[5.17,115/146] cifs: fix NULL ptr dereference in refresh_mounts()

From: Paulo Alcantara <pc@cjr.nz>

From: Paulo Alcantara <pc@cjr.nz>

commit 41f10081a92a0ed280008218a8ec18ad8ba0fceb upstream.

Either mount(2) or automount might not have server->origin_fullpath
set yet while refresh_cache_worker() is attempting to refresh DFS
referrals.  Add missing NULL check and locking around it.

This fixes bellow crash:

[ 1070.276835] general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN NOPTI
[ 1070.277676] KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
[ 1070.278219] CPU: 1 PID: 8506 Comm: kworker/u8:1 Not tainted 5.18.0-rc3 #10
[ 1070.278701] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.15.0-0-g2dd4b9b-rebuilt.opensuse.org 04/01/2014
[ 1070.279495] Workqueue: cifs-dfscache refresh_cache_worker [cifs]
[ 1070.280044] RIP: 0010:strcasecmp+0x34/0x150
[ 1070.280359] Code: 00 00 00 fc ff df 41 54 55 48 89 fd 53 48 83 ec 10 eb 03 4c 89 fe 48 89 ef 48 83 c5 01 48 89 f8 48 89 fa 48 c1 e8 03 83 e2 07 <42> 0f b6 04 28 38 d0 7f 08 84 c0 0f 85 bc 00 00 00 0f b6 45 ff 44
[ 1070.281729] RSP: 0018:ffffc90008367958 EFLAGS: 00010246
[ 1070.282114] RAX: 0000000000000000 RBX: dffffc0000000000 RCX: 0000000000000000
[ 1070.282691] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
[ 1070.283273] RBP: 0000000000000001 R08: 0000000000000000 R09: ffffffff873eda27
[ 1070.283857] R10: ffffc900083679a0 R11: 0000000000000001 R12: ffff88812624c000
[ 1070.284436] R13: dffffc0000000000 R14: ffff88810e6e9a88 R15: ffff888119bb9000
[ 1070.284990] FS:  0000000000000000(0000) GS:ffff888151200000(0000) knlGS:0000000000000000
[ 1070.285625] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 1070.286100] CR2: 0000561a4d922418 CR3: 000000010aecc000 CR4: 0000000000350ee0
[ 1070.286683] Call Trace:
[ 1070.286890]  <TASK>
[ 1070.287070]  refresh_cache_worker+0x895/0xd20 [cifs]
[ 1070.287475]  ? __refresh_tcon.isra.0+0xfb0/0xfb0 [cifs]
[ 1070.287905]  ? __lock_acquire+0xcd1/0x6960
[ 1070.288247]  ? is_dynamic_key+0x1a0/0x1a0
[ 1070.288591]  ? lockdep_hardirqs_on_prepare+0x410/0x410
[ 1070.289012]  ? lock_downgrade+0x6f0/0x6f0
[ 1070.289318]  process_one_work+0x7bd/0x12d0
[ 1070.289637]  ? worker_thread+0x160/0xec0
[ 1070.289970]  ? pwq_dec_nr_in_flight+0x230/0x230
[ 1070.290318]  ? _raw_spin_lock_irq+0x5e/0x90
[ 1070.290619]  worker_thread+0x5ac/0xec0
[ 1070.290891]  ? process_one_work+0x12d0/0x12d0
[ 1070.291199]  kthread+0x2a5/0x350
[ 1070.291430]  ? kthread_complete_and_exit+0x20/0x20
[ 1070.291770]  ret_from_fork+0x22/0x30
[ 1070.292050]  </TASK>
[ 1070.292223] Modules linked in: bpfilter cifs cifs_arc4 cifs_md4
[ 1070.292765] ---[ end trace 0000000000000000 ]---
[ 1070.293108] RIP: 0010:strcasecmp+0x34/0x150
[ 1070.293471] Code: 00 00 00 fc ff df 41 54 55 48 89 fd 53 48 83 ec 10 eb 03 4c 89 fe 48 89 ef 48 83 c5 01 48 89 f8 48 89 fa 48 c1 e8 03 83 e2 07 <42> 0f b6 04 28 38 d0 7f 08 84 c0 0f 85 bc 00 00 00 0f b6 45 ff 44
[ 1070.297718] RSP: 0018:ffffc90008367958 EFLAGS: 00010246
[ 1070.298622] RAX: 0000000000000000 RBX: dffffc0000000000 RCX: 0000000000000000
[ 1070.299428] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
[ 1070.300296] RBP: 0000000000000001 R08: 0000000000000000 R09: ffffffff873eda27
[ 1070.301204] R10: ffffc900083679a0 R11: 0000000000000001 R12: ffff88812624c000
[ 1070.301932] R13: dffffc0000000000 R14: ffff88810e6e9a88 R15: ffff888119bb9000
[ 1070.302645] FS:  0000000000000000(0000) GS:ffff888151200000(0000) knlGS:0000000000000000
[ 1070.303462] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 1070.304131] CR2: 0000561a4d922418 CR3: 000000010aecc000 CR4: 0000000000350ee0
[ 1070.305004] Kernel panic - not syncing: Fatal exception
[ 1070.305711] Kernel Offset: disabled
[ 1070.305971] ---[ end Kernel panic - not syncing: Fatal exception ]---

Signed-off-by: Paulo Alcantara (SUSE) <pc@cjr.nz>
Cc: stable@vger.kernel.org
Reviewed-by: Ronnie Sahlberg <lsahlber@redhat.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/cifs/connect.c   |    2 ++
 fs/cifs/dfs_cache.c |   19 ++++++++++++-------
 2 files changed, 14 insertions(+), 7 deletions(-)

Message ID	20220426081753.288771630@linuxfoundation.org
State	New
Headers	show Return-Path: <stable-owner@kernel.org> From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>, stable@vger.kernel.org, "Paulo Alcantara (SUSE)" <pc@cjr.nz>, Ronnie Sahlberg <lsahlber@redhat.com>, Steve French <stfrench@microsoft.com> Subject: [PATCH 5.17 115/146] cifs: fix NULL ptr dereference in refresh_mounts() Date: Tue, 26 Apr 2022 10:21:50 +0200 Message-Id: <20220426081753.288771630@linuxfoundation.org> In-Reply-To: <20220426081750.051179617@linuxfoundation.org> References: <20220426081750.051179617@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk
Series	None \| expand [5.17,002/146] perf tools: Fix segfault accessing sample_id xyarray [5.17,003/146] drm/amd/display: Only set PSR version when valid [5.17,004/146] block/compat_ioctl: fix range check in BLKGETSIZE [5.17,005/146] gfs2: assign rgrp glock before compute_bitstructs [5.17,006/146] scsi: ufs: core: scsi_get_lba() error fix [5.17,007/146] net/sched: cls_u32: fix netns refcount changes in u32_change() [5.17,008/146] ALSA: usb-audio: Clear MIDI port active flag after draining [5.17,009/146] ALSA: usb-audio: add mapping for MSI MAG X570S Torpedo MAX. [5.17,010/146] ALSA: hda/realtek: Add quirk for Clevo NP70PNP [5.17,011/146] ASoC: atmel: Remove system clock tree configuration for at91sam9g20ek [5.17,012/146] ASoC: topology: Correct error handling in soc_tplg_dapm_widget_create() [5.17,013/146] ASoC: rk817: Use devm_clk_get() in rk817_platform_probe [5.17,014/146] ASoC: msm8916-wcd-digital: Check failure for devm_snd_soc_register_component [5.17,015/146] ASoC: codecs: wcd934x: do not switch off SIDO Buck when codec is in use [5.17,016/146] dmaengine: idxd: fix device cleanup on disable [5.17,017/146] dmaengine: imx-sdma: Fix error checking in sdma_event_remap [5.17,018/146] dmaengine: mediatek:Fix PM usage reference leak of mtk_uart_apdma_alloc_chan_resou... [5.17,019/146] dmaengine: dw-edma: Fix unaligned 64bit access [5.17,020/146] spi: spi-mtk-nor: initialize spi controller after resume [5.17,021/146] firmware: cs_dsp: Fix overrun of unterminated control name string [5.17,022/146] esp: limit skb_page_frag_refill use to a single page [5.17,023/146] spi: cadence-quadspi: fix incorrect supports_op() return value [5.17,024/146] igc: Fix infinite loop in release_swfw_sync [5.17,025/146] igc: Fix BUG: scheduling while atomic [5.17,026/146] igc: Fix suspending when PTM is active [5.17,027/146] ice: allow creating VFs for !CONFIG_NET_SWITCHDEV [5.17,028/146] ice: fix crash in switchdev mode [5.17,029/146] ice: Fix memory leak in ice_get_orom_civd_data() [5.17,030/146] ALSA: hda/hdmi: fix warning about PCM count when used with SOF [5.17,031/146] rxrpc: Restore removed timer deletion [5.17,032/146] net/smc: Fix sock leak when release after smc_shutdown() [5.17,033/146] net/packet: fix packet_sock xmit return value checking [5.17,034/146] ip6_gre: Avoid updating tunnel->tun_hlen in __gre6_xmit() [5.17,035/146] ip6_gre: Fix skb_under_panic in __gre6_xmit() [5.17,036/146] net: restore alpha order to Ethernet devices in config [5.17,037/146] net/sched: cls_u32: fix possible leak in u32_init_knode() [5.17,038/146] l3mdev: l3mdev_master_upper_ifindex_by_index_rcu should be using netdev_master_upp... [5.17,039/146] ipv6: make ip6_rt_gc_expire an atomic_t [5.17,040/146] can: isotp: stop timeout monitoring when no first frame was sent [5.17,041/146] net: dsa: hellcreek: Calculate checksums in tagger [5.17,042/146] net: mscc: ocelot: fix broken IP multicast flooding [5.17,043/146] netlink: reset network and mac headers in netlink_dump() [5.17,044/146] drm/i915/display/psr: Unset enable_psr2_sel_fetch if other checks in intel_psr2_co... [5.17,045/146] RISC-V: KVM: Remove s & u as valid ISA extension [5.17,046/146] RISC-V: KVM: Restrict the extensions that can be disabled [5.17,047/146] net: stmmac: Use readl_poll_timeout_atomic() in atomic state [5.17,048/146] dmaengine: idxd: match type for retries var in idxd_enqcmds() [5.17,049/146] dmaengine: idxd: fix retry value to be constant for duration of function call [5.17,050/146] dmaengine: idxd: add RO check for wq max_batch_size write [5.17,051/146] dmaengine: idxd: add RO check for wq max_transfer_size write [5.17,052/146] dmaengine: idxd: skip clearing device context when device is read-only [5.17,053/146] selftests: mlxsw: vxlan_flooding: Prevent flooding of unwanted packets [5.17,054/146] selftests: mlxsw: vxlan_flooding_ipv6: Prevent flooding of unwanted packets [5.17,055/146] userfaultfd: mark uffd_wp regardless of VM_WRITE flag [5.17,056/146] arm64: mm: fix p?d_leaf() [5.17,057/146] XArray: Disallow sibling entries of nodes [5.17,058/146] drm/msm/gpu: Rename runtime suspend/resume functions [5.17,059/146] drm/msm/gpu: Remove mutex from wait_event condition [5.17,060/146] ARM: vexpress/spc: Avoid negative array index when !SMP [5.17,061/146] reset: renesas: Check return value of reset_control_deassert() [5.17,062/146] reset: tegra-bpmp: Restore Handle errors in BPMP response [5.17,063/146] platform/x86: samsung-laptop: Fix an unsigned comparison which can never be negative [5.17,064/146] ALSA: usb-audio: Fix undefined behavior due to shift overflowing the constant [5.17,065/146] drm/msm/disp: check the return value of kzalloc() [5.17,066/146] selftests: KVM: Free the GIC FD when cleaning up in arch_timer [5.17,067/146] ALSA: hda: intel-dsp-config: update AlderLake PCI IDs [5.17,068/146] arm64: dts: imx: Fix imx8*-var-som touchscreen property sizes [5.17,069/146] vxlan: fix error return code in vxlan_fdb_append [5.17,070/146] cifs: Check the IOCB_DIRECT flag, not O_DIRECT [5.17,071/146] net: atlantic: Avoid out-of-bounds indexing [5.17,072/146] mt76: Fix undefined behavior due to shift overflowing the constant [5.17,073/146] brcmfmac: sdio: Fix undefined behavior due to shift overflowing the constant [5.17,074/146] dpaa_eth: Fix missing of_node_put in dpaa_get_ts_info() [5.17,075/146] drm/msm/mdp5: check the return of kzalloc() [5.17,076/146] KVM: x86: hyper-v: Avoid writing to TSC page without an active vCPU [5.17,077/146] net: macb: Restart tx only if queue pointer is lagging [5.17,078/146] scsi: iscsi: Release endpoint ID when its freed [5.17,079/146] scsi: iscsi: Merge suspend fields [5.17,080/146] scsi: iscsi: Fix NOP handling during conn recovery [5.17,081/146] scsi: qedi: Fix failed disconnect handling [5.17,082/146] stat: fix inconsistency between struct stat and struct compat_stat [5.17,083/146] VFS: filename_create(): fix incorrect intent. [5.17,084/146] nvme: add a quirk to disable namespace identifiers [5.17,085/146] nvme-pci: disable namespace identifiers for the MAXIO MAP1002/1202 [5.17,086/146] nvme-pci: disable namespace identifiers for Qemu controllers [5.17,087/146] irq_work: use kasan_record_aux_stack_noalloc() record callstack [5.17,088/146] EDAC/synopsys: Read the error count from the correct register [5.17,089/146] mm/memory-failure.c: skip huge_zero_page in memory_failure() [5.17,090/146] memcg: sync flush only if periodic flush is delayed [5.17,091/146] mm, hugetlb: allow for "high" userspace addresses [5.17,092/146] oom_kill.c: futex: delay the OOM reaper to allow time for proper futex cleanup [5.17,093/146] mm/mmu_notifier.c: fix race in mmu_interval_notifier_remove() [5.17,094/146] ata: pata_marvell: Check the bmdma_addr beforing reading [5.17,095/146] dma: at_xdmac: fix a missing check on list iterator [5.17,096/146] dmaengine: imx-sdma: fix init of uart scripts [5.17,097/146] net: atlantic: invert deep par in pm functions, preventing null derefs [5.17,098/146] drm/radeon: fix logic inversion in radeon_sync_resv [5.17,099/146] io_uring: free iovec if file assignment fails [5.17,100/146] Input: omap4-keypad - fix pm_runtime_get_sync() error checking [5.17,101/146] scsi: sr: Do not leak information in ioctl [5.17,102/146] sched/pelt: Fix attach_entity_load_avg() corner case [5.17,103/146] perf/core: Fix perf_mmap fail when CONFIG_PERF_USE_VMALLOC enabled [5.17,104/146] drm/panel/raspberrypi-touchscreen: Avoid NULL deref if not initialised [5.17,105/146] drm/panel/raspberrypi-touchscreen: Initialise the bridge in prepare [5.17,106/146] powerpc/time: Always set decrementer in timer_interrupt() [5.17,107/146] KVM: PPC: Fix TCE handling for VFIO [5.17,108/146] drm/vc4: Use pm_runtime_resume_and_get to fix pm_runtime_get_sync() usage [5.17,109/146] powerpc/perf: Fix power9 event alternatives [5.17,110/146] powerpc/perf: Fix power10 event alternatives [5.17,111/146] arm/xen: Fix some refcount leaks [5.17,112/146] perf script: Always allow field data_src for auxtrace [5.17,113/146] perf report: Set PERF_SAMPLE_DATA_SRC bit for Arm SPE event [5.17,114/146] fs: fix acl translation [5.17,115/146] cifs: fix NULL ptr dereference in refresh_mounts() [5.17,116/146] cifs: use correct lock type in cifs_reconnect() [5.17,117/146] xtensa: patch_text: Fixup last cpu should be master [5.17,118/146] xtensa: fix a7 clobbering in coprocessor context load/store [5.17,119/146] openvswitch: fix OOB access in reserve_sfa_size() [5.17,120/146] gpio: Request interrupts after IRQ is initialized [5.17,121/146] ASoC: rt5682: fix an incorrect NULL check on list iterator [5.17,122/146] ASoC: soc-dapm: fix two incorrect uses of list iterator [5.17,123/146] e1000e: Fix possible overflow in LTR decoding [5.17,124/146] codecs: rt5682s: fix an incorrect NULL check on list iterator [5.17,125/146] ARC: entry: fix syscall_trace_exit argument [5.17,126/146] drm/vmwgfx: Fix gem refcounting and memory evictions [5.17,127/146] arm_pmu: Validate single/group leader events [5.17,128/146] KVM: x86/pmu: Update AMD PMC sample period to fix guest NMI-watchdog [5.17,129/146] KVM: x86: Dont re-acquire SRCU lock in complete_emulated_io() [5.17,130/146] KVM: x86: Pend KVM_REQ_APICV_UPDATE during vCPU creation to fix a race [5.17,131/146] KVM: nVMX: Defer APICv updates while L2 is active until L1 is active [5.17,132/146] KVM: SVM: Simplify and harden helper to flush SEV guest page(s) [5.17,133/146] KVM: SVM: Flush when freeing encrypted pages even on SME_COHERENT CPUs [5.17,134/146] ext4: fix fallocate to use file_modified to update permissions consistently [5.17,135/146] ext4: fix symlink file size not match to file content [5.17,136/146] ext4: fix use-after-free in ext4_search_dir [5.17,137/146] ext4: limit length to bitmap_maxbytes - blocksize in punch_hole [5.17,138/146] ext4, doc: fix incorrect h_reserved size [5.17,139/146] ext4: fix overhead calculation to account for the reserved gdt blocks [5.17,140/146] ext4: force overhead calculation if the s_overhead_cluster makes no sense [5.17,141/146] ext4: update the cached overhead value in the superblock [5.17,142/146] jbd2: fix a potential race while discarding reserved buffers after an abort [5.17,143/146] spi: atmel-quadspi: Fix the buswidth adjustment between spi-mem and controller [5.17,144/146] ASoC: SOF: topology: cleanup dailinks on widget unload [5.17,145/146] io_uring: fix leaks on IOPOLL and CQE_SKIP [5.17,146/146] arm64: dts: qcom: add IPA qcom,qmp property

[5.17,115/146] cifs: fix NULL ptr dereference in refresh_mounts()

Commit Message

Patch