- Kernel - mailweb.openeuler.org

[PATCH OLK-6.6 0/5] Add support for ecmdq
by Zhang Zekun 27 Jan '24

27 Jan '24

Add support for ecmdq Zhen Lei (5): iommu/arm-smmu-v3: Add support for ECMDQ register mode iommu/arm-smmu-v3: Ensure that a set of associated commands are inserted in the same ECMDQ iommu/arm-smmu-v3: Add arm_smmu_ecmdq_issue_cmdlist() for non-shared ECMDQ iommu/arm-smmu-v3: Add support for less than one ECMDQ per core iommu/arm-smmu-v3: Allow disabling ECMDQs at boot time drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 434 +++++++++++++++++++- drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.h | 39 ++ 2 files changed, 465 insertions(+), 8 deletions(-) -- 2.17.1

2 6

[PATCH openEuler-1.0-LTS] rtc: check if __rtc_read_time was successful
by Yu Liao 27 Jan '24

27 Jan '24

From: Tom Rix <trix(a)redhat.com> mainline inclusion from mainline-v5.18-rc1 commit 915593a7a663b2ad08b895a5f3ba8b19d89d4ebf category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8ZCJG CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ---------------------------------------- Clang static analysis reports this issue interface.c:810:8: warning: Passed-by-value struct argument contains uninitialized data now = rtc_tm_to_ktime(tm); ^~~~~~~~~~~~~~~~~~~ tm is set by a successful call to __rtc_read_time() but its return status is not checked. Check if it was successful before setting the enabled flag. Move the decl of err to function scope. Fixes: 2b2f5ff00f63 ("rtc: interface: ignore expired timers when enqueuing new timers") Signed-off-by: Tom Rix <trix(a)redhat.com> Signed-off-by: Alexandre Belloni <alexandre.belloni(a)bootlin.com> Link: https://lore.kernel.org/r/20220326194236.2916310-1-trix@redhat.com Signed-off-by: Yu Liao <liaoyu15(a)huawei.com> --- drivers/rtc/interface.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/drivers/rtc/interface.c b/drivers/rtc/interface.c index ce051f91829f..e62b341bdc9e 100644 --- a/drivers/rtc/interface.c +++ b/drivers/rtc/interface.c @@ -820,9 +820,13 @@ static int rtc_timer_enqueue(struct rtc_device *rtc, struct rtc_timer *timer) struct timerqueue_node *next = timerqueue_getnext(&rtc->timerqueue); struct rtc_time tm; ktime_t now; + int err; + + err = __rtc_read_time(rtc, &tm); + if (err) + return err; timer->enabled = 1; - __rtc_read_time(rtc, &tm); now = rtc_tm_to_ktime(tm); /* Skip over expired timers */ @@ -836,7 +840,6 @@ static int rtc_timer_enqueue(struct rtc_device *rtc, struct rtc_timer *timer) trace_rtc_timer_enqueue(timer); if (!next || ktime_before(timer->node.expires, next->expires)) { struct rtc_wkalrm alarm; - int err; alarm.time = rtc_ktime_to_tm(timer->node.expires); alarm.enabled = 1; err = __rtc_set_alarm(rtc, &alarm); -- 2.33.0

1 0

[PATCH openEuler-1.0-LTS] crypto: scomp - fix req->dst buffer overflow
by felix 27 Jan '24

27 Jan '24

From: Chengming Zhou <zhouchengming(a)bytedance.com> mainline inclusion category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I8ZBUC CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The req->dst buffer size should be checked before copying from the scomp_scratch->dst to avoid req->dst buffer overflow problem. Fixes: 1ab53a77b772 ("crypto: acomp - add driver-side scomp interface") Reported-by: syzbot+3eff5e51bf1db122a16e(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/0000000000000b05cd060d6b5511@google.com/ Signed-off-by: Chengming Zhou <zhouchengming(a)bytedance.com> Reviewed-by: Barry Song <v-songbaohua(a)oppo.com> Signed-off-by: Herbert Xu <herbert(a)gondor.apana.org.au> Signed-off-by: Felix Fu <fuzhen5(a)huawei.com> --- crypto/scompress.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/crypto/scompress.c b/crypto/scompress.c index 968bbcf65c94..3ade31df4f22 100644 --- a/crypto/scompress.c +++ b/crypto/scompress.c @@ -149,6 +149,7 @@ static int scomp_acomp_comp_decomp(struct acomp_req *req, int dir) const int cpu = get_cpu(); u8 *scratch_src = *per_cpu_ptr(scomp_src_scratches, cpu); u8 *scratch_dst = *per_cpu_ptr(scomp_dst_scratches, cpu); + unsigned int dlen; int ret; if (!req->src || !req->slen || req->slen > SCOMP_SCRATCH_SIZE) { @@ -164,6 +165,8 @@ static int scomp_acomp_comp_decomp(struct acomp_req *req, int dir) if (!req->dlen || req->dlen > SCOMP_SCRATCH_SIZE) req->dlen = SCOMP_SCRATCH_SIZE; + dlen = req->dlen; + scatterwalk_map_and_copy(scratch_src, req->src, 0, req->slen, 0); if (dir) ret = crypto_scomp_compress(scomp, scratch_src, req->slen, @@ -176,6 +179,9 @@ static int scomp_acomp_comp_decomp(struct acomp_req *req, int dir) req->dst = sgl_alloc(req->dlen, GFP_ATOMIC, NULL); if (!req->dst) goto out; + } else if (req->dlen > dlen) { + ret = -ENOSPC; + goto out; } scatterwalk_map_and_copy(scratch_dst, req->dst, 0, req->dlen, 1); -- 2.34.1

1 0

[PATCH openEuler-1.0-LTS] Bluetooth: rfcomm: Fix null-ptr-deref in rfcomm_check_security
by Zhengchao Shao 27 Jan '24

27 Jan '24

From: Yuxuan Hu <20373622(a)buaa.edu.cn> maillist inclusion category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I8YV3O CVE: CVE-2024-22099 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/commit/… -------------------------------- During our fuzz testing of the connection and disconnection process at the RFCOMM layer, we discovered this bug. By comparing the packets from a normal connection and disconnection process with the testcase that triggered a KASAN report. We analyzed the cause of this bug as follows: 1. In the packets captured during a normal connection, the host sends a `Read Encryption Key Size` type of `HCI_CMD` packet (Command Opcode: 0x1408) to the controller to inquire the length of encryption key.After receiving this packet, the controller immediately replies with a Command Completepacket (Event Code: 0x0e) to return the Encryption Key Size. 2. In our fuzz test case, the timing of the controller's response to this packet was delayed to an unexpected point: after the RFCOMM and L2CAP layers had disconnected but before the HCI layer had disconnected. 3. After receiving the Encryption Key Size Response at the time described in point 2, the host still called the rfcomm_check_security function. However, by this time `struct l2cap_conn *conn = l2cap_pi(sk)->chan->conn;` had already been released, and when the function executed `return hci_conn_security(conn->hcon, d->sec_level, auth_type, d->out);`, specifically when accessing `conn->hcon`, a null-ptr-deref error occurred. To fix this bug, check if `sk->sk_state` is BT_CLOSED before calling rfcomm_recv_frame in rfcomm_process_rx. Signed-off-by: Yuxuan Hu <20373622(a)buaa.edu.cn> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> --- net/bluetooth/rfcomm/core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/bluetooth/rfcomm/core.c b/net/bluetooth/rfcomm/core.c index b98225d65e87..6dff0d925400 100644 --- a/net/bluetooth/rfcomm/core.c +++ b/net/bluetooth/rfcomm/core.c @@ -1903,7 +1903,7 @@ static struct rfcomm_session *rfcomm_process_rx(struct rfcomm_session *s) /* Get data directly from socket receive queue without copying it. */ while ((skb = skb_dequeue(&sk->sk_receive_queue))) { skb_orphan(skb); - if (!skb_linearize(skb)) { + if (!skb_linearize(skb) && sk->sk_state != BT_CLOSED) { s = rfcomm_recv_frame(s, skb); if (!s) break; -- 2.34.1

1 0

[openeuler:openEuler-1.0-LTS 17239/21577] drivers/nvme/host/core.c:1163:27: error: 'compat_uptr_t' undeclared; did you mean 'compat_time_t'?
by kernel test robot 27 Jan '24

27 Jan '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 992b5fc139d3aa14b25613b06adee4bb9c110b28 commit: b8ba22a604e4d0a3ad8e23af22f432e12b6f1a65 [17239/21577] nvme: fix compat address handling in several ioctls config: arm64-randconfig-002-20240125 (https://download.01.org/0day-ci/archive/20240127/202401271204.lWrJHpqI-lkp@…) compiler: aarch64-linux-gcc (GCC) 13.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240127/202401271204.lWrJHpqI-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202401271204.lWrJHpqI-lkp@intel.com/ All errors (new ones prefixed by >>): drivers/nvme/host/core.c: In function 'nvme_to_user_ptr': >> drivers/nvme/host/core.c:1163:27: error: 'compat_uptr_t' undeclared (first use in this function); did you mean 'compat_time_t'? 1163 | ptrval = (compat_uptr_t)ptrval; | ^~~~~~~~~~~~~ | compat_time_t drivers/nvme/host/core.c:1163:27: note: each undeclared identifier is reported only once for each function it appears in >> drivers/nvme/host/core.c:1163:41: error: expected ';' before 'ptrval' 1163 | ptrval = (compat_uptr_t)ptrval; | ^~~~~~ | ; vim +1163 drivers/nvme/host/core.c 1154 1155 /* 1156 * Convert integer values from ioctl structures to user pointers, silently 1157 * ignoring the upper bits in the compat case to match behaviour of 32-bit 1158 * kernels. 1159 */ 1160 static void __user *nvme_to_user_ptr(uintptr_t ptrval) 1161 { 1162 if (in_compat_syscall()) > 1163 ptrval = (compat_uptr_t)ptrval; 1164 return (void __user *)ptrval; 1165 } 1166 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10] Bluetooth: rfcomm: Fix null-ptr-deref in rfcomm_check_security
by Zhengchao Shao 27 Jan '24

27 Jan '24

From: Yuxuan Hu <20373622(a)buaa.edu.cn> maillist inclusion category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I8YV3O CVE: CVE-2024-22099 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/commit/… -------------------------------- During our fuzz testing of the connection and disconnection process at the RFCOMM layer, we discovered this bug. By comparing the packets from a normal connection and disconnection process with the testcase that triggered a KASAN report. We analyzed the cause of this bug as follows: 1. In the packets captured during a normal connection, the host sends a `Read Encryption Key Size` type of `HCI_CMD` packet (Command Opcode: 0x1408) to the controller to inquire the length of encryption key.After receiving this packet, the controller immediately replies with a Command Completepacket (Event Code: 0x0e) to return the Encryption Key Size. 2. In our fuzz test case, the timing of the controller's response to this packet was delayed to an unexpected point: after the RFCOMM and L2CAP layers had disconnected but before the HCI layer had disconnected. 3. After receiving the Encryption Key Size Response at the time described in point 2, the host still called the rfcomm_check_security function. However, by this time `struct l2cap_conn *conn = l2cap_pi(sk)->chan->conn;` had already been released, and when the function executed `return hci_conn_security(conn->hcon, d->sec_level, auth_type, d->out);`, specifically when accessing `conn->hcon`, a null-ptr-deref error occurred. To fix this bug, check if `sk->sk_state` is BT_CLOSED before calling rfcomm_recv_frame in rfcomm_process_rx. Signed-off-by: Yuxuan Hu <20373622(a)buaa.edu.cn> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> --- net/bluetooth/rfcomm/core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/bluetooth/rfcomm/core.c b/net/bluetooth/rfcomm/core.c index 8d6fce9005bd..4f54c7df3a94 100644 --- a/net/bluetooth/rfcomm/core.c +++ b/net/bluetooth/rfcomm/core.c @@ -1937,7 +1937,7 @@ static struct rfcomm_session *rfcomm_process_rx(struct rfcomm_session *s) /* Get data directly from socket receive queue without copying it. */ while ((skb = skb_dequeue(&sk->sk_receive_queue))) { skb_orphan(skb); - if (!skb_linearize(skb)) { + if (!skb_linearize(skb) && sk->sk_state != BT_CLOSED) { s = rfcomm_recv_frame(s, skb); if (!s) break; -- 2.34.1

2 1

[openeuler:openEuler-1.0-LTS 16561/21577] mm/pin_mem.c:228:31: error: 'HUGETLB_PAGE_DTOR' undeclared; did you mean 'HUGETLB_PAGE_ORDER'?
by kernel test robot 27 Jan '24

27 Jan '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 992b5fc139d3aa14b25613b06adee4bb9c110b28 commit: 1a378b87531ea80e7847bf0105adedff28a73080 [16561/21577] mm: add pin memory method for checkpoint add restore config: arm64-randconfig-003-20240125 (https://download.01.org/0day-ci/archive/20240127/202401271117.5DMuyrks-lkp@…) compiler: aarch64-linux-gcc (GCC) 13.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240127/202401271117.5DMuyrks-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202401271117.5DMuyrks-lkp@intel.com/ All errors (new ones prefixed by >>): mm/pin_mem.c:171:6: warning: no previous prototype for 'reserve_page_from_buddy' [-Wmissing-prototypes] 171 | void reserve_page_from_buddy(unsigned long nr_pages, struct page *page) | ^~~~~~~~~~~~~~~~~~~~~~~ mm/pin_mem.c: In function 'init_huge_pmd_pages': >> mm/pin_mem.c:228:31: error: 'HUGETLB_PAGE_DTOR' undeclared (first use in this function); did you mean 'HUGETLB_PAGE_ORDER'? 228 | page->compound_dtor = HUGETLB_PAGE_DTOR + 1; | ^~~~~~~~~~~~~~~~~ | HUGETLB_PAGE_ORDER mm/pin_mem.c:228:31: note: each undeclared identifier is reported only once for each function it appears in mm/pin_mem.c: At top level: mm/pin_mem.c:254:6: warning: no previous prototype for 'free_user_map_pages' [-Wmissing-prototypes] 254 | void free_user_map_pages(unsigned int pid_index, unsigned int entry_index, unsigned int page_index) | ^~~~~~~~~~~~~~~~~~~ mm/pin_mem.c:311:6: warning: no previous prototype for 'check_redirect_end_valid' [-Wmissing-prototypes] 311 | bool check_redirect_end_valid(struct redirect_info *redirect_start, | ^~~~~~~~~~~~~~~~~~~~~~~~ mm/pin_mem.c:392:5: warning: no previous prototype for 'calculate_pin_mem_digest' [-Wmissing-prototypes] 392 | int calculate_pin_mem_digest(struct pin_mem_dump_info *pmdi, char *digest) | ^~~~~~~~~~~~~~~~~~~~~~~~ mm/pin_mem.c:481:5: warning: no previous prototype for 'collect_pmd_huge_pages' [-Wmissing-prototypes] 481 | int collect_pmd_huge_pages(struct task_struct *task, | ^~~~~~~~~~~~~~~~~~~~~~ mm/pin_mem.c:544:5: warning: no previous prototype for 'collect_normal_pages' [-Wmissing-prototypes] 544 | int collect_normal_pages(struct task_struct *task, | ^~~~~~~~~~~~~~~~~~~~ mm/pin_mem.c: In function 'collect_normal_pages': mm/pin_mem.c:549:26: warning: variable 'nr_pages' set but not used [-Wunused-but-set-variable] 549 | unsigned long i, nr_pages; | ^~~~~~~~ mm/pin_mem.c: At top level: mm/pin_mem.c:610:6: warning: no previous prototype for 'free_pin_pages' [-Wmissing-prototypes] 610 | void free_pin_pages(struct page_map_entry *pme) | ^~~~~~~~~~~~~~ mm/pin_mem.c:770:12: warning: no previous prototype for 'remap_normal_pages' [-Wmissing-prototypes] 770 | vm_fault_t remap_normal_pages(struct mm_struct *mm, struct vm_area_struct *vma, | ^~~~~~~~~~~~~~~~~~ mm/pin_mem.c:857:12: warning: no previous prototype for 'remap_huge_pmd_pages' [-Wmissing-prototypes] 857 | vm_fault_t remap_huge_pmd_pages(struct mm_struct *mm, struct vm_area_struct *vma, | ^~~~~~~~~~~~~~~~~~~~ vim +228 mm/pin_mem.c 211 212 static void init_huge_pmd_pages(struct page *head_page) 213 { 214 int i = 0; 215 struct page *page = head_page; 216 unsigned long *temp; 217 unsigned long compound_pad = COMPOUND_PAD_START; 218 219 __set_bit(PG_head, &page->flags); 220 __set_bit(PG_active, &page->flags); 221 atomic_set(&page->_refcount, 1); 222 page++; 223 i++; 224 page->compound_head = (unsigned long)head_page + 1; 225 page->_compound_pad_2 = (unsigned long)head_page & COMPOUND_PAD_MASK; 226 temp = (unsigned long *)(&(page->_compound_pad_2)); 227 temp[1] = LIST_POISON4; > 228 page->compound_dtor = HUGETLB_PAGE_DTOR + 1; 229 page->compound_order = HPAGE_PMD_ORDER; 230 page++; 231 i++; 232 page->compound_head = (unsigned long)head_page + 1; 233 page->_compound_pad_2 = (unsigned long)head_page + compound_pad; 234 i++; 235 236 INIT_LIST_HEAD(&(page->deferred_list)); 237 for (; i < HPAGE_PMD_NR; i++) { 238 page = head_page + i; 239 page->compound_head = (unsigned long)head_page + 1; 240 compound_pad += COMPOUND_PAD_DELTA; 241 page->_compound_pad_2 = (unsigned long)head_page + compound_pad; 242 temp = (unsigned long *)(&(page->_compound_pad_2)); 243 temp[1] = LIST_POISON4; 244 } 245 } 246 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS 0/1] crypto: scomp - fix req->dst buffer overflow
by felix 27 Jan '24

27 Jan '24

From: Felix Fu <fuzhen5(a)huawei.com> *** BLURB HERE *** Chengming Zhou (1): crypto: scomp - fix req->dst buffer overflow crypto/scompress.c | 6 ++++++ 1 file changed, 6 insertions(+) -- 2.34.1

1 1

[PATCH openEuler-1.0-LTS] nfc: nci: fix possible NULL pointer dereference in send_acknowledge()
by Ziyang Xuan 27 Jan '24

27 Jan '24

From: Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org> stable inclusion from stable-v4.19.297 commit 5622592f8f74ae3e594379af02e64ea84772d0dd category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I8YCSH CVE: CVE-2023-46343 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 7937609cd387246aed994e81aa4fa951358fba41 upstream. Handle memory allocation failure from nci_skb_alloc() (calling alloc_skb()) to avoid possible NULL pointer dereference. Reported-by: 黄思聪 <huangsicong(a)iie.ac.cn> Fixes: 391d8a2da787 ("NFC: Add NCI over SPI receive") Cc: <stable(a)vger.kernel.org> Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org> Reviewed-by: Simon Horman <horms(a)kernel.org> Link: https://lore.kernel.org/r/20231013184129.18738-1-krzysztof.kozlowski@linaro… Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Ziyang Xuan <william.xuanziyang(a)huawei.com> --- net/nfc/nci/spi.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/net/nfc/nci/spi.c b/net/nfc/nci/spi.c index 452f4c16b7a9..d2de7fc226f0 100644 --- a/net/nfc/nci/spi.c +++ b/net/nfc/nci/spi.c @@ -163,6 +163,8 @@ static int send_acknowledge(struct nci_spi *nspi, u8 acknowledge) int ret; skb = nci_skb_alloc(nspi->ndev, 0, GFP_KERNEL); + if (!skb) + return -ENOMEM; /* add the NCI SPI header to the start of the buffer */ hdr = skb_push(skb, NCI_SPI_HDR_LEN); -- 2.25.1

1 0

[openeuler:openEuler-1.0-LTS 20469/21577] arch/x86/entry/entry_64.o: warning: objtool: If this is a retpoline, please patch it in with alternatives and annotate it with ANNOTATE_NOSPEC_ALTERNATIVE.
by kernel test robot 27 Jan '24

27 Jan '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 992b5fc139d3aa14b25613b06adee4bb9c110b28 commit: 3acbac72baea337e0ac79801a8ba4b81e3b67014 [20469/21577] x86/speculation: Change FILL_RETURN_BUFFER to work with objtool config: x86_64-randconfig-001-20240125 (https://download.01.org/0day-ci/archive/20240127/202401270508.Gi2jxRRU-lkp@…) compiler: clang version 17.0.6 (https://github.com/llvm/llvm-project 6009708b4367171ccdbf4b5905cb6a803753fe18) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240127/202401270508.Gi2jxRRU-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202401270508.Gi2jxRRU-lkp@intel.com/ All warnings (new ones prefixed by >>): >> arch/x86/entry/entry_64.o: warning: objtool: .entry.text+0x1d2: unsupported intra-function call >> arch/x86/entry/entry_64.o: warning: objtool: If this is a retpoline, please patch it in with alternatives and annotate it with ANNOTATE_NOSPEC_ALTERNATIVE. -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0