netgraph memory trouble

[David Vos]

I have been playing with the netgraph ng_split node.  I discovered
that if I sent packets to it, after a period of time, I could no
longer use netgraph.  If I tried to use ngctl, I got an error back
saying that it could not allocate memory to send a message.  This also
meant that I could not shutdown my nodes (because that required
sending a message) and had to reboot my machine to start using
netgraph again.

vmstat -m would show netgraph_item having 128 items in use.

I am sending data to the split node using the macro
"NG_FWD_ITEM_HOOK".  Since this macro nulls out the item pointer, I
assume it takes full responsibility to free the item if something
fails.

The item then gets sent on to the function:
static int
ng_split_rcvdata(hook_p hook, item_p item)
{
	const priv_p	priv = NG_NODE_PRIVATE(NG_HOOK_NODE(hook));
	int		error = 0;

	if (hook == priv->out) {
		printf("ng_split: got packet from out hook!\n");
		NG_FREE_ITEM(item);
		error = EINVAL;
	} else if ((hook == priv->in) && (priv->mixed != NULL)) {
		NG_FWD_ITEM_HOOK(error, item, priv->mixed);
	} else if ((hook == priv->mixed) && (priv->out != NULL)) {
		NG_FWD_ITEM_HOOK(error, item, priv->out);
	}

	return (error);
}


Unfortunately, if priv->mixed or priv->out are NULL, then there is no
error  generated, and the item is not freed.

I modified the function to be:
        printf("ng_split: got packet hook=%x, priv->in=%x, priv->out=%x
                   priv->mixed=%x\n", hook, priv->in, priv->out, priv->mixed);

        if (hook == priv->out) {
                printf("ng_split: got packet from out hook!\n");
                NG_FREE_ITEM(item);
                error = EINVAL;
        } else if ((hook == priv->in) && (priv->mixed != NULL)) {
                NG_FWD_ITEM_HOOK(error, item, priv->mixed);
        } else if ((hook == priv->mixed) && (priv->out != NULL)) {
                NG_FWD_ITEM_HOOK(error, item, priv->out);
        } else {
                printf("ng_split: got packet from unknown hook, or
output hook is null\n");
                NG_FREE_ITEM(item);
                error = EINVAL;
        }

In /var/log/messages, I get:
Aug 18 15:31:50 foo kernel: ng_split: got packet hook=c53f6800,
priv->in=c53f6800, priv->out=c53f8c80 priv->mixed=0
Aug 18 15:31:50 foo kernel: ng_split: got packet from unknown hook, or
output hook is null

After making this modification to the code, I have not experienced any
of the memory problems mentioned above.


My conclusion is that an else clause needs to be added to the branches
in the ng_split_rcfdata() function.

I am using FreeBSD 5.4-RELEASE #1.


David