VM-related lock order reversal

Got this today while stressing the system out, trying to reproduce a nullfs
deadlock:

lock order reversal
 1st 0xc103d940 vm object (vm object) _at_ /usr/p4/tjr/src/sys/vm/vm_map.c:2148
 2nd 0xc042f110 system map (system map) _at_ /usr/p4/tjr/src/sys/vm/vm_kern.c:325

In case the line numbers in my tree are slightly out of sync:

vm_map.c:2148 is in vm_map_delete():
  2143                  if (object->ref_count != 1 &&
  2144                      (object->flags & (OBJ_NOSPLIT|OBJ_ONEMAPPING)) == OBJ_ONEMAPPING &&
  2145                      (object->type == OBJT_DEFAULT || object->type == OBJT_SWAP)) {
  2146                      VM_OBJECT_UNLOCK(object);
  2147                      vm_object_collapse(object);
  2148                      VM_OBJECT_LOCK(object);
  2149                      vm_object_page_remove(object, offidxstart, offidxend, FALSE);
  2150                      if (object->type == OBJT_SWAP)
  2151                          swap_pager_freespace(object, offidxstart, count);

vm_kern.c:325 is in kmem_malloc():
   320      /*
   321       * Locate sufficient space in the map.  This will give us the final
   322       * virtual address for the new memory, and thus will tell us the
   323       * offset within the kernel map.
   324       */
   325      vm_map_lock(map);
   326      if (vm_map_findspace(map, vm_map_min(map), size, &addr)) {
   327          vm_map_unlock(map);
   328          if (map != kmem_map) {
   329              static int last_report; /* when we did it (in ticks) */

Kernel config is GENERIC minus a few things, plus WITNESS, WITNESS_SKIPSPIN,
INVARIANTS, INVARIANTS_SUPPORT, DEBUG_VFS_LOCKS, and DIAGNOSTIC.


Tim