Commit 1229e2e57a5c for kernel

commit 1229e2e57a5c2980ccd457b9b53ea0eed5a22ab3
Merge: 94dc07d6d99a 15b38176fd15
Author: Linus Torvalds <torvalds@linux-foundation.org>
Date:   Fri Jul 17 21:41:54 2026 -0700

    Merge tag 'v7.2-rc3-smb3-server-fixes' of git://git.samba.org/ksmbd

    Pull smb server fixes from Steve French:
     "ksmbd server fixes, mostly addressing malformed SMB request
      handling and connection/session lifetime issues, including
      two information-disclosure or memory-safety bugs in the SMB2
      request/response paths.

       - validate FILE_ALLOCATION_INFORMATION before block rounding to
         prevent a client-controlled overflow from truncating a file.

       - pin connections while asynchronous oplock and lease-break
         notifications are pending.

       - initialize compound SMB2 READ alignment padding, preventing
         disclosure of uninitialized heap bytes.

       - release the allocated alternate-stream xattr name after rename.

       - size multichannel binding session-key buffers for the largest
         permitted key, avoiding a stack buffer overflow.

       - remove a disconnecting connection's channels from every session,
         including channels whose binding state has since changed.

       - serialize binding preauthentication-session lookup and update
         against its teardown.

       - check that every compound request element contains StructureSize2
         before reading it"

    * tag 'v7.2-rc3-smb3-server-fixes' of git://git.samba.org/ksmbd:
      ksmbd: validate compound request size before reading StructureSize2
      ksmbd: lock the binding preauth session in smb3_preauth_hash_rsp
      ksmbd: remove stale channels from all sessions on teardown
      ksmbd: fix stack buffer overflow in multichannel session-key copy
      ksmbd: fix memory leak of xattr_stream_name in smb2_rename()
      ksmbd: zero the smb2_read alignment tail to avoid an infoleak
      ksmbd: pin conn during async oplock break notification
      ksmbd: fix integer overflow in set_file_allocation_info()