[{"id":3679649,"web_url":"http://patchwork.ozlabs.org/comment/3679649/","msgid":"","list_archive_url":null,"date":"2026-04-21T01:39:55","subject":"Re: [PATCH 2/2] ksmbd: fix CreateOptions sanitization clobbering the\n whole field","submitter":{"id":79386,"url":"http://patchwork.ozlabs.org/api/people/79386/","name":"Namjae Jeon","email":"linkinjeon@kernel.org"},"content":"On Tue, Apr 21, 2026 at 2:51 AM DaeMyung Kang wrote:\n>\n> smb2_open() attempts to clear conflicting CreateOptions bits\n> (FILE_SEQUENTIAL_ONLY_LE together with FILE_RANDOM_ACCESS_LE, and\n> FILE_NO_COMPRESSION_LE on a directory open), but uses a plain\n> assignment of the bitwise negation of the target flag:\n>\n> req->CreateOptions = ~(FILE_SEQUENTIAL_ONLY_LE);\n> req->CreateOptions = ~(FILE_NO_COMPRESSION_LE);\n>\n> This replaces the entire field with 0xFFFFFFFB / 0xFFFFFFEF rather\n> than clearing a single bit. With the SEQUENTIAL/RANDOM case, the\n> next check for FILE_OPEN_BY_FILE_ID_LE | CREATE_TREE_CONNECTION |\n> FILE_RESERVE_OPFILTER_LE then trivially matches and a legitimate\n> request is rejected with -EOPNOTSUPP. With the NO_COMPRESSION case,\n> every downstream test (FILE_DELETE_ON_CLOSE, etc.) operates on a\n> corrupted CreateOptions value.\n>\n> Use &= ~FLAG to clear only the intended bit in both places.\nApplied it to #ksmbd-for-next-next.\nNote that I have added the missing signed-off-by tag and let me know\nif there is 1/2 patch.\nThanks!","headers":{"Return-Path":"\n ","X-Original-To":["incoming@patchwork.ozlabs.org","linux-cifs@vger.kernel.org"],"Delivered-To":"patchwork-incoming@legolas.ozlabs.org","Authentication-Results":["legolas.ozlabs.org;\n\tdkim=pass (2048-bit key;\n unprotected) header.d=kernel.org header.i=@kernel.org header.a=rsa-sha256\n header.s=k20201202 header.b=kvtK1qwz;\n\tdkim-atps=neutral","legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=vger.kernel.org\n (client-ip=2600:3c0a:e001:db::12fc:5321; helo=sea.lore.kernel.org;\n envelope-from=linux-cifs+bounces-10973-incoming=patchwork.ozlabs.org@vger.kernel.org;\n receiver=patchwork.ozlabs.org)","smtp.subspace.kernel.org;\n\tdkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org\n header.b=\"kvtK1qwz\"","smtp.subspace.kernel.org;\n arc=none smtp.client-ip=10.30.226.201"],"Received":["from sea.lore.kernel.org (sea.lore.kernel.org\n [IPv6:2600:3c0a:e001:db::12fc:5321])\n\t(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n\t key-exchange x25519 server-signature ECDSA (secp384r1) server-digest SHA384)\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4g04mY6TGyz1xqf\n\tfor ; Tue, 21 Apr 2026 11:40:13 +1000 (AEST)","from smtp.subspace.kernel.org (conduit.subspace.kernel.org\n [100.90.174.1])\n\tby sea.lore.kernel.org (Postfix) with ESMTP id 03822300C915\n\tfor ; Tue, 21 Apr 2026 01:40:11 +0000 (UTC)","from localhost.localdomain (localhost.localdomain [127.0.0.1])\n\tby smtp.subspace.kernel.org (Postfix) with ESMTP id 4D30D1E98EF;\n\tTue, 21 Apr 2026 01:40:10 +0000 (UTC)","from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org\n [10.30.226.201])\n\t(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))\n\t(No client certificate requested)\n\tby smtp.subspace.kernel.org (Postfix) with ESMTPS id 2A75018FC80\n\tfor ; Tue, 21 Apr 2026 01:40:09 +0000 (UTC)","by smtp.kernel.org (Postfix) with ESMTPSA id C024FC2BCB4\n\tfor ; Tue, 21 Apr 2026 01:40:09 +0000 (UTC)","by mail-ej1-f42.google.com with SMTP id\n a640c23a62f3a-b9358bc9c50so486724666b.1\n for ;\n Mon, 20 Apr 2026 18:40:09 -0700 (PDT)"],"ARC-Seal":"i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;\n\tt=1776735610; cv=none;\n b=BLxV9UCL9KuXKC9YiszhPDK2sQhWHmG3cBtCZKNJF4HmtIY8bbaGov0hb1/UjR5AUc0p7JFbHMM68iy778VHz7IUByp7n2nA8W2l9yP1WYIzdJFaW60beXg5LNELDAE+NvG3GXJDg8juflkH/++BXP0jOhJ2rjePIM/tM16vusc=","ARC-Message-Signature":"i=1; a=rsa-sha256; d=subspace.kernel.org;\n\ts=arc-20240116; t=1776735610; c=relaxed/simple;\n\tbh=VY/sZE8bhqM0/mK0lAft5EfTXoxNB/ZE7p9Jx7PupQw=;\n\th=MIME-Version:References:In-Reply-To:From:Date:Message-ID:Subject:\n\t To:Cc:Content-Type;\n b=KUXwriTDuK7GtbDmTO/0Qx4Q153YE3ukJd9m6TFzYqkVVGfiAIitIHHhH6UeIJM+C8VvFLY7Eg4uhThwQKlvB6zUFebHwnlgtjPw7+Ar6YT7EVfP75i/lhcENrPGGpy169pvwPY/JhJzE1XrvHsen1M2l7F5vJ/4cldhFI9pqnY=","ARC-Authentication-Results":"i=1; smtp.subspace.kernel.org;\n dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org\n header.b=kvtK1qwz; arc=none smtp.client-ip=10.30.226.201","DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org;\n\ts=k20201202; t=1776735609;\n\tbh=VY/sZE8bhqM0/mK0lAft5EfTXoxNB/ZE7p9Jx7PupQw=;\n\th=References:In-Reply-To:From:Date:Subject:To:Cc:From;\n\tb=kvtK1qwzqX8Q9m6/yH5rbu08NDxCA0K4EesbssNK40mAkQFIDXbdodlYl/S7GUUO8\n\t A8hfyScGROh57mmiZLHclX/Tqmn79+Cv04GK5WduA0Ij6pFpFyRGPQWraQFOx5m4P1\n\t G4o9JrZgQLVCqmeWs89gsoNx+krKL8+Avdfb2BvYlDxEiAMvzbfHoW5pyPq1PfOtHn\n\t paBoIdhcuPLSsfvz0D5CwBa6w4DZ/QVyvXk0ez041VVHQXP1kEfONFgCC/5QFMh6TI\n\t sZ6xu24y2Qq4DTDsmdGP4WyyFxZf1rnJ1CP1O5NPAW4c30YTOLFwa2xhxFsg1oVRw0\n\t WGVos2yw7zMlg==","X-Forwarded-Encrypted":"i=1;\n AFNElJ/01GovMQ5pR5E3kGye8PqvHYWjrjN6NziyWgFQGcZOy8vLzDASx1Z9N/UA+Ish+2wzpgdQs7ADEM22@vger.kernel.org","X-Gm-Message-State":"AOJu0YzOj5P5Af0nqX++cuiDaGzw0dh23KacDSX5QK7ABHAuXvlYxoy5\n\t4UUx87EOHR3O9AWAqDPbFNAya/FP62B1jOV2FEqbi7YpeTEDQhA9uuWVAgbST8/5tvW9pVe5tSu\n\tRp60Wx/gs3IAUC3aqxf95GEVWL4MiLPI=","X-Received":"by 2002:a17:906:bf45:b0:b9b:1cad:fe93 with SMTP id\n a640c23a62f3a-ba41adf96d8mr797789666b.24.1776735608276; Mon, 20 Apr 2026\n 18:40:08 -0700 (PDT)","Precedence":"bulk","X-Mailing-List":"linux-cifs@vger.kernel.org","List-Id":"","List-Subscribe":"","List-Unsubscribe":"","MIME-Version":"1.0","References":"<20260420175125.3341090-1-charsyam@gmail.com>","In-Reply-To":"<20260420175125.3341090-1-charsyam@gmail.com>","From":"Namjae Jeon ","Date":"Tue, 21 Apr 2026 10:39:55 +0900","X-Gmail-Original-Message-ID":"\n ","X-Gm-Features":"AQROBzAUCaYD2fipzmFFnXI4X8t4RhxnDlOpMjGu2F0y7p6I7ahJmYW1zt0h-U4","Message-ID":"\n ","Subject":"Re: [PATCH 2/2] ksmbd: fix CreateOptions sanitization clobbering the\n whole field","To":"DaeMyung Kang ","Cc":"Steve French ,\n Sergey Senozhatsky ,\n\tTom Talpey , linux-cifs@vger.kernel.org,\n linux-kernel@vger.kernel.org","Content-Type":"text/plain; charset=\"UTF-8\"","Content-Transfer-Encoding":"quoted-printable"}}]