154313 2006-11-06 22:56 0000 Kernel: proc: Use sane permission checks on the /proc/<pid>/fd/ symlinks (GENERIC-MAP-NOMATCH) 2009-07-12 21:10:28 0000 1 1 1 Unclassified Gentoo Security Kernel unspecified All Linux RESOLVED FIXED http://www.kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=778c1144771f0064b6f51bee865cceb0d996f2f9 [linux <2.6.19] P2 normal --- 1 jaervosz@gentoo.org security@gentoo.org kang@gentoo.org kumba@gentoo.org lcars@gentoo.org jaervosz@gentoo.org 2006-11-06 22:56:50 0000 Not sure wether we're affected by this one: Since 2.2 we have been doing a chroot check to see if it is appropriate to return a read or follow one of these magic symlinks. The chroot check was asking a question about the visibility of files to the calling process and it was actually checking the destination process, and not the files themselves. That test was clearly bogus. In my first pass through I simply fixed the test to check the visibility of the files themselves. That naive approach to fixing the permissions was too strict and resulted in cases where a task could not even see all of it's file descriptors. What has disturbed me about relaxing this check is that file descriptors are per-process private things, and they are occasionaly used a user space capability tokens. Looking a little farther into the symlink path on /proc I did find userid checks and a check for capability (CAP_DAC_OVERRIDE) so there were permissions checking this. But I was still concerned about privacy. Besides /proc there is only one other way to find out this kind of information, and that is ptrace. ptrace has been around for a long time and it has a well established security model. So after thinking about it I finally realized that the permission checks that make sense are the permission checks applied to ptrace_attach. The checks are simple per process, and won't cause nasty surprises for people coming from less capable unices. Unfortunately there is one case that the current ptrace_attach test does not cover: Zombies and kernel threads. Single stepping those kinds of processes is impossible. Being able to see which file descriptors are open on these tasks is important to lsof, fuser and friends. So for these special processes I made the rule you can't find out unless you have CAP_SYS_PTRACE. These proc permission checks should now conform to the principle of least surprise. As well as using much less code to implement :) Signed-off-by: Eric W. Biederman <ebiederm@xmission.com> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Linus Torvalds <torvalds@osdl.org> hlieberman@gentoo.org 2006-12-21 18:25:56 0000 Created an attachment (id=104552) Patch in Git hlieberman@gentoo.org 2006-12-21 18:28:01 0000 hppa-sources: Bump to 2.6.19 or patch. mips-sources: Bump to 2.6.19 or patch. rsbac-sources: Bump to 2.6.19 or patch. systrace-sources: Bump to 2.6.19 or patch. usermode-sources: Bump to 2.6.19 or patch. xen-sources: Bump to 2.6.19 or patch. gmsoft@gentoo.org 2006-12-23 03:51:27 0000 hppa-sources-2.6.19.1 commited. dang@gentoo.org 2007-01-02 20:00:57 0000 usermode-sources-2.6.18-r1 added. kang@gentoo.org 2007-01-12 13:40:28 0000 rsbac-sources-2.6.19 is in cvs (~arch) hlieberman@gentoo.org 2007-05-21 23:18:43 0000 Waiting on Xen. marineam@gentoo.org 2007-08-26 23:28:30 0000 The patch listed here was actually included in 2.6.18, not 2.6.19. So >=xen-sources-2.6.18 is unaffected. I masked xen-sources-2.6.16 a couple days ago and will be removed soon. 104552 2006-12-21 18:25 0000 Patch in Git back.c.patch text/plain RnJvbTogRXJpYyBXLiBCaWVkZXJtYW4gPGViaWVkZXJtQHhtaXNzaW9uLmNvbT4KRGF0ZTogTW9u LCAyNiBKdW4gMjAwNiAwNzoyNTo1OCArMDAwMCAoLTA3MDApClN1YmplY3Q6IFtQQVRDSF0gcHJv YzogVXNlIHNhbmUgcGVybWlzc2lvbiBjaGVja3Mgb24gdGhlIC9wcm9jLzxwaWQ+L2ZkLyBzeW1s aW5rcwpYLUdpdC1UYWc6IHYyLjYuMTgtcmMxClgtR2l0LVVybDogaHR0cDovL3d3dy5rZXJuZWwu b3JnL2dpdC8/cD1saW51eC9rZXJuZWwvZ2l0L3RvcnZhbGRzL2xpbnV4LTIuNi5naXQ7YT1jb21t aXRkaWZmO2g9Nzc4YzExNDQ3NzFmMDA2NGI2ZjUxYmVlODY1Y2NlYjBkOTk2ZjJmOQoKW1BBVENI XSBwcm9jOiBVc2Ugc2FuZSBwZXJtaXNzaW9uIGNoZWNrcyBvbiB0aGUgL3Byb2MvPHBpZD4vZmQv IHN5bWxpbmtzCgpTaW5jZSAyLjIgd2UgaGF2ZSBiZWVuIGRvaW5nIGEgY2hyb290IGNoZWNrIHRv IHNlZSBpZiBpdCBpcyBhcHByb3ByaWF0ZSB0bwpyZXR1cm4gYSByZWFkIG9yIGZvbGxvdyBvbmUg b2YgdGhlc2UgbWFnaWMgc3ltbGlua3MuICBUaGUgY2hyb290IGNoZWNrIHdhcwphc2tpbmcgYSBx dWVzdGlvbiBhYm91dCB0aGUgdmlzaWJpbGl0eSBvZiBmaWxlcyB0byB0aGUgY2FsbGluZyBwcm9j ZXNzIGFuZAppdCB3YXMgYWN0dWFsbHkgY2hlY2tpbmcgdGhlIGRlc3RpbmF0aW9uIHByb2Nlc3Ms IGFuZCBub3QgdGhlIGZpbGVzCnRoZW1zZWx2ZXMuICBUaGF0IHRlc3Qgd2FzIGNsZWFybHkgYm9n dXMuCgpJbiBteSBmaXJzdCBwYXNzIHRocm91Z2ggSSBzaW1wbHkgZml4ZWQgdGhlIHRlc3QgdG8g Y2hlY2sgdGhlIHZpc2liaWxpdHkgb2YKdGhlIGZpbGVzIHRoZW1zZWx2ZXMuICBUaGF0IG5haXZl IGFwcHJvYWNoIHRvIGZpeGluZyB0aGUgcGVybWlzc2lvbnMgd2FzCnRvbyBzdHJpY3QgYW5kIHJl c3VsdGVkIGluIGNhc2VzIHdoZXJlIGEgdGFzayBjb3VsZCBub3QgZXZlbiBzZWUgYWxsIG9mCml0 J3MgZmlsZSBkZXNjcmlwdG9ycy4KCldoYXQgaGFzIGRpc3R1cmJlZCBtZSBhYm91dCByZWxheGlu ZyB0aGlzIGNoZWNrIGlzIHRoYXQgZmlsZSBkZXNjcmlwdG9ycwphcmUgcGVyLXByb2Nlc3MgcHJp dmF0ZSB0aGluZ3MsIGFuZCB0aGV5IGFyZSBvY2Nhc2lvbmFseSB1c2VkIGEgdXNlciBzcGFjZQpj YXBhYmlsaXR5IHRva2Vucy4gIExvb2tpbmcgYSBsaXR0bGUgZmFydGhlciBpbnRvIHRoZSBzeW1s aW5rIHBhdGggb24gL3Byb2MKSSBkaWQgZmluZCB1c2VyaWQgY2hlY2tzIGFuZCBhIGNoZWNrIGZv ciBjYXBhYmlsaXR5IChDQVBfREFDX09WRVJSSURFKSBzbwp0aGVyZSB3ZXJlIHBlcm1pc3Npb25z IGNoZWNraW5nIHRoaXMuCgpCdXQgSSB3YXMgc3RpbGwgY29uY2VybmVkIGFib3V0IHByaXZhY3ku ICBCZXNpZGVzIC9wcm9jIHRoZXJlIGlzIG9ubHkgb25lCm90aGVyIHdheSB0byBmaW5kIG91dCB0 aGlzIGtpbmQgb2YgaW5mb3JtYXRpb24sIGFuZCB0aGF0IGlzIHB0cmFjZS4gIHB0cmFjZQpoYXMg YmVlbiBhcm91bmQgZm9yIGEgbG9uZyB0aW1lIGFuZCBpdCBoYXMgYSB3ZWxsIGVzdGFibGlzaGVk IHNlY3VyaXR5Cm1vZGVsLgoKU28gYWZ0ZXIgdGhpbmtpbmcgYWJvdXQgaXQgSSBmaW5hbGx5IHJl YWxpemVkIHRoYXQgdGhlIHBlcm1pc3Npb24gY2hlY2tzCnRoYXQgbWFrZSBzZW5zZSBhcmUgdGhl IHBlcm1pc3Npb24gY2hlY2tzIGFwcGxpZWQgdG8gcHRyYWNlX2F0dGFjaC4gIFRoZQpjaGVja3Mg YXJlIHNpbXBsZSBwZXIgcHJvY2VzcywgYW5kIHdvbid0IGNhdXNlIG5hc3R5IHN1cnByaXNlcyBm b3IgcGVvcGxlCmNvbWluZyBmcm9tIGxlc3MgY2FwYWJsZSB1bmljZXMuCgpVbmZvcnR1bmF0ZWx5 IHRoZXJlIGlzIG9uZSBjYXNlIHRoYXQgdGhlIGN1cnJlbnQgcHRyYWNlX2F0dGFjaCB0ZXN0IGRv ZXMKbm90IGNvdmVyOiBab21iaWVzIGFuZCBrZXJuZWwgdGhyZWFkcy4gIFNpbmdsZSBzdGVwcGlu ZyB0aG9zZSBraW5kcyBvZgpwcm9jZXNzZXMgaXMgaW1wb3NzaWJsZS4gIEJlaW5nIGFibGUgdG8g c2VlIHdoaWNoIGZpbGUgZGVzY3JpcHRvcnMgYXJlIG9wZW4Kb24gdGhlc2UgdGFza3MgaXMgaW1w b3J0YW50IHRvIGxzb2YsIGZ1c2VyIGFuZCBmcmllbmRzLiAgU28gZm9yIHRoZXNlCnNwZWNpYWwg cHJvY2Vzc2VzIEkgbWFkZSB0aGUgcnVsZSB5b3UgY2FuJ3QgZmluZCBvdXQgdW5sZXNzIHlvdSBo YXZlCkNBUF9TWVNfUFRSQUNFLgoKVGhlc2UgcHJvYyBwZXJtaXNzaW9uIGNoZWNrcyBzaG91bGQg bm93IGNvbmZvcm0gdG8gdGhlIHByaW5jaXBsZSBvZiBsZWFzdApzdXJwcmlzZS4gIEFzIHdlbGwg YXMgdXNpbmcgbXVjaCBsZXNzIGNvZGUgdG8gaW1wbGVtZW50IDopCgpTaWduZWQtb2ZmLWJ5OiBF cmljIFcuIEJpZWRlcm1hbiA8ZWJpZWRlcm1AeG1pc3Npb24uY29tPgpTaWduZWQtb2ZmLWJ5OiBB bmRyZXcgTW9ydG9uIDxha3BtQG9zZGwub3JnPgpTaWduZWQtb2ZmLWJ5OiBMaW51cyBUb3J2YWxk cyA8dG9ydmFsZHNAb3NkbC5vcmc+Ci0tLQoKLS0tIGEvZnMvcHJvYy9iYXNlLmMKKysrIGIvZnMv cHJvYy9iYXNlLmMKQEAgLTUzMiw0MiArNTMyLDM0IEBAIHN0YXRpYyBpbnQgcHJvY19vb21fc2Nv cmUoc3RydWN0IHRhc2tfc3QKIC8qKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioq KioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKiovCiAKIC8qIHBlcm1pc3Npb24gY2hl Y2tzICovCi0KLS8qIElmIHRoZSBwcm9jZXNzIGJlaW5nIHJlYWQgaXMgc2VwYXJhdGVkIGJ5IGNo cm9vdCBmcm9tIHRoZSByZWFkaW5nIHByb2Nlc3MsCi0gKiBkb24ndCBsZXQgdGhlIHJlYWRlciBh Y2Nlc3MgdGhlIHRocmVhZHMuCi0gKi8KLXN0YXRpYyBpbnQgcHJvY19jaGVja19jaHJvb3Qoc3Ry dWN0IGRlbnRyeSAqZGUsIHN0cnVjdCB2ZnNtb3VudCAqbW50KQorc3RhdGljIGludCBwcm9jX2Zk X2FjY2Vzc19hbGxvd2VkKHN0cnVjdCBpbm9kZSAqaW5vZGUpCiB7Ci0Jc3RydWN0IGRlbnRyeSAq YmFzZTsKLQlzdHJ1Y3QgdmZzbW91bnQgKm91cl92ZnNtbnQ7Ci0JaW50IHJlcyA9IDA7Ci0KLQly ZWFkX2xvY2soJmN1cnJlbnQtPmZzLT5sb2NrKTsKLQlvdXJfdmZzbW50ID0gbW50Z2V0KGN1cnJl bnQtPmZzLT5yb290bW50KTsKLQliYXNlID0gZGdldChjdXJyZW50LT5mcy0+cm9vdCk7Ci0JcmVh ZF91bmxvY2soJmN1cnJlbnQtPmZzLT5sb2NrKTsKLQotCXNwaW5fbG9jaygmdmZzbW91bnRfbG9j ayk7CisJc3RydWN0IHRhc2tfc3RydWN0ICp0YXNrOworCWludCBhbGxvd2VkID0gMDsKKwkvKiBB bGxvdyBhY2Nlc3MgdG8gYSB0YXNrJ3MgZmlsZSBkZXNjcmlwdG9ycyBpZiBlaXRoZXIgd2UgbWF5 CisJICogdXNlIHB0cmFjZSBhdHRhY2ggdG8gdGhlIHByb2Nlc3MgYW5kIGZpbmQgb3V0IHRoYXQK KwkgKiBpbmZvcm1hdGlvbiwgb3IgaWYgdGhlIHRhc2sgY2Fubm90IHBvc3NpYmx5IGJlIHB0cmFj ZWQKKwkgKiBhbGxvdyBhY2Nlc3MgaWYgd2UgaGF2ZSB0aGUgcHJvcGVyIGNhcGFiaWxpdHkuCisJ ICovCisJdGFzayA9IGdldF9wcm9jX3Rhc2soaW5vZGUpOworCWlmICh0YXNrID09IGN1cnJlbnQp CisJCWFsbG93ZWQgPSAxOworCWlmICh0YXNrICYmICFhbGxvd2VkKSB7CisJCWludCBhbGl2ZTsK IAotCXdoaWxlIChtbnQgIT0gb3VyX3Zmc21udCkgewotCQlpZiAobW50ID09IG1udC0+bW50X3Bh cmVudCkKLQkJCWdvdG8gb3V0OwotCQlkZSA9IG1udC0+bW50X21vdW50cG9pbnQ7Ci0JCW1udCA9 IG1udC0+bW50X3BhcmVudDsKKwkJdGFza19sb2NrKHRhc2spOworCQlhbGl2ZSA9ICEhdGFzay0+ bW07CisJCXRhc2tfdW5sb2NrKHRhc2spOworCQlpZiAoYWxpdmUpCisJCQkvKiBGb3IgYSBsaXZp bmcgdGFzayBvYmV5IHB0cmFjZV9tYXlfYXR0YWNoICovCisJCQlhbGxvd2VkID0gcHRyYWNlX21h eV9hdHRhY2godGFzayk7CisJCWVsc2UKKwkJCS8qIEZvciBhIHNwZWNpYWwgdGFzayBzaW1wbHkg Y2hlY2sgdGhlIGNhcGFiaWxpdHkgKi8KKwkJCWFsbG93ZWQgPSBjYXBhYmxlKENBUF9TWVNfUFRS QUNFKTsKIAl9Ci0KLQlpZiAoIWlzX3N1YmRpcihkZSwgYmFzZSkpCi0JCWdvdG8gb3V0OwotCXNw aW5fdW5sb2NrKCZ2ZnNtb3VudF9sb2NrKTsKLQotZXhpdDoKLQlkcHV0KGJhc2UpOwotCW1udHB1 dChvdXJfdmZzbW50KTsKLQlyZXR1cm4gcmVzOwotb3V0OgotCXNwaW5fdW5sb2NrKCZ2ZnNtb3Vu dF9sb2NrKTsKLQlyZXMgPSAtRUFDQ0VTOwotCWdvdG8gZXhpdDsKKwlpZiAodGFzaykKKwkJcHV0 X3Rhc2tfc3RydWN0KHRhc2spOworCXJldHVybiBhbGxvd2VkOwogfQogCiBleHRlcm4gc3RydWN0 IHNlcV9vcGVyYXRpb25zIG1vdW50c19vcDsKQEAgLTEwNjIsNTIgKzEwNTQsNiBAQCBzdGF0aWMg c3RydWN0IGZpbGVfb3BlcmF0aW9ucyBwcm9jX3NlY2NvCiB9OwogI2VuZGlmIC8qIENPTkZJR19T RUNDT01QICovCiAKLXN0YXRpYyBpbnQgcHJvY19jaGVja19kZW50cnlfdmlzaWJsZShzdHJ1Y3Qg aW5vZGUgKmlub2RlLAotCXN0cnVjdCBkZW50cnkgKmRlbnRyeSwgc3RydWN0IHZmc21vdW50ICpt bnQpCi17Ci0JLyogVmVyaWZ5IHRoYXQgdGhlIGN1cnJlbnQgcHJvY2VzcyBjYW4gYWxyZWFkeSBz ZWUgdGhlCi0JICogZmlsZSBwb2ludGVkIGF0IGJ5IHRoZSBmaWxlIGRlc2NyaXB0b3IuCi0JICog VGhpcyBwcmV2ZW50cyAvcHJvYyBmcm9tIGJlaW5nIGFuIGFjY2lkZW50YWwgaW5mb3JtYXRpb24g bGVhay4KLQkgKgotCSAqIFRoaXMgcHJldmVudHMgYWNjZXNzIHRvIGZpbGVzIHRoYXQgYXJlIG5v dCB2aXNpYmxlIGRvIHRvCi0JICogYmVpbmcgb24gdGhlIG90aGVyc2lkZSBvZiBhIGNocm9vdCwg aW4gYSBkaWZmZXJlbnQKLQkgKiBuYW1lc3BhY2UsIG9yIGFyZSBzaW1wbHkgcHJvY2VzcyBsb2Nh bCAobGlrZSBwaXBlcykuCi0JICovCi0Jc3RydWN0IHRhc2tfc3RydWN0ICp0YXNrOwotCWludCBl cnJvciA9IC1FQUNDRVM7Ci0KLQkvKiBTZWUgaWYgdGhlIHRoZSB0d28gdGFza3Mgc2hhcmUgYSBj b21tb25lIHNldCBvZgotCSAqIGZpbGUgZGVzY3JpcHRvcnMuICBJZiBzbyBldmVyeXRoaW5nIGlz IHZpc2libGUuCi0JICovCi0JcmN1X3JlYWRfbG9jaygpOwotCXRhc2sgPSB0cmVmX3Rhc2socHJv Y190cmVmKGlub2RlKSk7Ci0JaWYgKHRhc2spIHsKLQkJc3RydWN0IGZpbGVzX3N0cnVjdCAqdGFz a19maWxlcywgKmZpbGVzOwotCQkvKiBUaGlzIHRlc3QgYW5zd2VyZXMgdGhlIHF1ZXN0aW9uOgot CQkgKiBJcyB0aGVyZSBhIHBvaW50IGluIHRpbWUgc2luY2Ugd2UgbG9va2VkIHVwIHRoZQotCQkg KiBmaWxlIGRlc2NyaXB0b3Igd2hlcmUgdGhlIHR3byB0YXNrcyBzaGFyZSB0aGUKLQkJICogc2Ft ZSBmaWxlcyBzdHJ1Y3Q/Ci0JCSAqLwotCQlybWIoKTsKLQkJZmlsZXMgPSBjdXJyZW50LT5maWxl czsKLQkJdGFza19maWxlcyA9IHRhc2stPmZpbGVzOwotCQlpZiAoZmlsZXMgJiYgKGZpbGVzID09 IHRhc2tfZmlsZXMpKQotCQkJZXJyb3IgPSAwOwotCX0KLQlyY3VfcmVhZF91bmxvY2soKTsKLQlp ZiAoIWVycm9yKQotCQlnb3RvIG91dDsKLQotCS8qIElmIHRoZSB0d28gdGFza3MgZG9uJ3Qgc2hh cmUgYSBjb21tb24gc2V0IG9mIGZpbGUKLQkgKiBkZXNjcmlwdG9ycyBzZWUgaWYgdGhlIGRlc3Rp bmF0aW9uIGRlbnRyeSBpcyBhbHJlYWR5Ci0JICogdmlzaWJsZSBpbiB0aGUgY3VycmVudCB0YXNr cyBmaWxlc3lzdGVtIG5hbWVzcGFjZS4KLQkgKi8KLQllcnJvciA9IHByb2NfY2hlY2tfY2hyb290 KGRlbnRyeSwgbW50KTsKLW91dDoKLQlyZXR1cm4gZXJyb3I7Ci0KLX0KLQogc3RhdGljIHZvaWQg KnByb2NfcGlkX2ZvbGxvd19saW5rKHN0cnVjdCBkZW50cnkgKmRlbnRyeSwgc3RydWN0IG5hbWVp ZGF0YSAqbmQpCiB7CiAJc3RydWN0IGlub2RlICppbm9kZSA9IGRlbnRyeS0+ZF9pbm9kZTsKQEAg LTExMTYsMTggKzEwNjIsMTIgQEAgc3RhdGljIHZvaWQgKnByb2NfcGlkX2ZvbGxvd19saW5rKHN0 cnVjdAogCS8qIFdlIGRvbid0IG5lZWQgYSBiYXNlIHBvaW50ZXIgaW4gdGhlIC9wcm9jIGZpbGVz eXN0ZW0gKi8KIAlwYXRoX3JlbGVhc2UobmQpOwogCi0JaWYgKGN1cnJlbnQtPmZzdWlkICE9IGlu b2RlLT5pX3VpZCAmJiAhY2FwYWJsZShDQVBfREFDX09WRVJSSURFKSkKKwkvKiBBcmUgd2UgYWxs b3dlZCB0byBzbm9vcCBvbiB0aGUgdGFza3MgZmlsZSBkZXNjcmlwdG9ycz8gKi8KKwlpZiAoIXBy b2NfZmRfYWNjZXNzX2FsbG93ZWQoaW5vZGUpKQogCQlnb3RvIG91dDsKIAogCWVycm9yID0gUFJP Q19JKGlub2RlKS0+b3AucHJvY19nZXRfbGluayhpbm9kZSwgJm5kLT5kZW50cnksICZuZC0+bW50 KTsKIAluZC0+bGFzdF90eXBlID0gTEFTVF9CSU5EOwotCWlmIChlcnJvcikKLQkJZ290byBvdXQ7 Ci0KLQkvKiBPbmx5IHJldHVybiBmaWxlcyB0aGlzIHRhc2sgY2FuIGFscmVhZHkgc2VlICovCi0J ZXJyb3IgPSBwcm9jX2NoZWNrX2RlbnRyeV92aXNpYmxlKGlub2RlLCBuZC0+ZGVudHJ5LCBuZC0+ bW50KTsKLQlpZiAoZXJyb3IpCi0JCXBhdGhfcmVsZWFzZShuZCk7CiBvdXQ6CiAJcmV0dXJuIEVS Ul9QVFIoZXJyb3IpOwogfQpAQCAtMTE2NSwyMSArMTEwNSwxNSBAQCBzdGF0aWMgaW50IHByb2Nf cGlkX3JlYWRsaW5rKHN0cnVjdCBkZW50CiAJc3RydWN0IGRlbnRyeSAqZGU7CiAJc3RydWN0IHZm c21vdW50ICptbnQgPSBOVUxMOwogCi0KLQlpZiAoY3VycmVudC0+ZnN1aWQgIT0gaW5vZGUtPmlf dWlkICYmICFjYXBhYmxlKENBUF9EQUNfT1ZFUlJJREUpKQorCS8qIEFyZSB3ZSBhbGxvd2VkIHRv IHNub29wIG9uIHRoZSB0YXNrcyBmaWxlIGRlc2NyaXB0b3JzPyAqLworCWlmICghcHJvY19mZF9h Y2Nlc3NfYWxsb3dlZChpbm9kZSkpCiAJCWdvdG8gb3V0OwogCiAJZXJyb3IgPSBQUk9DX0koaW5v ZGUpLT5vcC5wcm9jX2dldF9saW5rKGlub2RlLCAmZGUsICZtbnQpOwogCWlmIChlcnJvcikKIAkJ Z290byBvdXQ7CiAKLQkvKiBPbmx5IHJldHVybiBmaWxlcyB0aGlzIHRhc2sgY2FuIGFscmVhZHkg c2VlICovCi0JZXJyb3IgPSBwcm9jX2NoZWNrX2RlbnRyeV92aXNpYmxlKGlub2RlLCBkZSwgbW50 KTsKLQlpZiAoZXJyb3IpCi0JCWdvdG8gb3V0X3B1dDsKLQogCWVycm9yID0gZG9fcHJvY19yZWFk bGluayhkZSwgbW50LCBidWZmZXIsIGJ1Zmxlbik7Ci1vdXRfcHV0OgogCWRwdXQoZGUpOwogCW1u dHB1dChtbnQpOwogb3V0Ogo=