Skip site navigation (1)Skip section navigation (2) 
Date:      Fri, 20 Jun 2014 15:36:09 -0700
From:      Navdeep Parhar <navdeep@chelsio.com>
To:        Alan Somers <asomers@freebsd.org>
Cc:        "freebsd-net@freebsd.org" <freebsd-net@freebsd.org>
Subject:   Re: ifaddr refcount problem
Message-ID:  <53A4B759.2060604@chelsio.com>
In-Reply-To: <CAOtMX2gH39O_3y1tpzcGw3ups_ujr%2Bzv2hkmPpEw5_xRcxSvQQ@mail.gmail.com>
References:  <53A48849.8080504@chelsio.com> <CAOtMX2gH39O_3y1tpzcGw3ups_ujr%2Bzv2hkmPpEw5_xRcxSvQQ@mail.gmail.com>
next in thread | previous in thread | raw e-mail | index | archive | help 

On 06/20/14 15:20, Alan Somers wrote:
...
> 
> Do you have a test case that can reproduce the panic?
> 
> -Alan
> 

Just run some UDP traffic on head or stable/10 and watch the refcount
leak on the transmitter.

# netperf -H ... -t UDP_STREAM


I see these two do ifa_ref (once per packet).

              kernel`ip_output+0x527
              kernel`udp_send+0xa88
              kernel`sosend_dgram+0x583
              kernel`kern_sendit+0x244
              kernel`sendit+0x129
              kernel`sys_sendto+0x4d
              kernel`amd64_syscall+0x3fb

              kernel`in_pcbladdr+0x160
              kernel`in_pcbconnect_setup+0x18b
              kernel`udp_send+0x3d7
              kernel`sosend_dgram+0x583
              kernel`kern_sendit+0x244
              kernel`sendit+0x129
              kernel`sys_sendto+0x4d
              kernel`amd64_syscall+0x3fb


(kgdb) l *(ip_output + 0x527)
0xffffffff80ac37f7 is in ip_output (/usr/src/sys/netinet/ip_output.c:249).
244			ip->ip_ttl = 1;
245			isbroadcast = 1;
246			ifa_free((void *)ia);
247		} else if (flags & IP_ROUTETOIF) {
248			if ((ia = ifatoia(ifa_ifwithdstaddr(sintosa(dst)))) == NULL &&
249			    (ia = ifatoia(ifa_ifwithnet(sintosa(dst), 0))) == NULL) {
250				IPSTAT_INC(ips_noroute);
251				error = ENETUNREACH;
252				goto bad;
253			}

And only this one does ifa_free (once per packet)
              kernel`in_pcbladdr+0x1fb
              kernel`in_pcbconnect_setup+0x18b
              kernel`udp_send+0x3d7
              kernel`sosend_dgram+0x583
              kernel`kern_sendit+0x244
              kernel`sendit+0x129
              kernel`sys_sendto+0x4d
              kernel`amd64_syscall+0x3fb


So there is a net leak of 1 refcount per packet.

Regards,
Navdeep

Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?53A4B759.2060604>