Backport request: ksmbd and smbdirect fixes merged in 7.4-rc

Backport request: ksmbd and smbdirect fixes merged in 7.4-rc

[이성현]

```
Hi,

Please consider the following fixes, all merged into mainline during
the 7.4 merge window, for the stable trees listed. None of them
carried a Cc: stable tag.

1) 4ca76b89917a ("smb: smbdirect: don't wait for
RDMA_CM_EVENT_DISCONNECTED in smbdirect_socket_destroy_sync()")
   328c7e307e84 ("smb: smbdirect: release failed pending sockets of a listener")
   5c171c90c446 ("smb: smbdirect: don't hand out already failed
sockets in smbdirect_socket_accept()")

   Trees: 7.3.y and 7.2.y (Fixes: dc691b91ad16, first released in 7.1).
   Please apply the three in this order; they were posted as one series.

   Without 328c7e307e84 an unauthenticated peer can permanently stop
   ksmbd from accepting SMB-Direct connections: every connection that
   fails before negotiation completes stays on the listener's pending
   list and counts against the backlog of 10, after which every new
   connection is rejected with -EBUSY until the listener is destroyed.
   I reported this and reproduced it on 7.3-rc2 with a small rdmacm
   client; about eleven connect-then-disconnect cycles are enough.

2) 68f410faedaf ("ksmbd: wait for negotiation before receiving another PDU")

   Trees: all supported stable trees that contain dc8289f91238
   (Fixes: dc8289f91238, "ksmbd: fix slab-out-of-bounds in init_smb2_rsp_hdr").

   The receive thread can read and dispatch the next PDU while the
   negotiation worker is still running, so a pipelined SMB2 NEGOTIATE
   after an SMB1 negotiate replaces conn->ops under the worker and the
   worker reads past the shorter SMB1 request buffer. This is reachable
   before authentication and leaks adjacent heap bytes in the response.
   I reported this to Namjae and reviewed the fix.

3) ef85bad39cf2 ("ksmbd: reject FSCTL_SET_ZERO_DATA on a directory handle")

   Tree: 7.3.y (Fixes: 25e414db7033, first released in 7.3).

   An authenticated client can open a directory with FILE_WRITE_DATA
   and send FSCTL_SET_ZERO_DATA on it; ksmbd_vfs_zero_data() then calls
   kernel_write() on a directory file without FMODE_WRITE, which hits
   WARN_ON_ONCE in __kernel_write_iter() and panics a panic_on_warn
   kernel. I wrote this fix.

I cherry-picked all five commits in this order on top of v7.3 and v7.2.9
and they apply cleanly without changes.

Thanks,
Lee Seong Hyeon
```

Re: Backport request: ksmbd and smbdirect fixes merged in 7.4-rc

[Greg KH]

On Tue, Oct 27, 2026 at 11:07:48PM +0700, 이성현 wrote:
> ```
> Hi,
> 
> Please consider the following fixes, all merged into mainline during
> the 7.4 merge window, for the stable trees listed. None of them
> carried a Cc: stable tag.

Why no tag?  What happened to prevent that?

thanks,

greg k-h

Re: Backport request: ksmbd and smbdirect fixes merged in 7.4-rc

[이성현]

On Tue, Oct 27, 2026 at 11:44PM, Greg KH wrote:
> Why no tag?  What happened to prevent that?

For 3) that is on me. When I sent ef85bad39cf2 on 2026-10-15 the
commit it fixes, 25e414db7033, was only in 7.3-rc, so I assumed there
was no released kernel to backport to and left the tag off. 7.3 was
then released with the bug before the fix reached mainline, which is
why I am asking now.

For 1) and 2) I am the reporter, not the author, so I cannot say why
the tags were not added. Namjae and Stefan are on Cc and can answer
that. I only noticed the gap when I checked which of the fixes had
reached a stable tree.

Thanks,
Lee Seong Hyeon

On Tue, Oct 27, 2026 at 11:44 PM Greg KH <gregkh@linuxfoundation.org> wrote:
>
> On Tue, Oct 27, 2026 at 11:07:48PM +0700, 이성현 wrote:
> > ```
> > Hi,
> >
> > Please consider the following fixes, all merged into mainline during
> > the 7.4 merge window, for the stable trees listed. None of them
> > carried a Cc: stable tag.
>
> Why no tag?  What happened to prevent that?
>
> thanks,
>
> greg k-h

Re: Backport request: ksmbd and smbdirect fixes merged in 7.4-rc

[Stefan Metzmacher]

Am 27.10.26 um 17:47 schrieb 이성현:
> On Tue, Oct 27, 2026 at 11:44PM, Greg KH wrote:
>> Why no tag?  What happened to prevent that?
> 
> For 3) that is on me. When I sent ef85bad39cf2 on 2026-10-15 the
> commit it fixes, 25e414db7033, was only in 7.3-rc, so I assumed there
> was no released kernel to backport to and left the tag off. 7.3 was
> then released with the bug before the fix reached mainline, which is
> why I am asking now.
> 
> For 1) and 2) I am the reporter, not the author, so I cannot say why
> the tags were not added. Namjae and Stefan are on Cc and can answer
> that. I only noticed the gap when I checked which of the fixes had
> reached a stable tree.

Sorry, I thought that a Fixes: tag would be enough to have commits being backported
as needed.

I read Documentation/process/stable-kernel-rules.rst again
and will also add stable in addition.

metze

Re: Backport request: ksmbd and smbdirect fixes merged in 7.4-rc

[Greg KH]

On Wed, Oct 28, 2026 at 10:04:22AM +0100, Stefan Metzmacher wrote:
> Am 27.10.26 um 17:47 schrieb 이성현:
> > On Tue, Oct 27, 2026 at 11:44PM, Greg KH wrote:
> > > Why no tag?  What happened to prevent that?
> > 
> > For 3) that is on me. When I sent ef85bad39cf2 on 2026-10-15 the
> > commit it fixes, 25e414db7033, was only in 7.3-rc, so I assumed there
> > was no released kernel to backport to and left the tag off. 7.3 was
> > then released with the bug before the fix reached mainline, which is
> > why I am asking now.
> > 
> > For 1) and 2) I am the reporter, not the author, so I cannot say why
> > the tags were not added. Namjae and Stefan are on Cc and can answer
> > that. I only noticed the gap when I checked which of the fixes had
> > reached a stable tree.
> 
> Sorry, I thought that a Fixes: tag would be enough to have commits being backported
> as needed.
> 
> I read Documentation/process/stable-kernel-rules.rst again
> and will also add stable in addition.

great, thanks!

Re: Backport request: ksmbd and smbdirect fixes merged in 7.4-rc

[Sasha Levin]

> 1) 4ca76b89917a ("smb: smbdirect: don't wait for
> RDMA_CM_EVENT_DISCONNECTED in smbdirect_socket_destroy_sync()")
>    328c7e307e84 ("smb: smbdirect: release failed pending sockets of a listener")
>    5c171c90c446 ("smb: smbdirect: don't hand out already failed
> sockets in smbdirect_socket_accept()")
>
>    Trees: 7.3.y and 7.2.y (Fixes: dc691b91ad16, first released in 7.1).

Queued for 7.3 and 7.2.

> 2) 68f410faedaf ("ksmbd: wait for negotiation before receiving another PDU")
>
>    Trees: all supported stable trees that contain dc8289f91238

Queued for 7.3, 7.2, 6.18, 6.12, 6.6, 6.1 and 5.15.

> 3) ef85bad39cf2 ("ksmbd: reject FSCTL_SET_ZERO_DATA on a directory handle")
>
>    Tree: 7.3.y (Fixes: 25e414db7033, first released in 7.3).

Queued for 7.3.

-- 
Thanks,
Sasha