Valgrind macOs 和错误 Syscall 参数 msg->desc.port.name 指向未初始化的字节

Question

我尝试在非常简单的项目中运行 valgrind 3.13 和 3.14（在 macOS 10.12.6 上），但我遇到了以前在我的 linux 中从未遇到过的奇怪错误。

1. 非常简单的C程序main.c:

   int main() {
       return (0);
   }
   

2. 用cc编译：

   $> cc main.c
   

3. 用valgrind运行我的简单程序：

   $> valgrind ./a.out
   

4. valgrind 的输出：

   ==12768== Memcheck, a memory error detector
   ==12768== Copyright (C) 2002-2017, and GNU GPL'd, by Julian Seward et al.
   ==12768== Using Valgrind-3.14.0.SVN and LibVEX; rerun with -h for copyright info
   ==12768== Command: ./a.out
   ==12768==
   ==12768== Syscall param msg->desc.port.name points to uninitialised byte(s)
   ==12768==    at 0x10049434A: mach_msg_trap (in /usr/lib/system/libsystem_kernel.dylib)
   ==12768==    by 0x100493796: mach_msg (in /usr/lib/system/libsystem_kernel.dylib)
   ==12768==    by 0x10048D485: task_set_special_port (in /usr/lib/system/libsystem_kernel.dylib)
   ==12768==    by 0x10062910E: _os_trace_create_debug_control_port (in /usr/lib/system/libsystem_trace.dylib)
   ==12768==    by 0x100629458: _libtrace_init (in /usr/lib/system/libsystem_trace.dylib)
   ==12768==    by 0x1001599DF: libSystem_initializer (in /usr/lib/libSystem.B.dylib)
   ==12768==    by 0x100017A1A: ImageLoaderMachO::doModInitFunctions(ImageLoader::LinkContext const&) (in /usr/lib/dyld)
   ==12768==    by 0x100017C1D: ImageLoaderMachO::doInitialization(ImageLoader::LinkContext const&) (in /usr/lib/dyld)
   ==12768==    by 0x1000134A9: ImageLoader::recursiveInitialization(ImageLoader::LinkContext const&, unsigned int, char const*, ImageLoader::InitializerTimingList&, ImageLoader::UninitedUpwards&) (in /usr/lib/dyld)
   ==12768==    by 0x100013440: ImageLoader::recursiveInitialization(ImageLoader::LinkContext const&, unsigned int, char const*, ImageLoader::InitializerTimingList&, ImageLoader::UninitedUpwards&) (in /usr/lib/dyld)
   ==12768==    by 0x100012523: ImageLoader::processInitializers(ImageLoader::LinkContext const&, unsigned int, ImageLoader::InitializerTimingList&, ImageLoader::UninitedUpwards&) (in /usr/lib/dyld)
   ==12768==    by 0x1000125B8: ImageLoader::runInitializers(ImageLoader::LinkContext const&, ImageLoader::InitializerTimingList&) (in /usr/lib/dyld)
   ==12768==  Address 0x10488ac6c is on thread 1's stack
   ==12768==  in frame #2, created by task_set_special_port (???:)
   ==12768==  Uninitialised value was created by a stack allocation
   ==12768==    at 0x1006290A6: _os_trace_create_debug_control_port (in /usr/lib/system/libsystem_trace.dylib)
   ==12768==
   ==12768==
   ==12768== HEAP SUMMARY:
   ==12768==     in use at exit: 18,144 bytes in 162 blocks
   ==12768==   total heap usage: 178 allocs, 16 frees, 24,288 bytes allocated
   ==12768==
   ==12768== LEAK SUMMARY:
   ==12768==    definitely lost: 3,456 bytes in 54 blocks
   ==12768==    indirectly lost: 0 bytes in 0 blocks
   ==12768==      possibly lost: 72 bytes in 3 blocks
   ==12768==    still reachable: 200 bytes in 6 blocks
   ==12768==         suppressed: 14,416 bytes in 99 blocks
   ==12768== Rerun with --leak-check=full to see details of leaked memory
   ==12768==
   ==12768== For counts of detected and suppressed errors, rerun with: -v
   ==12768== ERROR SUMMARY: 1 errors from 1 contexts (suppressed: 4 from 4)
   

   这部分trace我没看懂：

   ==12768== Syscall param msg->desc.port.name points to uninitialised byte(s)
   ==12768==    at 0x10049434A: mach_msg_trap (in /usr/lib/system/libsystem_kernel.dylib)
   ==12768==    by 0x100493796: mach_msg (in /usr/lib/system/libsystem_kernel.dylib)
   ==12768==    by 0x10048D485: task_set_special_port (in /usr/lib/system/libsystem_kernel.dylib)
   ==12768==    by 0x10062910E: _os_trace_create_debug_control_port (in /usr/lib/system/libsystem_trace.dylib)
   ==12768==    by 0x100629458: _libtrace_init (in /usr/lib/system/libsystem_trace.dylib)
   ==12768==    by 0x1001599DF: libSystem_initializer (in /usr/lib/libSystem.B.dylib)
   ==12768==    by 0x100017A1A: ImageLoaderMachO::doModInitFunctions(ImageLoader::LinkContext const&) (in /usr/lib/dyld)
   ==12768==    by 0x100017C1D: ImageLoaderMachO::doInitialization(ImageLoader::LinkContext const&) (in /usr/lib/dyld)
   ==12768==    by 0x1000134A9: ImageLoader::recursiveInitialization(ImageLoader::LinkContext const&, unsigned int, char const*, ImageLoader::InitializerTimingList&, ImageLoader::UninitedUpwards&) (in /usr/lib/dyld)
   ==12768==    by 0x100013440: ImageLoader::recursiveInitialization(ImageLoader::LinkContext const&, unsigned int, char const*, ImageLoader::InitializerTimingList&, ImageLoader::UninitedUpwards&) (in /usr/lib/dyld)
   ==12768==    by 0x100012523: ImageLoader::processInitializers(ImageLoader::LinkContext const&, unsigned int, ImageLoader::InitializerTimingList&, ImageLoader::UninitedUpwards&) (in /usr/lib/dyld)
   ==12768==    by 0x1000125B8: ImageLoader::runInitializers(ImageLoader::LinkContext const&, ImageLoader::InitializerTimingList&) (in /usr/lib/dyld)
   ==12768==  Address 0x10488ac6c is on thread 1's stack
   ==12768==  in frame #2, created by task_set_special_port (???:)
   ==12768==  Uninitialised value was created by a stack allocation
   ==12768==    at 0x1006290A6: _os_trace_create_debug_control_port (in /usr/lib/system/libsystem_trace.dylib)
   

我不明白为什么我的简单 return(0) 的堆摘要如此之大（178 分配，16 释放，24,288 字节分配）；程序。

Answer 1

Valgrind 有一个抑制错误的系统。抑制规则在特殊文件中指定，例如$PREFIX/lib/valgrind/default.supp。用户可以使用--gen-suppressions=full 辅助工具创建自己的规则，该工具将为遇到的每个错误打印一条抑制规则。然后，用户可以根据自己的需要对其进行自定义。

我为有问题的错误做了这个，效果很好！无需安装不稳定版本。如果您遇到其他您想忽略的报告错误，这也是一个很好的工具。

我将此文件保存为~/.valgrind.supp。

# false positive for any executable (it seems)
# macOS 10.12.6
# valgrind 3.13.0
{
    libtrace initialization false positive
    Memcheck:Param
    msg->desc.port.name
    fun:mach_msg_trap
    fun:mach_msg
    fun:task_set_special_port
    fun:_os_trace_create_debug_control_port
    fun:_libtrace_init
}

# 开始评论，{} 表示规则。第一行是规则的名称。第二个说明要抑制的工具和错误类型。 Param 表示无效的系统调用参数，下一行给出了抑制错误的参数。以下以fun: 开头的行表示此抑制规则仅适用于mach_msg_trap，当由mach_msg 调用时由task_set_special_port 调用等等。这样，我们只在 Valgrind 错误地将 libtrace 初始化为错误的非常特殊的情况下抑制错误。

如果您在命令行中提供参数--suppressions=$HOME/.valgrind.supp，Valgrind 将使用此规则，或者将其放入$VALGRIND_OPTS 或~/.valgrindrc。

• Suppressing errors [Valgrind]
• Setting default options [Valgrind]
• Writing suppression files [内存检查]
• Valgrind Suppression File Howto [wkWiki]

Answer 2

我刚刚检查了错误状态here，它似乎已解决，所以我只是检查了相应的提交并编译。它解决了未初始化字节的问题，但接缝会产生新问题：未处理的 MACH_SEND_TRAILER ？

1) 克隆主分支

$ git clone git://sourceware.org/git/valgrind.git

2) 修复它：

$ cd valgrind

$ git checkout 128fd6e

3) 像往常一样配置编译安装，指令here

4) 用一个简单的程序测试它

$ cd <install-folder>/bin
$ ./valgrind ls -l

==19116== Memcheck, a memory error detector
==19116== Copyright (C) 2002-2017, and GNU GPL'd, by Julian Seward et al.
    ==19116== Using Valgrind-3.14.0.GIT and LibVEX; rerun with -h for copyright info
==19116== Command: ls -l
==19116== 
--19116-- UNKNOWN mach_msg unhandled MACH_SEND_TRAILER option
--19116-- UNKNOWN mach_msg unhandled MACH_SEND_TRAILER option (repeated 2 times)
--19116-- UNKNOWN mach_msg unhandled MACH_SEND_TRAILER option (repeated 4 times)
--19116-- UNKNOWN mach_msg unhandled MACH_SEND_TRAILER option (repeated 8 times)
total 552
-rwxr-xr-x  1 user  student  41642 Sep 11 15:55 callgrind_annotate
-rwxr-xr-x  1 user  student  12020 Sep 11 15:55 callgrind_control
-rwxr-xr-x  1 user  student  32174 Sep 11 15:55 cg_annotate
-rwxr-xr-x  1 user  student  10422 Sep 11 15:55 cg_diff
-rwxr-xr-x  1 user  student  29964 Sep 11 15:55 cg_merge
-rwxr-xr-x  1 user  student  24402 Sep 11 15:55 ms_print
-rwxr-xr-x  1 user  student  24468 Sep 11 15:55 valgrind
-rwxr-xr-x  1 user  student  39048 Sep 11 15:55 valgrind-di-server
-rwxr-xr-x  1 user  student  15056 Sep 11 15:55 valgrind-listener
-rwxr-xr-x  1 user  student  40216 Sep 11 15:55 vgdb
==19116== 
==19116== HEAP SUMMARY:
==19116==     in use at exit: 136,779 bytes in 225 blocks
==19116==   total heap usage: 420 allocs, 195 frees, 202,112 bytes allocated
==19116== 
==19116== LEAK SUMMARY:
==19116==    definitely lost: 0 bytes in 0 blocks
==19116==    indirectly lost: 0 bytes in 0 blocks
==19116==      possibly lost: 72 bytes in 3 blocks
==19116==    still reachable: 114,861 bytes in 71 blocks
==19116==         suppressed: 21,846 bytes in 151 blocks
==19116== Rerun with --leak-check=full to see details of leaked memory
==19116== 
==19116== For counts of detected and suppressed errors, rerun with: -v
==19116== ERROR SUMMARY: 0 errors from 0 contexts (suppressed: 4 from 4)

在 linux ubuntu 16.04 上使用 valgrind 3.11.0 进行的相同测试提供了干净的输出。