malloc_debug_check.cpp revision 848247a972038e30e12b0c9f7f049aa97c73b9c7 
1/*
2 * Copyright (C) 2012 The Android Open Source Project
3 * All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
7 * are met:
8 *  * Redistributions of source code must retain the above copyright
9 *    notice, this list of conditions and the following disclaimer.
10 *  * Redistributions in binary form must reproduce the above copyright
11 *    notice, this list of conditions and the following disclaimer in
12 *    the documentation and/or other materials provided with the
13 *    distribution.
14 *
15 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
16 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
17 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
18 * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
19 * COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
20 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
21 * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
22 * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
23 * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
24 * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
25 * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
26 * SUCH DAMAGE.
27 */
28
29#include <arpa/inet.h>
30#include <dlfcn.h>
31#include <errno.h>
32#include <errno.h>
33#include <fcntl.h>
34#include <pthread.h>
35#include <stdarg.h>
36#include <stdbool.h>
37#include <stddef.h>
38#include <stdio.h>
39#include <stdlib.h>
40#include <string.h>
41#include <sys/socket.h>
42#include <sys/system_properties.h>
43#include <sys/types.h>
44#include <time.h>
45#include <unistd.h>
46#include <unwind.h>
47
48#include "debug_mapinfo.h"
49#include "debug_stacktrace.h"
50#include "dlmalloc.h"
51#include "logd.h"
52#include "malloc_debug_common.h"
53#include "ScopedPthreadMutexLocker.h"
54
55static mapinfo_t* gMapInfo;
56
57/* libc.debug.malloc.backlog */
58extern unsigned int malloc_double_free_backlog;
59
60#define MAX_BACKTRACE_DEPTH 16
61#define ALLOCATION_TAG      0x1ee7d00d
62#define BACKLOG_TAG         0xbabecafe
63#define FREE_POISON         0xa5
64#define BACKLOG_DEFAULT_LEN 100
65#define FRONT_GUARD         0xaa
66#define FRONT_GUARD_LEN     (1<<5)
67#define REAR_GUARD          0xbb
68#define REAR_GUARD_LEN      (1<<5)
69
70static void log_message(const char* format, ...) {
71  va_list args;
72  va_start(args, format);
73  __libc_format_log_va_list(ANDROID_LOG_ERROR, "libc", format, args);
74  va_end(args);
75}
76
77struct hdr_t {
78    uint32_t tag;
79    hdr_t* prev;
80    hdr_t* next;
81    intptr_t bt[MAX_BACKTRACE_DEPTH];
82    int bt_depth;
83    intptr_t freed_bt[MAX_BACKTRACE_DEPTH];
84    int freed_bt_depth;
85    size_t size;
86    char front_guard[FRONT_GUARD_LEN];
87} __attribute__((packed));
88
89struct ftr_t {
90    char rear_guard[REAR_GUARD_LEN];
91} __attribute__((packed));
92
93static inline ftr_t* to_ftr(hdr_t* hdr) {
94    return reinterpret_cast<ftr_t*>(reinterpret_cast<char*>(hdr + 1) + hdr->size);
95}
96
97static inline void* user(hdr_t* hdr) {
98    return hdr + 1;
99}
100
101static inline hdr_t* meta(void* user) {
102    return reinterpret_cast<hdr_t*>(user) - 1;
103}
104
105static unsigned num;
106static hdr_t *tail;
107static hdr_t *head;
108static pthread_mutex_t lock = PTHREAD_MUTEX_INITIALIZER;
109
110static unsigned backlog_num;
111static hdr_t *backlog_tail;
112static hdr_t *backlog_head;
113static pthread_mutex_t backlog_lock = PTHREAD_MUTEX_INITIALIZER;
114
115static inline void init_front_guard(hdr_t *hdr) {
116    memset(hdr->front_guard, FRONT_GUARD, FRONT_GUARD_LEN);
117}
118
119static inline bool is_front_guard_valid(hdr_t *hdr) {
120    for (size_t i = 0; i < FRONT_GUARD_LEN; i++) {
121        if (hdr->front_guard[i] != FRONT_GUARD) {
122            return 0;
123        }
124    }
125    return 1;
126}
127
128static inline void init_rear_guard(hdr_t *hdr) {
129    ftr_t* ftr = to_ftr(hdr);
130    memset(ftr->rear_guard, REAR_GUARD, REAR_GUARD_LEN);
131}
132
133static inline bool is_rear_guard_valid(hdr_t *hdr) {
134    unsigned i;
135    int valid = 1;
136    int first_mismatch = -1;
137    ftr_t* ftr = to_ftr(hdr);
138    for (i = 0; i < REAR_GUARD_LEN; i++) {
139        if (ftr->rear_guard[i] != REAR_GUARD) {
140            if (first_mismatch < 0)
141                first_mismatch = i;
142            valid = 0;
143        } else if (first_mismatch >= 0) {
144            log_message("+++ REAR GUARD MISMATCH [%d, %d)\n", first_mismatch, i);
145            first_mismatch = -1;
146        }
147    }
148
149    if (first_mismatch >= 0)
150        log_message("+++ REAR GUARD MISMATCH [%d, %d)\n", first_mismatch, i);
151    return valid;
152}
153
154static inline void add_locked(hdr_t *hdr, hdr_t **tail, hdr_t **head) {
155    hdr->prev = NULL;
156    hdr->next = *head;
157    if (*head)
158        (*head)->prev = hdr;
159    else
160        *tail = hdr;
161    *head = hdr;
162}
163
164static inline int del_locked(hdr_t *hdr, hdr_t **tail, hdr_t **head) {
165    if (hdr->prev) {
166        hdr->prev->next = hdr->next;
167    } else {
168        *head = hdr->next;
169    }
170    if (hdr->next) {
171        hdr->next->prev = hdr->prev;
172    } else {
173        *tail = hdr->prev;
174    }
175    return 0;
176}
177
178static inline void add(hdr_t *hdr, size_t size) {
179    ScopedPthreadMutexLocker locker(&lock);
180    hdr->tag = ALLOCATION_TAG;
181    hdr->size = size;
182    init_front_guard(hdr);
183    init_rear_guard(hdr);
184    num++;
185    add_locked(hdr, &tail, &head);
186}
187
188static inline int del(hdr_t *hdr) {
189    if (hdr->tag != ALLOCATION_TAG) {
190        return -1;
191    }
192
193    ScopedPthreadMutexLocker locker(&lock);
194    del_locked(hdr, &tail, &head);
195    num--;
196    return 0;
197}
198
199static inline void poison(hdr_t *hdr) {
200    memset(user(hdr), FREE_POISON, hdr->size);
201}
202
203static int was_used_after_free(hdr_t *hdr) {
204    unsigned i;
205    const char *data = (const char *)user(hdr);
206    for (i = 0; i < hdr->size; i++)
207        if (data[i] != FREE_POISON)
208            return 1;
209    return 0;
210}
211
212/* returns 1 if valid, *safe == 1 if safe to dump stack */
213static inline int check_guards(hdr_t *hdr, int *safe) {
214    *safe = 1;
215    if (!is_front_guard_valid(hdr)) {
216        if (hdr->front_guard[0] == FRONT_GUARD) {
217            log_message("+++ ALLOCATION %p SIZE %d HAS A CORRUPTED FRONT GUARD\n",
218                       user(hdr), hdr->size);
219        } else {
220            log_message("+++ ALLOCATION %p HAS A CORRUPTED FRONT GUARD "\
221                      "(NOT DUMPING STACKTRACE)\n", user(hdr));
222            /* Allocation header is probably corrupt, do not print stack trace */
223            *safe = 0;
224        }
225        return 0;
226    }
227
228    if (!is_rear_guard_valid(hdr)) {
229        log_message("+++ ALLOCATION %p SIZE %d HAS A CORRUPTED REAR GUARD\n",
230                   user(hdr), hdr->size);
231        return 0;
232    }
233
234    return 1;
235}
236
237/* returns 1 if valid, *safe == 1 if safe to dump stack */
238static inline int check_allocation_locked(hdr_t *hdr, int *safe) {
239    int valid = 1;
240    *safe = 1;
241
242    if (hdr->tag != ALLOCATION_TAG && hdr->tag != BACKLOG_TAG) {
243        log_message("+++ ALLOCATION %p HAS INVALID TAG %08x (NOT DUMPING STACKTRACE)\n",
244                   user(hdr), hdr->tag);
245        // Allocation header is probably corrupt, do not dequeue or dump stack
246        // trace.
247        *safe = 0;
248        return 0;
249    }
250
251    if (hdr->tag == BACKLOG_TAG && was_used_after_free(hdr)) {
252        log_message("+++ ALLOCATION %p SIZE %d WAS USED AFTER BEING FREED\n",
253                   user(hdr), hdr->size);
254        valid = 0;
255        /* check the guards to see if it's safe to dump a stack trace */
256        check_guards(hdr, safe);
257    } else {
258        valid = check_guards(hdr, safe);
259    }
260
261    if (!valid && *safe) {
262        log_message("+++ ALLOCATION %p SIZE %d ALLOCATED HERE:\n",
263                        user(hdr), hdr->size);
264        log_backtrace(gMapInfo, hdr->bt, hdr->bt_depth);
265        if (hdr->tag == BACKLOG_TAG) {
266            log_message("+++ ALLOCATION %p SIZE %d FREED HERE:\n",
267                       user(hdr), hdr->size);
268            log_backtrace(gMapInfo, hdr->freed_bt, hdr->freed_bt_depth);
269        }
270    }
271
272    return valid;
273}
274
275static inline int del_and_check_locked(hdr_t *hdr,
276                                       hdr_t **tail, hdr_t **head, unsigned *cnt,
277                                       int *safe) {
278    int valid = check_allocation_locked(hdr, safe);
279    if (safe) {
280        (*cnt)--;
281        del_locked(hdr, tail, head);
282    }
283    return valid;
284}
285
286static inline void del_from_backlog_locked(hdr_t *hdr) {
287    int safe;
288    del_and_check_locked(hdr,
289                         &backlog_tail, &backlog_head, &backlog_num,
290                         &safe);
291    hdr->tag = 0; /* clear the tag */
292}
293
294static inline void del_from_backlog(hdr_t *hdr) {
295    ScopedPthreadMutexLocker locker(&backlog_lock);
296    del_from_backlog_locked(hdr);
297}
298
299static inline int del_leak(hdr_t *hdr, int *safe) {
300    ScopedPthreadMutexLocker locker(&lock);
301    return del_and_check_locked(hdr, &tail, &head, &num, safe);
302}
303
304static inline void add_to_backlog(hdr_t *hdr) {
305    ScopedPthreadMutexLocker locker(&backlog_lock);
306    hdr->tag = BACKLOG_TAG;
307    backlog_num++;
308    add_locked(hdr, &backlog_tail, &backlog_head);
309    poison(hdr);
310    /* If we've exceeded the maximum backlog, clear it up */
311    while (backlog_num > malloc_double_free_backlog) {
312        hdr_t *gone = backlog_tail;
313        del_from_backlog_locked(gone);
314        dlfree(gone);
315    }
316}
317
318extern "C" void* chk_malloc(size_t size) {
319//  log_message("%s: %s\n", __FILE__, __FUNCTION__);
320
321    hdr_t* hdr = static_cast<hdr_t*>(dlmalloc(sizeof(hdr_t) + size + sizeof(ftr_t)));
322    if (hdr) {
323        hdr->bt_depth = get_backtrace(hdr->bt, MAX_BACKTRACE_DEPTH);
324        add(hdr, size);
325        return user(hdr);
326    }
327    return NULL;
328}
329
330extern "C" void* chk_memalign(size_t, size_t bytes) {
331//  log_message("%s: %s\n", __FILE__, __FUNCTION__);
332    // XXX: it's better to use malloc, than being wrong
333    return chk_malloc(bytes);
334}
335
336extern "C" void chk_free(void *ptr) {
337//  log_message("%s: %s\n", __FILE__, __FUNCTION__);
338
339    if (!ptr) /* ignore free(NULL) */
340        return;
341
342    hdr_t* hdr = meta(ptr);
343
344    if (del(hdr) < 0) {
345        intptr_t bt[MAX_BACKTRACE_DEPTH];
346        int depth;
347        depth = get_backtrace(bt, MAX_BACKTRACE_DEPTH);
348        if (hdr->tag == BACKLOG_TAG) {
349            log_message("+++ ALLOCATION %p SIZE %d BYTES MULTIPLY FREED!\n",
350                       user(hdr), hdr->size);
351            log_message("+++ ALLOCATION %p SIZE %d ALLOCATED HERE:\n",
352                       user(hdr), hdr->size);
353            log_backtrace(gMapInfo, hdr->bt, hdr->bt_depth);
354            /* hdr->freed_bt_depth should be nonzero here */
355            log_message("+++ ALLOCATION %p SIZE %d FIRST FREED HERE:\n",
356                       user(hdr), hdr->size);
357            log_backtrace(gMapInfo, hdr->freed_bt, hdr->freed_bt_depth);
358            log_message("+++ ALLOCATION %p SIZE %d NOW BEING FREED HERE:\n",
359                       user(hdr), hdr->size);
360            log_backtrace(gMapInfo, bt, depth);
361        } else {
362            log_message("+++ ALLOCATION %p IS CORRUPTED OR NOT ALLOCATED VIA TRACKER!\n",
363                       user(hdr));
364            log_backtrace(gMapInfo, bt, depth);
365        }
366    } else {
367        hdr->freed_bt_depth = get_backtrace(hdr->freed_bt,
368                                      MAX_BACKTRACE_DEPTH);
369        add_to_backlog(hdr);
370    }
371}
372
373extern "C" void *chk_realloc(void *ptr, size_t size) {
374//  log_message("%s: %s\n", __FILE__, __FUNCTION__);
375
376    if (!ptr) {
377        return chk_malloc(size);
378    }
379
380#ifdef REALLOC_ZERO_BYTES_FREE
381    if (!size) {
382        chk_free(ptr);
383        return NULL;
384    }
385#endif
386
387    hdr_t* hdr = meta(ptr);
388
389    if (del(hdr) < 0) {
390        intptr_t bt[MAX_BACKTRACE_DEPTH];
391        int depth;
392        depth = get_backtrace(bt, MAX_BACKTRACE_DEPTH);
393        if (hdr->tag == BACKLOG_TAG) {
394            log_message("+++ REALLOCATION %p SIZE %d OF FREED MEMORY!\n",
395                       user(hdr), size, hdr->size);
396            log_message("+++ ALLOCATION %p SIZE %d ALLOCATED HERE:\n",
397                       user(hdr), hdr->size);
398            log_backtrace(gMapInfo, hdr->bt, hdr->bt_depth);
399            /* hdr->freed_bt_depth should be nonzero here */
400            log_message("+++ ALLOCATION %p SIZE %d FIRST FREED HERE:\n",
401                       user(hdr), hdr->size);
402            log_backtrace(gMapInfo, hdr->freed_bt, hdr->freed_bt_depth);
403            log_message("+++ ALLOCATION %p SIZE %d NOW BEING REALLOCATED HERE:\n",
404                       user(hdr), hdr->size);
405            log_backtrace(gMapInfo, bt, depth);
406
407             /* We take the memory out of the backlog and fall through so the
408             * reallocation below succeeds.  Since we didn't really free it, we
409             * can default to this behavior.
410             */
411            del_from_backlog(hdr);
412        } else {
413            log_message("+++ REALLOCATION %p SIZE %d IS CORRUPTED OR NOT ALLOCATED VIA TRACKER!\n",
414                       user(hdr), size);
415            log_backtrace(gMapInfo, bt, depth);
416            // just get a whole new allocation and leak the old one
417            return dlrealloc(0, size);
418            // return dlrealloc(user(hdr), size); // assuming it was allocated externally
419        }
420    }
421
422    hdr = static_cast<hdr_t*>(dlrealloc(hdr, sizeof(hdr_t) + size + sizeof(ftr_t)));
423    if (hdr) {
424        hdr->bt_depth = get_backtrace(hdr->bt, MAX_BACKTRACE_DEPTH);
425        add(hdr, size);
426        return user(hdr);
427    }
428
429    return NULL;
430}
431
432extern "C" void *chk_calloc(int nmemb, size_t size) {
433//  log_message("%s: %s\n", __FILE__, __FUNCTION__);
434    size_t total_size = nmemb * size;
435    hdr_t* hdr = static_cast<hdr_t*>(dlcalloc(1, sizeof(hdr_t) + total_size + sizeof(ftr_t)));
436    if (hdr) {
437        hdr->bt_depth = get_backtrace(hdr->bt, MAX_BACKTRACE_DEPTH);
438        add(hdr, total_size);
439        return user(hdr);
440    }
441    return NULL;
442}
443
444static void heaptracker_free_leaked_memory() {
445    size_t total = num;
446    if (num) {
447        log_message("+++ Leaked allocations: %d\n", num);
448    }
449
450    hdr_t *del = NULL;
451    while (head) {
452        int safe;
453        del = head;
454        log_message("+++ Leaked block of size %d at %p (leak %d of %d)\n",
455                del->size, user(del), 1 + total - num, total);
456        if (del_leak(del, &safe)) {
457            /* safe == 1, because the allocation is valid */
458            log_backtrace(gMapInfo, del->bt, del->bt_depth);
459        }
460    }
461
462//  log_message("+++ DELETING %d BACKLOGGED ALLOCATIONS\n", backlog_num);
463    while (backlog_head) {
464        del = backlog_tail;
465        del_from_backlog(del);
466    }
467}
468
469/* Initializes malloc debugging framework.
470 * See comments on MallocDebugInit in malloc_debug_common.h
471 */
472extern "C" int malloc_debug_initialize() {
473  if (!malloc_double_free_backlog) {
474    malloc_double_free_backlog = BACKLOG_DEFAULT_LEN;
475  }
476  gMapInfo = mapinfo_create(getpid());
477  return 0;
478}
479
480extern "C" void malloc_debug_finalize() {
481  heaptracker_free_leaked_memory();
482  mapinfo_destroy(gMapInfo);
483}
484