From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D686B35C68A; Tue, 21 Jul 2026 21:26:24 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784669186; cv=none; b=uX1yQids4xpvWGtUl+dY8Pp4QiMfgP/15+06anrMl0JAEr8n46qdBuybh32tjmShD1YkvlMMefYGnbWxAhWU0q4IQVRTwAXqdd+J4YypGF4G8MzZhz3AG2G0QazF0hJi3x8OP5ws0iYP1x9vP417GOE/uHvwGgYl1j42IuS+ifw= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784669186; c=relaxed/simple; bh=nR6H1YstOXRfdMwEMTGoa7P4Ck6KTKTzXLQhNRGVfv8=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=vFrBMeBlPhzkN3W6oJjvjQeuCAwqv3KbFwJW5neQhP4LRuDeR0ChrKH8ZNNinGuFlTJ/FaiGqMAqVuOrC79lt2Ht3Y0XQfYkyDDa6aRZcGF1/l6vLpgWmvRtIGAOGMxNmMEPPe0ya7Jwap3RgPAXndcjtzvbpX5dcPA3WusmfwY= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=nbxYwZks; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="nbxYwZks" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 470D11F00A3A; Tue, 21 Jul 2026 21:26:24 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1784669184; bh=bwLWnW/vpYd2HYEx49ewyslO5lLne5BAYWxh7rp2jKA=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=nbxYwZksWP50ZL9x6OeHOqBDTpihIB74VkkhLuFngxb0WhPMLFFz/nR+Vy3q8FYTk QTfUC2JLxeNyNaFo6NXBJRvGxTWUXlPbq3AH0d6TUzeA5czbB0ENOM9B4935fMwUVW r+rSYmfFjqjo20X6isXKwkO+tc6TkqznYA/kdZPY= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Huiwen He , ChenXiaoSong , Steve French , Sasha Levin Subject: [PATCH 6.1 0458/1067] smb/client: always return a value for FS_IOC_GETFLAGS Date: Tue, 21 Jul 2026 17:17:39 +0200 Message-ID: <20260721152434.861755404@linuxfoundation.org> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260721152424.521567757@linuxfoundation.org> References: <20260721152424.521567757@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.1-stable review patch. If anyone has any objections, please let me know. ------------------ From: Huiwen He [ Upstream commit 7acbaa16b99edaf8ef432229d4b7a6f3b666767d ] Currently, repeated lsattr calls on a regular CIFS file without the compressed attribute may show random flags: $ touch test.bin $ lsattr test.bin s-S-ia-A-EjI---------m test.bin $ lsattr test.bin ------d-cEjI---------m test.bin The lsattr reproducer depends on the previous contents of its userspace buffer, so it may not reproduce on every setup. A deterministic reproducer is to initialize the ioctl argument before FS_IOC_GETFLAGS on a file without the compressed attribute: int flags = 0x7fffffff; ioctl(fd, FS_IOC_GETFLAGS, &flags); On an affected kernel, flags remains 0x7fffffff. With the fix, it is set to 0. This happens because when the cached inode does not have the compressed bit set, the CIFS fallback path in FS_IOC_GETFLAGS returns success without calling put_user() to write the zero flags value into the user buffer. As a result, the caller observes stale contents from its own buffer. Fix this by always writing the visible flags value back to the user buffer before returning success, even when the value is zero. Fixes: 64a5cfa6db94 ("Allow setting per-file compression via SMB2/3") Signed-off-by: Huiwen He Reviewed-by: ChenXiaoSong Signed-off-by: Steve French Signed-off-by: Sasha Levin --- fs/smb/client/ioctl.c | 12 +++++------- 1 file changed, 5 insertions(+), 7 deletions(-) diff --git a/fs/smb/client/ioctl.c b/fs/smb/client/ioctl.c index 367ac363e21123..0a3948c714cbc2 100644 --- a/fs/smb/client/ioctl.c +++ b/fs/smb/client/ioctl.c @@ -366,13 +366,11 @@ long cifs_ioctl(struct file *filep, unsigned int command, unsigned long arg) } #endif /* CONFIG_CIFS_ALLOW_INSECURE_LEGACY */ #endif /* CONFIG_CIFS_POSIX */ - rc = 0; - if (CIFS_I(inode)->cifsAttrs & ATTR_COMPRESSED) { - /* add in the compressed bit */ - ExtAttrBits = FS_COMPR_FL; - rc = put_user(ExtAttrBits & FS_FL_USER_VISIBLE, - (int __user *)arg); - } + if (CIFS_I(inode)->cifsAttrs & FILE_ATTRIBUTE_COMPRESSED) + ExtAttrBits |= FS_COMPR_FL; + + rc = put_user(ExtAttrBits & FS_FL_USER_VISIBLE, + (int __user *)arg); break; case FS_IOC_SETFLAGS: if (pSMBFile == NULL) -- 2.53.0