malloc/mcheck.c

   1 /* Standard debugging hooks for `malloc'.
   2    Copyright (C) 1990-2015 Free Software Foundation, Inc.
   3    This file is part of the GNU C Library.
   4    Written May 1989 by Mike Haertel.
   5
   6    The GNU C Library is free software; you can redistribute it and/or
   7    modify it under the terms of the GNU Lesser General Public
   8    License as published by the Free Software Foundation; either
   9    version 2.1 of the License, or (at your option) any later version.
  10
  11    The GNU C Library is distributed in the hope that it will be useful,
  12    but WITHOUT ANY WARRANTY; without even the implied warranty of
  13    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  14    Lesser General Public License for more details.
  15
  16    You should have received a copy of the GNU Lesser General Public
  17    License along with the GNU C Library; if not, see
  18    <http://www.gnu.org/licenses/>.  */
  19
  20 #ifndef _MALLOC_INTERNAL
  21 # define _MALLOC_INTERNAL
  22 # include <malloc.h>
  23 # include <mcheck.h>
  24 # include <stdint.h>
  25 # include <stdio.h>
  26 # include <libintl.h>
  27 # include <errno.h>
  28 #endif
  29
  30 /* Old hook values.  */
  31 static void (*old_free_hook)(__ptr_t ptr, const __ptr_t);
  32 static __ptr_t (*old_malloc_hook) (size_t size, const __ptr_t);
  33 static __ptr_t (*old_memalign_hook) (size_t alignment, size_t size,
  34                                      const __ptr_t);
  35 static __ptr_t (*old_realloc_hook) (__ptr_t ptr, size_t size,
  36                                     const __ptr_t);
  37
  38 /* Function to call when something awful happens.  */
  39 static void (*abortfunc) (enum mcheck_status);
  40
  41 /* Arbitrary magical numbers.  */
  42 #define MAGICWORD       0xfedabeeb
  43 #define MAGICFREE       0xd8675309
  44 #define MAGICBYTE       ((char) 0xd7)
  45 #define MALLOCFLOOD     ((char) 0x93)
  46 #define FREEFLOOD       ((char) 0x95)
  47
  48 struct hdr
  49 {
  50   size_t size;                  /* Exact size requested by user.  */
  51   unsigned long int magic;      /* Magic number to check header integrity.  */
  52   struct hdr *prev;
  53   struct hdr *next;
  54   __ptr_t block;                /* Real block allocated, for memalign.  */
  55   unsigned long int magic2;     /* Extra, keeps us doubleword aligned.  */
  56 };
  57
  58 /* This is the beginning of the list of all memory blocks allocated.
  59    It is only constructed if the pedantic testing is requested.  */
  60 static struct hdr *root;
  61
  62 static int mcheck_used;
  63
  64 /* Nonzero if pedentic checking of all blocks is requested.  */
  65 static int pedantic;
  66
  67 #if defined _LIBC || defined STDC_HEADERS || defined USG
  68 # include <string.h>
  69 # define flood memset
  70 #else
  71 static void flood (__ptr_t, int, size_t);
  72 static void flood (ptr, val, size)
  73 __ptr_t ptr;
  74 int val;
  75 size_t size;
  76 {
  77   char *cp = ptr;
  78   while (size--)
  79     *cp++ = val;
  80 }
  81 #endif
  82
  83 static enum mcheck_status
  84 checkhdr (const struct hdr *hdr)
  85 {
  86   enum mcheck_status status;
  87
  88   if (!mcheck_used)
  89     /* Maybe the mcheck used is disabled?  This happens when we find
  90        an error and report it.  */
  91     return MCHECK_OK;
  92
  93   switch (hdr->magic ^ ((uintptr_t) hdr->prev + (uintptr_t) hdr->next))
  94     {
  95     default:
  96       status = MCHECK_HEAD;
  97       break;
  98     case MAGICFREE:
  99       status = MCHECK_FREE;
 100       break;
 101     case MAGICWORD:
 102       if (((char *) &hdr[1])[hdr->size] != MAGICBYTE)
 103         status = MCHECK_TAIL;
 104       else if ((hdr->magic2 ^ (uintptr_t) hdr->block) != MAGICWORD)
 105         status = MCHECK_HEAD;
 106       else
 107         status = MCHECK_OK;
 108       break;
 109     }
 110   if (status != MCHECK_OK)
 111     {
 112       mcheck_used = 0;
 113       (*abortfunc) (status);
 114       mcheck_used = 1;
 115     }
 116   return status;
 117 }
 118
 119 void
 120 mcheck_check_all (void)
 121 {
 122   /* Walk through all the active blocks and test whether they were tampered
 123      with.  */
 124   struct hdr *runp = root;
 125
 126   /* Temporarily turn off the checks.  */
 127   pedantic = 0;
 128
 129   while (runp != NULL)
 130     {
 131       (void) checkhdr (runp);
 132
 133       runp = runp->next;
 134     }
 135
 136   /* Turn checks on again.  */
 137   pedantic = 1;
 138 }
 139 #ifdef _LIBC
 140 libc_hidden_def (mcheck_check_all)
 141 #endif
 142
 143 static void
 144 unlink_blk (struct hdr *ptr)
 145 {
 146   if (ptr->next != NULL)
 147     {
 148       ptr->next->prev = ptr->prev;
 149       ptr->next->magic = MAGICWORD ^ ((uintptr_t) ptr->next->prev
 150                                       + (uintptr_t) ptr->next->next);
 151     }
 152   if (ptr->prev != NULL)
 153     {
 154       ptr->prev->next = ptr->next;
 155       ptr->prev->magic = MAGICWORD ^ ((uintptr_t) ptr->prev->prev
 156                                       + (uintptr_t) ptr->prev->next);
 157     }
 158   else
 159     root = ptr->next;
 160 }
 161
 162 static void
 163 link_blk (struct hdr *hdr)
 164 {
 165   hdr->prev = NULL;
 166   hdr->next = root;
 167   root = hdr;
 168   hdr->magic = MAGICWORD ^ (uintptr_t) hdr->next;
 169
 170   /* And the next block.  */
 171   if (hdr->next != NULL)
 172     {
 173       hdr->next->prev = hdr;
 174       hdr->next->magic = MAGICWORD ^ ((uintptr_t) hdr
 175                                       + (uintptr_t) hdr->next->next);
 176     }
 177 }
 178 static void
 179 freehook (__ptr_t ptr, const __ptr_t caller)
 180 {
 181   if (pedantic)
 182     mcheck_check_all ();
 183   if (ptr)
 184     {
 185       struct hdr *hdr = ((struct hdr *) ptr) - 1;
 186       checkhdr (hdr);
 187       hdr->magic = MAGICFREE;
 188       hdr->magic2 = MAGICFREE;
 189       unlink_blk (hdr);
 190       hdr->prev = hdr->next = NULL;
 191       flood (ptr, FREEFLOOD, hdr->size);
 192       ptr = hdr->block;
 193     }
 194   __free_hook = old_free_hook;
 195   if (old_free_hook != NULL)
 196     (*old_free_hook)(ptr, caller);
 197   else
 198     free (ptr);
 199   __free_hook = freehook;
 200 }
 201
 202 static __ptr_t
 203 mallochook (size_t size, const __ptr_t caller)
 204 {
 205   struct hdr *hdr;
 206
 207   if (pedantic)
 208     mcheck_check_all ();
 209
 210   if (size > ~((size_t) 0) - (sizeof (struct hdr) + 1))
 211     {
 212       __set_errno (ENOMEM);
 213       return NULL;
 214     }
 215
 216   __malloc_hook = old_malloc_hook;
 217   if (old_malloc_hook != NULL)
 218     hdr = (struct hdr *) (*old_malloc_hook)(sizeof (struct hdr) + size + 1,
 219                                             caller);
 220   else
 221     hdr = (struct hdr *) malloc (sizeof (struct hdr) + size + 1);
 222   __malloc_hook = mallochook;
 223   if (hdr == NULL)
 224     return NULL;
 225
 226   hdr->size = size;
 227   link_blk (hdr);
 228   hdr->block = hdr;
 229   hdr->magic2 = (uintptr_t) hdr ^ MAGICWORD;
 230   ((char *) &hdr[1])[size] = MAGICBYTE;
 231   flood ((__ptr_t) (hdr + 1), MALLOCFLOOD, size);
 232   return (__ptr_t) (hdr + 1);
 233 }
 234
 235 static __ptr_t
 236 memalignhook (size_t alignment, size_t size,
 237               const __ptr_t caller)
 238 {
 239   struct hdr *hdr;
 240   size_t slop;
 241   char *block;
 242
 243   if (pedantic)
 244     mcheck_check_all ();
 245
 246   slop = (sizeof *hdr + alignment - 1) & - alignment;
 247
 248   if (size > ~((size_t) 0) - (slop + 1))
 249     {
 250       __set_errno (ENOMEM);
 251       return NULL;
 252     }
 253
 254   __memalign_hook = old_memalign_hook;
 255   if (old_memalign_hook != NULL)
 256     block = (*old_memalign_hook)(alignment, slop + size + 1, caller);
 257   else
 258     block = memalign (alignment, slop + size + 1);
 259   __memalign_hook = memalignhook;
 260   if (block == NULL)
 261     return NULL;
 262
 263   hdr = ((struct hdr *) (block + slop)) - 1;
 264
 265   hdr->size = size;
 266   link_blk (hdr);
 267   hdr->block = (__ptr_t) block;
 268   hdr->magic2 = (uintptr_t) block ^ MAGICWORD;
 269   ((char *) &hdr[1])[size] = MAGICBYTE;
 270   flood ((__ptr_t) (hdr + 1), MALLOCFLOOD, size);
 271   return (__ptr_t) (hdr + 1);
 272 }
 273
 274 static __ptr_t
 275 reallochook (__ptr_t ptr, size_t size, const __ptr_t caller)
 276 {
 277   if (size == 0)
 278     {
 279       freehook (ptr, caller);
 280       return NULL;
 281     }
 282
 283   struct hdr *hdr;
 284   size_t osize;
 285
 286   if (pedantic)
 287     mcheck_check_all ();
 288
 289   if (size > ~((size_t) 0) - (sizeof (struct hdr) + 1))
 290     {
 291       __set_errno (ENOMEM);
 292       return NULL;
 293     }
 294
 295   if (ptr)
 296     {
 297       hdr = ((struct hdr *) ptr) - 1;
 298       osize = hdr->size;
 299
 300       checkhdr (hdr);
 301       unlink_blk (hdr);
 302       if (size < osize)
 303         flood ((char *) ptr + size, FREEFLOOD, osize - size);
 304     }
 305   else
 306     {
 307       osize = 0;
 308       hdr = NULL;
 309     }
 310   __free_hook = old_free_hook;
 311   __malloc_hook = old_malloc_hook;
 312   __memalign_hook = old_memalign_hook;
 313   __realloc_hook = old_realloc_hook;
 314   if (old_realloc_hook != NULL)
 315     hdr = (struct hdr *) (*old_realloc_hook)((__ptr_t) hdr,
 316                                              sizeof (struct hdr) + size + 1,
 317                                              caller);
 318   else
 319     hdr = (struct hdr *) realloc ((__ptr_t) hdr,
 320                                   sizeof (struct hdr) + size + 1);
 321   __free_hook = freehook;
 322   __malloc_hook = mallochook;
 323   __memalign_hook = memalignhook;
 324   __realloc_hook = reallochook;
 325   if (hdr == NULL)
 326     return NULL;
 327
 328   hdr->size = size;
 329   link_blk (hdr);
 330   hdr->block = hdr;
 331   hdr->magic2 = (uintptr_t) hdr ^ MAGICWORD;
 332   ((char *) &hdr[1])[size] = MAGICBYTE;
 333   if (size > osize)
 334     flood ((char *) (hdr + 1) + osize, MALLOCFLOOD, size - osize);
 335   return (__ptr_t) (hdr + 1);
 336 }
 337
 338 __attribute__ ((noreturn))
 339 static void
 340 mabort (enum mcheck_status status)
 341 {
 342   const char *msg;
 343   switch (status)
 344     {
 345     case MCHECK_OK:
 346       msg = _ ("memory is consistent, library is buggy\n");
 347       break;
 348     case MCHECK_HEAD:
 349       msg = _ ("memory clobbered before allocated block\n");
 350       break;
 351     case MCHECK_TAIL:
 352       msg = _ ("memory clobbered past end of allocated block\n");
 353       break;
 354     case MCHECK_FREE:
 355       msg = _ ("block freed twice\n");
 356       break;
 357     default:
 358       msg = _ ("bogus mcheck_status, library is buggy\n");
 359       break;
 360     }
 361 #ifdef _LIBC
 362   __libc_fatal (msg);
 363 #else
 364   fprintf (stderr, "mcheck: %s", msg);
 365   fflush (stderr);
 366   abort ();
 367 #endif
 368 }
 369
 370 /* Memory barrier so that GCC does not optimize out the argument.  */
 371 #define malloc_opt_barrier(x) \
 372   ({ __typeof (x) __x = x; __asm ("" : "+m" (__x)); __x; })
 373
 374 int mcheck (func)
 375 void (*func)(enum mcheck_status);
 376 {
 377   abortfunc = (func != NULL) ? func : &mabort;
 378
 379   /* These hooks may not be safely inserted if malloc is already in use.  */
 380   if (__malloc_initialized <= 0 && !mcheck_used)
 381     {
 382       /* We call malloc() once here to ensure it is initialized.  */
 383       void *p = malloc (0);
 384       /* GCC might optimize out the malloc/free pair without a barrier.  */
 385       p = malloc_opt_barrier (p);
 386       free (p);
 387
 388       old_free_hook = __free_hook;
 389       __free_hook = freehook;
 390       old_malloc_hook = __malloc_hook;
 391       __malloc_hook = mallochook;
 392       old_memalign_hook = __memalign_hook;
 393       __memalign_hook = memalignhook;
 394       old_realloc_hook = __realloc_hook;
 395       __realloc_hook = reallochook;
 396       mcheck_used = 1;
 397     }
 398
 399   return mcheck_used ? 0 : -1;
 400 }
 401 #ifdef _LIBC
 402 libc_hidden_def (mcheck)
 403 #endif
 404
 405 int mcheck_pedantic (func)
 406 void (*func)(enum mcheck_status);
 407 {
 408   int res = mcheck (func);
 409   if (res == 0)
 410     pedantic = 1;
 411   return res;
 412 }
 413
 414 enum mcheck_status
 415 mprobe (__ptr_t ptr)
 416 {
 417   return mcheck_used ? checkhdr (((struct hdr *) ptr) - 1) : MCHECK_DISABLED;
 418 }