From owner-freebsd-hackers  Sun Sep  8 06:35:12 1996
Return-Path: owner-hackers
Received: (from root@localhost)
          by freefall.freebsd.org (8.7.5/8.7.3) id GAA00999
          for hackers-outgoing; Sun, 8 Sep 1996 06:35:12 -0700 (PDT)
Received: from who.cdrom.com (who.cdrom.com [204.216.27.3])
          by freefall.freebsd.org (8.7.5/8.7.3) with ESMTP id GAA00980;
          Sun, 8 Sep 1996 06:35:09 -0700 (PDT)
Received: from cheops.anu.edu.au (avalon@cheops.anu.edu.au [150.203.76.24])
          by who.cdrom.com (8.7.5/8.6.11) with ESMTP id GAA01258
          ; Sun, 8 Sep 1996 06:35:07 -0700 (PDT)
Message-Id: <199609081335.GAA01258@who.cdrom.com>
Received: by cheops.anu.edu.au
	(1.37.109.16/16.2) id AA278679625; Sun, 8 Sep 1996 23:33:45 +1000
From: Darren Reed <avalon@coombs.anu.edu.au>
Subject: Re: no more mbufs!
To: avalon@coombs.anu.edu.au (Darren Reed)
Date: Sun, 8 Sep 1996 23:33:45 +1000 (EST)
Cc: freebsd-bugs@freebsd.org, freebsd-hackers@freebsd.org
In-Reply-To: <199609080811.AA08048@mail.crl.com> from "Darren Reed" at Sep 8, 96 06:07:23 pm
X-Mailer: ELM [version 2.4 PL23]
Content-Type: text
Sender: owner-hackers@freebsd.org
X-Loop: FreeBSD.org
Precedence: bulk

In some mail from Darren Reed, sie said:
> 
> 
> Hi, I just made my 2.1.5 box run out of mbufs:
> 
> kernel: Out of mbuf clusters - increase maxusers!
> 
> so I thought I'd let it rest and wait for things to expire...
> 
> (a reboot is going to be necessary, I can see...)
> 
> however, netstat -m now looks like this:
> 1038 mbufs in use:
> 	1025 mbufs allocated to data
> 	2 mbufs allocated to packet headers
> 	3 mbufs allocated to protocol control blocks
> 	8 mbufs allocated to socket names and addresses
> 1024/1024 mbuf clusters in use
> 2177 Kbytes allocated to network (100% in use)
> 0 requests for memory deined
> 0 requests for memory delayed
> 0 calls to protocol drain queues
> 
> there appear to be no outstanding connections in netstat -an output.
> 
> To get the machine in this state, I was using it as the source of running
> iptest against an UltraSparc2 (making heavy use of sending packets out via
> BPF).
> 
> Some minutes later, "netstat -m" still reports the same.
> 
> Reboot time I guess: new kernel and has been up less than half an hour.

Sigh, and you know what ?  I've already got a patch for this amognst the
IP Filter patches for ip_input.c - guess this is why I never had a problem
until I put virgin 2.1.5 kernel on my box.  I didn't think of this until I
did up maxusers and did recreate the above situation.

Maybe someone will take this and commit it sometime...  discovered the bug
when I crashed my SunOS4 box, and managed to crash Ultrix too.  Seems like
it just fucks the mbufs on FreeBSD.  NetBSD fixed it when they rewrote
everything to use TAILQ, dunno about BSD/OS.

So IP Filter users, don't worry about the above bug report :-)

Darren


*** /sys/netinet/ip_input.c.orig	Wed Sep  6 20:31:35 1995
--- /sys/netinet/ip_input.c	Sun Apr 21 12:12:53 1996
***************
*** 507,512 ****
--- 523,530 ----
  	 * if they are completely covered, dequeue them.
  	 */
  	while (q != (struct ipasfrag *)fp && ip->ip_off + ip->ip_len > q->ip_off) {
+ 		struct mbuf *m0;
+ 
  		i = (ip->ip_off + ip->ip_len) - q->ip_off;
  		if (i < q->ip_len) {
  			q->ip_len -= i;
***************
*** 514,522 ****
  			m_adj(dtom(q), i);
  			break;
  		}
  		q = q->ipf_next;
- 		m_freem(dtom(q->ipf_prev));
  		ip_deq(q->ipf_prev);
  	}
  
  insert:
--- 532,541 ----
  			m_adj(dtom(q), i);
  			break;
  		}
+ 		m0 = dtom(q);
  		q = q->ipf_next;
  		ip_deq(q->ipf_prev);
+ 		m_freem(m0);
  	}
  
  insert: