Skip site navigation (1)Skip section navigation (2)
Date:      Sun, 27 Jul 2003 18:06:41 -0700
From:      John-Mark Gurney <gurney_j@efn.org>
To:        Lukas Ertl <l.ertl@univie.ac.at>
Cc:        freebsd-current@freebsd.org
Subject:   Re: device driver memory leak in 5.1-20030726?
Message-ID:  <20030728010641.GQ10708@funkthat.com>
In-Reply-To: <20030728010746.I587@korben.in.tern>
References:  <C882BF18-C03F-11D7-A23D-00039315D3FE@exonetric.com> <20030727163914.S698@korben.in.tern> <20030727191758.GN10708@funkthat.com> <20030728010746.I587@korben.in.tern>

next in thread | previous in thread | raw e-mail | index | archive | help

--E/DnYTRukya0zdZ1
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline

Lukas Ertl wrote this message on Mon, Jul 28, 2003 at 01:11 +0200:
> Then I have no explanation.  I'm running the box with a WiFi card,
> generating lots of network traffic, and the box is running fine, no
> panics, and low devbuf allocation.  I'm running the box with the USB
> Bluetooth dongle, generating much less traffic (it's just a 9.6kbit GSM
> link), and the box panics within half an hour in kmem_malloc, with devbuf
> allocation up to 74MB.  It must be either in the Bluetooth code or in the
> USB code.

Upon futher looking at the code, I have a better fix for this.  Let me
know how things go for you.

-- 
  John-Mark Gurney				Voice: +1 415 225 5579

     "All that I will do, has been done, All that I have, has not."

--E/DnYTRukya0zdZ1
Content-Type: text/plain; charset=us-ascii
Content-Disposition: attachment; filename="ng_device.diff"

Index: ng_device.c
===================================================================
RCS file: /home/ncvs/src/sys/netgraph/ng_device.c,v
retrieving revision 1.3
diff -u -u -r1.3 ng_device.c
--- ng_device.c	3 Mar 2003 12:15:52 -0000	1.3
+++ ng_device.c	28 Jul 2003 01:04:31 -0000
@@ -354,27 +354,13 @@
 	NGI_GET_M(item, m);
 	NG_FREE_ITEM(item);
 
-	m = m_pullup(m,m->m_len);
-	if(m == NULL) {
-		printf("%s(): ERROR: m_pullup failed\n",__func__);
-		return(-1);
-	}
-
-	buffer = malloc(sizeof(char)*m->m_len, M_DEVBUF, M_NOWAIT | M_ZERO);
-	if(buffer == NULL) {
-		printf("%s(): ERROR: buffer malloc failed\n",__func__);
-		return(-1);
-	}
-
-	buffer = mtod(m,char *);
-
-	if( (connection->loc+m->m_len) < NGD_QUEUE_SIZE) {
-	        memcpy(connection->readq+connection->loc, buffer, m->m_len);
-		connection->loc += m->m_len;
-	} else
+	if( (connection->loc+m->m_len) < NGD_QUEUE_SIZE)
+		m_copydata(m, 0, m->m_len, connection->readq+connection->loc);
+	else
+		/* XXX - we really should handle this failure case better */
 		printf("%s(): queue full, first read out a bit\n",__func__);
 
-	free(buffer,M_DEVBUF);
+	m_freem(m);
 
 	return(0);
 }

--E/DnYTRukya0zdZ1--



Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20030728010641.GQ10708>