kern/144330: [nfs] mbuf leakage in nfsd with zfs

[Mikolaj Golub]

Having debian in VirtualBOX I had some problems reproducing this until I ran
a script that dropped for shot periods of time traffic from the nfs server to
the client (using pf):

block out on $if from any to <nfs>

while sleep 3; do 
    sudo pfctl -t nfs -vT add 10.0.0.217;
    sleep 2; 
    sudo pfctl -t nfs -vT show;
    sudo pfctl -t nfs -vT delete 10.0.0.217;
done

The idea was to drop NFS server responses to make the client resend requests
and make RPC reply comes from the cache. And mbufs usage growth started to
observe:

09:30: 2806/1589/4395 mbufs in use (current/cache/total)
10:00: 5397/1068/6465 mbufs in use (current/cache/total)
10:30: 7945/1760/9705 mbufs in use (current/cache/total)
11:00: 9560/1435/10995 mbufs in use (current/cache/total)
11:30: 10337/2113/12450 mbufs in use (current/cache/total)

Athough it might be another issue then reported in this pr :-).

Reviewing rpc/svc.c:svc_getreq() it looks for me that for RS_DONE case args
are nevere freed. Shouldn't it be like in the attached patch?

Running the above test on the patched kernel the growth has not been observed
so far:

13:00: 1501/2219/3720 mbufs in use (current/cache/total)
13:30: 1514/2971/4485 mbufs in use (current/cache/total)
14:00: 1096/3389/4485 mbufs in use (current/cache/total)
14:30: 1107/3378/4485 mbufs in use (current/cache/total)
15:00: 1105/3380/4485 mbufs in use (current/cache/total)
15:30: 1105/3380/4485 mbufs in use (current/cache/total)

-- 
Mikolaj Golub

-------------- next part --------------
A non-text attachment was scrubbed...
Name: svc.c.svc_getreq.patch
Type: text/x-diff
Size: 296 bytes
Desc: not available
Url : http://lists.freebsd.org/pipermail/freebsd-fs/attachments/20100321/c1e469be/svc.c.svc_getreq.bin