samba.git, branch master

s3:loadparm: return NULL upon memalloc failure in lp_idmap_backend

2026-04-23T20:53:10+00:00

Return NULL instead of valid-but-misleading cast from 'false' to
pointer.

Signed-off-by: Shachar Sharon 
Reviewed-by: Noel Power 
Reviewed-by: Anoop C S 

Autobuild-User(master): Anoop C S 
Autobuild-Date(master): Thu Apr 23 20:53:10 UTC 2026 on atb-devel-224

s4:torture: Retry DsExecuteKCC on NT_STATUS_DS_BUSY

2026-04-23T07:55:04+00:00

The KCC service runs a periodic samba_kcc child process (every 300s,
first at 15s after startup) with a 40 second timeout. If a test calls
DsExecuteKCC while the periodic child is running, kccsrv returns
NT_STATUS_DS_BUSY which propagates as EPT_NT_CANT_PERFORM_OP to the
client, causing flaky test failures.

UNEXPECTED(error): samba4.drs.samba_tool_drs_showrepl.python(schema_pair_dc).samba_tool_drs_showrepl.SambaToolDrsShowReplTests.test_samba_tool_showrepl(schema_pair_dc:local)
REASON: Exception: Exception: Traceback (most recent call last):
  File "/builds/samba-testbase/samba-def-build/source4/torture/drs/python/samba_tool_drs_showrepl.py", line 57, in test_samba_tool_showrepl
    kcc_out = self.check_output("samba-tool drs kcc %s %s" % (self.dc1,
  File "/builds/samba-testbase/samba-def-build/bin/python/samba/tests/__init__.py", line 593, in check_output
    raise BlackboxProcessError(retcode, line, stdoutdata, stderrdata)
samba.tests.BlackboxProcessError: Command 'python3 bin/samba-tool drs kcc liveupgrade1dc -USCHEMADOMAIN/Administrator%locDCpass1'; shell True; exit status 255;
stdout: ''; stderr: 'ERROR(runtime): DsExecuteKCC failed - (3221356597, 'The operation cannot be performed.')

3221356597 => 0xc0020035 (EPT_NT_CANT_PERFORM_OP)

Signed-off-by: Andreas Schneider 
Reviewed-by: Douglas Bagnall 

Autobuild-User(master): Andreas Schneider 
Autobuild-Date(master): Thu Apr 23 07:55:04 UTC 2026 on atb-devel-224

s3:tests: Improve debugging for test_wbinfo_lookuprids_cache.sh

2026-04-22T16:35:58+00:00

Note that if this test fails, it is like something else creating keys.
The last time it was a crashing smbd which left a key in the database
and this test failed as a result.

Signed-off-by: Andreas Schneider 
Reviewed-by: Guenther Deschner 

Autobuild-User(master): Günther Deschner 
Autobuild-Date(master): Wed Apr 22 16:35:58 UTC 2026 on atb-devel-224

WHATSNEW: deprecated "allow dcerpc auth level connect"

2026-04-22T14:19:03+00:00

Signed-off-by: Stefan Metzmacher 
Reviewed-by: Ralph Boehme 

Autobuild-User(master): Stefan Metzmacher 
Autobuild-Date(master): Wed Apr 22 14:19:03 UTC 2026 on atb-devel-224

docs-xml/smbdotconf: deprecated "allow dcerpc auth level connect"

2026-04-22T13:16:35+00:00

This was only added to prevent problems with the fixes for
CVE-2016-2118.

Signed-off-by: Stefan Metzmacher 
Reviewed-by: Ralph Boehme

third_party/ngtcp2: import v1.22.1 for CVE-2026-40170

2026-04-22T13:16:35+00:00

For CVE-2026-40170 see:
https://github.com/ngtcp2/ngtcp2/security/advisories/GHSA-f523-465f-8c8f)

Signed-off-by: Stefan Metzmacher 
Reviewed-by: Andreas Schneider

vfs_ceph_new: remove double-cleanup in closedir

2026-04-21T22:18:42+00:00

vfs_ceph_release_fh() was called explicitly then again via the FSP
extension destructor triggered by vfs_ceph_remove_fh(). Drop the
explicit call and let the destructor handle cleanup.

Signed-off-by: Shweta Sodani 
Reviewed-by: Anoop C S 
Reviewed-by: John Mulligan 

Autobuild-User(master): Anoop C S 
Autobuild-Date(master): Tue Apr 21 22:18:42 UTC 2026 on atb-devel-224

vfs_ceph_new: fix return type mismatch in disk_free

2026-04-21T21:15:30+00:00

-ENOMEM cast to uint64_t is not the error sentinel UINT64_MAX and
leaves errno unset. Set errno and return UINT64_MAX instead.
Also replace UINT64_MAX instead of (uint64_t)-1) in all error path.

Signed-off-by: Shweta Sodani 
Reviewed-by: Anoop C S 
Reviewed-by: John Mulligan

vfs_ceph_new: fix END_PROFILE/END_PROFILE_X mismatch in ftruncate

2026-04-21T21:15:30+00:00

END_PROFILE omits the per-service counter; replace with END_PROFILE_X
to match the START_PROFILE_X on the strict_allocate path.

Signed-off-by: Shweta Sodani 
Reviewed-by: Anoop C S 
Reviewed-by: John Mulligan

s3/brlock: map nt-error from correct errno-value

2026-04-21T02:05:57+00:00

The functions 'brl_lock_windows_default' and 'brl_lock_posix' uses
explicit 'errno_ret' value to avoid possible errno overwrite. Use in
failure case.

Signed-off-by: Shachar Sharon 
Reviewed-by: Anoop C S 
Reviewed-by: Shwetha Acharya 
Reviewed-by: Martin Schwenke 

Autobuild-User(master): Martin Schwenke 
Autobuild-Date(master): Tue Apr 21 02:05:57 UTC 2026 on atb-devel-224