Commit 1e9cdc2ea15a for kernel

commit 1e9cdc2ea15adf4a821eefedabf6c0c8cf0b6a55
Merge: dac0b8c58757 f363a0fb134a
Author: Linus Torvalds <torvalds@linux-foundation.org>
Date:   Fri Jul 3 18:55:34 2026 -1000

    Merge tag 'v7.2-rc1-smb3-server-fixes' of git://git.samba.org/ksmbd

    Pull smb server fixes from Steve French:

     - Fix several use-after-free races in durable handle reconnect,
       supersede, and oplock handling

     - Avoid holding the inode oplock lock while waiting for a lease break
       acknowledgement. This removes delays of up to 35 seconds when cifs.ko
       closes a deferred handle in response to a lease break

     - Fix malformed security descriptor handling, including an undersized
       DACL allocation issue and an out-of-bounds ACE SID read

     - Fix memory leaks in security descriptor and DOS attribute xattr
       encoding/decoding error paths

     - Fix outstanding SMB2 credit leaks on aborted requests and correct the
       QUERY_INFO credit charge calculation

     - Fix hard-link creation without replacement being incorrectly rejected
       when the handle lacks DELETE access

     - Avoid unnecessary zeroing of large SMB2 read buffers

     - Add an oplock list lockdep annotation and update the documented
       support status for durable handles and SMB3.1.1 compression

     - Durable handle fixes to address ownership and lifetime races during
       reconnect, session teardown, oplock handling, and superseding opens,
       preventing stale session and file references from being used by
       concurrent operations

    * tag 'v7.2-rc1-smb3-server-fixes' of git://git.samba.org/ksmbd:
      ksmbd: fix app-instance durable supersede session UAF
      ksmbd: snapshot previous oplock state before durable checks
      ksmbd: close superseded durable handles through refcount handoff
      ksmbd: fix use-after-free of fp->owner.name in durable handle owner check
      smb/server: do not require delete access for non-replacing links
      ksmbd: don't hold ci->m_lock while waiting for a lease break ack
      ksmbd: doc: update feature support status for durable handles and compression
      ksmbd: annotate oplock list traversals under m_lock
      ksmbd: fix outstanding credit leak on abort and error paths
      ksmbd: fix credit charge calculation for SMB2 QUERY_INFO
      ksmbd: avoid zeroing the read buffer in smb2_read()
      ksmbd: validate num_subauth when copying ACE in set_ntacl_dacl
      ksmbd: reject undersized DACLs before parsing ACEs
      ksmbd: fix n.data memory leak in ksmbd_vfs_set_dos_attrib_xattr
      ksmbd: Fix acl.sd_buf memory leak and invalid sd_size error handling
      ksmbd: fix sd_ndr.data memory leak in ksmbd_vfs_set_sd_xattr