Date: Tue, 16 Mar 2004 19:20:21 +0300 (MSK) From: Dmitry Morozovsky <marck@rinet.ru> To: FreeBSD-gnats-submit@FreeBSD.org Cc: oleg@rinet.ru Subject: kern/64345: 4.x IPFW2 kernel memory leak (IPFW2+rote flaps+verrevpath) Message-ID: <200403161620.i2GGKL4w018371@woozle.rinet.ru> Resent-Message-ID: <200403161630.i2GGUOER024803@freefall.freebsd.org>
next in thread | raw e-mail | index | archive | help
>Number: 64345 >Category: kern >Synopsis: 4.x IPFW2 kernel memory leak (IPFW2+rote flaps+verrevpath) >Confidential: no >Severity: serious >Priority: medium >Responsible: freebsd-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: sw-bug >Submitter-Id: current-users >Arrival-Date: Tue Mar 16 08:30:24 PST 2004 >Closed-Date: >Last-Modified: >Originator: Dmitry Morozovsky >Release: FreeBSD 4-STABLE i386 >Organization: Cronyx Plus LLC (RiNet ISP) >Environment: System: FreeBSD 4-STABLE >Description: The following error has been catched by Oleg Bulyzhin <oleg@rinet.ru> It seems 4-STABLE leaks kernel memory in routing table while checking reverse paths. Our inter-vlan router with zebra/ospfd and 60+ VLANs exhausts default 100M of router table space in a couple of weeks. Error does not belong to -current since verify_rev_path() has been implemented different (and much cleaner) way. >How-To-Repeat: - build kernel or .ko with ipfw2 - add verrevpath checking rule ipfw add 50 deny ip from any to any not verrevpath in - use routing daemon with regular route update flow -watch for kernel memory used by route table by vmstat -m | grep rout | tail -1 >Fix: The following patch seems to fix the problem for us. However, others corner cases may exist, so maybe just MFC ip_fw2.c:1.50 ? Index: sys/netinet/ip_fw2.c =================================================================== RCS file: /home/ncvs/src/sys/netinet/ip_fw2.c,v retrieving revision 1.6.2.18 diff -u -r1.6.2.18 ip_fw2.c --- sys/netinet/ip_fw2.c 17 Oct 2003 11:01:03 -0000 1.6.2.18 +++ sys/netinet/ip_fw2.c 16 Mar 2004 12:39:52 -0000 @@ -432,6 +432,7 @@ /* Check if we've cached the route from the previous call. */ if (src.s_addr != dst->sin_addr.s_addr) { + if (ro.ro_rt != NULL) RTFREE(ro.ro_rt); ro.ro_rt = NULL; bzero(dst, sizeof(*dst)); >Release-Note: >Audit-Trail: >Unformatted:
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200403161620.i2GGKL4w018371>