1 /*
2 * Copyright (C) 2020 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16
17 #include "libdebuggerd/gwp_asan.h"
18 #include "libdebuggerd/tombstone.h"
19 #include "libdebuggerd/utility.h"
20
21 #include "gwp_asan/common.h"
22 #include "gwp_asan/crash_handler.h"
23
24 #include <unwindstack/AndroidUnwinder.h>
25 #include <unwindstack/Memory.h>
26 #include <unwindstack/Unwinder.h>
27
28 #include "tombstone.pb.h"
29
30 // Retrieve GWP-ASan state from `state_addr` inside the process at
31 // `process_memory`. Place the state into `*state`.
retrieve_gwp_asan_state(unwindstack::Memory * process_memory,uintptr_t state_addr,gwp_asan::AllocatorState * state)32 static bool retrieve_gwp_asan_state(unwindstack::Memory* process_memory, uintptr_t state_addr,
33 gwp_asan::AllocatorState* state) {
34 return process_memory->ReadFully(state_addr, state, sizeof(*state));
35 }
36
37 // Retrieve the GWP-ASan metadata pool from `metadata_addr` inside the process
38 // at `process_memory`. The number of metadata slots is retrieved from the
39 // allocator state provided. This function returns a heap-allocated copy of the
40 // metadata pool whose ownership should be managed by the caller. Returns
41 // nullptr on failure.
retrieve_gwp_asan_metadata(unwindstack::Memory * process_memory,const gwp_asan::AllocatorState & state,uintptr_t metadata_addr)42 static const gwp_asan::AllocationMetadata* retrieve_gwp_asan_metadata(
43 unwindstack::Memory* process_memory, const gwp_asan::AllocatorState& state,
44 uintptr_t metadata_addr) {
45 // 1 million GWP-ASan slots would take 4.1GiB of space. Thankfully, copying
46 // the metadata for that amount of slots is only 532MiB, and this really will
47 // only be used with some ridiculous torture-tests.
48 if (state.MaxSimultaneousAllocations > 1000000) {
49 ALOGE(
50 "Error when retrieving GWP-ASan metadata, MSA from state (%zu) "
51 "exceeds maximum allowed (1,000,000).",
52 state.MaxSimultaneousAllocations);
53 return nullptr;
54 }
55
56 gwp_asan::AllocationMetadata* meta =
57 new gwp_asan::AllocationMetadata[state.MaxSimultaneousAllocations];
58 if (!process_memory->ReadFully(metadata_addr, meta,
59 sizeof(*meta) * state.MaxSimultaneousAllocations)) {
60 ALOGE(
61 "Error when retrieving GWP-ASan metadata, could not retrieve %zu "
62 "pieces of metadata.",
63 state.MaxSimultaneousAllocations);
64 delete[] meta;
65 meta = nullptr;
66 }
67 return meta;
68 }
69
GwpAsanCrashData(unwindstack::Memory * process_memory,const ProcessInfo & process_info,const ThreadInfo & thread_info)70 GwpAsanCrashData::GwpAsanCrashData(unwindstack::Memory* process_memory,
71 const ProcessInfo& process_info, const ThreadInfo& thread_info) {
72 if (!process_memory || !process_info.gwp_asan_metadata || !process_info.gwp_asan_state) return;
73 // Extract the GWP-ASan regions from the dead process.
74 if (!retrieve_gwp_asan_state(process_memory, process_info.gwp_asan_state, &state_)) return;
75 metadata_.reset(retrieve_gwp_asan_metadata(process_memory, state_, process_info.gwp_asan_metadata));
76 if (!metadata_.get()) return;
77
78 // Get the external crash address from the thread info.
79 crash_address_ = 0u;
80 if (process_info.has_fault_address) {
81 crash_address_ = process_info.untagged_fault_address;
82 }
83
84 // Ensure the error belongs to GWP-ASan.
85 if (!__gwp_asan_error_is_mine(&state_, crash_address_)) return;
86
87 is_gwp_asan_responsible_ = true;
88 thread_id_ = thread_info.tid;
89
90 // Grab the internal error address, if it exists.
91 uintptr_t internal_crash_address = __gwp_asan_get_internal_crash_address(&state_, crash_address_);
92 if (internal_crash_address) {
93 crash_address_ = internal_crash_address;
94 }
95
96 // Get other information from the internal state.
97 error_ = __gwp_asan_diagnose_error(&state_, metadata_.get(), crash_address_);
98 error_string_ = gwp_asan::ErrorToString(error_);
99 responsible_allocation_ = __gwp_asan_get_metadata(&state_, metadata_.get(), crash_address_);
100 }
101
CrashIsMine() const102 bool GwpAsanCrashData::CrashIsMine() const {
103 return is_gwp_asan_responsible_;
104 }
105
106 constexpr size_t kMaxTraceLength = gwp_asan::AllocationMetadata::kMaxTraceLengthToCollect;
107
AddCauseProtos(Tombstone * tombstone,unwindstack::AndroidUnwinder * unwinder) const108 void GwpAsanCrashData::AddCauseProtos(Tombstone* tombstone,
109 unwindstack::AndroidUnwinder* unwinder) const {
110 if (!CrashIsMine()) {
111 ALOGE("Internal Error: AddCauseProtos() on a non-GWP-ASan crash.");
112 return;
113 }
114
115 Cause* cause = tombstone->add_causes();
116 MemoryError* memory_error = cause->mutable_memory_error();
117 HeapObject* heap_object = memory_error->mutable_heap();
118
119 memory_error->set_tool(MemoryError_Tool_GWP_ASAN);
120 switch (error_) {
121 case gwp_asan::Error::USE_AFTER_FREE:
122 memory_error->set_type(MemoryError_Type_USE_AFTER_FREE);
123 break;
124 case gwp_asan::Error::DOUBLE_FREE:
125 memory_error->set_type(MemoryError_Type_DOUBLE_FREE);
126 break;
127 case gwp_asan::Error::INVALID_FREE:
128 memory_error->set_type(MemoryError_Type_INVALID_FREE);
129 break;
130 case gwp_asan::Error::BUFFER_OVERFLOW:
131 memory_error->set_type(MemoryError_Type_BUFFER_OVERFLOW);
132 break;
133 case gwp_asan::Error::BUFFER_UNDERFLOW:
134 memory_error->set_type(MemoryError_Type_BUFFER_UNDERFLOW);
135 break;
136 default:
137 memory_error->set_type(MemoryError_Type_UNKNOWN);
138 break;
139 }
140
141 heap_object->set_address(__gwp_asan_get_allocation_address(responsible_allocation_));
142 heap_object->set_size(__gwp_asan_get_allocation_size(responsible_allocation_));
143
144 std::unique_ptr<uintptr_t[]> frames(new uintptr_t[kMaxTraceLength]);
145
146 heap_object->set_allocation_tid(__gwp_asan_get_allocation_thread_id(responsible_allocation_));
147 size_t num_frames =
148 __gwp_asan_get_allocation_trace(responsible_allocation_, frames.get(), kMaxTraceLength);
149 for (size_t i = 0; i != num_frames; ++i) {
150 unwindstack::FrameData frame_data = unwinder->BuildFrameFromPcOnly(frames[i]);
151 BacktraceFrame* f = heap_object->add_allocation_backtrace();
152 fill_in_backtrace_frame(f, frame_data);
153 }
154
155 heap_object->set_deallocation_tid(__gwp_asan_get_deallocation_thread_id(responsible_allocation_));
156 num_frames =
157 __gwp_asan_get_deallocation_trace(responsible_allocation_, frames.get(), kMaxTraceLength);
158 for (size_t i = 0; i != num_frames; ++i) {
159 unwindstack::FrameData frame_data = unwinder->BuildFrameFromPcOnly(frames[i]);
160 BacktraceFrame* f = heap_object->add_deallocation_backtrace();
161 fill_in_backtrace_frame(f, frame_data);
162 }
163
164 set_human_readable_cause(cause, crash_address_);
165 }
166