summaryrefslogtreecommitdiff
path: root/debuggerd/debuggerd_test.cpp
AgeCommit message (Collapse)Author
2021-06-29[MTE] Add a HWASan-style tag dump to tombstones.Mitch Phillips
We already dump the tags in the regigster dump section by appending the tag to the memory address. You only get 2 granules before each register and 13 after. The HWASan-style tag dump is extremely useful for debugging, as it gives a pretty comprehensive overview of the memory subsystem. It also provides enough context bytes (256) to give you a reasonable intuition about a particular bug. The tag dump shows up only if PTRACE_PEEKTAGS returns at least one value in the 256 requested. If the start of end of the region is untagged, it's omitted. The tag dump looks like this: Change-Id: Icc33fb97542d9b1fa3ae9e58aba34d524c6ba7b5 --- Memory tags around the fault address (0x60000704414d340), one tag per 16 bytes: 0x704414d000: 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0x704414d100: 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0x704414d200: 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 =>0x704414d300: 0 0 0 0 [2] 2 0 0 0 0 0 0 0 0 0 0 0x704414d400: 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0x704414d500: 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0x704414d600: 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0x704414d700: 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0x704414d800: 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0x704414d900: 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0x704414da00: 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 --- Bug: 183992164 Test: atest debuggerd_test on MTE+QEMU and sunfish. Change-Id: I8d5842e4803ca30b407e866c99eef56f2cb36600 Merged-In: I8d5842e4803ca30b407e866c99eef56f2cb36600
2021-06-03[MTE] Print cause and alloc/dealloc traces to logcat.Mitch Phillips
This information clearly meets the bar for being dumped to logcat. If we omit the info, we may confuse the user into thinking that it's not available at all, especially if it's their first time seeing an MTE report. This also adds some functionality to the integration testing library to pull logcat messages and scan them to make sure the contents are in both places. Fixes: 187881237 Test: atest debuggerd_test # on QEMU w/ MTE. Change-Id: Icc17ea45bda7628331cc4812eaad3bc5c949b7a7 Merged-In: Icc17ea45bda7628331cc4812eaad3bc5c949b7a7
2021-05-14Merge "Run MTE tests on zero-sized allocations."Peter Collingbourne
2021-05-13Run MTE tests on zero-sized allocations.Peter Collingbourne
Bug: 187879470 Change-Id: I9547f3032af9d1a921f8597a53389d25af33b369
2021-05-13Merge "Test that out-of-bounds UAF is not detected with MTE."Peter Collingbourne
2021-05-12Test that out-of-bounds UAF is not detected with MTE.Peter Collingbourne
This type of error is unlikely and attempting to detect it with MTE is likely to produce false positive reports. Make sure that this type of error is not detected by the allocator. Change-Id: I90676d1a031411d6b725890311317802bc24b459
2021-05-03Re-add backtrace note about unreadable elf.Christopher Ferris
When moving to the proto-ized tombstones, the note about unreadable elf files in a backtrace got lost. This re-adds it and adds a test to verify that the note properly shows up. Bug: 185428454 Test: Ran unit tests. Change-Id: I1150cc737772e1b79fd73ec5c782caadc4629421
2021-04-16Allow another prctl call.Christopher Ferris
A change was made so that pthread_create is calling prctl(PR_PAC_RESET_KEYS, ...) on aarch64. It's possible that other seccomp policies might need to change to allow this. Test: CrasherTest.seccomp_backtrace passes on aarch64. Change-Id: I9c4d1b3dca5f19a6285bf904bb942f1f52e42bd0
2021-03-19Merge "Support MTE and GWP-ASan features in proto tombstones."Peter Collingbourne
2021-03-19Merge "[GWP-ASan] Add debuggerd end-to-end tests and remove unique wording."Peter Collingbourne
2021-03-17debuggerd: prepare to abandon ship^Wgdb.Elliott Hughes
Talk of "gdb" when we currently mean "gdb or lldb" and will soon mean "lldb" is starting to confuse people. Let's use the more neutral "debugger" in places where it really doesn't matter. The switch from gdbclient.py to lldbclient.py is a change for another day... Test: treehugger Change-Id: If39ca7e1cdf4c8bb9475f1791cdaf201fbea50e0
2021-03-16Support MTE and GWP-ASan features in proto tombstones.Peter Collingbourne
Proto tombstones were missing tagged fault addresses, tagged_addr_ctrl, tags in memory dumps and Scudo and GWP-ASan error reports. Since text tombstones now go via protos, all of these features broke when we switched to text tombstones generated from protos by default. Fix the features by adding support for them to the proto format, tombstone_proto and tombstone_proto_to_text. Bug: 135772972 Bug: 182489365 Change-Id: I3ca854546c38755b1f6410a1f6198a44d25ed1c5
2021-03-11[GWP-ASan] Add debuggerd end-to-end tests and remove unique wording.Mitch Phillips
Looks like we unintentionally had a breakage after aosp/1595302, where both GWP-ASan and MTE tests started failing because the extra information wasn't plumbed through the tombstones. MTE has end-to-end tests but aren't run continuously, and GWP-ASan was missing the e2e tests. Also remove some unique wording for GWP-ASan, a UaF on the free'd pointer is now "0 bytes into a 16-byte allocation" instead of "on a 16-byte allocation". The former is more descriptive and is more ubiquitously used in our tooling. This patch adds the E2E tests, but the underlying problem needs to be fixed as well, before this patch can land. Bug: 182489365 Test: atest debuggerd_test Change-Id: I0fe8aba7ea443b3071724987f46b19a6525cda3c
2021-03-11Merge "Teach debuggerd to pass the secondary ring buffer to ↵Peter Collingbourne
__scudo_get_error_info()."
2021-03-06Merge "Untag addresses in registers before looking up the mapping."Treehugger Robot
2021-02-18Don't hard-code number of tombstones.Christopher Ferris
On cuttlefish, the number of tombstones allowed is much larger than 50, so change the algorithm to search for any tombstone file. Test: Ran unit tests on cuttlefish with > 50 tombstones. Test: Ran unit tests on device. Change-Id: Ia1d885fe19a7f7751fe3386d40b48750d1e21bd5
2021-02-12Teach debuggerd to pass the secondary ring buffer to __scudo_get_error_info().Peter Collingbourne
With this change we can report memory errors involving secondary allocations. Update the existing crasher tests to also test UAF/overflow/underflow on allocations with sizes sufficient to trigger the secondary allocator. Bug: 135772972 Change-Id: Ic8925c1f18621a8f272e26d5630e5d11d6d34d38
2021-02-05Untag addresses in registers before looking up the mapping.Peter Collingbourne
Otherwise we can fail to find map entries for tagged addresses, such as those of heap objects. Bug: 135772972 Change-Id: Ia626b0587c8461eb575b2de5c08562c73ba4a66e
2021-02-02Fix CrasherTest.smoke in debuggerd_test.Peter Collingbourne
Now that we default to sync MTE in tests, the default tagged_addr_ctrl in this test needs to be updated. Bug: 135772972 Change-Id: I9bf6fb29df9799d1ed8c0d8b66f4d2891f487d80
2021-01-26Reland protobuf tombstones.Josh Gao
This reverts the following commits: e156ede145a7fc671c705d045d89b49922a758b5. eda96eddcbdda9632166232b2363c7b84da0994d. 5ec54d1e843729cd1e38a2f791f001226a653e95. 1e45d3f2239333217d3252f78151f4294fda4e80. a50f61f8fa903117a6df82d164628de310f16ae9. Test: treehugger Test: atest -c CtsSeccompHostTestCases:android.seccomp.cts.SeccompHostJUnit4DeviceTest#testAppZygoteSyscalls Change-Id: Ic2b1f489ac9f1fec7d7a33c845c29891f4306bbd
2021-01-26Revert "tombstoned: make it easier to add more types of outputs."Jerome Gaillard
Revert "Let crash_dump read /proc/$PID." Revert submission 1556807-tombstone_proto Reason for revert: b/178455196, Broken test: android.seccomp.cts.SeccompHostJUnit4DeviceTest#testAppZygoteSyscalls on git_master on cf_x86_64_phone-userdebug Reverted Changes: Ide6811297:tombstoned: switch from goto to RAII. I8d285c4b4:tombstoned: make it easier to add more types of ou... Id0f0fa285:tombstoned: support for protobuf fds. I6be6082ab:Let crash_dump read /proc/$PID. Id812ca390:Make protobuf vendor_ramdisk_available. Ieeece6e6d:libdebuggerd: add protobuf implementation. Change-Id: Ib2403c1b61f6cf0513b76361440fbc5909d7554a
2021-01-26Revert "tombstoned: support for protobuf fds."Jerome Gaillard
Revert "Let crash_dump read /proc/$PID." Revert submission 1556807-tombstone_proto Reason for revert: b/178455196, Broken test: android.seccomp.cts.SeccompHostJUnit4DeviceTest#testAppZygoteSyscalls on git_master on cf_x86_64_phone-userdebug Reverted Changes: Ide6811297:tombstoned: switch from goto to RAII. I8d285c4b4:tombstoned: make it easier to add more types of ou... Id0f0fa285:tombstoned: support for protobuf fds. I6be6082ab:Let crash_dump read /proc/$PID. Id812ca390:Make protobuf vendor_ramdisk_available. Ieeece6e6d:libdebuggerd: add protobuf implementation. Change-Id: I0c4f3a17e8b06d6c65255388c571ebf11d371dbb
2021-01-25Merge changes from topic "tombstone_proto"Josh Gao
* changes: libdebuggerd: add protobuf implementation. tombstoned: support for protobuf fds. tombstoned: make it easier to add more types of outputs. tombstoned: switch from goto to RAII.
2021-01-15Move debuggerd_test over to mallopt().Elliott Hughes
Bug: http://b/135772972 Test: treehugger Change-Id: I178f2a753b5608d9e72cee8874524ad4faf701d7
2021-01-13tombstoned: support for protobuf fds.Josh Gao
Test: debuggerd_test Change-Id: Id0f0fa2856e4b8e57d7dc0e1495134e943b289da
2021-01-13tombstoned: make it easier to add more types of outputs.Josh Gao
While we're at it, switch to unlinkat. Test: debuggerd_test Change-Id: I8d285c4b4e94effa1acb8f69ac3af4ff8c37defb
2021-01-11Remove ANDROID_EXPERIMENTAL_MTE.Peter Collingbourne
Now that the feature guarded by this flag has landed in Linux 5.10 we no longer need the flag, so we can remove it. Bug: 135772972 Change-Id: I02fa50848cbd0486c23c8a229bb8f1ab5dd5a56f
2020-11-18Change the android_mallopt(M_SET_HEAP_TAGGING_LEVEL) API.Peter Collingbourne
- Make it apply to every thread, and thus remove the restriction that it must be called while the program is single threaded. - Make it change TCF0 itself (on all threads), instead of requiring callers to do it themselves, which can be error prone. And update all of the call sites. Change the implementation of android_mallopt(M_DISABLE_MEMORY_MITIGATIONS) to call android_mallopt(M_SET_HEAP_TAGGING_LEVEL) internally. This avoids crashes during startup that were observed when the two mallopts updated TCF0 unaware of each other. I wouldn't expect there to be any out-of-tree callers at this point, but it's worth noting that the new interface is backwards compatible with the old one because it strictly expands the set of situations in which the API can be used (i.e. situations where there are multiple threads running or where TCF0 hadn't been updated beforehand). Bug: 135772972 Change-Id: I7746707898ff31ef2e0af01c4f55ba90b72bef51
2020-11-02Fix the expected tagged_addr_ctrl in a test.Peter Collingbourne
It turns out that I had originally written the test with a local patch applied that forces TCF0 to SYNC, so it was testing for the wrong tagged_addr_ctrl value. Fix it. Bug: 135772972 Change-Id: Ibb9b25e5f5635372ad5de7825c31d7264ff02590
2020-09-15Dump the per-thread TAGGED_ADDR_CTRL value if available.Peter Collingbourne
This value indicates whether memory tagging is enabled on a thread, the mode (sync or async) and the set of excluded tags. This information can sometimes be important for understanding an MTE related crash, so include it in the per-thread tombstone output. Bug: 135772972 Change-Id: I25a16e10ac7fbb2b1ab2a961a5279f787039000b
2020-07-21Include memory tags in memory dump output.Peter Collingbourne
Tags appear in the addresses printed in the memory dump, which seems like a reasonable place to put them because tagged addresses will also appear in other places in the tombstone, such as registers and the fault address. Bug: 135772972 Change-Id: I52da338347ff6b7503cf5ac80763c540695dc061
2020-07-17Fix dumping of heap memory.Peter Collingbourne
After r.android.com/1288984 we started failing to dump memory contents for heap addresses because the tag started causing any addresses to fail this bounds check. Add an untag_address() call to the bounds check so that the tag is ignored. Bug: 154272452 Change-Id: I3a6d1a078b21871bd93164150a123549f83289f6
2020-05-08Add stack trace coverage to MTE tests.Peter Collingbourne
It's impractical to test the contents of the stack trace, but we should at least test that *a* stack trace is present, which would have caught the bug fixed by r.android.com/1306754 . Bug: 135772972 Change-Id: Ic5e0b997caa53c7eeec4e5185df5c043c9d4fe3d
2020-04-27Add support for MTE error reports in tombstones.Peter Collingbourne
Teach debuggerd to use the new scudo APIs proposed in https://reviews.llvm.org/D77283 for extracing MTE error reports from crashed processes, and include those reports in tombstones if possible. Bug: 135772972 Change-Id: I082dfd0ac9d781cfed2b8c34cc73562614bb0dbb
2020-03-27Read fault address on arm64 using proposed kernel API.Peter Collingbourne
On aarch64, the top 8 bits of the address (i.e. the tag bits) of the fault address in si_addr are always clear. This isn't ideal for MTE which will require these bits in order to correctly diagnose tag mismatches. A proposed kernel patch [1] exposes the full fault address including the tag bits as part of the ucontext. Change debuggerd to read this fault address if available. [1] https://patchwork.kernel.org/patch/11435077/ Bug: 135772972 Change-Id: Ia05be574113860f4e9ecc36a310c4b740e0c4afb
2019-12-17debuggerd: switch to using platform headers for DEBUGGER_SIGNAL.Josh Gao
Test: treehugger Change-Id: Ie9736c4a077dba1029d2352bd94d47ce07323aec
2019-10-10[debuggerd] fix -Wreorder-init-listNick Desaulniers
C++20 wants members to be ordered unlike C99. Bug: 139945549 Test: mm Change-Id: I3cbca589511c1e0bbc10c691949e18de77e16031 Signed-off-by: Nick Desaulniers <ndesaulniers@google.com>
2019-09-20Increase timeouts.Christopher Ferris
There is still some flakiness, so increase the timeout values. Also remove the TEMP_FAILURE_RETRY macro usage in TIMEOUT calls. That macro disables the ability of the alarm code to interrupt the system call. Bug: 141045754 Test: Unit tests pass. Change-Id: Ia3c95dccc3076a3fd5ef6432097a57e4ccee4df3
2019-09-18Add TEMP_FAILURE_RETRY where appropriate.Christopher Ferris
Bug: 141045754 Test: Ran unit tests in a loop on walleye and cuttlefish. Change-Id: I87b912e76889ed207ab17b862e4786ee44a382ba
2019-09-17Allow getrlimit/ugetrlimit syscalls in tests.Christopher Ferris
The fdsan code uses getrlimit/ugetrlimit so need to allow that when running the debuggerd unit tests. Bug: 141045754 Test: Ran the offending tests hundreds of times without failure. Change-Id: Iece94f03e7895d61ca8a8f3ab17dce7e54ddf9cd
2019-07-17Add cause message when stack overflow is detected.Christopher Ferris
Test: Ran new unit tests. Test: Ran crasher stack-overflow, crasher64 stack-overflow and verified Test: stack overflow cause is shown. Test: Ran stack overflow app and verified tombstone includes stack-overflow Test: message. Change-Id: I9bb01186dff5ed81c77d84b6aaedb5332ddd7256
2019-06-26Increase timeout to avoid flaky tests.Christopher Ferris
Also, print extra information when an error occurs. Test: Ran unit tests. Change-Id: I3404549db0ac18a4a82a99b2620556db96376bca
2019-02-13debuggerd: switch to base::{Send,Receive}FileDescriptors.Josh Gao
Bug: http://b/12204763 Test: debuggerd_test Change-Id: I0be40916214de51ab36fd6bd6d44090a84312e51
2018-09-14tombstoned: don't generate tombstones for native backtraces.Josh Gao
Previously, if an intercept ends before we ask for a file descriptor when doing a backtrace, we'll create a tombstone file instead. Bug: http://b/114139908 Bug: http://b/115349586 Test: debuggerd_test32 Change-Id: I23c7bb8ae5a982a4374a862d0a4f17bee03eb1d9
2018-09-12Fix multithreaded backtraces for seccomp processes.Josh Gao
Add threads to the existing seccomp backtrace test to prevent regressing this. Bug: http://b/114139908 Bug: http://b/115349586 Test: debuggerd_test32 Test: debuggerd_test64 Change-Id: I07fbe1619b60f0008deb045a249f9045404478c2
2018-08-27debuggerd_test: add test for fdsan abort message.Josh Gao
Bug: http://b/112770187 Test: debuggerd_test Test: bionic-unit-tests Change-Id: Ia93761e89074aea4629b8d0f232c580d6f0f249c
2018-05-14Expect optional (offset ...) in frame dump.Chih-Hung Hsieh
* New lld could create files that map to non-zero offset at run time. Test: debuggerd_test Bug: 79590156 Change-Id: I12db0ebef489ba8a1e648a29d214f8d3c3703996
2018-05-02Fix a debuggerd test expectation.Elliott Hughes
70d8f289454c9b691ec5421b0ed0354b6baaace8 broke a test that was not expecting to see the new detail about the signal's sender. Bug: http://b/78594105 Test: ran tests Change-Id: Idfa3a53b9e664308efdba560ffbb1401c1904530
2018-04-13debuggerd: remove maximum abort message length.Josh Gao
Let the logging implementation be the imposer of limits. Bug: http://b/64759619 Test: debuggerd_test Change-Id: I8bc73bf2301ce071668993b740880224846a4e75
2018-02-22debuggerd_fallback: don't recursively abort.Josh Gao
Calls to abort() will always result in our signal handler being called, because abort will manually unblock SIGABRT before raising it. This can lead to deadlock when handling address space exhaustion in the fallback handler. To fix this, switch our mutex to a recursive mutex, and manually keep track of our lock count. Bug: http://b/72929749 Test: debuggerd_test --gtest_filter="CrasherTest.seccomp_crash_oom" Change-Id: I609f263ce93550350b17757189326b627129d4a7
generated by cgit v1.2.3 (git 2.25.1) at 2025-10-03 14:10:08 +0000