diff options
| author | Mark Johnston <markj@FreeBSD.org> | 2022-06-15 14:19:01 +0000 |
|---|---|---|
| committer | Mark Johnston <markj@FreeBSD.org> | 2022-06-29 14:13:57 +0000 |
| commit | f1400b2ecc736e20e419d22ac97754dc4d71387f (patch) | |
| tree | e411ac67da2995ffd6b1839ddba1cea346cda6c5 | |
| parent | c31c881f7eee79ab7c5f820952cbf22af88da0db (diff) | |
| download | src-f1400b2ecc736e20e419d22ac97754dc4d71387f.tar.gz src-f1400b2ecc736e20e419d22ac97754dc4d71387f.zip | |
pmap: Keep PTI page table pages busy
PTI page table pages are allocated from a VM object, so must be
exclusively busied when they are freed, e.g., when a thread loses a race
in pmap_pti_pde(). Simply keep PTPs busy at all times, as was done for
some other kernel allocators in commit
e9ceb9dd110e04fc19729b4e9fb1c8bfbb8398a3.
Also remove some redundant assertions on "ref_count":
vm_page_unwire_noq() already asserts that the page's reference count is
greater than zero.
Reported by: syzkaller
Reviewed by: kib
Sponsored by: The FreeBSD Foundation
(cherry picked from commit c6d092b5107d1a3acefa977828b8130c0505fe7b)
| -rw-r--r-- | sys/amd64/amd64/pmap.c | 8 |
1 files changed, 2 insertions, 6 deletions
diff --git a/sys/amd64/amd64/pmap.c b/sys/amd64/amd64/pmap.c index f6b7238d39d7..79e61de490ae 100644 --- a/sys/amd64/amd64/pmap.c +++ b/sys/amd64/amd64/pmap.c @@ -10743,18 +10743,16 @@ pmap_pti_alloc_page(void) vm_page_t m; VM_OBJECT_ASSERT_WLOCKED(pti_obj); - m = vm_page_grab(pti_obj, pti_pg_idx++, VM_ALLOC_NOBUSY | - VM_ALLOC_WIRED | VM_ALLOC_ZERO); + m = vm_page_grab(pti_obj, pti_pg_idx++, VM_ALLOC_WIRED | VM_ALLOC_ZERO); return (m); } static bool pmap_pti_free_page(vm_page_t m) { - - KASSERT(m->ref_count > 0, ("page %p not referenced", m)); if (!vm_page_unwire_noq(m)) return (false); + vm_page_xbusy_claim(m); vm_page_free_zero(m); return (true); } @@ -10860,7 +10858,6 @@ pmap_pti_unwire_pde(void *pde, bool only_ref) VM_OBJECT_ASSERT_WLOCKED(pti_obj); m = PHYS_TO_VM_PAGE(DMAP_TO_PHYS((uintptr_t)pde)); - MPASS(m->ref_count > 0); MPASS(only_ref || m->ref_count > 1); pmap_pti_free_page(m); } @@ -10873,7 +10870,6 @@ pmap_pti_unwire_pte(void *pte, vm_offset_t va) VM_OBJECT_ASSERT_WLOCKED(pti_obj); m = PHYS_TO_VM_PAGE(DMAP_TO_PHYS((uintptr_t)pte)); - MPASS(m->ref_count > 0); if (pmap_pti_free_page(m)) { pde = pmap_pti_pde(va); MPASS((*pde & (X86_PG_PS | X86_PG_V)) == X86_PG_V); |