Extend the struct vm_page wire_count to u_int to avoid the overflow

of the counter, that may happen when too many sendfile(2) calls are
being executed with this vnode [1].

To keep the size of the struct vm_page and offsets of the fields
accessed by out-of-tree modules, swap the types and locations
of the wire_count and cow fields. Add safety checks to detect cow
overflow and force fallback to the normal copy code for zero-copy
sockets. [2]

Reported by:	Anton Yuzhaninov <citrin citrin ru> [1]
Suggested by:	alc [2]
Reviewed by:	alc
MFC after:	2 weeks

1 files changed, 4 insertions, 4 deletions

diff --git a/sys/vm/vm_page.h b/sys/vm/vm_page.h
index f609a211daec..7f996ea9bfab 100644
--- a/sys/vm/vm_page.h
+++ b/sys/vm/vm_page.h
@@ -111,12 +111,12 @@ struct vm_page {
 	vm_paddr_t phys_addr;		/* physical address of page */
 	struct md_page md;		/* machine dependant stuff */
 	uint8_t	queue;			/* page queue index */
-	int8_t segind;  
+	int8_t segind;
 	u_short	flags;			/* see below */
 	uint8_t	order;			/* index of the buddy queue */
 	uint8_t pool;
-	u_short wire_count;		/* wired down maps refs (P) */
-	u_int cow;			/* page cow mapping count */
+	u_short cow;			/* page cow mapping count */
+	u_int wire_count;		/* wired down maps refs (P) */
 	short hold_count;		/* page hold count */
 	u_short oflags;			/* page flags (O) */
 	u_char	act_count;		/* page usage count */
@@ -336,7 +336,7 @@ void vm_page_zero_invalid(vm_page_t m, boolean_t setvalid);
 void vm_page_free_toq(vm_page_t m);
 void vm_page_zero_idle_wakeup(void);
 void vm_page_cowfault (vm_page_t);
-void vm_page_cowsetup (vm_page_t);
+int vm_page_cowsetup(vm_page_t);
 void vm_page_cowclear (vm_page_t);
 
 /*