From 25f46ea449ca29e08bef64ef93eb5d5b117d7e2f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Axel=20D=C3=B6rfler?= <axeld@pinc-software.de>
Date: Sat, 30 Jun 2007 15:36:06 +0000
Subject: [PATCH] * Reserving areas never put down their reference of their
 address space when   removed in several cases. * vfs_get_vnode_cache() now
 always gives out a reference to the cache it   returns; if it needs to
 allocate a new one, the vnode owns one reference,   and the caller another. *
 therefore, file_cache_create() now owns a reference to its vm_cache_ref, and 
  frees it in file_cache_delete().

git-svn-id: file:///srv/svn/repos/haiku/haiku/trunk@21533 a95241bf-73f2-0310-859d-f6bbb57e9c96
---
 src/system/kernel/cache/file_cache.cpp |  1 +
 src/system/kernel/fs/vfs.cpp           |  7 ++++---
 src/system/kernel/vm/vm.cpp            | 10 ++++++----
 3 files changed, 11 insertions(+), 7 deletions(-)

diff --git a/src/system/kernel/cache/file_cache.cpp b/src/system/kernel/cache/file_cache.cpp
index bd869b35b9..69be9584ae 100644
--- a/src/system/kernel/cache/file_cache.cpp
+++ b/src/system/kernel/cache/file_cache.cpp
@@ -1292,6 +1292,7 @@ file_cache_delete(void *_cacheRef)
 
 	TRACE(("file_cache_delete(ref = %p)\n", ref));
 
+	vm_cache_release_ref(ref->cache);
 	vfs_put_vnode(ref->device);
 	delete ref;
 }
diff --git a/src/system/kernel/fs/vfs.cpp b/src/system/kernel/fs/vfs.cpp
index 57342624c5..e764bb55dc 100644
--- a/src/system/kernel/fs/vfs.cpp
+++ b/src/system/kernel/fs/vfs.cpp
@@ -3135,11 +3135,12 @@ vfs_get_vnode_cache(void *_vnode, vm_cache_ref **_cache, bool allocate)
 			vnode->busy = wasBusy;
 		} else
 			status = B_BAD_VALUE;
-	} else
-		vm_cache_acquire_ref(vnode->cache);
+	}
 
-	if (status == B_OK)
+	if (status == B_OK) {
+		vm_cache_acquire_ref(vnode->cache);
 		*_cache = vnode->cache;
+	}
 
 	mutex_unlock(&sVnodeMutex);
 	return status;
diff --git a/src/system/kernel/vm/vm.cpp b/src/system/kernel/vm/vm.cpp
index 8f2b430c10..cb562306d8 100644
--- a/src/system/kernel/vm/vm.cpp
+++ b/src/system/kernel/vm/vm.cpp
@@ -213,6 +213,7 @@ find_reserved_area(vm_address_space *addressSpace, addr_t start,
 		if (size == next->size) {
 			// the new area fully covers the reversed range
 			area->address_space_next = next->address_space_next;
+			vm_put_address_space(addressSpace);
 			free(next);
 		} else {
 			// resize the reserved range behind the area
@@ -543,6 +544,8 @@ map_backing_store(vm_address_space *addressSpace, vm_cache_ref *cacheRef,
 		newCache->type = CACHE_TYPE_RAM;
 		newCache->temporary = 1;
 		newCache->scan_skip = cache->scan_skip;
+		newCache->virtual_base = offset;
+		newCache->virtual_size = offset + size;
 
 		vm_cache_add_consumer_locked(cacheRef, newCache);
 
@@ -550,10 +553,8 @@ map_backing_store(vm_address_space *addressSpace, vm_cache_ref *cacheRef,
 		mutex_lock(&newCacheRef->lock);
 
 		cache = newCache;
-		cacheRef = newCache->ref;
+		cacheRef = newCacheRef;
 		store = newStore;
-		cache->virtual_base = offset;
-		cache->virtual_size = offset + size;
 	}
 
 	status = vm_cache_set_minimal_commitment_locked(cacheRef, offset + size);
@@ -649,6 +650,7 @@ vm_unreserve_address_range(team_id team, void *address, addr_t size)
 				addressSpace->areas = reserved->address_space_next;
 
 			area = reserved->address_space_next;
+			vm_put_address_space(addressSpace);
 			free(reserved);
 			continue;
 		}
@@ -3738,7 +3740,7 @@ fill_area_info(struct vm_area *area, area_info *info, size_t size)
 	needs any kind of locking, and actually exists.
 	Used by both lock_memory() and unlock_memory().
 */
-status_t
+static status_t
 test_lock_memory(vm_address_space *addressSpace, addr_t address,
 	bool &needsLocking)
 {