kernel: fix integer overflow in syssegflush(), segment code cleanup

mcountseg(), mfreeseg():
use Pte.first/last pointers when possible and avoid constructs
like s->map[i]->pages[j].

freepte():
do not zero entries in freepte(), the segment is going away and
here is no point in zeroing page pointers. hoist common code at
the top avoiding duplication.

segpage(), fixfault():
avoid load after store for Pte** pointer.

fixfault():
return -1 in default case to avoid the "used but not set" warning
for mmuphys and get rid of the useless initialization.

syssegflush():
due to len being unsigned, the pe = PGROUND(pe) can make "chunk"
bigger than len causing a overflow. rewrite the function and deal
with page alignment and errors at the beginning.

syssegflush(), segpage(), fixfault(), putseg(), relocateseg(),
mcountseg(), mfreeseg():
keep naming consistent.

1 files changed, 6 insertions, 7 deletions

diff --git a/sys/src/9/port/fault.c b/sys/src/9/port/fault.c
index b6f5e3894..5aff0a731 100644
--- a/sys/src/9/port/fault.c
+++ b/sys/src/9/port/fault.c
@@ -197,17 +197,16 @@ int
 fixfault(Segment *s, uintptr addr, int read, int doputmmu)
 {
 	int type;
-	Pte **p, *etp;
-	uintptr soff, mmuphys=0;
+	Pte **pte, *etp;
+	uintptr soff, mmuphys;
 	Page **pg, *old, *new;
 
 	addr &= ~(BY2PG-1);
 	soff = addr-s->base;
-	p = &s->map[soff/PTEMAPMEM];
-	if(*p == nil)
-		*p = ptealloc();
+	pte = &s->map[soff/PTEMAPMEM];
+	if((etp = *pte) == nil)
+		*pte = etp = ptealloc();
 
-	etp = *p;
 	pg = &etp->pages[(soff&(PTEMAPMEM-1))/BY2PG];
 	type = s->type&SG_TYPE;
 
@@ -219,7 +218,7 @@ fixfault(Segment *s, uintptr addr, int read, int doputmmu)
 	switch(type) {
 	default:
 		panic("fault");
-		break;
+		return -1;
 
 	case SG_TEXT: 			/* Demand load */
 		if(pagedout(*pg))