Panic with swap-backed md devices

[David Schultz]

On Thu, May 15, 2003, Giorgos Keramidas wrote:
> Trying to create and destroy a swap-backed md device results in panics
> with today's CURRENT.  I was trying to make a new -t swap md disk to
> test the problem described in a PR.  Using the following small shell
> script I noticed that it always causes a panic when mdconfig -d is run:
> 
> 	mdconfig -a -t swap -s 100m -u 10
> 	disklabel -r -w md10 auto
> 	newfs -O 1 -b 8192 -s 1024 md10
> 	mount /dev/md10 /mnt
> 	mount
> 	umount /mnt
> 	mount
> 	mdconfig -d -u 10

The following patch should fix the panic, but there's a small
vm_object leak that's still unfixed.  I'll look into that.

Index: sys/dev/md/md.c
===================================================================
RCS file: /cvs/src/sys/dev/md/md.c,v
retrieving revision 1.98
diff -u -r1.98 md.c
--- sys/dev/md/md.c	2 May 2003 06:18:58 -0000	1.98
+++ sys/dev/md/md.c	18 May 2003 04:04:23 -0000
@@ -932,7 +932,9 @@
 	if (sc->cred != NULL)
 		crfree(sc->cred);
 	if (sc->object != NULL) {
+		VM_OBJECT_LOCK(sc->object);
 		vm_pager_deallocate(sc->object);
+		VM_OBJECT_UNLOCK(sc->object);
 	}
 	if (sc->indir)
 		destroy_indir(sc, sc->indir);
@@ -990,7 +992,9 @@
 	sc->flags = mdio->md_options & MD_FORCE;
 	if (mdio->md_options & MD_RESERVE) {
 		if (swap_pager_reserve(sc->object, 0, sc->nsect) < 0) {
+			VM_OBJECT_LOCK(sc->object);
 			vm_pager_deallocate(sc->object);
+			VM_OBJECT_UNLOCK(sc->object);
 			sc->object = NULL;
 			mddestroy(sc, td);
 			return (EDOM);