From nobody Wed Jan 29 10:10:21 2025 X-Original-To: wireless@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4YjdFT2CjMz5mVCl for ; Wed, 29 Jan 2025 10:10:21 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R11" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4YjdFT1YYjz3xcG for ; Wed, 29 Jan 2025 10:10:21 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1738145421; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=07bgGlPXTZutcxVXkSp0pPW6ISrvInph7xxiDt/VGSY=; b=mo+k6eUaqV5jrVd6rnXWkcr5bN2FPn3YZsPNF3yQ2G87t6F4cn5seBmeojJimOk3cj4bLF F7cVtyn1x580VEEm6Qsy7AJvz72JAAJqZVAZTiVdmUOnM1b68uRtizVXEoO/Q8tgIwbseM ZuYrzx4HTLauRolNHXx7Ysbv4EOkozQvn+hFvLs6VTA4bF7SB9E/pwPZPGJJB8/7CaE5Vj 0RMPrg18rTQK2Jq8Dlk5wd1iiGFYvjf9Zw2gX3xjfPG8k1GlhS1/E4nuMXxsPCtOD6XLAj IJj4z1+R0dyP7q5V/xFphjwHSrD4ixjK2ZN6R5qdNYfQ9TvOR9H4p8W327sN6w== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1738145421; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=07bgGlPXTZutcxVXkSp0pPW6ISrvInph7xxiDt/VGSY=; b=SH0mFPkpzEa12IN0d6zr6Myp1Fx5wbLqixvoEZRkGl0nuLiuWAFcTVplS7ZZ2v4acUv/22 Og/j1uxOZ3XrDCkphyRX3Qrio/dyzkUFt3K3MwFHt175OvyR6b+36t0a/TLjBUqaw9AqLI +9EIDvfj/KOebNxcyXzbdQPQf4qNgzYV3oz2O2zXd7yT8icy7bIUDzXTPeMTewec0UyCUE UwAykjhNj30j4pT/UtqR2W/xS1OcMntOtCwObZdPEorU/AXOrjyGEVASAi4GqvcxHlLJsD 3DWdcQbf80mjxx5XzloWjyxz4SF8+lSfc8p0cd7nInEpi6D7d/+vUCqyW0xfaA== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1738145421; a=rsa-sha256; cv=none; b=jxQ8yprOw5ZAKhTLBFzo1koZKluBGreY7Lg22jbeNTy0iQFNbLJRLGR4XKkjEFo5pvheom /Sy0EvYeBnaYVFCdOCKpP08HlftyorCDM4ylv5yqq5WEOsbS3NhwqwlzlH7KIRES5butV+ Q45cvXZhnaXFtcK2goKhClkklnthWZgtdhwKQPoYgb6Tj+TZw3G6eYli21G7RxxBrwQ8j9 i040rXGKTSMCdbX/m6MuPvB4V0lDh2GBzWL66M9FYeTxS8tZEstt4e58CDV9C275Zc6t8M ywHTK77Jxzjbi/YVTvSNkrB9cb2uRYdvxnLlbtUj5Uhny/U8oVRFsStPxkYVPQ== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from kenobi.freebsd.org (kenobi.freebsd.org [IPv6:2610:1c1:1:606c::50:1d]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4YjdFT190JzxKm for ; Wed, 29 Jan 2025 10:10:21 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) Received: from kenobi.freebsd.org ([127.0.1.5]) by kenobi.freebsd.org (8.15.2/8.15.2) with ESMTP id 50TAALYp043473 for ; Wed, 29 Jan 2025 10:10:21 GMT (envelope-from bugzilla-noreply@freebsd.org) Received: (from www@localhost) by kenobi.freebsd.org (8.15.2/8.15.2/Submit) id 50TAAL09043472 for wireless@FreeBSD.org; Wed, 29 Jan 2025 10:10:21 GMT (envelope-from bugzilla-noreply@freebsd.org) X-Authentication-Warning: kenobi.freebsd.org: www set sender to bugzilla-noreply@freebsd.org using -f From: bugzilla-noreply@freebsd.org To: wireless@FreeBSD.org Subject: [Bug 283903] rtw88: possible skb leak Date: Wed, 29 Jan 2025 10:10:21 +0000 X-Bugzilla-Reason: CC X-Bugzilla-Type: changed X-Bugzilla-Watch-Reason: None X-Bugzilla-Product: Base System X-Bugzilla-Component: wireless X-Bugzilla-Version: CURRENT X-Bugzilla-Keywords: X-Bugzilla-Severity: Affects Only Me X-Bugzilla-Who: guillaume-freebsd@outters.eu X-Bugzilla-Status: Open X-Bugzilla-Resolution: X-Bugzilla-Priority: --- X-Bugzilla-Assigned-To: bz@FreeBSD.org X-Bugzilla-Flags: X-Bugzilla-Changed-Fields: Message-ID: In-Reply-To: References: Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="UTF-8" X-Bugzilla-URL: https://bugs.freebsd.org/bugzilla/ Auto-Submitted: auto-generated List-Id: Discussions List-Archive: https://lists.freebsd.org/archives/freebsd-wireless List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: freebsd-wireless@freebsd.org Sender: owner-freebsd-wireless@FreeBSD.org MIME-Version: 1.0 https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=3D283903 --- Comment #15 from Guillaume Outters --- (regarding my question on how to start playing with the kernel and if linux= _kpi was externalizable as a module, I resolved to learn how to compile and star= t a full custom kernel, which is a bit tedious but works) I could notice the fully binary behaviour of alloc, by tracing in linux_802= 11.c at: - lkpi_80211_txq_tx_one(), after the dev_alloc_skb() of https://github.com/freebsd/freebsd-src/blob/main/sys/compat/linuxkpi/common= /src/linux_80211.c#L3816 - linuxkpi_ieee80211_free_txskb(), before the _lkpi_ieee80211_free_txskb() Test procedure: reboot around 14:40 with the traced kernel, run two loops of: while true ; do scp ... ; vmstat -m | grep skb ; sleep 20 ; done One scp lasts 14 s, the other one 10 s, to create interferences (so that fr= om time to time they run simultaneously). I added two web browsing sessions, one around 15:00, the other around 17:40. MINUTES AFTER THE SECOND WEB BROWSING SESSION (interleaved with the scp's), VMSTAT STARTED REPORTING INCREASES WITHOUT FREEING ANYMORE. The increase speed matches that of the consumed bandwidth (1 MB of download= -> 1 MB of leaking SK buff mem). Here is a typical pattern BEFORE the tipping point, each SKB gets freed rapidly: Jan 28 17:43:22 pasdfric kernel: rtw880: ERROR Guillaume: alloc_skb 170 -> 0xfffffe00c51ed000 Jan 28 17:43:22 pasdfric kernel: ERROR Guillaume: free_skb 0xfffffe00c51ed0= 00 Jan 28 17:43:22 pasdfric kernel: rtw880: ERROR Guillaume: alloc_skb 170 -> 0xfffffe00c501e000 Jan 28 17:43:22 pasdfric kernel: rtw880: ERROR Guillaume: alloc_skb 206 -> 0xfffffe00c51ed000 Jan 28 17:43:22 pasdfric kernel: ERROR Guillaume: free_skb 0xfffffe00c501e0= 00 Jan 28 17:43:22 pasdfric kernel: rtw880: ERROR Guillaume: alloc_skb 170 -> 0xfffffe00c5173000 Jan 28 17:43:22 pasdfric kernel: rtw880: ERROR Guillaume: alloc_skb 170 -> 0xfffffe00c52ae000 Jan 28 17:43:22 pasdfric kernel: ERROR Guillaume: free_skb 0xfffffe00c51ed0= 00 Jan 28 17:43:22 pasdfric kernel: rtw880: ERROR Guillaume: alloc_skb 170 -> 0xfffffe008fdc2000 Jan 28 17:43:22 pasdfric kernel: ERROR Guillaume: free_skb 0xfffffe00c51730= 00 Jan 28 17:43:22 pasdfric kernel: ERROR Guillaume: free_skb 0xfffffe00c52ae0= 00 Jan 28 17:43:22 pasdfric kernel: ERROR Guillaume: free_skb 0xfffffe008fdc20= 00 Here is the pattern AT the tipping point: Jan 28 17:43:22 pasdfric kernel: rtw880: ERROR Guillaume: alloc_skb 170 -> 0xfffffe008fdc2000 Jan 28 17:43:22 pasdfric kernel: ERROR Guillaume: free_skb 0xfffffe008fdc20= 00 Jan 28 17:43:22 pasdfric kernel: rtw880: ERROR Guillaume: alloc_skb 170 -> 0xfffffe00c51ed000 Jan 28 17:43:22 pasdfric kernel: ERROR Guillaume: free_skb 0xfffffe00c51ed0= 00 Jan 28 17:43:22 pasdfric kernel: rtw880: ERROR Guillaume: alloc_skb 170 -> 0xfffffe008fdc2000 Jan 28 17:43:22 pasdfric kernel: rtw880: ERROR Guillaume: alloc_skb 170 -> 0xfffffe00c51ed000 Jan 28 17:43:22 pasdfric kernel: ERROR Guillaume: free_skb 0xfffffe008fdc20= 00 Jan 28 17:43:22 pasdfric kernel: rtw880: ERROR Guillaume: alloc_skb 170 -> 0xfffffe00c52ae000 Jan 28 17:43:22 pasdfric kernel: rtw880: ERROR Guillaume: alloc_skb 170 -> 0xfffffe00c5279000 Jan 28 17:43:22 pasdfric kernel: rtw880: ERROR Guillaume: alloc_skb 170 -> 0xfffffe00c52fc000 Jan 28 17:43:22 pasdfric kernel: rtw880: ERROR Guillaume: alloc_skb 170 -> 0xfffffe00c4fd3000 Jan 28 17:43:22 pasdfric kernel: rtw880: ERROR Guillaume: alloc_skb 170 -> 0xfffffe00c4fca000 Jan 28 17:43:22 pasdfric kernel: rtw880: ERROR Guillaume: alloc_skb 170 -> 0xfffffe00c525e000 Jan 28 17:43:22 pasdfric kernel: rtw880: ERROR Guillaume: alloc_skb 170 -> 0xfffffe00c53ff000 Jan 28 17:43:22 pasdfric kernel: rtw880: ERROR Guillaume: alloc_skb 170 -> 0xfffffe00c4d26000 Jan 28 17:43:22 pasdfric kernel: rtw880: ERROR Guillaume: alloc_skb 170 -> 0xfffffe00c5341000 Now I'll just have to go up in linuxkpi_ieee80211_free_txskb()'s callers to= see what calls it habitually, and doesn't call it anymore after the tipping point... --=20 You are receiving this mail because: You are on the CC list for the bug.=