[GIT PULL] ksmbd server fixes for 7.3-rc2 part2

[Namjae Jeon]

Hi Linus,

This is ksmbd server fixes pull request for v7.3-rc2. I add a description of
this pull request below. Please pull ksmbd with following ones.

Thanks!

The following changes since commit 89a312991dc6e638a36adc43ccb91dbc25504c04:

  Merge tag 'cifs-fixes-7.3-rc2' of https://git.manguebit.org/linux
(2026-09-01 13:37:14 -0700)

are available in the Git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/smb.git
tags/ksmbd-for-7.3-rc2-part2

for you to fetch changes up to b5ec6c462aab1062cf5d1e667ba7c6442f737055:

  ksmbd: fix tree connection use-after-free in smb2_tree_connect()
(2026-09-02 17:58:35 +0900)

----------------------------------------------------------------
 - Fix a tree connection use-after-free in smb2_tree_connect() by
   balancing references across concurrent connect, disconnect, and
   session logoff paths.

 - Validate source and target ranges in COPYCHUNK requests before range
   locking and copy operations.

 - Fix an oplock break notification UAF by acquiring a connection
   reference under ksmbd_inode lock and releasing it after the
   notification work completes.

 - Fix the sparc build by using an unsigned int for the atomic work
   state, ensuring xchg() uses a supported four-byte operation.

----------------------------------------------------------------
Abdifatah Suruur (1):
      ksmbd: fix use-after-free in oplock break notification

Alon Shakevsky (1):
      ksmbd: validate COPYCHUNK source and target ranges

Cen Zhang (Microsoft Security FORGE Labs) (1):
      ksmbd: fix tree connection use-after-free in smb2_tree_connect()

Namjae Jeon (1):
      ksmbd: fix sparc build with atomic work state

 fs/smb/server/ksmbd_work.h        |  2 +-
 fs/smb/server/mgmt/tree_connect.c |  8 +++++
 fs/smb/server/oplock.c            | 73 ++++++++++++++++++++++++++++++---------
 fs/smb/server/smb2pdu.c           | 28 +++++++--------
 fs/smb/server/vfs.c               | 12 ++++++-
 5 files changed, 90 insertions(+), 33 deletions(-)