kern/44950: SMP kernel crash in vm_page_free: freeing wired page

[Tor.Egge at cvsup.no.freebsd.org]

>  With an uptime of about 2 days I got today the first crash: stack trace is:
>  
>  (kgdb) where
>  #0  0xc016e052 in dumpsys ()
>  #1  0xc016de23 in boot ()
>  #2  0xc016e27c in poweroff_wait ()
>  #3  0xc02286ca in vm_page_free_toq ()
>  #4  0xc02274bc in vm_object_collapse ()
>  #5  0xc02266d0 in vm_object_deallocate ()
>  #6  0xc0223b74 in vm_map_entry_delete ()
>  #7  0xc0223d2d in vm_map_delete ()
>  #8  0xc0223dba in vm_map_remove ()
>  
>  Someone has an idea other than turn off SMP ?

This problem can also occur without SMP if you use threaded
applications (linuxthreads port or linux emulation), aio or procfs.

The enclosed patch might help.

- Tor Egge
-------------- next part --------------
Index: sys/vm/vm_page.c
===================================================================
RCS file: /home/ncvs/src/sys/vm/vm_page.c,v
retrieving revision 1.147.2.18
diff -u -r1.147.2.18 vm_page.c
--- sys/vm/vm_page.c	10 Mar 2002 05:03:19 -0000	1.147.2.18
+++ sys/vm/vm_page.c	6 Aug 2003 23:09:58 -0000
@@ -1403,7 +1408,8 @@
 {
 	int s;
 
-	if ((m->flags & (PG_BUSY|PG_UNMANAGED)) || m->busy || m->wire_count) {
+	if ((m->flags & (PG_BUSY|PG_UNMANAGED)) || m->busy ||
+	    m->hold_count || m->wire_count) {
 		printf("vm_page_cache: attempting to cache busy page\n");
 		return;
 	}
Index: sys/kern/sys_pipe.c
===================================================================
RCS file: /home/ncvs/src/sys/kern/sys_pipe.c,v
retrieving revision 1.60.2.14
diff -u -r1.60.2.14 sys_pipe.c
--- sys/kern/sys_pipe.c	3 Aug 2003 13:04:57 -0000	1.60.2.14
+++ sys/kern/sys_pipe.c	6 Aug 2003 23:09:58 -0000
@@ -561,12 +561,12 @@
 			int j;
 
 			for (j = 0; j < i; j++)
-				vm_page_unwire(wpipe->pipe_map.ms[j], 1);
+				vm_page_unhold(wpipe->pipe_map.ms[j]);
 			return (EFAULT);
 		}
 
 		m = PHYS_TO_VM_PAGE(paddr);
-		vm_page_wire(m);
+		vm_page_hold(m);
 		wpipe->pipe_map.ms[i] = m;
 	}
 
@@ -627,7 +627,7 @@
 		}
 	}
 	for (i = 0; i < wpipe->pipe_map.npages; i++)
-		vm_page_unwire(wpipe->pipe_map.ms[i], 1);
+		vm_page_unhold(wpipe->pipe_map.ms[i]);
 	wpipe->pipe_map.npages = 0;
 }
 
Index: sys/miscfs/procfs/procfs_mem.c
===================================================================
RCS file: /home/ncvs/src/sys/miscfs/procfs/Attic/procfs_mem.c,v
retrieving revision 1.46.2.3
diff -u -r1.46.2.3 procfs_mem.c
--- sys/miscfs/procfs/procfs_mem.c	22 Jan 2002 17:22:59 -0000	1.46.2.3
+++ sys/miscfs/procfs/procfs_mem.c	6 Aug 2003 23:09:58 -0000
@@ -188,9 +188,9 @@
 		}
 
 		/*
-		 * Wire the page into memory
+		 * Hold the page in memory
 		 */
-		vm_page_wire(m);
+		vm_page_hold(m);
 
 		/*
 		 * We're done with tmap now.
@@ -212,7 +212,7 @@
 		/*
 		 * release the page and the object
 		 */
-		vm_page_unwire(m, 1);
+		vm_page_unhold(m);
 		vm_object_deallocate(object);
 
 		object = NULL;