[GIT PULL] ksmbd server fixes for 7.4-rc3

[GIT PULL] ksmbd server fixes for 7.4-rc3

[Namjae Jeon]

Hi Linus,

This is ksmbd server fixes pull request for v7.4-rc3. I add a description of
this pull request below. Please pull ksmbd with following ones.

Thanks!

The following changes since commit fa4ad798f6f681031775266044ba1b0cf3c670bd:

  Merge tag 'for-7.4-rc1-tag' of
git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux (2026-11-07
13:52:02 -0800)

are available in the Git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/smb.git
tags/ksmbd-for-7.4-rc3

for you to fetch changes up to b0af9a3e6b1534d353ca6ac23caaf46127f62e4a:

  ksmbd: keep group denials when a POSIX ACL entry decides access
(2026-11-10 23:56:21 +0900)

----------------------------------------------------------------
- Evaluate explicit-access requests in DACL order with exact SID matching,
  and prevent guest and anonymous sessions from matching Authenticated
  Users.

- Apply Unix group and OWNER RIGHTS ACEs, and keep their denials
  when POSIX ACL fallback determines access.

- Allow the parent directory’s DACL to grant explicitly requested DELETE
  and FILE_READ_ATTRIBUTES through FILE_DELETE_CHILD and FILE_LIST_DIRECTORY.

- Exclude metadata-only file and stream opens from sharing conflicts and
  stream delete-sharing checks, while accounting for writes implied by
  overwrites and named-stream creation.

- Return STATUS_ACCESS_DENIED for reads on files lacking FMODE_READ,
  preventing warnings in __kernel_read() and potential panics.

- Pin parent dentries during SMB2 CREATE permission, status, and ACL
  inheritance operations to prevent use-after-free races with concurrent
  rename and removal.

- Keep expired sessions bound to their original user during NTLM
  reauthentication, preventing identity changes and a user-object leak.

----------------------------------------------------------------
Ian Bridges (6):
      ksmbd: grant a caller what its groups and OWNER RIGHTS ACEs allow
      ksmbd: skip metadata-only opens in sharing checks
      ksmbd: skip metadata-only stream opens in the delete check
      ksmbd: evaluate the DACL in order for explicit access requests
      ksmbd: let the parent's DACL grant DELETE and FILE_READ_ATTRIBUTES
      ksmbd: keep group denials when a POSIX ACL entry decides access

Jiwoo Kim (1):
      ksmbd: pin parent dentries in SMB2 CREATE ACL path

Michail Andreas Michalopoulos (1):
      ksmbd: refuse reauthentication of an expired session as another user

Wahid Khan (1):
      ksmbd: refuse to read a handle that is not open for reading

 fs/smb/server/mgmt/user_config.h   |   5 +
 fs/smb/server/smb2pdu.c            |  91 +++++++++---
 fs/smb/server/smb_common.c         |  34 ++++-
 fs/smb/server/smb_common.h         |   5 +
 fs/smb/server/smbacl.c             | 291 ++++++++++++++++++++++++++++++-------
 fs/smb/server/smbacl.h             |   2 +-
 fs/smb/server/tests/smbacl_kunit.c |   4 +-
 fs/smb/server/vfs.c                |   4 +
 fs/smb/server/vfs_cache.c          |   7 +-
 fs/smb/server/vfs_cache.h          |   2 +
 10 files changed, 368 insertions(+), 77 deletions(-)

Re: [GIT PULL] ksmbd server fixes for 7.4-rc3

[pr-tracker-bot]

The pull request you sent on Sat, 14 Nov 2026 14:29:14 +0900:

> git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/smb.git tags/ksmbd-for-7.4-rc3

has been merged into torvalds/linux.git:
https://git.kernel.org/torvalds/c/cba88960471ac67635080708b67ed5c2a2e4e9fd

Thank you!

-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/prtracker.html