Re: [PATCH v3 0/2] smb: client: fix dangling pointer in DFS target hints

[Fredric Cover]

Steve,
A gentle ping on this patch series. Let me know if any updates or
revisions are needed.

Thanks,
Fredric Cover

On Fri, Jul 24, 2026 at 3:02 PM Fredric Cover
<fredric.cover.lkernel@xxxxxxxxx> wrote:
>
> This series addresses a Use-After-Free bug where ce->tgthint was left
> pointing to freed memory after free_tgts() was called.
>
> To fix this, Patch 1 hardens the DFS cache readers against ce->tgthint
> being NULL. Also, Patch 1 hardens callers of get_tgt_name(), which
> returns an error pointer when ce->tgthint is NULL.
>
> Patch 2 clears ce->tgthint in free_tgts(), eliminating the dangling
> pointer.
>
> v2 -> v3:
>  - Resent series with proper thread structure and subject headers.
>
> v1 -> v2:
>  - Addressed automated review by Sashiko:
>    https://sashiko.dev/#/patchset/20260724023539.1596955-1-fredric.cover.lkernel%40gmail.com
>  - Split into a 2-patch series to harden readers against NULL and
>    ERR_PTR target hints.
>
> Fredric Cover (2):
>   smb: client: harden DFS cache against invalid target hints
>   smb: client: clear ce->tgthint in free_tgts()
>
>  fs/smb/client/dfs_cache.c | 33 ++++++++++++++++++++++++++-------
>  1 file changed, 26 insertions(+), 7 deletions(-)
>
> --
> 2.53.0
>