Skip to content

RDKBWIFI-498: Fix EM subdoc memory leaks in webconfig decode and EM a…#1250

Open
dkyncu wants to merge 1 commit into
rdkcentral:developfrom
dkyncu:leak-fixes
Open

RDKBWIFI-498: Fix EM subdoc memory leaks in webconfig decode and EM a…#1250
dkyncu wants to merge 1 commit into
rdkcentral:developfrom
dkyncu:leak-fixes

Conversation

@dkyncu

@dkyncu dkyncu commented Jul 6, 2026

Copy link
Copy Markdown

…pp publishers

The EasyMesh AP metrics pipeline leaks on both ends of the webconfig subdoc exchange, growing the consumer of the report (EM agent, via libwifi_webconfig) and OneWifi itself on every reporting interval. Leaks were located with LeakSanitizer and validated fixed on a device (RSS flat over 8 hours).

Decode side (libwifi_webconfig):

  • decode_em_ap_metrics_report_subdoc never freed data->u.encoded.json; per framework convention (see decode_radio_subdoc) the subdoc decoder owns the parsed tree, so the whole cJSON tree of every report leaked. Delete it on the success path and on the two error paths that were missing it.

  • decode_em_ap_metrics_report_object mallocs per-vap sta_traffic_stats and sta_link_metrics arrays into the decoded params, but nothing on the decode/translate path freed them (webconfig_data_free only frees u.encoded.raw). Free them in webconfig_easymesh_decode after translation, mirroring the existing assoc-map cleanup.

EM app publishers (wifi_em.c):

  • All four publishers (AP metrics report, sta link metrics report, channel scan report, beacon report) leaked the encoded JSON string: webconfig_encode allocates data->u.encoded.raw, the bus publish copies the payload, and the cleanup paths freed the decoded members and data but never the encoded string. The beacon report publisher also leaked wb_data itself on the success path.

…pp publishers

The EasyMesh AP metrics pipeline leaks on both ends of the webconfig
subdoc exchange, growing the consumer of the report (EM agent, via
libwifi_webconfig) and OneWifi itself on every reporting interval.
Leaks were located with LeakSanitizer and validated fixed on a device
(RSS flat over 8 hours).

Decode side (libwifi_webconfig):

- decode_em_ap_metrics_report_subdoc never freed data->u.encoded.json;
  per framework convention (see decode_radio_subdoc) the subdoc
  decoder owns the parsed tree, so the whole cJSON tree of every
  report leaked. Delete it on the success path and on the two error
  paths that were missing it.

- decode_em_ap_metrics_report_object mallocs per-vap sta_traffic_stats
  and sta_link_metrics arrays into the decoded params, but nothing on
  the decode/translate path freed them (webconfig_data_free only frees
  u.encoded.raw). Free them in webconfig_easymesh_decode after
  translation, mirroring the existing assoc-map cleanup.

EM app publishers (wifi_em.c):

- All four publishers (AP metrics report, sta link metrics report,
  channel scan report, beacon report) leaked the encoded JSON string:
  webconfig_encode allocates data->u.encoded.raw, the bus publish
  copies the payload, and the cleanup paths freed the decoded members
  and `data` but never the encoded string. The beacon report publisher
  also leaked wb_data itself on the success path.

Signed-off-by: Durmus Koyuncu <durmus.kyncu.kd@gmail.com>
Copilot AI review requested due to automatic review settings July 6, 2026 17:34
@dkyncu dkyncu requested a review from a team as a code owner July 6, 2026 17:34

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Fixes memory leaks in the EasyMesh AP metrics reporting pipeline by ensuring both decoded (cJSON tree + per-VAP arrays) and encoded (JSON string) allocations are freed across success/error paths.

Changes:

  • Free parsed cJSON (u.encoded.json) in decode_em_ap_metrics_report_subdoc() on success and additional error paths.
  • Free per-VAP decoded allocations (sta_traffic_stats, sta_link_metrics) after translation in webconfig_easymesh_decode() (EM_APP).
  • Free encoded payload strings (u.encoded.raw) and missing success-path allocations in EasyMesh publishers in wifi_em.c.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 4 comments.

File Description
source/webconfig/wifi_webconfig_em_ap_metrics_report.c Deletes decoded cJSON tree to stop per-interval subdoc decode leaks.
source/webconfig/wifi_easymesh_translator.c Adds EM_APP cleanup for decoded per-VAP arrays after translation.
source/apps/em/wifi_em.c Frees encoded JSON strings (and one missing struct free) in multiple EM publishers.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment thread source/apps/em/wifi_em.c
Comment on lines +481 to 484
free(data->u.encoded.raw);
free(data->u.decoded.em_sta_link_metrics_rsp.per_sta_metrics);
free(data);
}
cJSON_Delete(json);
return webconfig_error_decode;
}

Comment on lines +198 to 200
// the subdoc decoder owns u.encoded.json (see decode_radio_subdoc)
cJSON_Delete(json);
return webconfig_error_none;
Comment thread source/apps/em/wifi_em.c
Comment on lines +2044 to 2046
// u.encoded.raw is NULL if encode was not reached (data is memset)
free(data->u.encoded.raw);
free(data);
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants