git: dc876a5bcd46 - stable/12 - libnv: fix memory leaks

[Mariusz Zaborski]

The branch stable/12 has been updated by oshogbo:

URL: https://cgit.FreeBSD.org/src/commit/?id=dc876a5bcd46b486103c9127f51e01663504195b

commit dc876a5bcd46b486103c9127f51e01663504195b
Author:     Mariusz Zaborski <oshogbo at FreeBSD.org>
AuthorDate: 2019-02-10 23:28:55 +0000
Commit:     Mariusz Zaborski <oshogbo at FreeBSD.org>
CommitDate: 2021-07-06 17:58:08 +0000

    libnv: fix memory leaks
    
    nvpair_create_stringv: free the temporary string; this fix affects
    nvlist_add_stringf() and nvlist_add_stringv().
    
    nvpair_remove_nvlist_array (NV_TYPE_NVLIST_ARRAY case): free the chain
    of nvpairs (as resetting it prevents nvlist_destroy() from freeing it).
    Note: freeing the chain in nvlist_destroy() is not sufficient, because
    it would still leak through nvlist_take_nvlist_array().  This affects
    all nvlist_*_nvlist_array() use
    
    Submitted by:   Mindaugas Rasiukevicius <rmind at netbsd.org>
    Reported by:    clang/gcc ASAN
    MFC after:      2 weeks
    
    (cherry picked from commit b5d787d93b3d83f28e87e1f8cc740cb160f8f0ac)
---
 lib/libnv/tests/nvlist_send_recv_test.c |  2 ++
 sys/contrib/libnv/nv_impl.h             |  1 +
 sys/contrib/libnv/nvlist.c              |  9 +++++++++
 sys/contrib/libnv/nvpair.c              | 15 +++++++++++----
 4 files changed, 23 insertions(+), 4 deletions(-)

diff --git a/lib/libnv/tests/nvlist_send_recv_test.c b/lib/libnv/tests/nvlist_send_recv_test.c
index 1b673b5d4259..fbc918102b50 100644
--- a/lib/libnv/tests/nvlist_send_recv_test.c
+++ b/lib/libnv/tests/nvlist_send_recv_test.c
@@ -304,6 +304,8 @@ parent(int sock)
 
 	name = nvlist_next(nvl, &type, &cookie);
 	CHECK(name == NULL);
+
+	nvlist_destroy(nvl);
 }
 
 static void
diff --git a/sys/contrib/libnv/nv_impl.h b/sys/contrib/libnv/nv_impl.h
index a67cc2ca0883..1875c739beee 100644
--- a/sys/contrib/libnv/nv_impl.h
+++ b/sys/contrib/libnv/nv_impl.h
@@ -103,6 +103,7 @@ bool nvlist_move_nvpair(nvlist_t *nvl, nvpair_t *nvp);
 
 void nvlist_set_parent(nvlist_t *nvl, nvpair_t *parent);
 void nvlist_set_array_next(nvlist_t *nvl, nvpair_t *ele);
+nvpair_t *nvlist_get_array_next_nvpair(nvlist_t *nvl);
 
 const nvpair_t *nvlist_get_nvpair(const nvlist_t *nvl, const char *name);
 
diff --git a/sys/contrib/libnv/nvlist.c b/sys/contrib/libnv/nvlist.c
index 69b32a62a4cc..311325d822ce 100644
--- a/sys/contrib/libnv/nvlist.c
+++ b/sys/contrib/libnv/nvlist.c
@@ -247,6 +247,15 @@ nvlist_set_array_next(nvlist_t *nvl, nvpair_t *ele)
 	nvl->nvl_array_next = ele;
 }
 
+nvpair_t *
+nvlist_get_array_next_nvpair(nvlist_t *nvl)
+{
+
+	NVLIST_ASSERT(nvl);
+
+	return (nvl->nvl_array_next);
+}
+
 bool
 nvlist_in_array(const nvlist_t *nvl)
 {
diff --git a/sys/contrib/libnv/nvpair.c b/sys/contrib/libnv/nvpair.c
index ed01da2c5040..b767b9bbf972 100644
--- a/sys/contrib/libnv/nvpair.c
+++ b/sys/contrib/libnv/nvpair.c
@@ -229,8 +229,16 @@ nvpair_remove_nvlist_array(nvpair_t *nvp)
 	nvlarray = __DECONST(nvlist_t **,
 	    nvpair_get_nvlist_array(nvp, &count));
 	for (i = 0; i < count; i++) {
-		nvlist_set_array_next(nvlarray[i], NULL);
-		nvlist_set_parent(nvlarray[i], NULL);
+		nvlist_t *nvl;
+		nvpair_t *nnvp;
+
+		nvl = nvlarray[i];
+		nnvp = nvlist_get_array_next_nvpair(nvl);
+		if (nnvp != NULL) {
+			nvpair_free_structure(nnvp);
+		}
+		nvlist_set_array_next(nvl, NULL);
+		nvlist_set_parent(nvl, NULL);
 	}
 }
 
@@ -1194,8 +1202,7 @@ nvpair_create_stringv(const char *name, const char *valuefmt, va_list valueap)
 	if (len < 0)
 		return (NULL);
 	nvp = nvpair_create_string(name, str);
-	if (nvp == NULL)
-		nv_free(str);
+	nv_free(str);
 	return (nvp);
 }