Page MenuHomeFreeBSD

Fix a race in vm_page_pagequeue_lockptr().
ClosedPublic

Authored by markj on May 17 2018, 4:11 AM.
Tags
None
Referenced Files
Unknown Object (File)
Sat, Oct 18, 7:55 AM
Unknown Object (File)
Sat, Oct 18, 7:55 AM
Unknown Object (File)
Sat, Oct 18, 7:54 AM
Unknown Object (File)
Sat, Oct 18, 1:27 AM
Unknown Object (File)
Fri, Oct 17, 8:39 PM
Unknown Object (File)
Thu, Oct 9, 3:15 AM
Unknown Object (File)
Fri, Sep 26, 9:42 PM
Unknown Object (File)
Sep 2 2025, 2:41 AM
Subscribers

Details

Summary

We check for m->queue == PQ_NONE but later use m->queue as an index. In
between the two references, the value of m->queue may change to PQ_NONE.
(The locking protocol ensures that m->queue cannot transition between
two queue indices: either the from-value or the to-value must be
PQ_NONE.) Read the value of m->queue once to avoid this problem.

Test Plan

Gleb reported seeing panics as a result of the use of a bogus
index into the pagequeue array, and also reported that this patch
fixed the panics.

Diff Detail

Lint
Lint Passed
Unit
No Test Coverage
Build Status
Buildable 16640
Build 16545: arc lint + arc unit

Event Timeline

markj added reviewers: kib, alc, jeff.
markj added a subscriber: glebius.
This revision is now accepted and ready to land.May 17 2018, 4:15 AM
This revision was automatically updated to reflect the committed changes.