Re: panic: malloc: out of space in kmem_map [mbuf memory leak?]

[Stefan Sperling]

On Sat, Jul 04, 2020 at 04:34:23PM +0200, bw-open...@gmx.de wrote:
>       I can easily reproduce this panic by doing enough on the network: 
> Cloning a big git repository (which is
>       what I did for the panic text above) or doing a 'sysupgrade -s' often 
> is enough to reach the limits.
> 
>       I also noticed that even when seemingly idle, the mbufpl 'INUSE' column 
> of systat keeps increasing. It also
>       increases a lot faster when I am actively using the network.
> 
>       As the internal wireless of my netbook is not supported, I am using a 
> small Edimax usb dongle supported by
>       urtwn. When I remove it, the mbuf count stops increasing.
> 

It looks like an accidental mbuf leak was introduced when support for
CCMP crypto offload was added to urtwn(4) on June 11.

Please try this patch (caveat: I have not yet tested this myself).

diff f85d383eef26dc79893169f96ad913a77e4d2af8 /usr/src
blob - c2d12f00339dba6587b9d481934c416ef4001500
file + sys/dev/usb/if_urtwn.c
--- sys/dev/usb/if_urtwn.c
+++ sys/dev/usb/if_urtwn.c
@@ -1695,10 +1695,11 @@ urtwn_tx(void *cookie, struct mbuf *m, struct ieee8021
                txdp[6] = k->k_tsc >> 32;
                txdp[7] = k->k_tsc >> 40;
                txdp += IEEE80211_CCMP_HDRLEN;
 
                m_copydata(m, headerlen, m->m_pkthdr.len - headerlen, txdp);
+               m_freem(m);
        } else {
                xferlen = (txdp - data->buf) + m->m_pkthdr.len;
                m_copydata(m, 0, m->m_pkthdr.len, txdp);
                m_freem(m);
        }