Fix memcheck fork-child endpoint leaks

Free the inherited POSIX daemon endpoint in the three fork tests before their children call _exit. These losses were test artifacts, not product ownership bugs.

Re-exec the user namespace probe using the runner path recorded from argv[0]. Under Valgrind, /proc/self/exe can resolve to the instrumentation executable, so the probe did not reliably start a fresh test-runner process to derive the namespace overflow uid. Re-executing the runner preserves the fresh-process check while allowing Valgrind to report the test result.

Create build/ before allocating the temporary memory-analysis build directory so the script works on a fresh checkout.

Author: ngallodev

scripts/analyze-memory.sh

@@ -22,6 +22,7 @@ fi
 
 RESULTS_DIR="${CBM_MEMORY_RESULTS_DIR:-$ROOT/memlab-memory-analysis}"
 RUN_ID="$(date +%Y%m%d-%H%M%S)-$$"
+mkdir -p "$ROOT/build"
 ANALYSIS_BUILD="$(mktemp -d "$ROOT/build/memory-analysis.XXXXXX")"
 TEST_BIN="$ANALYSIS_BUILD/test-runner"
 RUN_RESULTS="$RESULTS_DIR/$RUN_ID"

tests/test_daemon_ipc.c

@@ -25,6 +25,8 @@
 #include <stdlib.h>
 #include <string.h>
 
+extern const char *cbm_test_program_path;
+
 #ifdef _WIN32
 #ifndef WIN32_LEAN_AND_MEAN
 #define WIN32_LEAN_AND_MEAN
@@ -3262,6 +3264,7 @@ TEST(daemon_ipc_posix_startup_lock_is_cross_process) {
         int child_result = ipc_test_cross_process_lock_child(endpoint, commands[0], results[1]);
         (void)close(commands[0]);
         (void)close(results[1]);
+        cbm_daemon_ipc_endpoint_free(endpoint);
         _exit(child_result);
     }
     if (child > 0) {
@@ -3352,6 +3355,7 @@ TEST(daemon_ipc_posix_lifetime_reservation_rejects_fork_inheritance) {
         cbm_daemon_ipc_lifetime_reservation_release(inherited);
         bool reported = ipc_test_fd_write_all(result_pipe[1], &child_result, sizeof(child_result));
         (void)close(result_pipe[1]);
+        cbm_daemon_ipc_endpoint_free(endpoint);
         _exit(reported && child_result == 1 ? 0 : 1);
     }
     if (child > 0) {
@@ -3447,6 +3451,7 @@ TEST(daemon_ipc_posix_child_participant_handoff_retains_legacy_bridge) {
             ipc_test_fd_write_all(child_to_parent[1], &release_byte, sizeof(release_byte));
         (void)close(parent_to_child[0]);
         (void)close(child_to_parent[1]);
+        cbm_daemon_ipc_endpoint_free(endpoint);
         _exit(join_byte == 1 && release_reported && release_byte == 1 ? 0 : 1);
     }
     if (child > 0) {
@@ -5581,7 +5586,10 @@ TEST(daemon_ipc_posix_single_uid_userns_real_smoke_issue1830) {
          * unprivileged userns) -- while looking like a product regression.
          * Re-exec so the decision is made by a process that STARTED here, which
          * is also the only shape production ever takes. */
-        (void)execl("/proc/self/exe", "test-runner", "--userns-secure-probe", probe, (char *)NULL);
+        /* /proc/self/exe can name Valgrind itself here. Re-exec the runner
+         * path recorded from argv[0] so the probe starts fresh in the namespace. */
+        (void)execl(cbm_test_program_path, "test-runner", "--userns-secure-probe", probe,
+                    (char *)NULL);
         _exit(3); /* exec failed -- distinct from secure(0)/refused(1)/skip(2) */
     }
     if (child < 0) {