Home | History | Annotate | Download | only in bionic
      1 /*
      2  * Copyright (C) 2009 The Android Open Source Project
      3  * All rights reserved.
      4  *
      5  * Redistribution and use in source and binary forms, with or without
      6  * modification, are permitted provided that the following conditions
      7  * are met:
      8  *  * Redistributions of source code must retain the above copyright
      9  *    notice, this list of conditions and the following disclaimer.
     10  *  * Redistributions in binary form must reproduce the above copyright
     11  *    notice, this list of conditions and the following disclaimer in
     12  *    the documentation and/or other materials provided with the
     13  *    distribution.
     14  *
     15  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
     16  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
     17  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
     18  * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
     19  * COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
     20  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
     21  * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
     22  * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
     23  * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
     24  * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
     25  * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
     26  * SUCH DAMAGE.
     27  */
     28 
     29 /*
     30  * Contains definition of structures, global variables, and implementation of
     31  * routines that are used by malloc leak detection code and other components in
     32  * the system. The trick is that some components expect these data and
     33  * routines to be defined / implemented in libc.so library, regardless
     34  * whether or not MALLOC_LEAK_CHECK macro is defined. To make things even
     35  * more tricky, malloc leak detection code, implemented in
     36  * libc_malloc_debug.so also requires access to these variables and routines
     37  * (to fill allocation entry hash table, for example). So, all relevant
     38  * variables and routines are defined / implemented here and exported
     39  * to all, leak detection code and other components via dynamic (libc.so),
     40  * or static (libc.a) linking.
     41  */
     42 
     43 #include <stdlib.h>
     44 #include <pthread.h>
     45 #include <unistd.h>
     46 #include "dlmalloc.h"
     47 #include "malloc_debug_common.h"
     48 
     49 /*
     50  * In a VM process, this is set to 1 after fork()ing out of zygote.
     51  */
     52 int gMallocLeakZygoteChild = 0;
     53 
     54 pthread_mutex_t gAllocationsMutex = PTHREAD_MUTEX_INITIALIZER;
     55 HashTable gHashTable;
     56 
     57 // =============================================================================
     58 // output functions
     59 // =============================================================================
     60 
     61 static int hash_entry_compare(const void* arg1, const void* arg2)
     62 {
     63     int result;
     64 
     65     HashEntry* e1 = *(HashEntry**)arg1;
     66     HashEntry* e2 = *(HashEntry**)arg2;
     67 
     68     // if one or both arg pointers are null, deal gracefully
     69     if (e1 == NULL) {
     70         result = (e2 == NULL) ? 0 : 1;
     71     } else if (e2 == NULL) {
     72         result = -1;
     73     } else {
     74         size_t nbAlloc1 = e1->allocations;
     75         size_t nbAlloc2 = e2->allocations;
     76         size_t size1 = e1->size & ~SIZE_FLAG_MASK;
     77         size_t size2 = e2->size & ~SIZE_FLAG_MASK;
     78         size_t alloc1 = nbAlloc1 * size1;
     79         size_t alloc2 = nbAlloc2 * size2;
     80 
     81         // sort in descending order by:
     82         // 1) total size
     83         // 2) number of allocations
     84         //
     85         // This is used for sorting, not determination of equality, so we don't
     86         // need to compare the bit flags.
     87         if (alloc1 > alloc2) {
     88             result = -1;
     89         } else if (alloc1 < alloc2) {
     90             result = 1;
     91         } else {
     92             if (nbAlloc1 > nbAlloc2) {
     93                 result = -1;
     94             } else if (nbAlloc1 < nbAlloc2) {
     95                 result = 1;
     96             } else {
     97                 result = 0;
     98             }
     99         }
    100     }
    101     return result;
    102 }
    103 
    104 /*
    105  * Retrieve native heap information.
    106  *
    107  * "*info" is set to a buffer we allocate
    108  * "*overallSize" is set to the size of the "info" buffer
    109  * "*infoSize" is set to the size of a single entry
    110  * "*totalMemory" is set to the sum of all allocations we're tracking; does
    111  *   not include heap overhead
    112  * "*backtraceSize" is set to the maximum number of entries in the back trace
    113  */
    114 void get_malloc_leak_info(uint8_t** info, size_t* overallSize,
    115         size_t* infoSize, size_t* totalMemory, size_t* backtraceSize)
    116 {
    117     // don't do anything if we have invalid arguments
    118     if (info == NULL || overallSize == NULL || infoSize == NULL ||
    119             totalMemory == NULL || backtraceSize == NULL) {
    120         return;
    121     }
    122     *totalMemory = 0;
    123 
    124     pthread_mutex_lock(&gAllocationsMutex);
    125 
    126     if (gHashTable.count == 0) {
    127         *info = NULL;
    128         *overallSize = 0;
    129         *infoSize = 0;
    130         *backtraceSize = 0;
    131         goto done;
    132     }
    133 
    134     void** list = (void**)dlmalloc(sizeof(void*) * gHashTable.count);
    135 
    136     // get the entries into an array to be sorted
    137     int index = 0;
    138     int i;
    139     for (i = 0 ; i < HASHTABLE_SIZE ; i++) {
    140         HashEntry* entry = gHashTable.slots[i];
    141         while (entry != NULL) {
    142             list[index] = entry;
    143             *totalMemory = *totalMemory +
    144                 ((entry->size & ~SIZE_FLAG_MASK) * entry->allocations);
    145             index++;
    146             entry = entry->next;
    147         }
    148     }
    149 
    150     // XXX: the protocol doesn't allow variable size for the stack trace (yet)
    151     *infoSize = (sizeof(size_t) * 2) + (sizeof(intptr_t) * BACKTRACE_SIZE);
    152     *overallSize = *infoSize * gHashTable.count;
    153     *backtraceSize = BACKTRACE_SIZE;
    154 
    155     // now get A byte array big enough for this
    156     *info = (uint8_t*)dlmalloc(*overallSize);
    157 
    158     if (*info == NULL) {
    159         *overallSize = 0;
    160         goto out_nomem_info;
    161     }
    162 
    163     qsort((void*)list, gHashTable.count, sizeof(void*), hash_entry_compare);
    164 
    165     uint8_t* head = *info;
    166     const int count = gHashTable.count;
    167     for (i = 0 ; i < count ; i++) {
    168         HashEntry* entry = list[i];
    169         size_t entrySize = (sizeof(size_t) * 2) + (sizeof(intptr_t) * entry->numEntries);
    170         if (entrySize < *infoSize) {
    171             /* we're writing less than a full entry, clear out the rest */
    172             memset(head + entrySize, 0, *infoSize - entrySize);
    173         } else {
    174             /* make sure the amount we're copying doesn't exceed the limit */
    175             entrySize = *infoSize;
    176         }
    177         memcpy(head, &(entry->size), entrySize);
    178         head += *infoSize;
    179     }
    180 
    181 out_nomem_info:
    182     dlfree(list);
    183 
    184 done:
    185     pthread_mutex_unlock(&gAllocationsMutex);
    186 }
    187 
    188 void free_malloc_leak_info(uint8_t* info)
    189 {
    190     dlfree(info);
    191 }
    192 
    193 struct mallinfo mallinfo()
    194 {
    195     return dlmallinfo();
    196 }
    197 
    198 void* valloc(size_t bytes) {
    199     /* assume page size of 4096 bytes */
    200     return memalign( getpagesize(), bytes );
    201 }
    202 
    203 /* Support for malloc debugging.
    204  * Note that if USE_DL_PREFIX is not defined, it's assumed that memory
    205  * allocation routines are implemented somewhere else, so all our custom
    206  * malloc routines should not be compiled at all.
    207  */
    208 #ifdef USE_DL_PREFIX
    209 
    210 /* Table for dispatching malloc calls, initialized with default dispatchers. */
    211 const MallocDebug __libc_malloc_default_dispatch __attribute__((aligned(32))) =
    212 {
    213     dlmalloc, dlfree, dlcalloc, dlrealloc, dlmemalign
    214 };
    215 
    216 /* Selector of dispatch table to use for dispatching malloc calls. */
    217 const MallocDebug* __libc_malloc_dispatch = &__libc_malloc_default_dispatch;
    218 
    219 void* malloc(size_t bytes) {
    220     return __libc_malloc_dispatch->malloc(bytes);
    221 }
    222 void free(void* mem) {
    223     __libc_malloc_dispatch->free(mem);
    224 }
    225 void* calloc(size_t n_elements, size_t elem_size) {
    226     return __libc_malloc_dispatch->calloc(n_elements, elem_size);
    227 }
    228 void* realloc(void* oldMem, size_t bytes) {
    229     return __libc_malloc_dispatch->realloc(oldMem, bytes);
    230 }
    231 void* memalign(size_t alignment, size_t bytes) {
    232     return __libc_malloc_dispatch->memalign(alignment, bytes);
    233 }
    234 
    235 /* We implement malloc debugging only in libc.so, so code bellow
    236  * must be excluded if we compile this file for static libc.a
    237  */
    238 #ifndef LIBC_STATIC
    239 #include <sys/system_properties.h>
    240 #include <dlfcn.h>
    241 #include "logd.h"
    242 
    243 // =============================================================================
    244 // log functions
    245 // =============================================================================
    246 
    247 #define debug_log(format, ...)  \
    248    __libc_android_log_print(ANDROID_LOG_DEBUG, "libc", (format), ##__VA_ARGS__ )
    249 #define error_log(format, ...)  \
    250    __libc_android_log_print(ANDROID_LOG_ERROR, "libc", (format), ##__VA_ARGS__ )
    251 #define info_log(format, ...)  \
    252    __libc_android_log_print(ANDROID_LOG_INFO, "libc", (format), ##__VA_ARGS__ )
    253 
    254 /* Table for dispatching malloc calls, depending on environment. */
    255 static MallocDebug gMallocUse __attribute__((aligned(32))) = {
    256     dlmalloc, dlfree, dlcalloc, dlrealloc, dlmemalign
    257 };
    258 
    259 extern char*  __progname;
    260 
    261 /* Handle to shared library where actual memory allocation is implemented.
    262  * This library is loaded and memory allocation calls are redirected there
    263  * when libc.debug.malloc environment variable contains value other than
    264  * zero:
    265  * 1  - For memory leak detections.
    266  * 5  - For filling allocated / freed memory with patterns defined by
    267  *      CHK_SENTINEL_VALUE, and CHK_FILL_FREE macros.
    268  * 10 - For adding pre-, and post- allocation stubs in order to detect
    269  *      buffer overruns.
    270  * Note that emulator's memory allocation instrumentation is not controlled by
    271  * libc.debug.malloc value, but rather by emulator, started with -memcheck
    272  * option. Note also, that if emulator has started with -memcheck option,
    273  * emulator's instrumented memory allocation will take over value saved in
    274  * libc.debug.malloc. In other words, if emulator has started with -memcheck
    275  * option, libc.debug.malloc value is ignored.
    276  * Actual functionality for debug levels 1-10 is implemented in
    277  * libc_malloc_debug_leak.so, while functionality for emultor's instrumented
    278  * allocations is implemented in libc_malloc_debug_qemu.so and can be run inside
    279   * the emulator only.
    280  */
    281 static void* libc_malloc_impl_handle = NULL;
    282 
    283 /* Make sure we have MALLOC_ALIGNMENT that matches the one that is
    284  * used in dlmalloc. Emulator's memchecker needs this value to properly
    285  * align its guarding zones.
    286  */
    287 #ifndef MALLOC_ALIGNMENT
    288 #define MALLOC_ALIGNMENT ((size_t)8U)
    289 #endif  /* MALLOC_ALIGNMENT */
    290 
    291 /* Initializes memory allocation framework once per process. */
    292 static void malloc_init_impl(void)
    293 {
    294     const char* so_name = NULL;
    295     MallocDebugInit malloc_debug_initialize = NULL;
    296     unsigned int qemu_running = 0;
    297     unsigned int debug_level = 0;
    298     unsigned int memcheck_enabled = 0;
    299     char env[PROP_VALUE_MAX];
    300     char memcheck_tracing[PROP_VALUE_MAX];
    301 
    302     /* Get custom malloc debug level. Note that emulator started with
    303      * memory checking option will have priority over debug level set in
    304      * libc.debug.malloc system property. */
    305     if (__system_property_get("ro.kernel.qemu", env) && atoi(env)) {
    306         qemu_running = 1;
    307         if (__system_property_get("ro.kernel.memcheck", memcheck_tracing)) {
    308             if (memcheck_tracing[0] != '0') {
    309                 // Emulator has started with memory tracing enabled. Enforce it.
    310                 debug_level = 20;
    311                 memcheck_enabled = 1;
    312             }
    313         }
    314     }
    315 
    316     /* If debug level has not been set by memcheck option in the emulator,
    317      * lets grab it from libc.debug.malloc system property. */
    318     if (!debug_level && __system_property_get("libc.debug.malloc", env)) {
    319         debug_level = atoi(env);
    320     }
    321 
    322     /* Debug level 0 means that we should use dlxxx allocation
    323      * routines (default). */
    324     if (!debug_level) {
    325         return;
    326     }
    327 
    328     // Lets see which .so must be loaded for the requested debug level
    329     switch (debug_level) {
    330         case 1:
    331         case 5:
    332         case 10:
    333             so_name = "/system/lib/libc_malloc_debug_leak.so";
    334             break;
    335         case 20:
    336             // Quick check: debug level 20 can only be handled in emulator.
    337             if (!qemu_running) {
    338                 error_log("%s: Debug level %d can only be set in emulator\n",
    339                           __progname, debug_level);
    340                 return;
    341             }
    342             // Make sure that memory checking has been enabled in emulator.
    343             if (!memcheck_enabled) {
    344                 error_log("%s: Memory checking is not enabled in the emulator\n",
    345                           __progname);
    346                 return;
    347             }
    348             so_name = "/system/lib/libc_malloc_debug_qemu.so";
    349             break;
    350         default:
    351             error_log("%s: Debug level %d is unknown\n",
    352                       __progname, debug_level);
    353             return;
    354     }
    355 
    356     // Load .so that implements the required malloc debugging functionality.
    357     libc_malloc_impl_handle = dlopen(so_name, RTLD_LAZY);
    358     if (libc_malloc_impl_handle == NULL) {
    359         error_log("%s: Missing module %s required for malloc debug level %d\n",
    360                  __progname, so_name, debug_level);
    361         return;
    362     }
    363 
    364     // Initialize malloc debugging in the loaded module.
    365     malloc_debug_initialize =
    366             dlsym(libc_malloc_impl_handle, "malloc_debug_initialize");
    367     if (malloc_debug_initialize == NULL) {
    368         error_log("%s: Initialization routine is not found in %s\n",
    369                   __progname, so_name);
    370         dlclose(libc_malloc_impl_handle);
    371         return;
    372     }
    373     if (malloc_debug_initialize()) {
    374         dlclose(libc_malloc_impl_handle);
    375         return;
    376     }
    377 
    378     if (debug_level == 20) {
    379         // For memory checker we need to do extra initialization.
    380         int (*memcheck_initialize)(int, const char*) =
    381                 dlsym(libc_malloc_impl_handle, "memcheck_initialize");
    382         if (memcheck_initialize == NULL) {
    383             error_log("%s: memcheck_initialize routine is not found in %s\n",
    384                       __progname, so_name);
    385             dlclose(libc_malloc_impl_handle);
    386             return;
    387         }
    388         if (memcheck_initialize(MALLOC_ALIGNMENT, memcheck_tracing)) {
    389             dlclose(libc_malloc_impl_handle);
    390             return;
    391         }
    392     }
    393 
    394     // Initialize malloc dispatch table with appropriate routines.
    395     switch (debug_level) {
    396         case 1:
    397             __libc_android_log_print(ANDROID_LOG_INFO, "libc",
    398                     "%s using MALLOC_DEBUG = %d (leak checker)\n",
    399                     __progname, debug_level);
    400             gMallocUse.malloc =
    401                 dlsym(libc_malloc_impl_handle, "leak_malloc");
    402             gMallocUse.free =
    403                 dlsym(libc_malloc_impl_handle, "leak_free");
    404             gMallocUse.calloc =
    405                 dlsym(libc_malloc_impl_handle, "leak_calloc");
    406             gMallocUse.realloc =
    407                 dlsym(libc_malloc_impl_handle, "leak_realloc");
    408             gMallocUse.memalign =
    409                 dlsym(libc_malloc_impl_handle, "leak_memalign");
    410             break;
    411         case 5:
    412             __libc_android_log_print(ANDROID_LOG_INFO, "libc",
    413                     "%s using MALLOC_DEBUG = %d (fill)\n",
    414                     __progname, debug_level);
    415             gMallocUse.malloc =
    416                 dlsym(libc_malloc_impl_handle, "fill_malloc");
    417             gMallocUse.free =
    418                 dlsym(libc_malloc_impl_handle, "fill_free");
    419             gMallocUse.calloc = dlcalloc;
    420             gMallocUse.realloc =
    421                 dlsym(libc_malloc_impl_handle, "fill_realloc");
    422             gMallocUse.memalign =
    423                 dlsym(libc_malloc_impl_handle, "fill_memalign");
    424             break;
    425         case 10:
    426             __libc_android_log_print(ANDROID_LOG_INFO, "libc",
    427                     "%s using MALLOC_DEBUG = %d (sentinels, fill)\n",
    428                     __progname, debug_level);
    429             gMallocUse.malloc =
    430                 dlsym(libc_malloc_impl_handle, "chk_malloc");
    431             gMallocUse.free =
    432                 dlsym(libc_malloc_impl_handle, "chk_free");
    433             gMallocUse.calloc =
    434                 dlsym(libc_malloc_impl_handle, "chk_calloc");
    435             gMallocUse.realloc =
    436                 dlsym(libc_malloc_impl_handle, "chk_realloc");
    437             gMallocUse.memalign =
    438                 dlsym(libc_malloc_impl_handle, "chk_memalign");
    439             break;
    440         case 20:
    441             __libc_android_log_print(ANDROID_LOG_INFO, "libc",
    442                 "%s[%u] using MALLOC_DEBUG = %d (instrumented for emulator)\n",
    443                 __progname, getpid(), debug_level);
    444             gMallocUse.malloc =
    445                 dlsym(libc_malloc_impl_handle, "qemu_instrumented_malloc");
    446             gMallocUse.free =
    447                 dlsym(libc_malloc_impl_handle, "qemu_instrumented_free");
    448             gMallocUse.calloc =
    449                 dlsym(libc_malloc_impl_handle, "qemu_instrumented_calloc");
    450             gMallocUse.realloc =
    451                 dlsym(libc_malloc_impl_handle, "qemu_instrumented_realloc");
    452             gMallocUse.memalign =
    453                 dlsym(libc_malloc_impl_handle, "qemu_instrumented_memalign");
    454             break;
    455         default:
    456             break;
    457     }
    458 
    459     // Make sure dispatch table is initialized
    460     if ((gMallocUse.malloc == NULL) ||
    461         (gMallocUse.free == NULL) ||
    462         (gMallocUse.calloc == NULL) ||
    463         (gMallocUse.realloc == NULL) ||
    464         (gMallocUse.memalign == NULL)) {
    465         error_log("%s: Cannot initialize malloc dispatch table for debug level"
    466                   " %d: %p, %p, %p, %p, %p\n",
    467                   __progname, debug_level,
    468                   gMallocUse.malloc, gMallocUse.free,
    469                   gMallocUse.calloc, gMallocUse.realloc,
    470                   gMallocUse.memalign);
    471         dlclose(libc_malloc_impl_handle);
    472         libc_malloc_impl_handle = NULL;
    473     } else {
    474         __libc_malloc_dispatch = &gMallocUse;
    475     }
    476 }
    477 
    478 static pthread_once_t  malloc_init_once_ctl = PTHREAD_ONCE_INIT;
    479 
    480 #endif  // !LIBC_STATIC
    481 #endif  // USE_DL_PREFIX
    482 
    483 /* Initializes memory allocation framework.
    484  * This routine is called from __libc_init routines implemented
    485  * in libc_init_static.c and libc_init_dynamic.c files.
    486  */
    487 void malloc_debug_init(void)
    488 {
    489     /* We need to initialize malloc iff we implement here custom
    490      * malloc routines (i.e. USE_DL_PREFIX is defined) for libc.so */
    491 #if defined(USE_DL_PREFIX) && !defined(LIBC_STATIC)
    492     if (pthread_once(&malloc_init_once_ctl, malloc_init_impl)) {
    493         error_log("Unable to initialize malloc_debug component.");
    494     }
    495 #endif  // USE_DL_PREFIX && !LIBC_STATIC
    496 }
    497