From: Steve French <stfrench@xxxxxxxxxxxxx> [ Upstream commit 87f93d82e0952da18af4d978e7d887b4c5326c0b ] Add check for null cifs_sb to create_options helper Signed-off-by: Steve French <stfrench@xxxxxxxxxxxxx> Reviewed-by: Amir Goldstein <amir73il@xxxxxxxxx> Reviewed-by: Aurelien Aptel <aaptel@xxxxxxxx> Signed-off-by: Pratyush Yadav <ptyadav@xxxxxxxxx> --- Only compile-tested. This was discovered by our static code analysis tool. I do not use CIFS and do not know how to actually reproduce the NULL dereference. Follow up from [0]. Original patch is at [1]. Mandatory text due to licensing terms: This bug was discovered and resolved using Coverity Static Analysis Security Testing (SAST) by Synopsys, Inc. [0] https://lore.kernel.org/stable/20230405114220.108739-1-ptyadav@xxxxxxxxx/T/#u [1] https://lore.kernel.org/all/CAH2r5mtu69KEWU94qZK32H_8cvyhVU8GyOKrZqbdjH0ZLd95Zg@xxxxxxxxxxxxxx/ fs/cifs/cifsproto.h | 2 +- fs/cifs/smb2ops.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/fs/cifs/cifsproto.h b/fs/cifs/cifsproto.h index a5fab9afd699f..2dde83a969680 100644 --- a/fs/cifs/cifsproto.h +++ b/fs/cifs/cifsproto.h @@ -602,7 +602,7 @@ static inline int get_dfs_path(const unsigned int xid, struct cifs_ses *ses, static inline int cifs_create_options(struct cifs_sb_info *cifs_sb, int options) { - if (backup_cred(cifs_sb)) + if (cifs_sb && (backup_cred(cifs_sb))) return options | CREATE_OPEN_BACKUP_INTENT; else return options; diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c index 4cb0ebe7330eb..44a261b9850de 100644 --- a/fs/cifs/smb2ops.c +++ b/fs/cifs/smb2ops.c @@ -2343,7 +2343,7 @@ smb2_queryfs(const unsigned int xid, struct cifs_tcon *tcon, FS_FULL_SIZE_INFORMATION, SMB2_O_INFO_FILESYSTEM, sizeof(struct smb2_fs_full_size_info), - &rsp_iov, &buftype, NULL); + &rsp_iov, &buftype, cifs_sb); if (rc) goto qfs_exit; -- 2.39.2
