Skip to content

Commit d04e495

Browse files
rubidijumrubidijum
committed
Valgrind analysis updated.
1 parent 928a4b8 commit d04e495

19 files changed

+936
-42
lines changed

‎ProjectAnalysisReport.md

Lines changed: 368 additions & 4 deletions
Large diffs are not rendered by default.

‎patches/memleak_demo_initial.patch

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
diff --git a/samples/bluetooth/beacon/src/main.c b/samples/bluetooth/beacon/src/main.c
2+
index 484b6e94c8f..1cedb95bdd2 100644
3+
--- a/samples/bluetooth/beacon/src/main.c
4+
+++ b/samples/bluetooth/beacon/src/main.c
5+
@@ -40,6 +40,18 @@ static const struct bt_data sd[] = {
6+
BT_DATA(BT_DATA_NAME_COMPLETE, DEVICE_NAME, DEVICE_NAME_LEN),
7+
};
8+
9+
+void mem_leak(){
10+
+ printk("mem_leak()\n");
11+
+ void *ptr = malloc(100);
12+
+}
13+
+
14+
+void use_uninitialized_mem(){
15+
+ printk("use_uninitialized_mem()\n");
16+
+ int *ptr = malloc(sizeof(int));
17+
+ int value = *ptr;
18+
+ free(ptr);
19+
+}
20+
+
21+
static void bt_ready(int err)
22+
{
23+
char addr_s[BT_ADDR_LE_STR_LEN];
24+
@@ -80,6 +92,10 @@ int main(void)
25+
26+
printk("Starting Beacon Demo\n");
27+
28+
+ printk("Calling memleak functions\n");
29+
+ mem_leak();
30+
+ use_uninitialized_mem();
31+
+
32+
/* Initialize the Bluetooth Subsystem */
33+
err = bt_enable(bt_ready);
34+
if (err) {

‎patches/memleak_demo_no_optimize.patch

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
diff --git a/samples/bluetooth/beacon/prj.conf b/samples/bluetooth/beacon/prj.conf
2+
index 045c5c5f61d..dad48c73103 100644
3+
--- a/samples/bluetooth/beacon/prj.conf
4+
+++ b/samples/bluetooth/beacon/prj.conf
5+
@@ -1,3 +1,5 @@
6+
CONFIG_BT=y
7+
CONFIG_LOG=y
8+
CONFIG_BT_DEVICE_NAME="Test beacon"
9+
+CONFIG_DEBUG=y
10+
+CONFIG_NO_OPTIMIZATIONS=y
11+
\ No newline at end of file
12+
diff --git a/samples/bluetooth/beacon/src/main.c b/samples/bluetooth/beacon/src/main.c
13+
index 484b6e94c8f..1cedb95bdd2 100644
14+
--- a/samples/bluetooth/beacon/src/main.c
15+
+++ b/samples/bluetooth/beacon/src/main.c
16+
@@ -40,6 +40,18 @@ static const struct bt_data sd[] = {
17+
BT_DATA(BT_DATA_NAME_COMPLETE, DEVICE_NAME, DEVICE_NAME_LEN),
18+
};
19+
20+
+void mem_leak(){
21+
+ printk("mem_leak()\n");
22+
+ void *ptr = malloc(100);
23+
+}
24+
+
25+
+void use_uninitialized_mem(){
26+
+ printk("use_uninitialized_mem()\n");
27+
+ int *ptr = malloc(sizeof(int));
28+
+ int value = *ptr;
29+
+ free(ptr);
30+
+}
31+
+
32+
static void bt_ready(int err)
33+
{
34+
char addr_s[BT_ADDR_LE_STR_LEN];
35+
@@ -80,6 +92,10 @@ int main(void)
36+
37+
printk("Starting Beacon Demo\n");
38+
39+
+ printk("Calling memleak functions\n");
40+
+ mem_leak();
41+
+ use_uninitialized_mem();
42+
+
43+
/* Initialize the Bluetooth Subsystem */
44+
err = bt_enable(bt_ready);
45+
if (err) {

‎patches/userchan_fix_uninit_access.patch

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
diff --git a/drivers/bluetooth/hci/userchan.c b/drivers/bluetooth/hci/userchan.c
2+
index 50c3165809d..4ad0e8a3c16 100644
3+
--- a/drivers/bluetooth/hci/userchan.c
4+
+++ b/drivers/bluetooth/hci/userchan.c
5+
@@ -58,7 +58,7 @@ static K_KERNEL_STACK_DEFINE(rx_thread_stack,
6+
CONFIG_ARCH_POSIX_RECOMMENDED_STACK_SIZE);
7+
static struct k_thread rx_thread_data;
8+
9+
-static unsigned short bt_dev_index;
10+
+static unsigned short bt_dev_index = 0;
11+
12+
#define TCP_ADDR_BUFF_SIZE 16
13+
static bool hci_socket;
14+
@@ -328,7 +328,9 @@ static int user_chan_open(void)
15+
int fd;
16+
17+
if (hci_socket) {
18+
- struct sockaddr_hci addr;
19+
+ // struct sockaddr_hci addr = {0};
20+
+ struct sockaddr addr;
21+
+ struct sockaddr_hci *hci_addr = (struct sockaddr_hci *)&addr;
22+
23+
fd = socket(PF_BLUETOOTH, SOCK_RAW | SOCK_CLOEXEC | SOCK_NONBLOCK,
24+
BTPROTO_HCI);
25+
@@ -337,9 +339,19 @@ static int user_chan_open(void)
26+
}
27+
28+
(void)memset(&addr, 0, sizeof(addr));
29+
- addr.hci_family = AF_BLUETOOTH;
30+
- addr.hci_dev = bt_dev_index;
31+
- addr.hci_channel = HCI_CHANNEL_USER;
32+
+ // addr.hci_family = AF_BLUETOOTH;
33+
+ // addr.hci_dev = bt_dev_index;
34+
+ // addr.hci_channel = HCI_CHANNEL_USER;
35+
+ hci_addr->hci_family = AF_BLUETOOTH;
36+
+ hci_addr->hci_dev = bt_dev_index;
37+
+ hci_addr->hci_channel = HCI_CHANNEL_USER;
38+
+
39+
+ LOG_ERR("sizeof(sockaddr_hci) = %zu\n", sizeof(struct sockaddr_hci));
40+
+ LOG_ERR("sizeof(sockaddr_rc) = %zu\n", sizeof(struct sockaddr));
41+
+
42+
+
43+
+ LOG_ERR("before BIND -------------- %d", bt_dev_index);
44+
+ LOG_ERR("before BIND -------------- %d", HCI_CHANNEL_USER);
45+
46+
if (bind(fd, (struct sockaddr *)&addr, sizeof(addr)) < 0) {
47+
int err = -errno;
48+
@@ -380,6 +392,7 @@ static int uc_open(const struct device *dev, bt_hci_recv_t recv)
49+
struct uc_data *uc = dev->data;
50+
51+
if (hci_socket) {
52+
+ LOG_ERR("TESTSSSSSSSSSSSS________________________%d", bt_dev_index);
53+
LOG_DBG("hci%d", bt_dev_index);
54+
} else {
55+
LOG_DBG("hci %s:%d", ip_addr, port);

‎valgrind/README.md renamed to ‎valgrind/memcheck/README.md

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -50,12 +50,16 @@ export BSIM_COMPONENTS_PATH=${BSIM_OUT_PATH}/components/
5050

5151
#### Running the sample utilizing BabbleSim
5252

53-
The process for running the sample with BabbleSim is similar to running it as a native app. In order to do so, you can transfer (and rename) the built `zephyr.exe` to the location where you installed BabbleSim (using the instructions above). Now you need to run a simulated physical link (for example `bs_2G4_phy_v1`), supply the custom test name, the number of devices PHY link should expect and chain executables, connecting them to the same name of test, while also providing the unique device numbers. It's easier to explain with an example:
53+
The process for running the sample with BabbleSim is similar to running it as a native app. The main difference is that the app should be build with the bsim board. Supported boards are listed [here](https://docs.zephyrproject.org/latest/boards/native/doc/bsim_boards_design.html). In order to build the sample targeting the bsim board, following command can be used:
54+
55+
`west build -p always -b nrf52_bsim`
56+
57+
After you build the app, you can transfer (and rename) the built `zephyr.exe` to the location where you installed BabbleSim (using the instructions above). Now you need to run a simulated physical link (for example `bs_2G4_phy_v1`), supply the custom test name, the number of devices PHY link should expect and chain executables, connecting them to the same name of test, while also providing the unique device numbers. It's easier to explain with an example:
5458

5559
```
5660
cd <path_to_bablesim>/bin
5761
58-
/bs_2G4_phy_v1 -s=sample_test -D=1 & ./zephyr.exe -s=sample_test -d=0
62+
/bs_2G4_phy_v1 -s=sample_test -D=1 & ./<zephyr_executable> -s=sample_test -d=0
5963
```
6064

6165
Where `-s=sample_test` uniquely names the test, `-D=1` indicates that there will be a single device connected to the PHY, and `-d=0` uniquely identifies a device that'll connect to the physical layer.

‎valgrind/memcheck/memcheck_beacon/run_beacon_valgrind.sh

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,69 @@
1+
#!/bin/bash
2+
3+
usage() {
4+
echo "Usage $0 [-h] [d HCI_DEVICE] [-t TIMEOUT]"
5+
echo " -d HCI_DEVICE Specify the BLE capable hci device. Default: hci0"
6+
echo " -t TIMEOUT Specify the timeout in seconds. Default: 0 (no timeout)"
7+
echo " -c y|n Specify if cleanup is needed. Default: n (no cleanup)"
8+
echo " -s y|n Specify whether the suppression file for valgrind is to be used"
9+
echo " -h Show help message"
10+
exit 1
11+
}
12+
13+
PROJECT_BASE=$HOME/2023_Analysis_zephyr/
14+
15+
source $PROJECT_BASE/zephyr/zephyr-env.sh
16+
17+
HCI_DEVICE=hci0
18+
CLEAN="n"
19+
TIMEOUT=0
20+
delay=5
21+
SUPPRESSION="n"
22+
SUPPRESSION_FILE=$PROJECT_BASE/zephyr/scripts/valgrind.supp
23+
SUPPRESSION_FLAG=""
24+
25+
while getopts "d:t:c:s:h" opt; do
26+
case $opt in
27+
d) HCI_DEVICE="$OPTARG" ;;
28+
t) TIMEOUT="$OPTARG" ;;
29+
c) CLEAN="$OPTARG" ;;
30+
s) SUPPRESSION="$OPTARG" ;;
31+
h) usage ;;
32+
*) echo "Invalid option: -$OPTARG" >&2; usage ;;
33+
esac
34+
done
35+
36+
# build the application
37+
west build -p auto -b native_posix $ZEPHYR_BASE/samples/bluetooth/beacon
38+
39+
# Bring down hci to avoid EBUSY errors
40+
bring_down_hci() {
41+
echo "Bringing down HCI interface: $HCI_DEVICE"
42+
sudo hciconfig $HCI_DEVICE down
43+
if [ $? -ne 0 ]; then
44+
echo "Failed to bring down HCI interface. Exiting."
45+
exit 1
46+
fi
47+
}
48+
49+
valgrind_output_dir=.
50+
51+
bring_down_hci
52+
53+
if [ "$SUPPRESSION" == "y" ]; then
54+
SUPPRESSION_FLAG="--suppressions=$SUPPRESSION_FILE"
55+
echo "Using supression - $SUPPRESSION_FLAG"
56+
fi
57+
58+
sudo valgrind $SUPPRESSION_FLAG --tool=memcheck --leak-check=full --log-file="$valgrind_output_dir/valgrind_$(date +%Y%m%d_%H%M%S).log" --show-leak-kinds=all --track-origins=yes ./build/zephyr/zephyr.exe --bt-dev="$HCI_DEVICE" > "$valgrind_output_dir/valgrind_stdout_$(date +%Y%m%d_%H%M%S).log" 2>&1 &
59+
VALGRIND_PID=$!
60+
sleep $TIMEOUT
61+
62+
sudo kill $VALGRIND_PID
63+
64+
if [ "$CLEAN" == "y" ]; then
65+
echo "Cleaning up ..."
66+
rm -rf ./build
67+
fi
68+
69+
reset

‎valgrind/memcheck/memcheck_beacon/valgrind_20250209_115049_initial.log

Lines changed: 146 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,146 @@
1+
==87752== Memcheck, a memory error detector
2+
==87752== Copyright (C) 2002-2017, and GNU GPL'd, by Julian Seward et al.
3+
==87752== Using Valgrind-3.18.1 and LibVEX; rerun with -h for copyright info
4+
==87752== Command: ./build/zephyr/zephyr.exe --bt-dev=hci0
5+
==87752== Parent PID: 87751
6+
==87752==
7+
==87752== Thread 3:
8+
==87752== Syscall param socketcall.bind(my_addr.rc_bdaddr) points to uninitialised byte(s)
9+
==87752== at 0x42924B2: bind (bind.c:32)
10+
==87752== by 0x80508D6: user_chan_open (userchan.c:344)
11+
==87752== by 0x80508D6: uc_open (userchan.c:388)
12+
==87752== by 0x804F5AE: bt_hci_open (bluetooth.h:127)
13+
==87752== by 0x804F5AE: bt_enable (hci_core.c:4360)
14+
==87752== by 0x8049B34: _posix_zephyr_main (main.c:105)
15+
==87752== by 0x80514F7: bg_thread_main (init.c:564)
16+
==87752== by 0x804A615: z_thread_entry (thread_entry.c:48)
17+
==87752== by 0x804BB21: posix_arch_thread_entry (thread.c:96)
18+
==87752== by 0x804BE4D: nct_thread_starter (nct.c:366)
19+
==87752== by 0x41F4C00: start_thread (pthread_create.c:442)
20+
==87752== by 0x428F309: clone (clone.S:107)
21+
==87752== Address 0x57a620c is on thread 3's stack
22+
==87752== in frame #1, created by uc_open (userchan.c:379)
23+
==87752== Uninitialised value was created by a stack allocation
24+
==87752== at 0x8050879: uc_open (userchan.c:379)
25+
==87752==
26+
==87752== Syscall param socketcall.bind(my_addr.rc_channel) points to uninitialised byte(s)
27+
==87752== at 0x42924B2: bind (bind.c:32)
28+
==87752== by 0x80508D6: user_chan_open (userchan.c:344)
29+
==87752== by 0x80508D6: uc_open (userchan.c:388)
30+
==87752== by 0x804F5AE: bt_hci_open (bluetooth.h:127)
31+
==87752== by 0x804F5AE: bt_enable (hci_core.c:4360)
32+
==87752== by 0x8049B34: _posix_zephyr_main (main.c:105)
33+
==87752== by 0x80514F7: bg_thread_main (init.c:564)
34+
==87752== by 0x804A615: z_thread_entry (thread_entry.c:48)
35+
==87752== by 0x804BB21: posix_arch_thread_entry (thread.c:96)
36+
==87752== by 0x804BE4D: nct_thread_starter (nct.c:366)
37+
==87752== by 0x41F4C00: start_thread (pthread_create.c:442)
38+
==87752== by 0x428F309: clone (clone.S:107)
39+
==87752== Address 0x57a620e is on thread 3's stack
40+
==87752== in frame #1, created by uc_open (userchan.c:379)
41+
==87752== Uninitialised value was created by a stack allocation
42+
==87752== at 0x8050879: uc_open (userchan.c:379)
43+
==87752==
44+
==87752==
45+
==87752== HEAP SUMMARY:
46+
==87752== in use at exit: 2,768 bytes in 7 blocks
47+
==87752== total heap usage: 18 allocs, 11 frees, 14,278 bytes allocated
48+
==87752==
49+
==87752== Thread 1:
50+
==87752== 80 bytes in 1 blocks are still reachable in loss record 1 of 7
51+
==87752== at 0x4048354: calloc (in /usr/libexec/valgrind/vgpreload_memcheck-x86-linux.so)
52+
==87752== by 0x804C208: nce_init (nce.c:60)
53+
==87752== by 0x804C8B1: posix_boot_cpu (soc.c:124)
54+
==87752== by 0x804D762: posix_init (main.c:80)
55+
==87752== by 0x804D78F: main (main.c:112)
56+
==87752==
57+
==87752== 96 bytes in 1 blocks are still reachable in loss record 2 of 7
58+
==87752== at 0x4048354: calloc (in /usr/libexec/valgrind/vgpreload_memcheck-x86-linux.so)
59+
==87752== by 0x804C018: nct_init (nct.c:512)
60+
==87752== by 0x804BBB5: posix_arch_init (posix_core_nsi.c:23)
61+
==87752== by 0x804C8BB: posix_boot_cpu (soc.c:125)
62+
==87752== by 0x804D762: posix_init (main.c:80)
63+
==87752== by 0x804D78F: main (main.c:112)
64+
==87752==
65+
==87752== 136 bytes in 1 blocks are possibly lost in loss record 3 of 7
66+
==87752== at 0x4048354: calloc (in /usr/libexec/valgrind/vgpreload_memcheck-x86-linux.so)
67+
==87752== by 0x4011D66: calloc (rtld-malloc.h:44)
68+
==87752== by 0x4011D66: allocate_dtv (dl-tls.c:375)
69+
==87752== by 0x4012823: _dl_allocate_tls (dl-tls.c:634)
70+
==87752== by 0x41F57F9: allocate_stack (allocatestack.c:430)
71+
==87752== by 0x41F57F9: pthread_create@@GLIBC_2.34 (pthread_create.c:647)
72+
==87752== by 0x804C322: nce_boot_cpu (nce.c:209)
73+
==87752== by 0x804C8CD: posix_boot_cpu (soc.c:126)
74+
==87752== by 0x804D762: posix_init (main.c:80)
75+
==87752== by 0x804D78F: main (main.c:112)
76+
==87752==
77+
==87752== 136 bytes in 1 blocks are possibly lost in loss record 4 of 7
78+
==87752== at 0x4048354: calloc (in /usr/libexec/valgrind/vgpreload_memcheck-x86-linux.so)
79+
==87752== by 0x4011D66: calloc (rtld-malloc.h:44)
80+
==87752== by 0x4011D66: allocate_dtv (dl-tls.c:375)
81+
==87752== by 0x4012823: _dl_allocate_tls (dl-tls.c:634)
82+
==87752== by 0x41F57F9: allocate_stack (allocatestack.c:430)
83+
==87752== by 0x41F57F9: pthread_create@@GLIBC_2.34 (pthread_create.c:647)
84+
==87752== by 0x804BFEF: nct_new_thread (nct.c:476)
85+
==87752== by 0x804BC19: posix_new_thread (posix_core_nsi.c:48)
86+
==87752== by 0x804BAF9: arch_new_thread (thread.c:55)
87+
==87752== by 0x80521BC: z_setup_new_thread (thread.c:564)
88+
==87752== by 0x805154A: init_idle_thread (init.c:597)
89+
==87752== by 0x805154A: z_init_cpu (init.c:610)
90+
==87752== by 0x805160D: prepare_multithreading (init.c:681)
91+
==87752== by 0x805160D: z_cstart (init.c:795)
92+
==87752== by 0x804C17B: sw_wrapper (nce.c:184)
93+
==87752== by 0x41F4C00: start_thread (pthread_create.c:442)
94+
==87752==
95+
==87752== 136 bytes in 1 blocks are possibly lost in loss record 5 of 7
96+
==87752== at 0x4048354: calloc (in /usr/libexec/valgrind/vgpreload_memcheck-x86-linux.so)
97+
==87752== by 0x4011D66: calloc (rtld-malloc.h:44)
98+
==87752== by 0x4011D66: allocate_dtv (dl-tls.c:375)
99+
==87752== by 0x4012823: _dl_allocate_tls (dl-tls.c:634)
100+
==87752== by 0x41F57F9: allocate_stack (allocatestack.c:430)
101+
==87752== by 0x41F57F9: pthread_create@@GLIBC_2.34 (pthread_create.c:647)
102+
==87752== by 0x804BFEF: nct_new_thread (nct.c:476)
103+
==87752== by 0x804BC19: posix_new_thread (posix_core_nsi.c:48)
104+
==87752== by 0x804BAF9: arch_new_thread (thread.c:55)
105+
==87752== by 0x80521BC: z_setup_new_thread (thread.c:564)
106+
==87752== by 0x8052210: z_impl_k_thread_create (thread.c:659)
107+
==87752== by 0x805202C: k_thread_create (kernel.h:85)
108+
==87752== by 0x805202C: k_work_queue_start (work.c:752)
109+
==87752== by 0x8051B71: k_sys_work_q_init (system_work_q.c:30)
110+
==87752== by 0x805142B: z_sys_init_run_level (init.c:371)
111+
==87752==
112+
==87752== 136 bytes in 1 blocks are possibly lost in loss record 6 of 7
113+
==87752== at 0x4048354: calloc (in /usr/libexec/valgrind/vgpreload_memcheck-x86-linux.so)
114+
==87752== by 0x4011D66: calloc (rtld-malloc.h:44)
115+
==87752== by 0x4011D66: allocate_dtv (dl-tls.c:375)
116+
==87752== by 0x4012823: _dl_allocate_tls (dl-tls.c:634)
117+
==87752== by 0x41F57F9: allocate_stack (allocatestack.c:430)
118+
==87752== by 0x41F57F9: pthread_create@@GLIBC_2.34 (pthread_create.c:647)
119+
==87752== by 0x804BFEF: nct_new_thread (nct.c:476)
120+
==87752== by 0x804BC19: posix_new_thread (posix_core_nsi.c:48)
121+
==87752== by 0x804BAF9: arch_new_thread (thread.c:55)
122+
==87752== by 0x80521BC: z_setup_new_thread (thread.c:564)
123+
==87752== by 0x8052210: z_impl_k_thread_create (thread.c:659)
124+
==87752== by 0x8050986: k_thread_create (kernel.h:85)
125+
==87752== by 0x8050986: uc_open (userchan.c:397)
126+
==87752== by 0x804F5AE: bt_hci_open (bluetooth.h:127)
127+
==87752== by 0x804F5AE: bt_enable (hci_core.c:4360)
128+
==87752== by 0x8049B34: _posix_zephyr_main (main.c:105)
129+
==87752==
130+
==87752== 2,048 bytes in 1 blocks are still reachable in loss record 7 of 7
131+
==87752== at 0x4048354: calloc (in /usr/libexec/valgrind/vgpreload_memcheck-x86-linux.so)
132+
==87752== by 0x804C084: nct_init (nct.c:524)
133+
==87752== by 0x804BBB5: posix_arch_init (posix_core_nsi.c:23)
134+
==87752== by 0x804C8BB: posix_boot_cpu (soc.c:125)
135+
==87752== by 0x804D762: posix_init (main.c:80)
136+
==87752== by 0x804D78F: main (main.c:112)
137+
==87752==
138+
==87752== LEAK SUMMARY:
139+
==87752== definitely lost: 0 bytes in 0 blocks
140+
==87752== indirectly lost: 0 bytes in 0 blocks
141+
==87752== possibly lost: 544 bytes in 4 blocks
142+
==87752== still reachable: 2,224 bytes in 3 blocks
143+
==87752== suppressed: 0 bytes in 0 blocks
144+
==87752==
145+
==87752== For lists of detected and suppressed errors, rerun with: -s
146+
==87752== ERROR SUMMARY: 6 errors from 6 contexts (suppressed: 0 from 0)

0 commit comments

Comments
 (0)