Use pmap_remove_all() instead of pmap_remove() before freeing the page

in vm_pgmoveco(); the page may have more than one mapping.  Hold the page
queues lock when calling pmap_remove_all().

Approved by:	re (blanket)

1 files changed, 4 insertions, 5 deletions

diff --git a/sys/kern/kern_subr.c b/sys/kern/kern_subr.c
index 0656598..2df1a13 100644
--- a/sys/kern/kern_subr.c
+++ b/sys/kern/kern_subr.c
@@ -104,12 +104,11 @@ vm_pgmoveco(mapa, srcobj,  kaddr, uaddr)
 		return(EFAULT);
 	}
 	if ((user_pg = vm_page_lookup(uobject, upindex)) != NULL) {
-		vm_page_lock_queues();
-		if (!vm_page_sleep_if_busy(user_pg, 1, "vm_pgmoveco"))
-			vm_page_unlock_queues();
-		pmap_remove(map->pmap, uaddr, uaddr+PAGE_SIZE);
-		vm_page_lock_queues();
+		do
+			vm_page_lock_queues();
+		while (vm_page_sleep_if_busy(user_pg, 1, "vm_pgmoveco"));
 		vm_page_busy(user_pg);
+		pmap_remove_all(user_pg);
 		vm_page_free(user_pg);
 		vm_page_unlock_queues();
 	}