Home | History | Annotate | Download | only in browser 
      1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
      2 // Use of this source code is governed by a BSD-style license that can be
      3 // found in the LICENSE file.
      4 
      5 #include "chrome/browser/crash_handler_host_linux.h"
      6 
      7 #include <stdint.h>
      8 #include <stdlib.h>
      9 #include <sys/socket.h>
     10 #include <sys/syscall.h>
     11 #include <unistd.h>
     12 
     13 #include "base/bind.h"
     14 #include "base/bind_helpers.h"
     15 #include "base/files/file_path.h"
     16 #include "base/format_macros.h"
     17 #include "base/linux_util.h"
     18 #include "base/logging.h"
     19 #include "base/memory/singleton.h"
     20 #include "base/message_loop/message_loop.h"
     21 #include "base/path_service.h"
     22 #include "base/posix/eintr_wrapper.h"
     23 #include "base/rand_util.h"
     24 #include "base/strings/string_util.h"
     25 #include "base/strings/stringprintf.h"
     26 #include "base/threading/thread.h"
     27 #include "breakpad/src/client/linux/handler/exception_handler.h"
     28 #include "breakpad/src/client/linux/minidump_writer/linux_dumper.h"
     29 #include "breakpad/src/client/linux/minidump_writer/minidump_writer.h"
     30 #include "chrome/app/breakpad_linux_impl.h"
     31 #include "chrome/common/chrome_paths.h"
     32 #include "chrome/common/env_vars.h"
     33 #include "content/public/browser/browser_thread.h"
     34 
     35 #if defined(OS_ANDROID)
     36 #include <sys/linux-syscalls.h>
     37 
     38 #define SYS_read __NR_read
     39 #endif
     40 
     41 using content::BrowserThread;
     42 using google_breakpad::ExceptionHandler;
     43 
     44 namespace {
     45 
     46 // The length of the control message:
     47 const unsigned kControlMsgSize =
     48     CMSG_SPACE(2*sizeof(int)) + CMSG_SPACE(sizeof(struct ucred));
     49 // The length of the regular payload:
     50 const unsigned kCrashContextSize = sizeof(ExceptionHandler::CrashContext);
     51 
     52 // Handles the crash dump and frees the allocated BreakpadInfo struct.
     53 void CrashDumpTask(CrashHandlerHostLinux* handler, BreakpadInfo* info) {
     54   if (handler->IsShuttingDown())
     55     return;
     56 
     57   HandleCrashDump(*info);
     58   delete[] info->filename;
     59   delete[] info->process_type;
     60   delete[] info->crash_url;
     61   delete[] info->guid;
     62   delete[] info->distro;
     63   delete info->crash_keys;
     64   delete info;
     65 }
     66 
     67 }  // namespace
     68 
     69 // Since classes derived from CrashHandlerHostLinux are singletons, it's only
     70 // destroyed at the end of the processes lifetime, which is greater in span than
     71 // the lifetime of the IO message loop. Thus, all calls to base::Bind() use
     72 // non-refcounted pointers.
     73 
     74 CrashHandlerHostLinux::CrashHandlerHostLinux()
     75     : shutting_down_(false) {
     76   int fds[2];
     77   // We use SOCK_SEQPACKET rather than SOCK_DGRAM to prevent the process from
     78   // sending datagrams to other sockets on the system. The sandbox may prevent
     79   // the process from calling socket() to create new sockets, but it'll still
     80   // inherit some sockets. With PF_UNIX+SOCK_DGRAM, it can call sendmsg to send
     81   // a datagram to any (abstract) socket on the same system. With
     82   // SOCK_SEQPACKET, this is prevented.
     83   CHECK_EQ(socketpair(AF_UNIX, SOCK_SEQPACKET, 0, fds), 0);
     84   static const int on = 1;
     85 
     86   // Enable passcred on the server end of the socket
     87   CHECK_EQ(setsockopt(fds[1], SOL_SOCKET, SO_PASSCRED, &on, sizeof(on)), 0);
     88 
     89   process_socket_ = fds[0];
     90   browser_socket_ = fds[1];
     91 
     92   BrowserThread::PostTask(
     93       BrowserThread::IO, FROM_HERE,
     94       base::Bind(&CrashHandlerHostLinux::Init, base::Unretained(this)));
     95 }
     96 
     97 CrashHandlerHostLinux::~CrashHandlerHostLinux() {
     98   (void) HANDLE_EINTR(close(process_socket_));
     99   (void) HANDLE_EINTR(close(browser_socket_));
    100 }
    101 
    102 void CrashHandlerHostLinux::Init() {
    103   base::MessageLoopForIO* ml = base::MessageLoopForIO::current();
    104   CHECK(ml->WatchFileDescriptor(
    105       browser_socket_, true /* persistent */,
    106       base::MessageLoopForIO::WATCH_READ,
    107       &file_descriptor_watcher_, this));
    108   ml->AddDestructionObserver(this);
    109 }
    110 
    111 void CrashHandlerHostLinux::InitCrashUploaderThread() {
    112   SetProcessType();
    113   uploader_thread_.reset(
    114       new base::Thread(std::string(process_type_ + "_crash_uploader").c_str()));
    115   uploader_thread_->Start();
    116 }
    117 
    118 void CrashHandlerHostLinux::OnFileCanWriteWithoutBlocking(int fd) {
    119   NOTREACHED();
    120 }
    121 
    122 void CrashHandlerHostLinux::OnFileCanReadWithoutBlocking(int fd) {
    123   DCHECK_EQ(fd, browser_socket_);
    124 
    125   // A process has crashed and has signaled us by writing a datagram
    126   // to the death signal socket. The datagram contains the crash context needed
    127   // for writing the minidump as well as a file descriptor and a credentials
    128   // block so that they can't lie about their pid.
    129   //
    130   // The message sender is in chrome/app/breakpad_linux.cc.
    131 
    132   struct msghdr msg = {0};
    133   struct iovec iov[kCrashIovSize];
    134 
    135   // Freed in WriteDumpFile();
    136   char* crash_context = new char[kCrashContextSize];
    137   // Freed in CrashDumpTask();
    138   char* guid = new char[kGuidSize + 1];
    139   char* crash_url = new char[kMaxActiveURLSize + 1];
    140   char* distro = new char[kDistroSize + 1];
    141 #if defined(ADDRESS_SANITIZER)
    142   asan_report_str_ = new char[kMaxAsanReportSize + 1];
    143 #endif
    144 
    145   // Freed in CrashDumpTask().
    146   CrashKeyStorage* crash_keys = new CrashKeyStorage;
    147   google_breakpad::SerializedNonAllocatingMap* serialized_crash_keys;
    148   size_t crash_keys_size = crash_keys->Serialize(
    149       const_cast<const google_breakpad::SerializedNonAllocatingMap**>(
    150           &serialized_crash_keys));
    151 
    152   char* tid_buf_addr = NULL;
    153   int tid_fd = -1;
    154   uint64_t uptime;
    155   size_t oom_size;
    156   char control[kControlMsgSize];
    157   const ssize_t expected_msg_size =
    158       kCrashContextSize +
    159       kGuidSize + 1 +
    160       kMaxActiveURLSize + 1 +
    161       kDistroSize + 1 +
    162       sizeof(tid_buf_addr) + sizeof(tid_fd) +
    163       sizeof(uptime) +
    164 #if defined(ADDRESS_SANITIZER)
    165       kMaxAsanReportSize + 1 +
    166 #endif
    167       sizeof(oom_size) +
    168       crash_keys_size;
    169   iov[0].iov_base = crash_context;
    170   iov[0].iov_len = kCrashContextSize;
    171   iov[1].iov_base = guid;
    172   iov[1].iov_len = kGuidSize + 1;
    173   iov[2].iov_base = crash_url;
    174   iov[2].iov_len = kMaxActiveURLSize + 1;
    175   iov[3].iov_base = distro;
    176   iov[3].iov_len = kDistroSize + 1;
    177   iov[4].iov_base = &tid_buf_addr;
    178   iov[4].iov_len = sizeof(tid_buf_addr);
    179   iov[5].iov_base = &tid_fd;
    180   iov[5].iov_len = sizeof(tid_fd);
    181   iov[6].iov_base = &uptime;
    182   iov[6].iov_len = sizeof(uptime);
    183   iov[7].iov_base = &oom_size;
    184   iov[7].iov_len = sizeof(oom_size);
    185   iov[8].iov_base = serialized_crash_keys;
    186   iov[8].iov_len = crash_keys_size;
    187 #if defined(ADDRESS_SANITIZER)
    188   iov[9].iov_base = asan_report_str_;
    189   iov[9].iov_len = kMaxAsanReportSize + 1;
    190 #endif
    191   msg.msg_iov = iov;
    192   msg.msg_iovlen = kCrashIovSize;
    193   msg.msg_control = control;
    194   msg.msg_controllen = kControlMsgSize;
    195 
    196   const ssize_t msg_size = HANDLE_EINTR(recvmsg(browser_socket_, &msg, 0));
    197   if (msg_size != expected_msg_size) {
    198     LOG(ERROR) << "Error reading from death signal socket. Crash dumping"
    199                << " is disabled."
    200                << " msg_size:" << msg_size
    201                << " errno:" << errno;
    202     file_descriptor_watcher_.StopWatchingFileDescriptor();
    203     return;
    204   }
    205 
    206   if (msg.msg_controllen != kControlMsgSize ||
    207       msg.msg_flags & ~MSG_TRUNC) {
    208     LOG(ERROR) << "Received death signal message with the wrong size;"
    209                << " msg.msg_controllen:" << msg.msg_controllen
    210                << " msg.msg_flags:" << msg.msg_flags
    211                << " kCrashContextSize:" << kCrashContextSize
    212                << " kControlMsgSize:" << kControlMsgSize;
    213     return;
    214   }
    215 
    216   // Walk the control payload an extract the file descriptor and validated pid.
    217   pid_t crashing_pid = -1;
    218   int partner_fd = -1;
    219   int signal_fd = -1;
    220   for (struct cmsghdr *hdr = CMSG_FIRSTHDR(&msg); hdr;
    221        hdr = CMSG_NXTHDR(&msg, hdr)) {
    222     if (hdr->cmsg_level != SOL_SOCKET)
    223       continue;
    224     if (hdr->cmsg_type == SCM_RIGHTS) {
    225       const unsigned len = hdr->cmsg_len -
    226           (((uint8_t*)CMSG_DATA(hdr)) - (uint8_t*)hdr);
    227       DCHECK_EQ(len % sizeof(int), 0u);
    228       const unsigned num_fds = len / sizeof(int);
    229       if (num_fds != 2) {
    230         // A nasty process could try and send us too many descriptors and
    231         // force a leak.
    232         LOG(ERROR) << "Death signal contained wrong number of descriptors;"
    233                    << " num_fds:" << num_fds;
    234         for (unsigned i = 0; i < num_fds; ++i)
    235           (void) HANDLE_EINTR(close(reinterpret_cast<int*>(CMSG_DATA(hdr))[i]));
    236         return;
    237       } else {
    238         partner_fd = reinterpret_cast<int*>(CMSG_DATA(hdr))[0];
    239         signal_fd = reinterpret_cast<int*>(CMSG_DATA(hdr))[1];
    240       }
    241     } else if (hdr->cmsg_type == SCM_CREDENTIALS) {
    242       const struct ucred *cred =
    243           reinterpret_cast<struct ucred*>(CMSG_DATA(hdr));
    244       crashing_pid = cred->pid;
    245     }
    246   }
    247 
    248   if (crashing_pid == -1 || partner_fd == -1 || signal_fd == -1) {
    249     LOG(ERROR) << "Death signal message didn't contain all expected control"
    250                << " messages";
    251     if (partner_fd >= 0)
    252       (void) HANDLE_EINTR(close(partner_fd));
    253     if (signal_fd >= 0)
    254       (void) HANDLE_EINTR(close(signal_fd));
    255     return;
    256   }
    257 
    258   // Kernel bug workaround (broken in 2.6.30 and 2.6.32, working in 2.6.38).
    259   // The kernel doesn't translate PIDs in SCM_CREDENTIALS across PID
    260   // namespaces. Thus |crashing_pid| might be garbage from our point of view.
    261   // In the future we can remove this workaround, but we have to wait a couple
    262   // of years to be sure that it's worked its way out into the world.
    263   // TODO(thestig) Remove the workaround when Ubuntu Lucid is deprecated.
    264 
    265   // The crashing process closes its copy of the signal_fd immediately after
    266   // calling sendmsg(). We can thus not reliably look for with with
    267   // FindProcessHoldingSocket(). But by necessity, it has to keep the
    268   // partner_fd open until the crashdump is complete.
    269   ino_t inode_number;
    270   if (!base::FileDescriptorGetInode(&inode_number, partner_fd)) {
    271     LOG(WARNING) << "Failed to get inode number for passed socket";
    272     (void) HANDLE_EINTR(close(partner_fd));
    273     (void) HANDLE_EINTR(close(signal_fd));
    274     return;
    275   }
    276   (void) HANDLE_EINTR(close(partner_fd));
    277 
    278   pid_t actual_crashing_pid = -1;
    279   if (!base::FindProcessHoldingSocket(&actual_crashing_pid, inode_number)) {
    280     LOG(WARNING) << "Failed to find process holding other end of crash reply "
    281                     "socket";
    282     (void) HANDLE_EINTR(close(signal_fd));
    283     return;
    284   }
    285 
    286   crashing_pid = actual_crashing_pid;
    287 
    288   // The crashing TID set inside the compromised context via
    289   // sys_gettid() in ExceptionHandler::HandleSignal might be wrong (if
    290   // the kernel supports PID namespacing) and may need to be
    291   // translated.
    292   //
    293   // We expect the crashing thread to be in sys_read(), waiting for us to
    294   // write to |signal_fd|. Most newer kernels where we have the different pid
    295   // namespaces also have /proc/[pid]/syscall, so we can look through
    296   // |actual_crashing_pid|'s thread group and find the thread that's in the
    297   // read syscall with the right arguments.
    298 
    299   std::string expected_syscall_data;
    300   // /proc/[pid]/syscall is formatted as follows:
    301   // syscall_number arg1 ... arg6 sp pc
    302   // but we just check syscall_number through arg3.
    303   base::StringAppendF(&expected_syscall_data, "%d 0x%x %p 0x1 ",
    304                       SYS_read, tid_fd, tid_buf_addr);
    305   bool syscall_supported = false;
    306   pid_t crashing_tid =
    307       base::FindThreadIDWithSyscall(crashing_pid,
    308                                     expected_syscall_data,
    309                                     &syscall_supported);
    310   if (crashing_tid == -1) {
    311     // We didn't find the thread we want. Maybe it didn't reach
    312     // sys_read() yet or the thread went away.  We'll just take a
    313     // guess here and assume the crashing thread is the thread group
    314     // leader.  If procfs syscall is not supported by the kernel, then
    315     // we assume the kernel also does not support TID namespacing and
    316     // trust the TID passed by the crashing process.
    317     LOG(WARNING) << "Could not translate tid - assuming crashing thread is "
    318         "thread group leader; syscall_supported=" << syscall_supported;
    319     crashing_tid = crashing_pid;
    320   }
    321 
    322   ExceptionHandler::CrashContext* bad_context =
    323       reinterpret_cast<ExceptionHandler::CrashContext*>(crash_context);
    324   bad_context->tid = crashing_tid;
    325 
    326   // Sanitize the string data a bit more
    327   guid[kGuidSize] = crash_url[kMaxActiveURLSize] = distro[kDistroSize] = 0;
    328 
    329   // Freed in CrashDumpTask();
    330   BreakpadInfo* info = new BreakpadInfo;
    331 
    332   info->fd = -1;
    333   info->process_type_length = process_type_.length();
    334   char* process_type_str = new char[info->process_type_length + 1];
    335   process_type_.copy(process_type_str, info->process_type_length);
    336   process_type_str[info->process_type_length] = '\0';
    337   info->process_type = process_type_str;
    338 
    339   info->crash_url_length = strlen(crash_url);
    340   info->crash_url = crash_url;
    341 
    342   info->guid_length = strlen(guid);
    343   info->guid = guid;
    344 
    345   info->distro_length = strlen(distro);
    346   info->distro = distro;
    347 #if defined(OS_ANDROID)
    348   // Nothing gets uploaded in android.
    349   info->upload = false;
    350 #else
    351   info->upload = (getenv(env_vars::kHeadless) == NULL);
    352 #endif
    353 
    354   info->crash_keys = crash_keys;
    355 
    356 #if defined(ADDRESS_SANITIZER)
    357   info->asan_report_str = asan_report_str_;
    358   info->asan_report_length = strlen(asan_report_str_);
    359 #endif
    360   info->process_start_time = uptime;
    361   info->oom_size = oom_size;
    362 
    363   BrowserThread::PostTask(
    364       BrowserThread::FILE, FROM_HERE,
    365       base::Bind(&CrashHandlerHostLinux::WriteDumpFile,
    366                  base::Unretained(this),
    367                  info,
    368                  crashing_pid,
    369                  crash_context,
    370                  signal_fd));
    371 }
    372 
    373 void CrashHandlerHostLinux::WriteDumpFile(BreakpadInfo* info,
    374                                           pid_t crashing_pid,
    375                                           char* crash_context,
    376                                           int signal_fd) {
    377   DCHECK(BrowserThread::CurrentlyOn(BrowserThread::FILE));
    378 
    379   base::FilePath dumps_path("/tmp");
    380   PathService::Get(base::DIR_TEMP, &dumps_path);
    381   if (!info->upload)
    382     PathService::Get(chrome::DIR_CRASH_DUMPS, &dumps_path);
    383   const uint64 rand = base::RandUint64();
    384   const std::string minidump_filename =
    385       base::StringPrintf("%s/chromium-%s-minidump-%016" PRIx64 ".dmp",
    386                          dumps_path.value().c_str(),
    387                          process_type_.c_str(),
    388                          rand);
    389 
    390   if (!google_breakpad::WriteMinidump(minidump_filename.c_str(),
    391                                       kMaxMinidumpFileSize,
    392                                       crashing_pid, crash_context,
    393                                       kCrashContextSize,
    394                                       google_breakpad::MappingList(),
    395                                       google_breakpad::AppMemoryList())) {
    396     LOG(ERROR) << "Failed to write crash dump for pid " << crashing_pid;
    397   }
    398 #if defined(ADDRESS_SANITIZER)
    399   // Create a temporary file holding the AddressSanitizer report.
    400   const std::string log_filename =
    401       base::StringPrintf("%s/chromium-%s-minidump-%016" PRIx64 ".log",
    402                          dumps_path.value().c_str(),
    403                          process_type_.c_str(),
    404                          rand);
    405   FILE* logfile = fopen(log_filename.c_str(), "w");
    406   CHECK(logfile);
    407   fprintf(logfile, "%s", asan_report_str_);
    408   fclose(logfile);
    409 #endif
    410 
    411   delete[] crash_context;
    412 
    413   // Freed in CrashDumpTask();
    414   char* minidump_filename_str = new char[minidump_filename.length() + 1];
    415   minidump_filename.copy(minidump_filename_str, minidump_filename.length());
    416   minidump_filename_str[minidump_filename.length()] = '\0';
    417   info->filename = minidump_filename_str;
    418 #if defined(ADDRESS_SANITIZER)
    419   char* minidump_log_filename_str = new char[minidump_filename.length() + 1];
    420   minidump_filename.copy(minidump_log_filename_str, minidump_filename.length());
    421   memcpy(minidump_log_filename_str + minidump_filename.length() - 3, "log", 3);
    422   minidump_log_filename_str[minidump_filename.length()] = '\0';
    423   info->log_filename = minidump_log_filename_str;
    424 #endif
    425   info->pid = crashing_pid;
    426 
    427   BrowserThread::PostTask(
    428       BrowserThread::IO, FROM_HERE,
    429       base::Bind(&CrashHandlerHostLinux::QueueCrashDumpTask,
    430                  base::Unretained(this),
    431                  info,
    432                  signal_fd));
    433 }
    434 
    435 void CrashHandlerHostLinux::QueueCrashDumpTask(BreakpadInfo* info,
    436                                                int signal_fd) {
    437   DCHECK(BrowserThread::CurrentlyOn(BrowserThread::IO));
    438 
    439   // Send the done signal to the process: it can exit now.
    440   struct msghdr msg = {0};
    441   struct iovec done_iov;
    442   done_iov.iov_base = const_cast<char*>("\x42");
    443   done_iov.iov_len = 1;
    444   msg.msg_iov = &done_iov;
    445   msg.msg_iovlen = 1;
    446 
    447   (void) HANDLE_EINTR(sendmsg(signal_fd, &msg, MSG_DONTWAIT | MSG_NOSIGNAL));
    448   (void) HANDLE_EINTR(close(signal_fd));
    449 
    450   uploader_thread_->message_loop()->PostTask(
    451       FROM_HERE,
    452       base::Bind(&CrashDumpTask, base::Unretained(this), info));
    453 }
    454 
    455 void CrashHandlerHostLinux::WillDestroyCurrentMessageLoop() {
    456   file_descriptor_watcher_.StopWatchingFileDescriptor();
    457 
    458   // If we are quitting and there are crash dumps in the queue, turn them into
    459   // no-ops.
    460   shutting_down_ = true;
    461   uploader_thread_->Stop();
    462 }
    463 
    464 bool CrashHandlerHostLinux::IsShuttingDown() const {
    465   return shutting_down_;
    466 }
    467 
    468 ExtensionCrashHandlerHostLinux::ExtensionCrashHandlerHostLinux() {
    469   InitCrashUploaderThread();
    470 }
    471 
    472 ExtensionCrashHandlerHostLinux::~ExtensionCrashHandlerHostLinux() {
    473 }
    474 
    475 void ExtensionCrashHandlerHostLinux::SetProcessType() {
    476   process_type_ = "extension";
    477 }
    478 
    479 // static
    480 ExtensionCrashHandlerHostLinux* ExtensionCrashHandlerHostLinux::GetInstance() {
    481   return Singleton<ExtensionCrashHandlerHostLinux>::get();
    482 }
    483 
    484 GpuCrashHandlerHostLinux::GpuCrashHandlerHostLinux() {
    485   InitCrashUploaderThread();
    486 }
    487 
    488 GpuCrashHandlerHostLinux::~GpuCrashHandlerHostLinux() {
    489 }
    490 
    491 void GpuCrashHandlerHostLinux::SetProcessType() {
    492   process_type_ = "gpu-process";
    493 }
    494 
    495 // static
    496 GpuCrashHandlerHostLinux* GpuCrashHandlerHostLinux::GetInstance() {
    497   return Singleton<GpuCrashHandlerHostLinux>::get();
    498 }
    499 
    500 PluginCrashHandlerHostLinux::PluginCrashHandlerHostLinux() {
    501   InitCrashUploaderThread();
    502 }
    503 
    504 PluginCrashHandlerHostLinux::~PluginCrashHandlerHostLinux() {
    505 }
    506 
    507 void PluginCrashHandlerHostLinux::SetProcessType() {
    508   process_type_ = "plugin";
    509 }
    510 
    511 // static
    512 PluginCrashHandlerHostLinux* PluginCrashHandlerHostLinux::GetInstance() {
    513   return Singleton<PluginCrashHandlerHostLinux>::get();
    514 }
    515 
    516 PpapiCrashHandlerHostLinux::PpapiCrashHandlerHostLinux() {
    517   InitCrashUploaderThread();
    518 }
    519 
    520 PpapiCrashHandlerHostLinux::~PpapiCrashHandlerHostLinux() {
    521 }
    522 
    523 void PpapiCrashHandlerHostLinux::SetProcessType() {
    524   process_type_ = "ppapi";
    525 }
    526 
    527 // static
    528 PpapiCrashHandlerHostLinux* PpapiCrashHandlerHostLinux::GetInstance() {
    529   return Singleton<PpapiCrashHandlerHostLinux>::get();
    530 }
    531 
    532 RendererCrashHandlerHostLinux::RendererCrashHandlerHostLinux() {
    533   InitCrashUploaderThread();
    534 }
    535 
    536 RendererCrashHandlerHostLinux::~RendererCrashHandlerHostLinux() {
    537 }
    538 
    539 void RendererCrashHandlerHostLinux::SetProcessType() {
    540   process_type_ = "renderer";
    541 }
    542 
    543 // static
    544 RendererCrashHandlerHostLinux* RendererCrashHandlerHostLinux::GetInstance() {
    545   return Singleton<RendererCrashHandlerHostLinux>::get();
    546 }
    547