From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 255192737EB; Mon, 23 Mar 2026 14:57:09 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774277829; cv=none; b=Jo2avnylK0FG0zPbqbkQ/LbLXZWqs1dspKRluHf3Ykv392LuQfWsTpC+xzgQhe6oBdzRxIY3DzOBObIy/5aPJD2O+iv6dfCWtWtuFI7f4e7xX6gOOQBt/eUVOTgCNayTZtgauVaLP13Z6LQWwDRsnNvWHSQcayfCQCfm43a6deI= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774277829; c=relaxed/simple; bh=ecwU54a3rfBjqOIqlp52+1V/5aN1CQOMq7CW7AHI76o=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=Lwd/q9+3Cz03yARFjZAtwD4sVYWDAA9uKGprD1AxbSHxVGzymMvi7CbaAdUWgD8vNBO9MxK9AYhb4A0bPOpIDL70oQBjIxXX4fyFDMZS5MiOaATzX8mUwt8cIDBpnCrChALaoPWTxtK62Y9lb+LSBYmrtv5JECSYQxmET8/j/BU= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=kzq1HQ+A; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="kzq1HQ+A" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 97C2DC4CEF7; Mon, 23 Mar 2026 14:57:08 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1774277829; bh=ecwU54a3rfBjqOIqlp52+1V/5aN1CQOMq7CW7AHI76o=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=kzq1HQ+AFfJx4iP+X/v/Ttl6Pi8r6ffJ+4MVs2zvX06QnU8mO3D7QMGrt83NxY5xF P6TdI1ZbbDGrbM3aIEoqygsnEa+Ed+Bo0xuNgL6owQNk//KxGFmMsm4Hkiq/ERktU2 hcM1boVoK8dX4bNiy6Pw9WqgKE4lzMKhFjIz6jd8= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Xiaoli Feng , Enzo Matsumiya , "Paulo Alcantara (Red Hat)" , David Howells , linux-cifs@vger.kernel.org, Steve French Subject: [PATCH 6.6 116/567] smb: client: fix broken multichannel with krb5+signing Date: Mon, 23 Mar 2026 14:40:36 +0100 Message-ID: <20260323134536.683183115@linuxfoundation.org> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260323134533.749096647@linuxfoundation.org> References: <20260323134533.749096647@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: stable@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.6-stable review patch. If anyone has any objections, please let me know. ------------------ From: Paulo Alcantara commit d9d1e319b39ea685ede59319002d567c159d23c3 upstream. When mounting a share with 'multichannel,max_channels=n,sec=krb5i', the client was duplicating signing key for all secondary channels, thus making the server fail all commands sent from secondary channels due to bad signatures. Every channel has its own signing key, so when establishing a new channel with krb5 auth, make sure to use the new session key as the derived key to generate channel's signing key in SMB2_auth_kerberos(). Repro: $ mount.cifs //srv/share /mnt -o multichannel,max_channels=4,sec=krb5i $ sleep 5 $ umount /mnt $ dmesg ... CIFS: VFS: sign fail cmd 0x5 message id 0x2 CIFS: VFS: \\srv SMB signature verification returned error = -13 CIFS: VFS: sign fail cmd 0x5 message id 0x2 CIFS: VFS: \\srv SMB signature verification returned error = -13 CIFS: VFS: sign fail cmd 0x4 message id 0x2 CIFS: VFS: \\srv SMB signature verification returned error = -13 Reported-by: Xiaoli Feng Reviewed-by: Enzo Matsumiya Signed-off-by: Paulo Alcantara (Red Hat) Cc: David Howells Cc: linux-cifs@vger.kernel.org Cc: stable@vger.kernel.org Signed-off-by: Steve French Signed-off-by: Greg Kroah-Hartman --- fs/smb/client/smb2pdu.c | 22 ++++++++++------------ 1 file changed, 10 insertions(+), 12 deletions(-) --- a/fs/smb/client/smb2pdu.c +++ b/fs/smb/client/smb2pdu.c @@ -1660,19 +1660,17 @@ SMB2_auth_kerberos(struct SMB2_sess_data is_binding = (ses->ses_status == SES_GOOD); spin_unlock(&ses->ses_lock); - /* keep session key if binding */ - if (!is_binding) { - kfree_sensitive(ses->auth_key.response); - ses->auth_key.response = kmemdup(msg->data, msg->sesskey_len, - GFP_KERNEL); - if (!ses->auth_key.response) { - cifs_dbg(VFS, "Kerberos can't allocate (%u bytes) memory\n", - msg->sesskey_len); - rc = -ENOMEM; - goto out_put_spnego_key; - } - ses->auth_key.len = msg->sesskey_len; + kfree_sensitive(ses->auth_key.response); + ses->auth_key.response = kmemdup(msg->data, + msg->sesskey_len, + GFP_KERNEL); + if (!ses->auth_key.response) { + cifs_dbg(VFS, "%s: can't allocate (%u bytes) memory\n", + __func__, msg->sesskey_len); + rc = -ENOMEM; + goto out_put_spnego_key; } + ses->auth_key.len = msg->sesskey_len; sess_data->iov[1].iov_base = msg->data + msg->sesskey_len; sess_data->iov[1].iov_len = msg->secblob_len;