From e1dd3c287ba836281de0197670018bd9bbfbd62b Mon Sep 17 00:00:00 2001 From: Iliyan Malchev Date: Tue, 29 May 2012 14:22:42 -0700 Subject: [PATCH] bionic: import heaptracker as chk_malloc This patch is a rewrite of libc.debug.malloc = 10 (chk_malloc). It provides the same features as the original (poison freed memory, detect heap overruns and underruns), except that it provides more debugging information whenever it detects a problem. In addition to the original features, the new chk_malloc() implementation detects multiple frees within a given range of the last N allocations, N being configurable via the system property libc.debug.malloc.backlog. Finally, this patch keeps track of all outstanding memory allocations. On program exit, we walk that list and report each outstanding allocation. (There is support (not enabled) for a scanner thread periodically walks over the list of outstanding allocations as well as the backlog of recently-freed allocations, checking for heap-usage errors.) Feature overview: 1) memory leaks 2) multiple frees 3) use after free 4) overrun Implementation: -- for each allocation, there is a: 1) stack trace at the time the allocation is made 2) if the memory is freed, there is also a stack trace at the point 3) a front and rear guard (fence) 4) the stack traces are kept together with the allocation -- the following lists and maintained 1) all outstanding memory allocations 3) a backlog of allocations what are freed; when you call free(), instead of actually freed, the allocation is moved to this backlog; 4) when the backlog of allocations gets full, the oldest entry gets evicted from it; at that point, the allocation is checked for overruns or use-after-free errors, and then actually freed. 5) when the program exits, the list of outstanding allocations and the backlog are inspected for errors, then freed; To use this, set the following system properties before running the process or processes you want to inspect: libc.malloc.debug.backlog # defaults to 100 libc.malloc.debug 10 When a problem is detected, you will see the following on logcat for a multiple free: E/libc ( 7233): +++ ALLOCATION 0x404b9278 SIZE 10 BYTES MULTIPLY FREED! E/libc ( 7233): +++ ALLOCATION 0x404b9278 SIZE 10 ALLOCATED HERE: E/libc ( 7233): *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** E/libc ( 7233): #00 pc 0000c35a /system/lib/libc_malloc_debug_leak.so E/libc ( 7233): #01 pc 0000c658 /system/lib/libc_malloc_debug_leak.so E/libc ( 7233): #02 pc 00016d80 /system/lib/libc.so E/libc ( 7233): #03 pc 4009647c /system/bin/malloctest E/libc ( 7233): #04 pc 00016f24 /system/lib/libc.so E/libc ( 7233): +++ ALLOCATION 0x404b9278 SIZE 10 FIRST FREED HERE: E/libc ( 7233): *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** E/libc ( 7233): #00 pc 0000c35a /system/lib/libc_malloc_debug_leak.so E/libc ( 7233): #01 pc 0000c7d2 /system/lib/libc_malloc_debug_leak.so E/libc ( 7233): #02 pc 00016d94 /system/lib/libc.so E/libc ( 7233): #03 pc 40096490 /system/bin/malloctest E/libc ( 7233): #04 pc 00016f24 /system/lib/libc.so E/libc ( 7233): +++ ALLOCATION 0x404b9278 SIZE 10 NOW BEING FREED HERE: E/libc ( 7233): *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** E/libc ( 7233): #00 pc 0000c35a /system/lib/libc_malloc_debug_leak.so E/libc ( 7233): #01 pc 0000c6ac /system/lib/libc_malloc_debug_leak.so E/libc ( 7233): #02 pc 00016d94 /system/lib/libc.so E/libc ( 7233): #03 pc 400964a0 /system/bin/malloctest E/libc ( 7233): #04 pc 00016f24 /system/lib/libc.so The following for a heap overrun and underrun: E/libc ( 7233): +++ REAR GUARD MISMATCH [10, 11) E/libc ( 7233): +++ ALLOCATION 0x404b9198 SIZE 10 HAS A CORRUPTED REAR GUARD E/libc ( 7233): +++ ALLOCATION 0x404b9198 SIZE 10 ALLOCATED HERE: E/libc ( 7233): *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** E/libc ( 7233): #00 pc 0000c35a /system/lib/libc_malloc_debug_leak.so E/libc ( 7233): #01 pc 0000c658 /system/lib/libc_malloc_debug_leak.so E/libc ( 7233): #02 pc 00016d80 /system/lib/libc.so E/libc ( 7233): #03 pc 40096438 /system/bin/malloctest E/libc ( 7233): #04 pc 00016f24 /system/lib/libc.so E/libc ( 7233): +++ ALLOCATION 0x404b9198 SIZE 10 FREED HERE: E/libc ( 7233): *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** E/libc ( 7233): #00 pc 0000c35a /system/lib/libc_malloc_debug_leak.so E/libc ( 7233): #01 pc 0000c7d2 /system/lib/libc_malloc_debug_leak.so E/libc ( 7233): #02 pc 00016d94 /system/lib/libc.so E/libc ( 7233): #03 pc 40096462 /system/bin/malloctest E/libc ( 7233): #04 pc 00016f24 /system/lib/libc.so E/libc ( 7233): +++ ALLOCATION 0x404b9358 SIZE 10 HAS A CORRUPTED FRONT GUARD E/libc ( 7233): +++ ALLOCATION 0x404b9358 SIZE 10 ALLOCATED HERE: E/libc ( 7233): *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** E/libc ( 7233): #00 pc 0000c35a /system/lib/libc_malloc_debug_leak.so E/libc ( 7233): #01 pc 0000c658 /system/lib/libc_malloc_debug_leak.so E/libc ( 7233): #02 pc 00016d80 /system/lib/libc.so E/libc ( 7233): #03 pc 400964ba /system/bin/malloctest E/libc ( 7233): #04 pc 00016f24 /system/lib/libc.so E/libc ( 7233): +++ ALLOCATION 0x404b9358 SIZE 10 FREED HERE: E/libc ( 7233): *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** E/libc ( 7233): #00 pc 0000c35a /system/lib/libc_malloc_debug_leak.so E/libc ( 7233): #01 pc 0000c7d2 /system/lib/libc_malloc_debug_leak.so E/libc ( 7233): #02 pc 00016d94 /system/lib/libc.so E/libc ( 7233): #03 pc 400964e4 /system/bin/malloctest E/libc ( 7233): #04 pc 00016f24 /system/lib/libc.so The following for a memory leak: E/libc ( 7233): +++ THERE ARE 1 LEAKED ALLOCATIONS E/libc ( 7233): +++ DELETING 4096 BYTES OF LEAKED MEMORY AT 0x404b95e8 (1 REMAINING) E/libc ( 7233): +++ ALLOCATION 0x404b95e8 SIZE 4096 ALLOCATED HERE: E/libc ( 7233): *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** E/libc ( 7233): #00 pc 0000c35a /system/lib/libc_malloc_debug_leak.so E/libc ( 7233): #01 pc 0000c658 /system/lib/libc_malloc_debug_leak.so E/libc ( 7233): #02 pc 00016d80 /system/lib/libc.so E/libc ( 7233): #03 pc 0001bc94 /system/lib/libc.so E/libc ( 7233): #04 pc 0001edf6 /system/lib/libc.so E/libc ( 7233): #05 pc 0001b80a /system/lib/libc.so E/libc ( 7233): #06 pc 0001c086 /system/lib/libc.so E/libc ( 7233): #07 pc 40096402 /system/bin/malloctest E/libc ( 7233): #08 pc 00016f24 /system/lib/libc.so Change-Id: Ic440e9d05a01e2ea86b25e8998714e88bc2d16e0 Signed-off-by: Iliyan Malchev --- libc/Android.mk | 5 +- libc/bionic/libc_init_common.c | 8 + libc/bionic/libc_init_dynamic.c | 6 + libc/bionic/malloc_debug_check.c | 574 +++++++++++++++++++++++ libc/bionic/malloc_debug_check_mapinfo.c | 126 +++++ libc/bionic/malloc_debug_check_mapinfo.h | 46 ++ libc/bionic/malloc_debug_common.c | 52 +- libc/bionic/malloc_debug_common.h | 28 +- libc/bionic/malloc_debug_leak.c | 261 +---------- libc/bionic/malloc_debug_qemu.c | 18 +- libc/bionic/malloc_debug_stacktrace.c | 76 +++ 11 files changed, 916 insertions(+), 284 deletions(-) create mode 100644 libc/bionic/malloc_debug_check.c create mode 100644 libc/bionic/malloc_debug_check_mapinfo.c create mode 100644 libc/bionic/malloc_debug_check_mapinfo.h create mode 100644 libc/bionic/malloc_debug_stacktrace.c diff --git a/libc/Android.mk b/libc/Android.mk index a4031462a..7d31340ca 100644 --- a/libc/Android.mk +++ b/libc/Android.mk @@ -716,7 +716,10 @@ LOCAL_CFLAGS := \ LOCAL_C_INCLUDES := $(libc_common_c_includes) LOCAL_SRC_FILES := \ - bionic/malloc_debug_leak.c + bionic/malloc_debug_leak.c \ + bionic/malloc_debug_check.c \ + bionic/malloc_debug_check_mapinfo.c \ + bionic/malloc_debug_stacktrace.c LOCAL_MODULE:= libc_malloc_debug_leak diff --git a/libc/bionic/libc_init_common.c b/libc/bionic/libc_init_common.c index 7fb1246a7..4ce4db629 100644 --- a/libc/bionic/libc_init_common.c +++ b/libc/bionic/libc_init_common.c @@ -138,4 +138,12 @@ void __libc_fini(void* array) func(); } + +#ifndef LIBC_STATIC + { + extern void __libc_postfini(void) __attribute__((weak)); + if (__libc_postfini) + __libc_postfini(); + } +#endif } diff --git a/libc/bionic/libc_init_dynamic.c b/libc/bionic/libc_init_dynamic.c index 1c8480c86..3a7e8e23c 100644 --- a/libc/bionic/libc_init_dynamic.c +++ b/libc/bionic/libc_init_dynamic.c @@ -89,6 +89,12 @@ void __libc_preinit(void) malloc_debug_init(); } +void __libc_postfini(void) +{ + extern void malloc_debug_fini(void); + malloc_debug_fini(); +} + /* This function is called from the executable's _start entry point * (see arch-$ARCH/bionic/crtbegin_dynamic.S), which is itself * called by the dynamic linker after it has loaded all shared diff --git a/libc/bionic/malloc_debug_check.c b/libc/bionic/malloc_debug_check.c new file mode 100644 index 000000000..4ae21fec2 --- /dev/null +++ b/libc/bionic/malloc_debug_check.c @@ -0,0 +1,574 @@ +/* + * Copyright (C) 2012 The Android Open Source Project + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * * Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * * Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in + * the documentation and/or other materials provided with the + * distribution. + * + * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS + * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT + * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS + * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE + * COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, + * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, + * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS + * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED + * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, + * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT + * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF + * SUCH DAMAGE. + */ + +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include + +#include +#include + +#include "dlmalloc.h" +#include "logd.h" + +#include "malloc_debug_common.h" +#include "malloc_debug_check_mapinfo.h" + +static mapinfo *milist; + +/* libc.debug.malloc.backlog */ +extern unsigned int malloc_double_free_backlog; + +#define MAX_BACKTRACE_DEPTH 15 +#define ALLOCATION_TAG 0x1ee7d00d +#define BACKLOG_TAG 0xbabecafe +#define FREE_POISON 0xa5 +#define BACKLOG_DEFAULT_LEN 100 +#define FRONT_GUARD 0xaa +#define FRONT_GUARD_LEN (1<<5) +#define REAR_GUARD 0xbb +#define REAR_GUARD_LEN (1<<5) + +static void print_backtrace(const intptr_t *bt, unsigned int depth); + +static void log_message(const char* format, ...) +{ + extern pthread_mutex_t gAllocationsMutex; + extern const MallocDebug __libc_malloc_default_dispatch; + extern const MallocDebug* __libc_malloc_dispatch; + + va_list args; + + pthread_mutex_lock(&gAllocationsMutex); + { + const MallocDebug* current_dispatch = __libc_malloc_dispatch; + __libc_malloc_dispatch = &__libc_malloc_default_dispatch; + va_start(args, format); + __libc_android_log_vprint(ANDROID_LOG_ERROR, "libc", + format, args); + va_end(args); + __libc_malloc_dispatch = current_dispatch; + } + pthread_mutex_unlock(&gAllocationsMutex); +} + +struct hdr { + uint32_t tag; + struct hdr *prev; + struct hdr *next; + intptr_t bt[MAX_BACKTRACE_DEPTH]; + int bt_depth; + intptr_t freed_bt[MAX_BACKTRACE_DEPTH]; + int freed_bt_depth; + size_t size; + char front_guard[FRONT_GUARD_LEN]; +} __attribute__((packed)); + +struct ftr { + char rear_guard[REAR_GUARD_LEN]; +} __attribute__((packed)); + +static inline struct ftr * to_ftr(struct hdr *hdr) +{ + return (struct ftr *)(((char *)(hdr + 1)) + hdr->size); +} + +static inline void *user(struct hdr *hdr) +{ + return hdr + 1; +} + +static inline struct hdr *meta(void *user) +{ + return ((struct hdr *)user) - 1; +} + +/* Call this on exit() to get leaked memory */ +void free_leaked_memory(void); + +static unsigned num; +static struct hdr *tail; +static struct hdr *head; +static pthread_mutex_t lock = PTHREAD_MUTEX_INITIALIZER; + +static unsigned backlog_num; +static struct hdr *backlog_tail; +static struct hdr *backlog_head; +static pthread_mutex_t backlog_lock = PTHREAD_MUTEX_INITIALIZER; + +extern __LIBC_HIDDEN__ +int get_backtrace(intptr_t* addrs, size_t max_entries); + +static void print_backtrace(const intptr_t *bt, unsigned int depth) +{ + const mapinfo *mi; + unsigned int cnt; + unsigned int rel_pc; + intptr_t self_bt[MAX_BACKTRACE_DEPTH]; + + if (!bt) { + depth = get_backtrace(self_bt, MAX_BACKTRACE_DEPTH); + bt = self_bt; + } + + log_message("*** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***\n"); + for (cnt = 0; cnt < depth && cnt < MAX_BACKTRACE_DEPTH; cnt++) { + mi = pc_to_mapinfo(milist, bt[cnt], &rel_pc); + log_message("\t#%02d pc %08x %s\n", cnt, + mi ? (intptr_t)rel_pc : bt[cnt], + mi ? mi->name : "(unknown)"); + } +} + +static inline void init_front_guard(struct hdr *hdr) +{ + memset(hdr->front_guard, FRONT_GUARD, FRONT_GUARD_LEN); +} + +static inline bool is_front_guard_valid(struct hdr *hdr) +{ + unsigned i; + for (i = 0; i < FRONT_GUARD_LEN; i++) + if (hdr->front_guard[i] != FRONT_GUARD) + return 0; + return 1; +} + +static inline void init_rear_guard(struct hdr *hdr) +{ + struct ftr *ftr = to_ftr(hdr); + memset(ftr->rear_guard, REAR_GUARD, REAR_GUARD_LEN); +} + +static inline bool is_rear_guard_valid(struct hdr *hdr) +{ + unsigned i; + int valid = 1; + int first_mismatch = -1; + struct ftr *ftr = to_ftr(hdr); + for (i = 0; i < REAR_GUARD_LEN; i++) { + if (ftr->rear_guard[i] != REAR_GUARD) { + if (first_mismatch < 0) + first_mismatch = i; + valid = 0; + } + else if (first_mismatch >= 0) { + log_message("+++ REAR GUARD MISMATCH [%d, %d)\n", first_mismatch, i); + first_mismatch = -1; + } + } + + if (first_mismatch >= 0) + log_message("+++ REAR GUARD MISMATCH [%d, %d)\n", first_mismatch, i); + return valid; +} + +static inline void add_locked(struct hdr *hdr, struct hdr **tail, struct hdr **head) +{ + hdr->prev = NULL; + hdr->next = *head; + if (*head) + (*head)->prev = hdr; + else + *tail = hdr; + *head = hdr; +} + +static inline int del_locked(struct hdr *hdr, struct hdr **tail, struct hdr **head) +{ + if (hdr->prev) + hdr->prev->next = hdr->next; + else + *head = hdr->next; + if (hdr->next) + hdr->next->prev = hdr->prev; + else + *tail = hdr->prev; + return 0; +} + +static inline void add(struct hdr *hdr, size_t size) +{ + pthread_mutex_lock(&lock); + hdr->tag = ALLOCATION_TAG; + hdr->size = size; + init_front_guard(hdr); + init_rear_guard(hdr); + num++; + add_locked(hdr, &tail, &head); + pthread_mutex_unlock(&lock); +} + +static inline int del(struct hdr *hdr) +{ + if (hdr->tag != ALLOCATION_TAG) + return -1; + + pthread_mutex_lock(&lock); + del_locked(hdr, &tail, &head); + num--; + pthread_mutex_unlock(&lock); + return 0; +} + +static inline void poison(struct hdr *hdr) +{ + memset(user(hdr), FREE_POISON, hdr->size); +} + +static int was_used_after_free(struct hdr *hdr) +{ + unsigned i; + const char *data = (const char *)user(hdr); + for (i = 0; i < hdr->size; i++) + if (data[i] != FREE_POISON) + return 1; + return 0; +} + +/* returns 1 if valid, *safe == 1 if safe to dump stack */ +static inline int check_guards(struct hdr *hdr, int *safe) +{ + *safe = 1; + if (!is_front_guard_valid(hdr)) { + if (hdr->front_guard[0] == FRONT_GUARD) { + log_message("+++ ALLOCATION %p SIZE %d HAS A CORRUPTED FRONT GUARD\n", + user(hdr), hdr->size); + } else { + log_message("+++ ALLOCATION %p HAS A CORRUPTED FRONT GUARD "\ + "(NOT DUMPING STACKTRACE)\n", user(hdr)); + /* Allocation header is probably corrupt, do not print stack trace */ + *safe = 0; + } + return 0; + } + + if (!is_rear_guard_valid(hdr)) { + log_message("+++ ALLOCATION %p SIZE %d HAS A CORRUPTED REAR GUARD\n", + user(hdr), hdr->size); + return 0; + } + + return 1; +} + +/* returns 1 if valid, *safe == 1 if safe to dump stack */ +static inline int check_allocation_locked(struct hdr *hdr, int *safe) +{ + int valid = 1; + *safe = 1; + + if (hdr->tag != ALLOCATION_TAG && hdr->tag != BACKLOG_TAG) { + log_message("+++ ALLOCATION %p HAS INVALID TAG %08x (NOT DUMPING STACKTRACE)\n", + user(hdr), hdr->tag); + /* Allocation header is probably corrupt, do not dequeue or dump stack + * trace. + */ + *safe = 0; + return 0; + } + + if (hdr->tag == BACKLOG_TAG && was_used_after_free(hdr)) { + log_message("+++ ALLOCATION %p SIZE %d WAS USED AFTER BEING FREED\n", + user(hdr), hdr->size); + valid = 0; + /* check the guards to see if it's safe to dump a stack trace */ + (void)check_guards(hdr, safe); + } + else + valid = check_guards(hdr, safe); + + if (!valid && *safe) { + log_message("+++ ALLOCATION %p SIZE %d ALLOCATED HERE:\n", + user(hdr), hdr->size); + print_backtrace(hdr->bt, hdr->bt_depth); + if (hdr->tag == BACKLOG_TAG) { + log_message("+++ ALLOCATION %p SIZE %d FREED HERE:\n", + user(hdr), hdr->size); + print_backtrace(hdr->freed_bt, hdr->freed_bt_depth); + } + } + + return valid; +} + +static inline int del_and_check_locked(struct hdr *hdr, + struct hdr **tail, struct hdr **head, unsigned *cnt, + int *safe) +{ + int valid; + valid = check_allocation_locked(hdr, safe); + if (safe) { + (*cnt)--; + del_locked(hdr, tail, head); + } + return valid; +} + +static inline void del_from_backlog_locked(struct hdr *hdr) +{ + int safe; + (void)del_and_check_locked(hdr, + &backlog_tail, &backlog_head, &backlog_num, + &safe); + hdr->tag = 0; /* clear the tag */ +} + +static inline void del_from_backlog(struct hdr *hdr) +{ + pthread_mutex_lock(&backlog_lock); + del_from_backlog_locked(hdr); + pthread_mutex_unlock(&backlog_lock); +} + +static inline int del_leak(struct hdr *hdr, int *safe) +{ + int valid; + pthread_mutex_lock(&lock); + valid = del_and_check_locked(hdr, + &tail, &head, &num, + safe); + pthread_mutex_unlock(&lock); + return valid; +} + +static inline void add_to_backlog(struct hdr *hdr) +{ + pthread_mutex_lock(&backlog_lock); + hdr->tag = BACKLOG_TAG; + backlog_num++; + add_locked(hdr, &backlog_tail, &backlog_head); + poison(hdr); + /* If we've exceeded the maximum backlog, clear it up */ + while (backlog_num > malloc_double_free_backlog) { + struct hdr *gone = backlog_tail; + del_from_backlog_locked(gone); + dlfree(gone); + } + pthread_mutex_unlock(&backlog_lock); +} + +void* chk_malloc(size_t size) +{ + struct hdr *hdr; + +// log_message("%s: %s\n", __FILE__, __FUNCTION__); + + hdr = dlmalloc(sizeof(struct hdr) + size + sizeof(struct ftr)); + if (hdr) { + hdr->bt_depth = get_backtrace(hdr->bt, MAX_BACKTRACE_DEPTH); + add(hdr, size); + return user(hdr); + } + return NULL; +} + +void* chk_memalign(size_t alignment, size_t bytes) +{ +// log_message("%s: %s\n", __FILE__, __FUNCTION__); + // XXX: it's better to use malloc, than being wrong + return chk_malloc(bytes); +} + +void chk_free(void *ptr) +{ + struct hdr *hdr; + +// log_message("%s: %s\n", __FILE__, __FUNCTION__); + + if (!ptr) /* ignore free(NULL) */ + return; + + hdr = meta(ptr); + + if (del(hdr) < 0) { + intptr_t bt[MAX_BACKTRACE_DEPTH]; + int depth; + depth = get_backtrace(bt, MAX_BACKTRACE_DEPTH); + if (hdr->tag == BACKLOG_TAG) { + log_message("+++ ALLOCATION %p SIZE %d BYTES MULTIPLY FREED!\n", + user(hdr), hdr->size); + log_message("+++ ALLOCATION %p SIZE %d ALLOCATED HERE:\n", + user(hdr), hdr->size); + print_backtrace(hdr->bt, hdr->bt_depth); + /* hdr->freed_bt_depth should be nonzero here */ + log_message("+++ ALLOCATION %p SIZE %d FIRST FREED HERE:\n", + user(hdr), hdr->size); + print_backtrace(hdr->freed_bt, hdr->freed_bt_depth); + log_message("+++ ALLOCATION %p SIZE %d NOW BEING FREED HERE:\n", + user(hdr), hdr->size); + print_backtrace(bt, depth); + } + else { + log_message("+++ ALLOCATION %p IS CORRUPTED OR NOT ALLOCATED VIA TRACKER!\n", + user(hdr)); + print_backtrace(bt, depth); + /* Leak here so that we do not crash */ + //dlfree(user(hdr)); + } + } + else { + hdr->freed_bt_depth = get_backtrace(hdr->freed_bt, + MAX_BACKTRACE_DEPTH); + add_to_backlog(hdr); + } +} + +void *chk_realloc(void *ptr, size_t size) +{ + struct hdr *hdr; + +// log_message("%s: %s\n", __FILE__, __FUNCTION__); + + if (!size) { + chk_free(ptr); + return NULL; + } + + if (!ptr) + return chk_malloc(size); + + hdr = meta(ptr); + + if (del(hdr) < 0) { + intptr_t bt[MAX_BACKTRACE_DEPTH]; + int depth; + depth = get_backtrace(bt, MAX_BACKTRACE_DEPTH); + if (hdr->tag == BACKLOG_TAG) { + log_message("+++ REALLOCATION %p SIZE %d OF FREED MEMORY!\n", + user(hdr), size, hdr->size); + log_message("+++ ALLOCATION %p SIZE %d ALLOCATED HERE:\n", + user(hdr), hdr->size); + print_backtrace(hdr->bt, hdr->bt_depth); + /* hdr->freed_bt_depth should be nonzero here */ + log_message("+++ ALLOCATION %p SIZE %d FIRST FREED HERE:\n", + user(hdr), hdr->size); + print_backtrace(hdr->freed_bt, hdr->freed_bt_depth); + log_message("+++ ALLOCATION %p SIZE %d NOW BEING REALLOCATED HERE:\n", + user(hdr), hdr->size); + print_backtrace(bt, depth); + + /* We take the memory out of the backlog and fall through so the + * reallocation below succeeds. Since we didn't really free it, we + * can default to this behavior. + */ + del_from_backlog(hdr); + } + else { + log_message("+++ REALLOCATION %p SIZE %d IS CORRUPTED OR NOT ALLOCATED VIA TRACKER!\n", + user(hdr), size); + print_backtrace(bt, depth); + // just get a whole new allocation and leak the old one + return dlrealloc(0, size); + // return dlrealloc(user(hdr), size); // assuming it was allocated externally + } + } + + hdr = dlrealloc(hdr, sizeof(struct hdr) + size + sizeof(struct ftr)); + if (hdr) { + hdr->bt_depth = get_backtrace(hdr->bt, MAX_BACKTRACE_DEPTH); + add(hdr, size); + return user(hdr); + } + + return NULL; +} + +void *chk_calloc(int nmemb, size_t size) +{ +// log_message("%s: %s\n", __FILE__, __FUNCTION__); + struct hdr *hdr; + size_t total_size = nmemb * size; + hdr = dlcalloc(1, sizeof(struct hdr) + total_size + sizeof(struct ftr)); + if (hdr) { + hdr->bt_depth = get_backtrace( + hdr->bt, MAX_BACKTRACE_DEPTH); + add(hdr, total_size); + return user(hdr); + } + return NULL; +} + +static void heaptracker_free_leaked_memory(void) +{ + struct hdr *del; int cnt; + + if (num) + log_message("+++ THERE ARE %d LEAKED ALLOCATIONS\n", num); + + while (head) { + int safe; + del = head; + log_message("+++ DELETING %d BYTES OF LEAKED MEMORY AT %p (%d REMAINING)\n", + del->size, user(del), num); + if (del_leak(del, &safe)) { + /* safe == 1, because the allocation is valid */ + log_message("+++ ALLOCATION %p SIZE %d ALLOCATED HERE:\n", + user(del), del->size); + print_backtrace(del->bt, del->bt_depth); + } + dlfree(del); + } + +// log_message("+++ DELETING %d BACKLOGGED ALLOCATIONS\n", backlog_num); + while (backlog_head) { + del = backlog_tail; + del_from_backlog(del); + dlfree(del); + } +} + +/* Initializes malloc debugging framework. + * See comments on MallocDebugInit in malloc_debug_common.h + */ +int malloc_debug_initialize(void) +{ + if (!malloc_double_free_backlog) + malloc_double_free_backlog = BACKLOG_DEFAULT_LEN; + milist = init_mapinfo(getpid()); + return 0; +} + +void malloc_debug_finalize(void) +{ + heaptracker_free_leaked_memory(); + deinit_mapinfo(milist); +} diff --git a/libc/bionic/malloc_debug_check_mapinfo.c b/libc/bionic/malloc_debug_check_mapinfo.c new file mode 100644 index 000000000..044fc6584 --- /dev/null +++ b/libc/bionic/malloc_debug_check_mapinfo.c @@ -0,0 +1,126 @@ +/* + * Copyright (C) 2012 The Android Open Source Project + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * * Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * * Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in + * the documentation and/or other materials provided with the + * distribution. + * + * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS + * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT + * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS + * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE + * COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, + * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, + * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS + * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED + * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, + * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT + * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF + * SUCH DAMAGE. + */ + +#include +#include +#include + +#include "dlmalloc.h" +#include "malloc_debug_check_mapinfo.h" + +// 6f000000-6f01e000 rwxp 00000000 00:0c 16389419 /system/lib/libcomposer.so +// 012345678901234567890123456789012345678901234567890123456789 +// 0 1 2 3 4 5 + +static mapinfo *parse_maps_line(char *line) +{ + mapinfo *mi; + int len = strlen(line); + + if(len < 1) return 0; + line[--len] = 0; + + if(len < 50) return 0; + if(line[20] != 'x') return 0; + + mi = dlmalloc(sizeof(mapinfo) + (len - 47)); + if(mi == 0) return 0; + + mi->start = strtoul(line, 0, 16); + mi->end = strtoul(line + 9, 0, 16); + /* To be filled in parse_elf_info if the mapped section starts with + * elf_header + */ + mi->next = 0; + strcpy(mi->name, line + 49); + + return mi; +} + +__LIBC_HIDDEN__ +mapinfo *init_mapinfo(int pid) +{ + struct mapinfo *milist = NULL; + char data[1024]; + sprintf(data, "/proc/%d/maps", pid); + FILE *fp = fopen(data, "r"); + if(fp) { + while(fgets(data, sizeof(data), fp)) { + mapinfo *mi = parse_maps_line(data); + if(mi) { + mi->next = milist; + milist = mi; + } + } + fclose(fp); + } + + return milist; +} + +__LIBC_HIDDEN__ +void deinit_mapinfo(mapinfo *mi) +{ + mapinfo *del; + while(mi) { + del = mi; + mi = mi->next; + dlfree(del); + } +} + +/* Map a pc address to the name of the containing ELF file */ +__LIBC_HIDDEN__ +const char *map_to_name(mapinfo *mi, unsigned pc, const char* def) +{ + while(mi) { + if((pc >= mi->start) && (pc < mi->end)){ + return mi->name; + } + mi = mi->next; + } + return def; +} + +/* Find the containing map info for the pc */ +__LIBC_HIDDEN__ +const mapinfo *pc_to_mapinfo(mapinfo *mi, unsigned pc, unsigned *rel_pc) +{ + *rel_pc = pc; + while(mi) { + if((pc >= mi->start) && (pc < mi->end)){ + // Only calculate the relative offset for shared libraries + if (strstr(mi->name, ".so")) { + *rel_pc -= mi->start; + } + return mi; + } + mi = mi->next; + } + return NULL; +} diff --git a/libc/bionic/malloc_debug_check_mapinfo.h b/libc/bionic/malloc_debug_check_mapinfo.h new file mode 100644 index 000000000..8a01cd3d4 --- /dev/null +++ b/libc/bionic/malloc_debug_check_mapinfo.h @@ -0,0 +1,46 @@ +/* + * Copyright (C) 2012 The Android Open Source Project + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * * Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * * Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in + * the documentation and/or other materials provided with the + * distribution. + * + * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS + * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT + * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS + * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE + * COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, + * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, + * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS + * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED + * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, + * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT + * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF + * SUCH DAMAGE. + */ + +#ifndef MALLOC_DEBUG_CHECK_MAPINFO_H +#define MALLOC_DEBUG_CHECK_MAPINFO_H + +#include + +typedef struct mapinfo { + struct mapinfo *next; + unsigned start; + unsigned end; + char name[]; +} mapinfo; + +__LIBC_HIDDEN__ mapinfo *init_mapinfo(int pid); +__LIBC_HIDDEN__ void deinit_mapinfo(mapinfo *mi); +__LIBC_HIDDEN__ const char *map_to_name(mapinfo *mi, unsigned pc, const char* def); +__LIBC_HIDDEN__ const mapinfo *pc_to_mapinfo(mapinfo *mi, unsigned pc, unsigned *rel_pc); + +#endif/*MALLOC_DEBUG_CHECK_MAPINFO_H*/ diff --git a/libc/bionic/malloc_debug_common.c b/libc/bionic/malloc_debug_common.c index 6837e393d..4105ab842 100644 --- a/libc/bionic/malloc_debug_common.c +++ b/libc/bionic/malloc_debug_common.c @@ -240,17 +240,6 @@ void* memalign(size_t alignment, size_t bytes) { #include #include "logd.h" -// ============================================================================= -// log functions -// ============================================================================= - -#define debug_log(format, ...) \ - __libc_android_log_print(ANDROID_LOG_DEBUG, "libc", (format), ##__VA_ARGS__ ) -#define error_log(format, ...) \ - __libc_android_log_print(ANDROID_LOG_ERROR, "libc", (format), ##__VA_ARGS__ ) -#define info_log(format, ...) \ - __libc_android_log_print(ANDROID_LOG_INFO, "libc", (format), ##__VA_ARGS__ ) - /* Table for dispatching malloc calls, depending on environment. */ static MallocDebug gMallocUse __attribute__((aligned(32))) = { dlmalloc, dlfree, dlcalloc, dlrealloc, dlmemalign @@ -288,6 +277,14 @@ static void* libc_malloc_impl_handle = NULL; #define MALLOC_ALIGNMENT ((size_t)8U) #endif /* MALLOC_ALIGNMENT */ +/* This variable is set to the value of property libc.debug.malloc.backlog, + * when the value of libc.debug.malloc = 10. It determines the size of the + * backlog we use to detect multiple frees. If the property is not set, the + * backlog length defaults to an internal constant defined in + * malloc_debug_check.c + */ +unsigned int malloc_double_free_backlog; + /* Initializes memory allocation framework once per process. */ static void malloc_init_impl(void) { @@ -339,9 +336,17 @@ static void malloc_init_impl(void) switch (debug_level) { case 1: case 5: - case 10: + case 10: { + char debug_backlog[PROP_VALUE_MAX]; + if (__system_property_get("libc.debug.malloc.backlog", debug_backlog)) { + malloc_double_free_backlog = atoi(debug_backlog); + info_log("%s: setting backlog length to %d\n", + __progname, malloc_double_free_backlog); + } + so_name = "/system/lib/libc_malloc_debug_leak.so"; break; + } case 20: // Quick check: debug level 20 can only be handled in emulator. if (!qemu_running) { @@ -485,7 +490,19 @@ static void malloc_init_impl(void) } } +static void malloc_fini_impl(void) +{ + if (libc_malloc_impl_handle) { + MallocDebugFini malloc_debug_finalize = NULL; + malloc_debug_finalize = + dlsym(libc_malloc_impl_handle, "malloc_debug_finalize"); + if (malloc_debug_finalize) + malloc_debug_finalize(); + } +} + static pthread_once_t malloc_init_once_ctl = PTHREAD_ONCE_INIT; +static pthread_once_t malloc_fini_once_ctl = PTHREAD_ONCE_INIT; #endif // !LIBC_STATIC #endif // USE_DL_PREFIX @@ -504,3 +521,14 @@ void malloc_debug_init(void) } #endif // USE_DL_PREFIX && !LIBC_STATIC } + +void malloc_debug_fini(void) +{ + /* We need to finalize malloc iff we implement here custom + * malloc routines (i.e. USE_DL_PREFIX is defined) for libc.so */ +#if defined(USE_DL_PREFIX) && !defined(LIBC_STATIC) + if (pthread_once(&malloc_fini_once_ctl, malloc_fini_impl)) { + error_log("Unable to finalize malloc_debug component."); + } +#endif // USE_DL_PREFIX && !LIBC_STATIC +} diff --git a/libc/bionic/malloc_debug_common.h b/libc/bionic/malloc_debug_common.h index 87600d64a..c78846b8b 100644 --- a/libc/bionic/malloc_debug_common.h +++ b/libc/bionic/malloc_debug_common.h @@ -82,15 +82,31 @@ struct MallocDebug { void* (*memalign)(size_t alignment, size_t bytes); }; -/* Malloc debugging initialization routine. - * This routine must be implemented in .so modules that implement malloc - * debugging. This routine is called once per process from malloc_init_impl - * routine implemented in bionic/libc/bionic/malloc_debug_common.c when malloc +/* Malloc debugging initialization and finalization routines. + * + * These routines must be implemented in .so modules that implement malloc + * debugging. The are is called once per process from malloc_init_impl and + * malloc_fini_impl respectively. + * + * They are implemented in bionic/libc/bionic/malloc_debug_common.c when malloc * debugging gets initialized for the process. - * Return: - * 0 on success, -1 on failure. + * + * MallocDebugInit returns: + * 0 on success, -1 on failure. */ typedef int (*MallocDebugInit)(void); +typedef void (*MallocDebugFini)(void); + +// ============================================================================= +// log functions +// ============================================================================= + +#define debug_log(format, ...) \ + __libc_android_log_print(ANDROID_LOG_DEBUG, "malloc_leak_check", (format), ##__VA_ARGS__ ) +#define error_log(format, ...) \ + __libc_android_log_print(ANDROID_LOG_ERROR, "malloc_leak_check", (format), ##__VA_ARGS__ ) +#define info_log(format, ...) \ + __libc_android_log_print(ANDROID_LOG_INFO, "malloc_leak_check", (format), ##__VA_ARGS__ ) #ifdef __cplusplus }; /* end of extern "C" */ diff --git a/libc/bionic/malloc_debug_leak.c b/libc/bionic/malloc_debug_leak.c index e0bcee946..0b186458f 100644 --- a/libc/bionic/malloc_debug_leak.c +++ b/libc/bionic/malloc_debug_leak.c @@ -61,22 +61,11 @@ extern int gMallocLeakZygoteChild; extern pthread_mutex_t gAllocationsMutex; extern HashTable gHashTable; -extern const MallocDebug __libc_malloc_default_dispatch; -extern const MallocDebug* __libc_malloc_dispatch; // ============================================================================= -// log functions +// stack trace functions // ============================================================================= -#define debug_log(format, ...) \ - __libc_android_log_print(ANDROID_LOG_DEBUG, "malloc_leak_check", (format), ##__VA_ARGS__ ) -#define error_log(format, ...) \ - __libc_android_log_print(ANDROID_LOG_ERROR, "malloc_leak_check", (format), ##__VA_ARGS__ ) -#define info_log(format, ...) \ - __libc_android_log_print(ANDROID_LOG_INFO, "malloc_leak_check", (format), ##__VA_ARGS__ ) - -static int gTrapOnError = 1; - #define MALLOC_ALIGNMENT 8 #define GUARD 0x48151642 #define DEBUG 0 @@ -210,246 +199,12 @@ static void remove_entry(HashEntry* entry) gHashTable.count--; } - // ============================================================================= -// stack trace functions -// ============================================================================= - -typedef struct -{ - size_t count; - intptr_t* addrs; -} stack_crawl_state_t; - - -/* depends how the system includes define this */ -#ifdef HAVE_UNWIND_CONTEXT_STRUCT -typedef struct _Unwind_Context __unwind_context; -#else -typedef _Unwind_Context __unwind_context; -#endif - -static _Unwind_Reason_Code trace_function(__unwind_context *context, void *arg) -{ - stack_crawl_state_t* state = (stack_crawl_state_t*)arg; - if (state->count) { - intptr_t ip = (intptr_t)_Unwind_GetIP(context); - if (ip) { - state->addrs[0] = ip; - state->addrs++; - state->count--; - return _URC_NO_REASON; - } - } - /* - * If we run out of space to record the address or 0 has been seen, stop - * unwinding the stack. - */ - return _URC_END_OF_STACK; -} - -static inline -int get_backtrace(intptr_t* addrs, size_t max_entries) -{ - stack_crawl_state_t state; - state.count = max_entries; - state.addrs = (intptr_t*)addrs; - _Unwind_Backtrace(trace_function, (void*)&state); - return max_entries - state.count; -} - -// ============================================================================= -// malloc check functions +// malloc fill functions // ============================================================================= #define CHK_FILL_FREE 0xef #define CHK_SENTINEL_VALUE (char)0xeb -#define CHK_SENTINEL_HEAD_SIZE 16 -#define CHK_SENTINEL_TAIL_SIZE 16 -#define CHK_OVERHEAD_SIZE ( CHK_SENTINEL_HEAD_SIZE + \ - CHK_SENTINEL_TAIL_SIZE + \ - sizeof(size_t) ) - -static void dump_stack_trace() -{ - intptr_t addrs[20]; - int c = get_backtrace(addrs, 20); - char buf[16]; - char tmp[16*20]; - int i; - - tmp[0] = 0; // Need to initialize tmp[0] for the first strcat - for (i=0 ; i=0 ; i--) { - if (buf[i] != CHK_SENTINEL_VALUE) { - assert_log_message( - "*** %s CHECK: buffer %p, size=%lu, " - "corrupted %d bytes after allocation", - func, buffer, bytes, i+1); - return -1; - } - } - - *allocated = bytes; - return 0; -} - - -void* chk_malloc(size_t bytes) -{ - char* buffer = (char*)dlmalloc(bytes + CHK_OVERHEAD_SIZE); - if (buffer) { - memset(buffer, CHK_SENTINEL_VALUE, bytes + CHK_OVERHEAD_SIZE); - size_t offset = dlmalloc_usable_size(buffer) - sizeof(size_t); - *(size_t *)(buffer + offset) = bytes; - buffer += CHK_SENTINEL_HEAD_SIZE; - } - return buffer; -} - -void chk_free(void* mem) -{ - assert_valid_malloc_pointer(mem); - if (mem) { - size_t size; - char* buffer; - - if (chk_mem_check(mem, &size, "FREE") == 0) { - buffer = (char*)mem - CHK_SENTINEL_HEAD_SIZE; - memset(buffer, CHK_FILL_FREE, size + CHK_OVERHEAD_SIZE); - dlfree(buffer); - } - } -} - -void* chk_calloc(size_t n_elements, size_t elem_size) -{ - size_t size; - void* ptr; - - /* Fail on overflow - just to be safe even though this code runs only - * within the debugging C library, not the production one */ - if (n_elements && MAX_SIZE_T / n_elements < elem_size) { - return NULL; - } - size = n_elements * elem_size; - ptr = chk_malloc(size); - if (ptr != NULL) { - memset(ptr, 0, size); - } - return ptr; -} - -void* chk_realloc(void* mem, size_t bytes) -{ - char* buffer; - int ret; - size_t old_bytes = 0; - - assert_valid_malloc_pointer(mem); - - if (mem != NULL && chk_mem_check(mem, &old_bytes, "REALLOC") < 0) - return NULL; - - char* new_buffer = chk_malloc(bytes); - if (mem == NULL) { - return new_buffer; - } - - if (new_buffer) { - if (bytes > old_bytes) - bytes = old_bytes; - memcpy(new_buffer, mem, bytes); - chk_free(mem); - } - - return new_buffer; -} - -void* chk_memalign(size_t alignment, size_t bytes) -{ - // XXX: it's better to use malloc, than being wrong - return chk_malloc(bytes); -} - -// ============================================================================= -// malloc fill functions -// ============================================================================= void* fill_malloc(size_t bytes) { @@ -497,6 +252,9 @@ void* fill_memalign(size_t alignment, size_t bytes) #define MEMALIGN_GUARD ((void*)0xA1A41520) +extern __LIBC_HIDDEN__ +int get_backtrace(intptr_t* addrs, size_t max_entries); + void* leak_malloc(size_t bytes) { // allocate enough space infront of the allocation to store the pointer for @@ -632,12 +390,3 @@ void* leak_memalign(size_t alignment, size_t bytes) } return base; } - -/* Initializes malloc debugging framework. - * See comments on MallocDebugInit in malloc_debug_common.h - */ -int malloc_debug_initialize(void) -{ - // We don't really have anything that requires initialization here. - return 0; -} diff --git a/libc/bionic/malloc_debug_qemu.c b/libc/bionic/malloc_debug_qemu.c index 4b694e9f7..bcbf1e6e7 100644 --- a/libc/bionic/malloc_debug_qemu.c +++ b/libc/bionic/malloc_debug_qemu.c @@ -287,7 +287,7 @@ static void dump_malloc_descriptor(char* str, /* * Logging helper macros. */ -#define debug_log(format, ...) \ +#define qemu_debug_log(format, ...) \ do { \ __libc_android_log_print(ANDROID_LOG_DEBUG, "memcheck", \ (format), ##__VA_ARGS__ ); \ @@ -296,7 +296,7 @@ static void dump_malloc_descriptor(char* str, } \ } while (0) -#define error_log(format, ...) \ +#define qemu_error_log(format, ...) \ do { \ __libc_android_log_print(ANDROID_LOG_ERROR, "memcheck", \ (format), ##__VA_ARGS__ ); \ @@ -305,7 +305,7 @@ static void dump_malloc_descriptor(char* str, } \ } while (0) -#define info_log(format, ...) \ +#define qemu_info_log(format, ...) \ do { \ __libc_android_log_print(ANDROID_LOG_INFO, "memcheck", \ (format), ##__VA_ARGS__ ); \ @@ -692,7 +692,7 @@ memcheck_initialize(int alignment, const char* memcheck_param) notify_qemu_libc_initialized(malloc_pid); - debug_log("Instrumented for pid=%03u: malloc=%p, free=%p, calloc=%p, realloc=%p, memalign=%p", + qemu_debug_log("Instrumented for pid=%03u: malloc=%p, free=%p, calloc=%p, realloc=%p, memalign=%p", malloc_pid, qemu_instrumented_malloc, qemu_instrumented_free, qemu_instrumented_calloc, qemu_instrumented_realloc, qemu_instrumented_memalign); @@ -717,7 +717,7 @@ qemu_instrumented_malloc(size_t bytes) desc.suffix_size = DEFAULT_SUFFIX_SIZE; desc.ptr = dlmalloc(mallocdesc_alloc_size(&desc)); if (desc.ptr == NULL) { - error_log(" malloc(%u): dlmalloc(%u) failed.", + qemu_error_log(" malloc(%u): dlmalloc(%u) failed.", malloc_pid, getpid(), bytes, mallocdesc_alloc_size(&desc)); return NULL; } @@ -797,7 +797,7 @@ qemu_instrumented_calloc(size_t n_elements, size_t elem_size) if (n_elements == 0 || elem_size == 0) { // Just let go zero bytes allocation. - info_log("::: : Zero calloc redir to malloc", + qemu_info_log("::: : Zero calloc redir to malloc", malloc_pid, getpid()); return qemu_instrumented_malloc(0); } @@ -874,14 +874,14 @@ qemu_instrumented_realloc(void* mem, size_t bytes) if (mem == NULL) { // Nothing to realloc. just do regular malloc. - info_log("::: : realloc(%p, %u) redir to malloc", + qemu_info_log("::: : realloc(%p, %u) redir to malloc", malloc_pid, getpid(), mem, bytes); return qemu_instrumented_malloc(bytes); } if (bytes == 0) { // This is a "free" condition. - info_log("::: : realloc(%p, %u) redir to free and malloc", + qemu_info_log("::: : realloc(%p, %u) redir to free and malloc", malloc_pid, getpid(), mem, bytes); qemu_instrumented_free(mem); @@ -977,7 +977,7 @@ qemu_instrumented_memalign(size_t alignment, size_t bytes) if (bytes == 0) { // Just let go zero bytes allocation. - info_log("::: : memalign(%X, %u) redir to malloc", + qemu_info_log("::: : memalign(%X, %u) redir to malloc", malloc_pid, getpid(), alignment, bytes); return qemu_instrumented_malloc(0); } diff --git a/libc/bionic/malloc_debug_stacktrace.c b/libc/bionic/malloc_debug_stacktrace.c new file mode 100644 index 000000000..c71b1c576 --- /dev/null +++ b/libc/bionic/malloc_debug_stacktrace.c @@ -0,0 +1,76 @@ +/* + * Copyright (C) 2012 The Android Open Source Project + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * * Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * * Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in + * the documentation and/or other materials provided with the + * distribution. + * + * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS + * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT + * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS + * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE + * COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, + * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, + * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS + * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED + * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, + * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT + * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF + * SUCH DAMAGE. + */ +#include +#include + +// ============================================================================= +// stack trace functions +// ============================================================================= + +typedef struct +{ + size_t count; + intptr_t* addrs; +} stack_crawl_state_t; + + +/* depends how the system includes define this */ +#ifdef HAVE_UNWIND_CONTEXT_STRUCT +typedef struct _Unwind_Context __unwind_context; +#else +typedef _Unwind_Context __unwind_context; +#endif + +static _Unwind_Reason_Code trace_function(__unwind_context *context, void *arg) +{ + stack_crawl_state_t* state = (stack_crawl_state_t*)arg; + if (state->count) { + intptr_t ip = (intptr_t)_Unwind_GetIP(context); + if (ip) { + state->addrs[0] = ip; + state->addrs++; + state->count--; + return _URC_NO_REASON; + } + } + /* + * If we run out of space to record the address or 0 has been seen, stop + * unwinding the stack. + */ + return _URC_END_OF_STACK; +} + +__LIBC_HIDDEN__ +int get_backtrace(intptr_t* addrs, size_t max_entries) +{ + stack_crawl_state_t state; + state.count = max_entries; + state.addrs = (intptr_t*)addrs; + _Unwind_Backtrace(trace_function, (void*)&state); + return max_entries - state.count; +}