kern/144330: [nfs] mbuf leakage in nfsd with zfs

[Mikolaj Golub]

The following reply was made to PR kern/144330; it has been noted by GNATS.

From: Mikolaj Golub <to.my.trociny at gmail.com>
To: Rick Macklem <rmacklem at uoguelph.ca>
Cc: Jeremy Chadwick <freebsd at jdc.parodius.com>,  freebsd-fs at FreeBSD.org,
	  Kai Kockro <kkockro at web.de>, bug-followup at FreeBSD.org,
          gerrit at pmp.uni-hannover.de
Subject: Re: kern/144330: [nfs] mbuf leakage in nfsd with zfs
Date: Sun, 21 Mar 2010 15:43:21 +0200

 --=-=-=
 
 Having debian in VirtualBOX I had some problems reproducing this until I ran
 a script that dropped for shot periods of time traffic from the nfs server to
 the client (using pf):
 
 block out on $if from any to <nfs>
 
 while sleep 3; do 
     sudo pfctl -t nfs -vT add 10.0.0.217;
     sleep 2; 
     sudo pfctl -t nfs -vT show;
     sudo pfctl -t nfs -vT delete 10.0.0.217;
 done
 
 The idea was to drop NFS server responses to make the client resend requests
 and make RPC reply comes from the cache. And mbufs usage growth started to
 observe:
 
 09:30: 2806/1589/4395 mbufs in use (current/cache/total)
 10:00: 5397/1068/6465 mbufs in use (current/cache/total)
 10:30: 7945/1760/9705 mbufs in use (current/cache/total)
 11:00: 9560/1435/10995 mbufs in use (current/cache/total)
 11:30: 10337/2113/12450 mbufs in use (current/cache/total)
 
 Athough it might be another issue then reported in this pr :-).
 
 Reviewing rpc/svc.c:svc_getreq() it looks for me that for RS_DONE case args
 are nevere freed. Shouldn't it be like in the attached patch?
 
 Running the above test on the patched kernel the growth has not been observed
 so far:
 
 13:00: 1501/2219/3720 mbufs in use (current/cache/total)
 13:30: 1514/2971/4485 mbufs in use (current/cache/total)
 14:00: 1096/3389/4485 mbufs in use (current/cache/total)
 14:30: 1107/3378/4485 mbufs in use (current/cache/total)
 15:00: 1105/3380/4485 mbufs in use (current/cache/total)
 15:30: 1105/3380/4485 mbufs in use (current/cache/total)
 
 -- 
 Mikolaj Golub
 
 
 --=-=-=
 Content-Type: text/x-diff
 Content-Disposition: inline; filename=svc.c.svc_getreq.patch
 
 --- sys/rpc/svc.c.orig	2010-03-21 10:17:20.000000000 +0200
 +++ sys/rpc/svc.c	2010-03-21 10:20:05.000000000 +0200
 @@ -819,6 +819,7 @@ svc_getreq(SVCXPRT *xprt, struct svc_req
  					free(r->rq_addr, M_SONAME);
  					r->rq_addr = NULL;
  				}
 +				m_freem(args);
  				goto call_done;
  
  			default:
 
 --=-=-=--