From: Fredric Cover <fredric.cover.lkernel@gmail.com> mainline inclusion from mainline-v7.3-rc1 commit bf86c08123c6ab8c61cc0be1dad7540db93738ff category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18921 CVE: CVE-2026-89636 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?i... -------------------------------- Currently, get_tgt_name() returns ERR_PTR(-ENOENT) when ce->tgthint is NULL, and dfs_cache_noreq_update_tgthint() assumes ce->tgthint is always valid. In preparation for clearing ce->tgthint in free_tgts(), harden callers of get_tgt_name() against ERR_PTR results and harden dfs_cache_noreq_update_tgthint() against NULL pointer dereferences. Cc: stable@vger.kernel.org Signed-off-by: Fredric Cover <fredric.cover.lkernel@gmail.com> Reviewed-by: ChenXiaoSong <chenxiaosong@kylinos.cn> Signed-off-by: Namjae Jeon <linkinjeon@kernel.org> Signed-off-by: Paulo Alcantara <pc@manguebit.org> Conflicts: fs/cifs/dfs_cache.c fs/smb/client/dfs_cache.c [different files] Signed-off-by: Yifan Qiao <qiaoyifan4@huawei.com> --- fs/cifs/dfs_cache.c | 43 ++++++++++++++++++++++++++++++++++--------- 1 file changed, 34 insertions(+), 9 deletions(-) diff --git a/fs/cifs/dfs_cache.c b/fs/cifs/dfs_cache.c index 7b6db272fd0b..9d02372d5b03 100644 --- a/fs/cifs/dfs_cache.c +++ b/fs/cifs/dfs_cache.c @@ -900,13 +900,21 @@ int dfs_cache_find(const unsigned int xid, struct cifs_ses *ses, goto out_free_path; } - if (ref) - rc = setup_referral(path, ce, ref, get_tgt_name(ce)); - else + if (ref) { + char *target = get_tgt_name(ce); + + if (IS_ERR(target)) { + rc = PTR_ERR(target); + goto out_unlock; + } + rc = setup_referral(path, ce, ref, target); + } else { rc = 0; + } if (!rc && tgt_list) rc = get_targets(ce, tgt_list); +out_unlock: up_read(&htable_rw_lock); out_free_path: @@ -951,10 +959,17 @@ int dfs_cache_noreq_find(const char *path, struct dfs_info3_param *ref, goto out_unlock; } - if (ref) - rc = setup_referral(path, ce, ref, get_tgt_name(ce)); - else + if (ref) { + char *target = get_tgt_name(ce); + + if (IS_ERR(target)) { + rc = PTR_ERR(target); + goto out_unlock; + } + rc = setup_referral(path, ce, ref, target); + } else { rc = 0; + } if (!rc && tgt_list) rc = get_targets(ce, tgt_list); @@ -1013,7 +1028,8 @@ int dfs_cache_update_tgthint(const unsigned int xid, struct cifs_ses *ses, t = ce->tgthint; - if (likely(!strcasecmp(it->it_name, t->name))) + /* Check 't' in case ce->tgthint was cleared by free_tgts() */ + if (t && likely(!strcasecmp(it->it_name, t->name))) goto out_unlock; list_for_each_entry(t, &ce->tlist, list) { @@ -1075,7 +1091,8 @@ int dfs_cache_noreq_update_tgthint(const char *path, rc = 0; t = ce->tgthint; - if (unlikely(!strcasecmp(it->it_name, t->name))) + /* Check 't' in case ce->tgthint was cleared by free_tgts() */ + if (t && unlikely(!strcasecmp(it->it_name, t->name))) goto out_unlock; list_for_each_entry(t, &ce->tlist, list) { @@ -1471,6 +1488,7 @@ static struct cifs_ses *find_root_ses(struct vol_info *vi, const char *path) { char *rpath; + char *target; int rc; struct cache_entry *ce; struct dfs_info3_param ref = {0}; @@ -1492,7 +1510,14 @@ static struct cifs_ses *find_root_ses(struct vol_info *vi, goto out; } - rc = setup_referral(path, ce, &ref, get_tgt_name(ce)); + target = get_tgt_name(ce); + + if (IS_ERR(target)) { + up_read(&htable_rw_lock); + ses = ERR_CAST(target); + goto out; + } + rc = setup_referral(path, ce, &ref, target); if (rc) { up_read(&htable_rw_lock); ses = ERR_PTR(rc); -- 2.52.0