[PATCH v2 3/3] ksmbd: fill in FileSysIdentifier in FS_POSIX_INFORMATION

From: Aleksandr Khromov

Date: Mon Aug 24 2026 - 06:24:17 EST


smb2_get_info_filesystem() reports 56 bytes for FS_POSIX_INFORMATION,
that is the whole of FILE_SYSTEM_POSIX_INFO, but never assigns
FileSysIdentifier. Those eight bytes go to the client as they are found
in the response buffer.

The buffer is zeroed on allocation, so a standalone request leaks
nothing. A compound request can leak: the offset of the next response
is advanced by the length pinned for the previous one, so a reply that
was written into the buffer and then dropped in favour of the short
error response of smb2_set_err_rsp() stays there, and the next reply is
laid over it with only the header cleared.

Report the file system id statfs() returned, which is what the field is
for; ksmbd already hands the same value out in FS_OBJECT_ID_INFORMATION
when the volume UUID is not available.

Fixes: e2f34481b24d ("cifsd: add server-side procedures for SMB3")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Aleksandr Khromov <haa@xxxxxxxxx>
---
fs/smb/server/smb2pdu.c | 2 ++
1 file changed, 2 insertions(+)

diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c
index 5e83ad4f085e..7f200ba103ba 100644
--- a/fs/smb/server/smb2pdu.c
+++ b/fs/smb/server/smb2pdu.c
@@ -6167,6 +6167,8 @@ static int smb2_get_info_filesystem(struct ksmbd_work *work,
info->UserBlocksAvail = cpu_to_le64(stfs.f_bavail);
info->TotalFileNodes = cpu_to_le64(stfs.f_files);
info->FreeFileNodes = cpu_to_le64(stfs.f_ffree);
+ memcpy(&info->FileSysIdentifier, &stfs.f_fsid,
+ sizeof(stfs.f_fsid));
rsp->OutputBufferLength = cpu_to_le32(56);
}
break;
--
2.48.1