linux-yocto/fs
Makar Semyonov 3c26a8d30e cifs: prevent NULL pointer dereference in UTF16 conversion
commit 70bccd9855dae56942f2b18a08ba137bb54093a0 upstream.

There can be a NULL pointer dereference bug here. NULL is passed to
__cifs_sfu_make_node without checks, which passes it unchecked to
cifs_strndup_to_utf16, which in turn passes it to
cifs_local_to_utf16_bytes where '*from' is dereferenced, causing a crash.

This patch adds a check for NULL 'src' in cifs_strndup_to_utf16 and
returns NULL early to prevent dereferencing NULL pointer.

Found by Linux Verification Center (linuxtesting.org) with SVACE

Signed-off-by: Makar Semyonov <m.semenov@tssltd.ru>
Cc: stable@vger.kernel.org
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-09-09 19:02:34 +02:00
..
9p vfs-6.16-rc1.netfs 2025-06-02 15:04:06 -07:00
adfs Merge patch series "adfs, affs, befs, hfs, hfsplus: convert to new mount api" 2024-10-08 14:41:53 +02:00
affs vfs-6.15-rc1.async.dir 2025-03-24 10:47:14 -07:00
afs afs: Set vllist to NULL if addr parsing fails 2025-07-23 13:54:34 +02:00
autofs VFS: rename lookup_one_len family to lookup_noperm and remove permission check 2025-04-08 11:24:36 +02:00
bcachefs bcachefs: Add missing snapshots_seen_add_inorder() 2025-07-24 22:56:37 -04:00
befs befs: convert befs to use the new mount api 2024-09-18 11:44:43 +02:00
bfs bfs: convert bfs to use the new mount api 2025-04-07 09:36:20 +02:00
btrfs btrfs: zoned: skip ZONE FINISH of conventional zones 2025-09-09 19:02:16 +02:00
cachefiles cachefiles: Fix the incorrect return value in __cachefiles_write() 2025-07-10 09:40:17 +02:00
ceph parse_longname(): strrchr() expects NUL-terminated string 2025-08-15 16:38:21 +02:00
coda Change inode_operations.mkdir to return struct dentry * 2025-02-27 20:00:17 +01:00
configfs - The 3 patch series "hung_task: extend blocking task stacktrace dump to 2025-05-31 19:12:53 -07:00
cramfs
crypto fscrypt: Don't use problematic non-inline crypto engines 2025-08-20 18:40:48 +02:00
debugfs debugfs: fix mount options not being applied 2025-08-28 16:34:38 +02:00
devpts devpts: Fix type for uid and gid params 2025-04-07 15:22:12 +02:00
dlm treewide, timers: Rename from_timer() to timer_container_of() 2025-06-08 09:07:37 +02:00
ecryptfs VFS: rename lookup_one_len family to lookup_noperm and remove permission check 2025-04-08 11:24:36 +02:00
efivarfs efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare 2025-09-04 16:55:43 +02:00
efs efs: fix the efs new mount api implementation 2024-10-15 15:58:36 +02:00
erofs erofs: fix atomic context detection when !CONFIG_DEBUG_LOCK_ALLOC 2025-09-04 16:55:31 +02:00
exfat exfat: add cluster chain loop check for dir 2025-08-20 18:41:29 +02:00
exportfs readdir: supply dir_context.count as readdir buffer size hint 2025-05-29 12:31:23 +02:00
ext2 ext2: Handle fiemap on empty files to prevent EINVAL 2025-08-20 18:40:56 +02:00
ext4 ext4: fix hole length calculation overflow in non-extent inodes 2025-08-28 16:34:15 +02:00
f2fs f2fs: fix to avoid out-of-boundary access in dnode page 2025-08-28 16:34:25 +02:00
fat Change inode_operations.mkdir to return struct dentry * 2025-02-27 20:00:17 +01:00
freevxfs freevxfs: Replace one-element array with flexible array member 2024-11-06 10:42:06 +01:00
fuse vfs-6.16-rc5.fixes 2025-07-04 09:06:49 -07:00
gfs2 gfs2: Set .migrate_folio in gfs2_{rgrp,meta}_aops 2025-08-20 18:40:54 +02:00
hfs hfs: fix not erasing deleted b-tree node issue 2025-08-20 18:40:55 +02:00
hfsplus hfsplus: don't use BUG_ON() in hfsplus_create_attributes_file() 2025-08-20 18:40:53 +02:00
hostfs Updates for UML for this cycle, notably: 2025-04-02 12:25:03 -07:00
hpfs Change inode_operations.mkdir to return struct dentry * 2025-02-27 20:00:17 +01:00
hugetlbfs - The 6 patch series "Enable strict percpu address space checks" from 2025-04-01 09:29:18 -07:00
iomap iomap: Fix broken data integrity guarantees for O_SYNC writes 2025-08-28 16:34:25 +02:00
isofs isofs: Verify inode mode when loading from disk 2025-07-11 11:39:31 +02:00
jbd2 jbd2: prevent softlockup in jbd2_log_do_checkpoint() 2025-08-28 16:34:25 +02:00
jffs2 jffs2: check jffs2_prealloc_raw_node_refs() result in few other places 2025-05-22 20:54:38 +02:00
jfs jfs: upper bound check of tree index in dbAllocAG 2025-08-20 18:41:23 +02:00
kernfs Driver core changes for 6.16-rc1 2025-05-29 09:11:39 -07:00
lockd sysctl: Fixes nsm_local_state bounds 2025-03-10 09:11:13 -04:00
minix Change inode_operations.mkdir to return struct dentry * 2025-02-27 20:00:17 +01:00
netfs netfs: Fix unbuffered write error handling 2025-08-28 16:34:13 +02:00
nfs NFS: Fix a race when updating an existing write 2025-08-28 16:34:35 +02:00
nfs_common NFS/localio: nfs_uuid_put() fix the wake up after unlinking the file 2025-08-15 16:39:27 +02:00
nfsd NFSD: detect mismatch of file handle and delegation stateid in OPEN op 2025-08-20 18:40:47 +02:00
nilfs2 nilfs2: reject invalid file types when reading inodes 2025-07-19 19:26:16 -07:00
nls move asm/unaligned.h to linux/unaligned.h 2024-10-02 17:23:23 -04:00
notify fanotify: sanitize handle_type values when reporting fid 2025-08-15 16:39:02 +02:00
ntfs3 fs/ntfs3: correctly create symlink for relative path 2025-08-20 18:40:55 +02:00
ocfs2 ocfs2: prevent release journal inode after journal shutdown 2025-09-09 19:02:31 +02:00
omfs omfs: convert to new mount API 2025-04-28 10:54:39 +02:00
openpromfs
orangefs fs/orangefs: use snprintf() instead of sprintf() 2025-08-20 18:41:22 +02:00
overlayfs ovl: use I_MUTEX_PARENT when locking parent in ovl_create_temp() 2025-08-28 16:34:41 +02:00
proc proc: fix missing pde_set_flags() for net proc files 2025-09-09 19:02:31 +02:00
pstore treewide: Switch/rename to timer_delete[_sync]() 2025-04-05 10:30:12 +02:00
qnx4
qnx6 fs/qnx6: Fix building with GCC 15 2024-12-03 10:40:36 +01:00
quota VFS: rename lookup_one_len family to lookup_noperm and remove permission check 2025-04-08 11:24:36 +02:00
ramfs Change inode_operations.mkdir to return struct dentry * 2025-02-27 20:00:17 +01:00
resctrl x86,fs/resctrl: Remove inappropriate references to cacheinfo in the resctrl subsystem 2025-06-16 21:06:12 +02:00
romfs
smb cifs: prevent NULL pointer dereference in UTF16 conversion 2025-09-09 19:02:34 +02:00
squashfs squashfs: fix memory leak in squashfs_fill_super 2025-08-28 16:34:35 +02:00
sysfs sysfs: constify attribute_group::bin_attrs 2025-04-15 18:46:10 +02:00
tests
tracefs tracefs: Add d_delete to remove negative dentries 2025-08-20 18:40:56 +02:00
ubifs This pull request contains the following fixes for JFFS2 and UBIFS: 2025-06-07 07:24:07 -07:00
udf udf: Verify partition map count 2025-08-20 18:40:54 +02:00
ufs fix the regression in ufs options parsing 2025-07-23 11:45:04 -04:00
unicode unicode: kunit: change tests filename and path 2025-02-12 14:00:11 -08:00
vboxsf vboxsf: Convert to writepages 2025-04-07 09:36:48 +02:00
verity Revert "fsverity: relax build time dependency on CRYPTO_SHA256" 2025-02-17 11:34:15 -08:00
xfs xfs: do not propagate ENODATA disk errors into xattr code 2025-09-04 16:55:48 +02:00
zonefs zonefs: use bdev_rw_virt in zonefs_read_super 2025-05-07 07:31:07 -06:00
aio.c fs: aio: initialize .ki_write_stream of read-write request 2025-05-07 08:00:11 -06:00
anon_inodes.c fs: export anon_inode_make_secure_inode() and fix secretmem LSM bypass 2025-06-23 12:41:17 +02:00
attr.c fs: handle delegated timestamps in setattr_copy_mgtime 2024-10-10 10:20:51 +02:00
backing-file.c tree-wide: s/revert_creds_light()/revert_creds()/g 2024-12-02 11:25:09 +01:00
bad_inode.c Change inode_operations.mkdir to return struct dentry * 2025-02-27 20:00:17 +01:00
binfmt_elf_fdpic.c binfmt_elf_fdpic: fix variable set but not used warning 2025-03-07 20:07:33 -08:00
binfmt_elf.c vfs-6.16-rc1.misc 2025-05-26 09:02:39 -07:00
binfmt_flat.c binfmt_flat: Fix integer overflow bug on 32 bit systems 2025-01-10 08:49:05 -08:00
binfmt_misc.c VFS: rename lookup_one_len family to lookup_noperm and remove permission check 2025-04-08 11:24:36 +02:00
binfmt_script.c
bpf_fs_kfuncs.c bpf: fs/xattr: Add BPF kfuncs to set and remove xattrs 2025-02-13 19:35:32 -08:00
buffer.c fs/buffer: fix use-after-free when call bh_read() helper 2025-08-28 16:34:38 +02:00
char_dev.c fs: Reorganize kerneldoc parameter names 2024-10-22 11:16:57 +02:00
compat_binfmt_elf.c binfmt_elf: Wire up AT_HWCAP3 at AT_HWCAP4 2024-10-17 18:38:49 +01:00
coredump.c coredump: validate socket name as it is written 2025-05-21 13:59:12 +02:00
d_path.c
dax.c vfs-6.16-rc2.fixes 2025-06-02 12:49:16 -07:00
dcache.c vfs-6.16-rc1.misc 2025-05-26 09:02:39 -07:00
direct-io.c
drop_caches.c fs: drop_caches: move sysctl to fs/drop_caches.c 2025-02-07 16:53:04 +01:00
eventfd.c make use of anon_inode_getfile_fmode() 2025-02-21 10:25:31 +01:00
eventpoll.c eventpoll: fix sphinx documentation build warning 2025-08-15 16:38:24 +02:00
exec.c anon_inode: rework assertions 2025-07-02 14:41:39 +02:00
fcntl.c fs: get rid of __FMODE_NONOTIFY kludge 2024-12-09 11:34:29 +01:00
fhandle.c fhandle: do_handle_open() should get FD with user flags 2025-08-28 16:34:38 +02:00
file_table.c fs: Make file-nr output the total allocated file handles 2025-04-21 10:27:58 +02:00
file.c fs: Prevent file descriptor table allocations exceeding INT_MAX 2025-08-20 18:40:48 +02:00
filesystems.c fs/filesystems: Fix potential unsigned integer underflow in fs_name() 2025-04-14 13:05:59 +02:00
fs_context.c fs/fs_context: Mark an unlikely if condition with unlikely() in vfs_parse_monolithic_sep() 2025-04-14 13:05:59 +02:00
fs_parser.c fs/fs_parse: Remove unused and problematic validate_constant_table() 2025-04-21 10:27:59 +02:00
fs_pin.c
fs_struct.c
fs_types.c
fs-writeback.c fs: writeback: fix use-after-free in __mark_inode_dirty() 2025-09-09 19:02:16 +02:00
fsopen.c fs: support O_PATH fds with FSCONFIG_SET_FD 2025-02-12 10:02:10 +01:00
init.c VFS: Change vfs_mkdir() to return the dentry. 2025-03-05 11:52:50 +01:00
inode.c fs: call inode_sb_list_add() outside of inode hash lock 2025-03-20 13:06:51 +01:00
internal.h libfs: massage path_from_stashed() to allow custom stashing behavior 2025-08-28 16:34:38 +02:00
ioctl.c vfs-6.16-rc1.super 2025-05-26 09:33:44 -07:00
Kconfig fs/resctrl: Add boiler plate for external resctrl code 2025-05-16 11:05:40 +02:00
Kconfig.binfmt
kernel_read_file.c fdget(), trivial conversions 2024-11-03 01:28:06 -05:00
libfs.c libfs: massage path_from_stashed() to allow custom stashing behavior 2025-08-28 16:34:38 +02:00
locks.c treewide: const qualify ctl_tables where applicable 2025-01-28 13:48:37 +01:00
Makefile fs/resctrl: Add boiler plate for external resctrl code 2025-05-16 11:05:40 +02:00
mbcache.c
mnt_idmapping.c statmount: allow to retrieve idmappings 2025-02-12 12:12:27 +01:00
mount.h Don't propagate mounts into detached trees 2025-05-26 17:35:32 -04:00
mpage.c fs: use writeback_iter directly in mpage_writepages 2025-05-09 12:37:48 +02:00
namei.c vfs-6.16-rc5.fixes 2025-07-04 09:06:49 -07:00
namespace.c use uniform permission checks for all mount propagation changes 2025-08-28 16:34:38 +02:00
nsfs.c vfs-6.15-rc1.nsfs 2025-03-24 11:38:12 -07:00
open.c fs/open: make do_truncate() killable 2025-05-15 12:03:12 +02:00
pidfs.c pidfs: raise SB_I_NODEV and SB_I_NOEXEC 2025-08-20 18:40:55 +02:00
pipe.c sort.h: hoist cmp_int() into generic header file 2025-05-11 17:54:12 -07:00
pnode.c Don't propagate mounts into detached trees 2025-05-26 17:35:32 -04:00
pnode.h replace collect_mounts()/drop_collected_mounts() with a safer variant 2025-06-23 14:01:49 -04:00
posix_acl.c acl: Annotate struct posix_acl with __counted_by() 2024-10-22 11:16:59 +02:00
proc_namespace.c ->mnt_devname is never NULL 2025-05-23 14:20:44 +02:00
read_write.c fs/read_write: make default_llseek() killable 2025-05-15 12:03:12 +02:00
readdir.c readdir: supply dir_context.count as readdir buffer size hint 2025-05-29 12:31:23 +02:00
remap_range.c convert vfs_dedupe_file_range(). 2024-11-03 01:28:07 -05:00
select.c select: core_sys_select add unlikely branch hint on return path 2025-04-21 10:27:58 +02:00
seq_file.c fs: Reorganize kerneldoc parameter names 2024-10-22 11:16:57 +02:00
signalfd.c make use of anon_inode_getfile_fmode() 2025-02-21 10:25:31 +01:00
splice.c netfs: Fix unbuffered write error handling 2025-08-28 16:34:13 +02:00
stack.c
stat.c xfs: New code for 6.16 2025-05-26 12:56:01 -07:00
statfs.c fdget_raw() users: switch to CLASS(fd_raw) 2024-11-03 01:28:06 -05:00
super.c fs: unlock the superblock during iterate_supers_type 2025-06-12 14:27:39 +02:00
sync.c fdget(), trivial conversions 2024-11-03 01:28:06 -05:00
sysctls.c treewide: const qualify ctl_tables where applicable 2025-01-28 13:48:37 +01:00
timerfd.c A treewide hrtimer timer cleanup 2025-03-25 10:54:15 -07:00
userfaultfd.c mm/userfaultfd: fix uninitialized output field for -EAGAIN race 2025-05-07 23:39:39 -07:00
utimes.c fdget(), more trivial conversions 2024-11-03 01:28:06 -05:00
xattr.c fs/xattr.c: fix simple_xattr_list() 2025-06-06 10:00:17 +02:00