1021335 - leaks in sctp_add_to_readq detected by LSAN

Status: RESOLVED FIXED

(Core :: WebRTC: Networking, defect)

Description

[Andrew McCreight [:mccr8]]

Attachment: SCTP allocation leak stacks

There's a few kb of these.

Randell, there's a bunch of leaks reported by Coverity for this SCTP code, so that's probably a good place to start trying to fix these, as that will be easier to turn into a fix than a few random LSAN stacks.

Comment 1

[Randell Jesup [:jesup] (needinfo me)]

Upstream bug I imagine...

Comment 2

[Michael Tüxen]

All "leaks" reported go through the same code path. The SCTP allocates memory which is given to its upper layer via the recv_callback. This memory is expected to be freed by the upper layer in the callback (or later outside). By looking at DataChannel.cc: Where are you freeing the buffer you got? At least not in the receive callback...

Best regards
Michael

Comment 3

[Randell Jesup [:jesup] (needinfo me)]

That would make it my bug; taking

Comment 4

[Randell Jesup [:jesup] (needinfo me)]

Attachment: Fix DataChannel leak of recv buffers from SCTP

tested under ASAN with no problems

Comment 5

[Randell Jesup [:jesup] (needinfo me)]

Comment on attachment 8436341 [details] [diff] [review]
Fix DataChannel leak of recv buffers from SCTP

Given the comment from Michael Tuexen (library author), I just need a sanity check review on this.  Tested under ASAN.

LSAN rocks

Comment 6

[Michael Tüxen]

Comment on attachment 8436341 [details] [diff] [review]
Fix DataChannel leak of recv buffers from SCTP

Review of attachment 8436341 [details] [diff] [review]:
-----------------------------------------------------------------

Looks good to me.

Comment 7

[Randell Jesup [:jesup] (needinfo me)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/1159503d1f38

Comment 8

[Randell Jesup [:jesup] (needinfo me)]

Comment on attachment 8436341 [details] [diff] [review]
Fix DataChannel leak of recv buffers from SCTP

[Approval Request Comment]  (For 31 Aurora or Beta)
Bug caused by (feature/regressing bug #): N/A

User impact if declined: major leak using DataChannels

Testing completed (on m-c, etc.): On inbound, run datachannel tests locally under ASAN, review by library author

Risk to taking this patch (and alternatives if risky): low.  ASAN would have shown any problems.  Simple mis-use of API; API memory use wasn't documented or I missed it.

String or IDL/UUID changes made by this patch: none

Comment 9

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/1159503d1f38

Comment 10

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-aurora/rev/755bb8c926b6