From 40411a6837620097efe2cf15f322f0526ae45385 Mon Sep 17 00:00:00 2001 From: Arthur Hanson Rasmusson Date: Tue, 29 Sep 2026 15:19:34 -0400 Subject: sema-svc: never apply swept-page releases with no live channel (guest boot corruption); tooling guards --- kernel/gsp_sema_service.c | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+) (limited to 'kernel') diff --git a/kernel/gsp_sema_service.c b/kernel/gsp_sema_service.c index ae8f7da..b29e833 100644 --- a/kernel/gsp_sema_service.c +++ b/kernel/gsp_sema_service.c @@ -2668,6 +2668,29 @@ static u32 svc_apply_page_data(struct nv_vgpu_device *vgpu, const u8 *buf, u64 pa_page) { u32 off, applied = 0; + bool any = false; + unsigned long flags; + int ci; + + /* + * No live channel: no client can be waiting on a release, so a + * "release" decoded from an arbitrary swept page can only be a false + * positive, and its write lands through whatever translation the VA + * happens to have (observed: 2 applied writes while the guest kernel + * was booting corrupted a task's CPU field and panicked the guest + * scheduler). Only apply swept-page releases while a client exists; + * real releases are carried by the channels' readable pushes then. + */ + spin_lock_irqsave(&svc.chan_lock, flags); + for (ci = 0; ci < SVC_MAX_CHANNELS; ci++) { + if (svc.chan[ci].valid) { + any = true; + break; + } + } + spin_unlock_irqrestore(&svc.chan_lock, flags); + if (!any) + return 0; /* * Decoded execution: walk the page as a method stream and perform the -- cgit v1.2.3