| Message ID | 20200603070338.7922-1-pannengyuan@huawei.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | qom-hmp-cmds: fix a memleak in hmp_qom_get | expand |
Hi Pan, On 6/3/20 9:03 AM, Pan Nengyuan wrote: > 'obj' forgot to free at the end of hmp_qom_get(). Fix that. > > The leak stack: > Direct leak of 40 byte(s) in 1 object(s) allocated from: > #0 0x7f4e3a779ae8 in __interceptor_malloc (/lib64/libasan.so.5+0xefae8) > #1 0x7f4e398f91d5 in g_malloc (/lib64/libglib-2.0.so.0+0x531d5) > #2 0x55c9fd9a3999 in qstring_from_substr /build/qemu/src/qobject/qstring.c:45 > #3 0x55c9fd894bd3 in qobject_output_type_str /build/qemu/src/qapi/qobject-output-visitor.c:175 > #4 0x55c9fd894bd3 in qobject_output_type_str /build/qemu/src/qapi/qobject-output-visitor.c:168 > #5 0x55c9fd88b34d in visit_type_str /build/qemu/src/qapi/qapi-visit-core.c:308 > #6 0x55c9fd59aa6b in property_get_str /build/qemu/src/qom/object.c:2064 > #7 0x55c9fd5adb8a in object_property_get_qobject /build/qemu/src/qom/qom-qobject.c:38 > #8 0x55c9fd4a029d in hmp_qom_get /build/qemu/src/qom/qom-hmp-cmds.c:66 > > Fixes: 89cf4fe34f4 When you fix a bug in a specific commit, please Cc the commit author and the reviewers, so they have a chance to 1/ review your fix and 2/ learn from their mistake. > Reported-by: Euler Robot <euler.robot@huawei.com> > Signed-off-by: Pan Nengyuan <pannengyuan@huawei.com> > --- > qom/qom-hmp-cmds.c | 1 + > 1 file changed, 1 insertion(+) > > diff --git a/qom/qom-hmp-cmds.c b/qom/qom-hmp-cmds.c > index f704b6949a..3d2a23292d 100644 > --- a/qom/qom-hmp-cmds.c > +++ b/qom/qom-hmp-cmds.c > @@ -71,6 +71,7 @@ void hmp_qom_get(Monitor *mon, const QDict *qdict) > qobject_unref(str); > } > > + qobject_unref(obj); The object_resolve_path() documentation is not clear about that... Can we get the documentation clarified? > hmp_handle_error(mon, err); > } > >
On 6/3/2020 2:51 PM, Philippe Mathieu-Daudé wrote: > Hi Pan, > > On 6/3/20 9:03 AM, Pan Nengyuan wrote: >> 'obj' forgot to free at the end of hmp_qom_get(). Fix that. >> >> The leak stack: >> Direct leak of 40 byte(s) in 1 object(s) allocated from: >> #0 0x7f4e3a779ae8 in __interceptor_malloc (/lib64/libasan.so.5+0xefae8) >> #1 0x7f4e398f91d5 in g_malloc (/lib64/libglib-2.0.so.0+0x531d5) >> #2 0x55c9fd9a3999 in qstring_from_substr /build/qemu/src/qobject/qstring.c:45 >> #3 0x55c9fd894bd3 in qobject_output_type_str /build/qemu/src/qapi/qobject-output-visitor.c:175 >> #4 0x55c9fd894bd3 in qobject_output_type_str /build/qemu/src/qapi/qobject-output-visitor.c:168 >> #5 0x55c9fd88b34d in visit_type_str /build/qemu/src/qapi/qapi-visit-core.c:308 >> #6 0x55c9fd59aa6b in property_get_str /build/qemu/src/qom/object.c:2064 >> #7 0x55c9fd5adb8a in object_property_get_qobject /build/qemu/src/qom/qom-qobject.c:38 >> #8 0x55c9fd4a029d in hmp_qom_get /build/qemu/src/qom/qom-hmp-cmds.c:66 >> >> Fixes: 89cf4fe34f4 > > When you fix a bug in a specific commit, please Cc the commit author and > the reviewers, so they have a chance to 1/ review your fix and 2/ learn > from their mistake. Ok, I will do next time. > >> Reported-by: Euler Robot <euler.robot@huawei.com> >> Signed-off-by: Pan Nengyuan <pannengyuan@huawei.com> >> --- >> qom/qom-hmp-cmds.c | 1 + >> 1 file changed, 1 insertion(+) >> >> diff --git a/qom/qom-hmp-cmds.c b/qom/qom-hmp-cmds.c >> index f704b6949a..3d2a23292d 100644 >> --- a/qom/qom-hmp-cmds.c >> +++ b/qom/qom-hmp-cmds.c >> @@ -71,6 +71,7 @@ void hmp_qom_get(Monitor *mon, const QDict *qdict) >> qobject_unref(str); >> } >> >> + qobject_unref(obj); > > The object_resolve_path() documentation is not clear about that... > Can we get the documentation clarified? I'm not sure why is object_resolve_path(). In this case, 'obj' is returned from object_property_get_qobject() in qmp_qom_get(). Do you mean document object_property_get_qobject() to make it more clear? Like: - The returned object has a reference count of 1, and will be freed when the last reference is dropped. Thanks. > >> hmp_handle_error(mon, err); >> } >> >> >
Pan Nengyuan <pannengyuan@huawei.com> 于2020年6月3日周三 下午2:17写道： > 'obj' forgot to free at the end of hmp_qom_get(). Fix that. > > The leak stack: > Direct leak of 40 byte(s) in 1 object(s) allocated from: > #0 0x7f4e3a779ae8 in __interceptor_malloc (/lib64/libasan.so.5+0xefae8) > #1 0x7f4e398f91d5 in g_malloc (/lib64/libglib-2.0.so.0+0x531d5) > #2 0x55c9fd9a3999 in qstring_from_substr > /build/qemu/src/qobject/qstring.c:45 > #3 0x55c9fd894bd3 in qobject_output_type_str > /build/qemu/src/qapi/qobject-output-visitor.c:175 > #4 0x55c9fd894bd3 in qobject_output_type_str > /build/qemu/src/qapi/qobject-output-visitor.c:168 > #5 0x55c9fd88b34d in visit_type_str > /build/qemu/src/qapi/qapi-visit-core.c:308 > #6 0x55c9fd59aa6b in property_get_str /build/qemu/src/qom/object.c:2064 > #7 0x55c9fd5adb8a in object_property_get_qobject > /build/qemu/src/qom/qom-qobject.c:38 > #8 0x55c9fd4a029d in hmp_qom_get /build/qemu/src/qom/qom-hmp-cmds.c:66 > > Fixes: 89cf4fe34f4 > Reported-by: Euler Robot <euler.robot@huawei.com> > Signed-off-by: Pan Nengyuan <pannengyuan@huawei.com> > This can be tested by compile qemu with '-fsanitize=address' cflags and: make check Reviewed-by: Li Qiang <liq3ea@gmail.com> Tested-by: Li Qiang <liq3ea@gmail.com> Li Qiang > --- > qom/qom-hmp-cmds.c | 1 + > 1 file changed, 1 insertion(+) > > diff --git a/qom/qom-hmp-cmds.c b/qom/qom-hmp-cmds.c > index f704b6949a..3d2a23292d 100644 > --- a/qom/qom-hmp-cmds.c > +++ b/qom/qom-hmp-cmds.c > @@ -71,6 +71,7 @@ void hmp_qom_get(Monitor *mon, const QDict *qdict) > qobject_unref(str); > } > > + qobject_unref(obj); > hmp_handle_error(mon, err); > } > > -- > 2.18.2 > > >
* Pan Nengyuan (pannengyuan@huawei.com) wrote: > 'obj' forgot to free at the end of hmp_qom_get(). Fix that. > > The leak stack: > Direct leak of 40 byte(s) in 1 object(s) allocated from: > #0 0x7f4e3a779ae8 in __interceptor_malloc (/lib64/libasan.so.5+0xefae8) > #1 0x7f4e398f91d5 in g_malloc (/lib64/libglib-2.0.so.0+0x531d5) > #2 0x55c9fd9a3999 in qstring_from_substr /build/qemu/src/qobject/qstring.c:45 > #3 0x55c9fd894bd3 in qobject_output_type_str /build/qemu/src/qapi/qobject-output-visitor.c:175 > #4 0x55c9fd894bd3 in qobject_output_type_str /build/qemu/src/qapi/qobject-output-visitor.c:168 > #5 0x55c9fd88b34d in visit_type_str /build/qemu/src/qapi/qapi-visit-core.c:308 > #6 0x55c9fd59aa6b in property_get_str /build/qemu/src/qom/object.c:2064 > #7 0x55c9fd5adb8a in object_property_get_qobject /build/qemu/src/qom/qom-qobject.c:38 > #8 0x55c9fd4a029d in hmp_qom_get /build/qemu/src/qom/qom-hmp-cmds.c:66 > > Fixes: 89cf4fe34f4 > Reported-by: Euler Robot <euler.robot@huawei.com> > Signed-off-by: Pan Nengyuan <pannengyuan@huawei.com> Queued. > --- > qom/qom-hmp-cmds.c | 1 + > 1 file changed, 1 insertion(+) > > diff --git a/qom/qom-hmp-cmds.c b/qom/qom-hmp-cmds.c > index f704b6949a..3d2a23292d 100644 > --- a/qom/qom-hmp-cmds.c > +++ b/qom/qom-hmp-cmds.c > @@ -71,6 +71,7 @@ void hmp_qom_get(Monitor *mon, const QDict *qdict) > qobject_unref(str); > } > > + qobject_unref(obj); > hmp_handle_error(mon, err); > } > > -- > 2.18.2 > > -- Dr. David Alan Gilbert / dgilbert@redhat.com / Manchester, UK
diff --git a/qom/qom-hmp-cmds.c b/qom/qom-hmp-cmds.c index f704b6949a..3d2a23292d 100644 --- a/qom/qom-hmp-cmds.c +++ b/qom/qom-hmp-cmds.c @@ -71,6 +71,7 @@ void hmp_qom_get(Monitor *mon, const QDict *qdict) qobject_unref(str); } + qobject_unref(obj); hmp_handle_error(mon, err); }
'obj' forgot to free at the end of hmp_qom_get(). Fix that. The leak stack: Direct leak of 40 byte(s) in 1 object(s) allocated from: #0 0x7f4e3a779ae8 in __interceptor_malloc (/lib64/libasan.so.5+0xefae8) #1 0x7f4e398f91d5 in g_malloc (/lib64/libglib-2.0.so.0+0x531d5) #2 0x55c9fd9a3999 in qstring_from_substr /build/qemu/src/qobject/qstring.c:45 #3 0x55c9fd894bd3 in qobject_output_type_str /build/qemu/src/qapi/qobject-output-visitor.c:175 #4 0x55c9fd894bd3 in qobject_output_type_str /build/qemu/src/qapi/qobject-output-visitor.c:168 #5 0x55c9fd88b34d in visit_type_str /build/qemu/src/qapi/qapi-visit-core.c:308 #6 0x55c9fd59aa6b in property_get_str /build/qemu/src/qom/object.c:2064 #7 0x55c9fd5adb8a in object_property_get_qobject /build/qemu/src/qom/qom-qobject.c:38 #8 0x55c9fd4a029d in hmp_qom_get /build/qemu/src/qom/qom-hmp-cmds.c:66 Fixes: 89cf4fe34f4 Reported-by: Euler Robot <euler.robot@huawei.com> Signed-off-by: Pan Nengyuan <pannengyuan@huawei.com> --- qom/qom-hmp-cmds.c | 1 + 1 file changed, 1 insertion(+)