1 /*
2 * Copyright (C) 2020 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16
17 #include "libdebuggerd/scudo.h"
18 #include "libdebuggerd/tombstone.h"
19
20 #include "unwindstack/AndroidUnwinder.h"
21 #include "unwindstack/Memory.h"
22
23 #include <android-base/macros.h>
24 #include <bionic/macros.h>
25
26 #include "tombstone.pb.h"
27
AllocAndReadFully(unwindstack::Memory * process_memory,uint64_t addr,size_t size)28 std::unique_ptr<char[]> AllocAndReadFully(unwindstack::Memory* process_memory, uint64_t addr,
29 size_t size) {
30 auto buf = std::make_unique<char[]>(size);
31 if (!process_memory->ReadFully(addr, buf.get(), size)) {
32 return std::unique_ptr<char[]>();
33 }
34 return buf;
35 }
36
ScudoCrashData(unwindstack::Memory * process_memory,const ProcessInfo & process_info)37 ScudoCrashData::ScudoCrashData(unwindstack::Memory* process_memory,
38 const ProcessInfo& process_info) {
39 if (!process_info.has_fault_address) {
40 return;
41 }
42
43 auto stack_depot = AllocAndReadFully(process_memory, process_info.scudo_stack_depot,
44 __scudo_get_stack_depot_size());
45 auto region_info = AllocAndReadFully(process_memory, process_info.scudo_region_info,
46 __scudo_get_region_info_size());
47 std::unique_ptr<char[]> ring_buffer;
48 if (process_info.scudo_ring_buffer_size != 0) {
49 ring_buffer = AllocAndReadFully(process_memory, process_info.scudo_ring_buffer,
50 process_info.scudo_ring_buffer_size);
51 }
52 if (!stack_depot || !region_info) {
53 return;
54 }
55
56 untagged_fault_addr_ = process_info.untagged_fault_address;
57 uintptr_t fault_page = untagged_fault_addr_ & ~(PAGE_SIZE - 1);
58
59 uintptr_t memory_begin = fault_page - PAGE_SIZE * 16;
60 if (memory_begin > fault_page) {
61 return;
62 }
63
64 uintptr_t memory_end = fault_page + PAGE_SIZE * 16;
65 if (memory_end < fault_page) {
66 return;
67 }
68
69 auto memory = std::make_unique<char[]>(memory_end - memory_begin);
70 for (auto i = memory_begin; i != memory_end; i += PAGE_SIZE) {
71 process_memory->ReadFully(i, memory.get() + i - memory_begin, PAGE_SIZE);
72 }
73
74 auto memory_tags = std::make_unique<char[]>((memory_end - memory_begin) / kTagGranuleSize);
75 for (auto i = memory_begin; i != memory_end; i += kTagGranuleSize) {
76 memory_tags[(i - memory_begin) / kTagGranuleSize] = process_memory->ReadTag(i);
77 }
78
79 __scudo_get_error_info(&error_info_, process_info.maybe_tagged_fault_address, stack_depot.get(),
80 region_info.get(), ring_buffer.get(), memory.get(), memory_tags.get(),
81 memory_begin, memory_end - memory_begin);
82 }
83
CrashIsMine() const84 bool ScudoCrashData::CrashIsMine() const {
85 return error_info_.reports[0].error_type != UNKNOWN;
86 }
87
FillInCause(Cause * cause,const scudo_error_report * report,unwindstack::AndroidUnwinder * unwinder) const88 void ScudoCrashData::FillInCause(Cause* cause, const scudo_error_report* report,
89 unwindstack::AndroidUnwinder* unwinder) const {
90 MemoryError* memory_error = cause->mutable_memory_error();
91 HeapObject* heap_object = memory_error->mutable_heap();
92
93 memory_error->set_tool(MemoryError_Tool_SCUDO);
94 switch (report->error_type) {
95 case USE_AFTER_FREE:
96 memory_error->set_type(MemoryError_Type_USE_AFTER_FREE);
97 break;
98 case BUFFER_OVERFLOW:
99 memory_error->set_type(MemoryError_Type_BUFFER_OVERFLOW);
100 break;
101 case BUFFER_UNDERFLOW:
102 memory_error->set_type(MemoryError_Type_BUFFER_UNDERFLOW);
103 break;
104 default:
105 memory_error->set_type(MemoryError_Type_UNKNOWN);
106 break;
107 }
108
109 heap_object->set_address(report->allocation_address);
110 heap_object->set_size(report->allocation_size);
111
112 heap_object->set_allocation_tid(report->allocation_tid);
113 for (size_t i = 0; i < arraysize(report->allocation_trace) && report->allocation_trace[i]; ++i) {
114 unwindstack::FrameData frame_data = unwinder->BuildFrameFromPcOnly(report->allocation_trace[i]);
115 BacktraceFrame* f = heap_object->add_allocation_backtrace();
116 fill_in_backtrace_frame(f, frame_data);
117 }
118
119 heap_object->set_deallocation_tid(report->deallocation_tid);
120 for (size_t i = 0; i < arraysize(report->deallocation_trace) && report->deallocation_trace[i];
121 ++i) {
122 unwindstack::FrameData frame_data =
123 unwinder->BuildFrameFromPcOnly(report->deallocation_trace[i]);
124 BacktraceFrame* f = heap_object->add_deallocation_backtrace();
125 fill_in_backtrace_frame(f, frame_data);
126 }
127
128 set_human_readable_cause(cause, untagged_fault_addr_);
129 }
130
AddCauseProtos(Tombstone * tombstone,unwindstack::AndroidUnwinder * unwinder) const131 void ScudoCrashData::AddCauseProtos(Tombstone* tombstone,
132 unwindstack::AndroidUnwinder* unwinder) const {
133 size_t report_num = 0;
134 while (report_num < sizeof(error_info_.reports) / sizeof(error_info_.reports[0]) &&
135 error_info_.reports[report_num].error_type != UNKNOWN) {
136 FillInCause(tombstone->add_causes(), &error_info_.reports[report_num++], unwinder);
137 }
138 }
139