Re: [PATCH 2/2] ksmbd: fix CreateOptions sanitization clobbering the whole field

[Namjae Jeon]

On Tue, Apr 21, 2026 at 2:51 AM DaeMyung Kang <charsyam@xxxxxxxxx> wrote:
>
> smb2_open() attempts to clear conflicting CreateOptions bits
> (FILE_SEQUENTIAL_ONLY_LE together with FILE_RANDOM_ACCESS_LE, and
> FILE_NO_COMPRESSION_LE on a directory open), but uses a plain
> assignment of the bitwise negation of the target flag:
>
>         req->CreateOptions = ~(FILE_SEQUENTIAL_ONLY_LE);
>         req->CreateOptions = ~(FILE_NO_COMPRESSION_LE);
>
> This replaces the entire field with 0xFFFFFFFB / 0xFFFFFFEF rather
> than clearing a single bit. With the SEQUENTIAL/RANDOM case, the
> next check for FILE_OPEN_BY_FILE_ID_LE | CREATE_TREE_CONNECTION |
> FILE_RESERVE_OPFILTER_LE then trivially matches and a legitimate
> request is rejected with -EOPNOTSUPP. With the NO_COMPRESSION case,
> every downstream test (FILE_DELETE_ON_CLOSE, etc.) operates on a
> corrupted CreateOptions value.
>
> Use &= ~FLAG to clear only the intended bit in both places.
Applied it to #ksmbd-for-next-next.
Note that I have added the missing signed-off-by tag and let me know
if there is 1/2 patch.
Thanks!