busdma: Protect ARM busdma bounce page counters using the bounce page lock.

In bus_dmamap_unload() on ARM, the counters for free_bpages and reserved_bpages
appear to be vulnerable to unprotected read-modify-write operations that result
in accounting that looks like a page leak.

This was noticed on a 2GB quad core i.MX6 system that has more than one device
attached via FTDI based USB serial connection.

Submitted by:	John Hein <jcfyecrayz@liamekaens.com>
Differential Revision:	https://reviews.freebsd.org/D35553
PR:		264836
MFC after:	3 days
Sponsored by:	NVIDIA Networking

This commit is contained in:

Hans Petter Selasky

2022-06-23 11:31:17 +02:00

parent 61c74fb66f

commit 6c4b6f55f7

1 changed files with 7 additions and 4 deletions

									
										sys/arm/arm/busdma_machdep.c
									
		+7
		-4
	
												View File
												
				@@ -1183,10 +1183,13 @@ bus_dmamap_unload(bus_dma_tag_t dmat, bus_dmamap_t map)

					if ((bz = dmat->bounce_zone) != NULL) {

						free_bounce_pages(dmat, map);

						bz = dmat->bounce_zone;

						bz->free_bpages += map->pagesreserved;

						bz->reserved_bpages -= map->pagesreserved;

						map->pagesreserved = 0;

						if (map->pagesreserved != 0) {

							mtx_lock(&bounce_lock);

							bz->free_bpages += map->pagesreserved;

							bz->reserved_bpages -= map->pagesreserved;

							mtx_unlock(&bounce_lock);

							map->pagesreserved = 0;

						}

						map->pagesneeded = 0;

					}

					map->sync_count = 0;