sema-svc: never apply swept-page releases with no live channel (guest boot corruption); tooling guards

1 files changed, 23 insertions, 0 deletions

diff --git a/kernel/gsp_sema_service.c b/kernel/gsp_sema_service.c
index ae8f7da..b29e833 100644
--- a/kernel/gsp_sema_service.c
+++ b/kernel/gsp_sema_service.c
@@ -2668,6 +2668,29 @@ static u32 svc_apply_page_data(struct nv_vgpu_device *vgpu, const u8 *buf,
 			       u64 pa_page)
 {
 	u32 off, applied = 0;
+	bool any = false;
+	unsigned long flags;
+	int ci;
+
+	/*
+	 * No live channel: no client can be waiting on a release, so a
+	 * "release" decoded from an arbitrary swept page can only be a false
+	 * positive, and its write lands through whatever translation the VA
+	 * happens to have (observed: 2 applied writes while the guest kernel
+	 * was booting corrupted a task's CPU field and panicked the guest
+	 * scheduler). Only apply swept-page releases while a client exists;
+	 * real releases are carried by the channels' readable pushes then.
+	 */
+	spin_lock_irqsave(&svc.chan_lock, flags);
+	for (ci = 0; ci < SVC_MAX_CHANNELS; ci++) {
+		if (svc.chan[ci].valid) {
+			any = true;
+			break;
+		}
+	}
+	spin_unlock_irqrestore(&svc.chan_lock, flags);
+	if (!any)
+		return 0;
 
 	/*
 	 * Decoded execution: walk the page as a method stream and perform the