| Message ID | m1skq53g9l.fsf_-_@frodo.ebiederm.org |
|---|---|
| State | Accepted, archived |
| Delegated to: | David Miller |
| Headers | show |
From: ebiederm@xmission.com (Eric W. Biederman) Date: Wed, 05 Nov 2008 15:27:34 -0800 > > I have been tracking for a while a case where when the > network namespace exits the cleanup gets stck in an > endless precessess of: > > unregister_netdevice: waiting for lo to become free. Usage count = 3 > unregister_netdevice: waiting for lo to become free. Usage count = 3 > unregister_netdevice: waiting for lo to become free. Usage count = 3 > unregister_netdevice: waiting for lo to become free. Usage count = 3 > unregister_netdevice: waiting for lo to become free. Usage count = 3 > unregister_netdevice: waiting for lo to become free. Usage count = 3 > unregister_netdevice: waiting for lo to become free. Usage count = 3 > > It turns out that if you listen on a multicast address an unsubscribe > packet is sent when the network device goes down. If you shutdown > the network namespace without carefully cleaning up this can trigger > the unsubscribe packet to be sent over the loopback interface while > the network namespace is going down. > > All of which is fine except when we drop the packet and forget to > free it leaking the skb and the dst entry attached to. As it > turns out the dst entry hold a reference to the idev which holds > the dev and keeps everything from being cleaned up. Yuck! > > By fixing my earlier thinko and add the needed kfree_skb and everything > cleans up beautifully. > > Signed-off-by: Eric W. Biederman <ebiederm@xmission.com> Applied. -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
diff --git a/net/core/dev.c b/net/core/dev.c index 811507c..a0c6060 100644 --- a/net/core/dev.c +++ b/net/core/dev.c @@ -2253,8 +2253,10 @@ int netif_receive_skb(struct sk_buff *skb) rcu_read_lock(); /* Don't receive packets in an exiting network namespace */ - if (!net_alive(dev_net(skb->dev))) + if (!net_alive(dev_net(skb->dev))) { + kfree_skb(skb); goto out; + } #ifdef CONFIG_NET_CLS_ACT if (skb->tc_verd & TC_NCLS) {
I have been tracking for a while a case where when the network namespace exits the cleanup gets stck in an endless precessess of: unregister_netdevice: waiting for lo to become free. Usage count = 3 unregister_netdevice: waiting for lo to become free. Usage count = 3 unregister_netdevice: waiting for lo to become free. Usage count = 3 unregister_netdevice: waiting for lo to become free. Usage count = 3 unregister_netdevice: waiting for lo to become free. Usage count = 3 unregister_netdevice: waiting for lo to become free. Usage count = 3 unregister_netdevice: waiting for lo to become free. Usage count = 3 It turns out that if you listen on a multicast address an unsubscribe packet is sent when the network device goes down. If you shutdown the network namespace without carefully cleaning up this can trigger the unsubscribe packet to be sent over the loopback interface while the network namespace is going down. All of which is fine except when we drop the packet and forget to free it leaking the skb and the dst entry attached to. As it turns out the dst entry hold a reference to the idev which holds the dev and keeps everything from being cleaned up. Yuck! By fixing my earlier thinko and add the needed kfree_skb and everything cleans up beautifully. Signed-off-by: Eric W. Biederman <ebiederm@xmission.com> --- net/core/dev.c | 4 +++- 1 files changed, 3 insertions(+), 1 deletions(-)