From: Bin Guo <guobin@linux.alibaba.com>

vcpu_faults_current[] is uint8_t.  The overflow assert was checked
after the post-increment, so 255 would wrap to 0 and the assert
would pass silently.  Move the check before the increment and use
< 255.

Signed-off-by: Bin Guo <guobin@linux.alibaba.com>
Link: https://lore.kernel.org/r/20260716101952.65329-2-guobin@linux.alibaba.com
Signed-off-by: Peter Xu <peterx@redhat.com>
---
 migration/postcopy-ram.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/migration/postcopy-ram.c b/migration/postcopy-ram.c
index 980b938a4c..b0828edb3e 100644
--- a/migration/postcopy-ram.c
+++ b/migration/postcopy-ram.c
@@ -1093,7 +1093,11 @@ void mark_postcopy_blocktime_begin(uintptr_t addr, uint32_t ptid,
         /*
          * Account how many concurrent faults on this vCPU we trapped.  See
          * comments above vcpu_faults_current[] on why it can be more than one.
+         *
+         * vcpu_faults_current[] is uint8_t, so assert before incrementing to
+         * catch overflow before it wraps.
          */
+        assert(dc->vcpu_faults_current[cpu] < 255);
         if (dc->vcpu_faults_current[cpu]++ == 0) {
             dc->smp_cpus_down++;
             /*
@@ -1103,9 +1107,6 @@ void mark_postcopy_blocktime_begin(uintptr_t addr, uint32_t ptid,
              */
             dc->last_begin = current;
         }
-
-        /* Making sure it won't overflow - it really should never! */
-        assert(dc->vcpu_faults_current[cpu] <= 255);
     } else {
         /*
          * For non-vCPU thread faults, we don't care about tid or cpu index
-- 
2.54.0