diff options
Diffstat (limited to 'kernel/gsp_sema_service.c')
| -rw-r--r-- | kernel/gsp_sema_service.c | 15 |
1 files changed, 15 insertions, 0 deletions
diff --git a/kernel/gsp_sema_service.c b/kernel/gsp_sema_service.c index c545242..a789796 100644 --- a/kernel/gsp_sema_service.c +++ b/kernel/gsp_sema_service.c @@ -7696,6 +7696,21 @@ static int svc_read_va_push_ex(struct nv_vgpu_device *vgpu, if (via_ipin && first && !svc_push_prefix_ok(p, chunk)) continue; /* content says: wrong pin */ + /* + * ISSUE-0002 (r50): a window guess is a linear + * extrapolation from the paired base page; the push + * buffer is not guaranteed physically contiguous (r49: + * the second session's CE push pages read all-zero + * through the window while the per-page sources were + * never tried because the window read "succeeded"). + * Never let an implausible window read shadow the + * learned/discovered resolvers: fall through to src=3. + * A valid push's first chunk always parses, so this + * cannot reject a correct window read. + */ + if (src == 2 && first && + !svc_method_stream_plausible(p, chunk)) + continue; done = true; } if (!done) |