Understanding Linux Network Internals

Reference Counts on neighbour Structures

Many kernel subsystems involved in the creation of neighbors keep a reference to the neighbour structure in some data structure; the routing subsystem does so, for instance. Therefore, the neighbour structure includes a reference count named refcnt, which is incremented and decremented with neigh_hold and neigh_release, respectively.

The most common event that increments a neighbor reference count is a packet transmission. Whenever a packet is sent out, the associated sk_buff buffer holds a reference to a neighbour structure, so neighbour->refcnt is incremented to make sure that the transmission can complete without problems. Once the packet has been transmitted, the count is decremented again.

This was an example of a short-term reference; others can last significantly longer. One example is the reference kept by the routing table cache (under both IPv4 and IPv6^[*]), as depicted in Figure 27-10.

The reference count is also incremented every time a per-neighbor timer is fired up, as shown in the following snapshot taken from neigh_update:

    if (new & NUD_IN_TIMER) {
            neigh_hold(neigh);
            neigh->timer.expires = jiffies +
                                   ((new & NUD_REACHABLE) ?
                                   neigh->parms->reachable_time : 0);
            add_timer(&neigh->timer);
    }

When an entry is to be removed for some reason (see neigh_ifdown in the section "Interactions with Other Subsystems") but it cannot be freed because someone still holds a reference to it, it is marked as dead with neighbour->dead set to 1. The garbage ...