misc/139058: mbuf cluster leak in ipfilter on FreeBSD 7.2
Jens Kassel
jens.kassel at birdstep.com
Tue Sep 22 12:30:02 UTC 2009
>Number: 139058
>Category: misc
>Synopsis: mbuf cluster leak in ipfilter on FreeBSD 7.2
>Confidential: no
>Severity: critical
>Priority: high
>Responsible: freebsd-bugs
>State: open
>Quarter:
>Keywords:
>Date-Required:
>Class: sw-bug
>Submitter-Id: current-users
>Arrival-Date: Tue Sep 22 12:30:01 UTC 2009
>Closed-Date:
>Last-Modified:
>Originator: Jens Kassel
>Release: FreeBSD 7.2 release
>Organization:
Birdstep
>Environment:
uname -a
FreeBSD h167.servicefactory.com 7.2-RELEASE FreeBSD 7.2-RELEASE #0: Fri May 1 08:49:13 UTC 2009 root at walker.cse.buffalo.edu:/usr/obj/usr/src/sys/GENERIC i386
>Description:
ipfilter/ipnat mbuf cluster leak
ipf 1.4.28
A fix for this was already implemented on FreeBSD 6.4 but lost in the FreeBSD 7.2.
I.e. version 1.4.28 on FreeBSD 6.4 differs from 1.4.28 on FreeBSD 7.2
>How-To-Repeat:
Force many bad nats
ipnat -s
mapped in 25367 out 1563123
added 186173 expired 159616
no memory 0 bad nat 2142640
inuse 26253
orphans 0
rules 154
wilds 0
hash efficiency 49.56%
bucket usage 39.71%
minimal length 0
maximal length 9
average length 2.018
TCP Entries per state
0 1 2 3 4 5 6 7 8 9 10 11
0 22636 0 0 22 3404 108 0 0 0 1 60
mbuf cluster will leak ....
>Fix:
Apply the following patch
--- ip_fil_freebsd.c 26 Oct 2006 11:22:04 -0000 1.1.1.1.2.2
+++ ip_fil_freebsd.c 21 Feb 2007 13:39:55 -0000
@@ -1016,7 +1016,7 @@
break;
case -1 :
error = -1;
- goto done;
+ goto bad;
break;
}
>Release-Note:
>Audit-Trail:
>Unformatted:
More information about the freebsd-bugs
mailing list