From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from lists.sourceforge.net (lists.sourceforge.net [216.105.38.7]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 5BDA6C677C4 for ; Wed, 11 Jun 2025 08:59:35 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.sourceforge.net; s=beta; h=Content-Transfer-Encoding:Content-Type:Cc: Reply-To:From:List-Subscribe:List-Help:List-Post:List-Archive: List-Unsubscribe:List-Id:Subject:In-Reply-To:References:To:MIME-Version:Date: Message-ID:Sender:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Owner; bh=NHVCc067/lyeg6zlq90grGdZCRfGy9xpCvrRJMwhCIQ=; b=EjxVe95gKeG66gEhYKAfdUAntX YSmBRWylDVRqLkb5JtihdnCKK0e0tRZp64e1GXblh6ZUp9BrIwfcgvAQvnSnnZgxJZqfJV+HZM8rZ QIKFgClWt5wZO6jrJabCCdKXAstc+1zZXPWx1WPl7JxXJuzDhbt5tdu4f58zrw0fOwTE=; Received: from [127.0.0.1] (helo=sfs-ml-3.v29.lw.sourceforge.com) by sfs-ml-3.v29.lw.sourceforge.com with esmtp (Exim 4.95) (envelope-from ) id 1uPHJ0-0005RD-O4; Wed, 11 Jun 2025 08:59:34 +0000 Received: from [172.30.29.66] (helo=mx.sourceforge.net) by sfs-ml-3.v29.lw.sourceforge.com with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.95) (envelope-from ) id 1uPHJ0-0005R6-0C for linux-f2fs-devel@lists.sourceforge.net; Wed, 11 Jun 2025 08:59:34 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sourceforge.net; s=x; h=Content-Transfer-Encoding:Content-Type:In-Reply-To: From:References:To:Subject:Cc:MIME-Version:Date:Message-ID:Sender:Reply-To: Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender: Resent-To:Resent-Cc:Resent-Message-ID:List-Id:List-Help:List-Unsubscribe: List-Subscribe:List-Post:List-Owner:List-Archive; bh=gpNLGpUzcJR4+W0iTIzum349WTKGOk03qKxbT35kyCg=; b=crzWbKGNThNxkxAb/8obX1SafR fnbFhZ+mCyNabQKyLjU1r9mlNxGE13AwD0+tn140dVtraM99e66ZPfc3pMomIRhVF/Doa9MCFeSxL Zf/KBdJ8pm4saIMclLmTp9qm5Ff6C9FFxV0fnrnp6D2naRiKySaVSaa+w87Hru8+tGCo=; DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sf.net; s=x ; h=Content-Transfer-Encoding:Content-Type:In-Reply-To:From:References:To: Subject:Cc:MIME-Version:Date:Message-ID:Sender:Reply-To:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:List-Id:List-Help:List-Unsubscribe:List-Subscribe: List-Post:List-Owner:List-Archive; bh=gpNLGpUzcJR4+W0iTIzum349WTKGOk03qKxbT35kyCg=; b=Guj3ndjm/cAkxhBZBCqoF9MDY6 jSpewRgDuGwsOKIpWoCDPQjGCoF7Qn5Aa4A4GrgZGUwFLk2/gxI4pQtp3rzruIJZsac3QEGN5qhrC t9//zho8KFC18DUaqabibPptMLVN/qSxRHfjWBRBBiZaeEH6WjNUgcjBm/cHGSrB/q3o=; Received: from dfw.source.kernel.org ([139.178.84.217]) by sfi-mx-2.v28.lw.sourceforge.com with esmtps (TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256) (Exim 4.95) id 1uPHIz-0000PY-5K for linux-f2fs-devel@lists.sourceforge.net; Wed, 11 Jun 2025 08:59:33 +0000 Received: from smtp.kernel.org (transwarp.subspace.kernel.org [100.75.92.58]) by dfw.source.kernel.org (Postfix) with ESMTP id D85B75C0763; Wed, 11 Jun 2025 08:57:10 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 01C84C4CEEE; Wed, 11 Jun 2025 08:59:24 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1749632367; bh=ue+31B2bG/IgKEzAtR1bURwIK+Rmq5NQ4YjRrVZ466s=; h=Date:Cc:Subject:To:References:From:In-Reply-To:From; b=AFrw0z5Q8pmOz+yeoK37AD5kqStvJnpFyGDBnPcuntaXQ36GHdQcv/5i0nt+BwztX n+bWDRjGssYXXZzkcNRjhX5JH01C1X254U/HeYSM/OB9kDQNjua+sCU9W/mGVM1WEu gQ8ag+2H7bVr2o15HRBGNpLmhtEHnVVf2rsAZlBrqO6NrmSRA/BNBbLph6NrFulvR4 DWv9RJ527bxuFb2DlygTIum3TWa8MnCdGEnQ986Dh9o4hh/SnNw37gcLiOzPJxOBSr wLeFTaDuHbQyHvZaaW8sc50ba2zxWbreSVDMqyNh/qzuWROQ/W2WUXm449GM3oG/DH zdpVg80f9n//A== Message-ID: Date: Wed, 11 Jun 2025 16:59:23 +0800 MIME-Version: 1.0 User-Agent: Mozilla Thunderbird To: Zhiguo Niu References: <1749107920-17958-1-git-send-email-zhiguo.niu@unisoc.com> <5c1da066-0c76-42f4-8c46-a99f60a900bf@kernel.org> Content-Language: en-US In-Reply-To: X-Headers-End: 1uPHIz-0000PY-5K Subject: Re: [f2fs-dev] [PATCH v3] f2fs: compress: fix UAF of f2fs_inode_info in f2fs_free_dic X-BeenThere: linux-f2fs-devel@lists.sourceforge.net X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , From: Chao Yu via Linux-f2fs-devel Reply-To: Chao Yu Cc: ke.wang@unisoc.com, linux-kernel@vger.kernel.org, linux-f2fs-devel@lists.sourceforge.net, Zhiguo Niu , Jaegeuk Kim , baocong.liu@unisoc.com, Hao_hao.Wang@unisoc.com Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 Errors-To: linux-f2fs-devel-bounces@lists.sourceforge.net T24gNi8xMS8yNSAxNTo1MSwgWmhpZ3VvIE5pdSB3cm90ZToKPiBaaGlndW8gTml1IDxuaXV6aGln dW84NEBnbWFpbC5jb20+IOS6jjIwMjXlubQ25pyIMTHml6XlkajkuIkgMTQ6NTLlhpnpgZPvvJoK Pj4KPj4gQ2hhbyBZdSA8Y2hhb0BrZXJuZWwub3JnPiDkuo4yMDI15bm0NuaciDEx5pel5ZGo5LiJ IDE0OjQ35YaZ6YGT77yaCj4+Pgo+Pj4gT24gNi8xMS8yNSAxNDo0MSwgWmhpZ3VvIE5pdSB3cm90 ZToKPj4+PiBDaGFvIFl1IDxjaGFvQGtlcm5lbC5vcmc+IOS6jjIwMjXlubQ25pyIMTHml6Xlkajk uIkgMTQ6MDflhpnpgZPvvJoKPj4+Pj4KPj4+Pj4gT24gNi8xMS8yNSAwMDowOCwgSmFlZ2V1ayBL aW0gd3JvdGU6Cj4+Pj4+PiBIaSBaaGlndW8sCj4+Pj4+Pgo+Pj4+Pj4gVGhpcyBwYXRjaCBjYXVz ZXMgQ1BVIGhhbmcgd2hlbiBydW5uaW5nIGZzc3RyZXNzIG9uIGNvbXByZXNzZWQvbm9uLWNvbXBy ZXNzZWQKPj4+Pj4+IGZpbGVzLiBQbGVhc2UgY2hlY2suCj4+Pj4+Cj4+Pj4+IE9oLCBzZWVtcyBp dCBtYXkgY2F1c2UgYmVsb3cgZGVhZGxvY2s6Cj4+Pj4+Cj4+Pj4+IENQVTAKPj4+Pj4gcHJvY2Vz cyBBCj4+Pj4+IC0gc3Bpbl9sb2NrKGlfbG9jaykKPj4+Pj4gc29mdHdhcmUgSVJRCj4+Pj4+IC0g ZW5kX2lvCj4+Pj4+ICAtIGlncmFiCj4+Pj4+ICAgLSBzcGluX2xvY2soaV9sb2NrKQo+Pj4+Pgo+ Pj4+PiBUaGFua3MsCj4+Pj4gSGkgQ2hhbywKPj4+PiBUaGFua3MgZm9yIHBvaW50aW5nIHRoaXMg b3V0Lgo+Pj4+IEkgaGF2ZSB0ZXN0ZWQgdGhpcyBwYXRjaCBsb2NhbGx5IGFib3V0IHNvbWUgYmFz aWMgY2FzZXMgYmVmb3JlIHN1Ym1pc3Npb24uCj4+Pj4gU28gaXQgc2VlbXMgdGhhdCBzaG91bGQg dXNlIHRoZSBmb2xsb3dpbmcgbWV0aG9kICB0byBzb2x2ZSB0aGlzIHByb2JsZW0/Cj4+Pj4gIiBz dG9yZSBpX2NvbXByZXNzX2FsZ29yaXRobS9zYmkgaW4gZGljIHRvIGF2b2lkIGlub2RlIGFjY2Vz cz8iCj4+Pgo+Pj4gWmhpZ3VvLAo+Pj4KPj4+IFllYWgsIEkgZ3Vlc3Mgc28uCj4+IEhpIENoYW8s Cj4+IE9LLCBJIHdpbGwgcHJlcGFyZSBpdCAuCj4+IFRoYW5rcyBhIGxvdC4KPj4+Cj4+PiBUaGFu a3MsCj4+Pgo+Pj4+IHRoYW5rc++8gQo+Pj4+Cj4+Pj4KPj4+Pj4KPj4+Pj4+Cj4+Pj4+PiBPbiAw Ni8wNSwgWmhpZ3VvIE5pdSB3cm90ZToKPj4+Pj4+PiBUaGUgZGVjb21wcmVzc19pb19jdHggbWF5 IGJlIHJlbGVhc2VkIGFzeW5jaHJvbm91c2x5IGFmdGVyCj4+Pj4+Pj4gSS9PIGNvbXBsZXRpb24u IElmIHRoaXMgZmlsZSBpcyBkZWxldGVkIGltbWVkaWF0ZWx5IGFmdGVyIHJlYWQsCj4+Pj4+Pj4g YW5kIHRoZSBrd29ya2VyIG9mIHByb2Nlc3NpbmcgcG9zdF9yZWFkX3dxIGhhcyBub3QgYmVlbiBl eGVjdXRlZCB5ZXQKPj4+Pj4+PiBkdWUgdG8gaGlnaCB3b3JrbG9hZHMsIEl0IGlzIHBvc3NpYmxl IHRoYXQgdGhlIGlub2RlKGYyZnNfaW5vZGVfaW5mbykKPj4+Pj4+PiBpcyBldmljdGVkIGFuZCBm cmVlZCBiZWZvcmUgaXQgaXMgdXNlZCBmMmZzX2ZyZWVfZGljLgo+Pj4+Pj4+Cj4+Pj4+Pj4gICAg IFRoZSBVQUYgY2FzZSBhcyBiZWxvdzoKPj4+Pj4+PiAgICAgVGhyZWFkIEEgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgIFRocmVhZCBCCj4+Pj4+Pj4gICAgIC0gZjJmc19kZWNv bXByZXNzX2VuZF9pbwo+Pj4+Pj4+ICAgICAgLSBmMmZzX3B1dF9kaWMKPj4+Pj4+PiAgICAgICAt IHF1ZXVlX3dvcmsKPj4+Pj4+PiAgICAgICAgIGFkZCBmcmVlX2RpYyB3b3JrIHRvIHBvc3RfcmVh ZF93cQo+Pj4+Pj4+ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgIC0gZG9fdW5saW5rCj4+Pj4+Pj4gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgIC0gaXB1dAo+Pj4+Pj4+ICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLSBldmljdAo+Pj4+Pj4+ICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC0gY2FsbF9yY3UK Pj4+Pj4+PiAgICAgVGhpcyBmaWxlIGlzIGRlbGV0ZWQgYWZ0ZXIgcmVhZC4KPj4+Pj4+Pgo+Pj4+ Pj4+ICAgICBUaHJlYWQgQyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGt3b3JrZXIg dG8gcHJvY2VzcyBwb3N0X3JlYWRfd3EKPj4+Pj4+PiAgICAgLSByY3VfZG9fYmF0Y2gKPj4+Pj4+ PiAgICAgIC0gZjJmc19mcmVlX2lub2RlCj4+Pj4+Pj4gICAgICAgLSBrbWVtX2NhY2hlX2ZyZWUK Pj4+Pj4+PiAgICAgIGlub2RlIGlzIGZyZWVkIGJ5IHJjdQo+Pj4+Pj4+ICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC0gcHJvY2Vzc19zY2hlZHVsZWRfd29ya3MK Pj4+Pj4+PiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLSBm MmZzX2xhdGVfZnJlZV9kaWMKPj4+Pj4+PiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgIC0gZjJmc19mcmVlX2RpYwo+Pj4+Pj4+ICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC0gZjJmc19yZWxlYXNlX2RlY29tcF9tZW0K Pj4+Pj4+PiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHJlYWQgKGRpYy0+ aW5vZGUpLT5pX2NvbXByZXNzX2FsZ29yaXRobQo+Pj4+Pj4+Cj4+Pj4+Pj4gVGhpcyBwYXRjaCB1 c2UgaWdyYWIgYmVmb3JlIGYyZnNfZnJlZV9kaWMgYW5kIGlwdXQgYWZ0ZXIgZnJlZSB0aGUgZGlj IHdoZW4gZGljIGZyZWUKPj4+Pj4+PiBhY3Rpb24gaXMgZG9uZSBieSBrd29ya2VyLgo+Pj4+Pj4+ Cj4+Pj4+Pj4gQ2M6IERhZWhvIEplb25nIDxkYWVob2plb25nQGdvb2dsZS5jb20+Cj4+Pj4+Pj4g Rml4ZXM6IGJmZjEzOWI0OWQ5ZiAoImYyZnM6IGhhbmRsZSBkZWNvbXByZXNzIG9ubHkgcG9zdCBw cm9jZXNzaW5nIGluIHNvZnRpcnEiKQo+Pj4+Pj4+IFNpZ25lZC1vZmYtYnk6IFpoaWd1byBOaXUg PHpoaWd1by5uaXVAdW5pc29jLmNvbT4KPj4+Pj4+PiBTaWduZWQtb2ZmLWJ5OiBCYW9jb25nIExp dSA8YmFvY29uZy5saXVAdW5pc29jLmNvbT4KPj4+Pj4+PiAtLS0KPj4+Pj4+PiB2MzogdXNlIGln cmFiIHRvIHJlcGxhY2UgX19pZ2V0Cj4+Pj4+Pj4gdjI6IHVzZSBfX2lnZXQvaXB1dCBmdW5jdGlv bgo+Pj4+Pj4+IC0tLQo+Pj4+Pj4+ICBmcy9mMmZzL2NvbXByZXNzLmMgfCAxNCArKysrKysrKyst LS0tLQo+Pj4+Pj4+ICAxIGZpbGUgY2hhbmdlZCwgOSBpbnNlcnRpb25zKCspLCA1IGRlbGV0aW9u cygtKQo+Pj4+Pj4+Cj4+Pj4+Pj4gZGlmZiAtLWdpdCBhL2ZzL2YyZnMvY29tcHJlc3MuYyBiL2Zz L2YyZnMvY29tcHJlc3MuYwo+Pj4+Pj4+IGluZGV4IGIzYzFkZjkuLjcyOWFkMTYgMTAwNjQ0Cj4+ Pj4+Pj4gLS0tIGEvZnMvZjJmcy9jb21wcmVzcy5jCj4+Pj4+Pj4gKysrIGIvZnMvZjJmcy9jb21w cmVzcy5jCj4+Pj4+Pj4gQEAgLTE2ODcsNyArMTY4Nyw3IEBAIHN0YXRpYyB2b2lkIGYyZnNfcmVs ZWFzZV9kZWNvbXBfbWVtKHN0cnVjdCBkZWNvbXByZXNzX2lvX2N0eCAqZGljLAo+Pj4+Pj4+ICB9 Cj4+Pj4+Pj4KPj4+Pj4+PiAgc3RhdGljIHZvaWQgZjJmc19mcmVlX2RpYyhzdHJ1Y3QgZGVjb21w cmVzc19pb19jdHggKmRpYywKPj4+Pj4+PiAtICAgICAgICAgICAgYm9vbCBieXBhc3NfZGVzdHJv eV9jYWxsYmFjayk7Cj4+Pj4+Pj4gKyAgICAgICAgICAgIGJvb2wgYnlwYXNzX2Rlc3Ryb3lfY2Fs bGJhY2ssIGJvb2wgbGF0ZV9mcmVlKTsKPj4+Pj4+Pgo+Pj4+Pj4+ICBzdHJ1Y3QgZGVjb21wcmVz c19pb19jdHggKmYyZnNfYWxsb2NfZGljKHN0cnVjdCBjb21wcmVzc19jdHggKmNjKQo+Pj4+Pj4+ ICB7Cj4+Pj4+Pj4gQEAgLTE3NDMsMTIgKzE3NDMsMTIgQEAgc3RydWN0IGRlY29tcHJlc3NfaW9f Y3R4ICpmMmZzX2FsbG9jX2RpYyhzdHJ1Y3QgY29tcHJlc3NfY3R4ICpjYykKPj4+Pj4+PiAgICAg IHJldHVybiBkaWM7Cj4+Pj4+Pj4KPj4+Pj4+PiAgb3V0X2ZyZWU6Cj4+Pj4+Pj4gLSAgICBmMmZz X2ZyZWVfZGljKGRpYywgdHJ1ZSk7Cj4+Pj4+Pj4gKyAgICBmMmZzX2ZyZWVfZGljKGRpYywgdHJ1 ZSwgZmFsc2UpOwo+Pj4+Pj4+ICAgICAgcmV0dXJuIEVSUl9QVFIocmV0KTsKPj4+Pj4+PiAgfQo+ Pj4+Pj4+Cj4+Pj4+Pj4gIHN0YXRpYyB2b2lkIGYyZnNfZnJlZV9kaWMoc3RydWN0IGRlY29tcHJl c3NfaW9fY3R4ICpkaWMsCj4+Pj4+Pj4gLSAgICAgICAgICAgIGJvb2wgYnlwYXNzX2Rlc3Ryb3lf Y2FsbGJhY2spCj4+Pj4+Pj4gKyAgICAgICAgICAgIGJvb2wgYnlwYXNzX2Rlc3Ryb3lfY2FsbGJh Y2ssIGJvb2wgbGF0ZV9mcmVlKQo+Pj4+Pj4+ICB7Cj4+Pj4+Pj4gICAgICBpbnQgaTsKPj4+Pj4+ Pgo+Pj4+Pj4+IEBAIC0xNzc1LDYgKzE3NzUsOCBAQCBzdGF0aWMgdm9pZCBmMmZzX2ZyZWVfZGlj KHN0cnVjdCBkZWNvbXByZXNzX2lvX2N0eCAqZGljLAo+Pj4+Pj4+ICAgICAgfQo+Pj4+Pj4+Cj4+ Pj4+Pj4gICAgICBwYWdlX2FycmF5X2ZyZWUoZGljLT5pbm9kZSwgZGljLT5ycGFnZXMsIGRpYy0+ bnJfcnBhZ2VzKTsKPj4+Pj4+PiArICAgIGlmIChsYXRlX2ZyZWUpCj4+Pj4+Pj4gKyAgICAgICAg ICAgIGlwdXQoZGljLT5pbm9kZSk7Cj4+Pj4+Pj4gICAgICBrbWVtX2NhY2hlX2ZyZWUoZGljX2Vu dHJ5X3NsYWIsIGRpYyk7Cj4+Pj4+Pj4gIH0KPj4+Pj4+Pgo+Pj4+Pj4+IEBAIC0xNzgzLDE2ICsx Nzg1LDE4IEBAIHN0YXRpYyB2b2lkIGYyZnNfbGF0ZV9mcmVlX2RpYyhzdHJ1Y3Qgd29ya19zdHJ1 Y3QgKndvcmspCj4+Pj4+Pj4gICAgICBzdHJ1Y3QgZGVjb21wcmVzc19pb19jdHggKmRpYyA9Cj4+ Pj4+Pj4gICAgICAgICAgICAgIGNvbnRhaW5lcl9vZih3b3JrLCBzdHJ1Y3QgZGVjb21wcmVzc19p b19jdHgsIGZyZWVfd29yayk7Cj4+Pj4+Pj4KPj4+Pj4+PiAtICAgIGYyZnNfZnJlZV9kaWMoZGlj LCBmYWxzZSk7Cj4+Pj4+Pj4gKyAgICBmMmZzX2ZyZWVfZGljKGRpYywgZmFsc2UsIHRydWUpOwo+ Pj4+Pj4+ICB9Cj4+Pj4+Pj4KPj4+Pj4+PiAgc3RhdGljIHZvaWQgZjJmc19wdXRfZGljKHN0cnVj dCBkZWNvbXByZXNzX2lvX2N0eCAqZGljLCBib29sIGluX3Rhc2spCj4+Pj4+Pj4gIHsKPj4+Pj4+ PiAgICAgIGlmIChyZWZjb3VudF9kZWNfYW5kX3Rlc3QoJmRpYy0+cmVmY250KSkgewo+Pj4+Pj4+ ICAgICAgICAgICAgICBpZiAoaW5fdGFzaykgewo+Pj4+Pj4+IC0gICAgICAgICAgICAgICAgICAg IGYyZnNfZnJlZV9kaWMoZGljLCBmYWxzZSk7Cj4+Pj4+Pj4gKyAgICAgICAgICAgICAgICAgICAg ZjJmc19mcmVlX2RpYyhkaWMsIGZhbHNlLCBmYWxzZSk7Cj4+Pj4+Pj4gICAgICAgICAgICAgIH0g ZWxzZSB7Cj4+Pj4+Pj4gICAgICAgICAgICAgICAgICAgICAgSU5JVF9XT1JLKCZkaWMtPmZyZWVf d29yaywgZjJmc19sYXRlX2ZyZWVfZGljKTsKPj4+Pj4+PiArICAgICAgICAgICAgICAgICAgICAv KiB1c2UgaWdyYWIgdG8gYXZvaWQgaW5vZGUgaXMgZXZpY3RlZCBzaW11bHRhbmVvdXNseSAqLwo+ Pj4+Pj4+ICsgICAgICAgICAgICAgICAgICAgIGYyZnNfYnVnX29uKEYyRlNfSV9TQihkaWMtPmlu b2RlKSwgIWlncmFiKGRpYy0+aW5vZGUpKTsKPj4+Pj4+PiAgICAgICAgICAgICAgICAgICAgICBx dWV1ZV93b3JrKEYyRlNfSV9TQihkaWMtPmlub2RlKS0+cG9zdF9yZWFkX3dxLAo+Pj4+Pj4+ICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAmZGljLT5mcmVlX3dvcmspOwo+Pj4+ Pj4+ICAgICAgICAgICAgICB9Cj4+Pj4+Pj4gLS0KPj4+Pj4+PiAxLjkuMQo+Pj4+Pgo+Pj4KPiAK PiBIaSBDaGFvLAo+IAo+IFRoZSBwYXRjaCBpcyBhYm91dCBhcyBmb2xsb3dzLCBiZWNhdXNlIGRp Yy0+c2JpIGlzIHVzZWQgZGlyZWN0bHkgaW4KPiBmMmZzX2ZyZWVfZGljOiBwYWdlX2FycmF5X2Zy ZWUoZGljLT5zYmksIGRpYy0+dHBhZ2VzLCBkaWMtPmNsdXN0ZXJfc2l6ZSk7Cj4gc28gdGhlcmUg YXJlIHR3byBwb2ludHMgSSB3YW50IHRvIGNvbmZpcm06Cj4gMS4gQXMgYSBjb3JyZXNwb25kaW5n LCB0aGUgZmlyc3QgcGFyYW1ldGVyIChpbm9kZSkgb2YgcGFnZV9hcnJheV9hbGxvYwo+IGlzIG5l ZWQgdG8gbW9kaWZ5IHRvIHNiaSBvciBub3QgPwo+IDIuIEFzIGEgY29ycmVzcG9uZGluZywgZG8g d2UgbmVlZCB0byBhZGQgdGhlIHNiaSBmaWVsZCBpbiBjb21wcmVzc19jdHgKPiBzbyB0aGF0IHBh Z2VfYXJyYXlfYWxsb2MvZnJlZSBjYWxsZWQKPiBpbiBjb21wcmVzcyBmbG93IGNhbiB1c2Ugc2Jp IGRpcmVjdGx5PwoKWmhpZ3VvLCBib3RoIDEpIGFuZCAyKSBjaGFuZ2VzIGxvb2sgZmluZSB0byBt ZS4KClRoYW5rcywKCj4gVGhhbmtzIQo+IAo+IGRpZmYgLS1naXQgYS9mcy9mMmZzL2NvbXByZXNz LmMgYi9mcy9mMmZzL2NvbXByZXNzLmMKPiBpbmRleCBiM2MxZGY5Li44OTdkOGFlIDEwMDY0NAo+ IC0tLSBhL2ZzL2YyZnMvY29tcHJlc3MuYwo+ICsrKyBiL2ZzL2YyZnMvY29tcHJlc3MuYwo+IEBA IC0zNCw5ICszNCw4IEBAIHN0YXRpYyB2b2lkICpwYWdlX2FycmF5X2FsbG9jKHN0cnVjdCBpbm9k ZSAqaW5vZGUsIGludCBucikKPiAgICAgICAgIHJldHVybiBmMmZzX2t6YWxsb2Moc2JpLCBzaXpl LCBHRlBfTk9GUyk7Cj4gIH0KPiAKPiAtc3RhdGljIHZvaWQgcGFnZV9hcnJheV9mcmVlKHN0cnVj dCBpbm9kZSAqaW5vZGUsIHZvaWQgKnBhZ2VzLCBpbnQgbnIpCj4gK3N0YXRpYyB2b2lkIHBhZ2Vf YXJyYXlfZnJlZShzdHJ1Y3QgZjJmc19zYl9pbmZvICpzYmksIHZvaWQgKnBhZ2VzLCBpbnQgbnIp Cj4gIHsKPiAtICAgICAgIHN0cnVjdCBmMmZzX3NiX2luZm8gKnNiaSA9IEYyRlNfSV9TQihpbm9k ZSk7Cj4gICAgICAgICB1bnNpZ25lZCBpbnQgc2l6ZSA9IHNpemVvZihzdHJ1Y3QgcGFnZSAqKSAq IG5yOwo+IAo+ICAgICAgICAgaWYgKCFwYWdlcykKPiBAQCAtMTU1LDcgKzE1NCw3IEBAIGludCBm MmZzX2luaXRfY29tcHJlc3NfY3R4KHN0cnVjdCBjb21wcmVzc19jdHggKmNjKQo+IAo+ICB2b2lk IGYyZnNfZGVzdHJveV9jb21wcmVzc19jdHgoc3RydWN0IGNvbXByZXNzX2N0eCAqY2MsIGJvb2wg cmV1c2UpCj4gIHsKPiAtICAgICAgIHBhZ2VfYXJyYXlfZnJlZShjYy0+aW5vZGUsIGNjLT5ycGFn ZXMsIGNjLT5jbHVzdGVyX3NpemUpOwo+ICsgICAgICAgcGFnZV9hcnJheV9mcmVlKEYyRlNfSV9T QihjYy0+aW5vZGUpLCBjYy0+cnBhZ2VzLCBjYy0+Y2x1c3Rlcl9zaXplKTsKPiAgICAgICAgIGNj LT5ycGFnZXMgPSBOVUxMOwo+ICAgICAgICAgY2MtPm5yX3JwYWdlcyA9IDA7Cj4gICAgICAgICBj Yy0+bnJfY3BhZ2VzID0gMDsKPiBAQCAtNzE2LDcgKzcxNSw3IEBAIHN0YXRpYyBpbnQgZjJmc19j b21wcmVzc19wYWdlcyhzdHJ1Y3QgY29tcHJlc3NfY3R4ICpjYykKPiAgICAgICAgICAgICAgICAg aWYgKGNjLT5jcGFnZXNbaV0pCj4gICAgICAgICAgICAgICAgICAgICAgICAgZjJmc19jb21wcmVz c19mcmVlX3BhZ2UoY2MtPmNwYWdlc1tpXSk7Cj4gICAgICAgICB9Cj4gLSAgICAgICBwYWdlX2Fy cmF5X2ZyZWUoY2MtPmlub2RlLCBjYy0+Y3BhZ2VzLCBjYy0+bnJfY3BhZ2VzKTsKPiArICAgICAg IHBhZ2VfYXJyYXlfZnJlZShGMkZTX0lfU0IoY2MtPmlub2RlKSwgY2MtPmNwYWdlcywgY2MtPm5y X2NwYWdlcyk7Cj4gICAgICAgICBjYy0+Y3BhZ2VzID0gTlVMTDsKPiAgZGVzdHJveV9jb21wcmVz c19jdHg6Cj4gICAgICAgICBpZiAoY29wcy0+ZGVzdHJveV9jb21wcmVzc19jdHgpCj4gQEAgLTcz NCw3ICs3MzMsNyBAQCBzdGF0aWMgdm9pZCBmMmZzX3JlbGVhc2VfZGVjb21wX21lbShzdHJ1Y3QK PiBkZWNvbXByZXNzX2lvX2N0eCAqZGljLAo+IAo+ICB2b2lkIGYyZnNfZGVjb21wcmVzc19jbHVz dGVyKHN0cnVjdCBkZWNvbXByZXNzX2lvX2N0eCAqZGljLCBib29sIGluX3Rhc2spCj4gIHsKPiAt ICAgICAgIHN0cnVjdCBmMmZzX3NiX2luZm8gKnNiaSA9IEYyRlNfSV9TQihkaWMtPmlub2RlKTsK PiArICAgICAgIHN0cnVjdCBmMmZzX3NiX2luZm8gKnNiaSA9IGRpYy0+c2JpOwo+ICAgICAgICAg c3RydWN0IGYyZnNfaW5vZGVfaW5mbyAqZmkgPSBGMkZTX0koZGljLT5pbm9kZSk7Cj4gICAgICAg ICBjb25zdCBzdHJ1Y3QgZjJmc19jb21wcmVzc19vcHMgKmNvcHMgPQo+ICAgICAgICAgICAgICAg ICAgICAgICAgIGYyZnNfY29wc1tmaS0+aV9jb21wcmVzc19hbGdvcml0aG1dOwo+IEBAIC0xNDQy LDEzICsxNDQxLDEzIEBAIHN0YXRpYyBpbnQgZjJmc193cml0ZV9jb21wcmVzc2VkX3BhZ2VzKHN0 cnVjdAo+IGNvbXByZXNzX2N0eCAqY2MsCj4gICAgICAgICBzcGluX3VubG9jaygmZmktPmlfc2l6 ZV9sb2NrKTsKPiAKPiAgICAgICAgIGYyZnNfcHV0X3JwYWdlcyhjYyk7Cj4gLSAgICAgICBwYWdl X2FycmF5X2ZyZWUoY2MtPmlub2RlLCBjYy0+Y3BhZ2VzLCBjYy0+bnJfY3BhZ2VzKTsKPiArICAg ICAgIHBhZ2VfYXJyYXlfZnJlZShGMkZTX0lfU0IoY2MtPmlub2RlKSwgY2MtPmNwYWdlcywgY2Mt Pm5yX2NwYWdlcyk7Cj4gICAgICAgICBjYy0+Y3BhZ2VzID0gTlVMTDsKPiAgICAgICAgIGYyZnNf ZGVzdHJveV9jb21wcmVzc19jdHgoY2MsIGZhbHNlKTsKPiAgICAgICAgIHJldHVybiAwOwo+IAo+ ICBvdXRfZGVzdHJveV9jcnlwdDoKPiAtICAgICAgIHBhZ2VfYXJyYXlfZnJlZShjYy0+aW5vZGUs IGNpYy0+cnBhZ2VzLCBjYy0+Y2x1c3Rlcl9zaXplKTsKPiArICAgICAgIHBhZ2VfYXJyYXlfZnJl ZShGMkZTX0lfU0IoY2MtPmlub2RlKSwgY2ljLT5ycGFnZXMsIGNjLT5jbHVzdGVyX3NpemUpOwo+ IAo+ICAgICAgICAgZm9yICgtLWk7IGkgPj0gMDsgaS0tKSB7Cj4gICAgICAgICAgICAgICAgIGlm ICghY2MtPmNwYWdlc1tpXSkKPiBAQCAtMTQ2OSw3ICsxNDY4LDcgQEAgc3RhdGljIGludCBmMmZz X3dyaXRlX2NvbXByZXNzZWRfcGFnZXMoc3RydWN0Cj4gY29tcHJlc3NfY3R4ICpjYywKPiAgICAg ICAgICAgICAgICAgZjJmc19jb21wcmVzc19mcmVlX3BhZ2UoY2MtPmNwYWdlc1tpXSk7Cj4gICAg ICAgICAgICAgICAgIGNjLT5jcGFnZXNbaV0gPSBOVUxMOwo+ICAgICAgICAgfQo+IC0gICAgICAg cGFnZV9hcnJheV9mcmVlKGNjLT5pbm9kZSwgY2MtPmNwYWdlcywgY2MtPm5yX2NwYWdlcyk7Cj4g KyAgICAgICBwYWdlX2FycmF5X2ZyZWUoRjJGU19JX1NCKGNjLT5pbm9kZSksIGNjLT5jcGFnZXMs IGNjLT5ucl9jcGFnZXMpOwo+ICAgICAgICAgY2MtPmNwYWdlcyA9IE5VTEw7Cj4gICAgICAgICBy ZXR1cm4gLUVBR0FJTjsKPiAgfQo+IEBAIC0xNDk5LDcgKzE0OTgsNyBAQCB2b2lkIGYyZnNfY29t cHJlc3Nfd3JpdGVfZW5kX2lvKHN0cnVjdCBiaW8gKmJpbywKPiBzdHJ1Y3QgcGFnZSAqcGFnZSkK PiAgICAgICAgICAgICAgICAgZW5kX3BhZ2Vfd3JpdGViYWNrKGNpYy0+cnBhZ2VzW2ldKTsKPiAg ICAgICAgIH0KPiAKPiAtICAgICAgIHBhZ2VfYXJyYXlfZnJlZShjaWMtPmlub2RlLCBjaWMtPnJw YWdlcywgY2ljLT5ucl9ycGFnZXMpOwo+ICsgICAgICAgcGFnZV9hcnJheV9mcmVlKEYyRlNfSV9T QihjaWMtPmlub2RlKSwgY2ljLT5ycGFnZXMsIGNpYy0+bnJfcnBhZ2VzKTsKPiAgICAgICAgIGtt ZW1fY2FjaGVfZnJlZShjaWNfZW50cnlfc2xhYiwgY2ljKTsKPiAgfQo+IAo+IEBAIC0xNjM3LDcg KzE2MzYsNyBAQCBzdGF0aWMgaW50IGYyZnNfcHJlcGFyZV9kZWNvbXBfbWVtKHN0cnVjdAo+IGRl Y29tcHJlc3NfaW9fY3R4ICpkaWMsCj4gICAgICAgICAgICAgICAgIGYyZnNfY29wc1tGMkZTX0ko ZGljLT5pbm9kZSktPmlfY29tcHJlc3NfYWxnb3JpdGhtXTsKPiAgICAgICAgIGludCBpOwo+IAo+ IC0gICAgICAgaWYgKCFhbGxvd19tZW1hbGxvY19mb3JfZGVjb21wKEYyRlNfSV9TQihkaWMtPmlu b2RlKSwgcHJlX2FsbG9jKSkKPiArICAgICAgIGlmICghYWxsb3dfbWVtYWxsb2NfZm9yX2RlY29t cChkaWMtPnNiaSwgcHJlX2FsbG9jKSkKPiAgICAgICAgICAgICAgICAgcmV0dXJuIDA7Cj4gCj4g ICAgICAgICBkaWMtPnRwYWdlcyA9IHBhZ2VfYXJyYXlfYWxsb2MoZGljLT5pbm9kZSwgZGljLT5j bHVzdGVyX3NpemUpOwo+IEBAIC0xNjcwLDEwICsxNjY5LDkgQEAgc3RhdGljIGludCBmMmZzX3By ZXBhcmVfZGVjb21wX21lbShzdHJ1Y3QKPiBkZWNvbXByZXNzX2lvX2N0eCAqZGljLAo+ICBzdGF0 aWMgdm9pZCBmMmZzX3JlbGVhc2VfZGVjb21wX21lbShzdHJ1Y3QgZGVjb21wcmVzc19pb19jdHgg KmRpYywKPiAgICAgICAgICAgICAgICAgYm9vbCBieXBhc3NfZGVzdHJveV9jYWxsYmFjaywgYm9v bCBwcmVfYWxsb2MpCj4gIHsKPiAtICAgICAgIGNvbnN0IHN0cnVjdCBmMmZzX2NvbXByZXNzX29w cyAqY29wcyA9Cj4gLSAgICAgICAgICAgICAgIGYyZnNfY29wc1tGMkZTX0koZGljLT5pbm9kZSkt PmlfY29tcHJlc3NfYWxnb3JpdGhtXTsKPiArICAgICAgIGNvbnN0IHN0cnVjdCBmMmZzX2NvbXBy ZXNzX29wcyAqY29wcyA9Cj4gZjJmc19jb3BzW2RpYy0+Y29tcHJlc3NfYWxnb3JpdGhtXTsKPiAK PiAtICAgICAgIGlmICghYWxsb3dfbWVtYWxsb2NfZm9yX2RlY29tcChGMkZTX0lfU0IoZGljLT5p bm9kZSksIHByZV9hbGxvYykpCj4gKyAgICAgICBpZiAoIWFsbG93X21lbWFsbG9jX2Zvcl9kZWNv bXAoZGljLT5zYmksIHByZV9hbGxvYykpCj4gICAgICAgICAgICAgICAgIHJldHVybjsKPiAKPiAg ICAgICAgIGlmICghYnlwYXNzX2Rlc3Ryb3lfY2FsbGJhY2sgJiYgY29wcy0+ZGVzdHJveV9kZWNv bXByZXNzX2N0eCkKPiBAQCAtMTcwOCw2ICsxNzA2LDggQEAgc3RydWN0IGRlY29tcHJlc3NfaW9f Y3R4ICpmMmZzX2FsbG9jX2RpYyhzdHJ1Y3QKPiBjb21wcmVzc19jdHggKmNjKQo+IAo+ICAgICAg ICAgZGljLT5tYWdpYyA9IEYyRlNfQ09NUFJFU1NFRF9QQUdFX01BR0lDOwo+ICAgICAgICAgZGlj LT5pbm9kZSA9IGNjLT5pbm9kZTsKPiArICAgICAgIGRpYy0+c2JpID0gc2JpOwo+ICsgICAgICAg ZGljLT5jb21wcmVzc19hbGdvcml0aG0gPSBGMkZTX0koY2MtPmlub2RlKS0+aV9jb21wcmVzc19h bGdvcml0aG07Cj4gICAgICAgICBhdG9taWNfc2V0KCZkaWMtPnJlbWFpbmluZ19wYWdlcywgY2Mt Pm5yX2NwYWdlcyk7Cj4gICAgICAgICBkaWMtPmNsdXN0ZXJfaWR4ID0gY2MtPmNsdXN0ZXJfaWR4 Owo+ICAgICAgICAgZGljLT5jbHVzdGVyX3NpemUgPSBjYy0+Y2x1c3Rlcl9zaXplOwo+IEBAIC0x NzYyLDcgKzE3NjIsNyBAQCBzdGF0aWMgdm9pZCBmMmZzX2ZyZWVfZGljKHN0cnVjdCBkZWNvbXBy ZXNzX2lvX2N0eCAqZGljLAo+ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgY29udGlu dWU7Cj4gICAgICAgICAgICAgICAgICAgICAgICAgZjJmc19jb21wcmVzc19mcmVlX3BhZ2UoZGlj LT50cGFnZXNbaV0pOwo+ICAgICAgICAgICAgICAgICB9Cj4gLSAgICAgICAgICAgICAgIHBhZ2Vf YXJyYXlfZnJlZShkaWMtPmlub2RlLCBkaWMtPnRwYWdlcywgZGljLT5jbHVzdGVyX3NpemUpOwo+ ICsgICAgICAgICAgICAgICBwYWdlX2FycmF5X2ZyZWUoZGljLT5zYmksIGRpYy0+dHBhZ2VzLCBk aWMtPmNsdXN0ZXJfc2l6ZSk7Cj4gICAgICAgICB9Cj4gCj4gICAgICAgICBpZiAoZGljLT5jcGFn ZXMpIHsKPiBAQCAtMTc3MSwxMCArMTc3MSwxMCBAQCBzdGF0aWMgdm9pZCBmMmZzX2ZyZWVfZGlj KHN0cnVjdCBkZWNvbXByZXNzX2lvX2N0eCAqZGljLAo+ICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgY29udGludWU7Cj4gICAgICAgICAgICAgICAgICAgICAgICAgZjJmc19jb21wcmVz c19mcmVlX3BhZ2UoZGljLT5jcGFnZXNbaV0pOwo+ICAgICAgICAgICAgICAgICB9Cj4gLSAgICAg ICAgICAgICAgIHBhZ2VfYXJyYXlfZnJlZShkaWMtPmlub2RlLCBkaWMtPmNwYWdlcywgZGljLT5u cl9jcGFnZXMpOwo+ICsgICAgICAgICAgICAgICBwYWdlX2FycmF5X2ZyZWUoZGljLT5zYmksIGRp Yy0+Y3BhZ2VzLCBkaWMtPm5yX2NwYWdlcyk7Cj4gICAgICAgICB9Cj4gCj4gLSAgICAgICBwYWdl X2FycmF5X2ZyZWUoZGljLT5pbm9kZSwgZGljLT5ycGFnZXMsIGRpYy0+bnJfcnBhZ2VzKTsKPiAr ICAgICAgIHBhZ2VfYXJyYXlfZnJlZShkaWMtPnNiaSwgZGljLT5ycGFnZXMsIGRpYy0+bnJfcnBh Z2VzKTsKPiAgICAgICAgIGttZW1fY2FjaGVfZnJlZShkaWNfZW50cnlfc2xhYiwgZGljKTsKPiAg fQo+IAo+IGRpZmYgLS1naXQgYS9mcy9mMmZzL2YyZnMuaCBiL2ZzL2YyZnMvZjJmcy5oCj4gaW5k ZXggOTMzM2EyMmIuLmRhMjEzN2UgMTAwNjQ0Cj4gLS0tIGEvZnMvZjJmcy9mMmZzLmgKPiArKysg Yi9mcy9mMmZzL2YyZnMuaAo+IEBAIC0xNTM2LDYgKzE1MzYsNyBAQCBzdHJ1Y3QgY29tcHJlc3Nf aW9fY3R4IHsKPiAgc3RydWN0IGRlY29tcHJlc3NfaW9fY3R4IHsKPiAgICAgICAgIHUzMiBtYWdp YzsgICAgICAgICAgICAgICAgICAgICAgLyogbWFnaWMgbnVtYmVyIHRvIGluZGljYXRlCj4gcGFn ZSBpcyBjb21wcmVzc2VkICovCj4gICAgICAgICBzdHJ1Y3QgaW5vZGUgKmlub2RlOyAgICAgICAg ICAgIC8qIGlub2RlIHRoZSBjb250ZXh0IGJlbG9uZyB0byAqLwo+ICsgICAgICAgc3RydWN0IGYy ZnNfc2JfaW5mbyAqc2JpOyAgICAgICAvKiBmMmZzX3NiX2luZm8gcG9pbnRlciAqLwo+ICAgICAg ICAgcGdvZmZfdCBjbHVzdGVyX2lkeDsgICAgICAgICAgICAvKiBjbHVzdGVyIGluZGV4IG51bWJl ciAqLwo+ICAgICAgICAgdW5zaWduZWQgaW50IGNsdXN0ZXJfc2l6ZTsgICAgICAvKiBwYWdlIGNv dW50IGluIGNsdXN0ZXIgKi8KPiAgICAgICAgIHVuc2lnbmVkIGludCBsb2dfY2x1c3Rlcl9zaXpl OyAgLyogbG9nIG9mIGNsdXN0ZXIgc2l6ZSAqLwo+IEBAIC0xNTc2LDYgKzE1NzcsNyBAQCBzdHJ1 Y3QgZGVjb21wcmVzc19pb19jdHggewo+IAo+ICAgICAgICAgYm9vbCBmYWlsZWQ7ICAgICAgICAg ICAgICAgICAgICAvKiBJTyBlcnJvciBvY2N1cnJlZCBiZWZvcmUKPiBkZWNvbXByZXNzaW9uPyAq Lwo+ICAgICAgICAgYm9vbCBuZWVkX3Zlcml0eTsgICAgICAgICAgICAgICAvKiBuZWVkIGZzLXZl cml0eSB2ZXJpZmljYXRpb24KPiBhZnRlciBkZWNvbXByZXNzaW9uPyAqLwo+ICsgICAgICAgdW5z aWduZWQgY2hhciBjb21wcmVzc19hbGdvcml0aG07ICAgICAgIC8qIGJhY2t1cCBhbGdvcml0aG0g dHlwZSAqLwo+ICAgICAgICAgdm9pZCAqcHJpdmF0ZTsgICAgICAgICAgICAgICAgICAvKiBwYXls b2FkIGJ1ZmZlciBmb3IKPiBzcGVjaWZpZWQgZGVjb21wcmVzc2lvbiBhbGdvcml0aG0gKi8KPiAg ICAgICAgIHZvaWQgKnByaXZhdGUyOyAgICAgICAgICAgICAgICAgLyogZXh0cmEgcGF5bG9hZCBi dWZmZXIgKi8KPiAgICAgICAgIHN0cnVjdCB3b3JrX3N0cnVjdCB2ZXJpdHlfd29yazsgLyogd29y ayB0byB2ZXJpZnkgdGhlCj4gZGVjb21wcmVzc2VkIHBhZ2VzICovCgoKCl9fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fCkxpbnV4LWYyZnMtZGV2ZWwgbWFpbGlu ZyBsaXN0CkxpbnV4LWYyZnMtZGV2ZWxAbGlzdHMuc291cmNlZm9yZ2UubmV0Cmh0dHBzOi8vbGlz dHMuc291cmNlZm9yZ2UubmV0L2xpc3RzL2xpc3RpbmZvL2xpbnV4LWYyZnMtZGV2ZWwK From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id BBB9025B676 for ; Wed, 11 Jun 2025 08:59:27 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1749632367; cv=none; b=kum7zmJkjLSn8gvqPSPAKdMoh4gQaH5S5gOmsdr3mQ7sgCt43ulP08x1MehAKCmENmY6d0tzz1H6nvUPqlNfCK4HYFIs52MSpQ7fF/Xp5QwkDVYD/cOYaTEqtXdp+oeFf9TzLDDWguMK3ZUiBblgTVPFYVtME/zAUZfb6ks+VcM= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1749632367; c=relaxed/simple; bh=ue+31B2bG/IgKEzAtR1bURwIK+Rmq5NQ4YjRrVZ466s=; h=Message-ID:Date:MIME-Version:Cc:Subject:To:References:From: In-Reply-To:Content-Type; b=mBgSU/GpP+Lm4irfoRTFoUQn+q8Zm0wM+375qpz4Vk7Px2dE72QmOuH4jr7PWDccpXqaSSmoTp4HQ1KYL8Pi6dWcCMDKD0zVsKM62F+jdFIpQ7yEwimSDmrOcWbQDn0wGSn2B/JNXwEKi4DdszImtXVZjCDCuc24TiS5HiAGpf8= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=AFrw0z5Q; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="AFrw0z5Q" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 01C84C4CEEE; Wed, 11 Jun 2025 08:59:24 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1749632367; bh=ue+31B2bG/IgKEzAtR1bURwIK+Rmq5NQ4YjRrVZ466s=; h=Date:Cc:Subject:To:References:From:In-Reply-To:From; b=AFrw0z5Q8pmOz+yeoK37AD5kqStvJnpFyGDBnPcuntaXQ36GHdQcv/5i0nt+BwztX n+bWDRjGssYXXZzkcNRjhX5JH01C1X254U/HeYSM/OB9kDQNjua+sCU9W/mGVM1WEu gQ8ag+2H7bVr2o15HRBGNpLmhtEHnVVf2rsAZlBrqO6NrmSRA/BNBbLph6NrFulvR4 DWv9RJ527bxuFb2DlygTIum3TWa8MnCdGEnQ986Dh9o4hh/SnNw37gcLiOzPJxOBSr wLeFTaDuHbQyHvZaaW8sc50ba2zxWbreSVDMqyNh/qzuWROQ/W2WUXm449GM3oG/DH zdpVg80f9n//A== Message-ID: Date: Wed, 11 Jun 2025 16:59:23 +0800 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Cc: chao@kernel.org, Jaegeuk Kim , Zhiguo Niu , linux-f2fs-devel@lists.sourceforge.net, linux-kernel@vger.kernel.org, ke.wang@unisoc.com, Hao_hao.Wang@unisoc.com, baocong.liu@unisoc.com Subject: Re: [PATCH v3] f2fs: compress: fix UAF of f2fs_inode_info in f2fs_free_dic To: Zhiguo Niu References: <1749107920-17958-1-git-send-email-zhiguo.niu@unisoc.com> <5c1da066-0c76-42f4-8c46-a99f60a900bf@kernel.org> Content-Language: en-US From: Chao Yu In-Reply-To: Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit On 6/11/25 15:51, Zhiguo Niu wrote: > Zhiguo Niu 于2025年6月11日周三 14:52写道： >> >> Chao Yu 于2025年6月11日周三 14:47写道： >>> >>> On 6/11/25 14:41, Zhiguo Niu wrote: >>>> Chao Yu 于2025年6月11日周三 14:07写道： >>>>> >>>>> On 6/11/25 00:08, Jaegeuk Kim wrote: >>>>>> Hi Zhiguo, >>>>>> >>>>>> This patch causes CPU hang when running fsstress on compressed/non-compressed >>>>>> files. Please check. >>>>> >>>>> Oh, seems it may cause below deadlock: >>>>> >>>>> CPU0 >>>>> process A >>>>> - spin_lock(i_lock) >>>>> software IRQ >>>>> - end_io >>>>> - igrab >>>>> - spin_lock(i_lock) >>>>> >>>>> Thanks, >>>> Hi Chao, >>>> Thanks for pointing this out. >>>> I have tested this patch locally about some basic cases before submission. >>>> So it seems that should use the following method to solve this problem? >>>> " store i_compress_algorithm/sbi in dic to avoid inode access?" >>> >>> Zhiguo, >>> >>> Yeah, I guess so. >> Hi Chao, >> OK, I will prepare it . >> Thanks a lot. >>> >>> Thanks, >>> >>>> thanks！ >>>> >>>> >>>>> >>>>>> >>>>>> On 06/05, Zhiguo Niu wrote: >>>>>>> The decompress_io_ctx may be released asynchronously after >>>>>>> I/O completion. If this file is deleted immediately after read, >>>>>>> and the kworker of processing post_read_wq has not been executed yet >>>>>>> due to high workloads, It is possible that the inode(f2fs_inode_info) >>>>>>> is evicted and freed before it is used f2fs_free_dic. >>>>>>> >>>>>>> The UAF case as below: >>>>>>> Thread A Thread B >>>>>>> - f2fs_decompress_end_io >>>>>>> - f2fs_put_dic >>>>>>> - queue_work >>>>>>> add free_dic work to post_read_wq >>>>>>> - do_unlink >>>>>>> - iput >>>>>>> - evict >>>>>>> - call_rcu >>>>>>> This file is deleted after read. >>>>>>> >>>>>>> Thread C kworker to process post_read_wq >>>>>>> - rcu_do_batch >>>>>>> - f2fs_free_inode >>>>>>> - kmem_cache_free >>>>>>> inode is freed by rcu >>>>>>> - process_scheduled_works >>>>>>> - f2fs_late_free_dic >>>>>>> - f2fs_free_dic >>>>>>> - f2fs_release_decomp_mem >>>>>>> read (dic->inode)->i_compress_algorithm >>>>>>> >>>>>>> This patch use igrab before f2fs_free_dic and iput after free the dic when dic free >>>>>>> action is done by kworker. >>>>>>> >>>>>>> Cc: Daeho Jeong >>>>>>> Fixes: bff139b49d9f ("f2fs: handle decompress only post processing in softirq") >>>>>>> Signed-off-by: Zhiguo Niu >>>>>>> Signed-off-by: Baocong Liu >>>>>>> --- >>>>>>> v3: use igrab to replace __iget >>>>>>> v2: use __iget/iput function >>>>>>> --- >>>>>>> fs/f2fs/compress.c | 14 +++++++++----- >>>>>>> 1 file changed, 9 insertions(+), 5 deletions(-) >>>>>>> >>>>>>> diff --git a/fs/f2fs/compress.c b/fs/f2fs/compress.c >>>>>>> index b3c1df9..729ad16 100644 >>>>>>> --- a/fs/f2fs/compress.c >>>>>>> +++ b/fs/f2fs/compress.c >>>>>>> @@ -1687,7 +1687,7 @@ static void f2fs_release_decomp_mem(struct decompress_io_ctx *dic, >>>>>>> } >>>>>>> >>>>>>> static void f2fs_free_dic(struct decompress_io_ctx *dic, >>>>>>> - bool bypass_destroy_callback); >>>>>>> + bool bypass_destroy_callback, bool late_free); >>>>>>> >>>>>>> struct decompress_io_ctx *f2fs_alloc_dic(struct compress_ctx *cc) >>>>>>> { >>>>>>> @@ -1743,12 +1743,12 @@ struct decompress_io_ctx *f2fs_alloc_dic(struct compress_ctx *cc) >>>>>>> return dic; >>>>>>> >>>>>>> out_free: >>>>>>> - f2fs_free_dic(dic, true); >>>>>>> + f2fs_free_dic(dic, true, false); >>>>>>> return ERR_PTR(ret); >>>>>>> } >>>>>>> >>>>>>> static void f2fs_free_dic(struct decompress_io_ctx *dic, >>>>>>> - bool bypass_destroy_callback) >>>>>>> + bool bypass_destroy_callback, bool late_free) >>>>>>> { >>>>>>> int i; >>>>>>> >>>>>>> @@ -1775,6 +1775,8 @@ static void f2fs_free_dic(struct decompress_io_ctx *dic, >>>>>>> } >>>>>>> >>>>>>> page_array_free(dic->inode, dic->rpages, dic->nr_rpages); >>>>>>> + if (late_free) >>>>>>> + iput(dic->inode); >>>>>>> kmem_cache_free(dic_entry_slab, dic); >>>>>>> } >>>>>>> >>>>>>> @@ -1783,16 +1785,18 @@ static void f2fs_late_free_dic(struct work_struct *work) >>>>>>> struct decompress_io_ctx *dic = >>>>>>> container_of(work, struct decompress_io_ctx, free_work); >>>>>>> >>>>>>> - f2fs_free_dic(dic, false); >>>>>>> + f2fs_free_dic(dic, false, true); >>>>>>> } >>>>>>> >>>>>>> static void f2fs_put_dic(struct decompress_io_ctx *dic, bool in_task) >>>>>>> { >>>>>>> if (refcount_dec_and_test(&dic->refcnt)) { >>>>>>> if (in_task) { >>>>>>> - f2fs_free_dic(dic, false); >>>>>>> + f2fs_free_dic(dic, false, false); >>>>>>> } else { >>>>>>> INIT_WORK(&dic->free_work, f2fs_late_free_dic); >>>>>>> + /* use igrab to avoid inode is evicted simultaneously */ >>>>>>> + f2fs_bug_on(F2FS_I_SB(dic->inode), !igrab(dic->inode)); >>>>>>> queue_work(F2FS_I_SB(dic->inode)->post_read_wq, >>>>>>> &dic->free_work); >>>>>>> } >>>>>>> -- >>>>>>> 1.9.1 >>>>> >>> > > Hi Chao, > > The patch is about as follows, because dic->sbi is used directly in > f2fs_free_dic: page_array_free(dic->sbi, dic->tpages, dic->cluster_size); > so there are two points I want to confirm: > 1. As a corresponding, the first parameter (inode) of page_array_alloc > is need to modify to sbi or not ? > 2. As a corresponding, do we need to add the sbi field in compress_ctx > so that page_array_alloc/free called > in compress flow can use sbi directly? Zhiguo, both 1) and 2) changes look fine to me. Thanks, > Thanks! > > diff --git a/fs/f2fs/compress.c b/fs/f2fs/compress.c > index b3c1df9..897d8ae 100644 > --- a/fs/f2fs/compress.c > +++ b/fs/f2fs/compress.c > @@ -34,9 +34,8 @@ static void *page_array_alloc(struct inode *inode, int nr) > return f2fs_kzalloc(sbi, size, GFP_NOFS); > } > > -static void page_array_free(struct inode *inode, void *pages, int nr) > +static void page_array_free(struct f2fs_sb_info *sbi, void *pages, int nr) > { > - struct f2fs_sb_info *sbi = F2FS_I_SB(inode); > unsigned int size = sizeof(struct page *) * nr; > > if (!pages) > @@ -155,7 +154,7 @@ int f2fs_init_compress_ctx(struct compress_ctx *cc) > > void f2fs_destroy_compress_ctx(struct compress_ctx *cc, bool reuse) > { > - page_array_free(cc->inode, cc->rpages, cc->cluster_size); > + page_array_free(F2FS_I_SB(cc->inode), cc->rpages, cc->cluster_size); > cc->rpages = NULL; > cc->nr_rpages = 0; > cc->nr_cpages = 0; > @@ -716,7 +715,7 @@ static int f2fs_compress_pages(struct compress_ctx *cc) > if (cc->cpages[i]) > f2fs_compress_free_page(cc->cpages[i]); > } > - page_array_free(cc->inode, cc->cpages, cc->nr_cpages); > + page_array_free(F2FS_I_SB(cc->inode), cc->cpages, cc->nr_cpages); > cc->cpages = NULL; > destroy_compress_ctx: > if (cops->destroy_compress_ctx) > @@ -734,7 +733,7 @@ static void f2fs_release_decomp_mem(struct > decompress_io_ctx *dic, > > void f2fs_decompress_cluster(struct decompress_io_ctx *dic, bool in_task) > { > - struct f2fs_sb_info *sbi = F2FS_I_SB(dic->inode); > + struct f2fs_sb_info *sbi = dic->sbi; > struct f2fs_inode_info *fi = F2FS_I(dic->inode); > const struct f2fs_compress_ops *cops = > f2fs_cops[fi->i_compress_algorithm]; > @@ -1442,13 +1441,13 @@ static int f2fs_write_compressed_pages(struct > compress_ctx *cc, > spin_unlock(&fi->i_size_lock); > > f2fs_put_rpages(cc); > - page_array_free(cc->inode, cc->cpages, cc->nr_cpages); > + page_array_free(F2FS_I_SB(cc->inode), cc->cpages, cc->nr_cpages); > cc->cpages = NULL; > f2fs_destroy_compress_ctx(cc, false); > return 0; > > out_destroy_crypt: > - page_array_free(cc->inode, cic->rpages, cc->cluster_size); > + page_array_free(F2FS_I_SB(cc->inode), cic->rpages, cc->cluster_size); > > for (--i; i >= 0; i--) { > if (!cc->cpages[i]) > @@ -1469,7 +1468,7 @@ static int f2fs_write_compressed_pages(struct > compress_ctx *cc, > f2fs_compress_free_page(cc->cpages[i]); > cc->cpages[i] = NULL; > } > - page_array_free(cc->inode, cc->cpages, cc->nr_cpages); > + page_array_free(F2FS_I_SB(cc->inode), cc->cpages, cc->nr_cpages); > cc->cpages = NULL; > return -EAGAIN; > } > @@ -1499,7 +1498,7 @@ void f2fs_compress_write_end_io(struct bio *bio, > struct page *page) > end_page_writeback(cic->rpages[i]); > } > > - page_array_free(cic->inode, cic->rpages, cic->nr_rpages); > + page_array_free(F2FS_I_SB(cic->inode), cic->rpages, cic->nr_rpages); > kmem_cache_free(cic_entry_slab, cic); > } > > @@ -1637,7 +1636,7 @@ static int f2fs_prepare_decomp_mem(struct > decompress_io_ctx *dic, > f2fs_cops[F2FS_I(dic->inode)->i_compress_algorithm]; > int i; > > - if (!allow_memalloc_for_decomp(F2FS_I_SB(dic->inode), pre_alloc)) > + if (!allow_memalloc_for_decomp(dic->sbi, pre_alloc)) > return 0; > > dic->tpages = page_array_alloc(dic->inode, dic->cluster_size); > @@ -1670,10 +1669,9 @@ static int f2fs_prepare_decomp_mem(struct > decompress_io_ctx *dic, > static void f2fs_release_decomp_mem(struct decompress_io_ctx *dic, > bool bypass_destroy_callback, bool pre_alloc) > { > - const struct f2fs_compress_ops *cops = > - f2fs_cops[F2FS_I(dic->inode)->i_compress_algorithm]; > + const struct f2fs_compress_ops *cops = > f2fs_cops[dic->compress_algorithm]; > > - if (!allow_memalloc_for_decomp(F2FS_I_SB(dic->inode), pre_alloc)) > + if (!allow_memalloc_for_decomp(dic->sbi, pre_alloc)) > return; > > if (!bypass_destroy_callback && cops->destroy_decompress_ctx) > @@ -1708,6 +1706,8 @@ struct decompress_io_ctx *f2fs_alloc_dic(struct > compress_ctx *cc) > > dic->magic = F2FS_COMPRESSED_PAGE_MAGIC; > dic->inode = cc->inode; > + dic->sbi = sbi; > + dic->compress_algorithm = F2FS_I(cc->inode)->i_compress_algorithm; > atomic_set(&dic->remaining_pages, cc->nr_cpages); > dic->cluster_idx = cc->cluster_idx; > dic->cluster_size = cc->cluster_size; > @@ -1762,7 +1762,7 @@ static void f2fs_free_dic(struct decompress_io_ctx *dic, > continue; > f2fs_compress_free_page(dic->tpages[i]); > } > - page_array_free(dic->inode, dic->tpages, dic->cluster_size); > + page_array_free(dic->sbi, dic->tpages, dic->cluster_size); > } > > if (dic->cpages) { > @@ -1771,10 +1771,10 @@ static void f2fs_free_dic(struct decompress_io_ctx *dic, > continue; > f2fs_compress_free_page(dic->cpages[i]); > } > - page_array_free(dic->inode, dic->cpages, dic->nr_cpages); > + page_array_free(dic->sbi, dic->cpages, dic->nr_cpages); > } > > - page_array_free(dic->inode, dic->rpages, dic->nr_rpages); > + page_array_free(dic->sbi, dic->rpages, dic->nr_rpages); > kmem_cache_free(dic_entry_slab, dic); > } > > diff --git a/fs/f2fs/f2fs.h b/fs/f2fs/f2fs.h > index 9333a22b..da2137e 100644 > --- a/fs/f2fs/f2fs.h > +++ b/fs/f2fs/f2fs.h > @@ -1536,6 +1536,7 @@ struct compress_io_ctx { > struct decompress_io_ctx { > u32 magic; /* magic number to indicate > page is compressed */ > struct inode *inode; /* inode the context belong to */ > + struct f2fs_sb_info *sbi; /* f2fs_sb_info pointer */ > pgoff_t cluster_idx; /* cluster index number */ > unsigned int cluster_size; /* page count in cluster */ > unsigned int log_cluster_size; /* log of cluster size */ > @@ -1576,6 +1577,7 @@ struct decompress_io_ctx { > > bool failed; /* IO error occurred before > decompression? */ > bool need_verity; /* need fs-verity verification > after decompression? */ > + unsigned char compress_algorithm; /* backup algorithm type */ > void *private; /* payload buffer for > specified decompression algorithm */ > void *private2; /* extra payload buffer */ > struct work_struct verity_work; /* work to verify the > decompressed pages */