Linaro-mm-sig

linaro-mm-sig@lists.linaro.org

58 participants
6152 discussions

Re: [PATCH] dma-buf/dma_fence: be more defensive in dma_fence_release

by Christian König

Hi Boris, On 3/18/26 10:18, Boris Brezillon wrote: > Hi Christian, > > On Wed, 18 Mar 2026 09:21:34 +0100 > Christian König <christian.koenig(a)amd.com> wrote: > >> On 3/17/26 16:21, Boris Brezillon wrote: >>> On Tue, 17 Mar 2026 15:48:25 +0100 >>> "Christian König" <ckoenig.leichtzumerken(a)gmail.com> wrote: >>> >>>> In case of a refcounting bug dma_fence_release() can be called >>>> before the fence was even signaled. >>>> >>>> Previously the dma_fence framework then force signaled the fence >>>> to make sure to unblock waiters, but that can potentially lead to >>>> random memory corruption when the DMA operation continues. So be >>>> more defensive here and pick the lesser evil. >>>> >>>> Instead of force signaling the fence set an error code on the >>>> fence, re-initialize the refcount to something large and taint the >>>> kernel. >>>> >>>> This will leak memory and eventually can cause a deadlock when the >>>> fence is never signaled, but at least we won't run into an use >>>> after free or random memory corruption. >>>> >>>> Signed-off-by: Christian König <christian.koenig(a)amd.com> >>>> --- >>>> drivers/dma-buf/dma-fence.c | 18 ++++++++++++++---- >>>> 1 file changed, 14 insertions(+), 4 deletions(-) >>>> >>>> diff --git a/drivers/dma-buf/dma-fence.c >>>> b/drivers/dma-buf/dma-fence.c index 1826ba73094c..8bf07685a053 >>>> 100644 --- a/drivers/dma-buf/dma-fence.c >>>> +++ b/drivers/dma-buf/dma-fence.c >>>> @@ -593,14 +593,24 @@ void dma_fence_release(struct kref *kref) >>>> /* >>>> * Failed to signal before release, likely a >>>> refcounting issue. * >>>> - * This should never happen, but if it does make >>>> sure that we >>>> - * don't leave chains dangling. We set the error >>>> flag first >>>> - * so that the callbacks know this signal is due >>>> to an error. >>>> + * This should never happen, but if try to be >>>> defensive and take >>>> + * the lesser evil. Initialize the refcount to >>>> something large, >>>> + * but not so large that it can overflow. >>>> + * >>>> + * That will leak memory and could deadlock if >>>> the fence never >>>> + * signals, but at least it doesn't cause an use >>>> after free or >>>> + * random memory corruption. >>>> + * >>>> + * Also taint the kernel to note that it is >>>> rather unreliable to >>>> + * continue. >>>> */ >>>> dma_fence_lock_irqsave(fence, flags); >>>> fence->error = -EDEADLK; >>>> - dma_fence_signal_locked(fence); >>>> + refcount_set(&fence->refcount.refcount, INT_MAX); >>>> >>> >>> I'm not convinced this is useful. If we leak the object, no one >>> should have a ref to release anyway. This does raise a question >>> though. The case we're trying to protect against is fence_callback >>> being registered to this fence and waiting for an event to signal >>> another proxy fence. >> >> Not quite. The real problematic case is that it is necessary to wait >> for a fence to signal with tons of memory management locks held. >> >> So it can be that a simple memory allocation cycles back and depends >> on the fence to signal. >> >>> How can the refcnt drop to zero in that case? Isn't the proxy >>> supposed to own a ref on the fence. Before we go further, I'd like >>> to understand what we're trying to do. >> >> Well we are in C here, so its simply coding errors. An unecessary >> dma_fence_put() in an error path is enough to trigger this. >> >>> The original discussion that led you to write this patch was about >>> detecting when a fence emitter/producer would leave unsignalled >>> fences behind, and the problem we have is when such unsignalled >>> fences have observers waiting for a "signalled" event. If the >>> refcnt drops to zero and the fence is released, we're already >>> passed that point, unfortunately. >> >> Well that is not quite correct. >> >> The most common problem is that we have unbalanced >> dma_fence_get()/dma_fence_put() and we end up in dma_fence_release() >> before the issuer of the dma_fence has a chance to signal it. > > Okay, so that's clearly not solving the problem we were discussing on > [1], I thought it was related. Yeah, correct. The situation on the Rust side is clearly different, you simply doesn't have incorrect refcounting issues there. > Also, I'm still skeptical that we should > try and harden security for a situation that's already covered by > refcount overflow detection. Refcount overflow detection is unfortunately not enabled everywhere and even if it is enabled it doesn't protect against such issues here, it only points them out when it is already to late. > I get why you want to do that, but it > feels like the wrong tool to me. I mean, we wouldn't even see it as > an unbalanced dma_fence_get/put() now that you manually set the refcount > to INT_MAX, which is the bug you're trying to cover for in the first > place. > >> >> See the main purpose of DMA fences is to prevent releasing memory >> back into the core memory management before the DMA operation is >> completed. > > That's a UAF, just a differnt kind (device UAF instead of CPU UAF). Yeah agree completely. The problem is that SW UAF issues are preventable by using something like Rust while HW UAF issues can only be found by an IOMMU and that in turn is disabled more often than not. Especially GPUs and accelerators usually use pass through mode for IOMMU because of both HW bugs as well as performance overhead. > Anyway, my point remains, the root of the issue you're covering for is > a dma_fence UAF (more put()s than get()s, and the CPU still has a ref > on a released dma_fence object). The outcome of this might be device > UAF because of the auto-signalling, but that's still just another > symptom of the dma_fence UAF (with wider consequences, admittedly). > >> >> So when a DMA fence signals to early it means that the HW is still >> writing to that memory but we already potentially re-using the memory >> ending in random memory corruption. > > Yep, I'm well aware of that. > >> >> UAF issues are harmless compared to that. > > That's not what I'm arguing against. What I'm saying is that you just > paper over an issue by messing up with the refcount, and now it's hard > to tell what the root cause is. Completely agree as well. It's not a real solution, but only the lesser evil. Regards, Christian. > > Regards, > > Boris > > [1]https://yhbt.net/lore/all/8bac1559-e139-4a74-a6e8-c2846093db72@amd.com/

16 hours, 35 minutes

Re: [PATCH] dma-buf/dma_fence: be more defensive in dma_fence_release

by Christian König

On 3/17/26 16:21, Boris Brezillon wrote: > On Tue, 17 Mar 2026 15:48:25 +0100 > "Christian König" <ckoenig.leichtzumerken(a)gmail.com> wrote: > >> In case of a refcounting bug dma_fence_release() can be called before the >> fence was even signaled. >> >> Previously the dma_fence framework then force signaled the fence to make >> sure to unblock waiters, but that can potentially lead to random memory >> corruption when the DMA operation continues. So be more defensive here and >> pick the lesser evil. >> >> Instead of force signaling the fence set an error code on the fence, >> re-initialize the refcount to something large and taint the kernel. >> >> This will leak memory and eventually can cause a deadlock when the fence >> is never signaled, but at least we won't run into an use after free or >> random memory corruption. >> >> Signed-off-by: Christian König <christian.koenig(a)amd.com> >> --- >> drivers/dma-buf/dma-fence.c | 18 ++++++++++++++---- >> 1 file changed, 14 insertions(+), 4 deletions(-) >> >> diff --git a/drivers/dma-buf/dma-fence.c b/drivers/dma-buf/dma-fence.c >> index 1826ba73094c..8bf07685a053 100644 >> --- a/drivers/dma-buf/dma-fence.c >> +++ b/drivers/dma-buf/dma-fence.c >> @@ -593,14 +593,24 @@ void dma_fence_release(struct kref *kref) >> /* >> * Failed to signal before release, likely a refcounting issue. >> * >> - * This should never happen, but if it does make sure that we >> - * don't leave chains dangling. We set the error flag first >> - * so that the callbacks know this signal is due to an error. >> + * This should never happen, but if try to be defensive and take >> + * the lesser evil. Initialize the refcount to something large, >> + * but not so large that it can overflow. >> + * >> + * That will leak memory and could deadlock if the fence never >> + * signals, but at least it doesn't cause an use after free or >> + * random memory corruption. >> + * >> + * Also taint the kernel to note that it is rather unreliable to >> + * continue. >> */ >> dma_fence_lock_irqsave(fence, flags); >> fence->error = -EDEADLK; >> - dma_fence_signal_locked(fence); >> + refcount_set(&fence->refcount.refcount, INT_MAX); > > I'm not convinced this is useful. If we leak the object, no one should > have a ref to release anyway. This does raise a question though. The > case we're trying to protect against is fence_callback being registered > to this fence and waiting for an event to signal another proxy fence. Not quite. The real problematic case is that it is necessary to wait for a fence to signal with tons of memory management locks held. So it can be that a simple memory allocation cycles back and depends on the fence to signal. > How can the refcnt drop to zero in that case? Isn't the proxy supposed > to own a ref on the fence. Before we go further, I'd like to understand > what we're trying to do. Well we are in C here, so its simply coding errors. An unecessary dma_fence_put() in an error path is enough to trigger this. > The original discussion that led you to write this patch was about > detecting when a fence emitter/producer would leave unsignalled fences > behind, and the problem we have is when such unsignalled fences have > observers waiting for a "signalled" event. If the refcnt drops to zero > and the fence is released, we're already passed that point, > unfortunately. Well that is not quite correct. The most common problem is that we have unbalanced dma_fence_get()/dma_fence_put() and we end up in dma_fence_release() before the issuer of the dma_fence has a chance to signal it. See the main purpose of DMA fences is to prevent releasing memory back into the core memory management before the DMA operation is completed. So when a DMA fence signals to early it means that the HW is still writing to that memory but we already potentially re-using the memory ending in random memory corruption. UAF issues are harmless compared to that. Regards, Christian. > It can be that: > > - the fence was never exposed -> this is fine > - the fence was exposed but never observed -> this is broken, because if > it had been observed it would have led to a deadlock > - the fence was exposed, observed for some time, but the observer got > bored, stopped waiting and: > * decided to go and execute its stuff anyway -> use-before-ready > situation > * gave up -> kinda okay, but we should still consider the fence > emitter broken > - the fence observer registered a callback but didn't take a ref on the > object -> this is potential UAF on the dma_fence, which can also lead > to a VRAM/system-mem UAF if the emitter drops the dma_fence without > signalling, because of the auto-signal you're getting rid of in this > patch. But the latter is just a side effect of the dma_fence UAF, > which I'm not convinced we should try to protect against. > >> dma_fence_unlock_irqrestore(fence, flags); >> + rcu_read_unlock(); >> + add_taint(TAINT_SOFTLOCKUP, LOCKDEP_STILL_OK); >> + return; >> } >> >> ops = rcu_dereference(fence->ops); >

18 hours, 3 minutes

Re: [PATCH] dma-buf/udmabuf: skip redundant cpu sync to fix cacheline EEXIST warning

by Christian König

On 3/18/26 06:40, Kasireddy, Vivek wrote: > Hi Mikhail, > >> Subject: [PATCH] dma-buf/udmabuf: skip redundant cpu sync to fix >> cacheline EEXIST warning >> >> When CONFIG_DMA_API_DEBUG_SG is enabled, importing a udmabuf >> into a DRM >> driver (e.g. amdgpu for video playback in GNOME Videos / Showtime) >> triggers a spurious warning: >> >> DMA-API: amdgpu 0000:03:00.0: cacheline tracking EEXIST, \ >> overlapping mappings aren't supported >> WARNING: kernel/dma/debug.c:619 at add_dma_entry+0x473/0x5f0 >> >> The call chain is: >> >> amdgpu_cs_ioctl >> -> amdgpu_ttm_backend_bind >> -> dma_buf_map_attachment >> -> [udmabuf] map_udmabuf -> get_sg_table >> -> dma_map_sgtable(dev, sg, direction, 0) // attrs=0 >> -> debug_dma_map_sg -> add_dma_entry -> EEXIST >> >> This happens because udmabuf builds a per-page scatter-gather list via >> sg_set_folio(). When begin_cpu_udmabuf() has already created an sg >> table mapped for the misc device, and an importer such as amdgpu >> maps >> the same pages for its own device via map_udmabuf(), the DMA debug >> infrastructure sees two active mappings whose physical addresses share >> cacheline boundaries and warns about the overlap. >> >> The DMA_ATTR_SKIP_CPU_SYNC flag suppresses this check in >> add_dma_entry() because it signals that no CPU cache maintenance is >> performed at map/unmap time, making the cacheline overlap harmless. >> >> All other major dma-buf exporters already pass this flag: >> - drm_gem_map_dma_buf() passes DMA_ATTR_SKIP_CPU_SYNC >> - amdgpu_dma_buf_map() passes DMA_ATTR_SKIP_CPU_SYNC >> >> The CPU sync at map/unmap time is also redundant for udmabuf: >> begin_cpu_udmabuf() and end_cpu_udmabuf() already perform explicit >> cache synchronization via dma_sync_sgtable_for_cpu/device() when >> CPU >> access is requested through the dma-buf interface. >> >> Pass DMA_ATTR_SKIP_CPU_SYNC to dma_map_sgtable() and >> dma_unmap_sgtable() in udmabuf to suppress the spurious warning >> and >> skip the redundant sync. >> >> Fixes: 284562e1f348 ("udmabuf: implement >> begin_cpu_access/end_cpu_access hooks") >> Cc: stable(a)vger.kernel.org >> Signed-off-by: Mikhail Gavrilov <mikhail.v.gavrilov(a)gmail.com> >> --- >> drivers/dma-buf/udmabuf.c | 4 ++-- >> 1 file changed, 2 insertions(+), 2 deletions(-) >> >> diff --git a/drivers/dma-buf/udmabuf.c b/drivers/dma-buf/udmabuf.c >> index 94b8ecb892bb..9c6f8785a28a 100644 >> --- a/drivers/dma-buf/udmabuf.c >> +++ b/drivers/dma-buf/udmabuf.c >> @@ -162,7 +162,7 @@ static struct sg_table *get_sg_table(struct device >> *dev, struct dma_buf *buf, >> sg_set_folio(sgl, ubuf->folios[i], PAGE_SIZE, >> ubuf->offsets[i]); >> >> - ret = dma_map_sgtable(dev, sg, direction, 0); >> + ret = dma_map_sgtable(dev, sg, direction, >> DMA_ATTR_SKIP_CPU_SYNC); >> if (ret < 0) >> goto err_map; >> return sg; >> @@ -177,7 +177,7 @@ static struct sg_table *get_sg_table(struct device >> *dev, struct dma_buf *buf, >> static void put_sg_table(struct device *dev, struct sg_table *sg, >> enum dma_data_direction direction) >> { >> - dma_unmap_sgtable(dev, sg, direction, 0); >> + dma_unmap_sgtable(dev, sg, direction, >> DMA_ATTR_SKIP_CPU_SYNC); > Looks OK to me but it would be nice if Christian or someone else can > provide an Ack for this patch. The details of the udmabuf handling is absolutely not my field of expertise. Feel free to add my Acked-by since it obviously seems to fix a bug, but it would be nice if somebody could do an in deep review as well. Regards, Christian. > > Thanks, > Vivek > >> sg_free_table(sg); >> kfree(sg); >> } >> -- >> 2.53.0 >

18 hours, 31 minutes

Professional blockchain investigation services

by schoumachermathieu8＠gmail.com

When someone loses funds to a fake crypto investment platform, recovery can be difficult but not always impossible. Some people contact services like Vault Traces Recovery experts, which specialize in tracking stolen digital assets. The more information you can provide (transaction hashes, platform details, emails, etc.), the better they can analyze the situation. For assistance, Contact them for more info HomePage > Vaulttrades . c o m WhatApp: +1 (570) 291-8211 Mail: info @ vaulttraces . C o m

1 day, 3 hours

Abortion Pills For Sale In Riyadh,(🟡💖🟢)+971568044699(🟡💖🟢 mifepristone and misoprostol available in Riyadh, Cytotec In Riyadh

by kachachaissue12＠gmail.com

Abortion Pills For Sale In Riyadh,(🟡💖🟢)+971568044699(🟡💖🟢 mifepristone and misoprostol available in Riyadh, Cytotec In Riyadh

1 day, 9 hours

Abortion Pills For Sale In RAK City, (🟡💖🟢)+971568044699(🟡💖🟢Abortion Pills For Sale In Fujairah, Jebel Ali, Kalba, Abortion Pills For Sale In Khor Fakkan, Umm al-Quwain

by kachachaissue12＠gmail.com

Abortion Pills For Sale In RAK City, (🟡💖🟢)+971568044699(🟡💖🟢Abortion Pills For Sale In Fujairah, Jebel Ali, Kalba, Abortion Pills For Sale In Khor Fakkan, Umm al-Quwain+971568044699 Abortion Pills In Bahrain, +971568044699 Abortion Pills For Sale In Bahrain, +971568044699 Termination Pills Available In Bahrain, +971568044699 Where Can I Buy Cytotec Pills In Bahrain, +971568044699 Misoprostol Pills Available In Bahrain, +971568044699 Misoprostol Tablets Available In Bahrain, +971568044699 +971568044699 Misoprostol Medicine In Bahrain, +971568044699 Mifepristone Pills In Bahrain, +971568044699 Mifepristone Pills In Bahrain, +971568044699 Mifepristone Tablets In Bahrain, +971568044699 Mifepristone Medicine Available In Bahrain, +971568044699 Where Can I Find Mifepristone Pills In Bahrain, +971568044699 Buy Abortion Pills In Bahrain,Cytotec Pills Available In Abu Dhabi, Buy Mifepristone And Misoprostol In Abu Dhabi, Buy cytotec Pills In Abu Dhabi, Buy Abortion pills in Abu Dhabi, Abortion Pills For Sale In Qatar Pharmacy Abortion Pills For Sale In Doha Where to Buy cytotec in Doha Qatar,buy mifepristone and misoprostol in Doha, buy cytotec pills in Doha,Abortion Pills For Sale In Kuwait, buy mifepristone and misoprostol in Kuwait, buy cytotec pills in Kuwait, buy abortion pills in Kuwait, abortion pill in Kuwait, Abortion Pills For Sale In Ras Al Khaimah, buy mifepristone and misoprostol in Ras Al Khaimah, buy cytotec pills in Ras Al Khaimah, buy abortion pills in Ras Al Khaimah … Abortion Pills For Sale In Sharjah, buy mifepristone and misoprostol in Sharjah, buy cytotec pills in Sharjah, buy abortion pills in Sharjah, abortion pill in Sharjah, Abortion Pills For Sale In Dubai Mall, buy mifepristone and misoprostol in Dubai Mall, buy cytotec pills in Dubai Mall, buy abortion pills in Dubai Mall, abortion pill in Dubai … Abortion Pills For Sale In Al Satwa, buy mifepristone and misoprostol in Satwa, buy cytotec pills in Satwa, buy abortion pills in Satwa, abortion pill in Satwa, Abortion Pills For Sale In Ajman, buy mifepristone and misoprostol in Ajman, buy cytotec pills in Ajman, buy abortion pills in Ajman, abortion pill in Ajman, Abortion Pills For Sale In Deira, buy mifepristone and misoprostol in Deira, buy cytotec pills in Deira, buy abortion pills in Deira, abortion pill in Deira, Abortion Pills For Sale In Rak City, buy mifepristone and misoprostol in Rak City, buy cytotec pills in Rak City, buy abortion pills in Rak City, abortion pill in Rak City, Abortion Pills For Sale In Al Ain, buy mifepristone and misoprostol in Al Ain, buy cytotec pills in Al Ain, buy abortion pills in Al Ain, abortion pill in Al Ain,Abortion Pills For Sale In Muscat, buy mifepristone and misoprostol in Muscat, buy cytotec pills in Muscat, buy abortion pills in Muscat, abortion pill in Muscat

1 day, 9 hours

Abortion Pills For Sale In Jeddah,(🟡💖🟢)+971568044699(🟡💖🟢 mifepristone and misoprostol available in Jeddah, Buy Cytotec In Jeddah

by kachachaissue12＠gmail.com

Abortion Pills For Sale In Jeddah,(🟡💖🟢)+971568044699(🟡💖🟢 mifepristone and misoprostol available in Jeddah, Buy Cytotec In Jeddah+971568044699 Abortion Pills In Bahrain, +971568044699 Abortion Pills For Sale In Bahrain, +971568044699 Termination Pills Available In Bahrain, +971568044699 Where Can I Buy Cytotec Pills In Bahrain, +971568044699 Misoprostol Pills Available In Bahrain, +971568044699 Misoprostol Tablets Available In Bahrain, +971568044699 +971568044699 Misoprostol Medicine In Bahrain, +971568044699 Mifepristone Pills In Bahrain, +971568044699 Mifepristone Pills In Bahrain, +971568044699 Mifepristone Tablets In Bahrain, +971568044699 Mifepristone Medicine Available In Bahrain, +971568044699 Where Can I Find Mifepristone Pills In Bahrain, +971568044699 Buy Abortion Pills In Bahrain,Cytotec Pills Available In Abu Dhabi, Buy Mifepristone And Misoprostol In Abu Dhabi, Buy cytotec Pills In Abu Dhabi, Buy Abortion pills in Abu Dhabi, Abortion Pills For Sale In Qatar Pharmacy Abortion Pills For Sale In Doha Where to Buy cytotec in Doha Qatar,buy mifepristone and misoprostol in Doha, buy cytotec pills in Doha,Abortion Pills For Sale In Kuwait, buy mifepristone and misoprostol in Kuwait, buy cytotec pills in Kuwait, buy abortion pills in Kuwait, abortion pill in Kuwait, Abortion Pills For Sale In Ras Al Khaimah, buy mifepristone and misoprostol in Ras Al Khaimah, buy cytotec pills in Ras Al Khaimah, buy abortion pills in Ras Al Khaimah … Abortion Pills For Sale In Sharjah, buy mifepristone and misoprostol in Sharjah, buy cytotec pills in Sharjah, buy abortion pills in Sharjah, abortion pill in Sharjah, Abortion Pills For Sale In Dubai Mall, buy mifepristone and misoprostol in Dubai Mall, buy cytotec pills in Dubai Mall, buy abortion pills in Dubai Mall, abortion pill in Dubai … Abortion Pills For Sale In Al Satwa, buy mifepristone and misoprostol in Satwa, buy cytotec pills in Satwa, buy abortion pills in Satwa, abortion pill in Satwa, Abortion Pills For Sale In Ajman, buy mifepristone and misoprostol in Ajman, buy cytotec pills in Ajman, buy abortion pills in Ajman, abortion pill in Ajman, Abortion Pills For Sale In Deira, buy mifepristone and misoprostol in Deira, buy cytotec pills in Deira, buy abortion pills in Deira, abortion pill in Deira, Abortion Pills For Sale In Rak City, buy mifepristone and misoprostol in Rak City, buy cytotec pills in Rak City, buy abortion pills in Rak City, abortion pill in Rak City, Abortion Pills For Sale In Al Ain, buy mifepristone and misoprostol in Al Ain, buy cytotec pills in Al Ain, buy abortion pills in Al Ain, abortion pill in Al Ain,Abortion Pills For Sale In Muscat, buy mifepristone and misoprostol in Muscat, buy cytotec pills in Muscat, buy abortion pills in Muscat, abortion pill in Muscat

1 day, 9 hours

Abortion Pills For Sale In Kalba,(🟡💖🟢)+971568044699(🟡💖🟢 Khor Fakkan, Umm al-Quwain

by kachachaissue12＠gmail.com

Abortion Pills For Sale In Kalba,(🟡💖🟢)+971568044699(🟡💖🟢 Khor Fakkan, Umm al-Quwain+971568044699 Abortion Pills In Bahrain, +971568044699 Abortion Pills For Sale In Bahrain, +971568044699 Termination Pills Available In Bahrain, +971568044699 Where Can I Buy Cytotec Pills In Bahrain, +971568044699 Misoprostol Pills Available In Bahrain, +971568044699 Misoprostol Tablets Available In Bahrain, +971568044699 +971568044699 Misoprostol Medicine In Bahrain, +971568044699 Mifepristone Pills In Bahrain, +971568044699 Mifepristone Pills In Bahrain, +971568044699 Mifepristone Tablets In Bahrain, +971568044699 Mifepristone Medicine Available In Bahrain, +971568044699 Where Can I Find Mifepristone Pills In Bahrain, +971568044699 Buy Abortion Pills In Bahrain,Cytotec Pills Available In Abu Dhabi, Buy Mifepristone And Misoprostol In Abu Dhabi, Buy cytotec Pills In Abu Dhabi, Buy Abortion pills in Abu Dhabi, Abortion Pills For Sale In Qatar Pharmacy Abortion Pills For Sale In Doha Where to Buy cytotec in Doha Qatar,buy mifepristone and misoprostol in Doha, buy cytotec pills in Doha,Abortion Pills For Sale In Kuwait, buy mifepristone and misoprostol in Kuwait, buy cytotec pills in Kuwait, buy abortion pills in Kuwait, abortion pill in Kuwait, Abortion Pills For Sale In Ras Al Khaimah, buy mifepristone and misoprostol in Ras Al Khaimah, buy cytotec pills in Ras Al Khaimah, buy abortion pills in Ras Al Khaimah … Abortion Pills For Sale In Sharjah, buy mifepristone and misoprostol in Sharjah, buy cytotec pills in Sharjah, buy abortion pills in Sharjah, abortion pill in Sharjah, Abortion Pills For Sale In Dubai Mall, buy mifepristone and misoprostol in Dubai Mall, buy cytotec pills in Dubai Mall, buy abortion pills in Dubai Mall, abortion pill in Dubai … Abortion Pills For Sale In Al Satwa, buy mifepristone and misoprostol in Satwa, buy cytotec pills in Satwa, buy abortion pills in Satwa, abortion pill in Satwa, Abortion Pills For Sale In Ajman, buy mifepristone and misoprostol in Ajman, buy cytotec pills in Ajman, buy abortion pills in Ajman, abortion pill in Ajman, Abortion Pills For Sale In Deira, buy mifepristone and misoprostol in Deira, buy cytotec pills in Deira, buy abortion pills in Deira, abortion pill in Deira, Abortion Pills For Sale In Rak City, buy mifepristone and misoprostol in Rak City, buy cytotec pills in Rak City, buy abortion pills in Rak City, abortion pill in Rak City, Abortion Pills For Sale In Al Ain, buy mifepristone and misoprostol in Al Ain, buy cytotec pills in Al Ain, buy abortion pills in Al Ain, abortion pill in Al Ain,Abortion Pills For Sale In Muscat, buy mifepristone and misoprostol in Muscat, buy cytotec pills in Muscat, buy abortion pills in Muscat, abortion pill in Muscat

1 day, 9 hours

Abortion Pills For Sale In Jebel Ali,(🟡💖🟢)+971568044699(🟡💖🟢 Kalba, Khor Fakkan, Umm al-Quwain

by kachachaissue12＠gmail.com

Abortion Pills For Sale In Jebel Ali,(🟡💖🟢)+971568044699(🟡💖🟢 Kalba, Khor Fakkan, Umm al-Quwain+971568044699 Abortion Pills In Bahrain, +971568044699 Abortion Pills For Sale In Bahrain, +971568044699 Termination Pills Available In Bahrain, +971568044699 Where Can I Buy Cytotec Pills In Bahrain, +971568044699 Misoprostol Pills Available In Bahrain, +971568044699 Misoprostol Tablets Available In Bahrain, +971568044699 +971568044699 Misoprostol Medicine In Bahrain, +971568044699 Mifepristone Pills In Bahrain, +971568044699 Mifepristone Pills In Bahrain, +971568044699 Mifepristone Tablets In Bahrain, +971568044699 Mifepristone Medicine Available In Bahrain, +971568044699 Where Can I Find Mifepristone Pills In Bahrain, +971568044699 Buy Abortion Pills In Bahrain,Cytotec Pills Available In Abu Dhabi, Buy Mifepristone And Misoprostol In Abu Dhabi, Buy cytotec Pills In Abu Dhabi, Buy Abortion pills in Abu Dhabi, Abortion Pills For Sale In Qatar Pharmacy Abortion Pills For Sale In Doha Where to Buy cytotec in Doha Qatar,buy mifepristone and misoprostol in Doha, buy cytotec pills in Doha,Abortion Pills For Sale In Kuwait, buy mifepristone and misoprostol in Kuwait, buy cytotec pills in Kuwait, buy abortion pills in Kuwait, abortion pill in Kuwait, Abortion Pills For Sale In Ras Al Khaimah, buy mifepristone and misoprostol in Ras Al Khaimah, buy cytotec pills in Ras Al Khaimah, buy abortion pills in Ras Al Khaimah … Abortion Pills For Sale In Sharjah, buy mifepristone and misoprostol in Sharjah, buy cytotec pills in Sharjah, buy abortion pills in Sharjah, abortion pill in Sharjah, Abortion Pills For Sale In Dubai Mall, buy mifepristone and misoprostol in Dubai Mall, buy cytotec pills in Dubai Mall, buy abortion pills in Dubai Mall, abortion pill in Dubai … Abortion Pills For Sale In Al Satwa, buy mifepristone and misoprostol in Satwa, buy cytotec pills in Satwa, buy abortion pills in Satwa, abortion pill in Satwa, Abortion Pills For Sale In Ajman, buy mifepristone and misoprostol in Ajman, buy cytotec pills in Ajman, buy abortion pills in Ajman, abortion pill in Ajman, Abortion Pills For Sale In Deira, buy mifepristone and misoprostol in Deira, buy cytotec pills in Deira, buy abortion pills in Deira, abortion pill in Deira, Abortion Pills For Sale In Rak City, buy mifepristone and misoprostol in Rak City, buy cytotec pills in Rak City, buy abortion pills in Rak City, abortion pill in Rak City, Abortion Pills For Sale In Al Ain, buy mifepristone and misoprostol in Al Ain, buy cytotec pills in Al Ain, buy abortion pills in Al Ain, abortion pill in Al Ain,Abortion Pills For Sale In Muscat, buy mifepristone and misoprostol in Muscat, buy cytotec pills in Muscat, buy abortion pills in Muscat, abortion pill in Muscat

1 day, 9 hours

Abortion Pills For Sale In Ruwais(🟡💖🟢)+971568044699(🟡💖🟢, Dhaid, Liwa Oasis, Madinat Zayed, Dibba Al-Fujairah,

by kachachaissue12＠gmail.com

Abortion Pills For Sale In Ruwais(🟡💖🟢)+971568044699(🟡💖🟢, Dhaid, Liwa Oasis, Madinat Zayed, Dibba Al-Fujairah,+971568044699 Abortion Pills In Bahrain, +971568044699 Abortion Pills For Sale In Bahrain, +971568044699 Termination Pills Available In Bahrain, +971568044699 Where Can I Buy Cytotec Pills In Bahrain, +971568044699 Misoprostol Pills Available In Bahrain, +971568044699 Misoprostol Tablets Available In Bahrain, +971568044699 +971568044699 Misoprostol Medicine In Bahrain, +971568044699 Mifepristone Pills In Bahrain, +971568044699 Mifepristone Pills In Bahrain, +971568044699 Mifepristone Tablets In Bahrain, +971568044699 Mifepristone Medicine Available In Bahrain, +971568044699 Where Can I Find Mifepristone Pills In Bahrain, +971568044699 Buy Abortion Pills In Bahrain,Cytotec Pills Available In Abu Dhabi, Buy Mifepristone And Misoprostol In Abu Dhabi, Buy cytotec Pills In Abu Dhabi, Buy Abortion pills in Abu Dhabi, Abortion Pills For Sale In Qatar Pharmacy Abortion Pills For Sale In Doha Where to Buy cytotec in Doha Qatar,buy mifepristone and misoprostol in Doha, buy cytotec pills in Doha,Abortion Pills For Sale In Kuwait, buy mifepristone and misoprostol in Kuwait, buy cytotec pills in Kuwait, buy abortion pills in Kuwait, abortion pill in Kuwait, Abortion Pills For Sale In Ras Al Khaimah, buy mifepristone and misoprostol in Ras Al Khaimah, buy cytotec pills in Ras Al Khaimah, buy abortion pills in Ras Al Khaimah … Abortion Pills For Sale In Sharjah, buy mifepristone and misoprostol in Sharjah, buy cytotec pills in Sharjah, buy abortion pills in Sharjah, abortion pill in Sharjah, Abortion Pills For Sale In Dubai Mall, buy mifepristone and misoprostol in Dubai Mall, buy cytotec pills in Dubai Mall, buy abortion pills in Dubai Mall, abortion pill in Dubai … Abortion Pills For Sale In Al Satwa, buy mifepristone and misoprostol in Satwa, buy cytotec pills in Satwa, buy abortion pills in Satwa, abortion pill in Satwa, Abortion Pills For Sale In Ajman, buy mifepristone and misoprostol in Ajman, buy cytotec pills in Ajman, buy abortion pills in Ajman, abortion pill in Ajman, Abortion Pills For Sale In Deira, buy mifepristone and misoprostol in Deira, buy cytotec pills in Deira, buy abortion pills in Deira, abortion pill in Deira, Abortion Pills For Sale In Rak City, buy mifepristone and misoprostol in Rak City, buy cytotec pills in Rak City, buy abortion pills in Rak City, abortion pill in Rak City, Abortion Pills For Sale In Al Ain, buy mifepristone and misoprostol in Al Ain, buy cytotec pills in Al Ain, buy abortion pills in Al Ain, abortion pill in Al Ain,Abortion Pills For Sale In Muscat, buy mifepristone and misoprostol in Muscat, buy cytotec pills in Muscat, buy abortion pills in Muscat, abortion pill in Muscat

1 day, 9 hours

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

Linaro-mm-sig