4 files changed, 192 insertions, 2 deletions

diff --git a/src/client/linux/microdump_writer/microdump_writer.cc b/src/client/linux/microdump_writer/microdump_writer.cc
index f45925fe..247387e2 100644
--- a/src/client/linux/microdump_writer/microdump_writer.cc
+++ b/src/client/linux/microdump_writer/microdump_writer.cc
@@ -86,7 +86,7 @@ class MicrodumpWriter {
     // try to not crash.
     if (!dumper_->Init() || !log_line_)
       return false;
-    return dumper_->ThreadsSuspend();
+    return dumper_->ThreadsSuspend() && dumper_->LateInit();
   }
 
   bool Dump() {
diff --git a/src/client/linux/minidump_writer/linux_dumper.cc b/src/client/linux/minidump_writer/linux_dumper.cc
index ebb008d6..00d18189 100644
--- a/src/client/linux/minidump_writer/linux_dumper.cc
+++ b/src/client/linux/minidump_writer/linux_dumper.cc
@@ -52,6 +52,22 @@
 #include "common/linux/safe_readlink.h"
 #include "third_party/lss/linux_syscall_support.h"
 
+#if defined(__ANDROID__)
+
+// Android packed relocations definitions are not yet available from the
+// NDK header files, so we have to provide them manually here.
+#ifndef DT_LOOS
+#define DT_LOOS 0x6000000d
+#endif
+#ifndef DT_ANDROID_REL
+static const int DT_ANDROID_REL = DT_LOOS + 2;
+#endif
+#ifndef DT_ANDROID_RELA
+static const int DT_ANDROID_RELA = DT_LOOS + 4;
+#endif
+
+#endif  // __ANDROID __
+
 static const char kMappedFileUnsafePrefix[] = "/dev/";
 static const char kDeletedSuffix[] = " (deleted)";
 static const char kReservedFlags[] = " ---p";
@@ -92,6 +108,13 @@ bool LinuxDumper::Init() {
   return ReadAuxv() && EnumerateThreads() && EnumerateMappings();
 }
 
+bool LinuxDumper::LateInit() {
+#if defined(__ANDROID__)
+  LatePostprocessMappings();
+#endif
+  return true;
+}
+
 bool
 LinuxDumper::ElfFileIdentifierForMapping(const MappingInfo& mapping,
                                          bool member,
@@ -395,6 +418,108 @@ bool LinuxDumper::EnumerateMappings() {
   return !mappings_.empty();
 }
 
+#if defined(__ANDROID__)
+
+bool LinuxDumper::GetLoadedElfHeader(uintptr_t start_addr, ElfW(Ehdr)* ehdr) {
+  CopyFromProcess(ehdr, pid_,
+                  reinterpret_cast<const void*>(start_addr),
+                  sizeof(*ehdr));
+  return my_memcmp(&ehdr->e_ident, ELFMAG, SELFMAG) == 0;
+}
+
+void LinuxDumper::ParseLoadedElfProgramHeaders(ElfW(Ehdr)* ehdr,
+                                               uintptr_t start_addr,
+                                               uintptr_t* min_vaddr_ptr,
+                                               uintptr_t* dyn_vaddr_ptr,
+                                               size_t* dyn_count_ptr) {
+  uintptr_t phdr_addr = start_addr + ehdr->e_phoff;
+
+  const uintptr_t max_addr = UINTPTR_MAX;
+  uintptr_t min_vaddr = max_addr;
+  uintptr_t dyn_vaddr = 0;
+  size_t dyn_count = 0;
+
+  for (size_t i = 0; i < ehdr->e_phnum; ++i) {
+    ElfW(Phdr) phdr;
+    CopyFromProcess(&phdr, pid_,
+                    reinterpret_cast<const void*>(phdr_addr),
+                    sizeof(phdr));
+    if (phdr.p_type == PT_LOAD && phdr.p_vaddr < min_vaddr) {
+      min_vaddr = phdr.p_vaddr;
+    }
+    if (phdr.p_type == PT_DYNAMIC) {
+      dyn_vaddr = phdr.p_vaddr;
+      dyn_count = phdr.p_memsz / sizeof(ElfW(Dyn));
+    }
+    phdr_addr += sizeof(phdr);
+  }
+
+  *min_vaddr_ptr = min_vaddr;
+  *dyn_vaddr_ptr = dyn_vaddr;
+  *dyn_count_ptr = dyn_count;
+}
+
+bool LinuxDumper::HasAndroidPackedRelocations(uintptr_t load_bias,
+                                              uintptr_t dyn_vaddr,
+                                              size_t dyn_count) {
+  uintptr_t dyn_addr = load_bias + dyn_vaddr;
+  for (size_t i = 0; i < dyn_count; ++i) {
+    ElfW(Dyn) dyn;
+    CopyFromProcess(&dyn, pid_,
+                    reinterpret_cast<const void*>(dyn_addr),
+                    sizeof(dyn));
+    if (dyn.d_tag == DT_ANDROID_REL || dyn.d_tag == DT_ANDROID_RELA) {
+      return true;
+    }
+    dyn_addr += sizeof(dyn);
+  }
+  return false;
+}
+
+uintptr_t LinuxDumper::GetEffectiveLoadBias(ElfW(Ehdr)* ehdr,
+                                            uintptr_t start_addr) {
+  uintptr_t min_vaddr = 0;
+  uintptr_t dyn_vaddr = 0;
+  size_t dyn_count = 0;
+  ParseLoadedElfProgramHeaders(ehdr, start_addr,
+                               &min_vaddr, &dyn_vaddr, &dyn_count);
+  // If |min_vaddr| is non-zero and we find Android packed relocation tags,
+  // return the effective load bias.
+  if (min_vaddr != 0) {
+    const uintptr_t load_bias = start_addr - min_vaddr;
+    if (HasAndroidPackedRelocations(load_bias, dyn_vaddr, dyn_count)) {
+      return load_bias;
+    }
+  }
+  // Either |min_vaddr| is zero, or it is non-zero but we did not find the
+  // expected Android packed relocations tags.
+  return start_addr;
+}
+
+void LinuxDumper::LatePostprocessMappings() {
+  for (size_t i = 0; i < mappings_.size(); ++i) {
+    // Only consider exec mappings that indicate a file path was mapped, and
+    // where the ELF header indicates a mapped shared library.
+    MappingInfo* mapping = mappings_[i];
+    if (!(mapping->exec && mapping->name[0] == '/')) {
+      continue;
+    }
+    ElfW(Ehdr) ehdr;
+    if (!GetLoadedElfHeader(mapping->start_addr, &ehdr)) {
+      continue;
+    }
+    if (ehdr.e_type == ET_DYN) {
+      // Compute the effective load bias for this mapped library, and update
+      // the mapping to hold that rather than |start_addr|. Where the library
+      // does not contain Android packed relocations, GetEffectiveLoadBias()
+      // returns |start_addr| and the mapping entry is not changed.
+      mapping->start_addr = GetEffectiveLoadBias(&ehdr, mapping->start_addr);
+    }
+  }
+}
+
+#endif  // __ANDROID__
+
 // Get information about the stack, given the stack pointer. We don't try to
 // walk the stack since we might not have all the information needed to do
 // unwind. So we just grab, up to, 32k of stack.
diff --git a/src/client/linux/minidump_writer/linux_dumper.h b/src/client/linux/minidump_writer/linux_dumper.h
index 87dfadb4..6a3a100f 100644
--- a/src/client/linux/minidump_writer/linux_dumper.h
+++ b/src/client/linux/minidump_writer/linux_dumper.h
@@ -39,6 +39,9 @@
 #define CLIENT_LINUX_MINIDUMP_WRITER_LINUX_DUMPER_H_
 
 #include <elf.h>
+#if defined(__ANDROID__)
+#include <link.h>
+#endif
 #include <linux/limits.h>
 #include <stdint.h>
 #include <sys/types.h>
@@ -76,6 +79,12 @@ class LinuxDumper {
   // Parse the data for |threads| and |mappings|.
   virtual bool Init();
 
+  // Take any actions that could not be taken in Init(). LateInit() is
+  // called after all other caller's initialization is complete, and in
+  // particular after it has called ThreadsSuspend(), so that ptrace is
+  // available.
+  virtual bool LateInit();
+
   // Return true if the dumper performs a post-mortem dump.
   virtual bool IsPostMortem() const = 0;
 
@@ -182,6 +191,62 @@ class LinuxDumper {
 
   // Info from /proc/<pid>/auxv
   wasteful_vector<elf_aux_val_t> auxv_;
+
+#if defined(__ANDROID__)
+ private:
+  // Android M and later support packed ELF relocations in shared libraries.
+  // Packing relocations changes the vaddr of the LOAD segments, such that
+  // the effective load bias is no longer the same as the start address of
+  // the memory mapping containing the executable parts of the library. The
+  // packing is applied to the stripped library run on the target, but not to
+  // any other library, and in particular not to the library used to generate
+  // breakpad symbols. As a result, we need to adjust the |start_addr| for
+  // any mapping that results from a shared library that contains Android
+  // packed relocations, so that it properly represents the effective library
+  // load bias. The following functions support this adjustment.
+
+  // Check that a given mapping at |start_addr| is for an ELF shared library.
+  // If it is, place the ELF header in |ehdr| and return true.
+  // The first LOAD segment in an ELF shared library has offset zero, so the
+  // ELF file header is at the start of this map entry, and in already mapped
+  // memory.
+  bool GetLoadedElfHeader(uintptr_t start_addr, ElfW(Ehdr)* ehdr);
+
+  // For the ELF file mapped at |start_addr|, iterate ELF program headers to
+  // find the min vaddr of all program header LOAD segments, the vaddr for
+  // the DYNAMIC segment, and a count of DYNAMIC entries. Return values in
+  // |min_vaddr_ptr|, |dyn_vaddr_ptr|, and |dyn_count_ptr|.
+  // The program header table is also in already mapped memory.
+  void ParseLoadedElfProgramHeaders(ElfW(Ehdr)* ehdr,
+                                    uintptr_t start_addr,
+                                    uintptr_t* min_vaddr_ptr,
+                                    uintptr_t* dyn_vaddr_ptr,
+                                    size_t* dyn_count_ptr);
+
+  // Search the DYNAMIC tags for the ELF file with the given |load_bias|, and
+  // return true if the tags indicate that the file contains Android packed
+  // relocations. Dynamic tags are found at |dyn_vaddr| past the |load_bias|.
+  bool HasAndroidPackedRelocations(uintptr_t load_bias,
+                                   uintptr_t dyn_vaddr,
+                                   size_t dyn_count);
+
+  // If the ELF file mapped at |start_addr| contained Android packed
+  // relocations, return the load bias that the system linker (or Chromium
+  // crazy linker) will have used. If the file did not contain Android
+  // packed relocations, returns |start_addr|, indicating that no adjustment
+  // is necessary.
+  // The effective load bias is |start_addr| adjusted downwards by the
+  // min vaddr in the library LOAD segments.
+  uintptr_t GetEffectiveLoadBias(ElfW(Ehdr)* ehdr, uintptr_t start_addr);
+
+  // Called from LateInit(). Iterates |mappings_| and rewrites the |start_addr|
+  // field of any that represent ELF shared libraries with Android packed
+  // relocations, so that |start_addr| is the load bias that the system linker
+  // (or Chromium crazy linker) used. This value matches the addresses produced
+  // when the non-relocation-packed library is used for breakpad symbol
+  // generation.
+  void LatePostprocessMappings();
+#endif  // __ANDROID__
 };
 
 }  // namespace google_breakpad
diff --git a/src/client/linux/minidump_writer/minidump_writer.cc b/src/client/linux/minidump_writer/minidump_writer.cc
index 0414bb72..9c1db99b 100644
--- a/src/client/linux/minidump_writer/minidump_writer.cc
+++ b/src/client/linux/minidump_writer/minidump_writer.cc
@@ -154,7 +154,7 @@ class MinidumpWriter {
     else if (!minidump_writer_.Open(path_))
       return false;
 
-    return dumper_->ThreadsSuspend();
+    return dumper_->ThreadsSuspend() && dumper_->LateInit();
   }
 
   ~MinidumpWriter() {