netdev - Re: Memory leak in ip_dst

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <1315806031.3174.16.camel@edumazet-laptop>
Date:	Mon, 12 Sep 2011 07:40:31 +0200
From:	Eric Dumazet <eric.dumazet@...il.com>
To:	Kumar S <ps2kumar@...oo.com>
Cc:	Neil Horman <nhorman@...driver.com>,
	netdev <netdev@...r.kernel.org>
Subject: Re: Memory leak in ip_dst_cache

Le dimanche 11 septembre 2011 à 20:38 -0700, Kumar S a écrit :

Please dont top post.

> Thanks Neil. I did try with prink(). I do see entries getting aged
> out, but they are not getting deallocated. This seems to be happening
> because of "ref_cnt". When the route entries are added the ref_cnt is
> set to 1. Looks this is causing trouble clearing the entries
> completely. If I set the ref_cnt to 0, I can see it working. Now I'm
> trying to understand whether this is right. Please let me know if you
> have any thoughts on it.

I believe I already explained what was happening.

A tcp socket has a pointer to a dst, so it holds a reference on it, to
make sure no freeing of dst can happen while at least some socket still
can reference dst. (It could reference freed memory and crash)

As soon as the tcp socket will try to transmit some data, the dst will
be checked and we notice its obsolete : We then release the refcount and
dst pointer.

Later, the garbage collector can notice dst refcount is zero and can
free dst.

If you have dormant tcp sockets (no trafic at all), they hold their dst.

A dormant tcp socket has a pretty more expensive memory cost than its
dst. (Socket structure, dentry, inode, and probably in user land a
thread or process, and data)

--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html