From owner-freebsd-current@FreeBSD.ORG Sun Jul 27 17:50:08 2003 Return-Path: Delivered-To: freebsd-current@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 2DFEF37B404 for ; Sun, 27 Jul 2003 17:50:08 -0700 (PDT) Received: from mail.cyberonic.com (mail.cyberonic.com [4.17.179.4]) by mx1.FreeBSD.org (Postfix) with ESMTP id 2936B43F85 for ; Sun, 27 Jul 2003 17:50:07 -0700 (PDT) (envelope-from jmg@hydrogen.funkthat.com) Received: from hydrogen.funkthat.com (node-40244c0a.sfo.onnet.us.uu.net [64.36.76.10]) by mail.cyberonic.com (8.12.8/8.12.5) with ESMTP id h6S1LX0n025034; Sun, 27 Jul 2003 21:21:34 -0400 Received: (from jmg@localhost) by hydrogen.funkthat.com (8.12.9/8.11.6) id h6S0o1AE086555; Sun, 27 Jul 2003 17:50:01 -0700 (PDT) (envelope-from jmg) Date: Sun, 27 Jul 2003 17:50:01 -0700 From: John-Mark Gurney To: Lukas Ertl Message-ID: <20030728005001.GP10708@funkthat.com> Mail-Followup-To: Lukas Ertl , Gary Jennejohn , freebsd-current@freebsd.org, Mark Blackman References: <20030727163914.S698@korben.in.tern> <20030727191758.GN10708@funkthat.com> <20030728010746.I587@korben.in.tern> Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="s/l3CgOIzMHHjg/5" Content-Disposition: inline In-Reply-To: <20030728010746.I587@korben.in.tern> User-Agent: Mutt/1.4.1i X-Operating-System: FreeBSD 4.2-RELEASE i386 X-PGP-Fingerprint: B7 EC EF F8 AE ED A7 31 96 7A 22 B3 D8 56 36 F4 X-Files: The truth is out there X-URL: http://resnet.uoregon.edu/~gurney_j/ X-Resume: http://resnet.uoregon.edu/~gurney_j/resume.html cc: Gary Jennejohn cc: Mark Blackman cc: freebsd-current@freebsd.org Subject: Re: device driver memory leak in 5.1-20030726? X-BeenThere: freebsd-current@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list Reply-To: John-Mark Gurney List-Id: Discussions about the use of FreeBSD-current List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 28 Jul 2003 00:50:08 -0000 --s/l3CgOIzMHHjg/5 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Lukas Ertl wrote this message on Mon, Jul 28, 2003 at 01:11 +0200: > On Sun, 27 Jul 2003, John-Mark Gurney wrote: > Then I have no explanation. I'm running the box with a WiFi card, > generating lots of network traffic, and the box is running fine, no > panics, and low devbuf allocation. I'm running the box with the USB > Bluetooth dongle, generating much less traffic (it's just a 9.6kbit GSM > link), and the box panics within half an hour in kmem_malloc, with devbuf > allocation up to 74MB. It must be either in the Bluetooth code or in the > USB code. Hmm. this is wierd, it appears to be a bug in the Netgraph code. There is a bit of code that allocates memory for the data, and then promptly overwrites the malloc w/ data from the mbuf. Try the attached patch. This could VERY well crash your machine as I don't know mbuf code very well. Thanks. -- John-Mark Gurney Voice: +1 415 225 5579 "All that I will do, has been done, All that I have, has not." --s/l3CgOIzMHHjg/5 Content-Type: text/plain; charset=us-ascii Content-Disposition: attachment; filename="ng_device.diff" Index: ng_device.c =================================================================== RCS file: /home/ncvs/src/sys/netgraph/ng_device.c,v retrieving revision 1.3 diff -u -u -r1.3 ng_device.c --- ng_device.c 3 Mar 2003 12:15:52 -0000 1.3 +++ ng_device.c 28 Jul 2003 00:47:30 -0000 @@ -360,12 +360,6 @@ return(-1); } - buffer = malloc(sizeof(char)*m->m_len, M_DEVBUF, M_NOWAIT | M_ZERO); - if(buffer == NULL) { - printf("%s(): ERROR: buffer malloc failed\n",__func__); - return(-1); - } - buffer = mtod(m,char *); if( (connection->loc+m->m_len) < NGD_QUEUE_SIZE) { @@ -374,7 +368,8 @@ } else printf("%s(): queue full, first read out a bit\n",__func__); - free(buffer,M_DEVBUF); + /* XXX - free chain? */ + m_free(m); return(0); } --s/l3CgOIzMHHjg/5--