malloc_debug_common.cpp revision 72bbd423579bb971dc06cdd3c06201faf3fe95e6 
1/*
2 * Copyright (C) 2009 The Android Open Source Project
3 * All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
7 * are met:
8 *  * Redistributions of source code must retain the above copyright
9 *    notice, this list of conditions and the following disclaimer.
10 *  * Redistributions in binary form must reproduce the above copyright
11 *    notice, this list of conditions and the following disclaimer in
12 *    the documentation and/or other materials provided with the
13 *    distribution.
14 *
15 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
16 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
17 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
18 * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
19 * COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
20 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
21 * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
22 * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
23 * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
24 * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
25 * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
26 * SUCH DAMAGE.
27 */
28
29/*
30 * Contains definition of structures, global variables, and implementation of
31 * routines that are used by malloc leak detection code and other components in
32 * the system. The trick is that some components expect these data and
33 * routines to be defined / implemented in libc.so library, regardless
34 * whether or not MALLOC_LEAK_CHECK macro is defined. To make things even
35 * more tricky, malloc leak detection code, implemented in
36 * libc_malloc_debug.so also requires access to these variables and routines
37 * (to fill allocation entry hash table, for example). So, all relevant
38 * variables and routines are defined / implemented here and exported
39 * to all, leak detection code and other components via dynamic (libc.so),
40 * or static (libc.a) linking.
41 */
42
43#include "malloc_debug_common.h"
44
45#include <pthread.h>
46#include <stdlib.h>
47#include <unistd.h>
48
49#include "private/ScopedPthreadMutexLocker.h"
50
51/*
52 * In a VM process, this is set to 1 after fork()ing out of zygote.
53 */
54int gMallocLeakZygoteChild = 0;
55
56__LIBC_HIDDEN__ pthread_mutex_t g_allocations_mutex = PTHREAD_MUTEX_INITIALIZER;
57__LIBC_HIDDEN__ HashTable g_hash_table;
58
59// =============================================================================
60// output functions
61// =============================================================================
62
63static int hash_entry_compare(const void* arg1, const void* arg2) {
64    int result;
65
66    const HashEntry* e1 = *static_cast<HashEntry* const*>(arg1);
67    const HashEntry* e2 = *static_cast<HashEntry* const*>(arg2);
68
69    // if one or both arg pointers are null, deal gracefully
70    if (e1 == NULL) {
71        result = (e2 == NULL) ? 0 : 1;
72    } else if (e2 == NULL) {
73        result = -1;
74    } else {
75        size_t nbAlloc1 = e1->allocations;
76        size_t nbAlloc2 = e2->allocations;
77        size_t size1 = e1->size & ~SIZE_FLAG_MASK;
78        size_t size2 = e2->size & ~SIZE_FLAG_MASK;
79        size_t alloc1 = nbAlloc1 * size1;
80        size_t alloc2 = nbAlloc2 * size2;
81
82        // sort in descending order by:
83        // 1) total size
84        // 2) number of allocations
85        //
86        // This is used for sorting, not determination of equality, so we don't
87        // need to compare the bit flags.
88        if (alloc1 > alloc2) {
89            result = -1;
90        } else if (alloc1 < alloc2) {
91            result = 1;
92        } else {
93            if (nbAlloc1 > nbAlloc2) {
94                result = -1;
95            } else if (nbAlloc1 < nbAlloc2) {
96                result = 1;
97            } else {
98                result = 0;
99            }
100        }
101    }
102    return result;
103}
104
105/*
106 * Retrieve native heap information.
107 *
108 * "*info" is set to a buffer we allocate
109 * "*overallSize" is set to the size of the "info" buffer
110 * "*infoSize" is set to the size of a single entry
111 * "*totalMemory" is set to the sum of all allocations we're tracking; does
112 *   not include heap overhead
113 * "*backtraceSize" is set to the maximum number of entries in the back trace
114 */
115
116// Exported for use by ddms.
117extern "C" void get_malloc_leak_info(uint8_t** info, size_t* overallSize,
118        size_t* infoSize, size_t* totalMemory, size_t* backtraceSize) {
119    // don't do anything if we have invalid arguments
120    if (info == NULL || overallSize == NULL || infoSize == NULL ||
121            totalMemory == NULL || backtraceSize == NULL) {
122        return;
123    }
124    *totalMemory = 0;
125
126    ScopedPthreadMutexLocker locker(&g_allocations_mutex);
127
128    if (g_hash_table.count == 0) {
129        *info = NULL;
130        *overallSize = 0;
131        *infoSize = 0;
132        *backtraceSize = 0;
133        return;
134    }
135
136    HashEntry** list = static_cast<HashEntry**>(Malloc(malloc)(sizeof(void*) * g_hash_table.count));
137
138    // get the entries into an array to be sorted
139    int index = 0;
140    for (size_t i = 0 ; i < HASHTABLE_SIZE ; ++i) {
141        HashEntry* entry = g_hash_table.slots[i];
142        while (entry != NULL) {
143            list[index] = entry;
144            *totalMemory = *totalMemory +
145                ((entry->size & ~SIZE_FLAG_MASK) * entry->allocations);
146            index++;
147            entry = entry->next;
148        }
149    }
150
151    // XXX: the protocol doesn't allow variable size for the stack trace (yet)
152    *infoSize = (sizeof(size_t) * 2) + (sizeof(uintptr_t) * BACKTRACE_SIZE);
153    *overallSize = *infoSize * g_hash_table.count;
154    *backtraceSize = BACKTRACE_SIZE;
155
156    // now get a byte array big enough for this
157    *info = static_cast<uint8_t*>(Malloc(malloc)(*overallSize));
158
159    if (*info == NULL) {
160        *overallSize = 0;
161        Malloc(free)(list);
162        return;
163    }
164
165    qsort(list, g_hash_table.count, sizeof(void*), hash_entry_compare);
166
167    uint8_t* head = *info;
168    const int count = g_hash_table.count;
169    for (int i = 0 ; i < count ; ++i) {
170        HashEntry* entry = list[i];
171        size_t entrySize = (sizeof(size_t) * 2) + (sizeof(uintptr_t) * entry->numEntries);
172        if (entrySize < *infoSize) {
173            /* we're writing less than a full entry, clear out the rest */
174            memset(head + entrySize, 0, *infoSize - entrySize);
175        } else {
176            /* make sure the amount we're copying doesn't exceed the limit */
177            entrySize = *infoSize;
178        }
179        memcpy(head, &(entry->size), entrySize);
180        head += *infoSize;
181    }
182
183    Malloc(free)(list);
184}
185
186// Exported for use by ddms.
187extern "C" void free_malloc_leak_info(uint8_t* info) {
188    Malloc(free)(info);
189}
190
191extern "C" struct mallinfo mallinfo() {
192    return Malloc(mallinfo)();
193}
194
195extern "C" void* valloc(size_t bytes) {
196    return Malloc(valloc)(bytes);
197}
198
199extern "C" void* pvalloc(size_t bytes) {
200    return Malloc(pvalloc)(bytes);
201}
202
203extern "C" int posix_memalign(void** memptr, size_t alignment, size_t size) {
204    return Malloc(posix_memalign)(memptr, alignment, size);
205}
206
207// Support for malloc debugging.
208// Table for dispatching malloc calls, initialized with default dispatchers.
209extern const MallocDebug __libc_malloc_default_dispatch;
210const MallocDebug __libc_malloc_default_dispatch __attribute__((aligned(32))) =
211{
212    Malloc(malloc), Malloc(free), Malloc(calloc), Malloc(realloc), Malloc(memalign), Malloc(malloc_usable_size),
213};
214
215/* Selector of dispatch table to use for dispatching malloc calls. */
216const MallocDebug* __libc_malloc_dispatch = &__libc_malloc_default_dispatch;
217
218extern "C" void* malloc(size_t bytes) {
219    return __libc_malloc_dispatch->malloc(bytes);
220}
221
222extern "C" void free(void* mem) {
223    __libc_malloc_dispatch->free(mem);
224}
225
226extern "C" void* calloc(size_t n_elements, size_t elem_size) {
227    return __libc_malloc_dispatch->calloc(n_elements, elem_size);
228}
229
230extern "C" void* realloc(void* oldMem, size_t bytes) {
231    return __libc_malloc_dispatch->realloc(oldMem, bytes);
232}
233
234extern "C" void* memalign(size_t alignment, size_t bytes) {
235    return __libc_malloc_dispatch->memalign(alignment, bytes);
236}
237
238extern "C" size_t malloc_usable_size(const void* mem) {
239    return __libc_malloc_dispatch->malloc_usable_size(mem);
240}
241
242/* We implement malloc debugging only in libc.so, so code below
243 * must be excluded if we compile this file for static libc.a
244 */
245#ifndef LIBC_STATIC
246#include <sys/system_properties.h>
247#include <dlfcn.h>
248#include <stdio.h>
249#include "private/libc_logging.h"
250
251/* Table for dispatching malloc calls, depending on environment. */
252static MallocDebug g_malloc_dispatch_table __attribute__((aligned(32))) = {
253    Malloc(malloc), Malloc(free), Malloc(calloc), Malloc(realloc), Malloc(memalign), Malloc(malloc_usable_size)
254};
255
256extern const char* __progname;
257
258/* Handle to shared library where actual memory allocation is implemented.
259 * This library is loaded and memory allocation calls are redirected there
260 * when libc.debug.malloc environment variable contains value other than
261 * zero:
262 * 1  - For memory leak detections.
263 * 5  - For filling allocated / freed memory with patterns defined by
264 *      CHK_SENTINEL_VALUE, and CHK_FILL_FREE macros.
265 * 10 - For adding pre-, and post- allocation stubs in order to detect
266 *      buffer overruns.
267 * Note that emulator's memory allocation instrumentation is not controlled by
268 * libc.debug.malloc value, but rather by emulator, started with -memcheck
269 * option. Note also, that if emulator has started with -memcheck option,
270 * emulator's instrumented memory allocation will take over value saved in
271 * libc.debug.malloc. In other words, if emulator has started with -memcheck
272 * option, libc.debug.malloc value is ignored.
273 * Actual functionality for debug levels 1-10 is implemented in
274 * libc_malloc_debug_leak.so, while functionality for emultor's instrumented
275 * allocations is implemented in libc_malloc_debug_qemu.so and can be run inside
276 * the emulator only.
277 */
278static void* libc_malloc_impl_handle = NULL;
279
280/* This variable is set to the value of property libc.debug.malloc.backlog,
281 * when the value of libc.debug.malloc = 10.  It determines the size of the
282 * backlog we use to detect multiple frees.  If the property is not set, the
283 * backlog length defaults to BACKLOG_DEFAULT_LEN.
284 */
285__LIBC_HIDDEN__ unsigned int g_malloc_debug_backlog;
286#define BACKLOG_DEFAULT_LEN 100
287
288/* The value of libc.debug.malloc. */
289__LIBC_HIDDEN__ int g_malloc_debug_level;
290
291template<typename FunctionType>
292static void InitMallocFunction(void* malloc_impl_handler, FunctionType* func, const char* prefix, const char* suffix) {
293    char symbol[128];
294    snprintf(symbol, sizeof(symbol), "%s_%s", prefix, suffix);
295    *func = reinterpret_cast<FunctionType>(dlsym(malloc_impl_handler, symbol));
296    if (*func == NULL) {
297        error_log("%s: dlsym(\"%s\") failed", __progname, symbol);
298    }
299}
300
301static void InitMalloc(void* malloc_impl_handler, MallocDebug* table, const char* prefix) {
302    __libc_format_log(ANDROID_LOG_INFO, "libc", "%s: using libc.debug.malloc %d (%s)\n",
303                      __progname, g_malloc_debug_level, prefix);
304
305    InitMallocFunction<MallocDebugMalloc>(malloc_impl_handler, &table->malloc, prefix, "malloc");
306    InitMallocFunction<MallocDebugFree>(malloc_impl_handler, &table->free, prefix, "free");
307    InitMallocFunction<MallocDebugCalloc>(malloc_impl_handler, &table->calloc, prefix, "calloc");
308    InitMallocFunction<MallocDebugRealloc>(malloc_impl_handler, &table->realloc, prefix, "realloc");
309    InitMallocFunction<MallocDebugMemalign>(malloc_impl_handler, &table->memalign, prefix, "memalign");
310    InitMallocFunction<MallocDebugMallocUsableSize>(malloc_impl_handler, &table->malloc_usable_size, prefix, "malloc_usable_size");
311}
312
313/* Initializes memory allocation framework once per process. */
314static void malloc_init_impl() {
315    const char* so_name = NULL;
316    MallocDebugInit malloc_debug_initialize = NULL;
317    unsigned int qemu_running = 0;
318    unsigned int memcheck_enabled = 0;
319    char env[PROP_VALUE_MAX];
320    char memcheck_tracing[PROP_VALUE_MAX];
321    char debug_program[PROP_VALUE_MAX];
322
323    /* Get custom malloc debug level. Note that emulator started with
324     * memory checking option will have priority over debug level set in
325     * libc.debug.malloc system property. */
326    if (__system_property_get("ro.kernel.qemu", env) && atoi(env)) {
327        qemu_running = 1;
328        if (__system_property_get("ro.kernel.memcheck", memcheck_tracing)) {
329            if (memcheck_tracing[0] != '0') {
330                // Emulator has started with memory tracing enabled. Enforce it.
331                g_malloc_debug_level = 20;
332                memcheck_enabled = 1;
333            }
334        }
335    }
336
337    /* If debug level has not been set by memcheck option in the emulator,
338     * lets grab it from libc.debug.malloc system property. */
339    if (g_malloc_debug_level == 0 && __system_property_get("libc.debug.malloc", env)) {
340        g_malloc_debug_level = atoi(env);
341    }
342
343    /* Debug level 0 means that we should use default allocation routines. */
344    if (g_malloc_debug_level == 0) {
345        return;
346    }
347
348    /* If libc.debug.malloc.program is set and is not a substring of progname,
349     * then exit.
350     */
351    if (__system_property_get("libc.debug.malloc.program", debug_program)) {
352        if (!strstr(__progname, debug_program)) {
353            return;
354        }
355    }
356
357    // mksh is way too leaky. http://b/7291287.
358    if (g_malloc_debug_level >= 10) {
359        if (strcmp(__progname, "sh") == 0 || strcmp(__progname, "/system/bin/sh") == 0) {
360            return;
361        }
362    }
363
364    // Choose the appropriate .so for the requested debug level.
365    switch (g_malloc_debug_level) {
366        case 1:
367        case 5:
368        case 10: {
369            char debug_backlog[PROP_VALUE_MAX];
370            if (__system_property_get("libc.debug.malloc.backlog", debug_backlog)) {
371                g_malloc_debug_backlog = atoi(debug_backlog);
372                info_log("%s: setting backlog length to %d\n", __progname, g_malloc_debug_backlog);
373            }
374            if (g_malloc_debug_backlog == 0) {
375                g_malloc_debug_backlog = BACKLOG_DEFAULT_LEN;
376            }
377            so_name = "libc_malloc_debug_leak.so";
378            break;
379        }
380        case 20:
381            // Quick check: debug level 20 can only be handled in emulator.
382            if (!qemu_running) {
383                error_log("%s: Debug level %d can only be set in emulator\n",
384                          __progname, g_malloc_debug_level);
385                return;
386            }
387            // Make sure that memory checking has been enabled in emulator.
388            if (!memcheck_enabled) {
389                error_log("%s: Memory checking is not enabled in the emulator\n",
390                          __progname);
391                return;
392            }
393            so_name = "libc_malloc_debug_qemu.so";
394            break;
395        default:
396            error_log("%s: Debug level %d is unknown\n", __progname, g_malloc_debug_level);
397            return;
398    }
399
400    // Load .so that implements the required malloc debugging functionality.
401    void* malloc_impl_handle = dlopen(so_name, RTLD_LAZY);
402    if (malloc_impl_handle == NULL) {
403        error_log("%s: Missing module %s required for malloc debug level %d: %s",
404                  __progname, so_name, g_malloc_debug_level, dlerror());
405        return;
406    }
407
408    // Initialize malloc debugging in the loaded module.
409    malloc_debug_initialize = reinterpret_cast<MallocDebugInit>(dlsym(malloc_impl_handle,
410                                                                      "malloc_debug_initialize"));
411    if (malloc_debug_initialize == NULL) {
412        error_log("%s: Initialization routine is not found in %s\n",
413                  __progname, so_name);
414        dlclose(malloc_impl_handle);
415        return;
416    }
417    if (malloc_debug_initialize() == -1) {
418        dlclose(malloc_impl_handle);
419        return;
420    }
421
422    if (g_malloc_debug_level == 20) {
423        // For memory checker we need to do extra initialization.
424        typedef int (*MemCheckInit)(int, const char*);
425        MemCheckInit memcheck_initialize =
426            reinterpret_cast<MemCheckInit>(dlsym(malloc_impl_handle,
427                                                 "memcheck_initialize"));
428        if (memcheck_initialize == NULL) {
429            error_log("%s: memcheck_initialize routine is not found in %s\n",
430                      __progname, so_name);
431            dlclose(malloc_impl_handle);
432            return;
433        }
434
435        if (memcheck_initialize(MALLOC_ALIGNMENT, memcheck_tracing)) {
436            dlclose(malloc_impl_handle);
437            return;
438        }
439    }
440
441
442    // Initialize malloc dispatch table with appropriate routines.
443    switch (g_malloc_debug_level) {
444        case 1:
445            InitMalloc(malloc_impl_handle, &g_malloc_dispatch_table, "leak");
446            break;
447        case 5:
448            InitMalloc(malloc_impl_handle, &g_malloc_dispatch_table, "fill");
449            break;
450        case 10:
451            InitMalloc(malloc_impl_handle, &g_malloc_dispatch_table, "chk");
452            break;
453        case 20:
454            InitMalloc(malloc_impl_handle, &g_malloc_dispatch_table, "qemu_instrumented");
455            break;
456        default:
457            break;
458    }
459
460    // Make sure dispatch table is initialized
461    if ((g_malloc_dispatch_table.malloc == NULL) ||
462        (g_malloc_dispatch_table.free == NULL) ||
463        (g_malloc_dispatch_table.calloc == NULL) ||
464        (g_malloc_dispatch_table.realloc == NULL) ||
465        (g_malloc_dispatch_table.memalign == NULL) ||
466        (g_malloc_dispatch_table.malloc_usable_size == NULL)) {
467        error_log("%s: some symbols for libc.debug.malloc level %d were not found (see above)",
468                  __progname, g_malloc_debug_level);
469        dlclose(malloc_impl_handle);
470    } else {
471        __libc_malloc_dispatch = &g_malloc_dispatch_table;
472        libc_malloc_impl_handle = malloc_impl_handle;
473    }
474}
475
476static void malloc_fini_impl() {
477    // Our BSD stdio implementation doesn't close the standard streams, it only flushes them.
478    // And it doesn't do that until its atexit handler (_cleanup) is run, and we run first!
479    // It's great that other unclosed FILE*s show up as malloc leaks, but we need to manually
480    // clean up the standard streams ourselves.
481    fclose(stdin);
482    fclose(stdout);
483    fclose(stderr);
484
485    if (libc_malloc_impl_handle != NULL) {
486        MallocDebugFini malloc_debug_finalize =
487            reinterpret_cast<MallocDebugFini>(dlsym(libc_malloc_impl_handle,
488                                                    "malloc_debug_finalize"));
489        if (malloc_debug_finalize != NULL) {
490            malloc_debug_finalize();
491        }
492    }
493}
494
495static pthread_once_t  malloc_init_once_ctl = PTHREAD_ONCE_INIT;
496static pthread_once_t  malloc_fini_once_ctl = PTHREAD_ONCE_INIT;
497
498#endif  // !LIBC_STATIC
499
500/* Initializes memory allocation framework.
501 * This routine is called from __libc_init routines implemented
502 * in libc_init_static.c and libc_init_dynamic.c files.
503 */
504extern "C" __LIBC_HIDDEN__ void malloc_debug_init() {
505    /* We need to initialize malloc iff we implement here custom
506     * malloc routines (i.e. USE_DL_PREFIX is defined) for libc.so */
507#if defined(USE_DL_PREFIX) && !defined(LIBC_STATIC)
508    if (pthread_once(&malloc_init_once_ctl, malloc_init_impl)) {
509        error_log("Unable to initialize malloc_debug component.");
510    }
511#endif  // USE_DL_PREFIX && !LIBC_STATIC
512}
513
514extern "C" __LIBC_HIDDEN__ void malloc_debug_fini() {
515    /* We need to finalize malloc iff we implement here custom
516     * malloc routines (i.e. USE_DL_PREFIX is defined) for libc.so */
517#if defined(USE_DL_PREFIX) && !defined(LIBC_STATIC)
518    if (pthread_once(&malloc_fini_once_ctl, malloc_fini_impl)) {
519        error_log("Unable to finalize malloc_debug component.");
520    }
521#endif  // USE_DL_PREFIX && !LIBC_STATIC
522}
523