Lock the page around vm_page_activate() and vm_page_deactivate() calls

where it was missed. The wrapped fragments now protect wire_count with
page lock.

Reviewed by:	alc

5 files changed, 26 insertions, 8 deletions

diff --git a/sys/dev/md/md.c b/sys/dev/md/md.c
index 78f2af3..edd687f 100644
--- a/sys/dev/md/md.c
+++ b/sys/dev/md/md.c
@@ -665,11 +665,13 @@ mdstart_swap(struct md_s *sc, struct bio *bp)
 		sf_buf_free(sf);
 		sched_unpin();
 		vm_page_wakeup(m);
+		vm_page_lock(m);
 		vm_page_lock_queues();
 		vm_page_activate(m);
 		if (bp->bio_cmd == BIO_WRITE)
 			vm_page_dirty(m);
 		vm_page_unlock_queues();
+		vm_page_unlock(m);
 
 		/* Actions on further pages start at offset 0 */
 		p += PAGE_SIZE - offs;
diff --git a/sys/fs/nfsclient/nfs_clbio.c b/sys/fs/nfsclient/nfs_clbio.c
index 2401c88..e23da72 100644
--- a/sys/fs/nfsclient/nfs_clbio.c
+++ b/sys/fs/nfsclient/nfs_clbio.c
@@ -192,12 +192,14 @@ ncl_getpages(struct vop_getpages_args *ap)
 
 	size = count - uio.uio_resid;
 	VM_OBJECT_LOCK(object);
-	vm_page_lock_queues();
 	for (i = 0, toff = 0; i < npages; i++, toff = nextoff) {
 		vm_page_t m;
 		nextoff = toff + PAGE_SIZE;
 		m = pages[i];
 
+		vm_page_lock(m);
+		vm_page_lock_queues();
+
 		if (nextoff <= size) {
 			/*
 			 * Read operation filled an entire page
@@ -244,8 +246,10 @@ ncl_getpages(struct vop_getpages_args *ap)
 				vm_page_free(m);
 			}
 		}
+
+		vm_page_unlock_queues();
+		vm_page_unlock(m);
 	}
-	vm_page_unlock_queues();
 	VM_OBJECT_UNLOCK(object);
 	return (0);
 }
diff --git a/sys/fs/nwfs/nwfs_io.c b/sys/fs/nwfs/nwfs_io.c
index 75b1c18..ef1c800 100644
--- a/sys/fs/nwfs/nwfs_io.c
+++ b/sys/fs/nwfs/nwfs_io.c
@@ -449,12 +449,14 @@ nwfs_getpages(ap)
 
 	size = count - uio.uio_resid;
 
-	vm_page_lock_queues();
 	for (i = 0, toff = 0; i < npages; i++, toff = nextoff) {
 		vm_page_t m;
 		nextoff = toff + PAGE_SIZE;
 		m = pages[i];
 
+		vm_page_lock(m);
+		vm_page_lock_queues();
+
 		if (nextoff <= size) {
 			m->valid = VM_PAGE_BITS_ALL;
 			KASSERT(m->dirty == 0,
@@ -489,8 +491,10 @@ nwfs_getpages(ap)
 				vm_page_free(m);
 			}
 		}
+
+		vm_page_unlock_queues();
+		vm_page_unlock(m);
 	}
-	vm_page_unlock_queues();
 	VM_OBJECT_UNLOCK(object);
 	return 0;
 #endif /* NWFS_RWCACHE */
diff --git a/sys/fs/smbfs/smbfs_io.c b/sys/fs/smbfs/smbfs_io.c
index df779a6..6537ed4 100644
--- a/sys/fs/smbfs/smbfs_io.c
+++ b/sys/fs/smbfs/smbfs_io.c
@@ -500,12 +500,14 @@ smbfs_getpages(ap)
 
 	size = count - uio.uio_resid;
 
-	vm_page_lock_queues();
 	for (i = 0, toff = 0; i < npages; i++, toff = nextoff) {
 		vm_page_t m;
 		nextoff = toff + PAGE_SIZE;
 		m = pages[i];
 
+		vm_page_lock(m);
+		vm_page_lock_queues();
+
 		if (nextoff <= size) {
 			/*
 			 * Read operation filled an entire page
@@ -553,8 +555,10 @@ smbfs_getpages(ap)
 				vm_page_free(m);
 			}
 		}
+
+		vm_page_unlock_queues();
+		vm_page_unlock(m);
 	}
-	vm_page_unlock_queues();
 	VM_OBJECT_UNLOCK(object);
 	return 0;
 #endif /* SMBFS_RWGENERIC */
diff --git a/sys/nfsclient/nfs_bio.c b/sys/nfsclient/nfs_bio.c
index cec0220..3a0705e 100644
--- a/sys/nfsclient/nfs_bio.c
+++ b/sys/nfsclient/nfs_bio.c
@@ -189,12 +189,14 @@ nfs_getpages(struct vop_getpages_args *ap)
 
 	size = count - uio.uio_resid;
 	VM_OBJECT_LOCK(object);
-	vm_page_lock_queues();
 	for (i = 0, toff = 0; i < npages; i++, toff = nextoff) {
 		vm_page_t m;
 		nextoff = toff + PAGE_SIZE;
 		m = pages[i];
 
+		vm_page_lock(m);
+		vm_page_lock_queues();
+
 		if (nextoff <= size) {
 			/*
 			 * Read operation filled an entire page
@@ -241,8 +243,10 @@ nfs_getpages(struct vop_getpages_args *ap)
 				vm_page_free(m);
 			}
 		}
+
+		vm_page_unlock_queues();
+		vm_page_unlock(m);
 	}
-	vm_page_unlock_queues();
 	VM_OBJECT_UNLOCK(object);
 	return (0);
 }