From owner-freebsd-alpha  Sat Dec 14 17: 5:23 2002
Delivered-To: freebsd-alpha@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP
	id 0D4EA37B401; Sat, 14 Dec 2002 17:05:22 -0800 (PST)
Received: from apollo.backplane.com (apollo.backplane.com [216.240.41.2])
	by mx1.FreeBSD.org (Postfix) with ESMTP
	id A8F0943EB2; Sat, 14 Dec 2002 17:05:21 -0800 (PST)
	(envelope-from dillon@apollo.backplane.com)
Received: from apollo.backplane.com (localhost [127.0.0.1])
	by apollo.backplane.com (8.12.5/8.12.5) with ESMTP id gBF15LOM060145;
	Sat, 14 Dec 2002 17:05:21 -0800 (PST)
	(envelope-from dillon@apollo.backplane.com)
Received: (from dillon@localhost)
	by apollo.backplane.com (8.12.5/8.12.5/Submit) id gBF15LiN060144;
	Sat, 14 Dec 2002 17:05:21 -0800 (PST)
	(envelope-from dillon)
Date: Sat, 14 Dec 2002 17:05:21 -0800 (PST)
From: Matthew Dillon <dillon@apollo.backplane.com>
Message-Id: <200212150105.gBF15LiN060144@apollo.backplane.com>
To: Jake Burkholder <jake@locore.ca>
Cc: "Brian F. Feldman" <green@FreeBSD.ORG>,
	John Baldwin <jhb@FreeBSD.ORG>, Kris Kennaway <kris@obsecurity.org>,
	current@FreeBSD.ORG, alpha@FreeBSD.ORG
Subject: Re: UMA panic under load
References: <XFMail.20021212113400.jhb@FreeBSD.org> <200212150037.gBF0bVSM014040@green.bikeshed.org> <20021214201446.F93389@locore.ca>
Sender: owner-freebsd-alpha@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-alpha.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-alpha>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-alpha>
X-Loop: FreeBSD.org


:P_WEXIT is set, so the process won't get swapped out.  The problem is that
:the vmspace refcnt is 0 when swapout_procs is called, since it was
:decremented in exit1.  The refcnt is incremented before p_flag is tested
:for P_WEXIT, the swapout is skipped because its found to be set, and then
:vmspace_free is called which decrements the refcnt to 0 and prematurely
:frees the vmspace.  Decrementing the refcnt in exit1 breaks the normal
:refernce count semantics because the vmspace is not being freed then.
:
:Jake

    Yup, I see it.  We could just move the P_WEXIT test but I wonder how
    many other places the vmspace might be bumped and then released.  The
    real bug appears to be in exit1().

    I seem to recall we hit this situation a few months ago.  I thought 
    it had been fixed.

					-Matt
					Matthew Dillon 
					<dillon@backplane.com>

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-alpha" in the body of the message