base/memory/shared_memory_posix.cc

   1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include "base/memory/shared_memory.h"
   6
   7 #include <errno.h>
   8 #include <fcntl.h>
   9 #include <sys/mman.h>
  10 #include <sys/stat.h>
  11 #include <sys/types.h>
  12 #include <unistd.h>
  13
  14 #include "base/files/file_util.h"
  15 #include "base/files/scoped_file.h"
  16 #include "base/lazy_instance.h"
  17 #include "base/logging.h"
  18 #include "base/process/process_metrics.h"
  19 #include "base/safe_strerror_posix.h"
  20 #include "base/strings/utf_string_conversions.h"
  21 #include "base/synchronization/lock.h"
  22 #include "base/threading/platform_thread.h"
  23 #include "base/threading/thread_restrictions.h"
  24
  25 #if defined(OS_MACOSX)
  26 #include "base/mac/foundation_util.h"
  27 #endif  // OS_MACOSX
  28
  29 #if defined(OS_ANDROID)
  30 #include "base/os_compat_android.h"
  31 #include "third_party/ashmem/ashmem.h"
  32 #endif
  33
  34 namespace base {
  35
  36 namespace {
  37
  38 LazyInstance<Lock>::Leaky g_thread_lock_ = LAZY_INSTANCE_INITIALIZER;
  39
  40 }
  41
  42 SharedMemory::SharedMemory()
  43     : mapped_file_(-1),
  44       readonly_mapped_file_(-1),
  45       inode_(0),
  46       mapped_size_(0),
  47       memory_(NULL),
  48       read_only_(false),
  49       requested_size_(0) {
  50 }
  51
  52 SharedMemory::SharedMemory(SharedMemoryHandle handle, bool read_only)
  53     : mapped_file_(handle.fd),
  54       readonly_mapped_file_(-1),
  55       inode_(0),
  56       mapped_size_(0),
  57       memory_(NULL),
  58       read_only_(read_only),
  59       requested_size_(0) {
  60   struct stat st;
  61   if (fstat(handle.fd, &st) == 0) {
  62     // If fstat fails, then the file descriptor is invalid and we'll learn this
  63     // fact when Map() fails.
  64     inode_ = st.st_ino;
  65   }
  66 }
  67
  68 SharedMemory::SharedMemory(SharedMemoryHandle handle, bool read_only,
  69                            ProcessHandle process)
  70     : mapped_file_(handle.fd),
  71       readonly_mapped_file_(-1),
  72       inode_(0),
  73       mapped_size_(0),
  74       memory_(NULL),
  75       read_only_(read_only),
  76       requested_size_(0) {
  77   // We don't handle this case yet (note the ignored parameter); let's die if
  78   // someone comes calling.
  79   NOTREACHED();
  80 }
  81
  82 SharedMemory::~SharedMemory() {
  83   Unmap();
  84   Close();
  85 }
  86
  87 // static
  88 bool SharedMemory::IsHandleValid(const SharedMemoryHandle& handle) {
  89   return handle.fd >= 0;
  90 }
  91
  92 // static
  93 SharedMemoryHandle SharedMemory::NULLHandle() {
  94   return SharedMemoryHandle();
  95 }
  96
  97 // static
  98 void SharedMemory::CloseHandle(const SharedMemoryHandle& handle) {
  99   DCHECK_GE(handle.fd, 0);
 100   if (close(handle.fd) < 0)
 101     DPLOG(ERROR) << "close";
 102 }
 103
 104 // static
 105 size_t SharedMemory::GetHandleLimit() {
 106   return base::GetMaxFds();
 107 }
 108
 109 bool SharedMemory::CreateAndMapAnonymous(size_t size) {
 110   return CreateAnonymous(size) && Map(size);
 111 }
 112
 113 #if !defined(OS_ANDROID)
 114 // Chromium mostly only uses the unique/private shmem as specified by
 115 // "name == L"". The exception is in the StatsTable.
 116 // TODO(jrg): there is no way to "clean up" all unused named shmem if
 117 // we restart from a crash.  (That isn't a new problem, but it is a problem.)
 118 // In case we want to delete it later, it may be useful to save the value
 119 // of mem_filename after FilePathForMemoryName().
 120 bool SharedMemory::Create(const SharedMemoryCreateOptions& options) {
 121   DCHECK_EQ(-1, mapped_file_);
 122   if (options.size == 0) return false;
 123
 124   if (options.size > static_cast<size_t>(std::numeric_limits<int>::max()))
 125     return false;
 126
 127   // This function theoretically can block on the disk, but realistically
 128   // the temporary files we create will just go into the buffer cache
 129   // and be deleted before they ever make it out to disk.
 130   base::ThreadRestrictions::ScopedAllowIO allow_io;
 131
 132   ScopedFILE fp;
 133   bool fix_size = true;
 134   ScopedFD readonly_fd;
 135
 136   FilePath path;
 137   if (options.name_deprecated == NULL || options.name_deprecated->empty()) {
 138     // It doesn't make sense to have a open-existing private piece of shmem
 139     DCHECK(!options.open_existing_deprecated);
 140     // Q: Why not use the shm_open() etc. APIs?
 141     // A: Because they're limited to 4mb on OS X.  FFFFFFFUUUUUUUUUUU
 142     FilePath directory;
 143     if (GetShmemTempDir(options.executable, &directory))
 144       fp.reset(CreateAndOpenTemporaryFileInDir(directory, &path));
 145
 146     if (fp) {
 147       if (options.share_read_only) {
 148         // Also open as readonly so that we can ShareReadOnlyToProcess.
 149         readonly_fd.reset(HANDLE_EINTR(open(path.value().c_str(), O_RDONLY)));
 150         if (!readonly_fd.is_valid()) {
 151           DPLOG(ERROR) << "open(\"" << path.value() << "\", O_RDONLY) failed";
 152           fp.reset();
 153           return false;
 154         }
 155       }
 156       // Deleting the file prevents anyone else from mapping it in (making it
 157       // private), and prevents the need for cleanup (once the last fd is
 158       // closed, it is truly freed).
 159       if (unlink(path.value().c_str()))
 160         PLOG(WARNING) << "unlink";
 161     }
 162   } else {
 163     if (!FilePathForMemoryName(*options.name_deprecated, &path))
 164       return false;
 165
 166     // Make sure that the file is opened without any permission
 167     // to other users on the system.
 168     const mode_t kOwnerOnly = S_IRUSR | S_IWUSR;
 169
 170     // First, try to create the file.
 171     int fd = HANDLE_EINTR(
 172         open(path.value().c_str(), O_RDWR | O_CREAT | O_EXCL, kOwnerOnly));
 173     if (fd == -1 && options.open_existing_deprecated) {
 174       // If this doesn't work, try and open an existing file in append mode.
 175       // Opening an existing file in a world writable directory has two main
 176       // security implications:
 177       // - Attackers could plant a file under their control, so ownership of
 178       //   the file is checked below.
 179       // - Attackers could plant a symbolic link so that an unexpected file
 180       //   is opened, so O_NOFOLLOW is passed to open().
 181       fd = HANDLE_EINTR(
 182           open(path.value().c_str(), O_RDWR | O_APPEND | O_NOFOLLOW));
 183
 184       // Check that the current user owns the file.
 185       // If uid != euid, then a more complex permission model is used and this
 186       // API is not appropriate.
 187       const uid_t real_uid = getuid();
 188       const uid_t effective_uid = geteuid();
 189       struct stat sb;
 190       if (fd >= 0 &&
 191           (fstat(fd, &sb) != 0 || sb.st_uid != real_uid ||
 192            sb.st_uid != effective_uid)) {
 193         LOG(ERROR) <<
 194             "Invalid owner when opening existing shared memory file.";
 195         close(fd);
 196         return false;
 197       }
 198
 199       // An existing file was opened, so its size should not be fixed.
 200       fix_size = false;
 201     }
 202
 203     if (options.share_read_only) {
 204       // Also open as readonly so that we can ShareReadOnlyToProcess.
 205       readonly_fd.reset(HANDLE_EINTR(open(path.value().c_str(), O_RDONLY)));
 206       if (!readonly_fd.is_valid()) {
 207         DPLOG(ERROR) << "open(\"" << path.value() << "\", O_RDONLY) failed";
 208         close(fd);
 209         fd = -1;
 210         return false;
 211       }
 212     }
 213     if (fd >= 0) {
 214       // "a+" is always appropriate: if it's a new file, a+ is similar to w+.
 215       fp.reset(fdopen(fd, "a+"));
 216     }
 217   }
 218   if (fp && fix_size) {
 219     // Get current size.
 220     struct stat stat;
 221     if (fstat(fileno(fp.get()), &stat) != 0)
 222       return false;
 223     const size_t current_size = stat.st_size;
 224     if (current_size != options.size) {
 225       if (HANDLE_EINTR(ftruncate(fileno(fp.get()), options.size)) != 0)
 226         return false;
 227     }
 228     requested_size_ = options.size;
 229   }
 230   if (fp == NULL) {
 231 #if !defined(OS_MACOSX)
 232     PLOG(ERROR) << "Creating shared memory in " << path.value() << " failed";
 233     FilePath dir = path.DirName();
 234     if (access(dir.value().c_str(), W_OK | X_OK) < 0) {
 235       PLOG(ERROR) << "Unable to access(W_OK|X_OK) " << dir.value();
 236       if (dir.value() == "/dev/shm") {
 237         LOG(FATAL) << "This is frequently caused by incorrect permissions on "
 238                    << "/dev/shm.  Try 'sudo chmod 1777 /dev/shm' to fix.";
 239       }
 240     }
 241 #else
 242     PLOG(ERROR) << "Creating shared memory in " << path.value() << " failed";
 243 #endif
 244     return false;
 245   }
 246
 247   return PrepareMapFile(fp.Pass(), readonly_fd.Pass());
 248 }
 249
 250 // Our current implementation of shmem is with mmap()ing of files.
 251 // These files need to be deleted explicitly.
 252 // In practice this call is only needed for unit tests.
 253 bool SharedMemory::Delete(const std::string& name) {
 254   FilePath path;
 255   if (!FilePathForMemoryName(name, &path))
 256     return false;
 257
 258   if (PathExists(path))
 259     return base::DeleteFile(path, false);
 260
 261   // Doesn't exist, so success.
 262   return true;
 263 }
 264
 265 bool SharedMemory::Open(const std::string& name, bool read_only) {
 266   FilePath path;
 267   if (!FilePathForMemoryName(name, &path))
 268     return false;
 269
 270   read_only_ = read_only;
 271
 272   const char *mode = read_only ? "r" : "r+";
 273   ScopedFILE fp(base::OpenFile(path, mode));
 274   ScopedFD readonly_fd(HANDLE_EINTR(open(path.value().c_str(), O_RDONLY)));
 275   if (!readonly_fd.is_valid()) {
 276     DPLOG(ERROR) << "open(\"" << path.value() << "\", O_RDONLY) failed";
 277     return false;
 278   }
 279   return PrepareMapFile(fp.Pass(), readonly_fd.Pass());
 280 }
 281 #endif  // !defined(OS_ANDROID)
 282
 283 bool SharedMemory::MapAt(off_t offset, size_t bytes) {
 284   if (mapped_file_ == -1)
 285     return false;
 286
 287   if (bytes > static_cast<size_t>(std::numeric_limits<int>::max()))
 288     return false;
 289
 290   if (memory_)
 291     return false;
 292
 293 #if defined(OS_ANDROID)
 294   // On Android, Map can be called with a size and offset of zero to use the
 295   // ashmem-determined size.
 296   if (bytes == 0) {
 297     DCHECK_EQ(0, offset);
 298     int ashmem_bytes = ashmem_get_size_region(mapped_file_);
 299     if (ashmem_bytes < 0)
 300       return false;
 301     bytes = ashmem_bytes;
 302   }
 303 #endif
 304
 305   memory_ = mmap(NULL, bytes, PROT_READ | (read_only_ ? 0 : PROT_WRITE),
 306                  MAP_SHARED, mapped_file_, offset);
 307
 308   bool mmap_succeeded = memory_ != (void*)-1 && memory_ != NULL;
 309   if (mmap_succeeded) {
 310     mapped_size_ = bytes;
 311     DCHECK_EQ(0U, reinterpret_cast<uintptr_t>(memory_) &
 312         (SharedMemory::MAP_MINIMUM_ALIGNMENT - 1));
 313   } else {
 314     memory_ = NULL;
 315   }
 316
 317   return mmap_succeeded;
 318 }
 319
 320 bool SharedMemory::Unmap() {
 321   if (memory_ == NULL)
 322     return false;
 323
 324   munmap(memory_, mapped_size_);
 325   memory_ = NULL;
 326   mapped_size_ = 0;
 327   return true;
 328 }
 329
 330 SharedMemoryHandle SharedMemory::handle() const {
 331   return FileDescriptor(mapped_file_, false);
 332 }
 333
 334 void SharedMemory::Close() {
 335   if (mapped_file_ > 0) {
 336     if (close(mapped_file_) < 0)
 337       PLOG(ERROR) << "close";
 338     mapped_file_ = -1;
 339   }
 340   if (readonly_mapped_file_ > 0) {
 341     if (close(readonly_mapped_file_) < 0)
 342       PLOG(ERROR) << "close";
 343     readonly_mapped_file_ = -1;
 344   }
 345 }
 346
 347 void SharedMemory::LockDeprecated() {
 348   g_thread_lock_.Get().Acquire();
 349   LockOrUnlockCommon(F_LOCK);
 350 }
 351
 352 void SharedMemory::UnlockDeprecated() {
 353   LockOrUnlockCommon(F_ULOCK);
 354   g_thread_lock_.Get().Release();
 355 }
 356
 357 #if !defined(OS_ANDROID)
 358 bool SharedMemory::PrepareMapFile(ScopedFILE fp, ScopedFD readonly_fd) {
 359   DCHECK_EQ(-1, mapped_file_);
 360   DCHECK_EQ(-1, readonly_mapped_file_);
 361   if (fp == NULL)
 362     return false;
 363
 364   // This function theoretically can block on the disk, but realistically
 365   // the temporary files we create will just go into the buffer cache
 366   // and be deleted before they ever make it out to disk.
 367   base::ThreadRestrictions::ScopedAllowIO allow_io;
 368
 369   struct stat st = {};
 370   if (fstat(fileno(fp.get()), &st))
 371     NOTREACHED();
 372   if (readonly_fd.is_valid()) {
 373     struct stat readonly_st = {};
 374     if (fstat(readonly_fd.get(), &readonly_st))
 375       NOTREACHED();
 376     if (st.st_dev != readonly_st.st_dev || st.st_ino != readonly_st.st_ino) {
 377       LOG(ERROR) << "writable and read-only inodes don't match; bailing";
 378       return false;
 379     }
 380   }
 381
 382   mapped_file_ = dup(fileno(fp.get()));
 383   if (mapped_file_ == -1) {
 384     if (errno == EMFILE) {
 385       LOG(WARNING) << "Shared memory creation failed; out of file descriptors";
 386       return false;
 387     } else {
 388       NOTREACHED() << "Call to dup failed, errno=" << errno;
 389     }
 390   }
 391   inode_ = st.st_ino;
 392   readonly_mapped_file_ = readonly_fd.release();
 393
 394   return true;
 395 }
 396
 397 // For the given shmem named |mem_name|, return a filename to mmap()
 398 // (and possibly create).  Modifies |filename|.  Return false on
 399 // error, or true of we are happy.
 400 bool SharedMemory::FilePathForMemoryName(const std::string& mem_name,
 401                                          FilePath* path) {
 402   // mem_name will be used for a filename; make sure it doesn't
 403   // contain anything which will confuse us.
 404   DCHECK_EQ(std::string::npos, mem_name.find('/'));
 405   DCHECK_EQ(std::string::npos, mem_name.find('\0'));
 406
 407   FilePath temp_dir;
 408   if (!GetShmemTempDir(false, &temp_dir))
 409     return false;
 410
 411 #if !defined(OS_MACOSX)
 412 #if defined(GOOGLE_CHROME_BUILD)
 413   std::string name_base = std::string("com.google.Chrome");
 414 #else
 415   std::string name_base = std::string("org.chromium.Chromium");
 416 #endif
 417 #else  // OS_MACOSX
 418   std::string name_base = std::string(base::mac::BaseBundleID());
 419 #endif  // OS_MACOSX
 420   *path = temp_dir.AppendASCII(name_base + ".shmem." + mem_name);
 421   return true;
 422 }
 423 #endif  // !defined(OS_ANDROID)
 424
 425 void SharedMemory::LockOrUnlockCommon(int function) {
 426   DCHECK_GE(mapped_file_, 0);
 427   while (lockf(mapped_file_, function, 0) < 0) {
 428     if (errno == EINTR) {
 429       continue;
 430     } else if (errno == ENOLCK) {
 431       // temporary kernel resource exaustion
 432       base::PlatformThread::Sleep(base::TimeDelta::FromMilliseconds(500));
 433       continue;
 434     } else {
 435       NOTREACHED() << "lockf() failed."
 436                    << " function:" << function
 437                    << " fd:" << mapped_file_
 438                    << " errno:" << errno
 439                    << " msg:" << safe_strerror(errno);
 440     }
 441   }
 442 }
 443
 444 bool SharedMemory::ShareToProcessCommon(ProcessHandle process,
 445                                         SharedMemoryHandle* new_handle,
 446                                         bool close_self,
 447                                         ShareMode share_mode) {
 448   int handle_to_dup = -1;
 449   switch(share_mode) {
 450     case SHARE_CURRENT_MODE:
 451       handle_to_dup = mapped_file_;
 452       break;
 453     case SHARE_READONLY:
 454       // We could imagine re-opening the file from /dev/fd, but that can't make
 455       // it readonly on Mac: https://codereview.chromium.org/27265002/#msg10
 456       CHECK(readonly_mapped_file_ >= 0);
 457       handle_to_dup = readonly_mapped_file_;
 458       break;
 459   }
 460
 461   const int new_fd = dup(handle_to_dup);
 462   if (new_fd < 0) {
 463     DPLOG(ERROR) << "dup() failed.";
 464     return false;
 465   }
 466
 467   new_handle->fd = new_fd;
 468   new_handle->auto_close = true;
 469
 470   if (close_self) {
 471     Unmap();
 472     Close();
 473   }
 474
 475   return true;
 476 }
 477
 478 }  // namespace base