Re: git: d160447129fe - main - vm_object: remove the charge member

From: Konstantin Belousov <kostikbel_at_gmail.com>
Date: Tue, 13 Jan 2026 16:24:44 UTC
On Tue, Jan 13, 2026 at 04:08:34PM +0000, Andrew Turner wrote:
> On 2026-01-13 14:03, Konstantin Belousov wrote:
> > The branch main has been updated by kib:
> > 
> > URL: https://cgit.FreeBSD.org/src/commit/?id=d160447129fe060b28bcd6ba429d17afdf494ff2
> > 
> > commit d160447129fe060b28bcd6ba429d17afdf494ff2
> > Author:     Konstantin Belousov <kib@FreeBSD.org>
> > AuthorDate: 2026-01-03 09:34:23 +0000
> > Commit:     Konstantin Belousov <kib@FreeBSD.org>
> > CommitDate: 2026-01-13 14:03:14 +0000
> > 
> >     vm_object: remove the charge member
> 
> I'm seeing the following panic with this change on boot. If I revert this
> change the boot succeeds.
> 
> Andrew
> 
> panic: swap_reserved 0x218c5 < decr 0xffffffffed021
> cpuid = 99
> time = 7
> KDB: stack backtrace:
> db_trace_self() at db_trace_self
> db_trace_self_wrapper() at db_trace_self_wrapper+0x38
> vpanic() at vpanic+0x1a0
> panic() at panic+0x48
> swap_release_by_cred() at swap_release_by_cred+0xf0
> vm_map_entry_delete() at vm_map_entry_delete+0x124
> vm_map_delete() at vm_map_delete+0x16c
> kern_munmap() at kern_munmap+0xb8
> do_el0_sync() at do_el0_sync+0x618
> handle_el0_sync() at handle_el0_sync+0x4c
> --- exception, esr 0x56000000

Try this please.

commit 870deef431f00f959e838261587b044a2913f414
Author: Konstantin Belousov <kib@FreeBSD.org>
Date:   Tue Jan 13 18:22:48 2026 +0200

    vm_map_entry_delete(): fix the calculation of swap release
    
    Reported by:    andrew
    Fixes:  d160447129fe060b28bcd6ba429d17afdf494ff2

diff --git a/sys/vm/vm_map.c b/sys/vm/vm_map.c
index 04628f44a497..b8295bb2108d 100644
--- a/sys/vm/vm_map.c
+++ b/sys/vm/vm_map.c
@@ -3997,7 +3997,7 @@ vm_map_entry_delete(vm_map_t map, vm_map_entry_t entry)
 				object->size = offidxstart;
 				if (object->cred != NULL) {
 					swap_release_by_cred(ptoa(oldsize -
-					    ptoa(object->size)), object->cred);
+					    object->size), object->cred);
 				}
 			}
 		}