BUG/MINOR: quic: free rejected Rx packets

Free Rx packet in the datagram handler if the packet was not taken in
charge by a quic_conn instance. This is reflected by the packet refcount
which is null.

A packet can be rejected for a variety of reasons. For example, failed
decryption, no Initial token and Retry emission or for datagram null
padding.

This patch should resolve the Rx packets memory leak observed via "show
pools" with the previous commit
  2c31e1293661cd44b71457b8fd0567b08ef95b0b
  BUG/MINOR: quic: purge conn Rx packet list on release

This specific memory leak instance was reproduced using quiche client
which uses null datagram padding.

This should partially resolve github issue #1751.

It must be backported up to 2.6.

diff --git a/src/xprt_quic.c b/src/xprt_quic.c
index b1ef28e292f0a4c68e4f05f7e1cab6f88f1da911..20160e1613cb317e957f9aac2f8efdf29ea0d801 100644 (file)
--- a/src/xprt_quic.c
+++ b/src/xprt_quic.c
@@ -6488,12 +6488,19 @@ struct task *quic_lstnr_dghdlr(struct task *t, void *ctx, unsigned int state)
                        if (!pkt)
                                goto err;
 
+                       LIST_INIT(&pkt->qc_rx_pkt_list);
                        pkt->time_received = now_ms;
                        quic_rx_packet_refinc(pkt);
                        qc_lstnr_pkt_rcv(pos, end, pkt, first_pkt, dgram);
                        first_pkt = 0;
                        pos += pkt->len;
                        quic_rx_packet_refdec(pkt);
+
+                       /* Free rejected packets */
+                       if (!pkt->refcnt) {
+                               BUG_ON(LIST_INLIST(&pkt->qc_rx_pkt_list));
+                               pool_free(pool_head_quic_rx_packet, pkt);
+                       }
                } while (pos < end);
 
                /* Increasing the received bytes counter by the UDP datagram length