Messages in this thread Patch in this message | | | Date | Tue, 25 May 1999 22:36:29 +0200 (MET DST) | From | Peter Tirsek <> | Subject | [PATCH] Memory leak in ipchains |
| |
Greetings.
My apologies if this has already been posted.
I've recently had a machine crash due to an appearant lack of memory. The nature of this problem lead us to look for a memory leak in the kernel, and we found a bug in the ipchains firewalling code. This doesn't affect normal operation of most sites, but does cause the kernel to allocate one 100-byte buffer[1] (128-byte slab?) that is never freed again, every time a rule is deleted using IP_FW_DELETE.
To reproduce, simply use the ipchains(8) utility to create a rule in any firewall chain, then delete it again (by rule, not by number). Looking at /proc/slabinfo before and after will show one additional size-128 block being allocated every time. Repeat this 32 times, and the output of free(1) or /proc/meminfo should also report 4k less memory free. Now repeat at will, or until the box crashes. :)
The bug is caused by the code that handles IP_FW_DELETE requests. It calls convert_ipfw(), which allocates and returns a new block of data, that is used later in del_rule_from_chain() to compare and find the matching rule. The rule itself is deleted from the chain and freed properly, but the temporary ip_fwkern is not.
The patch is fairly simple:
--- linux-2.2.9/net/ipv4/ip_fw.c Tue May 25 18:41:16 1999 +++ linux/net/ipv4/ip_fw.c Tue May 25 19:07:05 1999 @@ -1408,8 +1408,10 @@ else if ((chain = find_label(new->fwc_label)) == NULL) ret = ENOENT; else if ((ip_fwkern = convert_ipfw(&new->fwc_rule, &ret)) - != NULL) + != NULL) { ret = del_rule_from_chain(chain, ip_fwkern); + kfree(ip_fwkern); + } } break; Please CC any replies to me directly, as I'm not subscribed to the list.
[1] This is likely to be different on an SMP machine.
-- Peter Tirsek, peter@tirsek.dk | "Linux is not user-friendly!" | "It _is_ user-friendly. It's just not In lack of a better .sig, | ignorant-friendly and idiot-friendly." this is all you get. :-) | -- Unknown
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.rutgers.edu Please read the FAQ at http://www.tux.org/lkml/
| |