From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=74.125.82.181 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1794017034; b=edndW+9t08r5PkNMlkNlj77JxQ/2pyp7fZaFxbxDF6eSAn//v4woQ5+TK3katSHfAtMO qsubmGIs0q9drFes40EX4jNhNuOFpQ4X+wU+8uwuztJUohQ+e1cuzE5+1s3LQdKCo2KFs dTRf8FCPN5TEefKRG8GY5e9NQ/v4inoga6++uREOcHLLyWVyXR+c0I5+BF3uoTOKVY1hW 8ccWzXHzft2OweXcUI3lwaDQxrvJuD5JtJJe0GJW4L85/1yGJfXdErbMAfWxgW/IaGHN0 4zXzhFWcFCp3d7VWeIHBgXmFn+EDUOHfNhiwYhrFOuAOaPcC6wRQfWzmcMf+wIGT5SA== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1794017034; h=DMARC-Filter:Received:DKIM-Signature:X-Google-DKIM-Signature: X-Forwarded-Encrypted:X-Gm-Message-State:X-Gm-Gg:X-Received:Received: From:To:Cc:Subject:Date:Message-ID:X-Mailer:In-Reply-To:References: MIME-Version:Content-Type:Content-Transfer-Encoding; bh=fag9CAq5RdDK24g6i+Jze72o+KqHUpaocfKTd7BZIO0=; b=GDL2ihs1Jz7cdvjTIBzwDp7vkyw9Biy3rQckCIaML0S/8UOXpZsPe+xhClYe2+BjTibu tpgyx4AenFDx0PhHl6ZC5DdWeSm34P2uypSKMTFoxGtBPcarOT9siOz8taZa72cbaiXhy zkyvzgE4ILs9uBkHpTERiuUjhW6C2cQ/AwzZ/JF43y8sxhnYDfJZfx0eHdVOZxQnG+GcU cZwfVOyInZgyl3XqMb3C+1s0RWOYYiC5AmyzvMGr7ly3ORd32uUqnAxD85T2uXFxb+Svm ISwkwTbCSBUY+UQ/UlUE6o2f2qtHQhDNcaboQHTkTnJ3GfiNb/ZuOUiy9aLUfxAcAlw== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256 header.s=20260707 header.b=EjNPtQDd; arc=none smtp.remote-ip=74.125.82.181 Received: from mail-dy1-f181.google.com (mail-dy1-f181.google.com [74.125.82.181]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature ECDSA (prime256v1) server-digest SHA256) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 37E9D606A333 for ; Sat, 7 Nov 2026 02:03:54 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.2 smtp.subspace.kernel.org 37E9D606A333 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key, unprotected) header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256 header.s=20260707 header.b=EjNPtQDd Received: by mail-dy1-f181.google.com with SMTP id 5a478bee46e88-37000e7234bso1590289eec.1 for ; Fri, 06 Nov 2026 18:03:54 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20260707; t=1794017033; x=1794621833; darn=vger.kernel.org; h=content-transfer-encoding:content-type:mime-version:references :in-reply-to:message-id:date:subject:cc:to:from:from:to:cc:subject :date:message-id:reply-to:content-type; bh=fag9CAq5RdDK24g6i+Jze72o+KqHUpaocfKTd7BZIO0=; b=EjNPtQDdfUizC6avFZtZI8RqbdTirz6v/iHvg+7kwZmf+UjAaHZ5etVdklyGbtDOXp 18tAeoppS5HrZjnmJhZV949evREpLPB23tunsddoEos0a8e8zQk7C+iCX4vyFih3BR1f E1zr1pjo3TG6g6pb7w6pOQVjJSYGnX7bOljfT9rcQyscyQbZigwH1NqxHXLHpVWtGru9 0y03euFxYZ81BAjsVFTE3JHx10zDb6QSCSSXlglK19QQtAusZ66TtKp0Z8Ob8q/aJkTl 0b88hhxJorBi6uJJeV2Oj8JphDwxh680XHcTciLnI+YYCa6jvv7GTIoQClv9HUFLxUrF voQQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1794017033; x=1794621833; h=content-transfer-encoding:content-type:mime-version:references :in-reply-to:message-id:date:subject:cc:to:from:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=fag9CAq5RdDK24g6i+Jze72o+KqHUpaocfKTd7BZIO0=; b=z6mn0lRxnxOcKe/dc2PfKQRyj7E8/mHyzx/rXZFnIJe0VmbmdCcJGD3AxZvFO+TRQj N4LXJRvrNw9cqWtAvF6QSS404TnKRmfdnWbRvhrGqwt6qJS1UEjQnsCPd/NTG4ZzxH5C cXVxfEBz4UdTWvH6dJAgmz1kLrN24gHWn55Qg8ZzBHBlsx3n/N1owLXJSaMvepGVNDEB dIvcJ2bMSRcBWLBeP0HVzWKeSLkGLy05+mzo/lHcwnNB1X/RR1xNPHCWBiWP4HkTAllD e/Zuh/t0Pdh3QyLFfKNjX0LhR313umQ4JwG9LPVYDqldAWMxBMq2Zrjndawgtox3WBTh JFZQ== X-Forwarded-Encrypted: i=1; AKwUvBymwHf0yS8Oucd5LKBCgOVM3tbKBDg9g3KxQYWz87ZNtK8JYzgVPsL0GM+ZMnFV+Dy66125Fa0zW8eviZk=@vger.kernel.org X-Gm-Message-State: APuU4Z9rs9cavvu1ZB4aQBaJkpEzkBCtSAmA8kuOZfgmjY4myjUrX4xf 0LpARf2giGrwsZep7ZD6IKKgGndw1Mz7COK67wMhKqbRgGaPSIRsgbE3 X-Gm-Gg: AYBFou2D1AyGsBE9OgkCx5KoXmBZTYws5926sCIdRlTTdToQKG7tTb1QTyduRG3ldAB OI5BHLyVnIPF/mHX87USWRBRHVGZrwXmIYWNGje9WrUHdDeuKSEPGKoVc3mo3D8vcaPQi8CX0g2 7u//69owxOTTTafeZrsmQe4EghQhBkDOstzuTh3g8JFgEtyyd3PMlm6sCjNB8iGPTrsMQXvoQsm Njmc0202d9Fe6FUrzsZ0hrfwboOfgaWle6kvmTk/JB0jLBNfLIDGVg3tlo98ZSvAR3gupXZpHq9 cmdokF+4uCZFwCT2meEeAx8fNtS40agpn33L90dgmwfhcIIeGe14KEe630xmSGkmu/bWkOYCe07 NqeLjMIEgDtHqwzZmjq4g0yoN6rFJMpU/hVfl0BBl1vd4z+2buUOIOCGecF9ITcZseTc32CV260 Sv14uWCWB/QSpy66cvMlguJlKyyb9hp5WqYVCRMZ5mt9DhP61cwFCGmzr1fa1dyYdTpKZxDbL24 Kww58TEHkQctcBunN12z60enjS0Annm0kFkXeAlgdcHYGP6Yz1F81MEyXqZaey9lwzJsK2YjNs7 AIO8uyRITh9K4xJ1nlUsBBb4dwyoxnuV6IJRNpFuRs2sG3bxz8uZVa/ZxK06cr79djI= X-Received: by 2002:a05:7301:f0c:b0:36a:18e2:64c with SMTP id 5a478bee46e88-36f75a2afd9mr5001824eec.11.1794017032952; Fri, 06 Nov 2026 18:03:52 -0800 (PST) Received: from fred-server.tail1cd3ef.ts.net ([166.199.5.81]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-36fa922b205sm10524395eec.11.2026.11.06.18.03.50 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 06 Nov 2026 18:03:52 -0800 (PST) From: Fredric Cover To: Paulo Alcantara , Namjae Jeon Cc: ChenXiaoSong , Tom Talpey , Ronnie Sahlberg , Shyam Prasad N , Bharath SM , linux-cifs@vger.kernel.org, linux-kernel@vger.kernel.org, Fredric Cover Subject: [PATCH 2/2] smb: client: fix double conversion of DFS path in setup_dfs_ref() Date: Sat, 7 Nov 2026 02:02:57 +0000 Message-ID: <20261107020257.363811-3-fredric.cover.lkernel@gmail.com> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20261107020257.363811-1-fredric.cover.lkernel@gmail.com> References: <20261107020257.363811-1-fredric.cover.lkernel@gmail.com> X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit setup_dfs_ref() converts the path from the mount charset to the DFS cache charset (utf8) via dfs_get_path(), and then passes that already converted string to dfs_get_referral(). dfs_cache_find() converts its input again, assuming it is still in the mount charset. When the mount charset is not utf8 (iocharset=iso8859-1, or a kernel built with a non-utf8 CONFIG_NLS_DEFAULT) and the DFS path contains non-ASCII characters, the utf8 bytes are interpreted as mount-charset characters and encoded a second time. For example, "é" is sent as c3 83 c2 a9 instead of c3 a9. The server then fails the second-level referral with STATUS_OBJECT_PATH_NOT_FOUND and the mount fails with -ENOENT, even though the path exists. Pass the unconverted path to dfs_get_referral() so that it is converted exactly once. Such mounts now get past the second-level referral and reach dfs_parse_target_referral(), which is why this change depends on "smb: client: fix out-of-bounds read in dfs_parse_target_referral()". Tested with a Samba DFS root containing a link named "café", mounted with iocharset=iso8859-1 and the single Latin-1 byte 0xe9 in the path: before, the mount failed with -ENOENT; with both patches applied, it succeeds. Signed-off-by: Fredric Cover --- fs/smb/client/dfs.c | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-) diff --git a/fs/smb/client/dfs.c b/fs/smb/client/dfs.c index e6dcaf9b8682..0660c0a1eefb 100644 --- a/fs/smb/client/dfs.c +++ b/fs/smb/client/dfs.c @@ -103,6 +103,7 @@ static int setup_dfs_ref(struct dfs_info3_param *tgt, struct dfs_ref_walk *rw) struct cifs_sb_info *cifs_sb = rw->mnt_ctx->cifs_sb; struct smb3_fs_context *ctx = rw->mnt_ctx->fs_ctx; char *ref_path, *full_path; + const char *raw_path; int rc; set_root_smb_session(rw->mnt_ctx); @@ -114,9 +115,10 @@ static int setup_dfs_ref(struct dfs_info3_param *tgt, struct dfs_ref_walk *rw) if (!tgt || (tgt->server_type == DFS_TYPE_LINK && DFS_INTERLINK(tgt->flags))) - ref_path = dfs_get_path(cifs_sb, ctx->UNC); + raw_path = ctx->UNC; else - ref_path = dfs_get_path(cifs_sb, full_path); + raw_path = full_path; + ref_path = dfs_get_path(cifs_sb, raw_path); if (IS_ERR(ref_path)) { rc = PTR_ERR(ref_path); kfree(full_path); @@ -125,9 +127,13 @@ static int setup_dfs_ref(struct dfs_info3_param *tgt, struct dfs_ref_walk *rw) ref_walk_path(rw) = ref_path; ref_walk_fpath(rw) = full_path; - return dfs_get_referral(rw->mnt_ctx, - ref_walk_path(rw) + 1, - ref_walk_tl(rw)); + /* + * dfs_cache_find() canonicalizes its input from the mount's charset, so + * give it the raw path. Passing ref_walk_path() (already in the cache + * charset) would convert it a second time. + */ + + return dfs_get_referral(rw->mnt_ctx, raw_path + 1, ref_walk_tl(rw)); } static int __dfs_referral_walk(struct dfs_ref_walk *rw) -- 2.53.0