From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=100.103.45.18 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1793210145; b=01d6p2rPDUtssuOg8hd+SzIblFA61MOLDrNn2PvlnVRBhlmHwIxL4mgpqtHL/wh6ppTm lfsM1V3F5dpGGQzqSVAZ9UlFv/K1bX6mvhLnl49AD48t9ZtC0AOoaOiMT4fIJI8uK0kyw o1scttZuyNoDtPJbi9xgyLZTRM6GY1vqZusThiVnPFvsdt6+Jx3V0L8foum3gG2AiB/nz BiCpZMQkVKrL6cY/AmBQsDQ7NKJGTuGiy9V5+7AaBcIIHAuJrQputsdI+GnyyxtVx++Sn z9qSYGB/JpcDSgXUSdrbbCgQ2mIeh9cjDTe0HDOfBfvbBOvo2r+9m4359YBjUYHgdNQ== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1793210145; h=Received:DKIM-Signature:From:To:Cc:Subject:Date:Message-ID:X-Mailer: In-Reply-To:References:User-Agent:X-stable:X-Patchwork-Hint: MIME-Version:Content-Transfer-Encoding; bh=U5i+8fWiEdalFn7/MVUK8fWM0zpAVVZJsK2y6SBDWxo=; b=lsXuiBYu7ki4CwHClJRVhdN1AZHKuqK2zSVtxgQ2JLV14CEK1lPZHQfnQzq6KtVlSeUx qHy3oLNpCJ5pMg2yD0S8u7FeJfZQCMCiAHja63ChUW+q1mA9B/LfxUwYDV8b3qQPopJnD zVLTMQNSEzHIOgRWJqXDSD0XJ1lkqzanYhyThtCw7TrO7jsBV5nfM5j1FmhMWDfqZZ79T UuRA0772Z0jLJINJf81h1TmNZOutQ0JE06nyOhhmpl+quBccu/mNcmwqjwUC5DVtwDNhj CMfzlW4pKea62sdUdNwURHNkdRRU0PhiaVxY4uYXBSxzBFuKrZvgMko3QslumTXEhdg== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=0qebs46Z; arc=none smtp.remote-ip=100.103.45.18 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id DE768606A31C; Wed, 28 Oct 2026 17:55:44 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key, unprotected) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=0qebs46Z Received: by smtp.kernel.org (Postfix) with ESMTPSA id 40ECA1F01825; Wed, 28 Oct 2026 17:55:44 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1793210144; bh=U5i+8fWiEdalFn7/MVUK8fWM0zpAVVZJsK2y6SBDWxo=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=0qebs46ZqCAUTczlmtnd68VKgUhfxVQJYFVeEovj96i6qaeljiT5ScqhZhGa36yov A2+by5HBQih43v4isFFNH5o7rg4XvNGdZjEnSXhHM87HVUOP6ypALojGWSJEcmg4AC nWcJ9cC/2ncGeO6LPWlU0Kfm/fxKi5qQdfQ5bxeA= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Jacob Shivers , Ronnie Sahlberg , Shyam Prasad N , Tom Talpey , Bharath SM , Namjae Jeon , Paulo Alcantara Subject: [PATCH 6.6 090/168] smb: client: fix multiuser mount with krb5 Date: Wed, 28 Oct 2026 18:00:26 +0100 Message-ID: <20261028165945.219682089@linuxfoundation.org> X-Mailer: git-send-email 2.56.0 In-Reply-To: <20261028165943.089486480@linuxfoundation.org> References: <20261028165943.089486480@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore X-Mailing-List: patches@lists.linux.dev List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.6-stable review patch. If anyone has any objections, please let me know. ------------------ From: Paulo Alcantara commit 69499395867332364ed4ac8b546537eb3bab6ebb upstream. Customer reported that they could no longer mount their SMB shares with multiuser mount option and krb5. Turned out that the client wasn't duplicating username option when creating multiuser connections, therefore failing to retrieve credentials as cifs.upcall(8) couldn't find them in keytab. Fix this by duplicating username option (if set) from original fs context before creating multiuser connections with krb5. Reproducer: ``` $ ktutil ktutil: add_entry -password -p testuser -k 1 -e aes256-cts Password for testuser@ZELDA.TEST: ktutil: write_kt /etc/krb5.keytab ktutil: quit $ klist -ke Keytab name: FILE:/etc/krb5.keytab KVNO Principal ---- ---------------------------------------------------------------- 1 testuser@ZELDA.TEST (aes256-cts-hmac-sha1-96) $ mount.cifs //w22-root2/scratch /mnt/1 -o \ uid=1000,sec=krb5,username=testuser@ZELDA.TEST,multiuser mount error(13): Permission denied Refer to the mount.cifs(8) manual page (e.g. man mount.cifs) and kernel log messages (dmesg) ``` Reported-by: Jacob Shivers Fixes: 12b4c5d98cd7 ("smb: client: fix krb5 mount with username option") Cc: Ronnie Sahlberg Cc: Shyam Prasad N Cc: Tom Talpey Cc: Bharath SM Cc: Namjae Jeon Cc: stable@vger.kernel.org Reviewed-by: Namjae Jeon Signed-off-by: Paulo Alcantara Signed-off-by: Greg Kroah-Hartman --- fs/smb/client/connect.c | 21 ++++++++++++++++----- 1 file changed, 16 insertions(+), 5 deletions(-) --- a/fs/smb/client/connect.c +++ b/fs/smb/client/connect.c @@ -4147,14 +4147,25 @@ cifs_setup_session(const unsigned int xi return rc; } -static int -cifs_set_vol_auth(struct smb3_fs_context *ctx, struct cifs_ses *ses) +static int set_fs_context_auth(struct smb3_fs_context *ctx, + struct cifs_ses *ses) { ctx->sectype = ses->sectype; - /* krb5 is special, since we don't need username or pw */ - if (ctx->sectype == Kerberos) + /* + * krb5 is special as we might need to pass username (passwordless) down + * to cifs.upcall(8) for keytab. + */ + if (ctx->sectype == Kerberos) { + if (ses->user_name && ses->user_name[0]) { + ctx->username = kstrndup(ses->user_name, + CIFS_MAX_USERNAME_LEN, + GFP_KERNEL); + if (!ctx->username) + return -ENOMEM; + } return 0; + } return cifs_set_cifscreds(ctx, ses); } @@ -4193,7 +4204,7 @@ cifs_construct_tcon(struct cifs_sb_info ctx->witness = master_tcon->use_witness; ctx->dfs_root_ses = master_tcon->ses->dfs_root_ses; - rc = cifs_set_vol_auth(ctx, master_tcon->ses); + rc = set_fs_context_auth(ctx, master_tcon->ses); if (rc) { tcon = ERR_PTR(rc); goto out;