From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-10.8 required=3.0 tests=DKIMWL_WL_HIGH,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,INCLUDES_PATCH,MAILING_LIST_MULTI,SIGNED_OFF_BY, SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 21A66C04EBF for ; Wed, 5 Dec 2018 09:40:45 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id C748A2084C for ; Wed, 5 Dec 2018 09:40:44 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (1024-bit key) header.d=kernel.org header.i=@kernel.org header.b="TXlcQeHe" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org C748A2084C Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=kernel.org Authentication-Results: mail.kernel.org; spf=none smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728273AbeLEJkn (ORCPT ); Wed, 5 Dec 2018 04:40:43 -0500 Received: from mail.kernel.org ([198.145.29.99]:45082 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727500AbeLEJkl (ORCPT ); Wed, 5 Dec 2018 04:40:41 -0500 Received: from sasha-vm.mshome.net (unknown [213.57.143.11]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 32D2720878; Wed, 5 Dec 2018 09:40:36 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1544002839; bh=0NjT6KtPnm/7kLgsOWVmJ3AiQTcFIPwVU0yE1xS3N2E=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=TXlcQeHeBz4/ZewphIwnWeWdypt2AZNT54bwyvj2xLG25mXHmKDPKmiNuVgqOikBI EcYYi4SBUmqlN4WDmLHUCQ8mzCXzOPWBP8BuD6GaSJs/AY8aZYN9JiT1jYK3BNTmem US43nZlZdMkyknhs+qLGcfeWpHSpbAkNGTJA+vhs= From: Sasha Levin To: stable@vger.kernel.org, linux-kernel@vger.kernel.org Cc: Bernd Eckstein <3erndeckstein@gmail.com>, Oliver Zweigle , Bernd Eckstein <3ernd.Eckstein@gmail.com>, "David S . Miller" , Sasha Levin , linux-usb@vger.kernel.org, netdev@vger.kernel.org Subject: [PATCH AUTOSEL 4.19 083/123] usbnet: ipheth: fix potential recvmsg bug and recvmsg bug 2 Date: Wed, 5 Dec 2018 04:35:15 -0500 Message-Id: <20181205093555.5386-83-sashal@kernel.org> X-Mailer: git-send-email 2.17.1 In-Reply-To: <20181205093555.5386-1-sashal@kernel.org> References: <20181205093555.5386-1-sashal@kernel.org> Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Bernd Eckstein <3erndeckstein@gmail.com> [ Upstream commit 45611c61dd503454b2edae00aabe1e429ec49ebe ] The bug is not easily reproducable, as it may occur very infrequently (we had machines with 20minutes heavy downloading before it occurred) However, on a virual machine (VMWare on Windows 10 host) it occurred pretty frequently (1-2 seconds after a speedtest was started) dev->tx_skb mab be freed via dev_kfree_skb_irq on a callback before it is set. This causes the following problems: - double free of the skb or potential memory leak - in dmesg: 'recvmsg bug' and 'recvmsg bug 2' and eventually general protection fault Example dmesg output: [ 134.841986] ------------[ cut here ]------------ [ 134.841987] recvmsg bug: copied 9C24A555 seq 9C24B557 rcvnxt 9C25A6B3 fl 0 [ 134.841993] WARNING: CPU: 7 PID: 2629 at /build/linux-hwe-On9fm7/linux-hwe-4.15.0/net/ipv4/tcp.c:1865 tcp_recvmsg+0x44d/0xab0 [ 134.841994] Modules linked in: ipheth(OE) kvm_intel kvm irqbypass crct10dif_pclmul crc32_pclmul ghash_clmulni_intel pcbc aesni_intel aes_x86_64 crypto_simd glue_helper cryptd vmw_balloon intel_rapl_perf joydev input_leds serio_raw vmw_vsock_vmci_transport vsock shpchp i2c_piix4 mac_hid binfmt_misc vmw_vmci parport_pc ppdev lp parport autofs4 vmw_pvscsi vmxnet3 hid_generic usbhid hid vmwgfx ttm drm_kms_helper syscopyarea sysfillrect mptspi mptscsih sysimgblt ahci psmouse fb_sys_fops pata_acpi mptbase libahci e1000 drm scsi_transport_spi [ 134.842046] CPU: 7 PID: 2629 Comm: python Tainted: G W OE 4.15.0-34-generic #37~16.04.1-Ubuntu [ 134.842046] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 05/19/2017 [ 134.842048] RIP: 0010:tcp_recvmsg+0x44d/0xab0 [ 134.842048] RSP: 0018:ffffa6630422bcc8 EFLAGS: 00010286 [ 134.842049] RAX: 0000000000000000 RBX: ffff997616f4f200 RCX: 0000000000000006 [ 134.842049] RDX: 0000000000000007 RSI: 0000000000000082 RDI: ffff9976257d6490 [ 134.842050] RBP: ffffa6630422bd98 R08: 0000000000000001 R09: 000000000004bba4 [ 134.842050] R10: 0000000001e00c6f R11: 000000000004bba4 R12: ffff99760dee3000 [ 134.842051] R13: 0000000000000000 R14: ffff99760dee3514 R15: 0000000000000000 [ 134.842051] FS: 00007fe332347700(0000) GS:ffff9976257c0000(0000) knlGS:0000000000000000 [ 134.842052] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 134.842053] CR2: 0000000001e41000 CR3: 000000020e9b4006 CR4: 00000000003606e0 [ 134.842055] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 134.842055] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 134.842057] Call Trace: [ 134.842060] ? aa_sk_perm+0x53/0x1a0 [ 134.842064] inet_recvmsg+0x51/0xc0 [ 134.842066] sock_recvmsg+0x43/0x50 [ 134.842070] SYSC_recvfrom+0xe4/0x160 [ 134.842072] ? __schedule+0x3de/0x8b0 [ 134.842075] ? ktime_get_ts64+0x4c/0xf0 [ 134.842079] SyS_recvfrom+0xe/0x10 [ 134.842082] do_syscall_64+0x73/0x130 [ 134.842086] entry_SYSCALL_64_after_hwframe+0x3d/0xa2 [ 134.842086] RIP: 0033:0x7fe331f5a81d [ 134.842088] RSP: 002b:00007ffe8da98398 EFLAGS: 00000246 ORIG_RAX: 000000000000002d [ 134.842090] RAX: ffffffffffffffda RBX: ffffffffffffffff RCX: 00007fe331f5a81d [ 134.842094] RDX: 00000000000003fb RSI: 0000000001e00874 RDI: 0000000000000003 [ 134.842095] RBP: 00007fe32f642c70 R08: 0000000000000000 R09: 0000000000000000 [ 134.842097] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fe332347698 [ 134.842099] R13: 0000000001b7e0a0 R14: 0000000001e00874 R15: 0000000000000000 [ 134.842103] Code: 24 fd ff ff e9 cc fe ff ff 48 89 d8 41 8b 8c 24 10 05 00 00 44 8b 45 80 48 c7 c7 08 bd 59 8b 48 89 85 68 ff ff ff e8 b3 c4 7d ff <0f> 0b 48 8b 85 68 ff ff ff e9 e9 fe ff ff 41 8b 8c 24 10 05 00 [ 134.842126] ---[ end trace b7138fc08c83147f ]--- [ 134.842144] general protection fault: 0000 [#1] SMP PTI [ 134.842145] Modules linked in: ipheth(OE) kvm_intel kvm irqbypass crct10dif_pclmul crc32_pclmul ghash_clmulni_intel pcbc aesni_intel aes_x86_64 crypto_simd glue_helper cryptd vmw_balloon intel_rapl_perf joydev input_leds serio_raw vmw_vsock_vmci_transport vsock shpchp i2c_piix4 mac_hid binfmt_misc vmw_vmci parport_pc ppdev lp parport autofs4 vmw_pvscsi vmxnet3 hid_generic usbhid hid vmwgfx ttm drm_kms_helper syscopyarea sysfillrect mptspi mptscsih sysimgblt ahci psmouse fb_sys_fops pata_acpi mptbase libahci e1000 drm scsi_transport_spi [ 134.842161] CPU: 7 PID: 2629 Comm: python Tainted: G W OE 4.15.0-34-generic #37~16.04.1-Ubuntu [ 134.842162] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 05/19/2017 [ 134.842164] RIP: 0010:tcp_close+0x2c6/0x440 [ 134.842165] RSP: 0018:ffffa6630422bde8 EFLAGS: 00010202 [ 134.842167] RAX: 0000000000000000 RBX: ffff99760dee3000 RCX: 0000000180400034 [ 134.842168] RDX: 5c4afd407207a6c4 RSI: ffffe868495bd300 RDI: ffff997616f4f200 [ 134.842169] RBP: ffffa6630422be08 R08: 0000000016f4d401 R09: 0000000180400034 [ 134.842169] R10: ffffa6630422bd98 R11: 0000000000000000 R12: 000000000000600c [ 134.842170] R13: 0000000000000000 R14: ffff99760dee30c8 R15: ffff9975bd44fe00 [ 134.842171] FS: 00007fe332347700(0000) GS:ffff9976257c0000(0000) knlGS:0000000000000000 [ 134.842173] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 134.842174] CR2: 0000000001e41000 CR3: 000000020e9b4006 CR4: 00000000003606e0 [ 134.842177] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 134.842178] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 134.842179] Call Trace: [ 134.842181] inet_release+0x42/0x70 [ 134.842183] __sock_release+0x42/0xb0 [ 134.842184] sock_close+0x15/0x20 [ 134.842187] __fput+0xea/0x220 [ 134.842189] ____fput+0xe/0x10 [ 134.842191] task_work_run+0x8a/0xb0 [ 134.842193] exit_to_usermode_loop+0xc4/0xd0 [ 134.842195] do_syscall_64+0xf4/0x130 [ 134.842197] entry_SYSCALL_64_after_hwframe+0x3d/0xa2 [ 134.842197] RIP: 0033:0x7fe331f5a560 [ 134.842198] RSP: 002b:00007ffe8da982e8 EFLAGS: 00000246 ORIG_RAX: 0000000000000003 [ 134.842200] RAX: 0000000000000000 RBX: 00007fe32f642c70 RCX: 00007fe331f5a560 [ 134.842201] RDX: 00000000008f5320 RSI: 0000000001cd4b50 RDI: 0000000000000003 [ 134.842202] RBP: 00007fe32f6500f8 R08: 000000000000003c R09: 00000000009343c0 [ 134.842203] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fe32f6500d0 [ 134.842204] R13: 00000000008f5320 R14: 00000000008f5320 R15: 0000000001cd4770 [ 134.842205] Code: c8 00 00 00 45 31 e4 49 39 fe 75 4d eb 50 83 ab d8 00 00 00 01 48 8b 17 48 8b 47 08 48 c7 07 00 00 00 00 48 c7 47 08 00 00 00 00 <48> 89 42 08 48 89 10 0f b6 57 34 8b 47 2c 2b 47 28 83 e2 01 80 [ 134.842226] RIP: tcp_close+0x2c6/0x440 RSP: ffffa6630422bde8 [ 134.842227] ---[ end trace b7138fc08c831480 ]--- The proposed patch eliminates a potential racing condition. Before, usb_submit_urb was called and _after_ that, the skb was attached (dev->tx_skb). So, on a callback it was possible, however unlikely that the skb was freed before it was set. That way (because dev->tx_skb was not set to NULL after it was freed), it could happen that a skb from a earlier transmission was freed a second time (and the skb we should have freed did not get freed at all) Now we free the skb directly in ipheth_tx(). It is not passed to the callback anymore, eliminating the posibility of a double free of the same skb. Depending on the retval of usb_submit_urb() we use dev_kfree_skb_any() respectively dev_consume_skb_any() to free the skb. Signed-off-by: Oliver Zweigle Signed-off-by: Bernd Eckstein <3ernd.Eckstein@gmail.com> Signed-off-by: David S. Miller Signed-off-by: Sasha Levin --- drivers/net/usb/ipheth.c | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-) diff --git a/drivers/net/usb/ipheth.c b/drivers/net/usb/ipheth.c index 7275761a1177..3d8a70d3ea9b 100644 --- a/drivers/net/usb/ipheth.c +++ b/drivers/net/usb/ipheth.c @@ -140,7 +140,6 @@ struct ipheth_device { struct usb_device *udev; struct usb_interface *intf; struct net_device *net; - struct sk_buff *tx_skb; struct urb *tx_urb; struct urb *rx_urb; unsigned char *tx_buf; @@ -230,6 +229,7 @@ static void ipheth_rcvbulk_callback(struct urb *urb) case -ENOENT: case -ECONNRESET: case -ESHUTDOWN: + case -EPROTO: return; case 0: break; @@ -281,7 +281,6 @@ static void ipheth_sndbulk_callback(struct urb *urb) dev_err(&dev->intf->dev, "%s: urb status: %d\n", __func__, status); - dev_kfree_skb_irq(dev->tx_skb); if (status == 0) netif_wake_queue(dev->net); else @@ -423,7 +422,7 @@ static int ipheth_tx(struct sk_buff *skb, struct net_device *net) if (skb->len > IPHETH_BUF_SIZE) { WARN(1, "%s: skb too large: %d bytes\n", __func__, skb->len); dev->net->stats.tx_dropped++; - dev_kfree_skb_irq(skb); + dev_kfree_skb_any(skb); return NETDEV_TX_OK; } @@ -443,12 +442,11 @@ static int ipheth_tx(struct sk_buff *skb, struct net_device *net) dev_err(&dev->intf->dev, "%s: usb_submit_urb: %d\n", __func__, retval); dev->net->stats.tx_errors++; - dev_kfree_skb_irq(skb); + dev_kfree_skb_any(skb); } else { - dev->tx_skb = skb; - dev->net->stats.tx_packets++; dev->net->stats.tx_bytes += skb->len; + dev_consume_skb_any(skb); netif_stop_queue(net); } -- 2.17.1 From mboxrd@z Thu Jan 1 00:00:00 1970 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: base64 Subject: [AUTOSEL,4.19,083/123] usbnet: ipheth: fix potential recvmsg bug and recvmsg bug 2 From: Sasha Levin Message-Id: <20181205093555.5386-83-sashal@kernel.org> Date: Wed, 5 Dec 2018 04:35:15 -0500 To: stable@vger.kernel.org, linux-kernel@vger.kernel.org Cc: Bernd Eckstein <3erndeckstein@gmail.com>, Oliver Zweigle , Bernd Eckstein <3ernd.Eckstein@gmail.com>, "David S . Miller" , Sasha Levin , linux-usb@vger.kernel.org, netdev@vger.kernel.org List-ID: RnJvbTogQmVybmQgRWNrc3RlaW4gPDNlcm5kZWNrc3RlaW5AZ21haWwuY29tPgoKWyBVcHN0cmVh bSBjb21taXQgNDU2MTFjNjFkZDUwMzQ1NGIyZWRhZTAwYWFiZTFlNDI5ZWM0OWViZSBdCgpUaGUg YnVnIGlzIG5vdCBlYXNpbHkgcmVwcm9kdWNhYmxlLCBhcyBpdCBtYXkgb2NjdXIgdmVyeSBpbmZy ZXF1ZW50bHkKKHdlIGhhZCBtYWNoaW5lcyB3aXRoIDIwbWludXRlcyBoZWF2eSBkb3dubG9hZGlu ZyBiZWZvcmUgaXQgb2NjdXJyZWQpCkhvd2V2ZXIsIG9uIGEgdmlydWFsIG1hY2hpbmUgKFZNV2Fy ZSBvbiBXaW5kb3dzIDEwIGhvc3QpIGl0IG9jY3VycmVkCnByZXR0eSBmcmVxdWVudGx5ICgxLTIg c2Vjb25kcyBhZnRlciBhIHNwZWVkdGVzdCB3YXMgc3RhcnRlZCkKCmRldi0+dHhfc2tiIG1hYiBi ZSBmcmVlZCB2aWEgZGV2X2tmcmVlX3NrYl9pcnEgb24gYSBjYWxsYmFjawpiZWZvcmUgaXQgaXMg c2V0LgoKVGhpcyBjYXVzZXMgdGhlIGZvbGxvd2luZyBwcm9ibGVtczoKLSBkb3VibGUgZnJlZSBv ZiB0aGUgc2tiIG9yIHBvdGVudGlhbCBtZW1vcnkgbGVhawotIGluIGRtZXNnOiAncmVjdm1zZyBi dWcnIGFuZCAncmVjdm1zZyBidWcgMicgYW5kIGV2ZW50dWFsbHkKICBnZW5lcmFsIHByb3RlY3Rp b24gZmF1bHQKCkV4YW1wbGUgZG1lc2cgb3V0cHV0OgpbICAxMzQuODQxOTg2XSAtLS0tLS0tLS0t LS1bIGN1dCBoZXJlIF0tLS0tLS0tLS0tLS0KWyAgMTM0Ljg0MTk4N10gcmVjdm1zZyBidWc6IGNv cGllZCA5QzI0QTU1NSBzZXEgOUMyNEI1NTcgcmN2bnh0IDlDMjVBNkIzIGZsIDAKWyAgMTM0Ljg0 MTk5M10gV0FSTklORzogQ1BVOiA3IFBJRDogMjYyOSBhdCAvYnVpbGQvbGludXgtaHdlLU9uOWZt Ny9saW51eC1od2UtNC4xNS4wL25ldC9pcHY0L3RjcC5jOjE4NjUgdGNwX3JlY3Ztc2crMHg0NGQv MHhhYjAKWyAgMTM0Ljg0MTk5NF0gTW9kdWxlcyBsaW5rZWQgaW46IGlwaGV0aChPRSkga3ZtX2lu dGVsIGt2bSBpcnFieXBhc3MgY3JjdDEwZGlmX3BjbG11bCBjcmMzMl9wY2xtdWwgZ2hhc2hfY2xt dWxuaV9pbnRlbCBwY2JjIGFlc25pX2ludGVsIGFlc194ODZfNjQgY3J5cHRvX3NpbWQgZ2x1ZV9o ZWxwZXIgY3J5cHRkIHZtd19iYWxsb29uIGludGVsX3JhcGxfcGVyZiBqb3lkZXYgaW5wdXRfbGVk cyBzZXJpb19yYXcgdm13X3Zzb2NrX3ZtY2lfdHJhbnNwb3J0IHZzb2NrIHNocGNocCBpMmNfcGlp eDQgbWFjX2hpZCBiaW5mbXRfbWlzYyB2bXdfdm1jaSBwYXJwb3J0X3BjIHBwZGV2IGxwIHBhcnBv cnQgYXV0b2ZzNCB2bXdfcHZzY3NpIHZteG5ldDMgaGlkX2dlbmVyaWMgdXNiaGlkIGhpZCB2bXdn ZnggdHRtIGRybV9rbXNfaGVscGVyIHN5c2NvcHlhcmVhIHN5c2ZpbGxyZWN0IG1wdHNwaSBtcHRz Y3NpaCBzeXNpbWdibHQgYWhjaSBwc21vdXNlIGZiX3N5c19mb3BzIHBhdGFfYWNwaSBtcHRiYXNl IGxpYmFoY2kgZTEwMDAgZHJtIHNjc2lfdHJhbnNwb3J0X3NwaQpbICAxMzQuODQyMDQ2XSBDUFU6 IDcgUElEOiAyNjI5IENvbW06IHB5dGhvbiBUYWludGVkOiBHICAgICAgICBXICBPRSAgICA0LjE1 LjAtMzQtZ2VuZXJpYyAjMzd+MTYuMDQuMS1VYnVudHUKWyAgMTM0Ljg0MjA0Nl0gSGFyZHdhcmUg bmFtZTogVk13YXJlLCBJbmMuIFZNd2FyZSBWaXJ0dWFsIFBsYXRmb3JtLzQ0MEJYIERlc2t0b3Ag UmVmZXJlbmNlIFBsYXRmb3JtLCBCSU9TIDYuMDAgMDUvMTkvMjAxNwpbICAxMzQuODQyMDQ4XSBS SVA6IDAwMTA6dGNwX3JlY3Ztc2crMHg0NGQvMHhhYjAKWyAgMTM0Ljg0MjA0OF0gUlNQOiAwMDE4 OmZmZmZhNjYzMDQyMmJjYzggRUZMQUdTOiAwMDAxMDI4NgpbICAxMzQuODQyMDQ5XSBSQVg6IDAw MDAwMDAwMDAwMDAwMDAgUkJYOiBmZmZmOTk3NjE2ZjRmMjAwIFJDWDogMDAwMDAwMDAwMDAwMDAw NgpbICAxMzQuODQyMDQ5XSBSRFg6IDAwMDAwMDAwMDAwMDAwMDcgUlNJOiAwMDAwMDAwMDAwMDAw MDgyIFJESTogZmZmZjk5NzYyNTdkNjQ5MApbICAxMzQuODQyMDUwXSBSQlA6IGZmZmZhNjYzMDQy MmJkOTggUjA4OiAwMDAwMDAwMDAwMDAwMDAxIFIwOTogMDAwMDAwMDAwMDA0YmJhNApbICAxMzQu ODQyMDUwXSBSMTA6IDAwMDAwMDAwMDFlMDBjNmYgUjExOiAwMDAwMDAwMDAwMDRiYmE0IFIxMjog ZmZmZjk5NzYwZGVlMzAwMApbICAxMzQuODQyMDUxXSBSMTM6IDAwMDAwMDAwMDAwMDAwMDAgUjE0 OiBmZmZmOTk3NjBkZWUzNTE0IFIxNTogMDAwMDAwMDAwMDAwMDAwMApbICAxMzQuODQyMDUxXSBG UzogIDAwMDA3ZmUzMzIzNDc3MDAoMDAwMCkgR1M6ZmZmZjk5NzYyNTdjMDAwMCgwMDAwKSBrbmxH UzowMDAwMDAwMDAwMDAwMDAwClsgIDEzNC44NDIwNTJdIENTOiAgMDAxMCBEUzogMDAwMCBFUzog MDAwMCBDUjA6IDAwMDAwMDAwODAwNTAwMzMKWyAgMTM0Ljg0MjA1M10gQ1IyOiAwMDAwMDAwMDAx ZTQxMDAwIENSMzogMDAwMDAwMDIwZTliNDAwNiBDUjQ6IDAwMDAwMDAwMDAzNjA2ZTAKWyAgMTM0 Ljg0MjA1NV0gRFIwOiAwMDAwMDAwMDAwMDAwMDAwIERSMTogMDAwMDAwMDAwMDAwMDAwMCBEUjI6 IDAwMDAwMDAwMDAwMDAwMDAKWyAgMTM0Ljg0MjA1NV0gRFIzOiAwMDAwMDAwMDAwMDAwMDAwIERS NjogMDAwMDAwMDBmZmZlMGZmMCBEUjc6IDAwMDAwMDAwMDAwMDA0MDAKWyAgMTM0Ljg0MjA1N10g Q2FsbCBUcmFjZToKWyAgMTM0Ljg0MjA2MF0gID8gYWFfc2tfcGVybSsweDUzLzB4MWEwClsgIDEz NC44NDIwNjRdICBpbmV0X3JlY3Ztc2crMHg1MS8weGMwClsgIDEzNC44NDIwNjZdICBzb2NrX3Jl Y3Ztc2crMHg0My8weDUwClsgIDEzNC44NDIwNzBdICBTWVNDX3JlY3Zmcm9tKzB4ZTQvMHgxNjAK WyAgMTM0Ljg0MjA3Ml0gID8gX19zY2hlZHVsZSsweDNkZS8weDhiMApbICAxMzQuODQyMDc1XSAg PyBrdGltZV9nZXRfdHM2NCsweDRjLzB4ZjAKWyAgMTM0Ljg0MjA3OV0gIFN5U19yZWN2ZnJvbSsw eGUvMHgxMApbICAxMzQuODQyMDgyXSAgZG9fc3lzY2FsbF82NCsweDczLzB4MTMwClsgIDEzNC44 NDIwODZdICBlbnRyeV9TWVNDQUxMXzY0X2FmdGVyX2h3ZnJhbWUrMHgzZC8weGEyClsgIDEzNC44 NDIwODZdIFJJUDogMDAzMzoweDdmZTMzMWY1YTgxZApbICAxMzQuODQyMDg4XSBSU1A6IDAwMmI6 MDAwMDdmZmU4ZGE5ODM5OCBFRkxBR1M6IDAwMDAwMjQ2IE9SSUdfUkFYOiAwMDAwMDAwMDAwMDAw MDJkClsgIDEzNC44NDIwOTBdIFJBWDogZmZmZmZmZmZmZmZmZmZkYSBSQlg6IGZmZmZmZmZmZmZm ZmZmZmYgUkNYOiAwMDAwN2ZlMzMxZjVhODFkClsgIDEzNC44NDIwOTRdIFJEWDogMDAwMDAwMDAw MDAwMDNmYiBSU0k6IDAwMDAwMDAwMDFlMDA4NzQgUkRJOiAwMDAwMDAwMDAwMDAwMDAzClsgIDEz NC44NDIwOTVdIFJCUDogMDAwMDdmZTMyZjY0MmM3MCBSMDg6IDAwMDAwMDAwMDAwMDAwMDAgUjA5 OiAwMDAwMDAwMDAwMDAwMDAwClsgIDEzNC44NDIwOTddIFIxMDogMDAwMDAwMDAwMDAwMDAwMCBS MTE6IDAwMDAwMDAwMDAwMDAyNDYgUjEyOiAwMDAwN2ZlMzMyMzQ3Njk4ClsgIDEzNC44NDIwOTld IFIxMzogMDAwMDAwMDAwMWI3ZTBhMCBSMTQ6IDAwMDAwMDAwMDFlMDA4NzQgUjE1OiAwMDAwMDAw MDAwMDAwMDAwClsgIDEzNC44NDIxMDNdIENvZGU6IDI0IGZkIGZmIGZmIGU5IGNjIGZlIGZmIGZm IDQ4IDg5IGQ4IDQxIDhiIDhjIDI0IDEwIDA1IDAwIDAwIDQ0IDhiIDQ1IDgwIDQ4IGM3IGM3IDA4 IGJkIDU5IDhiIDQ4IDg5IDg1IDY4IGZmIGZmIGZmIGU4IGIzIGM0IDdkIGZmIDwwZj4gMGIgNDgg OGIgODUgNjggZmYgZmYgZmYgZTkgZTkgZmUgZmYgZmYgNDEgOGIgOGMgMjQgMTAgMDUgMDAKWyAg MTM0Ljg0MjEyNl0gLS0tWyBlbmQgdHJhY2UgYjcxMzhmYzA4YzgzMTQ3ZiBdLS0tClsgIDEzNC44 NDIxNDRdIGdlbmVyYWwgcHJvdGVjdGlvbiBmYXVsdDogMDAwMCBbIzFdIFNNUCBQVEkKWyAgMTM0 Ljg0MjE0NV0gTW9kdWxlcyBsaW5rZWQgaW46IGlwaGV0aChPRSkga3ZtX2ludGVsIGt2bSBpcnFi eXBhc3MgY3JjdDEwZGlmX3BjbG11bCBjcmMzMl9wY2xtdWwgZ2hhc2hfY2xtdWxuaV9pbnRlbCBw Y2JjIGFlc25pX2ludGVsIGFlc194ODZfNjQgY3J5cHRvX3NpbWQgZ2x1ZV9oZWxwZXIgY3J5cHRk IHZtd19iYWxsb29uIGludGVsX3JhcGxfcGVyZiBqb3lkZXYgaW5wdXRfbGVkcyBzZXJpb19yYXcg dm13X3Zzb2NrX3ZtY2lfdHJhbnNwb3J0IHZzb2NrIHNocGNocCBpMmNfcGlpeDQgbWFjX2hpZCBi aW5mbXRfbWlzYyB2bXdfdm1jaSBwYXJwb3J0X3BjIHBwZGV2IGxwIHBhcnBvcnQgYXV0b2ZzNCB2 bXdfcHZzY3NpIHZteG5ldDMgaGlkX2dlbmVyaWMgdXNiaGlkIGhpZCB2bXdnZnggdHRtIGRybV9r bXNfaGVscGVyIHN5c2NvcHlhcmVhIHN5c2ZpbGxyZWN0IG1wdHNwaSBtcHRzY3NpaCBzeXNpbWdi bHQgYWhjaSBwc21vdXNlIGZiX3N5c19mb3BzIHBhdGFfYWNwaSBtcHRiYXNlIGxpYmFoY2kgZTEw MDAgZHJtIHNjc2lfdHJhbnNwb3J0X3NwaQpbICAxMzQuODQyMTYxXSBDUFU6IDcgUElEOiAyNjI5 IENvbW06IHB5dGhvbiBUYWludGVkOiBHICAgICAgICBXICBPRSAgICA0LjE1LjAtMzQtZ2VuZXJp YyAjMzd+MTYuMDQuMS1VYnVudHUKWyAgMTM0Ljg0MjE2Ml0gSGFyZHdhcmUgbmFtZTogVk13YXJl LCBJbmMuIFZNd2FyZSBWaXJ0dWFsIFBsYXRmb3JtLzQ0MEJYIERlc2t0b3AgUmVmZXJlbmNlIFBs YXRmb3JtLCBCSU9TIDYuMDAgMDUvMTkvMjAxNwpbICAxMzQuODQyMTY0XSBSSVA6IDAwMTA6dGNw X2Nsb3NlKzB4MmM2LzB4NDQwClsgIDEzNC44NDIxNjVdIFJTUDogMDAxODpmZmZmYTY2MzA0MjJi ZGU4IEVGTEFHUzogMDAwMTAyMDIKWyAgMTM0Ljg0MjE2N10gUkFYOiAwMDAwMDAwMDAwMDAwMDAw IFJCWDogZmZmZjk5NzYwZGVlMzAwMCBSQ1g6IDAwMDAwMDAxODA0MDAwMzQKWyAgMTM0Ljg0MjE2 OF0gUkRYOiA1YzRhZmQ0MDcyMDdhNmM0IFJTSTogZmZmZmU4Njg0OTViZDMwMCBSREk6IGZmZmY5 OTc2MTZmNGYyMDAKWyAgMTM0Ljg0MjE2OV0gUkJQOiBmZmZmYTY2MzA0MjJiZTA4IFIwODogMDAw MDAwMDAxNmY0ZDQwMSBSMDk6IDAwMDAwMDAxODA0MDAwMzQKWyAgMTM0Ljg0MjE2OV0gUjEwOiBm ZmZmYTY2MzA0MjJiZDk4IFIxMTogMDAwMDAwMDAwMDAwMDAwMCBSMTI6IDAwMDAwMDAwMDAwMDYw MGMKWyAgMTM0Ljg0MjE3MF0gUjEzOiAwMDAwMDAwMDAwMDAwMDAwIFIxNDogZmZmZjk5NzYwZGVl MzBjOCBSMTU6IGZmZmY5OTc1YmQ0NGZlMDAKWyAgMTM0Ljg0MjE3MV0gRlM6ICAwMDAwN2ZlMzMy MzQ3NzAwKDAwMDApIEdTOmZmZmY5OTc2MjU3YzAwMDAoMDAwMCkga25sR1M6MDAwMDAwMDAwMDAw MDAwMApbICAxMzQuODQyMTczXSBDUzogIDAwMTAgRFM6IDAwMDAgRVM6IDAwMDAgQ1IwOiAwMDAw MDAwMDgwMDUwMDMzClsgIDEzNC44NDIxNzRdIENSMjogMDAwMDAwMDAwMWU0MTAwMCBDUjM6IDAw MDAwMDAyMGU5YjQwMDYgQ1I0OiAwMDAwMDAwMDAwMzYwNmUwClsgIDEzNC44NDIxNzddIERSMDog MDAwMDAwMDAwMDAwMDAwMCBEUjE6IDAwMDAwMDAwMDAwMDAwMDAgRFIyOiAwMDAwMDAwMDAwMDAw MDAwClsgIDEzNC44NDIxNzhdIERSMzogMDAwMDAwMDAwMDAwMDAwMCBEUjY6IDAwMDAwMDAwZmZm ZTBmZjAgRFI3OiAwMDAwMDAwMDAwMDAwNDAwClsgIDEzNC44NDIxNzldIENhbGwgVHJhY2U6Clsg IDEzNC44NDIxODFdICBpbmV0X3JlbGVhc2UrMHg0Mi8weDcwClsgIDEzNC44NDIxODNdICBfX3Nv Y2tfcmVsZWFzZSsweDQyLzB4YjAKWyAgMTM0Ljg0MjE4NF0gIHNvY2tfY2xvc2UrMHgxNS8weDIw ClsgIDEzNC44NDIxODddICBfX2ZwdXQrMHhlYS8weDIyMApbICAxMzQuODQyMTg5XSAgX19fX2Zw dXQrMHhlLzB4MTAKWyAgMTM0Ljg0MjE5MV0gIHRhc2tfd29ya19ydW4rMHg4YS8weGIwClsgIDEz NC44NDIxOTNdICBleGl0X3RvX3VzZXJtb2RlX2xvb3ArMHhjNC8weGQwClsgIDEzNC44NDIxOTVd ICBkb19zeXNjYWxsXzY0KzB4ZjQvMHgxMzAKWyAgMTM0Ljg0MjE5N10gIGVudHJ5X1NZU0NBTExf NjRfYWZ0ZXJfaHdmcmFtZSsweDNkLzB4YTIKWyAgMTM0Ljg0MjE5N10gUklQOiAwMDMzOjB4N2Zl MzMxZjVhNTYwClsgIDEzNC44NDIxOThdIFJTUDogMDAyYjowMDAwN2ZmZThkYTk4MmU4IEVGTEFH UzogMDAwMDAyNDYgT1JJR19SQVg6IDAwMDAwMDAwMDAwMDAwMDMKWyAgMTM0Ljg0MjIwMF0gUkFY OiAwMDAwMDAwMDAwMDAwMDAwIFJCWDogMDAwMDdmZTMyZjY0MmM3MCBSQ1g6IDAwMDA3ZmUzMzFm NWE1NjAKWyAgMTM0Ljg0MjIwMV0gUkRYOiAwMDAwMDAwMDAwOGY1MzIwIFJTSTogMDAwMDAwMDAw MWNkNGI1MCBSREk6IDAwMDAwMDAwMDAwMDAwMDMKWyAgMTM0Ljg0MjIwMl0gUkJQOiAwMDAwN2Zl MzJmNjUwMGY4IFIwODogMDAwMDAwMDAwMDAwMDAzYyBSMDk6IDAwMDAwMDAwMDA5MzQzYzAKWyAg MTM0Ljg0MjIwM10gUjEwOiAwMDAwMDAwMDAwMDAwMDAwIFIxMTogMDAwMDAwMDAwMDAwMDI0NiBS MTI6IDAwMDA3ZmUzMmY2NTAwZDAKWyAgMTM0Ljg0MjIwNF0gUjEzOiAwMDAwMDAwMDAwOGY1MzIw IFIxNDogMDAwMDAwMDAwMDhmNTMyMCBSMTU6IDAwMDAwMDAwMDFjZDQ3NzAKWyAgMTM0Ljg0MjIw NV0gQ29kZTogYzggMDAgMDAgMDAgNDUgMzEgZTQgNDkgMzkgZmUgNzUgNGQgZWIgNTAgODMgYWIg ZDggMDAgMDAgMDAgMDEgNDggOGIgMTcgNDggOGIgNDcgMDggNDggYzcgMDcgMDAgMDAgMDAgMDAg NDggYzcgNDcgMDggMDAgMDAgMDAgMDAgPDQ4PiA4OSA0MiAwOCA0OCA4OSAxMCAwZiBiNiA1NyAz NCA4YiA0NyAyYyAyYiA0NyAyOCA4MyBlMiAwMSA4MApbICAxMzQuODQyMjI2XSBSSVA6IHRjcF9j bG9zZSsweDJjNi8weDQ0MCBSU1A6IGZmZmZhNjYzMDQyMmJkZTgKWyAgMTM0Ljg0MjIyN10gLS0t WyBlbmQgdHJhY2UgYjcxMzhmYzA4YzgzMTQ4MCBdLS0tCgpUaGUgcHJvcG9zZWQgcGF0Y2ggZWxp bWluYXRlcyBhIHBvdGVudGlhbCByYWNpbmcgY29uZGl0aW9uLgpCZWZvcmUsIHVzYl9zdWJtaXRf dXJiIHdhcyBjYWxsZWQgYW5kIF9hZnRlcl8gdGhhdCwgdGhlIHNrYiB3YXMgYXR0YWNoZWQKKGRl di0+dHhfc2tiKS4gU28sIG9uIGEgY2FsbGJhY2sgaXQgd2FzIHBvc3NpYmxlLCBob3dldmVyIHVu bGlrZWx5IHRoYXQgdGhlCnNrYiB3YXMgZnJlZWQgYmVmb3JlIGl0IHdhcyBzZXQuIFRoYXQgd2F5 IChiZWNhdXNlIGRldi0+dHhfc2tiIHdhcyBub3Qgc2V0CnRvIE5VTEwgYWZ0ZXIgaXQgd2FzIGZy ZWVkKSwgaXQgY291bGQgaGFwcGVuIHRoYXQgYSBza2IgZnJvbSBhIGVhcmxpZXIKdHJhbnNtaXNz aW9uIHdhcyBmcmVlZCBhIHNlY29uZCB0aW1lIChhbmQgdGhlIHNrYiB3ZSBzaG91bGQgaGF2ZSBm cmVlZCBkaWQKbm90IGdldCBmcmVlZCBhdCBhbGwpCgpOb3cgd2UgZnJlZSB0aGUgc2tiIGRpcmVj dGx5IGluIGlwaGV0aF90eCgpLiBJdCBpcyBub3QgcGFzc2VkIHRvIHRoZQpjYWxsYmFjayBhbnlt b3JlLCBlbGltaW5hdGluZyB0aGUgcG9zaWJpbGl0eSBvZiBhIGRvdWJsZSBmcmVlIG9mIHRoZSBz YW1lCnNrYi4gRGVwZW5kaW5nIG9uIHRoZSByZXR2YWwgb2YgdXNiX3N1Ym1pdF91cmIoKSB3ZSB1 c2UgZGV2X2tmcmVlX3NrYl9hbnkoKQpyZXNwZWN0aXZlbHkgZGV2X2NvbnN1bWVfc2tiX2FueSgp IHRvIGZyZWUgdGhlIHNrYi4KClNpZ25lZC1vZmYtYnk6IE9saXZlciBad2VpZ2xlIDxPbGl2ZXIu WndlaWdsZUBmYXJvLmNvbT4KU2lnbmVkLW9mZi1ieTogQmVybmQgRWNrc3RlaW4gPDNlcm5kLkVj a3N0ZWluQGdtYWlsLmNvbT4KU2lnbmVkLW9mZi1ieTogRGF2aWQgUy4gTWlsbGVyIDxkYXZlbUBk YXZlbWxvZnQubmV0PgpTaWduZWQtb2ZmLWJ5OiBTYXNoYSBMZXZpbiA8c2FzaGFsQGtlcm5lbC5v cmc+Ci0tLQogZHJpdmVycy9uZXQvdXNiL2lwaGV0aC5jIHwgMTAgKysrKy0tLS0tLQogMSBmaWxl IGNoYW5nZWQsIDQgaW5zZXJ0aW9ucygrKSwgNiBkZWxldGlvbnMoLSkKCmRpZmYgLS1naXQgYS9k cml2ZXJzL25ldC91c2IvaXBoZXRoLmMgYi9kcml2ZXJzL25ldC91c2IvaXBoZXRoLmMKaW5kZXgg NzI3NTc2MWExMTc3Li4zZDhhNzBkM2VhOWIgMTAwNjQ0Ci0tLSBhL2RyaXZlcnMvbmV0L3VzYi9p cGhldGguYworKysgYi9kcml2ZXJzL25ldC91c2IvaXBoZXRoLmMKQEAgLTE0MCw3ICsxNDAsNiBA QCBzdHJ1Y3QgaXBoZXRoX2RldmljZSB7CiAJc3RydWN0IHVzYl9kZXZpY2UgKnVkZXY7CiAJc3Ry dWN0IHVzYl9pbnRlcmZhY2UgKmludGY7CiAJc3RydWN0IG5ldF9kZXZpY2UgKm5ldDsKLQlzdHJ1 Y3Qgc2tfYnVmZiAqdHhfc2tiOwogCXN0cnVjdCB1cmIgKnR4X3VyYjsKIAlzdHJ1Y3QgdXJiICpy eF91cmI7CiAJdW5zaWduZWQgY2hhciAqdHhfYnVmOwpAQCAtMjMwLDYgKzIyOSw3IEBAIHN0YXRp YyB2b2lkIGlwaGV0aF9yY3ZidWxrX2NhbGxiYWNrKHN0cnVjdCB1cmIgKnVyYikKIAljYXNlIC1F Tk9FTlQ6CiAJY2FzZSAtRUNPTk5SRVNFVDoKIAljYXNlIC1FU0hVVERPV046CisJY2FzZSAtRVBS T1RPOgogCQlyZXR1cm47CiAJY2FzZSAwOgogCQlicmVhazsKQEAgLTI4MSw3ICsyODEsNiBAQCBz dGF0aWMgdm9pZCBpcGhldGhfc25kYnVsa19jYWxsYmFjayhzdHJ1Y3QgdXJiICp1cmIpCiAJCWRl dl9lcnIoJmRldi0+aW50Zi0+ZGV2LCAiJXM6IHVyYiBzdGF0dXM6ICVkXG4iLAogCQlfX2Z1bmNf Xywgc3RhdHVzKTsKIAotCWRldl9rZnJlZV9za2JfaXJxKGRldi0+dHhfc2tiKTsKIAlpZiAoc3Rh dHVzID09IDApCiAJCW5ldGlmX3dha2VfcXVldWUoZGV2LT5uZXQpOwogCWVsc2UKQEAgLTQyMyw3 ICs0MjIsNyBAQCBzdGF0aWMgaW50IGlwaGV0aF90eChzdHJ1Y3Qgc2tfYnVmZiAqc2tiLCBzdHJ1 Y3QgbmV0X2RldmljZSAqbmV0KQogCWlmIChza2ItPmxlbiA+IElQSEVUSF9CVUZfU0laRSkgewog CQlXQVJOKDEsICIlczogc2tiIHRvbyBsYXJnZTogJWQgYnl0ZXNcbiIsIF9fZnVuY19fLCBza2It Pmxlbik7CiAJCWRldi0+bmV0LT5zdGF0cy50eF9kcm9wcGVkKys7Ci0JCWRldl9rZnJlZV9za2Jf aXJxKHNrYik7CisJCWRldl9rZnJlZV9za2JfYW55KHNrYik7CiAJCXJldHVybiBORVRERVZfVFhf T0s7CiAJfQogCkBAIC00NDMsMTIgKzQ0MiwxMSBAQCBzdGF0aWMgaW50IGlwaGV0aF90eChzdHJ1 Y3Qgc2tfYnVmZiAqc2tiLCBzdHJ1Y3QgbmV0X2RldmljZSAqbmV0KQogCQlkZXZfZXJyKCZkZXYt PmludGYtPmRldiwgIiVzOiB1c2Jfc3VibWl0X3VyYjogJWRcbiIsCiAJCQlfX2Z1bmNfXywgcmV0 dmFsKTsKIAkJZGV2LT5uZXQtPnN0YXRzLnR4X2Vycm9ycysrOwotCQlkZXZfa2ZyZWVfc2tiX2ly cShza2IpOworCQlkZXZfa2ZyZWVfc2tiX2FueShza2IpOwogCX0gZWxzZSB7Ci0JCWRldi0+dHhf c2tiID0gc2tiOwotCiAJCWRldi0+bmV0LT5zdGF0cy50eF9wYWNrZXRzKys7CiAJCWRldi0+bmV0 LT5zdGF0cy50eF9ieXRlcyArPSBza2ItPmxlbjsKKwkJZGV2X2NvbnN1bWVfc2tiX2FueShza2Ip OwogCQluZXRpZl9zdG9wX3F1ZXVlKG5ldCk7CiAJfQogCg==