/thirdparty/breakpad/client/linux/minidump_writer/linux_dumper.cc

  1// Copyright (c) 2010, Google Inc.
  2// All rights reserved.
  3//
  4// Redistribution and use in source and binary forms, with or without
  5// modification, are permitted provided that the following conditions are
  6// met:
  7//
  8//     * Redistributions of source code must retain the above copyright
  9// notice, this list of conditions and the following disclaimer.
 10//     * Redistributions in binary form must reproduce the above
 11// copyright notice, this list of conditions and the following disclaimer
 12// in the documentation and/or other materials provided with the
 13// distribution.
 14//     * Neither the name of Google Inc. nor the names of its
 15// contributors may be used to endorse or promote products derived from
 16// this software without specific prior written permission.
 17//
 18// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
 19// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
 20// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
 21// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
 22// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
 23// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
 24// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
 25// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
 26// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 27// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 28// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 29
 30// linux_dumper.cc: Implement google_breakpad::LinuxDumper.
 31// See linux_dumper.h for details.
 32
 33// This code deals with the mechanics of getting information about a crashed
 34// process. Since this code may run in a compromised address space, the same
 35// rules apply as detailed at the top of minidump_writer.h: no libc calls and
 36// use the alternative allocator.
 37
 38#include "client/linux/minidump_writer/linux_dumper.h"
 39
 40#include <assert.h>
 41#include <fcntl.h>
 42#include <limits.h>
 43#include <stddef.h>
 44#include <string.h>
 45
 46#include "client/linux/minidump_writer/line_reader.h"
 47#include "common/linux/file_id.h"
 48#include "common/linux/linux_libc_support.h"
 49#include "common/linux/memory_mapped_file.h"
 50#include "common/linux/safe_readlink.h"
 51#include "third_party/lss/linux_syscall_support.h"
 52
 53static const char kMappedFileUnsafePrefix[] = "/dev/";
 54static const char kDeletedSuffix[] = " (deleted)";
 55
 56inline static bool IsMappedFileOpenUnsafe(
 57    const google_breakpad::MappingInfo& mapping) {
 58  // It is unsafe to attempt to open a mapped file that lives under /dev,
 59  // because the semantics of the open may be driver-specific so we'd risk
 60  // hanging the crash dumper. And a file in /dev/ almost certainly has no
 61  // ELF file identifier anyways.
 62  return my_strncmp(mapping.name,
 63                    kMappedFileUnsafePrefix,
 64                    sizeof(kMappedFileUnsafePrefix) - 1) == 0;
 65}
 66
 67namespace google_breakpad {
 68
 69LinuxDumper::LinuxDumper(pid_t pid)
 70    : pid_(pid),
 71      crash_address_(0),
 72      crash_signal_(0),
 73      crash_thread_(0),
 74      threads_(&allocator_, 8),
 75      mappings_(&allocator_) {
 76}
 77
 78LinuxDumper::~LinuxDumper() {
 79}
 80
 81bool LinuxDumper::Init() {
 82  return EnumerateThreads() && EnumerateMappings();
 83}
 84
 85bool
 86LinuxDumper::ElfFileIdentifierForMapping(const MappingInfo& mapping,
 87                                         bool member,
 88                                         unsigned int mapping_id,
 89                                         uint8_t identifier[sizeof(MDGUID)])
 90{
 91  assert(!member || mapping_id < mappings_.size());
 92  my_memset(identifier, 0, sizeof(MDGUID));
 93  if (IsMappedFileOpenUnsafe(mapping))
 94    return false;
 95
 96  // Special-case linux-gate because it's not a real file.
 97  if (my_strcmp(mapping.name, kLinuxGateLibraryName) == 0) {
 98    const uintptr_t kPageSize = getpagesize();
 99    void* linux_gate = NULL;
100    if (pid_ == sys_getpid()) {
101      linux_gate = reinterpret_cast<void*>(mapping.start_addr);
102    } else {
103      linux_gate = allocator_.Alloc(kPageSize);
104      CopyFromProcess(linux_gate, pid_,
105                      reinterpret_cast<const void*>(mapping.start_addr),
106                      kPageSize);
107    }
108    return FileID::ElfFileIdentifierFromMappedFile(linux_gate, identifier);
109  }
110
111  char filename[NAME_MAX];
112  size_t filename_len = my_strlen(mapping.name);
113  assert(filename_len < NAME_MAX);
114  if (filename_len >= NAME_MAX)
115    return false;
116  memcpy(filename, mapping.name, filename_len);
117  filename[filename_len] = '\0';
118  bool filename_modified = HandleDeletedFileInMapping(filename);
119
120  MemoryMappedFile mapped_file(filename);
121  if (!mapped_file.data())  // Should probably check if size >= ElfW(Ehdr)?
122    return false;
123
124  bool success =
125      FileID::ElfFileIdentifierFromMappedFile(mapped_file.data(), identifier);
126  if (success && member && filename_modified) {
127    mappings_[mapping_id]->name[filename_len -
128                                sizeof(kDeletedSuffix) + 1] = '\0';
129  }
130
131  return success;
132}
133
134void*
135LinuxDumper::FindBeginningOfLinuxGateSharedLibrary(pid_t pid) const {
136  char auxv_path[NAME_MAX];
137  if (!BuildProcPath(auxv_path, pid, "auxv"))
138    return NULL;
139
140  // Find the AT_SYSINFO_EHDR entry for linux-gate.so
141  // See http://www.trilithium.com/johan/2005/08/linux-gate/ for more
142  // information.
143  int fd = sys_open(auxv_path, O_RDONLY, 0);
144  if (fd < 0) {
145    return NULL;
146  }
147
148  elf_aux_entry one_aux_entry;
149  while (sys_read(fd,
150                  &one_aux_entry,
151                  sizeof(elf_aux_entry)) == sizeof(elf_aux_entry) &&
152         one_aux_entry.a_type != AT_NULL) {
153    if (one_aux_entry.a_type == AT_SYSINFO_EHDR) {
154      close(fd);
155      return reinterpret_cast<void*>(one_aux_entry.a_un.a_val);
156    }
157  }
158  close(fd);
159  return NULL;
160}
161
162void*
163LinuxDumper::FindEntryPoint(pid_t pid) const {
164  char auxv_path[NAME_MAX];
165  if (!BuildProcPath(auxv_path, pid, "auxv"))
166    return NULL;
167
168  int fd = sys_open(auxv_path, O_RDONLY, 0);
169  if (fd < 0) {
170    return NULL;
171  }
172
173  // Find the AT_ENTRY entry
174  elf_aux_entry one_aux_entry;
175  while (sys_read(fd,
176                  &one_aux_entry,
177                  sizeof(elf_aux_entry)) == sizeof(elf_aux_entry) &&
178         one_aux_entry.a_type != AT_NULL) {
179    if (one_aux_entry.a_type == AT_ENTRY) {
180      close(fd);
181      return reinterpret_cast<void*>(one_aux_entry.a_un.a_val);
182    }
183  }
184  close(fd);
185  return NULL;
186}
187
188bool LinuxDumper::EnumerateMappings() {
189  char maps_path[NAME_MAX];
190  if (!BuildProcPath(maps_path, pid_, "maps"))
191    return false;
192
193  // linux_gate_loc is the beginning of the kernel's mapping of
194  // linux-gate.so in the process.  It doesn't actually show up in the
195  // maps list as a filename, so we use the aux vector to find it's
196  // load location and special case it's entry when creating the list
197  // of mappings.
198  const void* linux_gate_loc;
199  linux_gate_loc = FindBeginningOfLinuxGateSharedLibrary(pid_);
200  // Although the initial executable is usually the first mapping, it's not
201  // guaranteed (see http://crosbug.com/25355); therefore, try to use the
202  // actual entry point to find the mapping.
203  const void* entry_point_loc = FindEntryPoint(pid_);
204
205  const int fd = sys_open(maps_path, O_RDONLY, 0);
206  if (fd < 0)
207    return false;
208  LineReader* const line_reader = new(allocator_) LineReader(fd);
209
210  const char* line;
211  unsigned line_len;
212  while (line_reader->GetNextLine(&line, &line_len)) {
213    uintptr_t start_addr, end_addr, offset;
214
215    const char* i1 = my_read_hex_ptr(&start_addr, line);
216    if (*i1 == '-') {
217      const char* i2 = my_read_hex_ptr(&end_addr, i1 + 1);
218      if (*i2 == ' ') {
219        const char* i3 = my_read_hex_ptr(&offset, i2 + 6 /* skip ' rwxp ' */);
220        if (*i3 == ' ') {
221          const char* name = NULL;
222          // Only copy name if the name is a valid path name, or if
223          // it's the VDSO image.
224          if (((name = my_strchr(line, '/')) == NULL) &&
225              linux_gate_loc &&
226              reinterpret_cast<void*>(start_addr) == linux_gate_loc) {
227            name = kLinuxGateLibraryName;
228            offset = 0;
229          }
230          // Merge adjacent mappings with the same name into one module,
231          // assuming they're a single library mapped by the dynamic linker
232          if (name && !mappings_.empty()) {
233            MappingInfo* module = mappings_.back();
234            if ((start_addr == module->start_addr + module->size) &&
235                (my_strlen(name) == my_strlen(module->name)) &&
236                (my_strncmp(name, module->name, my_strlen(name)) == 0)) {
237              module->size = end_addr - module->start_addr;
238              line_reader->PopLine(line_len);
239              continue;
240            }
241          }
242          MappingInfo* const module = new(allocator_) MappingInfo;
243          memset(module, 0, sizeof(MappingInfo));
244          module->start_addr = start_addr;
245          module->size = end_addr - start_addr;
246          module->offset = offset;
247          if (name != NULL) {
248            const unsigned l = my_strlen(name);
249            if (l < sizeof(module->name))
250              memcpy(module->name, name, l);
251          }
252          // If this is the entry-point mapping, and it's not already the
253          // first one, then we need to make it be first.  This is because
254          // the minidump format assumes the first module is the one that
255          // corresponds to the main executable (as codified in
256          // processor/minidump.cc:MinidumpModuleList::GetMainModule()).
257          if (entry_point_loc &&
258              (entry_point_loc >=
259                  reinterpret_cast<void*>(module->start_addr)) &&
260              (entry_point_loc <
261                  reinterpret_cast<void*>(module->start_addr+module->size)) &&
262              !mappings_.empty()) {
263            // push the module onto the front of the list.
264            mappings_.resize(mappings_.size() + 1);
265            for (size_t idx = mappings_.size() - 1; idx > 0; idx--)
266              mappings_[idx] = mappings_[idx - 1];
267            mappings_[0] = module;
268          } else {
269            mappings_.push_back(module);
270          }
271        }
272      }
273    }
274    line_reader->PopLine(line_len);
275  }
276
277  sys_close(fd);
278
279  return !mappings_.empty();
280}
281
282// Get information about the stack, given the stack pointer. We don't try to
283// walk the stack since we might not have all the information needed to do
284// unwind. So we just grab, up to, 32k of stack.
285bool LinuxDumper::GetStackInfo(const void** stack, size_t* stack_len,
286                               uintptr_t int_stack_pointer) {
287  // Move the stack pointer to the bottom of the page that it's in.
288  const uintptr_t page_size = getpagesize();
289
290  uint8_t* const stack_pointer =
291      reinterpret_cast<uint8_t*>(int_stack_pointer & ~(page_size - 1));
292
293  // The number of bytes of stack which we try to capture.
294  static const ptrdiff_t kStackToCapture = 32 * 1024;
295
296  const MappingInfo* mapping = FindMapping(stack_pointer);
297  if (!mapping)
298    return false;
299  const ptrdiff_t offset = stack_pointer - (uint8_t*) mapping->start_addr;
300  const ptrdiff_t distance_to_end =
301      static_cast<ptrdiff_t>(mapping->size) - offset;
302  *stack_len = distance_to_end > kStackToCapture ?
303      kStackToCapture : distance_to_end;
304  *stack = stack_pointer;
305  return true;
306}
307
308// Find the mapping which the given memory address falls in.
309const MappingInfo* LinuxDumper::FindMapping(const void* address) const {
310  const uintptr_t addr = (uintptr_t) address;
311
312  for (size_t i = 0; i < mappings_.size(); ++i) {
313    const uintptr_t start = static_cast<uintptr_t>(mappings_[i]->start_addr);
314    if (addr >= start && addr - start < mappings_[i]->size)
315      return mappings_[i];
316  }
317
318  return NULL;
319}
320
321bool LinuxDumper::HandleDeletedFileInMapping(char* path) const {
322  static const size_t kDeletedSuffixLen = sizeof(kDeletedSuffix) - 1;
323
324  // Check for ' (deleted)' in |path|.
325  // |path| has to be at least as long as "/x (deleted)".
326  const size_t path_len = my_strlen(path);
327  if (path_len < kDeletedSuffixLen + 2)
328    return false;
329  if (my_strncmp(path + path_len - kDeletedSuffixLen, kDeletedSuffix,
330                 kDeletedSuffixLen) != 0) {
331    return false;
332  }
333
334  // Check |path| against the /proc/pid/exe 'symlink'.
335  char exe_link[NAME_MAX];
336  char new_path[NAME_MAX];
337  if (!BuildProcPath(exe_link, pid_, "exe"))
338    return false;
339  if (!SafeReadLink(exe_link, new_path))
340    return false;
341  if (my_strcmp(path, new_path) != 0)
342    return false;
343
344  // Check to see if someone actually named their executable 'foo (deleted)'.
345  struct kernel_stat exe_stat;
346  struct kernel_stat new_path_stat;
347  if (sys_stat(exe_link, &exe_stat) == 0 &&
348      sys_stat(new_path, &new_path_stat) == 0 &&
349      exe_stat.st_dev == new_path_stat.st_dev &&
350      exe_stat.st_ino == new_path_stat.st_ino) {
351    return false;
352  }
353
354  memcpy(path, exe_link, NAME_MAX);
355  return true;
356}
357
358}  // namespace google_breakpad