From owner-svn-src-head@freebsd.org Thu May 17 04:27:09 2018 Return-Path: Delivered-To: svn-src-head@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id A40FDEA9063; Thu, 17 May 2018 04:27:09 +0000 (UTC) (envelope-from markj@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client CN "mxrelay.nyi.freebsd.org", Issuer "Let's Encrypt Authority X3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 558726950C; Thu, 17 May 2018 04:27:09 +0000 (UTC) (envelope-from markj@FreeBSD.org) Received: from repo.freebsd.org (repo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 36922242C3; Thu, 17 May 2018 04:27:09 +0000 (UTC) (envelope-from markj@FreeBSD.org) Received: from repo.freebsd.org ([127.0.1.37]) by repo.freebsd.org (8.15.2/8.15.2) with ESMTP id w4H4R8f9058776; Thu, 17 May 2018 04:27:08 GMT (envelope-from markj@FreeBSD.org) Received: (from markj@localhost) by repo.freebsd.org (8.15.2/8.15.2/Submit) id w4H4R8lv058775; Thu, 17 May 2018 04:27:08 GMT (envelope-from markj@FreeBSD.org) Message-Id: <201805170427.w4H4R8lv058775@repo.freebsd.org> X-Authentication-Warning: repo.freebsd.org: markj set sender to markj@FreeBSD.org using -f From: Mark Johnston Date: Thu, 17 May 2018 04:27:08 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r333703 - head/sys/vm X-SVN-Group: head X-SVN-Commit-Author: markj X-SVN-Commit-Paths: head/sys/vm X-SVN-Commit-Revision: 333703 X-SVN-Commit-Repository: base MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-src-head@freebsd.org X-Mailman-Version: 2.1.26 Precedence: list List-Id: SVN commit messages for the src tree for head/-current List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 17 May 2018 04:27:09 -0000 Author: markj Date: Thu May 17 04:27:08 2018 New Revision: 333703 URL: https://svnweb.freebsd.org/changeset/base/333703 Log: Fix a race in vm_page_pagequeue_lockptr(). The value of m->queue must be cached after comparing it with PQ_NONE, since it may be concurrently changing. Reported by: glebius Reviewed by: jeff Differential Revision: https://reviews.freebsd.org/D15462 Modified: head/sys/vm/vm_page.c head/sys/vm/vm_page.h Modified: head/sys/vm/vm_page.c ============================================================================== --- head/sys/vm/vm_page.c Thu May 17 04:08:57 2018 (r333702) +++ head/sys/vm/vm_page.c Thu May 17 04:27:08 2018 (r333703) @@ -3088,10 +3088,11 @@ vm_page_pagequeue(vm_page_t m) static struct mtx * vm_page_pagequeue_lockptr(vm_page_t m) { + uint8_t queue; - if (m->queue == PQ_NONE) + if ((queue = m->queue) == PQ_NONE) return (NULL); - return (&vm_page_pagequeue(m)->pq_mutex); + return (&vm_pagequeue_domain(m)->vmd_pagequeues[queue].pq_mutex); } static inline void Modified: head/sys/vm/vm_page.h ============================================================================== --- head/sys/vm/vm_page.h Thu May 17 04:08:57 2018 (r333702) +++ head/sys/vm/vm_page.h Thu May 17 04:27:08 2018 (r333703) @@ -208,7 +208,7 @@ struct vm_page { uint16_t flags; /* page PG_* flags (P) */ uint8_t aflags; /* access is atomic */ uint8_t oflags; /* page VPO_* flags (O) */ - uint8_t queue; /* page queue index (Q) */ + volatile uint8_t queue; /* page queue index (Q) */ int8_t psind; /* pagesizes[] index (O) */ int8_t segind; /* vm_phys segment index (C) */ uint8_t order; /* index of the buddy queue (F) */