git: f1400b2ecc73 - stable/13 - pmap: Keep PTI page table pages busy

The branch stable/13 has been updated by markj:

URL: https://cgit.FreeBSD.org/src/commit/?id=f1400b2ecc736e20e419d22ac97754dc4d71387f

commit f1400b2ecc736e20e419d22ac97754dc4d71387f
Author:     Mark Johnston <markj@FreeBSD.org>
AuthorDate: 2022-06-15 14:19:01 +0000
Commit:     Mark Johnston <markj@FreeBSD.org>
CommitDate: 2022-06-29 14:13:57 +0000

    pmap: Keep PTI page table pages busy
    
    PTI page table pages are allocated from a VM object, so must be
    exclusively busied when they are freed, e.g., when a thread loses a race
    in pmap_pti_pde().  Simply keep PTPs busy at all times, as was done for
    some other kernel allocators in commit
    e9ceb9dd110e04fc19729b4e9fb1c8bfbb8398a3.
    
    Also remove some redundant assertions on "ref_count":
    vm_page_unwire_noq() already asserts that the page's reference count is
    greater than zero.
    
    Reported by:    syzkaller
    Reviewed by:    kib
    Sponsored by:   The FreeBSD Foundation
    
    (cherry picked from commit c6d092b5107d1a3acefa977828b8130c0505fe7b)
---
 sys/amd64/amd64/pmap.c | 8 ++------
 1 file changed, 2 insertions(+), 6 deletions(-)

diff --git a/sys/amd64/amd64/pmap.c b/sys/amd64/amd64/pmap.c
index f6b7238d39d7..79e61de490ae 100644
--- a/sys/amd64/amd64/pmap.c
+++ b/sys/amd64/amd64/pmap.c
@@ -10743,18 +10743,16 @@ pmap_pti_alloc_page(void)
 	vm_page_t m;
 
 	VM_OBJECT_ASSERT_WLOCKED(pti_obj);
-	m = vm_page_grab(pti_obj, pti_pg_idx++, VM_ALLOC_NOBUSY |
-	    VM_ALLOC_WIRED | VM_ALLOC_ZERO);
+	m = vm_page_grab(pti_obj, pti_pg_idx++, VM_ALLOC_WIRED | VM_ALLOC_ZERO);
 	return (m);
 }
 
 static bool
 pmap_pti_free_page(vm_page_t m)
 {
-
-	KASSERT(m->ref_count > 0, ("page %p not referenced", m));
 	if (!vm_page_unwire_noq(m))
 		return (false);
+	vm_page_xbusy_claim(m);
 	vm_page_free_zero(m);
 	return (true);
 }
@@ -10860,7 +10858,6 @@ pmap_pti_unwire_pde(void *pde, bool only_ref)
 
 	VM_OBJECT_ASSERT_WLOCKED(pti_obj);
 	m = PHYS_TO_VM_PAGE(DMAP_TO_PHYS((uintptr_t)pde));
-	MPASS(m->ref_count > 0);
 	MPASS(only_ref || m->ref_count > 1);
 	pmap_pti_free_page(m);
 }
@@ -10873,7 +10870,6 @@ pmap_pti_unwire_pte(void *pte, vm_offset_t va)
 
 	VM_OBJECT_ASSERT_WLOCKED(pti_obj);
 	m = PHYS_TO_VM_PAGE(DMAP_TO_PHYS((uintptr_t)pte));
-	MPASS(m->ref_count > 0);
 	if (pmap_pti_free_page(m)) {
 		pde = pmap_pti_pde(va);
 		MPASS((*pde & (X86_PG_PS | X86_PG_V)) == X86_PG_V);