ksmbd ACL packing fixed to block malformed DACLs and OOB reads

Two fixes in the kernel SMB server (ksmbd) close paths that could emit malformed discretionary ACLs or read past the end of heap buffers when building security descriptors for clients.

The first bug is in how DACL size is tracked while packing access-control entries. Overflow checks abort the packing loop when the running total would no longer fit in the 16-bit on-wire size field, but the overflow helper still stores the truncated sum. That truncated value is later written into the ACL header even though the preceding fill and copy steps have already emitted the full entry bytes. The result is an ACL whose declared length under-reports the bytes present, which can trigger out-of-bounds reads when the descriptor is re-parsed by clients or by ksmbd itself. The fix restores the pre-addition size on each overflow path so a truncated ACL stays self-consistent rather than malformed.

The second gap is inconsistent validation of SID sub-authority counts. A stored security descriptor can carry ACEs from an authenticated SMB2 SET_INFO that ksmbd accepted and saved raw; the DACL parser rejects a bad ACE with a silent break rather than failing the whole descriptor, so a crafted value can still reach the inode xattr. On a later QUERY_INFO that rebuilds a DACL from a POSIX ACL, the copy path indexed the fixed-size sub-authority array using that unchecked count. A value such as 255 produces a heap out-of-bounds read of roughly a kilobyte at an offset the client controls. Other SID parsers already reject or clamp the field; the fix applies the same gate before the copy.

Wentao Guan wrote the size-restore change. Haofeng Li added the sub-authority check, with input from Namjae Jeon. A direct backport did not apply cleanly to the 7.1 stable tree; Sasha Levin reported that a later series already covers 7.1 along with further hardening, so nothing further was needed for that branch.