From: Tetsuo Handa <penguin-kernel@i-love.sakura.ne.jp> To: dri-devel@lists.freedesktop.org, linux-fbdev@vger.kernel.org, linux-kernel@vger.kernel.org, "Maciej W. Rozycki" <macro@orcam.me.uk>, Daniel Vetter <daniel@ffwll.ch> Cc: Linus Torvalds <torvalds@linux-foundation.org>, syzbot <syzbot+1f29e126cf461c4de3b3@syzkaller.appspotmail.com>, b.zolnierkie@samsung.com, colin.king@canonical.com, gregkh@linuxfoundation.org, jani.nikula@intel.com, jirislaby@kernel.org, syzkaller-bugs@googlegroups.com, "Antonino A. Daplas" <adaplas@gmail.com> Subject: [PATCH] video: fbdev: vga16fb: fix OOB write in vga16fb_imageblit() Date: Sat, 15 May 2021 01:19:48 +0900 [thread overview] Message-ID: <05acdda8-dc1c-5119-4326-96eed24bea0c@i-love.sakura.ne.jp> (raw) In-Reply-To: <87d928e4-b2b9-ad30-f3f0-1dfb8e4e03ed@i-love.sakura.ne.jp> syzbot is reporting that a local user with the framebuffer console can crash the kernel [1], for ioctl(VT_RESIZE) allows a TTY to set arbitrary rows/columns values regardless of amount of memory reserved for the graphical screen. ---------- #include <sys/types.h> #include <sys/stat.h> #include <fcntl.h> #include <sys/ioctl.h> #include <linux/kd.h> #include <linux/vt.h> int main(int argc, char *argv[]) { const int fd = open("/dev/char/4:1", O_RDWR); struct vt_sizes vt = { 0x4100, 2 }; ioctl(fd, KDSETMODE, KD_GRAPHICS); ioctl(fd, VT_RESIZE, &vt); ioctl(fd, KDSETMODE, KD_TEXT); return 0; } ---------- Currently it is impossible to control upper limit of rows/columns values based on amount of memory reserved for the graphical screen, for resize_screen() calls vc->vc_sw->con_resize() only if vc->vc_mode is not already KD_GRAPHICS. I don't know the reason, and this condition predates the git history. Even if it turns out to be safe to always call this callback, we will need to involve another callback via "struct fb_ops" for checking the upper limits from fbcon_resize(). As a result, we will need to modify drivers/tty/vt/vt.c drivers/video/fbdev/core/fbcon.c drivers/video/fbdev/vga16fb.c include/linux/fb.h files only for checking rows/columns values passed to ioctl(VT_RESIZE) request. Therefore, instead of introducing such a complicated callback chain, avoid this problem by simply checking whether the address to read or write is in [VGA_FB_PHYS, VGA_FB_PHYS + VGA_FB_PHYS_LEN) range. [1] https://syzkaller.appspot.com/bug?extid=1f29e126cf461c4de3b3 Reported-by: syzbot <syzbot+1f29e126cf461c4de3b3@syzkaller.appspotmail.com> Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp> Tested-by: syzbot <syzbot+1f29e126cf461c4de3b3@syzkaller.appspotmail.com> --- drivers/video/fbdev/vga16fb.c | 54 +++++++++++++++++++++++------------ 1 file changed, 36 insertions(+), 18 deletions(-) diff --git a/drivers/video/fbdev/vga16fb.c b/drivers/video/fbdev/vga16fb.c index e2757ff1c23d..13732a3b1d69 100644 --- a/drivers/video/fbdev/vga16fb.c +++ b/drivers/video/fbdev/vga16fb.c @@ -98,6 +98,18 @@ static const struct fb_fix_screeninfo vga16fb_fix = { .accel = FB_ACCEL_NONE }; +/* + * Verify that the address to read or write is in [VGA_FB_PHYS, VGA_FB_PHYS + VGA_FB_PHYS_LEN) + * range, for ioctl(VT_RESIZE) allows a TTY to set arbitrary rows/columns values which will crash + * the kernel due to out of bounds access when trying to redraw the screen. + */ +static inline bool is_valid_iomem(const struct fb_info *info, const char __iomem *where) +{ + return info->screen_base <= where && where < info->screen_base + VGA_FB_PHYS_LEN; +} + +#define IS_SAFE(where) is_valid_iomem(info, (where)) + /* The VGA's weird architecture often requires that we read a byte and write a byte to the same location. It doesn't matter *what* byte we write, however. This is because all the action goes on behind @@ -851,7 +863,7 @@ static void vga_8planes_fillrect(struct fb_info *info, const struct fb_fillrect int x; /* we can do memset... */ - for (x = width; x > 0; --x) { + for (x = width; x > 0 && IS_SAFE(where); --x) { writeb(rect->color, where); where++; } @@ -864,7 +876,7 @@ static void vga_8planes_fillrect(struct fb_info *info, const struct fb_fillrect oldop = setop(0x18); oldsr = setsr(0xf); setmask(0x0F); - for (y = 0; y < rect->height; y++) { + for (y = 0; y < rect->height && IS_SAFE(where) && IS_SAFE(where + 1); y++) { rmw(where); rmw(where+1); where += info->fix.line_length; @@ -919,7 +931,7 @@ static void vga16fb_fillrect(struct fb_info *info, const struct fb_fillrect *rec setmask(0xff); while (height--) { - for (x = 0; x < width; x++) { + for (x = 0; x < width && IS_SAFE(dst); x++) { writeb(0, dst); dst++; } @@ -935,7 +947,7 @@ static void vga16fb_fillrect(struct fb_info *info, const struct fb_fillrect *rec setmask(0xff); while (height--) { - for (x = 0; x < width; x++) { + for (x = 0; x < width && IS_SAFE(dst); x++) { rmw(dst); dst++; } @@ -975,7 +987,7 @@ static void vga_8planes_copyarea(struct fb_info *info, const struct fb_copyarea dest = info->screen_base + dx + area->dy * info->fix.line_length; src = info->screen_base + sx + area->sy * info->fix.line_length; while (height--) { - for (x = 0; x < width; x++) { + for (x = 0; x < width && IS_SAFE(src) && IS_SAFE(dest); x++) { readb(src); writeb(0, dest); src++; @@ -991,7 +1003,7 @@ static void vga_8planes_copyarea(struct fb_info *info, const struct fb_copyarea src = info->screen_base + sx + width + (area->sy + height - 1) * info->fix.line_length; while (height--) { - for (x = 0; x < width; x++) { + for (x = 0; x < width && IS_SAFE(src - 1) && IS_SAFE(dest - 1); x++) { --src; --dest; readb(src); @@ -1065,7 +1077,7 @@ static void vga16fb_copyarea(struct fb_info *info, const struct fb_copyarea *are dst = info->screen_base + (dx/8) + dy * info->fix.line_length; src = info->screen_base + (sx/8) + sy * info->fix.line_length; while (height--) { - for (x = 0; x < width; x++) { + for (x = 0; x < width && IS_SAFE(src) && IS_SAFE(dst); x++) { readb(src); writeb(0, dst); dst++; @@ -1080,7 +1092,7 @@ static void vga16fb_copyarea(struct fb_info *info, const struct fb_copyarea *are src = info->screen_base + (sx/8) + width + (sy + height - 1) * info->fix.line_length; while (height--) { - for (x = 0; x < width; x++) { + for (x = 0; x < width && IS_SAFE(src - 1) && IS_SAFE(dst - 1); x++) { dst--; src--; readb(src); @@ -1130,13 +1142,15 @@ static void vga_8planes_imageblit(struct fb_info *info, const struct fb_image *i where = info->screen_base + dx + image->dy * info->fix.line_length; setmask(0xff); - writeb(image->bg_color, where); - readb(where); + if (IS_SAFE(where)) { + writeb(image->bg_color, where); + readb(where); + } selectmask(); setmask(image->fg_color ^ image->bg_color); setmode(0x42); setop(0x18); - for (y = 0; y < image->height; y++, where += info->fix.line_length) + for (y = 0; y < image->height && IS_SAFE(where); y++, where += info->fix.line_length) writew(transl_h[cdat[y]&0xF] | transl_l[cdat[y] >> 4], where); setmask(oldmask); setsr(oldsr); @@ -1165,14 +1179,16 @@ static void vga_imageblit_expand(struct fb_info *info, const struct fb_image *im selectmask(); setmask(0xff); - writeb(image->bg_color, where); - rmb(); - readb(where); /* fill latches */ + if (IS_SAFE(where)) { + writeb(image->bg_color, where); + rmb(); + readb(where); /* fill latches */ + } setmode(3); wmb(); for (y = 0; y < image->height; y++) { dst = where; - for (x = image->width/8; x--;) + for (x = image->width/8; x-- && IS_SAFE(dst);) writeb(*cdat++, dst++); where += info->fix.line_length; } @@ -1187,7 +1203,7 @@ static void vga_imageblit_expand(struct fb_info *info, const struct fb_image *im setmask(0xff); for (y = 0; y < image->height; y++) { dst = where; - for (x=image->width/8; x--;){ + for (x = image->width/8 && IS_SAFE(dst); x--;) { rmw(dst); setcolor(image->fg_color); selectmask(); @@ -1237,8 +1253,10 @@ static void vga_imageblit_color(struct fb_info *info, const struct fb_image *ima setcolor(*cdat); selectmask(); setmask(1 << (7 - (x % 8))); - fb_readb(dst); - fb_writeb(0, dst); + if (IS_SAFE(dst)) { + fb_readb(dst); + fb_writeb(0, dst); + } cdat++; } -- 2.18.4
WARNING: multiple messages have this Message-ID (diff)
From: Tetsuo Handa <penguin-kernel@i-love.sakura.ne.jp> To: dri-devel@lists.freedesktop.org, linux-fbdev@vger.kernel.org, linux-kernel@vger.kernel.org, "Maciej W. Rozycki" <macro@orcam.me.uk>, Daniel Vetter <daniel@ffwll.ch> Cc: jirislaby@kernel.org, b.zolnierkie@samsung.com, jani.nikula@intel.com, gregkh@linuxfoundation.org, syzkaller-bugs@googlegroups.com, colin.king@canonical.com, Linus Torvalds <torvalds@linux-foundation.org>, syzbot <syzbot+1f29e126cf461c4de3b3@syzkaller.appspotmail.com> Subject: [PATCH] video: fbdev: vga16fb: fix OOB write in vga16fb_imageblit() Date: Sat, 15 May 2021 01:19:48 +0900 [thread overview] Message-ID: <05acdda8-dc1c-5119-4326-96eed24bea0c@i-love.sakura.ne.jp> (raw) In-Reply-To: <87d928e4-b2b9-ad30-f3f0-1dfb8e4e03ed@i-love.sakura.ne.jp> syzbot is reporting that a local user with the framebuffer console can crash the kernel [1], for ioctl(VT_RESIZE) allows a TTY to set arbitrary rows/columns values regardless of amount of memory reserved for the graphical screen. ---------- #include <sys/types.h> #include <sys/stat.h> #include <fcntl.h> #include <sys/ioctl.h> #include <linux/kd.h> #include <linux/vt.h> int main(int argc, char *argv[]) { const int fd = open("/dev/char/4:1", O_RDWR); struct vt_sizes vt = { 0x4100, 2 }; ioctl(fd, KDSETMODE, KD_GRAPHICS); ioctl(fd, VT_RESIZE, &vt); ioctl(fd, KDSETMODE, KD_TEXT); return 0; } ---------- Currently it is impossible to control upper limit of rows/columns values based on amount of memory reserved for the graphical screen, for resize_screen() calls vc->vc_sw->con_resize() only if vc->vc_mode is not already KD_GRAPHICS. I don't know the reason, and this condition predates the git history. Even if it turns out to be safe to always call this callback, we will need to involve another callback via "struct fb_ops" for checking the upper limits from fbcon_resize(). As a result, we will need to modify drivers/tty/vt/vt.c drivers/video/fbdev/core/fbcon.c drivers/video/fbdev/vga16fb.c include/linux/fb.h files only for checking rows/columns values passed to ioctl(VT_RESIZE) request. Therefore, instead of introducing such a complicated callback chain, avoid this problem by simply checking whether the address to read or write is in [VGA_FB_PHYS, VGA_FB_PHYS + VGA_FB_PHYS_LEN) range. [1] https://syzkaller.appspot.com/bug?extid=1f29e126cf461c4de3b3 Reported-by: syzbot <syzbot+1f29e126cf461c4de3b3@syzkaller.appspotmail.com> Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp> Tested-by: syzbot <syzbot+1f29e126cf461c4de3b3@syzkaller.appspotmail.com> --- drivers/video/fbdev/vga16fb.c | 54 +++++++++++++++++++++++------------ 1 file changed, 36 insertions(+), 18 deletions(-) diff --git a/drivers/video/fbdev/vga16fb.c b/drivers/video/fbdev/vga16fb.c index e2757ff1c23d..13732a3b1d69 100644 --- a/drivers/video/fbdev/vga16fb.c +++ b/drivers/video/fbdev/vga16fb.c @@ -98,6 +98,18 @@ static const struct fb_fix_screeninfo vga16fb_fix = { .accel = FB_ACCEL_NONE }; +/* + * Verify that the address to read or write is in [VGA_FB_PHYS, VGA_FB_PHYS + VGA_FB_PHYS_LEN) + * range, for ioctl(VT_RESIZE) allows a TTY to set arbitrary rows/columns values which will crash + * the kernel due to out of bounds access when trying to redraw the screen. + */ +static inline bool is_valid_iomem(const struct fb_info *info, const char __iomem *where) +{ + return info->screen_base <= where && where < info->screen_base + VGA_FB_PHYS_LEN; +} + +#define IS_SAFE(where) is_valid_iomem(info, (where)) + /* The VGA's weird architecture often requires that we read a byte and write a byte to the same location. It doesn't matter *what* byte we write, however. This is because all the action goes on behind @@ -851,7 +863,7 @@ static void vga_8planes_fillrect(struct fb_info *info, const struct fb_fillrect int x; /* we can do memset... */ - for (x = width; x > 0; --x) { + for (x = width; x > 0 && IS_SAFE(where); --x) { writeb(rect->color, where); where++; } @@ -864,7 +876,7 @@ static void vga_8planes_fillrect(struct fb_info *info, const struct fb_fillrect oldop = setop(0x18); oldsr = setsr(0xf); setmask(0x0F); - for (y = 0; y < rect->height; y++) { + for (y = 0; y < rect->height && IS_SAFE(where) && IS_SAFE(where + 1); y++) { rmw(where); rmw(where+1); where += info->fix.line_length; @@ -919,7 +931,7 @@ static void vga16fb_fillrect(struct fb_info *info, const struct fb_fillrect *rec setmask(0xff); while (height--) { - for (x = 0; x < width; x++) { + for (x = 0; x < width && IS_SAFE(dst); x++) { writeb(0, dst); dst++; } @@ -935,7 +947,7 @@ static void vga16fb_fillrect(struct fb_info *info, const struct fb_fillrect *rec setmask(0xff); while (height--) { - for (x = 0; x < width; x++) { + for (x = 0; x < width && IS_SAFE(dst); x++) { rmw(dst); dst++; } @@ -975,7 +987,7 @@ static void vga_8planes_copyarea(struct fb_info *info, const struct fb_copyarea dest = info->screen_base + dx + area->dy * info->fix.line_length; src = info->screen_base + sx + area->sy * info->fix.line_length; while (height--) { - for (x = 0; x < width; x++) { + for (x = 0; x < width && IS_SAFE(src) && IS_SAFE(dest); x++) { readb(src); writeb(0, dest); src++; @@ -991,7 +1003,7 @@ static void vga_8planes_copyarea(struct fb_info *info, const struct fb_copyarea src = info->screen_base + sx + width + (area->sy + height - 1) * info->fix.line_length; while (height--) { - for (x = 0; x < width; x++) { + for (x = 0; x < width && IS_SAFE(src - 1) && IS_SAFE(dest - 1); x++) { --src; --dest; readb(src); @@ -1065,7 +1077,7 @@ static void vga16fb_copyarea(struct fb_info *info, const struct fb_copyarea *are dst = info->screen_base + (dx/8) + dy * info->fix.line_length; src = info->screen_base + (sx/8) + sy * info->fix.line_length; while (height--) { - for (x = 0; x < width; x++) { + for (x = 0; x < width && IS_SAFE(src) && IS_SAFE(dst); x++) { readb(src); writeb(0, dst); dst++; @@ -1080,7 +1092,7 @@ static void vga16fb_copyarea(struct fb_info *info, const struct fb_copyarea *are src = info->screen_base + (sx/8) + width + (sy + height - 1) * info->fix.line_length; while (height--) { - for (x = 0; x < width; x++) { + for (x = 0; x < width && IS_SAFE(src - 1) && IS_SAFE(dst - 1); x++) { dst--; src--; readb(src); @@ -1130,13 +1142,15 @@ static void vga_8planes_imageblit(struct fb_info *info, const struct fb_image *i where = info->screen_base + dx + image->dy * info->fix.line_length; setmask(0xff); - writeb(image->bg_color, where); - readb(where); + if (IS_SAFE(where)) { + writeb(image->bg_color, where); + readb(where); + } selectmask(); setmask(image->fg_color ^ image->bg_color); setmode(0x42); setop(0x18); - for (y = 0; y < image->height; y++, where += info->fix.line_length) + for (y = 0; y < image->height && IS_SAFE(where); y++, where += info->fix.line_length) writew(transl_h[cdat[y]&0xF] | transl_l[cdat[y] >> 4], where); setmask(oldmask); setsr(oldsr); @@ -1165,14 +1179,16 @@ static void vga_imageblit_expand(struct fb_info *info, const struct fb_image *im selectmask(); setmask(0xff); - writeb(image->bg_color, where); - rmb(); - readb(where); /* fill latches */ + if (IS_SAFE(where)) { + writeb(image->bg_color, where); + rmb(); + readb(where); /* fill latches */ + } setmode(3); wmb(); for (y = 0; y < image->height; y++) { dst = where; - for (x = image->width/8; x--;) + for (x = image->width/8; x-- && IS_SAFE(dst);) writeb(*cdat++, dst++); where += info->fix.line_length; } @@ -1187,7 +1203,7 @@ static void vga_imageblit_expand(struct fb_info *info, const struct fb_image *im setmask(0xff); for (y = 0; y < image->height; y++) { dst = where; - for (x=image->width/8; x--;){ + for (x = image->width/8 && IS_SAFE(dst); x--;) { rmw(dst); setcolor(image->fg_color); selectmask(); @@ -1237,8 +1253,10 @@ static void vga_imageblit_color(struct fb_info *info, const struct fb_image *ima setcolor(*cdat); selectmask(); setmask(1 << (7 - (x % 8))); - fb_readb(dst); - fb_writeb(0, dst); + if (IS_SAFE(dst)) { + fb_readb(dst); + fb_writeb(0, dst); + } cdat++; } -- 2.18.4
next prev parent reply other threads:[~2021-05-14 16:19 UTC|newest] Thread overview: 63+ messages / expand[flat|nested] mbox.gz Atom feed top 2020-05-08 7:07 BUG: unable to handle kernel paging request in vga16fb_imageblit (2) syzbot 2020-05-08 7:07 ` syzbot 2020-05-08 7:07 ` syzbot 2021-05-01 20:31 ` [syzbot] " syzbot 2021-05-01 20:31 ` syzbot 2021-05-02 1:53 ` syzbot 2021-05-02 1:53 ` syzbot 2021-05-03 13:41 ` Tetsuo Handa 2021-05-03 13:41 ` Tetsuo Handa 2021-05-07 11:09 ` Tetsuo Handa 2021-05-14 16:19 ` Tetsuo Handa [this message] 2021-05-14 16:19 ` [PATCH] video: fbdev: vga16fb: fix OOB write in vga16fb_imageblit() Tetsuo Handa 2021-05-14 17:29 ` Linus Torvalds 2021-05-14 17:29 ` Linus Torvalds 2021-05-14 17:37 ` Linus Torvalds 2021-05-14 17:37 ` Linus Torvalds 2021-05-14 18:23 ` Linus Torvalds 2021-05-14 18:23 ` Linus Torvalds 2021-05-14 20:25 ` Maciej W. Rozycki 2021-05-14 20:25 ` Maciej W. Rozycki 2021-05-14 20:32 ` Linus Torvalds 2021-05-14 20:32 ` Linus Torvalds 2021-05-14 21:10 ` Linus Torvalds 2021-05-14 21:10 ` Linus Torvalds 2021-05-15 7:43 ` [PATCH v2] tty: vt: always invoke vc->vc_sw->con_resize callback Tetsuo Handa 2021-05-15 7:43 ` Tetsuo Handa 2021-05-15 16:21 ` Maciej W. Rozycki 2021-05-15 16:21 ` Maciej W. Rozycki 2021-05-15 16:32 ` Maciej W. Rozycki 2021-05-15 16:32 ` Maciej W. Rozycki 2021-05-15 16:41 ` Linus Torvalds 2021-05-15 16:41 ` Linus Torvalds 2021-05-17 13:13 ` Daniel Vetter 2021-05-17 13:13 ` Daniel Vetter 2021-05-15 16:11 ` [PATCH] video: fbdev: vga16fb: fix OOB write in vga16fb_imageblit() Maciej W. Rozycki 2021-05-15 16:11 ` Maciej W. Rozycki 2021-05-17 13:07 ` Daniel Vetter 2021-05-17 13:07 ` Daniel Vetter 2021-05-17 13:10 ` Daniel Vetter 2021-05-17 13:10 ` Daniel Vetter 2021-05-15 0:45 ` Tetsuo Handa 2021-05-15 0:45 ` Tetsuo Handa -- strict thread matches above, loose matches on Subject: below -- 2020-10-06 8:18 BUG: unable to handle kernel paging request in cfb_imageblit syzbot 2020-10-06 8:18 ` syzbot 2020-10-06 8:18 ` syzbot 2020-12-18 15:26 ` syzbot 2020-12-18 15:26 ` syzbot 2020-12-18 15:27 ` Dmitry Vyukov 2020-12-18 15:27 ` Dmitry Vyukov 2020-05-12 6:55 BUG: unable to handle kernel paging request in bitfill_aligned syzbot 2020-05-12 6:55 ` syzbot 2020-05-12 6:55 ` syzbot 2019-12-27 7:13 BUG: unable to handle kernel paging request in vga16fb_imageblit syzbot 2019-12-27 7:13 ` syzbot 2019-12-27 7:13 ` syzbot 2019-12-10 16:38 BUG: unable to handle kernel paging request in sys_imageblit syzbot 2019-12-10 16:38 ` syzbot 2019-12-10 16:38 ` syzbot 2020-06-19 4:56 ` syzbot 2020-06-19 4:56 ` syzbot 2020-06-19 4:56 ` syzbot 2013-02-19 17:33 BUG: unable to handle kernel paging request at ffffc90000669000, IP: [<ffffffff8139d84a>] bitfill_unaligned+0x10a/0x1a0 Tommi Rantala 2013-02-19 17:33 ` BUG: unable to handle kernel paging request at ffffc90000669000, IP: [<ffffffff8139d84a>] bitfill_un Tommi Rantala
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=05acdda8-dc1c-5119-4326-96eed24bea0c@i-love.sakura.ne.jp \ --to=penguin-kernel@i-love.sakura.ne.jp \ --cc=adaplas@gmail.com \ --cc=b.zolnierkie@samsung.com \ --cc=colin.king@canonical.com \ --cc=daniel@ffwll.ch \ --cc=dri-devel@lists.freedesktop.org \ --cc=gregkh@linuxfoundation.org \ --cc=jani.nikula@intel.com \ --cc=jirislaby@kernel.org \ --cc=linux-fbdev@vger.kernel.org \ --cc=linux-kernel@vger.kernel.org \ --cc=macro@orcam.me.uk \ --cc=syzbot+1f29e126cf461c4de3b3@syzkaller.appspotmail.com \ --cc=syzkaller-bugs@googlegroups.com \ --cc=torvalds@linux-foundation.org \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.