Print this page
6452 ilbd leaks lmalloc() memory due to posix_spawn() sloppiness
Reviewed by: Albert Lee <trisk@omniti.com>

Split Close
Expand all
Collapse all
          --- old/usr/src/cmd/cmd-inet/usr.lib/ilbd/ilbd_hc.c
          +++ new/usr/src/cmd/cmd-inet/usr.lib/ilbd/ilbd_hc.c
↓ open down ↓ 15 lines elided ↑ open up ↑
  16   16   * fields enclosed by brackets "[]" replaced with your own identifying
  17   17   * information: Portions Copyright [yyyy] [name of copyright owner]
  18   18   *
  19   19   * CDDL HEADER END
  20   20   */
  21   21  
  22   22  /*
  23   23   * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
  24   24   * Use is subject to license terms.
  25   25   * Copyright 2012 Milan Jurik. All rights reserved.
       26 + * Copyright 2015 OmniTI Computer Consulting, Inc. All rights reserved.
  26   27   */
  27   28  
  28   29  #include <sys/types.h>
  29   30  #include <sys/socket.h>
  30   31  #include <sys/list.h>
  31   32  #include <sys/stropts.h>
  32   33  #include <sys/siginfo.h>
  33   34  #include <sys/wait.h>
  34   35  #include <arpa/inet.h>
  35   36  #include <netinet/in.h>
↓ open down ↓ 1245 lines elided ↑ open up ↑
1281 1282  
1282 1283          /* Set up a pipe to get output from probe command. */
1283 1284          if (pipe(fds) < 0) {
1284 1285                  logdebug("ilbd_run_probe: cannot create pipe");
1285 1286                  free(probe_ev);
1286 1287                  return (B_FALSE);
1287 1288          }
1288 1289          /* Set our side of the pipe to be non-blocking */
1289 1290          if ((fdflags = fcntl(fds[0], F_GETFL, 0)) == -1) {
1290 1291                  logdebug("ilbd_run_probe: fcntl(F_GETFL)");
1291      -                goto cleanup;
     1292 +                goto cleanup_noactions;
1292 1293          }
1293 1294          if (fcntl(fds[0], F_SETFL, fdflags | O_NONBLOCK) == -1) {
1294 1295                  logdebug("ilbd_run_probe: fcntl(F_SETFL)");
1295      -                goto cleanup;
     1296 +                goto cleanup_noactions;
1296 1297          }
1297 1298  
1298 1299          if (posix_spawn_file_actions_init(&fd_actions) != 0) {
1299 1300                  logdebug("ilbd_run_probe: posix_spawn_file_actions_init");
1300      -                goto cleanup;
     1301 +                goto cleanup_noactions;
1301 1302          }
1302 1303          if (posix_spawnattr_init(&attr) != 0) {
1303 1304                  logdebug("ilbd_run_probe: posix_spawnattr_init");
1304      -                goto cleanup;
     1305 +                goto cleanup_noattr;
1305 1306          }
1306 1307          if (posix_spawn_file_actions_addclose(&fd_actions, fds[0]) != 0) {
1307 1308                  logdebug("ilbd_run_probe: posix_spawn_file_actions_addclose");
1308 1309                  goto cleanup;
1309 1310          }
1310 1311          if (posix_spawn_file_actions_adddup2(&fd_actions, fds[1],
1311 1312              STDOUT_FILENO) != 0) {
1312 1313                  logdebug("ilbd_run_probe: posix_spawn_file_actions_dup2");
1313 1314                  goto cleanup;
1314 1315          }
↓ open down ↓ 33 lines elided ↑ open up ↑
1348 1349                  probe_name = srv->shc_hc->ihc_test;
1349 1350          }
1350 1351          if (posix_spawn(&pid, probe_name, &fd_actions, &attr, child_argv,
1351 1352              NULL) != 0) {
1352 1353                  logerr("%s: posix_spawn: %s for server %s: %s", __func__,
1353 1354                      srv->shc_hc->ihc_test, srv->shc_sg_srv->sgs_srvID,
1354 1355                      strerror(errno));
1355 1356                  goto cleanup;
1356 1357          }
1357 1358  
     1359 +        (void) posix_spawnattr_destroy(&attr);
     1360 +        (void) posix_spawn_file_actions_destroy(&fd_actions);
1358 1361          (void) close(fds[1]);
1359      -        destroy_argv(child_argv);
1360 1362          srv->shc_child_pid = pid;
1361 1363          srv->shc_child_fd = fds[0];
1362 1364          srv->shc_ev = probe_ev;
1363 1365  
1364 1366          probe_ev->ihp_ev = ILBD_EVENT_PROBE;
1365 1367          probe_ev->ihp_srv = srv;
1366 1368          probe_ev->ihp_pid = pid;
1367 1369          if (port_associate(srv->shc_ev_port, PORT_SOURCE_FD, fds[0],
1368 1370              POLLRDNORM, probe_ev) != 0) {
1369 1371                  /*
1370 1372                   * Need to kill the child.  It will free the srv->shc_ev,
1371 1373                   * which is probe_ev.  So set probe_ev to NULL.
1372 1374                   */
1373 1375                  ilbd_hc_kill_probe(srv);
1374 1376                  probe_ev = NULL;
1375      -                goto cleanup;
     1377 +                /* posix_spawn attrs & actions already destroyed. */
     1378 +                goto cleanup_noactions;
1376 1379          }
     1380 +        destroy_argv(child_argv);
1377 1381  
1378 1382          return (B_TRUE);
1379 1383  
1380 1384  cleanup:
     1385 +        (void) posix_spawnattr_destroy(&attr);
     1386 +cleanup_noattr:
     1387 +        (void) posix_spawn_file_actions_destroy(&fd_actions);
     1388 +cleanup_noactions:
1381 1389          (void) close(fds[0]);
1382 1390          (void) close(fds[1]);
1383 1391          destroy_argv(child_argv);
1384 1392          if (probe_ev != NULL)
1385 1393                  free(probe_ev);
1386 1394          return (B_FALSE);
1387 1395  }
1388 1396  
1389 1397  /*
1390 1398   * Called by ild_hc_probe_return() to re-associate the fd to a child to
↓ open down ↓ 185 lines elided ↑ open up ↑
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX