From nobody Thu May 28 22:16:09 2026 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gRLRY56qTz6fQlB for ; Thu, 28 May 2026 22:16:09 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R13" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gRLRY27lZz3LMV for ; Thu, 28 May 2026 22:16:09 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1780006569; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=vPUdPRw7aKSFw7xz5kzUfjmy09zH+lC9c6FYhRL0rJk=; b=L8sptIrftLezvxm7S5EIFRTEAdSDfVNhlXw+PzY92Uw+8GFswDf2zWVaCdM2xsaxIQJ7BE RtVrygDo/Q0DkTT3O5x9ENYyYKmQJvPBUjpOkoIPpy+v3/uBXT+2Yh+D4fxJFKVNOSx0DI 2F/5Sb4Qq+hZFS0PtQha2k+tSpwJkNs8GBoukMBXMzfdxOReILqz/PAzAfllIFlvYDeJ49 ZNgIFwR3GOlUmPxNff0pD376OOq+Of8U2h0DAlL5L+BkYrI1PF0mm9k0QTVIgWWW7FxfKZ pkGiEBehwzqGLIrD7G9UvF+RJVLHR1qJToMzg18XcFFYq48g48A+i45HJQP3CQ== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1780006569; a=rsa-sha256; cv=none; b=iA9njOH7CCX6iv0dMK5fa3arPIjAqgHR5v4xut9ODEqoq+/KYcmDnHLETVLGQODzPA+fFr l1xK6sYtNYAEFuxxS6CiGypKblyBFenN953NPbEFewfdkA+Rpht5eBPU5cSmlHo+HbChsQ Q6WfDEr7tqPmA7I6im7C+J0EMeKR3XIHyaHa61RVi0qR6566DwIXH28y1kzK7TbqTzyyD4 ug2iCnKvMHTVX63r4fHjC5l1fBAb3AQx2Uzi4Z3Cxm/MPSHJXtEvM6sWIHOHln0secOndT 0Z9xJFCR4ja9SXS3IQz309fPqF076cQCax2CdWYpx4X+fV8U1diYk0Yw+nL3/w== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1780006569; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=vPUdPRw7aKSFw7xz5kzUfjmy09zH+lC9c6FYhRL0rJk=; b=jp0TOBGrbzcINwuSzQukP4Srx92Kj2YKT8uUK7XUCFq8y+jZL1vMD4isTxsMlCDzgrhIxw UI5kxKr4flKcd4lFMPXimPJQquNW8OHYY6kJCfx1tC6VGaOVgWt3vfVxbfYmNj19nqVkIJ tlbAfpmpvDMlfkeo5g/M3u4ZWUKWbzbpkmz2I3JYN4l1nJ3/4fRZa/xKhjmffIwQ2Hb/9R zZbIlCjtxNj4QmAjGurhgtRLPrVpIVL0XwgkqlDhutT0wxQpi07wc7DsJSGnuAnsD9KjNj u7XNB5mCiMiKMYC7Ejf9DRV44gRs537Mo23MXOFzpNO9dXLV6xjDQbZA9TRfww== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gRLRY0y4Jz14xV for ; Thu, 28 May 2026 22:16:09 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 3c3f7 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Thu, 28 May 2026 22:16:09 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org Cc: Pat Maddox From: Colin Percival Subject: git: d51d91b07f5b - releng/15.1 - syslogd: fix memory leak in casper_ttymsg() List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: cperciva X-Git-Repository: src X-Git-Refname: refs/heads/releng/15.1 X-Git-Reftype: branch X-Git-Commit: d51d91b07f5bd1066652eb3d09fc5db07790824b Auto-Submitted: auto-generated Date: Thu, 28 May 2026 22:16:09 +0000 Message-Id: <6a18bea9.3c3f7.3ddb45bd@gitrepo.freebsd.org> The branch releng/15.1 has been updated by cperciva: URL: https://cgit.FreeBSD.org/src/commit/?id=d51d91b07f5bd1066652eb3d09fc5db07790824b commit d51d91b07f5bd1066652eb3d09fc5db07790824b Author: Pat Maddox AuthorDate: 2026-05-22 21:45:30 +0000 Commit: Colin Percival CommitDate: 2026-05-28 22:15:34 +0000 syslogd: fix memory leak in casper_ttymsg() nvlist_take_string_array(9) takes ownership of the array and its strings. casper_ttymsg() freed neither, leaking memory on every F_CONSOLE and F_TTY message. On long-running systems with high error-rate syslog traffic routed to /dev/console, syslogd.casper grew to hundreds of MB. Use nvlist_get_string_array(9) to borrow the array instead. Update casper_wallmsg() similarly. Approved by: re (cperciva) Approved by: src (des) Closes: https://github.com/freebsd/freebsd-src/pull/2222 Fixes: 61a29eca550b ("syslogd: Log messages using libcasper") MFC after: 3 days MFC to: stable/15 PR: 295488 Reported by: Pat Maddox Reviewed by: markj Tested by: dch (cherry picked from commit c783d7181d6a71cb2453f06e40c08c892510c2f2) (cherry picked from commit be03b0fb2241260ec94db431cf4f2954161f227e) --- usr.sbin/syslogd/syslogd_cap_log.c | 14 ++++++-------- 1 file changed, 6 insertions(+), 8 deletions(-) diff --git a/usr.sbin/syslogd/syslogd_cap_log.c b/usr.sbin/syslogd/syslogd_cap_log.c index 0156cc6f6b6c..5e2034abd9eb 100644 --- a/usr.sbin/syslogd/syslogd_cap_log.c +++ b/usr.sbin/syslogd/syslogd_cap_log.c @@ -128,19 +128,19 @@ cap_ttymsg(cap_channel_t *chan, struct iovec *iov, int iovcnt, int casper_ttymsg(nvlist_t *nvlin, nvlist_t *nvlout) { - char **nvlstrs; + const char * const *nvlstrs; struct iovec *iov; size_t iovcnt; int tmout; const char *line; - nvlstrs = nvlist_take_string_array(nvlin, "iov_strs", &iovcnt); + nvlstrs = nvlist_get_string_array(nvlin, "iov_strs", &iovcnt); assert(iovcnt <= TTYMSG_IOV_MAX); iov = calloc(iovcnt, sizeof(*iov)); if (iov == NULL) err(EXIT_FAILURE, "calloc"); for (size_t i = 0; i < iovcnt; ++i) { - iov[i].iov_base = nvlstrs[i]; + iov[i].iov_base = __DECONST(char *, nvlstrs[i]); iov[i].iov_len = strlen(nvlstrs[i]); } line = nvlist_get_string(nvlin, "line"); @@ -187,25 +187,23 @@ int casper_wallmsg(nvlist_t *nvlin) { const struct filed *f; - char **nvlstrs; + const char * const *nvlstrs; struct iovec *iov; size_t sz; f = nvlist_get_binary(nvlin, "filed", &sz); assert(sz == sizeof(*f)); - nvlstrs = nvlist_take_string_array(nvlin, "iov_strs", &sz); + nvlstrs = nvlist_get_string_array(nvlin, "iov_strs", &sz); assert(sz <= TTYMSG_IOV_MAX); iov = calloc(sz, sizeof(*iov)); if (iov == NULL) err(EXIT_FAILURE, "calloc"); for (size_t i = 0; i < sz; ++i) { - iov[i].iov_base = nvlstrs[i]; + iov[i].iov_base = __DECONST(char *, nvlstrs[i]); iov[i].iov_len = strlen(nvlstrs[i]); } wallmsg(f, iov, sz); - for (size_t i = 0; i < sz; ++i) - free(iov[i].iov_base); free(iov); return (0); }