[GIT PULL] smb client fixes for 7.3-rc1

[GIT PULL] smb client fixes for 7.3-rc1

[Paulo Alcantara]

Hi Linus,

Due to the sudden degradation of Steve French's health, I've inherited
a collection of cifs fixes that I'm not sure whether to send you
immediately or soak in linux-next for a week first.  What approach
would you prefer?  Attached is a pull request for the patches if you
are willing to take them immediately.

Thanks,
Paulo

----------------------------------------------------------------
The following changes since commit db2ddb87143519e20a95aa36c60b36107b736a58:

  Linux 7.2-rc7 (2026-08-09 14:54:50 -0700)

are available in the Git repository at:

  https://git.manguebit.org/linux.git tags/cifs-fixes-7.3-rc1

for you to fetch changes up to 6c322f5cf7476ded7a9a20f7be72462065a03c68:

  cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0 (2026-08-24 17:08:53 -0300)

----------------------------------------------------------------
There are thirty-three client fixes:

- five sensitive data leak fixes (clear stack and heap cryptographic
  keys/hashes)
- six file size and cache synchronization fixes (fscache cookie
  serialization and truncation handling)
- seven protocol validation and buffer safety fixes (prevent OOB
  access and loff_t underflow)
- six metadata and POSIX attribute fixes (proper hard-link counts and
  setuid/setgid stripping)
- three DFS cache and unmount fixes (prevent target-hint UAF and
  unmount hangs)
- six general client improvements (fix read request leaks, stats
  loops, handle servers that don't support O_TMPFILE)

----------------------------------------------------------------
Bryam Vargas (2):
      smb: client: restore the data_offset bound in is_valid_oplock_break()
      smb: client: reject a tree connect response whose byte count is too small

ChenXiaoSong (2):
      smb/client: return EOPNOTSUPP for unsupported O_TMPFILE
      smb/client: fix nlink of an overwritten open file

Christopher Lusk (2):
      smb: client: fix request buffer leak in smb2_new_read_req()
      smb: client: set replay flag on the read send-error retry path

Dmitry Antipov (1):
      smb: client: simplify __build_path_from_dentry_optional_prefix()

Frank Sorenson (13):
      cifs: use cifs_invalidate_cache() in cifs_do_truncate() for O_TRUNC
      cifs: add cifs_resize_file_locked() to guard fscache_resize_cookie() under i_rwsem
      cifs: remove redundant size-update block in cifs_remap_file_range()
      cifs: remove dead size-update blocks in cifs_setattr_unix/nounix
      cifs: fix clearing stats for fastest execution of each smb2 command
      smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2()
      smb: client: fix UAF and buffer leak in cifs_check_trans2() for malformed secondary T2
      smb: client: fix ALIGN() overflow in symlink_data() error context loop
      smb: client: fix use-before-check of ReparseDataLength in reparse_buf_ptr()
      cifs: clear tcon after cifsFileInfo_put() in cifs_file_set_size()
      smb: client: fix copy-paste error in WSL EA length accounting for $LXDEV
      cifs: call pagecache_isize_extended() in cifs_setsize() when extending
      cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0

Fredric Cover (2):
      smb: client: harden DFS cache against invalid target hints
      smb: client: clear ce->tgthint in free_tgts()

Jiangshan Yi (1):
      smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions

Mohammad Shahid (1):
      smb: client: remove redundant NULL check before kfree()

Thomas Huth (5):
      smb: client: Clear sensitive stack data in smb2transport.c
      smb: client: Clear sensitive stack and heap data in smb2ops.c
      smb: client: Clear sensitive stack data in cifsencrypt.c
      smb: client: Clear sensitive stack data in smb1encrypt.c
      smb: client: Avoid leaking sensitive data to the heap in connect.c

Ze Tan (3):
      smb/client: mark missing nlink values as unknown
      smb/client: preserve open info type across compound queries
      smb/client: decode reparse metadata using its payload type

Zizhi Wo (1):
      Revert "cifs: remove all cifs files before kill super"

 fs/smb/client/cifs_debug.c    |  2 +-
 fs/smb/client/cifsencrypt.c   | 12 ++++--
 fs/smb/client/cifsfs.c        | 21 ++++++----
 fs/smb/client/cifsfs.h        |  1 +
 fs/smb/client/cifssmb.c       |  6 +++
 fs/smb/client/connect.c       |  5 +--
 fs/smb/client/dfs_cache.c     | 33 ++++++++++++----
 fs/smb/client/dir.c           |  8 ++--
 fs/smb/client/file.c          |  1 +
 fs/smb/client/inode.c         | 90 +++++++++++++++++++++++++++----------------
 fs/smb/client/ioctl.c         |  3 +-
 fs/smb/client/reparse.h       | 17 ++++----
 fs/smb/client/smb1encrypt.c   | 19 +++++----
 fs/smb/client/smb1misc.c      |  3 +-
 fs/smb/client/smb1ops.c       | 10 ++++-
 fs/smb/client/smb1transport.c | 35 +++++++++++++++--
 fs/smb/client/smb2file.c      |  5 ++-
 fs/smb/client/smb2inode.c     | 22 +++++++----
 fs/smb/client/smb2ops.c       | 13 +++----
 fs/smb/client/smb2pdu.c       | 18 +++++++--
 fs/smb/client/smb2transport.c |  4 ++
 fs/smb/client/trace.h         |  3 +-
 22 files changed, 223 insertions(+), 108 deletions(-)

Re: [GIT PULL] smb client fixes for 7.3-rc1

[Linus Torvalds]

On Mon, 24 Aug 2026 at 15:06, Paulo Alcantara <pc@manguebit.org> wrote:
>
> Attached is a pull request for the patches if you
> are willing to take them immediately.

I think I might as well take them immediately and treat it as a merge
window update pull, even if it looks like only one of these commits
have been in linux-next. Not the comon situation, after all.

I assume there is nothing else pending right now?

Also, I've mentioned this elsewhere, but since I'm starting to see
more pulls from you I'll mention it explicitly here too: the merge
message should describe what the changes do, not irrelevant
technicalities.

And one such irrelevant technicality is how many patches there are.
Nobody cares.

Would it have been any different if it had been done as one single
larger patch? No.

And if people do care about the "five patches" part, they would be
looking at the individual commits, not reading the merge commit
message.

So I mention this because I reacted to "five sensitive data leak fixes".

The "five" is uninteresting, and the "data leak fixes" aren't.

Those commits are clearing keys after use. That's not fixing a leak,
that's just hardening in case a leak exists elsewere.

So I rewrote it as "clear sensitive data after use".

This is not a problem, but I'll be happier if I don't feel like I need
to edit things more than necessary, so I'm mentioning this in the hope
that people will stop that pattern of numbering patches in particular.

                 Linus

Re: [GIT PULL] smb client fixes for 7.3-rc1

[Paulo Alcantara]

Linus Torvalds <torvalds@linux-foundation.org> writes:

> On Mon, 24 Aug 2026 at 15:06, Paulo Alcantara <pc@manguebit.org> wrote:
>>
>> Attached is a pull request for the patches if you
>> are willing to take them immediately.
>
> I think I might as well take them immediately and treat it as a merge
> window update pull, even if it looks like only one of these commits
> have been in linux-next. Not the comon situation, after all.

ACK.  Thanks.

> I assume there is nothing else pending right now?

Nope.

> Also, I've mentioned this elsewhere, but since I'm starting to see
> more pulls from you I'll mention it explicitly here too: the merge
> message should describe what the changes do, not irrelevant
> technicalities.
>
> And one such irrelevant technicality is how many patches there are.
> Nobody cares.
>
> Would it have been any different if it had been done as one single
> larger patch? No.
>
> And if people do care about the "five patches" part, they would be
> looking at the individual commits, not reading the merge commit
> message.

ACK.  Sorry for attempting to follow the wrong pattern then.

> So I mention this because I reacted to "five sensitive data leak fixes".
>
> The "five" is uninteresting, and the "data leak fixes" aren't.
>
> Those commits are clearing keys after use. That's not fixing a leak,
> that's just hardening in case a leak exists elsewere.
>
> So I rewrote it as "clear sensitive data after use".

Makes sense, thanks.

> This is not a problem, but I'll be happier if I don't feel like I need
> to edit things more than necessary, so I'm mentioning this in the hope
> that people will stop that pattern of numbering patches in particular.

ACK.

Re: [GIT PULL] smb client fixes for 7.3-rc1

[pr-tracker-bot]

The pull request you sent on Mon, 24 Aug 2026 19:06:45 -0300:

> https://git.manguebit.org/linux.git tags/cifs-fixes-7.3-rc1

has been merged into torvalds/linux.git:
https://git.kernel.org/torvalds/c/ce14fe4cd756d2ad75a1f5b53816872b4e69f7cc

Thank you!

-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/prtracker.html