From owner-freebsd-bugs@FreeBSD.ORG Sat Aug 3 20:20:01 2013 Return-Path: Delivered-To: freebsd-bugs@smarthost.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTP id 3E0902AE for ; Sat, 3 Aug 2013 20:20:01 +0000 (UTC) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (freefall.freebsd.org [IPv6:2001:1900:2254:206c::16:87]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mx1.freebsd.org (Postfix) with ESMTPS id 1D0762CB1 for ; Sat, 3 Aug 2013 20:20:01 +0000 (UTC) Received: from freefall.freebsd.org (localhost [127.0.0.1]) by freefall.freebsd.org (8.14.7/8.14.7) with ESMTP id r73KK0FV037423 for ; Sat, 3 Aug 2013 20:20:00 GMT (envelope-from gnats@freefall.freebsd.org) Received: (from gnats@localhost) by freefall.freebsd.org (8.14.7/8.14.7/Submit) id r73KK01x037421; Sat, 3 Aug 2013 20:20:00 GMT (envelope-from gnats) Resent-Date: Sat, 3 Aug 2013 20:20:00 GMT Resent-Message-Id: <201308032020.r73KK01x037421@freefall.freebsd.org> Resent-From: FreeBSD-gnats-submit@FreeBSD.org (GNATS Filer) Resent-To: freebsd-bugs@FreeBSD.org Resent-Reply-To: FreeBSD-gnats-submit@FreeBSD.org, Joao Cabral Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTP id 12288127 for ; Sat, 3 Aug 2013 20:11:34 +0000 (UTC) (envelope-from nobody@FreeBSD.org) Received: from oldred.freebsd.org (oldred.freebsd.org [8.8.178.121]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.freebsd.org (Postfix) with ESMTPS id DA4A52C89 for ; Sat, 3 Aug 2013 20:11:33 +0000 (UTC) Received: from oldred.freebsd.org ([127.0.1.6]) by oldred.freebsd.org (8.14.5/8.14.7) with ESMTP id r73KBXR5011863 for ; Sat, 3 Aug 2013 20:11:33 GMT (envelope-from nobody@oldred.freebsd.org) Received: (from nobody@localhost) by oldred.freebsd.org (8.14.5/8.14.5/Submit) id r73KBWfb011862; Sat, 3 Aug 2013 20:11:32 GMT (envelope-from nobody) Message-Id: <201308032011.r73KBWfb011862@oldred.freebsd.org> Date: Sat, 3 Aug 2013 20:11:32 GMT From: Joao Cabral To: freebsd-gnats-submit@FreeBSD.org X-Send-Pr-Version: www-3.1 Subject: kern/181006: mbuf leak in run(4) driver X-BeenThere: freebsd-bugs@freebsd.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: Bug reports List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 03 Aug 2013 20:20:01 -0000 >Number: 181006 >Category: kern >Synopsis: mbuf leak in run(4) driver >Confidential: no >Severity: non-critical >Priority: low >Responsible: freebsd-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: sw-bug >Submitter-Id: current-users >Arrival-Date: Sat Aug 03 20:20:00 UTC 2013 >Closed-Date: >Last-Modified: >Originator: Joao Cabral >Release: 10.0-CURRENT >Organization: DHIS >Environment: FreeBSD witch.haversine.net 10.0-CURRENT FreeBSD 10.0-CURRENT #9 r249740:250116M: Sat Aug 3 18:55:54 UTC 2013 root@marvin.haversine.net:/usr/obj/arm.armv6/root/head/sys/RPI-B arm >Description: When running a Ralink RT3070/3020/2870 based USB WiFi adapter with FreeBSD current on a Raspberry Pi, the output of "netstat -nr" kept reporting an increasing number of mbufs up to (a few thousands) a point where the adapter would disconnect from the WiFi network and never reconnect again, at which point only a reboot would solve the problem. The adapter reports as: Aug 2 23:21:10 witch kernel: run0: MAC/BBP RT3070 (rev 0x0201), RF RT3020 (MIMO 1T1R), address 00:23:28:01:89:a2 Aug 2 23:21:11 witch kernel: wlan0: Ethernet address: 00:23:28:01:89:a2 Aug 2 23:21:12 witch kernel: run0: firmware RT2870 ver. 0.236 loaded Setting sysctl hw.usb.run.debug=1 caused a lot of error messages, mainly such as: Aug 3 03:05:01 witch kernel: run_bulk_rx_callback: bad DMA length 60329 Aug 3 03:05:02 witch kernel: run_bulk_rx_callback: bad DMA length 21348 > 2600 Aug 3 03:05:02 witch kernel: run_bulk_rx_callback: bad DMA length 2787 Aug 3 03:05:02 witch kernel: run_bulk_rx_callback: bad DMA length 26261 Aug 3 03:05:02 witch kernel: run_bulk_rx_callback: bad DMA length 55261 Which suggest alignment problems. >How-To-Repeat: Plugin a run(4) adapter to an arm based FreeBSD and let it flow traffic... see the mbufs increasing up to the point where the adapter disconnects and no longer recovers. >Fix: A friend suggested the following patch to base/head/sys/dev/usb/wlan/if_run.c which seems to have solved the problem of the increasing number of mbufs and hence the leak. Mbufs are now stable. This does not however solve the problem of misalignment observed on the Raspberry Pi/arm causing the error messages to be triggered. Index: if_run.c =================================================================== --- if_run.c (revision 253887) +++ if_run.c (working copy) @@ -2659,11 +2659,13 @@ if ((dmalen >= (uint32_t)-8) || (dmalen == 0) || ((dmalen & 3) != 0)) { DPRINTF("bad DMA length %u\n", dmalen); + m_freem(m); break; } if ((dmalen + 8) > (uint32_t)xferlen) { DPRINTF("bad DMA length %u > %d\n", dmalen + 8, xferlen); + m_freem(m); break; } @@ -2681,6 +2683,7 @@ if (__predict_false(m0 == NULL)) { DPRINTF("could not allocate mbuf\n"); ifp->if_ierrors++; + m_freem(m); break; } m_copydata(m, 4 /* skip 32-bit DMA-len header */, >Release-Note: >Audit-Trail: >Unformatted: