1 /*
2 * Copyright (C) 2020 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16
17 #if defined(USE_SCUDO)
18
19 #include "libdebuggerd/scudo.h"
20 #include "libdebuggerd/tombstone.h"
21 #include "libdebuggerd/utility_host.h"
22
23 #include "unwindstack/AndroidUnwinder.h"
24 #include "unwindstack/Memory.h"
25
26 #include <android-base/macros.h>
27 #include <bionic/macros.h>
28 #include <unistd.h>
29
30 #include "tombstone.pb.h"
31
AllocAndReadFully(unwindstack::Memory * process_memory,uint64_t addr,size_t size)32 std::unique_ptr<char[]> AllocAndReadFully(unwindstack::Memory* process_memory, uint64_t addr,
33 size_t size) {
34 auto buf = std::make_unique<char[]>(size);
35 if (!process_memory->ReadFully(addr, buf.get(), size)) {
36 return std::unique_ptr<char[]>();
37 }
38 return buf;
39 }
40
ScudoCrashData(unwindstack::Memory * process_memory,const ProcessInfo & process_info)41 ScudoCrashData::ScudoCrashData(unwindstack::Memory* process_memory,
42 const ProcessInfo& process_info) {
43 if (!process_info.has_fault_address) {
44 return;
45 }
46
47 auto region_info = AllocAndReadFully(process_memory, process_info.scudo_region_info,
48 __scudo_get_region_info_size());
49 std::unique_ptr<char[]> ring_buffer;
50 if (process_info.scudo_ring_buffer_size != 0) {
51 ring_buffer = AllocAndReadFully(process_memory, process_info.scudo_ring_buffer,
52 process_info.scudo_ring_buffer_size);
53 }
54 std::unique_ptr<char[]> stack_depot;
55 if (process_info.scudo_stack_depot_size != 0) {
56 stack_depot = AllocAndReadFully(process_memory, process_info.scudo_stack_depot,
57 process_info.scudo_stack_depot_size);
58 }
59 if (!region_info) {
60 return;
61 }
62
63 untagged_fault_addr_ = process_info.untagged_fault_address;
64 uintptr_t fault_page = untagged_fault_addr_ & ~(getpagesize() - 1);
65
66 uintptr_t memory_begin = fault_page - getpagesize() * 16;
67 if (memory_begin > fault_page) {
68 return;
69 }
70
71 uintptr_t memory_end = fault_page + getpagesize() * 16;
72 if (memory_end < fault_page) {
73 return;
74 }
75
76 auto memory = std::make_unique<char[]>(memory_end - memory_begin);
77 for (auto i = memory_begin; i != memory_end; i += getpagesize()) {
78 process_memory->ReadFully(i, memory.get() + i - memory_begin, getpagesize());
79 }
80
81 auto memory_tags = std::make_unique<char[]>((memory_end - memory_begin) / kTagGranuleSize);
82 for (auto i = memory_begin; i != memory_end; i += kTagGranuleSize) {
83 memory_tags[(i - memory_begin) / kTagGranuleSize] = process_memory->ReadTag(i);
84 }
85
86 __scudo_get_error_info(&error_info_, process_info.maybe_tagged_fault_address, stack_depot.get(),
87 process_info.scudo_stack_depot_size, region_info.get(), ring_buffer.get(),
88 process_info.scudo_ring_buffer_size, memory.get(), memory_tags.get(),
89 memory_begin, memory_end - memory_begin);
90 }
91
CrashIsMine() const92 bool ScudoCrashData::CrashIsMine() const {
93 return error_info_.reports[0].error_type != UNKNOWN;
94 }
95
FillInCause(Cause * cause,const scudo_error_report * report,unwindstack::AndroidUnwinder * unwinder) const96 void ScudoCrashData::FillInCause(Cause* cause, const scudo_error_report* report,
97 unwindstack::AndroidUnwinder* unwinder) const {
98 MemoryError* memory_error = cause->mutable_memory_error();
99 HeapObject* heap_object = memory_error->mutable_heap();
100
101 memory_error->set_tool(MemoryError_Tool_SCUDO);
102 switch (report->error_type) {
103 case USE_AFTER_FREE:
104 memory_error->set_type(MemoryError_Type_USE_AFTER_FREE);
105 break;
106 case BUFFER_OVERFLOW:
107 memory_error->set_type(MemoryError_Type_BUFFER_OVERFLOW);
108 break;
109 case BUFFER_UNDERFLOW:
110 memory_error->set_type(MemoryError_Type_BUFFER_UNDERFLOW);
111 break;
112 default:
113 memory_error->set_type(MemoryError_Type_UNKNOWN);
114 break;
115 }
116
117 heap_object->set_address(report->allocation_address);
118 heap_object->set_size(report->allocation_size);
119
120 heap_object->set_allocation_tid(report->allocation_tid);
121 for (size_t i = 0; i < arraysize(report->allocation_trace) && report->allocation_trace[i]; ++i) {
122 unwindstack::FrameData frame_data = unwinder->BuildFrameFromPcOnly(report->allocation_trace[i]);
123 BacktraceFrame* f = heap_object->add_allocation_backtrace();
124 fill_in_backtrace_frame(f, frame_data);
125 }
126
127 heap_object->set_deallocation_tid(report->deallocation_tid);
128 for (size_t i = 0; i < arraysize(report->deallocation_trace) && report->deallocation_trace[i];
129 ++i) {
130 unwindstack::FrameData frame_data =
131 unwinder->BuildFrameFromPcOnly(report->deallocation_trace[i]);
132 BacktraceFrame* f = heap_object->add_deallocation_backtrace();
133 fill_in_backtrace_frame(f, frame_data);
134 }
135
136 set_human_readable_cause(cause, untagged_fault_addr_);
137 }
138
AddCauseProtos(Tombstone * tombstone,unwindstack::AndroidUnwinder * unwinder) const139 void ScudoCrashData::AddCauseProtos(Tombstone* tombstone,
140 unwindstack::AndroidUnwinder* unwinder) const {
141 size_t report_num = 0;
142 while (report_num < sizeof(error_info_.reports) / sizeof(error_info_.reports[0]) &&
143 error_info_.reports[report_num].error_type != UNKNOWN) {
144 FillInCause(tombstone->add_causes(), &error_info_.reports[report_num++], unwinder);
145 }
146 }
147
148 #endif // USE_SCUDO
149