system/freebsd-src
system/freebsd-src
1
0
Fork 0
mirror of https://github.com/freebsd/freebsd-src synced 2024-10-15 12:54:27 +00:00
Code Issues Packages Projects Releases Wiki Activity

Handle a race of collapse with a retrying fault.

Browse source 
Both vm_object_scan_all_shadowed() and vm_object_collapse_scan() might
observe an invalid page left in the default backing object by the
fault handler that retried.  Check for the condition and refuse to collapse.

Reported and tested by:	pho
Reviewed by:	jeff
Sponsored by:	The FreeBSD Foundation
Differential revision:	https://reviews.freebsd.org/D23331
This commit is contained in:
Konstantin Belousov 2020-01-24 19:42:53 +00:00
parent 2f0e17b7de
commit cd0047f3a9
Notes: svn2git 2020-12-20 02:59:44 +00:00 
svn path=/head/; revision=357091
1 changed files with 38 additions and 10 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

48
sys/vm/vm_object.c
View file

@ -1700,13 +1700,24 @@ vm_object_scan_all_shadowed(vm_object_t object)
if (new_pindex >= object->size)
break;
/*
* If the backing object page is busy a grandparent or older
* page may still be undergoing CoW. It is not safe to
* collapse the backing object until it is quiesced.
*/
if (p != NULL && vm_page_busied(p))
return (false);
if (p != NULL) {
/*
* If the backing object page is busy a
* grandparent or older page may still be
* undergoing CoW. It is not safe to collapse
* the backing object until it is quiesced.
*/
if (vm_page_tryxbusy(p) == 0)
return (false);
/*
* We raced with the fault handler that left
* newly allocated invalid page on the object
* queue and retried.
*/
if (!vm_page_all_valid(p))
goto unbusy_ret;
}
/*
* See if the parent has the page or if the parent's object
@ -1717,15 +1728,24 @@ vm_object_scan_all_shadowed(vm_object_t object)
* object and we might as well give up now.
*/
pp = vm_page_lookup(object, new_pindex);
/*
* The valid check here is stable due to object lock being
* required to clear valid and initiate paging.
* The valid check here is stable due to object lock
* being required to clear valid and initiate paging.
* Busy of p disallows fault handler to validate pp.
*/
if ((pp == NULL || vm_page_none_valid(pp)) &&
!vm_pager_has_page(object, new_pindex, NULL, NULL))
return (false);
goto unbusy_ret;
if (p != NULL)
vm_page_xunbusy(p);
}
return (true);
unbusy_ret:
if (p != NULL)
vm_page_xunbusy(p);
return (false);
}
static void
@ -1776,6 +1796,14 @@ vm_object_collapse_scan(vm_object_t object)
continue;
}
if (!vm_page_all_valid(p)) {
KASSERT(!pmap_page_is_mapped(p),
("freeing mapped page %p", p));
if (vm_page_remove(p))
vm_page_free(p);
continue;
}
pp = vm_page_lookup(object, new_pindex);
if (pp != NULL && vm_page_tryxbusy(pp) == 0) {
vm_page_xunbusy(p);