49 Commits

Author SHA1 Message Date
Lei Zhang
c63c073d27 Do IWYU for check_op.h
Include check_op.h directly, instead of relying on the transitive
include from logging.h. This transitive include does not exist in
Chromium's //base.

Change-Id: I15962a9cdc26ac206032157b8d2659cf263ad695
Reviewed-on: https://chromium-review.googlesource.com/c/crashpad/crashpad/+/4950200
Reviewed-by: Mark Mentovai <mark@chromium.org>
Commit-Queue: Lei Zhang <thestig@chromium.org>
2023-10-18 20:01:37 +00:00
Thomas Gales
4f5dd67229 [riscv] Add RISC-V Linux support
Only RV64GC is supported.

Bug: fuchsia:127655

Tested: `python build/run_tests.py` on RISC-V emulator
Tested: Created minidump via self-induced crash on RISC-V emulator,
ran through Breakpad stackwalker

Change-Id: I713797cd623b0a758269048e01696cbce502ca6c
Reviewed-on: https://chromium-review.googlesource.com/c/crashpad/crashpad/+/4581050
Reviewed-by: Joshua Peraza <jperaza@chromium.org>
2023-06-12 21:13:24 +00:00
Stephan Hartmann
0acdadf032 snapshot: remove redundant template parameter
GCC 12 does not allow it in C++20 mode anymore.

Bug: chromium:819294
Change-Id: I025dda8046739fefc4ff449d4496ef496374eff5
Reviewed-on: https://chromium-review.googlesource.com/c/crashpad/crashpad/+/3929186
Commit-Queue: Mark Mentovai <mark@chromium.org>
Reviewed-by: Mark Mentovai <mark@chromium.org>
2022-09-30 15:07:02 +00:00
Mark Mentovai
6278690abe Update copyright boilerplate, 2022 edition (Crashpad)
sed -i '' -E -e 's/Copyright (.+) The Crashpad Authors\. All rights reserved\.$/Copyright \1 The Crashpad Authors/' $(git grep -El 'Copyright (.+) The Crashpad Authors\. All rights reserved\.$')

Bug: chromium:1098010
Change-Id: I8d6138469ddbe3d281a5d83f64cf918ec2491611
Reviewed-on: https://chromium-review.googlesource.com/c/crashpad/crashpad/+/3878262
Reviewed-by: Joshua Peraza <jperaza@chromium.org>
Commit-Queue: Mark Mentovai <mark@chromium.org>
2022-09-06 23:54:07 +00:00
André Kempe
45cc0da93a arm64: Add Armv8.3-A PAC support to assembly files
This patch adds optional support for Arm Pointer Authentication Codes.

X30/LR is not stored to stack at any place and restored for usage.
Therefore only adding PAC flag to .note.gnu.property section.

Change-Id: I9581059dfa1eed88af5a73df15b6a0d299caea13
Bug: crashpad: 1145581
Reviewed-on: https://chromium-review.googlesource.com/c/crashpad/crashpad/+/3440070
Reviewed-by: Mark Mentovai <mark@chromium.org>
Commit-Queue: Adenilson Cavalcanti <cavalcantii@chromium.org>
2022-02-08 08:42:05 +00:00
Mark Mentovai
50ed179e9a Use BUILDFLAG for OS checking
Use BUILDFLAG(IS_*) instead of defined(OS_*).

This was generated mostly mechnically by performing the following steps:
 - sed -i '' -E -e 's/defined\(OS_/BUILDFLAG(IS_/g' \
                -e 's%([ !])OS_([A-Z]+)%\1BUILDFLAG(IS_\2)%g' \
       $(git grep -l 'OS_'
         '**/*.c' '**/*.cc' '**/*.h' '**/*.m' '**/*.mm')
 - sed -i '' -e 's/#ifdef BUILDFLAG(/#if BUILDFLAG(/' \
       $(git grep -l '#ifdef BUILDFLAG('
         '**/*.c' '**/*.cc' '**/*.h' '**/*.m' '**/*.mm')
 - gsed -i -z -E -e \
       's%(.*)#include "%\1#include "build/buildflag.h"\n#include "%' \
       $(git grep -l 'BUILDFLAG(IS_'
         '**/*.c' '**/*.cc' '**/*.h' '**/*.m' '**/*.mm')
 - Spot checks to move #include "build/buildflag.h" to the correct parts
   of files.
 - sed -i '' -E -e \
       's%^(#include "build/buildflag.h")$%#include "build/build_config.h"\n\1%' \
       $(grep -L '^#include "build/build_config.h"$'
         $(git grep -l 'BUILDFLAG(IS_'
           '**/*.c' '**/*.cc' '**/*.h' '**/*.m' '**/*.mm'))
 - Add “clang-format off” around tool usage messages.
 - git cl format
 - Update mini_chromium to 85ba51f98278 (intermediate step).
   TESTING ONLY).
 - for f in $(git grep -l '^#include "build/buildflag.h"$'
              '**/*.c' '**/*.cc' '**/*.h' '**/*.m' '**/*.mm'); do \
       grep -v '^#include "build/buildflag.h"$' "${f}" > /tmp/z; \
       cp /tmp/z "${f}"; done
 - git cl format
 - Update mini_chromium to 735143774c5f (intermediate step).
 - Update mini_chromium to f41420eb45fa (as checked in).
 - Update mini_chromium to 6e2f204b4ae1 (as checked in).

For ease of review and inspection, each of these steps is uploaded as a
new patch set in a review series.

This includes an update of mini_chromium to 6e2f204b4ae1:

f41420eb45fa Use BUILDFLAG for OS checking
6e2f204b4ae1 Include what you use: string_util.h uses build_config.h

Bug: chromium:1234043
Change-Id: Ieef86186f094c64e59b853729737e36982f8cf69
Reviewed-on: https://chromium-review.googlesource.com/c/crashpad/crashpad/+/3400258
Reviewed-by: Joshua Peraza <jperaza@chromium.org>
Commit-Queue: Mark Mentovai <mark@chromium.org>
2022-01-19 20:21:19 +00:00
Salome Thirot
fe19de6e1d arm64: Add Armv8.5-A BTI support to assembly files.
Change-Id: Ic9c2d252829a39b0331e436df16effe7d0607996
Reviewed-on: https://chromium-review.googlesource.com/c/crashpad/crashpad/+/3241142
Commit-Queue: Jonathan Wright <jonathan.wright@arm.com>
Reviewed-by: Joshua Peraza <jperaza@chromium.org>
2021-12-01 10:47:56 +00:00
Peter Boström
1aa478d161 Remove DISALLOW_* macros in crashpad
This change was partially scripted and partially done manually with vim
regex + manually placing the deleted constructors.

The script change looked for destructors in the public: section of a
class, if that existed the deleted constructors would go before the
destructor.

For manual placement I looked for any constructor in the public: section
of the corresponding class. If there wasn't one, then it would ideally
have gone as the first entry except below enums, classes and typedefs.
This may not have been perfect, but is hopefully good enough. Fingers
crossed.

#include "base/macros.h" is removed from files that don't use
ignore_result, which is the only other thing defined in base/macros.h.

Bug: chromium:1010217
Change-Id: I099526255a40b1ac1264904b4ece2f3f503c9418
Reviewed-on: https://chromium-review.googlesource.com/c/crashpad/crashpad/+/3171034
Reviewed-by: Mark Mentovai <mark@chromium.org>
Commit-Queue: Peter Boström <pbos@chromium.org>
2021-09-21 15:09:44 +00:00
Joshua Peraza
78bcb55e1c Construct ProcessMemoryLinux using PtraceConnection
Update ProcessMemoryLinux to be constructed from PtraceConnection
instead of being Initialize()d with a pid_t.

This allows consolidating PtraceClient's BrokeredMemory with
ProcessMemoryLinux and providing the PtraceConnection as a alternative
to the memory file (previously only done for brokered connections).

Change-Id: I1363e208030eaf595fb8051e9a2c6b255c1f9886
Reviewed-on: https://chromium-review.googlesource.com/c/crashpad/crashpad/+/3072402
Reviewed-by: Mark Mentovai <mark@chromium.org>
Commit-Queue: Joshua Peraza <jperaza@chromium.org>
2021-08-11 15:48:33 +00:00
Sean McAllister
3965bc7d78 Refactor OS_LINUX usage for coming LaCrOs update.
We're working to decouple ChromeOS and Linux builds of Chrome.

Currently OS_CHROMEOS sets OS_LINUX, so we need to refactor
current OS_LINUX usage to make this explicit.

More information can be found at go/cros_is_linux_os_linux

BUG=chromium:1110266
TEST=manual build

Change-Id: Ie765da1ab6a0bf0286538ae1df3697abaa29aeaa
Reviewed-on: https://chromium-review.googlesource.com/c/crashpad/crashpad/+/2391116
Reviewed-by: Joshua Peraza <jperaza@chromium.org>
Commit-Queue: Joshua Peraza <jperaza@chromium.org>
2020-09-03 19:12:04 +00:00
Hans Wennborg
161bfed35a Remove/replace unnecessary includes of logging.h
If the file just needs the CHECK/CHECK_OP/NOTREACHED
macros, use the appropriate header for that instead.
Or if logging.h is not needed at all, remove it.

This is both a nice cleanup (logging.h is a big header,
and including it unnecessarily has compile-time costs),
and part of the final step towards making logging.h no
longer include check.h and the others.

Bug: chromium:1031540
Change-Id: Ia46806bd95fe498bcf3cf6d2c13ffa4081678043
Reviewed-on: https://chromium-review.googlesource.com/c/crashpad/crashpad/+/2255361
Reviewed-by: Mark Mentovai <mark@chromium.org>
Commit-Queue: Hans Wennborg <hans@chromium.org>
2020-06-22 11:59:03 +00:00
Joshua Peraza
294d233ca0 elf: adjust small DT_STRTAB addresses by load bias
Change-Id: I7ffbd2be0800aedad8b5c4b6982379e5485f1bc8
Reviewed-on: https://chromium-review.googlesource.com/c/crashpad/crashpad/+/2229114
Commit-Queue: Joshua Peraza <jperaza@chromium.org>
Reviewed-by: Mark Mentovai <mark@chromium.org>
2020-06-04 22:42:57 +00:00
Mark Mentovai
cba3dabf24 Add .gitattributes, setting “text eol=lf” or “binary” for all files
This should prevent accidental "\r\n" line endings from being introduced
again, as happened in 359fc4a1336d, fixed by 31470459b624.

Also includes:

Update mini_chromium to 0512d42698bfb47f2016ac627177c22d22b983d4

0512d42698bf Add .gitattributes, setting “text eol=lf” for all files

Change-Id: Id84c014914fec66632006ed364e2b14b4f1c175c
Reviewed-on: https://chromium-review.googlesource.com/c/crashpad/crashpad/+/1953807
Commit-Queue: Mark Mentovai <mark@chromium.org>
Reviewed-by: Robert Sesek <rsesek@chromium.org>
2019-12-06 19:07:12 +00:00
Clark DuVall
e5abe92b2e Add user minidump stream support for ELF
This is very similar to the windows implementation in
module_snapshot_win.cc.

Bug: crashpad:95
Change-Id: I3858e8bb0009c95395bfb7ca3855c3d937fd49d5
Reviewed-on: https://chromium-review.googlesource.com/c/crashpad/crashpad/+/1641588
Commit-Queue: Clark DuVall <cduvall@chromium.org>
Reviewed-by: Mark Mentovai <mark@chromium.org>
2019-06-11 17:20:05 +00:00
Scott Graham
ee1d5124a2 Fix incorrect range checks in elf image note reader
Overflows before and after padding could cause the max note size check
to be evaded.

Bug: chromium:967228, chromium: 967257, chromium:967223
Change-Id: I499a273e76e78529fc59ddcb74055be6d01fa2cb
Reviewed-on: https://chromium-review.googlesource.com/c/crashpad/crashpad/+/1631635
Reviewed-by: Joshua Peraza <jperaza@chromium.org>
Commit-Queue: Scott Graham <scottmg@chromium.org>
2019-05-28 18:23:11 +00:00
Scott Graham
daf9f5669e Fix unchecked allocation size of in fuzzer note reading
This fixes a fuzzer-only bug, and modifies the note API so that it can
no longer request infinitely sized notes.

Bug: chromium:966303
Change-Id: I97b9ca6774d3101560caddf2f9b0a8d7ecf7c2e2
Reviewed-on: https://chromium-review.googlesource.com/c/crashpad/crashpad/+/1628675
Commit-Queue: Scott Graham <scottmg@chromium.org>
Reviewed-by: Joshua Peraza <jperaza@chromium.org>
2019-05-24 20:20:27 +00:00
Scott Graham
122363ccae Fix compile for Linux 32b fuzz target
This code was previously not enabled, but was turned on recently.
However, there's no CQ check for 32 bit code.

Bug: chromium:966292
Change-Id: I4a3205d8517575e25d3e525f247ad45a906c3e25
Reviewed-on: https://chromium-review.googlesource.com/c/crashpad/crashpad/+/1627679
Reviewed-by: Joshua Peraza <jperaza@chromium.org>
Commit-Queue: Scott Graham <scottmg@chromium.org>
2019-05-23 17:37:08 +00:00
Casey Dahlin
5f77cf41b6 Add CodeViewRecordBuildId
Until now we've been stuffing ELF debug symbol link information into a
CodeViewPDB70. This has reached the limits of its usefulness. We now add
a CodeViewRecord that can contain a proper ELF build ID.

Change-Id: Ice52cb2a958a1b9031943f280d9054da02d2f17d
Reviewed-on: https://chromium-review.googlesource.com/c/crashpad/crashpad/+/1574107
Commit-Queue: Casey Dahlin <sadmac@google.com>
Reviewed-by: Mark Mentovai <mark@chromium.org>
2019-04-22 23:16:22 +00:00
Mark Mentovai
ff5a25e11f Remove a few unnecessary semicolons.
Patch by Nico Weber <thakis@chromium.org>, originally
https://crrev.com/c/1463405.

Bug: chromium:926235
Change-Id: I7e0ba822aa8dd104768d7ad6e603539576ae96a9
Reviewed-on: https://chromium-review.googlesource.com/c/1463744
Commit-Queue: Mark Mentovai <mark@chromium.org>
Reviewed-by: Nico Weber <thakis@chromium.org>
2019-02-11 16:21:20 +00:00
Joshua Peraza
2afe6dc210 android/linux: Support modules with shared relros on Android
Add MemoryMap::Iterator to support different strategies for locating
the start of module mappings on Android and Linux.

Beginning with API 21, Bionic provides android_dlopen_ext() which
allows passing a file descriptor with an existing relro segment to the
loader. This means that the mapping containing the dynamic segment
could have a name, device, and inode which are different than the
other mappings for the module.

The revised strategy for Android at API 21+ is to search all mappings
in reverse order from they dynamic array mapping until a module is
parsed with the expected dynamic array address.

Linux and Android 20- continue to select mappings using the device,
inode, and file offsets of the mappings.

Bug: crashpad:268
Change-Id: I30e95e51cb6874c00875d2a9c57f1249877736d4
Reviewed-on: https://chromium-review.googlesource.com/c/1374375
Commit-Queue: Joshua Peraza <jperaza@chromium.org>
Reviewed-by: Mark Mentovai <mark@chromium.org>
2018-12-17 22:58:16 +00:00
Joshua Peraza
3663b7cbbe Reland "Use a relative address in .note.crashpad.info"
This is a reland of 95e97a32eba4d505ab9591e683d2147c441eea48

Original change's description:
> Use a relative address in .note.crashpad.info
> 
> The desc value in the note is now the offset of CRASHPAD_INFO_SYMBOL
> from desc.
> 
> Making this note writable can trigger a linker error resulting in
> the binary embedding .note.crashpad.info to be rejected by the
> kernel during program loading.
> 
> The error was observed with:
> GNU ld (GNU Binutils for Debian) 2.30
> clang version 4.0.1-10 (tags/RELEASE_401/final)
> Debian 4.17.17-1rodete2
> 
> When the note is made writable, crashpad_snapshot_test contains two
> PT_LOAD segments which map to the same page.
> 
> LOAD         0x0000000000000000 0x0000000000000000 0x0000000000000000
>              0x0000000000000258 0x0000000000000258  R      0x200000
> LOAD         0x0000000000000258 0x0000000000000258 0x0000000000000258
>              0x00000000002b84d8 0x00000000002b8950  RWE    0x200000
> 
> Executing this binary with the execv system call triggers a segfault
> during program loading (an error can't be returned because the original
> process vm has already been discarded).
> 
> I suspect (I haven't set up a debuggable kernel) the failure occurs
> while attempting to map the second load segment because its virtual
> address, 0x258, is in the same page as the first load segment.
> https://elixir.bootlin.com/linux/v4.17.17/source/fs/binfmt_elf.c#L380
> 
> The linker normally produces consecutive load segments where the second
> segment is loaded 0x200000 bytes after the first, which I think is the
> maximum expected page size. Modifying the test executable to load the
> second segment at 0x1258 (4096 byte page size) allows program loading
> to succeed (but of course crashes after control is given to it).
> 
> Bug: crashpad:260
> Change-Id: I2b9f1e66e98919138baef3da991a9710bd970dc4
> Reviewed-on: https://chromium-review.googlesource.com/c/1292232
> Reviewed-by: Scott Graham <scottmg@chromium.org>
> Reviewed-by: Mark Mentovai <mark@chromium.org>
> Commit-Queue: Joshua Peraza <jperaza@chromium.org>

Bug: crashpad:260
Change-Id: I66713de84cc26c9119e0454d19c9c189263fe054
Reviewed-on: https://chromium-review.googlesource.com/c/1318066
Commit-Queue: Joshua Peraza <jperaza@chromium.org>
Reviewed-by: Mark Mentovai <mark@chromium.org>
Reviewed-by: Scott Graham <scottmg@chromium.org>
2018-11-06 21:38:33 +00:00
Scott Graham
9ee48fb1be Revert "Use a relative address in .note.crashpad.info"
This reverts commit 95e97a32eba4d505ab9591e683d2147c441eea48.

Reason for revert: arm64 lto build

Original change's description:
> Use a relative address in .note.crashpad.info
> 
> The desc value in the note is now the offset of CRASHPAD_INFO_SYMBOL
> from desc.
> 
> Making this note writable can trigger a linker error resulting in
> the binary embedding .note.crashpad.info to be rejected by the
> kernel during program loading.
> 
> The error was observed with:
> GNU ld (GNU Binutils for Debian) 2.30
> clang version 4.0.1-10 (tags/RELEASE_401/final)
> Debian 4.17.17-1rodete2
> 
> When the note is made writable, crashpad_snapshot_test contains two
> PT_LOAD segments which map to the same page.
> 
> LOAD         0x0000000000000000 0x0000000000000000 0x0000000000000000
>              0x0000000000000258 0x0000000000000258  R      0x200000
> LOAD         0x0000000000000258 0x0000000000000258 0x0000000000000258
>              0x00000000002b84d8 0x00000000002b8950  RWE    0x200000
> 
> Executing this binary with the execv system call triggers a segfault
> during program loading (an error can't be returned because the original
> process vm has already been discarded).
> 
> I suspect (I haven't set up a debuggable kernel) the failure occurs
> while attempting to map the second load segment because its virtual
> address, 0x258, is in the same page as the first load segment.
> https://elixir.bootlin.com/linux/v4.17.17/source/fs/binfmt_elf.c#L380
> 
> The linker normally produces consecutive load segments where the second
> segment is loaded 0x200000 bytes after the first, which I think is the
> maximum expected page size. Modifying the test executable to load the
> second segment at 0x1258 (4096 byte page size) allows program loading
> to succeed (but of course crashes after control is given to it).
> 
> Bug: crashpad:260
> Change-Id: I2b9f1e66e98919138baef3da991a9710bd970dc4
> Reviewed-on: https://chromium-review.googlesource.com/c/1292232
> Reviewed-by: Scott Graham <scottmg@chromium.org>
> Reviewed-by: Mark Mentovai <mark@chromium.org>
> Commit-Queue: Joshua Peraza <jperaza@chromium.org>

TBR=scottmg@chromium.org,jperaza@chromium.org,mark@chromium.org

# Not skipping CQ checks because original CL landed > 1 day ago.

Bug: crashpad:260
Change-Id: I7a2c741e6b4c10d3e3b8be3213a8ce2cd93675f7
Reviewed-on: https://chromium-review.googlesource.com/c/1316372
Reviewed-by: Scott Graham <scottmg@chromium.org>
Commit-Queue: Scott Graham <scottmg@chromium.org>
2018-11-03 03:28:19 +00:00
Joshua Peraza
95e97a32eb Use a relative address in .note.crashpad.info
The desc value in the note is now the offset of CRASHPAD_INFO_SYMBOL
from desc.

Making this note writable can trigger a linker error resulting in
the binary embedding .note.crashpad.info to be rejected by the
kernel during program loading.

The error was observed with:
GNU ld (GNU Binutils for Debian) 2.30
clang version 4.0.1-10 (tags/RELEASE_401/final)
Debian 4.17.17-1rodete2

When the note is made writable, crashpad_snapshot_test contains two
PT_LOAD segments which map to the same page.

LOAD         0x0000000000000000 0x0000000000000000 0x0000000000000000
             0x0000000000000258 0x0000000000000258  R      0x200000
LOAD         0x0000000000000258 0x0000000000000258 0x0000000000000258
             0x00000000002b84d8 0x00000000002b8950  RWE    0x200000

Executing this binary with the execv system call triggers a segfault
during program loading (an error can't be returned because the original
process vm has already been discarded).

I suspect (I haven't set up a debuggable kernel) the failure occurs
while attempting to map the second load segment because its virtual
address, 0x258, is in the same page as the first load segment.
https://elixir.bootlin.com/linux/v4.17.17/source/fs/binfmt_elf.c#L380

The linker normally produces consecutive load segments where the second
segment is loaded 0x200000 bytes after the first, which I think is the
maximum expected page size. Modifying the test executable to load the
second segment at 0x1258 (4096 byte page size) allows program loading
to succeed (but of course crashes after control is given to it).

Bug: crashpad:260
Change-Id: I2b9f1e66e98919138baef3da991a9710bd970dc4
Reviewed-on: https://chromium-review.googlesource.com/c/1292232
Reviewed-by: Scott Graham <scottmg@chromium.org>
Reviewed-by: Mark Mentovai <mark@chromium.org>
Commit-Queue: Joshua Peraza <jperaza@chromium.org>
2018-10-31 23:35:50 +00:00
Joshua Peraza
9b2a119dc6 elf: don't warn on trailing unread bytes in the elf dynamic array
This warning triggers reliably on most binaries and on android, spams
the logcat which may obfuscate other errors.

The actual amount varies, but is typically 40 bytes for 32-bit android
system libraries, 80 bytes for 64-bit android system libraries,
64 bytes for linux system libraries (on my machine), but so far they're
all zeroes.

Change-Id: I658434e8290c75641a3b17034ebdd958834bcd69
Reviewed-on: https://chromium-review.googlesource.com/c/1269740
Reviewed-by: Mark Mentovai <mark@chromium.org>
Commit-Queue: Joshua Peraza <jperaza@chromium.org>
2018-10-09 03:08:58 +00:00
Joshua Peraza
688dcfa22e android: handle modules loaded from zipfiles
Modules mapped from zipfiles will have mappings named for the zipfile
rather than the module name and an offset into that zipfile instead of
0.

Bug: crashpad:253, crashpad:254
Change-Id: I0503d13e7b80ba7bd1cc2d241633d9c68c98f1cd
Reviewed-on: https://chromium-review.googlesource.com/1232294
Reviewed-by: Mark Mentovai <mark@chromium.org>
2018-09-20 17:42:56 +00:00
Wez
bc50af15a2 Migrate from ScopedZxHandle to libzx containers.
Bug: chromium:852541
Change-Id: Ie05c70f249e6f843183a02ec61fd09f6a0607598
Reviewed-on: https://chromium-review.googlesource.com/1148923
Reviewed-by: Mark Mentovai <mark@chromium.org>
Commit-Queue: Wez <wez@chromium.org>
2018-08-01 17:38:19 +00:00
Joshua Peraza
52ff1accbb linux: Fix locating modules with multiple mappings from offset 0
The general strategy used by Crashpad to determine loaded modules is to
read the link_map to get the addresses of the dynamic arrays for all
loaded modules. Those addresses can then be used to query the MemoryMap
to locate the module's mappings, and in particular the base mapping
from which Crashpad can parse the entire loaded ELF file.

ELF modules are typically loaded in several mappings with varying
permissions for different segments. The previous strategy used to find
the base mapping for a module was to search backwards from the mapping
for the dynamic array until a mapping from file offset 0 was found for
the same file. This fails when the file is mapped multiple times from
file offset 0, which can happen if the first page of the file contains
a GNU_RELRO segment.

This new strategy queries the MemoryMap for ALL mappings associated
with the dynamic array's mapping, mapped from offset 0. The consumer
(process_reader_linux.cc) can then determine which mapping is the
correct base by attempting to parse a module at that address and
corroborating the PT_DYNAMIC or program header table address from the
parsed module with the values Crashpad gets from the link_map or
auxiliary vector.

Bug: crashpad:30
Change-Id: Ibfcbba512e8fccc8c65afef734ea5640b71e9f70
Reviewed-on: https://chromium-review.googlesource.com/1139396
Commit-Queue: Joshua Peraza <jperaza@chromium.org>
Reviewed-by: Mark Mentovai <mark@chromium.org>
2018-07-26 15:33:15 +00:00
Scott Graham
9a97daff39 Add libfuzzer support
Adds the build support for using libfuzzer controlled by setting
`crashpad_use_libfuzzer=true`.

Also adds a first fuzzer (for ElfImageReader). Currently only runs on
Linux, but should work on Fuchsia too with some minor fixes (not sure
yet whether the fixes required are toolchain or in our build setup).

Run as:
  out/lin/elf_image_reader_fuzzer snapshot/elf/elf_image_reader_fuzzer_corpus/
hits an OOM pretty quickly in trying to allocate a giant buffer.

Bug: crashpad:30, crashpad:196, crashpad:233
Change-Id: Idd3ca11fe00319b8b29e029d5e13b17bfd518ea0
Reviewed-on: https://chromium-review.googlesource.com/1083451
Reviewed-by: Robert Sesek <rsesek@chromium.org>
Reviewed-by: Joshua Peraza <jperaza@chromium.org>
Commit-Queue: Scott Graham <scottmg@chromium.org>
2018-06-07 21:09:53 +00:00
Joshua Peraza
19e6087bb2 Don't restrict ImageAnnotationReader to a module's address range
Annotations data structures may be dynamically allocated so could
appear outside a modules's address range. Let ImageAnnotationReader
use a ProcessMemoryRange for the process, rather than the module.

Also add a test for linux.

Bug: crashpad:30
Change-Id: Ibbf1d2fcb2e44b1b70c8a02e86c6f2fbd784535f
Reviewed-on: https://chromium-review.googlesource.com/1054705
Commit-Queue: Joshua Peraza <jperaza@chromium.org>
Reviewed-by: Scott Graham <scottmg@chromium.org>
2018-05-11 00:22:06 +00:00
Scott Graham
f55a8d4ff3 fuchsia: Work around lack of packaging in Fuchsia tree build
Packaged test running seems to be a ways off, but with a bit of path
fiddling in test_paths.cc we can actually use the paths where the tests
are copied, so do that instead to get all the tests re-enabled. The
setup in BUILD.gn should be mostly-useful once packaging is working as
all helper/data files will need to specified there anyway.

Also, attempted fix to flaky behaviour in
ProcessReaderFuchsia.ChildThreads exposed because the tests are now
being run. zx_object_wait_many() waits on *any* of the objects, not
*all* of them. Derp!

And finally, for the same test, work around some unintuitive behaviour
in zx_task_suspend(), in particular that the thread will not be
suspended for the purpose of reading registers right away, but instead
only "sometime later", which appears in pratice to be after the next
context switch. Have ScopedTaskSuspend block for a while to try to
ensure the registers become readble, and if they don't, at least fail
noisily at that point.

Bug: crashpad:196
Change-Id: I01fb3590ede96301c941c2a88eba47fdbfe74ea7
Reviewed-on: https://chromium-review.googlesource.com/1053797
Reviewed-by: Joshua Peraza <jperaza@chromium.org>
Commit-Queue: Scott Graham <scottmg@chromium.org>
2018-05-10 19:28:10 +00:00
Scott Graham
31703a585f fuchsia: When in Fuchsia tree, disable tests requiring external files
The package deployment/running is in flux at the moment. In order to get
all the other tests on to the main Fuchsia waterfall, disable the ~25
tests that require external files (for launching child processes,
loading modules, or data files) because those operations all fail on
Fuchsia-without-packages right now. Upstream this is PKG-46. Once test
packaging and running has been resolved, this can be reverted.

These tests are still run when building Crashpad standalone on Fuchsia
as the standalone build simply copies all the relevant data files to the
device in /tmp.

Bug: crashpad:196
Change-Id: I1677c394a2b9d709c59363ebeea8aff193d4c21d
Reviewed-on: https://chromium-review.googlesource.com/1045547
Commit-Queue: Scott Graham <scottmg@chromium.org>
Reviewed-by: Joshua Peraza <jperaza@chromium.org>
2018-05-05 00:27:22 +00:00
Scott Graham
bce68d7975 fuchsia: Miscellaneous fixes to get symbol resolution working
- Endian-swaps the 3 integer fields of the build id when returning it
  for use as the module id (see bug 229).
- Removes the "app:" prefix on the main binary, as this prevents the
  crash server from matching the binary name (and it isn't particularly
  useful anyway)
- Map "<vDSO>" to "libzircon.so" as that's what it actually is, so that
  symbols for it can be found.

Bug: crashpad:196, crashpad:229
Change-Id: Ie4abc732b7696345b96c34dbb1a7d2cc2cfcf77f
Reviewed-on: https://chromium-review.googlesource.com/1035461
Reviewed-by: Joshua Peraza <jperaza@chromium.org>
Commit-Queue: Scott Graham <scottmg@chromium.org>
2018-04-30 21:02:08 +00:00
Joshua Peraza
d108fd04a5 linux: Add PtraceConnection::ReadFileContents
Some files, such as /proc/[pid]/maps, may not be accessible to the
handler. This enables the handler access to the contents of those files
via the broker.

This change reads maps and auxv using ReadFileContents.

Bug: crashpad:30
Change-Id: Ia19b498bae473c616ea794ab51c3f22afd5795be
Reviewed-on: https://chromium-review.googlesource.com/989406
Reviewed-by: Mark Mentovai <mark@chromium.org>
2018-04-03 22:08:29 +00:00
Scott Graham
a45e88602b Skip ELF notes with a p_vaddr of zero
Don't attempt to read data if the note isn't in an allocated segment.
See investigation starting at
https://bugs.chromium.org/p/crashpad/issues/detail?id=220#c27 for
details.

Bug: crashpad:220, crashpad:30, crashpad:196
Change-Id: I60eaacb83ad00ef33bde9079d25cc23a59bdf2c8
Reviewed-on: https://chromium-review.googlesource.com/941507
Reviewed-by: Joshua Peraza <jperaza@chromium.org>
Commit-Queue: Scott Graham <scottmg@chromium.org>
2018-02-28 21:21:44 +00:00
Scott Graham
1aae5cedaf Refactor ModuleSnapshot(Linux|Fuchsia) into ModuleSnapshotElf
They were largely the same after recent changes, so with a bit at
initialization time the whole class can be de-duplicated.

Bug: crashpad:196, crashpad:30
Change-Id: I2f5df797dfe36e120090e570273b48ee03f660a5
Reviewed-on: https://chromium-review.googlesource.com/927611
Reviewed-by: Joshua Peraza <jperaza@chromium.org>
Reviewed-by: Mark Mentovai <mark@chromium.org>
Commit-Queue: Scott Graham <scottmg@chromium.org>
2018-02-21 20:20:43 +00:00
Scott Graham
7faa2ef898 Get CrashpadInfo address via a .note, rather than dynamic symtab
Embeds the address of g_crashpad_info into a .note section (which is
readable by the generic code to read notes in ElfImageReader).
Unfortunately because the note section is in libclient.a, it would
normally be dropped at link time.  To avoid that, GetCrashpadInfo() has
a reference *back* to that section, which in turn forces the linker to
include it, allowing the note reader to find it at runtime.

Previously, it was necessary to have the embedder of "client" figure out
how to cause `g_crashpad_info` to appear in the final module's dynamic
symbol table.  With this new approach, there's no manual configuration
necessary, as it's not necessary for the symbol to be exported.

This is currently only implemented in the Linux module reader (and I
believe the current set of enabled tests aren't exercising it?) but it
will also be done this way for the Fuchsia implementation of
ModuleSnapshot.

Bug: crashpad:196
Change-Id: I599db5903bc98303130d11ad850ba9ceed3b801a
Reviewed-on: https://chromium-review.googlesource.com/912284
Commit-Queue: Scott Graham <scottmg@chromium.org>
Reviewed-by: Mark Mentovai <mark@chromium.org>
Reviewed-by: Joshua Peraza <jperaza@chromium.org>
2018-02-15 19:02:12 +00:00
Joshua Peraza
3f0371cce2 Define ElfImageReader::Memory()
Bug: crashpad:30
Change-Id: Ibb6c6423736daa9fb248ac0c8d724244906236d4
Reviewed-on: https://chromium-review.googlesource.com/894447
Reviewed-by: Mark Mentovai <mark@chromium.org>
Commit-Queue: Joshua Peraza <jperaza@chromium.org>
2018-01-31 17:06:59 +00:00
Scott Graham
1f1657d573 Read either DT_HASH or DT_GNU_HASH to determine the size of DT_SYMTAB
Without the section headers for the symbol table, there's no direct way
to calculate the number of entries in the table.

DT_HASH and DT_GNU_HASH are auxiliary tables that are designed to make
symbol lookup faster. DT_HASH is the original and is theoretically
mandatory. DT_GNU_HASH is the new-and-improved, but is more complex.

In practice, however, an Android build (at least vs. API 16) has only
DT_HASH, and not DT_GNU_HASH, and a Fuchsia build has only DT_GNU_HASH
but not DT_HASH. So, both are tried.

This change does not actually use the data in these tables to improve
the speed of symbol lookup, but instead only uses them to correctly
terminate the linear search.

DT_HASH contains the total number of symbols in the symbol table fairly
directly because there is an entry for each symbol table entry in the
hash table, so the number is the same.

DT_GNU_HASH regrettably does not. Instead, it's necessary to walk the
buckets and chain structure to find the largest entry.

DT_GNU_HASH doesn't appear in any "real" documentation that I'm aware
of, other than the binutils code (at least as far as I know). Some
more-and-less-useful references:
- https://flapenguin.me/2017/04/24/elf-lookup-dt-hash/
- https://flapenguin.me/2017/05/10/elf-lookup-dt-gnu-hash/
- http://deroko.phearless.org/dt_gnu_hash.txt
- https://sourceware.org/ml/binutils/2006-10/msg00377.html

Change-Id: I7cfc4372f29efc37446f0931d22a1f790e44076f
Bug: crashpad:213, crashpad:196
Reviewed-on: https://chromium-review.googlesource.com/876879
Commit-Queue: Scott Graham <scottmg@chromium.org>
Reviewed-by: Mark Mentovai <mark@chromium.org>
Reviewed-by: Joshua Peraza <jperaza@chromium.org>
2018-01-30 22:40:17 +00:00
Scott Graham
c04352a2e6 Rework ElfImageReader.OneModuleChild to not rely on fork()
Switches from test::Multiprocess to test::MultiprocessExec for
ElfImageReader.OneModuleChild.

Uses the new child process launching, and passes the address of libc and
the address of getpid from the child to parent, rather than assuming the
values will be the same in both processes.

And, enables the test on Fuchsia since it now works.

Bug: crashpad:196, crashpad:215
Change-Id: I3650c16c4fccfe9c1e4147192fdc88b997460060
Reviewed-on: https://chromium-review.googlesource.com/887373
Commit-Queue: Scott Graham <scottmg@chromium.org>
Reviewed-by: Mark Mentovai <mark@chromium.org>
2018-01-25 23:02:20 +00:00
Scott Graham
11589d9b32 Rework ElfImageReader.MainExecutableChild to not rely on fork()
Switches from test::Multiprocess to test::MultiprocessExec for
ElfImageReader.MainExecutableChild.

Uses the new child process launching, and passes the expected symbol
address from the child to the parent, rather than assuming the value
will be the same in both processes.

And, enables the test on Fuchsia since it now works.

Bug: crashpad:196, crashpad:215
Change-Id: I3b43407b6584275d61bedc9c13d1625b950fc23b
Reviewed-on: https://chromium-review.googlesource.com/884993
Commit-Queue: Scott Graham <scottmg@chromium.org>
Reviewed-by: Mark Mentovai <mark@chromium.org>
2018-01-25 23:00:49 +00:00
Scott Graham
dea19c7374 fuchsia: Port ElfImageReader and (some of) its tests
(Still need to avoid fork()-dependence for the non-self tests.)

Bug: crashpad:196
Change-Id: Ib34fe33c7ec295881c1f555995072d9ff742647f
Reviewed-on: https://chromium-review.googlesource.com/876650
Reviewed-by: Joshua Peraza <jperaza@chromium.org>
Reviewed-by: Mark Mentovai <mark@chromium.org>
Commit-Queue: Scott Graham <scottmg@chromium.org>
2018-01-19 22:22:21 +00:00
Joshua Peraza
fb379a9242 Add ModuleSnapshotLinux
Bug: crashpad:30
Change-Id: Ibf1f62b82a4926e1dfd9ad92231bfff44b811d78
Reviewed-on: https://chromium-review.googlesource.com/842187
Commit-Queue: Joshua Peraza <jperaza@chromium.org>
Reviewed-by: Mark Mentovai <mark@chromium.org>
2018-01-10 19:41:47 +00:00
Joshua Peraza
8bbe985004 elf: Use d_ptr instead of d_val when reading from a dynamic array
The dynamic array reader should treat data as unsigned when initially
reading values from the array to prevent premature sign-extension. The
glibc and traditional android headers define d_val using Elf32_Word, an
unsigned type. linux/elf.h, used by unified android headers, defines
d_val using Elf32_Sword, a signed type. Use d_ptr instead since it's
always an unsigned type.

Bug: crashpad:30
Change-Id: Ie8e88941fefc7075621aefe226fdba33b1f6129c
Reviewed-on: https://chromium-review.googlesource.com/847818
Commit-Queue: Joshua Peraza <jperaza@chromium.org>
Reviewed-by: Mark Mentovai <mark@chromium.org>
2018-01-08 23:28:21 +00:00
Mark Mentovai
c04c05564d linux: Fix gcc -Wparentheses error from 7a0daa6989a9
../../snapshot/elf/elf_image_reader.cc:261:29: error: suggest parentheses around ‘-’ in operand of ‘&’ [-Werror=parentheses]
 #define PAD(x) ((x) + align - 1 & ~(align - 1))
                 ~~~~~~~~~~~~^~~
../../snapshot/elf/elf_image_reader.cc:262:26: note: in expansion of macro ‘PAD’
   size_t padded_namesz = PAD(note_info.n_namesz);
                          ^~~

Change-Id: I5cabc2741c8541ae9cf66933d35658e1cbc20912
Reviewed-on: https://chromium-review.googlesource.com/817575
Reviewed-by: Joshua Peraza <jperaza@chromium.org>
Commit-Queue: Mark Mentovai <mark@chromium.org>
2017-12-08 22:53:11 +00:00
Joshua Peraza
7a0daa6989 Enable reading notes from ELF images
Bug: crashpad:30
Change-Id: Ie6c594b05c6d39a869ed30b7a7b49e6a6301cc65
Reviewed-on: https://chromium-review.googlesource.com/792539
Commit-Queue: Joshua Peraza <jperaza@chromium.org>
Reviewed-by: Mark Mentovai <mark@chromium.org>
2017-12-05 19:27:37 +00:00
Dave Bort
906fce1d01 Make ProcessMemory an abstract interface
Only a Linux implementation for now, but similar code for other
OSes can move behind it in the future.

Bug: crashpad:196
Change-Id: I05966db1599a9cac3146d2a3d964e7ad8629d616
Reviewed-on: https://chromium-review.googlesource.com/685408
Reviewed-by: Mark Mentovai <mark@chromium.org>
Commit-Queue: Dave Bort <dbort@google.com>
2017-10-13 21:45:14 +00:00
Dave Bort
fe4b16fe88 Move linux/process files to util/process
A step towards making these files usable by non-Linux systems.

Bug: crashpad:196
Change-Id: I71323b29e46208b3992055722e4622d79409c44c
Reviewed-on: https://chromium-review.googlesource.com/685406
Commit-Queue: Dave Bort <dbort@google.com>
Reviewed-by: Mark Mentovai <mark@chromium.org>
2017-10-10 18:25:07 +00:00
Dave Bort
6c9bd10a24 Use generic VM types in snapshot/elf
A step towards making these files usable by non-Linux systems.

Bug: crashpad:196
Change-Id: I2497fd7e3bcb5390ae1e6ae22902ab6f56b59dff
Reviewed-on: https://chromium-review.googlesource.com/685405
Reviewed-by: Joshua Peraza <jperaza@chromium.org>
Commit-Queue: Dave Bort <dbort@google.com>
2017-10-03 00:42:39 +00:00
Dave Bort
9e07a7148c Move linux/elf files to snapshot/elf
A step towards making these files usable by non-Linux systems.

Bug: crashpad:196
Change-Id: I1dc4304b1376a3a5e45228cf40b23f0367d3efa8
Reviewed-on: https://chromium-review.googlesource.com/685404
Commit-Queue: Dave Bort <dbort@google.com>
Reviewed-by: Joshua Peraza <jperaza@chromium.org>
Reviewed-by: Mark Mentovai <mark@chromium.org>
2017-10-02 21:54:34 +00:00