Our seclabel parsing was repeatedly assigning malloc'd data into a temporary variable, without first freeing the previous use. Among other leaks flagged by valgrind: ==9312== 8 bytes in 1 blocks are definitely lost in loss record 88 of 821 ==9312== at 0x4A0645D: malloc (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so) ==9312== by 0x8C40369: strdup (strdup.c:42) ==9312== by 0x50EA799: virStrdup (virstring.c:676) ==9312== by 0x50FAEB9: virXPathString (virxml.c:90) ==9312== by 0x50FAF1E: virXPathStringLimit (virxml.c:112) ==9312== by 0x510F516: virSecurityLabelDefParseXML (domain_conf.c:4571) ==9312== by 0x510FB20: virSecurityLabelDefsParseXML (domain_conf.c:4720) While it was multiple problems, it looks like commit da78351 was to blame for all of them. * src/conf/domain_conf.c (virSecurityLabelDefParseXML): Plug leaks detected by valgrind. Signed-off-by: Eric Blake <eblake(a)redhat.com&gt; --- src/conf/domain_conf.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c index 6ed6155..077e035 100644 --- a/src/conf/domain_conf.c +++ b/src/conf/domain_conf.c @@ -4573,6 +4573,7 @@ virSecurityLabelDefParseXML(xmlXPathContextPtr ctxt, if (!(seclabel = virSecurityLabelDefNew(p))) goto error; + VIR_FREE(p); /* set default value */ seclabel->type = VIR_DOMAIN_SECLABEL_DYNAMIC; @@ -4606,6 +4607,7 @@ virSecurityLabelDefParseXML(xmlXPathContextPtr ctxt, goto error; } } + VIR_FREE(p); if (seclabel->type == VIR_DOMAIN_SECLABEL_DYNAMIC && !seclabel->relabel) { @@ -4656,6 +4658,7 @@ virSecurityLabelDefParseXML(xmlXPathContextPtr ctxt, } seclabel->label = p; + p = NULL; } /* Only parse imagelabel, if requested live XML with relabeling */ @@ -4670,6 +4673,7 @@ virSecurityLabelDefParseXML(xmlXPathContextPtr ctxt, goto error; } seclabel->imagelabel = p; + p = NULL; } /* Only parse baselabel for dynamic label type */ @@ -4677,6 +4681,7 @@ virSecurityLabelDefParseXML(xmlXPathContextPtr ctxt, p = virXPathStringLimit("string(./baselabel[1])", VIR_SECURITY_LABEL_BUFLEN-1, ctxt); seclabel->baselabel = p; + p = NULL; } return seclabel; -- 1.9.3