From owner-dev-commits-src-branches@freebsd.org Tue Jul 6 18:25:55 2021 Return-Path: Delivered-To: dev-commits-src-branches@mailman.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.nyi.freebsd.org (Postfix) with ESMTP id 20E5E6651EB; Tue, 6 Jul 2021 18:25:55 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4GK9wg0PQKz4ccK; Tue, 6 Jul 2021 18:25:55 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id E943F1E7D4; Tue, 6 Jul 2021 18:25:54 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.16.1/8.16.1) with ESMTP id 166IPsjn093214; Tue, 6 Jul 2021 18:25:54 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.16.1/8.16.1/Submit) id 166IPsi5093213; Tue, 6 Jul 2021 18:25:54 GMT (envelope-from git) Date: Tue, 6 Jul 2021 18:25:54 GMT Message-Id: <202107061825.166IPsi5093213@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Mariusz Zaborski Subject: git: dc876a5bcd46 - stable/12 - libnv: fix memory leaks MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: oshogbo X-Git-Repository: src X-Git-Refname: refs/heads/stable/12 X-Git-Reftype: branch X-Git-Commit: dc876a5bcd46b486103c9127f51e01663504195b Auto-Submitted: auto-generated X-BeenThere: dev-commits-src-branches@freebsd.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: Commits to the stable branches of the FreeBSD src repository List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 06 Jul 2021 18:25:55 -0000 The branch stable/12 has been updated by oshogbo: URL: https://cgit.FreeBSD.org/src/commit/?id=dc876a5bcd46b486103c9127f51e01663504195b commit dc876a5bcd46b486103c9127f51e01663504195b Author: Mariusz Zaborski AuthorDate: 2019-02-10 23:28:55 +0000 Commit: Mariusz Zaborski CommitDate: 2021-07-06 17:58:08 +0000 libnv: fix memory leaks nvpair_create_stringv: free the temporary string; this fix affects nvlist_add_stringf() and nvlist_add_stringv(). nvpair_remove_nvlist_array (NV_TYPE_NVLIST_ARRAY case): free the chain of nvpairs (as resetting it prevents nvlist_destroy() from freeing it). Note: freeing the chain in nvlist_destroy() is not sufficient, because it would still leak through nvlist_take_nvlist_array(). This affects all nvlist_*_nvlist_array() use Submitted by: Mindaugas Rasiukevicius Reported by: clang/gcc ASAN MFC after: 2 weeks (cherry picked from commit b5d787d93b3d83f28e87e1f8cc740cb160f8f0ac) --- lib/libnv/tests/nvlist_send_recv_test.c | 2 ++ sys/contrib/libnv/nv_impl.h | 1 + sys/contrib/libnv/nvlist.c | 9 +++++++++ sys/contrib/libnv/nvpair.c | 15 +++++++++++---- 4 files changed, 23 insertions(+), 4 deletions(-) diff --git a/lib/libnv/tests/nvlist_send_recv_test.c b/lib/libnv/tests/nvlist_send_recv_test.c index 1b673b5d4259..fbc918102b50 100644 --- a/lib/libnv/tests/nvlist_send_recv_test.c +++ b/lib/libnv/tests/nvlist_send_recv_test.c @@ -304,6 +304,8 @@ parent(int sock) name = nvlist_next(nvl, &type, &cookie); CHECK(name == NULL); + + nvlist_destroy(nvl); } static void diff --git a/sys/contrib/libnv/nv_impl.h b/sys/contrib/libnv/nv_impl.h index a67cc2ca0883..1875c739beee 100644 --- a/sys/contrib/libnv/nv_impl.h +++ b/sys/contrib/libnv/nv_impl.h @@ -103,6 +103,7 @@ bool nvlist_move_nvpair(nvlist_t *nvl, nvpair_t *nvp); void nvlist_set_parent(nvlist_t *nvl, nvpair_t *parent); void nvlist_set_array_next(nvlist_t *nvl, nvpair_t *ele); +nvpair_t *nvlist_get_array_next_nvpair(nvlist_t *nvl); const nvpair_t *nvlist_get_nvpair(const nvlist_t *nvl, const char *name); diff --git a/sys/contrib/libnv/nvlist.c b/sys/contrib/libnv/nvlist.c index 69b32a62a4cc..311325d822ce 100644 --- a/sys/contrib/libnv/nvlist.c +++ b/sys/contrib/libnv/nvlist.c @@ -247,6 +247,15 @@ nvlist_set_array_next(nvlist_t *nvl, nvpair_t *ele) nvl->nvl_array_next = ele; } +nvpair_t * +nvlist_get_array_next_nvpair(nvlist_t *nvl) +{ + + NVLIST_ASSERT(nvl); + + return (nvl->nvl_array_next); +} + bool nvlist_in_array(const nvlist_t *nvl) { diff --git a/sys/contrib/libnv/nvpair.c b/sys/contrib/libnv/nvpair.c index ed01da2c5040..b767b9bbf972 100644 --- a/sys/contrib/libnv/nvpair.c +++ b/sys/contrib/libnv/nvpair.c @@ -229,8 +229,16 @@ nvpair_remove_nvlist_array(nvpair_t *nvp) nvlarray = __DECONST(nvlist_t **, nvpair_get_nvlist_array(nvp, &count)); for (i = 0; i < count; i++) { - nvlist_set_array_next(nvlarray[i], NULL); - nvlist_set_parent(nvlarray[i], NULL); + nvlist_t *nvl; + nvpair_t *nnvp; + + nvl = nvlarray[i]; + nnvp = nvlist_get_array_next_nvpair(nvl); + if (nnvp != NULL) { + nvpair_free_structure(nnvp); + } + nvlist_set_array_next(nvl, NULL); + nvlist_set_parent(nvl, NULL); } } @@ -1194,8 +1202,7 @@ nvpair_create_stringv(const char *name, const char *valuefmt, va_list valueap) if (len < 0) return (NULL); nvp = nvpair_create_string(name, str); - if (nvp == NULL) - nv_free(str); + nv_free(str); return (nvp); }