<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:SimSun;
panose-1:2 1 6 0 3 1 1 1 1 1;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:SimSun;
panose-1:2 1 6 0 3 1 1 1 1 1;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
p.MsoListParagraph, li.MsoListParagraph, div.MsoListParagraph
{mso-style-priority:34;
margin-top:0cm;
margin-right:0cm;
margin-bottom:0cm;
margin-left:36.0pt;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
span.sha
{mso-style-name:sha;}
.MsoChpDefault
{mso-style-type:export-only;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 90.0pt 72.0pt 90.0pt;}
div.WordSection1
{page:WordSection1;}
/* List Definitions */
@list l0
{mso-list-id:474177448;
mso-list-type:hybrid;
mso-list-template-ids:162984778 67698703 67698713 67698715 67698703 67698713 67698715 67698703 67698713 67698715;}
@list l0:level1
{mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;}
@list l0:level2
{mso-level-number-format:alpha-lower;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;}
@list l0:level3
{mso-level-number-format:roman-lower;
mso-level-tab-stop:none;
mso-level-number-position:right;
text-indent:-9.0pt;}
@list l0:level4
{mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;}
@list l0:level5
{mso-level-number-format:alpha-lower;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;}
@list l0:level6
{mso-level-number-format:roman-lower;
mso-level-tab-stop:none;
mso-level-number-position:right;
text-indent:-9.0pt;}
@list l0:level7
{mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;}
@list l0:level8
{mso-level-number-format:alpha-lower;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;}
@list l0:level9
{mso-level-number-format:roman-lower;
mso-level-tab-stop:none;
mso-level-number-position:right;
text-indent:-9.0pt;}
ol
{margin-bottom:0cm;}
ul
{margin-bottom:0cm;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal">Hi all<o:p></o:p></p>
<p class="MsoNormal"> I think there is a memory leak bug in userspace audit, correct me if I’m wrong. Audit-2.8.5 has introduced a performance improvement for lol operations(see the following commits for details:<span class="sha"><span style="font-size:9.0pt;font-family:Consolas;color:#444D56;background:white">3ecf7a212c53e439109163eef79e3bbe4c00dd99,
</span></span><span style="font-size:9.0pt;font-family:Consolas;color:#444D56;background:white">270c39f1f0dd783a32aa0f9a73214cf15e1c19b4</span>). The improvement code snippet is repeated here for your convenience:<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">auparse/auparse.c:<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">260 if (lowest && lowest->status == EBS_COMPLETE) {<o:p></o:p></p>
<p class="MsoNormal">261 lowest->status = EBS_EMPTY;<o:p></o:p></p>
<p class="MsoNormal">262 au->au_ready--;<o:p></o:p></p>
<p class="MsoNormal">263 // Try to consolidate the array so that we iterate<o:p></o:p></p>
<p class="MsoNormal">264 // over a smaller portion next time<o:p></o:p></p>
<p class="MsoNormal">265 if (lowest == &lol->array[lol->maxi]) {<o:p></o:p></p>
<p class="MsoNormal">266 au_lolnode *ptr = lowest;<o:p></o:p></p>
<p class="MsoNormal">267 while (ptr->status == EBS_EMPTY && lol->maxi > 0) {<o:p></o:p></p>
<p class="MsoNormal">268 lol->maxi--;<o:p></o:p></p>
<p class="MsoNormal">269 ptr = &lol->array[lol->maxi];<o:p></o:p></p>
<p class="MsoNormal">270 }<o:p></o:p></p>
<p class="MsoNormal">271 }<o:p></o:p></p>
<p class="MsoNormal">272 return lowest->l;<o:p></o:p></p>
<p class="MsoNormal">273 }<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">The problem is that after shrinking lol-maxi, the EBS_EMPTY lolnodes are effectively denied chances of being freed, as only entries below lol-maxi are freed:<o:p></o:p></p>
<p class="MsoNormal"><o:p></o:p></p>
<p class="MsoNormal">1405 for (i = 0; i <= au->au_lo->maxi; i++) {<o:p></o:p></p>
<p class="MsoNormal">1406 au_lolnode *cur = &au->au_lo->array[i];<o:p></o:p></p>
<p class="MsoNormal">1407 if (cur->status == EBS_EMPTY && cur->l) {<o:p></o:p></p>
<p class="MsoNormal">1408 #ifdef LOL_EVENTS_DEBUG01<o:p></o:p></p>
<p class="MsoNormal">1409 if (debug) {printf("Freeing at start "); print_list_t(cur->l);}<o:p></o:p></p>
<p class="MsoNormal">1410 #endif /* LOL_EVENTS_DEBUG01 */<o:p></o:p></p>
<p class="MsoNormal">1411 aup_list_clear(cur->l);<o:p></o:p></p>
<p class="MsoNormal">1412 free(cur->l);<o:p></o:p></p>
<p class="MsoNormal">1413 au->le = NULL; // this should crash any usage<o:p></o:p></p>
<p class="MsoNormal">1414 // of au->le until reset<o:p></o:p></p>
<p class="MsoNormal">1415 cur->l = NULL;<o:p></o:p></p>
<p class="MsoNormal">1416 }<o:p></o:p></p>
<p class="MsoNormal">1417 }<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">The problem is further confirmed when later insertions can make the cut out entries completely lost to the wild, since it doesn’t check cur->l:<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">199 for (i = 0; i < lol->limit; i++) {<o:p></o:p></p>
<p class="MsoNormal">200 au_lolnode *cur = &lol->array[i];<o:p></o:p></p>
<p class="MsoNormal">201 if (cur->status == EBS_EMPTY) {<o:p></o:p></p>
<p class="MsoNormal">202 cur->l = l;<o:p></o:p></p>
<p class="MsoNormal">203 cur->status = EBS_BUILDING;<o:p></o:p></p>
<p class="MsoNormal">204 if (i > lol->maxi)<o:p></o:p></p>
<p class="MsoNormal">205 lol->maxi = i;<o:p></o:p></p>
<p class="MsoNormal">206 return cur;<o:p></o:p></p>
<p class="MsoNormal">207 }<o:p></o:p></p>
<p class="MsoNormal">208 }<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">---------------------------------------------Some blackbox tests on sedispatch:-------------------------------------------------------<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Valgrind check reports memory leak problem:<o:p></o:p></p>
<p class="MsoNormal">==30536== LEAK SUMMARY:<o:p></o:p></p>
<p class="MsoNormal">==30536== definitely lost: 14,848 bytes in 232 blocks<o:p></o:p></p>
<p class="MsoNormal">==30536== indirectly lost: 781,160 bytes in 29,837 blocks<o:p></o:p></p>
<p class="MsoNormal">==30536== possibly lost: 0 bytes in 0 blocks<o:p></o:p></p>
<p class="MsoNormal">==30536== still reachable: 11,851 bytes in 81 blocks<o:p></o:p></p>
<p class="MsoNormal">==30536== suppressed: 0 bytes in 0 blocks<o:p></o:p></p>
<p class="MsoNormal">==30536== Reachable blocks (those to which a pointer was found) are not shown<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">And a dummy test program generating floods of AVC events can blow the sedispatch daemon to some hundreds of megabytes after running for several days.<o:p></o:p></p>
</div>
</body>
</html>