1 /* 2 * Copyright (c) 1995, 2018, Oracle and/or its affiliates. All rights reserved. 3 * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. 4 * 5 * This code is free software; you can redistribute it and/or modify it 6 * under the terms of the GNU General Public License version 2 only, as 7 * published by the Free Software Foundation. Oracle designates this 8 * particular file as subject to the "Classpath" exception as provided 9 * by Oracle in the LICENSE file that accompanied this code. 10 * 11 * This code is distributed in the hope that it will be useful, but WITHOUT 12 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or 13 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License 14 * version 2 for more details (a copy is included in the LICENSE file that 15 * accompanied this code). 16 * 17 * You should have received a copy of the GNU General Public License version 18 * 2 along with this work; if not, write to the Free Software Foundation, 19 * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. 20 * 21 * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA 22 * or visit www.oracle.com if you need additional information or have any 23 * questions. 24 */ 25 26 #undef _LARGEFILE64_SOURCE 27 #define _LARGEFILE64_SOURCE 1 28 29 #include "jni.h" 30 #include "jvm.h" 31 #include "jvm_md.h" 32 #include "jni_util.h" 33 #include "io_util.h" 34 35 /* 36 * Platform-specific support for java.lang.Process 37 */ 38 #include <assert.h> 39 #include <stddef.h> 40 #include <stdlib.h> 41 #include <sys/types.h> 42 #include <ctype.h> 43 #include <sys/wait.h> 44 #include <signal.h> 45 #include <string.h> 46 47 #include <spawn.h> 48 49 #include "childproc.h" 50 51 /* 52 * 53 * When starting a child on Unix, we need to do three things: 54 * - fork off 55 * - in the child process, do some pre-exec work: duping/closing file 56 * descriptors to set up stdio-redirection, setting environment variables, 57 * changing paths... 58 * - then exec(2) the target binary 59 * 60 * There are three ways to fork off: 61 * 62 * A) fork(2). Portable and safe (no side effects) but may fail with ENOMEM on 63 * all Unices when invoked from a VM with a high memory footprint. On Unices 64 * with strict no-overcommit policy this problem is most visible. 65 * 66 * This is because forking the VM will first create a child process with 67 * theoretically the same memory footprint as the parent - even if you plan 68 * to follow up with exec'ing a tiny binary. In reality techniques like 69 * copy-on-write etc mitigate the problem somewhat but we still run the risk 70 * of hitting system limits. 71 * 72 * For a Linux centric description of this problem, see the documentation on 73 * /proc/sys/vm/overcommit_memory in Linux proc(5). 74 * 75 * B) vfork(2): Portable and fast but very unsafe. It bypasses the memory 76 * problems related to fork(2) by starting the child in the memory image of 77 * the parent. Things that can go wrong include: 78 * - Programming errors in the child process before the exec(2) call may 79 * trash memory in the parent process, most commonly the stack of the 80 * thread invoking vfork. 81 * - Signals received by the child before the exec(2) call may be at best 82 * misdirected to the parent, at worst immediately kill child and parent. 83 * 84 * This is mitigated by very strict rules about what one is allowed to do in 85 * the child process between vfork(2) and exec(2), which is basically nothing. 86 * However, we always broke this rule by doing the pre-exec work between 87 * vfork(2) and exec(2). 88 * 89 * Also note that vfork(2) has been deprecated by the OpenGroup, presumably 90 * because of its many dangers. 91 * 92 * C) clone(2): This is a Linux specific call which gives the caller fine 93 * grained control about how exactly the process fork is executed. It is 94 * powerful, but Linux-specific. 95 * 96 * Aside from these three possibilities there is a forth option: posix_spawn(3). 97 * Where fork/vfork/clone all fork off the process and leave pre-exec work and 98 * calling exec(2) to the user, posix_spawn(3) offers the user fork+exec-like 99 * functionality in one package, similar to CreateProcess() on Windows. 100 * 101 * It is not a system call in itself, but usually a wrapper implemented within 102 * the libc in terms of one of (fork|vfork|clone)+exec - so whether or not it 103 * has advantages over calling the naked (fork|vfork|clone) functions depends 104 * on how posix_spawn(3) is implemented. 105 * 106 * Note that when using posix_spawn(3), we exec twice: first a tiny binary called 107 * the jspawnhelper, then in the jspawnhelper we do the pre-exec work and exec a 108 * second time, this time the target binary (similar to the "exec-twice-technique" 109 * described in http://mail.openjdk.java.net/pipermail/core-libs-dev/2018-September/055333.html). 110 * 111 * This is a JDK-specific implementation detail which just happens to be 112 * implemented for jdk.lang.Process.launchMechanism=POSIX_SPAWN. 113 * 114 * --- Linux-specific --- 115 * 116 * How does glibc implement posix_spawn? 117 * (see: sysdeps/posix/spawni.c for glibc < 2.24, 118 * sysdeps/unix/sysv/linux/spawni.c for glibc >= 2.24): 119 * 120 * 1) Before glibc 2.4 (released 2006), posix_spawn(3) used just fork(2)/exec(2). 121 * This would be bad for the JDK since we would risk the known memory issues with 122 * fork(2). But since this only affects glibc variants which have long been 123 * phased out by modern distributions, this is irrelevant. 124 * 125 * 2) Between glibc 2.4 and glibc 2.23, posix_spawn uses either fork(2) or 126 * vfork(2) depending on how exactly the user called posix_spawn(3): 127 * 128 * <quote> 129 * The child process is created using vfork(2) instead of fork(2) when 130 * either of the following is true: 131 * 132 * * the spawn-flags element of the attributes object pointed to by 133 * attrp contains the GNU-specific flag POSIX_SPAWN_USEVFORK; or 134 * 135 * * file_actions is NULL and the spawn-flags element of the attributes 136 * object pointed to by attrp does not contain 137 * POSIX_SPAWN_SETSIGMASK, POSIX_SPAWN_SETSIGDEF, 138 * POSIX_SPAWN_SETSCHEDPARAM, POSIX_SPAWN_SETSCHEDULER, 139 * POSIX_SPAWN_SETPGROUP, or POSIX_SPAWN_RESETIDS. 140 * </quote> 141 * 142 * Due to the way the JDK calls posix_spawn(3), it would therefore call vfork(2). 143 * So we would avoid the fork(2) memory problems. However, there still remains the 144 * risk associated with vfork(2). But it is smaller than were we to call vfork(2) 145 * directly since we use the jspawnhelper, moving all pre-exec work off to after 146 * the first exec, thereby reducing the vulnerable time window. 147 * 148 * 3) Since glibc >= 2.24, glibc uses clone+exec: 149 * 150 * new_pid = CLONE (__spawni_child, STACK (stack, stack_size), stack_size, 151 * CLONE_VM | CLONE_VFORK | SIGCHLD, &args); 152 * 153 * This is even better than (2): 154 * 155 * CLONE_VM means we run in the parent's memory image, as with (2) 156 * CLONE_VFORK means parent waits until we exec, as with (2) 157 * 158 * However, error possibilities are further reduced since: 159 * - posix_spawn(3) passes a separate stack for the child to run on, eliminating 160 * the danger of trashing the forking thread's stack in the parent process. 161 * - posix_spawn(3) takes care to temporarily block all incoming signals to the 162 * child process until the first exec(2) has been called, 163 * 164 * TL;DR 165 * Calling posix_spawn(3) for glibc 166 * (2) < 2.24 is not perfect but still better than using plain vfork(2), since 167 * the chance of an error happening is greatly reduced 168 * (3) >= 2.24 is the best option - portable, fast and as safe as possible. 169 * 170 * --- 171 * 172 * How does muslc implement posix_spawn? 173 * 174 * They always did use the clone (.. CLONE_VM | CLONE_VFORK ...) 175 * technique. So we are safe to use posix_spawn() here regardless of muslc 176 * version. 177 * 178 * </Linux-specific> 179 * 180 * 181 * Based on the above analysis, we are currently defaulting to posix_spawn() 182 * on all Unices including Linux. 183 */ 184 185 static void 186 setSIGCHLDHandler(JNIEnv *env) 187 { 188 /* There is a subtle difference between having the signal handler 189 * for SIGCHLD be SIG_DFL and SIG_IGN. We cannot obtain process 190 * termination information for child processes if the signal 191 * handler is SIG_IGN. It must be SIG_DFL. 192 * 193 * We used to set the SIGCHLD handler only on Linux, but it's 194 * safest to set it unconditionally. 195 * 196 * Consider what happens if java's parent process sets the SIGCHLD 197 * handler to SIG_IGN. Normally signal handlers are inherited by 198 * children, but SIGCHLD is a controversial case. Solaris appears 199 * to always reset it to SIG_DFL, but this behavior may be 200 * non-standard-compliant, and we shouldn't rely on it. 201 * 202 * References: 203 * http://www.opengroup.org/onlinepubs/7908799/xsh/exec.html 204 * http://www.pasc.org/interps/unofficial/db/p1003.1/pasc-1003.1-132.html 205 */ 206 struct sigaction sa; 207 sa.sa_handler = SIG_DFL; 208 sigemptyset(&sa.sa_mask); 209 sa.sa_flags = SA_NOCLDSTOP | SA_RESTART; 210 if (sigaction(SIGCHLD, &sa, NULL) < 0) 211 JNU_ThrowInternalError(env, "Can't set SIGCHLD handler"); 212 } 213 214 static void* 215 xmalloc(JNIEnv *env, size_t size) 216 { 217 void *p = malloc(size); 218 if (p == NULL) 219 JNU_ThrowOutOfMemoryError(env, NULL); 220 return p; 221 } 222 223 #define NEW(type, n) ((type *) xmalloc(env, (n) * sizeof(type))) 224 225 /** 226 * If PATH is not defined, the OS provides some default value. 227 * Unfortunately, there's no portable way to get this value. 228 * Fortunately, it's only needed if the child has PATH while we do not. 229 */ 230 static const char* 231 defaultPath(void) 232 { 233 #ifdef __solaris__ 234 /* These really are the Solaris defaults! */ 235 return (geteuid() == 0 || getuid() == 0) ? 236 "/usr/xpg4/bin:/usr/bin:/opt/SUNWspro/bin:/usr/sbin" : 237 "/usr/xpg4/bin:/usr/bin:/opt/SUNWspro/bin:"; 238 #else 239 return ":/bin:/usr/bin"; /* glibc */ 240 #endif 241 } 242 243 static const char* 244 effectivePath(void) 245 { 246 const char *s = getenv("PATH"); 247 return (s != NULL) ? s : defaultPath(); 248 } 249 250 static int 251 countOccurrences(const char *s, char c) 252 { 253 int count; 254 for (count = 0; *s != '\0'; s++) 255 count += (*s == c); 256 return count; 257 } 258 259 static const char * const * 260 effectivePathv(JNIEnv *env) 261 { 262 char *p; 263 int i; 264 const char *path = effectivePath(); 265 int count = countOccurrences(path, ':') + 1; 266 size_t pathvsize = sizeof(const char *) * (count+1); 267 size_t pathsize = strlen(path) + 1; 268 const char **pathv = (const char **) xmalloc(env, pathvsize + pathsize); 269 270 if (pathv == NULL) 271 return NULL; 272 p = (char *) pathv + pathvsize; 273 memcpy(p, path, pathsize); 274 /* split PATH by replacing ':' with NULs; empty components => "." */ 275 for (i = 0; i < count; i++) { 276 char *q = p + strcspn(p, ":"); 277 pathv[i] = (p == q) ? "." : p; 278 *q = '\0'; 279 p = q + 1; 280 } 281 pathv[count] = NULL; 282 return pathv; 283 } 284 285 JNIEXPORT void JNICALL 286 Java_java_lang_ProcessImpl_init(JNIEnv *env, jclass clazz) 287 { 288 parentPathv = effectivePathv(env); 289 CHECK_NULL(parentPathv); 290 setSIGCHLDHandler(env); 291 } 292 293 294 #ifndef WIFEXITED 295 #define WIFEXITED(status) (((status)&0xFF) == 0) 296 #endif 297 298 #ifndef WEXITSTATUS 299 #define WEXITSTATUS(status) (((status)>>8)&0xFF) 300 #endif 301 302 #ifndef WIFSIGNALED 303 #define WIFSIGNALED(status) (((status)&0xFF) > 0 && ((status)&0xFF00) == 0) 304 #endif 305 306 #ifndef WTERMSIG 307 #define WTERMSIG(status) ((status)&0x7F) 308 #endif 309 310 static const char * 311 getBytes(JNIEnv *env, jbyteArray arr) 312 { 313 return arr == NULL ? NULL : 314 (const char*) (*env)->GetByteArrayElements(env, arr, NULL); 315 } 316 317 static void 318 releaseBytes(JNIEnv *env, jbyteArray arr, const char* parr) 319 { 320 if (parr != NULL) 321 (*env)->ReleaseByteArrayElements(env, arr, (jbyte*) parr, JNI_ABORT); 322 } 323 324 #define IOE_FORMAT "error=%d, %s" 325 326 static void 327 throwIOException(JNIEnv *env, int errnum, const char *defaultDetail) 328 { 329 const char *detail = defaultDetail; 330 char *errmsg; 331 size_t fmtsize; 332 char tmpbuf[1024]; 333 jstring s; 334 335 if (errnum != 0) { 336 int ret = getErrorString(errnum, tmpbuf, sizeof(tmpbuf)); 337 if (ret != EINVAL) 338 detail = tmpbuf; 339 } 340 /* ASCII Decimal representation uses 2.4 times as many bits as binary. */ 341 fmtsize = sizeof(IOE_FORMAT) + strlen(detail) + 3 * sizeof(errnum); 342 errmsg = NEW(char, fmtsize); 343 if (errmsg == NULL) 344 return; 345 346 snprintf(errmsg, fmtsize, IOE_FORMAT, errnum, detail); 347 s = JNU_NewStringPlatform(env, errmsg); 348 if (s != NULL) { 349 jobject x = JNU_NewObjectByName(env, "java/io/IOException", 350 "(Ljava/lang/String;)V", s); 351 if (x != NULL) 352 (*env)->Throw(env, x); 353 } 354 free(errmsg); 355 } 356 357 /** 358 * Throws an IOException with a message composed from the result of waitpid status. 359 */ 360 static void throwExitCause(JNIEnv *env, int pid, int status) { 361 char ebuf[128]; 362 if (WIFEXITED(status)) { 363 snprintf(ebuf, sizeof ebuf, 364 "Failed to exec spawn helper: pid: %d, exit value: %d", 365 pid, WEXITSTATUS(status)); 366 } else if (WIFSIGNALED(status)) { 367 snprintf(ebuf, sizeof ebuf, 368 "Failed to exec spawn helper: pid: %d, signal: %d", 369 pid, WTERMSIG(status)); 370 } else { 371 snprintf(ebuf, sizeof ebuf, 372 "Failed to exec spawn helper: pid: %d, status: 0x%08x", 373 pid, status); 374 } 375 throwIOException(env, 0, ebuf); 376 } 377 378 #ifdef DEBUG_PROCESS 379 /* Debugging process code is difficult; where to write debug output? */ 380 static void 381 debugPrint(char *format, ...) 382 { 383 FILE *tty = fopen("/dev/tty", "w"); 384 va_list ap; 385 va_start(ap, format); 386 vfprintf(tty, format, ap); 387 va_end(ap); 388 fclose(tty); 389 } 390 #endif /* DEBUG_PROCESS */ 391 392 static void 393 copyPipe(int from[2], int to[2]) 394 { 395 to[0] = from[0]; 396 to[1] = from[1]; 397 } 398 399 /* arg is an array of pointers to 0 terminated strings. array is terminated 400 * by a null element. 401 * 402 * *nelems and *nbytes receive the number of elements of array (incl 0) 403 * and total number of bytes (incl. 0) 404 * Note. An empty array will have one null element 405 * But if arg is null, then *nelems set to 0, and *nbytes to 0 406 */ 407 static void arraysize(const char * const *arg, int *nelems, int *nbytes) 408 { 409 int i, bytes, count; 410 const char * const *a = arg; 411 char *p; 412 int *q; 413 if (arg == 0) { 414 *nelems = 0; 415 *nbytes = 0; 416 return; 417 } 418 /* count the array elements and number of bytes */ 419 for (count=0, bytes=0; *a != 0; count++, a++) { 420 bytes += strlen(*a)+1; 421 } 422 *nbytes = bytes; 423 *nelems = count+1; 424 } 425 426 /* copy the strings from arg[] into buf, starting at given offset 427 * return new offset to next free byte 428 */ 429 static int copystrings(char *buf, int offset, const char * const *arg) { 430 char *p; 431 const char * const *a; 432 int count=0; 433 434 if (arg == 0) { 435 return offset; 436 } 437 for (p=buf+offset, a=arg; *a != 0; a++) { 438 int len = strlen(*a) +1; 439 memcpy(p, *a, len); 440 p += len; 441 count += len; 442 } 443 return offset+count; 444 } 445 446 /** 447 * We are unusually paranoid; use of vfork is 448 * especially likely to tickle gcc/glibc bugs. 449 */ 450 #ifdef __attribute_noinline__ /* See: sys/cdefs.h */ 451 __attribute_noinline__ 452 #endif 453 454 /* vfork(2) is deprecated on Solaris */ 455 #ifndef __solaris__ 456 static pid_t 457 vforkChild(ChildStuff *c) { 458 volatile pid_t resultPid; 459 460 /* 461 * We separate the call to vfork into a separate function to make 462 * very sure to keep stack of child from corrupting stack of parent, 463 * as suggested by the scary gcc warning: 464 * warning: variable 'foo' might be clobbered by 'longjmp' or 'vfork' 465 */ 466 resultPid = vfork(); 467 468 if (resultPid == 0) { 469 childProcess(c); 470 } 471 assert(resultPid != 0); /* childProcess never returns */ 472 return resultPid; 473 } 474 #endif 475 476 static pid_t 477 forkChild(ChildStuff *c) { 478 pid_t resultPid; 479 480 /* 481 * From Solaris fork(2): In Solaris 10, a call to fork() is 482 * identical to a call to fork1(); only the calling thread is 483 * replicated in the child process. This is the POSIX-specified 484 * behavior for fork(). 485 */ 486 resultPid = fork(); 487 488 if (resultPid == 0) { 489 childProcess(c); 490 } 491 assert(resultPid != 0); /* childProcess never returns */ 492 return resultPid; 493 } 494 495 static pid_t 496 spawnChild(JNIEnv *env, jobject process, ChildStuff *c, const char *helperpath) { 497 pid_t resultPid; 498 jboolean isCopy; 499 int i, offset, rval, bufsize, magic; 500 char *buf, buf1[16]; 501 char *hlpargs[2]; 502 SpawnInfo sp; 503 504 /* need to tell helper which fd is for receiving the childstuff 505 * and which fd to send response back on 506 */ 507 snprintf(buf1, sizeof(buf1), "%d:%d", c->childenv[0], c->fail[1]); 508 /* put the fd string as argument to the helper cmd */ 509 hlpargs[0] = buf1; 510 hlpargs[1] = 0; 511 512 /* Following items are sent down the pipe to the helper 513 * after it is spawned. 514 * All strings are null terminated. All arrays of strings 515 * have an empty string for termination. 516 * - the ChildStuff struct 517 * - the SpawnInfo struct 518 * - the argv strings array 519 * - the envv strings array 520 * - the home directory string 521 * - the parentPath string 522 * - the parentPathv array 523 */ 524 /* First calculate the sizes */ 525 arraysize(c->argv, &sp.nargv, &sp.argvBytes); 526 bufsize = sp.argvBytes; 527 arraysize(c->envv, &sp.nenvv, &sp.envvBytes); 528 bufsize += sp.envvBytes; 529 sp.dirlen = c->pdir == 0 ? 0 : strlen(c->pdir)+1; 530 bufsize += sp.dirlen; 531 arraysize(parentPathv, &sp.nparentPathv, &sp.parentPathvBytes); 532 bufsize += sp.parentPathvBytes; 533 /* We need to clear FD_CLOEXEC if set in the fds[]. 534 * Files are created FD_CLOEXEC in Java. 535 * Otherwise, they will be closed when the target gets exec'd */ 536 for (i=0; i<3; i++) { 537 if (c->fds[i] != -1) { 538 int flags = fcntl(c->fds[i], F_GETFD); 539 if (flags & FD_CLOEXEC) { 540 fcntl(c->fds[i], F_SETFD, flags & (~1)); 541 } 542 } 543 } 544 545 rval = posix_spawn(&resultPid, helperpath, 0, 0, (char * const *) hlpargs, environ); 546 547 if (rval != 0) { 548 return -1; 549 } 550 551 /* now the lengths are known, copy the data */ 552 buf = NEW(char, bufsize); 553 if (buf == 0) { 554 return -1; 555 } 556 offset = copystrings(buf, 0, &c->argv[0]); 557 offset = copystrings(buf, offset, &c->envv[0]); 558 memcpy(buf+offset, c->pdir, sp.dirlen); 559 offset += sp.dirlen; 560 offset = copystrings(buf, offset, parentPathv); 561 assert(offset == bufsize); 562 563 magic = magicNumber(); 564 565 /* write the two structs and the data buffer */ 566 write(c->childenv[1], (char *)&magic, sizeof(magic)); // magic number first 567 write(c->childenv[1], (char *)c, sizeof(*c)); 568 write(c->childenv[1], (char *)&sp, sizeof(sp)); 569 write(c->childenv[1], buf, bufsize); 570 free(buf); 571 572 /* In this mode an external main() in invoked which calls back into 573 * childProcess() in this file, rather than directly 574 * via the statement below */ 575 return resultPid; 576 } 577 578 /* 579 * Start a child process running function childProcess. 580 * This function only returns in the parent. 581 */ 582 static pid_t 583 startChild(JNIEnv *env, jobject process, ChildStuff *c, const char *helperpath) { 584 switch (c->mode) { 585 /* vfork(2) is deprecated on Solaris */ 586 #ifndef __solaris__ 587 case MODE_VFORK: 588 return vforkChild(c); 589 #endif 590 case MODE_FORK: 591 return forkChild(c); 592 case MODE_POSIX_SPAWN: 593 return spawnChild(env, process, c, helperpath); 594 default: 595 return -1; 596 } 597 } 598 599 JNIEXPORT jint JNICALL 600 Java_java_lang_ProcessImpl_forkAndExec(JNIEnv *env, 601 jobject process, 602 jint mode, 603 jbyteArray helperpath, 604 jbyteArray prog, 605 jbyteArray argBlock, jint argc, 606 jbyteArray envBlock, jint envc, 607 jbyteArray dir, 608 jintArray std_fds, 609 jboolean redirectErrorStream) 610 { 611 int errnum; 612 int resultPid = -1; 613 int in[2], out[2], err[2], fail[2], childenv[2]; 614 jint *fds = NULL; 615 const char *phelperpath = NULL; 616 const char *pprog = NULL; 617 const char *pargBlock = NULL; 618 const char *penvBlock = NULL; 619 ChildStuff *c; 620 621 in[0] = in[1] = out[0] = out[1] = err[0] = err[1] = fail[0] = fail[1] = -1; 622 childenv[0] = childenv[1] = -1; 623 624 if ((c = NEW(ChildStuff, 1)) == NULL) return -1; 625 c->argv = NULL; 626 c->envv = NULL; 627 c->pdir = NULL; 628 629 /* Convert prog + argBlock into a char ** argv. 630 * Add one word room for expansion of argv for use by 631 * execve_as_traditional_shell_script. 632 * This word is also used when using posix_spawn mode 633 */ 634 assert(prog != NULL && argBlock != NULL); 635 if ((phelperpath = getBytes(env, helperpath)) == NULL) goto Catch; 636 if ((pprog = getBytes(env, prog)) == NULL) goto Catch; 637 if ((pargBlock = getBytes(env, argBlock)) == NULL) goto Catch; 638 if ((c->argv = NEW(const char *, argc + 3)) == NULL) goto Catch; 639 c->argv[0] = pprog; 640 c->argc = argc + 2; 641 initVectorFromBlock(c->argv+1, pargBlock, argc); 642 643 if (envBlock != NULL) { 644 /* Convert envBlock into a char ** envv */ 645 if ((penvBlock = getBytes(env, envBlock)) == NULL) goto Catch; 646 if ((c->envv = NEW(const char *, envc + 1)) == NULL) goto Catch; 647 initVectorFromBlock(c->envv, penvBlock, envc); 648 } 649 650 if (dir != NULL) { 651 if ((c->pdir = getBytes(env, dir)) == NULL) goto Catch; 652 } 653 654 assert(std_fds != NULL); 655 fds = (*env)->GetIntArrayElements(env, std_fds, NULL); 656 if (fds == NULL) goto Catch; 657 658 if ((fds[0] == -1 && pipe(in) < 0) || 659 (fds[1] == -1 && pipe(out) < 0) || 660 (fds[2] == -1 && pipe(err) < 0) || 661 (pipe(childenv) < 0) || 662 (pipe(fail) < 0)) { 663 throwIOException(env, errno, "Bad file descriptor"); 664 goto Catch; 665 } 666 c->fds[0] = fds[0]; 667 c->fds[1] = fds[1]; 668 c->fds[2] = fds[2]; 669 670 copyPipe(in, c->in); 671 copyPipe(out, c->out); 672 copyPipe(err, c->err); 673 copyPipe(fail, c->fail); 674 copyPipe(childenv, c->childenv); 675 676 c->redirectErrorStream = redirectErrorStream; 677 c->mode = mode; 678 679 /* In posix_spawn mode, require the child process to signal aliveness 680 * right after it comes up. This is because there are implementations of 681 * posix_spawn() which do not report failed exec()s back to the caller 682 * (e.g. glibc, see JDK-8223777). In those cases, the fork() will have 683 * worked and successfully started the child process, but the exec() will 684 * have failed. There is no way for us to distinguish this from a target 685 * binary just exiting right after start. 686 * 687 * Note that we could do this additional handshake in all modes but for 688 * prudence only do it when it is needed (in posix_spawn mode). */ 689 c->sendAlivePing = (mode == MODE_POSIX_SPAWN) ? 1 : 0; 690 691 resultPid = startChild(env, process, c, phelperpath); 692 assert(resultPid != 0); 693 694 if (resultPid < 0) { 695 switch (c->mode) { 696 case MODE_VFORK: 697 throwIOException(env, errno, "vfork failed"); 698 break; 699 case MODE_FORK: 700 throwIOException(env, errno, "fork failed"); 701 break; 702 case MODE_POSIX_SPAWN: 703 throwIOException(env, errno, "posix_spawn failed"); 704 break; 705 } 706 goto Catch; 707 } 708 close(fail[1]); fail[1] = -1; /* See: WhyCantJohnnyExec (childproc.c) */ 709 710 /* If we expect the child to ping aliveness, wait for it. */ 711 if (c->sendAlivePing) { 712 switch(readFully(fail[0], &errnum, sizeof(errnum))) { 713 case 0: /* First exec failed; */ 714 { 715 int tmpStatus = 0; 716 int p = waitpid(resultPid, &tmpStatus, 0); 717 throwExitCause(env, p, tmpStatus); 718 goto Catch; 719 } 720 case sizeof(errnum): 721 assert(errnum == CHILD_IS_ALIVE); 722 if (errnum != CHILD_IS_ALIVE) { 723 /* Should never happen since the first thing the spawn 724 * helper should do is to send an alive ping to the parent, 725 * before doing any subsequent work. */ 726 throwIOException(env, 0, "Bad code from spawn helper " 727 "(Failed to exec spawn helper)"); 728 goto Catch; 729 } 730 break; 731 default: 732 throwIOException(env, errno, "Read failed"); 733 goto Catch; 734 } 735 } 736 737 switch (readFully(fail[0], &errnum, sizeof(errnum))) { 738 case 0: break; /* Exec succeeded */ 739 case sizeof(errnum): 740 waitpid(resultPid, NULL, 0); 741 throwIOException(env, errnum, "Exec failed"); 742 goto Catch; 743 default: 744 throwIOException(env, errno, "Read failed"); 745 goto Catch; 746 } 747 748 fds[0] = (in [1] != -1) ? in [1] : -1; 749 fds[1] = (out[0] != -1) ? out[0] : -1; 750 fds[2] = (err[0] != -1) ? err[0] : -1; 751 752 Finally: 753 /* Always clean up the child's side of the pipes */ 754 closeSafely(in [0]); 755 closeSafely(out[1]); 756 closeSafely(err[1]); 757 758 /* Always clean up fail and childEnv descriptors */ 759 closeSafely(fail[0]); 760 closeSafely(fail[1]); 761 closeSafely(childenv[0]); 762 closeSafely(childenv[1]); 763 764 releaseBytes(env, helperpath, phelperpath); 765 releaseBytes(env, prog, pprog); 766 releaseBytes(env, argBlock, pargBlock); 767 releaseBytes(env, envBlock, penvBlock); 768 releaseBytes(env, dir, c->pdir); 769 770 free(c->argv); 771 free(c->envv); 772 free(c); 773 774 if (fds != NULL) 775 (*env)->ReleaseIntArrayElements(env, std_fds, fds, 0); 776 777 return resultPid; 778 779 Catch: 780 /* Clean up the parent's side of the pipes in case of failure only */ 781 closeSafely(in [1]); in[1] = -1; 782 closeSafely(out[0]); out[0] = -1; 783 closeSafely(err[0]); err[0] = -1; 784 goto Finally; 785 } 786