valgrind

Valgrind

Purpose

Guide agents through Valgrind tools: Memcheck for memory errors, Cachegrind for cache simulation, Callgrind for call graphs, and Massif for heap profiling.

Triggers

• "My program has a memory leak / use-after-free"
• "I can't use ASan — can I use Valgrind instead?"
• "How do I profile cache behaviour without perf?"
• "How do I visualize call graphs with Callgrind?"
• "How do I profile heap allocation patterns?"
• "Valgrind reports errors in third-party code I can't fix"

Workflow

1. Memcheck — memory error detection

Compile with -g -O1 for best results. -O0 is also fine; avoid -O2+ which can produce false positives.

valgrind --tool=memcheck \
         --leak-check=full \
         --show-leak-kinds=all \
         --track-origins=yes \
         --error-exitcode=1 \
         ./prog [args]

Key flags:

Flag	Default	Effect
--leak-check=full	summary	Full leak details
--show-leak-kinds=all	definite	Show all leak kinds
--track-origins=yes	no	Show where uninit values came from (slow)
--error-exitcode=N	0	Exit N if errors found (CI integration)
--log-file=file	stderr	Save report to file
--suppressions=file	none	Suppress known FPs
--gen-suppressions=yes	no	Print suppression directives for errors
--max-stackframe=N	2000000	Increase for deep stacks
--malloc-fill=0xAB	off	Fill allocated memory (detect uninit use)
--free-fill=0xCD	off	Fill freed memory (detect use-after-free)

2. Understanding Memcheck output

==12345== Invalid read of size 4
==12345==    at 0x4007A2: foo (main.c:15)
==12345==    by 0x400846: main (main.c:30)
==12345==  Address 0x5204040 is 0 bytes after a block of size 40 alloc'd
==12345==    at 0x4C2FB0F: malloc (in /usr/lib/valgrind/vgpreload_memcheck.so)
==12345==    by 0x40074B: main (main.c:25)

• Invalid read/write: out-of-bounds access; check array bounds
• Use of uninitialised value: read before write; use --track-origins=yes
• Invalid free / double free: mismatched malloc/free; check ownership
• Definitely lost: reachable via no pointers; clear leak
• Indirectly lost: lost through a chain; usually means one root leak
• Possibly lost: might be pointing into the middle of a block; often FP with custom allocators