google-breakpad/src/client/linux/dump_writer_common/seccomp_unwinder.cc

// Copyright (c) 2014, Google Inc.
// All rights reserved.
//
// Redistribution and use in source and binary forms, with or without
// modification, are permitted provided that the following conditions are
// met:
//
//     * Redistributions of source code must retain the above copyright
// notice, this list of conditions and the following disclaimer.
//     * Redistributions in binary form must reproduce the above
// copyright notice, this list of conditions and the following disclaimer
// in the documentation and/or other materials provided with the
// distribution.
//     * Neither the name of Google Inc. nor the names of its
// contributors may be used to endorse or promote products derived from
// this software without specific prior written permission.
//
// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

#include "client/linux/dump_writer_common/seccomp_unwinder.h"

#include <string.h>

#include "google_breakpad/common/minidump_format.h"
#include "common/linux/linux_libc_support.h"

namespace google_breakpad {

void SeccompUnwinder::PopSeccompStackFrame(RawContextCPU* cpu,
                                           const MDRawThread& thread,
                                           uint8_t* stack_copy) {
#if defined(__x86_64)
  uint64_t bp = cpu->rbp;
  uint64_t top = thread.stack.start_of_memory_range;
  for (int i = 4; i--; ) {
    if (bp < top ||
        bp > thread.stack.start_of_memory_range +
        thread.stack.memory.data_size - sizeof(bp) ||
        bp & 1) {
      break;
    }
    uint64_t old_top = top;
    top = bp;
    uint8_t* bp_addr = stack_copy + bp - thread.stack.start_of_memory_range;
    my_memcpy(&bp, bp_addr, sizeof(bp));
    if (bp == 0xDEADBEEFDEADBEEFull) {
      struct {
        uint64_t r15;
        uint64_t r14;
        uint64_t r13;
        uint64_t r12;
        uint64_t r11;
        uint64_t r10;
        uint64_t r9;
        uint64_t r8;
        uint64_t rdi;
        uint64_t rsi;
        uint64_t rdx;
        uint64_t rcx;
        uint64_t rbx;
        uint64_t deadbeef;
        uint64_t rbp;
        uint64_t fakeret;
        uint64_t ret;
        /* char redzone[128]; */
      } seccomp_stackframe;
      if (top - offsetof(__typeof__(seccomp_stackframe), deadbeef) < old_top ||
          top - offsetof(__typeof__(seccomp_stackframe), deadbeef) +
          sizeof(seccomp_stackframe) >
          thread.stack.start_of_memory_range+thread.stack.memory.data_size) {
        break;
      }
      my_memcpy(&seccomp_stackframe,
                bp_addr - offsetof(__typeof__(seccomp_stackframe), deadbeef),
                sizeof(seccomp_stackframe));
      cpu->rbx = seccomp_stackframe.rbx;
      cpu->rcx = seccomp_stackframe.rcx;
      cpu->rdx = seccomp_stackframe.rdx;
      cpu->rsi = seccomp_stackframe.rsi;
      cpu->rdi = seccomp_stackframe.rdi;
      cpu->rbp = seccomp_stackframe.rbp;
      cpu->rsp = top + 4*sizeof(uint64_t) + 128;
      cpu->r8  = seccomp_stackframe.r8;
      cpu->r9  = seccomp_stackframe.r9;
      cpu->r10 = seccomp_stackframe.r10;
      cpu->r11 = seccomp_stackframe.r11;
      cpu->r12 = seccomp_stackframe.r12;
      cpu->r13 = seccomp_stackframe.r13;
      cpu->r14 = seccomp_stackframe.r14;
      cpu->r15 = seccomp_stackframe.r15;
      cpu->rip = seccomp_stackframe.fakeret;
      return;
    }
  }
#elif defined(__i386__)
  uint32_t bp = cpu->ebp;
  uint32_t top = thread.stack.start_of_memory_range;
  for (int i = 4; i--; ) {
    if (bp < top ||
        bp > thread.stack.start_of_memory_range +
        thread.stack.memory.data_size - sizeof(bp) ||
        bp & 1) {
      break;
    }
    uint32_t old_top = top;
    top = bp;
    uint8_t* bp_addr = stack_copy + bp - thread.stack.start_of_memory_range;
    my_memcpy(&bp, bp_addr, sizeof(bp));
    if (bp == 0xDEADBEEFu) {
      struct {
        uint32_t edi;
        uint32_t esi;
        uint32_t edx;
        uint32_t ecx;
        uint32_t ebx;
        uint32_t deadbeef;
        uint32_t ebp;
        uint32_t fakeret;
        uint32_t ret;
      } seccomp_stackframe;
      if (top - offsetof(__typeof__(seccomp_stackframe), deadbeef) < old_top ||
          top - offsetof(__typeof__(seccomp_stackframe), deadbeef) +
          sizeof(seccomp_stackframe) >
          thread.stack.start_of_memory_range+thread.stack.memory.data_size) {
        break;
      }
      my_memcpy(&seccomp_stackframe,
                bp_addr - offsetof(__typeof__(seccomp_stackframe), deadbeef),
                sizeof(seccomp_stackframe));
      cpu->ebx = seccomp_stackframe.ebx;
      cpu->ecx = seccomp_stackframe.ecx;
      cpu->edx = seccomp_stackframe.edx;
      cpu->esi = seccomp_stackframe.esi;
      cpu->edi = seccomp_stackframe.edi;
      cpu->ebp = seccomp_stackframe.ebp;
      cpu->esp = top + 4*sizeof(void*);
      cpu->eip = seccomp_stackframe.fakeret;
      return;
    }
  }
#endif
}

}  // namespace google_breakpad