106 lines
4.9 KiB
Plaintext
106 lines
4.9 KiB
Plaintext
# Suppressions for `make valgrind` (see scripts/valgrind.sh and valgrind/README.md).
|
|
#
|
|
# Each entry here is a specific, named allocation site, not a blanket "ignore leaks" rule, and
|
|
# each one is explained. They were captured with `valgrind --gen-suppressions=all` against a
|
|
# real `doos attach` run and trimmed to the exact stack valgrind printed; a new, different leak
|
|
# anywhere else still fails the check. Regenerate a candidate block with
|
|
# `valgrind --gen-suppressions=all` if doos's internals change and one of these stops matching.
|
|
|
|
{
|
|
doos-clone-child-stack
|
|
# Sandbox::start allocates the 1 MiB stack clone(2) needs for the namespace child. Its
|
|
# lifetime is tied to that child process, not to a scope in the parent, so it is never
|
|
# `delete[]`d: freeing it after clone() returns would be safe only once the child has copied
|
|
# what it needs, and doing that bookkeeping would add a second code path purely to silence
|
|
# a tool, not to fix a real leak. Confirmed "possibly lost", never "definitely lost".
|
|
Memcheck:Leak
|
|
match-leak-kinds: possible
|
|
fun:_Znwm
|
|
fun:_ZN4doos7Sandbox5startERNS_8FileLockE
|
|
fun:_ZN4doos7Sandbox3runEv
|
|
fun:_ZN4doos3Cli9cmdAttachESt6vectorINSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEESaIS7_EE
|
|
fun:_ZN4doos3Cli3runEv
|
|
fun:main
|
|
}
|
|
|
|
{
|
|
doos-mount-error-exception-object
|
|
# doMount's cold (error) path throws a SysError built from a std::string; when the namespace
|
|
# child terminates right after printing that error, the in-flight exception object itself
|
|
# (allocated by __cxa_allocate_exception) has not yet been destroyed by the unwinder. This is
|
|
# the standard valgrind artifact for a C++ exception that is still alive when the process
|
|
# exits, not a missing `delete`.
|
|
Memcheck:Leak
|
|
match-leak-kinds: possible
|
|
fun:malloc
|
|
fun:__cxa_allocate_exception
|
|
fun:_ZN4doos12_GLOBAL__N_1L7doMountEPKcRKNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEES2_mSA_.isra.0.cold
|
|
fun:_ZN4doos12_GLOBAL__N_1L9setupRootERKNS_9ContainerERKNSt10filesystem7__cxx114pathE
|
|
fun:_ZN4doos12_GLOBAL__N_1L13containerInitEPv
|
|
fun:clone
|
|
}
|
|
|
|
{
|
|
doos-mount-error-message-string
|
|
# Same doMount error path: the message string's internal buffer, built while constructing
|
|
# the SysError/runtime_error that is about to be thrown. Same explanation as
|
|
# doos-mount-error-exception-object, one frame earlier in the chain.
|
|
Memcheck:Leak
|
|
match-leak-kinds: possible
|
|
fun:_Znwm
|
|
fun:_ZNSs4_Rep9_S_createEmmRKSaIcE
|
|
fun:_ZNSt12__cow_stringC2EPKcm
|
|
fun:_ZNSt13runtime_errorC1ERKNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEE
|
|
fun:_ZN4doos8SysErrorC1ERKNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEEi
|
|
fun:_ZN4doos12_GLOBAL__N_1L7doMountEPKcRKNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEES2_mSA_.isra.0.cold
|
|
fun:_ZN4doos12_GLOBAL__N_1L9setupRootERKNS_9ContainerERKNSt10filesystem7__cxx114pathE
|
|
fun:_ZN4doos12_GLOBAL__N_1L13containerInitEPv
|
|
fun:clone
|
|
}
|
|
|
|
{
|
|
doos-mount-error-exception-object-top-level
|
|
# Same explanation as doos-mount-error-exception-object, for the mount call that runs
|
|
# directly in containerInit before setupRoot is reached (the very first "mount bind /",
|
|
# which is what fails when AppArmor blocks user namespaces for this binary's path).
|
|
Memcheck:Leak
|
|
match-leak-kinds: possible
|
|
fun:malloc
|
|
fun:__cxa_allocate_exception
|
|
fun:_ZN4doos12_GLOBAL__N_1L7doMountEPKcRKNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEES2_mSA_.isra.0.cold
|
|
fun:_ZN4doos12_GLOBAL__N_1L13containerInitEPv
|
|
fun:clone
|
|
}
|
|
|
|
{
|
|
doos-mount-error-message-string-top-level
|
|
# Same explanation as doos-mount-error-message-string, one level up: the mount call that
|
|
# runs directly in containerInit before setupRoot is reached.
|
|
Memcheck:Leak
|
|
match-leak-kinds: possible
|
|
fun:_Znwm
|
|
fun:_ZNSs4_Rep9_S_createEmmRKSaIcE
|
|
fun:_ZNSt12__cow_stringC2EPKcm
|
|
fun:_ZNSt13runtime_errorC1ERKNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEE
|
|
fun:_ZN4doos8SysErrorC1ERKNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEEi
|
|
fun:_ZN4doos12_GLOBAL__N_1L7doMountEPKcRKNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEES2_mSA_.isra.0.cold
|
|
fun:_ZN4doos12_GLOBAL__N_1L13containerInitEPv
|
|
fun:clone
|
|
}
|
|
|
|
{
|
|
doos-containerinit-ifstream-buffer
|
|
# containerInit's cold (error) path opens an ifstream (a /proc file, for a diagnostic) whose
|
|
# libstdc++ filebuf buffer is still open when the namespace child exits right after. Same
|
|
# "process exited before an RAII object on an about-to-unwind error path ran its destructor"
|
|
# pattern as the two entries above, for a stream instead of an exception.
|
|
Memcheck:Leak
|
|
match-leak-kinds: possible
|
|
fun:_Znam
|
|
fun:_ZNSt13basic_filebufIcSt11char_traitsIcEE27_M_allocate_internal_bufferEv
|
|
fun:_ZNSt13basic_filebufIcSt11char_traitsIcEE4openEPKcSt13_Ios_Openmode
|
|
fun:_ZNSt14basic_ifstreamIcSt11char_traitsIcEEC1EPKcSt13_Ios_Openmode
|
|
fun:_ZN4doos12_GLOBAL__N_1L13containerInitEPv.cold
|
|
fun:clone
|
|
}
|