sema: refuse below-floor fills that resolve outside vidmem (LOWFILL-REFUSED) - the 0x204020000 engine-window clear resolved to a different guest-RAM page on every execution and zeroed 8 KB of guest kernel memory (gmain NULL deref in __fdget, task_struct corruption)

1 files changed, 17 insertions, 0 deletions

diff --git a/kernel/gsp_sema_service.c b/kernel/gsp_sema_service.c
index 21f880d..a800fab 100644
--- a/kernel/gsp_sema_service.c
+++ b/kernel/gsp_sema_service.c
@@ -4622,6 +4622,23 @@ static int svc_fill(struct nv_vgpu_device *vgpu, u64 addr, u64 value, u32 elem,
 				va0, shadow, addr, aperture, elem, count,
 				value);
 		}
+		/*
+		 * r369: a below-floor fill may ONLY land in vidmem. The
+		 * 0x204020000 engine-window clear resolved to a DIFFERENT
+		 * guest-RAM page on every execution (9 runs, 9 pages) and
+		 * the guest died with its task_struct corrupted (gmain NULL
+		 * deref in __fdget) - each wrong resolution zeroed 8 KB of
+		 * guest kernel memory. Vidmem resolutions (the page-table
+		 * region, ap=VID) are the emulation's own shadow and stay
+		 * allowed; a SYS resolution for a window VA is refused and
+		 * logged loudly.
+		 */
+		if (va0 < SVC_VAS_FLOOR && !shadow &&
+		    aperture != CE_APERTURE_VID) {
+			pr_err_ratelimited("vgsp-sema: LOWFILL-REFUSED va=0x%llx pa=0x%llx ap=%u elem=%u count=%u (below-floor fill resolved outside vidmem)\n",
+					   va0, addr, aperture, elem, count);
+			return -ENOENT;
+		}
 	}
 
 	if (gsp_sema_dbg && !shadow && svc_dst_watched(addr) &&