valgrind --leak-check=full: Find Memory Leaks
valgrind --leak-check=full runs a program under Memcheck and reports leaked and mismanaged memory in detail.
Memcheck catches use-after-free, uninitialized reads, and leaks that unit tests miss. The trade-off is speed: it runs programs many times slower, which matters for CI timeouts.
What it does
valgrind runs a program on a synthetic CPU and, with the default Memcheck tool, tracks every allocation and memory access. --leak-check=full reports each leak with a stack trace, and --show-leak-kinds classifies them as definite, indirect, possible, or reachable.
Common usage
valgrind --leak-check=full ./my-program
# fail the build on any detected error
valgrind --leak-check=full --error-exitcode=1 \
--show-leak-kinds=definite ./my-program
# suppress known third-party leaks
valgrind --leak-check=full --suppressions=known.supp ./my-programOptions
| Flag | What it does |
|---|---|
| --leak-check=full | Report each leak with a full stack trace |
| --show-leak-kinds=<k> | Which leak kinds to show (definite, possible, all) |
| --error-exitcode=N | Exit with N if any error is detected (gate CI) |
| --track-origins=yes | Trace the origin of uninitialized values |
| --suppressions=<file> | Ignore known errors matching a suppression file |
In CI
Set --error-exitcode=1 so leaks fail the job. Because Memcheck slows execution by 10x to 50x, budget generous step timeouts and consider running it only on a representative subset of tests rather than the whole suite.
Common errors in CI
A step timeout is the most common failure: the program that runs in seconds takes minutes under Memcheck; raise the timeout or narrow the test set. "--track-origins=yes" further slows it, so enable it only when diagnosing. False positives from system libraries are silenced with --suppressions. On some hardened kernels valgrind reports "the impossible happened" when a syscall or instruction is unsupported; update valgrind to a version that knows the CPU.