compound_send_recv() only populates response vectors when resp_iov is non-NULL. The final pre-authentication hash update nevertheless dereferences resp_iov[0] whenever all compound requests complete. Guard the update with resp_iov to match the response-buffer handling and avoid a NULL pointer dereference on callers that do not request response vectors. Fixes: 62432a3f5145 ("cifs: Clean up some places where an extra kvec[] was required for rfc1002") Cc: stable@vger.kernel.org Reported-by: kernel test robot Reported-by: Dan Carpenter Closes: https://lore.kernel.org/all/202609241449.HlHmnZFZ-lkp@intel.com/ Assisted-by: LLM Co-developed-by: Luxing Yin Signed-off-by: Luxing Yin Signed-off-by: Zihan Xi --- fs/smb/client/transport.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/smb/client/transport.c b/fs/smb/client/transport.c index 6e21b5f8754a1..307bd82128781 100644 --- a/fs/smb/client/transport.c +++ b/fs/smb/client/transport.c @@ -1111,7 +1111,7 @@ compound_send_recv(const unsigned int xid, struct cifs_ses *ses, /* * Compounding is never used during session establish. */ - if (num_processed == num_rqst) { + if (num_processed == num_rqst && resp_iov) { spin_lock(&ses->ses_lock); if ((ses->ses_status == SES_NEW) || (optype & CIFS_NEG_OP) || (optype & CIFS_SESS_OP)) { struct kvec iov = { -- 2.43.0