* [PATCH] ksmbd: restore Kerberos logins with released ksmbd-tools
@ 2026-10-21 11:54 Michail Andreas Michalopoulos
2026-10-21 14:13 ` mixalhs
0 siblings, 1 reply; 2+ messages in thread
From: Michail Andreas Michalopoulos @ 2026-10-21 11:54 UTC (permalink / raw)
To: Namjae Jeon
Cc: Sergey Senozhatsky, Tom Talpey, ChenXiaoSong, linux-cifs,
linux-kernel, regressions, Michail Andreas Michalopoulos, stable
Commit a47634cd729b ("ksmbd: expire SMB sessions when Kerberos tickets
expire") added a __u64 session_expiry field to struct
ksmbd_spnego_authen_response, growing it from 156 to 168 bytes.
ipc_validate_msg() requires the response to have exactly that size, so
the 156-byte response of every released ksmbd-tools, up to 3.5.7, is
dropped and Kerberos session setup fails with STATUS_LOGON_FAILURE.
The other way round, kernels without that commit, including the stable
trees, drop the 168-byte response of current ksmbd-tools master, and
ksmbd-tools has no way to tell which layout a kernel expects.
Pass the expiry in the reserved area of the embedded struct
ksmbd_login_response instead. ksmbd-tools releases with that area
(3.4.4 and later) allocate the response zeroed and never write to it,
so they send an expiry of 0, which ksmbd already treats as no expiry.
The response is 156 bytes again, so it works with those releases, and
every kernel also accepts a response that sets the expiry. Use two
__u32 halves, as the reserved area is only 4-byte aligned.
Fixes: a47634cd729b ("ksmbd: expire SMB sessions when Kerberos tickets expire")
Cc: stable@vger.kernel.org
Closes: https://lore.kernel.org/all/CAO+rqLhpPvY0NLrAnZjFXz0gOXnA6zsXxK8xCgtA42XUkSsAeg@mail.gmail.com/
Assisted-by: LLM
Signed-off-by: Michail Andreas Michalopoulos <mike.michalo@gmail.com>
---
The matching ksmbd-tools change (struct layout and mountd/worker.c)
will follow as a pull request.
Tested with a local MIT KDC and smbclient --use-kerberos=required:
3.5.7 master master + tools change
7.2 login OK fails login OK
7.3 fails login OK fails
7.3 + this patch login OK fails login OK
With this patch and the tools change, smbtorture smb2.session over
Kerberos (including expire1n/1s/1e, expire2s/2e and expire_disconnect)
and the 190 smbtorture tests run by the ksmbd CI over NTLM give the same
results as 7.3 with ksmbd-tools master, with no kernel warnings. NTLM
logins also work with 3.5.7. A test-only mountd that overrides the
expiry (including values above 2^32), the response size and the length
fields found no wrong session expiry and no kernel warnings in 313
logins.
Current ksmbd-tools master needs the tools change to work with this
patch. If you'd rather the kernel also kept accepting the 168-byte
layout, I can add that in a v2. Only tested with smbclient and
smbtorture on x86_64.
fs/smb/server/auth.c | 3 ++-
fs/smb/server/ksmbd_netlink.h | 5 +++--
2 files changed, 5 insertions(+), 3 deletions(-)
diff --git a/fs/smb/server/auth.c b/fs/smb/server/auth.c
index 1b24eb3f3998..8e5a1b10db6a 100644
--- a/fs/smb/server/auth.c
+++ b/fs/smb/server/auth.c
@@ -464,7 +464,8 @@ int ksmbd_krb5_authenticate(struct ksmbd_session *sess, char *in_blob,
memcpy(out_blob, resp->payload + resp->session_key_len,
resp->spnego_blob_len);
*out_len = resp->spnego_blob_len;
- sess->kerberos_expiry = resp->session_expiry;
+ sess->kerberos_expiry = (u64)resp->login_response.session_expiry_hi << 32 |
+ resp->login_response.session_expiry_lo;
retval = 0;
out:
kvfree_sensitive(resp, sizeof(*resp) + resp->session_key_len +
diff --git a/fs/smb/server/ksmbd_netlink.h b/fs/smb/server/ksmbd_netlink.h
index 2673522c76bc..fc6af757e45e 100644
--- a/fs/smb/server/ksmbd_netlink.h
+++ b/fs/smb/server/ksmbd_netlink.h
@@ -148,7 +148,9 @@ struct ksmbd_login_response {
__u16 status;
__u16 hash_sz; /* hash size */
__s8 hash[KSMBD_REQ_MAX_HASH_SZ]; /* password hash */
- __u32 reserved[16]; /* Reserved room */
+ __u32 session_expiry_lo; /* Kerberos ticket expiry, SPNEGO only */
+ __u32 session_expiry_hi;
+ __u32 reserved[14]; /* Reserved room */
};
/*
@@ -286,7 +288,6 @@ struct ksmbd_spnego_authen_response {
* stored in SecurityBuffer of SMB2 SESSION
* SETUP response
*/
- __u64 session_expiry; /* Kerberos ticket expiry time */
__u8 payload[]; /* session key + AP_REP */
};
--
2.56.0
^ permalink raw reply [flat|nested] 2+ messages in thread
* Re: [PATCH] ksmbd: restore Kerberos logins with released ksmbd-tools
2026-10-21 11:54 [PATCH] ksmbd: restore Kerberos logins with released ksmbd-tools Michail Andreas Michalopoulos
@ 2026-10-21 14:13 ` mixalhs
0 siblings, 0 replies; 2+ messages in thread
From: mixalhs @ 2026-10-21 14:13 UTC (permalink / raw)
To: Namjae Jeon
Cc: Sergey Senozhatsky, Tom Talpey, ChenXiaoSong, linux-cifs,
linux-kernel, regressions, stable
The ksmbd-tools side is up as
https://github.com/cifsd-team/ksmbd-tools/pull/347
Michalis
On Wed, Oct 21, 2026 at 1:54 PM Michail Andreas Michalopoulos
<mike.michalo@gmail.com> wrote:
>
> Commit a47634cd729b ("ksmbd: expire SMB sessions when Kerberos tickets
> expire") added a __u64 session_expiry field to struct
> ksmbd_spnego_authen_response, growing it from 156 to 168 bytes.
> ipc_validate_msg() requires the response to have exactly that size, so
> the 156-byte response of every released ksmbd-tools, up to 3.5.7, is
> dropped and Kerberos session setup fails with STATUS_LOGON_FAILURE.
> The other way round, kernels without that commit, including the stable
> trees, drop the 168-byte response of current ksmbd-tools master, and
> ksmbd-tools has no way to tell which layout a kernel expects.
>
> Pass the expiry in the reserved area of the embedded struct
> ksmbd_login_response instead. ksmbd-tools releases with that area
> (3.4.4 and later) allocate the response zeroed and never write to it,
> so they send an expiry of 0, which ksmbd already treats as no expiry.
> The response is 156 bytes again, so it works with those releases, and
> every kernel also accepts a response that sets the expiry. Use two
> __u32 halves, as the reserved area is only 4-byte aligned.
>
> Fixes: a47634cd729b ("ksmbd: expire SMB sessions when Kerberos tickets expire")
> Cc: stable@vger.kernel.org
> Closes: https://lore.kernel.org/all/CAO+rqLhpPvY0NLrAnZjFXz0gOXnA6zsXxK8xCgtA42XUkSsAeg@mail.gmail.com/
> Assisted-by: LLM
> Signed-off-by: Michail Andreas Michalopoulos <mike.michalo@gmail.com>
> ---
> The matching ksmbd-tools change (struct layout and mountd/worker.c)
> will follow as a pull request.
>
> Tested with a local MIT KDC and smbclient --use-kerberos=required:
>
> 3.5.7 master master + tools change
> 7.2 login OK fails login OK
> 7.3 fails login OK fails
> 7.3 + this patch login OK fails login OK
>
> With this patch and the tools change, smbtorture smb2.session over
> Kerberos (including expire1n/1s/1e, expire2s/2e and expire_disconnect)
> and the 190 smbtorture tests run by the ksmbd CI over NTLM give the same
> results as 7.3 with ksmbd-tools master, with no kernel warnings. NTLM
> logins also work with 3.5.7. A test-only mountd that overrides the
> expiry (including values above 2^32), the response size and the length
> fields found no wrong session expiry and no kernel warnings in 313
> logins.
>
> Current ksmbd-tools master needs the tools change to work with this
> patch. If you'd rather the kernel also kept accepting the 168-byte
> layout, I can add that in a v2. Only tested with smbclient and
> smbtorture on x86_64.
>
> fs/smb/server/auth.c | 3 ++-
> fs/smb/server/ksmbd_netlink.h | 5 +++--
> 2 files changed, 5 insertions(+), 3 deletions(-)
>
> diff --git a/fs/smb/server/auth.c b/fs/smb/server/auth.c
> index 1b24eb3f3998..8e5a1b10db6a 100644
> --- a/fs/smb/server/auth.c
> +++ b/fs/smb/server/auth.c
> @@ -464,7 +464,8 @@ int ksmbd_krb5_authenticate(struct ksmbd_session *sess, char *in_blob,
> memcpy(out_blob, resp->payload + resp->session_key_len,
> resp->spnego_blob_len);
> *out_len = resp->spnego_blob_len;
> - sess->kerberos_expiry = resp->session_expiry;
> + sess->kerberos_expiry = (u64)resp->login_response.session_expiry_hi << 32 |
> + resp->login_response.session_expiry_lo;
> retval = 0;
> out:
> kvfree_sensitive(resp, sizeof(*resp) + resp->session_key_len +
> diff --git a/fs/smb/server/ksmbd_netlink.h b/fs/smb/server/ksmbd_netlink.h
> index 2673522c76bc..fc6af757e45e 100644
> --- a/fs/smb/server/ksmbd_netlink.h
> +++ b/fs/smb/server/ksmbd_netlink.h
> @@ -148,7 +148,9 @@ struct ksmbd_login_response {
> __u16 status;
> __u16 hash_sz; /* hash size */
> __s8 hash[KSMBD_REQ_MAX_HASH_SZ]; /* password hash */
> - __u32 reserved[16]; /* Reserved room */
> + __u32 session_expiry_lo; /* Kerberos ticket expiry, SPNEGO only */
> + __u32 session_expiry_hi;
> + __u32 reserved[14]; /* Reserved room */
> };
>
> /*
> @@ -286,7 +288,6 @@ struct ksmbd_spnego_authen_response {
> * stored in SecurityBuffer of SMB2 SESSION
> * SETUP response
> */
> - __u64 session_expiry; /* Kerberos ticket expiry time */
> __u8 payload[]; /* session key + AP_REP */
> };
>
> --
> 2.56.0
>
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2026-10-21 14:14 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2026-10-21 11:54 [PATCH] ksmbd: restore Kerberos logins with released ksmbd-tools Michail Andreas Michalopoulos
2026-10-21 14:13 ` mixalhs
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®