Project

General

Profile

Actions

Bug #4650

closed

Stream TCP raw reassembly is leaking

Added by Peter Manev over 2 years ago. Updated almost 2 years ago.

Status:
Closed
Priority:
Normal
Assignee:
Target version:
Affected Versions:
Effort:
Difficulty:
Label:

Description

(originally reported y Eric Leblond)

It seems we have a leak in memory when TCP raw reassembly is enabled. Raw reassembly memuse is always going up. When deactivating it, the leak is gone. The leak seems to affect the flow that get cleaned far slowly.
Application layer triggering raw reassembly on TX border is helping a lot to reduce memory usage.

Peter to create a reproducible setup with trex.


Related issues 7 (0 open7 closed)

Related to Suricata - Bug #4502: TCP reassembly memuse approaching memcap value results in TCP detection being stoppedClosedVictor JulienActions
Related to Suricata - Bug #4766: Flow leaked when flow->use_cnt access race happensClosedVictor JulienActions
Related to Suricata - Bug #4778: flow/bypass: app-layer/stream resources not freed when bypass activatedClosedVictor JulienActions
Related to Suricata - Bug #4808: flow: worker-evicted flows need to be processed quickerClosedVictor JulienActions
Related to Suricata - Optimization #4653: Flow cleaning with chunked approach is memory hungryClosedVictor JulienActions
Related to Suricata - Optimization #4652: GAP handling improvements seem expensiveRejectedActions
Related to Suricata - Bug #4828: flow: flows not evicted & freed in timeClosedVictor JulienActions
Actions #1

Updated by Andreas Herz over 2 years ago

  • Related to Bug #4502: TCP reassembly memuse approaching memcap value results in TCP detection being stopped added
Actions #2

Updated by Victor Julien over 2 years ago

Wonder if this could be related to #4766. If a flow gets stuck before its stream memory is released it might start to add up.

@Eric Leblond do we clean up the flows stream/app-layer memory when we switch to bypass?

Actions #3

Updated by Victor Julien over 2 years ago

  • Related to Bug #4766: Flow leaked when flow->use_cnt access race happens added
Actions #4

Updated by Victor Julien over 2 years ago

  • Related to Bug #4778: flow/bypass: app-layer/stream resources not freed when bypass activated added
Actions #5

Updated by Victor Julien over 2 years ago

  • Related to Bug #4808: flow: worker-evicted flows need to be processed quicker added
Actions #6

Updated by Victor Julien over 2 years ago

  • Status changed from New to In Progress
  • Assignee set to Victor Julien
  • Target version set to 7.0.0-beta1
Actions #7

Updated by Victor Julien over 2 years ago

  • Related to Optimization #4653: Flow cleaning with chunked approach is memory hungry added
Actions #8

Updated by Victor Julien over 2 years ago

Actions #9

Updated by Victor Julien over 2 years ago

  • Related to Bug #4828: flow: flows not evicted & freed in time added
Actions

Also available in: Atom PDF