From nobody@FreeBSD.org  Sat Aug  3 20:11:34 2013
Return-Path: <nobody@FreeBSD.org>
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1])
	(using TLSv1 with cipher ADH-AES256-SHA (256/256 bits))
	(No client certificate requested)
	by hub.freebsd.org (Postfix) with ESMTP id 12288127
	for <freebsd-gnats-submit@FreeBSD.org>; Sat,  3 Aug 2013 20:11:34 +0000 (UTC)
	(envelope-from nobody@FreeBSD.org)
Received: from oldred.freebsd.org (oldred.freebsd.org [8.8.178.121])
	(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
	(No client certificate requested)
	by mx1.freebsd.org (Postfix) with ESMTPS id DA4A52C89
	for <freebsd-gnats-submit@FreeBSD.org>; Sat,  3 Aug 2013 20:11:33 +0000 (UTC)
Received: from oldred.freebsd.org ([127.0.1.6])
	by oldred.freebsd.org (8.14.5/8.14.7) with ESMTP id r73KBXR5011863
	for <freebsd-gnats-submit@FreeBSD.org>; Sat, 3 Aug 2013 20:11:33 GMT
	(envelope-from nobody@oldred.freebsd.org)
Received: (from nobody@localhost)
	by oldred.freebsd.org (8.14.5/8.14.5/Submit) id r73KBWfb011862;
	Sat, 3 Aug 2013 20:11:32 GMT
	(envelope-from nobody)
Message-Id: <201308032011.r73KBWfb011862@oldred.freebsd.org>
Date: Sat, 3 Aug 2013 20:11:32 GMT
From: Joao Cabral <jcnc@dhis.org>
To: freebsd-gnats-submit@FreeBSD.org
Subject: mbuf leak in run(4) driver
X-Send-Pr-Version: www-3.1
X-GNATS-Notify:

>Number:         181006
>Category:       kern
>Synopsis:       [run] [patch] mbuf leak in run(4) driver
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    freebsd-net
>State:          closed
>Quarter:        
>Keywords:       
>Date-Required:  
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Sat Aug 03 20:20:00 UTC 2013
>Closed-Date:    Thu Feb 06 23:44:42 CET 2014
>Last-Modified:  Thu Feb 06 23:44:42 CET 2014
>Originator:     Joao Cabral
>Release:        10.0-CURRENT
>Organization:
DHIS
>Environment:
FreeBSD witch.haversine.net 10.0-CURRENT FreeBSD 10.0-CURRENT #9 r249740:250116M: Sat Aug  3 18:55:54 UTC 2013     root@marvin.haversine.net:/usr/obj/arm.armv6/root/head/sys/RPI-B  arm
>Description:
When running a Ralink RT3070/3020/2870 based USB WiFi adapter with FreeBSD current on a Raspberry Pi, the output of "netstat -nr" kept reporting an increasing number of mbufs up to (a few thousands) a point where the adapter would disconnect from the WiFi network and never reconnect again, at which point only a reboot would solve the problem. 

The adapter reports as: 

Aug  2 23:21:10 witch kernel: run0: MAC/BBP RT3070 (rev 0x0201), RF RT3020 (MIMO
 1T1R), address 00:23:28:01:89:a2
Aug  2 23:21:11 witch kernel: wlan0: Ethernet address: 00:23:28:01:89:a2
Aug  2 23:21:12 witch kernel: run0: firmware RT2870 ver. 0.236 loaded

Setting sysctl hw.usb.run.debug=1 caused a lot of error messages, mainly such as: 

Aug  3 03:05:01 witch kernel: run_bulk_rx_callback: bad DMA length 60329
Aug  3 03:05:02 witch kernel: run_bulk_rx_callback: bad DMA length 21348 > 2600
Aug  3 03:05:02 witch kernel: run_bulk_rx_callback: bad DMA length 2787
Aug  3 03:05:02 witch kernel: run_bulk_rx_callback: bad DMA length 26261
Aug  3 03:05:02 witch kernel: run_bulk_rx_callback: bad DMA length 55261

Which suggest alignment problems. 



>How-To-Repeat:

Plugin a run(4) adapter to an arm based FreeBSD and let it flow traffic... see the mbufs increasing up to the point where the adapter disconnects and no longer recovers.



>Fix:

A friend suggested the following patch to base/head/sys/dev/usb/wlan/if_run.c which seems to have solved the problem of the increasing number of mbufs and hence the leak. Mbufs are now stable. 

This does not however solve the problem of misalignment observed on the Raspberry Pi/arm causing the error messages to be triggered. 

Index: if_run.c
===================================================================
--- if_run.c	(revision 253887)
+++ if_run.c	(working copy)
@@ -2659,11 +2659,13 @@
 		if ((dmalen >= (uint32_t)-8) || (dmalen == 0) ||
 		    ((dmalen & 3) != 0)) {
 			DPRINTF("bad DMA length %u\n", dmalen);
+			m_freem(m);
 			break;
 		}
 		if ((dmalen + 8) > (uint32_t)xferlen) {
 			DPRINTF("bad DMA length %u > %d\n",
 			dmalen + 8, xferlen);
+			m_freem(m);
 			break;
 		}
 
@@ -2681,6 +2683,7 @@
 		if (__predict_false(m0 == NULL)) {
 			DPRINTF("could not allocate mbuf\n");
 			ifp->if_ierrors++;
+			m_freem(m);
 			break;
 		}
 		m_copydata(m, 4 /* skip 32-bit DMA-len header */,


>Release-Note:
>Audit-Trail:
Responsible-Changed-From-To: freebsd-bugs->freebsd-net 
Responsible-Changed-By: linimon 
Responsible-Changed-When: Sat Aug 3 23:59:08 UTC 2013 
Responsible-Changed-Why:  
Over to maintainer(s). 

http://www.freebsd.org/cgi/query-pr.cgi?pr=181006 

From: Joao Neves Cabral <jcnc@dhis.org>
To: bug-followup@FreeBSD.org,
 jcnc@dhis.org
Cc:  
Subject: Re: kern/181006: [run] [patch] mbuf leak in run(4) driver
Date: Sun, 4 Aug 2013 09:49:19 +0100

 Sorry, just a couple of mistakes/corrections:
 
 1. Where it reads "netstat -nr" should read "netstat -m".
 
 2. It might not be an alignment problem at all, but just a display/check =
 problem in the driver.
 
 ---
 
 But the patch seems to have fixed the issue and the network hasn't =
 hanged since and the mbufs are now stable:=20
 
 jcnc@witch ~]$ netstat -m
 2/268/270 mbufs in use (current/cache/total)
 2/132/134/31744 mbuf clusters in use (current/cache/total/max)
 2/126 mbuf+clusters out of packet secondary zone in use (current/cache)
 1/8/9/15872 4k (page size) jumbo clusters in use =
 (current/cache/total/max)
 0/0/0/4702 9k jumbo clusters in use (current/cache/total/max)
 0/0/0/2645 16k jumbo clusters in use (current/cache/total/max)
 8K/363K/371K bytes allocated to network (current/cache/total)
 0/0/0 requests for mbufs denied (mbufs/clusters/mbuf+clusters)
 0/0/0 requests for mbufs delayed (mbufs/clusters/mbuf+clusters)
 0/0/0 requests for jumbo clusters delayed (4k/9k/16k)
 0/0/0 requests for jumbo clusters denied (4k/9k/16k)
 0/4/4608 sfbufs in use (current/peak/max)
 0 requests for sfbufs denied
 0 requests for sfbufs delayed
 0 requests for I/O initiated by sendfile
 0 calls to protocol drain routines
 
 
State-Changed-From-To: open->closed 
State-Changed-By: brueffer 
State-Changed-When: Thu Feb 6 23:42:02 CET 2014 
State-Changed-Why:  
This was fixed in HEAD with r257435 and merged back to 9-STABLE in r259457. 
Thanks for the report! 

http://www.freebsd.org/cgi/query-pr.cgi?pr=181006 
>Unformatted:
