1 /*
2 * Copyright (C) 2009 The Android Open Source Project
3 * All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
7 * are met:
8 * * Redistributions of source code must retain the above copyright
9 * notice, this list of conditions and the following disclaimer.
10 * * Redistributions in binary form must reproduce the above copyright
11 * notice, this list of conditions and the following disclaimer in
12 * the documentation and/or other materials provided with the
13 * distribution.
14 *
15 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
16 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
17 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
18 * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
19 * COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
20 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
21 * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
22 * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
23 * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
24 * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
25 * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
26 * SUCH DAMAGE.
27 */
28
29 /*
30 * Contains definition of structures, global variables, and implementation of
31 * routines that are used by malloc leak detection code and other components in
32 * the system. The trick is that some components expect these data and
33 * routines to be defined / implemented in libc.so library, regardless
34 * whether or not MALLOC_LEAK_CHECK macro is defined. To make things even
35 * more tricky, malloc leak detection code, implemented in
36 * libc_malloc_debug.so also requires access to these variables and routines
37 * (to fill allocation entry hash table, for example). So, all relevant
38 * variables and routines are defined / implemented here and exported
39 * to all, leak detection code and other components via dynamic (libc.so),
40 * or static (libc.a) linking.
41 */
42
43 #include <stdlib.h>
44 #include <pthread.h>
45 #include <unistd.h>
46 #include "dlmalloc.h"
47 #include "malloc_debug_common.h"
48
49 /*
50 * In a VM process, this is set to 1 after fork()ing out of zygote.
51 */
52 int gMallocLeakZygoteChild = 0;
53
54 pthread_mutex_t gAllocationsMutex = PTHREAD_MUTEX_INITIALIZER;
55 HashTable gHashTable;
56
57 // =============================================================================
58 // output functions
59 // =============================================================================
60
hash_entry_compare(const void * arg1,const void * arg2)61 static int hash_entry_compare(const void* arg1, const void* arg2)
62 {
63 int result;
64
65 HashEntry* e1 = *(HashEntry**)arg1;
66 HashEntry* e2 = *(HashEntry**)arg2;
67
68 // if one or both arg pointers are null, deal gracefully
69 if (e1 == NULL) {
70 result = (e2 == NULL) ? 0 : 1;
71 } else if (e2 == NULL) {
72 result = -1;
73 } else {
74 size_t nbAlloc1 = e1->allocations;
75 size_t nbAlloc2 = e2->allocations;
76 size_t size1 = e1->size & ~SIZE_FLAG_MASK;
77 size_t size2 = e2->size & ~SIZE_FLAG_MASK;
78 size_t alloc1 = nbAlloc1 * size1;
79 size_t alloc2 = nbAlloc2 * size2;
80
81 // sort in descending order by:
82 // 1) total size
83 // 2) number of allocations
84 //
85 // This is used for sorting, not determination of equality, so we don't
86 // need to compare the bit flags.
87 if (alloc1 > alloc2) {
88 result = -1;
89 } else if (alloc1 < alloc2) {
90 result = 1;
91 } else {
92 if (nbAlloc1 > nbAlloc2) {
93 result = -1;
94 } else if (nbAlloc1 < nbAlloc2) {
95 result = 1;
96 } else {
97 result = 0;
98 }
99 }
100 }
101 return result;
102 }
103
104 /*
105 * Retrieve native heap information.
106 *
107 * "*info" is set to a buffer we allocate
108 * "*overallSize" is set to the size of the "info" buffer
109 * "*infoSize" is set to the size of a single entry
110 * "*totalMemory" is set to the sum of all allocations we're tracking; does
111 * not include heap overhead
112 * "*backtraceSize" is set to the maximum number of entries in the back trace
113 */
get_malloc_leak_info(uint8_t ** info,size_t * overallSize,size_t * infoSize,size_t * totalMemory,size_t * backtraceSize)114 void get_malloc_leak_info(uint8_t** info, size_t* overallSize,
115 size_t* infoSize, size_t* totalMemory, size_t* backtraceSize)
116 {
117 // don't do anything if we have invalid arguments
118 if (info == NULL || overallSize == NULL || infoSize == NULL ||
119 totalMemory == NULL || backtraceSize == NULL) {
120 return;
121 }
122 *totalMemory = 0;
123
124 pthread_mutex_lock(&gAllocationsMutex);
125
126 if (gHashTable.count == 0) {
127 *info = NULL;
128 *overallSize = 0;
129 *infoSize = 0;
130 *backtraceSize = 0;
131 goto done;
132 }
133
134 void** list = (void**)dlmalloc(sizeof(void*) * gHashTable.count);
135
136 // get the entries into an array to be sorted
137 int index = 0;
138 int i;
139 for (i = 0 ; i < HASHTABLE_SIZE ; i++) {
140 HashEntry* entry = gHashTable.slots[i];
141 while (entry != NULL) {
142 list[index] = entry;
143 *totalMemory = *totalMemory +
144 ((entry->size & ~SIZE_FLAG_MASK) * entry->allocations);
145 index++;
146 entry = entry->next;
147 }
148 }
149
150 // XXX: the protocol doesn't allow variable size for the stack trace (yet)
151 *infoSize = (sizeof(size_t) * 2) + (sizeof(intptr_t) * BACKTRACE_SIZE);
152 *overallSize = *infoSize * gHashTable.count;
153 *backtraceSize = BACKTRACE_SIZE;
154
155 // now get A byte array big enough for this
156 *info = (uint8_t*)dlmalloc(*overallSize);
157
158 if (*info == NULL) {
159 *overallSize = 0;
160 goto out_nomem_info;
161 }
162
163 qsort((void*)list, gHashTable.count, sizeof(void*), hash_entry_compare);
164
165 uint8_t* head = *info;
166 const int count = gHashTable.count;
167 for (i = 0 ; i < count ; i++) {
168 HashEntry* entry = list[i];
169 size_t entrySize = (sizeof(size_t) * 2) + (sizeof(intptr_t) * entry->numEntries);
170 if (entrySize < *infoSize) {
171 /* we're writing less than a full entry, clear out the rest */
172 memset(head + entrySize, 0, *infoSize - entrySize);
173 } else {
174 /* make sure the amount we're copying doesn't exceed the limit */
175 entrySize = *infoSize;
176 }
177 memcpy(head, &(entry->size), entrySize);
178 head += *infoSize;
179 }
180
181 out_nomem_info:
182 dlfree(list);
183
184 done:
185 pthread_mutex_unlock(&gAllocationsMutex);
186 }
187
free_malloc_leak_info(uint8_t * info)188 void free_malloc_leak_info(uint8_t* info)
189 {
190 dlfree(info);
191 }
192
mallinfo()193 struct mallinfo mallinfo()
194 {
195 return dlmallinfo();
196 }
197
valloc(size_t bytes)198 void* valloc(size_t bytes) {
199 /* assume page size of 4096 bytes */
200 return memalign( getpagesize(), bytes );
201 }
202
203 /* Support for malloc debugging.
204 * Note that if USE_DL_PREFIX is not defined, it's assumed that memory
205 * allocation routines are implemented somewhere else, so all our custom
206 * malloc routines should not be compiled at all.
207 */
208 #ifdef USE_DL_PREFIX
209
210 /* Table for dispatching malloc calls, initialized with default dispatchers. */
211 const MallocDebug __libc_malloc_default_dispatch __attribute__((aligned(32))) =
212 {
213 dlmalloc, dlfree, dlcalloc, dlrealloc, dlmemalign
214 };
215
216 /* Selector of dispatch table to use for dispatching malloc calls. */
217 const MallocDebug* __libc_malloc_dispatch = &__libc_malloc_default_dispatch;
218
malloc(size_t bytes)219 void* malloc(size_t bytes) {
220 return __libc_malloc_dispatch->malloc(bytes);
221 }
free(void * mem)222 void free(void* mem) {
223 __libc_malloc_dispatch->free(mem);
224 }
calloc(size_t n_elements,size_t elem_size)225 void* calloc(size_t n_elements, size_t elem_size) {
226 return __libc_malloc_dispatch->calloc(n_elements, elem_size);
227 }
realloc(void * oldMem,size_t bytes)228 void* realloc(void* oldMem, size_t bytes) {
229 return __libc_malloc_dispatch->realloc(oldMem, bytes);
230 }
memalign(size_t alignment,size_t bytes)231 void* memalign(size_t alignment, size_t bytes) {
232 return __libc_malloc_dispatch->memalign(alignment, bytes);
233 }
234
235 /* We implement malloc debugging only in libc.so, so code bellow
236 * must be excluded if we compile this file for static libc.a
237 */
238 #ifndef LIBC_STATIC
239 #include <sys/system_properties.h>
240 #include <dlfcn.h>
241 #include "logd.h"
242
243 /* Table for dispatching malloc calls, depending on environment. */
244 static MallocDebug gMallocUse __attribute__((aligned(32))) = {
245 dlmalloc, dlfree, dlcalloc, dlrealloc, dlmemalign
246 };
247
248 extern char* __progname;
249
250 /* Handle to shared library where actual memory allocation is implemented.
251 * This library is loaded and memory allocation calls are redirected there
252 * when libc.debug.malloc environment variable contains value other than
253 * zero:
254 * 1 - For memory leak detections.
255 * 5 - For filling allocated / freed memory with patterns defined by
256 * CHK_SENTINEL_VALUE, and CHK_FILL_FREE macros.
257 * 10 - For adding pre-, and post- allocation stubs in order to detect
258 * buffer overruns.
259 * Note that emulator's memory allocation instrumentation is not controlled by
260 * libc.debug.malloc value, but rather by emulator, started with -memcheck
261 * option. Note also, that if emulator has started with -memcheck option,
262 * emulator's instrumented memory allocation will take over value saved in
263 * libc.debug.malloc. In other words, if emulator has started with -memcheck
264 * option, libc.debug.malloc value is ignored.
265 * Actual functionality for debug levels 1-10 is implemented in
266 * libc_malloc_debug_leak.so, while functionality for emultor's instrumented
267 * allocations is implemented in libc_malloc_debug_qemu.so and can be run inside
268 * the emulator only.
269 */
270 static void* libc_malloc_impl_handle = NULL;
271
272 /* Make sure we have MALLOC_ALIGNMENT that matches the one that is
273 * used in dlmalloc. Emulator's memchecker needs this value to properly
274 * align its guarding zones.
275 */
276 #ifndef MALLOC_ALIGNMENT
277 #define MALLOC_ALIGNMENT ((size_t)8U)
278 #endif /* MALLOC_ALIGNMENT */
279
280 /* This variable is set to the value of property libc.debug.malloc.backlog,
281 * when the value of libc.debug.malloc = 10. It determines the size of the
282 * backlog we use to detect multiple frees. If the property is not set, the
283 * backlog length defaults to an internal constant defined in
284 * malloc_debug_check.c
285 */
286 unsigned int malloc_double_free_backlog;
287
288 /* Initializes memory allocation framework once per process. */
malloc_init_impl(void)289 static void malloc_init_impl(void)
290 {
291 const char* so_name = NULL;
292 MallocDebugInit malloc_debug_initialize = NULL;
293 unsigned int qemu_running = 0;
294 unsigned int debug_level = 0;
295 unsigned int memcheck_enabled = 0;
296 char env[PROP_VALUE_MAX];
297 char memcheck_tracing[PROP_VALUE_MAX];
298 char debug_program[PROP_VALUE_MAX];
299
300 /* Get custom malloc debug level. Note that emulator started with
301 * memory checking option will have priority over debug level set in
302 * libc.debug.malloc system property. */
303 if (__system_property_get("ro.kernel.qemu", env) && atoi(env)) {
304 qemu_running = 1;
305 if (__system_property_get("ro.kernel.memcheck", memcheck_tracing)) {
306 if (memcheck_tracing[0] != '0') {
307 // Emulator has started with memory tracing enabled. Enforce it.
308 debug_level = 20;
309 memcheck_enabled = 1;
310 }
311 }
312 }
313
314 /* If debug level has not been set by memcheck option in the emulator,
315 * lets grab it from libc.debug.malloc system property. */
316 if (!debug_level && __system_property_get("libc.debug.malloc", env)) {
317 debug_level = atoi(env);
318 }
319
320 /* Debug level 0 means that we should use dlxxx allocation
321 * routines (default). */
322 if (!debug_level) {
323 return;
324 }
325
326 /* If libc.debug.malloc.program is set and is not a substring of progname,
327 * then exit.
328 */
329 if (__system_property_get("libc.debug.malloc.program", debug_program)) {
330 if (!strstr(__progname, debug_program)) {
331 return;
332 }
333 }
334
335 // Lets see which .so must be loaded for the requested debug level
336 switch (debug_level) {
337 case 1:
338 case 5:
339 case 10: {
340 char debug_backlog[PROP_VALUE_MAX];
341 if (__system_property_get("libc.debug.malloc.backlog", debug_backlog)) {
342 malloc_double_free_backlog = atoi(debug_backlog);
343 info_log("%s: setting backlog length to %d\n",
344 __progname, malloc_double_free_backlog);
345 }
346
347 so_name = "/system/lib/libc_malloc_debug_leak.so";
348 break;
349 }
350 case 20:
351 // Quick check: debug level 20 can only be handled in emulator.
352 if (!qemu_running) {
353 error_log("%s: Debug level %d can only be set in emulator\n",
354 __progname, debug_level);
355 return;
356 }
357 // Make sure that memory checking has been enabled in emulator.
358 if (!memcheck_enabled) {
359 error_log("%s: Memory checking is not enabled in the emulator\n",
360 __progname);
361 return;
362 }
363 so_name = "/system/lib/libc_malloc_debug_qemu.so";
364 break;
365 default:
366 error_log("%s: Debug level %d is unknown\n",
367 __progname, debug_level);
368 return;
369 }
370
371 // Load .so that implements the required malloc debugging functionality.
372 libc_malloc_impl_handle = dlopen(so_name, RTLD_LAZY);
373 if (libc_malloc_impl_handle == NULL) {
374 error_log("%s: Missing module %s required for malloc debug level %d\n",
375 __progname, so_name, debug_level);
376 return;
377 }
378
379 // Initialize malloc debugging in the loaded module.
380 malloc_debug_initialize =
381 dlsym(libc_malloc_impl_handle, "malloc_debug_initialize");
382 if (malloc_debug_initialize == NULL) {
383 error_log("%s: Initialization routine is not found in %s\n",
384 __progname, so_name);
385 dlclose(libc_malloc_impl_handle);
386 return;
387 }
388 if (malloc_debug_initialize()) {
389 dlclose(libc_malloc_impl_handle);
390 return;
391 }
392
393 if (debug_level == 20) {
394 // For memory checker we need to do extra initialization.
395 int (*memcheck_initialize)(int, const char*) =
396 dlsym(libc_malloc_impl_handle, "memcheck_initialize");
397 if (memcheck_initialize == NULL) {
398 error_log("%s: memcheck_initialize routine is not found in %s\n",
399 __progname, so_name);
400 dlclose(libc_malloc_impl_handle);
401 return;
402 }
403 if (memcheck_initialize(MALLOC_ALIGNMENT, memcheck_tracing)) {
404 dlclose(libc_malloc_impl_handle);
405 return;
406 }
407 }
408
409 // Initialize malloc dispatch table with appropriate routines.
410 switch (debug_level) {
411 case 1:
412 __libc_android_log_print(ANDROID_LOG_INFO, "libc",
413 "%s using MALLOC_DEBUG = %d (leak checker)\n",
414 __progname, debug_level);
415 gMallocUse.malloc =
416 dlsym(libc_malloc_impl_handle, "leak_malloc");
417 gMallocUse.free =
418 dlsym(libc_malloc_impl_handle, "leak_free");
419 gMallocUse.calloc =
420 dlsym(libc_malloc_impl_handle, "leak_calloc");
421 gMallocUse.realloc =
422 dlsym(libc_malloc_impl_handle, "leak_realloc");
423 gMallocUse.memalign =
424 dlsym(libc_malloc_impl_handle, "leak_memalign");
425 break;
426 case 5:
427 __libc_android_log_print(ANDROID_LOG_INFO, "libc",
428 "%s using MALLOC_DEBUG = %d (fill)\n",
429 __progname, debug_level);
430 gMallocUse.malloc =
431 dlsym(libc_malloc_impl_handle, "fill_malloc");
432 gMallocUse.free =
433 dlsym(libc_malloc_impl_handle, "fill_free");
434 gMallocUse.calloc = dlcalloc;
435 gMallocUse.realloc =
436 dlsym(libc_malloc_impl_handle, "fill_realloc");
437 gMallocUse.memalign =
438 dlsym(libc_malloc_impl_handle, "fill_memalign");
439 break;
440 case 10:
441 __libc_android_log_print(ANDROID_LOG_INFO, "libc",
442 "%s using MALLOC_DEBUG = %d (sentinels, fill)\n",
443 __progname, debug_level);
444 gMallocUse.malloc =
445 dlsym(libc_malloc_impl_handle, "chk_malloc");
446 gMallocUse.free =
447 dlsym(libc_malloc_impl_handle, "chk_free");
448 gMallocUse.calloc =
449 dlsym(libc_malloc_impl_handle, "chk_calloc");
450 gMallocUse.realloc =
451 dlsym(libc_malloc_impl_handle, "chk_realloc");
452 gMallocUse.memalign =
453 dlsym(libc_malloc_impl_handle, "chk_memalign");
454 break;
455 case 20:
456 __libc_android_log_print(ANDROID_LOG_INFO, "libc",
457 "%s[%u] using MALLOC_DEBUG = %d (instrumented for emulator)\n",
458 __progname, getpid(), debug_level);
459 gMallocUse.malloc =
460 dlsym(libc_malloc_impl_handle, "qemu_instrumented_malloc");
461 gMallocUse.free =
462 dlsym(libc_malloc_impl_handle, "qemu_instrumented_free");
463 gMallocUse.calloc =
464 dlsym(libc_malloc_impl_handle, "qemu_instrumented_calloc");
465 gMallocUse.realloc =
466 dlsym(libc_malloc_impl_handle, "qemu_instrumented_realloc");
467 gMallocUse.memalign =
468 dlsym(libc_malloc_impl_handle, "qemu_instrumented_memalign");
469 break;
470 default:
471 break;
472 }
473
474 // Make sure dispatch table is initialized
475 if ((gMallocUse.malloc == NULL) ||
476 (gMallocUse.free == NULL) ||
477 (gMallocUse.calloc == NULL) ||
478 (gMallocUse.realloc == NULL) ||
479 (gMallocUse.memalign == NULL)) {
480 error_log("%s: Cannot initialize malloc dispatch table for debug level"
481 " %d: %p, %p, %p, %p, %p\n",
482 __progname, debug_level,
483 gMallocUse.malloc, gMallocUse.free,
484 gMallocUse.calloc, gMallocUse.realloc,
485 gMallocUse.memalign);
486 dlclose(libc_malloc_impl_handle);
487 libc_malloc_impl_handle = NULL;
488 } else {
489 __libc_malloc_dispatch = &gMallocUse;
490 }
491 }
492
malloc_fini_impl(void)493 static void malloc_fini_impl(void)
494 {
495 if (libc_malloc_impl_handle) {
496 MallocDebugFini malloc_debug_finalize = NULL;
497 malloc_debug_finalize =
498 dlsym(libc_malloc_impl_handle, "malloc_debug_finalize");
499 if (malloc_debug_finalize)
500 malloc_debug_finalize();
501 }
502 }
503
504 static pthread_once_t malloc_init_once_ctl = PTHREAD_ONCE_INIT;
505 static pthread_once_t malloc_fini_once_ctl = PTHREAD_ONCE_INIT;
506
507 #endif // !LIBC_STATIC
508 #endif // USE_DL_PREFIX
509
510 /* Initializes memory allocation framework.
511 * This routine is called from __libc_init routines implemented
512 * in libc_init_static.c and libc_init_dynamic.c files.
513 */
malloc_debug_init(void)514 void malloc_debug_init(void)
515 {
516 /* We need to initialize malloc iff we implement here custom
517 * malloc routines (i.e. USE_DL_PREFIX is defined) for libc.so */
518 #if defined(USE_DL_PREFIX) && !defined(LIBC_STATIC)
519 if (pthread_once(&malloc_init_once_ctl, malloc_init_impl)) {
520 error_log("Unable to initialize malloc_debug component.");
521 }
522 #endif // USE_DL_PREFIX && !LIBC_STATIC
523 }
524
malloc_debug_fini(void)525 void malloc_debug_fini(void)
526 {
527 /* We need to finalize malloc iff we implement here custom
528 * malloc routines (i.e. USE_DL_PREFIX is defined) for libc.so */
529 #if defined(USE_DL_PREFIX) && !defined(LIBC_STATIC)
530 if (pthread_once(&malloc_fini_once_ctl, malloc_fini_impl)) {
531 error_log("Unable to finalize malloc_debug component.");
532 }
533 #endif // USE_DL_PREFIX && !LIBC_STATIC
534 }
535