1 /*
2  * Copyright (C) 2016 The Android Open Source Project
3  *
4  * Licensed under the Apache License, Version 2.0 (the "License");
5  * you may not use this file except in compliance with the License.
6  * You may obtain a copy of the License at
7  *
8  *      http://www.apache.org/licenses/LICENSE-2.0
9  *
10  * Unless required by applicable law or agreed to in writing, software
11  * distributed under the License is distributed on an "AS IS" BASIS,
12  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13  * See the License for the specific language governing permissions and
14  * limitations under the License.
15  */
16 
17 #include <errno.h>
18 #include <fcntl.h>
19 #include <inttypes.h>
20 #include <pthread.h>
21 #include <sched.h>
22 #include <stddef.h>
23 #include <stdio.h>
24 #include <stdlib.h>
25 #include <string.h>
26 #include <sys/mman.h>
27 #include <sys/prctl.h>
28 #include <sys/syscall.h>
29 #include <sys/types.h>
30 #include <sys/wait.h>
31 #include <unistd.h>
32 
33 #include "android-base/macros.h"
34 
35 #include "PtracerThread.h"
36 #include "log.h"
37 
38 namespace android {
39 
40 class Stack {
41  public:
42   explicit Stack(size_t size) : size_(size) {
43     int prot = PROT_READ | PROT_WRITE;
44     int flags = MAP_PRIVATE | MAP_ANONYMOUS;
45     page_size_ = sysconf(_SC_PAGE_SIZE);
46     size_ += page_size_ * 2;  // guard pages
47     base_ = mmap(NULL, size_, prot, flags, -1, 0);
48     if (base_ == MAP_FAILED) {
49       base_ = NULL;
50       size_ = 0;
51       return;
52     }
53     prctl(PR_SET_VMA, PR_SET_VMA_ANON_NAME, base_, size_, "libmemunreachable stack");
54     mprotect(base_, page_size_, PROT_NONE);
55     mprotect(top(), page_size_, PROT_NONE);
56   };
57   ~Stack() { munmap(base_, size_); };
58   void* top() {
59     return reinterpret_cast<void*>(reinterpret_cast<uintptr_t>(base_) + size_ - page_size_);
60   };
61 
62  private:
63   DISALLOW_COPY_AND_ASSIGN(Stack);
64 
65   void* base_;
66   size_t size_;
67   size_t page_size_;
68 };
69 
70 PtracerThread::PtracerThread(const std::function<int()>& func) : child_pid_(0) {
71   stack_ = std::make_unique<Stack>(PTHREAD_STACK_MIN);
72   if (stack_->top() == nullptr) {
73     MEM_LOG_ALWAYS_FATAL("failed to mmap child stack: %s", strerror(errno));
74   }
75 
76   func_ = std::function<int()>{[&, func]() -> int {
77     // In the child thread, lock and unlock the mutex to wait for the parent
78     // to finish setting up for the child thread
79     std::unique_lock<std::mutex> lk(m_);
80     lk.unlock();
81     _exit(func());
82   }};
83 }
84 
85 PtracerThread::~PtracerThread() {
86   Kill();
87   Join();
88   ClearTracer();
89   stack_ = nullptr;
90 }
91 
92 bool PtracerThread::Start() {
93   std::unique_lock<std::mutex> lk(m_);
94 
95   // Convert from void(*)(void*) to lambda with captures
96   auto proxy = [](void* arg) -> int {
97     prctl(PR_SET_NAME, "libmemunreachable ptrace thread");
98     return (*reinterpret_cast<std::function<int()>*>(arg))();
99   };
100 
101   // See README.md for why we create the child process this way
102   child_pid_ = clone(proxy, stack_->top(), CLONE_VM | CLONE_FS | CLONE_FILES /*|CLONE_UNTRACED*/,
103                      reinterpret_cast<void*>(&func_));
104   if (child_pid_ < 0) {
105     MEM_ALOGE("failed to clone child: %s", strerror(errno));
106     return false;
107   }
108 
109   SetTracer(child_pid_);
110 
111   lk.unlock();
112 
113   return true;
114 }
115 
116 int PtracerThread::Join() {
117   if (child_pid_ == -1) {
118     return -1;
119   }
120   int status;
121   int ret = TEMP_FAILURE_RETRY(waitpid(child_pid_, &status, __WALL));
122   if (ret < 0) {
123     MEM_ALOGE("waitpid %d failed: %s", child_pid_, strerror(errno));
124     return -1;
125   }
126 
127   child_pid_ = -1;
128 
129   if (WIFEXITED(status)) {
130     return WEXITSTATUS(status);
131   } else if (WIFSIGNALED(status)) {
132     return -WTERMSIG(status);
133   } else {
134     MEM_ALOGE("unexpected status %x", status);
135     return -1;
136   }
137 }
138 
139 void PtracerThread::Kill() {
140   if (child_pid_ == -1) {
141     return;
142   }
143 
144   syscall(SYS_tkill, child_pid_, SIGKILL);
145 }
146 
147 void PtracerThread::SetTracer(pid_t tracer_pid) {
148   prctl(PR_SET_PTRACER, tracer_pid);
149 }
150 
151 void PtracerThread::ClearTracer() {
152   prctl(PR_SET_PTRACER, 0);
153 }
154 
155 }  // namespace android
156