mirror of
https://github.com/opnsense/src.git
synced 2026-05-19 16:35:42 -04:00
b5e8f167b9
vm_object_terminate() on a device-backed object at the same time that another processor, call it Pa, is performing dev_pager_alloc() on the same device. The problem is that vm_pager_object_lookup() should not be allowed to return a doomed object, i.e., an object with OBJ_DEAD set, but it does. In detail, the unfortunate sequence of events is: Pt in vm_object_terminate() holds the doomed object's lock and sets OBJ_DEAD on the object. Pa in dev_pager_alloc() holds dev_pager_sx and calls vm_pager_object_lookup(), which returns the doomed object. Next, Pa calls vm_object_reference(), which requires the doomed object's lock, so Pa waits for Pt to release the doomed object's lock. Pt proceeds to the point in vm_object_terminate() where it releases the doomed object's lock. Pa is now able to complete vm_object_reference() because it can now complete the acquisition of the doomed object's lock. So, now the doomed object has a reference count of one! Pa releases dev_pager_sx and returns the doomed object from dev_pager_alloc(). Pt now acquires dev_pager_mtx, removes the doomed object from dev_pager_object_list, releases dev_pager_mtx, and finally calls uma_zfree with the doomed object. However, the doomed object is still in use by Pa. Repeating my key point, vm_pager_object_lookup() must not return a doomed object. Moreover, the test for the object's state, i.e., doomed or not, and the increment of the object's reference count should be carried out atomically. Reviewed by: kib Approved by: re (kensmith) MFC after: 3 weeks |
||
|---|---|---|
| .. | ||
| default_pager.c | ||
| device_pager.c | ||
| memguard.c | ||
| memguard.h | ||
| phys_pager.c | ||
| pmap.h | ||
| redzone.c | ||
| redzone.h | ||
| swap_pager.c | ||
| swap_pager.h | ||
| uma.h | ||
| uma_core.c | ||
| uma_dbg.c | ||
| uma_dbg.h | ||
| uma_int.h | ||
| vm.h | ||
| vm_contig.c | ||
| vm_extern.h | ||
| vm_fault.c | ||
| vm_glue.c | ||
| vm_init.c | ||
| vm_kern.c | ||
| vm_kern.h | ||
| vm_map.c | ||
| vm_map.h | ||
| vm_meter.c | ||
| vm_mmap.c | ||
| vm_object.c | ||
| vm_object.h | ||
| vm_page.c | ||
| vm_page.h | ||
| vm_pageout.c | ||
| vm_pageout.h | ||
| vm_pageq.c | ||
| vm_pager.c | ||
| vm_pager.h | ||
| vm_param.h | ||
| vm_phys.c | ||
| vm_phys.h | ||
| vm_unix.c | ||
| vm_zeroidle.c | ||
| vnode_pager.c | ||
| vnode_pager.h | ||