Date: Thu, 10 Feb 2022 14:55:49 +0000 From: bugzilla-noreply@freebsd.org To: bugs@FreeBSD.org Subject: [Bug 261707] panic: vm_page_free_prep: freeing mapped page 0xfffffe0006f80170 on 14-Current(master-n252892-e30fceb89b7) Message-ID: <bug-261707-227-EvyhgrVNOn@https.bugs.freebsd.org/bugzilla/> In-Reply-To: <bug-261707-227@https.bugs.freebsd.org/bugzilla/> References: <bug-261707-227@https.bugs.freebsd.org/bugzilla/>
next in thread | previous in thread | raw e-mail | index | archive | help
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=3D261707 --- Comment #4 from commit-hook@FreeBSD.org --- A commit in branch main references this bug: URL: https://cgit.FreeBSD.org/src/commit/?id=3Db51927b7b018d268c91b2127d82786caf= 68254de commit b51927b7b018d268c91b2127d82786caf68254de Author: Konstantin Belousov <kib@FreeBSD.org> AuthorDate: 2022-02-10 14:50:42 +0000 Commit: Konstantin Belousov <kib@FreeBSD.org> CommitDate: 2022-02-10 14:55:10 +0000 Revert "vm_pageout_scans: correct detection of active object" This reverts commit 3de96d664aaaf8e3fb1ca4fc4bd864d2cf734b24. Problem is that it is possible to reach the state with ref_count =3D=3D 1 for the mapped non-anonymous object. For instance, anonymous posix shmfd or linux shmfs object could be mapped, and then corresponding file descriptor closed, dropping the object reference owned by the shmfd/shmfs file. Then the check in inactive scan assumes that the object and page are not mapped and frees the page, while they are not. PR: 261707 Discussed with: markj Sponsored by: The FreeBSD Foundation MFC after: now sys/vm/vm_pageout.c | 56 +++++++++++++++++--------------------------------= ---- 1 file changed, 18 insertions(+), 38 deletions(-) --=20 You are receiving this mail because: You are the assignee for the bug.=
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?bug-261707-227-EvyhgrVNOn>