cifs: Check for UTF-16 null codepoint in SFU symlink target location

Check that read buffer of SFU symlink target location does not contain
UTF-16 null codepoint (via UniStrnlen() call) because Linux cannot process
symlink with null byte, it truncates everything in buffer after null byte.

Fixes: cf2ce67345d6 ("cifs: Add support for reading SFU symlink location")
Signed-off-by: Pali Rohár <[email protected]>
Signed-off-by: Steve French <[email protected]>

diff --git a/fs/smb/client/inode.c b/fs/smb/client/inode.c
index 647f9bedd9fc44c9225f2494c6913a795c2fd6ad..eff3f57235eef3212fa9f7e510335baeecda4485 100644 (file)
--- a/fs/smb/client/inode.c
+++ b/fs/smb/client/inode.c
@@ -629,10 +629,16 @@ cifs_sfu_type(struct cifs_fattr *fattr, const char *path,
                                                                               &symlink_len_utf16,
                                                                               &symlink_buf_utf16,
                                                                               &buf_type);
+                                       /*
+                                        * Check that read buffer has valid length and does not
+                                        * contain UTF-16 null codepoint (via UniStrnlen() call)
+                                        * because Linux cannot process symlink with null byte.
+                                        */
                                        if ((rc == 0) &&
                                            (symlink_len_utf16 > 0) &&
                                            (symlink_len_utf16 < fattr->cf_eof-8 + 1) &&
-                                           (symlink_len_utf16 % 2 == 0)) {
+                                           (symlink_len_utf16 % 2 == 0) &&
+                                           (UniStrnlen((wchar_t *)symlink_buf_utf16, symlink_len_utf16/2) == symlink_len_utf16/2)) {
                                                fattr->cf_symlink_target =
                                                        cifs_strndup_from_utf16(symlink_buf_utf16,
                                                                                symlink_len_utf16,