On Fri, 2020-10-23 at 14:12 +0800, Chen Qun wrote:
> Properly free each command resp to avoid memory leak.
> ASAN shows memory leak stack:
>
> Indirect leak of 2352520 byte(s) in 571 object(s) allocated from:
> #0 0x7f6ca3308d4e in __interceptor_calloc (/lib64/libasan.so.5+0x112d4e)
> #1 0x7f6ca3127a50 in g_malloc0 (/lib64/libglib-2.0.so.0+0x55a50)
> #2 0x557bf3c71d2b in qdict_new ../qobject/qdict.c:29
> #3 0x557bf3c9caba in parse_object ../qobject/json-parser.c:318
> #4 0x557bf3c9ce75 in json_parser_parse ../qobject/json-parser.c:580
> #5 0x557bf3c8c8cf in json_message_process_token
> ../qobject/json-streamer.c:92
> #6 0x557bf3c9ea59 in json_lexer_feed_char ../qobject/json-lexer.c:313
> #7 0x557bf3c9eeb5 in json_lexer_feed ../qobject/json-lexer.c:350
> #8 0x557bf3c4793a in qmp_fd_receive ../tests/qtest/libqtest.c:608
> #9 0x557bf3c47b58 in qtest_qmp_receive ../tests/qtest/libqtest.c:618
> #10 0x557bf3c44245 in wait_command ../tests/qtest/migration-helpers.c:59
> #11 0x557bf3c445cb in migrate_query_status
> ../tests/qtest/migration-helpers.c:108
> #12 0x557bf3c44642 in check_migration_status
> ../tests/qtest/migration-helpers.c:124
> #13 0x557bf3c447e7 in wait_for_migration_status
> ../tests/qtest/migration-helpers.c:148
> #14 0x557bf3c43b8f in test_migrate_auto_converge
> ../tests/qtest/migration-test.c:1243
> ......
>
> Fix: 5e34005571af5
>
> Reported-by: Euler Robot <euler.ro...@huawei.com>
> Signed-off-by: Chen Qun <kuhn.chen...@huawei.com>
> ---
> Cc: Thomas Huth <th...@redhat.com>
> Cc: Laurent Vivier <lviv...@redhat.com>
> Cc: Maxim Levitsky <mlevi...@redhat.com>
> Cc: Paolo Bonzini <pbonz...@redhat.com>
> ---
> tests/qtest/migration-helpers.c | 16 ++++++++++++----
> 1 file changed, 12 insertions(+), 4 deletions(-)
>
> diff --git a/tests/qtest/migration-helpers.c b/tests/qtest/migration-helpers.c
> index b799dbafb7..4ee26014b7 100644
> --- a/tests/qtest/migration-helpers.c
> +++ b/tests/qtest/migration-helpers.c
> @@ -32,7 +32,7 @@ static void check_stop_event(QTestState *who)
> QDict *wait_command_fd(QTestState *who, int fd, const char *command, ...)
> {
> va_list ap;
> - QDict *resp;
> + QDict *resp, *ret;
>
> va_start(ap, command);
> qtest_qmp_vsend_fds(who, &fd, 1, command, ap);
> @@ -44,7 +44,11 @@ QDict *wait_command_fd(QTestState *who, int fd, const char
> *command, ...)
> g_assert(!qdict_haskey(resp, "error"));
> g_assert(qdict_haskey(resp, "return"));
>
> - return qdict_get_qdict(resp, "return");
> + ret = qdict_get_qdict(resp, "return");
> + qobject_ref(ret);
> + qobject_unref(resp);
> +
> + return ret;
> }
>
> /*
> @@ -53,7 +57,7 @@ QDict *wait_command_fd(QTestState *who, int fd, const char
> *command, ...)
> QDict *wait_command(QTestState *who, const char *command, ...)
> {
> va_list ap;
> - QDict *resp;
> + QDict *resp, *ret;
>
> va_start(ap, command);
> resp = qtest_vqmp(who, command, ap);
> @@ -64,7 +68,11 @@ QDict *wait_command(QTestState *who, const char *command,
> ...)
> g_assert(!qdict_haskey(resp, "error"));
> g_assert(qdict_haskey(resp, "return"));
>
> - return qdict_get_qdict(resp, "return");
> + ret = qdict_get_qdict(resp, "return");
> + qobject_ref(ret);
> + qobject_unref(resp);
> +
> + return ret;
> }
>
> /*
This is a funny one. I was thinking that reference counters in qobject should
take care of this.
I guess not.
Thanks for fixing it.
Best regards,
Maxim Levitsky
