ScoopDroid/android_system_core
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
android_system_core/debuggerd/libdebuggerd/tombstone_proto.cpp
Elliott Hughes b17d7be2e5 debuggerd: recognize jumps to non-executable memory. 
We have fairly fancy detection of stack pointer issues, but nothing for the program counter...

Bug: https://issuetracker.google.com/365602121
Change-Id: I7e7061a1b473089a0f31438df5ebc65b283475bc
2024-09-11 16:23:18 +00:00

932 lines
33 KiB
C++
Raw Blame History

/*
* Copyright (C) 2020 The Android Open Source Project
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
#define LOG_TAG "DEBUG"
#include "libdebuggerd/tombstone.h"
#include "libdebuggerd/gwp_asan.h"
#if defined(USE_SCUDO)
#include "libdebuggerd/scudo.h"
#endif
#include <errno.h>
#include <fcntl.h>
#include <inttypes.h>
#include <signal.h>
#include <stddef.h>
#include <stdint.h>
#include <stdlib.h>
#include <string.h>
#include <sys/mman.h>
#include <sys/sysinfo.h>
#include <time.h>
#include <memory>
#include <optional>
#include <set>
#include <string>
#include <async_safe/log.h>
#include <android-base/file.h>
#include <android-base/logging.h>
#include <android-base/properties.h>
#include <android-base/stringprintf.h>
#include <android-base/strings.h>
#include <android-base/unique_fd.h>
#include <android/log.h>
#include <android/set_abort_message.h>
#include <bionic/crash_detail_internal.h>
#include <bionic/macros.h>
#include <bionic/mte.h>
#include <bionic/reserved_signals.h>
#include <bionic/tls_defines.h>
#include <log/log.h>
#include <log/log_read.h>
#include <log/logprint.h>
#include <private/android_filesystem_config.h>
#include <procinfo/process.h>
#include <unwindstack/AndroidUnwinder.h>
#include <unwindstack/Error.h>
#include <unwindstack/MapInfo.h>
#include <unwindstack/Maps.h>
#include <unwindstack/Regs.h>
#include "libdebuggerd/open_files_list.h"
#include "libdebuggerd/utility.h"
#include "util.h"
#include "tombstone.pb.h"
using android::base::StringPrintf;
// The maximum number of messages to save in the protobuf per file.
static constexpr size_t kMaxLogMessages = 500;
// Use the demangler from libc++.
extern "C" char* __cxa_demangle(const char*, char*, size_t*, int* status);
static Architecture get_arch() {
#if defined(__arm__)
return Architecture::ARM32;
#elif defined(__aarch64__)
return Architecture::ARM64;
#elif defined(__i386__)
return Architecture::X86;
#elif defined(__x86_64__)
return Architecture::X86_64;
#elif defined(__riscv) && (__riscv_xlen == 64)
return Architecture::RISCV64;
#else
#error Unknown architecture!
#endif
}
static std::optional<std::string> get_stack_overflow_cause(uint64_t fault_addr, uint64_t sp,
unwindstack::Maps* maps) {
// Under stack MTE the stack pointer and/or the fault address can be tagged.
// In order to calculate deltas between them, strip off the tags off both
// addresses.
fault_addr = untag_address(fault_addr);
sp = untag_address(sp);
static constexpr uint64_t kMaxDifferenceBytes = 256;
uint64_t difference;
if (sp >= fault_addr) {
difference = sp - fault_addr;
} else {
difference = fault_addr - sp;
}
if (difference <= kMaxDifferenceBytes) {
// The faulting address is close to the current sp, check if the sp
// indicates a stack overflow.
// On arm, the sp does not get updated when the instruction faults.
// In this case, the sp will still be in a valid map, which is the
// last case below.
// On aarch64, the sp does get updated when the instruction faults.
// In this case, the sp will be in either an invalid map if triggered
// on the main thread, or in a guard map if in another thread, which
// will be the first case or second case from below.
std::shared_ptr<unwindstack::MapInfo> map_info = maps->Find(sp);
if (map_info == nullptr) {
return "stack pointer is in a non-existent map; likely due to stack overflow.";
} else if ((map_info->flags() & (PROT_READ | PROT_WRITE)) != (PROT_READ | PROT_WRITE)) {
return "stack pointer is not in a rw map; likely due to stack overflow.";
} else if ((sp - map_info->start()) <= kMaxDifferenceBytes) {
return "stack pointer is close to top of stack; likely stack overflow.";
}
}
return {};
}
void set_human_readable_cause(Cause* cause, uint64_t fault_addr) {
if (!cause->has_memory_error() || !cause->memory_error().has_heap()) {
return;
}
const MemoryError& memory_error = cause->memory_error();
const HeapObject& heap_object = memory_error.heap();
const char *tool_str;
switch (memory_error.tool()) {
case MemoryError_Tool_GWP_ASAN:
tool_str = "GWP-ASan";
break;
case MemoryError_Tool_SCUDO:
tool_str = "MTE";
break;
default:
tool_str = "Unknown";
break;
}
const char *error_type_str;
switch (memory_error.type()) {
case MemoryError_Type_USE_AFTER_FREE:
error_type_str = "Use After Free";
break;
case MemoryError_Type_DOUBLE_FREE:
error_type_str = "Double Free";
break;
case MemoryError_Type_INVALID_FREE:
error_type_str = "Invalid (Wild) Free";
break;
case MemoryError_Type_BUFFER_OVERFLOW:
error_type_str = "Buffer Overflow";
break;
case MemoryError_Type_BUFFER_UNDERFLOW:
error_type_str = "Buffer Underflow";
break;
default:
cause->set_human_readable(
StringPrintf("[%s]: Unknown error occurred at 0x%" PRIx64 ".", tool_str, fault_addr));
return;
}
uint64_t diff;
const char* location_str;
if (fault_addr < heap_object.address()) {
// Buffer Underflow, 6 bytes left of a 41-byte allocation at 0xdeadbeef.
location_str = "left of";
diff = heap_object.address() - fault_addr;
} else if (fault_addr - heap_object.address() < heap_object.size()) {
// Use After Free, 40 bytes into a 41-byte allocation at 0xdeadbeef.
location_str = "into";
diff = fault_addr - heap_object.address();
} else {
// Buffer Overflow, 6 bytes right of a 41-byte allocation at 0xdeadbeef.
location_str = "right of";
diff = fault_addr - heap_object.address() - heap_object.size();
}
// Suffix of 'bytes', i.e. 4 bytes' vs. '1 byte'.
const char* byte_suffix = "s";
if (diff == 1) {
byte_suffix = "";
}
cause->set_human_readable(StringPrintf(
"[%s]: %s, %" PRIu64 " byte%s %s a %" PRIu64 "-byte allocation at 0x%" PRIx64, tool_str,
error_type_str, diff, byte_suffix, location_str, heap_object.size(), heap_object.address()));
}
#if defined(__aarch64__)
void dump_stack_history(unwindstack::AndroidUnwinder* unwinder, uintptr_t target_tls,
StackHistoryBuffer& shb_obj, bool nounwind) {
auto process_memory = unwinder->GetProcessMemory();
target_tls += sizeof(void*) * TLS_SLOT_STACK_MTE;
uintptr_t stack_mte;
if (!process_memory->ReadFully(target_tls, &stack_mte, sizeof(stack_mte))) {
async_safe_format_log(ANDROID_LOG_ERROR, LOG_TAG,
"dump_stack_history: failed to read TLS_SLOT_STACK_MTE: %m");
return;
}
if (stack_mte == 0) {
async_safe_format_log(ANDROID_LOG_DEBUG, LOG_TAG,
"dump_stack_history: stack history buffer is null");
return;
}
uintptr_t untagged_stack_mte = untag_address(stack_mte);
uintptr_t buf_size = stack_mte_ringbuffer_size_from_pointer(stack_mte);
if (buf_size == 0) {
async_safe_format_log(ANDROID_LOG_ERROR, LOG_TAG, "dump_stack_history: empty size");
return;
}
uintptr_t buf_start = untagged_stack_mte & ~(buf_size - 1ULL);
std::vector<char> buf(buf_size);
if (!process_memory->ReadFully(buf_start, buf.data(), buf.size())) {
async_safe_format_log(ANDROID_LOG_ERROR, LOG_TAG,
"dump_stack_history: failed to read stack history: %m");
return;
}
uintptr_t original_off = untagged_stack_mte - buf_start;
if (original_off % 16 || original_off > buf_size) {
async_safe_format_log(ANDROID_LOG_ERROR, LOG_TAG,
"dump_stack_history: invalid offset: %" PRIuPTR, original_off);
return;
}
// The original_off is the next slot that would have been written, so the last
// slot that was written is the previous one.
for (uintptr_t idx = 16; idx <= buf_size; idx += 16) {
int64_t off = original_off - idx;
if (off < 0) off += buf_size;
uintptr_t pc, taggedfp;
memcpy(&pc, &(buf[off]), sizeof(pc));
memcpy(&taggedfp, &(buf[off + sizeof(pc)]), sizeof(taggedfp));
if (pc == 0) break;
uintptr_t fp = untag_address(taggedfp);
uintptr_t tag = taggedfp >> 56;
unwindstack::FrameData frame_data;
if (nounwind) {
frame_data.pc = pc;
} else {
// +4 is to counteract the "pc adjustment" in BuildFrameFromPcOnly.
// BuildFrameFromPcOnly assumes we are unwinding, so it needs to correct for that
// the PC is the return address. That is not the case here.
// It doesn't really matter, because either should be in the correct function, but
// this is more correct (and consistent with the nounwind case).
frame_data = unwinder->BuildFrameFromPcOnly(pc);
frame_data.pc += 4;
frame_data.rel_pc += 4;
}
StackHistoryBufferEntry* entry = shb_obj.add_entries();
fill_in_backtrace_frame(entry->mutable_addr(), frame_data);
entry->set_fp(fp);
entry->set_tag(tag);
}
}
static pid_t get_containing_thread(unwindstack::MapInfo* map_info, pid_t main_tid) {
if (map_info == nullptr) return 0;
std::string name = map_info->name();
if (name == "[stack]") {
return main_tid;
}
int tid;
if (sscanf(name.c_str(), "[anon:stack_and_tls:%d", &tid) != 1) {
return 0;
}
return tid;
}
static std::optional<std::string> maybe_stack_mte_cause(
Tombstone* tombstone, unwindstack::AndroidUnwinder* unwinder, const ThreadInfo& target_thread,
[[maybe_unused]] const std::map<pid_t, ThreadInfo>& threads, uint64_t fault_addr) {
unwindstack::Maps* maps = unwinder->GetMaps();
auto map_info = maps->Find(untag_address(fault_addr));
pid_t tid = get_containing_thread(map_info.get(), target_thread.tid);
if (!tid) {
return std::nullopt;
}
auto it = threads.find(tid);
if (it != threads.end()) {
StackHistoryBuffer* shb = tombstone->mutable_stack_history_buffer();
shb->set_tid(tid);
dump_stack_history(unwinder, it->second.tls, *shb);
} else {
async_safe_format_log(ANDROID_LOG_ERROR, LOG_TAG,
"dump_probable_cause: unknown target thread %d", tid);
}
return StringPrintf("stack tag-mismatch on thread %u", tid);
}
#endif
static void dump_probable_cause(Tombstone* tombstone, unwindstack::AndroidUnwinder* unwinder,
const ProcessInfo& process_info, const ThreadInfo& target_thread,
[[maybe_unused]] const std::map<pid_t, ThreadInfo>& threads) {
#if defined(USE_SCUDO)
ScudoCrashData scudo_crash_data(unwinder->GetProcessMemory().get(), process_info);
if (scudo_crash_data.CrashIsMine()) {
scudo_crash_data.AddCauseProtos(tombstone, unwinder);
return;
}
#endif
GwpAsanCrashData gwp_asan_crash_data(unwinder->GetProcessMemory().get(), process_info,
target_thread);
if (gwp_asan_crash_data.CrashIsMine()) {
gwp_asan_crash_data.AddCauseProtos(tombstone, unwinder);
return;
}
const siginfo *si = target_thread.siginfo;
auto fault_addr = reinterpret_cast<uint64_t>(si->si_addr);
unwindstack::Maps* maps = unwinder->GetMaps();
std::optional<std::string> cause;
if (si->si_signo == SIGSEGV && si->si_code == SEGV_MAPERR) {
if (fault_addr < 4096) {
cause = "null pointer dereference";
} else if (fault_addr == 0xffff0ffc) {
cause = "call to kuser_helper_version";
} else if (fault_addr == 0xffff0fe0) {
cause = "call to kuser_get_tls";
} else if (fault_addr == 0xffff0fc0) {
cause = "call to kuser_cmpxchg";
} else if (fault_addr == 0xffff0fa0) {
cause = "call to kuser_memory_barrier";
} else if (fault_addr == 0xffff0f60) {
cause = "call to kuser_cmpxchg64";
} else {
cause = get_stack_overflow_cause(fault_addr, target_thread.registers->sp(), maps);
}
} else if (si->si_signo == SIGSEGV && si->si_code == SEGV_ACCERR) {
auto map_info = maps->Find(fault_addr);
if (map_info != nullptr && map_info->flags() == PROT_EXEC) {
cause = "execute-only (no-read) memory access error; likely due to data in .text.";
} else if (fault_addr == target_thread.registers->pc() &&
map_info != nullptr && (map_info->flags() & PROT_EXEC) == 0) {
cause = "trying to execute non-executable memory.";
} else {
cause = get_stack_overflow_cause(fault_addr, target_thread.registers->sp(), maps);
}
}
#if defined(__aarch64__) && defined(SEGV_MTESERR)
else if (si->si_signo == SIGSEGV && si->si_code == SEGV_MTESERR) {
// If this was a heap MTE crash, it would have been handled by scudo. Checking whether it
// is a stack one.
cause = maybe_stack_mte_cause(tombstone, unwinder, target_thread, threads, fault_addr);
}
#endif
else if (si->si_signo == SIGSYS && si->si_code == SYS_SECCOMP) {
cause = StringPrintf("seccomp prevented call to disallowed %s system call %d", ABI_STRING,
si->si_syscall);
}
if (cause) {
Cause *cause_proto = tombstone->add_causes();
cause_proto->set_human_readable(*cause);
}
}
static void dump_crash_details(Tombstone* tombstone,
std::shared_ptr<unwindstack::Memory>& process_memory,
const ProcessInfo& process_info) {
uintptr_t address = process_info.crash_detail_page;
while (address) {
struct crash_detail_page_t page;
if (!process_memory->ReadFully(address, &page, sizeof(page))) {
async_safe_format_log(ANDROID_LOG_ERROR, LOG_TAG, "failed to read crash detail page: %m");
break;
}
if (page.used > kNumCrashDetails) {
async_safe_format_log(ANDROID_LOG_ERROR, LOG_TAG, "crash detail: page corrupted");
break;
}
for (size_t i = 0; i < page.used; ++i) {
const crash_detail_t& crash_detail = page.crash_details[i];
if (!crash_detail.data) {
continue;
}
std::string name(crash_detail.name_size, '\0');
if (!process_memory->ReadFully(reinterpret_cast<uintptr_t>(crash_detail.name), name.data(),
crash_detail.name_size)) {
async_safe_format_log(ANDROID_LOG_ERROR, LOG_TAG, "crash detail: failed to read name: %m");
continue;
}
std::string data(crash_detail.data_size, '\0');
if (!process_memory->ReadFully(reinterpret_cast<uintptr_t>(crash_detail.data), data.data(),
crash_detail.data_size)) {
async_safe_format_log(ANDROID_LOG_ERROR, LOG_TAG,
"crash detail: failed to read data for %s: %m", name.c_str());
continue;
}
auto* proto_detail = tombstone->add_crash_details();
proto_detail->set_name(name);
proto_detail->set_data(data);
}
address = reinterpret_cast<uintptr_t>(page.prev);
}
}
static void dump_abort_message(Tombstone* tombstone,
std::shared_ptr<unwindstack::Memory>& process_memory,
const ProcessInfo& process_info) {
uintptr_t address = process_info.abort_msg_address;
if (address == 0) {
return;
}
size_t length;
if (!process_memory->ReadFully(address, &length, sizeof(length))) {
async_safe_format_log(ANDROID_LOG_ERROR, LOG_TAG, "failed to read abort message header: %s",
strerror(errno));
return;
}
// The length field includes the length of the length field itself.
if (length < sizeof(size_t)) {
async_safe_format_log(ANDROID_LOG_ERROR, LOG_TAG,
"abort message header malformed: claimed length = %zu", length);
return;
}
length -= sizeof(size_t);
// The abort message should be null terminated already, but reserve a spot for NUL just in case.
std::string msg;
msg.resize(length);
if (!process_memory->ReadFully(address + sizeof(length), &msg[0], length)) {
async_safe_format_log(ANDROID_LOG_ERROR, LOG_TAG, "failed to read abort message header: %s",
strerror(errno));
return;
}
// Remove any trailing newlines.
size_t index = msg.size();
while (index > 0 && (msg[index - 1] == '\0' || msg[index - 1] == '\n')) {
--index;
}
msg.resize(index);
tombstone->set_abort_message(msg);
}
static void dump_open_fds(Tombstone* tombstone, const OpenFilesList* open_files) {
if (open_files) {
for (auto& [fd, entry] : *open_files) {
FD f;
f.set_fd(fd);
const std::optional<std::string>& path = entry.path;
if (path) {
f.set_path(*path);
}
const std::optional<uint64_t>& fdsan_owner = entry.fdsan_owner;
if (fdsan_owner) {
const char* type = android_fdsan_get_tag_type(*fdsan_owner);
uint64_t value = android_fdsan_get_tag_value(*fdsan_owner);
f.set_owner(type);
f.set_tag(value);
}
*tombstone->add_open_fds() = f;
}
}
}
void fill_in_backtrace_frame(BacktraceFrame* f, const unwindstack::FrameData& frame) {
f->set_rel_pc(frame.rel_pc);
f->set_pc(frame.pc);
f->set_sp(frame.sp);
if (!frame.function_name.empty()) {
// TODO: Should this happen here, or on the display side?
char* demangled_name = __cxa_demangle(frame.function_name.c_str(), nullptr, nullptr, nullptr);
if (demangled_name) {
f->set_function_name(demangled_name);
free(demangled_name);
} else {
f->set_function_name(frame.function_name);
}
}
f->set_function_offset(frame.function_offset);
if (frame.map_info == nullptr) {
// No valid map associated with this frame.
f->set_file_name("<unknown>");
return;
}
if (!frame.map_info->name().empty()) {
f->set_file_name(frame.map_info->GetFullName());
} else {
f->set_file_name(StringPrintf("<anonymous:%" PRIx64 ">", frame.map_info->start()));
}
f->set_file_map_offset(frame.map_info->elf_start_offset());
f->set_build_id(frame.map_info->GetPrintableBuildID());
}
static void dump_registers(unwindstack::AndroidUnwinder* unwinder,
const std::unique_ptr<unwindstack::Regs>& regs, Thread& thread,
bool memory_dump) {
if (regs == nullptr) {
return;
}
unwindstack::Maps* maps = unwinder->GetMaps();
unwindstack::Memory* memory = unwinder->GetProcessMemory().get();
regs->IterateRegisters([&thread, memory_dump, maps, memory](const char* name, uint64_t value) {
Register r;
r.set_name(name);
r.set_u64(value);
*thread.add_registers() = r;
if (memory_dump) {
MemoryDump dump;
dump.set_register_name(name);
std::shared_ptr<unwindstack::MapInfo> map_info = maps->Find(untag_address(value));
if (map_info) {
dump.set_mapping_name(map_info->name());
}
constexpr size_t kNumBytesAroundRegister = 256;
constexpr size_t kNumTagsAroundRegister = kNumBytesAroundRegister / kTagGranuleSize;
char buf[kNumBytesAroundRegister];
uint8_t tags[kNumTagsAroundRegister];
ssize_t bytes = dump_memory(buf, sizeof(buf), tags, sizeof(tags), &value, memory);
if (bytes == -1) {
return;
}
dump.set_begin_address(value);
dump.set_memory(buf, bytes);
bool has_tags = false;
#if defined(__aarch64__)
for (size_t i = 0; i < kNumTagsAroundRegister; ++i) {
if (tags[i] != 0) {
has_tags = true;
}
}
#endif // defined(__aarch64__)
if (has_tags) {
dump.mutable_arm_mte_metadata()->set_memory_tags(tags, kNumTagsAroundRegister);
}
*thread.add_memory_dump() = std::move(dump);
}
});
}
static void dump_thread_backtrace(std::vector<unwindstack::FrameData>& frames, Thread& thread) {
std::set<std::string> unreadable_elf_files;
for (const auto& frame : frames) {
BacktraceFrame* f = thread.add_current_backtrace();
fill_in_backtrace_frame(f, frame);
if (frame.map_info != nullptr && frame.map_info->ElfFileNotReadable()) {
unreadable_elf_files.emplace(frame.map_info->name());
}
}
if (!unreadable_elf_files.empty()) {
auto unreadable_elf_files_proto = thread.mutable_unreadable_elf_files();
auto backtrace_note = thread.mutable_backtrace_note();
*backtrace_note->Add() =
"Function names and BuildId information is missing for some frames due";
*backtrace_note->Add() = "to unreadable libraries. For unwinds of apps, only shared libraries";
*backtrace_note->Add() = "found under the lib/ directory are readable.";
*backtrace_note->Add() = "On this device, run setenforce 0 to make the libraries readable.";
*backtrace_note->Add() = "Unreadable libraries:";
for (auto& name : unreadable_elf_files) {
*backtrace_note->Add() = " " + name;
*unreadable_elf_files_proto->Add() = name;
}
}
}
static void dump_thread(Tombstone* tombstone, unwindstack::AndroidUnwinder* unwinder,
const ThreadInfo& thread_info, bool memory_dump = false,
unwindstack::AndroidUnwinder* guest_unwinder = nullptr) {
Thread thread;
thread.set_id(thread_info.tid);
thread.set_name(thread_info.thread_name);
thread.set_tagged_addr_ctrl(thread_info.tagged_addr_ctrl);
thread.set_pac_enabled_keys(thread_info.pac_enabled_keys);
unwindstack::AndroidUnwinderData data;
// Indicate we want a copy of the initial registers.
data.saved_initial_regs = std::make_optional<std::unique_ptr<unwindstack::Regs>>();
bool unwind_ret;
if (thread_info.registers != nullptr) {
unwind_ret = unwinder->Unwind(thread_info.registers.get(), data);
} else {
unwind_ret = unwinder->Unwind(thread_info.tid, data);
}
if (!unwind_ret) {
async_safe_format_log(ANDROID_LOG_ERROR, LOG_TAG, "Unwind failed for tid %d: Error %s",
thread_info.tid, data.GetErrorString().c_str());
} else {
dump_thread_backtrace(data.frames, thread);
}
dump_registers(unwinder, *data.saved_initial_regs, thread, memory_dump);
auto& threads = *tombstone->mutable_threads();
threads[thread_info.tid] = thread;
if (guest_unwinder) {
if (!thread_info.guest_registers) {
async_safe_format_log(ANDROID_LOG_INFO, LOG_TAG,
"No guest state registers information for tid %d", thread_info.tid);
return;
}
Thread guest_thread;
unwindstack::AndroidUnwinderData guest_data;
guest_data.saved_initial_regs = std::make_optional<std::unique_ptr<unwindstack::Regs>>();
if (guest_unwinder->Unwind(thread_info.guest_registers.get(), guest_data)) {
dump_thread_backtrace(guest_data.frames, guest_thread);
} else {
async_safe_format_log(ANDROID_LOG_ERROR, LOG_TAG,
"Unwind guest state registers failed for tid %d: Error %s",
thread_info.tid, guest_data.GetErrorString().c_str());
}
dump_registers(guest_unwinder, *guest_data.saved_initial_regs, guest_thread, memory_dump);
auto& guest_threads = *tombstone->mutable_guest_threads();
guest_threads[thread_info.tid] = guest_thread;
}
}
static void dump_mappings(Tombstone* tombstone, unwindstack::Maps* maps,
std::shared_ptr<unwindstack::Memory>& process_memory) {
for (const auto& map_info : *maps) {
auto* map = tombstone->add_memory_mappings();
map->set_begin_address(map_info->start());
map->set_end_address(map_info->end());
map->set_offset(map_info->offset());
if (map_info->flags() & PROT_READ) {
map->set_read(true);
}
if (map_info->flags() & PROT_WRITE) {
map->set_write(true);
}
if (map_info->flags() & PROT_EXEC) {
map->set_execute(true);
}
map->set_mapping_name(map_info->name());
std::string build_id = map_info->GetPrintableBuildID();
if (!build_id.empty()) {
map->set_build_id(build_id);
}
map->set_load_bias(map_info->GetLoadBias(process_memory));
}
}
// This creates a fake log message that indicates an error occurred when
// reading the log.
static void add_error_log_msg(Tombstone* tombstone, const std::string&& error_msg) {
LogBuffer buffer;
buffer.set_name("ERROR");
LogMessage* log_msg = buffer.add_logs();
log_msg->set_timestamp("00-00 00:00:00.000");
log_msg->set_pid(0);
log_msg->set_tid(0);
log_msg->set_priority(ANDROID_LOG_ERROR);
log_msg->set_tag("");
log_msg->set_message(error_msg);
*tombstone->add_log_buffers() = std::move(buffer);
async_safe_format_log(ANDROID_LOG_ERROR, LOG_TAG, "%s", error_msg.c_str());
}
static void dump_log_file(Tombstone* tombstone, const char* logger, pid_t pid) {
logger_list* logger_list = android_logger_list_open(android_name_to_log_id(logger),
ANDROID_LOG_NONBLOCK, kMaxLogMessages, pid);
if (logger_list == nullptr) {
add_error_log_msg(tombstone, android::base::StringPrintf("Cannot open log file %s", logger));
return;
}
LogBuffer buffer;
while (true) {
log_msg log_entry;
ssize_t actual = android_logger_list_read(logger_list, &log_entry);
if (actual < 0) {
if (actual == -EINTR) {
// interrupted by signal, retry
continue;
}
// Don't consider EAGAIN an error since this is a non-blocking call.
if (actual != -EAGAIN) {
add_error_log_msg(tombstone, android::base::StringPrintf("reading log %s failed (%s)",
logger, strerror(-actual)));
}
break;
} else if (actual == 0) {
break;
}
char timestamp_secs[32];
time_t sec = static_cast<time_t>(log_entry.entry.sec);
tm tm;
localtime_r(&sec, &tm);
strftime(timestamp_secs, sizeof(timestamp_secs), "%m-%d %H:%M:%S", &tm);
std::string timestamp =
StringPrintf("%s.%03d", timestamp_secs, log_entry.entry.nsec / 1'000'000);
// Msg format is: <priority:1><tag:N>\0<message:N>\0
char* msg = log_entry.msg();
if (msg == nullptr) {
continue;
}
unsigned char prio = msg[0];
char* tag = msg + 1;
msg = tag + strlen(tag) + 1;
// consume any trailing newlines
char* nl = msg + strlen(msg) - 1;
while (nl >= msg && *nl == '\n') {
*nl-- = '\0';
}
// Look for line breaks ('\n') and display each text line
// on a separate line, prefixed with the header, like logcat does.
do {
nl = strchr(msg, '\n');
if (nl != nullptr) {
*nl = '\0';
++nl;
}
LogMessage* log_msg = buffer.add_logs();
log_msg->set_timestamp(timestamp);
log_msg->set_pid(log_entry.entry.pid);
log_msg->set_tid(log_entry.entry.tid);
log_msg->set_priority(prio);
log_msg->set_tag(tag);
log_msg->set_message(msg);
} while ((msg = nl));
}
android_logger_list_free(logger_list);
if (!buffer.logs().empty()) {
buffer.set_name(logger);
*tombstone->add_log_buffers() = std::move(buffer);
}
}
static void dump_logcat(Tombstone* tombstone, pid_t pid) {
dump_log_file(tombstone, "system", pid);
dump_log_file(tombstone, "main", pid);
}
static void dump_tags_around_fault_addr(Signal* signal, const Tombstone& tombstone,
std::shared_ptr<unwindstack::Memory>& process_memory,
uintptr_t fault_addr) {
if (tombstone.arch() != Architecture::ARM64) return;
fault_addr = untag_address(fault_addr);
constexpr size_t kNumGranules = kNumTagRows * kNumTagColumns;
constexpr size_t kBytesToRead = kNumGranules * kTagGranuleSize;
// If the low part of the tag dump would underflow to the high address space, it's probably not
// a valid address for us to dump tags from.
if (fault_addr < kBytesToRead / 2) return;
constexpr uintptr_t kRowStartMask = ~(kNumTagColumns * kTagGranuleSize - 1);
size_t start_address = (fault_addr & kRowStartMask) - kBytesToRead / 2;
MemoryDump tag_dump;
size_t granules_to_read = kNumGranules;
// Attempt to read the first tag. If reading fails, this likely indicates the
// lowest touched page is inaccessible or not marked with PROT_MTE.
// Fast-forward over pages until one has tags, or we exhaust the search range.
while (process_memory->ReadTag(start_address) < 0) {
size_t page_size = sysconf(_SC_PAGE_SIZE);
size_t bytes_to_next_page = page_size - (start_address % page_size);
if (bytes_to_next_page >= granules_to_read * kTagGranuleSize) return;
start_address += bytes_to_next_page;
granules_to_read -= bytes_to_next_page / kTagGranuleSize;
}
tag_dump.set_begin_address(start_address);
std::string* mte_tags = tag_dump.mutable_arm_mte_metadata()->mutable_memory_tags();
for (size_t i = 0; i < granules_to_read; ++i) {
long tag = process_memory->ReadTag(start_address + i * kTagGranuleSize);
if (tag < 0) break;
mte_tags->push_back(static_cast<uint8_t>(tag));
}
if (!mte_tags->empty()) {
*signal->mutable_fault_adjacent_metadata() = tag_dump;
}
}
void engrave_tombstone_proto(Tombstone* tombstone, unwindstack::AndroidUnwinder* unwinder,
const std::map<pid_t, ThreadInfo>& threads, pid_t target_tid,
const ProcessInfo& process_info, const OpenFilesList* open_files,
const Architecture* guest_arch,
unwindstack::AndroidUnwinder* guest_unwinder) {
Tombstone result;
result.set_arch(get_arch());
if (guest_arch != nullptr) {
result.set_guest_arch(*guest_arch);
} else {
result.set_guest_arch(Architecture::NONE);
}
result.set_build_fingerprint(android::base::GetProperty("ro.build.fingerprint", "unknown"));
result.set_revision(android::base::GetProperty("ro.revision", "unknown"));
result.set_timestamp(get_timestamp());
const ThreadInfo& target_thread = threads.at(target_tid);
result.set_pid(target_thread.pid);
result.set_tid(target_thread.tid);
result.set_uid(target_thread.uid);
result.set_selinux_label(target_thread.selinux_label);
// The main thread must have a valid siginfo.
CHECK(target_thread.siginfo != nullptr);
struct sysinfo si;
sysinfo(&si);
android::procinfo::ProcessInfo proc_info;
std::string error;
if (android::procinfo::GetProcessInfo(target_thread.pid, &proc_info, &error)) {
uint64_t starttime = proc_info.starttime / sysconf(_SC_CLK_TCK);
result.set_process_uptime(si.uptime - starttime);
} else {
async_safe_format_log(ANDROID_LOG_ERROR, LOG_TAG, "failed to read process info: %s",
error.c_str());
}
result.set_page_size(getpagesize());
result.set_has_been_16kb_mode(android::base::GetBoolProperty("ro.misctrl.16kb_before", false));
auto cmd_line = result.mutable_command_line();
for (const auto& arg : target_thread.command_line) {
*cmd_line->Add() = arg;
}
if (!target_thread.siginfo) {
async_safe_fatal("siginfo missing");
}
Signal sig;
sig.set_number(target_thread.signo);
sig.set_name(get_signame(target_thread.siginfo));
sig.set_code(target_thread.siginfo->si_code);
sig.set_code_name(get_sigcode(target_thread.siginfo));
if (signal_has_sender(target_thread.siginfo, target_thread.pid)) {
sig.set_has_sender(true);
sig.set_sender_uid(target_thread.siginfo->si_uid);
sig.set_sender_pid(target_thread.siginfo->si_pid);
}
if (process_info.has_fault_address) {
sig.set_has_fault_address(true);
uintptr_t fault_addr = process_info.maybe_tagged_fault_address;
sig.set_fault_address(fault_addr);
dump_tags_around_fault_addr(&sig, result, unwinder->GetProcessMemory(), fault_addr);
}
*result.mutable_signal_info() = sig;
dump_abort_message(&result, unwinder->GetProcessMemory(), process_info);
dump_crash_details(&result, unwinder->GetProcessMemory(), process_info);
// Dump the target thread, but save the memory around the registers.
dump_thread(&result, unwinder, target_thread, /* memory_dump */ true, guest_unwinder);
for (const auto& [tid, thread_info] : threads) {
if (tid != target_tid) {
dump_thread(&result, unwinder, thread_info, /* memory_dump */ false, guest_unwinder);
}
}
dump_probable_cause(&result, unwinder, process_info, target_thread, threads);
dump_mappings(&result, unwinder->GetMaps(), unwinder->GetProcessMemory());
// Only dump logs on debuggable devices.
if (android::base::GetBoolProperty("ro.debuggable", false)) {
// Get the thread that corresponds to the main pid of the process.
const ThreadInfo& thread = threads.at(target_thread.pid);
// Do not attempt to dump logs of the logd process because the gathering
// of logs can hang until a timeout occurs.
if (thread.thread_name != "logd") {
dump_logcat(&result, target_thread.pid);
}
}
dump_open_fds(&result, open_files);
*tombstone = std::move(result);
}
Reference in a new issue View git blame Copy permalink