From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id BD9C83C07A for ; Sat, 30 May 2026 10:25:54 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780136755; cv=none; b=hENJ3UjmhSpfxoo0Zk2CDhY9TVhgdaUiUS9yabTjmb9mGBRtvBeiApRH13Z/UE8z8gQU1FufWF1bdK2zGp0EkoQ223A++JXUeIxTV/ZHdz7FJo7tVcqm11hZzm750BtoHZ5H+MXzcSKTkGgk2MKsFKDIWxAQ4Qof69QMuAHptlY= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780136755; c=relaxed/simple; bh=84z7UbrGG3QhcmKxXrbeKv3GohmKry79PQOICCf6PaY=; h=From:Subject:To:Cc:In-Reply-To:References:Content-Type:Date: Message-Id; b=kNwaS5K+jbPP9PVNSJnSFC6VPHSwc3Ry+EQCHftVSIdBxObaxAhsHTwZY1aKHcHOUyenh/Ng32pCRIXlabl1dNiTaet4JlEFW8fwBHl7AomXtDyyOtjCiWbIKPFo5IML8Flp4CTs7jkWioNsq2qcFAK0egubrr3MVXK4JSgYRhg= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=oa9v4BjE; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="oa9v4BjE" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 313521F00893; Sat, 30 May 2026 10:25:54 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1780136754; bh=jb7FEho4r1FnX92vNBd0/x1NFCRUuF8GjhHLYvYA8OM=; h=From:Subject:Reply-To:To:Cc:In-Reply-To:References:Date; b=oa9v4BjEvyptAgCmpl59iq8ux1ZruLtjcqduOhejixEaTTamJvVm5NrnyfjWK4iTH WUHcT0SjKq3ZkS5CkSDibF7wWpFVlR5ySM03qOPXVME/WX6kFhhBb7J+BPnAA2gwdg Cq0gpdrrxWbk1gYHavufdVR/gHow0s8/y+lqcOPC+jmcqup/DscB5OI0wE2fDd5J2H mfzNvGdYQis0f0VnwbeOhBqbSe6BBEIXCyyyH4dKDk9nQ3Aak0a0oTVqFRzhmxJoVI F8aa6IFDhVou6NIklKxyu7htXjC9Aw/ec59RcrPiLhBKq+9Day8Zv9MXpb1q2JsRi2 5tyci8WwzLvBw== From: sashiko-bot@kernel.org Subject: Re: [PATCH v6 3/8] media: meson: vdec: Handle kthread failure and free codec state Reply-To: sashiko-reviews@lists.linux.dev To: "Anand Moon" Cc: neil.armstrong@linaro.org, linux-media@vger.kernel.org, linux-amlogic@lists.infradead.org In-Reply-To: <20260530094326.11892-4-linux.amoon@gmail.com> References: <20260530094326.11892-4-linux.amoon@gmail.com> Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Date: Sat, 30 May 2026 10:25:53 +0000 Message-Id: <20260530102554.313521F00893@smtp.kernel.org> Precedence: bulk X-Mailing-List: linux-media@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Thank you for your contribution! Sashiko AI review found 3 potential issue(= s) to consider: New issues: - [Critical] Double-free of DMA buffers in the new err_cleanup path due to = a redundant codec_ops->stop(sess) call. Pre-existing issues: - [Critical] Clearing the hardware ownership token `core->cur_sess` before = executing `vdec_poweroff(sess)` creates a critical data race with concurren= t sessions. - [High] The concurrent locking patch destroys the STATUS_NEEDS_RESUME stat= e, leading to massive memory leaks during dynamic resolution changes. -- commit fd226e8b0810c7234d383bfb2d7ea8c103056049 Author: Anand Moon media: meson: vdec: Handle kthread failure and free codec state =20 vdec_start_streaming() launches a recycle thread when required by the codec. If kthread_run() fails, the previous error path only powered off the hardware, leaving sess->priv and codec state allocated. This caused a permanent leak of the codec context and associated DMA buffers. =20 Fix this by introducing a dedicated err_cleanup path: - Call codec_ops->stop() to release the codec context and clear sess->priv. - Power off the hardware before freeing buffers to avoid DMA faults. - Free canvas IDs explicitly and set sess->vififo_vaddr =3D NULL after dma_free_coherent() to guard against double=E2=80=91free in fallback stop= paths. - Reset core->cur_sess and sess->status to prevent stale references. Following change closes the memory leak on kthread_run() failure and ensures robust cleanup of codec resources in both error and stop paths. Closes: https://lore.kernel.org/all/20260521090944.F35401F00A3D@smtp.kernel= .org/ Fixes: 3e7f51bd9607 ("media: meson: add v4l2 m2m video decoder driver") > diff --git a/drivers/staging/media/meson/vdec/vdec.c b/drivers/staging/me= dia/meson/vdec/vdec.c > index 7233000e22323..8a5bf1a96830c 100644 > --- a/drivers/staging/media/meson/vdec/vdec.c > +++ b/drivers/staging/media/meson/vdec/vdec.c [ ... ] > @@ -352,16 +354,31 @@ static int vdec_start_streaming(struct vb2_queue *q= , unsigned int count) > =20 > sess->sequence_cap =3D 0; > sess->sequence_out =3D 0; > - if (vdec_codec_needs_recycle(sess)) > + if (vdec_codec_needs_recycle(sess)) { > sess->recycle_thread =3D kthread_run(vdec_recycle_thread, sess, > "vdec_recycle"); > + if (IS_ERR(sess->recycle_thread)) { > + ret =3D PTR_ERR(sess->recycle_thread); > + sess->recycle_thread =3D NULL; > + goto err_cleanup; > + } > + } > =20 > schedule_work(&sess->esparser_queue_work); > return 0; > =20 > +err_cleanup: > + vdec_free_canvas(sess); > + vdec_poweroff(sess); > + if (codec_ops && codec_ops->stop && sess->priv) { > + codec_ops->stop(sess); [Severity: Critical] Does this explicitly call codec_ops->stop() a second time, resulting in a double-free of the codec DMA memory? Looking at vdec_poweroff() called just above, it internally delegates to vdec_ops->stop(), which invokes codec_ops->stop(). Codec stop callbacks free their DMA buffers via dma_free_coherent() but do not set the pointers to NULL. If it is called again here, wouldn't it attempt to free them a second time? > + kfree(sess->priv); > + sess->priv =3D NULL; > + } > vififo_free: > dma_free_coherent(sess->core->dev, sess->vififo_size, > sess->vififo_vaddr, sess->vififo_paddr); > + sess->vififo_vaddr =3D NULL; > bufs_done: [ ... ] > @@ -441,8 +458,11 @@ static void vdec_stop_streaming(struct vb2_queue *q) > =20 > vdec_poweroff(sess); [Severity: Critical] This is a pre-existing issue, but could clearing the hardware ownership tok= en before executing vdec_poweroff() create a data race with concurrent session= s? Looking earlier in vdec_stop_streaming(), core->cur_sess =3D NULL is set inside the mutex, but vdec_poweroff(sess) is executed here after the mutex is dropped: mutex_lock(&core->lock); if (core->cur_sess =3D=3D sess) core->cur_sess =3D NULL; mutex_unlock(&core->lock); ... vdec_poweroff(sess); This allows a concurrent vdec_start_streaming() from another context to acquire the lock, claim ownership, and call vdec_poweron(). Since vdec_poweron() and vdec_poweroff() would execute concurrently on different sessions, is it possible they will read and write to the exact same global hardware registers and corrupt the shared hardware state? > vdec_free_canvas(sess); > - dma_free_coherent(sess->core->dev, sess->vififo_size, > - sess->vififo_vaddr, sess->vififo_paddr); > + if (sess->vififo_vaddr) { > + dma_free_coherent(sess->core->dev, sess->vififo_size, > + sess->vififo_vaddr, > + sess->vififo_paddr); > + } > vdec_reset_timestamps(sess); > vdec_reset_bufs_recycle(sess); > kfree(sess->priv); [Severity: High] This isn't a bug introduced by this patch, but does the recent change to concurrent locking destroy the STATUS_NEEDS_RESUME state? Earlier in vdec_stop_streaming(), sess->status is unconditionally overwritt= en to STATUS_STOPPED inside the mutex lock: mutex_lock(&core->lock); old_status =3D sess->status; sess->status =3D STATUS_STOPPED; mutex_unlock(&core->lock); When the CAPTURE queue is stopped during a source resolution change, the hardware cleanup block is intentionally skipped because old_status is STATUS_NEEDS_RESUME. However, when vdec_start_streaming() is later called to resume the CAPTURE queue, it expects sess->status =3D=3D STATUS_NEEDS_RESUM= E. Since it was forced to STATUS_STOPPED, will the resume check fail and cause the driver to incorrectly fall through to full initialization, executing dma_alloc_coherent() over the existing sess->vififo_vaddr and leaking memory? --=20 Sashiko AI review =C2=B7 https://sashiko.dev/#/patchset/20260530094326.1189= 2-1-linux.amoon@gmail.com?part=3D3 From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id BCF79CD5BD0 for ; Sat, 30 May 2026 10:26:06 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:MIME-Version:Reply-To:List-Subscribe: List-Help:List-Post:List-Archive:List-Unsubscribe:List-Id:Message-Id:Date: References:In-Reply-To:Cc:To:Subject:From:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: List-Owner; bh=GBljgjFiUDQ1ojQbLOzErF9LcAvd9HJbB7v3rHL67cE=; b=NmWQqrR4M+QFb7 lks6bFngkne1MtB9M2CMT/Qicwj/7nj/8k2usmCV3831lgoziMauwisG4p8t68c6bibhvRGCe0kmk NxoaOCPKFs7z2X8RDFLFJbgFgDNNZpsOkha2eBoocHANP/2o1rr0hOXE9O3+mMzMszqWHe2pP1fMV jcwJ6IoOAKmIyU9SSzZlgFjTTTBalY7LkqX41lm0/Of6qLPQH3QJJ3Oe2rg48BdlkvjPL5Meuauns ZgOp0mvj5fhlPA3Y5q6ywSgBU6LAbbLFXXJ5IzaUOZ/85s4DkYyLrrqApVUR+YoOvSkdLV4mOXg1y F7h76drlaJARk+7z+6RA==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.99.1 #2 (Red Hat Linux)) id 1wTGtD-00000008d4t-1ASG; Sat, 30 May 2026 10:25:59 +0000 Received: from tor.source.kernel.org ([172.105.4.254]) by bombadil.infradead.org with esmtps (Exim 4.99.1 #2 (Red Hat Linux)) id 1wTGt9-00000008d3w-207L for linux-amlogic@lists.infradead.org; Sat, 30 May 2026 10:25:55 +0000 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) by tor.source.kernel.org (Postfix) with ESMTP id B5B8260103; Sat, 30 May 2026 10:25:54 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 313521F00893; Sat, 30 May 2026 10:25:54 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1780136754; bh=jb7FEho4r1FnX92vNBd0/x1NFCRUuF8GjhHLYvYA8OM=; h=From:Subject:Reply-To:To:Cc:In-Reply-To:References:Date; b=oa9v4BjEvyptAgCmpl59iq8ux1ZruLtjcqduOhejixEaTTamJvVm5NrnyfjWK4iTH WUHcT0SjKq3ZkS5CkSDibF7wWpFVlR5ySM03qOPXVME/WX6kFhhBb7J+BPnAA2gwdg Cq0gpdrrxWbk1gYHavufdVR/gHow0s8/y+lqcOPC+jmcqup/DscB5OI0wE2fDd5J2H mfzNvGdYQis0f0VnwbeOhBqbSe6BBEIXCyyyH4dKDk9nQ3Aak0a0oTVqFRzhmxJoVI F8aa6IFDhVou6NIklKxyu7htXjC9Aw/ec59RcrPiLhBKq+9Day8Zv9MXpb1q2JsRi2 5tyci8WwzLvBw== From: sashiko-bot@kernel.org Subject: Re: [PATCH v6 3/8] media: meson: vdec: Handle kthread failure and free codec state To: "Anand Moon" Cc: neil.armstrong@linaro.org, linux-media@vger.kernel.org, linux-amlogic@lists.infradead.org In-Reply-To: <20260530094326.11892-4-linux.amoon@gmail.com> References: <20260530094326.11892-4-linux.amoon@gmail.com> Date: Sat, 30 May 2026 10:25:53 +0000 Message-Id: <20260530102554.313521F00893@smtp.kernel.org> X-BeenThere: linux-amlogic@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: sashiko-reviews@lists.linux.dev MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 Sender: "linux-amlogic" Errors-To: linux-amlogic-bounces+linux-amlogic=archiver.kernel.org@lists.infradead.org VGhhbmsgeW91IGZvciB5b3VyIGNvbnRyaWJ1dGlvbiEgU2FzaGlrbyBBSSByZXZpZXcgZm91bmQg MyBwb3RlbnRpYWwgaXNzdWUocykgdG8gY29uc2lkZXI6CgpOZXcgaXNzdWVzOgotIFtDcml0aWNh bF0gRG91YmxlLWZyZWUgb2YgRE1BIGJ1ZmZlcnMgaW4gdGhlIG5ldyBlcnJfY2xlYW51cCBwYXRo IGR1ZSB0byBhIHJlZHVuZGFudCBjb2RlY19vcHMtPnN0b3Aoc2VzcykgY2FsbC4KClByZS1leGlz dGluZyBpc3N1ZXM6Ci0gW0NyaXRpY2FsXSBDbGVhcmluZyB0aGUgaGFyZHdhcmUgb3duZXJzaGlw IHRva2VuIGBjb3JlLT5jdXJfc2Vzc2AgYmVmb3JlIGV4ZWN1dGluZyBgdmRlY19wb3dlcm9mZihz ZXNzKWAgY3JlYXRlcyBhIGNyaXRpY2FsIGRhdGEgcmFjZSB3aXRoIGNvbmN1cnJlbnQgc2Vzc2lv bnMuCi0gW0hpZ2hdIFRoZSBjb25jdXJyZW50IGxvY2tpbmcgcGF0Y2ggZGVzdHJveXMgdGhlIFNU QVRVU19ORUVEU19SRVNVTUUgc3RhdGUsIGxlYWRpbmcgdG8gbWFzc2l2ZSBtZW1vcnkgbGVha3Mg ZHVyaW5nIGR5bmFtaWMgcmVzb2x1dGlvbiBjaGFuZ2VzLgotLQoKY29tbWl0IGZkMjI2ZThiMDgx MGM3MjM0ZDM4M2JmYjJkN2VhOGMxMDMwNTYwNDkKQXV0aG9yOiBBbmFuZCBNb29uIDxsaW51eC5h bW9vbkBnbWFpbC5jb20+CgptZWRpYTogbWVzb246IHZkZWM6IEhhbmRsZSBrdGhyZWFkIGZhaWx1 cmUgYW5kIGZyZWUgY29kZWMgc3RhdGUKICAgIAp2ZGVjX3N0YXJ0X3N0cmVhbWluZygpIGxhdW5j aGVzIGEgcmVjeWNsZSB0aHJlYWQgd2hlbiByZXF1aXJlZCBieSB0aGUKY29kZWMuIElmIGt0aHJl YWRfcnVuKCkgZmFpbHMsIHRoZSBwcmV2aW91cyBlcnJvciBwYXRoIG9ubHkgcG93ZXJlZCBvZmYK dGhlIGhhcmR3YXJlLCBsZWF2aW5nIHNlc3MtPnByaXYgYW5kIGNvZGVjIHN0YXRlIGFsbG9jYXRl ZC4gVGhpcyBjYXVzZWQKYSBwZXJtYW5lbnQgbGVhayBvZiB0aGUgY29kZWMgY29udGV4dCBhbmQg YXNzb2NpYXRlZCBETUEgYnVmZmVycy4KICAgIApGaXggdGhpcyBieSBpbnRyb2R1Y2luZyBhIGRl ZGljYXRlZCBlcnJfY2xlYW51cCBwYXRoOgoKLSBDYWxsIGNvZGVjX29wcy0+c3RvcCgpIHRvIHJl bGVhc2UgdGhlIGNvZGVjIGNvbnRleHQgYW5kIGNsZWFyIHNlc3MtPnByaXYuCi0gUG93ZXIgb2Zm IHRoZSBoYXJkd2FyZSBiZWZvcmUgZnJlZWluZyBidWZmZXJzIHRvIGF2b2lkIERNQSBmYXVsdHMu Ci0gRnJlZSBjYW52YXMgSURzIGV4cGxpY2l0bHkgYW5kIHNldCBzZXNzLT52aWZpZm9fdmFkZHIg PSBOVUxMIGFmdGVyCiAgZG1hX2ZyZWVfY29oZXJlbnQoKSB0byBndWFyZCBhZ2FpbnN0IGRvdWJs ZeKAkWZyZWUgaW4gZmFsbGJhY2sgc3RvcCBwYXRocy4KLSBSZXNldCBjb3JlLT5jdXJfc2VzcyBh bmQgc2Vzcy0+c3RhdHVzIHRvIHByZXZlbnQgc3RhbGUgcmVmZXJlbmNlcy4KCkZvbGxvd2luZyBj aGFuZ2UgY2xvc2VzIHRoZSBtZW1vcnkgbGVhayBvbiBrdGhyZWFkX3J1bigpIGZhaWx1cmUgYW5k IGVuc3VyZXMKcm9idXN0IGNsZWFudXAgb2YgY29kZWMgcmVzb3VyY2VzIGluIGJvdGggZXJyb3Ig YW5kIHN0b3AgcGF0aHMuCgpDbG9zZXM6IGh0dHBzOi8vbG9yZS5rZXJuZWwub3JnL2FsbC8yMDI2 MDUyMTA5MDk0NC5GMzU0MDFGMDBBM0RAc210cC5rZXJuZWwub3JnLwpGaXhlczogM2U3ZjUxYmQ5 NjA3ICgibWVkaWE6IG1lc29uOiBhZGQgdjRsMiBtMm0gdmlkZW8gZGVjb2RlciBkcml2ZXIiKQoK PiBkaWZmIC0tZ2l0IGEvZHJpdmVycy9zdGFnaW5nL21lZGlhL21lc29uL3ZkZWMvdmRlYy5jIGIv ZHJpdmVycy9zdGFnaW5nL21lZGlhL21lc29uL3ZkZWMvdmRlYy5jCj4gaW5kZXggNzIzMzAwMGUy MjMyMy4uOGE1YmYxYTk2ODMwYyAxMDA2NDQKPiAtLS0gYS9kcml2ZXJzL3N0YWdpbmcvbWVkaWEv bWVzb24vdmRlYy92ZGVjLmMKPiArKysgYi9kcml2ZXJzL3N0YWdpbmcvbWVkaWEvbWVzb24vdmRl Yy92ZGVjLmMKClsgLi4uIF0KCj4gQEAgLTM1MiwxNiArMzU0LDMxIEBAIHN0YXRpYyBpbnQgdmRl Y19zdGFydF9zdHJlYW1pbmcoc3RydWN0IHZiMl9xdWV1ZSAqcSwgdW5zaWduZWQgaW50IGNvdW50 KQo+ICAKPiAgCXNlc3MtPnNlcXVlbmNlX2NhcCA9IDA7Cj4gIAlzZXNzLT5zZXF1ZW5jZV9vdXQg PSAwOwo+IC0JaWYgKHZkZWNfY29kZWNfbmVlZHNfcmVjeWNsZShzZXNzKSkKPiArCWlmICh2ZGVj X2NvZGVjX25lZWRzX3JlY3ljbGUoc2VzcykpIHsKPiAgCQlzZXNzLT5yZWN5Y2xlX3RocmVhZCA9 IGt0aHJlYWRfcnVuKHZkZWNfcmVjeWNsZV90aHJlYWQsIHNlc3MsCj4gIAkJCQkJCSAgICJ2ZGVj X3JlY3ljbGUiKTsKPiArCQlpZiAoSVNfRVJSKHNlc3MtPnJlY3ljbGVfdGhyZWFkKSkgewo+ICsJ CQlyZXQgPSBQVFJfRVJSKHNlc3MtPnJlY3ljbGVfdGhyZWFkKTsKPiArCQkJc2Vzcy0+cmVjeWNs ZV90aHJlYWQgPSBOVUxMOwo+ICsJCQlnb3RvIGVycl9jbGVhbnVwOwo+ICsJCX0KPiArCX0KPiAg Cj4gIAlzY2hlZHVsZV93b3JrKCZzZXNzLT5lc3BhcnNlcl9xdWV1ZV93b3JrKTsKPiAgCXJldHVy biAwOwo+ICAKPiArZXJyX2NsZWFudXA6Cj4gKwl2ZGVjX2ZyZWVfY2FudmFzKHNlc3MpOwo+ICsJ dmRlY19wb3dlcm9mZihzZXNzKTsKPiArCWlmIChjb2RlY19vcHMgJiYgY29kZWNfb3BzLT5zdG9w ICYmIHNlc3MtPnByaXYpIHsKPiArCQljb2RlY19vcHMtPnN0b3Aoc2Vzcyk7CgpbU2V2ZXJpdHk6 IENyaXRpY2FsXQpEb2VzIHRoaXMgZXhwbGljaXRseSBjYWxsIGNvZGVjX29wcy0+c3RvcCgpIGEg c2Vjb25kIHRpbWUsIHJlc3VsdGluZyBpbiBhCmRvdWJsZS1mcmVlIG9mIHRoZSBjb2RlYyBETUEg bWVtb3J5PwoKTG9va2luZyBhdCB2ZGVjX3Bvd2Vyb2ZmKCkgY2FsbGVkIGp1c3QgYWJvdmUsIGl0 IGludGVybmFsbHkgZGVsZWdhdGVzIHRvCnZkZWNfb3BzLT5zdG9wKCksIHdoaWNoIGludm9rZXMg Y29kZWNfb3BzLT5zdG9wKCkuIENvZGVjIHN0b3AgY2FsbGJhY2tzCmZyZWUgdGhlaXIgRE1BIGJ1 ZmZlcnMgdmlhIGRtYV9mcmVlX2NvaGVyZW50KCkgYnV0IGRvIG5vdCBzZXQgdGhlCnBvaW50ZXJz IHRvIE5VTEwuIElmIGl0IGlzIGNhbGxlZCBhZ2FpbiBoZXJlLCB3b3VsZG4ndCBpdCBhdHRlbXB0 IHRvIGZyZWUKdGhlbSBhIHNlY29uZCB0aW1lPwoKPiArCQlrZnJlZShzZXNzLT5wcml2KTsKPiAr CQlzZXNzLT5wcml2ID0gTlVMTDsKPiArCX0KPiAgdmlmaWZvX2ZyZWU6Cj4gIAlkbWFfZnJlZV9j b2hlcmVudChzZXNzLT5jb3JlLT5kZXYsIHNlc3MtPnZpZmlmb19zaXplLAo+ICAJCQkgIHNlc3Mt PnZpZmlmb192YWRkciwgc2Vzcy0+dmlmaWZvX3BhZGRyKTsKPiArCXNlc3MtPnZpZmlmb192YWRk ciA9IE5VTEw7Cj4gIGJ1ZnNfZG9uZToKClsgLi4uIF0KCj4gQEAgLTQ0MSw4ICs0NTgsMTEgQEAg c3RhdGljIHZvaWQgdmRlY19zdG9wX3N0cmVhbWluZyhzdHJ1Y3QgdmIyX3F1ZXVlICpxKQo+ICAK PiAgCQl2ZGVjX3Bvd2Vyb2ZmKHNlc3MpOwoKW1NldmVyaXR5OiBDcml0aWNhbF0KVGhpcyBpcyBh IHByZS1leGlzdGluZyBpc3N1ZSwgYnV0IGNvdWxkIGNsZWFyaW5nIHRoZSBoYXJkd2FyZSBvd25l cnNoaXAgdG9rZW4KYmVmb3JlIGV4ZWN1dGluZyB2ZGVjX3Bvd2Vyb2ZmKCkgY3JlYXRlIGEgZGF0 YSByYWNlIHdpdGggY29uY3VycmVudCBzZXNzaW9ucz8KCkxvb2tpbmcgZWFybGllciBpbiB2ZGVj X3N0b3Bfc3RyZWFtaW5nKCksIGNvcmUtPmN1cl9zZXNzID0gTlVMTCBpcyBzZXQKaW5zaWRlIHRo ZSBtdXRleCwgYnV0IHZkZWNfcG93ZXJvZmYoc2VzcykgaXMgZXhlY3V0ZWQgaGVyZSBhZnRlciB0 aGUgbXV0ZXgKaXMgZHJvcHBlZDoKCgltdXRleF9sb2NrKCZjb3JlLT5sb2NrKTsKCWlmIChjb3Jl LT5jdXJfc2VzcyA9PSBzZXNzKQoJCWNvcmUtPmN1cl9zZXNzID0gTlVMTDsKCW11dGV4X3VubG9j aygmY29yZS0+bG9jayk7CiAgICAuLi4KCXZkZWNfcG93ZXJvZmYoc2Vzcyk7CgpUaGlzIGFsbG93 cyBhIGNvbmN1cnJlbnQgdmRlY19zdGFydF9zdHJlYW1pbmcoKSBmcm9tIGFub3RoZXIgY29udGV4 dCB0bwphY3F1aXJlIHRoZSBsb2NrLCBjbGFpbSBvd25lcnNoaXAsIGFuZCBjYWxsIHZkZWNfcG93 ZXJvbigpLiBTaW5jZQp2ZGVjX3Bvd2Vyb24oKSBhbmQgdmRlY19wb3dlcm9mZigpIHdvdWxkIGV4 ZWN1dGUgY29uY3VycmVudGx5IG9uIGRpZmZlcmVudApzZXNzaW9ucywgaXMgaXQgcG9zc2libGUg dGhleSB3aWxsIHJlYWQgYW5kIHdyaXRlIHRvIHRoZSBleGFjdCBzYW1lIGdsb2JhbApoYXJkd2Fy ZSByZWdpc3RlcnMgYW5kIGNvcnJ1cHQgdGhlIHNoYXJlZCBoYXJkd2FyZSBzdGF0ZT8KCj4gIAkJ dmRlY19mcmVlX2NhbnZhcyhzZXNzKTsKPiAtCQlkbWFfZnJlZV9jb2hlcmVudChzZXNzLT5jb3Jl LT5kZXYsIHNlc3MtPnZpZmlmb19zaXplLAo+IC0JCQkJICBzZXNzLT52aWZpZm9fdmFkZHIsIHNl c3MtPnZpZmlmb19wYWRkcik7Cj4gKwkJaWYgKHNlc3MtPnZpZmlmb192YWRkcikgewo+ICsJCQlk bWFfZnJlZV9jb2hlcmVudChzZXNzLT5jb3JlLT5kZXYsIHNlc3MtPnZpZmlmb19zaXplLAo+ICsJ CQkJCSAgc2Vzcy0+dmlmaWZvX3ZhZGRyLAo+ICsJCQkJCSAgc2Vzcy0+dmlmaWZvX3BhZGRyKTsK PiArCQl9Cj4gIAkJdmRlY19yZXNldF90aW1lc3RhbXBzKHNlc3MpOwo+ICAJCXZkZWNfcmVzZXRf YnVmc19yZWN5Y2xlKHNlc3MpOwo+ICAJCWtmcmVlKHNlc3MtPnByaXYpOwoKW1NldmVyaXR5OiBI aWdoXQpUaGlzIGlzbid0IGEgYnVnIGludHJvZHVjZWQgYnkgdGhpcyBwYXRjaCwgYnV0IGRvZXMg dGhlIHJlY2VudCBjaGFuZ2UgdG8KY29uY3VycmVudCBsb2NraW5nIGRlc3Ryb3kgdGhlIFNUQVRV U19ORUVEU19SRVNVTUUgc3RhdGU/CgpFYXJsaWVyIGluIHZkZWNfc3RvcF9zdHJlYW1pbmcoKSwg c2Vzcy0+c3RhdHVzIGlzIHVuY29uZGl0aW9uYWxseSBvdmVyd3JpdHRlbgp0byBTVEFUVVNfU1RP UFBFRCBpbnNpZGUgdGhlIG11dGV4IGxvY2s6CgoJbXV0ZXhfbG9jaygmY29yZS0+bG9jayk7Cglv bGRfc3RhdHVzID0gc2Vzcy0+c3RhdHVzOwoJc2Vzcy0+c3RhdHVzID0gU1RBVFVTX1NUT1BQRUQ7 CgltdXRleF91bmxvY2soJmNvcmUtPmxvY2spOwoKV2hlbiB0aGUgQ0FQVFVSRSBxdWV1ZSBpcyBz dG9wcGVkIGR1cmluZyBhIHNvdXJjZSByZXNvbHV0aW9uIGNoYW5nZSwgdGhlCmhhcmR3YXJlIGNs ZWFudXAgYmxvY2sgaXMgaW50ZW50aW9uYWxseSBza2lwcGVkIGJlY2F1c2Ugb2xkX3N0YXR1cyBp cwpTVEFUVVNfTkVFRFNfUkVTVU1FLiBIb3dldmVyLCB3aGVuIHZkZWNfc3RhcnRfc3RyZWFtaW5n KCkgaXMgbGF0ZXIgY2FsbGVkIHRvCnJlc3VtZSB0aGUgQ0FQVFVSRSBxdWV1ZSwgaXQgZXhwZWN0 cyBzZXNzLT5zdGF0dXMgPT0gU1RBVFVTX05FRURTX1JFU1VNRS4KU2luY2UgaXQgd2FzIGZvcmNl ZCB0byBTVEFUVVNfU1RPUFBFRCwgd2lsbCB0aGUgcmVzdW1lIGNoZWNrIGZhaWwgYW5kIGNhdXNl CnRoZSBkcml2ZXIgdG8gaW5jb3JyZWN0bHkgZmFsbCB0aHJvdWdoIHRvIGZ1bGwgaW5pdGlhbGl6 YXRpb24sIGV4ZWN1dGluZwpkbWFfYWxsb2NfY29oZXJlbnQoKSBvdmVyIHRoZSBleGlzdGluZyBz ZXNzLT52aWZpZm9fdmFkZHIgYW5kIGxlYWtpbmcKbWVtb3J5PwoKLS0gClNhc2hpa28gQUkgcmV2 aWV3IMK3IGh0dHBzOi8vc2FzaGlrby5kZXYvIy9wYXRjaHNldC8yMDI2MDUzMDA5NDMyNi4xMTg5 Mi0xLWxpbnV4LmFtb29uQGdtYWlsLmNvbT9wYXJ0PTMKCl9fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fCmxpbnV4LWFtbG9naWMgbWFpbGluZyBsaXN0CmxpbnV4 LWFtbG9naWNAbGlzdHMuaW5mcmFkZWFkLm9yZwpodHRwOi8vbGlzdHMuaW5mcmFkZWFkLm9yZy9t YWlsbWFuL2xpc3RpbmZvL2xpbnV4LWFtbG9naWMK