From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E0B94396572; Fri, 4 Sep 2026 06:10:02 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788502204; cv=none; b=RVBZj0TxhLefRYdttcR0uwaqwRp5ZlTnmdNgr3u9Not3OTJo7wUdvkxDzqR5HILxtvxz0A80lUzJSG1kWLjoxXCMeYOK7XFEA5MVp+uSDHzHUEUMh8rwEfUqM1OxVMOH81XaJXQZlxtk7H4CP9OMZCfiHhDsFxw99Spxqo7xkR8= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788502204; c=relaxed/simple; bh=FhIOJcZr+OJ7PmtMj33sFAMiSrVWOqUsNY0hgO/eZ5E=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=bwQcDOW70l560oWfbTlI+fwblZtRaxbKQPFzEzLfP0CLY5hn7fuE+2/8LXujz4UJCq+gtdNA5qkuE6rPohtkl90ZtyxzofP2iIeOiw5XnOPQmmY0PQEpRmUKOkJZQ+lzzvQ2t9HSkMJFagKFCD9EFGNpZoaTY1do/aXC1ZxRB3M= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=Fd0Zp3Z0; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="Fd0Zp3Z0" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 6AE591F00A3D; Fri, 4 Sep 2026 06:10:02 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1788502202; bh=re+mAooBAyIs/o9fkYivkoK0d4OKL6snlGPtXr585Qk=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=Fd0Zp3Z0jUblQR4mbqztX99t0LsnMgYiA72d5g04NgEDyTweIJT7EzZC16ZLRjio4 K9rnCcelHWb7u9+Eff+4W2thMsYD5+5WWfjKPJC1hxR79ly2QnRDdBlGjf6aFv/mtg QjJt/7/8QnzNNnE+dbyk48wHHEp7eg/kTI2ppuKY= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Fredric Cover , ChenXiaoSong , Namjae Jeon , Paulo Alcantara Subject: [PATCH 6.12 124/403] smb: client: harden DFS cache against invalid target hints Date: Fri, 4 Sep 2026 06:58:47 +0200 Message-ID: <20260904045737.659100337@linuxfoundation.org> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260904045734.806166532@linuxfoundation.org> References: <20260904045734.806166532@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.12-stable review patch. If anyone has any objections, please let me know. ------------------ From: Fredric Cover commit bf86c08123c6ab8c61cc0be1dad7540db93738ff upstream. Currently, get_tgt_name() returns ERR_PTR(-ENOENT) when ce->tgthint is NULL, and dfs_cache_noreq_update_tgthint() assumes ce->tgthint is always valid. In preparation for clearing ce->tgthint in free_tgts(), harden callers of get_tgt_name() against ERR_PTR results and harden dfs_cache_noreq_update_tgthint() against NULL pointer dereferences. Cc: stable@vger.kernel.org Signed-off-by: Fredric Cover Reviewed-by: ChenXiaoSong Signed-off-by: Namjae Jeon Signed-off-by: Paulo Alcantara Signed-off-by: Greg Kroah-Hartman --- fs/smb/client/dfs_cache.c | 31 ++++++++++++++++++++++++------- 1 file changed, 24 insertions(+), 7 deletions(-) --- a/fs/smb/client/dfs_cache.c +++ b/fs/smb/client/dfs_cache.c @@ -871,13 +871,22 @@ int dfs_cache_find(const unsigned int xi goto out_free_path; } - if (ref) - rc = setup_referral(path, ce, ref, get_tgt_name(ce)); - else + if (ref) { + char *target = get_tgt_name(ce); + + if (IS_ERR(target)) { + rc = PTR_ERR(target); + goto out_unlock; + } + rc = setup_referral(path, ce, ref, target); + } else { rc = 0; + } + if (!rc && tgt_list) rc = get_targets(ce, tgt_list); +out_unlock: up_read(&htable_rw_lock); out_free_path: @@ -917,10 +926,17 @@ int dfs_cache_noreq_find(const char *pat goto out_unlock; } - if (ref) - rc = setup_referral(path, ce, ref, get_tgt_name(ce)); - else + if (ref) { + char *target = get_tgt_name(ce); + + if (IS_ERR(target)) { + rc = PTR_ERR(target); + goto out_unlock; + } + rc = setup_referral(path, ce, ref, target); + } else { rc = 0; + } if (!rc && tgt_list) rc = get_targets(ce, tgt_list); @@ -961,7 +977,8 @@ void dfs_cache_noreq_update_tgthint(cons t = READ_ONCE(ce->tgthint); - if (unlikely(!strcasecmp(it->it_name, t->name))) + /* Check 't' in case ce->tgthint was cleared by free_tgts() */ + if (t && unlikely(!strcasecmp(it->it_name, t->name))) goto out_unlock; list_for_each_entry(t, &ce->tlist, list) {