From nobody Tue Jan 03 00:59:33 2023 X-Original-To: freebsd-jail@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4NmDsT2Hlrz2p0m9 for ; Tue, 3 Jan 2023 00:59:41 +0000 (UTC) (envelope-from zlei.huang@gmail.com) Received: from mail-pj1-x1029.google.com (mail-pj1-x1029.google.com [IPv6:2607:f8b0:4864:20::1029]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (2048 bits) client-digest SHA256) (Client CN "smtp.gmail.com", Issuer "GTS CA 1D4" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4NmDsS1zRvz3DqW; Tue, 3 Jan 2023 00:59:40 +0000 (UTC) (envelope-from zlei.huang@gmail.com) Authentication-Results: mx1.freebsd.org; dkim=pass header.d=gmail.com header.s=20210112 header.b=JxbTnxvQ; spf=pass (mx1.freebsd.org: domain of zlei.huang@gmail.com designates 2607:f8b0:4864:20::1029 as permitted sender) smtp.mailfrom=zlei.huang@gmail.com; dmarc=pass (policy=none) header.from=gmail.com Received: by mail-pj1-x1029.google.com with SMTP id gv5-20020a17090b11c500b00223f01c73c3so26426857pjb.0; Mon, 02 Jan 2023 16:59:40 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=to:references:message-id:content-transfer-encoding:cc:date :in-reply-to:from:subject:mime-version:from:to:cc:subject:date :message-id:reply-to; bh=n9S8jeME4/Z/JqAIylWpSEK/498Z+t0BjGsklh/fTw4=; b=JxbTnxvQ0/L5BKAGusRKHfzsedkjLzzvLKXU+r3xKf8ype7KQ2vphhNqUGK2B5w0tG /uRUT3UkewJrXumHGruEOgDWBWIVIsvu+H3pfgsBQBSiiEfn4Rjwr1t1/NB7yrklCDG6 QLMm80g45L65zM3LSsmEKWKBAa/mPXcnA4fCoQK4mn6+L/YA9aYsWe9shcHz4QfWGqpJ W0vf7llbnouSvOn6xNgqqmdxvSDlbgs30snaS/GF4qJnHPW4sD42FDjyLUIbF+cAy3dz PfXzVtmU80V+MYqvZ7bkC1Gxd1Va2wQAMrDAyC8xU9jaq9pE13QJBU1eeVqO4LzKIKtx HsYg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=to:references:message-id:content-transfer-encoding:cc:date :in-reply-to:from:subject:mime-version:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=n9S8jeME4/Z/JqAIylWpSEK/498Z+t0BjGsklh/fTw4=; b=0iNM4qUJpR1407/j2WdtwEHruqJi/F/SY0d8Cyt7qQRKAyKrWw4CedzPLai5zSqZxB vUSVaJkjLsKKgBx8rdt6PDSbjn8Yren7UNE4+kr/Hs15eJ8/Tk55vJbrn33U6pOnWMA9 RXqkmsA7TJN64GnezNDsHF5RhSFOflYio8/woC1d+f2qRV2RNso1WJ3bdL1qRRp8Jn1Z UaNMhIWaMKm6sul1uITEhegIvJ6jzUiGrn52W6ZEnRkIuaHh0rk1V4wPT836eAusODdT jpfNfgd07GrDuQJXHzh0EPOHZ4lyc7W+Z7jFr0GcR3lJA1PWUxQUC6m8IviIp3w7Khjp /k7A== X-Gm-Message-State: AFqh2kqpiVlqikxtLRvu3ap1U+tYfnmrMEZRBvSPaptdroJMb4SLh/0V wknDTpuIkLXgFhQpMKpzAgPhf0n2K28= X-Google-Smtp-Source: AMrXdXvah1UaNaMp6u5xFly3U0kB7IXjWTI+cw6WaS6FfWc3nb2RBOPZNKprqiJicjTdky6H2+1AAA== X-Received: by 2002:a17:90a:778c:b0:213:1d5:8acf with SMTP id v12-20020a17090a778c00b0021301d58acfmr44629300pjk.18.1672707578936; Mon, 02 Jan 2023 16:59:38 -0800 (PST) Received: from [172.17.252.129] (ns1.oxydns.net. [45.32.91.63]) by smtp.gmail.com with ESMTPSA id n63-20020a17090a2cc500b00213a9e1ec44sm19879293pjd.52.2023.01.02.16.59.37 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Mon, 02 Jan 2023 16:59:38 -0800 (PST) Content-Type: text/plain; charset=us-ascii List-Id: Discussion about FreeBSD jail(8) List-Archive: https://lists.freebsd.org/archives/freebsd-jail List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-freebsd-jail@freebsd.org Mime-Version: 1.0 (Mac OS X Mail 13.4 \(3608.120.23.2.7\)) Subject: Re: What's going on with vnets and epairs w/ addresses? From: Zhenlei Huang In-Reply-To: Date: Tue, 3 Jan 2023 08:59:33 +0800 Cc: Mark Johnston , "Bjoern A. Zeeb" , "freebsd-jail@freebsd.org" Content-Transfer-Encoding: quoted-printable Message-Id: References: <5r22os7n-ro15-27q-r356-rps331o06so5@mnoonqbm.arg> <150A60D6-6757-46DD-988F-05A9FFA36821@FreeBSD.org> To: Gleb Smirnoff X-Mailer: Apple Mail (2.3608.120.23.2.7) X-Spamd-Result: default: False [-2.48 / 15.00]; NEURAL_HAM_LONG(-1.00)[-1.000]; SUBJECT_ENDS_QUESTION(1.00)[]; NEURAL_HAM_MEDIUM(-1.00)[-1.000]; NEURAL_HAM_SHORT(-0.98)[-0.984]; DMARC_POLICY_ALLOW(-0.50)[gmail.com,none]; MV_CASE(0.50)[]; R_DKIM_ALLOW(-0.20)[gmail.com:s=20210112]; R_SPF_ALLOW(-0.20)[+ip6:2607:f8b0:4000::/36]; MIME_GOOD(-0.10)[text/plain]; ARC_NA(0.00)[]; FROM_HAS_DN(0.00)[]; TO_DN_EQ_ADDR_SOME(0.00)[]; RCPT_COUNT_THREE(0.00)[4]; MID_RHS_MATCH_FROM(0.00)[]; RCVD_TLS_LAST(0.00)[]; TO_MATCH_ENVRCPT_ALL(0.00)[]; DWL_DNSWL_NONE(0.00)[gmail.com:dkim]; ASN(0.00)[asn:15169, ipnet:2607:f8b0::/32, country:US]; RCVD_IN_DNSWL_NONE(0.00)[2607:f8b0:4864:20::1029:from]; FREEMAIL_FROM(0.00)[gmail.com]; TO_DN_SOME(0.00)[]; RCVD_VIA_SMTP_AUTH(0.00)[]; TAGGED_FROM(0.00)[]; RCVD_COUNT_THREE(0.00)[3]; FROM_EQ_ENVFROM(0.00)[]; DKIM_TRACE(0.00)[gmail.com:+]; FREEMAIL_ENVFROM(0.00)[gmail.com]; MIME_TRACE(0.00)[0:+]; MLMMJ_DEST(0.00)[freebsd-jail@freebsd.org] X-Rspamd-Queue-Id: 4NmDsS1zRvz3DqW X-Spamd-Bar: -- X-ThisMailContainsUnwantedMimeParts: N Hi, Happy New Year 2023! > On Dec 27, 2022, at 4:42 AM, Gleb Smirnoff = wrote: >=20 > Zhenlei, Bjoern, Mark, >=20 > sorry for delayed response on this thread. Back when the problem > was first introduced, I made a code that forces purge of SMR zones. > However, I didn't push it in, hence the change on the test suite side > to remove interfaces from inside the jail before destroying it was > sufficient to close all leaks associated with the test suite. >=20 > I just rebased the code to fresh main and put it here: >=20 > https://github.com/glebius/FreeBSD/tree/smr-purge >=20 > The proof of concept based on the test from Zhenlei looks like this: >=20 > #!/bin/sh > n=3D"test_ref_leak" >=20 > jail -c name=3D$n path=3D/ vnet persist > # The following line trigger jail pr_ref leak > jexec $n ifconfig lo0 inet 127.0.0.1/8 >=20 > jail -R $n >=20 > for zone in tcp_inpcb udp_inpcb; do > sysctl vm.uma_zone_reclaim=3D${zone} > done >=20 > jls -j $n >=20 > At the point of the call to jls(8) the jail no longer exists. >=20 > My opinion on the whole problem matches Mark's opinion, that he = expressed > in his email on December 20. I like the idea of doing the prison > checks at a later stage of inpcb lookup, especially given new = discoveries > on the performance impact by Drew. The proper fix may take a while. >=20 > In addition to that I have strong opinion against the way we move = interfaces > between the jails. I claim that if did it right (tm), the problem we = are > talking about won't exist even with all the existing layering = violations > between inpcb+smr and jails+epoch. I will write a longer email on what = I > believe is the right (tm) way to manage interfaces/devices within = jails. > We already have had discussions on that with Alexander melifaro@ and = Warner > imp@. However, proper implementation will take a while. >=20 > We may use code from my smr-purge branch as a temporary solution. Any > thoughts on that? The code in smr-purge branch should also apply to non-vnet jails. I think it is OK as a temporary solution. >=20 > --=20 > Gleb Smirnoff