From 2cbd4a8bf460cdf414a2d7e4912c5bcfe3d0fdc2 Mon Sep 17 00:00:00 2001 From: Namjae Jeon Date: Thu, 13 Aug 2026 09:00:00 +0900 Subject: [PATCH] ksmbd: fix encrypted request lookup on bound channels An SMB3 multichannel binding registers the secondary connection in the session channel list, but does not insert the session into the secondary connection's session xarray. The decryption path only searches the connection-local xarray. As a result, every encrypted request received on a bound channel fails with "Could not get decryption key". Use the channel-aware session lookup for decryption. Also stop using the temporary conn->binding flag to decide whether the global lookup is allowed. Validate the permanent channel association under chann_lock instead. Fixes: f5a544e3bab7 ("ksmbd: add support for SMB3 multichannel") Signed-off-by: Namjae Jeon --- fs/smb/server/auth.c | 2 +- fs/smb/server/mgmt/user_session.c | 11 +++++++++-- 2 files changed, 10 insertions(+), 3 deletions(-) diff --git a/fs/smb/server/auth.c b/fs/smb/server/auth.c index 2f89af029247..bcd371f5550d 100644 --- a/fs/smb/server/auth.c +++ b/fs/smb/server/auth.c @@ -729,7 +729,7 @@ static int ksmbd_get_encryption_key(struct ksmbd_work *work, __u64 ses_id, * that the command can reach the session setup handler. Other * commands are rejected there with STATUS_NETWORK_SESSION_EXPIRED. */ - sess = ksmbd_session_lookup(work->conn, ses_id); + sess = ksmbd_session_lookup_all_states(work->conn, ses_id); if (sess && sess->state != SMB2_SESSION_VALID && (sess->state != SMB2_SESSION_EXPIRED || !sess->kerberos_expiry)) { diff --git a/fs/smb/server/mgmt/user_session.c b/fs/smb/server/mgmt/user_session.c index f4675c457714..31eccad5d732 100644 --- a/fs/smb/server/mgmt/user_session.c +++ b/fs/smb/server/mgmt/user_session.c @@ -551,11 +551,18 @@ struct ksmbd_session *ksmbd_session_lookup_all_states(struct ksmbd_conn *conn, unsigned long long id) { struct ksmbd_session *sess; + bool channel_found; sess = ksmbd_session_lookup(conn, id); - if (!sess && conn->binding) { + if (!sess) { sess = ksmbd_session_lookup_slowpath(id); - if (sess && !xa_load(&sess->ksmbd_chann_list, (long)conn)) { + if (!sess) + return NULL; + + down_read(&sess->chann_lock); + channel_found = xa_load(&sess->ksmbd_chann_list, (long)conn); + up_read(&sess->chann_lock); + if (!channel_found) { ksmbd_user_session_put(sess); sess = NULL; }