From: Greg Kroah-Hartman Date: Thu, 23 Apr 2026 12:51:58 +0000 (+0200) Subject: 5.15-stable patches X-Git-Url: http://git.ipfire.org/gitweb/?a=commitdiff_plain;h=cf05c831c4fc6cf97b175c019fe9f8ba7770e20b;p=thirdparty%2Fkernel%2Fstable-queue.git 5.15-stable patches added patches: ksmbd-unset-conn-binding-on-failed-binding-request.patch --- diff --git a/queue-5.15/ksmbd-unset-conn-binding-on-failed-binding-request.patch b/queue-5.15/ksmbd-unset-conn-binding-on-failed-binding-request.patch new file mode 100644 index 0000000000..a55717ae29 --- /dev/null +++ b/queue-5.15/ksmbd-unset-conn-binding-on-failed-binding-request.patch @@ -0,0 +1,36 @@ +From 282343cf8a4a5a3603b1cb0e17a7083e4a593b03 Mon Sep 17 00:00:00 2001 +From: Namjae Jeon +Date: Fri, 13 Mar 2026 10:00:58 +0900 +Subject: ksmbd: unset conn->binding on failed binding request + +From: Namjae Jeon + +commit 282343cf8a4a5a3603b1cb0e17a7083e4a593b03 upstream. + +When a multichannel SMB2_SESSION_SETUP request with +SMB2_SESSION_REQ_FLAG_BINDING fails ksmbd sets conn->binding = true +but never clears it on the error path. This leaves the connection in +a binding state where all subsequent ksmbd_session_lookup_all() calls +fall back to the global sessions table. This fix it by clearing +conn->binding = false in the error path. + +Cc: stable@vger.kernel.org +Reported-by: Hyunwoo Kim +Signed-off-by: Namjae Jeon +Signed-off-by: Steve French +Signed-off-by: Alva Lan +Signed-off-by: Greg Kroah-Hartman +--- + fs/ksmbd/smb2pdu.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/fs/ksmbd/smb2pdu.c ++++ b/fs/ksmbd/smb2pdu.c +@@ -1949,6 +1949,7 @@ out_err: + } + } + smb2_set_err_rsp(work); ++ conn->binding = false; + } else { + unsigned int iov_len; + diff --git a/queue-5.15/series b/queue-5.15/series index 729b6d597d..6f7b1563b8 100644 --- a/queue-5.15/series +++ b/queue-5.15/series @@ -166,3 +166,4 @@ revert-wifi-cfg80211-stop-nan-and-p2p-in-cfg80211_leave.patch scripts-dtc-remove-unused-dts_version-in-dtc-lexer.l.patch io_uring-poll-fix-epoll_uring_wake-sometimes-not-being-masked-in.patch io_uring-poll-fix-backport-of-io_poll_add-changes.patch +ksmbd-unset-conn-binding-on-failed-binding-request.patch