>Number:         23285
>Category:       kern
>Synopsis:       loaning out wired pages causes a panic
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Mon Oct 27 13:20:00 UTC 2003
>Closed-Date:
>Last-Modified:
>Originator:     YAMAMOTO Takashi <yamt@mwd.biglobe.ne.jp>
>Release:        NetBSD 1.6ZD
>Organization:

>Environment:
	
	
System: NetBSD kaeru 1.6ZD NetBSD 1.6ZD (build.kaeru) #255: Mon Oct 27 12:50:11 JST 2003 takashi@kaeru:/home/takashi/work/kernel/build.kaeru i386
Architecture: i386
Machine: i386
>Description:
	page loaning code doesn't handle wired pages properly.
>How-To-Repeat:
	compile and run the following source.
		% cc a.c
		% ./a.out /dev/zero|cat
	and you'll see a panic.
	(in this case, "pg->wire_count == 0" in uvm_loananon.)
----------
#include <sys/mman.h>

#include <err.h>
#include <fcntl.h>
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>

int
main(int argc, char *argv[])
{
	char *filename = "test";
	int fd;
	void *vp;
	size_t mapsize;

	if (argc > 1)
		filename = argv[1];

	fd = open(filename, O_RDONLY);
	if (fd < 0)
		err(1, "open");

	mapsize = 16*1024*1024;

	vp = mmap(0, mapsize, PROT_READ, MAP_FILE|MAP_PRIVATE, fd, 0);
	if (vp == MAP_FAILED)
		err(1, "mmap");

	if (mlock(vp, mapsize))
		err(1, "mlock");
		
	if (write(STDOUT_FILENO, vp, mapsize) == -1)
		err(1, "write");
}
----------
>Fix:
	if the page is wired, copy it instead of loaning out?

>Release-Note:
>Audit-Trail:
>Unformatted: