1 /*
2  * Copyright (C) 2018 The Android Open Source Project
3  * All rights reserved.
4  *
5  * Redistribution and use in source and binary forms, with or without
6  * modification, are permitted provided that the following conditions
7  * are met:
8  *  * Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer.
10  *  * Redistributions in binary form must reproduce the above copyright
11  *    notice, this list of conditions and the following disclaimer in
12  *    the documentation and/or other materials provided with the
13  *    distribution.
14  *
15  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
16  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
17  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
18  * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
19  * COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
20  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
21  * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
22  * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
23  * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
24  * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
25  * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
26  * SUCH DAMAGE.
27  */
28 
29 #include <fcntl.h>
30 #include <malloc.h>
31 #include <stdlib.h>
32 #include <sys/types.h>
33 #include <sys/wait.h>
34 #include <unistd.h>
35 
36 #include <string>
37 #include <vector>
38 
39 #include <gtest/gtest.h>
40 
41 #include <android-base/test_utils.h>
42 #include <bionic/malloc.h>
43 #include <private/bionic_malloc_dispatch.h>
44 #include <tests/utils.h>
45 
46 __BEGIN_DECLS
47 
48 void get_malloc_leak_info(uint8_t**, size_t*, size_t*, size_t*, size_t*);
49 void free_malloc_leak_info(uint8_t*);
50 int malloc_iterate(uintptr_t, size_t, void (*)(uintptr_t, size_t, void*), void*);
51 void malloc_enable();
52 void malloc_disable();
53 ssize_t malloc_backtrace(void*, uintptr_t*, size_t);
54 
55 __END_DECLS
56 
57 class MallocHooksTest : public ::testing::Test {
58  protected:
SetUp()59   void SetUp() override {
60     ASSERT_EQ(0, setenv("LIBC_HOOKS_ENABLE", "1", true));
61     initialized_ = false;
62   }
63 
TearDown()64   void TearDown() override {
65     if (initialized_) {
66       Reset();
67     }
68     ASSERT_EQ(0, unsetenv("LIBC_HOOKS_ENABLE"));
69   }
70 
Init()71   void Init() {
72     initialized_ = true;
73     malloc_hook_called_ = false;
74     free_hook_called_ = false;
75     realloc_hook_called_ = false;
76     memalign_hook_called_ = false;
77 
78     void_arg_ = nullptr;
79 
80     orig_malloc_hook_ = __malloc_hook;
81     orig_free_hook_ = __free_hook;
82     orig_realloc_hook_ = __realloc_hook;
83     orig_memalign_hook_ = __memalign_hook;
84   }
85 
Reset()86   void Reset() {
87     __malloc_hook = orig_malloc_hook_;
88     __free_hook = orig_free_hook_;
89     __realloc_hook = orig_realloc_hook_;
90     __memalign_hook = orig_memalign_hook_;
91   }
92 
93   void Exec(std::vector<const char*> args);
94   void RunTest(std::string test_name);
95 
96  public:
97   bool initialized_;
98 
99   int fd_;
100   std::string raw_output_;
101   pid_t pid_;
102 
103   static bool malloc_hook_called_;
104   static bool free_hook_called_;
105   static bool realloc_hook_called_;
106   static bool memalign_hook_called_;
107   static const void* void_arg_;
108 
109   static void* (*orig_malloc_hook_)(size_t, const void*);
110   static void (*orig_free_hook_)(void*, const void*);
111   static void* (*orig_realloc_hook_)(void*, size_t, const void*);
112   static void* (*orig_memalign_hook_)(size_t, size_t, const void*);
113 
114   static void* test_malloc_hook(size_t, const void*);
115   static void* test_realloc_hook(void* ptr, size_t, const void*);
116   static void* test_memalign_hook(size_t, size_t, const void*);
117   static void test_free_hook(void*, const void*);
118 };
119 
120 bool MallocHooksTest::malloc_hook_called_;
121 bool MallocHooksTest::free_hook_called_;
122 bool MallocHooksTest::realloc_hook_called_;
123 bool MallocHooksTest::memalign_hook_called_;
124 const void* MallocHooksTest::void_arg_;
125 
126 void* (*MallocHooksTest::orig_malloc_hook_)(size_t, const void*);
127 void (*MallocHooksTest::orig_free_hook_)(void*, const void*);
128 void* (*MallocHooksTest::orig_realloc_hook_)(void*, size_t, const void*);
129 void* (*MallocHooksTest::orig_memalign_hook_)(size_t, size_t, const void*);
130 
GetExe(std::string * exe_name)131 static void GetExe(std::string* exe_name) {
132   char path[PATH_MAX];
133   ssize_t path_len = readlink("/proc/self/exe", path, sizeof(path));
134   ASSERT_TRUE(path_len >= 0);
135   *exe_name = std::string(path, path_len);
136 }
137 
RunTest(std::string test_name)138 void MallocHooksTest::RunTest(std::string test_name) {
139   std::vector<const char*> args;
140   args.push_back("--gtest_also_run_disabled_tests");
141   std::string filter_arg("--gtest_filter=" + test_name);
142   args.push_back(filter_arg.c_str());
143 
144   ExecTestHelper test;
145   test.Run(
146       [&]() {
147         std::string exe_name;
148         GetExe(&exe_name);
149         args.insert(args.begin(), exe_name.c_str());
150         args.push_back(nullptr);
151         execv(args[0], reinterpret_cast<char* const*>(const_cast<char**>(args.data())));
152         exit(1);
153       },
154       0, nullptr);
155 }
156 
test_malloc_hook(size_t size,const void * arg)157 void* MallocHooksTest::test_malloc_hook(size_t size, const void* arg) {
158   malloc_hook_called_ = true;
159   void_arg_ = arg;
160   return orig_malloc_hook_(size, arg);
161 }
162 
test_realloc_hook(void * ptr,size_t size,const void * arg)163 void* MallocHooksTest::test_realloc_hook(void* ptr, size_t size, const void* arg) {
164   realloc_hook_called_ = true;
165   void_arg_ = arg;
166   return orig_realloc_hook_(ptr, size, arg);
167 }
168 
test_memalign_hook(size_t alignment,size_t size,const void * arg)169 void* MallocHooksTest::test_memalign_hook(size_t alignment, size_t size, const void* arg) {
170   memalign_hook_called_ = true;
171   void_arg_ = arg;
172   return orig_memalign_hook_(alignment, size, arg);
173 }
174 
test_free_hook(void * ptr,const void * arg)175 void MallocHooksTest::test_free_hook(void* ptr, const void* arg) {
176   free_hook_called_ = true;
177   void_arg_ = arg;
178   return orig_free_hook_(ptr, arg);
179 }
180 
TEST_F(MallocHooksTest,other_malloc_functions)181 TEST_F(MallocHooksTest, other_malloc_functions) {
182   SKIP_WITH_HWASAN; // HWASan does not implement mallinfo.
183   RunTest("*.DISABLED_other_malloc_functions");
184 }
185 
186 // Call other intercepted functions to make sure there are no crashes.
TEST_F(MallocHooksTest,DISABLED_other_malloc_functions)187 TEST_F(MallocHooksTest, DISABLED_other_malloc_functions) {
188   struct mallinfo info = mallinfo();
189   EXPECT_NE(0U, info.uordblks);
190 
191   EXPECT_EQ(0, mallopt(-1000, -1000));
192 
193   void* ptr = malloc(1024);
194   EXPECT_LE(1024U, malloc_usable_size(ptr));
195   free(ptr);
196 }
197 
TEST_F(MallocHooksTest,extended_functions)198 TEST_F(MallocHooksTest, extended_functions) {
199   RunTest("*.DISABLED_extended_functions");
200 }
201 
TEST_F(MallocHooksTest,DISABLED_extended_functions)202 TEST_F(MallocHooksTest, DISABLED_extended_functions) {
203   android_mallopt_leak_info_t leak_info;
204   ASSERT_TRUE(android_mallopt(M_GET_MALLOC_LEAK_INFO, &leak_info, sizeof(leak_info)));
205   EXPECT_EQ(nullptr, leak_info.buffer);
206   EXPECT_EQ(0U, leak_info.overall_size);
207   EXPECT_EQ(0U, leak_info.info_size);
208   EXPECT_EQ(0U, leak_info.total_memory);
209   EXPECT_EQ(0U, leak_info.backtrace_size);
210 
211   ASSERT_TRUE(android_mallopt(M_FREE_MALLOC_LEAK_INFO, &leak_info, sizeof(leak_info)));
212 
213   malloc_enable();
214   malloc_disable();
215 
216   EXPECT_EQ(0, malloc_iterate(0, 0, nullptr, nullptr));
217 
218   // Malloc hooks doesn't support any backtracing.
219   EXPECT_EQ(0, malloc_backtrace(nullptr, nullptr, 10));
220 }
221 
TEST_F(MallocHooksTest,malloc_hook)222 TEST_F(MallocHooksTest, malloc_hook) {
223   RunTest("*.DISABLED_malloc_hook");
224 }
225 
TEST_F(MallocHooksTest,DISABLED_malloc_hook)226 TEST_F(MallocHooksTest, DISABLED_malloc_hook) {
227   Init();
228   ASSERT_TRUE(__malloc_hook != nullptr);
229   __malloc_hook = test_malloc_hook;
230 
231   void* ptr = malloc(1024);
232   ASSERT_TRUE(ptr != nullptr);
233   write(0, ptr, 0);
234   free(ptr);
235 
236   EXPECT_TRUE(malloc_hook_called_) << "The malloc hook was not called.";
237   EXPECT_TRUE(void_arg_ != nullptr) << "The malloc hook was called with a nullptr.";
238 }
239 
TEST_F(MallocHooksTest,free_hook)240 TEST_F(MallocHooksTest, free_hook) {
241   RunTest("*.DISABLED_free_hook");
242 }
243 
TEST_F(MallocHooksTest,DISABLED_free_hook)244 TEST_F(MallocHooksTest, DISABLED_free_hook) {
245   Init();
246   ASSERT_TRUE(__free_hook != nullptr);
247   __free_hook = test_free_hook;
248 
249   void* ptr = malloc(1024);
250   ASSERT_TRUE(ptr != nullptr);
251   free(ptr);
252   write(0, ptr, 0);
253 
254   EXPECT_TRUE(free_hook_called_) << "The free hook was not called.";
255   EXPECT_TRUE(void_arg_ != nullptr) << "The free hook was called with a nullptr.";
256 }
257 
TEST_F(MallocHooksTest,realloc_hook)258 TEST_F(MallocHooksTest, realloc_hook) {
259   RunTest("*.DISABLED_realloc_hook");
260 }
261 
TEST_F(MallocHooksTest,DISABLED_realloc_hook)262 TEST_F(MallocHooksTest, DISABLED_realloc_hook) {
263   Init();
264   ASSERT_TRUE(__realloc_hook != nullptr);
265   __realloc_hook = test_realloc_hook;
266 
267   void* ptr = malloc(1024);
268   ASSERT_TRUE(ptr != nullptr);
269   ptr = realloc(ptr, 2048);
270   free(ptr);
271   write(0, ptr, 0);
272 
273   EXPECT_TRUE(realloc_hook_called_) << "The realloc hook was not called.";
274   EXPECT_TRUE(void_arg_ != nullptr) << "The realloc hook was called with a nullptr.";
275 }
276 
TEST_F(MallocHooksTest,memalign_hook)277 TEST_F(MallocHooksTest, memalign_hook) {
278   RunTest("*.DISABLED_memalign_hook");
279 }
280 
TEST_F(MallocHooksTest,DISABLED_memalign_hook)281 TEST_F(MallocHooksTest, DISABLED_memalign_hook) {
282   Init();
283   ASSERT_TRUE(__memalign_hook != nullptr);
284   __memalign_hook = test_memalign_hook;
285 
286   void* ptr = memalign(32, 1024);
287   ASSERT_TRUE(ptr != nullptr);
288   free(ptr);
289   write(0, ptr, 0);
290 
291   EXPECT_TRUE(memalign_hook_called_) << "The memalign hook was not called.";
292   EXPECT_TRUE(void_arg_ != nullptr) << "The memalign hook was called with a nullptr.";
293 }
294 
TEST_F(MallocHooksTest,posix_memalign_hook)295 TEST_F(MallocHooksTest, posix_memalign_hook) {
296   RunTest("*.DISABLED_posix_memalign_hook");
297 }
298 
TEST_F(MallocHooksTest,DISABLED_posix_memalign_hook)299 TEST_F(MallocHooksTest, DISABLED_posix_memalign_hook) {
300   Init();
301   ASSERT_TRUE(__memalign_hook != nullptr);
302   __memalign_hook = test_memalign_hook;
303 
304   void* ptr;
305   ASSERT_EQ(0, posix_memalign(&ptr, 32, 1024));
306   ASSERT_TRUE(ptr != nullptr);
307   free(ptr);
308   write(0, ptr, 0);
309 
310   EXPECT_TRUE(memalign_hook_called_) << "The memalign hook was not called when running posix_memalign.";
311   EXPECT_TRUE(void_arg_ != nullptr) << "The memalign hook was called with a nullptr.";
312 }
313 
TEST_F(MallocHooksTest,posix_memalign_hook_error)314 TEST_F(MallocHooksTest, posix_memalign_hook_error) {
315   RunTest("*.DISABLED_posix_memalign_hook_error");
316 }
317 
TEST_F(MallocHooksTest,DISABLED_posix_memalign_hook_error)318 TEST_F(MallocHooksTest, DISABLED_posix_memalign_hook_error) {
319   Init();
320   ASSERT_TRUE(__memalign_hook != nullptr);
321   __memalign_hook = test_memalign_hook;
322 
323   void* ptr;
324   ASSERT_EQ(EINVAL, posix_memalign(&ptr, 11, 1024));
325   write(0, ptr, 0);
326 
327   EXPECT_FALSE(memalign_hook_called_)
328       << "The memalign hook was called when running posix_memalign with an error.";
329   EXPECT_FALSE(void_arg_ != nullptr)
330       << "The memalign hook was called with a nullptr with an error.";
331 }
332 
TEST_F(MallocHooksTest,aligned_alloc_hook)333 TEST_F(MallocHooksTest, aligned_alloc_hook) {
334   RunTest("*.DISABLED_aligned_alloc_hook");
335 }
336 
TEST_F(MallocHooksTest,DISABLED_aligned_alloc_hook)337 TEST_F(MallocHooksTest, DISABLED_aligned_alloc_hook) {
338   Init();
339   ASSERT_TRUE(__memalign_hook != nullptr);
340   __memalign_hook = test_memalign_hook;
341 
342   void* ptr = aligned_alloc(32, 1024);
343   ASSERT_TRUE(ptr != nullptr);
344   free(ptr);
345   write(0, ptr, 0);
346 
347   EXPECT_TRUE(memalign_hook_called_) << "The memalign hook was not called when running aligned_alloc.";
348   EXPECT_TRUE(void_arg_ != nullptr) << "The memalign hook was called with a nullptr.";
349 }
350 
TEST_F(MallocHooksTest,aligned_alloc_hook_error)351 TEST_F(MallocHooksTest, aligned_alloc_hook_error) {
352   RunTest("*.DISABLED_aligned_alloc_hook_error");
353 }
354 
355 // Allow deliberate call with non-power-of-two alignment in test code.
356 #pragma clang diagnostic push
357 #pragma clang diagnostic ignored "-Wnon-power-of-two-alignment"
TEST_F(MallocHooksTest,DISABLED_aligned_alloc_hook_error)358 TEST_F(MallocHooksTest, DISABLED_aligned_alloc_hook_error) {
359   Init();
360   ASSERT_TRUE(__memalign_hook != nullptr);
361   __memalign_hook = test_memalign_hook;
362 
363   void* ptr = aligned_alloc(11, 1024);
364   ASSERT_TRUE(ptr == nullptr);
365   EXPECT_EQ(EINVAL, errno);
366   write(0, ptr, 0);
367 
368   EXPECT_FALSE(memalign_hook_called_)
369       << "The memalign hook was called when running aligned_alloc with an error.";
370   EXPECT_FALSE(void_arg_ != nullptr)
371       << "The memalign hook was called with a nullptr with an error.";
372 }
373 #pragma clang diagnostic pop
374 
375 #if !defined(__LP64__)
TEST_F(MallocHooksTest,pvalloc_hook)376 TEST_F(MallocHooksTest, pvalloc_hook) {
377   RunTest("*.DISABLED_pvalloc_hook");
378 }
379 
380 extern "C" void* pvalloc(size_t);
381 
TEST_F(MallocHooksTest,DISABLED_pvalloc_hook)382 TEST_F(MallocHooksTest, DISABLED_pvalloc_hook) {
383   Init();
384   ASSERT_TRUE(__memalign_hook != nullptr);
385   __memalign_hook = test_memalign_hook;
386 
387   void* ptr = pvalloc(1024);
388   ASSERT_TRUE(ptr != nullptr);
389   write(0, ptr, 0);
390   free(ptr);
391 
392   EXPECT_TRUE(memalign_hook_called_) << "The memalign hook was not called for pvalloc.";
393   EXPECT_TRUE(void_arg_ != nullptr) << "The memalign hook was called with a nullptr.";
394 }
395 
TEST_F(MallocHooksTest,valloc_hook)396 TEST_F(MallocHooksTest, valloc_hook) {
397   RunTest("*.DISABLED_valloc_hook");
398 }
399 
400 extern "C" void* valloc(size_t);
401 
TEST_F(MallocHooksTest,DISABLED_valloc_hook)402 TEST_F(MallocHooksTest, DISABLED_valloc_hook) {
403   Init();
404   ASSERT_TRUE(__memalign_hook != nullptr);
405   __memalign_hook = test_memalign_hook;
406 
407   void* ptr = valloc(1024);
408   ASSERT_TRUE(ptr != nullptr);
409   write(0, ptr, 0);
410   free(ptr);
411 
412   EXPECT_TRUE(memalign_hook_called_) << "The memalign hook was not called for valloc.";
413   EXPECT_TRUE(void_arg_ != nullptr) << "The memalign hook was called with a nullptr.";
414 }
415 #endif
416