d/freebsd-dev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

busdma: Protect ARM busdma bounce page counters using the bounce page lock.

Browse Source 
In bus_dmamap_unload() on ARM, the counters for free_bpages and reserved_bpages
appear to be vulnerable to unprotected read-modify-write operations that result
in accounting that looks like a page leak.

This was noticed on a 2GB quad core i.MX6 system that has more than one device
attached via FTDI based USB serial connection.

Submitted by:	John Hein <jcfyecrayz@liamekaens.com>
Differential Revision:	https://reviews.freebsd.org/D35553
PR:		264836
MFC after:	3 days
Sponsored by:	NVIDIA Networking
This commit is contained in:
Hans Petter Selasky 2022-06-23 11:31:17 +02:00
parent 61c74fb66f
commit 6c4b6f55f7
1 changed files with 7 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
sys/arm/arm/busdma_machdep.c
View File

@ -1183,10 +1183,13 @@ bus_dmamap_unload(bus_dma_tag_t dmat, bus_dmamap_t map)
if ((bz = dmat->bounce_zone) != NULL) {
free_bounce_pages(dmat, map);
bz = dmat->bounce_zone;
bz->free_bpages += map->pagesreserved;
bz->reserved_bpages -= map->pagesreserved;
map->pagesreserved = 0;
if (map->pagesreserved != 0) {
mtx_lock(&bounce_lock);
bz->free_bpages += map->pagesreserved;
bz->reserved_bpages -= map->pagesreserved;
mtx_unlock(&bounce_lock);
map->pagesreserved = 0;
}
map->pagesneeded = 0;
}
map->sync_count = 0;