Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

ksmbd: fix CreateOptions sanitization clobbering the whole field

smb2_open() attempts to clear conflicting CreateOptions bits
(FILE_SEQUENTIAL_ONLY_LE together with FILE_RANDOM_ACCESS_LE, and
FILE_NO_COMPRESSION_LE on a directory open), but uses a plain
assignment of the bitwise negation of the target flag:

req->CreateOptions = ~(FILE_SEQUENTIAL_ONLY_LE);
req->CreateOptions = ~(FILE_NO_COMPRESSION_LE);

This replaces the entire field with 0xFFFFFFFB / 0xFFFFFFEF rather
than clearing a single bit. With the SEQUENTIAL/RANDOM case, the
next check for FILE_OPEN_BY_FILE_ID_LE | CREATE_TREE_CONNECTION |
FILE_RESERVE_OPFILTER_LE then trivially matches and a legitimate
request is rejected with -EOPNOTSUPP. With the NO_COMPRESSION case,
every downstream test (FILE_DELETE_ON_CLOSE, etc.) operates on a
corrupted CreateOptions value.

Use &= ~FLAG to clear only the intended bit in both places.

Signed-off-by: DaeMyung Kang <charsyam@gmail.com>
Acked-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>

authored by

DaeMyung Kang and committed by
Steve French
5d115fa8 804054d1

+2 -2
+2 -2
fs/smb/server/smb2pdu.c
··· 3057 3057 } else { 3058 3058 if (req->CreateOptions & FILE_SEQUENTIAL_ONLY_LE && 3059 3059 req->CreateOptions & FILE_RANDOM_ACCESS_LE) 3060 - req->CreateOptions = ~(FILE_SEQUENTIAL_ONLY_LE); 3060 + req->CreateOptions &= ~FILE_SEQUENTIAL_ONLY_LE; 3061 3061 3062 3062 if (req->CreateOptions & 3063 3063 (FILE_OPEN_BY_FILE_ID_LE | CREATE_TREE_CONNECTION | ··· 3071 3071 rc = -EINVAL; 3072 3072 goto err_out2; 3073 3073 } else if (req->CreateOptions & FILE_NO_COMPRESSION_LE) { 3074 - req->CreateOptions = ~(FILE_NO_COMPRESSION_LE); 3074 + req->CreateOptions &= ~FILE_NO_COMPRESSION_LE; 3075 3075 } 3076 3076 } 3077 3077 }