Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Content-Type: multipart/mixed; boundary="------------9c4s0be1o5GSXHC3RDDkeezm"
Message-ID: <8ba678da-207e-ea00-a56d-736a2184e69e@colorfullife.com>
Date:   Sat, 6 Nov 2021 15:42:07 +0100
MIME-Version: 1.0
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101
 Thunderbird/91.2.0
Subject: Re: [RFC] shm: extend forced shm destroy to support objects from
 several IPC nses (simplified)
Content-Language: en-US
To:     "Eric W. Biederman" <ebiederm@xmission.com>
Cc:     Alexander Mikhalitsyn <alexander.mikhalitsyn@virtuozzo.com>,
        linux-kernel@vger.kernel.org,
        Andrew Morton <akpm@linux-foundation.org>,
        Davidlohr Bueso <dave@stgolabs.net>,
        Greg KH <gregkh@linuxfoundation.org>,
        Andrei Vagin <avagin@gmail.com>,
        Pavel Tikhomirov <ptikhomirov@virtuozzo.com>,
        Vasily Averin <vvs@virtuozzo.com>,
        Alexander Mikhalitsyn <alexander@mihalicyn.com>,
        stable@vger.kernel.org
References: <20211027224348.611025-1-alexander.mikhalitsyn@virtuozzo.com>
 <20211027224348.611025-3-alexander.mikhalitsyn@virtuozzo.com>
 <87wnlmqyw4.fsf@disp2133>
 <61ca7331-4a86-2bf6-9ccb-50f6a7824e12@colorfullife.com>
 <87lf22qob5.fsf_-_@disp2133>
From:   Manfred Spraul <manfred@colorfullife.com>
In-Reply-To: <87lf22qob5.fsf_-_@disp2133>
Precedence: bulk

This is a multi-part message in MIME format.
--------------9c4s0be1o5GSXHC3RDDkeezm
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 8bit

Hello together,

On 11/5/21 22:34, Eric W. Biederman wrote:
> I have to dash so this is short.
>
> This is what I am thinking this change should look like.
>
> I am not certain this is truly reviewable as a single change, so I will
> break it into a couple of smaller ones next time I get the chance.

I think we should concentrate to check the commit from Alexander.

What I did is to write two additional stress test apps - and now I'm 
able to trigger the use-after-free bug.

It is much simpler, the exclusion of exit_shm() and IPC_RMID didn't work 
- regardless if your approach or the approach from Alexander/myself is used.

>   
> +static inline void shm_clist_del(struct shmid_kernel *shp)
> +{
> +	struct task_struct *creator;
> +
> +	rcu_read_lock();
> +	creator = rcu_dereference(shp->shm_creator);
> +	if (creator) {
> +		task_lock(creator);
> +		list_del(&shp->shm_clist);
> +		task_unlock(creator);
> +	}
> +	rcu_read_unlock();
> +}
> +

shm_clist_del() only synchronizes against exit_shm() when shm_creator is 
not NULL.


> +		list_del(&shp->shm_clist);
> +		rcu_assign_pointer(shp->shm_creator, NULL);
> +

We set shm_creator to NULL -> no more synchronization.

Now IPC_RMID can run in parallel - regardless if we test for 
list_empty() or shm_creator.

> +
> +		/* Guarantee shp lives after task_lock is dropped */
> +		ipc_getref(&shp->shm_perm);
> +

task_lock() doesn't help: As soon as shm_creator is set to NULL, 
IPC_RMID won't acquire task_lock() anymore.

Thus shp can disappear before we arrive at this ipc_getref.

[Yes, I think I have introduced this bug. ]

Corrected version attached.


I'll reboot and retest the patch, then I would send it to akpm as 
replacement for current patch in mmotm.

--

     Manfred

--------------9c4s0be1o5GSXHC3RDDkeezm
Content-Type: text/x-patch; charset=UTF-8;
 name="0001-shm-extend-forced-shm-destroy-to-support-objects-fro.patch"
Content-Disposition: attachment;
 filename*0="0001-shm-extend-forced-shm-destroy-to-support-objects-fro.pa";
 filename*1="tch"
Content-Transfer-Encoding: base64

RnJvbSBkZjAyNGQ2MjdiZWIzZjIzZjJjNWI3OTVlMWFlODQxYTJkZDZmZjQ5IE1vbiBTZXAg
MTcgMDA6MDA6MDAgMjAwMQpGcm9tOiBBbGV4YW5kZXIgTWlraGFsaXRzeW4gPGFsZXhhbmRl
ci5taWtoYWxpdHN5bkB2aXJ0dW96em8uY29tPgpEYXRlOiBUaHUsIDI4IE9jdCAyMDIxIDAx
OjQzOjQ4ICswMzAwClN1YmplY3Q6IFtQQVRDSF0gc2htOiBleHRlbmQgZm9yY2VkIHNobSBk
ZXN0cm95IHRvIHN1cHBvcnQgb2JqZWN0cyBmcm9tCiBzZXZlcmFsIElQQyBuc2VzCgpDdXJy
ZW50bHksIGV4aXRfc2htIGZ1bmN0aW9uIG5vdCBkZXNpZ25lZCB0byB3b3JrIHByb3Blcmx5
IHdoZW4KdGFzay0+c3lzdnNobS5zaG1fY2xpc3QgaG9sZHMgc2htIG9iamVjdHMgZnJvbSBk
aWZmZXJlbnQgSVBDIG5hbWVzcGFjZXMuCgpUaGlzIGlzIGEgcmVhbCBwYWluIHdoZW4gc3lz
Y3RsIGtlcm5lbC5zaG1fcm1pZF9mb3JjZWQgPSAxLCBiZWNhdXNlCml0IGxlYWRzIHRvIHVz
ZS1hZnRlci1mcmVlIChyZXByb2R1Y2VyIGV4aXN0cykuCgpUaGF0IHBhcnRpY3VsYXIgcGF0
Y2ggaXMgYXR0ZW1wdCB0byBmaXggdGhlIHByb2JsZW0gYnkgZXh0ZW5kaW5nIGV4aXRfc2ht
Cm1lY2hhbmlzbSB0byBoYW5kbGUgc2htJ3MgZGVzdHJveSBmcm9tIHNldmVyYWwgSVBDIG5z
J2VzLgoKVG8gYWNoaWV2ZSB0aGF0IHdlIGRvIHNldmVyYWwgdGhpbmdzOgoxLiBhZGQgbmFt
ZXNwYWNlIChub24tcmVmY291bnRlZCkgcG9pbnRlciB0byB0aGUgc3RydWN0IHNobWlkX2tl
cm5lbAoyLiBkdXJpbmcgbmV3IHNobSBvYmplY3QgY3JlYXRpb24gKG5ld3NlZygpL3NobWdl
dCBzeXNjYWxsKSB3ZSBpbml0aWFsaXplCnRoaXMgcG9pbnRlciBieSBjdXJyZW50IHRhc2sg
SVBDIG5zCjMuIGV4aXRfc2htKCkgZnVsbHkgcmV3b3JrZWQgc3VjaCB0aGF0IGl0IHRyYXZl
cnNlcyBvdmVyIGFsbApzaHAncyBpbiB0YXNrLT5zeXN2c2htLnNobV9jbGlzdCBhbmQgZ2V0
cyBJUEMgbmFtZXNwYWNlIG5vdApmcm9tIGN1cnJlbnQgdGFzayBhcyBpdCB3YXMgYmVmb3Jl
IGJ1dCBmcm9tIHNocCdzIG9iamVjdCBpdHNlbGYsIHRoZW4KY2FsbCBzaG1fZGVzdHJveShz
aHAsIG5zKS4KCk5vdGUuIFdlIG5lZWQgdG8gYmUgcmVhbGx5IGNhcmVmdWwgaGVyZSwgYmVj
YXVzZSBhcyBpdCB3YXMgc2FpZCBiZWZvcmUKKDEpLCBvdXIgcG9pbnRlciB0byBJUEMgbnMg
bm9uLXJlZmNudCdlZC4gVG8gYmUgb24gdGhlIHNhZmUgc2lkZSB3ZSB1c2luZwpzcGVjaWFs
IGhlbHBlciBnZXRfaXBjX25zX25vdF96ZXJvKCkgd2hpY2ggYWxsb3dzIHRvIGdldCBJUEMg
bnMgcmVmY291bnRlcgpvbmx5IGlmIElQQyBucyBub3QgaW4gdGhlICJzdGF0ZSBvZiBkZXN0
cnVjdGlvbiIuCgpRL0EKClE6IFdoeSB3ZSBjYW4gYWNjZXNzIHNocC0+bnMgbWVtb3J5IHVz
aW5nIG5vbi1yZWZjb3VudGVkIHBvaW50ZXI/CkE6IEJlY2F1c2Ugc2hwIG9iamVjdCBsaWZl
dGltZSBpcyBhbHdheXMgc2hvcnRoZXIKdGhhbiBJUEMgbmFtZXNwYWNlIGxpZmV0aW1lLCBz
bywgaWYgd2UgZ2V0IHNocCBvYmplY3QgZnJvbSB0aGUKdGFzay0+c3lzdnNobS5zaG1fY2xp
c3Qgd2hpbGUgaG9sZGluZyB0YXNrX2xvY2sodGFzaykgbm9ib2R5IGNhbgpzdGVhbCBvdXIg
bmFtZXNwYWNlLgoKUTogRG9lcyB0aGlzIHBhdGNoIGNoYW5nZSBzZW1hbnRpY3Mgb2YgdW5z
aGFyZS9zZXRucy9jbG9uZSBzeXNjYWxscz8KQTogTm90LiBJdCdzIGp1c3QgZml4ZXMgbm9u
LWNvdmVyZWQgY2FzZSB3aGVuIHByb2Nlc3MgbWF5IGxlYXZlCklQQyBuYW1lc3BhY2Ugd2l0
aG91dCBnZXR0aW5nIHRhc2stPnN5c3ZzaG0uc2htX2NsaXN0IGxpc3QgY2xlYW5lZCB1cC4K
CkZpeGVzOiBhYjYwMmY3OTkxNSAoInNobTogbWFrZSBleGl0X3NobSB3b3JrIHByb3BvcnRp
b25hbCB0byB0YXNrIGFjdGl2aXR5IikKCkNjOiAiRXJpYyBXLiBCaWVkZXJtYW4iIDxlYmll
ZGVybUB4bWlzc2lvbi5jb20+CkNjOiBBbmRyZXcgTW9ydG9uIDxha3BtQGxpbnV4LWZvdW5k
YXRpb24ub3JnPgpDYzogRGF2aWRsb2hyIEJ1ZXNvIDxkYXZlQHN0Z29sYWJzLm5ldD4KQ2M6
IEdyZWcgS0ggPGdyZWdraEBsaW51eGZvdW5kYXRpb24ub3JnPgpDYzogQW5kcmVpIFZhZ2lu
IDxhdmFnaW5AZ21haWwuY29tPgpDYzogUGF2ZWwgVGlraG9taXJvdiA8cHRpa2hvbWlyb3ZA
dmlydHVvenpvLmNvbT4KQ2M6IFZhc2lseSBBdmVyaW4gPHZ2c0B2aXJ0dW96em8uY29tPgpD
YzogTWFuZnJlZCBTcHJhdWwgPG1hbmZyZWRAY29sb3JmdWxsaWZlLmNvbT4KQ2M6IEFsZXhh
bmRlciBNaWtoYWxpdHN5biA8YWxleGFuZGVyQG1paGFsaWN5bi5jb20+CkNjOiBzdGFibGVA
dmdlci5rZXJuZWwub3JnCkNvLWRldmVsb3BlZC1ieTogTWFuZnJlZCBTcHJhdWwgPG1hbmZy
ZWRAY29sb3JmdWxsaWZlLmNvbT4KU2lnbmVkLW9mZi1ieTogTWFuZnJlZCBTcHJhdWwgPG1h
bmZyZWRAY29sb3JmdWxsaWZlLmNvbT4KU2lnbmVkLW9mZi1ieTogQWxleGFuZGVyIE1pa2hh
bGl0c3luIDxhbGV4YW5kZXIubWlraGFsaXRzeW5AdmlydHVvenpvLmNvbT4KLSBjb21tZW50
IGNvcnJlY3Rpb25zLCBzaG1fY2xpc3RfbG9jayB3YXMgcmVwbGFjZWQgYnkgdGFza19sb2Nr
KCkKLSBpZi9lbHNlIGV4Y2hhbmdlZCBhcyByZWNvbW1lbmRlZCBieSBFcmljCi0gYnVnZml4
IGZvciBzaHAgcmVmY291bnRpbmcuIEFjdHVhbGx5LCB0aGlzIHByb2JhYmx5IHRoZSByZWFs
CiAgdXNlLWFmdGVyLWZyZWUgYnVnLCB0aGUgY3VycmVudCBjb2RlIGNvbnRhaW5zIGEgdXNl
LWFmdGVyLWZyZWUgZXZlbgogIHdpdGhvdXQgdXNpbmcgbmFtZXNwYWNlcy4KLSBhZGQgcmN1
X3JlYWRfbG9jaygpIGludG8gc2htX2NsaXN0X3JtKCksIHRvIHByb3RlY3QgYWdhaW5zdAog
IGEgdXNlLWFmdGVyLWZyZWUgZm9yIHNobV9jcmVhdG9yLT5hbGxvY19sb2NrLgpTaWduZWQt
b2ZmLWJ5OiBNYW5mcmVkIFNwcmF1bCA8bWFuZnJlZEBjb2xvcmZ1bGxpZmUuY29tPgotLS0K
IGluY2x1ZGUvbGludXgvaXBjX25hbWVzcGFjZS5oIHwgIDE1ICsrKwogaW5jbHVkZS9saW51
eC9zY2hlZC90YXNrLmggICAgfCAgIDIgKy0KIGlwYy9zaG0uYyAgICAgICAgICAgICAgICAg
ICAgIHwgMTg2ICsrKysrKysrKysrKysrKysrKysrKysrKystLS0tLS0tLS0KIDMgZmlsZXMg
Y2hhbmdlZCwgMTU2IGluc2VydGlvbnMoKyksIDQ3IGRlbGV0aW9ucygtKQoKZGlmZiAtLWdp
dCBhL2luY2x1ZGUvbGludXgvaXBjX25hbWVzcGFjZS5oIGIvaW5jbHVkZS9saW51eC9pcGNf
bmFtZXNwYWNlLmgKaW5kZXggMDVlMjI3NzBhZjUxLi5iNzUzOTVlYzhkNTIgMTAwNjQ0Ci0t
LSBhL2luY2x1ZGUvbGludXgvaXBjX25hbWVzcGFjZS5oCisrKyBiL2luY2x1ZGUvbGludXgv
aXBjX25hbWVzcGFjZS5oCkBAIC0xMzEsNiArMTMxLDE2IEBAIHN0YXRpYyBpbmxpbmUgc3Ry
dWN0IGlwY19uYW1lc3BhY2UgKmdldF9pcGNfbnMoc3RydWN0IGlwY19uYW1lc3BhY2UgKm5z
KQogCXJldHVybiBuczsKIH0KIAorc3RhdGljIGlubGluZSBzdHJ1Y3QgaXBjX25hbWVzcGFj
ZSAqZ2V0X2lwY19uc19ub3RfemVybyhzdHJ1Y3QgaXBjX25hbWVzcGFjZSAqbnMpCit7CisJ
aWYgKG5zKSB7CisJCWlmIChyZWZjb3VudF9pbmNfbm90X3plcm8oJm5zLT5ucy5jb3VudCkp
CisJCQlyZXR1cm4gbnM7CisJfQorCisJcmV0dXJuIE5VTEw7Cit9CisKIGV4dGVybiB2b2lk
IHB1dF9pcGNfbnMoc3RydWN0IGlwY19uYW1lc3BhY2UgKm5zKTsKICNlbHNlCiBzdGF0aWMg
aW5saW5lIHN0cnVjdCBpcGNfbmFtZXNwYWNlICpjb3B5X2lwY3ModW5zaWduZWQgbG9uZyBm
bGFncywKQEAgLTE0Nyw2ICsxNTcsMTEgQEAgc3RhdGljIGlubGluZSBzdHJ1Y3QgaXBjX25h
bWVzcGFjZSAqZ2V0X2lwY19ucyhzdHJ1Y3QgaXBjX25hbWVzcGFjZSAqbnMpCiAJcmV0dXJu
IG5zOwogfQogCitzdGF0aWMgaW5saW5lIHN0cnVjdCBpcGNfbmFtZXNwYWNlICpnZXRfaXBj
X25zX25vdF96ZXJvKHN0cnVjdCBpcGNfbmFtZXNwYWNlICpucykKK3sKKwlyZXR1cm4gbnM7
Cit9CisKIHN0YXRpYyBpbmxpbmUgdm9pZCBwdXRfaXBjX25zKHN0cnVjdCBpcGNfbmFtZXNw
YWNlICpucykKIHsKIH0KZGlmZiAtLWdpdCBhL2luY2x1ZGUvbGludXgvc2NoZWQvdGFzay5o
IGIvaW5jbHVkZS9saW51eC9zY2hlZC90YXNrLmgKaW5kZXggYmE4OGE2OTg3NDAwLi4wNThk
N2YzNzFlMjUgMTAwNjQ0Ci0tLSBhL2luY2x1ZGUvbGludXgvc2NoZWQvdGFzay5oCisrKyBi
L2luY2x1ZGUvbGludXgvc2NoZWQvdGFzay5oCkBAIC0xNTgsNyArMTU4LDcgQEAgc3RhdGlj
IGlubGluZSBzdHJ1Y3Qgdm1fc3RydWN0ICp0YXNrX3N0YWNrX3ZtX2FyZWEoY29uc3Qgc3Ry
dWN0IHRhc2tfc3RydWN0ICp0KQogICogUHJvdGVjdHMgLT5mcywgLT5maWxlcywgLT5tbSwg
LT5ncm91cF9pbmZvLCAtPmNvbW0sIGtleXJpbmcKICAqIHN1YnNjcmlwdGlvbnMgYW5kIHN5
bmNocm9uaXNlcyB3aXRoIHdhaXQ0KCkuICBBbHNvIHVzZWQgaW4gcHJvY2ZzLiAgQWxzbwog
ICogcGlucyB0aGUgZmluYWwgcmVsZWFzZSBvZiB0YXNrLmlvX2NvbnRleHQuICBBbHNvIHBy
b3RlY3RzIC0+Y3B1c2V0IGFuZAotICogLT5jZ3JvdXAuc3Vic3lzW10uIEFuZCAtPnZmb3Jr
X2RvbmUuCisgKiAtPmNncm91cC5zdWJzeXNbXS4gQW5kIC0+dmZvcmtfZG9uZS4gQW5kIC0+
c3lzdnNobS5zaG1fY2xpc3QuCiAgKgogICogTmVzdHMgYm90aCBpbnNpZGUgYW5kIG91dHNp
ZGUgb2YgcmVhZF9sb2NrKCZ0YXNrbGlzdF9sb2NrKS4KICAqIEl0IG11c3Qgbm90IGJlIG5l
c3RlZCB3aXRoIHdyaXRlX2xvY2tfaXJxKCZ0YXNrbGlzdF9sb2NrKSwKZGlmZiAtLWdpdCBh
L2lwYy9zaG0uYyBiL2lwYy9zaG0uYwppbmRleCBhYjc0OWJlNmQ4YjcuLjkzOWZhMmRlNGRl
NyAxMDA2NDQKLS0tIGEvaXBjL3NobS5jCisrKyBiL2lwYy9zaG0uYwpAQCAtNjIsOSArNjIs
MTggQEAgc3RydWN0IHNobWlkX2tlcm5lbCAvKiBwcml2YXRlIHRvIHRoZSBrZXJuZWwgKi8K
IAlzdHJ1Y3QgcGlkCQkqc2htX2xwcmlkOwogCXN0cnVjdCB1Y291bnRzCQkqbWxvY2tfdWNv
dW50czsKIAotCS8qIFRoZSB0YXNrIGNyZWF0ZWQgdGhlIHNobSBvYmplY3QuICBOVUxMIGlm
IHRoZSB0YXNrIGlzIGRlYWQuICovCisJLyoKKwkgKiBUaGUgdGFzayBjcmVhdGVkIHRoZSBz
aG0gb2JqZWN0LCBmb3IKKwkgKiB0YXNrX2xvY2soc2hwLT5zaG1fY3JlYXRvcikKKwkgKi8K
IAlzdHJ1Y3QgdGFza19zdHJ1Y3QJKnNobV9jcmVhdG9yOwotCXN0cnVjdCBsaXN0X2hlYWQJ
c2htX2NsaXN0OwkvKiBsaXN0IGJ5IGNyZWF0b3IgKi8KKworCS8qCisJICogTGlzdCBieSBj
cmVhdG9yLiB0YXNrX2xvY2soLT5zaG1fY3JlYXRvcikgcmVxdWlyZWQgZm9yIHJlYWQvd3Jp
dGUuCisJICogSWYgbGlzdF9lbXB0eSgpLCB0aGVuIHRoZSBjcmVhdG9yIGlzIGRlYWQgYWxy
ZWFkeS4KKwkgKi8KKwlzdHJ1Y3QgbGlzdF9oZWFkCXNobV9jbGlzdDsKKwlzdHJ1Y3QgaXBj
X25hbWVzcGFjZQkqbnM7CiB9IF9fcmFuZG9taXplX2xheW91dDsKIAogLyogc2htX21vZGUg
dXBwZXIgYnl0ZSBmbGFncyAqLwpAQCAtMTE1LDYgKzEyNCw3IEBAIHN0YXRpYyB2b2lkIGRv
X3NobV9ybWlkKHN0cnVjdCBpcGNfbmFtZXNwYWNlICpucywgc3RydWN0IGtlcm5faXBjX3Bl
cm0gKmlwY3ApCiAJc3RydWN0IHNobWlkX2tlcm5lbCAqc2hwOwogCiAJc2hwID0gY29udGFp
bmVyX29mKGlwY3AsIHN0cnVjdCBzaG1pZF9rZXJuZWwsIHNobV9wZXJtKTsKKwlXQVJOX09O
KG5zICE9IHNocC0+bnMpOwogCiAJaWYgKHNocC0+c2htX25hdHRjaCkgewogCQlzaHAtPnNo
bV9wZXJtLm1vZGUgfD0gU0hNX0RFU1Q7CkBAIC0yMjUsMTAgKzIzNSw0MyBAQCBzdGF0aWMg
dm9pZCBzaG1fcmN1X2ZyZWUoc3RydWN0IHJjdV9oZWFkICpoZWFkKQogCWtmcmVlKHNocCk7
CiB9CiAKLXN0YXRpYyBpbmxpbmUgdm9pZCBzaG1fcm1pZChzdHJ1Y3QgaXBjX25hbWVzcGFj
ZSAqbnMsIHN0cnVjdCBzaG1pZF9rZXJuZWwgKnMpCisvKgorICogSXQgaGFzIHRvIGJlIGNh
bGxlZCB3aXRoIHNocCBsb2NrZWQuCisgKiBJdCBtdXN0IGJlIGNhbGxlZCBiZWZvcmUgaXBj
X3JtaWQoKQorICovCitzdGF0aWMgaW5saW5lIHZvaWQgc2htX2NsaXN0X3JtKHN0cnVjdCBz
aG1pZF9rZXJuZWwgKnNocCkKK3sKKwlzdHJ1Y3QgdGFza19zdHJ1Y3QgKmNyZWF0b3I7CisK
KwkvKiBlbnN1cmUgdGhhdCBzaG1fY3JlYXRvciBkb2VzIG5vdCBkaXNhcHBlYXIgKi8KKwly
Y3VfcmVhZF9sb2NrKCk7CisKKwkvKgorCSAqIEEgY29uY3VycmVudCBleGl0X3NobSBtYXkg
ZG8gYSBsaXN0X2RlbF9pbml0KCkgYXMgd2VsbC4KKwkgKiBKdXN0IGRvIG5vdGhpbmcgaWYg
ZXhpdF9zaG0gYWxyZWFkeSBkaWQgdGhlIHdvcmsKKwkgKi8KKwlpZiAoIWxpc3RfZW1wdHko
JnNocC0+c2htX2NsaXN0KSkgeworCQkvKgorCQkgKiBzaHAtPnNobV9jcmVhdG9yIGlzIGd1
YXJhbnRlZWQgdG8gYmUgdmFsaWQgKm9ubHkqCisJCSAqIGlmIHNocC0+c2htX2NsaXN0IGlz
IG5vdCBlbXB0eS4KKwkJICovCisJCWNyZWF0b3IgPSBzaHAtPnNobV9jcmVhdG9yOworCisJ
CXRhc2tfbG9jayhjcmVhdG9yKTsKKwkJLyoKKwkJICogbGlzdF9kZWxfaW5pdCgpIGlzIGEg
bm9wIGlmIHRoZSBlbnRyeSB3YXMgYWxyZWFkeSByZW1vdmVkCisJCSAqIGZyb20gdGhlIGxp
c3QuCisJCSAqLworCQlsaXN0X2RlbF9pbml0KCZzaHAtPnNobV9jbGlzdCk7CisJCXRhc2tf
dW5sb2NrKGNyZWF0b3IpOworCX0KKwlyY3VfcmVhZF91bmxvY2soKTsKK30KKworc3RhdGlj
IGlubGluZSB2b2lkIHNobV9ybWlkKHN0cnVjdCBzaG1pZF9rZXJuZWwgKnMpCiB7Ci0JbGlz
dF9kZWwoJnMtPnNobV9jbGlzdCk7Ci0JaXBjX3JtaWQoJnNobV9pZHMobnMpLCAmcy0+c2ht
X3Blcm0pOworCXNobV9jbGlzdF9ybShzKTsKKwlpcGNfcm1pZCgmc2htX2lkcyhzLT5ucyks
ICZzLT5zaG1fcGVybSk7CiB9CiAKIApAQCAtMjgzLDcgKzMyNiw3IEBAIHN0YXRpYyB2b2lk
IHNobV9kZXN0cm95KHN0cnVjdCBpcGNfbmFtZXNwYWNlICpucywgc3RydWN0IHNobWlkX2tl
cm5lbCAqc2hwKQogCXNobV9maWxlID0gc2hwLT5zaG1fZmlsZTsKIAlzaHAtPnNobV9maWxl
ID0gTlVMTDsKIAlucy0+c2htX3RvdCAtPSAoc2hwLT5zaG1fc2Vnc3ogKyBQQUdFX1NJWkUg
LSAxKSA+PiBQQUdFX1NISUZUOwotCXNobV9ybWlkKG5zLCBzaHApOworCXNobV9ybWlkKHNo
cCk7CiAJc2htX3VubG9jayhzaHApOwogCWlmICghaXNfZmlsZV9odWdlcGFnZXMoc2htX2Zp
bGUpKQogCQlzaG1lbV9sb2NrKHNobV9maWxlLCAwLCBzaHAtPm1sb2NrX3Vjb3VudHMpOwpA
QCAtMzA2LDEwICszNDksMTAgQEAgc3RhdGljIHZvaWQgc2htX2Rlc3Ryb3koc3RydWN0IGlw
Y19uYW1lc3BhY2UgKm5zLCBzdHJ1Y3Qgc2htaWRfa2VybmVsICpzaHApCiAgKgogICogMikg
c3lzY3RsIGtlcm5lbC5zaG1fcm1pZF9mb3JjZWQgaXMgc2V0IHRvIDEuCiAgKi8KLXN0YXRp
YyBib29sIHNobV9tYXlfZGVzdHJveShzdHJ1Y3QgaXBjX25hbWVzcGFjZSAqbnMsIHN0cnVj
dCBzaG1pZF9rZXJuZWwgKnNocCkKK3N0YXRpYyBib29sIHNobV9tYXlfZGVzdHJveShzdHJ1
Y3Qgc2htaWRfa2VybmVsICpzaHApCiB7CiAJcmV0dXJuIChzaHAtPnNobV9uYXR0Y2ggPT0g
MCkgJiYKLQkgICAgICAgKG5zLT5zaG1fcm1pZF9mb3JjZWQgfHwKKwkgICAgICAgKHNocC0+
bnMtPnNobV9ybWlkX2ZvcmNlZCB8fAogCQkoc2hwLT5zaG1fcGVybS5tb2RlICYgU0hNX0RF
U1QpKTsKIH0KIApAQCAtMzQwLDcgKzM4Myw3IEBAIHN0YXRpYyB2b2lkIHNobV9jbG9zZShz
dHJ1Y3Qgdm1fYXJlYV9zdHJ1Y3QgKnZtYSkKIAlpcGNfdXBkYXRlX3BpZCgmc2hwLT5zaG1f
bHByaWQsIHRhc2tfdGdpZChjdXJyZW50KSk7CiAJc2hwLT5zaG1fZHRpbSA9IGt0aW1lX2dl
dF9yZWFsX3NlY29uZHMoKTsKIAlzaHAtPnNobV9uYXR0Y2gtLTsKLQlpZiAoc2htX21heV9k
ZXN0cm95KG5zLCBzaHApKQorCWlmIChzaG1fbWF5X2Rlc3Ryb3koc2hwKSkKIAkJc2htX2Rl
c3Ryb3kobnMsIHNocCk7CiAJZWxzZQogCQlzaG1fdW5sb2NrKHNocCk7CkBAIC0zNjEsMTAg
KzQwNCwxMCBAQCBzdGF0aWMgaW50IHNobV90cnlfZGVzdHJveV9vcnBoYW5lZChpbnQgaWQs
IHZvaWQgKnAsIHZvaWQgKmRhdGEpCiAJICoKIAkgKiBBcyBzaHAtPiogYXJlIGNoYW5nZWQg
dW5kZXIgcndzZW0sIGl0J3Mgc2FmZSB0byBza2lwIHNocCBsb2NraW5nLgogCSAqLwotCWlm
IChzaHAtPnNobV9jcmVhdG9yICE9IE5VTEwpCisJaWYgKCFsaXN0X2VtcHR5KCZzaHAtPnNo
bV9jbGlzdCkpCiAJCXJldHVybiAwOwogCi0JaWYgKHNobV9tYXlfZGVzdHJveShucywgc2hw
KSkgeworCWlmIChzaG1fbWF5X2Rlc3Ryb3koc2hwKSkgewogCQlzaG1fbG9ja19ieV9wdHIo
c2hwKTsKIAkJc2htX2Rlc3Ryb3kobnMsIHNocCk7CiAJfQpAQCAtMzgyLDQ4ICs0MjUsOTQg
QEAgdm9pZCBzaG1fZGVzdHJveV9vcnBoYW5lZChzdHJ1Y3QgaXBjX25hbWVzcGFjZSAqbnMp
CiAvKiBMb2NraW5nIGFzc3VtZXMgdGhpcyB3aWxsIG9ubHkgYmUgY2FsbGVkIHdpdGggdGFz
ayA9PSBjdXJyZW50ICovCiB2b2lkIGV4aXRfc2htKHN0cnVjdCB0YXNrX3N0cnVjdCAqdGFz
aykKIHsKLQlzdHJ1Y3QgaXBjX25hbWVzcGFjZSAqbnMgPSB0YXNrLT5uc3Byb3h5LT5pcGNf
bnM7Ci0Jc3RydWN0IHNobWlkX2tlcm5lbCAqc2hwLCAqbjsKKwlmb3IgKDs7KSB7CisJCXN0
cnVjdCBzaG1pZF9rZXJuZWwgKnNocDsKKwkJc3RydWN0IGlwY19uYW1lc3BhY2UgKm5zOwog
Ci0JaWYgKGxpc3RfZW1wdHkoJnRhc2stPnN5c3ZzaG0uc2htX2NsaXN0KSkKLQkJcmV0dXJu
OworCQl0YXNrX2xvY2sodGFzayk7CisKKwkJaWYgKGxpc3RfZW1wdHkoJnRhc2stPnN5c3Zz
aG0uc2htX2NsaXN0KSkgeworCQkJdGFza191bmxvY2sodGFzayk7CisJCQlicmVhazsKKwkJ
fQorCisJCXNocCA9IGxpc3RfZmlyc3RfZW50cnkoJnRhc2stPnN5c3ZzaG0uc2htX2NsaXN0
LCBzdHJ1Y3Qgc2htaWRfa2VybmVsLAorCQkJCXNobV9jbGlzdCk7CiAKLQkvKgotCSAqIElm
IGtlcm5lbC5zaG1fcm1pZF9mb3JjZWQgaXMgbm90IHNldCB0aGVuIG9ubHkga2VlcCB0cmFj
ayBvZgotCSAqIHdoaWNoIHNobWlkcyBhcmUgb3JwaGFuZWQsIHNvIHRoYXQgYSBsYXRlciBz
ZXQgb2YgdGhlIHN5c2N0bAotCSAqIGNhbiBjbGVhbiB0aGVtIHVwLgotCSAqLwotCWlmICgh
bnMtPnNobV9ybWlkX2ZvcmNlZCkgewotCQlkb3duX3JlYWQoJnNobV9pZHMobnMpLnJ3c2Vt
KTsKLQkJbGlzdF9mb3JfZWFjaF9lbnRyeShzaHAsICZ0YXNrLT5zeXN2c2htLnNobV9jbGlz
dCwgc2htX2NsaXN0KQotCQkJc2hwLT5zaG1fY3JlYXRvciA9IE5VTEw7CiAJCS8qCi0JCSAq
IE9ubHkgdW5kZXIgcmVhZCBsb2NrIGJ1dCB3ZSBhcmUgb25seSBjYWxsZWQgb24gY3VycmVu
dAotCQkgKiBzbyBubyBlbnRyeSBvbiB0aGUgbGlzdCB3aWxsIGJlIHNoYXJlZC4KKwkJICog
MSkgZ2V0IGEgcmVmZXJlbmNlIHRvIHNocC4KKwkJICogICAgVGhpcyBtdXN0IGJlIGRvbmUg
Zmlyc3Q6IFJpZ2h0IG5vdywgdGFza19sb2NrKCkgcHJldmVudHMKKwkJICogICAgYW55IGNv
bmN1cnJlbnQgSVBDX1JNSUQgY2FsbHMuIEFmdGVyIHRoZSBsaXN0X2RlbF9pbml0KCksCisJ
CSAqICAgIElQQ19STUlEIHdpbGwgbm90IGFjcXVpcmUgdGFza19sb2NrKC0+c2htX2NyZWF0
b3IpCisJCSAqICAgIGFueW1vcmUuCiAJCSAqLwotCQlsaXN0X2RlbCgmdGFzay0+c3lzdnNo
bS5zaG1fY2xpc3QpOwotCQl1cF9yZWFkKCZzaG1faWRzKG5zKS5yd3NlbSk7Ci0JCXJldHVy
bjsKLQl9CisJCVdBUk5fT04oIWlwY19yY3VfZ2V0cmVmKCZzaHAtPnNobV9wZXJtKSk7CiAK
LQkvKgotCSAqIERlc3Ryb3kgYWxsIGFscmVhZHkgY3JlYXRlZCBzZWdtZW50cywgdGhhdCB3
ZXJlIG5vdCB5ZXQgbWFwcGVkLAotCSAqIGFuZCBtYXJrIGFueSBtYXBwZWQgYXMgb3JwaGFu
IHRvIGNvdmVyIHRoZSBzeXNjdGwgdG9nZ2xpbmcuCi0JICogRGVzdHJveSBpcyBza2lwcGVk
IGlmIHNobV9tYXlfZGVzdHJveSgpIHJldHVybnMgZmFsc2UuCi0JICovCi0JZG93bl93cml0
ZSgmc2htX2lkcyhucykucndzZW0pOwotCWxpc3RfZm9yX2VhY2hfZW50cnlfc2FmZShzaHAs
IG4sICZ0YXNrLT5zeXN2c2htLnNobV9jbGlzdCwgc2htX2NsaXN0KSB7Ci0JCXNocC0+c2ht
X2NyZWF0b3IgPSBOVUxMOworCQkvKiAyKSB1bmxpbmsgKi8KKwkJbGlzdF9kZWxfaW5pdCgm
c2hwLT5zaG1fY2xpc3QpOworCisJCS8qCisJCSAqIDMpIEdldCBwb2ludGVyIHRvIHRoZSBp
cGMgbmFtZXNwYWNlLiBJdCBpcyB3b3J0aCB0byBzYXkKKwkJICogdGhhdCB0aGlzIHBvaW50
ZXIgaXMgZ3VhcmFudGVlZCB0byBiZSB2YWxpZCBiZWNhdXNlCisJCSAqIHNocCBsaWZldGlt
ZSBpcyBhbHdheXMgc2hvcnRlciB0aGFuIG5hbWVzcGFjZSBsaWZldGltZQorCQkgKiBpbiB3
aGljaCBzaHAgbGl2ZXMuCisJCSAqIFdlIHRha2VuIHRhc2tfbG9jayBpdCBtZWFucyB0aGF0
IHNocCB3b24ndCBiZSBmcmVlZC4KKwkJICovCisJCW5zID0gc2hwLT5uczsKIAotCQlpZiAo
c2htX21heV9kZXN0cm95KG5zLCBzaHApKSB7Ci0JCQlzaG1fbG9ja19ieV9wdHIoc2hwKTsK
LQkJCXNobV9kZXN0cm95KG5zLCBzaHApOworCQkvKgorCQkgKiA0KSBJZiBrZXJuZWwuc2ht
X3JtaWRfZm9yY2VkIGlzIG5vdCBzZXQgdGhlbiBvbmx5IGtlZXAgdHJhY2sgb2YKKwkJICog
d2hpY2ggc2htaWRzIGFyZSBvcnBoYW5lZCwgc28gdGhhdCBhIGxhdGVyIHNldCBvZiB0aGUg
c3lzY3RsCisJCSAqIGNhbiBjbGVhbiB0aGVtIHVwLgorCQkgKi8KKwkJaWYgKCFucy0+c2ht
X3JtaWRfZm9yY2VkKSB7CisJCQlpcGNfcmN1X3B1dHJlZigmc2hwLT5zaG1fcGVybSwgc2ht
X3JjdV9mcmVlKTsKKwkJCXRhc2tfdW5sb2NrKHRhc2spOworCQkJY29udGludWU7CiAJCX0K
LQl9CiAKLQkvKiBSZW1vdmUgdGhlIGxpc3QgaGVhZCBmcm9tIGFueSBzZWdtZW50cyBzdGls
bCBhdHRhY2hlZC4gKi8KLQlsaXN0X2RlbCgmdGFzay0+c3lzdnNobS5zaG1fY2xpc3QpOwot
CXVwX3dyaXRlKCZzaG1faWRzKG5zKS5yd3NlbSk7CisJCS8qCisJCSAqIDUpIGdldCBhIHJl
ZmVyZW5jZSB0byB0aGUgbmFtZXNwYWNlLgorCQkgKiAgICBUaGUgcmVmY291bnQgY291bGQg
YmUgYWxyZWFkeSAwLiBJZiBpdCBpcyAwLCB0aGVuCisJCSAqICAgIHRoZSBzaG0gb2JqZWN0
cyB3aWxsIGJlIGZyZWUgYnkgZnJlZV9pcGNfd29yaygpLgorCQkgKi8KKwkJbnMgPSBnZXRf
aXBjX25zX25vdF96ZXJvKG5zKTsKKwkJaWYgKCFucykgeworCQkJaXBjX3JjdV9wdXRyZWYo
JnNocC0+c2htX3Blcm0sIHNobV9yY3VfZnJlZSk7CisJCQl0YXNrX3VubG9jayh0YXNrKTsK
KwkJCWNvbnRpbnVlOworCQl9CisJCXRhc2tfdW5sb2NrKHRhc2spOworCisJCS8qCisJCSAq
IDYpIHdlIGhhdmUgYWxsIHJlZmVyZW5jZXMKKwkJICogICAgVGh1cyBsb2NrICYgaWYgbmVl
ZGVkIGRlc3Ryb3kgc2hwLgorCQkgKi8KKwkJZG93bl93cml0ZSgmc2htX2lkcyhucykucndz
ZW0pOworCQlzaG1fbG9ja19ieV9wdHIoc2hwKTsKKwkJLyoKKwkJICogcmN1X3JlYWRfbG9j
ayB3YXMgaW1wbGljaXRseSB0YWtlbiBpbiBzaG1fbG9ja19ieV9wdHIsIGl0J3MKKwkJICog
c2FmZSB0byBjYWxsIGlwY19yY3VfcHV0cmVmIGhlcmUKKwkJICovCisJCWlwY19yY3VfcHV0
cmVmKCZzaHAtPnNobV9wZXJtLCBzaG1fcmN1X2ZyZWUpOworCisJCWlmIChpcGNfdmFsaWRf
b2JqZWN0KCZzaHAtPnNobV9wZXJtKSkgeworCQkJaWYgKHNobV9tYXlfZGVzdHJveShzaHAp
KQorCQkJCXNobV9kZXN0cm95KG5zLCBzaHApOworCQkJZWxzZQorCQkJCXNobV91bmxvY2so
c2hwKTsKKwkJfSBlbHNlIHsKKwkJCS8qCisJCQkgKiBTb21lb25lIGVsc2UgZGVsZXRlZCB0
aGUgc2hwIGZyb20gbmFtZXNwYWNlCisJCQkgKiBpZHIva2h0IHdoaWxlIHdlIGhhdmUgd2Fp
dGVkLgorCQkJICogSnVzdCB1bmxvY2sgYW5kIGNvbnRpbnVlLgorCQkJICovCisJCQlzaG1f
dW5sb2NrKHNocCk7CisJCX0KKworCQl1cF93cml0ZSgmc2htX2lkcyhucykucndzZW0pOwor
CQlwdXRfaXBjX25zKG5zKTsgLyogcGFpcmVkIHdpdGggZ2V0X2lwY19uc19ub3RfemVybyAq
LworCX0KIH0KIAogc3RhdGljIHZtX2ZhdWx0X3Qgc2htX2ZhdWx0KHN0cnVjdCB2bV9mYXVs
dCAqdm1mKQpAQCAtNjgwLDcgKzc2OSwxMSBAQCBzdGF0aWMgaW50IG5ld3NlZyhzdHJ1Y3Qg
aXBjX25hbWVzcGFjZSAqbnMsIHN0cnVjdCBpcGNfcGFyYW1zICpwYXJhbXMpCiAJaWYgKGVy
cm9yIDwgMCkKIAkJZ290byBub19pZDsKIAorCXNocC0+bnMgPSBuczsKKworCXRhc2tfbG9j
ayhjdXJyZW50KTsKIAlsaXN0X2FkZCgmc2hwLT5zaG1fY2xpc3QsICZjdXJyZW50LT5zeXN2
c2htLnNobV9jbGlzdCk7CisJdGFza191bmxvY2soY3VycmVudCk7CiAKIAkvKgogCSAqIHNo
bWlkIGdldHMgcmVwb3J0ZWQgYXMgImlub2RlIyIgaW4gL3Byb2MvcGlkL21hcHMuCkBAIC0x
NTczLDcgKzE2NjYsOCBAQCBsb25nIGRvX3NobWF0KGludCBzaG1pZCwgY2hhciBfX3VzZXIg
KnNobWFkZHIsIGludCBzaG1mbGcsCiAJZG93bl93cml0ZSgmc2htX2lkcyhucykucndzZW0p
OwogCXNocCA9IHNobV9sb2NrKG5zLCBzaG1pZCk7CiAJc2hwLT5zaG1fbmF0dGNoLS07Ci0J
aWYgKHNobV9tYXlfZGVzdHJveShucywgc2hwKSkKKworCWlmIChzaG1fbWF5X2Rlc3Ryb3ko
c2hwKSkKIAkJc2htX2Rlc3Ryb3kobnMsIHNocCk7CiAJZWxzZQogCQlzaG1fdW5sb2NrKHNo
cCk7Ci0tIAoyLjMxLjEKCg==
--------------9c4s0be1o5GSXHC3RDDkeezm--