)]}'
{
  "commit": "8451f282fc102ba234f209202eae2ba9032dad80",
  "tree": "0c61bebe32a1ce8eb6b386ac6d3cda59c12a637f",
  "parents": [
    "8b2050eb20370c7403d76b4c13f9da0f987527b6"
  ],
  "author": {
    "name": "Tristan Madani",
    "email": "tristan@talencesecurity.com",
    "time": "Fri Oct 30 14:52:29 2026 +0000"
  },
  "committer": {
    "name": "Steffen Klassert",
    "email": "steffen.klassert@secunet.com",
    "time": "Mon Nov 09 08:30:06 2026 +0100"
  },
  "message": "xfrm: check state validity under lock in xfrm_state_find()\n\nThe output-cache insertion path in xfrm_state_find() checks\nx-\u003ekm.state \u003d\u003d XFRM_STATE_VALID before acquiring xfrm_state_lock,\nthen inserts the state into pol-\u003estate_cache_list under the lock.\n\nWhile this insertion block is currently unreachable -- cached is set\nunconditionally at the cached: label, making the !cached guard\nalways false -- the correct pattern is to perform the validity\ncheck under the lock, matching the fix in commit ddd3d01329203\n(\"xfrm: Fix xfrm state cache insertion race\") which addressed the\nsame TOCTOU for the input cache path.\n\nMove the XFRM_STATE_VALID check inside the critical section so the\npattern is correct when the cache insertion becomes reachable.\n\nSigned-off-by: Tristan Madani \u003ctristan@talencesecurity.com\u003e\nSigned-off-by: Steffen Klassert \u003csteffen.klassert@secunet.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "e45aa1ed5b96591a6e974a74fa2d0eea610a2679",
      "old_mode": 33188,
      "old_path": "net/xfrm/xfrm_state.c",
      "new_id": "03baa50f0df7c53b9af08e47a6078add280d48af",
      "new_mode": 33188,
      "new_path": "net/xfrm/xfrm_state.c"
    }
  ]
}