[PATCH v2 0/2] ksmbd: fix named-pipe reply loss and operation races

[Wang Zhaolong]

This series fixes two related problems in the ksmbd SMB2 named-pipe
implementation.

Patch 1 serializes operations per pipe and keeps the pipe state and handle
alive until all users finish. It avoids holding the session RPC lock across
IPC waits, rechecks cancellation and teardown after taking the pipe lock,
and releases the handle only after the last user. This is also the lifetime
model needed by the following patch.

Patch 2 keeps unread RPC reply bytes on the pipe. A short TRANSCEIVE may
return STATUS_BUFFER_OVERFLOW and a prefix, but the remaining bytes stay
available to a later READ. The reply is freed only when drained, or when
the pipe is closed, logged off or disconnected. Failed response
preparation or input requests do not discard output the client has not
received.

Bugzilla references:
  222196: short PIPE_TRANSCEIVE output loses unread RPC reply bytes
  222197: same-pipe RPC replies can reach the wrong request

Changes in v2:
- Rebased from f47d223627f8 to 21a7f44fd076.
- Fixed the W=1 kernel-doc warnings in patch 2 by moving
  smb2_pipe_response_done() above the smb2_read_pipe() kernel-doc comment.
  This is a comment-placement change; there is no runtime behavior change.
- Added the corresponding Bugzilla links to the commits, and added
  Reported-by/Closes for the kernel test robot W=1 report.
- No other functional changes from v1.

The series was tested on 21a7f44fd076 with a 2632-byte NetrShareEnum reply:
the base loses 2120 bytes with a 512-byte output cap, while the fixed
series returns 512 + 2120 = 2632 bytes. The same-pipe overlap test used
SIGSTOP on ksmbd.mountd and verified each SMB MessageID against its own
RPC call ID.
No test-only kernel delay patch is included or required.

Wang Zhaolong (2):
  ksmbd: avoid races between named-pipe operations
  ksmbd: fix named-pipe reply loss with small output buffers

 fs/smb/server/mgmt/user_session.c | 127 +++++++++-----
 fs/smb/server/mgmt/user_session.h |  18 ++
 fs/smb/server/smb2pdu.c           | 283 ++++++++++++++++++++----------
 fs/smb/server/transport_ipc.c     |  45 +++--
 fs/smb/server/transport_ipc.h     |  14 +-
 5 files changed, 323 insertions(+), 164 deletions(-)


base-commit: 21a7f44fd0765fcc5194130b28767786eba1d1e7