From nobody Fri Oct 2 12:20:16 2026 Received: from smtp-out-1a.sgdsn.gouv.fr (smtp-out-1b.sgdsn.gouv.fr [143.126.255.31]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id EF4C336A377; Fri, 31 Jul 2026 19:54:33 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=143.126.255.31 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785527676; cv=none; b=pFl5YH8id3SqxbbBqyFKDlKQGopWj8YMAjsE9JHxmtAPP/Qm9yxPc3GI/xRotYQg4kmiMPgB+zfYcjSD/iySiS7LU0Un9QeGJAuQkcEWFx9RshEMfYCx14WqOm44vjTETEDvF1145yLwNY9f3vT8w4IwRlWxZ5p6spFg6CSEAqA= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785527676; c=relaxed/simple; bh=j0j9T5uJ9jG+pnaYLyGvLBJDb2M+TAur5f5KeewAEho=; h=From:To:CC:Subject:Date:Message-ID:References:In-Reply-To: Content-Type:MIME-Version; b=LR91YKd0WHeYEssrBV7Di6asIjPGegMFroc/IkbtJ0WJywJOCAzrFJpyNuQQ25AWUftUsdAZIhTZ6OhZt9ejdtApkK8FCL/pD256ACaS9PsfFgeDZ31EjM8rSZEWD24pHEvCglJESuut5CZQ5dypJGXrys6QTxmhjkpqP61Nxb4= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=ssi.gouv.fr; spf=pass smtp.mailfrom=ssi.gouv.fr; dkim=pass (2048-bit key) header.d=ssi.gouv.fr header.i=@ssi.gouv.fr header.b=BoQLe0Um; arc=none smtp.client-ip=143.126.255.31 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=ssi.gouv.fr Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=ssi.gouv.fr Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ssi.gouv.fr header.i=@ssi.gouv.fr header.b="BoQLe0Um" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ssi.gouv.fr; s=20240601; t=1785527295; bh=j0j9T5uJ9jG+pnaYLyGvLBJDb2M+TAur5f5KeewAEho=; h=From:To:CC:Subject:Date:References:In-Reply-To:From:Subject; b=BoQLe0Um4jTHyeWY6bIXMrFcghJ7inw22uTJxNpcKAott8ZnLnX5LGxNxvBeSIK/c /T4eEjNpk/Zx+Nl4RymP1WSSh5NTe9sPAQ4sHJrNmwYXdlGo/neHjIfBls5Napytsr 701Qd/1u7oaHQQcxfTeOBtTt0l63DmJpoY0CyUprL/MLDztIBogDF02SZ/BxBmzWSB xnV9C7O0GhjfvVsa9NHVOH94KkskwefQ5THNVNwIui4ZE6MVY0OrkFJGn/YSZXY0WT pdZZhUoOp6TxJcUoIW/kHm79Eoqnx6N+GSiFaGwK2Ww41w/iyLc7Bkf7wnwctBX3Do ol7Xg7FeZ1TDw== From: JEAN Jeremy To: Xin Long , Jun Yang CC: "netdev@vger.kernel.org" , Jun Yang , "stable@kernel.org" , "TencentOS Corvus AI" , Marcelo Ricardo Leitner , "David S. Miller" , "Eric Dumazet" , Jakub Kicinski , Paolo Abeni , Simon Horman , Vlad Yasevich , "linux-sctp@vger.kernel.org" , "linux-kernel@vger.kernel.org" Subject: RE: [PATCH net] sctp: bound the auth_chunks copy length in SCTP_LOCAL_AUTH_CHUNKS Thread-Topic: [PATCH net] sctp: bound the auth_chunks copy length in SCTP_LOCAL_AUTH_CHUNKS Thread-Index: AQHdIQEXYam16JDD0EqbuX9liZo/ALaIBa9Q Date: Fri, 31 Jul 2026 19:48:15 +0000 Message-ID: <7402d0e3ade541f18d764ca6ecc037fc@ssi.gouv.fr> References: <20260730090149.24040-1-juny24602@gmail.com> In-Reply-To: Accept-Language: fr-FR, en-US Content-Language: fr-FR X-MS-Has-Attach: yes X-MS-TNEF-Correlator: Content-Type: multipart/mixed; boundary="_002_7402d0e3ade541f18d764ca6ecc037fcssigouvfr_" Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 --_002_7402d0e3ade541f18d764ca6ecc037fcssigouvfr_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Dear all, Attached is a proposed fix that relies on a code suggestion from Xin Long, = but reworked to better handle all cases. Does this look ok? I verified experimentally on 8ba098e6b6ff that this fix solves the two bugs= I reported. Regards, J=C3=A9r=C3=A9my -----Message d'origine----- De : Xin Long Envoy=C3=A9 : vendredi 31 juillet 2026 17:27 =C3=80 : Jun Yang ; JEAN Jeremy Cc : netdev@vger.kernel.org; Jun Yang ; stable@kerne= l.org; TencentOS Corvus AI ; Marcelo Ricardo Leitner ; David S. Miller ; Eric Duma= zet ; Jakub Kicinski ; Paolo Abeni ; Simon Horman ; Vlad Yasevich ; linux-sctp@vger.kernel.org; linux-kernel@vger.kernel.org Objet : Re: [PATCH net] sctp: bound the auth_chunks copy length in SCTP_LOC= AL_AUTH_CHUNKS On Thu, Jul 30, 2026 at 5:02=E2=80=AFAM Jun Yang wrot= e: > > From: Jun Yang > > sctp_getsockopt_local_auth_chunks() copies ntohs(length) - > sizeof(paramhdr) bytes out of ch->chunks without bounding the count. > For an association ch is the fixed-size asoc->c.auth_chunks[] array > (sizeof(struct sctp_paramhdr) + SCTP_AUTH_MAX_CHUNKS bytes), whose > length field is restored from the received state cookie by > sctp_unpack_cookie() and is not validated against the array size. A > cookie carrying an oversized length makes copy_to_user() read past the > array (out-of-bounds read). > > Bound the chunk count to SCTP_AUTH_MAX_CHUNKS before the copy. That > is the most valid chunk bytes either source can hold, so legitimate > output is unchanged, and it also covers a stored length smaller than > the parameter header, which would otherwise underflow. > > Fixes: 65b07e5d0d09 ("[SCTP]: API updates to suport SCTP-AUTH > extensions.") > Cc: stable@kernel.org > Reported-by: TencentOS Corvus AI > Signed-off-by: Jun Yang > --- > net/sctp/socket.c | 6 ++++++ > 1 file changed, 6 insertions(+) > > diff --git a/net/sctp/socket.c b/net/sctp/socket.c index > 9a6da4e0d741..3e9dacb772a0 100644 > --- a/net/sctp/socket.c > +++ b/net/sctp/socket.c > @@ -7109,6 +7109,12 @@ static int sctp_getsockopt_local_auth_chunks(struc= t sock *sk, int len, > goto num; > > num_chunks =3D ntohs(ch->param_hdr.length) - sizeof(struct > sctp_paramhdr); > + /* asoc->c.auth_chunks[] holds at most SCTP_AUTH_MAX_CHUNKS bytes= but its > + * length is restored from the state cookie and is not bounded he= re; > + * clamp so an oversized length cannot read past the array. > + */ > + if (num_chunks > SCTP_AUTH_MAX_CHUNKS) > + num_chunks =3D SCTP_AUTH_MAX_CHUNKS; > if (len < sizeof(struct sctp_authchunks) + num_chunks) > return -EINVAL; > > -- > 2.55.0 > The issue requires sysctl net.sctp.cookie_hmac_alg=3Dnone, right? If so, Jean Jeremy has reported two issues caused by the missing validation= of the auth params in the cookie. We may need to validate all auth_random,= auth_hmacs and auth_chunks in sctp_unpack_cookie(). Let's wait a bit and see if he proceeds with the fix I've suggested. Thanks. Les donn=C3=A9es =C3=A0 caract=C3=A8re personnel recueillies et trait=C3=A9= es dans le cadre de cet =C3=A9change, le sont =C3=A0 seule fin d=E2=80=99ex= =C3=A9cution d=E2=80=99une relation professionnelle et s=E2=80=99op=C3=A8re= nt dans cette seule finalit=C3=A9 et pour la dur=C3=A9e n=C3=A9cessaire =C3= =A0 cette relation. Si vous souhaitez faire usage de vos droits de consulta= tion, de rectification et de suppression de vos donn=C3=A9es, veuillez cont= acter contact.rgpd@sgdsn.gouv.fr. Si vous avez re=C3=A7u ce message par err= eur, nous vous remercions d=E2=80=99en informer l=E2=80=99exp=C3=A9diteur e= t de d=C3=A9truire le message. The personal data collected and processed du= ring this exchange aims solely at completing a business relationship and is= limited to the necessary duration of that relationship. If you wish to use= your rights of consultation, rectification and deletion of your data, plea= se contact: contact.rgpd@sgdsn.gouv.fr. If you have received this message i= n error, we thank you for informing the sender and destroying the message. --_002_7402d0e3ade541f18d764ca6ecc037fcssigouvfr_ Content-Type: application/octet-stream; name="cookie-hmac-id-new.patch" Content-Description: cookie-hmac-id-new.patch Content-Disposition: attachment; filename="cookie-hmac-id-new.patch"; size=6922; creation-date="Fri, 31 Jul 2026 19:40:12 GMT"; modification-date="Fri, 31 Jul 2026 19:40:16 GMT" Content-Transfer-Encoding: base64 RnJvbSA4MzVjNDBjM2FhMGIxOTU5YjFmYTI3ZWQ0MTM4NTQ4Nzk4N2EwMDk4IE1vbiBTZXAgMTcg MDA6MDA6MDAgMjAwMQpGcm9tOiA9P1VURi04P3E/Sj1DMz1BOXI9QzM9QTlteT0yMEplYW4/PSA8 SmVyZW15LkplYW5Ac3NpLmdvdXYuZnI+CkRhdGU6IFN1biwgMjYgSnVsIDIwMjYgMjM6MDM6MDQg KzAwMDAKU3ViamVjdDogW1BBVENIXSBzY3RwOiB2YWxpZGF0ZSBjb29raWUgQVVUSCBzdGF0ZSBi ZWZvcmUgdXNlCk1JTUUtVmVyc2lvbjogMS4wCkNvbnRlbnQtVHlwZTogdGV4dC9wbGFpbjsgY2hh cnNldD1VVEYtOApDb250ZW50LVRyYW5zZmVyLUVuY29kaW5nOiA4Yml0CgpXaGVuIGNvb2tpZSBh dXRoZW50aWNhdGlvbiBpcyBkaXNhYmxlZCwgQ09PS0lFX0VDSE8gcmVzdG9yZXMgZml4ZWQtc2l6 ZQpBVVRIIGZpZWxkcyBkaXJlY3RseSBmcm9tIHBlZXItY29udHJvbGxlZCBjb29raWUgYnl0ZXMu ICBBIGZvcmdlZCBSQU5ET00KbGVuZ3RoLCBITUFDIGxpc3QsIG9yIENIVU5LUyBsaXN0IGNhbiB0 aGVuIHJlYWNoIGFzc29jaWF0aW9uIGNvbnN1bWVycwp3aXRoIGxlbmd0aHMgb3IgaWRlbnRpZmll cnMgdGhhdCB3ZXJlIG5ldmVyIHZhbGlkYXRlZCBhZ2FpbnN0IHRoZSBsb2NhbApiYWNraW5nIGFy cmF5cy4KClZhbGlkYXRlIHRoZSBjb29raWUncyBSQU5ET00sIEhNQUNTLCBhbmQgQ0hVTktTIHBh cmFtZXRlcnMgYXQgdGhlIGNvb2tpZQp0cnVzdCBib3VuZGFyeSBiZWZvcmUgY29weWluZyB0aGVt IGludG8gdGhlIGFzc29jaWF0aW9uLiAgUmVqZWN0IGludmFsaWQKdHlwZXMsIG1hbGZvcm1lZCBs ZW5ndGhzLCB1bnN1cHBvcnRlZCBITUFDIGlkZW50aWZpZXJzLCBITUFDIGxpc3RzCndpdGhvdXQg U0hBMSwgYW5kIGZvcmJpZGRlbiBjaHVuayBpZHMuICBLZWVwIHRoZSBkb3duc3RyZWFtIEhNQUMg bG9va3VwCnBhdGggcmFuZ2Utc2FmZSBhcyBhIHNlY29uZCBsaW5lIG9mIGRlZmVuc2UuCgpGaXhl czogYmJkMGQ1OTgwOWY5ICgiW1NDVFBdOiBJbXBsZW1lbnQgdGhlIHJlY2VpdmUgYW5kIHZlcmlm aWNhdGlvbiBvZiBBVVRIIGNodW5rIikKRml4ZXM6IDFmNDg1NjQ5ZjUyOSAoIltTQ1RQXTogSW1w bGVtZW50IFNDVFAtQVVUSCBpbnRlcm5hbHMiKQpTaWduZWQtb2ZmLWJ5OiBKw6lyw6lteSBKZWFu IDxKZXJlbXkuSmVhbkBzc2kuZ291di5mcj4KLS0tCiBpbmNsdWRlL25ldC9zY3RwL2F1dGguaCAg fCAgMyArKwogbmV0L3NjdHAvYXV0aC5jICAgICAgICAgIHwgODggKysrKysrKysrKysrKysrKysr KysrKysrKysrKysrKysrKysrKysrKysrKysrKysrCiBuZXQvc2N0cC9zbV9tYWtlX2NodW5rLmMg fCAgMyArKwogbmV0L3NjdHAvc21fc3RhdGVmdW5zLmMgIHwgIDMgKysKIDQgZmlsZXMgY2hhbmdl ZCwgOTcgaW5zZXJ0aW9ucygrKQoKZGlmZiAtLWdpdCBhL2luY2x1ZGUvbmV0L3NjdHAvYXV0aC5o IGIvaW5jbHVkZS9uZXQvc2N0cC9hdXRoLmgKaW5kZXggNmYyY2Q1NjJiMWRlLi43NGIzNzkwZTJh M2QgMTAwNjQ0Ci0tLSBhL2luY2x1ZGUvbmV0L3NjdHAvYXV0aC5oCisrKyBiL2luY2x1ZGUvbmV0 L3NjdHAvYXV0aC5oCkBAIC0yMiw2ICsyMiw3IEBAIHN0cnVjdCBzY3RwX2VuZHBvaW50Owogc3Ry dWN0IHNjdHBfYXNzb2NpYXRpb247CiBzdHJ1Y3Qgc2N0cF9hdXRoa2V5Owogc3RydWN0IHNjdHBf aG1hY2FsZ287CitzdHJ1Y3Qgc2N0cF9jb29raWU7CiAKIC8qIERlZmluZXMgYW4gSE1BQyBhbGdv cml0aG0gc3VwcG9ydGVkIGJ5IFNDVFAgY2h1bmsgYXV0aGVudGljYXRpb24gKi8KIHN0cnVjdCBz Y3RwX2htYWMgewpAQCAtNzIsNiArNzMsOCBAQCBzdHJ1Y3Qgc2N0cF9zaGFyZWRfa2V5ICpzY3Rw X2F1dGhfZ2V0X3Noa2V5KAogaW50IHNjdHBfYXV0aF9hc29jX2NvcHlfc2hrZXlzKGNvbnN0IHN0 cnVjdCBzY3RwX2VuZHBvaW50ICplcCwKIAkJCQlzdHJ1Y3Qgc2N0cF9hc3NvY2lhdGlvbiAqYXNv YywKIAkJCQlnZnBfdCBnZnApOworYm9vbCBzY3RwX2F1dGhfdmVyaWZ5X2Nvb2tpZV9wYXJhbXMo Y29uc3Qgc3RydWN0IHNjdHBfZW5kcG9pbnQgKmVwLAorCQkJCSAgICBjb25zdCBzdHJ1Y3Qgc2N0 cF9jb29raWUgKmNvb2tpZSk7CiBjb25zdCBzdHJ1Y3Qgc2N0cF9obWFjICpzY3RwX2F1dGhfZ2V0 X2htYWMoX191MTYgaG1hY19pZCk7CiBjb25zdCBzdHJ1Y3Qgc2N0cF9obWFjICoKIHNjdHBfYXV0 aF9hc29jX2dldF9obWFjKGNvbnN0IHN0cnVjdCBzY3RwX2Fzc29jaWF0aW9uICphc29jKTsKZGlm ZiAtLWdpdCBhL25ldC9zY3RwL2F1dGguYyBiL25ldC9zY3RwL2F1dGguYwppbmRleCBjOTAxZDM3 M2FmODAuLjYxNjJlYjczMWE2YyAxMDA2NDQKLS0tIGEvbmV0L3NjdHAvYXV0aC5jCisrKyBiL25l dC9zY3RwL2F1dGguYwpAQCAtMzc3LDYgKzM3Nyw4NCBAQCBpbnQgc2N0cF9hdXRoX2Fzb2NfY29w eV9zaGtleXMoY29uc3Qgc3RydWN0IHNjdHBfZW5kcG9pbnQgKmVwLAogCXJldHVybiAtRU5PTUVN OwogfQogCitzdGF0aWMgYm9vbCBzY3RwX2F1dGhfY29va2llX2NodW5rX2ZvcmJpZGRlbihfX3U4 IGNodW5rX2lkKQoreworCXN3aXRjaCAoY2h1bmtfaWQpIHsKKwljYXNlIFNDVFBfQ0lEX0lOSVQ6 CisJY2FzZSBTQ1RQX0NJRF9JTklUX0FDSzoKKwljYXNlIFNDVFBfQ0lEX1NIVVRET1dOX0NPTVBM RVRFOgorCWNhc2UgU0NUUF9DSURfQVVUSDoKKwkJcmV0dXJuIHRydWU7CisJZGVmYXVsdDoKKwkJ cmV0dXJuIGZhbHNlOworCX0KK30KKworLyogVmVyaWZ5IEFVVEggcGFyYW1ldGVycyBjb3BpZWQg ZnJvbSBhIHN0YXRlIGNvb2tpZSBiZWZvcmUgdGhleSBhcmUgcmVzdG9yZWQKKyAqIGludG8gYW4g YXNzb2NpYXRpb24uICBXaGVuIGNvb2tpZSBhdXRoZW50aWNhdGlvbiBpcyBkaXNhYmxlZCB0aGVz ZSBmaWVsZHMKKyAqIGFyZSBwZWVyLWNvbnRyb2xsZWQsIHNvIHRoZXkgbXVzdCBzYXRpc2Z5IHRo ZSBzYW1lIGNvbnN0cmFpbnRzIGFzIGxvY2FsbHkKKyAqIGdlbmVyYXRlZCBBVVRIIHBhcmFtZXRl cnMuCisgKi8KK2Jvb2wgc2N0cF9hdXRoX3ZlcmlmeV9jb29raWVfcGFyYW1zKGNvbnN0IHN0cnVj dCBzY3RwX2VuZHBvaW50ICplcCwKKwkJCQkgICAgY29uc3Qgc3RydWN0IHNjdHBfY29va2llICpj b29raWUpCit7CisJY29uc3Qgc3RydWN0IHNjdHBfcGFyYW1oZHIgKnJhbmRvbTsKKwljb25zdCBz dHJ1Y3Qgc2N0cF9obWFjX2FsZ29fcGFyYW0gKmhtYWNzOworCWNvbnN0IHN0cnVjdCBzY3RwX2No dW5rc19wYXJhbSAqY2h1bmtzOworCWJvb2wgaGFzX3NoYTEgPSBmYWxzZTsKKwlfX3UxNiBobWFj c19sZW47CisJX191MTYgY2h1bmtzX2xlbjsKKwlfX3UxNiBuX2htYWNzOworCV9fdTE2IG5fY2h1 bmtzOworCV9fdTE2IGk7CisKKwlpZiAoc2N0cF9zayhlcC0+YmFzZS5zayktPmNvb2tpZV9hdXRo X2VuYWJsZSB8fCAhZXAtPmF1dGhfZW5hYmxlKQorCQlyZXR1cm4gdHJ1ZTsKKworCXJhbmRvbSA9 IChjb25zdCBzdHJ1Y3Qgc2N0cF9wYXJhbWhkciAqKWNvb2tpZS0+YXV0aF9yYW5kb207CisJaWYg KHJhbmRvbS0+dHlwZSAhPSBTQ1RQX1BBUkFNX1JBTkRPTSB8fAorCSAgICBudG9ocyhyYW5kb20t Pmxlbmd0aCkgIT0gc2l6ZW9mKCpyYW5kb20pICsgU0NUUF9BVVRIX1JBTkRPTV9MRU5HVEgpCisJ CXJldHVybiBmYWxzZTsKKworCWhtYWNzID0gKGNvbnN0IHN0cnVjdCBzY3RwX2htYWNfYWxnb19w YXJhbSAqKWNvb2tpZS0+YXV0aF9obWFjczsKKwlobWFjc19sZW4gPSBudG9ocyhobWFjcy0+cGFy YW1faGRyLmxlbmd0aCk7CisJaWYgKGhtYWNzLT5wYXJhbV9oZHIudHlwZSAhPSBTQ1RQX1BBUkFN X0hNQUNfQUxHTyB8fAorCSAgICBobWFjc19sZW4gPCBzaXplb2Yoc3RydWN0IHNjdHBfcGFyYW1o ZHIpICsKKwkJCXNpemVvZihobWFjcy0+aG1hY19pZHNbMF0pIHx8CisJICAgIGhtYWNzX2xlbiA+ IHNpemVvZihjb29raWUtPmF1dGhfaG1hY3MpIHx8CisJICAgIChobWFjc19sZW4gLSBzaXplb2Yo c3RydWN0IHNjdHBfcGFyYW1oZHIpKSAlCisJCQlzaXplb2YoaG1hY3MtPmhtYWNfaWRzWzBdKSkK KwkJcmV0dXJuIGZhbHNlOworCisJbl9obWFjcyA9IChobWFjc19sZW4gLSBzaXplb2Yoc3RydWN0 IHNjdHBfcGFyYW1oZHIpKSAvCisJCSAgc2l6ZW9mKGhtYWNzLT5obWFjX2lkc1swXSk7CisJZm9y IChpID0gMDsgaSA8IG5faG1hY3M7IGkrKykgeworCQlfX3UxNiBobWFjX2lkID0gbnRvaHMoaG1h Y3MtPmhtYWNfaWRzW2ldKTsKKworCQlpZiAoIXNjdHBfaG1hY19zdXBwb3J0ZWQoaG1hY19pZCkp CisJCQlyZXR1cm4gZmFsc2U7CisJCWlmIChobWFjX2lkID09IFNDVFBfQVVUSF9ITUFDX0lEX1NI QTEpCisJCQloYXNfc2hhMSA9IHRydWU7CisJfQorCWlmICghaGFzX3NoYTEpCisJCXJldHVybiBm YWxzZTsKKworCWNodW5rcyA9IChjb25zdCBzdHJ1Y3Qgc2N0cF9jaHVua3NfcGFyYW0gKiljb29r aWUtPmF1dGhfY2h1bmtzOworCWNodW5rc19sZW4gPSBudG9ocyhjaHVua3MtPnBhcmFtX2hkci5s ZW5ndGgpOworCWlmIChjaHVua3MtPnBhcmFtX2hkci50eXBlICE9IFNDVFBfUEFSQU1fQ0hVTktT IHx8CisJICAgIGNodW5rc19sZW4gPCBzaXplb2Yoc3RydWN0IHNjdHBfcGFyYW1oZHIpIHx8CisJ ICAgIGNodW5rc19sZW4gPiBzaXplb2YoY29va2llLT5hdXRoX2NodW5rcykpCisJCXJldHVybiBm YWxzZTsKKworCW5fY2h1bmtzID0gY2h1bmtzX2xlbiAtIHNpemVvZihzdHJ1Y3Qgc2N0cF9wYXJh bWhkcik7CisJZm9yIChpID0gMDsgaSA8IG5fY2h1bmtzOyBpKyspIHsKKwkJaWYgKHNjdHBfYXV0 aF9jb29raWVfY2h1bmtfZm9yYmlkZGVuKGNodW5rcy0+Y2h1bmtzW2ldKSkKKwkJCXJldHVybiBm YWxzZTsKKwl9CisKKwlyZXR1cm4gdHJ1ZTsKK30KKwogCiAvKiBQdWJsaWMgaW50ZXJmYWNlIHRv IGNyZWF0ZSB0aGUgYXNzb2NpYXRpb24gc2hhcmVkIGtleS4KICAqIFNlZSBjb2RlIGFib3ZlIGZv ciB0aGUgYWxnb3JpdGhtLgpAQCAtNDQ3LDYgKzUyNSw5IEBAIHN0cnVjdCBzY3RwX3NoYXJlZF9r ZXkgKnNjdHBfYXV0aF9nZXRfc2hrZXkoCiAKIGNvbnN0IHN0cnVjdCBzY3RwX2htYWMgKnNjdHBf YXV0aF9nZXRfaG1hYyhfX3UxNiBobWFjX2lkKQogeworCWlmICghc2N0cF9obWFjX3N1cHBvcnRl ZChobWFjX2lkKSkKKwkJcmV0dXJuIE5VTEw7CisKIAlyZXR1cm4gJnNjdHBfaG1hY19saXN0W2ht YWNfaWRdOwogfQogCkBAIC01MDgsNiArNTg5LDExIEBAIGludCBzY3RwX2F1dGhfYXNvY192ZXJp ZnlfaG1hY19pZChjb25zdCBzdHJ1Y3Qgc2N0cF9hc3NvY2lhdGlvbiAqYXNvYywKIAkJcmV0dXJu IDA7CiAKIAlobWFjcyA9IChzdHJ1Y3Qgc2N0cF9obWFjX2FsZ29fcGFyYW0gKilhc29jLT5jLmF1 dGhfaG1hY3M7CisJaWYgKG50b2hzKGhtYWNzLT5wYXJhbV9oZHIubGVuZ3RoKSA8IHNpemVvZihz dHJ1Y3Qgc2N0cF9wYXJhbWhkcikgfHwKKwkgICAgbnRvaHMoaG1hY3MtPnBhcmFtX2hkci5sZW5n dGgpID4gc2l6ZW9mKGFzb2MtPmMuYXV0aF9obWFjcykgfHwKKwkgICAgIXNjdHBfaG1hY19zdXBw b3J0ZWQobnRvaHMoaG1hY19pZCkpKQorCQlyZXR1cm4gMDsKKwogCW5fZWx0ID0gKG50b2hzKGht YWNzLT5wYXJhbV9oZHIubGVuZ3RoKSAtCiAJCSBzaXplb2Yoc3RydWN0IHNjdHBfcGFyYW1oZHIp KSA+PiAxOwogCkBAIC02MjksNiArNzE1LDggQEAgdm9pZCBzY3RwX2F1dGhfY2FsY3VsYXRlX2ht YWMoY29uc3Qgc3RydWN0IHNjdHBfYXNzb2NpYXRpb24gKmFzb2MsCiAJICovCiAJa2V5X2lkID0g bnRvaHMoYXV0aC0+YXV0aF9oZHIuc2hrZXlfaWQpOwogCWhtYWNfaWQgPSBudG9ocyhhdXRoLT5h dXRoX2hkci5obWFjX2lkKTsKKwlpZiAoIXNjdHBfaG1hY19zdXBwb3J0ZWQoaG1hY19pZCkpCisJ CXJldHVybjsKIAogCWlmIChrZXlfaWQgPT0gYXNvYy0+YWN0aXZlX2tleV9pZCkKIAkJYXNvY19r ZXkgPSBhc29jLT5hc29jX3NoYXJlZF9rZXk7CmRpZmYgLS1naXQgYS9uZXQvc2N0cC9zbV9tYWtl X2NodW5rLmMgYi9uZXQvc2N0cC9zbV9tYWtlX2NodW5rLmMKaW5kZXggMGFlMzBjM2M4OTEzLi5j MDhhNTc1M2ZiNTggMTAwNjQ0Ci0tLSBhL25ldC9zY3RwL3NtX21ha2VfY2h1bmsuYworKysgYi9u ZXQvc2N0cC9zbV9tYWtlX2NodW5rLmMKQEAgLTE4NTIsNiArMTg1Miw5IEBAIHN0cnVjdCBzY3Rw X2Fzc29jaWF0aW9uICpzY3RwX3VucGFja19jb29raWUoCiAJLyogU2V0IHVwIG91ciBwZWVyJ3Mg cG9ydCBudW1iZXIuICAqLwogCXJldHZhbC0+cGVlci5wb3J0ID0gbnRvaHMoY2h1bmstPnNjdHBf aGRyLT5zb3VyY2UpOwogCisJaWYgKCFzY3RwX2F1dGhfdmVyaWZ5X2Nvb2tpZV9wYXJhbXMoZXAs IGJlYXJfY29va2llKSkKKwkJZ290byBtYWxmb3JtZWQ7CisKIAkvKiBQb3B1bGF0ZSB0aGUgYXNz b2NpYXRpb24gZnJvbSB0aGUgY29va2llLiAgKi8KIAltZW1jcHkoJnJldHZhbC0+YywgYmVhcl9j b29raWUsIHNpemVvZigqYmVhcl9jb29raWUpKTsKIApkaWZmIC0tZ2l0IGEvbmV0L3NjdHAvc21f c3RhdGVmdW5zLmMgYi9uZXQvc2N0cC9zbV9zdGF0ZWZ1bnMuYwppbmRleCA3MDhmYTA3ZDVmZmYu LjgyODM2ZTkyN2JlNiAxMDA2NDQKLS0tIGEvbmV0L3NjdHAvc21fc3RhdGVmdW5zLmMKKysrIGIv bmV0L3NjdHAvc21fc3RhdGVmdW5zLmMKQEAgLTQ0MzYsNiArNDQzNiw5IEBAIHN0YXRpYyBlbnVt IHNjdHBfaWVycm9yIHNjdHBfc2ZfYXV0aGVudGljYXRlKAogCXNpZ19sZW4gPSBudG9ocyhjaHVu ay0+Y2h1bmtfaGRyLT5sZW5ndGgpIC0KIAkJICBzaXplb2Yoc3RydWN0IHNjdHBfYXV0aF9jaHVu ayk7CiAJaG1hYyA9IHNjdHBfYXV0aF9nZXRfaG1hYyhudG9ocyhhdXRoX2hkci0+aG1hY19pZCkp OworCWlmICghaG1hYykKKwkJcmV0dXJuIFNDVFBfSUVSUk9SX0FVVEhfQkFEX0hNQUM7CisKIAlp ZiAoc2lnX2xlbiAhPSBobWFjLT5obWFjX2xlbikKIAkJcmV0dXJuIFNDVFBfSUVSUk9SX1BST1RP X1ZJT0xBVElPTjsKIAotLSAKMi40Ny4zCg== --_002_7402d0e3ade541f18d764ca6ecc037fcssigouvfr_--