Patch "afs: Fix afs_atcell_get_link() to check if ws_cell is unset first" has been added to the 6.12-stable tree

[gregkh at linuxfoundation.org]

This is a note to let you know that I've just added the patch titled

    afs: Fix afs_atcell_get_link() to check if ws_cell is unset first

to the 6.12-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     afs-fix-afs_atcell_get_link-to-check-if-ws_cell-is-unset-first.patch
and it can be found in the queue-6.12 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable at vger.kernel.org> know about it.


>From 0307d16f3610eb29ad0b7529846de7d62fed60ca Mon Sep 17 00:00:00 2001
From: David Howells <dhowells at redhat.com>
Date: Tue, 18 Mar 2025 11:20:19 +0000
Subject: afs: Fix afs_atcell_get_link() to check if ws_cell is unset first

From: David Howells <dhowells at redhat.com>

commit 0307d16f3610eb29ad0b7529846de7d62fed60ca upstream.

Fix afs_atcell_get_link() to check if the workstation cell is unset before
doing the RCU pathwalk bit where we dereference that.

Fixes: 823869e1e616 ("afs: Fix afs_atcell_get_link() to handle RCU pathwalk")
Reported-by: syzbot+76a6f18e3af82e84f264 at syzkaller.appspotmail.com
Signed-off-by: David Howells <dhowells at redhat.com>
Link: https://lore.kernel.org/r/2481796.1742296819@warthog.procyon.org.uk
Tested-by: syzbot+76a6f18e3af82e84f264 at syzkaller.appspotmail.com
cc: Marc Dionne <marc.dionne at auristor.com>
cc: linux-afs at lists.infradead.org
cc: linux-fsdevel at vger.kernel.org
Signed-off-by: Christian Brauner <brauner at kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
---
 fs/afs/dynroot.c |    6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

--- a/fs/afs/dynroot.c
+++ b/fs/afs/dynroot.c
@@ -209,6 +209,9 @@ static const char *afs_atcell_get_link(s
 	const char *name;
 	bool dotted = vnode->fid.vnode == 3;
 
+	if (!rcu_access_pointer(net->ws_cell))
+		return ERR_PTR(-ENOENT);
+
 	if (!dentry) {
 		/* We're in RCU-pathwalk. */
 		cell = rcu_dereference(net->ws_cell);
@@ -220,9 +223,6 @@ static const char *afs_atcell_get_link(s
 		return name;
 	}
 
-	if (!rcu_access_pointer(net->ws_cell))
-		return ERR_PTR(-ENOENT);
-
 	down_read(&net->cells_lock);
 
 	cell = rcu_dereference_protected(net->ws_cell, lockdep_is_held(&net->cells_lock));


Patches currently in stable-queue which might be from dhowells at redhat.com are

queue-6.12/afs-fix-error-code-in-afs_extract_vl_addrs.patch
queue-6.12/afs-add-rootcell-checks.patch
queue-6.12/afs-fix-missing-null-pointer-check-in-afs_break_some.patch
queue-6.12/rxrpc-rxrpc_verify_data-ensure-rx_dec_buffer-alloc.patch
queue-6.12/afs-make-afs-.-cell-as-well-as-afs-cell-mountpoints.patch
queue-6.12/netfs-fix-writeback-error-handling.patch
queue-6.12/afs-fix-further-netns-teardown-to-cancel-the-preallocation-charger.patch
queue-6.12/afs-fix-netns-teardown-to-cancel-the-preallocation-charger.patch
queue-6.12/afs-fix-afs_dynroot_readdir-to-not-use-the-rcu-read-lock.patch
queue-6.12/afs-fix-misplaced-inc-of-net-cells_outstanding.patch
queue-6.12/afs-use-kvfree-to-free-memory-allocated-by-kvcalloc.patch
queue-6.12/netfs-drop-the-error-arg-from-netfs_read_subreq_term.patch
queue-6.12/cifs-fix-missing-credit-release-on-failure-in-cifs_i.patch
queue-6.12/afs-fix-afs_atcell_get_link-to-handle-rcu-pathwalk.patch
queue-6.12/afs-fix-unchecked-length-string-display-in-debug-sta.patch
queue-6.12/afs-fix-vllist-leak.patch
queue-6.12/rxrpc-fix-leak-of-released-call-in-recvmsg-msg_peek.patch
queue-6.12/afs-fix-double-netfs-initialisation-in-afs_root_iget.patch
queue-6.12/afs-fix-null-pointer-dereference-in-afs_get_tree.patch
queue-6.12/afs-fix-the-volume-afs_volume_rm_tree-is-set-on.patch
queue-6.12/afs-remove-erroneous-seq-1-in-volume-lookup-loop.patch
queue-6.12/afs-fix-callback-service-message-parsers-to-pass-thr.patch
queue-6.12/afs-fix-afs_atcell_get_link-to-check-if-ws_cell-is-unset-first.patch
queue-6.12/afs-make-afs-cell-and-afs-.-cell-symlinks.patch
queue-6.12/afs-remove-the-autocell-mount-option.patch
queue-6.12/afs-change-dynroot-to-create-contents-on-demand.patch