From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=202.12.124.148 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1793237148; b=IQTOsZNhUUPUMnrISECziflLo29gzzTmUTj9f+8iEDmvCcjoBih4siv+JmKQEmJRz5Lr C5cKE9qvvj180YJKNfJ4O0NyeEkRnRslbTrkIFmZEt4qI8Gk64hqNMsESfo9osGMKXrSj K+F/webXr7k/zWk3EM1+vgeXGsZvUM3DlZDbPKjWyxKGbtXF9spaBQaIQeq93aaTOgJ6F gajn9U+TQkPLHs/2GFRkVsqqY29BiZqWrJtF4Tl7vX9iDdML2TRCL0nkxEJMj5UPqFHDw 0xzTGlOtlSp4erFiICHLQs3I4FJD2QKTFnhucfkr25ynaXFbu/Sf+ZcMulXXitS6j4Q== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1793237148; h=DMARC-Filter:Received:Received:DKIM-Signature:DKIM-Signature: X-DKIM2-Info:DKIM2-Signature:X-DKIM2-Info:Message-Instance: X-ME-Sender:X-ME-Received:X-ME-Proxy-Cause:X-ME-Proxy:Feedback-ID: Received:From:To:Cc:Subject:Date:Message-ID:X-Mailer:MIME-Version: Content-Transfer-Encoding; bh=40uo3TzgyAeLpqUrd11Nx1bywBZTJ09VOqKwD0NOR3g=; b=VHyO0ovyApDdZFuT2gPCObHs1x/zQaWPj73ow7HW3+WjfOTJjzaVwAUWDbT1XV9v4LAH hlrGpvTIUC1YgGdVRdz4GcQsIo2Jrss+0NAVaA6KlRYdKU6KFzCW1mMEnPglsZY9Z+Zcs SaLmFcIGlk46YjId1fTYJkGPV+I2MCFs+LqBd4VHGSjHqXDehk8lI9/AAzfsPGCEPV+Gt YNpZUVZITX4cBGR8e9lW4p9t3Fu80lJw5hCnryFy7ar8VDqM/39XDsCMOeYbJoK1hIq/J /ceP+mDmGecYzry6JqcJC0Oz3Ibmx2J2UG7md2bwOosJjPAoawAOKUOvjwpoXHB8dlA== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass header.from=fastmail.org; spf=pass smtp.mailfrom=fastmail.org; dkim=pass header.d=fastmail.org header.i=@fastmail.org header.a=rsa-sha256 header.s=fm2 header.b=Gy+ThPxs; dkim=pass header.d=messagingengine.com header.i=@messagingengine.com header.a=rsa-sha256 header.s=fm2 header.b=xKEnE69d; arc=none smtp.remote-ip=202.12.124.148 Received: from fout-b5-smtp.messagingengine.com (fout-b5-smtp.messagingengine.com [202.12.124.148]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1) server-digest SHA256) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E6B09606A31C for ; Thu, 29 Oct 2026 01:25:46 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.2 smtp.subspace.kernel.org E6B09606A31C Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=fastmail.org Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=fastmail.org Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key, unprotected) header.d=fastmail.org header.i=@fastmail.org header.a=rsa-sha256 header.s=fm2 header.b=Gy+ThPxs; dkim=pass (2048-bit key, unprotected) header.d=messagingengine.com header.i=@messagingengine.com header.a=rsa-sha256 header.s=fm2 header.b=xKEnE69d Received: from phl-compute-01.internal (phl-compute-01.internal [10.202.2.41]) by mailfout.stl.internal (Postfix) with ESMTP id 30C2E1D000D0 for ; Wed, 28 Oct 2026 21:25:46 -0400 (EDT) Received: from phl-frontend-03 ([10.202.2.162]) by phl-compute-01.internal (MEProxy); Wed, 28 Oct 2026 21:25:46 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fastmail.org; h= cc:cc:content-transfer-encoding:content-type:date:date:from:from :in-reply-to:message-id:mime-version:reply-to:subject:subject:to :to; s=fm2; t=1793237145; x=1793323545; bh=40uo3TzgyAeLpqUrd11Nx 1bywBZTJ09VOqKwD0NOR3g=; b=Gy+ThPxsRWNWJD/vnXzZxlIPx/B8Bu3Qh6+eE zJMZBvM+8OJdcxFLJIC+DxfLh91RqrMs21azOkJE9O0Z0hexOaBXZuYcZ01ILzHr rFB+30MXwMOtB4/si8+XUwH3PnxrEqllBBrXXhrBCYsSQJ2Gc84HKq7chB9o5Q10 +l6avqLRpYGRIzRdJFr5AT8tFuzqCXh43MlnFZfjbOLiDBaW/J816M+CHwwCHu31 0r/tsiO/fqIWcL3dwtp7/ClmsZ0qG47rfz/700qb2m6CwW7B5VlDW2rT8AVw40pU 9nc+tMgY3bvmpK9PSwb82bncSaGOkk4ZrNZvagzRbq22I+gdA== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=cc:cc:content-transfer-encoding :content-type:date:date:feedback-id:feedback-id:from:from :in-reply-to:message-id:mime-version:reply-to:subject:subject:to :to:x-me-proxy:x-me-sender:x-me-sender:x-sasl-enc; s=fm2; t= 1793237145; x=1793323545; bh=40uo3TzgyAeLpqUrd11Nx1bywBZTJ09VOqK wD0NOR3g=; b=xKEnE69dH314kAEX4bNRRiQFftbxj3yopmAcoXNEEEMzCtaVOrN V0NqBgxL/c7UIuVqbxuptcMs+RkYFKeQhsnN/SeaSTF47j6Cw9WLXEhYUTDrTZMr ANtEZIIU7scjI1bnIqe+gL6xbTVDv8coYj0bTwkOinsksk45S8zVxg03OsaiyECI uHMuy/5SQf3e6cQxJRljwZ7Og3PCH4/RAQltWMZ4wSr99mP63O4AUSlDKaoyHdIP 2vXYJ8JxFQtPTIk7nhINTaGWhwmvut40aFOHLBJOa+8PNFg7v85qJ4ZEMIKeUbZi HVq+EVxV8gmhJPC5L+K7oOKyPDH4lcUimJQ== X-DKIM2-Info: draft=ietf-dkim-dkim2-spec-08; repo=github.com/dkim2wg/interop; date=2026-10-28; sw=lmtpprox; action=sign d=fastmail.org a=rsa-sha256; DKIM2-Signature: i=1; m=1; t=1793237145; d=fastmail.org; mf=PGljYkBmYXN0bWFpbC5vcmc+; rt=PGxpbnV4LWtlcm5lbEB2Z2VyLmtlcm5lbC5vcmc+; s=fm2:rsa-sha256:W0wqUgnEOTglJAGFYTmmazUxl7UhpaOQjnIKKXfn8zYxu60 1kvT+9UtBqnmN2xmf8KXhwvaPG7zA959N+SQ8KsLSE2IlRFVP7BcbkFQsCAQ3cOp UsQmjTUOWdrrrUhNtd2Y5hYCDIoODXlFIwI9Jv/bASvquBwPUGSvalGra6TOhaS4 +aJXE6gALTJtrXsizRKgHh9rFYZ89jg4E43Lw3LmuLefI7yk9mDlPwmMq8moBjYF LHCm494+vIRXa6xnVr+DYDcW5hQbd/V1AJ9jzWWhVxhcxebMwgEN4LA8fFybX3vc G/m7UkROrwnTmKufzaEHC7aLN1m0hypDGwc6Z0w==; X-DKIM2-Info: draft=ietf-dkim-dkim2-spec-08; repo=github.com/dkim2wg/interop; date=2026-10-28; sw=lmtpprox; action=mi-m=1; hc=9; hn=cc,content-transfer-encoding,date,feedback-id,from, message-id,mime-version,subject,to; Message-Instance: m=1; h=sha256:f0Xb0gOGJffAITMlNSj3k71khYqc+Jh/lCpTdboxPFY=:MnATMRxxRcIqckgRxtp9UNy99ER/Ne2NAicQc4MoUvM=; X-ME-Sender: X-ME-Received: X-ME-Proxy-Cause: dmFkZTE/sHuRLxtO961CCQw8GTWuuNDeNSfYM3hpyu1Lq8MfnehnZRY3vI6jAL1IOsza+t foWFHfTlGi2G5hIgVT7me610kTF+unGYeN+PL8gWn6cY8hFHlGYu/Gw/NqJ4JY6JGv8n7s TUqVB37vxxaWAyvnWi7g2gEmuaroydDygNtTjfD1Bc43d6lFnD+8TDgCt6cJAGciNUVnWr mFQQvguQ6gKQOUi6EnmIILe9x2gj4nAQJ7tDg8nTfy6iovFi2m8uJ/D6Iae/oezxP9axsN RqwrgBEp6h7rC3HpyS37K52fNgQQe2/N9sjbq/vYH0DmdedZD4zR72nr7YYE1jHI3X4ll2 RHyThGOVt3ZE4uWhkJkN+bwzj1oK4UgAYELuOot7gcm/ZbgC44A7zCmhcgK0RkdUHJiAcA FJJOPCaj2Z0QJo2iktux4OLjiMzBlEojMDK83UIDqy+LziybJAytJxONJJdmoZHvGVglUR mAkzySiSiEVoitpm2u/wgrwS8qnfShE2v57JGBCfAha7UKSoMJtVD7syBJ/eRkIAMzOkLd UJYfHfZPDGjbVhYmVQkj/EgKXEDZAZ7hCEAqHUA99PulyxFiQcCBIwwqksNWQw9Xc6W9wB Im7TjA52W+Z3cr5r5zmhU7WWM7TFqg+68N/L0KwxpEW3hEZC9itVVBHLAxSQ X-ME-Proxy: Feedback-ID: ib53e4b78:Fastmail Received: by mail.messagingengine.com (Postfix) with ESMTPA; Wed, 28 Oct 2026 21:25:43 -0400 (EDT) From: Ian Bridges To: Namjae Jeon Cc: Sergey Senozhatsky , Tom Talpey , ChenXiaoSong , Gael Blivet , linux-cifs@vger.kernel.org, linux-kernel@vger.kernel.org, Ian Bridges , stable@vger.kernel.org Subject: [PATCH] ksmbd: enforce the read-only share flag when creating a stream Date: Wed, 28 Oct 2026 20:25:32 -0500 Message-ID: <20261029012532.222013-1-icb@fastmail.org> X-Mailer: git-send-email 2.47.3 X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Transfer-Encoding: 8bit When a share is read-only, smb2_open() rejects opens that would create or truncate a file. Creating a named stream on an existing file with streams_xattr sets neither O_CREAT nor O_TRUNC, so it passes this check, and smb2_set_stream_name_xattr() then creates the stream. On a Time Machine share, opening a missing AFP_AfpInfo stream also writes one. A user who can write a file at the filesystem level can therefore add streams to it through a read-only share. Do not create a stream or synthesize AFP_AfpInfo when the share is not writable. Existing streams still open normally, and a missing stream opened with FILE_OPEN still returns STATUS_OBJECT_NAME_NOT_FOUND. Fixes: e2f34481b24d ("cifsd: add server-side procedures for SMB3") Fixes: eaff8e924f60 ("ksmbd: synthesize empty AFP_AfpInfo xattr on first probe") Cc: stable@vger.kernel.org Signed-off-by: Ian Bridges --- Notes: Reachable on a read-only streams_xattr share, or for a user outside its "write list". The change is persistent but only adds empty streams, or the synthesized 60-byte AFP_AfpInfo on a Time Machine share. Writing stream data still goes through the writable check. It is not a privilege escalation. Tested on ksmbd-for-next bd24b89645c5 with read-only and writable streams_xattr and Time Machine shares. Before this change new streams are created on the read-only shares. With it they fail with STATUS_ACCESS_DENIED and nothing is written. Writable shares behave as before. A reproducer is available on request. This fix was developed with LLM assistance. fs/smb/server/smb2pdu.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c index f3cd6ff7eb09..cbbe12b3f96e 100644 --- a/fs/smb/server/smb2pdu.c +++ b/fs/smb/server/smb2pdu.c @@ -3566,7 +3566,8 @@ static noinline int smb2_set_stream_name_xattr(const struct path *path, if (fp->cdoption == FILE_OPEN_LE) { if (!strcmp(stream_name, "AFP_AfpInfo") && test_share_config_flag(fp->tcon->share_conf, - KSMBD_SHARE_FLAG_TIME_MACHINE)) { + KSMBD_SHARE_FLAG_TIME_MACHINE) && + test_tree_conn_flag(fp->tcon, KSMBD_TREE_CONN_FLAG_WRITABLE)) { /* * Synthesize an empty AFP_AfpInfo xattr on first access. * type=0/creator=0 tells macOS to use the file extension @@ -3593,6 +3594,9 @@ static noinline int smb2_set_stream_name_xattr(const struct path *path, return -EBADF; } + if (!test_tree_conn_flag(fp->tcon, KSMBD_TREE_CONN_FLAG_WRITABLE)) + return -EACCES; + rc = ksmbd_vfs_setxattr(idmap, path, xattr_stream_name, NULL, 0, 0, false); if (rc < 0) pr_err("Failed to store XATTR stream name :%d\n", rc); base-commit: bd24b89645c5fa8283aceda78dbe53aa234e6bf9 -- 2.47.3