malloc/hooks.c

   1 /* Malloc implementation for multiple threads without lock contention.
   2    Copyright (C) 2001-2017 Free Software Foundation, Inc.
   3    This file is part of the GNU C Library.
   4    Contributed by Wolfram Gloger <wg@malloc.de>, 2001.
   5
   6    The GNU C Library is free software; you can redistribute it and/or
   7    modify it under the terms of the GNU Lesser General Public License as
   8    published by the Free Software Foundation; either version 2.1 of the
   9    License, or (at your option) any later version.
  10
  11    The GNU C Library is distributed in the hope that it will be useful,
  12    but WITHOUT ANY WARRANTY; without even the implied warranty of
  13    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  14    Lesser General Public License for more details.
  15
  16    You should have received a copy of the GNU Lesser General Public
  17    License along with the GNU C Library; see the file COPYING.LIB.  If
  18    not, see <http://www.gnu.org/licenses/>.  */
  19
  20 /* What to do if the standard debugging hooks are in place and a
  21    corrupt pointer is detected: do nothing (0), print an error message
  22    (1), or call abort() (2). */
  23
  24 /* Hooks for debugging versions.  The initial hooks just call the
  25    initialization routine, then do the normal work. */
  26
  27 static void *
  28 malloc_hook_ini (size_t sz, const void *caller)
  29 {
  30   __malloc_hook = NULL;
  31   ptmalloc_init ();
  32   return __libc_malloc (sz);
  33 }
  34
  35 static void *
  36 realloc_hook_ini (void *ptr, size_t sz, const void *caller)
  37 {
  38   __malloc_hook = NULL;
  39   __realloc_hook = NULL;
  40   ptmalloc_init ();
  41   return __libc_realloc (ptr, sz);
  42 }
  43
  44 static void *
  45 memalign_hook_ini (size_t alignment, size_t sz, const void *caller)
  46 {
  47   __memalign_hook = NULL;
  48   ptmalloc_init ();
  49   return __libc_memalign (alignment, sz);
  50 }
  51
  52 /* Whether we are using malloc checking.  */
  53 static int using_malloc_checking;
  54
  55 /* A flag that is set by malloc_set_state, to signal that malloc checking
  56    must not be enabled on the request from the user (via the MALLOC_CHECK_
  57    environment variable).  It is reset by __malloc_check_init to tell
  58    malloc_set_state that the user has requested malloc checking.
  59
  60    The purpose of this flag is to make sure that malloc checking is not
  61    enabled when the heap to be restored was constructed without malloc
  62    checking, and thus does not contain the required magic bytes.
  63    Otherwise the heap would be corrupted by calls to free and realloc.  If
  64    it turns out that the heap was created with malloc checking and the
  65    user has requested it malloc_set_state just calls __malloc_check_init
  66    again to enable it.  On the other hand, reusing such a heap without
  67    further malloc checking is safe.  */
  68 static int disallow_malloc_check;
  69
  70 /* Activate a standard set of debugging hooks. */
  71 void
  72 __malloc_check_init (void)
  73 {
  74   if (disallow_malloc_check)
  75     {
  76       disallow_malloc_check = 0;
  77       return;
  78     }
  79   using_malloc_checking = 1;
  80   __malloc_hook = malloc_check;
  81   __free_hook = free_check;
  82   __realloc_hook = realloc_check;
  83   __memalign_hook = memalign_check;
  84 }
  85
  86 /* A simple, standard set of debugging hooks.  Overhead is `only' one
  87    byte per chunk; still this will catch most cases of double frees or
  88    overruns.  The goal here is to avoid obscure crashes due to invalid
  89    usage, unlike in the MALLOC_DEBUG code. */
  90
  91 static unsigned char
  92 magicbyte (const void *p)
  93 {
  94   unsigned char magic;
  95
  96   magic = (((uintptr_t) p >> 3) ^ ((uintptr_t) p >> 11)) & 0xFF;
  97   /* Do not return 1.  See the comment in mem2mem_check().  */
  98   if (magic == 1)
  99     ++magic;
 100   return magic;
 101 }
 102
 103
 104 /* Visualize the chunk as being partitioned into blocks of 255 bytes from the
 105    highest address of the chunk, downwards.  The end of each block tells
 106    us the size of that block, up to the actual size of the requested
 107    memory.  Our magic byte is right at the end of the requested size, so we
 108    must reach it with this iteration, otherwise we have witnessed a memory
 109    corruption.  */
 110 static size_t
 111 malloc_check_get_size (mchunkptr p)
 112 {
 113   size_t size;
 114   unsigned char c;
 115   unsigned char magic = magicbyte (p);
 116
 117   assert (using_malloc_checking == 1);
 118
 119   for (size = chunksize (p) - 1 + (chunk_is_mmapped (p) ? 0 : SIZE_SZ);
 120        (c = ((unsigned char *) p)[size]) != magic;
 121        size -= c)
 122     {
 123       if (c <= 0 || size < (c + 2 * SIZE_SZ))
 124         malloc_printerr ("malloc_check_get_size: memory corruption");
 125     }
 126
 127   /* chunk2mem size.  */
 128   return size - 2 * SIZE_SZ;
 129 }
 130
 131 /* Instrument a chunk with overrun detector byte(s) and convert it
 132    into a user pointer with requested size req_sz. */
 133
 134 static void *
 135 mem2mem_check (void *ptr, size_t req_sz)
 136 {
 137   mchunkptr p;
 138   unsigned char *m_ptr = ptr;
 139   size_t max_sz, block_sz, i;
 140   unsigned char magic;
 141
 142   if (!ptr)
 143     return ptr;
 144
 145   p = mem2chunk (ptr);
 146   magic = magicbyte (p);
 147   max_sz = chunksize (p) - 2 * SIZE_SZ;
 148   if (!chunk_is_mmapped (p))
 149     max_sz += SIZE_SZ;
 150   for (i = max_sz - 1; i > req_sz; i -= block_sz)
 151     {
 152       block_sz = MIN (i - req_sz, 0xff);
 153       /* Don't allow the magic byte to appear in the chain of length bytes.
 154          For the following to work, magicbyte cannot return 0x01.  */
 155       if (block_sz == magic)
 156         --block_sz;
 157
 158       m_ptr[i] = block_sz;
 159     }
 160   m_ptr[req_sz] = magic;
 161   return (void *) m_ptr;
 162 }
 163
 164 /* Convert a pointer to be free()d or realloc()ed to a valid chunk
 165    pointer.  If the provided pointer is not valid, return NULL. */
 166
 167 static mchunkptr
 168 mem2chunk_check (void *mem, unsigned char **magic_p)
 169 {
 170   mchunkptr p;
 171   INTERNAL_SIZE_T sz, c;
 172   unsigned char magic;
 173
 174   if (!aligned_OK (mem))
 175     return NULL;
 176
 177   p = mem2chunk (mem);
 178   sz = chunksize (p);
 179   magic = magicbyte (p);
 180   if (!chunk_is_mmapped (p))
 181     {
 182       /* Must be a chunk in conventional heap memory. */
 183       int contig = contiguous (&main_arena);
 184       if ((contig &&
 185            ((char *) p < mp_.sbrk_base ||
 186             ((char *) p + sz) >= (mp_.sbrk_base + main_arena.system_mem))) ||
 187           sz < MINSIZE || sz & MALLOC_ALIGN_MASK || !inuse (p) ||
 188           (!prev_inuse (p) && ((prev_size (p) & MALLOC_ALIGN_MASK) != 0 ||
 189                                (contig && (char *) prev_chunk (p) < mp_.sbrk_base) ||
 190                                next_chunk (prev_chunk (p)) != p)))
 191         return NULL;
 192
 193       for (sz += SIZE_SZ - 1; (c = ((unsigned char *) p)[sz]) != magic; sz -= c)
 194         {
 195           if (c == 0 || sz < (c + 2 * SIZE_SZ))
 196             return NULL;
 197         }
 198     }
 199   else
 200     {
 201       unsigned long offset, page_mask = GLRO (dl_pagesize) - 1;
 202
 203       /* mmap()ed chunks have MALLOC_ALIGNMENT or higher power-of-two
 204          alignment relative to the beginning of a page.  Check this
 205          first. */
 206       offset = (unsigned long) mem & page_mask;
 207       if ((offset != MALLOC_ALIGNMENT && offset != 0 && offset != 0x10 &&
 208            offset != 0x20 && offset != 0x40 && offset != 0x80 && offset != 0x100 &&
 209            offset != 0x200 && offset != 0x400 && offset != 0x800 && offset != 0x1000 &&
 210            offset < 0x2000) ||
 211           !chunk_is_mmapped (p) || prev_inuse (p) ||
 212           ((((unsigned long) p - prev_size (p)) & page_mask) != 0) ||
 213           ((prev_size (p) + sz) & page_mask) != 0)
 214         return NULL;
 215
 216       for (sz -= 1; (c = ((unsigned char *) p)[sz]) != magic; sz -= c)
 217         {
 218           if (c == 0 || sz < (c + 2 * SIZE_SZ))
 219             return NULL;
 220         }
 221     }
 222   ((unsigned char *) p)[sz] ^= 0xFF;
 223   if (magic_p)
 224     *magic_p = (unsigned char *) p + sz;
 225   return p;
 226 }
 227
 228 /* Check for corruption of the top chunk.  */
 229 static void
 230 top_check (void)
 231 {
 232   mchunkptr t = top (&main_arena);
 233
 234   if (t == initial_top (&main_arena) ||
 235       (!chunk_is_mmapped (t) &&
 236        chunksize (t) >= MINSIZE &&
 237        prev_inuse (t) &&
 238        (!contiguous (&main_arena) ||
 239         (char *) t + chunksize (t) == mp_.sbrk_base + main_arena.system_mem)))
 240     return;
 241
 242   malloc_printerr ("malloc: top chunk is corrupt");
 243 }
 244
 245 static void *
 246 malloc_check (size_t sz, const void *caller)
 247 {
 248   void *victim;
 249
 250   if (sz + 1 == 0)
 251     {
 252       __set_errno (ENOMEM);
 253       return NULL;
 254     }
 255
 256   __libc_lock_lock (main_arena.mutex);
 257   top_check ();
 258   victim = _int_malloc (&main_arena, sz + 1);
 259   __libc_lock_unlock (main_arena.mutex);
 260   return mem2mem_check (victim, sz);
 261 }
 262
 263 static void
 264 free_check (void *mem, const void *caller)
 265 {
 266   mchunkptr p;
 267
 268   if (!mem)
 269     return;
 270
 271   __libc_lock_lock (main_arena.mutex);
 272   p = mem2chunk_check (mem, NULL);
 273   if (!p)
 274     malloc_printerr ("free(): invalid pointer");
 275   if (chunk_is_mmapped (p))
 276     {
 277       __libc_lock_unlock (main_arena.mutex);
 278       munmap_chunk (p);
 279       return;
 280     }
 281   _int_free (&main_arena, p, 1);
 282   __libc_lock_unlock (main_arena.mutex);
 283 }
 284
 285 static void *
 286 realloc_check (void *oldmem, size_t bytes, const void *caller)
 287 {
 288   INTERNAL_SIZE_T nb;
 289   void *newmem = 0;
 290   unsigned char *magic_p;
 291
 292   if (bytes + 1 == 0)
 293     {
 294       __set_errno (ENOMEM);
 295       return NULL;
 296     }
 297   if (oldmem == 0)
 298     return malloc_check (bytes, NULL);
 299
 300   if (bytes == 0)
 301     {
 302       free_check (oldmem, NULL);
 303       return NULL;
 304     }
 305   __libc_lock_lock (main_arena.mutex);
 306   const mchunkptr oldp = mem2chunk_check (oldmem, &magic_p);
 307   __libc_lock_unlock (main_arena.mutex);
 308   if (!oldp)
 309     malloc_printerr ("realloc(): invalid pointer");
 310   const INTERNAL_SIZE_T oldsize = chunksize (oldp);
 311
 312   checked_request2size (bytes + 1, nb);
 313   __libc_lock_lock (main_arena.mutex);
 314
 315   if (chunk_is_mmapped (oldp))
 316     {
 317 #if HAVE_MREMAP
 318       mchunkptr newp = mremap_chunk (oldp, nb);
 319       if (newp)
 320         newmem = chunk2mem (newp);
 321       else
 322 #endif
 323       {
 324         /* Note the extra SIZE_SZ overhead. */
 325         if (oldsize - SIZE_SZ >= nb)
 326           newmem = oldmem; /* do nothing */
 327         else
 328           {
 329             /* Must alloc, copy, free. */
 330             top_check ();
 331             newmem = _int_malloc (&main_arena, bytes + 1);
 332             if (newmem)
 333               {
 334                 memcpy (newmem, oldmem, oldsize - 2 * SIZE_SZ);
 335                 munmap_chunk (oldp);
 336               }
 337           }
 338       }
 339     }
 340   else
 341     {
 342       top_check ();
 343       INTERNAL_SIZE_T nb;
 344       checked_request2size (bytes + 1, nb);
 345       newmem = _int_realloc (&main_arena, oldp, oldsize, nb);
 346     }
 347
 348   DIAG_PUSH_NEEDS_COMMENT;
 349 #if __GNUC_PREREQ (7, 0)
 350   /* GCC 7 warns about magic_p may be used uninitialized.  But we never
 351      reach here if magic_p is uninitialized.  */
 352   DIAG_IGNORE_NEEDS_COMMENT (7, "-Wmaybe-uninitialized");
 353 #endif
 354   /* mem2chunk_check changed the magic byte in the old chunk.
 355      If newmem is NULL, then the old chunk will still be used though,
 356      so we need to invert that change here.  */
 357   if (newmem == NULL)
 358     *magic_p ^= 0xFF;
 359   DIAG_POP_NEEDS_COMMENT;
 360
 361   __libc_lock_unlock (main_arena.mutex);
 362
 363   return mem2mem_check (newmem, bytes);
 364 }
 365
 366 static void *
 367 memalign_check (size_t alignment, size_t bytes, const void *caller)
 368 {
 369   void *mem;
 370
 371   if (alignment <= MALLOC_ALIGNMENT)
 372     return malloc_check (bytes, NULL);
 373
 374   if (alignment < MINSIZE)
 375     alignment = MINSIZE;
 376
 377   /* If the alignment is greater than SIZE_MAX / 2 + 1 it cannot be a
 378      power of 2 and will cause overflow in the check below.  */
 379   if (alignment > SIZE_MAX / 2 + 1)
 380     {
 381       __set_errno (EINVAL);
 382       return 0;
 383     }
 384
 385   /* Check for overflow.  */
 386   if (bytes > SIZE_MAX - alignment - MINSIZE)
 387     {
 388       __set_errno (ENOMEM);
 389       return 0;
 390     }
 391
 392   /* Make sure alignment is power of 2.  */
 393   if (!powerof2 (alignment))
 394     {
 395       size_t a = MALLOC_ALIGNMENT * 2;
 396       while (a < alignment)
 397         a <<= 1;
 398       alignment = a;
 399     }
 400
 401   __libc_lock_lock (main_arena.mutex);
 402   top_check ();
 403   mem = _int_memalign (&main_arena, alignment, bytes + 1);
 404   __libc_lock_unlock (main_arena.mutex);
 405   return mem2mem_check (mem, bytes);
 406 }
 407
 408 #if SHLIB_COMPAT (libc, GLIBC_2_0, GLIBC_2_25)
 409
 410 /* Get/set state: malloc_get_state() records the current state of all
 411    malloc variables (_except_ for the actual heap contents and `hook'
 412    function pointers) in a system dependent, opaque data structure.
 413    This data structure is dynamically allocated and can be free()d
 414    after use.  malloc_set_state() restores the state of all malloc
 415    variables to the previously obtained state.  This is especially
 416    useful when using this malloc as part of a shared library, and when
 417    the heap contents are saved/restored via some other method.  The
 418    primary example for this is GNU Emacs with its `dumping' procedure.
 419    `Hook' function pointers are never saved or restored by these
 420    functions, with two exceptions: If malloc checking was in use when
 421    malloc_get_state() was called, then malloc_set_state() calls
 422    __malloc_check_init() if possible; if malloc checking was not in
 423    use in the recorded state but the user requested malloc checking,
 424    then the hooks are reset to 0.  */
 425
 426 #define MALLOC_STATE_MAGIC   0x444c4541l
 427 #define MALLOC_STATE_VERSION (0 * 0x100l + 5l) /* major*0x100 + minor */
 428
 429 struct malloc_save_state
 430 {
 431   long magic;
 432   long version;
 433   mbinptr av[NBINS * 2 + 2];
 434   char *sbrk_base;
 435   int sbrked_mem_bytes;
 436   unsigned long trim_threshold;
 437   unsigned long top_pad;
 438   unsigned int n_mmaps_max;
 439   unsigned long mmap_threshold;
 440   int check_action;
 441   unsigned long max_sbrked_mem;
 442   unsigned long max_total_mem;  /* Always 0, for backwards compatibility.  */
 443   unsigned int n_mmaps;
 444   unsigned int max_n_mmaps;
 445   unsigned long mmapped_mem;
 446   unsigned long max_mmapped_mem;
 447   int using_malloc_checking;
 448   unsigned long max_fast;
 449   unsigned long arena_test;
 450   unsigned long arena_max;
 451   unsigned long narenas;
 452 };
 453
 454 /* Dummy implementation which always fails.  We need to provide this
 455    symbol so that existing Emacs binaries continue to work with
 456    BIND_NOW.  */
 457 void *
 458 attribute_compat_text_section
 459 malloc_get_state (void)
 460 {
 461   __set_errno (ENOSYS);
 462   return NULL;
 463 }
 464 compat_symbol (libc, malloc_get_state, malloc_get_state, GLIBC_2_0);
 465
 466 int
 467 attribute_compat_text_section
 468 malloc_set_state (void *msptr)
 469 {
 470   struct malloc_save_state *ms = (struct malloc_save_state *) msptr;
 471
 472   if (ms->magic != MALLOC_STATE_MAGIC)
 473     return -1;
 474
 475   /* Must fail if the major version is too high. */
 476   if ((ms->version & ~0xffl) > (MALLOC_STATE_VERSION & ~0xffl))
 477     return -2;
 478
 479   /* We do not need to perform locking here because __malloc_set_state
 480      must be called before the first call into the malloc subsytem
 481      (usually via __malloc_initialize_hook).  pthread_create always
 482      calls calloc and thus must be called only afterwards, so there
 483      cannot be more than one thread when we reach this point.  */
 484
 485   /* Disable the malloc hooks (and malloc checking).  */
 486   __malloc_hook = NULL;
 487   __realloc_hook = NULL;
 488   __free_hook = NULL;
 489   __memalign_hook = NULL;
 490   using_malloc_checking = 0;
 491
 492   /* Patch the dumped heap.  We no longer try to integrate into the
 493      existing heap.  Instead, we mark the existing chunks as mmapped.
 494      Together with the update to dumped_main_arena_start and
 495      dumped_main_arena_end, realloc and free will recognize these
 496      chunks as dumped fake mmapped chunks and never free them.  */
 497
 498   /* Find the chunk with the lowest address with the heap.  */
 499   mchunkptr chunk = NULL;
 500   {
 501     size_t *candidate = (size_t *) ms->sbrk_base;
 502     size_t *end = (size_t *) (ms->sbrk_base + ms->sbrked_mem_bytes);
 503     while (candidate < end)
 504       if (*candidate != 0)
 505         {
 506           chunk = mem2chunk ((void *) (candidate + 1));
 507           break;
 508         }
 509       else
 510         ++candidate;
 511   }
 512   if (chunk == NULL)
 513     return 0;
 514
 515   /* Iterate over the dumped heap and patch the chunks so that they
 516      are treated as fake mmapped chunks.  */
 517   mchunkptr top = ms->av[2];
 518   while (chunk < top)
 519     {
 520       if (inuse (chunk))
 521         {
 522           /* Mark chunk as mmapped, to trigger the fallback path.  */
 523           size_t size = chunksize (chunk);
 524           set_head (chunk, size | IS_MMAPPED);
 525         }
 526       chunk = next_chunk (chunk);
 527     }
 528
 529   /* The dumped fake mmapped chunks all lie in this address range.  */
 530   dumped_main_arena_start = (mchunkptr) ms->sbrk_base;
 531   dumped_main_arena_end = top;
 532
 533   return 0;
 534 }
 535 compat_symbol (libc, malloc_set_state, malloc_set_state, GLIBC_2_0);
 536
 537 #endif  /* SHLIB_COMPAT */
 538
 539 /*
 540  * Local variables:
 541  * c-basic-offset: 2
 542  * End:
 543  */