Addendum to revision 1.174: In the case where vm_pager_allocate() is called

to create a vnode-backed object, the vnode lock must be held by the caller.

Reported by:	truckman
Discussed with:	kan

1 files changed, 6 insertions, 2 deletions

diff --git a/sys/vm/vm_mmap.c b/sys/vm/vm_mmap.c
index c210a8d..987318d 100644
--- a/sys/vm/vm_mmap.c
+++ b/sys/vm/vm_mmap.c
@@ -1223,6 +1223,8 @@ vm_mmap(vm_map_t map, vm_offset_t *addr, vm_size_t size, vm_prot_t prot,
 		if (vp->v_type == VCHR) {
 			type = OBJT_DEVICE;
 			handle = vp->v_rdev;
+			vput(vp);
+			mtx_unlock(&Giant);
 		} else {
 			struct vattr vat;
 
@@ -1242,8 +1244,6 @@ vm_mmap(vm_map_t map, vm_offset_t *addr, vm_size_t size, vm_prot_t prot,
 				flags |= MAP_NOSYNC;
 			}
 		}
-		vput(vp);
-		mtx_unlock(&Giant);
 	}
 
 	if (handle == NULL) {
@@ -1252,6 +1252,10 @@ vm_mmap(vm_map_t map, vm_offset_t *addr, vm_size_t size, vm_prot_t prot,
 	} else {
 		object = vm_pager_allocate(type,
 			handle, objsize, prot, foff);
+		if (type == OBJT_VNODE) {
+			vput(vp);
+			mtx_unlock(&Giant);
+		}
 		if (object == NULL) {
 			return (type == OBJT_DEVICE ? EINVAL : ENOMEM);
 		}