svn commit: r353371 - head/sys/kern

[John Baldwin]

Author: jhb
Date: Wed Oct  9 21:20:39 2019
New Revision: 353371
URL: https://svnweb.freebsd.org/changeset/base/353371

Log:
  Don't free the cursor boundary tag during vmem_destroy().
  
  The cursor boundary tag is statically allocated in the vmem instead of
  from the vmem_bt_zone.  Explicitly remove it from the vmem's segment
  list in vmem_destroy before freeing all the segments from the vmem.
  
  Reviewed by:	markj
  MFC after:	1 week
  Sponsored by:	Chelsio Communications
  Differential Revision:	https://reviews.freebsd.org/D21953

Modified:
  head/sys/kern/subr_vmem.c

Modified: head/sys/kern/subr_vmem.c
==============================================================================
--- head/sys/kern/subr_vmem.c	Wed Oct  9 21:18:46 2019	(r353370)
+++ head/sys/kern/subr_vmem.c	Wed Oct  9 21:20:39 2019	(r353371)
@@ -466,6 +466,7 @@ static void
 bt_remseg(vmem_t *vm, bt_t *bt)
 {
 
+	MPASS(bt->bt_type != BT_TYPE_CURSOR);
 	TAILQ_REMOVE(&vm->vm_seglist, bt, bt_seglist);
 	bt_free(vm, bt);
 }
@@ -843,6 +844,7 @@ vmem_destroy1(vmem_t *vm)
 	VMEM_LOCK(vm);
 	MPASS(vm->vm_nbusytag == 0);
 
+	TAILQ_REMOVE(&vm->vm_seglist, &vm->vm_cursor, bt_seglist);
 	while ((bt = TAILQ_FIRST(&vm->vm_seglist)) != NULL)
 		bt_remseg(vm, bt);