)]}'
{
  "commit": "a46232c697c809aaa2b0ad18157b49d66201fd7f",
  "tree": "f37f62130f69463d906affdb6b14bdf3eeab3507",
  "parents": [
    "da94223774ea012188ef76f89e0bd642b39ba517"
  ],
  "author": {
    "name": "Antony Antony",
    "email": "antony.antony@secunet.com",
    "time": "Wed Oct 07 11:35:48 2026 +0200"
  },
  "committer": {
    "name": "Steffen Klassert",
    "email": "steffen.klassert@secunet.com",
    "time": "Mon Oct 19 08:02:07 2026 +0200"
  },
  "message": "xfrm: include mark in MIGRATE_STATE SA collision check\n\nThe SA lookup tuple is (daddr, spi, proto, family, mark), but the\nEEXIST pre-check and the xfrm_state_insert() vs xfrm_state_add()\ndecision only considered daddr and family, ignoring mark.\nA migration that only changes the mark inserts a duplicate SA tuple\ninto the hash tables.\n\nThe collision check is implemented as xfrm_state_mark_collides(),\nwhich walks the SPI hash bucket for the target tuple and excludes the\nstate being migrated by pointer, rather than doing a separate\nexact-match lookup followed by a wildcard lookup and comparing the\nresult against self.\n\nBefore:\nroot@west:~# ip xfrm state add src 10.1.1.1 dst 10.1.1.2 proto esp \\\n        spi 0x1000  reqid 100 mode tunnel aead \"rfc4106(gcm(aes))\" \\\n        0x1111111111111111111111111111111111111111 96 \\\n        mark 0x1 mask 0xff\n\nroot@west:~# ip xfrm state add src 10.1.1.1 dst 10.1.1.2 proto esp \\\n        spi 0x1000  reqid 100 mode tunnel aead \"rfc4106(gcm(aes))\" \\\n        0x1111111111111111111111111111111111111111 96 \\\n        mark 0x2 mask 0xff\nroot@west:~# ip xfrm state migrate dst 10.1.1.2 proto esp spi 0x1000 \\\n        mark 0x1 mask 0xff \\\n        new-dst 10.1.1.2 new-src 10.1.1.1 new-reqid 100 \\\n        new-mark 0x2 mask 0xff\nip x s\nsrc 10.1.1.1 dst 10.1.1.2\n    proto esp spi 0x00001000 reqid 100 mode tunnel\n    replay-window 0\n    mark 0x2/0xff\n    aead rfc4106(gcm(aes)) 0x1111111111111111111111111111111111111111 96\n    anti-replay context: seq 0x0, oseq 0x0, bitmap 0x00000000\nsrc 10.1.1.1 dst 10.1.1.2\n    proto esp spi 0x00001000 reqid 100 mode tunnel\n    replay-window 0\n    mark 0x2/0xff\n    aead rfc4106(gcm(aes)) 0x1111111111111111111111111111111111111111 96\n    anti-replay context: seq 0x0, oseq 0x0, bitmap 0x00000000\n    sel src 0.0.0.0/0 dst 0.0.0.0/0\n\nNotice two states with same mark 0x2/0xff.\nAfter:\n\nError: New SA tuple already occupied.\n\nFixes: a9d155ea9b44 (\"xfrm: add XFRM_MSG_MIGRATE_STATE for single SA migration\")\nReported-by: Sashiko \u003csashiko-bot@kernel.org\u003e\nSigned-off-by: Antony Antony \u003cantony.antony@secunet.com\u003e\nSigned-off-by: Steffen Klassert \u003csteffen.klassert@secunet.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "9e053388aa4b2985e965be9d84ec1c4b28dfbba8",
      "old_mode": 33188,
      "old_path": "include/net/xfrm.h",
      "new_id": "26dd4b570588d72a1f414a6cfd5cf24d8598fc47",
      "new_mode": 33188,
      "new_path": "include/net/xfrm.h"
    },
    {
      "type": "modify",
      "old_id": "f1e04df8d50116dfd7764346dc404699c4f85b0b",
      "old_mode": 33188,
      "old_path": "net/xfrm/xfrm_state.c",
      "new_id": "65663c7ba836af40ea3b8c9c77dd7bdeddf3e0ed",
      "new_mode": 33188,
      "new_path": "net/xfrm/xfrm_state.c"
    },
    {
      "type": "modify",
      "old_id": "4de8c401eb442d51e47e0a07968cfd2bfb2937d7",
      "old_mode": 33188,
      "old_path": "net/xfrm/xfrm_user.c",
      "new_id": "a5fbe38839c492656fb2d582dc8b6c5a8978c17d",
      "new_mode": 33188,
      "new_path": "net/xfrm/xfrm_user.c"
    }
  ]
}