From: Peter Wu <peter@lekensteyn.nl>
To: Larry Finger <Larry.Finger@lwfinger.net>,
Chaoming Li <chaoming_li@realsil.com.cn>,
Kalle Valo <kvalo@codeaurora.org>,
linux-wireless@vger.kernel.org, netdev@vger.kernel.org,
linux-kernel@vger.kernel.org
Subject: [PATCH] rtlwifi: fix gigantic memleak in rtl_usb
Date: Sun, 6 Dec 2015 18:57:57 +0100 [thread overview]
Message-ID: <1449424677-3140-1-git-send-email-peter@lekensteyn.nl> (raw)
Free skb for received frames with a wrong checksum.
While using the rtl8192cu driver in monitor mode, somehow 5G of memory
was permanently lost (observable via the Available column in `free -m`).
Test scenario:
ip link set down wlan1
iw wlan1 set type monitor
ip link set up wlan1
iw wlan1 set channel 11
Then stream a video on a smartphone on channel 11. Without this patch
the memory usage grows linearly with the number of received packets:
grep MemAvailable /proc/meminfo
ip -s link show dev wlan1
Signed-off-by: Peter Wu <peter@lekensteyn.nl>
---
Hi,
This issue has existed since the introduction of this driver in v2.6.x,
using kmemleak I was about to figure out the source. There is also a
_rtl_usb_rx_process_agg that has similarly looking code, but that one is
unaffected. The pci code already frees the skb and is unaffected too.
Tested with kernel v4.3, this patch is simply rebased on v4.4-rc3 (due
to changed paths).
Kind regards,
Peter
---
drivers/net/wireless/realtek/rtlwifi/usb.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/net/wireless/realtek/rtlwifi/usb.c b/drivers/net/wireless/realtek/rtlwifi/usb.c
index 2721cf8..aac1ed3 100644
--- a/drivers/net/wireless/realtek/rtlwifi/usb.c
+++ b/drivers/net/wireless/realtek/rtlwifi/usb.c
@@ -531,6 +531,8 @@ static void _rtl_usb_rx_process_noagg(struct ieee80211_hw *hw,
ieee80211_rx(hw, skb);
else
dev_kfree_skb_any(skb);
+ } else {
+ dev_kfree_skb_any(skb);
}
}
--
2.6.3
next reply other threads:[~2015-12-06 18:20 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2015-12-06 17:57 Peter Wu [this message]
2015-12-06 20:18 ` [PATCH] rtlwifi: fix gigantic memleak in rtl_usb Larry Finger
2015-12-06 21:39 ` Peter Wu
2015-12-06 22:33 ` Larry Finger
2015-12-07 15:11 ` Kalle Valo
2015-12-07 16:04 ` Bruno Randolf
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1449424677-3140-1-git-send-email-peter@lekensteyn.nl \
--to=peter@lekensteyn.nl \
--cc=Larry.Finger@lwfinger.net \
--cc=chaoming_li@realsil.com.cn \
--cc=kvalo@codeaurora.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-wireless@vger.kernel.org \
--cc=netdev@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.