Xen Security Advisory 502 v3 (CVE-2026-62429) - vNUMA domain cleanup may race other operations

--=separator
Content-Type: text/plain; charset="utf-8"
Content-Disposition: inline
Content-Transfer-Encoding: 7bit

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

            Xen Security Advisory CVE-2026-62429 / XSA-502
                               version 3

            vNUMA domain cleanup may race other operations

UPDATES IN VERSION 3
====================

Public release.

ISSUE DESCRIPTION
=================

Accessing the vNUMA configuration data of a guest is still possible when
domain destruction has already started.  The cleaning up of that
configuration information is not synchronized with its retrieval by a
device model controlling the guest.

IMPACT
======

While Denial of Service (DoS) affecting the entire host and information
leaks and are the prevailing effect, a device model stub domain or a
de-privileged device model running in the control domain may also be
able to elevate its privileges to that of the host.

VULNERABLE SYSTEMS
==================

All Xen versions from 4.5 onwards are vulnerable.  Xen versions 4.4 and
earlier are not vulnerable.

Only entities controlling guests (on x86: HVM guests) can leverage the
vulnerability.  These are device models running in either a stub domain or
de-privileged in Dom0.

Only guests which have vNUMA enabled allow their controlling entities to
leverage the vulnerability.

MITIGATION
==========

On x86, running only PV or PVH guests will avoid the vulnerability.

Not enabling vNUMA for HVM guests will also avoid the vulnerability.

CREDITS
=======

This issue was discovered by Teddy Astie of Vates.

RESOLUTION
==========

Applying the appropriate attached patch resolves this issue.

Note that patches for released versions are generally prepared to
apply to the stable branches, and may not apply cleanly to the most
recent release tarball.  Downstreams are encouraged to update to the
tip of the stable branch before applying these patches.

xsa502.patch           xen-unstable - Xen 4.22.0
xsa502-4.21.patch      Xen 4.21.x - Xen 4.19.x
xsa502-4.18.patch      Xen 4.18.x - Xen 4.17.x

$ sha256sum xsa502*
e6150a6c468906a1bbcd4b9fca1f28cf3dc2c4617d6aab7c48507dbac003df82  xsa502.patch
f780c280539aedb3eeb4f5a43f3d2f4bc5a112ca1a2d7ad6a95eb2fbdc5f5cc8  xsa502-4.18.patch
a0b2b6f543a566e997a9f38bbd718cc81e8de8e7b442ff47e92260f70e66f647  xsa502-4.21.patch
$

DEPLOYMENT DURING EMBARGO
=========================

Deployment of the patches described above (or others which are
substantially similar) is permitted during the embargo, even on public-
facing systems with untrusted guest users and administrators.

HOWEVER, deployment of the mitigation is NOT permitted (except where
all the affected systems and VMs are administered and used only by
organisations which are members of the Xen Project Security Issues
Predisclosure List).  Specifically, deployment on public cloud systems
is NOT permitted.

This is because no longer exposing vNUMA is a guest visible configuration
change, which may lead to re-discovery of the issue.

Deployment of this mitigation is permitted only AFTER the embargo ends.

AND: Distribution of updated software is prohibited (except to other
members of the predisclosure list).

Predisclosure list members who wish to deploy significantly different
patches and/or mitigations, please contact the Xen Project Security
Team.

(Note: this during-embargo deployment notice is retained in
post-embargo publicly released Xen Project advisories, even though it
is then no longer applicable.  This is to enable the community to have
oversight of the Xen Project Security Team's decisionmaking.)

For more information about permissible uses of embargoed information,
consult the Xen Project community's agreed Security Policy:
  http://www.xenproject.org/security-policy.html
-----BEGIN PGP SIGNATURE-----

iQFABAEBCAAqFiEEI+MiLBRfRHX6gGCng/4UyVfoK9kFAmpomrQMHHBncEB4ZW4u
b3JnAAoJEIP+FMlX6CvZ58sH/2CogHDnmyLVcaB68ySxCnCZI5qNt0VonyH4n3s0
Ef4H74nwh3osLXrvkcnXvbrH4hqDKI3MtydScfHc5dpa1rQHXO8utHxZtGUU+CSv
A1nSYD42pu96V5xvTXO+xK5sCZoBREgUNS2TGCE02dkwXdngsCWnAPFn1BQi7wsG
LJWuzurlSRSc28PPuIEaKJM+eiyG88ep5fADrLycVPvltqd6bktEE1Xa82h5iSYd
9K7KTEDT9Kc0HZEg4x0h2OBwVqGdKF+8FHDNCEtpiwtE2Ao6OycTVzGNX7f+fq4/
CeQjI8I94j/r1zVPtuGBHNVkUdgrCIe36156RC7f1LFy0JM=
=7hf1
-----END PGP SIGNATURE-----

--=separator
Content-Type: application/octet-stream; name="xsa502.patch"
Content-Disposition: attachment; filename="xsa502.patch"
Content-Transfer-Encoding: base64

RnJvbTogSmFuIEJldWxpY2ggPGpiZXVsaWNoQHN1c2UuY29tPgpTdWJqZWN0
OiB2TlVNQTogY2xvc2UgcmFjZSB3aW5kb3cgaW4gZG9tYWluIGNsZWFudXAK
CkNhbGxpbmcgdm51bWFfZGVzdHJveSgpIHdpdGhvdXQgYW55IGxvY2tpbmcg
Y2FuIHJhY2UgdGhlIGhhbmRsaW5nIG9mIGJvdGgKWEVOTUVNX2dldF92bnVt
YWluZm8gYW5kIFhFTl9ET01DVExfc2V0dm51bWFpbmZvLiBXaGlsZSB0aGUg
bGF0dGVyIGlzLAp3aXRob3V0IEZsYXNrLCBzdHJpY3RseSBvbmx5IGV4cG9z
ZWQgdG8gdGhlIGNvbnRyb2wgZG9tYWluLCB0aGUgZm9ybWVyCmNhbiBhbHNv
IGJlIGludm9rZWQgYnkgYSBzdHViZG9tIERNIG9yIGEgZGUtcHJpdmlsZWdl
ZCBETSBydW5uaW5nIGluIHRoZQpjb250cm9sIGRvbWFpbi4gSXNvbGF0ZSB0
aGUgbG9naWMgdXNlZCBieSBYRU5fRE9NQ1RMX3NldHZudW1haW5mbyBpbnRv
IGEKbmV3IGhlbHBlciBmdW5jdGlvbiwgd2hpY2ggdGhlbiBpcyBhbHNvIHVz
ZWQgZnJvbSBkb21haW5fa2lsbCgpLiBXaGlsZQpkb2luZyBzbyBhbHNvIG1v
dmUgdGhlIHZudW1hX2Rlc3Ryb3koKSBpbnZvY2F0aW9uIG91dCBvZiB0aGUg
bG9ja2VkCnJlZ2lvbi4KCldpdGggZC0+dm51bWEgcHJvcGVybHkgY2xlYXJl
ZCBieSBkb21haW5fa2lsbCgpLCBYRU5NRU1fZ2V0X3ZudW1haW5mbyBub3cK
cmVhbGx5IG9ubHkgbmVlZHMgdG8gY2hlY2sgZm9yIHRoZSBmaWVsZCBiZWlu
ZyBOVUxMLiBUaGF0IGNoZWNrIG5lZWRzCnJlcGVhdGluZywgdGhvdWdoLCBh
ZnRlciByZS1hY3F1aXJpbmcgdGhlIGxvY2suCgpUaGlzIGlzIENWRS0yMDI2
LTYyNDI5IC8gWFNBLTUwMi4KCkZpeGVzOiA5Njk1MDE0OTY2YjUgKCJ4ZW46
IHZudW1hIHRvcG9sb2d5IGFuZCBzdWJvcCBoeXBlcmNhbGxzIikKUmVwb3J0
ZWQtYnk6IFRlZGR5IEFzdGllIDx0ZWRkeS5hc3RpZUB2YXRlcy50ZWNoPgpT
aWduZWQtb2ZmLWJ5OiBKYW4gQmV1bGljaCA8amJldWxpY2hAc3VzZS5jb20+
ClJldmlld2VkLWJ5OiBKdWVyZ2VuIEdyb3NzIDxqZ3Jvc3NAc3VzZS5jb20+
CgotLS0gYS94ZW4vY29tbW9uL2RvbWFpbi5jCisrKyBiL3hlbi9jb21tb24v
ZG9tYWluLmMKQEAgLTEzMjAsNyArMTMyMCw3IEBAIGludCBkb21haW5fa2ls
bChzdHJ1Y3QgZG9tYWluICpkKQogICAgICAgICBkLT5pc19keWluZyA9IERP
TURZSU5HX2R5aW5nOwogICAgICAgICByc3Bpbl9iYXJyaWVyKCZkLT5kb21h
aW5fbG9jayk7CiAgICAgICAgIGFyZ29fZGVzdHJveShkKTsKLSAgICAgICAg
dm51bWFfZGVzdHJveShkLT52bnVtYSk7CisgICAgICAgIHZudW1hX3JlcGxh
Y2UoZCwgTlVMTCk7CiAgICAgICAgIGRvbWFpbl9zZXRfb3V0c3RhbmRpbmdf
cGFnZXMoZCwgMCk7CiAgICAgICAgIC8qIGZhbGx0aHJvdWdoICovCiAgICAg
Y2FzZSBET01EWUlOR19keWluZzoKLS0tIGEveGVuL2NvbW1vbi9kb21jdGwu
YworKysgYi94ZW4vY29tbW9uL2RvbWN0bC5jCkBAIC0xNDAsNyArMTQwLDcg
QEAgdm9pZCBkb21jdGxfbG9ja19yZWxlYXNlKHZvaWQpCiAgICAgc3Bpbl91
bmxvY2soJmN1cnJlbnQtPmRvbWFpbi0+aHlwZXJjYWxsX2RlYWRsb2NrX211
dGV4KTsKIH0KIAotdm9pZCB2bnVtYV9kZXN0cm95KHN0cnVjdCB2bnVtYV9p
bmZvICp2bnVtYSkKK3N0YXRpYyB2b2lkIHZudW1hX2Rlc3Ryb3koc3RydWN0
IHZudW1hX2luZm8gKnZudW1hKQogewogICAgIGlmICggdm51bWEgKQogICAg
IHsKQEAgLTE1Miw2ICsxNTIsMTkgQEAgdm9pZCB2bnVtYV9kZXN0cm95KHN0
cnVjdCB2bnVtYV9pbmZvICp2bgogICAgIH0KIH0KIAorLyogT3ZlcndyaXRl
IChyZXBsYWNlKSB2bnVtYSB0b3BvbG9neSBmb3IgYSBkb21haW4uICovCit2
b2lkIHZudW1hX3JlcGxhY2Uoc3RydWN0IGRvbWFpbiAqZCwgc3RydWN0IHZu
dW1hX2luZm8gKnZudW1hKQoreworICAgIHN0cnVjdCB2bnVtYV9pbmZvICpv
bGQ7CisKKyAgICB3cml0ZV9sb2NrKCZkLT52bnVtYV9yd2xvY2spOworICAg
IG9sZCA9IGQtPnZudW1hOworICAgIGQtPnZudW1hID0gdm51bWE7CisgICAg
d3JpdGVfdW5sb2NrKCZkLT52bnVtYV9yd2xvY2spOworCisgICAgdm51bWFf
ZGVzdHJveShvbGQpOworfQorCiAvKgogICogQWxsb2NhdGVzIG1lbW9yeSBm
b3Igdk5VTUEsICoqdm51bWEgc2hvdWxkIGJlIE5VTEwuCiAgKiBDYWxsZXIg
aGFzIHRvIG1ha2Ugc3VyZSB0aGF0IGRvbWFpbiBoYXMgbWF4X3BhZ2VzCkBA
IC04OTUsMTIgKzkwOCw3IEBAIGxvbmcgZG9fZG9tY3RsKFhFTl9HVUVTVF9I
QU5ETEVfUEFSQU0oeGUKICAgICAgICAgICAgIGJyZWFrOwogICAgICAgICB9
CiAKLSAgICAgICAgLyogb3ZlcndyaXRlIHZudW1hIHRvcG9sb2d5IGZvciBk
b21haW4uICovCi0gICAgICAgIHdyaXRlX2xvY2soJmQtPnZudW1hX3J3bG9j
ayk7Ci0gICAgICAgIHZudW1hX2Rlc3Ryb3koZC0+dm51bWEpOwotICAgICAg
ICBkLT52bnVtYSA9IHZudW1hOwotICAgICAgICB3cml0ZV91bmxvY2soJmQt
PnZudW1hX3J3bG9jayk7Ci0KKyAgICAgICAgdm51bWFfcmVwbGFjZShkLCB2
bnVtYSk7CiAgICAgICAgIGJyZWFrOwogICAgIH0KIAotLS0gYS94ZW4vY29t
bW9uL21lbW9yeS5jCisrKyBiL3hlbi9jb21tb24vbWVtb3J5LmMKQEAgLTE5
MjIsMTIgKzE5MjIsMjQgQEAgbG9uZyBkb19tZW1vcnlfb3AodW5zaWduZWQg
bG9uZyBjbWQsIFhFTgogICAgICAgICAgICAgZ290byB2bnVtYWluZm9fb3V0
OwogICAgICAgICB9CiAKKyAgICAgICAgcmVhZF9sb2NrKCZkLT52bnVtYV9y
d2xvY2spOworCisgICAgICAgIC8qCisgICAgICAgICAqIENoZWNrIGQtPnZu
dW1hIGFnYWluIGFmdGVyIHJlLWFjcXVpcmluZyB0aGUgbG9jayBhcyB3ZSBj
YW4gcmFjZQorICAgICAgICAgKiB3aXRoIGRvbWFpbiBkZXN0cnVjdGlvbi4K
KyAgICAgICAgICovCisgICAgICAgIGlmICggIWQtPnZudW1hICkKKyAgICAg
ICAgeworICAgICAgICAgICAgQVNTRVJUKGQtPmlzX2R5aW5nKTsKKyAgICAg
ICAgICAgIHJlYWRfdW5sb2NrKCZkLT52bnVtYV9yd2xvY2spOworICAgICAg
ICAgICAgcmMgPSAtRVNSQ0g7CisgICAgICAgICAgICBnb3RvIHZudW1haW5m
b19vdXQ7CisgICAgICAgIH0KKwogICAgICAgICAvKgogICAgICAgICAgKiBD
aGVjayBpZiB2bnVtYSBpbmZvIGhhcyBjaGFuZ2VkIGFuZCBpZiB0aGUgYWxs
b2NhdGVkIGFycmF5cwogICAgICAgICAgKiBhcmUgbm90IGJpZyBlbm91Z2gu
CiAgICAgICAgICAqLwotICAgICAgICByZWFkX2xvY2soJmQtPnZudW1hX3J3
bG9jayk7Ci0KICAgICAgICAgaWYgKCBkb21fdm5vZGVzIDwgZC0+dm51bWEt
Pm5yX3Zub2RlcyB8fAogICAgICAgICAgICAgIGRvbV92cmFuZ2VzIDwgZC0+
dm51bWEtPm5yX3ZtZW1yYW5nZXMgfHwKICAgICAgICAgICAgICBkb21fdmNw
dXMgPCBkLT5tYXhfdmNwdXMgKQotLS0gYS94ZW4vaW5jbHVkZS94ZW4vZG9t
YWluLmgKKysrIGIveGVuL2luY2x1ZGUveGVuL2RvbWFpbi5oCkBAIC0xOTMs
OSArMTkzLDEwIEBAIHN0cnVjdCB2bnVtYV9pbmZvIHsKIH07CiAKICNpZm5k
ZWYgQ09ORklHX1BWX1NISU1fRVhDTFVTSVZFCi12b2lkIHZudW1hX2Rlc3Ry
b3koc3RydWN0IHZudW1hX2luZm8gKnZudW1hKTsKK3ZvaWQgdm51bWFfcmVw
bGFjZShzdHJ1Y3QgZG9tYWluICpkLCBzdHJ1Y3Qgdm51bWFfaW5mbyAqdm51
bWEpOwogI2Vsc2UKLXN0YXRpYyBpbmxpbmUgdm9pZCB2bnVtYV9kZXN0cm95
KHN0cnVjdCB2bnVtYV9pbmZvICp2bnVtYSkgeyBBU1NFUlQoIXZudW1hKTsg
fQorc3RhdGljIGlubGluZSB2b2lkIHZudW1hX3JlcGxhY2Uoc3RydWN0IGRv
bWFpbiAqZCwgc3RydWN0IHZudW1hX2luZm8gKnZudW1hKQoreyBBU1NFUlQo
IXZudW1hKTsgfQogI2VuZGlmCiAKICNpZmRlZiBDT05GSUdfVk1UUkFDRQo=

--=separator
Content-Type: application/octet-stream; name="xsa502-4.18.patch"
Content-Disposition: attachment; filename="xsa502-4.18.patch"
Content-Transfer-Encoding: base64

RnJvbTogSmFuIEJldWxpY2ggPGpiZXVsaWNoQHN1c2UuY29tPgpTdWJqZWN0
OiB2TlVNQTogY2xvc2UgcmFjZSB3aW5kb3cgaW4gZG9tYWluIGNsZWFudXAK
CkNhbGxpbmcgdm51bWFfZGVzdHJveSgpIHdpdGhvdXQgYW55IGxvY2tpbmcg
Y2FuIHJhY2UgdGhlIGhhbmRsaW5nIG9mIGJvdGgKWEVOTUVNX2dldF92bnVt
YWluZm8gYW5kIFhFTl9ET01DVExfc2V0dm51bWFpbmZvLiBXaGlsZSB0aGUg
bGF0dGVyIGlzLAp3aXRob3V0IEZsYXNrLCBzdHJpY3RseSBvbmx5IGV4cG9z
ZWQgdG8gdGhlIGNvbnRyb2wgZG9tYWluLCB0aGUgZm9ybWVyCmNhbiBhbHNv
IGJlIGludm9rZWQgYnkgYSBzdHViZG9tIERNIG9yIGEgZGUtcHJpdmlsZWdl
ZCBETSBydW5uaW5nIGluIHRoZQpjb250cm9sIGRvbWFpbi4gSXNvbGF0ZSB0
aGUgbG9naWMgdXNlZCBieSBYRU5fRE9NQ1RMX3NldHZudW1haW5mbyBpbnRv
IGEKbmV3IGhlbHBlciBmdW5jdGlvbiwgd2hpY2ggdGhlbiBpcyBhbHNvIHVz
ZWQgZnJvbSBkb21haW5fa2lsbCgpLiBXaGlsZQpkb2luZyBzbyBhbHNvIG1v
dmUgdGhlIHZudW1hX2Rlc3Ryb3koKSBpbnZvY2F0aW9uIG91dCBvZiB0aGUg
bG9ja2VkCnJlZ2lvbi4KCldpdGggZC0+dm51bWEgcHJvcGVybHkgY2xlYXJl
ZCBieSBkb21haW5fa2lsbCgpLCBYRU5NRU1fZ2V0X3ZudW1haW5mbyBub3cK
cmVhbGx5IG9ubHkgbmVlZHMgdG8gY2hlY2sgZm9yIHRoZSBmaWVsZCBiZWlu
ZyBOVUxMLiBUaGF0IGNoZWNrIG5lZWRzCnJlcGVhdGluZywgdGhvdWdoLCBh
ZnRlciByZS1hY3F1aXJpbmcgdGhlIGxvY2suCgpUaGlzIGlzIENWRS0yMDI2
LTYyNDI5IC8gWFNBLTUwMi4KCkZpeGVzOiA5Njk1MDE0OTY2YjUgKCJ4ZW46
IHZudW1hIHRvcG9sb2d5IGFuZCBzdWJvcCBoeXBlcmNhbGxzIikKUmVwb3J0
ZWQtYnk6IFRlZGR5IEFzdGllIDx0ZWRkeS5hc3RpZUB2YXRlcy50ZWNoPgpT
aWduZWQtb2ZmLWJ5OiBKYW4gQmV1bGljaCA8amJldWxpY2hAc3VzZS5jb20+
ClJldmlld2VkLWJ5OiBKdWVyZ2VuIEdyb3NzIDxqZ3Jvc3NAc3VzZS5jb20+
CgotLS0gYS94ZW4vY29tbW9uL2RvbWFpbi5jCisrKyBiL3hlbi9jb21tb24v
ZG9tYWluLmMKQEAgLTEwMDMsNyArMTAwMyw3IEBAIGludCBkb21haW5fa2ls
bChzdHJ1Y3QgZG9tYWluICpkKQogICAgICAgICBkLT5pc19keWluZyA9IERP
TURZSU5HX2R5aW5nOwogICAgICAgICBzcGluX2JhcnJpZXIoJmQtPmRvbWFp
bl9sb2NrKTsKICAgICAgICAgYXJnb19kZXN0cm95KGQpOwotICAgICAgICB2
bnVtYV9kZXN0cm95KGQtPnZudW1hKTsKKyAgICAgICAgdm51bWFfcmVwbGFj
ZShkLCBOVUxMKTsKICAgICAgICAgZG9tYWluX3NldF9vdXRzdGFuZGluZ19w
YWdlcyhkLCAwKTsKICAgICAgICAgLyogZmFsbHRocm91Z2ggKi8KICAgICBj
YXNlIERPTURZSU5HX2R5aW5nOgotLS0gYS94ZW4vY29tbW9uL2RvbWN0bC5j
CisrKyBiL3hlbi9jb21tb24vZG9tY3RsLmMKQEAgLTE1Myw3ICsxNTMsNyBA
QCB2b2lkIGRvbWN0bF9sb2NrX3JlbGVhc2Uodm9pZCkKICAgICBzcGluX3Vu
bG9jaygmY3VycmVudC0+ZG9tYWluLT5oeXBlcmNhbGxfZGVhZGxvY2tfbXV0
ZXgpOwogfQogCi12b2lkIHZudW1hX2Rlc3Ryb3koc3RydWN0IHZudW1hX2lu
Zm8gKnZudW1hKQorc3RhdGljIHZvaWQgdm51bWFfZGVzdHJveShzdHJ1Y3Qg
dm51bWFfaW5mbyAqdm51bWEpCiB7CiAgICAgaWYgKCB2bnVtYSApCiAgICAg
ewpAQCAtMTY1LDYgKzE2NSwxOSBAQCB2b2lkIHZudW1hX2Rlc3Ryb3koc3Ry
dWN0IHZudW1hX2luZm8gKnZuCiAgICAgfQogfQogCisvKiBPdmVyd3JpdGUg
KHJlcGxhY2UpIHZudW1hIHRvcG9sb2d5IGZvciBhIGRvbWFpbi4gKi8KK3Zv
aWQgdm51bWFfcmVwbGFjZShzdHJ1Y3QgZG9tYWluICpkLCBzdHJ1Y3Qgdm51
bWFfaW5mbyAqdm51bWEpCit7CisgICAgc3RydWN0IHZudW1hX2luZm8gKm9s
ZDsKKworICAgIHdyaXRlX2xvY2soJmQtPnZudW1hX3J3bG9jayk7CisgICAg
b2xkID0gZC0+dm51bWE7CisgICAgZC0+dm51bWEgPSB2bnVtYTsKKyAgICB3
cml0ZV91bmxvY2soJmQtPnZudW1hX3J3bG9jayk7CisKKyAgICB2bnVtYV9k
ZXN0cm95KG9sZCk7Cit9CisKIC8qCiAgKiBBbGxvY2F0ZXMgbWVtb3J5IGZv
ciB2TlVNQSwgKip2bnVtYSBzaG91bGQgYmUgTlVMTC4KICAqIENhbGxlciBo
YXMgdG8gbWFrZSBzdXJlIHRoYXQgZG9tYWluIGhhcyBtYXhfcGFnZXMKQEAg
LTkwOCwxMiArOTIxLDcgQEAgbG9uZyBkb19kb21jdGwoWEVOX0dVRVNUX0hB
TkRMRV9QQVJBTSh4ZQogICAgICAgICAgICAgYnJlYWs7CiAgICAgICAgIH0K
IAotICAgICAgICAvKiBvdmVyd3JpdGUgdm51bWEgdG9wb2xvZ3kgZm9yIGRv
bWFpbi4gKi8KLSAgICAgICAgd3JpdGVfbG9jaygmZC0+dm51bWFfcndsb2Nr
KTsKLSAgICAgICAgdm51bWFfZGVzdHJveShkLT52bnVtYSk7Ci0gICAgICAg
IGQtPnZudW1hID0gdm51bWE7Ci0gICAgICAgIHdyaXRlX3VubG9jaygmZC0+
dm51bWFfcndsb2NrKTsKLQorICAgICAgICB2bnVtYV9yZXBsYWNlKGQsIHZu
dW1hKTsKICAgICAgICAgYnJlYWs7CiAgICAgfQogCi0tLSBhL3hlbi9jb21t
b24vbWVtb3J5LmMKKysrIGIveGVuL2NvbW1vbi9tZW1vcnkuYwpAQCAtMTc2
MSwxMiArMTc2MSwyNCBAQCBsb25nIGRvX21lbW9yeV9vcCh1bnNpZ25lZCBs
b25nIGNtZCwgWEVOCiAgICAgICAgICAgICBnb3RvIHZudW1haW5mb19vdXQ7
CiAgICAgICAgIH0KIAorICAgICAgICByZWFkX2xvY2soJmQtPnZudW1hX3J3
bG9jayk7CisKKyAgICAgICAgLyoKKyAgICAgICAgICogQ2hlY2sgZC0+dm51
bWEgYWdhaW4gYWZ0ZXIgcmUtYWNxdWlyaW5nIHRoZSBsb2NrIGFzIHdlIGNh
biByYWNlCisgICAgICAgICAqIHdpdGggZG9tYWluIGRlc3RydWN0aW9uLgor
ICAgICAgICAgKi8KKyAgICAgICAgaWYgKCAhZC0+dm51bWEgKQorICAgICAg
ICB7CisgICAgICAgICAgICBBU1NFUlQoZC0+aXNfZHlpbmcpOworICAgICAg
ICAgICAgcmVhZF91bmxvY2soJmQtPnZudW1hX3J3bG9jayk7CisgICAgICAg
ICAgICByYyA9IC1FU1JDSDsKKyAgICAgICAgICAgIGdvdG8gdm51bWFpbmZv
X291dDsKKyAgICAgICAgfQorCiAgICAgICAgIC8qCiAgICAgICAgICAqIENo
ZWNrIGlmIHZudW1hIGluZm8gaGFzIGNoYW5nZWQgYW5kIGlmIHRoZSBhbGxv
Y2F0ZWQgYXJyYXlzCiAgICAgICAgICAqIGFyZSBub3QgYmlnIGVub3VnaC4K
ICAgICAgICAgICovCi0gICAgICAgIHJlYWRfbG9jaygmZC0+dm51bWFfcnds
b2NrKTsKLQogICAgICAgICBpZiAoIGRvbV92bm9kZXMgPCBkLT52bnVtYS0+
bnJfdm5vZGVzIHx8CiAgICAgICAgICAgICAgZG9tX3ZyYW5nZXMgPCBkLT52
bnVtYS0+bnJfdm1lbXJhbmdlcyB8fAogICAgICAgICAgICAgIGRvbV92Y3B1
cyA8IGQtPm1heF92Y3B1cyApCi0tLSBhL3hlbi9pbmNsdWRlL3hlbi9kb21h
aW4uaAorKysgYi94ZW4vaW5jbHVkZS94ZW4vZG9tYWluLmgKQEAgLTE1OSw5
ICsxNTksMTAgQEAgc3RydWN0IHZudW1hX2luZm8gewogfTsKIAogI2lmbmRl
ZiBDT05GSUdfUFZfU0hJTV9FWENMVVNJVkUKLXZvaWQgdm51bWFfZGVzdHJv
eShzdHJ1Y3Qgdm51bWFfaW5mbyAqdm51bWEpOwordm9pZCB2bnVtYV9yZXBs
YWNlKHN0cnVjdCBkb21haW4gKmQsIHN0cnVjdCB2bnVtYV9pbmZvICp2bnVt
YSk7CiAjZWxzZQotc3RhdGljIGlubGluZSB2b2lkIHZudW1hX2Rlc3Ryb3ko
c3RydWN0IHZudW1hX2luZm8gKnZudW1hKSB7IEFTU0VSVCghdm51bWEpOyB9
CitzdGF0aWMgaW5saW5lIHZvaWQgdm51bWFfcmVwbGFjZShzdHJ1Y3QgZG9t
YWluICpkLCBzdHJ1Y3Qgdm51bWFfaW5mbyAqdm51bWEpCit7IEFTU0VSVCgh
dm51bWEpOyB9CiAjZW5kaWYKIAogZXh0ZXJuIGJvb2wgdm10cmFjZV9hdmFp
bGFibGU7Cg==

--=separator
Content-Type: application/octet-stream; name="xsa502-4.21.patch"
Content-Disposition: attachment; filename="xsa502-4.21.patch"
Content-Transfer-Encoding: base64

RnJvbTogSmFuIEJldWxpY2ggPGpiZXVsaWNoQHN1c2UuY29tPgpTdWJqZWN0
OiB2TlVNQTogY2xvc2UgcmFjZSB3aW5kb3cgaW4gZG9tYWluIGNsZWFudXAK
CkNhbGxpbmcgdm51bWFfZGVzdHJveSgpIHdpdGhvdXQgYW55IGxvY2tpbmcg
Y2FuIHJhY2UgdGhlIGhhbmRsaW5nIG9mIGJvdGgKWEVOTUVNX2dldF92bnVt
YWluZm8gYW5kIFhFTl9ET01DVExfc2V0dm51bWFpbmZvLiBXaGlsZSB0aGUg
bGF0dGVyIGlzLAp3aXRob3V0IEZsYXNrLCBzdHJpY3RseSBvbmx5IGV4cG9z
ZWQgdG8gdGhlIGNvbnRyb2wgZG9tYWluLCB0aGUgZm9ybWVyCmNhbiBhbHNv
IGJlIGludm9rZWQgYnkgYSBzdHViZG9tIERNIG9yIGEgZGUtcHJpdmlsZWdl
ZCBETSBydW5uaW5nIGluIHRoZQpjb250cm9sIGRvbWFpbi4gSXNvbGF0ZSB0
aGUgbG9naWMgdXNlZCBieSBYRU5fRE9NQ1RMX3NldHZudW1haW5mbyBpbnRv
IGEKbmV3IGhlbHBlciBmdW5jdGlvbiwgd2hpY2ggdGhlbiBpcyBhbHNvIHVz
ZWQgZnJvbSBkb21haW5fa2lsbCgpLiBXaGlsZQpkb2luZyBzbyBhbHNvIG1v
dmUgdGhlIHZudW1hX2Rlc3Ryb3koKSBpbnZvY2F0aW9uIG91dCBvZiB0aGUg
bG9ja2VkCnJlZ2lvbi4KCldpdGggZC0+dm51bWEgcHJvcGVybHkgY2xlYXJl
ZCBieSBkb21haW5fa2lsbCgpLCBYRU5NRU1fZ2V0X3ZudW1haW5mbyBub3cK
cmVhbGx5IG9ubHkgbmVlZHMgdG8gY2hlY2sgZm9yIHRoZSBmaWVsZCBiZWlu
ZyBOVUxMLiBUaGF0IGNoZWNrIG5lZWRzCnJlcGVhdGluZywgdGhvdWdoLCBh
ZnRlciByZS1hY3F1aXJpbmcgdGhlIGxvY2suCgpUaGlzIGlzIENWRS0yMDI2
LTYyNDI5IC8gWFNBLTUwMi4KCkZpeGVzOiA5Njk1MDE0OTY2YjUgKCJ4ZW46
IHZudW1hIHRvcG9sb2d5IGFuZCBzdWJvcCBoeXBlcmNhbGxzIikKUmVwb3J0
ZWQtYnk6IFRlZGR5IEFzdGllIDx0ZWRkeS5hc3RpZUB2YXRlcy50ZWNoPgpT
aWduZWQtb2ZmLWJ5OiBKYW4gQmV1bGljaCA8amJldWxpY2hAc3VzZS5jb20+
ClJldmlld2VkLWJ5OiBKdWVyZ2VuIEdyb3NzIDxqZ3Jvc3NAc3VzZS5jb20+
CgotLS0gYS94ZW4vY29tbW9uL2RvbWFpbi5jCisrKyBiL3hlbi9jb21tb24v
ZG9tYWluLmMKQEAgLTEyNTUsNyArMTI1NSw3IEBAIGludCBkb21haW5fa2ls
bChzdHJ1Y3QgZG9tYWluICpkKQogICAgICAgICBkLT5pc19keWluZyA9IERP
TURZSU5HX2R5aW5nOwogICAgICAgICByc3Bpbl9iYXJyaWVyKCZkLT5kb21h
aW5fbG9jayk7CiAgICAgICAgIGFyZ29fZGVzdHJveShkKTsKLSAgICAgICAg
dm51bWFfZGVzdHJveShkLT52bnVtYSk7CisgICAgICAgIHZudW1hX3JlcGxh
Y2UoZCwgTlVMTCk7CiAgICAgICAgIGRvbWFpbl9zZXRfb3V0c3RhbmRpbmdf
cGFnZXMoZCwgMCk7CiAgICAgICAgIC8qIGZhbGx0aHJvdWdoICovCiAgICAg
Y2FzZSBET01EWUlOR19keWluZzoKLS0tIGEveGVuL2NvbW1vbi9kb21jdGwu
YworKysgYi94ZW4vY29tbW9uL2RvbWN0bC5jCkBAIC0xNDIsNyArMTQyLDcg
QEAgdm9pZCBkb21jdGxfbG9ja19yZWxlYXNlKHZvaWQpCiAgICAgc3Bpbl91
bmxvY2soJmN1cnJlbnQtPmRvbWFpbi0+aHlwZXJjYWxsX2RlYWRsb2NrX211
dGV4KTsKIH0KIAotdm9pZCB2bnVtYV9kZXN0cm95KHN0cnVjdCB2bnVtYV9p
bmZvICp2bnVtYSkKK3N0YXRpYyB2b2lkIHZudW1hX2Rlc3Ryb3koc3RydWN0
IHZudW1hX2luZm8gKnZudW1hKQogewogICAgIGlmICggdm51bWEgKQogICAg
IHsKQEAgLTE1NCw2ICsxNTQsMTkgQEAgdm9pZCB2bnVtYV9kZXN0cm95KHN0
cnVjdCB2bnVtYV9pbmZvICp2bgogICAgIH0KIH0KIAorLyogT3ZlcndyaXRl
IChyZXBsYWNlKSB2bnVtYSB0b3BvbG9neSBmb3IgYSBkb21haW4uICovCit2
b2lkIHZudW1hX3JlcGxhY2Uoc3RydWN0IGRvbWFpbiAqZCwgc3RydWN0IHZu
dW1hX2luZm8gKnZudW1hKQoreworICAgIHN0cnVjdCB2bnVtYV9pbmZvICpv
bGQ7CisKKyAgICB3cml0ZV9sb2NrKCZkLT52bnVtYV9yd2xvY2spOworICAg
IG9sZCA9IGQtPnZudW1hOworICAgIGQtPnZudW1hID0gdm51bWE7CisgICAg
d3JpdGVfdW5sb2NrKCZkLT52bnVtYV9yd2xvY2spOworCisgICAgdm51bWFf
ZGVzdHJveShvbGQpOworfQorCiAvKgogICogQWxsb2NhdGVzIG1lbW9yeSBm
b3Igdk5VTUEsICoqdm51bWEgc2hvdWxkIGJlIE5VTEwuCiAgKiBDYWxsZXIg
aGFzIHRvIG1ha2Ugc3VyZSB0aGF0IGRvbWFpbiBoYXMgbWF4X3BhZ2VzCkBA
IC05MDcsMTIgKzkyMCw3IEBAIGxvbmcgZG9fZG9tY3RsKFhFTl9HVUVTVF9I
QU5ETEVfUEFSQU0oeGUKICAgICAgICAgICAgIGJyZWFrOwogICAgICAgICB9
CiAKLSAgICAgICAgLyogb3ZlcndyaXRlIHZudW1hIHRvcG9sb2d5IGZvciBk
b21haW4uICovCi0gICAgICAgIHdyaXRlX2xvY2soJmQtPnZudW1hX3J3bG9j
ayk7Ci0gICAgICAgIHZudW1hX2Rlc3Ryb3koZC0+dm51bWEpOwotICAgICAg
ICBkLT52bnVtYSA9IHZudW1hOwotICAgICAgICB3cml0ZV91bmxvY2soJmQt
PnZudW1hX3J3bG9jayk7Ci0KKyAgICAgICAgdm51bWFfcmVwbGFjZShkLCB2
bnVtYSk7CiAgICAgICAgIGJyZWFrOwogICAgIH0KIAotLS0gYS94ZW4vY29t
bW9uL21lbW9yeS5jCisrKyBiL3hlbi9jb21tb24vbWVtb3J5LmMKQEAgLTE4
MDQsMTIgKzE4MDQsMjQgQEAgbG9uZyBkb19tZW1vcnlfb3AodW5zaWduZWQg
bG9uZyBjbWQsIFhFTgogICAgICAgICAgICAgZ290byB2bnVtYWluZm9fb3V0
OwogICAgICAgICB9CiAKKyAgICAgICAgcmVhZF9sb2NrKCZkLT52bnVtYV9y
d2xvY2spOworCisgICAgICAgIC8qCisgICAgICAgICAqIENoZWNrIGQtPnZu
dW1hIGFnYWluIGFmdGVyIHJlLWFjcXVpcmluZyB0aGUgbG9jayBhcyB3ZSBj
YW4gcmFjZQorICAgICAgICAgKiB3aXRoIGRvbWFpbiBkZXN0cnVjdGlvbi4K
KyAgICAgICAgICovCisgICAgICAgIGlmICggIWQtPnZudW1hICkKKyAgICAg
ICAgeworICAgICAgICAgICAgQVNTRVJUKGQtPmlzX2R5aW5nKTsKKyAgICAg
ICAgICAgIHJlYWRfdW5sb2NrKCZkLT52bnVtYV9yd2xvY2spOworICAgICAg
ICAgICAgcmMgPSAtRVNSQ0g7CisgICAgICAgICAgICBnb3RvIHZudW1haW5m
b19vdXQ7CisgICAgICAgIH0KKwogICAgICAgICAvKgogICAgICAgICAgKiBD
aGVjayBpZiB2bnVtYSBpbmZvIGhhcyBjaGFuZ2VkIGFuZCBpZiB0aGUgYWxs
b2NhdGVkIGFycmF5cwogICAgICAgICAgKiBhcmUgbm90IGJpZyBlbm91Z2gu
CiAgICAgICAgICAqLwotICAgICAgICByZWFkX2xvY2soJmQtPnZudW1hX3J3
bG9jayk7Ci0KICAgICAgICAgaWYgKCBkb21fdm5vZGVzIDwgZC0+dm51bWEt
Pm5yX3Zub2RlcyB8fAogICAgICAgICAgICAgIGRvbV92cmFuZ2VzIDwgZC0+
dm51bWEtPm5yX3ZtZW1yYW5nZXMgfHwKICAgICAgICAgICAgICBkb21fdmNw
dXMgPCBkLT5tYXhfdmNwdXMgKQotLS0gYS94ZW4vaW5jbHVkZS94ZW4vZG9t
YWluLmgKKysrIGIveGVuL2luY2x1ZGUveGVuL2RvbWFpbi5oCkBAIC0xODgs
OSArMTg4LDEwIEBAIHN0cnVjdCB2bnVtYV9pbmZvIHsKIH07CiAKICNpZm5k
ZWYgQ09ORklHX1BWX1NISU1fRVhDTFVTSVZFCi12b2lkIHZudW1hX2Rlc3Ry
b3koc3RydWN0IHZudW1hX2luZm8gKnZudW1hKTsKK3ZvaWQgdm51bWFfcmVw
bGFjZShzdHJ1Y3QgZG9tYWluICpkLCBzdHJ1Y3Qgdm51bWFfaW5mbyAqdm51
bWEpOwogI2Vsc2UKLXN0YXRpYyBpbmxpbmUgdm9pZCB2bnVtYV9kZXN0cm95
KHN0cnVjdCB2bnVtYV9pbmZvICp2bnVtYSkgeyBBU1NFUlQoIXZudW1hKTsg
fQorc3RhdGljIGlubGluZSB2b2lkIHZudW1hX3JlcGxhY2Uoc3RydWN0IGRv
bWFpbiAqZCwgc3RydWN0IHZudW1hX2luZm8gKnZudW1hKQoreyBBU1NFUlQo
IXZudW1hKTsgfQogI2VuZGlmCiAKIGV4dGVybiBib29sIHZtdHJhY2VfYXZh
aWxhYmxlOwo=

--=separator--