From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=100.103.45.18 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1792774979; b=tgOu+0MmFUt/4vUN/mKsg3l84HU8hh6ZXgMQtVoMJ49LMuMQ5ZUavwgPGERpPsHxmUvf 2jYb1ESElKOojgTpggvQqAYLLIGDjoD+ERq6vAZfTlHQgA1LRPbu/slYr9wa4SJpdHMDU jh5cqPkRpAHMP9gNWjtQd2zNPBfo/JrTi2trGkvvjx2/Y0FQuU6u1zwNZANB8TqhODU+C YL3ZXTsLR7u/esdSE9heDsl85ruxpgJURLmXtpczIyleE3v0ODAcsZoNMvZUIpuBaT/kK pAv2D7/n8lAMGa+BAB6ocdIjg98CyZfq1JhqPv/fmPhU0PbIPYhvcnROW+XxZ2XCohw== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1792774979; h=Received:DKIM-Signature:From:To:Cc:Subject:Date:Message-ID:X-Mailer: In-Reply-To:References:User-Agent:X-stable:X-Patchwork-Hint: MIME-Version:Content-Transfer-Encoding; bh=ZwxcIaljnNycQhvPYPc1sh9w4K2Mb6dD7LkMynB4nAM=; b=3B3e9wTwTmGSA4kf+HBZV55iL5js7Avl1n8zR3rld4rkHVw81L6u4uXBKjfBVEZH7Tg9 spteQdZNNVZ76YlGkcTRjoOMBQvlVNq7aVB+ESeBucIMySmWHZGnZxSbLs9neQgcIgVjk RuQT4+YzpTpP75DX7bArlmHuTrin0e1OaflVhwt6dIvIFJ7IWy2e6cXrn3DepLuIzRh2f LFlfjkrZhZYuBxcy/uu+3j+OqWD2gOSJU3JJgyyEm1L96FCQXg091M1nudkTciSTFX/L4 B94oDKdxLI8Qoy/sHgqN808fwqVK17IlkcmlB1Hq/PETa8+ylC6kyTVN3w4v3XIpBzw== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=elYcZmHq; arc=none smtp.remote-ip=100.103.45.18 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 98808606A31B; Fri, 23 Oct 2026 17:02:59 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key, unprotected) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=elYcZmHq Received: by smtp.kernel.org (Postfix) with ESMTPSA id 9B3A51F01825; Fri, 23 Oct 2026 17:02:58 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1792774979; bh=ZwxcIaljnNycQhvPYPc1sh9w4K2Mb6dD7LkMynB4nAM=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=elYcZmHqGvidd7qDKKDe5lKhH/t+38lB7ane+ZhqL8auGwNNvSvM5bfsMEOMqCC5e VB3pClZvbKfxjPwHYSfa3ygBnEgxZNB9kTTvje961FkYQbWukdPB9zigsQ9wccdwCo MpbfcGx4t8ZVUH9JTyJ38ZulaYbeYrXB/s97P8pA= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Jacob Shivers , Ronnie Sahlberg , Shyam Prasad N , Tom Talpey , Bharath SM , Namjae Jeon , Paulo Alcantara Subject: [PATCH 7.2 222/242] smb: client: fix multiuser mount with krb5 Date: Fri, 23 Oct 2026 18:41:04 +0200 Message-ID: <20261023163719.078902680@linuxfoundation.org> X-Mailer: git-send-email 2.56.0 In-Reply-To: <20261023163713.816071858@linuxfoundation.org> References: <20261023163713.816071858@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore X-Mailing-List: patches@lists.linux.dev List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 7.2-stable review patch. If anyone has any objections, please let me know. ------------------ From: Paulo Alcantara commit 69499395867332364ed4ac8b546537eb3bab6ebb upstream. Customer reported that they could no longer mount their SMB shares with multiuser mount option and krb5. Turned out that the client wasn't duplicating username option when creating multiuser connections, therefore failing to retrieve credentials as cifs.upcall(8) couldn't find them in keytab. Fix this by duplicating username option (if set) from original fs context before creating multiuser connections with krb5. Reproducer: ``` $ ktutil ktutil: add_entry -password -p testuser -k 1 -e aes256-cts Password for testuser@ZELDA.TEST: ktutil: write_kt /etc/krb5.keytab ktutil: quit $ klist -ke Keytab name: FILE:/etc/krb5.keytab KVNO Principal ---- ---------------------------------------------------------------- 1 testuser@ZELDA.TEST (aes256-cts-hmac-sha1-96) $ mount.cifs //w22-root2/scratch /mnt/1 -o \ uid=1000,sec=krb5,username=testuser@ZELDA.TEST,multiuser mount error(13): Permission denied Refer to the mount.cifs(8) manual page (e.g. man mount.cifs) and kernel log messages (dmesg) ``` Reported-by: Jacob Shivers Fixes: 12b4c5d98cd7 ("smb: client: fix krb5 mount with username option") Cc: Ronnie Sahlberg Cc: Shyam Prasad N Cc: Tom Talpey Cc: Bharath SM Cc: Namjae Jeon Cc: stable@vger.kernel.org Reviewed-by: Namjae Jeon Signed-off-by: Paulo Alcantara Signed-off-by: Greg Kroah-Hartman --- fs/smb/client/connect.c | 21 ++++++++++++++++----- 1 file changed, 16 insertions(+), 5 deletions(-) --- a/fs/smb/client/connect.c +++ b/fs/smb/client/connect.c @@ -4201,14 +4201,25 @@ cifs_setup_session(const unsigned int xi return rc; } -static int -cifs_set_vol_auth(struct smb3_fs_context *ctx, struct cifs_ses *ses) +static int set_fs_context_auth(struct smb3_fs_context *ctx, + struct cifs_ses *ses) { ctx->sectype = ses->sectype; - /* krb5 is special, since we don't need username or pw */ - if (ctx->sectype == Kerberos) + /* + * krb5 is special as we might need to pass username (passwordless) down + * to cifs.upcall(8) for keytab. + */ + if (ctx->sectype == Kerberos) { + if (ses->user_name && ses->user_name[0]) { + ctx->username = kstrndup(ses->user_name, + CIFS_MAX_USERNAME_LEN, + GFP_KERNEL); + if (!ctx->username) + return -ENOMEM; + } return 0; + } return cifs_set_cifscreds(ctx, ses); } @@ -4248,7 +4259,7 @@ cifs_construct_tcon(struct cifs_sb_info ctx->dfs_root_ses = master_tcon->ses->dfs_root_ses; ctx->unicode = master_tcon->ses->unicode; - rc = cifs_set_vol_auth(ctx, master_tcon->ses); + rc = set_fs_context_auth(ctx, master_tcon->ses); if (rc) { tcon = ERR_PTR(rc); goto out;