[SRU][J][PATCH 1/1] ksmbd: prevent rename with empty string

[Cengiz Can]

From: Namjae Jeon <linkinjeon at kernel.org>

Client can send empty newname string to ksmbd server.
It will cause a kernel oops from d_alloc.
This patch return the error when attempting to rename
a file or directory with an empty new name string.

Cc: stable at vger.kernel.org
Reported-by: Norbert Szetei <norbert at doyensec.com>
Tested-by: Norbert Szetei <norbert at doyensec.com>
Signed-off-by: Namjae Jeon <linkinjeon at kernel.org>
Signed-off-by: Steve French <stfrench at microsoft.com>
(backported from commit 53e3e5babc0963a92d856a5ec0ce92c59f54bc12)
[bot_kybele: Applied to fs/ksmbd/smb2pdu.c (file renamed from
 fs/smb/server/smb2pdu.c upstream); this tree's smb2_get_name lacks the
 leading-slash check that upstream showed as context, so only the empty-string
 ('\0') check was added.]
CVE-2025-37956
Assisted-by: kybele:claude-opus-4.8
Signed-off-by: Cengiz Can <cengiz.can at canonical.com>
---
 fs/ksmbd/smb2pdu.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/fs/ksmbd/smb2pdu.c b/fs/ksmbd/smb2pdu.c
index f85c6e6cbfd6..191c673b8afa 100644
--- a/fs/ksmbd/smb2pdu.c
+++ b/fs/ksmbd/smb2pdu.c
@@ -665,6 +665,11 @@ smb2_get_name(const char *src, const int maxlen, struct nls_table *local_nls)
 		return name;
 	}
 
+	if (*name == '\0') {
+		kfree(name);
+		return ERR_PTR(-EINVAL);
+	}
+
 	ksmbd_conv_path_to_unix(name);
 	ksmbd_strip_last_slash(name);
 	return name;
-- 
2.53.0