svn commit: r221795 - stable/8/sys/vm

[Max Laier]

Author: mlaier
Date: Thu May 12 01:22:23 2011
New Revision: 221795
URL: http://svn.freebsd.org/changeset/base/221795

Log:
  MFH r221714:
   Another long standing vm bug found at Isilon:
    Fix a race between vm_object_collapse and vm_fault.
  
   Reviewed by:	alc@

Modified:
  stable/8/sys/vm/vm_object.c
Directory Properties:
  stable/8/sys/   (props changed)
  stable/8/sys/amd64/include/xen/   (props changed)
  stable/8/sys/cddl/contrib/opensolaris/   (props changed)
  stable/8/sys/contrib/dev/acpica/   (props changed)
  stable/8/sys/contrib/pf/   (props changed)

Modified: stable/8/sys/vm/vm_object.c
==============================================================================
--- stable/8/sys/vm/vm_object.c	Thu May 12 00:10:29 2011	(r221794)
+++ stable/8/sys/vm/vm_object.c	Thu May 12 01:22:23 2011	(r221795)
@@ -1458,6 +1458,24 @@ vm_object_backing_scan(vm_object_t objec
 
 			pp = vm_page_lookup(object, new_pindex);
 			if (
+			    (op & OBSC_COLLAPSE_NOWAIT) != 0 &&
+			    (pp != NULL && pp->valid == 0)
+			) {
+				/*
+				 * The page in the parent is not (yet) valid.
+				 * We don't know anything about the state of
+				 * the original page.  It might be mapped,
+				 * so we must avoid the next if here.
+				 *
+				 * This is due to a race in vm_fault() where
+				 * we must unbusy the original (backing_obj)
+				 * page before we can (re)lock the parent.
+				 * Hence we can get here.
+				 */
+				p = next;
+				continue;
+			}
+			if (
 			    pp != NULL ||
 			    vm_pager_has_page(object, new_pindex, NULL, NULL)
 			) {