diff options
| author | Arthur Hanson Rasmusson <arthur@vgpu.io> | 2026-10-05 16:37:50 -0400 |
|---|---|---|
| committer | Arthur Hanson Rasmusson <arthur@vgpu.io> | 2026-10-05 16:37:50 -0400 |
| commit | 13a4473a7e86cef4283f3e3a1e0e6d29b3ef84e6 (patch) | |
| tree | 5d2b57f4e7e671f59c83eca320bf69fffe51b677 /kernel/gsp_phys_gpu.c | |
| parent | cc1028dffcbf9e028938555827f02b18ceba1665 (diff) | |
| download | open-iov-13a4473a7e86cef4283f3e3a1e0e6d29b3ef84e6.tar.gz open-iov-13a4473a7e86cef4283f3e3a1e0e6d29b3ef84e6.zip | |
vgsp: fix host crash in FWCLIENT promote order (MAIN first, non-MAIN after)
The 2026-10-05 16:05 crasher sent an accepted non-MAIN PROMOTE_CTX
(PM/PATCH/FECS/PRIV/UNR) before a MAIN control that failed 0x40; the
writing task then Oopsed in vma_interval_tree_remove with a corrupted
VMA rbtree and module list (host kernel memory corruption).
Restore the reference order (kgrobjGetPromoteIds_FWCLIENT: MAIN first)
and make MAIN-alone the abort point: GPU_INITIALIZE_CTX (mask bit7)
then the single-entry MAIN promote; build and send the non-MAIN entries
only after MAIN commits (or when MAIN is deselected). The previous
accepted-non-MAIN-before-failing-MAIN order is forbidden.
Build is unchanged otherwise; mask 0xbf now reproduces the proven-clean
mask-0x81 shape when MAIN hits the memdesc gate.
Diffstat (limited to 'kernel/gsp_phys_gpu.c')
0 files changed, 0 insertions, 0 deletions