mcheck.c 10 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416
  1. /* Standard debugging hooks for `malloc'.
  2. Copyright (C) 1990-2019 Free Software Foundation, Inc.
  3. This file is part of the GNU C Library.
  4. Written May 1989 by Mike Haertel.
  5. The GNU C Library is free software; you can redistribute it and/or
  6. modify it under the terms of the GNU Lesser General Public
  7. License as published by the Free Software Foundation; either
  8. version 2.1 of the License, or (at your option) any later version.
  9. The GNU C Library is distributed in the hope that it will be useful,
  10. but WITHOUT ANY WARRANTY; without even the implied warranty of
  11. MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
  12. Lesser General Public License for more details.
  13. You should have received a copy of the GNU Lesser General Public
  14. License along with the GNU C Library; if not, see
  15. <http://www.gnu.org/licenses/>. */
  16. #ifndef _MALLOC_INTERNAL
  17. # define _MALLOC_INTERNAL
  18. # include <malloc.h>
  19. # include <mcheck.h>
  20. # include <stdint.h>
  21. # include <stdio.h>
  22. # include <libintl.h>
  23. # include <errno.h>
  24. #endif
  25. /* Old hook values. */
  26. static void (*old_free_hook)(void *ptr, const void *);
  27. static void *(*old_malloc_hook) (size_t size, const void *);
  28. static void *(*old_memalign_hook) (size_t alignment, size_t size,
  29. const void *);
  30. static void *(*old_realloc_hook) (void *ptr, size_t size,
  31. const void *);
  32. /* Function to call when something awful happens. */
  33. static void (*abortfunc) (enum mcheck_status);
  34. /* Arbitrary magical numbers. */
  35. #define MAGICWORD 0xfedabeeb
  36. #define MAGICFREE 0xd8675309
  37. #define MAGICBYTE ((char) 0xd7)
  38. #define MALLOCFLOOD ((char) 0x93)
  39. #define FREEFLOOD ((char) 0x95)
  40. struct hdr
  41. {
  42. size_t size; /* Exact size requested by user. */
  43. unsigned long int magic; /* Magic number to check header integrity. */
  44. struct hdr *prev;
  45. struct hdr *next;
  46. void *block; /* Real block allocated, for memalign. */
  47. unsigned long int magic2; /* Extra, keeps us doubleword aligned. */
  48. };
  49. /* This is the beginning of the list of all memory blocks allocated.
  50. It is only constructed if the pedantic testing is requested. */
  51. static struct hdr *root;
  52. static int mcheck_used;
  53. /* Nonzero if pedentic checking of all blocks is requested. */
  54. static int pedantic;
  55. #if defined _LIBC || defined STDC_HEADERS || defined USG
  56. # include <string.h>
  57. # define flood memset
  58. #else
  59. static void flood (void *, int, size_t);
  60. static void
  61. flood (void *ptr, int val, size_t size)
  62. {
  63. char *cp = ptr;
  64. while (size--)
  65. *cp++ = val;
  66. }
  67. #endif
  68. static enum mcheck_status
  69. checkhdr (const struct hdr *hdr)
  70. {
  71. enum mcheck_status status;
  72. if (!mcheck_used)
  73. /* Maybe the mcheck used is disabled? This happens when we find
  74. an error and report it. */
  75. return MCHECK_OK;
  76. switch (hdr->magic ^ ((uintptr_t) hdr->prev + (uintptr_t) hdr->next))
  77. {
  78. default:
  79. status = MCHECK_HEAD;
  80. break;
  81. case MAGICFREE:
  82. status = MCHECK_FREE;
  83. break;
  84. case MAGICWORD:
  85. if (((char *) &hdr[1])[hdr->size] != MAGICBYTE)
  86. status = MCHECK_TAIL;
  87. else if ((hdr->magic2 ^ (uintptr_t) hdr->block) != MAGICWORD)
  88. status = MCHECK_HEAD;
  89. else
  90. status = MCHECK_OK;
  91. break;
  92. }
  93. if (status != MCHECK_OK)
  94. {
  95. mcheck_used = 0;
  96. (*abortfunc) (status);
  97. mcheck_used = 1;
  98. }
  99. return status;
  100. }
  101. void
  102. mcheck_check_all (void)
  103. {
  104. /* Walk through all the active blocks and test whether they were tampered
  105. with. */
  106. struct hdr *runp = root;
  107. /* Temporarily turn off the checks. */
  108. pedantic = 0;
  109. while (runp != NULL)
  110. {
  111. (void) checkhdr (runp);
  112. runp = runp->next;
  113. }
  114. /* Turn checks on again. */
  115. pedantic = 1;
  116. }
  117. #ifdef _LIBC
  118. libc_hidden_def (mcheck_check_all)
  119. #endif
  120. static void
  121. unlink_blk (struct hdr *ptr)
  122. {
  123. if (ptr->next != NULL)
  124. {
  125. ptr->next->prev = ptr->prev;
  126. ptr->next->magic = MAGICWORD ^ ((uintptr_t) ptr->next->prev
  127. + (uintptr_t) ptr->next->next);
  128. }
  129. if (ptr->prev != NULL)
  130. {
  131. ptr->prev->next = ptr->next;
  132. ptr->prev->magic = MAGICWORD ^ ((uintptr_t) ptr->prev->prev
  133. + (uintptr_t) ptr->prev->next);
  134. }
  135. else
  136. root = ptr->next;
  137. }
  138. static void
  139. link_blk (struct hdr *hdr)
  140. {
  141. hdr->prev = NULL;
  142. hdr->next = root;
  143. root = hdr;
  144. hdr->magic = MAGICWORD ^ (uintptr_t) hdr->next;
  145. /* And the next block. */
  146. if (hdr->next != NULL)
  147. {
  148. hdr->next->prev = hdr;
  149. hdr->next->magic = MAGICWORD ^ ((uintptr_t) hdr
  150. + (uintptr_t) hdr->next->next);
  151. }
  152. }
  153. static void
  154. freehook (void *ptr, const void *caller)
  155. {
  156. if (pedantic)
  157. mcheck_check_all ();
  158. if (ptr)
  159. {
  160. struct hdr *hdr = ((struct hdr *) ptr) - 1;
  161. checkhdr (hdr);
  162. hdr->magic = MAGICFREE;
  163. hdr->magic2 = MAGICFREE;
  164. unlink_blk (hdr);
  165. hdr->prev = hdr->next = NULL;
  166. flood (ptr, FREEFLOOD, hdr->size);
  167. ptr = hdr->block;
  168. }
  169. __free_hook = old_free_hook;
  170. if (old_free_hook != NULL)
  171. (*old_free_hook)(ptr, caller);
  172. else
  173. free (ptr);
  174. __free_hook = freehook;
  175. }
  176. static void *
  177. mallochook (size_t size, const void *caller)
  178. {
  179. struct hdr *hdr;
  180. if (pedantic)
  181. mcheck_check_all ();
  182. if (size > ~((size_t) 0) - (sizeof (struct hdr) + 1))
  183. {
  184. __set_errno (ENOMEM);
  185. return NULL;
  186. }
  187. __malloc_hook = old_malloc_hook;
  188. if (old_malloc_hook != NULL)
  189. hdr = (struct hdr *) (*old_malloc_hook)(sizeof (struct hdr) + size + 1,
  190. caller);
  191. else
  192. hdr = (struct hdr *) malloc (sizeof (struct hdr) + size + 1);
  193. __malloc_hook = mallochook;
  194. if (hdr == NULL)
  195. return NULL;
  196. hdr->size = size;
  197. link_blk (hdr);
  198. hdr->block = hdr;
  199. hdr->magic2 = (uintptr_t) hdr ^ MAGICWORD;
  200. ((char *) &hdr[1])[size] = MAGICBYTE;
  201. flood ((void *) (hdr + 1), MALLOCFLOOD, size);
  202. return (void *) (hdr + 1);
  203. }
  204. static void *
  205. memalignhook (size_t alignment, size_t size,
  206. const void *caller)
  207. {
  208. struct hdr *hdr;
  209. size_t slop;
  210. char *block;
  211. if (pedantic)
  212. mcheck_check_all ();
  213. slop = (sizeof *hdr + alignment - 1) & - alignment;
  214. if (size > ~((size_t) 0) - (slop + 1))
  215. {
  216. __set_errno (ENOMEM);
  217. return NULL;
  218. }
  219. __memalign_hook = old_memalign_hook;
  220. if (old_memalign_hook != NULL)
  221. block = (*old_memalign_hook)(alignment, slop + size + 1, caller);
  222. else
  223. block = memalign (alignment, slop + size + 1);
  224. __memalign_hook = memalignhook;
  225. if (block == NULL)
  226. return NULL;
  227. hdr = ((struct hdr *) (block + slop)) - 1;
  228. hdr->size = size;
  229. link_blk (hdr);
  230. hdr->block = (void *) block;
  231. hdr->magic2 = (uintptr_t) block ^ MAGICWORD;
  232. ((char *) &hdr[1])[size] = MAGICBYTE;
  233. flood ((void *) (hdr + 1), MALLOCFLOOD, size);
  234. return (void *) (hdr + 1);
  235. }
  236. static void *
  237. reallochook (void *ptr, size_t size, const void *caller)
  238. {
  239. if (size == 0)
  240. {
  241. freehook (ptr, caller);
  242. return NULL;
  243. }
  244. struct hdr *hdr;
  245. size_t osize;
  246. if (pedantic)
  247. mcheck_check_all ();
  248. if (size > ~((size_t) 0) - (sizeof (struct hdr) + 1))
  249. {
  250. __set_errno (ENOMEM);
  251. return NULL;
  252. }
  253. if (ptr)
  254. {
  255. hdr = ((struct hdr *) ptr) - 1;
  256. osize = hdr->size;
  257. checkhdr (hdr);
  258. unlink_blk (hdr);
  259. if (size < osize)
  260. flood ((char *) ptr + size, FREEFLOOD, osize - size);
  261. }
  262. else
  263. {
  264. osize = 0;
  265. hdr = NULL;
  266. }
  267. __free_hook = old_free_hook;
  268. __malloc_hook = old_malloc_hook;
  269. __memalign_hook = old_memalign_hook;
  270. __realloc_hook = old_realloc_hook;
  271. if (old_realloc_hook != NULL)
  272. hdr = (struct hdr *) (*old_realloc_hook)((void *) hdr,
  273. sizeof (struct hdr) + size + 1,
  274. caller);
  275. else
  276. hdr = (struct hdr *) realloc ((void *) hdr,
  277. sizeof (struct hdr) + size + 1);
  278. __free_hook = freehook;
  279. __malloc_hook = mallochook;
  280. __memalign_hook = memalignhook;
  281. __realloc_hook = reallochook;
  282. if (hdr == NULL)
  283. return NULL;
  284. hdr->size = size;
  285. link_blk (hdr);
  286. hdr->block = hdr;
  287. hdr->magic2 = (uintptr_t) hdr ^ MAGICWORD;
  288. ((char *) &hdr[1])[size] = MAGICBYTE;
  289. if (size > osize)
  290. flood ((char *) (hdr + 1) + osize, MALLOCFLOOD, size - osize);
  291. return (void *) (hdr + 1);
  292. }
  293. __attribute__ ((noreturn))
  294. static void
  295. mabort (enum mcheck_status status)
  296. {
  297. const char *msg;
  298. switch (status)
  299. {
  300. case MCHECK_OK:
  301. msg = _ ("memory is consistent, library is buggy\n");
  302. break;
  303. case MCHECK_HEAD:
  304. msg = _ ("memory clobbered before allocated block\n");
  305. break;
  306. case MCHECK_TAIL:
  307. msg = _ ("memory clobbered past end of allocated block\n");
  308. break;
  309. case MCHECK_FREE:
  310. msg = _ ("block freed twice\n");
  311. break;
  312. default:
  313. msg = _ ("bogus mcheck_status, library is buggy\n");
  314. break;
  315. }
  316. #ifdef _LIBC
  317. __libc_fatal (msg);
  318. #else
  319. fprintf (stderr, "mcheck: %s", msg);
  320. fflush (stderr);
  321. abort ();
  322. #endif
  323. }
  324. /* Memory barrier so that GCC does not optimize out the argument. */
  325. #define malloc_opt_barrier(x) \
  326. ({ __typeof (x) __x = x; __asm ("" : "+m" (__x)); __x; })
  327. int
  328. mcheck (void (*func) (enum mcheck_status))
  329. {
  330. abortfunc = (func != NULL) ? func : &mabort;
  331. /* These hooks may not be safely inserted if malloc is already in use. */
  332. if (__malloc_initialized <= 0 && !mcheck_used)
  333. {
  334. /* We call malloc() once here to ensure it is initialized. */
  335. void *p = malloc (0);
  336. /* GCC might optimize out the malloc/free pair without a barrier. */
  337. p = malloc_opt_barrier (p);
  338. free (p);
  339. old_free_hook = __free_hook;
  340. __free_hook = freehook;
  341. old_malloc_hook = __malloc_hook;
  342. __malloc_hook = mallochook;
  343. old_memalign_hook = __memalign_hook;
  344. __memalign_hook = memalignhook;
  345. old_realloc_hook = __realloc_hook;
  346. __realloc_hook = reallochook;
  347. mcheck_used = 1;
  348. }
  349. return mcheck_used ? 0 : -1;
  350. }
  351. #ifdef _LIBC
  352. libc_hidden_def (mcheck)
  353. #endif
  354. int
  355. mcheck_pedantic (void (*func) (enum mcheck_status))
  356. {
  357. int res = mcheck (func);
  358. if (res == 0)
  359. pedantic = 1;
  360. return res;
  361. }
  362. enum mcheck_status
  363. mprobe (void *ptr)
  364. {
  365. return mcheck_used ? checkhdr (((struct hdr *) ptr) - 1) : MCHECK_DISABLED;
  366. }