From owner-svn-src-all@freebsd.org Mon Apr 20 18:23:37 2020 Return-Path: Delivered-To: svn-src-all@mailman.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.nyi.freebsd.org (Postfix) with ESMTP id 23B142AA1CE; Mon, 20 Apr 2020 18:23:37 +0000 (UTC) (envelope-from cse.cem@gmail.com) Received: from mail-ot1-f44.google.com (mail-ot1-f44.google.com [209.85.210.44]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) server-signature RSA-PSS (4096 bits) client-signature RSA-PSS (2048 bits) client-digest SHA256) (Client CN "smtp.gmail.com", Issuer "GTS CA 1O1" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 495Zp0424Sz3JfW; Mon, 20 Apr 2020 18:23:36 +0000 (UTC) (envelope-from cse.cem@gmail.com) Received: by mail-ot1-f44.google.com with SMTP id 72so2549388otu.1; Mon, 20 Apr 2020 11:23:36 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:reply-to :from:date:message-id:subject:to:cc; bh=FcVaKqj1egVtVTu0Udk2N7yoQfNZ+euyJOIEyKr1fSk=; b=UlWL5OR118ZEy0S+2zEaxwkwh/loQSYafJPUZVM6Gcx3VnjcZL6TMFly9j4TadZqTV GKdFutuQN2VOeWVn7cWMYJijm53xjchu7kW23ESwjxcclLX8XekLPMOiuqKVscBYETY3 tEY0erLbloU6e9Wm9zGAPE0blZLXmQllGVq7ou9jA539TtyQdmJP5XVdD6Pvr+569O9r //qm4e5NEw9a9p1fUBjMMOkG/oJOGQ6YlfbtG808wbys34cel2QPLStn9O1Pmz290Rn7 +Mxiz6eDN+qfOV5f3Nt4Y2oXwExIoxz4itsc8hKVMSXVurKzsYRvW1BrVZYOKTIjei9U sZ/A== X-Gm-Message-State: AGi0Pubto9jjL4pfGQXYk0dEZSbMNtpGBal0jrQmrx92ZHBg1YqaPy86 qU9XkFWe25ARfP1ioEkCuugIxSV6 X-Google-Smtp-Source: APiQypLzROByvqsGiWIuaEKPLzin09taQGXzqFstGJqthfKdEcl51uaqxM8L/TLMuAE43MWI84ISkw== X-Received: by 2002:a9d:eed:: with SMTP id 100mr7578024otj.83.1587407015131; Mon, 20 Apr 2020 11:23:35 -0700 (PDT) Received: from mail-oi1-f174.google.com (mail-oi1-f174.google.com. [209.85.167.174]) by smtp.gmail.com with ESMTPSA id q187sm30264oih.48.2020.04.20.11.23.34 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Mon, 20 Apr 2020 11:23:34 -0700 (PDT) Received: by mail-oi1-f174.google.com with SMTP id a2so5048607oia.11; Mon, 20 Apr 2020 11:23:34 -0700 (PDT) X-Received: by 2002:a05:6808:28b:: with SMTP id z11mr516607oic.135.1587407014537; Mon, 20 Apr 2020 11:23:34 -0700 (PDT) MIME-Version: 1.0 References: <202004201445.03KEjIbB018710@repo.freebsd.org> In-Reply-To: <202004201445.03KEjIbB018710@repo.freebsd.org> Reply-To: cem@freebsd.org From: Conrad Meyer Date: Mon, 20 Apr 2020 11:23:23 -0700 X-Gmail-Original-Message-ID: Message-ID: Subject: Re: svn commit: r360122 - head/sys/vm To: Mark Johnston Cc: src-committers , svn-src-all , svn-src-head Content-Type: text/plain; charset="UTF-8" X-Rspamd-Queue-Id: 495Zp0424Sz3JfW X-Spamd-Bar: ----- Authentication-Results: mx1.freebsd.org; none X-Spamd-Result: default: False [-6.00 / 15.00]; NEURAL_HAM_MEDIUM(-1.00)[-1.000,0]; REPLY(-4.00)[]; TAGGED_FROM(0.00)[]; NEURAL_HAM_LONG(-1.00)[-1.000,0] X-BeenThere: svn-src-all@freebsd.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "SVN commit messages for the entire src tree \(except for " user" and " projects" \)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 20 Apr 2020 18:23:37 -0000 Thanks! On Mon, Apr 20, 2020 at 7:45 AM Mark Johnston wrote: > > Author: markj > Date: Mon Apr 20 14:45:17 2020 > New Revision: 360122 > URL: https://svnweb.freebsd.org/changeset/base/360122 > > Log: > Handle trashed queue pointers in vm_page_acquire_unlocked(). > > vm_page_acquire_unlocked() relies on type-stability of vm_page > structures and assumes that the listq linkage pointers always point to a > vm_page or are NULL. QUEUE_MACRO_DEBUG_TRASH breaks that assumption, so > add an explicit check for a trashed queue pointer before dereferencing. > > Reported and tested by: pho > Reviewed by: kib > Sponsored by: The FreeBSD Foundation > Differential Revision: https://reviews.freebsd.org/D24472 > > Modified: > head/sys/vm/vm_page.c > > Modified: head/sys/vm/vm_page.c > ============================================================================== > --- head/sys/vm/vm_page.c Mon Apr 20 14:24:13 2020 (r360121) > +++ head/sys/vm/vm_page.c Mon Apr 20 14:45:17 2020 (r360122) > @@ -4438,7 +4438,7 @@ vm_page_acquire_unlocked(vm_object_t object, vm_pindex > * without barriers. Switch to radix to verify. > */ > if (prev == NULL || (m = TAILQ_NEXT(prev, listq)) == NULL || > - m->pindex != pindex || > + QMD_IS_TRASHED(m) || m->pindex != pindex || > atomic_load_ptr(&m->object) != object) { > prev = NULL; > /*