svn commit: r302513 - stable/10/sys/vm

[Konstantin Belousov]

Author: kib
Date: Sun Jul 10 04:33:16 2016
New Revision: 302513
URL: https://svnweb.freebsd.org/changeset/base/302513

Log:
  MFC r302236:
  Handle the vm_fault() handler race with the vm_object_collapse()
  sleepable scan.
  
  MFC r302317:
  Change type of the 'dead' variable to boolean.

Modified:
  stable/10/sys/vm/vm_fault.c
Directory Properties:
  stable/10/   (props changed)

Modified: stable/10/sys/vm/vm_fault.c
==============================================================================
--- stable/10/sys/vm/vm_fault.c	Sun Jul 10 03:49:38 2016	(r302512)
+++ stable/10/sys/vm/vm_fault.c	Sun Jul 10 04:33:16 2016	(r302513)
@@ -286,7 +286,7 @@ vm_fault_hold(vm_map_t map, vm_offset_t 
 	vm_prot_t prot;
 	long ahead, behind;
 	int alloc_req, era, faultcount, nera, reqpage, result;
-	boolean_t growstack, is_first_object_locked, wired;
+	boolean_t dead, growstack, is_first_object_locked, wired;
 	int map_generation;
 	vm_object_t next_object;
 	vm_page_t marray[VM_FAULT_READ_MAX];
@@ -423,11 +423,18 @@ fast_failed:
 	fs.pindex = fs.first_pindex;
 	while (TRUE) {
 		/*
-		 * If the object is dead, we stop here
+		 * If the object is marked for imminent termination,
+		 * we retry here, since the collapse pass has raced
+		 * with us.  Otherwise, if we see terminally dead
+		 * object, return fail.
 		 */
-		if (fs.object->flags & OBJ_DEAD) {
+		if ((fs.object->flags & OBJ_DEAD) != 0) {
+			dead = fs.object->type == OBJT_DEAD;
 			unlock_and_deallocate(&fs);
-			return (KERN_PROTECTION_FAILURE);
+			if (dead)
+				return (KERN_PROTECTION_FAILURE);
+			pause("vmf_de", 1);
+			goto RetryFault;
 		}
 
 		/*