| Message ID | 20190827080512.2417-1-fangying1@huawei.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | qmp: Fix memory leak in migrate_params_test_apply | expand |
Patchew URL: https://patchew.org/QEMU/20190827080512.2417-1-fangying1@huawei.com/
Hi,
This series seems to have some coding style problems. See output below for
more information:
Message-id: 20190827080512.2417-1-fangying1@huawei.com
Type: series
Subject: [Qemu-devel] [PATCH] qmp: Fix memory leak in migrate_params_test_apply
=== TEST SCRIPT BEGIN ===
#!/bin/bash
git rev-parse base > /dev/null || exit 0
git config --local diff.renamelimit 0
git config --local diff.renames True
git config --local diff.algorithm histogram
./scripts/checkpatch.pl --mailback base..
=== TEST SCRIPT END ===
Updating 3c8cf5a9c21ff8782164d1def7f44bd888713384
Switched to a new branch 'test'
6e5df31 qmp: Fix memory leak in migrate_params_test_apply
=== OUTPUT BEGIN ===
ERROR: g_free(NULL) is safe this check is probably not required
#48: FILE: migration/migration.c:1254:
+ if (dest->tls_creds) {
+ g_free(dest->tls_creds);
ERROR: g_free(NULL) is safe this check is probably not required
#56: FILE: migration/migration.c:1262:
+ if (dest->tls_hostname) {
+ g_free(dest->tls_hostname);
total: 2 errors, 0 warnings, 17 lines checked
Commit 6e5df312feff (qmp: Fix memory leak in migrate_params_test_apply) has style problems, please review. If any of these errors
are false positives report them to the maintainer, see
CHECKPATCH in MAINTAINERS.
=== OUTPUT END ===
Test command exited with code: 1
The full log is available at
http://patchew.org/logs/20190827080512.2417-1-fangying1@huawei.com/testing.checkpatch/?type=message.
---
Email generated automatically by Patchew [https://patchew.org/].
Please send your feedback to patchew-devel@redhat.com
Ying Fang <fangying1@huawei.com> 于2019年8月27日周二 下午4:06写道： > Address Sanitizer shows memory leak in migrate_params_test_apply > migration/migration.c:1253 and the stack is as bellow: > > Direct leak of 45 byte(s) in 9 object(s) allocated from: > #0 0xffffbd7fc1db in __interceptor_malloc (/lib64/libasan.so.4+0xd31db) > #1 0xffffbd514163 in g_malloc (/lib64/libglib-2.0.so.0+0x57163) > #2 0xffffbd52f43b in g_strdup (/lib64/libglib-2.0.so.0+0x7243b) > #3 0xaaaadfa4d623 in migrate_params_test_apply > migration/migration.c:1253 > #4 0xaaaadfa4d623 in qmp_migrate_set_parameters > migration/migration.c:1422 > #5 0xaaaadfa963f3 in hmp_migrate_set_parameter monitor/hmp-cmds.c:1867 > #6 0xaaaadfa8afe3 in handle_hmp_command monitor/hmp.c:1082 > #7 0xaaaadf479c57 in qmp_human_monitor_command monitor/misc.c:140 > #8 0xaaaadfadf87b in qmp_marshal_human_monitor_command > qapi/qapi-commands-misc.c:1024 > #9 0xaaaadfc7797b in do_qmp_dispatch qapi/qmp-dispatch.c:131 > #10 0xaaaadfc7797b in qmp_dispatch qapi/qmp-dispatch.c:174 > #11 0xaaaadfa84fff in monitor_qmp_dispatch monitor/qmp.c:120 > #12 0xaaaadfa85bbf in monitor_qmp_bh_dispatcher monitor/qmp.c:209 > #13 0xaaaadfd2228f in aio_bh_call util/async.c:89 > #14 0xaaaadfd2228f in aio_bh_poll util/async.c:117 > #15 0xaaaadfd29bc3 in aio_dispatch util/aio-posix.c:459 > #16 0xaaaadfd21ff7 in aio_ctx_dispatch util/async.c:260 > #17 0xffffbd50e2f7 in g_main_context_dispatch > (/lib64/libglib-2.0.so.0+0x512f7) > #18 0xaaaadfd278d7 in glib_pollfds_poll util/main-loop.c:218 > #19 0xaaaadfd278d7 in os_host_main_loop_wait util/main-loop.c:241 > #20 0xaaaadfd278d7 in main_loop_wait util/main-loop.c:517 > #21 0xaaaadf67b5e7 in main_loop vl.c:1806 > #22 0xaaaadf15d453 in main vl.c:4488 > > Cc: zhanghailiang <zhang.zhanghailiang@huawei.com> > Signed-off-by: Ying Fang <fangying1@huawei.com> > --- > migration/migration.c | 6 ++++++ > 1 file changed, 6 insertions(+) > > diff --git a/migration/migration.c b/migration/migration.c > index 8b9f2fe30a..05e44ff7cc 100644 > --- a/migration/migration.c > +++ b/migration/migration.c > @@ -1250,11 +1250,17 @@ static void > migrate_params_test_apply(MigrateSetParameters *params, > > if (params->has_tls_creds) { > assert(params->tls_creds->type == QTYPE_QSTRING); > + if (dest->tls_creds) { > + g_free(dest->tls_creds); > + } > g_free can handle NULL, no need to do the NULL check. Thanks, Li Qiang > dest->tls_creds = g_strdup(params->tls_creds->u.s); > } > > if (params->has_tls_hostname) { > assert(params->tls_hostname->type == QTYPE_QSTRING); > + if (dest->tls_hostname) { > + g_free(dest->tls_hostname); > + } > dest->tls_hostname = g_strdup(params->tls_hostname->u.s); > } > > -- > 2.19.1 > > > >
On 2019/8/27 16:38, Li Qiang wrote: > > > Ying Fang <fangying1@huawei.com <mailto:fangying1@huawei.com>> 于2019年8月27日周 > 二 下午4:06写道： > > Address Sanitizer shows memory leak in migrate_params_test_apply > migration/migration.c:1253 and the stack is as bellow: > > Direct leak of 45 byte(s) in 9 object(s) allocated from: > #0 0xffffbd7fc1db in __interceptor_malloc (/lib64/libasan.so.4+0xd31db) > #1 0xffffbd514163 in g_malloc (/lib64/libglib-2.0.so.0+0x57163) > #2 0xffffbd52f43b in g_strdup (/lib64/libglib-2.0.so.0+0x7243b) > #3 0xaaaadfa4d623 in migrate_params_test_apply migration/migration.c:1253 > #4 0xaaaadfa4d623 in qmp_migrate_set_parameters migration/migration.c:1422 > #5 0xaaaadfa963f3 in hmp_migrate_set_parameter monitor/hmp-cmds.c:1867 > #6 0xaaaadfa8afe3 in handle_hmp_command monitor/hmp.c:1082 > #7 0xaaaadf479c57 in qmp_human_monitor_command monitor/misc.c:140 > #8 0xaaaadfadf87b in qmp_marshal_human_monitor_command > qapi/qapi-commands-misc.c:1024 > #9 0xaaaadfc7797b in do_qmp_dispatch qapi/qmp-dispatch.c:131 > #10 0xaaaadfc7797b in qmp_dispatch qapi/qmp-dispatch.c:174 > #11 0xaaaadfa84fff in monitor_qmp_dispatch monitor/qmp.c:120 > #12 0xaaaadfa85bbf in monitor_qmp_bh_dispatcher monitor/qmp.c:209 > #13 0xaaaadfd2228f in aio_bh_call util/async.c:89 > #14 0xaaaadfd2228f in aio_bh_poll util/async.c:117 > #15 0xaaaadfd29bc3 in aio_dispatch util/aio-posix.c:459 > #16 0xaaaadfd21ff7 in aio_ctx_dispatch util/async.c:260 > #17 0xffffbd50e2f7 in g_main_context_dispatch > (/lib64/libglib-2.0.so.0+0x512f7) > #18 0xaaaadfd278d7 in glib_pollfds_poll util/main-loop.c:218 > #19 0xaaaadfd278d7 in os_host_main_loop_wait util/main-loop.c:241 > #20 0xaaaadfd278d7 in main_loop_wait util/main-loop.c:517 > #21 0xaaaadf67b5e7 in main_loop vl.c:1806 > #22 0xaaaadf15d453 in main vl.c:4488 > > Cc: zhanghailiang <zhang.zhanghailiang@huawei.com > <mailto:zhang.zhanghailiang@huawei.com>> > Signed-off-by: Ying Fang <fangying1@huawei.com <mailto:fangying1@huawei.com>> > --- > migration/migration.c | 6 ++++++ > 1 file changed, 6 insertions(+) > > diff --git a/migration/migration.c b/migration/migration.c > index 8b9f2fe30a..05e44ff7cc 100644 > --- a/migration/migration.c > +++ b/migration/migration.c > @@ -1250,11 +1250,17 @@ static void > migrate_params_test_apply(MigrateSetParameters *params, > > if (params->has_tls_creds) { > assert(params->tls_creds->type == QTYPE_QSTRING); > + if (dest->tls_creds) { > + g_free(dest->tls_creds); > + } > > > g_free can handle NULL, no need to do the NULL check. Thanks for your remind, we can call g_free here directly. I'll send a v2 later. > > Thanks, > Li Qiang > > dest->tls_creds = g_strdup(params->tls_creds->u.s); > } > > if (params->has_tls_hostname) { > assert(params->tls_hostname->type == QTYPE_QSTRING); > + if (dest->tls_hostname) { > + g_free(dest->tls_hostname); > + } > dest->tls_hostname = g_strdup(params->tls_hostname->u.s); > } > > -- > 2.19.1 > > >
* Ying Fang (fangying1@huawei.com) wrote: > Address Sanitizer shows memory leak in migrate_params_test_apply > migration/migration.c:1253 and the stack is as bellow: > > Direct leak of 45 byte(s) in 9 object(s) allocated from: > #0 0xffffbd7fc1db in __interceptor_malloc (/lib64/libasan.so.4+0xd31db) > #1 0xffffbd514163 in g_malloc (/lib64/libglib-2.0.so.0+0x57163) > #2 0xffffbd52f43b in g_strdup (/lib64/libglib-2.0.so.0+0x7243b) > #3 0xaaaadfa4d623 in migrate_params_test_apply migration/migration.c:1253 > #4 0xaaaadfa4d623 in qmp_migrate_set_parameters migration/migration.c:1422 > #5 0xaaaadfa963f3 in hmp_migrate_set_parameter monitor/hmp-cmds.c:1867 > #6 0xaaaadfa8afe3 in handle_hmp_command monitor/hmp.c:1082 > #7 0xaaaadf479c57 in qmp_human_monitor_command monitor/misc.c:140 > #8 0xaaaadfadf87b in qmp_marshal_human_monitor_command qapi/qapi-commands-misc.c:1024 > #9 0xaaaadfc7797b in do_qmp_dispatch qapi/qmp-dispatch.c:131 > #10 0xaaaadfc7797b in qmp_dispatch qapi/qmp-dispatch.c:174 > #11 0xaaaadfa84fff in monitor_qmp_dispatch monitor/qmp.c:120 > #12 0xaaaadfa85bbf in monitor_qmp_bh_dispatcher monitor/qmp.c:209 > #13 0xaaaadfd2228f in aio_bh_call util/async.c:89 > #14 0xaaaadfd2228f in aio_bh_poll util/async.c:117 > #15 0xaaaadfd29bc3 in aio_dispatch util/aio-posix.c:459 > #16 0xaaaadfd21ff7 in aio_ctx_dispatch util/async.c:260 > #17 0xffffbd50e2f7 in g_main_context_dispatch (/lib64/libglib-2.0.so.0+0x512f7) > #18 0xaaaadfd278d7 in glib_pollfds_poll util/main-loop.c:218 > #19 0xaaaadfd278d7 in os_host_main_loop_wait util/main-loop.c:241 > #20 0xaaaadfd278d7 in main_loop_wait util/main-loop.c:517 > #21 0xaaaadf67b5e7 in main_loop vl.c:1806 > #22 0xaaaadf15d453 in main vl.c:4488 > > Cc: zhanghailiang <zhang.zhanghailiang@huawei.com> > Signed-off-by: Ying Fang <fangying1@huawei.com> > --- > migration/migration.c | 6 ++++++ > 1 file changed, 6 insertions(+) > > diff --git a/migration/migration.c b/migration/migration.c > index 8b9f2fe30a..05e44ff7cc 100644 > --- a/migration/migration.c > +++ b/migration/migration.c > @@ -1250,11 +1250,17 @@ static void migrate_params_test_apply(MigrateSetParameters *params, > > if (params->has_tls_creds) { > assert(params->tls_creds->type == QTYPE_QSTRING); > + if (dest->tls_creds) { > + g_free(dest->tls_creds); > + } > dest->tls_creds = g_strdup(params->tls_creds->u.s); > } > > if (params->has_tls_hostname) { > assert(params->tls_hostname->type == QTYPE_QSTRING); > + if (dest->tls_hostname) { > + g_free(dest->tls_hostname); > + } > dest->tls_hostname = g_strdup(params->tls_hostname->u.s); > } Thanks for reporting the leak, but I don't think this is the right fix: In the call chain we have, qmp_migrate_set_parameters calls: migrate_params_test_apply(params, &tmp); tmp is a stack allocated variable that becomes the 'dest' we see here. Then at the top of migrate_params_test_apply we have: *dest = migrate_get_current()->parameters; so that's probably bad; that's a shallow copy, so dest->tls_authz points to the same storage as the real current migration parameters. whne the code does: if (params->has_tls_creds) { assert(params->tls_creds->type == QTYPE_QSTRING); dest->tls_creds = g_strdup(params->tls_creds->u.s); } it's only changing the pointer in the 'tmp' not the main copy because of migrate_params_check fails then the parameters get entirely unchanged. So if you do a free on dest->tls_hostname you end up freeing the real parameter that's still getting used, not the tmp. So I think we need to: a) change migrate_params_test_apply so that it returns a MigrationParameters * rather than taking &tmp b) Make migrate_params_test use QAPI_CLONE to clone instead of doing: *dest = migrate_get_current()->parameters; c) Then do a qapi_free_MigrateParameters in qmp_migrate_set_parameters on both the true and false paths. Does that make sense? Dave > > -- > 2.19.1 > > -- Dr. David Alan Gilbert / dgilbert@redhat.com / Manchester, UK
On 2019/9/4 0:46, Dr. David Alan Gilbert wrote: > * Ying Fang (fangying1@huawei.com) wrote: >> Address Sanitizer shows memory leak in migrate_params_test_apply >> migration/migration.c:1253 and the stack is as bellow: >> >> Direct leak of 45 byte(s) in 9 object(s) allocated from: >> #0 0xffffbd7fc1db in __interceptor_malloc (/lib64/libasan.so.4+0xd31db) >> #1 0xffffbd514163 in g_malloc (/lib64/libglib-2.0.so.0+0x57163) >> #2 0xffffbd52f43b in g_strdup (/lib64/libglib-2.0.so.0+0x7243b) >> #3 0xaaaadfa4d623 in migrate_params_test_apply migration/migration.c:1253 >> #4 0xaaaadfa4d623 in qmp_migrate_set_parameters migration/migration.c:1422 >> #5 0xaaaadfa963f3 in hmp_migrate_set_parameter monitor/hmp-cmds.c:1867 >> #6 0xaaaadfa8afe3 in handle_hmp_command monitor/hmp.c:1082 >> #7 0xaaaadf479c57 in qmp_human_monitor_command monitor/misc.c:140 >> #8 0xaaaadfadf87b in qmp_marshal_human_monitor_command qapi/qapi-commands-misc.c:1024 >> #9 0xaaaadfc7797b in do_qmp_dispatch qapi/qmp-dispatch.c:131 >> #10 0xaaaadfc7797b in qmp_dispatch qapi/qmp-dispatch.c:174 >> #11 0xaaaadfa84fff in monitor_qmp_dispatch monitor/qmp.c:120 >> #12 0xaaaadfa85bbf in monitor_qmp_bh_dispatcher monitor/qmp.c:209 >> #13 0xaaaadfd2228f in aio_bh_call util/async.c:89 >> #14 0xaaaadfd2228f in aio_bh_poll util/async.c:117 >> #15 0xaaaadfd29bc3 in aio_dispatch util/aio-posix.c:459 >> #16 0xaaaadfd21ff7 in aio_ctx_dispatch util/async.c:260 >> #17 0xffffbd50e2f7 in g_main_context_dispatch (/lib64/libglib-2.0.so.0+0x512f7) >> #18 0xaaaadfd278d7 in glib_pollfds_poll util/main-loop.c:218 >> #19 0xaaaadfd278d7 in os_host_main_loop_wait util/main-loop.c:241 >> #20 0xaaaadfd278d7 in main_loop_wait util/main-loop.c:517 >> #21 0xaaaadf67b5e7 in main_loop vl.c:1806 >> #22 0xaaaadf15d453 in main vl.c:4488 >> >> Cc: zhanghailiang <zhang.zhanghailiang@huawei.com> >> Signed-off-by: Ying Fang <fangying1@huawei.com> >> --- >> migration/migration.c | 6 ++++++ >> 1 file changed, 6 insertions(+) >> >> diff --git a/migration/migration.c b/migration/migration.c >> index 8b9f2fe30a..05e44ff7cc 100644 >> --- a/migration/migration.c >> +++ b/migration/migration.c >> @@ -1250,11 +1250,17 @@ static void migrate_params_test_apply(MigrateSetParameters *params, >> >> if (params->has_tls_creds) { >> assert(params->tls_creds->type == QTYPE_QSTRING); >> + if (dest->tls_creds) { >> + g_free(dest->tls_creds); >> + } >> dest->tls_creds = g_strdup(params->tls_creds->u.s); >> } >> >> if (params->has_tls_hostname) { >> assert(params->tls_hostname->type == QTYPE_QSTRING); >> + if (dest->tls_hostname) { >> + g_free(dest->tls_hostname); >> + } >> dest->tls_hostname = g_strdup(params->tls_hostname->u.s); >> } > > Thanks for reporting the leak, but I don't think this is the right fix: > > In the call chain we have, qmp_migrate_set_parameters calls: > > migrate_params_test_apply(params, &tmp); > > tmp is a stack allocated variable that becomes the 'dest' > we see here. Then at the top of migrate_params_test_apply > we have: > > *dest = migrate_get_current()->parameters; > > so that's probably bad; that's a shallow copy, so dest->tls_authz > points to the same storage as the real current migration parameters. > > whne the code does: > if (params->has_tls_creds) { > assert(params->tls_creds->type == QTYPE_QSTRING); > dest->tls_creds = g_strdup(params->tls_creds->u.s); > } > Yes, you are right, this patch will not fix this issue. 'tmp' is just a copy of 'dest' here, it 's used to do parameter sanity check. We should either free tmp.tls_creds/tmp.tls_hostname after migrate_params_check or change migrate_params_test_apply . > it's only changing the pointer in the 'tmp' not the main copy > because of migrate_params_check fails then the parameters get entirely > unchanged. So if you do a free on dest->tls_hostname you end up > freeing the real parameter that's still getting used, not the tmp. > > So I think we need to: > a) change migrate_params_test_apply so that it returns a > MigrationParameters * rather than taking &tmp > b) Make migrate_params_test use QAPI_CLONE to clone instead of doing: > *dest = migrate_get_current()->parameters; > c) Then do a qapi_free_MigrateParameters in qmp_migrate_set_parameters > on both the true and false paths. > > Does that make sense? > > Dave > > >> >> -- >> 2.19.1 >> >> > -- > Dr. David Alan Gilbert / dgilbert@redhat.com / Manchester, UK > > . >
diff --git a/migration/migration.c b/migration/migration.c index 8b9f2fe30a..05e44ff7cc 100644 --- a/migration/migration.c +++ b/migration/migration.c @@ -1250,11 +1250,17 @@ static void migrate_params_test_apply(MigrateSetParameters *params, if (params->has_tls_creds) { assert(params->tls_creds->type == QTYPE_QSTRING); + if (dest->tls_creds) { + g_free(dest->tls_creds); + } dest->tls_creds = g_strdup(params->tls_creds->u.s); } if (params->has_tls_hostname) { assert(params->tls_hostname->type == QTYPE_QSTRING); + if (dest->tls_hostname) { + g_free(dest->tls_hostname); + } dest->tls_hostname = g_strdup(params->tls_hostname->u.s); }
Address Sanitizer shows memory leak in migrate_params_test_apply migration/migration.c:1253 and the stack is as bellow: Direct leak of 45 byte(s) in 9 object(s) allocated from: #0 0xffffbd7fc1db in __interceptor_malloc (/lib64/libasan.so.4+0xd31db) #1 0xffffbd514163 in g_malloc (/lib64/libglib-2.0.so.0+0x57163) #2 0xffffbd52f43b in g_strdup (/lib64/libglib-2.0.so.0+0x7243b) #3 0xaaaadfa4d623 in migrate_params_test_apply migration/migration.c:1253 #4 0xaaaadfa4d623 in qmp_migrate_set_parameters migration/migration.c:1422 #5 0xaaaadfa963f3 in hmp_migrate_set_parameter monitor/hmp-cmds.c:1867 #6 0xaaaadfa8afe3 in handle_hmp_command monitor/hmp.c:1082 #7 0xaaaadf479c57 in qmp_human_monitor_command monitor/misc.c:140 #8 0xaaaadfadf87b in qmp_marshal_human_monitor_command qapi/qapi-commands-misc.c:1024 #9 0xaaaadfc7797b in do_qmp_dispatch qapi/qmp-dispatch.c:131 #10 0xaaaadfc7797b in qmp_dispatch qapi/qmp-dispatch.c:174 #11 0xaaaadfa84fff in monitor_qmp_dispatch monitor/qmp.c:120 #12 0xaaaadfa85bbf in monitor_qmp_bh_dispatcher monitor/qmp.c:209 #13 0xaaaadfd2228f in aio_bh_call util/async.c:89 #14 0xaaaadfd2228f in aio_bh_poll util/async.c:117 #15 0xaaaadfd29bc3 in aio_dispatch util/aio-posix.c:459 #16 0xaaaadfd21ff7 in aio_ctx_dispatch util/async.c:260 #17 0xffffbd50e2f7 in g_main_context_dispatch (/lib64/libglib-2.0.so.0+0x512f7) #18 0xaaaadfd278d7 in glib_pollfds_poll util/main-loop.c:218 #19 0xaaaadfd278d7 in os_host_main_loop_wait util/main-loop.c:241 #20 0xaaaadfd278d7 in main_loop_wait util/main-loop.c:517 #21 0xaaaadf67b5e7 in main_loop vl.c:1806 #22 0xaaaadf15d453 in main vl.c:4488 Cc: zhanghailiang <zhang.zhanghailiang@huawei.com> Signed-off-by: Ying Fang <fangying1@huawei.com> --- migration/migration.c | 6 ++++++ 1 file changed, 6 insertions(+)