From nobody@FreeBSD.org  Fri May 11 09:19:34 2012
Return-Path: <nobody@FreeBSD.org>
Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52])
	by hub.freebsd.org (Postfix) with ESMTP id 311EC1065672
	for <freebsd-gnats-submit@FreeBSD.org>; Fri, 11 May 2012 09:19:34 +0000 (UTC)
	(envelope-from nobody@FreeBSD.org)
Received: from red.freebsd.org (red.freebsd.org [IPv6:2001:4f8:fff6::22])
	by mx1.freebsd.org (Postfix) with ESMTP id 1C6E28FC0C
	for <freebsd-gnats-submit@FreeBSD.org>; Fri, 11 May 2012 09:19:34 +0000 (UTC)
Received: from red.freebsd.org (localhost [127.0.0.1])
	by red.freebsd.org (8.14.4/8.14.4) with ESMTP id q4B9JXCZ043150
	for <freebsd-gnats-submit@FreeBSD.org>; Fri, 11 May 2012 09:19:33 GMT
	(envelope-from nobody@red.freebsd.org)
Received: (from nobody@localhost)
	by red.freebsd.org (8.14.4/8.14.4/Submit) id q4B9JXu3043149;
	Fri, 11 May 2012 09:19:33 GMT
	(envelope-from nobody)
Message-Id: <201205110919.q4B9JXu3043149@red.freebsd.org>
Date: Fri, 11 May 2012 09:19:33 GMT
From: Andrey Smagin <samspeed@mail.ru>
To: freebsd-gnats-submit@FreeBSD.org
Subject: mbuf leak if arp address is multicast
X-Send-Pr-Version: www-3.1
X-GNATS-Notify:

>Number:         167793
>Category:       kern
>Synopsis:       [arp] mbuf leak if arp address is multicast
>Confidential:   no
>Severity:       serious
>Priority:       low
>Responsible:    ae
>State:          feedback
>Quarter:        
>Keywords:       
>Date-Required:  
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Fri May 11 09:20:14 UTC 2012
>Closed-Date:    
>Last-Modified:  Mon Apr 21 12:10:41 UTC 2014
>Originator:     Andrey Smagin
>Release:        CURRENT - r235238M
>Organization:
>Environment:
FreeBSD samnote.vvt 10.0-CURRENT FreeBSD 10.0-CURRENT #2 r235238M: Fri May 11 07:00:35 MSK 2012     root@ns.vvt:/usr/obj/i386.i386/usr/src386/sys/SAM  i386
>Description:
System leak mbufs with multicast arp adresses 
>How-To-Repeat:
Create in one box static arp table for 65533 entries 172.16.0.0/16 with
multicast arp adresses, example eb:ee:00:00:xx:yy. xx yy - count number.
From another box after time we will see:

root samnote# netstat -m
*26078/427/26505 mbufs in use (current/cache/total)
*26076/170/26246/65536 mbuf clusters in use (current/cache/total/max)
*26076/164 mbuf+clusters out of packet secondary zone in use (current/cache)
0/20/20/65536 4k (page size) jumbo clusters in use (current/cache/total/max)
0/0/0/6400 9k jumbo clusters in use (current/cache/total/max)
0/0/0/3200 16k jumbo clusters in use (current/cache/total/max)
*58671K/526K/59198K bytes allocated to network (current/cache/total)
0/0/0 requests for mbufs denied (mbufs/clusters/mbuf+clusters)
0/0/0 requests for jumbo clusters denied (4k/9k/16k)
0/5/6656 sfbufs in use (current/peak/max)
0 requests for sfbufs denied
0 requests for sfbufs delayed
0 requests for I/O initiated by sendfile
0 calls to protocol drain routines

* values will increment. after some hours network stack will fail with
error: not free mbuf. By this bug I make DDOS for myself.
>Fix:
Don't use large number multicast arp adressed in one LAN.

>Release-Note:
>Audit-Trail:
Responsible-Changed-From-To: freebsd-bugs->freebsd-net 
Responsible-Changed-By: linimon 
Responsible-Changed-When: Sun Apr 20 00:11:03 UTC 2014 
Responsible-Changed-Why:  
Over to maintainer(s). 

http://www.freebsd.org/cgi/query-pr.cgi?pr=167793 
State-Changed-From-To: open->feedback 
State-Changed-By: ae 
State-Changed-When: Mon Apr 21 12:08:23 UTC 2014 
State-Changed-Why:  
Do you able reproduce that? 
It seems the problem was fixed in r249742. 


Responsible-Changed-From-To: freebsd-net->ae 
Responsible-Changed-By: ae 
Responsible-Changed-When: Mon Apr 21 12:08:23 UTC 2014 
Responsible-Changed-Why:  
Take it. 

http://www.freebsd.org/cgi/query-pr.cgi?pr=167793 
>Unformatted:
