Re: Memory leak in ieee80211_rx_napi()

[Larry Finger <Larry.Finger@lwfinger.net>]

On 4/9/21 2:31 PM, Johannes Berg wrote:
> Hi Larry,
> 
>> What setting or lack of, would cause ieee80211_rx_napi() to leak the skb that it
>> is given? The documentation states that once this call is made, mac80211 owns
>> this buffer. Does this mean that it will also be freed?
> 
> Eventually, yes. But it might go onto a NAPI GRO list, etc. Perhaps it
> might even look like it's leaked if it's on such a list if you didn't
> implement NAPI properly as polling, but just call ieee80211_rx_napi()
> with a non-NULL napi struct pointer.
> 
> That said, of course there might be bugs in mac80211 where it actually
> leaks the skb.
> 
> How are you determining that it's being leaked?
> 
> johannes
> 

I use kmemleak. They are real leaks as they persist after the rtw drivers are 
unloaded.

The call is ieee80211_rx_napi(rtwdev->hw, NULL, new, napi); I added a test for 
napi == NULL. None failed.

Is it possible that the NULL for struct ieee80211_sta would screw it up? I see 
that most of the Intel drivers use a non-NULL argument.

Would a "Network controller [0280]: Intel Corporation Wireless 7260 [8086:08b1] 
(rev 73)" use napi? If so, iwlmvm does not leak anything. I do not have any 
other devices that use napi.

Larry