breakpad doesn't create a minidump when CONFIG_PAX_RANDMMAP is enabled

89 views
Skip to first unread message

Nikita Kozlov

unread,
Dec 1, 2015, 11:13:14 AM12/1/15
to google-brea...@googlegroups.com
Hello,

I was looking at why we had no minidumps for some of our crashes on some
servers and I found that it was because of the CONFIG_PAX_RANDMMAP Linux
kernel features from the PaX patchset.
I don't know if it was reported yet or if there is a known workaround for it.

I have tested it with several kernels, from 3.14.X to 4.2.X on gentoo and
debian.
My test program look like this :
```
newCExceptionHandlerSimple();
// from https://github.com/Gandi/breakpad-c-wrapper, C wrapper around
// google_breakpad::ExceptionHandler
fd = open(argv[1], O_RDONLY);
addr = mmap(NULL, 1, PROT_READ, MAP_PRIVATE, fd, 0);
ftruncate(fd, 0);
fd = getchar();
printf("%x\n", addr[0x4]); //SIGBUS
```
the output is :

```
$ LD_PRELOAD=./libgbc_c_wrapper.so ./sigbus emptyfile
ExceptionHandler::DoDump google_breakpad::WriteMinidump without FD
Dump path: /tmp/0599f86e-902f-a14d-27ee0962-2a123136.dmp
zsh: segmentation fault (core dumped) LD_PRELOAD=.//libgbc_c_wrapper.so ./sigbus emptyfile
```

The core dump doesn't appear to have anything useful strangely, the
stack is from my program and not breakpad.
Without CONFIG_PAX_RANDMMAP everything is working as expected.

I didn't took a look yet on where it was failing, I'm unfamiliar with
breakpad code and it look difficult to debug since I cannot attach a
debugger to it (or I'm missing something?).

Any idea on how to start to debug without a lot of printf or on where to
start looking would be really appreciated :)

Regards,

-- Nikita

Mike Frysinger

unread,
Dec 15, 2015, 12:09:10 PM12/15/15
to google-brea...@googlegroups.com
attaching a debugger should work fine even when using the in-process handlers

can you try disabling the handlers entirely and look at the coredump you get back, with & w/out randmmap enabled ?  then see if the coredumps have all the mappings you need.

you might want to try posting to the grsecurity forums too as they have much more experience with the kernel settings and possible non-obvious changes in behavior.
-mike


--
You received this message because you are subscribed to the Google Groups "google-breakpad-discuss" group.
To unsubscribe from this group and stop receiving emails from it, send an email to google-breakpad-d...@googlegroups.com.
To post to this group, send email to google-brea...@googlegroups.com.
Visit this group at http://groups.google.com/group/google-breakpad-discuss.
For more options, visit https://groups.google.com/d/optout.

Reply all
Reply to author
Forward
0 new messages