From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id B1E25C83F11 for ; Mon, 28 Aug 2023 02:04:23 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender:List-Subscribe:List-Help :List-Post:List-Archive:List-Unsubscribe:List-Id:Content-Transfer-Encoding: Content-Type:In-Reply-To:From:References:Cc:To:Subject:MIME-Version:Date: Message-ID:Reply-To:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Owner; bh=XBu5JlOOh7gOc/W7S7ujfHc4mTCA8gighgaPPpAMcS0=; b=mVfVPJgyYMNXlcuFLX9dcQ2mkV m8n61GVg/5fcInQviOKLiJHZltDI18lfyYPSFAYR5/WSEs9pu9B35iX/BSHWBHN9+zvxCywM9w3fG bmH4B6UPCMgQpqtztZYj5mGZvXLp/COtvGMP0wYlwzY8kBDLmUslMzbEUtWTFrgE015FHUqUkHmLT rw2EKiF/TWKawNXQfekckcwJluxt6ObN9XkpV40lW0vbagrhxUJYqH2vpwuy+IWMF78qfOWE19J8W Mka5+hqWzk++cheVBIfymk8F7f6dkYWmTp2JeWrLZsxUWvDADyaYUgoE58Fl2RAm0QSry6QzH0VxO anuP/1DQ==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.96 #2 (Red Hat Linux)) id 1qaRc5-008iHS-0c; Mon, 28 Aug 2023 02:04:21 +0000 Received: from madras.collabora.co.uk ([2a00:1098:0:82:1000:25:2eeb:e5ab]) by bombadil.infradead.org with esmtps (Exim 4.96 #2 (Red Hat Linux)) id 1qaRbx-008iGA-28; Mon, 28 Aug 2023 02:04:17 +0000 Received: from [192.168.2.140] (109-252-153-31.dynamic.spd-mgts.ru [109.252.153.31]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) (Authenticated sender: dmitry.osipenko) by madras.collabora.co.uk (Postfix) with ESMTPSA id D444B6603102; Mon, 28 Aug 2023 03:04:04 +0100 (BST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=collabora.com; s=mail; t=1693188246; bh=MdQMfqcGXQs/ECA9S10/I1u8YJnIw7F7oF5+4wksxLc=; h=Date:Subject:To:Cc:References:From:In-Reply-To:From; b=K27UlQU54MNEWFjw4/pjdCvmw8V2jPGqr/EpQr3Hd+Xp8jK5ohJMz+n4u3Qc48Zoe mM3e3FH69TukH+BRwi9G9Mf4Mqrnk3iK4KENJwPGzT/Z3jyyJAWHxzAii9OkBoJhPu r0hiFq0RPtafLkeCHg6F+9GO6JZFH61NW+lt32f+q0PE0PG+jkkPm8/HABB3ozuwtA kJaTYzp0HxP2cdv3hIqFOPrDu6iJkDJgmPBe9xPNb+1zBL6KrRVSbhbqteWM5mlr3u ThOMGx0FsoaZN4F/Ooo3A0pnvisyoo5TdhenI4pMVO7k7uJs80xnHHn+mc36G+bYV2 rpQAsCYMtsSNA== Message-ID: <54b14ebe-b51b-2744-328d-2adcdaaf6d0e@collabora.com> Date: Mon, 28 Aug 2023 05:04:02 +0300 MIME-Version: 1.0 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101 Thunderbird/102.13.0 Subject: Re: [RESEND PATCH v2] media: mtk-jpeg: Fix use after free bug due to uncanceled work Content-Language: en-US To: Zheng Hacker Cc: Zheng Wang , Kyrie.Wu@mediatek.com, bin.liu@mediatek.com, mchehab@kernel.org, matthias.bgg@gmail.com, angelogioacchino.delregno@collabora.com, linux-media@vger.kernel.org, linux-kernel@vger.kernel.org, linux-arm-kernel@lists.infradead.org, linux-mediatek@lists.infradead.org, Irui.Wang@mediatek.com, security@kernel.org, 1395428693sheep@gmail.com, alex000young@gmail.com, Collabora Kernel ML References: <20230707092414.866760-1-zyytlz.wz@163.com> <8c8bd3ec-a5a4-32e4-45b5-ee16eeeac246@collabora.com> From: Dmitry Osipenko In-Reply-To: Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20230827_190414_039160_9B83FB4C X-CRM114-Status: GOOD ( 31.17 ) X-BeenThere: linux-mediatek@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: "Linux-mediatek" Errors-To: linux-mediatek-bounces+linux-mediatek=archiver.kernel.org@lists.infradead.org On 8/24/23 11:20, Zheng Hacker wrote: > Dmitry Osipenko 于2023年8月23日周三 02:51写道： > >> >> Hello Zheng, >> >> On 7/7/23 12:24, Zheng Wang wrote: >>> In mtk_jpeg_probe, &jpeg->job_timeout_work is bound with >>> mtk_jpeg_job_timeout_work. Then mtk_jpeg_dec_device_run >>> and mtk_jpeg_enc_device_run may be called to start the >>> work. >>> If we remove the module which will call mtk_jpeg_remove >>> to make cleanup, there may be a unfinished work. The >>> possible sequence is as follows, which will cause a >>> typical UAF bug. >>> >>> Fix it by canceling the work before cleanup in the mtk_jpeg_remove >>> >>> CPU0 CPU1 >>> >>> |mtk_jpeg_job_timeout_work >>> mtk_jpeg_remove | >>> v4l2_m2m_release | >>> kfree(m2m_dev); | >>> | >>> | v4l2_m2m_get_curr_priv >>> | m2m_dev->curr_ctx //use >>> Fixes: b2f0d2724ba4 ("[media] vcodec: mediatek: Add Mediatek JPEG Decoder Driver") >>> Signed-off-by: Zheng Wang >>> --- >>> - v2: use cancel_delayed_work_sync instead of cancel_delayed_work suggested by Kyrie. >>> --- >>> drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c | 1 + >>> 1 file changed, 1 insertion(+) >>> >>> diff --git a/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c b/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c >>> index 0051f372a66c..6069ecf420b0 100644 >>> --- a/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c >>> +++ b/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c >>> @@ -1816,6 +1816,7 @@ static void mtk_jpeg_remove(struct platform_device *pdev) >>> { >>> struct mtk_jpeg_dev *jpeg = platform_get_drvdata(pdev); >>> >>> + cancel_delayed_work_sync(&jpeg->job_timeout_work); >>> pm_runtime_disable(&pdev->dev); >>> video_unregister_device(jpeg->vdev); >>> v4l2_m2m_release(jpeg->m2m_dev); >> >> AFAICS, there is a fundamental problem here. The job_timeout_work uses >> v4l2_m2m_get_curr_priv() and at the time when driver module is unloaded, >> all the v4l contexts must be closed and released. Hence the >> v4l2_m2m_get_curr_priv() shall return NULL and crash the kernel when >> work is executed before cancel_delayed_work_sync(). >> > > Hi Dmitry, > > Thanks for your reply. I think you're right. As m2m_dev is freed in > v4l2_m2m_release, > the invoking in v4l2_m2m_get_curr_priv might cause either UAF or null > pointer dereference > bug. I am sure that context is closed when we invoke mtk_jpeg_remove. > But I'm not sure if > context is released when mtk_jpegdec_timeout_work running. > >> At the time when mtk_jpeg_remove() is invoked, there shall be no >> job_timeout_work running in background because all jobs should be >> completed before context is released. If you'll look at >> v4l2_m2m_cancel_job(), you can see that it waits for the task completion >> before closing context. > > Yes, so I think the better way is to put the cancel_delayed_work_sync > invoking into > v4l2_m2m_ctx_release function? The v4l2_m2m_ctx_release() already should wait for the job_timeout_work completion or for the interrupt fire. Apparently it doesn't work in yours case. You'll need to debug why v4l job or job_timeout_work is running after v4l2_m2m_ctx_release(), it shouldn't happen. The interrupt handler cancels job_timeout_work, you shouldn't need to flush the work. Technically, interrupt handler may race with job_timeout_work, but the timeout is set to 1 second and in practice should be difficult to trigger the race. The interrupt handler needs to be threaded, it should use cancel_delayed_work_sync() and check the return value of this function. >> >> You shouldn't be able to remove driver module while it has active/opened >> v4l contexts. If you can do that, then this is yours bug that needs to >> be fixed. >> >> In addition to this all, the job_timeout_work is initialized only for >> the single-core JPEG device. I'd expect this patch should crash >> multi-core JPEG devices. >> > > I think that's true. As I'm not familiar with the code here. Could you > please give me some advice about the patch? We'll need to understand why v4l2_m2m_ctx_release() doesn't work as expected before thinking about the patch. -- Best regards, Dmitry From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 70094C83F11 for ; Mon, 28 Aug 2023 02:04:54 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:In-Reply-To:From:References:Cc:To: Subject:MIME-Version:Date:Message-ID:Reply-To:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: List-Owner; bh=Fd4am1AzvtbsxmDgO1C8UHMc4pbbcewjq/5a8vbK6eU=; b=o+sxRC66bVjtnI rsu+Qr5nRJTS+ay/hWgRhMHIwQsl1umpXd/nDF4zBTgxg2+5OzrQ0cBLkvDEWQlh790Kj8Xcm0vfc GyVs5JmDH8GfWLfmQjBUwq8TlLHVU07YYd7amkxPSD4dZubP3c8nOE87lnJhZnBVxdn0/f1pZk2s0 m/MZjmf7fo8H/fVWsVmll9Onit3KU2z/Htkrytkhz6EUo+yKUWT2gFNEafPtc3i50PTHxTE+/C37g 61anTj1K4JjRrKUoK/r30C2JdR9sxa7MfhRSv1eOqUiEjVLs9xZiwdsafibRy2EdYLZSlXH3ahYFd /oDf5R+QP4hdBfDose+A==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.96 #2 (Red Hat Linux)) id 1qaRc4-008iHE-2K; Mon, 28 Aug 2023 02:04:20 +0000 Received: from madras.collabora.co.uk ([2a00:1098:0:82:1000:25:2eeb:e5ab]) by bombadil.infradead.org with esmtps (Exim 4.96 #2 (Red Hat Linux)) id 1qaRbx-008iGA-28; Mon, 28 Aug 2023 02:04:17 +0000 Received: from [192.168.2.140] (109-252-153-31.dynamic.spd-mgts.ru [109.252.153.31]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) (Authenticated sender: dmitry.osipenko) by madras.collabora.co.uk (Postfix) with ESMTPSA id D444B6603102; Mon, 28 Aug 2023 03:04:04 +0100 (BST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=collabora.com; s=mail; t=1693188246; bh=MdQMfqcGXQs/ECA9S10/I1u8YJnIw7F7oF5+4wksxLc=; h=Date:Subject:To:Cc:References:From:In-Reply-To:From; b=K27UlQU54MNEWFjw4/pjdCvmw8V2jPGqr/EpQr3Hd+Xp8jK5ohJMz+n4u3Qc48Zoe mM3e3FH69TukH+BRwi9G9Mf4Mqrnk3iK4KENJwPGzT/Z3jyyJAWHxzAii9OkBoJhPu r0hiFq0RPtafLkeCHg6F+9GO6JZFH61NW+lt32f+q0PE0PG+jkkPm8/HABB3ozuwtA kJaTYzp0HxP2cdv3hIqFOPrDu6iJkDJgmPBe9xPNb+1zBL6KrRVSbhbqteWM5mlr3u ThOMGx0FsoaZN4F/Ooo3A0pnvisyoo5TdhenI4pMVO7k7uJs80xnHHn+mc36G+bYV2 rpQAsCYMtsSNA== Message-ID: <54b14ebe-b51b-2744-328d-2adcdaaf6d0e@collabora.com> Date: Mon, 28 Aug 2023 05:04:02 +0300 MIME-Version: 1.0 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101 Thunderbird/102.13.0 Subject: Re: [RESEND PATCH v2] media: mtk-jpeg: Fix use after free bug due to uncanceled work Content-Language: en-US To: Zheng Hacker Cc: Zheng Wang , Kyrie.Wu@mediatek.com, bin.liu@mediatek.com, mchehab@kernel.org, matthias.bgg@gmail.com, angelogioacchino.delregno@collabora.com, linux-media@vger.kernel.org, linux-kernel@vger.kernel.org, linux-arm-kernel@lists.infradead.org, linux-mediatek@lists.infradead.org, Irui.Wang@mediatek.com, security@kernel.org, 1395428693sheep@gmail.com, alex000young@gmail.com, Collabora Kernel ML References: <20230707092414.866760-1-zyytlz.wz@163.com> <8c8bd3ec-a5a4-32e4-45b5-ee16eeeac246@collabora.com> From: Dmitry Osipenko In-Reply-To: X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20230827_190414_039160_9B83FB4C X-CRM114-Status: GOOD ( 31.17 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org T24gOC8yNC8yMyAxMToyMCwgWmhlbmcgSGFja2VyIHdyb3RlOgo+IERtaXRyeSBPc2lwZW5rbyA8 ZG1pdHJ5Lm9zaXBlbmtvQGNvbGxhYm9yYS5jb20+IOS6jjIwMjPlubQ45pyIMjPml6XlkajkuIkg MDI6NTHlhpnpgZPvvJoKPiAKPj4KPj4gSGVsbG8gWmhlbmcsCj4+Cj4+IE9uIDcvNy8yMyAxMjoy NCwgWmhlbmcgV2FuZyB3cm90ZToKPj4+IEluIG10a19qcGVnX3Byb2JlLCAmanBlZy0+am9iX3Rp bWVvdXRfd29yayBpcyBib3VuZCB3aXRoCj4+PiBtdGtfanBlZ19qb2JfdGltZW91dF93b3JrLiBU aGVuIG10a19qcGVnX2RlY19kZXZpY2VfcnVuCj4+PiBhbmQgbXRrX2pwZWdfZW5jX2RldmljZV9y dW4gbWF5IGJlIGNhbGxlZCB0byBzdGFydCB0aGUKPj4+IHdvcmsuCj4+PiBJZiB3ZSByZW1vdmUg dGhlIG1vZHVsZSB3aGljaCB3aWxsIGNhbGwgbXRrX2pwZWdfcmVtb3ZlCj4+PiB0byBtYWtlIGNs ZWFudXAsIHRoZXJlIG1heSBiZSBhIHVuZmluaXNoZWQgd29yay4gVGhlCj4+PiBwb3NzaWJsZSBz ZXF1ZW5jZSBpcyBhcyBmb2xsb3dzLCB3aGljaCB3aWxsIGNhdXNlIGEKPj4+IHR5cGljYWwgVUFG IGJ1Zy4KPj4+Cj4+PiBGaXggaXQgYnkgY2FuY2VsaW5nIHRoZSB3b3JrIGJlZm9yZSBjbGVhbnVw IGluIHRoZSBtdGtfanBlZ19yZW1vdmUKPj4+Cj4+PiBDUFUwICAgICAgICAgICAgICAgICAgQ1BV MQo+Pj4KPj4+ICAgICAgICAgICAgICAgICAgICAgfG10a19qcGVnX2pvYl90aW1lb3V0X3dvcmsK Pj4+IG10a19qcGVnX3JlbW92ZSAgICAgfAo+Pj4gICB2NGwyX20ybV9yZWxlYXNlICB8Cj4+PiAg ICAga2ZyZWUobTJtX2Rldik7IHwKPj4+ICAgICAgICAgICAgICAgICAgICAgfAo+Pj4gICAgICAg ICAgICAgICAgICAgICB8IHY0bDJfbTJtX2dldF9jdXJyX3ByaXYKPj4+ICAgICAgICAgICAgICAg ICAgICAgfCAgIG0ybV9kZXYtPmN1cnJfY3R4IC8vdXNlCj4+PiBGaXhlczogYjJmMGQyNzI0YmE0 ICgiW21lZGlhXSB2Y29kZWM6IG1lZGlhdGVrOiBBZGQgTWVkaWF0ZWsgSlBFRyBEZWNvZGVyIERy aXZlciIpCj4+PiBTaWduZWQtb2ZmLWJ5OiBaaGVuZyBXYW5nIDx6eXl0bHoud3pAMTYzLmNvbT4K Pj4+IC0tLQo+Pj4gLSB2MjogdXNlIGNhbmNlbF9kZWxheWVkX3dvcmtfc3luYyBpbnN0ZWFkIG9m IGNhbmNlbF9kZWxheWVkX3dvcmsgc3VnZ2VzdGVkIGJ5IEt5cmllLgo+Pj4gLS0tCj4+PiAgZHJp dmVycy9tZWRpYS9wbGF0Zm9ybS9tZWRpYXRlay9qcGVnL210a19qcGVnX2NvcmUuYyB8IDEgKwo+ Pj4gIDEgZmlsZSBjaGFuZ2VkLCAxIGluc2VydGlvbigrKQo+Pj4KPj4+IGRpZmYgLS1naXQgYS9k cml2ZXJzL21lZGlhL3BsYXRmb3JtL21lZGlhdGVrL2pwZWcvbXRrX2pwZWdfY29yZS5jIGIvZHJp dmVycy9tZWRpYS9wbGF0Zm9ybS9tZWRpYXRlay9qcGVnL210a19qcGVnX2NvcmUuYwo+Pj4gaW5k ZXggMDA1MWYzNzJhNjZjLi42MDY5ZWNmNDIwYjAgMTAwNjQ0Cj4+PiAtLS0gYS9kcml2ZXJzL21l ZGlhL3BsYXRmb3JtL21lZGlhdGVrL2pwZWcvbXRrX2pwZWdfY29yZS5jCj4+PiArKysgYi9kcml2 ZXJzL21lZGlhL3BsYXRmb3JtL21lZGlhdGVrL2pwZWcvbXRrX2pwZWdfY29yZS5jCj4+PiBAQCAt MTgxNiw2ICsxODE2LDcgQEAgc3RhdGljIHZvaWQgbXRrX2pwZWdfcmVtb3ZlKHN0cnVjdCBwbGF0 Zm9ybV9kZXZpY2UgKnBkZXYpCj4+PiAgewo+Pj4gICAgICAgc3RydWN0IG10a19qcGVnX2RldiAq anBlZyA9IHBsYXRmb3JtX2dldF9kcnZkYXRhKHBkZXYpOwo+Pj4KPj4+ICsgICAgIGNhbmNlbF9k ZWxheWVkX3dvcmtfc3luYygmanBlZy0+am9iX3RpbWVvdXRfd29yayk7Cj4+PiAgICAgICBwbV9y dW50aW1lX2Rpc2FibGUoJnBkZXYtPmRldik7Cj4+PiAgICAgICB2aWRlb191bnJlZ2lzdGVyX2Rl dmljZShqcGVnLT52ZGV2KTsKPj4+ICAgICAgIHY0bDJfbTJtX3JlbGVhc2UoanBlZy0+bTJtX2Rl dik7Cj4+Cj4+IEFGQUlDUywgdGhlcmUgaXMgYSBmdW5kYW1lbnRhbCBwcm9ibGVtIGhlcmUuIFRo ZSBqb2JfdGltZW91dF93b3JrIHVzZXMKPj4gdjRsMl9tMm1fZ2V0X2N1cnJfcHJpdigpIGFuZCBh dCB0aGUgdGltZSB3aGVuIGRyaXZlciBtb2R1bGUgaXMgdW5sb2FkZWQsCj4+IGFsbCB0aGUgdjRs IGNvbnRleHRzIG11c3QgYmUgY2xvc2VkIGFuZCByZWxlYXNlZC4gSGVuY2UgdGhlCj4+IHY0bDJf bTJtX2dldF9jdXJyX3ByaXYoKSBzaGFsbCByZXR1cm4gTlVMTCBhbmQgY3Jhc2ggdGhlIGtlcm5l bCB3aGVuCj4+IHdvcmsgaXMgZXhlY3V0ZWQgYmVmb3JlIGNhbmNlbF9kZWxheWVkX3dvcmtfc3lu YygpLgo+Pgo+IAo+IEhpIERtaXRyeSwKPiAKPiBUaGFua3MgZm9yIHlvdXIgcmVwbHkuIEkgdGhp bmsgeW91J3JlIHJpZ2h0LiBBcyBtMm1fZGV2IGlzIGZyZWVkIGluCj4gdjRsMl9tMm1fcmVsZWFz ZSwKPiB0aGUgaW52b2tpbmcgaW4gdjRsMl9tMm1fZ2V0X2N1cnJfcHJpdiBtaWdodCBjYXVzZSBl aXRoZXIgVUFGIG9yIG51bGwKPiBwb2ludGVyIGRlcmVmZXJlbmNlCj4gYnVnLiBJIGFtIHN1cmUg dGhhdCBjb250ZXh0IGlzIGNsb3NlZCB3aGVuIHdlIGludm9rZSBtdGtfanBlZ19yZW1vdmUuCj4g QnV0IEknbSBub3Qgc3VyZSBpZgo+IGNvbnRleHQgaXMgcmVsZWFzZWQgd2hlbiBtdGtfanBlZ2Rl Y190aW1lb3V0X3dvcmsgcnVubmluZy4KPiAKPj4gQXQgdGhlIHRpbWUgd2hlbiBtdGtfanBlZ19y ZW1vdmUoKSBpcyBpbnZva2VkLCB0aGVyZSBzaGFsbCBiZSBubwo+PiBqb2JfdGltZW91dF93b3Jr IHJ1bm5pbmcgaW4gYmFja2dyb3VuZCBiZWNhdXNlIGFsbCBqb2JzIHNob3VsZCBiZQo+PiBjb21w bGV0ZWQgYmVmb3JlIGNvbnRleHQgaXMgcmVsZWFzZWQuIElmIHlvdSdsbCBsb29rIGF0Cj4+IHY0 bDJfbTJtX2NhbmNlbF9qb2IoKSwgeW91IGNhbiBzZWUgdGhhdCBpdCB3YWl0cyBmb3IgdGhlIHRh c2sgY29tcGxldGlvbgo+PiBiZWZvcmUgY2xvc2luZyBjb250ZXh0Lgo+IAo+IFllcywgc28gSSB0 aGluayB0aGUgYmV0dGVyIHdheSBpcyB0byBwdXQgdGhlIGNhbmNlbF9kZWxheWVkX3dvcmtfc3lu Ywo+IGludm9raW5nIGludG8KPiB2NGwyX20ybV9jdHhfcmVsZWFzZSBmdW5jdGlvbj8KClRoZSB2 NGwyX20ybV9jdHhfcmVsZWFzZSgpIGFscmVhZHkgc2hvdWxkIHdhaXQgZm9yIHRoZSBqb2JfdGlt ZW91dF93b3JrCmNvbXBsZXRpb24gb3IgZm9yIHRoZSBpbnRlcnJ1cHQgZmlyZS4gQXBwYXJlbnRs eSBpdCBkb2Vzbid0IHdvcmsgaW4KeW91cnMgY2FzZS4gWW91J2xsIG5lZWQgdG8gZGVidWcgd2h5 IHY0bCBqb2Igb3Igam9iX3RpbWVvdXRfd29yayBpcwpydW5uaW5nIGFmdGVyIHY0bDJfbTJtX2N0 eF9yZWxlYXNlKCksIGl0IHNob3VsZG4ndCBoYXBwZW4uCgpUaGUgaW50ZXJydXB0IGhhbmRsZXIg Y2FuY2VscyBqb2JfdGltZW91dF93b3JrLCB5b3Ugc2hvdWxkbid0IG5lZWQgdG8KZmx1c2ggdGhl IHdvcmsuCgpUZWNobmljYWxseSwgaW50ZXJydXB0IGhhbmRsZXIgbWF5IHJhY2Ugd2l0aCBqb2Jf dGltZW91dF93b3JrLCBidXQgdGhlCnRpbWVvdXQgaXMgc2V0IHRvIDEgc2Vjb25kIGFuZCBpbiBw cmFjdGljZSBzaG91bGQgYmUgZGlmZmljdWx0IHRvCnRyaWdnZXIgdGhlIHJhY2UuIFRoZSBpbnRl cnJ1cHQgaGFuZGxlciBuZWVkcyB0byBiZSB0aHJlYWRlZCwgaXQgc2hvdWxkCnVzZSBjYW5jZWxf ZGVsYXllZF93b3JrX3N5bmMoKSBhbmQgY2hlY2sgdGhlIHJldHVybiB2YWx1ZSBvZiB0aGlzIGZ1 bmN0aW9uLgoKPj4KPj4gWW91IHNob3VsZG4ndCBiZSBhYmxlIHRvIHJlbW92ZSBkcml2ZXIgbW9k dWxlIHdoaWxlIGl0IGhhcyBhY3RpdmUvb3BlbmVkCj4+IHY0bCBjb250ZXh0cy4gSWYgeW91IGNh biBkbyB0aGF0LCB0aGVuIHRoaXMgaXMgeW91cnMgYnVnIHRoYXQgbmVlZHMgdG8KPj4gYmUgZml4 ZWQuCj4+Cj4+IEluIGFkZGl0aW9uIHRvIHRoaXMgYWxsLCB0aGUgam9iX3RpbWVvdXRfd29yayBp cyBpbml0aWFsaXplZCBvbmx5IGZvcgo+PiB0aGUgc2luZ2xlLWNvcmUgSlBFRyBkZXZpY2UuIEkn ZCBleHBlY3QgdGhpcyBwYXRjaCBzaG91bGQgY3Jhc2gKPj4gbXVsdGktY29yZSBKUEVHIGRldmlj ZXMuCj4+Cj4gCj4gSSB0aGluayB0aGF0J3MgdHJ1ZS4gQXMgSSdtIG5vdCBmYW1pbGlhciB3aXRo IHRoZSBjb2RlIGhlcmUuIENvdWxkIHlvdQo+IHBsZWFzZSBnaXZlIG1lIHNvbWUgYWR2aWNlIGFi b3V0IHRoZSBwYXRjaD8KCldlJ2xsIG5lZWQgdG8gdW5kZXJzdGFuZCB3aHkgdjRsMl9tMm1fY3R4 X3JlbGVhc2UoKSBkb2Vzbid0IHdvcmsgYXMKZXhwZWN0ZWQgYmVmb3JlIHRoaW5raW5nIGFib3V0 IHRoZSBwYXRjaC4KCi0tIApCZXN0IHJlZ2FyZHMsCkRtaXRyeQoKCl9fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fCmxpbnV4LWFybS1rZXJuZWwgbWFpbGluZyBs aXN0CmxpbnV4LWFybS1rZXJuZWxAbGlzdHMuaW5mcmFkZWFkLm9yZwpodHRwOi8vbGlzdHMuaW5m cmFkZWFkLm9yZy9tYWlsbWFuL2xpc3RpbmZvL2xpbnV4LWFybS1rZXJuZWwK