commit 1627f478a308ff402023feba04a384d0f9786da5
Author: Ryota Ozaki <ozaki-r@iij.ad.jp>
Date:   Thu Dec 28 17:27:37 2017 +0900

    Fix pool_catchup

diff --git a/sys/kern/subr_pool.c b/sys/kern/subr_pool.c
index 3e6c9225482..a71d7a392c4 100644
--- a/sys/kern/subr_pool.c
+++ b/sys/kern/subr_pool.c
@@ -750,6 +750,7 @@ pool_get(struct pool *pp, int flags)
 	struct pool_item *pi;
 	struct pool_item_header *ph;
 	void *v;
+	int s;
 
 	KASSERT(!(flags & PR_NOWAIT) != !(flags & PR_WAITOK));
 	KASSERTMSG((pp->pr_itemsperpage != 0),
@@ -763,6 +764,7 @@ pool_get(struct pool *pp, int flags)
 		ASSERT_SLEEPABLE();
 	}
 
+	s = splvm(); /* To keep IPL_VM over pool_catchup that releases pr_lock */
 	mutex_enter(&pp->pr_lock);
  startover:
 	/*
@@ -809,6 +811,7 @@ pool_get(struct pool *pp, int flags)
 		pp->pr_nfail++;
 
 		mutex_exit(&pp->pr_lock);
+		splx(s);
 		KASSERT((flags & (PR_NOWAIT|PR_LIMITFAIL)) != 0);
 		return (NULL);
 	}
@@ -852,6 +855,7 @@ pool_get(struct pool *pp, int flags)
 
 			pp->pr_nfail++;
 			mutex_exit(&pp->pr_lock);
+			splx(s);
 			KASSERT((flags & (PR_WAITOK|PR_NOWAIT)) == PR_NOWAIT);
 			return (NULL);
 		}
@@ -867,6 +871,7 @@ pool_get(struct pool *pp, int flags)
 		v = pi = LIST_FIRST(&ph->ph_itemlist);
 		if (__predict_false(v == NULL)) {
 			mutex_exit(&pp->pr_lock);
+			splx(s);
 			panic("%s: [%s] page empty", __func__, pp->pr_wchan);
 		}
 		KASSERTMSG((pp->pr_nitems > 0),
@@ -925,6 +930,7 @@ pool_get(struct pool *pp, int flags)
 	}
 
 	mutex_exit(&pp->pr_lock);
+	splx(s);
 	KASSERT((((vaddr_t)v + pp->pr_itemoffset) & (pp->pr_align - 1)) == 0);
 	FREECHECK_OUT(&pp->pr_freecheck, v);
 	pool_redzone_fill(pp, v);
@@ -1274,7 +1280,9 @@ pool_update_curpage(struct pool *pp)
 void
 pool_setlowat(struct pool *pp, int n)
 {
+	int s;
 
+	s = splvm(); /* To keep IPL_VM over pool_catchup that releases pr_lock */
 	mutex_enter(&pp->pr_lock);
 
 	pp->pr_minitems = n;
@@ -1292,6 +1300,7 @@ pool_setlowat(struct pool *pp, int n)
 	}
 
 	mutex_exit(&pp->pr_lock);
+	splx(s);
 }
 
 void