Ignore object->handle for OBJ_ANON objects.

Note that the change in vm_object_collapse() is arguably a correctness fix. We must not collapse into content-identity carrying objects. Reviewed by: jeff Tested by: pho Sponsored by: The FreeBSD Foundation Differential revision: https://reviews.freebsd.org/D22467
kstardust · Nov 24, 2019 · b8d6a9a · b8d6a9a
1 parent c10c454
commit b8d6a9a
Show file tree

Hide file tree

Showing 2 changed files with 14 additions and 21 deletions.
diff --git a/sys/vm/vm_map.c b/sys/vm/vm_map.c
@@ -3764,8 +3764,7 @@ vm_map_copy_entry(
 		if ((src_object = src_entry->object.vm_object) != NULL) {
 			VM_OBJECT_WLOCK(src_object);
 			charged = ENTRY_CHARGED(src_entry);
-			if (src_object->handle == NULL &&
-			    (src_object->flags & OBJ_ANON) != 0) {
+			if ((src_object->flags & OBJ_ANON) != 0) {
 				vm_object_collapse(src_object);
 				if ((src_object->flags & OBJ_ONEMAPPING) != 0) {
 					vm_object_split(src_entry);

diff --git a/sys/vm/vm_object.c b/sys/vm/vm_object.c
@@ -530,7 +530,7 @@ vm_object_vndeallocate(vm_object_t object)
 void
 vm_object_deallocate(vm_object_t object)
 {
-	vm_object_t temp;
+	vm_object_t robject, temp;
 	bool released;
 
 	while (object != NULL) {
@@ -565,19 +565,17 @@ vm_object_deallocate(vm_object_t object)
 			return;
 		} else if (object->ref_count == 1) {
 			if (object->shadow_count == 0 &&
-			    object->handle == NULL &&
 			    (object->flags & OBJ_ANON) != 0) {
 				vm_object_set_flag(object, OBJ_ONEMAPPING);
-			} else if ((object->shadow_count == 1) &&
-			    (object->handle == NULL) &&
-			    (object->flags & OBJ_ANON) != 0) {
-				vm_object_t robject;
-
+			} else if (object->shadow_count == 1) {
+				KASSERT((object->flags & OBJ_ANON) != 0,
+				    ("obj %p with shadow_count > 0 is not anon",
+				    object));
 				robject = LIST_FIRST(&object->shadow_head);
 				KASSERT(robject != NULL,
-				    ("vm_object_deallocate: ref_count: %d, shadow_count: %d",
-					 object->ref_count,
-					 object->shadow_count));
+				    ("vm_object_deallocate: ref_count: %d, "
+				    "shadow_count: %d", object->ref_count,
+				    object->shadow_count));
 				KASSERT((robject->flags & OBJ_TMPFS_NODE) == 0,
 				    ("shadowed tmpfs v_object %p", object));
 				if (!VM_OBJECT_TRYWLOCK(robject)) {
@@ -602,8 +600,7 @@ vm_object_deallocate(vm_object_t object)
 				 * deallocating its shadow.
 				 */
 				if ((robject->flags &
-				    (OBJ_DEAD | OBJ_ANON)) == OBJ_ANON &&
-				    robject->handle == NULL) {
+				    (OBJ_DEAD | OBJ_ANON)) == OBJ_ANON) {
 
 					refcount_acquire(&robject->ref_count);
 retry:
@@ -1302,7 +1299,7 @@ vm_object_shadow(
 	 * will be collapsed later.
 	 */
 	if (source != NULL && source->ref_count == 1 &&
-	    source->handle == NULL && (source->flags & OBJ_ANON) != 0)
+	    (source->flags & OBJ_ANON) != 0)
 		return;
 
 	/*
@@ -1751,10 +1748,8 @@ vm_object_collapse(vm_object_t object)
 		if ((backing_object->flags & OBJ_ANON) == 0)
 			break;
 		VM_OBJECT_WLOCK(backing_object);
-		if (backing_object->handle != NULL ||
-		    (backing_object->flags & OBJ_DEAD) != 0 ||
-		    object->handle != NULL ||
-		    (object->flags & OBJ_DEAD) != 0) {
+		if ((backing_object->flags & OBJ_DEAD) != 0 ||
+		    (object->flags & (OBJ_DEAD | OBJ_ANON)) != OBJ_ANON) {
 			VM_OBJECT_WUNLOCK(backing_object);
 			break;
 		}
@@ -2549,8 +2544,7 @@ DB_SHOW_COMMAND(vmochk, vm_object_check)
 	 * and none have zero ref counts.
 	 */
 	TAILQ_FOREACH(object, &vm_object_list, object_list) {
-		if (object->handle == NULL &&
-		    (object->type == OBJT_DEFAULT || object->type == OBJT_SWAP)) {
+		if ((object->flags & OBJ_ANON) != 0) {
 			if (object->ref_count == 0) {
 				db_printf("vmochk: internal obj has zero ref count: %ld\n",
 					(long)object->size);