[GIT PULL] smb client fixes for 7.3-rc4

[Paulo Alcantara <pc@manguebit.org>]

Linus,

Please consider pulling these smb client fixes for v7.3-rc4. They
address out-of-bounds reads and use-after-frees in the SMB2/3 receive
path reachable from a malicious server, use-after-frees and races in
multichannel and connection teardown, a heap overflow in the native
symlink parser, WSL reparse point parsing bugs, wrong-session lease
break ACKs on multiuser mounts and an RDMA connection leak. Most fixes
are for stable.

Thanks,
Paulo

----------------------------------------------------------------
The following changes since commit 0a96d0d726cd380423ac38e2c28f538db2940a1d:

  Merge tag 'cifs-fixes-7.3-rc3' of https://git.manguebit.org/linux (2026-09-10 14:03:48 -0700)

are available in the Git repository at:

  https://git.manguebit.org/linux.git tags/cifs-fixes-7.3-rc4

for you to fetch changes up to 717e0a25036b6c92cecace30913b2d874a4c22b8:

  cifs: Fix server use-after-free in cifs_chan_skip_or_disable() (2026-09-17 19:29:25 -0300)

----------------------------------------------------------------
smb client fixes for v7.3-rc4

A batch of bug fixes for the smb client:

 - Fix multiple out-of-bounds reads and use-after-frees in the SMB2/3
   receive path that are reachable from a malicious or compromised
   server: a stale next_buffer pointer and an integer overflow in
   compound encrypted frame handling, missing minimum-PDU-size and
   per-sub-PDU length validation before parsing command-specific
   response fields, missing bounds checks in DFS referral, server
   interface list, EA list, POSIX SID, snapshot enumeration and SMB1
   reparse point parsing

 - Fix use-after-frees and races in multichannel and connection
   teardown, including an interface freed while still in use when
   adding channels, a server used after its channel reference was
   dropped, a reconnect work item left queued after the server is
   freed and an uninitialized reconnect list node

 - Fix a heap overflow in the native symlink parser: an absolute
   target without an NT drive prefix caused out-of-bounds writes and a
   u16 length underflow leading to a 64K memcpy into a small buffer,
   triggerable by a user with write access to a mounted share under
   default settings

 - Fix WSL reparse point parsing: use unaligned accessors for the
   packed extended-attribute payload to avoid alignment faults on some
   architectures and stop leaving partially mutated fattr fields on
   parse failure

 - Fix lease break ACKs being sent through the wrong session on
   multiuser mounts, which caused read failures (e.g. on NetApp
   ONTAP/Azure Files) when copying files

 - Fix an smbd_connection leak when cifs_get_tcp_session() fails after
   an RDMA connection was already established

----------------------------------------------------------------
April Cardenas (1):
      smb/client: send lease break ACKs thru correct session for multiuser mounts

Frank Sorenson (9):
      smb: client: fix next_buffer UAF and NextCommand bounds in compound PDUs
      smb: client: validate minimum PDU size before smb2_get_data_area_len()
      smb: client: fix server->total_read for compound encrypted PDUs
      smb: client: fix missing lower-bound check on DFS referral string offsets
      smb: client: reject short Next offsets in parse_server_interfaces()
      smb: client: fix OOB struct field reads in move_smb2_ea_to_cifs()
      smb: client: fix missing iov bounds check in parse_posix_sids()
      smb: client: fix potential OOB read in smb3_enum_snapshots()
      smb: client: fix reparse buffer bounds in cifs_query_reparse_point()

Joseph Qi (1):
      smb: client: fix use-after-free of iface in cifs_try_adding_channels()

Jérémy Jean (1):
      smb: client: validate absolute native symlink targets before NT fixups

Paulo Alcantara (5):
      smb: client: cancel reconnect work in clean_demultiplex_info()
      smb: client: fix rlist race and missing initialization
      smb: client: fix smbd_connection leak on cifs_get_tcp_session() error
      smb: client: fix unaligned access in WSL reparse point parser
      smb: client: fix fattr leaking on wsl_to_fattr() failure

Wentao Liang (1):
      cifs: Fix server use-after-free in cifs_chan_skip_or_disable()

 fs/smb/client/cifssmb.c   |   2 +-
 fs/smb/client/connect.c   |   9 ++++
 fs/smb/client/file.c      |   4 +-
 fs/smb/client/misc.c      |  12 +++++-
 fs/smb/client/reparse.c   |  58 ++++++++++++++++----------
 fs/smb/client/reparse.h   |   7 ++--
 fs/smb/client/sess.c      | 104 ++++++++++++++++++++++++++++------------------
 fs/smb/client/smb2inode.c |  11 +++++
 fs/smb/client/smb2misc.c  |  69 +++++++++++++++++-------------
 fs/smb/client/smb2ops.c   |  51 +++++++++++++++++------
 fs/smb/client/smb2pdu.c   |  13 +++---
 fs/smb/client/trace.h     |   1 +
 12 files changed, 223 insertions(+), 118 deletions(-)