1 /* 2 * Copyright (C) 2009 The Android Open Source Project 3 * All rights reserved. 4 * 5 * Redistribution and use in source and binary forms, with or without 6 * modification, are permitted provided that the following conditions 7 * are met: 8 * * Redistributions of source code must retain the above copyright 9 * notice, this list of conditions and the following disclaimer. 10 * * Redistributions in binary form must reproduce the above copyright 11 * notice, this list of conditions and the following disclaimer in 12 * the documentation and/or other materials provided with the 13 * distribution. 14 * 15 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 16 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT 17 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS 18 * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE 19 * COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, 20 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, 21 * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS 22 * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED 23 * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, 24 * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT 25 * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 26 * SUCH DAMAGE. 27 */ 28 29 #if defined(LIBC_STATIC) 30 #error This file should not be compiled for static targets. 31 #endif 32 33 // Contains a thin layer that calls whatever real native allocator 34 // has been defined. For the libc shared library, this allows the 35 // implementation of a debug malloc that can intercept all of the allocation 36 // calls and add special debugging code to attempt to catch allocation 37 // errors. All of the debugging code is implemented in a separate shared 38 // library that is only loaded when the property "libc.debug.malloc.options" 39 // is set to a non-zero value. There are three functions exported to 40 // allow ddms, or other external users to get information from the debug 41 // allocation. 42 // get_malloc_leak_info: Returns information about all of the known native 43 // allocations that are currently in use. 44 // free_malloc_leak_info: Frees the data allocated by the call to 45 // get_malloc_leak_info. 46 // write_malloc_leak_info: Writes the leak info data to a file. 47 48 #include <dlfcn.h> 49 #include <errno.h> 50 #include <fcntl.h> 51 #include <pthread.h> 52 #include <stdatomic.h> 53 #include <stdbool.h> 54 #include <stdio.h> 55 #include <stdlib.h> 56 #include <unistd.h> 57 58 #include <android/dlext.h> 59 60 #include <private/bionic_config.h> 61 #include <private/bionic_defs.h> 62 #include <private/bionic_malloc_dispatch.h> 63 #include <private/bionic_malloc.h> 64 65 #include <sys/system_properties.h> 66 67 #include "malloc_common.h" 68 #include "malloc_common_dynamic.h" 69 #include "malloc_heapprofd.h" 70 #include "malloc_limit.h" 71 72 // ============================================================================= 73 // Global variables instantations. 74 // ============================================================================= 75 pthread_mutex_t gGlobalsMutateLock = PTHREAD_MUTEX_INITIALIZER; 76 77 bool gZygoteChild = false; 78 79 _Atomic bool gGlobalsMutating = false; 80 // ============================================================================= 81 82 static constexpr MallocDispatch __libc_malloc_default_dispatch 83 __attribute__((unused)) = { 84 Malloc(calloc), 85 Malloc(free), 86 Malloc(mallinfo), 87 Malloc(malloc), 88 Malloc(malloc_usable_size), 89 Malloc(memalign), 90 Malloc(posix_memalign), 91 #if defined(HAVE_DEPRECATED_MALLOC_FUNCS) 92 Malloc(pvalloc), 93 #endif 94 Malloc(realloc), 95 #if defined(HAVE_DEPRECATED_MALLOC_FUNCS) 96 Malloc(valloc), 97 #endif 98 Malloc(iterate), 99 Malloc(malloc_disable), 100 Malloc(malloc_enable), 101 Malloc(mallopt), 102 Malloc(aligned_alloc), 103 Malloc(malloc_info), 104 }; 105 106 static constexpr char kHooksSharedLib[] = "libc_malloc_hooks.so"; 107 static constexpr char kHooksPrefix[] = "hooks"; 108 static constexpr char kHooksPropertyEnable[] = "libc.debug.hooks.enable"; 109 static constexpr char kHooksEnvEnable[] = "LIBC_HOOKS_ENABLE"; 110 111 static constexpr char kDebugSharedLib[] = "libc_malloc_debug.so"; 112 static constexpr char kDebugPrefix[] = "debug"; 113 static constexpr char kDebugPropertyOptions[] = "libc.debug.malloc.options"; 114 static constexpr char kDebugPropertyProgram[] = "libc.debug.malloc.program"; 115 static constexpr char kDebugEnvOptions[] = "LIBC_DEBUG_MALLOC_OPTIONS"; 116 117 typedef void (*finalize_func_t)(); 118 typedef bool (*init_func_t)(const MallocDispatch*, bool*, const char*); 119 typedef void (*get_malloc_leak_info_func_t)(uint8_t**, size_t*, size_t*, size_t*, size_t*); 120 typedef void (*free_malloc_leak_info_func_t)(uint8_t*); 121 typedef bool (*write_malloc_leak_info_func_t)(FILE*); 122 typedef ssize_t (*malloc_backtrace_func_t)(void*, uintptr_t*, size_t); 123 124 enum FunctionEnum : uint8_t { 125 FUNC_INITIALIZE, 126 FUNC_FINALIZE, 127 FUNC_GET_MALLOC_LEAK_INFO, 128 FUNC_FREE_MALLOC_LEAK_INFO, 129 FUNC_MALLOC_BACKTRACE, 130 FUNC_WRITE_LEAK_INFO, 131 FUNC_LAST, 132 }; 133 static void* gFunctions[FUNC_LAST]; 134 135 extern "C" int __cxa_atexit(void (*func)(void *), void *arg, void *dso); 136 137 template<typename FunctionType> 138 static bool InitMallocFunction(void* malloc_impl_handler, FunctionType* func, const char* prefix, const char* suffix) { 139 char symbol[128]; 140 snprintf(symbol, sizeof(symbol), "%s_%s", prefix, suffix); 141 *func = reinterpret_cast<FunctionType>(dlsym(malloc_impl_handler, symbol)); 142 if (*func == nullptr) { 143 error_log("%s: dlsym(\"%s\") failed", getprogname(), symbol); 144 return false; 145 } 146 return true; 147 } 148 149 static bool InitMallocFunctions(void* impl_handler, MallocDispatch* table, const char* prefix) { 150 if (!InitMallocFunction<MallocFree>(impl_handler, &table->free, prefix, "free")) { 151 return false; 152 } 153 if (!InitMallocFunction<MallocCalloc>(impl_handler, &table->calloc, prefix, "calloc")) { 154 return false; 155 } 156 if (!InitMallocFunction<MallocMallinfo>(impl_handler, &table->mallinfo, prefix, "mallinfo")) { 157 return false; 158 } 159 if (!InitMallocFunction<MallocMallopt>(impl_handler, &table->mallopt, prefix, "mallopt")) { 160 return false; 161 } 162 if (!InitMallocFunction<MallocMalloc>(impl_handler, &table->malloc, prefix, "malloc")) { 163 return false; 164 } 165 if (!InitMallocFunction<MallocMallocInfo>(impl_handler, &table->malloc_info, prefix, 166 "malloc_info")) { 167 return false; 168 } 169 if (!InitMallocFunction<MallocMallocUsableSize>(impl_handler, &table->malloc_usable_size, prefix, 170 "malloc_usable_size")) { 171 return false; 172 } 173 if (!InitMallocFunction<MallocMemalign>(impl_handler, &table->memalign, prefix, "memalign")) { 174 return false; 175 } 176 if (!InitMallocFunction<MallocPosixMemalign>(impl_handler, &table->posix_memalign, prefix, 177 "posix_memalign")) { 178 return false; 179 } 180 if (!InitMallocFunction<MallocAlignedAlloc>(impl_handler, &table->aligned_alloc, 181 prefix, "aligned_alloc")) { 182 return false; 183 } 184 if (!InitMallocFunction<MallocRealloc>(impl_handler, &table->realloc, prefix, "realloc")) { 185 return false; 186 } 187 if (!InitMallocFunction<MallocIterate>(impl_handler, &table->iterate, prefix, "iterate")) { 188 return false; 189 } 190 if (!InitMallocFunction<MallocMallocDisable>(impl_handler, &table->malloc_disable, prefix, 191 "malloc_disable")) { 192 return false; 193 } 194 if (!InitMallocFunction<MallocMallocEnable>(impl_handler, &table->malloc_enable, prefix, 195 "malloc_enable")) { 196 return false; 197 } 198 #if defined(HAVE_DEPRECATED_MALLOC_FUNCS) 199 if (!InitMallocFunction<MallocPvalloc>(impl_handler, &table->pvalloc, prefix, "pvalloc")) { 200 return false; 201 } 202 if (!InitMallocFunction<MallocValloc>(impl_handler, &table->valloc, prefix, "valloc")) { 203 return false; 204 } 205 #endif 206 207 return true; 208 } 209 210 static void MallocFiniImpl(void*) { 211 // Our BSD stdio implementation doesn't close the standard streams, 212 // it only flushes them. Other unclosed FILE*s will show up as 213 // malloc leaks, but to avoid the standard streams showing up in 214 // leak reports, close them here. 215 fclose(stdin); 216 fclose(stdout); 217 fclose(stderr); 218 219 reinterpret_cast<finalize_func_t>(gFunctions[FUNC_FINALIZE])(); 220 } 221 222 static bool CheckLoadMallocHooks(char** options) { 223 char* env = getenv(kHooksEnvEnable); 224 if ((env == nullptr || env[0] == '\0' || env[0] == '0') && 225 (__system_property_get(kHooksPropertyEnable, *options) == 0 || *options[0] == '\0' || *options[0] == '0')) { 226 return false; 227 } 228 *options = nullptr; 229 return true; 230 } 231 232 static bool CheckLoadMallocDebug(char** options) { 233 // If kDebugMallocEnvOptions is set then it overrides the system properties. 234 char* env = getenv(kDebugEnvOptions); 235 if (env == nullptr || env[0] == '\0') { 236 if (__system_property_get(kDebugPropertyOptions, *options) == 0 || *options[0] == '\0') { 237 return false; 238 } 239 240 // Check to see if only a specific program should have debug malloc enabled. 241 char program[PROP_VALUE_MAX]; 242 if (__system_property_get(kDebugPropertyProgram, program) != 0 && 243 strstr(getprogname(), program) == nullptr) { 244 return false; 245 } 246 } else { 247 *options = env; 248 } 249 return true; 250 } 251 252 static void ClearGlobalFunctions() { 253 for (size_t i = 0; i < FUNC_LAST; i++) { 254 gFunctions[i] = nullptr; 255 } 256 } 257 258 bool InitSharedLibrary(void* impl_handle, const char* shared_lib, const char* prefix, MallocDispatch* dispatch_table) { 259 static constexpr const char* names[] = { 260 "initialize", 261 "finalize", 262 "get_malloc_leak_info", 263 "free_malloc_leak_info", 264 "malloc_backtrace", 265 "write_malloc_leak_info", 266 }; 267 for (size_t i = 0; i < FUNC_LAST; i++) { 268 char symbol[128]; 269 snprintf(symbol, sizeof(symbol), "%s_%s", prefix, names[i]); 270 gFunctions[i] = dlsym(impl_handle, symbol); 271 if (gFunctions[i] == nullptr) { 272 error_log("%s: %s routine not found in %s", getprogname(), symbol, shared_lib); 273 ClearGlobalFunctions(); 274 return false; 275 } 276 } 277 278 if (!InitMallocFunctions(impl_handle, dispatch_table, prefix)) { 279 ClearGlobalFunctions(); 280 return false; 281 } 282 return true; 283 } 284 285 // Note about USE_SCUDO. This file is compiled into libc.so and libc_scudo.so. 286 // When compiled into libc_scudo.so, the libc_malloc_* libraries don't need 287 // to be loaded from the runtime namespace since libc_scudo.so is not from 288 // the runtime APEX, but is copied to any APEX that needs it. 289 #ifndef USE_SCUDO 290 extern "C" struct android_namespace_t* android_get_exported_namespace(const char* name); 291 #endif 292 293 void* LoadSharedLibrary(const char* shared_lib, const char* prefix, MallocDispatch* dispatch_table) { 294 void* impl_handle = nullptr; 295 #ifndef USE_SCUDO 296 // Try to load the libc_malloc_* libs from the "runtime" namespace and then 297 // fall back to dlopen() to load them from the default namespace. 298 // 299 // The libraries are packaged in the runtime APEX together with libc.so. 300 // However, since the libc.so is searched via the symlink in the system 301 // partition (/system/lib/libc.so -> /apex/com.android.runtime/bionic.libc.so) 302 // libc.so is loaded into the default namespace. If we just dlopen() here, the 303 // linker will load the libs found in /system/lib which might be incompatible 304 // with libc.so in the runtime APEX. Use android_dlopen_ext to explicitly load 305 // the ones in the runtime APEX. 306 struct android_namespace_t* runtime_ns = android_get_exported_namespace("runtime"); 307 if (runtime_ns != nullptr) { 308 const android_dlextinfo dlextinfo = { 309 .flags = ANDROID_DLEXT_USE_NAMESPACE, 310 .library_namespace = runtime_ns, 311 }; 312 impl_handle = android_dlopen_ext(shared_lib, RTLD_NOW | RTLD_LOCAL, &dlextinfo); 313 } 314 #endif 315 316 if (impl_handle == nullptr) { 317 impl_handle = dlopen(shared_lib, RTLD_NOW | RTLD_LOCAL); 318 } 319 320 if (impl_handle == nullptr) { 321 error_log("%s: Unable to open shared library %s: %s", getprogname(), shared_lib, dlerror()); 322 return nullptr; 323 } 324 325 if (!InitSharedLibrary(impl_handle, shared_lib, prefix, dispatch_table)) { 326 dlclose(impl_handle); 327 impl_handle = nullptr; 328 } 329 330 return impl_handle; 331 } 332 333 bool FinishInstallHooks(libc_globals* globals, const char* options, const char* prefix) { 334 init_func_t init_func = reinterpret_cast<init_func_t>(gFunctions[FUNC_INITIALIZE]); 335 if (!init_func(&__libc_malloc_default_dispatch, &gZygoteChild, options)) { 336 error_log("%s: failed to enable malloc %s", getprogname(), prefix); 337 ClearGlobalFunctions(); 338 return false; 339 } 340 341 // Do a pointer swap so that all of the functions become valid at once to 342 // avoid any initialization order problems. 343 atomic_store(&globals->default_dispatch_table, &globals->malloc_dispatch_table); 344 if (GetDispatchTable() == nullptr) { 345 atomic_store(&globals->current_dispatch_table, &globals->malloc_dispatch_table); 346 } 347 348 // Use atexit to trigger the cleanup function. This avoids a problem 349 // where another atexit function is used to cleanup allocated memory, 350 // but the finalize function was already called. This particular error 351 // seems to be triggered by a zygote spawned process calling exit. 352 int ret_value = __cxa_atexit(MallocFiniImpl, nullptr, nullptr); 353 if (ret_value != 0) { 354 // We don't consider this a fatal error. 355 warning_log("failed to set atexit cleanup function: %d", ret_value); 356 } 357 return true; 358 } 359 360 static bool InstallHooks(libc_globals* globals, const char* options, const char* prefix, 361 const char* shared_lib) { 362 void* impl_handle = LoadSharedLibrary(shared_lib, prefix, &globals->malloc_dispatch_table); 363 if (impl_handle == nullptr) { 364 return false; 365 } 366 367 if (!FinishInstallHooks(globals, options, prefix)) { 368 dlclose(impl_handle); 369 return false; 370 } 371 return true; 372 } 373 374 // Initializes memory allocation framework once per process. 375 static void MallocInitImpl(libc_globals* globals) { 376 char prop[PROP_VALUE_MAX]; 377 char* options = prop; 378 379 // Prefer malloc debug since it existed first and is a more complete 380 // malloc interceptor than the hooks. 381 bool hook_installed = false; 382 if (CheckLoadMallocDebug(&options)) { 383 hook_installed = InstallHooks(globals, options, kDebugPrefix, kDebugSharedLib); 384 } else if (CheckLoadMallocHooks(&options)) { 385 hook_installed = InstallHooks(globals, options, kHooksPrefix, kHooksSharedLib); 386 } 387 388 if (!hook_installed) { 389 if (HeapprofdShouldLoad()) { 390 HeapprofdInstallHooksAtInit(globals); 391 } 392 393 // Install this last to avoid as many race conditions as possible. 394 HeapprofdInstallSignalHandler(); 395 } else { 396 // Install a signal handler that prints an error since we don't support 397 // heapprofd and any other hook to be installed at the same time. 398 HeapprofdInstallErrorSignalHandler(); 399 } 400 } 401 402 // Initializes memory allocation framework. 403 // This routine is called from __libc_init routines in libc_init_dynamic.cpp. 404 __BIONIC_WEAK_FOR_NATIVE_BRIDGE 405 __LIBC_HIDDEN__ void __libc_init_malloc(libc_globals* globals) { 406 MallocInitImpl(globals); 407 } 408 409 // ============================================================================= 410 // Functions to support dumping of native heap allocations using malloc debug. 411 // ============================================================================= 412 bool GetMallocLeakInfo(android_mallopt_leak_info_t* leak_info) { 413 void* func = gFunctions[FUNC_GET_MALLOC_LEAK_INFO]; 414 if (func == nullptr) { 415 errno = ENOTSUP; 416 return false; 417 } 418 reinterpret_cast<get_malloc_leak_info_func_t>(func)( 419 &leak_info->buffer, &leak_info->overall_size, &leak_info->info_size, 420 &leak_info->total_memory, &leak_info->backtrace_size); 421 return true; 422 } 423 424 bool FreeMallocLeakInfo(android_mallopt_leak_info_t* leak_info) { 425 void* func = gFunctions[FUNC_FREE_MALLOC_LEAK_INFO]; 426 if (func == nullptr) { 427 errno = ENOTSUP; 428 return false; 429 } 430 reinterpret_cast<free_malloc_leak_info_func_t>(func)(leak_info->buffer); 431 return true; 432 } 433 434 bool WriteMallocLeakInfo(FILE* fp) { 435 void* func = gFunctions[FUNC_WRITE_LEAK_INFO]; 436 bool written = false; 437 if (func != nullptr) { 438 written = reinterpret_cast<write_malloc_leak_info_func_t>(func)(fp); 439 } 440 441 if (!written) { 442 fprintf(fp, "Native heap dump not available. To enable, run these commands (requires root):\n"); 443 fprintf(fp, "# adb shell stop\n"); 444 fprintf(fp, "# adb shell setprop libc.debug.malloc.options backtrace\n"); 445 fprintf(fp, "# adb shell start\n"); 446 errno = ENOTSUP; 447 } 448 return written; 449 } 450 // ============================================================================= 451 452 // ============================================================================= 453 // Exported for use by libmemunreachable. 454 // ============================================================================= 455 extern "C" ssize_t malloc_backtrace(void* pointer, uintptr_t* frames, size_t frame_count) { 456 void* func = gFunctions[FUNC_MALLOC_BACKTRACE]; 457 if (func == nullptr) { 458 return 0; 459 } 460 return reinterpret_cast<malloc_backtrace_func_t>(func)(pointer, frames, frame_count); 461 } 462 // ============================================================================= 463 464 // ============================================================================= 465 // Platform-internal mallopt variant. 466 // ============================================================================= 467 extern "C" bool android_mallopt(int opcode, void* arg, size_t arg_size) { 468 if (opcode == M_SET_ZYGOTE_CHILD) { 469 if (arg != nullptr || arg_size != 0) { 470 errno = EINVAL; 471 return false; 472 } 473 gZygoteChild = true; 474 return true; 475 } 476 if (opcode == M_SET_ALLOCATION_LIMIT_BYTES) { 477 return LimitEnable(arg, arg_size); 478 } 479 if (opcode == M_WRITE_MALLOC_LEAK_INFO_TO_FILE) { 480 if (arg == nullptr || arg_size != sizeof(FILE*)) { 481 errno = EINVAL; 482 return false; 483 } 484 return WriteMallocLeakInfo(reinterpret_cast<FILE*>(arg)); 485 } 486 if (opcode == M_GET_MALLOC_LEAK_INFO) { 487 if (arg == nullptr || arg_size != sizeof(android_mallopt_leak_info_t)) { 488 errno = EINVAL; 489 return false; 490 } 491 return GetMallocLeakInfo(reinterpret_cast<android_mallopt_leak_info_t*>(arg)); 492 } 493 if (opcode == M_FREE_MALLOC_LEAK_INFO) { 494 if (arg == nullptr || arg_size != sizeof(android_mallopt_leak_info_t)) { 495 errno = EINVAL; 496 return false; 497 } 498 return FreeMallocLeakInfo(reinterpret_cast<android_mallopt_leak_info_t*>(arg)); 499 } 500 return HeapprofdMallopt(opcode, arg, arg_size); 501 } 502 // ============================================================================= 503 504 #if !defined(__LP64__) && defined(__arm__) 505 // ============================================================================= 506 // Old platform only functions that some old 32 bit apps are still using. 507 // See b/132175052. 508 // Only compile the functions for 32 bit arm, so that new apps do not use 509 // these functions. 510 // ============================================================================= 511 extern "C" void get_malloc_leak_info(uint8_t** info, size_t* overall_size, size_t* info_size, 512 size_t* total_memory, size_t* backtrace_size) { 513 if (info == nullptr || overall_size == nullptr || info_size == nullptr || 514 total_memory == nullptr || backtrace_size == nullptr) { 515 return; 516 } 517 518 *info = nullptr; 519 *overall_size = 0; 520 *info_size = 0; 521 *total_memory = 0; 522 *backtrace_size = 0; 523 524 android_mallopt_leak_info_t leak_info = {}; 525 if (android_mallopt(M_GET_MALLOC_LEAK_INFO, &leak_info, sizeof(leak_info))) { 526 *info = leak_info.buffer; 527 *overall_size = leak_info.overall_size; 528 *info_size = leak_info.info_size; 529 *total_memory = leak_info.total_memory; 530 *backtrace_size = leak_info.backtrace_size; 531 } 532 } 533 534 extern "C" void free_malloc_leak_info(uint8_t* info) { 535 android_mallopt_leak_info_t leak_info = { .buffer = info }; 536 android_mallopt(M_FREE_MALLOC_LEAK_INFO, &leak_info, sizeof(leak_info)); 537 } 538 // ============================================================================= 539 #endif 540