From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 4BDA030C160; Fri, 4 Sep 2026 05:15:45 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788498946; cv=none; b=FbWYZLKJeKfr/UjdEDpcI2c4jKuPuBEDWaa/MPo+qXBTNc1T8vCucHpww+Tjut/c0uuHnPh1np1p8tge8y1mRj6zxizCFl2UoVbLseaENF2iwE4vdSzugrOa3J8a51qvqxyWEw+e1JufKDBgv4R+0om1GJDbIu6dE1oYqPVX3sI= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788498946; c=relaxed/simple; bh=IMm+az2OjegicbaACJ5orTMSzXsfikEEhLwlRwIPjYc=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=cnmSGzjrwPGriPNMZ3FuRiFGWj04KV4IecOC2o6Ii8aiDvBgdKUCylAhRH1VL6HZv1yGw7NmxlUXqcBYp4erk/Fn8f44nFFwaKIKQXLqRDEXee3yMJuC3iD6rdKz6wdCkh6gM7LydtOEyGRln9Vai2dH6L/TuufwT33O+fWZqy0= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=YC0MCJwv; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="YC0MCJwv" Received: by smtp.kernel.org (Postfix) with ESMTPSA id A3E411F00A3D; Fri, 4 Sep 2026 05:15:44 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1788498945; bh=T51pjUOpnoWTQ5cTsUBfE4atTeZP31PAeAzus2q6SyY=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=YC0MCJwvGgDyBNaHsZFYpovWKkAx9qiicOcDU6TlovM90ZzcfCDbSjWQyeXQxrumy MUZ7IAudNu2j7sKR6MLSWN4Rqt+IVnlloKYgIqdHWmLvM+mDM7BqVac7N64vo5PB1C X5+GebKlSzQqA1Iy9HpAh/p2qnGaEe9tP1X6w5lE= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Fredric Cover , ChenXiaoSong , Namjae Jeon , Paulo Alcantara Subject: [PATCH 7.2 243/713] smb: client: harden DFS cache against invalid target hints Date: Fri, 4 Sep 2026 06:53:31 +0200 Message-ID: <20260904045809.279764856@linuxfoundation.org> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260904045803.810145556@linuxfoundation.org> References: <20260904045803.810145556@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 7.2-stable review patch. If anyone has any objections, please let me know. ------------------ From: Fredric Cover commit bf86c08123c6ab8c61cc0be1dad7540db93738ff upstream. Currently, get_tgt_name() returns ERR_PTR(-ENOENT) when ce->tgthint is NULL, and dfs_cache_noreq_update_tgthint() assumes ce->tgthint is always valid. In preparation for clearing ce->tgthint in free_tgts(), harden callers of get_tgt_name() against ERR_PTR results and harden dfs_cache_noreq_update_tgthint() against NULL pointer dereferences. Cc: stable@vger.kernel.org Signed-off-by: Fredric Cover Reviewed-by: ChenXiaoSong Signed-off-by: Namjae Jeon Signed-off-by: Paulo Alcantara Signed-off-by: Greg Kroah-Hartman --- fs/smb/client/dfs_cache.c | 31 ++++++++++++++++++++++++------- 1 file changed, 24 insertions(+), 7 deletions(-) --- a/fs/smb/client/dfs_cache.c +++ b/fs/smb/client/dfs_cache.c @@ -871,13 +871,22 @@ int dfs_cache_find(const unsigned int xi goto out_free_path; } - if (ref) - rc = setup_referral(path, ce, ref, get_tgt_name(ce)); - else + if (ref) { + char *target = get_tgt_name(ce); + + if (IS_ERR(target)) { + rc = PTR_ERR(target); + goto out_unlock; + } + rc = setup_referral(path, ce, ref, target); + } else { rc = 0; + } + if (!rc && tgt_list) rc = get_targets(ce, tgt_list); +out_unlock: up_read(&htable_rw_lock); out_free_path: @@ -917,10 +926,17 @@ int dfs_cache_noreq_find(const char *pat goto out_unlock; } - if (ref) - rc = setup_referral(path, ce, ref, get_tgt_name(ce)); - else + if (ref) { + char *target = get_tgt_name(ce); + + if (IS_ERR(target)) { + rc = PTR_ERR(target); + goto out_unlock; + } + rc = setup_referral(path, ce, ref, target); + } else { rc = 0; + } if (!rc && tgt_list) rc = get_targets(ce, tgt_list); @@ -961,7 +977,8 @@ void dfs_cache_noreq_update_tgthint(cons t = READ_ONCE(ce->tgthint); - if (unlikely(!strcasecmp(it->it_name, t->name))) + /* Check 't' in case ce->tgthint was cleared by free_tgts() */ + if (t && unlikely(!strcasecmp(it->it_name, t->name))) goto out_unlock; list_for_each_entry(t, &ce->tlist, list) {