[PATCH] smb: client: Fix NULL pointer dereference in cifs_debug_dirs_proc_show()

From: Wang Zhaolong
Date: Thu Aug 28 2025 - 21:08:52 EST


Reading /proc/fs/cifs/open_dirs may hit a NULL dereference when
tcon->cfids is NULL.

Add NULL check before accessing cfids to prevent the crash.

Reproduction:
- Mount CIFS share
- cat /proc/fs/cifs/open_dirs

Fixes: 844e5c0eb176 ("smb3 client: add way to show directory leases for improved debugging")
Signed-off-by: Wang Zhaolong <wangzhaolong@xxxxxxxxxxxxxxx>
---
fs/smb/client/cifs_debug.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/fs/smb/client/cifs_debug.c b/fs/smb/client/cifs_debug.c
index beb4f18f05ef..edb2e7f7fc23 100644
--- a/fs/smb/client/cifs_debug.c
+++ b/fs/smb/client/cifs_debug.c
@@ -302,10 +302,12 @@ static int cifs_debug_dirs_proc_show(struct seq_file *m, void *v)
list_for_each(tmp, &server->smb_ses_list) {
ses = list_entry(tmp, struct cifs_ses, smb_ses_list);
list_for_each(tmp1, &ses->tcon_list) {
tcon = list_entry(tmp1, struct cifs_tcon, tcon_list);
cfids = tcon->cfids;
+ if (!cfids)
+ continue;
spin_lock(&cfids->cfid_list_lock); /* check lock ordering */
seq_printf(m, "Num entries: %d\n", cfids->num_entries);
list_for_each_entry(cfid, &cfids->entries, entry) {
seq_printf(m, "0x%x 0x%llx 0x%llx %s",
tcon->tid,
@@ -317,12 +319,10 @@ static int cifs_debug_dirs_proc_show(struct seq_file *m, void *v)
if (cfid->dirents.is_valid)
seq_printf(m, ", valid dirents");
seq_printf(m, "\n");
}
spin_unlock(&cfids->cfid_list_lock);
-
-
}
}
}
spin_unlock(&cifs_tcp_ses_lock);
seq_putc(m, '\n');
--
2.39.2