1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. 2 // Use of this source code is governed by a BSD-style license that can be 3 // found in the LICENSE file. 4 5 #include "base/memory/shared_memory.h" 6 7 #include <errno.h> 8 #include <fcntl.h> 9 #include <stddef.h> 10 #include <sys/mman.h> 11 #include <sys/stat.h> 12 #include <unistd.h> 13 14 #include "base/files/file_util.h" 15 #include "base/files/scoped_file.h" 16 #include "base/logging.h" 17 #include "base/memory/shared_memory_helper.h" 18 #include "base/memory/shared_memory_tracker.h" 19 #include "base/posix/eintr_wrapper.h" 20 #include "base/posix/safe_strerror.h" 21 #include "base/process/process_metrics.h" 22 #include "base/scoped_generic.h" 23 #include "base/strings/utf_string_conversions.h" 24 #include "base/threading/thread_restrictions.h" 25 #include "base/trace_event/trace_event.h" 26 #include "build/build_config.h" 27 28 #if defined(OS_ANDROID) 29 #include "base/os_compat_android.h" 30 #endif 31 #if defined(OS_ANDROID) || defined(__ANDROID__) 32 #include "third_party/ashmem/ashmem.h" 33 #endif 34 35 namespace base { 36 SharedMemory()37 SharedMemory::SharedMemory() 38 : mapped_file_(-1), 39 readonly_mapped_file_(-1), 40 mapped_size_(0), 41 memory_(NULL), 42 read_only_(false), 43 requested_size_(0) { 44 } 45 SharedMemory(const SharedMemoryHandle & handle,bool read_only)46 SharedMemory::SharedMemory(const SharedMemoryHandle& handle, bool read_only) 47 : mapped_file_(handle.fd), 48 readonly_mapped_file_(-1), 49 mapped_size_(0), 50 memory_(NULL), 51 read_only_(read_only), 52 requested_size_(0) { 53 } 54 ~SharedMemory()55 SharedMemory::~SharedMemory() { 56 Unmap(); 57 Close(); 58 } 59 60 // static IsHandleValid(const SharedMemoryHandle & handle)61 bool SharedMemory::IsHandleValid(const SharedMemoryHandle& handle) { 62 return handle.fd >= 0; 63 } 64 65 // static NULLHandle()66 SharedMemoryHandle SharedMemory::NULLHandle() { 67 return SharedMemoryHandle(); 68 } 69 70 // static CloseHandle(const SharedMemoryHandle & handle)71 void SharedMemory::CloseHandle(const SharedMemoryHandle& handle) { 72 DCHECK_GE(handle.fd, 0); 73 if (IGNORE_EINTR(close(handle.fd)) < 0) 74 DPLOG(ERROR) << "close"; 75 } 76 77 // static GetHandleLimit()78 size_t SharedMemory::GetHandleLimit() { 79 return base::GetMaxFds(); 80 } 81 82 // static DuplicateHandle(const SharedMemoryHandle & handle)83 SharedMemoryHandle SharedMemory::DuplicateHandle( 84 const SharedMemoryHandle& handle) { 85 int duped_handle = HANDLE_EINTR(dup(handle.fd)); 86 if (duped_handle < 0) 87 return base::SharedMemory::NULLHandle(); 88 return base::FileDescriptor(duped_handle, true); 89 } 90 91 // static GetFdFromSharedMemoryHandle(const SharedMemoryHandle & handle)92 int SharedMemory::GetFdFromSharedMemoryHandle( 93 const SharedMemoryHandle& handle) { 94 return handle.fd; 95 } 96 CreateAndMapAnonymous(size_t size)97 bool SharedMemory::CreateAndMapAnonymous(size_t size) { 98 return CreateAnonymous(size) && Map(size); 99 } 100 101 #if !defined(OS_ANDROID) && !defined(__ANDROID__) 102 // static GetSizeFromSharedMemoryHandle(const SharedMemoryHandle & handle,size_t * size)103 bool SharedMemory::GetSizeFromSharedMemoryHandle( 104 const SharedMemoryHandle& handle, 105 size_t* size) { 106 struct stat st; 107 if (fstat(handle.fd, &st) != 0) 108 return false; 109 if (st.st_size < 0) 110 return false; 111 *size = st.st_size; 112 return true; 113 } 114 115 // Chromium mostly only uses the unique/private shmem as specified by 116 // "name == L"". The exception is in the StatsTable. 117 // TODO(jrg): there is no way to "clean up" all unused named shmem if 118 // we restart from a crash. (That isn't a new problem, but it is a problem.) 119 // In case we want to delete it later, it may be useful to save the value 120 // of mem_filename after FilePathForMemoryName(). Create(const SharedMemoryCreateOptions & options)121 bool SharedMemory::Create(const SharedMemoryCreateOptions& options) { 122 DCHECK_EQ(-1, mapped_file_); 123 if (options.size == 0) return false; 124 125 if (options.size > static_cast<size_t>(std::numeric_limits<int>::max())) 126 return false; 127 128 // This function theoretically can block on the disk, but realistically 129 // the temporary files we create will just go into the buffer cache 130 // and be deleted before they ever make it out to disk. 131 base::ThreadRestrictions::ScopedAllowIO allow_io; 132 133 ScopedFILE fp; 134 bool fix_size = true; 135 ScopedFD readonly_fd; 136 137 FilePath path; 138 if (options.name_deprecated == NULL || options.name_deprecated->empty()) { 139 bool result = 140 CreateAnonymousSharedMemory(options, &fp, &readonly_fd, &path); 141 if (!result) 142 return false; 143 } else { 144 if (!FilePathForMemoryName(*options.name_deprecated, &path)) 145 return false; 146 147 // Make sure that the file is opened without any permission 148 // to other users on the system. 149 const mode_t kOwnerOnly = S_IRUSR | S_IWUSR; 150 151 // First, try to create the file. 152 int fd = HANDLE_EINTR( 153 open(path.value().c_str(), O_RDWR | O_CREAT | O_EXCL, kOwnerOnly)); 154 if (fd == -1 && options.open_existing_deprecated) { 155 // If this doesn't work, try and open an existing file in append mode. 156 // Opening an existing file in a world writable directory has two main 157 // security implications: 158 // - Attackers could plant a file under their control, so ownership of 159 // the file is checked below. 160 // - Attackers could plant a symbolic link so that an unexpected file 161 // is opened, so O_NOFOLLOW is passed to open(). 162 fd = HANDLE_EINTR( 163 open(path.value().c_str(), O_RDWR | O_APPEND | O_NOFOLLOW)); 164 165 // Check that the current user owns the file. 166 // If uid != euid, then a more complex permission model is used and this 167 // API is not appropriate. 168 const uid_t real_uid = getuid(); 169 const uid_t effective_uid = geteuid(); 170 struct stat sb; 171 if (fd >= 0 && 172 (fstat(fd, &sb) != 0 || sb.st_uid != real_uid || 173 sb.st_uid != effective_uid)) { 174 LOG(ERROR) << 175 "Invalid owner when opening existing shared memory file."; 176 close(fd); 177 return false; 178 } 179 180 // An existing file was opened, so its size should not be fixed. 181 fix_size = false; 182 } 183 184 if (options.share_read_only) { 185 // Also open as readonly so that we can ShareReadOnlyToProcess. 186 readonly_fd.reset(HANDLE_EINTR(open(path.value().c_str(), O_RDONLY))); 187 if (!readonly_fd.is_valid()) { 188 DPLOG(ERROR) << "open(\"" << path.value() << "\", O_RDONLY) failed"; 189 close(fd); 190 fd = -1; 191 return false; 192 } 193 } 194 if (fd >= 0) { 195 // "a+" is always appropriate: if it's a new file, a+ is similar to w+. 196 fp.reset(fdopen(fd, "a+")); 197 } 198 } 199 if (fp && fix_size) { 200 // Get current size. 201 struct stat stat; 202 if (fstat(fileno(fp.get()), &stat) != 0) 203 return false; 204 const size_t current_size = stat.st_size; 205 if (current_size != options.size) { 206 if (HANDLE_EINTR(ftruncate(fileno(fp.get()), options.size)) != 0) 207 return false; 208 } 209 requested_size_ = options.size; 210 } 211 if (fp == NULL) { 212 PLOG(ERROR) << "Creating shared memory in " << path.value() << " failed"; 213 FilePath dir = path.DirName(); 214 if (access(dir.value().c_str(), W_OK | X_OK) < 0) { 215 PLOG(ERROR) << "Unable to access(W_OK|X_OK) " << dir.value(); 216 if (dir.value() == "/dev/shm") { 217 LOG(FATAL) << "This is frequently caused by incorrect permissions on " 218 << "/dev/shm. Try 'sudo chmod 1777 /dev/shm' to fix."; 219 } 220 } 221 return false; 222 } 223 224 return PrepareMapFile(std::move(fp), std::move(readonly_fd), &mapped_file_, 225 &readonly_mapped_file_); 226 } 227 228 // Our current implementation of shmem is with mmap()ing of files. 229 // These files need to be deleted explicitly. 230 // In practice this call is only needed for unit tests. Delete(const std::string & name)231 bool SharedMemory::Delete(const std::string& name) { 232 FilePath path; 233 if (!FilePathForMemoryName(name, &path)) 234 return false; 235 236 if (PathExists(path)) 237 return base::DeleteFile(path, false); 238 239 // Doesn't exist, so success. 240 return true; 241 } 242 Open(const std::string & name,bool read_only)243 bool SharedMemory::Open(const std::string& name, bool read_only) { 244 FilePath path; 245 if (!FilePathForMemoryName(name, &path)) 246 return false; 247 248 read_only_ = read_only; 249 250 const char *mode = read_only ? "r" : "r+"; 251 ScopedFILE fp(base::OpenFile(path, mode)); 252 ScopedFD readonly_fd(HANDLE_EINTR(open(path.value().c_str(), O_RDONLY))); 253 if (!readonly_fd.is_valid()) { 254 DPLOG(ERROR) << "open(\"" << path.value() << "\", O_RDONLY) failed"; 255 return false; 256 } 257 return PrepareMapFile(std::move(fp), std::move(readonly_fd), &mapped_file_, 258 &readonly_mapped_file_); 259 } 260 #endif // !defined(OS_ANDROID) && !defined(__ANDROID__) 261 MapAt(off_t offset,size_t bytes)262 bool SharedMemory::MapAt(off_t offset, size_t bytes) { 263 if (mapped_file_ == -1) 264 return false; 265 266 if (bytes > static_cast<size_t>(std::numeric_limits<int>::max())) 267 return false; 268 269 if (memory_) 270 return false; 271 272 #if defined(OS_ANDROID) || defined(__ANDROID__) 273 // On Android, Map can be called with a size and offset of zero to use the 274 // ashmem-determined size. 275 if (bytes == 0) { 276 DCHECK_EQ(0, offset); 277 int ashmem_bytes = ashmem_get_size_region(mapped_file_); 278 if (ashmem_bytes < 0) 279 return false; 280 bytes = ashmem_bytes; 281 } 282 #endif 283 284 memory_ = mmap(NULL, bytes, PROT_READ | (read_only_ ? 0 : PROT_WRITE), 285 MAP_SHARED, mapped_file_, offset); 286 287 bool mmap_succeeded = memory_ != (void*)-1 && memory_ != NULL; 288 if (mmap_succeeded) { 289 mapped_size_ = bytes; 290 DCHECK_EQ(0U, 291 reinterpret_cast<uintptr_t>(memory_) & 292 (SharedMemory::MAP_MINIMUM_ALIGNMENT - 1)); 293 SharedMemoryTracker::GetInstance()->IncrementMemoryUsage(*this); 294 } else { 295 memory_ = NULL; 296 } 297 298 return mmap_succeeded; 299 } 300 Unmap()301 bool SharedMemory::Unmap() { 302 if (memory_ == NULL) 303 return false; 304 305 munmap(memory_, mapped_size_); 306 SharedMemoryTracker::GetInstance()->DecrementMemoryUsage(*this); 307 memory_ = NULL; 308 mapped_size_ = 0; 309 return true; 310 } 311 handle() const312 SharedMemoryHandle SharedMemory::handle() const { 313 return FileDescriptor(mapped_file_, false); 314 } 315 TakeHandle()316 SharedMemoryHandle SharedMemory::TakeHandle() { 317 FileDescriptor handle(mapped_file_, true); 318 mapped_file_ = -1; 319 memory_ = nullptr; 320 mapped_size_ = 0; 321 return handle; 322 } 323 Close()324 void SharedMemory::Close() { 325 if (mapped_file_ > 0) { 326 if (IGNORE_EINTR(close(mapped_file_)) < 0) 327 PLOG(ERROR) << "close"; 328 mapped_file_ = -1; 329 } 330 if (readonly_mapped_file_ > 0) { 331 if (IGNORE_EINTR(close(readonly_mapped_file_)) < 0) 332 PLOG(ERROR) << "close"; 333 readonly_mapped_file_ = -1; 334 } 335 } 336 337 #if !defined(OS_ANDROID) && !defined(__ANDROID__) 338 // For the given shmem named |mem_name|, return a filename to mmap() 339 // (and possibly create). Modifies |filename|. Return false on 340 // error, or true of we are happy. FilePathForMemoryName(const std::string & mem_name,FilePath * path)341 bool SharedMemory::FilePathForMemoryName(const std::string& mem_name, 342 FilePath* path) { 343 // mem_name will be used for a filename; make sure it doesn't 344 // contain anything which will confuse us. 345 DCHECK_EQ(std::string::npos, mem_name.find('/')); 346 DCHECK_EQ(std::string::npos, mem_name.find('\0')); 347 348 FilePath temp_dir; 349 if (!GetShmemTempDir(false, &temp_dir)) 350 return false; 351 352 #if defined(GOOGLE_CHROME_BUILD) 353 std::string name_base = std::string("com.google.Chrome"); 354 #else 355 std::string name_base = std::string("org.chromium.Chromium"); 356 #endif 357 *path = temp_dir.AppendASCII(name_base + ".shmem." + mem_name); 358 return true; 359 } 360 #endif // !defined(OS_ANDROID) && !defined(__ANDROID__) 361 ShareToProcessCommon(ProcessHandle process,SharedMemoryHandle * new_handle,bool close_self,ShareMode share_mode)362 bool SharedMemory::ShareToProcessCommon(ProcessHandle process, 363 SharedMemoryHandle* new_handle, 364 bool close_self, 365 ShareMode share_mode) { 366 int handle_to_dup = -1; 367 switch(share_mode) { 368 case SHARE_CURRENT_MODE: 369 handle_to_dup = mapped_file_; 370 break; 371 case SHARE_READONLY: 372 // We could imagine re-opening the file from /dev/fd, but that can't make 373 // it readonly on Mac: https://codereview.chromium.org/27265002/#msg10 374 CHECK_GE(readonly_mapped_file_, 0); 375 handle_to_dup = readonly_mapped_file_; 376 break; 377 } 378 379 const int new_fd = HANDLE_EINTR(dup(handle_to_dup)); 380 if (new_fd < 0) { 381 if (close_self) { 382 Unmap(); 383 Close(); 384 } 385 DPLOG(ERROR) << "dup() failed."; 386 return false; 387 } 388 389 new_handle->fd = new_fd; 390 new_handle->auto_close = true; 391 392 if (close_self) { 393 Unmap(); 394 Close(); 395 } 396 397 return true; 398 } 399 GetUniqueId(SharedMemory::UniqueId * id) const400 bool SharedMemory::GetUniqueId(SharedMemory::UniqueId* id) const { 401 // This function is called just after mmap. fstat is a system call that might 402 // cause I/O. It's safe to call fstat here because mmap for shared memory is 403 // called in two cases: 404 // 1) To handle file-mapped memory 405 // 2) To handle annonymous shared memory 406 // In 1), I/O is already permitted. In 2), the backend is on page cache and 407 // fstat doesn't cause I/O access to the disk. See the discussion at 408 // crbug.com/604726#c41. 409 base::ThreadRestrictions::ScopedAllowIO allow_io; 410 struct stat file_stat; 411 if (HANDLE_EINTR(::fstat(static_cast<int>(handle().fd), &file_stat)) != 0) 412 return false; 413 id->first = file_stat.st_dev; 414 id->second = file_stat.st_ino; 415 return true; 416 } 417 418 } // namespace base 419