From acb691e15e3110bd2c063c740ae8d9a5e271238d Mon Sep 17 00:00:00 2001 From: Damijan Skvarc Date: Tue, 12 Nov 2019 12:32:35 +0100 Subject: [PATCH] ovsdb-server: fix memory leak while deleting zone memory leak was detected by valgrind during execution of "database commands -- positive checks" test. leaked memory was allocated in ovsdb_execute_mutate() function while parsing mutations from the apparent json entity: ==19563== at 0x4C2DB8F: malloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so) ==19563== by 0x4652D0: xmalloc (util.c:138) ==19563== by 0x46539E: xmemdup0 (util.c:168) ==19563== by 0x4653F7: xstrdup (util.c:177) ==19563== by 0x450379: ovsdb_base_type_clone (ovsdb-types.c:208) ==19563== by 0x450F8D: ovsdb_type_clone (ovsdb-types.c:550) ==19563== by 0x428C3F: ovsdb_mutation_from_json (mutation.c:108) ==19563== by 0x428F6B: ovsdb_mutation_set_from_json (mutation.c:187) ==19563== by 0x42578D: ovsdb_execute_mutate (execution.c:573) ==19563== by 0x4246B0: ovsdb_execute_compose (execution.c:171) ==19563== by 0x41CDE5: ovsdb_trigger_try (trigger.c:204) ==19563== by 0x41C8DF: ovsdb_trigger_init (trigger.c:61) ==19563== by 0x40E93C: ovsdb_jsonrpc_trigger_create (jsonrpc-server.c:1135) ==19563== by 0x40E20C: ovsdb_jsonrpc_session_got_request (jsonrpc-server.c:1002) ==19563== by 0x40D1C2: ovsdb_jsonrpc_session_run (jsonrpc-server.c:561) ==19563== by 0x40D31E: ovsdb_jsonrpc_session_run_all (jsonrpc-server.c:591) ==19563== by 0x40CD6E: ovsdb_jsonrpc_server_run (jsonrpc-server.c:406) ==19563== by 0x40627E: main_loop (ovsdb-server.c:209) ==19563== by 0x406E66: main (ovsdb-server.c:460) This memory is usually freed at the end of ovsdb_execute_mutate() however in the aforementioned test case this does not happen. Namely in case of delete mutator and in case of error while calling ovsdb_datum_from_json() apparent mutation was marked as invalid, what prevents freeing problematic memory. Memory leak can be reproduced quickly with the following command sequence: ovs-vsctl --no-wait -vreconnect:emer add-zone-tp netdev zone=1 icmp_first=1 icmp_reply=2 ovs-vsctl --no-wait -vreconnect:emer del-zone-tp netdev zone=1 Signed-off-by: Damijan Skvarc Signed-off-by: Ben Pfaff --- ovsdb/mutation.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/ovsdb/mutation.c b/ovsdb/mutation.c index cd20bdb7c..56edc5f00 100644 --- a/ovsdb/mutation.c +++ b/ovsdb/mutation.c @@ -147,6 +147,8 @@ ovsdb_mutation_from_json(const struct ovsdb_table_schema *ts, if (error && ovsdb_type_is_map(&m->type) && m->mutator == OVSDB_M_DELETE) { ovsdb_error_destroy(error); + ovsdb_base_type_destroy(&m->type.value); + m->type.value.enum_ = NULL; m->type.value.type = OVSDB_TYPE_VOID; error = ovsdb_datum_from_json(&m->arg, &m->type, array->elems[2], symtab); -- 2.39.2