From: Tom Lane <tgl@sss.pgh.pa.us>
To: Jelte Fennema <postgres@jeltef.nl>
cc: Michael Paquier <michael@paquier.xyz>, duspensky@ya.ru,
        pgsql-bugs@lists.postgresql.org
Subject: Re: BUG #16160: Minor memory leak in case of starting postgres server
 with SSL encryption
In-reply-to: 
 <CAGECzQQv-iQ=-EyouczH_s8M6oyT-ga6TwpY+RN9JZH-17bX7w@mail.gmail.com>
References: <16160-18367e56e9a28264@postgresql.org>
 <20191213063915.GE1942@paquier.xyz> <20191214092456.GB70616@paquier.xyz>
 <CAGECzQTucR20CLwb6mw_JLdVST8GqYNqYr1OmAnNS2Byg8r+dg@mail.gmail.com>
 <3255514.1615912277@sss.pgh.pa.us>
 <CAGECzQQv-iQ=-EyouczH_s8M6oyT-ga6TwpY+RN9JZH-17bX7w@mail.gmail.com>
Comments: In-reply-to Jelte Fennema <postgres@jeltef.nl>
	message dated "Tue, 16 Mar 2021 18:17:49 +0100"
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-ID: <3345316.1615916184.1@sss.pgh.pa.us>
Date: Tue, 16 Mar 2021 13:36:24 -0400
Message-ID: <3345317.1615916184@sss.pgh.pa.us>
Archived-At: 
 <https://www.postgresql.org/message-id/3345317.1615916184%40sss.pgh.pa.us>
Precedence: bulk

Jelte Fennema <postgres@jeltef.nl> writes:
> I'm pretty sure it was the only cause in this specific case. When running
> postgres with valgrind this was the only block that was repeatedly being
> leaked.

Yeah, after doing some testing locally it seems that the non-error path,
at least, is free of additional problems.  I set up a shell loop to hit
the postmaster with SIGHUP ten times a second.  Looking at v12, an
ssl-enabled postmaster leaks very visibly after a few moments; while
there's no detectable leak in HEAD.  So +1 for back-patching the DH_free
fix.  (Michael, do you want to do the honors?)

> Looking at it again now, I see that if an error occurs when parsing
> ssl_crl_file the root_cert_list is in fact leaked. This was easy to
> reproduce by specifying a bogus path for ssl_crl_file.

Interesting.  While this case doesn't seem likely to pose much of a
practical problem, maybe we should clean it up.  I'd already wondered
what was the point of separating the creation and use of the
root_cert_list by so much --- seems like we could install it
immediately after creation.

			regards, tom lane