qom-hmp-cmds: fix a memleak in hmp_qom_get

[PATCH] qom-hmp-cmds: fix a memleak in hmp_qom_get

Posted by Pan Nengyuan 3 years, 11 months ago

'obj' forgot to free at the end of hmp_qom_get(). Fix that.

The leak stack:
Direct leak of 40 byte(s) in 1 object(s) allocated from:
    #0 0x7f4e3a779ae8 in __interceptor_malloc (/lib64/libasan.so.5+0xefae8)
    #1 0x7f4e398f91d5 in g_malloc (/lib64/libglib-2.0.so.0+0x531d5)
    #2 0x55c9fd9a3999 in qstring_from_substr /build/qemu/src/qobject/qstring.c:45
    #3 0x55c9fd894bd3 in qobject_output_type_str /build/qemu/src/qapi/qobject-output-visitor.c:175
    #4 0x55c9fd894bd3 in qobject_output_type_str /build/qemu/src/qapi/qobject-output-visitor.c:168
    #5 0x55c9fd88b34d in visit_type_str /build/qemu/src/qapi/qapi-visit-core.c:308
    #6 0x55c9fd59aa6b in property_get_str /build/qemu/src/qom/object.c:2064
    #7 0x55c9fd5adb8a in object_property_get_qobject /build/qemu/src/qom/qom-qobject.c:38
    #8 0x55c9fd4a029d in hmp_qom_get /build/qemu/src/qom/qom-hmp-cmds.c:66

Fixes: 89cf4fe34f4
Reported-by: Euler Robot <euler.robot@huawei.com>
Signed-off-by: Pan Nengyuan <pannengyuan@huawei.com>
---
 qom/qom-hmp-cmds.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/qom/qom-hmp-cmds.c b/qom/qom-hmp-cmds.c
index f704b6949a..3d2a23292d 100644
--- a/qom/qom-hmp-cmds.c
+++ b/qom/qom-hmp-cmds.c
@@ -71,6 +71,7 @@ void hmp_qom_get(Monitor *mon, const QDict *qdict)
         qobject_unref(str);
     }
 
+    qobject_unref(obj);
     hmp_handle_error(mon, err);
 }
 
-- 
2.18.2

Re: [PATCH] qom-hmp-cmds: fix a memleak in hmp_qom_get

Posted by Philippe Mathieu-Daudé 3 years, 11 months ago

Hi Pan,

On 6/3/20 9:03 AM, Pan Nengyuan wrote:
> 'obj' forgot to free at the end of hmp_qom_get(). Fix that.
> 
> The leak stack:
> Direct leak of 40 byte(s) in 1 object(s) allocated from:
>     #0 0x7f4e3a779ae8 in __interceptor_malloc (/lib64/libasan.so.5+0xefae8)
>     #1 0x7f4e398f91d5 in g_malloc (/lib64/libglib-2.0.so.0+0x531d5)
>     #2 0x55c9fd9a3999 in qstring_from_substr /build/qemu/src/qobject/qstring.c:45
>     #3 0x55c9fd894bd3 in qobject_output_type_str /build/qemu/src/qapi/qobject-output-visitor.c:175
>     #4 0x55c9fd894bd3 in qobject_output_type_str /build/qemu/src/qapi/qobject-output-visitor.c:168
>     #5 0x55c9fd88b34d in visit_type_str /build/qemu/src/qapi/qapi-visit-core.c:308
>     #6 0x55c9fd59aa6b in property_get_str /build/qemu/src/qom/object.c:2064
>     #7 0x55c9fd5adb8a in object_property_get_qobject /build/qemu/src/qom/qom-qobject.c:38
>     #8 0x55c9fd4a029d in hmp_qom_get /build/qemu/src/qom/qom-hmp-cmds.c:66
> 
> Fixes: 89cf4fe34f4

When you fix a bug in a specific commit, please Cc the commit author and
the reviewers, so they have a chance to 1/ review your fix and 2/ learn
from their mistake.

> Reported-by: Euler Robot <euler.robot@huawei.com>
> Signed-off-by: Pan Nengyuan <pannengyuan@huawei.com>
> ---
>  qom/qom-hmp-cmds.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/qom/qom-hmp-cmds.c b/qom/qom-hmp-cmds.c
> index f704b6949a..3d2a23292d 100644
> --- a/qom/qom-hmp-cmds.c
> +++ b/qom/qom-hmp-cmds.c
> @@ -71,6 +71,7 @@ void hmp_qom_get(Monitor *mon, const QDict *qdict)
>          qobject_unref(str);
>      }
>  
> +    qobject_unref(obj);

The object_resolve_path() documentation is not clear about that...
Can we get the documentation clarified?

>      hmp_handle_error(mon, err);
>  }
>  
>

Re: [PATCH] qom-hmp-cmds: fix a memleak in hmp_qom_get

Posted by Pan Nengyuan 3 years, 11 months ago


On 6/3/2020 2:51 PM, Philippe Mathieu-Daudé wrote:
> Hi Pan,
> 
> On 6/3/20 9:03 AM, Pan Nengyuan wrote:
>> 'obj' forgot to free at the end of hmp_qom_get(). Fix that.
>>
>> The leak stack:
>> Direct leak of 40 byte(s) in 1 object(s) allocated from:
>>     #0 0x7f4e3a779ae8 in __interceptor_malloc (/lib64/libasan.so.5+0xefae8)
>>     #1 0x7f4e398f91d5 in g_malloc (/lib64/libglib-2.0.so.0+0x531d5)
>>     #2 0x55c9fd9a3999 in qstring_from_substr /build/qemu/src/qobject/qstring.c:45
>>     #3 0x55c9fd894bd3 in qobject_output_type_str /build/qemu/src/qapi/qobject-output-visitor.c:175
>>     #4 0x55c9fd894bd3 in qobject_output_type_str /build/qemu/src/qapi/qobject-output-visitor.c:168
>>     #5 0x55c9fd88b34d in visit_type_str /build/qemu/src/qapi/qapi-visit-core.c:308
>>     #6 0x55c9fd59aa6b in property_get_str /build/qemu/src/qom/object.c:2064
>>     #7 0x55c9fd5adb8a in object_property_get_qobject /build/qemu/src/qom/qom-qobject.c:38
>>     #8 0x55c9fd4a029d in hmp_qom_get /build/qemu/src/qom/qom-hmp-cmds.c:66
>>
>> Fixes: 89cf4fe34f4
> 
> When you fix a bug in a specific commit, please Cc the commit author and
> the reviewers, so they have a chance to 1/ review your fix and 2/ learn
> from their mistake.

Ok, I will do next time.

> 
>> Reported-by: Euler Robot <euler.robot@huawei.com>
>> Signed-off-by: Pan Nengyuan <pannengyuan@huawei.com>
>> ---
>>  qom/qom-hmp-cmds.c | 1 +
>>  1 file changed, 1 insertion(+)
>>
>> diff --git a/qom/qom-hmp-cmds.c b/qom/qom-hmp-cmds.c
>> index f704b6949a..3d2a23292d 100644
>> --- a/qom/qom-hmp-cmds.c
>> +++ b/qom/qom-hmp-cmds.c
>> @@ -71,6 +71,7 @@ void hmp_qom_get(Monitor *mon, const QDict *qdict)
>>          qobject_unref(str);
>>      }
>>  
>> +    qobject_unref(obj);
> 
> The object_resolve_path() documentation is not clear about that...
> Can we get the documentation clarified?

I'm not sure why is object_resolve_path().
In this case, 'obj' is returned from object_property_get_qobject() in qmp_qom_get().
Do you mean document object_property_get_qobject() to make it more clear?
Like:
  - The returned object has a reference count of 1, and will be freed when the last reference is dropped.

Thanks.

> 
>>      hmp_handle_error(mon, err);
>>  }
>>  
>>
>

Re: [PATCH] qom-hmp-cmds: fix a memleak in hmp_qom_get

Posted by Li Qiang 3 years, 11 months ago

Pan Nengyuan <pannengyuan@huawei.com> 于2020年6月3日周三 下午2:17写道：

> 'obj' forgot to free at the end of hmp_qom_get(). Fix that.
>
> The leak stack:
> Direct leak of 40 byte(s) in 1 object(s) allocated from:
>     #0 0x7f4e3a779ae8 in __interceptor_malloc (/lib64/libasan.so.5+0xefae8)
>     #1 0x7f4e398f91d5 in g_malloc (/lib64/libglib-2.0.so.0+0x531d5)
>     #2 0x55c9fd9a3999 in qstring_from_substr
> /build/qemu/src/qobject/qstring.c:45
>     #3 0x55c9fd894bd3 in qobject_output_type_str
> /build/qemu/src/qapi/qobject-output-visitor.c:175
>     #4 0x55c9fd894bd3 in qobject_output_type_str
> /build/qemu/src/qapi/qobject-output-visitor.c:168
>     #5 0x55c9fd88b34d in visit_type_str
> /build/qemu/src/qapi/qapi-visit-core.c:308
>     #6 0x55c9fd59aa6b in property_get_str /build/qemu/src/qom/object.c:2064
>     #7 0x55c9fd5adb8a in object_property_get_qobject
> /build/qemu/src/qom/qom-qobject.c:38
>     #8 0x55c9fd4a029d in hmp_qom_get /build/qemu/src/qom/qom-hmp-cmds.c:66
>
> Fixes: 89cf4fe34f4
> Reported-by: Euler Robot <euler.robot@huawei.com>
> Signed-off-by: Pan Nengyuan <pannengyuan@huawei.com>
>


This can be tested by compile qemu with '-fsanitize=address' cflags and:
make check

Reviewed-by: Li Qiang <liq3ea@gmail.com>
Tested-by: Li Qiang <liq3ea@gmail.com>

Li Qiang


> ---
>  qom/qom-hmp-cmds.c | 1 +
>  1 file changed, 1 insertion(+)
>
> diff --git a/qom/qom-hmp-cmds.c b/qom/qom-hmp-cmds.c
> index f704b6949a..3d2a23292d 100644
> --- a/qom/qom-hmp-cmds.c
> +++ b/qom/qom-hmp-cmds.c
> @@ -71,6 +71,7 @@ void hmp_qom_get(Monitor *mon, const QDict *qdict)
>          qobject_unref(str);
>      }
>
> +    qobject_unref(obj);
>      hmp_handle_error(mon, err);
>  }
>
> --
> 2.18.2
>
>
>

Re: [PATCH] qom-hmp-cmds: fix a memleak in hmp_qom_get

Posted by Dr. David Alan Gilbert 3 years, 10 months ago

* Pan Nengyuan (pannengyuan@huawei.com) wrote:
> 'obj' forgot to free at the end of hmp_qom_get(). Fix that.
> 
> The leak stack:
> Direct leak of 40 byte(s) in 1 object(s) allocated from:
>     #0 0x7f4e3a779ae8 in __interceptor_malloc (/lib64/libasan.so.5+0xefae8)
>     #1 0x7f4e398f91d5 in g_malloc (/lib64/libglib-2.0.so.0+0x531d5)
>     #2 0x55c9fd9a3999 in qstring_from_substr /build/qemu/src/qobject/qstring.c:45
>     #3 0x55c9fd894bd3 in qobject_output_type_str /build/qemu/src/qapi/qobject-output-visitor.c:175
>     #4 0x55c9fd894bd3 in qobject_output_type_str /build/qemu/src/qapi/qobject-output-visitor.c:168
>     #5 0x55c9fd88b34d in visit_type_str /build/qemu/src/qapi/qapi-visit-core.c:308
>     #6 0x55c9fd59aa6b in property_get_str /build/qemu/src/qom/object.c:2064
>     #7 0x55c9fd5adb8a in object_property_get_qobject /build/qemu/src/qom/qom-qobject.c:38
>     #8 0x55c9fd4a029d in hmp_qom_get /build/qemu/src/qom/qom-hmp-cmds.c:66
> 
> Fixes: 89cf4fe34f4
> Reported-by: Euler Robot <euler.robot@huawei.com>
> Signed-off-by: Pan Nengyuan <pannengyuan@huawei.com>

Queued.

> ---
>  qom/qom-hmp-cmds.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/qom/qom-hmp-cmds.c b/qom/qom-hmp-cmds.c
> index f704b6949a..3d2a23292d 100644
> --- a/qom/qom-hmp-cmds.c
> +++ b/qom/qom-hmp-cmds.c
> @@ -71,6 +71,7 @@ void hmp_qom_get(Monitor *mon, const QDict *qdict)
>          qobject_unref(str);
>      }
>  
> +    qobject_unref(obj);
>      hmp_handle_error(mon, err);
>  }
>  
> -- 
> 2.18.2
> 
> 
--
Dr. David Alan Gilbert / dgilbert@redhat.com / Manchester, UK