)]}'
{
  "commit": "7c7d5e9d7e3942ba5aec9847f61a6e76d7773191",
  "tree": "9ee39b8e1c9e91cd37d5e84778cd1cb1fe19ca71",
  "parents": [
    "ceac0de741bfb47ca255eee075257b3bb31f0651",
    "96f01b53c2d05e003b040892256de54a586e8529"
  ],
  "author": {
    "name": "Jakub Kicinski",
    "email": "kuba@kernel.org",
    "time": "Wed Sep 16 15:54:18 2026 -0700"
  },
  "committer": {
    "name": "Jakub Kicinski",
    "email": "kuba@kernel.org",
    "time": "Wed Sep 16 15:54:19 2026 -0700"
  },
  "message": "Merge tag \u0027ipsec-2026-09-16\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec\n\nSteffen Klassert says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\npull request (net): ipsec 2026-09-16\n\n1) xfrm: iptfs: fix stack OOB read in iptfs_skb_reset_frag_walk()\n   Add the up-front nr_frags guard iptfs_skb_add_frags() already has,\n   so an out-of-range offset can\u0027t walk past the on-stack frags[] array.\n\n2) xfrm: serialize state GC with device state flush\n   Serialize xfrm_state destruction against the deferred-device pass\n   with a dedicated mutex, since the device GC list doesn\u0027t hold a state\n   reference and the two paths could free the same state.\n\n3) xfrm: add missing RCU read lock in xfrm_send_migrate_state()\n   Hold the RCU read lock around xfrm_nlmsg_multicast() so the\n   rcu_dereference() of net-\u003exfrm.nlsk doesn\u0027t warn.\n\n4) xfrm: iptfs: fix runt reassembly panic from short inner tot_len\n   Require the runt length to cover at least the minimum IP header,\n   so a tot_len in [6, 19] (IPv4) can\u0027t write past the declared length\n   and trip skb_over_panic().\n\n5) ipv6: xfrm: use full sockets in local error paths\n   Use skb_to_full_sk() in xfrm6_local_rxpmtu() and xfrm6_local_error()\n   and bail out without a full socket, so a TCP_NEW_SYN_RECV request_sock\n   isn\u0027t miscast as a full inet/IPv6 socket.\n\n6) xfrm: fix compat ALLOCSPI request use-after-free\n   Drop the redundant alloc_compat() in xfrm_alloc_userspi() so the\n   compat translator no longer reads past the payload and publishes a\n   child a multicast clone can still see after xfrm_user_rcv_msg() frees.\n\n7) xfrm: add missing rcu_read_lock(), skb_dst_force() and dev_hold() for xfrm_trans_reinject()\n   Force the dst before queuing, hold dev across the workqueue deferral,\n   and take rcu_read_lock() around the finish() loop, so transport-mode\n   reinjection doesn\u0027t deref non-refcounted dst/dev under workqueue.\n\n8) xfrm: use hlist_del_init_rcu for state_cache and state_cache_input\n   Switch to hlist_del_init_rcu() so a second __xfrm_state_delete() is\n   a no-op instead of writing through LIST_POISON2, closing the UAFs.\n\n9) esp: downgrade zerocopy managed frags before mutating skb frags\n   Call skb_zcopy_downgrade_managed() before ESP rewrites the skb frag\n   array, so per-frag unrefs in esp_ssg_unref() and skb_release_data()\n   stay balanced for ubuf-owned managed frags.\n\n10) xfrm: hold net_device reference under RCU in bundle creation\n    Read dst-\u003edev via dst_dev_rcu() and keep RCU active through\n    xfrm_fill_dst(), so a concurrent RTM_DELLINK can\u0027t free dev\n    under bundle creation.\n\n11) xfrm: save input state data before secpath resets\n    Save the state protocol on the stack while it\u0027s still valid and\n    use the saved address family for transport_finish(), so post-reset\n    dereferences (VTI, XFRM if, MAX_DEPTH error) can\u0027t UAF the state.\n\n12) net: xfrm: reject unrepresentable espintcp transport headers\n    Use the careful transport-header helper and drop the skb through\n    the XFRM error path when the offset can\u0027t be represented, instead\n    of silently truncating it.\n\n* tag \u0027ipsec-2026-09-16\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec:\n  net: xfrm: reject unrepresentable espintcp transport headers\n  xfrm: save input state data before secpath resets\n  xfrm: hold net_device reference under RCU in bundle creation\n  esp: downgrade zerocopy managed frags before mutating skb frags\n  xfrm: use hlist_del_init_rcu for state_cache and state_cache_input\n  xfrm: add missing rcu_read_lock(), skb_dst_force() and dev_hold() for xfrm_trans_reinject()\n  xfrm: fix compat ALLOCSPI request use-after-free\n  ipv6: xfrm: use full sockets in local error paths\n  xfrm: iptfs: fix runt reassembly panic from short inner tot_len\n  xfrm: add missing RCU read lock in xfrm_send_migrate_state()\n  xfrm: serialize state GC with device state flush\n  xfrm: iptfs: fix stack OOB read in iptfs_skb_reset_frag_walk()\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260916101938.118628-1-steffen.klassert@secunet.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n",
  "tree_diff": []
}