Fix operator precedence and integer width in nv_dma_buf_mmap

[maycuatroi1]

Summary

Fix two bugs in nv_dma_buf_mmap() (kernel-open/nvidia/nv-dmabuf.c):

1. Operator precedence error (line 1344)

The outer for-loop condition:

for (; i < (priv->num_objects && (addr < vma->vm_end)); i++)

evaluates && first, producing a boolean 0 or 1. The loop runs at most once (i < 1), regardless of num_objects.

For multi-object DMA-buf exports, only the first object's ranges are mapped. The function returns success despite the incomplete mapping. Accessing the unmapped portion of the VMA causes SIGBUS.

Fix:

for (; (i < priv->num_objects) && (addr < vma->vm_end); i++)

2. Integer truncation in total_skip_size (line 1233)

total_skip_size is NvU32 but accumulates NvU64 range sizes. For DMA-bufs larger than 4 GB the offset wraps, causing incorrect range lookups in the page-mapping loop.

Fix: widen from NvU32 to NvU64.

Verification

Operator precedence bug confirmed with standalone C reproduction:

num_objects  buggy_iters     correct_iters   match?
----------  -----------     -------------   ------
1            1               1               OK
5            1               5               BUG!
100          1               100             BUG!

Integer truncation confirmed:

range[0]=0x100000000  NvU32=0x00000000  NvU64=0x0000000100000000  OVERFLOW!

Test plan

• Verify multi-object DMA-buf export + mmap maps all objects correctly
• Verify DMA-buf exports with total size > 4 GB compute correct offsets
• Verify single-object DMA-buf mmap behavior is unchanged

[CLAassistant]

All committers have signed the CLA.