malloc_debug_common.cpp revision e5fdaa4f9d102461a4d8a865e6ca84666893b9e7
1/* 2 * Copyright (C) 2009 The Android Open Source Project 3 * All rights reserved. 4 * 5 * Redistribution and use in source and binary forms, with or without 6 * modification, are permitted provided that the following conditions 7 * are met: 8 * * Redistributions of source code must retain the above copyright 9 * notice, this list of conditions and the following disclaimer. 10 * * Redistributions in binary form must reproduce the above copyright 11 * notice, this list of conditions and the following disclaimer in 12 * the documentation and/or other materials provided with the 13 * distribution. 14 * 15 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 16 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT 17 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS 18 * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE 19 * COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, 20 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, 21 * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS 22 * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED 23 * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, 24 * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT 25 * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 26 * SUCH DAMAGE. 27 */ 28 29// Contains definition of structures, global variables, and implementation of 30// routines that are used by malloc leak detection code and other components in 31// the system. The trick is that some components expect these data and 32// routines to be defined / implemented in libc.so library, regardless 33// whether or not MALLOC_LEAK_CHECK macro is defined. To make things even 34// more tricky, malloc leak detection code, implemented in 35// libc_malloc_debug.so also requires access to these variables and routines 36// (to fill allocation entry hash table, for example). So, all relevant 37// variables and routines are defined / implemented here and exported 38// to all, leak detection code and other components via dynamic (libc.so), 39// or static (libc.a) linking. 40 41#include "malloc_debug_common.h" 42 43#include <pthread.h> 44#include <stdlib.h> 45#include <unistd.h> 46 47#include "private/ScopedPthreadMutexLocker.h" 48 49// In a VM process, this is set to 1 after fork()ing out of zygote. 50int gMallocLeakZygoteChild = 0; 51 52static HashTable g_hash_table; 53 54// Support for malloc debugging. 55// Table for dispatching malloc calls, initialized with default dispatchers. 56static const MallocDebug __libc_malloc_default_dispatch __attribute__((aligned(32))) = { 57 Malloc(calloc), 58 Malloc(free), 59 Malloc(mallinfo), 60 Malloc(malloc), 61 Malloc(malloc_usable_size), 62 Malloc(memalign), 63 Malloc(posix_memalign), 64#if defined(HAVE_DEPRECATED_MALLOC_FUNCS) 65 Malloc(pvalloc), 66#endif 67 Malloc(realloc), 68#if defined(HAVE_DEPRECATED_MALLOC_FUNCS) 69 Malloc(valloc), 70#endif 71}; 72 73// Selector of dispatch table to use for dispatching malloc calls. 74// TODO: fix http://b/15432753 and make this static again. 75const MallocDebug* __libc_malloc_dispatch = &__libc_malloc_default_dispatch; 76 77// Handle to shared library where actual memory allocation is implemented. 78// This library is loaded and memory allocation calls are redirected there 79// when libc.debug.malloc environment variable contains value other than 80// zero: 81// 1 - For memory leak detections. 82// 5 - For filling allocated / freed memory with patterns defined by 83// CHK_SENTINEL_VALUE, and CHK_FILL_FREE macros. 84// 10 - For adding pre-, and post- allocation stubs in order to detect 85// buffer overruns. 86// Note that emulator's memory allocation instrumentation is not controlled by 87// libc.debug.malloc value, but rather by emulator, started with -memcheck 88// option. Note also, that if emulator has started with -memcheck option, 89// emulator's instrumented memory allocation will take over value saved in 90// libc.debug.malloc. In other words, if emulator has started with -memcheck 91// option, libc.debug.malloc value is ignored. 92// Actual functionality for debug levels 1-10 is implemented in 93// libc_malloc_debug_leak.so, while functionality for emulator's instrumented 94// allocations is implemented in libc_malloc_debug_qemu.so and can be run inside 95// the emulator only. 96#if !defined(LIBC_STATIC) 97static void* libc_malloc_impl_handle = NULL; 98#endif 99 100 101// The value of libc.debug.malloc. 102#if !defined(LIBC_STATIC) 103static int g_malloc_debug_level = 0; 104#endif 105 106// ============================================================================= 107// output functions 108// ============================================================================= 109 110static int hash_entry_compare(const void* arg1, const void* arg2) { 111 int result; 112 113 const HashEntry* e1 = *static_cast<HashEntry* const*>(arg1); 114 const HashEntry* e2 = *static_cast<HashEntry* const*>(arg2); 115 116 // if one or both arg pointers are null, deal gracefully 117 if (e1 == NULL) { 118 result = (e2 == NULL) ? 0 : 1; 119 } else if (e2 == NULL) { 120 result = -1; 121 } else { 122 size_t nbAlloc1 = e1->allocations; 123 size_t nbAlloc2 = e2->allocations; 124 size_t size1 = e1->size & ~SIZE_FLAG_MASK; 125 size_t size2 = e2->size & ~SIZE_FLAG_MASK; 126 size_t alloc1 = nbAlloc1 * size1; 127 size_t alloc2 = nbAlloc2 * size2; 128 129 // sort in descending order by: 130 // 1) total size 131 // 2) number of allocations 132 // 133 // This is used for sorting, not determination of equality, so we don't 134 // need to compare the bit flags. 135 if (alloc1 > alloc2) { 136 result = -1; 137 } else if (alloc1 < alloc2) { 138 result = 1; 139 } else { 140 if (nbAlloc1 > nbAlloc2) { 141 result = -1; 142 } else if (nbAlloc1 < nbAlloc2) { 143 result = 1; 144 } else { 145 result = 0; 146 } 147 } 148 } 149 return result; 150} 151 152// Retrieve native heap information. 153// 154// "*info" is set to a buffer we allocate 155// "*overallSize" is set to the size of the "info" buffer 156// "*infoSize" is set to the size of a single entry 157// "*totalMemory" is set to the sum of all allocations we're tracking; does 158// not include heap overhead 159// "*backtraceSize" is set to the maximum number of entries in the back trace 160 161// ============================================================================= 162// Exported for use by ddms. 163// ============================================================================= 164extern "C" void get_malloc_leak_info(uint8_t** info, size_t* overallSize, 165 size_t* infoSize, size_t* totalMemory, size_t* backtraceSize) { 166 // Don't do anything if we have invalid arguments. 167 if (info == NULL || overallSize == NULL || infoSize == NULL || 168 totalMemory == NULL || backtraceSize == NULL) { 169 return; 170 } 171 *totalMemory = 0; 172 173 ScopedPthreadMutexLocker locker(&g_hash_table.lock); 174 if (g_hash_table.count == 0) { 175 *info = NULL; 176 *overallSize = 0; 177 *infoSize = 0; 178 *backtraceSize = 0; 179 return; 180 } 181 182 HashEntry** list = static_cast<HashEntry**>(Malloc(malloc)(sizeof(void*) * g_hash_table.count)); 183 184 // Get the entries into an array to be sorted. 185 size_t index = 0; 186 for (size_t i = 0 ; i < HASHTABLE_SIZE ; ++i) { 187 HashEntry* entry = g_hash_table.slots[i]; 188 while (entry != NULL) { 189 list[index] = entry; 190 *totalMemory = *totalMemory + ((entry->size & ~SIZE_FLAG_MASK) * entry->allocations); 191 index++; 192 entry = entry->next; 193 } 194 } 195 196 // XXX: the protocol doesn't allow variable size for the stack trace (yet) 197 *infoSize = (sizeof(size_t) * 2) + (sizeof(uintptr_t) * BACKTRACE_SIZE); 198 *overallSize = *infoSize * g_hash_table.count; 199 *backtraceSize = BACKTRACE_SIZE; 200 201 // now get a byte array big enough for this 202 *info = static_cast<uint8_t*>(Malloc(malloc)(*overallSize)); 203 if (*info == NULL) { 204 *overallSize = 0; 205 Malloc(free)(list); 206 return; 207 } 208 209 qsort(list, g_hash_table.count, sizeof(void*), hash_entry_compare); 210 211 uint8_t* head = *info; 212 const size_t count = g_hash_table.count; 213 for (size_t i = 0 ; i < count ; ++i) { 214 HashEntry* entry = list[i]; 215 size_t entrySize = (sizeof(size_t) * 2) + (sizeof(uintptr_t) * entry->numEntries); 216 if (entrySize < *infoSize) { 217 // We're writing less than a full entry, clear out the rest. 218 memset(head + entrySize, 0, *infoSize - entrySize); 219 } else { 220 // Make sure the amount we're copying doesn't exceed the limit. 221 entrySize = *infoSize; 222 } 223 memcpy(head, &(entry->size), entrySize); 224 head += *infoSize; 225 } 226 227 Malloc(free)(list); 228} 229 230extern "C" void free_malloc_leak_info(uint8_t* info) { 231 Malloc(free)(info); 232} 233 234// ============================================================================= 235// Allocation functions 236// ============================================================================= 237extern "C" void* calloc(size_t n_elements, size_t elem_size) { 238 return __libc_malloc_dispatch->calloc(n_elements, elem_size); 239} 240 241extern "C" void free(void* mem) { 242 __libc_malloc_dispatch->free(mem); 243} 244 245extern "C" struct mallinfo mallinfo() { 246 return __libc_malloc_dispatch->mallinfo(); 247} 248 249extern "C" void* malloc(size_t bytes) { 250 return __libc_malloc_dispatch->malloc(bytes); 251} 252 253extern "C" size_t malloc_usable_size(const void* mem) { 254 return __libc_malloc_dispatch->malloc_usable_size(mem); 255} 256 257extern "C" void* memalign(size_t alignment, size_t bytes) { 258 return __libc_malloc_dispatch->memalign(alignment, bytes); 259} 260 261extern "C" int posix_memalign(void** memptr, size_t alignment, size_t size) { 262 return __libc_malloc_dispatch->posix_memalign(memptr, alignment, size); 263} 264 265#if defined(HAVE_DEPRECATED_MALLOC_FUNCS) 266extern "C" void* pvalloc(size_t bytes) { 267 return __libc_malloc_dispatch->pvalloc(bytes); 268} 269#endif 270 271extern "C" void* realloc(void* oldMem, size_t bytes) { 272 return __libc_malloc_dispatch->realloc(oldMem, bytes); 273} 274 275#if defined(HAVE_DEPRECATED_MALLOC_FUNCS) 276extern "C" void* valloc(size_t bytes) { 277 return __libc_malloc_dispatch->valloc(bytes); 278} 279#endif 280 281// We implement malloc debugging only in libc.so, so the code below 282// must be excluded if we compile this file for static libc.a 283#ifndef LIBC_STATIC 284#include <sys/system_properties.h> 285#include <dlfcn.h> 286#include <stdio.h> 287#include "private/libc_logging.h" 288 289template<typename FunctionType> 290static void InitMallocFunction(void* malloc_impl_handler, FunctionType* func, const char* prefix, const char* suffix) { 291 char symbol[128]; 292 snprintf(symbol, sizeof(symbol), "%s_%s", prefix, suffix); 293 *func = reinterpret_cast<FunctionType>(dlsym(malloc_impl_handler, symbol)); 294 if (*func == NULL) { 295 error_log("%s: dlsym(\"%s\") failed", getprogname(), symbol); 296 } 297} 298 299static void InitMalloc(void* malloc_impl_handler, MallocDebug* table, const char* prefix) { 300 __libc_format_log(ANDROID_LOG_INFO, "libc", "%s: using libc.debug.malloc %d (%s)\n", 301 getprogname(), g_malloc_debug_level, prefix); 302 303 InitMallocFunction<MallocDebugCalloc>(malloc_impl_handler, &table->calloc, prefix, "calloc"); 304 InitMallocFunction<MallocDebugFree>(malloc_impl_handler, &table->free, prefix, "free"); 305 InitMallocFunction<MallocDebugMallinfo>(malloc_impl_handler, &table->mallinfo, prefix, "mallinfo"); 306 InitMallocFunction<MallocDebugMalloc>(malloc_impl_handler, &table->malloc, prefix, "malloc"); 307 InitMallocFunction<MallocDebugMallocUsableSize>(malloc_impl_handler, &table->malloc_usable_size, prefix, "malloc_usable_size"); 308 InitMallocFunction<MallocDebugMemalign>(malloc_impl_handler, &table->memalign, prefix, "memalign"); 309 InitMallocFunction<MallocDebugPosixMemalign>(malloc_impl_handler, &table->posix_memalign, prefix, "posix_memalign"); 310#if defined(HAVE_DEPRECATED_MALLOC_FUNCS) 311 InitMallocFunction<MallocDebugPvalloc>(malloc_impl_handler, &table->pvalloc, prefix, "pvalloc"); 312#endif 313 InitMallocFunction<MallocDebugRealloc>(malloc_impl_handler, &table->realloc, prefix, "realloc"); 314#if defined(HAVE_DEPRECATED_MALLOC_FUNCS) 315 InitMallocFunction<MallocDebugValloc>(malloc_impl_handler, &table->valloc, prefix, "valloc"); 316#endif 317} 318 319// Initializes memory allocation framework once per process. 320static void malloc_init_impl() { 321 const char* so_name = NULL; 322 MallocDebugInit malloc_debug_initialize = NULL; 323 unsigned int qemu_running = 0; 324 unsigned int memcheck_enabled = 0; 325 char env[PROP_VALUE_MAX]; 326 char memcheck_tracing[PROP_VALUE_MAX]; 327 char debug_program[PROP_VALUE_MAX]; 328 329 // Get custom malloc debug level. Note that emulator started with 330 // memory checking option will have priority over debug level set in 331 // libc.debug.malloc system property. 332 if (__system_property_get("ro.kernel.qemu", env) && atoi(env)) { 333 qemu_running = 1; 334 if (__system_property_get("ro.kernel.memcheck", memcheck_tracing)) { 335 if (memcheck_tracing[0] != '0') { 336 // Emulator has started with memory tracing enabled. Enforce it. 337 g_malloc_debug_level = 20; 338 memcheck_enabled = 1; 339 } 340 } 341 } 342 343 // If debug level has not been set by memcheck option in the emulator, 344 // lets grab it from libc.debug.malloc system property. 345 if (g_malloc_debug_level == 0 && __system_property_get("libc.debug.malloc", env)) { 346 g_malloc_debug_level = atoi(env); 347 } 348 349 // Debug level 0 means that we should use default allocation routines. 350 if (g_malloc_debug_level == 0) { 351 return; 352 } 353 354 // If libc.debug.malloc.program is set and is not a substring of progname, 355 // then exit. 356 if (__system_property_get("libc.debug.malloc.program", debug_program)) { 357 if (!strstr(getprogname(), debug_program)) { 358 return; 359 } 360 } 361 362 // mksh is way too leaky. http://b/7291287. 363 if (g_malloc_debug_level >= 10) { 364 if (strcmp(getprogname(), "sh") == 0 || strcmp(getprogname(), "/system/bin/sh") == 0) { 365 return; 366 } 367 } 368 369 // Choose the appropriate .so for the requested debug level. 370 switch (g_malloc_debug_level) { 371 case 1: 372 case 5: 373 case 10: 374 so_name = "libc_malloc_debug_leak.so"; 375 break; 376 case 20: 377 // Quick check: debug level 20 can only be handled in emulator. 378 if (!qemu_running) { 379 error_log("%s: Debug level %d can only be set in emulator\n", 380 getprogname(), g_malloc_debug_level); 381 return; 382 } 383 // Make sure that memory checking has been enabled in emulator. 384 if (!memcheck_enabled) { 385 error_log("%s: Memory checking is not enabled in the emulator\n", getprogname()); 386 return; 387 } 388 so_name = "libc_malloc_debug_qemu.so"; 389 break; 390 default: 391 error_log("%s: Debug level %d is unknown\n", getprogname(), g_malloc_debug_level); 392 return; 393 } 394 395 // Load .so that implements the required malloc debugging functionality. 396 void* malloc_impl_handle = dlopen(so_name, RTLD_LAZY); 397 if (malloc_impl_handle == NULL) { 398 error_log("%s: Missing module %s required for malloc debug level %d: %s", 399 getprogname(), so_name, g_malloc_debug_level, dlerror()); 400 return; 401 } 402 403 // Initialize malloc debugging in the loaded module. 404 malloc_debug_initialize = reinterpret_cast<MallocDebugInit>(dlsym(malloc_impl_handle, 405 "malloc_debug_initialize")); 406 if (malloc_debug_initialize == NULL) { 407 error_log("%s: Initialization routine is not found in %s\n", getprogname(), so_name); 408 dlclose(malloc_impl_handle); 409 return; 410 } 411 if (malloc_debug_initialize(&g_hash_table) == -1) { 412 dlclose(malloc_impl_handle); 413 return; 414 } 415 416 if (g_malloc_debug_level == 20) { 417 // For memory checker we need to do extra initialization. 418 typedef int (*MemCheckInit)(int, const char*); 419 MemCheckInit memcheck_initialize = 420 reinterpret_cast<MemCheckInit>(dlsym(malloc_impl_handle, "memcheck_initialize")); 421 if (memcheck_initialize == NULL) { 422 error_log("%s: memcheck_initialize routine is not found in %s\n", 423 getprogname(), so_name); 424 dlclose(malloc_impl_handle); 425 return; 426 } 427 428 if (memcheck_initialize(MALLOC_ALIGNMENT, memcheck_tracing)) { 429 dlclose(malloc_impl_handle); 430 return; 431 } 432 } 433 434 // No need to init the dispatch table because we can only get 435 // here if debug level is 1, 5, 10, or 20. 436 static MallocDebug malloc_dispatch_table __attribute__((aligned(32))); 437 switch (g_malloc_debug_level) { 438 case 1: 439 InitMalloc(malloc_impl_handle, &malloc_dispatch_table, "leak"); 440 break; 441 case 5: 442 InitMalloc(malloc_impl_handle, &malloc_dispatch_table, "fill"); 443 break; 444 case 10: 445 InitMalloc(malloc_impl_handle, &malloc_dispatch_table, "chk"); 446 break; 447 case 20: 448 InitMalloc(malloc_impl_handle, &malloc_dispatch_table, "qemu_instrumented"); 449 break; 450 default: 451 break; 452 } 453 454 // Make sure dispatch table is initialized 455 if ((malloc_dispatch_table.calloc == NULL) || 456 (malloc_dispatch_table.free == NULL) || 457 (malloc_dispatch_table.mallinfo == NULL) || 458 (malloc_dispatch_table.malloc == NULL) || 459 (malloc_dispatch_table.malloc_usable_size == NULL) || 460 (malloc_dispatch_table.memalign == NULL) || 461 (malloc_dispatch_table.posix_memalign == NULL) || 462#if defined(HAVE_DEPRECATED_MALLOC_FUNCS) 463 (malloc_dispatch_table.pvalloc == NULL) || 464#endif 465 (malloc_dispatch_table.realloc == NULL) 466#if defined(HAVE_DEPRECATED_MALLOC_FUNCS) 467 || (malloc_dispatch_table.valloc == NULL) 468#endif 469 ) { 470 error_log("%s: some symbols for libc.debug.malloc level %d were not found (see above)", 471 getprogname(), g_malloc_debug_level); 472 dlclose(malloc_impl_handle); 473 } else { 474 __libc_malloc_dispatch = &malloc_dispatch_table; 475 libc_malloc_impl_handle = malloc_impl_handle; 476 } 477} 478 479static void malloc_fini_impl() { 480 // Our BSD stdio implementation doesn't close the standard streams, it only flushes them. 481 // And it doesn't do that until its atexit handler is run, and we run first! 482 // It's great that other unclosed FILE*s show up as malloc leaks, but we need to manually 483 // clean up the standard streams ourselves. 484 fclose(stdin); 485 fclose(stdout); 486 fclose(stderr); 487 488 if (libc_malloc_impl_handle != NULL) { 489 MallocDebugFini malloc_debug_finalize = 490 reinterpret_cast<MallocDebugFini>(dlsym(libc_malloc_impl_handle, "malloc_debug_finalize")); 491 if (malloc_debug_finalize != NULL) { 492 malloc_debug_finalize(g_malloc_debug_level); 493 } 494 } 495} 496 497#endif // !LIBC_STATIC 498 499// Initializes memory allocation framework. 500// This routine is called from __libc_init routines implemented 501// in libc_init_static.c and libc_init_dynamic.c files. 502extern "C" __LIBC_HIDDEN__ void malloc_debug_init() { 503#if !defined(LIBC_STATIC) 504 static pthread_once_t malloc_init_once_ctl = PTHREAD_ONCE_INIT; 505 if (pthread_once(&malloc_init_once_ctl, malloc_init_impl)) { 506 error_log("Unable to initialize malloc_debug component."); 507 } 508#endif // !LIBC_STATIC 509} 510 511extern "C" __LIBC_HIDDEN__ void malloc_debug_fini() { 512#if !defined(LIBC_STATIC) 513 static pthread_once_t malloc_fini_once_ctl = PTHREAD_ONCE_INIT; 514 if (pthread_once(&malloc_fini_once_ctl, malloc_fini_impl)) { 515 error_log("Unable to finalize malloc_debug component."); 516 } 517#endif // !LIBC_STATIC 518} 519