From 23f908ccd62b1123e0fe1ed73743dcd8390890e1 Mon Sep 17 00:00:00 2001 From: Amaury Denoyelle Date: Mon, 20 Jun 2022 10:58:03 +0200 Subject: [PATCH] BUG/MINOR: quic: free rejected Rx packets Free Rx packet in the datagram handler if the packet was not taken in charge by a quic_conn instance. This is reflected by the packet refcount which is null. A packet can be rejected for a variety of reasons. For example, failed decryption, no Initial token and Retry emission or for datagram null padding. This patch should resolve the Rx packets memory leak observed via "show pools" with the previous commit 2c31e1293661cd44b71457b8fd0567b08ef95b0b BUG/MINOR: quic: purge conn Rx packet list on release This specific memory leak instance was reproduced using quiche client which uses null datagram padding. This should partially resolve github issue #1751. It must be backported up to 2.6. --- src/xprt_quic.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/src/xprt_quic.c b/src/xprt_quic.c index b1ef28e292..20160e1613 100644 --- a/src/xprt_quic.c +++ b/src/xprt_quic.c @@ -6488,12 +6488,19 @@ struct task *quic_lstnr_dghdlr(struct task *t, void *ctx, unsigned int state) if (!pkt) goto err; + LIST_INIT(&pkt->qc_rx_pkt_list); pkt->time_received = now_ms; quic_rx_packet_refinc(pkt); qc_lstnr_pkt_rcv(pos, end, pkt, first_pkt, dgram); first_pkt = 0; pos += pkt->len; quic_rx_packet_refdec(pkt); + + /* Free rejected packets */ + if (!pkt->refcnt) { + BUG_ON(LIST_INLIST(&pkt->qc_rx_pkt_list)); + pool_free(pool_head_quic_rx_packet, pkt); + } } while (pos < end); /* Increasing the received bytes counter by the UDP datagram length