Re: [PATCH] smb: client: Fix NULL pointer dereference in cifs_debug_dirs_proc_show()

[Steve French]

Good catch.

Merged into cifs-2.6.git for-next

On Thu, Aug 28, 2025 at 8:08 PM Wang Zhaolong
<wangzhaolong@xxxxxxxxxxxxxxx> wrote:
>
> Reading /proc/fs/cifs/open_dirs may hit a NULL dereference when
> tcon->cfids is NULL.
>
> Add NULL check before accessing cfids to prevent the crash.
>
> Reproduction:
> - Mount CIFS share
> - cat /proc/fs/cifs/open_dirs
>
> Fixes: 844e5c0eb176 ("smb3 client: add way to show directory leases for improved debugging")
> Signed-off-by: Wang Zhaolong <wangzhaolong@xxxxxxxxxxxxxxx>
> ---
>  fs/smb/client/cifs_debug.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/fs/smb/client/cifs_debug.c b/fs/smb/client/cifs_debug.c
> index beb4f18f05ef..edb2e7f7fc23 100644
> --- a/fs/smb/client/cifs_debug.c
> +++ b/fs/smb/client/cifs_debug.c
> @@ -302,10 +302,12 @@ static int cifs_debug_dirs_proc_show(struct seq_file *m, void *v)
>                 list_for_each(tmp, &server->smb_ses_list) {
>                         ses = list_entry(tmp, struct cifs_ses, smb_ses_list);
>                         list_for_each(tmp1, &ses->tcon_list) {
>                                 tcon = list_entry(tmp1, struct cifs_tcon, tcon_list);
>                                 cfids = tcon->cfids;
> +                               if (!cfids)
> +                                       continue;
>                                 spin_lock(&cfids->cfid_list_lock); /* check lock ordering */
>                                 seq_printf(m, "Num entries: %d\n", cfids->num_entries);
>                                 list_for_each_entry(cfid, &cfids->entries, entry) {
>                                         seq_printf(m, "0x%x 0x%llx 0x%llx     %s",
>                                                 tcon->tid,
> @@ -317,12 +319,10 @@ static int cifs_debug_dirs_proc_show(struct seq_file *m, void *v)
>                                         if (cfid->dirents.is_valid)
>                                                 seq_printf(m, ", valid dirents");
>                                         seq_printf(m, "\n");
>                                 }
>                                 spin_unlock(&cfids->cfid_list_lock);
> -
> -
>                         }
>                 }
>         }
>         spin_unlock(&cifs_tcp_ses_lock);
>         seq_putc(m, '\n');
> --
> 2.39.2
>
>


-- 
Thanks,

Steve