[BUG net-next] infamous dev refcnt leak... again.

[BUG net-next] infamous dev refcnt leak... again.

[Eric Dumazet]

While rebooting host running latest net-next

 unregister_netdevice: waiting for eth0 to become free. Usage count = 4

Oh well...

Re: [BUG net-next] infamous dev refcnt leak... again.

[Eric Dumazet]

On Fri, 2015-08-14 at 14:14 -0700, Eric Dumazet wrote:
> While rebooting host running latest net-next
> 
>  unregister_netdevice: waiting for eth0 to become free. Usage count = 4
> 
> Oh well...
> 

It looks like David Ahern recent changes uncover a bug ?

Not clear which commit is at fault.

Maybe 3bfd847203c6d89532f836ad3f5b4ff4ced26dd9 ?

Somehow a down device can be found.

diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c
index b7f1d20..675a3b6 100644
--- a/net/ipv4/fib_semantics.c
+++ b/net/ipv4/fib_semantics.c
@@ -725,10 +725,14 @@ static int fib_check_nh(struct fib_config *cfg, struct fib_info *fi,
 		nh->nh_dev = dev = FIB_RES_DEV(res);
 		if (!dev)
 			goto out;
-		dev_hold(dev);
 		if (!netif_carrier_ok(dev))
 			nh->nh_flags |= RTNH_F_LINKDOWN;
-		err = (dev->flags & IFF_UP) ? 0 : -ENETDOWN;
+		if (dev->flags & IFF_UP) {
+			err = 0;
+			dev_hold(dev);
+		} else {
+			err = -ENETDOWN;
+		}
 	} else {
 		struct in_device *in_dev;
 

Re: [BUG net-next] infamous dev refcnt leak... again.

[David Ahern]

On 8/14/15 5:14 PM, Eric Dumazet wrote:
> On Fri, 2015-08-14 at 14:14 -0700, Eric Dumazet wrote:
>> While rebooting host running latest net-next
>>
>>   unregister_netdevice: waiting for eth0 to become free. Usage count = 4
>>
>> Oh well...
>>
>
> It looks like David Ahern recent changes uncover a bug ?
>
> Not clear which commit is at fault.
>
> Maybe 3bfd847203c6d89532f836ad3f5b4ff4ced26dd9 ?
>
> Somehow a down device can be found.

Can you elaborate on what you are doing to see the refcnt leak? I have 
not seen that at all. I have to leave for soccer carpool in 45 minutes 
or so, but can take a look this weekend.

David

>
> diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c
> index b7f1d20..675a3b6 100644
> --- a/net/ipv4/fib_semantics.c
> +++ b/net/ipv4/fib_semantics.c
> @@ -725,10 +725,14 @@ static int fib_check_nh(struct fib_config *cfg, struct fib_info *fi,
>   		nh->nh_dev = dev = FIB_RES_DEV(res);
>   		if (!dev)
>   			goto out;
> -		dev_hold(dev);
>   		if (!netif_carrier_ok(dev))
>   			nh->nh_flags |= RTNH_F_LINKDOWN;
> -		err = (dev->flags & IFF_UP) ? 0 : -ENETDOWN;
> +		if (dev->flags & IFF_UP) {
> +			err = 0;
> +			dev_hold(dev);
> +		} else {
> +			err = -ENETDOWN;
> +		}
>   	} else {
>   		struct in_device *in_dev;
>
>
>

Re: [BUG net-next] infamous dev refcnt leak... again.

[Eric Dumazet]

On Fri, 2015-08-14 at 17:19 -0600, David Ahern wrote:
> On 8/14/15 5:14 PM, Eric Dumazet wrote:
> > On Fri, 2015-08-14 at 14:14 -0700, Eric Dumazet wrote:
> >> While rebooting host running latest net-next
> >>
> >>   unregister_netdevice: waiting for eth0 to become free. Usage count = 4
> >>
> >> Oh well...
> >>
> >
> > It looks like David Ahern recent changes uncover a bug ?
> >
> > Not clear which commit is at fault.
> >
> > Maybe 3bfd847203c6d89532f836ad3f5b4ff4ced26dd9 ?
> >
> > Somehow a down device can be found.
> 
> Can you elaborate on what you are doing to see the refcnt leak? I have 
> not seen that at all. I have to leave for soccer carpool in 45 minutes 
> or so, but can take a look this weekend.


I simply reboot my host. eth0 device can not be dismantled and block the
reboot, I gave to reset the host.

I get the issue every time.

I confirm reverting 3bfd847203c6d89532f836ad3f5b4ff4ced26dd9
removes the issue for me.

Re: [BUG net-next] infamous dev refcnt leak... again.

[Eric Dumazet]

On Fri, 2015-08-14 at 16:31 -0700, Eric Dumazet wrote:

> 
> I simply reboot my host. eth0 device can not be dismantled and block the
> reboot, I gave to reset the host.
> 
> I get the issue every time.
> 
> I confirm reverting 3bfd847203c6d89532f836ad3f5b4ff4ced26dd9
> removes the issue for me.
> 

Also, netif_index_is_vrf() is supposed to be called under rcu,
but it is not the case from net/ipv4/udp.c , and ip_route_connect_init()

[PATCH net-next] ipv4: fix refcount leak in fib_check_nh()

[Eric Dumazet]

From: Eric Dumazet <edumazet@google.com>

fib_lookup() forces FIB_LOOKUP_NOREF flag, while fib_table_lookup()
does not.

This patch solves the typical message at reboot time or device
dismantle :

unregister_netdevice: waiting for eth0 to become free. Usage count = 4

Fixes: 3bfd847203c6 ("net: Use passed in table for nexthop lookups")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: David Ahern <dsa@cumulusnetworks.com>
---
 net/ipv4/fib_semantics.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c
index b7f1d20a9615..c8025851dac7 100644
--- a/net/ipv4/fib_semantics.c
+++ b/net/ipv4/fib_semantics.c
@@ -708,7 +708,8 @@ static int fib_check_nh(struct fib_config *cfg, struct fib_info *fi,
 
 			if (tbl)
 				err = fib_table_lookup(tbl, &fl4, &res,
-						   FIB_LOOKUP_IGNORE_LINKSTATE);
+						       FIB_LOOKUP_IGNORE_LINKSTATE |
+						       FIB_LOOKUP_NOREF);
 			else
 				err = fib_lookup(net, &fl4, &res,
 						 FIB_LOOKUP_IGNORE_LINKSTATE);

Re: [PATCH net-next] ipv4: fix refcount leak in fib_check_nh()

[David Ahern]

On 8/15/15 11:54 AM, Eric Dumazet wrote:
> From: Eric Dumazet <edumazet@google.com>
>
> fib_lookup() forces FIB_LOOKUP_NOREF flag, while fib_table_lookup()
> does not.
>
> This patch solves the typical message at reboot time or device
> dismantle :
>
> unregister_netdevice: waiting for eth0 to become free. Usage count = 4
>
> Fixes: 3bfd847203c6 ("net: Use passed in table for nexthop lookups")
> Signed-off-by: Eric Dumazet <edumazet@google.com>
> Cc: David Ahern <dsa@cumulusnetworks.com>

Still puzzled why I was not seeing the refcnt problem at reboot though I 
did see the extra dev_hold when I instrumented the hold and put. 
Anyways, thanks for resolving, Eric.

Acked-by: David Ahern <dsa@cumulusnetworks.com>

Re: [PATCH net-next] ipv4: fix refcount leak in fib_check_nh()

[David Miller]

From: Eric Dumazet <eric.dumazet@gmail.com>
Date: Sat, 15 Aug 2015 10:54:07 -0700

> From: Eric Dumazet <edumazet@google.com>
> 
> fib_lookup() forces FIB_LOOKUP_NOREF flag, while fib_table_lookup()
> does not.
> 
> This patch solves the typical message at reboot time or device
> dismantle :
> 
> unregister_netdevice: waiting for eth0 to become free. Usage count = 4
> 
> Fixes: 3bfd847203c6 ("net: Use passed in table for nexthop lookups")
> Signed-off-by: Eric Dumazet <edumazet@google.com>
> Cc: David Ahern <dsa@cumulusnetworks.com>

Applied, thanks Eric.