#### Pre-Submission Checklist - [x] Commit message has the format required by CONTRIBUTING guide - [x] Commits are split per component (core, individual modules, libs, utils, ...) - [x] Each component has a single commit (if not, squash them into one commit) - [x] No commits to README files for modules (changes must be done to docbook files in `doc/` subfolder, the README file is autogenerated)
#### Type Of Change - [x] Small bug fix (non-breaking change which fixes an issue) - [ ] New feature (non-breaking change which adds new functionality) - [ ] Breaking change (fix or feature that would change existing functionality) #### Checklist: - [x] PR should be backported to stable branches - [x] Tested changes locally - [x] Related to issue #4670 and #4671 #### Description Follow-up to the double-free fixes in #4670 / #4671. Those fixed the crash in `parse_sec_agree()`'s error path, but the P-CSCF sec-agree code still leaks shared memory on the normal (re-)registration paths: **ims_registrar_pcscf — `save_pending()`** - `sec_verify_params` (Security-Verify) is only used to copy SPI/port values into `sec_params` and is never stored on the contact → leaked on every REGISTER carrying a Security-Verify header. - `sec_params` (Security-Client) is only handed to the contact on the initial registration; on re-REGISTER and on the DB_ONLY de-registration early returns it is never stored → leaked on every re-REGISTER. **ims_ipsec_pcscf — `ipsec_create()`** - Initial registration overwrites `pcontact->security_temp->data.ipsec` with the new `ipsec_t` without freeing the previous one (stored by `save_pending()`) → orphaned on every registration. - On re-registration `req_sec_params->data.ipsec` is only used to build the tunnel and is never stored → leaked on every re-REGISTER. Ownership is tracked (`sec_params_stored`, `ipsec_swapped`) so structures are freed only on the paths where they are not handed to the contact; no double-free. Verified with `kamcmd mod.stats all shm`: on a fresh start `ims_registrar_pcscf` is 0 and `ims_ipsec_pcscf` is just the fixed SPI pool. Before the fix both grew on every re-registration cycle and never returned to baseline after UEs de-registered; with the fix the totals plateau under load and return to baseline. You can view, comment on, or merge this pull request online at: https://github.com/kamailio/kamailio/pull/4764 -- Commit Summary -- * ims_registrar_pcscf: free leaked sec-agree security_t in save_pending() * ims_ipsec_pcscf: free leaked ipsec_t in ipsec_create() -- File Changes -- M src/modules/ims_ipsec_pcscf/cmd.c (52) M src/modules/ims_registrar_pcscf/save.c (24) M src/modules/ims_registrar_pcscf/sec_agree.c (75) M src/modules/ims_registrar_pcscf/sec_agree.h (9) -- Patch Links -- https://github.com/kamailio/kamailio/pull/4764.patch https://github.com/kamailio/kamailio/pull/4764.diff -- Reply to this email directly or view it on GitHub: https://github.com/kamailio/kamailio/pull/4764 You are receiving this because you are subscribed to this thread. Message ID: <kamailio/kamailio/pull/[email protected]>
_______________________________________________ Kamailio - Development Mailing List -- [email protected] To unsubscribe send an email to [email protected] Important: keep the mailing list in the recipients, do not reply only to the sender!
