1/*
2 * Copyright (C) 2009 The Android Open Source Project
3 * All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
7 * are met:
8 *  * Redistributions of source code must retain the above copyright
9 *    notice, this list of conditions and the following disclaimer.
10 *  * Redistributions in binary form must reproduce the above copyright
11 *    notice, this list of conditions and the following disclaimer in
12 *    the documentation and/or other materials provided with the
13 *    distribution.
14 *
15 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
16 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
17 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
18 * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
19 * COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
20 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
21 * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
22 * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
23 * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
24 * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
25 * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
26 * SUCH DAMAGE.
27 */
28
29// Contains definition of structures, global variables, and implementation of
30// routines that are used by malloc leak detection code and other components in
31// the system. The trick is that some components expect these data and
32// routines to be defined / implemented in libc.so, regardless whether or not
33// malloc leak detection code is going to run. To make things even more tricky,
34// malloc leak detection code, implemented in libc_malloc_debug.so also
35// requires access to these variables and routines (to fill allocation entry
36// hash table, for example). So, all relevant variables and routines are
37// defined / implemented here and exported to all, leak detection code and
38// other components via dynamic (libc.so), or static (libc.a) linking.
39
40#include "malloc_debug_common.h"
41
42#include <pthread.h>
43#include <stdlib.h>
44#include <string.h>
45#include <unistd.h>
46
47#include "private/ScopedPthreadMutexLocker.h"
48
49#if defined(USE_JEMALLOC)
50#include "jemalloc.h"
51#define Malloc(function)  je_ ## function
52#elif defined(USE_DLMALLOC)
53#include "dlmalloc.h"
54#define Malloc(function)  dl ## function
55#else
56#error "Either one of USE_DLMALLOC or USE_JEMALLOC must be defined."
57#endif
58
59// In a VM process, this is set to 1 after fork()ing out of zygote.
60int gMallocLeakZygoteChild = 0;
61
62static HashTable g_hash_table;
63
64// Support for malloc debugging.
65// Table for dispatching malloc calls, initialized with default dispatchers.
66static const MallocDebug __libc_malloc_default_dispatch __attribute__((aligned(32))) = {
67  Malloc(calloc),
68  Malloc(free),
69  Malloc(mallinfo),
70  Malloc(malloc),
71  Malloc(malloc_usable_size),
72  Malloc(memalign),
73  Malloc(posix_memalign),
74#if defined(HAVE_DEPRECATED_MALLOC_FUNCS)
75  Malloc(pvalloc),
76#endif
77  Malloc(realloc),
78#if defined(HAVE_DEPRECATED_MALLOC_FUNCS)
79  Malloc(valloc),
80#endif
81};
82
83// Selector of dispatch table to use for dispatching malloc calls.
84static const MallocDebug* __libc_malloc_dispatch = &__libc_malloc_default_dispatch;
85
86// Handle to shared library where actual memory allocation is implemented.
87// This library is loaded and memory allocation calls are redirected there
88// when libc.debug.malloc environment variable contains value other than
89// zero:
90// 1  - For memory leak detections.
91// 5  - For filling allocated / freed memory with patterns defined by
92//      CHK_SENTINEL_VALUE, and CHK_FILL_FREE macros.
93// 10 - For adding pre-, and post- allocation stubs in order to detect
94//      buffer overruns.
95// Note that emulator's memory allocation instrumentation is not controlled by
96// libc.debug.malloc value, but rather by emulator, started with -memcheck
97// option. Note also, that if emulator has started with -memcheck option,
98// emulator's instrumented memory allocation will take over value saved in
99// libc.debug.malloc. In other words, if emulator has started with -memcheck
100// option, libc.debug.malloc value is ignored.
101// Actual functionality for debug levels 1-10 is implemented in
102// libc_malloc_debug_leak.so, while functionality for emulator's instrumented
103// allocations is implemented in libc_malloc_debug_qemu.so and can be run inside
104// the emulator only.
105#if !defined(LIBC_STATIC)
106static void* libc_malloc_impl_handle = NULL;
107#endif
108
109
110// The value of libc.debug.malloc.
111#if !defined(LIBC_STATIC)
112static int g_malloc_debug_level = 0;
113#endif
114
115// =============================================================================
116// output functions
117// =============================================================================
118
119static int hash_entry_compare(const void* arg1, const void* arg2) {
120  int result;
121
122  const HashEntry* e1 = *static_cast<HashEntry* const*>(arg1);
123  const HashEntry* e2 = *static_cast<HashEntry* const*>(arg2);
124
125  // if one or both arg pointers are null, deal gracefully
126  if (e1 == NULL) {
127    result = (e2 == NULL) ? 0 : 1;
128  } else if (e2 == NULL) {
129    result = -1;
130  } else {
131    size_t nbAlloc1 = e1->allocations;
132    size_t nbAlloc2 = e2->allocations;
133    size_t size1 = e1->size & ~SIZE_FLAG_MASK;
134    size_t size2 = e2->size & ~SIZE_FLAG_MASK;
135    size_t alloc1 = nbAlloc1 * size1;
136    size_t alloc2 = nbAlloc2 * size2;
137
138    // sort in descending order by:
139    // 1) total size
140    // 2) number of allocations
141    //
142    // This is used for sorting, not determination of equality, so we don't
143    // need to compare the bit flags.
144    if (alloc1 > alloc2) {
145      result = -1;
146    } else if (alloc1 < alloc2) {
147      result = 1;
148    } else {
149      if (nbAlloc1 > nbAlloc2) {
150        result = -1;
151      } else if (nbAlloc1 < nbAlloc2) {
152        result = 1;
153      } else {
154        result = 0;
155      }
156    }
157  }
158  return result;
159}
160
161// Retrieve native heap information.
162//
163// "*info" is set to a buffer we allocate
164// "*overallSize" is set to the size of the "info" buffer
165// "*infoSize" is set to the size of a single entry
166// "*totalMemory" is set to the sum of all allocations we're tracking; does
167//   not include heap overhead
168// "*backtraceSize" is set to the maximum number of entries in the back trace
169
170// =============================================================================
171// Exported for use by ddms.
172// =============================================================================
173extern "C" void get_malloc_leak_info(uint8_t** info, size_t* overallSize,
174    size_t* infoSize, size_t* totalMemory, size_t* backtraceSize) {
175  // Don't do anything if we have invalid arguments.
176  if (info == NULL || overallSize == NULL || infoSize == NULL ||
177    totalMemory == NULL || backtraceSize == NULL) {
178    return;
179  }
180  *totalMemory = 0;
181
182  ScopedPthreadMutexLocker locker(&g_hash_table.lock);
183  if (g_hash_table.count == 0) {
184    *info = NULL;
185    *overallSize = 0;
186    *infoSize = 0;
187    *backtraceSize = 0;
188    return;
189  }
190
191  HashEntry** list = static_cast<HashEntry**>(Malloc(malloc)(sizeof(void*) * g_hash_table.count));
192
193  // Get the entries into an array to be sorted.
194  size_t index = 0;
195  for (size_t i = 0 ; i < HASHTABLE_SIZE ; ++i) {
196    HashEntry* entry = g_hash_table.slots[i];
197    while (entry != NULL) {
198      list[index] = entry;
199      *totalMemory = *totalMemory + ((entry->size & ~SIZE_FLAG_MASK) * entry->allocations);
200      index++;
201      entry = entry->next;
202    }
203  }
204
205  // XXX: the protocol doesn't allow variable size for the stack trace (yet)
206  *infoSize = (sizeof(size_t) * 2) + (sizeof(uintptr_t) * BACKTRACE_SIZE);
207  *overallSize = *infoSize * g_hash_table.count;
208  *backtraceSize = BACKTRACE_SIZE;
209
210  // now get a byte array big enough for this
211  *info = static_cast<uint8_t*>(Malloc(malloc)(*overallSize));
212  if (*info == NULL) {
213    *overallSize = 0;
214    Malloc(free)(list);
215    return;
216  }
217
218  qsort(list, g_hash_table.count, sizeof(void*), hash_entry_compare);
219
220  uint8_t* head = *info;
221  const size_t count = g_hash_table.count;
222  for (size_t i = 0 ; i < count ; ++i) {
223    HashEntry* entry = list[i];
224    size_t entrySize = (sizeof(size_t) * 2) + (sizeof(uintptr_t) * entry->numEntries);
225    if (entrySize < *infoSize) {
226      // We're writing less than a full entry, clear out the rest.
227      memset(head + entrySize, 0, *infoSize - entrySize);
228    } else {
229      // Make sure the amount we're copying doesn't exceed the limit.
230      entrySize = *infoSize;
231    }
232    memcpy(head, &(entry->size), entrySize);
233    head += *infoSize;
234  }
235
236  Malloc(free)(list);
237}
238
239extern "C" void free_malloc_leak_info(uint8_t* info) {
240  Malloc(free)(info);
241}
242
243// =============================================================================
244// Allocation functions
245// =============================================================================
246extern "C" void* calloc(size_t n_elements, size_t elem_size) {
247  return __libc_malloc_dispatch->calloc(n_elements, elem_size);
248}
249
250extern "C" void free(void* mem) {
251  __libc_malloc_dispatch->free(mem);
252}
253
254extern "C" struct mallinfo mallinfo() {
255  return __libc_malloc_dispatch->mallinfo();
256}
257
258extern "C" void* malloc(size_t bytes) {
259  return __libc_malloc_dispatch->malloc(bytes);
260}
261
262extern "C" size_t malloc_usable_size(const void* mem) {
263  return __libc_malloc_dispatch->malloc_usable_size(mem);
264}
265
266extern "C" void* memalign(size_t alignment, size_t bytes) {
267  return __libc_malloc_dispatch->memalign(alignment, bytes);
268}
269
270extern "C" int posix_memalign(void** memptr, size_t alignment, size_t size) {
271  return __libc_malloc_dispatch->posix_memalign(memptr, alignment, size);
272}
273
274#if defined(HAVE_DEPRECATED_MALLOC_FUNCS)
275extern "C" void* pvalloc(size_t bytes) {
276  return __libc_malloc_dispatch->pvalloc(bytes);
277}
278#endif
279
280extern "C" void* realloc(void* oldMem, size_t bytes) {
281  return __libc_malloc_dispatch->realloc(oldMem, bytes);
282}
283
284#if defined(HAVE_DEPRECATED_MALLOC_FUNCS)
285extern "C" void* valloc(size_t bytes) {
286  return __libc_malloc_dispatch->valloc(bytes);
287}
288#endif
289
290// We implement malloc debugging only in libc.so, so the code below
291// must be excluded if we compile this file for static libc.a
292#ifndef LIBC_STATIC
293#include <sys/system_properties.h>
294#include <dlfcn.h>
295#include <stdio.h>
296#include "private/libc_logging.h"
297
298template<typename FunctionType>
299static void InitMallocFunction(void* malloc_impl_handler, FunctionType* func, const char* prefix, const char* suffix) {
300  char symbol[128];
301  snprintf(symbol, sizeof(symbol), "%s_%s", prefix, suffix);
302  *func = reinterpret_cast<FunctionType>(dlsym(malloc_impl_handler, symbol));
303  if (*func == NULL) {
304    error_log("%s: dlsym(\"%s\") failed", getprogname(), symbol);
305  }
306}
307
308static void InitMalloc(void* malloc_impl_handler, MallocDebug* table, const char* prefix) {
309  __libc_format_log(ANDROID_LOG_INFO, "libc", "%s: using libc.debug.malloc %d (%s)\n",
310                    getprogname(), g_malloc_debug_level, prefix);
311
312  InitMallocFunction<MallocDebugCalloc>(malloc_impl_handler, &table->calloc, prefix, "calloc");
313  InitMallocFunction<MallocDebugFree>(malloc_impl_handler, &table->free, prefix, "free");
314  InitMallocFunction<MallocDebugMallinfo>(malloc_impl_handler, &table->mallinfo, prefix, "mallinfo");
315  InitMallocFunction<MallocDebugMalloc>(malloc_impl_handler, &table->malloc, prefix, "malloc");
316  InitMallocFunction<MallocDebugMallocUsableSize>(malloc_impl_handler, &table->malloc_usable_size, prefix, "malloc_usable_size");
317  InitMallocFunction<MallocDebugMemalign>(malloc_impl_handler, &table->memalign, prefix, "memalign");
318  InitMallocFunction<MallocDebugPosixMemalign>(malloc_impl_handler, &table->posix_memalign, prefix, "posix_memalign");
319#if defined(HAVE_DEPRECATED_MALLOC_FUNCS)
320  InitMallocFunction<MallocDebugPvalloc>(malloc_impl_handler, &table->pvalloc, prefix, "pvalloc");
321#endif
322  InitMallocFunction<MallocDebugRealloc>(malloc_impl_handler, &table->realloc, prefix, "realloc");
323#if defined(HAVE_DEPRECATED_MALLOC_FUNCS)
324  InitMallocFunction<MallocDebugValloc>(malloc_impl_handler, &table->valloc, prefix, "valloc");
325#endif
326}
327
328// Initializes memory allocation framework once per process.
329static void malloc_init_impl() {
330  const char* so_name = NULL;
331  MallocDebugInit malloc_debug_initialize = NULL;
332  unsigned int qemu_running = 0;
333  unsigned int memcheck_enabled = 0;
334  char env[PROP_VALUE_MAX];
335  char memcheck_tracing[PROP_VALUE_MAX];
336  char debug_program[PROP_VALUE_MAX];
337
338  // Get custom malloc debug level. Note that emulator started with
339  // memory checking option will have priority over debug level set in
340  // libc.debug.malloc system property.
341  if (__system_property_get("ro.kernel.qemu", env) && atoi(env)) {
342    qemu_running = 1;
343    if (__system_property_get("ro.kernel.memcheck", memcheck_tracing)) {
344      if (memcheck_tracing[0] != '0') {
345        // Emulator has started with memory tracing enabled. Enforce it.
346        g_malloc_debug_level = 20;
347        memcheck_enabled = 1;
348      }
349    }
350  }
351
352  // If debug level has not been set by memcheck option in the emulator,
353  // lets grab it from libc.debug.malloc system property.
354  if (g_malloc_debug_level == 0 && __system_property_get("libc.debug.malloc", env)) {
355    g_malloc_debug_level = atoi(env);
356  }
357
358  // Debug level 0 means that we should use default allocation routines.
359  if (g_malloc_debug_level == 0) {
360    return;
361  }
362
363  // If libc.debug.malloc.program is set and is not a substring of progname,
364  // then exit.
365  if (__system_property_get("libc.debug.malloc.program", debug_program)) {
366    if (!strstr(getprogname(), debug_program)) {
367      return;
368    }
369  }
370
371  // mksh is way too leaky. http://b/7291287.
372  if (g_malloc_debug_level >= 10) {
373    if (strcmp(getprogname(), "sh") == 0 || strcmp(getprogname(), "/system/bin/sh") == 0) {
374      return;
375    }
376  }
377
378  // Choose the appropriate .so for the requested debug level.
379  switch (g_malloc_debug_level) {
380    case 1:
381    case 5:
382    case 10:
383      so_name = "libc_malloc_debug_leak.so";
384      break;
385    case 20:
386      // Quick check: debug level 20 can only be handled in emulator.
387      if (!qemu_running) {
388        error_log("%s: Debug level %d can only be set in emulator\n",
389                  getprogname(), g_malloc_debug_level);
390        return;
391      }
392      // Make sure that memory checking has been enabled in emulator.
393      if (!memcheck_enabled) {
394        error_log("%s: Memory checking is not enabled in the emulator\n", getprogname());
395        return;
396      }
397      so_name = "libc_malloc_debug_qemu.so";
398      break;
399    default:
400      error_log("%s: Debug level %d is unknown\n", getprogname(), g_malloc_debug_level);
401      return;
402  }
403
404  // Load .so that implements the required malloc debugging functionality.
405  void* malloc_impl_handle = dlopen(so_name, RTLD_NOW);
406  if (malloc_impl_handle == NULL) {
407    error_log("%s: Missing module %s required for malloc debug level %d: %s",
408              getprogname(), so_name, g_malloc_debug_level, dlerror());
409    return;
410  }
411
412  // Initialize malloc debugging in the loaded module.
413  malloc_debug_initialize = reinterpret_cast<MallocDebugInit>(dlsym(malloc_impl_handle,
414                                                                    "malloc_debug_initialize"));
415  if (malloc_debug_initialize == NULL) {
416    error_log("%s: Initialization routine is not found in %s\n", getprogname(), so_name);
417    dlclose(malloc_impl_handle);
418    return;
419  }
420  if (!malloc_debug_initialize(&g_hash_table, &__libc_malloc_default_dispatch)) {
421    dlclose(malloc_impl_handle);
422    return;
423  }
424
425  if (g_malloc_debug_level == 20) {
426    // For memory checker we need to do extra initialization.
427    typedef int (*MemCheckInit)(int, const char*);
428    MemCheckInit memcheck_initialize =
429      reinterpret_cast<MemCheckInit>(dlsym(malloc_impl_handle, "memcheck_initialize"));
430    if (memcheck_initialize == NULL) {
431      error_log("%s: memcheck_initialize routine is not found in %s\n",
432                getprogname(), so_name);
433      dlclose(malloc_impl_handle);
434      return;
435    }
436
437    if (memcheck_initialize(MALLOC_ALIGNMENT, memcheck_tracing)) {
438      dlclose(malloc_impl_handle);
439      return;
440    }
441  }
442
443  // No need to init the dispatch table because we can only get
444  // here if debug level is 1, 5, 10, or 20.
445  static MallocDebug malloc_dispatch_table __attribute__((aligned(32)));
446  switch (g_malloc_debug_level) {
447    case 1:
448      InitMalloc(malloc_impl_handle, &malloc_dispatch_table, "leak");
449      break;
450    case 5:
451      InitMalloc(malloc_impl_handle, &malloc_dispatch_table, "fill");
452      break;
453    case 10:
454      InitMalloc(malloc_impl_handle, &malloc_dispatch_table, "chk");
455      break;
456    case 20:
457      InitMalloc(malloc_impl_handle, &malloc_dispatch_table, "qemu_instrumented");
458      break;
459    default:
460      break;
461  }
462
463  // Make sure dispatch table is initialized
464  if ((malloc_dispatch_table.calloc == NULL) ||
465      (malloc_dispatch_table.free == NULL) ||
466      (malloc_dispatch_table.mallinfo == NULL) ||
467      (malloc_dispatch_table.malloc == NULL) ||
468      (malloc_dispatch_table.malloc_usable_size == NULL) ||
469      (malloc_dispatch_table.memalign == NULL) ||
470      (malloc_dispatch_table.posix_memalign == NULL) ||
471#if defined(HAVE_DEPRECATED_MALLOC_FUNCS)
472      (malloc_dispatch_table.pvalloc == NULL) ||
473#endif
474      (malloc_dispatch_table.realloc == NULL)
475#if defined(HAVE_DEPRECATED_MALLOC_FUNCS)
476      || (malloc_dispatch_table.valloc == NULL)
477#endif
478      ) {
479    error_log("%s: some symbols for libc.debug.malloc level %d were not found (see above)",
480              getprogname(), g_malloc_debug_level);
481    dlclose(malloc_impl_handle);
482  } else {
483    __libc_malloc_dispatch = &malloc_dispatch_table;
484    libc_malloc_impl_handle = malloc_impl_handle;
485  }
486}
487
488static void malloc_fini_impl() {
489  // Our BSD stdio implementation doesn't close the standard streams, it only flushes them.
490  // And it doesn't do that until its atexit handler is run, and we run first!
491  // It's great that other unclosed FILE*s show up as malloc leaks, but we need to manually
492  // clean up the standard streams ourselves.
493  fclose(stdin);
494  fclose(stdout);
495  fclose(stderr);
496
497  if (libc_malloc_impl_handle != NULL) {
498    MallocDebugFini malloc_debug_finalize =
499      reinterpret_cast<MallocDebugFini>(dlsym(libc_malloc_impl_handle, "malloc_debug_finalize"));
500    if (malloc_debug_finalize != NULL) {
501      malloc_debug_finalize(g_malloc_debug_level);
502    }
503  }
504}
505
506#endif  // !LIBC_STATIC
507
508// Initializes memory allocation framework.
509// This routine is called from __libc_init routines implemented
510// in libc_init_static.c and libc_init_dynamic.c files.
511extern "C" __LIBC_HIDDEN__ void malloc_debug_init() {
512#if !defined(LIBC_STATIC)
513  static pthread_once_t malloc_init_once_ctl = PTHREAD_ONCE_INIT;
514  if (pthread_once(&malloc_init_once_ctl, malloc_init_impl)) {
515    error_log("Unable to initialize malloc_debug component.");
516  }
517#endif  // !LIBC_STATIC
518}
519
520extern "C" __LIBC_HIDDEN__ void malloc_debug_fini() {
521#if !defined(LIBC_STATIC)
522  static pthread_once_t malloc_fini_once_ctl = PTHREAD_ONCE_INIT;
523  if (pthread_once(&malloc_fini_once_ctl, malloc_fini_impl)) {
524    error_log("Unable to finalize malloc_debug component.");
525  }
526#endif  // !LIBC_STATIC
527}
528