Re: [PATCH 6.1.y] smb/dfs_cache: Fix NULL pointer dereference on session connection failure

[Greg KH <gregkh@linuxfoundation.org>]

On Tue, Mar 03, 2026 at 07:31:39PM +0200, Ghadi Elie Rahme wrote:
> [ Upstream commit 6916881f443f67f6893b504fa2171468c8aed915 ]

No, that is NOT what this commit id is.

> It is possible for find_ipc_from_server_path to run while the tcon is NULL,
> resulting in a NULL pointer dereference crash when calling strcasecmp().
> This happens when the ipc connection fails freeing the tcon and setting it
> to NULL while the dfs cache worker thread was already executing.
> This issue was fixed upstream indirectly by a rewrite that removed this
> function. Although with this fix the issue can still occur, the window of
> the race is now much narrower.
> A fix that would completely fix it using mutexes was tested and
> worked fine. However the regression potential would be much higher and so
> would be the deviation from upstream.
> This is a good balance of safety while minimizing upstream deviation.

No, please use the upstream commits instead.  Also, you did not cc: any
of the maintainers or developers involved here, which would mean we
couldn't take this anyway.

sorry.

greg k-h