[GIT PULL] ksmbd server fixes

[Steve French]

Please pull the following changes since commit
a13c140cc289c0b7b3770bce5b3ad42ab35074aa:

  Linux 7.2-rc3 (2026-07-12 14:16:39 -0700)

are available in the Git repository at:

  git://git.samba.org/ksmbd.git tags/v7.2-rc3-smb3-server-fixes

for you to fetch changes up to 15b38176fd1530372905c602fde51fe89ec8c877:

  ksmbd: validate compound request size before reading StructureSize2
(2026-07-16 10:18:25 -0500)

----------------------------------------------------------------
This contains a set of eight ksmbd server fixes, mostly addressing malformed
SMB request handling and connection/session lifetime issues, including two
information-disclosure or memory-safety bugs in the SMB2 request/response
paths.

- validate FILE_ALLOCATION_INFORMATION before block rounding to prevent a
  client-controlled overflow from truncating a file.
- pin connections while asynchronous oplock and lease-break notifications
  are pending.
- initialize compound SMB2 READ alignment padding, preventing disclosure of
  uninitialized heap bytes.
- release the allocated alternate-stream xattr name after rename.
- size multichannel binding session-key buffers for the largest permitted
  key, avoiding a stack buffer overflow.
- remove a disconnecting connection's channels from every session, including
  channels whose binding state has since changed.
- serialize binding preauthentication-session lookup and update against its
  teardown.
- check that every compound request element contains StructureSize2 before
  reading it.
----------------------------------------------------------------
Gil Portnoy (5):
      ksmbd: zero the smb2_read alignment tail to avoid an infoleak
      ksmbd: fix memory leak of xattr_stream_name in smb2_rename()
      ksmbd: fix stack buffer overflow in multichannel session-key copy
      ksmbd: remove stale channels from all sessions on teardown
      ksmbd: lock the binding preauth session in smb3_preauth_hash_rsp

Ibrahim Hashimov (1):
      ksmbd: fix integer overflow in set_file_allocation_info()

Qihang (1):
      ksmbd: pin conn during async oplock break notification

Xiang Mei (Microsoft) (1):
      ksmbd: validate compound request size before reading StructureSize2

 fs/smb/server/mgmt/user_session.c | 25 +++++++++-----------
 fs/smb/server/mgmt/user_session.h |  2 +-
 fs/smb/server/oplock.c            |  6 +++--
 fs/smb/server/smb2misc.c          |  5 ++++
 fs/smb/server/smb2pdu.c           | 50 +++++++++++++++++++++++++++------------
 5 files changed, 56 insertions(+), 32 deletions(-)

-- 
Thanks,

Steve