From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 8100FC001DE for ; Thu, 20 Jul 2023 20:22:22 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230191AbjGTUWU (ORCPT ); Thu, 20 Jul 2023 16:22:20 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59978 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229653AbjGTUWT (ORCPT ); Thu, 20 Jul 2023 16:22:19 -0400 Received: from madras.collabora.co.uk (madras.collabora.co.uk [46.235.227.172]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id BA2E0271C; Thu, 20 Jul 2023 13:22:17 -0700 (PDT) Received: from nicolas-tpx395.localdomain (unknown [IPv6:2606:6d00:11:83d4::7a9]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) (Authenticated sender: nicolas) by madras.collabora.co.uk (Postfix) with ESMTPSA id 9C9576607094; Thu, 20 Jul 2023 21:22:14 +0100 (BST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=collabora.com; s=mail; t=1689884536; bh=6M9ZDL21aWrrFRYxWzAwtVegdIAxdx1kKWISs1pHSfY=; h=Subject:From:To:Cc:Date:In-Reply-To:References:From; b=ajaVbOG/FS7aLl4qzeKDNblnyhHDdjhv4HXGt+6yqnskc/OSnzK4NiLvWsLFt2sW0 xTP00Wi6Tcc0cGAl2LSXYGcOG0ujX7CRXDgceHtAuE6XEdvPvWVCAaaQBWoaW6wpm9 EOhr4D8ohufkzr4u0Q83tDXnGXYbxeFkXqgSmsMhVTlG8kPmVaQhMbmNOWefEGt/7W 7+yFPSuduXlaQmFf9fL7yoi+GpiTtNq2F8ypI+Sj/DzrtN4o9eG6yo+ePaqj7zKyfy Us246olv2/lmFLICCNghaggVQppOpduYaTsHMucFYhlm9gnS+CXPO3Cnkm/mM+Zj9u 6UeEisI8xvNvw== Message-ID: <02e3f58e3dc009eadd1f37ac3d7d65a95706c9a6.camel@collabora.com> Subject: Re: [PATCH 1/2] media: mediatek: vcodec: checking decoder ack message parameter From: Nicolas Dufresne To: Yunfei Dong , =?ISO-8859-1?Q?N=EDcolas?= "F . R . A . Prado" , Hans Verkuil , AngeloGioacchino Del Regno , Benjamin Gaignard , Nathan Hebert Cc: Chen-Yu Tsai , Hsin-Yi Wang , Fritz Koenig , Daniel Vetter , Steve Cho , linux-media@vger.kernel.org, devicetree@vger.kernel.org, linux-kernel@vger.kernel.org, linux-arm-kernel@lists.infradead.org, linux-mediatek@lists.infradead.org, Project_Global_Chrome_Upstream_Group@mediatek.com Date: Thu, 20 Jul 2023 16:22:06 -0400 In-Reply-To: <20230717081319.12542-1-yunfei.dong@mediatek.com> References: <20230717081319.12542-1-yunfei.dong@mediatek.com> Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable User-Agent: Evolution 3.48.4 (3.48.4-1.fc38) MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Hi, Le lundi 17 juillet 2023 =C3=A0 16:13 +0800, Yunfei Dong a =C3=A9crit=C2=A0= : > Need to checking all parameters of msg data are valid or not, > in case of access null pointer or unreasonable value leading > to kernel reboot. >=20 > Signed-off-by: Yunfei Dong > --- > .../vcodec/decoder/mtk_vcodec_dec_drv.h | 2 + > .../mediatek/vcodec/decoder/vdec_vpu_if.c | 77 ++++++++++++------- > 2 files changed, 52 insertions(+), 27 deletions(-) >=20 > diff --git a/drivers/media/platform/mediatek/vcodec/decoder/mtk_vcodec_de= c_drv.h b/drivers/media/platform/mediatek/vcodec/decoder/mtk_vcodec_dec_drv= .h > index c8b4374c5e6c..1ea5dbb475dd 100644 > --- a/drivers/media/platform/mediatek/vcodec/decoder/mtk_vcodec_dec_drv.h > +++ b/drivers/media/platform/mediatek/vcodec/decoder/mtk_vcodec_dec_drv.h > @@ -160,6 +160,7 @@ struct mtk_vcodec_dec_pdata { > * @hw_id: hardware index used to identify different hardware. > * > * @msg_queue: msg queue used to store lat buffer information. > + * @vpu_inst: vpu instance pointer. > */ > struct mtk_vcodec_dec_ctx { > enum mtk_instance_type type; > @@ -202,6 +203,7 @@ struct mtk_vcodec_dec_ctx { > int hw_id; > =20 > struct vdec_msg_queue msg_queue; > + void *vpu_inst; > }; > =20 > /** > diff --git a/drivers/media/platform/mediatek/vcodec/decoder/vdec_vpu_if.c= b/drivers/media/platform/mediatek/vcodec/decoder/vdec_vpu_if.c > index 82c3dc8c4127..23cfe5c6c90b 100644 > --- a/drivers/media/platform/mediatek/vcodec/decoder/vdec_vpu_if.c > +++ b/drivers/media/platform/mediatek/vcodec/decoder/vdec_vpu_if.c > @@ -72,6 +72,21 @@ static void handle_get_param_msg_ack(const struct vdec= _vpu_ipi_get_param_ack *ms > } > } > =20 > +static bool vpu_dec_check_ap_inst(struct mtk_vcodec_dec_dev *dec_dev, st= ruct vdec_vpu_inst *vpu) > +{ > + struct mtk_vcodec_dec_ctx *ctx; > + int ret =3D false; > + > + list_for_each_entry(ctx, &dec_dev->ctx_list, list) { I'm not quite fully aware of the threading model in place, but this ctx_lis= t is normally protected by dev->dev_mutex, and is not being protected here. I al= so don't know which type of interrupt handler we are in here. > + if (!IS_ERR_OR_NULL(ctx) && ctx->vpu_inst =3D=3D vpu) { > + ret =3D true; > + break; > + } > + } > + > + return ret; > +} > + > /* > * vpu_dec_ipi_handler - Handler for VPU ipi message. > * > @@ -84,44 +99,51 @@ static void handle_get_param_msg_ack(const struct vde= c_vpu_ipi_get_param_ack *ms > */ > static void vpu_dec_ipi_handler(void *data, unsigned int len, void *priv= ) > { > + struct mtk_vcodec_dec_dev *dec_dev; > const struct vdec_vpu_ipi_ack *msg =3D data; > - struct vdec_vpu_inst *vpu =3D (struct vdec_vpu_inst *) > - (unsigned long)msg->ap_inst_addr; > + struct vdec_vpu_inst *vpu; > =20 > - if (!vpu) { > + dec_dev =3D (struct mtk_vcodec_dec_dev *)priv; > + vpu =3D (struct vdec_vpu_inst *)(unsigned long)msg->ap_inst_addr; > + if (!priv || !vpu) { > mtk_v4l2_vdec_err(vpu->ctx, "ap_inst_addr is NULL, did the SCP hang or= crash?"); > return; > } > =20 > - mtk_vdec_debug(vpu->ctx, "+ id=3D%X", msg->msg_id); > + if (!vpu_dec_check_ap_inst(dec_dev, vpu) || msg->msg_id < VPU_IPIMSG_DE= C_INIT_ACK || > + msg->msg_id > VPU_IPIMSG_DEC_GET_PARAM_ACK) { > + mtk_v4l2_vdec_err(vpu->ctx, "vdec msg id not correctly =3D> 0x%x", msg= ->msg_id); > + vpu->failure =3D -EINVAL; > + goto error; > + } > =20 > vpu->failure =3D msg->status; > - vpu->signaled =3D 1; > + if (msg->status !=3D 0) > + goto error; > =20 > - if (msg->status =3D=3D 0) { > - switch (msg->msg_id) { > - case VPU_IPIMSG_DEC_INIT_ACK: > - handle_init_ack_msg(data); > - break; > + switch (msg->msg_id) { > + case VPU_IPIMSG_DEC_INIT_ACK: > + handle_init_ack_msg(data); > + break; > =20 > - case VPU_IPIMSG_DEC_START_ACK: > - case VPU_IPIMSG_DEC_END_ACK: > - case VPU_IPIMSG_DEC_DEINIT_ACK: > - case VPU_IPIMSG_DEC_RESET_ACK: > - case VPU_IPIMSG_DEC_CORE_ACK: > - case VPU_IPIMSG_DEC_CORE_END_ACK: > - break; > + case VPU_IPIMSG_DEC_START_ACK: > + case VPU_IPIMSG_DEC_END_ACK: > + case VPU_IPIMSG_DEC_DEINIT_ACK: > + case VPU_IPIMSG_DEC_RESET_ACK: > + case VPU_IPIMSG_DEC_CORE_ACK: > + case VPU_IPIMSG_DEC_CORE_END_ACK: > + break; > =20 > - case VPU_IPIMSG_DEC_GET_PARAM_ACK: > - handle_get_param_msg_ack(data); > - break; > - default: > - mtk_vdec_err(vpu->ctx, "invalid msg=3D%X", msg->msg_id); > - break; > - } > + case VPU_IPIMSG_DEC_GET_PARAM_ACK: > + handle_get_param_msg_ack(data); > + break; > + default: > + mtk_vdec_err(vpu->ctx, "invalid msg=3D%X", msg->msg_id); > + break; > } > =20 > - mtk_vdec_debug(vpu->ctx, "- id=3D%X", msg->msg_id); > +error: > + vpu->signaled =3D 1; > } > =20 > static int vcodec_vpu_send_msg(struct vdec_vpu_inst *vpu, void *msg, int= len) > @@ -182,9 +204,10 @@ int vpu_dec_init(struct vdec_vpu_inst *vpu) > =20 > init_waitqueue_head(&vpu->wq); > vpu->handler =3D vpu_dec_ipi_handler; > + vpu->ctx->vpu_inst =3D vpu; > =20 > err =3D mtk_vcodec_fw_ipi_register(vpu->ctx->dev->fw_handler, vpu->id, > - vpu->handler, "vdec", NULL); > + vpu->handler, "vdec", vpu->ctx->dev); > if (err) { > mtk_vdec_err(vpu->ctx, "vpu_ipi_register fail status=3D%d", err); > return err; > @@ -193,7 +216,7 @@ int vpu_dec_init(struct vdec_vpu_inst *vpu) > if (vpu->ctx->dev->vdec_pdata->hw_arch =3D=3D MTK_VDEC_LAT_SINGLE_CORE)= { > err =3D mtk_vcodec_fw_ipi_register(vpu->ctx->dev->fw_handler, > vpu->core_id, vpu->handler, > - "vdec", NULL); > + "vdec", vpu->ctx->dev); > if (err) { > mtk_vdec_err(vpu->ctx, "vpu_ipi_register core fail status=3D%d", err)= ; > return err; From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 06D26C001DC for ; Thu, 20 Jul 2023 20:22:42 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:MIME-Version:References:In-Reply-To: Date:Cc:To:From:Subject:Message-ID:Reply-To:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: List-Owner; bh=1O7qzRJVIOD7Vvf2CTY6uXvGUVhoIDAMqvR6arpLTWU=; b=MtzYt69X7oIB+y jdb5l3ODhJbfDPI6OR3vKtsXEuspK3I6MHeu7O+pGL30ZGturPRjS9NkNeoFSj1ODHjilrTRE6XU9 oeeSGlAUtLd+Hr35DHrmaG0QIi5UQLjgJa/lHUVMU84zyAAXVStcjLAnxFpJIdxTpI04OvJQQO4QO gg31IRb57MY1NcYeOcTa7B+hZLzLvQQKpUaejRMvG/6Q+V6+4dWgCE9X3QlJVx285NvW+7zKjDByp ROC2eOWPzzqOsYdIq+ORuEmqHnw/hCnmJvYqDGnlN6DthG72OtDblOzrqDoecwhvLlrHiFnAUlSpU Z195NFv8psFeW8xLae9A==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.96 #2 (Red Hat Linux)) id 1qMaAK-00C95c-1e; Thu, 20 Jul 2023 20:22:24 +0000 Received: from madras.collabora.co.uk ([2a00:1098:0:82:1000:25:2eeb:e5ab]) by bombadil.infradead.org with esmtps (Exim 4.96 #2 (Red Hat Linux)) id 1qMaAH-00C942-1G; Thu, 20 Jul 2023 20:22:23 +0000 Received: from nicolas-tpx395.localdomain (unknown [IPv6:2606:6d00:11:83d4::7a9]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) (Authenticated sender: nicolas) by madras.collabora.co.uk (Postfix) with ESMTPSA id 9C9576607094; Thu, 20 Jul 2023 21:22:14 +0100 (BST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=collabora.com; s=mail; t=1689884536; bh=6M9ZDL21aWrrFRYxWzAwtVegdIAxdx1kKWISs1pHSfY=; h=Subject:From:To:Cc:Date:In-Reply-To:References:From; b=ajaVbOG/FS7aLl4qzeKDNblnyhHDdjhv4HXGt+6yqnskc/OSnzK4NiLvWsLFt2sW0 xTP00Wi6Tcc0cGAl2LSXYGcOG0ujX7CRXDgceHtAuE6XEdvPvWVCAaaQBWoaW6wpm9 EOhr4D8ohufkzr4u0Q83tDXnGXYbxeFkXqgSmsMhVTlG8kPmVaQhMbmNOWefEGt/7W 7+yFPSuduXlaQmFf9fL7yoi+GpiTtNq2F8ypI+Sj/DzrtN4o9eG6yo+ePaqj7zKyfy Us246olv2/lmFLICCNghaggVQppOpduYaTsHMucFYhlm9gnS+CXPO3Cnkm/mM+Zj9u 6UeEisI8xvNvw== Message-ID: <02e3f58e3dc009eadd1f37ac3d7d65a95706c9a6.camel@collabora.com> Subject: Re: [PATCH 1/2] media: mediatek: vcodec: checking decoder ack message parameter From: Nicolas Dufresne To: Yunfei Dong , =?ISO-8859-1?Q?N=EDcolas?= "F . R . A . Prado" , Hans Verkuil , AngeloGioacchino Del Regno , Benjamin Gaignard , Nathan Hebert Cc: Chen-Yu Tsai , Hsin-Yi Wang , Fritz Koenig , Daniel Vetter , Steve Cho , linux-media@vger.kernel.org, devicetree@vger.kernel.org, linux-kernel@vger.kernel.org, linux-arm-kernel@lists.infradead.org, linux-mediatek@lists.infradead.org, Project_Global_Chrome_Upstream_Group@mediatek.com Date: Thu, 20 Jul 2023 16:22:06 -0400 In-Reply-To: <20230717081319.12542-1-yunfei.dong@mediatek.com> References: <20230717081319.12542-1-yunfei.dong@mediatek.com> User-Agent: Evolution 3.48.4 (3.48.4-1.fc38) MIME-Version: 1.0 X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20230720_132221_711166_4399A686 X-CRM114-Status: GOOD ( 21.31 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org SGksCgpMZSBsdW5kaSAxNyBqdWlsbGV0IDIwMjMgw6AgMTY6MTMgKzA4MDAsIFl1bmZlaSBEb25n IGEgw6ljcml0wqA6Cj4gTmVlZCB0byBjaGVja2luZyBhbGwgcGFyYW1ldGVycyBvZiBtc2cgZGF0 YSBhcmUgdmFsaWQgb3Igbm90LAo+IGluIGNhc2Ugb2YgYWNjZXNzIG51bGwgcG9pbnRlciBvciB1 bnJlYXNvbmFibGUgdmFsdWUgbGVhZGluZwo+IHRvIGtlcm5lbCByZWJvb3QuCj4gCj4gU2lnbmVk LW9mZi1ieTogWXVuZmVpIERvbmcgPHl1bmZlaS5kb25nQG1lZGlhdGVrLmNvbT4KPiAtLS0KPiAg Li4uL3Zjb2RlYy9kZWNvZGVyL210a192Y29kZWNfZGVjX2Rydi5oICAgICAgIHwgIDIgKwo+ICAu Li4vbWVkaWF0ZWsvdmNvZGVjL2RlY29kZXIvdmRlY192cHVfaWYuYyAgICAgfCA3NyArKysrKysr KysrKystLS0tLS0tCj4gIDIgZmlsZXMgY2hhbmdlZCwgNTIgaW5zZXJ0aW9ucygrKSwgMjcgZGVs ZXRpb25zKC0pCj4gCj4gZGlmZiAtLWdpdCBhL2RyaXZlcnMvbWVkaWEvcGxhdGZvcm0vbWVkaWF0 ZWsvdmNvZGVjL2RlY29kZXIvbXRrX3Zjb2RlY19kZWNfZHJ2LmggYi9kcml2ZXJzL21lZGlhL3Bs YXRmb3JtL21lZGlhdGVrL3Zjb2RlYy9kZWNvZGVyL210a192Y29kZWNfZGVjX2Rydi5oCj4gaW5k ZXggYzhiNDM3NGM1ZTZjLi4xZWE1ZGJiNDc1ZGQgMTAwNjQ0Cj4gLS0tIGEvZHJpdmVycy9tZWRp YS9wbGF0Zm9ybS9tZWRpYXRlay92Y29kZWMvZGVjb2Rlci9tdGtfdmNvZGVjX2RlY19kcnYuaAo+ ICsrKyBiL2RyaXZlcnMvbWVkaWEvcGxhdGZvcm0vbWVkaWF0ZWsvdmNvZGVjL2RlY29kZXIvbXRr X3Zjb2RlY19kZWNfZHJ2LmgKPiBAQCAtMTYwLDYgKzE2MCw3IEBAIHN0cnVjdCBtdGtfdmNvZGVj X2RlY19wZGF0YSB7Cj4gICAqIEBod19pZDogaGFyZHdhcmUgaW5kZXggdXNlZCB0byBpZGVudGlm eSBkaWZmZXJlbnQgaGFyZHdhcmUuCj4gICAqCj4gICAqIEBtc2dfcXVldWU6IG1zZyBxdWV1ZSB1 c2VkIHRvIHN0b3JlIGxhdCBidWZmZXIgaW5mb3JtYXRpb24uCj4gKyAqIEB2cHVfaW5zdDogdnB1 IGluc3RhbmNlIHBvaW50ZXIuCj4gICAqLwo+ICBzdHJ1Y3QgbXRrX3Zjb2RlY19kZWNfY3R4IHsK PiAgCWVudW0gbXRrX2luc3RhbmNlX3R5cGUgdHlwZTsKPiBAQCAtMjAyLDYgKzIwMyw3IEBAIHN0 cnVjdCBtdGtfdmNvZGVjX2RlY19jdHggewo+ICAJaW50IGh3X2lkOwo+ICAKPiAgCXN0cnVjdCB2 ZGVjX21zZ19xdWV1ZSBtc2dfcXVldWU7Cj4gKwl2b2lkICp2cHVfaW5zdDsKPiAgfTsKPiAgCj4g IC8qKgo+IGRpZmYgLS1naXQgYS9kcml2ZXJzL21lZGlhL3BsYXRmb3JtL21lZGlhdGVrL3Zjb2Rl Yy9kZWNvZGVyL3ZkZWNfdnB1X2lmLmMgYi9kcml2ZXJzL21lZGlhL3BsYXRmb3JtL21lZGlhdGVr L3Zjb2RlYy9kZWNvZGVyL3ZkZWNfdnB1X2lmLmMKPiBpbmRleCA4MmMzZGM4YzQxMjcuLjIzY2Zl NWM2YzkwYiAxMDA2NDQKPiAtLS0gYS9kcml2ZXJzL21lZGlhL3BsYXRmb3JtL21lZGlhdGVrL3Zj b2RlYy9kZWNvZGVyL3ZkZWNfdnB1X2lmLmMKPiArKysgYi9kcml2ZXJzL21lZGlhL3BsYXRmb3Jt L21lZGlhdGVrL3Zjb2RlYy9kZWNvZGVyL3ZkZWNfdnB1X2lmLmMKPiBAQCAtNzIsNiArNzIsMjEg QEAgc3RhdGljIHZvaWQgaGFuZGxlX2dldF9wYXJhbV9tc2dfYWNrKGNvbnN0IHN0cnVjdCB2ZGVj X3ZwdV9pcGlfZ2V0X3BhcmFtX2FjayAqbXMKPiAgCX0KPiAgfQo+ICAKPiArc3RhdGljIGJvb2wg dnB1X2RlY19jaGVja19hcF9pbnN0KHN0cnVjdCBtdGtfdmNvZGVjX2RlY19kZXYgKmRlY19kZXYs IHN0cnVjdCB2ZGVjX3ZwdV9pbnN0ICp2cHUpCj4gK3sKPiArCXN0cnVjdCBtdGtfdmNvZGVjX2Rl Y19jdHggKmN0eDsKPiArCWludCByZXQgPSBmYWxzZTsKPiArCj4gKwlsaXN0X2Zvcl9lYWNoX2Vu dHJ5KGN0eCwgJmRlY19kZXYtPmN0eF9saXN0LCBsaXN0KSB7CgpJJ20gbm90IHF1aXRlIGZ1bGx5 IGF3YXJlIG9mIHRoZSB0aHJlYWRpbmcgbW9kZWwgaW4gcGxhY2UsIGJ1dCB0aGlzIGN0eF9saXN0 IGlzCm5vcm1hbGx5IHByb3RlY3RlZCBieSBkZXYtPmRldl9tdXRleCwgYW5kIGlzIG5vdCBiZWlu ZyBwcm90ZWN0ZWQgaGVyZS4gSSBhbHNvCmRvbid0IGtub3cgd2hpY2ggdHlwZSBvZiBpbnRlcnJ1 cHQgaGFuZGxlciB3ZSBhcmUgaW4gaGVyZS4KCj4gKwkJaWYgKCFJU19FUlJfT1JfTlVMTChjdHgp ICYmIGN0eC0+dnB1X2luc3QgPT0gdnB1KSB7Cj4gKwkJCXJldCA9IHRydWU7Cj4gKwkJCWJyZWFr Owo+ICsJCX0KPiArCX0KPiArCj4gKwlyZXR1cm4gcmV0Owo+ICt9Cj4gKwo+ICAvKgo+ICAgKiB2 cHVfZGVjX2lwaV9oYW5kbGVyIC0gSGFuZGxlciBmb3IgVlBVIGlwaSBtZXNzYWdlLgo+ICAgKgo+ IEBAIC04NCw0NCArOTksNTEgQEAgc3RhdGljIHZvaWQgaGFuZGxlX2dldF9wYXJhbV9tc2dfYWNr KGNvbnN0IHN0cnVjdCB2ZGVjX3ZwdV9pcGlfZ2V0X3BhcmFtX2FjayAqbXMKPiAgICovCj4gIHN0 YXRpYyB2b2lkIHZwdV9kZWNfaXBpX2hhbmRsZXIodm9pZCAqZGF0YSwgdW5zaWduZWQgaW50IGxl biwgdm9pZCAqcHJpdikKPiAgewo+ICsJc3RydWN0IG10a192Y29kZWNfZGVjX2RldiAqZGVjX2Rl djsKPiAgCWNvbnN0IHN0cnVjdCB2ZGVjX3ZwdV9pcGlfYWNrICptc2cgPSBkYXRhOwo+IC0Jc3Ry dWN0IHZkZWNfdnB1X2luc3QgKnZwdSA9IChzdHJ1Y3QgdmRlY192cHVfaW5zdCAqKQo+IC0JCQkJ CSh1bnNpZ25lZCBsb25nKW1zZy0+YXBfaW5zdF9hZGRyOwo+ICsJc3RydWN0IHZkZWNfdnB1X2lu c3QgKnZwdTsKPiAgCj4gLQlpZiAoIXZwdSkgewo+ICsJZGVjX2RldiA9IChzdHJ1Y3QgbXRrX3Zj b2RlY19kZWNfZGV2ICopcHJpdjsKPiArCXZwdSA9IChzdHJ1Y3QgdmRlY192cHVfaW5zdCAqKSh1 bnNpZ25lZCBsb25nKW1zZy0+YXBfaW5zdF9hZGRyOwo+ICsJaWYgKCFwcml2IHx8ICF2cHUpIHsK PiAgCQltdGtfdjRsMl92ZGVjX2Vycih2cHUtPmN0eCwgImFwX2luc3RfYWRkciBpcyBOVUxMLCBk aWQgdGhlIFNDUCBoYW5nIG9yIGNyYXNoPyIpOwo+ICAJCXJldHVybjsKPiAgCX0KPiAgCj4gLQlt dGtfdmRlY19kZWJ1Zyh2cHUtPmN0eCwgIisgaWQ9JVgiLCBtc2ctPm1zZ19pZCk7Cj4gKwlpZiAo IXZwdV9kZWNfY2hlY2tfYXBfaW5zdChkZWNfZGV2LCB2cHUpIHx8IG1zZy0+bXNnX2lkIDwgVlBV X0lQSU1TR19ERUNfSU5JVF9BQ0sgfHwKPiArCSAgICBtc2ctPm1zZ19pZCA+IFZQVV9JUElNU0df REVDX0dFVF9QQVJBTV9BQ0spIHsKPiArCQltdGtfdjRsMl92ZGVjX2Vycih2cHUtPmN0eCwgInZk ZWMgbXNnIGlkIG5vdCBjb3JyZWN0bHkgPT4gMHgleCIsIG1zZy0+bXNnX2lkKTsKPiArCQl2cHUt PmZhaWx1cmUgPSAtRUlOVkFMOwo+ICsJCWdvdG8gZXJyb3I7Cj4gKwl9Cj4gIAo+ICAJdnB1LT5m YWlsdXJlID0gbXNnLT5zdGF0dXM7Cj4gLQl2cHUtPnNpZ25hbGVkID0gMTsKPiArCWlmIChtc2ct PnN0YXR1cyAhPSAwKQo+ICsJCWdvdG8gZXJyb3I7Cj4gIAo+IC0JaWYgKG1zZy0+c3RhdHVzID09 IDApIHsKPiAtCQlzd2l0Y2ggKG1zZy0+bXNnX2lkKSB7Cj4gLQkJY2FzZSBWUFVfSVBJTVNHX0RF Q19JTklUX0FDSzoKPiAtCQkJaGFuZGxlX2luaXRfYWNrX21zZyhkYXRhKTsKPiAtCQkJYnJlYWs7 Cj4gKwlzd2l0Y2ggKG1zZy0+bXNnX2lkKSB7Cj4gKwljYXNlIFZQVV9JUElNU0dfREVDX0lOSVRf QUNLOgo+ICsJCWhhbmRsZV9pbml0X2Fja19tc2coZGF0YSk7Cj4gKwkJYnJlYWs7Cj4gIAo+IC0J CWNhc2UgVlBVX0lQSU1TR19ERUNfU1RBUlRfQUNLOgo+IC0JCWNhc2UgVlBVX0lQSU1TR19ERUNf RU5EX0FDSzoKPiAtCQljYXNlIFZQVV9JUElNU0dfREVDX0RFSU5JVF9BQ0s6Cj4gLQkJY2FzZSBW UFVfSVBJTVNHX0RFQ19SRVNFVF9BQ0s6Cj4gLQkJY2FzZSBWUFVfSVBJTVNHX0RFQ19DT1JFX0FD SzoKPiAtCQljYXNlIFZQVV9JUElNU0dfREVDX0NPUkVfRU5EX0FDSzoKPiAtCQkJYnJlYWs7Cj4g KwljYXNlIFZQVV9JUElNU0dfREVDX1NUQVJUX0FDSzoKPiArCWNhc2UgVlBVX0lQSU1TR19ERUNf RU5EX0FDSzoKPiArCWNhc2UgVlBVX0lQSU1TR19ERUNfREVJTklUX0FDSzoKPiArCWNhc2UgVlBV X0lQSU1TR19ERUNfUkVTRVRfQUNLOgo+ICsJY2FzZSBWUFVfSVBJTVNHX0RFQ19DT1JFX0FDSzoK PiArCWNhc2UgVlBVX0lQSU1TR19ERUNfQ09SRV9FTkRfQUNLOgo+ICsJCWJyZWFrOwo+ICAKPiAt CQljYXNlIFZQVV9JUElNU0dfREVDX0dFVF9QQVJBTV9BQ0s6Cj4gLQkJCWhhbmRsZV9nZXRfcGFy YW1fbXNnX2FjayhkYXRhKTsKPiAtCQkJYnJlYWs7Cj4gLQkJZGVmYXVsdDoKPiAtCQkJbXRrX3Zk ZWNfZXJyKHZwdS0+Y3R4LCAiaW52YWxpZCBtc2c9JVgiLCBtc2ctPm1zZ19pZCk7Cj4gLQkJCWJy ZWFrOwo+IC0JCX0KPiArCWNhc2UgVlBVX0lQSU1TR19ERUNfR0VUX1BBUkFNX0FDSzoKPiArCQlo YW5kbGVfZ2V0X3BhcmFtX21zZ19hY2soZGF0YSk7Cj4gKwkJYnJlYWs7Cj4gKwlkZWZhdWx0Ogo+ ICsJCW10a192ZGVjX2Vycih2cHUtPmN0eCwgImludmFsaWQgbXNnPSVYIiwgbXNnLT5tc2dfaWQp Owo+ICsJCWJyZWFrOwo+ICAJfQo+ICAKPiAtCW10a192ZGVjX2RlYnVnKHZwdS0+Y3R4LCAiLSBp ZD0lWCIsIG1zZy0+bXNnX2lkKTsKPiArZXJyb3I6Cj4gKwl2cHUtPnNpZ25hbGVkID0gMTsKPiAg fQo+ICAKPiAgc3RhdGljIGludCB2Y29kZWNfdnB1X3NlbmRfbXNnKHN0cnVjdCB2ZGVjX3ZwdV9p bnN0ICp2cHUsIHZvaWQgKm1zZywgaW50IGxlbikKPiBAQCAtMTgyLDkgKzIwNCwxMCBAQCBpbnQg dnB1X2RlY19pbml0KHN0cnVjdCB2ZGVjX3ZwdV9pbnN0ICp2cHUpCj4gIAo+ICAJaW5pdF93YWl0 cXVldWVfaGVhZCgmdnB1LT53cSk7Cj4gIAl2cHUtPmhhbmRsZXIgPSB2cHVfZGVjX2lwaV9oYW5k bGVyOwo+ICsJdnB1LT5jdHgtPnZwdV9pbnN0ID0gdnB1Owo+ICAKPiAgCWVyciA9IG10a192Y29k ZWNfZndfaXBpX3JlZ2lzdGVyKHZwdS0+Y3R4LT5kZXYtPmZ3X2hhbmRsZXIsIHZwdS0+aWQsCj4g LQkJCQkJIHZwdS0+aGFuZGxlciwgInZkZWMiLCBOVUxMKTsKPiArCQkJCQkgdnB1LT5oYW5kbGVy LCAidmRlYyIsIHZwdS0+Y3R4LT5kZXYpOwo+ICAJaWYgKGVycikgewo+ICAJCW10a192ZGVjX2Vy cih2cHUtPmN0eCwgInZwdV9pcGlfcmVnaXN0ZXIgZmFpbCBzdGF0dXM9JWQiLCBlcnIpOwo+ICAJ CXJldHVybiBlcnI7Cj4gQEAgLTE5Myw3ICsyMTYsNyBAQCBpbnQgdnB1X2RlY19pbml0KHN0cnVj dCB2ZGVjX3ZwdV9pbnN0ICp2cHUpCj4gIAlpZiAodnB1LT5jdHgtPmRldi0+dmRlY19wZGF0YS0+ aHdfYXJjaCA9PSBNVEtfVkRFQ19MQVRfU0lOR0xFX0NPUkUpIHsKPiAgCQllcnIgPSBtdGtfdmNv ZGVjX2Z3X2lwaV9yZWdpc3Rlcih2cHUtPmN0eC0+ZGV2LT5md19oYW5kbGVyLAo+ICAJCQkJCQkg dnB1LT5jb3JlX2lkLCB2cHUtPmhhbmRsZXIsCj4gLQkJCQkJCSAidmRlYyIsIE5VTEwpOwo+ICsJ CQkJCQkgInZkZWMiLCB2cHUtPmN0eC0+ZGV2KTsKPiAgCQlpZiAoZXJyKSB7Cj4gIAkJCW10a192 ZGVjX2Vycih2cHUtPmN0eCwgInZwdV9pcGlfcmVnaXN0ZXIgY29yZSBmYWlsIHN0YXR1cz0lZCIs IGVycik7Cj4gIAkJCXJldHVybiBlcnI7CgoKX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX18KbGludXgtYXJtLWtlcm5lbCBtYWlsaW5nIGxpc3QKbGludXgtYXJt LWtlcm5lbEBsaXN0cy5pbmZyYWRlYWQub3JnCmh0dHA6Ly9saXN0cy5pbmZyYWRlYWQub3JnL21h aWxtYW4vbGlzdGluZm8vbGludXgtYXJtLWtlcm5lbAo=