[GIT PULL] ksmbd server fixes

[Steve French]

Please pull the following changes since commit
dc59e4fea9d83f03bad6bddf3fa2e52491777482:

  Linux 7.2-rc1 (2026-06-28 12:01:31 -0700)

are available in the Git repository at:

  git://git.samba.org/ksmbd.git tags/v7.2-rc1-smb3-server-fixes

for you to fetch changes up to f363a0fb134a3eb9e47368b1edbd251fd76be84b:

  ksmbd: fix app-instance durable supersede session UAF (2026-06-30
21:29:46 -0500)

----------------------------------------------------------------
16 ksmbd server fixes

  - Fix several use-after-free races in durable handle reconnect,
    supersede, and oplock handling.
  - Avoid holding the inode oplock lock while waiting for a lease break
    acknowledgement. This removes delays of up to 35 seconds when
    cifs.ko closes a deferred handle in response to a lease break.
  - Fix malformed security descriptor handling, including an undersized
    DACL allocation issue and an out-of-bounds ACE SID read.
  - Fix memory leaks in security descriptor and DOS attribute xattr
    encoding/decoding error paths.
  - Fix outstanding SMB2 credit leaks on aborted requests and correct
    the QUERY_INFO credit charge calculation.
  - Fix hard-link creation without replacement being incorrectly rejected
    when the handle lacks DELETE access.
  - Avoid unnecessary zeroing of large SMB2 read buffers.
  - Add an oplock list lockdep annotation and update the documented
    support status for durable handles and SMB3.1.1 compression.
  - Durable handle fixes to address ownership and lifetime races during
    reconnect, session teardown, oplock handling, and superseding
    opens, preventing stale session and file references from being used
    by concurrent operations.

----------------------------------------------------------------
ChenXiaoSong (1):
      smb/server: do not require delete access for non-replacing links

Gil Portnoy (2):
      ksmbd: fix use-after-free of fp->owner.name in durable handle owner check
      ksmbd: close superseded durable handles through refcount handoff

Haofeng Li (2):
      ksmbd: reject undersized DACLs before parsing ACEs
      ksmbd: validate num_subauth when copying ACE in set_ntacl_dacl

Namjae Jeon (7):
      ksmbd: avoid zeroing the read buffer in smb2_read()
      ksmbd: fix credit charge calculation for SMB2 QUERY_INFO
      ksmbd: fix outstanding credit leak on abort and error paths
      ksmbd: doc: update feature support status for durable handles
and compression
      ksmbd: don't hold ci->m_lock while waiting for a lease break ack
      ksmbd: snapshot previous oplock state before durable checks
      ksmbd: fix app-instance durable supersede session UAF

Qiang Liu (3):
      ksmbd: fix sd_ndr.data memory leak in ksmbd_vfs_set_sd_xattr
      ksmbd: Fix acl.sd_buf memory leak and invalid sd_size error handling
      ksmbd: fix n.data memory leak in ksmbd_vfs_set_dos_attrib_xattr

Runyu Xiao (1):
      ksmbd: annotate oplock list traversals under m_lock

 Documentation/filesystems/smb/ksmbd.rst |   4 +-
 fs/smb/server/ksmbd_work.h              |   7 ++
 fs/smb/server/oplock.c                  | 109 +++++++++++++++++++++++++++-----
 fs/smb/server/server.c                  |  14 ++++
 fs/smb/server/smb2misc.c                |  18 ++++--
 fs/smb/server/smb2pdu.c                 |  17 +++--
 fs/smb/server/smbacl.c                  |  15 ++++-
 fs/smb/server/vfs.c                     |  14 ++--
 fs/smb/server/vfs_cache.c               |  79 +++++++++++++++++------
 9 files changed, 216 insertions(+), 61 deletions(-)

-- 
Thanks,

Steve