diff options
Diffstat (limited to 'kernel/gsp_sema_service.c')
| -rw-r--r-- | kernel/gsp_sema_service.c | 23 |
1 files changed, 23 insertions, 0 deletions
diff --git a/kernel/gsp_sema_service.c b/kernel/gsp_sema_service.c index ae8f7da..b29e833 100644 --- a/kernel/gsp_sema_service.c +++ b/kernel/gsp_sema_service.c @@ -2668,6 +2668,29 @@ static u32 svc_apply_page_data(struct nv_vgpu_device *vgpu, const u8 *buf, u64 pa_page) { u32 off, applied = 0; + bool any = false; + unsigned long flags; + int ci; + + /* + * No live channel: no client can be waiting on a release, so a + * "release" decoded from an arbitrary swept page can only be a false + * positive, and its write lands through whatever translation the VA + * happens to have (observed: 2 applied writes while the guest kernel + * was booting corrupted a task's CPU field and panicked the guest + * scheduler). Only apply swept-page releases while a client exists; + * real releases are carried by the channels' readable pushes then. + */ + spin_lock_irqsave(&svc.chan_lock, flags); + for (ci = 0; ci < SVC_MAX_CHANNELS; ci++) { + if (svc.chan[ci].valid) { + any = true; + break; + } + } + spin_unlock_irqrestore(&svc.chan_lock, flags); + if (!any) + return 0; /* * Decoded execution: walk the page as a method stream and perform the |