/*
**
** Copyright (C) 2008-2011, The Android Open Source Project
**
** Licensed under the Apache License, Version 2.0 (the "License");
** you may not use this file except in compliance with the License.
** You may obtain a copy of the License at
**
** http://www.apache.org/licenses/LICENSE-2.0
**
** Unless required by applicable law or agreed to in writing, software
** distributed under the License is distributed on an "AS IS" BASIS,
** WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
** See the License for the specific language governing permissions and
** limitations under the License.
*/
#include <android/log.h>
#include <pthread.h>
#include <time.h>
#include <stdarg.h>
#include "mapinfo.h"
extern int heaptracker_stacktrace(intptr_t*, size_t);
extern void *__real_malloc(size_t size);
extern void *__real_realloc(void *ptr, size_t size);
extern void *__real_calloc(int nmemb, int size);
extern void __real_free(void *ptr);
static mapinfo *milist;
#define MAX_BACKTRACE_DEPTH 15
#define ALLOCATION_TAG 0x1ee7d00d
#define BACKLOG_TAG 0xbabecafe
#define FREE_POISON 0xa5
#define BACKLOG_MAX 50
#define FRONT_GUARD 0xaa
#define FRONT_GUARD_LEN (1<<4)
#define REAR_GUARD 0xbb
#define REAR_GUARD_LEN (1<<4)
#define SCANNER_SLEEP_S 3
struct hdr {
uint32_t tag;
struct hdr *prev;
struct hdr *next;
intptr_t bt[MAX_BACKTRACE_DEPTH];
int bt_depth;
intptr_t freed_bt[MAX_BACKTRACE_DEPTH];
int freed_bt_depth;
size_t size;
char front_guard[FRONT_GUARD_LEN];
} __attribute__((packed));
struct ftr {
char rear_guard[REAR_GUARD_LEN];
} __attribute__((packed));
static inline struct ftr * to_ftr(struct hdr *hdr)
{
return (struct ftr *)(((char *)(hdr + 1)) + hdr->size);
}
static inline void *user(struct hdr *hdr)
{
return hdr + 1;
}
static inline struct hdr *meta(void *user)
{
return ((struct hdr *)user) - 1;
}
extern int __android_log_vprint(int prio, const char *tag, const char *fmt, va_list ap);
static void default_log(const char *fmt, ...)
{
va_list lst;
va_start(lst, fmt);
__android_log_vprint(ANDROID_LOG_ERROR, "DEBUG", fmt, lst);
va_end(lst);
}
/* Override this for non-printf reporting */
void (*malloc_log)(const char *fmt, ...) = default_log;
/* Call this ad dlclose() to get leaked memory */
void free_leaked_memory(void);
static unsigned num;
static struct hdr *first;
static struct hdr *last;
static pthread_rwlock_t lock = PTHREAD_RWLOCK_INITIALIZER;
static unsigned backlog_num;
static struct hdr *backlog_first;
static struct hdr *backlog_last;
static pthread_rwlock_t backlog_lock = PTHREAD_RWLOCK_INITIALIZER;
void print_backtrace(const intptr_t *bt, int depth)
{
mapinfo *mi;
int cnt, rel_pc;
intptr_t self_bt[MAX_BACKTRACE_DEPTH];
if (!bt) {
depth = heaptracker_stacktrace(self_bt, MAX_BACKTRACE_DEPTH);
bt = self_bt;
}
malloc_log("*** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***\n");
for (cnt = 0; cnt < depth && cnt < MAX_BACKTRACE_DEPTH; cnt++) {
mi = pc_to_mapinfo(milist, bt[cnt], &rel_pc);
malloc_log("\t#%02d pc %08x %s\n", cnt,
mi ? rel_pc : bt[cnt],
mi ? mi->name : "(unknown)");
}
}
static inline void init_front_guard(struct hdr *hdr)
{
memset(hdr->front_guard, FRONT_GUARD, FRONT_GUARD_LEN);
}
static inline int is_front_guard_valid(struct hdr *hdr)
{
unsigned i;
for (i = 0; i < FRONT_GUARD_LEN; i++)
if (hdr->front_guard[i] != FRONT_GUARD)
return 0;
return 1;
}
static inline void init_rear_guard(struct hdr *hdr)
{
struct ftr *ftr = to_ftr(hdr);
memset(ftr->rear_guard, REAR_GUARD, REAR_GUARD_LEN);
}
static inline int is_rear_guard_valid(struct hdr *hdr)
{
unsigned i;
int valid = 1;
int first_mismatch = -1;
struct ftr *ftr = to_ftr(hdr);
for (i = 0; i < REAR_GUARD_LEN; i++) {
if (ftr->rear_guard[i] != REAR_GUARD) {
if (first_mismatch < 0)
first_mismatch = i;
valid = 0;
}
else if (first_mismatch >= 0) {
malloc_log("+++ REAR GUARD MISMATCH [%d, %d)\n", first_mismatch, i);
first_mismatch = -1;
}
}
if (first_mismatch >= 0)
malloc_log("+++ REAR GUARD MISMATCH [%d, %d)\n", first_mismatch, i);
return valid;
}
static inline void __add(struct hdr *hdr, struct hdr **first, struct hdr **last)
{
hdr->prev = 0;
hdr->next = *last;
if (*last)
(*last)->prev = hdr;
else
*first = hdr;
*last = hdr;
}
static inline int __del(struct hdr *hdr, struct hdr **first, struct hdr **last)
{
if (hdr->prev)
hdr->prev->next = hdr->next;
else
*last = hdr->next;
if (hdr->next)
hdr->next->prev = hdr->prev;
else
*first = hdr->prev;
return 0;
}
static inline void add(struct hdr *hdr, size_t size)
{
pthread_rwlock_wrlock(&lock);
hdr->tag = ALLOCATION_TAG;
hdr->size = size;
init_front_guard(hdr);
init_rear_guard(hdr);
num++;
__add(hdr, &first, &last);
pthread_rwlock_unlock(&lock);
}
static inline int del(struct hdr *hdr)
{
if (hdr->tag != ALLOCATION_TAG)
return -1;
pthread_rwlock_wrlock(&lock);
__del(hdr, &first, &last);
num--;
pthread_rwlock_unlock(&lock);
return 0;
}
static inline void poison(struct hdr *hdr)
{
memset(user(hdr), FREE_POISON, hdr->size);
}
static int was_used_after_free(struct hdr *hdr)
{
unsigned i;
const char *data = (const char *)user(hdr);
for (i = 0; i < hdr->size; i++)
if (data[i] != FREE_POISON)
return 1;
return 0;
}
/* returns 1 if valid, *safe == 1 if safe to dump stack */
static inline int check_guards(struct hdr *hdr, int *safe)
{
*safe = 1;
if (!is_front_guard_valid(hdr)) {
if (hdr->front_guard[0] == FRONT_GUARD) {
malloc_log("+++ ALLOCATION %p SIZE %d HAS A CORRUPTED FRONT GUARD\n",
user(hdr), hdr->size);
} else {
malloc_log("+++ ALLOCATION %p HAS A CORRUPTED FRONT GUARD "\
"(NOT DUMPING STACKTRACE)\n", user(hdr));
/* Allocation header is probably corrupt, do not print stack trace */
*safe = 0;
}
return 0;
}
if (!is_rear_guard_valid(hdr)) {
malloc_log("+++ ALLOCATION %p SIZE %d HAS A CORRUPTED REAR GUARD\n",
user(hdr), hdr->size);
return 0;
}
return 1;
}
/* returns 1 if valid, *safe == 1 if safe to dump stack */
static inline int __check_allocation(struct hdr *hdr, int *safe)
{
int valid = 1;
*safe = 1;
if (hdr->tag != ALLOCATION_TAG && hdr->tag != BACKLOG_TAG) {
malloc_log("+++ ALLOCATION %p HAS INVALID TAG %08x (NOT DUMPING STACKTRACE)\n",
user(hdr), hdr->tag);
/* Allocation header is probably corrupt, do not dequeue or dump stack
* trace.
*/
*safe = 0;
return 0;
}
if (hdr->tag == BACKLOG_TAG && was_used_after_free(hdr)) {
malloc_log("+++ ALLOCATION %p SIZE %d WAS USED AFTER BEING FREED\n",
user(hdr), hdr->size);
valid = 0;
/* check the guards to see if it's safe to dump a stack trace */
(void)check_guards(hdr, safe);
}
else
valid = check_guards(hdr, safe);
if (!valid && *safe) {
malloc_log("+++ ALLOCATION %p SIZE %d ALLOCATED HERE:\n",
user(hdr), hdr->size);
print_backtrace(hdr->bt, hdr->bt_depth);
if (hdr->tag == BACKLOG_TAG) {
malloc_log("+++ ALLOCATION %p SIZE %d FREED HERE:\n",
user(hdr), hdr->size);
print_backtrace(hdr->freed_bt, hdr->freed_bt_depth);
}
}
return valid;
}
static inline int __del_and_check(struct hdr *hdr,
struct hdr **first, struct hdr **last, unsigned *cnt,
int *safe)
{
int valid;
valid = __check_allocation(hdr, safe);
if (safe) {
(*cnt)--;
__del(hdr, first, last);
}
return valid;
}
static inline void __del_from_backlog(struct hdr *hdr)
{
int safe;
(void)__del_and_check(hdr,
&backlog_first, &backlog_last, &backlog_num,
&safe);
hdr->tag = 0; /* clear the tag */
}
static inline void del_from_backlog(struct hdr *hdr)
{
pthread_rwlock_wrlock(&backlog_lock);
__del_from_backlog(hdr);
pthread_rwlock_unlock(&backlog_lock);
}
static inline int del_leak(struct hdr *hdr, int *safe)
{
int valid;
pthread_rwlock_wrlock(&lock);
valid = __del_and_check(hdr,
&first, &last, &num,
safe);
pthread_rwlock_unlock(&lock);
return valid;
}
static inline void add_to_backlog(struct hdr *hdr)
{
pthread_rwlock_wrlock(&backlog_lock);
hdr->tag = BACKLOG_TAG;
backlog_num++;
__add(hdr, &backlog_first, &backlog_last);
poison(hdr);
/* If we've exceeded the maximum backlog, clear it up */
while (backlog_num > BACKLOG_MAX) {
struct hdr *gone = backlog_first;
__del_from_backlog(gone);
__real_free(gone);
}
pthread_rwlock_unlock(&backlog_lock);
}
void* __wrap_malloc(size_t size)
{
// malloc_tracker_log("%s: %s\n", __FILE__, __FUNCTION__);
struct hdr *hdr = __real_malloc(sizeof(struct hdr) + size +
sizeof(struct ftr));
if (hdr) {
hdr->bt_depth = heaptracker_stacktrace(
hdr->bt, MAX_BACKTRACE_DEPTH);
add(hdr, size);
return user(hdr);
}
return NULL;
}
void __wrap_free(void *ptr)
{
struct hdr *hdr;
if (!ptr) /* ignore free(NULL) */
return;
hdr = meta(ptr);
if (del(hdr) < 0) {
intptr_t bt[MAX_BACKTRACE_DEPTH];
int depth;
depth = heaptracker_stacktrace(bt, MAX_BACKTRACE_DEPTH);
if (hdr->tag == BACKLOG_TAG) {
malloc_log("+++ ALLOCATION %p SIZE %d BYTES MULTIPLY FREED!\n",
user(hdr), hdr->size);
malloc_log("+++ ALLOCATION %p SIZE %d ALLOCATED HERE:\n",
user(hdr), hdr->size);
print_backtrace(hdr->bt, hdr->bt_depth);
/* hdr->freed_bt_depth should be nonzero here */
malloc_log("+++ ALLOCATION %p SIZE %d FIRST FREED HERE:\n",
user(hdr), hdr->size);
print_backtrace(hdr->freed_bt, hdr->freed_bt_depth);
malloc_log("+++ ALLOCATION %p SIZE %d NOW BEING FREED HERE:\n",
user(hdr), hdr->size);
print_backtrace(bt, depth);
}
else {
malloc_log("+++ ALLOCATION %p IS CORRUPTED OR NOT ALLOCATED VIA TRACKER!\n",
user(hdr));
print_backtrace(bt, depth);
/* Leak here so that we do not crash */
//__real_free(user(hdr));
}
}
else {
hdr->freed_bt_depth = heaptracker_stacktrace(hdr->freed_bt,
MAX_BACKTRACE_DEPTH);
add_to_backlog(hdr);
}
}
void *__wrap_realloc(void *ptr, size_t size)
{
struct hdr *hdr;
if (!size) {
__wrap_free(ptr);
return NULL;
}
if (!ptr)
return __wrap_malloc(size);
hdr = meta(ptr);
// malloc_log("%s: %s\n", __FILE__, __FUNCTION__);
if (del(hdr) < 0) {
intptr_t bt[MAX_BACKTRACE_DEPTH];
int depth;
depth = heaptracker_stacktrace(bt, MAX_BACKTRACE_DEPTH);
if (hdr->tag == BACKLOG_TAG) {
malloc_log("+++ REALLOCATION %p SIZE %d OF FREED MEMORY!\n",
user(hdr), size, hdr->size);
malloc_log("+++ ALLOCATION %p SIZE %d ALLOCATED HERE:\n",
user(hdr), hdr->size);
print_backtrace(hdr->bt, hdr->bt_depth);
/* hdr->freed_bt_depth should be nonzero here */
malloc_log("+++ ALLOCATION %p SIZE %d FIRST FREED HERE:\n",
user(hdr), hdr->size);
print_backtrace(hdr->freed_bt, hdr->freed_bt_depth);
malloc_log("+++ ALLOCATION %p SIZE %d NOW BEING REALLOCATED HERE:\n",
user(hdr), hdr->size);
print_backtrace(bt, depth);
/* We take the memory out of the backlog and fall through so the
* reallocation below succeeds. Since we didn't really free it, we
* can default to this behavior.
*/
del_from_backlog(hdr);
}
else {
malloc_log("+++ REALLOCATION %p SIZE %d IS CORRUPTED OR NOT ALLOCATED VIA TRACKER!\n",
user(hdr), size);
print_backtrace(bt, depth);
// just get a whole new allocation and leak the old one
return __real_realloc(0, size);
// return __real_realloc(user(hdr), size); // assuming it was allocated externally
}
}
hdr = __real_realloc(hdr, sizeof(struct hdr) + size + sizeof(struct ftr));
if (hdr) {
hdr->bt_depth = heaptracker_stacktrace(hdr->bt, MAX_BACKTRACE_DEPTH);
add(hdr, size);
return user(hdr);
}
return NULL;
}
void *__wrap_calloc(int nmemb, size_t size)
{
// malloc_tracker_log("%s: %s\n", __FILE__, __FUNCTION__);
struct hdr *hdr;
size_t __size = nmemb * size;
hdr = __real_calloc(1, sizeof(struct hdr) + __size + sizeof(struct ftr));
if (hdr) {
hdr->bt_depth = heaptracker_stacktrace(
hdr->bt, MAX_BACKTRACE_DEPTH);
add(hdr, __size);
return user(hdr);
}
return NULL;
}
void heaptracker_free_leaked_memory(void)
{
struct hdr *del; int cnt;
if (num)
malloc_log("+++ THERE ARE %d LEAKED ALLOCATIONS\n", num);
while (last) {
int safe;
del = last;
malloc_log("+++ DELETING %d BYTES OF LEAKED MEMORY AT %p (%d REMAINING)\n",
del->size, user(del), num);
if (del_leak(del, &safe)) {
/* safe == 1, because the allocation is valid */
malloc_log("+++ ALLOCATION %p SIZE %d ALLOCATED HERE:\n",
user(del), del->size);
print_backtrace(del->bt, del->bt_depth);
}
__real_free(del);
}
// malloc_log("+++ DELETING %d BACKLOGGED ALLOCATIONS\n", backlog_num);
while (backlog_last) {
del = backlog_first;
del_from_backlog(del);
__real_free(del);
}
}
static int check_list(struct hdr *list, pthread_rwlock_t *rwlock)
{
struct hdr *hdr;
int safe, num_checked;
pthread_rwlock_rdlock(rwlock);
num_checked = 0;
hdr = list;
while (hdr) {
(void)__check_allocation(hdr, &safe);
hdr = hdr->next;
num_checked++;
}
pthread_rwlock_unlock(rwlock);
return num_checked;
}
static pthread_t scanner_thread;
static pthread_cond_t scanner_cond = PTHREAD_COND_INITIALIZER;
static int scanner_stop;
static pthread_mutex_t scanner_lock = PTHREAD_MUTEX_INITIALIZER;
static void* scanner(void *data __attribute__((unused)))
{
struct timespec ts;
int num_checked, num_checked_backlog;
while (1) {
num_checked = check_list(last, &lock);
num_checked_backlog = check_list(backlog_last, &backlog_lock);
// malloc_log("@@@ scanned %d/%d allocs and %d/%d freed\n",
// num_checked, num,
// num_checked_backlog, backlog_num);
pthread_mutex_lock(&scanner_lock);
if (!scanner_stop) {
clock_gettime(CLOCK_REALTIME, &ts);
ts.tv_sec += SCANNER_SLEEP_S;
pthread_cond_timedwait(&scanner_cond, &scanner_lock, &ts);
}
if (scanner_stop) {
pthread_mutex_unlock(&scanner_lock);
break;
}
pthread_mutex_unlock(&scanner_lock);
}
// malloc_log("@@@ scanner thread exiting");
return NULL;
}
static void init(void) __attribute__((constructor));
static void init(void)
{
// malloc_log("@@@ start scanner thread");
milist = init_mapinfo(getpid());
pthread_create(&scanner_thread,
NULL,
scanner,
NULL);
}
static void deinit(void) __attribute__((destructor));
static void deinit(void)
{
// malloc_log("@@@ signal stop to scanner thread");
pthread_mutex_lock(&scanner_lock);
scanner_stop = 1;
pthread_cond_signal(&scanner_cond);
pthread_mutex_unlock(&scanner_lock);
// malloc_log("@@@ wait for scanner thread to exit");
pthread_join(scanner_thread, NULL);
// malloc_log("@@@ scanner thread stopped");
heaptracker_free_leaked_memory();
deinit_mapinfo(milist);
}