diff options
| author | kib <kib@FreeBSD.org> | 2013-11-05 06:18:50 +0000 |
|---|---|---|
| committer | kib <kib@FreeBSD.org> | 2013-11-05 06:18:50 +0000 |
| commit | 79db892faa1963ba60f829d6a2e8aee17c2ff309 (patch) | |
| tree | b9cf90f81efe4898c5f3585b2b371e01ebd11ae1 /sys/vm | |
| parent | 2547e15155fd59763fe0345fe46b8a6735448230 (diff) | |
| download | FreeBSD-src-79db892faa1963ba60f829d6a2e8aee17c2ff309.zip FreeBSD-src-79db892faa1963ba60f829d6a2e8aee17c2ff309.tar.gz | |
Do not coalesce if the swap object belongs to tmpfs vnode. The
coalesce would extend the object to keep pages for the anonymous
mapping created by the process. The pages has no relations to the
tmpfs file content which could be written into the corresponding
range, causing anonymous mapping and file content aliasing and
subsequent corruption.
Another lesser problem created by coalescing is over-accounting on the
tmpfs node destruction, since the object size is substracted from the
total count of the pages owned by the tmpfs mount.
Reported and tested by: bdrewery
Sponsored by: The FreeBSD Foundation
MFC after: 1 week
Diffstat (limited to 'sys/vm')
| -rw-r--r-- | sys/vm/vm_object.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/sys/vm/vm_object.c b/sys/vm/vm_object.c index 9dea3a1..8683e2f 100644 --- a/sys/vm/vm_object.c +++ b/sys/vm/vm_object.c @@ -2099,8 +2099,9 @@ vm_object_coalesce(vm_object_t prev_object, vm_ooffset_t prev_offset, if (prev_object == NULL) return (TRUE); VM_OBJECT_WLOCK(prev_object); - if (prev_object->type != OBJT_DEFAULT && - prev_object->type != OBJT_SWAP) { + if ((prev_object->type != OBJT_DEFAULT && + prev_object->type != OBJT_SWAP) || + (prev_object->flags & OBJ_TMPFS) != 0) { VM_OBJECT_WUNLOCK(prev_object); return (FALSE); } |
