From 7f86d367e1e66db4e35e0721447d6318f78fd555 Mon Sep 17 00:00:00 2001
From: Matthew Dillon <dillon@apollo.backplane.com>
Date: Tue, 10 Jul 2012 20:15:37 -0700
Subject: [PATCH] kernel - Fix missing lock in pbuf update (minor)

* Fix a small timing window in an update of a counter.

* This bug is not known to have been hit by anyone, due to default
  settings for asynchronous I/O.
---
 sys/sys/buf.h       |  1 +
 sys/vm/swap_pager.c |  4 +---
 sys/vm/vm_pager.c   | 11 +++++++++++
 3 files changed, 13 insertions(+), 3 deletions(-)

diff --git a/sys/sys/buf.h b/sys/sys/buf.h
index ba033c6df0..aa5af8ca80 100644
--- a/sys/sys/buf.h
+++ b/sys/sys/buf.h
@@ -439,6 +439,7 @@ int	biowait_timeout (struct bio *, const char *, int);
 void	bpdone (struct buf *, int);
 void	biodone (struct bio *);
 void	biodone_sync (struct bio *);
+void	pbuf_adjcount(int *pfreecnt, int n);
 
 void	cluster_append(struct bio *, struct buf *);
 int	cluster_readx (struct vnode *, off_t, off_t, int,
diff --git a/sys/vm/swap_pager.c b/sys/vm/swap_pager.c
index 93f5bd4312..2ecedebc9d 100644
--- a/sys/vm/swap_pager.c
+++ b/sys/vm/swap_pager.c
@@ -1494,7 +1494,6 @@ swap_pager_putpages(vm_object_t object, vm_page_t *m, int count,
 	 * Update nsw parameters from swap_async_max sysctl values.  
 	 * Do not let the sysop crash the machine with bogus numbers.
 	 */
-
 	if (swap_async_max != nsw_wcount_async_max) {
 		int n;
 
@@ -1517,9 +1516,8 @@ swap_pager_putpages(vm_object_t object, vm_page_t *m, int count,
 		lwkt_gettoken(&vm_token);
 		n -= nsw_wcount_async_max;
 		if (nsw_wcount_async + n >= 0) {
-			nsw_wcount_async += n;
 			nsw_wcount_async_max += n;
-			wakeup(&nsw_wcount_async);
+			pbuf_adjcount(&nsw_wcount_async, n);
 		}
 		lwkt_reltoken(&vm_token);
 	}
diff --git a/sys/vm/vm_pager.c b/sys/vm/vm_pager.c
index 0002ef1be6..720e636f49 100644
--- a/sys/vm/vm_pager.c
+++ b/sys/vm/vm_pager.c
@@ -509,3 +509,14 @@ relpbuf(struct buf *bp, int *pfreecnt)
 	if (wake_freecnt)
 		wakeup(pfreecnt);
 }
+
+void
+pbuf_adjcount(int *pfreecnt, int n)
+{
+	if (n) {
+		spin_lock(&bswspin);
+		*pfreecnt += n;
+		spin_unlock(&bswspin);
+		wakeup(pfreecnt);
+	}
+}
-- 
2.41.0