diff options
| author |   Florian Schmaus <flow@gentoo.org> | 2026-05-22 13:21:09 +0200 |
|---|---|---|
| committer |   Michał Górny <mgorny@gentoo.org> | 2026-05-23 08:24:18 +0200 |
| commit | 7320b971e348d7b1e7dc4b4d8226c2bf803fac54 (patch) | |
| tree | 192ce51290a8ffc9c079442675444d2376bbf6e5 | |
| parent | Fix token leak if client performs non-blocking poll (diff) | |
| download | steve-main.tar.gz steve-main.tar.bz2 steve-main.zip | |
The steve_poll() function would leak memory in form of the pollhandle
in case a token is immediately available. Because then the pollhandle
is not placed in the waiters queue, where it is eventually deallocated
via the ~steve_waiter destructor.
Fix this my explicitly destroying the pollhandle if we do not put it
in the waiters queue.
Signed-off-by: Florian Schmaus <flow@gentoo.org>
Part-of: https://codeberg.org/gentoo/steve/pulls/2
Merges: https://codeberg.org/gentoo/steve/pulls/2
Signed-off-by: Michał Górny <mgorny@gentoo.org>
| -rw-r--r-- | src/steve.cxx | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/src/steve.cxx b/src/steve.cxx index ccbdfe5..4964dab 100644 --- a/src/steve.cxx +++ b/src/steve.cxx @@ -781,6 +781,7 @@ static void steve_write( static void steve_poll( fuse_req_t req, struct fuse_file_info *fi, struct fuse_pollhandle *ph) { + bool destroy_ph = false; steve_state *state = static_cast<steve_state *>(fuse_req_userdata(req)); int events = fi->poll_events & (POLLIN | POLLOUT); @@ -790,7 +791,8 @@ static void steve_poll( if (ph) state->waiters.emplace_back(ph, fi->fh); events &= ~POLLIN; - } + } else + destroy_ph = (ph != nullptr); if (state->verbose) { const steve_process *process = &state->processes.at(fi->fh); @@ -803,6 +805,9 @@ static void steve_poll( } fuse_reply_poll(req, events); + + if (destroy_ph) + fuse_pollhandle_destroy(ph); } static void steve_timeout_to_timeval(struct timeval *out, double timeout) { |