ksmbd: prevent session binding in compound requests

A failed multichannel binding can retain its target session on the work
item so that the error response can be signed. Subsequent compound
commands can then use that session together with a tree connection left
over from an earlier command.

Limit binding SESSION_SETUP requests to standalone messages during
message validation, before smb2_sess_setup() can replace work->sess.
Check both NextCommand and the current request offset to cover binding
in the first, middle and last positions of a compound. The existing
validation error path returns STATUS_INVALID_PARAMETER and stops
processing the remaining commands.

This intentionally limits support for compounded binding. It is not a
protocol requirement that binding be standalone. Standalone binding and
non-binding compounds retain their existing behavior, without changing
session, tree or response encryption handling.

Fixes: 4b706360ffb7 ("ksmbd: fix multichannel binding and enforce channel limit")
Cc: stable@vger.kernel.org
Reported-by: Zeng Adolph <coderzeng@hotmail.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>

0 files changed, 0 insertions, 0 deletions