vgsp-sema: only ALL-ZERO window-guess push reads fall through (ISSUE-0002)

r50 regression: requiring method-stream plausibility for the window source
rejected valid non-method push prefixes and corrupted c1 (VADD bad=32767),
so that gate is reverted. Narrow it to the r49 failure mode: a window read
returning all zeros cannot be a real page (the paired base page is real), so
fall through to the learned/discovered resolvers. Non-zero window content is
trusted exactly as before.

1 files changed, 11 insertions, 12 deletions

diff --git a/kernel/gsp_sema_service.c b/kernel/gsp_sema_service.c
index a789796..fd70869 100644
--- a/kernel/gsp_sema_service.c
+++ b/kernel/gsp_sema_service.c
@@ -7697,19 +7697,18 @@ static int svc_read_va_push_ex(struct nv_vgpu_device *vgpu,
 			    !svc_push_prefix_ok(p, chunk))
 				continue;	/* content says: wrong pin */
 			/*
-			 * ISSUE-0002 (r50): a window guess is a linear
-			 * extrapolation from the paired base page; the push
-			 * buffer is not guaranteed physically contiguous (r49:
-			 * the second session's CE push pages read all-zero
-			 * through the window while the per-page sources were
-			 * never tried because the window read "succeeded").
-			 * Never let an implausible window read shadow the
-			 * learned/discovered resolvers: fall through to src=3.
-			 * A valid push's first chunk always parses, so this
-			 * cannot reject a correct window read.
+			 * ISSUE-0002 (r51): a window guess that reads ALL
+			 * ZEROS cannot be right - the paired base page is
+			 * real, so a zero first chunk means the linear window
+			 * does not describe this page (r49: the second
+			 * session's CE push pages read zeros and, because the
+			 * read "succeeded", shadowed the per-page resolvers).
+			 * Fall through to src=3 instead. Non-zero window
+			 * content stays trusted exactly as before (r50:
+			 * requiring method-stream plausibility rejected valid
+			 * non-method push prefixes and corrupted c1).
 			 */
-			if (src == 2 && first &&
-			    !svc_method_stream_plausible(p, chunk))
+			if (src == 2 && first && !memchr_inv(p, 0, chunk))
 				continue;
 			done = true;
 		}