From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-13.4 required=3.0 tests=DKIMWL_WL_MED,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI, MENTIONS_GIT_HOSTING,SPF_HELO_NONE,SPF_PASS,USER_IN_DEF_DKIM_WL autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id E4FF9C43603 for ; Wed, 4 Dec 2019 06:51:49 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 5B59D24686 for ; Wed, 4 Dec 2019 06:34:01 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="dHJn7DD/" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727142AbfLDGeA (ORCPT ); Wed, 4 Dec 2019 01:34:00 -0500 Received: from mail-qk1-f196.google.com ([209.85.222.196]:39965 "EHLO mail-qk1-f196.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1725791AbfLDGd7 (ORCPT ); Wed, 4 Dec 2019 01:33:59 -0500 Received: by mail-qk1-f196.google.com with SMTP id a137so6117121qkc.7 for ; Tue, 03 Dec 2019 22:33:58 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=2cRSRnUjyOWj8W68zyd7mIujpzqYQeBmGrBj93EFUXY=; b=dHJn7DD/GzIvmxGi3WJtTxnr7lobK2J/Oi4Bn7PkUXqBKdM8XiuuMSwVwxSELSeNa6 IUh7RJ9hE279eVOvMIAtkV44u17LvJyd4BaCtSFwELWQbKZ1S+lyqLTma4AxsSRqs8i7 oqklpct9RqWtH5GjF75DxujkhqEBZ5bzQelJUyVJuh7xIxT0yJXS87kSLU01V2OopuPT VzKxXdlhiY6l46M7g1r1HtJCNh140NrdpopLWPGrKSxquSLdnKmA5+gr5EJPe3sHp4CB GZDSc43vmbGPdnUf7u0W+O5TeBBWOs8Mm8D2D4Ss6qcbpfJ+xu5KuzDQLzTFUDYa9sIk 5S5g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=2cRSRnUjyOWj8W68zyd7mIujpzqYQeBmGrBj93EFUXY=; b=CQjfdHqth6+XabsyoX8E72IaBuLA2VBzFVTtkV4mXTZVEknFXVzngYGER2Q+X3RGah WTIDS6DWB0a91outM5uwE5LUJmpReRy15RfTwU9FwEqCh6o92vobzT6AklBOfFK9JfB4 VYUn8A1nif8mSg3STwe1TzQmaIa0fjTUTLa3AQQvV4YR30NcXBEFBJZvkIYjVfqMqCuJ X8bN0qQEHilM4eefYksBoBduC85JyVQqhS7fPjEz4+aG9wQusZtIkP2EF0DvSgu0fgqP OQ8HqsrMEVEhbz/otxjXd5Es/0uKvvGJ+0IInNaZnYboBj8pSyoKSNIDUwdUYxtW8wDR 4/gg== X-Gm-Message-State: APjAAAVansmMp3K5ded8hJeuhITj7tlZTPBrgLiH51C3Y88F/LkG0bw8 abGKX1IYE6HP/R5reO9qfT7RDLgTb6yEJQ3FyPlBKw== X-Google-Smtp-Source: APXvYqwhBE4d0rB8gmQY7oLs/uQktcvJLrM1vE+q4Z7mwp3vUUtAhx3SF7wctd9w99E49ofDhRG92p9+ezHmbwCxdDo= X-Received: by 2002:a37:4782:: with SMTP id u124mr1427511qka.8.1575441237260; Tue, 03 Dec 2019 22:33:57 -0800 (PST) MIME-Version: 1.0 References: <0000000000002cfc3a0598d42b70@google.com> In-Reply-To: From: Dmitry Vyukov Date: Wed, 4 Dec 2019 07:33:45 +0100 Message-ID: Subject: Re: KASAN: slab-out-of-bounds Read in fbcon_get_font To: Daniel Vetter , kasan-dev , Andrey Ryabinin Cc: syzbot , Kentaro Takeda , Tetsuo Handa , James Morris , "Serge E. Hallyn" , linux-security-module , Bartlomiej Zolnierkiewicz , Daniel Thompson , dri-devel , ghalat@redhat.com, Linux Fbdev development list , Linux Kernel Mailing List , Maarten Lankhorst , Sam Ravnborg , syzkaller-bugs Content-Type: text/plain; charset="UTF-8" Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Tue, Dec 3, 2019 at 11:37 PM Daniel Vetter wrote: > > On Tue, Dec 3, 2019 at 11:25 PM syzbot > wrote: > > > > Hello, > > > > syzbot found the following crash on: > > > > HEAD commit: 76bb8b05 Merge tag 'kbuild-v5.5' of git://git.kernel.org/p.. > > git tree: upstream > > console output: https://syzkaller.appspot.com/x/log.txt?x=10bfe282e00000 > > kernel config: https://syzkaller.appspot.com/x/.config?x=dd226651cb0f364b > > dashboard link: https://syzkaller.appspot.com/bug?extid=4455ca3b3291de891abc > > compiler: gcc (GCC) 9.0.0 20181231 (experimental) > > syz repro: https://syzkaller.appspot.com/x/repro.syz?x=11181edae00000 > > C reproducer: https://syzkaller.appspot.com/x/repro.c?x=105cbb7ae00000 > > > > IMPORTANT: if you fix the bug, please add the following tag to the commit: > > Reported-by: syzbot+4455ca3b3291de891abc@syzkaller.appspotmail.com > > > > ================================================================== > > BUG: KASAN: slab-out-of-bounds in memcpy include/linux/string.h:380 [inline] > > BUG: KASAN: slab-out-of-bounds in fbcon_get_font+0x2b2/0x5e0 > > drivers/video/fbdev/core/fbcon.c:2465 > > Read of size 16 at addr ffff888094b0aa10 by task syz-executor414/9999 > > So fbcon allocates some memory, security/tomoyo goes around and frees > it, fbcon goes boom because the memory is gone. I'm kinda leaning > towards "not an fbcon bug". Adding relevant security folks and mailing > lists. > > But from a very quick look in tomoyo it loosk more like "machine on > fire, random corruption all over". No idea what's going on here. Hi Daniel, This is an out-of-bounds access, not use-after-free. I don't know why we print the free stack at all (maybe +Andrey knows), but that's what KASAN did from day one. I filed https://bugzilla.kernel.org/show_bug.cgi?id=198425 which I think is a good idea, I will add your confusion as a data point :) Re this bug, free stack is irrelevant, I guess it's when the heap block was freed before it was reallocated by console. So it's plain out-of-bounds in fbcon_get_font, which looks sane and consistent to me and reproducible on top. > > CPU: 0 PID: 9999 Comm: syz-executor414 Not tainted 5.4.0-syzkaller #0 > > Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS > > Google 01/01/2011 > > Call Trace: > > __dump_stack lib/dump_stack.c:77 [inline] > > dump_stack+0x197/0x210 lib/dump_stack.c:118 > > print_address_description.constprop.0.cold+0xd4/0x30b mm/kasan/report.c:374 > > __kasan_report.cold+0x1b/0x41 mm/kasan/report.c:506 > > kasan_report+0x12/0x20 mm/kasan/common.c:638 > > check_memory_region_inline mm/kasan/generic.c:185 [inline] > > check_memory_region+0x134/0x1a0 mm/kasan/generic.c:192 > > memcpy+0x24/0x50 mm/kasan/common.c:124 > > memcpy include/linux/string.h:380 [inline] > > fbcon_get_font+0x2b2/0x5e0 drivers/video/fbdev/core/fbcon.c:2465 > > con_font_get drivers/tty/vt/vt.c:4446 [inline] > > con_font_op+0x20b/0x1250 drivers/tty/vt/vt.c:4605 > > vt_ioctl+0x181a/0x26d0 drivers/tty/vt/vt_ioctl.c:965 > > tty_ioctl+0xa37/0x14f0 drivers/tty/tty_io.c:2658 > > vfs_ioctl fs/ioctl.c:47 [inline] > > file_ioctl fs/ioctl.c:545 [inline] > > do_vfs_ioctl+0x977/0x14e0 fs/ioctl.c:732 > > ksys_ioctl+0xab/0xd0 fs/ioctl.c:749 > > __do_sys_ioctl fs/ioctl.c:756 [inline] > > __se_sys_ioctl fs/ioctl.c:754 [inline] > > __x64_sys_ioctl+0x73/0xb0 fs/ioctl.c:754 > > do_syscall_64+0xfa/0x790 arch/x86/entry/common.c:294 > > entry_SYSCALL_64_after_hwframe+0x49/0xbe > > RIP: 0033:0x4444d9 > > Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 > > 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff > > ff 0f 83 7b d8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 > > RSP: 002b:00007fff6f4393b8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 > > RAX: ffffffffffffffda RBX: 00007fff6f4393c0 RCX: 00000000004444d9 > > RDX: 0000000020000440 RSI: 0000000000004b72 RDI: 0000000000000005 > > RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000400da0 > > R10: 00007fff6f438f00 R11: 0000000000000246 R12: 00000000004021e0 > > R13: 0000000000402270 R14: 0000000000000000 R15: 0000000000000000 > > > > Allocated by task 9999: > > save_stack+0x23/0x90 mm/kasan/common.c:71 > > set_track mm/kasan/common.c:79 [inline] > > __kasan_kmalloc mm/kasan/common.c:512 [inline] > > __kasan_kmalloc.constprop.0+0xcf/0xe0 mm/kasan/common.c:485 > > kasan_kmalloc+0x9/0x10 mm/kasan/common.c:526 > > __do_kmalloc mm/slab.c:3656 [inline] > > __kmalloc+0x163/0x770 mm/slab.c:3665 > > kmalloc include/linux/slab.h:561 [inline] > > fbcon_set_font+0x32d/0x860 drivers/video/fbdev/core/fbcon.c:2663 > > con_font_set drivers/tty/vt/vt.c:4538 [inline] > > con_font_op+0xe18/0x1250 drivers/tty/vt/vt.c:4603 > > vt_ioctl+0xd2e/0x26d0 drivers/tty/vt/vt_ioctl.c:913 > > tty_ioctl+0xa37/0x14f0 drivers/tty/tty_io.c:2658 > > vfs_ioctl fs/ioctl.c:47 [inline] > > file_ioctl fs/ioctl.c:545 [inline] > > do_vfs_ioctl+0x977/0x14e0 fs/ioctl.c:732 > > ksys_ioctl+0xab/0xd0 fs/ioctl.c:749 > > __do_sys_ioctl fs/ioctl.c:756 [inline] > > __se_sys_ioctl fs/ioctl.c:754 [inline] > > __x64_sys_ioctl+0x73/0xb0 fs/ioctl.c:754 > > do_syscall_64+0xfa/0x790 arch/x86/entry/common.c:294 > > entry_SYSCALL_64_after_hwframe+0x49/0xbe > > > > Freed by task 9771: > > save_stack+0x23/0x90 mm/kasan/common.c:71 > > set_track mm/kasan/common.c:79 [inline] > > kasan_set_free_info mm/kasan/common.c:334 [inline] > > __kasan_slab_free+0x102/0x150 mm/kasan/common.c:473 > > kasan_slab_free+0xe/0x10 mm/kasan/common.c:482 > > __cache_free mm/slab.c:3426 [inline] > > kfree+0x10a/0x2c0 mm/slab.c:3757 > > tomoyo_init_log+0x15c1/0x2070 security/tomoyo/audit.c:294 > > tomoyo_supervisor+0x33f/0xef0 security/tomoyo/common.c:2095 > > tomoyo_audit_env_log security/tomoyo/environ.c:36 [inline] > > tomoyo_env_perm+0x18e/0x210 security/tomoyo/environ.c:63 > > tomoyo_environ security/tomoyo/domain.c:670 [inline] > > tomoyo_find_next_domain+0x1354/0x1f6c security/tomoyo/domain.c:876 > > tomoyo_bprm_check_security security/tomoyo/tomoyo.c:107 [inline] > > tomoyo_bprm_check_security+0x124/0x1a0 security/tomoyo/tomoyo.c:97 > > security_bprm_check+0x63/0xb0 security/security.c:784 > > search_binary_handler+0x71/0x570 fs/exec.c:1645 > > exec_binprm fs/exec.c:1701 [inline] > > __do_execve_file.isra.0+0x1329/0x22b0 fs/exec.c:1821 > > do_execveat_common fs/exec.c:1867 [inline] > > do_execve fs/exec.c:1884 [inline] > > __do_sys_execve fs/exec.c:1960 [inline] > > __se_sys_execve fs/exec.c:1955 [inline] > > __x64_sys_execve+0x8f/0xc0 fs/exec.c:1955 > > do_syscall_64+0xfa/0x790 arch/x86/entry/common.c:294 > > entry_SYSCALL_64_after_hwframe+0x49/0xbe > > > > The buggy address belongs to the object at ffff888094b0a000 > > which belongs to the cache kmalloc-4k of size 4096 > > The buggy address is located 2576 bytes inside of > > 4096-byte region [ffff888094b0a000, ffff888094b0b000) > > The buggy address belongs to the page: > > page:ffffea000252c280 refcount:1 mapcount:0 mapping:ffff8880aa402000 > > index:0x0 compound_mapcount: 0 > > raw: 00fffe0000010200 ffffea0002a3ae08 ffffea0002a6aa88 ffff8880aa402000 > > raw: 0000000000000000 ffff888094b0a000 0000000100000001 0000000000000000 > > page dumped because: kasan: bad access detected > > > > Memory state around the buggy address: > > ffff888094b0a900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > > ffff888094b0a980: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > > > ffff888094b0aa00: 00 00 fc fc fc fc fc fc fc fc fc fc fc fc fc fc > > ^ > > ffff888094b0aa80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc > > ffff888094b0ab00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc > > ================================================================== > > > > > > --- > > This bug is generated by a bot. It may contain errors. > > See https://goo.gl/tpsmEJ for more information about syzbot. > > syzbot engineers can be reached at syzkaller@googlegroups.com. > > > > syzbot will keep track of this bug report. See: > > https://goo.gl/tpsmEJ#status for how to communicate with syzbot. > > syzbot can test patches for this bug, for details see: > > https://goo.gl/tpsmEJ#testing-patches From mboxrd@z Thu Jan 1 00:00:00 1970 From: Dmitry Vyukov Date: Wed, 04 Dec 2019 06:33:45 +0000 Subject: Re: KASAN: slab-out-of-bounds Read in fbcon_get_font Message-Id: List-Id: References: <0000000000002cfc3a0598d42b70@google.com> In-Reply-To: MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable To: Daniel Vetter , kasan-dev , Andrey Ryabinin Cc: Daniel Thompson , Bartlomiej Zolnierkiewicz , Tetsuo Handa , Linux Kernel Mailing List , syzbot , dri-devel , James Morris , syzkaller-bugs , linux-security-module , ghalat@redhat.com, Linux Fbdev development list , Kentaro Takeda , Sam Ravnborg , "Serge E. Hallyn" On Tue, Dec 3, 2019 at 11:37 PM Daniel Vetter wrot= e: > > On Tue, Dec 3, 2019 at 11:25 PM syzbot > wrote: > > > > Hello, > > > > syzbot found the following crash on: > > > > HEAD commit: 76bb8b05 Merge tag 'kbuild-v5.5' of git://git.kernel.or= g/p.. > > git tree: upstream > > console output: https://syzkaller.appspot.com/x/log.txt?x=10bfe282e00000 > > kernel config: https://syzkaller.appspot.com/x/.config?x=DD226651cb0f3= 64b > > dashboard link: https://syzkaller.appspot.com/bug?extidD55ca3b3291de891= abc > > compiler: gcc (GCC) 9.0.0 20181231 (experimental) > > syz repro: https://syzkaller.appspot.com/x/repro.syz?x=11181edae00= 000 > > C reproducer: https://syzkaller.appspot.com/x/repro.c?x=105cbb7ae00000 > > > > IMPORTANT: if you fix the bug, please add the following tag to the comm= it: > > Reported-by: syzbot+4455ca3b3291de891abc@syzkaller.appspotmail.com > > > > =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D > > BUG: KASAN: slab-out-of-bounds in memcpy include/linux/string.h:380 [in= line] > > BUG: KASAN: slab-out-of-bounds in fbcon_get_font+0x2b2/0x5e0 > > drivers/video/fbdev/core/fbcon.c:2465 > > Read of size 16 at addr ffff888094b0aa10 by task syz-executor414/9999 > > So fbcon allocates some memory, security/tomoyo goes around and frees > it, fbcon goes boom because the memory is gone. I'm kinda leaning > towards "not an fbcon bug". Adding relevant security folks and mailing > lists. > > But from a very quick look in tomoyo it loosk more like "machine on > fire, random corruption all over". No idea what's going on here. Hi Daniel, This is an out-of-bounds access, not use-after-free. I don't know why we print the free stack at all (maybe +Andrey knows), but that's what KASAN did from day one. I filed https://bugzilla.kernel.org/show_bug.cgi?id=198425 which I think is a good idea, I will add your confusion as a data point :) Re this bug, free stack is irrelevant, I guess it's when the heap block was freed before it was reallocated by console. So it's plain out-of-bounds in fbcon_get_font, which looks sane and consistent to me and reproducible on top. > > CPU: 0 PID: 9999 Comm: syz-executor414 Not tainted 5.4.0-syzkaller #0 > > Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS > > Google 01/01/2011 > > Call Trace: > > __dump_stack lib/dump_stack.c:77 [inline] > > dump_stack+0x197/0x210 lib/dump_stack.c:118 > > print_address_description.constprop.0.cold+0xd4/0x30b mm/kasan/report= .c:374 > > __kasan_report.cold+0x1b/0x41 mm/kasan/report.c:506 > > kasan_report+0x12/0x20 mm/kasan/common.c:638 > > check_memory_region_inline mm/kasan/generic.c:185 [inline] > > check_memory_region+0x134/0x1a0 mm/kasan/generic.c:192 > > memcpy+0x24/0x50 mm/kasan/common.c:124 > > memcpy include/linux/string.h:380 [inline] > > fbcon_get_font+0x2b2/0x5e0 drivers/video/fbdev/core/fbcon.c:2465 > > con_font_get drivers/tty/vt/vt.c:4446 [inline] > > con_font_op+0x20b/0x1250 drivers/tty/vt/vt.c:4605 > > vt_ioctl+0x181a/0x26d0 drivers/tty/vt/vt_ioctl.c:965 > > tty_ioctl+0xa37/0x14f0 drivers/tty/tty_io.c:2658 > > vfs_ioctl fs/ioctl.c:47 [inline] > > file_ioctl fs/ioctl.c:545 [inline] > > do_vfs_ioctl+0x977/0x14e0 fs/ioctl.c:732 > > ksys_ioctl+0xab/0xd0 fs/ioctl.c:749 > > __do_sys_ioctl fs/ioctl.c:756 [inline] > > __se_sys_ioctl fs/ioctl.c:754 [inline] > > __x64_sys_ioctl+0x73/0xb0 fs/ioctl.c:754 > > do_syscall_64+0xfa/0x790 arch/x86/entry/common.c:294 > > entry_SYSCALL_64_after_hwframe+0x49/0xbe > > RIP: 0033:0x4444d9 > > Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89= f7 > > 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 = ff > > ff 0f 83 7b d8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 > > RSP: 002b:00007fff6f4393b8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 > > RAX: ffffffffffffffda RBX: 00007fff6f4393c0 RCX: 00000000004444d9 > > RDX: 0000000020000440 RSI: 0000000000004b72 RDI: 0000000000000005 > > RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000400da0 > > R10: 00007fff6f438f00 R11: 0000000000000246 R12: 00000000004021e0 > > R13: 0000000000402270 R14: 0000000000000000 R15: 0000000000000000 > > > > Allocated by task 9999: > > save_stack+0x23/0x90 mm/kasan/common.c:71 > > set_track mm/kasan/common.c:79 [inline] > > __kasan_kmalloc mm/kasan/common.c:512 [inline] > > __kasan_kmalloc.constprop.0+0xcf/0xe0 mm/kasan/common.c:485 > > kasan_kmalloc+0x9/0x10 mm/kasan/common.c:526 > > __do_kmalloc mm/slab.c:3656 [inline] > > __kmalloc+0x163/0x770 mm/slab.c:3665 > > kmalloc include/linux/slab.h:561 [inline] > > fbcon_set_font+0x32d/0x860 drivers/video/fbdev/core/fbcon.c:2663 > > con_font_set drivers/tty/vt/vt.c:4538 [inline] > > con_font_op+0xe18/0x1250 drivers/tty/vt/vt.c:4603 > > vt_ioctl+0xd2e/0x26d0 drivers/tty/vt/vt_ioctl.c:913 > > tty_ioctl+0xa37/0x14f0 drivers/tty/tty_io.c:2658 > > vfs_ioctl fs/ioctl.c:47 [inline] > > file_ioctl fs/ioctl.c:545 [inline] > > do_vfs_ioctl+0x977/0x14e0 fs/ioctl.c:732 > > ksys_ioctl+0xab/0xd0 fs/ioctl.c:749 > > __do_sys_ioctl fs/ioctl.c:756 [inline] > > __se_sys_ioctl fs/ioctl.c:754 [inline] > > __x64_sys_ioctl+0x73/0xb0 fs/ioctl.c:754 > > do_syscall_64+0xfa/0x790 arch/x86/entry/common.c:294 > > entry_SYSCALL_64_after_hwframe+0x49/0xbe > > > > Freed by task 9771: > > save_stack+0x23/0x90 mm/kasan/common.c:71 > > set_track mm/kasan/common.c:79 [inline] > > kasan_set_free_info mm/kasan/common.c:334 [inline] > > __kasan_slab_free+0x102/0x150 mm/kasan/common.c:473 > > kasan_slab_free+0xe/0x10 mm/kasan/common.c:482 > > __cache_free mm/slab.c:3426 [inline] > > kfree+0x10a/0x2c0 mm/slab.c:3757 > > tomoyo_init_log+0x15c1/0x2070 security/tomoyo/audit.c:294 > > tomoyo_supervisor+0x33f/0xef0 security/tomoyo/common.c:2095 > > tomoyo_audit_env_log security/tomoyo/environ.c:36 [inline] > > tomoyo_env_perm+0x18e/0x210 security/tomoyo/environ.c:63 > > tomoyo_environ security/tomoyo/domain.c:670 [inline] > > tomoyo_find_next_domain+0x1354/0x1f6c security/tomoyo/domain.c:876 > > tomoyo_bprm_check_security security/tomoyo/tomoyo.c:107 [inline] > > tomoyo_bprm_check_security+0x124/0x1a0 security/tomoyo/tomoyo.c:97 > > security_bprm_check+0x63/0xb0 security/security.c:784 > > search_binary_handler+0x71/0x570 fs/exec.c:1645 > > exec_binprm fs/exec.c:1701 [inline] > > __do_execve_file.isra.0+0x1329/0x22b0 fs/exec.c:1821 > > do_execveat_common fs/exec.c:1867 [inline] > > do_execve fs/exec.c:1884 [inline] > > __do_sys_execve fs/exec.c:1960 [inline] > > __se_sys_execve fs/exec.c:1955 [inline] > > __x64_sys_execve+0x8f/0xc0 fs/exec.c:1955 > > do_syscall_64+0xfa/0x790 arch/x86/entry/common.c:294 > > entry_SYSCALL_64_after_hwframe+0x49/0xbe > > > > The buggy address belongs to the object at ffff888094b0a000 > > which belongs to the cache kmalloc-4k of size 4096 > > The buggy address is located 2576 bytes inside of > > 4096-byte region [ffff888094b0a000, ffff888094b0b000) > > The buggy address belongs to the page: > > page:ffffea000252c280 refcount:1 mapcount:0 mapping:ffff8880aa402000 > > index:0x0 compound_mapcount: 0 > > raw: 00fffe0000010200 ffffea0002a3ae08 ffffea0002a6aa88 ffff8880aa402000 > > raw: 0000000000000000 ffff888094b0a000 0000000100000001 0000000000000000 > > page dumped because: kasan: bad access detected > > > > Memory state around the buggy address: > > ffff888094b0a900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > > ffff888094b0a980: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > > > ffff888094b0aa00: 00 00 fc fc fc fc fc fc fc fc fc fc fc fc fc fc > > ^ > > ffff888094b0aa80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc > > ffff888094b0ab00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc > > =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D > > > > > > --- > > This bug is generated by a bot. It may contain errors. > > See https://goo.gl/tpsmEJ for more information about syzbot. > > syzbot engineers can be reached at syzkaller@googlegroups.com. > > > > syzbot will keep track of this bug report. See: > > https://goo.gl/tpsmEJ#status for how to communicate with syzbot. > > syzbot can test patches for this bug, for details see: > > https://goo.gl/tpsmEJ#testing-patches From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-5.7 required=3.0 tests=DKIM_ADSP_CUSTOM_MED, HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,MENTIONS_GIT_HOSTING, SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id DB661C0044D for ; Wed, 4 Dec 2019 08:01:34 +0000 (UTC) Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id B860920640 for ; Wed, 4 Dec 2019 08:01:34 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org B860920640 Authentication-Results: mail.kernel.org; dmarc=fail (p=reject dis=none) header.from=google.com Authentication-Results: mail.kernel.org; spf=none smtp.mailfrom=dri-devel-bounces@lists.freedesktop.org Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id 7EBF96F44A; Wed, 4 Dec 2019 08:01:22 +0000 (UTC) Received: from mail-qk1-x744.google.com (mail-qk1-x744.google.com [IPv6:2607:f8b0:4864:20::744]) by gabe.freedesktop.org (Postfix) with ESMTPS id 9FFFA6E23B for ; Wed, 4 Dec 2019 06:33:58 +0000 (UTC) Received: by mail-qk1-x744.google.com with SMTP id f5so6062108qkm.13 for ; Tue, 03 Dec 2019 22:33:58 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=2cRSRnUjyOWj8W68zyd7mIujpzqYQeBmGrBj93EFUXY=; b=KfLmRxy/doRsipTX3ofX7apuVaOvv4iQHGcT35RD+lOMogGROlIjkfelmZRHEuHiSj frt2eSqjGT3B99S9Dg7CvBiwvHrG2O1jnSQmDAKExAzU1TpS0+KcQBtN7f4YSG2QphlF HS+JLks9G0jbOQ4tA3gN8Ih4FkKQ703lyI9vdyxlg+k5aSM5ab0Dx3i5k2Ul9rQnNSIB 64ss2GQlrBzhUAapnrOGQ19m8MYahzEHdDdjKTjOtx+kQAG2tESAznMPOGXqBdAu0Lfy tUoG+OW+oEwTsxa/Mrw1SkpRJDcOLjg5h/uDKH/kwU65N40PFzzRGXDSoRkiQY2/SEWw tPUg== X-Gm-Message-State: APjAAAWw/Hv9X4KY12glSrS9e/lX9/qkJxU89qDMU49K5KhhI9V0dLji jmJhBCL53ZqLAX6oZIt3RHsNSIZY1oyijm4aSJpmOg== X-Google-Smtp-Source: APXvYqwhBE4d0rB8gmQY7oLs/uQktcvJLrM1vE+q4Z7mwp3vUUtAhx3SF7wctd9w99E49ofDhRG92p9+ezHmbwCxdDo= X-Received: by 2002:a37:4782:: with SMTP id u124mr1427511qka.8.1575441237260; Tue, 03 Dec 2019 22:33:57 -0800 (PST) MIME-Version: 1.0 References: <0000000000002cfc3a0598d42b70@google.com> In-Reply-To: From: Dmitry Vyukov Date: Wed, 4 Dec 2019 07:33:45 +0100 Message-ID: Subject: Re: KASAN: slab-out-of-bounds Read in fbcon_get_font To: Daniel Vetter , kasan-dev , Andrey Ryabinin X-Mailman-Approved-At: Wed, 04 Dec 2019 08:01:16 +0000 X-Mailman-Original-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=2cRSRnUjyOWj8W68zyd7mIujpzqYQeBmGrBj93EFUXY=; b=dHJn7DD/GzIvmxGi3WJtTxnr7lobK2J/Oi4Bn7PkUXqBKdM8XiuuMSwVwxSELSeNa6 IUh7RJ9hE279eVOvMIAtkV44u17LvJyd4BaCtSFwELWQbKZ1S+lyqLTma4AxsSRqs8i7 oqklpct9RqWtH5GjF75DxujkhqEBZ5bzQelJUyVJuh7xIxT0yJXS87kSLU01V2OopuPT VzKxXdlhiY6l46M7g1r1HtJCNh140NrdpopLWPGrKSxquSLdnKmA5+gr5EJPe3sHp4CB GZDSc43vmbGPdnUf7u0W+O5TeBBWOs8Mm8D2D4Ss6qcbpfJ+xu5KuzDQLzTFUDYa9sIk 5S5g== X-BeenThere: dri-devel@lists.freedesktop.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: Direct Rendering Infrastructure - Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Daniel Thompson , Bartlomiej Zolnierkiewicz , Tetsuo Handa , Linux Kernel Mailing List , syzbot , dri-devel , James Morris , syzkaller-bugs , linux-security-module , ghalat@redhat.com, Linux Fbdev development list , Kentaro Takeda , Sam Ravnborg , "Serge E. Hallyn" Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 Errors-To: dri-devel-bounces@lists.freedesktop.org Sender: "dri-devel" T24gVHVlLCBEZWMgMywgMjAxOSBhdCAxMTozNyBQTSBEYW5pZWwgVmV0dGVyIDxkYW5pZWwudmV0 dGVyQGZmd2xsLmNoPiB3cm90ZToKPgo+IE9uIFR1ZSwgRGVjIDMsIDIwMTkgYXQgMTE6MjUgUE0g c3l6Ym90Cj4gPHN5emJvdCs0NDU1Y2EzYjMyOTFkZTg5MWFiY0BzeXprYWxsZXIuYXBwc3BvdG1h aWwuY29tPiB3cm90ZToKPiA+Cj4gPiBIZWxsbywKPiA+Cj4gPiBzeXpib3QgZm91bmQgdGhlIGZv bGxvd2luZyBjcmFzaCBvbjoKPiA+Cj4gPiBIRUFEIGNvbW1pdDogICAgNzZiYjhiMDUgTWVyZ2Ug dGFnICdrYnVpbGQtdjUuNScgb2YgZ2l0Oi8vZ2l0Lmtlcm5lbC5vcmcvcC4uCj4gPiBnaXQgdHJl ZTogICAgICAgdXBzdHJlYW0KPiA+IGNvbnNvbGUgb3V0cHV0OiBodHRwczovL3N5emthbGxlci5h cHBzcG90LmNvbS94L2xvZy50eHQ/eD0xMGJmZTI4MmUwMDAwMAo+ID4ga2VybmVsIGNvbmZpZzog IGh0dHBzOi8vc3l6a2FsbGVyLmFwcHNwb3QuY29tL3gvLmNvbmZpZz94PWRkMjI2NjUxY2IwZjM2 NGIKPiA+IGRhc2hib2FyZCBsaW5rOiBodHRwczovL3N5emthbGxlci5hcHBzcG90LmNvbS9idWc/ ZXh0aWQ9NDQ1NWNhM2IzMjkxZGU4OTFhYmMKPiA+IGNvbXBpbGVyOiAgICAgICBnY2MgKEdDQykg OS4wLjAgMjAxODEyMzEgKGV4cGVyaW1lbnRhbCkKPiA+IHN5eiByZXBybzogICAgICBodHRwczov L3N5emthbGxlci5hcHBzcG90LmNvbS94L3JlcHJvLnN5ej94PTExMTgxZWRhZTAwMDAwCj4gPiBD IHJlcHJvZHVjZXI6ICAgaHR0cHM6Ly9zeXprYWxsZXIuYXBwc3BvdC5jb20veC9yZXByby5jP3g9 MTA1Y2JiN2FlMDAwMDAKPiA+Cj4gPiBJTVBPUlRBTlQ6IGlmIHlvdSBmaXggdGhlIGJ1ZywgcGxl YXNlIGFkZCB0aGUgZm9sbG93aW5nIHRhZyB0byB0aGUgY29tbWl0Ogo+ID4gUmVwb3J0ZWQtYnk6 IHN5emJvdCs0NDU1Y2EzYjMyOTFkZTg5MWFiY0BzeXprYWxsZXIuYXBwc3BvdG1haWwuY29tCj4g Pgo+ID4gPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09Cj4gPiBCVUc6IEtBU0FOOiBzbGFiLW91dC1vZi1ib3VuZHMgaW4gbWVt Y3B5IGluY2x1ZGUvbGludXgvc3RyaW5nLmg6MzgwIFtpbmxpbmVdCj4gPiBCVUc6IEtBU0FOOiBz bGFiLW91dC1vZi1ib3VuZHMgaW4gZmJjb25fZ2V0X2ZvbnQrMHgyYjIvMHg1ZTAKPiA+IGRyaXZl cnMvdmlkZW8vZmJkZXYvY29yZS9mYmNvbi5jOjI0NjUKPiA+IFJlYWQgb2Ygc2l6ZSAxNiBhdCBh ZGRyIGZmZmY4ODgwOTRiMGFhMTAgYnkgdGFzayBzeXotZXhlY3V0b3I0MTQvOTk5OQo+Cj4gU28g ZmJjb24gYWxsb2NhdGVzIHNvbWUgbWVtb3J5LCBzZWN1cml0eS90b21veW8gZ29lcyBhcm91bmQg YW5kIGZyZWVzCj4gaXQsIGZiY29uIGdvZXMgYm9vbSBiZWNhdXNlIHRoZSBtZW1vcnkgaXMgZ29u ZS4gSSdtIGtpbmRhIGxlYW5pbmcKPiB0b3dhcmRzICJub3QgYW4gZmJjb24gYnVnIi4gQWRkaW5n IHJlbGV2YW50IHNlY3VyaXR5IGZvbGtzIGFuZCBtYWlsaW5nCj4gbGlzdHMuCj4KPiBCdXQgZnJv bSBhIHZlcnkgcXVpY2sgbG9vayBpbiB0b21veW8gaXQgbG9vc2sgbW9yZSBsaWtlICJtYWNoaW5l IG9uCj4gZmlyZSwgcmFuZG9tIGNvcnJ1cHRpb24gYWxsIG92ZXIiLiBObyBpZGVhIHdoYXQncyBn b2luZyBvbiBoZXJlLgoKSGkgRGFuaWVsLAoKVGhpcyBpcyBhbiBvdXQtb2YtYm91bmRzIGFjY2Vz cywgbm90IHVzZS1hZnRlci1mcmVlLgpJIGRvbid0IGtub3cgd2h5IHdlIHByaW50IHRoZSBmcmVl IHN0YWNrIGF0IGFsbCAobWF5YmUgK0FuZHJleSBrbm93cyksCmJ1dCB0aGF0J3Mgd2hhdCBLQVNB TiBkaWQgZnJvbSBkYXkgb25lLiBJIGZpbGVkCmh0dHBzOi8vYnVnemlsbGEua2VybmVsLm9yZy9z aG93X2J1Zy5jZ2k/aWQ9MTk4NDI1IHdoaWNoIEkgdGhpbmsgaXMgYQpnb29kIGlkZWEsIEkgd2ls bCBhZGQgeW91ciBjb25mdXNpb24gYXMgYSBkYXRhIHBvaW50IDopClJlIHRoaXMgYnVnLCBmcmVl IHN0YWNrIGlzIGlycmVsZXZhbnQsIEkgZ3Vlc3MgaXQncyB3aGVuIHRoZSBoZWFwCmJsb2NrIHdh cyBmcmVlZCBiZWZvcmUgaXQgd2FzIHJlYWxsb2NhdGVkIGJ5IGNvbnNvbGUuIFNvIGl0J3MgcGxh aW4Kb3V0LW9mLWJvdW5kcyBpbiBmYmNvbl9nZXRfZm9udCwgd2hpY2ggbG9va3Mgc2FuZSBhbmQg Y29uc2lzdGVudCB0byBtZQphbmQgcmVwcm9kdWNpYmxlIG9uIHRvcC4KCgo+ID4gQ1BVOiAwIFBJ RDogOTk5OSBDb21tOiBzeXotZXhlY3V0b3I0MTQgTm90IHRhaW50ZWQgNS40LjAtc3l6a2FsbGVy ICMwCj4gPiBIYXJkd2FyZSBuYW1lOiBHb29nbGUgR29vZ2xlIENvbXB1dGUgRW5naW5lL0dvb2ds ZSBDb21wdXRlIEVuZ2luZSwgQklPUwo+ID4gR29vZ2xlIDAxLzAxLzIwMTEKPiA+IENhbGwgVHJh Y2U6Cj4gPiAgIF9fZHVtcF9zdGFjayBsaWIvZHVtcF9zdGFjay5jOjc3IFtpbmxpbmVdCj4gPiAg IGR1bXBfc3RhY2srMHgxOTcvMHgyMTAgbGliL2R1bXBfc3RhY2suYzoxMTgKPiA+ICAgcHJpbnRf YWRkcmVzc19kZXNjcmlwdGlvbi5jb25zdHByb3AuMC5jb2xkKzB4ZDQvMHgzMGIgbW0va2FzYW4v cmVwb3J0LmM6Mzc0Cj4gPiAgIF9fa2FzYW5fcmVwb3J0LmNvbGQrMHgxYi8weDQxIG1tL2thc2Fu L3JlcG9ydC5jOjUwNgo+ID4gICBrYXNhbl9yZXBvcnQrMHgxMi8weDIwIG1tL2thc2FuL2NvbW1v bi5jOjYzOAo+ID4gICBjaGVja19tZW1vcnlfcmVnaW9uX2lubGluZSBtbS9rYXNhbi9nZW5lcmlj LmM6MTg1IFtpbmxpbmVdCj4gPiAgIGNoZWNrX21lbW9yeV9yZWdpb24rMHgxMzQvMHgxYTAgbW0v a2FzYW4vZ2VuZXJpYy5jOjE5Mgo+ID4gICBtZW1jcHkrMHgyNC8weDUwIG1tL2thc2FuL2NvbW1v bi5jOjEyNAo+ID4gICBtZW1jcHkgaW5jbHVkZS9saW51eC9zdHJpbmcuaDozODAgW2lubGluZV0K PiA+ICAgZmJjb25fZ2V0X2ZvbnQrMHgyYjIvMHg1ZTAgZHJpdmVycy92aWRlby9mYmRldi9jb3Jl L2ZiY29uLmM6MjQ2NQo+ID4gICBjb25fZm9udF9nZXQgZHJpdmVycy90dHkvdnQvdnQuYzo0NDQ2 IFtpbmxpbmVdCj4gPiAgIGNvbl9mb250X29wKzB4MjBiLzB4MTI1MCBkcml2ZXJzL3R0eS92dC92 dC5jOjQ2MDUKPiA+ICAgdnRfaW9jdGwrMHgxODFhLzB4MjZkMCBkcml2ZXJzL3R0eS92dC92dF9p b2N0bC5jOjk2NQo+ID4gICB0dHlfaW9jdGwrMHhhMzcvMHgxNGYwIGRyaXZlcnMvdHR5L3R0eV9p by5jOjI2NTgKPiA+ICAgdmZzX2lvY3RsIGZzL2lvY3RsLmM6NDcgW2lubGluZV0KPiA+ICAgZmls ZV9pb2N0bCBmcy9pb2N0bC5jOjU0NSBbaW5saW5lXQo+ID4gICBkb192ZnNfaW9jdGwrMHg5Nzcv MHgxNGUwIGZzL2lvY3RsLmM6NzMyCj4gPiAgIGtzeXNfaW9jdGwrMHhhYi8weGQwIGZzL2lvY3Rs LmM6NzQ5Cj4gPiAgIF9fZG9fc3lzX2lvY3RsIGZzL2lvY3RsLmM6NzU2IFtpbmxpbmVdCj4gPiAg IF9fc2Vfc3lzX2lvY3RsIGZzL2lvY3RsLmM6NzU0IFtpbmxpbmVdCj4gPiAgIF9feDY0X3N5c19p b2N0bCsweDczLzB4YjAgZnMvaW9jdGwuYzo3NTQKPiA+ICAgZG9fc3lzY2FsbF82NCsweGZhLzB4 NzkwIGFyY2gveDg2L2VudHJ5L2NvbW1vbi5jOjI5NAo+ID4gICBlbnRyeV9TWVNDQUxMXzY0X2Fm dGVyX2h3ZnJhbWUrMHg0OS8weGJlCj4gPiBSSVA6IDAwMzM6MHg0NDQ0ZDkKPiA+IENvZGU6IDE4 IDg5IGQwIGMzIDY2IDJlIDBmIDFmIDg0IDAwIDAwIDAwIDAwIDAwIDBmIDFmIDAwIDQ4IDg5IGY4 IDQ4IDg5IGY3Cj4gPiA0OCA4OSBkNiA0OCA4OSBjYSA0ZCA4OSBjMiA0ZCA4OSBjOCA0YyA4YiA0 YyAyNCAwOCAwZiAwNSA8NDg+IDNkIDAxIGYwIGZmCj4gPiBmZiAwZiA4MyA3YiBkOCBmYiBmZiBj MyA2NiAyZSAwZiAxZiA4NCAwMCAwMCAwMCAwMAo+ID4gUlNQOiAwMDJiOjAwMDA3ZmZmNmY0Mzkz YjggRUZMQUdTOiAwMDAwMDI0NiBPUklHX1JBWDogMDAwMDAwMDAwMDAwMDAxMAo+ID4gUkFYOiBm ZmZmZmZmZmZmZmZmZmRhIFJCWDogMDAwMDdmZmY2ZjQzOTNjMCBSQ1g6IDAwMDAwMDAwMDA0NDQ0 ZDkKPiA+IFJEWDogMDAwMDAwMDAyMDAwMDQ0MCBSU0k6IDAwMDAwMDAwMDAwMDRiNzIgUkRJOiAw MDAwMDAwMDAwMDAwMDA1Cj4gPiBSQlA6IDAwMDAwMDAwMDAwMDAwMDAgUjA4OiAwMDAwMDAwMDAw MDAwMDAwIFIwOTogMDAwMDAwMDAwMDQwMGRhMAo+ID4gUjEwOiAwMDAwN2ZmZjZmNDM4ZjAwIFIx MTogMDAwMDAwMDAwMDAwMDI0NiBSMTI6IDAwMDAwMDAwMDA0MDIxZTAKPiA+IFIxMzogMDAwMDAw MDAwMDQwMjI3MCBSMTQ6IDAwMDAwMDAwMDAwMDAwMDAgUjE1OiAwMDAwMDAwMDAwMDAwMDAwCj4g Pgo+ID4gQWxsb2NhdGVkIGJ5IHRhc2sgOTk5OToKPiA+ICAgc2F2ZV9zdGFjaysweDIzLzB4OTAg bW0va2FzYW4vY29tbW9uLmM6NzEKPiA+ICAgc2V0X3RyYWNrIG1tL2thc2FuL2NvbW1vbi5jOjc5 IFtpbmxpbmVdCj4gPiAgIF9fa2FzYW5fa21hbGxvYyBtbS9rYXNhbi9jb21tb24uYzo1MTIgW2lu bGluZV0KPiA+ICAgX19rYXNhbl9rbWFsbG9jLmNvbnN0cHJvcC4wKzB4Y2YvMHhlMCBtbS9rYXNh bi9jb21tb24uYzo0ODUKPiA+ICAga2FzYW5fa21hbGxvYysweDkvMHgxMCBtbS9rYXNhbi9jb21t b24uYzo1MjYKPiA+ICAgX19kb19rbWFsbG9jIG1tL3NsYWIuYzozNjU2IFtpbmxpbmVdCj4gPiAg IF9fa21hbGxvYysweDE2My8weDc3MCBtbS9zbGFiLmM6MzY2NQo+ID4gICBrbWFsbG9jIGluY2x1 ZGUvbGludXgvc2xhYi5oOjU2MSBbaW5saW5lXQo+ID4gICBmYmNvbl9zZXRfZm9udCsweDMyZC8w eDg2MCBkcml2ZXJzL3ZpZGVvL2ZiZGV2L2NvcmUvZmJjb24uYzoyNjYzCj4gPiAgIGNvbl9mb250 X3NldCBkcml2ZXJzL3R0eS92dC92dC5jOjQ1MzggW2lubGluZV0KPiA+ICAgY29uX2ZvbnRfb3Ar MHhlMTgvMHgxMjUwIGRyaXZlcnMvdHR5L3Z0L3Z0LmM6NDYwMwo+ID4gICB2dF9pb2N0bCsweGQy ZS8weDI2ZDAgZHJpdmVycy90dHkvdnQvdnRfaW9jdGwuYzo5MTMKPiA+ICAgdHR5X2lvY3RsKzB4 YTM3LzB4MTRmMCBkcml2ZXJzL3R0eS90dHlfaW8uYzoyNjU4Cj4gPiAgIHZmc19pb2N0bCBmcy9p b2N0bC5jOjQ3IFtpbmxpbmVdCj4gPiAgIGZpbGVfaW9jdGwgZnMvaW9jdGwuYzo1NDUgW2lubGlu ZV0KPiA+ICAgZG9fdmZzX2lvY3RsKzB4OTc3LzB4MTRlMCBmcy9pb2N0bC5jOjczMgo+ID4gICBr c3lzX2lvY3RsKzB4YWIvMHhkMCBmcy9pb2N0bC5jOjc0OQo+ID4gICBfX2RvX3N5c19pb2N0bCBm cy9pb2N0bC5jOjc1NiBbaW5saW5lXQo+ID4gICBfX3NlX3N5c19pb2N0bCBmcy9pb2N0bC5jOjc1 NCBbaW5saW5lXQo+ID4gICBfX3g2NF9zeXNfaW9jdGwrMHg3My8weGIwIGZzL2lvY3RsLmM6NzU0 Cj4gPiAgIGRvX3N5c2NhbGxfNjQrMHhmYS8weDc5MCBhcmNoL3g4Ni9lbnRyeS9jb21tb24uYzoy OTQKPiA+ICAgZW50cnlfU1lTQ0FMTF82NF9hZnRlcl9od2ZyYW1lKzB4NDkvMHhiZQo+ID4KPiA+ IEZyZWVkIGJ5IHRhc2sgOTc3MToKPiA+ICAgc2F2ZV9zdGFjaysweDIzLzB4OTAgbW0va2FzYW4v Y29tbW9uLmM6NzEKPiA+ICAgc2V0X3RyYWNrIG1tL2thc2FuL2NvbW1vbi5jOjc5IFtpbmxpbmVd Cj4gPiAgIGthc2FuX3NldF9mcmVlX2luZm8gbW0va2FzYW4vY29tbW9uLmM6MzM0IFtpbmxpbmVd Cj4gPiAgIF9fa2FzYW5fc2xhYl9mcmVlKzB4MTAyLzB4MTUwIG1tL2thc2FuL2NvbW1vbi5jOjQ3 Mwo+ID4gICBrYXNhbl9zbGFiX2ZyZWUrMHhlLzB4MTAgbW0va2FzYW4vY29tbW9uLmM6NDgyCj4g PiAgIF9fY2FjaGVfZnJlZSBtbS9zbGFiLmM6MzQyNiBbaW5saW5lXQo+ID4gICBrZnJlZSsweDEw YS8weDJjMCBtbS9zbGFiLmM6Mzc1Nwo+ID4gICB0b21veW9faW5pdF9sb2crMHgxNWMxLzB4MjA3 MCBzZWN1cml0eS90b21veW8vYXVkaXQuYzoyOTQKPiA+ICAgdG9tb3lvX3N1cGVydmlzb3IrMHgz M2YvMHhlZjAgc2VjdXJpdHkvdG9tb3lvL2NvbW1vbi5jOjIwOTUKPiA+ICAgdG9tb3lvX2F1ZGl0 X2Vudl9sb2cgc2VjdXJpdHkvdG9tb3lvL2Vudmlyb24uYzozNiBbaW5saW5lXQo+ID4gICB0b21v eW9fZW52X3Blcm0rMHgxOGUvMHgyMTAgc2VjdXJpdHkvdG9tb3lvL2Vudmlyb24uYzo2Mwo+ID4g ICB0b21veW9fZW52aXJvbiBzZWN1cml0eS90b21veW8vZG9tYWluLmM6NjcwIFtpbmxpbmVdCj4g PiAgIHRvbW95b19maW5kX25leHRfZG9tYWluKzB4MTM1NC8weDFmNmMgc2VjdXJpdHkvdG9tb3lv L2RvbWFpbi5jOjg3Ngo+ID4gICB0b21veW9fYnBybV9jaGVja19zZWN1cml0eSBzZWN1cml0eS90 b21veW8vdG9tb3lvLmM6MTA3IFtpbmxpbmVdCj4gPiAgIHRvbW95b19icHJtX2NoZWNrX3NlY3Vy aXR5KzB4MTI0LzB4MWEwIHNlY3VyaXR5L3RvbW95by90b21veW8uYzo5Nwo+ID4gICBzZWN1cml0 eV9icHJtX2NoZWNrKzB4NjMvMHhiMCBzZWN1cml0eS9zZWN1cml0eS5jOjc4NAo+ID4gICBzZWFy Y2hfYmluYXJ5X2hhbmRsZXIrMHg3MS8weDU3MCBmcy9leGVjLmM6MTY0NQo+ID4gICBleGVjX2Jp bnBybSBmcy9leGVjLmM6MTcwMSBbaW5saW5lXQo+ID4gICBfX2RvX2V4ZWN2ZV9maWxlLmlzcmEu MCsweDEzMjkvMHgyMmIwIGZzL2V4ZWMuYzoxODIxCj4gPiAgIGRvX2V4ZWN2ZWF0X2NvbW1vbiBm cy9leGVjLmM6MTg2NyBbaW5saW5lXQo+ID4gICBkb19leGVjdmUgZnMvZXhlYy5jOjE4ODQgW2lu bGluZV0KPiA+ICAgX19kb19zeXNfZXhlY3ZlIGZzL2V4ZWMuYzoxOTYwIFtpbmxpbmVdCj4gPiAg IF9fc2Vfc3lzX2V4ZWN2ZSBmcy9leGVjLmM6MTk1NSBbaW5saW5lXQo+ID4gICBfX3g2NF9zeXNf ZXhlY3ZlKzB4OGYvMHhjMCBmcy9leGVjLmM6MTk1NQo+ID4gICBkb19zeXNjYWxsXzY0KzB4ZmEv MHg3OTAgYXJjaC94ODYvZW50cnkvY29tbW9uLmM6Mjk0Cj4gPiAgIGVudHJ5X1NZU0NBTExfNjRf YWZ0ZXJfaHdmcmFtZSsweDQ5LzB4YmUKPiA+Cj4gPiBUaGUgYnVnZ3kgYWRkcmVzcyBiZWxvbmdz IHRvIHRoZSBvYmplY3QgYXQgZmZmZjg4ODA5NGIwYTAwMAo+ID4gICB3aGljaCBiZWxvbmdzIHRv IHRoZSBjYWNoZSBrbWFsbG9jLTRrIG9mIHNpemUgNDA5Ngo+ID4gVGhlIGJ1Z2d5IGFkZHJlc3Mg aXMgbG9jYXRlZCAyNTc2IGJ5dGVzIGluc2lkZSBvZgo+ID4gICA0MDk2LWJ5dGUgcmVnaW9uIFtm ZmZmODg4MDk0YjBhMDAwLCBmZmZmODg4MDk0YjBiMDAwKQo+ID4gVGhlIGJ1Z2d5IGFkZHJlc3Mg YmVsb25ncyB0byB0aGUgcGFnZToKPiA+IHBhZ2U6ZmZmZmVhMDAwMjUyYzI4MCByZWZjb3VudDox IG1hcGNvdW50OjAgbWFwcGluZzpmZmZmODg4MGFhNDAyMDAwCj4gPiBpbmRleDoweDAgY29tcG91 bmRfbWFwY291bnQ6IDAKPiA+IHJhdzogMDBmZmZlMDAwMDAxMDIwMCBmZmZmZWEwMDAyYTNhZTA4 IGZmZmZlYTAwMDJhNmFhODggZmZmZjg4ODBhYTQwMjAwMAo+ID4gcmF3OiAwMDAwMDAwMDAwMDAw MDAwIGZmZmY4ODgwOTRiMGEwMDAgMDAwMDAwMDEwMDAwMDAwMSAwMDAwMDAwMDAwMDAwMDAwCj4g PiBwYWdlIGR1bXBlZCBiZWNhdXNlOiBrYXNhbjogYmFkIGFjY2VzcyBkZXRlY3RlZAo+ID4KPiA+ IE1lbW9yeSBzdGF0ZSBhcm91bmQgdGhlIGJ1Z2d5IGFkZHJlc3M6Cj4gPiAgIGZmZmY4ODgwOTRi MGE5MDA6IDAwIDAwIDAwIDAwIDAwIDAwIDAwIDAwIDAwIDAwIDAwIDAwIDAwIDAwIDAwIDAwCj4g PiAgIGZmZmY4ODgwOTRiMGE5ODA6IDAwIDAwIDAwIDAwIDAwIDAwIDAwIDAwIDAwIDAwIDAwIDAw IDAwIDAwIDAwIDAwCj4gPiA+IGZmZmY4ODgwOTRiMGFhMDA6IDAwIDAwIGZjIGZjIGZjIGZjIGZj IGZjIGZjIGZjIGZjIGZjIGZjIGZjIGZjIGZjCj4gPiAgICAgICAgICAgICAgICAgICAgICAgICAg IF4KPiA+ICAgZmZmZjg4ODA5NGIwYWE4MDogZmMgZmMgZmMgZmMgZmMgZmMgZmMgZmMgZmMgZmMg ZmMgZmMgZmMgZmMgZmMgZmMKPiA+ICAgZmZmZjg4ODA5NGIwYWIwMDogZmMgZmMgZmMgZmMgZmMg ZmMgZmMgZmMgZmMgZmMgZmMgZmMgZmMgZmMgZmMgZmMKPiA+ID09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQo+ID4KPiA+Cj4g PiAtLS0KPiA+IFRoaXMgYnVnIGlzIGdlbmVyYXRlZCBieSBhIGJvdC4gSXQgbWF5IGNvbnRhaW4g ZXJyb3JzLgo+ID4gU2VlIGh0dHBzOi8vZ29vLmdsL3Rwc21FSiBmb3IgbW9yZSBpbmZvcm1hdGlv biBhYm91dCBzeXpib3QuCj4gPiBzeXpib3QgZW5naW5lZXJzIGNhbiBiZSByZWFjaGVkIGF0IHN5 emthbGxlckBnb29nbGVncm91cHMuY29tLgo+ID4KPiA+IHN5emJvdCB3aWxsIGtlZXAgdHJhY2sg b2YgdGhpcyBidWcgcmVwb3J0LiBTZWU6Cj4gPiBodHRwczovL2dvby5nbC90cHNtRUojc3RhdHVz IGZvciBob3cgdG8gY29tbXVuaWNhdGUgd2l0aCBzeXpib3QuCj4gPiBzeXpib3QgY2FuIHRlc3Qg cGF0Y2hlcyBmb3IgdGhpcyBidWcsIGZvciBkZXRhaWxzIHNlZToKPiA+IGh0dHBzOi8vZ29vLmds L3Rwc21FSiN0ZXN0aW5nLXBhdGNoZXMKX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX18KZHJpLWRldmVsIG1haWxpbmcgbGlzdApkcmktZGV2ZWxAbGlzdHMuZnJl ZWRlc2t0b3Aub3JnCmh0dHBzOi8vbGlzdHMuZnJlZWRlc2t0b3Aub3JnL21haWxtYW4vbGlzdGlu Zm8vZHJpLWRldmVs