Memoy Leaks in RPM; Version, rpm-4.6.0

Wed May 13 06:53:43 UTC 2009

On Mon, 11 May 2009, Creative Innovative wrote:

> Hi Folks,
>  
> I am using a C utility that uses RPM to install packages.
>  
> RPM Version:: rpm-4.6.0
>  
> When I run the C program with Valgrind. I get a bunch of memory leaks.
>  
> Can someone let me know,if some of them are know or will it get fixed.

In general, the "still reachable" reports of valgrind aren't that 
interesting with rpm:
- For many things you need to call shutdown routines to free memory if
   you care.
- For many things rpm does deliberate one-shot allocation of "static"
   data such as data structures around tag table, that it doesn't bother
   freeing on exit.

Reports on other leaks are, of course, most welcome.

> ==13315== 72 bytes in 1 blocks are definitely lost in loss record 19 of
> 54
> ==13315==    at 0x4028122: calloc (vg_replace_malloc.c:397)
> ==13315==    by 0x45E1E8F: PR_Calloc (in /lib/libnspr4.so)
> ==13315==    by 0x42A1356: (within /lib/libnss3.so)
> ==13315==    by 0x42A13A0: (within /lib/libnss3.so)
> ==13315==    by 0x42A12B3: (within /lib/libnss3.so)
> ==13315==    by 0x4297F7A: (within /lib/libnss3.so)
> ==13315==    by 0x429C8C3: (within /lib/libnss3.so)
> ==13315==    by 0x425E265: (within /lib/libnss3.so)
> ==13315==    by 0x425E563: NSS_NoDB_Init (in /lib/libnss3.so)
> ==13315==    by 0x40B7BFE: rpmInitCrypto (in /usr/lib/librpmio-4.6.so)
> ==13315==    by 0x40768D9: rpmtsCreate (in /usr/lib/librpm-4.6.so)
> ==13315==    by 0x804B3A3: executeTransactionUsingRpm (rpmutform.c:1698)

You need to call rpmFreeCrypto() to shut down NSS before exit if you want 
to get rid of this one.

> ==13315== 5 bytes in 1 blocks are still reachable in loss record 1 of 54
> ==13315==    at 0x402A06E: malloc (vg_replace_malloc.c:207)
> ==13315==    by 0x4074380: (within /usr/lib/librpm-4.6.so)
> ==13315==    by 0x4074F0D: rpmReadConfigFiles (in /usr/lib/librpm-4.6.so)
> ==13315==    by 0x804B341: executeTransactionUsingRpm (rpmutform.c:1682)
> ==13315==    by 0x80493DB: main (callRpmUtil.c:16)
> ==13315==
> ==13315==
> ==13315== 6 bytes in 1 blocks are still reachable in loss record 2 of 54
> ==13315==    at 0x402A06E: malloc (vg_replace_malloc.c:207)
> ==13315==    by 0x40743F3: (within /usr/lib/librpm-4.6.so)
> ==13315==    by 0x4074F8E: rpmReadConfigFiles (in /usr/lib/librpm-4.6.so)
> ==13315==    by 0x804B341: executeTransactionUsingRpm (rpmutform.c:1682)
> ==13315==    by 0x80493DB: main (callRpmUtil.c:16)

Call rpmFreeRpmrc() before exit.

> ==13315==
> ==13315==
> ==13315== 12 bytes in 8 blocks are still reachable in loss record 3 of 54
> ==13315==    at 0x402A06E: malloc (vg_replace_malloc.c:207)
> ==13315==    by 0x40B06F0: addMacro (in /usr/lib/librpmio-4.6.so)
> ==13315==    by 0x40B1E59: (within /usr/lib/librpmio-4.6.so)
> ==13315==    by 0x40B1ED8: rpmDefineMacro (in /usr/lib/librpmio-4.6.so)
> ==13315==    by 0x40B1FA1: rpmLoadMacroFile (in /usr/lib/librpmio-4.6.so)
> ==13315==    by 0x40B21E2: rpmInitMacros (in /usr/lib/librpmio-4.6.so)
> ==13315==    by 0x4074F4A: rpmReadConfigFiles (in /usr/lib/librpm-4.6.so)
> ==13315==    by 0x804B341: executeTransactionUsingRpm (rpmutform.c:1682)
> ==13315==    by 0x80493DB: main (callRpmUtil.c:16)

Call rpmFreeMacros() before exit.

> ==13315==
> ==13315== 16 bytes in 2 blocks are still reachable in loss record 4 of 54
> ==13315==    at 0x402A06E: malloc (vg_replace_malloc.c:207)
> ==13315==    by 0x4072382: (within /usr/lib/librpm-4.6.so)
> ==13315==    by 0x407257B: (within /usr/lib/librpm-4.6.so)
> ==13315==    by 0x40744B9: rpmSetTables (in /usr/lib/librpm-4.6.so)
> ==13315==    by 0x40747BF: (within /usr/lib/librpm-4.6.so)
> ==13315==    by 0x4074F5E: rpmReadConfigFiles (in /usr/lib/librpm-4.6.so)
> ==13315==    by 0x804B341: executeTransactionUsingRpm (rpmutform.c:1682)
> ==13315==    by 0x80493DB: main (callRpmUtil.c:16)

This is again rpmrc stuff, see above.

> ==13315== 22 bytes in 1 blocks are still reachable in loss record 6 of 54
> ==13315==    at 0x402A06E: malloc (vg_replace_malloc.c:207)
> ==13315==    by 0x407E592: rpmtsAcquireLock (in /usr/lib/librpm-4.6.so)
> ==13315==    by 0x407B54B: rpmtsRun (in /usr/lib/librpm-4.6.so)
> ==13315==    by 0x804AE32: invokeRpmToRunTrans (rpmutform.c:1475)
> ==13315==    by 0x804B73B: executeTransactionUsingRpm (rpmutform.c:1812)
> ==13315==    by 0x80493DB: main (callRpmUtil.c:16)

This is deliberate one-shot initialization (and alloc).

> ==13315==
> ==13315==
> ==13315== 24 bytes in 1 blocks are still reachable in loss record 7 of 54
> ==13315==    at 0x402A06E: malloc (vg_replace_malloc.c:207)
> ==13315==    by 0x40B6119: (within /usr/lib/librpmio-4.6.so)
> ==13315==    by 0x40B62A1: rpmlog (in /usr/lib/librpmio-4.6.so)
> ==13315==    by 0x406126C: rpmReadPackageFile (in /usr/lib/librpm-4.6.so)
> ==13315==    by 0x8049AC1: addInstallPkgToRpmTs (rpmutform.c:369)
> ==13315==    by 0x8049D93: addPkgForInstall (rpmutform.c:463)
> ==13315==    by 0x804A10B: processTransList (rpmutform.c:630)
> ==13315==    by 0x804B638: executeTransactionUsingRpm (rpmutform.c:1776)
> ==13315==    by 0x80493DB: main (callRpmUtil.c:16)

Call rpmlogClose() before exit.

> ==13315== 24 bytes in 1 blocks are still reachable in loss record 9 of 54
> ==13315==    at 0x4028122: calloc (vg_replace_malloc.c:397)
> ==13315==    by 0x40B6B76: rpmluaNew (in /usr/lib/librpmio-4.6.so)
> ==13315==    by 0x40B72CA: rpmluaGetPrintBuffer (in
> /usr/lib/librpmio-4.6.so)
> ==13315==    by 0x4074FA6: rpmReadConfigFiles (in /usr/lib/librpm-4.6.so)
> ==13315==    by 0x804B341: executeTransactionUsingRpm (rpmutform.c:1682)
> ==13315==    by 0x80493DB: main (callRpmUtil.c:16)

Another one-shot initialization, but rpm >= 4.7.0 the lua subsystem is 
shutdown too, eliminating this.

> ==13315== 32 bytes in 1 blocks are still reachable in loss record 12 of
> 54
> ==13315==    at 0x4028122: calloc (vg_replace_malloc.c:397)
> ==13315==    by 0x40593A5: (within /usr/lib/librpm-4.6.so)
> ==13315==    by 0x405941E: rpmGetFilesystemList (in
> /usr/lib/librpm-4.6.so)
> ==13315==    by 0x4077B57: rpmtsInitDSI (in /usr/lib/librpm-4.6.so)
> ==13315==    by 0x407B714: rpmtsRun (in /usr/lib/librpm-4.6.so)
> ==13315==    by 0x804AE32: invokeRpmToRunTrans (rpmutform.c:1475)
> ==13315==    by 0x804B6A8: executeTransactionUsingRpm (rpmutform.c:1793)
> ==13315==    by 0x80493DB: main (callRpmUtil.c:16)

Call rpmFreeFileSystems() before exit.

> ==13315== 42 bytes in 1 blocks are still reachable in loss record 14 of
> 54
> ==13315==    at 0x402A06E: malloc (vg_replace_malloc.c:207)
> ==13315==    by 0x406A8A9: rpmdsNewDNEVR (in /usr/lib/librpm-4.6.so)
> ==13315==    by 0x406A9F2: rpmdsNext (in /usr/lib/librpm-4.6.so)
> ==13315==    by 0x406ABD1: rpmdsSearch (in /usr/lib/librpm-4.6.so)
> ==13315==    by 0x4056184: (within /usr/lib/librpm-4.6.so)
> ==13315==    by 0x405654F: (within /usr/lib/librpm-4.6.so)
> ==13315==    by 0x40568AA: rpmtsCheck (in /usr/lib/librpm-4.6.so)
> ==13315==    by 0x804ACE6: invokeRpmToRunTrans (rpmutform.c:1422)
> ==13315==    by 0x804B6A8: executeTransactionUsingRpm (rpmutform.c:1793)
> ==13315==    by 0x80493DB: main (callRpmUtil.c:16)
> ==13315==
> ==13315==
> ==13315== 48 bytes in 1 blocks are still reachable in loss record 15 of
> 54
> ==13315==    at 0x402A06E: malloc (vg_replace_malloc.c:207)
> ==13315==    by 0x406AFE9: rpmdsMerge (in /usr/lib/librpm-4.6.so)
> ==13315==    by 0x406B76F: rpmdsRpmlib (in /usr/lib/librpm-4.6.so)
> ==13315==    by 0x4056162: (within /usr/lib/librpm-4.6.so)
> ==13315==    by 0x405654F: (within /usr/lib/librpm-4.6.so)
> ==13315==    by 0x40568AA: rpmtsCheck (in /usr/lib/librpm-4.6.so)
> ==13315==    by 0x804ACE6: invokeRpmToRunTrans (rpmutform.c:1422)
> ==13315==    by 0x804B6A8: executeTransactionUsingRpm (rpmutform.c:1793)
> ==13315==    by 0x80493DB: main (callRpmUtil.c:16)

This is from rpmlib() dependency set which is another one-shot 
initialization, freeing it is more fuss than worth.

[...bunch of dupes snipped...]

> ==13315== 1,256 bytes in 2 blocks are still reachable in loss record 43
> of 54
> ==13315==    at 0x4028122: calloc (vg_replace_malloc.c:397)
> ==13315==    by 0x405239F: (within /usr/lib/librpm-4.6.so)
> ==13315==    by 0x4052839: (within /usr/lib/librpm-4.6.so)
> ==13315==    by 0x4052344: rpmTagGetValue (in /usr/lib/librpm-4.6.so)
> ==13315==    by 0x404C51A: (within /usr/lib/librpm-4.6.so)
> ==13315==    by 0x404DBBE: (within /usr/lib/librpm-4.6.so)
> ==13315==    by 0x404DEFB: rpmdbOpen (in /usr/lib/librpm-4.6.so)
> ==13315==    by 0x40771AF: rpmtsOpenDB (in /usr/lib/librpm-4.6.so)
> ==13315==    by 0x407724A: rpmtsInitIterator (in /usr/lib/librpm-4.6.so)
> ==13315==    by 0x4077573: (within /usr/lib/librpm-4.6.so)
> ==13315==    by 0x4077710: rpmtsGetKeyring (in /usr/lib/librpm-4.6.so)
> ==13315==    by 0x40610FE: rpmReadPackageFile (in /usr/lib/librpm-4.6.so)
> ==13315==

This is rpm tag table stuff, another "static" item using one-shot 
allocation.

>  
> ==13315== 21,792 bytes in 506 blocks are still reachable in loss record
> 53 of 54
> ==13315==    at 0x402A06E: malloc (vg_replace_malloc.c:207)
> ==13315==    by 0x402A1EF: realloc (vg_replace_malloc.c:429)
> ==13315==    by 0x405F853: (within /usr/lib/librpm-4.6.so)
> ==13315==    by 0x405B425: (within /usr/lib/librpm-4.6.so)
> ==13315==    by 0x405AAF1: (within /usr/lib/librpm-4.6.so)
> ==13315==    by 0x405EFF2: fsmSetup (in /usr/lib/librpm-4.6.so)
> ==13315==    by 0x4063872: (within /usr/lib/librpm-4.6.so)
> ==13315==    by 0x4064B0B: (within /usr/lib/librpm-4.6.so)
> ==13315==    by 0x4064311: (within /usr/lib/librpm-4.6.so)
> ==13315==    by 0x407D5A3: rpmtsRun (in /usr/lib/librpm-4.6.so)
> ==13315==    by 0x804AE32: invokeRpmToRunTrans (rpmutform.c:1475)
> ==13315==    by 0x804B73B: executeTransactionUsingRpm (rpmutform.c:1812)

Hard to say for sure as there are no debugging symbols for librpm. Could 
be SELinux related (maybe rpm 4.6.0 isn't shutting down selinux properly, 
don't remember for sure).

Mind you there certainly are leaks in 4.6.0 (on various rarely used error 
paths typically), known ones are fixed in 4.7.0 and 4.6.x branch in git 
already.

 	- Panu -