ksmbd: reserve space for the UTF-16 terminator in stream info

Overview

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: reserve space for the UTF-16 terminator in stream info

smb_strtoUTF16() always writes a terminating zero UTF-16 unit after the converted characters, but get_file_stream_info() budgets only sizeof(struct smb2_file_stream_info) + streamlen * 2 for a stream entry and sizeof(struct smb2_file_stream_info) + 7 * 2 for the trailing "::$DATA" entry. When an entry exactly fills the 448-byte small response buffer, the terminator is written two bytes past the allocation.

Reserve one extra UTF-16 unit in both budget checks. The terminator is not part of the wire format, so the reported lengths are unchanged.

Affected

• Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 06a751809ebd33e95b05bf733697318a17a4872b
• Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 0e64f89563164719ceb1aa33f2a8bfd6391fa340
• Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < a025c4991a7d83edc4dd339e3ea86d8ff6226eca
• Linux < 6.18.61
• Linux < 7.3.2
• Linux (all versions)

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.