diff options
| author | bmilekic <bmilekic@FreeBSD.org> | 2004-06-09 19:18:50 +0000 |
|---|---|---|
| committer | bmilekic <bmilekic@FreeBSD.org> | 2004-06-09 19:18:50 +0000 |
| commit | 1edc23feaad96fde62e176b34b55074f2c42f1c4 (patch) | |
| tree | 2642e88b94f9d20c2a13881194c2d583ae3106ea /sys | |
| parent | c298d11504ba291b24d865b166403192861c70ba (diff) | |
| download | FreeBSD-src-1edc23feaad96fde62e176b34b55074f2c42f1c4.zip FreeBSD-src-1edc23feaad96fde62e176b34b55074f2c42f1c4.tar.gz | |
Make the slabrefzone, the zone from which we allocated slabs with
internal reference counters, UMA_ZONE_NOFREE. This way, those slabs
(with their ref counts) will be effectively type-stable, then using
a trick like this on the refcount is no longer dangerous:
MEXT_REM_REF(m);
if (atomic_cmpset_int(m->m_ext.ref_cnt, 0, 1)) {
if (m->m_ext.ext_type == EXT_PACKET) {
uma_zfree(zone_pack, m);
return;
} else if (m->m_ext.ext_type == EXT_CLUSTER) {
uma_zfree(zone_clust, m->m_ext.ext_buf);
m->m_ext.ext_buf = NULL;
} else {
(*(m->m_ext.ext_free))(m->m_ext.ext_buf,
m->m_ext.ext_args);
if (m->m_ext.ext_type != EXT_EXTREF)
free(m->m_ext.ref_cnt, M_MBUF);
}
}
uma_zfree(zone_mbuf, m);
Previously, a second thread hitting the above cmpset might
actually read the refcnt AFTER it has already been freed. A very
rare occurance. Now we'll know that it won't be freed, though.
Spotted by: julian, pjd
Diffstat (limited to 'sys')
| -rw-r--r-- | sys/vm/uma_core.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/sys/vm/uma_core.c b/sys/vm/uma_core.c index 82d60c6..687886d 100644 --- a/sys/vm/uma_core.c +++ b/sys/vm/uma_core.c @@ -1473,7 +1473,8 @@ uma_startup(void *bootmem) slabrefzone = uma_zcreate("UMA RCntSlabs", slabsize, NULL, NULL, NULL, NULL, - UMA_ALIGN_PTR, UMA_ZFLAG_INTERNAL); + UMA_ALIGN_PTR, + UMA_ZFLAG_INTERNAL|UMA_ZONE_NOFREE); hashzone = uma_zcreate("UMA Hash", sizeof(struct slabhead *) * UMA_HASH_SIZE_INIT, |
