[GIT PULL] smb client fixes for 7.4-rc1

[Paulo Alcantara <pc@manguebit.org>]

Linus,

Please consider pulling these smb client fixes for v7.4-rc1.  All of
them are for stable.

Thanks,
Paulo

----------------------------------------------------------------
The following changes since commit 2c455ddca7827ad8fa3a64fdbf5a60efb928b46a:

  smb client: fix mis-merge with fileattr_set taking a const idmap (2026-10-20 18:27:33 -1000)

are available in the Git repository at:

  https://git.manguebit.org/linux.git tags/cifs-fixes-7.4-rc1

for you to fetch changes up to ddc7a7e1eeb116ccaf010a6f1fb6ab927f3f888d:

  smb: client: validate SMB1 EA list bounds before parsing (2026-10-27 11:01:20 -0300)

----------------------------------------------------------------
 - Validate the offsets and lengths a server puts in its responses before
   using them, so that a malicious or broken server can no longer make the
   client read past the received data: POSIX lock data (which leaked
   kernel bytes through F_GETLK), NT transaction responses and SMB1 EA
   lists (both wrapping their pointer checks on 32-bit), short
   SESSION_SETUP responses (which sent stale buffer content back to the
   server in the NTLMv2 AUTHENTICATE message), SMB2 READ data areas and
   empty truncated fiemap responses

 - Fix a heap overflow in SMB2_tcon() with UNC paths longer than
   MAX_SHARENAME_LENGTH

 - Fix a slab-out-of-bounds write when chmod() rewrites a security
   descriptor that needs more room than was reserved

 - Fix a use-after-free of the server info between the cifsd thread and
   the release of the last session reference (reported by syzbot)

 - Fix a use-after-free in the demultiplex thread when a receive error
   reconnects and frees the read request still being processed

 - Fix a double teardown of a tcon that the cached directory laundromat
   took a reference on while it was being freed

 - Fix a NULL pointer dereference when /proc/fs/cifs/DebugData is read
   while the module is still initializing

----------------------------------------------------------------
Abdifatah Suruur (3):
      smb: client: reject short SESSION_SETUP responses
      smb: client: validate the data area in SMB2_read()
      smb: client: fix fiemap wild read on empty truncated response

Dominik Maier (1):
      smb: client: fix slab-out-of-bounds write in id_mode_to_cifs_acl()

Eduard Zateev (1):
      smb: client: hold server info until cifsd exits

Fredric Cover (1):
      smb: client: fix early procfs exposure race

Luxiao Xu (1):
      smb: client: fix buffer overflow in SMB2_tcon()

Paulo Alcantara (1):
      smb: client: don't resurrect an exiting tcon from cached dir workers

Ratnaker Gautam (3):
      smb: client: bound POSIX lock data area by response length
      smb: client: validate NT transaction response layout and offsets
      smb: client: validate SMB1 EA list bounds before parsing

Weiming Shi (1):
      smb: client: stop processing a read response after a receive error

 fs/smb/client/cached_dir.c | 30 ++++++++++++++-------
 fs/smb/client/cifsacl.c    |  9 ++++---
 fs/smb/client/cifsfs.c     | 20 +++++++-------
 fs/smb/client/cifsglob.h   |  2 ++
 fs/smb/client/cifssmb.c    | 66 ++++++++++++++++++++++++++++++++--------------
 fs/smb/client/connect.c    | 33 ++++++++++++++---------
 fs/smb/client/smb2misc.c   | 16 +++++++++++
 fs/smb/client/smb2ops.c    | 30 ++++++++++++++++++---
 fs/smb/client/smb2pdu.c    | 46 +++++++++++++++++++++++++++-----
 fs/smb/client/trace.h      |  1 +
 fs/smb/client/transport.c  |  2 ++
 11 files changed, 191 insertions(+), 64 deletions(-)