mirrors-yuzu-emu/breakpad
1
0
Fork 0
mirror of https://github.com/yuzu-emu/breakpad synced 2024-11-26 11:07:56 +00:00
Code Issues Projects Releases Packages Wiki Activity

Revert of Extend mapping merge to include reserved but unused mappings. (https://breakpad.appspot.com/7714003)

Browse source 
Reason for revert:
It is causing breakpad crash reports to be invalid (see the associated
bug).

Merging empty holes in r-x mappings was originally introduced in
https://breakpad.appspot.com/7714003 to deal with the first generation
of relro packing, which could introduce holes within a .so mapping:

  [libchrome.so]
  [guard region]
  [libchrome.so]

However, the logic is broken for the case of two *different* adjacent
.so mappings with a guard region in the middle:

  [libfoo.so]
  [guard region]
  [libchrome.so]

In this case the guard region is mistakenly associated with libfoo.so,
but that is not the right thing to do. In fact, the second generation of
rerlo packing added the guard region to prevent mmaps from overlapping
and to give room for the non-zero vaddr of relro-packed libraries, which
require an anticipated load bias.

As the first generation of relro packing is not used anymore, there is
no reason to keep this buggy code, which causes failures in decoding
crashes where an arbitrary library is mapped immediately before a rerlo
packed library.

Original issue's description:
> Extend mapping merge to include reserved but unused mappings.
>
> When parsing /proc/pid/maps, current code merges adjacent entries that
> refer to the same library and where the start of the second is equal to
> the end of the first, for example:
>
>   40022000-40025000 r-xp 00000000 b3:11 827        /system/lib/liblog.so
>   40025000-40026000 r--p 00002000 b3:11 827        /system/lib/liblog.so
>   40026000-40027000 rw-p 00003000 b3:11 827        /system/lib/liblog.so
>
> When the system linker loads a library it first reserves all the address
> space required, from the smallest start to the largest end address, using
> an anonymous mapping, and then maps loaded segments inside that reservation.
> If the loaded segments do not fully occupy the reservation this leaves
> gaps, and these gaps prevent merges that should occur from occurring:
>
>   40417000-4044a000 r-xp 00000000 b3:11 820        /system/lib/libjpeg.so
> > 4044a000-4044b000 ---p 00000000 00:00 0
>   4044b000-4044c000 r--p 00033000 b3:11 820        /system/lib/libjpeg.so
>   4044c000-4044d000 rw-p 00034000 b3:11 820        /system/lib/libjpeg.so
>
> Where the segments that follow this gap do not contain executable code
> the failure to merge does not affect breakpad operation.  However, where
> they do then the merge needs to occur.  Packing relocations in a large
> library splits the executable segment into two, resulting in:
>
>   73b0c000-73b21000 r-xp 00000000 b3:19 786460
> /data/.../libchrome.2160.0.so
> > 73b21000-73d12000 ---p 00000000 00:00 0
>   73d12000-75a90000 r-xp 00014000 b3:19 786460
> /data/.../libchrome.2160.0.so
>   75a90000-75c0d000 rw-p 01d91000 b3:19 786460
> /data/.../libchrome.2160.0.so
>
> Here the mapping at 73d12000-75a90000 must be merged into 73b0c000-73b21000
> so that breakpad correctly calculates the base address for text.
>
> This change enables the full merge by also merging anonymous maps which
> result from unused reservation, identified as '---p' with offset 0, and
> which follow on from an executable mapping, into that executable mapping.
>
> BUG=chromium:394703

BUG=chromium:499747
R=primiano@chromium.org, rmcilroy@chromium.org

Review URL: https://codereview.chromium.org/1923383002 .
This commit is contained in:
Primiano Tucci 2016-04-28 16:49:44 +01:00
parent 8762c82297
commit 17ad0c18b1
1 changed files with 0 additions and 18 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

18
src/client/linux/minidump_writer/linux_dumper.cc
View file

@ -70,7 +70,6 @@ static const int DT_ANDROID_RELA = DT_LOOS + 4;
static const char kMappedFileUnsafePrefix[] = "/dev/";
static const char kDeletedSuffix[] = " (deleted)";
static const char kReservedFlags[] = " ---p";
inline static bool IsMappedFileOpenUnsafe(
const google_breakpad::MappingInfo& mapping) {
@ -357,23 +356,6 @@ bool LinuxDumper::EnumerateMappings() {
continue;
}
}
// Also merge mappings that result from address ranges that the
// linker reserved but which a loaded library did not use. These
// appear as an anonymous private mapping with no access flags set
// and which directly follow an executable mapping.
if (!name && !mappings_.empty()) {
MappingInfo* module = mappings_.back();
if ((start_addr == module->start_addr + module->size) &&
module->exec &&
module->name[0] == '/' &&
offset == 0 && my_strncmp(i2,
kReservedFlags,
sizeof(kReservedFlags) - 1) == 0) {
module->size = end_addr - module->start_addr;
line_reader->PopLine(line_len);
continue;
}
}
MappingInfo* const module = new(allocator_) MappingInfo;
my_memset(module, 0, sizeof(MappingInfo));
module->start_addr = start_addr;