"CIFS VFS: SMB response too short (9 bytes)" when copying data from CIFS mount

[Steve French]

It sounds pretty straightforward if both wireshark and the Linux
kernel client agree and say that this old Samba server sent a
malformed response (presumably a CIFS ReadX response).  Note that this
is an old version of Samba server - Samba 3.6 was released more than 4
years ago.

Try turning off unix extensions on the mount and/or setting rsize
smaller (which might change the behavior of the Samba server read
response).  So try
1) adding something like "rsize=60000" to the options you pass to the
mount command
2) and as a different experiment try mounting with "nounix" to disable
CIFS unix extensions which would also have the affect of reducing the
maximum read size
3) another option to try is to set max protocols in the server's
smb.conf to enable SMB2.0 support and try "vers=2.0" on mount

My guess is that the bug is related to large CIFS read processing in
this old version of Samba.

I also want to --- strongly --- encourage upgrade from Samba 3.6.3 to
at least Samba 4.1 (I use Samba 4.3).  The additional security
features and capabilities which SMB2.1 and SMB3 bring (not just the
new protocol features and improved performance) are VERY helpful and
very important for security.

On Tue, Sep 29, 2015 at 11:04 AM, Andrew Martin <amartin at xes-inc.com> wrote:
> ----- Original Message -----
>> From: "Steve French" <smfrench at gmail.com>
>> To: "Andrew Martin" <amartin at xes-inc.com>
>> Cc: linux-cifs at vger.kernel.org
>> Sent: Monday, September 28, 2015 6:32:51 PM
>> Subject: Re: "CIFS VFS: SMB response too short (9 bytes)" when copying data from CIFS mount
>>
>> It is possible that it is a cifs client bug or a server bug but hard
>> to tell without seeing the trace.  Obviously the client message
>> indicates that the SMB response from the server was invalid (malformed
>> due to server bug) but hard to prove that without looking at a network
>> trace.  See the mention of wireshark at
>>
>> https://wiki.samba.org/index.php/LinuxCIFS_troubleshooting
>>
>>
>> Also it may be better for many use cases to mount with SMB3
>> ("vers=3.0") rather than the ancient cifs dialect (unless the server
>> is Samba where there are "posix extensions" that the client can take
>> advantage of).
>>
>> What is the server version?
>>
> Steve,
>
> The server is Ubuntu 12.04 with Samba 3.6.3, so I am limited to vers=1.0.
> I attempted to pass vers=2.0 (since it looks like basic SMB2 support was
> available in Samba 3.6.3), however it failed to mount with this error:
> mount error(112): Host is down
> Refer to the mount.cifs(8) manual page (e.g. man mount.cifs)
>
> Looking at the Wireshark capture when the "SMB response too short" message
> is being printed, I see the following queries sent before the malformed
> packet:
>
> <client>        <server>        SMB     268     Trans2 Request, QUERY_PATH_INFO, Query File Unix Basic, Path: /path/to/file.txt
> <server>        <client>        SMB     230     Trans2 Response, QUERY_PATH_INFO
> <client>        <server>        SMB     129     Read AndX Request, FID: 0x3134, 131022 bytes at offset 262144
> <server>        <client>        SMB     79      [Malformed Packet] - Expert Info (Error/Malformed): Malformed Packet (Exception occurred)
>
> The server's samba log for the client during this period:
> http://pastebin.com/Y0diqhGY
>
> I also set /proc/fs/cifs/cifsFYI to 7 and captured the following output:
> http://pastebin.com/CfPUtBQg
>
> Note that the Samba share definition is as follows:
> http://pastebin.com/0aVCaRJH
>
> Thanks,
>
> Andrew



-- 
Thanks,

Steve