1 /*
2 * Copyright (C) 2020 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16
17 #include "libdebuggerd/gwp_asan.h"
18 #include "libdebuggerd/tombstone.h"
19 #include "libdebuggerd/utility.h"
20
21 #include "gwp_asan/common.h"
22 #include "gwp_asan/crash_handler.h"
23
24 #include <unwindstack/Maps.h>
25 #include <unwindstack/Memory.h>
26 #include <unwindstack/Regs.h>
27 #include <unwindstack/Unwinder.h>
28
29 #include "tombstone.pb.h"
30
31 // Retrieve GWP-ASan state from `state_addr` inside the process at
32 // `process_memory`. Place the state into `*state`.
retrieve_gwp_asan_state(unwindstack::Memory * process_memory,uintptr_t state_addr,gwp_asan::AllocatorState * state)33 static bool retrieve_gwp_asan_state(unwindstack::Memory* process_memory, uintptr_t state_addr,
34 gwp_asan::AllocatorState* state) {
35 return process_memory->ReadFully(state_addr, state, sizeof(*state));
36 }
37
38 // Retrieve the GWP-ASan metadata pool from `metadata_addr` inside the process
39 // at `process_memory`. The number of metadata slots is retrieved from the
40 // allocator state provided. This function returns a heap-allocated copy of the
41 // metadata pool whose ownership should be managed by the caller. Returns
42 // nullptr on failure.
retrieve_gwp_asan_metadata(unwindstack::Memory * process_memory,const gwp_asan::AllocatorState & state,uintptr_t metadata_addr)43 static const gwp_asan::AllocationMetadata* retrieve_gwp_asan_metadata(
44 unwindstack::Memory* process_memory, const gwp_asan::AllocatorState& state,
45 uintptr_t metadata_addr) {
46 // 1 million GWP-ASan slots would take 4.1GiB of space. Thankfully, copying
47 // the metadata for that amount of slots is only 532MiB, and this really will
48 // only be used with some ridiculous torture-tests.
49 if (state.MaxSimultaneousAllocations > 1000000) {
50 ALOGE(
51 "Error when retrieving GWP-ASan metadata, MSA from state (%zu) "
52 "exceeds maximum allowed (1,000,000).",
53 state.MaxSimultaneousAllocations);
54 return nullptr;
55 }
56
57 gwp_asan::AllocationMetadata* meta =
58 new gwp_asan::AllocationMetadata[state.MaxSimultaneousAllocations];
59 if (!process_memory->ReadFully(metadata_addr, meta,
60 sizeof(*meta) * state.MaxSimultaneousAllocations)) {
61 ALOGE(
62 "Error when retrieving GWP-ASan metadata, could not retrieve %zu "
63 "pieces of metadata.",
64 state.MaxSimultaneousAllocations);
65 delete[] meta;
66 meta = nullptr;
67 }
68 return meta;
69 }
70
GwpAsanCrashData(unwindstack::Memory * process_memory,const ProcessInfo & process_info,const ThreadInfo & thread_info)71 GwpAsanCrashData::GwpAsanCrashData(unwindstack::Memory* process_memory,
72 const ProcessInfo& process_info, const ThreadInfo& thread_info) {
73 if (!process_memory || !process_info.gwp_asan_metadata || !process_info.gwp_asan_state) return;
74 // Extract the GWP-ASan regions from the dead process.
75 if (!retrieve_gwp_asan_state(process_memory, process_info.gwp_asan_state, &state_)) return;
76 metadata_.reset(retrieve_gwp_asan_metadata(process_memory, state_, process_info.gwp_asan_metadata));
77 if (!metadata_.get()) return;
78
79 // Get the external crash address from the thread info.
80 crash_address_ = 0u;
81 if (process_info.has_fault_address) {
82 crash_address_ = process_info.untagged_fault_address;
83 }
84
85 // Ensure the error belongs to GWP-ASan.
86 if (!__gwp_asan_error_is_mine(&state_, crash_address_)) return;
87
88 is_gwp_asan_responsible_ = true;
89 thread_id_ = thread_info.tid;
90
91 // Grab the internal error address, if it exists.
92 uintptr_t internal_crash_address = __gwp_asan_get_internal_crash_address(&state_);
93 if (internal_crash_address) {
94 crash_address_ = internal_crash_address;
95 }
96
97 // Get other information from the internal state.
98 error_ = __gwp_asan_diagnose_error(&state_, metadata_.get(), crash_address_);
99 error_string_ = gwp_asan::ErrorToString(error_);
100 responsible_allocation_ = __gwp_asan_get_metadata(&state_, metadata_.get(), crash_address_);
101 }
102
CrashIsMine() const103 bool GwpAsanCrashData::CrashIsMine() const {
104 return is_gwp_asan_responsible_;
105 }
106
107 constexpr size_t kMaxTraceLength = gwp_asan::AllocationMetadata::kMaxTraceLengthToCollect;
108
AddCauseProtos(Tombstone * tombstone,unwindstack::Unwinder * unwinder) const109 void GwpAsanCrashData::AddCauseProtos(Tombstone* tombstone, unwindstack::Unwinder* unwinder) const {
110 if (!CrashIsMine()) {
111 ALOGE("Internal Error: AddCauseProtos() on a non-GWP-ASan crash.");
112 return;
113 }
114
115 Cause* cause = tombstone->add_causes();
116 MemoryError* memory_error = cause->mutable_memory_error();
117 HeapObject* heap_object = memory_error->mutable_heap();
118
119 memory_error->set_tool(MemoryError_Tool_GWP_ASAN);
120 switch (error_) {
121 case gwp_asan::Error::USE_AFTER_FREE:
122 memory_error->set_type(MemoryError_Type_USE_AFTER_FREE);
123 break;
124 case gwp_asan::Error::DOUBLE_FREE:
125 memory_error->set_type(MemoryError_Type_DOUBLE_FREE);
126 break;
127 case gwp_asan::Error::INVALID_FREE:
128 memory_error->set_type(MemoryError_Type_INVALID_FREE);
129 break;
130 case gwp_asan::Error::BUFFER_OVERFLOW:
131 memory_error->set_type(MemoryError_Type_BUFFER_OVERFLOW);
132 break;
133 case gwp_asan::Error::BUFFER_UNDERFLOW:
134 memory_error->set_type(MemoryError_Type_BUFFER_UNDERFLOW);
135 break;
136 default:
137 memory_error->set_type(MemoryError_Type_UNKNOWN);
138 break;
139 }
140
141 heap_object->set_address(__gwp_asan_get_allocation_address(responsible_allocation_));
142 heap_object->set_size(__gwp_asan_get_allocation_size(responsible_allocation_));
143 unwinder->SetDisplayBuildID(true);
144
145 std::unique_ptr<uintptr_t[]> frames(new uintptr_t[kMaxTraceLength]);
146
147 heap_object->set_allocation_tid(__gwp_asan_get_allocation_thread_id(responsible_allocation_));
148 size_t num_frames =
149 __gwp_asan_get_allocation_trace(responsible_allocation_, frames.get(), kMaxTraceLength);
150 for (size_t i = 0; i != num_frames; ++i) {
151 unwindstack::FrameData frame_data = unwinder->BuildFrameFromPcOnly(frames[i]);
152 BacktraceFrame* f = heap_object->add_allocation_backtrace();
153 fill_in_backtrace_frame(f, frame_data);
154 }
155
156 heap_object->set_deallocation_tid(__gwp_asan_get_deallocation_thread_id(responsible_allocation_));
157 num_frames =
158 __gwp_asan_get_deallocation_trace(responsible_allocation_, frames.get(), kMaxTraceLength);
159 for (size_t i = 0; i != num_frames; ++i) {
160 unwindstack::FrameData frame_data = unwinder->BuildFrameFromPcOnly(frames[i]);
161 BacktraceFrame* f = heap_object->add_deallocation_backtrace();
162 fill_in_backtrace_frame(f, frame_data);
163 }
164
165 set_human_readable_cause(cause, crash_address_);
166 }
167