Pull fscrypt fixes from Eric Biggers:

 - Fix a bug where in a specific edge case, file contents en/decryption
   could be done with the wrong data unit size

 - Fix the data structure used for keeping track of users that have
   added an fscrypt key to be a simple list instead of a 'struct key'
   keyring

   This fixes issues such as a lockdep report found by syzbot and
   possible unintended interactions with the keyctl() system calls

* tag 'fscrypt-for-linus' of git://git.kernel.org/pub/scm/fs/fscrypt/linux:
  fscrypt: Replace mk_users keyring with simple list
  fscrypt: Fix key setup in edge case with multiple data unit sizes

Pull ceph updates from Ilya Dryomov:
 "This adds support for manual client session reset in CephFS, allowing
  operators to get out of tricky livelock situations involving caps and
  file locks without evicting the problematic client instance on the MDS
  side or rebooting the client node both of which can be disruptive"

* tag 'ceph-for-7.2-rc1' of https://github.com/ceph/ceph-client:
  ceph: add manual reset debugfs control and tracepoints
  ceph: add client reset state machine and session teardown
  ceph: add diagnostic timeout loop to wait_caps_flush()
  ceph: harden send_mds_reconnect and handle active-MDS peer reset
  ceph: use proper endian conversion for flock_len in reconnect
  ceph: convert inode flags to named bit positions and atomic bitops
  rbd: switch to dynamic root device

Pull gfs2 updates from Andreas Gruenbacher:

 - fix page poisoning not handled correctly when growing files

 - quota initialization / destruction fixes: sleeping under a bitlock in
   PREEMPT_RT, broken quota_init error recovery, missing RCU
   synchronization

* tag 'gfs2-for-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/gfs2/linux-gfs2:
  gfs2: page poisoning fix
  gfs2: Remove unused fallocate_chunk argument
  gfs2: fix use-after-free in gfs2_qd_dealloc
  gfs2: move quota_init qc iterator increment
  gfs2: fix quota init duplicate scan

Pull ecryptfs updates from Tyler Hicks:
 "No functional changes, just code cleanups:

   - replace kmalloc()/snprintf() with kasprintf()

   - simplify code flow by removing an unnecessary variable"

* tag 'ecryptfs-7.2-rc1-updates' of git://git.kernel.org/pub/scm/linux/kernel/git/tyhicks/ecryptfs:
  ecryptfs: use kasprintf in ecryptfs_crypto_api_algify_cipher_name
  ecryptfs: remove redundant variable found_auth_tok

Pull smb server updates from Steve French:
 "This is mostly a correctness and compatibility update for ksmbd's
  SMB2/3 lease, oplock, durable handle, compound request, CREATE,
  rename, stream and share-mode handling.

  A large part of the series fixes cases found by smbtorture where ksmbd
  diverged from the SMB2/3 protocol requirements.

  The main changes are:

   - Rework SMB2 lease state handling so lease state is shared per
     ClientGuid/LeaseKey across opens, with better validation of lease
     create contexts, ACK handling, epochs, break-in-progress reporting,
     v2 lease notification routing, and chained lease breaks

   - Fix several oplock break corner cases, including ACK validation,
     timeout downgrade behavior, level-II break handling on unlink,
     share-conflict lease breaks, and read-control/stat-open behavior

   - Fix durable handle behavior around delete-on-close, stale
     reconnects, reconnect context parsing, oplock/lease break
     invalidation, and durable v2 AppInstanceId replacement

   - Fix compound request handling so related commands propagate failed
     statuses correctly, preserve response framing across chained
     errors, keep compound FIDs across READ/WRITE/FLUSH, and send
     interim STATUS_PENDING where clients expect cancellable compound
     I/O

   - Tighten CREATE and stream semantics, including create attribute
     validation, allocation size reporting, explicit create security
     descriptors, unnamed DATA stream handling, stream directory
     validation, and stream delete sharing against the base file

   - Fix rename and metadata behavior, including parent directory
     sharing checks, denying directory rename with open children, and
     preserving SMB ChangeTime across rename for open handles

   - Fix two important safety issues: a multichannel byte-range lock
     list owner race that could lead to use-after-free, and an NTLMv2
     session key update before authentication proof validation

   - Fix a concurrent SMB2 NEGOTIATE preauth use-after-free, a UBSAN
     warning in compression capability parsing, a false hung-task
     warning in the durable handle scavenger, endian debug logging,
     Smatch indentation warnings, and kernel-doc warnings

   - Increase the default SMB3 transaction size from 1MB to 4MB to
     better match modern read/write negotiation and improve sequential
     I/O behavior"

* tag 'v7.2-rc-part2-smb3-server-fixes' of git://git.samba.org/ksmbd: (50 commits)
  ksmbd: fix kernel-doc warnings in smb2_lease_break_noti()
  ksmbd: fix inconsistent indenting warnings
  ksmbd: validate NTLMv2 response before updating session key
  ksmbd: increase SMB3_DEFAULT_TRANS_SIZE from 1MB to 4MB
  ksmbd: fix UBSAN array-index-out-of-bounds in decode_compress_ctxt()
  ksmbd: sleep interruptibly in the durable handle scavenger
  ksmbd: start file id allocation at 1
  ksmbd: treat read-control opens as stat opens only for leases
  ksmbd: validate :: stream type against directory create
  ksmbd: break conflicting-open leases only as far as needed
  ksmbd: break handle caching for share conflicts
  ksmbd: normalize ungrantable lease states
  ksmbd: return oplock protocol error for level II ack
  ksmbd: avoid level II oplock break notification on unlink
  ksmbd: downgrade oplock after break timeout
  ksmbd: apply create security descriptor first
  ksmbd: return requested create allocation size
  ksmbd: tighten create file attribute validation
  ksmbd: reject empty-attribute synchronize-only create
  ksmbd: honor stream delete sharing for base file
  ...

Pull smb client fixes from Steve French:
 - fix potential double frees
 - fix potential memory leak in receiving compound response
 - querydir improvement
 - fix chown with smb311 posix extensions
 - ACL setting fixes
 - minor debug improvement and cleanup
 - add some missing protocol defines
 - sparse file fixes

* tag 'v7.2-rc-part2-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6:
  cifs: define variable sized buffer for querydir responses
  smb/client: do not account EOF extension as allocation
  smb/client: preserve errors from smb2_set_sparse()
  smb: client: Fix next buffer leak in receive_encrypted_standard()
  smb/client: use %pe to print error pointer
  smb/client: name the default fallocate mode
  smb common: add missing AAPL defines
  smb/client: fix chown/chgrp with SMB3 POSIX Extensions
  smb/client: fix security flag calculation when setting security descriptors
  smb: client: refactor ACL setting control flow in id_mode_to_cifs_acl()
  smb: client: fix query directory replay double-free
  smb: client: fix change notify replay double-free
  smb: client: fix query_info() replay double-free
  smb: client: fix double-free in SMB2_close() replay
  smb: client: fix double-free in SMB2_ioctl() replay
  smb: client: fix double-free in SMB2_open() replay
  smb: client: fix double-free in SMB2_flush() replay

Pull networking fixes from Jakub Kicinski:
 "Including fixes from netfilter and IPsec.

  Current release - regressions:

   - do not acquire dev->tx_global_lock in netdev_watchdog_up()

   - ethtool: keep rtnl_lock for ops using ethtool_op_get_link()

   - fix deadlock in nested UP notifier events

  Current release - new code bugs:

   - eth:
      - cn20k: fix subbank free list indexing for search order
      - airoha: fix BQL underflow in shared QDMA TX ring

  Previous releases - regressions:

   - netfilter:
     - flowtable: fix offloaded ct timeout never being extended
     - nf_conncount: prevent connlimit drops for early confirmed ct

  Previous releases - always broken:

   - require CAP_NET_ADMIN in the originating netns when modifying
     cross-netns devices

   - report NAPI thread PID in the caller's pid namespace

   - mac802154: fix dirty frag in in-place crypto for IOT radios

   - sctp: hold socket lock when dumping endpoints in sctp_diag, avoid
     an overflow

   - eth: gve: fix header buffer corruption with header-split and HW-GRO

   - af_key: initialize alg_key_len for IPComp states, prevent OOB read"

* tag 'net-7.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (213 commits)
  selftests: bonding: add a test for VLAN propagation over a bonded real device
  vlan: defer real device state propagation to netdev_work
  net: add the driver-facing netdev_work scheduling API
  net: turn the rx_mode work into a generic netdev_work facility
  net: ethtool: keep rtnl_lock for ops using ethtool_op_get_link()
  rxrpc: Fix rxrpc_rotate_tx_rotate() to check there's something to rotate
  rxrpc: Fix leak of released call in recvmsg(MSG_PEEK)
  rxrpc: Fix socket notification race
  rxrpc: Fix potential infinite loop in rxrpc_recvmsg()
  rxrpc: Fix oob challenge leak in cleanup after notification failure
  rxrpc: Fix the reception of a reply packet before data transmission
  afs: Fix uncancelled rxrpc OOB message handler
  afs: Fix further netns teardown to cancel the preallocation charger
  rxrpc: Fix double unlock in rxrpc_recvmsg()
  rxrpc: Fix leak of connection from OOB challenge
  rxrpc: Fix ACKALL packet handling
  net: hns3: differentiate autoneg default values between copper and fiber
  net: hns3: fix permanent link down deadlock after reset
  net: hns3: refactor MAC autoneg and speed configuration
  net: hns3: unify copper port ksettings configuration path
  ...

Fix AFS to cancel its OOB message processing (typically to respond to
security challenges).  Also move OOB message processing to afs_wq so that
it's also waited for and make the OOB handler just return if the net
namespace is no longer live.

Fixes: 5800b1cf3fd8 ("rxrpc: Allow CHALLENGEs to the passed to the app for a RESPONSE")
Link: https://sashiko.dev/#/patchset/20260609140911.838677-1-dhowells%40redhat.com
Signed-off-by: David Howells <dhowells@redhat.com>
cc: Li Daming <d4n.for.sec@gmail.com>
cc: Ren Wei <n05ec@lzu.edu.cn>
cc: Marc Dionne <marc.dionne@auristor.com>
cc: Jeffrey Altman <jaltman@auristor.com>
cc: Simon Horman <horms@kernel.org>
cc: linux-afs@lists.infradead.org
cc: stable@kernel.org
Link: https://patch.msgid.link/20260624163819.3017002-6-dhowells@redhat.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

When an afs network namespace is torn down, it cancels and waits for the
work item that keeps the preallocated rxrpc call/conn/peer queue charged
before disabling incoming (i.e. listen 0), but there's a small window in
which it can be requeued by an incoming call wending through the I/O
thread.

Fix this by cancelling the charger work item again after reducing the
listen backlog to zero.

Fixes: 47694fbc9d24 ("afs: Fix netns teardown to cancel the preallocation charger")
Reported-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: David Howells <dhowells@redhat.com>
Link: https://sashiko.dev/#/patchset/20260609140911.838677-1-dhowells%40redhat.com
cc: Li Daming <d4n.for.sec@gmail.com>
cc: Ren Wei <n05ec@lzu.edu.cn>
cc: Marc Dionne <marc.dionne@auristor.com>
cc: Jeffrey Altman <jaltman@auristor.com>
cc: Simon Horman <horms@kernel.org>
cc: linux-afs@lists.infradead.org
cc: stable@kernel.org
Link: https://patch.msgid.link/20260624163819.3017002-5-dhowells@redhat.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

QueryDirectory responses today are stored in one of two fixed
sized buffers: smallbuf (448 bytes) or bigbuf (16KB). These are
borrowed from server struct and are not sufficient for large-sized
query dir operations.

With this change we will now define a new buffer type specifically
for cifs_search_info to hold variable sized responses. These will
be allocated by kmalloc and freed by kfree.

Signed-off-by: Shyam Prasad N <sprasad@microsoft.com>
Signed-off-by: Steve French <stfrench@microsoft.com>