From nobody@FreeBSD.org  Mon Dec 10 00:24:38 2001
Return-Path: <nobody@FreeBSD.org>
Received: from freefall.freebsd.org (freefall.FreeBSD.org [216.136.204.21])
	by hub.freebsd.org (Postfix) with ESMTP id 3466A37B41D
	for <freebsd-gnats-submit@FreeBSD.org>; Mon, 10 Dec 2001 00:24:38 -0800 (PST)
Received: (from nobody@localhost)
	by freefall.freebsd.org (8.11.6/8.11.6) id fBA8Oc364430;
	Mon, 10 Dec 2001 00:24:38 -0800 (PST)
	(envelope-from nobody)
Message-Id: <200112100824.fBA8Oc364430@freefall.freebsd.org>
Date: Mon, 10 Dec 2001 00:24:38 -0800 (PST)
From: Chi-Fung Fan <chifung@soda.CSUA.berkeley.edu>
To: freebsd-gnats-submit@FreeBSD.org
Subject: mbufs leaks in dev/ed
X-Send-Pr-Version: www-1.0

>Number:         32666
>Category:       i386
>Synopsis:       mbufs leaks in dev/ed
>Confidential:   no
>Severity:       non-critical
>Priority:       medium
>Responsible:    imp
>State:          closed
>Quarter:        
>Keywords:       
>Date-Required:  
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Mon Dec 10 00:30:00 PST 2001
>Closed-Date:    Sun Sep 29 18:14:27 MDT 2002
>Last-Modified:  Sun Sep 29 18:14:27 MDT 2002
>Originator:     Chi-Fung Fan
>Release:        4.4
>Organization:
>Environment:
486 machine running as a home-network router using two ne2000 compatible nics.  One nic is connected to at&t @home cable modem.

FreeBSD marx.rice.net 4.4-RELEASE FreeBSD 4.4-RELEASE #3: Sun Dec  9 15:07:33 PST 2001     root@marx.rice.net:/usr/src/sys/compile/MARX  i386


>Description:
When ed0 is connected to a noisy network (e.g. @home network), ed_pio_write_mbufs() frequently fails to "wait for remote DMA complete."
The caller ed_start() doesn't free the mbuf when this happens resulting in mbufs leaks.  This would eventually exhaust all the systems mbufs. 
>How-To-Repeat:
connect to a noisy network and make sure you see many of
"ed0: remote transmit DMA failed to complete" messages.
>Fix:
In /usr/src/sys/dev/ed/if_ed.c function ed_start(ifp), add m_freem(m0)
before go back to loop.

len = ed_pio_write_mbufs(sc, m, (int)buffer);
if (len == 0) {
     m_freem(m0);  /* fix mbufs leak */
     goto outloop;
}

>Release-Note:
>Audit-Trail:
Responsible-Changed-From-To: freebsd-bugs->imp 
Responsible-Changed-By: sheldonh 
Responsible-Changed-When: Sun Dec 30 04:22:15 PST 2001 
Responsible-Changed-Why:  
Warner, you've spent a bit of time in the ed(4) driver -- could you take 
a look at this? 

http://www.FreeBSD.org/cgi/query-pr.cgi?pr=32666 
State-Changed-From-To: open->closed 
State-Changed-By: imp 
State-Changed-When: Sun Sep 29 18:14:16 MDT 2002 
State-Changed-Why:  
I've committed this fix. 


http://www.freebsd.org/cgi/query-pr.cgi?pr=32666 
>Unformatted:
