smb2_create_open_flags() picks the open mode from the read and write bits of the desired access. FILE_EXECUTE and FILE_READ_ATTRIBUTES select neither, so a request for FILE_WRITE_DATA | FILE_EXECUTE | FILE_READ_ATTRIBUTES opens the file O_WRONLY. smb2_read() accepts FILE_READ_ATTRIBUTES and ksmbd_vfs_read() accepts FILE_EXECUTE, so a later READ on that handle passes both checks and reaches __kernel_read() on a file that has no FMODE_READ: WARNING: fs/read_write.c:518 at __kernel_read __kernel_read ksmbd_vfs_read smb2_read handle_ksmbd_work Any client that can open a file with write access on a share, including a guest session, can trigger it; with panic_on_warn it takes the machine down. Return STATUS_ACCESS_DENIED when the file is not readable. Fixes: f44158485826 ("cifsd: add file operations") Cc: stable@vger.kernel.org Signed-off-by: Wahid Khan --- fs/smb/server/vfs.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/fs/smb/server/vfs.c b/fs/smb/server/vfs.c index 1f2bc76f0..cb3f4f5fe 100644 --- a/fs/smb/server/vfs.c +++ b/fs/smb/server/vfs.c @@ -367,6 +367,10 @@ int ksmbd_vfs_read(struct ksmbd_work *work, struct ksmbd_file *fp, size_t count, if (ksmbd_stream_fd(fp)) return ksmbd_vfs_stream_read(fp, rbuf, pos, count); + /* The access granted on open can include FILE_EXECUTE for a write-only file */ + if (!(filp->f_mode & FMODE_READ)) + return -EACCES; + if (!fp->is_posix_ctxt) { int ret; -- 2.53.0