device_pager: Avoid double-insertion of pages into the pager list

[markj]

Summary

Unmanaged device pager objects maintain a linked list of pages that were
returned from the fault handler. Initially, such pages are valid, but
msync(MS_INVALIDATE) can mark them invalid (and clean). They are not
removed from page tables (since they are unmanaged), but a subsequent
mlock() call can trigger a page fault that is handled by the pager.
dev_pager_getpages() then re-inserts the page into the linked list even
though it's already present there.

This patch fixes the problem by removing the linked list. OBJ_PG_DTOR
is set, so vm_object_terminate_pages() does nothing, and
dev_pager_dealloc() instead handles cleanup of the object.

Add a regression test case which triggers a queue.h assertion failure in
unpatched kernels.

Note, in stable branches we should avoid changing the layout of struct
vm_object.

Reported by: slidybat

[kib]

So the patch shrinks struct vm_object by single pointer, am I right?

sys/vm/device_pager.c

355

How the vm_page_free() case could occur at all?

[markj]

In D57743#1323874, @kib wrote:

So the patch shrinks struct vm_object by single pointer, am I right?

I believe so.

sys/vm/device_pager.c

355

vm_fault will initially insert some newly allocated pages into the object. Typically they are replaced with fictitious pages by the device pager, but I suspect it's possible that some error in between can cause invalid pages to be left behind in the object.

[kib]

Side note. Using unmanaged device pager for the allocated regular pages is the bug by itself. E.g. the driver cannot be unloaded or at least the pages cannot be freed.

So all pagers used by sound(4) should be converted to managed cdev, or to something else. It might be that the phys pager is the better choice for all types of mmaps there.

[markj]

In D57743#1323881, @kib wrote:

Side note. Using unmanaged device pager for the allocated regular pages is the bug by itself. E.g. the driver cannot be unloaded or at least the pages cannot be freed.

So all pagers used by sound(4) should be converted to managed cdev, or to something else. It might be that the phys pager is the better choice for all types of mmaps there.

I agree. I guess some of these drivers existed before OBJT_PHYS was introduced in 2000.

(Note, the regression test uses /dev/devstat, not a sound driver. It just uses the devfs infrastructure for mmap.)

[markj]

Fix a typo

[kib]

sys/vm/device_pager.c

355

Worth a comment IMO.

[markj]

Add a comment