Lock the vm object when removing a page.

2 files changed, 5 insertions, 0 deletions

diff --git a/sys/kern/uipc_jumbo.c b/sys/kern/uipc_jumbo.c
index 0956a86..8a7c546 100644
--- a/sys/kern/uipc_jumbo.c
+++ b/sys/kern/uipc_jumbo.c
@@ -222,6 +222,7 @@ jumbo_pg_free(vm_offset_t addr)
 	paddr = pmap_kextract((vm_offset_t)addr);
 	pg = PHYS_TO_VM_PAGE(paddr);
 
+	VM_OBJECT_LOCK(jumbo_vm_object);
 	if (pg->object != jumbo_vm_object) {
 		jumbo_vmuiomove_pgs_freed++;
 /*		if(vm_page_lookup(jumbo_vm_object, atop(addr - jumbo_basekva)))
@@ -235,6 +236,7 @@ jumbo_pg_free(vm_offset_t addr)
 		vm_page_free(pg);
 		vm_page_unlock_queues();
 	}
+	VM_OBJECT_UNLOCK(jumbo_vm_object);
 
 	mtx_lock(&jumbo_mutex);
 
diff --git a/sys/kern/uipc_syscalls.c b/sys/kern/uipc_syscalls.c
index aa687eb..4a49f8c 100644
--- a/sys/kern/uipc_syscalls.c
+++ b/sys/kern/uipc_syscalls.c
@@ -1926,6 +1926,8 @@ retry_lookup:
 			    IO_VMIO | ((MAXBSIZE / bsize) << 16),
 			    td->td_ucred, NOCRED, &resid, td);
 			VOP_UNLOCK(vp, 0, td);
+			if (error)
+				VM_OBJECT_LOCK(obj);  
 			vm_page_lock_queues();
 			vm_page_flag_clear(pg, PG_ZERO);
 			vm_page_io_finish(pg);
@@ -1942,6 +1944,7 @@ retry_lookup:
 					vm_page_free(pg);
 				}
 				vm_page_unlock_queues();
+				VM_OBJECT_UNLOCK(obj);
 				sbunlock(&so->so_snd);
 				goto done;
 			}