1 /* 2 * Copyright (C) 2009 The Android Open Source Project 3 * All rights reserved. 4 * 5 * Redistribution and use in source and binary forms, with or without 6 * modification, are permitted provided that the following conditions 7 * are met: 8 * * Redistributions of source code must retain the above copyright 9 * notice, this list of conditions and the following disclaimer. 10 * * Redistributions in binary form must reproduce the above copyright 11 * notice, this list of conditions and the following disclaimer in 12 * the documentation and/or other materials provided with the 13 * distribution. 14 * 15 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 16 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT 17 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS 18 * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE 19 * COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, 20 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, 21 * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS 22 * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED 23 * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, 24 * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT 25 * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 26 * SUCH DAMAGE. 27 */ 28 29 /* 30 * Contains definition of structures, global variables, and implementation of 31 * routines that are used by malloc leak detection code and other components in 32 * the system. The trick is that some components expect these data and 33 * routines to be defined / implemented in libc.so library, regardless 34 * whether or not MALLOC_LEAK_CHECK macro is defined. To make things even 35 * more tricky, malloc leak detection code, implemented in 36 * libc_malloc_debug.so also requires access to these variables and routines 37 * (to fill allocation entry hash table, for example). So, all relevant 38 * variables and routines are defined / implemented here and exported 39 * to all, leak detection code and other components via dynamic (libc.so), 40 * or static (libc.a) linking. 41 */ 42 43 #include <stdlib.h> 44 #include <pthread.h> 45 #include <unistd.h> 46 #include "dlmalloc.h" 47 #include "malloc_debug_common.h" 48 49 /* 50 * In a VM process, this is set to 1 after fork()ing out of zygote. 51 */ 52 int gMallocLeakZygoteChild = 0; 53 54 pthread_mutex_t gAllocationsMutex = PTHREAD_MUTEX_INITIALIZER; 55 HashTable gHashTable; 56 57 // ============================================================================= 58 // output functions 59 // ============================================================================= 60 61 static int hash_entry_compare(const void* arg1, const void* arg2) 62 { 63 int result; 64 65 HashEntry* e1 = *(HashEntry**)arg1; 66 HashEntry* e2 = *(HashEntry**)arg2; 67 68 // if one or both arg pointers are null, deal gracefully 69 if (e1 == NULL) { 70 result = (e2 == NULL) ? 0 : 1; 71 } else if (e2 == NULL) { 72 result = -1; 73 } else { 74 size_t nbAlloc1 = e1->allocations; 75 size_t nbAlloc2 = e2->allocations; 76 size_t size1 = e1->size & ~SIZE_FLAG_MASK; 77 size_t size2 = e2->size & ~SIZE_FLAG_MASK; 78 size_t alloc1 = nbAlloc1 * size1; 79 size_t alloc2 = nbAlloc2 * size2; 80 81 // sort in descending order by: 82 // 1) total size 83 // 2) number of allocations 84 // 85 // This is used for sorting, not determination of equality, so we don't 86 // need to compare the bit flags. 87 if (alloc1 > alloc2) { 88 result = -1; 89 } else if (alloc1 < alloc2) { 90 result = 1; 91 } else { 92 if (nbAlloc1 > nbAlloc2) { 93 result = -1; 94 } else if (nbAlloc1 < nbAlloc2) { 95 result = 1; 96 } else { 97 result = 0; 98 } 99 } 100 } 101 return result; 102 } 103 104 /* 105 * Retrieve native heap information. 106 * 107 * "*info" is set to a buffer we allocate 108 * "*overallSize" is set to the size of the "info" buffer 109 * "*infoSize" is set to the size of a single entry 110 * "*totalMemory" is set to the sum of all allocations we're tracking; does 111 * not include heap overhead 112 * "*backtraceSize" is set to the maximum number of entries in the back trace 113 */ 114 void get_malloc_leak_info(uint8_t** info, size_t* overallSize, 115 size_t* infoSize, size_t* totalMemory, size_t* backtraceSize) 116 { 117 // don't do anything if we have invalid arguments 118 if (info == NULL || overallSize == NULL || infoSize == NULL || 119 totalMemory == NULL || backtraceSize == NULL) { 120 return; 121 } 122 *totalMemory = 0; 123 124 pthread_mutex_lock(&gAllocationsMutex); 125 126 if (gHashTable.count == 0) { 127 *info = NULL; 128 *overallSize = 0; 129 *infoSize = 0; 130 *backtraceSize = 0; 131 goto done; 132 } 133 134 void** list = (void**)dlmalloc(sizeof(void*) * gHashTable.count); 135 136 // get the entries into an array to be sorted 137 int index = 0; 138 int i; 139 for (i = 0 ; i < HASHTABLE_SIZE ; i++) { 140 HashEntry* entry = gHashTable.slots[i]; 141 while (entry != NULL) { 142 list[index] = entry; 143 *totalMemory = *totalMemory + 144 ((entry->size & ~SIZE_FLAG_MASK) * entry->allocations); 145 index++; 146 entry = entry->next; 147 } 148 } 149 150 // XXX: the protocol doesn't allow variable size for the stack trace (yet) 151 *infoSize = (sizeof(size_t) * 2) + (sizeof(intptr_t) * BACKTRACE_SIZE); 152 *overallSize = *infoSize * gHashTable.count; 153 *backtraceSize = BACKTRACE_SIZE; 154 155 // now get A byte array big enough for this 156 *info = (uint8_t*)dlmalloc(*overallSize); 157 158 if (*info == NULL) { 159 *overallSize = 0; 160 goto out_nomem_info; 161 } 162 163 qsort((void*)list, gHashTable.count, sizeof(void*), hash_entry_compare); 164 165 uint8_t* head = *info; 166 const int count = gHashTable.count; 167 for (i = 0 ; i < count ; i++) { 168 HashEntry* entry = list[i]; 169 size_t entrySize = (sizeof(size_t) * 2) + (sizeof(intptr_t) * entry->numEntries); 170 if (entrySize < *infoSize) { 171 /* we're writing less than a full entry, clear out the rest */ 172 memset(head + entrySize, 0, *infoSize - entrySize); 173 } else { 174 /* make sure the amount we're copying doesn't exceed the limit */ 175 entrySize = *infoSize; 176 } 177 memcpy(head, &(entry->size), entrySize); 178 head += *infoSize; 179 } 180 181 out_nomem_info: 182 dlfree(list); 183 184 done: 185 pthread_mutex_unlock(&gAllocationsMutex); 186 } 187 188 void free_malloc_leak_info(uint8_t* info) 189 { 190 dlfree(info); 191 } 192 193 struct mallinfo mallinfo() 194 { 195 return dlmallinfo(); 196 } 197 198 void* valloc(size_t bytes) { 199 /* assume page size of 4096 bytes */ 200 return memalign( getpagesize(), bytes ); 201 } 202 203 /* Support for malloc debugging. 204 * Note that if USE_DL_PREFIX is not defined, it's assumed that memory 205 * allocation routines are implemented somewhere else, so all our custom 206 * malloc routines should not be compiled at all. 207 */ 208 #ifdef USE_DL_PREFIX 209 210 /* Table for dispatching malloc calls, initialized with default dispatchers. */ 211 const MallocDebug __libc_malloc_default_dispatch __attribute__((aligned(32))) = 212 { 213 dlmalloc, dlfree, dlcalloc, dlrealloc, dlmemalign 214 }; 215 216 /* Selector of dispatch table to use for dispatching malloc calls. */ 217 const MallocDebug* __libc_malloc_dispatch = &__libc_malloc_default_dispatch; 218 219 void* malloc(size_t bytes) { 220 return __libc_malloc_dispatch->malloc(bytes); 221 } 222 void free(void* mem) { 223 __libc_malloc_dispatch->free(mem); 224 } 225 void* calloc(size_t n_elements, size_t elem_size) { 226 return __libc_malloc_dispatch->calloc(n_elements, elem_size); 227 } 228 void* realloc(void* oldMem, size_t bytes) { 229 return __libc_malloc_dispatch->realloc(oldMem, bytes); 230 } 231 void* memalign(size_t alignment, size_t bytes) { 232 return __libc_malloc_dispatch->memalign(alignment, bytes); 233 } 234 235 /* We implement malloc debugging only in libc.so, so code bellow 236 * must be excluded if we compile this file for static libc.a 237 */ 238 #ifndef LIBC_STATIC 239 #include <sys/system_properties.h> 240 #include <dlfcn.h> 241 #include "logd.h" 242 243 /* Table for dispatching malloc calls, depending on environment. */ 244 static MallocDebug gMallocUse __attribute__((aligned(32))) = { 245 dlmalloc, dlfree, dlcalloc, dlrealloc, dlmemalign 246 }; 247 248 extern char* __progname; 249 250 /* Handle to shared library where actual memory allocation is implemented. 251 * This library is loaded and memory allocation calls are redirected there 252 * when libc.debug.malloc environment variable contains value other than 253 * zero: 254 * 1 - For memory leak detections. 255 * 5 - For filling allocated / freed memory with patterns defined by 256 * CHK_SENTINEL_VALUE, and CHK_FILL_FREE macros. 257 * 10 - For adding pre-, and post- allocation stubs in order to detect 258 * buffer overruns. 259 * Note that emulator's memory allocation instrumentation is not controlled by 260 * libc.debug.malloc value, but rather by emulator, started with -memcheck 261 * option. Note also, that if emulator has started with -memcheck option, 262 * emulator's instrumented memory allocation will take over value saved in 263 * libc.debug.malloc. In other words, if emulator has started with -memcheck 264 * option, libc.debug.malloc value is ignored. 265 * Actual functionality for debug levels 1-10 is implemented in 266 * libc_malloc_debug_leak.so, while functionality for emultor's instrumented 267 * allocations is implemented in libc_malloc_debug_qemu.so and can be run inside 268 * the emulator only. 269 */ 270 static void* libc_malloc_impl_handle = NULL; 271 272 /* Make sure we have MALLOC_ALIGNMENT that matches the one that is 273 * used in dlmalloc. Emulator's memchecker needs this value to properly 274 * align its guarding zones. 275 */ 276 #ifndef MALLOC_ALIGNMENT 277 #define MALLOC_ALIGNMENT ((size_t)8U) 278 #endif /* MALLOC_ALIGNMENT */ 279 280 /* This variable is set to the value of property libc.debug.malloc.backlog, 281 * when the value of libc.debug.malloc = 10. It determines the size of the 282 * backlog we use to detect multiple frees. If the property is not set, the 283 * backlog length defaults to an internal constant defined in 284 * malloc_debug_check.c 285 */ 286 unsigned int malloc_double_free_backlog; 287 288 /* Initializes memory allocation framework once per process. */ 289 static void malloc_init_impl(void) 290 { 291 const char* so_name = NULL; 292 MallocDebugInit malloc_debug_initialize = NULL; 293 unsigned int qemu_running = 0; 294 unsigned int debug_level = 0; 295 unsigned int memcheck_enabled = 0; 296 char env[PROP_VALUE_MAX]; 297 char memcheck_tracing[PROP_VALUE_MAX]; 298 char debug_program[PROP_VALUE_MAX]; 299 300 /* Get custom malloc debug level. Note that emulator started with 301 * memory checking option will have priority over debug level set in 302 * libc.debug.malloc system property. */ 303 if (__system_property_get("ro.kernel.qemu", env) && atoi(env)) { 304 qemu_running = 1; 305 if (__system_property_get("ro.kernel.memcheck", memcheck_tracing)) { 306 if (memcheck_tracing[0] != '0') { 307 // Emulator has started with memory tracing enabled. Enforce it. 308 debug_level = 20; 309 memcheck_enabled = 1; 310 } 311 } 312 } 313 314 /* If debug level has not been set by memcheck option in the emulator, 315 * lets grab it from libc.debug.malloc system property. */ 316 if (!debug_level && __system_property_get("libc.debug.malloc", env)) { 317 debug_level = atoi(env); 318 } 319 320 /* Debug level 0 means that we should use dlxxx allocation 321 * routines (default). */ 322 if (!debug_level) { 323 return; 324 } 325 326 /* If libc.debug.malloc.program is set and is not a substring of progname, 327 * then exit. 328 */ 329 if (__system_property_get("libc.debug.malloc.program", debug_program)) { 330 if (!strstr(__progname, debug_program)) { 331 return; 332 } 333 } 334 335 // Lets see which .so must be loaded for the requested debug level 336 switch (debug_level) { 337 case 1: 338 case 5: 339 case 10: { 340 char debug_backlog[PROP_VALUE_MAX]; 341 if (__system_property_get("libc.debug.malloc.backlog", debug_backlog)) { 342 malloc_double_free_backlog = atoi(debug_backlog); 343 info_log("%s: setting backlog length to %d\n", 344 __progname, malloc_double_free_backlog); 345 } 346 347 so_name = "/system/lib/libc_malloc_debug_leak.so"; 348 break; 349 } 350 case 20: 351 // Quick check: debug level 20 can only be handled in emulator. 352 if (!qemu_running) { 353 error_log("%s: Debug level %d can only be set in emulator\n", 354 __progname, debug_level); 355 return; 356 } 357 // Make sure that memory checking has been enabled in emulator. 358 if (!memcheck_enabled) { 359 error_log("%s: Memory checking is not enabled in the emulator\n", 360 __progname); 361 return; 362 } 363 so_name = "/system/lib/libc_malloc_debug_qemu.so"; 364 break; 365 default: 366 error_log("%s: Debug level %d is unknown\n", 367 __progname, debug_level); 368 return; 369 } 370 371 // Load .so that implements the required malloc debugging functionality. 372 libc_malloc_impl_handle = dlopen(so_name, RTLD_LAZY); 373 if (libc_malloc_impl_handle == NULL) { 374 error_log("%s: Missing module %s required for malloc debug level %d\n", 375 __progname, so_name, debug_level); 376 return; 377 } 378 379 // Initialize malloc debugging in the loaded module. 380 malloc_debug_initialize = 381 dlsym(libc_malloc_impl_handle, "malloc_debug_initialize"); 382 if (malloc_debug_initialize == NULL) { 383 error_log("%s: Initialization routine is not found in %s\n", 384 __progname, so_name); 385 dlclose(libc_malloc_impl_handle); 386 return; 387 } 388 if (malloc_debug_initialize()) { 389 dlclose(libc_malloc_impl_handle); 390 return; 391 } 392 393 if (debug_level == 20) { 394 // For memory checker we need to do extra initialization. 395 int (*memcheck_initialize)(int, const char*) = 396 dlsym(libc_malloc_impl_handle, "memcheck_initialize"); 397 if (memcheck_initialize == NULL) { 398 error_log("%s: memcheck_initialize routine is not found in %s\n", 399 __progname, so_name); 400 dlclose(libc_malloc_impl_handle); 401 return; 402 } 403 if (memcheck_initialize(MALLOC_ALIGNMENT, memcheck_tracing)) { 404 dlclose(libc_malloc_impl_handle); 405 return; 406 } 407 } 408 409 // Initialize malloc dispatch table with appropriate routines. 410 switch (debug_level) { 411 case 1: 412 __libc_android_log_print(ANDROID_LOG_INFO, "libc", 413 "%s using MALLOC_DEBUG = %d (leak checker)\n", 414 __progname, debug_level); 415 gMallocUse.malloc = 416 dlsym(libc_malloc_impl_handle, "leak_malloc"); 417 gMallocUse.free = 418 dlsym(libc_malloc_impl_handle, "leak_free"); 419 gMallocUse.calloc = 420 dlsym(libc_malloc_impl_handle, "leak_calloc"); 421 gMallocUse.realloc = 422 dlsym(libc_malloc_impl_handle, "leak_realloc"); 423 gMallocUse.memalign = 424 dlsym(libc_malloc_impl_handle, "leak_memalign"); 425 break; 426 case 5: 427 __libc_android_log_print(ANDROID_LOG_INFO, "libc", 428 "%s using MALLOC_DEBUG = %d (fill)\n", 429 __progname, debug_level); 430 gMallocUse.malloc = 431 dlsym(libc_malloc_impl_handle, "fill_malloc"); 432 gMallocUse.free = 433 dlsym(libc_malloc_impl_handle, "fill_free"); 434 gMallocUse.calloc = dlcalloc; 435 gMallocUse.realloc = 436 dlsym(libc_malloc_impl_handle, "fill_realloc"); 437 gMallocUse.memalign = 438 dlsym(libc_malloc_impl_handle, "fill_memalign"); 439 break; 440 case 10: 441 __libc_android_log_print(ANDROID_LOG_INFO, "libc", 442 "%s using MALLOC_DEBUG = %d (sentinels, fill)\n", 443 __progname, debug_level); 444 gMallocUse.malloc = 445 dlsym(libc_malloc_impl_handle, "chk_malloc"); 446 gMallocUse.free = 447 dlsym(libc_malloc_impl_handle, "chk_free"); 448 gMallocUse.calloc = 449 dlsym(libc_malloc_impl_handle, "chk_calloc"); 450 gMallocUse.realloc = 451 dlsym(libc_malloc_impl_handle, "chk_realloc"); 452 gMallocUse.memalign = 453 dlsym(libc_malloc_impl_handle, "chk_memalign"); 454 break; 455 case 20: 456 __libc_android_log_print(ANDROID_LOG_INFO, "libc", 457 "%s[%u] using MALLOC_DEBUG = %d (instrumented for emulator)\n", 458 __progname, getpid(), debug_level); 459 gMallocUse.malloc = 460 dlsym(libc_malloc_impl_handle, "qemu_instrumented_malloc"); 461 gMallocUse.free = 462 dlsym(libc_malloc_impl_handle, "qemu_instrumented_free"); 463 gMallocUse.calloc = 464 dlsym(libc_malloc_impl_handle, "qemu_instrumented_calloc"); 465 gMallocUse.realloc = 466 dlsym(libc_malloc_impl_handle, "qemu_instrumented_realloc"); 467 gMallocUse.memalign = 468 dlsym(libc_malloc_impl_handle, "qemu_instrumented_memalign"); 469 break; 470 default: 471 break; 472 } 473 474 // Make sure dispatch table is initialized 475 if ((gMallocUse.malloc == NULL) || 476 (gMallocUse.free == NULL) || 477 (gMallocUse.calloc == NULL) || 478 (gMallocUse.realloc == NULL) || 479 (gMallocUse.memalign == NULL)) { 480 error_log("%s: Cannot initialize malloc dispatch table for debug level" 481 " %d: %p, %p, %p, %p, %p\n", 482 __progname, debug_level, 483 gMallocUse.malloc, gMallocUse.free, 484 gMallocUse.calloc, gMallocUse.realloc, 485 gMallocUse.memalign); 486 dlclose(libc_malloc_impl_handle); 487 libc_malloc_impl_handle = NULL; 488 } else { 489 __libc_malloc_dispatch = &gMallocUse; 490 } 491 } 492 493 static void malloc_fini_impl(void) 494 { 495 if (libc_malloc_impl_handle) { 496 MallocDebugFini malloc_debug_finalize = NULL; 497 malloc_debug_finalize = 498 dlsym(libc_malloc_impl_handle, "malloc_debug_finalize"); 499 if (malloc_debug_finalize) 500 malloc_debug_finalize(); 501 } 502 } 503 504 static pthread_once_t malloc_init_once_ctl = PTHREAD_ONCE_INIT; 505 static pthread_once_t malloc_fini_once_ctl = PTHREAD_ONCE_INIT; 506 507 #endif // !LIBC_STATIC 508 #endif // USE_DL_PREFIX 509 510 /* Initializes memory allocation framework. 511 * This routine is called from __libc_init routines implemented 512 * in libc_init_static.c and libc_init_dynamic.c files. 513 */ 514 void malloc_debug_init(void) 515 { 516 /* We need to initialize malloc iff we implement here custom 517 * malloc routines (i.e. USE_DL_PREFIX is defined) for libc.so */ 518 #if defined(USE_DL_PREFIX) && !defined(LIBC_STATIC) 519 if (pthread_once(&malloc_init_once_ctl, malloc_init_impl)) { 520 error_log("Unable to initialize malloc_debug component."); 521 } 522 #endif // USE_DL_PREFIX && !LIBC_STATIC 523 } 524 525 void malloc_debug_fini(void) 526 { 527 /* We need to finalize malloc iff we implement here custom 528 * malloc routines (i.e. USE_DL_PREFIX is defined) for libc.so */ 529 #if defined(USE_DL_PREFIX) && !defined(LIBC_STATIC) 530 if (pthread_once(&malloc_fini_once_ctl, malloc_fini_impl)) { 531 error_log("Unable to finalize malloc_debug component."); 532 } 533 #endif // USE_DL_PREFIX && !LIBC_STATIC 534 } 535
