mojo/edk/system/transport_data.cc

   1 // Copyright 2014 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include "mojo/edk/system/transport_data.h"
   6
   7 #include <string.h>
   8
   9 #include "base/compiler_specific.h"
  10 #include "base/logging.h"
  11 #include "mojo/edk/system/channel.h"
  12 #include "mojo/edk/system/configuration.h"
  13 #include "mojo/edk/system/message_in_transit.h"
  14
  15 namespace mojo {
  16 namespace system {
  17
  18 // The maximum amount of space needed per platform handle.
  19 // (|{Channel,RawChannel}::GetSerializedPlatformHandleSize()| should always
  20 // return a value which is at most this. This is only used to calculate
  21 // |TransportData::kMaxBufferSize|. This value should be a multiple of the
  22 // alignment in order to simplify calculations, even though the actual amount of
  23 // space needed need not be a multiple of the alignment.
  24 const size_t kMaxSizePerPlatformHandle = 8;
  25 static_assert(kMaxSizePerPlatformHandle % MessageInTransit::kMessageAlignment ==
  26                   0,
  27               "kMaxSizePerPlatformHandle not a multiple of alignment");
  28
  29 STATIC_CONST_MEMBER_DEFINITION const size_t
  30     TransportData::kMaxSerializedDispatcherSize;
  31 STATIC_CONST_MEMBER_DEFINITION const size_t
  32     TransportData::kMaxSerializedDispatcherPlatformHandles;
  33
  34 // static
  35 size_t TransportData::GetMaxBufferSize() {
  36   // In additional to the header, for each attached (Mojo) handle there'll be a
  37   // handle table entry and serialized dispatcher data.
  38   return sizeof(Header) +
  39          GetConfiguration().max_message_num_handles *
  40              (sizeof(HandleTableEntry) + kMaxSerializedDispatcherSize) +
  41          GetMaxPlatformHandles() * kMaxSizePerPlatformHandle;
  42 }
  43
  44 // static
  45 size_t TransportData::GetMaxPlatformHandles() {
  46   return GetConfiguration().max_message_num_handles *
  47          kMaxSerializedDispatcherPlatformHandles;
  48 }
  49
  50 struct TransportData::PrivateStructForCompileAsserts {
  51   static_assert(sizeof(Header) % MessageInTransit::kMessageAlignment == 0,
  52                 "sizeof(MessageInTransit::Header) not a multiple of alignment");
  53   static_assert(kMaxSerializedDispatcherSize %
  54                         MessageInTransit::kMessageAlignment ==
  55                     0,
  56                 "kMaxSerializedDispatcherSize not a multiple of alignment");
  57   static_assert(sizeof(HandleTableEntry) %
  58                         MessageInTransit::kMessageAlignment ==
  59                     0,
  60                 "sizeof(MessageInTransit::HandleTableEntry) not a multiple of "
  61                 "alignment");
  62 };
  63
  64 TransportData::TransportData(scoped_ptr<DispatcherVector> dispatchers,
  65                              Channel* channel) {
  66   DCHECK(dispatchers);
  67   DCHECK(channel);
  68
  69   const size_t num_handles = dispatchers->size();
  70   DCHECK_GT(num_handles, 0u);
  71
  72   // The offset to the start of the (Mojo) handle table.
  73   const size_t handle_table_start_offset = sizeof(Header);
  74   // The offset to the start of the serialized dispatcher data.
  75   const size_t serialized_dispatcher_start_offset =
  76       handle_table_start_offset + num_handles * sizeof(HandleTableEntry);
  77   // The estimated size of the secondary buffer. We compute this estimate below.
  78   // It must be at least as big as the (eventual) actual size.
  79   size_t estimated_size = serialized_dispatcher_start_offset;
  80   size_t estimated_num_platform_handles = 0;
  81 #if DCHECK_IS_ON()
  82   std::vector<size_t> all_max_sizes(num_handles);
  83   std::vector<size_t> all_max_platform_handles(num_handles);
  84 #endif
  85   for (size_t i = 0; i < num_handles; i++) {
  86     if (Dispatcher* dispatcher = (*dispatchers)[i].get()) {
  87       size_t max_size = 0;
  88       size_t max_platform_handles = 0;
  89       Dispatcher::TransportDataAccess::StartSerialize(
  90           dispatcher, channel, &max_size, &max_platform_handles);
  91
  92       DCHECK_LE(max_size, kMaxSerializedDispatcherSize);
  93       estimated_size += MessageInTransit::RoundUpMessageAlignment(max_size);
  94       DCHECK_LE(estimated_size, GetMaxBufferSize());
  95
  96       DCHECK_LE(max_platform_handles, kMaxSerializedDispatcherPlatformHandles);
  97       estimated_num_platform_handles += max_platform_handles;
  98       DCHECK_LE(estimated_num_platform_handles, GetMaxPlatformHandles());
  99
 100 #if DCHECK_IS_ON()
 101       all_max_sizes[i] = max_size;
 102       all_max_platform_handles[i] = max_platform_handles;
 103 #endif
 104     }
 105   }
 106
 107   size_t size_per_platform_handle = 0;
 108   if (estimated_num_platform_handles > 0) {
 109     size_per_platform_handle = channel->GetSerializedPlatformHandleSize();
 110     DCHECK_LE(size_per_platform_handle, kMaxSizePerPlatformHandle);
 111     estimated_size += estimated_num_platform_handles * size_per_platform_handle;
 112     estimated_size = MessageInTransit::RoundUpMessageAlignment(estimated_size);
 113     DCHECK_LE(estimated_size, GetMaxBufferSize());
 114   }
 115
 116   buffer_.reset(static_cast<char*>(
 117       base::AlignedAlloc(estimated_size, MessageInTransit::kMessageAlignment)));
 118   // Entirely clear out the secondary buffer, since then we won't have to worry
 119   // about clearing padding or unused space (e.g., if a dispatcher fails to
 120   // serialize).
 121   memset(buffer_.get(), 0, estimated_size);
 122
 123   if (estimated_num_platform_handles > 0) {
 124     DCHECK(!platform_handles_);
 125     platform_handles_.reset(new embedder::PlatformHandleVector());
 126   }
 127
 128   Header* header = reinterpret_cast<Header*>(buffer_.get());
 129   header->num_handles = static_cast<uint32_t>(num_handles);
 130   // (Okay to leave |platform_handle_table_offset|, |num_platform_handles|, and
 131   // |unused| be zero; we'll set the former two later if necessary.)
 132
 133   HandleTableEntry* handle_table = reinterpret_cast<HandleTableEntry*>(
 134       buffer_.get() + handle_table_start_offset);
 135   size_t current_offset = serialized_dispatcher_start_offset;
 136   for (size_t i = 0; i < num_handles; i++) {
 137     Dispatcher* dispatcher = (*dispatchers)[i].get();
 138     if (!dispatcher) {
 139       static_assert(Dispatcher::kTypeUnknown == 0,
 140                     "Value of Dispatcher::kTypeUnknown must be 0");
 141       continue;
 142     }
 143
 144 #if DCHECK_IS_ON()
 145     size_t old_platform_handles_size =
 146         platform_handles_ ? platform_handles_->size() : 0;
 147 #endif
 148
 149     void* destination = buffer_.get() + current_offset;
 150     size_t actual_size = 0;
 151     if (Dispatcher::TransportDataAccess::EndSerializeAndClose(
 152             dispatcher, channel, destination, &actual_size,
 153             platform_handles_.get())) {
 154       handle_table[i].type = static_cast<int32_t>(dispatcher->GetType());
 155       handle_table[i].offset = static_cast<uint32_t>(current_offset);
 156       handle_table[i].size = static_cast<uint32_t>(actual_size);
 157 // (Okay to not set |unused| since we cleared the entire buffer.)
 158
 159 #if DCHECK_IS_ON()
 160       DCHECK_LE(actual_size, all_max_sizes[i]);
 161       DCHECK_LE(platform_handles_
 162                     ? (platform_handles_->size() - old_platform_handles_size)
 163                     : 0,
 164                 all_max_platform_handles[i]);
 165 #endif
 166     } else {
 167       // Nothing to do on failure, since |buffer_| was cleared, and
 168       // |kTypeUnknown| is zero. The handle was simply closed.
 169       LOG(ERROR) << "Failed to serialize handle to remote message pipe";
 170     }
 171
 172     current_offset += MessageInTransit::RoundUpMessageAlignment(actual_size);
 173     DCHECK_LE(current_offset, estimated_size);
 174     DCHECK_LE(platform_handles_ ? platform_handles_->size() : 0,
 175               estimated_num_platform_handles);
 176   }
 177
 178   if (platform_handles_ && platform_handles_->size() > 0) {
 179     header->platform_handle_table_offset =
 180         static_cast<uint32_t>(current_offset);
 181     header->num_platform_handles =
 182         static_cast<uint32_t>(platform_handles_->size());
 183     current_offset += platform_handles_->size() * size_per_platform_handle;
 184     current_offset = MessageInTransit::RoundUpMessageAlignment(current_offset);
 185   }
 186
 187   // There's no aligned realloc, so it's no good way to release unused space (if
 188   // we overshot our estimated space requirements).
 189   buffer_size_ = current_offset;
 190
 191   // |dispatchers_| will be destroyed as it goes out of scope.
 192 }
 193
 194 #if defined(OS_POSIX)
 195 TransportData::TransportData(
 196     embedder::ScopedPlatformHandleVectorPtr platform_handles)
 197     : buffer_size_(sizeof(Header)), platform_handles_(platform_handles.Pass()) {
 198   buffer_.reset(static_cast<char*>(
 199       base::AlignedAlloc(buffer_size_, MessageInTransit::kMessageAlignment)));
 200   memset(buffer_.get(), 0, buffer_size_);
 201 }
 202 #endif  // defined(OS_POSIX)
 203
 204 TransportData::~TransportData() {
 205 }
 206
 207 // static
 208 const char* TransportData::ValidateBuffer(
 209     size_t serialized_platform_handle_size,
 210     const void* buffer,
 211     size_t buffer_size) {
 212   DCHECK(buffer);
 213   DCHECK_GT(buffer_size, 0u);
 214
 215   // Always make sure that the buffer size is sane; if it's not, someone's
 216   // messing with us.
 217   if (buffer_size < sizeof(Header) || buffer_size > GetMaxBufferSize() ||
 218       buffer_size % MessageInTransit::kMessageAlignment != 0)
 219     return "Invalid message secondary buffer size";
 220
 221   const Header* header = static_cast<const Header*>(buffer);
 222   const size_t num_handles = header->num_handles;
 223
 224 #if !defined(OS_POSIX)
 225   // On POSIX, we send control messages with platform handles (but no handles)
 226   // attached (see the comments for
 227   // |TransportData(embedder::ScopedPlatformHandleVectorPtr)|. (This check isn't
 228   // important security-wise anyway.)
 229   if (num_handles == 0)
 230     return "Message has no handles attached, but secondary buffer present";
 231 #endif
 232
 233   // Sanity-check |num_handles| (before multiplying it against anything).
 234   if (num_handles > GetConfiguration().max_message_num_handles)
 235     return "Message handle payload too large";
 236
 237   if (buffer_size < sizeof(Header) + num_handles * sizeof(HandleTableEntry))
 238     return "Message secondary buffer too small";
 239
 240   if (header->num_platform_handles == 0) {
 241     // Then |platform_handle_table_offset| should also be zero.
 242     if (header->platform_handle_table_offset != 0) {
 243       return "Message has no handles attached, but platform handle table "
 244              "present";
 245     }
 246   } else {
 247     // |num_handles| has already been validated, so the multiplication is okay.
 248     if (header->num_platform_handles >
 249         num_handles * kMaxSerializedDispatcherPlatformHandles)
 250       return "Message has too many platform handles attached";
 251
 252     static const char kInvalidPlatformHandleTableOffset[] =
 253         "Message has invalid platform handle table offset";
 254     // This doesn't check that the platform handle table doesn't alias other
 255     // stuff, but it doesn't matter, since it's all read-only.
 256     if (header->platform_handle_table_offset %
 257             MessageInTransit::kMessageAlignment !=
 258         0)
 259       return kInvalidPlatformHandleTableOffset;
 260
 261     // ">" instead of ">=" since the size per handle may be zero.
 262     if (header->platform_handle_table_offset > buffer_size)
 263       return kInvalidPlatformHandleTableOffset;
 264
 265     // We already checked |platform_handle_table_offset| and
 266     // |num_platform_handles|, so the addition and multiplication are okay.
 267     if (header->platform_handle_table_offset +
 268             header->num_platform_handles * serialized_platform_handle_size >
 269         buffer_size)
 270       return kInvalidPlatformHandleTableOffset;
 271   }
 272
 273   const HandleTableEntry* handle_table =
 274       reinterpret_cast<const HandleTableEntry*>(
 275           static_cast<const char*>(buffer) + sizeof(Header));
 276   static const char kInvalidSerializedDispatcher[] =
 277       "Message contains invalid serialized dispatcher";
 278   for (size_t i = 0; i < num_handles; i++) {
 279     size_t offset = handle_table[i].offset;
 280     if (offset % MessageInTransit::kMessageAlignment != 0)
 281       return kInvalidSerializedDispatcher;
 282
 283     size_t size = handle_table[i].size;
 284     if (size > kMaxSerializedDispatcherSize || size > buffer_size)
 285       return kInvalidSerializedDispatcher;
 286
 287     // Note: This is an overflow-safe check for |offset + size > buffer_size|
 288     // (we know that |size <= buffer_size| from the previous check).
 289     if (offset > buffer_size - size)
 290       return kInvalidSerializedDispatcher;
 291   }
 292
 293   return nullptr;
 294 }
 295
 296 // static
 297 void TransportData::GetPlatformHandleTable(const void* transport_data_buffer,
 298                                            size_t* num_platform_handles,
 299                                            const void** platform_handle_table) {
 300   DCHECK(transport_data_buffer);
 301   DCHECK(num_platform_handles);
 302   DCHECK(platform_handle_table);
 303
 304   const Header* header = static_cast<const Header*>(transport_data_buffer);
 305   *num_platform_handles = header->num_platform_handles;
 306   *platform_handle_table = static_cast<const char*>(transport_data_buffer) +
 307                            header->platform_handle_table_offset;
 308 }
 309
 310 // static
 311 scoped_ptr<DispatcherVector> TransportData::DeserializeDispatchers(
 312     const void* buffer,
 313     size_t buffer_size,
 314     embedder::ScopedPlatformHandleVectorPtr platform_handles,
 315     Channel* channel) {
 316   DCHECK(buffer);
 317   DCHECK_GT(buffer_size, 0u);
 318   DCHECK(channel);
 319
 320   const Header* header = static_cast<const Header*>(buffer);
 321   const size_t num_handles = header->num_handles;
 322   scoped_ptr<DispatcherVector> dispatchers(new DispatcherVector(num_handles));
 323
 324   const HandleTableEntry* handle_table =
 325       reinterpret_cast<const HandleTableEntry*>(
 326           static_cast<const char*>(buffer) + sizeof(Header));
 327   for (size_t i = 0; i < num_handles; i++) {
 328     size_t offset = handle_table[i].offset;
 329     size_t size = handle_table[i].size;
 330     // Should already have been checked by |ValidateBuffer()|:
 331     DCHECK_EQ(offset % MessageInTransit::kMessageAlignment, 0u);
 332     DCHECK_LE(offset, buffer_size);
 333     DCHECK_LE(offset + size, buffer_size);
 334
 335     const void* source = static_cast<const char*>(buffer) + offset;
 336     (*dispatchers)[i] = Dispatcher::TransportDataAccess::Deserialize(
 337         channel, handle_table[i].type, source, size, platform_handles.get());
 338   }
 339
 340   return dispatchers.Pass();
 341 }
 342
 343 }  // namespace system
 344 }  // namespace mojo