1 files changed, 27 insertions, 21 deletions

diff --git a/sys/fs/tmpfs/tmpfs_vnops.c b/sys/fs/tmpfs/tmpfs_vnops.c
index bddcf24..8107ae1 100644
--- a/sys/fs/tmpfs/tmpfs_vnops.c
+++ b/sys/fs/tmpfs/tmpfs_vnops.c
@@ -511,7 +511,6 @@ tmpfs_mappedread(vm_object_t vobj, vm_object_t tobj, size_t len, struct uio *uio
 	offset = addr & PAGE_MASK;
 	tlen = MIN(PAGE_SIZE - offset, len);
 
-	VM_OBJECT_LOCK(vobj);
 lookupvpg:
 	if (((m = vm_page_lookup(vobj, idx)) != NULL) &&
 	    vm_page_is_valid(m, offset, tlen)) {
@@ -634,29 +633,36 @@ tmpfs_mappedwrite(vm_object_t vobj, vm_object_t tobj, size_t len, struct uio *ui
 	offset = addr & PAGE_MASK;
 	tlen = MIN(PAGE_SIZE - offset, len);
 
-	VM_OBJECT_LOCK(vobj);
 lookupvpg:
-	if (((vpg = vm_page_lookup(vobj, idx)) != NULL) &&
-	    vm_page_is_valid(vpg, offset, tlen)) {
-		if ((vpg->oflags & VPO_BUSY) != 0) {
-			/*
-			 * Reference the page before unlocking and sleeping so
-			 * that the page daemon is less likely to reclaim it.  
-			 */
-			vm_page_reference(vpg);
-			vm_page_sleep(vpg, "tmfsmw");
-			goto lookupvpg;
+	vpg = vm_radix_lookup(&vobj->rtree, idx, VM_RADIX_ANY);
+	if (vpg != NULL) {
+		if (vm_page_is_valid(vpg, offset, tlen)) {
+			if ((vpg->oflags & VPO_BUSY) != 0) {
+				/*
+				 * Reference the page before unlocking and
+				 * sleeping so that the page daemon is less
+				 * likely to reclaim it.  
+			 	*/
+				vm_page_reference(vpg);
+				vm_page_sleep(vpg, "tmfsmw");
+				goto lookupvpg;
+			}
+			vm_page_busy(vpg);
+			vm_page_undirty(vpg);
+			VM_OBJECT_UNLOCK(vobj);
+			error = uiomove_fromphys(&vpg, offset, tlen, uio);
+		} else {
+			if (vpg->flags & PG_CACHED) {
+				mtx_lock(&vm_page_queue_free_mtx);
+				if (vpg->object == vobj)
+					vm_page_cache_free(vpg);
+				mtx_unlock(&vm_page_queue_free_mtx);
+			}
+			VM_OBJECT_UNLOCK(vobj);
+			vpg = NULL;
 		}
-		vm_page_busy(vpg);
-		vm_page_undirty(vpg);
-		VM_OBJECT_UNLOCK(vobj);
-		error = uiomove_fromphys(&vpg, offset, tlen, uio);
-	} else {
-		if (vm_page_is_cached(vobj, idx))
-			vm_page_cache_free(vobj, idx, idx + 1);
+	} else
 		VM_OBJECT_UNLOCK(vobj);
-		vpg = NULL;
-	}
 	VM_OBJECT_LOCK(tobj);
 	tpg = vm_page_grab(tobj, idx, VM_ALLOC_WIRED |
 	    VM_ALLOC_NORMAL | VM_ALLOC_RETRY);