Re: [PATCH] cifs: fix DFS traversal oops without CONFIG_CIFS_DFS_UPCALL

[ronnie sahlberg <ronniesahlberg@gmail.com>]

reviewed-by me

On Thu, 30 Mar 2023 at 06:23, David Disseldorp <ddiss@suse.de> wrote:
>
> When compiled with CONFIG_CIFS_DFS_UPCALL disabled, cifs_dfs_d_automount
> NULL. cifs.ko logic for mapping CIFS_FATTR_DFS_REFERRAL attributes to
> S_AUTOMOUNT and corresponding dentry flags is retained regardless of
> CONFIG_CIFS_DFS_UPCALL, leading to a NULL pointer dereference in
> VFS follow_automount() when traversing a DFS referral link:
>   BUG: kernel NULL pointer dereference, address: 0000000000000000
>   ...
>   Call Trace:
>    <TASK>
>    __traverse_mounts+0xb5/0x220
>    ? cifs_revalidate_mapping+0x65/0xc0 [cifs]
>    step_into+0x195/0x610
>    ? lookup_fast+0xe2/0xf0
>    path_lookupat+0x64/0x140
>    filename_lookup+0xc2/0x140
>    ? __create_object+0x299/0x380
>    ? kmem_cache_alloc+0x119/0x220
>    ? user_path_at_empty+0x31/0x50
>    user_path_at_empty+0x31/0x50
>    __x64_sys_chdir+0x2a/0xd0
>    ? exit_to_user_mode_prepare+0xca/0x100
>    do_syscall_64+0x42/0x90
>    entry_SYSCALL_64_after_hwframe+0x72/0xdc
>
> This fix adds an inline cifs_dfs_d_automount() {return -EREMOTE} handler
> when CONFIG_CIFS_DFS_UPCALL is disabled. An alternative would be to
> avoid flagging S_AUTOMOUNT, etc. without CONFIG_CIFS_DFS_UPCALL. This
> approach was chosen as it provides more control over the error path.
>
> Signed-off-by: David Disseldorp <ddiss@suse.de>
> ---
>  fs/cifs/cifsfs.h | 5 ++++-
>  1 file changed, 4 insertions(+), 1 deletion(-)
>
> diff --git a/fs/cifs/cifsfs.h b/fs/cifs/cifsfs.h
> index 71fe0a0a7992..415176b2cf32 100644
> --- a/fs/cifs/cifsfs.h
> +++ b/fs/cifs/cifsfs.h
> @@ -124,7 +124,10 @@ extern const struct dentry_operations cifs_ci_dentry_ops;
>  #ifdef CONFIG_CIFS_DFS_UPCALL
>  extern struct vfsmount *cifs_dfs_d_automount(struct path *path);
>  #else
> -#define cifs_dfs_d_automount NULL
> +static inline struct vfsmount *cifs_dfs_d_automount(struct path *path)
> +{
> +       return ERR_PTR(-EREMOTE);
> +}
>  #endif
>
>  /* Functions related to symlinks */
> --
> 2.35.3
>