The branch main has been updated by kib: URL: https://cgit.FreeBSD.org/src/commit/?id=b02ddb59e64620733a6cbc48fb1d0583a62fef78
commit b02ddb59e64620733a6cbc48fb1d0583a62fef78 Author: Konstantin Belousov <[email protected]> AuthorDate: 2026-01-11 11:04:01 +0000 Commit: Konstantin Belousov <[email protected]> CommitDate: 2026-01-17 02:07:57 +0000 swap_pager_getpages(): assert that bp->b_pages[] is accessed in bounds Reviewed by: glebius, markj Tested by: pho Sponsored by: The FreeBSD Foundation MFC after: 1 week Differential revision: https://reviews.freebsd.org/D54713 --- sys/vm/swap_pager.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/sys/vm/swap_pager.c b/sys/vm/swap_pager.c index efb0dd477c93..012d89db3310 100644 --- a/sys/vm/swap_pager.c +++ b/sys/vm/swap_pager.c @@ -1396,6 +1396,9 @@ swap_pager_getpages_locked(struct pctrie_iter *blks, vm_object_t object, vm_object_prepare_buf_pages(object, bp->b_pages, count, &rbehind, &rahead, ma); bp->b_npages = rbehind + count + rahead; + KASSERT(bp->b_npages <= PBUF_PAGES, + ("bp_npages %d (rb %d c %d ra %d) not less than PBUF_PAGES %jd", + bp->b_npages, rbehind, count, rahead, (uintmax_t)PBUF_PAGES)); for (int i = 0; i < bp->b_npages; i++) bp->b_pages[i]->oflags |= VPO_SWAPINPROG; bp->b_blkno = swp_pager_meta_lookup(blks, pindex - rbehind);
