upstream/opnsense-src
1
0
Fork 0
mirror of https://github.com/opnsense/src.git synced 2026-06-09 08:43:19 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

busdma: Protect ARM busdma bounce page counters using the bounce page lock.

Browse source 
In bus_dmamap_unload() on ARM, the counters for free_bpages and reserved_bpages
appear to be vulnerable to unprotected read-modify-write operations that result
in accounting that looks like a page leak.

This was noticed on a 2GB quad core i.MX6 system that has more than one device
attached via FTDI based USB serial connection.

Submitted by:	John Hein <jcfyecrayz@liamekaens.com>
Differential Revision:	https://reviews.freebsd.org/D35553
PR:		264836
MFC after:	3 days
Sponsored by:	NVIDIA Networking
This commit is contained in:
Hans Petter Selasky 2022-06-23 11:31:17 +02:00
parent 61c74fb66f
commit 6c4b6f55f7
1 changed files with 7 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

11
sys/arm/arm/busdma_machdep.c
View file

@ -1183,10 +1183,13 @@ bus_dmamap_unload(bus_dma_tag_t dmat, bus_dmamap_t map)
if ((bz = dmat->bounce_zone) != NULL) {
free_bounce_pages(dmat, map);
bz = dmat->bounce_zone;
bz->free_bpages += map->pagesreserved;
bz->reserved_bpages -= map->pagesreserved;
map->pagesreserved = 0;
if (map->pagesreserved != 0) {
mtx_lock(&bounce_lock);
bz->free_bpages += map->pagesreserved;
bz->reserved_bpages -= map->pagesreserved;
mtx_unlock(&bounce_lock);
map->pagesreserved = 0;
}
map->pagesneeded = 0;
}
map->sync_count = 0;