Date: Tue, 28 Jun 2022 06:19:31 GMT From: Hans Petter Selasky <hselasky@FreeBSD.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org Subject: git: a0ffae30c593 - stable/12 - busdma: Protect ARM busdma bounce page counters using the bounce page lock. Message-ID: <202206280619.25S6JVx4093750@gitrepo.freebsd.org>
next in thread | raw e-mail | index | archive | help
The branch stable/12 has been updated by hselasky: URL: https://cgit.FreeBSD.org/src/commit/?id=a0ffae30c593d829bc9cdd7b32017352e501d247 commit a0ffae30c593d829bc9cdd7b32017352e501d247 Author: Hans Petter Selasky <hselasky@FreeBSD.org> AuthorDate: 2022-06-23 09:31:17 +0000 Commit: Hans Petter Selasky <hselasky@FreeBSD.org> CommitDate: 2022-06-28 06:17:20 +0000 busdma: Protect ARM busdma bounce page counters using the bounce page lock. In bus_dmamap_unload() on ARM, the counters for free_bpages and reserved_bpages appear to be vulnerable to unprotected read-modify-write operations that result in accounting that looks like a page leak. This was noticed on a 2GB quad core i.MX6 system that has more than one device attached via FTDI based USB serial connection. Submitted by: John Hein <jcfyecrayz@liamekaens.com> Differential Revision: https://reviews.freebsd.org/D35553 PR: 264836 Sponsored by: NVIDIA Networking (cherry picked from commit 6c4b6f55f77d8d7cee1b277bd6579a77d6890ef9) --- sys/arm/arm/busdma_machdep-v6.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/sys/arm/arm/busdma_machdep-v6.c b/sys/arm/arm/busdma_machdep-v6.c index 29547672651d..f8fc9e670d2b 100644 --- a/sys/arm/arm/busdma_machdep-v6.c +++ b/sys/arm/arm/busdma_machdep-v6.c @@ -1274,10 +1274,13 @@ bus_dmamap_unload(bus_dma_tag_t dmat, bus_dmamap_t map) free_bounce_page(dmat, bpage); } - bz = dmat->bounce_zone; - bz->free_bpages += map->pagesreserved; - bz->reserved_bpages -= map->pagesreserved; - map->pagesreserved = 0; + if (map->pagesreserved != 0) { + mtx_lock(&bounce_lock); + bz->free_bpages += map->pagesreserved; + bz->reserved_bpages -= map->pagesreserved; + mtx_unlock(&bounce_lock); + map->pagesreserved = 0; + } map->pagesneeded = 0; } map->sync_count = 0;
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?202206280619.25S6JVx4093750>