2
* Copyright (C) 2012 The Android Open Source Project
5
* Redistribution and use in source and binary forms, with or without
6
* modification, are permitted provided that the following conditions
8
* * Redistributions of source code must retain the above copyright
9
* notice, this list of conditions and the following disclaimer.
10
* * Redistributions in binary form must reproduce the above copyright
11
* notice, this list of conditions and the following disclaimer in
12
* the documentation and/or other materials provided with the
15
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
16
* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
17
* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
18
* FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
19
* COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
20
* INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
21
* BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
22
* OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
23
* AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
24
* OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
25
* OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
33
#include <arpa/inet.h>
34
#include <sys/socket.h>
46
#include <sys/types.h>
47
#include <sys/system_properties.h>
52
#include "malloc_debug_common.h"
53
#include "malloc_debug_check_mapinfo.h"
55
static mapinfo *milist;
57
/* libc.debug.malloc.backlog */
58
extern unsigned int malloc_double_free_backlog;
60
#define MAX_BACKTRACE_DEPTH 15
61
#define ALLOCATION_TAG 0x1ee7d00d
62
#define BACKLOG_TAG 0xbabecafe
63
#define FREE_POISON 0xa5
64
#define BACKLOG_DEFAULT_LEN 100
65
#define FRONT_GUARD 0xaa
66
#define FRONT_GUARD_LEN (1<<5)
67
#define REAR_GUARD 0xbb
68
#define REAR_GUARD_LEN (1<<5)
70
static void print_backtrace(const intptr_t *bt, unsigned int depth);
72
static void log_message(const char* format, ...)
74
extern pthread_mutex_t gAllocationsMutex;
75
extern const MallocDebug __libc_malloc_default_dispatch;
76
extern const MallocDebug* __libc_malloc_dispatch;
80
pthread_mutex_lock(&gAllocationsMutex);
82
const MallocDebug* current_dispatch = __libc_malloc_dispatch;
83
__libc_malloc_dispatch = &__libc_malloc_default_dispatch;
84
va_start(args, format);
85
__libc_android_log_vprint(ANDROID_LOG_ERROR, "libc",
88
__libc_malloc_dispatch = current_dispatch;
90
pthread_mutex_unlock(&gAllocationsMutex);
97
intptr_t bt[MAX_BACKTRACE_DEPTH];
99
intptr_t freed_bt[MAX_BACKTRACE_DEPTH];
102
char front_guard[FRONT_GUARD_LEN];
103
} __attribute__((packed));
106
char rear_guard[REAR_GUARD_LEN];
107
} __attribute__((packed));
109
static inline struct ftr * to_ftr(struct hdr *hdr)
111
return (struct ftr *)(((char *)(hdr + 1)) + hdr->size);
114
static inline void *user(struct hdr *hdr)
119
static inline struct hdr *meta(void *user)
121
return ((struct hdr *)user) - 1;
124
/* Call this on exit() to get leaked memory */
125
void free_leaked_memory(void);
128
static struct hdr *tail;
129
static struct hdr *head;
130
static pthread_mutex_t lock = PTHREAD_MUTEX_INITIALIZER;
132
static unsigned backlog_num;
133
static struct hdr *backlog_tail;
134
static struct hdr *backlog_head;
135
static pthread_mutex_t backlog_lock = PTHREAD_MUTEX_INITIALIZER;
137
extern __LIBC_HIDDEN__
138
int get_backtrace(intptr_t* addrs, size_t max_entries);
140
static void print_backtrace(const intptr_t *bt, unsigned int depth)
145
intptr_t self_bt[MAX_BACKTRACE_DEPTH];
148
depth = get_backtrace(self_bt, MAX_BACKTRACE_DEPTH);
152
log_message("*** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***\n");
153
for (cnt = 0; cnt < depth && cnt < MAX_BACKTRACE_DEPTH; cnt++) {
154
mi = pc_to_mapinfo(milist, bt[cnt], &rel_pc);
155
log_message("\t#%02d pc %08x %s\n", cnt,
156
mi ? (intptr_t)rel_pc : bt[cnt],
157
mi ? mi->name : "(unknown)");
161
static inline void init_front_guard(struct hdr *hdr)
163
memset(hdr->front_guard, FRONT_GUARD, FRONT_GUARD_LEN);
166
static inline bool is_front_guard_valid(struct hdr *hdr)
169
for (i = 0; i < FRONT_GUARD_LEN; i++)
170
if (hdr->front_guard[i] != FRONT_GUARD)
175
static inline void init_rear_guard(struct hdr *hdr)
177
struct ftr *ftr = to_ftr(hdr);
178
memset(ftr->rear_guard, REAR_GUARD, REAR_GUARD_LEN);
181
static inline bool is_rear_guard_valid(struct hdr *hdr)
185
int first_mismatch = -1;
186
struct ftr *ftr = to_ftr(hdr);
187
for (i = 0; i < REAR_GUARD_LEN; i++) {
188
if (ftr->rear_guard[i] != REAR_GUARD) {
189
if (first_mismatch < 0)
193
else if (first_mismatch >= 0) {
194
log_message("+++ REAR GUARD MISMATCH [%d, %d)\n", first_mismatch, i);
199
if (first_mismatch >= 0)
200
log_message("+++ REAR GUARD MISMATCH [%d, %d)\n", first_mismatch, i);
204
static inline void add_locked(struct hdr *hdr, struct hdr **tail, struct hdr **head)
215
static inline int del_locked(struct hdr *hdr, struct hdr **tail, struct hdr **head)
218
hdr->prev->next = hdr->next;
222
hdr->next->prev = hdr->prev;
228
static inline void add(struct hdr *hdr, size_t size)
230
pthread_mutex_lock(&lock);
231
hdr->tag = ALLOCATION_TAG;
233
init_front_guard(hdr);
234
init_rear_guard(hdr);
236
add_locked(hdr, &tail, &head);
237
pthread_mutex_unlock(&lock);
240
static inline int del(struct hdr *hdr)
242
if (hdr->tag != ALLOCATION_TAG)
245
pthread_mutex_lock(&lock);
246
del_locked(hdr, &tail, &head);
248
pthread_mutex_unlock(&lock);
252
static inline void poison(struct hdr *hdr)
254
memset(user(hdr), FREE_POISON, hdr->size);
257
static int was_used_after_free(struct hdr *hdr)
260
const char *data = (const char *)user(hdr);
261
for (i = 0; i < hdr->size; i++)
262
if (data[i] != FREE_POISON)
267
/* returns 1 if valid, *safe == 1 if safe to dump stack */
268
static inline int check_guards(struct hdr *hdr, int *safe)
271
if (!is_front_guard_valid(hdr)) {
272
if (hdr->front_guard[0] == FRONT_GUARD) {
273
log_message("+++ ALLOCATION %p SIZE %d HAS A CORRUPTED FRONT GUARD\n",
274
user(hdr), hdr->size);
276
log_message("+++ ALLOCATION %p HAS A CORRUPTED FRONT GUARD "\
277
"(NOT DUMPING STACKTRACE)\n", user(hdr));
278
/* Allocation header is probably corrupt, do not print stack trace */
284
if (!is_rear_guard_valid(hdr)) {
285
log_message("+++ ALLOCATION %p SIZE %d HAS A CORRUPTED REAR GUARD\n",
286
user(hdr), hdr->size);
293
/* returns 1 if valid, *safe == 1 if safe to dump stack */
294
static inline int check_allocation_locked(struct hdr *hdr, int *safe)
299
if (hdr->tag != ALLOCATION_TAG && hdr->tag != BACKLOG_TAG) {
300
log_message("+++ ALLOCATION %p HAS INVALID TAG %08x (NOT DUMPING STACKTRACE)\n",
301
user(hdr), hdr->tag);
302
/* Allocation header is probably corrupt, do not dequeue or dump stack
309
if (hdr->tag == BACKLOG_TAG && was_used_after_free(hdr)) {
310
log_message("+++ ALLOCATION %p SIZE %d WAS USED AFTER BEING FREED\n",
311
user(hdr), hdr->size);
313
/* check the guards to see if it's safe to dump a stack trace */
314
(void)check_guards(hdr, safe);
317
valid = check_guards(hdr, safe);
319
if (!valid && *safe) {
320
log_message("+++ ALLOCATION %p SIZE %d ALLOCATED HERE:\n",
321
user(hdr), hdr->size);
322
print_backtrace(hdr->bt, hdr->bt_depth);
323
if (hdr->tag == BACKLOG_TAG) {
324
log_message("+++ ALLOCATION %p SIZE %d FREED HERE:\n",
325
user(hdr), hdr->size);
326
print_backtrace(hdr->freed_bt, hdr->freed_bt_depth);
333
static inline int del_and_check_locked(struct hdr *hdr,
334
struct hdr **tail, struct hdr **head, unsigned *cnt,
338
valid = check_allocation_locked(hdr, safe);
341
del_locked(hdr, tail, head);
346
static inline void del_from_backlog_locked(struct hdr *hdr)
349
(void)del_and_check_locked(hdr,
350
&backlog_tail, &backlog_head, &backlog_num,
352
hdr->tag = 0; /* clear the tag */
355
static inline void del_from_backlog(struct hdr *hdr)
357
pthread_mutex_lock(&backlog_lock);
358
del_from_backlog_locked(hdr);
359
pthread_mutex_unlock(&backlog_lock);
362
static inline int del_leak(struct hdr *hdr, int *safe)
365
pthread_mutex_lock(&lock);
366
valid = del_and_check_locked(hdr,
369
pthread_mutex_unlock(&lock);
373
static inline void add_to_backlog(struct hdr *hdr)
375
pthread_mutex_lock(&backlog_lock);
376
hdr->tag = BACKLOG_TAG;
378
add_locked(hdr, &backlog_tail, &backlog_head);
380
/* If we've exceeded the maximum backlog, clear it up */
381
while (backlog_num > malloc_double_free_backlog) {
382
struct hdr *gone = backlog_tail;
383
del_from_backlog_locked(gone);
386
pthread_mutex_unlock(&backlog_lock);
389
void* chk_malloc(size_t size)
393
// log_message("%s: %s\n", __FILE__, __FUNCTION__);
395
hdr = dlmalloc(sizeof(struct hdr) + size + sizeof(struct ftr));
397
hdr->bt_depth = get_backtrace(hdr->bt, MAX_BACKTRACE_DEPTH);
404
void* chk_memalign(size_t alignment, size_t bytes)
406
// log_message("%s: %s\n", __FILE__, __FUNCTION__);
407
// XXX: it's better to use malloc, than being wrong
408
return chk_malloc(bytes);
411
void chk_free(void *ptr)
415
// log_message("%s: %s\n", __FILE__, __FUNCTION__);
417
if (!ptr) /* ignore free(NULL) */
423
intptr_t bt[MAX_BACKTRACE_DEPTH];
425
depth = get_backtrace(bt, MAX_BACKTRACE_DEPTH);
426
if (hdr->tag == BACKLOG_TAG) {
427
log_message("+++ ALLOCATION %p SIZE %d BYTES MULTIPLY FREED!\n",
428
user(hdr), hdr->size);
429
log_message("+++ ALLOCATION %p SIZE %d ALLOCATED HERE:\n",
430
user(hdr), hdr->size);
431
print_backtrace(hdr->bt, hdr->bt_depth);
432
/* hdr->freed_bt_depth should be nonzero here */
433
log_message("+++ ALLOCATION %p SIZE %d FIRST FREED HERE:\n",
434
user(hdr), hdr->size);
435
print_backtrace(hdr->freed_bt, hdr->freed_bt_depth);
436
log_message("+++ ALLOCATION %p SIZE %d NOW BEING FREED HERE:\n",
437
user(hdr), hdr->size);
438
print_backtrace(bt, depth);
441
log_message("+++ ALLOCATION %p IS CORRUPTED OR NOT ALLOCATED VIA TRACKER!\n",
443
print_backtrace(bt, depth);
444
/* Leak here so that we do not crash */
449
hdr->freed_bt_depth = get_backtrace(hdr->freed_bt,
450
MAX_BACKTRACE_DEPTH);
455
void *chk_realloc(void *ptr, size_t size)
459
// log_message("%s: %s\n", __FILE__, __FUNCTION__);
467
return chk_malloc(size);
472
intptr_t bt[MAX_BACKTRACE_DEPTH];
474
depth = get_backtrace(bt, MAX_BACKTRACE_DEPTH);
475
if (hdr->tag == BACKLOG_TAG) {
476
log_message("+++ REALLOCATION %p SIZE %d OF FREED MEMORY!\n",
477
user(hdr), size, hdr->size);
478
log_message("+++ ALLOCATION %p SIZE %d ALLOCATED HERE:\n",
479
user(hdr), hdr->size);
480
print_backtrace(hdr->bt, hdr->bt_depth);
481
/* hdr->freed_bt_depth should be nonzero here */
482
log_message("+++ ALLOCATION %p SIZE %d FIRST FREED HERE:\n",
483
user(hdr), hdr->size);
484
print_backtrace(hdr->freed_bt, hdr->freed_bt_depth);
485
log_message("+++ ALLOCATION %p SIZE %d NOW BEING REALLOCATED HERE:\n",
486
user(hdr), hdr->size);
487
print_backtrace(bt, depth);
489
/* We take the memory out of the backlog and fall through so the
490
* reallocation below succeeds. Since we didn't really free it, we
491
* can default to this behavior.
493
del_from_backlog(hdr);
496
log_message("+++ REALLOCATION %p SIZE %d IS CORRUPTED OR NOT ALLOCATED VIA TRACKER!\n",
498
print_backtrace(bt, depth);
499
// just get a whole new allocation and leak the old one
500
return dlrealloc(0, size);
501
// return dlrealloc(user(hdr), size); // assuming it was allocated externally
505
hdr = dlrealloc(hdr, sizeof(struct hdr) + size + sizeof(struct ftr));
507
hdr->bt_depth = get_backtrace(hdr->bt, MAX_BACKTRACE_DEPTH);
515
void *chk_calloc(int nmemb, size_t size)
517
// log_message("%s: %s\n", __FILE__, __FUNCTION__);
519
size_t total_size = nmemb * size;
520
hdr = dlcalloc(1, sizeof(struct hdr) + total_size + sizeof(struct ftr));
522
hdr->bt_depth = get_backtrace(
523
hdr->bt, MAX_BACKTRACE_DEPTH);
524
add(hdr, total_size);
530
static void heaptracker_free_leaked_memory(void)
532
struct hdr *del; int cnt;
535
log_message("+++ THERE ARE %d LEAKED ALLOCATIONS\n", num);
540
log_message("+++ DELETING %d BYTES OF LEAKED MEMORY AT %p (%d REMAINING)\n",
541
del->size, user(del), num);
542
if (del_leak(del, &safe)) {
543
/* safe == 1, because the allocation is valid */
544
log_message("+++ ALLOCATION %p SIZE %d ALLOCATED HERE:\n",
545
user(del), del->size);
546
print_backtrace(del->bt, del->bt_depth);
551
// log_message("+++ DELETING %d BACKLOGGED ALLOCATIONS\n", backlog_num);
552
while (backlog_head) {
554
del_from_backlog(del);
559
/* Initializes malloc debugging framework.
560
* See comments on MallocDebugInit in malloc_debug_common.h
562
int malloc_debug_initialize(void)
564
if (!malloc_double_free_backlog)
565
malloc_double_free_backlog = BACKLOG_DEFAULT_LEN;
566
milist = init_mapinfo(getpid());
570
void malloc_debug_finalize(void)
572
heaptracker_free_leaked_memory();
573
deinit_mapinfo(milist);