From 3a6b7ca87129a995f0b3d7ddb0ea7c9893d430c0 Mon Sep 17 00:00:00 2001 From: Arthur Hanson Rasmusson Date: Mon, 28 Sep 2026 11:13:47 -0400 Subject: sema: clamp the pin-rewind at ring start - never wrap below zero The rewind used entries - (N - get) for get < N, which for an empty ring (get=0, put=0) jumped last_get to entries-8, so the pump read ring slots the producer had never reached and could execute stale/garbage entries. Replay only recently consumed slots, clamped at 0. --- kernel/gsp_sema_service.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) (limited to 'kernel') diff --git a/kernel/gsp_sema_service.c b/kernel/gsp_sema_service.c index 020023a..ba26b3d 100644 --- a/kernel/gsp_sema_service.c +++ b/kernel/gsp_sema_service.c @@ -3486,9 +3486,14 @@ static void svc_handle_map_add(void) if (!ch->valid || !ch->gpfifo_entries) continue; + /* + * Clamp the rewind at 0: wrapping below zero (get=0 -> entries + * - N) makes the pump read ring slots past the producer that + * hold stale entries, so replay only recently consumed slots + * or from the start of the ring, never around the wrap. + */ get = ch->last_get; - ch->last_get = (get >= SVC_PIN_REWIND) ? get - SVC_PIN_REWIND : - ch->gpfifo_entries - (SVC_PIN_REWIND - get); + ch->last_get = (get >= SVC_PIN_REWIND) ? get - SVC_PIN_REWIND : 0; } spin_unlock_irqrestore(&svc.chan_lock, flags); -- cgit v1.2.3