1/* 2 * Copyright (C) 2009 The Android Open Source Project 3 * All rights reserved. 4 * 5 * Redistribution and use in source and binary forms, with or without 6 * modification, are permitted provided that the following conditions 7 * are met: 8 * * Redistributions of source code must retain the above copyright 9 * notice, this list of conditions and the following disclaimer. 10 * * Redistributions in binary form must reproduce the above copyright 11 * notice, this list of conditions and the following disclaimer in 12 * the documentation and/or other materials provided with the 13 * distribution. 14 * 15 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 16 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT 17 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS 18 * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE 19 * COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, 20 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, 21 * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS 22 * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED 23 * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, 24 * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT 25 * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 26 * SUCH DAMAGE. 27 */ 28 29/* 30 * Contains definition of structures, global variables, and implementation of 31 * routines that are used by malloc leak detection code and other components in 32 * the system. The trick is that some components expect these data and 33 * routines to be defined / implemented in libc.so library, regardless 34 * whether or not MALLOC_LEAK_CHECK macro is defined. To make things even 35 * more tricky, malloc leak detection code, implemented in 36 * libc_malloc_debug.so also requires access to these variables and routines 37 * (to fill allocation entry hash table, for example). So, all relevant 38 * variables and routines are defined / implemented here and exported 39 * to all, leak detection code and other components via dynamic (libc.so), 40 * or static (libc.a) linking. 41 */ 42 43#include <stdlib.h> 44#include <pthread.h> 45#include <unistd.h> 46#include "dlmalloc.h" 47#include "malloc_debug_common.h" 48 49/* 50 * In a VM process, this is set to 1 after fork()ing out of zygote. 51 */ 52int gMallocLeakZygoteChild = 0; 53 54pthread_mutex_t gAllocationsMutex = PTHREAD_MUTEX_INITIALIZER; 55HashTable gHashTable; 56 57// ============================================================================= 58// output functions 59// ============================================================================= 60 61static int hash_entry_compare(const void* arg1, const void* arg2) { 62 int result; 63 64 const HashEntry* e1 = *static_cast<HashEntry* const*>(arg1); 65 const HashEntry* e2 = *static_cast<HashEntry* const*>(arg2); 66 67 // if one or both arg pointers are null, deal gracefully 68 if (e1 == NULL) { 69 result = (e2 == NULL) ? 0 : 1; 70 } else if (e2 == NULL) { 71 result = -1; 72 } else { 73 size_t nbAlloc1 = e1->allocations; 74 size_t nbAlloc2 = e2->allocations; 75 size_t size1 = e1->size & ~SIZE_FLAG_MASK; 76 size_t size2 = e2->size & ~SIZE_FLAG_MASK; 77 size_t alloc1 = nbAlloc1 * size1; 78 size_t alloc2 = nbAlloc2 * size2; 79 80 // sort in descending order by: 81 // 1) total size 82 // 2) number of allocations 83 // 84 // This is used for sorting, not determination of equality, so we don't 85 // need to compare the bit flags. 86 if (alloc1 > alloc2) { 87 result = -1; 88 } else if (alloc1 < alloc2) { 89 result = 1; 90 } else { 91 if (nbAlloc1 > nbAlloc2) { 92 result = -1; 93 } else if (nbAlloc1 < nbAlloc2) { 94 result = 1; 95 } else { 96 result = 0; 97 } 98 } 99 } 100 return result; 101} 102 103/* 104 * Retrieve native heap information. 105 * 106 * "*info" is set to a buffer we allocate 107 * "*overallSize" is set to the size of the "info" buffer 108 * "*infoSize" is set to the size of a single entry 109 * "*totalMemory" is set to the sum of all allocations we're tracking; does 110 * not include heap overhead 111 * "*backtraceSize" is set to the maximum number of entries in the back trace 112 */ 113extern "C" void get_malloc_leak_info(uint8_t** info, size_t* overallSize, 114 size_t* infoSize, size_t* totalMemory, size_t* backtraceSize) { 115 // don't do anything if we have invalid arguments 116 if (info == NULL || overallSize == NULL || infoSize == NULL || 117 totalMemory == NULL || backtraceSize == NULL) { 118 return; 119 } 120 *totalMemory = 0; 121 122 ScopedPthreadMutexLocker locker(&gAllocationsMutex); 123 124 if (gHashTable.count == 0) { 125 *info = NULL; 126 *overallSize = 0; 127 *infoSize = 0; 128 *backtraceSize = 0; 129 return; 130 } 131 132 HashEntry** list = static_cast<HashEntry**>(dlmalloc(sizeof(void*) * gHashTable.count)); 133 134 // get the entries into an array to be sorted 135 int index = 0; 136 for (size_t i = 0 ; i < HASHTABLE_SIZE ; ++i) { 137 HashEntry* entry = gHashTable.slots[i]; 138 while (entry != NULL) { 139 list[index] = entry; 140 *totalMemory = *totalMemory + 141 ((entry->size & ~SIZE_FLAG_MASK) * entry->allocations); 142 index++; 143 entry = entry->next; 144 } 145 } 146 147 // XXX: the protocol doesn't allow variable size for the stack trace (yet) 148 *infoSize = (sizeof(size_t) * 2) + (sizeof(intptr_t) * BACKTRACE_SIZE); 149 *overallSize = *infoSize * gHashTable.count; 150 *backtraceSize = BACKTRACE_SIZE; 151 152 // now get a byte array big enough for this 153 *info = static_cast<uint8_t*>(dlmalloc(*overallSize)); 154 155 if (*info == NULL) { 156 *overallSize = 0; 157 dlfree(list); 158 return; 159 } 160 161 qsort(list, gHashTable.count, sizeof(void*), hash_entry_compare); 162 163 uint8_t* head = *info; 164 const int count = gHashTable.count; 165 for (int i = 0 ; i < count ; ++i) { 166 HashEntry* entry = list[i]; 167 size_t entrySize = (sizeof(size_t) * 2) + (sizeof(intptr_t) * entry->numEntries); 168 if (entrySize < *infoSize) { 169 /* we're writing less than a full entry, clear out the rest */ 170 memset(head + entrySize, 0, *infoSize - entrySize); 171 } else { 172 /* make sure the amount we're copying doesn't exceed the limit */ 173 entrySize = *infoSize; 174 } 175 memcpy(head, &(entry->size), entrySize); 176 head += *infoSize; 177 } 178 179 dlfree(list); 180} 181 182extern "C" void free_malloc_leak_info(uint8_t* info) { 183 dlfree(info); 184} 185 186extern "C" struct mallinfo mallinfo() { 187 return dlmallinfo(); 188} 189 190extern "C" size_t malloc_usable_size(void* mem) { 191 return dlmalloc_usable_size(mem); 192} 193 194extern "C" void* valloc(size_t bytes) { 195 return dlvalloc(bytes); 196} 197 198extern "C" void* pvalloc(size_t bytes) { 199 return dlpvalloc(bytes); 200} 201 202extern "C" int posix_memalign(void** memptr, size_t alignment, size_t size) { 203 return dlposix_memalign(memptr, alignment, size); 204} 205 206/* Support for malloc debugging. 207 * Note that if USE_DL_PREFIX is not defined, it's assumed that memory 208 * allocation routines are implemented somewhere else, so all our custom 209 * malloc routines should not be compiled at all. 210 */ 211#ifdef USE_DL_PREFIX 212 213/* Table for dispatching malloc calls, initialized with default dispatchers. */ 214extern const MallocDebug __libc_malloc_default_dispatch; 215const MallocDebug __libc_malloc_default_dispatch __attribute__((aligned(32))) = { 216 dlmalloc, dlfree, dlcalloc, dlrealloc, dlmemalign 217}; 218 219/* Selector of dispatch table to use for dispatching malloc calls. */ 220const MallocDebug* __libc_malloc_dispatch = &__libc_malloc_default_dispatch; 221 222extern "C" void* malloc(size_t bytes) { 223 return __libc_malloc_dispatch->malloc(bytes); 224} 225 226extern "C" void free(void* mem) { 227 __libc_malloc_dispatch->free(mem); 228} 229 230extern "C" void* calloc(size_t n_elements, size_t elem_size) { 231 return __libc_malloc_dispatch->calloc(n_elements, elem_size); 232} 233 234extern "C" void* realloc(void* oldMem, size_t bytes) { 235 return __libc_malloc_dispatch->realloc(oldMem, bytes); 236} 237 238extern "C" void* memalign(size_t alignment, size_t bytes) { 239 return __libc_malloc_dispatch->memalign(alignment, bytes); 240} 241 242/* We implement malloc debugging only in libc.so, so code bellow 243 * must be excluded if we compile this file for static libc.a 244 */ 245#ifndef LIBC_STATIC 246#include <sys/system_properties.h> 247#include <dlfcn.h> 248#include <stdio.h> 249#include "logd.h" 250 251/* Table for dispatching malloc calls, depending on environment. */ 252static MallocDebug gMallocUse __attribute__((aligned(32))) = { 253 dlmalloc, dlfree, dlcalloc, dlrealloc, dlmemalign 254}; 255 256extern char* __progname; 257 258/* Handle to shared library where actual memory allocation is implemented. 259 * This library is loaded and memory allocation calls are redirected there 260 * when libc.debug.malloc environment variable contains value other than 261 * zero: 262 * 1 - For memory leak detections. 263 * 5 - For filling allocated / freed memory with patterns defined by 264 * CHK_SENTINEL_VALUE, and CHK_FILL_FREE macros. 265 * 10 - For adding pre-, and post- allocation stubs in order to detect 266 * buffer overruns. 267 * Note that emulator's memory allocation instrumentation is not controlled by 268 * libc.debug.malloc value, but rather by emulator, started with -memcheck 269 * option. Note also, that if emulator has started with -memcheck option, 270 * emulator's instrumented memory allocation will take over value saved in 271 * libc.debug.malloc. In other words, if emulator has started with -memcheck 272 * option, libc.debug.malloc value is ignored. 273 * Actual functionality for debug levels 1-10 is implemented in 274 * libc_malloc_debug_leak.so, while functionality for emultor's instrumented 275 * allocations is implemented in libc_malloc_debug_qemu.so and can be run inside 276 * the emulator only. 277 */ 278static void* libc_malloc_impl_handle = NULL; 279 280/* Make sure we have MALLOC_ALIGNMENT that matches the one that is 281 * used in dlmalloc. Emulator's memchecker needs this value to properly 282 * align its guarding zones. 283 */ 284#ifndef MALLOC_ALIGNMENT 285#define MALLOC_ALIGNMENT ((size_t)8U) 286#endif /* MALLOC_ALIGNMENT */ 287 288/* This variable is set to the value of property libc.debug.malloc.backlog, 289 * when the value of libc.debug.malloc = 10. It determines the size of the 290 * backlog we use to detect multiple frees. If the property is not set, the 291 * backlog length defaults to an internal constant defined in 292 * malloc_debug_check.cpp. 293 */ 294unsigned int malloc_double_free_backlog; 295 296static void InitMalloc(MallocDebug* table, int debug_level, const char* prefix) { 297 __libc_android_log_print(ANDROID_LOG_INFO, "libc", "%s: using libc.debug.malloc %d (%s)\n", 298 __progname, debug_level, prefix); 299 300 char symbol[128]; 301 302 snprintf(symbol, sizeof(symbol), "%s_malloc", prefix); 303 table->malloc = reinterpret_cast<MallocDebugMalloc>(dlsym(libc_malloc_impl_handle, symbol)); 304 if (table->malloc == NULL) { 305 error_log("%s: dlsym(\"%s\") failed", __progname, symbol); 306 } 307 308 snprintf(symbol, sizeof(symbol), "%s_free", prefix); 309 table->free = reinterpret_cast<MallocDebugFree>(dlsym(libc_malloc_impl_handle, symbol)); 310 if (table->free == NULL) { 311 error_log("%s: dlsym(\"%s\") failed", __progname, symbol); 312 } 313 314 snprintf(symbol, sizeof(symbol), "%s_calloc", prefix); 315 table->calloc = reinterpret_cast<MallocDebugCalloc>(dlsym(libc_malloc_impl_handle, symbol)); 316 if (table->calloc == NULL) { 317 error_log("%s: dlsym(\"%s\") failed", __progname, symbol); 318 } 319 320 snprintf(symbol, sizeof(symbol), "%s_realloc", prefix); 321 table->realloc = reinterpret_cast<MallocDebugRealloc>(dlsym(libc_malloc_impl_handle, symbol)); 322 if (table->realloc == NULL) { 323 error_log("%s: dlsym(\"%s\") failed", __progname, symbol); 324 } 325 326 snprintf(symbol, sizeof(symbol), "%s_memalign", prefix); 327 table->memalign = reinterpret_cast<MallocDebugMemalign>(dlsym(libc_malloc_impl_handle, symbol)); 328 if (table->memalign == NULL) { 329 error_log("%s: dlsym(\"%s\") failed", __progname, symbol); 330 } 331} 332 333/* Initializes memory allocation framework once per process. */ 334static void malloc_init_impl() { 335 const char* so_name = NULL; 336 MallocDebugInit malloc_debug_initialize = NULL; 337 unsigned int qemu_running = 0; 338 unsigned int debug_level = 0; 339 unsigned int memcheck_enabled = 0; 340 char env[PROP_VALUE_MAX]; 341 char memcheck_tracing[PROP_VALUE_MAX]; 342 char debug_program[PROP_VALUE_MAX]; 343 344 /* Get custom malloc debug level. Note that emulator started with 345 * memory checking option will have priority over debug level set in 346 * libc.debug.malloc system property. */ 347 if (__system_property_get("ro.kernel.qemu", env) && atoi(env)) { 348 qemu_running = 1; 349 if (__system_property_get("ro.kernel.memcheck", memcheck_tracing)) { 350 if (memcheck_tracing[0] != '0') { 351 // Emulator has started with memory tracing enabled. Enforce it. 352 debug_level = 20; 353 memcheck_enabled = 1; 354 } 355 } 356 } 357 358 /* If debug level has not been set by memcheck option in the emulator, 359 * lets grab it from libc.debug.malloc system property. */ 360 if (debug_level == 0 && __system_property_get("libc.debug.malloc", env)) { 361 debug_level = atoi(env); 362 } 363 364 /* Debug level 0 means that we should use dlxxx allocation 365 * routines (default). */ 366 if (debug_level == 0) { 367 return; 368 } 369 370 /* If libc.debug.malloc.program is set and is not a substring of progname, 371 * then exit. 372 */ 373 if (__system_property_get("libc.debug.malloc.program", debug_program)) { 374 if (!strstr(__progname, debug_program)) { 375 return; 376 } 377 } 378 379 // Lets see which .so must be loaded for the requested debug level 380 switch (debug_level) { 381 case 1: 382 case 5: 383 case 10: { 384 char debug_backlog[PROP_VALUE_MAX]; 385 if (__system_property_get("libc.debug.malloc.backlog", debug_backlog)) { 386 malloc_double_free_backlog = atoi(debug_backlog); 387 info_log("%s: setting backlog length to %d\n", 388 __progname, malloc_double_free_backlog); 389 } 390 391 so_name = "/system/lib/libc_malloc_debug_leak.so"; 392 break; 393 } 394 case 20: 395 // Quick check: debug level 20 can only be handled in emulator. 396 if (!qemu_running) { 397 error_log("%s: Debug level %d can only be set in emulator\n", 398 __progname, debug_level); 399 return; 400 } 401 // Make sure that memory checking has been enabled in emulator. 402 if (!memcheck_enabled) { 403 error_log("%s: Memory checking is not enabled in the emulator\n", 404 __progname); 405 return; 406 } 407 so_name = "/system/lib/libc_malloc_debug_qemu.so"; 408 break; 409 default: 410 error_log("%s: Debug level %d is unknown\n", 411 __progname, debug_level); 412 return; 413 } 414 415 // Load .so that implements the required malloc debugging functionality. 416 libc_malloc_impl_handle = dlopen(so_name, RTLD_LAZY); 417 if (libc_malloc_impl_handle == NULL) { 418 error_log("%s: Missing module %s required for malloc debug level %d: %s", 419 __progname, so_name, debug_level, dlerror()); 420 return; 421 } 422 423 // Initialize malloc debugging in the loaded module. 424 malloc_debug_initialize = reinterpret_cast<MallocDebugInit>(dlsym(libc_malloc_impl_handle, 425 "malloc_debug_initialize")); 426 if (malloc_debug_initialize == NULL) { 427 error_log("%s: Initialization routine is not found in %s\n", 428 __progname, so_name); 429 dlclose(libc_malloc_impl_handle); 430 return; 431 } 432 if (malloc_debug_initialize()) { 433 dlclose(libc_malloc_impl_handle); 434 return; 435 } 436 437 if (debug_level == 20) { 438 // For memory checker we need to do extra initialization. 439 typedef int (*MemCheckInit)(int, const char*); 440 MemCheckInit memcheck_initialize = 441 reinterpret_cast<MemCheckInit>(dlsym(libc_malloc_impl_handle, 442 "memcheck_initialize")); 443 if (memcheck_initialize == NULL) { 444 error_log("%s: memcheck_initialize routine is not found in %s\n", 445 __progname, so_name); 446 dlclose(libc_malloc_impl_handle); 447 return; 448 } 449 if (memcheck_initialize(MALLOC_ALIGNMENT, memcheck_tracing)) { 450 dlclose(libc_malloc_impl_handle); 451 return; 452 } 453 } 454 455 // Initialize malloc dispatch table with appropriate routines. 456 switch (debug_level) { 457 case 1: 458 InitMalloc(&gMallocUse, debug_level, "leak"); 459 break; 460 case 5: 461 InitMalloc(&gMallocUse, debug_level, "fill"); 462 break; 463 case 10: 464 InitMalloc(&gMallocUse, debug_level, "chk"); 465 break; 466 case 20: 467 InitMalloc(&gMallocUse, debug_level, "qemu_instrumented"); 468 break; 469 default: 470 break; 471 } 472 473 // Make sure dispatch table is initialized 474 if ((gMallocUse.malloc == NULL) || 475 (gMallocUse.free == NULL) || 476 (gMallocUse.calloc == NULL) || 477 (gMallocUse.realloc == NULL) || 478 (gMallocUse.memalign == NULL)) { 479 error_log("%s: some symbols for libc.debug.malloc level %d were not found (see above)", 480 __progname, debug_level); 481 dlclose(libc_malloc_impl_handle); 482 libc_malloc_impl_handle = NULL; 483 } else { 484 __libc_malloc_dispatch = &gMallocUse; 485 } 486} 487 488static void malloc_fini_impl() { 489 if (libc_malloc_impl_handle) { 490 MallocDebugFini malloc_debug_finalize = 491 reinterpret_cast<MallocDebugFini>(dlsym(libc_malloc_impl_handle, 492 "malloc_debug_finalize")); 493 if (malloc_debug_finalize) { 494 malloc_debug_finalize(); 495 } 496 } 497} 498 499static pthread_once_t malloc_init_once_ctl = PTHREAD_ONCE_INIT; 500static pthread_once_t malloc_fini_once_ctl = PTHREAD_ONCE_INIT; 501 502#endif // !LIBC_STATIC 503#endif // USE_DL_PREFIX 504 505/* Initializes memory allocation framework. 506 * This routine is called from __libc_init routines implemented 507 * in libc_init_static.c and libc_init_dynamic.c files. 508 */ 509extern "C" void malloc_debug_init() { 510 /* We need to initialize malloc iff we implement here custom 511 * malloc routines (i.e. USE_DL_PREFIX is defined) for libc.so */ 512#if defined(USE_DL_PREFIX) && !defined(LIBC_STATIC) 513 if (pthread_once(&malloc_init_once_ctl, malloc_init_impl)) { 514 error_log("Unable to initialize malloc_debug component."); 515 } 516#endif // USE_DL_PREFIX && !LIBC_STATIC 517} 518 519extern "C" void malloc_debug_fini() { 520 /* We need to finalize malloc iff we implement here custom 521 * malloc routines (i.e. USE_DL_PREFIX is defined) for libc.so */ 522#if defined(USE_DL_PREFIX) && !defined(LIBC_STATIC) 523 if (pthread_once(&malloc_fini_once_ctl, malloc_fini_impl)) { 524 error_log("Unable to finalize malloc_debug component."); 525 } 526#endif // USE_DL_PREFIX && !LIBC_STATIC 527} 528