freebsd-dev/sys/vm
Konstantin Belousov 19f5d9f27f Fix another race between vm_map_protect() and vm_map_wire().
vm_map_wire() increments entry->wire_count, after that it drops the
map lock both for faulting in the entry' pages, and for marking next
entry in the requested region as IN_TRANSITION. Only after all entries
are faulted in, MAP_ENTRY_USER_WIRE flag is set.

This makes it possible for vm_map_protect() to run while other entry'
MAP_ENTRY_IN_TRANSITION flag is handled, and vm_map_busy() lock does
not prevent it. In particular, if the call to vm_map_protect() adds
VM_PROT_WRITE to CoW entry, it would fail to call
vm_fault_copy_entry(). There are at least two consequences of the
race: the top object in the shadow chain is not populated with
writeable pages, and second, the entry eventually get contradictory
flags MAP_ENTRY_NEEDS_COPY | MAP_ENTRY_USER_WIRED with VM_PROT_WRITE
set.

Handle it by waiting for all MAP_ENTRY_IN_TRANSITION flags to go away
in vm_map_protect(), which does not drop map lock afterwards. Note
that vm_map_busy_wait() is left as is.

Reported and tested by:	pho (previous version)
Reviewed by:	Doug Moore <dougm@rice.edu>, markj
Sponsored by:	The FreeBSD Foundation
MFC after:	1 week
Differential revision:	https://reviews.freebsd.org/D20091
2019-05-01 13:15:06 +00:00
..
_vm_radix.h sys: general adoption of SPDX licensing ID tags. 2017-11-27 15:23:17 +00:00
default_pager.c SPDX: wrong license. 2017-11-30 15:45:42 +00:00
device_pager.c Change the vm_ooffset_t type to unsigned. 2018-12-02 13:16:46 +00:00
memguard.c Eliminate kmem_arena and kmem_object in preparation for further NUMA commits. 2017-11-28 23:40:54 +00:00
memguard.h sys: general adoption of SPDX licensing ID tags. 2017-11-27 15:23:17 +00:00
phys_pager.c sys: general adoption of SPDX licensing ID tags. 2017-11-27 15:23:17 +00:00
pmap.h Add pmap_is_valid_memattr(9). 2018-08-01 18:45:51 +00:00
redzone.c sys: general adoption of SPDX licensing ID tags. 2017-11-27 15:23:17 +00:00
redzone.h sys: general adoption of SPDX licensing ID tags. 2017-11-27 15:23:17 +00:00
sg_pager.c Change the vm_ooffset_t type to unsigned. 2018-12-02 13:16:46 +00:00
swap_pager.c Improve error reporting when the swap pager runs out of memory. 2019-03-26 19:11:15 +00:00
swap_pager.h sys: further adoption of SPDX licensing ID tags. 2017-11-20 19:43:44 +00:00
uma_core.c for a cache-only zone the destructor tries to destroy a non-existent keg 2019-04-12 12:46:25 +00:00
uma_dbg.c Fix compilation failures on different arches that have vm_machdep.c not 2019-01-15 19:33:47 +00:00
uma_dbg.h sys: general adoption of SPDX licensing ID tags. 2017-11-27 15:23:17 +00:00
uma_int.h UMA: unsign some variables related to allocation in hash_alloc(). 2019-02-12 04:33:05 +00:00
uma.h o Move zone limit from keg level up to zone level. This means that now 2019-01-15 00:02:06 +00:00
vm_domainset.c Add a !NUMA definition for vm_domainset_iter_policy_ref_init(). 2018-10-24 17:09:20 +00:00
vm_domainset.h Refactor domainset iterators for use by malloc(9) and UMA. 2018-10-23 16:35:58 +00:00
vm_extern.h Add malloc_domainset(9) and _domainset variants to other allocator KPIs. 2018-10-30 18:26:34 +00:00
vm_fault.c Disallow preemptive creation of wired superpage mappings. 2019-03-21 19:52:50 +00:00
vm_glue.c Refactor domainset iterators for use by malloc(9) and UMA. 2018-10-23 16:35:58 +00:00
vm_init.c Do not reserve KVA for paging bufs in vm_ksubmap_init(), since now 2019-01-16 20:14:16 +00:00
vm_kern.c Eliminate adj_free field from vm_map_entry. 2019-03-29 16:53:46 +00:00
vm_kern.h Do not reserve KVA for paging bufs in vm_ksubmap_init(), since now 2019-01-16 20:14:16 +00:00
vm_map.c Fix another race between vm_map_protect() and vm_map_wire(). 2019-05-01 13:15:06 +00:00
vm_map.h Eliminate adj_free field from vm_map_entry. 2019-03-29 16:53:46 +00:00
vm_meter.c Add a per-pagequeue pdpages counter. 2018-08-23 21:03:45 +00:00
vm_mmap.c i386: honor kern.elf32.read_exec for ommap(2) and break(2), as already 2019-02-09 03:56:48 +00:00
vm_object.c Include path for tmpfs objects in vm.objects sysctl 2018-11-30 04:59:43 +00:00
vm_object.h Change the vm_ooffset_t type to unsigned. 2018-12-02 13:16:46 +00:00
vm_page.c Implement minidump support for RISC-V. 2019-03-06 00:01:06 +00:00
vm_page.h Allow vm_page_free_prep() to dequeue pages without the page lock. 2019-02-03 18:43:20 +00:00
vm_pageout.c Clear pointers to indicate that the respective locks are released. 2019-02-21 15:44:32 +00:00
vm_pageout.h linuxkpi: Use pageproc instead of vmproc 2018-11-21 04:34:18 +00:00
vm_pagequeue.h Allow empty NUMA memory domains to support Threadripper2 2018-10-01 14:14:21 +00:00
vm_pager.c Do not reserve KVA for paging bufs in vm_ksubmap_init(), since now 2019-01-16 20:14:16 +00:00
vm_pager.h sys: further adoption of SPDX licensing ID tags. 2017-11-20 19:43:44 +00:00
vm_param.h SPDX: Consider code from Carnegie-Mellon University. 2017-11-30 15:48:35 +00:00
vm_phys.c vm: remove seq.h inclusion made obsolete by NUMA rewrite 2019-02-27 22:42:29 +00:00
vm_phys.h MI VM: Make it possible to set size of superpage at boot instead of compile time. 2019-01-18 13:35:06 +00:00
vm_radix.c vm: stop passing M_ZERO when allocating radix nodes 2018-06-24 13:08:05 +00:00
vm_radix.h sys: general adoption of SPDX licensing ID tags. 2017-11-27 15:23:17 +00:00
vm_reserv.c MI VM: Make it possible to set size of superpage at boot instead of compile time. 2019-01-18 13:35:06 +00:00
vm_reserv.h Lock reservations with a dedicated lock in each reservation. Protect the 2018-03-22 19:21:11 +00:00
vm_swapout_dummy.c SPDX: Consider code from Carnegie-Mellon University. 2017-11-30 15:48:35 +00:00
vm_swapout.c linuxkpi: Use pageproc instead of vmproc 2018-11-21 04:34:18 +00:00
vm_unix.c i386: honor kern.elf32.read_exec for ommap(2) and break(2), as already 2019-02-09 03:56:48 +00:00
vm.h Move vm_ndomains to vm.h where it can be used with a single header include 2018-03-27 03:27:02 +00:00
vnode_pager.c Fix incorrect assertion in vnode_pager_generic_getpages() 2019-02-26 04:50:46 +00:00
vnode_pager.h sys: further adoption of SPDX licensing ID tags. 2017-11-20 19:43:44 +00:00