Summary: | arm/arm/busdma_machdep-v6.c: bounce page accounting leak (noticed with high traffic ftdi usb serial devices) | ||||||||
---|---|---|---|---|---|---|---|---|---|
Product: | Base System | Reporter: | John Hein <jcfyecrayz> | ||||||
Component: | arm | Assignee: | freebsd-arm (Nobody) <freebsd-arm> | ||||||
Status: | Closed FIXED | ||||||||
Severity: | Affects Some People | CC: | freebsd-arm, hselasky, jcfyecrayz | ||||||
Priority: | --- | ||||||||
Version: | 13.1-STABLE | ||||||||
Hardware: | Any | ||||||||
OS: | Any | ||||||||
URL: | https://reviews.freebsd.org/D35553 | ||||||||
Attachments: |
|
Description
John Hein
2022-06-22 21:53:03 UTC
Created attachment 234876 [details]
[patch] protect bounce page counters with global bounce page mutex
This patch protects the otherwise unprotected bpage counters in bus_dmamap_unload() with the global bounce_lock mutex.
Can you check the value of "map->pagesreserved". Was it always zero? Created attachment 234881 [details]
Can you test this patch instead?
(In reply to Hans Petter Selasky from comment #2) Yes, map->pagesreserved was always zero in our testing. Tested with: dtrace -n 'fbt::_bus_dmamap_unload:entry { @ = quantize(((struct bus_dmamap*)arg1)->pagesreserved); }' (In reply to Hans Petter Selasky from comment #3) Yes, we'll run test some units with your optimization to skip taking the mutex if map->pagesreserved is 0. A commit in branch main references this bug: URL: https://cgit.FreeBSD.org/src/commit/?id=6c4b6f55f77d8d7cee1b277bd6579a77d6890ef9 commit 6c4b6f55f77d8d7cee1b277bd6579a77d6890ef9 Author: Hans Petter Selasky <hselasky@FreeBSD.org> AuthorDate: 2022-06-23 09:31:17 +0000 Commit: Hans Petter Selasky <hselasky@FreeBSD.org> CommitDate: 2022-06-25 10:01:59 +0000 busdma: Protect ARM busdma bounce page counters using the bounce page lock. In bus_dmamap_unload() on ARM, the counters for free_bpages and reserved_bpages appear to be vulnerable to unprotected read-modify-write operations that result in accounting that looks like a page leak. This was noticed on a 2GB quad core i.MX6 system that has more than one device attached via FTDI based USB serial connection. Submitted by: John Hein <jcfyecrayz@liamekaens.com> Differential Revision: https://reviews.freebsd.org/D35553 PR: 264836 MFC after: 3 days Sponsored by: NVIDIA Networking sys/arm/arm/busdma_machdep.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) A commit in branch stable/12 references this bug: URL: https://cgit.FreeBSD.org/src/commit/?id=a0ffae30c593d829bc9cdd7b32017352e501d247 commit a0ffae30c593d829bc9cdd7b32017352e501d247 Author: Hans Petter Selasky <hselasky@FreeBSD.org> AuthorDate: 2022-06-23 09:31:17 +0000 Commit: Hans Petter Selasky <hselasky@FreeBSD.org> CommitDate: 2022-06-28 06:17:20 +0000 busdma: Protect ARM busdma bounce page counters using the bounce page lock. In bus_dmamap_unload() on ARM, the counters for free_bpages and reserved_bpages appear to be vulnerable to unprotected read-modify-write operations that result in accounting that looks like a page leak. This was noticed on a 2GB quad core i.MX6 system that has more than one device attached via FTDI based USB serial connection. Submitted by: John Hein <jcfyecrayz@liamekaens.com> Differential Revision: https://reviews.freebsd.org/D35553 PR: 264836 Sponsored by: NVIDIA Networking (cherry picked from commit 6c4b6f55f77d8d7cee1b277bd6579a77d6890ef9) sys/arm/arm/busdma_machdep-v6.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) A commit in branch stable/13 references this bug: URL: https://cgit.FreeBSD.org/src/commit/?id=78088c5714e065058e8b18595d31a2c115cc00d6 commit 78088c5714e065058e8b18595d31a2c115cc00d6 Author: Hans Petter Selasky <hselasky@FreeBSD.org> AuthorDate: 2022-06-23 09:31:17 +0000 Commit: Hans Petter Selasky <hselasky@FreeBSD.org> CommitDate: 2022-06-28 06:20:34 +0000 busdma: Protect ARM busdma bounce page counters using the bounce page lock. In bus_dmamap_unload() on ARM, the counters for free_bpages and reserved_bpages appear to be vulnerable to unprotected read-modify-write operations that result in accounting that looks like a page leak. This was noticed on a 2GB quad core i.MX6 system that has more than one device attached via FTDI based USB serial connection. Submitted by: John Hein <jcfyecrayz@liamekaens.com> Differential Revision: https://reviews.freebsd.org/D35553 PR: 264836 Sponsored by: NVIDIA Networking (cherry picked from commit 6c4b6f55f77d8d7cee1b277bd6579a77d6890ef9) sys/arm/arm/busdma_machdep.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) |