Lock the vm_object when performing vm_pager_deallocate().

4 files changed, 11 insertions, 6 deletions

diff --git a/sys/vm/swap_pager.c b/sys/vm/swap_pager.c
index b21d6ac..fcb7a09 100644
--- a/sys/vm/swap_pager.c
+++ b/sys/vm/swap_pager.c
@@ -428,9 +428,8 @@ swap_pager_dealloc(object)
 	}
 	mtx_unlock(&sw_alloc_mtx);
 
-	VM_OBJECT_LOCK(object);
+	VM_OBJECT_LOCK_ASSERT(object, MA_OWNED);
 	vm_object_pip_wait(object, "swpdea");
-	VM_OBJECT_UNLOCK(object);
 
 	/*
 	 * Free all remaining metadata.  We only bother to free it from 
diff --git a/sys/vm/vm_object.c b/sys/vm/vm_object.c
index dc33f00..4e1f037 100644
--- a/sys/vm/vm_object.c
+++ b/sys/vm/vm_object.c
@@ -600,12 +600,12 @@ vm_object_terminate(vm_object_t object)
 	}
 	vm_page_unlock_queues();
 	splx(s);
-	VM_OBJECT_UNLOCK(object);
 
 	/*
 	 * Let the pager know object is dead.
 	 */
 	vm_pager_deallocate(object);
+	VM_OBJECT_UNLOCK(object);
 
 	/*
 	 * Remove the object from the global object list.
diff --git a/sys/vm/vm_pager.c b/sys/vm/vm_pager.c
index 46bdd41..5747930 100644
--- a/sys/vm/vm_pager.c
+++ b/sys/vm/vm_pager.c
@@ -256,10 +256,15 @@ vm_pager_allocate(objtype_t type, void *handle, vm_ooffset_t size,
 	return (ret);
 }
 
+/*
+ *	The object must be locked.
+ */
 void
 vm_pager_deallocate(object)
 	vm_object_t object;
 {
+
+	VM_OBJECT_LOCK_ASSERT(object, MA_OWNED);
 	(*pagertab[object->type]->pgo_dealloc) (object);
 }
 
diff --git a/sys/vm/vnode_pager.c b/sys/vm/vnode_pager.c
index 8115908..60890e1 100644
--- a/sys/vm/vnode_pager.c
+++ b/sys/vm/vnode_pager.c
@@ -175,19 +175,20 @@ vnode_pager_alloc(void *handle, vm_ooffset_t size, vm_prot_t prot,
 	return (object);
 }
 
+/*
+ *	The object must be locked.
+ */
 static void
 vnode_pager_dealloc(object)
 	vm_object_t object;
 {
 	struct vnode *vp = object->handle;
 
-	GIANT_REQUIRED;
 	if (vp == NULL)
 		panic("vnode_pager_dealloc: pager already dealloced");
 
-	VM_OBJECT_LOCK(object);
+	VM_OBJECT_LOCK_ASSERT(object, MA_OWNED);
 	vm_object_pip_wait(object, "vnpdea");
-	VM_OBJECT_UNLOCK(object);
 
 	object->handle = NULL;
 	object->type = OBJT_DEAD;