Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(108)

Side by Side Diff: chrome/browser/crash_handler_host_linux.cc

Issue 9838033: Upstream native crash handling changes for Android. (Closed) Base URL: http://git.chromium.org/git/chromium.git@trunk
Patch Set: In response to comments. Lots of linux to posix Created 8 years, 8 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View unified diff | Download patch | Annotate | Revision Log
OLDNEW
(Empty)
1 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file.
4
5 #include "chrome/browser/crash_handler_host_linux.h"
6
7 #include <stdint.h>
8 #include <stdlib.h>
9 #include <sys/socket.h>
10 #include <sys/syscall.h>
11 #include <unistd.h>
12
13 #include "base/bind.h"
14 #include "base/bind_helpers.h"
15 #include "base/eintr_wrapper.h"
16 #include "base/file_path.h"
17 #include "base/format_macros.h"
18 #include "base/linux_util.h"
19 #include "base/logging.h"
20 #include "base/memory/singleton.h"
21 #include "base/message_loop.h"
22 #include "base/path_service.h"
23 #include "base/rand_util.h"
24 #include "base/string_util.h"
25 #include "base/stringprintf.h"
26 #include "base/threading/thread.h"
27 #include "breakpad/src/client/linux/handler/exception_handler.h"
28 #include "breakpad/src/client/linux/minidump_writer/linux_dumper.h"
29 #include "breakpad/src/client/linux/minidump_writer/minidump_writer.h"
30 #include "chrome/app/breakpad_linux.h"
31 #include "chrome/common/chrome_paths.h"
32 #include "chrome/common/env_vars.h"
33 #include "content/public/browser/browser_thread.h"
34
35 using content::BrowserThread;
36 using google_breakpad::ExceptionHandler;
37
38 namespace {
39
40 // The length of the control message:
41 const unsigned kControlMsgSize =
42 CMSG_SPACE(2*sizeof(int)) + CMSG_SPACE(sizeof(struct ucred));
43 // The length of the regular payload:
44 const unsigned kCrashContextSize = sizeof(ExceptionHandler::CrashContext);
45
46 // Handles the crash dump and frees the allocated BreakpadInfo struct.
47 void CrashDumpTask(CrashHandlerHostLinux* handler, BreakpadInfo* info) {
48 if (handler->IsShuttingDown())
49 return;
50
51 HandleCrashDump(*info);
52 delete[] info->filename;
53 delete[] info->process_type;
54 delete[] info->crash_url;
55 delete[] info->guid;
56 delete[] info->distro;
57 delete info;
58 }
59
60 } // namespace
61
62 // Since classes derived from CrashHandlerHostLinux are singletons, it's only
63 // destroyed at the end of the processes lifetime, which is greater in span than
64 // the lifetime of the IO message loop. Thus, all calls to base::Bind() use
65 // non-refcounted pointers.
66
67 CrashHandlerHostLinux::CrashHandlerHostLinux()
68 : shutting_down_(false) {
69 int fds[2];
70 // We use SOCK_SEQPACKET rather than SOCK_DGRAM to prevent the process from
71 // sending datagrams to other sockets on the system. The sandbox may prevent
72 // the process from calling socket() to create new sockets, but it'll still
73 // inherit some sockets. With PF_UNIX+SOCK_DGRAM, it can call sendmsg to send
74 // a datagram to any (abstract) socket on the same system. With
75 // SOCK_SEQPACKET, this is prevented.
76 CHECK_EQ(socketpair(AF_UNIX, SOCK_SEQPACKET, 0, fds), 0);
77 static const int on = 1;
78
79 // Enable passcred on the server end of the socket
80 CHECK_EQ(setsockopt(fds[1], SOL_SOCKET, SO_PASSCRED, &on, sizeof(on)), 0);
81
82 process_socket_ = fds[0];
83 browser_socket_ = fds[1];
84
85 BrowserThread::PostTask(
86 BrowserThread::IO, FROM_HERE,
87 base::Bind(&CrashHandlerHostLinux::Init, base::Unretained(this)));
88 }
89
90 CrashHandlerHostLinux::~CrashHandlerHostLinux() {
91 HANDLE_EINTR(close(process_socket_));
92 HANDLE_EINTR(close(browser_socket_));
93 }
94
95 void CrashHandlerHostLinux::Init() {
96 MessageLoopForIO* ml = MessageLoopForIO::current();
97 CHECK(ml->WatchFileDescriptor(
98 browser_socket_, true /* persistent */,
99 MessageLoopForIO::WATCH_READ,
100 &file_descriptor_watcher_, this));
101 ml->AddDestructionObserver(this);
102 }
103
104 void CrashHandlerHostLinux::InitCrashUploaderThread() {
105 SetProcessType();
106 uploader_thread_.reset(
107 new base::Thread(std::string(process_type_ + "_crash_uploader").c_str()));
108 uploader_thread_->Start();
109 }
110
111 void CrashHandlerHostLinux::OnFileCanWriteWithoutBlocking(int fd) {
112 DCHECK(false);
113 }
114
115 void CrashHandlerHostLinux::OnFileCanReadWithoutBlocking(int fd) {
116 DCHECK_EQ(fd, browser_socket_);
117
118 // A process has crashed and has signaled us by writing a datagram
119 // to the death signal socket. The datagram contains the crash context needed
120 // for writing the minidump as well as a file descriptor and a credentials
121 // block so that they can't lie about their pid.
122
123 const size_t kIovSize = 7;
124 struct msghdr msg = {0};
125 struct iovec iov[kIovSize];
126
127 // Freed in WriteDumpFile();
128 char* crash_context = new char[kCrashContextSize];
129 // Freed in CrashDumpTask();
130 char* guid = new char[kGuidSize + 1];
131 char* crash_url = new char[kMaxActiveURLSize + 1];
132 char* distro = new char[kDistroSize + 1];
133
134 char* tid_buf_addr = NULL;
135 int tid_fd = -1;
136 uint64_t uptime;
137 char control[kControlMsgSize];
138 const ssize_t expected_msg_size =
139 kCrashContextSize +
140 kGuidSize + 1 +
141 kMaxActiveURLSize + 1 +
142 kDistroSize + 1 +
143 sizeof(tid_buf_addr) + sizeof(tid_fd) +
144 sizeof(uptime);
145
146 iov[0].iov_base = crash_context;
147 iov[0].iov_len = kCrashContextSize;
148 iov[1].iov_base = guid;
149 iov[1].iov_len = kGuidSize + 1;
150 iov[2].iov_base = crash_url;
151 iov[2].iov_len = kMaxActiveURLSize + 1;
152 iov[3].iov_base = distro;
153 iov[3].iov_len = kDistroSize + 1;
154 iov[4].iov_base = &tid_buf_addr;
155 iov[4].iov_len = sizeof(tid_buf_addr);
156 iov[5].iov_base = &tid_fd;
157 iov[5].iov_len = sizeof(tid_fd);
158 iov[6].iov_base = &uptime;
159 iov[6].iov_len = sizeof(uptime);
160 msg.msg_iov = iov;
161 msg.msg_iovlen = kIovSize;
162 msg.msg_control = control;
163 msg.msg_controllen = kControlMsgSize;
164
165 const ssize_t msg_size = HANDLE_EINTR(recvmsg(browser_socket_, &msg, 0));
166 if (msg_size != expected_msg_size) {
167 LOG(ERROR) << "Error reading from death signal socket. Crash dumping"
168 << " is disabled."
169 << " msg_size:" << msg_size
170 << " errno:" << errno;
171 file_descriptor_watcher_.StopWatchingFileDescriptor();
172 return;
173 }
174
175 if (msg.msg_controllen != kControlMsgSize ||
176 msg.msg_flags & ~MSG_TRUNC) {
177 LOG(ERROR) << "Received death signal message with the wrong size;"
178 << " msg.msg_controllen:" << msg.msg_controllen
179 << " msg.msg_flags:" << msg.msg_flags
180 << " kCrashContextSize:" << kCrashContextSize
181 << " kControlMsgSize:" << kControlMsgSize;
182 return;
183 }
184
185 // Walk the control payload an extract the file descriptor and validated pid.
186 pid_t crashing_pid = -1;
187 int partner_fd = -1;
188 int signal_fd = -1;
189 for (struct cmsghdr *hdr = CMSG_FIRSTHDR(&msg); hdr;
190 hdr = CMSG_NXTHDR(&msg, hdr)) {
191 if (hdr->cmsg_level != SOL_SOCKET)
192 continue;
193 if (hdr->cmsg_type == SCM_RIGHTS) {
194 const unsigned len = hdr->cmsg_len -
195 (((uint8_t*)CMSG_DATA(hdr)) - (uint8_t*)hdr);
196 DCHECK_EQ(len % sizeof(int), 0u);
197 const unsigned num_fds = len / sizeof(int);
198 if (num_fds != 2) {
199 // A nasty process could try and send us too many descriptors and
200 // force a leak.
201 LOG(ERROR) << "Death signal contained wrong number of descriptors;"
202 << " num_fds:" << num_fds;
203 for (unsigned i = 0; i < num_fds; ++i)
204 HANDLE_EINTR(close(reinterpret_cast<int*>(CMSG_DATA(hdr))[i]));
205 return;
206 } else {
207 partner_fd = reinterpret_cast<int*>(CMSG_DATA(hdr))[0];
208 signal_fd = reinterpret_cast<int*>(CMSG_DATA(hdr))[1];
209 }
210 } else if (hdr->cmsg_type == SCM_CREDENTIALS) {
211 const struct ucred *cred =
212 reinterpret_cast<struct ucred*>(CMSG_DATA(hdr));
213 crashing_pid = cred->pid;
214 }
215 }
216
217 if (crashing_pid == -1 || partner_fd == -1 || signal_fd == -1) {
218 LOG(ERROR) << "Death signal message didn't contain all expected control"
219 << " messages";
220 if (partner_fd >= 0)
221 HANDLE_EINTR(close(partner_fd));
222 if (signal_fd >= 0)
223 HANDLE_EINTR(close(signal_fd));
224 return;
225 }
226
227 // Kernel bug workaround (broken in 2.6.30 and 2.6.32, working in 2.6.38).
228 // The kernel doesn't translate PIDs in SCM_CREDENTIALS across PID
229 // namespaces. Thus |crashing_pid| might be garbage from our point of view.
230 // In the future we can remove this workaround, but we have to wait a couple
231 // of years to be sure that it's worked its way out into the world.
232 // TODO(thestig) Remove the workaround when Ubuntu Lucid is deprecated.
233
234 // The crashing process closes its copy of the signal_fd immediately after
235 // calling sendmsg(). We can thus not reliably look for with with
236 // FindProcessHoldingSocket(). But by necessity, it has to keep the
237 // partner_fd open until the crashdump is complete.
238 uint64_t inode_number;
239 if (!base::FileDescriptorGetInode(&inode_number, partner_fd)) {
240 LOG(WARNING) << "Failed to get inode number for passed socket";
241 HANDLE_EINTR(close(partner_fd));
242 HANDLE_EINTR(close(signal_fd));
243 return;
244 }
245 HANDLE_EINTR(close(partner_fd));
246
247 pid_t actual_crashing_pid = -1;
248 if (!base::FindProcessHoldingSocket(&actual_crashing_pid, inode_number)) {
249 LOG(WARNING) << "Failed to find process holding other end of crash reply "
250 "socket";
251 HANDLE_EINTR(close(signal_fd));
252 return;
253 }
254
255 crashing_pid = actual_crashing_pid;
256
257 // The crashing TID set inside the compromised context via
258 // sys_gettid() in ExceptionHandler::HandleSignal might be wrong (if
259 // the kernel supports PID namespacing) and may need to be
260 // translated.
261 //
262 // We expect the crashing thread to be in sys_read(), waiting for us to
263 // write to |signal_fd|. Most newer kernels where we have the different pid
264 // namespaces also have /proc/[pid]/syscall, so we can look through
265 // |actual_crashing_pid|'s thread group and find the thread that's in the
266 // read syscall with the right arguments.
267
268 std::string expected_syscall_data;
269 // /proc/[pid]/syscall is formatted as follows:
270 // syscall_number arg1 ... arg6 sp pc
271 // but we just check syscall_number through arg3.
272 base::StringAppendF(&expected_syscall_data, "%d 0x%x %p 0x1 ",
273 SYS_read, tid_fd, tid_buf_addr);
274 bool syscall_supported = false;
275 pid_t crashing_tid =
276 base::FindThreadIDWithSyscall(crashing_pid,
277 expected_syscall_data,
278 &syscall_supported);
279 if (crashing_tid == -1) {
280 // We didn't find the thread we want. Maybe it didn't reach
281 // sys_read() yet or the thread went away. We'll just take a
282 // guess here and assume the crashing thread is the thread group
283 // leader. If procfs syscall is not supported by the kernel, then
284 // we assume the kernel also does not support TID namespacing and
285 // trust the TID passed by the crashing process.
286 LOG(WARNING) << "Could not translate tid - assuming crashing thread is "
287 "thread group leader; syscall_supported=" << syscall_supported;
288 crashing_tid = crashing_pid;
289 }
290
291 ExceptionHandler::CrashContext* bad_context =
292 reinterpret_cast<ExceptionHandler::CrashContext*>(crash_context);
293 bad_context->tid = crashing_tid;
294
295 // Sanitize the string data a bit more
296 guid[kGuidSize] = crash_url[kMaxActiveURLSize] = distro[kDistroSize] = 0;
297
298 // Freed in CrashDumpTask();
299 BreakpadInfo* info = new BreakpadInfo;
300
301 info->process_type_length = process_type_.length();
302 char* process_type_str = new char[info->process_type_length + 1];
303 process_type_.copy(process_type_str, info->process_type_length);
304 process_type_str[info->process_type_length] = '\0';
305 info->process_type = process_type_str;
306
307 info->crash_url_length = strlen(crash_url);
308 info->crash_url = crash_url;
309
310 info->guid_length = strlen(guid);
311 info->guid = guid;
312
313 info->distro_length = strlen(distro);
314 info->distro = distro;
315
316 info->upload = (getenv(env_vars::kHeadless) == NULL);
317 info->process_start_time = uptime;
318
319 BrowserThread::PostTask(
320 BrowserThread::FILE, FROM_HERE,
321 base::Bind(&CrashHandlerHostLinux::WriteDumpFile,
322 base::Unretained(this),
323 info,
324 crashing_pid,
325 crash_context,
326 signal_fd));
327 }
328
329 void CrashHandlerHostLinux::WriteDumpFile(BreakpadInfo* info,
330 pid_t crashing_pid,
331 char* crash_context,
332 int signal_fd) {
333 DCHECK(BrowserThread::CurrentlyOn(BrowserThread::FILE));
334
335 FilePath dumps_path("/tmp");
336 PathService::Get(base::DIR_TEMP, &dumps_path);
337 if (!info->upload)
338 PathService::Get(chrome::DIR_CRASH_DUMPS, &dumps_path);
339 const uint64 rand = base::RandUint64();
340 const std::string minidump_filename =
341 base::StringPrintf("%s/chromium-%s-minidump-%016" PRIx64 ".dmp",
342 dumps_path.value().c_str(),
343 process_type_.c_str(),
344 rand);
345 if (!google_breakpad::WriteMinidump(minidump_filename.c_str(),
346 crashing_pid, crash_context,
347 kCrashContextSize)) {
348 LOG(ERROR) << "Failed to write crash dump for pid " << crashing_pid;
349 }
350 delete[] crash_context;
351
352 // Freed in CrashDumpTask();
353 char* minidump_filename_str = new char[minidump_filename.length() + 1];
354 minidump_filename.copy(minidump_filename_str, minidump_filename.length());
355 minidump_filename_str[minidump_filename.length()] = '\0';
356 info->filename = minidump_filename_str;
357
358 BrowserThread::PostTask(
359 BrowserThread::IO, FROM_HERE,
360 base::Bind(&CrashHandlerHostLinux::QueueCrashDumpTask,
361 base::Unretained(this),
362 info,
363 signal_fd));
364 }
365
366 void CrashHandlerHostLinux::QueueCrashDumpTask(BreakpadInfo* info,
367 int signal_fd) {
368 DCHECK(BrowserThread::CurrentlyOn(BrowserThread::IO));
369
370 // Send the done signal to the process: it can exit now.
371 struct msghdr msg = {0};
372 struct iovec done_iov;
373 done_iov.iov_base = const_cast<char*>("\x42");
374 done_iov.iov_len = 1;
375 msg.msg_iov = &done_iov;
376 msg.msg_iovlen = 1;
377
378 HANDLE_EINTR(sendmsg(signal_fd, &msg, MSG_DONTWAIT | MSG_NOSIGNAL));
379 HANDLE_EINTR(close(signal_fd));
380
381 uploader_thread_->message_loop()->PostTask(
382 FROM_HERE,
383 base::Bind(&CrashDumpTask, base::Unretained(this), info));
384 }
385
386 void CrashHandlerHostLinux::WillDestroyCurrentMessageLoop() {
387 file_descriptor_watcher_.StopWatchingFileDescriptor();
388
389 // If we are quitting and there are crash dumps in the queue, turn them into
390 // no-ops.
391 shutting_down_ = true;
392 uploader_thread_->Stop();
393 }
394
395 bool CrashHandlerHostLinux::IsShuttingDown() const {
396 return shutting_down_;
397 }
398
399 ExtensionCrashHandlerHostLinux::ExtensionCrashHandlerHostLinux() {
400 InitCrashUploaderThread();
401 }
402
403 ExtensionCrashHandlerHostLinux::~ExtensionCrashHandlerHostLinux() {
404 }
405
406 void ExtensionCrashHandlerHostLinux::SetProcessType() {
407 process_type_ = "extension";
408 }
409
410 // static
411 ExtensionCrashHandlerHostLinux* ExtensionCrashHandlerHostLinux::GetInstance() {
412 return Singleton<ExtensionCrashHandlerHostLinux>::get();
413 }
414
415 GpuCrashHandlerHostLinux::GpuCrashHandlerHostLinux() {
416 InitCrashUploaderThread();
417 }
418
419 GpuCrashHandlerHostLinux::~GpuCrashHandlerHostLinux() {
420 }
421
422 void GpuCrashHandlerHostLinux::SetProcessType() {
423 process_type_ = "gpu-process";
424 }
425
426 // static
427 GpuCrashHandlerHostLinux* GpuCrashHandlerHostLinux::GetInstance() {
428 return Singleton<GpuCrashHandlerHostLinux>::get();
429 }
430
431 PluginCrashHandlerHostLinux::PluginCrashHandlerHostLinux() {
432 InitCrashUploaderThread();
433 }
434
435 PluginCrashHandlerHostLinux::~PluginCrashHandlerHostLinux() {
436 }
437
438 void PluginCrashHandlerHostLinux::SetProcessType() {
439 process_type_ = "plugin";
440 }
441
442 // static
443 PluginCrashHandlerHostLinux* PluginCrashHandlerHostLinux::GetInstance() {
444 return Singleton<PluginCrashHandlerHostLinux>::get();
445 }
446
447 PpapiCrashHandlerHostLinux::PpapiCrashHandlerHostLinux() {
448 InitCrashUploaderThread();
449 }
450
451 PpapiCrashHandlerHostLinux::~PpapiCrashHandlerHostLinux() {
452 }
453
454 void PpapiCrashHandlerHostLinux::SetProcessType() {
455 process_type_ = "ppapi";
456 }
457
458 // static
459 PpapiCrashHandlerHostLinux* PpapiCrashHandlerHostLinux::GetInstance() {
460 return Singleton<PpapiCrashHandlerHostLinux>::get();
461 }
462
463 RendererCrashHandlerHostLinux::RendererCrashHandlerHostLinux() {
464 InitCrashUploaderThread();
465 }
466
467 RendererCrashHandlerHostLinux::~RendererCrashHandlerHostLinux() {
468 }
469
470 void RendererCrashHandlerHostLinux::SetProcessType() {
471 process_type_ = "renderer";
472 }
473
474 // static
475 RendererCrashHandlerHostLinux* RendererCrashHandlerHostLinux::GetInstance() {
476 return Singleton<RendererCrashHandlerHostLinux>::get();
477 }
OLDNEW

Powered by Google App Engine
This is Rietveld 408576698