From: Frantisek Sumsal <frantisek@sumsal.cz>
Date: Thu, 1 Jun 2023 20:11:01 +0000 (+0200)
Subject: socket: avoid memory leak on incomplete SocketPort object
X-Git-Tag: v254-rc1~304^2~1
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=f8b21a08aa0a8db34212bccca13bfc58dbdc5667;p=thirdparty%2Fsystemd.git

socket: avoid memory leak on incomplete SocketPort object

==1==ERROR: LeakSanitizer: detected memory leaks

Direct leak of 17 byte(s) in 1 object(s) allocated from:
    #0 0x7fc096c7243b in strdup (/lib64/libasan.so.8+0x7243b)
    #1 0x7fc095db3899 in bus_socket_set_transient_property ../src/core/dbus-socket.c:386
    #2 0x7fc095db5140 in bus_socket_set_property ../src/core/dbus-socket.c:460
    #3 0x7fc095dd20f1 in bus_unit_set_properties ../src/core/dbus-unit.c:2473
    #4 0x7fc095d87d53 in transient_unit_from_message ../src/core/dbus-manager.c:1025
    #5 0x7fc095d8872f in method_start_transient_unit ../src/core/dbus-manager.c:1112
    #6 0x7fc0944ddf4f in method_callbacks_run ../src/libsystemd/sd-bus/bus-objects.c:406
    #7 0x7fc0944e7854 in object_find_and_run ../src/libsystemd/sd-bus/bus-objects.c:1319
    #8 0x7fc0944e8f03 in bus_process_object ../src/libsystemd/sd-bus/bus-objects.c:1439
    #9 0x7fc09454ad78 in process_message ../src/libsystemd/sd-bus/sd-bus.c:3011
    #10 0x7fc09454b302 in process_running ../src/libsystemd/sd-bus/sd-bus.c:3053
    #11 0x7fc09454e158 in bus_process_internal ../src/libsystemd/sd-bus/sd-bus.c:3273
    #12 0x7fc09454e2f2 in sd_bus_process ../src/libsystemd/sd-bus/sd-bus.c:3300
    #13 0x7fc094551a59 in io_callback ../src/libsystemd/sd-bus/sd-bus.c:3642
    #14 0x7fc094727830 in source_dispatch ../src/libsystemd/sd-event/sd-event.c:4187
    #15 0x7fc094731009 in sd_event_dispatch ../src/libsystemd/sd-event/sd-event.c:4808
    #16 0x7fc094732124 in sd_event_run ../src/libsystemd/sd-event/sd-event.c:4869
    #17 0x7fc095f7af9f in manager_loop ../src/core/manager.c:3242
    #18 0x41cc7c in invoke_main_loop ../src/core/main.c:1937
    #19 0x4252e0 in main ../src/core/main.c:3072
    #20 0x7fc092a4a50f in __libc_start_call_main (/lib64/libc.so.6+0x2750f)

SUMMARY: AddressSanitizer: 17 byte(s) leaked in 1 allocation(s).
---

diff --git a/src/core/dbus-socket.c b/src/core/dbus-socket.c
index 48e6419130f..09a3a9502b3 100644
--- a/src/core/dbus-socket.c
+++ b/src/core/dbus-socket.c
@@ -364,7 +364,7 @@ static int bus_socket_set_transient_property(
                         return r;
 
                 while ((r = sd_bus_message_read(message, "(ss)", &t, &a)) > 0) {
-                        _cleanup_free_ SocketPort *p = NULL;
+                        _cleanup_(socket_port_freep) SocketPort *p = NULL;
 
                         p = new(SocketPort, 1);
                         if (!p)
diff --git a/src/core/socket.c b/src/core/socket.c
index 7c596182c2b..f8fe62c9191 100644
--- a/src/core/socket.c
+++ b/src/core/socket.c
@@ -120,6 +120,19 @@ static void socket_cleanup_fd_list(SocketPort *p) {
         p->n_auxiliary_fds = 0;
 }
 
+SocketPort *socket_port_free(SocketPort *p) {
+        if (!p)
+                return NULL;
+
+        sd_event_source_unref(p->event_source);
+
+        socket_cleanup_fd_list(p);
+        safe_close(p->fd);
+        free(p->path);
+
+        return mfree(p);
+}
+
 void socket_free_ports(Socket *s) {
         SocketPort *p;
 
@@ -127,13 +140,7 @@ void socket_free_ports(Socket *s) {
 
         while ((p = s->ports)) {
                 LIST_REMOVE(port, s->ports, p);
-
-                sd_event_source_unref(p->event_source);
-
-                socket_cleanup_fd_list(p);
-                safe_close(p->fd);
-                free(p->path);
-                free(p);
+                socket_port_free(p);
         }
 }
 
diff --git a/src/core/socket.h b/src/core/socket.h
index 308a0727568..191d27f46d1 100644
--- a/src/core/socket.h
+++ b/src/core/socket.h
@@ -172,6 +172,9 @@ int socket_collect_fds(Socket *s, int **fds);
 /* Called from the service code when a per-connection service ended */
 void socket_connection_unref(Socket *s);
 
+SocketPort *socket_port_free(SocketPort *p);
+DEFINE_TRIVIAL_CLEANUP_FUNC(SocketPort*, socket_port_free);
+
 void socket_free_ports(Socket *s);
 
 int socket_load_service_unit(Socket *s, int cfd, Unit **ret);