core: merge branch 'th/memleaks'

Fix memleaks and enable valgrind checks for most unit tests except
ifupdown plugin. For ifupdown tests, there are some leaks that are
not yet fixed. This is still to do.

To run checks with valgrind, configure with --with-valgrind.

Especially for libnm and libnm-glib tests, there are several leaks
that are (probably?) not the fault of NetworkManager code. Hence,
several suppressions were added to valgrind.suppressions.
On different systems and different version of glib, these suppressions
might not match and the test will fail there.

The valgrind.suppressions should be reviewed, cleaned up and adjusted
for more systems (and different glib library versions).

63 files changed, 546 insertions, 158 deletions

diff --git a/callouts/tests/Makefile.am b/callouts/tests/Makefile.am
index 3d16d74e25..a0ed40159f 100644
--- a/callouts/tests/Makefile.am
+++ b/callouts/tests/Makefile.am
@@ -28,6 +28,7 @@ test_dispatcher_envp_LDADD = \
 
 ###########################################
 
+@VALGRIND_RULES@
 TESTS = test-dispatcher-envp
 
 endif
diff --git a/callouts/tests/test-dispatcher-envp.c b/callouts/tests/test-dispatcher-envp.c
index eb41505dc0..ac2a9bd900 100644
--- a/callouts/tests/test-dispatcher-envp.c
+++ b/callouts/tests/test-dispatcher-envp.c
@@ -212,12 +212,12 @@ parse_ip4 (GKeyFile *kf, GVariant **out_props, const char *section, GError **err
 	split = g_strsplit_set (tmp, " ", -1);
 	g_free (tmp);
 
-	if (g_strv_length (split) > 0) {
+	if (split && g_strv_length (split) > 0) {
 		for (iter = split; iter && *iter; iter++)
 			g_strstrip (*iter);
 		g_variant_builder_add (&props, "{sv}", "domains", g_variant_new_strv ((gpointer) split, -1));
-		g_strfreev (split);
 	}
+	g_strfreev (split);
 
 	/* nameservers */
 	if (!add_uint_array (kf, &props, "ip4", "nameservers", error))
@@ -233,7 +233,7 @@ parse_ip4 (GKeyFile *kf, GVariant **out_props, const char *section, GError **err
 	split = g_strsplit_set (tmp, ",", -1);
 	g_free (tmp);
 
-	if (g_strv_length (split) > 0) {
+	if (split && g_strv_length (split) > 0) {
 		addresses = g_ptr_array_new_with_free_func ((GDestroyNotify) nm_ip_address_unref);
 		for (iter = split; iter && *iter; iter++) {
 			NMIPAddress *addr;
@@ -275,7 +275,7 @@ parse_ip4 (GKeyFile *kf, GVariant **out_props, const char *section, GError **err
 		split = g_strsplit_set (tmp, ",", -1);
 		g_free (tmp);
 
-		if (g_strv_length (split) > 0) {
+		if (split && g_strv_length (split) > 0) {
 			routes = g_ptr_array_new_with_free_func ((GDestroyNotify) nm_ip_route_unref);
 			for (iter = split; iter && *iter; iter++) {
 				NMIPRoute *route;
@@ -336,11 +336,15 @@ parse_dhcp (GKeyFile *kf,
 	g_variant_builder_init (&props, G_VARIANT_TYPE ("a{sv}"));
 	for (iter = keys; iter && *iter; iter++) {
 		val = g_key_file_get_string (kf, group_name, *iter, error);
-		if (!val)
+		if (!val) {
+			g_strfreev (keys);
+			g_variant_builder_clear (&props);
 			return FALSE;
+		}
 		g_variant_builder_add (&props, "{sv}", *iter, g_variant_new_string (val));
 		g_free (val);
 	}
+	g_strfreev (keys);
 
 	*out_props = g_variant_builder_end (&props);
 	return TRUE;
@@ -367,6 +371,21 @@ get_dispatcher_file (const char *file,
 	gboolean success = FALSE;
 	char **keys, **iter, *val;
 
+	g_assert (!error || !*error);
+	g_assert (out_con_dict && !*out_con_dict);
+	g_assert (out_con_props && !*out_con_props);
+	g_assert (out_device_props && !*out_device_props);
+	g_assert (out_device_ip4_props && !*out_device_ip4_props);
+	g_assert (out_device_ip6_props && !*out_device_ip6_props);
+	g_assert (out_device_dhcp4_props && !*out_device_dhcp4_props);
+	g_assert (out_device_dhcp6_props && !*out_device_dhcp6_props);
+	g_assert (out_vpn_ip_iface && !*out_vpn_ip_iface);
+	g_assert (out_vpn_ip4_props && !*out_vpn_ip4_props);
+	g_assert (out_vpn_ip6_props && !*out_vpn_ip6_props);
+	g_assert (out_expected_iface && !*out_expected_iface);
+	g_assert (out_action && !*out_action);
+	g_assert (out_env && !*out_env);
+
 	kf = g_key_file_new ();
 	if (!g_key_file_load_from_file (kf, file, G_KEY_FILE_NONE, error))
 		return FALSE;
@@ -520,6 +539,7 @@ test_generic (const char *file, const char *override_vpn_ip_iface)
 
 	g_assert_cmpstr (expected_iface, ==, out_iface);
 
+	g_strfreev (denv);
 	g_free (out_iface);
 	g_free (vpn_ip_iface);
 	g_free (expected_iface);
diff --git a/clients/cli/settings.c b/clients/cli/settings.c
index 5d003fad92..78947f04c3 100644
--- a/clients/cli/settings.c
+++ b/clients/cli/settings.c
@@ -6532,6 +6532,7 @@ nmc_setting_get_valid_properties (NMSetting *setting)
 			valid_props[i++] = g_strdup (key_name);
 	}
 	valid_props[i] = NULL;
+	g_free (props);
 
 	return valid_props;
 }
diff --git a/configure.ac b/configure.ac
index 3e23728e33..3bace48e27 100644
--- a/configure.ac
+++ b/configure.ac
@@ -891,6 +891,7 @@ AM_CONDITIONAL(REQUIRE_ROOT_TESTS, test "$enable_tests" == "root")
 AS_IF([test "$with_valgrind" != "no"],
 	AC_SUBST(VALGRIND_RULES, 'TESTS_ENVIRONMENT = "$(top_srcdir)/tools/run-test-valgrind.sh" "$(LIBTOOL)" "$(with_valgrind)" "$(top_srcdir)/valgrind.suppressions"'),
 	AC_SUBST(VALGRIND_RULES, []))
+AM_CONDITIONAL(WITH_VALGRIND, test "${with_valgrind}" != "no")
 
 GTK_DOC_CHECK(1.0)
 
diff --git a/include/nm-test-utils.h b/include/nm-test-utils.h
index a26bffad26..a9347e92ab 100644
--- a/include/nm-test-utils.h
+++ b/include/nm-test-utils.h
@@ -1054,8 +1054,8 @@ typedef enum {
 					g_variant_builder_add (&__setting_builder, "{sv}", \
 					                       __cur_property_name, \
 					                       __property_val); \
-				} else \
-					g_variant_unref (__property_val); \
+				} \
+				g_variant_unref (__property_val); \
 			} \
 			 \
 			if (__cur_setting_name) \
diff --git a/libnm-core/nm-connection.c b/libnm-core/nm-connection.c
index 239079e3b1..79ff31d89d 100644
--- a/libnm-core/nm-connection.c
+++ b/libnm-core/nm-connection.c
@@ -304,6 +304,8 @@ nm_connection_replace_settings (NMConnection *connection,
 	for (s = settings; s; s = s->next)
 		_nm_connection_add_setting (connection, s->data);
 
+	g_slist_free (settings);
+
 	if (changed)
 		g_signal_emit (connection, signals[CHANGED], 0);
 	return TRUE;
diff --git a/libnm-core/nm-setting-8021x.c b/libnm-core/nm-setting-8021x.c
index f4884b5c81..41559e0c8a 100644
--- a/libnm-core/nm-setting-8021x.c
+++ b/libnm-core/nm-setting-8021x.c
@@ -1884,6 +1884,7 @@ nm_setting_802_1x_get_private_key_format (NMSetting8021x *setting)
 			g_error_free (error);
 			return NM_SETTING_802_1X_CK_FORMAT_UNKNOWN;
 		}
+		g_error_free (error);
 		return NM_SETTING_802_1X_CK_FORMAT_RAW_KEY;
 	default:
 		break;
@@ -2164,6 +2165,7 @@ nm_setting_802_1x_get_phase2_private_key_format (NMSetting8021x *setting)
 			g_error_free (error);
 			return NM_SETTING_802_1X_CK_FORMAT_UNKNOWN;
 		}
+		g_error_free (error);
 		return NM_SETTING_802_1X_CK_FORMAT_RAW_KEY;
 	default:
 		break;
diff --git a/libnm-core/nm-setting-connection.c b/libnm-core/nm-setting-connection.c
index 01f5d423c1..7bc927bc1d 100644
--- a/libnm-core/nm-setting-connection.c
+++ b/libnm-core/nm-setting-connection.c
@@ -968,8 +968,9 @@ find_virtual_interface_name (GVariant *connection_dict)
 
 	/* All of the deprecated virtual interface name properties were named "interface-name". */
 	if (!g_variant_lookup (setting_dict, "interface-name", "&s", &interface_name))
-		return NULL;
+		interface_name = NULL;
 
+	g_variant_unref (setting_dict);
 	return interface_name;
 }
 
diff --git a/libnm-core/nm-setting-dcb.c b/libnm-core/nm-setting-dcb.c
index a4fa00c840..915cc41f2e 100644
--- a/libnm-core/nm-setting-dcb.c
+++ b/libnm-core/nm-setting-dcb.c
@@ -50,7 +50,7 @@ NM_SETTING_REGISTER_TYPE (NM_TYPE_SETTING_DCB)
 typedef struct {
 	NMSettingDcbFlags app_fcoe_flags;
 	gint              app_fcoe_priority;
-	const char *      app_fcoe_mode;
+	char *            app_fcoe_mode;
 
 	NMSettingDcbFlags app_iscsi_flags;
 	gint              app_iscsi_priority;
@@ -793,6 +793,7 @@ set_property (GObject *object, guint prop_id,
 		priv->app_fcoe_priority = g_value_get_int (value);
 		break;
 	case PROP_APP_FCOE_MODE:
+		g_free (priv->app_fcoe_mode);
 		priv->app_fcoe_mode = g_value_dup_string (value);
 		break;
 	case PROP_APP_ISCSI_FLAGS:
@@ -897,6 +898,16 @@ get_property (GObject *object, guint prop_id,
 }
 
 static void
+finalize (GObject *object)
+{
+	NMSettingDcbPrivate *priv = NM_SETTING_DCB_GET_PRIVATE (object);
+
+	g_free (priv->app_fcoe_mode);
+
+	G_OBJECT_CLASS (nm_setting_dcb_parent_class)->finalize (object);
+}
+
+static void
 nm_setting_dcb_class_init (NMSettingDcbClass *setting_class)
 {
 	GObjectClass *object_class = G_OBJECT_CLASS (setting_class);
@@ -907,6 +918,7 @@ nm_setting_dcb_class_init (NMSettingDcbClass *setting_class)
 	/* virtual methods */
 	object_class->set_property = set_property;
 	object_class->get_property = get_property;
+	object_class->finalize = finalize;
 	parent_class->verify       = verify;
 
 	/* Properties */
diff --git a/libnm-core/nm-setting-team-port.c b/libnm-core/nm-setting-team-port.c
index b5125753c3..7fbf8620f1 100644
--- a/libnm-core/nm-setting-team-port.c
+++ b/libnm-core/nm-setting-team-port.c
@@ -130,6 +130,7 @@ set_property (GObject *object, guint prop_id,
 
 	switch (prop_id) {
 	case PROP_CONFIG:
+		g_free (priv->config);
 		priv->config = g_value_dup_string (value);
 		break;
 	default:
@@ -155,6 +156,16 @@ get_property (GObject *object, guint prop_id,
 }
 
 static void
+finalize (GObject *object)
+{
+	NMSettingTeamPortPrivate *priv = NM_SETTING_TEAM_PORT_GET_PRIVATE (object);
+
+	g_free (priv->config);
+
+	G_OBJECT_CLASS (nm_setting_team_port_parent_class)->finalize (object);
+}
+
+static void
 nm_setting_team_port_class_init (NMSettingTeamPortClass *setting_class)
 {
 	GObjectClass *object_class = G_OBJECT_CLASS (setting_class);
@@ -165,6 +176,7 @@ nm_setting_team_port_class_init (NMSettingTeamPortClass *setting_class)
 	/* virtual methods */
 	object_class->set_property = set_property;
 	object_class->get_property = get_property;
+	object_class->finalize = finalize;
 	parent_class->verify       = verify;
 
 	/* Properties */
diff --git a/libnm-core/nm-setting-wired.c b/libnm-core/nm-setting-wired.c
index ac143e45df..2a7479405d 100644
--- a/libnm-core/nm-setting-wired.c
+++ b/libnm-core/nm-setting-wired.c
@@ -434,27 +434,24 @@ nm_setting_wired_get_s390_option (NMSettingWired *setting,
                                   const char **out_key,
                                   const char **out_value)
 {
-	NMSettingWiredPrivate *priv;
-	guint32 num_keys;
-	GList *keys;
-	const char *_key = NULL, *_value = NULL;
+	const char *_key, *_value;
+	GHashTableIter iter;
+	guint i = 0;
 
 	g_return_val_if_fail (NM_IS_SETTING_WIRED (setting), FALSE);
 
-	priv = NM_SETTING_WIRED_GET_PRIVATE (setting);
-
-	num_keys = nm_setting_wired_get_num_s390_options (setting);
-	g_return_val_if_fail (idx < num_keys, FALSE);
-
-	keys = g_hash_table_get_keys (priv->s390_options);
-	_key = g_list_nth_data (keys, idx);
-	_value = g_hash_table_lookup (priv->s390_options, _key);
-
-	if (out_key)
-		*out_key = _key;
-	if (out_value)
-		*out_value = _value;
-	return TRUE;
+	g_hash_table_iter_init (&iter, NM_SETTING_WIRED_GET_PRIVATE (setting)->s390_options);
+	while (g_hash_table_iter_next (&iter, (gpointer) &_key, (gpointer) &_value)) {
+		if (i == idx) {
+			if (out_key)
+				*out_key = _key;
+			if (out_value)
+				*out_value = _value;
+			return TRUE;
+		}
+		i++;
+	}
+	g_return_val_if_reached (FALSE);
 }
 
 /**
diff --git a/libnm-core/nm-utils.c b/libnm-core/nm-utils.c
index 4532ab26db..321c03f18c 100644
--- a/libnm-core/nm-utils.c
+++ b/libnm-core/nm-utils.c
@@ -1802,6 +1802,7 @@ nm_utils_ip_addresses_from_variant (GVariant *value,
 			g_variant_unref (attr_val);
 		}
 
+		g_variant_unref (addr_var);
 		g_ptr_array_add (addresses, addr);
 	}
 
diff --git a/libnm-core/tests/Makefile.am b/libnm-core/tests/Makefile.am
index a21c131cb5..79aa73dbf9 100644
--- a/libnm-core/tests/Makefile.am
+++ b/libnm-core/tests/Makefile.am
@@ -24,6 +24,7 @@ LDADD = \
 	$(top_builddir)/libnm-core/libnm-core.la \
 	$(GLIB_LIBS)
 
+@VALGRIND_RULES@
 TESTS = $(noinst_PROGRAMS)
 
 endif
diff --git a/libnm-core/tests/test-crypto.c b/libnm-core/tests/test-crypto.c
index 1c8ae4773e..b6ed2b11af 100644
--- a/libnm-core/tests/test-crypto.c
+++ b/libnm-core/tests/test-crypto.c
@@ -98,7 +98,7 @@ out:
 static void
 test_cert (gconstpointer test_data)
 {
-	char *path;
+	gs_free char *path;
 	GByteArray *array;
 	NMCryptoFileFormat format = NM_CRYPTO_FILE_FORMAT_UNKNOWN;
 	GError *error = NULL;
@@ -226,6 +226,7 @@ test_is_pkcs12 (const char *path, gboolean expect_fail)
 	if (expect_fail) {
 		g_assert_error (error, NM_CRYPTO_ERROR, NM_CRYPTO_ERROR_INVALID_DATA);
 		g_assert (!is_pkcs12);
+		g_clear_error (&error);
 	} else {
 		g_assert_no_error (error);
 		g_assert (is_pkcs12);
diff --git a/libnm-core/tests/test-general.c b/libnm-core/tests/test-general.c
index 04e2a8e654..2a091187a8 100644
--- a/libnm-core/tests/test-general.c
+++ b/libnm-core/tests/test-general.c
@@ -25,6 +25,7 @@
 #include <string.h>
 
 #include <nm-utils.h>
+#include "gsystem-local-alloc.h"
 
 #include "nm-setting-private.h"
 #include "nm-utils.h"
@@ -648,7 +649,7 @@ test_setting_ip4_config_address_data (void)
 static void
 test_setting_gsm_apn_spaces (void)
 {
-	NMSettingGsm *s_gsm;
+	gs_unref_object NMSettingGsm *s_gsm;
 	const char *tmp;
 
 	s_gsm = (NMSettingGsm *) nm_setting_gsm_new ();
@@ -676,7 +677,7 @@ test_setting_gsm_apn_spaces (void)
 static void
 test_setting_gsm_apn_bad_chars (void)
 {
-	NMSettingGsm *s_gsm;
+	gs_unref_object NMSettingGsm *s_gsm;
 
 	s_gsm = (NMSettingGsm *) nm_setting_gsm_new ();
 	ASSERT (s_gsm != NULL,
@@ -714,7 +715,7 @@ test_setting_gsm_apn_bad_chars (void)
 static void
 test_setting_gsm_apn_underscore (void)
 {
-	NMSettingGsm *s_gsm;
+	gs_unref_object NMSettingGsm *s_gsm;
 
 	s_gsm = (NMSettingGsm *) nm_setting_gsm_new ();
 	g_assert (s_gsm);
@@ -729,7 +730,7 @@ test_setting_gsm_apn_underscore (void)
 static void
 test_setting_gsm_without_number (void)
 {
-	NMSettingGsm *s_gsm;
+	gs_unref_object NMSettingGsm *s_gsm;
 
 	s_gsm = (NMSettingGsm *) nm_setting_gsm_new ();
 	g_assert (s_gsm);
@@ -1551,6 +1552,7 @@ test_connection_replace_settings_bad (void)
 	connection = new_test_connection ();
 	success = nm_connection_replace_settings (connection, new_settings, &error);
 	g_assert_error (error, NM_CONNECTION_ERROR, NM_CONNECTION_ERROR_INVALID_SETTING);
+	g_clear_error (&error);
 	g_assert (!success);
 
 	g_assert (nm_connection_verify (connection, NULL));
@@ -2388,7 +2390,7 @@ test_connection_bad_base_types (void)
 static void
 test_setting_compare_id (void)
 {
-	NMSetting *old, *new;
+	gs_unref_object NMSetting *old, *new;
 	gboolean success;
 
 	old = nm_setting_connection_new ();
@@ -2412,7 +2414,7 @@ test_setting_compare_id (void)
 static void
 test_setting_compare_timestamp (void)
 {
-	NMSetting *old, *new;
+	gs_unref_object NMSetting *old, *new;
 	gboolean success;
 
 	old = nm_setting_connection_new ();
@@ -2457,7 +2459,7 @@ static void
 test_setting_compare_secrets (gconstpointer test_data)
 {
 	const TestDataCompareSecrets *data = test_data;
-	NMSetting *old, *new;
+	gs_unref_object NMSetting *old, *new;
 	gboolean success;
 
 	/* Make sure that a connection with transient/unsaved secrets compares
@@ -2488,7 +2490,7 @@ static void
 test_setting_compare_vpn_secrets (gconstpointer test_data)
 {
 	const TestDataCompareSecrets *data = test_data;
-	NMSetting *old, *new;
+	gs_unref_object NMSetting *old, *new;
 	gboolean success;
 
 	/* Make sure that a connection with transient/unsaved secrets compares
@@ -2764,7 +2766,7 @@ test_setting_connection_changed_signal (void)
 	NMConnection *connection;
 	gboolean changed = FALSE;
 	NMSettingConnection *s_con;
-	char *uuid;
+	gs_free char *uuid;
 
 	connection = nm_simple_connection_new ();
 	g_signal_connect (connection,
@@ -3170,7 +3172,7 @@ test_setting_802_1x_changed_signal (void)
 static void
 test_setting_old_uuid (void)
 {
-	NMSetting *setting;
+	gs_unref_object NMSetting *setting;
 
 	/* NetworkManager-0.9.4.0 generated 40-character UUIDs with no dashes,
 	 * like this one. Test that we maintain compatibility. */
@@ -3879,6 +3881,7 @@ test_setting_ip6_gateway (void)
 	value = g_variant_lookup_value (ip6_dict, NM_SETTING_IP_CONFIG_GATEWAY, G_VARIANT_TYPE_STRING);
 	g_assert (value != NULL);
 	g_assert_cmpstr (g_variant_get_string (value, NULL), ==, "abcd::1");
+	g_variant_unref (value);
 
 	value = g_variant_lookup_value (ip6_dict, NM_SETTING_IP_CONFIG_ADDRESSES, G_VARIANT_TYPE ("a(ayuay)"));
 	g_assert (value != NULL);
@@ -3975,6 +3978,7 @@ test_hexstr2bin (void)
 			g_assert (b);
 			g_assert_cmpint (g_bytes_get_size (b), ==, items[i].expected_len);
 			g_assert (memcmp (g_bytes_get_data (b, NULL), items[i].expected, g_bytes_get_size (b)) == 0);
+			g_bytes_unref (b);
 		} else
 			g_assert (b == NULL);
 	}
diff --git a/libnm-core/tests/test-secrets.c b/libnm-core/tests/test-secrets.c
index 1254dfffed..a915ae7d4e 100644
--- a/libnm-core/tests/test-secrets.c
+++ b/libnm-core/tests/test-secrets.c
@@ -176,6 +176,7 @@ test_need_tls_secrets_path (void)
 			"need-tls-secrets-path-key-password",
 			"expected to require private key password, but it wasn't");
 
+	g_ptr_array_free (hints, TRUE);
 	g_object_unref (connection);
 }
 
@@ -219,6 +220,7 @@ test_need_tls_secrets_blob (void)
 			"need-tls-secrets-blob-key-password",
 			"expected to require private key password, but it wasn't");
 
+	g_ptr_array_free (hints, TRUE);
 	g_object_unref (connection);
 }
 
@@ -345,6 +347,7 @@ test_need_tls_phase2_secrets_path (void)
 			"need-tls-phase2-secrets-path-key-password",
 			"expected to require private key password, but it wasn't");
 
+	g_ptr_array_free (hints, TRUE);
 	g_object_unref (connection);
 }
 
@@ -389,6 +392,7 @@ test_need_tls_phase2_secrets_blob (void)
 			"need-tls-phase2-secrets-blob-key-password",
 			"expected to require private key password, but it wasn't");
 
+	g_ptr_array_free (hints, TRUE);
 	g_object_unref (connection);
 }
 
@@ -559,8 +563,8 @@ test_update_secrets_wifi_bad_setting_name (void)
 	g_assert_error (error, NM_CONNECTION_ERROR, NM_CONNECTION_ERROR_SETTING_NOT_FOUND);
 	g_assert (success == FALSE);
 
+	g_clear_error (&error);
 	g_variant_unref (secrets);
-
 	g_object_unref (connection);
 }
 
@@ -668,6 +672,7 @@ test_update_secrets_whole_connection_bad_setting (void)
 	g_assert_error (error, NM_CONNECTION_ERROR, NM_CONNECTION_ERROR_SETTING_NOT_FOUND);
 	g_assert (success == FALSE);
 
+	g_clear_error (&error);
 	g_variant_unref (copy);
 	g_object_unref (connection);
 }
diff --git a/libnm-core/tests/test-setting-8021x.c b/libnm-core/tests/test-setting-8021x.c
index 637ab81c1c..992379c7a2 100644
--- a/libnm-core/tests/test-setting-8021x.c
+++ b/libnm-core/tests/test-setting-8021x.c
@@ -186,6 +186,7 @@ test_phase2_private_key_import (const char *path,
 		g_object_get (s_8021x, NM_SETTING_802_1X_PHASE2_PRIVATE_KEY, &tmp_key, NULL);
 		ASSERT (tmp_key != NULL, "phase2-private-key-import", "missing private key value");
 		check_scheme_path (tmp_key, path);
+		g_bytes_unref (tmp_key);
 	} else
 		g_assert_not_reached ();
 
@@ -245,6 +246,7 @@ test_wrong_password_keeps_data (const char *path, const char *password)
 	        "wrong-password-keeps-data", "unexpected missing error");
 	ASSERT (format == NM_SETTING_802_1X_CK_FORMAT_UNKNOWN,
 	        "wrong-password-keeps-data", "unexpected success reading private key format");
+	g_clear_error (&error);
 
 	/* Make sure the password hasn't changed */
 	pw = nm_setting_802_1x_get_private_key_password (s_8021x);
@@ -342,6 +344,7 @@ test_wrong_phase2_password_keeps_data (const char *path, const char *password)
 	        "wrong-phase2-password-keeps-data", "unexpected missing error");
 	ASSERT (format == NM_SETTING_802_1X_CK_FORMAT_UNKNOWN,
 	        "wrong-phase2-password-keeps-data", "unexpected success reading private key format");
+	g_clear_error (&error);
 
 	/* Make sure the password hasn't changed */
 	pw = nm_setting_802_1x_get_phase2_private_key_password (s_8021x);
diff --git a/libnm-core/tests/test-setting-dcb.c b/libnm-core/tests/test-setting-dcb.c
index 8adab8ce88..2265db8905 100644
--- a/libnm-core/tests/test-setting-dcb.c
+++ b/libnm-core/tests/test-setting-dcb.c
@@ -28,6 +28,7 @@
 #include "nm-setting-dcb.h"
 #include "nm-connection.h"
 #include "nm-errors.h"
+#include "gsystem-local-alloc.h"
 
 #define DCB_FLAGS_ALL (NM_SETTING_DCB_FLAG_ENABLE | \
                        NM_SETTING_DCB_FLAG_ADVERTISE | \
@@ -36,7 +37,7 @@
 static void
 test_dcb_flags_valid (void)
 {
-	NMSettingDcb *s_dcb;
+	gs_unref_object NMSettingDcb *s_dcb;
 	GError *error = NULL;
 	gboolean success;
 	guint i;
@@ -89,7 +90,7 @@ test_dcb_flags_valid (void)
 static void
 test_dcb_flags_invalid (void)
 {
-	NMSettingDcb *s_dcb;
+	gs_unref_object NMSettingDcb *s_dcb;
 	GError *error = NULL;
 	gboolean success;
 
@@ -148,7 +149,7 @@ test_dcb_flags_invalid (void)
 static void
 test_dcb_app_priorities (void)
 {
-	NMSettingDcb *s_dcb;
+	gs_unref_object NMSettingDcb *s_dcb;
 	GError *error = NULL;
 	gboolean success;
 
@@ -210,7 +211,7 @@ test_dcb_app_priorities (void)
 static void
 test_dcb_priorities_valid (void)
 {
-	NMSettingDcb *s_dcb;
+	gs_unref_object NMSettingDcb *s_dcb;
 	GError *error = NULL;
 	gboolean success;
 	guint i;
@@ -269,7 +270,7 @@ test_dcb_priorities_valid (void)
 static void
 test_dcb_bandwidth_sums (void)
 {
-	NMSettingDcb *s_dcb;
+	gs_unref_object NMSettingDcb *s_dcb;
 	GError *error = NULL;
 	gboolean success;
 
diff --git a/libnm-glib/tests/Makefile.am b/libnm-glib/tests/Makefile.am
index 7b8f3627e2..6ce91dd931 100644
--- a/libnm-glib/tests/Makefile.am
+++ b/libnm-glib/tests/Makefile.am
@@ -12,6 +12,11 @@ AM_CPPFLAGS = \
 
 noinst_PROGRAMS = $(TESTS)
 
+if WITH_VALGRIND
+@VALGRIND_RULES@ --launch-dbus
+else
+TESTS_ENVIRONMENT = $(srcdir)/libnm-test-launch.sh
+endif
 TESTS = test-nm-client test-remote-settings-client
 
 ####### NMClient and non-settings tests #######
@@ -42,8 +47,6 @@ test_remote_settings_client_LDADD = \
 
 ###########################################
 
-TESTS_ENVIRONMENT = $(srcdir)/libnm-glib-test-launch.sh
-
 endif
 
 EXTRA_DIST = libnm-glib-test-launch.sh
diff --git a/libnm-glib/tests/test-remote-settings-client.c b/libnm-glib/tests/test-remote-settings-client.c
index 237e287f85..a109f8df4a 100644
--- a/libnm-glib/tests/test-remote-settings-client.c
+++ b/libnm-glib/tests/test-remote-settings-client.c
@@ -36,6 +36,7 @@
 
 #include "nm-remote-settings.h"
 #include "common.h"
+#include "gsystem-local-alloc.h"
 
 static NMTestServiceInfo *sinfo;
 static NMRemoteSettings *settings = NULL;
@@ -63,7 +64,7 @@ add_cb (NMRemoteSettings *s,
 static void
 test_add_connection (void)
 {
-	NMConnection *connection;
+	gs_unref_object NMConnection *connection = NULL;
 	NMSettingConnection *s_con;
 	NMSettingWired *s_wired;
 	char *uuid;
@@ -256,6 +257,7 @@ test_make_visible (void)
 			break;
 		}
 	}
+	g_slist_free (list);
 	g_assert (found == TRUE);
 
 	g_free (path);
@@ -298,6 +300,7 @@ test_remove_connection (void)
 	g_assert_cmpint (g_slist_length (list), >, 0);
 
 	connection = NM_REMOTE_CONNECTION (list->data);
+	g_slist_free (list);
 	g_assert (connection);
 	g_assert (remote == connection);
 	path = g_strdup (nm_connection_get_path (NM_CONNECTION (connection)));
@@ -329,6 +332,7 @@ test_remove_connection (void)
 		g_assert ((gpointer) connection != (gpointer) candidate);
 		g_assert_cmpstr (path, ==, nm_connection_get_path (candidate));
 	}
+	g_slist_free (list);
 
 	g_free (path);
 	g_object_unref (proxy);
diff --git a/libnm-util/nm-connection.c b/libnm-util/nm-connection.c
index a1350f5445..3a929b045f 100644
--- a/libnm-util/nm-connection.c
+++ b/libnm-util/nm-connection.c
@@ -1241,7 +1241,7 @@ nm_connection_to_hash (NMConnection *connection, NMSettingHashFlags flags)
 	g_return_val_if_fail (NM_IS_CONNECTION (connection), NULL);
 
 	ret = g_hash_table_new_full (g_str_hash, g_str_equal,
-	                             g_free, (GDestroyNotify) g_hash_table_destroy);
+	                             g_free, (GDestroyNotify) g_hash_table_unref);
 
 	priv = NM_CONNECTION_GET_PRIVATE (connection);
 
diff --git a/libnm-util/nm-setting-dcb.c b/libnm-util/nm-setting-dcb.c
index 2376581e76..89ee387852 100644
--- a/libnm-util/nm-setting-dcb.c
+++ b/libnm-util/nm-setting-dcb.c
@@ -78,7 +78,7 @@ NM_SETTING_REGISTER_TYPE (NM_TYPE_SETTING_DCB)
 typedef struct {
 	NMSettingDcbFlags app_fcoe_flags;
 	gint              app_fcoe_priority;
-	const char *      app_fcoe_mode;
+	char *            app_fcoe_mode;
 
 	NMSettingDcbFlags app_iscsi_flags;
 	gint              app_iscsi_priority;
@@ -833,6 +833,7 @@ set_property (GObject *object, guint prop_id,
 		priv->app_fcoe_priority = g_value_get_int (value);
 		break;
 	case PROP_APP_FCOE_MODE:
+		g_free (priv->app_fcoe_mode);
 		priv->app_fcoe_mode = g_value_dup_string (value);
 		break;
 	case PROP_APP_ISCSI_FLAGS:
@@ -945,6 +946,16 @@ get_property (GObject *object, guint prop_id,
 }
 
 static void
+finalize (GObject *object)
+{
+	NMSettingDcbPrivate *priv = NM_SETTING_DCB_GET_PRIVATE (object);
+
+	g_free (priv->app_fcoe_mode);
+
+	G_OBJECT_CLASS (nm_setting_dcb_parent_class)->finalize (object);
+}
+
+static void
 nm_setting_dcb_class_init (NMSettingDcbClass *setting_class)
 {
 	GObjectClass *object_class = G_OBJECT_CLASS (setting_class);
@@ -955,6 +966,7 @@ nm_setting_dcb_class_init (NMSettingDcbClass *setting_class)
 	/* virtual methods */
 	object_class->set_property = set_property;
 	object_class->get_property = get_property;
+	object_class->finalize = finalize;
 	parent_class->verify       = verify;
 
 	/* Properties */
diff --git a/libnm-util/nm-setting-team-port.c b/libnm-util/nm-setting-team-port.c
index 6bc71c981d..9992f58a28 100644
--- a/libnm-util/nm-setting-team-port.c
+++ b/libnm-util/nm-setting-team-port.c
@@ -130,6 +130,7 @@ set_property (GObject *object, guint prop_id,
 
 	switch (prop_id) {
 	case PROP_CONFIG:
+		g_free (priv->config);
 		priv->config = g_value_dup_string (value);
 		break;
 	default:
@@ -155,6 +156,16 @@ get_property (GObject *object, guint prop_id,
 }
 
 static void
+finalize (GObject *object)
+{
+	NMSettingTeamPortPrivate *priv = NM_SETTING_TEAM_PORT_GET_PRIVATE (object);
+
+	g_free (priv->config);
+
+	G_OBJECT_CLASS (nm_setting_team_port_parent_class)->finalize (object);
+}
+
+static void
 nm_setting_team_port_class_init (NMSettingTeamPortClass *setting_class)
 {
 	GObjectClass *object_class = G_OBJECT_CLASS (setting_class);
@@ -165,6 +176,7 @@ nm_setting_team_port_class_init (NMSettingTeamPortClass *setting_class)
 	/* virtual methods */
 	object_class->set_property = set_property;
 	object_class->get_property = get_property;
+	object_class->finalize = finalize;
 	parent_class->verify       = verify;
 
 	/* Properties */
diff --git a/libnm-util/nm-setting-wired.c b/libnm-util/nm-setting-wired.c
index 8d927921db..aba5fb9831 100644
--- a/libnm-util/nm-setting-wired.c
+++ b/libnm-util/nm-setting-wired.c
@@ -474,27 +474,24 @@ nm_setting_wired_get_s390_option (NMSettingWired *setting,
                                   const char **out_key,
                                   const char **out_value)
 {
-	NMSettingWiredPrivate *priv;
-	guint32 num_keys;
-	GList *keys;
-	const char *_key = NULL, *_value = NULL;
+	const char *_key, *_value;
+	GHashTableIter iter;
+	guint i = 0;
 
 	g_return_val_if_fail (NM_IS_SETTING_WIRED (setting), FALSE);
 
-	priv = NM_SETTING_WIRED_GET_PRIVATE (setting);
-
-	num_keys = nm_setting_wired_get_num_s390_options (setting);
-	g_return_val_if_fail (idx < num_keys, FALSE);
-
-	keys = g_hash_table_get_keys (priv->s390_options);
-	_key = g_list_nth_data (keys, idx);
-	_value = g_hash_table_lookup (priv->s390_options, _key);
-
-	if (out_key)
-		*out_key = _key;
-	if (out_value)
-		*out_value = _value;
-	return TRUE;
+	g_hash_table_iter_init (&iter, NM_SETTING_WIRED_GET_PRIVATE (setting)->s390_options);
+	while (g_hash_table_iter_next (&iter, (gpointer) &_key, (gpointer) &_value)) {
+		if (i == idx) {
+			if (out_key)
+				*out_key = _key;
+			if (out_value)
+				*out_value = _value;
+			return TRUE;
+		}
+		i++;
+	}
+	g_return_val_if_reached (FALSE);
 }
 
 /**
diff --git a/libnm-util/tests/Makefile.am b/libnm-util/tests/Makefile.am
index 690bdbf65a..16a7f8f3fc 100644
--- a/libnm-util/tests/Makefile.am
+++ b/libnm-util/tests/Makefile.am
@@ -10,6 +10,7 @@ AM_CPPFLAGS = \
 	-DBUILD_DIR=\"$(abs_builddir)\" \
 	-DTEST_CERT_DIR=\"$(top_srcdir)/libnm-core/tests/certs/\"
 
+@VALGRIND_RULES@
 TESTS = \
 	test-settings-defaults \
 	test-crypto \
diff --git a/libnm-util/tests/test-crypto.c b/libnm-util/tests/test-crypto.c
index 4bf2b3be74..960316d560 100644
--- a/libnm-util/tests/test-crypto.c
+++ b/libnm-util/tests/test-crypto.c
@@ -96,7 +96,7 @@ out:
 static void
 test_cert (gconstpointer test_data)
 {
-	char *path;
+	gs_free char *path;
 	GByteArray *array;
 	NMCryptoFileFormat format = NM_CRYPTO_FILE_FORMAT_UNKNOWN;
 	GError *error = NULL;
@@ -153,6 +153,7 @@ test_load_private_key (const char *path,
 		        "unexpected failure determining private key file '%s' "
 		        "type with invalid password (expected %d, got %d)",
 		        path, NM_CRYPTO_KEY_TYPE_UNKNOWN, key_type);
+		g_clear_error (&error);
 		return;
 	}
 
@@ -183,6 +184,7 @@ test_load_private_key (const char *path,
 		g_byte_array_free (decrypted, TRUE);
 	}
 
+	g_clear_error (&error);
 	g_byte_array_free (array, TRUE);
 }
 
@@ -207,6 +209,7 @@ test_load_pkcs12 (const char *path,
 			    "%d): %d %s",
 			    path, NM_CRYPTO_FILE_FORMAT_PKCS12, format, error->code, error->message);
 	}
+	g_clear_error (&error);
 }
 
 static void
diff --git a/libnm-util/tests/test-general.c b/libnm-util/tests/test-general.c
index f748fcf595..52508115fd 100644
--- a/libnm-util/tests/test-general.c
+++ b/libnm-util/tests/test-general.c
@@ -30,6 +30,7 @@
 #include <sys/resource.h>
 
 #include <nm-utils.h>
+#include "gsystem-local-alloc.h"
 
 #include "nm-setting-private.h"
 #include "nm-setting-connection.h"
@@ -310,6 +311,13 @@ test_setting_vpn_modify_during_foreach (void)
 	g_object_unref (s_vpn);
 }
 
+static void
+_g_value_array_free (void *ptr)
+{
+	if (ptr)
+		g_value_array_free ((GValueArray *) ptr);
+}
+
 #define OLD_DBUS_TYPE_G_IP6_ADDRESS (dbus_g_type_get_struct ("GValueArray", DBUS_TYPE_G_UCHAR_ARRAY, G_TYPE_UINT, G_TYPE_INVALID))
 #define OLD_DBUS_TYPE_G_ARRAY_OF_IP6_ADDRESS (dbus_g_type_get_collection ("GPtrArray", OLD_DBUS_TYPE_G_IP6_ADDRESS))
 
@@ -338,7 +346,7 @@ test_setting_ip6_config_old_address_array (void)
 
 	g_value_init (&written_value, OLD_DBUS_TYPE_G_ARRAY_OF_IP6_ADDRESS);
 
-	addresses = g_ptr_array_new ();
+	addresses = g_ptr_array_new_full (0, _g_value_array_free);
 	array = g_value_array_new (3);
 
 	/* IP address */
@@ -398,6 +406,7 @@ test_setting_ip6_config_old_address_array (void)
 	ASSERT (memcmp (ba->data, &gw[0], sizeof (gw)) == 0,
 	        "ip6-old-addr", "unexpected failure comparing gateways");
 
+	g_ptr_array_unref (addresses);
 	g_value_unset (&written_value);
 	g_value_unset (&read_value);
 	g_object_unref (s_ip6);
@@ -406,7 +415,7 @@ test_setting_ip6_config_old_address_array (void)
 static void
 test_setting_gsm_apn_spaces (void)
 {
-	NMSettingGsm *s_gsm;
+	gs_unref_object NMSettingGsm *s_gsm;
 	const char *tmp;
 
 	s_gsm = (NMSettingGsm *) nm_setting_gsm_new ();
@@ -434,7 +443,7 @@ test_setting_gsm_apn_spaces (void)
 static void
 test_setting_gsm_apn_bad_chars (void)
 {
-	NMSettingGsm *s_gsm;
+	gs_unref_object NMSettingGsm *s_gsm;
 
 	s_gsm = (NMSettingGsm *) nm_setting_gsm_new ();
 	ASSERT (s_gsm != NULL,
@@ -472,7 +481,7 @@ test_setting_gsm_apn_bad_chars (void)
 static void
 test_setting_gsm_apn_underscore (void)
 {
-	NMSettingGsm *s_gsm;
+	gs_unref_object NMSettingGsm *s_gsm;
 	GError *error = NULL;
 	gboolean success;
 
@@ -491,7 +500,7 @@ test_setting_gsm_apn_underscore (void)
 static void
 test_setting_gsm_without_number (void)
 {
-	NMSettingGsm *s_gsm;
+	gs_unref_object NMSettingGsm *s_gsm;
 	GError *error = NULL;
 	gboolean success;
 
@@ -1573,6 +1582,7 @@ test_connection_good_base_types (void)
 	              NM_SETTING_GSM_APN, "metered.billing.sucks",
 	              NULL);
 	nm_connection_add_setting (connection, setting);
+	g_clear_object (&connection);
 
 	/* CDMA connection */
 	connection = nm_connection_new ();
@@ -1671,7 +1681,7 @@ test_connection_bad_base_types (void)
 static void
 test_setting_compare_id (void)
 {
-	NMSetting *old, *new;
+	gs_unref_object NMSetting *old, *new;
 	gboolean success;
 
 	old = nm_setting_connection_new ();
@@ -1697,7 +1707,7 @@ test_setting_compare_secrets (NMSettingSecretFlags secret_flags,
                               NMSettingCompareFlags comp_flags,
                               gboolean remove_secret)
 {
-	NMSetting *old, *new;
+	gs_unref_object NMSetting *old, *new;
 	gboolean success;
 
 	/* Make sure that a connection with transient/unsaved secrets compares
@@ -1729,7 +1739,7 @@ test_setting_compare_vpn_secrets (NMSettingSecretFlags secret_flags,
                                   NMSettingCompareFlags comp_flags,
                                   gboolean remove_secret)
 {
-	NMSetting *old, *new;
+	gs_unref_object NMSetting *old, *new;
 	gboolean success;
 
 	/* Make sure that a connection with transient/unsaved secrets compares
@@ -1908,7 +1918,7 @@ test_setting_connection_changed_signal (void)
 	NMConnection *connection;
 	gboolean changed = FALSE;
 	NMSettingConnection *s_con;
-	char *uuid;
+	gs_free char *uuid;
 
 	connection = nm_connection_new ();
 	g_signal_connect (connection,
@@ -2318,7 +2328,7 @@ static void
 test_setting_old_uuid (void)
 {
 	GError *error = NULL;
-	NMSetting *setting;
+	gs_unref_object NMSetting *setting;
 	gboolean success;
 
 	/* NetworkManager-0.9.4.0 generated 40-character UUIDs with no dashes,
diff --git a/libnm-util/tests/test-secrets.c b/libnm-util/tests/test-secrets.c
index fb0ad4c7e5..a22edb0fb7 100644
--- a/libnm-util/tests/test-secrets.c
+++ b/libnm-util/tests/test-secrets.c
@@ -176,6 +176,7 @@ test_need_tls_secrets_path (void)
 			"need-tls-secrets-path-key-password",
 			"expected to require private key password, but it wasn't");
 
+	g_ptr_array_free (hints, TRUE);
 	g_object_unref (connection);
 }
 
@@ -219,6 +220,7 @@ test_need_tls_secrets_blob (void)
 			"need-tls-secrets-blob-key-password",
 			"expected to require private key password, but it wasn't");
 
+	g_ptr_array_free (hints, TRUE);
 	g_object_unref (connection);
 }
 
@@ -345,6 +347,7 @@ test_need_tls_phase2_secrets_path (void)
 			"need-tls-phase2-secrets-path-key-password",
 			"expected to require private key password, but it wasn't");
 
+	g_ptr_array_free (hints, TRUE);
 	g_object_unref (connection);
 }
 
@@ -389,6 +392,7 @@ test_need_tls_phase2_secrets_blob (void)
 			"need-tls-phase2-secrets-blob-key-password",
 			"expected to require private key password, but it wasn't");
 
+	g_ptr_array_free (hints, TRUE);
 	g_object_unref (connection);
 }
 
@@ -507,6 +511,7 @@ test_update_secrets_wifi_single_setting (void)
 	tmp = nm_setting_wireless_security_get_wep_key (s_wsec, 0);
 	g_assert_cmpstr (tmp, ==, wepkey);
 
+	g_hash_table_unref (secrets);
 	g_object_unref (connection);
 }
 
@@ -547,6 +552,7 @@ test_update_secrets_wifi_full_hash (void)
 	tmp = nm_setting_wireless_security_get_wep_key (s_wsec, 0);
 	g_assert_cmpstr (tmp, ==, wepkey);
 
+	g_hash_table_unref (all);
 	g_object_unref (connection);
 }
 
@@ -577,6 +583,8 @@ test_update_secrets_wifi_bad_setting_name (void)
 	g_assert_error (error, NM_CONNECTION_ERROR, NM_CONNECTION_ERROR_SETTING_NOT_FOUND);
 	g_assert (success == FALSE);
 
+	g_clear_error (&error);
+	g_hash_table_unref (secrets);
 	g_object_unref (connection);
 }
 
@@ -600,7 +608,7 @@ test_update_secrets_whole_connection (void)
 	secrets = nm_connection_to_hash (connection, NM_SETTING_HASH_FLAG_ALL);
 	wsec_hash = g_hash_table_lookup (secrets, NM_SETTING_WIRELESS_SECURITY_SETTING_NAME);
 	g_assert (wsec_hash);
-	g_hash_table_insert (wsec_hash, NM_SETTING_WIRELESS_SECURITY_WEP_KEY0, string_to_gvalue (wepkey));
+	g_hash_table_insert (wsec_hash, g_strdup (NM_SETTING_WIRELESS_SECURITY_WEP_KEY0), string_to_gvalue (wepkey));
 
 	success = nm_connection_update_secrets (connection, NULL, secrets, &error);
 	g_assert_no_error (error);
@@ -610,6 +618,7 @@ test_update_secrets_whole_connection (void)
 	g_assert (s_wsec);
 	g_assert_cmpstr (nm_setting_wireless_security_get_wep_key (s_wsec, 0), ==, wepkey);
 
+	g_hash_table_unref (secrets);
 	g_object_unref (connection);
 }
 
@@ -629,6 +638,7 @@ test_update_secrets_whole_connection_empty_hash (void)
 	g_assert_no_error (error);
 	g_assert (success == TRUE);
 	g_object_unref (connection);
+	g_hash_table_unref (secrets);
 }
 
 static void
@@ -650,20 +660,23 @@ test_update_secrets_whole_connection_bad_setting (void)
 	secrets = nm_connection_to_hash (connection, NM_SETTING_HASH_FLAG_ALL);
 	wsec_hash = g_hash_table_lookup (secrets, NM_SETTING_WIRELESS_SECURITY_SETTING_NAME);
 	g_assert (wsec_hash);
-	g_hash_table_insert (wsec_hash, NM_SETTING_WIRELESS_SECURITY_WEP_KEY0, string_to_gvalue (wepkey));
+	g_hash_table_insert (wsec_hash, g_strdup (NM_SETTING_WIRELESS_SECURITY_WEP_KEY0), string_to_gvalue (wepkey));
 
 	/* Steal the wsec setting hash so it's not deallocated, and stuff it back
 	 * in with a different name so we ensure libnm-util is returning the right
 	 * error when it finds an entry in the connection hash that doesn't match
 	 * any setting in the connection.
 	 */
-	g_hash_table_steal (secrets, NM_SETTING_WIRELESS_SECURITY_SETTING_NAME);
-	g_hash_table_insert (secrets, "asdfasdfasdfasdf", wsec_hash);
+	g_hash_table_ref (wsec_hash);
+	g_hash_table_remove (secrets, NM_SETTING_WIRELESS_SECURITY_SETTING_NAME);
+	g_hash_table_insert (secrets, g_strdup ("asdfasdfasdfasdf"), wsec_hash);
 
 	success = nm_connection_update_secrets (connection, NULL, secrets, &error);
 	g_assert_error (error, NM_CONNECTION_ERROR, NM_CONNECTION_ERROR_SETTING_NOT_FOUND);
 	g_assert (success == FALSE);
 
+	g_clear_error (&error);
+	g_hash_table_destroy (secrets);
 	g_object_unref (connection);
 }
 
@@ -716,6 +729,7 @@ test_update_secrets_null_setting_name_with_setting_hash (void)
 	g_assert_error (error, NM_CONNECTION_ERROR, NM_CONNECTION_ERROR_SETTING_NOT_FOUND);
 	g_assert (!success);
 
+	g_clear_error (&error);
 	g_hash_table_destroy (secrets);
 	g_object_unref (connection);
 }
diff --git a/libnm-util/tests/test-setting-8021x.c b/libnm-util/tests/test-setting-8021x.c
index 4b37d92b78..dfc07a8055 100644
--- a/libnm-util/tests/test-setting-8021x.c
+++ b/libnm-util/tests/test-setting-8021x.c
@@ -188,6 +188,7 @@ test_phase2_private_key_import (const char *path,
 		g_object_get (s_8021x, NM_SETTING_802_1X_PHASE2_PRIVATE_KEY, &tmp_key, NULL);
 		ASSERT (tmp_key != NULL, "phase2-private-key-import", "missing private key value");
 		check_scheme_path (tmp_key, path);
+		g_byte_array_free (tmp_key, TRUE);
 	} else
 		g_assert_not_reached ();
 
@@ -249,6 +250,7 @@ test_wrong_password_keeps_data (const char *path, const char *password)
 	        "wrong-password-keeps-data", "unexpected missing error");
 	ASSERT (format == NM_SETTING_802_1X_CK_FORMAT_UNKNOWN,
 	        "wrong-password-keeps-data", "unexpected success reading private key format");
+	g_clear_error (&error);
 
 	/* Make sure the password hasn't changed */
 	pw = nm_setting_802_1x_get_private_key_password (s_8021x);
@@ -346,6 +348,7 @@ test_wrong_phase2_password_keeps_data (const char *path, const char *password)
 	        "wrong-phase2-password-keeps-data", "unexpected missing error");
 	ASSERT (format == NM_SETTING_802_1X_CK_FORMAT_UNKNOWN,
 	        "wrong-phase2-password-keeps-data", "unexpected success reading private key format");
+	g_clear_error (&error);
 
 	/* Make sure the password hasn't changed */
 	pw = nm_setting_802_1x_get_phase2_private_key_password (s_8021x);
diff --git a/libnm-util/tests/test-setting-dcb.c b/libnm-util/tests/test-setting-dcb.c
index 1c7d78b8c8..c40ef54ad1 100644
--- a/libnm-util/tests/test-setting-dcb.c
+++ b/libnm-util/tests/test-setting-dcb.c
@@ -26,6 +26,7 @@
 #include <nm-utils.h>
 #include <nm-glib-compat.h>
 #include "nm-setting-dcb.h"
+#include "gsystem-local-alloc.h"
 
 #define DCB_FLAGS_ALL (NM_SETTING_DCB_FLAG_ENABLE | \
                        NM_SETTING_DCB_FLAG_ADVERTISE | \
@@ -34,7 +35,7 @@
 static void
 test_dcb_flags_valid (void)
 {
-	NMSettingDcb *s_dcb;
+	gs_unref_object NMSettingDcb *s_dcb;
 	GError *error = NULL;
 	gboolean success;
 	guint i;
@@ -87,7 +88,7 @@ test_dcb_flags_valid (void)
 static void
 test_dcb_flags_invalid (void)
 {
-	NMSettingDcb *s_dcb;
+	gs_unref_object NMSettingDcb *s_dcb;
 	GError *error = NULL;
 	gboolean success;
 
@@ -146,7 +147,7 @@ test_dcb_flags_invalid (void)
 static void
 test_dcb_app_priorities (void)
 {
-	NMSettingDcb *s_dcb;
+	gs_unref_object NMSettingDcb *s_dcb;
 	GError *error = NULL;
 	gboolean success;
 
@@ -208,7 +209,7 @@ test_dcb_app_priorities (void)
 static void
 test_dcb_priorities_valid (void)
 {
-	NMSettingDcb *s_dcb;
+	gs_unref_object NMSettingDcb *s_dcb;
 	GError *error = NULL;
 	gboolean success;
 	guint i;
@@ -267,7 +268,7 @@ test_dcb_priorities_valid (void)
 static void
 test_dcb_bandwidth_sums (void)
 {
-	NMSettingDcb *s_dcb;
+	gs_unref_object NMSettingDcb *s_dcb;
 	GError *error = NULL;
 	gboolean success;
 
diff --git a/libnm/nm-dbus-helpers.c b/libnm/nm-dbus-helpers.c
index 7a99e70d25..6bfd4bbd83 100644
--- a/libnm/nm-dbus-helpers.c
+++ b/libnm/nm-dbus-helpers.c
@@ -349,6 +349,7 @@ _nm_dbus_bind_properties (gpointer object, gpointer skeleton)
 		                        skeleton, properties[i]->name,
 		                        G_BINDING_BIDIRECTIONAL | G_BINDING_SYNC_CREATE);
 	}
+	g_free (properties);
 }
 
 static char *
diff --git a/libnm/tests/Makefile.am b/libnm/tests/Makefile.am
index 38449fad07..56dd17d5f8 100644
--- a/libnm/tests/Makefile.am
+++ b/libnm/tests/Makefile.am
@@ -17,6 +17,11 @@ LDADD = \
 
 noinst_PROGRAMS = $(TESTS)
 
+if WITH_VALGRIND
+@VALGRIND_RULES@ --launch-dbus
+else
+TESTS_ENVIRONMENT = $(srcdir)/libnm-test-launch.sh
+endif
 TESTS = test-nm-client test-remote-settings-client test-secret-agent
 
 test_nm_client_SOURCES = \
@@ -33,9 +38,6 @@ test_secret_agent_SOURCES = \
 	common.c \
 	common.h \
 	test-secret-agent.c
-
-TESTS_ENVIRONMENT = $(srcdir)/libnm-test-launch.sh
-
 endif
 
 EXTRA_DIST = libnm-test-launch.sh
diff --git a/libnm/tests/test-remote-settings-client.c b/libnm/tests/test-remote-settings-client.c
index 8f9dc27f2e..15590fac1a 100644
--- a/libnm/tests/test-remote-settings-client.c
+++ b/libnm/tests/test-remote-settings-client.c
@@ -370,7 +370,7 @@ add_remove_cb (GObject *s,
 {
 	NMRemoteConnection *connection;
 	gboolean *done = user_data;
-	GError *error = NULL;
+	gs_free_error GError *error = NULL;
 
 	connection = nm_client_add_connection_finish (client, result, &error);
 	g_assert_error (error, NM_CLIENT_ERROR, NM_CLIENT_ERROR_OBJECT_CREATION_FAILED);
@@ -426,7 +426,7 @@ add_bad_cb (GObject *s,
             gpointer user_data)
 {
 	gboolean *done = user_data;
-	GError *error = NULL;
+	gs_free_error GError *error = NULL;
 
 	remote = nm_client_add_connection_finish (client, result, &error);
 	g_assert_error (error, NM_CONNECTION_ERROR, NM_CONNECTION_ERROR_INVALID_PROPERTY);
@@ -469,7 +469,7 @@ save_hostname_cb (GObject *s,
                   gpointer user_data)
 {
 	gboolean *done = user_data;
-	GError *error = NULL;
+	gs_free_error GError *error = NULL;
 
 	nm_client_save_hostname_finish (client, result, &error);
 	g_assert_no_error (error);
diff --git a/libnm/tests/test-secret-agent.c b/libnm/tests/test-secret-agent.c
index 0424b74e9b..dc1b9d6833 100644
--- a/libnm/tests/test-secret-agent.c
+++ b/libnm/tests/test-secret-agent.c
@@ -354,7 +354,7 @@ connection_activated_none_cb (GObject *c,
 {
 	TestSecretAgentData *sadata = user_data;
 	NMActiveConnection *ac;
-	GError *error = NULL;
+	gs_free_error GError *error = NULL;
 
 	ac = nm_client_activate_connection_finish (sadata->client, result, &error);
 	g_assert_error (error, NM_AGENT_MANAGER_ERROR, NM_AGENT_MANAGER_ERROR_NO_SECRETS);
@@ -399,8 +399,8 @@ connection_activated_no_secrets_cb (GObject *c,
                                     gpointer user_data)
 {
 	TestSecretAgentData *sadata = user_data;
-	NMActiveConnection *ac;
-	GError *error = NULL;
+	gs_unref_object NMActiveConnection *ac = NULL;
+	gs_free_error GError *error = NULL;
 
 	ac = nm_client_activate_connection_finish (sadata->client, result, &error);
 	g_assert_error (error, NM_AGENT_MANAGER_ERROR, NM_AGENT_MANAGER_ERROR_NO_SECRETS);
@@ -434,8 +434,8 @@ connection_activated_cancel_cb (GObject *c,
                                 gpointer user_data)
 {
 	TestSecretAgentData *sadata = user_data;
-	NMActiveConnection *ac;
-	GError *error = NULL;
+	gs_unref_object NMActiveConnection *ac;
+	gs_free_error GError *error = NULL;
 
 	ac = nm_client_activate_connection_finish (sadata->client, result, &error);
 	g_assert_error (error, NM_AGENT_MANAGER_ERROR, NM_AGENT_MANAGER_ERROR_USER_CANCELED);
diff --git a/src/devices/nm-device.c b/src/devices/nm-device.c
index 3bb65c487b..9df3712ed4 100644
--- a/src/devices/nm-device.c
+++ b/src/devices/nm-device.c
@@ -8323,7 +8323,7 @@ dispose (GObject *object)
 
 	_cleanup_generic_post (self, FALSE);
 
-	g_clear_pointer (&priv->ip6_saved_properties, g_hash_table_unref);
+	g_hash_table_remove_all (priv->ip6_saved_properties);
 
 	if (priv->recheck_assume_id) {
 		g_source_remove (priv->recheck_assume_id);
@@ -8339,8 +8339,7 @@ dispose (GObject *object)
 		priv->con_provider = NULL;
 	}
 
-	g_hash_table_unref (priv->available_connections);
-	priv->available_connections = NULL;
+	g_hash_table_remove_all (priv->available_connections);
 
 	if (priv->carrier_wait_id) {
 		g_source_remove (priv->carrier_wait_id);
@@ -8377,6 +8376,9 @@ finalize (GObject *object)
 	g_free (priv->type_desc);
 	g_free (priv->dhcp_anycast_address);
 
+	g_hash_table_unref (priv->ip6_saved_properties);
+	g_hash_table_unref (priv->available_connections);
+
 	G_OBJECT_CLASS (nm_device_parent_class)->finalize (object);
 }
 
diff --git a/src/devices/wifi/tests/Makefile.am b/src/devices/wifi/tests/Makefile.am
index 09c6401fef..2a7d784970 100644
--- a/src/devices/wifi/tests/Makefile.am
+++ b/src/devices/wifi/tests/Makefile.am
@@ -23,5 +23,6 @@ test_wifi_ap_utils_SOURCES = \
 
 test_wifi_ap_utils_LDADD = $(top_builddir)/src/libNetworkManager.la
 
+@VALGRIND_RULES@
 TESTS = test-wifi-ap-utils
 
diff --git a/src/dhcp-manager/nm-dhcp-utils.c b/src/dhcp-manager/nm-dhcp-utils.c
index 5aa25ff0c4..8cd4359abb 100644
--- a/src/dhcp-manager/nm-dhcp-utils.c
+++ b/src/dhcp-manager/nm-dhcp-utils.c
@@ -140,6 +140,7 @@ process_dhclient_rfc3442_route (const char **octets,
 			g_free (str_addr);
 			goto error;
 		}
+		g_free (str_addr);
 		tmp_addr &= nm_utils_ip4_prefix_to_netmask ((guint32) tmp);
 		route->network = tmp_addr;
 	}
diff --git a/src/dhcp-manager/tests/Makefile.am b/src/dhcp-manager/tests/Makefile.am
index 9dc5dcb13d..8aa79a29be 100644
--- a/src/dhcp-manager/tests/Makefile.am
+++ b/src/dhcp-manager/tests/Makefile.am
@@ -37,6 +37,7 @@ test_dhcp_utils_LDADD = \
 
 #################################
 
+@VALGRIND_RULES@
 TESTS = test-dhcp-dhclient test-dhcp-utils
 
 EXTRA_DIST = \
diff --git a/src/dhcp-manager/tests/test-dhcp-dhclient.c b/src/dhcp-manager/tests/test-dhcp-dhclient.c
index 4f7e96afde..848584aadf 100644
--- a/src/dhcp-manager/tests/test-dhcp-dhclient.c
+++ b/src/dhcp-manager/tests/test-dhcp-dhclient.c
@@ -430,6 +430,9 @@ test_one_duid (const char *escaped, const guint8 *unescaped, guint len)
 	g_assert (w);
 	g_assert_cmpint (strlen (escaped), ==, strlen (w));
 	g_assert_cmpstr (escaped, ==, w);
+
+	g_byte_array_free (t, TRUE);
+	g_free (w);
 }
 
 static void
diff --git a/src/dnsmasq-manager/tests/Makefile.am b/src/dnsmasq-manager/tests/Makefile.am
index c6ce1cdafc..b51de6aa5d 100644
--- a/src/dnsmasq-manager/tests/Makefile.am
+++ b/src/dnsmasq-manager/tests/Makefile.am
@@ -19,5 +19,6 @@ test_dnsmasq_utils_SOURCES = \
 test_dnsmasq_utils_LDADD = \
 	$(top_builddir)/src/libNetworkManager.la
 
+@VALGRIND_RULES@
 TESTS = test-dnsmasq-utils
 
diff --git a/src/nm-config-data.c b/src/nm-config-data.c
index f1a7bcfc62..270c302f12 100644
--- a/src/nm-config-data.c
+++ b/src/nm-config-data.c
@@ -286,6 +286,8 @@ finalize (GObject *gobject)
 	g_slist_free (priv->no_auto_default.specs);
 	g_strfreev (priv->no_auto_default.arr);
 
+	g_key_file_unref (priv->keyfile);
+
 	G_OBJECT_CLASS (nm_config_data_parent_class)->finalize (gobject);
 }
 
diff --git a/src/nm-config.c b/src/nm-config.c
index 03fca56b73..d28ed86fbb 100644
--- a/src/nm-config.c
+++ b/src/nm-config.c
@@ -471,8 +471,8 @@ read_config (GKeyFile *keyfile, const char *path, GError **error)
 
 			if (keys[k][len - 1] == '+') {
 				char *base_key = g_strndup (keys[k], len - 1);
-				const char *old_val = g_key_file_get_value (keyfile, groups[g], base_key, NULL);
-				const char *new_val = g_key_file_get_value (kf, groups[g], keys[k], NULL);
+				char *old_val = g_key_file_get_value (keyfile, groups[g], base_key, NULL);
+				char *new_val = g_key_file_get_value (kf, groups[g], keys[k], NULL);
 
 				if (old_val && *old_val) {
 					char *combined = g_strconcat (old_val, ",", new_val, NULL);
@@ -483,6 +483,8 @@ read_config (GKeyFile *keyfile, const char *path, GError **error)
 					g_key_file_set_value (keyfile, groups[g], base_key, new_val);
 
 				g_free (base_key);
+				g_free (old_val);
+				g_free (new_val);
 				continue;
 			}
 
diff --git a/src/platform/tests/Makefile.am b/src/platform/tests/Makefile.am
index b06e25e0ca..c10600eb51 100644
--- a/src/platform/tests/Makefile.am
+++ b/src/platform/tests/Makefile.am
@@ -109,7 +109,7 @@ test_cleanup_linux_CPPFLAGS = \
 	-DKERNEL_HACKS=1
 test_cleanup_linux_LDADD = $(PLATFORM_LDADD)
 
-#@VALGRIND_RULES@
+@VALGRIND_RULES@
 TESTS = test-link-fake test-address-fake test-route-fake test-cleanup-fake test-address-linux test-route-linux test-cleanup-linux
 
 
diff --git a/src/settings/plugins/ibft/reader.c b/src/settings/plugins/ibft/reader.c
index bcbfa33002..e3a0168a6c 100644
--- a/src/settings/plugins/ibft/reader.c
+++ b/src/settings/plugins/ibft/reader.c
@@ -178,6 +178,7 @@ done:
 	if (lines)
 		g_strfreev (lines);
 	g_free (out);
+	g_free (err);
 	if (success)
 		*out_blocks = blocks;
 	else
diff --git a/src/settings/plugins/ibft/tests/Makefile.am b/src/settings/plugins/ibft/tests/Makefile.am
index dd72220a76..3c7c94accd 100644
--- a/src/settings/plugins/ibft/tests/Makefile.am
+++ b/src/settings/plugins/ibft/tests/Makefile.am
@@ -32,6 +32,7 @@ test_ibft_SOURCES = \
 test_ibft_LDADD = \
 	$(top_builddir)/src/libNetworkManager.la
 
+@VALGRIND_RULES@
 TESTS = test-ibft
 
 endif
diff --git a/src/settings/plugins/ibft/tests/test-ibft.c b/src/settings/plugins/ibft/tests/test-ibft.c
index 2ff249af34..d5da9ec022 100644
--- a/src/settings/plugins/ibft/tests/test-ibft.c
+++ b/src/settings/plugins/ibft/tests/test-ibft.c
@@ -63,7 +63,7 @@ read_block (const char *iscsiadm_path, const char *expected_mac)
 	}
 	g_assert (block);
 
-	g_slist_foreach (blocks, (GFunc) g_ptr_array_unref, NULL);
+	g_slist_free_full (blocks, (GDestroyNotify) g_ptr_array_unref);
 	return block;
 }
 
@@ -110,6 +110,7 @@ test_read_ibft_dhcp (void)
 	g_assert_cmpstr (nm_setting_ip_config_get_method (s_ip4), ==, NM_SETTING_IP4_CONFIG_METHOD_AUTO);
 
 	g_object_unref (connection);
+	g_ptr_array_unref (block);
 }
 
 static void
@@ -266,7 +267,7 @@ test_read_ibft_vlan (void)
 	g_assert_cmpstr (nm_setting_ip_config_get_gateway (s_ip4), ==, NULL);
 
 	g_object_unref (connection);
-	g_ptr_array_ref (block);
+	g_ptr_array_unref (block);
 }
 
 NMTST_DEFINE ();
diff --git a/src/settings/plugins/ifcfg-rh/reader.c b/src/settings/plugins/ifcfg-rh/reader.c
index 1acfbe8eea..d13ba3dc4b 100644
--- a/src/settings/plugins/ifcfg-rh/reader.c
+++ b/src/settings/plugins/ifcfg-rh/reader.c
@@ -536,8 +536,6 @@ read_route_file_legacy (const char *filename, NMSettingIPConfig *s_ip4, GError *
 	char **lines = NULL, **iter;
 	GRegex *regex_to1, *regex_to2, *regex_via, *regex_metric;
 	GMatchInfo *match_info;
-	NMIPRoute *route = NULL;
-	char *dest = NULL, *prefix = NULL, *next_hop = NULL, *metric = NULL;
 	gint64 prefix_int, metric_int;
 	gboolean success = FALSE;
 
@@ -568,6 +566,9 @@ read_route_file_legacy (const char *filename, NMSettingIPConfig *s_ip4, GError *
 	/* Iterate through file lines */
 	lines = g_strsplit_set (contents, "\n\r", -1);
 	for (iter = lines; iter && *iter; iter++) {
+		gs_free char *next_hop = NULL, *dest = NULL;
+		char *prefix, *metric;
+		NMIPRoute *route;
 
 		/* Skip empty lines */
 		if (g_regex_match_simple (pattern_empty, *iter, 0, 0))
@@ -587,11 +588,10 @@ read_route_file_legacy (const char *filename, NMSettingIPConfig *s_ip4, GError *
 		}
 		dest = g_match_info_fetch (match_info, 1);
 		if (!strcmp (dest, "default"))
-			strcpy (dest, "0.0.0.0");
+			strcpy (dest,  "0.0.0.0");
 		if (!nm_utils_ipaddr_valid (AF_INET, dest)) {
 			g_set_error (error, NM_SETTINGS_ERROR, NM_SETTINGS_ERROR_INVALID_CONNECTION,
 			             "Invalid IP4 route destination address '%s'", dest);
-			g_free (dest);
 			g_match_info_free (match_info);
 			goto error;
 		}
@@ -606,7 +606,6 @@ read_route_file_legacy (const char *filename, NMSettingIPConfig *s_ip4, GError *
 			if (errno || prefix_int <= 0 || prefix_int > 32) {
 				g_set_error (error, NM_SETTINGS_ERROR, NM_SETTINGS_ERROR_INVALID_CONNECTION,
 				             "Invalid IP4 route destination prefix '%s'", prefix);
-				g_free (dest);
 				g_free (prefix);
 				goto error;
 			}
@@ -622,13 +621,10 @@ read_route_file_legacy (const char *filename, NMSettingIPConfig *s_ip4, GError *
 				             "Invalid IP4 route gateway address '%s'",
 				             next_hop);
 				g_match_info_free (match_info);
-				g_free (dest);
-				g_free (next_hop);
 				goto error;
 			}
 		} else {
 			/* we don't make distinction between missing GATEWAY IP and 0.0.0.0 */
-			next_hop = NULL;
 		}
 		g_match_info_free (match_info);
 
@@ -643,8 +639,6 @@ read_route_file_legacy (const char *filename, NMSettingIPConfig *s_ip4, GError *
 				g_match_info_free (match_info);
 				g_set_error (error, NM_SETTINGS_ERROR, NM_SETTINGS_ERROR_INVALID_CONNECTION,
 				             "Invalid IP4 route metric '%s'", metric);
-				g_free (dest);
-				g_free (next_hop);
 				g_free (metric);
 				goto error;
 			}
@@ -653,13 +647,11 @@ read_route_file_legacy (const char *filename, NMSettingIPConfig *s_ip4, GError *
 		g_match_info_free (match_info);
 
 		route = nm_ip_route_new (AF_INET, dest, prefix_int, next_hop, metric_int, error);
-		if (!route) {
-			g_free (dest);
-			g_free (next_hop);
+		if (!route)
 			goto error;
-		}
 		if (!nm_setting_ip_config_add_route (s_ip4, route))
 			PARSE_WARNING ("duplicate IP4 route");
+		nm_ip_route_unref (route);
 	}
 
 	success = TRUE;
@@ -667,8 +659,6 @@ read_route_file_legacy (const char *filename, NMSettingIPConfig *s_ip4, GError *
 error:
 	g_free (contents);
 	g_strfreev (lines);
-	if (route)
-		nm_ip_route_unref (route);
 	g_regex_unref (regex_to1);
 	g_regex_unref (regex_to2);
 	g_regex_unref (regex_via);
@@ -743,7 +733,6 @@ read_route6_file (const char *filename, NMSettingIPConfig *s_ip6, GError **error
 	char **lines = NULL, **iter;
 	GRegex *regex_to1, *regex_to2, *regex_via, *regex_metric;
 	GMatchInfo *match_info;
-	NMIPRoute *route = NULL;
 	char *dest = NULL, *prefix = NULL, *next_hop = NULL, *metric = NULL;
 	gint64 prefix_int, metric_int;
 	gboolean success = FALSE;
@@ -775,6 +764,7 @@ read_route6_file (const char *filename, NMSettingIPConfig *s_ip6, GError **error
 	/* Iterate through file lines */
 	lines = g_strsplit_set (contents, "\n\r", -1);
 	for (iter = lines; iter && *iter; iter++) {
+		NMIPRoute *route;
 
 		/* Skip empty lines */
 		if (g_regex_match_simple (pattern_empty, *iter, 0, 0))
@@ -864,6 +854,7 @@ read_route6_file (const char *filename, NMSettingIPConfig *s_ip6, GError **error
 			goto error;
 		if (!nm_setting_ip_config_add_route (s_ip6, route))
 			PARSE_WARNING ("duplicate IP6 route");
+		nm_ip_route_unref (route);
 	}
 
 	success = TRUE;
@@ -871,8 +862,6 @@ read_route6_file (const char *filename, NMSettingIPConfig *s_ip6, GError **error
 error:
 	g_free (contents);
 	g_strfreev (lines);
-	if (route)
-		nm_ip_route_unref (route);
 	g_regex_unref (regex_to1);
 	g_regex_unref (regex_to2);
 	g_regex_unref (regex_via);
@@ -3073,7 +3062,8 @@ make_wpa_setting (shvarFile *ifcfg,
 			if (psk) {
 				g_object_set (wsec, NM_SETTING_WIRELESS_SECURITY_PSK, psk, NULL);
 				g_free (psk);
-			}
+			} else if (error)
+				goto error;
 		}
 
 		if (adhoc)
@@ -4464,6 +4454,7 @@ make_vlan_setting (shvarFile *ifcfg,
 		goto error;
 	}
 	g_object_set (s_vlan, NM_SETTING_VLAN_PARENT, parent, NULL);
+	g_clear_pointer (&parent, g_free);
 
 	if (svTrueValue (ifcfg, "REORDER_HDR", FALSE))
 		vlan_flags |= NM_VLAN_FLAG_REORDER_HEADERS;
@@ -4482,6 +4473,8 @@ make_vlan_setting (shvarFile *ifcfg,
 	parse_prio_map_list (s_vlan, ifcfg, "VLAN_INGRESS_PRIORITY_MAP", NM_VLAN_INGRESS_MAP);
 	parse_prio_map_list (s_vlan, ifcfg, "VLAN_EGRESS_PRIORITY_MAP", NM_VLAN_EGRESS_MAP);
 
+	g_free (iface_name);
+
 	return (NMSetting *) s_vlan;
 
 error:
@@ -4655,7 +4648,8 @@ connection_from_file_full (const char *filename,
 {
 	NMConnection *connection = NULL;
 	shvarFile *parsed;
-	char *type, *devtype, *bootproto;
+	gs_free char *type = NULL;
+	char *devtype, *bootproto;
 	NMSetting *s_ip4, *s_ip6, *s_port, *s_dcb = NULL;
 	const char *ifcfg_name = NULL;
 
@@ -4699,8 +4693,6 @@ connection_from_file_full (const char *filename,
 	}
 	g_free (bootproto);
 
-	type = NULL;
-
 	devtype = svGetValue (parsed, "DEVICETYPE", FALSE);
 	if (devtype) {
 		if (!strcasecmp (devtype, TYPE_TEAM))
@@ -4788,7 +4780,6 @@ connection_from_file_full (const char *filename,
 			PARSE_WARNING ("connection type was unrecognized but device was not uniquely identified; device may be managed");
 		goto done;
 	}
-	g_free (type);
 
 	if (!connection)
 		goto done;
diff --git a/src/settings/plugins/ifcfg-rh/shvar.c b/src/settings/plugins/ifcfg-rh/shvar.c
index 6c9769b2c8..5f3d173b2a 100644
--- a/src/settings/plugins/ifcfg-rh/shvar.c
+++ b/src/settings/plugins/ifcfg-rh/shvar.c
@@ -372,10 +372,12 @@ svSetValue (shvarFile *s, const char *key, const char *value, gboolean verbatim)
 		if (oldval) {
 			/* delete line */
 			s->lineList = g_list_remove_link (s->lineList, s->current);
+			g_free (s->current->data);
 			g_list_free_1 (s->current);
 			s->modified = TRUE;
 		}
-		goto bail; /* do not need keyValue */
+		g_free (keyValue);
+		goto end;
 	}
 
 	if (!oldval) {
@@ -387,21 +389,19 @@ svSetValue (shvarFile *s, const char *key, const char *value, gboolean verbatim)
 
 	if (strcmp (oldval, newval) != 0) {
 		/* change line */
-		if (s->current)
+		if (s->current) {
+			g_free (s->current->data);
 			s->current->data = keyValue;
-		else
+		} else
 			s->lineList = g_list_append (s->lineList, keyValue);
 		s->modified = TRUE;
-	}
+	} else
+		g_free (keyValue);
 
  end:
 	g_free (newval);
 	g_free (oldval);
 	return;
-
- bail:
-	g_free (keyValue);
-	goto end;
 }
 
 /* Write the current contents iff modified.  Returns FALSE on error
diff --git a/src/settings/plugins/ifcfg-rh/tests/Makefile.am b/src/settings/plugins/ifcfg-rh/tests/Makefile.am
index 5a17ed9bb6..a3f6a05204 100644
--- a/src/settings/plugins/ifcfg-rh/tests/Makefile.am
+++ b/src/settings/plugins/ifcfg-rh/tests/Makefile.am
@@ -47,6 +47,7 @@ test_ifcfg_rh_utils_SOURCES = \
 test_ifcfg_rh_utils_LDADD = \
 	$(top_builddir)/src/libNetworkManager.la
 
+@VALGRIND_RULES@
 TESTS = test-ifcfg-rh-utils test-ifcfg-rh
 
 endif
diff --git a/src/settings/plugins/ifcfg-rh/tests/test-ifcfg-rh.c b/src/settings/plugins/ifcfg-rh/tests/test-ifcfg-rh.c
index 15cdf88f03..3bc4ba932e 100644
--- a/src/settings/plugins/ifcfg-rh/tests/test-ifcfg-rh.c
+++ b/src/settings/plugins/ifcfg-rh/tests/test-ifcfg-rh.c
@@ -377,7 +377,7 @@ test_read_unmanaged_unrecognized (void)
 {
 	NMConnection *connection;
 	NMSettingConnection *s_con;
-	char *unhandled_spec = NULL;
+	gs_free char *unhandled_spec = NULL;
 	GError *error = NULL;
 	const char *expected_id = "PigeonNet";
 	guint64 expected_timestamp = 0;
@@ -408,7 +408,7 @@ test_read_unrecognized (void)
 {
 	NMConnection *connection;
 	NMSettingConnection *s_con;
-	char *unhandled_spec = NULL;
+	gs_free char *unhandled_spec = NULL;
 	GError *error = NULL;
 	const char *expected_id = "U Can't Touch This";
 	guint64 expected_timestamp = 0;
@@ -5341,6 +5341,7 @@ test_read_wifi_band_a_channel_mismatch (void)
 	                                        NULL, TYPE_WIRELESS, NULL, &error);
 	g_assert (connection == NULL);
 	g_assert_error (error, NM_SETTINGS_ERROR, NM_SETTINGS_ERROR_INVALID_CONNECTION);
+	g_clear_error (&error);
 }
 
 static void
@@ -5353,6 +5354,7 @@ test_read_wifi_band_bg_channel_mismatch (void)
 	                                        NULL, TYPE_WIRELESS, NULL, &error);
 	g_assert (connection == NULL);
 	g_assert_error (error, NM_SETTINGS_ERROR, NM_SETTINGS_ERROR_INVALID_CONNECTION);
+	g_clear_error (&error);
 }
 
 #define TEST_IFCFG_WIRED_QETH_STATIC TEST_IFCFG_DIR"/network-scripts/ifcfg-test-wired-qeth-static"
@@ -9523,6 +9525,7 @@ test_write_wifi_wpa_then_wep_with_perms (void)
 	keyfile = utils_get_keys_path (testfile);
 	unlink (keyfile);
 	unlink (testfile);
+	g_free (keyfile);
 
 	g_free (testfile);
 	g_object_unref (reread);
@@ -10185,6 +10188,7 @@ test_write_wired_pppoe (void)
 	        "wired-pppoe-write", "unexpected success writing connection to disk");
 
 	g_object_unref (connection);
+	g_clear_error (&error);
 }
 
 static void
@@ -10247,6 +10251,7 @@ test_write_vpn (void)
 	        "vpn-write", "unexpected success writing connection to disk");
 
 	g_object_unref (connection);
+	g_clear_error (&error);
 }
 
 static void
@@ -10329,6 +10334,7 @@ test_write_mobile_broadband (gboolean gsm)
 	        "mobile-broadband-write", "unexpected success writing connection to disk");
 
 	g_object_unref (connection);
+	g_clear_error (&error);
 }
 
 #define TEST_IFCFG_BRIDGE_MAIN TEST_IFCFG_DIR"/network-scripts/ifcfg-test-bridge-main"
@@ -10955,6 +10961,7 @@ test_read_ibft_ignored (void)
 	                                        NULL, &error);
 	g_assert_error (error, NM_SETTINGS_ERROR, NM_SETTINGS_ERROR_INVALID_CONNECTION);
 	g_assert (connection == NULL);
+	g_clear_error (&error);
 }
 
 #define TEST_IFCFG_BOND_MAIN TEST_IFCFG_DIR"/network-scripts/ifcfg-test-bond-main"
@@ -11750,6 +11757,7 @@ test_read_dcb_bad_booleans (void)
 	g_assert_error (error, NM_SETTINGS_ERROR, NM_SETTINGS_ERROR_INVALID_CONNECTION);
 	g_assert (strstr (error->message, "invalid boolean digit"));
 	g_assert (connection == NULL);
+	g_clear_error (&error);
 }
 
 static void
@@ -11767,6 +11775,7 @@ test_read_dcb_short_booleans (void)
 	g_assert_error (error, NM_SETTINGS_ERROR, NM_SETTINGS_ERROR_INVALID_CONNECTION);
 	g_assert (strstr (error->message, "boolean array must be 8 characters"));
 	g_assert (connection == NULL);
+	g_clear_error (&error);
 }
 
 static void
@@ -11784,6 +11793,7 @@ test_read_dcb_bad_uints (void)
 	g_assert_error (error, NM_SETTINGS_ERROR, NM_SETTINGS_ERROR_INVALID_CONNECTION);
 	g_assert (strstr (error->message, "invalid uint digit"));
 	g_assert (connection == NULL);
+	g_clear_error (&error);
 }
 
 static void
@@ -11801,6 +11811,7 @@ test_read_dcb_short_uints (void)
 	g_assert_error (error, NM_SETTINGS_ERROR, NM_SETTINGS_ERROR_INVALID_CONNECTION);
 	g_assert (strstr (error->message, "uint array must be 8 characters"));
 	g_assert (connection == NULL);
+	g_clear_error (&error);
 }
 
 static void
@@ -11818,6 +11829,7 @@ test_read_dcb_bad_percent (void)
 	g_assert_error (error, NM_SETTINGS_ERROR, NM_SETTINGS_ERROR_INVALID_CONNECTION);
 	g_assert (strstr (error->message, "invalid percent element"));
 	g_assert (connection == NULL);
+	g_clear_error (&error);
 }
 
 static void
@@ -11835,6 +11847,7 @@ test_read_dcb_short_percent (void)
 	g_assert_error (error, NM_SETTINGS_ERROR, NM_SETTINGS_ERROR_INVALID_CONNECTION);
 	g_assert (strstr (error->message, "percent array must be 8 elements"));
 	g_assert (connection == NULL);
+	g_clear_error (&error);
 }
 
 static void
@@ -11852,6 +11865,7 @@ test_read_dcb_pgpct_not_100 (void)
 	g_assert_error (error, NM_SETTINGS_ERROR, NM_SETTINGS_ERROR_INVALID_CONNECTION);
 	g_assert (strstr (error->message, "invalid percentage sum"));
 	g_assert (connection == NULL);
+	g_clear_error (&error);
 }
 
 static void
@@ -12207,6 +12221,7 @@ test_write_team_port (void)
 	val = svGetValue (f, "TEAM_PORT_CONFIG", TRUE);
 	g_assert (val);
 	g_assert_cmpstr (val, ==, escaped_expected_config);
+	g_free (val);
 	val = svGetValue (f, "TEAM_MASTER", TRUE);
 	g_assert (val);
 	g_assert_cmpstr (val, ==, "team0");
diff --git a/src/settings/plugins/ifcfg-rh/writer.c b/src/settings/plugins/ifcfg-rh/writer.c
index 383bee0811..a746b2421c 100644
--- a/src/settings/plugins/ifcfg-rh/writer.c
+++ b/src/settings/plugins/ifcfg-rh/writer.c
@@ -44,6 +44,7 @@
 #include <nm-utils.h>
 
 #include "nm-logging.h"
+#include "gsystem-local-alloc.h"
 #include "common.h"
 #include "shvar.h"
 #include "reader.h"
@@ -2112,13 +2113,16 @@ static void
 write_ip4_aliases (NMConnection *connection, char *base_ifcfg_path)
 {
 	NMSettingIPConfig *s_ip4;
-	char *base_ifcfg_dir, *base_ifcfg_name, *base_name;
+	gs_free char *base_ifcfg_dir = NULL, *base_ifcfg_name = NULL;
+	const char*base_name;
 	int i, num, base_ifcfg_name_len, base_name_len;
 	GDir *dir;
 
 	base_ifcfg_dir = g_path_get_dirname (base_ifcfg_path);
 	base_ifcfg_name = g_path_get_basename (base_ifcfg_path);
 	base_ifcfg_name_len = strlen (base_ifcfg_name);
+	if (!g_str_has_prefix (base_ifcfg_name, IFCFG_TAG))
+		g_return_if_reached ();
 	base_name = base_ifcfg_name + strlen (IFCFG_TAG);
 	base_name_len = strlen (base_name);
 
@@ -2190,9 +2194,6 @@ write_ip4_aliases (NMConnection *connection, char *base_ifcfg_path)
 		svWriteFile (ifcfg, 0644, NULL);
 		svCloseFile (ifcfg);
 	}
-
-	g_free (base_ifcfg_name);
-	g_free (base_ifcfg_dir);
 }
 
 static gboolean
diff --git a/src/settings/plugins/ifupdown/tests/Makefile.am b/src/settings/plugins/ifupdown/tests/Makefile.am
index 24cdd95504..2e927db931 100644
--- a/src/settings/plugins/ifupdown/tests/Makefile.am
+++ b/src/settings/plugins/ifupdown/tests/Makefile.am
@@ -23,6 +23,8 @@ test_ifupdown_SOURCES = \
 test_ifupdown_LDADD = \
 	$(top_builddir)/src/libNetworkManager.la
 
+# TODO: enable valgrind for ifupdown. Currently it fails.
+#@VALGRIND_RULES@
 TESTS = test-ifupdown
 
 endif
diff --git a/src/settings/plugins/keyfile/reader.c b/src/settings/plugins/keyfile/reader.c
index 1575f01727..1a1d9663d3 100644
--- a/src/settings/plugins/keyfile/reader.c
+++ b/src/settings/plugins/keyfile/reader.c
@@ -869,6 +869,7 @@ parity_parser (NMSetting *setting, const char *key, GKeyFile *keyfile, const cha
 				int_val = 'X';
 			}
 		}
+		g_free (str_val);
 	}
 
 	if (!int_val)
diff --git a/src/settings/plugins/keyfile/tests/Makefile.am b/src/settings/plugins/keyfile/tests/Makefile.am
index 20b9820c9e..a79e20b5b6 100644
--- a/src/settings/plugins/keyfile/tests/Makefile.am
+++ b/src/settings/plugins/keyfile/tests/Makefile.am
@@ -34,6 +34,7 @@ test_keyfile_LDADD = \
 	$(DBUS_LIBS) \
 	$(CODE_COVERAGE_LDFLAGS)
 
+@VALGRIND_RULES@
 TESTS = test-keyfile
 
 endif
diff --git a/src/settings/plugins/keyfile/tests/test-keyfile.c b/src/settings/plugins/keyfile/tests/test-keyfile.c
index 51f9e2c882..28ab20c681 100644
--- a/src/settings/plugins/keyfile/tests/test-keyfile.c
+++ b/src/settings/plugins/keyfile/tests/test-keyfile.c
@@ -1515,6 +1515,7 @@ test_write_intlike_ssid (void)
 	g_assert_no_error (error);
 	g_assert (tmp);
 	g_assert_cmpstr (tmp, ==, "101");
+	g_free (tmp);
 
 	g_key_file_free (keyfile);
 
@@ -1601,6 +1602,7 @@ test_write_intlike_ssid_2 (void)
 	g_assert_no_error (error);
 	g_assert (tmp);
 	g_assert_cmpstr (tmp, ==, "11\\;12\\;13\\;");
+	g_free (tmp);
 
 	g_key_file_free (keyfile);
 
@@ -2511,6 +2513,7 @@ test_write_wired_8021x_tls_connection_path (void)
 	tmp2 = g_path_get_dirname (testfile);
 	if (g_strcmp0 (tmp2, TEST_KEYFILES_DIR) == 0)
 		relative = TRUE;
+	g_free (tmp2);
 
 	/* CA cert */
 	tmp = g_key_file_get_string (keyfile,
@@ -3098,6 +3101,7 @@ test_write_new_wired_group_name (void)
 	unlink (testfile);
 	g_free (testfile);
 
+	g_key_file_unref (kf);
 	g_object_unref (reread);
 	g_object_unref (connection);
 }
@@ -3236,6 +3240,7 @@ test_write_new_wireless_group_names (void)
 	unlink (testfile);
 	g_free (testfile);
 
+	g_key_file_unref (kf);
 	g_object_unref (reread);
 	g_object_unref (connection);
 }
diff --git a/src/supplicant-manager/tests/Makefile.am b/src/supplicant-manager/tests/Makefile.am
index 452ccdc1f7..85268dcff9 100644
--- a/src/supplicant-manager/tests/Makefile.am
+++ b/src/supplicant-manager/tests/Makefile.am
@@ -18,4 +18,5 @@ test_supplicant_config_SOURCES = \
 test_supplicant_config_LDADD = \
 	$(top_builddir)/src/libNetworkManager.la
 
+@VALGRIND_RULES@
 TESTS = test-supplicant-config
diff --git a/src/supplicant-manager/tests/test-supplicant-config.c b/src/supplicant-manager/tests/test-supplicant-config.c
index 5aa3fa2db6..9b9e392d25 100644
--- a/src/supplicant-manager/tests/test-supplicant-config.c
+++ b/src/supplicant-manager/tests/test-supplicant-config.c
@@ -111,7 +111,7 @@ test_wifi_open (void)
 	NMSettingConnection *s_con;
 	NMSettingWireless *s_wifi;
 	NMSettingIPConfig *s_ip4;
-	NMSupplicantConfig *config;
+	gs_unref_object NMSupplicantConfig *config;
 	GHashTable *hash;
 	char *uuid;
 	gboolean success;
@@ -191,6 +191,7 @@ test_wifi_open (void)
 	validate_opt ("wifi-open", hash, "bssid", TYPE_KEYWORD, bssid_str, -1);
 	validate_opt ("wifi-open", hash, "key_mgmt", TYPE_KEYWORD, "NONE", -1);
 
+	g_hash_table_unref (hash);
 	g_object_unref (connection);
 }
 
@@ -206,7 +207,7 @@ test_wifi_wep_key (const char *detail,
 	NMSettingWireless *s_wifi;
 	NMSettingWirelessSecurity *s_wsec;
 	NMSettingIPConfig *s_ip4;
-	NMSupplicantConfig *config;
+	gs_unref_object NMSupplicantConfig *config;
 	GHashTable *hash;
 	char *uuid;
 	gboolean success;
@@ -305,6 +306,7 @@ test_wifi_wep_key (const char *detail,
 	validate_opt (detail, hash, "wep_tx_keyidx", TYPE_INT, GINT_TO_POINTER (0), -1);
 	validate_opt (detail, hash, "wep_key0", TYPE_BYTES, expected, expected_size);
 
+	g_hash_table_unref (hash);
 	g_object_unref (connection);
 }
 
@@ -343,7 +345,7 @@ test_wifi_wpa_psk (const char *detail,
 	NMSettingWireless *s_wifi;
 	NMSettingWirelessSecurity *s_wsec;
 	NMSettingIPConfig *s_ip4;
-	NMSupplicantConfig *config;
+	gs_unref_object NMSupplicantConfig *config;
 	GHashTable *hash;
 	char *uuid;
 	gboolean success;
@@ -454,6 +456,7 @@ test_wifi_wpa_psk (const char *detail,
 	validate_opt (detail, hash, "group", TYPE_KEYWORD, "TKIP CCMP", -1);
 	validate_opt (detail, hash, "psk", key_type, expected, expected_size);
 
+	g_hash_table_unref (hash);
 	g_object_unref (connection);
 }
 
diff --git a/src/tests/Makefile.am b/src/tests/Makefile.am
index 65bc2199c6..a96d1ce910 100644
--- a/src/tests/Makefile.am
+++ b/src/tests/Makefile.am
@@ -86,6 +86,7 @@ EXTRA_DIST = test-secret-agent.py
 
 ###########################################
 
+@VALGRIND_RULES@
 TESTS = \
 	test-ip4-config \
 	test-ip6-config \
diff --git a/src/tests/config/Makefile.am b/src/tests/config/Makefile.am
index 66009c877b..42c6b9a1b0 100644
--- a/src/tests/config/Makefile.am
+++ b/src/tests/config/Makefile.am
@@ -23,6 +23,7 @@ test_config_SOURCES = \
 test_config_LDADD = \
 	$(top_builddir)/src/libNetworkManager.la
 
+@VALGRIND_RULES@
 TESTS = test-config
 
 EXTRA_DIST = \
diff --git a/src/tests/config/nm-test-device.c b/src/tests/config/nm-test-device.c
index 63067b25f6..512085e997 100644
--- a/src/tests/config/nm-test-device.c
+++ b/src/tests/config/nm-test-device.c
@@ -61,12 +61,6 @@ dispose (GObject *object)
 	g_object_class->dispose (object);
 }
 
-static void
-finalize (GObject *object)
-{
-	g_object_class->finalize (object);
-}
-
 static guint32
 get_generic_capabilities (NMDevice *device)
 {
@@ -84,7 +78,6 @@ nm_test_device_class_init (NMTestDeviceClass *klass)
 	object_class->constructor = constructor;
 	object_class->constructed = constructed;
 	object_class->dispose = dispose;
-	object_class->finalize = finalize;
 
 	device_class->get_generic_capabilities = get_generic_capabilities;
 }
diff --git a/src/tests/test-wired-defname.c b/src/tests/test-wired-defname.c
index a05588b8a4..1d83f3d1aa 100644
--- a/src/tests/test-wired-defname.c
+++ b/src/tests/test-wired-defname.c
@@ -26,6 +26,7 @@
 #include <nm-simple-connection.h>
 #include <nm-setting-connection.h>
 #include "nm-device-ethernet-utils.h"
+#include "gsystem-local-alloc.h"
 
 static NMConnection *
 _new_connection (const char *id)
@@ -45,7 +46,7 @@ _new_connection (const char *id)
 static void
 test_defname_no_connections (void)
 {
-	char *name;
+	gs_free char *name;
 
 	name = nm_device_ethernet_utils_get_default_wired_name (NULL);
 	g_assert_cmpstr (name, ==, "Wired connection 1");
@@ -57,7 +58,7 @@ static void
 test_defname_no_conflict (void)
 {
 	GSList *list = NULL;
-	char *name;
+	gs_free char *name;
 
 	list = g_slist_append (list, _new_connection ("asdfasdfasdfadf"));
 	list = g_slist_append (list, _new_connection ("work wifi"));
@@ -75,7 +76,7 @@ static void
 test_defname_conflict (void)
 {
 	GSList *list = NULL;
-	char *name;
+	gs_free char *name;
 
 	list = g_slist_append (list, _new_connection ("asdfasdfasdfadf"));
 	list = g_slist_append (list, _new_connection ("Wired connection 1"));
@@ -93,7 +94,7 @@ static void
 test_defname_multiple_conflicts (void)
 {
 	GSList *list = NULL;
-	char *name;
+	gs_free char *name;
 
 	list = g_slist_append (list, _new_connection ("random gsm connection"));
 	list = g_slist_append (list, _new_connection ("home wifi"));
diff --git a/tools/run-test-valgrind.sh b/tools/run-test-valgrind.sh
index 84659fc85b..fb8cb1482e 100755
--- a/tools/run-test-valgrind.sh
+++ b/tools/run-test-valgrind.sh
@@ -3,6 +3,14 @@
 LIBTOOL="$1"; shift
 VALGRIND="$1"; shift
 SUPPRESSIONS="$1"; shift
+if [ "$1" = "--launch-dbus" ]; then
+    # Spawn DBus if there's none
+    if [ -z "$DBUS_SESSION_BUS_ADDRESS" ]; then
+        eval `dbus-launch --sh-syntax`
+        trap "kill $DBUS_SESSION_BUS_PID" EXIT
+    fi
+    shift
+fi
 TEST="$1"; shift
 
 LOGFILE="valgrind-`echo "$TEST" | tr -cd '[:alpha:]-'`.log"
@@ -19,6 +27,11 @@ $LIBTOOL --mode=execute "$VALGRIND" \
 	"$TEST"
 RESULT=$?
 
+if [ $RESULT -eq 0 -a "$(wc -c "$LOGFILE" | awk '{print$1}')" -ne 0 ]; then
+	echo "valgrind succeeded, but log is not empty: $LOGFILE"
+	exit 1
+fi
+
 if [ $RESULT -ne 0 -a $RESULT -ne 77 ]; then
 	echo "Don't forget to check the valgrind log at '`realpath $LOGFILE`'." >&2
 fi
diff --git a/valgrind.suppressions b/valgrind.suppressions
index c418b4b617..f0dbda135d 100644
--- a/valgrind.suppressions
+++ b/valgrind.suppressions
@@ -129,3 +129,217 @@
    match-leak-kinds: possible
    fun:calloc
 }
+
+
+{
+   _glib_sigaction
+   Memcheck:Param
+   rt_sigaction(act->sa_flags)
+   fun:__libc_sigaction
+   fun:unref_unix_signal_handler_unlocked
+   fun:g_child_watch_finalize
+   fun:g_source_unref_internal
+   fun:g_main_context_dispatch
+   fun:g_main_context_iterate.isra.24
+   fun:g_main_loop_run
+   ...
+}
+
+{
+   # FIXME: dunny why this is needed. Clean up later.
+   _dispatcher_test
+   Memcheck:Leak
+   match-leak-kinds: definite
+   fun:malloc
+   fun:g_malloc
+   fun:g_slice_alloc
+   fun:g_variant_new_from_bytes
+   fun:g_variant_new_from_trusted
+   fun:parse_dhcp
+   fun:get_dispatcher_file
+   ...
+   fun:g_test_run_suite_internal
+   fun:g_test_run_suite_internal
+   fun:g_test_run_suite
+}
+
+{
+   _gdbus_1
+   Memcheck:Leak
+   match-leak-kinds: definite
+   fun:malloc
+   fun:g_malloc
+   fun:g_slice_alloc
+   fun:g_slice_alloc0
+   fun:get_dispatch
+   fun:g_main_context_dispatch
+   fun:g_main_context_iterate.isra.24
+   fun:g_main_loop_run
+   fun:gdbus_shared_thread_func
+   fun:g_thread_proxy
+   fun:start_thread
+   fun:clone
+}
+
+{
+   _gdbus_2
+   Memcheck:Leak
+   match-leak-kinds: definite
+   fun:malloc
+   fun:g_malloc
+   fun:g_slice_alloc
+   fun:g_slice_alloc0
+   fun:g_main_context_push_thread_default
+   fun:gdbus_shared_thread_func
+   fun:g_thread_proxy
+   fun:start_thread
+   fun:clone
+}
+
+{
+   _gdbus_3
+   Memcheck:Leak
+   match-leak-kinds: definite
+   fun:calloc
+   fun:g_malloc0
+   fun:_g_socket_read_with_control_messages
+   fun:_g_dbus_worker_do_read_unlocked
+   fun:_g_dbus_worker_do_read_cb
+   fun:g_simple_async_result_complete
+   fun:complete_in_idle_cb
+   fun:g_main_context_dispatch
+   fun:g_main_context_iterate.isra.24
+   fun:g_main_loop_run
+   fun:gdbus_shared_thread_func
+   fun:g_thread_proxy
+}
+
+{
+   _gdbus_4
+   Memcheck:Leak
+   match-leak-kinds: definite
+   fun:calloc
+   fun:g_malloc0
+   fun:thread_memory_from_self.part.12
+   fun:g_slice_alloc
+   fun:g_slice_alloc0
+   fun:g_main_context_push_thread_default
+   fun:gdbus_shared_thread_func
+   fun:g_thread_proxy
+   fun:start_thread
+   fun:clone
+}
+
+{
+   _gdbus_5
+   Memcheck:Leak
+   match-leak-kinds: definite
+   ...
+   fun:g_dbus_message_new_from_blob
+   ...
+}
+
+{
+   _gdbus_9
+   Memcheck:Leak
+   match-leak-kinds: definite
+   fun:malloc
+   fun:g_malloc
+   fun:g_slice_alloc
+   fun:g_slice_alloc0
+   fun:get_dispatch
+   fun:g_main_current_source
+   fun:g_task_return
+   fun:g_task_thread_pool_thread
+   fun:g_thread_pool_thread_proxy
+   fun:g_thread_proxy
+   fun:start_thread
+   fun:clone
+}
+
+{
+   _gdbus_10
+   Memcheck:Leak
+   match-leak-kinds: definite
+   fun:malloc
+   fun:g_malloc
+   fun:g_slice_alloc
+   fun:g_slice_alloc0
+   fun:g_system_thread_new
+   fun:g_thread_new_internal
+   fun:g_thread_pool_start_thread.part.0
+   fun:g_thread_pool_push
+   fun:g_task_start_task_thread
+   fun:g_task_run_in_thread
+   fun:g_async_initable_real_init_async
+   fun:g_bus_get
+}
+
+{
+   _gdbus_11
+   Memcheck:Leak
+   match-leak-kinds: definite
+   fun:calloc
+   fun:g_malloc0
+   fun:thread_memory_from_self.part.12
+   fun:g_slice_alloc
+   fun:g_slice_alloc0
+   fun:get_dispatch
+   fun:g_main_current_source
+   fun:g_task_return
+   fun:g_task_thread_pool_thread
+   fun:g_thread_pool_thread_proxy
+   fun:g_thread_proxy
+   fun:start_thread
+}
+
+{
+   _gdbus_12
+   Memcheck:Leak
+   match-leak-kinds: definite
+   fun:malloc
+   fun:g_malloc
+   fun:g_slice_alloc
+   fun:g_error_new_valist
+   fun:g_error_new
+   fun:g_dbus_error_new_for_dbus_error
+   fun:g_dbus_error_set_dbus_error
+   fun:g_dbus_message_to_gerror
+   fun:decode_method_reply
+   fun:g_dbus_connection_call_sync_internal
+   fun:g_dbus_proxy_call_sync_internal
+   fun:g_dbus_proxy_call_sync
+}
+
+{
+   _gdbus_15
+   Memcheck:Leak
+   match-leak-kinds: definite
+   fun:malloc
+   fun:g_malloc
+   fun:g_slice_alloc
+   fun:g_hash_table_new_full
+   fun:demarshal_map
+   fun:_dbus_gvalue_demarshal
+   fun:dbus_g_proxy_end_call_internal
+   fun:dbus_g_proxy_end_call
+   fun:get_permissions_reply
+   fun:complete_pending_call_and_unlock
+   fun:dbus_connection_dispatch
+   fun:message_queue_dispatch
+}
+
+{
+   _gdbus_16
+   Memcheck:Leak
+   match-leak-kinds: definite
+   fun:calloc
+   fun:g_malloc0
+   fun:_g_dbus_worker_send_message
+   fun:g_dbus_connection_send_message_unlocked
+   fun:unsubscribe_id_internal
+   fun:g_dbus_connection_signal_unsubscribe
+   fun:g_dbus_proxy_finalize
+   ...
+}
+