tobiaswaldvogel:

• Device TP Archer c7 v2
• Software OpenWrt SNAPSHOT r14651+16-23c7fb7600
• How to reproduce: Just wait a few hours (Usually just 6 hours)
• I tried both ath10k drivers (ath10k and ath10k-ct) with the same result

After compiling the current trunk for TP Archer c7 v2 there seems to be a memory leak in the kernel.
The memory usage is creeping up over a few hours until it triggers an OOM and a reboot.
There is no user space process consuming the memory and an analysis with kmemleak showed always the following entries:

unreferenced object 0x84639900 (size 176):
comm "hostapd", pid 1622, jiffies 5733 (age 112.956s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 85 5f f0 00 00 00 00 00 ........._......
00 00 00 00 00 00 00 00 40 22 00 1b 00 07 00 00 ........@"......
backtrace:
[] kmem_cache_alloc+0xf4/0x23c
[] __build_skb+0x34/0xd0
[<968af6d0>] __netdev_alloc_skb+0xf8/0x1ac
[<3bb1be69>] ieee80211_mgmt_tx+0x120/0x5a0 [mac80211]
[] nl80211_parse_chandef+0x1bb8/0x2be8 [cfg80211]


gdb resolved this to

ieee80211_mgmt_tx (backports-5.8-1/net/mac80211/offchannel.c:890).
885 ret = -EBUSY;
886 goto out_unlock;
887 }
888
889 skb = dev_alloc_skb(local->hw.extra_tx_headroom + params->len);
890 if (!skb) {
891 ret = -ENOMEM;
892 goto out_unlock;
893 }
894 skb_reserve(skb, local->hw.extra_tx_headroom);


nl80211_tx_mgmt (backports-5.8-1/net/wireless/nl80211.c:10990).
10985 }
10986 }
10987
10988 params.chan = chandef.chan;
10989 err = cfg80211_mlme_mgmt_tx(rdev, wdev, &params, &cookie);
10990 if (err)
10991 goto free_msg;
10992
10993 if (msg) {
10994 if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,


As far as I understood this belongs to the remain_on_channel functionality
But unfortunately I was unable to spot why the skb is not released