>Number:         16028
>Category:       port-i386
>Synopsis:       i386 pmap_enter() screws up accounting in error path
>Confidential:   no
>Severity:       serious
>Priority:       high
>Responsible:    port-i386-maintainer
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Sat Mar 23 16:04:00 PST 2002
>Closed-Date:
>Last-Modified:
>Originator:     Jason R Thorpe
>Release:        NetBSD 1.5ZC
>Organization:
Wasabi Systems, Inc.
>Environment:
	
	
System: NetBSD yeah-baby.shagadelic.org 1.5ZC NetBSD 1.5ZC (YEAH-BABY-XP) #6: Tue Mar 19 14:51:02 PST 2002 thorpej@yeah-baby.shagadelic.org:/u1/netbsd/src/sys/arch/i386/compile/YEAH-BABY-XP i386
Architecture: i386
Machine: i386
>Description:
	In an error path in the i386 pmap_enter(), the PTP
	wire_count and the pmap's wired_count and resident_count
	can become inconsistent with the contents of the page
	tables.

	The problem occurs when pmap_alloc_pv() is called and
	PMAP_CANFAIL is set; the pmap_alloc_pv() call is made
	after ptp->wire_count, pmap->pm_stats.resident_count,
	and pmap->pm_stats.wired_count are updated.

>How-To-Repeat:
	This was noticed by code inspection.

	Other pmaps may also have this problem.

>Fix:
	Not provided.
>Release-Note:
>Audit-Trail:
>Unformatted: