[PATCH] ksmbd: reject FILE_ATTRIBUTE_TEMPORARY on directories

[Michail Andreas Michalopoulos]

Setting FILE_ATTRIBUTE_TEMPORARY on a directory with SMB2 SET_INFO
(FileBasicInformation) succeeds: ksmbd keeps the attribute and, with
"store dos attributes" enabled, also writes it to the DOS attribute
xattr.

MS-FSA (FileBasicInformation) says the request must fail with
STATUS_INVALID_PARAMETER when FILE_ATTRIBUTE_TEMPORARY is set on a
directory, and Samba rejects it too. smbtorture's
smb2.create.dosattr_tmp_dir checks this and fails against ksmbd.

Return -EINVAL, which is sent as STATUS_INVALID_PARAMETER, when a
directory is asked to become TEMPORARY. Do the check before any
timestamp is changed, so a rejected request leaves the open file and
the inode unchanged.

Fixes: e2f34481b24d ("cifsd: add server-side procedures for SMB3")
Assisted-by: LLM
Signed-off-by: Michail Andreas Michalopoulos <mike.michalo@xxxxxxxxx>
---
Tested on ksmbd-for-next 454ae8e5c306 in a QEMU x86_64 VM with
ksmbd-tools 3.5.7: smb2.create.dosattr_tmp_dir fails before and passes
after this patch. The 187 smbtorture tests run by the ksmbd CI, plus
smb2.setinfo and smb2.dosmode, give the same results with and without
it (smb2.dosmode fails both ways, for an unrelated reason).

The same failure reproduces on the Ubuntu 26.04 arm64 kernel with
ksmbd-tools 3.5.6 and smbtorture 4.23.6.

MS-FSA (Creation of a New File) also says that creating a directory
with FILE_ATTRIBUTE_TEMPORARY must fail with STATUS_INVALID_PARAMETER,
and ksmbd doesn't check that either. I left it out because I have no
test for it; I can send a follow-up if you want it.

 fs/smb/server/smb2pdu.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c
index 40af35c0aa29..1ed8e8135c58 100644
--- a/fs/smb/server/smb2pdu.c
+++ b/fs/smb/server/smb2pdu.c
@@ -8695,6 +8695,11 @@ static int set_file_basic_info(struct ksmbd_file *fp,
 	inode = file_inode(filp);
 	idmap = file_mnt_idmap(filp);
 
+	/* MS-FSA FileBasicInformation: a directory can't be marked TEMPORARY */
+	if (S_ISDIR(inode->i_mode) &&
+	    (file_info->Attributes & FILE_ATTRIBUTE_TEMPORARY_LE))
+		return -EINVAL;
+
 	if (file_info->CreationTime)
 		fp->create_time = le64_to_cpu(file_info->CreationTime);
 
-- 
2.56.0