1 /*
2 * Copyright (C) 2016 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16
17 #include <errno.h>
18 #include <fcntl.h>
19 #include <inttypes.h>
20 #include <pthread.h>
21 #include <sched.h>
22 #include <stddef.h>
23 #include <stdio.h>
24 #include <stdlib.h>
25 #include <string.h>
26 #include <unistd.h>
27 #include <sys/mman.h>
28 #include <sys/syscall.h>
29 #include <sys/types.h>
30 #include <sys/wait.h>
31
32 #include "android-base/macros.h"
33
34 #include "anon_vma_naming.h"
35 #include "log.h"
36 #include "PtracerThread.h"
37
38 class Stack {
39 public:
Stack(size_t size)40 Stack(size_t size) : size_(size) {
41 int prot = PROT_READ | PROT_WRITE;
42 int flags = MAP_PRIVATE | MAP_ANONYMOUS;
43 page_size_ = sysconf(_SC_PAGE_SIZE);
44 size_ += page_size_*2; // guard pages
45 base_ = mmap(NULL, size_, prot, flags, -1, 0);
46 if (base_ == MAP_FAILED) {
47 base_ = NULL;
48 size_ = 0;
49 return;
50 }
51 prctl(PR_SET_VMA, PR_SET_VMA_ANON_NAME, base_, size_, "libmemunreachable stack");
52 mprotect(base_, page_size_, PROT_NONE);
53 mprotect(top(), page_size_, PROT_NONE);
54 };
~Stack()55 ~Stack() {
56 munmap(base_, size_);
57 };
top()58 void* top() {
59 return reinterpret_cast<void*>(reinterpret_cast<uintptr_t>(base_) + size_ - page_size_);
60 };
61 private:
62 DISALLOW_COPY_AND_ASSIGN(Stack);
63
64 void *base_;
65 size_t size_;
66 size_t page_size_;
67 };
68
PtracerThread(const std::function<int ()> & func)69 PtracerThread::PtracerThread(const std::function<int()>& func) :
70 child_pid_(0) {
71 stack_ = std::make_unique<Stack>(PTHREAD_STACK_MIN);
72 if (stack_->top() == nullptr) {
73 LOG_ALWAYS_FATAL("failed to mmap child stack: %s", strerror(errno));
74 }
75
76 func_ = std::function<int()>{[&, func]() -> int {
77 // In the child thread, lock and unlock the mutex to wait for the parent
78 // to finish setting up for the child thread
79 std::unique_lock<std::mutex> lk(m_);
80 lk.unlock();
81 _exit(func());
82 }};
83 }
84
~PtracerThread()85 PtracerThread::~PtracerThread() {
86 Kill();
87 Join();
88 ClearTracer();
89 stack_ = nullptr;
90 }
91
Start()92 bool PtracerThread::Start() {
93 std::unique_lock<std::mutex> lk(m_);
94
95 // Convert from void(*)(void*) to lambda with captures
96 auto proxy = [](void *arg) -> int {
97 prctl(PR_SET_NAME, "libmemunreachable ptrace thread");
98 return (*reinterpret_cast<std::function<int()>*>(arg))();
99 };
100
101 child_pid_ = clone(proxy, stack_->top(),
102 CLONE_VM|CLONE_FS|CLONE_FILES/*|CLONE_UNTRACED*/,
103 reinterpret_cast<void*>(&func_));
104 if (child_pid_ < 0) {
105 ALOGE("failed to clone child: %s", strerror(errno));
106 return false;
107 }
108
109 SetTracer(child_pid_);
110
111 lk.unlock();
112
113 return true;
114 }
115
Join()116 int PtracerThread::Join() {
117 if (child_pid_ == -1) {
118 return -1;
119 }
120 int status;
121 int ret = TEMP_FAILURE_RETRY(waitpid(child_pid_, &status, __WALL));
122 if (ret < 0) {
123 ALOGE("waitpid %d failed: %s", child_pid_, strerror(errno));
124 return -1;
125 }
126
127 child_pid_ = -1;
128
129 if (WIFEXITED(status)) {
130 return WEXITSTATUS(status);
131 } else if (WIFSIGNALED(status)) {
132 return -WTERMSIG(status);
133 } else {
134 ALOGE("unexpected status %x", status);
135 return -1;
136 }
137 }
138
Kill()139 void PtracerThread::Kill() {
140 if (child_pid_ == -1) {
141 return;
142 }
143
144 syscall(SYS_tkill, child_pid_, SIGKILL);
145 }
146
SetTracer(pid_t tracer_pid)147 void PtracerThread::SetTracer(pid_t tracer_pid) {
148 prctl(PR_SET_PTRACER, tracer_pid);
149 }
150
ClearTracer()151 void PtracerThread::ClearTracer() {
152 prctl(PR_SET_PTRACER, 0);
153 }
154