- Do not swap out a process if it is in creation. The process may have no

  address space yet.

- Check whether a process is a system process prior to dereferencing
  its p_vmspace.  Aio assumes that only the curthread switches the address
  space of a system process.

1 files changed, 24 insertions, 0 deletions

diff --git a/sys/vm/vm_glue.c b/sys/vm/vm_glue.c
index 8e3f5c6..41e1719 100644
--- a/sys/vm/vm_glue.c
+++ b/sys/vm/vm_glue.c
@@ -675,9 +675,33 @@ retry:
 		 * finishes, or a thread of this
 		 * process may attempt to alter
 		 * the map.
+		 *
+		 * Watch out for a process in
+		 * creation.  It may have no
+		 * address space yet.
+		 *
+		 * An aio daemon switches its
+		 * address space while running.
+		 * Perform a quick check whether
+		 * a process has P_SYSTEM.
 		 */
+		PROC_LOCK(p);
+		if ((p->p_flag & P_SYSTEM) != 0) {
+			PROC_UNLOCK(p);
+			continue;
+		}
+		mtx_lock_spin(&sched_lock);
+		if (p->p_state == PRS_NEW) {
+			mtx_unlock_spin(&sched_lock);
+			PROC_UNLOCK(p);
+			continue;
+		}
 		vm = p->p_vmspace;
+		KASSERT(vm != NULL,
+			("swapout_procs: a process has no address space"));
 		++vm->vm_refcnt;
+		mtx_unlock_spin(&sched_lock);
+		PROC_UNLOCK(p);
 		if (!vm_map_trylock(&vm->vm_map))
 			goto nextproc1;