From nobody Tue May 26 20:41:22 2026 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gQ4R66Mvtz6gQJP for ; Tue, 26 May 2026 20:41:22 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R13" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gQ4R634Bvz3qys for ; Tue, 26 May 2026 20:41:22 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1779828082; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=BI72o4TtcUuBywAg3LM1gbvCZ/2ppL3nDBB84SHRWts=; b=css+be1vUYJwdLo2R4DeF4bUKQsVg2Y93uyH+PXhOdhW28tWlJsc0vztT50Rlszl4e2rOk zCSr2bSP/FrqLx7k1YXvX1CX/Z6Mup4H3/lvEc2ovyl8brn0/c9/vnv04Jxh/obOoHDqjy j6HcX1Eo+hx3yJ5IPB17mqH5/eDBGOGR+Rl5Xr8L1AiGben1wp+vvZ/Z4BwDgh7SA3RoMY iVmejnOfhb7SRn+PGMXuTTYS38zWBDFeq5FJxcyl1o9WVHBr9r0XNjNtPC0o30+hiX6XYy 7E+hSo+60kH+pmTYO5E0DgQPpl6SQxEikFNe0WvhZY9Z2rsb+E7ViNcDVxWZXA== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1779828082; a=rsa-sha256; cv=none; b=EurZ4HDbbjgsGBI5djp6DUetb3Hg21IwdPbN96fAF6gYL5VV6XFdnoKi7eF2DI4fXMcTAr cg5F4mCBy0gUVJc4sUJrIG/0NG5HiFdtdDtec9XOQKKHNHA9yZmUXljx98vvGUHVF2bHl3 f3wp5qdyfjRGxyVBdLmp7H4X7Zv06iqiidbQ5y4TrpyPGBo+2sW+oj1EuA6FsWMSecnASi 9L/IRdxt9WHGzmy9d8627/UcezEco4M68Qj7gl/FP6a7pLBEHRmlDye0CBmcxvE7bjaHhT UN0TZsVilP+Gu4K2CcNNcePdQh0uphHuL4BIv1mYpRq43u3lrIga7FMRI5Yi1A== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1779828082; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=BI72o4TtcUuBywAg3LM1gbvCZ/2ppL3nDBB84SHRWts=; b=PuAYida/Uz7RuSg2jyRibgoGEpeBCd51fTpNRPE0W7SRKf/Y+ie2JcWXZFxXwGsIimaXLl RRputdFzvWfX9Bhu6vsDbYZr1Sow9e88IH2sZm/79aqsk/bHNyPOdj7Kyl5+GvbRPELWF8 ltB0bcjv7YzfNmY0lkdXEXrSE0RVypO5HaAafU5u7WkDyfWjYh3Sv7E0J0skwMWCkE4p0V ck6YOCpKVzeWGfSJcKU4gO0rhuPV6uXdp+7KuUbglQXD260j58+voO1zNKw3DZjLQYk85X n0FHCy1J7cuJ7q7+DLvPLCQClBF5dJ+zlNFcyktreHR2ops9V/pNwkFvif1Z9Q== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gQ4R622kpzCjX for ; Tue, 26 May 2026 20:41:22 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 1fa94 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 26 May 2026 20:41:22 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org Cc: Pat Maddox From: Dave Cottlehuber Subject: git: be03b0fb2241 - stable/15 - syslogd: fix memory leak in casper_ttymsg() List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: dch X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: be03b0fb2241260ec94db431cf4f2954161f227e Auto-Submitted: auto-generated Date: Tue, 26 May 2026 20:41:22 +0000 Message-Id: <6a160572.1fa94.31128035@gitrepo.freebsd.org> The branch stable/15 has been updated by dch: URL: https://cgit.FreeBSD.org/src/commit/?id=be03b0fb2241260ec94db431cf4f2954161f227e commit be03b0fb2241260ec94db431cf4f2954161f227e Author: Pat Maddox AuthorDate: 2026-05-22 21:45:30 +0000 Commit: Dave Cottlehuber CommitDate: 2026-05-26 20:37:18 +0000 syslogd: fix memory leak in casper_ttymsg() nvlist_take_string_array(9) takes ownership of the array and its strings. casper_ttymsg() freed neither, leaking memory on every F_CONSOLE and F_TTY message. On long-running systems with high error-rate syslog traffic routed to /dev/console, syslogd.casper grew to hundreds of MB. Use nvlist_get_string_array(9) to borrow the array instead. Update casper_wallmsg() similarly. Approved by: src (des) Closes: https://github.com/freebsd/freebsd-src/pull/2222 Fixes: 61a29eca550b ("syslogd: Log messages using libcasper") MFC after: 3 days MFC to: stable/15 PR: 295488 Reported by: Pat Maddox Reviewed by: markj Tested by: dch (cherry picked from commit c783d7181d6a71cb2453f06e40c08c892510c2f2) --- usr.sbin/syslogd/syslogd_cap_log.c | 14 ++++++-------- 1 file changed, 6 insertions(+), 8 deletions(-) diff --git a/usr.sbin/syslogd/syslogd_cap_log.c b/usr.sbin/syslogd/syslogd_cap_log.c index 0156cc6f6b6c..5e2034abd9eb 100644 --- a/usr.sbin/syslogd/syslogd_cap_log.c +++ b/usr.sbin/syslogd/syslogd_cap_log.c @@ -128,19 +128,19 @@ cap_ttymsg(cap_channel_t *chan, struct iovec *iov, int iovcnt, int casper_ttymsg(nvlist_t *nvlin, nvlist_t *nvlout) { - char **nvlstrs; + const char * const *nvlstrs; struct iovec *iov; size_t iovcnt; int tmout; const char *line; - nvlstrs = nvlist_take_string_array(nvlin, "iov_strs", &iovcnt); + nvlstrs = nvlist_get_string_array(nvlin, "iov_strs", &iovcnt); assert(iovcnt <= TTYMSG_IOV_MAX); iov = calloc(iovcnt, sizeof(*iov)); if (iov == NULL) err(EXIT_FAILURE, "calloc"); for (size_t i = 0; i < iovcnt; ++i) { - iov[i].iov_base = nvlstrs[i]; + iov[i].iov_base = __DECONST(char *, nvlstrs[i]); iov[i].iov_len = strlen(nvlstrs[i]); } line = nvlist_get_string(nvlin, "line"); @@ -187,25 +187,23 @@ int casper_wallmsg(nvlist_t *nvlin) { const struct filed *f; - char **nvlstrs; + const char * const *nvlstrs; struct iovec *iov; size_t sz; f = nvlist_get_binary(nvlin, "filed", &sz); assert(sz == sizeof(*f)); - nvlstrs = nvlist_take_string_array(nvlin, "iov_strs", &sz); + nvlstrs = nvlist_get_string_array(nvlin, "iov_strs", &sz); assert(sz <= TTYMSG_IOV_MAX); iov = calloc(sz, sizeof(*iov)); if (iov == NULL) err(EXIT_FAILURE, "calloc"); for (size_t i = 0; i < sz; ++i) { - iov[i].iov_base = nvlstrs[i]; + iov[i].iov_base = __DECONST(char *, nvlstrs[i]); iov[i].iov_len = strlen(nvlstrs[i]); } wallmsg(f, iov, sz); - for (size_t i = 0; i < sz; ++i) - free(iov[i].iov_base); free(iov); return (0); }