From owner-freebsd-current@FreeBSD.ORG Thu Jan 19 18:15:24 2006 Return-Path: X-Original-To: freebsd-current@freebsd.org Delivered-To: freebsd-current@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 28D2B16A41F; Thu, 19 Jan 2006 18:15:24 +0000 (GMT) (envelope-from jhb@freebsd.org) Received: from speedfactory.net (mail6.speedfactory.net [66.23.216.219]) by mx1.FreeBSD.org (Postfix) with ESMTP id 77F8B43D60; Thu, 19 Jan 2006 18:15:14 +0000 (GMT) (envelope-from jhb@freebsd.org) Received: from server.baldwin.cx (unverified [66.23.211.162]) by speedfactory.net (SurgeMail 3.5b3) with ESMTP id 6468443 for multiple; Thu, 19 Jan 2006 13:16:14 -0500 Received: from localhost (john@localhost [127.0.0.1]) by server.baldwin.cx (8.13.4/8.13.4) with ESMTP id k0JIFCkA063983; Thu, 19 Jan 2006 13:15:12 -0500 (EST) (envelope-from jhb@freebsd.org) From: John Baldwin To: freebsd-current@freebsd.org Date: Thu, 19 Jan 2006 11:14:24 -0500 User-Agent: KMail/1.9.1 References: <20060118070549.GA617@xor.obsecurity.org> <43CEEBD4.3060604@FreeBSD.org> <200601190802.31914.jhb@freebsd.org> In-Reply-To: <200601190802.31914.jhb@freebsd.org> MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit Content-Disposition: inline Message-Id: <200601191114.27075.jhb@freebsd.org> X-Virus-Scanned: ClamAV 0.87.1/1245/Wed Jan 18 11:57:44 2006 on server.baldwin.cx X-Virus-Status: Clean X-Spam-Status: No, score=-1.4 required=4.2 tests=ALL_TRUSTED, SUBJECT_EXCESS_QP autolearn=failed version=3.1.0 X-Spam-Checker-Version: SpamAssassin 3.1.0 (2005-09-13) on server.baldwin.cx X-Server: High Performance Mail Server - http://surgemail.com r=1653887525 Cc: alc@freebsd.org, Suleiman Souhlal , Kris Kennaway Subject: Re: System call munmap returning with the following locks held: Giant X-BeenThere: freebsd-current@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Discussions about the use of FreeBSD-current List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 19 Jan 2006 18:15:24 -0000 On Thursday 19 January 2006 08:02, John Baldwin wrote: > On Wednesday 18 January 2006 08:31 pm, Suleiman Souhlal wrote: > > Hi, > > > > John Baldwin wrote: > > > I sent this to you on IRC, but for the archives, here's a possible fix. > > > It looks like vm_object_deallocate() never unlocks Giant if it locks > > > it, and the leak would only happen if mpsafevfs=0 or you are using a > > > non-safe filesystem: > > > > The real problem is that vm_object_deallocate() doesn't expect the > > object's type to change if it sees it's a vnode, when it's not holding > > the object lock: > > /* > > * In general, the object should be locked when working with > > * its type. In this case, in order to maintain proper lock > > * ordering, an exception is possible because a vnode-backed > > * object never changes its type. > > */ > > vfslocked = 0; > > if (object->type == OBJT_VNODE) { > > struct vnode *vp = (struct vnode *) object->handle; > > vfslocked = VFS_LOCK_GIANT(vp->v_mount); > > } > > VM_OBJECT_LOCK(object); > > if (object->type == OBJT_VNODE) { > > vm_object_vndeallocate(object); > > VFS_UNLOCK_GIANT(vfslocked); > > return; > > } > > > > The comment is actually wrong, and the object's type can change to > > OBJT_DEAD when the corresponing vnode gets freed, so maybe you might > > want to change it. > > Well, that's not the cause of Kris' panic at all (the function really is > not ever dropping Giant). If the object does change to OBJT_DEAD after > Giant is acquired then some of the MPASS()'s I added might fail I think. > I'm not sure if that's all that has to be done to fix the problem you are > concerned about. Actually, if the object's type isn't guaranteed to be stable by teh caller somehow, then the VFS_LOCK_GIANT part itself is racey. Really fixing it would be something ugly like this: vfslocked = 0; restart: VM_OBJECT_LOCK(object); if (object->type == OBJT_VNODE) { struct vnode *vp = (struct vnode *)object->handle; if (VFS_NEEDSGIANT(vp->v_mount) { VM_OBJECT_UNLOCK(object); mtx_lock(&Giant); vfslocked = 1; goto restart; } else VFS_UNLOCK_GIANT(vfslocked); } else VFS_UNLOCK_GIANT(vfslocked); ... Are you really sure the object's type can change or does the caller of vm_object_deallocate() hold some sort of reference or what not that prevents the type from changing? -- John Baldwin <>< http://www.FreeBSD.org/~jhb/ "Power Users Use the Power to Serve" = http://www.FreeBSD.org