[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [PATCH] qom-hmp-cmds: fix a memleak in hmp_qom_get
From: |
Philippe Mathieu-Daudé |
Subject: |
Re: [PATCH] qom-hmp-cmds: fix a memleak in hmp_qom_get |
Date: |
Wed, 3 Jun 2020 08:51:57 +0200 |
User-agent: |
Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.5.0 |
Hi Pan,
On 6/3/20 9:03 AM, Pan Nengyuan wrote:
> 'obj' forgot to free at the end of hmp_qom_get(). Fix that.
>
> The leak stack:
> Direct leak of 40 byte(s) in 1 object(s) allocated from:
> #0 0x7f4e3a779ae8 in __interceptor_malloc (/lib64/libasan.so.5+0xefae8)
> #1 0x7f4e398f91d5 in g_malloc (/lib64/libglib-2.0.so.0+0x531d5)
> #2 0x55c9fd9a3999 in qstring_from_substr
> /build/qemu/src/qobject/qstring.c:45
> #3 0x55c9fd894bd3 in qobject_output_type_str
> /build/qemu/src/qapi/qobject-output-visitor.c:175
> #4 0x55c9fd894bd3 in qobject_output_type_str
> /build/qemu/src/qapi/qobject-output-visitor.c:168
> #5 0x55c9fd88b34d in visit_type_str
> /build/qemu/src/qapi/qapi-visit-core.c:308
> #6 0x55c9fd59aa6b in property_get_str /build/qemu/src/qom/object.c:2064
> #7 0x55c9fd5adb8a in object_property_get_qobject
> /build/qemu/src/qom/qom-qobject.c:38
> #8 0x55c9fd4a029d in hmp_qom_get /build/qemu/src/qom/qom-hmp-cmds.c:66
>
> Fixes: 89cf4fe34f4
When you fix a bug in a specific commit, please Cc the commit author and
the reviewers, so they have a chance to 1/ review your fix and 2/ learn
from their mistake.
> Reported-by: Euler Robot <euler.robot@huawei.com>
> Signed-off-by: Pan Nengyuan <pannengyuan@huawei.com>
> ---
> qom/qom-hmp-cmds.c | 1 +
> 1 file changed, 1 insertion(+)
>
> diff --git a/qom/qom-hmp-cmds.c b/qom/qom-hmp-cmds.c
> index f704b6949a..3d2a23292d 100644
> --- a/qom/qom-hmp-cmds.c
> +++ b/qom/qom-hmp-cmds.c
> @@ -71,6 +71,7 @@ void hmp_qom_get(Monitor *mon, const QDict *qdict)
> qobject_unref(str);
> }
>
> + qobject_unref(obj);
The object_resolve_path() documentation is not clear about that...
Can we get the documentation clarified?
> hmp_handle_error(mon, err);
> }
>
>