From 914145a8b84bb744c9c0779c925c20d14d4fa6bf Mon Sep 17 00:00:00 2001 From: Arthur Hanson Rasmusson Date: Fri, 9 Oct 2026 16:06:03 -0400 Subject: vgsp-sema: implausible window-guess push reads fall through to per-page resolvers (ISSUE-0002) r49: the second session's CE push pages beyond the paired base page read all-zero through the linear window guess; because the window read 'succeeded', the learned/discovered/targeted resolvers (src=3) were never tried and every follow-up push was held as unreadable (crel frozen, client spinning). A valid push's first chunk always parses as a method stream, so require that for the window source on the first chunk only and fall through otherwise. Correct window reads are unaffected. --- kernel/gsp_sema_service.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+) (limited to 'kernel') diff --git a/kernel/gsp_sema_service.c b/kernel/gsp_sema_service.c index c545242..a789796 100644 --- a/kernel/gsp_sema_service.c +++ b/kernel/gsp_sema_service.c @@ -7696,6 +7696,21 @@ static int svc_read_va_push_ex(struct nv_vgpu_device *vgpu, if (via_ipin && first && !svc_push_prefix_ok(p, chunk)) continue; /* content says: wrong pin */ + /* + * ISSUE-0002 (r50): a window guess is a linear + * extrapolation from the paired base page; the push + * buffer is not guaranteed physically contiguous (r49: + * the second session's CE push pages read all-zero + * through the window while the per-page sources were + * never tried because the window read "succeeded"). + * Never let an implausible window read shadow the + * learned/discovered resolvers: fall through to src=3. + * A valid push's first chunk always parses, so this + * cannot reject a correct window read. + */ + if (src == 2 && first && + !svc_method_stream_plausible(p, chunk)) + continue; done = true; } if (!done) -- cgit v1.2.3