From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-8.0 required=3.0 tests=DKIM_INVALID,DKIM_SIGNED, HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_PATCH,MAILING_LIST_MULTI,SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_SANE_1 autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3D4E9C54E8B for ; Tue, 12 May 2020 05:13:58 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 129F42072B for ; Tue, 12 May 2020 05:13:58 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=fail reason="signature verification failed" (1024-bit key) header.d=mg.codeaurora.org header.i=@mg.codeaurora.org header.b="s2otOE5l" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728769AbgELFN5 (ORCPT ); Tue, 12 May 2020 01:13:57 -0400 Received: from mail26.static.mailgun.info ([104.130.122.26]:44920 "EHLO mail26.static.mailgun.info" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1725814AbgELFN4 (ORCPT ); Tue, 12 May 2020 01:13:56 -0400 DKIM-Signature: a=rsa-sha256; v=1; c=relaxed/relaxed; d=mg.codeaurora.org; q=dns/txt; s=smtp; t=1589260435; h=Content-Transfer-Encoding: Content-Type: In-Reply-To: MIME-Version: Date: Message-ID: From: References: Cc: To: Subject: Sender; bh=vnJZoIczJd+Nx4ZHUh2bb/pAfZ5qGHf3HGR3EAiVMWY=; b=s2otOE5lGZnCFr1HbETMWbPZ5B3FxcPzSLxYHHqyjoq8aj2yMsO1IUqo/MLTqXKuwsaNblnd X5qTashMs8rXbocLqkLgZ2U2uQgRfTl/XuW1J48yp1pOyBwi9wXzEpp2rpAGasPZppRURXVm XpWtiAJyYlDdwhM/HbLHYxJVGs4= X-Mailgun-Sending-Ip: 104.130.122.26 X-Mailgun-Sid: WyI0MWYwYSIsICJsaW51eC1rZXJuZWxAdmdlci5rZXJuZWwub3JnIiwgImJlOWU0YSJd Received: from smtp.codeaurora.org (ec2-35-166-182-171.us-west-2.compute.amazonaws.com [35.166.182.171]) by mxa.mailgun.org with ESMTP id 5eba307d.7fe834207e30-smtp-out-n02; Tue, 12 May 2020 05:13:33 -0000 (UTC) Received: by smtp.codeaurora.org (Postfix, from userid 1001) id D39B2C43637; Tue, 12 May 2020 05:13:32 +0000 (UTC) Received: from [192.168.0.102] (unknown [183.83.139.238]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) (Authenticated sender: charante) by smtp.codeaurora.org (Postfix) with ESMTPSA id 3D635C433CB; Tue, 12 May 2020 05:13:28 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 smtp.codeaurora.org 3D635C433CB Authentication-Results: aws-us-west-2-caf-mail-1.web.codeaurora.org; dmarc=none (p=none dis=none) header.from=codeaurora.org Authentication-Results: aws-us-west-2-caf-mail-1.web.codeaurora.org; spf=none smtp.mailfrom=charante@codeaurora.org Subject: Re: [PATCH] dma-buf: fix use-after-free in dmabuffs_dname To: Greg KH Cc: dri-devel@lists.freedesktop.org, linaro-mm-sig@lists.linaro.org, linux-kernel@vger.kernel.org, vinmenon@codeaurora.org, sumit.semwal@linaro.org, ghackmann@google.com, fengc@google.com, linux-media@vger.kernel.org References: <1588060442-28638-1-git-send-email-charante@codeaurora.org> <20200505100806.GA4177627@kroah.com> <8424b2ac-3ea6-6e5b-b99c-951a569f493d@codeaurora.org> <20200506090002.GA2619587@kroah.com> From: Charan Teja Kalla Message-ID: <3bc8dd81-f298-aea0-f218-2e2ef12ca603@codeaurora.org> Date: Tue, 12 May 2020 10:43:18 +0530 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:68.0) Gecko/20100101 Thunderbird/68.8.0 MIME-Version: 1.0 In-Reply-To: <20200506090002.GA2619587@kroah.com> Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 8bit Content-Language: en-US Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Thank you Greg for the comments. On 5/6/2020 2:30 PM, Greg KH wrote: > On Wed, May 06, 2020 at 02:00:10PM +0530, Charan Teja Kalla wrote: >> Thank you Greg for the reply. >> >> On 5/5/2020 3:38 PM, Greg KH wrote: >>> On Tue, Apr 28, 2020 at 01:24:02PM +0530, Charan Teja Reddy wrote: >>>> The following race occurs while accessing the dmabuf object exported as >>>> file: >>>> P1 P2 >>>> dma_buf_release() dmabuffs_dname() >>>> [say lsof reading /proc//fd/] >>>> >>>> read dmabuf stored in dentry->fsdata >>>> Free the dmabuf object >>>> Start accessing the dmabuf structure >>>> >>>> In the above description, the dmabuf object freed in P1 is being >>>> accessed from P2 which is resulting into the use-after-free. Below is >>>> the dump stack reported. >>>> >>>> Call Trace: >>>> kasan_report+0x12/0x20 >>>> __asan_report_load8_noabort+0x14/0x20 >>>> dmabuffs_dname+0x4f4/0x560 >>>> tomoyo_realpath_from_path+0x165/0x660 >>>> tomoyo_get_realpath >>>> tomoyo_check_open_permission+0x2a3/0x3e0 >>>> tomoyo_file_open >>>> tomoyo_file_open+0xa9/0xd0 >>>> security_file_open+0x71/0x300 >>>> do_dentry_open+0x37a/0x1380 >>>> vfs_open+0xa0/0xd0 >>>> path_openat+0x12ee/0x3490 >>>> do_filp_open+0x192/0x260 >>>> do_sys_openat2+0x5eb/0x7e0 >>>> do_sys_open+0xf2/0x180 >>>> >>>> Fixes: bb2bb90 ("dma-buf: add DMA_BUF_SET_NAME ioctls") >>> Nit, please read the documentation for how to do a Fixes: line properly, >>> you need more digits: >>> Fixes: bb2bb9030425 ("dma-buf: add DMA_BUF_SET_NAME ioctls") >> >> Will update the patch >> >> >>>> Reported-by:syzbot+3643a18836bce555bff6@syzkaller.appspotmail.com >>>> Signed-off-by: Charan Teja Reddy >>> Also, any reason you didn't include the other mailing lists that >>> get_maintainer.pl said to? >> >> Really sorry for not sending to complete list. Added now. >> >> >>> And finally, no cc: stable in the s-o-b area for an issue that needs to >>> be backported to older kernels? >> >> Will update the patch. >> >> >>>> --- >>>> drivers/dma-buf/dma-buf.c | 25 +++++++++++++++++++++++-- >>>> include/linux/dma-buf.h | 1 + >>>> 2 files changed, 24 insertions(+), 2 deletions(-) >>>> >>>> diff --git a/drivers/dma-buf/dma-buf.c b/drivers/dma-buf/dma-buf.c >>>> index 570c923..069d8f78 100644 >>>> --- a/drivers/dma-buf/dma-buf.c >>>> +++ b/drivers/dma-buf/dma-buf.c >>>> @@ -25,6 +25,7 @@ >>>> #include >>>> #include >>>> #include >>>> +#include >>>> #include >>>> #include >>>> @@ -38,18 +39,34 @@ struct dma_buf_list { >>>> static struct dma_buf_list db_list; >>>> +static void dmabuf_dent_put(struct dma_buf *dmabuf) >>>> +{ >>>> + if (atomic_dec_and_test(&dmabuf->dent_count)) { >>>> + kfree(dmabuf->name); >>>> + kfree(dmabuf); >>>> + } >>> Why not just use a kref instead of an open-coded atomic value? >> >> Kref approach looks cleaner. will update the patch accordingly. >> >> >>>> +} >>>> + >>>> static char *dmabuffs_dname(struct dentry *dentry, char *buffer, int buflen) >>>> { >>>> struct dma_buf *dmabuf; >>>> char name[DMA_BUF_NAME_LEN]; >>>> size_t ret = 0; >>>> + spin_lock(&dentry->d_lock); >>>> dmabuf = dentry->d_fsdata; >>>> + if (!dmabuf || !atomic_add_unless(&dmabuf->dent_count, 1, 0)) { >>>> + spin_unlock(&dentry->d_lock); >>>> + goto out; >>> How can dmabuf not be valid here? >>> >>> And isn't there already a usecount for the buffer? >> >> dmabuf exported as file simply relies on that file's refcount, thus fput() >> releases the dmabuf. >> >> We are storing the dmabuf in the dentry->d_fsdata but there is no binding >> between the dentry and the dmabuf. So, flow will be like >> >> 1) P1 calls fput(dmabuf_fd) >> >> 2) P2 trying to access the file information of P1. >>     Eg: lsof command trying to list out the dmabuf_fd information using >> /proc//fd/dmabuf_fd >> >> 3) P1 calls the file->f_op->release(dmabuf_fd_file)(ends up in calling >> dma_buf_release()),   thus frees up the dmabuf buffer. >> >> 4) P2 access the dmabuf stored in the dentry->d_fsdata which was freed in >> step 3. >> >> So we need to have some refcount mechanism to avoid the use-after-free in >> step 4. > Ok, but watch out, now you have 2 different reference counts for the > same structure. Keeping them coordinated is almost always an impossible > task so you need to only rely on one. If you can't use the file api, > just drop all of the reference counting logic in there and only use the > kref one. I feel that changing the refcount logic now to dma-buf objects involve changes in the core dma-buf framework. NO? Instead, how about passing the user passed name directly in the ->d_fsdata inplace of dmabuf object? Because we just need user passed name in the dmabuffs_dname(). With this we can avoid the need for extra refcount on dmabuf. Posted patch-V2: https://lkml.org/lkml/2020/5/8/158 > > good luck! > > greg k-h -- The Qualcomm Innovation Center, Inc. is a member of the Code Aurora Forum, a Linux Foundation Collaborative Project From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-8.0 required=3.0 tests=DKIM_INVALID,DKIM_SIGNED, HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_PATCH,MAILING_LIST_MULTI,SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_SANE_1 autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id EEBD3C54E8B for ; Tue, 12 May 2020 07:10:16 +0000 (UTC) Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id BC8652075E for ; Tue, 12 May 2020 07:10:16 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=fail reason="signature verification failed" (1024-bit key) header.d=mg.codeaurora.org header.i=@mg.codeaurora.org header.b="S+by9CzY" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org BC8652075E Authentication-Results: mail.kernel.org; dmarc=none (p=none dis=none) header.from=codeaurora.org Authentication-Results: mail.kernel.org; spf=none smtp.mailfrom=dri-devel-bounces@lists.freedesktop.org Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id 556746E860; Tue, 12 May 2020 07:09:35 +0000 (UTC) Received: from mail27.static.mailgun.info (mail27.static.mailgun.info [104.130.122.27]) by gabe.freedesktop.org (Postfix) with ESMTPS id 6382B6E82A for ; Tue, 12 May 2020 05:13:42 +0000 (UTC) DKIM-Signature: a=rsa-sha256; v=1; c=relaxed/relaxed; d=mg.codeaurora.org; q=dns/txt; s=smtp; t=1589260425; h=Content-Transfer-Encoding: Content-Type: In-Reply-To: MIME-Version: Date: Message-ID: From: References: Cc: To: Subject: Sender; bh=vnJZoIczJd+Nx4ZHUh2bb/pAfZ5qGHf3HGR3EAiVMWY=; b=S+by9CzYDTXaBkKT2flO6t+mWvjmP2/JI2fvPMkLC3stF9M7xXcVLNfROr6i2hJrL3fqdBsK 5PaLIxcgWN6PO3Yyy4r3+oTRMtjyJ1qLFhOqLkjMrIgjy6vlt8C5BpvF/va8fQdTSmV/eIos H7qaosjdIlZWgXzcr/jEeFWs4Y0= X-Mailgun-Sending-Ip: 104.130.122.27 X-Mailgun-Sid: WyJkOTU5ZSIsICJkcmktZGV2ZWxAbGlzdHMuZnJlZWRlc2t0b3Aub3JnIiwgImJlOWU0YSJd Received: from smtp.codeaurora.org (ec2-35-166-182-171.us-west-2.compute.amazonaws.com [35.166.182.171]) by mxa.mailgun.org with ESMTP id 5eba307f.7fa7c032ef48-smtp-out-n03; Tue, 12 May 2020 05:13:35 -0000 (UTC) Received: by smtp.codeaurora.org (Postfix, from userid 1001) id 13A02C433F2; Tue, 12 May 2020 05:13:34 +0000 (UTC) Received: from [192.168.0.102] (unknown [183.83.139.238]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) (Authenticated sender: charante) by smtp.codeaurora.org (Postfix) with ESMTPSA id 3D635C433CB; Tue, 12 May 2020 05:13:28 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 smtp.codeaurora.org 3D635C433CB Authentication-Results: aws-us-west-2-caf-mail-1.web.codeaurora.org; dmarc=none (p=none dis=none) header.from=codeaurora.org Authentication-Results: aws-us-west-2-caf-mail-1.web.codeaurora.org; spf=none smtp.mailfrom=charante@codeaurora.org Subject: Re: [PATCH] dma-buf: fix use-after-free in dmabuffs_dname To: Greg KH References: <1588060442-28638-1-git-send-email-charante@codeaurora.org> <20200505100806.GA4177627@kroah.com> <8424b2ac-3ea6-6e5b-b99c-951a569f493d@codeaurora.org> <20200506090002.GA2619587@kroah.com> From: Charan Teja Kalla Message-ID: <3bc8dd81-f298-aea0-f218-2e2ef12ca603@codeaurora.org> Date: Tue, 12 May 2020 10:43:18 +0530 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:68.0) Gecko/20100101 Thunderbird/68.8.0 MIME-Version: 1.0 In-Reply-To: <20200506090002.GA2619587@kroah.com> Content-Language: en-US X-Mailman-Approved-At: Tue, 12 May 2020 07:09:30 +0000 X-BeenThere: dri-devel@lists.freedesktop.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Direct Rendering Infrastructure - Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: fengc@google.com, linux-kernel@vger.kernel.org, ghackmann@google.com, linaro-mm-sig@lists.linaro.org, vinmenon@codeaurora.org, dri-devel@lists.freedesktop.org, linux-media@vger.kernel.org Content-Transfer-Encoding: base64 Content-Type: text/plain; charset="utf-8"; Format="flowed" Errors-To: dri-devel-bounces@lists.freedesktop.org Sender: "dri-devel" ClRoYW5rIHlvdSBHcmVnIGZvciB0aGUgY29tbWVudHMuCgpPbiA1LzYvMjAyMCAyOjMwIFBNLCBH cmVnIEtIIHdyb3RlOgo+IE9uIFdlZCwgTWF5IDA2LCAyMDIwIGF0IDAyOjAwOjEwUE0gKzA1MzAs IENoYXJhbiBUZWphIEthbGxhIHdyb3RlOgo+PiBUaGFuayB5b3UgR3JlZyBmb3IgdGhlIHJlcGx5 Lgo+Pgo+PiBPbiA1LzUvMjAyMCAzOjM4IFBNLCBHcmVnIEtIIHdyb3RlOgo+Pj4gT24gVHVlLCBB cHIgMjgsIDIwMjAgYXQgMDE6MjQ6MDJQTSArMDUzMCwgQ2hhcmFuIFRlamEgUmVkZHkgd3JvdGU6 Cj4+Pj4gVGhlIGZvbGxvd2luZyByYWNlIG9jY3VycyB3aGlsZSBhY2Nlc3NpbmcgdGhlIGRtYWJ1 ZiBvYmplY3QgZXhwb3J0ZWQgYXMKPj4+PiBmaWxlOgo+Pj4+IFAxCQkJCVAyCj4+Pj4gZG1hX2J1 Zl9yZWxlYXNlKCkgICAgICAgICAgZG1hYnVmZnNfZG5hbWUoKQo+Pj4+IAkJCSAgIFtzYXkgbHNv ZiByZWFkaW5nIC9wcm9jLzxQMSBwaWQ+L2ZkLzxudW0+XQo+Pj4+Cj4+Pj4gCQkJICAgcmVhZCBk bWFidWYgc3RvcmVkIGluIGRlbnRyeS0+ZnNkYXRhCj4+Pj4gRnJlZSB0aGUgZG1hYnVmIG9iamVj dAo+Pj4+IAkJCSAgIFN0YXJ0IGFjY2Vzc2luZyB0aGUgZG1hYnVmIHN0cnVjdHVyZQo+Pj4+Cj4+ Pj4gSW4gdGhlIGFib3ZlIGRlc2NyaXB0aW9uLCB0aGUgZG1hYnVmIG9iamVjdCBmcmVlZCBpbiBQ MSBpcyBiZWluZwo+Pj4+IGFjY2Vzc2VkIGZyb20gUDIgd2hpY2ggaXMgcmVzdWx0aW5nIGludG8g dGhlIHVzZS1hZnRlci1mcmVlLiBCZWxvdyBpcwo+Pj4+IHRoZSBkdW1wIHN0YWNrIHJlcG9ydGVk Lgo+Pj4+Cj4+Pj4gQ2FsbCBUcmFjZToKPj4+PiAgICBrYXNhbl9yZXBvcnQrMHgxMi8weDIwCj4+ Pj4gICAgX19hc2FuX3JlcG9ydF9sb2FkOF9ub2Fib3J0KzB4MTQvMHgyMAo+Pj4+ICAgIGRtYWJ1 ZmZzX2RuYW1lKzB4NGY0LzB4NTYwCj4+Pj4gICAgdG9tb3lvX3JlYWxwYXRoX2Zyb21fcGF0aCsw eDE2NS8weDY2MAo+Pj4+ICAgIHRvbW95b19nZXRfcmVhbHBhdGgKPj4+PiAgICB0b21veW9fY2hl Y2tfb3Blbl9wZXJtaXNzaW9uKzB4MmEzLzB4M2UwCj4+Pj4gICAgdG9tb3lvX2ZpbGVfb3Blbgo+ Pj4+ICAgIHRvbW95b19maWxlX29wZW4rMHhhOS8weGQwCj4+Pj4gICAgc2VjdXJpdHlfZmlsZV9v cGVuKzB4NzEvMHgzMDAKPj4+PiAgICBkb19kZW50cnlfb3BlbisweDM3YS8weDEzODAKPj4+PiAg ICB2ZnNfb3BlbisweGEwLzB4ZDAKPj4+PiAgICBwYXRoX29wZW5hdCsweDEyZWUvMHgzNDkwCj4+ Pj4gICAgZG9fZmlscF9vcGVuKzB4MTkyLzB4MjYwCj4+Pj4gICAgZG9fc3lzX29wZW5hdDIrMHg1 ZWIvMHg3ZTAKPj4+PiAgICBkb19zeXNfb3BlbisweGYyLzB4MTgwCj4+Pj4KPj4+PiBGaXhlczog YmIyYmI5MCAoImRtYS1idWY6IGFkZCBETUFfQlVGX1NFVF9OQU1FIGlvY3RscyIpCj4+PiBOaXQs IHBsZWFzZSByZWFkIHRoZSBkb2N1bWVudGF0aW9uIGZvciBob3cgdG8gZG8gYSBGaXhlczogbGlu ZSBwcm9wZXJseSwKPj4+IHlvdSBuZWVkIG1vcmUgZGlnaXRzOgo+Pj4gCUZpeGVzOiBiYjJiYjkw MzA0MjUgKCJkbWEtYnVmOiBhZGQgRE1BX0JVRl9TRVRfTkFNRSBpb2N0bHMiKQo+Pgo+PiBXaWxs IHVwZGF0ZSB0aGUgcGF0Y2gKPj4KPj4KPj4+PiBSZXBvcnRlZC1ieTpzeXpib3QrMzY0M2ExODgz NmJjZTU1NWJmZjZAc3l6a2FsbGVyLmFwcHNwb3RtYWlsLmNvbQo+Pj4+IFNpZ25lZC1vZmYtYnk6 IENoYXJhbiBUZWphIFJlZGR5PGNoYXJhbnRlQGNvZGVhdXJvcmEub3JnPgo+Pj4gQWxzbywgYW55 IHJlYXNvbiB5b3UgZGlkbid0IGluY2x1ZGUgdGhlIG90aGVyIG1haWxpbmcgbGlzdHMgdGhhdAo+ Pj4gZ2V0X21haW50YWluZXIucGwgc2FpZCB0bz8KPj4KPj4gUmVhbGx5IHNvcnJ5IGZvciBub3Qg c2VuZGluZyB0byBjb21wbGV0ZSBsaXN0LiBBZGRlZCBub3cuCj4+Cj4+Cj4+PiBBbmQgZmluYWxs eSwgbm8gY2M6IHN0YWJsZSBpbiB0aGUgcy1vLWIgYXJlYSBmb3IgYW4gaXNzdWUgdGhhdCBuZWVk cyB0bwo+Pj4gYmUgYmFja3BvcnRlZCB0byBvbGRlciBrZXJuZWxzPwo+Pgo+PiBXaWxsIHVwZGF0 ZSB0aGUgcGF0Y2guCj4+Cj4+Cj4+Pj4gLS0tCj4+Pj4gICAgZHJpdmVycy9kbWEtYnVmL2RtYS1i dWYuYyB8IDI1ICsrKysrKysrKysrKysrKysrKysrKysrLS0KPj4+PiAgICBpbmNsdWRlL2xpbnV4 L2RtYS1idWYuaCAgIHwgIDEgKwo+Pj4+ICAgIDIgZmlsZXMgY2hhbmdlZCwgMjQgaW5zZXJ0aW9u cygrKSwgMiBkZWxldGlvbnMoLSkKPj4+Pgo+Pj4+IGRpZmYgLS1naXQgYS9kcml2ZXJzL2RtYS1i dWYvZG1hLWJ1Zi5jIGIvZHJpdmVycy9kbWEtYnVmL2RtYS1idWYuYwo+Pj4+IGluZGV4IDU3MGM5 MjMuLjA2OWQ4Zjc4IDEwMDY0NAo+Pj4+IC0tLSBhL2RyaXZlcnMvZG1hLWJ1Zi9kbWEtYnVmLmMK Pj4+PiArKysgYi9kcml2ZXJzL2RtYS1idWYvZG1hLWJ1Zi5jCj4+Pj4gQEAgLTI1LDYgKzI1LDcg QEAKPj4+PiAgICAjaW5jbHVkZSA8bGludXgvbW0uaD4KPj4+PiAgICAjaW5jbHVkZSA8bGludXgv bW91bnQuaD4KPj4+PiAgICAjaW5jbHVkZSA8bGludXgvcHNldWRvX2ZzLmg+Cj4+Pj4gKyNpbmNs dWRlIDxsaW51eC9kY2FjaGUuaD4KPj4+PiAgICAjaW5jbHVkZSA8dWFwaS9saW51eC9kbWEtYnVm Lmg+Cj4+Pj4gICAgI2luY2x1ZGUgPHVhcGkvbGludXgvbWFnaWMuaD4KPj4+PiBAQCAtMzgsMTgg KzM5LDM0IEBAIHN0cnVjdCBkbWFfYnVmX2xpc3Qgewo+Pj4+ICAgIHN0YXRpYyBzdHJ1Y3QgZG1h X2J1Zl9saXN0IGRiX2xpc3Q7Cj4+Pj4gK3N0YXRpYyB2b2lkIGRtYWJ1Zl9kZW50X3B1dChzdHJ1 Y3QgZG1hX2J1ZiAqZG1hYnVmKQo+Pj4+ICt7Cj4+Pj4gKwlpZiAoYXRvbWljX2RlY19hbmRfdGVz dCgmZG1hYnVmLT5kZW50X2NvdW50KSkgewo+Pj4+ICsJCWtmcmVlKGRtYWJ1Zi0+bmFtZSk7Cj4+ Pj4gKwkJa2ZyZWUoZG1hYnVmKTsKPj4+PiArCX0KPj4+IFdoeSBub3QganVzdCB1c2UgYSBrcmVm IGluc3RlYWQgb2YgYW4gb3Blbi1jb2RlZCBhdG9taWMgdmFsdWU/Cj4+Cj4+IEtyZWYgYXBwcm9h Y2ggbG9va3MgY2xlYW5lci4gd2lsbCB1cGRhdGUgdGhlIHBhdGNoIGFjY29yZGluZ2x5Lgo+Pgo+ Pgo+Pj4+ICt9Cj4+Pj4gKwo+Pj4+ICAgIHN0YXRpYyBjaGFyICpkbWFidWZmc19kbmFtZShzdHJ1 Y3QgZGVudHJ5ICpkZW50cnksIGNoYXIgKmJ1ZmZlciwgaW50IGJ1ZmxlbikKPj4+PiAgICB7Cj4+ Pj4gICAgCXN0cnVjdCBkbWFfYnVmICpkbWFidWY7Cj4+Pj4gICAgCWNoYXIgbmFtZVtETUFfQlVG X05BTUVfTEVOXTsKPj4+PiAgICAJc2l6ZV90IHJldCA9IDA7Cj4+Pj4gKwlzcGluX2xvY2soJmRl bnRyeS0+ZF9sb2NrKTsKPj4+PiAgICAJZG1hYnVmID0gZGVudHJ5LT5kX2ZzZGF0YTsKPj4+PiAr CWlmICghZG1hYnVmIHx8ICFhdG9taWNfYWRkX3VubGVzcygmZG1hYnVmLT5kZW50X2NvdW50LCAx LCAwKSkgewo+Pj4+ICsJCXNwaW5fdW5sb2NrKCZkZW50cnktPmRfbG9jayk7Cj4+Pj4gKwkJZ290 byBvdXQ7Cj4+PiBIb3cgY2FuIGRtYWJ1ZiBub3QgYmUgdmFsaWQgaGVyZT8KPj4+Cj4+PiBBbmQg aXNuJ3QgdGhlcmUgYWxyZWFkeSBhIHVzZWNvdW50IGZvciB0aGUgYnVmZmVyPwo+Pgo+PiBkbWFi dWYgZXhwb3J0ZWQgYXMgZmlsZSBzaW1wbHkgcmVsaWVzIG9uIHRoYXQgZmlsZSdzIHJlZmNvdW50 LCB0aHVzIGZwdXQoKQo+PiByZWxlYXNlcyB0aGUgZG1hYnVmLgo+Pgo+PiBXZSBhcmUgc3Rvcmlu ZyB0aGUgZG1hYnVmIGluIHRoZSBkZW50cnktPmRfZnNkYXRhIGJ1dCB0aGVyZSBpcyBubyBiaW5k aW5nCj4+IGJldHdlZW4gdGhlIGRlbnRyeSBhbmQgdGhlIGRtYWJ1Zi4gU28sIGZsb3cgd2lsbCBi ZSBsaWtlCj4+Cj4+IDEpIFAxIGNhbGxzIGZwdXQoZG1hYnVmX2ZkKQo+Pgo+PiAyKSBQMiB0cnlp bmcgdG8gYWNjZXNzIHRoZSBmaWxlIGluZm9ybWF0aW9uIG9mIFAxLgo+PiAgwqDCoMKgIEVnOiBs c29mIGNvbW1hbmQgdHJ5aW5nIHRvIGxpc3Qgb3V0IHRoZSBkbWFidWZfZmQgaW5mb3JtYXRpb24g dXNpbmcKPj4gL3Byb2MvPFAxIHBpZD4vZmQvZG1hYnVmX2ZkCj4+Cj4+IDMpIFAxIGNhbGxzIHRo ZSBmaWxlLT5mX29wLT5yZWxlYXNlKGRtYWJ1Zl9mZF9maWxlKShlbmRzIHVwIGluIGNhbGxpbmcK Pj4gZG1hX2J1Zl9yZWxlYXNlKCkpLMKgwqAgdGh1cyBmcmVlcyB1cCB0aGUgZG1hYnVmIGJ1ZmZl ci4KPj4KPj4gNCkgUDIgYWNjZXNzIHRoZSBkbWFidWYgc3RvcmVkIGluIHRoZSBkZW50cnktPmRf ZnNkYXRhIHdoaWNoIHdhcyBmcmVlZCBpbgo+PiBzdGVwIDMuCj4+Cj4+IFNvIHdlIG5lZWQgdG8g aGF2ZSBzb21lIHJlZmNvdW50IG1lY2hhbmlzbSB0byBhdm9pZCB0aGUgdXNlLWFmdGVyLWZyZWUg aW4KPj4gc3RlcCA0Lgo+IE9rLCBidXQgd2F0Y2ggb3V0LCBub3cgeW91IGhhdmUgMiBkaWZmZXJl bnQgcmVmZXJlbmNlIGNvdW50cyBmb3IgdGhlCj4gc2FtZSBzdHJ1Y3R1cmUuICBLZWVwaW5nIHRo ZW0gY29vcmRpbmF0ZWQgaXMgYWxtb3N0IGFsd2F5cyBhbiBpbXBvc3NpYmxlCj4gdGFzayBzbyB5 b3UgbmVlZCB0byBvbmx5IHJlbHkgb24gb25lLiAgSWYgeW91IGNhbid0IHVzZSB0aGUgZmlsZSBh cGksCj4ganVzdCBkcm9wIGFsbCBvZiB0aGUgcmVmZXJlbmNlIGNvdW50aW5nIGxvZ2ljIGluIHRo ZXJlIGFuZCBvbmx5IHVzZSB0aGUKPiBrcmVmIG9uZS4KCkkgZmVlbCB0aGF0IGNoYW5naW5nIHRo ZSByZWZjb3VudCBsb2dpYyBub3cgdG8gZG1hLWJ1ZiBvYmplY3RzIGludm9sdmUgCmNoYW5nZXMg aW4KCnRoZSBjb3JlIGRtYS1idWYgZnJhbWV3b3JrLiBOTz8gSW5zdGVhZCwgaG93IGFib3V0IHBh c3NpbmcgdGhlIHVzZXIgCnBhc3NlZCBuYW1lIGRpcmVjdGx5CgppbiB0aGUgLT5kX2ZzZGF0YSBp bnBsYWNlIG9mIGRtYWJ1ZiBvYmplY3Q/IEJlY2F1c2Ugd2UganVzdCBuZWVkIHVzZXIgCnBhc3Nl ZCBuYW1lIGluIHRoZQoKZG1hYnVmZnNfZG5hbWUoKS4gV2l0aCB0aGlzIHdlIGNhbiBhdm9pZCB0 aGUgbmVlZCBmb3IgZXh0cmEgcmVmY291bnQgb24gCmRtYWJ1Zi4KClBvc3RlZCBwYXRjaC1WMjog aHR0cHM6Ly9sa21sLm9yZy9sa21sLzIwMjAvNS84LzE1OAoKCj4KPiBnb29kIGx1Y2shCj4KPiBn cmVnIGstaAoKLS0gClRoZSBRdWFsY29tbSBJbm5vdmF0aW9uIENlbnRlciwgSW5jLiBpcyBhIG1l bWJlciBvZiB0aGUgQ29kZSBBdXJvcmEgRm9ydW0sIGEgTGludXggRm91bmRhdGlvbiBDb2xsYWJv cmF0aXZlIFByb2plY3QKX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX18KZHJpLWRldmVsIG1haWxpbmcgbGlzdApkcmktZGV2ZWxAbGlzdHMuZnJlZWRlc2t0b3Au b3JnCmh0dHBzOi8vbGlzdHMuZnJlZWRlc2t0b3Aub3JnL21haWxtYW4vbGlzdGluZm8vZHJpLWRl dmVsCg==