Reading /proc/fs/cifs/open_dirs may hit a NULL dereference when
tcon->cfids is NULL.

Add NULL check before accessing cfids to prevent the crash.

Reproduction:
- Mount CIFS share
- cat /proc/fs/cifs/open_dirs

Fixes: 844e5c0eb176 ("smb3 client: add way to show directory leases for improved debugging")
Signed-off-by: Wang Zhaolong <wangzhaolong@huaweicloud.com>
---
 fs/smb/client/cifs_debug.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/fs/smb/client/cifs_debug.c b/fs/smb/client/cifs_debug.c
index beb4f18f05ef..edb2e7f7fc23 100644
--- a/fs/smb/client/cifs_debug.c
+++ b/fs/smb/client/cifs_debug.c
@@ -302,10 +302,12 @@ static int cifs_debug_dirs_proc_show(struct seq_file *m, void *v)
 		list_for_each(tmp, &server->smb_ses_list) {
 			ses = list_entry(tmp, struct cifs_ses, smb_ses_list);
 			list_for_each(tmp1, &ses->tcon_list) {
 				tcon = list_entry(tmp1, struct cifs_tcon, tcon_list);
 				cfids = tcon->cfids;
+				if (!cfids)
+					continue;
 				spin_lock(&cfids->cfid_list_lock); /* check lock ordering */
 				seq_printf(m, "Num entries: %d\n", cfids->num_entries);
 				list_for_each_entry(cfid, &cfids->entries, entry) {
 					seq_printf(m, "0x%x 0x%llx 0x%llx     %s",
 						tcon->tid,
@@ -317,12 +319,10 @@ static int cifs_debug_dirs_proc_show(struct seq_file *m, void *v)
 					if (cfid->dirents.is_valid)
 						seq_printf(m, ", valid dirents");
 					seq_printf(m, "\n");
 				}
 				spin_unlock(&cfids->cfid_list_lock);
-
-
 			}
 		}
 	}
 	spin_unlock(&cifs_tcp_ses_lock);
 	seq_putc(m, '\n');
-- 
2.39.2

Good catch.

Merged into cifs-2.6.git for-next

On Thu, Aug 28, 2025 at 8:08 PM Wang Zhaolong
<wangzhaolong@huaweicloud.com> wrote:
>
> Reading /proc/fs/cifs/open_dirs may hit a NULL dereference when
> tcon->cfids is NULL.
>
> Add NULL check before accessing cfids to prevent the crash.
>
> Reproduction:
> - Mount CIFS share
> - cat /proc/fs/cifs/open_dirs
>
> Fixes: 844e5c0eb176 ("smb3 client: add way to show directory leases for improved debugging")
> Signed-off-by: Wang Zhaolong <wangzhaolong@huaweicloud.com>
> ---
>  fs/smb/client/cifs_debug.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/fs/smb/client/cifs_debug.c b/fs/smb/client/cifs_debug.c
> index beb4f18f05ef..edb2e7f7fc23 100644
> --- a/fs/smb/client/cifs_debug.c
> +++ b/fs/smb/client/cifs_debug.c
> @@ -302,10 +302,12 @@ static int cifs_debug_dirs_proc_show(struct seq_file *m, void *v)
>                 list_for_each(tmp, &server->smb_ses_list) {
>                         ses = list_entry(tmp, struct cifs_ses, smb_ses_list);
>                         list_for_each(tmp1, &ses->tcon_list) {
>                                 tcon = list_entry(tmp1, struct cifs_tcon, tcon_list);
>                                 cfids = tcon->cfids;
> +                               if (!cfids)
> +                                       continue;
>                                 spin_lock(&cfids->cfid_list_lock); /* check lock ordering */
>                                 seq_printf(m, "Num entries: %d\n", cfids->num_entries);
>                                 list_for_each_entry(cfid, &cfids->entries, entry) {
>                                         seq_printf(m, "0x%x 0x%llx 0x%llx     %s",
>                                                 tcon->tid,
> @@ -317,12 +319,10 @@ static int cifs_debug_dirs_proc_show(struct seq_file *m, void *v)
>                                         if (cfid->dirents.is_valid)
>                                                 seq_printf(m, ", valid dirents");
>                                         seq_printf(m, "\n");
>                                 }
>                                 spin_unlock(&cfids->cfid_list_lock);
> -
> -
>                         }
>                 }
>         }
>         spin_unlock(&cifs_tcp_ses_lock);
>         seq_putc(m, '\n');
> --
> 2.39.2
>
>


-- 
Thanks,

Steve