Re: [PATCH 1/2] ksmbd: skip metadata-only opens in sharing checks

[Namjae Jeon]

> diff --git a/fs/smb/server/smb_common.c b/fs/smb/server/smb_common.c
> index f9fb3741ada3..920e94017bf6 100644
> --- a/fs/smb/server/smb_common.c
> +++ b/fs/smb/server/smb_common.c
> @@ -719,6 +719,15 @@ int ksmbd_smb_check_shared_mode(struct file *filp, struct ksmbd_file *curr_fp)
>                 if (prev_fp->attrib_only != curr_fp->attrib_only)
>                         continue;
>
> +               /*
> +                * Two opens conflict only if both hold a right in
> +                * FILE_SHARE_CHECKED_ACCESS_LE (MS-FSA 2.1.5.1.2.1 and
> +                * 2.1.5.1.2.2)
> +                */
> +               if (!(prev_fp->daccess & FILE_SHARE_CHECKED_ACCESS_LE) ||
> +                   !(curr_fp->daccess & FILE_SHARE_CHECKED_ACCESS_LE))
> +                       continue;
> +
Could we account for O_TRUNC in the access mask used for sharing
checks before adding this shortcut ?  CREATE requesting READ_CONTROL
can still specify FILE_OVERWRITE. smb2_create_open_flags() then sets
O_TRUNC, but fp->daccess remains READ_CONTROL, so this condition skips
the sharing checks even though the request can reach
smb2_create_truncate(). For example, with an existing FILE_READ_DATA
open and ShareAccess=0, second CREATE specifying READ_CONTROL,
FILE_OVERWRITE and ShareAccess=0 changes the sharing-check result from
-EPERM to success in the extracted-function harness. The open should
be checked using an effective access mask that includes
FILE_WRITE_DATA when O_TRUNC is requested. The client's requested
access can be kept separately for the returned handle. This would let
the shortcut exclude opens that only access metadata while still
checking opens that truncate file data.

Thanks.