The vm_fault() should not be allowed to proceed on the map entry which
is being wired now. The entry wired count is changed to non-zero in advance, before the map lock is dropped. This makes the vm_fault() to perceive the entry as wired, and breaks the fragment which moves the wire count from the shadowed page, to the upper page, making the code unwiring non-wired page. On the other hand, the vm_fault() calls from vm_fault_wire() should be allowed to proceed, so only drain MAP_ENTRY_IN_TRANSITION from vm_fault() when wiring_thread is not current. Reported and tested by: pho Reviewed by: alc Sponsored by: The FreeBSD Foundation MFC after: 2 weeks
This commit is contained in:
parent
0acea7dfde
commit
4f9c9114a3
Notes:
svn2git
2020-12-20 02:59:44 +00:00
svn path=/head/; revision=253191
@ -280,6 +280,19 @@ RetryFault:;
|
||||
(u_long)vaddr);
|
||||
}
|
||||
|
||||
if (fs.entry->eflags & MAP_ENTRY_IN_TRANSITION &&
|
||||
fs.entry->wiring_thread != curthread) {
|
||||
vm_map_unlock_read(fs.map);
|
||||
vm_map_lock(fs.map);
|
||||
if (vm_map_lookup_entry(fs.map, vaddr, &fs.entry) &&
|
||||
(fs.entry->eflags & MAP_ENTRY_IN_TRANSITION)) {
|
||||
fs.entry->eflags |= MAP_ENTRY_NEEDS_WAKEUP;
|
||||
vm_map_unlock_and_wait(fs.map, 0);
|
||||
} else
|
||||
vm_map_unlock(fs.map);
|
||||
goto RetryFault;
|
||||
}
|
||||
|
||||
/*
|
||||
* Make a reference to this object to prevent its disposal while we
|
||||
* are messing with it. Once we have the reference, the map is free
|
||||
|
Loading…
Reference in New Issue
Block a user