[syslog-ng] Memory leak can occur with supressed duplicate log messages

[Balazs Scheidler]

On Mon, 2010-06-28 at 12:30 +1200, andy kitchingman wrote:
> Hi 
> 
> 
> Due to my company firewall, I do not have access to the git public
> repository, so I will post this here. 
> 
> 
> I believe there is a memory leak when duplicate messages are
> suppressed and messages cannot be consumed: 
> 
> 
> logwriter.c: log_writer_last_msg_flush(LogWriter *self) 
> 
> ------------------------------------------- 
> 
> 
> log_queue_push_tail(self->queue, m, &path_options) can return FALSE
> (message cannot be consumed), in which case the local LogMessage m is
> leaked. 
> 
> 
> The fix should be something like 
> 
> 
>   if (!log_queue_push_tail(self->queue, m, &path_options)) 
> 
>     { 
> 
>       log_msg_unref(m); 
> 
>     } 
> 

Thanks for the report, but this patch breaks flow control. Seemingly
better fix for the problem is:

diff --git a/src/logwriter.c b/src/logwriter.c
index dcc9584..86d1e07 100644
--- a/src/logwriter.c
+++ b/src/logwriter.c
@@ -356,7 +356,15 @@ log_writer_last_msg_flush(LogWriter *self)
                                          
                                          
   path_options.flow_control = FALSE;
-  log_queue_push_tail(self->queue, m, &path_options);
+  if (!log_queue_push_tail(self->queue, m, &path_options))
+    {
+      stats_counter_inc(self->dropped_messages);
+      msg_debug("Destination queue full, dropping suppressed message",
+                evt_tag_int("queue_len", log_queue_get_length(self->queue)),
+                evt_tag_int("mem_fifo_size", self->options->mem_fifo_size),
+                NULL);
+      log_msg_drop(m, &path_options);
+    }
 
   log_writer_last_msg_release(self);
 }

I've also commited this to syslog-ng OSE 3.0 tree, it'll be forward ported over
time to newer versions as well. Here's the git commit entry:

commit 9c2c2be8b95add3789a91cec25ea92a3bd6ceedb
Author: Balazs Scheidler <bazsi at balabit.hu>
Date:   Wed Jun 30 17:41:06 2010 +0200

    logwriter: fix memory leak if the suppressed message doesn't fit into the queue
    
    In case a suppressed message couldn't be inserted into the destination FIFO,
    it was leaked. This patch correctly disposes of the message in this case.
    
    Reported-By: Andy Kitchingman


-- 
Bazsi