[PATCH] ksmbd: read request header for compounded CANCEL

[Noah Weinberger]

Hello,

For a compounded CANCEL, smb2_cancel() matches the cancel against the
*response* header:

    if (work->next_smb2_rcv_hdr_off)
            hdr = ksmbd_resp_buf_next(work);

The chained response header is initialized with Flags =
SERVER_TO_REDIR|RELATED, so SMB2_FLAGS_ASYNC_COMMAND is never set there:
an async-form CANCEL therefore always takes the MessageId branch and
matches nothing, i.e. a compounded async CANCEL is a silent no-op and
the deferred work keeps running until it completes, times out or the
connection closes. MS-SMB2 forbids compounding CANCEL, so only
non-conforming clients are affected, and the read itself is always
in-bounds (the response header is fully initialized).

Read the request header for the compounded case.

Affected version/commit: mainline fa4ad798f6f681031775266044ba1b0cf3c670bd (v7.4-rc1, 2026-11-07), fs/smb/server/smb2pdu.c:10515-10524 (smb2_cancel).
Pre-existing in v7.3.

This was found during an assisted (AI-supported) static source review of
mainline fa4ad798f6f681031775266044ba1b0cf3c670bd (v7.4-rc1, 2026-11-07); every code path cited below was re-verified by the
reporter against that tree. The patch below has NOT been compiled and has
NOT been runtime tested, and no reproducer was produced - the triggering
conditions are described above instead. Please treat this as a report for
verification rather than a battle-tested fix.

Reported-by: Noah Weinberger <noahweinberger2003@xxxxxxxxx>
---
diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c
index b084cca..36c5a40 100644
--- a/fs/smb/server/smb2pdu.c
+++ b/fs/smb/server/smb2pdu.c
@@ -10521,7 +10521,7 @@ int smb2_cancel(struct ksmbd_work *work)
 	struct list_head *command_list;
 
 	if (work->next_smb2_rcv_hdr_off)
-		hdr = ksmbd_resp_buf_next(work);
+		hdr = ksmbd_req_buf_next(work);
 
 	ksmbd_debug(SMB, "smb2 cancel called on mid %llu, async flags 0x%x\n",
 		    le64_to_cpu(hdr->MessageId),