* [PATCH] smb: client: Fix NULL pointer dereference in cifs_debug_dirs_proc_show()
@ 2025-08-29 0:59 Wang Zhaolong
2025-08-29 17:05 ` Steve French
0 siblings, 1 reply; 2+ messages in thread
From: Wang Zhaolong @ 2025-08-29 0:59 UTC (permalink / raw)
To: sfrench, bharathsm
Cc: linux-cifs, samba-technical, linux-kernel, chengzhihao1, yi.zhang,
yangerkun
Reading /proc/fs/cifs/open_dirs may hit a NULL dereference when
tcon->cfids is NULL.
Add NULL check before accessing cfids to prevent the crash.
Reproduction:
- Mount CIFS share
- cat /proc/fs/cifs/open_dirs
Fixes: 844e5c0eb176 ("smb3 client: add way to show directory leases for improved debugging")
Signed-off-by: Wang Zhaolong <wangzhaolong@huaweicloud.com>
---
fs/smb/client/cifs_debug.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/fs/smb/client/cifs_debug.c b/fs/smb/client/cifs_debug.c
index beb4f18f05ef..edb2e7f7fc23 100644
--- a/fs/smb/client/cifs_debug.c
+++ b/fs/smb/client/cifs_debug.c
@@ -302,10 +302,12 @@ static int cifs_debug_dirs_proc_show(struct seq_file *m, void *v)
list_for_each(tmp, &server->smb_ses_list) {
ses = list_entry(tmp, struct cifs_ses, smb_ses_list);
list_for_each(tmp1, &ses->tcon_list) {
tcon = list_entry(tmp1, struct cifs_tcon, tcon_list);
cfids = tcon->cfids;
+ if (!cfids)
+ continue;
spin_lock(&cfids->cfid_list_lock); /* check lock ordering */
seq_printf(m, "Num entries: %d\n", cfids->num_entries);
list_for_each_entry(cfid, &cfids->entries, entry) {
seq_printf(m, "0x%x 0x%llx 0x%llx %s",
tcon->tid,
@@ -317,12 +319,10 @@ static int cifs_debug_dirs_proc_show(struct seq_file *m, void *v)
if (cfid->dirents.is_valid)
seq_printf(m, ", valid dirents");
seq_printf(m, "\n");
}
spin_unlock(&cfids->cfid_list_lock);
-
-
}
}
}
spin_unlock(&cifs_tcp_ses_lock);
seq_putc(m, '\n');
--
2.39.2
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH] smb: client: Fix NULL pointer dereference in cifs_debug_dirs_proc_show()
2025-08-29 0:59 [PATCH] smb: client: Fix NULL pointer dereference in cifs_debug_dirs_proc_show() Wang Zhaolong
@ 2025-08-29 17:05 ` Steve French
0 siblings, 0 replies; 2+ messages in thread
From: Steve French @ 2025-08-29 17:05 UTC (permalink / raw)
To: Wang Zhaolong
Cc: bharathsm, linux-cifs, samba-technical, linux-kernel,
chengzhihao1, yi.zhang, yangerkun
Good catch.
Merged into cifs-2.6.git for-next
On Thu, Aug 28, 2025 at 8:08 PM Wang Zhaolong
<wangzhaolong@huaweicloud.com> wrote:
>
> Reading /proc/fs/cifs/open_dirs may hit a NULL dereference when
> tcon->cfids is NULL.
>
> Add NULL check before accessing cfids to prevent the crash.
>
> Reproduction:
> - Mount CIFS share
> - cat /proc/fs/cifs/open_dirs
>
> Fixes: 844e5c0eb176 ("smb3 client: add way to show directory leases for improved debugging")
> Signed-off-by: Wang Zhaolong <wangzhaolong@huaweicloud.com>
> ---
> fs/smb/client/cifs_debug.c | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/fs/smb/client/cifs_debug.c b/fs/smb/client/cifs_debug.c
> index beb4f18f05ef..edb2e7f7fc23 100644
> --- a/fs/smb/client/cifs_debug.c
> +++ b/fs/smb/client/cifs_debug.c
> @@ -302,10 +302,12 @@ static int cifs_debug_dirs_proc_show(struct seq_file *m, void *v)
> list_for_each(tmp, &server->smb_ses_list) {
> ses = list_entry(tmp, struct cifs_ses, smb_ses_list);
> list_for_each(tmp1, &ses->tcon_list) {
> tcon = list_entry(tmp1, struct cifs_tcon, tcon_list);
> cfids = tcon->cfids;
> + if (!cfids)
> + continue;
> spin_lock(&cfids->cfid_list_lock); /* check lock ordering */
> seq_printf(m, "Num entries: %d\n", cfids->num_entries);
> list_for_each_entry(cfid, &cfids->entries, entry) {
> seq_printf(m, "0x%x 0x%llx 0x%llx %s",
> tcon->tid,
> @@ -317,12 +319,10 @@ static int cifs_debug_dirs_proc_show(struct seq_file *m, void *v)
> if (cfid->dirents.is_valid)
> seq_printf(m, ", valid dirents");
> seq_printf(m, "\n");
> }
> spin_unlock(&cfids->cfid_list_lock);
> -
> -
> }
> }
> }
> spin_unlock(&cifs_tcp_ses_lock);
> seq_putc(m, '\n');
> --
> 2.39.2
>
>
--
Thanks,
Steve
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2025-08-29 17:05 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2025-08-29 0:59 [PATCH] smb: client: Fix NULL pointer dereference in cifs_debug_dirs_proc_show() Wang Zhaolong
2025-08-29 17:05 ` Steve French
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).