From dd00f6f349508aeb03c8d223eb2f59c748a666c9 Mon Sep 17 00:00:00 2001 From: Matthew Dillon Date: Fri, 12 Feb 2010 22:06:06 -0800 Subject: [PATCH] kernel - fix bug in objcache_destroy() * objcache_destroy() calls mag_purge() which cycles the critical section, except objecache_destroy() never entered into a critical section so this panics instead. --- sys/kern/kern_objcache.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/sys/kern/kern_objcache.c b/sys/kern/kern_objcache.c index febdb61782..c1e88e2049 100644 --- a/sys/kern/kern_objcache.c +++ b/sys/kern/kern_objcache.c @@ -719,10 +719,12 @@ maglist_purge(struct objcache *oc, struct magazinelist *maglist) * can't use SLIST_FOREACH because blocking releases the depot * spinlock */ + crit_enter(); while ((mag = SLIST_FIRST(maglist)) != NULL) { SLIST_REMOVE_HEAD(maglist, nextmagazine); count += mag_purge(oc, mag, TRUE); } + crit_exit(); return(count); } @@ -841,8 +843,10 @@ objcache_destroy(struct objcache *oc) for (cpuid = 0; cpuid < ncpus; cpuid++) { cache_percpu = &oc->cache_percpu[cpuid]; + crit_enter(); mag_purge(oc, cache_percpu->loaded_magazine, TRUE); mag_purge(oc, cache_percpu->previous_magazine, TRUE); + crit_exit(); cache_percpu->loaded_magazine = NULL; cache_percpu->previous_magazine = NULL; /* don't bother adjusting depot->unallocated_objects */ @@ -881,7 +885,9 @@ objcache_populate_linear(struct objcache *oc, void *base, int nelts, int size) p += size; } if (MAGAZINE_EMPTY(emptymag)) { + crit_enter(); mag_purge(oc, emptymag, TRUE); + crit_exit(); } else { spin_lock_wr(&depot->spin); SLIST_INSERT_HEAD(&depot->fullmagazines, emptymag, -- 2.41.0