From: Pali Rohár Date: Fri, 27 Sep 2024 18:20:39 +0000 (+0200) Subject: cifs: Check for UTF-16 null codepoint in SFU symlink target location X-Git-Tag: v6.12-rc2~29^2~8 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=a9023656bcd28aaf184974a121d3c2f2ec1ded46;p=thirdparty%2Fkernel%2Flinux.git cifs: Check for UTF-16 null codepoint in SFU symlink target location Check that read buffer of SFU symlink target location does not contain UTF-16 null codepoint (via UniStrnlen() call) because Linux cannot process symlink with null byte, it truncates everything in buffer after null byte. Fixes: cf2ce67345d6 ("cifs: Add support for reading SFU symlink location") Signed-off-by: Pali Rohár Signed-off-by: Steve French --- diff --git a/fs/smb/client/inode.c b/fs/smb/client/inode.c index 647f9bedd9fc4..eff3f57235eef 100644 --- a/fs/smb/client/inode.c +++ b/fs/smb/client/inode.c @@ -629,10 +629,16 @@ cifs_sfu_type(struct cifs_fattr *fattr, const char *path, &symlink_len_utf16, &symlink_buf_utf16, &buf_type); + /* + * Check that read buffer has valid length and does not + * contain UTF-16 null codepoint (via UniStrnlen() call) + * because Linux cannot process symlink with null byte. + */ if ((rc == 0) && (symlink_len_utf16 > 0) && (symlink_len_utf16 < fattr->cf_eof-8 + 1) && - (symlink_len_utf16 % 2 == 0)) { + (symlink_len_utf16 % 2 == 0) && + (UniStrnlen((wchar_t *)symlink_buf_utf16, symlink_len_utf16/2) == symlink_len_utf16/2)) { fattr->cf_symlink_target = cifs_strndup_from_utf16(symlink_buf_utf16, symlink_len_utf16,