heaptracker.c

/*
**
** Copyright (C) 2008-2011, The Android Open Source Project
**
** Licensed under the Apache License, Version 2.0 (the "License");
** you may not use this file except in compliance with the License.
** You may obtain a copy of the License at
**
**     http://www.apache.org/licenses/LICENSE-2.0
**
** Unless required by applicable law or agreed to in writing, software
** distributed under the License is distributed on an "AS IS" BASIS,
** WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
** See the License for the specific language governing permissions and
** limitations under the License.
*/

#include <android/log.h>
#include <pthread.h>
#include <time.h>
#include <stdarg.h>

#include "mapinfo.h"

extern int heaptracker_stacktrace(intptr_t*, size_t);
extern void *__real_malloc(size_t size);
extern void *__real_realloc(void *ptr, size_t size);
extern void *__real_calloc(int nmemb, int size);
extern void __real_free(void *ptr);

static mapinfo *milist;

#define MAX_BACKTRACE_DEPTH 15
#define ALLOCATION_TAG      0x1ee7d00d
#define BACKLOG_TAG         0xbabecafe
#define FREE_POISON         0xa5
#define BACKLOG_MAX         50
#define FRONT_GUARD         0xaa
#define FRONT_GUARD_LEN     (1<<4)
#define REAR_GUARD          0xbb
#define REAR_GUARD_LEN      (1<<4)
#define SCANNER_SLEEP_S     3

struct hdr {
    uint32_t tag;
    struct hdr *prev;
    struct hdr *next;
    intptr_t bt[MAX_BACKTRACE_DEPTH];
    int bt_depth;
    intptr_t freed_bt[MAX_BACKTRACE_DEPTH];
    int freed_bt_depth;
    size_t size;
    char front_guard[FRONT_GUARD_LEN];
} __attribute__((packed));

struct ftr {
    char rear_guard[REAR_GUARD_LEN];
} __attribute__((packed));

static inline struct ftr * to_ftr(struct hdr *hdr)
{
    return (struct ftr *)(((char *)(hdr + 1)) + hdr->size);
}

static inline void *user(struct hdr *hdr)
{
    return hdr + 1;
}

static inline struct hdr *meta(void *user)
{
    return ((struct hdr *)user) - 1;
}

extern int __android_log_vprint(int prio, const char *tag, const char *fmt, va_list ap);
static void default_log(const char *fmt, ...)
{
    va_list lst;
    va_start(lst, fmt);
    __android_log_vprint(ANDROID_LOG_ERROR, "DEBUG", fmt, lst);
    va_end(lst);
}

/* Override this for non-printf reporting */
void (*malloc_log)(const char *fmt, ...) = default_log;
/* Call this ad dlclose() to get leaked memory */
void free_leaked_memory(void);

static unsigned num;
static struct hdr *first;
static struct hdr *last;
static pthread_rwlock_t lock = PTHREAD_RWLOCK_INITIALIZER;

static unsigned backlog_num;
static struct hdr *backlog_first;
static struct hdr *backlog_last;
static pthread_rwlock_t backlog_lock = PTHREAD_RWLOCK_INITIALIZER;

void print_backtrace(const intptr_t *bt, int depth)
{
    mapinfo *mi;
    int cnt, rel_pc;
    intptr_t self_bt[MAX_BACKTRACE_DEPTH];

    if (!bt) {
        depth = heaptracker_stacktrace(self_bt, MAX_BACKTRACE_DEPTH);
        bt = self_bt;
    }

    malloc_log("*** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***\n");
    for (cnt = 0; cnt < depth && cnt < MAX_BACKTRACE_DEPTH; cnt++) {
        mi = pc_to_mapinfo(milist, bt[cnt], &rel_pc);
        malloc_log("\t#%02d  pc %08x  %s\n", cnt,
                   mi ? rel_pc : bt[cnt],
                   mi ? mi->name : "(unknown)");
    }
}

static inline void init_front_guard(struct hdr *hdr)
{
    memset(hdr->front_guard, FRONT_GUARD, FRONT_GUARD_LEN);
}

static inline int is_front_guard_valid(struct hdr *hdr)
{
    unsigned i;
    for (i = 0; i < FRONT_GUARD_LEN; i++)
        if (hdr->front_guard[i] != FRONT_GUARD)
            return 0;
    return 1;
}

static inline void init_rear_guard(struct hdr *hdr)
{
    struct ftr *ftr = to_ftr(hdr);
    memset(ftr->rear_guard, REAR_GUARD, REAR_GUARD_LEN);
}

static inline int is_rear_guard_valid(struct hdr *hdr)
{
    unsigned i;
    int valid = 1;
    int first_mismatch = -1;
    struct ftr *ftr = to_ftr(hdr);
    for (i = 0; i < REAR_GUARD_LEN; i++) {
        if (ftr->rear_guard[i] != REAR_GUARD) {
            if (first_mismatch < 0)
                first_mismatch = i;
            valid = 0;
        }
        else if (first_mismatch >= 0) {
            malloc_log("+++ REAR GUARD MISMATCH [%d, %d)\n", first_mismatch, i);
            first_mismatch = -1;
        }
    }

    if (first_mismatch >= 0)
        malloc_log("+++ REAR GUARD MISMATCH [%d, %d)\n", first_mismatch, i);
    return valid;
}

static inline void __add(struct hdr *hdr, struct hdr **first, struct hdr **last)
{
    hdr->prev = 0;
    hdr->next = *last;
    if (*last)
        (*last)->prev = hdr;
    else
        *first = hdr;
    *last = hdr;
}

static inline int __del(struct hdr *hdr, struct hdr **first, struct hdr **last)
{
    if (hdr->prev)
        hdr->prev->next = hdr->next;
    else
        *last = hdr->next;
    if (hdr->next)
        hdr->next->prev = hdr->prev;
    else
        *first = hdr->prev;
    return 0;
}

static inline void add(struct hdr *hdr, size_t size)
{
    pthread_rwlock_wrlock(&lock);
    hdr->tag = ALLOCATION_TAG;
    hdr->size = size;
    init_front_guard(hdr);
    init_rear_guard(hdr);
    num++;
    __add(hdr, &first, &last);
    pthread_rwlock_unlock(&lock);
}

static inline int del(struct hdr *hdr)
{
    if (hdr->tag != ALLOCATION_TAG)
        return -1;

    pthread_rwlock_wrlock(&lock);
    __del(hdr, &first, &last);
    num--;
    pthread_rwlock_unlock(&lock);
    return 0;
}

static inline void poison(struct hdr *hdr)
{
    memset(user(hdr), FREE_POISON, hdr->size);
}

static int was_used_after_free(struct hdr *hdr)
{
    unsigned i;
    const char *data = (const char *)user(hdr);
    for (i = 0; i < hdr->size; i++)
        if (data[i] != FREE_POISON)
            return 1;
    return 0;
}

/* returns 1 if valid, *safe == 1 if safe to dump stack */
static inline int check_guards(struct hdr *hdr, int *safe)
{
    *safe = 1;
    if (!is_front_guard_valid(hdr)) {
        if (hdr->front_guard[0] == FRONT_GUARD) {
            malloc_log("+++ ALLOCATION %p SIZE %d HAS A CORRUPTED FRONT GUARD\n",
                       user(hdr), hdr->size);
        } else {
            malloc_log("+++ ALLOCATION %p HAS A CORRUPTED FRONT GUARD "\
                      "(NOT DUMPING STACKTRACE)\n", user(hdr));
            /* Allocation header is probably corrupt, do not print stack trace */
            *safe = 0;
        }
        return 0;
    }

    if (!is_rear_guard_valid(hdr)) {
        malloc_log("+++ ALLOCATION %p SIZE %d HAS A CORRUPTED REAR GUARD\n",
                   user(hdr), hdr->size);
        return 0;
    }

    return 1;
}

/* returns 1 if valid, *safe == 1 if safe to dump stack */
static inline int __check_allocation(struct hdr *hdr, int *safe)
{
    int valid = 1;
    *safe = 1;

    if (hdr->tag != ALLOCATION_TAG && hdr->tag != BACKLOG_TAG) {
        malloc_log("+++ ALLOCATION %p HAS INVALID TAG %08x (NOT DUMPING STACKTRACE)\n",
                   user(hdr), hdr->tag);
	/* Allocation header is probably corrupt, do not dequeue or dump stack
         * trace.
         */
        *safe = 0;
        return 0;
    }

    if (hdr->tag == BACKLOG_TAG && was_used_after_free(hdr)) {
        malloc_log("+++ ALLOCATION %p SIZE %d WAS USED AFTER BEING FREED\n",
                   user(hdr), hdr->size);
        valid = 0;
	/* check the guards to see if it's safe to dump a stack trace */
        (void)check_guards(hdr, safe);
    }
    else
        valid = check_guards(hdr, safe);

    if (!valid && *safe) {
        malloc_log("+++ ALLOCATION %p SIZE %d ALLOCATED HERE:\n",
                        user(hdr), hdr->size);
        print_backtrace(hdr->bt, hdr->bt_depth);
        if (hdr->tag == BACKLOG_TAG) {
            malloc_log("+++ ALLOCATION %p SIZE %d FREED HERE:\n",
                       user(hdr), hdr->size);
            print_backtrace(hdr->freed_bt, hdr->freed_bt_depth);
        }
    }

    return valid;
}

static inline int __del_and_check(struct hdr *hdr,
                                   struct hdr **first, struct hdr **last, unsigned *cnt,
                                   int *safe)
{
    int valid;
    valid = __check_allocation(hdr, safe);
    if (safe) {
        (*cnt)--;
        __del(hdr, first, last);
    }
    return valid;
}

static inline void __del_from_backlog(struct hdr *hdr)
{
        int safe;
        (void)__del_and_check(hdr,
                              &backlog_first, &backlog_last, &backlog_num,
                              &safe);
        hdr->tag = 0; /* clear the tag */
}

static inline void del_from_backlog(struct hdr *hdr)
{
    pthread_rwlock_wrlock(&backlog_lock);
    __del_from_backlog(hdr);
    pthread_rwlock_unlock(&backlog_lock);
}

static inline int del_leak(struct hdr *hdr, int *safe)
{
    int valid;
    pthread_rwlock_wrlock(&lock);
    valid = __del_and_check(hdr,
                            &first, &last, &num,
                            safe);
    pthread_rwlock_unlock(&lock);
    return valid;
}

static inline void add_to_backlog(struct hdr *hdr)
{
    pthread_rwlock_wrlock(&backlog_lock);
    hdr->tag = BACKLOG_TAG;
    backlog_num++;
    __add(hdr, &backlog_first, &backlog_last);
    poison(hdr);
    /* If we've exceeded the maximum backlog, clear it up */
    while (backlog_num > BACKLOG_MAX) {
        struct hdr *gone = backlog_first;
        __del_from_backlog(gone);
        __real_free(gone);
    }
    pthread_rwlock_unlock(&backlog_lock);
}

void* __wrap_malloc(size_t size)
{
//  malloc_tracker_log("%s: %s\n", __FILE__, __FUNCTION__);
    struct hdr *hdr = __real_malloc(sizeof(struct hdr) + size +
                                    sizeof(struct ftr));
    if (hdr) {
        hdr->bt_depth = heaptracker_stacktrace(
                            hdr->bt, MAX_BACKTRACE_DEPTH);
        add(hdr, size);
        return user(hdr);
    }
    return NULL;
}

void __wrap_free(void *ptr)
{
    struct hdr *hdr;
    if (!ptr) /* ignore free(NULL) */
        return;

    hdr = meta(ptr);

    if (del(hdr) < 0) {
        intptr_t bt[MAX_BACKTRACE_DEPTH];
        int depth;
        depth = heaptracker_stacktrace(bt, MAX_BACKTRACE_DEPTH);
        if (hdr->tag == BACKLOG_TAG) {
            malloc_log("+++ ALLOCATION %p SIZE %d BYTES MULTIPLY FREED!\n",
                       user(hdr), hdr->size);
            malloc_log("+++ ALLOCATION %p SIZE %d ALLOCATED HERE:\n",
                       user(hdr), hdr->size);
            print_backtrace(hdr->bt, hdr->bt_depth);
            /* hdr->freed_bt_depth should be nonzero here */
            malloc_log("+++ ALLOCATION %p SIZE %d FIRST FREED HERE:\n",
                       user(hdr), hdr->size);
            print_backtrace(hdr->freed_bt, hdr->freed_bt_depth);
            malloc_log("+++ ALLOCATION %p SIZE %d NOW BEING FREED HERE:\n",
                       user(hdr), hdr->size);
            print_backtrace(bt, depth);
        }
        else {
            malloc_log("+++ ALLOCATION %p IS CORRUPTED OR NOT ALLOCATED VIA TRACKER!\n",
                       user(hdr));
            print_backtrace(bt, depth);
            /* Leak here so that we do not crash */
            //__real_free(user(hdr));
        }
    }
    else {
        hdr->freed_bt_depth = heaptracker_stacktrace(hdr->freed_bt,
                                      MAX_BACKTRACE_DEPTH);
        add_to_backlog(hdr);
    }
}

void *__wrap_realloc(void *ptr, size_t size)
{
    struct hdr *hdr;

    if (!size) {
        __wrap_free(ptr);
        return NULL;
    }

    if (!ptr)
        return __wrap_malloc(size);

    hdr = meta(ptr);

//  malloc_log("%s: %s\n", __FILE__, __FUNCTION__);
    if (del(hdr) < 0) {
        intptr_t bt[MAX_BACKTRACE_DEPTH];
        int depth;
        depth = heaptracker_stacktrace(bt, MAX_BACKTRACE_DEPTH);
        if (hdr->tag == BACKLOG_TAG) {
            malloc_log("+++ REALLOCATION %p SIZE %d OF FREED MEMORY!\n",
                       user(hdr), size, hdr->size);
            malloc_log("+++ ALLOCATION %p SIZE %d ALLOCATED HERE:\n",
                       user(hdr), hdr->size);
            print_backtrace(hdr->bt, hdr->bt_depth);
            /* hdr->freed_bt_depth should be nonzero here */
            malloc_log("+++ ALLOCATION %p SIZE %d FIRST FREED HERE:\n",
                       user(hdr), hdr->size);
            print_backtrace(hdr->freed_bt, hdr->freed_bt_depth);
            malloc_log("+++ ALLOCATION %p SIZE %d NOW BEING REALLOCATED HERE:\n",
                       user(hdr), hdr->size);
            print_backtrace(bt, depth);

	    /* We take the memory out of the backlog and fall through so the
	     * reallocation below succeeds.  Since we didn't really free it, we
	     * can default to this behavior.
             */
            del_from_backlog(hdr);
        }
        else {
            malloc_log("+++ REALLOCATION %p SIZE %d IS CORRUPTED OR NOT ALLOCATED VIA TRACKER!\n",
                       user(hdr), size);
            print_backtrace(bt, depth);
            // just get a whole new allocation and leak the old one
            return __real_realloc(0, size);
            // return __real_realloc(user(hdr), size); // assuming it was allocated externally
        }
    }
 
    hdr = __real_realloc(hdr, sizeof(struct hdr) + size + sizeof(struct ftr));
    if (hdr) {
        hdr->bt_depth = heaptracker_stacktrace(hdr->bt, MAX_BACKTRACE_DEPTH);
        add(hdr, size);
        return user(hdr);
    }

    return NULL;
}

void *__wrap_calloc(int nmemb, size_t size)
{
//  malloc_tracker_log("%s: %s\n", __FILE__, __FUNCTION__);
    struct hdr *hdr;
    size_t __size = nmemb * size;
    hdr = __real_calloc(1, sizeof(struct hdr) + __size + sizeof(struct ftr));
    if (hdr) {
        hdr->bt_depth = heaptracker_stacktrace(
                            hdr->bt, MAX_BACKTRACE_DEPTH);
        add(hdr, __size);
        return user(hdr);
    }
    return NULL;
}

void heaptracker_free_leaked_memory(void)
{
    struct hdr *del; int cnt;

    if (num)
        malloc_log("+++ THERE ARE %d LEAKED ALLOCATIONS\n", num);

    while (last) {
        int safe;
        del = last;
        malloc_log("+++ DELETING %d BYTES OF LEAKED MEMORY AT %p (%d REMAINING)\n",
                del->size, user(del), num);
        if (del_leak(del, &safe)) {
            /* safe == 1, because the allocation is valid */
            malloc_log("+++ ALLOCATION %p SIZE %d ALLOCATED HERE:\n",
                        user(del), del->size);
            print_backtrace(del->bt, del->bt_depth);
        }
        __real_free(del);
    }

//  malloc_log("+++ DELETING %d BACKLOGGED ALLOCATIONS\n", backlog_num);
    while (backlog_last) {
	del = backlog_first;
        del_from_backlog(del);
        __real_free(del);
    }
}

static int check_list(struct hdr *list, pthread_rwlock_t *rwlock)
{
    struct hdr *hdr;
    int safe, num_checked;

    pthread_rwlock_rdlock(rwlock);
    num_checked = 0;
    hdr = list;
    while (hdr) {
        (void)__check_allocation(hdr, &safe);
        hdr = hdr->next;
        num_checked++;
    }
    pthread_rwlock_unlock(rwlock);

    return num_checked;
}

static pthread_t scanner_thread;
static pthread_cond_t scanner_cond = PTHREAD_COND_INITIALIZER;
static int scanner_stop;
static pthread_mutex_t scanner_lock = PTHREAD_MUTEX_INITIALIZER;

static void* scanner(void *data __attribute__((unused)))
{
    struct timespec ts;
    int num_checked, num_checked_backlog;

    while (1) {
        num_checked = check_list(last, &lock);
        num_checked_backlog = check_list(backlog_last, &backlog_lock);

//      malloc_log("@@@ scanned %d/%d allocs and %d/%d freed\n",
//                 num_checked, num,
//                 num_checked_backlog, backlog_num);

        pthread_mutex_lock(&scanner_lock);
        if (!scanner_stop) {
            clock_gettime(CLOCK_REALTIME, &ts);
            ts.tv_sec += SCANNER_SLEEP_S;
            pthread_cond_timedwait(&scanner_cond, &scanner_lock, &ts);
        }
        if (scanner_stop) {
            pthread_mutex_unlock(&scanner_lock);
            break;
        }
        pthread_mutex_unlock(&scanner_lock);
    }

//  malloc_log("@@@ scanner thread exiting");
    return NULL;
}

static void init(void) __attribute__((constructor));
static void init(void)
{
//  malloc_log("@@@ start scanner thread");
    milist = init_mapinfo(getpid());
    pthread_create(&scanner_thread,
                   NULL,
                   scanner,
                   NULL);
}

static void deinit(void) __attribute__((destructor));
static void deinit(void)
{
//  malloc_log("@@@ signal stop to scanner thread");
    pthread_mutex_lock(&scanner_lock);
    scanner_stop = 1;
    pthread_cond_signal(&scanner_cond);
    pthread_mutex_unlock(&scanner_lock);
//  malloc_log("@@@ wait for scanner thread to exit");
    pthread_join(scanner_thread, NULL);
//  malloc_log("@@@ scanner thread stopped");

    heaptracker_free_leaked_memory();
    deinit_mapinfo(milist);
}