Possible race in i386/i386/pmap.c:pmap_copy()

[Matt Dillon]

    Alfred, DG, could you take a look at pmap_copy() in i386/i386/pmap.c
    and tell me if what I think I'm seeing is what I'm seeing?

    My read of this code is that a global, APTDpde, is being set, and
    then that pointer is being used in a loop later on in the routine.
    the problem is that the pmap_allocpte() call can block and, by my
    read, that means some other process can go in and change APTDpde out
    from under the loop.

    This could also be related to problem Julian has been seeing with his
    KSE patch set.

    There is a comment:

                                /*
                                 * We have to check after allocpte for the
                                 * pte still being around...  allocpte can
                                 * block.
                                 */
                                dstmpte = pmap_allocpte(dst_pmap, addr);
                                if ((*dst_pte == 0) && (ptetemp = *src_pte)) {
                                        /*
                                         * Clear the modified and
                                        ...

    But I do not believe this check is sufficient if APTDpde gets ripped
    out from under the loop.  Is this race real or am I blowing smoke?

                                                -Matt


To Unsubscribe: send mail to [EMAIL PROTECTED]
with "unsubscribe freebsd-hackers" in the body of the message