From owner-svn-src-all@FreeBSD.ORG Wed Jun 27 15:55:35 2012 Return-Path: Delivered-To: svn-src-all@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 8E85C106572D; Wed, 27 Jun 2012 15:55:34 +0000 (UTC) (envelope-from bschmidt@FreeBSD.org) Received: from svn.freebsd.org (svn.freebsd.org [IPv6:2001:4f8:fff6::2c]) by mx1.freebsd.org (Postfix) with ESMTP id AE8F18FC14; Wed, 27 Jun 2012 15:55:34 +0000 (UTC) Received: from svn.freebsd.org (localhost [127.0.0.1]) by svn.freebsd.org (8.14.4/8.14.4) with ESMTP id q5RFtY4u018894; Wed, 27 Jun 2012 15:55:34 GMT (envelope-from bschmidt@svn.freebsd.org) Received: (from bschmidt@localhost) by svn.freebsd.org (8.14.4/8.14.4/Submit) id q5RFtY1V018892; Wed, 27 Jun 2012 15:55:34 GMT (envelope-from bschmidt@svn.freebsd.org) Message-Id: <201206271555.q5RFtY1V018892@svn.freebsd.org> From: Bernhard Schmidt Date: Wed, 27 Jun 2012 15:55:34 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org X-SVN-Group: head MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Cc: Subject: svn commit: r237647 - head/sys/dev/iwn X-BeenThere: svn-src-all@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: "SVN commit messages for the entire src tree \(except for " user" and " projects" \)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 27 Jun 2012 15:55:35 -0000 Author: bschmidt Date: Wed Jun 27 15:55:34 2012 New Revision: 237647 URL: http://svn.freebsd.org/changeset/base/237647 Log: Fix a TX aggregation issue, if after the last compressed BA notification the TX queue is empty, there won't be a TX done notification, effectly resulting in an mbuf leak. The correct way to handle this is to free up mbufs on both BA and TX done notifications up to the last sent seqno. Tested by: osa@ MFC after: 3 days Modified: head/sys/dev/iwn/if_iwn.c Modified: head/sys/dev/iwn/if_iwn.c ============================================================================== --- head/sys/dev/iwn/if_iwn.c Wed Jun 27 12:30:56 2012 (r237646) +++ head/sys/dev/iwn/if_iwn.c Wed Jun 27 15:55:34 2012 (r237647) @@ -2437,18 +2437,43 @@ iwn_rx_compressed_ba(struct iwn_softc *s struct ieee80211_node *ni; struct iwn_compressed_ba *ba = (struct iwn_compressed_ba *)(desc + 1); struct iwn_tx_ring *txq; + struct iwn_tx_data *txdata; struct ieee80211_tx_ampdu *tap; + struct mbuf *m; uint64_t bitmap; uint8_t tid; - int ackfailcnt = 0, i, shift; + int ackfailcnt = 0, i, lastidx, qid, shift; bus_dmamap_sync(sc->rxq.data_dmat, data->map, BUS_DMASYNC_POSTREAD); - txq = &sc->txq[le16toh(ba->qid)]; - tap = sc->qid2tap[le16toh(ba->qid)]; + qid = le16toh(ba->qid); + txq = &sc->txq[ba->qid]; + tap = sc->qid2tap[ba->qid]; tid = tap->txa_tid; - ni = tap->txa_ni; - wn = (void *)ni; + wn = (void *)tap->txa_ni; + + for (lastidx = le16toh(ba->ssn) & 0xff; txq->read != lastidx;) { + txdata = &txq->data[txq->read]; + + /* Unmap and free mbuf. */ + bus_dmamap_sync(txq->data_dmat, txdata->map, + BUS_DMASYNC_POSTWRITE); + bus_dmamap_unload(txq->data_dmat, txdata->map); + m = txdata->m, txdata->m = NULL; + ni = txdata->ni, txdata->ni = NULL; + + KASSERT(ni != NULL, ("no node")); + KASSERT(m != NULL, ("no mbuf")); + + if (m->m_flags & M_TXCB) + ieee80211_process_callback(ni, m, 1); + + m_freem(m); + ieee80211_free_node(ni); + + txq->queued--; + txq->read = (txq->read + 1) % IWN_TX_RING_COUNT; + } if (wn->agg[tid].bitmap == 0) return; @@ -2460,6 +2485,7 @@ iwn_rx_compressed_ba(struct iwn_softc *s if (wn->agg[tid].nframes > (64 - shift)) return; + ni = tap->txa_ni; bitmap = (le64toh(ba->bitmap) >> shift) & wn->agg[tid].bitmap; for (i = 0; bitmap; i++) { if ((bitmap & 1) == 0) { @@ -2815,8 +2841,6 @@ iwn_ampdu_tx_done(struct iwn_softc *sc, for (lastidx = (seqno & 0xff); ring->read != lastidx;) { data = &ring->data[ring->read]; - KASSERT(data->ni != NULL, ("no node")); - /* Unmap and free mbuf. */ bus_dmamap_sync(ring->data_dmat, data->map, BUS_DMASYNC_POSTWRITE); @@ -2824,6 +2848,9 @@ iwn_ampdu_tx_done(struct iwn_softc *sc, m = data->m, data->m = NULL; ni = data->ni, data->ni = NULL; + KASSERT(ni != NULL, ("no node")); + KASSERT(m != NULL, ("no mbuf")); + if (m->m_flags & M_TXCB) ieee80211_process_callback(ni, m, 1);