)]}'
{
  "commit": "26aad08a928901296aabfbc7a33ecb951656bb98",
  "tree": "594f0c022bba117c9af59d6d44858bfd1b4b2480",
  "parents": [
    "c381039ade2e161ab08c0eda73c4f8b9a7115928"
  ],
  "author": {
    "name": "Alessandro Schino",
    "email": "7991aleschino@gmail.com",
    "time": "Fri Jun 05 14:22:15 2026 +0200"
  },
  "committer": {
    "name": "Steffen Klassert",
    "email": "steffen.klassert@secunet.com",
    "time": "Tue Jun 09 15:58:17 2026 +0200"
  },
  "message": "esp: fix page frag reference leak on skb_to_sgvec failure\n\nIn esp_output_tail(), when esp-\u003einplace is false, the old skb page frags\nare replaced with a new page from the xfrm page_frag cache The source\nscatterlist (sg) is built from the old frags before the replacement, and\nesp_ssg_unref() is responsible for releasing the old page references\nafter the crypto operation completes\n\nHowever, if the second skb_to_sgvec() call (which builds the destination\nscatterlist from the new page) fails, the code jumps to error_free which\nonly calls kfree(tmp). The old page frag references captured in the\nsource scatterlist are never released:\n\n  1 sg[] is built from old frags via skb_to_sgvec() (no extra get_page)\n  2 nr_frags is set to 1 and frag[0] is replaced with the new page\n  3 Second skb_to_sgvec() fails -\u003e goto error_free\n\nFix this by adding a bool parameter to esp_ssg_unref() that, when true,\nunconditionally unrefs the source scatterlist frags. Since req-\u003esrc is\nnot yet initialized by aead_request_set_crypt() at the point of the\nerror, the source scatterlist is obtained directly via esp_req_sg()\nExisting callers pass false to preserve the original behavior\n\nThe same issue exists in both esp4 and esp6 as the code is identical\n\nFixes: cac2661c53f3 (\"esp4: Avoid skb_cow_data whenever possible\")\nFixes: 03e2a30f6a27 (\"esp6: Avoid skb_cow_data whenever possible\")\nSigned-off-by: Alessandro Schino \u003c7991aleschino@gmail.com\u003e\nSigned-off-by: Steffen Klassert \u003csteffen.klassert@secunet.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "513c8215c947f109a5a6850feb317b6d988fe445",
      "old_mode": 33188,
      "old_path": "net/ipv4/esp4.c",
      "new_id": "dfc81ee969ae03337fbe9f89a976d3d0ace224f4",
      "new_mode": 33188,
      "new_path": "net/ipv4/esp4.c"
    },
    {
      "type": "modify",
      "old_id": "57481e423e59e6c88a3c972d1d9bfd3bf02b08b6",
      "old_mode": 33188,
      "old_path": "net/ipv6/esp6.c",
      "new_id": "296b57926abb985a5761d1f90e678f2956df5ea9",
      "new_mode": 33188,
      "new_path": "net/ipv6/esp6.c"
    }
  ]
}