From: Matthew Dillon <dillon@apollo.backplane.com>
Date: Thu, 16 Aug 2012 17:46:33 +0000 (-0700)
Subject: kernel - Fix long-standing vm_map token panic
X-Git-Tag: v3.0.3~6
X-Git-Url: http://gitweb.dragonflybsd.org/dragonfly.git/commitdiff_plain/c4ad22e2259588e2e420164d97c938c437adbc87

kernel - Fix long-standing vm_map token panic

* Bug turned out to be an error path in vm_map_find().

* This bug ate a lot of hours from several people, but Antonio was able
  to instrument the token path in a way that allowed us to narrow down
  and locate the problem.

Submitted-by: tuxillo, vsrinivas
Debugging-by: tuxillo
---

diff --git a/sys/vm/vm_map.c b/sys/vm/vm_map.c
index e3fd77e..a1da959 100644
--- a/sys/vm/vm_map.c
+++ b/sys/vm/vm_map.c
@@ -1266,6 +1266,8 @@ vm_map_find(vm_map_t map, vm_object_t object, vm_ooffset_t offset,
 		vm_object_hold(object);
 	if (fitit) {
 		if (vm_map_findspace(map, start, length, align, 0, addr)) {
+			if (object)
+				vm_object_drop(object);
 			vm_map_unlock(map);
 			vm_map_entry_release(count);
 			return (KERN_NO_SPACE);