kern/181006: mbuf leak in run(4) driver

[Joao Cabral]

>Number:         181006
>Category:       kern
>Synopsis:       mbuf leak in run(4) driver
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    freebsd-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Sat Aug 03 20:20:00 UTC 2013
>Closed-Date:
>Last-Modified:
>Originator:     Joao Cabral
>Release:        10.0-CURRENT
>Organization:
DHIS
>Environment:
FreeBSD witch.haversine.net 10.0-CURRENT FreeBSD 10.0-CURRENT #9 r249740:250116M: Sat Aug  3 18:55:54 UTC 2013     root at marvin.haversine.net:/usr/obj/arm.armv6/root/head/sys/RPI-B  arm
>Description:
When running a Ralink RT3070/3020/2870 based USB WiFi adapter with FreeBSD current on a Raspberry Pi, the output of "netstat -nr" kept reporting an increasing number of mbufs up to (a few thousands) a point where the adapter would disconnect from the WiFi network and never reconnect again, at which point only a reboot would solve the problem. 

The adapter reports as: 

Aug  2 23:21:10 witch kernel: run0: MAC/BBP RT3070 (rev 0x0201), RF RT3020 (MIMO
 1T1R), address 00:23:28:01:89:a2
Aug  2 23:21:11 witch kernel: wlan0: Ethernet address: 00:23:28:01:89:a2
Aug  2 23:21:12 witch kernel: run0: firmware RT2870 ver. 0.236 loaded

Setting sysctl hw.usb.run.debug=1 caused a lot of error messages, mainly such as: 

Aug  3 03:05:01 witch kernel: run_bulk_rx_callback: bad DMA length 60329
Aug  3 03:05:02 witch kernel: run_bulk_rx_callback: bad DMA length 21348 > 2600
Aug  3 03:05:02 witch kernel: run_bulk_rx_callback: bad DMA length 2787
Aug  3 03:05:02 witch kernel: run_bulk_rx_callback: bad DMA length 26261
Aug  3 03:05:02 witch kernel: run_bulk_rx_callback: bad DMA length 55261

Which suggest alignment problems. 



>How-To-Repeat:

Plugin a run(4) adapter to an arm based FreeBSD and let it flow traffic... see the mbufs increasing up to the point where the adapter disconnects and no longer recovers.



>Fix:

A friend suggested the following patch to base/head/sys/dev/usb/wlan/if_run.c which seems to have solved the problem of the increasing number of mbufs and hence the leak. Mbufs are now stable. 

This does not however solve the problem of misalignment observed on the Raspberry Pi/arm causing the error messages to be triggered. 

Index: if_run.c
===================================================================
--- if_run.c	(revision 253887)
+++ if_run.c	(working copy)
@@ -2659,11 +2659,13 @@
 		if ((dmalen >= (uint32_t)-8) || (dmalen == 0) ||
 		    ((dmalen & 3) != 0)) {
 			DPRINTF("bad DMA length %u\n", dmalen);
+			m_freem(m);
 			break;
 		}
 		if ((dmalen + 8) > (uint32_t)xferlen) {
 			DPRINTF("bad DMA length %u > %d\n",
 			dmalen + 8, xferlen);
+			m_freem(m);
 			break;
 		}
 
@@ -2681,6 +2683,7 @@
 		if (__predict_false(m0 == NULL)) {
 			DPRINTF("could not allocate mbuf\n");
 			ifp->if_ierrors++;
+			m_freem(m);
 			break;
 		}
 		m_copydata(m, 4 /* skip 32-bit DMA-len header */,


>Release-Note:
>Audit-Trail:
>Unformatted: