IPSec / xfrm memory leak found

[Bernd Schütte]

Hi everybody.

there is a memory leak in the current kernels since 4.15 (maybe olders as well) in combination with IPSec. I verified it with kernel linux-meta 4.15.0.70.72 on Ubuntu 18.04.

As Strongswan is used and users login / logout, being connected and doing traffic memory gets lost. After a while no memory is left over and OOM killer starts it work.

After some debugging and asking in the Strongswan irc channel I was informed that there was a memory leak found in net/xfrm/xfrm_state.c which might be related. Here is the commit to this fix:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=86c6739eda7d2a03f2db30cbee67a5fb81afa8ba

I applied this patch against the linux-meta 4.15.0.70.72 and it fixes the issue.

Tested and verified on and with:
Ubuntu 18.04.3 LTS
strongswan-5.6.2-1ubuntu2.4
linux-image-generic-4.15.0.70.72

Here are some additional information:
https://<email address hidden>/
https://marc.info/?l=linux-netdev&m=157405892918311&w=2

it also is reproducible with hwe and hwe-edge kernel as well as with other strongswan version. I also backported latest Ubuntu version of strongswan to 18.04 which has same behavior. On a completely different system (Gentoo) it also is the case. So I'm really sure that this is related to the reported kernel thing which is already solve in current mainline

[Bernd Schütte (pent1ckel)]

package was not taken correctly

[Bernd Schütte (pent1ckel)]

some additional hints and reports.

https://lore.kernel<email address hidden>/
https://lore.kernel<email address hidden>/

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Stefan Bader (smb)]

There is a previous report about this, duplicating this to the previous bug report.