With both conntrack and bridging turned on in the 2.6.0test11 kernel,
sending fragmented packets over the bridge reveals a memory leak
(specifically, forwarding packets from any interface to a bridge). The
memory that is leaking seems to be being allocated on line 299 on
net/bridge/br_netfilter.c:
if ((nf_bridge = nf_bridge_alloc(skb)) == NULL)
return NF_DROP;
Only the first fragment gets freed later on.
The patch attached fixes the problem by freeing nf_bridge when the
packets are defragmented, however I am sure this is not the right place
to do this. Where would the skb's for the fragments usually get freed?
Bart De Schuymer suggested that they should be freed in
skbuff.c::skb_release_data(), but having looked at this it seems to do
this already. skb_release_data() calls skb_drop_fraglist(), which does
kfree_skb() on each fragment, and kfree_skb calls nf_bridge_put correctly
so this isn't the problem.
--
- Steve Hill
Senior Software Developer Email: steve@xxxxxxxxxxxx
Navaho Technologies Ltd. Tel: +44-870-7034015
... Alcohol and calculus don't mix - Don't drink and derive! ...
bridge-memleak.patch
Description: Text document
|