diff options
| author | Arthur Hanson Rasmusson <arthur@vgpu.io> | 2026-10-26 17:15:08 -0400 |
|---|---|---|
| committer | Arthur Hanson Rasmusson <arthur@vgpu.io> | 2026-10-26 17:15:08 -0400 |
| commit | 5409c02a42d037f1e15609f6e9f7b43535bf8e9c (patch) | |
| tree | f90aca3279310ced595f5ad05c0b8aa4c68352c8 /kernel/gsp_phys_booter.c | |
| parent | 49f449a4ade7b33d4c10ba407f38d1c4b64864e1 (diff) | |
| download | open-iov-5409c02a42d037f1e15609f6e9f7b43535bf8e9c.tar.gz open-iov-5409c02a42d037f1e15609f6e9f7b43535bf8e9c.zip | |
r800 SESSION 141 walk guard: gsp_phys_chunk_page_va returns NULL for an unallocated chunk (no per-page array AND no base va) - it previously returned (u8*)NULL + page*PAGE_SIZE, a small non-NULL garbage pointer, so the caller's NULL guard passed and the empty-set post-mortem print dereferenced it (Oops #2 at gsp_phys_backend_guest_gr_submit+0x4394, CR2=0x1e93c); with the guard, min_data=0's no-external-data forward can proceed
Diffstat (limited to 'kernel/gsp_phys_booter.c')
| -rw-r--r-- | kernel/gsp_phys_booter.c | 12 |
1 files changed, 12 insertions, 0 deletions
diff --git a/kernel/gsp_phys_booter.c b/kernel/gsp_phys_booter.c index 65fa429..f7d1226 100644 --- a/kernel/gsp_phys_booter.c +++ b/kernel/gsp_phys_booter.c @@ -2634,6 +2634,18 @@ EXPORT_SYMBOL_GPL(gsp_phys_boot_rm_flags); static void *gsp_phys_chunk_page_va(const struct gsp_phys_boot_chunk *c, u32 page) { + /* + * SESSION 141: an unallocated chunk (no per-page array AND no base + * va) must answer NULL. It previously returned + * (u8 *)NULL + page*PAGE_SIZE - a small non-NULL garbage pointer - + * so the caller's NULL guard passed and the empty-set post-mortem + * print dereferenced it: Oops #2 RIP + * gsp_phys_backend_guest_gr_submit+0x4394, CR2=0x1e93c with slot 30 + * (0x1e000 = 30*0x1000 + 0x900 off). min_data=0's no-external-data + * forward hit this on its first pass. + */ + if (!c->page_va && !c->va) + return NULL; if (c->page_va) return c->page_va[page]; return (u8 *)c->va + (size_t)page * GSP_PHYS_PAGE_SIZE; |