Bug 156083

Summary:	ipfw pipe flush - memleak
Product:	Base System	Reporter:	Artjom Nikushkin <arni>
Component:	kern	Assignee:	Andrey V. Elsukov <ae>
Status:	Closed FIXED
Severity:	Affects Only Me
Priority:	Normal
Version:	8.2-RELEASE
Hardware:	Any
OS:	Any

Description Artjom Nikushkin 2011-03-31 10:10:09 UTC

After sequental pipe config/flush, dummynet hits limit of memory and `dmesg` ouputs : "ipfw: setsockopt(IP_DUMMYNET_CONFIGURE): Cannot allocate memory", and crashes. Pipe is configured with src-ip or dst-ip mask (dummynet hash pipes).

How-To-Repeat: In fresh install : 
for ((i=1;$i<2000000; i=$i+1)); do ipfw pipe 1 config bw 10Mbit/s mask src-ip 0xffffffff ; ipfw -f pipe flush ; done

When Wired memory hits about 370Mb of RAM, it crashes. 
It's possible to make it crash faster - rise net.inet.ip.dummynet.hash_size up to the maximum size.

Comment 1 Andrey V. Elsukov freebsd_committer

2011-03-31 13:07:09 UTC

Responsible Changed
From-To: freebsd-bugs->ae

Take it.

Comment 2 dfilter service freebsd_committer

2011-03-31 16:10:54 UTC

Author: ae
Date: Thu Mar 31 15:10:41 2011
New Revision: 220203
URL: http://svn.freebsd.org/changeset/base/220203

Log:
  Fix a memory leak. Memory that is allocated for schedulers hash table
  was not freed.
  
  PR:		kern/156083
  MFC after:	1 week

Modified:
  head/sys/netinet/ipfw/ip_dummynet.c

Modified: head/sys/netinet/ipfw/ip_dummynet.c
==============================================================================
--- head/sys/netinet/ipfw/ip_dummynet.c	Thu Mar 31 14:44:00 2011	(r220202)
+++ head/sys/netinet/ipfw/ip_dummynet.c	Thu Mar 31 15:10:41 2011	(r220203)
@@ -748,9 +748,10 @@ schk_delete_cb(void *obj, void *arg)
 #endif
 	fsk_detach_list(&s->fsk_list, arg ? DN_DESTROY : 0);
 	/* no more flowset pointing to us now */
-	if (s->sch.flags & DN_HAVE_MASK)
+	if (s->sch.flags & DN_HAVE_MASK) {
 		dn_ht_scan(s->siht, si_destroy, NULL);
-	else if (s->siht)
+		dn_ht_free(s->siht, 0);
+	} else if (s->siht)
 		si_destroy(s->siht, NULL);
 	if (s->profile) {
 		free(s->profile, M_DUMMYNET);
_______________________________________________
svn-src-all@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/svn-src-all
To unsubscribe, send any mail to "svn-src-all-unsubscribe@freebsd.org"

Comment 3 dfilter service freebsd_committer

2011-04-07 07:01:18 UTC

Author: ae
Date: Thu Apr  7 06:01:09 2011
New Revision: 220408
URL: http://svn.freebsd.org/changeset/base/220408

Log:
  MFC r220203:
    Fix a memory leak. Memory that is allocated for schedulers hash table
    was not freed.
  
    PR:		kern/156083

Modified:
  stable/8/sys/netinet/ipfw/ip_dummynet.c
Directory Properties:
  stable/8/sys/   (props changed)
  stable/8/sys/amd64/include/xen/   (props changed)
  stable/8/sys/cddl/contrib/opensolaris/   (props changed)
  stable/8/sys/contrib/dev/acpica/   (props changed)
  stable/8/sys/contrib/pf/   (props changed)

Modified: stable/8/sys/netinet/ipfw/ip_dummynet.c
==============================================================================
--- stable/8/sys/netinet/ipfw/ip_dummynet.c	Thu Apr  7 05:58:21 2011	(r220407)
+++ stable/8/sys/netinet/ipfw/ip_dummynet.c	Thu Apr  7 06:01:09 2011	(r220408)
@@ -747,9 +747,10 @@ schk_delete_cb(void *obj, void *arg)
 #endif
 	fsk_detach_list(&s->fsk_list, arg ? DN_DESTROY : 0);
 	/* no more flowset pointing to us now */
-	if (s->sch.flags & DN_HAVE_MASK)
+	if (s->sch.flags & DN_HAVE_MASK) {
 		dn_ht_scan(s->siht, si_destroy, NULL);
-	else if (s->siht)
+		dn_ht_free(s->siht, 0);
+	} else if (s->siht)
 		si_destroy(s->siht, NULL);
 	if (s->profile) {
 		free(s->profile, M_DUMMYNET);
_______________________________________________
svn-src-all@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/svn-src-all
To unsubscribe, send any mail to "svn-src-all-unsubscribe@freebsd.org"

Comment 4 Andrey V. Elsukov freebsd_committer

2011-04-07 12:23:18 UTC

State Changed
From-To: open->closed

Committed to head/ and stable/8. Thanks!