Page MenuHomeFreeBSD

Properly stop timer before freeing link level entries for IPv4 and IPv6
ClosedPublic

Authored by hselasky on Dec 17 2015, 7:37 PM.
Tags
None
Referenced Files
Unknown Object (File)
Sat, Mar 2, 3:35 AM
Unknown Object (File)
Sat, Mar 2, 3:08 AM
Unknown Object (File)
Thu, Feb 29, 7:25 AM
Unknown Object (File)
Jan 27 2024, 12:11 AM
Unknown Object (File)
Jan 27 2024, 12:11 AM
Unknown Object (File)
Jan 27 2024, 12:09 AM
Unknown Object (File)
Jan 27 2024, 12:09 AM
Unknown Object (File)
Jan 27 2024, 12:09 AM

Details

Summary

By running the following commands link level entries will leak.
This in particular causes a panic when ejecting USB type of ethernet devices.

DEF_ROUTE=x.x.x.x # replace with IP of your default route
vmstat -m | grep llt
arp -d $DEF_ROUTE
ping $DEF_ROUTE
vmstat -m | grep llt
arp -d $DEF_ROUTE
ping $DEF_ROUTE

Fix problem by adding missing callout_stop() calls.
Technically a callout_drain() call is required, though this patch is better than nothing.

Diff Detail

Repository
rS FreeBSD src repository - subversion
Lint
Lint Skipped
Unit
Tests Skipped

Event Timeline

hselasky retitled this revision from to Fix races managing link level tables related to use of callouts.
hselasky updated this object.
hselasky edited the test plan for this revision. (Show Details)
hselasky added reviewers: rrs, glebius, hiren, sbruno, adrian, jhb, bz.
hselasky set the repository for this revision to rS FreeBSD src repository - subversion.
sbruno removed a reviewer: sbruno.
sbruno added a subscriber: sbruno.

Need to check for LLE_LINKED at entry of callout function. Seems some code path is not stopping the callouts!

I'm currently investigating the call to arptimer when LLE_LINKED is not set, who is not clearing the timer.

Here goes:

lltable_delete_addr() will unlink the entry and try to delete it, but doesn't stop the callout.

For example reproduce using the default route x.x.x.x:

vmstat -m | grep llt
arp -d x.x.x.x
ping x.x.x.x
vmstat -m | grep llt
arp -d x.x.x.x
ping x.x.x.x

I observe that the number of llt allocations doesn't drop after the deletion, which means the timer for the unlinked entry still has one reference which appears to be causing this arptimer panic.

Need to stop timer when deleting arp table entries.

Ping - any reviewers active on this one?

Ping - any reviewers active on this one?

sorry, will take a look today.

hselasky edited edge metadata.

Update patch to match 12-current.

Ping - this is still an issue in 12-current when yanking USB network devices.

hselasky retitled this revision from Fix races managing link level tables related to use of callouts to Properly stop timer before freeing link level entries for IPv4 and IPv6.
hselasky edited the summary of this revision. (Show Details)
hselasky edited the test plan for this revision. (Show Details)
hselasky added a reviewer: gallatin.

Update patch for 12-current

loos added a subscriber: loos.

We run a similar fix in pfSense for quite some time now.

This revision is now accepted and ready to land.Jan 23 2018, 8:26 PM
This revision was automatically updated to reflect the committed changes.