[GIT PULL] smb client fixes for 7.3-rc5

[Paulo Alcantara <pc@manguebit.org>]

Linus,

Please consider pulling these smb client fixes for v7.3-rc5.  They
address leaked server handles and dropped errors in the SMB2 compound
create path, out-of-bounds reads when parsing create contexts from a
malicious server, a double credit decrement found by syzbot and a
minor POSIX specification reference update.  Most fixes are for
stable.

Thanks,
Paulo

----------------------------------------------------------------
The following changes since commit 17e7b8eacf4cac800a4fc89a28729df72a2dabda:

  Merge tag 'cifs-fixes-7.3-rc4' of https://git.manguebit.org/linux (2026-09-18 13:44:59 -0700)

are available in the Git repository at:

  https://git.manguebit.org/linux.git tags/cifs-fixes-7.3-rc5

for you to fetch changes up to e66cf1625ec4a3fe68346119f371def713fd0a4d:

  smb: client: use finish_no_open() for non-regular inodes (2026-09-24 10:50:39 -0300)

----------------------------------------------------------------
smb client fixes for v7.3-rc5

 - Fix leaked server handles and dropped errors in the SMB2 compound
   create path: a parsing error reported as success, an earlier CREATE
   left open when a later command fails, the cached directory open
   losing the FID needed for cleanup, and SMB2_open() not closing the
   handle after a create-context parse failure

 - Fix out-of-bounds reads when parsing create contexts from a
   malicious server: bound each context by its Next field, parse the
   lease and QFid contexts from their declared offsets and validate
   the POSIX create context length

 - Fix a double credit decrement, and its warning, when a compound
   send fails and triggers a reconnect; found by syzbot

 - Fix a dentry and server handle leak in cifs_atomic_open() when an
   O_CREAT open resolves to a symlink or other non-regular inode

 - Use GFP_KERNEL in the DFS get_targets() path

 - Minor update to the POSIX extension specification references

----------------------------------------------------------------
Adarsh Das (1):
      smb: client: delete compound mids on send failure before unlock

Fredric Cover (1):
      smb: client: use GFP_KERNEL in get_targets()

Namjae Jeon (1):
      smb: client: use finish_no_open() for non-regular inodes

ZhangGuoDong (1):
      smb: client: update POSIX extension specification references

Zihan Xi (6):
      smb: client: fix create context out-of-bounds reads
      smb: client: validate POSIX create context length
      smb: client: close handle after create-context parsing failure
      smb: client: clean up failed cached directory opens
      smb: client: close completed creates on compound wait errors
      smb: client: preserve create-context parsing errors

 fs/smb/client/cached_dir.c | 32 ++++++++++++++-------
 fs/smb/client/dfs_cache.c  |  4 +--
 fs/smb/client/dir.c        | 52 ++++++++++++++++++++++++---------
 fs/smb/client/smb2inode.c  |  6 ++--
 fs/smb/client/smb2misc.c   |  9 ++++--
 fs/smb/client/smb2ops.c    | 28 ++++++++++++------
 fs/smb/client/smb2pdu.c    | 54 +++++++++++++++++++++++++++--------
 fs/smb/client/smb2pdu.h    | 10 +++++--
 fs/smb/client/transport.c  | 71 +++++++++++++++++++++++++++++++++++++---------
 9 files changed, 200 insertions(+), 66 deletions(-)