> > but isn't it more generic uvm_vslock/unlock problem?
> > ie. anyone can modify the mapping between uvm_vslock and uvm_vsunlock.
> 
> that's a different problem, which requires multiple LWPs in one process
> to trigger (since I don't think we have any way for a process to modify
> the mappings of another process).  the problem at hand can happen even with
> traditional single-threaded programs.

your analysis (a fault overwrites wired mapping with non-wired one)
implies that the corresponding map entry is not wired, right?
is it possible without uvm_vslock?

> is there a PR for it?

PR/25639.

YAMAMOTO Takashi