Clean up warnings in the malloc_debug_* files.
Also clean up cpplint.py-detected lint.
Change-Id: Ia18e89c4c6878764f8d7ed34b8247e7a8d8fe88b
diff --git a/libc/bionic/malloc_debug_check.cpp b/libc/bionic/malloc_debug_check.cpp
new file mode 100644
index 0000000..9e6d92e
--- /dev/null
+++ b/libc/bionic/malloc_debug_check.cpp
@@ -0,0 +1,518 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ * * Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in
+ * the documentation and/or other materials provided with the
+ * distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
+ * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ * COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
+ * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
+ * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
+ * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+ * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
+ * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include <errno.h>
+#include <pthread.h>
+#include <time.h>
+#include <stdio.h>
+#include <arpa/inet.h>
+#include <sys/socket.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+#include <errno.h>
+#include <stddef.h>
+#include <stdarg.h>
+#include <fcntl.h>
+#include <unwind.h>
+#include <dlfcn.h>
+#include <stdbool.h>
+
+#include <sys/types.h>
+#include <sys/system_properties.h>
+
+#include "dlmalloc.h"
+#include "logd.h"
+
+#include "malloc_debug_common.h"
+#include "malloc_debug_check_mapinfo.h"
+
+static mapinfo *milist;
+
+/* libc.debug.malloc.backlog */
+extern unsigned int malloc_double_free_backlog;
+
+#define MAX_BACKTRACE_DEPTH 15
+#define ALLOCATION_TAG 0x1ee7d00d
+#define BACKLOG_TAG 0xbabecafe
+#define FREE_POISON 0xa5
+#define BACKLOG_DEFAULT_LEN 100
+#define FRONT_GUARD 0xaa
+#define FRONT_GUARD_LEN (1<<5)
+#define REAR_GUARD 0xbb
+#define REAR_GUARD_LEN (1<<5)
+
+static void log_message(const char* format, ...) {
+ extern const MallocDebug __libc_malloc_default_dispatch;
+ extern const MallocDebug* __libc_malloc_dispatch;
+ extern pthread_mutex_t gAllocationsMutex;
+
+ va_list args;
+ {
+ ScopedPthreadMutexLocker locker(&gAllocationsMutex);
+ const MallocDebug* current_dispatch = __libc_malloc_dispatch;
+ __libc_malloc_dispatch = &__libc_malloc_default_dispatch;
+ va_start(args, format);
+ __libc_android_log_vprint(ANDROID_LOG_ERROR, "libc", format, args);
+ va_end(args);
+ __libc_malloc_dispatch = current_dispatch;
+ }
+}
+
+struct hdr_t {
+ uint32_t tag;
+ hdr_t* prev;
+ hdr_t* next;
+ intptr_t bt[MAX_BACKTRACE_DEPTH];
+ int bt_depth;
+ intptr_t freed_bt[MAX_BACKTRACE_DEPTH];
+ int freed_bt_depth;
+ size_t size;
+ char front_guard[FRONT_GUARD_LEN];
+} __attribute__((packed));
+
+struct ftr_t {
+ char rear_guard[REAR_GUARD_LEN];
+} __attribute__((packed));
+
+static inline ftr_t* to_ftr(hdr_t* hdr) {
+ return reinterpret_cast<ftr_t*>(reinterpret_cast<char*>(hdr + 1) + hdr->size);
+}
+
+static inline void* user(hdr_t* hdr) {
+ return hdr + 1;
+}
+
+static inline hdr_t* meta(void* user) {
+ return reinterpret_cast<hdr_t*>(user) - 1;
+}
+
+static unsigned num;
+static hdr_t *tail;
+static hdr_t *head;
+static pthread_mutex_t lock = PTHREAD_MUTEX_INITIALIZER;
+
+static unsigned backlog_num;
+static hdr_t *backlog_tail;
+static hdr_t *backlog_head;
+static pthread_mutex_t backlog_lock = PTHREAD_MUTEX_INITIALIZER;
+
+extern __LIBC_HIDDEN__ int get_backtrace(intptr_t* addrs, size_t max_entries);
+
+static void print_backtrace(const intptr_t *bt, unsigned int depth) {
+ const mapinfo *mi;
+ unsigned int cnt;
+ unsigned int rel_pc;
+ intptr_t self_bt[MAX_BACKTRACE_DEPTH];
+
+ if (!bt) {
+ depth = get_backtrace(self_bt, MAX_BACKTRACE_DEPTH);
+ bt = self_bt;
+ }
+
+ log_message("*** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***\n");
+ for (cnt = 0; cnt < depth && cnt < MAX_BACKTRACE_DEPTH; cnt++) {
+ mi = pc_to_mapinfo(milist, bt[cnt], &rel_pc);
+ log_message("\t#%02d pc %08x %s\n", cnt,
+ mi ? (intptr_t)rel_pc : bt[cnt],
+ mi ? mi->name : "(unknown)");
+ }
+}
+
+static inline void init_front_guard(hdr_t *hdr) {
+ memset(hdr->front_guard, FRONT_GUARD, FRONT_GUARD_LEN);
+}
+
+static inline bool is_front_guard_valid(hdr_t *hdr) {
+ for (size_t i = 0; i < FRONT_GUARD_LEN; i++) {
+ if (hdr->front_guard[i] != FRONT_GUARD) {
+ return 0;
+ }
+ }
+ return 1;
+}
+
+static inline void init_rear_guard(hdr_t *hdr) {
+ ftr_t* ftr = to_ftr(hdr);
+ memset(ftr->rear_guard, REAR_GUARD, REAR_GUARD_LEN);
+}
+
+static inline bool is_rear_guard_valid(hdr_t *hdr) {
+ unsigned i;
+ int valid = 1;
+ int first_mismatch = -1;
+ ftr_t* ftr = to_ftr(hdr);
+ for (i = 0; i < REAR_GUARD_LEN; i++) {
+ if (ftr->rear_guard[i] != REAR_GUARD) {
+ if (first_mismatch < 0)
+ first_mismatch = i;
+ valid = 0;
+ } else if (first_mismatch >= 0) {
+ log_message("+++ REAR GUARD MISMATCH [%d, %d)\n", first_mismatch, i);
+ first_mismatch = -1;
+ }
+ }
+
+ if (first_mismatch >= 0)
+ log_message("+++ REAR GUARD MISMATCH [%d, %d)\n", first_mismatch, i);
+ return valid;
+}
+
+static inline void add_locked(hdr_t *hdr, hdr_t **tail, hdr_t **head) {
+ hdr->prev = NULL;
+ hdr->next = *head;
+ if (*head)
+ (*head)->prev = hdr;
+ else
+ *tail = hdr;
+ *head = hdr;
+}
+
+static inline int del_locked(hdr_t *hdr, hdr_t **tail, hdr_t **head) {
+ if (hdr->prev) {
+ hdr->prev->next = hdr->next;
+ } else {
+ *head = hdr->next;
+ }
+ if (hdr->next) {
+ hdr->next->prev = hdr->prev;
+ } else {
+ *tail = hdr->prev;
+ }
+ return 0;
+}
+
+static inline void add(hdr_t *hdr, size_t size) {
+ ScopedPthreadMutexLocker locker(&lock);
+ hdr->tag = ALLOCATION_TAG;
+ hdr->size = size;
+ init_front_guard(hdr);
+ init_rear_guard(hdr);
+ num++;
+ add_locked(hdr, &tail, &head);
+}
+
+static inline int del(hdr_t *hdr) {
+ if (hdr->tag != ALLOCATION_TAG) {
+ return -1;
+ }
+
+ ScopedPthreadMutexLocker locker(&lock);
+ del_locked(hdr, &tail, &head);
+ num--;
+ return 0;
+}
+
+static inline void poison(hdr_t *hdr) {
+ memset(user(hdr), FREE_POISON, hdr->size);
+}
+
+static int was_used_after_free(hdr_t *hdr) {
+ unsigned i;
+ const char *data = (const char *)user(hdr);
+ for (i = 0; i < hdr->size; i++)
+ if (data[i] != FREE_POISON)
+ return 1;
+ return 0;
+}
+
+/* returns 1 if valid, *safe == 1 if safe to dump stack */
+static inline int check_guards(hdr_t *hdr, int *safe) {
+ *safe = 1;
+ if (!is_front_guard_valid(hdr)) {
+ if (hdr->front_guard[0] == FRONT_GUARD) {
+ log_message("+++ ALLOCATION %p SIZE %d HAS A CORRUPTED FRONT GUARD\n",
+ user(hdr), hdr->size);
+ } else {
+ log_message("+++ ALLOCATION %p HAS A CORRUPTED FRONT GUARD "\
+ "(NOT DUMPING STACKTRACE)\n", user(hdr));
+ /* Allocation header is probably corrupt, do not print stack trace */
+ *safe = 0;
+ }
+ return 0;
+ }
+
+ if (!is_rear_guard_valid(hdr)) {
+ log_message("+++ ALLOCATION %p SIZE %d HAS A CORRUPTED REAR GUARD\n",
+ user(hdr), hdr->size);
+ return 0;
+ }
+
+ return 1;
+}
+
+/* returns 1 if valid, *safe == 1 if safe to dump stack */
+static inline int check_allocation_locked(hdr_t *hdr, int *safe) {
+ int valid = 1;
+ *safe = 1;
+
+ if (hdr->tag != ALLOCATION_TAG && hdr->tag != BACKLOG_TAG) {
+ log_message("+++ ALLOCATION %p HAS INVALID TAG %08x (NOT DUMPING STACKTRACE)\n",
+ user(hdr), hdr->tag);
+ // Allocation header is probably corrupt, do not dequeue or dump stack
+ // trace.
+ *safe = 0;
+ return 0;
+ }
+
+ if (hdr->tag == BACKLOG_TAG && was_used_after_free(hdr)) {
+ log_message("+++ ALLOCATION %p SIZE %d WAS USED AFTER BEING FREED\n",
+ user(hdr), hdr->size);
+ valid = 0;
+ /* check the guards to see if it's safe to dump a stack trace */
+ check_guards(hdr, safe);
+ } else {
+ valid = check_guards(hdr, safe);
+ }
+
+ if (!valid && *safe) {
+ log_message("+++ ALLOCATION %p SIZE %d ALLOCATED HERE:\n",
+ user(hdr), hdr->size);
+ print_backtrace(hdr->bt, hdr->bt_depth);
+ if (hdr->tag == BACKLOG_TAG) {
+ log_message("+++ ALLOCATION %p SIZE %d FREED HERE:\n",
+ user(hdr), hdr->size);
+ print_backtrace(hdr->freed_bt, hdr->freed_bt_depth);
+ }
+ }
+
+ return valid;
+}
+
+static inline int del_and_check_locked(hdr_t *hdr,
+ hdr_t **tail, hdr_t **head, unsigned *cnt,
+ int *safe) {
+ int valid = check_allocation_locked(hdr, safe);
+ if (safe) {
+ (*cnt)--;
+ del_locked(hdr, tail, head);
+ }
+ return valid;
+}
+
+static inline void del_from_backlog_locked(hdr_t *hdr) {
+ int safe;
+ del_and_check_locked(hdr,
+ &backlog_tail, &backlog_head, &backlog_num,
+ &safe);
+ hdr->tag = 0; /* clear the tag */
+}
+
+static inline void del_from_backlog(hdr_t *hdr) {
+ ScopedPthreadMutexLocker locker(&backlog_lock);
+ del_from_backlog_locked(hdr);
+}
+
+static inline int del_leak(hdr_t *hdr, int *safe) {
+ ScopedPthreadMutexLocker locker(&lock);
+ return del_and_check_locked(hdr, &tail, &head, &num, safe);
+}
+
+static inline void add_to_backlog(hdr_t *hdr) {
+ ScopedPthreadMutexLocker locker(&backlog_lock);
+ hdr->tag = BACKLOG_TAG;
+ backlog_num++;
+ add_locked(hdr, &backlog_tail, &backlog_head);
+ poison(hdr);
+ /* If we've exceeded the maximum backlog, clear it up */
+ while (backlog_num > malloc_double_free_backlog) {
+ hdr_t *gone = backlog_tail;
+ del_from_backlog_locked(gone);
+ dlfree(gone);
+ }
+}
+
+extern "C" void* chk_malloc(size_t size) {
+// log_message("%s: %s\n", __FILE__, __FUNCTION__);
+
+ hdr_t* hdr = static_cast<hdr_t*>(dlmalloc(sizeof(hdr_t) + size + sizeof(ftr_t)));
+ if (hdr) {
+ hdr->bt_depth = get_backtrace(hdr->bt, MAX_BACKTRACE_DEPTH);
+ add(hdr, size);
+ return user(hdr);
+ }
+ return NULL;
+}
+
+extern "C" void* chk_memalign(size_t, size_t bytes) {
+// log_message("%s: %s\n", __FILE__, __FUNCTION__);
+ // XXX: it's better to use malloc, than being wrong
+ return chk_malloc(bytes);
+}
+
+extern "C" void chk_free(void *ptr) {
+// log_message("%s: %s\n", __FILE__, __FUNCTION__);
+
+ if (!ptr) /* ignore free(NULL) */
+ return;
+
+ hdr_t* hdr = meta(ptr);
+
+ if (del(hdr) < 0) {
+ intptr_t bt[MAX_BACKTRACE_DEPTH];
+ int depth;
+ depth = get_backtrace(bt, MAX_BACKTRACE_DEPTH);
+ if (hdr->tag == BACKLOG_TAG) {
+ log_message("+++ ALLOCATION %p SIZE %d BYTES MULTIPLY FREED!\n",
+ user(hdr), hdr->size);
+ log_message("+++ ALLOCATION %p SIZE %d ALLOCATED HERE:\n",
+ user(hdr), hdr->size);
+ print_backtrace(hdr->bt, hdr->bt_depth);
+ /* hdr->freed_bt_depth should be nonzero here */
+ log_message("+++ ALLOCATION %p SIZE %d FIRST FREED HERE:\n",
+ user(hdr), hdr->size);
+ print_backtrace(hdr->freed_bt, hdr->freed_bt_depth);
+ log_message("+++ ALLOCATION %p SIZE %d NOW BEING FREED HERE:\n",
+ user(hdr), hdr->size);
+ print_backtrace(bt, depth);
+ } else {
+ log_message("+++ ALLOCATION %p IS CORRUPTED OR NOT ALLOCATED VIA TRACKER!\n",
+ user(hdr));
+ print_backtrace(bt, depth);
+ /* Leak here so that we do not crash */
+ //dlfree(user(hdr));
+ }
+ } else {
+ hdr->freed_bt_depth = get_backtrace(hdr->freed_bt,
+ MAX_BACKTRACE_DEPTH);
+ add_to_backlog(hdr);
+ }
+}
+
+extern "C" void *chk_realloc(void *ptr, size_t size) {
+// log_message("%s: %s\n", __FILE__, __FUNCTION__);
+
+ if (!size) {
+ chk_free(ptr);
+ return NULL;
+ }
+
+ if (!ptr) {
+ return chk_malloc(size);
+ }
+
+ hdr_t* hdr = meta(ptr);
+
+ if (del(hdr) < 0) {
+ intptr_t bt[MAX_BACKTRACE_DEPTH];
+ int depth;
+ depth = get_backtrace(bt, MAX_BACKTRACE_DEPTH);
+ if (hdr->tag == BACKLOG_TAG) {
+ log_message("+++ REALLOCATION %p SIZE %d OF FREED MEMORY!\n",
+ user(hdr), size, hdr->size);
+ log_message("+++ ALLOCATION %p SIZE %d ALLOCATED HERE:\n",
+ user(hdr), hdr->size);
+ print_backtrace(hdr->bt, hdr->bt_depth);
+ /* hdr->freed_bt_depth should be nonzero here */
+ log_message("+++ ALLOCATION %p SIZE %d FIRST FREED HERE:\n",
+ user(hdr), hdr->size);
+ print_backtrace(hdr->freed_bt, hdr->freed_bt_depth);
+ log_message("+++ ALLOCATION %p SIZE %d NOW BEING REALLOCATED HERE:\n",
+ user(hdr), hdr->size);
+ print_backtrace(bt, depth);
+
+ /* We take the memory out of the backlog and fall through so the
+ * reallocation below succeeds. Since we didn't really free it, we
+ * can default to this behavior.
+ */
+ del_from_backlog(hdr);
+ } else {
+ log_message("+++ REALLOCATION %p SIZE %d IS CORRUPTED OR NOT ALLOCATED VIA TRACKER!\n",
+ user(hdr), size);
+ print_backtrace(bt, depth);
+ // just get a whole new allocation and leak the old one
+ return dlrealloc(0, size);
+ // return dlrealloc(user(hdr), size); // assuming it was allocated externally
+ }
+ }
+
+ hdr = static_cast<hdr_t*>(dlrealloc(hdr, sizeof(hdr_t) + size + sizeof(ftr_t)));
+ if (hdr) {
+ hdr->bt_depth = get_backtrace(hdr->bt, MAX_BACKTRACE_DEPTH);
+ add(hdr, size);
+ return user(hdr);
+ }
+
+ return NULL;
+}
+
+extern "C" void *chk_calloc(int nmemb, size_t size) {
+// log_message("%s: %s\n", __FILE__, __FUNCTION__);
+ size_t total_size = nmemb * size;
+ hdr_t* hdr = static_cast<hdr_t*>(dlcalloc(1, sizeof(hdr_t) + total_size + sizeof(ftr_t)));
+ if (hdr) {
+ hdr->bt_depth = get_backtrace(
+ hdr->bt, MAX_BACKTRACE_DEPTH);
+ add(hdr, total_size);
+ return user(hdr);
+ }
+ return NULL;
+}
+
+static void heaptracker_free_leaked_memory() {
+ if (num) {
+ log_message("+++ THERE ARE %d LEAKED ALLOCATIONS\n", num);
+ }
+
+ hdr_t *del = NULL;
+ while (head) {
+ int safe;
+ del = head;
+ log_message("+++ DELETING %d BYTES OF LEAKED MEMORY AT %p (%d REMAINING)\n",
+ del->size, user(del), num);
+ if (del_leak(del, &safe)) {
+ /* safe == 1, because the allocation is valid */
+ log_message("+++ ALLOCATION %p SIZE %d ALLOCATED HERE:\n",
+ user(del), del->size);
+ print_backtrace(del->bt, del->bt_depth);
+ }
+ dlfree(del);
+ }
+
+// log_message("+++ DELETING %d BACKLOGGED ALLOCATIONS\n", backlog_num);
+ while (backlog_head) {
+ del = backlog_tail;
+ del_from_backlog(del);
+ dlfree(del);
+ }
+}
+
+/* Initializes malloc debugging framework.
+ * See comments on MallocDebugInit in malloc_debug_common.h
+ */
+extern "C" int malloc_debug_initialize() {
+ if (!malloc_double_free_backlog)
+ malloc_double_free_backlog = BACKLOG_DEFAULT_LEN;
+ milist = init_mapinfo(getpid());
+ return 0;
+}
+
+extern "C" void malloc_debug_finalize() {
+ heaptracker_free_leaked_memory();
+ deinit_mapinfo(milist);
+}