1// Copyright (c) 2011 The Chromium Authors. All rights reserved.
2// Use of this source code is governed by a BSD-style license that can be
3// found in the LICENSE file.
4
5#include "chrome/browser/crash_handler_host_linux.h"
6
7#include <stdint.h>
8#include <stdlib.h>
9#include <sys/socket.h>
10#include <sys/syscall.h>
11#include <unistd.h>
12
13#include "base/eintr_wrapper.h"
14#include "base/file_path.h"
15#include "base/format_macros.h"
16#include "base/linux_util.h"
17#include "base/logging.h"
18#include "base/memory/singleton.h"
19#include "base/message_loop.h"
20#include "base/path_service.h"
21#include "base/rand_util.h"
22#include "base/string_util.h"
23#include "base/task.h"
24#include "base/threading/thread.h"
25#include "breakpad/src/client/linux/handler/exception_handler.h"
26#include "breakpad/src/client/linux/minidump_writer/linux_dumper.h"
27#include "breakpad/src/client/linux/minidump_writer/minidump_writer.h"
28#include "chrome/app/breakpad_linux.h"
29#include "chrome/common/chrome_paths.h"
30#include "chrome/common/env_vars.h"
31#include "content/browser/browser_thread.h"
32
33using google_breakpad::ExceptionHandler;
34
35namespace {
36
37// The length of the control message:
38const unsigned kControlMsgSize =
39    CMSG_SPACE(2*sizeof(int)) + CMSG_SPACE(sizeof(struct ucred));
40// The length of the regular payload:
41const unsigned kCrashContextSize = sizeof(ExceptionHandler::CrashContext);
42
43// Handles the crash dump and frees the allocated BreakpadInfo struct.
44void CrashDumpTask(CrashHandlerHostLinux* handler, BreakpadInfo* info) {
45  if (handler->IsShuttingDown())
46    return;
47
48  HandleCrashDump(*info);
49  delete[] info->filename;
50  delete[] info->process_type;
51  delete[] info->crash_url;
52  delete[] info->guid;
53  delete[] info->distro;
54  delete info;
55}
56
57}  // namespace
58
59// Since classes derived from CrashHandlerHostLinux are singletons, it's only
60// destroyed at the end of the processes lifetime, which is greater in span than
61// the lifetime of the IO message loop.
62DISABLE_RUNNABLE_METHOD_REFCOUNT(CrashHandlerHostLinux);
63
64CrashHandlerHostLinux::CrashHandlerHostLinux()
65    : shutting_down_(false) {
66  int fds[2];
67  // We use SOCK_SEQPACKET rather than SOCK_DGRAM to prevent the process from
68  // sending datagrams to other sockets on the system. The sandbox may prevent
69  // the process from calling socket() to create new sockets, but it'll still
70  // inherit some sockets. With PF_UNIX+SOCK_DGRAM, it can call sendmsg to send
71  // a datagram to any (abstract) socket on the same system. With
72  // SOCK_SEQPACKET, this is prevented.
73  CHECK_EQ(socketpair(AF_UNIX, SOCK_SEQPACKET, 0, fds), 0);
74  static const int on = 1;
75
76  // Enable passcred on the server end of the socket
77  CHECK_EQ(setsockopt(fds[1], SOL_SOCKET, SO_PASSCRED, &on, sizeof(on)), 0);
78
79  process_socket_ = fds[0];
80  browser_socket_ = fds[1];
81
82  BrowserThread::PostTask(
83      BrowserThread::IO, FROM_HERE,
84      NewRunnableMethod(this, &CrashHandlerHostLinux::Init));
85}
86
87CrashHandlerHostLinux::~CrashHandlerHostLinux() {
88  HANDLE_EINTR(close(process_socket_));
89  HANDLE_EINTR(close(browser_socket_));
90}
91
92void CrashHandlerHostLinux::Init() {
93  MessageLoopForIO* ml = MessageLoopForIO::current();
94  CHECK(ml->WatchFileDescriptor(
95      browser_socket_, true /* persistent */,
96      MessageLoopForIO::WATCH_READ,
97      &file_descriptor_watcher_, this));
98  ml->AddDestructionObserver(this);
99}
100
101void CrashHandlerHostLinux::InitCrashUploaderThread() {
102  SetProcessType();
103  uploader_thread_.reset(
104      new base::Thread(std::string(process_type_ + "_crash_uploader").c_str()));
105  uploader_thread_->Start();
106}
107
108void CrashHandlerHostLinux::OnFileCanWriteWithoutBlocking(int fd) {
109  DCHECK(false);
110}
111
112void CrashHandlerHostLinux::OnFileCanReadWithoutBlocking(int fd) {
113  DCHECK_EQ(fd, browser_socket_);
114
115  // A process has crashed and has signaled us by writing a datagram
116  // to the death signal socket. The datagram contains the crash context needed
117  // for writing the minidump as well as a file descriptor and a credentials
118  // block so that they can't lie about their pid.
119
120  const size_t kIovSize = 7;
121  struct msghdr msg = {0};
122  struct iovec iov[kIovSize];
123
124  // Freed in WriteDumpFile();
125  char* crash_context = new char[kCrashContextSize];
126  // Freed in CrashDumpTask();
127  char* guid = new char[kGuidSize + 1];
128  char* crash_url = new char[kMaxActiveURLSize + 1];
129  char* distro = new char[kDistroSize + 1];
130
131  char* tid_buf_addr = NULL;
132  int tid_fd = -1;
133  uint64_t uptime;
134  char control[kControlMsgSize];
135  const ssize_t expected_msg_size =
136      kCrashContextSize +
137      kGuidSize + 1 +
138      kMaxActiveURLSize + 1 +
139      kDistroSize + 1 +
140      sizeof(tid_buf_addr) + sizeof(tid_fd) +
141      sizeof(uptime);
142
143  iov[0].iov_base = crash_context;
144  iov[0].iov_len = kCrashContextSize;
145  iov[1].iov_base = guid;
146  iov[1].iov_len = kGuidSize + 1;
147  iov[2].iov_base = crash_url;
148  iov[2].iov_len = kMaxActiveURLSize + 1;
149  iov[3].iov_base = distro;
150  iov[3].iov_len = kDistroSize + 1;
151  iov[4].iov_base = &tid_buf_addr;
152  iov[4].iov_len = sizeof(tid_buf_addr);
153  iov[5].iov_base = &tid_fd;
154  iov[5].iov_len = sizeof(tid_fd);
155  iov[6].iov_base = &uptime;
156  iov[6].iov_len = sizeof(uptime);
157  msg.msg_iov = iov;
158  msg.msg_iovlen = kIovSize;
159  msg.msg_control = control;
160  msg.msg_controllen = kControlMsgSize;
161
162  const ssize_t msg_size = HANDLE_EINTR(recvmsg(browser_socket_, &msg, 0));
163  if (msg_size != expected_msg_size) {
164    LOG(ERROR) << "Error reading from death signal socket. Crash dumping"
165               << " is disabled."
166               << " msg_size:" << msg_size
167               << " errno:" << errno;
168    file_descriptor_watcher_.StopWatchingFileDescriptor();
169    return;
170  }
171
172  if (msg.msg_controllen != kControlMsgSize ||
173      msg.msg_flags & ~MSG_TRUNC) {
174    LOG(ERROR) << "Received death signal message with the wrong size;"
175               << " msg.msg_controllen:" << msg.msg_controllen
176               << " msg.msg_flags:" << msg.msg_flags
177               << " kCrashContextSize:" << kCrashContextSize
178               << " kControlMsgSize:" << kControlMsgSize;
179    return;
180  }
181
182  // Walk the control payload an extract the file descriptor and validated pid.
183  pid_t crashing_pid = -1;
184  int partner_fd = -1;
185  int signal_fd = -1;
186  for (struct cmsghdr *hdr = CMSG_FIRSTHDR(&msg); hdr;
187       hdr = CMSG_NXTHDR(&msg, hdr)) {
188    if (hdr->cmsg_level != SOL_SOCKET)
189      continue;
190    if (hdr->cmsg_type == SCM_RIGHTS) {
191      const unsigned len = hdr->cmsg_len -
192          (((uint8_t*)CMSG_DATA(hdr)) - (uint8_t*)hdr);
193      DCHECK_EQ(len % sizeof(int), 0u);
194      const unsigned num_fds = len / sizeof(int);
195      if (num_fds != 2) {
196        // A nasty process could try and send us too many descriptors and
197        // force a leak.
198        LOG(ERROR) << "Death signal contained wrong number of descriptors;"
199                   << " num_fds:" << num_fds;
200        for (unsigned i = 0; i < num_fds; ++i)
201          HANDLE_EINTR(close(reinterpret_cast<int*>(CMSG_DATA(hdr))[i]));
202        return;
203      } else {
204        partner_fd = reinterpret_cast<int*>(CMSG_DATA(hdr))[0];
205        signal_fd = reinterpret_cast<int*>(CMSG_DATA(hdr))[1];
206      }
207    } else if (hdr->cmsg_type == SCM_CREDENTIALS) {
208      const struct ucred *cred =
209          reinterpret_cast<struct ucred*>(CMSG_DATA(hdr));
210      crashing_pid = cred->pid;
211    }
212  }
213
214  if (crashing_pid == -1 || partner_fd == -1 || signal_fd == -1) {
215    LOG(ERROR) << "Death signal message didn't contain all expected control"
216               << " messages";
217    if (partner_fd >= 0)
218      HANDLE_EINTR(close(partner_fd));
219    if (signal_fd >= 0)
220      HANDLE_EINTR(close(signal_fd));
221    return;
222  }
223
224  // Kernel bug workaround (broken in 2.6.30 at least):
225  // The kernel doesn't translate PIDs in SCM_CREDENTIALS across PID
226  // namespaces. Thus |crashing_pid| might be garbage from our point of view.
227  // In the future we can remove this workaround, but we have to wait a couple
228  // of years to be sure that it's worked its way out into the world.
229
230  // The crashing process closes its copy of the signal_fd immediately after
231  // calling sendmsg(). We can thus not reliably look for with with
232  // FindProcessHoldingSocket(). But by necessity, it has to keep the
233  // partner_fd open until the crashdump is complete.
234  uint64_t inode_number;
235  if (!base::FileDescriptorGetInode(&inode_number, partner_fd)) {
236    LOG(WARNING) << "Failed to get inode number for passed socket";
237    HANDLE_EINTR(close(partner_fd));
238    HANDLE_EINTR(close(signal_fd));
239    return;
240  }
241  HANDLE_EINTR(close(partner_fd));
242
243  pid_t actual_crashing_pid = -1;
244  if (!base::FindProcessHoldingSocket(&actual_crashing_pid, inode_number)) {
245    LOG(WARNING) << "Failed to find process holding other end of crash reply "
246                    "socket";
247    HANDLE_EINTR(close(signal_fd));
248    return;
249  }
250
251  if (actual_crashing_pid != crashing_pid) {
252    crashing_pid = actual_crashing_pid;
253
254    // The crashing TID set inside the compromised context via sys_gettid()
255    // in ExceptionHandler::HandleSignal is also wrong and needs to be
256    // translated.
257    //
258    // We expect the crashing thread to be in sys_read(), waiting for use to
259    // write to |signal_fd|. Most newer kernels where we have the different pid
260    // namespaces also have /proc/[pid]/syscall, so we can look through
261    // |actual_crashing_pid|'s thread group and find the thread that's in the
262    // read syscall with the right arguments.
263
264    std::string expected_syscall_data;
265    // /proc/[pid]/syscall is formatted as follows:
266    // syscall_number arg1 ... arg6 sp pc
267    // but we just check syscall_number through arg3.
268    base::StringAppendF(&expected_syscall_data, "%d 0x%x %p 0x1 ",
269                        SYS_read, tid_fd, tid_buf_addr);
270    pid_t crashing_tid =
271        base::FindThreadIDWithSyscall(crashing_pid, expected_syscall_data);
272    if (crashing_tid == -1) {
273      // We didn't find the thread we want. Maybe it didn't reach sys_read()
274      // yet, or the kernel doesn't support /proc/[pid]/syscall or the thread
275      // went away.  We'll just take a guess here and assume the crashing
276      // thread is the thread group leader.
277      crashing_tid = crashing_pid;
278    }
279
280    ExceptionHandler::CrashContext* bad_context =
281        reinterpret_cast<ExceptionHandler::CrashContext*>(crash_context);
282    bad_context->tid = crashing_tid;
283  }
284
285  // Sanitize the string data a bit more
286  guid[kGuidSize] = crash_url[kMaxActiveURLSize] = distro[kDistroSize] = 0;
287
288  // Freed in CrashDumpTask();
289  BreakpadInfo* info = new BreakpadInfo;
290
291  info->process_type_length = process_type_.length();
292  char* process_type_str = new char[info->process_type_length + 1];
293  process_type_.copy(process_type_str, info->process_type_length);
294  process_type_str[info->process_type_length] = '\0';
295  info->process_type = process_type_str;
296
297  info->crash_url_length = strlen(crash_url);
298  info->crash_url = crash_url;
299
300  info->guid_length = strlen(guid);
301  info->guid = guid;
302
303  info->distro_length = strlen(distro);
304  info->distro = distro;
305
306  info->upload = (getenv(env_vars::kHeadless) == NULL);
307  info->process_start_time = uptime;
308
309  BrowserThread::PostTask(
310      BrowserThread::FILE, FROM_HERE,
311      NewRunnableMethod(this,
312                        &CrashHandlerHostLinux::WriteDumpFile,
313                        info,
314                        crashing_pid,
315                        crash_context,
316                        signal_fd));
317}
318
319void CrashHandlerHostLinux::WriteDumpFile(BreakpadInfo* info,
320                                          pid_t crashing_pid,
321                                          char* crash_context,
322                                          int signal_fd) {
323  DCHECK(BrowserThread::CurrentlyOn(BrowserThread::FILE));
324
325  FilePath dumps_path("/tmp");
326  PathService::Get(base::DIR_TEMP, &dumps_path);
327  if (!info->upload)
328    PathService::Get(chrome::DIR_CRASH_DUMPS, &dumps_path);
329  const uint64 rand = base::RandUint64();
330  const std::string minidump_filename =
331      StringPrintf("%s/chromium-%s-minidump-%016" PRIx64 ".dmp",
332                   dumps_path.value().c_str(), process_type_.c_str(), rand);
333  if (!google_breakpad::WriteMinidump(minidump_filename.c_str(),
334                                      crashing_pid, crash_context,
335                                      kCrashContextSize)) {
336    LOG(ERROR) << "Failed to write crash dump for pid " << crashing_pid;
337  }
338  delete[] crash_context;
339
340  // Freed in CrashDumpTask();
341  char* minidump_filename_str = new char[minidump_filename.length() + 1];
342  minidump_filename.copy(minidump_filename_str, minidump_filename.length());
343  minidump_filename_str[minidump_filename.length()] = '\0';
344  info->filename = minidump_filename_str;
345
346  BrowserThread::PostTask(
347      BrowserThread::IO, FROM_HERE,
348      NewRunnableMethod(this,
349                        &CrashHandlerHostLinux::QueueCrashDumpTask,
350                        info,
351                        signal_fd));
352}
353
354void CrashHandlerHostLinux::QueueCrashDumpTask(BreakpadInfo* info,
355                                               int signal_fd) {
356  DCHECK(BrowserThread::CurrentlyOn(BrowserThread::IO));
357
358  // Send the done signal to the process: it can exit now.
359  struct msghdr msg = {0};
360  struct iovec done_iov;
361  done_iov.iov_base = const_cast<char*>("\x42");
362  done_iov.iov_len = 1;
363  msg.msg_iov = &done_iov;
364  msg.msg_iovlen = 1;
365
366  HANDLE_EINTR(sendmsg(signal_fd, &msg, MSG_DONTWAIT | MSG_NOSIGNAL));
367  HANDLE_EINTR(close(signal_fd));
368
369  uploader_thread_->message_loop()->PostTask(
370      FROM_HERE,
371      NewRunnableFunction(&CrashDumpTask, this, info));
372}
373
374void CrashHandlerHostLinux::WillDestroyCurrentMessageLoop() {
375  file_descriptor_watcher_.StopWatchingFileDescriptor();
376
377  // If we are quitting and there are crash dumps in the queue, turn them into
378  // no-ops.
379  shutting_down_ = true;
380  uploader_thread_->Stop();
381}
382
383bool CrashHandlerHostLinux::IsShuttingDown() const {
384  return shutting_down_;
385}
386
387GpuCrashHandlerHostLinux::GpuCrashHandlerHostLinux() {
388  InitCrashUploaderThread();
389}
390
391GpuCrashHandlerHostLinux::~GpuCrashHandlerHostLinux() {
392}
393
394void GpuCrashHandlerHostLinux::SetProcessType() {
395  process_type_ = "gpu-process";
396}
397
398// static
399GpuCrashHandlerHostLinux* GpuCrashHandlerHostLinux::GetInstance() {
400  return Singleton<GpuCrashHandlerHostLinux>::get();
401}
402
403PluginCrashHandlerHostLinux::PluginCrashHandlerHostLinux() {
404  InitCrashUploaderThread();
405}
406
407PluginCrashHandlerHostLinux::~PluginCrashHandlerHostLinux() {
408}
409
410void PluginCrashHandlerHostLinux::SetProcessType() {
411  process_type_ = "plugin";
412}
413
414// static
415PluginCrashHandlerHostLinux* PluginCrashHandlerHostLinux::GetInstance() {
416  return Singleton<PluginCrashHandlerHostLinux>::get();
417}
418
419RendererCrashHandlerHostLinux::RendererCrashHandlerHostLinux() {
420  InitCrashUploaderThread();
421}
422
423RendererCrashHandlerHostLinux::~RendererCrashHandlerHostLinux() {
424}
425
426void RendererCrashHandlerHostLinux::SetProcessType() {
427  process_type_ = "renderer";
428}
429
430// static
431RendererCrashHandlerHostLinux* RendererCrashHandlerHostLinux::GetInstance() {
432  return Singleton<RendererCrashHandlerHostLinux>::get();
433}
434
435PpapiCrashHandlerHostLinux::PpapiCrashHandlerHostLinux() {
436  InitCrashUploaderThread();
437}
438
439PpapiCrashHandlerHostLinux::~PpapiCrashHandlerHostLinux() {
440}
441
442void PpapiCrashHandlerHostLinux::SetProcessType() {
443  process_type_ = "ppapi";
444}
445
446// static
447PpapiCrashHandlerHostLinux* PpapiCrashHandlerHostLinux::GetInstance() {
448  return Singleton<PpapiCrashHandlerHostLinux>::get();
449}
450