476 lines
17 KiB
C++
476 lines
17 KiB
C++
// Copyright (c) 2010, Google Inc.
|
|
// All rights reserved.
|
|
//
|
|
// Redistribution and use in source and binary forms, with or without
|
|
// modification, are permitted provided that the following conditions are
|
|
// met:
|
|
//
|
|
// * Redistributions of source code must retain the above copyright
|
|
// notice, this list of conditions and the following disclaimer.
|
|
// * Redistributions in binary form must reproduce the above
|
|
// copyright notice, this list of conditions and the following disclaimer
|
|
// in the documentation and/or other materials provided with the
|
|
// distribution.
|
|
// * Neither the name of Google Inc. nor the names of its
|
|
// contributors may be used to endorse or promote products derived from
|
|
// this software without specific prior written permission.
|
|
//
|
|
// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
|
|
// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
|
|
// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
|
|
// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
|
|
// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
|
|
// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
|
|
// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
|
|
// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
|
|
// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
|
|
// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
|
|
// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
|
|
|
// linux_dumper.cc: Implement google_breakpad::LinuxDumper.
|
|
// See linux_dumper.h for details.
|
|
|
|
// This code deals with the mechanics of getting information about a crashed
|
|
// process. Since this code may run in a compromised address space, the same
|
|
// rules apply as detailed at the top of minidump_writer.h: no libc calls and
|
|
// use the alternative allocator.
|
|
|
|
#include "client/linux/minidump_writer/linux_dumper.h"
|
|
|
|
#include <assert.h>
|
|
#include <elf.h>
|
|
#include <fcntl.h>
|
|
#include <limits.h>
|
|
#include <stddef.h>
|
|
#include <string.h>
|
|
|
|
#include "client/linux/minidump_writer/line_reader.h"
|
|
#include "common/linux/elfutils.h"
|
|
#include "common/linux/file_id.h"
|
|
#include "common/linux/linux_libc_support.h"
|
|
#include "common/linux/memory_mapped_file.h"
|
|
#include "common/linux/safe_readlink.h"
|
|
#include "third_party/lss/linux_syscall_support.h"
|
|
|
|
static const char kMappedFileUnsafePrefix[] = "/dev/";
|
|
static const char kDeletedSuffix[] = " (deleted)";
|
|
static const char kReservedFlags[] = " ---p";
|
|
|
|
inline static bool IsMappedFileOpenUnsafe(
|
|
const google_breakpad::MappingInfo& mapping) {
|
|
// It is unsafe to attempt to open a mapped file that lives under /dev,
|
|
// because the semantics of the open may be driver-specific so we'd risk
|
|
// hanging the crash dumper. And a file in /dev/ almost certainly has no
|
|
// ELF file identifier anyways.
|
|
return my_strncmp(mapping.name,
|
|
kMappedFileUnsafePrefix,
|
|
sizeof(kMappedFileUnsafePrefix) - 1) == 0;
|
|
}
|
|
|
|
namespace google_breakpad {
|
|
|
|
// All interesting auvx entry types are below AT_SYSINFO_EHDR
|
|
#define AT_MAX AT_SYSINFO_EHDR
|
|
|
|
LinuxDumper::LinuxDumper(pid_t pid)
|
|
: pid_(pid),
|
|
crash_address_(0),
|
|
crash_signal_(0),
|
|
crash_thread_(pid),
|
|
threads_(&allocator_, 8),
|
|
mappings_(&allocator_),
|
|
auxv_(&allocator_, AT_MAX + 1) {
|
|
// The passed-in size to the constructor (above) is only a hint.
|
|
// Must call .resize() to do actual initialization of the elements.
|
|
auxv_.resize(AT_MAX + 1);
|
|
}
|
|
|
|
LinuxDumper::~LinuxDumper() {
|
|
}
|
|
|
|
bool LinuxDumper::Init() {
|
|
return ReadAuxv() && EnumerateThreads() && EnumerateMappings();
|
|
}
|
|
|
|
bool
|
|
LinuxDumper::ElfFileIdentifierForMapping(const MappingInfo& mapping,
|
|
bool member,
|
|
unsigned int mapping_id,
|
|
uint8_t identifier[sizeof(MDGUID)]) {
|
|
assert(!member || mapping_id < mappings_.size());
|
|
my_memset(identifier, 0, sizeof(MDGUID));
|
|
if (IsMappedFileOpenUnsafe(mapping))
|
|
return false;
|
|
|
|
// Special-case linux-gate because it's not a real file.
|
|
if (my_strcmp(mapping.name, kLinuxGateLibraryName) == 0) {
|
|
void* linux_gate = NULL;
|
|
if (pid_ == sys_getpid()) {
|
|
linux_gate = reinterpret_cast<void*>(mapping.start_addr);
|
|
} else {
|
|
linux_gate = allocator_.Alloc(mapping.size);
|
|
CopyFromProcess(linux_gate, pid_,
|
|
reinterpret_cast<const void*>(mapping.start_addr),
|
|
mapping.size);
|
|
}
|
|
return FileID::ElfFileIdentifierFromMappedFile(linux_gate, identifier);
|
|
}
|
|
|
|
char filename[NAME_MAX];
|
|
size_t filename_len = my_strlen(mapping.name);
|
|
if (filename_len >= NAME_MAX) {
|
|
assert(false);
|
|
return false;
|
|
}
|
|
my_memcpy(filename, mapping.name, filename_len);
|
|
filename[filename_len] = '\0';
|
|
bool filename_modified = HandleDeletedFileInMapping(filename);
|
|
|
|
MemoryMappedFile mapped_file(filename, mapping.offset);
|
|
if (!mapped_file.data() || mapped_file.size() < SELFMAG)
|
|
return false;
|
|
|
|
bool success =
|
|
FileID::ElfFileIdentifierFromMappedFile(mapped_file.data(), identifier);
|
|
if (success && member && filename_modified) {
|
|
mappings_[mapping_id]->name[filename_len -
|
|
sizeof(kDeletedSuffix) + 1] = '\0';
|
|
}
|
|
|
|
return success;
|
|
}
|
|
|
|
namespace {
|
|
bool ElfFileSoNameFromMappedFile(
|
|
const void* elf_base, char* soname, size_t soname_size) {
|
|
if (!IsValidElf(elf_base)) {
|
|
// Not ELF
|
|
return false;
|
|
}
|
|
|
|
const void* segment_start;
|
|
size_t segment_size;
|
|
int elf_class;
|
|
if (!FindElfSection(elf_base, ".dynamic", SHT_DYNAMIC,
|
|
&segment_start, &segment_size, &elf_class)) {
|
|
// No dynamic section
|
|
return false;
|
|
}
|
|
|
|
const void* dynstr_start;
|
|
size_t dynstr_size;
|
|
if (!FindElfSection(elf_base, ".dynstr", SHT_STRTAB,
|
|
&dynstr_start, &dynstr_size, &elf_class)) {
|
|
// No dynstr section
|
|
return false;
|
|
}
|
|
|
|
const ElfW(Dyn)* dynamic = static_cast<const ElfW(Dyn)*>(segment_start);
|
|
size_t dcount = segment_size / sizeof(ElfW(Dyn));
|
|
for (const ElfW(Dyn)* dyn = dynamic; dyn < dynamic + dcount; ++dyn) {
|
|
if (dyn->d_tag == DT_SONAME) {
|
|
const char* dynstr = static_cast<const char*>(dynstr_start);
|
|
if (dyn->d_un.d_val >= dynstr_size) {
|
|
// Beyond the end of the dynstr section
|
|
return false;
|
|
}
|
|
const char* str = dynstr + dyn->d_un.d_val;
|
|
const size_t maxsize = dynstr_size - dyn->d_un.d_val;
|
|
my_strlcpy(soname, str, maxsize < soname_size ? maxsize : soname_size);
|
|
return true;
|
|
}
|
|
}
|
|
|
|
// Did not find SONAME
|
|
return false;
|
|
}
|
|
|
|
// Find the shared object name (SONAME) by examining the ELF information
|
|
// for |mapping|. If the SONAME is found copy it into the passed buffer
|
|
// |soname| and return true. The size of the buffer is |soname_size|.
|
|
// The SONAME will be truncated if it is too long to fit in the buffer.
|
|
bool ElfFileSoName(
|
|
const MappingInfo& mapping, char* soname, size_t soname_size) {
|
|
if (IsMappedFileOpenUnsafe(mapping)) {
|
|
// Not safe
|
|
return false;
|
|
}
|
|
|
|
char filename[NAME_MAX];
|
|
size_t filename_len = my_strlen(mapping.name);
|
|
if (filename_len >= NAME_MAX) {
|
|
assert(false);
|
|
// name too long
|
|
return false;
|
|
}
|
|
|
|
my_memcpy(filename, mapping.name, filename_len);
|
|
filename[filename_len] = '\0';
|
|
|
|
MemoryMappedFile mapped_file(filename, mapping.offset);
|
|
if (!mapped_file.data() || mapped_file.size() < SELFMAG) {
|
|
// mmap failed
|
|
return false;
|
|
}
|
|
|
|
return ElfFileSoNameFromMappedFile(mapped_file.data(), soname, soname_size);
|
|
}
|
|
|
|
} // namespace
|
|
|
|
|
|
// static
|
|
void LinuxDumper::GetMappingEffectiveNameAndPath(const MappingInfo& mapping,
|
|
char* file_path,
|
|
size_t file_path_size,
|
|
char* file_name,
|
|
size_t file_name_size) {
|
|
my_strlcpy(file_path, mapping.name, file_path_size);
|
|
|
|
// If an executable is mapped from a non-zero offset, this is likely because
|
|
// the executable was loaded directly from inside an archive file (e.g., an
|
|
// apk on Android). We try to find the name of the shared object (SONAME) by
|
|
// looking in the file for ELF sections.
|
|
bool mapped_from_archive = false;
|
|
if (mapping.exec && mapping.offset != 0)
|
|
mapped_from_archive = ElfFileSoName(mapping, file_name, file_name_size);
|
|
|
|
if (mapped_from_archive) {
|
|
// Some tools (e.g., stackwalk) extract the basename from the pathname. In
|
|
// this case, we append the file_name to the mapped archive path as follows:
|
|
// file_name := libname.so
|
|
// file_path := /path/to/ARCHIVE.APK/libname.so
|
|
if (my_strlen(file_path) + 1 + my_strlen(file_name) < file_path_size) {
|
|
my_strlcat(file_path, "/", file_path_size);
|
|
my_strlcat(file_path, file_name, file_path_size);
|
|
}
|
|
} else {
|
|
// Common case:
|
|
// file_path := /path/to/libname.so
|
|
// file_name := libname.so
|
|
const char* basename = my_strrchr(file_path, '/');
|
|
basename = basename == NULL ? file_path : (basename + 1);
|
|
my_strlcpy(file_name, basename, file_name_size);
|
|
}
|
|
}
|
|
|
|
bool LinuxDumper::ReadAuxv() {
|
|
char auxv_path[NAME_MAX];
|
|
if (!BuildProcPath(auxv_path, pid_, "auxv")) {
|
|
return false;
|
|
}
|
|
|
|
int fd = sys_open(auxv_path, O_RDONLY, 0);
|
|
if (fd < 0) {
|
|
return false;
|
|
}
|
|
|
|
elf_aux_entry one_aux_entry;
|
|
bool res = false;
|
|
while (sys_read(fd,
|
|
&one_aux_entry,
|
|
sizeof(elf_aux_entry)) == sizeof(elf_aux_entry) &&
|
|
one_aux_entry.a_type != AT_NULL) {
|
|
if (one_aux_entry.a_type <= AT_MAX) {
|
|
auxv_[one_aux_entry.a_type] = one_aux_entry.a_un.a_val;
|
|
res = true;
|
|
}
|
|
}
|
|
sys_close(fd);
|
|
return res;
|
|
}
|
|
|
|
bool LinuxDumper::EnumerateMappings() {
|
|
char maps_path[NAME_MAX];
|
|
if (!BuildProcPath(maps_path, pid_, "maps"))
|
|
return false;
|
|
|
|
// linux_gate_loc is the beginning of the kernel's mapping of
|
|
// linux-gate.so in the process. It doesn't actually show up in the
|
|
// maps list as a filename, but it can be found using the AT_SYSINFO_EHDR
|
|
// aux vector entry, which gives the information necessary to special
|
|
// case its entry when creating the list of mappings.
|
|
// See http://www.trilithium.com/johan/2005/08/linux-gate/ for more
|
|
// information.
|
|
const void* linux_gate_loc =
|
|
reinterpret_cast<void *>(auxv_[AT_SYSINFO_EHDR]);
|
|
// Although the initial executable is usually the first mapping, it's not
|
|
// guaranteed (see http://crosbug.com/25355); therefore, try to use the
|
|
// actual entry point to find the mapping.
|
|
const void* entry_point_loc = reinterpret_cast<void *>(auxv_[AT_ENTRY]);
|
|
|
|
const int fd = sys_open(maps_path, O_RDONLY, 0);
|
|
if (fd < 0)
|
|
return false;
|
|
LineReader* const line_reader = new(allocator_) LineReader(fd);
|
|
|
|
const char* line;
|
|
unsigned line_len;
|
|
while (line_reader->GetNextLine(&line, &line_len)) {
|
|
uintptr_t start_addr, end_addr, offset;
|
|
|
|
const char* i1 = my_read_hex_ptr(&start_addr, line);
|
|
if (*i1 == '-') {
|
|
const char* i2 = my_read_hex_ptr(&end_addr, i1 + 1);
|
|
if (*i2 == ' ') {
|
|
bool exec = (*(i2 + 3) == 'x');
|
|
const char* i3 = my_read_hex_ptr(&offset, i2 + 6 /* skip ' rwxp ' */);
|
|
if (*i3 == ' ') {
|
|
const char* name = NULL;
|
|
// Only copy name if the name is a valid path name, or if
|
|
// it's the VDSO image.
|
|
if (((name = my_strchr(line, '/')) == NULL) &&
|
|
linux_gate_loc &&
|
|
reinterpret_cast<void*>(start_addr) == linux_gate_loc) {
|
|
name = kLinuxGateLibraryName;
|
|
offset = 0;
|
|
}
|
|
// Merge adjacent mappings with the same name into one module,
|
|
// assuming they're a single library mapped by the dynamic linker
|
|
if (name && !mappings_.empty()) {
|
|
MappingInfo* module = mappings_.back();
|
|
if ((start_addr == module->start_addr + module->size) &&
|
|
(my_strlen(name) == my_strlen(module->name)) &&
|
|
(my_strncmp(name, module->name, my_strlen(name)) == 0)) {
|
|
module->size = end_addr - module->start_addr;
|
|
line_reader->PopLine(line_len);
|
|
continue;
|
|
}
|
|
}
|
|
// Also merge mappings that result from address ranges that the
|
|
// linker reserved but which a loaded library did not use. These
|
|
// appear as an anonymous private mapping with no access flags set
|
|
// and which directly follow an executable mapping.
|
|
if (!name && !mappings_.empty()) {
|
|
MappingInfo* module = mappings_.back();
|
|
if ((start_addr == module->start_addr + module->size) &&
|
|
module->exec &&
|
|
module->name[0] == '/' &&
|
|
offset == 0 && my_strncmp(i2,
|
|
kReservedFlags,
|
|
sizeof(kReservedFlags) - 1) == 0) {
|
|
module->size = end_addr - module->start_addr;
|
|
line_reader->PopLine(line_len);
|
|
continue;
|
|
}
|
|
}
|
|
MappingInfo* const module = new(allocator_) MappingInfo;
|
|
my_memset(module, 0, sizeof(MappingInfo));
|
|
module->start_addr = start_addr;
|
|
module->size = end_addr - start_addr;
|
|
module->offset = offset;
|
|
module->exec = exec;
|
|
if (name != NULL) {
|
|
const unsigned l = my_strlen(name);
|
|
if (l < sizeof(module->name))
|
|
my_memcpy(module->name, name, l);
|
|
}
|
|
// If this is the entry-point mapping, and it's not already the
|
|
// first one, then we need to make it be first. This is because
|
|
// the minidump format assumes the first module is the one that
|
|
// corresponds to the main executable (as codified in
|
|
// processor/minidump.cc:MinidumpModuleList::GetMainModule()).
|
|
if (entry_point_loc &&
|
|
(entry_point_loc >=
|
|
reinterpret_cast<void*>(module->start_addr)) &&
|
|
(entry_point_loc <
|
|
reinterpret_cast<void*>(module->start_addr+module->size)) &&
|
|
!mappings_.empty()) {
|
|
// push the module onto the front of the list.
|
|
mappings_.resize(mappings_.size() + 1);
|
|
for (size_t idx = mappings_.size() - 1; idx > 0; idx--)
|
|
mappings_[idx] = mappings_[idx - 1];
|
|
mappings_[0] = module;
|
|
} else {
|
|
mappings_.push_back(module);
|
|
}
|
|
}
|
|
}
|
|
}
|
|
line_reader->PopLine(line_len);
|
|
}
|
|
|
|
sys_close(fd);
|
|
|
|
return !mappings_.empty();
|
|
}
|
|
|
|
// Get information about the stack, given the stack pointer. We don't try to
|
|
// walk the stack since we might not have all the information needed to do
|
|
// unwind. So we just grab, up to, 32k of stack.
|
|
bool LinuxDumper::GetStackInfo(const void** stack, size_t* stack_len,
|
|
uintptr_t int_stack_pointer) {
|
|
// Move the stack pointer to the bottom of the page that it's in.
|
|
const uintptr_t page_size = getpagesize();
|
|
|
|
uint8_t* const stack_pointer =
|
|
reinterpret_cast<uint8_t*>(int_stack_pointer & ~(page_size - 1));
|
|
|
|
// The number of bytes of stack which we try to capture.
|
|
static const ptrdiff_t kStackToCapture = 32 * 1024;
|
|
|
|
const MappingInfo* mapping = FindMapping(stack_pointer);
|
|
if (!mapping)
|
|
return false;
|
|
const ptrdiff_t offset = stack_pointer -
|
|
reinterpret_cast<uint8_t*>(mapping->start_addr);
|
|
const ptrdiff_t distance_to_end =
|
|
static_cast<ptrdiff_t>(mapping->size) - offset;
|
|
*stack_len = distance_to_end > kStackToCapture ?
|
|
kStackToCapture : distance_to_end;
|
|
*stack = stack_pointer;
|
|
return true;
|
|
}
|
|
|
|
// Find the mapping which the given memory address falls in.
|
|
const MappingInfo* LinuxDumper::FindMapping(const void* address) const {
|
|
const uintptr_t addr = (uintptr_t) address;
|
|
|
|
for (size_t i = 0; i < mappings_.size(); ++i) {
|
|
const uintptr_t start = static_cast<uintptr_t>(mappings_[i]->start_addr);
|
|
if (addr >= start && addr - start < mappings_[i]->size)
|
|
return mappings_[i];
|
|
}
|
|
|
|
return NULL;
|
|
}
|
|
|
|
bool LinuxDumper::HandleDeletedFileInMapping(char* path) const {
|
|
static const size_t kDeletedSuffixLen = sizeof(kDeletedSuffix) - 1;
|
|
|
|
// Check for ' (deleted)' in |path|.
|
|
// |path| has to be at least as long as "/x (deleted)".
|
|
const size_t path_len = my_strlen(path);
|
|
if (path_len < kDeletedSuffixLen + 2)
|
|
return false;
|
|
if (my_strncmp(path + path_len - kDeletedSuffixLen, kDeletedSuffix,
|
|
kDeletedSuffixLen) != 0) {
|
|
return false;
|
|
}
|
|
|
|
// Check |path| against the /proc/pid/exe 'symlink'.
|
|
char exe_link[NAME_MAX];
|
|
char new_path[NAME_MAX];
|
|
if (!BuildProcPath(exe_link, pid_, "exe"))
|
|
return false;
|
|
if (!SafeReadLink(exe_link, new_path))
|
|
return false;
|
|
if (my_strcmp(path, new_path) != 0)
|
|
return false;
|
|
|
|
// Check to see if someone actually named their executable 'foo (deleted)'.
|
|
struct kernel_stat exe_stat;
|
|
struct kernel_stat new_path_stat;
|
|
if (sys_stat(exe_link, &exe_stat) == 0 &&
|
|
sys_stat(new_path, &new_path_stat) == 0 &&
|
|
exe_stat.st_dev == new_path_stat.st_dev &&
|
|
exe_stat.st_ino == new_path_stat.st_ino) {
|
|
return false;
|
|
}
|
|
|
|
my_memcpy(path, exe_link, NAME_MAX);
|
|
return true;
|
|
}
|
|
|
|
} // namespace google_breakpad
|