blob: c8b25ae2b3da95337fc52ee0aeae814717497f4a [file] [log] [blame]
* Copyright 2017 The Android Open Source Project
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* See the License for the specific language governing permissions and
* limitations under the License.
#include <dirent.h>
#include <fcntl.h>
#include <poll.h>
#include <pthread.h>
#include <stddef.h>
#include <sys/ucontext.h>
#include <syscall.h>
#include <unistd.h>
#include <atomic>
#include <memory>
#include <mutex>
#include <android-base/file.h>
#include <android-base/unique_fd.h>
#include <async_safe/log.h>
#include <bionic/reserved_signals.h>
#include <unwindstack/DexFiles.h>
#include <unwindstack/JitDebug.h>
#include <unwindstack/Maps.h>
#include <unwindstack/Memory.h>
#include <unwindstack/Regs.h>
#include <unwindstack/Unwinder.h>
#include "debuggerd/handler.h"
#include "handler/fallback.h"
#include "tombstoned/tombstoned.h"
#include "util.h"
#include "libdebuggerd/backtrace.h"
#include "libdebuggerd/tombstone.h"
using android::base::unique_fd;
extern "C" bool __linker_enable_fallback_allocator();
extern "C" void __linker_disable_fallback_allocator();
// This is incredibly sketchy to do inside of a signal handler, especially when libbacktrace
// uses the C++ standard library throughout, but this code runs in the linker, so we'll be using
// the linker's malloc instead of the libc one. Switch it out for a replacement, just in case.
// This isn't the default method of dumping because it can fail in cases such as address space
// exhaustion.
static void debuggerd_fallback_trace(int output_fd, ucontext_t* ucontext) {
if (!__linker_enable_fallback_allocator()) {
async_safe_format_log(ANDROID_LOG_ERROR, "libc", "fallback allocator already in use");
std::unique_ptr<unwindstack::Regs> regs;
ThreadInfo thread; = getpid();
thread.tid = gettid();
thread.thread_name = get_thread_name(gettid());
unwindstack::Regs::CreateFromUcontext(unwindstack::Regs::CurrentArch(), ucontext));
// Do not use the thread cache here because it will call pthread_key_create
// which doesn't work in linker code. See b/189803009.
// Use a normal cached object because the process is stopped, and there
// is no chance of data changing between reads.
auto process_memory = unwindstack::Memory::CreateProcessMemoryCached(getpid());
// TODO: Create this once and store it in a global?
unwindstack::UnwinderFromPid unwinder(kMaxFrames, getpid(), process_memory);
dump_backtrace_thread(output_fd, &unwinder, thread);
static void debuggerd_fallback_tombstone(int output_fd, int proto_fd, ucontext_t* ucontext,
siginfo_t* siginfo, void* abort_message) {
if (!__linker_enable_fallback_allocator()) {
async_safe_format_log(ANDROID_LOG_ERROR, "libc", "fallback allocator already in use");
engrave_tombstone_ucontext(output_fd, proto_fd, reinterpret_cast<uintptr_t>(abort_message),
siginfo, ucontext);
static bool forward_output(int src_fd, int dst_fd, pid_t expected_tid) {
// Make sure the thread actually got the signal.
struct pollfd pfd = {
.fd = src_fd, .events = POLLIN,
// Wait for up to a second for output to start flowing.
if (poll(&pfd, 1, 1000) != 1) {
return false;
pid_t tid;
if (TEMP_FAILURE_RETRY(read(src_fd, &tid, sizeof(tid))) != sizeof(tid)) {
async_safe_format_log(ANDROID_LOG_ERROR, "libc", "failed to read tid");
return false;
if (tid != expected_tid) {
async_safe_format_log(ANDROID_LOG_ERROR, "libc", "received tid %d, expected %d", tid,
return false;
while (true) {
char buf[512];
ssize_t rc = TEMP_FAILURE_RETRY(read(src_fd, buf, sizeof(buf)));
if (rc == 0) {
return true;
} else if (rc < 0) {
return false;
if (!android::base::WriteFully(dst_fd, buf, rc)) {
// We failed to write to tombstoned, but there's not much we can do.
// Keep reading from src_fd to keep things going.
struct __attribute__((__packed__)) packed_thread_output {
int32_t tid;
int32_t fd;
static uint64_t pack_thread_fd(pid_t tid, int fd) {
packed_thread_output packed = {.tid = tid, .fd = fd};
uint64_t result;
static_assert(sizeof(packed) == sizeof(result));
memcpy(&result, &packed, sizeof(packed));
return result;
static std::pair<pid_t, int> unpack_thread_fd(uint64_t value) {
packed_thread_output result;
memcpy(&result, &value, sizeof(value));
return std::make_pair(result.tid, result.fd);
static void trace_handler(siginfo_t* info, ucontext_t* ucontext) {
static std::atomic<uint64_t> trace_output(pack_thread_fd(-1, -1));
if (info->si_value.sival_ptr == kDebuggerdFallbackSivalPtrRequestDump) {
// Asked to dump by the original signal recipient.
uint64_t val = trace_output.load();
auto [tid, fd] = unpack_thread_fd(val);
if (tid != gettid()) {
// We received some other thread's info request?
async_safe_format_log(ANDROID_LOG_ERROR, "libc",
"thread %d received output fd for thread %d?", gettid(), tid);
if (!trace_output.compare_exchange_strong(val, pack_thread_fd(-1, -1))) {
// Presumably, the timeout in forward_output expired, and the main thread moved on.
// If this happened, the main thread closed our fd for us, so just return.
async_safe_format_log(ANDROID_LOG_ERROR, "libc", "cmpxchg for thread %d failed", gettid());
// Write our tid to the output fd to let the main thread know that we're working.
if (TEMP_FAILURE_RETRY(write(fd, &tid, sizeof(tid))) == sizeof(tid)) {
debuggerd_fallback_trace(fd, ucontext);
} else {
async_safe_format_log(ANDROID_LOG_ERROR, "libc", "failed to write to output fd");
// Only allow one thread to perform a trace at a time.
static std::mutex trace_mutex;
if (!trace_mutex.try_lock()) {
async_safe_format_log(ANDROID_LOG_INFO, "libc", "trace lock failed");
std::lock_guard<std::mutex> scoped_lock(trace_mutex, std::adopt_lock);
// Fetch output fd from tombstoned.
unique_fd tombstone_socket, output_fd;
if (!tombstoned_connect(getpid(), &tombstone_socket, &output_fd, nullptr,
kDebuggerdNativeBacktrace)) {
async_safe_format_log(ANDROID_LOG_ERROR, "libc",
"missing crash_dump_fallback() in selinux policy?");
// Dump our own stack.
debuggerd_fallback_trace(output_fd.get(), ucontext);
// Send a signal to all of our siblings, asking them to dump their stack.
pid_t current_tid = gettid();
if (!iterate_tids(current_tid, [&output_fd](pid_t tid) {
// Use a pipe, to be able to detect situations where the thread gracefully exits before
// receiving our signal.
unique_fd pipe_read, pipe_write;
if (!Pipe(&pipe_read, &pipe_write)) {
async_safe_format_log(ANDROID_LOG_ERROR, "libc", "failed to create pipe: %s",
uint64_t expected = pack_thread_fd(-1, -1);
int sent_fd = pipe_write.release();
if (!trace_output.compare_exchange_strong(expected, pack_thread_fd(tid, sent_fd))) {
auto [tid, fd] = unpack_thread_fd(expected);
async_safe_format_log(ANDROID_LOG_ERROR, "libc",
"thread %d is already outputting to fd %d?", tid, fd);
siginfo_t siginfo = {};
siginfo.si_code = SI_QUEUE;
siginfo.si_value.sival_ptr = kDebuggerdFallbackSivalPtrRequestDump;
siginfo.si_pid = getpid();
siginfo.si_uid = getuid();
if (syscall(__NR_rt_tgsigqueueinfo, getpid(), tid, BIONIC_SIGNAL_DEBUGGER, &siginfo) != 0) {
async_safe_format_log(ANDROID_LOG_ERROR, "libc", "failed to send trace signal to %d: %s",
tid, strerror(errno));
bool success = forward_output(pipe_read.get(), output_fd.get(), tid);
if (!success) {
async_safe_format_log(ANDROID_LOG_ERROR, "libc",
"timeout expired while waiting for thread %d to dump", tid);
// Regardless of whether the poll succeeds, check to see if the thread took fd ownership.
uint64_t post_wait =, -1));
if (post_wait != pack_thread_fd(-1, -1)) {
auto [tid, fd] = unpack_thread_fd(post_wait);
if (fd != -1) {
async_safe_format_log(ANDROID_LOG_ERROR, "libc", "closing fd %d for thread %d", fd, tid);
})) {
async_safe_format_log(ANDROID_LOG_ERROR, "libc", "failed to open /proc/%d/task: %s",
current_tid, strerror(errno));
static void crash_handler(siginfo_t* info, ucontext_t* ucontext, void* abort_message) {
// Only allow one thread to handle a crash at a time (this can happen multiple times without
// exit, since tombstones can be requested without a real crash happening.)
static std::recursive_mutex crash_mutex;
static int lock_count;
if (lock_count++ > 0) {
async_safe_format_log(ANDROID_LOG_ERROR, "libc", "recursed signal handler call, aborting");
sigset_t sigset;
sigaddset(&sigset, SIGABRT);
sigprocmask(SIG_UNBLOCK, &sigset, nullptr);
// Just in case...
async_safe_format_log(ANDROID_LOG_ERROR, "libc", "abort didn't exit, exiting");
unique_fd tombstone_socket, output_fd, proto_fd;
bool tombstoned_connected = tombstoned_connect(getpid(), &tombstone_socket, &output_fd, &proto_fd,
debuggerd_fallback_tombstone(output_fd.get(), proto_fd.get(), ucontext, info, abort_message);
if (tombstoned_connected) {
extern "C" void debuggerd_fallback_handler(siginfo_t* info, ucontext_t* ucontext,
void* abort_message) {
if (info->si_signo == BIONIC_SIGNAL_DEBUGGER && info->si_value.sival_ptr != nullptr) {
return trace_handler(info, ucontext);
} else {
return crash_handler(info, ucontext, abort_message);