From: David Ahern <dsahern@kernel.org>
To: Matt Whitlock <kernel@mattwhitlock.name>
Cc: netdev@vger.kernel.org
Subject: Re: Memory leak in __ip6_rt_update_pmtu (net/ipv6/route.c)
Date: Tue, 11 Apr 2023 10:13:41 -0600 [thread overview]
Message-ID: <20230411161341.GA26208@u2004-local> (raw)
In-Reply-To: <241aa97b-4e6a-4b57-a80b-8f711c135b91@mattwhitlock.name>
On Sat, Apr 08, 2023 at 04:03:29PM -0400, Matt Whitlock wrote:
> Found while running 6.1.23-gentoo with kmemleak while trying to diagnose a
> probably unrelated memory leak:
>
> unreferenced object 0xffff888042fc7b00 (size 256):
> comm "softirq", pid 0, jiffies 4328682724 (age 5739.246s)
> hex dump (first 32 bytes):
> 00 80 4d 01 81 88 ff ff 00 49 e3 94 ff ff ff ff ..M......I......
> 60 ef 70 b5 81 88 ff ff a4 9c 0b 02 01 00 00 00 `.p.............
> backtrace:
> [<000000000b4f8d52>] dst_alloc+0x3c/0x140
> [<0000000075b21562>] ip6_rt_cache_alloc.constprop.0+0x7b/0x190
> [<00000000236d18fe>] __ip6_rt_update_pmtu+0x119/0x250
> [<00000000e4b766f3>] inet6_csk_update_pmtu+0x42/0x80
> [<00000000b86e1f12>] tcp_v6_mtu_reduced+0x35/0x80
> [<00000000a854cc14>] tcp_v6_err+0x41f/0x480
> [<00000000eff3ef2f>] icmpv6_notify+0xbb/0x180
> [<00000000e4924371>] icmpv6_rcv+0x34a/0x3d0
> [<000000007163d548>] ip6_protocol_deliver_rcu+0x75/0x3b0
> [<00000000fdb6a323>] ip6_input_finish+0x35/0x60
> [<00000000ebde6920>] ip6_sublist_rcv_finish+0x2d/0x40
> [<00000000105dd24d>] ip6_sublist_rcv+0x191/0x210
> [<00000000e87845f8>] ipv6_list_rcv+0xed/0x100
> [<00000000206d66ad>] __netif_receive_skb_list_core+0x16c/0x1c0
> [<0000000000117935>] netif_receive_skb_list_internal+0x173/0x270
> [<00000000ea0594e7>] napi_complete_done+0x69/0x170
> unreferenced object 0xffff8881b570ef60 (size 96):
> comm "softirq", pid 0, jiffies 4328682724 (age 5739.246s)
> hex dump (first 32 bytes):
> 00 00 00 00 c8 05 00 00 00 00 00 00 00 00 00 00 ................
> 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
> backtrace:
> [<00000000adeef916>] kmalloc_trace+0x11/0x20
> [<000000002752b81a>] dst_cow_metrics_generic+0x22/0x100
> [<00000000b9c32bc3>] rt6_do_update_pmtu+0x34/0xb0
> [<00000000c53e4e49>] __ip6_rt_update_pmtu+0x12c/0x250
> [<00000000e4b766f3>] inet6_csk_update_pmtu+0x42/0x80
> [<00000000b86e1f12>] tcp_v6_mtu_reduced+0x35/0x80
> [<00000000a854cc14>] tcp_v6_err+0x41f/0x480
> [<00000000eff3ef2f>] icmpv6_notify+0xbb/0x180
> [<00000000e4924371>] icmpv6_rcv+0x34a/0x3d0
> [<000000007163d548>] ip6_protocol_deliver_rcu+0x75/0x3b0
> [<00000000fdb6a323>] ip6_input_finish+0x35/0x60
> [<00000000ebde6920>] ip6_sublist_rcv_finish+0x2d/0x40
> [<00000000105dd24d>] ip6_sublist_rcv+0x191/0x210
> [<00000000e87845f8>] ipv6_list_rcv+0xed/0x100
> [<00000000206d66ad>] __netif_receive_skb_list_core+0x16c/0x1c0
> [<0000000000117935>] netif_receive_skb_list_internal+0x173/0x270
>
> Note: The bottom object is referenced by the top object. (Look in the hex
> dump to see the address 0xffff8881b570ef60 in little-endian byte order at
> offset 16.)
>
> To my unfamiliar eyes this would appear to be the most suspect bit of code
> (in __ip6_rt_update_pmtu at net/ipv6/route.c:2907):
>
> nrt6 = ip6_rt_cache_alloc(&res, daddr, saddr);
> if (nrt6) {
> rt6_do_update_pmtu(nrt6, mtu);
> if (rt6_insert_exception(nrt6, &res))
> dst_release_immediate(&nrt6->dst);
> }
>
> If rt6_insert_exception returns an error, we release the struct dst_entry
> (nrt6->dst), but what about the struct rt6_info (*nrt6) that we just
> allocated?
rt6_info is a container of dst_entry. As the stack trace above shows,
ip6_rt_cache_alloc -> dst_alloc. ie., freeing the dst_entry frees the
rt6_info.
prev parent reply other threads:[~2023-04-11 16:15 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-04-08 20:03 Memory leak in __ip6_rt_update_pmtu (net/ipv6/route.c) Matt Whitlock
2023-04-11 16:13 ` David Ahern [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20230411161341.GA26208@u2004-local \
--to=dsahern@kernel.org \
--cc=kernel@mattwhitlock.name \
--cc=netdev@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).