• Home
  • Line#
  • Scopes#
  • Navigate#
  • Raw
  • Download
1  // Copyright (c) 2012 The Chromium Authors. All rights reserved.
2  // Use of this source code is governed by a BSD-style license that can be
3  // found in the LICENSE file.
4  
5  #include "base/memory/shared_memory.h"
6  
7  #include <errno.h>
8  #include <fcntl.h>
9  #include <stddef.h>
10  #include <sys/mman.h>
11  #include <sys/stat.h>
12  #include <unistd.h>
13  
14  #include "base/files/file_util.h"
15  #include "base/files/scoped_file.h"
16  #include "base/logging.h"
17  #include "base/memory/shared_memory_helper.h"
18  #include "base/memory/shared_memory_tracker.h"
19  #include "base/posix/eintr_wrapper.h"
20  #include "base/posix/safe_strerror.h"
21  #include "base/process/process_metrics.h"
22  #include "base/scoped_generic.h"
23  #include "base/strings/utf_string_conversions.h"
24  #include "base/threading/thread_restrictions.h"
25  #include "base/trace_event/trace_event.h"
26  #include "build/build_config.h"
27  
28  #if defined(OS_ANDROID)
29  #include "base/os_compat_android.h"
30  #endif
31  #if defined(OS_ANDROID) || defined(__ANDROID__)
32  #include "third_party/ashmem/ashmem.h"
33  #endif
34  
35  namespace base {
36  
SharedMemory()37  SharedMemory::SharedMemory()
38      : mapped_file_(-1),
39        readonly_mapped_file_(-1),
40        mapped_size_(0),
41        memory_(NULL),
42        read_only_(false),
43        requested_size_(0) {
44  }
45  
SharedMemory(const SharedMemoryHandle & handle,bool read_only)46  SharedMemory::SharedMemory(const SharedMemoryHandle& handle, bool read_only)
47      : mapped_file_(handle.fd),
48        readonly_mapped_file_(-1),
49        mapped_size_(0),
50        memory_(NULL),
51        read_only_(read_only),
52        requested_size_(0) {
53  }
54  
~SharedMemory()55  SharedMemory::~SharedMemory() {
56    Unmap();
57    Close();
58  }
59  
60  // static
IsHandleValid(const SharedMemoryHandle & handle)61  bool SharedMemory::IsHandleValid(const SharedMemoryHandle& handle) {
62    return handle.fd >= 0;
63  }
64  
65  // static
NULLHandle()66  SharedMemoryHandle SharedMemory::NULLHandle() {
67    return SharedMemoryHandle();
68  }
69  
70  // static
CloseHandle(const SharedMemoryHandle & handle)71  void SharedMemory::CloseHandle(const SharedMemoryHandle& handle) {
72    DCHECK_GE(handle.fd, 0);
73    if (IGNORE_EINTR(close(handle.fd)) < 0)
74      DPLOG(ERROR) << "close";
75  }
76  
77  // static
GetHandleLimit()78  size_t SharedMemory::GetHandleLimit() {
79    return base::GetMaxFds();
80  }
81  
82  // static
DuplicateHandle(const SharedMemoryHandle & handle)83  SharedMemoryHandle SharedMemory::DuplicateHandle(
84      const SharedMemoryHandle& handle) {
85    int duped_handle = HANDLE_EINTR(dup(handle.fd));
86    if (duped_handle < 0)
87      return base::SharedMemory::NULLHandle();
88    return base::FileDescriptor(duped_handle, true);
89  }
90  
91  // static
GetFdFromSharedMemoryHandle(const SharedMemoryHandle & handle)92  int SharedMemory::GetFdFromSharedMemoryHandle(
93      const SharedMemoryHandle& handle) {
94    return handle.fd;
95  }
96  
CreateAndMapAnonymous(size_t size)97  bool SharedMemory::CreateAndMapAnonymous(size_t size) {
98    return CreateAnonymous(size) && Map(size);
99  }
100  
101  #if !defined(OS_ANDROID) && !defined(__ANDROID__)
102  // static
GetSizeFromSharedMemoryHandle(const SharedMemoryHandle & handle,size_t * size)103  bool SharedMemory::GetSizeFromSharedMemoryHandle(
104      const SharedMemoryHandle& handle,
105      size_t* size) {
106    struct stat st;
107    if (fstat(handle.fd, &st) != 0)
108      return false;
109    if (st.st_size < 0)
110      return false;
111    *size = st.st_size;
112    return true;
113  }
114  
115  // Chromium mostly only uses the unique/private shmem as specified by
116  // "name == L"". The exception is in the StatsTable.
117  // TODO(jrg): there is no way to "clean up" all unused named shmem if
118  // we restart from a crash.  (That isn't a new problem, but it is a problem.)
119  // In case we want to delete it later, it may be useful to save the value
120  // of mem_filename after FilePathForMemoryName().
Create(const SharedMemoryCreateOptions & options)121  bool SharedMemory::Create(const SharedMemoryCreateOptions& options) {
122    DCHECK_EQ(-1, mapped_file_);
123    if (options.size == 0) return false;
124  
125    if (options.size > static_cast<size_t>(std::numeric_limits<int>::max()))
126      return false;
127  
128    // This function theoretically can block on the disk, but realistically
129    // the temporary files we create will just go into the buffer cache
130    // and be deleted before they ever make it out to disk.
131    base::ThreadRestrictions::ScopedAllowIO allow_io;
132  
133    ScopedFILE fp;
134    bool fix_size = true;
135    ScopedFD readonly_fd;
136  
137    FilePath path;
138    if (options.name_deprecated == NULL || options.name_deprecated->empty()) {
139      bool result =
140          CreateAnonymousSharedMemory(options, &fp, &readonly_fd, &path);
141      if (!result)
142        return false;
143    } else {
144      if (!FilePathForMemoryName(*options.name_deprecated, &path))
145        return false;
146  
147      // Make sure that the file is opened without any permission
148      // to other users on the system.
149      const mode_t kOwnerOnly = S_IRUSR | S_IWUSR;
150  
151      // First, try to create the file.
152      int fd = HANDLE_EINTR(
153          open(path.value().c_str(), O_RDWR | O_CREAT | O_EXCL, kOwnerOnly));
154      if (fd == -1 && options.open_existing_deprecated) {
155        // If this doesn't work, try and open an existing file in append mode.
156        // Opening an existing file in a world writable directory has two main
157        // security implications:
158        // - Attackers could plant a file under their control, so ownership of
159        //   the file is checked below.
160        // - Attackers could plant a symbolic link so that an unexpected file
161        //   is opened, so O_NOFOLLOW is passed to open().
162        fd = HANDLE_EINTR(
163            open(path.value().c_str(), O_RDWR | O_APPEND | O_NOFOLLOW));
164  
165        // Check that the current user owns the file.
166        // If uid != euid, then a more complex permission model is used and this
167        // API is not appropriate.
168        const uid_t real_uid = getuid();
169        const uid_t effective_uid = geteuid();
170        struct stat sb;
171        if (fd >= 0 &&
172            (fstat(fd, &sb) != 0 || sb.st_uid != real_uid ||
173             sb.st_uid != effective_uid)) {
174          LOG(ERROR) <<
175              "Invalid owner when opening existing shared memory file.";
176          close(fd);
177          return false;
178        }
179  
180        // An existing file was opened, so its size should not be fixed.
181        fix_size = false;
182      }
183  
184      if (options.share_read_only) {
185        // Also open as readonly so that we can ShareReadOnlyToProcess.
186        readonly_fd.reset(HANDLE_EINTR(open(path.value().c_str(), O_RDONLY)));
187        if (!readonly_fd.is_valid()) {
188          DPLOG(ERROR) << "open(\"" << path.value() << "\", O_RDONLY) failed";
189          close(fd);
190          fd = -1;
191          return false;
192        }
193      }
194      if (fd >= 0) {
195        // "a+" is always appropriate: if it's a new file, a+ is similar to w+.
196        fp.reset(fdopen(fd, "a+"));
197      }
198    }
199    if (fp && fix_size) {
200      // Get current size.
201      struct stat stat;
202      if (fstat(fileno(fp.get()), &stat) != 0)
203        return false;
204      const size_t current_size = stat.st_size;
205      if (current_size != options.size) {
206        if (HANDLE_EINTR(ftruncate(fileno(fp.get()), options.size)) != 0)
207          return false;
208      }
209      requested_size_ = options.size;
210    }
211    if (fp == NULL) {
212      PLOG(ERROR) << "Creating shared memory in " << path.value() << " failed";
213      FilePath dir = path.DirName();
214      if (access(dir.value().c_str(), W_OK | X_OK) < 0) {
215        PLOG(ERROR) << "Unable to access(W_OK|X_OK) " << dir.value();
216        if (dir.value() == "/dev/shm") {
217          LOG(FATAL) << "This is frequently caused by incorrect permissions on "
218                     << "/dev/shm.  Try 'sudo chmod 1777 /dev/shm' to fix.";
219        }
220      }
221      return false;
222    }
223  
224    return PrepareMapFile(std::move(fp), std::move(readonly_fd), &mapped_file_,
225                          &readonly_mapped_file_);
226  }
227  
228  // Our current implementation of shmem is with mmap()ing of files.
229  // These files need to be deleted explicitly.
230  // In practice this call is only needed for unit tests.
Delete(const std::string & name)231  bool SharedMemory::Delete(const std::string& name) {
232    FilePath path;
233    if (!FilePathForMemoryName(name, &path))
234      return false;
235  
236    if (PathExists(path))
237      return base::DeleteFile(path, false);
238  
239    // Doesn't exist, so success.
240    return true;
241  }
242  
Open(const std::string & name,bool read_only)243  bool SharedMemory::Open(const std::string& name, bool read_only) {
244    FilePath path;
245    if (!FilePathForMemoryName(name, &path))
246      return false;
247  
248    read_only_ = read_only;
249  
250    const char *mode = read_only ? "r" : "r+";
251    ScopedFILE fp(base::OpenFile(path, mode));
252    ScopedFD readonly_fd(HANDLE_EINTR(open(path.value().c_str(), O_RDONLY)));
253    if (!readonly_fd.is_valid()) {
254      DPLOG(ERROR) << "open(\"" << path.value() << "\", O_RDONLY) failed";
255      return false;
256    }
257    return PrepareMapFile(std::move(fp), std::move(readonly_fd), &mapped_file_,
258                          &readonly_mapped_file_);
259  }
260  #endif  // !defined(OS_ANDROID) && !defined(__ANDROID__)
261  
MapAt(off_t offset,size_t bytes)262  bool SharedMemory::MapAt(off_t offset, size_t bytes) {
263    if (mapped_file_ == -1)
264      return false;
265  
266    if (bytes > static_cast<size_t>(std::numeric_limits<int>::max()))
267      return false;
268  
269    if (memory_)
270      return false;
271  
272  #if defined(OS_ANDROID) || defined(__ANDROID__)
273    // On Android, Map can be called with a size and offset of zero to use the
274    // ashmem-determined size.
275    if (bytes == 0) {
276      DCHECK_EQ(0, offset);
277      int ashmem_bytes = ashmem_get_size_region(mapped_file_);
278      if (ashmem_bytes < 0)
279        return false;
280      bytes = ashmem_bytes;
281    }
282  #endif
283  
284    memory_ = mmap(NULL, bytes, PROT_READ | (read_only_ ? 0 : PROT_WRITE),
285                   MAP_SHARED, mapped_file_, offset);
286  
287    bool mmap_succeeded = memory_ != (void*)-1 && memory_ != NULL;
288    if (mmap_succeeded) {
289      mapped_size_ = bytes;
290      DCHECK_EQ(0U,
291                reinterpret_cast<uintptr_t>(memory_) &
292                    (SharedMemory::MAP_MINIMUM_ALIGNMENT - 1));
293      SharedMemoryTracker::GetInstance()->IncrementMemoryUsage(*this);
294    } else {
295      memory_ = NULL;
296    }
297  
298    return mmap_succeeded;
299  }
300  
Unmap()301  bool SharedMemory::Unmap() {
302    if (memory_ == NULL)
303      return false;
304  
305    munmap(memory_, mapped_size_);
306    SharedMemoryTracker::GetInstance()->DecrementMemoryUsage(*this);
307    memory_ = NULL;
308    mapped_size_ = 0;
309    return true;
310  }
311  
handle() const312  SharedMemoryHandle SharedMemory::handle() const {
313    return FileDescriptor(mapped_file_, false);
314  }
315  
TakeHandle()316  SharedMemoryHandle SharedMemory::TakeHandle() {
317    FileDescriptor handle(mapped_file_, true);
318    mapped_file_ = -1;
319    memory_ = nullptr;
320    mapped_size_ = 0;
321    return handle;
322  }
323  
Close()324  void SharedMemory::Close() {
325    if (mapped_file_ > 0) {
326      if (IGNORE_EINTR(close(mapped_file_)) < 0)
327        PLOG(ERROR) << "close";
328      mapped_file_ = -1;
329    }
330    if (readonly_mapped_file_ > 0) {
331      if (IGNORE_EINTR(close(readonly_mapped_file_)) < 0)
332        PLOG(ERROR) << "close";
333      readonly_mapped_file_ = -1;
334    }
335  }
336  
337  #if !defined(OS_ANDROID) && !defined(__ANDROID__)
338  // For the given shmem named |mem_name|, return a filename to mmap()
339  // (and possibly create).  Modifies |filename|.  Return false on
340  // error, or true of we are happy.
FilePathForMemoryName(const std::string & mem_name,FilePath * path)341  bool SharedMemory::FilePathForMemoryName(const std::string& mem_name,
342                                           FilePath* path) {
343    // mem_name will be used for a filename; make sure it doesn't
344    // contain anything which will confuse us.
345    DCHECK_EQ(std::string::npos, mem_name.find('/'));
346    DCHECK_EQ(std::string::npos, mem_name.find('\0'));
347  
348    FilePath temp_dir;
349    if (!GetShmemTempDir(false, &temp_dir))
350      return false;
351  
352  #if defined(GOOGLE_CHROME_BUILD)
353    std::string name_base = std::string("com.google.Chrome");
354  #else
355    std::string name_base = std::string("org.chromium.Chromium");
356  #endif
357    *path = temp_dir.AppendASCII(name_base + ".shmem." + mem_name);
358    return true;
359  }
360  #endif  // !defined(OS_ANDROID) && !defined(__ANDROID__)
361  
ShareToProcessCommon(ProcessHandle process,SharedMemoryHandle * new_handle,bool close_self,ShareMode share_mode)362  bool SharedMemory::ShareToProcessCommon(ProcessHandle process,
363                                          SharedMemoryHandle* new_handle,
364                                          bool close_self,
365                                          ShareMode share_mode) {
366    int handle_to_dup = -1;
367    switch(share_mode) {
368      case SHARE_CURRENT_MODE:
369        handle_to_dup = mapped_file_;
370        break;
371      case SHARE_READONLY:
372        // We could imagine re-opening the file from /dev/fd, but that can't make
373        // it readonly on Mac: https://codereview.chromium.org/27265002/#msg10
374        CHECK_GE(readonly_mapped_file_, 0);
375        handle_to_dup = readonly_mapped_file_;
376        break;
377    }
378  
379    const int new_fd = HANDLE_EINTR(dup(handle_to_dup));
380    if (new_fd < 0) {
381      if (close_self) {
382        Unmap();
383        Close();
384      }
385      DPLOG(ERROR) << "dup() failed.";
386      return false;
387    }
388  
389    new_handle->fd = new_fd;
390    new_handle->auto_close = true;
391  
392    if (close_self) {
393      Unmap();
394      Close();
395    }
396  
397    return true;
398  }
399  
GetUniqueId(SharedMemory::UniqueId * id) const400  bool SharedMemory::GetUniqueId(SharedMemory::UniqueId* id) const {
401    // This function is called just after mmap. fstat is a system call that might
402    // cause I/O. It's safe to call fstat here because mmap for shared memory is
403    // called in two cases:
404    // 1) To handle file-mapped memory
405    // 2) To handle annonymous shared memory
406    // In 1), I/O is already permitted. In 2), the backend is on page cache and
407    // fstat doesn't cause I/O access to the disk. See the discussion at
408    // crbug.com/604726#c41.
409    base::ThreadRestrictions::ScopedAllowIO allow_io;
410    struct stat file_stat;
411    if (HANDLE_EINTR(::fstat(static_cast<int>(handle().fd), &file_stat)) != 0)
412      return false;
413    id->first = file_stat.st_dev;
414    id->second = file_stat.st_ino;
415    return true;
416  }
417  
418  }  // namespace base
419