[PATCH] ksmbd: refuse to read a handle that is not open for reading

[PATCH] ksmbd: refuse to read a handle that is not open for reading

[Wahid Khan]

smb2_create_open_flags() picks the open mode from the read and write
bits of the desired access. FILE_EXECUTE and FILE_READ_ATTRIBUTES select
neither, so a request for FILE_WRITE_DATA | FILE_EXECUTE |
FILE_READ_ATTRIBUTES opens the file O_WRONLY.

smb2_read() accepts FILE_READ_ATTRIBUTES and ksmbd_vfs_read() accepts
FILE_EXECUTE, so a later READ on that handle passes both checks and
reaches __kernel_read() on a file that has no FMODE_READ:

  WARNING: fs/read_write.c:518 at __kernel_read
   __kernel_read
   ksmbd_vfs_read
   smb2_read
   handle_ksmbd_work

Any client that can open a file with write access on a share, including
a guest session, can trigger it; with panic_on_warn it takes the machine
down.

Return STATUS_ACCESS_DENIED when the file is not readable.

Fixes: f44158485826 ("cifsd: add file operations")
Cc: stable@vger.kernel.org
Signed-off-by: Wahid Khan <wahidzk0091@gmail.com>
---
 fs/smb/server/vfs.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/fs/smb/server/vfs.c b/fs/smb/server/vfs.c
index 1f2bc76f0..cb3f4f5fe 100644
--- a/fs/smb/server/vfs.c
+++ b/fs/smb/server/vfs.c
@@ -367,6 +367,10 @@ int ksmbd_vfs_read(struct ksmbd_work *work, struct ksmbd_file *fp, size_t count,
 	if (ksmbd_stream_fd(fp))
 		return ksmbd_vfs_stream_read(fp, rbuf, pos, count);
 
+	/* The access granted on open can include FILE_EXECUTE for a write-only file */
+	if (!(filp->f_mode & FMODE_READ))
+		return -EACCES;
+
 	if (!fp->is_posix_ctxt) {
 		int ret;
 
-- 
2.53.0

Re: [PATCH] ksmbd: refuse to read a handle that is not open for reading

[Ian Bridges]

On Thu, Nov 05, 2026 at 11:08:38PM +0530, Wahid Khan wrote:
> Return STATUS_ACCESS_DENIED when the file is not readable.

Tested on ksmbd-for-next with KASAN. A READ on a handle opened for
FILE_WRITE_DATA | FILE_EXECUTE | FILE_READ_ATTRIBUTES hits the warning
before and gets STATUS_ACCESS_DENIED after. smbtorture gives the same
results as without the patch.

Reviewed-by: Ian Bridges <icb@fastmail.org>
Tested-by: Ian Bridges <icb@fastmail.org>

Re: [PATCH] ksmbd: refuse to read a handle that is not open for reading

[Namjae Jeon]

On Fri, Nov 6, 2026 at 6:19 AM Ian Bridges <icb@fastmail.org> wrote:
>
> On Thu, Nov 05, 2026 at 11:08:38PM +0530, Wahid Khan wrote:
> > Return STATUS_ACCESS_DENIED when the file is not readable.
>
> Tested on ksmbd-for-next with KASAN. A READ on a handle opened for
> FILE_WRITE_DATA | FILE_EXECUTE | FILE_READ_ATTRIBUTES hits the warning
> before and gets STATUS_ACCESS_DENIED after. smbtorture gives the same
> results as without the patch.
>
> Reviewed-by: Ian Bridges <icb@fastmail.org>
> Tested-by: Ian Bridges <icb@fastmail.org>
Applied it to #ksmbd-for-next.
Thanks!