valgrind使用方法

1. 概述

valgrind是一款的用于C/C++内存检测、性能优化的开源软件，而且非常轻量级，上手也非常快。一些大型企业也将valgrind对代码的检查纳入到CI构建系统中，实时保证代码质量。

这里就陆续对valgrind的一些功能进行介绍。//由于时间关系，一时无法全部分析清楚，因此本文会持续更新。

valgrind网站：http://www.valgrind.org/http://www.valgrind.org/

2. 软件安装

先从网站上下载一个版本，比如最新版本：
http://www.valgrind.org/downloads/current.html
下载完源码之后，首先解压缩：

tar -jxvf valgrind-3.9.0.tar.bz2

然后可以看到README文件，这个文件中给出了安装的过程。如同大多数Linux上源码安装一样，3个步骤：

./configure
make
makeinstall (如果用户权限不够，可以先切换到root）

检查安装结果：

root@myhost /home/test/valgrind/valgrind-3.9.0 # valgrind --version
valgrind-3.9.0
root@myhost # valgrind ls -l
==11706== Memcheck, a memory error detector
==11706== Copyright (C) 2002-2013, and GNU GPL'd, by Julian Seward et al.
==11706== Using Valgrind-3.9.0 and LibVEX; rerun with -h for copyright info
==11706== Command: ls -l
==11706==
总用量 1832
-rw-r--r--  1 test users  38742 11月  1 07:33 aclocal.m4
-rw-r--r--  1 test users   3267 10月 28 18:30 AUTHORS
......................
-rwxr-xr-x  1 test users    691 10月 23 18:49 vg-in-place
-rw-r--r--  1 test users   2946 10月 23 18:50 xfree-3.supp
-rw-r--r--  1 test users   9018 10月 23 18:49 xfree-4.supp
==11706==
==11706== HEAP SUMMARY:
==11706==     in use at exit: 14,997 bytes in 90 blocks
==11706==   total heap usage: 2,718 allocs, 2,628 frees, 167,722 bytes allocated
==11706==
==11706== LEAK SUMMARY:
==11706==    definitely lost: 0 bytes in 0 blocks
==11706==    indirectly lost: 0 bytes in 0 blocks
==11706==      possibly lost: 0 bytes in 0 blocks
==11706==    still reachable: 14,997 bytes in 90 blocks
==11706==         suppressed: 0 bytes in 0 blocks
==11706== Rerun with --leak-check=full to see details of leaked memory
==11706==
==11706== For counts of detected and suppressed errors, rerun with: -v
==11706== ERROR SUMMARY: 0 errors from 0 contexts (suppressed: 0 from 0)
root@myhost /home/test/valgrind/valgrind-3.9.0 #

3. 使用方法

3.1 参考资料

可以从网上下载使用文档，如pdf文档：http://www.valgrind.org/docs/manual/valgrind_manual.pdf

最好的学习方法就是实践。

3.2 一个简单的例子

要对代码使用valgrind，那么代码编译的时候需要添加调试选项。下面是一个简单的例子，可以对valgrind有个初步的了解。

代码：

#include <stdio.h>
#include <stdlib.h>
#include <string.h>

int main() {
const size_t BUFFER_SIZE = 1024;
char* buffer = (char*)malloc(sizeof(char) * BUFFER_SIZE);
if (NULL == buffer) {
printf("No more memory to allocate.\n");
exit(1);
}

strcpy(buffer, "Hello, valgrind.");
printf("%s\n", buffer);

free(buffer);

return 0;
}

编译、运行：

test@myhost ...me/test/examples/Cpp/valgrind/memcheck % gcc -g -o test main.c
test@myhost ...me/test/examples/Cpp/valgrind/memcheck % ./test
Hello, valgrind.
test@myhost ...me/test/examples/Cpp/valgrind/memcheck % valgrind --tool=memcheck ./test
==11946== Memcheck, a memory error detector
==11946== Copyright (C) 2002-2013, and GNU GPL'd, by Julian Seward et al.
==11946== Using Valgrind-3.9.0 and LibVEX; rerun with -h for copyright info
==11946== Command: ./test
==11946==
Hello, valgrind.
==11946==
==11946== HEAP SUMMARY:
==11946==     in use at exit: 0 bytes in 0 blocks
==11946==   total heap usage: 1 allocs, 1 frees, 1,024 bytes allocated
==11946==
==11946== All heap blocks were freed -- no leaks are possible
==11946==
==11946== For counts of detected and suppressed errors, rerun with: -v
==11946== ERROR SUMMARY: 0 errors from 0 contexts (suppressed: 0 from 0)
test@myhost ...me/test/examples/Cpp/valgrind/memcheck %

目前为止，代码没有显示出任何问题。接下来在代码中增加一行：

++buffer;

即：

#include <stdio.h>
#include <stdlib.h>
#include <string.h>

int main() {
const size_t BUFFER_SIZE = 1024;
char* buffer = (char*)malloc(sizeof(char) * BUFFER_SIZE);
if (NULL == buffer) {
printf("No more memory to allocate.\n");
exit(1);
}

strcpy(buffer, "Hello, valgrind.");
printf("%s\n", buffer);

++buffer;

free(buffer);

return 0;
}

再次编译、运行：

test@myhost ...me/test/examples/Cpp/valgrind/memcheck % gcc -g -o test main.c
test@myhost ...me/test/examples/Cpp/valgrind/memcheck % ./test
Hello, valgrind.
[1]    11988 segmentation fault (core dumped)  ./test
139 test@myhost ...me/test/examples/Cpp/valgrind/memcheck % valgrind --tool=memcheck ./test
==12005== Memcheck, a memory error detector
==12005== Copyright (C) 2002-2013, and GNU GPL'd, by Julian Seward et al.
==12005== Using Valgrind-3.9.0 and LibVEX; rerun with -h for copyright info
==12005== Command: ./test
==12005==
Hello, valgrind.
==12005== Invalid free() / delete / delete[] / realloc()
==12005==    at 0x4028F29: free (vg_replace_malloc.c:468)
==12005==    by 0x804850B: main (main.c:18)
==12005==  Address 0x4202029 is 1 bytes inside a block of size 1,024 alloc'd
==12005==    at 0x4029FB0: malloc (vg_replace_malloc.c:291)
==12005==    by 0x80484A8: main (main.c:7)
==12005==
==12005==
==12005== HEAP SUMMARY:
==12005==     in use at exit: 1,024 bytes in 1 blocks
==12005==   total heap usage: 1 allocs, 1 frees, 1,024 bytes allocated
==12005==
==12005== LEAK SUMMARY:
==12005==    definitely lost: 1,024 bytes in 1 blocks
==12005==    indirectly lost: 0 bytes in 0 blocks
==12005==      possibly lost: 0 bytes in 0 blocks
==12005==    still reachable: 0 bytes in 0 blocks
==12005==         suppressed: 0 bytes in 0 blocks
==12005== Rerun with --leak-check=full to see details of leaked memory
==12005==
==12005== For counts of detected and suppressed errors, rerun with: -v
==12005== ERROR SUMMARY: 1 errors from 1 contexts (suppressed: 0 from 0)
test@myhost ...me/test/examples/Cpp/valgrind/memcheck %

此外，可以对照“C代码的coredump”一文进行分析：

test@myhost ...me/test/examples/Cpp/valgrind/memcheck % ll
总用量 88
-rw------- 1 test users 335872  3月  3 20:52 core
-rw-r--r-- 1 test users    449  3月  3 20:52 main.c
-rw-r--r-- 1 test users    342  3月  3 20:41 main.c~
-rwxr-xr-x 1 test users   8004  3月  3 20:52 test*
test@myhost ...me/test/examples/Cpp/valgrind/memcheck % gdb ./test core
GNU gdb (GDB) 7.7
Copyright (C) 2014 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "i686-pc-linux-gnu".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
<http://www.gnu.org/software/gdb/documentation/>.
For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from ./test...done.
[New LWP 12462]

warning: Could not load shared library symbols for linux-gate.so.1.
Do you need "set solib-search-path" or "set sysroot"?
Core was generated by `./test'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0  0xb765e5d0 in __GI___libc_free (mem=0x8702009) at malloc.c:2916
2916    malloc.c: 没有那个文件或目录.
(gdb) where
#0  0xb765e5d0 in __GI___libc_free (mem=0x8702009) at malloc.c:2916
#1  0x0804852f in main () at main.c:24
(gdb)

对比可以发现，valgrind给出的检查结果更加精准，更加利于定位问题：

==12005== Invalid free() / delete / delete[] / realloc()
==12005==    at 0x4028F29: free (vg_replace_malloc.c:468)
==12005==    by 0x804850B: main (main.c:18)
==12005==  Address 0x4202029 is 1 bytes inside a block of size 1,024 alloc'd
==12005==    at 0x4029FB0: malloc (vg_replace_malloc.c:291)
==12005==    by 0x80484A8: main (main.c:7)

在有了初步印象之后，接下来一点点学习valgrind的功能。对于一些常用功能，我们会通过python脚本语言自动分析出valgrind检查结果。——这也是通常的CI采用的做法。

3.3 内存检查

。。。