e1cb9d3747
We are otherwise susceptible to a race with a concurrent vm_map_wire(), which may drop the map lock to fault pages into the object chain. In particular, vm_map_protect() will only copy newly writable wired pages into the top-level object when MAP_ENTRY_USER_WIRED is set, but vm_map_wire() only sets this flag after its fault loop. We may thus end up with a writable wired entry whose top-level object does not contain the entire range of pages. Reported and tested by: pho Reviewed by: kib MFC after: 1 week Sponsored by: Dell EMC Isilon Differential Revision: https://reviews.freebsd.org/D10349