[Bug 256714] Memory leaks when detaching a device

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=256714

            Bug ID: 256714
           Summary: Memory leaks when detaching a device
           Product: Base System
           Version: 13.0-STABLE
          Hardware: Any
                OS: Any
            Status: New
          Severity: Affects Some People
          Priority: ---
         Component: bin
          Assignee: bugs@FreeBSD.org
          Reporter: jcaplan@blackberry.com

Created attachment 225929
  --> https://bugs.freebsd.org/bugzilla/attachment.cgi?id=225929&action=edit
proposed patch

Overview
--------

I identified a few memory leaks that occur when detaching a device. The
routetbl leak depends on the FIB_ALGO option.

There are 3 new leaks when unmounting devices compared to 12.2.

- pfil_head_unregister() should free the ph. This is a typical use, implying
that memory should be freed and it's not the callers responsibility:

                pfil_head_unregister(priv->pfil);
                priv->pfil = NULL;


- in6_purgeifaddr() was removing an item from a list, and then deleting it. The
only problem is that `nd6_prefix_del()` does reference counting and this may
not be the last reference. instead leave it on the list so it can be still
properly deleted later on by nd6_purge().

- the new in6_fib_algo.c code uses the rn_* radix tree functions.
rn_detachhead() doesn't free all rn_mklist objects.

Steps to Reproduce
------------------


# vmstat -m | grep -E 'ip6ndp | routetbl | pfil'
         pfil    17     2K       -       17  64,128
     routetbl   126    14K       -      425 
32,64,128,256,512,1024,2048,4096,8192
       ip6ndp    10     2K       -       18  64,256
# devctl attach pci0:3:0:0
# ifconfig vmx0 172.16.129.201/24 up
# devctl detach pci0:3:0:0
# vmstat -m | grep -E 'ip6ndp | routetbl | pfil'
         pfil    18     2K       -       18  64,128
     routetbl   151    14K       -      509 
32,64,128,256,512,1024,2048,4096,8192
       ip6ndp    11     2K       -       21  64,256


Actual Results
--------------

Increase in networking device related memory after attaching and detaching a
device

Expected Results
----------------

All memory is freed


Build Date & Hardware
---------------------
FreeBSD freebsd 13.0-RELEASE FreeBSD 13.0-RELEASE #6
releng/13.0-n244733-ea31abc261f: Sat Jun 19 06:23:53 UTC 2021    
jcaplan@freebsd:/usr/obj/usr/src/amd64.amd64/sys/DEBUG  amd64


Additional Information
----------------------

Diff attached to fix leaks.


For the lradix6_destroy() issue, it's a workaround because passing the root of
the tree to rn_detachhead() is leaking the memory allocated in
rn_new_radix_mask(). However, I'm not sure it's possible to safely free that
memory in a single walk of the radix tree and address the leak from within
rn_delete(). If it turns out to be necessary to do a second pass, doing so on
the flattened list of nodes in lr->radix_mem is convenient. It could also be
done from inside rn_detachhead() with an extra rn_walktree().

-- 
You are receiving this mail because:
You are the assignee for the bug.