]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
ksmbd: fix CreateOptions sanitization clobbering the whole field
authorDaeMyung Kang <charsyam@gmail.com>
Mon, 20 Apr 2026 17:51:25 +0000 (02:51 +0900)
committerSteve French <stfrench@microsoft.com>
Wed, 22 Apr 2026 13:11:23 +0000 (08:11 -0500)
commit5d115fa84027e4b999c3d3c7b1294849cf35cdb2
treefa84bfbb14d4e162a5003a8956e6a214b2d278a1
parent804054d19886ac6628883d82410f6ee42a818664
ksmbd: fix CreateOptions sanitization clobbering the whole field

smb2_open() attempts to clear conflicting CreateOptions bits
(FILE_SEQUENTIAL_ONLY_LE together with FILE_RANDOM_ACCESS_LE, and
FILE_NO_COMPRESSION_LE on a directory open), but uses a plain
assignment of the bitwise negation of the target flag:

req->CreateOptions = ~(FILE_SEQUENTIAL_ONLY_LE);
req->CreateOptions = ~(FILE_NO_COMPRESSION_LE);

This replaces the entire field with 0xFFFFFFFB / 0xFFFFFFEF rather
than clearing a single bit. With the SEQUENTIAL/RANDOM case, the
next check for FILE_OPEN_BY_FILE_ID_LE | CREATE_TREE_CONNECTION |
FILE_RESERVE_OPFILTER_LE then trivially matches and a legitimate
request is rejected with -EOPNOTSUPP. With the NO_COMPRESSION case,
every downstream test (FILE_DELETE_ON_CLOSE, etc.) operates on a
corrupted CreateOptions value.

Use &= ~FLAG to clear only the intended bit in both places.

Signed-off-by: DaeMyung Kang <charsyam@gmail.com>
Acked-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
fs/smb/server/smb2pdu.c