diff options
| -rw-r--r-- | kernel/gsp_sema_service.c | 23 |
1 files changed, 11 insertions, 12 deletions
diff --git a/kernel/gsp_sema_service.c b/kernel/gsp_sema_service.c index a789796..fd70869 100644 --- a/kernel/gsp_sema_service.c +++ b/kernel/gsp_sema_service.c @@ -7697,19 +7697,18 @@ static int svc_read_va_push_ex(struct nv_vgpu_device *vgpu, !svc_push_prefix_ok(p, chunk)) continue; /* content says: wrong pin */ /* - * ISSUE-0002 (r50): a window guess is a linear - * extrapolation from the paired base page; the push - * buffer is not guaranteed physically contiguous (r49: - * the second session's CE push pages read all-zero - * through the window while the per-page sources were - * never tried because the window read "succeeded"). - * Never let an implausible window read shadow the - * learned/discovered resolvers: fall through to src=3. - * A valid push's first chunk always parses, so this - * cannot reject a correct window read. + * ISSUE-0002 (r51): a window guess that reads ALL + * ZEROS cannot be right - the paired base page is + * real, so a zero first chunk means the linear window + * does not describe this page (r49: the second + * session's CE push pages read zeros and, because the + * read "succeeded", shadowed the per-page resolvers). + * Fall through to src=3 instead. Non-zero window + * content stays trusted exactly as before (r50: + * requiring method-stream plausibility rejected valid + * non-method push prefixes and corrupted c1). */ - if (src == 2 && first && - !svc_method_stream_plausible(p, chunk)) + if (src == 2 && first && !memchr_inv(p, 0, chunk)) continue; done = true; } |