[PATCH 2/2] ksmbd: fix CreateOptions sanitization clobbering the whole field

[PATCH 2/2] ksmbd: fix CreateOptions sanitization clobbering the whole field

[DaeMyung Kang]

smb2_open() attempts to clear conflicting CreateOptions bits
(FILE_SEQUENTIAL_ONLY_LE together with FILE_RANDOM_ACCESS_LE, and
FILE_NO_COMPRESSION_LE on a directory open), but uses a plain
assignment of the bitwise negation of the target flag:

	req->CreateOptions = ~(FILE_SEQUENTIAL_ONLY_LE);
	req->CreateOptions = ~(FILE_NO_COMPRESSION_LE);

This replaces the entire field with 0xFFFFFFFB / 0xFFFFFFEF rather
than clearing a single bit. With the SEQUENTIAL/RANDOM case, the
next check for FILE_OPEN_BY_FILE_ID_LE | CREATE_TREE_CONNECTION |
FILE_RESERVE_OPFILTER_LE then trivially matches and a legitimate
request is rejected with -EOPNOTSUPP. With the NO_COMPRESSION case,
every downstream test (FILE_DELETE_ON_CLOSE, etc.) operates on a
corrupted CreateOptions value.

Use &= ~FLAG to clear only the intended bit in both places.
---
 fs/smb/server/smb2pdu.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c
index 6a60f97baa60..38d3bc66912d 100644
--- a/fs/smb/server/smb2pdu.c
+++ b/fs/smb/server/smb2pdu.c
@@ -3063,7 +3063,7 @@ int smb2_open(struct ksmbd_work *work)
 	} else {
 		if (req->CreateOptions & FILE_SEQUENTIAL_ONLY_LE &&
 		    req->CreateOptions & FILE_RANDOM_ACCESS_LE)
-			req->CreateOptions = ~(FILE_SEQUENTIAL_ONLY_LE);
+			req->CreateOptions &= ~FILE_SEQUENTIAL_ONLY_LE;
 
 		if (req->CreateOptions &
 		    (FILE_OPEN_BY_FILE_ID_LE | CREATE_TREE_CONNECTION |
@@ -3077,7 +3077,7 @@ int smb2_open(struct ksmbd_work *work)
 				rc = -EINVAL;
 				goto err_out2;
 			} else if (req->CreateOptions & FILE_NO_COMPRESSION_LE) {
-				req->CreateOptions = ~(FILE_NO_COMPRESSION_LE);
+				req->CreateOptions &= ~FILE_NO_COMPRESSION_LE;
 			}
 		}
 	}
-- 
2.43.0

Re: [PATCH 2/2] ksmbd: fix CreateOptions sanitization clobbering the whole field

[Namjae Jeon]

On Tue, Apr 21, 2026 at 2:51 AM DaeMyung Kang <charsyam@gmail.com> wrote:
>
> smb2_open() attempts to clear conflicting CreateOptions bits
> (FILE_SEQUENTIAL_ONLY_LE together with FILE_RANDOM_ACCESS_LE, and
> FILE_NO_COMPRESSION_LE on a directory open), but uses a plain
> assignment of the bitwise negation of the target flag:
>
>         req->CreateOptions = ~(FILE_SEQUENTIAL_ONLY_LE);
>         req->CreateOptions = ~(FILE_NO_COMPRESSION_LE);
>
> This replaces the entire field with 0xFFFFFFFB / 0xFFFFFFEF rather
> than clearing a single bit. With the SEQUENTIAL/RANDOM case, the
> next check for FILE_OPEN_BY_FILE_ID_LE | CREATE_TREE_CONNECTION |
> FILE_RESERVE_OPFILTER_LE then trivially matches and a legitimate
> request is rejected with -EOPNOTSUPP. With the NO_COMPRESSION case,
> every downstream test (FILE_DELETE_ON_CLOSE, etc.) operates on a
> corrupted CreateOptions value.
>
> Use &= ~FLAG to clear only the intended bit in both places.
Applied it to #ksmbd-for-next-next.
Note that I have added the missing signed-off-by tag and let me know
if there is 1/2 patch.
Thanks!