kern/64345: 4.x IPFW2 kernel memory leak (IPFW2+rote flaps+verrevpath)

[Dmitry Morozovsky]

>Number:         64345
>Category:       kern
>Synopsis:       4.x IPFW2 kernel memory leak (IPFW2+rote flaps+verrevpath)
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    freebsd-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Tue Mar 16 08:30:24 PST 2004
>Closed-Date:
>Last-Modified:
>Originator:     Dmitry Morozovsky
>Release:        FreeBSD 4-STABLE i386
>Organization:
Cronyx Plus LLC (RiNet ISP)
>Environment:
System: FreeBSD 4-STABLE 


>Description:

The following error has been catched by Oleg Bulyzhin <oleg at rinet.ru>

It seems 4-STABLE leaks kernel memory in routing table while checking reverse
paths.  Our inter-vlan router with zebra/ospfd and 60+ VLANs exhausts default
100M of router table space in a couple of weeks.

Error does not belong to -current since verify_rev_path() has been implemented
different (and much cleaner) way.

>How-To-Repeat:
- build kernel or .ko with ipfw2
- add verrevpath checking rule
ipfw add 50 deny ip from any to any not verrevpath in
- use routing daemon with regular route update flow

-watch for kernel memory used by route table by
vmstat -m | grep rout | tail -1

>Fix:

The following patch seems to fix the problem for us.  However, others corner
cases may exist, so maybe just MFC ip_fw2.c:1.50 ?

Index: sys/netinet/ip_fw2.c
===================================================================
RCS file: /home/ncvs/src/sys/netinet/ip_fw2.c,v
retrieving revision 1.6.2.18
diff -u -r1.6.2.18 ip_fw2.c
--- sys/netinet/ip_fw2.c	17 Oct 2003 11:01:03 -0000	1.6.2.18
+++ sys/netinet/ip_fw2.c	16 Mar 2004 12:39:52 -0000
@@ -432,6 +432,7 @@
 
 	/* Check if we've cached the route from the previous call. */
 	if (src.s_addr != dst->sin_addr.s_addr) {
+		if (ro.ro_rt != NULL) RTFREE(ro.ro_rt);
 		ro.ro_rt = NULL;
 
 		bzero(dst, sizeof(*dst));
>Release-Note:
>Audit-Trail:
>Unformatted: