busdma: avoid buflen underflow

[mhorne]

Summary

The loop condition in the dmamap_load_buffer() method is 'buflen > 0',
and buflen is an unsigned type (bus_size_t).

A recent change made it possible for sgsize to exceed the remaining
buflen, when the tag has a large alignment requirement. The result is
that we would not break out of the loop at the correct time. Fix this by
avoiding underflow in the subtraction at the end of the loop.

PR: 279383
Reported by: Robert Morris <[e-mail]>
Fixes: a77e1f0f81df ("busdma: better handling of small segment bouncing")

[mhorne]

I could apply the same guard to bounce_bus_dmamap_load_phys() methods, but in those functions it is easier to see that underflow is not possible, so I haven't yet.

sys/arm64/arm64/busdma_bounce.c

864–867

Note: arm and arm64 implementations are actually lacking the line

sgsize = roundup2(sgsize, dmat->common.alignment);

found in the other implementations, and are therefore not susceptible to the same underflow. Still, I think it is wise to add the check here too.

[jhibbits]

Makes sense to me.