From: "Dr. David Alan Gilbert (git)" <dgilbert@redhat.com>
To: qemu-devel@nongnu.org, david@redhat.com, zhukeqian1@huawei.com,
maozhongyi@cmss.chinamobile.com, marcandre.lureau@redhat.com,
pannengyuan@huawei.com, f4bug@amsat.org, wei.w.wang@intel.com,
yi.y.sun@intel.com, quintela@redhat.com
Subject: [PULL 12/12] migration/multifd: Do error_free after migrate_set_error to avoid memleaks
Date: Thu, 7 May 2020 18:02:11 +0100 [thread overview]
Message-ID: <20200507170211.238283-13-dgilbert@redhat.com> (raw)
In-Reply-To: <20200507170211.238283-1-dgilbert@redhat.com>
From: Pan Nengyuan <pannengyuan@huawei.com>
When error happen in multifd_send_thread, it use error_copy to set migrate error in
multifd_send_terminate_threads(). We should call error_free after it.
Similarly, fix another two places in multifd_recv_thread/multifd_save_cleanup.
The leak stack:
Direct leak of 48 byte(s) in 1 object(s) allocated from:
#0 0x7f781af07cf0 in calloc (/lib64/libasan.so.5+0xefcf0)
#1 0x7f781a2ce22d in g_malloc0 (/lib64/libglib-2.0.so.0+0x5322d)
#2 0x55ee1d075c17 in error_setv /mnt/sdb/backup/qemu/util/error.c:61
#3 0x55ee1d076464 in error_setg_errno_internal /mnt/sdb/backup/qemu/util/error.c:109
#4 0x55ee1cef066e in qio_channel_socket_writev /mnt/sdb/backup/qemu/io/channel-socket.c:569
#5 0x55ee1cee806b in qio_channel_writev /mnt/sdb/backup/qemu/io/channel.c:207
#6 0x55ee1cee806b in qio_channel_writev_all /mnt/sdb/backup/qemu/io/channel.c:171
#7 0x55ee1cee8248 in qio_channel_write_all /mnt/sdb/backup/qemu/io/channel.c:257
#8 0x55ee1ca12c9a in multifd_send_thread /mnt/sdb/backup/qemu/migration/multifd.c:657
#9 0x55ee1d0607fc in qemu_thread_start /mnt/sdb/backup/qemu/util/qemu-thread-posix.c:519
#10 0x7f78159ae2dd in start_thread (/lib64/libpthread.so.0+0x82dd)
#11 0x7f78156df4b2 in __GI___clone (/lib64/libc.so.6+0xfc4b2)
Indirect leak of 52 byte(s) in 1 object(s) allocated from:
#0 0x7f781af07f28 in __interceptor_realloc (/lib64/libasan.so.5+0xeff28)
#1 0x7f78156f07d9 in __GI___vasprintf_chk (/lib64/libc.so.6+0x10d7d9)
#2 0x7f781a30ea6c in g_vasprintf (/lib64/libglib-2.0.so.0+0x93a6c)
#3 0x7f781a2e7cd0 in g_strdup_vprintf (/lib64/libglib-2.0.so.0+0x6ccd0)
#4 0x7f781a2e7d8c in g_strdup_printf (/lib64/libglib-2.0.so.0+0x6cd8c)
#5 0x55ee1d075c86 in error_setv /mnt/sdb/backup/qemu/util/error.c:65
#6 0x55ee1d076464 in error_setg_errno_internal /mnt/sdb/backup/qemu/util/error.c:109
#7 0x55ee1cef066e in qio_channel_socket_writev /mnt/sdb/backup/qemu/io/channel-socket.c:569
#8 0x55ee1cee806b in qio_channel_writev /mnt/sdb/backup/qemu/io/channel.c:207
#9 0x55ee1cee806b in qio_channel_writev_all /mnt/sdb/backup/qemu/io/channel.c:171
#10 0x55ee1cee8248 in qio_channel_write_all /mnt/sdb/backup/qemu/io/channel.c:257
#11 0x55ee1ca12c9a in multifd_send_thread /mnt/sdb/backup/qemu/migration/multifd.c:657
#12 0x55ee1d0607fc in qemu_thread_start /mnt/sdb/backup/qemu/util/qemu-thread-posix.c:519
#13 0x7f78159ae2dd in start_thread (/lib64/libpthread.so.0+0x82dd)
#14 0x7f78156df4b2 in __GI___clone (/lib64/libc.so.6+0xfc4b2)
Reported-by: Euler Robot <euler.robot@huawei.com>
Signed-off-by: Pan Nengyuan <pannengyuan@huawei.com>
Message-Id: <20200506095416.26099-3-pannengyuan@huawei.com>
Reviewed-by: Juan Quintela <quintela@redhat.com>
Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
---
migration/multifd.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/migration/multifd.c b/migration/multifd.c
index e3efd33a0d..5a3e4d0d46 100644
--- a/migration/multifd.c
+++ b/migration/multifd.c
@@ -550,6 +550,7 @@ void multifd_save_cleanup(void)
multifd_send_state->ops->send_cleanup(p, &local_err);
if (local_err) {
migrate_set_error(migrate_get_current(), local_err);
+ error_free(local_err);
}
}
qemu_sem_destroy(&multifd_send_state->channels_ready);
@@ -688,6 +689,7 @@ out:
if (local_err) {
trace_multifd_send_error(p->id);
multifd_send_terminate_threads(local_err);
+ error_free(local_err);
}
/*
@@ -965,6 +967,7 @@ static void *multifd_recv_thread(void *opaque)
if (local_err) {
multifd_recv_terminate_threads(local_err);
+ error_free(local_err);
}
qemu_mutex_lock(&p->mutex);
p->running = false;
--
2.26.2
next prev parent reply other threads:[~2020-05-07 17:06 UTC|newest]
Thread overview: 14+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-05-07 17:01 [PULL 00/12] migration queue Dr. David Alan Gilbert (git)
2020-05-07 17:02 ` [PULL 01/12] migration: fix bad indentation in error_report() Dr. David Alan Gilbert (git)
2020-05-07 17:02 ` [PULL 02/12] migration/migration: improve error reporting for migrate parameters Dr. David Alan Gilbert (git)
2020-05-07 17:02 ` [PULL 03/12] monitor/hmp-cmds: add hmp_handle_error() for hmp_migrate_set_speed() Dr. David Alan Gilbert (git)
2020-05-07 17:02 ` [PULL 04/12] migration: move the units of migrate parameters from milliseconds to ms Dr. David Alan Gilbert (git)
2020-05-07 17:02 ` [PULL 05/12] docs/devel/migration: start a debugging section Dr. David Alan Gilbert (git)
2020-05-07 17:02 ` [PULL 06/12] migration/colo: Add missing error-propagation code Dr. David Alan Gilbert (git)
2020-05-07 17:02 ` [PULL 07/12] migration/throttle: Add cpu-throttle-tailslow migration parameter Dr. David Alan Gilbert (git)
2020-05-07 17:02 ` [PULL 08/12] migration/ram: Consolidate variable reset after placement in ram_load_postcopy() Dr. David Alan Gilbert (git)
2020-05-07 17:02 ` [PULL 09/12] migration/rdma: fix a memleak on error path in rdma_start_incoming_migration Dr. David Alan Gilbert (git)
2020-05-07 17:02 ` [PULL 10/12] migration/xbzrle: add encoding rate Dr. David Alan Gilbert (git)
2020-05-07 17:02 ` [PULL 11/12] migration/multifd: fix memleaks in multifd_new_send_channel_async Dr. David Alan Gilbert (git)
2020-05-07 17:02 ` Dr. David Alan Gilbert (git) [this message]
2020-05-07 18:49 ` [PULL 00/12] migration queue Peter Maydell
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200507170211.238283-13-dgilbert@redhat.com \
--to=dgilbert@redhat.com \
--cc=david@redhat.com \
--cc=f4bug@amsat.org \
--cc=maozhongyi@cmss.chinamobile.com \
--cc=marcandre.lureau@redhat.com \
--cc=pannengyuan@huawei.com \
--cc=qemu-devel@nongnu.org \
--cc=quintela@redhat.com \
--cc=wei.w.wang@intel.com \
--cc=yi.y.sun@intel.com \
--cc=zhukeqian1@huawei.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).