From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-5.4 required=3.0 tests=DKIMWL_WL_HIGH,DKIM_SIGNED, DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,SIGNED_OFF_BY, SPF_PASS,URIBL_RHS_DOB autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 75632C04EBF for ; Thu, 6 Dec 2018 09:30:23 +0000 (UTC) Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id 44BCD214DA for ; Thu, 6 Dec 2018 09:30:23 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=lists.infradead.org header.i=@lists.infradead.org header.b="uI2d9jWJ"; dkim=fail reason="signature verification failed" (1024-bit key) header.d=kernel.org header.i=@kernel.org header.b="ZtKPrsYb" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 44BCD214DA Authentication-Results: mail.kernel.org; dmarc=none (p=none dis=none) header.from=linuxfoundation.org Authentication-Results: mail.kernel.org; spf=none smtp.mailfrom=linux-amlogic-bounces+linux-amlogic=archiver.kernel.org@lists.infradead.org DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20170209; h=Sender: Content-Transfer-Encoding:Content-Type:Cc:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:MIME-Version:Message-ID:Date:From:To: Subject:Reply-To:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References: List-Owner; bh=/nAhLMqB+5jtJjJPr83Jio1xbcjUsa9UMAHdhftWojk=; b=uI2d9jWJQ8Rmj3 yJTr7UtJV/fXDqE9T12PHkmkl/VY/VWk8hIl+sHNzByojiT8Jj9RAahxc2RBmOyukKcZtcpbXl7dZ mQd/tC7RPdYzXRtA8IDiyhRqXhxl8AXa46ZAhbTpRLgZsi93uB2mypKtnwPApQGytWXW2xkWWzBQT QQqx2q2W7tQ23aa2+EZ1CLP+3HHmcKgvMGmjxIQI7NeL7FpP5kSUuae88p51lZCB3M/CFLDrbPdkS +Lm5Z4/ur+27f6P3E4sy3AS0dKmxo5RrRlY9p3mAHNHrsHuA6jpsOpIWlGN2QmoRI+oz/jrGkhSAI C86N4vmG6rtG2KML+QNA==; Received: from localhost ([127.0.0.1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.90_1 #2 (Red Hat Linux)) id 1gUpz7-0001lG-8D; Thu, 06 Dec 2018 09:30:17 +0000 Received: from mail.kernel.org ([198.145.29.99]) by bombadil.infradead.org with esmtps (Exim 4.90_1 #2 (Red Hat Linux)) id 1gUpz4-0001E6-BH; Thu, 06 Dec 2018 09:30:16 +0000 Received: from localhost (5356596B.cm-6-7b.dynamic.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 0DFC0214C1; Thu, 6 Dec 2018 09:30:05 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1544088606; bh=IVQgNajT5sTSEUsQAIzDwuJIcxrpeERWB46o4AxAoWQ=; h=Subject:To:Cc:From:Date:From; b=ZtKPrsYb0xlZNfOP8G3auCCVcLhp5CsAiAZZr/QScvndgmYi2HF3x3oEVxDH+FRLG MfguxBcRVjbS8VGkLWczUOoQkxMCcYfonElsaNHcoTbEC8/SZ0CT+MLkk47jesFMNm j/fdzgAQgX512xX+e3stzxbhvaHx5Mee45ToOudk= Subject: Patch "drm/meson: Fix OOB memory accesses in meson_viu_set_osd_lut()" has been added to the 4.14-stable tree To: 20181125012117.31915-1-lyude@redhat.com, carlo@caione.org, dri-devel@lists.freedesktop.org, gregkh@linuxfoundation.org, khilman@baylibre.com, linux-amlogic@lists.infradead.org, linux-arm-kernel@lists.infradead.org, lyude@redhat.com, maxime.ripard@bootlin.com, narmstrong@baylibre.com, seanpaul@chromium.org From: Date: Thu, 06 Dec 2018 10:29:53 +0100 Message-ID: <15440885931170@kroah.com> MIME-Version: 1.0 X-stable: commit X-Patchwork-Hint: ignore X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20181206_013014_433208_B5CF9E59 X-CRM114-Status: GOOD ( 11.38 ) X-BeenThere: linux-amlogic@lists.infradead.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: stable-commits@vger.kernel.org Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: "linux-amlogic" Errors-To: linux-amlogic-bounces+linux-amlogic=archiver.kernel.org@lists.infradead.org This is a note to let you know that I've just added the patch titled drm/meson: Fix OOB memory accesses in meson_viu_set_osd_lut() to the 4.14-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: drm-meson-fix-oob-memory-accesses-in-meson_viu_set_osd_lut.patch and it can be found in the queue-4.14 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let know about it. >From 97b2a3180a559a33852ac0cd77904166069484fd Mon Sep 17 00:00:00 2001 From: Lyude Paul Date: Sat, 24 Nov 2018 20:21:17 -0500 Subject: drm/meson: Fix OOB memory accesses in meson_viu_set_osd_lut() From: Lyude Paul commit 97b2a3180a559a33852ac0cd77904166069484fd upstream. Currently on driver bringup with KASAN enabled, meson triggers an OOB memory access as shown below: [ 117.904528] ================================================================== [ 117.904560] BUG: KASAN: global-out-of-bounds in meson_viu_set_osd_lut+0x7a0/0x890 [ 117.904588] Read of size 4 at addr ffff20000a63ce24 by task systemd-udevd/498 [ 117.904601] [ 118.083372] CPU: 4 PID: 498 Comm: systemd-udevd Not tainted 4.20.0-rc3Lyude-Test+ #20 [ 118.091143] Hardware name: amlogic khadas-vim2/khadas-vim2, BIOS 2018.07-rc2-armbian 09/11/2018 [ 118.099768] Call trace: [ 118.102181] dump_backtrace+0x0/0x3e8 [ 118.105796] show_stack+0x14/0x20 [ 118.109083] dump_stack+0x130/0x1c4 [ 118.112539] print_address_description+0x60/0x25c [ 118.117214] kasan_report+0x1b4/0x368 [ 118.120851] __asan_report_load4_noabort+0x18/0x20 [ 118.125566] meson_viu_set_osd_lut+0x7a0/0x890 [ 118.129953] meson_viu_init+0x10c/0x290 [ 118.133741] meson_drv_bind_master+0x474/0x748 [ 118.138141] meson_drv_bind+0x10/0x18 [ 118.141760] try_to_bring_up_master+0x3d8/0x768 [ 118.146249] component_add+0x214/0x570 [ 118.149978] meson_dw_hdmi_probe+0x18/0x20 [meson_dw_hdmi] [ 118.155404] platform_drv_probe+0x98/0x138 [ 118.159455] really_probe+0x2a0/0xa70 [ 118.163070] driver_probe_device+0x1b4/0x2d8 [ 118.167299] __driver_attach+0x200/0x280 [ 118.171189] bus_for_each_dev+0x10c/0x1a8 [ 118.175144] driver_attach+0x38/0x50 [ 118.178681] bus_add_driver+0x330/0x608 [ 118.182471] driver_register+0x140/0x388 [ 118.186361] __platform_driver_register+0xc8/0x108 [ 118.191117] meson_dw_hdmi_platform_driver_init+0x1c/0x1000 [meson_dw_hdmi] [ 118.198022] do_one_initcall+0x12c/0x3bc [ 118.201883] do_init_module+0x1fc/0x638 [ 118.205673] load_module+0x4b4c/0x6808 [ 118.209387] __se_sys_init_module+0x2e8/0x3c0 [ 118.213699] __arm64_sys_init_module+0x68/0x98 [ 118.218100] el0_svc_common+0x104/0x210 [ 118.221893] el0_svc_handler+0x48/0xb8 [ 118.225594] el0_svc+0x8/0xc [ 118.228429] [ 118.229887] The buggy address belongs to the variable: [ 118.235007] eotf_33_linear_mapping+0x84/0xc0 [ 118.239301] [ 118.240752] Memory state around the buggy address: [ 118.245522] ffff20000a63cd00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 118.252695] ffff20000a63cd80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 118.259850] >ffff20000a63ce00: 00 00 00 00 04 fa fa fa fa fa fa fa 00 00 00 00 [ 118.267000] ^ [ 118.271222] ffff20000a63ce80: 00 fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00 [ 118.278393] ffff20000a63cf00: 00 00 00 00 00 00 00 00 00 00 00 00 04 fa fa fa [ 118.285542] ================================================================== [ 118.292699] Disabling lock debugging due to kernel taint It seems that when looping through the OSD EOTF LUT maps, we use the same max iterator for OETF: 20. This is wrong though, since 20*2 is 40, which means that we'll stop out of bounds on the EOTF maps. But, this whole thing is already confusing enough to read through as-is, so let's just replace all of the hardcoded sizes with OSD_(OETF/EOTF)_LUT_SIZE / 2. Signed-off-by: Lyude Paul Fixes: bbbe775ec5b5 ("drm: Add support for Amlogic Meson Graphic Controller") Cc: Neil Armstrong Cc: Maxime Ripard Cc: Carlo Caione Cc: Kevin Hilman Cc: dri-devel@lists.freedesktop.org Cc: linux-amlogic@lists.infradead.org Cc: linux-arm-kernel@lists.infradead.org Cc: # v4.10+ Acked-by: Neil Armstrong Signed-off-by: Neil Armstrong Link: https://patchwork.freedesktop.org/patch/msgid/20181125012117.31915-1-lyude@redhat.com Signed-off-by: Sean Paul Signed-off-by: Greg Kroah-Hartman --- drivers/gpu/drm/meson/meson_viu.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) --- a/drivers/gpu/drm/meson/meson_viu.c +++ b/drivers/gpu/drm/meson/meson_viu.c @@ -184,18 +184,18 @@ void meson_viu_set_osd_lut(struct meson_ if (lut_sel == VIU_LUT_OSD_OETF) { writel(0, priv->io_base + _REG(addr_port)); - for (i = 0; i < 20; i++) + for (i = 0; i < (OSD_OETF_LUT_SIZE / 2); i++) writel(r_map[i * 2] | (r_map[i * 2 + 1] << 16), priv->io_base + _REG(data_port)); writel(r_map[OSD_OETF_LUT_SIZE - 1] | (g_map[0] << 16), priv->io_base + _REG(data_port)); - for (i = 0; i < 20; i++) + for (i = 0; i < (OSD_OETF_LUT_SIZE / 2); i++) writel(g_map[i * 2 + 1] | (g_map[i * 2 + 2] << 16), priv->io_base + _REG(data_port)); - for (i = 0; i < 20; i++) + for (i = 0; i < (OSD_OETF_LUT_SIZE / 2); i++) writel(b_map[i * 2] | (b_map[i * 2 + 1] << 16), priv->io_base + _REG(data_port)); @@ -211,18 +211,18 @@ void meson_viu_set_osd_lut(struct meson_ } else if (lut_sel == VIU_LUT_OSD_EOTF) { writel(0, priv->io_base + _REG(addr_port)); - for (i = 0; i < 20; i++) + for (i = 0; i < (OSD_EOTF_LUT_SIZE / 2); i++) writel(r_map[i * 2] | (r_map[i * 2 + 1] << 16), priv->io_base + _REG(data_port)); writel(r_map[OSD_EOTF_LUT_SIZE - 1] | (g_map[0] << 16), priv->io_base + _REG(data_port)); - for (i = 0; i < 20; i++) + for (i = 0; i < (OSD_EOTF_LUT_SIZE / 2); i++) writel(g_map[i * 2 + 1] | (g_map[i * 2 + 2] << 16), priv->io_base + _REG(data_port)); - for (i = 0; i < 20; i++) + for (i = 0; i < (OSD_EOTF_LUT_SIZE / 2); i++) writel(b_map[i * 2] | (b_map[i * 2 + 1] << 16), priv->io_base + _REG(data_port)); Patches currently in stable-queue which might be from lyude@redhat.com are queue-4.14/drm-meson-enable-fast_io-in-meson_dw_hdmi_regmap_config.patch queue-4.14/drm-meson-fix-oob-memory-accesses-in-meson_viu_set_osd_lut.patch _______________________________________________ linux-amlogic mailing list linux-amlogic@lists.infradead.org http://lists.infradead.org/mailman/listinfo/linux-amlogic From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-5.4 required=3.0 tests=DKIMWL_WL_HIGH,DKIM_SIGNED, DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,SIGNED_OFF_BY, SPF_PASS,URIBL_RHS_DOB autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 22692C04EB9 for ; Thu, 6 Dec 2018 09:30:20 +0000 (UTC) Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id BA076214F1 for ; Thu, 6 Dec 2018 09:30:19 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=lists.infradead.org header.i=@lists.infradead.org header.b="lHs4lBVd"; dkim=fail reason="signature verification failed" (1024-bit key) header.d=kernel.org header.i=@kernel.org header.b="ZtKPrsYb" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org BA076214F1 Authentication-Results: mail.kernel.org; dmarc=none (p=none dis=none) header.from=linuxfoundation.org Authentication-Results: mail.kernel.org; spf=none smtp.mailfrom=linux-arm-kernel-bounces+infradead-linux-arm-kernel=archiver.kernel.org@lists.infradead.org DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20170209; h=Sender: Content-Transfer-Encoding:Content-Type:Cc:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:MIME-Version:Message-ID:Date:From:To: Subject:Reply-To:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References: List-Owner; bh=ZLWpWOypASm7Us7+ni5I2cQFTHveu1rC2P/iakxTBX0=; b=lHs4lBVdBBkTs8 KOPAsUinT4H7vmifA/2IUD/o+gs6sfa0RuM5cRZhD6ykcRIiUqxdF98854Dn1xSD2xCndMO5IA5oO PVgXBt5mixC0kb1uKTPK0vYIPTUoeIqCY47IA4fLtxR01AfyutN23309ZknUTjYHz8KKSaKD1PiLT mtGt3PXmAATpV/UsFbwqffLjgX0EsSi31QuwhpGtvCOoLhFyw/LSbWc3x9P1LK7xfMK5uNd75CtAu a+h7QqOR2cjTFgO45sdJW4dwKyujU2F1mPYN+0xFdhyI3MJ6AUEwueLdG/6xbBctoXfjFoPoAC8+p wy8v6n23+guW/Rbda9AA==; Received: from localhost ([127.0.0.1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.90_1 #2 (Red Hat Linux)) id 1gUpz8-0001lh-Ep; Thu, 06 Dec 2018 09:30:18 +0000 Received: from mail.kernel.org ([198.145.29.99]) by bombadil.infradead.org with esmtps (Exim 4.90_1 #2 (Red Hat Linux)) id 1gUpz4-0001E6-BH; Thu, 06 Dec 2018 09:30:16 +0000 Received: from localhost (5356596B.cm-6-7b.dynamic.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 0DFC0214C1; Thu, 6 Dec 2018 09:30:05 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1544088606; bh=IVQgNajT5sTSEUsQAIzDwuJIcxrpeERWB46o4AxAoWQ=; h=Subject:To:Cc:From:Date:From; b=ZtKPrsYb0xlZNfOP8G3auCCVcLhp5CsAiAZZr/QScvndgmYi2HF3x3oEVxDH+FRLG MfguxBcRVjbS8VGkLWczUOoQkxMCcYfonElsaNHcoTbEC8/SZ0CT+MLkk47jesFMNm j/fdzgAQgX512xX+e3stzxbhvaHx5Mee45ToOudk= Subject: Patch "drm/meson: Fix OOB memory accesses in meson_viu_set_osd_lut()" has been added to the 4.14-stable tree To: 20181125012117.31915-1-lyude@redhat.com, carlo@caione.org, dri-devel@lists.freedesktop.org, gregkh@linuxfoundation.org, khilman@baylibre.com, linux-amlogic@lists.infradead.org, linux-arm-kernel@lists.infradead.org, lyude@redhat.com, maxime.ripard@bootlin.com, narmstrong@baylibre.com, seanpaul@chromium.org From: Date: Thu, 06 Dec 2018 10:29:53 +0100 Message-ID: <15440885931170@kroah.com> MIME-Version: 1.0 X-stable: commit X-Patchwork-Hint: ignore X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20181206_013014_433208_B5CF9E59 X-CRM114-Status: GOOD ( 11.38 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: stable-commits@vger.kernel.org Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+infradead-linux-arm-kernel=archiver.kernel.org@lists.infradead.org This is a note to let you know that I've just added the patch titled drm/meson: Fix OOB memory accesses in meson_viu_set_osd_lut() to the 4.14-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: drm-meson-fix-oob-memory-accesses-in-meson_viu_set_osd_lut.patch and it can be found in the queue-4.14 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let know about it. >From 97b2a3180a559a33852ac0cd77904166069484fd Mon Sep 17 00:00:00 2001 From: Lyude Paul Date: Sat, 24 Nov 2018 20:21:17 -0500 Subject: drm/meson: Fix OOB memory accesses in meson_viu_set_osd_lut() From: Lyude Paul commit 97b2a3180a559a33852ac0cd77904166069484fd upstream. Currently on driver bringup with KASAN enabled, meson triggers an OOB memory access as shown below: [ 117.904528] ================================================================== [ 117.904560] BUG: KASAN: global-out-of-bounds in meson_viu_set_osd_lut+0x7a0/0x890 [ 117.904588] Read of size 4 at addr ffff20000a63ce24 by task systemd-udevd/498 [ 117.904601] [ 118.083372] CPU: 4 PID: 498 Comm: systemd-udevd Not tainted 4.20.0-rc3Lyude-Test+ #20 [ 118.091143] Hardware name: amlogic khadas-vim2/khadas-vim2, BIOS 2018.07-rc2-armbian 09/11/2018 [ 118.099768] Call trace: [ 118.102181] dump_backtrace+0x0/0x3e8 [ 118.105796] show_stack+0x14/0x20 [ 118.109083] dump_stack+0x130/0x1c4 [ 118.112539] print_address_description+0x60/0x25c [ 118.117214] kasan_report+0x1b4/0x368 [ 118.120851] __asan_report_load4_noabort+0x18/0x20 [ 118.125566] meson_viu_set_osd_lut+0x7a0/0x890 [ 118.129953] meson_viu_init+0x10c/0x290 [ 118.133741] meson_drv_bind_master+0x474/0x748 [ 118.138141] meson_drv_bind+0x10/0x18 [ 118.141760] try_to_bring_up_master+0x3d8/0x768 [ 118.146249] component_add+0x214/0x570 [ 118.149978] meson_dw_hdmi_probe+0x18/0x20 [meson_dw_hdmi] [ 118.155404] platform_drv_probe+0x98/0x138 [ 118.159455] really_probe+0x2a0/0xa70 [ 118.163070] driver_probe_device+0x1b4/0x2d8 [ 118.167299] __driver_attach+0x200/0x280 [ 118.171189] bus_for_each_dev+0x10c/0x1a8 [ 118.175144] driver_attach+0x38/0x50 [ 118.178681] bus_add_driver+0x330/0x608 [ 118.182471] driver_register+0x140/0x388 [ 118.186361] __platform_driver_register+0xc8/0x108 [ 118.191117] meson_dw_hdmi_platform_driver_init+0x1c/0x1000 [meson_dw_hdmi] [ 118.198022] do_one_initcall+0x12c/0x3bc [ 118.201883] do_init_module+0x1fc/0x638 [ 118.205673] load_module+0x4b4c/0x6808 [ 118.209387] __se_sys_init_module+0x2e8/0x3c0 [ 118.213699] __arm64_sys_init_module+0x68/0x98 [ 118.218100] el0_svc_common+0x104/0x210 [ 118.221893] el0_svc_handler+0x48/0xb8 [ 118.225594] el0_svc+0x8/0xc [ 118.228429] [ 118.229887] The buggy address belongs to the variable: [ 118.235007] eotf_33_linear_mapping+0x84/0xc0 [ 118.239301] [ 118.240752] Memory state around the buggy address: [ 118.245522] ffff20000a63cd00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 118.252695] ffff20000a63cd80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 118.259850] >ffff20000a63ce00: 00 00 00 00 04 fa fa fa fa fa fa fa 00 00 00 00 [ 118.267000] ^ [ 118.271222] ffff20000a63ce80: 00 fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00 [ 118.278393] ffff20000a63cf00: 00 00 00 00 00 00 00 00 00 00 00 00 04 fa fa fa [ 118.285542] ================================================================== [ 118.292699] Disabling lock debugging due to kernel taint It seems that when looping through the OSD EOTF LUT maps, we use the same max iterator for OETF: 20. This is wrong though, since 20*2 is 40, which means that we'll stop out of bounds on the EOTF maps. But, this whole thing is already confusing enough to read through as-is, so let's just replace all of the hardcoded sizes with OSD_(OETF/EOTF)_LUT_SIZE / 2. Signed-off-by: Lyude Paul Fixes: bbbe775ec5b5 ("drm: Add support for Amlogic Meson Graphic Controller") Cc: Neil Armstrong Cc: Maxime Ripard Cc: Carlo Caione Cc: Kevin Hilman Cc: dri-devel@lists.freedesktop.org Cc: linux-amlogic@lists.infradead.org Cc: linux-arm-kernel@lists.infradead.org Cc: # v4.10+ Acked-by: Neil Armstrong Signed-off-by: Neil Armstrong Link: https://patchwork.freedesktop.org/patch/msgid/20181125012117.31915-1-lyude@redhat.com Signed-off-by: Sean Paul Signed-off-by: Greg Kroah-Hartman --- drivers/gpu/drm/meson/meson_viu.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) --- a/drivers/gpu/drm/meson/meson_viu.c +++ b/drivers/gpu/drm/meson/meson_viu.c @@ -184,18 +184,18 @@ void meson_viu_set_osd_lut(struct meson_ if (lut_sel == VIU_LUT_OSD_OETF) { writel(0, priv->io_base + _REG(addr_port)); - for (i = 0; i < 20; i++) + for (i = 0; i < (OSD_OETF_LUT_SIZE / 2); i++) writel(r_map[i * 2] | (r_map[i * 2 + 1] << 16), priv->io_base + _REG(data_port)); writel(r_map[OSD_OETF_LUT_SIZE - 1] | (g_map[0] << 16), priv->io_base + _REG(data_port)); - for (i = 0; i < 20; i++) + for (i = 0; i < (OSD_OETF_LUT_SIZE / 2); i++) writel(g_map[i * 2 + 1] | (g_map[i * 2 + 2] << 16), priv->io_base + _REG(data_port)); - for (i = 0; i < 20; i++) + for (i = 0; i < (OSD_OETF_LUT_SIZE / 2); i++) writel(b_map[i * 2] | (b_map[i * 2 + 1] << 16), priv->io_base + _REG(data_port)); @@ -211,18 +211,18 @@ void meson_viu_set_osd_lut(struct meson_ } else if (lut_sel == VIU_LUT_OSD_EOTF) { writel(0, priv->io_base + _REG(addr_port)); - for (i = 0; i < 20; i++) + for (i = 0; i < (OSD_EOTF_LUT_SIZE / 2); i++) writel(r_map[i * 2] | (r_map[i * 2 + 1] << 16), priv->io_base + _REG(data_port)); writel(r_map[OSD_EOTF_LUT_SIZE - 1] | (g_map[0] << 16), priv->io_base + _REG(data_port)); - for (i = 0; i < 20; i++) + for (i = 0; i < (OSD_EOTF_LUT_SIZE / 2); i++) writel(g_map[i * 2 + 1] | (g_map[i * 2 + 2] << 16), priv->io_base + _REG(data_port)); - for (i = 0; i < 20; i++) + for (i = 0; i < (OSD_EOTF_LUT_SIZE / 2); i++) writel(b_map[i * 2] | (b_map[i * 2 + 1] << 16), priv->io_base + _REG(data_port)); Patches currently in stable-queue which might be from lyude@redhat.com are queue-4.14/drm-meson-enable-fast_io-in-meson_dw_hdmi_regmap_config.patch queue-4.14/drm-meson-fix-oob-memory-accesses-in-meson_viu_set_osd_lut.patch _______________________________________________ linux-arm-kernel mailing list linux-arm-kernel@lists.infradead.org http://lists.infradead.org/mailman/listinfo/linux-arm-kernel From mboxrd@z Thu Jan 1 00:00:00 1970 From: Subject: Patch "drm/meson: Fix OOB memory accesses in meson_viu_set_osd_lut()" has been added to the 4.14-stable tree Date: Thu, 06 Dec 2018 10:29:53 +0100 Message-ID: <15440885931170@kroah.com> Mime-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 Return-path: Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by gabe.freedesktop.org (Postfix) with ESMTPS id 999966E54D for ; Thu, 6 Dec 2018 09:30:06 +0000 (UTC) List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dri-devel-bounces@lists.freedesktop.org Sender: "dri-devel" To: 20181125012117.31915-1-lyude@redhat.com, carlo@caione.org, dri-devel@lists.freedesktop.org, gregkh@linuxfoundation.org, khilman@baylibre.com, linux-amlogic@lists.infradead.org, linux-arm-kernel@lists.infradead.orglyude@redhat.com, maxime.ripard@bootlin.com, narmstrong@baylibre.com, seanpaul@chromium.org Cc: stable-commits@vger.kernel.org List-Id: dri-devel@lists.freedesktop.org ClRoaXMgaXMgYSBub3RlIHRvIGxldCB5b3Uga25vdyB0aGF0IEkndmUganVzdCBhZGRlZCB0aGUg cGF0Y2ggdGl0bGVkCgogICAgZHJtL21lc29uOiBGaXggT09CIG1lbW9yeSBhY2Nlc3NlcyBpbiBt ZXNvbl92aXVfc2V0X29zZF9sdXQoKQoKdG8gdGhlIDQuMTQtc3RhYmxlIHRyZWUgd2hpY2ggY2Fu IGJlIGZvdW5kIGF0OgogICAgaHR0cDovL3d3dy5rZXJuZWwub3JnL2dpdC8/cD1saW51eC9rZXJu ZWwvZ2l0L3N0YWJsZS9zdGFibGUtcXVldWUuZ2l0O2E9c3VtbWFyeQoKVGhlIGZpbGVuYW1lIG9m IHRoZSBwYXRjaCBpczoKICAgICBkcm0tbWVzb24tZml4LW9vYi1tZW1vcnktYWNjZXNzZXMtaW4t bWVzb25fdml1X3NldF9vc2RfbHV0LnBhdGNoCmFuZCBpdCBjYW4gYmUgZm91bmQgaW4gdGhlIHF1 ZXVlLTQuMTQgc3ViZGlyZWN0b3J5LgoKSWYgeW91LCBvciBhbnlvbmUgZWxzZSwgZmVlbHMgaXQg c2hvdWxkIG5vdCBiZSBhZGRlZCB0byB0aGUgc3RhYmxlIHRyZWUsCnBsZWFzZSBsZXQgPHN0YWJs ZUB2Z2VyLmtlcm5lbC5vcmc+IGtub3cgYWJvdXQgaXQuCgoKRnJvbSA5N2IyYTMxODBhNTU5YTMz ODUyYWMwY2Q3NzkwNDE2NjA2OTQ4NGZkIE1vbiBTZXAgMTcgMDA6MDA6MDAgMjAwMQpGcm9tOiBM eXVkZSBQYXVsIDxseXVkZUByZWRoYXQuY29tPgpEYXRlOiBTYXQsIDI0IE5vdiAyMDE4IDIwOjIx OjE3IC0wNTAwClN1YmplY3Q6IGRybS9tZXNvbjogRml4IE9PQiBtZW1vcnkgYWNjZXNzZXMgaW4g bWVzb25fdml1X3NldF9vc2RfbHV0KCkKCkZyb206IEx5dWRlIFBhdWwgPGx5dWRlQHJlZGhhdC5j b20+Cgpjb21taXQgOTdiMmEzMTgwYTU1OWEzMzg1MmFjMGNkNzc5MDQxNjYwNjk0ODRmZCB1cHN0 cmVhbS4KCkN1cnJlbnRseSBvbiBkcml2ZXIgYnJpbmd1cCB3aXRoIEtBU0FOIGVuYWJsZWQsIG1l c29uIHRyaWdnZXJzIGFuIE9PQgptZW1vcnkgYWNjZXNzIGFzIHNob3duIGJlbG93OgoKWyAgMTE3 LjkwNDUyOF0gPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09ClsgIDExNy45MDQ1NjBdIEJVRzogS0FTQU46IGdsb2JhbC1vdXQt b2YtYm91bmRzIGluIG1lc29uX3ZpdV9zZXRfb3NkX2x1dCsweDdhMC8weDg5MApbICAxMTcuOTA0 NTg4XSBSZWFkIG9mIHNpemUgNCBhdCBhZGRyIGZmZmYyMDAwMGE2M2NlMjQgYnkgdGFzayBzeXN0 ZW1kLXVkZXZkLzQ5OApbICAxMTcuOTA0NjAxXQpbICAxMTguMDgzMzcyXSBDUFU6IDQgUElEOiA0 OTggQ29tbTogc3lzdGVtZC11ZGV2ZCBOb3QgdGFpbnRlZCA0LjIwLjAtcmMzTHl1ZGUtVGVzdCsg IzIwClsgIDExOC4wOTExNDNdIEhhcmR3YXJlIG5hbWU6IGFtbG9naWMga2hhZGFzLXZpbTIva2hh ZGFzLXZpbTIsIEJJT1MgMjAxOC4wNy1yYzItYXJtYmlhbiAwOS8xMS8yMDE4ClsgIDExOC4wOTk3 NjhdIENhbGwgdHJhY2U6ClsgIDExOC4xMDIxODFdICBkdW1wX2JhY2t0cmFjZSsweDAvMHgzZTgK WyAgMTE4LjEwNTc5Nl0gIHNob3dfc3RhY2srMHgxNC8weDIwClsgIDExOC4xMDkwODNdICBkdW1w X3N0YWNrKzB4MTMwLzB4MWM0ClsgIDExOC4xMTI1MzldICBwcmludF9hZGRyZXNzX2Rlc2NyaXB0 aW9uKzB4NjAvMHgyNWMKWyAgMTE4LjExNzIxNF0gIGthc2FuX3JlcG9ydCsweDFiNC8weDM2OApb ICAxMTguMTIwODUxXSAgX19hc2FuX3JlcG9ydF9sb2FkNF9ub2Fib3J0KzB4MTgvMHgyMApbICAx MTguMTI1NTY2XSAgbWVzb25fdml1X3NldF9vc2RfbHV0KzB4N2EwLzB4ODkwClsgIDExOC4xMjk5 NTNdICBtZXNvbl92aXVfaW5pdCsweDEwYy8weDI5MApbICAxMTguMTMzNzQxXSAgbWVzb25fZHJ2 X2JpbmRfbWFzdGVyKzB4NDc0LzB4NzQ4ClsgIDExOC4xMzgxNDFdICBtZXNvbl9kcnZfYmluZCsw eDEwLzB4MTgKWyAgMTE4LjE0MTc2MF0gIHRyeV90b19icmluZ191cF9tYXN0ZXIrMHgzZDgvMHg3 NjgKWyAgMTE4LjE0NjI0OV0gIGNvbXBvbmVudF9hZGQrMHgyMTQvMHg1NzAKWyAgMTE4LjE0OTk3 OF0gIG1lc29uX2R3X2hkbWlfcHJvYmUrMHgxOC8weDIwIFttZXNvbl9kd19oZG1pXQpbICAxMTgu MTU1NDA0XSAgcGxhdGZvcm1fZHJ2X3Byb2JlKzB4OTgvMHgxMzgKWyAgMTE4LjE1OTQ1NV0gIHJl YWxseV9wcm9iZSsweDJhMC8weGE3MApbICAxMTguMTYzMDcwXSAgZHJpdmVyX3Byb2JlX2Rldmlj ZSsweDFiNC8weDJkOApbICAxMTguMTY3Mjk5XSAgX19kcml2ZXJfYXR0YWNoKzB4MjAwLzB4Mjgw ClsgIDExOC4xNzExODldICBidXNfZm9yX2VhY2hfZGV2KzB4MTBjLzB4MWE4ClsgIDExOC4xNzUx NDRdICBkcml2ZXJfYXR0YWNoKzB4MzgvMHg1MApbICAxMTguMTc4NjgxXSAgYnVzX2FkZF9kcml2 ZXIrMHgzMzAvMHg2MDgKWyAgMTE4LjE4MjQ3MV0gIGRyaXZlcl9yZWdpc3RlcisweDE0MC8weDM4 OApbICAxMTguMTg2MzYxXSAgX19wbGF0Zm9ybV9kcml2ZXJfcmVnaXN0ZXIrMHhjOC8weDEwOApb ICAxMTguMTkxMTE3XSAgbWVzb25fZHdfaGRtaV9wbGF0Zm9ybV9kcml2ZXJfaW5pdCsweDFjLzB4 MTAwMCBbbWVzb25fZHdfaGRtaV0KWyAgMTE4LjE5ODAyMl0gIGRvX29uZV9pbml0Y2FsbCsweDEy Yy8weDNiYwpbICAxMTguMjAxODgzXSAgZG9faW5pdF9tb2R1bGUrMHgxZmMvMHg2MzgKWyAgMTE4 LjIwNTY3M10gIGxvYWRfbW9kdWxlKzB4NGI0Yy8weDY4MDgKWyAgMTE4LjIwOTM4N10gIF9fc2Vf c3lzX2luaXRfbW9kdWxlKzB4MmU4LzB4M2MwClsgIDExOC4yMTM2OTldICBfX2FybTY0X3N5c19p bml0X21vZHVsZSsweDY4LzB4OTgKWyAgMTE4LjIxODEwMF0gIGVsMF9zdmNfY29tbW9uKzB4MTA0 LzB4MjEwClsgIDExOC4yMjE4OTNdICBlbDBfc3ZjX2hhbmRsZXIrMHg0OC8weGI4ClsgIDExOC4y MjU1OTRdICBlbDBfc3ZjKzB4OC8weGMKWyAgMTE4LjIyODQyOV0KWyAgMTE4LjIyOTg4N10gVGhl IGJ1Z2d5IGFkZHJlc3MgYmVsb25ncyB0byB0aGUgdmFyaWFibGU6ClsgIDExOC4yMzUwMDddICBl b3RmXzMzX2xpbmVhcl9tYXBwaW5nKzB4ODQvMHhjMApbICAxMTguMjM5MzAxXQpbICAxMTguMjQw NzUyXSBNZW1vcnkgc3RhdGUgYXJvdW5kIHRoZSBidWdneSBhZGRyZXNzOgpbICAxMTguMjQ1NTIy XSAgZmZmZjIwMDAwYTYzY2QwMDogMDAgMDAgMDAgMDAgMDAgMDAgMDAgMDAgMDAgMDAgMDAgMDAg MDAgMDAgMDAgMDAKWyAgMTE4LjI1MjY5NV0gIGZmZmYyMDAwMGE2M2NkODA6IDAwIDAwIDAwIDAw IDAwIDAwIDAwIDAwIDAwIDAwIDAwIDAwIDAwIDAwIDAwIDAwClsgIDExOC4yNTk4NTBdID5mZmZm MjAwMDBhNjNjZTAwOiAwMCAwMCAwMCAwMCAwNCBmYSBmYSBmYSBmYSBmYSBmYSBmYSAwMCAwMCAw MCAwMApbICAxMTguMjY3MDAwXSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgXgpbICAx MTguMjcxMjIyXSAgZmZmZjIwMDAwYTYzY2U4MDogMDAgZmEgZmEgZmEgZmEgZmEgZmEgZmEgMDAg MDAgMDAgMDAgMDAgMDAgMDAgMDAKWyAgMTE4LjI3ODM5M10gIGZmZmYyMDAwMGE2M2NmMDA6IDAw IDAwIDAwIDAwIDAwIDAwIDAwIDAwIDAwIDAwIDAwIDAwIDA0IGZhIGZhIGZhClsgIDExOC4yODU1 NDJdID09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PQpbICAxMTguMjkyNjk5XSBEaXNhYmxpbmcgbG9jayBkZWJ1Z2dpbmcgZHVl IHRvIGtlcm5lbCB0YWludAoKSXQgc2VlbXMgdGhhdCB3aGVuIGxvb3BpbmcgdGhyb3VnaCB0aGUg T1NEIEVPVEYgTFVUIG1hcHMsIHdlIHVzZSB0aGUKc2FtZSBtYXggaXRlcmF0b3IgZm9yIE9FVEY6 IDIwLiBUaGlzIGlzIHdyb25nIHRob3VnaCwgc2luY2UgMjAqMiBpcyA0MCwKd2hpY2ggbWVhbnMg dGhhdCB3ZSdsbCBzdG9wIG91dCBvZiBib3VuZHMgb24gdGhlIEVPVEYgbWFwcy4KCkJ1dCwgdGhp cyB3aG9sZSB0aGluZyBpcyBhbHJlYWR5IGNvbmZ1c2luZyBlbm91Z2ggdG8gcmVhZCB0aHJvdWdo IGFzLWlzLApzbyBsZXQncyBqdXN0IHJlcGxhY2UgYWxsIG9mIHRoZSBoYXJkY29kZWQgc2l6ZXMg d2l0aApPU0RfKE9FVEYvRU9URilfTFVUX1NJWkUgLyAyLgoKU2lnbmVkLW9mZi1ieTogTHl1ZGUg UGF1bCA8bHl1ZGVAcmVkaGF0LmNvbT4KRml4ZXM6IGJiYmU3NzVlYzViNSAoImRybTogQWRkIHN1 cHBvcnQgZm9yIEFtbG9naWMgTWVzb24gR3JhcGhpYyBDb250cm9sbGVyIikKQ2M6IE5laWwgQXJt c3Ryb25nIDxuYXJtc3Ryb25nQGJheWxpYnJlLmNvbT4KQ2M6IE1heGltZSBSaXBhcmQgPG1heGlt ZS5yaXBhcmRAYm9vdGxpbi5jb20+CkNjOiBDYXJsbyBDYWlvbmUgPGNhcmxvQGNhaW9uZS5vcmc+ CkNjOiBLZXZpbiBIaWxtYW4gPGtoaWxtYW5AYmF5bGlicmUuY29tPgpDYzogZHJpLWRldmVsQGxp c3RzLmZyZWVkZXNrdG9wLm9yZwpDYzogbGludXgtYW1sb2dpY0BsaXN0cy5pbmZyYWRlYWQub3Jn CkNjOiBsaW51eC1hcm0ta2VybmVsQGxpc3RzLmluZnJhZGVhZC5vcmcKQ2M6IDxzdGFibGVAdmdl ci5rZXJuZWwub3JnPiAjIHY0LjEwKwpBY2tlZC1ieTogTmVpbCBBcm1zdHJvbmcgPG5hcm1zdHJv bmdAYmF5bGlicmUuY29tPgpTaWduZWQtb2ZmLWJ5OiBOZWlsIEFybXN0cm9uZyA8bmFybXN0cm9u Z0BiYXlsaWJyZS5jb20+Ckxpbms6IGh0dHBzOi8vcGF0Y2h3b3JrLmZyZWVkZXNrdG9wLm9yZy9w YXRjaC9tc2dpZC8yMDE4MTEyNTAxMjExNy4zMTkxNS0xLWx5dWRlQHJlZGhhdC5jb20KU2lnbmVk LW9mZi1ieTogU2VhbiBQYXVsIDxzZWFucGF1bEBjaHJvbWl1bS5vcmc+ClNpZ25lZC1vZmYtYnk6 IEdyZWcgS3JvYWgtSGFydG1hbiA8Z3JlZ2toQGxpbnV4Zm91bmRhdGlvbi5vcmc+CgotLS0KIGRy aXZlcnMvZ3B1L2RybS9tZXNvbi9tZXNvbl92aXUuYyB8ICAgMTIgKysrKysrLS0tLS0tCiAxIGZp bGUgY2hhbmdlZCwgNiBpbnNlcnRpb25zKCspLCA2IGRlbGV0aW9ucygtKQoKLS0tIGEvZHJpdmVy cy9ncHUvZHJtL21lc29uL21lc29uX3ZpdS5jCisrKyBiL2RyaXZlcnMvZ3B1L2RybS9tZXNvbi9t ZXNvbl92aXUuYwpAQCAtMTg0LDE4ICsxODQsMTggQEAgdm9pZCBtZXNvbl92aXVfc2V0X29zZF9s dXQoc3RydWN0IG1lc29uXwogCWlmIChsdXRfc2VsID09IFZJVV9MVVRfT1NEX09FVEYpIHsKIAkJ d3JpdGVsKDAsIHByaXYtPmlvX2Jhc2UgKyBfUkVHKGFkZHJfcG9ydCkpOwogCi0JCWZvciAoaSA9 IDA7IGkgPCAyMDsgaSsrKQorCQlmb3IgKGkgPSAwOyBpIDwgKE9TRF9PRVRGX0xVVF9TSVpFIC8g Mik7IGkrKykKIAkJCXdyaXRlbChyX21hcFtpICogMl0gfCAocl9tYXBbaSAqIDIgKyAxXSA8PCAx NiksCiAJCQkJcHJpdi0+aW9fYmFzZSArIF9SRUcoZGF0YV9wb3J0KSk7CiAKIAkJd3JpdGVsKHJf bWFwW09TRF9PRVRGX0xVVF9TSVpFIC0gMV0gfCAoZ19tYXBbMF0gPDwgMTYpLAogCQkJcHJpdi0+ aW9fYmFzZSArIF9SRUcoZGF0YV9wb3J0KSk7CiAKLQkJZm9yIChpID0gMDsgaSA8IDIwOyBpKysp CisJCWZvciAoaSA9IDA7IGkgPCAoT1NEX09FVEZfTFVUX1NJWkUgLyAyKTsgaSsrKQogCQkJd3Jp dGVsKGdfbWFwW2kgKiAyICsgMV0gfCAoZ19tYXBbaSAqIDIgKyAyXSA8PCAxNiksCiAJCQkJcHJp di0+aW9fYmFzZSArIF9SRUcoZGF0YV9wb3J0KSk7CiAKLQkJZm9yIChpID0gMDsgaSA8IDIwOyBp KyspCisJCWZvciAoaSA9IDA7IGkgPCAoT1NEX09FVEZfTFVUX1NJWkUgLyAyKTsgaSsrKQogCQkJ d3JpdGVsKGJfbWFwW2kgKiAyXSB8IChiX21hcFtpICogMiArIDFdIDw8IDE2KSwKIAkJCQlwcml2 LT5pb19iYXNlICsgX1JFRyhkYXRhX3BvcnQpKTsKIApAQCAtMjExLDE4ICsyMTEsMTggQEAgdm9p ZCBtZXNvbl92aXVfc2V0X29zZF9sdXQoc3RydWN0IG1lc29uXwogCX0gZWxzZSBpZiAobHV0X3Nl bCA9PSBWSVVfTFVUX09TRF9FT1RGKSB7CiAJCXdyaXRlbCgwLCBwcml2LT5pb19iYXNlICsgX1JF RyhhZGRyX3BvcnQpKTsKIAotCQlmb3IgKGkgPSAwOyBpIDwgMjA7IGkrKykKKwkJZm9yIChpID0g MDsgaSA8IChPU0RfRU9URl9MVVRfU0laRSAvIDIpOyBpKyspCiAJCQl3cml0ZWwocl9tYXBbaSAq IDJdIHwgKHJfbWFwW2kgKiAyICsgMV0gPDwgMTYpLAogCQkJCXByaXYtPmlvX2Jhc2UgKyBfUkVH KGRhdGFfcG9ydCkpOwogCiAJCXdyaXRlbChyX21hcFtPU0RfRU9URl9MVVRfU0laRSAtIDFdIHwg KGdfbWFwWzBdIDw8IDE2KSwKIAkJCXByaXYtPmlvX2Jhc2UgKyBfUkVHKGRhdGFfcG9ydCkpOwog Ci0JCWZvciAoaSA9IDA7IGkgPCAyMDsgaSsrKQorCQlmb3IgKGkgPSAwOyBpIDwgKE9TRF9FT1RG X0xVVF9TSVpFIC8gMik7IGkrKykKIAkJCXdyaXRlbChnX21hcFtpICogMiArIDFdIHwgKGdfbWFw W2kgKiAyICsgMl0gPDwgMTYpLAogCQkJCXByaXYtPmlvX2Jhc2UgKyBfUkVHKGRhdGFfcG9ydCkp OwogCi0JCWZvciAoaSA9IDA7IGkgPCAyMDsgaSsrKQorCQlmb3IgKGkgPSAwOyBpIDwgKE9TRF9F T1RGX0xVVF9TSVpFIC8gMik7IGkrKykKIAkJCXdyaXRlbChiX21hcFtpICogMl0gfCAoYl9tYXBb aSAqIDIgKyAxXSA8PCAxNiksCiAJCQkJcHJpdi0+aW9fYmFzZSArIF9SRUcoZGF0YV9wb3J0KSk7 CiAKCgpQYXRjaGVzIGN1cnJlbnRseSBpbiBzdGFibGUtcXVldWUgd2hpY2ggbWlnaHQgYmUgZnJv bSBseXVkZUByZWRoYXQuY29tIGFyZQoKcXVldWUtNC4xNC9kcm0tbWVzb24tZW5hYmxlLWZhc3Rf aW8taW4tbWVzb25fZHdfaGRtaV9yZWdtYXBfY29uZmlnLnBhdGNoCnF1ZXVlLTQuMTQvZHJtLW1l c29uLWZpeC1vb2ItbWVtb3J5LWFjY2Vzc2VzLWluLW1lc29uX3ZpdV9zZXRfb3NkX2x1dC5wYXRj aApfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXwpkcmktZGV2 ZWwgbWFpbGluZyBsaXN0CmRyaS1kZXZlbEBsaXN0cy5mcmVlZGVza3RvcC5vcmcKaHR0cHM6Ly9s aXN0cy5mcmVlZGVza3RvcC5vcmcvbWFpbG1hbi9saXN0aW5mby9kcmktZGV2ZWwK