base/profiler/win32_stack_frame_unwinder.cc

   1 // Copyright 2015 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include "base/profiler/win32_stack_frame_unwinder.h"
   6
   7 #include "base/containers/hash_tables.h"
   8 #include "base/memory/singleton.h"
   9 #include "base/stl_util.h"
  10
  11 namespace base {
  12
  13 // LeafUnwindBlacklist --------------------------------------------------------
  14
  15 namespace {
  16
  17 // Records modules that are known to have functions that violate the Microsoft
  18 // x64 calling convention and would be dangerous to manually unwind if
  19 // encountered as the last frame on the call stack. Functions like these have
  20 // been observed in injected third party modules that either do not provide
  21 // function unwind information, or do not provide the required function prologue
  22 // and epilogue. The former case was observed in several AV products and the
  23 // latter in a WndProc function associated with Actual Window
  24 // Manager/aimemb64.dll. See https://crbug.com/476422.
  25 class LeafUnwindBlacklist {
  26  public:
  27   static LeafUnwindBlacklist* GetInstance();
  28
  29   // This function does not allocate memory and is safe to call between
  30   // SuspendThread and ResumeThread.
  31   bool IsBlacklisted(const void* module) const;
  32
  33   // Allocates memory. Must be invoked only after ResumeThread, otherwise we
  34   // risk deadlocking on a heap lock held by a suspended thread.
  35   void AddModuleToBlacklist(const void* module);
  36
  37  private:
  38   friend struct DefaultSingletonTraits<LeafUnwindBlacklist>;
  39
  40   LeafUnwindBlacklist();
  41   ~LeafUnwindBlacklist();
  42
  43   // The set of modules known to have functions that violate the Microsoft x64
  44   // calling convention.
  45   base::hash_set<const void*> blacklisted_modules_;
  46
  47   DISALLOW_COPY_AND_ASSIGN(LeafUnwindBlacklist);
  48 };
  49
  50 // static
  51 LeafUnwindBlacklist* LeafUnwindBlacklist::GetInstance() {
  52   // Leaky for shutdown performance.
  53   return Singleton<LeafUnwindBlacklist,
  54                    LeakySingletonTraits<LeafUnwindBlacklist>>::get();
  55 }
  56
  57 bool LeafUnwindBlacklist::IsBlacklisted(const void* module) const {
  58   return ContainsKey(blacklisted_modules_, module);
  59 }
  60
  61 void LeafUnwindBlacklist::AddModuleToBlacklist(const void* module) {
  62   CHECK(module);
  63   blacklisted_modules_.insert(module);
  64 }
  65
  66 LeafUnwindBlacklist::LeafUnwindBlacklist() {}
  67 LeafUnwindBlacklist::~LeafUnwindBlacklist() {}
  68
  69 }  // namespace
  70
  71 // Win32StackFrameUnwinder ----------------------------------------------------
  72
  73 Win32StackFrameUnwinder::UnwindFunctions::~UnwindFunctions() {}
  74 Win32StackFrameUnwinder::UnwindFunctions::UnwindFunctions() {}
  75
  76 Win32StackFrameUnwinder::Win32UnwindFunctions::Win32UnwindFunctions() {}
  77
  78 PRUNTIME_FUNCTION Win32StackFrameUnwinder::Win32UnwindFunctions::
  79 LookupFunctionEntry(DWORD64 program_counter, PDWORD64 image_base) {
  80 #ifdef _WIN64
  81   return RtlLookupFunctionEntry(program_counter, image_base, nullptr);
  82 #else
  83   NOTREACHED();
  84   return nullptr;
  85 #endif
  86 }
  87
  88 void Win32StackFrameUnwinder::Win32UnwindFunctions::VirtualUnwind(
  89     DWORD64 image_base,
  90     DWORD64 program_counter,
  91     PRUNTIME_FUNCTION runtime_function,
  92     CONTEXT* context) {
  93 #ifdef _WIN64
  94   void* handler_data;
  95   ULONG64 establisher_frame;
  96   KNONVOLATILE_CONTEXT_POINTERS nvcontext = {};
  97   RtlVirtualUnwind(0, image_base, program_counter, runtime_function,
  98                    context, &handler_data, &establisher_frame, &nvcontext);
  99 #else
 100   NOTREACHED();
 101 #endif
 102 }
 103
 104
 105 Win32StackFrameUnwinder::Win32StackFrameUnwinder()
 106     : Win32StackFrameUnwinder(&win32_unwind_functions_) {
 107 }
 108
 109 Win32StackFrameUnwinder::~Win32StackFrameUnwinder() {
 110   if (pending_blacklisted_module_) {
 111     LeafUnwindBlacklist::GetInstance()->AddModuleToBlacklist(
 112         pending_blacklisted_module_);
 113   }
 114 }
 115
 116 bool Win32StackFrameUnwinder::TryUnwind(CONTEXT* context) {
 117 #ifdef _WIN64
 118   CHECK(!at_top_frame_ || unwind_info_present_for_all_frames_);
 119   CHECK(!pending_blacklisted_module_);
 120
 121   ULONG64 image_base;
 122   // Try to look up unwind metadata for the current function.
 123   PRUNTIME_FUNCTION runtime_function =
 124       unwind_functions_->LookupFunctionEntry(context->Rip, &image_base);
 125
 126   if (runtime_function) {
 127     unwind_functions_->VirtualUnwind(image_base, context->Rip, runtime_function,
 128                                      context);
 129     at_top_frame_ = false;
 130   } else {
 131     // RtlLookupFunctionEntry didn't find unwind information. This could mean
 132     // the code at the instruction pointer is in:
 133     //
 134     // 1. a true leaf function (i.e. a function that neither calls a function,
 135     //    nor allocates any stack space itself) in which case the return
 136     //    address is at RSP, or
 137     //
 138     // 2. a function that doesn't adhere to the Microsoft x64 calling
 139     //    convention, either by not providing the required unwind information,
 140     //    or by not having the prologue or epilogue required for unwinding;
 141     //    this case has been observed in crash data in injected third party
 142     //    DLLs.
 143     //
 144     // In valid code, case 1 can only occur (by definition) as the last frame
 145     // on the stack. This happens in about 5% of observed stacks and can
 146     // easily be unwound by popping RSP and using it as the next frame's
 147     // instruction pointer.
 148     //
 149     // Case 2 can occur anywhere on the stack, and attempting to unwind the
 150     // stack will result in treating whatever value happens to be on the stack
 151     // at RSP as the next frame's instruction pointer. This is certainly wrong
 152     // and very likely to lead to crashing by deferencing invalid pointers in
 153     // the next RtlVirtualUnwind call.
 154     //
 155     // If we see case 2 at a location not the last frame, and all the previous
 156     // frame had valid unwind information, then this is definitely bad code.
 157     // We blacklist the module as untrustable for unwinding if we encounter a
 158     // function in it that doesn't have unwind information.
 159
 160     if (at_top_frame_) {
 161       at_top_frame_ = false;
 162
 163       // We are at the end of the stack. It's very likely that we're in case 1
 164       // since the vast majority of code adheres to the Microsoft x64 calling
 165       // convention. But there's a small chance we might be unlucky and be in
 166       // case 2. If this module is known to have bad code according to the
 167       // leaf unwind blacklist, stop here, otherwise manually unwind.
 168       if (LeafUnwindBlacklist::GetInstance()->IsBlacklisted(
 169               reinterpret_cast<const void*>(image_base))) {
 170         return false;
 171       }
 172
 173       context->Rip = context->Rsp;
 174       context->Rsp += 8;
 175       unwind_info_present_for_all_frames_ = false;
 176     } else {
 177       // We're not at the end of the stack. This frame is untrustworthy and we
 178       // can't safely unwind from here.
 179       if (unwind_info_present_for_all_frames_) {
 180         // Unwind information was present for all previous frames, so we can
 181         // be confident this is case 2. Record the module to be blacklisted.
 182         pending_blacklisted_module_ =
 183             reinterpret_cast<const void *>(image_base);
 184       } else {
 185         // We started off on a function without unwind information. It's very
 186         // likely that all frames up to this point have been good, and this
 187         // frame is case 2. But it's possible that the initial frame was case
 188         // 2 but hadn't been blacklisted yet, and we've started to go off into
 189         // the weeds. Since we can't be sure, just bail out without
 190         // blacklisting the module; chances are we'll later encounter the same
 191         // function on a stack with full unwind information.
 192       }
 193       return false;
 194     }
 195   }
 196
 197   return true;
 198 #else
 199   NOTREACHED();
 200   return false;
 201 #endif
 202 }
 203
 204 Win32StackFrameUnwinder::Win32StackFrameUnwinder(
 205     UnwindFunctions* unwind_functions)
 206     : at_top_frame_(true),
 207       unwind_info_present_for_all_frames_(true),
 208       pending_blacklisted_module_(nullptr),
 209       unwind_functions_(unwind_functions) {
 210 }
 211
 212 }  // namespace base