CVE-2023-53246

In the Linux kernel, the following vulnerability has been resolved:

cifs: fix DFS traversal oops without CONFIGCIFSDFS_UPCALL

When compiled with CONFIGCIFSDFSUPCALL disabled, cifsdfsdautomount is NULL. cifs.ko logic for mapping CIFSFATTRDFSREFERRAL attributes to SAUTOMOUNT and corresponding dentry flags is retained regardless of CONFIGCIFSDFSUPCALL, leading to a NULL pointer dereference in VFS followautomount() when traversing a DFS referral link: BUG: kernel NULL pointer dereference, address: 0000000000000000 ... Call Trace: <TASK> __traversemounts+0xb5/0x220 ? cifsrevalidate_mapping+0x65/0xc0 [cifs] stepinto+0x195/0x610 ? lookupfast+0xe2/0xf0 pathlookupat+0x64/0x140 filenamelookup+0xc2/0x140 ? __createobject+0x299/0x380 ? kmemcache_alloc+0x119/0x220 ? userpathatempty+0x31/0x50 userpathatempty+0x31/0x50 __x64syschdir+0x2a/0xd0 ? exittousermodeprepare+0xca/0x100 dosyscall64+0x42/0x90 entrySYSCALL64afterhwframe+0x72/0xdc

This fix adds an inline cifsdfsdautomount() {return -EREMOTE} handler when CONFIGCIFSDFSUPCALL is disabled. An alternative would be to avoid flagging SAUTOMOUNT, etc. without CONFIGCIFSDFSUPCALL. This approach was chosen as it provides more control over the error path.