1 /* 2 * Copyright (C) 2009 The Android Open Source Project 3 * All rights reserved. 4 * 5 * Redistribution and use in source and binary forms, with or without 6 * modification, are permitted provided that the following conditions 7 * are met: 8 * * Redistributions of source code must retain the above copyright 9 * notice, this list of conditions and the following disclaimer. 10 * * Redistributions in binary form must reproduce the above copyright 11 * notice, this list of conditions and the following disclaimer in 12 * the documentation and/or other materials provided with the 13 * distribution. 14 * 15 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 16 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT 17 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS 18 * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE 19 * COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, 20 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, 21 * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS 22 * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED 23 * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, 24 * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT 25 * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 26 * SUCH DAMAGE. 27 */ 28 29 // Contains definition of structures, global variables, and implementation of 30 // routines that are used by malloc leak detection code and other components in 31 // the system. The trick is that some components expect these data and 32 // routines to be defined / implemented in libc.so library, regardless 33 // whether or not MALLOC_LEAK_CHECK macro is defined. To make things even 34 // more tricky, malloc leak detection code, implemented in 35 // libc_malloc_debug.so also requires access to these variables and routines 36 // (to fill allocation entry hash table, for example). So, all relevant 37 // variables and routines are defined / implemented here and exported 38 // to all, leak detection code and other components via dynamic (libc.so), 39 // or static (libc.a) linking. 40 41 #include "malloc_debug_common.h" 42 43 #include <pthread.h> 44 #include <stdlib.h> 45 #include <unistd.h> 46 47 #include "private/ScopedPthreadMutexLocker.h" 48 49 #if defined(USE_JEMALLOC) 50 #include "jemalloc.h" 51 #define Malloc(function) je_ ## function 52 #elif defined(USE_DLMALLOC) 53 #include "dlmalloc.h" 54 #define Malloc(function) dl ## function 55 #else 56 #error "Either one of USE_DLMALLOC or USE_JEMALLOC must be defined." 57 #endif 58 59 // In a VM process, this is set to 1 after fork()ing out of zygote. 60 int gMallocLeakZygoteChild = 0; 61 62 static HashTable g_hash_table; 63 64 // Support for malloc debugging. 65 // Table for dispatching malloc calls, initialized with default dispatchers. 66 static const MallocDebug __libc_malloc_default_dispatch __attribute__((aligned(32))) = { 67 Malloc(calloc), 68 Malloc(free), 69 Malloc(mallinfo), 70 Malloc(malloc), 71 Malloc(malloc_usable_size), 72 Malloc(memalign), 73 Malloc(posix_memalign), 74 #if defined(HAVE_DEPRECATED_MALLOC_FUNCS) 75 Malloc(pvalloc), 76 #endif 77 Malloc(realloc), 78 #if defined(HAVE_DEPRECATED_MALLOC_FUNCS) 79 Malloc(valloc), 80 #endif 81 }; 82 83 // Selector of dispatch table to use for dispatching malloc calls. 84 static const MallocDebug* __libc_malloc_dispatch = &__libc_malloc_default_dispatch; 85 86 // Handle to shared library where actual memory allocation is implemented. 87 // This library is loaded and memory allocation calls are redirected there 88 // when libc.debug.malloc environment variable contains value other than 89 // zero: 90 // 1 - For memory leak detections. 91 // 5 - For filling allocated / freed memory with patterns defined by 92 // CHK_SENTINEL_VALUE, and CHK_FILL_FREE macros. 93 // 10 - For adding pre-, and post- allocation stubs in order to detect 94 // buffer overruns. 95 // Note that emulator's memory allocation instrumentation is not controlled by 96 // libc.debug.malloc value, but rather by emulator, started with -memcheck 97 // option. Note also, that if emulator has started with -memcheck option, 98 // emulator's instrumented memory allocation will take over value saved in 99 // libc.debug.malloc. In other words, if emulator has started with -memcheck 100 // option, libc.debug.malloc value is ignored. 101 // Actual functionality for debug levels 1-10 is implemented in 102 // libc_malloc_debug_leak.so, while functionality for emulator's instrumented 103 // allocations is implemented in libc_malloc_debug_qemu.so and can be run inside 104 // the emulator only. 105 #if !defined(LIBC_STATIC) 106 static void* libc_malloc_impl_handle = NULL; 107 #endif 108 109 110 // The value of libc.debug.malloc. 111 #if !defined(LIBC_STATIC) 112 static int g_malloc_debug_level = 0; 113 #endif 114 115 // ============================================================================= 116 // output functions 117 // ============================================================================= 118 119 static int hash_entry_compare(const void* arg1, const void* arg2) { 120 int result; 121 122 const HashEntry* e1 = *static_cast<HashEntry* const*>(arg1); 123 const HashEntry* e2 = *static_cast<HashEntry* const*>(arg2); 124 125 // if one or both arg pointers are null, deal gracefully 126 if (e1 == NULL) { 127 result = (e2 == NULL) ? 0 : 1; 128 } else if (e2 == NULL) { 129 result = -1; 130 } else { 131 size_t nbAlloc1 = e1->allocations; 132 size_t nbAlloc2 = e2->allocations; 133 size_t size1 = e1->size & ~SIZE_FLAG_MASK; 134 size_t size2 = e2->size & ~SIZE_FLAG_MASK; 135 size_t alloc1 = nbAlloc1 * size1; 136 size_t alloc2 = nbAlloc2 * size2; 137 138 // sort in descending order by: 139 // 1) total size 140 // 2) number of allocations 141 // 142 // This is used for sorting, not determination of equality, so we don't 143 // need to compare the bit flags. 144 if (alloc1 > alloc2) { 145 result = -1; 146 } else if (alloc1 < alloc2) { 147 result = 1; 148 } else { 149 if (nbAlloc1 > nbAlloc2) { 150 result = -1; 151 } else if (nbAlloc1 < nbAlloc2) { 152 result = 1; 153 } else { 154 result = 0; 155 } 156 } 157 } 158 return result; 159 } 160 161 // Retrieve native heap information. 162 // 163 // "*info" is set to a buffer we allocate 164 // "*overallSize" is set to the size of the "info" buffer 165 // "*infoSize" is set to the size of a single entry 166 // "*totalMemory" is set to the sum of all allocations we're tracking; does 167 // not include heap overhead 168 // "*backtraceSize" is set to the maximum number of entries in the back trace 169 170 // ============================================================================= 171 // Exported for use by ddms. 172 // ============================================================================= 173 extern "C" void get_malloc_leak_info(uint8_t** info, size_t* overallSize, 174 size_t* infoSize, size_t* totalMemory, size_t* backtraceSize) { 175 // Don't do anything if we have invalid arguments. 176 if (info == NULL || overallSize == NULL || infoSize == NULL || 177 totalMemory == NULL || backtraceSize == NULL) { 178 return; 179 } 180 *totalMemory = 0; 181 182 ScopedPthreadMutexLocker locker(&g_hash_table.lock); 183 if (g_hash_table.count == 0) { 184 *info = NULL; 185 *overallSize = 0; 186 *infoSize = 0; 187 *backtraceSize = 0; 188 return; 189 } 190 191 HashEntry** list = static_cast<HashEntry**>(Malloc(malloc)(sizeof(void*) * g_hash_table.count)); 192 193 // Get the entries into an array to be sorted. 194 size_t index = 0; 195 for (size_t i = 0 ; i < HASHTABLE_SIZE ; ++i) { 196 HashEntry* entry = g_hash_table.slots[i]; 197 while (entry != NULL) { 198 list[index] = entry; 199 *totalMemory = *totalMemory + ((entry->size & ~SIZE_FLAG_MASK) * entry->allocations); 200 index++; 201 entry = entry->next; 202 } 203 } 204 205 // XXX: the protocol doesn't allow variable size for the stack trace (yet) 206 *infoSize = (sizeof(size_t) * 2) + (sizeof(uintptr_t) * BACKTRACE_SIZE); 207 *overallSize = *infoSize * g_hash_table.count; 208 *backtraceSize = BACKTRACE_SIZE; 209 210 // now get a byte array big enough for this 211 *info = static_cast<uint8_t*>(Malloc(malloc)(*overallSize)); 212 if (*info == NULL) { 213 *overallSize = 0; 214 Malloc(free)(list); 215 return; 216 } 217 218 qsort(list, g_hash_table.count, sizeof(void*), hash_entry_compare); 219 220 uint8_t* head = *info; 221 const size_t count = g_hash_table.count; 222 for (size_t i = 0 ; i < count ; ++i) { 223 HashEntry* entry = list[i]; 224 size_t entrySize = (sizeof(size_t) * 2) + (sizeof(uintptr_t) * entry->numEntries); 225 if (entrySize < *infoSize) { 226 // We're writing less than a full entry, clear out the rest. 227 memset(head + entrySize, 0, *infoSize - entrySize); 228 } else { 229 // Make sure the amount we're copying doesn't exceed the limit. 230 entrySize = *infoSize; 231 } 232 memcpy(head, &(entry->size), entrySize); 233 head += *infoSize; 234 } 235 236 Malloc(free)(list); 237 } 238 239 extern "C" void free_malloc_leak_info(uint8_t* info) { 240 Malloc(free)(info); 241 } 242 243 // ============================================================================= 244 // Allocation functions 245 // ============================================================================= 246 extern "C" void* calloc(size_t n_elements, size_t elem_size) { 247 return __libc_malloc_dispatch->calloc(n_elements, elem_size); 248 } 249 250 extern "C" void free(void* mem) { 251 __libc_malloc_dispatch->free(mem); 252 } 253 254 extern "C" struct mallinfo mallinfo() { 255 return __libc_malloc_dispatch->mallinfo(); 256 } 257 258 extern "C" void* malloc(size_t bytes) { 259 return __libc_malloc_dispatch->malloc(bytes); 260 } 261 262 extern "C" size_t malloc_usable_size(const void* mem) { 263 return __libc_malloc_dispatch->malloc_usable_size(mem); 264 } 265 266 extern "C" void* memalign(size_t alignment, size_t bytes) { 267 return __libc_malloc_dispatch->memalign(alignment, bytes); 268 } 269 270 extern "C" int posix_memalign(void** memptr, size_t alignment, size_t size) { 271 return __libc_malloc_dispatch->posix_memalign(memptr, alignment, size); 272 } 273 274 #if defined(HAVE_DEPRECATED_MALLOC_FUNCS) 275 extern "C" void* pvalloc(size_t bytes) { 276 return __libc_malloc_dispatch->pvalloc(bytes); 277 } 278 #endif 279 280 extern "C" void* realloc(void* oldMem, size_t bytes) { 281 return __libc_malloc_dispatch->realloc(oldMem, bytes); 282 } 283 284 #if defined(HAVE_DEPRECATED_MALLOC_FUNCS) 285 extern "C" void* valloc(size_t bytes) { 286 return __libc_malloc_dispatch->valloc(bytes); 287 } 288 #endif 289 290 // We implement malloc debugging only in libc.so, so the code below 291 // must be excluded if we compile this file for static libc.a 292 #ifndef LIBC_STATIC 293 #include <sys/system_properties.h> 294 #include <dlfcn.h> 295 #include <stdio.h> 296 #include "private/libc_logging.h" 297 298 template<typename FunctionType> 299 static void InitMallocFunction(void* malloc_impl_handler, FunctionType* func, const char* prefix, const char* suffix) { 300 char symbol[128]; 301 snprintf(symbol, sizeof(symbol), "%s_%s", prefix, suffix); 302 *func = reinterpret_cast<FunctionType>(dlsym(malloc_impl_handler, symbol)); 303 if (*func == NULL) { 304 error_log("%s: dlsym(\"%s\") failed", getprogname(), symbol); 305 } 306 } 307 308 static void InitMalloc(void* malloc_impl_handler, MallocDebug* table, const char* prefix) { 309 __libc_format_log(ANDROID_LOG_INFO, "libc", "%s: using libc.debug.malloc %d (%s)\n", 310 getprogname(), g_malloc_debug_level, prefix); 311 312 InitMallocFunction<MallocDebugCalloc>(malloc_impl_handler, &table->calloc, prefix, "calloc"); 313 InitMallocFunction<MallocDebugFree>(malloc_impl_handler, &table->free, prefix, "free"); 314 InitMallocFunction<MallocDebugMallinfo>(malloc_impl_handler, &table->mallinfo, prefix, "mallinfo"); 315 InitMallocFunction<MallocDebugMalloc>(malloc_impl_handler, &table->malloc, prefix, "malloc"); 316 InitMallocFunction<MallocDebugMallocUsableSize>(malloc_impl_handler, &table->malloc_usable_size, prefix, "malloc_usable_size"); 317 InitMallocFunction<MallocDebugMemalign>(malloc_impl_handler, &table->memalign, prefix, "memalign"); 318 InitMallocFunction<MallocDebugPosixMemalign>(malloc_impl_handler, &table->posix_memalign, prefix, "posix_memalign"); 319 #if defined(HAVE_DEPRECATED_MALLOC_FUNCS) 320 InitMallocFunction<MallocDebugPvalloc>(malloc_impl_handler, &table->pvalloc, prefix, "pvalloc"); 321 #endif 322 InitMallocFunction<MallocDebugRealloc>(malloc_impl_handler, &table->realloc, prefix, "realloc"); 323 #if defined(HAVE_DEPRECATED_MALLOC_FUNCS) 324 InitMallocFunction<MallocDebugValloc>(malloc_impl_handler, &table->valloc, prefix, "valloc"); 325 #endif 326 } 327 328 // Initializes memory allocation framework once per process. 329 static void malloc_init_impl() { 330 const char* so_name = NULL; 331 MallocDebugInit malloc_debug_initialize = NULL; 332 unsigned int qemu_running = 0; 333 unsigned int memcheck_enabled = 0; 334 char env[PROP_VALUE_MAX]; 335 char memcheck_tracing[PROP_VALUE_MAX]; 336 char debug_program[PROP_VALUE_MAX]; 337 338 // Get custom malloc debug level. Note that emulator started with 339 // memory checking option will have priority over debug level set in 340 // libc.debug.malloc system property. 341 if (__system_property_get("ro.kernel.qemu", env) && atoi(env)) { 342 qemu_running = 1; 343 if (__system_property_get("ro.kernel.memcheck", memcheck_tracing)) { 344 if (memcheck_tracing[0] != '0') { 345 // Emulator has started with memory tracing enabled. Enforce it. 346 g_malloc_debug_level = 20; 347 memcheck_enabled = 1; 348 } 349 } 350 } 351 352 // If debug level has not been set by memcheck option in the emulator, 353 // lets grab it from libc.debug.malloc system property. 354 if (g_malloc_debug_level == 0 && __system_property_get("libc.debug.malloc", env)) { 355 g_malloc_debug_level = atoi(env); 356 } 357 358 // Debug level 0 means that we should use default allocation routines. 359 if (g_malloc_debug_level == 0) { 360 return; 361 } 362 363 // If libc.debug.malloc.program is set and is not a substring of progname, 364 // then exit. 365 if (__system_property_get("libc.debug.malloc.program", debug_program)) { 366 if (!strstr(getprogname(), debug_program)) { 367 return; 368 } 369 } 370 371 // mksh is way too leaky. http://b/7291287. 372 if (g_malloc_debug_level >= 10) { 373 if (strcmp(getprogname(), "sh") == 0 || strcmp(getprogname(), "/system/bin/sh") == 0) { 374 return; 375 } 376 } 377 378 // Choose the appropriate .so for the requested debug level. 379 switch (g_malloc_debug_level) { 380 case 1: 381 case 5: 382 case 10: 383 so_name = "libc_malloc_debug_leak.so"; 384 break; 385 case 20: 386 // Quick check: debug level 20 can only be handled in emulator. 387 if (!qemu_running) { 388 error_log("%s: Debug level %d can only be set in emulator\n", 389 getprogname(), g_malloc_debug_level); 390 return; 391 } 392 // Make sure that memory checking has been enabled in emulator. 393 if (!memcheck_enabled) { 394 error_log("%s: Memory checking is not enabled in the emulator\n", getprogname()); 395 return; 396 } 397 so_name = "libc_malloc_debug_qemu.so"; 398 break; 399 default: 400 error_log("%s: Debug level %d is unknown\n", getprogname(), g_malloc_debug_level); 401 return; 402 } 403 404 // Load .so that implements the required malloc debugging functionality. 405 void* malloc_impl_handle = dlopen(so_name, RTLD_LAZY); 406 if (malloc_impl_handle == NULL) { 407 error_log("%s: Missing module %s required for malloc debug level %d: %s", 408 getprogname(), so_name, g_malloc_debug_level, dlerror()); 409 return; 410 } 411 412 // Initialize malloc debugging in the loaded module. 413 malloc_debug_initialize = reinterpret_cast<MallocDebugInit>(dlsym(malloc_impl_handle, 414 "malloc_debug_initialize")); 415 if (malloc_debug_initialize == NULL) { 416 error_log("%s: Initialization routine is not found in %s\n", getprogname(), so_name); 417 dlclose(malloc_impl_handle); 418 return; 419 } 420 if (!malloc_debug_initialize(&g_hash_table, &__libc_malloc_default_dispatch)) { 421 dlclose(malloc_impl_handle); 422 return; 423 } 424 425 if (g_malloc_debug_level == 20) { 426 // For memory checker we need to do extra initialization. 427 typedef int (*MemCheckInit)(int, const char*); 428 MemCheckInit memcheck_initialize = 429 reinterpret_cast<MemCheckInit>(dlsym(malloc_impl_handle, "memcheck_initialize")); 430 if (memcheck_initialize == NULL) { 431 error_log("%s: memcheck_initialize routine is not found in %s\n", 432 getprogname(), so_name); 433 dlclose(malloc_impl_handle); 434 return; 435 } 436 437 if (memcheck_initialize(MALLOC_ALIGNMENT, memcheck_tracing)) { 438 dlclose(malloc_impl_handle); 439 return; 440 } 441 } 442 443 // No need to init the dispatch table because we can only get 444 // here if debug level is 1, 5, 10, or 20. 445 static MallocDebug malloc_dispatch_table __attribute__((aligned(32))); 446 switch (g_malloc_debug_level) { 447 case 1: 448 InitMalloc(malloc_impl_handle, &malloc_dispatch_table, "leak"); 449 break; 450 case 5: 451 InitMalloc(malloc_impl_handle, &malloc_dispatch_table, "fill"); 452 break; 453 case 10: 454 InitMalloc(malloc_impl_handle, &malloc_dispatch_table, "chk"); 455 break; 456 case 20: 457 InitMalloc(malloc_impl_handle, &malloc_dispatch_table, "qemu_instrumented"); 458 break; 459 default: 460 break; 461 } 462 463 // Make sure dispatch table is initialized 464 if ((malloc_dispatch_table.calloc == NULL) || 465 (malloc_dispatch_table.free == NULL) || 466 (malloc_dispatch_table.mallinfo == NULL) || 467 (malloc_dispatch_table.malloc == NULL) || 468 (malloc_dispatch_table.malloc_usable_size == NULL) || 469 (malloc_dispatch_table.memalign == NULL) || 470 (malloc_dispatch_table.posix_memalign == NULL) || 471 #if defined(HAVE_DEPRECATED_MALLOC_FUNCS) 472 (malloc_dispatch_table.pvalloc == NULL) || 473 #endif 474 (malloc_dispatch_table.realloc == NULL) 475 #if defined(HAVE_DEPRECATED_MALLOC_FUNCS) 476 || (malloc_dispatch_table.valloc == NULL) 477 #endif 478 ) { 479 error_log("%s: some symbols for libc.debug.malloc level %d were not found (see above)", 480 getprogname(), g_malloc_debug_level); 481 dlclose(malloc_impl_handle); 482 } else { 483 __libc_malloc_dispatch = &malloc_dispatch_table; 484 libc_malloc_impl_handle = malloc_impl_handle; 485 } 486 } 487 488 static void malloc_fini_impl() { 489 // Our BSD stdio implementation doesn't close the standard streams, it only flushes them. 490 // And it doesn't do that until its atexit handler is run, and we run first! 491 // It's great that other unclosed FILE*s show up as malloc leaks, but we need to manually 492 // clean up the standard streams ourselves. 493 fclose(stdin); 494 fclose(stdout); 495 fclose(stderr); 496 497 if (libc_malloc_impl_handle != NULL) { 498 MallocDebugFini malloc_debug_finalize = 499 reinterpret_cast<MallocDebugFini>(dlsym(libc_malloc_impl_handle, "malloc_debug_finalize")); 500 if (malloc_debug_finalize != NULL) { 501 malloc_debug_finalize(g_malloc_debug_level); 502 } 503 } 504 } 505 506 #endif // !LIBC_STATIC 507 508 // Initializes memory allocation framework. 509 // This routine is called from __libc_init routines implemented 510 // in libc_init_static.c and libc_init_dynamic.c files. 511 extern "C" __LIBC_HIDDEN__ void malloc_debug_init() { 512 #if !defined(LIBC_STATIC) 513 static pthread_once_t malloc_init_once_ctl = PTHREAD_ONCE_INIT; 514 if (pthread_once(&malloc_init_once_ctl, malloc_init_impl)) { 515 error_log("Unable to initialize malloc_debug component."); 516 } 517 #endif // !LIBC_STATIC 518 } 519 520 extern "C" __LIBC_HIDDEN__ void malloc_debug_fini() { 521 #if !defined(LIBC_STATIC) 522 static pthread_once_t malloc_fini_once_ctl = PTHREAD_ONCE_INIT; 523 if (pthread_once(&malloc_fini_once_ctl, malloc_fini_impl)) { 524 error_log("Unable to finalize malloc_debug component."); 525 } 526 #endif // !LIBC_STATIC 527 } 528
