d/freebsd-nq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Correct a very old error in both vm_object_madvise() (originating in

Browse Source 
vm/vm_object.c revision 1.88) and vm_object_sync() (originating in
vm/vm_map.c revision 1.36): When descending a chain of backing objects,
both use the wrong object's backing offset.  Consequently, both may
operate on the wrong pages.

Quoting Matt, "This could be responsible for all of the sporatic madvise
oddness that has been reported over the years."

Reviewed by:	Matt Dillon
This commit is contained in:
Alan Cox 2004-07-28 18:23:08 +00:00
parent 77ef8a97cd
commit 56e0670fdc
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
sys/vm/vm_object.c
View File

@ -985,9 +985,9 @@ vm_object_sync(vm_object_t object, vm_ooffset_t offset, vm_size_t size,
VM_OBJECT_LOCK(object);
while ((backing_object = object->backing_object) != NULL) {
VM_OBJECT_LOCK(backing_object);
offset += object->backing_object_offset;
VM_OBJECT_UNLOCK(object);
object = backing_object;
offset += object->backing_object_offset;
if (object->size < OFF_TO_IDX(offset + size))
size = IDX_TO_OFF(object->size) - offset;
}
@ -1096,9 +1096,9 @@ vm_object_madvise(vm_object_t object, vm_pindex_t pindex, int count, int advise)
if (backing_object == NULL)
goto unlock_tobject;
VM_OBJECT_LOCK(backing_object);
tpindex += OFF_TO_IDX(tobject->backing_object_offset);
VM_OBJECT_UNLOCK(tobject);
tobject = backing_object;
tpindex += OFF_TO_IDX(tobject->backing_object_offset);
goto shadowlookup;
}
/*