Re: [PATCH RESEND v2 1/7] tests/migration: fix memleak in wait_command/wait_command_fd

[Maxim Levitsky <mlevitsk@redhat.com>]

On Fri, 2020-10-23 at 14:12 +0800, Chen Qun wrote:
> Properly free each command resp to avoid memory leak.
> ASAN shows memory leak stack:
> 
> Indirect leak of 2352520 byte(s) in 571 object(s) allocated from:
>     #0 0x7f6ca3308d4e in __interceptor_calloc (/lib64/libasan.so.5+0x112d4e)
>     #1 0x7f6ca3127a50 in g_malloc0 (/lib64/libglib-2.0.so.0+0x55a50)
>     #2 0x557bf3c71d2b in qdict_new ../qobject/qdict.c:29
>     #3 0x557bf3c9caba in parse_object ../qobject/json-parser.c:318
>     #4 0x557bf3c9ce75 in json_parser_parse ../qobject/json-parser.c:580
>     #5 0x557bf3c8c8cf in json_message_process_token ../qobject/json-streamer.c:92
>     #6 0x557bf3c9ea59 in json_lexer_feed_char ../qobject/json-lexer.c:313
>     #7 0x557bf3c9eeb5 in json_lexer_feed ../qobject/json-lexer.c:350
>     #8 0x557bf3c4793a in qmp_fd_receive ../tests/qtest/libqtest.c:608
>     #9 0x557bf3c47b58 in qtest_qmp_receive ../tests/qtest/libqtest.c:618
>     #10 0x557bf3c44245 in wait_command ../tests/qtest/migration-helpers.c:59
>     #11 0x557bf3c445cb in migrate_query_status ../tests/qtest/migration-helpers.c:108
>     #12 0x557bf3c44642 in check_migration_status ../tests/qtest/migration-helpers.c:124
>     #13 0x557bf3c447e7 in wait_for_migration_status ../tests/qtest/migration-helpers.c:148
>     #14 0x557bf3c43b8f in test_migrate_auto_converge ../tests/qtest/migration-test.c:1243
>     ......
> 
> Fix: 5e34005571af5
> 
> Reported-by: Euler Robot <euler.robot@huawei.com>
> Signed-off-by: Chen Qun <kuhn.chenqun@huawei.com>
> ---
> Cc: Thomas Huth <thuth@redhat.com>
> Cc: Laurent Vivier <lvivier@redhat.com>
> Cc: Maxim Levitsky <mlevitsk@redhat.com>
> Cc: Paolo Bonzini <pbonzini@redhat.com>
> ---
>  tests/qtest/migration-helpers.c | 16 ++++++++++++----
>  1 file changed, 12 insertions(+), 4 deletions(-)
> 
> diff --git a/tests/qtest/migration-helpers.c b/tests/qtest/migration-helpers.c
> index b799dbafb7..4ee26014b7 100644
> --- a/tests/qtest/migration-helpers.c
> +++ b/tests/qtest/migration-helpers.c
> @@ -32,7 +32,7 @@ static void check_stop_event(QTestState *who)
>  QDict *wait_command_fd(QTestState *who, int fd, const char *command, ...)
>  {
>      va_list ap;
> -    QDict *resp;
> +    QDict *resp, *ret;
>  
>      va_start(ap, command);
>      qtest_qmp_vsend_fds(who, &fd, 1, command, ap);
> @@ -44,7 +44,11 @@ QDict *wait_command_fd(QTestState *who, int fd, const char *command, ...)
>      g_assert(!qdict_haskey(resp, "error"));
>      g_assert(qdict_haskey(resp, "return"));
>  
> -    return qdict_get_qdict(resp, "return");
> +    ret = qdict_get_qdict(resp, "return");
> +    qobject_ref(ret);
> +    qobject_unref(resp);
> +
> +    return ret;
>  }
>  
>  /*
> @@ -53,7 +57,7 @@ QDict *wait_command_fd(QTestState *who, int fd, const char *command, ...)
>  QDict *wait_command(QTestState *who, const char *command, ...)
>  {
>      va_list ap;
> -    QDict *resp;
> +    QDict *resp, *ret;
>  
>      va_start(ap, command);
>      resp = qtest_vqmp(who, command, ap);
> @@ -64,7 +68,11 @@ QDict *wait_command(QTestState *who, const char *command, ...)
>      g_assert(!qdict_haskey(resp, "error"));
>      g_assert(qdict_haskey(resp, "return"));
>  
> -    return qdict_get_qdict(resp, "return");
> +    ret = qdict_get_qdict(resp, "return");
> +    qobject_ref(ret);
> +    qobject_unref(resp);
> +
> +    return ret;
>  }
>  
>  /*
This is a funny one. I was thinking that reference counters in qobject should take care of this.
I guess not.

Thanks for fixing it.

Best regards,
	Maxim Levitsky