|
@@ -36,14 +36,15 @@
|
|
|
|
|
|
namespace UserspaceEmulator {
|
|
|
|
|
|
-MallocTracer::MallocTracer()
|
|
|
+MallocTracer::MallocTracer(Emulator& emulator)
|
|
|
+ : m_emulator(emulator)
|
|
|
{
|
|
|
}
|
|
|
|
|
|
template<typename Callback>
|
|
|
inline void MallocTracer::for_each_mallocation(Callback callback) const
|
|
|
{
|
|
|
- Emulator::the().mmu().for_each_region([&](auto& region) {
|
|
|
+ m_emulator.mmu().for_each_region([&](auto& region) {
|
|
|
if (region.is_mmap() && static_cast<const MmapRegion&>(region).is_malloc_block()) {
|
|
|
auto* malloc_data = static_cast<MmapRegion&>(region).malloc_metadata();
|
|
|
for (auto& mallocation : malloc_data->mallocations) {
|
|
@@ -57,7 +58,7 @@ inline void MallocTracer::for_each_mallocation(Callback callback) const
|
|
|
|
|
|
void MallocTracer::target_did_malloc(Badge<SoftCPU>, FlatPtr address, size_t size)
|
|
|
{
|
|
|
- auto* region = Emulator::the().mmu().find_region({ 0x20, address });
|
|
|
+ auto* region = m_emulator.mmu().find_region({ 0x20, address });
|
|
|
ASSERT(region);
|
|
|
ASSERT(region->is_mmap());
|
|
|
auto& mmap_region = static_cast<MmapRegion&>(*region);
|
|
@@ -72,7 +73,7 @@ void MallocTracer::target_did_malloc(Badge<SoftCPU>, FlatPtr address, size_t siz
|
|
|
ASSERT(existing_mallocation->freed);
|
|
|
existing_mallocation->size = size;
|
|
|
existing_mallocation->freed = false;
|
|
|
- existing_mallocation->malloc_backtrace = Emulator::the().raw_backtrace();
|
|
|
+ existing_mallocation->malloc_backtrace = m_emulator.raw_backtrace();
|
|
|
existing_mallocation->free_backtrace.clear();
|
|
|
return;
|
|
|
}
|
|
@@ -92,7 +93,7 @@ void MallocTracer::target_did_malloc(Badge<SoftCPU>, FlatPtr address, size_t siz
|
|
|
malloc_data->mallocations.resize(1);
|
|
|
dbgln("Tracking malloc block @ {:p} with chunk_size={}, chunk_count={}", malloc_data->address, malloc_data->chunk_size, malloc_data->mallocations.size());
|
|
|
}
|
|
|
- malloc_data->mallocation_for_address(address) = { address, size, true, false, Emulator::the().raw_backtrace(), Vector<FlatPtr>() };
|
|
|
+ malloc_data->mallocation_for_address(address) = { address, size, true, false, m_emulator.raw_backtrace(), Vector<FlatPtr>() };
|
|
|
}
|
|
|
|
|
|
ALWAYS_INLINE Mallocation& MallocRegionMetadata::mallocation_for_address(FlatPtr address) const
|
|
@@ -120,22 +121,22 @@ void MallocTracer::target_did_free(Badge<SoftCPU>, FlatPtr address)
|
|
|
if (mallocation->freed) {
|
|
|
reportln("\n=={}== \033[31;1mDouble free()\033[0m, {:p}", getpid(), address);
|
|
|
reportln("=={}== Address {} has already been passed to free()", getpid(), address);
|
|
|
- Emulator::the().dump_backtrace();
|
|
|
+ m_emulator.dump_backtrace();
|
|
|
} else {
|
|
|
mallocation->freed = true;
|
|
|
- mallocation->free_backtrace = Emulator::the().raw_backtrace();
|
|
|
+ mallocation->free_backtrace = m_emulator.raw_backtrace();
|
|
|
}
|
|
|
return;
|
|
|
}
|
|
|
|
|
|
reportln("\n=={}== \033[31;1mInvalid free()\033[0m, {:p}", getpid(), address);
|
|
|
reportln("=={}== Address {} has never been returned by malloc()", getpid(), address);
|
|
|
- Emulator::the().dump_backtrace();
|
|
|
+ m_emulator.dump_backtrace();
|
|
|
}
|
|
|
|
|
|
void MallocTracer::target_did_realloc(Badge<SoftCPU>, FlatPtr address, size_t size)
|
|
|
{
|
|
|
- auto* region = Emulator::the().mmu().find_region({ 0x20, address });
|
|
|
+ auto* region = m_emulator.mmu().find_region({ 0x20, address });
|
|
|
ASSERT(region);
|
|
|
ASSERT(region->is_mmap());
|
|
|
auto& mmap_region = static_cast<MmapRegion&>(*region);
|
|
@@ -158,7 +159,7 @@ void MallocTracer::target_did_realloc(Badge<SoftCPU>, FlatPtr address, size_t si
|
|
|
|
|
|
existing_mallocation->size = size;
|
|
|
// FIXME: Should we track malloc/realloc backtrace separately perhaps?
|
|
|
- existing_mallocation->malloc_backtrace = Emulator::the().raw_backtrace();
|
|
|
+ existing_mallocation->malloc_backtrace = m_emulator.raw_backtrace();
|
|
|
}
|
|
|
|
|
|
Mallocation* MallocTracer::find_mallocation(const Region& region, FlatPtr address)
|
|
@@ -179,7 +180,7 @@ Mallocation* MallocTracer::find_mallocation(const Region& region, FlatPtr addres
|
|
|
|
|
|
Mallocation* MallocTracer::find_mallocation(FlatPtr address)
|
|
|
{
|
|
|
- auto* region = Emulator::the().mmu().find_region({ 0x23, address });
|
|
|
+ auto* region = m_emulator.mmu().find_region({ 0x23, address });
|
|
|
if (!region)
|
|
|
return nullptr;
|
|
|
return find_mallocation(*region, address);
|
|
@@ -216,26 +217,26 @@ void MallocTracer::audit_read(const Region& region, FlatPtr address, size_t size
|
|
|
if (!m_auditing_enabled)
|
|
|
return;
|
|
|
|
|
|
- if (Emulator::the().is_in_malloc_or_free())
|
|
|
+ if (m_emulator.is_in_malloc_or_free())
|
|
|
return;
|
|
|
|
|
|
auto* mallocation = find_mallocation(region, address);
|
|
|
|
|
|
if (!mallocation) {
|
|
|
reportln("\n=={}== \033[31;1mHeap buffer overflow\033[0m, invalid {}-byte read at address {:p}", getpid(), size, address);
|
|
|
- Emulator::the().dump_backtrace();
|
|
|
+ m_emulator.dump_backtrace();
|
|
|
auto* mallocation_before = find_mallocation_before(address);
|
|
|
auto* mallocation_after = find_mallocation_after(address);
|
|
|
size_t distance_to_mallocation_before = mallocation_before ? (address - mallocation_before->address - mallocation_before->size) : 0;
|
|
|
size_t distance_to_mallocation_after = mallocation_after ? (mallocation_after->address - address) : 0;
|
|
|
if (mallocation_before && (!mallocation_after || distance_to_mallocation_before < distance_to_mallocation_after)) {
|
|
|
reportln("=={}== Address is {} byte(s) after block of size {}, identity {:p}, allocated at:", getpid(), distance_to_mallocation_before, mallocation_before->size, mallocation_before->address);
|
|
|
- Emulator::the().dump_backtrace(mallocation_before->malloc_backtrace);
|
|
|
+ m_emulator.dump_backtrace(mallocation_before->malloc_backtrace);
|
|
|
return;
|
|
|
}
|
|
|
if (mallocation_after && (!mallocation_before || distance_to_mallocation_after < distance_to_mallocation_before)) {
|
|
|
reportln("=={}== Address is {} byte(s) before block of size {}, identity {:p}, allocated at:", getpid(), distance_to_mallocation_after, mallocation_after->size, mallocation_after->address);
|
|
|
- Emulator::the().dump_backtrace(mallocation_after->malloc_backtrace);
|
|
|
+ m_emulator.dump_backtrace(mallocation_after->malloc_backtrace);
|
|
|
}
|
|
|
return;
|
|
|
}
|
|
@@ -244,11 +245,11 @@ void MallocTracer::audit_read(const Region& region, FlatPtr address, size_t size
|
|
|
|
|
|
if (mallocation->freed) {
|
|
|
reportln("\n=={}== \033[31;1mUse-after-free\033[0m, invalid {}-byte read at address {:p}", getpid(), size, address);
|
|
|
- Emulator::the().dump_backtrace();
|
|
|
+ m_emulator.dump_backtrace();
|
|
|
reportln("=={}== Address is {} byte(s) into block of size {}, allocated at:", getpid(), offset_into_mallocation, mallocation->size);
|
|
|
- Emulator::the().dump_backtrace(mallocation->malloc_backtrace);
|
|
|
+ m_emulator.dump_backtrace(mallocation->malloc_backtrace);
|
|
|
reportln("=={}== Later freed at:", getpid());
|
|
|
- Emulator::the().dump_backtrace(mallocation->free_backtrace);
|
|
|
+ m_emulator.dump_backtrace(mallocation->free_backtrace);
|
|
|
return;
|
|
|
}
|
|
|
}
|
|
@@ -258,25 +259,25 @@ void MallocTracer::audit_write(const Region& region, FlatPtr address, size_t siz
|
|
|
if (!m_auditing_enabled)
|
|
|
return;
|
|
|
|
|
|
- if (Emulator::the().is_in_malloc_or_free())
|
|
|
+ if (m_emulator.is_in_malloc_or_free())
|
|
|
return;
|
|
|
|
|
|
auto* mallocation = find_mallocation(region, address);
|
|
|
if (!mallocation) {
|
|
|
reportln("\n=={}== \033[31;1mHeap buffer overflow\033[0m, invalid {}-byte write at address {:p}", getpid(), size, address);
|
|
|
- Emulator::the().dump_backtrace();
|
|
|
+ m_emulator.dump_backtrace();
|
|
|
auto* mallocation_before = find_mallocation_before(address);
|
|
|
auto* mallocation_after = find_mallocation_after(address);
|
|
|
size_t distance_to_mallocation_before = mallocation_before ? (address - mallocation_before->address - mallocation_before->size) : 0;
|
|
|
size_t distance_to_mallocation_after = mallocation_after ? (mallocation_after->address - address) : 0;
|
|
|
if (mallocation_before && (!mallocation_after || distance_to_mallocation_before < distance_to_mallocation_after)) {
|
|
|
reportln("=={}== Address is {} byte(s) after block of size {}, identity {:p}, allocated at:", getpid(), distance_to_mallocation_before, mallocation_before->size, mallocation_before->address);
|
|
|
- Emulator::the().dump_backtrace(mallocation_before->malloc_backtrace);
|
|
|
+ m_emulator.dump_backtrace(mallocation_before->malloc_backtrace);
|
|
|
return;
|
|
|
}
|
|
|
if (mallocation_after && (!mallocation_before || distance_to_mallocation_after < distance_to_mallocation_before)) {
|
|
|
reportln("=={}== Address is {} byte(s) before block of size {}, identity {:p}, allocated at:", getpid(), distance_to_mallocation_after, mallocation_after->size, mallocation_after->address);
|
|
|
- Emulator::the().dump_backtrace(mallocation_after->malloc_backtrace);
|
|
|
+ m_emulator.dump_backtrace(mallocation_after->malloc_backtrace);
|
|
|
}
|
|
|
return;
|
|
|
}
|
|
@@ -285,11 +286,11 @@ void MallocTracer::audit_write(const Region& region, FlatPtr address, size_t siz
|
|
|
|
|
|
if (mallocation->freed) {
|
|
|
reportln("\n=={}== \033[31;1mUse-after-free\033[0m, invalid {}-byte write at address {:p}", getpid(), size, address);
|
|
|
- Emulator::the().dump_backtrace();
|
|
|
+ m_emulator.dump_backtrace();
|
|
|
reportln("=={}== Address is {} byte(s) into block of size {}, allocated at:", getpid(), offset_into_mallocation, mallocation->size);
|
|
|
- Emulator::the().dump_backtrace(mallocation->malloc_backtrace);
|
|
|
+ m_emulator.dump_backtrace(mallocation->malloc_backtrace);
|
|
|
reportln("=={}== Later freed at:", getpid());
|
|
|
- Emulator::the().dump_backtrace(mallocation->free_backtrace);
|
|
|
+ m_emulator.dump_backtrace(mallocation->free_backtrace);
|
|
|
return;
|
|
|
}
|
|
|
}
|
|
@@ -308,7 +309,7 @@ bool MallocTracer::is_reachable(const Mallocation& mallocation) const
|
|
|
return IterationDecision::Continue;
|
|
|
size_t pointers_in_mallocation = other_mallocation.size / sizeof(u32);
|
|
|
for (size_t i = 0; i < pointers_in_mallocation; ++i) {
|
|
|
- auto value = Emulator::the().mmu().read32({ 0x20, other_mallocation.address + i * sizeof(u32) });
|
|
|
+ auto value = m_emulator.mmu().read32({ 0x20, other_mallocation.address + i * sizeof(u32) });
|
|
|
if (value.value() == mallocation.address && !value.is_uninitialized()) {
|
|
|
#ifdef REACHABLE_DEBUG
|
|
|
reportln("mallocation {:p} is reachable from other mallocation {:p}", mallocation.address, other_mallocation.address);
|
|
@@ -324,7 +325,7 @@ bool MallocTracer::is_reachable(const Mallocation& mallocation) const
|
|
|
return true;
|
|
|
|
|
|
// 2. Search in other memory regions for pointers to this mallocation
|
|
|
- Emulator::the().mmu().for_each_region([&](auto& region) {
|
|
|
+ m_emulator.mmu().for_each_region([&](auto& region) {
|
|
|
// Skip the stack
|
|
|
if (region.is_stack())
|
|
|
return IterationDecision::Continue;
|
|
@@ -364,7 +365,7 @@ void MallocTracer::dump_leak_report()
|
|
|
++leaks_found;
|
|
|
bytes_leaked += mallocation.size;
|
|
|
reportln("\n=={}== \033[31;1mLeak\033[0m, {}-byte allocation at address {:p}", getpid(), mallocation.size, mallocation.address);
|
|
|
- Emulator::the().dump_backtrace(mallocation.malloc_backtrace);
|
|
|
+ m_emulator.dump_backtrace(mallocation.malloc_backtrace);
|
|
|
return IterationDecision::Continue;
|
|
|
});
|
|
|
|