linux-kernel - Re: [PATCH 2/2] cifs: prevent NULL pointer dereference in UTF16 conversion

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CAH2r5mugqRXD_OH5m_+1dyPyTEmH-Rpdq_6zDiGB8_XOHOMH9w@mail.gmail.com>
Date: Thu, 4 Sep 2025 11:45:25 -0500
From: Steve French <smfrench@...il.com>
To: Makar Semyonov <m.semenov@...ltd.ru>
Cc: Steve French <sfrench@...ba.org>, Paulo Alcantara <pc@...guebit.com>, 
	Ronnie Sahlberg <ronniesahlberg@...il.com>, Shyam Prasad N <sprasad@...rosoft.com>, 
	Tom Talpey <tom@...pey.com>, Bharath SM <bharathsm@...rosoft.com>, linux-cifs@...r.kernel.org, 
	linux-kernel@...r.kernel.org
Subject: Re: [PATCH 2/2] cifs: prevent NULL pointer dereference in UTF16 conversion

merged into cifs-2.6.git for-next and added Cc: stable

On Thu, Sep 4, 2025 at 7:36 AM Makar Semyonov <m.semenov@...ltd.ru> wrote:
>
> There can be a NULL pointer dereference bug here. NULL is passed to
> __cifs_sfu_make_node without checks, which passes it unchecked to
> cifs_strndup_to_utf16, which in turn passes it to
> cifs_local_to_utf16_bytes where '*from' is dereferenced, causing a crash.
>
> This patch adds a check for NULL 'src' in cifs_strndup_to_utf16 and
> returns NULL early to prevent dereferencing NULL pointer.
>
> Found by Linux Verification Center (linuxtesting.org) with SVACE
>
> Signed-off-by: Makar Semyonov <m.semenov@...ltd.ru>
> ---
>  fs/smb/client/cifs_unicode.c | 3 +++
>  1 file changed, 3 insertions(+)
>
> diff --git a/fs/smb/client/cifs_unicode.c b/fs/smb/client/cifs_unicode.c
> index 4cc6e0896fad..1a9324bec7d6 100644
> --- a/fs/smb/client/cifs_unicode.c
> +++ b/fs/smb/client/cifs_unicode.c
> @@ -628,6 +628,9 @@ cifs_strndup_to_utf16(const char *src, const int maxlen, int *utf16_len,
>  {
>         int len;
>         __le16 *dst;
> +
> +       if (!src)
> +               return NULL;
>
>         len = cifs_local_to_utf16_bytes(src, maxlen, cp);
>         len += 2; /* NULL */
> --
> 2.43.0
>
>


-- 
Thanks,

Steve