- Lock the vm_object when performing swap_pager_isswapped().

 - Assert that the vm_object is locked in swap_pager_isswapped().

2 files changed, 17 insertions, 14 deletions

diff --git a/sys/vm/swap_pager.c b/sys/vm/swap_pager.c
index d68a465..b21d6ac 100644
--- a/sys/vm/swap_pager.c
+++ b/sys/vm/swap_pager.c
@@ -1648,6 +1648,7 @@ int swap_pager_isswapped(vm_object_t object, int devidx) {
 	int bcount;
 	int i;
 
+	VM_OBJECT_LOCK_ASSERT(object, MA_OWNED);
 	for (bcount = 0; bcount < object->un_pager.swp.swp_bcount; bcount++) {
 		struct swblock *swap;
 
diff --git a/sys/vm/vm_glue.c b/sys/vm/vm_glue.c
index e6d204e..765f23c 100644
--- a/sys/vm/vm_glue.c
+++ b/sys/vm/vm_glue.c
@@ -361,24 +361,26 @@ retry:
 	sx_slock(&allproc_lock);
 	FOREACH_PROC_IN_SYSTEM(p) {
 		PROC_LOCK(p);
-
 		object = p->p_upages_obj;
-		if (object != NULL &&
-		    swap_pager_isswapped(p->p_upages_obj, devidx)) {
-			sx_sunlock(&allproc_lock);
-			faultin(p);
-			PROC_UNLOCK(p);
+		if (object != NULL) {
 			VM_OBJECT_LOCK(object);
-			vm_page_lock_queues();
-			TAILQ_FOREACH(m, &object->memq, listq)
-				vm_page_dirty(m);
-			vm_page_unlock_queues();
-			swap_pager_freespace(object, 0,
-			    object->un_pager.swp.swp_bcount);
+			if (swap_pager_isswapped(object, devidx)) {
+				VM_OBJECT_UNLOCK(object);
+				sx_sunlock(&allproc_lock);
+				faultin(p);
+				PROC_UNLOCK(p);
+				VM_OBJECT_LOCK(object);
+				vm_page_lock_queues();
+				TAILQ_FOREACH(m, &object->memq, listq)
+					vm_page_dirty(m);
+				vm_page_unlock_queues();
+				swap_pager_freespace(object, 0,
+				    object->un_pager.swp.swp_bcount);
+				VM_OBJECT_UNLOCK(object);
+				goto retry;
+			}
 			VM_OBJECT_UNLOCK(object);
-			goto retry;
 		}
-
 		PROC_UNLOCK(p);
 	}
 	sx_sunlock(&allproc_lock);