Date: Tue, 16 Mar 2004 19:20:21 +0300 (MSK) From: Dmitry Morozovsky <marck@rinet.ru> To: FreeBSD-gnats-submit@FreeBSD.org Cc: oleg@rinet.ru Subject: kern/64345: 4.x IPFW2 kernel memory leak (IPFW2+rote flaps+verrevpath) Message-ID: <200403161620.i2GGKL4w018371@woozle.rinet.ru> Resent-Message-ID: <200403161630.i2GGUOER024803@freefall.freebsd.org>
next in thread | raw e-mail | index | archive | help
>Number: 64345
>Category: kern
>Synopsis: 4.x IPFW2 kernel memory leak (IPFW2+rote flaps+verrevpath)
>Confidential: no
>Severity: serious
>Priority: medium
>Responsible: freebsd-bugs
>State: open
>Quarter:
>Keywords:
>Date-Required:
>Class: sw-bug
>Submitter-Id: current-users
>Arrival-Date: Tue Mar 16 08:30:24 PST 2004
>Closed-Date:
>Last-Modified:
>Originator: Dmitry Morozovsky
>Release: FreeBSD 4-STABLE i386
>Organization:
Cronyx Plus LLC (RiNet ISP)
>Environment:
System: FreeBSD 4-STABLE
>Description:
The following error has been catched by Oleg Bulyzhin <oleg@rinet.ru>
It seems 4-STABLE leaks kernel memory in routing table while checking reverse
paths. Our inter-vlan router with zebra/ospfd and 60+ VLANs exhausts default
100M of router table space in a couple of weeks.
Error does not belong to -current since verify_rev_path() has been implemented
different (and much cleaner) way.
>How-To-Repeat:
- build kernel or .ko with ipfw2
- add verrevpath checking rule
ipfw add 50 deny ip from any to any not verrevpath in
- use routing daemon with regular route update flow
-watch for kernel memory used by route table by
vmstat -m | grep rout | tail -1
>Fix:
The following patch seems to fix the problem for us. However, others corner
cases may exist, so maybe just MFC ip_fw2.c:1.50 ?
Index: sys/netinet/ip_fw2.c
===================================================================
RCS file: /home/ncvs/src/sys/netinet/ip_fw2.c,v
retrieving revision 1.6.2.18
diff -u -r1.6.2.18 ip_fw2.c
--- sys/netinet/ip_fw2.c 17 Oct 2003 11:01:03 -0000 1.6.2.18
+++ sys/netinet/ip_fw2.c 16 Mar 2004 12:39:52 -0000
@@ -432,6 +432,7 @@
/* Check if we've cached the route from the previous call. */
if (src.s_addr != dst->sin_addr.s_addr) {
+ if (ro.ro_rt != NULL) RTFREE(ro.ro_rt);
ro.ro_rt = NULL;
bzero(dst, sizeof(*dst));
>Release-Note:
>Audit-Trail:
>Unformatted:
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200403161620.i2GGKL4w018371>