svn commit: r351133 - head/sys/vm

[Aleksandr Rybalko]

Author: ray
Date: Fri Aug 16 19:27:05 2019
New Revision: 351133
URL: https://svnweb.freebsd.org/changeset/base/351133

Log:
  Check paddr for overflow.
  Fix panic on initialize of "vm reserv" per-superpage lock in case when RAM ends at upper boundary of address space.
  Observed on ARM32 board BPI-R2 (2GB RAM 0x80000000-0xffffffff).
  
  PR:		235362
  Reviewed by:	kib, markj, alc
  MFC after:	2 weeks
  Differential Revision:	https://reviews.freebsd.org/D21272

Modified:
  head/sys/vm/vm_reserv.c

Modified: head/sys/vm/vm_reserv.c
==============================================================================
--- head/sys/vm/vm_reserv.c	Fri Aug 16 18:57:32 2019	(r351132)
+++ head/sys/vm/vm_reserv.c	Fri Aug 16 19:27:05 2019	(r351133)
@@ -316,7 +316,8 @@ sysctl_vm_reserv_fullpop(SYSCTL_HANDLER_ARGS)
 	for (segind = 0; segind < vm_phys_nsegs; segind++) {
 		seg = &vm_phys_segs[segind];
 		paddr = roundup2(seg->start, VM_LEVEL_0_SIZE);
-		while (paddr + VM_LEVEL_0_SIZE <= seg->end) {
+		while (paddr + VM_LEVEL_0_SIZE > paddr && paddr +
+		    VM_LEVEL_0_SIZE <= seg->end) {
 			rv = &vm_reserv_array[paddr >> VM_LEVEL_0_SHIFT];
 			fullpop += rv->popcnt == VM_LEVEL_0_NPAGES;
 			paddr += VM_LEVEL_0_SIZE;
@@ -1055,7 +1056,8 @@ vm_reserv_init(void)
 	for (segind = 0; segind < vm_phys_nsegs; segind++) {
 		seg = &vm_phys_segs[segind];
 		paddr = roundup2(seg->start, VM_LEVEL_0_SIZE);
-		while (paddr + VM_LEVEL_0_SIZE <= seg->end) {
+		while (paddr + VM_LEVEL_0_SIZE > paddr && paddr +
+		    VM_LEVEL_0_SIZE <= seg->end) {
 			rv = &vm_reserv_array[paddr >> VM_LEVEL_0_SHIFT];
 			rv->pages = PHYS_TO_VM_PAGE(paddr);
 			rv->domain = seg->domain;