From owner-dev-commits-src-all@freebsd.org Mon Jan 4 13:35:46 2021 Return-Path: Delivered-To: dev-commits-src-all@mailman.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.nyi.freebsd.org (Postfix) with ESMTP id AF9BE4D67CE; Mon, 4 Jan 2021 13:35:46 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "Let's Encrypt Authority X3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4D8c8L4V84z4k5N; Mon, 4 Jan 2021 13:35:46 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 8BBB71AD47; Mon, 4 Jan 2021 13:35:46 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.16.1/8.16.1) with ESMTP id 104DZkJa014492; Mon, 4 Jan 2021 13:35:46 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.16.1/8.16.1/Submit) id 104DZkhF014491; Mon, 4 Jan 2021 13:35:46 GMT (envelope-from git) Date: Mon, 4 Jan 2021 13:35:46 GMT Message-Id: <202101041335.104DZkhF014491@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Mark Johnston Subject: git: c4cceb1d0d6f - main - md: Fix a race in mdstart_swap() MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: c4cceb1d0d6f59789524feab3ddf7e3110d10d75 Auto-Submitted: auto-generated X-BeenThere: dev-commits-src-all@freebsd.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: Commit messages for all branches of the src repository List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 04 Jan 2021 13:35:46 -0000 The branch main has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=c4cceb1d0d6f59789524feab3ddf7e3110d10d75 commit c4cceb1d0d6f59789524feab3ddf7e3110d10d75 Author: Mark Johnston AuthorDate: 2021-01-04 13:21:57 +0000 Commit: Mark Johnston CommitDate: 2021-01-04 13:26:14 +0000 md: Fix a race in mdstart_swap() Release a grabbed page's busy state only after marking it as referenced. Otherwise there exists a narrow window where the page could be freed before the update. Before r356902 this was not a problem since the object lock was held. Discussed with: kib Sponsored by: The FreeBSD Foundation --- sys/dev/md/md.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/sys/dev/md/md.c b/sys/dev/md/md.c index 1b4b583b3c09..5c2cb2f25d2e 100644 --- a/sys/dev/md/md.c +++ b/sys/dev/md/md.c @@ -1146,8 +1146,6 @@ mdstart_swap(struct md_s *sc, struct bio *bp) VM_OBJECT_WUNLOCK(sc->object); } if (m != NULL) { - vm_page_xunbusy(m); - /* * The page may be deactivated prior to setting * PGA_REFERENCED, but in this case it will be @@ -1157,6 +1155,7 @@ mdstart_swap(struct md_s *sc, struct bio *bp) vm_page_reference(m); else vm_page_activate(m); + vm_page_xunbusy(m); } /* Actions on further pages start at offset 0 */