[Bug 256714] Memory leaks when detaching a device
Date: Sat, 19 Jun 2021 11:05:33 UTC
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=256714
Bug ID: 256714
Summary: Memory leaks when detaching a device
Product: Base System
Version: 13.0-STABLE
Hardware: Any
OS: Any
Status: New
Severity: Affects Some People
Priority: ---
Component: bin
Assignee: bugs@FreeBSD.org
Reporter: jcaplan@blackberry.com
Created attachment 225929
--> https://bugs.freebsd.org/bugzilla/attachment.cgi?id=225929&action=edit
proposed patch
Overview
--------
I identified a few memory leaks that occur when detaching a device. The
routetbl leak depends on the FIB_ALGO option.
There are 3 new leaks when unmounting devices compared to 12.2.
- pfil_head_unregister() should free the ph. This is a typical use, implying
that memory should be freed and it's not the callers responsibility:
pfil_head_unregister(priv->pfil);
priv->pfil = NULL;
- in6_purgeifaddr() was removing an item from a list, and then deleting it. The
only problem is that `nd6_prefix_del()` does reference counting and this may
not be the last reference. instead leave it on the list so it can be still
properly deleted later on by nd6_purge().
- the new in6_fib_algo.c code uses the rn_* radix tree functions.
rn_detachhead() doesn't free all rn_mklist objects.
Steps to Reproduce
------------------
# vmstat -m | grep -E 'ip6ndp | routetbl | pfil'
pfil 17 2K - 17 64,128
routetbl 126 14K - 425
32,64,128,256,512,1024,2048,4096,8192
ip6ndp 10 2K - 18 64,256
# devctl attach pci0:3:0:0
# ifconfig vmx0 172.16.129.201/24 up
# devctl detach pci0:3:0:0
# vmstat -m | grep -E 'ip6ndp | routetbl | pfil'
pfil 18 2K - 18 64,128
routetbl 151 14K - 509
32,64,128,256,512,1024,2048,4096,8192
ip6ndp 11 2K - 21 64,256
Actual Results
--------------
Increase in networking device related memory after attaching and detaching a
device
Expected Results
----------------
All memory is freed
Build Date & Hardware
---------------------
FreeBSD freebsd 13.0-RELEASE FreeBSD 13.0-RELEASE #6
releng/13.0-n244733-ea31abc261f: Sat Jun 19 06:23:53 UTC 2021
jcaplan@freebsd:/usr/obj/usr/src/amd64.amd64/sys/DEBUG amd64
Additional Information
----------------------
Diff attached to fix leaks.
For the lradix6_destroy() issue, it's a workaround because passing the root of
the tree to rn_detachhead() is leaking the memory allocated in
rn_new_radix_mask(). However, I'm not sure it's possible to safely free that
memory in a single walk of the radix tree and address the leak from within
rn_delete(). If it turns out to be necessary to do a second pass, doing so on
the flattened list of nodes in lr->radix_mem is convenient. It could also be
done from inside rn_detachhead() with an extra rn_walktree().
--
You are receiving this mail because:
You are the assignee for the bug.