[src/trunk]: src/sys/arch/x86/x86 pmap_get_ptp(): the uvm_pagefree() call in ...

[ad <ad%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/6cad1cdf8295
branches:  trunk
changeset: 847420:6cad1cdf8295
user:      ad <ad%NetBSD.org@localhost>
date:      Sun Dec 22 15:15:20 2019 +0000

description:
pmap_get_ptp(): the uvm_pagefree() call in the failure case can block too.
Pacify the assertion in pmap_unmap_ptes().

XXX Revisit and solve this chicken-and-egg problem in a more elegant way.

Reported-by: syzbot+24967905b8d17344581c%syzkaller.appspotmail.com@localhost

diffstat:

 sys/arch/x86/x86/pmap.c |  9 ++++-----
 1 files changed, 4 insertions(+), 5 deletions(-)

diffs (39 lines):

diff -r 07634c72440f -r 6cad1cdf8295 sys/arch/x86/x86/pmap.c
--- a/sys/arch/x86/x86/pmap.c   Sun Dec 22 15:09:39 2019 +0000
+++ b/sys/arch/x86/x86/pmap.c   Sun Dec 22 15:15:20 2019 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: pmap.c,v 1.347 2019/12/21 13:00:24 ad Exp $    */
+/*     $NetBSD: pmap.c,v 1.348 2019/12/22 15:15:20 ad Exp $    */
 
 /*
  * Copyright (c) 2008, 2010, 2016, 2017, 2019 The NetBSD Foundation, Inc.
@@ -130,7 +130,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: pmap.c,v 1.347 2019/12/21 13:00:24 ad Exp $");
+__KERNEL_RCSID(0, "$NetBSD: pmap.c,v 1.348 2019/12/22 15:15:20 ad Exp $");
 
 #include "opt_user_ldt.h"
 #include "opt_lockdebug.h"
@@ -2120,8 +2120,6 @@
                        pt[i].new = true;
                        if (__predict_false(ncsw != lwp_pctr())) {
                                /* uvm_pagealloc can block. */
-                               /* XXX silence assertion in pmap_unmap_ptes */
-                               pmap->pm_ncsw = lwp_pctr();
                                error = EAGAIN;
                                goto fail;
                        }
@@ -2195,9 +2193,10 @@
                if (!pt[i].new) {
                        continue;
                }
-               obj = &pmap->pm_obj[i - 2];
                uvm_pagefree(pt[i].pg);
        }
+       /* XXX silence assertion in pmap_unmap_ptes */
+       pmap->pm_ncsw = lwp_pctr();
        return error;
 }