[PATCH 1/2] ksmbd: fix negative timestamps being saved to disk

[PATCH 1/2] ksmbd: fix negative timestamps being saved to disk

[koraynilay]

When setting a timestamp before epoch 0, ksmbd converts it from NT
format to Unix format without normalizing it, leading to the nanoseconds
field to be saved (on-disk too) as a negative number, which leads to a
garbled stat command output and a reported +4 seconds in the timestamp.

This bug also violates a struct timespec64 invariant, as documented in
the set_normalized_timespec64() kernel-doc:
[...]
 * Note: The tv_nsec part is always in the range of 0 <= tv_nsec < NSEC_PER_SEC.
 * For negative values only the tv_sec field is negative !
 */

Reproducer, with /tmp as the local filesystem folder exported as [test]
in ksmbd.conf and /mnt as the smb folder mounted with mount -t cifs:

  mount -t cifs //127.0.0.1/test /mnt -o username=user,password=pass
  touch /mnt/test.txt
  touch -d "1969-07-20 20:17:40.123456789" /mnt/test.txt
  stat -c "Server local (/tmp):   %y" /tmp/test.txt
  stat -c "CIFS client  (/mnt):   %y" /mnt/test.txt --cached=never
  smbclient //127.0.0.1/test -U user%pass -c "allinfo test.txt"

which prints (stat output is garbled because of negative value):

  Server local (/tmp):   1969-07-20 20:17:41.()*+,--00 +0000
  CIFS client  (/mnt):   1969-07-20 20:17:45.+(/+)*/00 +0000
  altname: TESTT~K6.TXT
  [...]
  access_time:    Sun Jul 20 20:17:44 1969 UTC
  write_time:     Sun Jul 20 20:17:44 1969 UTC
  [...]

Fix this by using set_normalized_timespec64() in ksmbd_NTtimeToUnix().

Fixes: e2f34481b24d ("cifsd: add server-side procedures for SMB3")
Cc: stable@vger.kernel.org
Assisted-by: Gemini:3.8-flash-high antigravity-cli-1.5.3
Signed-off-by: koraynilay <koray.fra@gmail.com>
---
Yet another small fix I found while implementing ptime[1].
(Still not the last one :c)

Thanks.

[1]: https://lore.kernel.org/all/20261101015551.786044-1-koray.fra@gmail.com/T/#t

 fs/smb/server/misc.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/fs/smb/server/misc.c b/fs/smb/server/misc.c
index 5037f37c9226..94781246b4d6 100644
--- a/fs/smb/server/misc.c
+++ b/fs/smb/server/misc.c
@@ -336,8 +336,7 @@ struct timespec64 ksmbd_NTtimeToUnix(__le64 ntutc)
 	if (t < 0) {
 		abs_t = -t;
 		ts.tv_nsec = do_div(abs_t, 10000000) * 100;
-		ts.tv_nsec = -ts.tv_nsec;
-		ts.tv_sec = -abs_t;
+		set_normalized_timespec64(&ts, -abs_t, -ts.tv_nsec);
 	} else {
 		abs_t = t;
 		ts.tv_nsec = do_div(abs_t, 10000000) * 100;

base-commit: f4692d0e3b5e16d32d4ec7b1e0e58d7dbe74aaf4
-- 
2.56.0

[PATCH 2/2] cifs: fix negative timestamps being read from smb

[koraynilay]

When reading a timestamp before epoch 0, cifs converts it from NT format
to Unix format without normalizing it, leading to the nanoseconds field
to be used as a negative number, which leads to a garbled stat command
output.

This bug also violates a struct timespec64 invariant, as documented in
the set_normalized_timespec64() kernel-doc:
[...]
 * Note: The tv_nsec part is always in the range of 0 <= tv_nsec < NSEC_PER_SEC.
 * For negative values only the tv_sec field is negative !
 */

Reproducer, with /tmp as the local filesystem folder exported as [test]
in ksmbd.conf and /mnt as the smb folder mounted with mount -t cifs:

  mount -t cifs //127.0.0.1/test /mnt -o username=user,password=pass
  touch -d "1969-07-20 20:17:40.123456789" /tmp/test.txt
  stat -c "Server local (/tmp):   %y" /tmp/test.txt
  stat -c "CIFS client  (/mnt):   %y" /mnt/test.txt --cached=never
  smbclient //127.0.0.1/test -U user%pass -c "allinfo test.txt"

which prints (stat output is garbled because of negative value):

  Server local (/tmp):   1969-07-20 20:17:40.123456789 +0000
  CIFS client  (/mnt):   1969-07-20 20:17:41.()*+,--00 +0000
  altname: TESTT~K6.TXT
  [...]
  access_time:    Sun Jul 20 20:17:40 1969 UTC
  write_time:     Sun Jul 20 20:17:40 1969 UTC
  [...]

Fix this by using set_normalized_timespec64() in cifs_NTtimeToUnix().

Fixes: 2ae83bf93882 ("[CIFS] Fix setting time before epoch (negative time values)")
Cc: stable@vger.kernel.org
Assisted-by: Gemini:3.8-flash-high antigravity-cli-1.5.3
Signed-off-by: koraynilay <koray.fra@gmail.com>
---
Yet another small fix I found while implementing ptime[1].
(Still not the last one :c)

Thanks.

[1]: https://lore.kernel.org/all/20261101015551.786044-1-koray.fra@gmail.com/T/#t

 fs/smb/client/netmisc.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/fs/smb/client/netmisc.c b/fs/smb/client/netmisc.c
index cf737ede1ab3..033ca8f7e151 100644
--- a/fs/smb/client/netmisc.c
+++ b/fs/smb/client/netmisc.c
@@ -133,8 +133,7 @@ cifs_NTtimeToUnix(__le64 ntutc)
 	if (t < 0) {
 		abs_t = -t;
 		ts.tv_nsec = (time64_t)(do_div(abs_t, 10000000) * 100);
-		ts.tv_nsec = -ts.tv_nsec;
-		ts.tv_sec = -abs_t;
+		set_normalized_timespec64(&ts, -abs_t, -ts.tv_nsec);
 	} else {
 		abs_t = t;
 		ts.tv_nsec = (time64_t)do_div(abs_t, 10000000) * 100;

base-commit: f4692d0e3b5e16d32d4ec7b1e0e58d7dbe74aaf4
-- 
2.56.0

Re: [PATCH 1/2] ksmbd: fix negative timestamps being saved to disk

[Ian Bridges]

Hi,

On Thu, Nov 12, 2026 at 12:16:36PM +0100, koraynilay wrote:
> When setting a timestamp before epoch 0, ksmbd converts it from NT
> format to Unix format without normalizing it, leading to the nanoseconds
> field to be saved (on-disk too) as a negative number, which leads to a
> garbled stat command output and a reported +4 seconds in the timestamp.

I tested this with the ksmbd code from ksmbd-for-next. Before the
patch, setting an access or write time before 1970 with a fraction of
a second stored the wrong time on disk. The stored time was about four
seconds late, stat showed garbage for the fraction, and a query over
SMB returned the wrong time too. With the patch, the time on disk and
the time returned over SMB match the time that was set. Times after
1970, and whole seconds before it, behave as before. smbtorture gives
the same results as without the patch, and KASAN reports nothing.

Reviewed-by: Ian Bridges <icb@fastmail.org>
Tested-by: Ian Bridges <icb@fastmail.org>