svn commit: r355049 - stable/11/sys/vm

[Doug Moore]

Author: dougm
Date: Sun Nov 24 06:54:17 2019
New Revision: 355049
URL: https://svnweb.freebsd.org/changeset/base/355049

Log:
  MFC r354785
  
  The loop in vm_map_protect that verifies that all transition map
  entries are stabilized, repeatedly verifies the same entry. Check each
  entry in turn.

Modified:
  stable/11/sys/vm/vm_map.c
Directory Properties:
  stable/11/   (props changed)

Modified: stable/11/sys/vm/vm_map.c
==============================================================================
--- stable/11/sys/vm/vm_map.c	Sun Nov 24 06:46:49 2019	(r355048)
+++ stable/11/sys/vm/vm_map.c	Sun Nov 24 06:54:17 2019	(r355049)
@@ -2041,17 +2041,16 @@ again:
 			vm_map_unlock(map);
 			return (KERN_PROTECTION_FAILURE);
 		}
-		if ((entry->eflags & MAP_ENTRY_IN_TRANSITION) != 0)
-			in_tran = entry;
+		if ((current->eflags & MAP_ENTRY_IN_TRANSITION) != 0)
+			in_tran = current;
 	}
 
 	/*
-	 * Postpone the operation until all in transition map entries
-	 * are stabilized.  In-transition entry might already have its
-	 * pages wired and wired_count incremented, but
-	 * MAP_ENTRY_USER_WIRED flag not yet set, and visible to other
-	 * threads because the map lock is dropped.  In this case we
-	 * would miss our call to vm_fault_copy_entry().
+	 * Postpone the operation until all in-transition map entries have
+	 * stabilized.  An in-transition entry might already have its pages
+	 * wired and wired_count incremented, but not yet have its
+	 * MAP_ENTRY_USER_WIRED flag set.  In which case, we would fail to call
+	 * vm_fault_copy_entry() in the final loop below.
 	 */
 	if (in_tran != NULL) {
 		in_tran->eflags |= MAP_ENTRY_NEEDS_WAKEUP;