From b02ddb59e64620733a6cbc48fb1d0583a62fef78 Mon Sep 17 00:00:00 2001
From: Konstantin Belousov <kib@FreeBSD.org>
Date: Sun, 11 Jan 2026 13:04:01 +0200
Subject: [PATCH] swap_pager_getpages(): assert that bp->b_pages[] is accessed
 in bounds

Reviewed by:	glebius, markj
Tested by:	pho
Sponsored by:	The FreeBSD Foundation
MFC after:	1 week
Differential revision:	https://reviews.freebsd.org/D54713
---
 sys/vm/swap_pager.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/sys/vm/swap_pager.c b/sys/vm/swap_pager.c
index efb0dd477c9..012d89db331 100644
--- a/sys/vm/swap_pager.c
+++ b/sys/vm/swap_pager.c
@@ -1396,6 +1396,9 @@ swap_pager_getpages_locked(struct pctrie_iter *blks, vm_object_t object,
 	vm_object_prepare_buf_pages(object, bp->b_pages, count, &rbehind,
 	    &rahead, ma);
 	bp->b_npages = rbehind + count + rahead;
+	KASSERT(bp->b_npages <= PBUF_PAGES,
+	    ("bp_npages %d (rb %d c %d ra %d) not less than PBUF_PAGES %jd",
+	    bp->b_npages, rbehind, count, rahead, (uintmax_t)PBUF_PAGES));
 	for (int i = 0; i < bp->b_npages; i++)
 		bp->b_pages[i]->oflags |= VPO_SWAPINPROG;
 	bp->b_blkno = swp_pager_meta_lookup(blks, pindex - rbehind);