123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348 |
- // Copyright (c) 2012 The Chromium Authors. All rights reserved.
- // Use of this source code is governed by a BSD-style license that can be
- // found in the LICENSE file.
- #include "sandbox/win/src/sharedmem_ipc_server.h"
- #include <stddef.h>
- #include <stdint.h>
- #include "base/callback.h"
- #include "base/check.h"
- #include "base/memory/ptr_util.h"
- #include "base/notreached.h"
- #include "sandbox/win/src/crosscall_params.h"
- #include "sandbox/win/src/crosscall_server.h"
- #include "sandbox/win/src/ipc_args.h"
- #include "sandbox/win/src/sandbox.h"
- #include "sandbox/win/src/sandbox_types.h"
- #include "sandbox/win/src/sharedmem_ipc_client.h"
- #include "sandbox/win/src/threadpool.h"
- namespace {
- // This handle must not be closed.
- volatile HANDLE g_alive_mutex = nullptr;
- } // namespace
- namespace sandbox {
- SharedMemIPCServer::ServerControl::ServerControl() {}
- SharedMemIPCServer::ServerControl::~ServerControl() {}
- SharedMemIPCServer::SharedMemIPCServer(HANDLE target_process,
- DWORD target_process_id,
- ThreadPool* thread_pool,
- Dispatcher* dispatcher)
- : client_control_(nullptr),
- thread_pool_(thread_pool),
- target_process_(target_process),
- target_process_id_(target_process_id),
- call_dispatcher_(dispatcher) {
- // We create a initially owned mutex. If the server dies unexpectedly,
- // the thread that owns it will fail to release the lock and windows will
- // report to the target (when it tries to acquire it) that the wait was
- // abandoned. Note: We purposely leak the local handle because we want it to
- // be closed by Windows itself so it is properly marked as abandoned if the
- // server dies.
- if (!g_alive_mutex) {
- HANDLE mutex = ::CreateMutexW(nullptr, true, nullptr);
- if (::InterlockedCompareExchangePointer(&g_alive_mutex, mutex, nullptr)) {
- // We lost the race to create the mutex.
- ::CloseHandle(mutex);
- }
- }
- }
- SharedMemIPCServer::~SharedMemIPCServer() {
- // Free the wait handles associated with the thread pool.
- if (!thread_pool_->UnRegisterWaits(this)) {
- // Better to leak than to crash.
- return;
- }
- server_contexts_.clear();
- if (client_control_)
- ::UnmapViewOfFile(client_control_);
- }
- bool SharedMemIPCServer::Init(void* shared_mem,
- uint32_t shared_size,
- uint32_t channel_size) {
- // The shared memory needs to be at least as big as a channel.
- if (shared_size < channel_size) {
- return false;
- }
- // The channel size should be aligned.
- if (0 != (channel_size % 32)) {
- return false;
- }
- // Calculate how many channels we can fit in the shared memory.
- shared_size -= offsetof(IPCControl, channels);
- size_t channel_count = shared_size / (sizeof(ChannelControl) + channel_size);
- // If we cannot fit even one channel we bail out.
- if (0 == channel_count) {
- return false;
- }
- // Calculate the start of the first channel.
- size_t base_start =
- (sizeof(ChannelControl) * channel_count) + offsetof(IPCControl, channels);
- client_control_ = reinterpret_cast<IPCControl*>(shared_mem);
- client_control_->channels_count = 0;
- // This is the initialization that we do per-channel. Basically:
- // 1) make two events (ping & pong)
- // 2) create handles to the events for the client and the server.
- // 3) initialize the channel (client_context) with the state.
- // 4) initialize the server side of the channel (service_context).
- // 5) call the thread provider RegisterWait to register the ping events.
- for (size_t ix = 0; ix != channel_count; ++ix) {
- ChannelControl* client_context = &client_control_->channels[ix];
- ServerControl* service_context = new ServerControl;
- server_contexts_.push_back(base::WrapUnique(service_context));
- if (!MakeEvents(&service_context->ping_event, &service_context->pong_event,
- &client_context->ping_event, &client_context->pong_event)) {
- return false;
- }
- client_context->channel_base = base_start;
- client_context->state = kFreeChannel;
- // Note that some of these values are available as members of this object
- // but we put them again into the service_context because we will be called
- // on a static method (ThreadPingEventReady). In particular, target_process_
- // is a raw handle that is not owned by this object (it's owned by the
- // owner of this object), and we are storing it in multiple places.
- service_context->shared_base = reinterpret_cast<char*>(shared_mem);
- service_context->channel_size = channel_size;
- service_context->channel = client_context;
- service_context->channel_buffer =
- service_context->shared_base + client_context->channel_base;
- service_context->dispatcher = call_dispatcher_;
- service_context->target_info.process = target_process_;
- service_context->target_info.process_id = target_process_id_;
- // Advance to the next channel.
- base_start += channel_size;
- // Register the ping event with the threadpool.
- thread_pool_->RegisterWait(this, service_context->ping_event.Get(),
- ThreadPingEventReady, service_context);
- }
- if (!::DuplicateHandle(::GetCurrentProcess(), g_alive_mutex, target_process_,
- &client_control_->server_alive,
- SYNCHRONIZE | EVENT_MODIFY_STATE, false, 0)) {
- return false;
- }
- // This last setting indicates to the client all is setup.
- client_control_->channels_count = channel_count;
- return true;
- }
- bool SharedMemIPCServer::InvokeCallback(const ServerControl* service_context,
- void* ipc_buffer,
- CrossCallReturn* call_result) {
- // Set the default error code;
- SetCallError(SBOX_ERROR_INVALID_IPC, call_result);
- uint32_t output_size = 0;
- // Parse, verify and copy the message. The handler operates on a copy
- // of the message so the client cannot play dirty tricks by changing the
- // data in the channel while the IPC is being processed.
- std::unique_ptr<CrossCallParamsEx> params(CrossCallParamsEx::CreateFromBuffer(
- ipc_buffer, service_context->channel_size, &output_size));
- if (!params.get())
- return false;
- IpcTag tag = params->GetTag();
- static_assert(0 == INVALID_TYPE, "incorrect type enum");
- IPCParams ipc_params = {tag};
- void* args[kMaxIpcParams];
- if (!GetArgs(params.get(), &ipc_params, args))
- return false;
- IPCInfo ipc_info = {tag};
- ipc_info.client_info = &service_context->target_info;
- Dispatcher* dispatcher = service_context->dispatcher;
- DCHECK(dispatcher);
- bool error = true;
- Dispatcher* handler = nullptr;
- Dispatcher::CallbackGeneric callback_generic;
- handler = dispatcher->OnMessageReady(&ipc_params, &callback_generic);
- if (handler) {
- switch (params->GetParamsCount()) {
- case 0: {
- // Ask the IPC dispatcher if it can service this IPC.
- Dispatcher::Callback0 callback =
- reinterpret_cast<Dispatcher::Callback0>(callback_generic);
- if (!(handler->*callback)(&ipc_info))
- break;
- error = false;
- break;
- }
- case 1: {
- Dispatcher::Callback1 callback =
- reinterpret_cast<Dispatcher::Callback1>(callback_generic);
- if (!(handler->*callback)(&ipc_info, args[0]))
- break;
- error = false;
- break;
- }
- case 2: {
- Dispatcher::Callback2 callback =
- reinterpret_cast<Dispatcher::Callback2>(callback_generic);
- if (!(handler->*callback)(&ipc_info, args[0], args[1]))
- break;
- error = false;
- break;
- }
- case 3: {
- Dispatcher::Callback3 callback =
- reinterpret_cast<Dispatcher::Callback3>(callback_generic);
- if (!(handler->*callback)(&ipc_info, args[0], args[1], args[2]))
- break;
- error = false;
- break;
- }
- case 4: {
- Dispatcher::Callback4 callback =
- reinterpret_cast<Dispatcher::Callback4>(callback_generic);
- if (!(handler->*callback)(&ipc_info, args[0], args[1], args[2],
- args[3]))
- break;
- error = false;
- break;
- }
- case 5: {
- Dispatcher::Callback5 callback =
- reinterpret_cast<Dispatcher::Callback5>(callback_generic);
- if (!(handler->*callback)(&ipc_info, args[0], args[1], args[2], args[3],
- args[4]))
- break;
- error = false;
- break;
- }
- case 6: {
- Dispatcher::Callback6 callback =
- reinterpret_cast<Dispatcher::Callback6>(callback_generic);
- if (!(handler->*callback)(&ipc_info, args[0], args[1], args[2], args[3],
- args[4], args[5]))
- break;
- error = false;
- break;
- }
- case 7: {
- Dispatcher::Callback7 callback =
- reinterpret_cast<Dispatcher::Callback7>(callback_generic);
- if (!(handler->*callback)(&ipc_info, args[0], args[1], args[2], args[3],
- args[4], args[5], args[6]))
- break;
- error = false;
- break;
- }
- case 8: {
- Dispatcher::Callback8 callback =
- reinterpret_cast<Dispatcher::Callback8>(callback_generic);
- if (!(handler->*callback)(&ipc_info, args[0], args[1], args[2], args[3],
- args[4], args[5], args[6], args[7]))
- break;
- error = false;
- break;
- }
- case 9: {
- Dispatcher::Callback9 callback =
- reinterpret_cast<Dispatcher::Callback9>(callback_generic);
- if (!(handler->*callback)(&ipc_info, args[0], args[1], args[2], args[3],
- args[4], args[5], args[6], args[7], args[8]))
- break;
- error = false;
- break;
- }
- default: {
- NOTREACHED();
- break;
- }
- }
- }
- if (error) {
- if (handler)
- SetCallError(SBOX_ERROR_FAILED_IPC, call_result);
- } else {
- memcpy(call_result, &ipc_info.return_info, sizeof(*call_result));
- SetCallSuccess(call_result);
- if (params->IsInOut()) {
- // Maybe the params got changed by the broker. We need to upadte the
- // memory section.
- memcpy(ipc_buffer, params.get(), output_size);
- }
- }
- ReleaseArgs(&ipc_params, args);
- return !error;
- }
- // This function gets called by a thread from the thread pool when a
- // ping event fires. The context is the same as passed in the RegisterWait()
- // call above.
- void __stdcall SharedMemIPCServer::ThreadPingEventReady(void* context,
- unsigned char) {
- if (!context) {
- DCHECK(false);
- return;
- }
- ServerControl* service_context = reinterpret_cast<ServerControl*>(context);
- // Since the event fired, the channel *must* be busy. Change to kAckChannel
- // while we service it.
- LONG last_state = ::InterlockedCompareExchange(
- &service_context->channel->state, kAckChannel, kBusyChannel);
- if (kBusyChannel != last_state) {
- DCHECK(false);
- return;
- }
- // Prepare the result structure. At this point we will return some result
- // even if the IPC is invalid, malformed or has no handler.
- CrossCallReturn call_result = {0};
- void* buffer = service_context->channel_buffer;
- InvokeCallback(service_context, buffer, &call_result);
- // Copy the answer back into the channel and signal the pong event. This
- // should wake up the client so it can finish the ipc cycle.
- CrossCallParams* call_params = reinterpret_cast<CrossCallParams*>(buffer);
- memcpy(call_params->GetCallReturn(), &call_result, sizeof(call_result));
- ::InterlockedExchange(&service_context->channel->state, kAckChannel);
- ::SetEvent(service_context->pong_event.Get());
- }
- bool SharedMemIPCServer::MakeEvents(base::win::ScopedHandle* server_ping,
- base::win::ScopedHandle* server_pong,
- HANDLE* client_ping,
- HANDLE* client_pong) {
- // Note that the IPC client has no right to delete the events. That would
- // cause problems. The server *owns* the events.
- const DWORD kDesiredAccess = SYNCHRONIZE | EVENT_MODIFY_STATE;
- // The events are auto reset, and start not signaled.
- server_ping->Set(::CreateEventW(nullptr, false, false, nullptr));
- if (!::DuplicateHandle(::GetCurrentProcess(), server_ping->Get(),
- target_process_, client_ping, kDesiredAccess, false,
- 0)) {
- return false;
- }
- server_pong->Set(::CreateEventW(nullptr, false, false, nullptr));
- if (!::DuplicateHandle(::GetCurrentProcess(), server_pong->Get(),
- target_process_, client_pong, kDesiredAccess, false,
- 0)) {
- return false;
- }
- return true;
- }
- } // namespace sandbox
|