Date: Tue, 28 Jun 2022 06:20:53 GMT From: Hans Petter Selasky <hselasky@FreeBSD.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org Subject: git: 78088c5714e0 - stable/13 - busdma: Protect ARM busdma bounce page counters using the bounce page lock. Message-ID: <202206280620.25S6KrFp002408@gitrepo.freebsd.org>
next in thread | raw e-mail | index | archive | help
The branch stable/13 has been updated by hselasky: URL: https://cgit.FreeBSD.org/src/commit/?id=78088c5714e065058e8b18595d31a2c115cc00d6 commit 78088c5714e065058e8b18595d31a2c115cc00d6 Author: Hans Petter Selasky <hselasky@FreeBSD.org> AuthorDate: 2022-06-23 09:31:17 +0000 Commit: Hans Petter Selasky <hselasky@FreeBSD.org> CommitDate: 2022-06-28 06:20:34 +0000 busdma: Protect ARM busdma bounce page counters using the bounce page lock. In bus_dmamap_unload() on ARM, the counters for free_bpages and reserved_bpages appear to be vulnerable to unprotected read-modify-write operations that result in accounting that looks like a page leak. This was noticed on a 2GB quad core i.MX6 system that has more than one device attached via FTDI based USB serial connection. Submitted by: John Hein <jcfyecrayz@liamekaens.com> Differential Revision: https://reviews.freebsd.org/D35553 PR: 264836 Sponsored by: NVIDIA Networking (cherry picked from commit 6c4b6f55f77d8d7cee1b277bd6579a77d6890ef9) --- sys/arm/arm/busdma_machdep.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/sys/arm/arm/busdma_machdep.c b/sys/arm/arm/busdma_machdep.c index 11c306526e0d..6137e4261b26 100644 --- a/sys/arm/arm/busdma_machdep.c +++ b/sys/arm/arm/busdma_machdep.c @@ -1292,10 +1292,13 @@ bus_dmamap_unload(bus_dma_tag_t dmat, bus_dmamap_t map) free_bounce_page(dmat, bpage); } - bz = dmat->bounce_zone; - bz->free_bpages += map->pagesreserved; - bz->reserved_bpages -= map->pagesreserved; - map->pagesreserved = 0; + if (map->pagesreserved != 0) { + mtx_lock(&bounce_lock); + bz->free_bpages += map->pagesreserved; + bz->reserved_bpages -= map->pagesreserved; + mtx_unlock(&bounce_lock); + map->pagesreserved = 0; + } map->pagesneeded = 0; } map->sync_count = 0;
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?202206280620.25S6KrFp002408>