Re: [PATCH 01/10] xfrm6: fix out-of-bounds write in xfrm6_input_addr() when secpath is full

Hello:

This series was applied to netdev/net.git (main)
by Steffen Klassert <[email protected]>:

On Tue, 18 Aug 2026 11:28:32 +0200 you wrote:
> From: Xiang Mei <[email protected]>
> 
> The depth check in xfrm6_input_addr() is off by one:
> 
>   if (1 + sp->len == XFRM_MAX_DEPTH)
>           goto drop;
>   ...
>   sp->xvec[sp->len++] = x;
> 
> [...]

Here is the summary with links:
  - [01/10] xfrm6: fix out-of-bounds write in xfrm6_input_addr() when secpath is full
    https://git.kernel.org/netdev/net/c/5d9e3bf34fec
  - [02/10] esp: do not unref managed frag pages in esp_ssg_unref()
    https://git.kernel.org/netdev/net/c/21697720ff43
  - [03/10] xfrm: espintcp: fix UAF during close
    https://git.kernel.org/netdev/net/c/deb232e88487
  - [04/10] xfrm: drop ESP-in-TCP packets with no ingress device
    https://git.kernel.org/netdev/net/c/e1d7c5ac1c24
  - [05/10] xfrm: avoid lock inversion in nat keepalive work
    https://git.kernel.org/netdev/net/c/763fe700b7c5
  - [06/10] xfrm: Fix skb double-free in xfrm_dev_direct_output()
    https://git.kernel.org/netdev/net/c/2aed51fc58d9
  - [07/10] xfrm: ah6: validate routing header segments_left
    https://git.kernel.org/netdev/net/c/7bad4bda74dc
  - [08/10] xfrm: fix xfrm_state_construct() auth-trunc leak
    https://git.kernel.org/netdev/net/c/c12cbf56320f
  - [09/10] Revert "esp: do not unref managed frag pages in esp_ssg_unref()"
    https://git.kernel.org/netdev/net/c/0fda52de8bbd
  - [10/10] xfrm: bound nat keepalive state collection
    https://git.kernel.org/netdev/net/c/4e9442ce551e

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html