From owner-freebsd-arm@FreeBSD.ORG  Sat Nov  8 16:58:35 2014
Return-Path: <owner-freebsd-arm@FreeBSD.ORG>
Delivered-To: freebsd-arm@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org
 [IPv6:2001:1900:2254:206a::19:1])
 (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits))
 (No client certificate requested)
 by hub.freebsd.org (Postfix) with ESMTPS id B23223C6
 for <freebsd-arm@freebsd.org>; Sat,  8 Nov 2014 16:58:35 +0000 (UTC)
Received: from moon.peach.ne.jp (moon.peach.ne.jp [203.141.148.98])
 (using TLSv1 with cipher DHE-RSA-CAMELLIA256-SHA (256/256 bits))
 (Client did not present a certificate)
 by mx1.freebsd.org (Postfix) with ESMTPS id 810AD315
 for <freebsd-arm@freebsd.org>; Sat,  8 Nov 2014 16:58:34 +0000 (UTC)
Received: from moon.peach.ne.jp (localhost [127.0.0.1])
 by moon.peach.ne.jp (Postfix) with ESMTP id 7AA0939D0A
 for <freebsd-arm@freebsd.org>; Sun,  9 Nov 2014 01:58:26 +0900 (JST)
Received: from artemis (unknown [172.18.0.21])
 (using TLSv1 with cipher AES128-SHA (128/128 bits))
 (No client certificate requested)
 by moon.peach.ne.jp (Postfix) with ESMTPSA id 616FB39D09
 for <freebsd-arm@freebsd.org>; Sun,  9 Nov 2014 01:58:26 +0900 (JST)
Message-ID: <A9FF20484A844727B5D6DD3A03A94999@ad.peach.ne.jp>
From: "Daisuke Aoyama" <aoyama@peach.ne.jp>
To: <freebsd-arm@freebsd.org>
Subject: swap_pager_reserve bug (not arm depend and any version of FreeBSD)
Date: Sun, 9 Nov 2014 01:58:21 +0900
MIME-Version: 1.0
Content-Type: text/plain; format=flowed; charset="iso-2022-jp";
 reply-type=original
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
Importance: Normal
X-Mailer: Microsoft Windows Live Mail 14.0.8117.416
X-MimeOLE: Produced By Microsoft MimeOLE V14.0.8117.416
X-Virus-Scanned: ClamAV using ClamSMTP
X-BeenThere: freebsd-arm@freebsd.org
X-Mailman-Version: 2.1.18-1
Precedence: list
List-Id: "Porting FreeBSD to ARM processors." <freebsd-arm.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/options/freebsd-arm>,
 <mailto:freebsd-arm-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-arm/>
List-Post: <mailto:freebsd-arm@freebsd.org>
List-Help: <mailto:freebsd-arm-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-arm>,
 <mailto:freebsd-arm-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Sat, 08 Nov 2014 16:58:35 -0000

Hello,

In short, I get a bug of kernel code. swap_pager_reserve never free unused area.
Because of this, you can't clean up correctly by vm_object_deallocate.

The part of my code in the kernel module is like this:
        vm_object_t obj;
        obj = vm_pager_allocate(OBJT_SWAP, NULL, 32768, VM_PROT_DEFAULT, 0, NULL);
        swap_pager_reserve(obj, 0, OFF_TO_IDX(32768));
        (using...)
        vm_object_deallocate(obj);

Allocate 32KB as swap object, then reserve all and deallocate it after using.
In this case, swap_pager_reserve take 128KB(32xPAGE_SIZE) swap on it,
but vm_object_deallocate will free only 32KB.
Probably, left 96KB will cause a kernel panic when you remove(swapoff) the swap device 
(including shutdown).
I think this is a rare case but don't want get a panic...

Here is my test patch. If you have more better code, please help me.
Currently, I've tested on 9.3 amd64 and 11-current arm RPi.

Index: swap_pager.c
===================================================================
--- swap_pager.c        (revision 274088)
+++ swap_pager.c        (working copy)
@@ -858,7 +858,7 @@
        VM_OBJECT_WLOCK(object);
        while (size) {
                if (n == 0) {
-                       n = BLIST_MAX_ALLOC;
+                       n = min(BLIST_MAX_ALLOC, size); /* happy with small size */
                        while ((blk = swp_pager_getswapspace(n)) == SWAPBLK_NONE) {
                                n >>= 1;
                                if (n == 0) {


Thanks,
-- 
Daisuke Aoyama