aboutsummaryrefslogtreecommitdiff
path: root/libc/bionic/malloc_common_dynamic.cpp
Commit message (Collapse)AuthorAgeFilesLines
* [GWP-ASan] Provide runtime configuration through an env var + sysprop.Mitch Phillips2022-04-201-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch introduces GWP-ASan system properties and environment variables to control the internal sampling rates of GWP-ASan. This can be used for: 1. "Torture testing" the system, i.e. running it under an extremely high sampling rate under GWP-ASan. 2. Increasing sampling remotely to allow further crash report collection of rare issues. There are three sets of system properites: 1. libc.debug.gwp_asan.*.system_default: Default values for native executables and system apps. 2. libc.debug.gwp_asan.*.app_default: Default values for non-system apps, and 3. libc.debug.gwp_asan.*.<basename/app_name>: Default values for an individual app or native process. There are three variables that can be changed: 1. The allocation sampling rate (default: 2500) - using the environment variable GWP_ASAN_SAMPLE_RATE or the libc.debug.gwp_asan.sample_rate.* system property. 2. The process sampling rate (default: 128 for system apps/processes, 1 for opted-in apps) - using the environment variable GWP_ASAN_PROCESS_SAMPLING or the libc.debug.gwp_asan.process_sampling.* system property, 3. The number of slots available (default: 32) - using the environment variable GWP_ASAN_MAX_ALLOCS or the libc.debug.gwp_asan.max_allocs.* system property. If not specified, #3 will be calculated as a ratio of the default |2500 SampleRate : 32 slots|. So, a sample rate of "1250" (i.e. twice as frequent sampling) will result in a doubling of the max_allocs to "64". Bug: 219651032 Test: atest bionic-unit-tests Change-Id: Idb40a2a4d074e01ce3c4e635ad639a91a32d570f
* Fix broken return code of M_INITIALIZE_GWP_ASAN.Christopher Ferris2021-09-201-3/+2
| | | | | | | | | | When calling android_mallopt using M_INITIALIZE_GWP_ASAN, nothing was being returned. Fix this, add a test, and also refactor the code a bit so dynamic and static share the same code. Test: Unit tests pass in dynamic and static versions. Test: Passed using both jemalloc and scudo. Change-Id: Ibe54b6ccabdbd44d2378892e793df393978bc02b
* Teach debuggerd to pass the secondary ring buffer to __scudo_get_error_info().Peter Collingbourne2021-02-121-0/+2
| | | | | | | | | | With this change we can report memory errors involving secondary allocations. Update the existing crasher tests to also test UAF/overflow/underflow on allocations with sizes sufficient to trigger the secondary allocator. Bug: 135772972 Change-Id: Ic8925c1f18621a8f272e26d5630e5d11d6d34d38
* [MemInit] Remove old API, introduce new MemInit API.Mitch Phillips2021-01-251-1/+1
| | | | | | | | | | | | Introduces new heap-zero-init API. We've realised that it's better to be able to individually control MTE and heap zero-init. Having heap-zero-init not be controllable without affecting MTE affects our ability to turn off heap-zero-init in zygote-forked applications. Bug: 135772972 Test: On FVP: atest -s localhost:5555 malloc#zero_init \ Test: malloc#disable_mte heap_tagging_level Change-Id: I8c6722502733259934c699f4f1269eaf1641a09f
* Remove the now-unnecessary android_mallopt() options.Elliott Hughes2021-01-151-6/+0
| | | | | | | | | These are available from mallopt() now, and all callers have been switched over. Bug: http://b/135772972 Test: treehugger Change-Id: I90c7a7573b261c27001a2dfd4589b23861ad613b
* Make "disable memory mitigations" and "set heap tagging level" more available.Elliott Hughes2021-01-141-5/+4
| | | | | | | | | | | | | These were only available internally via android_mallopt(), but they're likely to be needed by more code in future, so move them into mallopt(). This change leaves the android_mallopt() options for now, but I plan on coming back to remove them after I've switched the handful of callers over to mallopt() instead. Bug: http://b/135772972 Test: treehugger Change-Id: Ia154614069a7623c6aca85975a91e6a156f04759
* [Tagged Pointers] Allow probing the current TP level w/ locking.Mitch Phillips2020-11-301-0/+2
| | | | | | | | | | | | | | | | | | | aosp/1484976 introduced a breaking change where DisableMemoryMitigations() now indiscriminately turns tagged pointers off. When android_mallopt(M_DISABLE_MEMORY_MITIGATIONS) is called, the correct behaviour is: - In SYNC/ASYNC MTE mode -> disable all tagged pointers. - If all tagged pointers are already disabled -> nop. - If we're in TBI mode -> nop (keep the TBI mode as-is). In order to do that we have to allow probing of the current heap tagging mode. In order to prevent TOCTOU between GetHeapTaggingLevel() and SetHeapTaggingLevel(), we expose a global mutex that should be held when calling these functions. Bug: 174263432 Test: atest CtsTaggingHostTestCases on Flame Change-Id: Ia96f7269d542c9041270458806aee36766d2fbbb
* Add an API for per-process disabling memory initialization.Peter Collingbourne2020-10-081-0/+4
| | | | | | | | | | | | | | | | | | | | | | | Introduce an android_mallopt(M_DISABLE_MEMORY_MITIGATIONS) API call that may be used to disable zero- or pattern-init on non-MTE hardware, or memory tagging on MTE hardware. The intent is that this function may be called at any time, including when there are multiple threads running. Disabling zero- or pattern-init is quite trivial, we just need to set a global variable to 0 via a Scudo API call (although there will be some separate work required on the Scudo side to make this operation thread-safe). It is a bit more tricky to disable MTE across a process, because the kernel does not provide an API for disabling tag checking in all threads in a process, only per-thread. We need to send a signal to each of the process's threads with a handler that issues the required prctl call, and lock thread creation for the duration of the API call to avoid races between thread enumeration and calls to pthread_create(). Bug: 135772972 Change-Id: I81ece86ace916eb6b435ab516cd431ec4b48a3bf
* Introduce a new heap tagging level, M_HEAP_TAGGING_LEVEL_SYNC.Peter Collingbourne2020-05-051-0/+8
| | | | | | | | | | The SYNC tagging level enables stack trace collection for allocations and deallocations, which allows allocation and deallocation stack traces to appear in tombstones when encountering a tag check fault in synchronous tag checking mode. Bug: 135772972 Change-Id: Ibda9f51b29d2c8e2c993fc74425dea7bfa23ab1e
* Rename APEX NamespaceKiyoung Kim2020-02-201-1/+1
| | | | | | | | | | | | | | | Current APEX Namespace is named with APEX name itself, which also uses .(dot) so linker configuration can keep the syntax safe. For example, if there are APEX modules named 'A' and 'A.link.A', then 'namespace.A.link.A.link.A = a.so' phrase can be ambiguous from the linker. To allow any additional linker syntax in the future, we should avoid dot separator from the namespace name. Bug: 148826508 Test: m -j passed Test: boot succeeded from cuttlefish and walleye Change-Id: Ic3fe396aef6366fc6c7a0677bc7f92a57fd4e229
* Merge "Enable scudo for non-svelte configs."Christopher Ferris2020-02-121-8/+0
|\
| * Enable scudo for non-svelte configs.Christopher Ferris2020-02-111-8/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Scudo still isn't quite at the same RSS as jemalloc for the svelte config so only enable this for normal config. Bug: 137795072 Test: Built svelte config and verified it is still jemalloc. Test: Ran performance tests on normal config (bionic benchmarks). Test: Ran trace tests (system/extras/memory_replay). Test: Ran scudo unit tests. Test: Ran bionic unit tests. Test: Ran libmemunreachable tests. Test: Ran atest CtsRsBlasTestCases on cuttlefish. Test: Ran atest AslrMallocTest. Test: Ran atest CtsHiddenApiKillswitchWildcardTestCases and verified it has Test: the same runtime as the jemalloc. Change-Id: I241165feb8fe9ea814b7b166e3aaa6563d18524a
* | Merge "[GWP-ASan] Fix non-reentrant libc_globals init behaviour."Treehugger Robot2020-02-121-2/+4
|\ \
| * | [GWP-ASan] Fix non-reentrant libc_globals init behaviour.Mitch Phillips2020-02-111-2/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The WriteProtected mutator for __libc_globals isn't reentrant. Previously we were calling __libc_globals.mutate() inside of GWP-ASan's libc initialisation, which is called inside the __libc_globals.mutate(). This causes problems with malloc_debug and other malloc shims, as they fail to install when GWP-ASan is sampling their processes. Bug: 135634846 Test: atest bionic Change-Id: Iae51faa8d78677eeab6204b6ab4f3ae1b7517ba5
* | | Merge "[malloc dispatch] Install dispatch over the top of GWP-ASan."Treehugger Robot2020-02-121-1/+1
|\ \ \ | |_|/ |/| |
| * | [malloc dispatch] Install dispatch over the top of GWP-ASan.Mitch Phillips2020-02-111-1/+1
| |/ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When enabled, GWP-ASan sets the current dispatch table. Then, when a shim layer (malloc_debug, malloc_hooks, heapprofd) comes along, they should (by design) overwrite the current dispatch table. Currently, these shim layers check to see whether malloc_limit is installed by checking the current dispatch table against nullptr. Because GWP-ASan owns the current dispatch table, the shim thinks that malloc_limit is installed and falls back to only use the default dispatch, thinking that malloc_limit will call them. This is not the case, and they should take over the current dispatch pointer. Bug: 135634846 Test: atest bionic Change-Id: Ifb6f8864a15af9ac7f20d9364c40f73c5dd9d870
* | Merge "Use "com.android.runtime" for its link namespace"Treehugger Robot2020-02-111-2/+2
|\ \ | |/ |/|
| * Use "com.android.runtime" for its link namespaceJooyung Han2020-02-081-2/+2
| | | | | | | | | | | | | | | | | | For consistency, linker namespace for apex modules use its apex name instead of hard-coded short name. Bug: 148826508 Test: m / boot Change-Id: I4bf565cd528d744fc42841fd2d9f8bf652d4d346
* | [GWP-ASan] Integrate GWP-ASan into bionc's malloc() (using hooks).Mitch Phillips2020-02-101-25/+25
|/ | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch introduces GWP-ASan - a sampled allocator framework that finds use-after-free and heap-buffer-overflow bugs in production environments. GWP-ASan is being introduced in an always-disabled mode. This means that GWP-ASan will be permanently disabled until a further patch turns on support. As such, there should be no visible functional change for the time being. GWP-ASan requires -fno-emulated-tls wherever it's linked from. We intentionally link GWP-ASan into libc so that it's part of the initial set of libraries, and thus has static TLS storage (so we can use Initial-Exec TLS instead of Global-Dynamic). As a benefit, this reduces overhead for a sampled process. GWP-ASan is always initialised via. a call to mallopt(M_INITIALIZE_GWP_ASAN, which must be done before a process is multithreaded). More information about GWP-ASan can be found in the upstream documentation: http://llvm.org/docs/GwpAsan.html Bug: 135634846 Test: atest bionic Change-Id: Ib9bd33337d17dab39ac32f4536bff71bd23498b0
* Merge "Revert "Enable the scudo native allocator.""Christopher Ferris2020-01-211-0/+8
|\
| * Revert "Enable the scudo native allocator."Anna Trostanetski2020-01-201-0/+8
| | | | | | | | | | | | | | | | | | | | This reverts commit b1989584125ff863986068e2080e0ea686bf0b81. Reason for revert: b/147838132. Breaks JNI calls. Bug: 147838132 Change-Id: I657cf9fddc1e8ee60c1830a1b3f560ab51928a40
* | Merge "allow for heapprofd's signal to be multiplexed"Ryan Savitski2020-01-161-8/+37
|\ \ | |/ |/|
| * allow for heapprofd's signal to be multiplexedRyan Savitski2020-01-151-8/+37
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch refactors heapprofd_malloc to make it easier to reuse the reserved signal for multiple purposes. We define a new generic signal handler for profilers, which dispatches to more specific logic based on the signal's payload (si_value). The profiler signal handler is installed during libc preinit, after malloc initialization (so races against synchronous heapprofd initialization need not be considered). In terms of code organization, I copied the existing approach with a loosely referenced function in bionic_globals.h. Do tell if you'd rather a different approach here. The profileability of a process is quite tied to the malloc files/interfaces in bionic - in particular, it's set through android_mallopt. I do not change that, but instead introduce a new android_mallopt option to be able to query profileability of the process (which is now used by the new profiler signal handler). As part of that, gZygoteChildProfileable is moved from heapprofd_malloc to common (alongside gZygoteChild). I've removed the masking and reraising of the heapprofd signal when racing against malloc_limit init. We're ok with taking a simpler approach and dropping the heapprofd signal in such an unlikely race. Note: this requires a corresponding change in heapprofd to use sigqueue() instead of kill(), as the latter leaves the si_value uninitialized(?) on the receiving side. Bug: 144281346 Change-Id: I93bb2e82cff5870e5ca499cf86439860aca9dfa5
* | Enable the scudo native allocator.Christopher Ferris2020-01-141-8/+0
|/ | | | | | | | | | | | | | | This is attempt number two, all known failures and issues have been fixed. Bug: 137795072 Test: Built both svelte and non-svelte versions. Ran enormous numbers Test: of performance testing. Test: Ran scudo unit tests. Test: Ran bionic unit tests. Test: Ran libmemunreachable tests. Test: Ran atest CtsRsBlasTestCases on cuttlefish instance. Change-Id: Ib0c6ef38b63b7a1f39f4431ed8414afe3a92f9b5
* Add an android_mallopt for controlling the heap tagging level.Peter Collingbourne2020-01-091-0/+4
| | | | | | | | | | This doesn't add any functionality for now, but there are a couple of changes in flight that will want to add enumerators to the mallopt, so let's give them a place to add them. Bug: 135772972 Bug: 135754954 Change-Id: I6e810020f66070e844500c6fa99b703963365659
* Revert "Enable the scudo native allocator."Ytai Ben-tsvi2019-12-191-0/+8
| | | | | | | | | This reverts commit 6ffbe97859fb6f753a9c0d1b2bfe220af9b2ca46. Reason for revert: Droidcop-triggered revert due to breakage b/146543543 Change-Id: Ie9a5b2f6ca5dbc8d3c6cafe70e34838d74e45c56 Bug: 146543543
* Enable the scudo native allocator.Christopher Ferris2019-12-181-8/+0
| | | | | | | | | | Bug: 137795072 Test: Built both svelte and non-svelte versions. Ran enormous numbers Test: of performance testing. Test: Ran scudo unit tests. Test: Ran bionic unit tests. Change-Id: Iec6c98f2bdf6e0d5a6d18dff0c0883fac391c6d5
* Make android_mallopt weak for native bridgeEvgeny Eltsin2019-12-161-0/+1
| | | | | | | It is not intercepted by malloc hooks. Test: bionic-unit-tests --gtest_filter=android_mallopt* Change-Id: I3fb4101bdcdb62d82a09212fda9eafff7f43c786
* Rename iterate to malloc_iterate internally.Christopher Ferris2019-11-081-2/+3
| | | | | | | | | | | | I have no idea why I used the iterate name internally which is completely unlike every other function name. Change this to match everyone else so that it's now malloc_iterate everywhere. This is probably the last chance to change this before mainline modules begin, so make everything consistent. Test: Compiles, unit tests passes. Change-Id: I56d293377fa0fe1a3dc3dd85d6432f877cc2003c
* Make bionic_malloc.h a platform header.Christopher Ferris2019-09-161-1/+1
| | | | | | | | | | | | Instead of having platform directories directly include the private header, create a platform header directory and export it. Bug: 130763340 Test: Builds. Change-Id: Ie0f092b3fe077a3de8b90266c0b28bfbc20d0dfa Merged-In: Ie0f092b3fe077a3de8b90266c0b28bfbc20d0dfa (cherry picked from commit 8f582ef2f8a77d953d0e9f33387f592d20f852e2)
* Add removed platform functions used by apps.Christopher Ferris2019-05-081-0/+37
| | | | | | | | | | | | | Added get_malloc_leak_info and free_malloc_leak_info for arm 32 bit only so that the kindle app will continue to run. Bug: 132175052 Test: Ran kindle app, read pdf file. Verified libKindleReaderJNI.so Test: is loaded in memory properly. Change-Id: Ib1ea3a37b3729f9bcc2739c5f3a584ea8f66d200 Merged-In: Ib1ea3a37b3729f9bcc2739c5f3a584ea8f66d200 (cherry picked from commit 235f35a26632c4c3c748f8079950bcd35f676b79)
* Move all leak info functions to android_mallopt.Christopher Ferris2019-04-191-23/+36
| | | | | | | | | | | Bug: 130028357 Test: malloc_hooks unit tests. Test: Enable backtrace for mediaserver, run dumpsys media.player -m Test: Enable backtrace for calendar, run am dumpheap -n <PID> <FILE> Change-Id: I6774e28ccd9b3f2310127a5b39ccd15fe696a787 Merged-In: I6774e28ccd9b3f2310127a5b39ccd15fe696a787 (cherry picked from commit 3aadc5e80a5e2cf6b6760ed90d528709223bb449)
* Remove gMallocLeakZygoteChild.Christopher Ferris2019-04-161-2/+13
| | | | | | | | | | | | | | | Remove this global variable and change the setting of it to non-zero to a call to android_mallopt. In addition, change the initialize function to use pass a bool* instead of int*. Bug: 130028357 Test: Ran malloc_debug/malloc_hooks/perfetto tests. Change-Id: I20d382bdeaaf38aac6b9dcabea5b3dfab3c945f6 Merged-In: I20d382bdeaaf38aac6b9dcabea5b3dfab3c945f6 (cherry picked from commit 5225b342f0810c027df3d09fbbcef4d324b19b93)
* Don't load libc_malloc_* libs from runtime ns for libc_scudoJiyong Park2019-04-111-0/+8
| | | | | | | | | | | | | | | | | | | | | malloc_common_dynamic.cpp is compiled into both libc.so and libc_scudo.so. When compiled for libc_scudo.so, it doesn't try to load libc_malloc_* libs from the runtime linker namespace. This is because, unlike libc.so which is shared from the runtime APEX, libc_scudo.so is copied to any APEX that it needs. Furthermore, libdl_android which provides android_get_exported_namespace is not available for vendors. So the vendor variant of libc_scudo.so can't anyway locate the runtime namespace. Bug: 130213757 Bug: 122566199 Test: `m libc_scudo libc_scudo` is successful Test: inspect the built library to see if it has reference to android_get_exported_namespace Merged-In: I4c41de361fdb3fa34b95218923f4ce4e9c010f9e Change-Id: I4c41de361fdb3fa34b95218923f4ce4e9c010f9e (cherry picked from commit ff94a13d2d0679ea1ceb60464547237bb59362f7)
* Load libc_malloc_* libraries from the runtime APEXJiyong Park2019-04-111-1/+28
| | | | | | | | | | | | | | | | | | | | | | /system/lib/libc.so is a symlink to libc.so in the runtime APEX. libc_malloc_* libraries are bundled with libc.so because they share implementation details. However, since libc.so is loaded in the default namespace where the runtime APEX path (/apex/com.android.runtime/lib) is not accessible, libc.so has been using libc_malloc_* from /system/lib. This is wrong because libc.so (from the runtime APEX) and libc_malloc_* (from the platform) may not be in-sync. libc.so now uses android_dlopen_ext to load libc_malloc_* libraries correctly from the "runtime" linker namespace. Bug: 122566199 Test: bionic-unit-tests Merged-In: I46980fbe89e93ea79a7760c9b8eb007af0ada8d8 Change-Id: I46980fbe89e93ea79a7760c9b8eb007af0ada8d8 (cherry picked from commit 4e46ac69c23c8585bce17c2e032986a37bf33aef)
* Disable info messages by default for malloc debug.Christopher Ferris2019-04-021-3/+1
| | | | | | | | | | | | Add a new option verbose for malloc debug that is not enabled by default. This disables all of the info log messages. It turns out these log messages can add a measurable amount of time and can change the boot up. Bug: 129239269 Test: Adjusted unit tests pass. Test: Verified no messages unless verbose option used. Change-Id: I805cb7c8ecb44de88119574e59d784877cacc383
* Fix double initialization call.Christopher Ferris2019-03-281-7/+0
| | | | | | | | | | The previous refactor left a double call to the initialization of the loaded hooks. Remove the unnecessary call. Bug: 129239269 Test: All unit tests pass. No double printing of init messages. Change-Id: Ie980f2383c75d69f8b06bf9a431bb59caef21188
* Add a platform API for setting an allocation limit.Christopher Ferris2019-03-151-1/+17
| | | | | | | | | | | | | | | | | | | | | | | | | Introduce an M_SET_ALLOCATION_LIMIT enumerator for android_mallopt(), which can be used to set an upper bound on the total size of all allocations made using the memory allocation APIs. This is useful for programs such as audioextractor and mediaserver which need to set such a limit as a security mitigation. Currently these programs are using setrlimit(RLIMIT_AS) which isn't exactly what these programs want to control. RLIMIT_AS is also problematic under sanitizers which allocate large amounts of address space as shadow memory, and is especially problematic under shadow call stack, which requires 16MB of address space per thread. Add new unit tests for bionic. Add new unit tests for malloc debug that verify that when the limit is enabled, malloc debug still functions for nearly every allocation function. Bug: 118642754 Test: Ran bionic-unit-tests/bionic-unit-tests-static. Test: Ran malloc debug tests and perfetto integration tests. Change-Id: I735403c4d2c87f00fb2cdef81d00af0af446b2bb
* Refactor the malloc_info code.Christopher Ferris2019-03-071-0/+5
| | | | | | | | | | | | | | malloc_info needs to be per native allocator, but the code treated it like a global function that doesn't depend on the native memory allocator. Update malloc debug to dump the actual pointers that it has been tracking. Test: bionic-unit-tests pass. Test: malloc debug tests pass. Test: malloc hook tests pass. Change-Id: I3b0d4d748489dd84c16d16933479dc8b8d79013e Merged-In: I3b0d4d748489dd84c16d16933479dc8b8d79013e (cherry picked from commit a3656a98b10d2a4a6194a5d9705ad9c2cc5877b0)
* Avoid heapprofd init when other hooks enabled.Christopher Ferris2019-02-141-9/+20
| | | | | | | | | | | All of the heapprofd code assumes that it's the only hook that has been enabled. Enforce that by disallowing heapprofd from enabling if malloc debug or malloc hooks have been enabled. Test: Ran all unit tests (bionic/malloc hooks/malloc debug/perfetto). Test: Enabled malloc debug ran perfetto integration tests and verified Test: that an error message goes to the log. Change-Id: I506fbf1c5b8e4052855531fa0d161f5de06e6c1a
* Refactor malloc common into distinct pieces.Christopher Ferris2019-02-121-0/+420
The pieces: - The malloc common shared by static and dynamic code (malloc_common.cpp). - The code for shared libraries that includes any dlopen'ing (malloc_common_dynamic.cpp). - The implementation of perfetto's heapprofd (malloc_heapprofd.cpp). This makes it easier to see what's going on in the many different areas. It should also make it easier to add the allocation capping option. Other related changes: - Update the unit tests for android_mallopt. All of the current options don't work on static binaries, so make sure that is reflected in the test. - A few names changes to make sure that all code is consistent. Test: Ran tests (malloc hooks/malloc debug/perfetto/bionic unit tests). Change-Id: I0893bfbc0f83d82506fac5d1f37cf92fbdef6f59
generated by cgit v1.2.3 (git 2.25.1) at 2026-01-13 02:39:13 +0000