)]}'
{
  "commit": "f0cf5a24cefeb629876bd15d668ff062c8655e28",
  "tree": "e4e7b2aadbb59cf95025a75c6a14d8fe3ed3605e",
  "parents": [
    "fb1baa000d7a0b597ab9eb29b179b03e70e5f6ee"
  ],
  "author": {
    "name": "Binbin Deng",
    "email": "18983559317@163.com",
    "time": "Mon Oct 19 19:16:11 2026 +0800"
  },
  "committer": {
    "name": "Luiz Augusto von Dentz",
    "email": "luiz.von.dentz@intel.com",
    "time": "Mon Nov 02 17:09:00 2026 -0500"
  },
  "message": "Bluetooth: hci_core: Initialize IRK before publication\n\nhci_add_irk() initializes the identity address and address type of a newly\nallocated IRK, publishes it on hdev-\u003eidentity_resolving_keys, and only then\ninitializes its value and RPA.  RCU readers such as hci_find_irk_by_rpa()\nand the debugfs identity_resolving_keys_show() can traverse the new entry\nduring that window and see a zero or partially initialized IRK.\n\nThe race is reachable by racing an IRK addition with another CPU resolving\nor dumping IRKs.  In particular, userspace can issue MGMT_OP_LOAD_IRKS\nwhile another process reads the corresponding debugfs file or triggers RPA\nresolution.\n\nInitialize the IRK value and RPA before publishing a newly allocated IRK.\nExisting IRKs remain published and continue to be updated in place.\n\nFound during a static-analysis-assisted audit: candidate sites were\nsurfaced by a Coccinelle rule, and the reader/writer paths were\nconfirmed by LLM-assisted (GLM-5.3) code inspection.  The issue was\nnot observed at runtime; it is identified by code inspection only.\n\nFixes: adae20cb2d20 (\"Bluetooth: Convert IRK list to RCU\")\nAssisted-by: GLM-5.3 coccinelle\nSigned-off-by: Binbin Deng \u003c18983559317@163.com\u003e\nSigned-off-by: Luiz Augusto von Dentz \u003cluiz.von.dentz@intel.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "209244fd93918e5a57d6bed0510cc3dded386f2c",
      "old_mode": 33188,
      "old_path": "net/bluetooth/hci_core.c",
      "new_id": "65373e4aea948b13d9e13af1e9dc6c67d4a62876",
      "new_mode": 33188,
      "new_path": "net/bluetooth/hci_core.c"
    }
  ]
}