linux-kernel - Re: [PATCH] smb: client: Fix NULL pointer dereference in cifs_debug_dirs_proc

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CAH2r5ms7biGGTARH=cXPz80HaEcysRQztYgYHLL0vLTaVRsOBw@mail.gmail.com>
Date: Fri, 29 Aug 2025 12:05:02 -0500
From: Steve French <smfrench@...il.com>
To: Wang Zhaolong <wangzhaolong@...weicloud.com>
Cc: bharathsm@...rosoft.com, linux-cifs@...r.kernel.org, 
	samba-technical@...ts.samba.org, linux-kernel@...r.kernel.org, 
	chengzhihao1@...wei.com, yi.zhang@...wei.com, yangerkun@...wei.com
Subject: Re: [PATCH] smb: client: Fix NULL pointer dereference in cifs_debug_dirs_proc_show()

Good catch.

Merged into cifs-2.6.git for-next

On Thu, Aug 28, 2025 at 8:08 PM Wang Zhaolong
<wangzhaolong@...weicloud.com> wrote:
>
> Reading /proc/fs/cifs/open_dirs may hit a NULL dereference when
> tcon->cfids is NULL.
>
> Add NULL check before accessing cfids to prevent the crash.
>
> Reproduction:
> - Mount CIFS share
> - cat /proc/fs/cifs/open_dirs
>
> Fixes: 844e5c0eb176 ("smb3 client: add way to show directory leases for improved debugging")
> Signed-off-by: Wang Zhaolong <wangzhaolong@...weicloud.com>
> ---
>  fs/smb/client/cifs_debug.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/fs/smb/client/cifs_debug.c b/fs/smb/client/cifs_debug.c
> index beb4f18f05ef..edb2e7f7fc23 100644
> --- a/fs/smb/client/cifs_debug.c
> +++ b/fs/smb/client/cifs_debug.c
> @@ -302,10 +302,12 @@ static int cifs_debug_dirs_proc_show(struct seq_file *m, void *v)
>                 list_for_each(tmp, &server->smb_ses_list) {
>                         ses = list_entry(tmp, struct cifs_ses, smb_ses_list);
>                         list_for_each(tmp1, &ses->tcon_list) {
>                                 tcon = list_entry(tmp1, struct cifs_tcon, tcon_list);
>                                 cfids = tcon->cfids;
> +                               if (!cfids)
> +                                       continue;
>                                 spin_lock(&cfids->cfid_list_lock); /* check lock ordering */
>                                 seq_printf(m, "Num entries: %d\n", cfids->num_entries);
>                                 list_for_each_entry(cfid, &cfids->entries, entry) {
>                                         seq_printf(m, "0x%x 0x%llx 0x%llx     %s",
>                                                 tcon->tid,
> @@ -317,12 +319,10 @@ static int cifs_debug_dirs_proc_show(struct seq_file *m, void *v)
>                                         if (cfid->dirents.is_valid)
>                                                 seq_printf(m, ", valid dirents");
>                                         seq_printf(m, "\n");
>                                 }
>                                 spin_unlock(&cfids->cfid_list_lock);
> -
> -
>                         }
>                 }
>         }
>         spin_unlock(&cifs_tcp_ses_lock);
>         seq_putc(m, '\n');
> --
> 2.39.2
>
>


-- 
Thanks,

Steve