Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

cifs: prevent NULL pointer dereference in UTF16 conversion

There can be a NULL pointer dereference bug here. NULL is passed to
__cifs_sfu_make_node without checks, which passes it unchecked to
cifs_strndup_to_utf16, which in turn passes it to
cifs_local_to_utf16_bytes where '*from' is dereferenced, causing a crash.

This patch adds a check for NULL 'src' in cifs_strndup_to_utf16 and
returns NULL early to prevent dereferencing NULL pointer.

Found by Linux Verification Center (linuxtesting.org) with SVACE

Signed-off-by: Makar Semyonov <m.semenov@tssltd.ru>
Cc: stable@vger.kernel.org
Signed-off-by: Steve French <stfrench@microsoft.com>

authored by

Makar Semyonov and committed by
Steve French
70bccd98 91be128b

+3
+3
fs/smb/client/cifs_unicode.c
··· 629 629 int len; 630 630 __le16 *dst; 631 631 632 + if (!src) 633 + return NULL; 634 + 632 635 len = cifs_local_to_utf16_bytes(src, maxlen, cp); 633 636 len += 2; /* NULL */ 634 637 dst = kmalloc(len, GFP_KERNEL);