[Bridge] [BUG] bridge leaks 3 references on lo per up&down

[Bridge] [BUG] bridge leaks 3 references on lo per up&down

[David Lamparter]

On Wed, Jul 28, 2010 at 09:44:28AM +0200, David Lamparter wrote:
> On Tue, Jul 27, 2010 at 10:02:49AM -0700, Stephen Hemminger wrote:
> > David Lamparter <equinox@diac24.net> wrote:
> > > unregister_netdevice: waiting for lo to become free. Usage count = 4
> > > 
> > > unshare -n -- /bin/bash -c 'ip link add link lo veth0 type veth peer
> > > name veth3 netns 1; brctl addbr br0; ip l s br0 up; ip a l; sleep 8'

When I do

unshare -n -- /bin/bash -c 'ip link add link lo veth0 type veth peer
	name veth3 netns 1; brctl addbr br0; \
	ip l s br0 up; sleep 8; ip l s br0 down; sleep 1;
	ip l s br0 up; sleep 8;'

I get "usage count = 7" on lo; when I add another up & down, I get
"usage count = 10". 4 times makes it a merry 13 refs...


-David

Re: [Bridge] [BUG] bridge leaks 3 references on lo per up&down

[David Lamparter]

On Wed, Jul 28, 2010 at 11:58:25AM +0200, David Lamparter wrote:
> unshare -n -- /bin/bash -c 'ip link add link lo veth0 type veth peer
>       name veth3 netns 1; brctl addbr br0; \
>       ip l s br0 up; sleep 8; ip l s br0 down; sleep 1;
>       ip l s br0 up; sleep 8;'
>
> I get "usage count = 7" on lo; when I add another up & down, I get
> "usage count = 10". 4 times makes it a merry 13 refs...

It only happens with BRIDGE_IGMP_SNOOPING. As we don't need that, our
"fix" is just to run with it disabled... works pretty fine.

Herbert, you implemented bridge multicast support, maybe you can figure
out where these references are taken?


-David

Re: [Bridge] [BUG] bridge leaks 3 references on lo per up&down

[Herbert Xu]

On Wed, Jul 28, 2010 at 02:03:36PM +0200, David Lamparter wrote:
> 
> Herbert, you implemented bridge multicast support, maybe you can figure
> out where these references are taken?

OK this patch should fix it.

However, it also means that the IPv6 membership report parsing is
broken and we still need look into it.

bridge: Fix skb leak when multicast parsing fails on TX

On the bridge TX path we're leaking an skb when br_multicast_rcv
returns an error.

Reported-by: David Lamparter <equinox@diac24.net>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>

diff --git a/net/bridge/br_device.c b/net/bridge/br_device.c
index 753fc42..f49f20b 100644
--- a/net/bridge/br_device.c
+++ b/net/bridge/br_device.c
@@ -47,8 +47,10 @@ netdev_tx_t br_dev_xmit(struct sk_buff *skb, struct net_device *dev)
 	skb_pull(skb, ETH_HLEN);
 
 	if (is_multicast_ether_addr(dest)) {
-		if (br_multicast_rcv(br, NULL, skb))
+		if (br_multicast_rcv(br, NULL, skb)) {
+			kfree_skb(skb);
 			goto out;
+		}
 
 		mdst = br_mdb_get(br, skb);
 		if (mdst || BR_INPUT_SKB_CB_MROUTERS_ONLY(skb))

Thanks,
-- 
Email: Herbert Xu <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt

Re: [Bridge] [BUG] bridge leaks 3 references on lo per up&down

[David Miller]

From: Herbert Xu <herbert@gondor.apana.org.au>
Date: Thu, 29 Jul 2010 19:12:31 +0800

> bridge: Fix skb leak when multicast parsing fails on TX
> 
> On the bridge TX path we're leaking an skb when br_multicast_rcv
> returns an error.
> 
> Reported-by: David Lamparter <equinox@diac24.net>
> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>

Applied to net-2.6, thanks!