From nobody@FreeBSD.org  Fri Jul  2 13:07:09 2010
Return-Path: <nobody@FreeBSD.org>
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id 03695106566B
	for <freebsd-gnats-submit@FreeBSD.org>; Fri,  2 Jul 2010 13:07:09 +0000 (UTC)
	(envelope-from nobody@FreeBSD.org)
Received: from www.freebsd.org (www.freebsd.org [IPv6:2001:4f8:fff6::21])
	by mx1.freebsd.org (Postfix) with ESMTP id E6E8F8FC1B
	for <freebsd-gnats-submit@FreeBSD.org>; Fri,  2 Jul 2010 13:07:08 +0000 (UTC)
Received: from www.freebsd.org (localhost [127.0.0.1])
	by www.freebsd.org (8.14.3/8.14.3) with ESMTP id o62D788Y070776
	for <freebsd-gnats-submit@FreeBSD.org>; Fri, 2 Jul 2010 13:07:08 GMT
	(envelope-from nobody@www.freebsd.org)
Received: (from nobody@localhost)
	by www.freebsd.org (8.14.3/8.14.3/Submit) id o62D78oE070775;
	Fri, 2 Jul 2010 13:07:08 GMT
	(envelope-from nobody)
Message-Id: <201007021307.o62D78oE070775@www.freebsd.org>
Date: Fri, 2 Jul 2010 13:07:08 GMT
From: Boris Kochergin <spawk@acm.poly.edu>
To: freebsd-gnats-submit@FreeBSD.org
Subject: FreeBSD 7.x hostap memory leak in net80211 or Atheros driver
X-Send-Pr-Version: www-3.1
X-GNATS-Notify:

>Number:         148317
>Category:       kern
>Synopsis:       [ath] FreeBSD 7.x hostap memory leak in net80211 or Atheros driver
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    freebsd-wireless
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:  
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Fri Jul 02 13:10:05 UTC 2010
>Closed-Date:    
>Last-Modified:  Mon Apr 11 11:41:40 UTC 2011
>Originator:     Boris Kochergin
>Release:        7.3-RELEASE-p1
>Organization:
Polytechnic Institute of NYU
>Environment:
FreeBSD varick-ap-2 7.3-RELEASE-p1 FreeBSD 7.3-RELEASE-p1 #3: Wed Jun 16 09:56:35 EDT 2010     boris@varick-ap-2:/usr/obj/usr/src/sys/VARICK-5501-AP  i386
>Description:
When using an Atheros 5212 PCI controller as a busy 7.x access point, a memory leak occurs frequently and eventually leads to a panic. The problem has been observed on multiple machines. Relevant "vmstat -m" output when the leak is observed:

80211node 12677 101401K       -   120901  16,512

Running "ifconfig ath0 down" (ath0 being the controller in hostap mode) frees the memory. The problem occurs with all three rate-control algorithms. I have eliminated some possible allocations that might cause the leak and have narrowed it down to two:

Line 595 of /usr/src/sys/net80211/ieee80211_node.c:

       MALLOC(ni, struct ieee80211_node *, sizeof(struct ieee80211_node),
               M_80211_NODE, M_NOWAIT | M_ZERO);

Line 3164 of /usr/src/sys/dev/ath/if_ath.c:

       an = malloc(space, M_80211_NODE, M_NOWAIT|M_ZERO);

It looks like both are supposed to be freed by node_free() in /usr/src/sys/net80211/ieee80211_node.c, but there is some code path where that doesn't happen, and should.
>How-To-Repeat:

>Fix:


>Release-Note:
>Audit-Trail:
Responsible-Changed-From-To: freebsd-bugs->freebsd-net 
Responsible-Changed-By: linimon 
Responsible-Changed-When: Mon Jul 12 15:40:30 UTC 2010 
Responsible-Changed-Why:  
Over to maintainer(s). 

http://www.freebsd.org/cgi/query-pr.cgi?pr=148317 
Responsible-Changed-From-To: freebsd-net->freebsd-wireless 
Responsible-Changed-By: adrian 
Responsible-Changed-When: Mon Apr 11 11:41:26 UTC 2011 
Responsible-Changed-Why:  
punt to wireless list 


http://www.freebsd.org/cgi/query-pr.cgi?pr=148317 
>Unformatted:
