git: vm: fix cdev pager object lifecycle and allocation race

[Aaron LI]

commit 7119b8aef73957d0bc0b8dbaaef2a071eed31cdb
Author: Leding Li <lileding at gmail.com>
Date:   Sat Jul 11 02:50:54 2026 +0800

    vm: fix cdev pager object lifecycle and allocation race
    
    cdev_pager_allocate() previously called cdev_pg_ctor before looking up
    the object.  Repeated allocations therefore called a non-idempotent
    constructor multiple times for one allocated vm_object, while the
    destructor ran only once.
    
    In addition, cdev_pager_allocate() could race with other threads
    allocating an object.
    
    This commit fixes both problems.  Reserve a newly allocated object in
    the pager list with a NULL ops pointer while its constructor runs
    outside dev_pager_mtx.  Concurrent lookup and allocation callers wait
    for construction to finish.  Publish the ops pointer and wake them on
    success; remove and mark the object dead before waking them on failure.
    Use ops rather than dev as the construction sentinel because DragonFly
    has valid NULL-handle pager users.
    
    Derived-from: FreeBSD (commit e93404065177d6c909cd64bf7d74fe0d8df35edf)
    GitHub-PR: https://github.com/DragonFlyBSD/DragonFlyBSD/pull/49

Summary of changes:
 sys/vm/device_pager.c | 120 +++++++++++++++++++++++++++++++++++++-------------
 1 file changed, 89 insertions(+), 31 deletions(-)

http://gitweb.dragonflybsd.org/dragonfly.git/commitdiff/7119b8aef73957d0bc0b8dbaaef2a071eed31cdb


-- 
DragonFly BSD source repository