[GIT PULL] ksmbd server update for 7.3-rc1
Namjae Jeon <[email protected]>
| Newsgroups | gmane.linux.kernel |
|---|---|
| Message-ID | <CAKYAXd8PROT1-3CXk2MnJco2KNKH_4iiN-Ypo5vOFWLPhRki4Q@mail.gmail.com> |
Hi Linus,
This is ksmbd server update pull request for v7.3-rc1. I add a description of
this pull request below. Please pull ksmbd with following ones.
Thanks!
The following changes since commit 8d3ae59288f1e7d58d76558a6ee96d533bc5019f:
Linux 7.2 (2026-08-16 14:32:26 -0700)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/smb.git
tags/ksmbd-for-7.3-rc1
for you to fetch changes up to 4c6320e0ad400d4ee41cfde614c05a0d87f54e1b:
MAINTAINERS: update ksmbd repository URL (2026-08-20 22:56:18 +0900)
----------------------------------------------------------------
This contains a set of 142 SMB server updates focused on SMB2 command
sequencing, SMB3 request replay and encryption, Apple Time Machine
interoperability, protocol-compatibility fixes validated with smbtorture,
security hardening, SMB Direct transport support, connection reliability,
and other correctness improvements.
New features:
- Implement the SMB2 command sequence window.
Enforce the credit-based MessageId range for each connection, rejecting
out-of-window, duplicate, and wrapped sequence numbers. This prevents
invalid requests and same-channel replays from being processed.
- Add SMB3 request replay support.
SMB3 clients may resend requests with SMB2_FLAGS_REPLAY_OPERATION after
a channel disconnect when the original response was lost. Track the
required channel and open state to safely handle durable CREATE replays
and make oplock, lease, and lock replays idempotent, avoiding duplicate
state changes and improving multichannel reconnect reliability.
- Add opt-in Apple Time Machine support.
Implement the AAPL negotiation and related Finder, stream, COPYCHUNK,
sparse-file, CHANGE_NOTIFY, and RPC compatibility required for Time
Machine shares, allowing macOS backupd to use ksmbd for backups.
- Add per-share SMB3 encryption support.
Allow individual shares to require SMB3 encryption by advertising
SMB2_SHAREFLAG_ENCRYPT_DATA in TREE_CONNECT responses and rejecting
unencrypted tree connects and plaintext requests for protected shares.
- Add SMB Direct RDMA encryption support.
Extend SMB Direct to support SMB3 encrypted payloads over RDMA, with
transform negotiation and encryption/decryption for RDMA READ/WRITE.
Other changes:
- Parse and retain AppInstanceVersion contexts, enforce version ordering,
close older active handles for newer takeovers, and reject invalid or
unversioned opens according to the SMB2 semantics.
- Accept durable reconnect requests that omit VolatileFileId when the
persistent ID and reconnect context identify the handle, while
continuing to reject explicit volatile-ID mismatches.
- Fix SMB2/SMB3 protocol validation and security issues, including request
offsets, file and object IDs, IPC responses, output buffer sizes,
SMB3.1.1 binding validation, signing-required handling, durable handles,
ACLs, maximal access, and security information.
- Fix heap out-of-bounds accesses, use-after-free bugs, memory leaks,
invalid pointer dereferences, and sensitive-data lifetime issues in
authentication, Kerberos, preauthentication, sessions, connections,
and module teardown.
- Correct alternate-data-stream and named-stream handling, COPYCHUNK
behavior, sparse-file and compression attributes, allocated-range
queries, file trimming, duplicate extents, DOS attributes, snapshots,
normalized names, and partial information responses.
- Fix locking, lease, oplock, durable reconnect, async request, and
CHANGE_NOTIFY races, including deferred-lock rollback, parent directory
lease notifications, and connection teardown lifetime bugs.
- Fix SMB3 encryption handling for compressed requests, expired encrypted
sessions, interim responses, bound multichannel connections, and
decryption failures.
- Fix SMB3 multichannel session lookup and session state transitions so
changes are scoped to the correct bound connections and cannot revive
connections that are already shutting down.
- Fix DACL access checks so ACE walks are bounded by the declared DACL
size, preventing data beyond the DACL boundary from being interpreted
during access validation.
- Fix session accounting and lifetime issues, including session counter
updates during publication and removal, session leaks on registration
failure, and procfs creation diagnostics.
- Improve TCP connection reliability by enabling TCP keepalive for
accepted connections and preserving TCP timers for kernel sockets,
preventing silent peers from holding connections indefinitely.
- Fix smbdirect RDMA cleanup ordering for completion queues, QPs, child
sockets, and listener locking.
- Improve async response framing, multi-iovec signing, RPC pipe status
handling, and ksmbd procfs monitoring for server, share, connection,
session, and open-file state.
- Remove the obsolete DES crypto header and Kconfig dependency now that
NTLMv1 support has been removed.
- Update the ksmbd repository URL in MAINTAINERS and add an additional
KSMBD reviewer.
----------------------------------------------------------------
Aldo Ariel Panzardo (1):
ksmbd: only rebind the reopened file's own oplock on durable reconnect
ChenXiaoSong (12):
smb/server: send compound prefix before async pending response
smb/server: introduce struct ksmbd_transport_write
smb/server: use MSG_EOR for async interim response
smb/server: fix signing when a response uses more than one iov
smb/server: cancel async requests when closing connection
smb/server: avoid registering async requests during connection close
smb/server: fix unbuffered file position alignment check
smb/server: fix posix state check for directory rename
smb/server: rename to ksmbd_has_nonposix_open_child()
smb/server: deny overwriting targets with non-POSIX opens
smb/server: fix use-after-free in ksmbd_conn_transport_destroy()
MAINTAINERS: add myself as KSMBD reviewer
Enzo Matsumiya (1):
smb: server: fix leak of ksmbd_ipc_login_request_ext() returned buffer
Gael Blivet (23):
ksmbd: fix off-by-one rejecting minimal COPYCHUNK query-limits request
ksmbd: route stream FileDispositionInformation through stream delete flag
ksmbd: report actual xattr value length for stream
EndOfFile/AllocationSize
ksmbd: return STATUS_OBJECT_NAME_NOT_FOUND for unknown IPC pipe names
ksmbd: quiet mdssvc RPC log spam
ksmbd: clear stale sparse attribute on non-sparse shares
ksmbd: route stream FileDispositionInformation through stream delete flag
ksmbd: fix durable handle v2 default timeout units (60 -> 60000)
ksmbd: validate out_buf_len before FSCTL_CREATE_OR_GET_OBJECT_ID
and FSCTL_GET_REPARSE_POINT writes
ksmbd: zero-initialize xattr_dos_attrib in smb2_update_xattrs()
ksmbd: don't check directory emptiness when deleting a stream
ksmbd: skip fallocate for SMB2_CREATE_ALLOCATION_SIZE on a stream handle
ksmbd: add AAPL kAAPL_SERVER_QUERY create context support
ksmbd: synthesize empty AFP_AfpInfo xattr on first probe
ksmbd: send inline FinderInfo in FIND responses when
READDIR_ATTR negotiated
ksmbd: defer CHANGE_NOTIFY completion instead of STATUS_NOT_IMPLEMENTED
ksmbd: implement full-file copy for AAPL ChunkCount=0 COPYCHUNK
ksmbd: add AAPL READDIR_ATTR V2 support
ksmbd: report actual xattr value length in stream enumeration
ksmbd: quiet mdssvc RPC log spam in create_smb2_pipe
ksmbd: fix maximal access leak when object has no NT ACL
ksmbd: fix AsyncId zeroed before use in smb2_lock() cancel response
ksmbd: exempt FSCTL_PIPE_TRANSCEIVE from the generic file-id lookup
Guangshuo Li (1):
ksmbd: Do not skip lock checks for single-byte ranges
Hang Nan (1):
ksmbd: bound smb_check_perm_dacl() ACE walks by DACL size
Ilan Dudnik (2):
ksmbd: defer publishing granted locks to prevent UAF/double-free race
ksmbd: fix heap out-of-bounds write in krb5_authenticate()
Namjae Jeon (77):
ksmbd: reject SMB3.1.1 binding with mismatched cipher
ksmbd: validate SMB2 write offsets
ksmbd: fix maximum allowed access checks
ksmbd: support access-based directory enumeration
ksmbd: honor owner rights ACEs in maximal access
ksmbd: reject delete-on-close for read-only files
ksmbd: protect private extended attributes
ksmbd: allow I/O on directory named streams
ksmbd: return buffer overflow for partial filesystem info
ksmbd: fix partial file information responses
ksmbd: return buffer too small for short security queries
ksmbd: support normalized name information
ksmbd: require read control for security information
ksmbd: support empty snapshot enumeration
ksmbd: return complete resume key response
ksmbd: preserve data during overlapping copy chunk
ksmbd: preserve access denied status for copychunk
ksmbd: support copychunk for alternate data streams
ksmbd: handle AAPL stream copy length mismatch
ksmbd: distinguish unknown RPC pipe names
ksmbd: support file compression attributes
ksmbd: preserve compression state in set basic info
ksmbd: preserve compression state across opens
ksmbd: persist FSCTL_SET_SPARSE state
ksmbd: reject FSCTL_SET_SPARSE on directories
ksmbd: allow FSCTL_SET_SPARSE without input buffer
ksmbd: handle empty QUERY_ALLOCATED_RANGES output
ksmbd: handle allocated range queries on dense files
ksmbd: fix permission checks for file allocation ioctls
ksmbd: honor byte-range locks for zero data
ksmbd: support file level trim
ksmbd: fall back to copy for duplicate extents
ksmbd: validate file ids for query network interface info
ksmbd: send lease breaks for handle-caching share conflicts
ksmbd: synchronize lease breaks before renaming files
ksmbd: check base file delete pending for stream opens
ksmbd: validate object id handles before response buffers
ksmbd: preserve DOS attributes across truncating opens
ksmbd: retain connection for pending notify work
ksmbd: add SMB3 request replay support
ksmbd: fix malformed procfs status output
ksmbd: expose connection runtime state in procfs
ksmbd: report session and open file details in procfs
ksmbd: add procfs monitoring for active shares
ksmbd: extend procfs server statistics
ksmbd: honor client signing-required in all modes
ksmbd: fix durable V2 persistent handle handling
ksmbd: do not advertise unimplemented CA support
ksmbd: implement the command sequence window
ksmbd: free preauth sessions on connection teardown
ksmbd: report holes in allocated range queries
ksmbd: stabilize allocation size after buffered writes
ksmbd: expire SMB sessions when Kerberos tickets expire
ksmbd: serialize oplock close with pending break ownership
ksmbd: fix SMB2 byte-range lock end offset
ksmbd: recognize replayed SMB2 lock sequences
ksmbd: safely discard unregistered deferred locks
ksmbd: reject blocking compound lock requests
ksmbd: fix use-after-free in lease break notification
ksmbd: detach blocked lock requests before freeing
ksmbd: wait for deferred notify cancellation
ksmbd: accept unspecified volatile ID on durable reconnect
ksmbd: implement SMB2 AppInstanceVersion takeover
ksmbd: notify parent directory leases on child create
ksmbd: add per-share SMB3 encryption enforcement
ksmbd: fix encrypted request lookup on bound channels
ksmbd: scope session state changes to bound connections
ksmbd: encrypt interim responses to encrypted requests
ksmbd: disconnect on SMB3 decryption failure
ksmbd: decrypt requests from expired encrypted sessions
ksmbd: handle encrypted compressed requests
ksmbd: add SMB Direct RDMA encryption transform
ksmbd: make RDMA encryption diagnostics conditional
ksmbd: enable TCP keepalive for accepted connections
ksmbd: keep TCP timers alive for kernel sockets
smb: server: remove unused DES crypto header
MAINTAINERS: update ksmbd repository URL
Rosen Penev (1):
ksmbd: remove extra byte from ipc_msg_alloc() size calculations
Thomas Huth (6):
smb: server: Clear sensitive stack and heap data in auth.c
smb: server: Make sure that passkey is not leaked on the heap in
user_config.c
smb: server: Free session data in user_session.c with kfree_sensitive()
smb: server: Free sensitive data in connection.c with kfree_sensitive()
smb: server: Clear Preauth_HashValue in smb2pdu.c with kfree_sensitive()
smb: server: Remove obsolete "select CRYPTO_LIB_DES" from Kconfig file
Yunseong Kim (6):
ksmbd: fix slab-out-of-bounds read in ksmbd_alloc_user()
smb: smbdirect: free completion queues with ib_free_cq()
smb: smbdirect: destroy QP before mem pools on accept failure
smb: smbdirect: avoid recursive listen.lock during cleanup
smb: smbdirect: release pending child sockets outside the handler lock
ksmbd: validate ipc response length before dereferencing its fields
Ze Tan (5):
smb/server: fix tree connection leak in smb2_tree_connect()
smb/server: warn if ksmbd_proc_create() fails
smb/server: fix session leak in ksmbd_session_register()
smb/server: update session counter under sessions table lock
smb/server: fix session counter on session removal
ZhangGuoDong (6):
smb/server: fix null-ptr-deref in ksmbd_ipc_tree_connect_request()
smb/server: fix memory leak in ksmbd_vfs_set_durable_owner()
smb/server: fix invalid pointer dereference in
ksmbd_stop_durable_scavenger()
smb/server: abort initialization when proc setup fails
smb/server: call ksmbd_proc_cleanup() on module init failure
smb/server: preserve error status in smb2_handle_negotiate()
MAINTAINERS | 4 +-
fs/smb/client/smb2pdu.h | 24 -
fs/smb/common/fscc.h | 15 +
fs/smb/common/smb2pdu.h | 39 +-
fs/smb/common/smb2status.h | 1 +
fs/smb/common/smbfsctl.h | 1 +
fs/smb/common/smbglob.h | 1 +
fs/smb/server/Kconfig | 1 -
fs/smb/server/auth.c | 215 ++-
fs/smb/server/auth.h | 4 +
fs/smb/server/compress.c | 76 +-
fs/smb/server/compress.h | 1 +
fs/smb/server/connection.c | 223 ++-
fs/smb/server/connection.h | 47 +-
fs/smb/server/ksmbd_netlink.h | 8 +-
fs/smb/server/ksmbd_work.c | 5 +
fs/smb/server/ksmbd_work.h | 14 +
fs/smb/server/mgmt/share_config.c | 65 +-
fs/smb/server/mgmt/share_config.h | 25 +
fs/smb/server/mgmt/tree_connect.c | 2 +
fs/smb/server/mgmt/user_config.c | 18 +-
fs/smb/server/mgmt/user_session.c | 240 +--
fs/smb/server/mgmt/user_session.h | 4 +
fs/smb/server/misc.h | 11 +-
fs/smb/server/oplock.c | 344 +++-
fs/smb/server/oplock.h | 8 +-
fs/smb/server/proc.c | 170 +-
fs/smb/server/server.c | 86 +-
fs/smb/server/server.h | 2 +
fs/smb/server/smb2misc.c | 79 +
fs/smb/server/smb2ops.c | 22 +-
fs/smb/server/smb2pdu.c | 3185 ++++++++++++++++++++++++++++++++-----
fs/smb/server/smb2pdu.h | 82 +
fs/smb/server/smb_common.c | 17 +-
fs/smb/server/smb_common.h | 2 +-
fs/smb/server/smbacl.c | 115 +-
fs/smb/server/smbacl.h | 3 +-
fs/smb/server/stats.h | 57 +-
fs/smb/server/transport_ipc.c | 27 +-
fs/smb/server/transport_rdma.c | 19 +-
fs/smb/server/transport_rdma.h | 2 +
fs/smb/server/transport_tcp.c | 31 +-
fs/smb/server/vfs.c | 559 ++++++-
fs/smb/server/vfs.h | 20 +-
fs/smb/server/vfs_cache.c | 280 +++-
fs/smb/server/vfs_cache.h | 43 +-
fs/smb/smbdirect/accept.c | 16 +-
fs/smb/smbdirect/connection.c | 13 +-
fs/smb/smbdirect/socket.c | 98 +-
49 files changed, 5448 insertions(+), 876 deletions(-)