kern/78968: FreeBSD freezes on mbufs exhaustion (network interface independent)

[Jakub Kruszona-Zawadzki]

>Number:         78968
>Category:       kern
>Synopsis:       FreeBSD freezes on mbufs exhaustion (network interface independent)
>Confidential:   no
>Severity:       critical
>Priority:       high
>Responsible:    freebsd-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Thu Mar 17 22:40:02 GMT 2005
>Closed-Date:
>Last-Modified:
>Originator:     Jakub Kruszona-Zawadzki
>Release:        FreeBSD 5.3
>Organization:
Gemius SA
>Environment:
FreeBSD router.gucio.pl 5.3-STABLE FreeBSD 5.3-STABLE #4: Sun Dec  5 04:53:26 CET 2004     root at router.gucio.pl:/usr/obj/usr/src/sys/GENERIC  i386      
>Description:
We are using all of our output bandwidth. Tcp stack allocates mbufs for output queues. When mbufs space is exhausted system freezes. Even 'numlock' on keyboard don't work. It looks like kernel is going into an infinite loop or something - system is dead and the only thing you can do is reboot.
>How-To-Repeat:
Set max mbufs to a small number (only for testing).
Generate a file about 300kB (i.e. dd if=/dev/urandom of=/tmp/file bs=1024 count=300).
Add to inetd.conf line like this:
telnet  stream  tcp     nowait  root    /bin/cat        cat     /tmp/file
Restart inetd with these options (maybe not all are necessary):
inetd -c 0 -C 0 -R 0 -s 0

On remote machine run many processes that will open many connections to your serwer on telent port, but WILL NOT download the file. You can use these programs:
In python:
#!/usr/bin/env python
from socket import socket
from time import sleep

socks = []
for i in xrange(240):
    try:
        s = socket()
        s.connect(('192.168.0.1',23))
        socks.append(s)
    except Exception:
        pass

print "opened"
sleep(100)

for i in socks:
    i.close()

In php:
<?
 for ($i=0;$i<1000;$i++) {
  if(!($file[$i]=fsockopen('192.168.0.1',23)))
   break;
  fgets($file[$i],1);
 }
?>

FreeBSD 5.3 with default number of mbufs (about 17000) freezes after a few minutes, when both these programs work in several (6 pythons an 15 phps) copies.
While these programs are active, "netstat -n" should be showing many "ESTABLISHED" connections with full output queue. In "netstat -m" output number of "mbufs in use" and "mbuf clusters in use" should increase. When current number of "mbuf clusters in use" reaches max value, system freezes in a few seconds.

During normal work "netstat -m" looks like this:
334 mbufs in use
198/17088 mbuf clusters in use (current/max)
0/3/4528 sfbufs in use (current/peak/max)
479 KBytes allocated to network
0 requests for sfbufs denied
0 requests for sfbufs delayed
0 requests for I/O initiated by sendfile
104 calls to protocol drain routines

>Fix:
This problem doesn't exist in FreeBSD 4.x
>Release-Note:
>Audit-Trail:
>Unformatted: