kill_mac.cc 6.8 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173
  1. // Copyright (c) 2013 The Chromium Authors. All rights reserved.
  2. // Use of this source code is governed by a BSD-style license that can be
  3. // found in the LICENSE file.
  4. #include "base/process/kill.h"
  5. #include <errno.h>
  6. #include <signal.h>
  7. #include <sys/event.h>
  8. #include <sys/types.h>
  9. #include <sys/wait.h>
  10. #include "base/files/file_util.h"
  11. #include "base/files/scoped_file.h"
  12. #include "base/logging.h"
  13. #include "base/posix/eintr_wrapper.h"
  14. namespace base {
  15. namespace {
  16. const int kWaitBeforeKillSeconds = 2;
  17. // Reap |child| process. This call blocks until completion.
  18. void BlockingReap(pid_t child) {
  19. const pid_t result = HANDLE_EINTR(waitpid(child, NULL, 0));
  20. if (result == -1) {
  21. DPLOG(ERROR) << "waitpid(" << child << ", NULL, 0)";
  22. }
  23. }
  24. // Waits for |timeout| seconds for the given |child| to exit and reap it. If
  25. // the child doesn't exit within the time specified, kills it.
  26. //
  27. // This function takes two approaches: first, it tries to use kqueue to
  28. // observe when the process exits. kevent can monitor a kqueue with a
  29. // timeout, so this method is preferred to wait for a specified period of
  30. // time. Once the kqueue indicates the process has exited, waitpid will reap
  31. // the exited child. If the kqueue doesn't provide an exit event notification,
  32. // before the timeout expires, or if the kqueue fails or misbehaves, the
  33. // process will be mercilessly killed and reaped.
  34. //
  35. // A child process passed to this function may be in one of several states:
  36. // running, terminated and not yet reaped, and (apparently, and unfortunately)
  37. // terminated and already reaped. Normally, a process will at least have been
  38. // asked to exit before this function is called, but this is not required.
  39. // If a process is terminating and unreaped, there may be a window between the
  40. // time that kqueue will no longer recognize it and when it becomes an actual
  41. // zombie that a non-blocking (WNOHANG) waitpid can reap. This condition is
  42. // detected when kqueue indicates that the process is not running and a
  43. // non-blocking waitpid fails to reap the process but indicates that it is
  44. // still running. In this event, a blocking attempt to reap the process
  45. // collects the known-dying child, preventing zombies from congregating.
  46. //
  47. // In the event that the kqueue misbehaves entirely, as it might under a
  48. // EMFILE condition ("too many open files", or out of file descriptors), this
  49. // function will forcibly kill and reap the child without delay. This
  50. // eliminates another potential zombie vector. (If you're out of file
  51. // descriptors, you're probably deep into something else, but that doesn't
  52. // mean that zombies be allowed to kick you while you're down.)
  53. //
  54. // The fact that this function seemingly can be called to wait on a child
  55. // that's not only already terminated but already reaped is a bit of a
  56. // problem: a reaped child's pid can be reclaimed and may refer to a distinct
  57. // process in that case. The fact that this function can seemingly be called
  58. // to wait on a process that's not even a child is also a problem: kqueue will
  59. // work in that case, but waitpid won't, and killing a non-child might not be
  60. // the best approach.
  61. void WaitForChildToDie(pid_t child, int timeout) {
  62. DCHECK_GT(child, 0);
  63. DCHECK_GT(timeout, 0);
  64. // DON'T ADD ANY EARLY RETURNS TO THIS FUNCTION without ensuring that
  65. // |child| has been reaped. Specifically, even if a kqueue, kevent, or other
  66. // call fails, this function should fall back to the last resort of trying
  67. // to kill and reap the process. Not observing this rule will resurrect
  68. // zombies.
  69. int result;
  70. ScopedFD kq(HANDLE_EINTR(kqueue()));
  71. if (!kq.is_valid()) {
  72. DPLOG(ERROR) << "kqueue()";
  73. } else {
  74. struct kevent change = {0};
  75. EV_SET(&change, child, EVFILT_PROC, EV_ADD, NOTE_EXIT, 0, NULL);
  76. result = HANDLE_EINTR(kevent(kq.get(), &change, 1, NULL, 0, NULL));
  77. if (result == -1) {
  78. if (errno != ESRCH) {
  79. DPLOG(ERROR) << "kevent (setup " << child << ")";
  80. } else {
  81. // At this point, one of the following has occurred:
  82. // 1. The process has died but has not yet been reaped.
  83. // 2. The process has died and has already been reaped.
  84. // 3. The process is in the process of dying. It's no longer
  85. // kqueueable, but it may not be waitable yet either. Mark calls
  86. // this case the "zombie death race".
  87. result = HANDLE_EINTR(waitpid(child, NULL, WNOHANG));
  88. if (result != 0) {
  89. // A positive result indicates case 1. waitpid succeeded and reaped
  90. // the child. A result of -1 indicates case 2. The child has already
  91. // been reaped. In both of these cases, no further action is
  92. // necessary.
  93. return;
  94. }
  95. // |result| is 0, indicating case 3. The process will be waitable in
  96. // short order. Fall back out of the kqueue code to kill it (for good
  97. // measure) and reap it.
  98. }
  99. } else {
  100. // Keep track of the elapsed time to be able to restart kevent if it's
  101. // interrupted.
  102. TimeDelta remaining_delta = Seconds(timeout);
  103. TimeTicks deadline = TimeTicks::Now() + remaining_delta;
  104. result = -1;
  105. struct kevent event = {0};
  106. while (remaining_delta.InMilliseconds() > 0) {
  107. const struct timespec remaining_timespec = remaining_delta.ToTimeSpec();
  108. result = kevent(kq.get(), NULL, 0, &event, 1, &remaining_timespec);
  109. if (result == -1 && errno == EINTR) {
  110. remaining_delta = deadline - TimeTicks::Now();
  111. result = 0;
  112. } else {
  113. break;
  114. }
  115. }
  116. if (result == -1) {
  117. DPLOG(ERROR) << "kevent (wait " << child << ")";
  118. } else if (result > 1) {
  119. DLOG(ERROR) << "kevent (wait " << child << "): unexpected result "
  120. << result;
  121. } else if (result == 1) {
  122. if ((event.fflags & NOTE_EXIT) &&
  123. (event.ident == static_cast<uintptr_t>(child))) {
  124. // The process is dead or dying. This won't block for long, if at
  125. // all.
  126. BlockingReap(child);
  127. return;
  128. } else {
  129. DLOG(ERROR) << "kevent (wait " << child
  130. << "): unexpected event: fflags=" << event.fflags
  131. << ", ident=" << event.ident;
  132. }
  133. }
  134. }
  135. }
  136. // The child is still alive, or is very freshly dead. Be sure by sending it
  137. // a signal. This is safe even if it's freshly dead, because it will be a
  138. // zombie (or on the way to zombiedom) and kill will return 0 even if the
  139. // signal is not delivered to a live process.
  140. result = kill(child, SIGKILL);
  141. if (result == -1) {
  142. DPLOG(ERROR) << "kill(" << child << ", SIGKILL)";
  143. } else {
  144. // The child is definitely on the way out now. BlockingReap won't need to
  145. // wait for long, if at all.
  146. BlockingReap(child);
  147. }
  148. }
  149. } // namespace
  150. void EnsureProcessTerminated(Process process) {
  151. WaitForChildToDie(process.Pid(), kWaitBeforeKillSeconds);
  152. }
  153. } // namespace base