Memcheck: a memory error detector
•
Addr1
,
Addr2
,
Addr4
,
Addr8
,
Addr16
, meaning an invalid address during a memory access of 1, 2, 4, 8 or 16
bytes respectively.
•
Jump
, meaning an jump to an unaddressable location error.
•
Param
, meaning an invalid system call parameter error.
•
Free
, meaning an invalid or mismatching free.
•
Overlap
, meaning a
src
/
dst
overlap in
memcpy
or a similar function.
•
Leak
, meaning a memory leak.
Param
errors have an extra information line at this point, which is the name of the offending system call parameter.
No other error kinds have this extra line.
The first line of the calling context: for
ValueN
and
AddrN
errors, it is either the name of the function in which the
error occurred, or, failing that, the full path of the
.so
file or executable containing the error location.
For
Free
errors, is the name of the function doing the freeing (eg,
free
,
__builtin_vec_delete
, etc). For
Overlap
errors, is the name of the function with the overlapping arguments (eg.
memcpy
,
strcpy
, etc).
Lastly, there’s the rest of the calling context.
4.5. Details of Memcheck’s checking machinery
Read this section if you want to know, in detail, exactly what and how Memcheck is checking.
4.5.1. Valid-value (V) bits
It is simplest to think of Memcheck implementing a synthetic CPU which is identical to a real CPU, except for one
crucial detail. Every bit (literally) of data processed, stored and handled by the real CPU has, in the synthetic CPU, an
associated "valid-value" bit, which says whether or not the accompanying bit has a legitimate value. In the discussions
which follow, this bit is referred to as the V (valid-value) bit.
Each byte in the system therefore has a 8 V bits which follow it wherever it goes. For example, when the CPU loads a
word-size item (4 bytes) from memory, it also loads the corresponding 32 V bits from a bitmap which stores the V bits
for the process’ entire address space. If the CPU should later write the whole or some part of that value to memory at
a different address, the relevant V bits will be stored back in the V-bit bitmap.
In short, each bit in the system has (conceptually) an associated V bit, which follows it around everywhere, even
inside the CPU. Yes, all the CPU’s registers (integer, floating point, vector and condition registers) have their own V
bit vectors. For this to work, Memcheck uses a great deal of compression to represent the V bits compactly.
Copying values around does not cause Memcheck to check for, or report on, errors.
However, when a value is
used in a way which might conceivably affect your program’s externally-visible behaviour, the associated V bits are
immediately checked. If any of these indicate that the value is undefined (even partially), an error is reported.
Here’s an (admittedly nonsensical) example:
60
