d/freebsd-skq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Handle trashed queue pointers in vm_page_acquire_unlocked().

Browse Source 
vm_page_acquire_unlocked() relies on type-stability of vm_page
structures and assumes that the listq linkage pointers always point to a
vm_page or are NULL.  QUEUE_MACRO_DEBUG_TRASH breaks that assumption, so
add an explicit check for a trashed queue pointer before dereferencing.

Reported and tested by:	pho
Reviewed by:	kib
Sponsored by:	The FreeBSD Foundation
Differential Revision:	https://reviews.freebsd.org/D24472
This commit is contained in:
markj 2020-04-20 14:45:17 +00:00
parent 3fd1ed6f36
commit e367fe2912
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
sys/vm/vm_page.c
View File

@ -4438,7 +4438,7 @@ vm_page_acquire_unlocked(vm_object_t object, vm_pindex_t pindex,
* without barriers. Switch to radix to verify. * without barriers. Switch to radix to verify.
*/ */
if (prev == NULL || (m = TAILQ_NEXT(prev, listq)) == NULL || if (prev == NULL || (m = TAILQ_NEXT(prev, listq)) == NULL ||
m->pindex != pindex || QMD_IS_TRASHED(m) || m->pindex != pindex ||
atomic_load_ptr(&m->object) != object) { atomic_load_ptr(&m->object) != object) {
prev = NULL; prev = NULL;
/* /*