)]}'
{
  "commit": "902407bc588575af0ceae5de4f635fe1e024f258",
  "tree": "2c0b6b7de249b9b3dfb2362ef274b0a78f599e32",
  "parents": [
    "10f51f4fb99de99c64b9d35707f05fa0308f25ff"
  ],
  "author": {
    "name": "Joas Antonio dos Santos",
    "email": "joasantonio108@gmail.com",
    "time": "Tue Oct 27 18:17:06 2026 -0300"
  },
  "committer": {
    "name": "Dave Miller",
    "email": "davem@davem-thinkpadp1gen8.ibmlond.csb",
    "time": "Mon Nov 02 09:20:26 2026 +0000"
  },
  "message": "net/mlx5: macsec: free struct mlx5_fs_id after an RCU grace period\n\nmacsec_fs_id_del() removes a struct mlx5_fs_id from its rhashtable with\nrhashtable_remove_fast() and then frees it with kfree() right away.\n\nThe TX (SCI) table is read locklessly from the transmit path:\nmlx5e_macsec_handle_tx_skb() and mlx5e_macsec_tx_build_eseg() call\nmlx5_macsec_fs_get_fs_id_from_hashtable(), which does\nrhashtable_lookup() under rcu_read_lock() and then reads\nmlx5_fs_id-\u003eid. A transmit that looked the entry up just before it was\nremoved reads freed memory.\n\nBefore commit d4ece08f4b1d (\"net/mlx5: Maintain fs_id xarray per MACsec\ndevice inside macsec steering\") the SCI table held struct\nmlx5e_macsec_sa directly, and mlx5e_macsec_del_txsa() freed it with\nkfree_rcu_mightsleep(). That commit moved the table into macsec_fs.c\nwith the new struct mlx5_fs_id, but frees it with a plain kfree().\n\nAdd an rcu_head to struct mlx5_fs_id and free it with kfree_rcu().\n\nThe same issue was flagged by the Sashiko AI review as a pre-existing\nproblem while reviewing the HW-GRO for PSP series.\n\nFixes: d4ece08f4b1d (\"net/mlx5: Maintain fs_id xarray per MACsec device inside macsec steering\")\nLink: https://lore.kernel.org/all/20260909065542.4B80D1F00ACA@smtp.kernel.org/\nSigned-off-by: Joas Antonio dos Santos \u003cjoasantonio108@gmail.com\u003e\nAssisted-by: Yaga Agent HackerSec Claude:claude-opus-5-5\nReviewed-by: Simon Horman \u003chorms@kernel.org\u003e\nSigned-off-by: Dave Miller \u003cdavem@davem-thinkpadp1gen8.ibmlond.csb\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "efc5167493c1252b31fa85923ea79d53266e4103",
      "old_mode": 33188,
      "old_path": "drivers/net/ethernet/mellanox/mlx5/core/lib/macsec_fs.c",
      "new_id": "7d785c937d43ddbb4da237357c9c11b66e2dce7b",
      "new_mode": 33188,
      "new_path": "drivers/net/ethernet/mellanox/mlx5/core/lib/macsec_fs.c"
    }
  ]
}