From xen-announce-bounces@lists.xenproject.org Fri Oct 09 08:53:28 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Fri, 09 Oct 2026 08:53:28 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1444095.1661110 (Exim 4.92) (envelope-from ) id 1xF6Ld-0002Ro-M6; Fri, 09 Oct 2026 08:53:01 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1444095.1661110; Fri, 09 Oct 2026 08:53:01 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1xF6Ld-0002Rd-G4; Fri, 09 Oct 2026 08:53:01 +0000 Received: by outflank-mailman (input) for mailman id 1444095; Fri, 09 Oct 2026 08:53:00 +0000 Received: from mx.expurgate.net ([194.145.224.20]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1xF6Lc-0002RJ-LR; Fri, 09 Oct 2026 08:53:00 +0000 Received: from mx.expurgate.net (helo=localhost) by mx.expurgate.net with esmtp id 1xF6Lb-0020KT-Ny; Fri, 09 Oct 2026 10:52:59 +0200 Received: from [10.42.69.7] (helo=localhost) by localhost with ESMTP (eXpurgate MTA 0.9.1) (envelope-from ) id 6ac8ab68-8faa-0a2a0a5109dd-0a2a45078778-18 for ; Fri, 09 Oct 2026 10:52:59 +0200 Received: from [104.130.215.37] (helo=mail.xenproject.org) by tlsNG-ef75cf.mxtls.expurgate.net with ESMTPS (eXpurgate 4.57.1) (envelope-from ) id 6ac8ab6a-b4ea-0a2a45070019-6882d725ae08-3 for ; Fri, 09 Oct 2026 10:52:59 +0200 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1xF6LU-004j7d-2d; Fri, 09 Oct 2026 08:52:52 +0000 Received: from julieng by xenbits.xenproject.org with local (Exim 4.96) (envelope-from ) id 1xF6LU-001PzP-2R; Fri, 09 Oct 2026 08:52:52 +0000 X-BeenThere: xen-announce@lists.xenproject.org List-Id: "Xen announcements \(low volume\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-announce-bounces@lists.xenproject.org Precedence: list Sender: "Xen-announce" Authentication-Results: eu.smtp.expurgate.cloud; none Content-Type: multipart/mixed; boundary="=separator"; charset="utf-8" Content-Transfer-Encoding: binary MIME-Version: 1.0 X-Mailer: MIME-tools 5.510 (Entity 5.510) To: xen-announce@lists.xen.org, xen-devel@lists.xen.org, xen-users@lists.xen.org, oss-security@lists.openwall.com From: Xen.org security team CC: Xen.org security team Subject: Xen Security Advisory 522 v1 (CVE-2026-98375) - Linux xen-netfront: backend can crash guest via malformed RX packets Message-Id: Date: Fri, 09 Oct 2026 08:52:52 +0000 X-purgate-ID: tlsNG-ef75cf/1791535979-378D1AE4-126C4B0D/0/0 X-purgate-type: clean X-purgate-size: 5448 --=separator Content-Type: text/plain; charset="utf-8" Content-Disposition: inline Content-Transfer-Encoding: 7bit -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Xen Security Advisory CVE-2026-98375 / XSA-522 Linux xen-netfront: backend can crash guest via malformed RX packets ISSUE DESCRIPTION ================= If a RX packet sent from the networking backend to the Linux xen-netfront driver is split into multiple slots and the first slot is shorter than an Ethernet header, a BUG() will crash the guest. This is a backend induced Denial of Service (DoS). IMPACT ====== A malicious network backend can cause a DoS affecting the entire guest it is serving. VULNERABLE SYSTEMS ================== All Linux guests being served by a potentially untrusted network backend (i.e. a network backend in a driver domain) are affected. Linux guests with a kernel from 2.6.23 onwards are affected. MITIGATION ========== Using a trusted network backend will avoid the issue in the guests. CREDITS ======= This issue was discovered by Josef Bacik of Anthropic. RESOLUTION ========== Applying the attached patch resolves this issue. xsa522-linux.patch Linux $ sha256sum xsa522* 5bd78edbf9f039b6e12e725c883a44485fd60e7e8e06c493d57bb2ecfeccbb6e xsa522-linux.patch $ NOTE REGARDING LACK OF EMBARGO ============================== This issue was disclosed in public. -----BEGIN PGP SIGNATURE----- iQFcBAEBCABGFiEEI+MiLBRfRHX6gGCng/4UyVfoK9kFAmrIqswbFIAAAAAABAAO bWFudTIsMi41KzEuMTIsMCwzDBxwZ3BAeGVuLm9yZwAKCRCD/hTJV+gr2Z0aB/4x lyvVclfKLPKO7TezBS0Du+ee3t8PbwMfWe7Gw3rMOkaytQs+XbBZrZ/lF9uNgSyu a+bwaALjNvTuBJiU2Hq6w6qSMjrDb4Kfn1vRe+iw/MXj5K1q8J6NzXP/rZGkIPCl E1NyC8RPiRzva/X3CgfO59nsHNxmVxy5cFowP4oxGjp/sAqTLR4JMbK9tALa50Hz 5dc+CUC7i9YlbVgcn1KatORknlSBBqvefRM/zF/uLtGi5YCmVWVc7QlHF5BCBgio Gu5zjEqA+De5/Rg0o5gHH3Jh6xWTtfThoZewROQgu+P9QYUmHZpGKfCkYazTddzi Ns9Hz1obvGY4JuCanYvF =QR/D -----END PGP SIGNATURE----- --=separator Content-Type: application/octet-stream; name="xsa522-linux.patch" Content-Disposition: attachment; filename="xsa522-linux.patch" Content-Transfer-Encoding: base64 RnJvbSBjODQzZGRhMTg3YmQ0NGExMmQ4YTJiMWI1NmFlYmZjN2Y2NzFiODIw IE1vbiBTZXAgMTcgMDA6MDA6MDAgMjAwMQpGcm9tOiBKb3NlZiBCYWNpayA8 am9zZWZAdG94aWNwYW5kYS5jb20+CkRhdGU6IFdlZCwgNyBPY3QgMjAyNiAx Nzo1NTo0MCArMDAwMApTdWJqZWN0OiBbUEFUQ0hdIHhlbi9uZXRmcm9udDog ZHJvcCBSWCBwYWNrZXRzIHdpdGggYSBzaG9ydCBFdGhlcm5ldCBoZWFkZXIK CmhhbmRsZV9pbmNvbWluZ19xdWV1ZSgpIHB1bGxzIHB1bGxfdG8gYnl0ZXMg aW50byB0aGUgaGVhZCBiZWZvcmUKY2FsbGluZyBldGhfdHlwZV90cmFucygp LiAgcHVsbF90byBpcyB0aGUgbGVuZ3RoIG9mIHRoZSBmaXJzdCBSWCBzbG90 LApjYXBwZWQgYXQgUlhfQ09QWV9USFJFU0hPTEQsIGFuZCB0aGF0IGxlbmd0 aCBjb21lcyBmcm9tIHRoZSBiYWNrZW5kLgpOb3RoaW5nIGNoZWNrcyBpdCBh Z2FpbnN0IEVUSF9ITEVOLgoKSWYgdGhlIGZpcnN0IHNsb3QgaXMgc2hvcnRl ciB0aGFuIEVUSF9ITEVOIGFuZCBtb3JlIHNsb3RzIGZvbGxvdywgdGhlCmhl YWQgZW5kcyB1cCBzaG9ydGVyIHRoYW4gYW4gRXRoZXJuZXQgaGVhZGVyIHdo aWxlIHNrYi0+bGVuIGlzIGxvbmdlciwKYW5kIGV0aF90eXBlX3RyYW5zKCkg QlVHKClzIGluIF9fc2tiX3B1bGwoKS4gIElmIHRoZSB3aG9sZSBwYWNrZXQg aXMKc2hvcnRlciB0aGFuIEVUSF9ITEVOLCBldGhfdHlwZV90cmFucygpIHJl YWRzIHRoZSBoZWFkZXIgcGFzdCB0aGUgZW5kCm9mIHRoZSBkYXRhIGluc3Rl YWQuCgpQdWxsIGF0IGxlYXN0IEVUSF9ITEVOLCBhbmQgZHJvcCB0aGUgcGFj a2V0IGlmIHRoYXQgZmFpbHMsIHdoaWNoIGFsc28KZHJvcHMgcGFja2V0cyB0 b28gc2hvcnQgdG8gaG9sZCBhbiBFdGhlcm5ldCBoZWFkZXIuICBUaGlzIGFs c28gY2hlY2tzCnRoZSByZXR1cm4gdmFsdWUgb2YgdGhlIHB1bGwsIHdoaWNo IHdhcyBpZ25vcmVkLgoKVGhpcyBpcyBYU0EtNTIyIC8gQ1ZFLTIwMjYtOTgz NzUKCkZpeGVzOiAwZDE2MDIxMTk2NWIgKCJ4ZW46IGFkZCB2aXJ0dWFsIG5l dHdvcmsgZGV2aWNlIGRyaXZlciIpCkNjOiBzdGFibGVAdmdlci5rZXJuZWwu b3JnCkFzc2lzdGVkLWJ5OiBMTE0KU2lnbmVkLW9mZi1ieTogSm9zZWYgQmFj aWsgPGpvc2VmQHRveGljcGFuZGEuY29tPgpNZXNzYWdlLUlEOiA8MjAyNjEw MDctYjQteGVuLW5ldGZyb250LXNob3J0LWhlYWQtdjEtMS0xMmQ3MTEzYTdl NGVAdG94aWNwYW5kYS5jb20+ClJldmlld2VkLWJ5OiBKdWVyZ2VuIEdyb3Nz IDxqZ3Jvc3NAc3VzZS5jb20+ClNpZ25lZC1vZmYtYnk6IEp1ZXJnZW4gR3Jv c3MgPGpncm9zc0BzdXNlLmNvbT4KLS0tCiBkcml2ZXJzL25ldC94ZW4tbmV0 ZnJvbnQuYyB8IDEyICsrKysrKysrKystLQogMSBmaWxlIGNoYW5nZWQsIDEw IGluc2VydGlvbnMoKyksIDIgZGVsZXRpb25zKC0pCgpkaWZmIC0tZ2l0IGEv ZHJpdmVycy9uZXQveGVuLW5ldGZyb250LmMgYi9kcml2ZXJzL25ldC94ZW4t bmV0ZnJvbnQuYwppbmRleCAyZWQ2NzM2NDljNDguLmQyNjk0NTdlODM5ZSAx MDA2NDQKLS0tIGEvZHJpdmVycy9uZXQveGVuLW5ldGZyb250LmMKKysrIGIv ZHJpdmVycy9uZXQveGVuLW5ldGZyb250LmMKQEAgLTEyMzQsOCArMTIzNCwx NiBAQCBzdGF0aWMgaW50IGhhbmRsZV9pbmNvbWluZ19xdWV1ZShzdHJ1Y3Qg bmV0ZnJvbnRfcXVldWUgKnF1ZXVlLAogCXdoaWxlICgoc2tiID0gX19za2Jf ZGVxdWV1ZShyeHEpKSAhPSBOVUxMKSB7CiAJCWludCBwdWxsX3RvID0gTkVU RlJPTlRfU0tCX0NCKHNrYiktPnB1bGxfdG87CiAKLQkJaWYgKHB1bGxfdG8g PiBza2JfaGVhZGxlbihza2IpKQotCQkJX19wc2tiX3B1bGxfdGFpbChza2Is IHB1bGxfdG8gLSBza2JfaGVhZGxlbihza2IpKTsKKwkJLyogcHVsbF90byBj b21lcyBmcm9tIHRoZSBmaXJzdCBzbG90J3MgbGVuZ3RoLCB3aGljaCB0aGUK KwkJICogYmFja2VuZCBjb250cm9scy4gIE1ha2Ugc3VyZSB0aGUgaGVhZCBo b2xkcyBhdCBsZWFzdCBhbgorCQkgKiBFdGhlcm5ldCBoZWFkZXIgZm9yIGV0 aF90eXBlX3RyYW5zKCkuCisJCSAqLworCQlpZiAoIXBza2JfbWF5X3B1bGwo c2tiLCBtYXgocHVsbF90bywgRVRIX0hMRU4pKSkgeworCQkJa2ZyZWVfc2ti KHNrYik7CisJCQlwYWNrZXRzX2Ryb3BwZWQrKzsKKwkJCXF1ZXVlLT5pbmZv LT5uZXRkZXYtPnN0YXRzLnJ4X2Vycm9ycysrOworCQkJY29udGludWU7CisJ CX0KIAogCQkvKiBFdGhlcm5ldCB3b3JrOiBEZWxheWVkIHRvIGhlcmUgYXMg aXQgcGVla3MgdGhlIGhlYWRlci4gKi8KIAkJc2tiLT5wcm90b2NvbCA9IGV0 aF90eXBlX3RyYW5zKHNrYiwgcXVldWUtPmluZm8tPm5ldGRldik7Ci0tIAoy LjU1LjAKCg== --=separator-- From xen-announce-bounces@lists.xenproject.org Tue Oct 13 12:28:55 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 13 Oct 2026 12:28:55 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1447113.1663349 (Exim 4.92) (envelope-from ) id 1xGbcf-0006qq-S5; Tue, 13 Oct 2026 12:28:49 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1447113.1663349; Tue, 13 Oct 2026 12:28:49 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1xGbcf-0006qb-No; Tue, 13 Oct 2026 12:28:49 +0000 Received: by outflank-mailman (input) for mailman id 1447113; Tue, 13 Oct 2026 12:28:48 +0000 Received: from mx.expurgate.net ([195.190.135.10]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1xGbce-0006mQ-CS; Tue, 13 Oct 2026 12:28:48 +0000 Received: from mx.expurgate.net (helo=localhost) by mx.expurgate.net with esmtp id 1xGbcd-00FMjl-P8; Tue, 13 Oct 2026 14:28:47 +0200 Received: from [10.42.69.12] (helo=localhost) by localhost with ESMTP (eXpurgate MTA 0.9.1) (envelope-from ) id 6ace23fc-8faa-0a2a0a5109dd-0a2a450c98b0-2 for ; Tue, 13 Oct 2026 14:28:47 +0200 Received: from [104.130.215.37] (helo=mail.xenproject.org) by tlsNG-d25034.mxtls.expurgate.net with ESMTPS (eXpurgate 4.57.1) (envelope-from ) id 6ace23fe-f479-0a2a450c0019-6882d725d970-3 for ; Tue, 13 Oct 2026 14:28:47 +0200 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.98.2) (envelope-from ) id 1xGbcZ-00000003NGs-3ddL; Tue, 13 Oct 2026 12:28:43 +0000 Received: from andrewcoop by xenbits.xenproject.org with local (Exim 4.98.2) (envelope-from ) id 1xGbcZ-0000000F8jX-2Ydd; Tue, 13 Oct 2026 12:28:43 +0000 X-BeenThere: xen-announce@lists.xenproject.org List-Id: "Xen announcements \(low volume\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-announce-bounces@lists.xenproject.org Precedence: list Sender: "Xen-announce" Authentication-Results: eu.smtp.expurgate.cloud; none Content-Type: multipart/mixed; boundary="=separator"; charset="utf-8" Content-Transfer-Encoding: binary MIME-Version: 1.0 X-Mailer: MIME-tools 5.515 (Entity 5.515) To: xen-announce@lists.xen.org, xen-devel@lists.xen.org, xen-users@lists.xen.org, oss-security@lists.openwall.com From: Xen.org security team CC: Xen.org security team Subject: Xen Security Advisory 516 v2 (CVE-2026-79609) - x86: XPTI may break on huge-memory systems Message-Id: Date: Tue, 13 Oct 2026 12:28:43 +0000 X-purgate-ID: tlsNG-d25034/1791894527-51538A5B-1D0D221A/0/0 X-purgate-type: clean X-purgate-size: 42044 --=separator Content-Type: text/plain; charset="utf-8" Content-Disposition: inline Content-Transfer-Encoding: 7bit -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Xen Security Advisory CVE-2026-79609 / XSA-516 version 2 x86: XPTI may break on huge-memory systems UPDATES IN VERSION 2 ==================== Public release. ISSUE DESCRIPTION ================= XPTI (Xen Page Table Isolation) was introduced to mitigate Meltdown (CVE-2017-5754, one aspect of XSA-254). This involves copying 64-bit PV guest page table entries from guest-chosen root page tables to the Xen- chosen one which is in actual use by hardware. To read the guest root page table, the directmap is used. PV guests, however, have a directmap which may not cover all memory; in particular this is the case if any memory extends beyond the 5 TiB (CONFIG_BIGMEM=y: 3.5 TiB) address boundary. IMPACT ====== A 64-bit PV guest may be able to elevate its privilege to that of the host. It is also possible for them to observe information pertaining to other guests, or to cause Denial of Service (DoS) affecting the entire host. VULNERABLE SYSTEMS ================== All versions of Xen with the XPTI work backported to are affected. In upstream these are Xen 4.7.5 and onwards, Xen 4.8.3 and onwards, Xen 4.9.2 and onwards, Xen 4.10.1 and onwards, and all major releases from 4.11 onwards. Only 64-bit PV guests can leverage the vulnerability. HVM and PVH guests cannot leverage the vulnerability. 32-bit PV guests haven't been security supported anymore. Only x86 systems are affected. Arm systems are not affected. Only systems with RAM above the 5 TiB (CONFIG_BIGMEM=y: 3.5 TiB) boundary are affected. Systems with no RAM above the 5 TiB (CONFIG_BIGMEM=y: 3.5 TiB) boundary are not affected. MITIGATION ========== Not running 64-bit PV guests will avoid the vulnerability. The "mem=" hypervisor command line option may be used to limit the amount of memory Xen is going to use. That would be "mem=5T" for the CONFIG_BIGMEM=n case and "mem=3584G" for the CONFIG_BIGMEM=y one. CREDITS ======= This issue was discovered by George Dunlap. RESOLUTION ========== Applying the appropriate attached patch resolves this issue. Note that patches for released versions are generally prepared to apply to the stable branches, and may not apply cleanly to the most recent release tarball. Downstreams are encouraged to update to the tip of the stable branch before applying these patches. xsa516.patch xen-unstable - Xen 4.19.x xsa516-4.18.patch Xen 4.18.x xsa516-4.17.patch Xen 4.17.x $ sha256sum xsa516* aff590335eed173a2f67375829a25682983cacf14ff170d25e636533552ecaa8 xsa516.patch 06b818ca56dff7ccc1f4842e9977a0eee283c516959980c85cf9d54d1c0abdb0 xsa516-4.17.patch 09d87137da9d5065227c808a1150cdbb878ae05785d6929de0754184313546fa xsa516-4.18.patch $ DEPLOYMENT DURING EMBARGO ========================= Deployment of the patches and/or mitigations described above (or others which are substantially similar) is permitted during the embargo, even on public-facing systems with untrusted guest users and administrators. But: Distribution of updated software is prohibited (except to other members of the predisclosure list). Predisclosure list members who wish to deploy significantly different patches and/or mitigations, please contact the Xen Project Security Team. (Note: this during-embargo deployment notice is retained in post-embargo publicly released Xen Project advisories, even though it is then no longer applicable. This is to enable the community to have oversight of the Xen Project Security Team's decisionmaking.) For more information about permissible uses of embargoed information, consult the Xen Project community's agreed Security Policy: http://www.xenproject.org/security-policy.html -----BEGIN PGP SIGNATURE----- iQFABAEBCAAqFiEEI+MiLBRfRHX6gGCng/4UyVfoK9kFAmrOIjwMHHBncEB4ZW4u b3JnAAoJEIP+FMlX6CvZ0LoH/Ap814NnaDiHkPGqPWg0/N8gEJmPgUvSXXsjI8gb t+aLjuG3tI6j12jWtohBj67RiDAYWc3mAaqr7c9tb1Bi24IyenZIf8gAvkS72sUi Hl4WPCMcmgp0xM8s9b1peep5XTSVH1s+xDLGmBx21jXhoop1IJ5Na9VV2PcX50MJ assI8h4VE9xAYnMzMbd14IzbGXWylAZLdJYLGBoI06X7eZvPNPUvkktJaMqmSJgS IeJuUKK8pb5AFlefSxzcu007olRLhXxQrbkKXbwnyS+ZXI9r02hh8njPUTy8p/PG sLS5NNIHalXlxIOtQ20H+Hbi0n80nKn2T3ctjsKkmBGUioU= =KASN -----END PGP SIGNATURE----- --=separator Content-Type: application/octet-stream; name="xsa516.patch" Content-Disposition: attachment; filename="xsa516.patch" Content-Transfer-Encoding: base64 RnJvbTogR2VvcmdlIER1bmxhcCA8Z3dkQHhlbnByb2plY3Qub3JnPgpTdWJqZWN0OiB4ODYvcHY6 IG1hcCBlYWNoIHZDUFUncyByb290IHBhZ2UgdGFibGUgaW4gaXRzIHBlci1kb21haW4gYXJlYQoK Rm9yIFhQVEkgZW5hYmxlZCBWTXMsIHJlc3RvcmVfYWxsX2d1ZXN0KCkgY29waWVzIG1vc3Qgb2Yg dGhlIGFjdGl2ZSBMNApwYWdldGFibGUgaW50byB0aGUgcGVyLUNQVSByb290X3BndC4gIFRoZSBM NCBpcyByZWFkIHZpYSB0aGUKZGlyZWN0bWFwLgoKVW5mb3J0dW5hdGVseSwgdGhlcmUgd2FzIG5v IGFjY291bnRpbmcgZm9yIHRoZSBmYWN0IHRoYXQgUFYgZ3Vlc3RzCmhhdmUgc2hvcnQgZGlyZWN0 bWFwcy4gIEZvciBhbiBMNCBsaXZpbmcgYmV5b25kIHRoZSA1VCBib3VuZGFyeSAoMy41VApmb3Ig Q09ORklHX0JJR01FTSksIFhlbiB3aWxsIGNvcHkgYXJiaXRyYXJ5IGRhdGEgZnJvbSBndWVzdC1j b250cm9sbGVkCnZpcnR1YWwgYWRkcmVzcyBzcGFjZSBpbnRvIHRoZSBwZXItQ1BVIHJvb3RfcGd0 LCBpbnN0ZWFkIG9mIHRoZQppbnRlbmRlZCBMNC4KClhlbiBoYXMgcGVyLWRvbWFpbiBtYXBwaW5n cyBmb3IgdGhlIExEVCBhbmQgR0RULCB3aXRoIHR3byBwYWdlcwpyZXNlcnZlZCBmb3IgWGVuJ3Mg dXNlIGluIHRoZSBHRFQgYnV0IG9ubHkgb25lIGluIHVzZS4gIFJldXNlIEdEVCBwYWdlCjE1IHRv IG1hcCB0aGUgZWZmZWN0aXZlIEw0LiAgVGhlIEdEVCBsaW1pdCBrZWVwcyBpbXBsaWNpdCBhY2Nl c3NlcyBvdXQKb2YgdGhpcyBwYWdlLgoKV2UgdXBkYXRlIHRoaXMgbWFwcGluZyBpbiBtYWtlX2Ny MygpLCB0aGUgb25seSBwbGFjZSBhIG5vbi1lbXB0eSB2YWx1ZQpvZiB2LT5hcmNoLmNyMyBpcyB3 cml0dGVuIGludG8gYSBndWVzdCdzIHZjcHUgc3RydWN0LCBmb3IgdHdvIHJlYXNvbnMuCkZpcnN0 IGlzIHJlZmVyZW5jZSBjb3VudGluZzogdGhpcyBtYWtlcyBpdCBlYXNpZXIgdG8gYXJndWUgdGhh dCB0aGUKcmVmZXJlbmNlIGZvciB2LT5hcmNoLmNyMyBpdHNlbGYgY292ZXJzIHRoZSByZWZlcmVu Y2UgZm9yIHRoZSBtYXBwaW5nLgoKU2Vjb25kbHksIHRoaXMgZ3VhcmFudGVlcyB0aGF0IGFsbCB1 cGRhdGVzLCBldmVuIHVwZGF0ZXMgbWFkZSBpbgpzaGFkb3cgbW9kZSwgcmVzdWx0IGluIGFuIHVw ZGF0ZSB0byB0aGUgbWFwcGluZy4gIER1cmluZyBsaXZlCm1pZ3JhdGlvbiwgaXQncyBwb3NzaWJs ZSBmb3IgZ3Vlc3RfZ2V0X2VmZl9rZXJuX2wxZSgpIHRvIHJlc3VsdCBpbiBhCm1vZGlmaWVkIHZh bHVlIG9mIHYtPmFyY2guY3IzIChza2V0Y2ggYmVsb3cpOyBwbGFjaW5nIHRoZSBtYXBwaW5nCnVw ZGF0ZSBhdCBtYWtlX2NyMygpIGNhdGNoZXMgdGhpcywgd2hpbGUgb3RoZXIgY2FuZGlkYXRlIGxv Y2F0aW9ucwpsaWtlIHdyaXRlX3B0YmFzZSgpIGFuZCB0b2dnbGVfZ3Vlc3RfbW9kZSgpIGRvbid0 LgoKTm90ZSB0aGF0IHdlIGludHJvZHVjZSB0aGUgaWRlYSBvZiBhbiAiZWZmZWN0aXZlIEw0IiBo ZXJlLCB0byBtZWFuCiJndWVzdCBMNCBhZnRlciBhbnkgdHJhbnNmb3JtYXRpb25zIjogWFBUSSBj b3BpZXMgZWl0aGVyIHRoZSBhY3R1YWwKZ3Vlc3QgTDQgaWYgbm90IHNoYWRvd2VkLCBvciB0aGUg c2hhZG93IEw0ICh0cmFuc2Zvcm1lZCkgaWYgc2hhZG93ZWQuCgpTa2V0Y2g6IGd1ZXN0X2dldF9l ZmZfa2Vybl9sMWUoKSBoYXMgYSBwYWlyIG9mIHRvZ2dsZV9ndWVzdF9wdCgpIGNhbGxzCndoaWNo IGhhcHBlbiBpZiB0aGUgZ3Vlc3QgaXMgaW4gdXNlciBtb2RlLiAgRHVyaW5nIGxpdmUgbWlncmF0 aW9uLCBhCmxvZy1kaXJ0eSBjbGVhbiB3aWxsIGRvIGEgZG9tYWluX3BhdXNlIGFuZCB0aGVuIGNh bGwKc2hhZG93X2Jsb3dfdGFibGVzKCksIHVucGlubmluZyB0aGUgc2hhZG93IG9mIHRoZSBndWVz dCB1c2VyIHJvb3QKcGFnZXRhYmxlLiAgQWZ0ZXIgZXhlY3V0aW9uIHJlc3VtZXMsIHRoZSBmaXJz dCB0b2dnbGVfZ3Vlc3RfcHQoKSBjb3VsZAp0aGVuIGNhdXNlIHRoYXQgcGFnZSB0byBiZWNvbWUg dW5zaGFkb3dlZC4gIFRoZSBzZWNvbmQKdG9nZ2xlX2d1ZXN0X3B0KCkgd291bGQgdGhlbiByZS1z aGFkb3cgaXQsIHBvc3NpYmx5IHdpdGggYSBkaWZmZXJlbnQKYmFja2luZyBzaGFkb3cgcGFnZS4K ClRoaXMgaXMgWFNBLTUxNiAvIENWRS0yMDI2LTc5NjA5LgoKRml4ZXM6IDU3ODRkZTNlMjA2NyAo Ing4NjogTWVsdGRvd24gYmFuZC1haWQgYWdhaW5zdCBtYWxpY2lvdXMgNjQtYml0IFBWIGd1ZXN0 cyIpCkFzc2lzdGVkLWJ5OiBDbGF1ZGUgQ29kZTpjbGF1ZGUtZmFibGUtNS0xClNpZ25lZC1vZmYt Ynk6IEdlb3JnZSBEdW5sYXAgPGd3ZEB4ZW5wcm9qZWN0Lm9yZz4KUmV2aWV3ZWQtYnk6IEphbiBC ZXVsaWNoIDxqYmV1bGljaEBzdXNlLmNvbT4KLS0tCgpDaGFuZ2VzIGluIHY0OgotIFJld29yZGVk IHRoZSBwdl91bm1hcF9lZmZfcm9vdF9wdCgpIGNvbW1lbnQgYW5kIHRoZSBsaWZldGltZSBub3Rl CiAgYmVsb3cuICBUaGUgd2luZG93IGhhcyBleGFjdGx5IHYtPmFyY2guY3IzJ3MgdmFsaWRpdHk6 IGluIHNoYWRvdyBtb2RlCiAgYm90aCBuYW1lIHRoZSB0b3AtbGV2ZWwgc2hhZG93IGFmdGVyIHNo YWRvd190ZWFyZG93bigpIGhhcyByZWxlYXNlZAogIGl0LCB1bnRpbCB2Y3B1X2Rlc3Ryb3lfcGFn ZXRhYmxlcygpIGNsZWFycyB0aGVtLCBhbmQgbm90aGluZyB1c2VzCiAgZWl0aGVyIGJ5IHRoZW4u ICBUaGUgZWFybGllciB3b3JkaW5nIGNsYWltZWQgbW9yZS4KLSBUd2Vha2VkIGNvbW1pdCBtZXNz YWdlIHdvcmRpbmcgcmUgc2tldGNoIHRvIG1ha2UgaXQgY2xlYXIgaXQncyBub3QgYSByYWNlCi0g UmV3b3JrZWQgImxhc3QgcGFnZSBvZiBHRFQiIGNvbW1lbnQgdG8gYmUgbW9yZSB0ZWNobmljYWxs eSBhY2N1cmF0ZQoKKEEgcGF0Y2ggbWFya2VkIHYzIHdhcyBzZW50IGVycm9uZW91c2x5LikKCkNo YW5nZXMgaW4gdjIgKG9mIHNlY3VyaXR5QCBwb3N0aW5nKToKLSBNZXJnZWQgaXNfcHZfZG9tYWlu KCkgY29uZGl0aW9uIGluIG1ha2VfY3IzKCkKLSBVc2UgS0IoNjQpIGFzIHJlcXVlc3RlZCBkdXJp bmcgcmV2aWV3Ci0gQlVJTERfQlVHX09OKCkgbm93IGV4cHJlc3NlZCB3aXRoIExBU1RfUkVTRVJW RURfR0RUX0JZVEUgYXMKICByZXF1ZXN0ZWQgZHVyaW5nIHJldmlldwotIFN3aXRjaGVkIHRvICJQ Vl9FRkZfUk9PVF9QVCIgdG8gc3BlY2lmeSB0aGF0IHRoaXMgaXMgYWZ0ZXIgcG90ZW50aWFsCiAg c2hhZG93IHRyYW5zZm9ybWF0aW9ucwotIFRyaW1tZWQgZG93biB0aGUgY29tbWl0IG1lc3NhZ2Us IGNsYXJpZmllZCBtYWtlX2NyMygpIHJhdGlvbmFsZS4KClJlbGF0aXZlIHRvIHY1OgotIFRoZSB3 aW5kb3cgaXMgdGhlIHNwYXJlIEdEVCBwYWdlIGFmdGVyIFhlbidzIHJlc2VydmVkIHJhbmdlIHJh dGhlcgogIHRoYW4gYSBuZXcgc3ViLWFyZWE6IG5vIGFsbG9jYXRpb24gKHYyJ3MgYXJyYXkgZHJl dyBhIDMyeAogIG92ZXItYWxsb2NhdGlvbiByZW1hcmspIGFuZCBub3RoaW5nIHRvIGNyZWF0ZSBv ciB0ZWFyIGRvd24gcGVyIHZDUFUuCi0gVGhlIHJlZnJlc2ggaXMgaW4gbWFrZV9jcjMoKSwgd2hp Y2ggZXZlcnkgcm9vdCBjaGFuZ2UgcGFzc2VzIHRocm91Z2gsCiAgc2hhZG93IG1vZGUgaW5jbHVk ZWQsIGluc3RlYWQgb2Ygd3JpdGVfcHRiYXNlKCkgcGx1cyB0aGUgdG9nZ2xlLgotIFRoZSB3aW5k b3cgaXMgY2xlYXJlZCBpbiB2Y3B1X2Rlc3Ryb3lfcGFnZXRhYmxlcygpIGFsb25nc2lkZQogIHYt PmFyY2guY3IzLCBzbyBpdCBoYXMgZXhhY3RseSB2LT5hcmNoLmNyMydzIHZhbGlkaXR5LgotIFRo ZSBlbnRyeS5TIGNvbXB1dGF0aW9uIGtlZXBzIHRoZSB2MiBzaGFwZTsgdGhlIG1hcHBpbmcgc3Rh eXMKICByZWFkLW9ubHksIGFzIHN1Z2dlc3RlZCBvbiB2Mi4KLSBCdWlsZC10aW1lIGNoZWNrcyBw aW4gdGhlIHdpbmRvdyB0byB0aGUgcmVzZXJ2ZWQgcmFuZ2UuCkl0IGFwcGxpZXMgb24gaXRzIG93 biB0byBjdXJyZW50IHN0YWdpbmcsIHVzaW5nIHRoZSBwZXItdkNQVSBHRFQgTDEKdGFibGUgWGVu IGFscmVhZHkga2VlcHMuCi0tLQogeGVuL2FyY2gveDg2L2luY2x1ZGUvYXNtL2NvbmZpZy5oIHwg MjMgKysrKysrKysrKysrKystLQogeGVuL2FyY2gveDg2L2luY2x1ZGUvYXNtL2Rlc2MuaCAgIHwg MTAgKysrKysrKwogeGVuL2FyY2gveDg2L21tLmMgICAgICAgICAgICAgICAgIHwgNDUgKysrKysr KysrKysrKysrKysrKysrKysrKysrKystLQogeGVuL2FyY2gveDg2L3g4Nl82NC9hc20tb2Zmc2V0 cy5jIHwgIDEgKwogeGVuL2FyY2gveDg2L3g4Nl82NC9lbnRyeS5TICAgICAgIHwgIDcgKysrKy0K IDUgZmlsZXMgY2hhbmdlZCwgODEgaW5zZXJ0aW9ucygrKSwgNSBkZWxldGlvbnMoLSkKCmRpZmYg LS1naXQgYS94ZW4vYXJjaC94ODYvaW5jbHVkZS9hc20vY29uZmlnLmggYi94ZW4vYXJjaC94ODYv aW5jbHVkZS9hc20vY29uZmlnLmgKaW5kZXggMWIyODM0OWE0Mi4uMGMwMDRlZGM2NiAxMDA2NDQK LS0tIGEveGVuL2FyY2gveDg2L2luY2x1ZGUvYXNtL2NvbmZpZy5oCisrKyBiL3hlbi9hcmNoL3g4 Ni9pbmNsdWRlL2FzbS9jb25maWcuaApAQCAtMjQ5LDExICsyNDksMzAgQEAgZXh0ZXJuIHVuc2ln bmVkIGxvbmcgeGVuX3BoeXNfc3RhcnQ7CiAjZGVmaW5lIEdEVF9MRFRfVklSVF9TVEFSVCAgICAg ICBQRVJET01BSU5fVklSVF9TTE9UKDApCiAjZGVmaW5lIEdEVF9MRFRfVklSVF9FTkQgICAgICAg ICAoR0RUX0xEVF9WSVJUX1NUQVJUICsgKEdEVF9MRFRfTUJZVEVTIDw8IDIwKSkKIAotLyogVGhl IGFkZHJlc3Mgb2YgYSBwYXJ0aWN1bGFyIFZDUFUncyBHRFQgb3IgTERULiAqLworLyoKKyAqIFRo ZSBhZGRyZXNzIG9mIGEgcGFydGljdWxhciBWQ1BVJ3MgR0RUIG9yIExEVDsgZWFjaCBpcyB0aGUg YXJjaGl0ZWN0dXJhbAorICogbWF4aW11bSBvZiA2NGsuCisgKi8KKyNkZWZpbmUgR0RUX1ZJUlRf U0laRSAgICAgICAgS0IoNjQpCiAjZGVmaW5lIEdEVF9WSVJUX1NUQVJUKHYpICAgIFwKICAgICAo UEVSRE9NQUlOX1ZJUlRfU1RBUlQgKyAoKHYpLT52Y3B1X2lkIDw8IEdEVF9MRFRfVkNQVV9WQV9T SElGVCkpCiAjZGVmaW5lIExEVF9WSVJUX1NUQVJUKHYpICAgIFwKLSAgICAoR0RUX1ZJUlRfU1RB UlQodikgKyAoNjQqMTAyNCkpCisgICAgKEdEVF9WSVJUX1NUQVJUKHYpICsgR0RUX1ZJUlRfU0la RSkKKworLyoKKyAqIFRoZSB2Q1BVJ3MgZWZmZWN0aXZlIHJvb3QgcGFnZSB0YWJsZSwgbWFwcGVk IHJlYWQtb25seSBpbiB0aGUgbGFzdAorICogcGFnZSBvZiBpdHMgR0RUOiB0aGUgcGFnZSBhZnRl ciBYZW4ncyByZXNlcnZlZCByYW5nZSwgYmV5b25kIHRoZQorICogR0RUIGxpbWl0IFhlbiBsb2Fk cyAoTEFTVF9SRVNFUlZFRF9HRFRfQllURSksIHNvIG5vIHNlbGVjdG9yIGNhbgorICogcmVhY2gg aXQuICAiRWZmZWN0aXZlIiBpcyB0aGUgcm9vdCBwYWdlIHRhYmxlIHRoZSB2Q1BVIGlzIG1lYW50 IHRvCisgKiBydW4gb24gYWZ0ZXIgYW55IHRyYW5zZm9ybWF0aW9uOiB0aGUgZ3Vlc3QncyBvd24s IG9yIGl0cyBzaGFkb3cKKyAqIHVuZGVyIHNoYWRvdyBwYWdpbmcuICBYUFRJIGRvZXMgbm90IHRy YW5zZm9ybSBpdCBmdXJ0aGVyIGJ1dCBjb3BpZXMKKyAqIGZyb20gaXQ6IHRoZSBleGl0IHBhdGgg cmVhZHMgdGhlIGd1ZXN0LXZpc2libGUgTDQgc2xvdHMgZnJvbSBoZXJlLgorICogQWRkaW5nIGEg cmVzZXJ2ZWQgR0RUIHBhZ2Ugd291bGQgbWVhbiBtb3ZpbmcgdGhlIHdpbmRvdyBvdXQgb2YgdGhl CisgKiBHRFQgZmlyc3Q7IHB2X21hcF9lZmZfcm9vdF9wdCgpIGNoZWNrcyB0aGUgbGF5b3V0IGF0 IGJ1aWxkIHRpbWUuCisgKi8KKyNkZWZpbmUgUFZfRUZGX1JPT1RfUFRfUEFHRSAgICAoRklSU1Rf UkVTRVJWRURfR0RUX1BBR0UgKyAxKQorI2RlZmluZSBQVl9FRkZfUk9PVF9QVF9PRkZTRVQgIChQ Vl9FRkZfUk9PVF9QVF9QQUdFIDw8IFBBR0VfU0hJRlQpCisjZGVmaW5lIFBWX0VGRl9ST09UX1BU KHYpICAgICAgKEdEVF9WSVJUX1NUQVJUKHYpICsgUFZfRUZGX1JPT1RfUFRfT0ZGU0VUKQogCiAv KiBtYXBfZG9tYWluX3BhZ2UoKSBtYXAgY2FjaGUuIFRoZSBzZWNvbmQgcGVyLWRvbWFpbi1tYXBw aW5nIHN1Yi1hcmVhLiAqLwogI2RlZmluZSBNQVBDQUNIRV9WQ1BVX0VOVFJJRVMgICAgKENPTkZJ R19QQUdJTkdfTEVWRUxTICogQ09ORklHX1BBR0lOR19MRVZFTFMpCmRpZmYgLS1naXQgYS94ZW4v YXJjaC94ODYvaW5jbHVkZS9hc20vZGVzYy5oIGIveGVuL2FyY2gveDg2L2luY2x1ZGUvYXNtL2Rl c2MuaAppbmRleCBkY2JkYWMzZmY3Li43Y2JiOWE3MzM2IDEwMDY0NAotLS0gYS94ZW4vYXJjaC94 ODYvaW5jbHVkZS9hc20vZGVzYy5oCisrKyBiL3hlbi9hcmNoL3g4Ni9pbmNsdWRlL2FzbS9kZXNj LmgKQEAgLTYsNiArNiwxNiBAQAogLyoKICAqIFhlbiByZXNlcnZlcyBhIG1lbW9yeSBwYWdlIG9m IEdEVCBlbnRyaWVzLgogICogTm8gZ3Vlc3QgR0RUIGVudHJpZXMgZXhpc3QgYmV5b25kIHRoZSBY ZW4gcmVzZXJ2ZWQgYXJlYS4KKyAqCisgKiBUaGUgcGFnZSBhZnRlciB0aGUgcmVzZXJ2ZWQgYXJl YSwgdGhlIGxhc3Qgb2YgdGhlIEdEVCdzIDY0aywgaXMgdGhlCisgKiBQViBlZmZlY3RpdmUgcm9v dC10YWJsZSB3aW5kb3cgKFBWX0VGRl9ST09UX1BUX1BBR0UsIGNvbmZpZy5oKToKKyAqIGJleW9u ZCB0aGUgR0RUIGxpbWl0IFhlbiBsb2FkcyAoTEFTVF9SRVNFUlZFRF9HRFRfQllURSksIHNvIG5v CisgKiBzZWxlY3RvciByZWFjaGVzIGl0LiAgWGVuIHVzZXMgb25seSBhIGZldyBvZiB0aGUgcmVz ZXJ2ZWQgcGFnZSdzCisgKiA1MTIgc2xvdHMsIHNvIG1vcmUgWGVuIGRlc2NyaXB0b3JzIG5ldmVy IG5lZWQgYW5vdGhlciBwYWdlOyBpZiBvbmUKKyAqIHdlcmUgbmVlZGVkIHJlZ2FyZGxlc3MsIHRo ZSB3aW5kb3cgd291bGQgaGF2ZSB0byBtb3ZlIG91dCBvZiB0aGUKKyAqIEdEVCBmaXJzdCAoaW50 byBhIHBlci1kb21haW4gc3ViLWFyZWEgb2YgaXRzIG93biksIGFzIHRoaXMgaXMgdGhlCisgKiBH RFQncyBsYXN0IHBhZ2UuICBwdl9tYXBfZWZmX3Jvb3RfcHQoKSBjaGVja3MgdGhlIGxheW91dCBh dCBidWlsZAorICogdGltZS4KICAqLwogI2RlZmluZSBOUl9SRVNFUlZFRF9HRFRfUEFHRVMgICAx CiAjZGVmaW5lIE5SX1JFU0VSVkVEX0dEVF9CWVRFUyAgIChOUl9SRVNFUlZFRF9HRFRfUEFHRVMg KiBQQUdFX1NJWkUpCmRpZmYgLS1naXQgYS94ZW4vYXJjaC94ODYvbW0uYyBiL3hlbi9hcmNoL3g4 Ni9tbS5jCmluZGV4IGIxNTg3NDI0MDguLmY0Yjg3ZWQ1ZWMgMTAwNjQ0Ci0tLSBhL3hlbi9hcmNo L3g4Ni9tbS5jCisrKyBiL3hlbi9hcmNoL3g4Ni9tbS5jCkBAIC01MTAsMTMgKzUxMCw1MiBAQCB2 b2lkIHNoYXJlX3hlbl9wYWdlX3dpdGhfZ3Vlc3Qoc3RydWN0IHBhZ2VfaW5mbyAqcGFnZSwgc3Ry dWN0IGRvbWFpbiAqZCwKICAgICBucnNwaW5fdW5sb2NrKCZkLT5wYWdlX2FsbG9jX2xvY2spOwog fQogCisvKgorICogTWFwIEBtZm4gcmVhZC1vbmx5IGF0IHYncyBQVl9FRkZfUk9PVF9QVCgpIHdp bmRvdy4gIFRoZSB3aW5kb3cgbGl2ZXMgaW4KKyAqIHYncyBwZXItZG9tYWluIGFyZWEsIHNvIHYg bmVlZCBub3QgYmUgY3VycmVudDsgdGhlIGxvY2FsIGZsdXNoIGlzIGZvcgorICogd2hlbiBpdCBp cywgd2l0aCBpdHMgb3duIHBhZ2UgdGFibGVzIGxvYWRlZC4KKyAqLworc3RhdGljIHZvaWQgcHZf bWFwX2VmZl9yb290X3B0KGNvbnN0IHN0cnVjdCB2Y3B1ICp2LCBtZm5fdCBtZm4pCit7CisgICAg LyoKKyAgICAgKiBUaGUgd2luZG93IG11c3QgbGllIGJleW9uZCB0aGUgR0RUIGxpbWl0IFhlbiBs b2Fkcywgc28gdGhhdCBubworICAgICAqIHNlbGVjdG9yIHJlYWNoZXMgaXQsIGFuZCB3aXRoaW4g dGhlIEdEVCdzIDY0ay4KKyAgICAgKi8KKyAgICBCVUlMRF9CVUdfT04oUFZfRUZGX1JPT1RfUFRf T0ZGU0VUIDw9IExBU1RfUkVTRVJWRURfR0RUX0JZVEUpOworICAgIEJVSUxEX0JVR19PTihQVl9F RkZfUk9PVF9QVF9PRkZTRVQgKyBQQUdFX1NJWkUgPiBHRFRfVklSVF9TSVpFKTsKKworICAgIGwx ZV93cml0ZShwdl9nZHRfcHRlcyh2KSArIFBWX0VGRl9ST09UX1BUX1BBR0UsCisgICAgICAgICAg ICAgIGwxZV9mcm9tX21mbihtZm4sIF9fUEFHRV9IWVBFUlZJU09SX1JPKSk7CisgICAgZmx1c2hf dGxiX29uZV9sb2NhbChQVl9FRkZfUk9PVF9QVCh2KSk7Cit9CisKKy8qCisgKiBDbGVhciB0aGUg d2luZG93LiAgSXRzIGxpZmV0aW1lIGlzIHYtPmFyY2guY3IzJ3M6IG1ha2VfY3IzKCkgd3JpdGVz IGl0CisgKiB3aGVyZXZlciB2LT5hcmNoLmNyMyBpcyBzZXQsIGFuZCB2Y3B1X2Rlc3Ryb3lfcGFn ZXRhYmxlcygpIGNsZWFycyBpdCB3aGVyZQorICogdi0+YXJjaC5jcjMgaXMgemVyb2VkLiAgSW4g c2hhZG93IG1vZGUgYm90aCBuYW1lIGEgdG9wLWxldmVsIHNoYWRvdywgd2hpY2gKKyAqIHNoYWRv d190ZWFyZG93bigpIHJlbGVhc2VzIGJlZm9yZSB0aGF0IHBvaW50OyBub3RoaW5nIHVzZXMgZWl0 aGVyIG9uY2UgdGhlCisgKiB2Q1BVIGNhbiBubyBsb25nZXIgcnVuLgorICovCitzdGF0aWMgdm9p ZCBwdl91bm1hcF9lZmZfcm9vdF9wdChjb25zdCBzdHJ1Y3QgdmNwdSAqdikKK3sKKyAgICBsMWVf d3JpdGUocHZfZ2R0X3B0ZXModikgKyBQVl9FRkZfUk9PVF9QVF9QQUdFLCBsMWVfZW1wdHkoKSk7 CisgICAgZmx1c2hfdGxiX29uZV9sb2NhbChQVl9FRkZfUk9PVF9QVCh2KSk7Cit9CisKIHZvaWQg bWFrZV9jcjMoc3RydWN0IHZjcHUgKnYsIG1mbl90IG1mbikKIHsKICAgICBzdHJ1Y3QgZG9tYWlu ICpkID0gdi0+ZG9tYWluOwogCiAgICAgdi0+YXJjaC5jcjMgPSBtZm5feChtZm4pIDw8IFBBR0Vf U0hJRlQ7Ci0gICAgaWYgKCBpc19wdl9kb21haW4oZCkgJiYgZC0+YXJjaC5wdi5wY2lkICkKLSAg ICAgICAgdi0+YXJjaC5jcjMgfD0gZ2V0X3BjaWRfYml0cyh2LCBmYWxzZSk7CisKKyAgICBpZiAo IGlzX3B2X2RvbWFpbihkKSApCisgICAgeworICAgICAgICBpZiAoIGQtPmFyY2gucHYucGNpZCAp CisgICAgICAgICAgICB2LT5hcmNoLmNyMyB8PSBnZXRfcGNpZF9iaXRzKHYsIGZhbHNlKTsKKwor ICAgICAgICBpZiAoIGQtPmFyY2gucHYueHB0aSApCisgICAgICAgICAgICBwdl9tYXBfZWZmX3Jv b3RfcHQodiwgbWZuKTsKKyAgICB9CiB9CiAKIHZvaWQgd3JpdGVfcHRiYXNlKHN0cnVjdCB2Y3B1 ICp2KQpAQCAtMzIyNCw2ICszMjYzLDggQEAgaW50IHZjcHVfZGVzdHJveV9wYWdldGFibGVzKHN0 cnVjdCB2Y3B1ICp2KQogICAgICAgICByZXR1cm4gcmM7CiAKICAgICB2LT5hcmNoLmNyMyA9IDA7 CisgICAgaWYgKCBpc19wdl9kb21haW4odi0+ZG9tYWluKSAmJiB2LT5kb21haW4tPmFyY2gucHYu eHB0aSApCisgICAgICAgIHB2X3VubWFwX2VmZl9yb290X3B0KHYpOwogCiAgICAgLyoKICAgICAg KiBHZXQgdGhlIHRvcC1sZXZlbCBndWVzdCBwYWdlOyBlaXRoZXIgdGhlIGd1ZXN0X3RhYmxlIGl0 c2VsZiwgZm9yCmRpZmYgLS1naXQgYS94ZW4vYXJjaC94ODYveDg2XzY0L2FzbS1vZmZzZXRzLmMg Yi94ZW4vYXJjaC94ODYveDg2XzY0L2FzbS1vZmZzZXRzLmMKaW5kZXggYmFmMjY2YWI4MC4uMDU0 OWZkNWU4ZCAxMDA2NDQKLS0tIGEveGVuL2FyY2gveDg2L3g4Nl82NC9hc20tb2Zmc2V0cy5jCisr KyBiL3hlbi9hcmNoL3g4Ni94ODZfNjQvYXNtLW9mZnNldHMuYwpAQCAtODIsNiArODIsNyBAQCB2 b2lkIF9fZHVtbXlfXyh2b2lkKQogCiAjdW5kZWYgT0ZGU0VUX0VGCiAKKyAgICBPRkZTRVQoVkNQ VV9pZCwgc3RydWN0IHZjcHUsIHZjcHVfaWQpOwogICAgIE9GRlNFVChWQ1BVX3Byb2Nlc3Nvciwg c3RydWN0IHZjcHUsIHByb2Nlc3Nvcik7CiAgICAgT0ZGU0VUKFZDUFVfZG9tYWluLCBzdHJ1Y3Qg dmNwdSwgZG9tYWluKTsKICAgICBPRkZTRVQoVkNQVV92Y3B1X2luZm8sIHN0cnVjdCB2Y3B1LCB2 Y3B1X2luZm9fYXJlYS5tYXApOwpkaWZmIC0tZ2l0IGEveGVuL2FyY2gveDg2L3g4Nl82NC9lbnRy eS5TIGIveGVuL2FyY2gveDg2L3g4Nl82NC9lbnRyeS5TCmluZGV4IDU5OTUzYzlmNTIuLmJhMTc1 YmRlN2MgMTAwNjQ0Ci0tLSBhL3hlbi9hcmNoL3g4Ni94ODZfNjQvZW50cnkuUworKysgYi94ZW4v YXJjaC94ODYveDg2XzY0L2VudHJ5LlMKQEAgLTIwMCw5ICsyMDAsMTQgQEAgRlVOQ19MT0NBTChy ZXN0b3JlX2FsbF9ndWVzdCkKICAgICAgICAgbW92YWJzICRQQUREUl9NQVNLICYgUEFHRV9NQVNL LCAlcnNpCiAgICAgICAgIG1vdmFicyAkRElSRUNUTUFQX1ZJUlRfU1RBUlQsICVyY3gKICAgICAg ICAgYW5kICAgJXJzaSwgJXJkaQotICAgICAgICBhbmQgICAlcjksICVyc2kKICAgICAgICAgYWRk ICAgJXJjeCwgJXJkaQorCisgICAgICAgIC8qIEVmZmVjdGl2ZSByb290IHBhZ2UgdGFibGUgaXMg bWFwcGVkIGF0IFBWX0VGRl9ST09UX1BUKHYpICovCisgICAgICAgIG1vdiAgIFZDUFVfaWQoJXJi eCksICVlc2kKKyAgICAgICAgc2hsICAgJEdEVF9MRFRfVkNQVV9WQV9TSElGVCwgJXJzaQorICAg ICAgICBtb3ZhYnMgJEdEVF9MRFRfVklSVF9TVEFSVCArIFBWX0VGRl9ST09UX1BUX09GRlNFVCwg JXJjeAogICAgICAgICBhZGQgICAlcmN4LCAlcnNpCisKICAgICAgICAgbW92ICAgJFJPT1RfUEFH RVRBQkxFX0ZJUlNUX1hFTl9TTE9ULCAlZWN4CiAgICAgICAgIG1vdiAgIHJvb3RfdGFibGVfb2Zm c2V0KFNIX0xJTkVBUl9QVF9WSVJUX1NUQVJUKSo4KCVyc2kpLCAlcjgKICAgICAgICAgbW92ICAg JXI4LCByb290X3RhYmxlX29mZnNldChTSF9MSU5FQVJfUFRfVklSVF9TVEFSVCkqOCglcmRpKQo= --=separator Content-Type: application/octet-stream; name="xsa516-4.17.patch" Content-Disposition: attachment; filename="xsa516-4.17.patch" Content-Transfer-Encoding: base64 RnJvbTogR2VvcmdlIER1bmxhcCA8Z3dkQHhlbnByb2plY3Qub3JnPgpTdWJqZWN0OiB4ODYvcHY6 IG1hcCBlYWNoIHZDUFUncyByb290IHBhZ2UgdGFibGUgaW4gaXRzIHBlci1kb21haW4gYXJlYQoK Rm9yIFhQVEkgZW5hYmxlZCBWTXMsIHJlc3RvcmVfYWxsX2d1ZXN0KCkgY29waWVzIG1vc3Qgb2Yg dGhlIGFjdGl2ZSBMNApwYWdldGFibGUgaW50byB0aGUgcGVyLUNQVSByb290X3BndC4gIFRoZSBM NCBpcyByZWFkIHZpYSB0aGUKZGlyZWN0bWFwLgoKVW5mb3J0dW5hdGVseSwgdGhlcmUgd2FzIG5v IGFjY291bnRpbmcgZm9yIHRoZSBmYWN0IHRoYXQgUFYgZ3Vlc3RzCmhhdmUgc2hvcnQgZGlyZWN0 bWFwcy4gIEZvciBhbiBMNCBsaXZpbmcgYmV5b25kIHRoZSA1VCBib3VuZGFyeSAoMy41VApmb3Ig Q09ORklHX0JJR01FTSksIFhlbiB3aWxsIGNvcHkgYXJiaXRyYXJ5IGRhdGEgZnJvbSBndWVzdC1j b250cm9sbGVkCnZpcnR1YWwgYWRkcmVzcyBzcGFjZSBpbnRvIHRoZSBwZXItQ1BVIHJvb3RfcGd0 LCBpbnN0ZWFkIG9mIHRoZQppbnRlbmRlZCBMNC4KClhlbiBoYXMgcGVyLWRvbWFpbiBtYXBwaW5n cyBmb3IgdGhlIExEVCBhbmQgR0RULCB3aXRoIHR3byBwYWdlcwpyZXNlcnZlZCBmb3IgWGVuJ3Mg dXNlIGluIHRoZSBHRFQgYnV0IG9ubHkgb25lIGluIHVzZS4gIFJldXNlIEdEVCBwYWdlCjE1IHRv IG1hcCB0aGUgZWZmZWN0aXZlIEw0LiAgVGhlIEdEVCBsaW1pdCBrZWVwcyBpbXBsaWNpdCBhY2Nl c3NlcyBvdXQKb2YgdGhpcyBwYWdlLgoKV2UgdXBkYXRlIHRoaXMgbWFwcGluZyBpbiBtYWtlX2Ny MygpLCB0aGUgb25seSBwbGFjZSBhIG5vbi1lbXB0eSB2YWx1ZQpvZiB2LT5hcmNoLmNyMyBpcyB3 cml0dGVuIGludG8gYSBndWVzdCdzIHZjcHUgc3RydWN0LCBmb3IgdHdvIHJlYXNvbnMuCkZpcnN0 IGlzIHJlZmVyZW5jZSBjb3VudGluZzogdGhpcyBtYWtlcyBpdCBlYXNpZXIgdG8gYXJndWUgdGhh dCB0aGUKcmVmZXJlbmNlIGZvciB2LT5hcmNoLmNyMyBpdHNlbGYgY292ZXJzIHRoZSByZWZlcmVu Y2UgZm9yIHRoZSBtYXBwaW5nLgoKU2Vjb25kbHksIHRoaXMgZ3VhcmFudGVlcyB0aGF0IGFsbCB1 cGRhdGVzLCBldmVuIHVwZGF0ZXMgbWFkZSBpbgpzaGFkb3cgbW9kZSwgcmVzdWx0IGluIGFuIHVw ZGF0ZSB0byB0aGUgbWFwcGluZy4gIER1cmluZyBsaXZlCm1pZ3JhdGlvbiwgaXQncyBwb3NzaWJs ZSBmb3IgZ3Vlc3RfZ2V0X2VmZl9rZXJuX2wxZSgpIHRvIHJlc3VsdCBpbiBhCm1vZGlmaWVkIHZh bHVlIG9mIHYtPmFyY2guY3IzIChza2V0Y2ggYmVsb3cpOyBwbGFjaW5nIHRoZSBtYXBwaW5nCnVw ZGF0ZSBhdCBtYWtlX2NyMygpIGNhdGNoZXMgdGhpcywgd2hpbGUgb3RoZXIgY2FuZGlkYXRlIGxv Y2F0aW9ucwpsaWtlIHdyaXRlX3B0YmFzZSgpIGFuZCB0b2dnbGVfZ3Vlc3RfbW9kZSgpIGRvbid0 LgoKTm90ZSB0aGF0IHdlIGludHJvZHVjZSB0aGUgaWRlYSBvZiBhbiAiZWZmZWN0aXZlIEw0IiBo ZXJlLCB0byBtZWFuCiJndWVzdCBMNCBhZnRlciBhbnkgdHJhbnNmb3JtYXRpb25zIjogWFBUSSBj b3BpZXMgZWl0aGVyIHRoZSBhY3R1YWwKZ3Vlc3QgTDQgaWYgbm90IHNoYWRvd2VkLCBvciB0aGUg c2hhZG93IEw0ICh0cmFuc2Zvcm1lZCkgaWYgc2hhZG93ZWQuCgpTa2V0Y2g6IGd1ZXN0X2dldF9l ZmZfa2Vybl9sMWUoKSBoYXMgYSBwYWlyIG9mIHRvZ2dsZV9ndWVzdF9wdCgpIGNhbGxzCndoaWNo IGhhcHBlbiBpZiB0aGUgZ3Vlc3QgaXMgaW4gdXNlciBtb2RlLiAgRHVyaW5nIGxpdmUgbWlncmF0 aW9uLCBhCmxvZy1kaXJ0eSBjbGVhbiB3aWxsIGRvIGEgZG9tYWluX3BhdXNlIGFuZCB0aGVuIGNh bGwKc2hhZG93X2Jsb3dfdGFibGVzKCksIHVucGlubmluZyB0aGUgc2hhZG93IG9mIHRoZSBndWVz dCB1c2VyIHJvb3QKcGFnZXRhYmxlLiAgQWZ0ZXIgZXhlY3V0aW9uIHJlc3VtZXMsIHRoZSBmaXJz dCB0b2dnbGVfZ3Vlc3RfcHQoKSBjb3VsZAp0aGVuIGNhdXNlIHRoYXQgcGFnZSB0byBiZWNvbWUg dW5zaGFkb3dlZC4gIFRoZSBzZWNvbmQKdG9nZ2xlX2d1ZXN0X3B0KCkgd291bGQgdGhlbiByZS1z aGFkb3cgaXQsIHBvc3NpYmx5IHdpdGggYSBkaWZmZXJlbnQKYmFja2luZyBzaGFkb3cgcGFnZS4K ClRoaXMgaXMgWFNBLTUxNiAvIENWRS0yMDI2LTc5NjA5LgoKRml4ZXM6IDU3ODRkZTNlMjA2NyAo Ing4NjogTWVsdGRvd24gYmFuZC1haWQgYWdhaW5zdCBtYWxpY2lvdXMgNjQtYml0IFBWIGd1ZXN0 cyIpCkFzc2lzdGVkLWJ5OiBDbGF1ZGUgQ29kZTpjbGF1ZGUtZmFibGUtNS0xClNpZ25lZC1vZmYt Ynk6IEdlb3JnZSBEdW5sYXAgPGd3ZEB4ZW5wcm9qZWN0Lm9yZz4KUmV2aWV3ZWQtYnk6IEphbiBC ZXVsaWNoIDxqYmV1bGljaEBzdXNlLmNvbT4KCi0tLSBhL3hlbi9hcmNoL3g4Ni9pbmNsdWRlL2Fz bS9jb25maWcuaAorKysgYi94ZW4vYXJjaC94ODYvaW5jbHVkZS9hc20vY29uZmlnLmgKQEAgLTI5 NiwxMSArMjk2LDMwIEBAIGV4dGVybiB1bnNpZ25lZCBsb25nIHhlbl9waHlzX3N0YXJ0OwogI2Rl ZmluZSBHRFRfTERUX1ZJUlRfU1RBUlQgICAgICAgUEVSRE9NQUlOX1ZJUlRfU0xPVCgwKQogI2Rl ZmluZSBHRFRfTERUX1ZJUlRfRU5EICAgICAgICAgKEdEVF9MRFRfVklSVF9TVEFSVCArIChHRFRf TERUX01CWVRFUyA8PCAyMCkpCiAKLS8qIFRoZSBhZGRyZXNzIG9mIGEgcGFydGljdWxhciBWQ1BV J3MgR0RUIG9yIExEVC4gKi8KKy8qCisgKiBUaGUgYWRkcmVzcyBvZiBhIHBhcnRpY3VsYXIgVkNQ VSdzIEdEVCBvciBMRFQ7IGVhY2ggaXMgdGhlIGFyY2hpdGVjdHVyYWwKKyAqIG1heGltdW0gb2Yg NjRrLgorICovCisjZGVmaW5lIEdEVF9WSVJUX1NJWkUgICAgICAgIEtCKDY0KQogI2RlZmluZSBH RFRfVklSVF9TVEFSVCh2KSAgICBcCiAgICAgKFBFUkRPTUFJTl9WSVJUX1NUQVJUICsgKCh2KS0+ dmNwdV9pZCA8PCBHRFRfTERUX1ZDUFVfVkFfU0hJRlQpKQogI2RlZmluZSBMRFRfVklSVF9TVEFS VCh2KSAgICBcCi0gICAgKEdEVF9WSVJUX1NUQVJUKHYpICsgKDY0KjEwMjQpKQorICAgIChHRFRf VklSVF9TVEFSVCh2KSArIEdEVF9WSVJUX1NJWkUpCisKKy8qCisgKiBUaGUgdkNQVSdzIGVmZmVj dGl2ZSByb290IHBhZ2UgdGFibGUsIG1hcHBlZCByZWFkLW9ubHkgaW4gdGhlIGxhc3QKKyAqIHBh Z2Ugb2YgaXRzIEdEVDogdGhlIHBhZ2UgYWZ0ZXIgWGVuJ3MgcmVzZXJ2ZWQgcmFuZ2UsIGJleW9u ZCB0aGUKKyAqIEdEVCBsaW1pdCBYZW4gbG9hZHMgKExBU1RfUkVTRVJWRURfR0RUX0JZVEUpLCBz byBubyBzZWxlY3RvciBjYW4KKyAqIHJlYWNoIGl0LiAgIkVmZmVjdGl2ZSIgaXMgdGhlIHJvb3Qg cGFnZSB0YWJsZSB0aGUgdkNQVSBpcyBtZWFudCB0bworICogcnVuIG9uIGFmdGVyIGFueSB0cmFu c2Zvcm1hdGlvbjogdGhlIGd1ZXN0J3Mgb3duLCBvciBpdHMgc2hhZG93CisgKiB1bmRlciBzaGFk b3cgcGFnaW5nLiAgWFBUSSBkb2VzIG5vdCB0cmFuc2Zvcm0gaXQgZnVydGhlciBidXQgY29waWVz CisgKiBmcm9tIGl0OiB0aGUgZXhpdCBwYXRoIHJlYWRzIHRoZSBndWVzdC12aXNpYmxlIEw0IHNs b3RzIGZyb20gaGVyZS4KKyAqIEFkZGluZyBhIHJlc2VydmVkIEdEVCBwYWdlIHdvdWxkIG1lYW4g bW92aW5nIHRoZSB3aW5kb3cgb3V0IG9mIHRoZQorICogR0RUIGZpcnN0OyBwdl9tYXBfZWZmX3Jv b3RfcHQoKSBjaGVja3MgdGhlIGxheW91dCBhdCBidWlsZCB0aW1lLgorICovCisjZGVmaW5lIFBW X0VGRl9ST09UX1BUX1BBR0UgICAgKEZJUlNUX1JFU0VSVkVEX0dEVF9QQUdFICsgMSkKKyNkZWZp bmUgUFZfRUZGX1JPT1RfUFRfT0ZGU0VUICAoUFZfRUZGX1JPT1RfUFRfUEFHRSA8PCBQQUdFX1NI SUZUKQorI2RlZmluZSBQVl9FRkZfUk9PVF9QVCh2KSAgICAgIChHRFRfVklSVF9TVEFSVCh2KSAr IFBWX0VGRl9ST09UX1BUX09GRlNFVCkKIAogLyogbWFwX2RvbWFpbl9wYWdlKCkgbWFwIGNhY2hl LiBUaGUgc2Vjb25kIHBlci1kb21haW4tbWFwcGluZyBzdWItYXJlYS4gKi8KICNkZWZpbmUgTUFQ Q0FDSEVfVkNQVV9FTlRSSUVTICAgIChDT05GSUdfUEFHSU5HX0xFVkVMUyAqIENPTkZJR19QQUdJ TkdfTEVWRUxTKQotLS0gYS94ZW4vYXJjaC94ODYvaW5jbHVkZS9hc20vZGVzYy5oCisrKyBiL3hl bi9hcmNoL3g4Ni9pbmNsdWRlL2FzbS9kZXNjLmgKQEAgLTYsNiArNiwxNiBAQAogLyoKICAqIFhl biByZXNlcnZlcyBhIG1lbW9yeSBwYWdlIG9mIEdEVCBlbnRyaWVzLgogICogTm8gZ3Vlc3QgR0RU IGVudHJpZXMgZXhpc3QgYmV5b25kIHRoZSBYZW4gcmVzZXJ2ZWQgYXJlYS4KKyAqCisgKiBUaGUg cGFnZSBhZnRlciB0aGUgcmVzZXJ2ZWQgYXJlYSwgdGhlIGxhc3Qgb2YgdGhlIEdEVCdzIDY0aywg aXMgdGhlCisgKiBQViBlZmZlY3RpdmUgcm9vdC10YWJsZSB3aW5kb3cgKFBWX0VGRl9ST09UX1BU X1BBR0UsIGNvbmZpZy5oKToKKyAqIGJleW9uZCB0aGUgR0RUIGxpbWl0IFhlbiBsb2FkcyAoTEFT VF9SRVNFUlZFRF9HRFRfQllURSksIHNvIG5vCisgKiBzZWxlY3RvciByZWFjaGVzIGl0LiAgWGVu IHVzZXMgb25seSBhIGZldyBvZiB0aGUgcmVzZXJ2ZWQgcGFnZSdzCisgKiA1MTIgc2xvdHMsIHNv IG1vcmUgWGVuIGRlc2NyaXB0b3JzIG5ldmVyIG5lZWQgYW5vdGhlciBwYWdlOyBpZiBvbmUKKyAq IHdlcmUgbmVlZGVkIHJlZ2FyZGxlc3MsIHRoZSB3aW5kb3cgd291bGQgaGF2ZSB0byBtb3ZlIG91 dCBvZiB0aGUKKyAqIEdEVCBmaXJzdCAoaW50byBhIHBlci1kb21haW4gc3ViLWFyZWEgb2YgaXRz IG93biksIGFzIHRoaXMgaXMgdGhlCisgKiBHRFQncyBsYXN0IHBhZ2UuICBwdl9tYXBfZWZmX3Jv b3RfcHQoKSBjaGVja3MgdGhlIGxheW91dCBhdCBidWlsZAorICogdGltZS4KICAqLwogI2RlZmlu ZSBOUl9SRVNFUlZFRF9HRFRfUEFHRVMgICAxCiAjZGVmaW5lIE5SX1JFU0VSVkVEX0dEVF9CWVRF UyAgIChOUl9SRVNFUlZFRF9HRFRfUEFHRVMgKiBQQUdFX1NJWkUpCi0tLSBhL3hlbi9hcmNoL3g4 Ni9tbS5jCisrKyBiL3hlbi9hcmNoL3g4Ni9tbS5jCkBAIC01MjMsMTMgKzUyMyw1MiBAQCB2b2lk IHNoYXJlX3hlbl9wYWdlX3dpdGhfZ3Vlc3Qoc3RydWN0IHBhCiAgICAgc3Bpbl91bmxvY2soJmQt PnBhZ2VfYWxsb2NfbG9jayk7CiB9CiAKKy8qCisgKiBNYXAgQG1mbiByZWFkLW9ubHkgYXQgdidz IFBWX0VGRl9ST09UX1BUKCkgd2luZG93LiAgVGhlIHdpbmRvdyBsaXZlcyBpbgorICogdidzIHBl ci1kb21haW4gYXJlYSwgc28gdiBuZWVkIG5vdCBiZSBjdXJyZW50OyB0aGUgbG9jYWwgZmx1c2gg aXMgZm9yCisgKiB3aGVuIGl0IGlzLCB3aXRoIGl0cyBvd24gcGFnZSB0YWJsZXMgbG9hZGVkLgor ICovCitzdGF0aWMgdm9pZCBwdl9tYXBfZWZmX3Jvb3RfcHQoY29uc3Qgc3RydWN0IHZjcHUgKnYs IG1mbl90IG1mbikKK3sKKyAgICAvKgorICAgICAqIFRoZSB3aW5kb3cgbXVzdCBsaWUgYmV5b25k IHRoZSBHRFQgbGltaXQgWGVuIGxvYWRzLCBzbyB0aGF0IG5vCisgICAgICogc2VsZWN0b3IgcmVh Y2hlcyBpdCwgYW5kIHdpdGhpbiB0aGUgR0RUJ3MgNjRrLgorICAgICAqLworICAgIEJVSUxEX0JV R19PTihQVl9FRkZfUk9PVF9QVF9PRkZTRVQgPD0gTEFTVF9SRVNFUlZFRF9HRFRfQllURSk7Cisg ICAgQlVJTERfQlVHX09OKFBWX0VGRl9ST09UX1BUX09GRlNFVCArIFBBR0VfU0laRSA+IEdEVF9W SVJUX1NJWkUpOworCisgICAgbDFlX3dyaXRlKHB2X2dkdF9wdGVzKHYpICsgUFZfRUZGX1JPT1Rf UFRfUEFHRSwKKyAgICAgICAgICAgICAgbDFlX2Zyb21fbWZuKG1mbiwgX19QQUdFX0hZUEVSVklT T1JfUk8pKTsKKyAgICBmbHVzaF90bGJfb25lX2xvY2FsKFBWX0VGRl9ST09UX1BUKHYpKTsKK30K KworLyoKKyAqIENsZWFyIHRoZSB3aW5kb3cuICBJdHMgbGlmZXRpbWUgaXMgdi0+YXJjaC5jcjMn czogbWFrZV9jcjMoKSB3cml0ZXMgaXQKKyAqIHdoZXJldmVyIHYtPmFyY2guY3IzIGlzIHNldCwg YW5kIHZjcHVfZGVzdHJveV9wYWdldGFibGVzKCkgY2xlYXJzIGl0IHdoZXJlCisgKiB2LT5hcmNo LmNyMyBpcyB6ZXJvZWQuICBJbiBzaGFkb3cgbW9kZSBib3RoIG5hbWUgYSB0b3AtbGV2ZWwgc2hh ZG93LCB3aGljaAorICogc2hhZG93X3RlYXJkb3duKCkgcmVsZWFzZXMgYmVmb3JlIHRoYXQgcG9p bnQ7IG5vdGhpbmcgdXNlcyBlaXRoZXIgb25jZSB0aGUKKyAqIHZDUFUgY2FuIG5vIGxvbmdlciBy dW4uCisgKi8KK3N0YXRpYyB2b2lkIHB2X3VubWFwX2VmZl9yb290X3B0KGNvbnN0IHN0cnVjdCB2 Y3B1ICp2KQoreworICAgIGwxZV93cml0ZShwdl9nZHRfcHRlcyh2KSArIFBWX0VGRl9ST09UX1BU X1BBR0UsIGwxZV9lbXB0eSgpKTsKKyAgICBmbHVzaF90bGJfb25lX2xvY2FsKFBWX0VGRl9ST09U X1BUKHYpKTsKK30KKwogdm9pZCBtYWtlX2NyMyhzdHJ1Y3QgdmNwdSAqdiwgbWZuX3QgbWZuKQog ewogICAgIHN0cnVjdCBkb21haW4gKmQgPSB2LT5kb21haW47CiAKICAgICB2LT5hcmNoLmNyMyA9 IG1mbl94KG1mbikgPDwgUEFHRV9TSElGVDsKLSAgICBpZiAoIGlzX3B2X2RvbWFpbihkKSAmJiBk LT5hcmNoLnB2LnBjaWQgKQotICAgICAgICB2LT5hcmNoLmNyMyB8PSBnZXRfcGNpZF9iaXRzKHYs IGZhbHNlKTsKKworICAgIGlmICggaXNfcHZfZG9tYWluKGQpICkKKyAgICB7CisgICAgICAgIGlm ICggZC0+YXJjaC5wdi5wY2lkICkKKyAgICAgICAgICAgIHYtPmFyY2guY3IzIHw9IGdldF9wY2lk X2JpdHModiwgZmFsc2UpOworCisgICAgICAgIGlmICggZC0+YXJjaC5wdi54cHRpICkKKyAgICAg ICAgICAgIHB2X21hcF9lZmZfcm9vdF9wdCh2LCBtZm4pOworICAgIH0KIH0KIAogdm9pZCB3cml0 ZV9wdGJhc2Uoc3RydWN0IHZjcHUgKnYpCkBAIC0zMjEzLDYgKzMyNTIsOCBAQCBpbnQgdmNwdV9k ZXN0cm95X3BhZ2V0YWJsZXMoc3RydWN0IHZjcHUKICAgICAgICAgcmV0dXJuIHJjOwogCiAgICAg di0+YXJjaC5jcjMgPSAwOworICAgIGlmICggaXNfcHZfZG9tYWluKHYtPmRvbWFpbikgJiYgdi0+ ZG9tYWluLT5hcmNoLnB2LnhwdGkgKQorICAgICAgICBwdl91bm1hcF9lZmZfcm9vdF9wdCh2KTsK IAogICAgIC8qCiAgICAgICogR2V0IHRoZSB0b3AtbGV2ZWwgZ3Vlc3QgcGFnZTsgZWl0aGVyIHRo ZSBndWVzdF90YWJsZSBpdHNlbGYsIGZvcgotLS0gYS94ZW4vYXJjaC94ODYveDg2XzY0L2FzbS1v ZmZzZXRzLmMKKysrIGIveGVuL2FyY2gveDg2L3g4Nl82NC9hc20tb2Zmc2V0cy5jCkBAIC03Niw2 ICs3Niw3IEBAIHZvaWQgX19kdW1teV9fKHZvaWQpCiAKICN1bmRlZiBPRkZTRVRfRUYKIAorICAg IE9GRlNFVChWQ1BVX2lkLCBzdHJ1Y3QgdmNwdSwgdmNwdV9pZCk7CiAgICAgT0ZGU0VUKFZDUFVf cHJvY2Vzc29yLCBzdHJ1Y3QgdmNwdSwgcHJvY2Vzc29yKTsKICAgICBPRkZTRVQoVkNQVV9kb21h aW4sIHN0cnVjdCB2Y3B1LCBkb21haW4pOwogICAgIE9GRlNFVChWQ1BVX3ZjcHVfaW5mbywgc3Ry dWN0IHZjcHUsIHZjcHVfaW5mbyk7Ci0tLSBhL3hlbi9hcmNoL3g4Ni94ODZfNjQvZW50cnkuUwor KysgYi94ZW4vYXJjaC94ODYveDg2XzY0L2VudHJ5LlMKQEAgLTE3Myw5ICsxNzMsMTQgQEAgcmVz dG9yZV9hbGxfZ3Vlc3Q6CiAgICAgICAgIG1vdmFicyAkUEFERFJfTUFTSyAmIFBBR0VfTUFTSywg JXJzaQogICAgICAgICBtb3ZhYnMgJERJUkVDVE1BUF9WSVJUX1NUQVJULCAlcmN4CiAgICAgICAg IGFuZCAgICVyc2ksICVyZGkKLSAgICAgICAgYW5kICAgJXI5LCAlcnNpCiAgICAgICAgIGFkZCAg ICVyY3gsICVyZGkKKworICAgICAgICAvKiBFZmZlY3RpdmUgcm9vdCBwYWdlIHRhYmxlIGlzIG1h cHBlZCBhdCBQVl9FRkZfUk9PVF9QVCh2KSAqLworICAgICAgICBtb3YgICBWQ1BVX2lkKCVyYngp LCAlZXNpCisgICAgICAgIHNobCAgICRHRFRfTERUX1ZDUFVfVkFfU0hJRlQsICVyc2kKKyAgICAg ICAgbW92YWJzICRHRFRfTERUX1ZJUlRfU1RBUlQgKyBQVl9FRkZfUk9PVF9QVF9PRkZTRVQsICVy Y3gKICAgICAgICAgYWRkICAgJXJjeCwgJXJzaQorCiAgICAgICAgIG1vdiAgICRST09UX1BBR0VU QUJMRV9GSVJTVF9YRU5fU0xPVCwgJWVjeAogICAgICAgICBtb3YgICByb290X3RhYmxlX29mZnNl dChTSF9MSU5FQVJfUFRfVklSVF9TVEFSVCkqOCglcnNpKSwgJXI4CiAgICAgICAgIG1vdiAgICVy OCwgcm9vdF90YWJsZV9vZmZzZXQoU0hfTElORUFSX1BUX1ZJUlRfU1RBUlQpKjgoJXJkaSkK --=separator Content-Type: application/octet-stream; name="xsa516-4.18.patch" Content-Disposition: attachment; filename="xsa516-4.18.patch" Content-Transfer-Encoding: base64 RnJvbTogR2VvcmdlIER1bmxhcCA8Z3dkQHhlbnByb2plY3Qub3JnPgpTdWJqZWN0OiB4ODYvcHY6 IG1hcCBlYWNoIHZDUFUncyByb290IHBhZ2UgdGFibGUgaW4gaXRzIHBlci1kb21haW4gYXJlYQoK Rm9yIFhQVEkgZW5hYmxlZCBWTXMsIHJlc3RvcmVfYWxsX2d1ZXN0KCkgY29waWVzIG1vc3Qgb2Yg dGhlIGFjdGl2ZSBMNApwYWdldGFibGUgaW50byB0aGUgcGVyLUNQVSByb290X3BndC4gIFRoZSBM NCBpcyByZWFkIHZpYSB0aGUKZGlyZWN0bWFwLgoKVW5mb3J0dW5hdGVseSwgdGhlcmUgd2FzIG5v IGFjY291bnRpbmcgZm9yIHRoZSBmYWN0IHRoYXQgUFYgZ3Vlc3RzCmhhdmUgc2hvcnQgZGlyZWN0 bWFwcy4gIEZvciBhbiBMNCBsaXZpbmcgYmV5b25kIHRoZSA1VCBib3VuZGFyeSAoMy41VApmb3Ig Q09ORklHX0JJR01FTSksIFhlbiB3aWxsIGNvcHkgYXJiaXRyYXJ5IGRhdGEgZnJvbSBndWVzdC1j b250cm9sbGVkCnZpcnR1YWwgYWRkcmVzcyBzcGFjZSBpbnRvIHRoZSBwZXItQ1BVIHJvb3RfcGd0 LCBpbnN0ZWFkIG9mIHRoZQppbnRlbmRlZCBMNC4KClhlbiBoYXMgcGVyLWRvbWFpbiBtYXBwaW5n cyBmb3IgdGhlIExEVCBhbmQgR0RULCB3aXRoIHR3byBwYWdlcwpyZXNlcnZlZCBmb3IgWGVuJ3Mg dXNlIGluIHRoZSBHRFQgYnV0IG9ubHkgb25lIGluIHVzZS4gIFJldXNlIEdEVCBwYWdlCjE1IHRv IG1hcCB0aGUgZWZmZWN0aXZlIEw0LiAgVGhlIEdEVCBsaW1pdCBrZWVwcyBpbXBsaWNpdCBhY2Nl c3NlcyBvdXQKb2YgdGhpcyBwYWdlLgoKV2UgdXBkYXRlIHRoaXMgbWFwcGluZyBpbiBtYWtlX2Ny MygpLCB0aGUgb25seSBwbGFjZSBhIG5vbi1lbXB0eSB2YWx1ZQpvZiB2LT5hcmNoLmNyMyBpcyB3 cml0dGVuIGludG8gYSBndWVzdCdzIHZjcHUgc3RydWN0LCBmb3IgdHdvIHJlYXNvbnMuCkZpcnN0 IGlzIHJlZmVyZW5jZSBjb3VudGluZzogdGhpcyBtYWtlcyBpdCBlYXNpZXIgdG8gYXJndWUgdGhh dCB0aGUKcmVmZXJlbmNlIGZvciB2LT5hcmNoLmNyMyBpdHNlbGYgY292ZXJzIHRoZSByZWZlcmVu Y2UgZm9yIHRoZSBtYXBwaW5nLgoKU2Vjb25kbHksIHRoaXMgZ3VhcmFudGVlcyB0aGF0IGFsbCB1 cGRhdGVzLCBldmVuIHVwZGF0ZXMgbWFkZSBpbgpzaGFkb3cgbW9kZSwgcmVzdWx0IGluIGFuIHVw ZGF0ZSB0byB0aGUgbWFwcGluZy4gIER1cmluZyBsaXZlCm1pZ3JhdGlvbiwgaXQncyBwb3NzaWJs ZSBmb3IgZ3Vlc3RfZ2V0X2VmZl9rZXJuX2wxZSgpIHRvIHJlc3VsdCBpbiBhCm1vZGlmaWVkIHZh bHVlIG9mIHYtPmFyY2guY3IzIChza2V0Y2ggYmVsb3cpOyBwbGFjaW5nIHRoZSBtYXBwaW5nCnVw ZGF0ZSBhdCBtYWtlX2NyMygpIGNhdGNoZXMgdGhpcywgd2hpbGUgb3RoZXIgY2FuZGlkYXRlIGxv Y2F0aW9ucwpsaWtlIHdyaXRlX3B0YmFzZSgpIGFuZCB0b2dnbGVfZ3Vlc3RfbW9kZSgpIGRvbid0 LgoKTm90ZSB0aGF0IHdlIGludHJvZHVjZSB0aGUgaWRlYSBvZiBhbiAiZWZmZWN0aXZlIEw0IiBo ZXJlLCB0byBtZWFuCiJndWVzdCBMNCBhZnRlciBhbnkgdHJhbnNmb3JtYXRpb25zIjogWFBUSSBj b3BpZXMgZWl0aGVyIHRoZSBhY3R1YWwKZ3Vlc3QgTDQgaWYgbm90IHNoYWRvd2VkLCBvciB0aGUg c2hhZG93IEw0ICh0cmFuc2Zvcm1lZCkgaWYgc2hhZG93ZWQuCgpTa2V0Y2g6IGd1ZXN0X2dldF9l ZmZfa2Vybl9sMWUoKSBoYXMgYSBwYWlyIG9mIHRvZ2dsZV9ndWVzdF9wdCgpIGNhbGxzCndoaWNo IGhhcHBlbiBpZiB0aGUgZ3Vlc3QgaXMgaW4gdXNlciBtb2RlLiAgRHVyaW5nIGxpdmUgbWlncmF0 aW9uLCBhCmxvZy1kaXJ0eSBjbGVhbiB3aWxsIGRvIGEgZG9tYWluX3BhdXNlIGFuZCB0aGVuIGNh bGwKc2hhZG93X2Jsb3dfdGFibGVzKCksIHVucGlubmluZyB0aGUgc2hhZG93IG9mIHRoZSBndWVz dCB1c2VyIHJvb3QKcGFnZXRhYmxlLiAgQWZ0ZXIgZXhlY3V0aW9uIHJlc3VtZXMsIHRoZSBmaXJz dCB0b2dnbGVfZ3Vlc3RfcHQoKSBjb3VsZAp0aGVuIGNhdXNlIHRoYXQgcGFnZSB0byBiZWNvbWUg dW5zaGFkb3dlZC4gIFRoZSBzZWNvbmQKdG9nZ2xlX2d1ZXN0X3B0KCkgd291bGQgdGhlbiByZS1z aGFkb3cgaXQsIHBvc3NpYmx5IHdpdGggYSBkaWZmZXJlbnQKYmFja2luZyBzaGFkb3cgcGFnZS4K ClRoaXMgaXMgWFNBLTUxNiAvIENWRS0yMDI2LTc5NjA5LgoKRml4ZXM6IDU3ODRkZTNlMjA2NyAo Ing4NjogTWVsdGRvd24gYmFuZC1haWQgYWdhaW5zdCBtYWxpY2lvdXMgNjQtYml0IFBWIGd1ZXN0 cyIpCkFzc2lzdGVkLWJ5OiBDbGF1ZGUgQ29kZTpjbGF1ZGUtZmFibGUtNS0xClNpZ25lZC1vZmYt Ynk6IEdlb3JnZSBEdW5sYXAgPGd3ZEB4ZW5wcm9qZWN0Lm9yZz4KUmV2aWV3ZWQtYnk6IEphbiBC ZXVsaWNoIDxqYmV1bGljaEBzdXNlLmNvbT4KCi0tLSBhL3hlbi9hcmNoL3g4Ni9pbmNsdWRlL2Fz bS9jb25maWcuaAorKysgYi94ZW4vYXJjaC94ODYvaW5jbHVkZS9hc20vY29uZmlnLmgKQEAgLTI5 NiwxMSArMjk2LDMwIEBAIGV4dGVybiB1bnNpZ25lZCBsb25nIHhlbl9waHlzX3N0YXJ0OwogI2Rl ZmluZSBHRFRfTERUX1ZJUlRfU1RBUlQgICAgICAgUEVSRE9NQUlOX1ZJUlRfU0xPVCgwKQogI2Rl ZmluZSBHRFRfTERUX1ZJUlRfRU5EICAgICAgICAgKEdEVF9MRFRfVklSVF9TVEFSVCArIChHRFRf TERUX01CWVRFUyA8PCAyMCkpCiAKLS8qIFRoZSBhZGRyZXNzIG9mIGEgcGFydGljdWxhciBWQ1BV J3MgR0RUIG9yIExEVC4gKi8KKy8qCisgKiBUaGUgYWRkcmVzcyBvZiBhIHBhcnRpY3VsYXIgVkNQ VSdzIEdEVCBvciBMRFQ7IGVhY2ggaXMgdGhlIGFyY2hpdGVjdHVyYWwKKyAqIG1heGltdW0gb2Yg NjRrLgorICovCisjZGVmaW5lIEdEVF9WSVJUX1NJWkUgICAgICAgIEtCKDY0KQogI2RlZmluZSBH RFRfVklSVF9TVEFSVCh2KSAgICBcCiAgICAgKFBFUkRPTUFJTl9WSVJUX1NUQVJUICsgKCh2KS0+ dmNwdV9pZCA8PCBHRFRfTERUX1ZDUFVfVkFfU0hJRlQpKQogI2RlZmluZSBMRFRfVklSVF9TVEFS VCh2KSAgICBcCi0gICAgKEdEVF9WSVJUX1NUQVJUKHYpICsgKDY0KjEwMjQpKQorICAgIChHRFRf VklSVF9TVEFSVCh2KSArIEdEVF9WSVJUX1NJWkUpCisKKy8qCisgKiBUaGUgdkNQVSdzIGVmZmVj dGl2ZSByb290IHBhZ2UgdGFibGUsIG1hcHBlZCByZWFkLW9ubHkgaW4gdGhlIGxhc3QKKyAqIHBh Z2Ugb2YgaXRzIEdEVDogdGhlIHBhZ2UgYWZ0ZXIgWGVuJ3MgcmVzZXJ2ZWQgcmFuZ2UsIGJleW9u ZCB0aGUKKyAqIEdEVCBsaW1pdCBYZW4gbG9hZHMgKExBU1RfUkVTRVJWRURfR0RUX0JZVEUpLCBz byBubyBzZWxlY3RvciBjYW4KKyAqIHJlYWNoIGl0LiAgIkVmZmVjdGl2ZSIgaXMgdGhlIHJvb3Qg cGFnZSB0YWJsZSB0aGUgdkNQVSBpcyBtZWFudCB0bworICogcnVuIG9uIGFmdGVyIGFueSB0cmFu c2Zvcm1hdGlvbjogdGhlIGd1ZXN0J3Mgb3duLCBvciBpdHMgc2hhZG93CisgKiB1bmRlciBzaGFk b3cgcGFnaW5nLiAgWFBUSSBkb2VzIG5vdCB0cmFuc2Zvcm0gaXQgZnVydGhlciBidXQgY29waWVz CisgKiBmcm9tIGl0OiB0aGUgZXhpdCBwYXRoIHJlYWRzIHRoZSBndWVzdC12aXNpYmxlIEw0IHNs b3RzIGZyb20gaGVyZS4KKyAqIEFkZGluZyBhIHJlc2VydmVkIEdEVCBwYWdlIHdvdWxkIG1lYW4g bW92aW5nIHRoZSB3aW5kb3cgb3V0IG9mIHRoZQorICogR0RUIGZpcnN0OyBwdl9tYXBfZWZmX3Jv b3RfcHQoKSBjaGVja3MgdGhlIGxheW91dCBhdCBidWlsZCB0aW1lLgorICovCisjZGVmaW5lIFBW X0VGRl9ST09UX1BUX1BBR0UgICAgKEZJUlNUX1JFU0VSVkVEX0dEVF9QQUdFICsgMSkKKyNkZWZp bmUgUFZfRUZGX1JPT1RfUFRfT0ZGU0VUICAoUFZfRUZGX1JPT1RfUFRfUEFHRSA8PCBQQUdFX1NI SUZUKQorI2RlZmluZSBQVl9FRkZfUk9PVF9QVCh2KSAgICAgIChHRFRfVklSVF9TVEFSVCh2KSAr IFBWX0VGRl9ST09UX1BUX09GRlNFVCkKIAogLyogbWFwX2RvbWFpbl9wYWdlKCkgbWFwIGNhY2hl LiBUaGUgc2Vjb25kIHBlci1kb21haW4tbWFwcGluZyBzdWItYXJlYS4gKi8KICNkZWZpbmUgTUFQ Q0FDSEVfVkNQVV9FTlRSSUVTICAgIChDT05GSUdfUEFHSU5HX0xFVkVMUyAqIENPTkZJR19QQUdJ TkdfTEVWRUxTKQotLS0gYS94ZW4vYXJjaC94ODYvaW5jbHVkZS9hc20vZGVzYy5oCisrKyBiL3hl bi9hcmNoL3g4Ni9pbmNsdWRlL2FzbS9kZXNjLmgKQEAgLTYsNiArNiwxNiBAQAogLyoKICAqIFhl biByZXNlcnZlcyBhIG1lbW9yeSBwYWdlIG9mIEdEVCBlbnRyaWVzLgogICogTm8gZ3Vlc3QgR0RU IGVudHJpZXMgZXhpc3QgYmV5b25kIHRoZSBYZW4gcmVzZXJ2ZWQgYXJlYS4KKyAqCisgKiBUaGUg cGFnZSBhZnRlciB0aGUgcmVzZXJ2ZWQgYXJlYSwgdGhlIGxhc3Qgb2YgdGhlIEdEVCdzIDY0aywg aXMgdGhlCisgKiBQViBlZmZlY3RpdmUgcm9vdC10YWJsZSB3aW5kb3cgKFBWX0VGRl9ST09UX1BU X1BBR0UsIGNvbmZpZy5oKToKKyAqIGJleW9uZCB0aGUgR0RUIGxpbWl0IFhlbiBsb2FkcyAoTEFT VF9SRVNFUlZFRF9HRFRfQllURSksIHNvIG5vCisgKiBzZWxlY3RvciByZWFjaGVzIGl0LiAgWGVu IHVzZXMgb25seSBhIGZldyBvZiB0aGUgcmVzZXJ2ZWQgcGFnZSdzCisgKiA1MTIgc2xvdHMsIHNv IG1vcmUgWGVuIGRlc2NyaXB0b3JzIG5ldmVyIG5lZWQgYW5vdGhlciBwYWdlOyBpZiBvbmUKKyAq IHdlcmUgbmVlZGVkIHJlZ2FyZGxlc3MsIHRoZSB3aW5kb3cgd291bGQgaGF2ZSB0byBtb3ZlIG91 dCBvZiB0aGUKKyAqIEdEVCBmaXJzdCAoaW50byBhIHBlci1kb21haW4gc3ViLWFyZWEgb2YgaXRz IG93biksIGFzIHRoaXMgaXMgdGhlCisgKiBHRFQncyBsYXN0IHBhZ2UuICBwdl9tYXBfZWZmX3Jv b3RfcHQoKSBjaGVja3MgdGhlIGxheW91dCBhdCBidWlsZAorICogdGltZS4KICAqLwogI2RlZmlu ZSBOUl9SRVNFUlZFRF9HRFRfUEFHRVMgICAxCiAjZGVmaW5lIE5SX1JFU0VSVkVEX0dEVF9CWVRF UyAgIChOUl9SRVNFUlZFRF9HRFRfUEFHRVMgKiBQQUdFX1NJWkUpCi0tLSBhL3hlbi9hcmNoL3g4 Ni9tbS5jCisrKyBiL3hlbi9hcmNoL3g4Ni9tbS5jCkBAIC01MDUsMTMgKzUwNSw1MiBAQCB2b2lk IHNoYXJlX3hlbl9wYWdlX3dpdGhfZ3Vlc3Qoc3RydWN0IHBhCiAgICAgc3Bpbl91bmxvY2soJmQt PnBhZ2VfYWxsb2NfbG9jayk7CiB9CiAKKy8qCisgKiBNYXAgQG1mbiByZWFkLW9ubHkgYXQgdidz IFBWX0VGRl9ST09UX1BUKCkgd2luZG93LiAgVGhlIHdpbmRvdyBsaXZlcyBpbgorICogdidzIHBl ci1kb21haW4gYXJlYSwgc28gdiBuZWVkIG5vdCBiZSBjdXJyZW50OyB0aGUgbG9jYWwgZmx1c2gg aXMgZm9yCisgKiB3aGVuIGl0IGlzLCB3aXRoIGl0cyBvd24gcGFnZSB0YWJsZXMgbG9hZGVkLgor ICovCitzdGF0aWMgdm9pZCBwdl9tYXBfZWZmX3Jvb3RfcHQoY29uc3Qgc3RydWN0IHZjcHUgKnYs IG1mbl90IG1mbikKK3sKKyAgICAvKgorICAgICAqIFRoZSB3aW5kb3cgbXVzdCBsaWUgYmV5b25k IHRoZSBHRFQgbGltaXQgWGVuIGxvYWRzLCBzbyB0aGF0IG5vCisgICAgICogc2VsZWN0b3IgcmVh Y2hlcyBpdCwgYW5kIHdpdGhpbiB0aGUgR0RUJ3MgNjRrLgorICAgICAqLworICAgIEJVSUxEX0JV R19PTihQVl9FRkZfUk9PVF9QVF9PRkZTRVQgPD0gTEFTVF9SRVNFUlZFRF9HRFRfQllURSk7Cisg ICAgQlVJTERfQlVHX09OKFBWX0VGRl9ST09UX1BUX09GRlNFVCArIFBBR0VfU0laRSA+IEdEVF9W SVJUX1NJWkUpOworCisgICAgbDFlX3dyaXRlKHB2X2dkdF9wdGVzKHYpICsgUFZfRUZGX1JPT1Rf UFRfUEFHRSwKKyAgICAgICAgICAgICAgbDFlX2Zyb21fbWZuKG1mbiwgX19QQUdFX0hZUEVSVklT T1JfUk8pKTsKKyAgICBmbHVzaF90bGJfb25lX2xvY2FsKFBWX0VGRl9ST09UX1BUKHYpKTsKK30K KworLyoKKyAqIENsZWFyIHRoZSB3aW5kb3cuICBJdHMgbGlmZXRpbWUgaXMgdi0+YXJjaC5jcjMn czogbWFrZV9jcjMoKSB3cml0ZXMgaXQKKyAqIHdoZXJldmVyIHYtPmFyY2guY3IzIGlzIHNldCwg YW5kIHZjcHVfZGVzdHJveV9wYWdldGFibGVzKCkgY2xlYXJzIGl0IHdoZXJlCisgKiB2LT5hcmNo LmNyMyBpcyB6ZXJvZWQuICBJbiBzaGFkb3cgbW9kZSBib3RoIG5hbWUgYSB0b3AtbGV2ZWwgc2hh ZG93LCB3aGljaAorICogc2hhZG93X3RlYXJkb3duKCkgcmVsZWFzZXMgYmVmb3JlIHRoYXQgcG9p bnQ7IG5vdGhpbmcgdXNlcyBlaXRoZXIgb25jZSB0aGUKKyAqIHZDUFUgY2FuIG5vIGxvbmdlciBy dW4uCisgKi8KK3N0YXRpYyB2b2lkIHB2X3VubWFwX2VmZl9yb290X3B0KGNvbnN0IHN0cnVjdCB2 Y3B1ICp2KQoreworICAgIGwxZV93cml0ZShwdl9nZHRfcHRlcyh2KSArIFBWX0VGRl9ST09UX1BU X1BBR0UsIGwxZV9lbXB0eSgpKTsKKyAgICBmbHVzaF90bGJfb25lX2xvY2FsKFBWX0VGRl9ST09U X1BUKHYpKTsKK30KKwogdm9pZCBtYWtlX2NyMyhzdHJ1Y3QgdmNwdSAqdiwgbWZuX3QgbWZuKQog ewogICAgIHN0cnVjdCBkb21haW4gKmQgPSB2LT5kb21haW47CiAKICAgICB2LT5hcmNoLmNyMyA9 IG1mbl94KG1mbikgPDwgUEFHRV9TSElGVDsKLSAgICBpZiAoIGlzX3B2X2RvbWFpbihkKSAmJiBk LT5hcmNoLnB2LnBjaWQgKQotICAgICAgICB2LT5hcmNoLmNyMyB8PSBnZXRfcGNpZF9iaXRzKHYs IGZhbHNlKTsKKworICAgIGlmICggaXNfcHZfZG9tYWluKGQpICkKKyAgICB7CisgICAgICAgIGlm ICggZC0+YXJjaC5wdi5wY2lkICkKKyAgICAgICAgICAgIHYtPmFyY2guY3IzIHw9IGdldF9wY2lk X2JpdHModiwgZmFsc2UpOworCisgICAgICAgIGlmICggZC0+YXJjaC5wdi54cHRpICkKKyAgICAg ICAgICAgIHB2X21hcF9lZmZfcm9vdF9wdCh2LCBtZm4pOworICAgIH0KIH0KIAogdm9pZCB3cml0 ZV9wdGJhc2Uoc3RydWN0IHZjcHUgKnYpCkBAIC0zMTk3LDYgKzMyMzYsOCBAQCBpbnQgdmNwdV9k ZXN0cm95X3BhZ2V0YWJsZXMoc3RydWN0IHZjcHUKICAgICAgICAgcmV0dXJuIHJjOwogCiAgICAg di0+YXJjaC5jcjMgPSAwOworICAgIGlmICggaXNfcHZfZG9tYWluKHYtPmRvbWFpbikgJiYgdi0+ ZG9tYWluLT5hcmNoLnB2LnhwdGkgKQorICAgICAgICBwdl91bm1hcF9lZmZfcm9vdF9wdCh2KTsK IAogICAgIC8qCiAgICAgICogR2V0IHRoZSB0b3AtbGV2ZWwgZ3Vlc3QgcGFnZTsgZWl0aGVyIHRo ZSBndWVzdF90YWJsZSBpdHNlbGYsIGZvcgotLS0gYS94ZW4vYXJjaC94ODYveDg2XzY0L2FzbS1v ZmZzZXRzLmMKKysrIGIveGVuL2FyY2gveDg2L3g4Nl82NC9hc20tb2Zmc2V0cy5jCkBAIC03Niw2 ICs3Niw3IEBAIHZvaWQgX19kdW1teV9fKHZvaWQpCiAKICN1bmRlZiBPRkZTRVRfRUYKIAorICAg IE9GRlNFVChWQ1BVX2lkLCBzdHJ1Y3QgdmNwdSwgdmNwdV9pZCk7CiAgICAgT0ZGU0VUKFZDUFVf cHJvY2Vzc29yLCBzdHJ1Y3QgdmNwdSwgcHJvY2Vzc29yKTsKICAgICBPRkZTRVQoVkNQVV9kb21h aW4sIHN0cnVjdCB2Y3B1LCBkb21haW4pOwogICAgIE9GRlNFVChWQ1BVX3ZjcHVfaW5mbywgc3Ry dWN0IHZjcHUsIHZjcHVfaW5mb19hcmVhLm1hcCk7Ci0tLSBhL3hlbi9hcmNoL3g4Ni94ODZfNjQv ZW50cnkuUworKysgYi94ZW4vYXJjaC94ODYveDg2XzY0L2VudHJ5LlMKQEAgLTE3Myw5ICsxNzMs MTQgQEAgcmVzdG9yZV9hbGxfZ3Vlc3Q6CiAgICAgICAgIG1vdmFicyAkUEFERFJfTUFTSyAmIFBB R0VfTUFTSywgJXJzaQogICAgICAgICBtb3ZhYnMgJERJUkVDVE1BUF9WSVJUX1NUQVJULCAlcmN4 CiAgICAgICAgIGFuZCAgICVyc2ksICVyZGkKLSAgICAgICAgYW5kICAgJXI5LCAlcnNpCiAgICAg ICAgIGFkZCAgICVyY3gsICVyZGkKKworICAgICAgICAvKiBFZmZlY3RpdmUgcm9vdCBwYWdlIHRh YmxlIGlzIG1hcHBlZCBhdCBQVl9FRkZfUk9PVF9QVCh2KSAqLworICAgICAgICBtb3YgICBWQ1BV X2lkKCVyYngpLCAlZXNpCisgICAgICAgIHNobCAgICRHRFRfTERUX1ZDUFVfVkFfU0hJRlQsICVy c2kKKyAgICAgICAgbW92YWJzICRHRFRfTERUX1ZJUlRfU1RBUlQgKyBQVl9FRkZfUk9PVF9QVF9P RkZTRVQsICVyY3gKICAgICAgICAgYWRkICAgJXJjeCwgJXJzaQorCiAgICAgICAgIG1vdiAgICRS T09UX1BBR0VUQUJMRV9GSVJTVF9YRU5fU0xPVCwgJWVjeAogICAgICAgICBtb3YgICByb290X3Rh YmxlX29mZnNldChTSF9MSU5FQVJfUFRfVklSVF9TVEFSVCkqOCglcnNpKSwgJXI4CiAgICAgICAg IG1vdiAgICVyOCwgcm9vdF90YWJsZV9vZmZzZXQoU0hfTElORUFSX1BUX1ZJUlRfU1RBUlQpKjgo JXJkaSkK --=separator-- From xen-announce-bounces@lists.xenproject.org Tue Oct 13 12:28:56 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 13 Oct 2026 12:28:56 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1447106.1663309 (Exim 4.92) (envelope-from ) id 1xGbcX-0005kT-Ks; Tue, 13 Oct 2026 12:28:41 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1447106.1663309; Tue, 13 Oct 2026 12:28:41 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1xGbcX-0005kM-HJ; Tue, 13 Oct 2026 12:28:41 +0000 Received: by outflank-mailman (input) for mailman id 1447106; Tue, 13 Oct 2026 12:28:39 +0000 Received: from mx.expurgate.net ([194.145.224.20]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1xGbcV-0005hb-LM; Tue, 13 Oct 2026 12:28:39 +0000 Received: from mx.expurgate.net (helo=localhost) by mx.expurgate.net with esmtp id 1xGbcV-00DIG6-2E; Tue, 13 Oct 2026 14:28:39 +0200 Received: from [10.42.69.5] (helo=localhost) by localhost with ESMTP (eXpurgate MTA 0.9.1) (envelope-from ) id 6ace23ef-2eae-0a2a0a5409dd-0a2a4505bd54-26 for ; Tue, 13 Oct 2026 14:28:39 +0200 Received: from [104.130.215.37] (helo=mail.xenproject.org) by tlsNG-c201ff.mxtls.expurgate.net with ESMTPS (eXpurgate 4.57.1) (envelope-from ) id 6ace23f5-4cb1-0a2a45050019-6882d725d400-3 for ; Tue, 13 Oct 2026 14:28:38 +0200 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.98.2) (envelope-from ) id 1xGbcR-00000003NGX-1oab; Tue, 13 Oct 2026 12:28:35 +0000 Received: from andrewcoop by xenbits.xenproject.org with local (Exim 4.98.2) (envelope-from ) id 1xGbcR-0000000F8S9-0jrW; Tue, 13 Oct 2026 12:28:35 +0000 X-BeenThere: xen-announce@lists.xenproject.org List-Id: "Xen announcements \(low volume\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-announce-bounces@lists.xenproject.org Precedence: list Sender: "Xen-announce" Authentication-Results: eu.smtp.expurgate.cloud; none Content-Type: multipart/mixed; boundary="=separator"; charset="utf-8" Content-Transfer-Encoding: binary MIME-Version: 1.0 X-Mailer: MIME-tools 5.515 (Entity 5.515) To: xen-announce@lists.xen.org, xen-devel@lists.xen.org, xen-users@lists.xen.org, oss-security@lists.openwall.com From: Xen.org security team CC: Xen.org security team Subject: Xen Security Advisory 515 v2 (CVE-2026-79608) - x86/AMD: ineffectual Zenbleed workaround Message-Id: Date: Tue, 13 Oct 2026 12:28:35 +0000 X-purgate-ID: tlsNG-c201ff/1791894518-720AA2A1-ABEF8E1F/0/0 X-purgate-type: clean X-purgate-size: 6623 --=separator Content-Type: text/plain; charset="utf-8" Content-Disposition: inline Content-Transfer-Encoding: 7bit -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Xen Security Advisory CVE-2026-79608 / XSA-515 version 2 x86/AMD: ineffectual Zenbleed workaround UPDATES IN VERSION 2 ==================== Public release. ISSUE DESCRIPTION ================= The workaround for XSA-433 (Zenbleed, CVE-2023-20593) was later re-worked to better integrate with other manipulations of the same MSR. In this rework an inverted conditional was introduced, resulting in the workaround to not be applied when needed and vice versa. For more details, see: http://xenbits.xen.org/xsa/advisory-433.html IMPACT ====== An attacker can exploit this bug to read data from different contexts on the same core. Examples of such data includes key material, cypher and plaintext from the AES-NI instructions, or the contents of REP-MOVS instructions, commonly used to implement memcpy(). VULNERABLE SYSTEMS ================== Xen versions 4.19.4 and onwards, 4.20.3 and onwards, 4.21.1 and onwards, and 4.22 are affected. Xen versions 4.18, minor versions 4.19.3 and earlier, minor versions 4.20.2 and earlier, and 4.21.0 are not affected. The vulnerability can only be leveraged on systems running out-of-date microcode. Microcode fixing Zenbleed was published in late 2023. Updated firmware subseqeuent to this, or e.g. updated amd-ucode from linux-firmware (for the subset of CPUs covered by linux-firmware) are not vulnerable. The original issue and hence the applicability of the workaround is specific to the AMD Zen2 microarchitecture. AMD do not believe that other microarchitectures are affected. MITIGATION ========== This issue can be mitigated by disabling AVX, either by booting Xen with `cpuid=no-avx` on the command line, or by specifying `cpuid="host:avx=0"` in the vm.cfg file of all untrusted VMs. However, this will come with a significant impact on the system and is not recommended for anyone able to deploy the microcode or patch described below. CREDITS ======= This issue was discovered by Sashiko + Opus 5.0 and diagnosed as a security issue by George Dunlap. RESOLUTION ========== Applying the attached patch resolves this issue. Note that patches for released versions are generally prepared to apply to the stable branches, and may not apply cleanly to the most recent release tarball. Downstreams are encouraged to update to the tip of the stable branch before applying these patches. xsa515.patch xen-unstable - Xen 4.19.x $ sha256sum xsa515* d54c5f5443209e523c1d1b456063d105792058d402513bc1e56246b5938de6d8 xsa515.patch $ DEPLOYMENT DURING EMBARGO ========================= Deployment of the patches described above (or others which are substantially similar) is permitted during the embargo, even on public- facing systems with untrusted guest users and administrators. HOWEVER, deployment of the mitigation is NOT permitted (except where all the affected systems and VMs are administered and used only by organisations which are members of the Xen Project Security Issues Predisclosure List). Specifically, deployment on public cloud systems is NOT permitted. This is because altering exposure of AVX is a guest visible configuration change, which may lead to re-discovery of the issue. Deployment of this mitigation is permitted only AFTER the embargo ends. AND: Distribution of updated software is prohibited (except to other members of the predisclosure list). Predisclosure list members who wish to deploy significantly different patches and/or mitigations, please contact the Xen Project Security Team. (Note: this during-embargo deployment notice is retained in post-embargo publicly released Xen Project advisories, even though it is then no longer applicable. This is to enable the community to have oversight of the Xen Project Security Team's decisionmaking.) For more information about permissible uses of embargoed information, consult the Xen Project community's agreed Security Policy: http://www.xenproject.org/security-policy.html -----BEGIN PGP SIGNATURE----- iQFABAEBCAAqFiEEI+MiLBRfRHX6gGCng/4UyVfoK9kFAmrOIhsMHHBncEB4ZW4u b3JnAAoJEIP+FMlX6CvZKrYIAIKTxPm+Rvb9K2SvRJoHgjFDGTG0OxXqWFDjPnUR DKTx/URFmXCFT4PCGuAearWnkw25x0e80TdNfCrdHxDJzENSCcmb+5iIuM8nUtgo hMwNON4YUWn0GhBe3fcgAdlmxwWfhIJZHWt0LDrZrO9Nr21hmgVhvzME2VtH0EkA Yafi6ZixVwheA48w2to1cBjx27J5XucmvFoMgSRfW40YhpCmWDLDMv1F0vwxioyy vWVrk7pfYEj8n/hiap2MoI/pTDD6PruF+lWsO1fzHFwZHcUPOU+rV/elfEAA027E rRVsxob58ljY1IH/sMYOmSm7OQaGjau0kS7vC9kXtm7lmBQ= =NxYd -----END PGP SIGNATURE----- --=separator Content-Type: application/octet-stream; name="xsa515.patch" Content-Disposition: attachment; filename="xsa515.patch" Content-Transfer-Encoding: base64 RnJvbTogQW5kcmV3IENvb3BlciA8YW5kcmV3LmNvb3BlcjNAY2l0cml4LmNvbT4KU3ViamVjdDog eDg2L2FtZDogRml4IGludmVydGVkIGNvbmRpdGlvbiBpbiB6ZW5ibGVlZF91c2VfY2hpY2tlbmJp dCgpCgpUaGUgaWRlbnRpZmllZCBjb21taXQgaW52ZXJ0ZWQgdGhlIGNvbmRpdGlvbiB1bmRlciB3 aGljaCBYZW4gY2hvb3Nlcwp0byBzZXQgdGhlIFplbmJsZWVkIGNoaWNrZW5iaXQuCgpVbmRvIHRo YXQsIGFuZCBsZWF2ZSBhIGJldHRlciBjb21tZW50IGV4cGxhaW5pbmcgd2h5LgoKRm91bmQgYnkg QUkgcmV2aWV3IG9mIHRoZSByZWZlcmVuY2VkIGNvbW1pdC4KClRoaXMgaXMgWFNBLTUxNSAvIENW RS0yMDI2LTc5NjA4LgoKRml4ZXM6IGQwYzc1ZGM0YzAyOCAoIng4Ni9hbWQ6IEZpeCByYWNlIGVk aXRpbmcgREVfQ0ZHIikKQXNzaXN0ZWQtYnk6IFNhc2hpa28gKyBPcHVzIDUuMApSZXBvcnRlZC1i eTogR2VvcmdlIER1bmxhcCA8ZHVubGFwZ0B1bWljaC5lZHU+ClNpZ25lZC1vZmYtYnk6IEFuZHJl dyBDb29wZXIgPGFuZHJldy5jb29wZXIzQGNpdHJpeC5jb20+ClJldmlld2VkLWJ5OiBKYW4gQmV1 bGljaCA8amJldWxpY2hAc3VzZS5jb20+CgpkaWZmIC0tZ2l0IGEveGVuL2FyY2gveDg2L2NwdS9h bWQuYyBiL3hlbi9hcmNoL3g4Ni9jcHUvYW1kLmMKaW5kZXggNzA3ODNjOWEwYWYwLi4xNDg4ODZm ZTJlYTEgMTAwNjQ0Ci0tLSBhL3hlbi9hcmNoL3g4Ni9jcHUvYW1kLmMKKysrIGIveGVuL2FyY2gv eDg2L2NwdS9hbWQuYwpAQCAtODg3LDcgKzg4NywxMiBAQCBzdGF0aWMgYm9vbCB6ZW5ibGVlZF91 c2VfY2hpY2tlbmJpdCh2b2lkKQogICAgICAgICByZXR1cm4gaXNfemVuMl91YXJjaCgpOwogICAg IH0KIAotICAgIHJldHVybiAodWludDhfdCljdXJyX3JldiA+PSBmaXhlZF9yZXY7CisgICAgLyoK KyAgICAgKiBaZW5ibGVlZCBjYW4gYmUgbWl0aWdhdGVkIGJ5IGRpc2FibGluZyBGbG9hdGluZy1Q b2ludAorICAgICAqIE1vdi1FbGltaW5hdGlvbiwgYnV0IHRoaXMgaXMgZXhwZW5zaXZlLiAgT25s eSBkbyBzbyB3aGVuIHdlCisgICAgICogZG9uJ3QgaGF2ZSBhIGZpeCBpbiBtaWNyb2NvZGUuCisg ICAgICovCisgICAgcmV0dXJuICh1aW50OF90KWN1cnJfcmV2IDwgZml4ZWRfcmV2OwogfQogCiB2 b2lkIGFtZF9pbml0X2RlX2NmZyhjb25zdCBzdHJ1Y3QgY3B1aW5mb194ODYgKmMpCg== --=separator-- From xen-announce-bounces@lists.xenproject.org Tue Oct 13 12:28:56 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 13 Oct 2026 12:28:56 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1447118.1663389 (Exim 4.92) (envelope-from ) id 1xGbck-0007tN-5x; Tue, 13 Oct 2026 12:28:54 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1447118.1663389; Tue, 13 Oct 2026 12:28:54 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1xGbcj-0007rn-RW; Tue, 13 Oct 2026 12:28:53 +0000 Received: by outflank-mailman (input) for mailman id 1447118; Tue, 13 Oct 2026 12:28:52 +0000 Received: from mx.expurgate.net ([195.190.135.10]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1xGbci-0007Kx-05; Tue, 13 Oct 2026 12:28:52 +0000 Received: from mx.expurgate.net (helo=localhost) by mx.expurgate.net with esmtp id 1xGbch-00FMox-CS; Tue, 13 Oct 2026 14:28:51 +0200 Received: from [10.42.69.9] (helo=localhost) by localhost with ESMTP (eXpurgate MTA 0.9.1) (envelope-from ) id 6ace2401-bab6-0a2a0a5309dd-0a2a4509de3a-6 for ; Tue, 13 Oct 2026 14:28:51 +0200 Received: from [104.130.215.37] (helo=mail.xenproject.org) by tlsNG-bad1c0.mxtls.expurgate.net with ESMTPS (eXpurgate 4.57.1) (envelope-from ) id 6ace2402-be1a-0a2a45090019-6882d725a2c4-3 for ; Tue, 13 Oct 2026 14:28:51 +0200 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.98.2) (envelope-from ) id 1xGbce-00000003NHL-0WzF; Tue, 13 Oct 2026 12:28:47 +0000 Received: from andrewcoop by xenbits.xenproject.org with local (Exim 4.98.2) (envelope-from ) id 1xGbcd-0000000F8nY-3bRd; Tue, 13 Oct 2026 12:28:47 +0000 X-BeenThere: xen-announce@lists.xenproject.org List-Id: "Xen announcements \(low volume\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-announce-bounces@lists.xenproject.org Precedence: list Sender: "Xen-announce" Authentication-Results: eu.smtp.expurgate.cloud; none Content-Type: multipart/mixed; boundary="=separator"; charset="utf-8" Content-Transfer-Encoding: binary MIME-Version: 1.0 X-Mailer: MIME-tools 5.515 (Entity 5.515) To: xen-announce@lists.xen.org, xen-devel@lists.xen.org, xen-users@lists.xen.org, oss-security@lists.openwall.com From: Xen.org security team CC: Xen.org security team Subject: Xen Security Advisory 517 v2 (CVE-2026-79610) - grant-table: double version change race Message-Id: Date: Tue, 13 Oct 2026 12:28:47 +0000 X-purgate-ID: tlsNG-bad1c0/1791894531-FD469034-5AEEE705/0/0 X-purgate-type: clean X-purgate-size: 7295 --=separator Content-Type: text/plain; charset="utf-8" Content-Disposition: inline Content-Transfer-Encoding: 7bit -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Xen Security Advisory CVE-2026-79610 / XSA-517 version 2 grant-table: double version change race UPDATES IN VERSION 2 ==================== Public release. ISSUE DESCRIPTION ================= XSA-501 was about issues with v1 -> v2 and v2 -> v1 changes racing certain other grant table operations. Sadly a v2 -> v1 -> v2 change has yet another effect which wasn't accounted for: During the first change, status pages would be freed. During the second change they would be allocated again. Hence across the full pair of change the addresses of the status pages may change, rendering stale previously calculated pointers into the status array. IMPACT ====== An unprivileged guest may be able to elevate its privileges to that of the host. Information leaks and Denial of Service (DoS) are possible as well. VULNERABLE SYSTEMS ================== All Xen versions from 4.0 onwards are vulnerable. Xen versions 3.4 and earlier are not vulnerable. Only x86 guests permitted to use grant table version 2 interfaces can leverage this vulnerability. On Arm, grant table v2 use is explicitly unsupported. Only multi-vCPU guests can leverage this vulnerability. Xen versions 4.13 and newer offer a way to build Xen without grant table support. Such hypervisors (CONFIG_GRANT_TABLE turned off) are not vulnerable. MITIGATION ========== Using the "gnttab=max-ver:1" hypervisor command line option will avoid the vulnerability. Using the "max_grant_version=1" guest configuration option for guests will also avoid the vulnerability. CREDITS ======= This issue was discovered by Claude Opus and diagnosed as a security issue by Teddy Astie of Vates. RESOLUTION ========== Applying the appropriate attached patch resolves this issue. Note that patches for released versions are generally prepared to apply to the stable branches, and may not apply cleanly to the most recent release tarball. Downstreams are encouraged to update to the tip of the stable branch before applying these patches. xsa517.patch xen-unstable - Xen 4.17.x $ sha256sum xsa517* 0f114af84cd925f8bc69b26386e2e4a95a52f947bc400f961a9e1ba46c0a2e05 xsa517.patch $ DEPLOYMENT DURING EMBARGO ========================= Deployment of the patches described above (or others which are substantially similar) is permitted during the embargo, even on public- facing systems with untrusted guest users and administrators. HOWEVER, deployment of the mitigation is NOT permitted (except where all the affected systems and VMs are administered and used only by organisations which are members of the Xen Project Security Issues Predisclosure List). Specifically, deployment on public cloud systems is NOT permitted. This is because restricting the available grant table version is a guest visible configuration change, which may lead to re-discovery of the issue. Deployment of this mitigation is permitted only AFTER the embargo ends. AND: Distribution of updated software is prohibited (except to other members of the predisclosure list). Predisclosure list members who wish to deploy significantly different patches and/or mitigations, please contact the Xen Project Security Team. (Note: this during-embargo deployment notice is retained in post-embargo publicly released Xen Project advisories, even though it is then no longer applicable. This is to enable the community to have oversight of the Xen Project Security Team's decisionmaking.) For more information about permissible uses of embargoed information, consult the Xen Project community's agreed Security Policy: http://www.xenproject.org/security-policy.html -----BEGIN PGP SIGNATURE----- iQFABAEBCAAqFiEEI+MiLBRfRHX6gGCng/4UyVfoK9kFAmrOIlkMHHBncEB4ZW4u b3JnAAoJEIP+FMlX6CvZAGUH/3wERoCBP6lIwfFmIMiAcqVVctqz6/8OgplQEp8A inNRPR8Avx++0lt4AdERiNYy3xwxGAZzJsxYC3ipCaHvMwOmm11DiMX5yuhvefNw TJxWaWut2QmF0Vi0G4acvvlfslb9JA9quEgLDzF/2dMiyHzTL4xvdeJ5OR5zXAoD hexjk0DCSDcYRHnD0OautofMGTaBaGJVHz08uRNkz3gOxumAeKnxmfelF8QgnTb3 jRYIt5z+Kye8oXZ0uTVY86YR7YbuiaHAJx1YZzceyfaVjJzvS8ZsTFt2CXshcex8 33fw3iQnY9ImA/NC11y4OLt8F8nb+Ge2Cge98wBt8NPSoBc= =SAIu -----END PGP SIGNATURE----- --=separator Content-Type: application/octet-stream; name="xsa517.patch" Content-Disposition: attachment; filename="xsa517.patch" Content-Transfer-Encoding: base64 RnJvbTogSmFuIEJldWxpY2ggPGpiZXVsaWNoQHN1c2UuY29tPgpTdWJqZWN0OiBnbnR0YWI6IGFk ZHJlc3MgZmFsbG91dCBmcm9tIFhTQS01MDEKCkEgdjEgLT4gdjIgY2hhbmdlIGlzbid0IHRoZSBv bmx5IHNjZW5hcmlvIHdoZXJlICJzdGF0dXMiIG1heSBnbyBzdGFsZSBpbgptYXBfZ3JhbnRfcmVm KCkuIEFjcm9zcyBhIHYyIC0+IHYxIC0+IHYyIGNoYW5nZSB0aGUgc3RhdHVzIHBhZ2VzIHdvdWxk CmhhdmUgYmVlbiBmcmVlZCBhbmQgcmUtcG9wdWxhdGVkLCBwb3NzaWJseSBjaGFuZ2luZyB0aGUg cGFnZXMgdXNlZCBmb3IgdGhlCmFycmF5LiBDaGVjayB0aGUgcG9pbnRlciBhZ2FpbnN0IHRoZSBl eHBlY3RlZCB2ZXJzaW9uLWRlcGVuZGVudCB2YWx1ZS4KClRoaXMgaXMgWFNBLTUxNyAvIENWRS0y MDI2LTc5NjEwLgoKRml4ZXM6IDk2ZGZlYjQxNzc0YSAoImdudHRhYjogY29wZSB3aXRoIHZlcnNp b24gY2hhbmdlcyByYWNpbmcgb3RoZXIgb3BlcmF0aW9ucyIpCkFzc2lzdGVkLWJ5OiBDbGF1ZGUK UmVwb3J0ZWQtYnk6IFRlZGR5IEFzdGllIDx0ZWRkeS5hc3RpZUB2YXRlcy50ZWNoPgpTaWduZWQt b2ZmLWJ5OiBKYW4gQmV1bGljaCA8amJldWxpY2hAc3VzZS5jb20+ClJldmlld2VkLWJ5OiBUZWRk eSBBc3RpZSA8dGVkZHkuYXN0aWVAdmF0ZXMudGVjaD4KLS0tCnYyOiBBZGQgcGFyZW50aGVzZXMg YXJvdW5kIHRoZSB8fCBleHByZXNzaW9uLgoKLS0tIGEveGVuL2NvbW1vbi9ncmFudF90YWJsZS5j CisrKyBiL3hlbi9jb21tb24vZ3JhbnRfdGFibGUuYwpAQCAtMTM1MCwxMyArMTM1MCwxOSBAQCBt YXBfZ3JhbnRfcmVmKAogCiAgICAgZ3JhbnRfcmVhZF9sb2NrKHJndCk7CiAKLSAgICBpZiAoIHVu bGlrZWx5KGV2YWx1YXRlX25vc3BlYygocmd0LT5ndF92ZXJzaW9uID09IDEpICE9Ci0gICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgKHN0YXR1cyA9PSAmc2hhaC0+ZmxhZ3MpKSkgKQor ICAgIC8qCisgICAgICogQWZ0ZXIgYSB2MSAtPiB2MiBjaGFuZ2UgYmVoaW5kIG91ciBiYWNrcyAi cmVmIiBtYXkgbm93IGJlIG91dCBvZgorICAgICAqIGJvdW5kcy4gIFdoaWxlIGFmdGVyIGEgdjIg LT4gdjEgLT4gdjIgY2hhbmdlICJyZWYiIHdvdWxkIHN0aWxsIGJlCisgICAgICogc3VpdGFibHkg Ym91bmRlZCwgdGhlIHVuZGVybHlpbmcgc3RhdHVzIHBhZ2UgbWF5IGhhdmUgbW92ZWQuCisgICAg ICovCisgICAgaWYgKCBldmFsdWF0ZV9ub3NwZWMocmd0LT5ndF92ZXJzaW9uID09IDEKKyAgICAg ICAgICAgICAgICAgICAgICAgICA/IHN0YXR1cyAhPSAmc2hhaC0+ZmxhZ3MKKyAgICAgICAgICAg ICAgICAgICAgICAgICA6IChyZWYgPj0gbnJfZ3JhbnRfZW50cmllcyhyZ3QpIHx8CisgICAgICAg ICAgICAgICAgICAgICAgICAgICAgc3RhdHVzICE9ICZzdGF0dXNfZW50cnkocmd0LCByZWYpKSkg KQogICAgIHsKICAgICAgICAgLyoKLSAgICAgICAgICogQWZ0ZXIgYSB2MSAtPiB2MiBjaGFuZ2Ug YmVoaW5kIG91ciBiYWNrcyAicmVmIiBtYXkgbm93IGJlIG91dCBvZgotICAgICAgICAgKiBib3Vu ZHMuICBSZWNhbGN1bGF0ZSBpdCwgYnV0IG9ubHkgZm9yIHJlc2VydmVkIGVudHJpZXMuICBPdGhl cnMKLSAgICAgICAgICogd2lsbCBoYXZlIGJlZW4gY2xlYXJlZCBhbnl3YXkgYnkgdGhlIHZlcnNp b24gY2hhbmdlLgorICAgICAgICAgKiBSZWNhbGN1bGF0ZSBzdGF0dXMsIGJ1dCBvbmx5IGZvciBy ZXNlcnZlZCBlbnRyaWVzLiAgT3RoZXJzIHdpbGwKKyAgICAgICAgICogaGF2ZSBiZWVuIGNsZWFy ZWQgYW55d2F5IGJ5IHRoZSB2ZXJzaW9uIGNoYW5nZShzKS4KICAgICAgICAgICovCiAgICAgICAg IGlmICggcmVmIDwgR05UVEFCX05SX1JFU0VSVkVEX0VOVFJJRVMgKQogICAgICAgICAgICAgc3Rh dHVzID0gZXZhbHVhdGVfbm9zcGVjKHJndC0+Z3RfdmVyc2lvbiA9PSAxKQo= --=separator-- From xen-announce-bounces@lists.xenproject.org Tue Oct 13 12:28:56 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 13 Oct 2026 12:28:56 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1447102.1663268 (Exim 4.92) (envelope-from ) id 1xGbcS-0004pW-KB; Tue, 13 Oct 2026 12:28:36 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1447102.1663268; Tue, 13 Oct 2026 12:28:36 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1xGbcS-0004oy-GY; Tue, 13 Oct 2026 12:28:36 +0000 Received: by outflank-mailman (input) for mailman id 1447102; Tue, 13 Oct 2026 12:28:35 +0000 Received: from mx.expurgate.net ([195.190.135.10]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1xGbcR-0004oV-4U; Tue, 13 Oct 2026 12:28:35 +0000 Received: from mx.expurgate.net (helo=localhost) by mx.expurgate.net with esmtp id 1xGbcQ-00FMeE-HP; Tue, 13 Oct 2026 14:28:34 +0200 Received: from [10.42.69.1] (helo=localhost) by localhost with ESMTP (eXpurgate MTA 0.9.1) (envelope-from ) id 6ace23ec-bab6-0a2a0a5309dd-0a2a4501bdb4-6 for ; Tue, 13 Oct 2026 14:28:34 +0200 Received: from [104.130.215.37] (helo=mail.xenproject.org) by tlsNG-d62444.mxtls.expurgate.net with ESMTPS (eXpurgate 4.57.1) (envelope-from ) id 6ace23f0-5984-0a2a45010019-6882d725c4a6-3 for ; Tue, 13 Oct 2026 14:28:34 +0200 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.98.2) (envelope-from ) id 1xGbcM-00000003NGC-2C5h; Tue, 13 Oct 2026 12:28:30 +0000 Received: from andrewcoop by xenbits.xenproject.org with local (Exim 4.98.2) (envelope-from ) id 1xGbcM-0000000F8M0-0z6F; Tue, 13 Oct 2026 12:28:30 +0000 X-BeenThere: xen-announce@lists.xenproject.org List-Id: "Xen announcements \(low volume\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-announce-bounces@lists.xenproject.org Precedence: list Sender: "Xen-announce" Authentication-Results: eu.smtp.expurgate.cloud; none Content-Type: multipart/mixed; boundary="=separator"; charset="utf-8" Content-Transfer-Encoding: binary MIME-Version: 1.0 X-Mailer: MIME-tools 5.515 (Entity 5.515) To: xen-announce@lists.xen.org, xen-devel@lists.xen.org, xen-users@lists.xen.org, oss-security@lists.openwall.com From: Xen.org security team CC: Xen.org security team Subject: Xen Security Advisory 514 v2 (CVE-2026-79607) - Xenstore: Guests can crash xenstored during Live Update Message-Id: Date: Tue, 13 Oct 2026 12:28:30 +0000 X-purgate-ID: tlsNG-d62444/1791894514-1F66C757-68071524/0/0 X-purgate-type: clean X-purgate-size: 5581 --=separator Content-Type: text/plain; charset="utf-8" Content-Disposition: inline Content-Transfer-Encoding: 7bit -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Xen Security Advisory CVE-2026-79607 / XSA-514 version 2 Xenstore: Guests can crash xenstored during Live Update UPDATES IN VERSION 2 ==================== Public release. ISSUE DESCRIPTION ================= During Xenstore live update the state record for a Xenstore watch with specified watch depth is written with two bytes missing. This results in an inconsistent state when reading the state back in the new Xenstore, causing a crash of Xenstore or wrong Xenstore data. IMPACT ====== An unprivileged guest can cause the Xenstore service to crash or to get corrupted during a live update of Xenstore, causing a DoS of the host regarding further domain administration actions. VULNERABLE SYSTEMS ================== Only systems running Xen 4.22 are vulnerable. Systems running Xen 4.21 or older are not vulnerable. Only systems running C xenstore either as daemon or as stubdom are vulnerable. Systems running oxenstored are not vulnerable. MITIGATION ========== Not doing a live update of Xenstore avoids the vulnerability. Switching to oxenstored avoids the vulnerability. CREDITS ======= This issue was discovered by Andrii Sultanov of Vates. RESOLUTION ========== Applying the attached patch resolves this issue. Note that patches for released versions are generally prepared to apply to the stable branches, and may not apply cleanly to the most recent release tarball. Downstreams are encouraged to update to the tip of the stable branch before applying these patches. xsa514.patch xen-unstable - Xen 4.22.x $ sha256sum xsa514* 8774d9b45db75851560db70a9be06d5e379311bd3042d9049bc29456e141ae7d xsa514.patch $ DEPLOYMENT DURING EMBARGO ========================= Deployment of the patches described above (or others which are substantially similar) is permitted during the embargo, even on public-facing systems with untrusted guest users and administrators. Not doing a live update of Xenstore as a mitigation is permitted. Switching to oxenstored is not permitted, as this is a guest visible configuration change. But: Distribution of updated software is prohibited (except to other members of the predisclosure list). Predisclosure list members who wish to deploy significantly different patches and/or mitigations, please contact the Xen Project Security Team. (Note: this during-embargo deployment notice is retained in post-embargo publicly released Xen Project advisories, even though it is then no longer applicable. This is to enable the community to have oversight of the Xen Project Security Team's decisionmaking.) For more information about permissible uses of embargoed information, consult the Xen Project community's agreed Security Policy: http://www.xenproject.org/security-policy.html -----BEGIN PGP SIGNATURE----- iQFABAEBCAAqFiEEI+MiLBRfRHX6gGCng/4UyVfoK9kFAmrOIa8MHHBncEB4ZW4u b3JnAAoJEIP+FMlX6CvZB5YH+wf2251Z1DOOtQcCB1LV9vsunIaEGd5l7pHdIZ3a 3j9A6r/KGc+RtSgDB9TWCMgjKLbBfwivOxBHHhxjhejsfnUKUJNryJFLn86plFdu VRrdk5pHmypNgb9mCf3KQ8BQputnuAu36QuIlw3F5z5XAanmyurT1QJKV0RXLrQF J3ROkGAGYp6gHhPDBFwCi/dWE/I1PRfvi53oyPPflj2kAh3DPwycpPQV0JZommjC ljh1uvyPMnwr76nnh5e4LmismWa9Gks/p3BQuF01w3Prj/vR4wRxLEMCPjhK6xV6 PLcKgrt+DGn/xwj7fEdaAVlXyh4YcxQlmUWHzaNm94Knq+8= =BuOZ -----END PGP SIGNATURE----- --=separator Content-Type: application/octet-stream; name="xsa514.patch" Content-Disposition: attachment; filename="xsa514.patch" Content-Transfer-Encoding: base64 RnJvbSA2ODE2M2U3MzI5OTQ5ZjUwOWQ2MGMyMzllMDRlNWVkN2YwYzZiYzBlIE1vbiBTZXAgMTcg MDA6MDA6MDAgMjAwMQpGcm9tOiBKdWVyZ2VuIEdyb3NzIDxqZ3Jvc3NAc3VzZS5jb20+CkRhdGU6 IEZyaSwgMTggU2VwIDIwMjYgMTI6MjU6MDcgKzAyMDAKU3ViamVjdDogW1BBVENIXSB0b29scy94 ZW5zdG9yZWQ6IGZpeCBsaXZlIHVwZGF0ZSB3aXRoIHdhdGNoZXMgc3BlY2lmeWluZwogZGVwdGgK CkR1ZSB0byBhIHR5cG8gdGhlIHN0YXRlIHJlY29yZCBmb3IgYSB3YXRjaCBzcGVjaWZ5aW5nIGEg ZGVwdGggaXMKd3JpdHRlbiBvbmx5IHBhcnRpYWxseS4gSW5zdGVhZCBvZiB1c2luZyB0aGUgY29y cmVjdCBsZW5ndGggb2YgdGhlCnhzX3N0YXRlX3dhdGNoX2V4dCBzdHJ1Y3R1cmUgb25seSB0aGUg bGVuZ3RoIG9mIHRoZSB4c19zdGF0ZV93YXRjaApzdHJ1Y3R1cmUgd2FzIHVzZWQgd2hlbiB3cml0 aW5nIHRoZSBkYXRhLgoKRml4IHRoYXQgYnkgdXNpbmcgdGhlIGNvcnJlY3QgbGVuZ3RoLgoKVGhp cyBpcyBYU0EtNTE0IC8gQ1ZFLTIwMjYtNzk2MDcKCkZpeGVzOiBkYjk4ZGUxMjBjYjggKCJ0b29s cy94ZW5zdG9yZWQ6IGFkZCBkZXB0aCBpbmZvcm1hdGlvbiB0byB3YXRjaGVzIikKUmVwb3J0ZWQt Ynk6IEFuZHJpaSBTdWx0YW5vdiA8YW5kcml5LnN1bHRhbm92QHZhdGVzLnRlY2g+ClNpZ25lZC1v ZmYtYnk6IEp1ZXJnZW4gR3Jvc3MgPGpncm9zc0BzdXNlLmNvbT4KLS0tCiB0b29scy94ZW5zdG9y ZWQvd2F0Y2guYyB8IDIgKy0KIDEgZmlsZSBjaGFuZ2VkLCAxIGluc2VydGlvbigrKSwgMSBkZWxl dGlvbigtKQoKZGlmZiAtLWdpdCBhL3Rvb2xzL3hlbnN0b3JlZC93YXRjaC5jIGIvdG9vbHMveGVu c3RvcmVkL3dhdGNoLmMKaW5kZXggYzE0M2U2ZmJjZi4uNzA5N2FiMGIwZCAxMDA2NDQKLS0tIGEv dG9vbHMveGVuc3RvcmVkL3dhdGNoLmMKKysrIGIvdG9vbHMveGVuc3RvcmVkL3dhdGNoLmMKQEAg LTM1NCw3ICszNTQsNyBAQCBjb25zdCBjaGFyICpkdW1wX3N0YXRlX3dhdGNoZXMoRklMRSAqZnAs IHN0cnVjdCBjb25uZWN0aW9uICpjb25uLAogCQkJcmV0dXJuICJEdW1wIHdhdGNoIHN0YXRlIGVy cm9yIjsKIAogCQlpZiAod2F0Y2gtPmRlcHRoID49IDApIHsKLQkJCWlmIChmd3JpdGUoJnN3ZSwg c2l6ZW9mKHN3KSwgMSwgZnApICE9IDEpCisJCQlpZiAoZndyaXRlKCZzd2UsIHNpemVvZihzd2Up LCAxLCBmcCkgIT0gMSkKIAkJCQlyZXR1cm4gIkR1bXAgd2F0Y2ggc3RhdGUgZXh0IGVycm9yIjsK IAkJfSBlbHNlIHsKIAkJCWlmIChmd3JpdGUoJnN3LCBzaXplb2Yoc3cpLCAxLCBmcCkgIT0gMSkK LS0gCjIuNTUuMAoK --=separator-- From xen-announce-bounces@lists.xenproject.org Tue Oct 13 12:29:00 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 13 Oct 2026 12:29:00 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1447127.1663420 (Exim 4.92) (envelope-from ) id 1xGbcp-0000aL-DV; Tue, 13 Oct 2026 12:28:59 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1447127.1663420; Tue, 13 Oct 2026 12:28:59 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1xGbco-0000WU-Vz; Tue, 13 Oct 2026 12:28:58 +0000 Received: by outflank-mailman (input) for mailman id 1447127; Tue, 13 Oct 2026 12:28:57 +0000 Received: from mx.expurgate.net ([194.145.224.20]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1xGbcm-0008PB-KU; Tue, 13 Oct 2026 12:28:56 +0000 Received: from mx.expurgate.net (helo=localhost) by mx.expurgate.net with esmtp id 1xGbcl-00DIPB-Vs; Tue, 13 Oct 2026 14:28:55 +0200 Received: from [10.42.69.1] (helo=localhost) by localhost with ESMTP (eXpurgate MTA 0.9.1) (envelope-from ) id 6ace2403-2eae-0a2a0a5409dd-0a2a4501ece6-14 for ; Tue, 13 Oct 2026 14:28:55 +0200 Received: from [104.130.215.37] (helo=mail.xenproject.org) by tlsNG-d62444.mxtls.expurgate.net with ESMTPS (eXpurgate 4.57.1) (envelope-from ) id 6ace2406-5984-0a2a45010019-6882d7259974-3 for ; Tue, 13 Oct 2026 14:28:55 +0200 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.98.2) (envelope-from ) id 1xGbci-00000003NHh-2Uhh; Tue, 13 Oct 2026 12:28:52 +0000 Received: from andrewcoop by xenbits.xenproject.org with local (Exim 4.98.2) (envelope-from ) id 1xGbci-0000000F8xP-1Sbi; Tue, 13 Oct 2026 12:28:52 +0000 X-BeenThere: xen-announce@lists.xenproject.org List-Id: "Xen announcements \(low volume\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-announce-bounces@lists.xenproject.org Precedence: list Sender: "Xen-announce" Authentication-Results: eu.smtp.expurgate.cloud; none Content-Type: multipart/mixed; boundary="=separator"; charset="utf-8" Content-Transfer-Encoding: binary MIME-Version: 1.0 X-Mailer: MIME-tools 5.515 (Entity 5.515) To: xen-announce@lists.xen.org, xen-devel@lists.xen.org, xen-users@lists.xen.org, oss-security@lists.openwall.com From: Xen.org security team CC: Xen.org security team Subject: Xen Security Advisory 518 v2 (CVE-2026-79611) - VMX: VMentry failure with branch tracing and blocked states Message-Id: Date: Tue, 13 Oct 2026 12:28:52 +0000 X-purgate-ID: tlsNG-d62444/1791894535-1E664757-CCC5F802/0/0 X-purgate-type: clean X-purgate-size: 13424 --=separator Content-Type: text/plain; charset="utf-8" Content-Disposition: inline Content-Transfer-Encoding: 7bit -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Xen Security Advisory CVE-2026-79611 / XSA-518 version 2 VMX: VMentry failure with branch tracing and blocked states UPDATES IN VERSION 2 ==================== Public release. ISSUE DESCRIPTION ================= For XSA-308 logic was introduced, as VMX VMEntry checks do not like the exact combination of state which occurs when #DB in intercepted, Single Stepping is active, and blocked by STI/MovSS is active, despite this being a legitimate state to be in. The resulting VMEntry failure is fatal to the guest. Sadly there is another special sub-case of the above, with branch tracing enabled. In that case the prior adjustment would still cause a VMentry failure, as before fatal to the guest. IMPACT ====== HVM/PVH guest userspace code may be able to crash the guest, resulting in a guest Denial of Service. VULNERABLE SYSTEMS ================== All versions of Xen are affected. Only systems supporting VMX hardware virtual extensions (Intel, VIA or Zhaoxin CPUs) are affected. Arm as well as AMD and Hygon systems are unaffected. Only HVM/PVH guests are affected. PV guests cannot leverage the vulnerability. MITIGATION ========== Running only PV guests will avoid this vulnerability. Running HVM guests on only AMD or Hygon hardware will also avoid this vulnerability. CREDITS ======= This issue was discovered by Claude Opus and diagnosed as a security issue by Teddy Astie of Vates. RESOLUTION ========== Applying the appropriate attached patch resolves this issue. Note that patches for released versions are generally prepared to apply to the stable branches, and may not apply cleanly to the most recent release tarball. Downstreams are encouraged to update to the tip of the stable branch before applying these patches. xsa518.patch xen-unstable - Xen 4.21.x xsa518-4.20.patch Xen 4.20.x - Xen 4.17.x $ sha256sum xsa518* a703af59b22f1e47543af0668c8715b4e4011ba4fc05fd8b94bf05503dce88ef xsa518.patch a1a1b3548166e051f62a0759af5df8d365f524ae52f4bbbe642d45692a1f8bde xsa518-4.20.patch $ DEPLOYMENT DURING EMBARGO ========================= Deployment of the patches and/or mitigations described above (or others which are substantially similar) is permitted during the embargo, even on public-facing systems with untrusted guest users and administrators. But: Distribution of updated software is prohibited (except to other members of the predisclosure list). Predisclosure list members who wish to deploy significantly different patches and/or mitigations, please contact the Xen Project Security Team. -----BEGIN PGP SIGNATURE----- iQFABAEBCAAqFiEEI+MiLBRfRHX6gGCng/4UyVfoK9kFAmrOIooMHHBncEB4ZW4u b3JnAAoJEIP+FMlX6CvZTOUIAMMapd/RMFzQxmwdwICbmj2zDnEWutkzQyV0bMMK Ui2VleXQ7pDWH5OEfDNl6644Gs6x4zB9lrTZFubAFvXjqNUk9C3QxU6LOlV0RQAq a96/glbPhXhOONdn1K5DuJq35sKjhGdsy8B+Ati+IGPstT8bGytrz+CVbdR1bnLb 3XvnRHqFSEHoQxejE/aRXpRw4k1HHD5wFQ/WfvgOEKYj+Ghjm+KE2sNhcahxxFf4 ys8v9JWBKhnLAe+mJIiMPGiKmX5uUVl6HhdX6SjTHuzzbsmITF3VOwsnHZR9vLn1 BqUwLG/uQKes4LRinfOA5RrOMt/q/ChjXPw2x6IZZJLjHVk= =hyph -----END PGP SIGNATURE----- --=separator Content-Type: application/octet-stream; name="xsa518.patch" Content-Disposition: attachment; filename="xsa518.patch" Content-Transfer-Encoding: base64 RnJvbTogQW5kcmV3IENvb3BlciA8YW5kcmV3LmNvb3BlcjNAY2l0cml4LmNvbT4KU3ViamVjdDog eDg2L3ZteDogUmV3b3JrICNEQiBpbnRlcmNlcHQgbG9naWMgdG8gZml4IFZNRW50cnkgZmFpbHVy ZSB3aXRoIEJURgoKVGhlIGNvbnNpc3RlbmN5IGNoZWNrcyBpbiBlZmZlY3Qgd2hlbiBCbG9ja2Vk LWJ5LVNUSS9Nb3ZTUyBhcmUgYWN0aXZlIGluY2x1ZGVzCkRFQlVHQ1RMLkJURiB0b28uICBUYWtl IHRoaXMgaW50byBhY2NvdW50IHdoZW4gZWRpdGluZyBQRU5ESU5HX0RCRy5CUy4KClRoaXMgZW5k cyB1cCBuYXJyb3dpbmcgdGhlIGNhc2VzIHdoZXJlIFBFTkRJTkdfREJHIGlzIG1vZGlmaWVkLiAg UmV3b3JrIHRoZQpjb21tZW50IHRvIGJlIG1vcmUgcHJlY2lzZS4KClRoaXMgaXMgWFNBLTUxOCAv IENWRS0yMDI2LTc5NjExLgoKRml4ZXM6IDFkM2ViODI1OTgwNCAoIng4Ni92dHg6IFdvcmsgYXJv dW5kIFNpbmdsZVN0ZXAgKyBTVEkvTW92U1MgVk1FbnRyeSBmYWlsdXJlcyIpClJlcG9ydGVkLWJ5 OiBUZWRkeSBBc3RpZSA8dGVkZHkuYXN0aWVAdmF0ZXMudGVjaD4KU2lnbmVkLW9mZi1ieTogQW5k cmV3IENvb3BlciA8YW5kcmV3LmNvb3BlcjNAY2l0cml4LmNvbT4KUmV2aWV3ZWQtYnk6IEphbiBC ZXVsaWNoIDxqYmV1bGljaEBzdXNlLmNvbT4KUmV2aWV3ZWQtYnk6IFRlZGR5IEFzdGllIDx0ZWRk eS5hc3RpZUB2YXRlcy50ZWNoPgotLS0KIHhlbi9hcmNoL3g4Ni9odm0vdm14L3ZteC5jIHwgNDEg KysrKysrKysrKysrKysrKystLS0tLS0tLS0tLS0tLS0tLS0tLS0KIDEgZmlsZSBjaGFuZ2VkLCAx OCBpbnNlcnRpb25zKCspLCAyMyBkZWxldGlvbnMoLSkKCmRpZmYgLS1naXQgYS94ZW4vYXJjaC94 ODYvaHZtL3ZteC92bXguYyBiL3hlbi9hcmNoL3g4Ni9odm0vdm14L3ZteC5jCmluZGV4IDYyMzc2 MjNhNGMxNi4uOTdkZDM3ZGQ3Y2U0IDEwMDY0NAotLS0gYS94ZW4vYXJjaC94ODYvaHZtL3ZteC92 bXguYworKysgYi94ZW4vYXJjaC94ODYvaHZtL3ZteC92bXguYwpAQCAtNDM5NiwzMyArNDM5Niwy OCBAQCB2b2lkIGFzbWxpbmthZ2Ugdm14X3ZtZXhpdF9oYW5kbGVyKHN0cnVjdCBjcHVfdXNlcl9y ZWdzICpyZWdzKQogICAgICAgICAgICAgICogV2UgaW50ZXJjZXB0ICNEQiB1bmNvbmRpdGlvbmFs bHkgdG8gd29yayBhcm91bmQgQ1ZFLTIwMTUtODEwNCAvCiAgICAgICAgICAgICAgKiBYU0EtMTU2 IChndWVzdC1rZXJuZWwgaW5kdWNlZCBob3N0IERvUykuCiAgICAgICAgICAgICAgKgotICAgICAg ICAgICAgICogU1RJL01vdlNTIHNoYWRvd3MgYmxvY2svZGVmZXIgaW50ZXJydXB0cy9leGNlcHRp b25zIChleGFjdAotICAgICAgICAgICAgICogZGV0YWlscyBhcmUgY29tcGxpY2F0ZWQgYW5kIHBv b3JseSBkb2N1bWVudGVkKS4gIERlYnVnCi0gICAgICAgICAgICAgKiBleGNlcHRpb25zIGRlbGF5 ZWQgZm9yIGFueSByZWFzb24gYXJlIHN0b3JlZCBpbiB0aGUKLSAgICAgICAgICAgICAqIFBFTkRJ TkdfREJHX0VYQ0VQVElPTlMgZmllbGQuCisgICAgICAgICAgICAgKiBNb3N0IHNvdXJjZXMgb2Yg I0RCIGFjY3VtdWF0ZSBzdGF0dXMgaW4gUEVORElOR19EQkcsIHdoaWNoIGFyZQorICAgICAgICAg ICAgICogdGhlbiBkaXNwYXRjaGVkIGluIHByaW9yaXR5IG9yZGVyIHByaW9yIHRvIGZldGNoaW5n IHRoZSBuZXh0CisgICAgICAgICAgICAgKiBpbnN0cnVjdGlvbi4gIFdoZW4gdGhlICNEQiBpbnRl cmNlcHQgdHJpZ2dlcnMsIFBFTkRJTkdfREJHIGlzIDAKKyAgICAgICAgICAgICAqIHdpdGggdGhl IHN0YXR1cyBiaXRzIGhhdmluZyBtb3ZlZCBpbnRvIEVYSVRfUVVBTElGSUNBVElPTi4KICAgICAg ICAgICAgICAqCi0gICAgICAgICAgICAgKiBUaGUgZmFsbGluZyBlZGdlIG9mIFBFTkRJTkdfREJH IGNhdXNlcyAjREIgdG8gYmUgZGVsaXZlcmVkLAotICAgICAgICAgICAgICogcmVzdWx0aW5nIGlu IGEgVk1FeGl0LCBhcyAjREIgaXMgaW50ZXJjZXB0ZWQuICBUaGUgVk1DUyBzdGlsbAotICAgICAg ICAgICAgICogcmVwb3J0cyBibG9ja2VkLWJ5LVNUSS9Nb3ZTUy4KKyAgICAgICAgICAgICAqIEF0 IGFueSBwb2ludCBpZiBCbG9ja2VkLWJ5LVNUSS9Nb3ZTUyBhcmUgYWN0aXZlLCBleHRyYSBWTUVu dHJ5CisgICAgICAgICAgICAgKiBjb25zaXN0ZW5jeSBjaGVja3MgYXJlIGFwcGxpZWQsIGNyb3Nz LWNoZWNraW5nIEVGTEFHUy5URiwKKyAgICAgICAgICAgICAqIFBFTkRJTkdfREJHLkJTIGFuZCBE RUJVR0NUTC5CVEYuICBUaGVzZSBjb25zaXN0ZW5jeSBjaGVja3MKKyAgICAgICAgICAgICAqIGFw cGx5IHRvIEFjdGl2aXR5LXN0YXRlLUhMVCB0b28sIGJ1dCBYZW4gZG9lc24ndCBzdXBwb3J0IHRo aXMuCiAgICAgICAgICAgICAgKgotICAgICAgICAgICAgICogVGhlIFZNRW50cnkgY2hlY2tzIHdo ZW4gRUZMQUdTLlRGIGlzIHNldCBkb24ndCBsaWtlIGEgVk1DUyBpbgotICAgICAgICAgICAgICog dGhpcyBzdGF0ZS4gIERlc3BpdGUgYSAjREIgcXVldWVkIGluIFZNRU5UUllfSU5UUl9JTkZPLCB0 aGUKLSAgICAgICAgICAgICAqIHN0YXRlIGlzIHJlamVjdGVkIGFzIERSNi5CUyBpc24ndCBwZW5k aW5nLiAgRml4IHRoaXMgdXAuCisgICAgICAgICAgICAgKiBUaGUgVk1DUyBzdGF0ZSBhdCB0aGUg cG9pbnQgb2YgI0RCIGludGVyY2VwdCBkb2VzIG5vdCBzYXRpc2Z5CisgICAgICAgICAgICAgKiB0 aGUgY29uc2lzdGVuY3kgY2hlY2tzLiAgSW4gdGhlIGNhc2UgdGhhdCBhIFNpbmdsZVN0ZXAgc2hv dWxkCisgICAgICAgICAgICAgKiBiZSBwZW5kaW5nLCBmaWxsIFBFTkRJTkdfREJHIGJhY2sgaW4g dG8gc2F0aXNmeSB0aGUgY29uc2l0ZW5jeQorICAgICAgICAgICAgICogY2hlY2suCiAgICAgICAg ICAgICAgKi8KLSAgICAgICAgICAgIGlmICggdW5saWtlbHkocmVncy0+ZWZsYWdzICYgWDg2X0VG TEFHU19URikgKQorICAgICAgICAgICAgaWYgKCB1bmxpa2VseShyZWdzLT5lZmxhZ3MgJiBYODZf RUZMQUdTX1RGKSAmJgorICAgICAgICAgICAgICAgICAodm1yZWFkKEdVRVNUX0lOVEVSUlVQVElC SUxJVFlfSU5GTykgJgorICAgICAgICAgICAgICAgICAgKFZNWF9JTlRSX1NIQURPV19TVEkgfCBW TVhfSU5UUl9TSEFET1dfTU9WX1NTKSkgJiYKKyAgICAgICAgICAgICAgICAgISh2bXJlYWQoR1VF U1RfSUEzMl9ERUJVR0NUTCkgJiBJQTMyX0RFQlVHQ1RMTVNSX0JURikgKQogICAgICAgICAgICAg ewotICAgICAgICAgICAgICAgIHVuc2lnbmVkIGxvbmcgaW50X2luZm87Ci0KLSAgICAgICAgICAg ICAgICBfX3ZtcmVhZChHVUVTVF9JTlRFUlJVUFRJQklMSVRZX0lORk8sICZpbnRfaW5mbyk7Ci0K LSAgICAgICAgICAgICAgICBpZiAoIGludF9pbmZvICYgKFZNWF9JTlRSX1NIQURPV19TVEkgfCBW TVhfSU5UUl9TSEFET1dfTU9WX1NTKSApCi0gICAgICAgICAgICAgICAgewotICAgICAgICAgICAg ICAgICAgICB1bnNpZ25lZCBsb25nIHBlbmRpbmdfZGJnOwotCi0gICAgICAgICAgICAgICAgICAg IF9fdm1yZWFkKEdVRVNUX1BFTkRJTkdfREJHX0VYQ0VQVElPTlMsICZwZW5kaW5nX2RiZyk7Ci0g ICAgICAgICAgICAgICAgICAgIF9fdm13cml0ZShHVUVTVF9QRU5ESU5HX0RCR19FWENFUFRJT05T LAotICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgcGVuZGluZ19kYmcgfCBEUl9TVEVQKTsK LSAgICAgICAgICAgICAgICB9CisgICAgICAgICAgICAgICAgQVNTRVJUKHZtcmVhZChHVUVTVF9Q RU5ESU5HX0RCR19FWENFUFRJT05TKSA9PSAwKTsKKyAgICAgICAgICAgICAgICBfX3Ztd3JpdGUo R1VFU1RfUEVORElOR19EQkdfRVhDRVBUSU9OUywgWDg2X0RSNl9CUyk7CiAgICAgICAgICAgICB9 CiAKICAgICAgICAgICAgIGlmICggIXYtPmRvbWFpbi0+ZGVidWdnZXJfYXR0YWNoZWQgKQo= --=separator Content-Type: application/octet-stream; name="xsa518-4.20.patch" Content-Disposition: attachment; filename="xsa518-4.20.patch" Content-Transfer-Encoding: base64 RnJvbTogQW5kcmV3IENvb3BlciA8YW5kcmV3LmNvb3BlcjNAY2l0cml4LmNvbT4KU3ViamVjdDog eDg2L3ZteDogUmV3b3JrICNEQiBpbnRlcmNlcHQgbG9naWMgdG8gZml4IFZNRW50cnkgZmFpbHVy ZSB3aXRoIEJURgoKVGhlIGNvbnNpc3RlbmN5IGNoZWNrcyBpbiBlZmZlY3Qgd2hlbiBCbG9ja2Vk LWJ5LVNUSS9Nb3ZTUyBhcmUgYWN0aXZlIGluY2x1ZGVzCkRFQlVHQ1RMLkJURiB0b28uICBUYWtl IHRoaXMgaW50byBhY2NvdW50IHdoZW4gZWRpdGluZyBQRU5ESU5HX0RCRy5CUy4KClRoaXMgZW5k cyB1cCBuYXJyb3dpbmcgdGhlIGNhc2VzIHdoZXJlIFBFTkRJTkdfREJHIGlzIG1vZGlmaWVkLiAg UmV3b3JrIHRoZQpjb21tZW50IHRvIGJlIG1vcmUgcHJlY2lzZS4KClRoaXMgaXMgWFNBLTUxOCAv IENWRS0yMDI2LTc5NjExLgoKRml4ZXM6IDFkM2ViODI1OTgwNCAoIng4Ni92dHg6IFdvcmsgYXJv dW5kIFNpbmdsZVN0ZXAgKyBTVEkvTW92U1MgVk1FbnRyeSBmYWlsdXJlcyIpClJlcG9ydGVkLWJ5 OiBUZWRkeSBBc3RpZSA8dGVkZHkuYXN0aWVAdmF0ZXMudGVjaD4KU2lnbmVkLW9mZi1ieTogQW5k cmV3IENvb3BlciA8YW5kcmV3LmNvb3BlcjNAY2l0cml4LmNvbT4KUmV2aWV3ZWQtYnk6IEphbiBC ZXVsaWNoIDxqYmV1bGljaEBzdXNlLmNvbT4KUmV2aWV3ZWQtYnk6IFRlZGR5IEFzdGllIDx0ZWRk eS5hc3RpZUB2YXRlcy50ZWNoPgoKLS0tIGEveGVuL2FyY2gveDg2L2h2bS92bXgvdm14LmMKKysr IGIveGVuL2FyY2gveDg2L2h2bS92bXgvdm14LmMKQEAgLTQyODEsMjYgKzQyODEsMzAgQEAgdm9p ZCBhc21saW5rYWdlIHZteF92bWV4aXRfaGFuZGxlcihzdHJ1YwogICAgICAgICAgICAgICogV2Ug aW50ZXJjZXB0ICNEQiB1bmNvbmRpdGlvbmFsbHkgdG8gd29yayBhcm91bmQgQ1ZFLTIwMTUtODEw NCAvCiAgICAgICAgICAgICAgKiBYU0EtMTU2IChndWVzdC1rZXJuZWwgaW5kdWNlZCBob3N0IERv UykuCiAgICAgICAgICAgICAgKgotICAgICAgICAgICAgICogU1RJL01vdlNTIHNoYWRvd3MgYmxv Y2svZGVmZXIgaW50ZXJydXB0cy9leGNlcHRpb25zIChleGFjdAotICAgICAgICAgICAgICogZGV0 YWlscyBhcmUgY29tcGxpY2F0ZWQgYW5kIHBvb3JseSBkb2N1bWVudGVkKS4gIERlYnVnCi0gICAg ICAgICAgICAgKiBleGNlcHRpb25zIGRlbGF5ZWQgZm9yIGFueSByZWFzb24gYXJlIHN0b3JlZCBp biB0aGUKLSAgICAgICAgICAgICAqIFBFTkRJTkdfREJHX0VYQ0VQVElPTlMgZmllbGQuCisgICAg ICAgICAgICAgKiBNb3N0IHNvdXJjZXMgb2YgI0RCIGFjY3VtdWF0ZSBzdGF0dXMgaW4gUEVORElO R19EQkcsIHdoaWNoIGFyZQorICAgICAgICAgICAgICogdGhlbiBkaXNwYXRjaGVkIGluIHByaW9y aXR5IG9yZGVyIHByaW9yIHRvIGZldGNoaW5nIHRoZSBuZXh0CisgICAgICAgICAgICAgKiBpbnN0 cnVjdGlvbi4gIFdoZW4gdGhlICNEQiBpbnRlcmNlcHQgdHJpZ2dlcnMsIFBFTkRJTkdfREJHIGlz IDAKKyAgICAgICAgICAgICAqIHdpdGggdGhlIHN0YXR1cyBiaXRzIGhhdmluZyBtb3ZlZCBpbnRv IEVYSVRfUVVBTElGSUNBVElPTi4KICAgICAgICAgICAgICAqCi0gICAgICAgICAgICAgKiBUaGUg ZmFsbGluZyBlZGdlIG9mIFBFTkRJTkdfREJHIGNhdXNlcyAjREIgdG8gYmUgZGVsaXZlcmVkLAot ICAgICAgICAgICAgICogcmVzdWx0aW5nIGluIGEgVk1FeGl0LCBhcyAjREIgaXMgaW50ZXJjZXB0 ZWQuICBUaGUgVk1DUyBzdGlsbAotICAgICAgICAgICAgICogcmVwb3J0cyBibG9ja2VkLWJ5LVNU SS9Nb3ZTUy4KKyAgICAgICAgICAgICAqIEF0IGFueSBwb2ludCBpZiBCbG9ja2VkLWJ5LVNUSS9N b3ZTUyBhcmUgYWN0aXZlLCBleHRyYSBWTUVudHJ5CisgICAgICAgICAgICAgKiBjb25zaXN0ZW5j eSBjaGVja3MgYXJlIGFwcGxpZWQsIGNyb3NzLWNoZWNraW5nIEVGTEFHUy5URiwKKyAgICAgICAg ICAgICAqIFBFTkRJTkdfREJHLkJTIGFuZCBERUJVR0NUTC5CVEYuICBUaGVzZSBjb25zaXN0ZW5j eSBjaGVja3MKKyAgICAgICAgICAgICAqIGFwcGx5IHRvIEFjdGl2aXR5LXN0YXRlLUhMVCB0b28s IGJ1dCBYZW4gZG9lc24ndCBzdXBwb3J0IHRoaXMuCiAgICAgICAgICAgICAgKgotICAgICAgICAg ICAgICogVGhlIFZNRW50cnkgY2hlY2tzIHdoZW4gRUZMQUdTLlRGIGlzIHNldCBkb24ndCBsaWtl IGEgVk1DUyBpbgotICAgICAgICAgICAgICogdGhpcyBzdGF0ZS4gIERlc3BpdGUgYSAjREIgcXVl dWVkIGluIFZNRU5UUllfSU5UUl9JTkZPLCB0aGUKLSAgICAgICAgICAgICAqIHN0YXRlIGlzIHJl amVjdGVkIGFzIERSNi5CUyBpc24ndCBwZW5kaW5nLiAgRml4IHRoaXMgdXAuCisgICAgICAgICAg ICAgKiBUaGUgVk1DUyBzdGF0ZSBhdCB0aGUgcG9pbnQgb2YgI0RCIGludGVyY2VwdCBkb2VzIG5v dCBzYXRpc2Z5CisgICAgICAgICAgICAgKiB0aGUgY29uc2lzdGVuY3kgY2hlY2tzLiAgSW4gdGhl IGNhc2UgdGhhdCBhIFNpbmdsZVN0ZXAgc2hvdWxkCisgICAgICAgICAgICAgKiBiZSBwZW5kaW5n LCBmaWxsIFBFTkRJTkdfREJHIGJhY2sgaW4gdG8gc2F0aXNmeSB0aGUgY29uc2l0ZW5jeQorICAg ICAgICAgICAgICogY2hlY2suCiAgICAgICAgICAgICAgKi8KICAgICAgICAgICAgIGlmICggdW5s aWtlbHkocmVncy0+ZWZsYWdzICYgWDg2X0VGTEFHU19URikgKQogICAgICAgICAgICAgewotICAg ICAgICAgICAgICAgIHVuc2lnbmVkIGxvbmcgaW50X2luZm87CisgICAgICAgICAgICAgICAgdW5z aWduZWQgbG9uZyBpbnRfaW5mbywgZGVidWdjdGw7CiAKICAgICAgICAgICAgICAgICBfX3ZtcmVh ZChHVUVTVF9JTlRFUlJVUFRJQklMSVRZX0lORk8sICZpbnRfaW5mbyk7CisgICAgICAgICAgICAg ICAgX192bXJlYWQoR1VFU1RfSUEzMl9ERUJVR0NUTCwgJmRlYnVnY3RsKTsKIAotICAgICAgICAg ICAgICAgIGlmICggaW50X2luZm8gJiAoVk1YX0lOVFJfU0hBRE9XX1NUSSB8IFZNWF9JTlRSX1NI QURPV19NT1ZfU1MpICkKKyAgICAgICAgICAgICAgICBpZiAoIChpbnRfaW5mbyAmIChWTVhfSU5U Ul9TSEFET1dfU1RJIHwgVk1YX0lOVFJfU0hBRE9XX01PVl9TUykpICYmCisgICAgICAgICAgICAg ICAgICAgICAhKGRlYnVnY3RsICYgSUEzMl9ERUJVR0NUTE1TUl9CVEYpICkKICAgICAgICAgICAg ICAgICB7CiAgICAgICAgICAgICAgICAgICAgIHVuc2lnbmVkIGxvbmcgcGVuZGluZ19kYmc7CiAK --=separator-- From xen-announce-bounces@lists.xenproject.org Tue Oct 13 12:29:10 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 13 Oct 2026 12:29:10 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1447142.1663448 (Exim 4.92) (envelope-from ) id 1xGbcx-0001nS-A0; Tue, 13 Oct 2026 12:29:07 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1447142.1663448; Tue, 13 Oct 2026 12:29:06 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1xGbcv-0001eG-O5; Tue, 13 Oct 2026 12:29:05 +0000 Received: by outflank-mailman (input) for mailman id 1447142; Tue, 13 Oct 2026 12:29:01 +0000 Received: from mx.expurgate.net ([194.145.224.20]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1xGbcq-0000nW-RN; Tue, 13 Oct 2026 12:29:01 +0000 Received: from mx.expurgate.net (helo=localhost) by mx.expurgate.net with esmtp id 1xGbcq-00DITf-6H; Tue, 13 Oct 2026 14:29:00 +0200 Received: from [10.42.69.6] (helo=localhost) by localhost with ESMTP (eXpurgate MTA 0.9.1) (envelope-from ) id 6ace2403-e002-0a2a0a5209dd-0a2a45068954-36 for ; Tue, 13 Oct 2026 14:29:00 +0200 Received: from [104.130.215.37] (helo=mail.xenproject.org) by tlsNG-16d1c6.mxtls.expurgate.net with ESMTPS (eXpurgate 4.57.1) (envelope-from ) id 6ace240a-195a-0a2a45060019-6882d725cdac-3 for ; Tue, 13 Oct 2026 14:28:59 +0200 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.98.2) (envelope-from ) id 1xGbcm-00000003NI2-19nM; Tue, 13 Oct 2026 12:28:56 +0000 Received: from andrewcoop by xenbits.xenproject.org with local (Exim 4.98.2) (envelope-from ) id 1xGbcm-0000000F959-03cI; Tue, 13 Oct 2026 12:28:56 +0000 X-BeenThere: xen-announce@lists.xenproject.org List-Id: "Xen announcements \(low volume\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-announce-bounces@lists.xenproject.org Precedence: list Sender: "Xen-announce" Authentication-Results: eu.smtp.expurgate.cloud; none Content-Type: multipart/mixed; boundary="=separator"; charset="utf-8" Content-Transfer-Encoding: binary MIME-Version: 1.0 X-Mailer: MIME-tools 5.515 (Entity 5.515) To: xen-announce@lists.xen.org, xen-devel@lists.xen.org, xen-users@lists.xen.org, oss-security@lists.openwall.com From: Xen.org security team CC: Xen.org security team Subject: Xen Security Advisory 519 v2 (CVE-2026-102699,CVE-2026-102702) - Arm: multiple issues with GNTTABOP_cache_flush Message-Id: Date: Tue, 13 Oct 2026 12:28:56 +0000 X-purgate-ID: tlsNG-16d1c6/1791894540-FE27077B-ECA0CA4B/0/0 X-purgate-type: clean X-purgate-size: 25558 --=separator Content-Type: text/plain; charset="utf-8" Content-Disposition: inline Content-Transfer-Encoding: 7bit -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Xen Security Advisory CVE-2026-102699,CVE-2026-102702 / XSA-519 version 2 Arm: multiple issues with GNTTABOP_cache_flush UPDATES IN VERSION 2 ==================== Public release. ISSUE DESCRIPTION ================= 1) XSA-437 (CVE-2023-34321) addressed issues with overflows in calculations involved in guests flushing caches through GNTTABOP_cache_flush. Unfortunately the fix there introduced a calculation which may underflow, resulting in a loop which would - at least on 64-bit Arm - take excessively long, and which would likely eventually crash the hypervisor. This is CVE-2026-102699. 2) GNTTABOP_cache_flush may be issued on memory mapped from another domain using the grant table interface. However there was no restriction to disallow the use of invalidate-without-clean against read-only grant mappings, which may corrupt the granted memory. This is CVE-2026-102702. IMPACT ====== A malicious unprivileged guest may crash the hypervisor, causing a Denial of Service (DoS) affecting the entire host, or corrupt memory belonging to another domain. Privilege escalation and information leaks cannot be ruled out. VULNERABLE SYSTEMS ================== All Xen versions from 4.5 onwards are vulnerable. Xen versions 4.4 and earlier are not vulnerable. Only Arm systems are vulnerable. x86 systems are not vulnerable. MITIGATION ========== There is no known mitigation. CREDITS ======= CVE-2026-102699 was discovered by Leonid Komarianskyi of EPAM. It was later independently reported by Ayan Kumar Halder of AMD. CVE-2026-102702 was found by the security team while looking at the surrounding code. RESOLUTION ========== Applying the appropriate attached patch resolves this issue. Note that patches for released versions are generally prepared to apply to the stable branches, and may not apply cleanly to the most recent release tarball. Downstreams are encouraged to update to the tip of the stable branch before applying these patches. xsa519-?.patch xen-unstable - Xen 4.21.x xsa519-4.20-?.patch Xen 4.20.x - Xen 4.17.x $ sha256sum xsa519* 3abfe7776402ba82d54b72163427694055cc3a5a729fd50a15af58699fef7903 xsa519-1.patch 6f09a24c5c793570e290ec853220099c617e372d96b93f938439ac4a18191dd2 xsa519-2.patch 1ed852f7e22fafe75e278dc913377fda5b0b73c8af51fe872684eb5b0bcb9597 xsa519-4.20-1.patch df5ba864761f3274df817fa362e234afb4b5e3f95b47daf25a307ac3d922aab6 xsa519-4.20-2.patch $ DEPLOYMENT DURING EMBARGO ========================= Deployment of the patches and/or mitigations described above (or others which are substantially similar) is permitted during the embargo, even on public-facing systems with untrusted guest users and administrators. But: Distribution of updated software is prohibited (except to other members of the predisclosure list). Predisclosure list members who wish to deploy significantly different patches and/or mitigations, please contact the Xen Project Security Team. (Note: this during-embargo deployment notice is retained in post-embargo publicly released Xen Project advisories, even though it is then no longer applicable. This is to enable the community to have oversight of the Xen Project Security Team's decisionmaking.) For more information about permissible uses of embargoed information, consult the Xen Project community's agreed Security Policy: http://www.xenproject.org/security-policy.html -----BEGIN PGP SIGNATURE----- iQFABAEBCAAqFiEEI+MiLBRfRHX6gGCng/4UyVfoK9kFAmrOIrAMHHBncEB4ZW4u b3JnAAoJEIP+FMlX6CvZ9ccIALBHbUY7GDoW1oFxKSpvrFFzwdSeq+yR7Y+cnBy7 6j9ehJE2zC1qLqHy0MQjFcmdSvdm/1Qy4CZ+cZgKtOMCeOvV8OwA6QkuHV5fch0f 2wHq71u/9p7wWhsILb9EHaUHBFNXiQ+joahKPyX4FHwz2aCB+aodqCRMsvk0Kd7K PSX4FotvGHSfgxrdzP6oLPOrmvVwy91ienOabE7QMTW2anghDIFVfjycYuebfXxF S+d7ciAcHdd72fOhM/wVlXZohslxw14ESJYZMUOvha8godQjPwCtT/A/SDc/k0Et 98xImFp4NU9W4Pk42eS+JUs3KNLWFapzVePRQ0Ku80Ia6wg= =xgyt -----END PGP SIGNATURE----- --=separator Content-Type: application/octet-stream; name="xsa519-1.patch" Content-Disposition: attachment; filename="xsa519-1.patch" Content-Transfer-Encoding: base64 RnJvbTogTGVvbmlkIEtvbWFyaWFuc2t5aSA8bGVvbmlkX2tvbWFyaWFuc2t5aUBlcGFtLmNvbT4K U3ViamVjdDogeGVuL2FybTogRml4IHNpemUgdW5kZXJmbG93IGluIGludmFsaWRhdGVfZGNhY2hl X3ZhX3JhbmdlKCkKCldoZW4gdGhlIHN0YXJ0IGFkZHJlc3MgaXMgbm90IGNhY2hlbGluZSBhbGln bmVkLCB0aGUgYnl0ZXMgY292ZXJlZCBieQp0aGUgZmlyc3QsIHBhcnRpYWwgY2FjaGVsaW5lIGFy ZSBzdWJ0cmFjdGVkIGZyb20gJ3NpemUnLiBOb3RoaW5nIGNoZWNrcwp0aGF0IHRoZSByZWdpb24g YWN0dWFsbHkgZXh0ZW5kcyBiZXlvbmQgdGhhdCBjYWNoZWxpbmUsIHNvIGlmIGl0IGRvZXMKbm90 LCB0aGUgdW5zaWduZWQgc3VidHJhY3Rpb24gdW5kZXJmbG93cyBhbmQgdGhlIGxvb3AgdGhhdCBm b2xsb3dzIHdhbGtzCnByYWN0aWNhbGx5IHRoZSBlbnRpcmUgYWRkcmVzcyBzcGFjZS4KCkZvciBl eGFtcGxlLCB3aXRoIGEgNjQtYnl0ZSBjYWNoZWxpbmUsIHAgPSAweDQwMDAwMDAxIGFuZCBzaXpl ID0gMToKCiAgICBwICYgY2FjaGVsaW5lX21hc2sgICAgIC0+IDEsIHNvIHRoZSBwYXJ0aWFsIGhl YWQgaXMgdGFrZW4KICAgIHNpemUgLT0gNjQgLSAxICAgICAgICAgLT4gMSAtIDYzIHVuZGVyZmxv d3MgdG8gMHhmZmZmZmZmZmZmZmZmZmMyCgpJbnN0ZWFkIG9mIGEgc2luZ2xlICJkYyBjaXZhYyIg YXQgMHg0MDAwMDAwMCwgdGhlIGxvb3AgdGhlbiBydW5zCjI4ODIzMDM3NjE1MTcxMTc0MyB0aW1l cywgaXNzdWluZyAiZGMgaXZhYyIgZnJvbSAweDQwMDAwMDQwIHVwd2FyZHMuCkludmFsaWRhdGlu ZyB3aXRob3V0IGNsZWFuaW5nIGRpc2NhcmRzIGRpcnR5IGNhY2hlbGluZXMsIHNvIHRoaXMKY29y cnVwdHMgd2hhdGV2ZXIgaXMgbWFwcGVkIGFsb25nIHRoZSB3YXkgdW50aWwgWGVuIHRha2VzIGEg ZGF0YSBhYm9ydC4KCk1vcmVvdmVyLCBfY2FjaGVfZmx1c2goKSBpbiBjb21tb24vZ3JhbnRfdGFi bGUuYywgcmVhY2hhYmxlIGZyb20gYSBndWVzdAp2aWEgR05UVEFCT1BfY2FjaGVfZmx1c2gsIGJv dW5kcyAnb2Zmc2V0JyBhbmQgJ2xlbmd0aCcgYWdhaW5zdCB0aGUgcGFnZQpzaXplIGJ1dCByZXF1 aXJlcyBubyBhbGlnbm1lbnQsIHNvIEdOVFRBQl9DQUNIRV9JTlZBTCB3aXRoIG9mZnNldCA9IDEK YW5kIGxlbmd0aCA9IDEgaXMgZW5vdWdoIHRvIHRyaWdnZXIgdGhpcy4gTm90ZSB0aGF0IHRoZSBw YWdlIG1heSBiZWxvbmcKdG8gYSBkaWZmZXJlbnQgZG9tYWluICh0aGUgZCAhPSBvd25lciBwYXRo KSwgc28gdGhlIGRhdGEgYmVpbmcgZGlzY2FyZGVkCmlzIG5vdCBuZWNlc3NhcmlseSB0aGUgY2Fs bGVyJ3Mgb3duLgoKVGhlIHN1YnRyYWN0aW9uIGRhdGVzIGJhY2sgdG8gdGhlIGZpeCBmb3IgWFNB LTQzNywgc28gdGhpcyBpcyBhIHJlZ3Jlc3Npb24KaW4gdGhhdCBjaGFuZ2UuCgpGaXggdGhpcyBi eSBkZXRlY3RpbmcgdGhlIHVuZGVyZmxvdyBpbnN0ZWFkIG9mIGxldHRpbmcgaXQgaGFwcGVuOiBp ZiB0aGUKcmVnaW9uIGVuZHMgaW5zaWRlIHRoZSBmaXJzdCBjYWNoZWxpbmUsIHRoZXJlIGlzIG5v dGhpbmcgbGVmdCB0byBmbHVzaAphbmQgdGhlIGZ1bmN0aW9uIGJhaWxzIG91dCByaWdodCBhZnRl ciBjbGVhbmluZyBpdC4gUGFydGlhbGx5IGNvdmVyZWQKY2FjaGVsaW5lcyBhcmUgc3RpbGwgY2xl YW5lZCBhcyB3ZWxsIGFzIGludmFsaWRhdGVkLCBzbyB0aGF0IGRhdGEgb3V0c2lkZQpvZiB0aGUg cmVnaW9uIGlzIG5vdCBkaXNjYXJkZWQuCgpBZGRpdGlvbmFsbHksIGRyb3AgJ2lkeCcgYW5kIGFk dmFuY2UgJ3AnIGRpcmVjdGx5IGluc3RlYWQuIEl0IHNpbXBsaWZpZXMKdGhlIGxvZ2ljIHdoaWxl IHVzaW5nIGZld2VyIHZhcmlhYmxlcyBhbmQgbGVzcyBhcml0aG1ldGljLgoKTm90ZSB0aGF0IHRo ZSBwYXJ0aWFsIGhlYWQgaXMgbm93IGNsZWFuZWQgdXNpbmcgdGhlIHVuYWxpZ25lZCBzdGFydCBv ZiB0aGUKcmVnaW9uIGluc3RlYWQgb2YgdGhlIHN0YXJ0IG9mIGl0cyBjYWNoZWxpbmUuIFRoaXMg aXMgcGVybWl0dGVkIGJ5IHRoZQphcmNoaXRlY3R1cmU7IHRoZSBBcm0gQVJNIChEREkgMDQ4Nykg c3RhdGVzOgoKICAiV2hlbiBhIERDIGluc3RydWN0aW9uIHJlcXVpcmVzIGFuIGFkZHJlc3MgYXJn dW1lbnQgdGhpcyB0YWtlcyB0aGUgZm9ybQogIG9mIGEgNjQtYml0IHJlZ2lzdGVyIHRoYXQgaG9s ZHMgdGhlIFZBIGFyZ3VtZW50LiBObyBhbGlnbm1lbnQKICByZXN0cmljdGlvbnMgYXBwbHkgZm9y IHRoaXMgYWRkcmVzcy4iCgpUaGUgc2FtZSBhcHBsaWVzIG9uIEFybTMyLgoKQWxzbywgc3dpdGNo IHRoZSBhc20oKSBpbiB0aGUgbG9vcCB0byBhc21faW5saW5lLCBsaWtlIHRoZSBuZWlnaGJvdXJp bmcKb25lczogdGhlIHdyYXBwZXIgZXhwYW5kcyB0byBhIHNpbmdsZSBpbnN0cnVjdGlvbiB3aXRo IGEgdHJhaWxpbmcKc2VtaWNvbG9uLCB3aGljaCBHQ0MgY291bnRzIGFzIHR3byBzdGF0ZW1lbnRz LCBvdmVyZXN0aW1hdGluZyB0aGUgc2l6ZQpvZiB0aGUgZnVuY3Rpb24gd2hlbiBkZWNpZGluZyB3 aGV0aGVyIHRvIGlubGluZSBpdC4KClRoaXMgaXMgQ1ZFLTIwMjYtMTAyNjk5LCBwYXJ0IG9mIFhT QS01MTkuCgpGaXhlczogOWEyMTZlOTJkZTlmICgieGVuL2FybTogcGFnZTogSGFuZGxlIGNhY2hl IGZsdXNoIG9mIGFuIGVsZW1lbnQgYXQgdGhlIHRvcCBvZiB0aGUgYWRkcmVzcyBzcGFjZSIpClNp Z25lZC1vZmYtYnk6IExlb25pZCBLb21hcmlhbnNreWkgPGxlb25pZF9rb21hcmlhbnNreWlAZXBh bS5jb20+ClJldmlld2VkLWJ5OiBKYW4gQmV1bGljaCA8amJldWxpY2hAc3VzZS5jb20+ClJldmll d2VkLWJ5OiBKdWxpZW4gR3JhbGwgPGp1bGllbkB4ZW4ub3JnPgoKZGlmZiAtLWdpdCBhL3hlbi9h cmNoL2FybS9pbmNsdWRlL2FzbS9wYWdlLmggYi94ZW4vYXJjaC9hcm0vaW5jbHVkZS9hc20vcGFn ZS5oCmluZGV4IDkwMTAwYTk2ZGZkYS4uNmRhNDc0NTczNmEyIDEwMDY0NAotLS0gYS94ZW4vYXJj aC9hcm0vaW5jbHVkZS9hc20vcGFnZS5oCisrKyBiL3hlbi9hcmNoL2FybS9pbmNsdWRlL2FzbS9w YWdlLmgKQEAgLTE2OCw3ICsxNjgsNyBAQCBzdGF0aWMgaW5saW5lIHNpemVfdCByZWFkX2RjYWNo ZV9saW5lX2J5dGVzKHZvaWQpCiBzdGF0aWMgaW5saW5lIGludCBpbnZhbGlkYXRlX2RjYWNoZV92 YV9yYW5nZShjb25zdCB2b2lkICpwLCB1bnNpZ25lZCBsb25nIHNpemUpCiB7CiAgICAgc2l6ZV90 IGNhY2hlbGluZV9tYXNrID0gZGNhY2hlX2xpbmVfYnl0ZXMgLSAxOwotICAgIHVuc2lnbmVkIGxv bmcgaWR4ID0gMDsKKyAgICB1bnNpZ25lZCBsb25nIHBhcnRpYWxfaGVhZDsKIAogICAgIGlmICgg IXNpemUgKQogICAgICAgICByZXR1cm4gMDsKQEAgLTE3OCwyMyArMTc4LDM1IEBAIHN0YXRpYyBp bmxpbmUgaW50IGludmFsaWRhdGVfZGNhY2hlX3ZhX3JhbmdlKGNvbnN0IHZvaWQgKnAsIHVuc2ln bmVkIGxvbmcgc2l6ZSkKIAogICAgIGRzYihzeSk7ICAgICAgICAgICAvKiBTbyB0aGUgQ1BVIGlz c3VlcyBhbGwgd3JpdGVzIHRvIHRoZSByYW5nZSAqLwogCi0gICAgaWYgKCAodWludHB0cl90KXAg JiBjYWNoZWxpbmVfbWFzayApCisgICAgLyoKKyAgICAgKiBBIGNhY2hlbGluZSBvbmx5IHBhcnRp YWxseSBjb3ZlcmVkIGJ5IHRoZSByZWdpb24gaGFzIHRvIGJlIGNsZWFuZWQgYXMKKyAgICAgKiB3 ZWxsIGFzIGludmFsaWRhdGVkLCBzbyB0aGF0IGRhdGEgbGl2aW5nIG91dHNpZGUgb2YgdGhlIHJl Z2lvbiBpcyBub3QKKyAgICAgKiBkaXNjYXJkZWQuCisgICAgICovCisgICAgcGFydGlhbF9oZWFk ID0gKHVpbnRwdHJfdClwICYgY2FjaGVsaW5lX21hc2s7CisgICAgaWYgKCBwYXJ0aWFsX2hlYWQg KQogICAgIHsKLSAgICAgICAgc2l6ZSAtPSBkY2FjaGVfbGluZV9ieXRlcyAtICgodWludHB0cl90 KXAgJiBjYWNoZWxpbmVfbWFzayk7Ci0gICAgICAgIHAgPSAodm9pZCAqKSgodWludHB0cl90KXAg JiB+Y2FjaGVsaW5lX21hc2spOworICAgICAgICB1bnNpZ25lZCBsb25nIHJlbSA9IGRjYWNoZV9s aW5lX2J5dGVzIC0gcGFydGlhbF9oZWFkOworCiAgICAgICAgIGFzbV9pbmxpbmUgdm9sYXRpbGUg KAogICAgICAgICAgICAgX19jbGVhbl9hbmRfaW52YWxpZGF0ZV9kY2FjaGVfb25lKDApIDo6ICJy IiAocCkgKTsKLSAgICAgICAgcCArPSBkY2FjaGVfbGluZV9ieXRlczsKKyAgICAgICAgcCArPSBy ZW07CisKKyAgICAgICAgLyogVGhlIHJlZ2lvbiBtYXkgZW5kIHdpdGhpbiB0aGlzIGNhY2hlbGlu ZSwgbGVhdmluZyBub3RoaW5nIHRvIGRvLiAqLworICAgICAgICBpZiAoIF9fYnVpbHRpbl91c3Vi bF9vdmVyZmxvdyhzaXplLCByZW0sICZzaXplKSApCisgICAgICAgICAgICBnb3RvIGRvbmU7CiAg ICAgfQogCiAgICAgZm9yICggOyBzaXplID49IGRjYWNoZV9saW5lX2J5dGVzOwotICAgICAgICAg ICAgaWR4ICs9IGRjYWNoZV9saW5lX2J5dGVzLCBzaXplIC09IGRjYWNoZV9saW5lX2J5dGVzICkK LSAgICAgICAgYXNtIHZvbGF0aWxlIChfX2ludmFsaWRhdGVfZGNhY2hlX29uZSgwKSA6IDogInIi IChwICsgaWR4KSk7CisgICAgICAgICAgICBwICs9IGRjYWNoZV9saW5lX2J5dGVzLCBzaXplIC09 IGRjYWNoZV9saW5lX2J5dGVzICkKKyAgICAgICAgYXNtX2lubGluZSB2b2xhdGlsZSAoX19pbnZh bGlkYXRlX2RjYWNoZV9vbmUoMCkgOiA6ICJyIiAocCkpOwogCisgICAgLyogUGFydGlhbCB0YWls IG11c3QgYmUgY2xlYW5lZCBhcyB3ZWxsLiAqLwogICAgIGlmICggc2l6ZSA+IDAgKQogICAgICAg ICBhc21faW5saW5lIHZvbGF0aWxlICgKLSAgICAgICAgICAgIF9fY2xlYW5fYW5kX2ludmFsaWRh dGVfZGNhY2hlX29uZSgwKSA6OiAiciIgKHAgKyBpZHgpICk7CisgICAgICAgICAgICBfX2NsZWFu X2FuZF9pbnZhbGlkYXRlX2RjYWNoZV9vbmUoMCkgOjogInIiIChwKSApOwogCisgZG9uZToKICAg ICBkc2Ioc3kpOyAgICAgICAgICAgLyogU28gd2Uga25vdyB0aGUgZmx1c2hlcyBoYXBwZW4gYmVm b3JlIGNvbnRpbnVpbmcgKi8KIAogICAgIHJldHVybiAwOwo= --=separator Content-Type: application/octet-stream; name="xsa519-2.patch" Content-Disposition: attachment; filename="xsa519-2.patch" Content-Transfer-Encoding: base64 RnJvbTogQW5kcmV3IENvb3BlciA8YW5kcmV3LmNvb3BlcjNAY2l0cml4LmNvbT4KU3ViamVjdDog eGVuL2dudHRhYjogUHJldmVudCBHTlRUQUJPUF9jYWNoZV9mbHVzaCBmcm9tIGNvcnJ1cHRpbmcg Uk8gZ3JhbnRzCgpHcmFudHMgY2FuIGJlIG9mZmVyZWQgcmVhZC1vbmx5IGJ5IHRoZSBvd25pbmcg ZG9tYWluLiAgV2hpbGUgYSBkb21haW4gbWFwcGluZwphIFJPIGdyYW50IG1heSBoYXZlIGEgbmVl ZCB0byBpbnZhbGlkYXRlIHRoZSBjYWNoZSwgaXQgbXVzdCBub3QgbW9kaWZ5IHRoZQpvdGhlci1n dWVzdHMgZGF0YSB3aGlsZSBkb2luZyBzby4gIEZvcmNlLXVwZ3JhZGUgdG8gYSBjbGVhbiBvcGVy YXRpb24gaW4gdGhpcwpjYXNlLgoKVGhpcyBpcyBDVkUtMjAyNi0xMDI3MDIsIHBhcnQgb2YgWFNB LTUxOS4KCkZpeGVzOiAxOGU4ZDIyZmU3NTAgKCJpbnRyb2R1Y2UgR05UVEFCT1BfY2FjaGVfZmx1 c2giKQpTaWduZWQtb2ZmLWJ5OiBBbmRyZXcgQ29vcGVyIDxhbmRyZXcuY29vcGVyM0BjaXRyaXgu Y29tPgpSZXZpZXdlZC1ieTogU3RlZmFubyBTdGFiZWxsaW5pIDxzc3RhYmVsbGluaUBrZXJuZWwu b3JnPgoKZGlmZiAtLWdpdCBhL3hlbi9jb21tb24vZ3JhbnRfdGFibGUuYyBiL3hlbi9jb21tb24v Z3JhbnRfdGFibGUuYwppbmRleCA4ODkyNjUzY2VkNzAuLjAzZTkxOWZkMjQyNCAxMDA2NDQKLS0t IGEveGVuL2NvbW1vbi9ncmFudF90YWJsZS5jCisrKyBiL3hlbi9jb21tb24vZ3JhbnRfdGFibGUu YwpAQCAtOTgzLDYgKzk4MywxMyBAQCBzdGF0aWMgc3RydWN0IGFjdGl2ZV9ncmFudF9lbnRyeSAq Z3JhbnRfbWFwX2V4aXN0cyhjb25zdCBzdHJ1Y3QgZG9tYWluICpsZCwKIAogICAgIHJldHVybiBF UlJfUFRSKC1FSU5WQUwpOwogfQorCitzdGF0aWMgYm9vbCBncmFudF9tYXBfaXNfcm8oc3RydWN0 IGFjdGl2ZV9ncmFudF9lbnRyeSAqYWN0KQoreworICAgIEFTU0VSVChzcGluX2lzX2xvY2tlZCgm YWN0LT5sb2NrKSk7CisKKyAgICByZXR1cm4gKGFjdC0+cGluICYgKEdOVFBJTl9oc3R3X21hc2sg fCBHTlRQSU5fZGV2d19tYXNrKSkgPT0gMDsKK30KICNlbmRpZiAvKiBDT05GSUdfSEFTX0dSQU5U X0NBQ0hFX0ZMVVNIICovCiAKIHVuaW9uIG1hcHRyYWNrX25vZGUgewpAQCAtMzU5Nyw3ICszNjA0 LDcgQEAgZ250dGFiX3N3YXBfZ3JhbnRfcmVmKFhFTl9HVUVTVF9IQU5ETEVfUEFSQU0oZ250dGFi X3N3YXBfZ3JhbnRfcmVmX3QpIHVvcCwKIH0KIAogI2lmZGVmIENPTkZJR19IQVNfR1JBTlRfQ0FD SEVfRkxVU0gKLXN0YXRpYyBpbnQgX2NhY2hlX2ZsdXNoKGNvbnN0IGdudHRhYl9jYWNoZV9mbHVz aF90ICpjZmx1c2gsIGdyYW50X3JlZl90ICpjdXJfcmVmKQorc3RhdGljIGludCBfY2FjaGVfZmx1 c2goZ250dGFiX2NhY2hlX2ZsdXNoX3QgKmNmbHVzaCwgZ3JhbnRfcmVmX3QgKmN1cl9yZWYpCiB7 CiAgICAgc3RydWN0IGRvbWFpbiAqZCwgKm93bmVyOwogICAgIHN0cnVjdCBwYWdlX2luZm8gKnBh Z2U7CkBAIC0zNjQ4LDYgKzM2NTUsMjQgQEAgc3RhdGljIGludCBfY2FjaGVfZmx1c2goY29uc3Qg Z250dGFiX2NhY2hlX2ZsdXNoX3QgKmNmbHVzaCwgZ3JhbnRfcmVmX3QgKmN1cl9yZWYKICAgICAg ICAgICAgIHB1dF9wYWdlKHBhZ2UpOwogICAgICAgICAgICAgcmV0dXJuIGFjdCA/IFBUUl9FUlIo YWN0KSA6IDE7CiAgICAgICAgIH0KKworICAgICAgICAvKgorICAgICAgICAgKiBJZiB0aGUgZ3Jh bnQgbWFwcGluZyBpcyByZWFkLW9ubHksIGl0IG11c3QgYmUgY2xlYW5lZCBhcyB3ZWxsIGFzCisg ICAgICAgICAqIGludmFsaWRhdGVkLiAgSW52YWxpZGF0aW9uIHdpdGhvdXQgY2xlYW5pbmcgbWF5 IG1vZGlmeSBtZW1vcnkgdGhlCisgICAgICAgICAqIGdyYW50ZXIgaXMgZXhwZWN0aW5nIG5vdCB0 byBjaGFuZ2UuCisgICAgICAgICAqCisgICAgICAgICAqIEl0IGlzIGhpZ2hseSB1bmxpa2VseSBi dXQgbGVnYWwgdG8gaGF2ZSBtdWx0aXBsZSBncmFudCBtYXBwaW5ncyBvZgorICAgICAgICAgKiBk aWZmZXJpbmcgcmVhZC1vbmx5LW5lc3MuICBJZiBhIHJlYWQtd3JpdGUgZ3JhbnQgbWFwcGluZyBp cyBmb3VuZAorICAgICAgICAgKiBmaXJzdCwgdGhlbiBpdCdzIGZpbmUgdG8gaW52YWxpZGF0ZSB3 aXRob3V0IGNsZWFuLgorICAgICAgICAgKgorICAgICAgICAgKiBJZiBhIHJlYWQtb25seSBncmFu dCBtYXBwaW5nIGlzIGZvdW5kIGZpcnN0LCBhIGxhdGVyIHJlYWQtd3JpdGUKKyAgICAgICAgICog bWFwcGluZyBjb3VsZCBiZSBtaXNzZWQuICBBc3N1bWUgdGhhdCB0aGUgcmVhZC1vbmx5IG1hcHBp bmcgaXMgdGhlCisgICAgICAgICAqIG9ubHkgbWFwcGluZy4gIFRoZSBjb3N0IGlzIGEgY2xlYW4g b2YgdXAgdG8gNGssIHdoaWxlIHRoZSBzYXZpbmcgaXMKKyAgICAgICAgICogbm90IHJlcXVpcmlu ZyB0aGUgc2VhcmNoIG9mIGdyYW50IG1hcHMgdG8gYmUgZXhoYXVzdGl2ZSBpbiBvcmRlciB0bwor ICAgICAgICAgKiBzcG90IGEgY29ybmVyLWNhc2UgZXhwZWN0ZWQgbm90IHRvIGV4aXN0IGluIHBy YWN0aWNlLgorICAgICAgICAgKi8KKyAgICAgICAgaWYgKCBncmFudF9tYXBfaXNfcm8oYWN0KSAp CisgICAgICAgICAgICBjZmx1c2gtPm9wIHw9IEdOVFRBQl9DQUNIRV9DTEVBTjsKICAgICB9CiAK ICAgICB2ID0gbWFwX2RvbWFpbl9wYWdlKG1mbik7Cg== --=separator Content-Type: application/octet-stream; name="xsa519-4.20-1.patch" Content-Disposition: attachment; filename="xsa519-4.20-1.patch" Content-Transfer-Encoding: base64 RnJvbTogTGVvbmlkIEtvbWFyaWFuc2t5aSA8bGVvbmlkX2tvbWFyaWFuc2t5aUBlcGFtLmNvbT4K U3ViamVjdDogeGVuL2FybTogcGFnZTogZml4IHNpemUgdW5kZXJmbG93IGluIGludmFsaWRhdGVf ZGNhY2hlX3ZhX3JhbmdlKCkKCldoZW4gdGhlIHN0YXJ0IGFkZHJlc3MgaXMgbm90IGNhY2hlbGlu ZSBhbGlnbmVkLCB0aGUgYnl0ZXMgY292ZXJlZCBieQp0aGUgZmlyc3QsIHBhcnRpYWwgY2FjaGVs aW5lIGFyZSBzdWJ0cmFjdGVkIGZyb20gJ3NpemUnLiBOb3RoaW5nIGNoZWNrcwp0aGF0IHRoZSBy ZWdpb24gYWN0dWFsbHkgZXh0ZW5kcyBiZXlvbmQgdGhhdCBjYWNoZWxpbmUsIHNvIGlmIGl0IGRv ZXMKbm90LCB0aGUgdW5zaWduZWQgc3VidHJhY3Rpb24gdW5kZXJmbG93cyBhbmQgdGhlIGxvb3Ag dGhhdCBmb2xsb3dzIHdhbGtzCnByYWN0aWNhbGx5IHRoZSBlbnRpcmUgYWRkcmVzcyBzcGFjZS4K CkZvciBleGFtcGxlLCB3aXRoIGEgNjQtYnl0ZSBjYWNoZWxpbmUsIHAgPSAweDQwMDAwMDAxIGFu ZCBzaXplID0gMToKCiAgICBwICYgY2FjaGVsaW5lX21hc2sgICAgIC0+IDEsIHNvIHRoZSBwYXJ0 aWFsIGhlYWQgaXMgdGFrZW4KICAgIHNpemUgLT0gNjQgLSAxICAgICAgICAgLT4gMSAtIDYzIHVu ZGVyZmxvd3MgdG8gMHhmZmZmZmZmZmZmZmZmZmMyCgpJbnN0ZWFkIG9mIGEgc2luZ2xlICJkYyBj aXZhYyIgYXQgMHg0MDAwMDAwMCwgdGhlIGxvb3AgdGhlbiBydW5zCjI4ODIzMDM3NjE1MTcxMTc0 MyB0aW1lcywgaXNzdWluZyAiZGMgaXZhYyIgZnJvbSAweDQwMDAwMDQwIHVwd2FyZHMuCkludmFs aWRhdGluZyB3aXRob3V0IGNsZWFuaW5nIGRpc2NhcmRzIGRpcnR5IGNhY2hlbGluZXMsIHNvIHRo aXMKY29ycnVwdHMgd2hhdGV2ZXIgaXMgbWFwcGVkIGFsb25nIHRoZSB3YXkgdW50aWwgWGVuIHRh a2VzIGEgZGF0YSBhYm9ydC4KCk1vcmVvdmVyLCBfY2FjaGVfZmx1c2goKSBpbiBjb21tb24vZ3Jh bnRfdGFibGUuYywgcmVhY2hhYmxlIGZyb20gYSBndWVzdAp2aWEgR05UVEFCT1BfY2FjaGVfZmx1 c2gsIGJvdW5kcyAnb2Zmc2V0JyBhbmQgJ2xlbmd0aCcgYWdhaW5zdCB0aGUgcGFnZQpzaXplIGJ1 dCByZXF1aXJlcyBubyBhbGlnbm1lbnQsIHNvIEdOVFRBQl9DQUNIRV9JTlZBTCB3aXRoIG9mZnNl dCA9IDEKYW5kIGxlbmd0aCA9IDEgaXMgZW5vdWdoIHRvIHRyaWdnZXIgdGhpcy4gTm90ZSB0aGF0 IHRoZSBwYWdlIG1heSBiZWxvbmcKdG8gYSBkaWZmZXJlbnQgZG9tYWluICh0aGUgZCAhPSBvd25l ciBwYXRoKSwgc28gdGhlIGRhdGEgYmVpbmcgZGlzY2FyZGVkCmlzIG5vdCBuZWNlc3NhcmlseSB0 aGUgY2FsbGVyJ3Mgb3duLgoKVGhlIHN1YnRyYWN0aW9uIGRhdGVzIGJhY2sgdG8gdGhlIGZpeCBm b3IgWFNBLTQzNywgc28gdGhpcyBpcyBhIHJlZ3Jlc3Npb24KaW4gdGhhdCBjaGFuZ2UuCgpGaXgg dGhpcyBieSBkZXRlY3RpbmcgdGhlIHVuZGVyZmxvdyBpbnN0ZWFkIG9mIGxldHRpbmcgaXQgaGFw cGVuOiBpZiB0aGUKcmVnaW9uIGVuZHMgaW5zaWRlIHRoZSBmaXJzdCBjYWNoZWxpbmUsIHRoZXJl IGlzIG5vdGhpbmcgbGVmdCB0byBmbHVzaAphbmQgdGhlIGZ1bmN0aW9uIGJhaWxzIG91dCByaWdo dCBhZnRlciBjbGVhbmluZyBpdC4gUGFydGlhbGx5IGNvdmVyZWQKY2FjaGVsaW5lcyBhcmUgc3Rp bGwgY2xlYW5lZCBhcyB3ZWxsIGFzIGludmFsaWRhdGVkLCBzbyB0aGF0IGRhdGEgb3V0c2lkZQpv ZiB0aGUgcmVnaW9uIGlzIG5vdCBkaXNjYXJkZWQuCgpBZGRpdGlvbmFsbHksIGRyb3AgJ2lkeCcg YW5kIGFkdmFuY2UgJ3AnIGRpcmVjdGx5IGluc3RlYWQuIEl0IHNpbXBsaWZpZXMKdGhlIGxvZ2lj IHdoaWxlIHVzaW5nIGZld2VyIHZhcmlhYmxlcyBhbmQgbGVzcyBhcml0aG1ldGljLgoKTm90ZSB0 aGF0IHRoZSBwYXJ0aWFsIGhlYWQgaXMgbm93IGNsZWFuZWQgdXNpbmcgdGhlIHVuYWxpZ25lZCBz dGFydCBvZiB0aGUKcmVnaW9uIGluc3RlYWQgb2YgdGhlIHN0YXJ0IG9mIGl0cyBjYWNoZWxpbmUu IFRoaXMgaXMgcGVybWl0dGVkIGJ5IHRoZQphcmNoaXRlY3R1cmU7IHRoZSBBcm0gQVJNIChEREkg MDQ4Nykgc3RhdGVzOgoKICAiV2hlbiBhIERDIGluc3RydWN0aW9uIHJlcXVpcmVzIGFuIGFkZHJl c3MgYXJndW1lbnQgdGhpcyB0YWtlcyB0aGUgZm9ybQogIG9mIGEgNjQtYml0IHJlZ2lzdGVyIHRo YXQgaG9sZHMgdGhlIFZBIGFyZ3VtZW50LiBObyBhbGlnbm1lbnQKICByZXN0cmljdGlvbnMgYXBw bHkgZm9yIHRoaXMgYWRkcmVzcy4iCgpUaGUgc2FtZSBhcHBsaWVzIG9uIEFybTMyLgoKVGhpcyBp cyBDVkUtMjAyNi0xMDI2OTksIHBhcnQgb2YgWFNBLTUxOS4KCkZpeGVzOiA5YTIxNmU5MmRlOWYg KCJ4ZW4vYXJtOiBwYWdlOiBIYW5kbGUgY2FjaGUgZmx1c2ggb2YgYW4gZWxlbWVudCBhdCB0aGUg dG9wIG9mIHRoZSBhZGRyZXNzIHNwYWNlIikKU2lnbmVkLW9mZi1ieTogTGVvbmlkIEtvbWFyaWFu c2t5aSA8bGVvbmlkX2tvbWFyaWFuc2t5aUBlcGFtLmNvbT4KUmV2aWV3ZWQtYnk6IEphbiBCZXVs aWNoIDxqYmV1bGljaEBzdXNlLmNvbT4KUmV2aWV3ZWQtYnk6IEp1bGllbiBHcmFsbCA8anVsaWVu QHhlbi5vcmc+CgpkaWZmIC0tZ2l0IGEveGVuL2FyY2gvYXJtL2luY2x1ZGUvYXNtL3BhZ2UuaCBi L3hlbi9hcmNoL2FybS9pbmNsdWRlL2FzbS9wYWdlLmgKaW5kZXggNjlmODE3ZDFlNjhhLi5lMjYx MDRhMjFlMTAgMTAwNjQ0Ci0tLSBhL3hlbi9hcmNoL2FybS9pbmNsdWRlL2FzbS9wYWdlLmgKKysr IGIveGVuL2FyY2gvYXJtL2luY2x1ZGUvYXNtL3BhZ2UuaApAQCAtMTYyLDcgKzE2Miw3IEBAIHN0 YXRpYyBpbmxpbmUgc2l6ZV90IHJlYWRfZGNhY2hlX2xpbmVfYnl0ZXModm9pZCkKIHN0YXRpYyBp bmxpbmUgaW50IGludmFsaWRhdGVfZGNhY2hlX3ZhX3JhbmdlKGNvbnN0IHZvaWQgKnAsIHVuc2ln bmVkIGxvbmcgc2l6ZSkKIHsKICAgICBzaXplX3QgY2FjaGVsaW5lX21hc2sgPSBkY2FjaGVfbGlu ZV9ieXRlcyAtIDE7Ci0gICAgdW5zaWduZWQgbG9uZyBpZHggPSAwOworICAgIHVuc2lnbmVkIGxv bmcgcGFydGlhbF9oZWFkOwogCiAgICAgaWYgKCAhc2l6ZSApCiAgICAgICAgIHJldHVybiAwOwpA QCAtMTcyLDIxICsxNzIsMzQgQEAgc3RhdGljIGlubGluZSBpbnQgaW52YWxpZGF0ZV9kY2FjaGVf dmFfcmFuZ2UoY29uc3Qgdm9pZCAqcCwgdW5zaWduZWQgbG9uZyBzaXplKQogCiAgICAgZHNiKHN5 KTsgICAgICAgICAgIC8qIFNvIHRoZSBDUFUgaXNzdWVzIGFsbCB3cml0ZXMgdG8gdGhlIHJhbmdl ICovCiAKLSAgICBpZiAoICh1aW50cHRyX3QpcCAmIGNhY2hlbGluZV9tYXNrICkKKyAgICAvKgor ICAgICAqIEEgY2FjaGVsaW5lIG9ubHkgcGFydGlhbGx5IGNvdmVyZWQgYnkgdGhlIHJlZ2lvbiBo YXMgdG8gYmUgY2xlYW5lZCBhcworICAgICAqIHdlbGwgYXMgaW52YWxpZGF0ZWQsIHNvIHRoYXQg ZGF0YSBsaXZpbmcgb3V0c2lkZSBvZiB0aGUgcmVnaW9uIGlzIG5vdAorICAgICAqIGRpc2NhcmRl ZC4KKyAgICAgKi8KKyAgICBwYXJ0aWFsX2hlYWQgPSAodWludHB0cl90KXAgJiBjYWNoZWxpbmVf bWFzazsKKyAgICBpZiAoIHBhcnRpYWxfaGVhZCApCiAgICAgewotICAgICAgICBzaXplIC09IGRj YWNoZV9saW5lX2J5dGVzIC0gKCh1aW50cHRyX3QpcCAmIGNhY2hlbGluZV9tYXNrKTsKLSAgICAg ICAgcCA9ICh2b2lkICopKCh1aW50cHRyX3QpcCAmIH5jYWNoZWxpbmVfbWFzayk7CisgICAgICAg IHVuc2lnbmVkIGxvbmcgcmVtID0gZGNhY2hlX2xpbmVfYnl0ZXMgLSBwYXJ0aWFsX2hlYWQ7CisK ICAgICAgICAgYXNtIHZvbGF0aWxlIChfX2NsZWFuX2FuZF9pbnZhbGlkYXRlX2RjYWNoZV9vbmUo MCkgOiA6ICJyIiAocCkpOwotICAgICAgICBwICs9IGRjYWNoZV9saW5lX2J5dGVzOworICAgICAg ICBwICs9IHJlbTsKKworICAgICAgICAvKiBUaGUgcmVnaW9uIG1heSBlbmQgd2l0aGluIHRoaXMg Y2FjaGVsaW5lLCBsZWF2aW5nIG5vdGhpbmcgdG8gZG8uICovCisgICAgICAgIHNpemUgLT0gcmVt OworICAgICAgICBpZiAoIHNpemUgPiByZW0gKSAvKiB1bmRlcmZsb3cgKi8KKyAgICAgICAgICAg IGdvdG8gZG9uZTsKICAgICB9CiAKICAgICBmb3IgKCA7IHNpemUgPj0gZGNhY2hlX2xpbmVfYnl0 ZXM7Ci0gICAgICAgICAgICBpZHggKz0gZGNhY2hlX2xpbmVfYnl0ZXMsIHNpemUgLT0gZGNhY2hl X2xpbmVfYnl0ZXMgKQotICAgICAgICBhc20gdm9sYXRpbGUgKF9faW52YWxpZGF0ZV9kY2FjaGVf b25lKDApIDogOiAiciIgKHAgKyBpZHgpKTsKKyAgICAgICAgICAgIHAgKz0gZGNhY2hlX2xpbmVf Ynl0ZXMsIHNpemUgLT0gZGNhY2hlX2xpbmVfYnl0ZXMgKQorICAgICAgICBhc20gdm9sYXRpbGUg KF9faW52YWxpZGF0ZV9kY2FjaGVfb25lKDApIDogOiAiciIgKHApKTsKIAorICAgIC8qIFBhcnRp YWwgdGFpbCBtdXN0IGJlIGNsZWFuZWQgYXMgd2VsbC4gKi8KICAgICBpZiAoIHNpemUgPiAwICkK LSAgICAgICAgYXNtIHZvbGF0aWxlIChfX2NsZWFuX2FuZF9pbnZhbGlkYXRlX2RjYWNoZV9vbmUo MCkgOiA6ICJyIiAocCArIGlkeCkpOworICAgICAgICBhc20gdm9sYXRpbGUgKF9fY2xlYW5fYW5k X2ludmFsaWRhdGVfZGNhY2hlX29uZSgwKSA6IDogInIiIChwKSk7CiAKKyBkb25lOgogICAgIGRz YihzeSk7ICAgICAgICAgICAvKiBTbyB3ZSBrbm93IHRoZSBmbHVzaGVzIGhhcHBlbiBiZWZvcmUg Y29udGludWluZyAqLwogCiAgICAgcmV0dXJuIDA7Cg== --=separator Content-Type: application/octet-stream; name="xsa519-4.20-2.patch" Content-Disposition: attachment; filename="xsa519-4.20-2.patch" Content-Transfer-Encoding: base64 RnJvbTogQW5kcmV3IENvb3BlciA8YW5kcmV3LmNvb3BlcjNAY2l0cml4LmNvbT4KU3ViamVjdDog eGVuL2dudHRhYjogUHJldmVudCBHTlRUQUJPUF9jYWNoZV9mbHVzaCBmcm9tIGNvcnJ1cHRpbmcg Uk8gZ3JhbnRzCgpHcmFudHMgY2FuIGJlIG9mZmVyZWQgcmVhZC1vbmx5IGJ5IHRoZSBvd25pbmcg ZG9tYWluLiAgV2hpbGUgYSBkb21haW4gbWFwcGluZwphIFJPIGdyYW50IG1heSBoYXZlIGEgbmVl ZCB0byBpbnZhbGlkYXRlIHRoZSBjYWNoZSwgaXQgbXVzdCBub3QgbW9kaWZ5IHRoZQpvdGhlci1n dWVzdHMgZGF0YSB3aGlsZSBkb2luZyBzby4gIEZvcmNlLXVwZ3JhZGUgdG8gYSBjbGVhbiBvcGVy YXRpb24gaW4gdGhpcwpjYXNlLgoKVGhpcyBpcyBDVkUtMjAyNi0xMDI3MDIsIHBhcnQgb2YgWFNB LTUxOS4KCkZpeGVzOiAxOGU4ZDIyZmU3NTAgKCJpbnRyb2R1Y2UgR05UVEFCT1BfY2FjaGVfZmx1 c2giKQpTaWduZWQtb2ZmLWJ5OiBBbmRyZXcgQ29vcGVyIDxhbmRyZXcuY29vcGVyM0BjaXRyaXgu Y29tPgpSZXZpZXdlZC1ieTogU3RlZmFubyBTdGFiZWxsaW5pIDxzc3RhYmVsbGluaUBrZXJuZWwu b3JnPgoKZGlmZiAtLWdpdCBhL3hlbi9jb21tb24vZ3JhbnRfdGFibGUuYyBiL3hlbi9jb21tb24v Z3JhbnRfdGFibGUuYwppbmRleCBjMGNhNGYzMDU3NTAuLjIwNmYxZWQ2N2EyOCAxMDA2NDQKLS0t IGEveGVuL2NvbW1vbi9ncmFudF90YWJsZS5jCisrKyBiL3hlbi9jb21tb24vZ3JhbnRfdGFibGUu YwpAQCAtOTgzLDYgKzk4MywxMyBAQCBzdGF0aWMgc3RydWN0IGFjdGl2ZV9ncmFudF9lbnRyeSAq Z3JhbnRfbWFwX2V4aXN0cyhjb25zdCBzdHJ1Y3QgZG9tYWluICpsZCwKICAgICByZXR1cm4gRVJS X1BUUigtRUlOVkFMKTsKIH0KIAorc3RhdGljIGJvb2wgZ3JhbnRfbWFwX2lzX3JvKHN0cnVjdCBh Y3RpdmVfZ3JhbnRfZW50cnkgKmFjdCkKK3sKKyAgICBBU1NFUlQoc3Bpbl9pc19sb2NrZWQoJmFj dC0+bG9jaykpOworCisgICAgcmV0dXJuIChhY3QtPnBpbiAmIChHTlRQSU5faHN0d19tYXNrIHwg R05UUElOX2RldndfbWFzaykpID09IDA7Cit9CisKIHVuaW9uIG1hcHRyYWNrX25vZGUgewogICAg IHN0cnVjdCB7CiAgICAgICAgIC8qIFJhZGl4IHRyZWUgc2xvdCBwb2ludGVycyB1c2UgdHdvIG9m IHRoZSBiaXRzLiAqLwpAQCAtMzU5NSw3ICszNjAyLDcgQEAgZ250dGFiX3N3YXBfZ3JhbnRfcmVm KFhFTl9HVUVTVF9IQU5ETEVfUEFSQU0oZ250dGFiX3N3YXBfZ3JhbnRfcmVmX3QpIHVvcCwKICAg ICByZXR1cm4gMDsKIH0KIAotc3RhdGljIGludCBfY2FjaGVfZmx1c2goY29uc3QgZ250dGFiX2Nh Y2hlX2ZsdXNoX3QgKmNmbHVzaCwgZ3JhbnRfcmVmX3QgKmN1cl9yZWYpCitzdGF0aWMgaW50IF9j YWNoZV9mbHVzaChnbnR0YWJfY2FjaGVfZmx1c2hfdCAqY2ZsdXNoLCBncmFudF9yZWZfdCAqY3Vy X3JlZikKIHsKICAgICBzdHJ1Y3QgZG9tYWluICpkLCAqb3duZXI7CiAgICAgc3RydWN0IHBhZ2Vf aW5mbyAqcGFnZTsKQEAgLTM2NDYsNiArMzY1MywyNCBAQCBzdGF0aWMgaW50IF9jYWNoZV9mbHVz aChjb25zdCBnbnR0YWJfY2FjaGVfZmx1c2hfdCAqY2ZsdXNoLCBncmFudF9yZWZfdCAqY3VyX3Jl ZgogICAgICAgICAgICAgcHV0X3BhZ2UocGFnZSk7CiAgICAgICAgICAgICByZXR1cm4gYWN0ID8g UFRSX0VSUihhY3QpIDogMTsKICAgICAgICAgfQorCisgICAgICAgIC8qCisgICAgICAgICAqIElm IHRoZSBncmFudCBtYXBwaW5nIGlzIHJlYWQtb25seSwgaXQgbXVzdCBiZSBjbGVhbmVkIGFzIHdl bGwgYXMKKyAgICAgICAgICogaW52YWxpZGF0ZWQuICBJbnZhbGlkYXRpb24gd2l0aG91dCBjbGVh bmluZyBtYXkgbW9kaWZ5IG1lbW9yeSB0aGUKKyAgICAgICAgICogZ3JhbnRlciBpcyBleHBlY3Rp bmcgbm90IHRvIGNoYW5nZS4KKyAgICAgICAgICoKKyAgICAgICAgICogSXQgaXMgaGlnaGx5IHVu bGlrZWx5IGJ1dCBsZWdhbCB0byBoYXZlIG11bHRpcGxlIGdyYW50IG1hcHBpbmdzIG9mCisgICAg ICAgICAqIGRpZmZlcmluZyByZWFkLW9ubHktbmVzcy4gIElmIGEgcmVhZC13cml0ZSBncmFudCBt YXBwaW5nIGlzIGZvdW5kCisgICAgICAgICAqIGZpcnN0LCB0aGVuIGl0J3MgZmluZSB0byBpbnZh bGlkYXRlIHdpdGhvdXQgY2xlYW4uCisgICAgICAgICAqCisgICAgICAgICAqIElmIGEgcmVhZC1v bmx5IGdyYW50IG1hcHBpbmcgaXMgZm91bmQgZmlyc3QsIGEgbGF0ZXIgcmVhZC13cml0ZQorICAg ICAgICAgKiBtYXBwaW5nIGNvdWxkIGJlIG1pc3NlZC4gIEFzc3VtZSB0aGF0IHRoZSByZWFkLW9u bHkgbWFwcGluZyBpcyB0aGUKKyAgICAgICAgICogb25seSBtYXBwaW5nLiAgVGhlIGNvc3QgaXMg YSBjbGVhbiBvZiB1cCB0byA0aywgd2hpbGUgdGhlIHNhdmluZyBpcworICAgICAgICAgKiBub3Qg cmVxdWlyaW5nIHRoZSBzZWFyY2ggb2YgZ3JhbnQgbWFwcyB0byBiZSBleGhhdXN0aXZlIGluIG9y ZGVyIHRvCisgICAgICAgICAqIHNwb3QgYSBjb3JuZXItY2FzZSBleHBlY3RlZCBub3QgdG8gZXhp c3QgaW4gcHJhY3RpY2UuCisgICAgICAgICAqLworICAgICAgICBpZiAoIGdyYW50X21hcF9pc19y byhhY3QpICkKKyAgICAgICAgICAgIGNmbHVzaC0+b3AgfD0gR05UVEFCX0NBQ0hFX0NMRUFOOwog ICAgIH0KIAogICAgIHYgPSBtYXBfZG9tYWluX3BhZ2UobWZuKTsK --=separator-- From xen-announce-bounces@lists.xenproject.org Tue Oct 13 12:29:19 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 13 Oct 2026 12:29:19 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1447151.1663467 (Exim 4.92) (envelope-from ) id 1xGbd2-0002lH-Ke; Tue, 13 Oct 2026 12:29:12 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1447151.1663467; Tue, 13 Oct 2026 12:29:12 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1xGbd1-0002cQ-DW; Tue, 13 Oct 2026 12:29:11 +0000 Received: by outflank-mailman (input) for mailman id 1447151; Tue, 13 Oct 2026 12:29:04 +0000 Received: from mx.expurgate.net ([194.145.224.10]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1xGbct-0001Do-CN; Tue, 13 Oct 2026 12:29:03 +0000 Received: from mx.expurgate.net (helo=localhost) by mx.expurgate.net with esmtp id 1xGbcs-009dD9-Oe; Tue, 13 Oct 2026 14:29:02 +0200 Received: from [10.42.69.1] (helo=localhost) by localhost with ESMTP (eXpurgate MTA 0.9.1) (envelope-from ) id 6ace2403-2eae-0a2a0a5409dd-0a2a4501ece6-32 for ; Tue, 13 Oct 2026 14:29:02 +0200 Received: from [104.130.215.37] (helo=mail.xenproject.org) by tlsNG-d62444.mxtls.expurgate.net with ESMTPS (eXpurgate 4.57.1) (envelope-from ) id 6ace240d-5984-0a2a45010019-6882d725a7a2-3 for ; Tue, 13 Oct 2026 14:29:02 +0200 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.98.2) (envelope-from ) id 1xGbcq-00000003NIa-0fu4; Tue, 13 Oct 2026 12:28:59 +0000 Received: from andrewcoop by xenbits.xenproject.org with local (Exim 4.98.2) (envelope-from ) id 1xGbcp-0000000F9FM-3n4i; Tue, 13 Oct 2026 12:28:59 +0000 X-BeenThere: xen-announce@lists.xenproject.org List-Id: "Xen announcements \(low volume\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-announce-bounces@lists.xenproject.org Precedence: list Sender: "Xen-announce" Authentication-Results: eu.smtp.expurgate.cloud; none Content-Type: multipart/mixed; boundary="=separator"; charset="utf-8" Content-Transfer-Encoding: binary MIME-Version: 1.0 X-Mailer: MIME-tools 5.515 (Entity 5.515) To: xen-announce@lists.xen.org, xen-devel@lists.xen.org, xen-users@lists.xen.org, oss-security@lists.openwall.com From: Xen.org security team CC: Xen.org security team Subject: Xen Security Advisory 520 v2 (CVE-2026-102700) - gnttab: cache-flush handling may cause page reference leak Message-Id: Date: Tue, 13 Oct 2026 12:28:59 +0000 X-purgate-ID: tlsNG-d62444/1791894542-BEA66757-1FED5286/0/0 X-purgate-type: clean X-purgate-size: 4719 --=separator Content-Type: text/plain; charset="utf-8" Content-Disposition: inline Content-Transfer-Encoding: 7bit -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Xen Security Advisory CVE-2026-102700 / XSA-520 version 2 gnttab: cache-flush handling may cause page reference leak UPDATES IN VERSION 2 ==================== Public release. ISSUE DESCRIPTION ================= With its original introduction, GNTTAB_cache_flush was made available uniformly. XSA-232 (CVE-2017-14318) then covered an omitted NULL pointer check, yet the addition of that check failed to adjust the subsequent error path. That error path fails to drop a page reference in case the specified page is owned by a special system domain (DOM_IO and DOM_COW are system domains which can have memory pages assigned to them.) IMPACT ====== The most likely outcome is Denial of Service (DoS) of either Domain 0 (then likely affecting the entire host) or of another domain. VULNERABLE SYSTEMS ================== Xen versions 4.5 through 4.20 are affected. Xen versions 4.21 and newer as well as 4.4 and older are not affected. Only x86 systems are vulnerable. Arm systems are not vulnerable. MITIGATION ========== There is no known mitigation. CREDITS ======= This issue was discovered independently by Andrew Cooper of Citrix and Yehyeong Lee. RESOLUTION ========== Applying the appropriate attached patch resolves this issue. Note that patches for released versions are generally prepared to apply to the stable branches, and may not apply cleanly to the most recent release tarball. Downstreams are encouraged to update to the tip of the stable branch before applying these patches. xsa520.patch Xen 4.20.x - Xen 4.17.x $ sha256sum xsa520* e6814fe4a77d38f83c7bf3b92e8d24a0d95508572b845c622985e7021338cca9 xsa520.patch $ DEPLOYMENT DURING EMBARGO ========================= Deployment of the patches and/or mitigations described above (or others which are substantially similar) is permitted during the embargo, even on public-facing systems with untrusted guest users and administrators. But: Distribution of updated software is prohibited (except to other members of the predisclosure list). Predisclosure list members who wish to deploy significantly different patches and/or mitigations, please contact the Xen Project Security Team. (Note: this during-embargo deployment notice is retained in post-embargo publicly released Xen Project advisories, even though it is then no longer applicable. This is to enable the community to have oversight of the Xen Project Security Team's decisionmaking.) For more information about permissible uses of embargoed information, consult the Xen Project community's agreed Security Policy: http://www.xenproject.org/security-policy.html -----BEGIN PGP SIGNATURE----- iQFABAEBCAAqFiEEI+MiLBRfRHX6gGCng/4UyVfoK9kFAmrOItgMHHBncEB4ZW4u b3JnAAoJEIP+FMlX6CvZw3AIALH4pnPt5g51TX1HIUUjtyqxK9j6IyFtYgHqptRA XTaZAD+NlU9R97SKGG8/YkMwdIDOQ43HE0sjJpARScQbCXcoq781yf4U1xbuy56z prClo+bFT61BnbJnzpQuhmZ1kfPYhqqeYSEsm9TUj6g1Z3j2oq45aISrgyDJgsRJ /t8Reelp/kFhQHql7Bt7uRy0xYTHcYuN56dGDAJJ1MsExsbEdLW4hgIcTjBkD04A 29MSv3j1WlCpWSCIEs27dzJv3i5mrcp1hSXfDo84NYMzxEY9FRcSGPNaGiG0/5pG gRe67qr5htHW8rYiTjJRc2b/Sp6D1f7+QThqcq010NwdrzE= =v0su -----END PGP SIGNATURE----- --=separator Content-Type: application/octet-stream; name="xsa520.patch" Content-Disposition: attachment; filename="xsa520.patch" Content-Transfer-Encoding: base64 RnJvbTogSmFuIEJldWxpY2ggPGpiZXVsaWNoQHN1c2UuY29tPgpTdWJqZWN0OiBnbnR0YWI6IHBy b3Blcmx5IGRyb3AgcGFnZSByZWYgb24gYSBHTlRUQUJfY2FjaGVfZmx1c2ggZXJyb3IgcGF0aAoK T3JkaW5hcnkgZG9tYWlucyBhbHdheXMgaGF2ZSBhIGdyYW50IHRhYmxlLiBTeXN0ZW0gZG9tYWlu cyBkb24ndCwgYnV0IHRoZXkKYWxzbyBkb24ndCBub3JtYWxseSAib3duIiBwYWdlcyAtIGV4Y2Vw dCBmb3IgRE9NX0lPIGFuZCBET01fQ09XIG9uIHg4Ni4KClRoaXMgaXMgWFNBLTUyMCAvIENWRS0y MDI2LTEwMjcwMC4KClJlcG9ydGVkLWJ5OiBBbmRyZXcgQ29vcGVyIDxhbmRyZXcuY29vcGVyM0Bj aXRyaXguY29tPgpSZXBvcnRlZC1ieTogWWVoeWVvbmcgTGVlIDx5aGxlZUBpc3NsYWIua29yZWEu YWMua3I+ClNpZ25lZC1vZmYtYnk6IEphbiBCZXVsaWNoIDxqYmV1bGljaEBzdXNlLmNvbT4KCi0t LSBhL3hlbi9jb21tb24vZ3JhbnRfdGFibGUuYworKysgYi94ZW4vY29tbW9uL2dyYW50X3RhYmxl LmMKQEAgLTM2MjQsNiArMzYyNCw4IEBAIHN0YXRpYyBpbnQgX2NhY2hlX2ZsdXNoKGNvbnN0IGdu dHRhYl9jYWMKICAgICBvd25lciA9IHBhZ2VfZ2V0X293bmVyX2FuZF9yZWZlcmVuY2UocGFnZSk7 CiAgICAgaWYgKCAhb3duZXIgfHwgIW93bmVyLT5ncmFudF90YWJsZSApCiAgICAgeworICAgICAg ICBpZiAoIG93bmVyICkKKyAgICAgICAgICAgIHB1dF9wYWdlKHBhZ2UpOwogICAgICAgICByY3Vf dW5sb2NrX2RvbWFpbihkKTsKICAgICAgICAgcmV0dXJuIC1FUEVSTTsKICAgICB9Cg== --=separator-- From xen-announce-bounces@lists.xenproject.org Tue Oct 13 12:29:28 2026 Return-path: Envelope-to: archives@lists.xen.org Delivery-date: Tue, 13 Oct 2026 12:29:28 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1447180.1663522 (Exim 4.92) (envelope-from ) id 1xGbdG-0005Ea-5J; Tue, 13 Oct 2026 12:29:26 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1447180.1663522; Tue, 13 Oct 2026 12:29:25 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1xGbdE-00053L-35; Tue, 13 Oct 2026 12:29:24 +0000 Received: by outflank-mailman (input) for mailman id 1447180; Tue, 13 Oct 2026 12:29:09 +0000 Received: from mx.expurgate.net ([194.145.224.20]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1xGbcx-000207-KN; Tue, 13 Oct 2026 12:29:07 +0000 Received: from mx.expurgate.net (helo=localhost) by mx.expurgate.net with esmtp id 1xGbcw-00DIaV-Tv; Tue, 13 Oct 2026 14:29:06 +0200 Received: from [10.42.69.3] (helo=localhost) by localhost with ESMTP (eXpurgate MTA 0.9.1) (envelope-from ) id 6ace2401-e002-0a2a0a5209dd-0a2a4503a296-40 for ; Tue, 13 Oct 2026 14:29:06 +0200 Received: from [104.130.215.37] (helo=mail.xenproject.org) by tlsNG-33051d.mxtls.expurgate.net with ESMTPS (eXpurgate 4.57.1) (envelope-from ) id 6ace2411-fae8-0a2a45030019-6882d725a7b0-3 for ; Tue, 13 Oct 2026 14:29:06 +0200 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.98.2) (envelope-from ) id 1xGbct-00000003NJD-2Axv; Tue, 13 Oct 2026 12:29:03 +0000 Received: from andrewcoop by xenbits.xenproject.org with local (Exim 4.98.2) (envelope-from ) id 1xGbct-0000000F9PF-18JY; Tue, 13 Oct 2026 12:29:03 +0000 X-BeenThere: xen-announce@lists.xenproject.org List-Id: "Xen announcements \(low volume\)" List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-announce-bounces@lists.xenproject.org Precedence: list Sender: "Xen-announce" Authentication-Results: eu.smtp.expurgate.cloud; none Content-Type: multipart/mixed; boundary="=separator"; charset="utf-8" Content-Transfer-Encoding: binary MIME-Version: 1.0 X-Mailer: MIME-tools 5.515 (Entity 5.515) To: xen-announce@lists.xen.org, xen-devel@lists.xen.org, xen-users@lists.xen.org, oss-security@lists.openwall.com From: Xen.org security team CC: Xen.org security team Subject: Xen Security Advisory 521 v2 (CVE-2026-102701) - tapdisk: Out-of-bounds access in tap_ctl_connect_xenblkif() Message-Id: Date: Tue, 13 Oct 2026 12:29:03 +0000 X-purgate-ID: tlsNG-33051d/1791894546-77EC24E9-556037BB/0/0 X-purgate-type: clean X-purgate-size: 6574 --=separator Content-Type: text/plain; charset="utf-8" Content-Disposition: inline Content-Transfer-Encoding: 7bit -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Xen Security Advisory CVE-2026-102701 / XSA-521 version 2 tapdisk: Out-of-bounds access in tap_ctl_connect_xenblkif() UPDATES IN VERSION 2 ==================== Public release. ISSUE DESCRIPTION ================= Tapdisk is a userspace xen-blkback implementation used by the XAPI toolstack. During connection, multi-page rings may be negotiated between the frontend and backend. Tapdisk had no boundary check on the size requested by the frontend, and assumed it did not exceed 8. IMPACT ====== A buggy or malicious guest can cause a stack overflow in tapdisk, potentially leading to code execution. Tapdisk normally runs as root. VULNERABLE SYSTEMS ================== All versions of tapdisk are vulnerable. MITIGATION ========== There are no mitigations. CREDITS ======= This issue was discovered by Claude Opus and diagnosed as a security issue by Teddy Astie of Vates. RESOLUTION ========== Applying the attached patch resolves this issue. xsa521.patch blktap master $ sha256sum xsa521* 72ece150e9d0836f217f3382c8dc76cd51bffbe4b7610c00f219b90e5600cbc5 xsa521.patch $ DEPLOYMENT DURING EMBARGO ========================= Deployment of the patches and/or mitigations described above (or others which are substantially similar) is permitted during the embargo, even on public-facing systems with untrusted guest users and administrators. But: Distribution of updated software is prohibited (except to other members of the predisclosure list). Predisclosure list members who wish to deploy significantly different patches and/or mitigations, please contact the Xen Project Security Team. (Note: this during-embargo deployment notice is retained in post-embargo publicly released Xen Project advisories, even though it is then no longer applicable. This is to enable the community to have oversight of the Xen Project Security Team's decisionmaking.) For more information about permissible uses of embargoed information, consult the Xen Project community's agreed Security Policy: http://www.xenproject.org/security-policy.html -----BEGIN PGP SIGNATURE----- iQFABAEBCAAqFiEEI+MiLBRfRHX6gGCng/4UyVfoK9kFAmrOIvgMHHBncEB4ZW4u b3JnAAoJEIP+FMlX6CvZgdgIAKXTyop/90HNxeBpRVbYP2vrPCm2YBMzoc3YtxdM 0wWdbFvUptHWnzypCWuUGJWq8ZFf4lInnkJrj0sJ9te+OSQDqcfwTMEQuDWzBM08 lQ27H0kcum3rble2V2CFCK4uOoLYwOYX/bA5vCeGiiPQcUU3m++6IoAMaRY7G2V7 RTNJmNCtbGiC7l3ExUX9KxnFCSaX9gL99YkygybBecSsjJhdlGZj7pzvJtomv1sC fVSAFmXkivLGKX8TXQdj/48xmdqNSIQgYbdSdyZgGjmy7bxIgxB576FHwlN/fzf7 ZzpeEO8yZTFWeCJCKZavvjsq/7u2vxUtpoL3c81vSKWCOLc= =w1aW -----END PGP SIGNATURE----- --=separator Content-Type: application/octet-stream; name="xsa521.patch" Content-Disposition: attachment; filename="xsa521.patch" Content-Transfer-Encoding: base64 RnJvbTogVGVkZHkgQXN0aWUgPHRlZGR5LmFzdGllQHZhdGVzLnRlY2g+ClN1YmplY3Q6IEVuc3Vy ZSBwYXNzZWQgcmluZy1wYWdlLW9yZGVyIGlzIHZhbGlkCgpUaGUgY3VycmVudCBsb2dpYyBhY2Nl cHRzIGFueSBndWVzdCBwcm92aWRlZCByaW5nIG9yZGVyLCB3aGljaCBjYW4gY2F1c2UgYQpzdGFj ayBvdmVyZmxvdyBpbiB0YXBfY3RsX2Nvbm5lY3RfeGVuYmxraWYoKSBhcyB0YXBkaXNrX21lc3Nh Z2VfYmxraWY6OmdyZWYKY2FuIG9ubHkgc3RvcmUgOCBncmFudCByZWZlcmVuY2VzLCB5ZXQgb3Jk ZXIgbWF5IGJlIGxhcmdlciB0aGFuIDMuCgpGaXggdGhpcyBieSBjaGVja2luZyB0aGF0IHJpbmcg b3JkZXIgdmFsdWVzIGlzIGluIFswLi4zXSByYW5nZS4gIEFsc28gY2xhcmlmeQp0aGUgZ3JlZiBh cnJheSBzaXplIGluIHRhcGRpc2tfbWVzc2FnZV9ibGtpZiAoZml4ZXMgVE9ETykuCgpUaGlzIGlz IFhTQS01MjEgLyBDVkUtMjAyNi0xMDI3MDEuCgpTaWduZWQtb2ZmLWJ5OiBUZWRkeSBBc3RpZSA8 dGVkZHkuYXN0aWVAdmF0ZXMudGVjaD4KUmV2aWV3ZWQtYnk6IFJvc3MgTGFnZXJ3YWxsIDxyb3Nz LmxhZ2Vyd2FsbEBjaXRyaXguY29tPgpUZXN0ZWQtYnk6IEFsZXggQnJldHQgPGFsZXguYnJldHRA Y2l0cml4LmNvbT4KCmRpZmYgLS1naXQgYS9jb250cm9sL3RhcC1jdGwteGVuLmMgYi9jb250cm9s L3RhcC1jdGwteGVuLmMKaW5kZXggZjA5Yjc2ZWE4MjU1Li4zN2RmZjA2NjIzYmYgMTAwNjQ0Ci0t LSBhL2NvbnRyb2wvdGFwLWN0bC14ZW4uYworKysgYi9jb250cm9sL3RhcC1jdGwteGVuLmMKQEAg LTQ1LDYgKzQ1LDggQEAKICNpbmNsdWRlIDxzdHJpbmcuaD4KICNpbmNsdWRlIDx1bmlzdGQuaD4K IAorI2luY2x1ZGUgInhlbl9ibGtpZi5oIgorI2luY2x1ZGUgImRlYnVnLmgiCiAjaW5jbHVkZSAi dGFwLWN0bC5oIgogI2luY2x1ZGUgImNvbXBpbGVyLmgiCiAjaW5jbHVkZSAidXRpbC5oIgpAQCAt NTgsNyArNjAsOSBAQCB0YXBfY3RsX2Nvbm5lY3RfeGVuYmxraWYoY29uc3QgcGlkX3QgcGlkLCBj b25zdCBkb21pZF90IGRvbWlkLCBjb25zdCBpbnQgZGV2aWQsCiAgICAgdGFwZGlza19tZXNzYWdl X3QgbWVzc2FnZTsKICAgICBpbnQgaSwgZXJyOwogCi0JbWVtc2V0KCZtZXNzYWdlLCAwLCBzaXpl b2YobWVzc2FnZSkpOworICAgIEFTU0VSVChvcmRlciA+PSAwICYmIG9yZGVyIDw9IE1BWF9SSU5H X1BBR0VfT1JERVIpOworCisgICAgbWVtc2V0KCZtZXNzYWdlLCAwLCBzaXplb2YobWVzc2FnZSkp OwogICAgIG1lc3NhZ2UudHlwZSA9IFRBUERJU0tfTUVTU0FHRV9YRU5CTEtJRl9DT05ORUNUOwog ICAgIG1lc3NhZ2UuY29va2llID0gbWlub3I7CiAKZGlmZiAtLWdpdCBhL2luY2x1ZGUvdGFwZGlz ay1tZXNzYWdlLmggYi9pbmNsdWRlL3RhcGRpc2stbWVzc2FnZS5oCmluZGV4IDQ4OTAxN2NhNjkw OS4uNzIzMWExNGQzMDFjIDEwMDY0NAotLS0gYS9pbmNsdWRlL3RhcGRpc2stbWVzc2FnZS5oCisr KyBiL2luY2x1ZGUvdGFwZGlzay1tZXNzYWdlLmgKQEAgLTM0LDYgKzM0LDggQEAKICNpbmNsdWRl IDxpbnR0eXBlcy5oPgogI2luY2x1ZGUgPHN5cy90eXBlcy5oPgogCisjaW5jbHVkZSAieGVuX2Js a2lmLmgiCisKIC8qCiAgKiBUT0RPIFRoaXMgaXMgcXVpdGUgc21hbGwgc2luY2Ugd2UgZG9uJ3Qg YWxsb3cgcGF0aCBiaWdnZXIgdGhhbiAyNTYgY2hhcnMuIElmCiAgKiB3ZSBldmVyIGluY3JlYXNl IHRoaXMsIG1ha2Ugc3VyZSB0YXBkaXNrX21lc3NhZ2VfdCBzdHJ1Y3R1cmVzIGFyZSBub3QKQEAg LTEzNSw5ICsxMzcsOCBAQCB0eXBlZGVmIHN0cnVjdCB0YXBkaXNrX21lc3NhZ2VfYmxraWYgewog CiAJLyoqCiAJICogR3JhbnQgcmVmZXJlbmNlcyBmb3IgdGhlIHNoYXJlZCByaW5nLgotCSAqIFRP RE8gV2h5IDggc3BlY2lmaWNhbGx5PwogCSAqLwotCXVpbnQzMl90IGdyZWZbOF07CisJdWludDMy X3QgZ3JlZltNQVhfUklOR19QQUdFU107CiAKIAkvKioKIAkgKiBOdW1iZXIgb2YgcGFnZXMgaW4g dGhlIHJpbmcsIGV4cHJlc3NlZCBhcyBhIHBhZ2Ugb3JkZXIuCmRpZmYgLS1naXQgYS90YXBiYWNr L2Zyb250ZW5kLmMgYi90YXBiYWNrL2Zyb250ZW5kLmMKaW5kZXggMjQzZjg0MjUyZGQ2Li45ODZm NDU2NDdiZjYgMTAwNjQ0Ci0tLSBhL3RhcGJhY2svZnJvbnRlbmQuYworKysgYi90YXBiYWNrL2Zy b250ZW5kLmMKQEAgLTExOSw2ICsxMTksMTIgQEAgY29ubmVjdF90YXAodmJkX3QgKiBjb25zdCBk ZXZpY2UpCiAgICAgICAgICAgICAgICAgIiVkIiwgJm9yZGVyKSkKICAgICAgICAgb3JkZXIgPSAw OwogCisgICAgaWYgKG9yZGVyIDwgMCB8fCBvcmRlciA+IE1BWF9SSU5HX1BBR0VfT1JERVIpIHsK KyAgICAgICAgV0FSTihkZXZpY2UsICJmcm9udC1lbmQgYXNrZWQgZm9yIGFuIGludmFsaWQgcmlu ZyBvcmRlcjogJWRcbiIsIG9yZGVyKTsKKyAgICAgICAgZXJyID0gRUlOVkFMOworICAgICAgICBn b3RvIG91dDsKKyAgICB9CisKICAgICAgbnJfcGFnZXMgPSAxIDw8IG9yZGVyOwogCiAgICAgaWYg KCEoZ3JlZiA9IGNhbGxvYyhucl9wYWdlcywgc2l6ZW9mKGdyYW50X3JlZl90KSkpKSB7Cg== --=separator--