DragonFlyBSD Kernel Audit
DF-0953 / fix.diff
← back to finding ↓ download raw
diff --git a/sys/vm/vm_pager.c b/sys/vm/vm_pager.c
--- a/sys/vm/vm_pager.c
+++ b/sys/vm/vm_pager.c
@@ -642,10 +642,11 @@
 		KKASSERT(bp->b_kvabase);
 		spin_lock(&bswspin_mem[iter]);
 		TAILQ_INSERT_HEAD(&bswlist_mem[iter], bp, b_freelist);
-		if (atomic_fetchadd_int(&pbuf_mem_count, 1) == nswbuf_mem / 4)
+		if (atomic_fetchadd_int(&pbuf_mem_count, 1) == 0 ||
+		    atomic_fetchadd_int(&pbuf_mem_count, 1) == nswbuf_mem / 4)
 			wake = 1;
 		if (pfreecnt) {
-			if (atomic_fetchadd_int(pfreecnt, 1) == 1)
+			if (atomic_fetchadd_int(pfreecnt, 1) == 0)
 				wake_free = 1;
 		}
 		spin_unlock(&bswspin_mem[iter]);
@@ -656,10 +657,11 @@
 		CPUMASK_ASSZERO(bp->b_cpumask);
 		spin_lock(&bswspin_kva[iter]);
 		TAILQ_INSERT_HEAD(&bswlist_kva[iter], bp, b_freelist);
-		if (atomic_fetchadd_int(&pbuf_kva_count, 1) == nswbuf_kva / 4)
+		if (atomic_fetchadd_int(&pbuf_kva_count, 1) == 0 ||
+		    atomic_fetchadd_int(&pbuf_kva_count, 1) == nswbuf_kva / 4)
 			wake = 1;
 		if (pfreecnt) {
-			if (atomic_fetchadd_int(pfreecnt, 1) == 1)
+			if (atomic_fetchadd_int(pfreecnt, 1) == 0)
 				wake_free = 1;
 		}
 		spin_unlock(&bswspin_kva[iter]);
@@ -671,10 +673,11 @@
 		CPUMASK_ASSZERO(bp->b_cpumask);
 		spin_lock(&bswspin_raw[iter]);
 		TAILQ_INSERT_HEAD(&bswlist_raw[iter], bp, b_freelist);
-		if (atomic_fetchadd_int(&pbuf_raw_count, 1) == nswbuf_raw / 4)
+		if (atomic_fetchadd_int(&pbuf_raw_count, 1) == 0 ||
+		    atomic_fetchadd_int(&pbuf_raw_count, 1) == nswbuf_raw / 4)
 			wake = 1;
 		if (pfreecnt) {
-			if (atomic_fetchadd_int(pfreecnt, 1) == 1)
+			if (atomic_fetchadd_int(pfreecnt, 1) == 0)
 				wake_free = 1;
 		}
 		spin_unlock(&bswspin_raw[iter]);