1 /* 2 * Copyright (C) 2009 The Android Open Source Project 3 * All rights reserved. 4 * 5 * Redistribution and use in source and binary forms, with or without 6 * modification, are permitted provided that the following conditions 7 * are met: 8 * * Redistributions of source code must retain the above copyright 9 * notice, this list of conditions and the following disclaimer. 10 * * Redistributions in binary form must reproduce the above copyright 11 * notice, this list of conditions and the following disclaimer in 12 * the documentation and/or other materials provided with the 13 * distribution. 14 * 15 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 16 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT 17 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS 18 * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE 19 * COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, 20 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, 21 * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS 22 * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED 23 * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, 24 * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT 25 * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 26 * SUCH DAMAGE. 27 */ 28 29 /* 30 * Contains definition of structures, global variables, and implementation of 31 * routines that are used by malloc leak detection code and other components in 32 * the system. The trick is that some components expect these data and 33 * routines to be defined / implemented in libc.so library, regardless 34 * whether or not MALLOC_LEAK_CHECK macro is defined. To make things even 35 * more tricky, malloc leak detection code, implemented in 36 * libc_malloc_debug.so also requires access to these variables and routines 37 * (to fill allocation entry hash table, for example). So, all relevant 38 * variables and routines are defined / implemented here and exported 39 * to all, leak detection code and other components via dynamic (libc.so), 40 * or static (libc.a) linking. 41 */ 42 43 #include "malloc_debug_common.h" 44 45 #include <pthread.h> 46 #include <stdlib.h> 47 #include <unistd.h> 48 49 #include "dlmalloc.h" 50 #include "ScopedPthreadMutexLocker.h" 51 52 /* 53 * In a VM process, this is set to 1 after fork()ing out of zygote. 54 */ 55 int gMallocLeakZygoteChild = 0; 56 57 pthread_mutex_t gAllocationsMutex = PTHREAD_MUTEX_INITIALIZER; 58 HashTable gHashTable; 59 60 // ============================================================================= 61 // output functions 62 // ============================================================================= 63 64 static int hash_entry_compare(const void* arg1, const void* arg2) { 65 int result; 66 67 const HashEntry* e1 = *static_cast<HashEntry* const*>(arg1); 68 const HashEntry* e2 = *static_cast<HashEntry* const*>(arg2); 69 70 // if one or both arg pointers are null, deal gracefully 71 if (e1 == NULL) { 72 result = (e2 == NULL) ? 0 : 1; 73 } else if (e2 == NULL) { 74 result = -1; 75 } else { 76 size_t nbAlloc1 = e1->allocations; 77 size_t nbAlloc2 = e2->allocations; 78 size_t size1 = e1->size & ~SIZE_FLAG_MASK; 79 size_t size2 = e2->size & ~SIZE_FLAG_MASK; 80 size_t alloc1 = nbAlloc1 * size1; 81 size_t alloc2 = nbAlloc2 * size2; 82 83 // sort in descending order by: 84 // 1) total size 85 // 2) number of allocations 86 // 87 // This is used for sorting, not determination of equality, so we don't 88 // need to compare the bit flags. 89 if (alloc1 > alloc2) { 90 result = -1; 91 } else if (alloc1 < alloc2) { 92 result = 1; 93 } else { 94 if (nbAlloc1 > nbAlloc2) { 95 result = -1; 96 } else if (nbAlloc1 < nbAlloc2) { 97 result = 1; 98 } else { 99 result = 0; 100 } 101 } 102 } 103 return result; 104 } 105 106 /* 107 * Retrieve native heap information. 108 * 109 * "*info" is set to a buffer we allocate 110 * "*overallSize" is set to the size of the "info" buffer 111 * "*infoSize" is set to the size of a single entry 112 * "*totalMemory" is set to the sum of all allocations we're tracking; does 113 * not include heap overhead 114 * "*backtraceSize" is set to the maximum number of entries in the back trace 115 */ 116 extern "C" void get_malloc_leak_info(uint8_t** info, size_t* overallSize, 117 size_t* infoSize, size_t* totalMemory, size_t* backtraceSize) { 118 // don't do anything if we have invalid arguments 119 if (info == NULL || overallSize == NULL || infoSize == NULL || 120 totalMemory == NULL || backtraceSize == NULL) { 121 return; 122 } 123 *totalMemory = 0; 124 125 ScopedPthreadMutexLocker locker(&gAllocationsMutex); 126 127 if (gHashTable.count == 0) { 128 *info = NULL; 129 *overallSize = 0; 130 *infoSize = 0; 131 *backtraceSize = 0; 132 return; 133 } 134 135 HashEntry** list = static_cast<HashEntry**>(dlmalloc(sizeof(void*) * gHashTable.count)); 136 137 // get the entries into an array to be sorted 138 int index = 0; 139 for (size_t i = 0 ; i < HASHTABLE_SIZE ; ++i) { 140 HashEntry* entry = gHashTable.slots[i]; 141 while (entry != NULL) { 142 list[index] = entry; 143 *totalMemory = *totalMemory + 144 ((entry->size & ~SIZE_FLAG_MASK) * entry->allocations); 145 index++; 146 entry = entry->next; 147 } 148 } 149 150 // XXX: the protocol doesn't allow variable size for the stack trace (yet) 151 *infoSize = (sizeof(size_t) * 2) + (sizeof(uintptr_t) * BACKTRACE_SIZE); 152 *overallSize = *infoSize * gHashTable.count; 153 *backtraceSize = BACKTRACE_SIZE; 154 155 // now get a byte array big enough for this 156 *info = static_cast<uint8_t*>(dlmalloc(*overallSize)); 157 158 if (*info == NULL) { 159 *overallSize = 0; 160 dlfree(list); 161 return; 162 } 163 164 qsort(list, gHashTable.count, sizeof(void*), hash_entry_compare); 165 166 uint8_t* head = *info; 167 const int count = gHashTable.count; 168 for (int i = 0 ; i < count ; ++i) { 169 HashEntry* entry = list[i]; 170 size_t entrySize = (sizeof(size_t) * 2) + (sizeof(uintptr_t) * entry->numEntries); 171 if (entrySize < *infoSize) { 172 /* we're writing less than a full entry, clear out the rest */ 173 memset(head + entrySize, 0, *infoSize - entrySize); 174 } else { 175 /* make sure the amount we're copying doesn't exceed the limit */ 176 entrySize = *infoSize; 177 } 178 memcpy(head, &(entry->size), entrySize); 179 head += *infoSize; 180 } 181 182 dlfree(list); 183 } 184 185 extern "C" void free_malloc_leak_info(uint8_t* info) { 186 dlfree(info); 187 } 188 189 extern "C" struct mallinfo mallinfo() { 190 return dlmallinfo(); 191 } 192 193 extern "C" size_t malloc_usable_size(void* mem) { 194 return dlmalloc_usable_size(mem); 195 } 196 197 extern "C" void* valloc(size_t bytes) { 198 return dlvalloc(bytes); 199 } 200 201 extern "C" void* pvalloc(size_t bytes) { 202 return dlpvalloc(bytes); 203 } 204 205 extern "C" int posix_memalign(void** memptr, size_t alignment, size_t size) { 206 return dlposix_memalign(memptr, alignment, size); 207 } 208 209 /* Support for malloc debugging. 210 * Note that if USE_DL_PREFIX is not defined, it's assumed that memory 211 * allocation routines are implemented somewhere else, so all our custom 212 * malloc routines should not be compiled at all. 213 */ 214 #ifdef USE_DL_PREFIX 215 216 /* Table for dispatching malloc calls, initialized with default dispatchers. */ 217 extern const MallocDebug __libc_malloc_default_dispatch; 218 const MallocDebug __libc_malloc_default_dispatch __attribute__((aligned(32))) = { 219 dlmalloc, dlfree, dlcalloc, dlrealloc, dlmemalign 220 }; 221 222 /* Selector of dispatch table to use for dispatching malloc calls. */ 223 const MallocDebug* __libc_malloc_dispatch = &__libc_malloc_default_dispatch; 224 225 extern "C" void* malloc(size_t bytes) { 226 return __libc_malloc_dispatch->malloc(bytes); 227 } 228 229 extern "C" void free(void* mem) { 230 __libc_malloc_dispatch->free(mem); 231 } 232 233 extern "C" void* calloc(size_t n_elements, size_t elem_size) { 234 return __libc_malloc_dispatch->calloc(n_elements, elem_size); 235 } 236 237 extern "C" void* realloc(void* oldMem, size_t bytes) { 238 return __libc_malloc_dispatch->realloc(oldMem, bytes); 239 } 240 241 extern "C" void* memalign(size_t alignment, size_t bytes) { 242 return __libc_malloc_dispatch->memalign(alignment, bytes); 243 } 244 245 /* We implement malloc debugging only in libc.so, so code below 246 * must be excluded if we compile this file for static libc.a 247 */ 248 #ifndef LIBC_STATIC 249 #include <sys/system_properties.h> 250 #include <dlfcn.h> 251 #include <stdio.h> 252 #include "libc_logging.h" 253 254 /* Table for dispatching malloc calls, depending on environment. */ 255 static MallocDebug gMallocUse __attribute__((aligned(32))) = { 256 dlmalloc, dlfree, dlcalloc, dlrealloc, dlmemalign 257 }; 258 259 extern const char* __progname; 260 261 /* Handle to shared library where actual memory allocation is implemented. 262 * This library is loaded and memory allocation calls are redirected there 263 * when libc.debug.malloc environment variable contains value other than 264 * zero: 265 * 1 - For memory leak detections. 266 * 5 - For filling allocated / freed memory with patterns defined by 267 * CHK_SENTINEL_VALUE, and CHK_FILL_FREE macros. 268 * 10 - For adding pre-, and post- allocation stubs in order to detect 269 * buffer overruns. 270 * Note that emulator's memory allocation instrumentation is not controlled by 271 * libc.debug.malloc value, but rather by emulator, started with -memcheck 272 * option. Note also, that if emulator has started with -memcheck option, 273 * emulator's instrumented memory allocation will take over value saved in 274 * libc.debug.malloc. In other words, if emulator has started with -memcheck 275 * option, libc.debug.malloc value is ignored. 276 * Actual functionality for debug levels 1-10 is implemented in 277 * libc_malloc_debug_leak.so, while functionality for emultor's instrumented 278 * allocations is implemented in libc_malloc_debug_qemu.so and can be run inside 279 * the emulator only. 280 */ 281 static void* libc_malloc_impl_handle = NULL; 282 283 // This must match the alignment used by dlmalloc. 284 #ifndef MALLOC_ALIGNMENT 285 #define MALLOC_ALIGNMENT ((size_t)(2 * sizeof(void *))) 286 #endif 287 288 /* This variable is set to the value of property libc.debug.malloc.backlog, 289 * when the value of libc.debug.malloc = 10. It determines the size of the 290 * backlog we use to detect multiple frees. If the property is not set, the 291 * backlog length defaults to BACKLOG_DEFAULT_LEN. 292 */ 293 unsigned int gMallocDebugBacklog; 294 #define BACKLOG_DEFAULT_LEN 100 295 296 /* The value of libc.debug.malloc. */ 297 int gMallocDebugLevel; 298 299 static void InitMalloc(MallocDebug* table, const char* prefix) { 300 __libc_format_log(ANDROID_LOG_INFO, "libc", "%s: using libc.debug.malloc %d (%s)\n", 301 __progname, gMallocDebugLevel, prefix); 302 303 char symbol[128]; 304 305 snprintf(symbol, sizeof(symbol), "%s_malloc", prefix); 306 table->malloc = reinterpret_cast<MallocDebugMalloc>(dlsym(libc_malloc_impl_handle, symbol)); 307 if (table->malloc == NULL) { 308 error_log("%s: dlsym(\"%s\") failed", __progname, symbol); 309 } 310 311 snprintf(symbol, sizeof(symbol), "%s_free", prefix); 312 table->free = reinterpret_cast<MallocDebugFree>(dlsym(libc_malloc_impl_handle, symbol)); 313 if (table->free == NULL) { 314 error_log("%s: dlsym(\"%s\") failed", __progname, symbol); 315 } 316 317 snprintf(symbol, sizeof(symbol), "%s_calloc", prefix); 318 table->calloc = reinterpret_cast<MallocDebugCalloc>(dlsym(libc_malloc_impl_handle, symbol)); 319 if (table->calloc == NULL) { 320 error_log("%s: dlsym(\"%s\") failed", __progname, symbol); 321 } 322 323 snprintf(symbol, sizeof(symbol), "%s_realloc", prefix); 324 table->realloc = reinterpret_cast<MallocDebugRealloc>(dlsym(libc_malloc_impl_handle, symbol)); 325 if (table->realloc == NULL) { 326 error_log("%s: dlsym(\"%s\") failed", __progname, symbol); 327 } 328 329 snprintf(symbol, sizeof(symbol), "%s_memalign", prefix); 330 table->memalign = reinterpret_cast<MallocDebugMemalign>(dlsym(libc_malloc_impl_handle, symbol)); 331 if (table->memalign == NULL) { 332 error_log("%s: dlsym(\"%s\") failed", __progname, symbol); 333 } 334 } 335 336 /* Initializes memory allocation framework once per process. */ 337 static void malloc_init_impl() { 338 const char* so_name = NULL; 339 MallocDebugInit malloc_debug_initialize = NULL; 340 unsigned int qemu_running = 0; 341 unsigned int memcheck_enabled = 0; 342 char env[PROP_VALUE_MAX]; 343 char memcheck_tracing[PROP_VALUE_MAX]; 344 char debug_program[PROP_VALUE_MAX]; 345 346 /* Get custom malloc debug level. Note that emulator started with 347 * memory checking option will have priority over debug level set in 348 * libc.debug.malloc system property. */ 349 if (__system_property_get("ro.kernel.qemu", env) && atoi(env)) { 350 qemu_running = 1; 351 if (__system_property_get("ro.kernel.memcheck", memcheck_tracing)) { 352 if (memcheck_tracing[0] != '0') { 353 // Emulator has started with memory tracing enabled. Enforce it. 354 gMallocDebugLevel = 20; 355 memcheck_enabled = 1; 356 } 357 } 358 } 359 360 /* If debug level has not been set by memcheck option in the emulator, 361 * lets grab it from libc.debug.malloc system property. */ 362 if (gMallocDebugLevel == 0 && __system_property_get("libc.debug.malloc", env)) { 363 gMallocDebugLevel = atoi(env); 364 } 365 366 /* Debug level 0 means that we should use dlxxx allocation 367 * routines (default). */ 368 if (gMallocDebugLevel == 0) { 369 return; 370 } 371 372 /* If libc.debug.malloc.program is set and is not a substring of progname, 373 * then exit. 374 */ 375 if (__system_property_get("libc.debug.malloc.program", debug_program)) { 376 if (!strstr(__progname, debug_program)) { 377 return; 378 } 379 } 380 381 // mksh is way too leaky. http://b/7291287. 382 if (gMallocDebugLevel >= 10) { 383 if (strcmp(__progname, "sh") == 0 || strcmp(__progname, "/system/bin/sh") == 0) { 384 return; 385 } 386 } 387 388 // Choose the appropriate .so for the requested debug level. 389 switch (gMallocDebugLevel) { 390 case 1: 391 case 5: 392 case 10: { 393 char debug_backlog[PROP_VALUE_MAX]; 394 if (__system_property_get("libc.debug.malloc.backlog", debug_backlog)) { 395 gMallocDebugBacklog = atoi(debug_backlog); 396 info_log("%s: setting backlog length to %d\n", __progname, gMallocDebugBacklog); 397 } 398 if (gMallocDebugBacklog == 0) { 399 gMallocDebugBacklog = BACKLOG_DEFAULT_LEN; 400 } 401 so_name = "/system/lib/libc_malloc_debug_leak.so"; 402 break; 403 } 404 case 20: 405 // Quick check: debug level 20 can only be handled in emulator. 406 if (!qemu_running) { 407 error_log("%s: Debug level %d can only be set in emulator\n", 408 __progname, gMallocDebugLevel); 409 return; 410 } 411 // Make sure that memory checking has been enabled in emulator. 412 if (!memcheck_enabled) { 413 error_log("%s: Memory checking is not enabled in the emulator\n", 414 __progname); 415 return; 416 } 417 so_name = "/system/lib/libc_malloc_debug_qemu.so"; 418 break; 419 default: 420 error_log("%s: Debug level %d is unknown\n", __progname, gMallocDebugLevel); 421 return; 422 } 423 424 // Load .so that implements the required malloc debugging functionality. 425 libc_malloc_impl_handle = dlopen(so_name, RTLD_LAZY); 426 if (libc_malloc_impl_handle == NULL) { 427 error_log("%s: Missing module %s required for malloc debug level %d: %s", 428 __progname, so_name, gMallocDebugLevel, dlerror()); 429 return; 430 } 431 432 // Initialize malloc debugging in the loaded module. 433 malloc_debug_initialize = reinterpret_cast<MallocDebugInit>(dlsym(libc_malloc_impl_handle, 434 "malloc_debug_initialize")); 435 if (malloc_debug_initialize == NULL) { 436 error_log("%s: Initialization routine is not found in %s\n", 437 __progname, so_name); 438 dlclose(libc_malloc_impl_handle); 439 return; 440 } 441 if (malloc_debug_initialize() == -1) { 442 dlclose(libc_malloc_impl_handle); 443 return; 444 } 445 446 if (gMallocDebugLevel == 20) { 447 // For memory checker we need to do extra initialization. 448 typedef int (*MemCheckInit)(int, const char*); 449 MemCheckInit memcheck_initialize = 450 reinterpret_cast<MemCheckInit>(dlsym(libc_malloc_impl_handle, 451 "memcheck_initialize")); 452 if (memcheck_initialize == NULL) { 453 error_log("%s: memcheck_initialize routine is not found in %s\n", 454 __progname, so_name); 455 dlclose(libc_malloc_impl_handle); 456 return; 457 } 458 459 if (memcheck_initialize(MALLOC_ALIGNMENT, memcheck_tracing)) { 460 dlclose(libc_malloc_impl_handle); 461 return; 462 } 463 } 464 465 // Initialize malloc dispatch table with appropriate routines. 466 switch (gMallocDebugLevel) { 467 case 1: 468 InitMalloc(&gMallocUse, "leak"); 469 break; 470 case 5: 471 InitMalloc(&gMallocUse, "fill"); 472 break; 473 case 10: 474 InitMalloc(&gMallocUse, "chk"); 475 break; 476 case 20: 477 InitMalloc(&gMallocUse, "qemu_instrumented"); 478 break; 479 default: 480 break; 481 } 482 483 // Make sure dispatch table is initialized 484 if ((gMallocUse.malloc == NULL) || 485 (gMallocUse.free == NULL) || 486 (gMallocUse.calloc == NULL) || 487 (gMallocUse.realloc == NULL) || 488 (gMallocUse.memalign == NULL)) { 489 error_log("%s: some symbols for libc.debug.malloc level %d were not found (see above)", 490 __progname, gMallocDebugLevel); 491 dlclose(libc_malloc_impl_handle); 492 libc_malloc_impl_handle = NULL; 493 } else { 494 __libc_malloc_dispatch = &gMallocUse; 495 } 496 } 497 498 static void malloc_fini_impl() { 499 // Our BSD stdio implementation doesn't close the standard streams, it only flushes them. 500 // And it doesn't do that until its atexit handler (_cleanup) is run, and we run first! 501 // It's great that other unclosed FILE*s show up as malloc leaks, but we need to manually 502 // clean up the standard streams ourselves. 503 fclose(stdin); 504 fclose(stdout); 505 fclose(stderr); 506 507 if (libc_malloc_impl_handle != NULL) { 508 MallocDebugFini malloc_debug_finalize = 509 reinterpret_cast<MallocDebugFini>(dlsym(libc_malloc_impl_handle, 510 "malloc_debug_finalize")); 511 if (malloc_debug_finalize != NULL) { 512 malloc_debug_finalize(); 513 } 514 } 515 } 516 517 static pthread_once_t malloc_init_once_ctl = PTHREAD_ONCE_INIT; 518 static pthread_once_t malloc_fini_once_ctl = PTHREAD_ONCE_INIT; 519 520 #endif // !LIBC_STATIC 521 #endif // USE_DL_PREFIX 522 523 /* Initializes memory allocation framework. 524 * This routine is called from __libc_init routines implemented 525 * in libc_init_static.c and libc_init_dynamic.c files. 526 */ 527 extern "C" void malloc_debug_init() { 528 /* We need to initialize malloc iff we implement here custom 529 * malloc routines (i.e. USE_DL_PREFIX is defined) for libc.so */ 530 #if defined(USE_DL_PREFIX) && !defined(LIBC_STATIC) 531 if (pthread_once(&malloc_init_once_ctl, malloc_init_impl)) { 532 error_log("Unable to initialize malloc_debug component."); 533 } 534 #endif // USE_DL_PREFIX && !LIBC_STATIC 535 } 536 537 extern "C" void malloc_debug_fini() { 538 /* We need to finalize malloc iff we implement here custom 539 * malloc routines (i.e. USE_DL_PREFIX is defined) for libc.so */ 540 #if defined(USE_DL_PREFIX) && !defined(LIBC_STATIC) 541 if (pthread_once(&malloc_fini_once_ctl, malloc_fini_impl)) { 542 error_log("Unable to finalize malloc_debug component."); 543 } 544 #endif // USE_DL_PREFIX && !LIBC_STATIC 545 } 546