linux-kernel - Send-Q on UDP socket growing steadily

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <47EF2890.9010704@rojer.pp.ru>
Date:	Sun, 30 Mar 2008 06:43:44 +0100
From:	Deomid Ryabkov <myself@...er.pp.ru>
To:	linux-kernel@...r.kernel.org
Subject: Send-Q on UDP socket growing steadily - why?

This has started recently and i'm at a loss as to why.
Send-Q on a moderately active UDP socket keeps growing steadily until it 
reaches ~128K (wmem_max?) at which point socket writes start failing.
The application in question is standard ntpd from Fedora 7, kernel is 
the latest available for the distro, that is
2.6.23.15-80.fc7 #1 SMP Sun Feb 10 16:52:18 EST 2008 x86_64

BIND, running on the same machine, does not exhibit this problem, but 
that may be because it does not get nearly as much load as ntpd,
which is part of the pool.ntp.org. That said, load is really not very 
high, on the order of 10 QPS, and machine is 99+% idle.
ntpd seems to be doing its usual select-recvmsg-sendto routine, nothing 
out of the ordinary.
And yet, Send-Q keeps growing at _exactly_ 360 bytes every 10 seconds, 
here's a sample of output shortly after ntpd restart:

# while sleep 1; do netstat -na | grep 177:123; done
udp        0  17280 89.111.168.177:123          
0.0.0.0:*                              
udp        0  17280 89.111.168.177:123          
0.0.0.0:*                              
udp        0  17280 89.111.168.177:123          
0.0.0.0:*                              
udp        0  17280 89.111.168.177:123          
0.0.0.0:*                              
udp        0  17280 89.111.168.177:123          
0.0.0.0:*                              
udp        0  17280 89.111.168.177:123          
0.0.0.0:*                              
udp        0  17280 89.111.168.177:123          
0.0.0.0:*                              
udp        0  17280 89.111.168.177:123          
0.0.0.0:*                              
-------> +360 bytes
udp        0  17640 89.111.168.177:123          
0.0.0.0:*                              
udp        0  17640 89.111.168.177:123          
0.0.0.0:*                              
udp        0  17640 89.111.168.177:123          
0.0.0.0:*                              
udp        0  17640 89.111.168.177:123          
0.0.0.0:*                              
udp        0  17640 89.111.168.177:123          
0.0.0.0:*                              
udp        0  17640 89.111.168.177:123          
0.0.0.0:*                              
udp        0  17640 89.111.168.177:123          
0.0.0.0:*                              
udp        0  17640 89.111.168.177:123          
0.0.0.0:*                              
udp        0  17640 89.111.168.177:123          
0.0.0.0:*                              
udp        0  17640 89.111.168.177:123          
0.0.0.0:*                              
-------> +360 bytes, 10 seconds later
udp        0  18000 89.111.168.177:123          
0.0.0.0:*                              
udp        0  18000 89.111.168.177:123          
0.0.0.0:*                              
udp        0  18000 89.111.168.177:123          
0.0.0.0:*                              
udp        0  18000 89.111.168.177:123          
0.0.0.0:*                              
udp        0  18000 89.111.168.177:123          
0.0.0.0:*                              
udp        0  18000 89.111.168.177:123          
0.0.0.0:*                              
udp        0  18000 89.111.168.177:123          
0.0.0.0:*                              
udp        0  18000 89.111.168.177:123          
0.0.0.0:*                              
udp        0  18000 89.111.168.177:123          
0.0.0.0:*                              
udp        0  18000 89.111.168.177:123          
0.0.0.0:*                              
-------> +360 bytes, 10 seconds later
udp        0  18360 89.111.168.177:123          0.0.0.0:*              
[...]
etc, etc.

My understanding is that non-empty send queue for UDP sockets should be 
very rare occurence,
maybe under extreme loads. And then there's this steady creep...
What's going on? It almost looks like something is leaking somewhere.

-- 
Deomid Ryabkov aka Rojer
myself@...er.pp.ru
rojer@...admins.ru
ICQ: 8025844

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/