From patchwork Sat Mar 21 20:16:05 2015 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Larry Finger X-Patchwork-Id: 6064871 X-Patchwork-Delegate: kvalo@adurom.com Return-Path: X-Original-To: patchwork-linux-wireless@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork2.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.136]) by patchwork2.web.kernel.org (Postfix) with ESMTP id 51EFEBF90F for ; Sat, 21 Mar 2015 20:16:26 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id 6EC1120351 for ; Sat, 21 Mar 2015 20:16:25 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 7766C202E6 for ; Sat, 21 Mar 2015 20:16:24 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751800AbbCUUQW (ORCPT ); Sat, 21 Mar 2015 16:16:22 -0400 Received: from mail-ob0-f178.google.com ([209.85.214.178]:36324 "EHLO mail-ob0-f178.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751781AbbCUUQU (ORCPT ); Sat, 21 Mar 2015 16:16:20 -0400 Received: by obdfc2 with SMTP id fc2so99477078obd.3; Sat, 21 Mar 2015 13:16:20 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=sender:from:to:cc:subject:date:message-id; bh=VhlYTSKBxBjuKmG3LDXsqKpzzFaBBWK4wCASX4dmfp8=; b=YzCN4/2ZODuW4+SAKasuQbV8rnF9W+TvyqC1zPpVcTmeeJ13uRXrwc0taWrt/emIwI krfU4RiZ8CJEdy3LTSclwmoJ+1tAMX4phUoSZkGR2yUOyylEMGQ3EFTu/YtelO10KrSA R9F44cODwnwee4yK97RUGptV+CcnRKxcMO/uAljltP8V1dfuxcGpcu131e7muU/4js+T zWYppeQ1JDNQX1Xq1zsyVOYVh3bw+ODNO6eb/0MQdh3Y20jej/nG4vhJXlicnI+MPwQu Y8TGUL3cTBoqkZQmk3ZdwkSiZp4rZYZ5OvHPSxPeJMKflxky86l5wcUtZrGkRNFs3cP8 LzPw== X-Received: by 10.182.241.197 with SMTP id wk5mr12115500obc.0.1426968979940; Sat, 21 Mar 2015 13:16:19 -0700 (PDT) Received: from linux.site ([75.81.56.199]) by mx.google.com with ESMTPSA id nu6sm4871732obc.27.2015.03.21.13.16.18 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Sat, 21 Mar 2015 13:16:19 -0700 (PDT) From: Larry Finger To: kvalo@codeaurora.org Cc: linux-wireless@vger.kernel.org, Larry Finger , Kevin Mullican , Shao Fu , Stable Subject: [PATCH] rtlwifi: Fix IOMMU mapping leak in AP mode Date: Sat, 21 Mar 2015 15:16:05 -0500 Message-Id: <1426968965-30161-1-git-send-email-Larry.Finger@lwfinger.net> X-Mailer: git-send-email 2.1.4 Sender: linux-wireless-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-wireless@vger.kernel.org X-Spam-Status: No, score=-6.8 required=5.0 tests=BAYES_00,DKIM_SIGNED, RCVD_IN_DNSWL_HI,T_DKIM_INVALID,T_RP_MATCHES_RCVD,UNPARSEABLE_RELAY autolearn=unavailable version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP Transmission of an AP beacon does not call the TX interrupt service routine, which usually does the cleanup. Instead, cleanup is handled in a tasklet completion routine. Unfortunately, this routine has a serious bug in that it does not release the DMA mapping before it frees the skb, thus one IOMMU mapping is leaked for each beacon. The test system failed with no free IOMMU mapping slots approximately one hour after hostapd was used to start an AP. This issue was reported and tested at https://github.com/lwfinger/rtlwifi_new/issues/30. Reported-and-tested-by: Kevin Mullican Cc: Kevin Mullican Signed-off-by: Shao Fu Signed-off-by: Larry Finger Cc: Stable [3.18+] --- Kalle, This patch should be applied as soon as possible - 4.0 would be best. I know it is late in the 4.0 release cycle, but it took a while to diagnose the problem. Thanks, Larry --- drivers/net/wireless/rtlwifi/pci.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/drivers/net/wireless/rtlwifi/pci.c b/drivers/net/wireless/rtlwifi/pci.c index 7069778..11ef17d 100644 --- a/drivers/net/wireless/rtlwifi/pci.c +++ b/drivers/net/wireless/rtlwifi/pci.c @@ -1120,12 +1120,22 @@ static void _rtl_pci_prepare_bcn_tasklet(struct ieee80211_hw *hw) /*This is for new trx flow*/ struct rtl_tx_buffer_desc *pbuffer_desc = NULL; u8 temp_one = 1; + u8 *entry; memset(&tcb_desc, 0, sizeof(struct rtl_tcb_desc)); ring = &rtlpci->tx_ring[BEACON_QUEUE]; pskb = __skb_dequeue(&ring->queue); - if (pskb) + if (rtlpriv->use_new_trx_flow) + entry = (u8 *)(&ring->buffer_desc[ring->idx]); + else + entry = (u8 *)(&ring->desc[ring->idx]); + if (pskb) { + pci_unmap_single(rtlpci->pdev, + rtlpriv->cfg->ops->get_desc( + (u8 *)entry, true, HW_DESC_TXBUFF_ADDR), + pskb->len, PCI_DMA_TODEVICE); kfree_skb(pskb); + } /*NB: the beacon data buffer must be 32-bit aligned. */ pskb = ieee80211_beacon_get(hw, mac->vif);