From 87e4b1c8533f5b42175366706daff9c706dd1ecf Mon Sep 17 00:00:00 2001 From: Ilya Maximets Date: Fri, 20 Nov 2020 01:17:16 +0100 Subject: [PATCH 08/16] pinctrl: Fix leak of DNS cache records. 'smap_clear()' doesn't free allocated memory, but 'smap_clone()' re-initializes hash map clearing internal pointers and leaking this memory. 'smap_destroy()' should be used instead. Also, all the records and array of datapaths should be freed on destruction of a cache entry. Direct leak of 16 byte(s) in 2 object(s) allocated from: #0 0x5211c7 in calloc (/controller/ovn-controller+0x5211c7) #1 0x752364 in xcalloc /lib/util.c:121:31 #2 0x576e76 in sync_dns_cache /controller/pinctrl.c:2517:25 #3 0x5758fb in pinctrl_run /controller/pinctrl.c:3158:5 #4 0x59b06c in main /controller/ovn-controller.c:2642:25 #5 0x7fb570fc11a2 in __libc_start_main (/lib64/libc.so.6+0x271a2) Indirect leak of 26 byte(s) in 2 object(s) allocated from: #0 0x52100f in malloc (/controller/ovn-controller+0x52100f) #1 0x7523d6 in xmalloc /lib/util.c:138:15 #2 0x7524a8 in xmemdup0 /lib/util.c:168:15 #3 0x73d8fc in smap_clone /lib/smap.c:314:45 #4 0x576e2f in sync_dns_cache /controller/pinctrl.c:2513:13 #5 0x5758fb in pinctrl_run /controller/pinctrl.c:3158:5 #6 0x59b06c in main /controller/ovn-controller.c:2642:25 #7 0x7fb570fc11a2 in __libc_start_main (/lib64/libc.so.6+0x271a2) Fixes: 6b72068202f1 ("ovn-controller: Add a new thread in pinctrl module to handle packet-ins.") Acked-by: Dumitru Ceara Signed-off-by: Ilya Maximets Signed-off-by: Numan Siddique --- controller/pinctrl.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/controller/pinctrl.c b/controller/pinctrl.c index 728fb3063..d445d235e 100644 --- a/controller/pinctrl.c +++ b/controller/pinctrl.c @@ -2508,7 +2508,7 @@ sync_dns_cache(const struct sbrec_dns_table *dns_table) dns_data->delete = false; if (!smap_equal(&dns_data->records, &sbrec_dns->records)) { - smap_clear(&dns_data->records); + smap_destroy(&dns_data->records); smap_clone(&dns_data->records, &sbrec_dns->records); } @@ -2524,6 +2524,8 @@ sync_dns_cache(const struct sbrec_dns_table *dns_table) struct dns_data *d = iter->data; if (d->delete) { shash_delete(&dns_cache, iter); + smap_destroy(&d->records); + free(d->dps); free(d); } } @@ -2536,6 +2538,8 @@ destroy_dns_cache(void) SHASH_FOR_EACH_SAFE (iter, next, &dns_cache) { struct dns_data *d = iter->data; shash_delete(&dns_cache, iter); + smap_destroy(&d->records); + free(d->dps); free(d); } } -- 2.28.0