1 // Copyright (c) 2010 Google Inc.
2 // All rights reserved.
3 //
4 // Redistribution and use in source and binary forms, with or without
5 // modification, are permitted provided that the following conditions are
6 // met:
7 //
8 // * Redistributions of source code must retain the above copyright
9 // notice, this list of conditions and the following disclaimer.
10 // * Redistributions in binary form must reproduce the above
11 // copyright notice, this list of conditions and the following disclaimer
12 // in the documentation and/or other materials provided with the
13 // distribution.
14 // * Neither the name of Google Inc. nor the names of its
15 // contributors may be used to endorse or promote products derived from
16 // this software without specific prior written permission.
17 //
18 // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
19 // "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
20 // LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
21 // A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
22 // OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
23 // SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
24 // LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
25 // DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
26 // THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
27 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
28 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
29
30 // The ExceptionHandler object installs signal handlers for a number of
31 // signals. We rely on the signal handler running on the thread which crashed
32 // in order to identify it. This is true of the synchronous signals (SEGV etc),
33 // but not true of ABRT. Thus, if you send ABRT to yourself in a program which
34 // uses ExceptionHandler, you need to use tgkill to direct it to the current
35 // thread.
36 //
37 // The signal flow looks like this:
38 //
39 // SignalHandler (uses a global stack of ExceptionHandler objects to find
40 // | one to handle the signal. If the first rejects it, try
41 // | the second etc...)
42 // V
43 // HandleSignal ----------------------------| (clones a new process which
44 // | | shares an address space with
45 // (wait for cloned | the crashed process. This
46 // process) | allows us to ptrace the crashed
47 // | | process)
48 // V V
49 // (set signal handler to ThreadEntry (static function to bounce
50 // SIG_DFL and rethrow, | back into the object)
51 // killing the crashed |
52 // process) V
53 // DoDump (writes minidump)
54 // |
55 // V
56 // sys_exit
57 //
58
59 // This code is a little fragmented. Different functions of the ExceptionHandler
60 // class run in a number of different contexts. Some of them run in a normal
61 // context and are easy to code, others run in a compromised context and the
62 // restrictions at the top of minidump_writer.cc apply: no libc and use the
63 // alternative malloc. Each function should have comment above it detailing the
64 // context which it runs in.
65
66 #include "linux/handler/exception_handler.h"
67
68 #include <errno.h>
69 #include <fcntl.h>
70 #include <linux/limits.h>
71 #include <pthread.h>
72 #include <sched.h>
73 #include <signal.h>
74 #include <stdio.h>
75 #include <sys/mman.h>
76 #include <sys/prctl.h>
77 #include <sys/syscall.h>
78 #include <sys/wait.h>
79 #include <unistd.h>
80
81 #include <sys/ucontext.h>
82 #include <sys/user.h>
83 #include <ucontext.h>
84
85 #include <algorithm>
86 #include <utility>
87 #include <vector>
88
89 #include "common/basictypes.h"
90 #include "common/linux/breakpad_getcontext.h"
91 #include "common/linux/linux_libc_support.h"
92 #include "common/memory_allocator.h"
93 #include "linux/log/log.h"
94 #include "linux/microdump_writer/microdump_writer.h"
95 #include "linux/minidump_writer/linux_dumper.h"
96 #include "linux/minidump_writer/minidump_writer.h"
97 #include "common/linux/eintr_wrapper.h"
98 #include "third_party/lss/linux_syscall_support.h"
99 #if defined(MOZ_OXIDIZED_BREAKPAD)
100 #include "nsString.h"
101 #include "mozilla/toolkit/crashreporter/rust_minidump_writer_linux_ffi_generated.h"
102 #endif
103
104 #ifdef MOZ_PHC
105 #include "replace_malloc_bridge.h"
106 #endif
107
108 #if defined(__ANDROID__)
109 #include "linux/sched.h"
110 #endif
111
112 #ifndef PR_SET_PTRACER
113 #define PR_SET_PTRACER 0x59616d61
114 #endif
115
116 #define SKIP_SIGILL(sig) if (g_skip_sigill_ && (sig == SIGILL)) continue;
117
118 namespace google_breakpad {
119
120 namespace {
121 // The list of signals which we consider to be crashes. The default action for
122 // all these signals must be Core (see man 7 signal) because we rethrow the
123 // signal after handling it and expect that it'll be fatal.
124 const int kExceptionSignals[] = {
125 SIGSEGV, SIGABRT, SIGFPE, SIGILL, SIGBUS, SIGTRAP
126 };
127 const int kNumHandledSignals =
128 sizeof(kExceptionSignals) / sizeof(kExceptionSignals[0]);
129 struct sigaction old_handlers[kNumHandledSignals];
130 bool handlers_installed = false;
131
132 // InstallAlternateStackLocked will store the newly installed stack in new_stack
133 // and (if it exists) the previously installed stack in old_stack.
134 stack_t old_stack;
135 stack_t new_stack;
136 bool stack_installed = false;
137
138 // Create an alternative stack to run the signal handlers on. This is done since
139 // the signal might have been caused by a stack overflow.
140 // Runs before crashing: normal context.
InstallAlternateStackLocked()141 void InstallAlternateStackLocked() {
142 if (stack_installed)
143 return;
144
145 memset(&old_stack, 0, sizeof(old_stack));
146 memset(&new_stack, 0, sizeof(new_stack));
147
148 // SIGSTKSZ may be too small to prevent the signal handlers from overrunning
149 // the alternative stack. Ensure that the size of the alternative stack is
150 // large enough.
151 static const size_t kSigStackSize = std::max(size_t(16384), size_t(SIGSTKSZ));
152
153 // Only set an alternative stack if there isn't already one, or if the current
154 // one is too small.
155 if (sys_sigaltstack(NULL, &old_stack) == -1 || !old_stack.ss_sp ||
156 old_stack.ss_size < kSigStackSize) {
157 new_stack.ss_sp = calloc(1, kSigStackSize);
158 new_stack.ss_size = kSigStackSize;
159
160 if (sys_sigaltstack(&new_stack, NULL) == -1) {
161 free(new_stack.ss_sp);
162 return;
163 }
164 stack_installed = true;
165 }
166 }
167
168 // Runs before crashing: normal context.
RestoreAlternateStackLocked()169 void RestoreAlternateStackLocked() {
170 if (!stack_installed)
171 return;
172
173 stack_t current_stack;
174 if (sys_sigaltstack(NULL, ¤t_stack) == -1)
175 return;
176
177 // Only restore the old_stack if the current alternative stack is the one
178 // installed by the call to InstallAlternateStackLocked.
179 if (current_stack.ss_sp == new_stack.ss_sp) {
180 if (old_stack.ss_sp) {
181 if (sys_sigaltstack(&old_stack, NULL) == -1)
182 return;
183 } else {
184 stack_t disable_stack;
185 disable_stack.ss_flags = SS_DISABLE;
186 if (sys_sigaltstack(&disable_stack, NULL) == -1)
187 return;
188 }
189 }
190
191 free(new_stack.ss_sp);
192 stack_installed = false;
193 }
194
InstallDefaultHandler(int sig)195 void InstallDefaultHandler(int sig) {
196 #if defined(__ANDROID__)
197 // Android L+ expose signal and sigaction symbols that override the system
198 // ones. There is a bug in these functions where a request to set the handler
199 // to SIG_DFL is ignored. In that case, an infinite loop is entered as the
200 // signal is repeatedly sent to breakpad's signal handler.
201 // To work around this, directly call the system's sigaction.
202 struct kernel_sigaction sa;
203 memset(&sa, 0, sizeof(sa));
204 sys_sigemptyset(&sa.sa_mask);
205 sa.sa_handler_ = SIG_DFL;
206 sa.sa_flags = SA_RESTART;
207 sys_rt_sigaction(sig, &sa, NULL, sizeof(kernel_sigset_t));
208 #else
209 signal(sig, SIG_DFL);
210 #endif
211 }
212
213 // The global exception handler stack. This is needed because there may exist
214 // multiple ExceptionHandler instances in a process. Each will have itself
215 // registered in this stack.
216 std::vector<ExceptionHandler*>* g_handler_stack_ = NULL;
217 pthread_mutex_t g_handler_stack_mutex_ = PTHREAD_MUTEX_INITIALIZER;
218
219 // sizeof(CrashContext) can be too big w.r.t the size of alternatate stack
220 // for SignalHandler(). Keep the crash context as a .bss field. Exception
221 // handlers are serialized by the |g_handler_stack_mutex_| and at most one at a
222 // time can use |g_crash_context_|.
223 ExceptionHandler::CrashContext g_crash_context_;
224
225 FirstChanceHandler g_first_chance_handler_ = nullptr;
226 bool g_skip_sigill_ = false;
227 } // namespace
228
229 // Runs before crashing: normal context.
ExceptionHandler(const MinidumpDescriptor & descriptor,FilterCallback filter,MinidumpCallback callback,void * callback_context,bool install_handler,const int server_fd)230 ExceptionHandler::ExceptionHandler(const MinidumpDescriptor& descriptor,
231 FilterCallback filter,
232 MinidumpCallback callback,
233 void* callback_context,
234 bool install_handler,
235 const int server_fd)
236 : filter_(filter),
237 callback_(callback),
238 callback_context_(callback_context),
239 minidump_descriptor_(descriptor),
240 crash_handler_(NULL) {
241
242 g_skip_sigill_ = getenv("MOZ_DISABLE_EXCEPTION_HANDLER_SIGILL") ? true : false;
243 if (server_fd >= 0)
244 crash_generation_client_.reset(CrashGenerationClient::TryCreate(server_fd));
245
246 if (!IsOutOfProcess() && !minidump_descriptor_.IsFD() &&
247 !minidump_descriptor_.IsMicrodumpOnConsole())
248 minidump_descriptor_.UpdatePath();
249
250 #if defined(__ANDROID__)
251 if (minidump_descriptor_.IsMicrodumpOnConsole())
252 logger::initializeCrashLogWriter();
253 #endif
254
255 pthread_mutex_lock(&g_handler_stack_mutex_);
256
257 // Pre-fault the crash context struct. This is to avoid failing due to OOM
258 // if handling an exception when the process ran out of virtual memory.
259 memset(&g_crash_context_, 0, sizeof(g_crash_context_));
260
261 if (!g_handler_stack_)
262 g_handler_stack_ = new std::vector<ExceptionHandler*>;
263 if (install_handler) {
264 InstallAlternateStackLocked();
265 InstallHandlersLocked();
266 }
267 g_handler_stack_->push_back(this);
268 pthread_mutex_unlock(&g_handler_stack_mutex_);
269 }
270
271 // Runs before crashing: normal context.
~ExceptionHandler()272 ExceptionHandler::~ExceptionHandler() {
273 pthread_mutex_lock(&g_handler_stack_mutex_);
274 std::vector<ExceptionHandler*>::iterator handler =
275 std::find(g_handler_stack_->begin(), g_handler_stack_->end(), this);
276 g_handler_stack_->erase(handler);
277 if (g_handler_stack_->empty()) {
278 delete g_handler_stack_;
279 g_handler_stack_ = NULL;
280 RestoreAlternateStackLocked();
281 RestoreHandlersLocked();
282 }
283 pthread_mutex_unlock(&g_handler_stack_mutex_);
284 }
285
286 // Runs before crashing: normal context.
287 // static
InstallHandlersLocked()288 bool ExceptionHandler::InstallHandlersLocked() {
289 if (handlers_installed)
290 return false;
291
292 // Fail if unable to store all the old handlers.
293 for (int i = 0; i < kNumHandledSignals; ++i) {
294 SKIP_SIGILL(kExceptionSignals[i]);
295 if (sigaction(kExceptionSignals[i], NULL, &old_handlers[i]) == -1)
296 return false;
297 }
298
299 struct sigaction sa;
300 memset(&sa, 0, sizeof(sa));
301 sigemptyset(&sa.sa_mask);
302
303 // Mask all exception signals when we're handling one of them.
304 for (int i = 0; i < kNumHandledSignals; ++i) {
305 SKIP_SIGILL(kExceptionSignals[i]);
306 sigaddset(&sa.sa_mask, kExceptionSignals[i]);
307 }
308
309 sa.sa_sigaction = SignalHandler;
310 sa.sa_flags = SA_ONSTACK | SA_SIGINFO;
311
312 for (int i = 0; i < kNumHandledSignals; ++i) {
313 SKIP_SIGILL(kExceptionSignals[i]);
314 if (sigaction(kExceptionSignals[i], &sa, NULL) == -1) {
315 // At this point it is impractical to back out changes, and so failure to
316 // install a signal is intentionally ignored.
317 }
318 }
319 handlers_installed = true;
320 return true;
321 }
322
323 // This function runs in a compromised context: see the top of the file.
324 // Runs on the crashing thread.
325 // static
RestoreHandlersLocked()326 void ExceptionHandler::RestoreHandlersLocked() {
327 if (!handlers_installed)
328 return;
329
330 for (int i = 0; i < kNumHandledSignals; ++i) {
331 SKIP_SIGILL(kExceptionSignals[i]);
332 if (sigaction(kExceptionSignals[i], &old_handlers[i], NULL) == -1) {
333 InstallDefaultHandler(kExceptionSignals[i]);
334 }
335 }
336 handlers_installed = false;
337 }
338
339 // void ExceptionHandler::set_crash_handler(HandlerCallback callback) {
340 // crash_handler_ = callback;
341 // }
342
343 // This function runs in a compromised context: see the top of the file.
344 // Runs on the crashing thread.
345 // static
SignalHandler(int sig,siginfo_t * info,void * uc)346 void ExceptionHandler::SignalHandler(int sig, siginfo_t* info, void* uc) {
347
348 // Give the first chance handler a chance to recover from this signal
349 //
350 // This is primarily used by V8. V8 uses guard regions to guarantee memory
351 // safety in WebAssembly. This means some signals might be expected if they
352 // originate from Wasm code while accessing the guard region. We give V8 the
353 // chance to handle and recover from these signals first.
354 if (g_first_chance_handler_ != nullptr &&
355 g_first_chance_handler_(sig, info, uc)) {
356 return;
357 }
358
359 // All the exception signals are blocked at this point.
360 pthread_mutex_lock(&g_handler_stack_mutex_);
361
362 // Sometimes, Breakpad runs inside a process where some other buggy code
363 // saves and restores signal handlers temporarily with 'signal'
364 // instead of 'sigaction'. This loses the SA_SIGINFO flag associated
365 // with this function. As a consequence, the values of 'info' and 'uc'
366 // become totally bogus, generally inducing a crash.
367 //
368 // The following code tries to detect this case. When it does, it
369 // resets the signal handlers with sigaction + SA_SIGINFO and returns.
370 // This forces the signal to be thrown again, but this time the kernel
371 // will call the function with the right arguments.
372 struct sigaction cur_handler;
373 if (sigaction(sig, NULL, &cur_handler) == 0 &&
374 cur_handler.sa_sigaction == SignalHandler &&
375 (cur_handler.sa_flags & SA_SIGINFO) == 0) {
376 // Reset signal handler with the right flags.
377 sigemptyset(&cur_handler.sa_mask);
378 sigaddset(&cur_handler.sa_mask, sig);
379
380 cur_handler.sa_sigaction = SignalHandler;
381 cur_handler.sa_flags = SA_ONSTACK | SA_SIGINFO;
382
383 if (sigaction(sig, &cur_handler, NULL) == -1) {
384 // When resetting the handler fails, try to reset the
385 // default one to avoid an infinite loop here.
386 InstallDefaultHandler(sig);
387 }
388 pthread_mutex_unlock(&g_handler_stack_mutex_);
389 return;
390 }
391
392 bool handled = false;
393 for (int i = g_handler_stack_->size() - 1; !handled && i >= 0; --i) {
394 handled = (*g_handler_stack_)[i]->HandleSignal(sig, info, uc);
395 }
396
397 // Upon returning from this signal handler, sig will become unmasked and then
398 // it will be retriggered. If one of the ExceptionHandlers handled it
399 // successfully, restore the default handler. Otherwise, restore the
400 // previously installed handler. Then, when the signal is retriggered, it will
401 // be delivered to the appropriate handler.
402 if (handled) {
403 InstallDefaultHandler(sig);
404 } else {
405 RestoreHandlersLocked();
406 }
407
408 pthread_mutex_unlock(&g_handler_stack_mutex_);
409
410 // info->si_code <= 0 iff SI_FROMUSER (SI_FROMKERNEL otherwise).
411 if (info->si_code <= 0 || sig == SIGABRT) {
412 // This signal was triggered by somebody sending us the signal with kill().
413 // In order to retrigger it, we have to queue a new signal by calling
414 // kill() ourselves. The special case (si_pid == 0 && sig == SIGABRT) is
415 // due to the kernel sending a SIGABRT from a user request via SysRQ.
416 if (sys_tgkill(getpid(), syscall(__NR_gettid), sig) < 0) {
417 // If we failed to kill ourselves (e.g. because a sandbox disallows us
418 // to do so), we instead resort to terminating our process. This will
419 // result in an incorrect exit code.
420 _exit(1);
421 }
422 } else {
423 // This was a synchronous signal triggered by a hard fault (e.g. SIGSEGV).
424 // No need to reissue the signal. It will automatically trigger again,
425 // when we return from the signal handler.
426 }
427 }
428
429 struct ThreadArgument {
430 pid_t pid; // the crashing process
431 const MinidumpDescriptor* minidump_descriptor;
432 ExceptionHandler* handler;
433 const void* context; // a CrashContext structure
434 size_t context_size;
435 };
436
437 // This is the entry function for the cloned process. We are in a compromised
438 // context here: see the top of the file.
439 // static
ThreadEntry(void * arg)440 int ExceptionHandler::ThreadEntry(void *arg) {
441 const ThreadArgument *thread_arg = reinterpret_cast<ThreadArgument*>(arg);
442
443 // Close the write end of the pipe. This allows us to fail if the parent dies
444 // while waiting for the continue signal.
445 sys_close(thread_arg->handler->fdes[1]);
446
447 // Block here until the crashing process unblocks us when
448 // we're allowed to use ptrace
449 thread_arg->handler->WaitForContinueSignal();
450 sys_close(thread_arg->handler->fdes[0]);
451
452 return thread_arg->handler->DoDump(thread_arg->pid, thread_arg->context,
453 thread_arg->context_size) == false;
454 }
455
456 #ifdef MOZ_PHC
GetPHCAddrInfo(siginfo_t * siginfo,mozilla::phc::AddrInfo * addr_info)457 static void GetPHCAddrInfo(siginfo_t* siginfo,
458 mozilla::phc::AddrInfo* addr_info) {
459 // Is this a crash involving a PHC allocation?
460 if (siginfo->si_signo == SIGSEGV || siginfo->si_signo == SIGBUS) {
461 ReplaceMalloc::IsPHCAllocation(siginfo->si_addr, addr_info);
462 }
463 }
464 #endif
465
466 // This function runs in a compromised context: see the top of the file.
467 // Runs on the crashing thread.
HandleSignal(int,siginfo_t * info,void * uc)468 bool ExceptionHandler::HandleSignal(int /*sig*/, siginfo_t* info, void* uc) {
469 mozilla::phc::AddrInfo addr_info;
470 #ifdef MOZ_PHC
471 GetPHCAddrInfo(info, &addr_info);
472 #endif
473
474 if (filter_ && !filter_(callback_context_))
475 return false;
476
477 // Allow ourselves to be dumped if the signal is trusted.
478 bool signal_trusted = info->si_code > 0;
479 bool signal_pid_trusted = info->si_code == SI_USER ||
480 info->si_code == SI_TKILL;
481 if (signal_trusted || (signal_pid_trusted && info->si_pid == getpid())) {
482 sys_prctl(PR_SET_DUMPABLE, 1, 0, 0, 0);
483 }
484
485 // Fill in all the holes in the struct to make Valgrind happy.
486 memset(&g_crash_context_, 0, sizeof(g_crash_context_));
487 memcpy(&g_crash_context_.siginfo, info, sizeof(siginfo_t));
488 memcpy(&g_crash_context_.context, uc, sizeof(ucontext_t));
489 #if defined(__aarch64__)
490 ucontext_t* uc_ptr = (ucontext_t*)uc;
491 struct fpsimd_context* fp_ptr =
492 (struct fpsimd_context*)&uc_ptr->uc_mcontext.__reserved;
493 if (fp_ptr->head.magic == FPSIMD_MAGIC) {
494 memcpy(&g_crash_context_.float_state, fp_ptr,
495 sizeof(g_crash_context_.float_state));
496 }
497 #elif !defined(__ARM_EABI__) && !defined(__mips__)
498 // FP state is not part of user ABI on ARM Linux.
499 // In case of MIPS Linux FP state is already part of ucontext_t
500 // and 'float_state' is not a member of CrashContext.
501 ucontext_t* uc_ptr = (ucontext_t*)uc;
502 if (uc_ptr->uc_mcontext.fpregs) {
503 memcpy(&g_crash_context_.float_state, uc_ptr->uc_mcontext.fpregs,
504 sizeof(g_crash_context_.float_state));
505 }
506 #endif
507 g_crash_context_.tid = syscall(__NR_gettid);
508 if (crash_handler_ != NULL) {
509 if (crash_handler_(&g_crash_context_, sizeof(g_crash_context_),
510 callback_context_)) {
511 return true;
512 }
513 }
514
515 return GenerateDump(&g_crash_context_, &addr_info);
516 }
517
518 // This is a public interface to HandleSignal that allows the client to
519 // generate a crash dump. This function may run in a compromised context.
SimulateSignalDelivery(int sig)520 bool ExceptionHandler::SimulateSignalDelivery(int sig) {
521 siginfo_t siginfo = {};
522 // Mimic a trusted signal to allow tracing the process (see
523 // ExceptionHandler::HandleSignal().
524 siginfo.si_code = SI_USER;
525 siginfo.si_pid = getpid();
526 ucontext_t context;
527 getcontext(&context);
528 return HandleSignal(sig, &siginfo, &context);
529 }
530
531 // This function may run in a compromised context: see the top of the file.
GenerateDump(CrashContext * context,const mozilla::phc::AddrInfo * addr_info)532 bool ExceptionHandler::GenerateDump(
533 CrashContext *context, const mozilla::phc::AddrInfo* addr_info) {
534 if (IsOutOfProcess()) {
535 bool success =
536 crash_generation_client_->RequestDump(context, sizeof(*context));
537
538 if (callback_) {
539 success =
540 callback_(minidump_descriptor_, callback_context_, addr_info, success);
541 }
542
543 return success;
544 }
545
546 // Allocating too much stack isn't a problem, and better to err on the side
547 // of caution than smash it into random locations.
548 static const unsigned kChildStackSize = 16000;
549 PageAllocator allocator;
550 uint8_t* stack = reinterpret_cast<uint8_t*>(allocator.Alloc(kChildStackSize));
551 if (!stack)
552 return false;
553 // clone() needs the top-most address. (scrub just to be safe)
554 stack += kChildStackSize;
555 my_memset(stack - 16, 0, 16);
556
557 ThreadArgument thread_arg;
558 thread_arg.handler = this;
559 thread_arg.minidump_descriptor = &minidump_descriptor_;
560 thread_arg.pid = getpid();
561 thread_arg.context = context;
562 thread_arg.context_size = sizeof(*context);
563
564 // We need to explicitly enable ptrace of parent processes on some
565 // kernels, but we need to know the PID of the cloned process before we
566 // can do this. Create a pipe here which we can use to block the
567 // cloned process after creating it, until we have explicitly enabled ptrace
568 if (sys_pipe(fdes) == -1) {
569 // Creating the pipe failed. We'll log an error but carry on anyway,
570 // as we'll probably still get a useful crash report. All that will happen
571 // is the write() and read() calls will fail with EBADF
572 static const char no_pipe_msg[] = "ExceptionHandler::GenerateDump "
573 "sys_pipe failed:";
574 logger::write(no_pipe_msg, sizeof(no_pipe_msg) - 1);
575 logger::write(strerror(errno), strlen(strerror(errno)));
576 logger::write("\n", 1);
577
578 // Ensure fdes[0] and fdes[1] are invalid file descriptors.
579 fdes[0] = fdes[1] = -1;
580 }
581
582 const pid_t child = sys_clone(
583 ThreadEntry, stack, CLONE_FS | CLONE_UNTRACED, &thread_arg, NULL, NULL,
584 NULL);
585 if (child == -1) {
586 sys_close(fdes[0]);
587 sys_close(fdes[1]);
588 return false;
589 }
590
591 if (child != 0) {
592 static const char clonedMsg[] =
593 "ExceptionHandler::GenerateDump cloned child ";
594 char pidMsg[32] = {};
595
596 unsigned int pidLen = my_uint_len(child);
597 my_uitos(pidMsg, child, pidLen);
598
599 logger::write(clonedMsg, my_strlen(clonedMsg));
600 logger::write(pidMsg, pidLen);
601 logger::write("\n", 1);
602 } else {
603 static const char childMsg[] =
604 "ExceptionHandler::GenerateDump I'm the child\n";
605 logger::write(childMsg, my_strlen(childMsg));
606 }
607
608 // Close the read end of the pipe.
609 sys_close(fdes[0]);
610 // Allow the child to ptrace us
611 sys_prctl(PR_SET_PTRACER, child, 0, 0, 0);
612 SendContinueSignalToChild();
613 int status = 0;
614 const int r = HANDLE_EINTR(sys_waitpid(child, &status, __WALL));
615
616 sys_close(fdes[1]);
617
618 if (r == -1) {
619 static const char msg[] = "ExceptionHandler::GenerateDump waitpid failed:";
620 logger::write(msg, sizeof(msg) - 1);
621 logger::write(strerror(errno), strlen(strerror(errno)));
622 logger::write("\n", 1);
623 }
624
625 bool success = r != -1 && WIFEXITED(status) && WEXITSTATUS(status) == 0;
626 if (callback_)
627 success =
628 callback_(minidump_descriptor_, callback_context_, addr_info, success);
629 return success;
630 }
631
632 // This function runs in a compromised context: see the top of the file.
SendContinueSignalToChild()633 void ExceptionHandler::SendContinueSignalToChild() {
634 static const char okToContinueMessage = 'a';
635 int r;
636 r = HANDLE_EINTR(sys_write(fdes[1], &okToContinueMessage, sizeof(char)));
637 if (r == -1) {
638 static const char msg[] = "ExceptionHandler::SendContinueSignalToChild "
639 "sys_write failed:";
640 logger::write(msg, sizeof(msg) - 1);
641 logger::write(strerror(errno), strlen(strerror(errno)));
642 logger::write("\n", 1);
643 }
644
645 const char* msg = "ExceptionHandler::SendContinueSignalToChild sent continue signal to child\n";
646 logger::write(msg, my_strlen(msg));
647 }
648
649 // This function runs in a compromised context: see the top of the file.
650 // Runs on the cloned process.
WaitForContinueSignal()651 void ExceptionHandler::WaitForContinueSignal() {
652 int r;
653 char receivedMessage;
654
655 const char* waitMsg = "ExceptionHandler::WaitForContinueSignal waiting for continue signal...\n";
656 logger::write(waitMsg, my_strlen(waitMsg));
657
658 r = HANDLE_EINTR(sys_read(fdes[0], &receivedMessage, sizeof(char)));
659 if (r == -1) {
660 static const char msg[] = "ExceptionHandler::WaitForContinueSignal "
661 "sys_read failed:";
662 logger::write(msg, sizeof(msg) - 1);
663 logger::write(strerror(errno), strlen(strerror(errno)));
664 logger::write("\n", 1);
665 }
666 }
667
668 // This function runs in a compromised context: see the top of the file.
669 // Runs on the cloned process.
DoDump(pid_t crashing_process,const void * context,size_t context_size)670 bool ExceptionHandler::DoDump(pid_t crashing_process, const void* context,
671 size_t context_size) {
672 const bool may_skip_dump =
673 minidump_descriptor_.skip_dump_if_principal_mapping_not_referenced();
674 const uintptr_t principal_mapping_address =
675 minidump_descriptor_.address_within_principal_mapping();
676 const bool sanitize_stacks = minidump_descriptor_.sanitize_stacks();
677 if (minidump_descriptor_.IsMicrodumpOnConsole()) {
678 return google_breakpad::WriteMicrodump(
679 crashing_process,
680 context,
681 context_size,
682 mapping_list_,
683 may_skip_dump,
684 principal_mapping_address,
685 sanitize_stacks,
686 *minidump_descriptor_.microdump_extra_info());
687 }
688 if (minidump_descriptor_.IsFD()) {
689 return google_breakpad::WriteMinidump(minidump_descriptor_.fd(),
690 minidump_descriptor_.size_limit(),
691 crashing_process,
692 context,
693 context_size,
694 mapping_list_,
695 app_memory_list_,
696 may_skip_dump,
697 principal_mapping_address,
698 sanitize_stacks);
699 }
700 return google_breakpad::WriteMinidump(minidump_descriptor_.path(),
701 minidump_descriptor_.size_limit(),
702 crashing_process,
703 context,
704 context_size,
705 mapping_list_,
706 app_memory_list_,
707 may_skip_dump,
708 principal_mapping_address,
709 sanitize_stacks);
710 }
711
712 // static
WriteMinidump(const string & dump_path,MinidumpCallback callback,void * callback_context)713 bool ExceptionHandler::WriteMinidump(const string& dump_path,
714 MinidumpCallback callback,
715 void* callback_context) {
716 MinidumpDescriptor descriptor(dump_path);
717 ExceptionHandler eh(descriptor, NULL, callback, callback_context, false, -1);
718 return eh.WriteMinidump();
719 }
720
721 // In order to making using EBP to calculate the desired value for ESP
722 // a valid operation, ensure that this function is compiled with a
723 // frame pointer using the following attribute. This attribute
724 // is supported on GCC but not on clang.
725 #if defined(__i386__) && defined(__GNUC__) && !defined(__clang__)
726 __attribute__((optimize("no-omit-frame-pointer")))
727 #endif
WriteMinidump()728 bool ExceptionHandler::WriteMinidump() {
729 if (!IsOutOfProcess() && !minidump_descriptor_.IsFD() &&
730 !minidump_descriptor_.IsMicrodumpOnConsole()) {
731 // Update the path of the minidump so that this can be called multiple times
732 // and new files are created for each minidump. This is done before the
733 // generation happens, as clients may want to access the MinidumpDescriptor
734 // after this call to find the exact path to the minidump file.
735 minidump_descriptor_.UpdatePath();
736 } else if (minidump_descriptor_.IsFD()) {
737 // Reposition the FD to its beginning and resize it to get rid of the
738 // previous minidump info.
739 lseek(minidump_descriptor_.fd(), 0, SEEK_SET);
740 ignore_result(ftruncate(minidump_descriptor_.fd(), 0));
741 }
742
743 // Allow this process to be dumped.
744 sys_prctl(PR_SET_DUMPABLE, 1, 0, 0, 0);
745
746 CrashContext context;
747 int getcontext_result = getcontext(&context.context);
748 if (getcontext_result)
749 return false;
750
751 #if defined(__i386__)
752 // In CPUFillFromUContext in minidumpwriter.cc the stack pointer is retrieved
753 // from REG_UESP instead of from REG_ESP. REG_UESP is the user stack pointer
754 // and it only makes sense when running in kernel mode with a different stack
755 // pointer. When WriteMiniDump is called during normal processing REG_UESP is
756 // zero which leads to bad minidump files.
757 if (!context.context.uc_mcontext.gregs[REG_UESP]) {
758 // If REG_UESP is set to REG_ESP then that includes the stack space for the
759 // CrashContext object in this function, which is about 128 KB. Since the
760 // Linux dumper only records 32 KB of stack this would mean that nothing
761 // useful would be recorded. A better option is to set REG_UESP to REG_EBP,
762 // perhaps with a small negative offset in case there is any code that
763 // objects to them being equal.
764 context.context.uc_mcontext.gregs[REG_UESP] =
765 context.context.uc_mcontext.gregs[REG_EBP] - 16;
766 // The stack saving is based off of REG_ESP so it must be set to match the
767 // new REG_UESP.
768 context.context.uc_mcontext.gregs[REG_ESP] =
769 context.context.uc_mcontext.gregs[REG_UESP];
770 }
771 #endif
772
773 #if !defined(__ARM_EABI__) && !defined(__aarch64__) && !defined(__mips__)
774 // FPU state is not part of ARM EABI ucontext_t.
775 memcpy(&context.float_state, context.context.uc_mcontext.fpregs,
776 sizeof(context.float_state));
777 #endif
778 context.tid = sys_gettid();
779
780 // Add an exception stream to the minidump for better reporting.
781 memset(&context.siginfo, 0, sizeof(context.siginfo));
782 context.siginfo.si_signo = MD_EXCEPTION_CODE_LIN_DUMP_REQUESTED;
783 #if defined(__i386__)
784 context.siginfo.si_addr =
785 reinterpret_cast<void*>(context.context.uc_mcontext.gregs[REG_EIP]);
786 #elif defined(__x86_64__)
787 context.siginfo.si_addr =
788 reinterpret_cast<void*>(context.context.uc_mcontext.gregs[REG_RIP]);
789 #elif defined(__arm__)
790 context.siginfo.si_addr =
791 reinterpret_cast<void*>(context.context.uc_mcontext.arm_pc);
792 #elif defined(__aarch64__)
793 context.siginfo.si_addr =
794 reinterpret_cast<void*>(context.context.uc_mcontext.pc);
795 #elif defined(__mips__)
796 context.siginfo.si_addr =
797 reinterpret_cast<void*>(context.context.uc_mcontext.pc);
798 #else
799 #error "This code has not been ported to your platform yet."
800 #endif
801
802 // nullptr here for phc::AddrInfo* is ok because this is not a crash.
803 return GenerateDump(&context, nullptr);
804 }
805
AddMappingInfo(const string & name,const wasteful_vector<uint8_t> & identifier,uintptr_t start_address,size_t mapping_size,size_t file_offset)806 void ExceptionHandler::AddMappingInfo(const string& name,
807 const wasteful_vector<uint8_t>& identifier,
808 uintptr_t start_address,
809 size_t mapping_size,
810 size_t file_offset) {
811 MappingInfo info;
812 info.start_addr = start_address;
813 info.size = mapping_size;
814 info.offset = file_offset;
815 strncpy(info.name, name.c_str(), sizeof(info.name) - 1);
816 info.name[sizeof(info.name) - 1] = '\0';
817
818 MappingEntry mapping;
819 mapping.first = info;
820 mapping.second.assign(identifier.begin(), identifier.end());
821 mapping_list_.push_back(mapping);
822 }
823
RegisterAppMemory(void * ptr,size_t length)824 void ExceptionHandler::RegisterAppMemory(void* ptr, size_t length) {
825 AppMemoryList::iterator iter =
826 std::find(app_memory_list_.begin(), app_memory_list_.end(), ptr);
827 if (iter != app_memory_list_.end()) {
828 // Don't allow registering the same pointer twice.
829 return;
830 }
831
832 AppMemory app_memory;
833 app_memory.ptr = ptr;
834 app_memory.length = length;
835 app_memory_list_.push_back(app_memory);
836 }
837
UnregisterAppMemory(void * ptr)838 void ExceptionHandler::UnregisterAppMemory(void* ptr) {
839 AppMemoryList::iterator iter =
840 std::find(app_memory_list_.begin(), app_memory_list_.end(), ptr);
841 if (iter != app_memory_list_.end()) {
842 app_memory_list_.erase(iter);
843 }
844 }
845
846 // static
WriteMinidumpForChild(pid_t child,pid_t child_blamed_thread,const string & dump_path,MinidumpCallback callback,void * callback_context)847 bool ExceptionHandler::WriteMinidumpForChild(pid_t child,
848 pid_t child_blamed_thread,
849 const string& dump_path,
850 MinidumpCallback callback,
851 void* callback_context) {
852 // This function is not run in a compromised context.
853 MinidumpDescriptor descriptor(dump_path);
854 descriptor.UpdatePath();
855 #if defined(MOZ_OXIDIZED_BREAKPAD)
856 nsCString error_msg;
857 if (!write_minidump_linux(descriptor.path(), child, child_blamed_thread, &error_msg))
858 return false;
859 #else
860 if (!google_breakpad::WriteMinidump(descriptor.path(),
861 child,
862 child_blamed_thread))
863 return false;
864 #endif
865
866 // nullptr here for phc::AddrInfo* is ok because this is not a crash.
867 return callback ? callback(descriptor, callback_context, nullptr, true)
868 : true;
869 }
870
SetFirstChanceExceptionHandler(FirstChanceHandler callback)871 void SetFirstChanceExceptionHandler(FirstChanceHandler callback) {
872 g_first_chance_handler_ = callback;
873 }
874
875 } // namespace google_breakpad
876