[PATCH] rtlwifi: fix gigantic memleak in rtl_usb

2015-12-06 Thread Peter Wu
Free skb for received frames with a wrong checksum.

While using the rtl8192cu driver in monitor mode, somehow 5G of memory
was permanently lost (observable via the Available column in `free -m`).

Test scenario:

ip link set down wlan1
iw wlan1 set type monitor
ip link set up wlan1
iw wlan1 set channel 11

Then stream a video on a smartphone on channel 11. Without this patch
the memory usage grows linearly with the number of received packets:

grep MemAvailable /proc/meminfo
ip -s link show dev wlan1

Signed-off-by: Peter Wu 
---
Hi,

This issue has existed since the introduction of this driver in v2.6.x,
using kmemleak I was about to figure out the source. There is also a
_rtl_usb_rx_process_agg that has similarly looking code, but that one is
unaffected. The pci code already frees the skb and is unaffected too.

Tested with kernel v4.3, this patch is simply rebased on v4.4-rc3 (due
to changed paths).

Kind regards,
Peter
---
 drivers/net/wireless/realtek/rtlwifi/usb.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/net/wireless/realtek/rtlwifi/usb.c 
b/drivers/net/wireless/realtek/rtlwifi/usb.c
index 2721cf8..aac1ed3 100644
--- a/drivers/net/wireless/realtek/rtlwifi/usb.c
+++ b/drivers/net/wireless/realtek/rtlwifi/usb.c
@@ -531,6 +531,8 @@ static void _rtl_usb_rx_process_noagg(struct ieee80211_hw 
*hw,
ieee80211_rx(hw, skb);
else
dev_kfree_skb_any(skb);
+   } else {
+   dev_kfree_skb_any(skb);
}
 }
 
-- 
2.6.3

--
To unsubscribe from this list: send the line "unsubscribe linux-wireless" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html


[PATCH v2] rtlwifi: fix memory leak for USB device

2015-12-06 Thread Peter Wu
Free skb for received frames with a wrong checksum. This can happen
pretty rapidly, exhausting all memory.

This fixes a memleak (detected with kmemleak). Originally found while
using monitor mode, but it also appears during managed mode (once the
link is up).

Cc: sta...@vger.kernel.org
Signed-off-by: Peter Wu 
---
 v2: updated commit message based on Larry's feedback
 v1: 
https://lkml.kernel.org/r/1449424677-3140-1-git-send-email-pe...@lekensteyn.nl

Tested with v4.3, rebased on v4.4-rc3 (changed paths). The bug goes back
to its introduction in the v2.6.x kernel.
---
 drivers/net/wireless/realtek/rtlwifi/usb.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/net/wireless/realtek/rtlwifi/usb.c 
b/drivers/net/wireless/realtek/rtlwifi/usb.c
index 2721cf8..aac1ed3 100644
--- a/drivers/net/wireless/realtek/rtlwifi/usb.c
+++ b/drivers/net/wireless/realtek/rtlwifi/usb.c
@@ -531,6 +531,8 @@ static void _rtl_usb_rx_process_noagg(struct ieee80211_hw 
*hw,
ieee80211_rx(hw, skb);
else
dev_kfree_skb_any(skb);
+   } else {
+   dev_kfree_skb_any(skb);
}
 }
 
-- 
2.6.3

--
To unsubscribe from this list: send the line "unsubscribe linux-wireless" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html


Re: [PATCH linux-firmware] mt7601u: Add firmware version 2.6

2015-12-06 Thread Ben Hutchings
On Fri, 2015-11-27 at 22:26 +, Jakub Kicinski wrote:
[...]
> From: Hua Shao (邵华) 
> 
> Add firmware for mt7601u. version 34.
> 
> Signed-off-by: Hua Shao 
> ---
>  WHENCE  |  10 ++
>  mt7601u.bin | Bin 0 -> 45412 bytes
>  2 files changed, 10 insertions(+)
>  create mode 100755 mt7601u.bin
[...]

I've applied this; thanks.

Ben.

-- 
Ben Hutchings
Theory and practice are closer in theory than in practice.
- John Levine, moderator of comp.compilers

signature.asc
Description: This is a digitally signed message part


Re: [PATCH v2] rtlwifi: fix memory leak for USB device

2015-12-06 Thread Larry Finger

On 12/06/2015 06:07 PM, Peter Wu wrote:

Free skb for received frames with a wrong checksum. This can happen
pretty rapidly, exhausting all memory.

This fixes a memleak (detected with kmemleak). Originally found while
using monitor mode, but it also appears during managed mode (once the
link is up).

Cc: sta...@vger.kernel.org
Signed-off-by: Peter Wu 
---
  v2: updated commit message based on Larry's feedback
  v1: 
https://lkml.kernel.org/r/1449424677-3140-1-git-send-email-pe...@lekensteyn.nl

Tested with v4.3, rebased on v4.4-rc3 (changed paths). The bug goes back
to its introduction in the v2.6.x kernel.
---
  drivers/net/wireless/realtek/rtlwifi/usb.c | 2 ++
  1 file changed, 2 insertions(+)


ACKed-by: Larry Finger 

Thanks,

Larry



diff --git a/drivers/net/wireless/realtek/rtlwifi/usb.c 
b/drivers/net/wireless/realtek/rtlwifi/usb.c
index 2721cf8..aac1ed3 100644
--- a/drivers/net/wireless/realtek/rtlwifi/usb.c
+++ b/drivers/net/wireless/realtek/rtlwifi/usb.c
@@ -531,6 +531,8 @@ static void _rtl_usb_rx_process_noagg(struct ieee80211_hw 
*hw,
ieee80211_rx(hw, skb);
else
dev_kfree_skb_any(skb);
+   } else {
+   dev_kfree_skb_any(skb);
}
  }




--
To unsubscribe from this list: send the line "unsubscribe linux-wireless" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html


Re: [PATCH] rtlwifi: fix gigantic memleak in rtl_usb

2015-12-06 Thread Larry Finger

On 12/06/2015 11:57 AM, Peter Wu wrote:

Free skb for received frames with a wrong checksum.

While using the rtl8192cu driver in monitor mode, somehow 5G of memory
was permanently lost (observable via the Available column in `free -m`).

Test scenario:

 ip link set down wlan1
 iw wlan1 set type monitor
 ip link set up wlan1
 iw wlan1 set channel 11

Then stream a video on a smartphone on channel 11. Without this patch
the memory usage grows linearly with the number of received packets:

 grep MemAvailable /proc/meminfo
 ip -s link show dev wlan1

Signed-off-by: Peter Wu 
---
Hi,

This issue has existed since the introduction of this driver in v2.6.x,
using kmemleak I was about to figure out the source. There is also a
_rtl_usb_rx_process_agg that has similarly looking code, but that one is
unaffected. The pci code already frees the skb and is unaffected too.

Tested with kernel v4.3, this patch is simply rebased on v4.4-rc3 (due
to changed paths).

Kind regards,
Peter
---
  drivers/net/wireless/realtek/rtlwifi/usb.c | 2 ++
  1 file changed, 2 insertions(+)

diff --git a/drivers/net/wireless/realtek/rtlwifi/usb.c 
b/drivers/net/wireless/realtek/rtlwifi/usb.c
index 2721cf8..aac1ed3 100644
--- a/drivers/net/wireless/realtek/rtlwifi/usb.c
+++ b/drivers/net/wireless/realtek/rtlwifi/usb.c
@@ -531,6 +531,8 @@ static void _rtl_usb_rx_process_noagg(struct ieee80211_hw 
*hw,
ieee80211_rx(hw, skb);
else
dev_kfree_skb_any(skb);
+   } else {
+   dev_kfree_skb_any(skb);
}
  }




Thanks for finding and fixing this memory leak.

The patch is OK, but the commit message and subject are not. I do not like the 
use of the word "gigantic" in the subject. A better subject would be: "rtlwifi: 
Fix memory leak for USB device while in monitor mode".


The commit message should say that a memory leak was observed, and found with 
kmemleak. If you were simply reportimg the bug, then the steps needed to 
reproduce it would be important, but as you have a fix, those steps are 
extraneous. You should also include a "Cc: Stable 

Re: [PATCH] mwifiex: fix semicolon.cocci warnings

2015-12-06 Thread Joe Perches
On Sun, 2015-12-06 at 22:56 +0100, Julia Lawall wrote:
> Remove unneeded semicolon.
> 
> Generated by: scripts/coccinelle/misc/semicolon.cocci

There are a lot more of these

arch/arm/mach-ixp4xx/goramo_mlr.c:78:static u32 hw_bits = 0xFFFD;/* 
assume all hardware present */;
crypto/tgr192.c:563:tgr192_update(desc, NULL, 0); /* flush */ ;
crypto/tgr192.c:591:tgr192_update(desc, NULL, 0); /* flush */ ;
drivers/block/drbd/drbd_int.h:982:  struct list_head list; /* on 
device->pending_bitmap_io */;
drivers/block/drbd/drbd_state.c:2202:   enum drbd_state_rv err, rv = 
SS_UNKNOWN_ERROR; /* continue waiting */;
drivers/block/drbd/drbd_main.c:1453:return drop_it; /* && (device->state == 
R_PRIMARY) */;
drivers/block/ataflop.c:779:dma_wd.fdc_speed = 0;   /* always seek 
with 8 Mhz */;
drivers/scsi/bnx2i/bnx2i.h:540: u16 itt[BNX2X_MAX_CQS];
/* Cstorm CQ sequence to notify array, updated by driver */;
drivers/net/ethernet/chelsio/cxgb4vf/sge.c:1802:for 
(frag = 0, fp = gl.frags; /**/; frag++, fp++) {
drivers/net/wireless/marvell/mwifiex/init.c:98: priv->beacon_period = 100; /* 
beacon interval */ ;
drivers/net/wireless/intel/iwlwifi/mvm/fw-api-power.h:313:}; /* 
TX_POWER_REDUCED_FLAGS_TYPE_API_E_VER_2 */;
drivers/net/wireless/intersil/prism54/islpci_dev.c:112: return 
-EILSEQ; /* Illegal byte sequence  */;
drivers/spi/spi-bcm2835.c:239:  bs->dma_pending = 0;

/* and mark as completed */;
drivers/spi/spi-topcliff-pch.c:879: param->chan_id = data->ch * 2; /* Tx = 
0, 2 */;
drivers/spi/spi-topcliff-pch.c:894: param->chan_id = data->ch * 2 + 1; /* 
Rx = Tx + 1 */;
drivers/usb/serial/keyspan.c:1966:  dr->bRequest = 0xB0;/* 49wg 
control message */;
drivers/usb/serial/oti6858.c:112:   u8  rx_bytes_avail; /* 
number of bytes in rx buffer */;
drivers/clk/tegra/clk-dfll.c:723:   int coef = 128; /* FIXME: td->cg_scale? 
*/;
drivers/media/pci/ivtv/ivtv-driver.h:532:   u8 even[2]; /* two-byte 
payload of even field */;
fs/xfs/libxfs/xfs_btree.h:98:   case XFS_BTNUM_MAX: ASSERT(0); /* fucking gcc 
*/ ; break;   \
fs/xfs/libxfs/xfs_btree.h:118:  case XFS_BTNUM_MAX: ASSERT(0); /* fucking gcc 
*/ ; break; \
fs/xfs/xfs_itable.c:375:ac.ac_ubleft = ubcount * statstruct_size; /* 
bytes */;
include/uapi/linux/nfc.h:278:   char service_name[NFC_LLCP_MAX_SERVICE_NAME]; 
/* Service name URI */;
kernel/trace/ring_buffer.c:4896:set_current_state(TASK_INTERRUPTIBLE);
/* Just run for 10 seconds */;
sound/soc/intel/atom/sst/sst.c:71:  sst_shim_write64(drv->shim, 
drv->ipc_reg.ipcx, header.full);
--
To unsubscribe from this list: send the line "unsubscribe linux-wireless" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html


[PATCH] mwifiex: fix semicolon.cocci warnings

2015-12-06 Thread Julia Lawall
Remove unneeded semicolon.

Generated by: scripts/coccinelle/misc/semicolon.cocci

Signed-off-by: Fengguang Wu 
Signed-off-by: Julia Lawall 
---

 init.c |2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/net/wireless/marvell/mwifiex/init.c
+++ b/drivers/net/wireless/marvell/mwifiex/init.c
@@ -95,7 +95,7 @@ int mwifiex_init_priv(struct mwifiex_pri
priv->curr_pkt_filter = HostCmd_ACT_MAC_RX_ON | HostCmd_ACT_MAC_TX_ON |
HostCmd_ACT_MAC_ETHERNETII_ENABLE;
 
-   priv->beacon_period = 100; /* beacon interval */ ;
+   priv->beacon_period = 100; /* beacon interval */
priv->attempted_bss_desc = NULL;
memset(>curr_bss_params, 0, sizeof(priv->curr_bss_params));
priv->listen_interval = MWIFIEX_DEFAULT_LISTEN_INTERVAL;
--
To unsubscribe from this list: send the line "unsubscribe linux-wireless" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html


Re: [PATCH] rtlwifi: fix gigantic memleak in rtl_usb

2015-12-06 Thread Peter Wu
On Sun, Dec 06, 2015 at 02:18:36PM -0600, Larry Finger wrote:
> On 12/06/2015 11:57 AM, Peter Wu wrote:
> >Free skb for received frames with a wrong checksum.
> >
> >While using the rtl8192cu driver in monitor mode, somehow 5G of memory
> >was permanently lost (observable via the Available column in `free -m`).
> >
> >Test scenario:
> >
> > ip link set down wlan1
> > iw wlan1 set type monitor
> > ip link set up wlan1
> > iw wlan1 set channel 11
> >
> >Then stream a video on a smartphone on channel 11. Without this patch
> >the memory usage grows linearly with the number of received packets:
> >
> > grep MemAvailable /proc/meminfo
> > ip -s link show dev wlan1
> >
> >Signed-off-by: Peter Wu 
> >---
> >Hi,
> >
> >This issue has existed since the introduction of this driver in v2.6.x,
> >using kmemleak I was about to figure out the source. There is also a
> >_rtl_usb_rx_process_agg that has similarly looking code, but that one is
> >unaffected. The pci code already frees the skb and is unaffected too.
> >
> >Tested with kernel v4.3, this patch is simply rebased on v4.4-rc3 (due
> >to changed paths).
> >
> >Kind regards,
> >Peter
> >---
> >  drivers/net/wireless/realtek/rtlwifi/usb.c | 2 ++
> >  1 file changed, 2 insertions(+)
> >
> >diff --git a/drivers/net/wireless/realtek/rtlwifi/usb.c 
> >b/drivers/net/wireless/realtek/rtlwifi/usb.c
> >index 2721cf8..aac1ed3 100644
> >--- a/drivers/net/wireless/realtek/rtlwifi/usb.c
> >+++ b/drivers/net/wireless/realtek/rtlwifi/usb.c
> >@@ -531,6 +531,8 @@ static void _rtl_usb_rx_process_noagg(struct 
> >ieee80211_hw *hw,
> > ieee80211_rx(hw, skb);
> > else
> > dev_kfree_skb_any(skb);
> >+} else {
> >+dev_kfree_skb_any(skb);
> > }
> >  }
> >
> >
> 
> Thanks for finding and fixing this memory leak.
> 
> The patch is OK, but the commit message and subject are not. I do not like
> the use of the word "gigantic" in the subject. A better subject would be:
> "rtlwifi: Fix memory leak for USB device while in monitor mode".
> 
> The commit message should say that a memory leak was observed, and found
> with kmemleak. If you were simply reportimg the bug, then the steps needed
> to reproduce it would be important, but as you have a fix, those steps are
> extraneous. You should also include a "Cc: Stable  line. When the patch is picked up for stable kernels, it will be necessary
> to rebase the patch to compensate for the directory change.

I have done some additional testing using QEMU and USB passthrough and
can report that the leak is not limited to monitor mode. The commit
message is adjusted for that. This issue is pretty bad, I previously hit
5GB within an hour with low traffic, this VM with 256M RAM panics after
5 minutes in managed mode. (Remote denial of service, heh.)

Originally I had the Cc: stable line added, but the SubmittingPatches
document seems to discourage that for networking. Added it again.

Here is the updated patch, hopefully addressing your concerns. Feel free
to modify it as you find appropriate.

Peter
--
>From a2c5fec1789bef48671d643ea7ecd0244d1e0246 Mon Sep 17 00:00:00 2001
From: Peter Wu 
Date: Sun, 6 Dec 2015 17:59:41 +0100
Subject: [PATCH] rtlwifi: fix memory leak for USB device

Free skb for received frames with a wrong checksum. This can happen
pretty rapidly, exhausting all memory.

This fixes a memleak (detected with kmemleak). Originally found while
using monitor mode, but it also appears during managed mode (once the
link is up).

Cc: sta...@vger.kernel.org
Signed-off-by: Peter Wu 
---
 drivers/net/wireless/realtek/rtlwifi/usb.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/net/wireless/realtek/rtlwifi/usb.c 
b/drivers/net/wireless/realtek/rtlwifi/usb.c
index 2721cf8..aac1ed3 100644
--- a/drivers/net/wireless/realtek/rtlwifi/usb.c
+++ b/drivers/net/wireless/realtek/rtlwifi/usb.c
@@ -531,6 +531,8 @@ static void _rtl_usb_rx_process_noagg(struct ieee80211_hw 
*hw,
ieee80211_rx(hw, skb);
else
dev_kfree_skb_any(skb);
+   } else {
+   dev_kfree_skb_any(skb);
}
 }
 
-- 
2.6.3

--
To unsubscribe from this list: send the line "unsubscribe linux-wireless" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html