Skip to content

fix context leaks in GCS datasource and registry transport#4162

Open
immanuwell wants to merge 1 commit into
kubevirt:mainfrom
immanuwell:fix-context-leaks-importer
Open

fix context leaks in GCS datasource and registry transport#4162
immanuwell wants to merge 1 commit into
kubevirt:mainfrom
immanuwell:fix-context-leaks-importer

Conversation

@immanuwell

@immanuwell immanuwell commented May 28, 2026

Copy link
Copy Markdown

What this PR does / why we need it:

Three context bugs in pkg/importer that have been quietly leaking resources:

  1. NewGCSDataSource discards the cancel func from context.WithTimeout - there's even a nolint:govet todo comment acknowledging it. The context is never cancelled so goroutines/timers leak on every GCS import. Fix: store cancel in the struct, call it in Close() (and on error paths).

  2. GetImageDigest creates a timeout ctx via commandTimeoutContext() but then passes context.Background() to src.GetManifest() - so the timeout has no effect on the actual manifest fetch, it can hang forever.

  3. validateImagePlatformMatch hardcodes context.Background() even though the caller has a proper timeout ctx. Fixed by threading ctx through as a param.

How to reproduce 1 (GCS leak):

  • profile memory while running repeated GCS imports
  • or just look at pkg/importer/gcs-datasource.go:61, the nolint comment spells it out

How to reproduce 2 (GetManifest ignores timeout):

  • call GetImageDigest against a slow/unresponsive registry with a short timeout - it won't respect the timeout

Release note:

NONE

@kubevirt-bot kubevirt-bot added release-note-none Denotes a PR that doesn't merit a release note. dco-signoff: yes Indicates the PR's author has DCO signed all their commits. labels May 28, 2026
@kubevirt-bot kubevirt-bot requested review from aglitke and alromeros May 28, 2026 07:50
@kubevirt-bot

Copy link
Copy Markdown
Contributor

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign mhenriks for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@kubevirt-bot

Copy link
Copy Markdown
Contributor

Hi @immanuwell. Thanks for your PR.

PRs from untrusted users cannot be marked as trusted with /ok-to-test in this repo meaning untrusted PR authors can never trigger tests themselves. Collaborators can still trigger tests on the PR using /test all.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@akalenyu akalenyu left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

thank you!

Comment thread pkg/importer/transport.go
Comment thread pkg/importer/gcs-datasource.go
@akalenyu

Copy link
Copy Markdown
Collaborator

/test all

@coveralls

coveralls commented May 28, 2026

Copy link
Copy Markdown

Coverage Status

coverage: 49.495% (-0.03%) from 49.521% — immanuwell:fix-context-leaks-importer into kubevirt:main

@akalenyu

Copy link
Copy Markdown
Collaborator

/test pull-containerized-data-importer-e2e-destructive
/test pull-containerized-data-importer-e2e-nfs
unrelated flakes

@kubevirt-bot

kubevirt-bot commented May 28, 2026

Copy link
Copy Markdown
Contributor

@immanuwell: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name Commit Details Required Rerun command
pull-containerized-data-importer-e2e-ceph b5255b3 link true /test pull-containerized-data-importer-e2e-ceph
pull-containerized-data-importer-e2e-s390x b5255b3 link unknown /test pull-containerized-data-importer-e2e-s390x
pull-containerized-data-importer-e2e-nfs b5255b3 link true /test pull-containerized-data-importer-e2e-nfs
Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

@immanuwell immanuwell force-pushed the fix-context-leaks-importer branch from b5255b3 to 340a7d6 Compare June 14, 2026 13:44
@immanuwell

Copy link
Copy Markdown
Author

@akalenyu done, I addressed all your suggestions, PTAL

@immanuwell immanuwell requested a review from akalenyu June 14, 2026 13:47
Comment thread pkg/importer/transport.go Outdated
Expect(ProcessingPhaseError).To(Equal(result))
})

It("Close should cancel the context before closing readers", func() {

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nice!

Signed-off-by: Immanuel Tikhonov <pchpr.00@list.ru>
@immanuwell immanuwell force-pushed the fix-context-leaks-importer branch from 340a7d6 to fb58e7c Compare June 14, 2026 14:59
@immanuwell immanuwell requested a review from akalenyu June 14, 2026 15:00
@immanuwell

Copy link
Copy Markdown
Author

@akalenyu done, PTAL

@akalenyu akalenyu left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

looks good, just unsure about the extra defensiveness with ctx == nil
/test all

Comment thread pkg/importer/transport.go
Comment on lines +197 to +199
if ctx == nil {
ctx = context.Background()
}

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

don't think we need this?

Comment thread pkg/importer/transport.go
Comment on lines +277 to +279
if ctx == nil {
ctx = context.Background()
}

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

same, we own all the calls and can guarantee context is passed

@kubevirt-prow

kubevirt-prow Bot commented Jun 14, 2026

Copy link
Copy Markdown

@immanuwell: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name Commit Details Required Rerun command
pull-containerized-data-importer-e2e-hpp-latest fb58e7c link true /test pull-containerized-data-importer-e2e-hpp-latest
pull-containerized-data-importer-e2e-nfs fb58e7c link true /test pull-containerized-data-importer-e2e-nfs
Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dco-signoff: yes Indicates the PR's author has DCO signed all their commits. release-note-none Denotes a PR that doesn't merit a release note. size/L

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants