]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
Merge tag 'v7.2-rc3-smb3-server-fixes' of git://git.samba.org/ksmbd master
authorLinus Torvalds <torvalds@linux-foundation.org>
Sat, 18 Jul 2026 04:41:54 +0000 (21:41 -0700)
committerLinus Torvalds <torvalds@linux-foundation.org>
Sat, 18 Jul 2026 04:41:54 +0000 (21:41 -0700)
commit1229e2e57a5c2980ccd457b9b53ea0eed5a22ab3
tree99b0a623438bfd56e98260382527e4ed82c2213e
parent94dc07d6d99a9e4e3e2422c1c486cc4349e9e5a7
parent15b38176fd1530372905c602fde51fe89ec8c877
Merge tag 'v7.2-rc3-smb3-server-fixes' of git://git.samba.org/ksmbd

Pull smb server fixes from Steve French:
 "ksmbd server fixes, mostly addressing malformed SMB request
  handling and connection/session lifetime issues, including
  two information-disclosure or memory-safety bugs in the SMB2
  request/response paths.

   - validate FILE_ALLOCATION_INFORMATION before block rounding to
     prevent a client-controlled overflow from truncating a file.

   - pin connections while asynchronous oplock and lease-break
     notifications are pending.

   - initialize compound SMB2 READ alignment padding, preventing
     disclosure of uninitialized heap bytes.

   - release the allocated alternate-stream xattr name after rename.

   - size multichannel binding session-key buffers for the largest
     permitted key, avoiding a stack buffer overflow.

   - remove a disconnecting connection's channels from every session,
     including channels whose binding state has since changed.

   - serialize binding preauthentication-session lookup and update
     against its teardown.

   - check that every compound request element contains StructureSize2
     before reading it"

* tag 'v7.2-rc3-smb3-server-fixes' of git://git.samba.org/ksmbd:
  ksmbd: validate compound request size before reading StructureSize2
  ksmbd: lock the binding preauth session in smb3_preauth_hash_rsp
  ksmbd: remove stale channels from all sessions on teardown
  ksmbd: fix stack buffer overflow in multichannel session-key copy
  ksmbd: fix memory leak of xattr_stream_name in smb2_rename()
  ksmbd: zero the smb2_read alignment tail to avoid an infoleak
  ksmbd: pin conn during async oplock break notification
  ksmbd: fix integer overflow in set_file_allocation_info()