upstream/haproxy
1
0
Fork 0
mirror of https://github.com/haproxy/haproxy.git synced 2026-04-22 14:49:45 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions 9
haproxy/include/haproxy/bug.h

460 lines
17 KiB
C
Raw Normal View History

REORG: include: move the BUG_ON() code to haproxy/bug.h This one used to be stored into debug.h but the debug tools got larger and require a lot of other includes, which can't use BUG_ON() anymore because of this. It does not make sense and instead this macro should be placed into the lower includes and given its omnipresence, the best solution is to create a new bug.h with the few surrounding macros needed to trigger bugs and place assertions anywhere. Another benefit is that it won't be required to add include <debug.h> anymore to use BUG_ON, it will automatically be covered by api.h. No less than 32 occurrences were dropped. The FSM_PRINTF macro was dropped since not used at all anymore (probably since 1.6 or so).
2020-05-27 10:51:33 -04:00
/*
* include/haproxy/bug.h
* Assertions and instant crash macros needed everywhere.
*
* Copyright (C) 2000-2020 Willy Tarreau - w@1wt.eu
*
* Permission is hereby granted, free of charge, to any person obtaining
* a copy of this software and associated documentation files (the
* "Software"), to deal in the Software without restriction, including
* without limitation the rights to use, copy, modify, merge, publish,
* distribute, sublicense, and/or sell copies of the Software, and to
* permit persons to whom the Software is furnished to do so, subject to
* the following conditions:
*
* The above copyright notice and this permission notice shall be
* included in all copies or substantial portions of the Software.
*
* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
* EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES
* OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
* NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT
* HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
* WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
* FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
* OTHER DEALINGS IN THE SOFTWARE.
*/
#ifndef _HAPROXY_BUG_H
#define _HAPROXY_BUG_H
DEBUG: move the tainted stuff to bug.h for easier inclusion The functions needed to manipulate the "tainted" flags were located in too high a level to be callable from the lower code layers. Let's move them to bug.h.
2022-02-25 04:10:00 -05:00
#include <haproxy/atomic.h>
REORG: include: move the BUG_ON() code to haproxy/bug.h This one used to be stored into debug.h but the debug tools got larger and require a lot of other includes, which can't use BUG_ON() anymore because of this. It does not make sense and instead this macro should be placed into the lower includes and given its omnipresence, the best solution is to create a new bug.h with the few surrounding macros needed to trigger bugs and place assertions anywhere. Another benefit is that it won't be required to add include <debug.h> anymore to use BUG_ON, it will automatically be covered by api.h. No less than 32 occurrences were dropped. The FSM_PRINTF macro was dropped since not used at all anymore (probably since 1.6 or so).
2020-05-27 10:51:33 -04:00
#include <haproxy/compiler.h>
/* quick debugging hack, should really be removed ASAP */
#ifdef DEBUG_FULL
#define DPRINTF(x...) fprintf(x)
#else
#define DPRINTF(x...)
#endif
DEBUG: cleanup back trace generation Most BUG()/ABORT() macros were duplicating the same code to call the backtrace production to stderr, better place that into a new DUMP_TRACE() macro.
2022-02-25 01:49:18 -05:00
#define DUMP_TRACE() do { extern void ha_backtrace_to_stderr(void); ha_backtrace_to_stderr(); } while (0)
DEBUG: crash using an invalid opcode on x86/x86_64 instead of an invalid access BUG_ON() calls currently trigger a segfault. This is more convenient than abort() as it doesn't rely on any function call nor signal handler and never causes non-unwindable stacks when opening cores. But it adds quite some confusion in bug reports which are rightfully tagged "segv" and do not instantly allow to distinguish real segv (e.g. null derefs) from code asserts. Some CPU architectures offer various crashing methods. On x86 we have INT3 (0xCC), which stops into the debugger, and UD0/UD1/UD2. INT3 looks appealing but for whatever reason (maybe signal handling somewhere) it loses the last call point in the stack, making backtraces unusable. UD2 has the merit of being only 2 bytes and causing an invalid instruction, which almost never happens normally, so it's easily distinguishable. Here it was defined as a macro so that the line number in the core matches the one where the BUG_ON() macro is called, and the debugger shows the last frame exactly at its calligg point. E.g. when calling "debug dev bug": Program terminated with signal SIGILL, Illegal instruction. #0 debug_parse_cli_bug (args=<optimized out>, payload=<optimized out>, appctx=<optimized out>, private=<optimized out>) at src/debug.c:408 408 BUG_ON(one > zero); [Current thread is 1 (Thread 0x7f7a660cc1c0 (LWP 14238))] (gdb) bt #0 debug_parse_cli_bug (args=<optimized out>, payload=<optimized out>, appctx=<optimized out>, private=<optimized out>) at src/debug.c:408 #1 debug_parse_cli_bug (args=<optimized out>, payload=<optimized out>, appctx=<optimized out>, private=<optimized out>) at src/debug.c:402 #2 0x000000000061a69f in cli_parse_request (appctx=appctx@entry=0x181c0160) at src/cli.c:832 #3 0x000000000061af86 in cli_io_handler (appctx=0x181c0160) at src/cli.c:1035 #4 0x00000000006ca2f2 in task_run_applet (t=0x181c0290, context=0x181c0160, state=<optimized out>) at src/applet.c:449
2023-04-25 12:44:58 -04:00
/* First, let's try to handle some arch-specific crashing methods. We prefer
* the macro to the function because when opening the core, the debugger will
* directly show the calling point (e.g. the BUG_ON() condition) based on the
* line number, while the function will create new line numbers. But the
* function is needed e.g. if some pragmas are needed.
*/
#if defined(__i386__) || defined(__x86_64__)
#define ha_crash_now() do { \
/* ud2 opcode: 2 bytes, raises illegal instruction */ \
__asm__ volatile(".byte 0x0f,0x0b\n"); \
my_unreachable(); \
} while (0)
DEBUG: crash using an invalid opcode on aarch64 instead of an invalid access On aarch64 there's also a guaranted invalid instruction, called UDF, and which even supports an optional 16-bit immediate operand: https://developer.arm.com/documentation/ddi0596/2021-12/Base-Instructions/UDF--Permanently-Undefined-?lang=en It's conveniently encoded as 4 zeroes (when the operand is zero). It's unclear when support for it was added into GAS, if at all; even a not-so-old 2.27 doesn't know about it. Let's byte-encode it. Tested on an A72 and works as expected.
2023-04-25 13:01:48 -04:00
#elif defined(__aarch64__)
#define ha_crash_now() do { \
/* udf#imm16: 4 bytes (), raises illegal instruction */ \
__asm__ volatile(".byte 0x00,0x00,0x00,0x00\n"); \
my_unreachable(); \
} while (0)
DEBUG: crash using an invalid opcode on x86/x86_64 instead of an invalid access BUG_ON() calls currently trigger a segfault. This is more convenient than abort() as it doesn't rely on any function call nor signal handler and never causes non-unwindable stacks when opening cores. But it adds quite some confusion in bug reports which are rightfully tagged "segv" and do not instantly allow to distinguish real segv (e.g. null derefs) from code asserts. Some CPU architectures offer various crashing methods. On x86 we have INT3 (0xCC), which stops into the debugger, and UD0/UD1/UD2. INT3 looks appealing but for whatever reason (maybe signal handling somewhere) it loses the last call point in the stack, making backtraces unusable. UD2 has the merit of being only 2 bytes and causing an invalid instruction, which almost never happens normally, so it's easily distinguishable. Here it was defined as a macro so that the line number in the core matches the one where the BUG_ON() macro is called, and the debugger shows the last frame exactly at its calligg point. E.g. when calling "debug dev bug": Program terminated with signal SIGILL, Illegal instruction. #0 debug_parse_cli_bug (args=<optimized out>, payload=<optimized out>, appctx=<optimized out>, private=<optimized out>) at src/debug.c:408 408 BUG_ON(one > zero); [Current thread is 1 (Thread 0x7f7a660cc1c0 (LWP 14238))] (gdb) bt #0 debug_parse_cli_bug (args=<optimized out>, payload=<optimized out>, appctx=<optimized out>, private=<optimized out>) at src/debug.c:408 #1 debug_parse_cli_bug (args=<optimized out>, payload=<optimized out>, appctx=<optimized out>, private=<optimized out>) at src/debug.c:402 #2 0x000000000061a69f in cli_parse_request (appctx=appctx@entry=0x181c0160) at src/cli.c:832 #3 0x000000000061af86 in cli_io_handler (appctx=0x181c0160) at src/cli.c:1035 #4 0x00000000006ca2f2 in task_run_applet (t=0x181c0290, context=0x181c0160, state=<optimized out>) at src/applet.c:449
2023-04-25 12:44:58 -04:00
#else // not x86
/* generic implementation, causes a segfault */
BUILD: debug: work around gcc-12 excessive -Warray-bounds warnings As was first reported by Ilya in issue #1513, compiling with gcc-12 adds warnings about size 0 around each BUG_ON() call due to the ABORT_NOW() macro that tries to dereference pointer value 1. The problem is known, seems to be complex inside gcc and could only be worked around for now by adjusting a pointer limit so that the warning still catches NULL derefs in the first page but not other values commonly used in kernels and boot loaders: https://gcc.gnu.org/git/gitweb.cgi?p=gcc.git;h=91f7d7e1b It's described in more details here: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104657 https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99578 https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103768 And some projects had to work around it using various approaches, some of which are described in the bugs reports above, plus another one here: https://mail.coreboot.org/hyperkitty/list/seabios@seabios.org/thread/HLK3BHP2T3FN6FZ46BIPIK3VD5FOU74Z/ In haproxy we can hide it by hiding the pointer in a DISGUISE() macro, but this forces the pointer to be loaded into a register, so that register is lost precisely where we want to get the maximum of them. In our case we purposely use a low-value non-null pointer because: - it's mandatory that this value fits within an unmapped page and only the lowest one has this property - we really want to avoid register loads for the address, as these will be lost and will complicate the bug analysis, and they tend to be used for large addresses (i.e. instruction length limit). - the compiler may decide to optimize away the null deref when it sees it (seen in the past already) As such, the current workaround merged in gcc-12 is not effective for us. Another approach consists in using pragmas to silently disable -Warray-bounds and -Wnull-dereference only for this part. The problem is that pragmas cannot be placed into macros. The resulting solution consists in defining a forced-inlined function only to trigger the crash, and surround the dereference with pragmas, themselves conditionned to gcc >= 5 since older versions don't understand them (but they don't complain on the dereference at least). This way the code remains the same even at -O0, without the stack pointer being modified nor any address register being modified on common archs (x86 at least). A variation could have been to rely on __builtin_trap() but it's not everywhere and it behaves differently on different platforms (undefined opcode or a nasty abort()) while the segv remains uniform and effective. This may need to be backported to older releases once users start to complain about gcc-12 breakage.
2022-05-09 14:07:21 -04:00
static inline __attribute((always_inline)) void ha_crash_now(void)
{
#if __GNUC_PREREQ__(5, 0)
#pragma GCC diagnostic push
#pragma GCC diagnostic ignored "-Warray-bounds"
BUILD: debug: silence warning on gcc-5 In 2.6, 8a0fd3a36 ("BUILD: debug: work around gcc-12 excessive -Warray-bounds warnings") disabled some warnings that were reported around the the BUG() statement. But the -Wnull-dereference warning isn't known from gcc-5, it only arrived in gcc-6, hence makes gcc-5 complain loudly that it doesn't know this directive. Let's just condition this one to gcc-6.
2022-07-10 07:09:54 -04:00
#if __GNUC_PREREQ__(6, 0)
BUILD: debug: work around gcc-12 excessive -Warray-bounds warnings As was first reported by Ilya in issue #1513, compiling with gcc-12 adds warnings about size 0 around each BUG_ON() call due to the ABORT_NOW() macro that tries to dereference pointer value 1. The problem is known, seems to be complex inside gcc and could only be worked around for now by adjusting a pointer limit so that the warning still catches NULL derefs in the first page but not other values commonly used in kernels and boot loaders: https://gcc.gnu.org/git/gitweb.cgi?p=gcc.git;h=91f7d7e1b It's described in more details here: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104657 https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99578 https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103768 And some projects had to work around it using various approaches, some of which are described in the bugs reports above, plus another one here: https://mail.coreboot.org/hyperkitty/list/seabios@seabios.org/thread/HLK3BHP2T3FN6FZ46BIPIK3VD5FOU74Z/ In haproxy we can hide it by hiding the pointer in a DISGUISE() macro, but this forces the pointer to be loaded into a register, so that register is lost precisely where we want to get the maximum of them. In our case we purposely use a low-value non-null pointer because: - it's mandatory that this value fits within an unmapped page and only the lowest one has this property - we really want to avoid register loads for the address, as these will be lost and will complicate the bug analysis, and they tend to be used for large addresses (i.e. instruction length limit). - the compiler may decide to optimize away the null deref when it sees it (seen in the past already) As such, the current workaround merged in gcc-12 is not effective for us. Another approach consists in using pragmas to silently disable -Warray-bounds and -Wnull-dereference only for this part. The problem is that pragmas cannot be placed into macros. The resulting solution consists in defining a forced-inlined function only to trigger the crash, and surround the dereference with pragmas, themselves conditionned to gcc >= 5 since older versions don't understand them (but they don't complain on the dereference at least). This way the code remains the same even at -O0, without the stack pointer being modified nor any address register being modified on common archs (x86 at least). A variation could have been to rely on __builtin_trap() but it's not everywhere and it behaves differently on different platforms (undefined opcode or a nasty abort()) while the segv remains uniform and effective. This may need to be backported to older releases once users start to complain about gcc-12 breakage.
2022-05-09 14:07:21 -04:00
#pragma GCC diagnostic ignored "-Wnull-dereference"
BUILD: debug: silence warning on gcc-5 In 2.6, 8a0fd3a36 ("BUILD: debug: work around gcc-12 excessive -Warray-bounds warnings") disabled some warnings that were reported around the the BUG() statement. But the -Wnull-dereference warning isn't known from gcc-5, it only arrived in gcc-6, hence makes gcc-5 complain loudly that it doesn't know this directive. Let's just condition this one to gcc-6.
2022-07-10 07:09:54 -04:00
#endif
BUILD: debug: work around gcc-12 excessive -Warray-bounds warnings As was first reported by Ilya in issue #1513, compiling with gcc-12 adds warnings about size 0 around each BUG_ON() call due to the ABORT_NOW() macro that tries to dereference pointer value 1. The problem is known, seems to be complex inside gcc and could only be worked around for now by adjusting a pointer limit so that the warning still catches NULL derefs in the first page but not other values commonly used in kernels and boot loaders: https://gcc.gnu.org/git/gitweb.cgi?p=gcc.git;h=91f7d7e1b It's described in more details here: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104657 https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99578 https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103768 And some projects had to work around it using various approaches, some of which are described in the bugs reports above, plus another one here: https://mail.coreboot.org/hyperkitty/list/seabios@seabios.org/thread/HLK3BHP2T3FN6FZ46BIPIK3VD5FOU74Z/ In haproxy we can hide it by hiding the pointer in a DISGUISE() macro, but this forces the pointer to be loaded into a register, so that register is lost precisely where we want to get the maximum of them. In our case we purposely use a low-value non-null pointer because: - it's mandatory that this value fits within an unmapped page and only the lowest one has this property - we really want to avoid register loads for the address, as these will be lost and will complicate the bug analysis, and they tend to be used for large addresses (i.e. instruction length limit). - the compiler may decide to optimize away the null deref when it sees it (seen in the past already) As such, the current workaround merged in gcc-12 is not effective for us. Another approach consists in using pragmas to silently disable -Warray-bounds and -Wnull-dereference only for this part. The problem is that pragmas cannot be placed into macros. The resulting solution consists in defining a forced-inlined function only to trigger the crash, and surround the dereference with pragmas, themselves conditionned to gcc >= 5 since older versions don't understand them (but they don't complain on the dereference at least). This way the code remains the same even at -O0, without the stack pointer being modified nor any address register being modified on common archs (x86 at least). A variation could have been to rely on __builtin_trap() but it's not everywhere and it behaves differently on different platforms (undefined opcode or a nasty abort()) while the segv remains uniform and effective. This may need to be backported to older releases once users start to complain about gcc-12 breakage.
2022-05-09 14:07:21 -04:00
#endif
*(volatile char *)1 = 0;
#if __GNUC_PREREQ__(5, 0)
#pragma GCC diagnostic pop
#endif
my_unreachable();
}
DEBUG: crash using an invalid opcode on x86/x86_64 instead of an invalid access BUG_ON() calls currently trigger a segfault. This is more convenient than abort() as it doesn't rely on any function call nor signal handler and never causes non-unwindable stacks when opening cores. But it adds quite some confusion in bug reports which are rightfully tagged "segv" and do not instantly allow to distinguish real segv (e.g. null derefs) from code asserts. Some CPU architectures offer various crashing methods. On x86 we have INT3 (0xCC), which stops into the debugger, and UD0/UD1/UD2. INT3 looks appealing but for whatever reason (maybe signal handling somewhere) it loses the last call point in the stack, making backtraces unusable. UD2 has the merit of being only 2 bytes and causing an invalid instruction, which almost never happens normally, so it's easily distinguishable. Here it was defined as a macro so that the line number in the core matches the one where the BUG_ON() macro is called, and the debugger shows the last frame exactly at its calligg point. E.g. when calling "debug dev bug": Program terminated with signal SIGILL, Illegal instruction. #0 debug_parse_cli_bug (args=<optimized out>, payload=<optimized out>, appctx=<optimized out>, private=<optimized out>) at src/debug.c:408 408 BUG_ON(one > zero); [Current thread is 1 (Thread 0x7f7a660cc1c0 (LWP 14238))] (gdb) bt #0 debug_parse_cli_bug (args=<optimized out>, payload=<optimized out>, appctx=<optimized out>, private=<optimized out>) at src/debug.c:408 #1 debug_parse_cli_bug (args=<optimized out>, payload=<optimized out>, appctx=<optimized out>, private=<optimized out>) at src/debug.c:402 #2 0x000000000061a69f in cli_parse_request (appctx=appctx@entry=0x181c0160) at src/cli.c:832 #3 0x000000000061af86 in cli_io_handler (appctx=0x181c0160) at src/cli.c:1035 #4 0x00000000006ca2f2 in task_run_applet (t=0x181c0290, context=0x181c0160, state=<optimized out>) at src/applet.c:449
2023-04-25 12:44:58 -04:00
#endif // end of arch-specific ha_crash_now() definitions
BUILD: introduce possibility to define ABORT_NOW() conditionally code analysis tools recognize abort() better, so let us introduce such possibility
2020-09-12 02:24:48 -04:00
#ifdef DEBUG_USE_ABORT
/* abort() is better recognized by code analysis tools */
DEBUG: cleanup back trace generation Most BUG()/ABORT() macros were duplicating the same code to call the backtrace production to stderr, better place that into a new DUMP_TRACE() macro.
2022-02-25 01:49:18 -05:00
#define ABORT_NOW() do { DUMP_TRACE(); abort(); } while (0)
BUILD: introduce possibility to define ABORT_NOW() conditionally code analysis tools recognize abort() better, so let us introduce such possibility
2020-09-12 02:24:48 -04:00
#else
/* More efficient than abort() because it does not mangle the
BUILD: debug: work around gcc-12 excessive -Warray-bounds warnings As was first reported by Ilya in issue #1513, compiling with gcc-12 adds warnings about size 0 around each BUG_ON() call due to the ABORT_NOW() macro that tries to dereference pointer value 1. The problem is known, seems to be complex inside gcc and could only be worked around for now by adjusting a pointer limit so that the warning still catches NULL derefs in the first page but not other values commonly used in kernels and boot loaders: https://gcc.gnu.org/git/gitweb.cgi?p=gcc.git;h=91f7d7e1b It's described in more details here: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104657 https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99578 https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103768 And some projects had to work around it using various approaches, some of which are described in the bugs reports above, plus another one here: https://mail.coreboot.org/hyperkitty/list/seabios@seabios.org/thread/HLK3BHP2T3FN6FZ46BIPIK3VD5FOU74Z/ In haproxy we can hide it by hiding the pointer in a DISGUISE() macro, but this forces the pointer to be loaded into a register, so that register is lost precisely where we want to get the maximum of them. In our case we purposely use a low-value non-null pointer because: - it's mandatory that this value fits within an unmapped page and only the lowest one has this property - we really want to avoid register loads for the address, as these will be lost and will complicate the bug analysis, and they tend to be used for large addresses (i.e. instruction length limit). - the compiler may decide to optimize away the null deref when it sees it (seen in the past already) As such, the current workaround merged in gcc-12 is not effective for us. Another approach consists in using pragmas to silently disable -Warray-bounds and -Wnull-dereference only for this part. The problem is that pragmas cannot be placed into macros. The resulting solution consists in defining a forced-inlined function only to trigger the crash, and surround the dereference with pragmas, themselves conditionned to gcc >= 5 since older versions don't understand them (but they don't complain on the dereference at least). This way the code remains the same even at -O0, without the stack pointer being modified nor any address register being modified on common archs (x86 at least). A variation could have been to rely on __builtin_trap() but it's not everywhere and it behaves differently on different platforms (undefined opcode or a nasty abort()) while the segv remains uniform and effective. This may need to be backported to older releases once users start to complain about gcc-12 breakage.
2022-05-09 14:07:21 -04:00
* stack and stops at the exact location we need.
*/
#define ABORT_NOW() do { DUMP_TRACE(); ha_crash_now(); } while (0)
BUILD: introduce possibility to define ABORT_NOW() conditionally code analysis tools recognize abort() better, so let us introduce such possibility
2020-09-12 02:24:48 -04:00
#endif
REORG: include: move the BUG_ON() code to haproxy/bug.h This one used to be stored into debug.h but the debug tools got larger and require a lot of other includes, which can't use BUG_ON() anymore because of this. It does not make sense and instead this macro should be placed into the lower includes and given its omnipresence, the best solution is to create a new bug.h with the few surrounding macros needed to trigger bugs and place assertions anywhere. Another benefit is that it won't be required to add include <debug.h> anymore to use BUG_ON, it will automatically be covered by api.h. No less than 32 occurrences were dropped. The FSM_PRINTF macro was dropped since not used at all anymore (probably since 1.6 or so).
2020-05-27 10:51:33 -04:00
DEBUG: cleanup BUG_ON() configuration The BUG_ON() macro handling is complicated because it relies on a conditional CRASH_NOW() macro whose definition depends on DEBUG_STRICT and DEBUG_STRICT_NOCRASH. Let's rethink the whole thing differently, and instead make the underlying _BUG_ON() macro take a crash argument to decide whether to crash or not, as well as a prefix and a suffix for the message, that will allow to distinguish between variants. Now the suffix is set to a message explaining we don't crash when needed. This also allows to get rid of the CRASH_NOW() macro and to define much simpler new macros.
2022-02-25 02:45:52 -05:00
/* This is the generic low-level macro dealing with conditional warnings and
* bugs. The caller decides whether to crash or not and what prefix and suffix
DEBUG: make the _BUG_ON() macro return the condition By doing so it now becomes an expression and will allow for example to use WARN_ON() in tests, for example: if (WARN_ON(cond)) return NULL;
2022-02-25 03:10:26 -05:00
* to pass. The macro returns the boolean value of the condition as an int for
DEBUG: report BUG_ON() and WARN_ON() in the tainted flags It can be useful to know from the "tainted" variable whether any WARN_ON() or BUG_ON() triggered. Both were now added.
2022-02-25 04:20:29 -05:00
* the case where it wouldn't die. The <crash> flag is made of:
* - crash & 1: crash yes/no;
* - crash & 2: taint as bug instead of warn
DEBUG: cleanup BUG_ON() configuration The BUG_ON() macro handling is complicated because it relies on a conditional CRASH_NOW() macro whose definition depends on DEBUG_STRICT and DEBUG_STRICT_NOCRASH. Let's rethink the whole thing differently, and instead make the underlying _BUG_ON() macro take a crash argument to decide whether to crash or not, as well as a prefix and a suffix for the message, that will allow to distinguish between variants. Now the suffix is set to a message explaining we don't crash when needed. This also allows to get rid of the CRASH_NOW() macro and to define much simpler new macros.
2022-02-25 02:45:52 -05:00
*/
#define _BUG_ON(cond, file, line, crash, pfx, sfx) \
__BUG_ON(cond, file, line, crash, pfx, sfx)
#define __BUG_ON(cond, file, line, crash, pfx, sfx) \
BUILD: bug: make BUG_ON() void to avoid a rare warning When building without threads, the recently introduced BUG_ON(tid != 0) turns to a constant expression that evaluates to 0 and that is not used, resulting in this warning: src/connection.c: In function 'conn_free': src/connection.c:584:3: warning: statement with no effect [-Wunused-value] This is because the whole thing is declared as an expression for clarity. Make it return void to avoid this. No backport is needed.
2023-09-04 10:42:53 -04:00
(void)(unlikely(cond) ? ({ \
DEBUG: reduce the footprint of BUG_ON() calls Many inline functions involve some BUG_ON() calls and because of the partial complexity of the functions, they're not inlined anymore (e.g. co_data()). The reason is that the expression instantiates the message, its size, sometimes a counter, then the atomic OR to taint the process, and the back trace. That can be a lot for an inline function and most of it is always the same. This commit modifies this by delegating the common parts to a dedicated function "complain()" that takes care of updating the counter if needed, writing the message and measuring its length, and tainting the process. This way the caller only has to check a condition, pass a pointer to the preset message, and the info about the type (bug or warn) for the tainting, then decide whether to dump or crash. Note that this part could also be moved to the function but resulted in complain() always being at the top of the stack, which didn't seem like an improvement. Thanks to these changes, the BUG_ON() calls do not result in uninlining functions anymore and the overall code size was reduced by 60 to 120 kB depending on the build options.
2022-03-02 09:52:03 -05:00
complain(NULL, "\n" pfx "condition \"" #cond "\" matched at " file ":" #line "" sfx "\n", crash); \
if (crash & 1) \
ABORT_NOW(); \
else \
DUMP_TRACE(); \
1; /* let's return the true condition */ \
}) : 0)
DEBUG: cleanup BUG_ON() configuration The BUG_ON() macro handling is complicated because it relies on a conditional CRASH_NOW() macro whose definition depends on DEBUG_STRICT and DEBUG_STRICT_NOCRASH. Let's rethink the whole thing differently, and instead make the underlying _BUG_ON() macro take a crash argument to decide whether to crash or not, as well as a prefix and a suffix for the message, that will allow to distinguish between variants. Now the suffix is set to a message explaining we don't crash when needed. This also allows to get rid of the CRASH_NOW() macro and to define much simpler new macros.
2022-02-25 02:45:52 -05:00
DEBUG: add a new WARN_ON_ONCE() macro This one will maintain a static counter per call place and will only emit the warning on the first call. It may be used to invite users to report an unexpected event without spamming them with messages.
2022-02-25 02:55:11 -05:00
/* This one is equivalent except that it only emits the message once by
* maintaining a static counter. This may be used with warnings to detect
* certain unexpected conditions in field. Later on, in cores it will be
* possible to verify these counters.
*/
#define _BUG_ON_ONCE(cond, file, line, crash, pfx, sfx) \
__BUG_ON_ONCE(cond, file, line, crash, pfx, sfx)
#define __BUG_ON_ONCE(cond, file, line, crash, pfx, sfx) \
BUILD: bug: make BUG_ON() void to avoid a rare warning When building without threads, the recently introduced BUG_ON(tid != 0) turns to a constant expression that evaluates to 0 and that is not used, resulting in this warning: src/connection.c: In function 'conn_free': src/connection.c:584:3: warning: statement with no effect [-Wunused-value] This is because the whole thing is declared as an expression for clarity. Make it return void to avoid this. No backport is needed.
2023-09-04 10:42:53 -04:00
(void)(unlikely(cond) ? ({ \
DEBUG: add a new WARN_ON_ONCE() macro This one will maintain a static counter per call place and will only emit the warning on the first call. It may be used to invite users to report an unexpected event without spamming them with messages.
2022-02-25 02:55:11 -05:00
static int __match_count_##line; \
DEBUG: reduce the footprint of BUG_ON() calls Many inline functions involve some BUG_ON() calls and because of the partial complexity of the functions, they're not inlined anymore (e.g. co_data()). The reason is that the expression instantiates the message, its size, sometimes a counter, then the atomic OR to taint the process, and the back trace. That can be a lot for an inline function and most of it is always the same. This commit modifies this by delegating the common parts to a dedicated function "complain()" that takes care of updating the counter if needed, writing the message and measuring its length, and tainting the process. This way the caller only has to check a condition, pass a pointer to the preset message, and the info about the type (bug or warn) for the tainting, then decide whether to dump or crash. Note that this part could also be moved to the function but resulted in complain() always being at the top of the stack, which didn't seem like an improvement. Thanks to these changes, the BUG_ON() calls do not result in uninlining functions anymore and the overall code size was reduced by 60 to 120 kB depending on the build options.
2022-03-02 09:52:03 -05:00
complain(&__match_count_##line, "\n" pfx "condition \"" #cond "\" matched at " file ":" #line "" sfx "\n", crash); \
if (crash & 1) \
ABORT_NOW(); \
else \
DUMP_TRACE(); \
1; /* let's return the true condition */ \
}) : 0)
DEBUG: add a new WARN_ON_ONCE() macro This one will maintain a static counter per call place and will only emit the warning on the first call. It may be used to invite users to report an unexpected event without spamming them with messages.
2022-02-25 02:55:11 -05:00
DEBUG: implement 4 levels of choices between warn and crash. We used to have DEBUG_STRICT_NOCRASH to disable crashes on BUG_ON(). Now we have other levels (WARN_ON(), CHECK_IF()) so we need something finer-grained. This patch introduces DEBUG_STRICT_ACTION which takes an integer value. 0 disables crashes and is the equivalent of DEBUG_STRICT_NOCRASH. 1 is the default and only enables crashes on BUG_ON(). 2 also enables crashes on WARN_ON(), and 3 also enables warnings on CHECK_IF(), and is suited to developers and CI.
2022-02-28 08:59:25 -05:00
/* DEBUG_STRICT enables/disables runtime checks on condition <cond>
* DEBUG_STRICT_ACTION indicates the level of verification on the rules when
* <cond> is true:
*
* macro BUG_ON() WARN_ON() CHECK_IF()
* value 0 warn warn warn
* 1 CRASH warn warn
* 2 CRASH CRASH warn
* 3 CRASH CRASH CRASH
REORG: include: move the BUG_ON() code to haproxy/bug.h This one used to be stored into debug.h but the debug tools got larger and require a lot of other includes, which can't use BUG_ON() anymore because of this. It does not make sense and instead this macro should be placed into the lower includes and given its omnipresence, the best solution is to create a new bug.h with the few surrounding macros needed to trigger bugs and place assertions anywhere. Another benefit is that it won't be required to add include <debug.h> anymore to use BUG_ON, it will automatically be covered by api.h. No less than 32 occurrences were dropped. The FSM_PRINTF macro was dropped since not used at all anymore (probably since 1.6 or so).
2020-05-27 10:51:33 -04:00
*/
DEBUG: implement 4 levels of choices between warn and crash. We used to have DEBUG_STRICT_NOCRASH to disable crashes on BUG_ON(). Now we have other levels (WARN_ON(), CHECK_IF()) so we need something finer-grained. This patch introduces DEBUG_STRICT_ACTION which takes an integer value. 0 disables crashes and is the equivalent of DEBUG_STRICT_NOCRASH. 1 is the default and only enables crashes on BUG_ON(). 2 also enables crashes on WARN_ON(), and 3 also enables warnings on CHECK_IF(), and is suited to developers and CI.
2022-02-28 08:59:25 -05:00
DEBUG: add two new macros to enable debugging in hot paths Two new BUG_ON variants, BUG_ON_HOT() and CHECK_IF_HOT() are introduced to debug hot paths (such as low-level API functions). These ones must not be enabled by default as they would significantly affect performance but they may be enabled by setting DEBUG_STRICT to a value above 1. In this case, DEBUG_STRICT_ACTION is mostly respected with a small change, which is that the no_crash variant of BUG_ON() isn't turned to a regular warning but to a one-time warning so as not to spam with warnings in a hot path. It is for this reason that there is no WARN_ON_HOT().
2022-02-28 09:25:58 -05:00
/* The macros below are for general use */
REORG: include: move the BUG_ON() code to haproxy/bug.h This one used to be stored into debug.h but the debug tools got larger and require a lot of other includes, which can't use BUG_ON() anymore because of this. It does not make sense and instead this macro should be placed into the lower includes and given its omnipresence, the best solution is to create a new bug.h with the few surrounding macros needed to trigger bugs and place assertions anywhere. Another benefit is that it won't be required to add include <debug.h> anymore to use BUG_ON, it will automatically be covered by api.h. No less than 32 occurrences were dropped. The FSM_PRINTF macro was dropped since not used at all anymore (probably since 1.6 or so).
2020-05-27 10:51:33 -04:00
#if defined(DEBUG_STRICT)
DEBUG: implement 4 levels of choices between warn and crash. We used to have DEBUG_STRICT_NOCRASH to disable crashes on BUG_ON(). Now we have other levels (WARN_ON(), CHECK_IF()) so we need something finer-grained. This patch introduces DEBUG_STRICT_ACTION which takes an integer value. 0 disables crashes and is the equivalent of DEBUG_STRICT_NOCRASH. 1 is the default and only enables crashes on BUG_ON(). 2 also enables crashes on WARN_ON(), and 3 also enables warnings on CHECK_IF(), and is suited to developers and CI.
2022-02-28 08:59:25 -05:00
# if defined(DEBUG_STRICT_ACTION) && (DEBUG_STRICT_ACTION < 1)
/* Lowest level: BUG_ON() warns, WARN_ON() warns, CHECK_IF() warns */
# define BUG_ON(cond) _BUG_ON (cond, __FILE__, __LINE__, 2, "WARNING: bug ", " (not crashing but process is untrusted now, please report to developers)")
DEBUG: improve BUG_ON output message accuracy Now we'll explicitly mention if the test was a bug/warn/check, and "FATAL" is only displayed when the process crashes. The non-crashing BUG_ON() also suggests to report to developers.
2022-02-28 08:15:41 -05:00
# define WARN_ON(cond) _BUG_ON (cond, __FILE__, __LINE__, 0, "WARNING: warn ", " (please report to developers)")
# define CHECK_IF(cond) _BUG_ON_ONCE(cond, __FILE__, __LINE__, 0, "WARNING: check ", " (please report to developers)")
DEBUG: implement 4 levels of choices between warn and crash. We used to have DEBUG_STRICT_NOCRASH to disable crashes on BUG_ON(). Now we have other levels (WARN_ON(), CHECK_IF()) so we need something finer-grained. This patch introduces DEBUG_STRICT_ACTION which takes an integer value. 0 disables crashes and is the equivalent of DEBUG_STRICT_NOCRASH. 1 is the default and only enables crashes on BUG_ON(). 2 also enables crashes on WARN_ON(), and 3 also enables warnings on CHECK_IF(), and is suited to developers and CI.
2022-02-28 08:59:25 -05:00
# elif !defined(DEBUG_STRICT_ACTION) || (DEBUG_STRICT_ACTION == 1)
/* default level: BUG_ON() crashes, WARN_ON() warns, CHECK_IF() warns */
# define BUG_ON(cond) _BUG_ON (cond, __FILE__, __LINE__, 3, "FATAL: bug ", "")
DEBUG: improve BUG_ON output message accuracy Now we'll explicitly mention if the test was a bug/warn/check, and "FATAL" is only displayed when the process crashes. The non-crashing BUG_ON() also suggests to report to developers.
2022-02-28 08:15:41 -05:00
# define WARN_ON(cond) _BUG_ON (cond, __FILE__, __LINE__, 0, "WARNING: warn ", " (please report to developers)")
# define CHECK_IF(cond) _BUG_ON_ONCE(cond, __FILE__, __LINE__, 0, "WARNING: check ", " (please report to developers)")
BUILD: debug: fix build warning on older compilers around DEBUG_STRICT_ACTION The new macro was introduced with commit 86bcc5308 ("DEBUG: implement 4 levels of choices between warn and crash.") but some older compilers can complain that we test the value when the macro is not defined despite having already been checked in a previous #if directive. Let's just repeat the test for the definition.
2022-02-28 11:57:19 -05:00
# elif defined(DEBUG_STRICT_ACTION) && (DEBUG_STRICT_ACTION == 2)
DEBUG: implement 4 levels of choices between warn and crash. We used to have DEBUG_STRICT_NOCRASH to disable crashes on BUG_ON(). Now we have other levels (WARN_ON(), CHECK_IF()) so we need something finer-grained. This patch introduces DEBUG_STRICT_ACTION which takes an integer value. 0 disables crashes and is the equivalent of DEBUG_STRICT_NOCRASH. 1 is the default and only enables crashes on BUG_ON(). 2 also enables crashes on WARN_ON(), and 3 also enables warnings on CHECK_IF(), and is suited to developers and CI.
2022-02-28 08:59:25 -05:00
/* Stricter level: BUG_ON() crashes, WARN_ON() crashes, CHECK_IF() warns */
# define BUG_ON(cond) _BUG_ON (cond, __FILE__, __LINE__, 3, "FATAL: bug ", "")
# define WARN_ON(cond) _BUG_ON (cond, __FILE__, __LINE__, 1, "FATAL: warn ", "")
# define CHECK_IF(cond) _BUG_ON_ONCE(cond, __FILE__, __LINE__, 0, "WARNING: check ", " (please report to developers)")
BUILD: debug: fix build warning on older compilers around DEBUG_STRICT_ACTION The new macro was introduced with commit 86bcc5308 ("DEBUG: implement 4 levels of choices between warn and crash.") but some older compilers can complain that we test the value when the macro is not defined despite having already been checked in a previous #if directive. Let's just repeat the test for the definition.
2022-02-28 11:57:19 -05:00
# elif defined(DEBUG_STRICT_ACTION) && (DEBUG_STRICT_ACTION >= 3)
DEBUG: implement 4 levels of choices between warn and crash. We used to have DEBUG_STRICT_NOCRASH to disable crashes on BUG_ON(). Now we have other levels (WARN_ON(), CHECK_IF()) so we need something finer-grained. This patch introduces DEBUG_STRICT_ACTION which takes an integer value. 0 disables crashes and is the equivalent of DEBUG_STRICT_NOCRASH. 1 is the default and only enables crashes on BUG_ON(). 2 also enables crashes on WARN_ON(), and 3 also enables warnings on CHECK_IF(), and is suited to developers and CI.
2022-02-28 08:59:25 -05:00
/* Developer/CI level: BUG_ON() crashes, WARN_ON() crashes, CHECK_IF() crashes */
# define BUG_ON(cond) _BUG_ON (cond, __FILE__, __LINE__, 3, "FATAL: bug ", "")
# define WARN_ON(cond) _BUG_ON (cond, __FILE__, __LINE__, 1, "FATAL: warn ", "")
# define CHECK_IF(cond) _BUG_ON_ONCE(cond, __FILE__, __LINE__, 1, "FATAL: check ", "")
# endif
REORG: include: move the BUG_ON() code to haproxy/bug.h This one used to be stored into debug.h but the debug tools got larger and require a lot of other includes, which can't use BUG_ON() anymore because of this. It does not make sense and instead this macro should be placed into the lower includes and given its omnipresence, the best solution is to create a new bug.h with the few surrounding macros needed to trigger bugs and place assertions anywhere. Another benefit is that it won't be required to add include <debug.h> anymore to use BUG_ON, it will automatically be covered by api.h. No less than 32 occurrences were dropped. The FSM_PRINTF macro was dropped since not used at all anymore (probably since 1.6 or so).
2020-05-27 10:51:33 -04:00
#else
BUILD: debug: make sure debug macros are never empty As outlined in commit f7ebe584d7 ("BUILD: debug: Add braces to if statement calling only CHECK_IF()"), the BUG_ON() family of macros is incorrectly defined to be empty when debugging is disabled, and that can lead to trouble. Make sure they always fall back to the usual "do { } while (0)". This may be backported to 2.6 if needed, though no such issue was met there to date.
2022-08-31 04:52:25 -04:00
# define BUG_ON(cond) do { } while (0)
# define WARN_ON(cond) do { } while (0)
# define CHECK_IF(cond) do { } while (0)
REORG: include: move the BUG_ON() code to haproxy/bug.h This one used to be stored into debug.h but the debug tools got larger and require a lot of other includes, which can't use BUG_ON() anymore because of this. It does not make sense and instead this macro should be placed into the lower includes and given its omnipresence, the best solution is to create a new bug.h with the few surrounding macros needed to trigger bugs and place assertions anywhere. Another benefit is that it won't be required to add include <debug.h> anymore to use BUG_ON, it will automatically be covered by api.h. No less than 32 occurrences were dropped. The FSM_PRINTF macro was dropped since not used at all anymore (probably since 1.6 or so).
2020-05-27 10:51:33 -04:00
#endif
DEBUG: add two new macros to enable debugging in hot paths Two new BUG_ON variants, BUG_ON_HOT() and CHECK_IF_HOT() are introduced to debug hot paths (such as low-level API functions). These ones must not be enabled by default as they would significantly affect performance but they may be enabled by setting DEBUG_STRICT to a value above 1. In this case, DEBUG_STRICT_ACTION is mostly respected with a small change, which is that the no_crash variant of BUG_ON() isn't turned to a regular warning but to a one-time warning so as not to spam with warnings in a hot path. It is for this reason that there is no WARN_ON_HOT().
2022-02-28 09:25:58 -05:00
/* These macros are only for hot paths and remain disabled unless DEBUG_STRICT is 2 or above.
* Only developers/CI should use these levels as they may significantly impact performance by
* enabling checks in sensitive areas.
*/
#if defined(DEBUG_STRICT) && (DEBUG_STRICT > 1)
# if defined(DEBUG_STRICT_ACTION) && (DEBUG_STRICT_ACTION < 1)
/* Lowest level: BUG_ON() warns, CHECK_IF() warns */
# define BUG_ON_HOT(cond) _BUG_ON_ONCE(cond, __FILE__, __LINE__, 2, "WARNING: bug ", " (not crashing but process is untrusted now, please report to developers)")
# define CHECK_IF_HOT(cond) _BUG_ON_ONCE(cond, __FILE__, __LINE__, 0, "WARNING: check ", " (please report to developers)")
# elif !defined(DEBUG_STRICT_ACTION) || (DEBUG_STRICT_ACTION < 3)
/* default level: BUG_ON() crashes, CHECK_IF() warns */
# define BUG_ON_HOT(cond) _BUG_ON (cond, __FILE__, __LINE__, 3, "FATAL: bug ", "")
# define CHECK_IF_HOT(cond) _BUG_ON_ONCE(cond, __FILE__, __LINE__, 0, "WARNING: check ", " (please report to developers)")
BUILD: debug: fix build warning on older compilers around DEBUG_STRICT_ACTION The new macro was introduced with commit 86bcc5308 ("DEBUG: implement 4 levels of choices between warn and crash.") but some older compilers can complain that we test the value when the macro is not defined despite having already been checked in a previous #if directive. Let's just repeat the test for the definition.
2022-02-28 11:57:19 -05:00
# elif defined(DEBUG_STRICT_ACTION) && (DEBUG_STRICT_ACTION >= 3)
DEBUG: add two new macros to enable debugging in hot paths Two new BUG_ON variants, BUG_ON_HOT() and CHECK_IF_HOT() are introduced to debug hot paths (such as low-level API functions). These ones must not be enabled by default as they would significantly affect performance but they may be enabled by setting DEBUG_STRICT to a value above 1. In this case, DEBUG_STRICT_ACTION is mostly respected with a small change, which is that the no_crash variant of BUG_ON() isn't turned to a regular warning but to a one-time warning so as not to spam with warnings in a hot path. It is for this reason that there is no WARN_ON_HOT().
2022-02-28 09:25:58 -05:00
/* Developer/CI level: BUG_ON() crashes, CHECK_IF() crashes */
# define BUG_ON_HOT(cond) _BUG_ON (cond, __FILE__, __LINE__, 3, "FATAL: bug ", "")
# define CHECK_IF_HOT(cond) _BUG_ON_ONCE(cond, __FILE__, __LINE__, 1, "FATAL: check ", "")
# endif
#else
BUILD: debug: make sure debug macros are never empty As outlined in commit f7ebe584d7 ("BUILD: debug: Add braces to if statement calling only CHECK_IF()"), the BUG_ON() family of macros is incorrectly defined to be empty when debugging is disabled, and that can lead to trouble. Make sure they always fall back to the usual "do { } while (0)". This may be backported to 2.6 if needed, though no such issue was met there to date.
2022-08-31 04:52:25 -04:00
# define BUG_ON_HOT(cond) do { } while (0)
# define CHECK_IF_HOT(cond) do { } while (0)
DEBUG: add two new macros to enable debugging in hot paths Two new BUG_ON variants, BUG_ON_HOT() and CHECK_IF_HOT() are introduced to debug hot paths (such as low-level API functions). These ones must not be enabled by default as they would significantly affect performance but they may be enabled by setting DEBUG_STRICT to a value above 1. In this case, DEBUG_STRICT_ACTION is mostly respected with a small change, which is that the no_crash variant of BUG_ON() isn't turned to a regular warning but to a one-time warning so as not to spam with warnings in a hot path. It is for this reason that there is no WARN_ON_HOT().
2022-02-28 09:25:58 -05:00
#endif
REORG: include: move the BUG_ON() code to haproxy/bug.h This one used to be stored into debug.h but the debug tools got larger and require a lot of other includes, which can't use BUG_ON() anymore because of this. It does not make sense and instead this macro should be placed into the lower includes and given its omnipresence, the best solution is to create a new bug.h with the few surrounding macros needed to trigger bugs and place assertions anywhere. Another benefit is that it won't be required to add include <debug.h> anymore to use BUG_ON, it will automatically be covered by api.h. No less than 32 occurrences were dropped. The FSM_PRINTF macro was dropped since not used at all anymore (probably since 1.6 or so).
2020-05-27 10:51:33 -04:00
BUILD: Fix build when using clang without optimizing. ha_free() uses code that attempts to set a non-existant variable to provoke a link-time error, with the expectation that the compiler will not omit that if the code is unreachable. However, clang will emit it when compiling with no optimization, so only do that if __OPTIMIZE__ is defined.
2021-03-05 10:42:14 -05:00
/* When not optimizing, clang won't remove that code, so only compile it in when optimizing */
BUILD: bug: refine HA_LINK_ERROR() to only be used on gcc and derivatives TCC happens to define __OPTIMIZE__ at -O2 but doesn't proceed with dead code elimination, resulting in ha_free() to always reference the link error symbol. Let's condition this test on __GCC__ which others like Clang also define.
2021-03-09 04:08:05 -05:00
#if defined(__GNUC__) && defined(__OPTIMIZE__)
BUILD: Fix build when using clang without optimizing. ha_free() uses code that attempts to set a non-existant variable to provoke a link-time error, with the expectation that the compiler will not omit that if the code is unreachable. However, clang will emit it when compiling with no optimization, so only do that if __OPTIMIZE__ is defined.
2021-03-05 10:42:14 -05:00
#define HA_LINK_ERROR(what) \
do { \
/* provoke a build-time error */ \
extern volatile int what; \
what = 1; \
} while (0)
#else
#define HA_LINK_ERROR(what) \
do { \
} while (0)
#endif /* __OPTIMIZE__ */
CLEANUP: tree-wide: replace free(x);x=NULL with ha_free(&x) This makes the code more readable and less prone to copy-paste errors. In addition, it allows to place some __builtin_constant_p() predicates to trigger a link-time error in case the compiler knows that the freed area is constant. It will also produce compile-time error if trying to free something that is not a regular pointer (e.g. a function). The DEBUG_MEM_STATS macro now also defines an instance for ha_free() so that all these calls can be checked. 178 occurrences were converted. The vast majority of them were handled by the following Coccinelle script, some slightly refined to better deal with "&*x" or with long lines: @ rule @ expression E; @@ - free(E); - E = NULL; + ha_free(&E); It was verified that the resulting code is the same, more or less a handful of cases where the compiler optimized slightly differently the temporary variable that holds the copy of the pointer. A non-negligible amount of {free(str);str=NULL;str_len=0;} are still present in the config part (mostly header names in proxies). These ones should also be cleaned for the same reasons, and probably be turned into ist strings.
2021-02-20 04:46:51 -05:00
/* more reliable free() that clears the pointer */
#define ha_free(x) do { \
typeof(x) __x = (x); \
if (__builtin_constant_p((x)) || __builtin_constant_p(*(x))) { \
BUILD: Fix build when using clang without optimizing. ha_free() uses code that attempts to set a non-existant variable to provoke a link-time error, with the expectation that the compiler will not omit that if the code is unreachable. However, clang will emit it when compiling with no optimization, so only do that if __OPTIMIZE__ is defined.
2021-03-05 10:42:14 -05:00
HA_LINK_ERROR(call_to_ha_free_attempts_to_free_a_constant); \
CLEANUP: tree-wide: replace free(x);x=NULL with ha_free(&x) This makes the code more readable and less prone to copy-paste errors. In addition, it allows to place some __builtin_constant_p() predicates to trigger a link-time error in case the compiler knows that the freed area is constant. It will also produce compile-time error if trying to free something that is not a regular pointer (e.g. a function). The DEBUG_MEM_STATS macro now also defines an instance for ha_free() so that all these calls can be checked. 178 occurrences were converted. The vast majority of them were handled by the following Coccinelle script, some slightly refined to better deal with "&*x" or with long lines: @ rule @ expression E; @@ - free(E); - E = NULL; + ha_free(&E); It was verified that the resulting code is the same, more or less a handful of cases where the compiler optimized slightly differently the temporary variable that holds the copy of the pointer. A non-negligible amount of {free(str);str=NULL;str_len=0;} are still present in the config part (mostly header names in proxies). These ones should also be cleaned for the same reasons, and probably be turned into ist strings.
2021-02-20 04:46:51 -05:00
} \
free(*__x); \
*__x = NULL; \
} while (0)
MINOR: debug: add a new "debug dev memstats" command Now when building with -DDEBUG_MEM_STATS, some malloc/calloc/strdup/realloc stats are kept per file+line number and may be displayed and even reset on the CLI using "debug dev memstats". This allows to easily track potential leakers or abnormal usages.
2020-07-02 03:14:48 -04:00
MINOR: debug: add struct ha_caller to describe a calling location The purpose of this structure is to assemble all constant parts of a generic calling point for a specific event. These ones are created by the compiler as a static const element outside of the code path, so they cost nothing in terms of CPU, and a pointer to that descriptor can be passed to the place that needs it. This is very similar to what is being done for the mem_stat stuff. This will be useful to simplify and improve DEBUG_TASK.
2022-09-06 01:55:44 -04:00
/* describes a call place in the code, for example for tracing memory
* allocations or task wakeups. These must be declared static const.
*/
struct ha_caller {
const char *func; // function name
const char *file; // file name
uint16_t line; // line number
uint8_t what; // description of the call, usage specific
uint8_t arg8; // optional argument, usage specific
uint32_t arg32; // optional argument, usage specific
};
#define MK_CALLER(_what, _arg8, _arg32) \
({ static const struct ha_caller _ = { \
.func = __func__, .file = __FILE__, .line = __LINE__, \
.what = _what, .arg8 = _arg8, .arg32 = _arg32 }; \
&_; })
DEBUG: move the tainted stuff to bug.h for easier inclusion The functions needed to manipulate the "tainted" flags were located in too high a level to be callable from the lower code layers. Let's move them to bug.h.
2022-02-25 04:10:00 -05:00
/* handle 'tainted' status */
enum tainted_flags {
TAINTED_CONFIG_EXP_KW_DECLARED = 0x00000001,
TAINTED_ACTION_EXP_EXECUTED = 0x00000002,
TAINTED_CLI_EXPERT_MODE = 0x00000004,
TAINTED_CLI_EXPERIMENTAL_MODE = 0x00000008,
DEBUG: report BUG_ON() and WARN_ON() in the tainted flags It can be useful to know from the "tainted" variable whether any WARN_ON() or BUG_ON() triggered. Both were now added.
2022-02-25 04:20:29 -05:00
TAINTED_WARN = 0x00000010, /* a WARN_ON triggered */
TAINTED_BUG = 0x00000020, /* a BUG_ON triggered */
MEDIUM: debug: add a tainted flag when a shared library is loaded Several bug reports were caused by shared libraries being loaded by other libraries or some Lua code. Such libraries could define alternate symbols or include dependencies to alternate versions of a library used by haproxy, making it very hard to understand backtraces and analyze the issue. Let's intercept dlopen() and set a new TAINTED_SHARED_LIBS flag when it succeeds, so that "show info" makes it visible that some external libs were added. The redefinition is based on the definition of RTLD_DEFAULT or RTLD_NEXT that were previously used to detect that dlsym() is usable, since we need it as well. This should be sufficient to catch most situations.
2022-06-19 10:41:59 -04:00
TAINTED_SHARED_LIBS = 0x00000040, /* a shared library was loaded */
MEDIUM: debug: detect redefinition of symbols upon dlopen() In order to better detect the danger caused by extra shared libraries which replace some symbols, upon dlopen() we now compare a few critical symbols such as malloc(), free(), and some OpenSSL symbols, to see if the loaded library comes with its own version. If this happens, a warning is emitted and TAINTED_REDEFINITION is set. This is important because some external libs might be linked against different libraries than the ones haproxy was linked with, and most often this will end very badly (e.g. an OpenSSL object is allocated by haproxy and freed by such libs). Since the main source of dlopen() calls is the Lua lib, via a "require" statement, it's worth trying to show a Lua call trace when detecting a symbol redefinition during dlopen(). As such we emit a Lua backtrace if Lua is detected as being in use.
2022-06-19 10:49:51 -04:00
TAINTED_REDEFINITION = 0x00000080, /* symbol redefinition detected */
MINOR: pools: report a replaced memory allocator instead of just malloc_trim() Instead of reporting the inaccurate "malloc_trim() support" on -vv, let's report the case where the memory allocator was actively replaced from the one used at build time, as this is the corner case we want to be cautious about. We also put a tainted bit when this happens so that it's possible to detect it at run time (e.g. the user might have inherited it from an environment variable during a reload operation). The now unused is_trim_enabled() function was finally dropped.
2023-03-22 13:01:41 -04:00
TAINTED_REPLACED_MEM_ALLOCATOR = 0x00000100, /* memory allocator was replaced using LD_PRELOAD */
DEBUG: add a tainted flag when ha_panic() is called This will make it easier to know that the panic function was called, for the occasional case where the dump crashes and/or the stack is corrupted and not much exploitable. Now at least it will be sufficient to check the tainted value to know that someone called ha_panic(), and it will also be usable to condition extra analysis.
2023-10-25 08:34:08 -04:00
TAINTED_PANIC = 0x00000200, /* a panic dump has started */
DEBUG: lua: add tainted flags for stuck Lua contexts William suggested that since we can detect the presence of Lua in the stack, let's combine it with stuck detection to set a new pair of flags indicating a stuck Lua context and a stuck Lua shared context. Now, executing an infinite loop in a Lua sample fetch function with yield disabled crashes with tainted=0xe40 if loaded from a lua-load statement, or tainted=0x640 from a lua-load-per-thread statement. In addition, at the end of the panic dump, we can check if Lua was seen stuck and emit recommendations about lua-load-per-thread and the choice of dependencies depending on the presence of threads and/or shared context.
2023-10-25 09:02:59 -04:00
TAINTED_LUA_STUCK = 0x00000400, /* stuck in a Lua context */
TAINTED_LUA_STUCK_SHARED = 0x00000800, /* stuck in a shared Lua context */
DEBUG: pools: detect that malloc_trim() is in progress Now when calling ha_panic() with a thread still under malloc_trim(), we'll set a new tainted flag to easily report it, and the output trace will report that this condition happened and will suggest to use no-memory-trimming to avoid it in the future.
2023-10-25 09:42:27 -04:00
TAINTED_MEM_TRIMMING_STUCK = 0x00001000, /* stuck while trimming memory */
DEBUG: move the tainted stuff to bug.h for easier inclusion The functions needed to manipulate the "tainted" flags were located in too high a level to be callable from the lower code layers. Let's move them to bug.h.
2022-02-25 04:10:00 -05:00
};
/* this is a bit field made of TAINTED_*, and is declared in haproxy.c */
extern unsigned int tainted;
DEBUG: reduce the footprint of BUG_ON() calls Many inline functions involve some BUG_ON() calls and because of the partial complexity of the functions, they're not inlined anymore (e.g. co_data()). The reason is that the expression instantiates the message, its size, sometimes a counter, then the atomic OR to taint the process, and the back trace. That can be a lot for an inline function and most of it is always the same. This commit modifies this by delegating the common parts to a dedicated function "complain()" that takes care of updating the counter if needed, writing the message and measuring its length, and tainting the process. This way the caller only has to check a condition, pass a pointer to the preset message, and the info about the type (bug or warn) for the tainting, then decide whether to dump or crash. Note that this part could also be moved to the function but resulted in complain() always being at the top of the stack, which didn't seem like an improvement. Thanks to these changes, the BUG_ON() calls do not result in uninlining functions anymore and the overall code size was reduced by 60 to 120 kB depending on the build options.
2022-03-02 09:52:03 -05:00
void complain(int *counter, const char *msg, int taint);
DEBUG: move the tainted stuff to bug.h for easier inclusion The functions needed to manipulate the "tainted" flags were located in too high a level to be callable from the lower code layers. Let's move them to bug.h.
2022-02-25 04:10:00 -05:00
static inline void mark_tainted(const enum tainted_flags flag)
{
HA_ATOMIC_OR(&tainted, flag);
}
static inline unsigned int get_tainted()
{
return HA_ATOMIC_LOAD(&tainted);
}
MINOR: debug: add a new "debug dev memstats" command Now when building with -DDEBUG_MEM_STATS, some malloc/calloc/strdup/realloc stats are kept per file+line number and may be displayed and even reset on the CLI using "debug dev memstats". This allows to easily track potential leakers or abnormal usages.
2020-07-02 03:14:48 -04:00
#if defined(DEBUG_MEM_STATS)
#include <stdlib.h>
#include <string.h>
/* Memory allocation statistics are centralized into a global "mem_stats"
* section. This will not work with some linkers.
*/
enum {
MEM_STATS_TYPE_UNSET = 0,
MEM_STATS_TYPE_CALLOC,
MEM_STATS_TYPE_FREE,
MEM_STATS_TYPE_MALLOC,
MEM_STATS_TYPE_REALLOC,
MEM_STATS_TYPE_STRDUP,
MEDIUM: debug: improve DEBUG_MEM_STATS to also report pool alloc/free Sometimes using "debug dev memstats" can be frustrating because all pool allocations are reported through pool-os.h and that's all. But in practice there's nothing wrong with also intercepting pool_alloc, pool_free and pool_zalloc and report their call counts and locations, so that's what this patch does. It only uses an alternate set of macroes for these 3 calls when DEBUG_MEM_STATS is defined. The outputs are reported as P_ALLOC (for both pool_malloc() and pool_zalloc()) and P_FREE (for pool_free()).
2022-06-23 04:54:17 -04:00
MEM_STATS_TYPE_P_ALLOC,
MEM_STATS_TYPE_P_FREE,
MINOR: debug: add a new "debug dev memstats" command Now when building with -DDEBUG_MEM_STATS, some malloc/calloc/strdup/realloc stats are kept per file+line number and may be displayed and even reset on the CLI using "debug dev memstats". This allows to easily track potential leakers or abnormal usages.
2020-07-02 03:14:48 -04:00
};
struct mem_stats {
size_t calls;
size_t size;
CLEANUP: debug: use struct ha_caller for memstat The memstats code currently defines its own file/function/line number, type and extra pointer. We don't need to keep them separate and we can easily replace them all with just a struct ha_caller. Note that the extra pointer could be converted to a pool ID stored into arg8 or arg32 and be dropped as well, but this would first require to define IDs for pools (which we currently do not have).
2022-09-06 02:05:59 -04:00
struct ha_caller caller;
MINOR: debug: store and report the pool's name in struct mem_stats Let's add a generic "extra" pointer to the struct mem_stats to store context-specific information. When tracing pool_alloc/pool_free, we can now store a pointer to the pool, which allows to report the pool name on an extra column. This significantly improves tracing capabilities. Example: proxy.c:1598 CALLOC size: 28832 calls: 4 size/call: 7208 dynbuf.c:55 P_FREE size: 32768 calls: 2 size/call: 16384 buffer quic_tls.h:385 P_FREE size: 34008 calls: 1417 size/call: 24 quic_tls_iv quic_tls.h:389 P_FREE size: 34008 calls: 1417 size/call: 24 quic_tls_iv quic_tls.h:554 P_FREE size: 34008 calls: 1417 size/call: 24 quic_tls_iv quic_tls.h:558 P_FREE size: 34008 calls: 1417 size/call: 24 quic_tls_iv quic_tls.h:562 P_FREE size: 34008 calls: 1417 size/call: 24 quic_tls_iv quic_tls.h:401 P_ALLOC size: 34080 calls: 1420 size/call: 24 quic_tls_iv quic_tls.h:403 P_ALLOC size: 34080 calls: 1420 size/call: 24 quic_tls_iv xprt_quic.c:4060 MALLOC size: 45376 calls: 5672 size/call: 8 quic_sock.c:328 P_ALLOC size: 46440 calls: 215 size/call: 216 quic_dgram
2022-08-09 02:15:27 -04:00
const void *extra; // extra info specific to this call (e.g. pool ptr)
MINOR: debug: make the mem_stats section aligned to void* Not specifying the alignment will let the linker choose it, and it turns out that it will not necessarily be the same size as the one chosen for struct mem_stats, as can be seen if any new fields are added there. Let's enforce an alignment to void* both for the section and for the structure.
2022-08-09 02:09:24 -04:00
} __attribute__((aligned(sizeof(void*))));
MINOR: debug: add a new "debug dev memstats" command Now when building with -DDEBUG_MEM_STATS, some malloc/calloc/strdup/realloc stats are kept per file+line number and may be displayed and even reset on the CLI using "debug dev memstats". This allows to easily track potential leakers or abnormal usages.
2020-07-02 03:14:48 -04:00
BUILD: debug: avoid build warnings with DEBUG_MEM_STATS Some libcs define strdup() as a macro and cause redefine warnings to be emitted, so let's first undefine all functions we redefine.
2020-07-02 04:25:01 -04:00
#undef calloc
MINOR: debug: add a new "debug dev memstats" command Now when building with -DDEBUG_MEM_STATS, some malloc/calloc/strdup/realloc stats are kept per file+line number and may be displayed and even reset on the CLI using "debug dev memstats". This allows to easily track potential leakers or abnormal usages.
2020-07-02 03:14:48 -04:00
#define calloc(x,y) ({ \
size_t __x = (x); size_t __y = (y); \
MINOR: debug: make the mem_stats section aligned to void* Not specifying the alignment will let the linker choose it, and it turns out that it will not necessarily be the same size as the one chosen for struct mem_stats, as can be seen if any new fields are added there. Let's enforce an alignment to void* both for the section and for the structure.
2022-08-09 02:09:24 -04:00
static struct mem_stats _ __attribute__((used,__section__("mem_stats"),__aligned__(sizeof(void*)))) = { \
CLEANUP: debug: use struct ha_caller for memstat The memstats code currently defines its own file/function/line number, type and extra pointer. We don't need to keep them separate and we can easily replace them all with just a struct ha_caller. Note that the extra pointer could be converted to a pool ID stored into arg8 or arg32 and be dropped as well, but this would first require to define IDs for pools (which we currently do not have).
2022-09-06 02:05:59 -04:00
.caller = { \
.file = __FILE__, .line = __LINE__, \
.what = MEM_STATS_TYPE_CALLOC, \
.func = __func__, \
}, \
MINOR: debug: add a new "debug dev memstats" command Now when building with -DDEBUG_MEM_STATS, some malloc/calloc/strdup/realloc stats are kept per file+line number and may be displayed and even reset on the CLI using "debug dev memstats". This allows to easily track potential leakers or abnormal usages.
2020-07-02 03:14:48 -04:00
}; \
BUILD: debug: remove unnecessary quotes in HA_WEAK() calls HA_WEAK() is supposed to take a symbol in argument, not a string, since the asm statements it produces already quote the argument. Having it quoted twice doesn't work on older compilers and was the only reason why DEBUG_MEM_STATS didn't work on older compilers.
2022-11-13 06:14:10 -05:00
HA_WEAK(__start_mem_stats); \
HA_WEAK(__stop_mem_stats); \
CLEANUP: atomic/tree-wide: replace single increments/decrements with inc/dec This patch replaces roughly all occurrences of an HA_ATOMIC_ADD(&foo, 1) or HA_ATOMIC_SUB(&foo, 1) with the equivalent HA_ATOMIC_INC(&foo) and HA_ATOMIC_DEC(&foo) respectively. These are 507 changes over 45 files.
2021-04-06 07:53:36 -04:00
_HA_ATOMIC_INC(&_.calls); \
MINOR: debug: add a new "debug dev memstats" command Now when building with -DDEBUG_MEM_STATS, some malloc/calloc/strdup/realloc stats are kept per file+line number and may be displayed and even reset on the CLI using "debug dev memstats". This allows to easily track potential leakers or abnormal usages.
2020-07-02 03:14:48 -04:00
_HA_ATOMIC_ADD(&_.size, __x * __y); \
calloc(__x,__y); \
})
BUILD: debug: avoid build warnings with DEBUG_MEM_STATS Some libcs define strdup() as a macro and cause redefine warnings to be emitted, so let's first undefine all functions we redefine.
2020-07-02 04:25:01 -04:00
/* note: we can't redefine free() because we have a few variables and struct
MINOR: debug/memstats: permit to pass the size to free() Right now the free() call is not intercepted since all this is done using macros and that would break a lot of stuff. Instead a __free() macro was provided but never used. In addition it used to only report a zero size, which is not very convenient. With this patch comes a better solution. Instead it provides a new will_free() macro that can be prepended before a call to free(). It only keeps the counters up to date, and also supports being passed a size. The pool_free_area() command now uses it, which finally allows the stats to look correct: pool-os.h:38 MALLOC size: 5802127832 calls: 3868044 size/call: 1500 pool-os.h:47 FREE size: 5800041576 calls: 3867444 size/call: 1499 The few other places directly calling free() could now be instrumented to use this and to pass the correct sizeof() when known.
2022-08-09 03:08:18 -04:00
* members called like this. This one may be used before a call to free(),
* and when known, the size should be indicated, otherwise pass zero. The
* pointer is used to know whether the call should be accounted for (null is
* ignored).
BUILD: debug: avoid build warnings with DEBUG_MEM_STATS Some libcs define strdup() as a macro and cause redefine warnings to be emitted, so let's first undefine all functions we redefine.
2020-07-02 04:25:01 -04:00
*/
MINOR: debug/memstats: permit to pass the size to free() Right now the free() call is not intercepted since all this is done using macros and that would break a lot of stuff. Instead a __free() macro was provided but never used. In addition it used to only report a zero size, which is not very convenient. With this patch comes a better solution. Instead it provides a new will_free() macro that can be prepended before a call to free(). It only keeps the counters up to date, and also supports being passed a size. The pool_free_area() command now uses it, which finally allows the stats to look correct: pool-os.h:38 MALLOC size: 5802127832 calls: 3868044 size/call: 1500 pool-os.h:47 FREE size: 5800041576 calls: 3867444 size/call: 1499 The few other places directly calling free() could now be instrumented to use this and to pass the correct sizeof() when known.
2022-08-09 03:08:18 -04:00
#undef will_free
#define will_free(x, y) ({ \
void *__x = (x); size_t __y = (y); \
MINOR: debug: make the mem_stats section aligned to void* Not specifying the alignment will let the linker choose it, and it turns out that it will not necessarily be the same size as the one chosen for struct mem_stats, as can be seen if any new fields are added there. Let's enforce an alignment to void* both for the section and for the structure.
2022-08-09 02:09:24 -04:00
static struct mem_stats _ __attribute__((used,__section__("mem_stats"),__aligned__(sizeof(void*)))) = { \
CLEANUP: debug: use struct ha_caller for memstat The memstats code currently defines its own file/function/line number, type and extra pointer. We don't need to keep them separate and we can easily replace them all with just a struct ha_caller. Note that the extra pointer could be converted to a pool ID stored into arg8 or arg32 and be dropped as well, but this would first require to define IDs for pools (which we currently do not have).
2022-09-06 02:05:59 -04:00
.caller = { \
.file = __FILE__, .line = __LINE__, \
.what = MEM_STATS_TYPE_FREE, \
.func = __func__, \
}, \
MINOR: debug: add a new "debug dev memstats" command Now when building with -DDEBUG_MEM_STATS, some malloc/calloc/strdup/realloc stats are kept per file+line number and may be displayed and even reset on the CLI using "debug dev memstats". This allows to easily track potential leakers or abnormal usages.
2020-07-02 03:14:48 -04:00
}; \
BUILD: debug: remove unnecessary quotes in HA_WEAK() calls HA_WEAK() is supposed to take a symbol in argument, not a string, since the asm statements it produces already quote the argument. Having it quoted twice doesn't work on older compilers and was the only reason why DEBUG_MEM_STATS didn't work on older compilers.
2022-11-13 06:14:10 -05:00
HA_WEAK(__start_mem_stats); \
HA_WEAK(__stop_mem_stats); \
MINOR: debug/memstats: permit to pass the size to free() Right now the free() call is not intercepted since all this is done using macros and that would break a lot of stuff. Instead a __free() macro was provided but never used. In addition it used to only report a zero size, which is not very convenient. With this patch comes a better solution. Instead it provides a new will_free() macro that can be prepended before a call to free(). It only keeps the counters up to date, and also supports being passed a size. The pool_free_area() command now uses it, which finally allows the stats to look correct: pool-os.h:38 MALLOC size: 5802127832 calls: 3868044 size/call: 1500 pool-os.h:47 FREE size: 5800041576 calls: 3867444 size/call: 1499 The few other places directly calling free() could now be instrumented to use this and to pass the correct sizeof() when known.
2022-08-09 03:08:18 -04:00
if (__x) { \
CLEANUP: atomic/tree-wide: replace single increments/decrements with inc/dec This patch replaces roughly all occurrences of an HA_ATOMIC_ADD(&foo, 1) or HA_ATOMIC_SUB(&foo, 1) with the equivalent HA_ATOMIC_INC(&foo) and HA_ATOMIC_DEC(&foo) respectively. These are 507 changes over 45 files.
2021-04-06 07:53:36 -04:00
_HA_ATOMIC_INC(&_.calls); \
MINOR: debug/memstats: permit to pass the size to free() Right now the free() call is not intercepted since all this is done using macros and that would break a lot of stuff. Instead a __free() macro was provided but never used. In addition it used to only report a zero size, which is not very convenient. With this patch comes a better solution. Instead it provides a new will_free() macro that can be prepended before a call to free(). It only keeps the counters up to date, and also supports being passed a size. The pool_free_area() command now uses it, which finally allows the stats to look correct: pool-os.h:38 MALLOC size: 5802127832 calls: 3868044 size/call: 1500 pool-os.h:47 FREE size: 5800041576 calls: 3867444 size/call: 1499 The few other places directly calling free() could now be instrumented to use this and to pass the correct sizeof() when known.
2022-08-09 03:08:18 -04:00
_HA_ATOMIC_ADD(&_.size, __y); \
} \
MINOR: debug: add a new "debug dev memstats" command Now when building with -DDEBUG_MEM_STATS, some malloc/calloc/strdup/realloc stats are kept per file+line number and may be displayed and even reset on the CLI using "debug dev memstats". This allows to easily track potential leakers or abnormal usages.
2020-07-02 03:14:48 -04:00
})
CLEANUP: tree-wide: replace free(x);x=NULL with ha_free(&x) This makes the code more readable and less prone to copy-paste errors. In addition, it allows to place some __builtin_constant_p() predicates to trigger a link-time error in case the compiler knows that the freed area is constant. It will also produce compile-time error if trying to free something that is not a regular pointer (e.g. a function). The DEBUG_MEM_STATS macro now also defines an instance for ha_free() so that all these calls can be checked. 178 occurrences were converted. The vast majority of them were handled by the following Coccinelle script, some slightly refined to better deal with "&*x" or with long lines: @ rule @ expression E; @@ - free(E); - E = NULL; + ha_free(&E); It was verified that the resulting code is the same, more or less a handful of cases where the compiler optimized slightly differently the temporary variable that holds the copy of the pointer. A non-negligible amount of {free(str);str=NULL;str_len=0;} are still present in the config part (mostly header names in proxies). These ones should also be cleaned for the same reasons, and probably be turned into ist strings.
2021-02-20 04:46:51 -05:00
#undef ha_free
#define ha_free(x) ({ \
typeof(x) __x = (x); \
MINOR: debug: make the mem_stats section aligned to void* Not specifying the alignment will let the linker choose it, and it turns out that it will not necessarily be the same size as the one chosen for struct mem_stats, as can be seen if any new fields are added there. Let's enforce an alignment to void* both for the section and for the structure.
2022-08-09 02:09:24 -04:00
static struct mem_stats _ __attribute__((used,__section__("mem_stats"),__aligned__(sizeof(void*)))) = { \
CLEANUP: debug: use struct ha_caller for memstat The memstats code currently defines its own file/function/line number, type and extra pointer. We don't need to keep them separate and we can easily replace them all with just a struct ha_caller. Note that the extra pointer could be converted to a pool ID stored into arg8 or arg32 and be dropped as well, but this would first require to define IDs for pools (which we currently do not have).
2022-09-06 02:05:59 -04:00
.caller = { \
.file = __FILE__, .line = __LINE__, \
.what = MEM_STATS_TYPE_FREE, \
.func = __func__, \
}, \
CLEANUP: tree-wide: replace free(x);x=NULL with ha_free(&x) This makes the code more readable and less prone to copy-paste errors. In addition, it allows to place some __builtin_constant_p() predicates to trigger a link-time error in case the compiler knows that the freed area is constant. It will also produce compile-time error if trying to free something that is not a regular pointer (e.g. a function). The DEBUG_MEM_STATS macro now also defines an instance for ha_free() so that all these calls can be checked. 178 occurrences were converted. The vast majority of them were handled by the following Coccinelle script, some slightly refined to better deal with "&*x" or with long lines: @ rule @ expression E; @@ - free(E); - E = NULL; + ha_free(&E); It was verified that the resulting code is the same, more or less a handful of cases where the compiler optimized slightly differently the temporary variable that holds the copy of the pointer. A non-negligible amount of {free(str);str=NULL;str_len=0;} are still present in the config part (mostly header names in proxies). These ones should also be cleaned for the same reasons, and probably be turned into ist strings.
2021-02-20 04:46:51 -05:00
}; \
BUILD: debug: remove unnecessary quotes in HA_WEAK() calls HA_WEAK() is supposed to take a symbol in argument, not a string, since the asm statements it produces already quote the argument. Having it quoted twice doesn't work on older compilers and was the only reason why DEBUG_MEM_STATS didn't work on older compilers.
2022-11-13 06:14:10 -05:00
HA_WEAK(__start_mem_stats); \
HA_WEAK(__stop_mem_stats); \
CLEANUP: tree-wide: replace free(x);x=NULL with ha_free(&x) This makes the code more readable and less prone to copy-paste errors. In addition, it allows to place some __builtin_constant_p() predicates to trigger a link-time error in case the compiler knows that the freed area is constant. It will also produce compile-time error if trying to free something that is not a regular pointer (e.g. a function). The DEBUG_MEM_STATS macro now also defines an instance for ha_free() so that all these calls can be checked. 178 occurrences were converted. The vast majority of them were handled by the following Coccinelle script, some slightly refined to better deal with "&*x" or with long lines: @ rule @ expression E; @@ - free(E); - E = NULL; + ha_free(&E); It was verified that the resulting code is the same, more or less a handful of cases where the compiler optimized slightly differently the temporary variable that holds the copy of the pointer. A non-negligible amount of {free(str);str=NULL;str_len=0;} are still present in the config part (mostly header names in proxies). These ones should also be cleaned for the same reasons, and probably be turned into ist strings.
2021-02-20 04:46:51 -05:00
if (__builtin_constant_p((x)) || __builtin_constant_p(*(x))) { \
BUILD: Fix build when using clang without optimizing. ha_free() uses code that attempts to set a non-existant variable to provoke a link-time error, with the expectation that the compiler will not omit that if the code is unreachable. However, clang will emit it when compiling with no optimization, so only do that if __OPTIMIZE__ is defined.
2021-03-05 10:42:14 -05:00
HA_LINK_ERROR(call_to_ha_free_attempts_to_free_a_constant); \
CLEANUP: tree-wide: replace free(x);x=NULL with ha_free(&x) This makes the code more readable and less prone to copy-paste errors. In addition, it allows to place some __builtin_constant_p() predicates to trigger a link-time error in case the compiler knows that the freed area is constant. It will also produce compile-time error if trying to free something that is not a regular pointer (e.g. a function). The DEBUG_MEM_STATS macro now also defines an instance for ha_free() so that all these calls can be checked. 178 occurrences were converted. The vast majority of them were handled by the following Coccinelle script, some slightly refined to better deal with "&*x" or with long lines: @ rule @ expression E; @@ - free(E); - E = NULL; + ha_free(&E); It was verified that the resulting code is the same, more or less a handful of cases where the compiler optimized slightly differently the temporary variable that holds the copy of the pointer. A non-negligible amount of {free(str);str=NULL;str_len=0;} are still present in the config part (mostly header names in proxies). These ones should also be cleaned for the same reasons, and probably be turned into ist strings.
2021-02-20 04:46:51 -05:00
} \
if (*__x) \
CLEANUP: atomic/tree-wide: replace single increments/decrements with inc/dec This patch replaces roughly all occurrences of an HA_ATOMIC_ADD(&foo, 1) or HA_ATOMIC_SUB(&foo, 1) with the equivalent HA_ATOMIC_INC(&foo) and HA_ATOMIC_DEC(&foo) respectively. These are 507 changes over 45 files.
2021-04-06 07:53:36 -04:00
_HA_ATOMIC_INC(&_.calls); \
CLEANUP: tree-wide: replace free(x);x=NULL with ha_free(&x) This makes the code more readable and less prone to copy-paste errors. In addition, it allows to place some __builtin_constant_p() predicates to trigger a link-time error in case the compiler knows that the freed area is constant. It will also produce compile-time error if trying to free something that is not a regular pointer (e.g. a function). The DEBUG_MEM_STATS macro now also defines an instance for ha_free() so that all these calls can be checked. 178 occurrences were converted. The vast majority of them were handled by the following Coccinelle script, some slightly refined to better deal with "&*x" or with long lines: @ rule @ expression E; @@ - free(E); - E = NULL; + ha_free(&E); It was verified that the resulting code is the same, more or less a handful of cases where the compiler optimized slightly differently the temporary variable that holds the copy of the pointer. A non-negligible amount of {free(str);str=NULL;str_len=0;} are still present in the config part (mostly header names in proxies). These ones should also be cleaned for the same reasons, and probably be turned into ist strings.
2021-02-20 04:46:51 -05:00
free(*__x); \
*__x = NULL; \
})
BUILD: debug: avoid build warnings with DEBUG_MEM_STATS Some libcs define strdup() as a macro and cause redefine warnings to be emitted, so let's first undefine all functions we redefine.
2020-07-02 04:25:01 -04:00
#undef malloc
MINOR: debug: add a new "debug dev memstats" command Now when building with -DDEBUG_MEM_STATS, some malloc/calloc/strdup/realloc stats are kept per file+line number and may be displayed and even reset on the CLI using "debug dev memstats". This allows to easily track potential leakers or abnormal usages.
2020-07-02 03:14:48 -04:00
#define malloc(x) ({ \
size_t __x = (x); \
MINOR: debug: make the mem_stats section aligned to void* Not specifying the alignment will let the linker choose it, and it turns out that it will not necessarily be the same size as the one chosen for struct mem_stats, as can be seen if any new fields are added there. Let's enforce an alignment to void* both for the section and for the structure.
2022-08-09 02:09:24 -04:00
static struct mem_stats _ __attribute__((used,__section__("mem_stats"),__aligned__(sizeof(void*)))) = { \
CLEANUP: debug: use struct ha_caller for memstat The memstats code currently defines its own file/function/line number, type and extra pointer. We don't need to keep them separate and we can easily replace them all with just a struct ha_caller. Note that the extra pointer could be converted to a pool ID stored into arg8 or arg32 and be dropped as well, but this would first require to define IDs for pools (which we currently do not have).
2022-09-06 02:05:59 -04:00
.caller = { \
.file = __FILE__, .line = __LINE__, \
.what = MEM_STATS_TYPE_MALLOC, \
.func = __func__, \
}, \
MINOR: debug: add a new "debug dev memstats" command Now when building with -DDEBUG_MEM_STATS, some malloc/calloc/strdup/realloc stats are kept per file+line number and may be displayed and even reset on the CLI using "debug dev memstats". This allows to easily track potential leakers or abnormal usages.
2020-07-02 03:14:48 -04:00
}; \
BUILD: debug: remove unnecessary quotes in HA_WEAK() calls HA_WEAK() is supposed to take a symbol in argument, not a string, since the asm statements it produces already quote the argument. Having it quoted twice doesn't work on older compilers and was the only reason why DEBUG_MEM_STATS didn't work on older compilers.
2022-11-13 06:14:10 -05:00
HA_WEAK(__start_mem_stats); \
HA_WEAK(__stop_mem_stats); \
CLEANUP: atomic/tree-wide: replace single increments/decrements with inc/dec This patch replaces roughly all occurrences of an HA_ATOMIC_ADD(&foo, 1) or HA_ATOMIC_SUB(&foo, 1) with the equivalent HA_ATOMIC_INC(&foo) and HA_ATOMIC_DEC(&foo) respectively. These are 507 changes over 45 files.
2021-04-06 07:53:36 -04:00
_HA_ATOMIC_INC(&_.calls); \
MINOR: debug: add a new "debug dev memstats" command Now when building with -DDEBUG_MEM_STATS, some malloc/calloc/strdup/realloc stats are kept per file+line number and may be displayed and even reset on the CLI using "debug dev memstats". This allows to easily track potential leakers or abnormal usages.
2020-07-02 03:14:48 -04:00
_HA_ATOMIC_ADD(&_.size, __x); \
malloc(__x); \
})
BUILD: debug: avoid build warnings with DEBUG_MEM_STATS Some libcs define strdup() as a macro and cause redefine warnings to be emitted, so let's first undefine all functions we redefine.
2020-07-02 04:25:01 -04:00
#undef realloc
MINOR: debug: add a new "debug dev memstats" command Now when building with -DDEBUG_MEM_STATS, some malloc/calloc/strdup/realloc stats are kept per file+line number and may be displayed and even reset on the CLI using "debug dev memstats". This allows to easily track potential leakers or abnormal usages.
2020-07-02 03:14:48 -04:00
#define realloc(x,y) ({ \
void *__x = (x); size_t __y = (y); \
MINOR: debug: make the mem_stats section aligned to void* Not specifying the alignment will let the linker choose it, and it turns out that it will not necessarily be the same size as the one chosen for struct mem_stats, as can be seen if any new fields are added there. Let's enforce an alignment to void* both for the section and for the structure.
2022-08-09 02:09:24 -04:00
static struct mem_stats _ __attribute__((used,__section__("mem_stats"),__aligned__(sizeof(void*)))) = { \
CLEANUP: debug: use struct ha_caller for memstat The memstats code currently defines its own file/function/line number, type and extra pointer. We don't need to keep them separate and we can easily replace them all with just a struct ha_caller. Note that the extra pointer could be converted to a pool ID stored into arg8 or arg32 and be dropped as well, but this would first require to define IDs for pools (which we currently do not have).
2022-09-06 02:05:59 -04:00
.caller = { \
.file = __FILE__, .line = __LINE__, \
.what = MEM_STATS_TYPE_REALLOC, \
.func = __func__, \
}, \
MINOR: debug: add a new "debug dev memstats" command Now when building with -DDEBUG_MEM_STATS, some malloc/calloc/strdup/realloc stats are kept per file+line number and may be displayed and even reset on the CLI using "debug dev memstats". This allows to easily track potential leakers or abnormal usages.
2020-07-02 03:14:48 -04:00
}; \
BUILD: debug: remove unnecessary quotes in HA_WEAK() calls HA_WEAK() is supposed to take a symbol in argument, not a string, since the asm statements it produces already quote the argument. Having it quoted twice doesn't work on older compilers and was the only reason why DEBUG_MEM_STATS didn't work on older compilers.
2022-11-13 06:14:10 -05:00
HA_WEAK(__start_mem_stats); \
HA_WEAK(__stop_mem_stats); \
CLEANUP: atomic/tree-wide: replace single increments/decrements with inc/dec This patch replaces roughly all occurrences of an HA_ATOMIC_ADD(&foo, 1) or HA_ATOMIC_SUB(&foo, 1) with the equivalent HA_ATOMIC_INC(&foo) and HA_ATOMIC_DEC(&foo) respectively. These are 507 changes over 45 files.
2021-04-06 07:53:36 -04:00
_HA_ATOMIC_INC(&_.calls); \
MINOR: debug: add a new "debug dev memstats" command Now when building with -DDEBUG_MEM_STATS, some malloc/calloc/strdup/realloc stats are kept per file+line number and may be displayed and even reset on the CLI using "debug dev memstats". This allows to easily track potential leakers or abnormal usages.
2020-07-02 03:14:48 -04:00
_HA_ATOMIC_ADD(&_.size, __y); \
realloc(__x,__y); \
})
BUILD: debug: avoid build warnings with DEBUG_MEM_STATS Some libcs define strdup() as a macro and cause redefine warnings to be emitted, so let's first undefine all functions we redefine.
2020-07-02 04:25:01 -04:00
#undef strdup
MINOR: debug: add a new "debug dev memstats" command Now when building with -DDEBUG_MEM_STATS, some malloc/calloc/strdup/realloc stats are kept per file+line number and may be displayed and even reset on the CLI using "debug dev memstats". This allows to easily track potential leakers or abnormal usages.
2020-07-02 03:14:48 -04:00
#define strdup(x) ({ \
const char *__x = (x); size_t __y = strlen(__x); \
MINOR: debug: make the mem_stats section aligned to void* Not specifying the alignment will let the linker choose it, and it turns out that it will not necessarily be the same size as the one chosen for struct mem_stats, as can be seen if any new fields are added there. Let's enforce an alignment to void* both for the section and for the structure.
2022-08-09 02:09:24 -04:00
static struct mem_stats _ __attribute__((used,__section__("mem_stats"),__aligned__(sizeof(void*)))) = { \
CLEANUP: debug: use struct ha_caller for memstat The memstats code currently defines its own file/function/line number, type and extra pointer. We don't need to keep them separate and we can easily replace them all with just a struct ha_caller. Note that the extra pointer could be converted to a pool ID stored into arg8 or arg32 and be dropped as well, but this would first require to define IDs for pools (which we currently do not have).
2022-09-06 02:05:59 -04:00
.caller = { \
.file = __FILE__, .line = __LINE__, \
.what = MEM_STATS_TYPE_STRDUP, \
.func = __func__, \
}, \
MINOR: debug: add a new "debug dev memstats" command Now when building with -DDEBUG_MEM_STATS, some malloc/calloc/strdup/realloc stats are kept per file+line number and may be displayed and even reset on the CLI using "debug dev memstats". This allows to easily track potential leakers or abnormal usages.
2020-07-02 03:14:48 -04:00
}; \
BUILD: debug: remove unnecessary quotes in HA_WEAK() calls HA_WEAK() is supposed to take a symbol in argument, not a string, since the asm statements it produces already quote the argument. Having it quoted twice doesn't work on older compilers and was the only reason why DEBUG_MEM_STATS didn't work on older compilers.
2022-11-13 06:14:10 -05:00
HA_WEAK(__start_mem_stats); \
HA_WEAK(__stop_mem_stats); \
CLEANUP: atomic/tree-wide: replace single increments/decrements with inc/dec This patch replaces roughly all occurrences of an HA_ATOMIC_ADD(&foo, 1) or HA_ATOMIC_SUB(&foo, 1) with the equivalent HA_ATOMIC_INC(&foo) and HA_ATOMIC_DEC(&foo) respectively. These are 507 changes over 45 files.
2021-04-06 07:53:36 -04:00
_HA_ATOMIC_INC(&_.calls); \
MINOR: debug: add a new "debug dev memstats" command Now when building with -DDEBUG_MEM_STATS, some malloc/calloc/strdup/realloc stats are kept per file+line number and may be displayed and even reset on the CLI using "debug dev memstats". This allows to easily track potential leakers or abnormal usages.
2020-07-02 03:14:48 -04:00
_HA_ATOMIC_ADD(&_.size, __y); \
strdup(__x); \
})
MINOR: debug/memstats: permit to pass the size to free() Right now the free() call is not intercepted since all this is done using macros and that would break a lot of stuff. Instead a __free() macro was provided but never used. In addition it used to only report a zero size, which is not very convenient. With this patch comes a better solution. Instead it provides a new will_free() macro that can be prepended before a call to free(). It only keeps the counters up to date, and also supports being passed a size. The pool_free_area() command now uses it, which finally allows the stats to look correct: pool-os.h:38 MALLOC size: 5802127832 calls: 3868044 size/call: 1500 pool-os.h:47 FREE size: 5800041576 calls: 3867444 size/call: 1499 The few other places directly calling free() could now be instrumented to use this and to pass the correct sizeof() when known.
2022-08-09 03:08:18 -04:00
#else // DEBUG_MEM_STATS
#define will_free(x, y) do { } while (0)
MINOR: debug: add a new "debug dev memstats" command Now when building with -DDEBUG_MEM_STATS, some malloc/calloc/strdup/realloc stats are kept per file+line number and may be displayed and even reset on the CLI using "debug dev memstats". This allows to easily track potential leakers or abnormal usages.
2020-07-02 03:14:48 -04:00
#endif /* DEBUG_MEM_STATS*/
BUILD: bug.h: add a warning in the base API when unsafe functions are used Once in a while we introduce an sprintf() or strncat() function by accident. These ones are particularly dangerous and must never ever be used because the only way to use them safely is at least as complicated if not more, than their safe counterparts. By redefining a few of these functions with an attribute_warning() we can deliver a message to the developer who is tempted to use them. This commit does it for strcat(), strcpy(), strncat(), sprintf(), vsprintf(). More could come later if needed, such as strtok() and maybe a few others, but these are less common.
2023-04-07 08:57:13 -04:00
/* Add warnings to users of such functions. These will be reported at link time
* indicating what file name and line used them. The goal is to remind their
* users that these are extremely unsafe functions that never have a valid
* reason for being used.
*/
#undef strcat
__attribute__warning("\n"
" * WARNING! strcat() must never be used, because there is no convenient way\n"
" * to use it that is safe. Use memcpy() instead!\n")
extern char *strcat(char *__restrict dest, const char *__restrict src);
#undef strcpy
__attribute__warning("\n"
" * WARNING! strcpy() must never be used, because there is no convenient way\n"
" * to use it that is safe. Use memcpy() or strlcpy2() instead!\n")
extern char *strcpy(char *__restrict dest, const char *__restrict src);
#undef strncat
__attribute__warning("\n"
" * WARNING! strncat() must never be used, because there is no convenient way\n"
" * to use it that is safe. Use memcpy() instead!\n")
extern char *strncat(char *__restrict dest, const char *__restrict src, size_t n);
#undef sprintf
__attribute__warning("\n"
" * WARNING! sprintf() must never be used, because there is no convenient way\n"
" * to use it that is safe. Use snprintf() instead!\n")
extern int sprintf(char *__restrict dest, const char *__restrict fmt, ...);
#if defined(_VA_LIST_DEFINED) || defined(_VA_LIST_DECLARED) || defined(_VA_LIST)
#undef vsprintf
__attribute__warning("\n"
" * WARNING! vsprintf() must never be used, because there is no convenient way\n"
" * to use it that is safe. Use vsnprintf() instead!\n")
extern int vsprintf(char *__restrict dest, const char *__restrict fmt, va_list ap);
#endif
REORG: include: move the BUG_ON() code to haproxy/bug.h This one used to be stored into debug.h but the debug tools got larger and require a lot of other includes, which can't use BUG_ON() anymore because of this. It does not make sense and instead this macro should be placed into the lower includes and given its omnipresence, the best solution is to create a new bug.h with the few surrounding macros needed to trigger bugs and place assertions anywhere. Another benefit is that it won't be required to add include <debug.h> anymore to use BUG_ON, it will automatically be covered by api.h. No less than 32 occurrences were dropped. The FSM_PRINTF macro was dropped since not used at all anymore (probably since 1.6 or so).
2020-05-27 10:51:33 -04:00
#endif /* _HAPROXY_BUG_H */
/*
* Local variables:
* c-indent-level: 8
* c-basic-offset: 8
* End:
*/
Reference in a new issue Copy permalink