[PATCH] ksmbd: check sign flag of the current compound command

[Noah Weinberger]

Hello,

smb2_is_sign_req() decides whether a command must be verified/answered
signed based on the FIRST command's header, even when dispatching
commands 2..N of a compound, so the SIGNED flag of the current command
is ignored and its response goes out unsigned.

When the session mandates signing, __process_request rejects the whole
compound because the first header is unsigned, and when signing is
optional an unsigned request was already permitted - so I could not
construct a bypass; this is a conformance/defense-in-depth fix. Use the
current command's request header, like smb2_check_sign_req() does.

Affected version/commit: mainline fa4ad798f6f681031775266044ba1b0cf3c670bd (v7.4-rc1, 2026-11-07), fs/smb/server/smb2pdu.c:12811-12820 (smb2_is_sign_req).
Pre-existing in v7.3.

This was found during an assisted (AI-supported) static source review of
mainline fa4ad798f6f681031775266044ba1b0cf3c670bd (v7.4-rc1, 2026-11-07); every code path cited below was re-verified by the
reporter against that tree. The patch below has NOT been compiled and has
NOT been runtime tested, and no reproducer was produced - the triggering
conditions are described above instead. Please treat this as a report for
verification rather than a battle-tested fix.

Reported-by: Noah Weinberger <noahweinberger2003@xxxxxxxxx>
---
diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c
index b084cca..d0c6356 100644
--- a/fs/smb/server/smb2pdu.c
+++ b/fs/smb/server/smb2pdu.c
@@ -12812,6 +12812,9 @@ bool smb2_is_sign_req(struct ksmbd_work *work, unsigned int command)
 {
 	struct smb2_hdr *rcv_hdr2 = smb_get_msg(work->request_buf);
 
+	if (work->next_smb2_rcv_hdr_off)
+		rcv_hdr2 = ksmbd_req_buf_next(work);
+
 	if ((rcv_hdr2->Flags & SMB2_FLAGS_SIGNED) &&
 	    command != SMB2_NEGOTIATE_HE)
 		return true;