From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 38F3EC44507 for ; Mon, 13 Jul 2026 12:33:33 +0000 (UTC) Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id 96D1C10E967; Mon, 13 Jul 2026 12:33:32 +0000 (UTC) Authentication-Results: gabe.freedesktop.org; dkim=pass (2048-bit key; unprotected) header.d=kernel.org header.i=@kernel.org header.b="D++mAoLY"; dkim-atps=neutral Received: from tor.source.kernel.org (tor.source.kernel.org [172.105.4.254]) by gabe.freedesktop.org (Postfix) with ESMTPS id CDA2E10E5D0 for ; Mon, 13 Jul 2026 12:33:30 +0000 (UTC) Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) by tor.source.kernel.org (Postfix) with ESMTP id 431376004E; Mon, 13 Jul 2026 12:33:30 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id B77CA1F000E9; Mon, 13 Jul 2026 12:33:29 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1783946010; bh=So1ngTMBKLWI40f71cpPAfkDGrA9phrdJHyTDXmsHAU=; h=From:Subject:Reply-To:To:Cc:In-Reply-To:References:Date; b=D++mAoLYVRURLK8IbG+ipZJfm6mOQriEvpH9JAGwBiHIsBPaCLaGe794VVhnYzWNH +qVyOZtEWldYwCrZak6CfWOvWt9nKVyKlJtUnpXAUDuR4VUrmbDSgt6iOqHpq2n8+3 Q66uXf6oW81pdRYafm3wsm5pMbdlIUMwQvXgEhL5vvsndl/OC93QsCBZDiu4tOsWjy sJtPJe9Qz9bI1ge+BX6pobBQ+WiKjyu2X14MIWX8x/RBPP3cJ6mEp+WNEZ1I5FYd4o JKvPfX+4SrczkcC+cipaub0D/DloLr38xX6WlFHtqgHTTxO8hAJjlosbxoAIRIX7bY n/71AkdoEdPMQ== From: sashiko-bot@kernel.org Subject: Re: [PATCH v7 06/19] media: meson: vdec: Fix race condition by canceling work sync To: "Anand Moon" Cc: neil.armstrong@linaro.org, dri-devel@lists.freedesktop.org, linux-amlogic@lists.infradead.org In-Reply-To: <20260713120840.17427-7-linux.amoon@gmail.com> References: <20260713120840.17427-1-linux.amoon@gmail.com> <20260713120840.17427-7-linux.amoon@gmail.com> Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Date: Mon, 13 Jul 2026 12:33:29 +0000 Message-Id: <20260713123329.B77CA1F000E9@smtp.kernel.org> X-BeenThere: dri-devel@lists.freedesktop.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Direct Rendering Infrastructure - Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: sashiko-reviews@lists.linux.dev Errors-To: dri-devel-bounces@lists.freedesktop.org Sender: "dri-devel" Thank you for your contribution! Sashiko AI review found 4 potential issue(= s) to consider: - [High] Calling `cancel_work_sync(&sess->esparser_queue_work)` inside `vde= c_stop_streaming()` introduces a guaranteed AB-BA deadlock during `VIDIOC_S= TREAMOFF`. - [High] `cancel_work_sync()` and `synchronize_irq()` are invoked before th= e hardware is powered off, leaving a race window where late interrupts can = schedule work on a soon-to-be-freed session. - [High] `vdec_close()` unconditionally powers off shared hardware state an= d clears the active session, allowing a rogue client to crash an ongoing de= coding session. - [Medium] The patch fails to remove the scheduling of `esparser_queue_work= ` during destination buffer completion, contradicting its own commit messag= e. -- --- Patch [6]: [PATCH v7 06/19] media: meson: vdec: Fix race condition by c= anceling work sync --- commit 9631e0314174ce9dbe778bf9146832ff6e5a0364 Author: Anand Moon media: meson: vdec: Fix race condition by canceling work sync This commit attempts to synchronize workqueue states during teardown to eliminate race conditions. It adds synchronous cancellation of esparser_queue_work in vdec_stop_streaming() and vdec_close(). Closes: https://lore.kernel.org/all/20260521090944.F35401F00A3D@smtp.kernel= .org/ > Remove the scheduling of esparser queue work during destination buffer > completion, as freeing the vififo is handled elsewhere. [Severity: Medium] Did this actually get removed? Looking at dst_buf_done() in vdec_helpers.c, it still contains: /* Buffer done probably means the vififo got freed */ schedule_work(&sess->esparser_queue_work); This seems to contradict the commit message and means the workqueue is still scheduled asynchronously during destination buffer completion. > diff --git a/drivers/staging/media/meson/vdec/vdec.c b/drivers/staging/me= dia/meson/vdec/vdec.c > index 7689ffdb2e500..6fe9722577179 100644 > --- a/drivers/staging/media/meson/vdec/vdec.c > +++ b/drivers/staging/media/meson/vdec/vdec.c > @@ -484,11 +484,15 @@ static void vdec_stop_streaming(struct vb2_queue *q) > } > } > =20 > + mutex_unlock(&core->lock); > /* Synchronize and flush pending hardware interrupt service routines */ > synchronize_irq(core->vdec_irq); > /* Ensure esparser ISR finishes executing */ > synchronize_irq(core->esparser_irq); > =20 > + cancel_work_sync(&sess->esparser_queue_work); [Severity: High] Can this cause a deadlock? When userspace calls the streamoff ioctl, the v4l2 core acquires the queue lock (&sess->lock) before calling this vdec_stop_streaming() callback. Since cancel_work_sync() waits for the worker thread to finish, and the worker esparser_queue_all_src() attempts to acquire mutex_lock(&sess->lock), won't these threads wait on each other indefinitely if the worker is already running? [Severity: High] Could this teardown ordering lead to a use-after-free? Because cancel_work_sync() and synchronize_irq() are called before vdec_poweroff() disables the hardware, the hardware is still active and can generate interrupts. An interrupt could fire immediately after cancel_work_sync() returns, causing dst_buf_done() to schedule the work again. If the sess structure is subsequently freed, won't the newly scheduled work dereference a freed pointer? > + mutex_lock(&core->lock); > + > vdec_poweroff(sess); > vdec_free_canvas(sess); [ ... ] > @@ -999,6 +1003,8 @@ static int vdec_close(struct file *file) > /* Ensure esparser ISR finishes executing */ > synchronize_irq(core->esparser_irq); > =20 > + cancel_work_sync(&sess->esparser_queue_work); [Severity: High] Does this have the same teardown ordering race as vdec_stop_streaming()? The cancel_work_sync() call happens before vdec_poweroff(sess). If the hardware generates a late interrupt, could the work be scheduled again right before the session is freed? > + > if (!IS_ERR_OR_NULL(sess->recycle_thread)) { > kthread_stop(sess->recycle_thread); > sess->recycle_thread =3D NULL; Later in vdec_close(), the hardware is powered down and the session is clea= red: mutex_lock(&core->lock); vdec_poweroff(sess); vdec_free_canvas(sess); core->cur_sess =3D NULL; [Severity: High] Does this unconditionally terminate the hardware state of the active sessio= n? Because this lacks an if (core->cur_sess =3D=3D sess) check (which is safel= y used in vdec_stop_streaming), if a secondary client opens and immediately closes the device node, won't it forcefully power off the hardware and clear the session while the primary client is actively streaming? --=20 Sashiko AI review =C2=B7 https://sashiko.dev/#/patchset/20260713120840.1742= 7-1-linux.amoon@gmail.com?part=3D6 From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 717F5C44508 for ; Mon, 13 Jul 2026 12:33:33 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:MIME-Version:Reply-To:List-Subscribe: List-Help:List-Post:List-Archive:List-Unsubscribe:List-Id:Message-Id:Date: References:In-Reply-To:Cc:To:Subject:From:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: List-Owner; bh=SfpssP8a5Y0ccNrvAZybr5fbAXMcq2/SfUZRj92XmyA=; b=x4Rqn3oaLYRdw4 jTp/FS8CkE3Zg7RVJUpreGCELzfzILZO4Z7TM/xAZ4WT8arGf2NpaTWLSJMKPVeqIO3+FPwAdUWK9 VlUGoBMJwE1wmUUCDYWxUcg+d/V2lQOZof8fwlprmzsbDoaPbuzIvm5Mox1vHCCdvs3mmeeVWXecO Wf9YGmFrHsV0E00eePnYxXUD6TDA/JJKKMP8yi9XgsFShQhUeOIKiMRqJHTcx+1z8ufa+mj9dg8nc tuTxaA1HXzBLF7NqF88KWkFlse7MkuSjiYjYN1K95HmUcgEJQBOWMXR6Dq2o3b43EsJqwpEKAgxS1 W5MJ4CD4z5FSvil7Z/ag==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.99.1 #2 (Red Hat Linux)) id 1wjFql-00000009CwW-3DPS; Mon, 13 Jul 2026 12:33:31 +0000 Received: from tor.source.kernel.org ([2600:3c04:e001:324:0:1991:8:25]) by bombadil.infradead.org with esmtps (Exim 4.99.1 #2 (Red Hat Linux)) id 1wjFqk-00000009CwH-3L5N for linux-amlogic@lists.infradead.org; Mon, 13 Jul 2026 12:33:30 +0000 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) by tor.source.kernel.org (Postfix) with ESMTP id 431376004E; Mon, 13 Jul 2026 12:33:30 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id B77CA1F000E9; Mon, 13 Jul 2026 12:33:29 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1783946010; bh=So1ngTMBKLWI40f71cpPAfkDGrA9phrdJHyTDXmsHAU=; h=From:Subject:Reply-To:To:Cc:In-Reply-To:References:Date; b=D++mAoLYVRURLK8IbG+ipZJfm6mOQriEvpH9JAGwBiHIsBPaCLaGe794VVhnYzWNH +qVyOZtEWldYwCrZak6CfWOvWt9nKVyKlJtUnpXAUDuR4VUrmbDSgt6iOqHpq2n8+3 Q66uXf6oW81pdRYafm3wsm5pMbdlIUMwQvXgEhL5vvsndl/OC93QsCBZDiu4tOsWjy sJtPJe9Qz9bI1ge+BX6pobBQ+WiKjyu2X14MIWX8x/RBPP3cJ6mEp+WNEZ1I5FYd4o JKvPfX+4SrczkcC+cipaub0D/DloLr38xX6WlFHtqgHTTxO8hAJjlosbxoAIRIX7bY n/71AkdoEdPMQ== From: sashiko-bot@kernel.org Subject: Re: [PATCH v7 06/19] media: meson: vdec: Fix race condition by canceling work sync To: "Anand Moon" Cc: neil.armstrong@linaro.org, dri-devel@lists.freedesktop.org, linux-amlogic@lists.infradead.org In-Reply-To: <20260713120840.17427-7-linux.amoon@gmail.com> References: <20260713120840.17427-1-linux.amoon@gmail.com> <20260713120840.17427-7-linux.amoon@gmail.com> Date: Mon, 13 Jul 2026 12:33:29 +0000 Message-Id: <20260713123329.B77CA1F000E9@smtp.kernel.org> X-BeenThere: linux-amlogic@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: sashiko-reviews@lists.linux.dev MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 Sender: "linux-amlogic" Errors-To: linux-amlogic-bounces+linux-amlogic=archiver.kernel.org@lists.infradead.org VGhhbmsgeW91IGZvciB5b3VyIGNvbnRyaWJ1dGlvbiEgU2FzaGlrbyBBSSByZXZpZXcgZm91bmQg NCBwb3RlbnRpYWwgaXNzdWUocykgdG8gY29uc2lkZXI6Ci0gW0hpZ2hdIENhbGxpbmcgYGNhbmNl bF93b3JrX3N5bmMoJnNlc3MtPmVzcGFyc2VyX3F1ZXVlX3dvcmspYCBpbnNpZGUgYHZkZWNfc3Rv cF9zdHJlYW1pbmcoKWAgaW50cm9kdWNlcyBhIGd1YXJhbnRlZWQgQUItQkEgZGVhZGxvY2sgZHVy aW5nIGBWSURJT0NfU1RSRUFNT0ZGYC4KLSBbSGlnaF0gYGNhbmNlbF93b3JrX3N5bmMoKWAgYW5k IGBzeW5jaHJvbml6ZV9pcnEoKWAgYXJlIGludm9rZWQgYmVmb3JlIHRoZSBoYXJkd2FyZSBpcyBw b3dlcmVkIG9mZiwgbGVhdmluZyBhIHJhY2Ugd2luZG93IHdoZXJlIGxhdGUgaW50ZXJydXB0cyBj YW4gc2NoZWR1bGUgd29yayBvbiBhIHNvb24tdG8tYmUtZnJlZWQgc2Vzc2lvbi4KLSBbSGlnaF0g YHZkZWNfY2xvc2UoKWAgdW5jb25kaXRpb25hbGx5IHBvd2VycyBvZmYgc2hhcmVkIGhhcmR3YXJl IHN0YXRlIGFuZCBjbGVhcnMgdGhlIGFjdGl2ZSBzZXNzaW9uLCBhbGxvd2luZyBhIHJvZ3VlIGNs aWVudCB0byBjcmFzaCBhbiBvbmdvaW5nIGRlY29kaW5nIHNlc3Npb24uCi0gW01lZGl1bV0gVGhl IHBhdGNoIGZhaWxzIHRvIHJlbW92ZSB0aGUgc2NoZWR1bGluZyBvZiBgZXNwYXJzZXJfcXVldWVf d29ya2AgZHVyaW5nIGRlc3RpbmF0aW9uIGJ1ZmZlciBjb21wbGV0aW9uLCBjb250cmFkaWN0aW5n IGl0cyBvd24gY29tbWl0IG1lc3NhZ2UuCi0tCgotLS0gUGF0Y2ggWzZdOiBbUEFUQ0ggdjcgMDYv MTldIG1lZGlhOiBtZXNvbjogdmRlYzogRml4IHJhY2UgY29uZGl0aW9uIGJ5IGNhbmNlbGluZyB3 b3JrIHN5bmMgLS0tCmNvbW1pdCA5NjMxZTAzMTQxNzRjZTlkYmU3NzhiZjkxNDY4MzJmZjZlNWEw MzY0CkF1dGhvcjogQW5hbmQgTW9vbiA8bGludXguYW1vb25AZ21haWwuY29tPgoKbWVkaWE6IG1l c29uOiB2ZGVjOiBGaXggcmFjZSBjb25kaXRpb24gYnkgY2FuY2VsaW5nIHdvcmsgc3luYwoKVGhp cyBjb21taXQgYXR0ZW1wdHMgdG8gc3luY2hyb25pemUgd29ya3F1ZXVlIHN0YXRlcyBkdXJpbmcg dGVhcmRvd24gdG8KZWxpbWluYXRlIHJhY2UgY29uZGl0aW9ucy4gSXQgYWRkcyBzeW5jaHJvbm91 cyBjYW5jZWxsYXRpb24gb2YKZXNwYXJzZXJfcXVldWVfd29yayBpbiB2ZGVjX3N0b3Bfc3RyZWFt aW5nKCkgYW5kIHZkZWNfY2xvc2UoKS4KCkNsb3NlczogaHR0cHM6Ly9sb3JlLmtlcm5lbC5vcmcv YWxsLzIwMjYwNTIxMDkwOTQ0LkYzNTQwMUYwMEEzREBzbXRwLmtlcm5lbC5vcmcvCgo+IFJlbW92 ZSB0aGUgc2NoZWR1bGluZyBvZiBlc3BhcnNlciBxdWV1ZSB3b3JrIGR1cmluZyBkZXN0aW5hdGlv biBidWZmZXIKPiBjb21wbGV0aW9uLCBhcyBmcmVlaW5nIHRoZSB2aWZpZm8gaXMgaGFuZGxlZCBl bHNld2hlcmUuCgpbU2V2ZXJpdHk6IE1lZGl1bV0KRGlkIHRoaXMgYWN0dWFsbHkgZ2V0IHJlbW92 ZWQ/IExvb2tpbmcgYXQgZHN0X2J1Zl9kb25lKCkgaW4gdmRlY19oZWxwZXJzLmMsCml0IHN0aWxs IGNvbnRhaW5zOgoKICAgIC8qIEJ1ZmZlciBkb25lIHByb2JhYmx5IG1lYW5zIHRoZSB2aWZpZm8g Z290IGZyZWVkICovCiAgICBzY2hlZHVsZV93b3JrKCZzZXNzLT5lc3BhcnNlcl9xdWV1ZV93b3Jr KTsKClRoaXMgc2VlbXMgdG8gY29udHJhZGljdCB0aGUgY29tbWl0IG1lc3NhZ2UgYW5kIG1lYW5z IHRoZSB3b3JrcXVldWUgaXMgc3RpbGwKc2NoZWR1bGVkIGFzeW5jaHJvbm91c2x5IGR1cmluZyBk ZXN0aW5hdGlvbiBidWZmZXIgY29tcGxldGlvbi4KCj4gZGlmZiAtLWdpdCBhL2RyaXZlcnMvc3Rh Z2luZy9tZWRpYS9tZXNvbi92ZGVjL3ZkZWMuYyBiL2RyaXZlcnMvc3RhZ2luZy9tZWRpYS9tZXNv bi92ZGVjL3ZkZWMuYwo+IGluZGV4IDc2ODlmZmRiMmU1MDAuLjZmZTk3MjI1NzcxNzkgMTAwNjQ0 Cj4gLS0tIGEvZHJpdmVycy9zdGFnaW5nL21lZGlhL21lc29uL3ZkZWMvdmRlYy5jCj4gKysrIGIv ZHJpdmVycy9zdGFnaW5nL21lZGlhL21lc29uL3ZkZWMvdmRlYy5jCj4gQEAgLTQ4NCwxMSArNDg0 LDE1IEBAIHN0YXRpYyB2b2lkIHZkZWNfc3RvcF9zdHJlYW1pbmcoc3RydWN0IHZiMl9xdWV1ZSAq cSkKPiAgCQkJfQo+ICAJCX0KPiAgCj4gKwkJbXV0ZXhfdW5sb2NrKCZjb3JlLT5sb2NrKTsKPiAg CQkvKiBTeW5jaHJvbml6ZSBhbmQgZmx1c2ggcGVuZGluZyBoYXJkd2FyZSBpbnRlcnJ1cHQgc2Vy dmljZSByb3V0aW5lcyAqLwo+ICAJCXN5bmNocm9uaXplX2lycShjb3JlLT52ZGVjX2lycSk7Cj4g IAkJLyogRW5zdXJlIGVzcGFyc2VyIElTUiBmaW5pc2hlcyBleGVjdXRpbmcgKi8KPiAgCQlzeW5j aHJvbml6ZV9pcnEoY29yZS0+ZXNwYXJzZXJfaXJxKTsKPiAgCj4gKwkJY2FuY2VsX3dvcmtfc3lu Yygmc2Vzcy0+ZXNwYXJzZXJfcXVldWVfd29yayk7CgpbU2V2ZXJpdHk6IEhpZ2hdCkNhbiB0aGlz IGNhdXNlIGEgZGVhZGxvY2s/CgpXaGVuIHVzZXJzcGFjZSBjYWxscyB0aGUgc3RyZWFtb2ZmIGlv Y3RsLCB0aGUgdjRsMiBjb3JlIGFjcXVpcmVzIHRoZSBxdWV1ZQpsb2NrICgmc2Vzcy0+bG9jaykg YmVmb3JlIGNhbGxpbmcgdGhpcyB2ZGVjX3N0b3Bfc3RyZWFtaW5nKCkgY2FsbGJhY2suClNpbmNl IGNhbmNlbF93b3JrX3N5bmMoKSB3YWl0cyBmb3IgdGhlIHdvcmtlciB0aHJlYWQgdG8gZmluaXNo LCBhbmQgdGhlCndvcmtlciBlc3BhcnNlcl9xdWV1ZV9hbGxfc3JjKCkgYXR0ZW1wdHMgdG8gYWNx dWlyZSBtdXRleF9sb2NrKCZzZXNzLT5sb2NrKSwKd29uJ3QgdGhlc2UgdGhyZWFkcyB3YWl0IG9u IGVhY2ggb3RoZXIgaW5kZWZpbml0ZWx5IGlmIHRoZSB3b3JrZXIgaXMKYWxyZWFkeSBydW5uaW5n PwoKW1NldmVyaXR5OiBIaWdoXQpDb3VsZCB0aGlzIHRlYXJkb3duIG9yZGVyaW5nIGxlYWQgdG8g YSB1c2UtYWZ0ZXItZnJlZT8KCkJlY2F1c2UgY2FuY2VsX3dvcmtfc3luYygpIGFuZCBzeW5jaHJv bml6ZV9pcnEoKSBhcmUgY2FsbGVkIGJlZm9yZQp2ZGVjX3Bvd2Vyb2ZmKCkgZGlzYWJsZXMgdGhl IGhhcmR3YXJlLCB0aGUgaGFyZHdhcmUgaXMgc3RpbGwgYWN0aXZlCmFuZCBjYW4gZ2VuZXJhdGUg aW50ZXJydXB0cy4gQW4gaW50ZXJydXB0IGNvdWxkIGZpcmUgaW1tZWRpYXRlbHkgYWZ0ZXIKY2Fu Y2VsX3dvcmtfc3luYygpIHJldHVybnMsIGNhdXNpbmcgZHN0X2J1Zl9kb25lKCkgdG8gc2NoZWR1 bGUgdGhlIHdvcmsKYWdhaW4uIElmIHRoZSBzZXNzIHN0cnVjdHVyZSBpcyBzdWJzZXF1ZW50bHkg ZnJlZWQsIHdvbid0IHRoZSBuZXdseQpzY2hlZHVsZWQgd29yayBkZXJlZmVyZW5jZSBhIGZyZWVk IHBvaW50ZXI/Cgo+ICsJCW11dGV4X2xvY2soJmNvcmUtPmxvY2spOwo+ICsKPiAgCQl2ZGVjX3Bv d2Vyb2ZmKHNlc3MpOwo+ICAJCXZkZWNfZnJlZV9jYW52YXMoc2Vzcyk7CgpbIC4uLiBdCgo+IEBA IC05OTksNiArMTAwMyw4IEBAIHN0YXRpYyBpbnQgdmRlY19jbG9zZShzdHJ1Y3QgZmlsZSAqZmls ZSkKPiAgCS8qIEVuc3VyZSBlc3BhcnNlciBJU1IgZmluaXNoZXMgZXhlY3V0aW5nICovCj4gIAlz eW5jaHJvbml6ZV9pcnEoY29yZS0+ZXNwYXJzZXJfaXJxKTsKPiAgCj4gKwljYW5jZWxfd29ya19z eW5jKCZzZXNzLT5lc3BhcnNlcl9xdWV1ZV93b3JrKTsKCltTZXZlcml0eTogSGlnaF0KRG9lcyB0 aGlzIGhhdmUgdGhlIHNhbWUgdGVhcmRvd24gb3JkZXJpbmcgcmFjZSBhcyB2ZGVjX3N0b3Bfc3Ry ZWFtaW5nKCk/CgpUaGUgY2FuY2VsX3dvcmtfc3luYygpIGNhbGwgaGFwcGVucyBiZWZvcmUgdmRl Y19wb3dlcm9mZihzZXNzKS4gSWYKdGhlIGhhcmR3YXJlIGdlbmVyYXRlcyBhIGxhdGUgaW50ZXJy dXB0LCBjb3VsZCB0aGUgd29yayBiZSBzY2hlZHVsZWQKYWdhaW4gcmlnaHQgYmVmb3JlIHRoZSBz ZXNzaW9uIGlzIGZyZWVkPwoKPiArCj4gIAlpZiAoIUlTX0VSUl9PUl9OVUxMKHNlc3MtPnJlY3lj bGVfdGhyZWFkKSkgewo+ICAJCWt0aHJlYWRfc3RvcChzZXNzLT5yZWN5Y2xlX3RocmVhZCk7Cj4g IAkJc2Vzcy0+cmVjeWNsZV90aHJlYWQgPSBOVUxMOwoKTGF0ZXIgaW4gdmRlY19jbG9zZSgpLCB0 aGUgaGFyZHdhcmUgaXMgcG93ZXJlZCBkb3duIGFuZCB0aGUgc2Vzc2lvbiBpcyBjbGVhcmVkOgoK ICAgIG11dGV4X2xvY2soJmNvcmUtPmxvY2spOwoKICAgIHZkZWNfcG93ZXJvZmYoc2Vzcyk7CiAg ICB2ZGVjX2ZyZWVfY2FudmFzKHNlc3MpOwogICAgY29yZS0+Y3VyX3Nlc3MgPSBOVUxMOwoKW1Nl dmVyaXR5OiBIaWdoXQpEb2VzIHRoaXMgdW5jb25kaXRpb25hbGx5IHRlcm1pbmF0ZSB0aGUgaGFy ZHdhcmUgc3RhdGUgb2YgdGhlIGFjdGl2ZSBzZXNzaW9uPwoKQmVjYXVzZSB0aGlzIGxhY2tzIGFu IGlmIChjb3JlLT5jdXJfc2VzcyA9PSBzZXNzKSBjaGVjayAod2hpY2ggaXMgc2FmZWx5IHVzZWQK aW4gdmRlY19zdG9wX3N0cmVhbWluZyksIGlmIGEgc2Vjb25kYXJ5IGNsaWVudCBvcGVucyBhbmQg aW1tZWRpYXRlbHkgY2xvc2VzCnRoZSBkZXZpY2Ugbm9kZSwgd29uJ3QgaXQgZm9yY2VmdWxseSBw b3dlciBvZmYgdGhlIGhhcmR3YXJlIGFuZCBjbGVhciB0aGUKc2Vzc2lvbiB3aGlsZSB0aGUgcHJp bWFyeSBjbGllbnQgaXMgYWN0aXZlbHkgc3RyZWFtaW5nPwoKLS0gClNhc2hpa28gQUkgcmV2aWV3 IMK3IGh0dHBzOi8vc2FzaGlrby5kZXYvIy9wYXRjaHNldC8yMDI2MDcxMzEyMDg0MC4xNzQyNy0x LWxpbnV4LmFtb29uQGdtYWlsLmNvbT9wYXJ0PTYKCl9fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fCmxpbnV4LWFtbG9naWMgbWFpbGluZyBsaXN0CmxpbnV4LWFt bG9naWNAbGlzdHMuaW5mcmFkZWFkLm9yZwpodHRwOi8vbGlzdHMuaW5mcmFkZWFkLm9yZy9tYWls bWFuL2xpc3RpbmZvL2xpbnV4LWFtbG9naWMK