DF-2982 / fix.diff
--- a/sys/vm/default_pager.c 2026-06-29 12:51:19.000000000 +0000 +++ b/sys/vm/default_pager.c 2026-10-26 03:27:38.934321340 +0000 @@ -34,8 +34,13 @@ * storage. The backing store is usually swap so we just fall through to * the swap routines. However, since swap metadata has not been assigned, * the swap routines assign and manage the swap backing store through the - * vm_page->swapblk field. The object is only converted when the page is - * physically freed after having been cleaned and even then vm_page->swapblk + * (NOTE: this design was retired long ago - vm_page has no swapblk field. + * An OBJT_DEFAULT object is converted to OBJT_SWAP immediately and + * atomically the first time swap metadata is built for it; until then + * swblock_count == 0 is the load-bearing invariant: default_pager_dealloc + * KKASSERTs it, vm_fault relies on it for zero-fill-on-FAIL correctness, + * and the DRM shims rely on vm_pager_has_page() == FALSE here.) + * vm_page->swapblk * is maintained whenever a resident page also has swap backing store. * * $FreeBSD: src/sys/vm/default_pager.c,v 1.23 1999/11/07 20:03:53 alc Exp $ @@ -129,10 +134,11 @@ * the page to its backing store, or if no backing store has been assigned, * it is not yet synchronized. * - * It is possible to have fully-synchronized swap assigned without the - * object having been converted. We just call swap_pager_haspage() to - * deal with it since it must already deal with it plus deal with swap - * meta-data structures. + * (NOTE: the above comment described the retired design. In the current + * code an OBJT_DEFAULT object never carries swap metadata: it is converted + * to OBJT_SWAP atomically when the first swap metadata is built, so this + * pager unconditionally reports "no page" - callers (VM fault, DRM shims) + * depend on that.) */ static boolean_t default_pager_haspage(vm_object_t object, vm_pindex_t pindex) |