From nobody Wed Oct 06 15:38:32 2021 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id EB38F12B9443; Wed, 6 Oct 2021 15:38:32 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4HPds46J4Mz3r3M; Wed, 6 Oct 2021 15:38:32 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id B96FC22A90; Wed, 6 Oct 2021 15:38:32 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.16.1/8.16.1) with ESMTP id 196FcWNQ007057; Wed, 6 Oct 2021 15:38:32 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.16.1/8.16.1/Submit) id 196FcWns007056; Wed, 6 Oct 2021 15:38:32 GMT (envelope-from git) Date: Wed, 6 Oct 2021 15:38:32 GMT Message-Id: <202110061538.196FcWns007056@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Ian Lepore Subject: git: b1cca7436737 - stable/13 - Fix busdma resource leak on usb device detach. List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-dev-commits-src-branches@freebsd.org X-BeenThere: dev-commits-src-branches@freebsd.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: ian X-Git-Repository: src X-Git-Refname: refs/heads/stable/13 X-Git-Reftype: branch X-Git-Commit: b1cca74367374bbb9cdc881c671a9f9525dca313 Auto-Submitted: auto-generated X-ThisMailContainsUnwantedMimeParts: N The branch stable/13 has been updated by ian: URL: https://cgit.FreeBSD.org/src/commit/?id=b1cca74367374bbb9cdc881c671a9f9525dca313 commit b1cca74367374bbb9cdc881c671a9f9525dca313 Author: Ian Lepore AuthorDate: 2021-09-28 19:29:10 +0000 Commit: Ian Lepore CommitDate: 2021-10-06 15:36:02 +0000 Fix busdma resource leak on usb device detach. When a usb device is detached, usb_pc_dmamap_destroy() called bus_dmamap_destroy() while the map was still loaded. That's harmless on x86 architectures, but on all other platforms it causes bus_dmamap_destroy() to return EBUSY and leak away any memory resources (including bounce buffers) associated with the mapping, as well as any allocated map structure itself. This change introduces a new is_loaded flag to the usb_page_cache struct to track whether a map is loaded or not. If the map is loaded, bus_dmamap_unload() is called before bus_dmamap_destroy() to avoid leaking away resources. Differential Revision: https://reviews.freebsd.org/D32208 (cherry picked from commit dc91a9715f8fda4b3633388830a28a99f73cbe59) --- sys/dev/usb/usb_busdma.c | 16 +++++++++++++--- sys/dev/usb/usb_busdma.h | 1 + 2 files changed, 14 insertions(+), 3 deletions(-) diff --git a/sys/dev/usb/usb_busdma.c b/sys/dev/usb/usb_busdma.c index 4806903fa83a..62e22805b39c 100644 --- a/sys/dev/usb/usb_busdma.c +++ b/sys/dev/usb/usb_busdma.c @@ -600,6 +600,7 @@ usb_pc_alloc_mem(struct usb_page_cache *pc, struct usb_page *pg, bus_dmamem_free(utag->tag, ptr, map); goto error; } + pc->isloaded = 1; memset(ptr, 0, size); usb_pc_cpu_flush(pc); @@ -612,6 +613,7 @@ error: pc->page_start = NULL; pc->page_offset_buf = 0; pc->page_offset_end = 0; + pc->isloaded = 0; pc->map = NULL; pc->tag = NULL; return (1); @@ -626,11 +628,13 @@ void usb_pc_free_mem(struct usb_page_cache *pc) { if (pc && pc->buffer) { - bus_dmamap_unload(pc->tag, pc->map); + if (pc->isloaded) + bus_dmamap_unload(pc->tag, pc->map); bus_dmamem_free(pc->tag, pc->buffer, pc->map); pc->buffer = NULL; + pc->isloaded = 0; } } @@ -662,7 +666,8 @@ usb_pc_load_mem(struct usb_page_cache *pc, usb_size_t size, uint8_t sync) * We have to unload the previous loaded DMA * pages before trying to load a new one! */ - bus_dmamap_unload(pc->tag, pc->map); + if (pc->isloaded) + bus_dmamap_unload(pc->tag, pc->map); /* * Try to load memory into DMA. @@ -675,6 +680,7 @@ usb_pc_load_mem(struct usb_page_cache *pc, usb_size_t size, uint8_t sync) err = 0; } if (err || uptag->dma_error) { + pc->isloaded = 0; return (1); } } else { @@ -682,7 +688,8 @@ usb_pc_load_mem(struct usb_page_cache *pc, usb_size_t size, uint8_t sync) * We have to unload the previous loaded DMA * pages before trying to load a new one! */ - bus_dmamap_unload(pc->tag, pc->map); + if (pc->isloaded) + bus_dmamap_unload(pc->tag, pc->map); /* * Try to load memory into DMA. The callback @@ -693,6 +700,7 @@ usb_pc_load_mem(struct usb_page_cache *pc, usb_size_t size, uint8_t sync) &usb_pc_load_mem_cb, pc, BUS_DMA_WAITOK)) { } } + pc->isloaded = 1; } else { if (!sync) { /* @@ -785,6 +793,8 @@ void usb_pc_dmamap_destroy(struct usb_page_cache *pc) { if (pc && pc->tag) { + if (pc->isloaded) + bus_dmamap_unload(pc->tag, pc->map); bus_dmamap_destroy(pc->tag, pc->map); pc->tag = NULL; pc->map = NULL; diff --git a/sys/dev/usb/usb_busdma.h b/sys/dev/usb/usb_busdma.h index ca0631e2ce53..2f60b30963d2 100644 --- a/sys/dev/usb/usb_busdma.h +++ b/sys/dev/usb/usb_busdma.h @@ -101,6 +101,7 @@ struct usb_page_cache { * from the memory. Else write. */ uint8_t ismultiseg:1; /* set if we can have multiple * segments */ + uint8_t isloaded:1; /* Set if map is currently loaded. */ #endif };