5.15-stable patches

added patches:
	ksmbd-unset-conn-binding-on-failed-binding-request.patch

diff --git a/queue-5.15/ksmbd-unset-conn-binding-on-failed-binding-request.patch b/queue-5.15/ksmbd-unset-conn-binding-on-failed-binding-request.patch
new file mode 100644 (file)
index 0000000..a55717a
--- /dev/null
+++ b/queue-5.15/ksmbd-unset-conn-binding-on-failed-binding-request.patch
@@ -0,0 +1,36 @@
+From 282343cf8a4a5a3603b1cb0e17a7083e4a593b03 Mon Sep 17 00:00:00 2001
+From: Namjae Jeon <linkinjeon@kernel.org>
+Date: Fri, 13 Mar 2026 10:00:58 +0900
+Subject: ksmbd: unset conn->binding on failed binding request
+
+From: Namjae Jeon <linkinjeon@kernel.org>
+
+commit 282343cf8a4a5a3603b1cb0e17a7083e4a593b03 upstream.
+
+When a multichannel SMB2_SESSION_SETUP request with
+SMB2_SESSION_REQ_FLAG_BINDING fails ksmbd sets conn->binding = true
+but never clears it on the error path. This leaves the connection in
+a binding state where all subsequent ksmbd_session_lookup_all() calls
+fall back to the global sessions table. This fix it by clearing
+conn->binding = false in the error path.
+
+Cc: stable@vger.kernel.org
+Reported-by: Hyunwoo Kim <imv4bel@gmail.com>
+Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Alva Lan <alvalan9@foxmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/ksmbd/smb2pdu.c |    1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/fs/ksmbd/smb2pdu.c
++++ b/fs/ksmbd/smb2pdu.c
+@@ -1949,6 +1949,7 @@ out_err:
+                       }
+               }
+               smb2_set_err_rsp(work);
++              conn->binding = false;
+       } else {
+               unsigned int iov_len;
+ 

diff --git a/queue-5.15/series b/queue-5.15/series
index 729b6d597ded8c72d7446846e2ccca1936fb1b8c..6f7b1563b85173bcd7c1b8ace9e93182e299dc6a 100644 (file)
--- a/queue-5.15/series
+++ b/queue-5.15/series
@@ -166,3 +166,4 @@ revert-wifi-cfg80211-stop-nan-and-p2p-in-cfg80211_leave.patch
 scripts-dtc-remove-unused-dts_version-in-dtc-lexer.l.patch
 io_uring-poll-fix-epoll_uring_wake-sometimes-not-being-masked-in.patch
 io_uring-poll-fix-backport-of-io_poll_add-changes.patch
+ksmbd-unset-conn-binding-on-failed-binding-request.patch