[19017] in Kerberos_V5_Development
Re: About Memory Leak of kinit with pkinit Plugin
daemon@ATHENA.MIT.EDU (Simo Sorce)
Mon Sep 22 15:15:31 2014
Date: Mon, 22 Sep 2014 15:15:14 -0400
From: Simo Sorce <simo@redhat.com>
To: Greg Hudson <ghudson@mit.edu>
Message-ID: <20140922151514.09d2b482@willson.usersys.redhat.com>
In-Reply-To: <542046C8.9040001@mit.edu>
MIME-Version: 1.0
Cc: krbdev@mit.edu, Zhou Yang <sherice.911@gmail.com>
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: krbdev-bounces@mit.edu
On Mon, 22 Sep 2014 11:56:56 -0400
Greg Hudson <ghudson@mit.edu> wrote:
> On 09/22/2014 04:17 AM, Zhou Yang wrote:
> > I'm trying to transplant kinit (for AS, the lastest version
> > *1.12.2*) into a daemon program. But when I tested the stability of
> > this feature (by infinite loop), a memory leak problem was found.
> [...]
> > * 57,328 (176 direct, 57,152 indirect) bytes in 1 blocks are
> > definitely lost in loss record 568 of 568*
>
> I believe you are seeing heap memory which is allocated by OpenSSL
> during initialization and never cleaned up. valgrind detects it as
> leaked because the OpenSSL library has been unloaded by the time the
> process exits.
>
> We cannot currently tell OpenSSL to clean up its heap memory, because
> we cannot know whether OpenSSL is being used by the application or by
> another library.
>
> This only becomes an unbounded memory leak if the PKINIT module (and
> therefore OpenSSL) is repeatedly loaded and unloaded as a result of
> the application's krb5 usage. If the application uses the same
> krb5_context for all AS-REQs, or is itself linked against OpenSSL,
> there won't be an unbounded leak.
>
> In 1.13 (due out soon) we open plugin modules with RTLD_NODELETE where
> available, which precludes this repeated load-unload scenario and can
> also improve performance.
PAM modules are loaded and unloaded at each use, I wonder if this will
causes issues (or merely keep the leak in check) in pam_krb5 when
pkinit is configured.
Simo.
--
Simo Sorce * Red Hat, Inc * New York
_______________________________________________
krbdev mailing list krbdev@mit.edu
https://mailman.mit.edu/mailman/listinfo/krbdev
