Comment 59 for bug 1711407

Ok, here is a new debug kernel:
http://people.canonical.com/~ddstreet/lp1711407/linux-image-4.13.13-00940-gf16e2bbbddee_4.13.13-00940-gf16e2bbbddee-24_amd64.deb

I didn't use the PPA as this one will dump out quite a lot of debug in the logs all the time. When you reproduce it (which hopefully you can still do, even with the added debug msgs), please check the output to find the address of the leaked dst, e.g.:

[ 2833.421135] (netns ffff9f4d77278000): dst ffff9f4d743e9a00 expires 0 error 0 obsolete 2 flags 0 refcnt 1 ops ipv4_dst_ops+0x0/0xc0 creator ip_route_input_rcu+0x6b0/0xd80

would be dst address "ffff9f4d743e9a00". Then, please grep dmesg for that, so you get output similar to:

$ dmesg | grep ffff9f4d743e9a00
[ 2823.048309] dst_init: dst ffff9f4d743e9a00 refcnt 1 from __dst_alloc+0x7e/0x100
[ 2823.048312] dst_hold: dst ffff9f4d743e9a00 refcnt 2 from rt_cache_route+0x54/0xe0
[ 2823.048327] dst_hold_safe: dst ffff9f4d743e9a00 refcnt 3 from inet_sk_rx_dst_set+0x7f/0xc0
[ 2823.048453] dst_release: dst ffff9f4d743e9a00 refcnt 2 from skb_release_head_state+0x96/0xa0
[ 2823.048572] dst_hold_safe: dst ffff9f4d743e9a00 refcnt 3 from tcp_add_backlog+0x12f/0x170
[ 2823.048580] dst_release: dst ffff9f4d743e9a00 refcnt 2 from skb_release_head_state+0x96/0xa0
[ 2823.231547] dst_release_immediate: dst ffff9f4d743e9a00 refcnt 1 from free_fib_info_rcu+0x173/0x1c0
[ 2833.421088] (netns ffff9f4d77278000): open sk ffff9f4d766aa100 family 2 state 4 dst_cache (null) rx_dst ffff9f4d743e9a00 creator generic_ip_connect+0x24b/0x4f0 [cifs]
[ 2833.421135] (netns ffff9f4d77278000): dst ffff9f4d743e9a00 expires 0 error 0 obsolete 2 flags 0 refcnt 1 ops ipv4_dst_ops+0x0/0xc0 creator ip_route_input_rcu+0x6b0/0xd80

Paste that output here, so I can see the history of the dst refcnt. If you don't see the initial dst_init in the trace, try using /var/log/kern.log instead of dmesg, as dmesg may have rolled over the older logs if you have a lot of output going on.