)]}'
{
  "commit": "26cc0e69cce062cd3aa6fae33074684669c35a71",
  "tree": "b3f83760ecd653ecac8511928c3da0d5ae809c40",
  "parents": [
    "0b2bbfee2bcb80017d4d47e94f8dc92151dcdd6f"
  ],
  "author": {
    "name": "Hui Peng",
    "email": "benquike@gmail.com",
    "time": "Mon Sep 21 05:10:01 2026 +0000"
  },
  "committer": {
    "name": "Jakub Kicinski",
    "email": "kuba@kernel.org",
    "time": "Thu Sep 24 09:11:56 2026 -0700"
  },
  "message": "mctp: route: iterate socket tag list in mctp_lookup_prealloc_tag()\n\nWhen a socket transmits a packet with MCTP_TAG_PREALLOC set,\nmctp_lookup_prealloc_tag() iterates over the per-netns \u0026mns-\u003ekeys list\nand matches netid, req_tag, peer_addr, and manual_alloc, without\nchecking whether tmp-\u003esk \u003d\u003d \u0026msk-\u003esk. This allows any MCTP socket in the\nsame network namespace to use and consume another socket\u0027s preallocated\ntag.\n\nIterate the socket\u0027s own tag list (\u0026msk-\u003ekeys via sklist) instead of the\nnamespace-wide \u0026mns-\u003ekeys list in mctp_lookup_prealloc_tag(), ensuring\nthat only tags allocated by msk are matched.\n\nTested in QEMU against Linux 7.3.0-rc3 by allocating a manual tag\n(0x18) on socket A via SIOCMCTPALLOCTAG for peer EID 9 and sending a\n4-byte message with MCTP_TAG_PREALLOC from socket B in the same network\nnamespace. On the unfixed kernel, sendto(sock_b) using socket A\u0027s\npreallocated tag succeeds (ret \u003d 4); with this patch applied,\nsendto(sock_b) fails with -ENOENT (errno \u003d 2) while sendto(sock_a)\nsucceeds (ret \u003d 4).\n\nFixes: 63ed1aab3d40 (\"mctp: Add SIOCMCTP{ALLOC,DROP}TAG ioctls for tag control\")\nSuggested-by: Jeremy Kerr \u003cjk@codeconstruct.com.au\u003e\nCc: stable@vger.kernel.org\nSigned-off-by: Hui Peng \u003cbenquike@gmail.com\u003e\nLink: https://patch.msgid.link/20260921051002.1656692-1-benquike@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "b19c63a5691a87f7550717f4e8864d47c1bb67cb",
      "old_mode": 33188,
      "old_path": "net/mctp/route.c",
      "new_id": "e7c95eeacb486f93e3ab674f57cc28db04dcae15",
      "new_mode": 33188,
      "new_path": "net/mctp/route.c"
    }
  ]
}