| OLD | NEW |
| 1 // Copyright 2017 The Chromium Authors. All rights reserved. | 1 // Copyright 2017 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 // This file contains all the logic necessary to intercept allocations on | 5 // This file contains all the logic necessary to intercept allocations on |
| 6 // macOS. "malloc zones" are an abstraction that allows the process to intercept | 6 // macOS. "malloc zones" are an abstraction that allows the process to intercept |
| 7 // all malloc-related functions. There is no good mechanism [short of | 7 // all malloc-related functions. There is no good mechanism [short of |
| 8 // interposition] to determine new malloc zones are added, so there's no clean | 8 // interposition] to determine new malloc zones are added, so there's no clean |
| 9 // mechanism to intercept all malloc zones. This file contains logic to | 9 // mechanism to intercept all malloc zones. This file contains logic to |
| 10 // intercept the default and purgeable zones, which always exist. A cursory | 10 // intercept the default and purgeable zones, which always exist. A cursory |
| (...skipping 11 matching lines...) Expand all Loading... |
| 22 #include <errno.h> | 22 #include <errno.h> |
| 23 #include <mach/mach.h> | 23 #include <mach/mach.h> |
| 24 #include <mach/mach_vm.h> | 24 #include <mach/mach_vm.h> |
| 25 #import <objc/runtime.h> | 25 #import <objc/runtime.h> |
| 26 #include <stddef.h> | 26 #include <stddef.h> |
| 27 | 27 |
| 28 #include <new> | 28 #include <new> |
| 29 | 29 |
| 30 #include "base/allocator/features.h" | 30 #include "base/allocator/features.h" |
| 31 #include "base/allocator/malloc_zone_functions_mac.h" | 31 #include "base/allocator/malloc_zone_functions_mac.h" |
| 32 #include "base/bind.h" | |
| 33 #include "base/logging.h" | 32 #include "base/logging.h" |
| 34 #include "base/mac/mac_util.h" | 33 #include "base/mac/mac_util.h" |
| 35 #include "base/mac/mach_logging.h" | 34 #include "base/mac/mach_logging.h" |
| 36 #include "base/process/memory.h" | 35 #include "base/process/memory.h" |
| 37 #include "base/scoped_clear_errno.h" | 36 #include "base/scoped_clear_errno.h" |
| 38 #include "base/threading/sequenced_task_runner_handle.h" | |
| 39 #include "build/build_config.h" | 37 #include "build/build_config.h" |
| 40 #include "third_party/apple_apsl/CFBase.h" | 38 #include "third_party/apple_apsl/CFBase.h" |
| 41 | 39 |
| 42 namespace base { | 40 namespace base { |
| 43 namespace allocator { | 41 namespace allocator { |
| 44 | 42 |
| 45 bool g_replaced_default_zone = false; | 43 bool g_replaced_default_zone = false; |
| 46 | 44 |
| 47 namespace { | 45 namespace { |
| 48 | 46 |
| (...skipping 209 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 258 typedef id (*allocWithZone_t)(id, SEL, NSZone*); | 256 typedef id (*allocWithZone_t)(id, SEL, NSZone*); |
| 259 allocWithZone_t g_old_allocWithZone; | 257 allocWithZone_t g_old_allocWithZone; |
| 260 | 258 |
| 261 id oom_killer_allocWithZone(id self, SEL _cmd, NSZone* zone) { | 259 id oom_killer_allocWithZone(id self, SEL _cmd, NSZone* zone) { |
| 262 id result = g_old_allocWithZone(self, _cmd, zone); | 260 id result = g_old_allocWithZone(self, _cmd, zone); |
| 263 if (!result) | 261 if (!result) |
| 264 TerminateBecauseOutOfMemory(0); | 262 TerminateBecauseOutOfMemory(0); |
| 265 return result; | 263 return result; |
| 266 } | 264 } |
| 267 | 265 |
| 266 void ReplaceZoneFunctions(ChromeMallocZone* zone, |
| 267 const MallocZoneFunctions* functions) { |
| 268 // Remove protection. |
| 269 mach_vm_address_t reprotection_start = 0; |
| 270 mach_vm_size_t reprotection_length = 0; |
| 271 vm_prot_t reprotection_value = VM_PROT_NONE; |
| 272 DeprotectMallocZone(zone, &reprotection_start, &reprotection_length, |
| 273 &reprotection_value); |
| 274 |
| 275 CHECK(functions->malloc && functions->calloc && functions->valloc && |
| 276 functions->free && functions->realloc); |
| 277 zone->malloc = functions->malloc; |
| 278 zone->calloc = functions->calloc; |
| 279 zone->valloc = functions->valloc; |
| 280 zone->free = functions->free; |
| 281 zone->realloc = functions->realloc; |
| 282 if (functions->batch_malloc) |
| 283 zone->batch_malloc = functions->batch_malloc; |
| 284 if (functions->batch_free) |
| 285 zone->batch_free = functions->batch_free; |
| 286 if (functions->size) |
| 287 zone->size = functions->size; |
| 288 if (zone->version >= 5 && functions->memalign) { |
| 289 zone->memalign = functions->memalign; |
| 290 } |
| 291 if (zone->version >= 6 && functions->free_definite_size) { |
| 292 zone->free_definite_size = functions->free_definite_size; |
| 293 } |
| 294 |
| 295 // Restore protection if it was active. |
| 296 if (reprotection_start) { |
| 297 kern_return_t result = |
| 298 mach_vm_protect(mach_task_self(), reprotection_start, |
| 299 reprotection_length, false, reprotection_value); |
| 300 MACH_CHECK(result == KERN_SUCCESS, result) << "mach_vm_protect"; |
| 301 } |
| 302 } |
| 303 |
| 268 void UninterceptMallocZoneForTesting(struct _malloc_zone_t* zone) { | 304 void UninterceptMallocZoneForTesting(struct _malloc_zone_t* zone) { |
| 269 ChromeMallocZone* chrome_zone = reinterpret_cast<ChromeMallocZone*>(zone); | 305 ChromeMallocZone* chrome_zone = reinterpret_cast<ChromeMallocZone*>(zone); |
| 270 if (!IsMallocZoneAlreadyStored(chrome_zone)) | 306 if (!IsMallocZoneAlreadyStored(chrome_zone)) |
| 271 return; | 307 return; |
| 272 MallocZoneFunctions& functions = GetFunctionsForZone(zone); | 308 MallocZoneFunctions& functions = GetFunctionsForZone(zone); |
| 273 ReplaceZoneFunctions(chrome_zone, &functions); | 309 ReplaceZoneFunctions(chrome_zone, &functions); |
| 274 } | 310 } |
| 275 | 311 |
| 276 } // namespace | 312 } // namespace |
| 277 | 313 |
| (...skipping 203 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 481 kern_return_t kr = malloc_get_all_zones(mach_task_self(), 0, &zones, &count); | 517 kern_return_t kr = malloc_get_all_zones(mach_task_self(), 0, &zones, &count); |
| 482 CHECK(kr == KERN_SUCCESS); | 518 CHECK(kr == KERN_SUCCESS); |
| 483 for (unsigned int i = 0; i < count; ++i) { | 519 for (unsigned int i = 0; i < count; ++i) { |
| 484 UninterceptMallocZoneForTesting( | 520 UninterceptMallocZoneForTesting( |
| 485 reinterpret_cast<struct _malloc_zone_t*>(zones[i])); | 521 reinterpret_cast<struct _malloc_zone_t*>(zones[i])); |
| 486 } | 522 } |
| 487 | 523 |
| 488 ClearAllMallocZonesForTesting(); | 524 ClearAllMallocZonesForTesting(); |
| 489 } | 525 } |
| 490 | 526 |
| 491 namespace { | |
| 492 | |
| 493 void ShimNewMallocZonesAndReschedule(base::Time end_time, | |
| 494 base::TimeDelta delay) { | |
| 495 ShimNewMallocZones(); | |
| 496 | |
| 497 if (base::Time::Now() > end_time) | |
| 498 return; | |
| 499 | |
| 500 base::TimeDelta next_delay = delay * 2; | |
| 501 SequencedTaskRunnerHandle::Get()->PostDelayedTask( | |
| 502 FROM_HERE, | |
| 503 base::Bind(&ShimNewMallocZonesAndReschedule, end_time, next_delay), | |
| 504 delay); | |
| 505 } | |
| 506 | |
| 507 } // namespace | |
| 508 | |
| 509 void PeriodicallyShimNewMallocZones() { | |
| 510 base::Time end_time = base::Time::Now() + base::TimeDelta::FromMinutes(1); | |
| 511 base::TimeDelta initial_delay = base::TimeDelta::FromSeconds(1); | |
| 512 ShimNewMallocZonesAndReschedule(end_time, initial_delay); | |
| 513 } | |
| 514 | |
| 515 void ShimNewMallocZones() { | |
| 516 StoreFunctionsForAllZones(); | |
| 517 | |
| 518 // Use the functions for the default zone as a template to replace those | |
| 519 // new zones. | |
| 520 ChromeMallocZone* default_zone = | |
| 521 reinterpret_cast<ChromeMallocZone*>(malloc_default_zone()); | |
| 522 DCHECK(IsMallocZoneAlreadyStored(default_zone)); | |
| 523 | |
| 524 MallocZoneFunctions new_functions; | |
| 525 StoreZoneFunctions(default_zone, &new_functions); | |
| 526 ReplaceFunctionsForStoredZones(&new_functions); | |
| 527 } | |
| 528 | |
| 529 void ReplaceZoneFunctions(ChromeMallocZone* zone, | |
| 530 const MallocZoneFunctions* functions) { | |
| 531 // Remove protection. | |
| 532 mach_vm_address_t reprotection_start = 0; | |
| 533 mach_vm_size_t reprotection_length = 0; | |
| 534 vm_prot_t reprotection_value = VM_PROT_NONE; | |
| 535 DeprotectMallocZone(zone, &reprotection_start, &reprotection_length, | |
| 536 &reprotection_value); | |
| 537 | |
| 538 CHECK(functions->malloc && functions->calloc && functions->valloc && | |
| 539 functions->free && functions->realloc); | |
| 540 zone->malloc = functions->malloc; | |
| 541 zone->calloc = functions->calloc; | |
| 542 zone->valloc = functions->valloc; | |
| 543 zone->free = functions->free; | |
| 544 zone->realloc = functions->realloc; | |
| 545 if (functions->batch_malloc) | |
| 546 zone->batch_malloc = functions->batch_malloc; | |
| 547 if (functions->batch_free) | |
| 548 zone->batch_free = functions->batch_free; | |
| 549 if (functions->size) | |
| 550 zone->size = functions->size; | |
| 551 if (zone->version >= 5 && functions->memalign) { | |
| 552 zone->memalign = functions->memalign; | |
| 553 } | |
| 554 if (zone->version >= 6 && functions->free_definite_size) { | |
| 555 zone->free_definite_size = functions->free_definite_size; | |
| 556 } | |
| 557 | |
| 558 // Restore protection if it was active. | |
| 559 if (reprotection_start) { | |
| 560 kern_return_t result = | |
| 561 mach_vm_protect(mach_task_self(), reprotection_start, | |
| 562 reprotection_length, false, reprotection_value); | |
| 563 MACH_CHECK(result == KERN_SUCCESS, result) << "mach_vm_protect"; | |
| 564 } | |
| 565 } | |
| 566 | |
| 567 } // namespace allocator | 527 } // namespace allocator |
| 568 } // namespace base | 528 } // namespace base |
| OLD | NEW |