Page MenuHomeFreeBSD

Close races in vm object chain traversal for unlock
ClosedPublic

Authored by rlibby on Feb 25 2021, 6:32 PM.

Details

Summary

We were unlocking the vm object before reading the backing_object field.
In the meantime, the object could be freed and reused. This could cause
us to go off the rails in the object chain traversal, failing to unlock
the rest of the objects in the original chain and corrupting the lock
state of the victim chain.

MFC after: 3 days
Sponsored by: Dell EMC Isilon

Test Plan
procstat -av
mount -t procfs proc /proc
cat /proc/*/map

Diff Detail

Repository
R10 FreeBSD src repository
Lint
Automatic diff as part of commit; lint not applicable.
Unit
Automatic diff as part of commit; unit tests not applicable.

Event Timeline

This revision is now accepted and ready to land.Feb 25 2021, 6:37 PM

This can be done without introducing another object pointer (nobj) by resetting lobj and following the pattern elsewhere, but I found the approach with nobj to be more readable.

I looked for other occurrences of this but didn't find any.