>Number: 181006
>Category: kern
>Synopsis: mbuf leak in run(4) driver
>Confidential: no
>Severity: non-critical
>Priority: low
>Responsible: freebsd-bugs
>State: open
>Quarter:
>Keywords:
>Date-Required:
>Class: sw-bug
>Submitter-Id: current-users
>Arrival-Date: Sat Aug 03 20:20:00 UTC 2013
>Closed-Date:
>Last-Modified:
>Originator: Joao Cabral
>Release: 10.0-CURRENT
>Organization:
DHIS
>Environment:
FreeBSD witch.haversine.net 10.0-CURRENT FreeBSD 10.0-CURRENT #9
r249740:250116M: Sat Aug 3 18:55:54 UTC 2013
r...@marvin.haversine.net:/usr/obj/arm.armv6/root/head/sys/RPI-B arm
>Description:
When running a Ralink RT3070/3020/2870 based USB WiFi adapter with FreeBSD
current on a Raspberry Pi, the output of "netstat -nr" kept reporting an
increasing number of mbufs up to (a few thousands) a point where the adapter
would disconnect from the WiFi network and never reconnect again, at which
point only a reboot would solve the problem.
The adapter reports as:
Aug 2 23:21:10 witch kernel: run0: MAC/BBP RT3070 (rev 0x0201), RF RT3020 (MIMO
1T1R), address 00:23:28:01:89:a2
Aug 2 23:21:11 witch kernel: wlan0: Ethernet address: 00:23:28:01:89:a2
Aug 2 23:21:12 witch kernel: run0: firmware RT2870 ver. 0.236 loaded
Setting sysctl hw.usb.run.debug=1 caused a lot of error messages, mainly such
as:
Aug 3 03:05:01 witch kernel: run_bulk_rx_callback: bad DMA length 60329
Aug 3 03:05:02 witch kernel: run_bulk_rx_callback: bad DMA length 21348 > 2600
Aug 3 03:05:02 witch kernel: run_bulk_rx_callback: bad DMA length 2787
Aug 3 03:05:02 witch kernel: run_bulk_rx_callback: bad DMA length 26261
Aug 3 03:05:02 witch kernel: run_bulk_rx_callback: bad DMA length 55261
Which suggest alignment problems.
>How-To-Repeat:
Plugin a run(4) adapter to an arm based FreeBSD and let it flow traffic... see
the mbufs increasing up to the point where the adapter disconnects and no
longer recovers.
>Fix:
A friend suggested the following patch to base/head/sys/dev/usb/wlan/if_run.c
which seems to have solved the problem of the increasing number of mbufs and
hence the leak. Mbufs are now stable.
This does not however solve the problem of misalignment observed on the
Raspberry Pi/arm causing the error messages to be triggered.
Index: if_run.c
===================================================================
--- if_run.c (revision 253887)
+++ if_run.c (working copy)
@@ -2659,11 +2659,13 @@
if ((dmalen >= (uint32_t)-8) || (dmalen == 0) ||
((dmalen & 3) != 0)) {
DPRINTF("bad DMA length %u\n", dmalen);
+ m_freem(m);
break;
}
if ((dmalen + 8) > (uint32_t)xferlen) {
DPRINTF("bad DMA length %u > %d\n",
dmalen + 8, xferlen);
+ m_freem(m);
break;
}
@@ -2681,6 +2683,7 @@
if (__predict_false(m0 == NULL)) {
DPRINTF("could not allocate mbuf\n");
ifp->if_ierrors++;
+ m_freem(m);
break;
}
m_copydata(m, 4 /* skip 32-bit DMA-len header */,
>Release-Note:
>Audit-Trail:
>Unformatted:
_______________________________________________
freebsd-bugs@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-bugs
To unsubscribe, send any mail to "freebsd-bugs-unsubscr...@freebsd.org"
