From nobody Thu Aug 27 01:20:23 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) client-ip=192.237.175.120; envelope-from=xen-devel-bounces@lists.xenproject.org; helo=lists.xenproject.org; Authentication-Results: mx.zohomail.com; spf=pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) smtp.mailfrom=xen-devel-bounces@lists.xenproject.org Return-Path: Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) by mx.zohomail.com with SMTPS id 1785240359287894.2322399419846; Tue, 28 Jul 2026 05:05:59 -0700 (PDT) Received: from list by lists.xenproject.org with outflank-mailman.1372506.1619997 (Exim 4.92) (envelope-from ) id 1wogYy-0004xx-CZ; Tue, 28 Jul 2026 12:05:36 +0000 Received: by outflank-mailman (output) from mailman id 1372506.1619997; Tue, 28 Jul 2026 12:05:35 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogYw-0004qK-9z; Tue, 28 Jul 2026 12:05:34 +0000 Received: by outflank-mailman (input) for mailman id 1372506; Tue, 28 Jul 2026 12:05:22 +0000 Received: from mx.expurgate.net ([194.145.224.20]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wogYh-0002Mk-8e; Tue, 28 Jul 2026 12:05:19 +0000 Received: from mx.expurgate.net (helo=localhost) by mx.expurgate.net with esmtp id 1wogYg-004Och-HD; Tue, 28 Jul 2026 14:05:18 +0200 Received: from [10.42.69.1] (helo=localhost) by localhost with ESMTP (eXpurgate MTA 0.9.1) (envelope-from ) id 6a689af8-bab6-0a2a0a5309dd-0a2a4501e800-14 for ; Tue, 28 Jul 2026 14:05:18 +0200 Received: from [104.130.215.37] (helo=mail.xenproject.org) by tlsNG-d62444.mxtls.expurgate.net with ESMTPS (eXpurgate 4.57.1) (envelope-from ) id 6a689afd-5984-0a2a45010019-6882d725ebc2-3 for ; Tue, 28 Jul 2026 14:05:18 +0200 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wogYb-00DPCC-2J; Tue, 28 Jul 2026 12:05:13 +0000 Received: from andrewcoop by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1wogYb-003Dnj-1I; Tue, 28 Jul 2026 12:05:13 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version X-BeenThere: xen-devel@lists.xenproject.org List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xenproject.org Precedence: list Sender: "Xen-devel" Authentication-Results: eu.smtp.expurgate.cloud; none Content-Type: multipart/mixed; boundary="=separator"; charset="utf-8" Content-Transfer-Encoding: binary MIME-Version: 1.0 X-Mailer: MIME-tools 5.510 (Entity 5.510) To: xen-announce@lists.xen.org, xen-devel@lists.xen.org, xen-users@lists.xen.org, oss-security@lists.openwall.com From: Xen.org security team CC: Xen.org security team Subject: Xen Security Advisory 502 v3 (CVE-2026-62429) - vNUMA domain cleanup may race other operations Message-Id: Date: Tue, 28 Jul 2026 12:05:13 +0000 X-purgate-ID: tlsNG-d62444/1785240318-BDA7E757-0BADA150/0/0 X-purgate-type: clean X-purgate-size: 20992 X-Zoho-Virus-Status: 1 X-Zoho-AV-Stamp: zmail-av-0.2.10.1.5.2/285.228.97 X-ZM-MESSAGEID: 1785240361682158500 --=separator Content-Type: text/plain; charset="utf-8" Content-Disposition: inline Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Reported-by: Teddy Astie Reviewed-by: Juergen Gross -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Xen Security Advisory CVE-2026-62429 / XSA-502 version 3 vNUMA domain cleanup may race other operations UPDATES IN VERSION 3 =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D Public release. ISSUE DESCRIPTION =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D Accessing the vNUMA configuration data of a guest is still possible when domain destruction has already started. The cleaning up of that configuration information is not synchronized with its retrieval by a device model controlling the guest. IMPACT =3D=3D=3D=3D=3D=3D While Denial of Service (DoS) affecting the entire host and information leaks and are the prevailing effect, a device model stub domain or a de-privileged device model running in the control domain may also be able to elevate its privileges to that of the host. VULNERABLE SYSTEMS =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D All Xen versions from 4.5 onwards are vulnerable. Xen versions 4.4 and earlier are not vulnerable. Only entities controlling guests (on x86: HVM guests) can leverage the vulnerability. These are device models running in either a stub domain or de-privileged in Dom0. Only guests which have vNUMA enabled allow their controlling entities to leverage the vulnerability. MITIGATION =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D On x86, running only PV or PVH guests will avoid the vulnerability. Not enabling vNUMA for HVM guests will also avoid the vulnerability. CREDITS =3D=3D=3D=3D=3D=3D=3D This issue was discovered by Teddy Astie of Vates. RESOLUTION =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D Applying the appropriate attached patch resolves this issue. Note that patches for released versions are generally prepared to apply to the stable branches, and may not apply cleanly to the most recent release tarball. Downstreams are encouraged to update to the tip of the stable branch before applying these patches. xsa502.patch xen-unstable - Xen 4.22.0 xsa502-4.21.patch Xen 4.21.x - Xen 4.19.x xsa502-4.18.patch Xen 4.18.x - Xen 4.17.x $ sha256sum xsa502* e6150a6c468906a1bbcd4b9fca1f28cf3dc2c4617d6aab7c48507dbac003df82 xsa502.pa= tch f780c280539aedb3eeb4f5a43f3d2f4bc5a112ca1a2d7ad6a95eb2fbdc5f5cc8 xsa502-4.= 18.patch a0b2b6f543a566e997a9f38bbd718cc81e8de8e7b442ff47e92260f70e66f647 xsa502-4.= 21.patch $ DEPLOYMENT DURING EMBARGO =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D Deployment of the patches described above (or others which are substantially similar) is permitted during the embargo, even on public- facing systems with untrusted guest users and administrators. HOWEVER, deployment of the mitigation is NOT permitted (except where all the affected systems and VMs are administered and used only by organisations which are members of the Xen Project Security Issues Predisclosure List). Specifically, deployment on public cloud systems is NOT permitted. This is because no longer exposing vNUMA is a guest visible configuration change, which may lead to re-discovery of the issue. Deployment of this mitigation is permitted only AFTER the embargo ends. AND: Distribution of updated software is prohibited (except to other members of the predisclosure list). Predisclosure list members who wish to deploy significantly different patches and/or mitigations, please contact the Xen Project Security Team. (Note: this during-embargo deployment notice is retained in post-embargo publicly released Xen Project advisories, even though it is then no longer applicable. This is to enable the community to have oversight of the Xen Project Security Team's decisionmaking.) For more information about permissible uses of embargoed information, consult the Xen Project community's agreed Security Policy: http://www.xenproject.org/security-policy.html -----BEGIN PGP SIGNATURE----- iQFABAEBCAAqFiEEI+MiLBRfRHX6gGCng/4UyVfoK9kFAmpomrQMHHBncEB4ZW4u b3JnAAoJEIP+FMlX6CvZ58sH/2CogHDnmyLVcaB68ySxCnCZI5qNt0VonyH4n3s0 Ef4H74nwh3osLXrvkcnXvbrH4hqDKI3MtydScfHc5dpa1rQHXO8utHxZtGUU+CSv A1nSYD42pu96V5xvTXO+xK5sCZoBREgUNS2TGCE02dkwXdngsCWnAPFn1BQi7wsG LJWuzurlSRSc28PPuIEaKJM+eiyG88ep5fADrLycVPvltqd6bktEE1Xa82h5iSYd 9K7KTEDT9Kc0HZEg4x0h2OBwVqGdKF+8FHDNCEtpiwtE2Ao6OycTVzGNX7f+fq4/ CeQjI8I94j/r1zVPtuGBHNVkUdgrCIe36156RC7f1LFy0JM=3D =3D7hf1 -----END PGP SIGNATURE----- --=separator Content-Type: application/octet-stream; name="xsa502.patch" Content-Disposition: attachment; filename="xsa502.patch" Content-Transfer-Encoding: base64 RnJvbTogSmFuIEJldWxpY2ggPGpiZXVsaWNoQHN1c2UuY29tPgpTdWJqZWN0 OiB2TlVNQTogY2xvc2UgcmFjZSB3aW5kb3cgaW4gZG9tYWluIGNsZWFudXAK CkNhbGxpbmcgdm51bWFfZGVzdHJveSgpIHdpdGhvdXQgYW55IGxvY2tpbmcg Y2FuIHJhY2UgdGhlIGhhbmRsaW5nIG9mIGJvdGgKWEVOTUVNX2dldF92bnVt YWluZm8gYW5kIFhFTl9ET01DVExfc2V0dm51bWFpbmZvLiBXaGlsZSB0aGUg bGF0dGVyIGlzLAp3aXRob3V0IEZsYXNrLCBzdHJpY3RseSBvbmx5IGV4cG9z ZWQgdG8gdGhlIGNvbnRyb2wgZG9tYWluLCB0aGUgZm9ybWVyCmNhbiBhbHNv IGJlIGludm9rZWQgYnkgYSBzdHViZG9tIERNIG9yIGEgZGUtcHJpdmlsZWdl ZCBETSBydW5uaW5nIGluIHRoZQpjb250cm9sIGRvbWFpbi4gSXNvbGF0ZSB0 aGUgbG9naWMgdXNlZCBieSBYRU5fRE9NQ1RMX3NldHZudW1haW5mbyBpbnRv IGEKbmV3IGhlbHBlciBmdW5jdGlvbiwgd2hpY2ggdGhlbiBpcyBhbHNvIHVz ZWQgZnJvbSBkb21haW5fa2lsbCgpLiBXaGlsZQpkb2luZyBzbyBhbHNvIG1v dmUgdGhlIHZudW1hX2Rlc3Ryb3koKSBpbnZvY2F0aW9uIG91dCBvZiB0aGUg bG9ja2VkCnJlZ2lvbi4KCldpdGggZC0+dm51bWEgcHJvcGVybHkgY2xlYXJl ZCBieSBkb21haW5fa2lsbCgpLCBYRU5NRU1fZ2V0X3ZudW1haW5mbyBub3cK cmVhbGx5IG9ubHkgbmVlZHMgdG8gY2hlY2sgZm9yIHRoZSBmaWVsZCBiZWlu ZyBOVUxMLiBUaGF0IGNoZWNrIG5lZWRzCnJlcGVhdGluZywgdGhvdWdoLCBh ZnRlciByZS1hY3F1aXJpbmcgdGhlIGxvY2suCgpUaGlzIGlzIENWRS0yMDI2 LTYyNDI5IC8gWFNBLTUwMi4KCkZpeGVzOiA5Njk1MDE0OTY2YjUgKCJ4ZW46 IHZudW1hIHRvcG9sb2d5IGFuZCBzdWJvcCBoeXBlcmNhbGxzIikKUmVwb3J0 ZWQtYnk6IFRlZGR5IEFzdGllIDx0ZWRkeS5hc3RpZUB2YXRlcy50ZWNoPgpT aWduZWQtb2ZmLWJ5OiBKYW4gQmV1bGljaCA8amJldWxpY2hAc3VzZS5jb20+ ClJldmlld2VkLWJ5OiBKdWVyZ2VuIEdyb3NzIDxqZ3Jvc3NAc3VzZS5jb20+ CgotLS0gYS94ZW4vY29tbW9uL2RvbWFpbi5jCisrKyBiL3hlbi9jb21tb24v ZG9tYWluLmMKQEAgLTEzMjAsNyArMTMyMCw3IEBAIGludCBkb21haW5fa2ls bChzdHJ1Y3QgZG9tYWluICpkKQogICAgICAgICBkLT5pc19keWluZyA9IERP TURZSU5HX2R5aW5nOwogICAgICAgICByc3Bpbl9iYXJyaWVyKCZkLT5kb21h aW5fbG9jayk7CiAgICAgICAgIGFyZ29fZGVzdHJveShkKTsKLSAgICAgICAg dm51bWFfZGVzdHJveShkLT52bnVtYSk7CisgICAgICAgIHZudW1hX3JlcGxh Y2UoZCwgTlVMTCk7CiAgICAgICAgIGRvbWFpbl9zZXRfb3V0c3RhbmRpbmdf cGFnZXMoZCwgMCk7CiAgICAgICAgIC8qIGZhbGx0aHJvdWdoICovCiAgICAg Y2FzZSBET01EWUlOR19keWluZzoKLS0tIGEveGVuL2NvbW1vbi9kb21jdGwu YworKysgYi94ZW4vY29tbW9uL2RvbWN0bC5jCkBAIC0xNDAsNyArMTQwLDcg QEAgdm9pZCBkb21jdGxfbG9ja19yZWxlYXNlKHZvaWQpCiAgICAgc3Bpbl91 bmxvY2soJmN1cnJlbnQtPmRvbWFpbi0+aHlwZXJjYWxsX2RlYWRsb2NrX211 dGV4KTsKIH0KIAotdm9pZCB2bnVtYV9kZXN0cm95KHN0cnVjdCB2bnVtYV9p bmZvICp2bnVtYSkKK3N0YXRpYyB2b2lkIHZudW1hX2Rlc3Ryb3koc3RydWN0 IHZudW1hX2luZm8gKnZudW1hKQogewogICAgIGlmICggdm51bWEgKQogICAg IHsKQEAgLTE1Miw2ICsxNTIsMTkgQEAgdm9pZCB2bnVtYV9kZXN0cm95KHN0 cnVjdCB2bnVtYV9pbmZvICp2bgogICAgIH0KIH0KIAorLyogT3ZlcndyaXRl IChyZXBsYWNlKSB2bnVtYSB0b3BvbG9neSBmb3IgYSBkb21haW4uICovCit2 b2lkIHZudW1hX3JlcGxhY2Uoc3RydWN0IGRvbWFpbiAqZCwgc3RydWN0IHZu dW1hX2luZm8gKnZudW1hKQoreworICAgIHN0cnVjdCB2bnVtYV9pbmZvICpv bGQ7CisKKyAgICB3cml0ZV9sb2NrKCZkLT52bnVtYV9yd2xvY2spOworICAg IG9sZCA9IGQtPnZudW1hOworICAgIGQtPnZudW1hID0gdm51bWE7CisgICAg d3JpdGVfdW5sb2NrKCZkLT52bnVtYV9yd2xvY2spOworCisgICAgdm51bWFf ZGVzdHJveShvbGQpOworfQorCiAvKgogICogQWxsb2NhdGVzIG1lbW9yeSBm b3Igdk5VTUEsICoqdm51bWEgc2hvdWxkIGJlIE5VTEwuCiAgKiBDYWxsZXIg aGFzIHRvIG1ha2Ugc3VyZSB0aGF0IGRvbWFpbiBoYXMgbWF4X3BhZ2VzCkBA IC04OTUsMTIgKzkwOCw3IEBAIGxvbmcgZG9fZG9tY3RsKFhFTl9HVUVTVF9I QU5ETEVfUEFSQU0oeGUKICAgICAgICAgICAgIGJyZWFrOwogICAgICAgICB9 CiAKLSAgICAgICAgLyogb3ZlcndyaXRlIHZudW1hIHRvcG9sb2d5IGZvciBk b21haW4uICovCi0gICAgICAgIHdyaXRlX2xvY2soJmQtPnZudW1hX3J3bG9j ayk7Ci0gICAgICAgIHZudW1hX2Rlc3Ryb3koZC0+dm51bWEpOwotICAgICAg ICBkLT52bnVtYSA9IHZudW1hOwotICAgICAgICB3cml0ZV91bmxvY2soJmQt PnZudW1hX3J3bG9jayk7Ci0KKyAgICAgICAgdm51bWFfcmVwbGFjZShkLCB2 bnVtYSk7CiAgICAgICAgIGJyZWFrOwogICAgIH0KIAotLS0gYS94ZW4vY29t bW9uL21lbW9yeS5jCisrKyBiL3hlbi9jb21tb24vbWVtb3J5LmMKQEAgLTE5 MjIsMTIgKzE5MjIsMjQgQEAgbG9uZyBkb19tZW1vcnlfb3AodW5zaWduZWQg bG9uZyBjbWQsIFhFTgogICAgICAgICAgICAgZ290byB2bnVtYWluZm9fb3V0 OwogICAgICAgICB9CiAKKyAgICAgICAgcmVhZF9sb2NrKCZkLT52bnVtYV9y d2xvY2spOworCisgICAgICAgIC8qCisgICAgICAgICAqIENoZWNrIGQtPnZu dW1hIGFnYWluIGFmdGVyIHJlLWFjcXVpcmluZyB0aGUgbG9jayBhcyB3ZSBj YW4gcmFjZQorICAgICAgICAgKiB3aXRoIGRvbWFpbiBkZXN0cnVjdGlvbi4K KyAgICAgICAgICovCisgICAgICAgIGlmICggIWQtPnZudW1hICkKKyAgICAg ICAgeworICAgICAgICAgICAgQVNTRVJUKGQtPmlzX2R5aW5nKTsKKyAgICAg ICAgICAgIHJlYWRfdW5sb2NrKCZkLT52bnVtYV9yd2xvY2spOworICAgICAg ICAgICAgcmMgPSAtRVNSQ0g7CisgICAgICAgICAgICBnb3RvIHZudW1haW5m b19vdXQ7CisgICAgICAgIH0KKwogICAgICAgICAvKgogICAgICAgICAgKiBD aGVjayBpZiB2bnVtYSBpbmZvIGhhcyBjaGFuZ2VkIGFuZCBpZiB0aGUgYWxs b2NhdGVkIGFycmF5cwogICAgICAgICAgKiBhcmUgbm90IGJpZyBlbm91Z2gu CiAgICAgICAgICAqLwotICAgICAgICByZWFkX2xvY2soJmQtPnZudW1hX3J3 bG9jayk7Ci0KICAgICAgICAgaWYgKCBkb21fdm5vZGVzIDwgZC0+dm51bWEt Pm5yX3Zub2RlcyB8fAogICAgICAgICAgICAgIGRvbV92cmFuZ2VzIDwgZC0+ dm51bWEtPm5yX3ZtZW1yYW5nZXMgfHwKICAgICAgICAgICAgICBkb21fdmNw dXMgPCBkLT5tYXhfdmNwdXMgKQotLS0gYS94ZW4vaW5jbHVkZS94ZW4vZG9t YWluLmgKKysrIGIveGVuL2luY2x1ZGUveGVuL2RvbWFpbi5oCkBAIC0xOTMs OSArMTkzLDEwIEBAIHN0cnVjdCB2bnVtYV9pbmZvIHsKIH07CiAKICNpZm5k ZWYgQ09ORklHX1BWX1NISU1fRVhDTFVTSVZFCi12b2lkIHZudW1hX2Rlc3Ry b3koc3RydWN0IHZudW1hX2luZm8gKnZudW1hKTsKK3ZvaWQgdm51bWFfcmVw bGFjZShzdHJ1Y3QgZG9tYWluICpkLCBzdHJ1Y3Qgdm51bWFfaW5mbyAqdm51 bWEpOwogI2Vsc2UKLXN0YXRpYyBpbmxpbmUgdm9pZCB2bnVtYV9kZXN0cm95 KHN0cnVjdCB2bnVtYV9pbmZvICp2bnVtYSkgeyBBU1NFUlQoIXZudW1hKTsg fQorc3RhdGljIGlubGluZSB2b2lkIHZudW1hX3JlcGxhY2Uoc3RydWN0IGRv bWFpbiAqZCwgc3RydWN0IHZudW1hX2luZm8gKnZudW1hKQoreyBBU1NFUlQo IXZudW1hKTsgfQogI2VuZGlmCiAKICNpZmRlZiBDT05GSUdfVk1UUkFDRQo= --=separator Content-Type: application/octet-stream; name="xsa502-4.18.patch" Content-Disposition: attachment; filename="xsa502-4.18.patch" Content-Transfer-Encoding: base64 RnJvbTogSmFuIEJldWxpY2ggPGpiZXVsaWNoQHN1c2UuY29tPgpTdWJqZWN0 OiB2TlVNQTogY2xvc2UgcmFjZSB3aW5kb3cgaW4gZG9tYWluIGNsZWFudXAK CkNhbGxpbmcgdm51bWFfZGVzdHJveSgpIHdpdGhvdXQgYW55IGxvY2tpbmcg Y2FuIHJhY2UgdGhlIGhhbmRsaW5nIG9mIGJvdGgKWEVOTUVNX2dldF92bnVt YWluZm8gYW5kIFhFTl9ET01DVExfc2V0dm51bWFpbmZvLiBXaGlsZSB0aGUg bGF0dGVyIGlzLAp3aXRob3V0IEZsYXNrLCBzdHJpY3RseSBvbmx5IGV4cG9z ZWQgdG8gdGhlIGNvbnRyb2wgZG9tYWluLCB0aGUgZm9ybWVyCmNhbiBhbHNv IGJlIGludm9rZWQgYnkgYSBzdHViZG9tIERNIG9yIGEgZGUtcHJpdmlsZWdl ZCBETSBydW5uaW5nIGluIHRoZQpjb250cm9sIGRvbWFpbi4gSXNvbGF0ZSB0 aGUgbG9naWMgdXNlZCBieSBYRU5fRE9NQ1RMX3NldHZudW1haW5mbyBpbnRv IGEKbmV3IGhlbHBlciBmdW5jdGlvbiwgd2hpY2ggdGhlbiBpcyBhbHNvIHVz ZWQgZnJvbSBkb21haW5fa2lsbCgpLiBXaGlsZQpkb2luZyBzbyBhbHNvIG1v dmUgdGhlIHZudW1hX2Rlc3Ryb3koKSBpbnZvY2F0aW9uIG91dCBvZiB0aGUg bG9ja2VkCnJlZ2lvbi4KCldpdGggZC0+dm51bWEgcHJvcGVybHkgY2xlYXJl ZCBieSBkb21haW5fa2lsbCgpLCBYRU5NRU1fZ2V0X3ZudW1haW5mbyBub3cK cmVhbGx5IG9ubHkgbmVlZHMgdG8gY2hlY2sgZm9yIHRoZSBmaWVsZCBiZWlu ZyBOVUxMLiBUaGF0IGNoZWNrIG5lZWRzCnJlcGVhdGluZywgdGhvdWdoLCBh ZnRlciByZS1hY3F1aXJpbmcgdGhlIGxvY2suCgpUaGlzIGlzIENWRS0yMDI2 LTYyNDI5IC8gWFNBLTUwMi4KCkZpeGVzOiA5Njk1MDE0OTY2YjUgKCJ4ZW46 IHZudW1hIHRvcG9sb2d5IGFuZCBzdWJvcCBoeXBlcmNhbGxzIikKUmVwb3J0 ZWQtYnk6IFRlZGR5IEFzdGllIDx0ZWRkeS5hc3RpZUB2YXRlcy50ZWNoPgpT aWduZWQtb2ZmLWJ5OiBKYW4gQmV1bGljaCA8amJldWxpY2hAc3VzZS5jb20+ ClJldmlld2VkLWJ5OiBKdWVyZ2VuIEdyb3NzIDxqZ3Jvc3NAc3VzZS5jb20+ CgotLS0gYS94ZW4vY29tbW9uL2RvbWFpbi5jCisrKyBiL3hlbi9jb21tb24v ZG9tYWluLmMKQEAgLTEwMDMsNyArMTAwMyw3IEBAIGludCBkb21haW5fa2ls bChzdHJ1Y3QgZG9tYWluICpkKQogICAgICAgICBkLT5pc19keWluZyA9IERP TURZSU5HX2R5aW5nOwogICAgICAgICBzcGluX2JhcnJpZXIoJmQtPmRvbWFp bl9sb2NrKTsKICAgICAgICAgYXJnb19kZXN0cm95KGQpOwotICAgICAgICB2 bnVtYV9kZXN0cm95KGQtPnZudW1hKTsKKyAgICAgICAgdm51bWFfcmVwbGFj ZShkLCBOVUxMKTsKICAgICAgICAgZG9tYWluX3NldF9vdXRzdGFuZGluZ19w YWdlcyhkLCAwKTsKICAgICAgICAgLyogZmFsbHRocm91Z2ggKi8KICAgICBj YXNlIERPTURZSU5HX2R5aW5nOgotLS0gYS94ZW4vY29tbW9uL2RvbWN0bC5j CisrKyBiL3hlbi9jb21tb24vZG9tY3RsLmMKQEAgLTE1Myw3ICsxNTMsNyBA QCB2b2lkIGRvbWN0bF9sb2NrX3JlbGVhc2Uodm9pZCkKICAgICBzcGluX3Vu bG9jaygmY3VycmVudC0+ZG9tYWluLT5oeXBlcmNhbGxfZGVhZGxvY2tfbXV0 ZXgpOwogfQogCi12b2lkIHZudW1hX2Rlc3Ryb3koc3RydWN0IHZudW1hX2lu Zm8gKnZudW1hKQorc3RhdGljIHZvaWQgdm51bWFfZGVzdHJveShzdHJ1Y3Qg dm51bWFfaW5mbyAqdm51bWEpCiB7CiAgICAgaWYgKCB2bnVtYSApCiAgICAg ewpAQCAtMTY1LDYgKzE2NSwxOSBAQCB2b2lkIHZudW1hX2Rlc3Ryb3koc3Ry dWN0IHZudW1hX2luZm8gKnZuCiAgICAgfQogfQogCisvKiBPdmVyd3JpdGUg KHJlcGxhY2UpIHZudW1hIHRvcG9sb2d5IGZvciBhIGRvbWFpbi4gKi8KK3Zv aWQgdm51bWFfcmVwbGFjZShzdHJ1Y3QgZG9tYWluICpkLCBzdHJ1Y3Qgdm51 bWFfaW5mbyAqdm51bWEpCit7CisgICAgc3RydWN0IHZudW1hX2luZm8gKm9s ZDsKKworICAgIHdyaXRlX2xvY2soJmQtPnZudW1hX3J3bG9jayk7CisgICAg b2xkID0gZC0+dm51bWE7CisgICAgZC0+dm51bWEgPSB2bnVtYTsKKyAgICB3 cml0ZV91bmxvY2soJmQtPnZudW1hX3J3bG9jayk7CisKKyAgICB2bnVtYV9k ZXN0cm95KG9sZCk7Cit9CisKIC8qCiAgKiBBbGxvY2F0ZXMgbWVtb3J5IGZv ciB2TlVNQSwgKip2bnVtYSBzaG91bGQgYmUgTlVMTC4KICAqIENhbGxlciBo YXMgdG8gbWFrZSBzdXJlIHRoYXQgZG9tYWluIGhhcyBtYXhfcGFnZXMKQEAg LTkwOCwxMiArOTIxLDcgQEAgbG9uZyBkb19kb21jdGwoWEVOX0dVRVNUX0hB TkRMRV9QQVJBTSh4ZQogICAgICAgICAgICAgYnJlYWs7CiAgICAgICAgIH0K IAotICAgICAgICAvKiBvdmVyd3JpdGUgdm51bWEgdG9wb2xvZ3kgZm9yIGRv bWFpbi4gKi8KLSAgICAgICAgd3JpdGVfbG9jaygmZC0+dm51bWFfcndsb2Nr KTsKLSAgICAgICAgdm51bWFfZGVzdHJveShkLT52bnVtYSk7Ci0gICAgICAg IGQtPnZudW1hID0gdm51bWE7Ci0gICAgICAgIHdyaXRlX3VubG9jaygmZC0+ dm51bWFfcndsb2NrKTsKLQorICAgICAgICB2bnVtYV9yZXBsYWNlKGQsIHZu dW1hKTsKICAgICAgICAgYnJlYWs7CiAgICAgfQogCi0tLSBhL3hlbi9jb21t b24vbWVtb3J5LmMKKysrIGIveGVuL2NvbW1vbi9tZW1vcnkuYwpAQCAtMTc2 MSwxMiArMTc2MSwyNCBAQCBsb25nIGRvX21lbW9yeV9vcCh1bnNpZ25lZCBs b25nIGNtZCwgWEVOCiAgICAgICAgICAgICBnb3RvIHZudW1haW5mb19vdXQ7 CiAgICAgICAgIH0KIAorICAgICAgICByZWFkX2xvY2soJmQtPnZudW1hX3J3 bG9jayk7CisKKyAgICAgICAgLyoKKyAgICAgICAgICogQ2hlY2sgZC0+dm51 bWEgYWdhaW4gYWZ0ZXIgcmUtYWNxdWlyaW5nIHRoZSBsb2NrIGFzIHdlIGNh biByYWNlCisgICAgICAgICAqIHdpdGggZG9tYWluIGRlc3RydWN0aW9uLgor ICAgICAgICAgKi8KKyAgICAgICAgaWYgKCAhZC0+dm51bWEgKQorICAgICAg ICB7CisgICAgICAgICAgICBBU1NFUlQoZC0+aXNfZHlpbmcpOworICAgICAg ICAgICAgcmVhZF91bmxvY2soJmQtPnZudW1hX3J3bG9jayk7CisgICAgICAg ICAgICByYyA9IC1FU1JDSDsKKyAgICAgICAgICAgIGdvdG8gdm51bWFpbmZv X291dDsKKyAgICAgICAgfQorCiAgICAgICAgIC8qCiAgICAgICAgICAqIENo ZWNrIGlmIHZudW1hIGluZm8gaGFzIGNoYW5nZWQgYW5kIGlmIHRoZSBhbGxv Y2F0ZWQgYXJyYXlzCiAgICAgICAgICAqIGFyZSBub3QgYmlnIGVub3VnaC4K ICAgICAgICAgICovCi0gICAgICAgIHJlYWRfbG9jaygmZC0+dm51bWFfcnds b2NrKTsKLQogICAgICAgICBpZiAoIGRvbV92bm9kZXMgPCBkLT52bnVtYS0+ bnJfdm5vZGVzIHx8CiAgICAgICAgICAgICAgZG9tX3ZyYW5nZXMgPCBkLT52 bnVtYS0+bnJfdm1lbXJhbmdlcyB8fAogICAgICAgICAgICAgIGRvbV92Y3B1 cyA8IGQtPm1heF92Y3B1cyApCi0tLSBhL3hlbi9pbmNsdWRlL3hlbi9kb21h aW4uaAorKysgYi94ZW4vaW5jbHVkZS94ZW4vZG9tYWluLmgKQEAgLTE1OSw5 ICsxNTksMTAgQEAgc3RydWN0IHZudW1hX2luZm8gewogfTsKIAogI2lmbmRl ZiBDT05GSUdfUFZfU0hJTV9FWENMVVNJVkUKLXZvaWQgdm51bWFfZGVzdHJv eShzdHJ1Y3Qgdm51bWFfaW5mbyAqdm51bWEpOwordm9pZCB2bnVtYV9yZXBs YWNlKHN0cnVjdCBkb21haW4gKmQsIHN0cnVjdCB2bnVtYV9pbmZvICp2bnVt YSk7CiAjZWxzZQotc3RhdGljIGlubGluZSB2b2lkIHZudW1hX2Rlc3Ryb3ko c3RydWN0IHZudW1hX2luZm8gKnZudW1hKSB7IEFTU0VSVCghdm51bWEpOyB9 CitzdGF0aWMgaW5saW5lIHZvaWQgdm51bWFfcmVwbGFjZShzdHJ1Y3QgZG9t YWluICpkLCBzdHJ1Y3Qgdm51bWFfaW5mbyAqdm51bWEpCit7IEFTU0VSVCgh dm51bWEpOyB9CiAjZW5kaWYKIAogZXh0ZXJuIGJvb2wgdm10cmFjZV9hdmFp bGFibGU7Cg== --=separator Content-Type: application/octet-stream; name="xsa502-4.21.patch" Content-Disposition: attachment; filename="xsa502-4.21.patch" Content-Transfer-Encoding: base64 RnJvbTogSmFuIEJldWxpY2ggPGpiZXVsaWNoQHN1c2UuY29tPgpTdWJqZWN0 OiB2TlVNQTogY2xvc2UgcmFjZSB3aW5kb3cgaW4gZG9tYWluIGNsZWFudXAK CkNhbGxpbmcgdm51bWFfZGVzdHJveSgpIHdpdGhvdXQgYW55IGxvY2tpbmcg Y2FuIHJhY2UgdGhlIGhhbmRsaW5nIG9mIGJvdGgKWEVOTUVNX2dldF92bnVt YWluZm8gYW5kIFhFTl9ET01DVExfc2V0dm51bWFpbmZvLiBXaGlsZSB0aGUg bGF0dGVyIGlzLAp3aXRob3V0IEZsYXNrLCBzdHJpY3RseSBvbmx5IGV4cG9z ZWQgdG8gdGhlIGNvbnRyb2wgZG9tYWluLCB0aGUgZm9ybWVyCmNhbiBhbHNv IGJlIGludm9rZWQgYnkgYSBzdHViZG9tIERNIG9yIGEgZGUtcHJpdmlsZWdl ZCBETSBydW5uaW5nIGluIHRoZQpjb250cm9sIGRvbWFpbi4gSXNvbGF0ZSB0 aGUgbG9naWMgdXNlZCBieSBYRU5fRE9NQ1RMX3NldHZudW1haW5mbyBpbnRv IGEKbmV3IGhlbHBlciBmdW5jdGlvbiwgd2hpY2ggdGhlbiBpcyBhbHNvIHVz ZWQgZnJvbSBkb21haW5fa2lsbCgpLiBXaGlsZQpkb2luZyBzbyBhbHNvIG1v dmUgdGhlIHZudW1hX2Rlc3Ryb3koKSBpbnZvY2F0aW9uIG91dCBvZiB0aGUg bG9ja2VkCnJlZ2lvbi4KCldpdGggZC0+dm51bWEgcHJvcGVybHkgY2xlYXJl ZCBieSBkb21haW5fa2lsbCgpLCBYRU5NRU1fZ2V0X3ZudW1haW5mbyBub3cK cmVhbGx5IG9ubHkgbmVlZHMgdG8gY2hlY2sgZm9yIHRoZSBmaWVsZCBiZWlu ZyBOVUxMLiBUaGF0IGNoZWNrIG5lZWRzCnJlcGVhdGluZywgdGhvdWdoLCBh ZnRlciByZS1hY3F1aXJpbmcgdGhlIGxvY2suCgpUaGlzIGlzIENWRS0yMDI2 LTYyNDI5IC8gWFNBLTUwMi4KCkZpeGVzOiA5Njk1MDE0OTY2YjUgKCJ4ZW46 IHZudW1hIHRvcG9sb2d5IGFuZCBzdWJvcCBoeXBlcmNhbGxzIikKUmVwb3J0 ZWQtYnk6IFRlZGR5IEFzdGllIDx0ZWRkeS5hc3RpZUB2YXRlcy50ZWNoPgpT aWduZWQtb2ZmLWJ5OiBKYW4gQmV1bGljaCA8amJldWxpY2hAc3VzZS5jb20+ ClJldmlld2VkLWJ5OiBKdWVyZ2VuIEdyb3NzIDxqZ3Jvc3NAc3VzZS5jb20+ CgotLS0gYS94ZW4vY29tbW9uL2RvbWFpbi5jCisrKyBiL3hlbi9jb21tb24v ZG9tYWluLmMKQEAgLTEyNTUsNyArMTI1NSw3IEBAIGludCBkb21haW5fa2ls bChzdHJ1Y3QgZG9tYWluICpkKQogICAgICAgICBkLT5pc19keWluZyA9IERP TURZSU5HX2R5aW5nOwogICAgICAgICByc3Bpbl9iYXJyaWVyKCZkLT5kb21h aW5fbG9jayk7CiAgICAgICAgIGFyZ29fZGVzdHJveShkKTsKLSAgICAgICAg dm51bWFfZGVzdHJveShkLT52bnVtYSk7CisgICAgICAgIHZudW1hX3JlcGxh Y2UoZCwgTlVMTCk7CiAgICAgICAgIGRvbWFpbl9zZXRfb3V0c3RhbmRpbmdf cGFnZXMoZCwgMCk7CiAgICAgICAgIC8qIGZhbGx0aHJvdWdoICovCiAgICAg Y2FzZSBET01EWUlOR19keWluZzoKLS0tIGEveGVuL2NvbW1vbi9kb21jdGwu YworKysgYi94ZW4vY29tbW9uL2RvbWN0bC5jCkBAIC0xNDIsNyArMTQyLDcg QEAgdm9pZCBkb21jdGxfbG9ja19yZWxlYXNlKHZvaWQpCiAgICAgc3Bpbl91 bmxvY2soJmN1cnJlbnQtPmRvbWFpbi0+aHlwZXJjYWxsX2RlYWRsb2NrX211 dGV4KTsKIH0KIAotdm9pZCB2bnVtYV9kZXN0cm95KHN0cnVjdCB2bnVtYV9p bmZvICp2bnVtYSkKK3N0YXRpYyB2b2lkIHZudW1hX2Rlc3Ryb3koc3RydWN0 IHZudW1hX2luZm8gKnZudW1hKQogewogICAgIGlmICggdm51bWEgKQogICAg IHsKQEAgLTE1NCw2ICsxNTQsMTkgQEAgdm9pZCB2bnVtYV9kZXN0cm95KHN0 cnVjdCB2bnVtYV9pbmZvICp2bgogICAgIH0KIH0KIAorLyogT3ZlcndyaXRl IChyZXBsYWNlKSB2bnVtYSB0b3BvbG9neSBmb3IgYSBkb21haW4uICovCit2 b2lkIHZudW1hX3JlcGxhY2Uoc3RydWN0IGRvbWFpbiAqZCwgc3RydWN0IHZu dW1hX2luZm8gKnZudW1hKQoreworICAgIHN0cnVjdCB2bnVtYV9pbmZvICpv bGQ7CisKKyAgICB3cml0ZV9sb2NrKCZkLT52bnVtYV9yd2xvY2spOworICAg IG9sZCA9IGQtPnZudW1hOworICAgIGQtPnZudW1hID0gdm51bWE7CisgICAg d3JpdGVfdW5sb2NrKCZkLT52bnVtYV9yd2xvY2spOworCisgICAgdm51bWFf ZGVzdHJveShvbGQpOworfQorCiAvKgogICogQWxsb2NhdGVzIG1lbW9yeSBm b3Igdk5VTUEsICoqdm51bWEgc2hvdWxkIGJlIE5VTEwuCiAgKiBDYWxsZXIg aGFzIHRvIG1ha2Ugc3VyZSB0aGF0IGRvbWFpbiBoYXMgbWF4X3BhZ2VzCkBA IC05MDcsMTIgKzkyMCw3IEBAIGxvbmcgZG9fZG9tY3RsKFhFTl9HVUVTVF9I QU5ETEVfUEFSQU0oeGUKICAgICAgICAgICAgIGJyZWFrOwogICAgICAgICB9 CiAKLSAgICAgICAgLyogb3ZlcndyaXRlIHZudW1hIHRvcG9sb2d5IGZvciBk b21haW4uICovCi0gICAgICAgIHdyaXRlX2xvY2soJmQtPnZudW1hX3J3bG9j ayk7Ci0gICAgICAgIHZudW1hX2Rlc3Ryb3koZC0+dm51bWEpOwotICAgICAg ICBkLT52bnVtYSA9IHZudW1hOwotICAgICAgICB3cml0ZV91bmxvY2soJmQt PnZudW1hX3J3bG9jayk7Ci0KKyAgICAgICAgdm51bWFfcmVwbGFjZShkLCB2 bnVtYSk7CiAgICAgICAgIGJyZWFrOwogICAgIH0KIAotLS0gYS94ZW4vY29t bW9uL21lbW9yeS5jCisrKyBiL3hlbi9jb21tb24vbWVtb3J5LmMKQEAgLTE4 MDQsMTIgKzE4MDQsMjQgQEAgbG9uZyBkb19tZW1vcnlfb3AodW5zaWduZWQg bG9uZyBjbWQsIFhFTgogICAgICAgICAgICAgZ290byB2bnVtYWluZm9fb3V0 OwogICAgICAgICB9CiAKKyAgICAgICAgcmVhZF9sb2NrKCZkLT52bnVtYV9y d2xvY2spOworCisgICAgICAgIC8qCisgICAgICAgICAqIENoZWNrIGQtPnZu dW1hIGFnYWluIGFmdGVyIHJlLWFjcXVpcmluZyB0aGUgbG9jayBhcyB3ZSBj YW4gcmFjZQorICAgICAgICAgKiB3aXRoIGRvbWFpbiBkZXN0cnVjdGlvbi4K KyAgICAgICAgICovCisgICAgICAgIGlmICggIWQtPnZudW1hICkKKyAgICAg ICAgeworICAgICAgICAgICAgQVNTRVJUKGQtPmlzX2R5aW5nKTsKKyAgICAg ICAgICAgIHJlYWRfdW5sb2NrKCZkLT52bnVtYV9yd2xvY2spOworICAgICAg ICAgICAgcmMgPSAtRVNSQ0g7CisgICAgICAgICAgICBnb3RvIHZudW1haW5m b19vdXQ7CisgICAgICAgIH0KKwogICAgICAgICAvKgogICAgICAgICAgKiBD aGVjayBpZiB2bnVtYSBpbmZvIGhhcyBjaGFuZ2VkIGFuZCBpZiB0aGUgYWxs b2NhdGVkIGFycmF5cwogICAgICAgICAgKiBhcmUgbm90IGJpZyBlbm91Z2gu CiAgICAgICAgICAqLwotICAgICAgICByZWFkX2xvY2soJmQtPnZudW1hX3J3 bG9jayk7Ci0KICAgICAgICAgaWYgKCBkb21fdm5vZGVzIDwgZC0+dm51bWEt Pm5yX3Zub2RlcyB8fAogICAgICAgICAgICAgIGRvbV92cmFuZ2VzIDwgZC0+ dm51bWEtPm5yX3ZtZW1yYW5nZXMgfHwKICAgICAgICAgICAgICBkb21fdmNw dXMgPCBkLT5tYXhfdmNwdXMgKQotLS0gYS94ZW4vaW5jbHVkZS94ZW4vZG9t YWluLmgKKysrIGIveGVuL2luY2x1ZGUveGVuL2RvbWFpbi5oCkBAIC0xODgs OSArMTg4LDEwIEBAIHN0cnVjdCB2bnVtYV9pbmZvIHsKIH07CiAKICNpZm5k ZWYgQ09ORklHX1BWX1NISU1fRVhDTFVTSVZFCi12b2lkIHZudW1hX2Rlc3Ry b3koc3RydWN0IHZudW1hX2luZm8gKnZudW1hKTsKK3ZvaWQgdm51bWFfcmVw bGFjZShzdHJ1Y3QgZG9tYWluICpkLCBzdHJ1Y3Qgdm51bWFfaW5mbyAqdm51 bWEpOwogI2Vsc2UKLXN0YXRpYyBpbmxpbmUgdm9pZCB2bnVtYV9kZXN0cm95 KHN0cnVjdCB2bnVtYV9pbmZvICp2bnVtYSkgeyBBU1NFUlQoIXZudW1hKTsg fQorc3RhdGljIGlubGluZSB2b2lkIHZudW1hX3JlcGxhY2Uoc3RydWN0IGRv bWFpbiAqZCwgc3RydWN0IHZudW1hX2luZm8gKnZudW1hKQoreyBBU1NFUlQo IXZudW1hKTsgfQogI2VuZGlmCiAKIGV4dGVybiBib29sIHZtdHJhY2VfYXZh aWxhYmxlOwo= --=separator--