DF-0955 / fix.diff
diff --git a/sys/vm/vm_contig.c b/sys/vm/vm_contig.c --- a/sys/vm/vm_contig.c +++ b/sys/vm/vm_contig.c @@ -399,8 +399,16 @@ m = &pga[i]; if (vm_page_busy_try(m, TRUE)) { - vm_contig_pg_free(start, - (i - start) * PAGE_SIZE); + /* + * DF-0955: on the first iteration (i == start) + * (i - start) * PAGE_SIZE == 0, which + * vm_contig_pg_free() would panic on. Guard + * the call so we only free what we actually + * allocated. + */ + if (i > start) + vm_contig_pg_free(start, + (i - start) * PAGE_SIZE); start++; goto again; } @@ -419,8 +427,12 @@ } if (pqtype != PQ_FREE || m->hold_count) { vm_page_wakeup(m); - vm_contig_pg_free(start, - (i - start) * PAGE_SIZE); + /* + * DF-0955: same i == start guard as above. + */ + if (i > start) + vm_contig_pg_free(start, + (i - start) * PAGE_SIZE); start++; goto again; } |