⬢ DragonFlyBSD Kernel Audit
DF-2982 / fix.diff
← back to finding ↓ download raw
--- a/sys/vm/default_pager.c	2026-06-29 12:51:19.000000000 +0000
+++ b/sys/vm/default_pager.c	2026-10-26 03:27:38.934321340 +0000
@@ -34,8 +34,13 @@
  * storage.  The backing store is usually swap so we just fall through to
  * the swap routines.  However, since swap metadata has not been assigned,
  * the swap routines assign and manage the swap backing store through the
- * vm_page->swapblk field.  The object is only converted when the page is 
- * physically freed after having been cleaned and even then vm_page->swapblk
+ * (NOTE: this design was retired long ago - vm_page has no swapblk field.
+ * An OBJT_DEFAULT object is converted to OBJT_SWAP immediately and
+ * atomically the first time swap metadata is built for it; until then
+ * swblock_count == 0 is the load-bearing invariant: default_pager_dealloc
+ * KKASSERTs it, vm_fault relies on it for zero-fill-on-FAIL correctness,
+ * and the DRM shims rely on vm_pager_has_page() == FALSE here.)
+ * vm_page->swapblk
  * is maintained whenever a resident page also has swap backing store.
  *
  * $FreeBSD: src/sys/vm/default_pager.c,v 1.23 1999/11/07 20:03:53 alc Exp $
@@ -129,10 +134,11 @@
  * the page to its backing store, or if no backing store has been assigned,
  * it is not yet synchronized.
  *
- * It is possible to have fully-synchronized swap assigned without the
- * object having been converted.  We just call swap_pager_haspage() to
- * deal with it since it must already deal with it plus deal with swap
- * meta-data structures.
+ * (NOTE: the above comment described the retired design.  In the current
+ * code an OBJT_DEFAULT object never carries swap metadata: it is converted
+ * to OBJT_SWAP atomically when the first swap metadata is built, so this
+ * pager unconditionally reports "no page" - callers (VM fault, DRM shims)
+ * depend on that.)
  */
 static boolean_t
 default_pager_haspage(vm_object_t object, vm_pindex_t pindex)