Re: [PATCH v2] smb: client: terminate session upon failed client required signing

[Aaditya Kansal <aadityakansal390@gmail.com>]

On 2/16/26 02:38, Steve French wrote:
> On Sun, Feb 15, 2026 at 1:23 PM Aaditya Kansal
> <aadityakansal390@gmail.com> wrote:
>>
>> On 2/16/26 00:01, Steve French wrote:
>>> On Sun, Feb 15, 2026 at 7:17 AM Aaditya Kansal
>>> <aadityakansal390@gmail.com> wrote:
>>>>
>>>> On 2/5/26 06:30, Aaditya Kansal wrote:
>>>>> Currently, when smb signature verification fails, the behaviour is to log
>>>>> the failure without any action to terminate the session.
>>>>>
>>>>> Call cifs_reconnect() when client required signature verification fails.
>>>>> Otherwise, log the error without reconnecting.
>>>>>
>>>>> Signed-off-by: Aaditya Kansal <aadityakansal390@gmail.com>
>>>>> ---
>>>>> Changes in v2:
>>>>> - reconnect only triggered when client required signature verification fails
>>>>> ---
>>>>>  fs/smb/client/cifstransport.c | 10 ++++++++--
>>>>>  1 file changed, 8 insertions(+), 2 deletions(-)
>>>>>
>>>>> diff --git a/fs/smb/client/cifstransport.c b/fs/smb/client/cifstransport.c
>>>>> index 28d1cee90625..6c1fbf0bef6d 100644
>>>>> --- a/fs/smb/client/cifstransport.c
>>>>> +++ b/fs/smb/client/cifstransport.c
>>>>> @@ -169,12 +169,18 @@ cifs_check_receive(struct mid_q_entry *mid, struct TCP_Server_Info *server,
>>>>>
>>>>>               iov[0].iov_base = mid->resp_buf;
>>>>>               iov[0].iov_len = len;
>>>>> -             /* FIXME: add code to kill session */
>>>>> +
>>>>>               rc = cifs_verify_signature(&rqst, server,
>>>>>                                          mid->sequence_number);
>>>>> -             if (rc)
>>>>> +             if (rc) {
>>>>>                       cifs_server_dbg(VFS, "SMB signature verification returned error = %d\n",
>>>>>                                rc);
>>>>> +
>>>>> +                     if (!(server->sec_mode & SECMODE_SIGN_REQUIRED)) {
>>>>> +                             cifs_reconnect(server, true);
>>>>> +                             return rc;
>>>>> +                     }
>>>>> +             }
>>>>>       }
>>>>>
>>>>>       /* BB special case reconnect tid and uid here? */
>>>> Hi, I am writing this as a ping for this patch. Thanks
>>> merged into cifs-2.6.git for-next but had to rebase it to merge into
>>> current code.
>>>
>>> Have you verified the behavior of default (smb3.1.1) mounts as well?
>>>
>> Thank you. Yes, I have checked it for the default version.
>> Tested for both client required and server required signature verification.
> You were able to verify (simulate) it as well for default ie SMB3.1.1
> (not just for SMB1
> which this patch fixes), and no changes needed for SMB3.1.1?
>
>
Yes, I verified for default version (3.1.1). First I set signing
required option on server side,
then I set the sign flag on client side. SMB3.1.1 mounts with no issues.

-- 
-AK