Messages in this thread Patch in this message | | | Date | Sun, 30 Jan 2005 18:58:27 +0100 | From | Patrick McHardy <> | Subject | Re: Memory leak in 2.6.11-rc1? |
| |
Patrick McHardy wrote:
>> Russell King wrote: >> >>> I don't know if the code is using fragment lists in ip_fragment(), but >>> on reading the code a question comes to mind: if we have a list of >>> fragments, does each fragment skb have a valid (and refcounted) dst >>> pointer before ip_fragment() does it's job? If yes, then isn't the >>> first ip_copy_metadata() in ip_fragment() going to overwrite this >>> pointer without dropping the refcount? >>> >> Nice spotting. If conntrack isn't loaded defragmentation happens after >> routing, so this is likely the cause. > > > OTOH, if conntrack isn't loaded forwarded packet are never defragmented, > so frag_list should be empty. So probably false alarm, sorry.
Ok, final decision: you are right :) conntrack also defragments locally generated packets before they hit ip_fragment. In this case the fragments have skb->dst set.
Regards Patrick
===== net/ipv4/ip_output.c 1.74 vs edited ===== --- 1.74/net/ipv4/ip_output.c 2005-01-25 01:40:10 +01:00 +++ edited/net/ipv4/ip_output.c 2005-01-30 18:54:43 +01:00 @@ -389,6 +389,7 @@ to->priority = from->priority; to->protocol = from->protocol; to->security = from->security; + dst_release(to->dst); to->dst = dst_clone(from->dst); to->dev = from->dev; | |