CVE-2026-98254: swiotlb: use the adjusted address for the highmem page lookup

In the Linux kernel, the following vulnerability has been resolved:

swiotlb: use the adjusted address for the highmem page lookup

swiotlbbounce() reads the page frame number from the slot's recorded origaddr, then advances origaddr by tlboffset to reach the address the caller asked about. The highmem branch mixes the two: the offset within the page comes from the adjusted address, the page from the value before it.

Once the adjustment crosses a page boundary the pair no longer describes one location, and the whole copy lands one page below the intended one for a positive tlboffset, one above for a negative one. DMAFROMDEVICE writes the device data over the wrong page and leaves the intended one stale, DMATODEVICE feeds the device from a page the mapping may not cover. Partial syncs through dmasyncsinglerangefor() are what make tlboffset non-zero.

The branch test is picked the same way, so a slot recorded in lowmem can be adjusted into highmem and the lowmem path then hands a highmem address to phystovirt().

Take both from origaddr once it is final and keep pfn in the branch that uses it. PhysHighMem() asks the question straight from the address, as dma-debug already does.