)]}'
{
  "commit": "ae9c8df1ffb84560ac01cbdc26cfb19027f4d25f",
  "tree": "263105a11f49348faac23d5a43e13de7fef14c37",
  "parents": [
    "f0cf5a24cefeb629876bd15d668ff062c8655e28"
  ],
  "author": {
    "name": "Binbin Deng",
    "email": "18983559317@163.com",
    "time": "Mon Oct 19 16:17:11 2026 +0800"
  },
  "committer": {
    "name": "Luiz Augusto von Dentz",
    "email": "luiz.von.dentz@intel.com",
    "time": "Mon Nov 02 17:09:00 2026 -0500"
  },
  "message": "Bluetooth: hci_core: Initialize link key before publication\n\nhci_add_link_key() allocates a new link key with kzalloc(), inserts it into\nhdev-\u003elink_keys with list_add_rcu(), and only then initializes its address,\nvalue, type, and PIN length.  RCU readers such as hci_find_link_key()\nand the debugfs link_keys_show() do not take hci_dev_lock, so they can\ntraverse the new entry during that initialization window and observe\na zero or partially initialized key.\n\nThis can be triggered by racing a link-key update with another CPU looking\nup or dumping keys.  In particular, userspace can issue\nMGMT_OP_LOAD_LINK_KEYS while another process reads the corresponding\ndebugfs file.\n\nComplete all fields of a newly allocated key before publishing it with\nlist_add_rcu().  Existing keys remain visible and keep their current\nin-place update behavior.\n\nFound during a static-analysis-assisted audit: candidate sites were\nsurfaced by a Coccinelle rule, and the reader/writer paths were\nconfirmed by LLM-assisted (GLM-5.3) code inspection.  The issue was\nnot observed at runtime; it is identified by code inspection only.\n\nFixes: 0378b5977013 (\"Bluetooth: Convert link keys list to use RCU\")\nSigned-off-by: Binbin Deng \u003c18983559317@163.com\u003e\nSigned-off-by: Luiz Augusto von Dentz \u003cluiz.von.dentz@intel.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "65373e4aea948b13d9e13af1e9dc6c67d4a62876",
      "old_mode": 33188,
      "old_path": "net/bluetooth/hci_core.c",
      "new_id": "ec5ef5811df954761607e0d7d41c9bd47e71fd5d",
      "new_mode": 33188,
      "new_path": "net/bluetooth/hci_core.c"
    }
  ]
}