From patchwork Sun Dec 6 17:57:57 2015 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Peter Wu X-Patchwork-Id: 7779151 X-Patchwork-Delegate: kvalo@adurom.com Return-Path: X-Original-To: patchwork-linux-wireless@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork2.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.136]) by patchwork2.web.kernel.org (Postfix) with ESMTP id F0F49BEEE1 for ; Sun, 6 Dec 2015 18:20:41 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id 17351203E3 for ; Sun, 6 Dec 2015 18:20:41 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id CA1F4203E1 for ; Sun, 6 Dec 2015 18:20:39 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753369AbbLFSUi (ORCPT ); Sun, 6 Dec 2015 13:20:38 -0500 Received: from lekensteyn.nl ([178.21.112.251]:47575 "EHLO lekensteyn.nl" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753033AbbLFSUh (ORCPT ); Sun, 6 Dec 2015 13:20:37 -0500 X-Greylist: delayed 1307 seconds by postgrey-1.27 at vger.kernel.org; Sun, 06 Dec 2015 13:20:37 EST DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lekensteyn.nl; s=s2048-2015-q1; h=Message-Id:Date:Subject:To:From; bh=VB9cCtldpefIz00a90eT5VYzRoWuzpgTT2JRW0YqFFo=; b=BW6bsZQMslwlK98wZfCVFEXgq9KHhiQaMq9Q+L8Tuzu0rd64uPmYLpxqGyo2sgLGTOPjj/+4B+7AhTX0d3uKQCDdUfrWq06WWN8QDr55kFj4RBH8WrtTAEenXZWaxCjye5qOybtexhVoTkveD1+SELacUbFeyu4gqw5yHw9exbjV3+xwMHCHoJ1toEEm/KaxeJ7dOvhbpdNCG93G8XF/55Klo7w4LuNO/klttIPxtmS6CZZSsdRubLQKpJ6kQq3OpHAAKlNr9xN6sjwXtdXn5ASoblHTqd91rudSq8prKTR/62bdrcF+FqC2dgbbtPO56maccl8gRXge6f0Qih3FMg==; Received: by lekensteyn.nl with esmtpsa (TLS1.2:ECDHE_RSA_AES_128_CBC_SHA256:128) (Exim 4.84) (envelope-from ) id 1a5dZo-00038N-7z; Sun, 06 Dec 2015 18:58:39 +0100 From: Peter Wu To: Larry Finger , Chaoming Li , Kalle Valo , linux-wireless@vger.kernel.org, netdev@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH] rtlwifi: fix gigantic memleak in rtl_usb Date: Sun, 6 Dec 2015 18:57:57 +0100 Message-Id: <1449424677-3140-1-git-send-email-peter@lekensteyn.nl> X-Mailer: git-send-email 2.6.3 X-Spam-Score: 0.0 (/) X-Spam-Status: No, score=-6.8 required=5.0 tests=BAYES_00,DKIM_SIGNED, RCVD_IN_DNSWL_HI,T_DKIM_INVALID,T_RP_MATCHES_RCVD,UNPARSEABLE_RELAY autolearn=ham version=3.3.1 Sender: linux-wireless-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-wireless@vger.kernel.org X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP Free skb for received frames with a wrong checksum. While using the rtl8192cu driver in monitor mode, somehow 5G of memory was permanently lost (observable via the Available column in `free -m`). Test scenario: ip link set down wlan1 iw wlan1 set type monitor ip link set up wlan1 iw wlan1 set channel 11 Then stream a video on a smartphone on channel 11. Without this patch the memory usage grows linearly with the number of received packets: grep MemAvailable /proc/meminfo ip -s link show dev wlan1 Signed-off-by: Peter Wu --- Hi, This issue has existed since the introduction of this driver in v2.6.x, using kmemleak I was about to figure out the source. There is also a _rtl_usb_rx_process_agg that has similarly looking code, but that one is unaffected. The pci code already frees the skb and is unaffected too. Tested with kernel v4.3, this patch is simply rebased on v4.4-rc3 (due to changed paths). Kind regards, Peter --- drivers/net/wireless/realtek/rtlwifi/usb.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/net/wireless/realtek/rtlwifi/usb.c b/drivers/net/wireless/realtek/rtlwifi/usb.c index 2721cf8..aac1ed3 100644 --- a/drivers/net/wireless/realtek/rtlwifi/usb.c +++ b/drivers/net/wireless/realtek/rtlwifi/usb.c @@ -531,6 +531,8 @@ static void _rtl_usb_rx_process_noagg(struct ieee80211_hw *hw, ieee80211_rx(hw, skb); else dev_kfree_skb_any(skb); + } else { + dev_kfree_skb_any(skb); } }