*BSD News Article 13895


Return to BSD News archive

Path: sserve!newshost.anu.edu.au!munnari.oz.au!news.Hawaii.Edu!ames!agate!agate.berkeley.edu!cgd
From: cgd@eden.CS.Berkeley.EDU (Chris G. Demetriou)
Newsgroups: comp.os.386bsd.bugs
Subject: Re: kmem_map overflow with 0.2.2 kernel
Date: 1 Apr 93 21:06:11
Organization: Kernel Hackers 'r' Us
Lines: 36
Message-ID: <CGD.93Apr1210611@eden.CS.Berkeley.EDU>
References: <C4Kw3q.C6M@sugar.neosoft.com> <1993Mar31.075521.29358@amsteel.chel.su>
NNTP-Posting-Host: eden.cs.berkeley.edu
In-reply-to: ivans@amsteel.chel.su's message of Wed, 31 Mar 1993 07:55:21 GMT

In article <1993Mar31.075521.29358@amsteel.chel.su> ivans@amsteel.chel.su (Mike Ivans) writes:
>I  had  a similar problem while compiling X with sources on sparcstation,
>connected to my 386bsd box through NFS. I solved  the  problem  with  the
>help of the following patch for vm_kern.c:

that patch is incorrect.  (i don't know why it solved your problems;
perhaps you're really trashing memory elsewhere w/it installed...)

     |   In short, the M_WAITOK and M_NOWAIT flags passed to the kernel
     | memory allocator routines are converted to boolean TRUE/FALSE
     | values when passed in parameter "canwait" to kern_malloc.  The logic
     | in kern_malloc is incorrectly coded so that a panic is generated
     | if canwait is TRUE and a null is returned on the FALSE condition.
     | This is obviously backwards (even the comments indicate the correct
     | behaviour).  Basically the M_NOWAIT case is designed for interrupt
     | time allocational where a request must be satisfied immediately.
     | The vast majority of the allocations happen using M_WAITOK.

this is incorrect, because if "canwait" is *true* null should
*NEVER, EVER* be returned.  if "canwait" is false, then null
is an allowed return value, because kmem_malloc was told
to "return a pointer if you can, otherwise don't wait, and return null."

the panic is there in the canwait case (and is correct), because
kmem_malloc isn't supposed to return null, but the machinery
to have it wait in this case (whem *_map is full) was not written,
and so...  panic().



chris
--
Chris G. Demetriou                                    cgd@cs.berkeley.edu

   "386bsd as depth first search: whenever you go to fix something you
       find that 3 more things are actually broken." -- Adam Glass