vgsp-sema: implausible window-guess push reads fall through to per-page resolvers (ISSUE-0002)

r49: the second session's CE push pages beyond the paired base page read
all-zero through the linear window guess; because the window read
'succeeded', the learned/discovered/targeted resolvers (src=3) were never
tried and every follow-up push was held as unreadable (crel frozen, client
spinning). A valid push's first chunk always parses as a method stream, so
require that for the window source on the first chunk only and fall through
otherwise. Correct window reads are unaffected.

1 files changed, 15 insertions, 0 deletions

diff --git a/kernel/gsp_sema_service.c b/kernel/gsp_sema_service.c
index c545242..a789796 100644
--- a/kernel/gsp_sema_service.c
+++ b/kernel/gsp_sema_service.c
@@ -7696,6 +7696,21 @@ static int svc_read_va_push_ex(struct nv_vgpu_device *vgpu,
 			if (via_ipin && first &&
 			    !svc_push_prefix_ok(p, chunk))
 				continue;	/* content says: wrong pin */
+			/*
+			 * ISSUE-0002 (r50): a window guess is a linear
+			 * extrapolation from the paired base page; the push
+			 * buffer is not guaranteed physically contiguous (r49:
+			 * the second session's CE push pages read all-zero
+			 * through the window while the per-page sources were
+			 * never tried because the window read "succeeded").
+			 * Never let an implausible window read shadow the
+			 * learned/discovered resolvers: fall through to src=3.
+			 * A valid push's first chunk always parses, so this
+			 * cannot reject a correct window read.
+			 */
+			if (src == 2 && first &&
+			    !svc_method_stream_plausible(p, chunk))
+				continue;
 			done = true;
 		}
 		if (!done)