From owner-freebsd-bugs@FreeBSD.ORG Tue Mar 16 08:30:24 2004 Return-Path: Delivered-To: freebsd-bugs@hub.freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id C11C216A4CF for ; Tue, 16 Mar 2004 08:30:24 -0800 (PST) Received: from freefall.freebsd.org (freefall.freebsd.org [216.136.204.21]) by mx1.FreeBSD.org (Postfix) with ESMTP id A199243D39 for ; Tue, 16 Mar 2004 08:30:24 -0800 (PST) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (gnats@localhost [127.0.0.1]) i2GGUObv024809 for ; Tue, 16 Mar 2004 08:30:24 -0800 (PST) (envelope-from gnats@freefall.freebsd.org) Received: (from gnats@localhost) by freefall.freebsd.org (8.12.10/8.12.10/Submit) id i2GGUOER024803; Tue, 16 Mar 2004 08:30:24 -0800 (PST) (envelope-from gnats) Resent-Date: Tue, 16 Mar 2004 08:30:24 -0800 (PST) Resent-Message-Id: <200403161630.i2GGUOER024803@freefall.freebsd.org> Resent-From: FreeBSD-gnats-submit@FreeBSD.org (GNATS Filer) Resent-To: freebsd-bugs@FreeBSD.org Resent-Reply-To: FreeBSD-gnats-submit@FreeBSD.org, Dmitry Morozovsky Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 7CA4816A4CE for ; Tue, 16 Mar 2004 08:20:24 -0800 (PST) Received: from woozle.rinet.ru (woozle.rinet.ru [195.54.192.68]) by mx1.FreeBSD.org (Postfix) with ESMTP id C5E4F43D45 for ; Tue, 16 Mar 2004 08:20:23 -0800 (PST) (envelope-from marck@woozle.rinet.ru) Received: from woozle.rinet.ru (localhost [127.0.0.1]) by woozle.rinet.ru (8.12.10/8.12.10) with ESMTP id i2GGKLci018372; Tue, 16 Mar 2004 19:20:21 +0300 (MSK) (envelope-from marck@woozle.rinet.ru) Received: (from marck@localhost) by woozle.rinet.ru (8.12.10/8.12.10/Submit) id i2GGKL4w018371; Tue, 16 Mar 2004 19:20:21 +0300 (MSK) (envelope-from marck) Message-Id: <200403161620.i2GGKL4w018371@woozle.rinet.ru> Date: Tue, 16 Mar 2004 19:20:21 +0300 (MSK) From: Dmitry Morozovsky To: FreeBSD-gnats-submit@FreeBSD.org X-Send-Pr-Version: 3.113 cc: oleg@rinet.ru Subject: kern/64345: 4.x IPFW2 kernel memory leak (IPFW2+rote flaps+verrevpath) X-BeenThere: freebsd-bugs@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list Reply-To: Dmitry Morozovsky List-Id: Bug reports List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 16 Mar 2004 16:30:25 -0000 >Number: 64345 >Category: kern >Synopsis: 4.x IPFW2 kernel memory leak (IPFW2+rote flaps+verrevpath) >Confidential: no >Severity: serious >Priority: medium >Responsible: freebsd-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: sw-bug >Submitter-Id: current-users >Arrival-Date: Tue Mar 16 08:30:24 PST 2004 >Closed-Date: >Last-Modified: >Originator: Dmitry Morozovsky >Release: FreeBSD 4-STABLE i386 >Organization: Cronyx Plus LLC (RiNet ISP) >Environment: System: FreeBSD 4-STABLE >Description: The following error has been catched by Oleg Bulyzhin It seems 4-STABLE leaks kernel memory in routing table while checking reverse paths. Our inter-vlan router with zebra/ospfd and 60+ VLANs exhausts default 100M of router table space in a couple of weeks. Error does not belong to -current since verify_rev_path() has been implemented different (and much cleaner) way. >How-To-Repeat: - build kernel or .ko with ipfw2 - add verrevpath checking rule ipfw add 50 deny ip from any to any not verrevpath in - use routing daemon with regular route update flow -watch for kernel memory used by route table by vmstat -m | grep rout | tail -1 >Fix: The following patch seems to fix the problem for us. However, others corner cases may exist, so maybe just MFC ip_fw2.c:1.50 ? Index: sys/netinet/ip_fw2.c =================================================================== RCS file: /home/ncvs/src/sys/netinet/ip_fw2.c,v retrieving revision 1.6.2.18 diff -u -r1.6.2.18 ip_fw2.c --- sys/netinet/ip_fw2.c 17 Oct 2003 11:01:03 -0000 1.6.2.18 +++ sys/netinet/ip_fw2.c 16 Mar 2004 12:39:52 -0000 @@ -432,6 +432,7 @@ /* Check if we've cached the route from the previous call. */ if (src.s_addr != dst->sin_addr.s_addr) { + if (ro.ro_rt != NULL) RTFREE(ro.ro_rt); ro.ro_rt = NULL; bzero(dst, sizeof(*dst)); >Release-Note: >Audit-Trail: >Unformatted: