smb2_compound_op() saves the result from compound_send_recv() in tmp_rc. For SMB2_OP_OPEN_QUERY it then parses the CREATE contexts, but the final assignment of rc from tmp_rc discards a parsing error. A malformed create-context response can therefore be reported as successful to smb2_query_path_info(). Keep a create-context parsing error in tmp_rc so it survives per-command response processing and is returned to the caller. Fixes: b07687edee99 ("cifs: Improve SMB2+ stat() to work also without FILE_READ_ATTRIBUTES") Cc: stable@vger.kernel.org Reported-by: Vega Assisted-by: LLM Co-developed-by: Luxing Yin Signed-off-by: Luxing Yin Signed-off-by: Zihan Xi --- changes in v5: - Rerolled the series after fixing a NULL dereference reported by the kernel test robot Smatch analysis in patch 5: https://lore.kernel.org/r/202609241449.HlHmnZFZ-lkp@intel.com/ - v4 Link: https://lore.kernel.org/all/cover.1789478666.git.zihanx@nebusec.ai/ changes in v4: - Keep a create-context parsing error in tmp_rc while processing later compound responses. - v3 Link: https://lore.kernel.org/all/cover.1788516372.git.zihanx@nebusec.ai/ changes in v3: - No counterpart; this patch is added in the v4 reroll. - v2 Link: https://lore.kernel.org/all/cover.1787486936.git.zihanx@nebusec.ai/ changes in v2: - No counterpart in v2. - v1 Link: https://lore.kernel.org/all/eb1bc35611f91bd10a4772400b37fac26f660956.1782579150.git.xizh2024@lzu.edu.cn/ --- fs/smb/client/smb2inode.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/fs/smb/client/smb2inode.c b/fs/smb/client/smb2inode.c index 6971496dfe8c2..cedad9daeb220 100644 --- a/fs/smb/client/smb2inode.c +++ b/fs/smb/client/smb2inode.c @@ -582,8 +582,10 @@ static int smb2_compound_op(const unsigned int xid, struct cifs_tcon *tcon, /* smb2_parse_contexts() fills idata->fi.IndexNumber */ rc = smb2_parse_contexts(server, &rsp_iov[0], &oparms->fid->epoch, oparms->fid->lease_key, &oplock, &idata->fi, NULL); - if (rc) + if (rc) { cifs_dbg(VFS, "rc: %d parsing context of compound op\n", rc); + tmp_rc = rc; + } } for (i = 0; i < num_cmds; i++) { -- 2.43.0