[PATCH] smb: client: fix multiuser mount with krb5

[PATCH] smb: client: fix multiuser mount with krb5

[Paulo Alcantara]

Customer reported that they could no longer mount their SMB shares
with multiuser mount option and krb5.  Turned out that the client
wasn't duplicating username option when creating multiuser
connections, therefore failing to retrieve credentials as
cifs.upcall(8) couldn't find them in keytab.

Fix this by duplicating username option (if set) from original fs
context before creating multiuser connections with krb5.

Reproducer:

  ```
  $ ktutil
  ktutil:  add_entry -password -p testuser -k 1 -e aes256-cts
  Password for testuser@ZELDA.TEST:
  ktutil:  write_kt /etc/krb5.keytab
  ktutil:  quit
  $ klist -ke
  Keytab name: FILE:/etc/krb5.keytab
  KVNO Principal
   ---- ----------------------------------------------------------------
     1 testuser@ZELDA.TEST (aes256-cts-hmac-sha1-96)
  $ mount.cifs //w22-root2/scratch /mnt/1 -o \
      	uid=1000,sec=krb5,username=testuser@ZELDA.TEST,multiuser
  mount error(13): Permission denied
  Refer to the mount.cifs(8) manual page (e.g. man mount.cifs) and
  kernel log messages (dmesg)
  ```

Reported-by: Jacob Shivers <jshivers@redhat.com>
Fixes: 12b4c5d98cd7 ("smb: client: fix krb5 mount with username option")
Signed-off-by: Paulo Alcantara <pc@manguebit.org>
Cc: Ronnie Sahlberg <ronniesahlberg@gmail.com>
Cc: Shyam Prasad N <sprasad@microsoft.com>
Cc: Tom Talpey <tom@talpey.com>
Cc: Bharath SM <bharathsm@microsoft.com>
Cc: Namjae Jeon <linkinjeon@kernel.org>
Cc: stable@vger.kernel.org
---
 fs/smb/client/connect.c | 21 ++++++++++++++++-----
 1 file changed, 16 insertions(+), 5 deletions(-)

diff --git a/fs/smb/client/connect.c b/fs/smb/client/connect.c
index bcd7f1ae99ba..b6e98eb31673 100644
--- a/fs/smb/client/connect.c
+++ b/fs/smb/client/connect.c
@@ -4189,14 +4189,25 @@ cifs_setup_session(const unsigned int xid, struct cifs_ses *ses,
 	return rc;
 }
 
-static int
-cifs_set_vol_auth(struct smb3_fs_context *ctx, struct cifs_ses *ses)
+static int set_fs_context_auth(struct smb3_fs_context *ctx,
+			       struct cifs_ses *ses)
 {
 	ctx->sectype = ses->sectype;
 
-	/* krb5 is special, since we don't need username or pw */
-	if (ctx->sectype == Kerberos)
+	/*
+	 * krb5 is special as we might need to pass username (passwordless) down
+	 * to cifs.upcall(8) for keytab.
+	 */
+	if (ctx->sectype == Kerberos) {
+		if (ses->user_name && ses->user_name[0]) {
+			ctx->username = kstrndup(ses->user_name,
+						 CIFS_MAX_USERNAME_LEN,
+						 GFP_KERNEL);
+			if (!ctx->username)
+				return -ENOMEM;
+		}
 		return 0;
+	}
 
 	return cifs_set_cifscreds(ctx, ses);
 }
@@ -4236,7 +4247,7 @@ cifs_construct_tcon(struct cifs_sb_info *cifs_sb, kuid_t fsuid)
 	ctx->dfs_root_ses = master_tcon->ses->dfs_root_ses;
 	ctx->unicode = master_tcon->ses->unicode;
 
-	rc = cifs_set_vol_auth(ctx, master_tcon->ses);
+	rc = set_fs_context_auth(ctx, master_tcon->ses);
 	if (rc) {
 		tcon = ERR_PTR(rc);
 		goto out;
-- 
2.55.0

Re: [PATCH] smb: client: fix multiuser mount with krb5

[Namjae Jeon]

On Tue, Aug 25, 2026 at 4:59 AM Paulo Alcantara <pc@manguebit.org> wrote:
>
> Customer reported that they could no longer mount their SMB shares
> with multiuser mount option and krb5.  Turned out that the client
> wasn't duplicating username option when creating multiuser
> connections, therefore failing to retrieve credentials as
> cifs.upcall(8) couldn't find them in keytab.
>
> Fix this by duplicating username option (if set) from original fs
> context before creating multiuser connections with krb5.
>
> Reproducer:
>
>   ```
>   $ ktutil
>   ktutil:  add_entry -password -p testuser -k 1 -e aes256-cts
>   Password for testuser@ZELDA.TEST:
>   ktutil:  write_kt /etc/krb5.keytab
>   ktutil:  quit
>   $ klist -ke
>   Keytab name: FILE:/etc/krb5.keytab
>   KVNO Principal
>    ---- ----------------------------------------------------------------
>      1 testuser@ZELDA.TEST (aes256-cts-hmac-sha1-96)
>   $ mount.cifs //w22-root2/scratch /mnt/1 -o \
>         uid=1000,sec=krb5,username=testuser@ZELDA.TEST,multiuser
>   mount error(13): Permission denied
>   Refer to the mount.cifs(8) manual page (e.g. man mount.cifs) and
>   kernel log messages (dmesg)
>   ```
>
> Reported-by: Jacob Shivers <jshivers@redhat.com>
> Fixes: 12b4c5d98cd7 ("smb: client: fix krb5 mount with username option")
> Signed-off-by: Paulo Alcantara <pc@manguebit.org>
> Cc: Ronnie Sahlberg <ronniesahlberg@gmail.com>
> Cc: Shyam Prasad N <sprasad@microsoft.com>
> Cc: Tom Talpey <tom@talpey.com>
> Cc: Bharath SM <bharathsm@microsoft.com>
> Cc: Namjae Jeon <linkinjeon@kernel.org>
> Cc: stable@vger.kernel.org
Reviewed-by: Namjae Jeon <linkinjeon@kernel.org>
Thanks.

Re: [PATCH] smb: client: fix multiuser mount with krb5

[Paulo Alcantara]

Paulo Alcantara <pc@manguebit.org> writes:

> Customer reported that they could no longer mount their SMB shares
> with multiuser mount option and krb5.  Turned out that the client
> wasn't duplicating username option when creating multiuser
> connections, therefore failing to retrieve credentials as
> cifs.upcall(8) couldn't find them in keytab.
>
> Fix this by duplicating username option (if set) from original fs
> context before creating multiuser connections with krb5.
> ...

Applied.