It is possible for an active aio to prevent shared memory from being

dereferenced when a process exits due to the vmspace ref-count being
bumped.  Change shmexit() and shmexit_myhook() to take a vmspace instead
of a process and call it in vmspace_dofree().  This way if it is missed
in exit1()'s early-resource-free it will still be caught when the zombie is
reaped.

Also fix a potential race in shmexit_myhook() by NULLing out
vmspace->vm_shm prior to calling shm_delete_mapping() and free().

MFC after:	7 days

1 files changed, 8 insertions, 0 deletions

diff --git a/sys/vm/vm_map.c b/sys/vm/vm_map.c
index 97d7c6d..6c53b7f 100644
--- a/sys/vm/vm_map.c
+++ b/sys/vm/vm_map.c
@@ -80,6 +80,7 @@
 #include <sys/resourcevar.h>
 #include <sys/sysent.h>
 #include <sys/stdint.h>
+#include <sys/shm.h>
 
 #include <vm/vm.h>
 #include <vm/vm_param.h>
@@ -284,6 +285,13 @@ static __inline void
 vmspace_dofree(struct vmspace *vm)
 {
 	CTR1(KTR_VM, "vmspace_free: %p", vm);
+
+	/*
+	 * Make sure any SysV shm is freed, it might not have been in
+	 * exit1().
+	 */
+	shmexit(vm);
+
 	/*
 	 * Lock the map, to wait out all other references to it.
 	 * Delete all of the mappings and pages they hold, then call