)]}'
{
  "commit": "c381039ade2e161ab08c0eda73c4f8b9a7115928",
  "tree": "b3979f2380a875393a61ed0fcc3cbadfd08bdbd3",
  "parents": [
    "c8a8a75b733467b00c08b91a38dbaf207a08ed6e"
  ],
  "author": {
    "name": "Wyatt Feng",
    "email": "bronzed_45_vested@icloud.com",
    "time": "Wed Jun 03 00:46:27 2026 +0800"
  },
  "committer": {
    "name": "Steffen Klassert",
    "email": "steffen.klassert@secunet.com",
    "time": "Fri Jun 05 13:20:03 2026 +0200"
  },
  "message": "xfrm: espintcp: do not reuse an in-progress partial send\n\nespintcp keeps a single in-flight transmit in ctx-\u003epartial.\nBefore building a new sk_msg, espintcp_sendmsg() first tries to flush\nthat state through espintcp_push_msgs().\n\nFor blocking callers, espintcp_push_msgs() may return success even when\nthe previous partial send is still pending. espintcp_sendmsg() would\nthen reinitialize emsg-\u003eskmsg and reuse ctx-\u003epartial while the old\ntransfer still owns that state.\n\nDo not rebuild the send message when ctx-\u003epartial is still in progress.\nIf espintcp_push_msgs() returns with emsg-\u003elen still set, fail the new\nsend instead of overwriting the live partial state.\n\nThis is a memory-safety fix: reusing the live partial-send state can\nleave a stale offset attached to a new sk_msg and lead to an out-of-\nbounds read in the send path.\n\ntcp_sendmsg_locked() already handles waiting for send buffer memory, so\nthe fix here is just to preserve espintcp\u0027s one-message-at-a-time\ntransmit state.\n\nFixes: e27cca96cd68 (\"xfrm: add espintcp (RFC 8229)\")\nCc: stable@kernel.org\nReported-by: Yuan Tan \u003cyuantan098@gmail.com\u003e\nReported-by: Yifan Wu \u003cyifanwucs@gmail.com\u003e\nReported-by: Juefei Pu \u003ctomapufckgml@gmail.com\u003e\nReported-by: Zhengchuan Liang \u003czcliangcn@gmail.com\u003e\nReported-by: Xin Liu \u003cbird@lzu.edu.cn\u003e\nAssisted-by: Codex:GPT-5.4\nSigned-off-by: Wyatt Feng \u003cbronzed_45_vested@icloud.com\u003e\nSigned-off-by: Ren Wei \u003cn05ec@lzu.edu.cn\u003e\nSigned-off-by: Steffen Klassert \u003csteffen.klassert@secunet.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "a2756186e13a296a18adf3a10397ce58a1557e9a",
      "old_mode": 33188,
      "old_path": "net/xfrm/espintcp.c",
      "new_id": "d9035546375eba5314d64ea33af8660c77523ed1",
      "new_mode": 33188,
      "new_path": "net/xfrm/espintcp.c"
    }
  ]
}