NetBSD Problem Report #54419
From sc.dying@gmail.com Mon Jul 29 08:31:18 2019
Return-Path: <sc.dying@gmail.com>
Received: from mail.netbsd.org (mail.netbsd.org [199.233.217.200])
(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
(Client CN "mail.NetBSD.org", Issuer "mail.NetBSD.org CA" (not verified))
by mollari.NetBSD.org (Postfix) with ESMTPS id 76A717A178
for <gnats-bugs@gnats.NetBSD.org>; Mon, 29 Jul 2019 08:31:18 +0000 (UTC)
Message-Id: <3a1af961-427b-df8b-102a-5376e9925e61@gmail.com>
Date: Mon, 29 Jul 2019 08:31:11 +0000
From: sc.dying@gmail.com
Reply-To:
To: gnats-bugs@NetBSD.org
Subject: mbuf leak when deleting route
>Number: 54419
>Category: kern
>Synopsis: mbuf leak when deleting route
>Confidential: no
>Severity: serious
>Priority: high
>Responsible: kern-bug-people
>State: closed
>Class: sw-bug
>Submitter-Id: net
>Arrival-Date: Mon Jul 29 08:35:00 +0000 2019
>Closed-Date: Mon Aug 05 02:42:08 +0000 2019
>Last-Modified: Mon Aug 05 02:42:08 +0000 2019
>Originator: sc.dying@gmail.com
>Release: NetBSD 8.99.51
>Organization:
>Environment:
System: NetBSD 8.99.51 NetBSD 8.99.51 (GENERIC) #0: Sun Jul 28 17:41:21 UTC 2019 mkrepro@mkrepro.NetBSD.org:/usr/src/sys/arch/amd64/compile/GENERIC amd64 x86_64
>Description:
An mbuf goes somewhere when deleting a route on -current/amd64 and -8.1/amd64.
When you delete a route using route command, it is deleted successfully, but
mbuf usage of netstat -m gains 1.
See How-To-Repeat for detail.
I saw same problem on NetBSD-8.1/amd64, too.
>How-To-Repeat:
After boot single, I typed following commands.
# uname -ap
NetBSD 8.99.51 NetBSD 8.99.51 (GENERIC) #0: Sun Jul 28 17:41:21 UTC 2019 mkrepro@mkrepro.NetBSD.org:/usr/src/sys/arch/amd64/compile/GENERIC amd64 x86_64
# ifconfig lo0 127.0.0.1
# route add 192.168.0.1 127.0.0.1
add host 192.168.0.1: gateway 127.0.0.1
# netstat -m
0 mbufs in use:
0 calls to protocol drain routines
# route delete 192.168.0.1
delete host 192.168.0.1
# netstat -m
1 mbufs in use:
1 mbufs allocated to data
0 calls to protocol drain routines
# sh -c 'i=0; while [ $i -lt 10000 ]; do route -q add 192.168.0.1 127.0.0.1; route -q delete 192.168.0.1; i=$((i+1)); done'
# netstat -m
10001 mbufs in use:
10001 mbufs allocated to data
0 calls to protocol drain routines
#
>Fix:
Yes, please.
>Release-Note:
>Audit-Trail:
From: Ryota Ozaki <ozaki.ryota@gmail.com>
To: "gnats-bugs@NetBSD.org" <gnats-bugs@netbsd.org>
Cc: kern-bug-people@netbsd.org, gnats-admin@netbsd.org, netbsd-bugs@netbsd.org
Subject: Re: kern/54419: mbuf leak when deleting route
Date: Thu, 1 Aug 2019 15:32:13 +0900
On Mon, Jul 29, 2019 at 5:35 PM <sc.dying@gmail.com> wrote:
>
> >Number: 54419
> >Category: kern
> >Synopsis: mbuf leak when deleting route
> >Confidential: no
> >Severity: serious
> >Priority: high
> >Responsible: kern-bug-people
> >State: open
> >Class: sw-bug
> >Submitter-Id: net
> >Arrival-Date: Mon Jul 29 08:35:00 +0000 2019
> >Originator: sc.dying@gmail.com
> >Release: NetBSD 8.99.51
> >Organization:
> >Environment:
> System: NetBSD 8.99.51 NetBSD 8.99.51 (GENERIC) #0: Sun Jul 28 17:41:21 UTC 2019 mkrepro@mkrepro.NetBSD.org:/usr/src/sys/arch/amd64/compile/GENERIC amd64 x86_64
> >Description:
>
> An mbuf goes somewhere when deleting a route on -current/amd64 and -8.1/amd64.
>
> When you delete a route using route command, it is deleted successfully, but
> mbuf usage of netstat -m gains 1.
> See How-To-Repeat for detail.
>
> I saw same problem on NetBSD-8.1/amd64, too.
>
> >How-To-Repeat:
>
> After boot single, I typed following commands.
>
> # uname -ap
> NetBSD 8.99.51 NetBSD 8.99.51 (GENERIC) #0: Sun Jul 28 17:41:21 UTC 2019 mkrepro@mkrepro.NetBSD.org:/usr/src/sys/arch/amd64/compile/GENERIC amd64 x86_64
> # ifconfig lo0 127.0.0.1
> # route add 192.168.0.1 127.0.0.1
> add host 192.168.0.1: gateway 127.0.0.1
> # netstat -m
> 0 mbufs in use:
> 0 calls to protocol drain routines
> # route delete 192.168.0.1
> delete host 192.168.0.1
> # netstat -m
> 1 mbufs in use:
> 1 mbufs allocated to data
> 0 calls to protocol drain routines
> # sh -c 'i=0; while [ $i -lt 10000 ]; do route -q add 192.168.0.1 127.0.0.1; route -q delete 192.168.0.1; i=$((i+1)); done'
> # netstat -m
> 10001 mbufs in use:
> 10001 mbufs allocated to data
> 0 calls to protocol drain routines
> #
The leak occurs if there is no listener of routing sockets. That's the
reason the single user mode is needed and we don't observe the leak
normally.
>
> >Fix:
> Yes, please.
The below patch fixes the leak.
I guess it's a typo. Should we disallow normal users of m_freem to
use m_free accidentally by say renaming it to _m_free or something?
Thanks,
ozaki-r
diff --git a/sys/net/raw_usrreq.c b/sys/net/raw_usrreq.c
index 24185c17939..19d96dcb82b 100644
--- a/sys/net/raw_usrreq.c
+++ b/sys/net/raw_usrreq.c
@@ -110,7 +110,7 @@ raw_input(struct mbuf *m0, struct sockproto
*proto, struct sockaddr *src,
}
if (last != NULL) {
if (sbappendaddr(&last->so_rcv, src, m, NULL) == 0) {
- m_free(m);
+ m_freem(m);
soroverflow(last);
} else
sorwakeup(last);
From: sc dying <sc.dying@gmail.com>
To: Ryota Ozaki <ozaki.ryota@gmail.com>
Cc: "gnats-bugs@NetBSD.org" <gnats-bugs@netbsd.org>, kern-bug-people@netbsd.org,
gnats-admin@netbsd.org, netbsd-bugs@netbsd.org
Subject: Re: kern/54419: mbuf leak when deleting route
Date: Thu, 1 Aug 2019 12:08:07 +0000
On Thu, Aug 1, 2019 at 6:32 AM Ryota Ozaki <ozaki.ryota@gmail.com> wrote:
>
> On Mon, Jul 29, 2019 at 5:35 PM <sc.dying@gmail.com> wrote:
> >
> > >Number: 54419
> > >Category: kern
> > >Synopsis: mbuf leak when deleting route
> > >Confidential: no
> > >Severity: serious
> > >Priority: high
> > >Responsible: kern-bug-people
> > >State: open
> > >Class: sw-bug
> > >Submitter-Id: net
> > >Arrival-Date: Mon Jul 29 08:35:00 +0000 2019
> > >Originator: sc.dying@gmail.com
> > >Release: NetBSD 8.99.51
> > >Organization:
> > >Environment:
> > System: NetBSD 8.99.51 NetBSD 8.99.51 (GENERIC) #0: Sun Jul 28 17:41:21 UTC 2019 mkrepro@mkrepro.NetBSD.org:/usr/src/sys/arch/amd64/compile/GENERIC amd64 x86_64
> > >Description:
> >
> > An mbuf goes somewhere when deleting a route on -current/amd64 and -8.1/amd64.
> >
> > When you delete a route using route command, it is deleted successfully, but
> > mbuf usage of netstat -m gains 1.
> > See How-To-Repeat for detail.
> >
> > I saw same problem on NetBSD-8.1/amd64, too.
> >
> > >How-To-Repeat:
> >
> > After boot single, I typed following commands.
> >
> > # uname -ap
> > NetBSD 8.99.51 NetBSD 8.99.51 (GENERIC) #0: Sun Jul 28 17:41:21 UTC 2019 mkrepro@mkrepro.NetBSD.org:/usr/src/sys/arch/amd64/compile/GENERIC amd64 x86_64
> > # ifconfig lo0 127.0.0.1
> > # route add 192.168.0.1 127.0.0.1
> > add host 192.168.0.1: gateway 127.0.0.1
> > # netstat -m
> > 0 mbufs in use:
> > 0 calls to protocol drain routines
> > # route delete 192.168.0.1
> > delete host 192.168.0.1
> > # netstat -m
> > 1 mbufs in use:
> > 1 mbufs allocated to data
> > 0 calls to protocol drain routines
> > # sh -c 'i=0; while [ $i -lt 10000 ]; do route -q add 192.168.0.1 127.0.0.1; route -q delete 192.168.0.1; i=$((i+1)); done'
> > # netstat -m
> > 10001 mbufs in use:
> > 10001 mbufs allocated to data
> > 0 calls to protocol drain routines
> > #
>
> The leak occurs if there is no listener of routing sockets. That's the
> reason the single user mode is needed and we don't observe the leak
> normally.
Yes, on other hosts I run ntpd with ntpd_chrootdir set,
so I can reproduce on them.
> > >Fix:
> > Yes, please.
>
> The below patch fixes the leak.
I confirm the problem is fixed.
Thank you!
>
> I guess it's a typo. Should we disallow normal users of m_freem to
> use m_free accidentally by say renaming it to _m_free or something?
>
> Thanks,
> ozaki-r
>
> diff --git a/sys/net/raw_usrreq.c b/sys/net/raw_usrreq.c
> index 24185c17939..19d96dcb82b 100644
> --- a/sys/net/raw_usrreq.c
> +++ b/sys/net/raw_usrreq.c
> @@ -110,7 +110,7 @@ raw_input(struct mbuf *m0, struct sockproto
> *proto, struct sockaddr *src,
> }
> if (last != NULL) {
> if (sbappendaddr(&last->so_rcv, src, m, NULL) == 0) {
> - m_free(m);
> + m_freem(m);
> soroverflow(last);
> } else
> sorwakeup(last);
From: "Ryota Ozaki" <ozaki-r@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc:
Subject: PR/54419 CVS commit: src/sys/net
Date: Fri, 2 Aug 2019 01:55:01 +0000
Module Name: src
Committed By: ozaki-r
Date: Fri Aug 2 01:55:01 UTC 2019
Modified Files:
src/sys/net: raw_usrreq.c
Log Message:
Fix typo (s/m_free/m_freem/)
This fixes PR kern/54419 "mbuf leak when deleting route" from sc dying.
To generate a diff of this commit:
cvs rdiff -u -r1.62 -r1.63 src/sys/net/raw_usrreq.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
From: Ryota Ozaki <ozaki.ryota@gmail.com>
To: sc dying <sc.dying@gmail.com>
Cc: "gnats-bugs@NetBSD.org" <gnats-bugs@netbsd.org>, kern-bug-people@netbsd.org,
gnats-admin@netbsd.org, netbsd-bugs@netbsd.org
Subject: Re: kern/54419: mbuf leak when deleting route
Date: Fri, 2 Aug 2019 10:57:50 +0900
On Thu, Aug 1, 2019 at 9:08 PM sc dying <sc.dying@gmail.com> wrote:
>
> On Thu, Aug 1, 2019 at 6:32 AM Ryota Ozaki <ozaki.ryota@gmail.com> wrote:
> >
> > On Mon, Jul 29, 2019 at 5:35 PM <sc.dying@gmail.com> wrote:
> > >
> > > >Number: 54419
> > > >Category: kern
> > > >Synopsis: mbuf leak when deleting route
> > > >Confidential: no
> > > >Severity: serious
> > > >Priority: high
> > > >Responsible: kern-bug-people
> > > >State: open
> > > >Class: sw-bug
> > > >Submitter-Id: net
> > > >Arrival-Date: Mon Jul 29 08:35:00 +0000 2019
> > > >Originator: sc.dying@gmail.com
> > > >Release: NetBSD 8.99.51
> > > >Organization:
> > > >Environment:
> > > System: NetBSD 8.99.51 NetBSD 8.99.51 (GENERIC) #0: Sun Jul 28 17:41:21 UTC 2019 mkrepro@mkrepro.NetBSD.org:/usr/src/sys/arch/amd64/compile/GENERIC amd64 x86_64
> > > >Description:
> > >
> > > An mbuf goes somewhere when deleting a route on -current/amd64 and -8.1/amd64.
> > >
> > > When you delete a route using route command, it is deleted successfully, but
> > > mbuf usage of netstat -m gains 1.
> > > See How-To-Repeat for detail.
> > >
> > > I saw same problem on NetBSD-8.1/amd64, too.
> > >
> > > >How-To-Repeat:
> > >
> > > After boot single, I typed following commands.
> > >
> > > # uname -ap
> > > NetBSD 8.99.51 NetBSD 8.99.51 (GENERIC) #0: Sun Jul 28 17:41:21 UTC 2019 mkrepro@mkrepro.NetBSD.org:/usr/src/sys/arch/amd64/compile/GENERIC amd64 x86_64
> > > # ifconfig lo0 127.0.0.1
> > > # route add 192.168.0.1 127.0.0.1
> > > add host 192.168.0.1: gateway 127.0.0.1
> > > # netstat -m
> > > 0 mbufs in use:
> > > 0 calls to protocol drain routines
> > > # route delete 192.168.0.1
> > > delete host 192.168.0.1
> > > # netstat -m
> > > 1 mbufs in use:
> > > 1 mbufs allocated to data
> > > 0 calls to protocol drain routines
> > > # sh -c 'i=0; while [ $i -lt 10000 ]; do route -q add 192.168.0.1 127.0.0.1; route -q delete 192.168.0.1; i=$((i+1)); done'
> > > # netstat -m
> > > 10001 mbufs in use:
> > > 10001 mbufs allocated to data
> > > 0 calls to protocol drain routines
> > > #
> >
> > The leak occurs if there is no listener of routing sockets. That's the
> > reason the single user mode is needed and we don't observe the leak
> > normally.
>
> Yes, on other hosts I run ntpd with ntpd_chrootdir set,
> so I can reproduce on them.
>
> > > >Fix:
> > > Yes, please.
> >
> > The below patch fixes the leak.
>
> I confirm the problem is fixed.
> Thank you!
Thank you for the confirmation! I've committed it and will pull it up to
-8/-9 soon.
ozaki-r
>
> >
> > I guess it's a typo. Should we disallow normal users of m_freem to
> > use m_free accidentally by say renaming it to _m_free or something?
> >
> > Thanks,
> > ozaki-r
> >
> > diff --git a/sys/net/raw_usrreq.c b/sys/net/raw_usrreq.c
> > index 24185c17939..19d96dcb82b 100644
> > --- a/sys/net/raw_usrreq.c
> > +++ b/sys/net/raw_usrreq.c
> > @@ -110,7 +110,7 @@ raw_input(struct mbuf *m0, struct sockproto
> > *proto, struct sockaddr *src,
> > }
> > if (last != NULL) {
> > if (sbappendaddr(&last->so_rcv, src, m, NULL) == 0) {
> > - m_free(m);
> > + m_freem(m);
> > soroverflow(last);
> > } else
> > sorwakeup(last);
State-Changed-From-To: open->pending-pullups
State-Changed-By: ozaki-r@NetBSD.org
State-Changed-When: Fri, 02 Aug 2019 05:02:01 +0000
State-Changed-Why:
pullup-8 #1318 and pullup-9 #7
From: "Martin Husemann" <martin@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc:
Subject: PR/54419 CVS commit: [netbsd-8] src/sys/net
Date: Sun, 4 Aug 2019 11:01:22 +0000
Module Name: src
Committed By: martin
Date: Sun Aug 4 11:01:22 UTC 2019
Modified Files:
src/sys/net [netbsd-8]: raw_usrreq.c
Log Message:
Pull up following revision(s) (requested by ozaki-r in ticket #1318):
sys/net/raw_usrreq.c: revision 1.63
sys/net/raw_usrreq.c: revision 1.64
Fix typo (s/m_free/m_freem/)
This fixes PR kern/54419 "mbuf leak when deleting route" from sc dying.
-
Fix typo (s/m_free/m_freem/) (one more)
To generate a diff of this commit:
cvs rdiff -u -r1.56.4.2 -r1.56.4.3 src/sys/net/raw_usrreq.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
From: "Martin Husemann" <martin@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc:
Subject: PR/54419 CVS commit: [netbsd-9] src/sys/net
Date: Sun, 4 Aug 2019 11:40:11 +0000
Module Name: src
Committed By: martin
Date: Sun Aug 4 11:40:11 UTC 2019
Modified Files:
src/sys/net [netbsd-9]: raw_usrreq.c
Log Message:
Pull up following revision(s) (requested by ozaki-r in ticket #7):
sys/net/raw_usrreq.c: revision 1.63
sys/net/raw_usrreq.c: revision 1.64
Fix typo (s/m_free/m_freem/)
This fixes PR kern/54419 "mbuf leak when deleting route" from sc dying.
-
Fix typo (s/m_free/m_freem/) (one more)
To generate a diff of this commit:
cvs rdiff -u -r1.62 -r1.62.4.1 src/sys/net/raw_usrreq.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
State-Changed-From-To: pending-pullups->closed
State-Changed-By: ozaki-r@NetBSD.org
State-Changed-When: Mon, 05 Aug 2019 02:42:08 +0000
State-Changed-Why:
Pulled up. Thanks.
>Unformatted:
(Contact us)
$NetBSD: query-full-pr,v 1.43 2018/01/16 07:36:43 maya Exp $
$NetBSD: gnats_config.sh,v 1.9 2014/08/02 14:16:04 spz Exp $
Copyright © 1994-2017
The NetBSD Foundation, Inc. ALL RIGHTS RESERVED.
Home