Memory leak/attack vector about czmq HOT 11 CLOSED

Rewrote my zmq test in czmq, still not seeing the growth. Please double check my code and results.

https://gist.github.com/deepcube/5423034

from czmq.

Running under valgrind:

gcc -c -o out/obj/czmq_leak_s.o src/czmq_leak_s.c -Iinclude
gcc -o out/czmq_leak_s out/obj/czmq_leak_s.o -Iinclude -lzmq -lczmq
==11664== Memcheck, a memory error detector
==11664== Copyright (C) 2002-2010, and GNU GPL'd, by Julian Seward et al.
==11664== Using Valgrind-3.6.0.SVN-Debian and LibVEX; rerun with -h for copyright info
==11664== Command: out/czmq_leak_s
==11664==
Starting DDOS test.
ZMQ version is 3.2.3
CZMQ version is 1.4.0
^CInterrupted, please take a moment to observe the size of the executable in memory.
Press enter when done...

Shutting down...
==11664==
==11664== HEAP SUMMARY:
==11664== in use at exit: 0 bytes in 0 blocks
==11664== total heap usage: 253,803 allocs, 253,803 frees, 411,935,709 bytes allocated
==11664==
==11664== All heap blocks were freed -- no leaks are possible
==11664==
==11664== For counts of detected and suppressed errors, rerun with: -v
==11664== ERROR SUMMARY: 0 errors from 0 contexts (suppressed: 4 from 4)

No leak, but my example server did grow over time. You can see it grew from its base size to 260kb to 392.85mb. (411,935,709 bytes)

from czmq.

Upon further testing, if the server does zmq_poll(3) or zmq_recvmsg(3), then there is no memory growth. If the server spins ( for(;;); ), sleep(3), or pause(3), there is growth.

from czmq.

Isn't this expected behavior? The server is queuing up the messages during the sleep() - it'll only free up that memory if it can pull the messages off the queue and do something with them.

from czmq.

Makes sense to me

from czmq.

I guess I am a bit perplexed, as in the example code (https://gist.github.com/JustonDavies/5266122) the client only connects, waits a moment, then disconnects. I never explicitly send anything and thus nothing would need to be received or removed from the queue.

from czmq.

It sound more like dangling socket handles.
On Apr 24, 2013 7:30 PM, "nga⁴" [email protected] wrote:

I guess I am a bit perplexed, as in the example code (
https://gist.github.com/JustonDavies/5266122) the client only connects,
waits a moment, then disconnects. I never explicitly send anything and thus
nothing would need to be received or removed from the queue.

—
Reply to this email directly or view it on GitHubhttps://github.com//issues/141#issuecomment-16950457
.

from czmq.

Yes, but only if you don't send messages?

from czmq.

Well I re-wrote the example using the native bindings. Server starts, clients connect and disconnect sending nothing, the server just idles never invoking a receive and I can replicate the growth. However, if I put the server in a loop where it attempts to receive (while the clients still start up connect/disconnect sending nothing) the problem never occurs. https://gist.github.com/JustonDavies/5437189

It seems that asking the server to receive (even when nothing is being sent) prevents the problem. This limits the means of attack to any time you might have a socket that people could connect to that never invokes a receive.

To state the obvious, I might have jumped the gun saying this was a czmq specific problem. I should've read the other gist before hand and logged the bug in the correct place.

from czmq.

Ah... This is in fact normal. If the main thread doesn't call libzmq
internal events will accumulate. It's not an attack vector, but an
incorrect use of the API. It May need better documentation.
On Apr 24, 2013 8:01 PM, "nga⁴" [email protected] wrote:

Well I re-wrote the example using the native bindings. Server starts,
clients connect and disconnect sending nothing, the server just idles never
invoking a receive and I can replicate the growth. However, if I put the
server in a loop where it attempts to receive (while the clients still
start up connect/disconnect sending nothing) the problem never occurs.
https://gist.github.com/JustonDavies/5437189

It seems that asking the server to receive (even when nothing is being
sent) prevents the problem. This limits the means of attack to any time you
might have a socket that people could connect to that never invokes a
receive.

To state the obvious, I might have jumped the gun saying this was a czmq
specific problem. I should've read the other gist before hand and logged
the bug in the correct place.

—
Reply to this email directly or view it on GitHubhttps://github.com//issues/141#issuecomment-16953470
.

from czmq.

Closing this.

from czmq.