Re: [PATCH] smb: client: fail SMB2 responses with a bad signature

[Namjae Jeon]

On Fri, Nov 13, 2026 at 9:00 PM Suyuan Wang via B4 Relay
<devnull+shyckless.gmail.com@xxxxxxxxxx> wrote:
>
> From: Suyuan Wang <stevewong@xxxxxxxxxxx>
>
> smb2_check_receive() checks the response signature when signing is on,
> but a failed check is only logged:
>
>     rc = smb2_verify_signature(&rqst, server);
>     if (rc)
>             cifs_server_dbg(VFS, "SMB signature verification returned ...",
>                             rc);
>     ...
>     return map_smb2_to_linux_error(mid->resp_buf, log_error);
>
> The status from the response is returned as usual, and the caller goes
> on to use a response whose signature is wrong. This is the path for
> synchronous requests and for smb2_writev_callback(). On a signed but
> unencrypted connection, anyone who can modify the traffic can change
> e.g. a directory listing, and the client accepts it.
>
> Return the verification error instead.
>
> Unlike the SMB1 fix in commit dc96f01d54cc ("smb: client: terminate
> session upon failed client required signing"), don't reconnect: this
> runs in the thread that sent the request, and only cifsd should call
> cifs_reconnect(). And fail the request whichever side required signing,
> since a response with a bad signature can't be trusted either way.
>
> Found with a static analysis tool and checked by hand.
>
> Reported-by: Daniel Birtwhistle <daniel.birtwhistle@xxxxxxxxxxxxxxxx>
> Closes: https://lore.kernel.org/linux-cifs/SN4PR22MB28883DAF57E0B4D4BFB1C22AEEC42@xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx/
> Fixes: 3c1bf7e48e9e ("CIFS: Enable signing in SMB2")
> Cc: stable@xxxxxxxxxxxxxxx
> Co-developed-by: Kaixuan Li <kaixuan.li@xxxxxxxxxx>
> Signed-off-by: Kaixuan Li <kaixuan.li@xxxxxxxxxx>
> Signed-off-by: Suyuan Wang <stevewong@xxxxxxxxxxx>
Please check Sashiko's review comments.

https://sashiko.dev/#/patchset/20261113-smb2-sign-v1-1-937ee7c20f08%40gmail.com

Thanks.