CVE-2026-53271: ksmbd: fix NULL-deref of opinfo->conn in oplock/lease break notifiers

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: fix NULL-deref of opinfo->conn in oplock/lease break notifiers

smb2oplockbreaknoti() and smb2leasebreaknoti() read opinfo->conn into a local with neither READONCE() nor a NULL check. Both run from oplockbreak() after opinfogetlist() has dropped ci->mlock, so a concurrent SMB2 LOGOFF (sessionfdcheck()) can set op->conn = NULL under ci->mlock within that window. ksmbdconnrcountinc(conn) then writes through NULL at offset 0xc4 -- a remotely triggerable oops.

Guard both reads the way compareguidkey() already does: read opinfo->conn with READONCE() and return early if it is NULL, before allocating the work struct so nothing leaks. A NULL conn means the client is gone and the break is moot, so return 0; oplockbreak() treats that as success and runs the normal teardown.