malloc_debug_common.cpp revision 14442bb22955f704091f23e670ed9f8bdcda1ce9 
1/*
2 * Copyright (C) 2009 The Android Open Source Project
3 * All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
7 * are met:
8 *  * Redistributions of source code must retain the above copyright
9 *    notice, this list of conditions and the following disclaimer.
10 *  * Redistributions in binary form must reproduce the above copyright
11 *    notice, this list of conditions and the following disclaimer in
12 *    the documentation and/or other materials provided with the
13 *    distribution.
14 *
15 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
16 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
17 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
18 * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
19 * COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
20 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
21 * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
22 * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
23 * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
24 * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
25 * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
26 * SUCH DAMAGE.
27 */
28
29/*
30 * Contains definition of structures, global variables, and implementation of
31 * routines that are used by malloc leak detection code and other components in
32 * the system. The trick is that some components expect these data and
33 * routines to be defined / implemented in libc.so library, regardless
34 * whether or not MALLOC_LEAK_CHECK macro is defined. To make things even
35 * more tricky, malloc leak detection code, implemented in
36 * libc_malloc_debug.so also requires access to these variables and routines
37 * (to fill allocation entry hash table, for example). So, all relevant
38 * variables and routines are defined / implemented here and exported
39 * to all, leak detection code and other components via dynamic (libc.so),
40 * or static (libc.a) linking.
41 */
42
43#include "malloc_debug_common.h"
44
45#include <pthread.h>
46#include <stdlib.h>
47#include <unistd.h>
48
49#include "private/ScopedPthreadMutexLocker.h"
50
51// In a VM process, this is set to 1 after fork()ing out of zygote.
52int gMallocLeakZygoteChild = 0;
53
54static HashTable g_hash_table;
55
56// Support for malloc debugging.
57// Table for dispatching malloc calls, initialized with default dispatchers.
58static const MallocDebug __libc_malloc_default_dispatch __attribute__((aligned(32))) = {
59  Malloc(malloc), Malloc(free), Malloc(calloc), Malloc(realloc), Malloc(memalign), Malloc(malloc_usable_size),
60};
61
62// Selector of dispatch table to use for dispatching malloc calls.
63// TODO: fix http://b/15432753 and make this static again.
64const MallocDebug* __libc_malloc_dispatch = &__libc_malloc_default_dispatch;
65
66// Handle to shared library where actual memory allocation is implemented.
67// This library is loaded and memory allocation calls are redirected there
68// when libc.debug.malloc environment variable contains value other than
69// zero:
70// 1  - For memory leak detections.
71// 5  - For filling allocated / freed memory with patterns defined by
72//      CHK_SENTINEL_VALUE, and CHK_FILL_FREE macros.
73// 10 - For adding pre-, and post- allocation stubs in order to detect
74//      buffer overruns.
75// Note that emulator's memory allocation instrumentation is not controlled by
76// libc.debug.malloc value, but rather by emulator, started with -memcheck
77// option. Note also, that if emulator has started with -memcheck option,
78// emulator's instrumented memory allocation will take over value saved in
79// libc.debug.malloc. In other words, if emulator has started with -memcheck
80// option, libc.debug.malloc value is ignored.
81// Actual functionality for debug levels 1-10 is implemented in
82// libc_malloc_debug_leak.so, while functionality for emulator's instrumented
83// allocations is implemented in libc_malloc_debug_qemu.so and can be run inside
84// the emulator only.
85#if !defined(LIBC_STATIC)
86static void* libc_malloc_impl_handle = NULL;
87#endif
88
89
90// The value of libc.debug.malloc.
91#if !defined(LIBC_STATIC)
92static int g_malloc_debug_level = 0;
93#endif
94
95// =============================================================================
96// output functions
97// =============================================================================
98
99static int hash_entry_compare(const void* arg1, const void* arg2) {
100    int result;
101
102    const HashEntry* e1 = *static_cast<HashEntry* const*>(arg1);
103    const HashEntry* e2 = *static_cast<HashEntry* const*>(arg2);
104
105    // if one or both arg pointers are null, deal gracefully
106    if (e1 == NULL) {
107        result = (e2 == NULL) ? 0 : 1;
108    } else if (e2 == NULL) {
109        result = -1;
110    } else {
111        size_t nbAlloc1 = e1->allocations;
112        size_t nbAlloc2 = e2->allocations;
113        size_t size1 = e1->size & ~SIZE_FLAG_MASK;
114        size_t size2 = e2->size & ~SIZE_FLAG_MASK;
115        size_t alloc1 = nbAlloc1 * size1;
116        size_t alloc2 = nbAlloc2 * size2;
117
118        // sort in descending order by:
119        // 1) total size
120        // 2) number of allocations
121        //
122        // This is used for sorting, not determination of equality, so we don't
123        // need to compare the bit flags.
124        if (alloc1 > alloc2) {
125            result = -1;
126        } else if (alloc1 < alloc2) {
127            result = 1;
128        } else {
129            if (nbAlloc1 > nbAlloc2) {
130                result = -1;
131            } else if (nbAlloc1 < nbAlloc2) {
132                result = 1;
133            } else {
134                result = 0;
135            }
136        }
137    }
138    return result;
139}
140
141/*
142 * Retrieve native heap information.
143 *
144 * "*info" is set to a buffer we allocate
145 * "*overallSize" is set to the size of the "info" buffer
146 * "*infoSize" is set to the size of a single entry
147 * "*totalMemory" is set to the sum of all allocations we're tracking; does
148 *   not include heap overhead
149 * "*backtraceSize" is set to the maximum number of entries in the back trace
150 */
151
152// Exported for use by ddms.
153extern "C" void get_malloc_leak_info(uint8_t** info, size_t* overallSize,
154        size_t* infoSize, size_t* totalMemory, size_t* backtraceSize) {
155    // don't do anything if we have invalid arguments
156    if (info == NULL || overallSize == NULL || infoSize == NULL ||
157            totalMemory == NULL || backtraceSize == NULL) {
158        return;
159    }
160    *totalMemory = 0;
161
162    ScopedPthreadMutexLocker locker(&g_hash_table.lock);
163
164    if (g_hash_table.count == 0) {
165        *info = NULL;
166        *overallSize = 0;
167        *infoSize = 0;
168        *backtraceSize = 0;
169        return;
170    }
171
172    HashEntry** list = static_cast<HashEntry**>(Malloc(malloc)(sizeof(void*) * g_hash_table.count));
173
174    // get the entries into an array to be sorted
175    int index = 0;
176    for (size_t i = 0 ; i < HASHTABLE_SIZE ; ++i) {
177        HashEntry* entry = g_hash_table.slots[i];
178        while (entry != NULL) {
179            list[index] = entry;
180            *totalMemory = *totalMemory +
181                ((entry->size & ~SIZE_FLAG_MASK) * entry->allocations);
182            index++;
183            entry = entry->next;
184        }
185    }
186
187    // XXX: the protocol doesn't allow variable size for the stack trace (yet)
188    *infoSize = (sizeof(size_t) * 2) + (sizeof(uintptr_t) * BACKTRACE_SIZE);
189    *overallSize = *infoSize * g_hash_table.count;
190    *backtraceSize = BACKTRACE_SIZE;
191
192    // now get a byte array big enough for this
193    *info = static_cast<uint8_t*>(Malloc(malloc)(*overallSize));
194
195    if (*info == NULL) {
196        *overallSize = 0;
197        Malloc(free)(list);
198        return;
199    }
200
201    qsort(list, g_hash_table.count, sizeof(void*), hash_entry_compare);
202
203    uint8_t* head = *info;
204    const int count = g_hash_table.count;
205    for (int i = 0 ; i < count ; ++i) {
206        HashEntry* entry = list[i];
207        size_t entrySize = (sizeof(size_t) * 2) + (sizeof(uintptr_t) * entry->numEntries);
208        if (entrySize < *infoSize) {
209            /* we're writing less than a full entry, clear out the rest */
210            memset(head + entrySize, 0, *infoSize - entrySize);
211        } else {
212            /* make sure the amount we're copying doesn't exceed the limit */
213            entrySize = *infoSize;
214        }
215        memcpy(head, &(entry->size), entrySize);
216        head += *infoSize;
217    }
218
219    Malloc(free)(list);
220}
221
222// Exported for use by ddms.
223extern "C" void free_malloc_leak_info(uint8_t* info) {
224    Malloc(free)(info);
225}
226
227extern "C" struct mallinfo mallinfo() {
228    return Malloc(mallinfo)();
229}
230
231extern "C" void* valloc(size_t bytes) {
232    return Malloc(valloc)(bytes);
233}
234
235extern "C" void* pvalloc(size_t bytes) {
236    return Malloc(pvalloc)(bytes);
237}
238
239extern "C" int posix_memalign(void** memptr, size_t alignment, size_t size) {
240    return Malloc(posix_memalign)(memptr, alignment, size);
241}
242
243extern "C" void* malloc(size_t bytes) {
244    return __libc_malloc_dispatch->malloc(bytes);
245}
246
247extern "C" void free(void* mem) {
248    __libc_malloc_dispatch->free(mem);
249}
250
251extern "C" void* calloc(size_t n_elements, size_t elem_size) {
252    return __libc_malloc_dispatch->calloc(n_elements, elem_size);
253}
254
255extern "C" void* realloc(void* oldMem, size_t bytes) {
256    return __libc_malloc_dispatch->realloc(oldMem, bytes);
257}
258
259extern "C" void* memalign(size_t alignment, size_t bytes) {
260    return __libc_malloc_dispatch->memalign(alignment, bytes);
261}
262
263extern "C" size_t malloc_usable_size(const void* mem) {
264    return __libc_malloc_dispatch->malloc_usable_size(mem);
265}
266
267/* We implement malloc debugging only in libc.so, so code below
268 * must be excluded if we compile this file for static libc.a
269 */
270#ifndef LIBC_STATIC
271#include <sys/system_properties.h>
272#include <dlfcn.h>
273#include <stdio.h>
274#include "private/libc_logging.h"
275
276template<typename FunctionType>
277static void InitMallocFunction(void* malloc_impl_handler, FunctionType* func, const char* prefix, const char* suffix) {
278    char symbol[128];
279    snprintf(symbol, sizeof(symbol), "%s_%s", prefix, suffix);
280    *func = reinterpret_cast<FunctionType>(dlsym(malloc_impl_handler, symbol));
281    if (*func == NULL) {
282        error_log("%s: dlsym(\"%s\") failed", getprogname(), symbol);
283    }
284}
285
286static void InitMalloc(void* malloc_impl_handler, MallocDebug* table, const char* prefix) {
287    __libc_format_log(ANDROID_LOG_INFO, "libc", "%s: using libc.debug.malloc %d (%s)\n",
288                      getprogname(), g_malloc_debug_level, prefix);
289
290    InitMallocFunction<MallocDebugMalloc>(malloc_impl_handler, &table->malloc, prefix, "malloc");
291    InitMallocFunction<MallocDebugFree>(malloc_impl_handler, &table->free, prefix, "free");
292    InitMallocFunction<MallocDebugCalloc>(malloc_impl_handler, &table->calloc, prefix, "calloc");
293    InitMallocFunction<MallocDebugRealloc>(malloc_impl_handler, &table->realloc, prefix, "realloc");
294    InitMallocFunction<MallocDebugMemalign>(malloc_impl_handler, &table->memalign, prefix, "memalign");
295    InitMallocFunction<MallocDebugMallocUsableSize>(malloc_impl_handler, &table->malloc_usable_size, prefix, "malloc_usable_size");
296}
297
298/* Initializes memory allocation framework once per process. */
299static void malloc_init_impl() {
300    const char* so_name = NULL;
301    MallocDebugInit malloc_debug_initialize = NULL;
302    unsigned int qemu_running = 0;
303    unsigned int memcheck_enabled = 0;
304    char env[PROP_VALUE_MAX];
305    char memcheck_tracing[PROP_VALUE_MAX];
306    char debug_program[PROP_VALUE_MAX];
307
308    /* Get custom malloc debug level. Note that emulator started with
309     * memory checking option will have priority over debug level set in
310     * libc.debug.malloc system property. */
311    if (__system_property_get("ro.kernel.qemu", env) && atoi(env)) {
312        qemu_running = 1;
313        if (__system_property_get("ro.kernel.memcheck", memcheck_tracing)) {
314            if (memcheck_tracing[0] != '0') {
315                // Emulator has started with memory tracing enabled. Enforce it.
316                g_malloc_debug_level = 20;
317                memcheck_enabled = 1;
318            }
319        }
320    }
321
322    /* If debug level has not been set by memcheck option in the emulator,
323     * lets grab it from libc.debug.malloc system property. */
324    if (g_malloc_debug_level == 0 && __system_property_get("libc.debug.malloc", env)) {
325        g_malloc_debug_level = atoi(env);
326    }
327
328    /* Debug level 0 means that we should use default allocation routines. */
329    if (g_malloc_debug_level == 0) {
330        return;
331    }
332
333    /* If libc.debug.malloc.program is set and is not a substring of progname,
334     * then exit.
335     */
336    if (__system_property_get("libc.debug.malloc.program", debug_program)) {
337        if (!strstr(getprogname(), debug_program)) {
338            return;
339        }
340    }
341
342    // mksh is way too leaky. http://b/7291287.
343    if (g_malloc_debug_level >= 10) {
344        if (strcmp(getprogname(), "sh") == 0 || strcmp(getprogname(), "/system/bin/sh") == 0) {
345            return;
346        }
347    }
348
349    // Choose the appropriate .so for the requested debug level.
350    switch (g_malloc_debug_level) {
351        case 1:
352        case 5:
353        case 10:
354            so_name = "libc_malloc_debug_leak.so";
355            break;
356        case 20:
357            // Quick check: debug level 20 can only be handled in emulator.
358            if (!qemu_running) {
359                error_log("%s: Debug level %d can only be set in emulator\n",
360                          getprogname(), g_malloc_debug_level);
361                return;
362            }
363            // Make sure that memory checking has been enabled in emulator.
364            if (!memcheck_enabled) {
365                error_log("%s: Memory checking is not enabled in the emulator\n",
366                          getprogname());
367                return;
368            }
369            so_name = "libc_malloc_debug_qemu.so";
370            break;
371        default:
372            error_log("%s: Debug level %d is unknown\n", getprogname(), g_malloc_debug_level);
373            return;
374    }
375
376    // Load .so that implements the required malloc debugging functionality.
377    void* malloc_impl_handle = dlopen(so_name, RTLD_LAZY);
378    if (malloc_impl_handle == NULL) {
379        error_log("%s: Missing module %s required for malloc debug level %d: %s",
380                  getprogname(), so_name, g_malloc_debug_level, dlerror());
381        return;
382    }
383
384    // Initialize malloc debugging in the loaded module.
385    malloc_debug_initialize = reinterpret_cast<MallocDebugInit>(dlsym(malloc_impl_handle,
386                                                                      "malloc_debug_initialize"));
387    if (malloc_debug_initialize == NULL) {
388        error_log("%s: Initialization routine is not found in %s\n",
389                  getprogname(), so_name);
390        dlclose(malloc_impl_handle);
391        return;
392    }
393    if (malloc_debug_initialize(&g_hash_table) == -1) {
394        dlclose(malloc_impl_handle);
395        return;
396    }
397
398    if (g_malloc_debug_level == 20) {
399        // For memory checker we need to do extra initialization.
400        typedef int (*MemCheckInit)(int, const char*);
401        MemCheckInit memcheck_initialize =
402            reinterpret_cast<MemCheckInit>(dlsym(malloc_impl_handle,
403                                                 "memcheck_initialize"));
404        if (memcheck_initialize == NULL) {
405            error_log("%s: memcheck_initialize routine is not found in %s\n",
406                      getprogname(), so_name);
407            dlclose(malloc_impl_handle);
408            return;
409        }
410
411        if (memcheck_initialize(MALLOC_ALIGNMENT, memcheck_tracing)) {
412            dlclose(malloc_impl_handle);
413            return;
414        }
415    }
416
417    // Initialize malloc dispatch table with appropriate routines.
418    static MallocDebug malloc_dispatch_table __attribute__((aligned(32))) = {
419        Malloc(malloc),
420        Malloc(free),
421        Malloc(calloc),
422        Malloc(realloc),
423        Malloc(memalign),
424        Malloc(malloc_usable_size)
425    };
426
427    switch (g_malloc_debug_level) {
428        case 1:
429            InitMalloc(malloc_impl_handle, &malloc_dispatch_table, "leak");
430            break;
431        case 5:
432            InitMalloc(malloc_impl_handle, &malloc_dispatch_table, "fill");
433            break;
434        case 10:
435            InitMalloc(malloc_impl_handle, &malloc_dispatch_table, "chk");
436            break;
437        case 20:
438            InitMalloc(malloc_impl_handle, &malloc_dispatch_table, "qemu_instrumented");
439            break;
440        default:
441            break;
442    }
443
444    // Make sure dispatch table is initialized
445    if ((malloc_dispatch_table.malloc == NULL) ||
446        (malloc_dispatch_table.free == NULL) ||
447        (malloc_dispatch_table.calloc == NULL) ||
448        (malloc_dispatch_table.realloc == NULL) ||
449        (malloc_dispatch_table.memalign == NULL) ||
450        (malloc_dispatch_table.malloc_usable_size == NULL)) {
451        error_log("%s: some symbols for libc.debug.malloc level %d were not found (see above)",
452                  getprogname(), g_malloc_debug_level);
453        dlclose(malloc_impl_handle);
454    } else {
455        __libc_malloc_dispatch = &malloc_dispatch_table;
456        libc_malloc_impl_handle = malloc_impl_handle;
457    }
458}
459
460static void malloc_fini_impl() {
461    // Our BSD stdio implementation doesn't close the standard streams, it only flushes them.
462    // And it doesn't do that until its atexit handler is run, and we run first!
463    // It's great that other unclosed FILE*s show up as malloc leaks, but we need to manually
464    // clean up the standard streams ourselves.
465    fclose(stdin);
466    fclose(stdout);
467    fclose(stderr);
468
469    if (libc_malloc_impl_handle != NULL) {
470        MallocDebugFini malloc_debug_finalize =
471            reinterpret_cast<MallocDebugFini>(dlsym(libc_malloc_impl_handle,
472                                                    "malloc_debug_finalize"));
473        if (malloc_debug_finalize != NULL) {
474            malloc_debug_finalize(g_malloc_debug_level);
475        }
476    }
477}
478
479#endif  // !LIBC_STATIC
480
481/* Initializes memory allocation framework.
482 * This routine is called from __libc_init routines implemented
483 * in libc_init_static.c and libc_init_dynamic.c files.
484 */
485extern "C" __LIBC_HIDDEN__ void malloc_debug_init() {
486#if defined(USE_DL_PREFIX) && !defined(LIBC_STATIC)
487  static pthread_once_t malloc_init_once_ctl = PTHREAD_ONCE_INIT;
488  if (pthread_once(&malloc_init_once_ctl, malloc_init_impl)) {
489    error_log("Unable to initialize malloc_debug component.");
490  }
491#endif  // USE_DL_PREFIX && !LIBC_STATIC
492}
493
494extern "C" __LIBC_HIDDEN__ void malloc_debug_fini() {
495#if defined(USE_DL_PREFIX) && !defined(LIBC_STATIC)
496  static pthread_once_t malloc_fini_once_ctl = PTHREAD_ONCE_INIT;
497  if (pthread_once(&malloc_fini_once_ctl, malloc_fini_impl)) {
498    error_log("Unable to finalize malloc_debug component.");
499  }
500#endif  // USE_DL_PREFIX && !LIBC_STATIC
501}
502