[Bug 256714] Memory leaks when detaching a device

From: <bugzilla-noreply_at_freebsd.org>
Date: Sat, 19 Jun 2021 11:05:33 +0000

            Bug ID: 256714
           Summary: Memory leaks when detaching a device
           Product: Base System
           Version: 13.0-STABLE
          Hardware: Any
                OS: Any
            Status: New
          Severity: Affects Some People
          Priority: ---
         Component: bin
          Assignee: bugs_at_FreeBSD.org
          Reporter: jcaplan_at_blackberry.com

Created attachment 225929
  --> https://bugs.freebsd.org/bugzilla/attachment.cgi?id=225929&action=edit
proposed patch


I identified a few memory leaks that occur when detaching a device. The
routetbl leak depends on the FIB_ALGO option.

There are 3 new leaks when unmounting devices compared to 12.2.

- pfil_head_unregister() should free the ph. This is a typical use, implying
that memory should be freed and it's not the callers responsibility:

                priv->pfil = NULL;

- in6_purgeifaddr() was removing an item from a list, and then deleting it. The
only problem is that `nd6_prefix_del()` does reference counting and this may
not be the last reference. instead leave it on the list so it can be still
properly deleted later on by nd6_purge().

- the new in6_fib_algo.c code uses the rn_* radix tree functions.
rn_detachhead() doesn't free all rn_mklist objects.

Steps to Reproduce

# vmstat -m | grep -E 'ip6ndp | routetbl | pfil'
         pfil    17     2K       -       17  64,128
     routetbl   126    14K       -      425 
       ip6ndp    10     2K       -       18  64,256
# devctl attach pci0:3:0:0
# ifconfig vmx0 up
# devctl detach pci0:3:0:0
# vmstat -m | grep -E 'ip6ndp | routetbl | pfil'
         pfil    18     2K       -       18  64,128
     routetbl   151    14K       -      509 
       ip6ndp    11     2K       -       21  64,256

Actual Results

Increase in networking device related memory after attaching and detaching a

Expected Results

All memory is freed

Build Date & Hardware
FreeBSD freebsd 13.0-RELEASE FreeBSD 13.0-RELEASE #6
releng/13.0-n244733-ea31abc261f: Sat Jun 19 06:23:53 UTC 2021    
jcaplan_at_freebsd:/usr/obj/usr/src/amd64.amd64/sys/DEBUG  amd64

Additional Information

Diff attached to fix leaks.

For the lradix6_destroy() issue, it's a workaround because passing the root of
the tree to rn_detachhead() is leaking the memory allocated in
rn_new_radix_mask(). However, I'm not sure it's possible to safely free that
memory in a single walk of the radix tree and address the leak from within
rn_delete(). If it turns out to be necessary to do a second pass, doing so on
the flattened list of nodes in lr->radix_mem is convenient. It could also be
done from inside rn_detachhead() with an extra rn_walktree().

You are receiving this mail because:
You are the assignee for the bug.
Received on Sat Jun 19 2021 - 11:05:33 UTC

Original text of this message