From 8d567340186ba22b9d2396ea8d6c2db96253cae7 Mon Sep 17 00:00:00 2001
From: kettenis <kettenis@openbsd.org>
Date: Tue, 1 Feb 2022 19:57:28 +0000
Subject: [PATCH] Make sure we always pass a page-aligned address to
 pmap_grow_map(). Fixes an issue uncovered by the recent change to enlarge kva
 space where an unaligned address was passed resulting in memset() writing
 past the end of the newly allocated page.

ok miod@
---
 sys/arch/arm/arm/pmap7.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/sys/arch/arm/arm/pmap7.c b/sys/arch/arm/arm/pmap7.c
index 45de66ba816..ffad79e0b5e 100644
--- a/sys/arch/arm/arm/pmap7.c
+++ b/sys/arch/arm/arm/pmap7.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: pmap7.c,v 1.61 2021/03/25 04:12:00 jsg Exp $	*/
+/*	$OpenBSD: pmap7.c,v 1.62 2022/02/01 19:57:28 kettenis Exp $	*/
 /*	$NetBSD: pmap.c,v 1.147 2004/01/18 13:03:50 scw Exp $	*/
 
 /*
@@ -1968,6 +1968,8 @@ pmap_grow_map(vaddr_t va, pt_entry_t cache_mode, paddr_t *pap)
 	pt_entry_t *ptep;
 	paddr_t pa;
 
+	KASSERT((va & PAGE_MASK) == 0);
+
 	if (uvm.page_init_done == 0) {
 		if (uvm_page_physget(&pa) == 0)
 			return (1);
@@ -2032,7 +2034,8 @@ pmap_grow_l2_bucket(pmap_t pm, vaddr_t va)
 			 * The new l2_dtable straddles a page boundary.
 			 * Map in another page to cover it.
 			 */
-			if (pmap_grow_map(nva, pte_l2_s_cache_mode, NULL))
+			if (pmap_grow_map(trunc_page(nva),
+			    pte_l2_s_cache_mode, NULL))
 				return (NULL);
 		}
 
-- 
2.20.1