1/*
2 * Copyright (C) 2009 The Android Open Source Project
3 * All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
7 * are met:
8 *  * Redistributions of source code must retain the above copyright
9 *    notice, this list of conditions and the following disclaimer.
10 *  * Redistributions in binary form must reproduce the above copyright
11 *    notice, this list of conditions and the following disclaimer in
12 *    the documentation and/or other materials provided with the
13 *    distribution.
14 *
15 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
16 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
17 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
18 * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
19 * COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
20 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
21 * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
22 * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
23 * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
24 * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
25 * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
26 * SUCH DAMAGE.
27 */
28
29/*
30 * Contains definition of structures, global variables, and implementation of
31 * routines that are used by malloc leak detection code and other components in
32 * the system. The trick is that some components expect these data and
33 * routines to be defined / implemented in libc.so library, regardless
34 * whether or not MALLOC_LEAK_CHECK macro is defined. To make things even
35 * more tricky, malloc leak detection code, implemented in
36 * libc_malloc_debug.so also requires access to these variables and routines
37 * (to fill allocation entry hash table, for example). So, all relevant
38 * variables and routines are defined / implemented here and exported
39 * to all, leak detection code and other components via dynamic (libc.so),
40 * or static (libc.a) linking.
41 */
42
43#include <stdlib.h>
44#include <pthread.h>
45#include <unistd.h>
46#include "dlmalloc.h"
47#include "malloc_debug_common.h"
48
49/*
50 * In a VM process, this is set to 1 after fork()ing out of zygote.
51 */
52int gMallocLeakZygoteChild = 0;
53
54pthread_mutex_t gAllocationsMutex = PTHREAD_MUTEX_INITIALIZER;
55HashTable gHashTable;
56
57// =============================================================================
58// output functions
59// =============================================================================
60
61static int hash_entry_compare(const void* arg1, const void* arg2) {
62    int result;
63
64    const HashEntry* e1 = *static_cast<HashEntry* const*>(arg1);
65    const HashEntry* e2 = *static_cast<HashEntry* const*>(arg2);
66
67    // if one or both arg pointers are null, deal gracefully
68    if (e1 == NULL) {
69        result = (e2 == NULL) ? 0 : 1;
70    } else if (e2 == NULL) {
71        result = -1;
72    } else {
73        size_t nbAlloc1 = e1->allocations;
74        size_t nbAlloc2 = e2->allocations;
75        size_t size1 = e1->size & ~SIZE_FLAG_MASK;
76        size_t size2 = e2->size & ~SIZE_FLAG_MASK;
77        size_t alloc1 = nbAlloc1 * size1;
78        size_t alloc2 = nbAlloc2 * size2;
79
80        // sort in descending order by:
81        // 1) total size
82        // 2) number of allocations
83        //
84        // This is used for sorting, not determination of equality, so we don't
85        // need to compare the bit flags.
86        if (alloc1 > alloc2) {
87            result = -1;
88        } else if (alloc1 < alloc2) {
89            result = 1;
90        } else {
91            if (nbAlloc1 > nbAlloc2) {
92                result = -1;
93            } else if (nbAlloc1 < nbAlloc2) {
94                result = 1;
95            } else {
96                result = 0;
97            }
98        }
99    }
100    return result;
101}
102
103/*
104 * Retrieve native heap information.
105 *
106 * "*info" is set to a buffer we allocate
107 * "*overallSize" is set to the size of the "info" buffer
108 * "*infoSize" is set to the size of a single entry
109 * "*totalMemory" is set to the sum of all allocations we're tracking; does
110 *   not include heap overhead
111 * "*backtraceSize" is set to the maximum number of entries in the back trace
112 */
113extern "C" void get_malloc_leak_info(uint8_t** info, size_t* overallSize,
114        size_t* infoSize, size_t* totalMemory, size_t* backtraceSize) {
115    // don't do anything if we have invalid arguments
116    if (info == NULL || overallSize == NULL || infoSize == NULL ||
117            totalMemory == NULL || backtraceSize == NULL) {
118        return;
119    }
120    *totalMemory = 0;
121
122    ScopedPthreadMutexLocker locker(&gAllocationsMutex);
123
124    if (gHashTable.count == 0) {
125        *info = NULL;
126        *overallSize = 0;
127        *infoSize = 0;
128        *backtraceSize = 0;
129        return;
130    }
131
132    HashEntry** list = static_cast<HashEntry**>(dlmalloc(sizeof(void*) * gHashTable.count));
133
134    // get the entries into an array to be sorted
135    int index = 0;
136    for (size_t i = 0 ; i < HASHTABLE_SIZE ; ++i) {
137        HashEntry* entry = gHashTable.slots[i];
138        while (entry != NULL) {
139            list[index] = entry;
140            *totalMemory = *totalMemory +
141                ((entry->size & ~SIZE_FLAG_MASK) * entry->allocations);
142            index++;
143            entry = entry->next;
144        }
145    }
146
147    // XXX: the protocol doesn't allow variable size for the stack trace (yet)
148    *infoSize = (sizeof(size_t) * 2) + (sizeof(intptr_t) * BACKTRACE_SIZE);
149    *overallSize = *infoSize * gHashTable.count;
150    *backtraceSize = BACKTRACE_SIZE;
151
152    // now get a byte array big enough for this
153    *info = static_cast<uint8_t*>(dlmalloc(*overallSize));
154
155    if (*info == NULL) {
156        *overallSize = 0;
157        dlfree(list);
158        return;
159    }
160
161    qsort(list, gHashTable.count, sizeof(void*), hash_entry_compare);
162
163    uint8_t* head = *info;
164    const int count = gHashTable.count;
165    for (int i = 0 ; i < count ; ++i) {
166        HashEntry* entry = list[i];
167        size_t entrySize = (sizeof(size_t) * 2) + (sizeof(intptr_t) * entry->numEntries);
168        if (entrySize < *infoSize) {
169            /* we're writing less than a full entry, clear out the rest */
170            memset(head + entrySize, 0, *infoSize - entrySize);
171        } else {
172            /* make sure the amount we're copying doesn't exceed the limit */
173            entrySize = *infoSize;
174        }
175        memcpy(head, &(entry->size), entrySize);
176        head += *infoSize;
177    }
178
179    dlfree(list);
180}
181
182extern "C" void free_malloc_leak_info(uint8_t* info) {
183    dlfree(info);
184}
185
186extern "C" struct mallinfo mallinfo() {
187    return dlmallinfo();
188}
189
190extern "C" size_t malloc_usable_size(void* mem) {
191    return dlmalloc_usable_size(mem);
192}
193
194extern "C" void* valloc(size_t bytes) {
195    return dlvalloc(bytes);
196}
197
198extern "C" void* pvalloc(size_t bytes) {
199    return dlpvalloc(bytes);
200}
201
202extern "C" int posix_memalign(void** memptr, size_t alignment, size_t size) {
203    return dlposix_memalign(memptr, alignment, size);
204}
205
206/* Support for malloc debugging.
207 * Note that if USE_DL_PREFIX is not defined, it's assumed that memory
208 * allocation routines are implemented somewhere else, so all our custom
209 * malloc routines should not be compiled at all.
210 */
211#ifdef USE_DL_PREFIX
212
213/* Table for dispatching malloc calls, initialized with default dispatchers. */
214extern const MallocDebug __libc_malloc_default_dispatch;
215const MallocDebug __libc_malloc_default_dispatch __attribute__((aligned(32))) = {
216    dlmalloc, dlfree, dlcalloc, dlrealloc, dlmemalign
217};
218
219/* Selector of dispatch table to use for dispatching malloc calls. */
220const MallocDebug* __libc_malloc_dispatch = &__libc_malloc_default_dispatch;
221
222extern "C" void* malloc(size_t bytes) {
223    return __libc_malloc_dispatch->malloc(bytes);
224}
225
226extern "C" void free(void* mem) {
227    __libc_malloc_dispatch->free(mem);
228}
229
230extern "C" void* calloc(size_t n_elements, size_t elem_size) {
231    return __libc_malloc_dispatch->calloc(n_elements, elem_size);
232}
233
234extern "C" void* realloc(void* oldMem, size_t bytes) {
235    return __libc_malloc_dispatch->realloc(oldMem, bytes);
236}
237
238extern "C" void* memalign(size_t alignment, size_t bytes) {
239    return __libc_malloc_dispatch->memalign(alignment, bytes);
240}
241
242/* We implement malloc debugging only in libc.so, so code bellow
243 * must be excluded if we compile this file for static libc.a
244 */
245#ifndef LIBC_STATIC
246#include <sys/system_properties.h>
247#include <dlfcn.h>
248#include <stdio.h>
249#include "logd.h"
250
251/* Table for dispatching malloc calls, depending on environment. */
252static MallocDebug gMallocUse __attribute__((aligned(32))) = {
253    dlmalloc, dlfree, dlcalloc, dlrealloc, dlmemalign
254};
255
256extern char* __progname;
257
258/* Handle to shared library where actual memory allocation is implemented.
259 * This library is loaded and memory allocation calls are redirected there
260 * when libc.debug.malloc environment variable contains value other than
261 * zero:
262 * 1  - For memory leak detections.
263 * 5  - For filling allocated / freed memory with patterns defined by
264 *      CHK_SENTINEL_VALUE, and CHK_FILL_FREE macros.
265 * 10 - For adding pre-, and post- allocation stubs in order to detect
266 *      buffer overruns.
267 * Note that emulator's memory allocation instrumentation is not controlled by
268 * libc.debug.malloc value, but rather by emulator, started with -memcheck
269 * option. Note also, that if emulator has started with -memcheck option,
270 * emulator's instrumented memory allocation will take over value saved in
271 * libc.debug.malloc. In other words, if emulator has started with -memcheck
272 * option, libc.debug.malloc value is ignored.
273 * Actual functionality for debug levels 1-10 is implemented in
274 * libc_malloc_debug_leak.so, while functionality for emultor's instrumented
275 * allocations is implemented in libc_malloc_debug_qemu.so and can be run inside
276  * the emulator only.
277 */
278static void* libc_malloc_impl_handle = NULL;
279
280/* Make sure we have MALLOC_ALIGNMENT that matches the one that is
281 * used in dlmalloc. Emulator's memchecker needs this value to properly
282 * align its guarding zones.
283 */
284#ifndef MALLOC_ALIGNMENT
285#define MALLOC_ALIGNMENT ((size_t)8U)
286#endif  /* MALLOC_ALIGNMENT */
287
288/* This variable is set to the value of property libc.debug.malloc.backlog,
289 * when the value of libc.debug.malloc = 10.  It determines the size of the
290 * backlog we use to detect multiple frees.  If the property is not set, the
291 * backlog length defaults to an internal constant defined in
292 * malloc_debug_check.cpp.
293 */
294unsigned int malloc_double_free_backlog;
295
296static void InitMalloc(MallocDebug* table, int debug_level, const char* prefix) {
297  __libc_android_log_print(ANDROID_LOG_INFO, "libc", "%s: using libc.debug.malloc %d (%s)\n",
298                           __progname, debug_level, prefix);
299
300  char symbol[128];
301
302  snprintf(symbol, sizeof(symbol), "%s_malloc", prefix);
303  table->malloc = reinterpret_cast<MallocDebugMalloc>(dlsym(libc_malloc_impl_handle, symbol));
304  if (table->malloc == NULL) {
305      error_log("%s: dlsym(\"%s\") failed", __progname, symbol);
306  }
307
308  snprintf(symbol, sizeof(symbol), "%s_free", prefix);
309  table->free = reinterpret_cast<MallocDebugFree>(dlsym(libc_malloc_impl_handle, symbol));
310  if (table->free == NULL) {
311      error_log("%s: dlsym(\"%s\") failed", __progname, symbol);
312  }
313
314  snprintf(symbol, sizeof(symbol), "%s_calloc", prefix);
315  table->calloc = reinterpret_cast<MallocDebugCalloc>(dlsym(libc_malloc_impl_handle, symbol));
316  if (table->calloc == NULL) {
317      error_log("%s: dlsym(\"%s\") failed", __progname, symbol);
318  }
319
320  snprintf(symbol, sizeof(symbol), "%s_realloc", prefix);
321  table->realloc = reinterpret_cast<MallocDebugRealloc>(dlsym(libc_malloc_impl_handle, symbol));
322  if (table->realloc == NULL) {
323      error_log("%s: dlsym(\"%s\") failed", __progname, symbol);
324  }
325
326  snprintf(symbol, sizeof(symbol), "%s_memalign", prefix);
327  table->memalign = reinterpret_cast<MallocDebugMemalign>(dlsym(libc_malloc_impl_handle, symbol));
328  if (table->memalign == NULL) {
329      error_log("%s: dlsym(\"%s\") failed", __progname, symbol);
330  }
331}
332
333/* Initializes memory allocation framework once per process. */
334static void malloc_init_impl() {
335    const char* so_name = NULL;
336    MallocDebugInit malloc_debug_initialize = NULL;
337    unsigned int qemu_running = 0;
338    unsigned int debug_level = 0;
339    unsigned int memcheck_enabled = 0;
340    char env[PROP_VALUE_MAX];
341    char memcheck_tracing[PROP_VALUE_MAX];
342    char debug_program[PROP_VALUE_MAX];
343
344    /* Get custom malloc debug level. Note that emulator started with
345     * memory checking option will have priority over debug level set in
346     * libc.debug.malloc system property. */
347    if (__system_property_get("ro.kernel.qemu", env) && atoi(env)) {
348        qemu_running = 1;
349        if (__system_property_get("ro.kernel.memcheck", memcheck_tracing)) {
350            if (memcheck_tracing[0] != '0') {
351                // Emulator has started with memory tracing enabled. Enforce it.
352                debug_level = 20;
353                memcheck_enabled = 1;
354            }
355        }
356    }
357
358    /* If debug level has not been set by memcheck option in the emulator,
359     * lets grab it from libc.debug.malloc system property. */
360    if (debug_level == 0 && __system_property_get("libc.debug.malloc", env)) {
361        debug_level = atoi(env);
362    }
363
364    /* Debug level 0 means that we should use dlxxx allocation
365     * routines (default). */
366    if (debug_level == 0) {
367        return;
368    }
369
370    /* If libc.debug.malloc.program is set and is not a substring of progname,
371     * then exit.
372     */
373    if (__system_property_get("libc.debug.malloc.program", debug_program)) {
374        if (!strstr(__progname, debug_program)) {
375            return;
376        }
377    }
378
379    // Lets see which .so must be loaded for the requested debug level
380    switch (debug_level) {
381        case 1:
382        case 5:
383        case 10: {
384            char debug_backlog[PROP_VALUE_MAX];
385            if (__system_property_get("libc.debug.malloc.backlog", debug_backlog)) {
386                malloc_double_free_backlog = atoi(debug_backlog);
387                info_log("%s: setting backlog length to %d\n",
388                         __progname, malloc_double_free_backlog);
389            }
390
391            so_name = "/system/lib/libc_malloc_debug_leak.so";
392            break;
393        }
394        case 20:
395            // Quick check: debug level 20 can only be handled in emulator.
396            if (!qemu_running) {
397                error_log("%s: Debug level %d can only be set in emulator\n",
398                          __progname, debug_level);
399                return;
400            }
401            // Make sure that memory checking has been enabled in emulator.
402            if (!memcheck_enabled) {
403                error_log("%s: Memory checking is not enabled in the emulator\n",
404                          __progname);
405                return;
406            }
407            so_name = "/system/lib/libc_malloc_debug_qemu.so";
408            break;
409        default:
410            error_log("%s: Debug level %d is unknown\n",
411                      __progname, debug_level);
412            return;
413    }
414
415    // Load .so that implements the required malloc debugging functionality.
416    libc_malloc_impl_handle = dlopen(so_name, RTLD_LAZY);
417    if (libc_malloc_impl_handle == NULL) {
418        error_log("%s: Missing module %s required for malloc debug level %d: %s",
419                  __progname, so_name, debug_level, dlerror());
420        return;
421    }
422
423    // Initialize malloc debugging in the loaded module.
424    malloc_debug_initialize = reinterpret_cast<MallocDebugInit>(dlsym(libc_malloc_impl_handle,
425                                                                      "malloc_debug_initialize"));
426    if (malloc_debug_initialize == NULL) {
427        error_log("%s: Initialization routine is not found in %s\n",
428                  __progname, so_name);
429        dlclose(libc_malloc_impl_handle);
430        return;
431    }
432    if (malloc_debug_initialize()) {
433        dlclose(libc_malloc_impl_handle);
434        return;
435    }
436
437    if (debug_level == 20) {
438        // For memory checker we need to do extra initialization.
439        typedef int (*MemCheckInit)(int, const char*);
440        MemCheckInit memcheck_initialize =
441            reinterpret_cast<MemCheckInit>(dlsym(libc_malloc_impl_handle,
442                                                 "memcheck_initialize"));
443        if (memcheck_initialize == NULL) {
444            error_log("%s: memcheck_initialize routine is not found in %s\n",
445                      __progname, so_name);
446            dlclose(libc_malloc_impl_handle);
447            return;
448        }
449        if (memcheck_initialize(MALLOC_ALIGNMENT, memcheck_tracing)) {
450            dlclose(libc_malloc_impl_handle);
451            return;
452        }
453    }
454
455    // Initialize malloc dispatch table with appropriate routines.
456    switch (debug_level) {
457        case 1:
458            InitMalloc(&gMallocUse, debug_level, "leak");
459            break;
460        case 5:
461            InitMalloc(&gMallocUse, debug_level, "fill");
462            break;
463        case 10:
464            InitMalloc(&gMallocUse, debug_level, "chk");
465            break;
466        case 20:
467            InitMalloc(&gMallocUse, debug_level, "qemu_instrumented");
468            break;
469        default:
470            break;
471    }
472
473    // Make sure dispatch table is initialized
474    if ((gMallocUse.malloc == NULL) ||
475        (gMallocUse.free == NULL) ||
476        (gMallocUse.calloc == NULL) ||
477        (gMallocUse.realloc == NULL) ||
478        (gMallocUse.memalign == NULL)) {
479        error_log("%s: some symbols for libc.debug.malloc level %d were not found (see above)",
480                  __progname, debug_level);
481        dlclose(libc_malloc_impl_handle);
482        libc_malloc_impl_handle = NULL;
483    } else {
484        __libc_malloc_dispatch = &gMallocUse;
485    }
486}
487
488static void malloc_fini_impl() {
489    if (libc_malloc_impl_handle) {
490        MallocDebugFini malloc_debug_finalize =
491            reinterpret_cast<MallocDebugFini>(dlsym(libc_malloc_impl_handle,
492                                                    "malloc_debug_finalize"));
493        if (malloc_debug_finalize) {
494            malloc_debug_finalize();
495        }
496    }
497}
498
499static pthread_once_t  malloc_init_once_ctl = PTHREAD_ONCE_INIT;
500static pthread_once_t  malloc_fini_once_ctl = PTHREAD_ONCE_INIT;
501
502#endif  // !LIBC_STATIC
503#endif  // USE_DL_PREFIX
504
505/* Initializes memory allocation framework.
506 * This routine is called from __libc_init routines implemented
507 * in libc_init_static.c and libc_init_dynamic.c files.
508 */
509extern "C" void malloc_debug_init() {
510    /* We need to initialize malloc iff we implement here custom
511     * malloc routines (i.e. USE_DL_PREFIX is defined) for libc.so */
512#if defined(USE_DL_PREFIX) && !defined(LIBC_STATIC)
513  if (pthread_once(&malloc_init_once_ctl, malloc_init_impl)) {
514        error_log("Unable to initialize malloc_debug component.");
515    }
516#endif  // USE_DL_PREFIX && !LIBC_STATIC
517}
518
519extern "C" void malloc_debug_fini() {
520  /* We need to finalize malloc iff we implement here custom
521     * malloc routines (i.e. USE_DL_PREFIX is defined) for libc.so */
522#if defined(USE_DL_PREFIX) && !defined(LIBC_STATIC)
523  if (pthread_once(&malloc_fini_once_ctl, malloc_fini_impl)) {
524        error_log("Unable to finalize malloc_debug component.");
525    }
526#endif  // USE_DL_PREFIX && !LIBC_STATIC
527}
528