)]}'
{
  "commit": "0d2da2561bdeb459b6c540c2417a15c1f8732e6a",
  "tree": "ace92e44f378939e3cdcb75911e7de708a129d2e",
  "parents": [
    "28032ef879b6ab073bb8c85f2044edaf6b80c929"
  ],
  "author": {
    "name": "Al Viro",
    "email": "viro@zeniv.linux.org.uk",
    "time": "Fri Feb 14 23:37:58 2025 -0500"
  },
  "committer": {
    "name": "Al Viro",
    "email": "viro@zeniv.linux.org.uk",
    "time": "Tue Jun 17 17:58:14 2025 -0400"
  },
  "message": "ceph: fix a race with rename() in ceph_mdsc_build_path()\n\nLift copying the name into callers of ceph_encode_encrypted_dname()\nthat do not have it already copied; ceph_encode_encrypted_fname()\ndisappears.\n\nThat fixes a UAF in ceph_mdsc_build_path() - while the initial copy\nof plaintext into buf is done under -\u003ed_lock, we access the\noriginal name again in ceph_encode_encrypted_fname() and that is\ndone without any locking.  With ceph_encode_encrypted_dname() using\nthe stable copy the problem goes away.\n\nTested-by: Viacheslav Dubeyko \u003cSlava.Dubeyko@ibm.com\u003e\nReviewed-by: Viacheslav Dubeyko \u003cSlava.Dubeyko@ibm.com\u003e\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "a8d8b56cf9d2113cfaeec9ae681cc486b68d1afa",
      "old_mode": 33188,
      "old_path": "fs/ceph/caps.c",
      "new_id": "b1a8ff612c41dc30e39db79190bba1d6448417bf",
      "new_mode": 33188,
      "new_path": "fs/ceph/caps.c"
    },
    {
      "type": "modify",
      "old_id": "2aef56fc6275434c23dfef7237a64bebfe4fae74",
      "old_mode": 33188,
      "old_path": "fs/ceph/crypto.c",
      "new_id": "e312f52f48e4591daad215f9cd160447833f5b69",
      "new_mode": 33188,
      "new_path": "fs/ceph/crypto.c"
    },
    {
      "type": "modify",
      "old_id": "d0768239a1c9c96bc0b992b6160f334e19a47f89",
      "old_mode": 33188,
      "old_path": "fs/ceph/crypto.h",
      "new_id": "f752bbb2eb06cc2d53fa7182321ddbf65468ce57",
      "new_mode": 33188,
      "new_path": "fs/ceph/crypto.h"
    },
    {
      "type": "modify",
      "old_id": "a321aa6d0ed22680fbfd1c2939c7da47e8607d26",
      "old_mode": 33188,
      "old_path": "fs/ceph/dir.c",
      "new_id": "8478e7e75df66c19787ff74e5ecda915622618e0",
      "new_mode": 33188,
      "new_path": "fs/ceph/dir.c"
    },
    {
      "type": "modify",
      "old_id": "230e0c3f341f7119db7a189a5a378772cc4250cd",
      "old_mode": 33188,
      "old_path": "fs/ceph/mds_client.c",
      "new_id": "0f497c39ff8246d755e01ef5df4b6db0af8f8352",
      "new_mode": 33188,
      "new_path": "fs/ceph/mds_client.c"
    }
  ]
}