components/crash/content/browser/crash_handler_host_linux.cc

   1 // Copyright 2013 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include "components/crash/content/browser/crash_handler_host_linux.h"
   6
   7 #include <stdint.h>
   8 #include <stdlib.h>
   9 #include <sys/socket.h>
  10 #include <sys/syscall.h>
  11 #include <unistd.h>
  12
  13 #include "base/bind.h"
  14 #include "base/bind_helpers.h"
  15 #include "base/files/file_path.h"
  16 #include "base/files/file_util.h"
  17 #include "base/files/scoped_file.h"
  18 #include "base/format_macros.h"
  19 #include "base/linux_util.h"
  20 #include "base/location.h"
  21 #include "base/logging.h"
  22 #include "base/path_service.h"
  23 #include "base/posix/eintr_wrapper.h"
  24 #include "base/rand_util.h"
  25 #include "base/single_thread_task_runner.h"
  26 #include "base/strings/string_util.h"
  27 #include "base/strings/stringprintf.h"
  28 #include "base/threading/thread.h"
  29 #include "breakpad/src/client/linux/handler/exception_handler.h"
  30 #include "breakpad/src/client/linux/minidump_writer/linux_dumper.h"
  31 #include "breakpad/src/client/linux/minidump_writer/minidump_writer.h"
  32 #include "components/crash/content/app/breakpad_linux_impl.h"
  33 #include "content/public/browser/browser_thread.h"
  34
  35 #if defined(OS_ANDROID) && !defined(__LP64__)
  36 #include <sys/linux-syscalls.h>
  37
  38 #define SYS_read __NR_read
  39 #endif
  40
  41 using content::BrowserThread;
  42 using google_breakpad::ExceptionHandler;
  43
  44 namespace breakpad {
  45
  46 namespace {
  47
  48 const size_t kNumFDs = 1;
  49 // The length of the control message:
  50 const size_t kControlMsgSize =
  51     CMSG_SPACE(kNumFDs * sizeof(int)) + CMSG_SPACE(sizeof(struct ucred));
  52 // The length of the regular payload:
  53 const size_t kCrashContextSize = sizeof(ExceptionHandler::CrashContext);
  54
  55 // Handles the crash dump and frees the allocated BreakpadInfo struct.
  56 void CrashDumpTask(CrashHandlerHostLinux* handler,
  57                    scoped_ptr<BreakpadInfo> info) {
  58   if (handler->IsShuttingDown() && info->upload) {
  59     base::DeleteFile(base::FilePath(info->filename), false);
  60 #if defined(ADDRESS_SANITIZER)
  61     base::DeleteFile(base::FilePath(info->log_filename), false);
  62 #endif
  63     return;
  64   }
  65
  66   HandleCrashDump(*info);
  67   delete[] info->filename;
  68 #if defined(ADDRESS_SANITIZER)
  69   delete[] info->log_filename;
  70   delete[] info->asan_report_str;
  71 #endif
  72   delete[] info->process_type;
  73   delete[] info->distro;
  74   delete info->crash_keys;
  75 }
  76
  77 }  // namespace
  78
  79 // Since instances of CrashHandlerHostLinux are leaked, they are only destroyed
  80 // at the end of the processes lifetime, which is greater in span than the
  81 // lifetime of the IO message loop. Thus, all calls to base::Bind() use
  82 // non-refcounted pointers.
  83
  84 CrashHandlerHostLinux::CrashHandlerHostLinux(const std::string& process_type,
  85                                              const base::FilePath& dumps_path,
  86                                              bool upload)
  87     : process_type_(process_type),
  88       dumps_path_(dumps_path),
  89       upload_(upload),
  90       shutting_down_(false),
  91       worker_pool_token_(BrowserThread::GetBlockingPool()->GetSequenceToken()) {
  92   int fds[2];
  93   // We use SOCK_SEQPACKET rather than SOCK_DGRAM to prevent the process from
  94   // sending datagrams to other sockets on the system. The sandbox may prevent
  95   // the process from calling socket() to create new sockets, but it'll still
  96   // inherit some sockets. With PF_UNIX+SOCK_DGRAM, it can call sendmsg to send
  97   // a datagram to any (abstract) socket on the same system. With
  98   // SOCK_SEQPACKET, this is prevented.
  99   CHECK_EQ(0, socketpair(AF_UNIX, SOCK_SEQPACKET, 0, fds));
 100   static const int on = 1;
 101
 102   // Enable passcred on the server end of the socket
 103   CHECK_EQ(0, setsockopt(fds[1], SOL_SOCKET, SO_PASSCRED, &on, sizeof(on)));
 104
 105   process_socket_ = fds[0];
 106   browser_socket_ = fds[1];
 107
 108   BrowserThread::PostTask(
 109       BrowserThread::IO, FROM_HERE,
 110       base::Bind(&CrashHandlerHostLinux::Init, base::Unretained(this)));
 111 }
 112
 113 CrashHandlerHostLinux::~CrashHandlerHostLinux() {
 114   close(process_socket_);
 115   close(browser_socket_);
 116 }
 117
 118 void CrashHandlerHostLinux::StartUploaderThread() {
 119   uploader_thread_.reset(
 120       new base::Thread(process_type_ + "_crash_uploader"));
 121   uploader_thread_->Start();
 122 }
 123
 124 void CrashHandlerHostLinux::Init() {
 125   base::MessageLoopForIO* ml = base::MessageLoopForIO::current();
 126   CHECK(ml->WatchFileDescriptor(
 127       browser_socket_, true /* persistent */,
 128       base::MessageLoopForIO::WATCH_READ,
 129       &file_descriptor_watcher_, this));
 130   ml->AddDestructionObserver(this);
 131 }
 132
 133 void CrashHandlerHostLinux::OnFileCanWriteWithoutBlocking(int fd) {
 134   NOTREACHED();
 135 }
 136
 137 void CrashHandlerHostLinux::OnFileCanReadWithoutBlocking(int fd) {
 138   DCHECK_EQ(browser_socket_, fd);
 139
 140   // A process has crashed and has signaled us by writing a datagram
 141   // to the death signal socket. The datagram contains the crash context needed
 142   // for writing the minidump as well as a file descriptor and a credentials
 143   // block so that they can't lie about their pid.
 144   //
 145   // The message sender is in components/crash/content/app/breakpad_linux.cc.
 146
 147   struct msghdr msg = {0};
 148   struct iovec iov[kCrashIovSize];
 149
 150   scoped_ptr<char[]> crash_context(new char[kCrashContextSize]);
 151 #if defined(ADDRESS_SANITIZER)
 152   scoped_ptr<char[]> asan_report(new char[kMaxAsanReportSize + 1]);
 153 #endif
 154
 155   scoped_ptr<CrashKeyStorage> crash_keys(new CrashKeyStorage);
 156   google_breakpad::SerializedNonAllocatingMap* serialized_crash_keys;
 157   size_t crash_keys_size = crash_keys->Serialize(
 158       const_cast<const google_breakpad::SerializedNonAllocatingMap**>(
 159           &serialized_crash_keys));
 160
 161   char* tid_buf_addr = NULL;
 162   int tid_fd = -1;
 163   uint64_t uptime;
 164   size_t oom_size;
 165   char control[kControlMsgSize];
 166   const ssize_t expected_msg_size =
 167       kCrashContextSize +
 168       sizeof(tid_buf_addr) + sizeof(tid_fd) +
 169       sizeof(uptime) +
 170 #if defined(ADDRESS_SANITIZER)
 171       kMaxAsanReportSize + 1 +
 172 #endif
 173       sizeof(oom_size) +
 174       crash_keys_size;
 175   iov[0].iov_base = crash_context.get();
 176   iov[0].iov_len = kCrashContextSize;
 177   iov[1].iov_base = &tid_buf_addr;
 178   iov[1].iov_len = sizeof(tid_buf_addr);
 179   iov[2].iov_base = &tid_fd;
 180   iov[2].iov_len = sizeof(tid_fd);
 181   iov[3].iov_base = &uptime;
 182   iov[3].iov_len = sizeof(uptime);
 183   iov[4].iov_base = &oom_size;
 184   iov[4].iov_len = sizeof(oom_size);
 185   iov[5].iov_base = serialized_crash_keys;
 186   iov[5].iov_len = crash_keys_size;
 187 #if !defined(ADDRESS_SANITIZER)
 188   static_assert(5 == kCrashIovSize - 1, "kCrashIovSize should equal 6");
 189 #else
 190   iov[6].iov_base = asan_report.get();
 191   iov[6].iov_len = kMaxAsanReportSize + 1;
 192   static_assert(6 == kCrashIovSize - 1, "kCrashIovSize should equal 7");
 193 #endif
 194   msg.msg_iov = iov;
 195   msg.msg_iovlen = kCrashIovSize;
 196   msg.msg_control = control;
 197   msg.msg_controllen = kControlMsgSize;
 198
 199   const ssize_t msg_size = HANDLE_EINTR(recvmsg(browser_socket_, &msg, 0));
 200   if (msg_size < 0) {
 201     LOG(ERROR) << "Error reading from death signal socket. Crash dumping"
 202                << " is disabled."
 203                << " msg_size:" << msg_size
 204                << " errno:" << errno;
 205     file_descriptor_watcher_.StopWatchingFileDescriptor();
 206     return;
 207   }
 208   const bool bad_message = (msg_size != expected_msg_size ||
 209                             msg.msg_controllen != kControlMsgSize ||
 210                             msg.msg_flags & ~MSG_TRUNC);
 211   base::ScopedFD signal_fd;
 212   pid_t crashing_pid = -1;
 213   if (msg.msg_controllen > 0) {
 214     // Walk the control payload and extract the file descriptor and
 215     // validated pid.
 216     for (struct cmsghdr *hdr = CMSG_FIRSTHDR(&msg); hdr;
 217          hdr = CMSG_NXTHDR(&msg, hdr)) {
 218       if (hdr->cmsg_level != SOL_SOCKET)
 219         continue;
 220       if (hdr->cmsg_type == SCM_RIGHTS) {
 221         const size_t len = hdr->cmsg_len -
 222             (((uint8_t*)CMSG_DATA(hdr)) - (uint8_t*)hdr);
 223         DCHECK_EQ(0U, len % sizeof(int));
 224         const size_t num_fds = len / sizeof(int);
 225         if (num_fds != kNumFDs) {
 226           // A nasty process could try and send us too many descriptors and
 227           // force a leak.
 228           LOG(ERROR) << "Death signal contained wrong number of descriptors;"
 229                      << " num_fds:" << num_fds;
 230           for (size_t i = 0; i < num_fds; ++i)
 231             close(reinterpret_cast<int*>(CMSG_DATA(hdr))[i]);
 232           return;
 233         }
 234         DCHECK(!signal_fd.is_valid());
 235         int fd = reinterpret_cast<int*>(CMSG_DATA(hdr))[0];
 236         DCHECK_GE(fd, 0);  // The kernel should never send a negative fd.
 237         signal_fd.reset(fd);
 238       } else if (hdr->cmsg_type == SCM_CREDENTIALS) {
 239         DCHECK_EQ(-1, crashing_pid);
 240         const struct ucred *cred =
 241             reinterpret_cast<struct ucred*>(CMSG_DATA(hdr));
 242         crashing_pid = cred->pid;
 243       }
 244     }
 245   }
 246
 247   if (bad_message) {
 248     LOG(ERROR) << "Received death signal message with the wrong size;"
 249                << " msg.msg_controllen:" << msg.msg_controllen
 250                << " msg.msg_flags:" << msg.msg_flags
 251                << " kCrashContextSize:" << kCrashContextSize
 252                << " kControlMsgSize:" << kControlMsgSize;
 253     return;
 254   }
 255   if (crashing_pid == -1 || !signal_fd.is_valid()) {
 256     LOG(ERROR) << "Death signal message didn't contain all expected control"
 257                << " messages";
 258     return;
 259   }
 260
 261   // The crashing TID set inside the compromised context via
 262   // sys_gettid() in ExceptionHandler::HandleSignal might be wrong (if
 263   // the kernel supports PID namespacing) and may need to be
 264   // translated.
 265   //
 266   // We expect the crashing thread to be in sys_read(), waiting for us to
 267   // write to |signal_fd|. Most newer kernels where we have the different pid
 268   // namespaces also have /proc/[pid]/syscall, so we can look through
 269   // |actual_crashing_pid|'s thread group and find the thread that's in the
 270   // read syscall with the right arguments.
 271
 272   std::string expected_syscall_data;
 273   // /proc/[pid]/syscall is formatted as follows:
 274   // syscall_number arg1 ... arg6 sp pc
 275   // but we just check syscall_number through arg3.
 276   base::StringAppendF(&expected_syscall_data, "%d 0x%x %p 0x1 ",
 277                       SYS_read, tid_fd, tid_buf_addr);
 278   bool syscall_supported = false;
 279   pid_t crashing_tid =
 280       base::FindThreadIDWithSyscall(crashing_pid,
 281                                     expected_syscall_data,
 282                                     &syscall_supported);
 283   if (crashing_tid == -1) {
 284     // We didn't find the thread we want. Maybe it didn't reach
 285     // sys_read() yet or the thread went away.  We'll just take a
 286     // guess here and assume the crashing thread is the thread group
 287     // leader.  If procfs syscall is not supported by the kernel, then
 288     // we assume the kernel also does not support TID namespacing and
 289     // trust the TID passed by the crashing process.
 290     LOG(WARNING) << "Could not translate tid - assuming crashing thread is "
 291         "thread group leader; syscall_supported=" << syscall_supported;
 292     crashing_tid = crashing_pid;
 293   }
 294
 295   ExceptionHandler::CrashContext* bad_context =
 296       reinterpret_cast<ExceptionHandler::CrashContext*>(crash_context.get());
 297   bad_context->tid = crashing_tid;
 298
 299   scoped_ptr<BreakpadInfo> info(new BreakpadInfo);
 300
 301   info->fd = -1;
 302   info->process_type_length = process_type_.length();
 303   // Freed in CrashDumpTask().
 304   char* process_type_str = new char[info->process_type_length + 1];
 305   process_type_.copy(process_type_str, info->process_type_length);
 306   process_type_str[info->process_type_length] = '\0';
 307   info->process_type = process_type_str;
 308
 309   // Memory released from scoped_ptrs below are also freed in CrashDumpTask().
 310   info->crash_keys = crash_keys.release();
 311 #if defined(ADDRESS_SANITIZER)
 312   asan_report[kMaxAsanReportSize] = '\0';
 313   info->asan_report_str = asan_report.release();
 314   info->asan_report_length = strlen(info->asan_report_str);
 315 #endif
 316
 317   info->process_start_time = uptime;
 318   info->oom_size = oom_size;
 319 #if defined(OS_ANDROID)
 320   // Nothing gets uploaded in android.
 321   info->upload = false;
 322 #else
 323   info->upload = upload_;
 324 #endif
 325
 326
 327   BrowserThread::GetBlockingPool()->PostSequencedWorkerTask(
 328       worker_pool_token_,
 329       FROM_HERE,
 330       base::Bind(&CrashHandlerHostLinux::WriteDumpFile,
 331                  base::Unretained(this),
 332                  base::Passed(&info),
 333                  base::Passed(&crash_context),
 334                  crashing_pid,
 335                  signal_fd.release()));
 336 }
 337
 338 void CrashHandlerHostLinux::WriteDumpFile(scoped_ptr<BreakpadInfo> info,
 339                                           scoped_ptr<char[]> crash_context,
 340                                           pid_t crashing_pid,
 341                                           int signal_fd) {
 342   DCHECK(BrowserThread::GetBlockingPool()->IsRunningSequenceOnCurrentThread(
 343       worker_pool_token_));
 344
 345   // Set |info->distro| here because base::GetLinuxDistro() needs to run on a
 346   // blocking thread.
 347   std::string distro = base::GetLinuxDistro();
 348   info->distro_length = distro.length();
 349   // Freed in CrashDumpTask().
 350   char* distro_str = new char[info->distro_length + 1];
 351   distro.copy(distro_str, info->distro_length);
 352   distro_str[info->distro_length] = '\0';
 353   info->distro = distro_str;
 354
 355   base::FilePath dumps_path("/tmp");
 356   PathService::Get(base::DIR_TEMP, &dumps_path);
 357   if (!info->upload)
 358     dumps_path = dumps_path_;
 359   const std::string minidump_filename =
 360       base::StringPrintf("%s/chromium-%s-minidump-%016" PRIx64 ".dmp",
 361                          dumps_path.value().c_str(),
 362                          process_type_.c_str(),
 363                          base::RandUint64());
 364
 365   if (!google_breakpad::WriteMinidump(minidump_filename.c_str(),
 366                                       kMaxMinidumpFileSize,
 367                                       crashing_pid,
 368                                       crash_context.get(),
 369                                       kCrashContextSize,
 370                                       google_breakpad::MappingList(),
 371                                       google_breakpad::AppMemoryList())) {
 372     LOG(ERROR) << "Failed to write crash dump for pid " << crashing_pid;
 373   }
 374 #if defined(ADDRESS_SANITIZER)
 375   // Create a temporary file holding the AddressSanitizer report.
 376   const base::FilePath log_path =
 377       base::FilePath(minidump_filename).ReplaceExtension("log");
 378   base::WriteFile(log_path, info->asan_report_str, info->asan_report_length);
 379 #endif
 380
 381   // Freed in CrashDumpTask().
 382   char* minidump_filename_str = new char[minidump_filename.length() + 1];
 383   minidump_filename.copy(minidump_filename_str, minidump_filename.length());
 384   minidump_filename_str[minidump_filename.length()] = '\0';
 385   info->filename = minidump_filename_str;
 386 #if defined(ADDRESS_SANITIZER)
 387   // Freed in CrashDumpTask().
 388   char* minidump_log_filename_str = new char[minidump_filename.length() + 1];
 389   minidump_filename.copy(minidump_log_filename_str, minidump_filename.length());
 390   memcpy(minidump_log_filename_str + minidump_filename.length() - 3, "log", 3);
 391   minidump_log_filename_str[minidump_filename.length()] = '\0';
 392   info->log_filename = minidump_log_filename_str;
 393 #endif
 394   info->pid = crashing_pid;
 395
 396   BrowserThread::PostTask(
 397       BrowserThread::IO, FROM_HERE,
 398       base::Bind(&CrashHandlerHostLinux::QueueCrashDumpTask,
 399                  base::Unretained(this),
 400                  base::Passed(&info),
 401                  signal_fd));
 402 }
 403
 404 void CrashHandlerHostLinux::QueueCrashDumpTask(scoped_ptr<BreakpadInfo> info,
 405                                                int signal_fd) {
 406   DCHECK_CURRENTLY_ON(BrowserThread::IO);
 407
 408   // Send the done signal to the process: it can exit now.
 409   struct msghdr msg = {0};
 410   struct iovec done_iov;
 411   done_iov.iov_base = const_cast<char*>("\x42");
 412   done_iov.iov_len = 1;
 413   msg.msg_iov = &done_iov;
 414   msg.msg_iovlen = 1;
 415
 416   HANDLE_EINTR(sendmsg(signal_fd, &msg, MSG_DONTWAIT | MSG_NOSIGNAL));
 417   close(signal_fd);
 418
 419   uploader_thread_->task_runner()->PostTask(
 420       FROM_HERE,
 421       base::Bind(&CrashDumpTask, base::Unretained(this), base::Passed(&info)));
 422 }
 423
 424 void CrashHandlerHostLinux::WillDestroyCurrentMessageLoop() {
 425   file_descriptor_watcher_.StopWatchingFileDescriptor();
 426
 427   // If we are quitting and there are crash dumps in the queue, turn them into
 428   // no-ops.
 429   shutting_down_ = true;
 430   uploader_thread_->Stop();
 431 }
 432
 433 bool CrashHandlerHostLinux::IsShuttingDown() const {
 434   return shutting_down_;
 435 }
 436
 437 }  // namespace breakpad