Re: System call munmap returning with the following locks held: Giant

From: Kris Kennaway <kris_at_obsecurity.org>
Date: Thu, 19 Jan 2006 16:23:57 -0500
On Thu, Jan 19, 2006 at 02:38:33PM -0600, Alan Cox wrote:
> On Thu, Jan 19, 2006 at 11:14:24AM -0500, John Baldwin wrote:
> [snip]
> > 
> > Are you really sure the object's type can change or does the caller of 
> > vm_object_deallocate() hold some sort of reference or what not that prevents 
> > the type from changing?
> > 
> 
> My recollection is that the object does not change type until all of
> the references have been drained and it is about to be freed by
> vm_object_terminate().  At the point where the type check is being
> performed, the caller should hold a reference on the object.  Thus,
> the type should not be changing.
> 
> That said, an unexpected type change still strikes me as the most
> plausible cause.
> 
> Is there a test that easily reproduces this problem?

Racing mmap/munmap on NFS with umount -f.  I'll send you the code I'm
using (from ups_at_) separately.

Kris
Received on Thu Jan 19 2006 - 20:24:01 UTC

This archive was generated by hypermail 2.4.0 : Wed May 19 2021 - 11:38:51 UTC