Home | History | Annotate | Download | only in browser 
      1 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
      2 // Use of this source code is governed by a BSD-style license that can be
      3 // found in the LICENSE file.
      4 
      5 #include "chrome/browser/crash_handler_host_linux.h"
      6 
      7 #include <stdint.h>
      8 #include <stdlib.h>
      9 #include <sys/socket.h>
     10 #include <sys/syscall.h>
     11 #include <unistd.h>
     12 
     13 #include "base/eintr_wrapper.h"
     14 #include "base/file_path.h"
     15 #include "base/format_macros.h"
     16 #include "base/linux_util.h"
     17 #include "base/logging.h"
     18 #include "base/memory/singleton.h"
     19 #include "base/message_loop.h"
     20 #include "base/path_service.h"
     21 #include "base/rand_util.h"
     22 #include "base/string_util.h"
     23 #include "base/task.h"
     24 #include "base/threading/thread.h"
     25 #include "breakpad/src/client/linux/handler/exception_handler.h"
     26 #include "breakpad/src/client/linux/minidump_writer/linux_dumper.h"
     27 #include "breakpad/src/client/linux/minidump_writer/minidump_writer.h"
     28 #include "chrome/app/breakpad_linux.h"
     29 #include "chrome/common/chrome_paths.h"
     30 #include "chrome/common/env_vars.h"
     31 #include "content/browser/browser_thread.h"
     32 
     33 using google_breakpad::ExceptionHandler;
     34 
     35 namespace {
     36 
     37 // The length of the control message:
     38 const unsigned kControlMsgSize =
     39     CMSG_SPACE(2*sizeof(int)) + CMSG_SPACE(sizeof(struct ucred));
     40 // The length of the regular payload:
     41 const unsigned kCrashContextSize = sizeof(ExceptionHandler::CrashContext);
     42 
     43 // Handles the crash dump and frees the allocated BreakpadInfo struct.
     44 void CrashDumpTask(CrashHandlerHostLinux* handler, BreakpadInfo* info) {
     45   if (handler->IsShuttingDown())
     46     return;
     47 
     48   HandleCrashDump(*info);
     49   delete[] info->filename;
     50   delete[] info->process_type;
     51   delete[] info->crash_url;
     52   delete[] info->guid;
     53   delete[] info->distro;
     54   delete info;
     55 }
     56 
     57 }  // namespace
     58 
     59 // Since classes derived from CrashHandlerHostLinux are singletons, it's only
     60 // destroyed at the end of the processes lifetime, which is greater in span than
     61 // the lifetime of the IO message loop.
     62 DISABLE_RUNNABLE_METHOD_REFCOUNT(CrashHandlerHostLinux);
     63 
     64 CrashHandlerHostLinux::CrashHandlerHostLinux()
     65     : shutting_down_(false) {
     66   int fds[2];
     67   // We use SOCK_SEQPACKET rather than SOCK_DGRAM to prevent the process from
     68   // sending datagrams to other sockets on the system. The sandbox may prevent
     69   // the process from calling socket() to create new sockets, but it'll still
     70   // inherit some sockets. With PF_UNIX+SOCK_DGRAM, it can call sendmsg to send
     71   // a datagram to any (abstract) socket on the same system. With
     72   // SOCK_SEQPACKET, this is prevented.
     73   CHECK_EQ(socketpair(AF_UNIX, SOCK_SEQPACKET, 0, fds), 0);
     74   static const int on = 1;
     75 
     76   // Enable passcred on the server end of the socket
     77   CHECK_EQ(setsockopt(fds[1], SOL_SOCKET, SO_PASSCRED, &on, sizeof(on)), 0);
     78 
     79   process_socket_ = fds[0];
     80   browser_socket_ = fds[1];
     81 
     82   BrowserThread::PostTask(
     83       BrowserThread::IO, FROM_HERE,
     84       NewRunnableMethod(this, &CrashHandlerHostLinux::Init));
     85 }
     86 
     87 CrashHandlerHostLinux::~CrashHandlerHostLinux() {
     88   HANDLE_EINTR(close(process_socket_));
     89   HANDLE_EINTR(close(browser_socket_));
     90 }
     91 
     92 void CrashHandlerHostLinux::Init() {
     93   MessageLoopForIO* ml = MessageLoopForIO::current();
     94   CHECK(ml->WatchFileDescriptor(
     95       browser_socket_, true /* persistent */,
     96       MessageLoopForIO::WATCH_READ,
     97       &file_descriptor_watcher_, this));
     98   ml->AddDestructionObserver(this);
     99 }
    100 
    101 void CrashHandlerHostLinux::InitCrashUploaderThread() {
    102   SetProcessType();
    103   uploader_thread_.reset(
    104       new base::Thread(std::string(process_type_ + "_crash_uploader").c_str()));
    105   uploader_thread_->Start();
    106 }
    107 
    108 void CrashHandlerHostLinux::OnFileCanWriteWithoutBlocking(int fd) {
    109   DCHECK(false);
    110 }
    111 
    112 void CrashHandlerHostLinux::OnFileCanReadWithoutBlocking(int fd) {
    113   DCHECK_EQ(fd, browser_socket_);
    114 
    115   // A process has crashed and has signaled us by writing a datagram
    116   // to the death signal socket. The datagram contains the crash context needed
    117   // for writing the minidump as well as a file descriptor and a credentials
    118   // block so that they can't lie about their pid.
    119 
    120   const size_t kIovSize = 7;
    121   struct msghdr msg = {0};
    122   struct iovec iov[kIovSize];
    123 
    124   // Freed in WriteDumpFile();
    125   char* crash_context = new char[kCrashContextSize];
    126   // Freed in CrashDumpTask();
    127   char* guid = new char[kGuidSize + 1];
    128   char* crash_url = new char[kMaxActiveURLSize + 1];
    129   char* distro = new char[kDistroSize + 1];
    130 
    131   char* tid_buf_addr = NULL;
    132   int tid_fd = -1;
    133   uint64_t uptime;
    134   char control[kControlMsgSize];
    135   const ssize_t expected_msg_size =
    136       kCrashContextSize +
    137       kGuidSize + 1 +
    138       kMaxActiveURLSize + 1 +
    139       kDistroSize + 1 +
    140       sizeof(tid_buf_addr) + sizeof(tid_fd) +
    141       sizeof(uptime);
    142 
    143   iov[0].iov_base = crash_context;
    144   iov[0].iov_len = kCrashContextSize;
    145   iov[1].iov_base = guid;
    146   iov[1].iov_len = kGuidSize + 1;
    147   iov[2].iov_base = crash_url;
    148   iov[2].iov_len = kMaxActiveURLSize + 1;
    149   iov[3].iov_base = distro;
    150   iov[3].iov_len = kDistroSize + 1;
    151   iov[4].iov_base = &tid_buf_addr;
    152   iov[4].iov_len = sizeof(tid_buf_addr);
    153   iov[5].iov_base = &tid_fd;
    154   iov[5].iov_len = sizeof(tid_fd);
    155   iov[6].iov_base = &uptime;
    156   iov[6].iov_len = sizeof(uptime);
    157   msg.msg_iov = iov;
    158   msg.msg_iovlen = kIovSize;
    159   msg.msg_control = control;
    160   msg.msg_controllen = kControlMsgSize;
    161 
    162   const ssize_t msg_size = HANDLE_EINTR(recvmsg(browser_socket_, &msg, 0));
    163   if (msg_size != expected_msg_size) {
    164     LOG(ERROR) << "Error reading from death signal socket. Crash dumping"
    165                << " is disabled."
    166                << " msg_size:" << msg_size
    167                << " errno:" << errno;
    168     file_descriptor_watcher_.StopWatchingFileDescriptor();
    169     return;
    170   }
    171 
    172   if (msg.msg_controllen != kControlMsgSize ||
    173       msg.msg_flags & ~MSG_TRUNC) {
    174     LOG(ERROR) << "Received death signal message with the wrong size;"
    175                << " msg.msg_controllen:" << msg.msg_controllen
    176                << " msg.msg_flags:" << msg.msg_flags
    177                << " kCrashContextSize:" << kCrashContextSize
    178                << " kControlMsgSize:" << kControlMsgSize;
    179     return;
    180   }
    181 
    182   // Walk the control payload an extract the file descriptor and validated pid.
    183   pid_t crashing_pid = -1;
    184   int partner_fd = -1;
    185   int signal_fd = -1;
    186   for (struct cmsghdr *hdr = CMSG_FIRSTHDR(&msg); hdr;
    187        hdr = CMSG_NXTHDR(&msg, hdr)) {
    188     if (hdr->cmsg_level != SOL_SOCKET)
    189       continue;
    190     if (hdr->cmsg_type == SCM_RIGHTS) {
    191       const unsigned len = hdr->cmsg_len -
    192           (((uint8_t*)CMSG_DATA(hdr)) - (uint8_t*)hdr);
    193       DCHECK_EQ(len % sizeof(int), 0u);
    194       const unsigned num_fds = len / sizeof(int);
    195       if (num_fds != 2) {
    196         // A nasty process could try and send us too many descriptors and
    197         // force a leak.
    198         LOG(ERROR) << "Death signal contained wrong number of descriptors;"
    199                    << " num_fds:" << num_fds;
    200         for (unsigned i = 0; i < num_fds; ++i)
    201           HANDLE_EINTR(close(reinterpret_cast<int*>(CMSG_DATA(hdr))[i]));
    202         return;
    203       } else {
    204         partner_fd = reinterpret_cast<int*>(CMSG_DATA(hdr))[0];
    205         signal_fd = reinterpret_cast<int*>(CMSG_DATA(hdr))[1];
    206       }
    207     } else if (hdr->cmsg_type == SCM_CREDENTIALS) {
    208       const struct ucred *cred =
    209           reinterpret_cast<struct ucred*>(CMSG_DATA(hdr));
    210       crashing_pid = cred->pid;
    211     }
    212   }
    213 
    214   if (crashing_pid == -1 || partner_fd == -1 || signal_fd == -1) {
    215     LOG(ERROR) << "Death signal message didn't contain all expected control"
    216                << " messages";
    217     if (partner_fd >= 0)
    218       HANDLE_EINTR(close(partner_fd));
    219     if (signal_fd >= 0)
    220       HANDLE_EINTR(close(signal_fd));
    221     return;
    222   }
    223 
    224   // Kernel bug workaround (broken in 2.6.30 at least):
    225   // The kernel doesn't translate PIDs in SCM_CREDENTIALS across PID
    226   // namespaces. Thus |crashing_pid| might be garbage from our point of view.
    227   // In the future we can remove this workaround, but we have to wait a couple
    228   // of years to be sure that it's worked its way out into the world.
    229 
    230   // The crashing process closes its copy of the signal_fd immediately after
    231   // calling sendmsg(). We can thus not reliably look for with with
    232   // FindProcessHoldingSocket(). But by necessity, it has to keep the
    233   // partner_fd open until the crashdump is complete.
    234   uint64_t inode_number;
    235   if (!base::FileDescriptorGetInode(&inode_number, partner_fd)) {
    236     LOG(WARNING) << "Failed to get inode number for passed socket";
    237     HANDLE_EINTR(close(partner_fd));
    238     HANDLE_EINTR(close(signal_fd));
    239     return;
    240   }
    241   HANDLE_EINTR(close(partner_fd));
    242 
    243   pid_t actual_crashing_pid = -1;
    244   if (!base::FindProcessHoldingSocket(&actual_crashing_pid, inode_number)) {
    245     LOG(WARNING) << "Failed to find process holding other end of crash reply "
    246                     "socket";
    247     HANDLE_EINTR(close(signal_fd));
    248     return;
    249   }
    250 
    251   if (actual_crashing_pid != crashing_pid) {
    252     crashing_pid = actual_crashing_pid;
    253 
    254     // The crashing TID set inside the compromised context via sys_gettid()
    255     // in ExceptionHandler::HandleSignal is also wrong and needs to be
    256     // translated.
    257     //
    258     // We expect the crashing thread to be in sys_read(), waiting for use to
    259     // write to |signal_fd|. Most newer kernels where we have the different pid
    260     // namespaces also have /proc/[pid]/syscall, so we can look through
    261     // |actual_crashing_pid|'s thread group and find the thread that's in the
    262     // read syscall with the right arguments.
    263 
    264     std::string expected_syscall_data;
    265     // /proc/[pid]/syscall is formatted as follows:
    266     // syscall_number arg1 ... arg6 sp pc
    267     // but we just check syscall_number through arg3.
    268     base::StringAppendF(&expected_syscall_data, "%d 0x%x %p 0x1 ",
    269                         SYS_read, tid_fd, tid_buf_addr);
    270     pid_t crashing_tid =
    271         base::FindThreadIDWithSyscall(crashing_pid, expected_syscall_data);
    272     if (crashing_tid == -1) {
    273       // We didn't find the thread we want. Maybe it didn't reach sys_read()
    274       // yet, or the kernel doesn't support /proc/[pid]/syscall or the thread
    275       // went away.  We'll just take a guess here and assume the crashing
    276       // thread is the thread group leader.
    277       crashing_tid = crashing_pid;
    278     }
    279 
    280     ExceptionHandler::CrashContext* bad_context =
    281         reinterpret_cast<ExceptionHandler::CrashContext*>(crash_context);
    282     bad_context->tid = crashing_tid;
    283   }
    284 
    285   // Sanitize the string data a bit more
    286   guid[kGuidSize] = crash_url[kMaxActiveURLSize] = distro[kDistroSize] = 0;
    287 
    288   // Freed in CrashDumpTask();
    289   BreakpadInfo* info = new BreakpadInfo;
    290 
    291   info->process_type_length = process_type_.length();
    292   char* process_type_str = new char[info->process_type_length + 1];
    293   process_type_.copy(process_type_str, info->process_type_length);
    294   process_type_str[info->process_type_length] = '\0';
    295   info->process_type = process_type_str;
    296 
    297   info->crash_url_length = strlen(crash_url);
    298   info->crash_url = crash_url;
    299 
    300   info->guid_length = strlen(guid);
    301   info->guid = guid;
    302 
    303   info->distro_length = strlen(distro);
    304   info->distro = distro;
    305 
    306   info->upload = (getenv(env_vars::kHeadless) == NULL);
    307   info->process_start_time = uptime;
    308 
    309   BrowserThread::PostTask(
    310       BrowserThread::FILE, FROM_HERE,
    311       NewRunnableMethod(this,
    312                         &CrashHandlerHostLinux::WriteDumpFile,
    313                         info,
    314                         crashing_pid,
    315                         crash_context,
    316                         signal_fd));
    317 }
    318 
    319 void CrashHandlerHostLinux::WriteDumpFile(BreakpadInfo* info,
    320                                           pid_t crashing_pid,
    321                                           char* crash_context,
    322                                           int signal_fd) {
    323   DCHECK(BrowserThread::CurrentlyOn(BrowserThread::FILE));
    324 
    325   FilePath dumps_path("/tmp");
    326   PathService::Get(base::DIR_TEMP, &dumps_path);
    327   if (!info->upload)
    328     PathService::Get(chrome::DIR_CRASH_DUMPS, &dumps_path);
    329   const uint64 rand = base::RandUint64();
    330   const std::string minidump_filename =
    331       StringPrintf("%s/chromium-%s-minidump-%016" PRIx64 ".dmp",
    332                    dumps_path.value().c_str(), process_type_.c_str(), rand);
    333   if (!google_breakpad::WriteMinidump(minidump_filename.c_str(),
    334                                       crashing_pid, crash_context,
    335                                       kCrashContextSize)) {
    336     LOG(ERROR) << "Failed to write crash dump for pid " << crashing_pid;
    337   }
    338   delete[] crash_context;
    339 
    340   // Freed in CrashDumpTask();
    341   char* minidump_filename_str = new char[minidump_filename.length() + 1];
    342   minidump_filename.copy(minidump_filename_str, minidump_filename.length());
    343   minidump_filename_str[minidump_filename.length()] = '\0';
    344   info->filename = minidump_filename_str;
    345 
    346   BrowserThread::PostTask(
    347       BrowserThread::IO, FROM_HERE,
    348       NewRunnableMethod(this,
    349                         &CrashHandlerHostLinux::QueueCrashDumpTask,
    350                         info,
    351                         signal_fd));
    352 }
    353 
    354 void CrashHandlerHostLinux::QueueCrashDumpTask(BreakpadInfo* info,
    355                                                int signal_fd) {
    356   DCHECK(BrowserThread::CurrentlyOn(BrowserThread::IO));
    357 
    358   // Send the done signal to the process: it can exit now.
    359   struct msghdr msg = {0};
    360   struct iovec done_iov;
    361   done_iov.iov_base = const_cast<char*>("\x42");
    362   done_iov.iov_len = 1;
    363   msg.msg_iov = &done_iov;
    364   msg.msg_iovlen = 1;
    365 
    366   HANDLE_EINTR(sendmsg(signal_fd, &msg, MSG_DONTWAIT | MSG_NOSIGNAL));
    367   HANDLE_EINTR(close(signal_fd));
    368 
    369   uploader_thread_->message_loop()->PostTask(
    370       FROM_HERE,
    371       NewRunnableFunction(&CrashDumpTask, this, info));
    372 }
    373 
    374 void CrashHandlerHostLinux::WillDestroyCurrentMessageLoop() {
    375   file_descriptor_watcher_.StopWatchingFileDescriptor();
    376 
    377   // If we are quitting and there are crash dumps in the queue, turn them into
    378   // no-ops.
    379   shutting_down_ = true;
    380   uploader_thread_->Stop();
    381 }
    382 
    383 bool CrashHandlerHostLinux::IsShuttingDown() const {
    384   return shutting_down_;
    385 }
    386 
    387 GpuCrashHandlerHostLinux::GpuCrashHandlerHostLinux() {
    388   InitCrashUploaderThread();
    389 }
    390 
    391 GpuCrashHandlerHostLinux::~GpuCrashHandlerHostLinux() {
    392 }
    393 
    394 void GpuCrashHandlerHostLinux::SetProcessType() {
    395   process_type_ = "gpu-process";
    396 }
    397 
    398 // static
    399 GpuCrashHandlerHostLinux* GpuCrashHandlerHostLinux::GetInstance() {
    400   return Singleton<GpuCrashHandlerHostLinux>::get();
    401 }
    402 
    403 PluginCrashHandlerHostLinux::PluginCrashHandlerHostLinux() {
    404   InitCrashUploaderThread();
    405 }
    406 
    407 PluginCrashHandlerHostLinux::~PluginCrashHandlerHostLinux() {
    408 }
    409 
    410 void PluginCrashHandlerHostLinux::SetProcessType() {
    411   process_type_ = "plugin";
    412 }
    413 
    414 // static
    415 PluginCrashHandlerHostLinux* PluginCrashHandlerHostLinux::GetInstance() {
    416   return Singleton<PluginCrashHandlerHostLinux>::get();
    417 }
    418 
    419 RendererCrashHandlerHostLinux::RendererCrashHandlerHostLinux() {
    420   InitCrashUploaderThread();
    421 }
    422 
    423 RendererCrashHandlerHostLinux::~RendererCrashHandlerHostLinux() {
    424 }
    425 
    426 void RendererCrashHandlerHostLinux::SetProcessType() {
    427   process_type_ = "renderer";
    428 }
    429 
    430 // static
    431 RendererCrashHandlerHostLinux* RendererCrashHandlerHostLinux::GetInstance() {
    432   return Singleton<RendererCrashHandlerHostLinux>::get();
    433 }
    434 
    435 PpapiCrashHandlerHostLinux::PpapiCrashHandlerHostLinux() {
    436   InitCrashUploaderThread();
    437 }
    438 
    439 PpapiCrashHandlerHostLinux::~PpapiCrashHandlerHostLinux() {
    440 }
    441 
    442 void PpapiCrashHandlerHostLinux::SetProcessType() {
    443   process_type_ = "ppapi";
    444 }
    445 
    446 // static
    447 PpapiCrashHandlerHostLinux* PpapiCrashHandlerHostLinux::GetInstance() {
    448   return Singleton<PpapiCrashHandlerHostLinux>::get();
    449 }
    450