Page MenuHomeFreeBSD

Fix racy checks of m->queue.
ClosedPublic

Authored by markj on May 3 2018, 3:00 PM.
Tags
None
Referenced Files
Unknown Object (File)
Tue, Sep 30, 11:42 PM
Unknown Object (File)
Sat, Sep 27, 4:51 PM
Unknown Object (File)
Sat, Sep 27, 3:57 AM
Unknown Object (File)
Fri, Sep 26, 10:14 PM
Unknown Object (File)
Fri, Sep 26, 5:25 AM
Unknown Object (File)
Fri, Sep 26, 4:33 AM
Unknown Object (File)
Fri, Sep 26, 3:09 AM
Unknown Object (File)
Fri, Sep 26, 1:42 AM
Subscribers

Details

Summary

r332974 was somewhat sloppy in that I did not properly audit callers of
vm_page_active() and so on. Code like the following is racy after that
revision:

vm_page_assert_locked(m);
if (m->queue == PQ_ACTIVE)
	vm_page_reference(m);
else
	vm_page_requeue(m);

in particular, PGA_DEQUEUE might be set on m, in which case m->queue
may change to PQ_NONE after the vm_page_active() call but before the
vm_page_requeue() call. (Note that once m->queue has transitioned to
PQ_NONE, the page lock prevents further updates to the queue field.)

Add a function, vm_page_queue(), which reads m->queue with the
appropriate synchronization. It requires the page lock. Use this
function where appropriate.

Test Plan

pho found the issue (manifested as an assertion failure in vm_page_requeue()) and verified the patch.

Diff Detail

Repository
rS FreeBSD src repository - subversion
Lint
Lint Not Applicable
Unit
Tests Not Applicable

Event Timeline

markj edited the test plan for this revision. (Show Details)
markj added reviewers: alc, kib, jeff.
This revision is now accepted and ready to land.May 4 2018, 2:50 PM
This revision was automatically updated to reflect the committed changes.