Author: kib
Date: Wed May 8 16:07:01 2019
New Revision: 347352
URL: https://svnweb.freebsd.org/changeset/base/347352
Log:
MFC r346990:
Fix another race between vm_map_protect() and vm_map_wire().
Modified:
stable/11/sys/vm/vm_map.c
Directory Properties:
stable/11/ (props changed)
Modified: stable/11/sys/vm/vm_map.c
==============================================================================
--- stable/11/sys/vm/vm_map.c Wed May 8 16:06:54 2019 (r347351)
+++ stable/11/sys/vm/vm_map.c Wed May 8 16:07:01 2019 (r347352)
@@ -2003,7 +2003,7 @@ int
vm_map_protect(vm_map_t map, vm_offset_t start, vm_offset_t end,
vm_prot_t new_prot, boolean_t set_max)
{
- vm_map_entry_t current, entry;
+ vm_map_entry_t current, entry, in_tran;
vm_object_t obj;
struct ucred *cred;
vm_prot_t old_prot;
@@ -2011,6 +2011,8 @@ vm_map_protect(vm_map_t map, vm_offset_t start, vm_off
if (start == end)
return (KERN_SUCCESS);
+again:
+ in_tran = NULL;
vm_map_lock(map);
/*
@@ -2043,6 +2045,22 @@ vm_map_protect(vm_map_t map, vm_offset_t start, vm_off
vm_map_unlock(map);
return (KERN_PROTECTION_FAILURE);
}
+ if ((entry->eflags & MAP_ENTRY_IN_TRANSITION) != 0)
+ in_tran = entry;
+ }
+
+ /*
+ * Postpone the operation until all in transition map entries
+ * are stabilized. In-transition entry might already have its
+ * pages wired and wired_count incremented, but
+ * MAP_ENTRY_USER_WIRED flag not yet set, and visible to other
+ * threads because the map lock is dropped. In this case we
+ * would miss our call to vm_fault_copy_entry().
+ */
+ if (in_tran != NULL) {
+ in_tran->eflags |= MAP_ENTRY_NEEDS_WAKEUP;
+ vm_map_unlock_and_wait(map, 0);
+ goto again;
}
/*
_______________________________________________
[email protected] mailing list
https://lists.freebsd.org/mailman/listinfo/svn-src-all
To unsubscribe, send any mail to "[email protected]"
