Re: sys/uvm: unwind failed amap copies
Mark Kettenis <[email protected]>
| Newsgroups | gmane.os.openbsd.tech |
|---|---|
| Message-ID | <[email protected]> |
> Date: Mon, 03 Aug 2026 01:23:08 +0200 > From: Kirill A. Korinsky <[email protected]> Hi Kirill, > > tech@, > > I continue my hunt on hangs and crashes at my very small octeon. > > Here the second finding from that a few days long sprint. > > A PR_NOWAIT chunk allocation in amap_copy() may fail after earlier > chunks already contain copied anons; amap_free() requires an empty amap, > so direct cleanup trips its diagnostic assertion or leaves copied anon > references orphaned which may end who knows how. > > Here, I use amap_wipeout() instead to reverse the partial copy, release > the shared lock, and free the temporary amap. > > Thought? > > Index: sys/uvm/uvm_amap.c > =================================================================== > RCS file: /home/cvs/src/sys/uvm/uvm_amap.c,v > diff -u -p -r1.99 uvm_amap.c > --- sys/uvm/uvm_amap.c 18 Jun 2026 13:14:26 -0000 1.99 > +++ sys/uvm/uvm_amap.c 2 Aug 2026 23:08:35 -0000 > @@ -640,10 +640,8 @@ amap_copy(struct vm_map *map, struct vm_ > > chunk = amap_chunk_get(amap, lcv, 1, PR_NOWAIT); > if (chunk == NULL) { > - amap_unlock(srcamap); > - /* Destroy the new amap. */ > - amap->am_ref--; > - amap_free(amap); > + amap->am_ref = 0; Why do you set am_ref to zero here instead of just decreasing it? > + amap_wipeout(amap); > return; > } > > > > -- > wbr, Kirill > >