mojo/system/transport_data.cc

   1 // Copyright 2014 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include "mojo/system/transport_data.h"
   6
   7 #include <string.h>
   8
   9 #include "base/compiler_specific.h"
  10 #include "base/logging.h"
  11 #include "mojo/system/channel.h"
  12 #include "mojo/system/constants.h"
  13 #include "mojo/system/message_in_transit.h"
  14
  15 namespace mojo {
  16 namespace system {
  17
  18 // The maximum amount of space needed per platform handle.
  19 // (|{Channel,RawChannel}::GetSerializedPlatformHandleSize()| should always
  20 // return a value which is at most this. This is only used to calculate
  21 // |TransportData::kMaxBufferSize|. This value should be a multiple of the
  22 // alignment in order to simplify calculations, even though the actual amount of
  23 // space needed need not be a multiple of the alignment.
  24 const size_t kMaxSizePerPlatformHandle = 8;
  25 COMPILE_ASSERT(kMaxSizePerPlatformHandle %
  26                        MessageInTransit::kMessageAlignment ==
  27                    0,
  28                kMaxSizePerPlatformHandle_not_a_multiple_of_alignment);
  29
  30 STATIC_CONST_MEMBER_DEFINITION const size_t
  31     TransportData::kMaxSerializedDispatcherSize;
  32 STATIC_CONST_MEMBER_DEFINITION const size_t
  33     TransportData::kMaxSerializedDispatcherPlatformHandles;
  34
  35 // static
  36 const size_t TransportData::kMaxPlatformHandles =
  37     kMaxMessageNumHandles * kMaxSerializedDispatcherPlatformHandles;
  38
  39 // In additional to the header, for each attached (Mojo) handle there'll be a
  40 // handle table entry and serialized dispatcher data.
  41 // Note: This definition must follow the one for |kMaxPlatformHandles|;
  42 // otherwise, we get a static initializer with gcc (but not clang).
  43 // static
  44 const size_t TransportData::kMaxBufferSize =
  45     sizeof(Header) +
  46     kMaxMessageNumHandles *
  47         (sizeof(HandleTableEntry) + kMaxSerializedDispatcherSize) +
  48     kMaxPlatformHandles * kMaxSizePerPlatformHandle;
  49
  50 struct TransportData::PrivateStructForCompileAsserts {
  51   // The size of |Header| must be a multiple of the alignment.
  52   COMPILE_ASSERT(sizeof(Header) % MessageInTransit::kMessageAlignment == 0,
  53                  sizeof_MessageInTransit_Header_invalid);
  54
  55   // The maximum serialized dispatcher size must be a multiple of the alignment.
  56   COMPILE_ASSERT(kMaxSerializedDispatcherSize %
  57                          MessageInTransit::kMessageAlignment ==
  58                      0,
  59                  kMaxSerializedDispatcherSize_not_a_multiple_of_alignment);
  60
  61   // The size of |HandleTableEntry| must be a multiple of the alignment.
  62   COMPILE_ASSERT(sizeof(HandleTableEntry) %
  63                          MessageInTransit::kMessageAlignment ==
  64                      0,
  65                  sizeof_MessageInTransit_HandleTableEntry_invalid);
  66 };
  67
  68 TransportData::TransportData(scoped_ptr<DispatcherVector> dispatchers,
  69                              Channel* channel) {
  70   DCHECK(dispatchers);
  71   DCHECK(channel);
  72
  73   const size_t num_handles = dispatchers->size();
  74   DCHECK_GT(num_handles, 0u);
  75
  76   // The offset to the start of the (Mojo) handle table.
  77   const size_t handle_table_start_offset = sizeof(Header);
  78   // The offset to the start of the serialized dispatcher data.
  79   const size_t serialized_dispatcher_start_offset =
  80       handle_table_start_offset + num_handles * sizeof(HandleTableEntry);
  81   // The estimated size of the secondary buffer. We compute this estimate below.
  82   // It must be at least as big as the (eventual) actual size.
  83   size_t estimated_size = serialized_dispatcher_start_offset;
  84   size_t estimated_num_platform_handles = 0;
  85 #if DCHECK_IS_ON
  86   std::vector<size_t> all_max_sizes(num_handles);
  87   std::vector<size_t> all_max_platform_handles(num_handles);
  88 #endif
  89   for (size_t i = 0; i < num_handles; i++) {
  90     if (Dispatcher* dispatcher = (*dispatchers)[i].get()) {
  91       size_t max_size = 0;
  92       size_t max_platform_handles = 0;
  93       Dispatcher::TransportDataAccess::StartSerialize(
  94           dispatcher, channel, &max_size, &max_platform_handles);
  95
  96       DCHECK_LE(max_size, kMaxSerializedDispatcherSize);
  97       estimated_size += MessageInTransit::RoundUpMessageAlignment(max_size);
  98       DCHECK_LE(estimated_size, kMaxBufferSize);
  99
 100       DCHECK_LE(max_platform_handles, kMaxSerializedDispatcherPlatformHandles);
 101       estimated_num_platform_handles += max_platform_handles;
 102       DCHECK_LE(estimated_num_platform_handles, kMaxPlatformHandles);
 103
 104 #if DCHECK_IS_ON
 105       all_max_sizes[i] = max_size;
 106       all_max_platform_handles[i] = max_platform_handles;
 107 #endif
 108     }
 109   }
 110
 111   size_t size_per_platform_handle = 0;
 112   if (estimated_num_platform_handles > 0) {
 113     size_per_platform_handle = channel->GetSerializedPlatformHandleSize();
 114     DCHECK_LE(size_per_platform_handle, kMaxSizePerPlatformHandle);
 115     estimated_size += estimated_num_platform_handles * size_per_platform_handle;
 116     estimated_size = MessageInTransit::RoundUpMessageAlignment(estimated_size);
 117     DCHECK_LE(estimated_size, kMaxBufferSize);
 118   }
 119
 120   buffer_.reset(static_cast<char*>(
 121       base::AlignedAlloc(estimated_size, MessageInTransit::kMessageAlignment)));
 122   // Entirely clear out the secondary buffer, since then we won't have to worry
 123   // about clearing padding or unused space (e.g., if a dispatcher fails to
 124   // serialize).
 125   memset(buffer_.get(), 0, estimated_size);
 126
 127   if (estimated_num_platform_handles > 0) {
 128     DCHECK(!platform_handles_);
 129     platform_handles_.reset(new embedder::PlatformHandleVector());
 130   }
 131
 132   Header* header = reinterpret_cast<Header*>(buffer_.get());
 133   header->num_handles = static_cast<uint32_t>(num_handles);
 134   // (Okay to leave |platform_handle_table_offset|, |num_platform_handles|, and
 135   // |unused| be zero; we'll set the former two later if necessary.)
 136
 137   HandleTableEntry* handle_table = reinterpret_cast<HandleTableEntry*>(
 138       buffer_.get() + handle_table_start_offset);
 139   size_t current_offset = serialized_dispatcher_start_offset;
 140   for (size_t i = 0; i < num_handles; i++) {
 141     Dispatcher* dispatcher = (*dispatchers)[i].get();
 142     if (!dispatcher) {
 143       COMPILE_ASSERT(Dispatcher::kTypeUnknown == 0,
 144                      value_of_Dispatcher_kTypeUnknown_must_be_zero);
 145       continue;
 146     }
 147
 148 #if DCHECK_IS_ON
 149     size_t old_platform_handles_size =
 150         platform_handles_ ? platform_handles_->size() : 0;
 151 #endif
 152
 153     void* destination = buffer_.get() + current_offset;
 154     size_t actual_size = 0;
 155     if (Dispatcher::TransportDataAccess::EndSerializeAndClose(
 156             dispatcher,
 157             channel,
 158             destination,
 159             &actual_size,
 160             platform_handles_.get())) {
 161       handle_table[i].type = static_cast<int32_t>(dispatcher->GetType());
 162       handle_table[i].offset = static_cast<uint32_t>(current_offset);
 163       handle_table[i].size = static_cast<uint32_t>(actual_size);
 164 // (Okay to not set |unused| since we cleared the entire buffer.)
 165
 166 #if DCHECK_IS_ON
 167       DCHECK_LE(actual_size, all_max_sizes[i]);
 168       DCHECK_LE(platform_handles_
 169                     ? (platform_handles_->size() - old_platform_handles_size)
 170                     : 0,
 171                 all_max_platform_handles[i]);
 172 #endif
 173     } else {
 174       // Nothing to do on failure, since |buffer_| was cleared, and
 175       // |kTypeUnknown| is zero. The handle was simply closed.
 176       LOG(ERROR) << "Failed to serialize handle to remote message pipe";
 177     }
 178
 179     current_offset += MessageInTransit::RoundUpMessageAlignment(actual_size);
 180     DCHECK_LE(current_offset, estimated_size);
 181     DCHECK_LE(platform_handles_ ? platform_handles_->size() : 0,
 182               estimated_num_platform_handles);
 183   }
 184
 185   if (platform_handles_ && platform_handles_->size() > 0) {
 186     header->platform_handle_table_offset =
 187         static_cast<uint32_t>(current_offset);
 188     header->num_platform_handles =
 189         static_cast<uint32_t>(platform_handles_->size());
 190     current_offset += platform_handles_->size() * size_per_platform_handle;
 191     current_offset = MessageInTransit::RoundUpMessageAlignment(current_offset);
 192   }
 193
 194   // There's no aligned realloc, so it's no good way to release unused space (if
 195   // we overshot our estimated space requirements).
 196   buffer_size_ = current_offset;
 197
 198   // |dispatchers_| will be destroyed as it goes out of scope.
 199 }
 200
 201 #if defined(OS_POSIX)
 202 TransportData::TransportData(
 203     embedder::ScopedPlatformHandleVectorPtr platform_handles)
 204     : buffer_size_(sizeof(Header)), platform_handles_(platform_handles.Pass()) {
 205   buffer_.reset(static_cast<char*>(
 206       base::AlignedAlloc(buffer_size_, MessageInTransit::kMessageAlignment)));
 207   memset(buffer_.get(), 0, buffer_size_);
 208 }
 209 #endif  // defined(OS_POSIX)
 210
 211 TransportData::~TransportData() {
 212 }
 213
 214 // static
 215 const char* TransportData::ValidateBuffer(
 216     size_t serialized_platform_handle_size,
 217     const void* buffer,
 218     size_t buffer_size) {
 219   DCHECK(buffer);
 220   DCHECK_GT(buffer_size, 0u);
 221
 222   // Always make sure that the buffer size is sane; if it's not, someone's
 223   // messing with us.
 224   if (buffer_size < sizeof(Header) || buffer_size > kMaxBufferSize ||
 225       buffer_size % MessageInTransit::kMessageAlignment != 0)
 226     return "Invalid message secondary buffer size";
 227
 228   const Header* header = static_cast<const Header*>(buffer);
 229   const size_t num_handles = header->num_handles;
 230
 231 #if !defined(OS_POSIX)
 232   // On POSIX, we send control messages with platform handles (but no handles)
 233   // attached (see the comments for
 234   // |TransportData(embedder::ScopedPlatformHandleVectorPtr)|. (This check isn't
 235   // important security-wise anyway.)
 236   if (num_handles == 0)
 237     return "Message has no handles attached, but secondary buffer present";
 238 #endif
 239
 240   // Sanity-check |num_handles| (before multiplying it against anything).
 241   if (num_handles > kMaxMessageNumHandles)
 242     return "Message handle payload too large";
 243
 244   if (buffer_size < sizeof(Header) + num_handles * sizeof(HandleTableEntry))
 245     return "Message secondary buffer too small";
 246
 247   if (header->num_platform_handles == 0) {
 248     // Then |platform_handle_table_offset| should also be zero.
 249     if (header->platform_handle_table_offset != 0) {
 250       return "Message has no handles attached, but platform handle table "
 251              "present";
 252     }
 253   } else {
 254     // |num_handles| has already been validated, so the multiplication is okay.
 255     if (header->num_platform_handles >
 256         num_handles * kMaxSerializedDispatcherPlatformHandles)
 257       return "Message has too many platform handles attached";
 258
 259     static const char kInvalidPlatformHandleTableOffset[] =
 260         "Message has invalid platform handle table offset";
 261     // This doesn't check that the platform handle table doesn't alias other
 262     // stuff, but it doesn't matter, since it's all read-only.
 263     if (header->platform_handle_table_offset %
 264             MessageInTransit::kMessageAlignment !=
 265         0)
 266       return kInvalidPlatformHandleTableOffset;
 267
 268     // ">" instead of ">=" since the size per handle may be zero.
 269     if (header->platform_handle_table_offset > buffer_size)
 270       return kInvalidPlatformHandleTableOffset;
 271
 272     // We already checked |platform_handle_table_offset| and
 273     // |num_platform_handles|, so the addition and multiplication are okay.
 274     if (header->platform_handle_table_offset +
 275             header->num_platform_handles * serialized_platform_handle_size >
 276         buffer_size)
 277       return kInvalidPlatformHandleTableOffset;
 278   }
 279
 280   const HandleTableEntry* handle_table =
 281       reinterpret_cast<const HandleTableEntry*>(
 282           static_cast<const char*>(buffer) + sizeof(Header));
 283   static const char kInvalidSerializedDispatcher[] =
 284       "Message contains invalid serialized dispatcher";
 285   for (size_t i = 0; i < num_handles; i++) {
 286     size_t offset = handle_table[i].offset;
 287     if (offset % MessageInTransit::kMessageAlignment != 0)
 288       return kInvalidSerializedDispatcher;
 289
 290     size_t size = handle_table[i].size;
 291     if (size > kMaxSerializedDispatcherSize || size > buffer_size)
 292       return kInvalidSerializedDispatcher;
 293
 294     // Note: This is an overflow-safe check for |offset + size > buffer_size|
 295     // (we know that |size <= buffer_size| from the previous check).
 296     if (offset > buffer_size - size)
 297       return kInvalidSerializedDispatcher;
 298   }
 299
 300   return NULL;
 301 }
 302
 303 // static
 304 void TransportData::GetPlatformHandleTable(const void* transport_data_buffer,
 305                                            size_t* num_platform_handles,
 306                                            const void** platform_handle_table) {
 307   DCHECK(transport_data_buffer);
 308   DCHECK(num_platform_handles);
 309   DCHECK(platform_handle_table);
 310
 311   const Header* header = static_cast<const Header*>(transport_data_buffer);
 312   *num_platform_handles = header->num_platform_handles;
 313   *platform_handle_table = static_cast<const char*>(transport_data_buffer) +
 314                            header->platform_handle_table_offset;
 315 }
 316
 317 // static
 318 scoped_ptr<DispatcherVector> TransportData::DeserializeDispatchers(
 319     const void* buffer,
 320     size_t buffer_size,
 321     embedder::ScopedPlatformHandleVectorPtr platform_handles,
 322     Channel* channel) {
 323   DCHECK(buffer);
 324   DCHECK_GT(buffer_size, 0u);
 325   DCHECK(channel);
 326
 327   const Header* header = static_cast<const Header*>(buffer);
 328   const size_t num_handles = header->num_handles;
 329   scoped_ptr<DispatcherVector> dispatchers(new DispatcherVector(num_handles));
 330
 331   const HandleTableEntry* handle_table =
 332       reinterpret_cast<const HandleTableEntry*>(
 333           static_cast<const char*>(buffer) + sizeof(Header));
 334   for (size_t i = 0; i < num_handles; i++) {
 335     size_t offset = handle_table[i].offset;
 336     size_t size = handle_table[i].size;
 337     // Should already have been checked by |ValidateBuffer()|:
 338     DCHECK_EQ(offset % MessageInTransit::kMessageAlignment, 0u);
 339     DCHECK_LE(offset, buffer_size);
 340     DCHECK_LE(offset + size, buffer_size);
 341
 342     const void* source = static_cast<const char*>(buffer) + offset;
 343     (*dispatchers)[i] = Dispatcher::TransportDataAccess::Deserialize(
 344         channel, handle_table[i].type, source, size, platform_handles.get());
 345   }
 346
 347   return dispatchers.Pass();
 348 }
 349
 350 }  // namespace system
 351 }  // namespace mojo