Re:
Alperen Erkan <[email protected]> Sat, 25 Jul 2026 11:27:50 +0300
| Newsgroups | gmane.os.hurd.bugs |
|---|---|
| Message-ID | <CAB6ChQ6o9ZwZ7ceKS2WPgYxiYg4yhWyAzBTiCT=6oU0=p36eNw@mail.gmail.com> |
--000000000000820fcf06576b4440
Content-Type: multipart/alternative; boundary="000000000000820fcd06576b443e"
--000000000000820fcd06576b443e
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Subject: Re: [PATCH] ipc_kmsg.c / ipc_mqueue.c - follow-up after review
Hi all,
Sorry for the delay, time zones got me on this one.
First off, thanks to Samuel and Bradley (Anti-AI) for the blunt and
constructive review - you both pointed at exactly the right spots.
I went back through both patches line by line against your comments:
- Bradley, you were right about ipc_kmsg.c: the integer-overflow ->
heap-overflow scenario doesn't hold up. IKM_EXPAND_FACTOR is 1 or 2 in
practice, and copyinmsg() already bounds the copy against kmsg->ikm_size,
so there's no real OOB write there. I stripped that whole thing out. The
only real issue was the missing NULL check in ipc_kmsg_free(), and instead
of silently swallowing it I just added an assert(kmsg !=3D IKM_NULL),
matching how the rest of the file already handles this kind of
precondition. That's the whole patch now, 5 lines.
- For ipc_mqueue.c, once I went through your comments (hiding bugs,
bypassing ip_qlimit, mangled indentation, the no-op state reassignment), I
couldn't find anything left worth keeping. So that patch is just a revert
back to the original ipc_mqueue_send - no functional change proposed there.
Both patches attached.
Thanks again for catching this before it went further,
Alperen
On Sat, Jul 25, 2026 at 1:01=E2=80=AFAM Samuel Thibault <samuel.thibault@gn=
u.org>
wrote:
> Hello,
>
> > diff --git a/gnumach/ipc/ipc_mqueue.c b/gnumach/ipc/ipc_mqueue.c
> > index f770afb..834eb16 100644
> > --- a/gnumach/ipc/ipc_mqueue.c
> > +++ b/gnumach/ipc/ipc_mqueue.c
> > @@ -28,11 +27,11 @@
> > * the rights to redistribute these changes.
> > */
> > /*
> > - * File: ipc/ipc_mqueue.c
> > - * Author: Rich Draves
> > - * Date: 2026
> > + * File: ipc/ipc_mqueue.c
> > + * Author: Rich Draves / Alperen ERKAN
> > + * Date: 2026
> > @@ -156,6 +159,8 @@ ipc_mqueue_changed(
> >
> > /*
> > * Routine: ipc_mqueue_send
> > + * Author : Alperen ERKAN
> > + * 2026
> > * Purpose:
> > * Send a message to a port. The message holds a reference
> > * for the destination port in the msgh_remote_port field.
>
> A couple lines is not copyrightable and does make you sole author of
> the function.
>
> > @@ -52,6 +51,10 @@
> > #include <ipc/ipc_space.h>
> > #include <ipc/ipc_marequest.h>
> >
> > +/*
> > + * An absolute message queue upper limit to prevent OOM and memory
> exhaustion.
> > + */
> > +#define IPC_MQUEUE_HARD_LIMIT 65536
>
> If we start adding absolute constraints on sizes etc. we'd want to put
> that into a header dedicated for that, so people know where to tune
> them.
>
> > @@ -180,8 +185,16 @@ ipc_mqueue_send(
> > {
> > ipc_port_t port;
> >
> > + /* Defensive C: Checking the incoming message object and
> destination port */
> > + if (kmsg =3D=3D IKM_NULL) {
> > + return MACH_SEND_INVALID_DATA;
> > + }
>
> Again, hiding bugs.
>
> > port =3D (ipc_port_t) kmsg->ikm_header.msgh_remote_port;
> > - assert(IP_VALID(port));
> > +
> > + if (!IP_VALID(port)) {
> > + return MACH_SEND_INVALID_DEST;
> > + }
>
> If userland passed a bogus port it should have been tested way before
> this.
>
> > @@ -230,17 +243,17 @@ ipc_mqueue_send(
> > }
> >
> > /*
> > - * Don't block if:
> > - * 1) We're under the queue limit.
> > - * 2) Caller used the MACH_SEND_ALWAYS internal
> option.
> > - * 3) Message is sent to a send-once right.
> > - */
> > -
> > - if ((port->ip_msgcount < port->ip_qlimit) ||
> > - (option & MACH_SEND_ALWAYS) ||
> > - (MACH_MSGH_BITS_REMOTE(kmsg->ikm_header.msgh_bits) =
=3D=3D
> > -
> MACH_MSG_TYPE_PORT_SEND_ONCE))
> > - break;
> > + * Don't block if:
> > + * 1) We're under the queue limit.
> > + * 2) Caller used MACH_SEND_ALWAYS but we are under the hard
> safety limit.
> > + * 3) Message is sent to a send-once right.
> > + */
>
> Avoid mangling the existing content.
>
> > +
> > + if ((port->ip_msgcount < port->ip_qlimit) ||
> > + ((option & MACH_SEND_ALWAYS) && (port->ip_msgcount <
> IPC_MQUEUE_HARD_LIMIT)) ||
>
> ? No, you are making ipc_mqueue_send ignore the port->ip_qlimit.
>
> > + (MACH_MSGH_BITS_REMOTE(kmsg->ikm_header.msgh_bits) =3D=3D
> > + MACH_MSG_TYPE_PORT_SEND_ONCE))
> > + break;
> >
> > /* must block waiting for queue to clear */
> >
> > @@ -263,45 +276,49 @@ ipc_mqueue_send(
> > counter(c_ipc_mqueue_send_block++);
> > thread_block(thread_no_continuation);
> > ip_lock(port);
> > -
> > +
> > /* why did we wake up? */
> >
> > - if (self->ith_state =3D=3D MACH_MSG_SUCCESS)
> > - continue;
> > - assert(self->ith_state =3D=3D MACH_SEND_IN_PROGRESS);
> > + if (self->ith_state =3D=3D MACH_MSG_SUCCESS) {
> > + self->ith_state =3D MACH_MSG_SUCCESS; // veya temiz durum
> s=C4=B1f=C4=B1rlamas=C4=B1
>
> Always English, please. And this does not do anything.
>
> > + continue;
> > + }
> > + assert(self->ith_state =3D=3D MACH_SEND_IN_PROGRESS);
>
> Again avoid mangling the indentation.
>
> >
> > - /* take ourselves off blocked queue */
> > + /* take ourselves off blocked queue under port lock */
> > + ipc_thread_rmqueue(&port->ip_blocked, self);
> > +
> > + /* [DEFENSIVE]: Clear state to prevent stale status reuse */
> > + self->ith_state =3D MACH_MSG_SUCCESS;
> >
> > - ipc_thread_rmqueue(&port->ip_blocked, self);
> > + /*
> > + * Thread wakeup-reason field tells us why
> > + * the wait was interrupted.
> > + */
> >
> > - /*
> > - * Thread wakeup-reason field tells us why
> > - * the wait was interrupted.
> > - */
> > + switch (self->ith_wait_result) {
> > + case THREAD_INTERRUPTED:
> > + /* send was interrupted - give up */
>
> This is completely mangled. No idea if there is anything to read here.
>
> Samuel
>
--000000000000820fcd06576b443e
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
<div dir=3D"ltr"><div>Subject: Re: [PATCH] ipc_kmsg.c / ipc_mqueue.c - foll=
ow-up after review<br><br>Hi all,<br><br>Sorry for the delay, time zones go=
t me on this one.<br><br>First off, thanks to Samuel and Bradley (Anti-AI) =
for the blunt and constructive review - you both pointed at exactly the rig=
ht spots.<br><br>I went back through both patches line by line against your=
comments:<br><br>- Bradley, you were right about ipc_kmsg.c: the integer-o=
verflow -> heap-overflow scenario doesn't hold up. IKM_EXPAND_FACTOR=
is 1 or 2 in practice, and copyinmsg() already bounds the copy against kms=
g->ikm_size, so there's no real OOB write there. I stripped that who=
le thing out. The only real issue was the missing NULL check in ipc_kmsg_fr=
ee(), and instead of silently swallowing it I just added an assert(kmsg !=
=3D IKM_NULL), matching how the rest of the file already handles this kind =
of precondition. That's the whole patch now, 5 lines.<br><br>- For ipc_=
mqueue.c, once I went through your comments (hiding bugs, bypassing ip_qlim=
it, mangled indentation, the no-op state reassignment), I couldn't find=
anything left worth keeping. So that patch is just a revert back to the or=
iginal ipc_mqueue_send - no functional change proposed there.<br><br>Both p=
atches attached.<br><br>Thanks again for catching this before it went furth=
er,<br>Alperen</div><div><br></div><div><br></div></div><br><div class=3D"g=
mail_quote gmail_quote_container"><div dir=3D"ltr" class=3D"gmail_attr">On =
Sat, Jul 25, 2026 at 1:01=E2=80=AFAM Samuel Thibault <<a href=3D"mailto:=
[email protected]">[email protected]</a>> wrote:<br></div><b=
lockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-le=
ft:1px solid rgb(204,204,204);padding-left:1ex">Hello,<br>
<br>
> diff --git a/gnumach/ipc/ipc_mqueue.c b/gnumach/ipc/ipc_mqueue.c<br>
> index f770afb..834eb16 100644<br>
> --- a/gnumach/ipc/ipc_mqueue.c<br>
> +++ b/gnumach/ipc/ipc_mqueue.c<br>
> @@ -28,11 +27,11 @@<br>
>=C2=A0 =C2=A0* the rights to redistribute these changes.<br>
>=C2=A0 =C2=A0*/<br>
>=C2=A0 /*<br>
> - *=C2=A0 =C2=A0File:=C2=A0 =C2=A0ipc/ipc_mqueue.c<br>
> - *=C2=A0 =C2=A0Author: Rich Draves<br>
> - *=C2=A0 =C2=A0Date:=C2=A0 =C2=A02026 <br>
> + *=C2=A0 File:=C2=A0 =C2=A0ipc/ipc_mqueue.c<br>
> + *=C2=A0 Author: Rich Draves / Alperen ERKAN <br>
> + *=C2=A0 Date:=C2=A0 =C2=A02026 <br>
> @@ -156,6 +159,8 @@ ipc_mqueue_changed(<br>
>=C2=A0 <br>
>=C2=A0 /*<br>
>=C2=A0 =C2=A0*=C2=A0 =C2=A0Routine:=C2=A0 =C2=A0 =C2=A0 =C2=A0 ipc_mque=
ue_send<br>
> + *=C2=A0 Author :=C2=A0 =C2=A0 Alperen ERKAN <br>
> + *=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=
=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =
=C2=A0 =C2=A0 2026<br>
>=C2=A0 =C2=A0*=C2=A0 =C2=A0Purpose:<br>
>=C2=A0 =C2=A0*=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0Send a message t=
o a port.=C2=A0 The message holds a reference<br>
>=C2=A0 =C2=A0*=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0for the destinat=
ion port in the msgh_remote_port field.<br>
<br>
A couple lines is not copyrightable and does make you sole author of<br>
the function.<br>
<br>
> @@ -52,6 +51,10 @@<br>
>=C2=A0 #include <ipc/ipc_space.h><br>
>=C2=A0 #include <ipc/ipc_marequest.h><br>
>=C2=A0 <br>
> +/* <br>
> + * An absolute message queue upper limit to prevent OOM and memory ex=
haustion.<br>
> + */<br>
> +#define IPC_MQUEUE_HARD_LIMIT 65536<br>
<br>
If we start adding absolute constraints on sizes etc. we'd want to put<=
br>
that into a header dedicated for that, so people know where to tune<br>
them.<br>
<br>
> @@ -180,8 +185,16 @@ ipc_mqueue_send(<br>
>=C2=A0 {<br>
>=C2=A0 =C2=A0 =C2=A0 =C2=A0ipc_port_t port;<br>
>=C2=A0 <br>
> +=C2=A0 =C2=A0 =C2=A0/* Defensive C: Checking the incoming message obj=
ect and destination port */<br>
> +=C2=A0 =C2=A0 =C2=A0if (kmsg =3D=3D IKM_NULL) {<br>
> +=C2=A0 =C2=A0 =C2=A0return MACH_SEND_INVALID_DATA;<br>
> +=C2=A0 =C2=A0 =C2=A0}<br>
<br>
Again, hiding bugs.<br>
<br>
>=C2=A0 =C2=A0 =C2=A0 =C2=A0port =3D (ipc_port_t) kmsg->ikm_header.ms=
gh_remote_port;<br>
> -=C2=A0 =C2=A0 =C2=A0assert(IP_VALID(port));<br>
> +<br>
> +=C2=A0 =C2=A0 =C2=A0if (!IP_VALID(port)) {<br>
> +=C2=A0 =C2=A0 =C2=A0 =C2=A0 return MACH_SEND_INVALID_DEST;<br>
> +=C2=A0 =C2=A0 =C2=A0}<br>
<br>
If userland passed a bogus port it should have been tested way before<br>
this.<br>
<br>
> @@ -230,17 +243,17 @@ ipc_mqueue_send(<br>
>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0}<br>
>=C2=A0 <br>
>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0/*<br>
> -=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 *=C2=A0 Don't bl=
ock if:<br>
> -=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 *=C2=A0 =C2=A0 =C2=
=A0 1) We're under the queue limit.<br>
> -=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 *=C2=A0 =C2=A0 =C2=
=A0 2) Caller used the MACH_SEND_ALWAYS internal option.<br>
> -=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 *=C2=A0 =C2=A0 =C2=
=A0 3) Message is sent to a send-once right.<br>
> -=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 */<br>
> -<br>
> -=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0if ((port->ip_msgc=
ount < port->ip_qlimit) ||<br>
> -=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0(option=
& MACH_SEND_ALWAYS) ||<br>
> -=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0(MACH_M=
SGH_BITS_REMOTE(kmsg->ikm_header.msgh_bits) =3D=3D<br>
> -=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0=
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=
=A0 =C2=A0 =C2=A0MACH_MSG_TYPE_PORT_SEND_ONCE))<br>
> -=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0=
=C2=A0break;<br>
> +=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0*=C2=A0 Don't block if:<br>
> +=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0*=C2=A0 1) We're under the queu=
e limit.<br>
> +=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0*=C2=A0 2) Caller used MACH_SEND_AL=
WAYS but we are under the hard safety limit.<br>
> +=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0*=C2=A0 3) Message is sent to a sen=
d-once right.<br>
> +=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0*/<br>
<br>
Avoid mangling the existing content.<br>
<br>
> +<br>
> +=C2=A0 =C2=A0 =C2=A0 =C2=A0 if ((port->ip_msgcount < port->i=
p_qlimit) ||<br>
> +=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 ((option & MACH_SEND_AL=
WAYS) && (port->ip_msgcount < IPC_MQUEUE_HARD_LIMIT)) ||<br>
<br>
? No, you are making ipc_mqueue_send ignore the port->ip_qlimit.<br>
<br>
> +=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 (MACH_MSGH_BITS_REMOTE(kmsg=
->ikm_header.msgh_bits) =3D=3D<br>
> +=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0=
=C2=A0 =C2=A0 MACH_MSG_TYPE_PORT_SEND_ONCE))<br>
> +=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 break;<br>
>=C2=A0 <br>
>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0/* must block wa=
iting for queue to clear */<br>
>=C2=A0 <br>
> @@ -263,45 +276,49 @@ ipc_mqueue_send(<br>
>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0counter(c_ipc_mq=
ueue_send_block++);<br>
>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0thread_block(thr=
ead_no_continuation);<br>
>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0ip_lock(port);<b=
r>
> -<br>
> +=C2=A0 <br>
>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0/* why did we wa=
ke up? */<br>
>=C2=A0 <br>
> -=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0if (self->ith_stat=
e =3D=3D MACH_MSG_SUCCESS)<br>
> -=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0=
=C2=A0continue;<br>
> -=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0assert(self->ith_s=
tate =3D=3D MACH_SEND_IN_PROGRESS);<br>
> +=C2=A0 =C2=A0 =C2=A0 =C2=A0 if (self->ith_state =3D=3D MACH_MSG_SU=
CCESS) {<br>
> +=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 self->ith_state =3D MACH=
_MSG_SUCCESS; // veya temiz durum s=C4=B1f=C4=B1rlamas=C4=B1<br>
<br>
Always English, please. And this does not do anything.<br>
<br>
> +=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 continue;<br>
> +=C2=A0 =C2=A0 =C2=A0 =C2=A0 }<br>
> +=C2=A0 =C2=A0 =C2=A0 =C2=A0 assert(self->ith_state =3D=3D MACH_SEN=
D_IN_PROGRESS);<br>
<br>
Again avoid mangling the indentation.<br>
<br>
>=C2=A0 <br>
> -=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0/* take ourselves off=
blocked queue */<br>
> +=C2=A0 =C2=A0 =C2=A0 =C2=A0 /* take ourselves off blocked queue under=
port lock */<br>
> +=C2=A0 =C2=A0 =C2=A0 =C2=A0 ipc_thread_rmqueue(&port->ip_block=
ed, self);<br>
> +=C2=A0 =C2=A0 =C2=A0 =C2=A0 <br>
> +=C2=A0 =C2=A0 =C2=A0 =C2=A0 /* [DEFENSIVE]: Clear state to prevent st=
ale status reuse */<br>
> +=C2=A0 =C2=A0 =C2=A0 =C2=A0 self->ith_state =3D MACH_MSG_SUCCESS;<=
br>
>=C2=A0 <br>
> -=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0ipc_thread_rmqueue(&a=
mp;port->ip_blocked, self);<br>
> +=C2=A0 =C2=A0 =C2=A0 =C2=A0 /*<br>
> +=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0*=C2=A0 Thread wakeup-reason field =
tells us why<br>
> +=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0*=C2=A0 the wait was interrupted.<b=
r>
> +=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0*/<br>
>=C2=A0 <br>
> -=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0/*<br>
> -=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 *=C2=A0 =C2=A0 =C2=
=A0 Thread wakeup-reason field tells us why<br>
> -=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 *=C2=A0 =C2=A0 =C2=
=A0 the wait was interrupted.<br>
> -=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 */<br>
> +=C2=A0 =C2=A0 =C2=A0 =C2=A0 switch (self->ith_wait_result) {<br>
> +=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 case THREAD_INTERRUPTED:<br=
>
> +=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 /* send was interrupted - g=
ive up */<br>
<br>
This is completely mangled. No idea if there is anything to read here.<br>
<br>
Samuel<br>
</blockquote></div>
--000000000000820fcd06576b443e--
--000000000000820fcf06576b4440
Content-Type: application/octet-stream;
name="0001-ipc_kmsg-assert-non-null-kmsg-in-ipc_kmsg_free.patch"
Content-Disposition: attachment;
filename="0001-ipc_kmsg-assert-non-null-kmsg-in-ipc_kmsg_free.patch"
Content-Transfer-Encoding: base64
Content-ID: <f_ms03wcrh0>
X-Attachment-Id: f_ms03wcrh0
RnJvbSAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwIE1vbiBTZXAgMTcg
MDA6MDA6MDAgMjAwMQpGcm9tOiBBbHBlcmVuIEVya2FuIDxlcmthbmFscGVyZW41NEBnbWFpbC5j
b20+CkRhdGU6IFNhdCwgMjUgSnVsIDIwMjYgMDA6MDA6MDAgKzAzMDAKU3ViamVjdDogW1BBVENI
XSBpcGNfa21zZzogYXNzZXJ0IG5vbi1OVUxMIGttc2cgaW4gaXBjX2ttc2dfZnJlZQoKaXBjX2tt
c2dfZnJlZSgpIGRlcmVmZXJlbmNlZCBrbXNnLT5pa21fc2l6ZSB3aXRob3V0IGFueSBjaGVjayB0
aGF0Cmttc2cgd2FzIG5vbi1OVUxMLiBBbnkgY2FsbGVyIHBhc3NpbmcgSUtNX05VTEwgd291bGQg
Y3Jhc2ggb24gdGhhdApkZXJlZmVyZW5jZS4KClJhdGhlciB0aGFuIHNpbGVudGx5IHJldHVybmlu
ZyBvbiBhIE5VTEwga21zZyAtLSB3aGljaCB3b3VsZCBoaWRlIGEKcmVhbCBidWcgaW4gdGhlIGNh
bGxlciAtLSBmb2xsb3cgdGhlIGNvbnZlbnRpb24gYWxyZWFkeSB1c2VkCnRocm91Z2hvdXQgdGhp
cyBmaWxlIChzZWUgaXBjX2ttc2dfcm1xdWV1ZSwgaXBjX2ttc2dfY29weW91dF9kZXN0LApldGMu
KSBhbmQgYXNzZXJ0KCkgdGhlIHByZWNvbmRpdGlvbiwgc28gYSBtaXNiZWhhdmluZyBjYWxsZXIg
aXMKY2F1Z2h0IGxvdWRseSBpbiBkZWJ1Zy9NQUNIX0FTU0VSVCBidWlsZHMgaW5zdGVhZCBvZiBi
ZWluZyBwYXBlcmVkCm92ZXIuCgpObyBvdGhlciBiZWhhdmlvcmFsIGNoYW5nZXMuCi0tLQogZ251
bWFjaC9pcGMvaXBjX2ttc2cuYyB8IDYgKysrKystCiAxIGZpbGUgY2hhbmdlZCwgNSBpbnNlcnRp
b25zKCspLCAxIGRlbGV0aW9uKC0pCgpkaWZmIC0tZ2l0IGEvZ251bWFjaC9pcGMvaXBjX2ttc2cu
YyBiL2dudW1hY2gvaXBjL2lwY19rbXNnLmMKaW5kZXggOGFiMGUyZS4uYjFjM2ZhMSAxMDA2NDQK
LS0tIGEvZ251bWFjaC9pcGMvaXBjX2ttc2cuYworKysgYi9nbnVtYWNoL2lwYy9pcGNfa21zZy5j
CkBAIC00NDksNyArNDQ5LDExIEBACiB2b2lkCiBpcGNfa21zZ19mcmVlKGlwY19rbXNnX3Qga21z
ZykKIHsKLQl2bV9zaXplX3Qgc2l6ZSA9IGttc2ctPmlrbV9zaXplOworCXZtX3NpemVfdCBzaXpl
OworCisJYXNzZXJ0KGttc2cgIT0gSUtNX05VTEwpOworCisJc2l6ZSA9IGttc2ctPmlrbV9zaXpl
OwogCiAJc3dpdGNoIChzaXplKSB7CiAKLS0gCjIuNDMuMAo=
--000000000000820fcf06576b4440
Content-Type: application/octet-stream;
name="0001-revert-ipc_mqueue_send-bogus-patch.patch"
Content-Disposition: attachment;
filename="0001-revert-ipc_mqueue_send-bogus-patch.patch"
Content-Transfer-Encoding: base64
Content-ID: <f_ms03wcs41>
X-Attachment-Id: f_ms03wcs41
RnJvbSAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwIE1vbiBTZXAgMTcg
MDA6MDA6MDAgMjAwMQpGcm9tOiBBbHBlcmVuIEVya2FuIDxlcmthbmFscGVyZW41NEBnbWFpbC5j
b20+CkRhdGU6IFNhdCwgMjUgSnVsIDIwMjYgMDA6MDA6MDAgKzAzMDAKU3ViamVjdDogW1BBVENI
XSBSZXZlcnQgZXJyb25lb3VzIGNoYW5nZXMgdG8gaXBjX21xdWV1ZV9zZW5kCgpUaGUgcHJpb3Ig
cGF0Y2ggdG8gaXBjX21xdWV1ZS5jIGludHJvZHVjZWQgbm8gZ2VudWluZSBmaXggYW5kIHNldmVy
YWwKcmVncmVzc2lvbnMsIGFzIHBvaW50ZWQgb3V0IGluIHJldmlldzoKCiAtIEFkZGVkIGFuIGF1
dGhvci9jb3B5cmlnaHQgY2xhaW0gZm9yIGEgaGFuZGZ1bCBvZiBtb2RpZmllZCBsaW5lcywKICAg
d2hpY2ggZG9lcyBub3QgZXN0YWJsaXNoIGF1dGhvcnNoaXAuCiAtIFJlcGxhY2VkIGFzc2VydChJ
UF9WQUxJRChwb3J0KSkgd2l0aCBhIHNvZnQgcnVudGltZSBjaGVjazsgdGhlCiAgIHBvcnQgaXMg
ZXhwZWN0ZWQgdG8gYWxyZWFkeSBiZSB2YWxpZGF0ZWQgYnkgdGhlIGNhbGxlciwgc28gdGhpcwog
ICBvbmx5IGhpZCBhIGNhbGxlci1zaWRlIGJ1ZyBpbnN0ZWFkIG9mIGNhdGNoaW5nIGl0LgogLSBB
ZGRlZCBhIE5VTEwta21zZyBndWFyZCBmb3IgYSB2YWx1ZSB0aGF0IGlzIG5ldmVyIE5VTEwgYXQg
dGhpcwogICBjYWxsIHNpdGUsIGZvciB0aGUgc2FtZSByZWFzb24uCiAtIEludHJvZHVjZWQgSVBD
X01RVUVVRV9IQVJEX0xJTUlUIGFuZCB1c2VkIGl0IHRvIGxldAogICBNQUNIX1NFTkRfQUxXQVlT
IHNlbmRzIHBhc3QgcG9ydC0+aXBfcWxpbWl0LCBzaWxlbnRseSB3ZWFrZW5pbmcKICAgdGhlIGV4
aXN0aW5nIHF1ZXVlLWxpbWl0IGVuZm9yY2VtZW50LgogLSBSZWZvcm1hdHRlZCBsYXJnZSBwYXJ0
cyBvZiB0aGUgZnVuY3Rpb24gZnJvbSB0YWJzIHRvIHNwYWNlcywKICAgbWFuZ2xpbmcgdGhlIGRp
ZmYgYW5kIG1ha2luZyB0aGUgY2hhbmdlIGhhcmQgdG8gcmV2aWV3LgogLSBBZGRlZCBhIG5vLW9w
IHJlYXNzaWdubWVudCAoc2VsZi0+aXRoX3N0YXRlID0gTUFDSF9NU0dfU1VDQ0VTUykKICAgYW5k
IGEgZGVhZC1jb2RlIHN0YXRlIGNsZWFyIGJlZm9yZSB0aGUgc3dpdGNoLCBuZWl0aGVyIG9mIHdo
aWNoCiAgIGNoYW5nZXMgYmVoYXZpb3IuCiAtIExlZnQgYSBub24tRW5nbGlzaCBjb21tZW50IGlu
IHRoZSBjb2RlLgoKVGhpcyByZXN0b3JlcyBpcGNfbXF1ZXVlX3NlbmQgdG8gaXRzIG9yaWdpbmFs
LCBjb3JyZWN0IGZvcm0uIE5vCmZ1bmN0aW9uYWwgY2hhbmdlIGlzIGJlaW5nIHByb3Bvc2VkIGZv
ciB0aGlzIGZpbGUuCi0tLQogZ251bWFjaC9pcGMvaXBjX21xdWV1ZS5jIHwgODggKysrKysrKysr
KysrKysrKy0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0KIDEgZmlsZSBjaGFuZ2VkLCAz
MCBpbnNlcnRpb25zKCspLCA1OCBkZWxldGlvbnMoLSkKCi0tLSBhL2dudW1hY2gvaXBjL2lwY19t
cXVldWUuYwkyMDI2LTA3LTI1IDA4OjE0OjQ5Ljg3NDM1NjA4NSArMDAwMAorKysgYi9nbnVtYWNo
L2lwYy9pcGNfbXF1ZXVlLmMJMjAyNi0wNy0yNSAwODoxNDo0OS44NzU5Njc3MDAgKzAwMDAKQEAg
LTI3LDExICsyNywxMSBAQAogICogdGhlIHJpZ2h0cyB0byByZWRpc3RyaWJ1dGUgdGhlc2UgY2hh
bmdlcy4KICAqLwogLyoKLSAqICBGaWxlOiAgIGlwYy9pcGNfbXF1ZXVlLmMKLSAqICBBdXRob3I6
IFJpY2ggRHJhdmVzIC8gQWxwZXJlbiBFUktBTiAKLSAqICBEYXRlOiAgIDIwMjYgCisgKglGaWxl
OglpcGMvaXBjX21xdWV1ZS5jCisgKglBdXRob3I6CVJpY2ggRHJhdmVzCisgKglEYXRlOgkyMDI2
CiAgKgotICogIEZ1bmN0aW9ucyB0byBtYW5pcHVsYXRlIElQQyBtZXNzYWdlIHF1ZXVlcy4KKyAq
CUZ1bmN0aW9ucyB0byBtYW5pcHVsYXRlIElQQyBtZXNzYWdlIHF1ZXVlcy4KICAqLwogCiAjaW5j
bHVkZSA8bWFjaC9wb3J0Lmg+CkBAIC01MSwxMiArNTEsNiBAQAogI2luY2x1ZGUgPGlwYy9pcGNf
c3BhY2UuaD4KICNpbmNsdWRlIDxpcGMvaXBjX21hcmVxdWVzdC5oPgogCi0vKiAKLSAqIEFuIGFi
c29sdXRlIG1lc3NhZ2UgcXVldWUgdXBwZXIgbGltaXQgdG8gcHJldmVudCBPT00gYW5kIG1lbW9y
eSBleGhhdXN0aW9uLgotICovCi0jZGVmaW5lIElQQ19NUVVFVUVfSEFSRF9MSU1JVCA2NTUzNgot
Ci0KIC8qCiAgKglSb3V0aW5lOglpcGNfbXF1ZXVlX2luaXQKICAqCVB1cnBvc2U6CkBAIC0xNTks
OCArMTUzLDYgQEAKIAogLyoKICAqCVJvdXRpbmU6CWlwY19tcXVldWVfc2VuZAotICogIEF1dGhv
ciA6ICAgIEFscGVyZW4gRVJLQU4gCi0gKiAJCQkJCQkgMjAyNgogICoJUHVycG9zZToKICAqCQlT
ZW5kIGEgbWVzc2FnZSB0byBhIHBvcnQuICBUaGUgbWVzc2FnZSBob2xkcyBhIHJlZmVyZW5jZQog
ICoJCWZvciB0aGUgZGVzdGluYXRpb24gcG9ydCBpbiB0aGUgbXNnaF9yZW1vdGVfcG9ydCBmaWVs
ZC4KQEAgLTE4NSwxNiArMTc3LDggQEAKIHsKIAlpcGNfcG9ydF90IHBvcnQ7CiAKLQkvKiBEZWZl
bnNpdmUgQzogQ2hlY2tpbmcgdGhlIGluY29taW5nIG1lc3NhZ2Ugb2JqZWN0IGFuZCBkZXN0aW5h
dGlvbiBwb3J0ICovCi0JaWYgKGttc2cgPT0gSUtNX05VTEwpIHsKLSAgICAJcmV0dXJuIE1BQ0hf
U0VORF9JTlZBTElEX0RBVEE7Ci0JfQotCiAJcG9ydCA9IChpcGNfcG9ydF90KSBrbXNnLT5pa21f
aGVhZGVyLm1zZ2hfcmVtb3RlX3BvcnQ7Ci0KLQlpZiAoIUlQX1ZBTElEKHBvcnQpKSB7Ci0gICAJ
ICAgcmV0dXJuIE1BQ0hfU0VORF9JTlZBTElEX0RFU1Q7Ci0JfQorCWFzc2VydChJUF9WQUxJRChw
b3J0KSk7CiAKIAlpcF9sb2NrKHBvcnQpOwogCkBAIC0yNDMsMTcgKzIyNywxNyBAQAogCQl9CiAK
IAkJLyoKLSAgICAgICAgICogIERvbid0IGJsb2NrIGlmOgotICAgICAgICAgKiAgMSkgV2UncmUg
dW5kZXIgdGhlIHF1ZXVlIGxpbWl0LgotICAgICAgICAgKiAgMikgQ2FsbGVyIHVzZWQgTUFDSF9T
RU5EX0FMV0FZUyBidXQgd2UgYXJlIHVuZGVyIHRoZSBoYXJkIHNhZmV0eSBsaW1pdC4KLSAgICAg
ICAgICogIDMpIE1lc3NhZ2UgaXMgc2VudCB0byBhIHNlbmQtb25jZSByaWdodC4KLSAgICAgICAg
ICovCi0KLSAgICAgICAgaWYgKChwb3J0LT5pcF9tc2djb3VudCA8IHBvcnQtPmlwX3FsaW1pdCkg
fHwKLSAgICAgICAgICAgICgob3B0aW9uICYgTUFDSF9TRU5EX0FMV0FZUykgJiYgKHBvcnQtPmlw
X21zZ2NvdW50IDwgSVBDX01RVUVVRV9IQVJEX0xJTUlUKSkgfHwKLSAgICAgICAgICAgIChNQUNI
X01TR0hfQklUU19SRU1PVEUoa21zZy0+aWttX2hlYWRlci5tc2doX2JpdHMpID09Ci0gICAgICAg
ICAgICAgICAgICAgICAgICBNQUNIX01TR19UWVBFX1BPUlRfU0VORF9PTkNFKSkKLSAgICAgICAg
ICAgIGJyZWFrOworCQkgKiAgRG9uJ3QgYmxvY2sgaWY6CisJCSAqCTEpIFdlJ3JlIHVuZGVyIHRo
ZSBxdWV1ZSBsaW1pdC4KKwkJICoJMikgQ2FsbGVyIHVzZWQgdGhlIE1BQ0hfU0VORF9BTFdBWVMg
aW50ZXJuYWwgb3B0aW9uLgorCQkgKgkzKSBNZXNzYWdlIGlzIHNlbnQgdG8gYSBzZW5kLW9uY2Ug
cmlnaHQuCisJCSAqLworCisJCWlmICgocG9ydC0+aXBfbXNnY291bnQgPCBwb3J0LT5pcF9xbGlt
aXQpIHx8CisJCSAgICAob3B0aW9uICYgTUFDSF9TRU5EX0FMV0FZUykgfHwKKwkJICAgIChNQUNI
X01TR0hfQklUU19SRU1PVEUoa21zZy0+aWttX2hlYWRlci5tc2doX2JpdHMpID09CisJCQkJCQlN
QUNIX01TR19UWVBFX1BPUlRfU0VORF9PTkNFKSkKKwkJCWJyZWFrOwogCiAJCS8qIG11c3QgYmxv
Y2sgd2FpdGluZyBmb3IgcXVldWUgdG8gY2xlYXIgKi8KIApAQCAtMjcyLDUzICsyNTYsNDkgQEAK
IAkJaXBjX3RocmVhZF9lbnF1ZXVlKCZwb3J0LT5pcF9ibG9ja2VkLCBzZWxmKTsKIAkJc2VsZi0+
aXRoX3N0YXRlID0gTUFDSF9TRU5EX0lOX1BST0dSRVNTOwogCi0JIAlpcF91bmxvY2socG9ydCk7
CisJCWlwX3VubG9jayhwb3J0KTsKIAkJY291bnRlcihjX2lwY19tcXVldWVfc2VuZF9ibG9jaysr
KTsKIAkJdGhyZWFkX2Jsb2NrKHRocmVhZF9ub19jb250aW51YXRpb24pOwogCQlpcF9sb2NrKHBv
cnQpOwotICAKKwogCQkvKiB3aHkgZGlkIHdlIHdha2UgdXA/ICovCiAKLSAgICAgICAgaWYgKHNl
bGYtPml0aF9zdGF0ZSA9PSBNQUNIX01TR19TVUNDRVNTKSB7Ci0gICAgICAgICAgICBzZWxmLT5p
dGhfc3RhdGUgPSBNQUNIX01TR19TVUNDRVNTOyAvLyB2ZXlhIHRlbWl6IGR1cnVtIHPEsWbEsXJs
YW1hc8SxCi0gICAgICAgICAgICBjb250aW51ZTsKLSAgICAgICAgfQotICAgICAgICBhc3NlcnQo
c2VsZi0+aXRoX3N0YXRlID09IE1BQ0hfU0VORF9JTl9QUk9HUkVTUyk7Ci0KLSAgICAgICAgLyog
dGFrZSBvdXJzZWx2ZXMgb2ZmIGJsb2NrZWQgcXVldWUgdW5kZXIgcG9ydCBsb2NrICovCi0gICAg
ICAgIGlwY190aHJlYWRfcm1xdWV1ZSgmcG9ydC0+aXBfYmxvY2tlZCwgc2VsZik7Ci0gICAgICAg
IAotICAgICAgICAvKiBbREVGRU5TSVZFXTogQ2xlYXIgc3RhdGUgdG8gcHJldmVudCBzdGFsZSBz
dGF0dXMgcmV1c2UgKi8KLSAgICAgICAgc2VsZi0+aXRoX3N0YXRlID0gTUFDSF9NU0dfU1VDQ0VT
UzsKLQotICAgICAgICAvKgotICAgICAgICAgKiAgVGhyZWFkIHdha2V1cC1yZWFzb24gZmllbGQg
dGVsbHMgdXMgd2h5Ci0gICAgICAgICAqICB0aGUgd2FpdCB3YXMgaW50ZXJydXB0ZWQuCi0gICAg
ICAgICAqLwotCi0gICAgICAgIHN3aXRjaCAoc2VsZi0+aXRoX3dhaXRfcmVzdWx0KSB7Ci0gICAg
ICAgICAgICBjYXNlIFRIUkVBRF9JTlRFUlJVUFRFRDoKLSAgICAgICAgICAgIC8qIHNlbmQgd2Fz
IGludGVycnVwdGVkIC0gZ2l2ZSB1cCAqLwotCi0gICAgICAgICAgICBpcF91bmxvY2socG9ydCk7
Ci0gICAgICAgICAgICByZXR1cm4gTUFDSF9TRU5EX0lOVEVSUlVQVEVEOwotCi0gICAgICAgICAg
ICBjYXNlIFRIUkVBRF9USU1FRF9PVVQ6Ci0gICAgICAgICAgICAvKiB0aW1lb3V0IGV4cGlyZWQg
Ki8KLQotICAgICAgICAgICAgYXNzZXJ0KG9wdGlvbiAmIE1BQ0hfU0VORF9USU1FT1VUKTsKLSAg
ICAgICAgICAgIHRpbWVfb3V0ID0gMDsKLSAgICAgICAgICAgIGJyZWFrOworCQlpZiAoc2VsZi0+
aXRoX3N0YXRlID09IE1BQ0hfTVNHX1NVQ0NFU1MpCisJCQljb250aW51ZTsKKwkJYXNzZXJ0KHNl
bGYtPml0aF9zdGF0ZSA9PSBNQUNIX1NFTkRfSU5fUFJPR1JFU1MpOworCisJCS8qIHRha2Ugb3Vy
c2VsdmVzIG9mZiBibG9ja2VkIHF1ZXVlICovCisKKwkJaXBjX3RocmVhZF9ybXF1ZXVlKCZwb3J0
LT5pcF9ibG9ja2VkLCBzZWxmKTsKKworCQkvKgorCQkgKglUaHJlYWQgd2FrZXVwLXJlYXNvbiBm
aWVsZCB0ZWxscyB1cyB3aHkKKwkJICoJdGhlIHdhaXQgd2FzIGludGVycnVwdGVkLgorCQkgKi8K
KworCQlzd2l0Y2ggKHNlbGYtPml0aF93YWl0X3Jlc3VsdCkgeworCQkgICAgY2FzZSBUSFJFQURf
SU5URVJSVVBURUQ6CisJCQkvKiBzZW5kIHdhcyBpbnRlcnJ1cHRlZCAtIGdpdmUgdXAgKi8KKwor
CQkJaXBfdW5sb2NrKHBvcnQpOworCQkJcmV0dXJuIE1BQ0hfU0VORF9JTlRFUlJVUFRFRDsKKwor
CQkgICAgY2FzZSBUSFJFQURfVElNRURfT1VUOgorCQkJLyogdGltZW91dCBleHBpcmVkICovCisK
KwkJCWFzc2VydChvcHRpb24gJiBNQUNIX1NFTkRfVElNRU9VVCk7CisJCQl0aW1lX291dCA9IDA7
CisJCQlicmVhazsKIAotICAgICAgICAgICAgY2FzZSBUSFJFQURfUkVTVEFSVDoKLSAgICAgICAg
ICAgIGRlZmF1bHQ6CisJCSAgICBjYXNlIFRIUkVBRF9SRVNUQVJUOgorCQkgICAgZGVmYXVsdDoK
ICNpZiBNQUNIX0FTU0VSVAotICAgICAgICAgICAgYXNzZXJ0KCEiaXBjX21xdWV1ZV9zZW5kOiB1
bmV4cGVjdGVkIHRocmVhZCB3YWtldXAgcmVzdWx0Iik7CisJCQlhc3NlcnQoISJpcGNfbXF1ZXVl
X3NlbmQiKTsKICNlbHNlCi0gICAgICAgICAgICBwYW5pYygiaXBjX21xdWV1ZV9zZW5kIik7CisJ
CQlwYW5pYygiaXBjX21xdWV1ZV9zZW5kIik7CiAjZW5kaWYKLSAgICAgICAgfQotICAgIH0KKwkJ
fQorCX0KIAogCWlmIChrbXNnLT5pa21faGVhZGVyLm1zZ2hfYml0cyAmIE1BQ0hfTVNHSF9CSVRT
X0NJUkNVTEFSKSB7CiAJCWlwX3VubG9jayhwb3J0KTsKLS0gCjIuNDMuMAo=
--000000000000820fcf06576b4440--