From 4ef32018380133ce3d7130cb388d1aac5c30cd06 Mon Sep 17 00:00:00 2001 From: Wang Shilong Date: Thu, 12 Mar 2026 09:09:06 +0800 Subject: [PATCH 1/2] DAOS-18681 rebuild: fix potential memory leaks in error paths Fix potential memory leaks in error cases in rebuild and IV path. Also Fixed a memmory allocation check typo to avoid potential crash Removed stale comments Signed-off-by: Wang Shilong --- src/cart/crt_iv.c | 10 +++++++--- src/object/srv_obj_migrate.c | 10 ++++------ src/rebuild/scan.c | 2 +- src/rebuild/srv.c | 10 ++++++---- 4 files changed, 18 insertions(+), 14 deletions(-) diff --git a/src/cart/crt_iv.c b/src/cart/crt_iv.c index 9913686e5f1..f993630cc27 100644 --- a/src/cart/crt_iv.c +++ b/src/cart/crt_iv.c @@ -1,6 +1,6 @@ /* * (C) Copyright 2016-2024 Intel Corporation. - * (C) Copyright 2025 Hewlett Packard Enterprise Development LP + * (C) Copyright 2025-2026 Hewlett Packard Enterprise Development LP * * SPDX-License-Identifier: BSD-2-Clause-Patent */ @@ -1136,7 +1136,7 @@ crt_ivf_rpc_issue(d_rank_t dest_node, crt_iv_key_t *iv_key, struct crt_iv_fetch_in *input; crt_bulk_t local_bulk = CRT_BULK_NULL; crt_endpoint_t ep = {0}; - crt_rpc_t *rpc; + crt_rpc_t *rpc = NULL; struct ivf_key_in_progress *entry; int rc = 0; struct crt_iv_ops *iv_ops; @@ -1266,6 +1266,8 @@ crt_ivf_rpc_issue(d_rank_t dest_node, crt_iv_key_t *iv_key, D_MUTEX_UNLOCK(&ivns_internal->cii_lock); if (local_bulk != CRT_BULK_NULL) crt_bulk_free(local_bulk); + if (rpc != NULL) + RPC_PUB_DECREF(rpc); } return rc; } @@ -2611,7 +2613,7 @@ crt_ivu_rpc_issue(d_rank_t dest_rank, crt_iv_key_t *iv_key, struct crt_iv_update_in *input; crt_bulk_t local_bulk = CRT_BULK_NULL; crt_endpoint_t ep = {0}; - crt_rpc_t *rpc; + crt_rpc_t *rpc = NULL; int rc = 0; uint32_t local_grp_ver; @@ -2693,6 +2695,8 @@ crt_ivu_rpc_issue(d_rank_t dest_rank, crt_iv_key_t *iv_key, if (rc != 0) { if (local_bulk != CRT_BULK_NULL) crt_bulk_free(local_bulk); + if (rpc != NULL) + RPC_PUB_DECREF(rpc); } return rc; } diff --git a/src/object/srv_obj_migrate.c b/src/object/srv_obj_migrate.c index 2ccda79e4c2..169f8658790 100644 --- a/src/object/srv_obj_migrate.c +++ b/src/object/srv_obj_migrate.c @@ -953,11 +953,11 @@ migrate_fetch_update_inline(struct migrate_one *mrone, daos_handle_t oh, VOS_OF_REBUILD, &mrone->mo_dkey, iod_cnt, &mrone->mo_iods[start], iod_csums, &sgls[start]); + daos_csummer_free_ic(csummer, &iod_csums); if (rc) { DL_ERROR(rc, DF_RB ": migrate failed", DP_RB_MRO(mrone)); D_GOTO(out, rc); } - daos_csummer_free_ic(csummer, &iod_csums); } out: @@ -4325,8 +4325,10 @@ migrate_check_one(void *data) migrate_pool_tls_get(tls); tls->mpt_post_process_started = 1; D_ALLOC_PTR(ult_arg); - if (ult_arg == NULL) + if (ult_arg == NULL) { + migrate_pool_tls_put(tls); D_GOTO(out, rc = -DER_NOMEM); + } ult_arg->rpa_tls = tls; ult_arg->rpa_migrated_root = &tls->mpt_migrated_root; @@ -4464,10 +4466,6 @@ ds_object_migrate_send(struct ds_pool *pool, uuid_t pool_hdl_uuid, uuid_t cont_h return -DER_NONEXIST; } - /* NB: let's send object list to 0 xstream to simplify the migrate - * object handling process for now, for example avoid lock to insert - * objects in the object tree. - */ tgt_ep.ep_rank = target->ta_comp.co_rank; index = target->ta_comp.co_index; ABT_rwlock_unlock(pool->sp_lock); diff --git a/src/rebuild/scan.c b/src/rebuild/scan.c index 61f8d86680c..a070819916d 100644 --- a/src/rebuild/scan.c +++ b/src/rebuild/scan.c @@ -291,7 +291,7 @@ rebuild_objects_send_ult(void *data) D_GOTO(out, rc = -DER_NOMEM); D_ALLOC_ARRAY(punched_ephs, REBUILD_SEND_LIMIT); - if (ephs == NULL) + if (punched_ephs == NULL) D_GOTO(out, rc = -DER_NOMEM); arg.count = 0; diff --git a/src/rebuild/srv.c b/src/rebuild/srv.c index 91185bb5cc3..dad28cfbdb8 100644 --- a/src/rebuild/srv.c +++ b/src/rebuild/srv.c @@ -1417,12 +1417,14 @@ rebuild_scan_broadcast(struct ds_pool *pool, struct rebuild_global_pool_tracker crt_group_rank(pool->sp_group, &rsi->rsi_master_rank); rc = dss_rpc_send(rpc); - rso = crt_reply_get(rpc); - if (rc == 0) - rc = rso->rso_status; - else + if (rc != 0) { DL_ERROR(rc, DF_RB " scan broadcast send failed.", DP_RB_RGT(rgt)); + crt_req_decref(rpc); + D_GOTO(out, rc); + } + rso = crt_reply_get(rpc); + rc = rso->rso_status; rgt->rgt_init_scan = 1; rgt->rgt_stable_epoch = rso->rso_stable_epoch; DL_INFO(rc, DF_RB " got stable/reclaim epoch " DF_X64 "/" DF_X64, DP_RB_RGT(rgt), From 1c472aa8d9ee611022dab5b265605012182978f9 Mon Sep 17 00:00:00 2001 From: Wang Shilong Date: Thu, 12 Mar 2026 10:42:11 +0800 Subject: [PATCH 2/2] Address some comments Signed-off-by: Wang Shilong --- src/cart/crt_iv.c | 11 +++++------ src/rebuild/srv.c | 10 ++++------ 2 files changed, 9 insertions(+), 12 deletions(-) diff --git a/src/cart/crt_iv.c b/src/cart/crt_iv.c index f993630cc27..71d1e741309 100644 --- a/src/cart/crt_iv.c +++ b/src/cart/crt_iv.c @@ -1136,7 +1136,7 @@ crt_ivf_rpc_issue(d_rank_t dest_node, crt_iv_key_t *iv_key, struct crt_iv_fetch_in *input; crt_bulk_t local_bulk = CRT_BULK_NULL; crt_endpoint_t ep = {0}; - crt_rpc_t *rpc = NULL; + crt_rpc_t *rpc; struct ivf_key_in_progress *entry; int rc = 0; struct crt_iv_ops *iv_ops; @@ -1236,6 +1236,7 @@ crt_ivf_rpc_issue(d_rank_t dest_node, crt_iv_key_t *iv_key, } else { D_DEBUG(DB_ALL, "Group Version Changed: From %d: To %d\n", grp_ver, local_grp_ver); + RPC_PUB_DECREF(rpc); D_GOTO(exit, rc = -DER_GRPVER); } @@ -1266,8 +1267,6 @@ crt_ivf_rpc_issue(d_rank_t dest_node, crt_iv_key_t *iv_key, D_MUTEX_UNLOCK(&ivns_internal->cii_lock); if (local_bulk != CRT_BULK_NULL) crt_bulk_free(local_bulk); - if (rpc != NULL) - RPC_PUB_DECREF(rpc); } return rc; } @@ -2613,7 +2612,7 @@ crt_ivu_rpc_issue(d_rank_t dest_rank, crt_iv_key_t *iv_key, struct crt_iv_update_in *input; crt_bulk_t local_bulk = CRT_BULK_NULL; crt_endpoint_t ep = {0}; - crt_rpc_t *rpc = NULL; + crt_rpc_t *rpc; int rc = 0; uint32_t local_grp_ver; @@ -2644,6 +2643,7 @@ crt_ivu_rpc_issue(d_rank_t dest_rank, crt_iv_key_t *iv_key, } if (rc != 0) { D_ERROR("crt_bulk_create(): "DF_RC"\n", DP_RC(rc)); + RPC_PUB_DECREF(rpc); D_GOTO(exit, rc); } } else { @@ -2679,6 +2679,7 @@ crt_ivu_rpc_issue(d_rank_t dest_rank, crt_iv_key_t *iv_key, "On entry: %d: Changed to :%d\n", ivns_internal->cii_gns.gn_ivns_id.ii_group_name, grp_ver, local_grp_ver); + RPC_PUB_DECREF(rpc); D_GOTO(exit, rc = -DER_GRPVER); } input->ivu_grp_ver = grp_ver; @@ -2695,8 +2696,6 @@ crt_ivu_rpc_issue(d_rank_t dest_rank, crt_iv_key_t *iv_key, if (rc != 0) { if (local_bulk != CRT_BULK_NULL) crt_bulk_free(local_bulk); - if (rpc != NULL) - RPC_PUB_DECREF(rpc); } return rc; } diff --git a/src/rebuild/srv.c b/src/rebuild/srv.c index dad28cfbdb8..91185bb5cc3 100644 --- a/src/rebuild/srv.c +++ b/src/rebuild/srv.c @@ -1417,14 +1417,12 @@ rebuild_scan_broadcast(struct ds_pool *pool, struct rebuild_global_pool_tracker crt_group_rank(pool->sp_group, &rsi->rsi_master_rank); rc = dss_rpc_send(rpc); - if (rc != 0) { + rso = crt_reply_get(rpc); + if (rc == 0) + rc = rso->rso_status; + else DL_ERROR(rc, DF_RB " scan broadcast send failed.", DP_RB_RGT(rgt)); - crt_req_decref(rpc); - D_GOTO(out, rc); - } - rso = crt_reply_get(rpc); - rc = rso->rso_status; rgt->rgt_init_scan = 1; rgt->rgt_stable_epoch = rso->rso_stable_epoch; DL_INFO(rc, DF_RB " got stable/reclaim epoch " DF_X64 "/" DF_X64, DP_RB_RGT(rgt),