Re: [PATCH] ksmbd: verify transform SessionId matches the decrypted header

[Greg KH <greg@kroah.com>]

On Mon, Sep 28, 2026 at 11:13:00AM +0800, Dairui Zhang wrote:
> The decryption key for an encrypted request is selected by the
> SessionId in the encryption transform header, but the request is
> then authorized under the session named in the decrypted inner SMB2
> header. Nothing compares the two, so on a connection carrying more
> than one session a client can have a request decrypted with one
> session's key and executed under another session's identity. Since
> encrypted requests are also exempt from the signing requirement, the
> AEAD tag is the only proof of session identity, and it is checked
> against the wrong session.
> 
> Per MS-SMB2 the server must verify that the SessionId in the
> transform header matches the one in the decrypted SMB2 header and
> treat a mismatch as a protocol error. Validate the whole decrypted
> message before dispatching it: the message must be at least one
> fixed SMB2 header; the first operation must not set
> SMB2_FLAGS_RELATED_OPERATIONS and its SessionId must match the
> transform SessionId; each subsequent operation in a compound chain
> must either set SMB2_FLAGS_RELATED_OPERATIONS or carry the same
> SessionId; and NextCommand offsets must be 8-byte aligned and within
> the message. When the encrypted payload is a compression transform,
> the transform SessionId is saved during decryption and the same
> validation runs on the decompressed message. (The 8-byte alignment
> of compound responses is already handled by the existing
> chained-response padding.)
> 
> Reported-by: Dairui Zhang <zhangdairui@gmail.com>
> Assisted-by: LLM
> Cc: stable@vger.kernel.org
> Signed-off-by: Dairui Zhang <zhangdairui@gmail.com>
> ---
> v2 -> v3:
> - Per review, extend the check to the whole decrypted message before
>   dispatch: first-op size/RELATED_OPERATIONS/SessionId rules and
>   per-op compound-chain SessionId and NextCommand validation, shared
>   between the plain and compression paths via a common helper.

The "v3" isn't up in the Subject line for some reason :(