Pull smb server fixes from Steve French:
 "ksmbd server fixes, mostly addressing malformed SMB request
  handling and connection/session lifetime issues, including
  two information-disclosure or memory-safety bugs in the SMB2
  request/response paths.

   - validate FILE_ALLOCATION_INFORMATION before block rounding to
     prevent a client-controlled overflow from truncating a file.

   - pin connections while asynchronous oplock and lease-break
     notifications are pending.

   - initialize compound SMB2 READ alignment padding, preventing
     disclosure of uninitialized heap bytes.

   - release the allocated alternate-stream xattr name after rename.

   - size multichannel binding session-key buffers for the largest
     permitted key, avoiding a stack buffer overflow.

   - remove a disconnecting connection's channels from every session,
     including channels whose binding state has since changed.

   - serialize binding preauthentication-session lookup and update
     against its teardown.

   - check that every compound request element contains StructureSize2
     before reading it"

* tag 'v7.2-rc3-smb3-server-fixes' of git://git.samba.org/ksmbd:
  ksmbd: validate compound request size before reading StructureSize2
  ksmbd: lock the binding preauth session in smb3_preauth_hash_rsp
  ksmbd: remove stale channels from all sessions on teardown
  ksmbd: fix stack buffer overflow in multichannel session-key copy
  ksmbd: fix memory leak of xattr_stream_name in smb2_rename()
  ksmbd: zero the smb2_read alignment tail to avoid an infoleak
  ksmbd: pin conn during async oplock break notification
  ksmbd: fix integer overflow in set_file_allocation_info()

Pull smb client fixes from Steve French:

 - fallocate fixes

 - unit test fixes

 - fix allocation size after duplicate extents

 - fix check for overlapping data areas

* tag 'v7.2-rc3-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6:
  smb/client: flush dirty data before punching a hole
  smb/client: Use EXPORT_SYMBOL_IF_KUNIT() to export symbols in SMB2
  smb/client: Use EXPORT_SYMBOL_IF_KUNIT() to export symbols
  smb: client: reject overlapping data areas in SMB2 responses
  smb/client: refresh allocation after EOF-extending fallocate
  smb/client: emulate small EOF-extending mode 0 fallocate ranges
  smb/client: reduce fallocate zero buffer allocation
  smb/client: handle overlapping allocated ranges in fallocate
  smb/client: refresh allocation size after duplicate extents
  smb: client: use kvzalloc() for megabyte buffer in simple fallocate

Pull xfs fixes from Carlos Maiolino:
 "This contains mostly a series of bug fixes found by different LLM
  models"

* tag 'xfs-fixes-7.2-rc4' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux: (21 commits)
  xfs: don't zap bmbt forks if they are MAXLEVELS tall
  xfs: clamp timestamp nanoseconds correctly
  xfs: fully check the parent handle when it points to the rootdir
  xfs: handle non-inode owners for rtrmap record checking
  xfs: fix off-by-one error when calling xchk_xref_has_rt_owner
  xfs: set xfarray killable sort correctly
  xfs: grab rtrmap btree when checking rgsuper
  xfs: write the rg superblock when fixing it
  xfs: use the rt version of the cow staging checker
  xfs: use rtrefcount btree cursor in xchk_xref_is_rt_cow_staging
  xfs: don't wrap around quota ids in dqiterate
  xfs: move cow_replace_mapping to xfs_bmap_util.c
  xfs: make cow repair somewhat flaky when debugging knob enabled
  xfs: don't replace the wrong part of the cow fork
  xfs: resample the data fork mapping after cycling ILOCK
  xfs: fix null pointer dereference in tracepoint
  xfs: use xfs_csn_t for xlog_cil_push_now() push_seq parameter
  xfs: tie zoned sysfs lifetime to zone info
  xfs: fail recovery on a committed log item with no regions
  xfs: splice unsorted log items back to the transaction after the loop
  ...

Pull erofs fixes from Gao Xiang:

 - Fix sanity checks for ztailpacking tail pclusters to avoid
   false corruption reports

 - Use more informative s_id for file-backed mounts

 - Hide the meaningless "cache_strategy=" mount option on plain
   (uncompressed) filesystems

 - Remove the unneeded erofs_is_ishare_inode() helper

* tag 'erofs-for-7.2-rc4-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs:
  erofs: hide "cache_strategy=" for plain filesystems
  erofs: get rid of erofs_is_ishare_inode() helper
  erofs: relax sanity check for tail pclusters due to ztailpacking
  erofs: use more informative s_id for file-backed mounts

When ksmbd validates a compound (chained) SMB2 request,
ksmbd_smb2_check_message() reads pdu->StructureSize2 without first
checking that the compound element is large enough to contain it.
StructureSize2 is a 2-byte field at offset 64
(__SMB2_HEADER_STRUCTURE_SIZE) from the start of each element.

The compound-walking logic only guarantees that a full 64-byte SMB2
header is present for the trailing element: when NextCommand is 0, len is
reduced to the number of bytes remaining after next_smb2_rcv_hdr_off. A
remote client can craft a compound request whose last element has exactly
64 bytes, so the 2-byte StructureSize2 read at offset 64 extends one byte
past the receive buffer, producing a slab-out-of-bounds read.

  BUG: KASAN: slab-out-of-bounds in ksmbd_smb2_check_message (fs/smb/server/smb2misc.c:402)
  Read of size 2 at addr ffff888012ae31ac by task kworker/0:1/14
  The buggy address is located 172 bytes inside of allocated 173-byte region
  Workqueue: ksmbd-io handle_ksmbd_work
  Call Trace:
   ...
   kasan_report (mm/kasan/report.c:595)
   ksmbd_smb2_check_message (fs/smb/server/smb2misc.c:402)
   handle_ksmbd_work (fs/smb/server/server.c:119)
   process_one_work (kernel/workqueue.c:3314)
   worker_thread (kernel/workqueue.c:3397)
   kthread (kernel/kthread.c:436)
   ret_from_fork (arch/x86/kernel/process.c:158)
   ret_from_fork_asm (arch/x86/entry/entry_64.S:245)

Reject any compound element that is too small to hold StructureSize2
before dereferencing it.

Fixes: e2f34481b24d ("cifsd: add server-side procedures for SMB3")
Reported-by: AutonomousCodeSecurity@microsoft.com
Signed-off-by: Xiang Mei (Microsoft) <xmei5@asu.edu>
Acked-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>

smb3_preauth_hash_rsp() computes the SMB3.1.1 preauth integrity hash on
the response path. For a binding SESSION_SETUP it looks up the
per-connection preauth_session and reads its Preauth_HashValue.

smb2_sess_setup() frees that preauth_session under ksmbd_conn_lock().
Two SMB2 requests on one connection can run concurrently, so an unlocked
lookup and hash can use a preauth_session after another worker frees it.

Take ksmbd_conn_lock() before selecting conn->binding and hold it across
the selected preauth hash lookup and update. This preserves the existing
hash selection while preventing the lookup-to-use lifetime race.

Fixes: 1c5daa2ea924 ("ksmbd: handle channel binding with a different user")
Signed-off-by: Gil Portnoy <dddhkts1@gmail.com>
Acked-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>

ksmbd_sessions_deregister() removes a connection's channels from other
sessions' channel lists only while conn->binding is still set:

	if (conn->binding) {
		hash_for_each_safe(sessions_table, ...)
			ksmbd_chann_del(conn, sess);
	}

conn->binding is a transient flag: it is cleared once a binding
SESSION_SETUP completes, and also by a subsequent non-binding
SESSION_SETUP on the same connection (a reauthentication on a bound
channel, or a new SessionId==0 setup). A connection that has bound a
channel into another session's ksmbd_chann_list and then clears
conn->binding leaves that channel behind when it disconnects: the
channel, whose chann->conn points at the now freed struct ksmbd_conn,
stays on the owner session's list.

When the owning connection later tears down, the second loop
dereferences the stale channel:

	xa_for_each(&sess->ksmbd_chann_list, chann_id, chann)
		if (chann->conn != conn)
			ksmbd_conn_set_exiting(chann->conn);   /* freed */

which is a use-after-free write into the freed ksmbd_conn (the same
stale channel is also walked by show_proc_session() through /proc). The
session is leaked as well, because its channel list never empties.

Remove the conn->binding gate so a connection always removes its
channels from every session on teardown.

Fixes: faf8578c77f3 ("ksmbd: find bound sessions during reauthentication")
Signed-off-by: Gil Portnoy <dddhkts1@gmail.com>
Acked-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>

Commit 4b706360ffb7 ("ksmbd: fix multichannel binding and enforce channel
limit") moved the binding-path session key out of the session-wide
sess->sess_key (CIFS_KEY_SIZE = 40) into a new per-channel buffer, and
sized both that buffer and the on-stack copy used during binding with
SMB2_NTLMV2_SESSKEY_SIZE (16):

	struct channel {
		char	sess_key[SMB2_NTLMV2_SESSKEY_SIZE];	/* 16 */
		...
	};

	ntlm_authenticate() / krb5_authenticate():
		char channel_key[SMB2_NTLMV2_SESSKEY_SIZE] = {};	/* 16 */
		char *auth_key = conn->binding ? channel_key : sess->sess_key;

The two writers that fill this destination still bound the copy length
against CIFS_KEY_SIZE (40), not against the 16-byte buffer:

	ksmbd_decode_ntlmssp_auth_blob() (NTLM key exchange):
		if (sess_key_len > CIFS_KEY_SIZE)	/* 40 */
			return -EINVAL;
		arc4_crypt(ctx_arc4, sess_key,
			   (char *)authblob + sess_key_off, sess_key_len);

	ksmbd_krb5_authenticate():
		if (resp->session_key_len > sizeof(sess->sess_key))	/* 40 */
			...
		memcpy(sess_key, resp->payload, resp->session_key_len);

On a binding SESSION_SETUP, auth_key points at the 16-byte channel_key,
so a client that supplies an NTLM EncryptedRandomSessionKey of up to 40
bytes (with NTLMSSP_NEGOTIATE_KEY_EXCH), or a Kerberos ticket whose
session key is longer than 16 bytes (a normal AES256 key is 32), writes
past the 16-byte stack buffer -- up to a 24-byte kernel stack overflow.
KASAN reports it as a stack-out-of-bounds write in arc4_crypt() called
from ksmbd_decode_ntlmssp_auth_blob().

The destinations must be able to hold the full session key the length
checks already permit. Size the per-channel key buffer and the two
on-stack channel_key buffers with CIFS_KEY_SIZE, matching sess->sess_key.

Fixes: 4b706360ffb7 ("ksmbd: fix multichannel binding and enforce channel limit")
Signed-off-by: Gil Portnoy <dddhkts1@gmail.com>
Acked-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>

On an SMB2 SET_INFO(FileRenameInformation) whose target names an alternate
data stream, smb2_rename() obtains a formatted stream-name string from
ksmbd_vfs_xattr_stream_name(), which allocates it with kasprintf() and
returns it through an out-param:

	rc = ksmbd_vfs_xattr_stream_name(stream_name, &xattr_stream_name, ...);
	if (rc)
		goto out;
	rc = ksmbd_vfs_setxattr(..., xattr_stream_name, ...);
	if (rc < 0) {
		...
		goto out;
	}
	goto out;

xattr_stream_name is declared inside the alternate-data-stream block, but
the out: label is outside that block and frees only new_name, so it cannot
release xattr_stream_name. ksmbd_vfs_setxattr() takes a const char * and
only reads the name, so it does not take ownership either. Both the
setxattr-failure and the success path therefore leak the kasprintf()'d
string. An authenticated client with a writable share can leak kernel
memory on every stream rename, exhausting kernel memory over time.

Free xattr_stream_name after its use, before the block's goto out. The
two earlier goto out paths never assign the variable, so there is no
double-free.

Signed-off-by: Gil Portnoy <dddhkts1@gmail.com>
Acked-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>

Commit 6b9a2e09d4cc ("ksmbd: avoid zeroing the read buffer in smb2_read()")
switched the SMB2 READ payload buffer from kvzalloc() to kvmalloc(), on the
premise that only the nbytes actually read are ever transmitted, so the
ALIGN(length, 8) tail need not be initialized.

That premise does not hold for a compound response. ksmbd_vfs_read() fills
only nbytes, leaving [nbytes, ALIGN(length, 8)) uninitialized. The aux
payload is pinned as the last response iov with iov_len == nbytes, but when
the READ is a member of a compound, init_chained_smb2_rsp() 8-byte-aligns
the previous member by extending that same iov:

	new_len = ALIGN(len, 8);
	work->iov[work->iov_idx].iov_len += (new_len - len);
	inc_rfc1001_len(work->response_buf, new_len - len);

so up to 7 uninitialized bytes of the kvmalloc()'d slab tail are sent
to the client. When the read length is small the buffer is served from
a general kmalloc slab, so those bytes can be stale kernel-heap
contents, including pointer values -- an information leak usable to
defeat KASLR.

An authenticated client triggers it with a compound request containing a
READ whose returned nbytes is not 8-aligned (for example [READ, CLOSE] with
a 1-byte read).

Zero only the alignment tail after the read, preserving the bulk
no-zeroing optimization of 6b9a2e09d4cc.

Fixes: 6b9a2e09d4cc ("ksmbd: avoid zeroing the read buffer in smb2_read()")
Cc: stable@vger.kernel.org
Signed-off-by: Gil Portnoy <dddhkts1@gmail.com>
Acked-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>