ksmbd: encrypt interim responses to encrypted requests

Browse source

The normal response path applies an SMB3 transform when the request was
encrypted.  Async interim responses, completed compound prefixes and two
CHANGE_NOTIFY cleanup paths write their synthetic response work directly,
bypassing that encryption step.

A packet capture shows FE SMB2 STATUS_PENDING, CREATE and CHANGE_NOTIFY
responses following FD SMB3 requests.  The client resets the connection
immediately after receiving those plaintext responses.

Send synthetic interim work through a common helper that applies the
session encryption transform first.  A compound prefix shares the original
work's response iov, which encryption would replace in place, so flatten it
into an independently owned work before encrypting and sending it.

Fixes: 64bfa9d49026 ("smb/server: use MSG_EOR for async interim response")
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>

...

This commit is contained in:

Namjae Jeon 2026-08-13 09:03:00 +09:00

parent c50e628122

commit 2a0e037648

1 changed files with 67 additions and 4 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

71

fs/smb/server/smb2pdu.c

View file