FAILED: patch "[PATCH] ksmbd: use opener credentials for FSCTL mutations" failed to apply to 6.18-stable tree

PATCH New [email protected] 2 participants 4 messages Jul 14 – Jul 16

Subsystems (4)

Stable branch VFS SMB client (CIFS) Kernel SMB3 server (ksmbd)

lore

Share & tools

lore

[email protected]

author maintainer

2026-07-14 14:39 UTC #0 lore raw

The patch below does not apply to the 6.18-stable tree.
If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <[email protected]>.

To reproduce the conflict and resubmit, you may use the following commands:

git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.18.y
git checkout FETCH_HEAD
git cherry-pick -x c6394bcaf254c5baf9aff43376020be5db6d3316
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<[email protected]>' --in-reply-to '2026071403-ferris-hydroxide-5531@gregkh' --subject-prefix 'PATCH 6.18.y' 'HEAD^..'

Possible dependencies:

thanks,

greg k-h

------------------ original commit in Linus's tree ------------------

From c6394bcaf254c5baf9aff43376020be5db6d3316 Mon Sep 17 00:00:00 2001
From: Namjae Jeon <[email protected]>
Date: Sat, 13 Jun 2026 22:00:04 +0900
Subject: [PATCH] ksmbd: use opener credentials for FSCTL mutations

SET_SPARSE, SET_ZERO_DATA and SET_COMPRESSION operate on an open SMB handle but call VFS xattr, fallocate or fileattr helpers with the current ksmbd worker credentials. Those helpers can revalidate inode permissions, ownership and LSM policy independently of the SMB handle access mask.

Run each operation with the credentials captured in the target file when the handle was opened. Keep credential handling local to these single-file FSCTLs rather than applying session credentials to the complete IOCTL handler, which also contains handle-less and multi-handle operations.

Cc [email protected]

Reported-by Musaab Khan <[email protected]>

Signed-off-by Namjae Jeon <[email protected]>

Signed-off-by Steve French <[email protected]>

fs/smb/server/smb2pdu.c +3 -0

index fcb1bcd5de95..c1c6c1a64f60 100644
@@ -8387,6 +8387,7 @@ static inline int fsctl_set_sparse(struct ksmbd_work *work, u64 id,
 	if (fp->f_ci->m_fattr != old_fattr &&
 	    test_share_config_flag(work->tcon->share_conf,
 				   KSMBD_SHARE_FLAG_STORE_DOS_ATTRS)) {
+		const struct cred *saved_cred;
 		struct xattr_dos_attrib da;
 
 		ret = ksmbd_vfs_get_dos_attrib_xattr(idmap,

@@ -8395,9 +8396,11 @@ static inline int fsctl_set_sparse(struct ksmbd_work *work, u64 id,
 			goto out;
 
 		da.attr = le32_to_cpu(fp->f_ci->m_fattr);
+		saved_cred = override_creds(fp->filp->f_cred);
 		ret = ksmbd_vfs_set_dos_attrib_xattr(idmap,
 						     &fp->filp->f_path,
 						     &da, true);
+		revert_creds(saved_cred);
 		if (ret)
 			fp->f_ci->m_fattr = old_fattr;
 	}

fs/smb/server/vfs.c +18 -8

index 04a4bd0f492b..fe376453a519 100644
@@ -918,15 +918,21 @@ void ksmbd_vfs_set_fadvise(struct file *filp, __le32 option)
 int ksmbd_vfs_zero_data(struct ksmbd_work *work, struct ksmbd_file *fp,
 			loff_t off, loff_t len)
 {
-	smb_break_all_levII_oplock(work, fp, 1);
-	if (fp->f_ci->m_fattr & FILE_ATTRIBUTE_SPARSE_FILE_LE)
-		return vfs_fallocate(fp->filp,
-				     FALLOC_FL_PUNCH_HOLE | FALLOC_FL_KEEP_SIZE,
-				     off, len);
+	const struct cred *saved_cred;
+	int err;
 
-	return vfs_fallocate(fp->filp,
-			     FALLOC_FL_ZERO_RANGE | FALLOC_FL_KEEP_SIZE,
-			     off, len);
+	smb_break_all_levII_oplock(work, fp, 1);
+	saved_cred = override_creds(fp->filp->f_cred);
+	if (fp->f_ci->m_fattr & FILE_ATTRIBUTE_SPARSE_FILE_LE)
+		err = vfs_fallocate(fp->filp,
+				    FALLOC_FL_PUNCH_HOLE | FALLOC_FL_KEEP_SIZE,
+				    off, len);
+	else
+		err = vfs_fallocate(fp->filp,
+				    FALLOC_FL_ZERO_RANGE | FALLOC_FL_KEEP_SIZE,
+				    off, len);
+	revert_creds(saved_cred);
+	return err;
 }
 
 int ksmbd_vfs_fqar_lseek(struct ksmbd_file *fp, loff_t start, loff_t length,

@@ -1935,6 +1941,7 @@ int ksmbd_vfs_get_compression(struct ksmbd_file *fp, u16 *fmt)
 
 int ksmbd_vfs_set_compression(struct ksmbd_work *work, struct ksmbd_file *fp, u16 fmt)
 {
+	const struct cred *saved_cred = NULL;
 	struct file_kattr fa;
 	struct dentry *dentry = fp->filp->f_path.dentry;
 	struct mnt_idmap *idmap = file_mnt_idmap(fp->filp);

@@ -1947,6 +1954,7 @@ int ksmbd_vfs_set_compression(struct ksmbd_work *work, struct ksmbd_file *fp, u1
 		goto out;
 	}
 
+	saved_cred = override_creds(fp->filp->f_cred);
 	rc = vfs_fileattr_get(dentry, &fa);
 	if (rc)
 		goto out;

@@ -2000,5 +2008,7 @@ int ksmbd_vfs_set_compression(struct ksmbd_work *work, struct ksmbd_file *fp, u1
 	}
 
 out:
+	if (saved_cred)
+		revert_creds(saved_cred);
 	return rc;
 }

Sasha Levin

maintainer

2026-07-16 10:18 UTC #1 lore raw

PATCH 1/3 cifs: SMB1 split: Rename cifstransport.c

From: David Howells <[email protected]>

[ Upstream commit b09eab52b307df58a36f34d047378053a2e13e13 ]

Rename cifstransport.c to smb1transport.c in order to give consistent names SMB1-specific files.

Signed-off-by David Howells <[email protected]>

cc Steve French <[email protected]>

cc Paulo Alcantara <[email protected]>

cc Enzo Matsumiya <[email protected]>

cc [email protected]

Acked-by Enzo Matsumiya <[email protected]>

Signed-off-by Steve French <[email protected]>

Stable-dep-of: c6394bcaf254 ("ksmbd: use opener credentials for FSCTL mutations")

Signed-off-by Sasha Levin <[email protected]>

---
 fs/smb/client/Makefile                             | 5 ++++-
 fs/smb/client/{cifstransport.c => smb1transport.c} | 0
 2 files changed, 4 insertions(+), 1 deletion(-)
 rename fs/smb/client/{cifstransport.c => smb1transport.c} (100%)

fs/smb/client/Makefile +4 -1

index 4c97b31a25c280..9754b4776df845 100644
@@ -32,6 +32,9 @@ cifs-$(CONFIG_CIFS_SMB_DIRECT) += smbdirect.o
 
 cifs-$(CONFIG_CIFS_ROOT) += cifsroot.o
 
-cifs-$(CONFIG_CIFS_ALLOW_INSECURE_LEGACY) += smb1ops.o cifssmb.o cifstransport.o
+cifs-$(CONFIG_CIFS_ALLOW_INSECURE_LEGACY) += \
+	cifssmb.o \
+	smb1ops.o \
+	smb1transport.o
 
 cifs-$(CONFIG_CIFS_COMPRESSION) += compress.o compress/lz77.o

fs/smb/client/smb1transport.c renamed from fs/smb/client/cifstransport.c +0 -0

similarity index 100%
rename from fs/smb/client/cifstransport.c
rename to fs/smb/client/smb1transport.c

Signature · 1 line

2.53.0

Sasha Levin

maintainer

2026-07-16 10:18 UTC #2 lore raw

PATCH 2/3 cifs: SMB1 split: Add some #includes

From: David Howells <[email protected]>

[ Upstream commit a7c7f35bcf0943ba85ab14bafbfbcbc3a30ad402 ]

Add some #includes to make sure things continue to compile as splitting occurs.

Signed-off-by David Howells <[email protected]>

cc Steve French <[email protected]>

cc Paulo Alcantara <[email protected]>

cc Enzo Matsumiya <[email protected]>

cc [email protected]

Acked-by Enzo Matsumiya <[email protected]>

Signed-off-by Steve French <[email protected]>

Stable-dep-of: c6394bcaf254 ("ksmbd: use opener credentials for FSCTL mutations")

Signed-off-by Sasha Levin <[email protected]>

---
 fs/smb/client/cifssmb.c       | 5 +++--
 fs/smb/client/smb1transport.c | 4 ++--
 2 files changed, 5 insertions(+), 4 deletions(-)

fs/smb/client/cifssmb.c +3 -2

index bfc9b1ea76fac9..7694ca283fdc38 100644
@@ -26,11 +26,12 @@
 #include <linux/uaccess.h>
 #include <linux/netfs.h>
 #include <trace/events/netfs.h>
+#include "cifsglob.h"
+#include "cifsproto.h"
+#include "../common/smbfsctl.h"
 #include "cifspdu.h"
 #include "cifsfs.h"
-#include "cifsglob.h"
 #include "cifsacl.h"
-#include "cifsproto.h"
 #include "cifs_unicode.h"
 #include "cifs_debug.h"
 #include "fscache.h"

fs/smb/client/smb1transport.c +2 -2

index e98b95eff8c983..518f764dedcce6 100644
@@ -22,13 +22,13 @@
 #include <linux/mempool.h>
 #include <linux/sched/signal.h>
 #include <linux/task_io_accounting_ops.h>
-#include "cifspdu.h"
 #include "cifsglob.h"
 #include "cifsproto.h"
-#include "cifs_debug.h"
+#include "cifspdu.h"
 #include "smb2proto.h"
 #include "smbdirect.h"
 #include "compress.h"
+#include "cifs_debug.h"
 
 /* Max number of iovectors we can use off the stack when sending requests. */
 #define CIFS_MAX_IOV_SIZE 8

Signature · 1 line

2.53.0

Sasha Levin

maintainer

2026-07-16 10:18 UTC #3 lore raw

PATCH 3/3 ksmbd: use opener credentials for FSCTL mutations

In reply to Sasha Levin

From: Namjae Jeon <[email protected]>

[ Upstream commit c6394bcaf254c5baf9aff43376020be5db6d3316 ]

Cc [email protected]

Reported-by Musaab Khan <[email protected]>

Signed-off-by Namjae Jeon <[email protected]>

Signed-off-by Steve French <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

---
 fs/smb/server/smb2pdu.c |  3 +++
 fs/smb/server/vfs.c     | 20 +++++++++++++-------
 2 files changed, 16 insertions(+), 7 deletions(-)

fs/smb/server/smb2pdu.c +3 -0

index c012c5a93cc61f..e7ff03afed76f0 100644
@@ -8244,6 +8244,7 @@ static inline int fsctl_set_sparse(struct ksmbd_work *work, u64 id,
 	if (fp->f_ci->m_fattr != old_fattr &&
 	    test_share_config_flag(work->tcon->share_conf,
 				   KSMBD_SHARE_FLAG_STORE_DOS_ATTRS)) {
+		const struct cred *saved_cred;
 		struct xattr_dos_attrib da;
 
 		ret = ksmbd_vfs_get_dos_attrib_xattr(idmap,

@@ -8252,9 +8253,11 @@ static inline int fsctl_set_sparse(struct ksmbd_work *work, u64 id,
 			goto out;
 
 		da.attr = le32_to_cpu(fp->f_ci->m_fattr);
+		saved_cred = override_creds(fp->filp->f_cred);
 		ret = ksmbd_vfs_set_dos_attrib_xattr(idmap,
 						     &fp->filp->f_path,
 						     &da, true);
+		revert_creds(saved_cred);
 		if (ret)
 			fp->f_ci->m_fattr = old_fattr;
 	}

fs/smb/server/vfs.c +13 -7

index 90e693e4e41497..1062dc7f3fef64 100644
@@ -988,15 +988,21 @@ void ksmbd_vfs_set_fadvise(struct file *filp, __le32 option)
 int ksmbd_vfs_zero_data(struct ksmbd_work *work, struct ksmbd_file *fp,
 			loff_t off, loff_t len)
 {
+	const struct cred *saved_cred;
+	int err;
+
 	smb_break_all_levII_oplock(work, fp, 1);
+	saved_cred = override_creds(fp->filp->f_cred);
 	if (fp->f_ci->m_fattr & FILE_ATTRIBUTE_SPARSE_FILE_LE)
-		return vfs_fallocate(fp->filp,
-				     FALLOC_FL_PUNCH_HOLE | FALLOC_FL_KEEP_SIZE,
-				     off, len);
-
-	return vfs_fallocate(fp->filp,
-			     FALLOC_FL_ZERO_RANGE | FALLOC_FL_KEEP_SIZE,
-			     off, len);
+		err = vfs_fallocate(fp->filp,
+				    FALLOC_FL_PUNCH_HOLE | FALLOC_FL_KEEP_SIZE,
+				    off, len);
+	else
+		err = vfs_fallocate(fp->filp,
+				    FALLOC_FL_ZERO_RANGE | FALLOC_FL_KEEP_SIZE,
+				    off, len);
+	revert_creds(saved_cred);
+	return err;
 }
 
 int ksmbd_vfs_fqar_lseek(struct ksmbd_file *fp, loff_t start, loff_t length,

Signature · 1 line

2.53.0