diff mbox

iptables: nft: fix memory leaks in nft_fini

Message ID 1385981114-3131-1-git-send-email-anarey@gmail.com
State Accepted
Headers show

Commit Message

Ana Rey Dec. 2, 2013, 10:45 a.m. UTC 
Those errors are shown with valgrind tool:

valgrind --leak-check=full xtables -A INPUT -i eth0 -p tcp --dport 80

==12554== 40 bytes in 1 blocks are still reachable in loss record 1 of 10
==12554==    at 0x4C2935B: malloc (vg_replace_malloc.c:270)
==12554==    by 0x574D755: mnl_nlmsg_batch_start (nlmsg.c:447)
==12554==    by 0x416520: nft_action (nft.c:2281)
==12554==    by 0x41355E: xtables_main (xtables-standalone.c:75)
==12554==    by 0x5B87994: (below main) (libc-start.c:260)

==12554== 135,168 bytes in 1 blocks are still reachable in loss record 9 of 10
==12554==    at 0x4C2935B: malloc (vg_replace_malloc.c:270)
==12554==    by 0x415A24: mnl_nft_batch_alloc (nft.c:102)
==12554==    by 0x416520: nft_action (nft.c:2281)
==12554==    by 0x41355E: xtables_main (xtables-standalone.c:75)
==12554==    by 0x5B87994: (below main) (libc-start.c:260)

These objects are allocated from nft_init but they were not released
appropriately in the exit path.
---
 iptables/nft.c | 2 ++
 1 file changed, 2 insertions(+)

Comments

Pablo Neira Ayuso Dec. 4, 2013, 11:25 a.m. UTC | #1 
On Mon, Dec 02, 2013 at 11:45:14AM +0100, Ana Rey wrote:
> Those errors are shown with valgrind tool:
> 
> valgrind --leak-check=full xtables -A INPUT -i eth0 -p tcp --dport 80
> 
> ==12554== 40 bytes in 1 blocks are still reachable in loss record 1 of 10
> ==12554==    at 0x4C2935B: malloc (vg_replace_malloc.c:270)
> ==12554==    by 0x574D755: mnl_nlmsg_batch_start (nlmsg.c:447)
> ==12554==    by 0x416520: nft_action (nft.c:2281)
> ==12554==    by 0x41355E: xtables_main (xtables-standalone.c:75)
> ==12554==    by 0x5B87994: (below main) (libc-start.c:260)
> 
> ==12554== 135,168 bytes in 1 blocks are still reachable in loss record 9 of 10
> ==12554==    at 0x4C2935B: malloc (vg_replace_malloc.c:270)
> ==12554==    by 0x415A24: mnl_nft_batch_alloc (nft.c:102)
> ==12554==    by 0x416520: nft_action (nft.c:2281)
> ==12554==    by 0x41355E: xtables_main (xtables-standalone.c:75)
> ==12554==    by 0x5B87994: (below main) (libc-start.c:260)
> 
> These objects are allocated from nft_init but they were not released
> appropriately in the exit path.

Applied, thanks.
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
diff mbox

Patch

diff --git a/iptables/nft.c b/iptables/nft.c
index 0599beb..a015947 100644
--- a/iptables/nft.c
+++ b/iptables/nft.c
@@ -618,6 +618,8 @@  int nft_init(struct nft_handle *h, struct builtin_table *t)
 void nft_fini(struct nft_handle *h)
 {
 	mnl_socket_close(h->nl);
+	free(mnl_nlmsg_batch_head(h->batch));
+	mnl_nlmsg_batch_stop(h->batch);
 }
 
 int nft_table_add(struct nft_handle *h, const struct nft_table *t)