1 /*
2 * Copyright (C) 2020 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16
17 #if defined(USE_SCUDO)
18
19 #include "libdebuggerd/scudo.h"
20 #include "libdebuggerd/tombstone.h"
21
22 #include "unwindstack/AndroidUnwinder.h"
23 #include "unwindstack/Memory.h"
24
25 #include <android-base/macros.h>
26 #include <bionic/macros.h>
27 #include <unistd.h>
28
29 #include "tombstone.pb.h"
30
AllocAndReadFully(unwindstack::Memory * process_memory,uint64_t addr,size_t size)31 std::unique_ptr<char[]> AllocAndReadFully(unwindstack::Memory* process_memory, uint64_t addr,
32 size_t size) {
33 auto buf = std::make_unique<char[]>(size);
34 if (!process_memory->ReadFully(addr, buf.get(), size)) {
35 return std::unique_ptr<char[]>();
36 }
37 return buf;
38 }
39
ScudoCrashData(unwindstack::Memory * process_memory,const ProcessInfo & process_info)40 ScudoCrashData::ScudoCrashData(unwindstack::Memory* process_memory,
41 const ProcessInfo& process_info) {
42 if (!process_info.has_fault_address) {
43 return;
44 }
45
46 auto region_info = AllocAndReadFully(process_memory, process_info.scudo_region_info,
47 __scudo_get_region_info_size());
48 std::unique_ptr<char[]> ring_buffer;
49 if (process_info.scudo_ring_buffer_size != 0) {
50 ring_buffer = AllocAndReadFully(process_memory, process_info.scudo_ring_buffer,
51 process_info.scudo_ring_buffer_size);
52 }
53 std::unique_ptr<char[]> stack_depot;
54 if (process_info.scudo_stack_depot_size != 0) {
55 stack_depot = AllocAndReadFully(process_memory, process_info.scudo_stack_depot,
56 process_info.scudo_stack_depot_size);
57 }
58 if (!region_info) {
59 return;
60 }
61
62 untagged_fault_addr_ = process_info.untagged_fault_address;
63 uintptr_t fault_page = untagged_fault_addr_ & ~(getpagesize() - 1);
64
65 uintptr_t memory_begin = fault_page - getpagesize() * 16;
66 if (memory_begin > fault_page) {
67 return;
68 }
69
70 uintptr_t memory_end = fault_page + getpagesize() * 16;
71 if (memory_end < fault_page) {
72 return;
73 }
74
75 auto memory = std::make_unique<char[]>(memory_end - memory_begin);
76 for (auto i = memory_begin; i != memory_end; i += getpagesize()) {
77 process_memory->ReadFully(i, memory.get() + i - memory_begin, getpagesize());
78 }
79
80 auto memory_tags = std::make_unique<char[]>((memory_end - memory_begin) / kTagGranuleSize);
81 for (auto i = memory_begin; i != memory_end; i += kTagGranuleSize) {
82 memory_tags[(i - memory_begin) / kTagGranuleSize] = process_memory->ReadTag(i);
83 }
84
85 __scudo_get_error_info(&error_info_, process_info.maybe_tagged_fault_address, stack_depot.get(),
86 process_info.scudo_stack_depot_size, region_info.get(), ring_buffer.get(),
87 process_info.scudo_ring_buffer_size, memory.get(), memory_tags.get(),
88 memory_begin, memory_end - memory_begin);
89 }
90
CrashIsMine() const91 bool ScudoCrashData::CrashIsMine() const {
92 return error_info_.reports[0].error_type != UNKNOWN;
93 }
94
FillInCause(Cause * cause,const scudo_error_report * report,unwindstack::AndroidUnwinder * unwinder) const95 void ScudoCrashData::FillInCause(Cause* cause, const scudo_error_report* report,
96 unwindstack::AndroidUnwinder* unwinder) const {
97 MemoryError* memory_error = cause->mutable_memory_error();
98 HeapObject* heap_object = memory_error->mutable_heap();
99
100 memory_error->set_tool(MemoryError_Tool_SCUDO);
101 switch (report->error_type) {
102 case USE_AFTER_FREE:
103 memory_error->set_type(MemoryError_Type_USE_AFTER_FREE);
104 break;
105 case BUFFER_OVERFLOW:
106 memory_error->set_type(MemoryError_Type_BUFFER_OVERFLOW);
107 break;
108 case BUFFER_UNDERFLOW:
109 memory_error->set_type(MemoryError_Type_BUFFER_UNDERFLOW);
110 break;
111 default:
112 memory_error->set_type(MemoryError_Type_UNKNOWN);
113 break;
114 }
115
116 heap_object->set_address(report->allocation_address);
117 heap_object->set_size(report->allocation_size);
118
119 heap_object->set_allocation_tid(report->allocation_tid);
120 for (size_t i = 0; i < arraysize(report->allocation_trace) && report->allocation_trace[i]; ++i) {
121 unwindstack::FrameData frame_data = unwinder->BuildFrameFromPcOnly(report->allocation_trace[i]);
122 BacktraceFrame* f = heap_object->add_allocation_backtrace();
123 fill_in_backtrace_frame(f, frame_data);
124 }
125
126 heap_object->set_deallocation_tid(report->deallocation_tid);
127 for (size_t i = 0; i < arraysize(report->deallocation_trace) && report->deallocation_trace[i];
128 ++i) {
129 unwindstack::FrameData frame_data =
130 unwinder->BuildFrameFromPcOnly(report->deallocation_trace[i]);
131 BacktraceFrame* f = heap_object->add_deallocation_backtrace();
132 fill_in_backtrace_frame(f, frame_data);
133 }
134
135 set_human_readable_cause(cause, untagged_fault_addr_);
136 }
137
AddCauseProtos(Tombstone * tombstone,unwindstack::AndroidUnwinder * unwinder) const138 void ScudoCrashData::AddCauseProtos(Tombstone* tombstone,
139 unwindstack::AndroidUnwinder* unwinder) const {
140 size_t report_num = 0;
141 while (report_num < sizeof(error_info_.reports) / sizeof(error_info_.reports[0]) &&
142 error_info_.reports[report_num].error_type != UNKNOWN) {
143 FillInCause(tombstone->add_causes(), &error_info_.reports[report_num++], unwinder);
144 }
145 }
146
147 #endif // USE_SCUDO
148