libnl-genl-3.0 memory leak

[Sylvain Trinquet]

It seems that there is a memory leak in the libnl-genl-3.0 library.
The memory-leak can be seen when the function genl_ctrl_resolve() fails.

It seems that this function copy a buffer and forget to deallocate it properly:
  258 cb = nl_cb_clone(orig); // buffer copied not freed

-----------------------------------------------------------------------------
The following attached source-code can help you to reproduce this behavior on Ubuntu 14.04.
It forces an issue on the genl_ctrl_resolve by asking an unknown netlink-family.

To compile program:
g++ -std=c++11 main.cpp $(pkg-config --cflags --libs libnl-3.0 libnl-genl-3.0) -o main

To detect memory-leak using Valgrind:
valgrind --leak-check=full ./main

-----------------------------------------------------------------------------
Executing it on Debian 8.0 shows "no memory leak":
sylvain@debian:~/test$ lsb_release -rd
Description: Debian GNU/Linux 8.8 (jessie)
Release: 8.8

sylvain@debian:~/test$ g++ -std=c++11 main.cpp $(pkg-config --cflags --libs libnl-3.0 libnl-genl-3.0) -o main
sylvain@debian:~/test$ valgrind --leak-check=full ./main
==26390== Memcheck, a memory error detector
==26390== Copyright (C) 2002-2013, and GNU GPL'd, by Julian Seward et al.
==26390== Using Valgrind-3.10.0 and LibVEX; rerun with -h for copyright info
==26390== Command: ./main
==26390==
start test
error: can't retrieve the netlink-family id
end test
==26390==
==26390== HEAP SUMMARY:
==26390== in use at exit: 0 bytes in 0 blocks
==26390== total heap usage: 13 allocs, 13 frees, 22,142 bytes allocated
==26390==
==26390== All heap blocks were freed -- no leaks are possible
==26390==
==26390== For counts of detected and suppressed errors, rerun with: -v
==26390== ERROR SUMMARY: 0 errors from 0 contexts (suppressed: 0 from 0)

-----------------------------------------------------------------------------
Executing it on Ubuntu 14.04 shows a memory leak:
ubuntu@ubuntu:~$ lsb_release -rd
Description: Ubuntu 14.04.5 LTS
Release: 14.04

ubuntu@ubuntu:~$ g++ -std=c++11 main.cpp $(pkg-config --cflags --libs libnl-3.0 libnl-genl-3.0) -o main
ubuntu@ubuntu:~$ valgrind --leak-check=full ./main
==37377== Memcheck, a memory error detector
==37377== Copyright (C) 2002-2013, and GNU GPL'd, by Julian Seward et al.
==37377== Using Valgrind-3.10.1 and LibVEX; rerun with -h for copyright info
==37377== Command: ./main
==37377==
start test
error: can't retrieve the netlink-family id
end test
==37377==
==37377== HEAP SUMMARY:
==37377== in use at exit: 224 bytes in 1 blocks
==37377== total heap usage: 13 allocs, 12 frees, 22,142 bytes allocated
==37377==
==37377== 224 bytes in 1 blocks are definitely lost in loss record 1 of 1
==37377== at 0x4C2CC70: calloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==37377== by 0x5048FAA: nl_cb_alloc (in /lib/x86_64-linux-gnu/libnl-3.so.200.16.1)
==37377== by 0x504CB1E: nl_socket_alloc (in /lib/x86_64-linux-gnu/libnl-3.so.200.16.1)
==37377== by 0x4012E3: A::Init() (in /home/ubuntu/main)
==37377== by 0x401189: main (in /home/ubuntu/main)
==37377==
==37377== LEAK SUMMARY:
==37377== definitely lost: 224 bytes in 1 blocks
==37377== indirectly lost: 0 bytes in 0 blocks
==37377== possibly lost: 0 bytes in 0 blocks
==37377== still reachable: 0 bytes in 0 blocks
==37377== suppressed: 0 bytes in 0 blocks
==37377==
==37377== For counts of detected and suppressed errors, rerun with: -v
==37377== ERROR SUMMARY: 1 errors from 1 contexts (suppressed: 0 from 0)

Thanks,
Sylvain Trinquet

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Joshua Powers (powersj)]

Thank you for taking the time to report this bug and helping to make Ubuntu
better. I appreciate the quality of this bug report and I'm sure it will be
helpful to others experiencing the same issue.

This sounds like an upstream bug to me. The best route to getting it fixed
in Ubuntu in this case would be to file an bug with the upstream project.
Otherwise, I am not sure what we can do directly in Ubuntu to fix the
problem.

If you do end up filing an upstream bug, please link to it from here. Thanks!

[Joshua Powers (powersj)]

I believe this is the upstream project:
https://github.com/tgraf/libnl

[Filofel (filofel)]

Joshua,

Since this is apparently fixed in Debian 8.0, couldn't it have been fixed
already upstream?
In which case, the problem would rather be updating the Ubuntu LTS version
(or backporting the fix)?

On Wed, May 17, 2017 at 11:56 PM, Joshua Powers <email address hidden>
wrote:

> I believe this is the upstream project:
> https://github.com/tgraf/libnl
>
> ** Tags added: bitesize needs-upstream-report
>
> --
> You received this bug notification because you are subscribed to the bug
> report.
> https://bugs.launchpad.net/bugs/1690836
>
> Title:
> libnl-genl-3.0 memory leak
>
> To manage notifications about this bug go to:
> https://bugs.launchpad.net/ubuntu/+source/libnl3/+bug/
> 1690836/+subscriptions
>

[Joshua Powers (powersj)]

@filofel, my bad yes you are right. This seems fixed in later versions and as such this requires an SRU.

Next step would be to determine what changes would be required to fix.

Trusty-updates has version 3.2.21-1ubuntu4
Debian stable (jessie) has version 3.2.24-2

[Joshua Powers (powersj)]

We also need to confirm that this is fixed in Artful. Given it is fixed in Debian stable it probably is, but confirming that it is fixed in the latest development release will be required for the SRU.

[Christian Ehrhardt  (paelzer)]

Artful

# valgrind --leak-check=full ./main
==1839== Memcheck, a memory error detector
==1839== Copyright (C) 2002-2017, and GNU GPL'd, by Julian Seward et al.
==1839== Using Valgrind-3.13.0 and LibVEX; rerun with -h for copyright info
==1839== Command: ./main
==1839==
start test
error: can't retrieve the netlink-family id
end test
==1839==
==1839== HEAP SUMMARY:
==1839== in use at exit: 0 bytes in 0 blocks
==1839== total heap usage: 17 allocs, 17 frees, 96,875 bytes allocated
==1839==
==1839== All heap blocks were freed -- no leaks are possible
==1839==
==1839== For counts of detected and suppressed errors, rerun with: -v
==1839== ERROR SUMMARY: 0 errors from 0 contexts (suppressed: 0 from 0)

[Christian Ehrhardt  (paelzer)]

Xenial seems affected

# valgrind --leak-check=full ./main
==1859== Memcheck, a memory error detector
==1859== Copyright (C) 2002-2015, and GNU GPL'd, by Julian Seward et al.
==1859== Using Valgrind-3.11.0 and LibVEX; rerun with -h for copyright info
==1859== Command: ./main
==1859==
start test
error: can't retrieve the netlink-family id
end test
==1859==
==1859== HEAP SUMMARY:
==1859== in use at exit: 72,704 bytes in 1 blocks
==1859== total heap usage: 17 allocs, 16 frees, 96,875 bytes allocated
==1859==
==1859== LEAK SUMMARY:
==1859== definitely lost: 0 bytes in 0 blocks
==1859== indirectly lost: 0 bytes in 0 blocks
==1859== possibly lost: 0 bytes in 0 blocks
==1859== still reachable: 72,704 bytes in 1 blocks
==1859== suppressed: 0 bytes in 0 blocks
==1859== Reachable blocks (those to which a pointer was found) are not shown.
==1859== To see them, rerun with: --leak-check=full --show-leak-kinds=all
==1859==
==1859== For counts of detected and suppressed errors, rerun with: -v
==1859== ERROR SUMMARY: 0 errors from 0 contexts (suppressed: 0 from 0)

[Christian Ehrhardt  (paelzer)]

X: 3.2.27-1ubuntu0.16.04.1
A: 3.2.29-0ubuntu3

https://github.com/thom311/libnl looks more up to date than the repo suggested before.

Checking the log in between it is not ovbious what it is, also the leak seemed to have changed between trusty and xenial (maybe old fixed and new added).

[Christian Ehrhardt  (paelzer)]

Needs debugging what the actual change is that could be considered for backporting.

[Bryce Harrington (bryce)]

Xenial and trusty have reached end of standard support