Code: int utf8s_to_utf16s(const u8 *s, int len, wchar_t *pwcs)
 {
 	u16 *op;
 	int size;
 	unicode_t u;
 
 	op = pwcs;
	while (*s && len > 0) {
 		if (*s & 0x80) {
 			size = utf8_to_utf32(s, len, &u);
 			if (size < 0)
 				return -EINVAL;
 
 			if (u >= PLANE_SIZE) {
 				u -= PLANE_SIZE;
				*op++ = (wchar_t) (SURROGATE_PAIR |
						((u >> 10) & SURROGATE_BITS));
				*op++ = (wchar_t) (SURROGATE_PAIR |
 						SURROGATE_LOW |
						(u & SURROGATE_BITS));
 			} else {
				*op++ = (wchar_t) u;
 			}
			s += size;
			len -= size;
 		} else {
			*op++ = *s++;
 			len--;
 		}
 	}
 	return op - pwcs;
}

Vulnerability Type: DoS Overflow +Priv 
CWE ID: CWE-119
Summary: Buffer overflow in the VFAT filesystem implementation in the Linux kernel before 3.3 allows local users to gain privileges or cause a denial of service (system crash) via a VFAT write operation on a filesystem with the utf8 mount option, which is not properly handled during UTF-8 to UTF-16 conversion.
Commit Message: NLS: improve UTF8 -> UTF16 string conversion routine

The utf8s_to_utf16s conversion routine needs to be improved.  Unlike
its utf16s_to_utf8s sibling, it doesn't accept arguments specifying
the maximum length of the output buffer or the endianness of its
16-bit output.

This patch (as1501) adds the two missing arguments, and adjusts the
only two places in the kernel where the function is called.  A
follow-on patch will add a third caller that does utilize the new
capabilities.

The two conversion routines are still annoyingly inconsistent in the
way they handle invalid byte combinations.  But that's a subject for a
different patch.

Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
CC: Clemens Ladisch <clemens@ladisch.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>