1  /*
2   * Copyright (C) 2020 The Android Open Source Project
3   *
4   * Licensed under the Apache License, Version 2.0 (the "License");
5   * you may not use this file except in compliance with the License.
6   * You may obtain a copy of the License at
7   *
8   *      http://www.apache.org/licenses/LICENSE-2.0
9   *
10   * Unless required by applicable law or agreed to in writing, software
11   * distributed under the License is distributed on an "AS IS" BASIS,
12   * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13   * See the License for the specific language governing permissions and
14   * limitations under the License.
15   */
16  
17  #include "libdebuggerd/gwp_asan.h"
18  #include "libdebuggerd/tombstone.h"
19  #include "libdebuggerd/utility.h"
20  
21  #include "gwp_asan/common.h"
22  #include "gwp_asan/crash_handler.h"
23  
24  #include <unwindstack/AndroidUnwinder.h>
25  #include <unwindstack/Memory.h>
26  #include <unwindstack/Unwinder.h>
27  
28  #include "tombstone.pb.h"
29  
30  // Retrieve GWP-ASan state from `state_addr` inside the process at
31  // `process_memory`. Place the state into `*state`.
retrieve_gwp_asan_state(unwindstack::Memory * process_memory,uintptr_t state_addr,gwp_asan::AllocatorState * state)32  static bool retrieve_gwp_asan_state(unwindstack::Memory* process_memory, uintptr_t state_addr,
33                                      gwp_asan::AllocatorState* state) {
34    return process_memory->ReadFully(state_addr, state, sizeof(*state));
35  }
36  
37  // Retrieve the GWP-ASan metadata pool from `metadata_addr` inside the process
38  // at `process_memory`. The number of metadata slots is retrieved from the
39  // allocator state provided. This function returns a heap-allocated copy of the
40  // metadata pool whose ownership should be managed by the caller. Returns
41  // nullptr on failure.
retrieve_gwp_asan_metadata(unwindstack::Memory * process_memory,const gwp_asan::AllocatorState & state,uintptr_t metadata_addr)42  static const gwp_asan::AllocationMetadata* retrieve_gwp_asan_metadata(
43      unwindstack::Memory* process_memory, const gwp_asan::AllocatorState& state,
44      uintptr_t metadata_addr) {
45    // 1 million GWP-ASan slots would take 4.1GiB of space. Thankfully, copying
46    // the metadata for that amount of slots is only 532MiB, and this really will
47    // only be used with some ridiculous torture-tests.
48    if (state.MaxSimultaneousAllocations > 1000000) {
49      ALOGE(
50          "Error when retrieving GWP-ASan metadata, MSA from state (%zu) "
51          "exceeds maximum allowed (1,000,000).",
52          state.MaxSimultaneousAllocations);
53      return nullptr;
54    }
55  
56    gwp_asan::AllocationMetadata* meta =
57        new gwp_asan::AllocationMetadata[state.MaxSimultaneousAllocations];
58    if (!process_memory->ReadFully(metadata_addr, meta,
59                                   sizeof(*meta) * state.MaxSimultaneousAllocations)) {
60      ALOGE(
61          "Error when retrieving GWP-ASan metadata, could not retrieve %zu "
62          "pieces of metadata.",
63          state.MaxSimultaneousAllocations);
64      delete[] meta;
65      meta = nullptr;
66    }
67    return meta;
68  }
69  
GwpAsanCrashData(unwindstack::Memory * process_memory,const ProcessInfo & process_info,const ThreadInfo & thread_info)70  GwpAsanCrashData::GwpAsanCrashData(unwindstack::Memory* process_memory,
71                                     const ProcessInfo& process_info, const ThreadInfo& thread_info) {
72    if (!process_memory || !process_info.gwp_asan_metadata || !process_info.gwp_asan_state) return;
73    // Extract the GWP-ASan regions from the dead process.
74    if (!retrieve_gwp_asan_state(process_memory, process_info.gwp_asan_state, &state_)) return;
75    metadata_.reset(retrieve_gwp_asan_metadata(process_memory, state_, process_info.gwp_asan_metadata));
76    if (!metadata_.get()) return;
77  
78    // Get the external crash address from the thread info.
79    crash_address_ = 0u;
80    if (process_info.has_fault_address) {
81      crash_address_ = process_info.untagged_fault_address;
82    }
83  
84    // Ensure the error belongs to GWP-ASan.
85    if (!__gwp_asan_error_is_mine(&state_, crash_address_)) return;
86  
87    is_gwp_asan_responsible_ = true;
88    thread_id_ = thread_info.tid;
89  
90    // Grab the internal error address, if it exists.
91    uintptr_t internal_crash_address = __gwp_asan_get_internal_crash_address(&state_, crash_address_);
92    if (internal_crash_address) {
93      crash_address_ = internal_crash_address;
94    }
95  
96    // Get other information from the internal state.
97    error_ = __gwp_asan_diagnose_error(&state_, metadata_.get(), crash_address_);
98    error_string_ = gwp_asan::ErrorToString(error_);
99    responsible_allocation_ = __gwp_asan_get_metadata(&state_, metadata_.get(), crash_address_);
100  }
101  
CrashIsMine() const102  bool GwpAsanCrashData::CrashIsMine() const {
103    return is_gwp_asan_responsible_;
104  }
105  
106  constexpr size_t kMaxTraceLength = gwp_asan::AllocationMetadata::kMaxTraceLengthToCollect;
107  
AddCauseProtos(Tombstone * tombstone,unwindstack::AndroidUnwinder * unwinder) const108  void GwpAsanCrashData::AddCauseProtos(Tombstone* tombstone,
109                                        unwindstack::AndroidUnwinder* unwinder) const {
110    if (!CrashIsMine()) {
111      ALOGE("Internal Error: AddCauseProtos() on a non-GWP-ASan crash.");
112      return;
113    }
114  
115    Cause* cause = tombstone->add_causes();
116    MemoryError* memory_error = cause->mutable_memory_error();
117    HeapObject* heap_object = memory_error->mutable_heap();
118  
119    memory_error->set_tool(MemoryError_Tool_GWP_ASAN);
120    switch (error_) {
121      case gwp_asan::Error::USE_AFTER_FREE:
122        memory_error->set_type(MemoryError_Type_USE_AFTER_FREE);
123        break;
124      case gwp_asan::Error::DOUBLE_FREE:
125        memory_error->set_type(MemoryError_Type_DOUBLE_FREE);
126        break;
127      case gwp_asan::Error::INVALID_FREE:
128        memory_error->set_type(MemoryError_Type_INVALID_FREE);
129        break;
130      case gwp_asan::Error::BUFFER_OVERFLOW:
131        memory_error->set_type(MemoryError_Type_BUFFER_OVERFLOW);
132        break;
133      case gwp_asan::Error::BUFFER_UNDERFLOW:
134        memory_error->set_type(MemoryError_Type_BUFFER_UNDERFLOW);
135        break;
136      default:
137        memory_error->set_type(MemoryError_Type_UNKNOWN);
138        break;
139    }
140  
141    heap_object->set_address(__gwp_asan_get_allocation_address(responsible_allocation_));
142    heap_object->set_size(__gwp_asan_get_allocation_size(responsible_allocation_));
143  
144    std::unique_ptr<uintptr_t[]> frames(new uintptr_t[kMaxTraceLength]);
145  
146    heap_object->set_allocation_tid(__gwp_asan_get_allocation_thread_id(responsible_allocation_));
147    size_t num_frames =
148        __gwp_asan_get_allocation_trace(responsible_allocation_, frames.get(), kMaxTraceLength);
149    for (size_t i = 0; i != num_frames; ++i) {
150      unwindstack::FrameData frame_data = unwinder->BuildFrameFromPcOnly(frames[i]);
151      BacktraceFrame* f = heap_object->add_allocation_backtrace();
152      fill_in_backtrace_frame(f, frame_data);
153    }
154  
155    heap_object->set_deallocation_tid(__gwp_asan_get_deallocation_thread_id(responsible_allocation_));
156    num_frames =
157        __gwp_asan_get_deallocation_trace(responsible_allocation_, frames.get(), kMaxTraceLength);
158    for (size_t i = 0; i != num_frames; ++i) {
159      unwindstack::FrameData frame_data = unwinder->BuildFrameFromPcOnly(frames[i]);
160      BacktraceFrame* f = heap_object->add_deallocation_backtrace();
161      fill_in_backtrace_frame(f, frame_data);
162    }
163  
164    set_human_readable_cause(cause, crash_address_);
165  }
166