Date: Sun, 27 Jul 2003 17:50:01 -0700 From: John-Mark Gurney <gurney_j@efn.org> To: Lukas Ertl <l.ertl@univie.ac.at> Cc: freebsd-current@freebsd.org Subject: Re: device driver memory leak in 5.1-20030726? Message-ID: <20030728005001.GP10708@funkthat.com> In-Reply-To: <20030728010746.I587@korben.in.tern> References: <C882BF18-C03F-11D7-A23D-00039315D3FE@exonetric.com> <20030727163914.S698@korben.in.tern> <20030727191758.GN10708@funkthat.com> <20030728010746.I587@korben.in.tern>
next in thread | previous in thread | raw e-mail | index | archive | help
[-- Attachment #1 --]
Lukas Ertl wrote this message on Mon, Jul 28, 2003 at 01:11 +0200:
> On Sun, 27 Jul 2003, John-Mark Gurney wrote:
> Then I have no explanation. I'm running the box with a WiFi card,
> generating lots of network traffic, and the box is running fine, no
> panics, and low devbuf allocation. I'm running the box with the USB
> Bluetooth dongle, generating much less traffic (it's just a 9.6kbit GSM
> link), and the box panics within half an hour in kmem_malloc, with devbuf
> allocation up to 74MB. It must be either in the Bluetooth code or in the
> USB code.
Hmm. this is wierd, it appears to be a bug in the Netgraph code. There
is a bit of code that allocates memory for the data, and then promptly
overwrites the malloc w/ data from the mbuf.
Try the attached patch. This could VERY well crash your machine as I
don't know mbuf code very well.
Thanks.
--
John-Mark Gurney Voice: +1 415 225 5579
"All that I will do, has been done, All that I have, has not."
[-- Attachment #2 --]
Index: ng_device.c
===================================================================
RCS file: /home/ncvs/src/sys/netgraph/ng_device.c,v
retrieving revision 1.3
diff -u -u -r1.3 ng_device.c
--- ng_device.c 3 Mar 2003 12:15:52 -0000 1.3
+++ ng_device.c 28 Jul 2003 00:47:30 -0000
@@ -360,12 +360,6 @@
return(-1);
}
- buffer = malloc(sizeof(char)*m->m_len, M_DEVBUF, M_NOWAIT | M_ZERO);
- if(buffer == NULL) {
- printf("%s(): ERROR: buffer malloc failed\n",__func__);
- return(-1);
- }
-
buffer = mtod(m,char *);
if( (connection->loc+m->m_len) < NGD_QUEUE_SIZE) {
@@ -374,7 +368,8 @@
} else
printf("%s(): queue full, first read out a bit\n",__func__);
- free(buffer,M_DEVBUF);
+ /* XXX - free chain? */
+ m_free(m);
return(0);
}
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20030728005001.GP10708>