From owner-freebsd-net@freebsd.org Fri Feb 12 21:48:26 2021 Return-Path: Delivered-To: freebsd-net@mailman.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.nyi.freebsd.org (Postfix) with ESMTP id 3B04E5324D2 for ; Fri, 12 Feb 2021 21:48:26 +0000 (UTC) (envelope-from rysto32@gmail.com) Received: from mail-pj1-x102e.google.com (mail-pj1-x102e.google.com [IPv6:2607:f8b0:4864:20::102e]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (2048 bits) client-digest SHA256) (Client CN "smtp.gmail.com", Issuer "GTS CA 1O1" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4DcnDn3B8hz4TBn; Fri, 12 Feb 2021 21:48:25 +0000 (UTC) (envelope-from rysto32@gmail.com) Received: by mail-pj1-x102e.google.com with SMTP id l18so385032pji.3; Fri, 12 Feb 2021 13:48:25 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=flRDdVEbz86o1PEWaQXrIigfsy4zX8D6AwLCpdYDaC8=; b=Dy5wQex3yUMaRYVLBEYH82cFMu7x/HdCGZFqi1APS+25LQ+HbrsYtaNm7FpioEFxyD R7ogO9Ebc7j/zbOUHNg7yPLhEG/3HisgyehQt/1C/TD327m3V+jW/GCO8CrPR3SdhvSB Fhs+GDMb8RS0G6PbsFKuUwmoPGAudc1nxsB8tVhoPBBAcdE5T5oNaFHr+ZokKp64vlUr z/jkZ4ylYn92sb1im7XsCPAaZ5eWesKBRZVhHeqp9RudohuB7De3bRra4pvUMp5BBm4j Vn+CyGxLQ4zaf5jZ/eTAZTjBr77L3rQRrxRtRkRO6/l/m44CkkXApL/Cr3+vdW5XN3eF d/sw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=flRDdVEbz86o1PEWaQXrIigfsy4zX8D6AwLCpdYDaC8=; b=f7dzDKMW12V8e2kM5tolgDx8A0BzqMnPmcxV15FEeXa8twj5J5PIzJZOVAbJ8B8MAj ORIYx5Z+C1REpKr3S28s33zWF20VHYa4HXFYoSLv0KzUl25VfC534NRulCR9/GPoY3My cljusvpJls8y2l3UzRFZqSa6HO9OqRs+9yB3A8VUKa7/xOn1fVQUulaWaPnQei/Z0Dyy btn+H7odLuaONrso+VRcQCrxfJF89d504yr0TRWGjvRfTwfKlJLbUmcP7f5VfFSEaEqS NQ5pr2usDaHtQMGFJ0he8TYfQlLt58+gV1HOHjM7a9Hg/Z31Y5Q5FlwvZWqOcEFeWTbb ESaw== X-Gm-Message-State: AOAM533Soa1udUb8mXDUusmvnOFP989OnoeH8iaFZ30uee4VG/mXPxcn rMvqJ+66lE0mquAJbzoTHu8jMC1VZuC2dATIHcB2yloyWFM= X-Google-Smtp-Source: ABdhPJxap1ZrQpPyifXUjVB7ZOT1ICytfhtq2L1gKxJD23NBaEuDdaX2XfDaCnoIWSE8NJVH+v1NsPi+SraucOruDvU= X-Received: by 2002:a17:90a:4ecb:: with SMTP id v11mr4538080pjl.75.1613166503750; Fri, 12 Feb 2021 13:48:23 -0800 (PST) MIME-Version: 1.0 References: <113921613153727@vla1-bff2c05bedc2.qloud-c.yandex.net> <1464101613162719@mail.yandex.ru> In-Reply-To: <1464101613162719@mail.yandex.ru> From: Ryan Stone Date: Fri, 12 Feb 2021 16:48:12 -0500 Message-ID: Subject: Re: ifaddr reference count leaks that seem to be related to routing code To: "Alexander V. Chernikov" Cc: freebsd-net Content-Type: text/plain; charset="UTF-8" X-Rspamd-Queue-Id: 4DcnDn3B8hz4TBn X-Spamd-Bar: ---- Authentication-Results: mx1.freebsd.org; dkim=pass header.d=gmail.com header.s=20161025 header.b=Dy5wQex3; dmarc=pass (policy=none) header.from=gmail.com; spf=pass (mx1.freebsd.org: domain of rysto32@gmail.com designates 2607:f8b0:4864:20::102e as permitted sender) smtp.mailfrom=rysto32@gmail.com X-Spamd-Result: default: False [-4.00 / 15.00]; ARC_NA(0.00)[]; RBL_DBL_DONT_QUERY_IPS(0.00)[2607:f8b0:4864:20::102e:from]; R_DKIM_ALLOW(-0.20)[gmail.com:s=20161025]; RCVD_TLS_ALL(0.00)[]; FROM_HAS_DN(0.00)[]; R_SPF_ALLOW(-0.20)[+ip6:2607:f8b0:4000::/36:c]; FREEMAIL_FROM(0.00)[gmail.com]; MIME_GOOD(-0.10)[text/plain]; TO_MATCH_ENVRCPT_ALL(0.00)[]; NEURAL_HAM_LONG(-1.00)[-1.000]; SPAMHAUS_ZRD(0.00)[2607:f8b0:4864:20::102e:from:127.0.2.255]; NEURAL_HAM_MEDIUM(-1.00)[-1.000]; TO_DN_ALL(0.00)[]; DKIM_TRACE(0.00)[gmail.com:+]; RCPT_COUNT_TWO(0.00)[2]; DMARC_POLICY_ALLOW(-0.50)[gmail.com,none]; RCVD_IN_DNSWL_NONE(0.00)[2607:f8b0:4864:20::102e:from]; NEURAL_HAM_SHORT(-1.00)[-1.000]; FROM_EQ_ENVFROM(0.00)[]; MIME_TRACE(0.00)[0:+]; FREEMAIL_ENVFROM(0.00)[gmail.com]; ASN(0.00)[asn:15169, ipnet:2607:f8b0::/32, country:US]; RCVD_COUNT_TWO(0.00)[2]; MAILMAN_DEST(0.00)[freebsd-net]; DWL_DNSWL_NONE(0.00)[gmail.com:dkim] X-BeenThere: freebsd-net@freebsd.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: Networking and TCP/IP with FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 12 Feb 2021 21:48:26 -0000 On Fri, Feb 12, 2021 at 4:14 PM Alexander V. Chernikov wrote: > The slightly different approach here: https://reviews.freebsd.org/D28629 > We indeed are running under epoch, so that prevents _immediate_ ifa destruction. > However, we still can run into the situation when > * in thread 1 we drop to 0 refcount for ifa and schedule its deletion. > * in thread 2 we use this ifa and reference it > * destroy callout kicks in > * unhappy user reports bug > The current approach minimises this possibility by taking an ifa refcount early. > More general approach would probably be in introducing `ifa_try_ref()` based on refcount_acquire_if_not_zero() but that's something that needs a bit more effort. Oops, you're completely correct. Do you think that we should put a KASSERT in ifa_ref() that ifa_refcnt > 0 to catch such a bug if somebody ever manages to introduce one? Of course it would not fire except in the case where we already lost the race, but at least it would make it easier to debug.