[GIT PULL] ksmbd server fixes for 7.4-rc1

[Namjae Jeon]

Hi Linus,

This is ksmbd server fixes pull request for v7.4-rc1. I add a description of
this pull request below. Please pull ksmbd with following ones.

Thanks!

The following changes since commit 6b4b543fa18757297ac756a6fe6e64f506b7844a:

  Merge tag 'parisc-for-7.4-rc1' of
git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux
(2026-10-25 18:04:17 -1000)

are available in the Git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/smb.git
tags/ksmbd-for-7.4-rc1-part2

for you to fetch changes up to 206fc30f71b005156085fd8523ccc84a2c67791b:

  ksmbd: return complete and aligned stream information (2026-10-28
17:57:07 +0900)

----------------------------------------------------------------
 - Fix compound CREATE response buffer sizing and reserve space for final
   response padding to prevent buffer overflows and out-of-bounds reads.

 - Allocate sufficient space for UTF-16 directory-name conversion,
   including the terminating NUL.

 - Fix an RDMA transfer length underflow that can cause out-of-bounds
   reads or writes when processing multiple remote buffer descriptors.

 - Fix use-after-free bugs during failed durable reconnect cleanup and
   AppInstanceId supersede racing with session teardown.

 - Keep retry timeout clamp bounds constant to fix a MIPS build
   failure with CONFIG_HZ=1024.

 - Fix a session reference leak in compounded SESSION_SETUP and reject
   compounded session binding to avoid mixing session and tree state
   after a failed binding.

 - Serialize operations on each named pipe and preserve unread RPC reply
   data for subsequent READ requests when the client's output buffer is
   too small.

 - Return complete, eight-byte-aligned stream information entries and
   report insufficient output space correctly.

 - Use the resolved share root path so shares rooted at mount points
   list their contents correctly with crossmnt disabled.

 - Ignore network-device events outside the initial network namespace,
   preventing container interfaces from affecting ksmbd listeners.

----------------------------------------------------------------
Denis Kulikov (1):
      ksmbd: use the resolved share path for the share root

Ian Bridges (5):
      ksmbd: fix app-instance non-durable supersede session UAF
      ksmbd: fix SMB2 CREATE response buffer overflow in compound requests
      ksmbd: fix out-of-bounds read when padding the final compound response
      ksmbd: fix use-after-free after a failed durable reconnect
      ksmbd: fix session reference leak on compounded SESSION_SETUP

Jan Koester (1):
      ksmbd: ignore network devices of other namespaces

Namjae Jeon (3):
      ksmbd: prevent session binding in compound requests
      ksmbd: keep retry timeout clamp bounds constant
      ksmbd: return complete and aligned stream information

Stefan Metzmacher (1):
      smb: smbdirect: fix buffer length underflow in RDMA transfers

VeroFess (1):
      smb: server: size directory name conversion buffer correctly

Wang Zhaolong (2):
      ksmbd: avoid races between named-pipe operations
      ksmbd: fix named-pipe reply loss with small output buffers

 fs/smb/server/mgmt/user_session.c | 128 ++++++----
 fs/smb/server/mgmt/user_session.h |  18 ++
 fs/smb/server/misc.c              |   8 +-
 fs/smb/server/smb2misc.c          |   8 +
 fs/smb/server/smb2pdu.c           | 517 +++++++++++++++++++++++++-------------
 fs/smb/server/transport_ipc.c     |  45 ++--
 fs/smb/server/transport_ipc.h     |  14 +-
 fs/smb/server/transport_tcp.c     |  11 +-
 fs/smb/server/vfs.c               |   9 +-
 fs/smb/server/vfs_cache.c         |  60 ++++-
 fs/smb/server/vfs_cache.h         |   2 +
 fs/smb/smbdirect/rw.c             |   1 -
 12 files changed, 569 insertions(+), 252 deletions(-)