6452 ilbd leaks lmalloc() memory due to posix_spawn() sloppiness
Reviewed by: Albert Lee <trisk@omniti.com>

@@ -21,10 +21,11 @@
 
 /*
  * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
  * Copyright 2012 Milan Jurik. All rights reserved.
+ * Copyright 2015 OmniTI Computer Consulting, Inc. All rights reserved.
  */
 
 #include <sys/types.h>
 #include <sys/socket.h>
 #include <sys/list.h>

@@ -1286,24 +1287,24 @@
                 return (B_FALSE);
         }
         /* Set our side of the pipe to be non-blocking */
         if ((fdflags = fcntl(fds[0], F_GETFL, 0)) == -1) {
                 logdebug("ilbd_run_probe: fcntl(F_GETFL)");
-                goto cleanup;
+                goto cleanup_noactions;
         }
         if (fcntl(fds[0], F_SETFL, fdflags | O_NONBLOCK) == -1) {
                 logdebug("ilbd_run_probe: fcntl(F_SETFL)");
-                goto cleanup;
+                goto cleanup_noactions;
         }
 
         if (posix_spawn_file_actions_init(&fd_actions) != 0) {
                 logdebug("ilbd_run_probe: posix_spawn_file_actions_init");
-                goto cleanup;
+                goto cleanup_noactions;
         }
         if (posix_spawnattr_init(&attr) != 0) {
                 logdebug("ilbd_run_probe: posix_spawnattr_init");
-                goto cleanup;
+                goto cleanup_noattr;
         }
         if (posix_spawn_file_actions_addclose(&fd_actions, fds[0]) != 0) {
                 logdebug("ilbd_run_probe: posix_spawn_file_actions_addclose");
                 goto cleanup;
         }

@@ -1353,12 +1354,13 @@
                     srv->shc_hc->ihc_test, srv->shc_sg_srv->sgs_srvID,
                     strerror(errno));
                 goto cleanup;
         }
 
+        (void) posix_spawnattr_destroy(&attr);
+        (void) posix_spawn_file_actions_destroy(&fd_actions);
         (void) close(fds[1]);
-        destroy_argv(child_argv);
         srv->shc_child_pid = pid;
         srv->shc_child_fd = fds[0];
         srv->shc_ev = probe_ev;
 
         probe_ev->ihp_ev = ILBD_EVENT_PROBE;

@@ -1370,16 +1372,22 @@
                  * Need to kill the child.  It will free the srv->shc_ev,
                  * which is probe_ev.  So set probe_ev to NULL.
                  */
                 ilbd_hc_kill_probe(srv);
                 probe_ev = NULL;
-                goto cleanup;
+                /* posix_spawn attrs & actions already destroyed. */
+                goto cleanup_noactions;
         }
+        destroy_argv(child_argv);
 
         return (B_TRUE);
 
 cleanup:
+        (void) posix_spawnattr_destroy(&attr);
+cleanup_noattr:
+        (void) posix_spawn_file_actions_destroy(&fd_actions);
+cleanup_noactions:
         (void) close(fds[0]);
         (void) close(fds[1]);
         destroy_argv(child_argv);
         if (probe_ev != NULL)
                 free(probe_ev);