linux-stable.git/fs/smb/client/dfs_cache.c, branch linux-rolling-lts

smb: client: harden DFS cache against invalid target hints

2026-09-07T15:22:32+00:00

commit bf86c08123c6ab8c61cc0be1dad7540db93738ff upstream.

Currently, get_tgt_name() returns ERR_PTR(-ENOENT) when ce->tgthint is
NULL, and dfs_cache_noreq_update_tgthint() assumes ce->tgthint is always
valid.

In preparation for clearing ce->tgthint in free_tgts(), harden callers
of get_tgt_name() against ERR_PTR results and harden
dfs_cache_noreq_update_tgthint() against NULL pointer dereferences.

Cc: stable@vger.kernel.org
Signed-off-by: Fredric Cover 
Reviewed-by: ChenXiaoSong 
Signed-off-by: Namjae Jeon 
Signed-off-by: Paulo Alcantara 
Signed-off-by: Greg Kroah-Hartman

smb: client: clear ce->tgthint in free_tgts()

2026-09-07T15:22:32+00:00

commit b1b741cf8e7ce1b91d937e23decd3d3358748700 upstream.

When free_tgts() frees all structures in ce->tlist, ce->tgthint
is left pointing to one of the freed cache_dfs_tgt structures.

If ce->tgthint is not reset before it is used later, it results
in a use-after-free.

Set ce->tgthint to NULL in free_tgts() after the elements are
freed to reflect that no elements remain.

Fixes: 54be1f6c1c37 ("cifs: Add DFS cache routines")
Cc: stable@vger.kernel.org # depends on: smb: client: harden DFS cache against invalid target hints
Signed-off-by: Fredric Cover 
Reviewed-by: ChenXiaoSong 
Signed-off-by: Namjae Jeon 
Signed-off-by: Paulo Alcantara 
Signed-off-by: Greg Kroah-Hartman

smb: client: handle lack of IPC in dfs_cache_refresh()

2025-10-30T01:13:05+00:00

In very rare cases, DFS mounts could end up with SMB sessions without
any IPC connections.  These mounts are only possible when having
unexpired cached DFS referrals, hence not requiring any IPC
connections during the mount process.

Try to establish those missing IPC connections when refreshing DFS
referrals.  If the server is still rejecting it, then simply ignore
and leave expired cached DFS referral for any potential DFS failovers.

Reported-by: Jay Shin 
Signed-off-by: Paulo Alcantara (Red Hat) 
Cc: David Howells 
Cc: linux-cifs@vger.kernel.org
Signed-off-by: Steve French

smb: client: get rid of kstrdup() in get_ses_refpath()

2025-02-06T03:09:07+00:00

After commit 36008fe6e3dc ("smb: client: don't try following DFS links
in cifs_tree_connect()"), TCP_Server_Info::leaf_fullpath will no
longer be changed, so there is no need to kstrdup() it.

Signed-off-by: Paulo Alcantara (Red Hat) 
Signed-off-by: Steve French

smb: client: get rid of TCP_Server_Info::refpath_lock

2025-01-23T02:13:49+00:00

TCP_Server_Info::leaf_fullpath is allocated in cifs_get_tcp_session()
and never changed afterwards, so there is no need to serialize its
access.

Signed-off-by: Paulo Alcantara (Red Hat) 
Signed-off-by: Steve French

smb: client: provide dns_resolve_{unc,name} helpers

2025-01-20T01:34:00+00:00

Some places pass hostnames rather than UNC paths to resolve them to ip
addresses, so provide helpers to handle both cases and then stop
converting hostnames to UNC paths by inserting path delimiters into
them.  Also kill @expiry parameter as it's not used anywhere.

Signed-off-by: Paulo Alcantara (Red Hat) 
Signed-off-by: Steve French

smb: client: fix DFS mount against old servers with NTLMSSP

2025-01-20T01:34:00+00:00

Old Windows servers will return not fully qualified DFS targets by
default as specified in

  MS-DFSC 3.2.5.5 Receiving a Root Referral Request or Link Referral
  Request

    | Servers SHOULD<30> return fully qualified DNS host names of
    | targets in responses to root referral requests and link referral
    | requests.
    | ...
    | <30> Section 3.2.5.5: By default, Windows Server 2003, Windows
    | Server 2008, Windows Server 2008 R2, Windows Server 2012, and
    | Windows Server 2012 R2 return DNS host names that are not fully
    | qualified for targets.

Fix this by converting all NetBIOS host names from DFS targets to
FQDNs and try resolving them first if DNS domain name was provided in
NTLMSSP CHALLENGE_MESSAGE message from previous SMB2_SESSION_SETUP.
This also prevents the client from translating the DFS target
hostnames to another domain depending on the network domain search
order.

Signed-off-by: Paulo Alcantara (Red Hat) 
Signed-off-by: Steve French

smb: client: allow more DFS referrals to be cached

2024-11-27T00:46:15+00:00

In some DFS setups, a single DFS share may contain hundreds of DFS
links and increasing the DFS cache to allow more referrals to be
cached improves DFS failover as the client will likely find a cached
DFS referral when reconnecting and then avoiding unnecessary remounts.

Signed-off-by: Paulo Alcantara (Red Hat) 
Signed-off-by: Steve French

smb: client: Use str_yes_no() helper function

2024-11-18T04:20:54+00:00

Remove hard-coded strings by using the str_yes_no() helper function.

Signed-off-by: Thorsten Blum 
Signed-off-by: Steve French

smb: client: fix DFS interlink failover

2024-09-25T02:51:48+00:00

The DFS interlinks point to different DFS namespaces so make sure to
use the correct DFS root server to chase any DFS links under it by
storing the SMB session in dfs_ref_walk structure and then using it on
every referral walk.

Signed-off-by: Paulo Alcantara (Red Hat) 
Signed-off-by: Steve French