[PATCH] statd: fix memory leak in sm_mon_1_svc() when existing host re-monitors

[PATCH] statd: fix memory leak in sm_mon_1_svc() when existing host re-monitors

[xuchenchen]

From: xuchenchen <xuchenchen@kylinos.cn>

When an already-monitored host sends a new SM_MON request with a
different priv cookie, the code sets existing=1 and reuses the
existing notify_list entry. However, clnt->dns_name is overwritten
with the newly allocated dnsname without freeing the old value,
causing a memory leak.

Since statd is a long-running daemon, repeated SM_MON requests with
changing cookies will accumulate leaked strings.

Fix by freeing the old dns_name before overwriting it.

Signed-off-by: xuchenchen <xuchenchen@kylinos.cn>
---
 utils/statd/monitor.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/utils/statd/monitor.c b/utils/statd/monitor.c
index c76589ca..76ef16f1 100644
--- a/utils/statd/monitor.c
+++ b/utils/statd/monitor.c
@@ -187,6 +187,8 @@ sm_mon_1_svc(struct mon *argp, struct svc_req *rqstp)
 	NL_MY_VERS(clnt) = id->my_vers;
 	NL_MY_PROC(clnt) = id->my_proc;
 	memcpy(NL_PRIV(clnt), argp->priv, SM_PRIV_SIZE);
+	if (existing)
+		free(clnt->dns_name);
 	clnt->dns_name = dnsname;
 
 	/*
-- 
2.47.3

Re: [PATCH] statd: fix memory leak in sm_mon_1_svc() when existing host re-monitors

[Steve Dickson]

On 7/28/26 4:33 AM, xuchenchen wrote:
> From: xuchenchen <xuchenchen@kylinos.cn>
> 
> When an already-monitored host sends a new SM_MON request with a
> different priv cookie, the code sets existing=1 and reuses the
> existing notify_list entry. However, clnt->dns_name is overwritten
> with the newly allocated dnsname without freeing the old value,
> causing a memory leak.
> 
> Since statd is a long-running daemon, repeated SM_MON requests with
> changing cookies will accumulate leaked strings.
> 
> Fix by freeing the old dns_name before overwriting it.
> 
> Signed-off-by: xuchenchen <xuchenchen@kylinos.cn>
Committed... (tag: nfs-utils-2-9-3-rc1)

steved.> ---
>   utils/statd/monitor.c | 2 ++
>   1 file changed, 2 insertions(+)
> 
> diff --git a/utils/statd/monitor.c b/utils/statd/monitor.c
> index c76589ca..76ef16f1 100644
> --- a/utils/statd/monitor.c
> +++ b/utils/statd/monitor.c
> @@ -187,6 +187,8 @@ sm_mon_1_svc(struct mon *argp, struct svc_req *rqstp)
>   	NL_MY_VERS(clnt) = id->my_vers;
>   	NL_MY_PROC(clnt) = id->my_proc;
>   	memcpy(NL_PRIV(clnt), argp->priv, SM_PRIV_SIZE);
> +	if (existing)
> +		free(clnt->dns_name);
>   	clnt->dns_name = dnsname;
>   
>   	/*