vm_object_pmap_remove: Also remove in the shadow object

Otherwise, when e.g. terminating tasks with shared mappings, some references
remain within the pv_head_table to pmap_t objects that had already been
destroyed.

1 files changed, 17 insertions, 1 deletions

diff --git a/vm/vm_object.c b/vm/vm_object.c
index 3e6b28c4..2dba76b1 100644
--- a/vm/vm_object.c
+++ b/vm/vm_object.c
@@ -986,12 +986,28 @@ void vm_object_pmap_remove(
 		return;
 
 	vm_object_lock(object);
-	queue_iterate(&object->memq, p, vm_page_t, listq) {
+
+	while (TRUE) {
+	     queue_iterate(&object->memq, p, vm_page_t, listq) {
 		if (!p->fictitious &&
 		    (start <= p->offset) &&
 		    (p->offset < end))
 			pmap_page_protect(p->phys_addr, VM_PROT_NONE);
+	     }
+
+	     if (object->shadow == VM_OBJECT_NULL)
+	       break;
+
+	     vm_object_t prev_object = object;
+
+	     start += object->shadow_offset;
+	     end   += object->shadow_offset;
+	     object = object->shadow;
+
+	     vm_object_lock(object);
+	     vm_object_unlock(prev_object);
 	}
+
 	vm_object_unlock(object);
 }