Re: [BUG 1/3] smb: client: SMB2/3 signature failures are logged but the response is accepted

"Birtwhistle, Daniel" <[email protected]> Mon, 20 Jul 2026 11:51:32 +0000
Newsgroups org.kernel.vger.linux-cifs
Message-ID <SN4PR22MB2888A3C1128344C813F25B22EEC32@SN4PR22MB2888.namprd22.prod.outlook.com>
Thanks, Greg and Willy. Understood. I’ll prepare separate patches for the three reports following Documentation/process/submitting-patches.rst. I’ll keep any reproducer off the public list and provide it privately to the relevant maintainers if needed. I’ll also omit [email protected] from further public-list messages.

________________________________________
From: Greg KH <[email protected]>
Sent: Monday, July 20, 2026 2:13 AM
To: Birtwhistle, Daniel
Cc: Steve French; Paulo Alcantara; [email protected]; [email protected]
Subject: Re: [BUG 1/3] smb: client: SMB2/3 signature failures are logged but the response is accepted

CAUTION: This email originated from outside of GE HealthCare. Only open links or attachments if you trust the sender. Report suspicious emails using Outlook’s “Report” button.

On Sun, Jul 19, 2026 at 06:05:01PM +0000, Birtwhistle, Daniel wrote:
> Hello Steve, Paulo, and linux-cifs maintainers,
>
> My name is Daniel Birtwhistle. In my role, I assess security properties of
> software inherited by GE HealthCare products. I am writing personally as the
> researcher and technical contact.
>
> This is the first of three coordinated CIFS client reports. This message covers
> response-signature enforcement. The companions cover server-provided symlinks
> escaping mount confinement and client-required sealing being dropped after
> reconnect; all three defects have different fixes and can be classified
> independently.

As you sent these to a public list, no need to get [email protected]
involved.

Also:

> I have the minimal candidate patch, source harness, raw transcript, trace
> results and matched controls. I have not posted or attached the reproducer,
> but can provide it directly for review and can test a maintainer-proposed fix.

Always send patches, as the documentation asks, so you can get full
credit for resolving the issue if the fix is correct.

Same for the other 2 emails you sent.

thanks,

greg k-h