Bug 1309439 - libtevent leaks memory during signal handling
Summary: libtevent leaks memory during signal handling
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: libtevent
Version: 7.3
Hardware: All
OS: Linux
urgent
urgent
Target Milestone: rc
: ---
Assignee: Jakub Hrozek
QA Contact: Steeve Goveas
URL:
Whiteboard:
Depends On:
Blocks: 1309440 1324387
TreeView+ depends on / blocked
 
Reported: 2016-02-17 20:00 UTC by Jakub Hrozek
Modified: 2019-10-10 11:14 UTC (History)
10 users (show)

Fixed In Version: libtevent-0.9.26-2.el7
Doc Type: Bug Fix
Doc Text:
Previously, the libtevent package suffered from a memory leak in signal handling. This bug has been fixed and memory leaks no longer occur in libtevent.
Clone Of:
: 1309440 1324387 (view as bug list)
Environment:
Last Closed: 2016-11-04 07:07:16 UTC
Target Upstream Version:


Attachments (Terms of Use)
reproducer (999 bytes, text/plain)
2016-02-18 13:57 UTC, Pavel Březina
no flags Details


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHEA-2016:2474 0 normal SHIPPED_LIVE libtevent bug fix update 2016-11-03 14:07:48 UTC

Description Jakub Hrozek 2016-02-17 20:00:02 UTC
Description of problem:
libtevent allocates memory during tevent_common_add_signal() but doesn't free it.

Version-Release number of selected component (if applicable):
libtevent-0.9.25-1.el7

How reproducible:
always

Steps to Reproduce:
1. register a signal handler with libtevent
2. watch the memory usage of a program after startup
3. receive a bunch of signals
3. observe memory usage go up

Actual results:


Expected results:


Additional info:
this is best tested through sssd performing many allocations

Comment 2 Pavel Březina 2016-02-18 13:57:04 UTC
Steps to reproduce are wrong. It is not about receiving the signals, the leak occurs on registering a signal handler. I'm attaching a simple reproducer in C.

Comment 3 Pavel Březina 2016-02-18 13:57:43 UTC
Created attachment 1128225 [details]
reproducer

Comment 5 gagriogi 2016-02-24 13:14:58 UTC
Steeve, do you think we can manage to have this in Z-stream?

Comment 6 Jakub Hrozek 2016-03-30 15:21:22 UTC
(In reply to gagriogi from comment #5)
> Steeve, do you think we can manage to have this in Z-stream?

We tentatively agreed to include this in U4.

Comment 8 Jakub Hrozek 2016-03-30 15:22:42 UTC
Pavel, can you please create some reproducer (C code would be fine) that QE could use to reproduce and verify the bug?

Comment 9 Pavel Březina 2016-03-31 12:26:50 UTC
The reproducer was attached in February :-)

https://bugzilla.redhat.com/show_bug.cgi?id=1309439#c3

Comment 12 Jakub Hrozek 2016-04-01 08:26:55 UTC
To reproduce, grab the source file that Pavel attached as comment #3 and save it as some file, I used tev.c as an example. Make sure that libtevent-devel and libtalloc-devel are installed.
Then compile the source with:
$ gcc -ltevent -ltalloc tev.c
and run the resulting binary:
$./a.out

With the unpatched packages, you should see a bunch of "struct sigaction" structures being reported by libtalloc as leaked. You should not see these leaks with the patched version.

Comment 13 Jakub Hrozek 2016-04-01 08:27:39 UTC
Steeve, can you add a qa_ack based on comment #12 as a reproducer?

Comment 19 Amith 2016-08-21 11:21:13 UTC
Verified the bug on libtevent Version: libtevent-0.9.28-1.el7.x86_64

Steps followed during verification:
1. Already reproduced this bug with the older build: libtevent-0.9.25-1.el7.x86_64 during verification of RHEL-7.2.Z bug BZ1324387.

2. With the patched build, the "struct sigaction" shouldn't be reported, see the output:

# ./a.out 
full talloc report on 'null_context' (total   2928 bytes in   7 blocks)
    struct tevent_sig_state        contains   2768 bytes in   1 blocks (ref 0) 0x1a53680
    struct tevent_ops_list         contains     32 bytes in   1 blocks (ref 0) 0x1a53320
    struct tevent_ops_list         contains     32 bytes in   1 blocks (ref 0) 0x1a53290
    struct tevent_ops_list         contains     32 bytes in   1 blocks (ref 0) 0x1a53200
    struct tevent_ops_list         contains     32 bytes in   1 blocks (ref 0) 0x1a53170
    struct tevent_ops_list         contains     32 bytes in   1 blocks (ref 0) 0x1a530e0

Comment 21 errata-xmlrpc 2016-11-04 07:07:16 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHEA-2016-2474.html


Note You need to log in before you can comment on or make changes to this bug.