- Hold the page queues lock around vm_page_wakeup().

3 files changed, 10 insertions, 3 deletions

diff --git a/sys/vm/vm_glue.c b/sys/vm/vm_glue.c
index e38b3d3..81451c1 100644
--- a/sys/vm/vm_glue.c
+++ b/sys/vm/vm_glue.c
@@ -227,9 +227,11 @@ vm_proc_new(struct proc *p)
 		    VM_ALLOC_NORMAL | VM_ALLOC_RETRY | VM_ALLOC_WIRED);
 		ma[i] = m;
 
+		vm_page_lock_queues();
 		vm_page_wakeup(m);
 		vm_page_flag_clear(m, PG_ZERO);
 		m->valid = VM_PAGE_BITS_ALL;
+		vm_page_unlock_queues();
 	}
 
 	/*
diff --git a/sys/vm/vm_kern.c b/sys/vm/vm_kern.c
index 3701082..f72bc32 100644
--- a/sys/vm/vm_kern.c
+++ b/sys/vm/vm_kern.c
@@ -200,9 +200,11 @@ kmem_alloc(map, size)
 				VM_ALLOC_ZERO | VM_ALLOC_RETRY);
 		if ((mem->flags & PG_ZERO) == 0)
 			pmap_zero_page(mem);
+		vm_page_lock_queues();
 		mem->valid = VM_PAGE_BITS_ALL;
 		vm_page_flag_clear(mem, PG_ZERO);
 		vm_page_wakeup(mem);
+		vm_page_unlock_queues();
 	}
 
 	/*
diff --git a/sys/vm/vm_object.c b/sys/vm/vm_object.c
index 7dca2ae..7a44bce 100644
--- a/sys/vm/vm_object.c
+++ b/sys/vm/vm_object.c
@@ -1256,8 +1256,10 @@ vm_object_split(vm_map_entry_t entry)
 		swap_pager_copy(orig_object, new_object, offidxstart, 0);
 		vm_object_pip_wakeup(orig_object);
 	}
+	vm_page_lock_queues();
 	TAILQ_FOREACH(m, &new_object->memq, listq)
 		vm_page_wakeup(m);
+	vm_page_unlock_queues();
 	entry->object.vm_object = new_object;
 	entry->offset = 0LL;
 	vm_object_deallocate(orig_object);
@@ -1940,14 +1942,15 @@ vm_freeze_copyopts(vm_object_t object, vm_pindex_t froma, vm_pindex_t toa)
 				pmap_remove_all(m_in);
 				vm_page_unlock_queues();
 				pmap_copy_page(m_in, m_out);
+				vm_page_lock_queues();
 				m_out->valid = m_in->valid;
 				vm_page_dirty(m_out);
-				vm_page_lock_queues();
 				vm_page_activate(m_out);
-				vm_page_unlock_queues();
 				vm_page_wakeup(m_in);
-			}
+			} else
+				vm_page_lock_queues();
 			vm_page_wakeup(m_out);
+			vm_page_unlock_queues();
 		}
 
 		object->shadow_count--;