From 1a535523cd7d4a25cbdb68b60e29942c9f7afef3 Mon Sep 17 00:00:00 2001
From: alc <alc@FreeBSD.org>
Date: Fri, 23 Aug 2013 17:27:12 +0000
Subject: [PATCH] Addendum to r254141: The call to vm_radix_insert() in
 vm_page_cache() can reclaim the last preexisting cached page in the object,
 resulting in a call to vdrop().  Detect this scenario so that the vnode's
 hold count is correctly maintained.  Otherwise, we panic.

Reported by:	scottl
Tested by:	pho
Discussed with:	attilio, jeff, kib
---
 sys/vm/vm_page.c  |  9 +++++++++
 sys/vm/vm_radix.c | 15 +++++++++++++++
 sys/vm/vm_radix.h |  1 +
 3 files changed, 25 insertions(+)

diff --git a/sys/vm/vm_page.c b/sys/vm/vm_page.c
index 12417750e3dd..21772899eea6 100644
--- a/sys/vm/vm_page.c
+++ b/sys/vm/vm_page.c
@@ -2558,6 +2558,15 @@ vm_page_cache(vm_page_t m)
 		vm_page_free(m);
 		return;
 	}
+
+	/*
+	 * The above call to vm_radix_insert() could reclaim the one pre-
+	 * existing cached page from this object, resulting in a call to
+	 * vdrop().
+	 */
+	if (!cache_was_empty)
+		cache_was_empty = vm_radix_is_singleton(&object->cache);
+
 	m->flags |= PG_CACHED;
 	cnt.v_cache_count++;
 	PCPU_INC(cnt.v_tcached);
diff --git a/sys/vm/vm_radix.c b/sys/vm/vm_radix.c
index 8698738c8503..ff311b2d5b55 100644
--- a/sys/vm/vm_radix.c
+++ b/sys/vm/vm_radix.c
@@ -431,6 +431,21 @@ vm_radix_insert(struct vm_radix *rtree, vm_page_t page)
 	return (0);
 }
 
+/*
+ * Returns TRUE if the specified radix tree contains a single leaf and FALSE
+ * otherwise.
+ */
+boolean_t
+vm_radix_is_singleton(struct vm_radix *rtree)
+{
+	struct vm_radix_node *rnode;
+
+	rnode = vm_radix_getroot(rtree);
+	if (rnode == NULL)
+		return (FALSE);
+	return (vm_radix_isleaf(rnode));
+}
+
 /*
  * Returns the value stored at the index.  If the index is not present,
  * NULL is returned.
diff --git a/sys/vm/vm_radix.h b/sys/vm/vm_radix.h
index 73c9cc113a5d..4491860027b8 100644
--- a/sys/vm/vm_radix.h
+++ b/sys/vm/vm_radix.h
@@ -37,6 +37,7 @@
 
 void		vm_radix_init(void);
 int		vm_radix_insert(struct vm_radix *rtree, vm_page_t page);
+boolean_t	vm_radix_is_singleton(struct vm_radix *rtree);
 vm_page_t	vm_radix_lookup(struct vm_radix *rtree, vm_pindex_t index);
 vm_page_t	vm_radix_lookup_ge(struct vm_radix *rtree, vm_pindex_t index);
 vm_page_t	vm_radix_lookup_le(struct vm_radix *rtree, vm_pindex_t index);