diff options
| author | Arthur Hanson Rasmusson <arthur@vgpu.io> | 2026-10-22 17:54:30 -0400 |
|---|---|---|
| committer | Arthur Hanson Rasmusson <arthur@vgpu.io> | 2026-10-22 17:54:30 -0400 |
| commit | 203d3ff5378d4825e039b7cbd9a15adca5aea867 (patch) | |
| tree | 20110ee775ca800f87a39765f3e6314f57a23943 /kernel | |
| parent | 93e9516d8e7d893e941cb0c469614a7b9e3db359 (diff) | |
| download | open-iov-203d3ff5378d4825e039b7cbd9a15adca5aea867.tar.gz open-iov-203d3ff5378d4825e039b7cbd9a15adca5aea867.zip | |
r496d USERD shape-scan validation: the progress-tracker entry sits ABOVE the ring
The ring-ownership check rejected every entry VA >= ring_va, but the driver
writes TWO GPFIFO entries per kickoff - the main pushbuffer BELOW the ring
and the progress tracker ABOVE it (nvidia-push-priv.h). Accept VAs anywhere
in the 2 MB allocation window.
Diffstat (limited to 'kernel')
| -rw-r--r-- | kernel/gsp_sema_service.c | 9 |
1 files changed, 8 insertions, 1 deletions
diff --git a/kernel/gsp_sema_service.c b/kernel/gsp_sema_service.c index 75c7645..c8987b7 100644 --- a/kernel/gsp_sema_service.c +++ b/kernel/gsp_sema_service.c @@ -13078,10 +13078,17 @@ static int svc_chan_userd(struct nv_vgpu_device *vgpu, struct svc_channel *ch, eva = ((u64)(a1 & 0xff) << 32) | (u64)(a0 & 0xfffffffc); elen = ((a1 >> 10) & 0x1fffff) << 2; + /* + * Every entry the put claims must name a + * VA in the ring's allocation window - + * pushbuffers below the ring, the + * progress tracker above it. + */ if (!eva || - eva >= ch->gpfifo_va || eva + SVC_GR_RAM_WIN / 2 < ch->gpfifo_va || + eva >= ch->gpfifo_va + + SVC_GR_RAM_WIN / 2 || elen < 4 || elen > 0x100000) { ok = false; break; |