Re: [PATCH v2 0/2] smb: client: fix dangling pointer in DFS target hints

[Fredric Cover]

Namjae, Paulo, and list,

Checking on the status of this patch series. It appears to not yet be
merged into #linux-next, at least on kernel.org. I understand that the
branch/maintainer changes may interfere. Thanks for keeping me
posted.

Thanks,
Fredric

On Mon, Aug 17, 2026 at 6:16 PM Namjae Jeon <linkinjeon@xxxxxxxxxx> wrote:
>
> On Sat, Jul 25, 2026 at 6:47 AM Fredric Cover
> <fredric.cover.lkernel@xxxxxxxxx> wrote:
> >
> > This series addresses a Use-After-Free bug where ce->tgthint was left
> > pointing to freed memory after free_tgts() was called.
> >
> > To fix this, Patch 1 hardens the DFS cache readers against ce->tgthint
> > being NULL. Also, Patch 1 hardens callers of get_tgt_name(), which
> > returns an error pointer when ce->tgthint is NULL.
> >
> > Patch 2 clears ce->tgthint in free_tgts(), eliminating the dangling
> > pointer.
> >
> > v1 -> v2:
> >  - Addressed automated review by Sashiko:
> >    https://sashiko.dev/#/patchset/20260724023539.1596955-1-fredric.cover.lkernel%40gmail.com
> >    Split into a 2-patch series to harden readers against NULL and
> >    ERR_PTR target hints so that clearing ce->tgthint does not cause
> >    NULL pointer dereferences.
> >
> > Fredric Cover (2):
> >   smb: client: harden DFS cache against invalid target hints
> >   smb: client: clear ce->tgthint in free_tgts()
> I will apply v3 patch-set to #for-next.
> Thanks!