From: Alexandra Diupina <adiupina@astralinux.ru> mainline inclusion from mainline-v6.15-rc1 commit b4885bd5935bb26f0a414ad55679a372e53f9b9b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC6Q1P CVE: CVE-2025-37844 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?i... -------------------------------- cifs_server_dbg() implies server to be non-NULL so move call under condition to avoid NULL pointer dereference. Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: e79b0332ae06 ("cifs: ignore cached share root handle closing errors") Cc: stable@vger.kernel.org Signed-off-by: Alexandra Diupina <adiupina@astralinux.ru> Signed-off-by: Steve French <stfrench@microsoft.com> Conflicts: fs/smb/client/smb2misc.c fs/cifs/smb2misc.c [The file path has been changed.] Signed-off-by: Wang Zhaolong <wangzhaolong1@huawei.com> --- fs/cifs/smb2misc.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/fs/cifs/smb2misc.c b/fs/cifs/smb2misc.c index edffa5657d26..074a56796092 100644 --- a/fs/cifs/smb2misc.c +++ b/fs/cifs/smb2misc.c @@ -807,15 +807,16 @@ smb2_handle_cancelled_close(struct cifs_tcon *tcon, __u64 persistent_fid, struct TCP_Server_Info *server = NULL; WARN_ONCE(tcon->tc_count < 0, "tcon refcount is negative"); spin_unlock(&cifs_tcp_ses_lock); - if (tcon->ses) + if (tcon->ses) { server = tcon->ses->server; - cifs_server_dbg(FYI, "tid=%u: tcon is closing, skipping async close retry of fid %llu %llu\n", - tcon->tid, persistent_fid, volatile_fid); + cifs_server_dbg(FYI, "tid=%u: tcon is closing, skipping async close retry of fid %llu %llu\n", + tcon->tid, persistent_fid, volatile_fid); + } return 0; } tcon->tc_count++; spin_unlock(&cifs_tcp_ses_lock); -- 2.34.3