summaryrefslogtreecommitdiff
path: root/debuggerd/libdebuggerd
AgeCommit message (Collapse)Author
2021-06-29[MTE] Add a HWASan-style tag dump to tombstones.Mitch Phillips
We already dump the tags in the regigster dump section by appending the tag to the memory address. You only get 2 granules before each register and 13 after. The HWASan-style tag dump is extremely useful for debugging, as it gives a pretty comprehensive overview of the memory subsystem. It also provides enough context bytes (256) to give you a reasonable intuition about a particular bug. The tag dump shows up only if PTRACE_PEEKTAGS returns at least one value in the 256 requested. If the start of end of the region is untagged, it's omitted. The tag dump looks like this: Change-Id: Icc33fb97542d9b1fa3ae9e58aba34d524c6ba7b5 --- Memory tags around the fault address (0x60000704414d340), one tag per 16 bytes: 0x704414d000: 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0x704414d100: 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0x704414d200: 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 =>0x704414d300: 0 0 0 0 [2] 2 0 0 0 0 0 0 0 0 0 0 0x704414d400: 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0x704414d500: 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0x704414d600: 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0x704414d700: 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0x704414d800: 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0x704414d900: 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0x704414da00: 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 --- Bug: 183992164 Test: atest debuggerd_test on MTE+QEMU and sunfish. Change-Id: I8d5842e4803ca30b407e866c99eef56f2cb36600 Merged-In: I8d5842e4803ca30b407e866c99eef56f2cb36600
2021-06-24Avoid using thread cache in unwinder.yidong zhang
Using thread cache will cause SIGSEGV for 32bit+kernel4.9 device. Bug: 190579082 Bug: 189803009 Test: run cts -m CtsSeccompHostTestCases Change-Id: I47b13d02674aadbacd8dac36d8382eed0885413c Merged-In: I47b13d02674aadbacd8dac36d8382eed0885413c Signed-off-by: yidong zhang <yidong.zhang@amlogic.com> (cherry picked from commit cbf7c466e65eba2b285b28292a5e4934b6655c8a)
2021-06-03[MTE] Print cause and alloc/dealloc traces to logcat.Mitch Phillips
This information clearly meets the bar for being dumped to logcat. If we omit the info, we may confuse the user into thinking that it's not available at all, especially if it's their first time seeing an MTE report. This also adds some functionality to the integration testing library to pull logcat messages and scan them to make sure the contents are in both places. Fixes: 187881237 Test: atest debuggerd_test # on QEMU w/ MTE. Change-Id: Icc17ea45bda7628331cc4812eaad3bc5c949b7a7 Merged-In: Icc17ea45bda7628331cc4812eaad3bc5c949b7a7
2021-05-13Update API of MapInfo from libunwindstackDavid Srbecky
Use accessors to for all the fields. Test: build Change-Id: I68d149d914d4a4b088aaf822fe222a5d9e56ae80
2021-05-03Re-add backtrace note about unreadable elf.Christopher Ferris
When moving to the proto-ized tombstones, the note about unreadable elf files in a backtrace got lost. This re-adds it and adds a test to verify that the note properly shows up. Bug: 185428454 Test: Ran unit tests. Change-Id: I1150cc737772e1b79fd73ec5c782caadc4629421
2021-03-31Merge "debuggerd: store commandline instead of process name."Josh Gao
2021-03-30debuggerd: store commandline instead of process name.Josh Gao
Bug: http://b/180605583 Test: debuggerd_test Change-Id: I018d399a5460f357766dc1b429f645f78fe88565
2021-03-23Adjust libunwindstack MapInfo APIDavid Srbecky
Test: m debuggerd_test Change-Id: I63a2379bad3ace4755ae48bf0a83eaa0070f9077
2021-03-23Merge "libdebuggerd: store process uptime."Josh Gao
2021-03-19Merge "Support MTE and GWP-ASan features in proto tombstones."Peter Collingbourne
2021-03-19Merge "[GWP-ASan] Add debuggerd end-to-end tests and remove unique wording."Peter Collingbourne
2021-03-16debuggerd: remove unused file.Elliott Hughes
Test: treehugger Change-Id: I17f5f88e91be3dccbf01b93ca93b0879a997bb4d
2021-03-16Support MTE and GWP-ASan features in proto tombstones.Peter Collingbourne
Proto tombstones were missing tagged fault addresses, tagged_addr_ctrl, tags in memory dumps and Scudo and GWP-ASan error reports. Since text tombstones now go via protos, all of these features broke when we switched to text tombstones generated from protos by default. Fix the features by adding support for them to the proto format, tombstone_proto and tombstone_proto_to_text. Bug: 135772972 Bug: 182489365 Change-Id: I3ca854546c38755b1f6410a1f6198a44d25ed1c5
2021-03-11[GWP-ASan] Add debuggerd end-to-end tests and remove unique wording.Mitch Phillips
Looks like we unintentionally had a breakage after aosp/1595302, where both GWP-ASan and MTE tests started failing because the extra information wasn't plumbed through the tombstones. MTE has end-to-end tests but aren't run continuously, and GWP-ASan was missing the e2e tests. Also remove some unique wording for GWP-ASan, a UaF on the free'd pointer is now "0 bytes into a 16-byte allocation" instead of "on a 16-byte allocation". The former is more descriptive and is more ubiquitously used in our tooling. This patch adds the E2E tests, but the underlying problem needs to be fixed as well, before this patch can land. Bug: 182489365 Test: atest debuggerd_test Change-Id: I0fe8aba7ea443b3071724987f46b19a6525cda3c
2021-03-11Merge "Teach debuggerd to pass the secondary ring buffer to ↵Peter Collingbourne
__scudo_get_error_info()."
2021-03-06Merge "Untag addresses in registers before looking up the mapping."Treehugger Robot
2021-03-01libdebuggerd: store process uptime.Josh Gao
Application developers would like to know how long their process has been alive for to distinguish between crashes that happen immediately upon startup and crashes in regular operation. Test: manual Change-Id: Ia31eeadfcced358b478c7a7c7bb2e8a0252e30f4
2021-03-01libdebuggerd: delete unused code.Josh Gao
Test: none Change-Id: I87b62f306d287e9356c639f6d0c49566c71f7f29
2021-02-19Merge "Update for new kernel 5.11 headers."Christopher Ferris
2021-02-18Generate text tombstones from proto tombstones by default.Josh Gao
We're running into timeouts from death tests because we're ~doubling the cost of crash dumping by doing it twice. Bug: http://b/180605583 Test: treehugger Change-Id: If5b40434171323a09960b70af0124ec08bd3fbe8
2021-02-18Update for new kernel 5.11 headers.Christopher Ferris
Add new SYS_USER_DISPATCH to SIGSYS case. Test: Builds, unit tests pass. Change-Id: Id470053c167d7ffe51d622356c867815cd773fbc
2021-02-12Teach debuggerd to pass the secondary ring buffer to __scudo_get_error_info().Peter Collingbourne
With this change we can report memory errors involving secondary allocations. Update the existing crasher tests to also test UAF/overflow/underflow on allocations with sizes sufficient to trigger the secondary allocator. Bug: 135772972 Change-Id: Ic8925c1f18621a8f272e26d5630e5d11d6d34d38
2021-02-10[GWP-ASan] Update metadata field name.Mitch Phillips
Bug: N/A Test: Build succeeds. Change-Id: I889fbc6722695c9c738352c174c8817548a0faa1
2021-02-05Untag addresses in registers before looking up the mapping.Peter Collingbourne
Otherwise we can fail to find map entries for tagged addresses, such as those of heap objects. Bug: 135772972 Change-Id: Ia626b0587c8461eb575b2de5c08562c73ba4a66e
2021-01-27Remove use of libbase logging in libdebuggerd.Josh Gao
libbase logging uses getprogname() to get the default tag, which breaks for the fallback handler which is statically linked into the dynamic linker. Switch to libasync_safe for logging. Test: atest -c CtsSeccompHostTestCases:android.seccomp.cts.SeccompHostJUnit4DeviceTest#testAppZygoteSyscalls Change-Id: Ieeaf33fb26cff4ba7e1589d1d883ac2fcc74cf47
2021-01-26Reland protobuf tombstones.Josh Gao
This reverts the following commits: e156ede145a7fc671c705d045d89b49922a758b5. eda96eddcbdda9632166232b2363c7b84da0994d. 5ec54d1e843729cd1e38a2f791f001226a653e95. 1e45d3f2239333217d3252f78151f4294fda4e80. a50f61f8fa903117a6df82d164628de310f16ae9. Test: treehugger Test: atest -c CtsSeccompHostTestCases:android.seccomp.cts.SeccompHostJUnit4DeviceTest#testAppZygoteSyscalls Change-Id: Ic2b1f489ac9f1fec7d7a33c845c29891f4306bbd
2021-01-26Revert "libdebuggerd: add protobuf implementation."Jerome Gaillard
Revert "Let crash_dump read /proc/$PID." Revert submission 1556807-tombstone_proto Reason for revert: b/178455196, Broken test: android.seccomp.cts.SeccompHostJUnit4DeviceTest#testAppZygoteSyscalls on git_master on cf_x86_64_phone-userdebug Reverted Changes: Ide6811297:tombstoned: switch from goto to RAII. I8d285c4b4:tombstoned: make it easier to add more types of ou... Id0f0fa285:tombstoned: support for protobuf fds. I6be6082ab:Let crash_dump read /proc/$PID. Id812ca390:Make protobuf vendor_ramdisk_available. Ieeece6e6d:libdebuggerd: add protobuf implementation. Change-Id: Ia0a1ee57e7630e01c495dc166218f665340aad7f
2021-01-26Revert "Fix build breakage."Jerome Gaillard
This reverts commit 675cb30f05907f6c509815365c9af58a8671fe4e. Reason for revert: b/178455196, Broken test: android.seccomp.cts.SeccompHostJUnit4DeviceTest#testAppZygoteSyscalls on git_master on cf_x86_64_phone-userdebug Change-Id: I82d228f2bc3e6b426d4703732e1c8766815ccc97
2021-01-25Fix build breakage.Josh Gao
Test: mma Test: treehugger Change-Id: I2d08c9b6e7776e69ca1e7f0d83838830f3c9b15c
2021-01-25Merge changes from topic "tombstone_proto"Josh Gao
* changes: libdebuggerd: add protobuf implementation. tombstoned: support for protobuf fds. tombstoned: make it easier to add more types of outputs. tombstoned: switch from goto to RAII.
2021-01-21[MTE] Cleanup tagged si_addr refs to fix mappings OOB bug.Mitch Phillips
Currently, all MTE failures end up displaying 'Fault address falls at 0x<addr> after any mapped regions'. Clearly when scanning, we should use the untagged address to figure out which ranges it's in. I've taken the liberty of removing all si_addr parsing and moving it into the common ProcessInfo, as well as making it really explicit whether you want the (possibly tagged) original si_addr, or whether you want the untagged variant (for scanning /proc/maps or whatever). This is not particularly easily testable, as ReadCrashInfo isn't easily injectable and `dump_all_maps` should already be passed the untagged pointer to scan for. I've tested this locally on FVP under SYNC MTE with a simple UaF binary and noted the problem is fixed. Given that this is making the code more clear, I'm hoping the owners see no need for a regression test :). Bug: 135772972 Test: On FVP, run 'adb shell MEMTAG_OPTIONS=sync sanitizer-status' and check that the use-after-free test ends up with the /proc/maps desription in the right place. Change-Id: I220e4200c75a72474a95a67e5bbc36173a438dd2
2021-01-21libdebuggerd: add protobuf implementation.Josh Gao
This commit implements protobuf output for tombstones, along with a translator that should emit bytewise identical output to the existing tombstone dumping code, except for ancillary data from GWP-ASan and Scudo, which haven't been implemented yet. Test: setprop debug.debuggerd.translate.translate_proto_to_text 1 && /data/nativetest64/debuggerd_test/debuggerd_test Test: for TOMBSTONE in /data/tombstones/tombstone_??; do pbtombstone $TOMBSTONE.pb | diff $TOMBSTONE - done Change-Id: Ieeece6e6d1c26eb608b00ec24e2e725e161c8c92
2021-01-11Remove ANDROID_EXPERIMENTAL_MTE.Peter Collingbourne
Now that the feature guarded by this flag has landed in Linux 5.10 we no longer need the flag, so we can remove it. Bug: 135772972 Change-Id: I02fa50848cbd0486c23c8a229bb8f1ab5dd5a56f
2020-12-14Update for v5.10 kernel headers.Christopher Ferris
Test: Builds. Change-Id: I6c4b04751df026ef7cbb91627174188c5e6d137c
2020-11-24Adjust to MapInfo to new api.David Srbecky
Change-Id: Ic3818a8b001657e6b54ba6fcbf68f8c1d7ef2683
2020-11-13Switch to the new kernel API for obtaining fault address tag bits.Peter Collingbourne
The discussion on LKML is converging on v16 of the fault address tag bits patch [1]. In this version of the patch the presence of the tag bits in si_addr is controlled by a sa_flags bit, and a protocol is introduced to allow userspace to detect kernel support for sa_flags bits. Update the tombstone signal handler to use this API to read the tag bits, update the interceptors in libsigchain to implement the flag support detection protocol and hide the tag bits in si_addr from chained signal handlers that did not request them to match the kernel behavior. [1] https://lore.kernel.org/linux-arm-kernel/cover.1605235762.git.pcc@google.com/ Change-Id: I57f24c07c01ceb3e5b81cfc15edf559ef7dfc740
2020-09-24Add arch member into Unwinder object.Christopher Ferris
This simplifies some of the logic and removes the need to pass an Arch value to functions that should already know about the arch it is operating on. Includes fixes for debuggerd/libbacktrace. Added new unit tests to cover new cases. Test: All unit tests pass. Test: Faked unwinder failing to verify debuggerd error messages display Test: properly in backtrace and tombstone. Change-Id: I439fcae0695befcfb1cb4c0a786cc74949d33425
2020-09-15Dump the per-thread TAGGED_ADDR_CTRL value if available.Peter Collingbourne
This value indicates whether memory tagging is enabled on a thread, the mode (sync or async) and the set of excluded tags. This information can sometimes be important for understanding an MTE related crash, so include it in the per-thread tombstone output. Bug: 135772972 Change-Id: I25a16e10ac7fbb2b1ab2a961a5279f787039000b
2020-08-03libdebuggerd: do a to-do.Elliott Hughes
Until 77fdb22cf686002dfba8a24cf36666d7257b3034, logd started as AID_ROOT and then dropped its privileges. Since then, there's been no reason to use string comparisons rather than checking the uid. Test: pkill -SEGV logd Test: treehugger Change-Id: Ia709f8f59cb0ab9abac7df84c96c701b5d0a83ea
2020-07-31Update language to comply with Android's inclusive language guidanceJeff Sharkey
See https://source.android.com/setup/contribute/respectful-code for reference Bug: 161896447 Change-Id: Iafcccbdbdf3ff1078e87000e2ce560ff09b43f68
2020-07-24Merge "debuggerd: use One True timestamp function."Elliott Hughes
2020-07-23debuggerd: use One True timestamp function.Elliott Hughes
An OEM asks for sub-second granularity, and that's most easily done if we only have one timestamp generator. I'm not convinced sub-second granularity is particularly useful myself, and I definitely don't think that nanosecond resolution is meaningful but I do like this cleanup, and if I'm going to use sub-second precision I may as well use the maximum precision available to me. Also reduce some duplication of code reading cmdline/comm. Bug: https://issuetracker.google.com/161860597 Test: head /data/tombstones/* Change-Id: I035ecfd4a3338ccd84dae0ef973a998a7c7c5056
2020-07-21Include memory tags in memory dump output.Peter Collingbourne
Tags appear in the addresses printed in the memory dump, which seems like a reasonable place to put them because tagged addresses will also appear in other places in the tombstone, such as registers and the fault address. Bug: 135772972 Change-Id: I52da338347ff6b7503cf5ac80763c540695dc061
2020-07-21Adjust conditions for dumping the memory around a register.Peter Collingbourne
Previously, we would do a simple bounds check before deciding whether to dump the memory around a register. On 64-bit platforms, the register's value was required to be less than (4 << 60). However, after stripping tags on AArch64 as part of r.android.com/1365229, all pointer values became less than (4 << 60), so the check became useless for filtering out invalid pointers. As a result, we would attempt to dump memory for all registers, which for a register not containing a valid pointer would typically consist of 16 lines of dashes. One possible fix may be to replace the constant (4 << 60) with the process's actual address space limit (known as TASK_SIZE inside the kernel; typically 39 bits on AArch64 and 48 bits on x86_64), but the kernel provides no API for retrieving a process's TASK_SIZE value. We could guess it by looking at for example the highest bit set in the value of getauxval(AT_EXECFN), which points to an address on the stack which typically is mapped at the end of the address space on program startup, but at least on AArch64 it is possible to dynamically extend TASK_SIZE at runtime by providing a hint to mmap(), so this is not always sufficient. Instead, it seems best to remove most of the early bounds check, and simply issue ptrace() calls for each register value, bailing out of the entire output if none of the calls ended up succeeding. This also has the nice side effect of avoiding 16 lines of noise per register whose value looks like a pointer but actually points to unmapped memory. We still retain part of the bounds check in order to avoid integer overflow during the dump (including overflows into the tag part of the address on architectures that support tagging). Bug: 154272452 Change-Id: I94e4b7124b7735b92fd83a49c80ebded3483cd4e
2020-07-17Fix dumping of heap memory.Peter Collingbourne
After r.android.com/1288984 we started failing to dump memory contents for heap addresses because the tag started causing any addresses to fail this bounds check. Add an untag_address() call to the bounds check so that the tag is ignored. Bug: 154272452 Change-Id: I3a6d1a078b21871bd93164150a123549f83289f6
2020-04-27Add support for MTE error reports in tombstones.Peter Collingbourne
Teach debuggerd to use the new scudo APIs proposed in https://reviews.llvm.org/D77283 for extracing MTE error reports from crashed processes, and include those reports in tombstones if possible. Bug: 135772972 Change-Id: I082dfd0ac9d781cfed2b8c34cc73562614bb0dbb
2020-04-17Don't include log/log_read.h in log/log.hTom Cherry
log/log.h primarily concerns itself with writing logs. The few users who read logs should directly include log/log_read.h. Bug: 78370064 Test: build Change-Id: Ie95c55ea2ffc76fc95768323d445ada6ad4f2520
2020-03-30Merge "Read fault address on arm64 using proposed kernel API."Peter Collingbourne
2020-03-30Merge "Move crash_dump into the runtime APEX."Peter Collingbourne
2020-03-27Read fault address on arm64 using proposed kernel API.Peter Collingbourne
On aarch64, the top 8 bits of the address (i.e. the tag bits) of the fault address in si_addr are always clear. This isn't ideal for MTE which will require these bits in order to correctly diagnose tag mismatches. A proposed kernel patch [1] exposes the full fault address including the tag bits as part of the ucontext. Change debuggerd to read this fault address if available. [1] https://patchwork.kernel.org/patch/11435077/ Bug: 135772972 Change-Id: Ia05be574113860f4e9ecc36a310c4b740e0c4afb
generated by cgit v1.2.3 (git 2.25.1) at 2025-10-03 21:33:22 +0000