In the Linux kernel, the following vulnerability has been resolved:
cifs: fix DFS traversal oops without CONFIGCIFSDFS_UPCALL
When compiled with CONFIGCIFSDFSUPCALL disabled, cifsdfsdautomount is NULL. cifs.ko logic for mapping CIFSFATTRDFSREFERRAL attributes to SAUTOMOUNT and corresponding dentry flags is retained regardless of CONFIGCIFSDFSUPCALL, leading to a NULL pointer dereference in VFS followautomount() when traversing a DFS referral link: BUG: kernel NULL pointer dereference, address: 0000000000000000 ... Call Trace: <TASK> _traversemounts+0xb5/0x220 ? cifsrevalidatemapping+0x65/0xc0 [cifs] stepinto+0x195/0x610 ? lookupfast+0xe2/0xf0 pathlookupat+0x64/0x140 filenamelookup+0xc2/0x140 ? _createobject+0x299/0x380 ? kmemcachealloc+0x119/0x220 ? userpathatempty+0x31/0x50 userpathatempty+0x31/0x50 _x64syschdir+0x2a/0xd0 ? exittousermodeprepare+0xca/0x100 dosyscall64+0x42/0x90 entrySYSCALL64after_hwframe+0x72/0xdc
This fix adds an inline cifsdfsdautomount() {return -EREMOTE} handler when CONFIGCIFSDFSUPCALL is disabled. An alternative would be to avoid flagging SAUTOMOUNT, etc. without CONFIGCIFSDFSUPCALL. This approach was chosen as it provides more control over the error path.