linux-kernel - Memory leak of skbuff_ext

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20191017022654.5b993ce1@fire.localdomain>
Date:   Thu, 17 Oct 2019 02:26:54 +0300
From:   Dmitrii Tcvetkov <demfloro@...floro.ru>
To:     netdev@...r.kernel.org
Cc:     linux-kernel@...r.kernel.org
Subject: Memory leak of skbuff_ext_cache in v5.4-rc2

During testing of v5.4-rc2 on a machine with

0a:00.0 Ethernet controller: Realtek Semiconductor Co., Ltd.
RTL8111/8168/8411 PCI Express Gigabit Ethernet Controller (rev 09)

I noticed that skbuff_ext_cache memory usage was constantly increasing:

# grep skbuff_ext_cache /proc/slabinfo
slabinfo - version: 2.1
...
skbuff_ext_cache  206880 206880    128   32    1 : tunables    0    0    0 : slabdata   6465   6465      0

(After 60 seconds)

# grep skbuff_ext_cache /proc/slabinfo
slabinfo - version: 2.1
...
skbuff_ext_cache  217312 217312    128   32    1 : tunables    0    0    0 : slabdata   6791   6791      0

There is no limit to this, after about 24 hours size of the cache was more
than 1.5 GiB.

Bisect led me to commit 895b5c9f206 (netfilter: drop bridge nf reset from nf_reset).
After reverting the commit I can't reproduce the problem on current
mainline master (bc88f85c6c0) on the machine.

Bisect log:
git bisect start
# good: [54ecb8f7028c5eb3d740bb82b0f1d90f2df63c5c] Linux 5.4-rc1
git bisect good 54ecb8f7028c5eb3d740bb82b0f1d90f2df63c5c
# bad: [da0c9ea146cbe92b832f1b0f694840ea8eb33cce] Linux 5.4-rc2
git bisect bad da0c9ea146cbe92b832f1b0f694840ea8eb33cce
# good: [2cf2aa6a69db0b17b3979144287af8775c1c1534] dma-mapping: fix false positivse warnings in dma_common_free_remap()
git bisect good 2cf2aa6a69db0b17b3979144287af8775c1c1534
# bad: [2d880b8709c013d47472f85a9d42ea1aca3bce47] net: phy: extract pause mode
git bisect bad 2d880b8709c013d47472f85a9d42ea1aca3bce47
# good: [b33210e3797d600a5a5e556682f0afe596aa011b] Merge branch 'stmmac-fixes'
git bisect good b33210e3797d600a5a5e556682f0afe596aa011b
# bad: [53de429f4e88f538f7a8ec2b18be8c0cd9b2c8e1] net: hisilicon: Fix usage of uninitialized variable in function mdio_sc_cfg_reg_write()
git bisect bad 53de429f4e88f538f7a8ec2b18be8c0cd9b2c8e1
# good: [e8521e53cca584ddf8ec4584d3c550a6c65f88c4] net: dsa: rtl8366: Check VLAN ID and not ports
git bisect good e8521e53cca584ddf8ec4584d3c550a6c65f88c4
# good: [76d674947c17d297d65b185aa6ce551f915c7e2e] Merge branch 'SJA1105-DSA-locking-fixes-for-PTP'
git bisect good 76d674947c17d297d65b185aa6ce551f915c7e2e
# bad: [34a4c95abd25ab41fb390b985a08a651b1fa0b0f] netfilter: nft_connlimit: disable bh on garbage collection
git bisect bad 34a4c95abd25ab41fb390b985a08a651b1fa0b0f
# bad: [895b5c9f206eb7d25dc1360a8ccfc5958895eb89] netfilter: drop bridge nf reset from nf_reset
git bisect bad 895b5c9f206eb7d25dc1360a8ccfc5958895eb89
# first bad commit: [895b5c9f206eb7d25dc1360a8ccfc5958895eb89] netfilter: drop bridge nf reset from nf_reset

dmesg after "echo 1 > /sys/kernel/slab/skbuff_ext_cache/trace" attached.

Other machines with other network cards don't show the problem with
commit 895b5c9f206 (netfilter: drop bridge nf reset from nf_reset).

View attachment "trace.txt" of type "text/plain" (119276 bytes)