Added llvm into exceptions as we can't add README.chromium into 3rd party repository
[chromium-blink-merge.git] / base / memory / shared_memory_posix.cc
blobfd26ad19ffbe1e3268d9b4165dd3591b4b0f6042
1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file.
5 #include "base/memory/shared_memory.h"
7 #include <errno.h>
8 #include <fcntl.h>
9 #include <sys/mman.h>
10 #include <sys/stat.h>
11 #include <sys/types.h>
12 #include <unistd.h>
14 #include "base/files/file_util.h"
15 #include "base/files/scoped_file.h"
16 #include "base/lazy_instance.h"
17 #include "base/logging.h"
18 #include "base/process/process_metrics.h"
19 #include "base/safe_strerror_posix.h"
20 #include "base/strings/utf_string_conversions.h"
21 #include "base/synchronization/lock.h"
22 #include "base/threading/platform_thread.h"
23 #include "base/threading/thread_restrictions.h"
25 #if defined(OS_MACOSX)
26 #include "base/mac/foundation_util.h"
27 #endif // OS_MACOSX
29 #if defined(OS_ANDROID)
30 #include "base/os_compat_android.h"
31 #include "third_party/ashmem/ashmem.h"
32 #endif
34 namespace base {
36 namespace {
38 LazyInstance<Lock>::Leaky g_thread_lock_ = LAZY_INSTANCE_INITIALIZER;
42 SharedMemory::SharedMemory()
43 : mapped_file_(-1),
44 readonly_mapped_file_(-1),
45 inode_(0),
46 mapped_size_(0),
47 memory_(NULL),
48 read_only_(false),
49 requested_size_(0) {
52 SharedMemory::SharedMemory(SharedMemoryHandle handle, bool read_only)
53 : mapped_file_(handle.fd),
54 readonly_mapped_file_(-1),
55 inode_(0),
56 mapped_size_(0),
57 memory_(NULL),
58 read_only_(read_only),
59 requested_size_(0) {
60 struct stat st;
61 if (fstat(handle.fd, &st) == 0) {
62 // If fstat fails, then the file descriptor is invalid and we'll learn this
63 // fact when Map() fails.
64 inode_ = st.st_ino;
68 SharedMemory::SharedMemory(SharedMemoryHandle handle, bool read_only,
69 ProcessHandle process)
70 : mapped_file_(handle.fd),
71 readonly_mapped_file_(-1),
72 inode_(0),
73 mapped_size_(0),
74 memory_(NULL),
75 read_only_(read_only),
76 requested_size_(0) {
77 // We don't handle this case yet (note the ignored parameter); let's die if
78 // someone comes calling.
79 NOTREACHED();
82 SharedMemory::~SharedMemory() {
83 Unmap();
84 Close();
87 // static
88 bool SharedMemory::IsHandleValid(const SharedMemoryHandle& handle) {
89 return handle.fd >= 0;
92 // static
93 SharedMemoryHandle SharedMemory::NULLHandle() {
94 return SharedMemoryHandle();
97 // static
98 void SharedMemory::CloseHandle(const SharedMemoryHandle& handle) {
99 DCHECK_GE(handle.fd, 0);
100 if (close(handle.fd) < 0)
101 DPLOG(ERROR) << "close";
104 // static
105 size_t SharedMemory::GetHandleLimit() {
106 return base::GetMaxFds();
109 bool SharedMemory::CreateAndMapAnonymous(size_t size) {
110 return CreateAnonymous(size) && Map(size);
113 #if !defined(OS_ANDROID)
114 // Chromium mostly only uses the unique/private shmem as specified by
115 // "name == L"". The exception is in the StatsTable.
116 // TODO(jrg): there is no way to "clean up" all unused named shmem if
117 // we restart from a crash. (That isn't a new problem, but it is a problem.)
118 // In case we want to delete it later, it may be useful to save the value
119 // of mem_filename after FilePathForMemoryName().
120 bool SharedMemory::Create(const SharedMemoryCreateOptions& options) {
121 DCHECK_EQ(-1, mapped_file_);
122 if (options.size == 0) return false;
124 if (options.size > static_cast<size_t>(std::numeric_limits<int>::max()))
125 return false;
127 // This function theoretically can block on the disk, but realistically
128 // the temporary files we create will just go into the buffer cache
129 // and be deleted before they ever make it out to disk.
130 base::ThreadRestrictions::ScopedAllowIO allow_io;
132 ScopedFILE fp;
133 bool fix_size = true;
134 ScopedFD readonly_fd;
136 FilePath path;
137 if (options.name_deprecated == NULL || options.name_deprecated->empty()) {
138 // It doesn't make sense to have a open-existing private piece of shmem
139 DCHECK(!options.open_existing_deprecated);
140 // Q: Why not use the shm_open() etc. APIs?
141 // A: Because they're limited to 4mb on OS X. FFFFFFFUUUUUUUUUUU
142 FilePath directory;
143 if (GetShmemTempDir(options.executable, &directory))
144 fp.reset(CreateAndOpenTemporaryFileInDir(directory, &path));
146 if (fp) {
147 if (options.share_read_only) {
148 // Also open as readonly so that we can ShareReadOnlyToProcess.
149 readonly_fd.reset(HANDLE_EINTR(open(path.value().c_str(), O_RDONLY)));
150 if (!readonly_fd.is_valid()) {
151 DPLOG(ERROR) << "open(\"" << path.value() << "\", O_RDONLY) failed";
152 fp.reset();
153 return false;
156 // Deleting the file prevents anyone else from mapping it in (making it
157 // private), and prevents the need for cleanup (once the last fd is
158 // closed, it is truly freed).
159 if (unlink(path.value().c_str()))
160 PLOG(WARNING) << "unlink";
162 } else {
163 if (!FilePathForMemoryName(*options.name_deprecated, &path))
164 return false;
166 // Make sure that the file is opened without any permission
167 // to other users on the system.
168 const mode_t kOwnerOnly = S_IRUSR | S_IWUSR;
170 // First, try to create the file.
171 int fd = HANDLE_EINTR(
172 open(path.value().c_str(), O_RDWR | O_CREAT | O_EXCL, kOwnerOnly));
173 if (fd == -1 && options.open_existing_deprecated) {
174 // If this doesn't work, try and open an existing file in append mode.
175 // Opening an existing file in a world writable directory has two main
176 // security implications:
177 // - Attackers could plant a file under their control, so ownership of
178 // the file is checked below.
179 // - Attackers could plant a symbolic link so that an unexpected file
180 // is opened, so O_NOFOLLOW is passed to open().
181 fd = HANDLE_EINTR(
182 open(path.value().c_str(), O_RDWR | O_APPEND | O_NOFOLLOW));
184 // Check that the current user owns the file.
185 // If uid != euid, then a more complex permission model is used and this
186 // API is not appropriate.
187 const uid_t real_uid = getuid();
188 const uid_t effective_uid = geteuid();
189 struct stat sb;
190 if (fd >= 0 &&
191 (fstat(fd, &sb) != 0 || sb.st_uid != real_uid ||
192 sb.st_uid != effective_uid)) {
193 LOG(ERROR) <<
194 "Invalid owner when opening existing shared memory file.";
195 close(fd);
196 return false;
199 // An existing file was opened, so its size should not be fixed.
200 fix_size = false;
203 if (options.share_read_only) {
204 // Also open as readonly so that we can ShareReadOnlyToProcess.
205 readonly_fd.reset(HANDLE_EINTR(open(path.value().c_str(), O_RDONLY)));
206 if (!readonly_fd.is_valid()) {
207 DPLOG(ERROR) << "open(\"" << path.value() << "\", O_RDONLY) failed";
208 close(fd);
209 fd = -1;
210 return false;
213 if (fd >= 0) {
214 // "a+" is always appropriate: if it's a new file, a+ is similar to w+.
215 fp.reset(fdopen(fd, "a+"));
218 if (fp && fix_size) {
219 // Get current size.
220 struct stat stat;
221 if (fstat(fileno(fp.get()), &stat) != 0)
222 return false;
223 const size_t current_size = stat.st_size;
224 if (current_size != options.size) {
225 if (HANDLE_EINTR(ftruncate(fileno(fp.get()), options.size)) != 0)
226 return false;
228 requested_size_ = options.size;
230 if (fp == NULL) {
231 #if !defined(OS_MACOSX)
232 PLOG(ERROR) << "Creating shared memory in " << path.value() << " failed";
233 FilePath dir = path.DirName();
234 if (access(dir.value().c_str(), W_OK | X_OK) < 0) {
235 PLOG(ERROR) << "Unable to access(W_OK|X_OK) " << dir.value();
236 if (dir.value() == "/dev/shm") {
237 LOG(FATAL) << "This is frequently caused by incorrect permissions on "
238 << "/dev/shm. Try 'sudo chmod 1777 /dev/shm' to fix.";
241 #else
242 PLOG(ERROR) << "Creating shared memory in " << path.value() << " failed";
243 #endif
244 return false;
247 return PrepareMapFile(fp.Pass(), readonly_fd.Pass());
250 // Our current implementation of shmem is with mmap()ing of files.
251 // These files need to be deleted explicitly.
252 // In practice this call is only needed for unit tests.
253 bool SharedMemory::Delete(const std::string& name) {
254 FilePath path;
255 if (!FilePathForMemoryName(name, &path))
256 return false;
258 if (PathExists(path))
259 return base::DeleteFile(path, false);
261 // Doesn't exist, so success.
262 return true;
265 bool SharedMemory::Open(const std::string& name, bool read_only) {
266 FilePath path;
267 if (!FilePathForMemoryName(name, &path))
268 return false;
270 read_only_ = read_only;
272 const char *mode = read_only ? "r" : "r+";
273 ScopedFILE fp(base::OpenFile(path, mode));
274 ScopedFD readonly_fd(HANDLE_EINTR(open(path.value().c_str(), O_RDONLY)));
275 if (!readonly_fd.is_valid()) {
276 DPLOG(ERROR) << "open(\"" << path.value() << "\", O_RDONLY) failed";
277 return false;
279 return PrepareMapFile(fp.Pass(), readonly_fd.Pass());
281 #endif // !defined(OS_ANDROID)
283 bool SharedMemory::MapAt(off_t offset, size_t bytes) {
284 if (mapped_file_ == -1)
285 return false;
287 if (bytes > static_cast<size_t>(std::numeric_limits<int>::max()))
288 return false;
290 if (memory_)
291 return false;
293 #if defined(OS_ANDROID)
294 // On Android, Map can be called with a size and offset of zero to use the
295 // ashmem-determined size.
296 if (bytes == 0) {
297 DCHECK_EQ(0, offset);
298 int ashmem_bytes = ashmem_get_size_region(mapped_file_);
299 if (ashmem_bytes < 0)
300 return false;
301 bytes = ashmem_bytes;
303 #endif
305 memory_ = mmap(NULL, bytes, PROT_READ | (read_only_ ? 0 : PROT_WRITE),
306 MAP_SHARED, mapped_file_, offset);
308 bool mmap_succeeded = memory_ != (void*)-1 && memory_ != NULL;
309 if (mmap_succeeded) {
310 mapped_size_ = bytes;
311 DCHECK_EQ(0U, reinterpret_cast<uintptr_t>(memory_) &
312 (SharedMemory::MAP_MINIMUM_ALIGNMENT - 1));
313 } else {
314 memory_ = NULL;
317 return mmap_succeeded;
320 bool SharedMemory::Unmap() {
321 if (memory_ == NULL)
322 return false;
324 munmap(memory_, mapped_size_);
325 memory_ = NULL;
326 mapped_size_ = 0;
327 return true;
330 SharedMemoryHandle SharedMemory::handle() const {
331 return FileDescriptor(mapped_file_, false);
334 void SharedMemory::Close() {
335 if (mapped_file_ > 0) {
336 if (close(mapped_file_) < 0)
337 PLOG(ERROR) << "close";
338 mapped_file_ = -1;
340 if (readonly_mapped_file_ > 0) {
341 if (close(readonly_mapped_file_) < 0)
342 PLOG(ERROR) << "close";
343 readonly_mapped_file_ = -1;
347 void SharedMemory::LockDeprecated() {
348 g_thread_lock_.Get().Acquire();
349 LockOrUnlockCommon(F_LOCK);
352 void SharedMemory::UnlockDeprecated() {
353 LockOrUnlockCommon(F_ULOCK);
354 g_thread_lock_.Get().Release();
357 #if !defined(OS_ANDROID)
358 bool SharedMemory::PrepareMapFile(ScopedFILE fp, ScopedFD readonly_fd) {
359 DCHECK_EQ(-1, mapped_file_);
360 DCHECK_EQ(-1, readonly_mapped_file_);
361 if (fp == NULL)
362 return false;
364 // This function theoretically can block on the disk, but realistically
365 // the temporary files we create will just go into the buffer cache
366 // and be deleted before they ever make it out to disk.
367 base::ThreadRestrictions::ScopedAllowIO allow_io;
369 struct stat st = {};
370 if (fstat(fileno(fp.get()), &st))
371 NOTREACHED();
372 if (readonly_fd.is_valid()) {
373 struct stat readonly_st = {};
374 if (fstat(readonly_fd.get(), &readonly_st))
375 NOTREACHED();
376 if (st.st_dev != readonly_st.st_dev || st.st_ino != readonly_st.st_ino) {
377 LOG(ERROR) << "writable and read-only inodes don't match; bailing";
378 return false;
382 mapped_file_ = dup(fileno(fp.get()));
383 if (mapped_file_ == -1) {
384 if (errno == EMFILE) {
385 LOG(WARNING) << "Shared memory creation failed; out of file descriptors";
386 return false;
387 } else {
388 NOTREACHED() << "Call to dup failed, errno=" << errno;
391 inode_ = st.st_ino;
392 readonly_mapped_file_ = readonly_fd.release();
394 return true;
397 // For the given shmem named |mem_name|, return a filename to mmap()
398 // (and possibly create). Modifies |filename|. Return false on
399 // error, or true of we are happy.
400 bool SharedMemory::FilePathForMemoryName(const std::string& mem_name,
401 FilePath* path) {
402 // mem_name will be used for a filename; make sure it doesn't
403 // contain anything which will confuse us.
404 DCHECK_EQ(std::string::npos, mem_name.find('/'));
405 DCHECK_EQ(std::string::npos, mem_name.find('\0'));
407 FilePath temp_dir;
408 if (!GetShmemTempDir(false, &temp_dir))
409 return false;
411 #if !defined(OS_MACOSX)
412 #if defined(GOOGLE_CHROME_BUILD)
413 std::string name_base = std::string("com.google.Chrome");
414 #else
415 std::string name_base = std::string("org.chromium.Chromium");
416 #endif
417 #else // OS_MACOSX
418 std::string name_base = std::string(base::mac::BaseBundleID());
419 #endif // OS_MACOSX
420 *path = temp_dir.AppendASCII(name_base + ".shmem." + mem_name);
421 return true;
423 #endif // !defined(OS_ANDROID)
425 void SharedMemory::LockOrUnlockCommon(int function) {
426 DCHECK_GE(mapped_file_, 0);
427 while (lockf(mapped_file_, function, 0) < 0) {
428 if (errno == EINTR) {
429 continue;
430 } else if (errno == ENOLCK) {
431 // temporary kernel resource exaustion
432 base::PlatformThread::Sleep(base::TimeDelta::FromMilliseconds(500));
433 continue;
434 } else {
435 NOTREACHED() << "lockf() failed."
436 << " function:" << function
437 << " fd:" << mapped_file_
438 << " errno:" << errno
439 << " msg:" << safe_strerror(errno);
444 bool SharedMemory::ShareToProcessCommon(ProcessHandle process,
445 SharedMemoryHandle* new_handle,
446 bool close_self,
447 ShareMode share_mode) {
448 int handle_to_dup = -1;
449 switch(share_mode) {
450 case SHARE_CURRENT_MODE:
451 handle_to_dup = mapped_file_;
452 break;
453 case SHARE_READONLY:
454 // We could imagine re-opening the file from /dev/fd, but that can't make
455 // it readonly on Mac: https://codereview.chromium.org/27265002/#msg10
456 CHECK(readonly_mapped_file_ >= 0);
457 handle_to_dup = readonly_mapped_file_;
458 break;
461 const int new_fd = dup(handle_to_dup);
462 if (new_fd < 0) {
463 DPLOG(ERROR) << "dup() failed.";
464 return false;
467 new_handle->fd = new_fd;
468 new_handle->auto_close = true;
470 if (close_self) {
471 Unmap();
472 Close();
475 return true;
478 } // namespace base