[PATCH v2] smb: client: terminate session upon failed client required signing

[PATCH v2] smb: client: terminate session upon failed client required signing

[Aaditya Kansal]

Currently, when smb signature verification fails, the behaviour is to log
the failure without any action to terminate the session.

Call cifs_reconnect() when client required signature verification fails.
Otherwise, log the error without reconnecting.

Signed-off-by: Aaditya Kansal <aadityakansal390@gmail.com>
---
Changes in v2:
- reconnect only triggered when client required signature verification fails
---
 fs/smb/client/cifstransport.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/fs/smb/client/cifstransport.c b/fs/smb/client/cifstransport.c
index 28d1cee90625..6c1fbf0bef6d 100644
--- a/fs/smb/client/cifstransport.c
+++ b/fs/smb/client/cifstransport.c
@@ -169,12 +169,18 @@ cifs_check_receive(struct mid_q_entry *mid, struct TCP_Server_Info *server,
 
 		iov[0].iov_base = mid->resp_buf;
 		iov[0].iov_len = len;
-		/* FIXME: add code to kill session */
+
 		rc = cifs_verify_signature(&rqst, server,
 					   mid->sequence_number);
-		if (rc)
+		if (rc) {
 			cifs_server_dbg(VFS, "SMB signature verification returned error = %d\n",
 				 rc);
+
+			if (!(server->sec_mode & SECMODE_SIGN_REQUIRED)) {
+				cifs_reconnect(server, true);
+				return rc;
+			}
+		}
 	}
 
 	/* BB special case reconnect tid and uid here? */
-- 
2.52.0

Re: [PATCH v2] smb: client: terminate session upon failed client required signing

[Aaditya Kansal]

On 2/5/26 06:30, Aaditya Kansal wrote:
> Currently, when smb signature verification fails, the behaviour is to log
> the failure without any action to terminate the session.
>
> Call cifs_reconnect() when client required signature verification fails.
> Otherwise, log the error without reconnecting.
>
> Signed-off-by: Aaditya Kansal <aadityakansal390@gmail.com>
> ---
> Changes in v2:
> - reconnect only triggered when client required signature verification fails
> ---
>  fs/smb/client/cifstransport.c | 10 ++++++++--
>  1 file changed, 8 insertions(+), 2 deletions(-)
>
> diff --git a/fs/smb/client/cifstransport.c b/fs/smb/client/cifstransport.c
> index 28d1cee90625..6c1fbf0bef6d 100644
> --- a/fs/smb/client/cifstransport.c
> +++ b/fs/smb/client/cifstransport.c
> @@ -169,12 +169,18 @@ cifs_check_receive(struct mid_q_entry *mid, struct TCP_Server_Info *server,
>  
>  		iov[0].iov_base = mid->resp_buf;
>  		iov[0].iov_len = len;
> -		/* FIXME: add code to kill session */
> +
>  		rc = cifs_verify_signature(&rqst, server,
>  					   mid->sequence_number);
> -		if (rc)
> +		if (rc) {
>  			cifs_server_dbg(VFS, "SMB signature verification returned error = %d\n",
>  				 rc);
> +
> +			if (!(server->sec_mode & SECMODE_SIGN_REQUIRED)) {
> +				cifs_reconnect(server, true);
> +				return rc;
> +			}
> +		}
>  	}
>  
>  	/* BB special case reconnect tid and uid here? */
Hi, I am writing this as a ping for this patch. Thanks

-- 
-AK

Re: [PATCH v2] smb: client: terminate session upon failed client required signing

[Steve French]

On Sun, Feb 15, 2026 at 7:17 AM Aaditya Kansal
<aadityakansal390@gmail.com> wrote:
>
>
>
> On 2/5/26 06:30, Aaditya Kansal wrote:
> > Currently, when smb signature verification fails, the behaviour is to log
> > the failure without any action to terminate the session.
> >
> > Call cifs_reconnect() when client required signature verification fails.
> > Otherwise, log the error without reconnecting.
> >
> > Signed-off-by: Aaditya Kansal <aadityakansal390@gmail.com>
> > ---
> > Changes in v2:
> > - reconnect only triggered when client required signature verification fails
> > ---
> >  fs/smb/client/cifstransport.c | 10 ++++++++--
> >  1 file changed, 8 insertions(+), 2 deletions(-)
> >
> > diff --git a/fs/smb/client/cifstransport.c b/fs/smb/client/cifstransport.c
> > index 28d1cee90625..6c1fbf0bef6d 100644
> > --- a/fs/smb/client/cifstransport.c
> > +++ b/fs/smb/client/cifstransport.c
> > @@ -169,12 +169,18 @@ cifs_check_receive(struct mid_q_entry *mid, struct TCP_Server_Info *server,
> >
> >               iov[0].iov_base = mid->resp_buf;
> >               iov[0].iov_len = len;
> > -             /* FIXME: add code to kill session */
> > +
> >               rc = cifs_verify_signature(&rqst, server,
> >                                          mid->sequence_number);
> > -             if (rc)
> > +             if (rc) {
> >                       cifs_server_dbg(VFS, "SMB signature verification returned error = %d\n",
> >                                rc);
> > +
> > +                     if (!(server->sec_mode & SECMODE_SIGN_REQUIRED)) {
> > +                             cifs_reconnect(server, true);
> > +                             return rc;
> > +                     }
> > +             }
> >       }
> >
> >       /* BB special case reconnect tid and uid here? */
> Hi, I am writing this as a ping for this patch. Thanks

merged into cifs-2.6.git for-next but had to rebase it to merge into
current code.

Have you verified the behavior of default (smb3.1.1) mounts as well?

-- 
Thanks,

Steve

Re: [PATCH v2] smb: client: terminate session upon failed client required signing

[Aaditya Kansal]

On 2/16/26 00:01, Steve French wrote:
> On Sun, Feb 15, 2026 at 7:17 AM Aaditya Kansal
> <aadityakansal390@gmail.com> wrote:
>>
>>
>> On 2/5/26 06:30, Aaditya Kansal wrote:
>>> Currently, when smb signature verification fails, the behaviour is to log
>>> the failure without any action to terminate the session.
>>>
>>> Call cifs_reconnect() when client required signature verification fails.
>>> Otherwise, log the error without reconnecting.
>>>
>>> Signed-off-by: Aaditya Kansal <aadityakansal390@gmail.com>
>>> ---
>>> Changes in v2:
>>> - reconnect only triggered when client required signature verification fails
>>> ---
>>>  fs/smb/client/cifstransport.c | 10 ++++++++--
>>>  1 file changed, 8 insertions(+), 2 deletions(-)
>>>
>>> diff --git a/fs/smb/client/cifstransport.c b/fs/smb/client/cifstransport.c
>>> index 28d1cee90625..6c1fbf0bef6d 100644
>>> --- a/fs/smb/client/cifstransport.c
>>> +++ b/fs/smb/client/cifstransport.c
>>> @@ -169,12 +169,18 @@ cifs_check_receive(struct mid_q_entry *mid, struct TCP_Server_Info *server,
>>>
>>>               iov[0].iov_base = mid->resp_buf;
>>>               iov[0].iov_len = len;
>>> -             /* FIXME: add code to kill session */
>>> +
>>>               rc = cifs_verify_signature(&rqst, server,
>>>                                          mid->sequence_number);
>>> -             if (rc)
>>> +             if (rc) {
>>>                       cifs_server_dbg(VFS, "SMB signature verification returned error = %d\n",
>>>                                rc);
>>> +
>>> +                     if (!(server->sec_mode & SECMODE_SIGN_REQUIRED)) {
>>> +                             cifs_reconnect(server, true);
>>> +                             return rc;
>>> +                     }
>>> +             }
>>>       }
>>>
>>>       /* BB special case reconnect tid and uid here? */
>> Hi, I am writing this as a ping for this patch. Thanks
> merged into cifs-2.6.git for-next but had to rebase it to merge into
> current code.
>
> Have you verified the behavior of default (smb3.1.1) mounts as well?
>
Thank you. Yes, I have checked it for the default version.
Tested for both client required and server required signature verification.

-- 
-AK

Re: [PATCH v2] smb: client: terminate session upon failed client required signing

[Steve French]

On Sun, Feb 15, 2026 at 1:23 PM Aaditya Kansal
<aadityakansal390@gmail.com> wrote:
>
>
> On 2/16/26 00:01, Steve French wrote:
> > On Sun, Feb 15, 2026 at 7:17 AM Aaditya Kansal
> > <aadityakansal390@gmail.com> wrote:
> >>
> >>
> >> On 2/5/26 06:30, Aaditya Kansal wrote:
> >>> Currently, when smb signature verification fails, the behaviour is to log
> >>> the failure without any action to terminate the session.
> >>>
> >>> Call cifs_reconnect() when client required signature verification fails.
> >>> Otherwise, log the error without reconnecting.
> >>>
> >>> Signed-off-by: Aaditya Kansal <aadityakansal390@gmail.com>
> >>> ---
> >>> Changes in v2:
> >>> - reconnect only triggered when client required signature verification fails
> >>> ---
> >>>  fs/smb/client/cifstransport.c | 10 ++++++++--
> >>>  1 file changed, 8 insertions(+), 2 deletions(-)
> >>>
> >>> diff --git a/fs/smb/client/cifstransport.c b/fs/smb/client/cifstransport.c
> >>> index 28d1cee90625..6c1fbf0bef6d 100644
> >>> --- a/fs/smb/client/cifstransport.c
> >>> +++ b/fs/smb/client/cifstransport.c
> >>> @@ -169,12 +169,18 @@ cifs_check_receive(struct mid_q_entry *mid, struct TCP_Server_Info *server,
> >>>
> >>>               iov[0].iov_base = mid->resp_buf;
> >>>               iov[0].iov_len = len;
> >>> -             /* FIXME: add code to kill session */
> >>> +
> >>>               rc = cifs_verify_signature(&rqst, server,
> >>>                                          mid->sequence_number);
> >>> -             if (rc)
> >>> +             if (rc) {
> >>>                       cifs_server_dbg(VFS, "SMB signature verification returned error = %d\n",
> >>>                                rc);
> >>> +
> >>> +                     if (!(server->sec_mode & SECMODE_SIGN_REQUIRED)) {
> >>> +                             cifs_reconnect(server, true);
> >>> +                             return rc;
> >>> +                     }
> >>> +             }
> >>>       }
> >>>
> >>>       /* BB special case reconnect tid and uid here? */
> >> Hi, I am writing this as a ping for this patch. Thanks
> > merged into cifs-2.6.git for-next but had to rebase it to merge into
> > current code.
> >
> > Have you verified the behavior of default (smb3.1.1) mounts as well?
> >
> Thank you. Yes, I have checked it for the default version.
> Tested for both client required and server required signature verification.

You were able to verify (simulate) it as well for default ie SMB3.1.1
(not just for SMB1
which this patch fixes), and no changes needed for SMB3.1.1?


-- 
Thanks,

Steve

Re: [PATCH v2] smb: client: terminate session upon failed client required signing

[Aaditya Kansal]

On 2/16/26 02:38, Steve French wrote:
> On Sun, Feb 15, 2026 at 1:23 PM Aaditya Kansal
> <aadityakansal390@gmail.com> wrote:
>>
>> On 2/16/26 00:01, Steve French wrote:
>>> On Sun, Feb 15, 2026 at 7:17 AM Aaditya Kansal
>>> <aadityakansal390@gmail.com> wrote:
>>>>
>>>> On 2/5/26 06:30, Aaditya Kansal wrote:
>>>>> Currently, when smb signature verification fails, the behaviour is to log
>>>>> the failure without any action to terminate the session.
>>>>>
>>>>> Call cifs_reconnect() when client required signature verification fails.
>>>>> Otherwise, log the error without reconnecting.
>>>>>
>>>>> Signed-off-by: Aaditya Kansal <aadityakansal390@gmail.com>
>>>>> ---
>>>>> Changes in v2:
>>>>> - reconnect only triggered when client required signature verification fails
>>>>> ---
>>>>>  fs/smb/client/cifstransport.c | 10 ++++++++--
>>>>>  1 file changed, 8 insertions(+), 2 deletions(-)
>>>>>
>>>>> diff --git a/fs/smb/client/cifstransport.c b/fs/smb/client/cifstransport.c
>>>>> index 28d1cee90625..6c1fbf0bef6d 100644
>>>>> --- a/fs/smb/client/cifstransport.c
>>>>> +++ b/fs/smb/client/cifstransport.c
>>>>> @@ -169,12 +169,18 @@ cifs_check_receive(struct mid_q_entry *mid, struct TCP_Server_Info *server,
>>>>>
>>>>>               iov[0].iov_base = mid->resp_buf;
>>>>>               iov[0].iov_len = len;
>>>>> -             /* FIXME: add code to kill session */
>>>>> +
>>>>>               rc = cifs_verify_signature(&rqst, server,
>>>>>                                          mid->sequence_number);
>>>>> -             if (rc)
>>>>> +             if (rc) {
>>>>>                       cifs_server_dbg(VFS, "SMB signature verification returned error = %d\n",
>>>>>                                rc);
>>>>> +
>>>>> +                     if (!(server->sec_mode & SECMODE_SIGN_REQUIRED)) {
>>>>> +                             cifs_reconnect(server, true);
>>>>> +                             return rc;
>>>>> +                     }
>>>>> +             }
>>>>>       }
>>>>>
>>>>>       /* BB special case reconnect tid and uid here? */
>>>> Hi, I am writing this as a ping for this patch. Thanks
>>> merged into cifs-2.6.git for-next but had to rebase it to merge into
>>> current code.
>>>
>>> Have you verified the behavior of default (smb3.1.1) mounts as well?
>>>
>> Thank you. Yes, I have checked it for the default version.
>> Tested for both client required and server required signature verification.
> You were able to verify (simulate) it as well for default ie SMB3.1.1
> (not just for SMB1
> which this patch fixes), and no changes needed for SMB3.1.1?
>
>
Yes, I verified for default version (3.1.1). First I set signing
required option on server side,
then I set the sign flag on client side. SMB3.1.1 mounts with no issues.

-- 
-AK

Re: [PATCH v2] smb: client: terminate session upon failed client required signing

[Steve French]

On Sun, Feb 15, 2026 at 4:42 PM Aaditya Kansal
<aadityakansal390@gmail.com> wrote:
>
>
>
> On 2/16/26 02:38, Steve French wrote:
> > On Sun, Feb 15, 2026 at 1:23 PM Aaditya Kansal
> > <aadityakansal390@gmail.com> wrote:
> >>
> >> On 2/16/26 00:01, Steve French wrote:
> >>> On Sun, Feb 15, 2026 at 7:17 AM Aaditya Kansal
> >>> <aadityakansal390@gmail.com> wrote:
> >>>>
> >>>> On 2/5/26 06:30, Aaditya Kansal wrote:
> >>>>> Currently, when smb signature verification fails, the behaviour is to log
> >>>>> the failure without any action to terminate the session.
> >>>>>
> >>>>> Call cifs_reconnect() when client required signature verification fails.
> >>>>> Otherwise, log the error without reconnecting.
> >>>>>
> >>>>> Signed-off-by: Aaditya Kansal <aadityakansal390@gmail.com>
> >>>>> ---
> >>>>> Changes in v2:
> >>>>> - reconnect only triggered when client required signature verification fails
> >>>>> ---
> >>>>>  fs/smb/client/cifstransport.c | 10 ++++++++--
> >>>>>  1 file changed, 8 insertions(+), 2 deletions(-)
> >>>>>
> >>>>> diff --git a/fs/smb/client/cifstransport.c b/fs/smb/client/cifstransport.c
> >>>>> index 28d1cee90625..6c1fbf0bef6d 100644
> >>>>> --- a/fs/smb/client/cifstransport.c
> >>>>> +++ b/fs/smb/client/cifstransport.c
> >>>>> @@ -169,12 +169,18 @@ cifs_check_receive(struct mid_q_entry *mid, struct TCP_Server_Info *server,
> >>>>>
> >>>>>               iov[0].iov_base = mid->resp_buf;
> >>>>>               iov[0].iov_len = len;
> >>>>> -             /* FIXME: add code to kill session */
> >>>>> +
> >>>>>               rc = cifs_verify_signature(&rqst, server,
> >>>>>                                          mid->sequence_number);
> >>>>> -             if (rc)
> >>>>> +             if (rc) {
> >>>>>                       cifs_server_dbg(VFS, "SMB signature verification returned error = %d\n",
> >>>>>                                rc);
> >>>>> +
> >>>>> +                     if (!(server->sec_mode & SECMODE_SIGN_REQUIRED)) {
> >>>>> +                             cifs_reconnect(server, true);
> >>>>> +                             return rc;
> >>>>> +                     }
> >>>>> +             }
> >>>>>       }
> >>>>>
> >>>>>       /* BB special case reconnect tid and uid here? */
> >>>> Hi, I am writing this as a ping for this patch. Thanks
> >>> merged into cifs-2.6.git for-next but had to rebase it to merge into
> >>> current code.
> >>>
> >>> Have you verified the behavior of default (smb3.1.1) mounts as well?
> >>>
> >> Thank you. Yes, I have checked it for the default version.
> >> Tested for both client required and server required signature verification.
> > You were able to verify (simulate) it as well for default ie SMB3.1.1
> > (not just for SMB1
> > which this patch fixes), and no changes needed for SMB3.1.1?
> >
> >
> Yes, I verified for default version (3.1.1). First I set signing
> required option on server side,
> then I set the sign flag on client side. SMB3.1.1 mounts with no issues.

How were you able to simulate bad signatures being sent from the server
for SMB3.1.1? and for SMB1?

-- 
Thanks,

Steve

Re: [PATCH v2] smb: client: terminate session upon failed client required signing

[Aaditya Kansal]

On 2/16/26 06:54, Steve French wrote:
> On Sun, Feb 15, 2026 at 4:42 PM Aaditya Kansal
> <aadityakansal390@gmail.com> wrote:
>>
>>
>> On 2/16/26 02:38, Steve French wrote:
>>> On Sun, Feb 15, 2026 at 1:23 PM Aaditya Kansal
>>> <aadityakansal390@gmail.com> wrote:
>>>> On 2/16/26 00:01, Steve French wrote:
>>>>> On Sun, Feb 15, 2026 at 7:17 AM Aaditya Kansal
>>>>> <aadityakansal390@gmail.com> wrote:
>>>>>> On 2/5/26 06:30, Aaditya Kansal wrote:
>>>>>>> Currently, when smb signature verification fails, the behaviour is to log
>>>>>>> the failure without any action to terminate the session.
>>>>>>>
>>>>>>> Call cifs_reconnect() when client required signature verification fails.
>>>>>>> Otherwise, log the error without reconnecting.
>>>>>>>
>>>>>>> Signed-off-by: Aaditya Kansal <aadityakansal390@gmail.com>
>>>>>>> ---
>>>>>>> Changes in v2:
>>>>>>> - reconnect only triggered when client required signature verification fails
>>>>>>> ---
>>>>>>>  fs/smb/client/cifstransport.c | 10 ++++++++--
>>>>>>>  1 file changed, 8 insertions(+), 2 deletions(-)
>>>>>>>
>>>>>>> diff --git a/fs/smb/client/cifstransport.c b/fs/smb/client/cifstransport.c
>>>>>>> index 28d1cee90625..6c1fbf0bef6d 100644
>>>>>>> --- a/fs/smb/client/cifstransport.c
>>>>>>> +++ b/fs/smb/client/cifstransport.c
>>>>>>> @@ -169,12 +169,18 @@ cifs_check_receive(struct mid_q_entry *mid, struct TCP_Server_Info *server,
>>>>>>>
>>>>>>>               iov[0].iov_base = mid->resp_buf;
>>>>>>>               iov[0].iov_len = len;
>>>>>>> -             /* FIXME: add code to kill session */
>>>>>>> +
>>>>>>>               rc = cifs_verify_signature(&rqst, server,
>>>>>>>                                          mid->sequence_number);
>>>>>>> -             if (rc)
>>>>>>> +             if (rc) {
>>>>>>>                       cifs_server_dbg(VFS, "SMB signature verification returned error = %d\n",
>>>>>>>                                rc);
>>>>>>> +
>>>>>>> +                     if (!(server->sec_mode & SECMODE_SIGN_REQUIRED)) {
>>>>>>> +                             cifs_reconnect(server, true);
>>>>>>> +                             return rc;
>>>>>>> +                     }
>>>>>>> +             }
>>>>>>>       }
>>>>>>>
>>>>>>>       /* BB special case reconnect tid and uid here? */
>>>>>> Hi, I am writing this as a ping for this patch. Thanks
>>>>> merged into cifs-2.6.git for-next but had to rebase it to merge into
>>>>> current code.
>>>>>
>>>>> Have you verified the behavior of default (smb3.1.1) mounts as well?
>>>>>
>>>> Thank you. Yes, I have checked it for the default version.
>>>> Tested for both client required and server required signature verification.
>>> You were able to verify (simulate) it as well for default ie SMB3.1.1
>>> (not just for SMB1
>>> which this patch fixes), and no changes needed for SMB3.1.1?
>>>
>>>
>> Yes, I verified for default version (3.1.1). First I set signing
>> required option on server side,
>> then I set the sign flag on client side. SMB3.1.1 mounts with no issues.
> How were you able to simulate bad signatures being sent from the server
> for SMB3.1.1? and for SMB1?
>
I changed the condition that checks cifs_verify_signature on client side
and set it
to true, to ensure the failed signature verification path is hit. For
cifs, it reconnected on
client required signature verification and for server side, it just
logged the error.
For SMB3.1.1, the path doesn't hit and the behavior remains unchanged.

-- 
-AK