From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-7.0 required=3.0 tests=HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_PATCH,MAILING_LIST_MULTI,SIGNED_OFF_BY,SPF_PASS,URIBL_BLOCKED autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id D6B37C282C7 for ; Tue, 29 Jan 2019 18:39:41 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 9F58A20856 for ; Tue, 29 Jan 2019 18:39:41 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1729062AbfA2Sjk (ORCPT ); Tue, 29 Jan 2019 13:39:40 -0500 Received: from mx1.redhat.com ([209.132.183.28]:16103 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726852AbfA2Sjj (ORCPT ); Tue, 29 Jan 2019 13:39:39 -0500 Received: from smtp.corp.redhat.com (int-mx05.intmail.prod.int.phx2.redhat.com [10.5.11.15]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id 268EF51EF3; Tue, 29 Jan 2019 18:39:39 +0000 (UTC) Received: from malachite.bss.redhat.com (dhcp-10-20-1-11.bss.redhat.com [10.20.1.11]) by smtp.corp.redhat.com (Postfix) with ESMTP id 067F51713D; Tue, 29 Jan 2019 18:39:32 +0000 (UTC) From: Lyude Paul To: intel-gfx@lists.freedesktop.org, dri-devel@lists.freedesktop.org Cc: Daniel Vetter , Maarten Lankhorst , Maxime Ripard , Sean Paul , David Airlie , linux-kernel@vger.kernel.org Subject: [PATCH 1/3] drm/dp_mst: Fix unbalanced malloc ref in drm_dp_mst_deallocate_vcpi() Date: Tue, 29 Jan 2019 13:39:25 -0500 Message-Id: <20190129183928.26779-2-lyude@redhat.com> In-Reply-To: <20190129183928.26779-1-lyude@redhat.com> References: <20190129183928.26779-1-lyude@redhat.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Scanned-By: MIMEDefang 2.79 on 10.5.11.15 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.30]); Tue, 29 Jan 2019 18:39:39 +0000 (UTC) Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org In drm_dp_mst_deallocate_vcpi(), we currently unconditionally call drm_dp_mst_put_port_malloc() on the port that's passed to us, even if we never successfully allocated VCPI to it. This is contrary to what we do in drm_dp_mst_allocate_vcpi(), where we only call drm_dp_mst_get_port_malloc() on the passed port if we successfully allocated VCPI to it. As a result, if drm_dp_mst_allocate_vcpi() fails during a modeset and another successive modeset calls drm_dp_mst_deallocate_vcpi() we will end up dropping someone else's malloc reference to the port. Example: [ 962.309260] ================================================================== [ 962.309290] BUG: KASAN: use-after-free in drm_dp_mst_put_port_malloc+0x72/0x180 [drm_kms_helper] [ 962.309296] Read of size 4 at addr ffff888416c30004 by task kworker/0:1H/500 [ 962.309308] CPU: 0 PID: 500 Comm: kworker/0:1H Tainted: G W O 5.0.0-rc2Lyude-Test+ #1 [ 962.309313] Hardware name: LENOVO 20L8S2N800/20L8S2N800, BIOS N22ET35W (1.12 ) 04/09/2018 [ 962.309428] Workqueue: events_highpri intel_atomic_cleanup_work [i915] [ 962.309434] Call Trace: [ 962.309452] dump_stack+0xad/0x150 [ 962.309462] ? dump_stack_print_info.cold.0+0x1b/0x1b [ 962.309472] ? kmsg_dump_rewind_nolock+0xd9/0xd9 [ 962.309504] ? drm_dp_mst_put_port_malloc+0x72/0x180 [drm_kms_helper] [ 962.309515] print_address_description+0x6c/0x23c [ 962.309542] ? drm_dp_mst_put_port_malloc+0x72/0x180 [drm_kms_helper] [ 962.309568] ? drm_dp_mst_put_port_malloc+0x72/0x180 [drm_kms_helper] [ 962.309577] kasan_report.cold.3+0x1a/0x32 [ 962.309605] ? drm_dp_mst_put_port_malloc+0x72/0x180 [drm_kms_helper] [ 962.309631] drm_dp_mst_put_port_malloc+0x72/0x180 [drm_kms_helper] [ 962.309658] ? drm_dp_mst_put_mstb_malloc+0x180/0x180 [drm_kms_helper] [ 962.309687] drm_dp_mst_destroy_state+0xcd/0x120 [drm_kms_helper] [ 962.309745] drm_atomic_state_default_clear+0x6ee/0xcc0 [drm] [ 962.309864] intel_atomic_state_clear+0xe/0x80 [i915] [ 962.309928] __drm_atomic_state_free+0x35/0xd0 [drm] [ 962.310044] intel_atomic_cleanup_work+0x56/0x70 [i915] [ 962.310057] process_one_work+0x884/0x1400 [ 962.310067] ? drain_workqueue+0x5a0/0x5a0 [ 962.310075] ? __schedule+0x87f/0x1e80 [ 962.310086] ? __sched_text_start+0x8/0x8 [ 962.310095] ? run_rebalance_domains+0x400/0x400 [ 962.310110] ? deref_stack_reg+0xb4/0x120 [ 962.310117] ? __read_once_size_nocheck.constprop.7+0x10/0x10 [ 962.310124] ? worker_enter_idle+0x47f/0x6a0 [ 962.310134] ? schedule+0xd7/0x2e0 [ 962.310141] ? __schedule+0x1e80/0x1e80 [ 962.310148] ? _raw_spin_lock_irq+0x9f/0x130 [ 962.310155] ? _raw_write_unlock_irqrestore+0x110/0x110 [ 962.310164] worker_thread+0x196/0x11e0 [ 962.310175] ? set_load_weight+0x2e0/0x2e0 [ 962.310181] ? __switch_to_asm+0x34/0x70 [ 962.310187] ? __switch_to_asm+0x40/0x70 [ 962.310194] ? process_one_work+0x1400/0x1400 [ 962.310199] ? __switch_to_asm+0x40/0x70 [ 962.310205] ? __switch_to_asm+0x34/0x70 [ 962.310211] ? __switch_to_asm+0x34/0x70 [ 962.310216] ? __switch_to_asm+0x40/0x70 [ 962.310221] ? __switch_to_asm+0x34/0x70 [ 962.310226] ? __switch_to_asm+0x40/0x70 [ 962.310231] ? __switch_to_asm+0x34/0x70 [ 962.310236] ? __switch_to_asm+0x40/0x70 [ 962.310242] ? syscall_return_via_sysret+0xf/0x7f [ 962.310248] ? __switch_to_asm+0x34/0x70 [ 962.310253] ? __switch_to_asm+0x40/0x70 [ 962.310258] ? __switch_to_asm+0x34/0x70 [ 962.310263] ? __switch_to_asm+0x40/0x70 [ 962.310268] ? __switch_to_asm+0x34/0x70 [ 962.310273] ? __switch_to_asm+0x40/0x70 [ 962.310281] ? __schedule+0x87f/0x1e80 [ 962.310292] ? __sched_text_start+0x8/0x8 [ 962.310300] ? save_stack+0x8c/0xb0 [ 962.310308] ? __kasan_kmalloc.constprop.6+0xc6/0xd0 [ 962.310313] ? kthread+0x98/0x3a0 [ 962.310318] ? ret_from_fork+0x35/0x40 [ 962.310334] ? __wake_up_common+0x178/0x6f0 [ 962.310343] ? _raw_spin_lock_irqsave+0xa4/0x140 [ 962.310349] ? __lock_text_start+0x8/0x8 [ 962.310355] ? _raw_write_lock_irqsave+0x70/0x130 [ 962.310360] ? __lock_text_start+0x8/0x8 [ 962.310371] ? process_one_work+0x1400/0x1400 [ 962.310376] kthread+0x2e2/0x3a0 [ 962.310383] ? kthread_create_on_node+0xc0/0xc0 [ 962.310389] ret_from_fork+0x35/0x40 [ 962.310401] Allocated by task 1462: [ 962.310410] __kasan_kmalloc.constprop.6+0xc6/0xd0 [ 962.310437] drm_dp_add_port+0xd60/0x1960 [drm_kms_helper] [ 962.310464] drm_dp_send_link_address+0x4b0/0x770 [drm_kms_helper] [ 962.310491] drm_dp_check_and_send_link_address+0x197/0x1f0 [drm_kms_helper] [ 962.310515] drm_dp_mst_link_probe_work+0x2b6/0x330 [drm_kms_helper] [ 962.310522] process_one_work+0x884/0x1400 [ 962.310529] worker_thread+0x196/0x11e0 [ 962.310533] kthread+0x2e2/0x3a0 [ 962.310538] ret_from_fork+0x35/0x40 [ 962.310543] Freed by task 500: [ 962.310550] __kasan_slab_free+0x133/0x180 [ 962.310555] kfree+0x92/0x1a0 [ 962.310581] drm_dp_mst_put_port_malloc+0x14d/0x180 [drm_kms_helper] [ 962.310693] intel_connector_destroy+0xb2/0xe0 [i915] [ 962.310747] drm_mode_object_put.part.0+0x12b/0x1a0 [drm] [ 962.310802] drm_atomic_state_default_clear+0x1f2/0xcc0 [drm] [ 962.310916] intel_atomic_state_clear+0xe/0x80 [i915] [ 962.310972] __drm_atomic_state_free+0x35/0xd0 [drm] [ 962.311083] intel_atomic_cleanup_work+0x56/0x70 [i915] [ 962.311092] process_one_work+0x884/0x1400 [ 962.311098] worker_thread+0x196/0x11e0 [ 962.311103] kthread+0x2e2/0x3a0 [ 962.311108] ret_from_fork+0x35/0x40 [ 962.311116] The buggy address belongs to the object at ffff888416c30000 which belongs to the cache kmalloc-2k of size 2048 [ 962.311122] The buggy address is located 4 bytes inside of 2048-byte region [ffff888416c30000, ffff888416c30800) [ 962.311124] The buggy address belongs to the page: [ 962.311132] page:ffffea00105b0c00 count:1 mapcount:0 mapping:ffff88841d003040 index:0x0 compound_mapcount: 0 [ 962.311142] flags: 0x8000000000010200(slab|head) [ 962.311152] raw: 8000000000010200 dead000000000100 dead000000000200 ffff88841d003040 [ 962.311159] raw: 0000000000000000 00000000000f000f 00000001ffffffff 0000000000000000 [ 962.311162] page dumped because: kasan: bad access detected So, bail early if drm_dp_mst_deallocate_vcpi() is called on a port with no VCPI allocation. Additionally, clean up the surrounding kerneldoc while we're at it since the port is assumed to be kept around because the DRM driver is expected to hold a malloc reference to it, not just us. Signed-off-by: Lyude Paul Fixes: eceae1472467 ("drm/dp_mst: Start tracking per-port VCPI allocations") Cc: Daniel Vetter --- drivers/gpu/drm/drm_dp_mst_topology.c | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) diff --git a/drivers/gpu/drm/drm_dp_mst_topology.c b/drivers/gpu/drm/drm_dp_mst_topology.c index 2552a27362a0..8ba0e5b368da 100644 --- a/drivers/gpu/drm/drm_dp_mst_topology.c +++ b/drivers/gpu/drm/drm_dp_mst_topology.c @@ -3246,15 +3246,13 @@ EXPORT_SYMBOL(drm_dp_mst_reset_vcpi_slots); /** * drm_dp_mst_deallocate_vcpi() - deallocate a VCPI * @mgr: manager for this port - * @port: unverified port to deallocate vcpi for + * @port: port to deallocate vcpi for */ void drm_dp_mst_deallocate_vcpi(struct drm_dp_mst_topology_mgr *mgr, struct drm_dp_mst_port *port) { - /* - * A port with VCPI will remain allocated until it's VCPI is - * released, no verified ref needed - */ + if (!port->vcpi.vcpi) + return; drm_dp_mst_put_payload_id(mgr, port->vcpi.vcpi); port->vcpi.num_slots = 0; -- 2.20.1 From mboxrd@z Thu Jan 1 00:00:00 1970 From: Lyude Paul Subject: [PATCH 1/3] drm/dp_mst: Fix unbalanced malloc ref in drm_dp_mst_deallocate_vcpi() Date: Tue, 29 Jan 2019 13:39:25 -0500 Message-ID: <20190129183928.26779-2-lyude@redhat.com> References: <20190129183928.26779-1-lyude@redhat.com> Mime-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 Return-path: In-Reply-To: <20190129183928.26779-1-lyude@redhat.com> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dri-devel-bounces@lists.freedesktop.org Sender: "dri-devel" To: intel-gfx@lists.freedesktop.org, dri-devel@lists.freedesktop.org Cc: Maxime Ripard , linux-kernel@vger.kernel.org, David Airlie , Sean Paul List-Id: dri-devel@lists.freedesktop.org SW4gZHJtX2RwX21zdF9kZWFsbG9jYXRlX3ZjcGkoKSwgd2UgY3VycmVudGx5IHVuY29uZGl0aW9u YWxseSBjYWxsCmRybV9kcF9tc3RfcHV0X3BvcnRfbWFsbG9jKCkgb24gdGhlIHBvcnQgdGhhdCdz IHBhc3NlZCB0byB1cywgZXZlbiBpZiB3ZQpuZXZlciBzdWNjZXNzZnVsbHkgYWxsb2NhdGVkIFZD UEkgdG8gaXQuIFRoaXMgaXMgY29udHJhcnkgdG8gd2hhdCB3ZSBkbwppbiBkcm1fZHBfbXN0X2Fs bG9jYXRlX3ZjcGkoKSwgd2hlcmUgd2Ugb25seSBjYWxsCmRybV9kcF9tc3RfZ2V0X3BvcnRfbWFs bG9jKCkgb24gdGhlIHBhc3NlZCBwb3J0IGlmIHdlIHN1Y2Nlc3NmdWxseQphbGxvY2F0ZWQgVkNQ SSB0byBpdC4KCkFzIGEgcmVzdWx0LCBpZiBkcm1fZHBfbXN0X2FsbG9jYXRlX3ZjcGkoKSBmYWls cyBkdXJpbmcgYSBtb2Rlc2V0IGFuZAphbm90aGVyIHN1Y2Nlc3NpdmUgbW9kZXNldCBjYWxscyBk cm1fZHBfbXN0X2RlYWxsb2NhdGVfdmNwaSgpIHdlIHdpbGwKZW5kIHVwIGRyb3BwaW5nIHNvbWVv bmUgZWxzZSdzIG1hbGxvYyByZWZlcmVuY2UgdG8gdGhlIHBvcnQuIEV4YW1wbGU6CgpbICA5NjIu MzA5MjYwXSA9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT0KWyAgOTYyLjMwOTI5MF0gQlVHOiBLQVNBTjogdXNlLWFmdGVyLWZy ZWUgaW4gZHJtX2RwX21zdF9wdXRfcG9ydF9tYWxsb2MrMHg3Mi8weDE4MCBbZHJtX2ttc19oZWxw ZXJdClsgIDk2Mi4zMDkyOTZdIFJlYWQgb2Ygc2l6ZSA0IGF0IGFkZHIgZmZmZjg4ODQxNmMzMDAw NCBieSB0YXNrIGt3b3JrZXIvMDoxSC81MDAKClsgIDk2Mi4zMDkzMDhdIENQVTogMCBQSUQ6IDUw MCBDb21tOiBrd29ya2VyLzA6MUggVGFpbnRlZDogRyAgICAgICAgVyAgTyAgICAgIDUuMC4wLXJj Mkx5dWRlLVRlc3QrICMxClsgIDk2Mi4zMDkzMTNdIEhhcmR3YXJlIG5hbWU6IExFTk9WTyAyMEw4 UzJOODAwLzIwTDhTMk44MDAsIEJJT1MgTjIyRVQzNVcgKDEuMTIgKSAwNC8wOS8yMDE4ClsgIDk2 Mi4zMDk0MjhdIFdvcmtxdWV1ZTogZXZlbnRzX2hpZ2hwcmkgaW50ZWxfYXRvbWljX2NsZWFudXBf d29yayBbaTkxNV0KWyAgOTYyLjMwOTQzNF0gQ2FsbCBUcmFjZToKWyAgOTYyLjMwOTQ1Ml0gIGR1 bXBfc3RhY2srMHhhZC8weDE1MApbICA5NjIuMzA5NDYyXSAgPyBkdW1wX3N0YWNrX3ByaW50X2lu Zm8uY29sZC4wKzB4MWIvMHgxYgpbICA5NjIuMzA5NDcyXSAgPyBrbXNnX2R1bXBfcmV3aW5kX25v bG9jaysweGQ5LzB4ZDkKWyAgOTYyLjMwOTUwNF0gID8gZHJtX2RwX21zdF9wdXRfcG9ydF9tYWxs b2MrMHg3Mi8weDE4MCBbZHJtX2ttc19oZWxwZXJdClsgIDk2Mi4zMDk1MTVdICBwcmludF9hZGRy ZXNzX2Rlc2NyaXB0aW9uKzB4NmMvMHgyM2MKWyAgOTYyLjMwOTU0Ml0gID8gZHJtX2RwX21zdF9w dXRfcG9ydF9tYWxsb2MrMHg3Mi8weDE4MCBbZHJtX2ttc19oZWxwZXJdClsgIDk2Mi4zMDk1Njhd ICA/IGRybV9kcF9tc3RfcHV0X3BvcnRfbWFsbG9jKzB4NzIvMHgxODAgW2RybV9rbXNfaGVscGVy XQpbICA5NjIuMzA5NTc3XSAga2FzYW5fcmVwb3J0LmNvbGQuMysweDFhLzB4MzIKWyAgOTYyLjMw OTYwNV0gID8gZHJtX2RwX21zdF9wdXRfcG9ydF9tYWxsb2MrMHg3Mi8weDE4MCBbZHJtX2ttc19o ZWxwZXJdClsgIDk2Mi4zMDk2MzFdICBkcm1fZHBfbXN0X3B1dF9wb3J0X21hbGxvYysweDcyLzB4 MTgwIFtkcm1fa21zX2hlbHBlcl0KWyAgOTYyLjMwOTY1OF0gID8gZHJtX2RwX21zdF9wdXRfbXN0 Yl9tYWxsb2MrMHgxODAvMHgxODAgW2RybV9rbXNfaGVscGVyXQpbICA5NjIuMzA5Njg3XSAgZHJt X2RwX21zdF9kZXN0cm95X3N0YXRlKzB4Y2QvMHgxMjAgW2RybV9rbXNfaGVscGVyXQpbICA5NjIu MzA5NzQ1XSAgZHJtX2F0b21pY19zdGF0ZV9kZWZhdWx0X2NsZWFyKzB4NmVlLzB4Y2MwIFtkcm1d ClsgIDk2Mi4zMDk4NjRdICBpbnRlbF9hdG9taWNfc3RhdGVfY2xlYXIrMHhlLzB4ODAgW2k5MTVd ClsgIDk2Mi4zMDk5MjhdICBfX2RybV9hdG9taWNfc3RhdGVfZnJlZSsweDM1LzB4ZDAgW2RybV0K WyAgOTYyLjMxMDA0NF0gIGludGVsX2F0b21pY19jbGVhbnVwX3dvcmsrMHg1Ni8weDcwIFtpOTE1 XQpbICA5NjIuMzEwMDU3XSAgcHJvY2Vzc19vbmVfd29yaysweDg4NC8weDE0MDAKWyAgOTYyLjMx MDA2N10gID8gZHJhaW5fd29ya3F1ZXVlKzB4NWEwLzB4NWEwClsgIDk2Mi4zMTAwNzVdICA/IF9f c2NoZWR1bGUrMHg4N2YvMHgxZTgwClsgIDk2Mi4zMTAwODZdICA/IF9fc2NoZWRfdGV4dF9zdGFy dCsweDgvMHg4ClsgIDk2Mi4zMTAwOTVdICA/IHJ1bl9yZWJhbGFuY2VfZG9tYWlucysweDQwMC8w eDQwMApbICA5NjIuMzEwMTEwXSAgPyBkZXJlZl9zdGFja19yZWcrMHhiNC8weDEyMApbICA5NjIu MzEwMTE3XSAgPyBfX3JlYWRfb25jZV9zaXplX25vY2hlY2suY29uc3Rwcm9wLjcrMHgxMC8weDEw ClsgIDk2Mi4zMTAxMjRdICA/IHdvcmtlcl9lbnRlcl9pZGxlKzB4NDdmLzB4NmEwClsgIDk2Mi4z MTAxMzRdICA/IHNjaGVkdWxlKzB4ZDcvMHgyZTAKWyAgOTYyLjMxMDE0MV0gID8gX19zY2hlZHVs ZSsweDFlODAvMHgxZTgwClsgIDk2Mi4zMTAxNDhdICA/IF9yYXdfc3Bpbl9sb2NrX2lycSsweDlm LzB4MTMwClsgIDk2Mi4zMTAxNTVdICA/IF9yYXdfd3JpdGVfdW5sb2NrX2lycXJlc3RvcmUrMHgx MTAvMHgxMTAKWyAgOTYyLjMxMDE2NF0gIHdvcmtlcl90aHJlYWQrMHgxOTYvMHgxMWUwClsgIDk2 Mi4zMTAxNzVdICA/IHNldF9sb2FkX3dlaWdodCsweDJlMC8weDJlMApbICA5NjIuMzEwMTgxXSAg PyBfX3N3aXRjaF90b19hc20rMHgzNC8weDcwClsgIDk2Mi4zMTAxODddICA/IF9fc3dpdGNoX3Rv X2FzbSsweDQwLzB4NzAKWyAgOTYyLjMxMDE5NF0gID8gcHJvY2Vzc19vbmVfd29yaysweDE0MDAv MHgxNDAwClsgIDk2Mi4zMTAxOTldICA/IF9fc3dpdGNoX3RvX2FzbSsweDQwLzB4NzAKWyAgOTYy LjMxMDIwNV0gID8gX19zd2l0Y2hfdG9fYXNtKzB4MzQvMHg3MApbICA5NjIuMzEwMjExXSAgPyBf X3N3aXRjaF90b19hc20rMHgzNC8weDcwClsgIDk2Mi4zMTAyMTZdICA/IF9fc3dpdGNoX3RvX2Fz bSsweDQwLzB4NzAKWyAgOTYyLjMxMDIyMV0gID8gX19zd2l0Y2hfdG9fYXNtKzB4MzQvMHg3MApb ICA5NjIuMzEwMjI2XSAgPyBfX3N3aXRjaF90b19hc20rMHg0MC8weDcwClsgIDk2Mi4zMTAyMzFd ICA/IF9fc3dpdGNoX3RvX2FzbSsweDM0LzB4NzAKWyAgOTYyLjMxMDIzNl0gID8gX19zd2l0Y2hf dG9fYXNtKzB4NDAvMHg3MApbICA5NjIuMzEwMjQyXSAgPyBzeXNjYWxsX3JldHVybl92aWFfc3lz cmV0KzB4Zi8weDdmClsgIDk2Mi4zMTAyNDhdICA/IF9fc3dpdGNoX3RvX2FzbSsweDM0LzB4NzAK WyAgOTYyLjMxMDI1M10gID8gX19zd2l0Y2hfdG9fYXNtKzB4NDAvMHg3MApbICA5NjIuMzEwMjU4 XSAgPyBfX3N3aXRjaF90b19hc20rMHgzNC8weDcwClsgIDk2Mi4zMTAyNjNdICA/IF9fc3dpdGNo X3RvX2FzbSsweDQwLzB4NzAKWyAgOTYyLjMxMDI2OF0gID8gX19zd2l0Y2hfdG9fYXNtKzB4MzQv MHg3MApbICA5NjIuMzEwMjczXSAgPyBfX3N3aXRjaF90b19hc20rMHg0MC8weDcwClsgIDk2Mi4z MTAyODFdICA/IF9fc2NoZWR1bGUrMHg4N2YvMHgxZTgwClsgIDk2Mi4zMTAyOTJdICA/IF9fc2No ZWRfdGV4dF9zdGFydCsweDgvMHg4ClsgIDk2Mi4zMTAzMDBdICA/IHNhdmVfc3RhY2srMHg4Yy8w eGIwClsgIDk2Mi4zMTAzMDhdICA/IF9fa2FzYW5fa21hbGxvYy5jb25zdHByb3AuNisweGM2LzB4 ZDAKWyAgOTYyLjMxMDMxM10gID8ga3RocmVhZCsweDk4LzB4M2EwClsgIDk2Mi4zMTAzMThdICA/ IHJldF9mcm9tX2ZvcmsrMHgzNS8weDQwClsgIDk2Mi4zMTAzMzRdICA/IF9fd2FrZV91cF9jb21t b24rMHgxNzgvMHg2ZjAKWyAgOTYyLjMxMDM0M10gID8gX3Jhd19zcGluX2xvY2tfaXJxc2F2ZSsw eGE0LzB4MTQwClsgIDk2Mi4zMTAzNDldICA/IF9fbG9ja190ZXh0X3N0YXJ0KzB4OC8weDgKWyAg OTYyLjMxMDM1NV0gID8gX3Jhd193cml0ZV9sb2NrX2lycXNhdmUrMHg3MC8weDEzMApbICA5NjIu MzEwMzYwXSAgPyBfX2xvY2tfdGV4dF9zdGFydCsweDgvMHg4ClsgIDk2Mi4zMTAzNzFdICA/IHBy b2Nlc3Nfb25lX3dvcmsrMHgxNDAwLzB4MTQwMApbICA5NjIuMzEwMzc2XSAga3RocmVhZCsweDJl Mi8weDNhMApbICA5NjIuMzEwMzgzXSAgPyBrdGhyZWFkX2NyZWF0ZV9vbl9ub2RlKzB4YzAvMHhj MApbICA5NjIuMzEwMzg5XSAgcmV0X2Zyb21fZm9yaysweDM1LzB4NDAKClsgIDk2Mi4zMTA0MDFd IEFsbG9jYXRlZCBieSB0YXNrIDE0NjI6ClsgIDk2Mi4zMTA0MTBdICBfX2thc2FuX2ttYWxsb2Mu Y29uc3Rwcm9wLjYrMHhjNi8weGQwClsgIDk2Mi4zMTA0MzddICBkcm1fZHBfYWRkX3BvcnQrMHhk NjAvMHgxOTYwIFtkcm1fa21zX2hlbHBlcl0KWyAgOTYyLjMxMDQ2NF0gIGRybV9kcF9zZW5kX2xp bmtfYWRkcmVzcysweDRiMC8weDc3MCBbZHJtX2ttc19oZWxwZXJdClsgIDk2Mi4zMTA0OTFdICBk cm1fZHBfY2hlY2tfYW5kX3NlbmRfbGlua19hZGRyZXNzKzB4MTk3LzB4MWYwIFtkcm1fa21zX2hl bHBlcl0KWyAgOTYyLjMxMDUxNV0gIGRybV9kcF9tc3RfbGlua19wcm9iZV93b3JrKzB4MmI2LzB4 MzMwIFtkcm1fa21zX2hlbHBlcl0KWyAgOTYyLjMxMDUyMl0gIHByb2Nlc3Nfb25lX3dvcmsrMHg4 ODQvMHgxNDAwClsgIDk2Mi4zMTA1MjldICB3b3JrZXJfdGhyZWFkKzB4MTk2LzB4MTFlMApbICA5 NjIuMzEwNTMzXSAga3RocmVhZCsweDJlMi8weDNhMApbICA5NjIuMzEwNTM4XSAgcmV0X2Zyb21f Zm9yaysweDM1LzB4NDAKClsgIDk2Mi4zMTA1NDNdIEZyZWVkIGJ5IHRhc2sgNTAwOgpbICA5NjIu MzEwNTUwXSAgX19rYXNhbl9zbGFiX2ZyZWUrMHgxMzMvMHgxODAKWyAgOTYyLjMxMDU1NV0gIGtm cmVlKzB4OTIvMHgxYTAKWyAgOTYyLjMxMDU4MV0gIGRybV9kcF9tc3RfcHV0X3BvcnRfbWFsbG9j KzB4MTRkLzB4MTgwIFtkcm1fa21zX2hlbHBlcl0KWyAgOTYyLjMxMDY5M10gIGludGVsX2Nvbm5l Y3Rvcl9kZXN0cm95KzB4YjIvMHhlMCBbaTkxNV0KWyAgOTYyLjMxMDc0N10gIGRybV9tb2RlX29i amVjdF9wdXQucGFydC4wKzB4MTJiLzB4MWEwIFtkcm1dClsgIDk2Mi4zMTA4MDJdICBkcm1fYXRv bWljX3N0YXRlX2RlZmF1bHRfY2xlYXIrMHgxZjIvMHhjYzAgW2RybV0KWyAgOTYyLjMxMDkxNl0g IGludGVsX2F0b21pY19zdGF0ZV9jbGVhcisweGUvMHg4MCBbaTkxNV0KWyAgOTYyLjMxMDk3Ml0g IF9fZHJtX2F0b21pY19zdGF0ZV9mcmVlKzB4MzUvMHhkMCBbZHJtXQpbICA5NjIuMzExMDgzXSAg aW50ZWxfYXRvbWljX2NsZWFudXBfd29yaysweDU2LzB4NzAgW2k5MTVdClsgIDk2Mi4zMTEwOTJd ICBwcm9jZXNzX29uZV93b3JrKzB4ODg0LzB4MTQwMApbICA5NjIuMzExMDk4XSAgd29ya2VyX3Ro cmVhZCsweDE5Ni8weDExZTAKWyAgOTYyLjMxMTEwM10gIGt0aHJlYWQrMHgyZTIvMHgzYTAKWyAg OTYyLjMxMTEwOF0gIHJldF9mcm9tX2ZvcmsrMHgzNS8weDQwCgpbICA5NjIuMzExMTE2XSBUaGUg YnVnZ3kgYWRkcmVzcyBiZWxvbmdzIHRvIHRoZSBvYmplY3QgYXQgZmZmZjg4ODQxNmMzMDAwMAog ICAgICAgICAgICAgICAgd2hpY2ggYmVsb25ncyB0byB0aGUgY2FjaGUga21hbGxvYy0yayBvZiBz aXplIDIwNDgKWyAgOTYyLjMxMTEyMl0gVGhlIGJ1Z2d5IGFkZHJlc3MgaXMgbG9jYXRlZCA0IGJ5 dGVzIGluc2lkZSBvZgogICAgICAgICAgICAgICAgMjA0OC1ieXRlIHJlZ2lvbiBbZmZmZjg4ODQx NmMzMDAwMCwgZmZmZjg4ODQxNmMzMDgwMCkKWyAgOTYyLjMxMTEyNF0gVGhlIGJ1Z2d5IGFkZHJl c3MgYmVsb25ncyB0byB0aGUgcGFnZToKWyAgOTYyLjMxMTEzMl0gcGFnZTpmZmZmZWEwMDEwNWIw YzAwIGNvdW50OjEgbWFwY291bnQ6MCBtYXBwaW5nOmZmZmY4ODg0MWQwMDMwNDAgaW5kZXg6MHgw IGNvbXBvdW5kX21hcGNvdW50OiAwClsgIDk2Mi4zMTExNDJdIGZsYWdzOiAweDgwMDAwMDAwMDAw MTAyMDAoc2xhYnxoZWFkKQpbICA5NjIuMzExMTUyXSByYXc6IDgwMDAwMDAwMDAwMTAyMDAgZGVh ZDAwMDAwMDAwMDEwMCBkZWFkMDAwMDAwMDAwMjAwIGZmZmY4ODg0MWQwMDMwNDAKWyAgOTYyLjMx MTE1OV0gcmF3OiAwMDAwMDAwMDAwMDAwMDAwIDAwMDAwMDAwMDAwZjAwMGYgMDAwMDAwMDFmZmZm ZmZmZiAwMDAwMDAwMDAwMDAwMDAwClsgIDk2Mi4zMTExNjJdIHBhZ2UgZHVtcGVkIGJlY2F1c2U6 IGthc2FuOiBiYWQgYWNjZXNzIGRldGVjdGVkCgpTbywgYmFpbCBlYXJseSBpZiBkcm1fZHBfbXN0 X2RlYWxsb2NhdGVfdmNwaSgpIGlzIGNhbGxlZCBvbiBhIHBvcnQgd2l0aApubyBWQ1BJIGFsbG9j YXRpb24uIEFkZGl0aW9uYWxseSwgY2xlYW4gdXAgdGhlIHN1cnJvdW5kaW5nIGtlcm5lbGRvYwp3 aGlsZSB3ZSdyZSBhdCBpdCBzaW5jZSB0aGUgcG9ydCBpcyBhc3N1bWVkIHRvIGJlIGtlcHQgYXJv dW5kIGJlY2F1c2UKdGhlIERSTSBkcml2ZXIgaXMgZXhwZWN0ZWQgdG8gaG9sZCBhIG1hbGxvYyBy ZWZlcmVuY2UgdG8gaXQsIG5vdCBqdXN0CnVzLgoKU2lnbmVkLW9mZi1ieTogTHl1ZGUgUGF1bCA8 bHl1ZGVAcmVkaGF0LmNvbT4KRml4ZXM6IGVjZWFlMTQ3MjQ2NyAoImRybS9kcF9tc3Q6IFN0YXJ0 IHRyYWNraW5nIHBlci1wb3J0IFZDUEkgYWxsb2NhdGlvbnMiKQpDYzogRGFuaWVsIFZldHRlciA8 ZGFuaWVsQGZmd2xsLmNoPgotLS0KIGRyaXZlcnMvZ3B1L2RybS9kcm1fZHBfbXN0X3RvcG9sb2d5 LmMgfCA4ICsrKy0tLS0tCiAxIGZpbGUgY2hhbmdlZCwgMyBpbnNlcnRpb25zKCspLCA1IGRlbGV0 aW9ucygtKQoKZGlmZiAtLWdpdCBhL2RyaXZlcnMvZ3B1L2RybS9kcm1fZHBfbXN0X3RvcG9sb2d5 LmMgYi9kcml2ZXJzL2dwdS9kcm0vZHJtX2RwX21zdF90b3BvbG9neS5jCmluZGV4IDI1NTJhMjcz NjJhMC4uOGJhMGU1YjM2OGRhIDEwMDY0NAotLS0gYS9kcml2ZXJzL2dwdS9kcm0vZHJtX2RwX21z dF90b3BvbG9neS5jCisrKyBiL2RyaXZlcnMvZ3B1L2RybS9kcm1fZHBfbXN0X3RvcG9sb2d5LmMK QEAgLTMyNDYsMTUgKzMyNDYsMTMgQEAgRVhQT1JUX1NZTUJPTChkcm1fZHBfbXN0X3Jlc2V0X3Zj cGlfc2xvdHMpOwogLyoqCiAgKiBkcm1fZHBfbXN0X2RlYWxsb2NhdGVfdmNwaSgpIC0gZGVhbGxv Y2F0ZSBhIFZDUEkKICAqIEBtZ3I6IG1hbmFnZXIgZm9yIHRoaXMgcG9ydAotICogQHBvcnQ6IHVu dmVyaWZpZWQgcG9ydCB0byBkZWFsbG9jYXRlIHZjcGkgZm9yCisgKiBAcG9ydDogcG9ydCB0byBk ZWFsbG9jYXRlIHZjcGkgZm9yCiAgKi8KIHZvaWQgZHJtX2RwX21zdF9kZWFsbG9jYXRlX3ZjcGko c3RydWN0IGRybV9kcF9tc3RfdG9wb2xvZ3lfbWdyICptZ3IsCiAJCQkJc3RydWN0IGRybV9kcF9t c3RfcG9ydCAqcG9ydCkKIHsKLQkvKgotCSAqIEEgcG9ydCB3aXRoIFZDUEkgd2lsbCByZW1haW4g YWxsb2NhdGVkIHVudGlsIGl0J3MgVkNQSSBpcwotCSAqIHJlbGVhc2VkLCBubyB2ZXJpZmllZCBy ZWYgbmVlZGVkCi0JICovCisJaWYgKCFwb3J0LT52Y3BpLnZjcGkpCisJCXJldHVybjsKIAogCWRy bV9kcF9tc3RfcHV0X3BheWxvYWRfaWQobWdyLCBwb3J0LT52Y3BpLnZjcGkpOwogCXBvcnQtPnZj cGkubnVtX3Nsb3RzID0gMDsKLS0gCjIuMjAuMQoKX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX18KZHJpLWRldmVsIG1haWxpbmcgbGlzdApkcmktZGV2ZWxAbGlz dHMuZnJlZWRlc2t0b3Aub3JnCmh0dHBzOi8vbGlzdHMuZnJlZWRlc2t0b3Aub3JnL21haWxtYW4v bGlzdGluZm8vZHJpLWRldmVsCg==