Re: [PATCH] ksmbd: restore Kerberos logins with released ksmbd-tools

[mixalhs]

The ksmbd-tools side is up as
https://github.com/cifsd-team/ksmbd-tools/pull/347

Michalis

On Wed, Oct 21, 2026 at 1:54 PM Michail Andreas Michalopoulos
<mike.michalo@xxxxxxxxx> wrote:
>
> Commit a47634cd729b ("ksmbd: expire SMB sessions when Kerberos tickets
> expire") added a __u64 session_expiry field to struct
> ksmbd_spnego_authen_response, growing it from 156 to 168 bytes.
> ipc_validate_msg() requires the response to have exactly that size, so
> the 156-byte response of every released ksmbd-tools, up to 3.5.7, is
> dropped and Kerberos session setup fails with STATUS_LOGON_FAILURE.
> The other way round, kernels without that commit, including the stable
> trees, drop the 168-byte response of current ksmbd-tools master, and
> ksmbd-tools has no way to tell which layout a kernel expects.
>
> Pass the expiry in the reserved area of the embedded struct
> ksmbd_login_response instead. ksmbd-tools releases with that area
> (3.4.4 and later) allocate the response zeroed and never write to it,
> so they send an expiry of 0, which ksmbd already treats as no expiry.
> The response is 156 bytes again, so it works with those releases, and
> every kernel also accepts a response that sets the expiry. Use two
> __u32 halves, as the reserved area is only 4-byte aligned.
>
> Fixes: a47634cd729b ("ksmbd: expire SMB sessions when Kerberos tickets expire")
> Cc: stable@xxxxxxxxxxxxxxx
> Closes: https://lore.kernel.org/all/CAO+rqLhpPvY0NLrAnZjFXz0gOXnA6zsXxK8xCgtA42XUkSsAeg@xxxxxxxxxxxxxx/
> Assisted-by: LLM
> Signed-off-by: Michail Andreas Michalopoulos <mike.michalo@xxxxxxxxx>
> ---
> The matching ksmbd-tools change (struct layout and mountd/worker.c)
> will follow as a pull request.
>
> Tested with a local MIT KDC and smbclient --use-kerberos=required:
>
>                     3.5.7      master     master + tools change
>   7.2               login OK   fails      login OK
>   7.3               fails      login OK   fails
>   7.3 + this patch  login OK   fails      login OK
>
> With this patch and the tools change, smbtorture smb2.session over
> Kerberos (including expire1n/1s/1e, expire2s/2e and expire_disconnect)
> and the 190 smbtorture tests run by the ksmbd CI over NTLM give the same
> results as 7.3 with ksmbd-tools master, with no kernel warnings. NTLM
> logins also work with 3.5.7. A test-only mountd that overrides the
> expiry (including values above 2^32), the response size and the length
> fields found no wrong session expiry and no kernel warnings in 313
> logins.
>
> Current ksmbd-tools master needs the tools change to work with this
> patch. If you'd rather the kernel also kept accepting the 168-byte
> layout, I can add that in a v2. Only tested with smbclient and
> smbtorture on x86_64.
>
>  fs/smb/server/auth.c          | 3 ++-
>  fs/smb/server/ksmbd_netlink.h | 5 +++--
>  2 files changed, 5 insertions(+), 3 deletions(-)
>
> diff --git a/fs/smb/server/auth.c b/fs/smb/server/auth.c
> index 1b24eb3f3998..8e5a1b10db6a 100644
> --- a/fs/smb/server/auth.c
> +++ b/fs/smb/server/auth.c
> @@ -464,7 +464,8 @@ int ksmbd_krb5_authenticate(struct ksmbd_session *sess, char *in_blob,
>         memcpy(out_blob, resp->payload + resp->session_key_len,
>                resp->spnego_blob_len);
>         *out_len = resp->spnego_blob_len;
> -       sess->kerberos_expiry = resp->session_expiry;
> +       sess->kerberos_expiry = (u64)resp->login_response.session_expiry_hi << 32 |
> +                               resp->login_response.session_expiry_lo;
>         retval = 0;
>  out:
>         kvfree_sensitive(resp, sizeof(*resp) + resp->session_key_len +
> diff --git a/fs/smb/server/ksmbd_netlink.h b/fs/smb/server/ksmbd_netlink.h
> index 2673522c76bc..fc6af757e45e 100644
> --- a/fs/smb/server/ksmbd_netlink.h
> +++ b/fs/smb/server/ksmbd_netlink.h
> @@ -148,7 +148,9 @@ struct ksmbd_login_response {
>         __u16   status;
>         __u16   hash_sz;                        /* hash size */
>         __s8    hash[KSMBD_REQ_MAX_HASH_SZ];    /* password hash */
> -       __u32   reserved[16];                   /* Reserved room */
> +       __u32   session_expiry_lo;      /* Kerberos ticket expiry, SPNEGO only */
> +       __u32   session_expiry_hi;
> +       __u32   reserved[14];                   /* Reserved room */
>  };
>
>  /*
> @@ -286,7 +288,6 @@ struct ksmbd_spnego_authen_response {
>                                   * stored in SecurityBuffer of SMB2 SESSION
>                                   * SETUP response
>                                   */
> -       __u64   session_expiry; /* Kerberos ticket expiry time */
>         __u8    payload[]; /* session key + AP_REP */
>  };
>
> --
> 2.56.0
>