From owner-cvs-all@FreeBSD.ORG  Wed Jun  9 19:18:51 2004
Return-Path: <owner-cvs-all@FreeBSD.ORG>
Delivered-To: cvs-all@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP
	id 570DF16A4CE; Wed,  9 Jun 2004 19:18:51 +0000 (GMT)
Received: from repoman.freebsd.org (repoman.freebsd.org [216.136.204.115])
	by mx1.FreeBSD.org (Postfix) with ESMTP
	id 51ED643D1F; Wed,  9 Jun 2004 19:18:51 +0000 (GMT)
	(envelope-from bmilekic@FreeBSD.org)
Received: from repoman.freebsd.org (localhost [127.0.0.1])
	by repoman.freebsd.org (8.12.11/8.12.11) with ESMTP id i59JIpEw014376;
	Wed, 9 Jun 2004 19:18:51 GMT
	(envelope-from bmilekic@repoman.freebsd.org)
Received: (from bmilekic@localhost)
	by repoman.freebsd.org (8.12.11/8.12.11/Submit) id i59JIpUe014375;
	Wed, 9 Jun 2004 19:18:51 GMT
	(envelope-from bmilekic)
Message-Id: <200406091918.i59JIpUe014375@repoman.freebsd.org>
From: Bosko Milekic <bmilekic@FreeBSD.org>
Date: Wed, 9 Jun 2004 19:18:51 +0000 (UTC)
To: src-committers@FreeBSD.org, cvs-src@FreeBSD.org,
	cvs-all@FreeBSD.org
X-FreeBSD-CVS-Branch: HEAD
Subject: cvs commit: src/sys/vm uma_core.c
X-BeenThere: cvs-all@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: CVS commit messages for the entire tree <cvs-all.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/cvs-all>,
	<mailto:cvs-all-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/cvs-all>
List-Post: <mailto:cvs-all@freebsd.org>
List-Help: <mailto:cvs-all-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/cvs-all>,
	<mailto:cvs-all-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Wed, 09 Jun 2004 19:18:51 -0000

bmilekic    2004-06-09 19:18:51 UTC

  FreeBSD src repository

  Modified files:
    sys/vm               uma_core.c 
  Log:
  Make the slabrefzone, the zone from which we allocated slabs with
  internal reference counters, UMA_ZONE_NOFREE.  This way, those slabs
  (with their ref counts) will be effectively type-stable, then using
  a trick like this on the refcount is no longer dangerous:
  
          MEXT_REM_REF(m);
          if (atomic_cmpset_int(m->m_ext.ref_cnt, 0, 1)) {
                  if (m->m_ext.ext_type == EXT_PACKET) {
                          uma_zfree(zone_pack, m);
                          return;
                  } else if (m->m_ext.ext_type == EXT_CLUSTER) {
                          uma_zfree(zone_clust, m->m_ext.ext_buf);
                          m->m_ext.ext_buf = NULL;
                  } else {
                          (*(m->m_ext.ext_free))(m->m_ext.ext_buf,
                              m->m_ext.ext_args);
                          if (m->m_ext.ext_type != EXT_EXTREF)
                                  free(m->m_ext.ref_cnt, M_MBUF);
                  }
          }
          uma_zfree(zone_mbuf, m);
  
  Previously, a second thread hitting the above cmpset might
  actually read the refcnt AFTER it has already been freed.  A very
  rare occurance.  Now we'll know that it won't be freed, though.
  
  Spotted by: julian, pjd
  
  Revision  Changes    Path
  1.95      +2 -1      src/sys/vm/uma_core.c