From e18cc7bf3e0979dd4989b2fa8bb671558dd50769 Mon Sep 17 00:00:00 2001 From: Max Laier Date: Mon, 9 May 2011 20:27:49 +0000 Subject: [PATCH] Another long standing vm bug found at Isilon: Fix a race between vm_object_collapse and vm_fault. Reviewed by: alc@ MFC after: 3 days --- sys/vm/vm_object.c | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) diff --git a/sys/vm/vm_object.c b/sys/vm/vm_object.c index 5df2f31fa0b..dbcac852975 100644 --- a/sys/vm/vm_object.c +++ b/sys/vm/vm_object.c @@ -1467,6 +1467,24 @@ vm_object_backing_scan(vm_object_t object, int op) } pp = vm_page_lookup(object, new_pindex); + if ( + (op & OBSC_COLLAPSE_NOWAIT) != 0 && + (pp != NULL && pp->valid == 0) + ) { + /* + * The page in the parent is not (yet) valid. + * We don't know anything about the state of + * the original page. It might be mapped, + * so we must avoid the next if here. + * + * This is due to a race in vm_fault() where + * we must unbusy the original (backing_obj) + * page before we can (re)lock the parent. + * Hence we can get here. + */ + p = next; + continue; + } if ( pp != NULL || vm_pager_has_page(object, new_pindex, NULL, NULL)