Heap corruption with aligned memory allocator in tiny_cnn

[aquibjamal123]

I have a tiny_cnn function parse_cifar10() for which I am tracing heap corruption.
I am including the file present at - [https://github.com/Xilinx/xilinx-tiny-c ... 0_parser.h]

ESP_ERROR_CHECK( heap_trace_start(HEAP_TRACE_LEAKS) );
parse_cifar10(path, &test_images, &test_labels, -1.0, 1.0, 0, 0);
ESP_ERROR_CHECK( heap_trace_stop() );
heap_trace_dump();


Inside parse_cifar10() there is a vector img of type vec_t.
The vector type vec_t is a typedef defined as - "typedef std::vector<float_t, aligned_allocator<float_t, 64>> vec_t;" as shown below:

vec_t img(CIFAR10_IMAGE_SIZE);
printf("Heap check after img vector creation \n");
if(heap_caps_check_integrity_all(true)==false)
{
printf("Heap check failed after img vector creation \n");
}
printf("Size of image vector element %d and size of float %d\n", sizeof(vec_t), sizeof(float_t));
if (!ifs.read((char*) &buf[0], CIFAR10_IMAGE_SIZE)) break;
std::transform(buf.begin(), buf.end(), std::back_inserter(img),
[=](unsigned char c) { return scale_min + (scale_max - scale_min) * c / 255; });
train_images->push_back(img);
train_labels->push_back(label);


To compile with esp_idf, I defined flag ESP32 in make file.
I added the heap_caps_aligned_alloc() in file included from - "[https://github.com/Xilinx/xilinx-tiny-c ... llocator.h]" in function void* aligned_alloc(size_type align, size_type size) after _mm_malloc(size, align);

#elif defined(ESP32)
return heap_caps_aligned_alloc(align, size, MALLOC_CAP_SPIRAM);


To free the memory, in same file aligned_allocator.h in function void aligned_free(pointer ptr), I added
#elif defined(ESP32)
heap_caps_aligned_free(ptr);


The heap trace is as follows:

Start heap trace
Heap check after img vector creation
CORRUPT HEAP: Bad head at 0x3f85249c. Expected 0xabba1234 got 0x3fbffff4
Heap check failed after img vector creation
Size of image vector element 12 and size of float 4
2 allocations trace (100 entry buffer)
12 bytes (@ 0x3ffb7520) allocated CPU 0 ccount 0x3069e89c caller 0x401040a5:0x400d886c
0x401040a5: operator new(unsigned int) at /builds/idf/crosstool-NG/.build/xtensa-esp32-elf/src/gcc/libstdc++-v3/libsupc++/new_op.cc:50

4 bytes (@ 0x3ffb753c) allocated CPU 0 ccount 0x30738b60 caller 0x401040a5:0x400da547
0x401040a5: operator new(unsigned int) at /builds/idf/crosstool-NG/.build/xtensa-esp32-elf/src/gcc/libstdc++-v3/libsupc++/new_op.cc:50

16 bytes 'leaked' in trace (2 allocations)
total allocations 42 total frees 40


Calling heap_caps_check_integrity_all() after parse_cifar10() gives below output
CORRUPT HEAP: Bad head at 0x3f85b544. Expected 0xabba1234 got 0x3fbffff4


I think, the variable img is not freed when the scope of function parse_cifar10() ends.

I would highly appreciate any guidance in solving the Heap corruption.

Thank you!

[ESP_Angus]

Hi,

There are some known issues with aligned allocation in some ESP-IDF versions. Exactly which ESP-IDF version are you using?

Angus

[aquibjamal123]

Hi,

The output of idf.py --version is : ESP-IDF v4.2-dirty
Should I use different version to call heap_caps_aligned_alloc()?

With regards,
Aquib

[aquibjamal123]

I changed the ESP-IDF version and pulled the libraries from master branch.
The output of idf.py --version is :
ESP-IDF v4.4-dev-4-g73db14240

I am also using heap_caps_free() instead of deprecated function heap_caps_aligned_free().

I am still getting the heap corruption error and board reboots continuously.

The errors in console outputs are:
2 allocations trace (100 entry buffer)
12 bytes (@ 0x3ffb90f8) allocated CPU 0 ccount 0x31bb93f8 caller 0x40105b11:0x400db8dc
0x40105b11: operator new(unsigned int) at /builds/idf/crosstool-NG/.build/xtensa-esp32-elf/src/gcc/libstdc++-v3/libsupc++/new_op.cc:50

4 bytes (@ 0x3ffb9114) allocated CPU 0 ccount 0x31c50d30 caller 0x40105b11:0x400dd5b7
0x40105b11: operator new(unsigned int) at /builds/idf/crosstool-NG/.build/xtensa-esp32-elf/src/gcc/libstdc++-v3/libsupc++/new_op.cc:50


16 bytes 'leaked' in trace (2 allocations)
total allocations 41 total frees 42

I would like to point out that now, there are 41 allocations and 42 frees whereas earlier, there were 42 allocations and 40 frees.

I would be grateful for any inputs and suggestions in solving this issue.

[ESP_Angus]

Hi aquibjamal,

I think the ESP-IDF version you are using doesn't have any known issues with aligned alloc.

EDIT:

Can you narrow down the corruption to exactly one of the lines in the function?

BTW, the version of the function you posted and the version in the header are a little different. In your version, how is "buf" declared?

Angus

[aquibjamal123]

I suspect the memory leak is from the variable img which is of type vec_t.
This is a typedef - typedef std::vector<float_t, aligned_allocator<float_t, 64>> vec_t;.
I think, this variable is not deleted, when the function ends and it is causing the memory leak.
I initialised the size of img to be CIFAR10_IMAGE_SIZE to make sure it is of fixed size.

The variable buf is declared as - std::vector<unsigned char> buf(CIFAR10_IMAGE_SIZE);.

To try to free the memory occupied by img and buf, I am calling the img.clear(), buf.clear, tiny_cnn::vec_t().swap(img); and std::vector<unsigned char>().swap(buf); functions.

The values of scale_min, scale_max, x_padding, y_padding are : -1, 1, 0, 0 respectively.

I have attached the code file and console log for reference.
I would be highly grateful for any advice.

With regards,
Aquib

[aquibjamal123]

I have written a simpler function as shown below.
The header containing the aligned allocator class is also attached with this post.
As already mentioned, vec_t is typedef of typedef std::vector<float_t, aligned_allocator<float_t, 64>> vec_t;

Code: Select all

void myfunction()
{
  vec_t myvector1(1,0);
  vec_t myvector2(5,0);
  vec_t myvector3(10,0);
  for(int i=0; i<myvector1.size();i++)
    printf("Myvector1 is %f\n",myvector1[i]);
  
  for(int i=0; i<myvector2.size();i++)
    printf("Myvector2 is %f\n",myvector2[i]);

  for(int i=0; i<myvector3.size();i++)
    printf("Myvector3 is %f\n",myvector3[i]);
}

I created myvector1 with different lengths.
Each time, when I did the heap trace, 16 bytes were leaked with this function irrespective of the length of myvector1 as shown below-

1 allocations trace (100 entry buffer)
16 bytes (@ 0x3ffb8fe8) allocated CPU 0 ccount 0x3acb4024 caller 0x40135f64:0x40132580
0x40135f64: _dtoa_r at /builds/idf/crosstool-NG/.build/xtensa-esp32-elf/src/newlib/newlib/libc/stdlib/dtoa.c:234 (discriminator 1)

0x40132580: cvt at /builds/idf/crosstool-NG/.build/xtensa-esp32-elf/src/newlib/newlib/libc/stdio/vfprintf.c:1879
(inlined by) _vfprintf_r at /builds/idf/crosstool-NG/.build/xtensa-esp32-elf/src/newlib/newlib/libc/stdio/vfprintf.c:1314

16 bytes 'leaked' in trace (1 allocations)
total allocations 1 total frees 3

Please let me know if there is a way to solve this.

With regards,
Aquib