bionic: import heaptracker as chk_malloc

This patch is a rewrite of libc.debug.malloc = 10 (chk_malloc).  It provides
the same features as the original (poison freed memory, detect heap overruns
and underruns), except that it provides more debugging information whenever it
detects a problem.

In addition to the original features, the new chk_malloc() implementation
detects multiple frees within a given range of the last N allocations, N being
configurable via the system property libc.debug.malloc.backlog.

Finally, this patch keeps track of all outstanding memory allocations.  On
program exit, we walk that list and report each outstanding allocation.

(There is support (not enabled) for a scanner thread periodically walks over
the list of outstanding allocations as well as the backlog of recently-freed
allocations, checking for heap-usage errors.)

Feature overview:

  1) memory leaks
  2) multiple frees
  3) use after free
  4) overrun

Implementation:

-- for each allocation, there is a:
  1) stack trace at the time the allocation is made
  2) if the memory is freed, there is also a stack trace at the point
  3) a front and rear guard (fence)
  4) the stack traces are kept together with the allocation

-- the following lists and maintained

  1) all outstanding memory allocations
  3) a backlog of allocations what are freed; when you call free(), instead of
     actually freed, the allocation is moved to this backlog;
  4) when the backlog of allocations gets full, the oldest entry gets evicted
     from it; at that point, the allocation is checked for overruns or
     use-after-free errors, and then actually freed.
  5) when the program exits, the list of outstanding allocations and the
     backlog are inspected for errors, then freed;

To use this, set the following system properties before running the process or
processes you want to inspect:

libc.malloc.debug.backlog # defaults to 100
libc.malloc.debug 10

When a problem is detected, you will see the following on logcat for a multiple
free:

E/libc    ( 7233): +++ ALLOCATION 0x404b9278 SIZE 10 BYTES MULTIPLY FREED!
E/libc    ( 7233): +++ ALLOCATION 0x404b9278 SIZE 10 ALLOCATED HERE:
E/libc    ( 7233): *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
E/libc    ( 7233):      #00  pc 0000c35a  /system/lib/libc_malloc_debug_leak.so
E/libc    ( 7233):      #01  pc 0000c658  /system/lib/libc_malloc_debug_leak.so
E/libc    ( 7233):      #02  pc 00016d80  /system/lib/libc.so
E/libc    ( 7233):      #03  pc 4009647c  /system/bin/malloctest
E/libc    ( 7233):      #04  pc 00016f24  /system/lib/libc.so
E/libc    ( 7233): +++ ALLOCATION 0x404b9278 SIZE 10 FIRST FREED HERE:
E/libc    ( 7233): *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
E/libc    ( 7233):      #00  pc 0000c35a  /system/lib/libc_malloc_debug_leak.so
E/libc    ( 7233):      #01  pc 0000c7d2  /system/lib/libc_malloc_debug_leak.so
E/libc    ( 7233):      #02  pc 00016d94  /system/lib/libc.so
E/libc    ( 7233):      #03  pc 40096490  /system/bin/malloctest
E/libc    ( 7233):      #04  pc 00016f24  /system/lib/libc.so
E/libc    ( 7233): +++ ALLOCATION 0x404b9278 SIZE 10 NOW BEING FREED HERE:
E/libc    ( 7233): *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
E/libc    ( 7233):      #00  pc 0000c35a  /system/lib/libc_malloc_debug_leak.so
E/libc    ( 7233):      #01  pc 0000c6ac  /system/lib/libc_malloc_debug_leak.so
E/libc    ( 7233):      #02  pc 00016d94  /system/lib/libc.so
E/libc    ( 7233):      #03  pc 400964a0  /system/bin/malloctest
E/libc    ( 7233):      #04  pc 00016f24  /system/lib/libc.so

The following for a heap overrun and underrun:

E/libc    ( 7233): +++ REAR GUARD MISMATCH [10, 11)
E/libc    ( 7233): +++ ALLOCATION 0x404b9198 SIZE 10 HAS A CORRUPTED REAR GUARD
E/libc    ( 7233): +++ ALLOCATION 0x404b9198 SIZE 10 ALLOCATED HERE:
E/libc    ( 7233): *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
E/libc    ( 7233):      #00  pc 0000c35a  /system/lib/libc_malloc_debug_leak.so
E/libc    ( 7233):      #01  pc 0000c658  /system/lib/libc_malloc_debug_leak.so
E/libc    ( 7233):      #02  pc 00016d80  /system/lib/libc.so
E/libc    ( 7233):      #03  pc 40096438  /system/bin/malloctest
E/libc    ( 7233):      #04  pc 00016f24  /system/lib/libc.so
E/libc    ( 7233): +++ ALLOCATION 0x404b9198 SIZE 10 FREED HERE:
E/libc    ( 7233): *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
E/libc    ( 7233):      #00  pc 0000c35a  /system/lib/libc_malloc_debug_leak.so
E/libc    ( 7233):      #01  pc 0000c7d2  /system/lib/libc_malloc_debug_leak.so
E/libc    ( 7233):      #02  pc 00016d94  /system/lib/libc.so
E/libc    ( 7233):      #03  pc 40096462  /system/bin/malloctest
E/libc    ( 7233):      #04  pc 00016f24  /system/lib/libc.so
E/libc    ( 7233): +++ ALLOCATION 0x404b9358 SIZE 10 HAS A CORRUPTED FRONT GUARD
E/libc    ( 7233): +++ ALLOCATION 0x404b9358 SIZE 10 ALLOCATED HERE:
E/libc    ( 7233): *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
E/libc    ( 7233):      #00  pc 0000c35a  /system/lib/libc_malloc_debug_leak.so
E/libc    ( 7233):      #01  pc 0000c658  /system/lib/libc_malloc_debug_leak.so
E/libc    ( 7233):      #02  pc 00016d80  /system/lib/libc.so
E/libc    ( 7233):      #03  pc 400964ba  /system/bin/malloctest
E/libc    ( 7233):      #04  pc 00016f24  /system/lib/libc.so
E/libc    ( 7233): +++ ALLOCATION 0x404b9358 SIZE 10 FREED HERE:
E/libc    ( 7233): *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
E/libc    ( 7233):      #00  pc 0000c35a  /system/lib/libc_malloc_debug_leak.so
E/libc    ( 7233):      #01  pc 0000c7d2  /system/lib/libc_malloc_debug_leak.so
E/libc    ( 7233):      #02  pc 00016d94  /system/lib/libc.so
E/libc    ( 7233):      #03  pc 400964e4  /system/bin/malloctest
E/libc    ( 7233):      #04  pc 00016f24  /system/lib/libc.so

The following for a memory leak:

E/libc    ( 7233): +++ THERE ARE 1 LEAKED ALLOCATIONS
E/libc    ( 7233): +++ DELETING 4096 BYTES OF LEAKED MEMORY AT 0x404b95e8 (1 REMAINING)
E/libc    ( 7233): +++ ALLOCATION 0x404b95e8 SIZE 4096 ALLOCATED HERE:
E/libc    ( 7233): *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
E/libc    ( 7233):      #00  pc 0000c35a  /system/lib/libc_malloc_debug_leak.so
E/libc    ( 7233):      #01  pc 0000c658  /system/lib/libc_malloc_debug_leak.so
E/libc    ( 7233):      #02  pc 00016d80  /system/lib/libc.so
E/libc    ( 7233):      #03  pc 0001bc94  /system/lib/libc.so
E/libc    ( 7233):      #04  pc 0001edf6  /system/lib/libc.so
E/libc    ( 7233):      #05  pc 0001b80a  /system/lib/libc.so
E/libc    ( 7233):      #06  pc 0001c086  /system/lib/libc.so
E/libc    ( 7233):      #07  pc 40096402  /system/bin/malloctest
E/libc    ( 7233):      #08  pc 00016f24  /system/lib/libc.so

Change-Id: Ic440e9d05a01e2ea86b25e8998714e88bc2d16e0
Signed-off-by: Iliyan Malchev <malchev@google.com>

1 files changed, 40 insertions, 12 deletions

diff --git a/libc/bionic/malloc_debug_common.c b/libc/bionic/malloc_debug_common.c
index 6837e39..4105ab8 100644
--- a/libc/bionic/malloc_debug_common.c
+++ b/libc/bionic/malloc_debug_common.c
@@ -240,17 +240,6 @@ void* memalign(size_t alignment, size_t bytes) {
 #include <dlfcn.h>
 #include "logd.h"
 
-// =============================================================================
-// log functions
-// =============================================================================
-
-#define debug_log(format, ...)  \
-   __libc_android_log_print(ANDROID_LOG_DEBUG, "libc", (format), ##__VA_ARGS__ )
-#define error_log(format, ...)  \
-   __libc_android_log_print(ANDROID_LOG_ERROR, "libc", (format), ##__VA_ARGS__ )
-#define info_log(format, ...)  \
-   __libc_android_log_print(ANDROID_LOG_INFO, "libc", (format), ##__VA_ARGS__ )
-
 /* Table for dispatching malloc calls, depending on environment. */
 static MallocDebug gMallocUse __attribute__((aligned(32))) = {
     dlmalloc, dlfree, dlcalloc, dlrealloc, dlmemalign
@@ -288,6 +277,14 @@ static void* libc_malloc_impl_handle = NULL;
 #define MALLOC_ALIGNMENT ((size_t)8U)
 #endif  /* MALLOC_ALIGNMENT */
 
+/* This variable is set to the value of property libc.debug.malloc.backlog,
+ * when the value of libc.debug.malloc = 10.  It determines the size of the
+ * backlog we use to detect multiple frees.  If the property is not set, the
+ * backlog length defaults to an internal constant defined in
+ * malloc_debug_check.c
+ */
+unsigned int malloc_double_free_backlog;
+
 /* Initializes memory allocation framework once per process. */
 static void malloc_init_impl(void)
 {
@@ -339,9 +336,17 @@ static void malloc_init_impl(void)
     switch (debug_level) {
         case 1:
         case 5:
-        case 10:
+        case 10: {
+            char debug_backlog[PROP_VALUE_MAX];
+            if (__system_property_get("libc.debug.malloc.backlog", debug_backlog)) {
+                malloc_double_free_backlog = atoi(debug_backlog);
+                info_log("%s: setting backlog length to %d\n",
+                         __progname, malloc_double_free_backlog);
+            }
+
             so_name = "/system/lib/libc_malloc_debug_leak.so";
             break;
+        }
         case 20:
             // Quick check: debug level 20 can only be handled in emulator.
             if (!qemu_running) {
@@ -485,7 +490,19 @@ static void malloc_init_impl(void)
     }
 }
 
+static void malloc_fini_impl(void)
+{
+    if (libc_malloc_impl_handle) {
+        MallocDebugFini malloc_debug_finalize = NULL;
+        malloc_debug_finalize =
+                dlsym(libc_malloc_impl_handle, "malloc_debug_finalize");
+        if (malloc_debug_finalize)
+            malloc_debug_finalize();
+    }
+}
+
 static pthread_once_t  malloc_init_once_ctl = PTHREAD_ONCE_INIT;
+static pthread_once_t  malloc_fini_once_ctl = PTHREAD_ONCE_INIT;
 
 #endif  // !LIBC_STATIC
 #endif  // USE_DL_PREFIX
@@ -504,3 +521,14 @@ void malloc_debug_init(void)
     }
 #endif  // USE_DL_PREFIX && !LIBC_STATIC
 }
+
+void malloc_debug_fini(void)
+{
+    /* We need to finalize malloc iff we implement here custom
+     * malloc routines (i.e. USE_DL_PREFIX is defined) for libc.so */
+#if defined(USE_DL_PREFIX) && !defined(LIBC_STATIC)
+    if (pthread_once(&malloc_fini_once_ctl, malloc_fini_impl)) {
+        error_log("Unable to finalize malloc_debug component.");
+    }
+#endif  // USE_DL_PREFIX && !LIBC_STATIC
+}