]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
cifs: prevent NULL pointer dereference in UTF16 conversion
authorMakar Semyonov <m.semenov@tssltd.ru>
Thu, 4 Sep 2025 12:28:41 +0000 (15:28 +0300)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Tue, 9 Sep 2025 16:58:18 +0000 (18:58 +0200)
commit1f797f062b5cf13a1c2bcc23285361baaa7c9260
treec3a4b201993578683c04a7050b69f5f4ab95d135
parent20080709457bc1e920eb002483d7d981d9b2ac1c
cifs: prevent NULL pointer dereference in UTF16 conversion

commit 70bccd9855dae56942f2b18a08ba137bb54093a0 upstream.

There can be a NULL pointer dereference bug here. NULL is passed to
__cifs_sfu_make_node without checks, which passes it unchecked to
cifs_strndup_to_utf16, which in turn passes it to
cifs_local_to_utf16_bytes where '*from' is dereferenced, causing a crash.

This patch adds a check for NULL 'src' in cifs_strndup_to_utf16 and
returns NULL early to prevent dereferencing NULL pointer.

Found by Linux Verification Center (linuxtesting.org) with SVACE

Signed-off-by: Makar Semyonov <m.semenov@tssltd.ru>
Cc: stable@vger.kernel.org
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
fs/smb/client/cifs_unicode.c