[GIT PULL] smb client fixes for 7.4-rc3

[Paulo Alcantara <pc@manguebit.org>]

Linus,

Please consider pulling these smb client fixes for v7.4-rc3.  Most of
them fix silent data loss in writeback since the move to netfslib; the
rest are memory-safety and smaller fixes.  All of them are for stable.

Thanks,
Paulo

----------------------------------------------------------------
The following changes since commit 51b4bf5fe7c90ebf08599b9a3c7620b4a3fd4b22:

  Merge tag 'cifs-fixes-7.4-rc1' of https://git.manguebit.org/linux (2026-10-30 13:40:03 -1000)

are available in the Git repository at:

  https://git.manguebit.org/linux.git tags/cifs-fixes-7.4-rc3

for you to fetch changes up to 25912ed3b75dcf5ff623dcb549b925dd0d0948f7:

  smb: client: flush deferred handles of other names before a hard link open (2026-11-11 13:51:10 -0300)

----------------------------------------------------------------
smb client fixes for v7.4-rc3

 - Fix silent data loss in writeback: since the move to netfslib a
   transient failure (a reconnect, a lost handle, an interrupted wait,
   -ENOMEM, or a task killed while close() flushes its dirty pages)
   ended writeback with the folios clean and no error, dropping the
   write; retry it instead, bounded by the hard and retrans mount
   options, and have umount -f abort the retries and the reconnect and
   credit waits so the unmount's own sync can't hang

 - Prefer a non-O_DIRECT handle for writeback, as Windows rejects
   unaligned I/O on O_DIRECT handles and silently dropped about 1% of
   the writes in generic/051

 - netfs: keep the prepare_read() and prepare_write() errno across a
   reissue, and don't hang a read whose retry is abandoned (the
   writeback fixes depend on these)

 - Fix an out-of-bounds write when compounding an encrypted SMB2_IOCTL
   with a large input, which an unprivileged user can trigger with a
   long symlink target

 - Fix an out-of-bounds read parsing a DFS target referral, and a double
   conversion of the DFS path in setup_dfs_ref()

 - Validate security descriptor headers before allocating the query
   result, and compare owner and group SIDs by their encoded lengths

 - Hold a server reference while queueing reconnect work so the server
   can't be freed under the worker

 - Hold the inode across cifs_oplock_break() so dropping the handle
   reference can't free it before the break is acknowledged

 - Flush an inode's deferred handles before opening another of its hard
   links, so the open doesn't reuse the lease key under a mismatched
   name and get rejected with STATUS_INVALID_PARAMETER

 - Skip a NULL channel in __cifs_put_smb_ses()

 - Bound the invalid NTLMSSP signature diagnostic

----------------------------------------------------------------
Andrey Misiurov (1):
      smb: client: fix OOB write when compounding SMB2_IOCTL with encryption

Fredric Cover (2):
      smb: client: fix out-of-bounds read in dfs_parse_target_referral()
      smb: client: fix double conversion of DFS path in setup_dfs_ref()

Iván Ezequiel Rodriguez (1):
      netfs: preserve prepare_write errno on reissue

Joseph Qi (3):
      smb: client: skip NULL channel in __cifs_put_smb_ses()
      smb: client: hold server ref while queueing reconnect work
      smb: client: hold the inode across cifs_oplock_break()

Paulo Alcantara (19):
      smb: client: don't write back through O_DIRECT handles
      netfs: keep the prepare_read errno when abandoning read retries
      netfs: don't hang a read whose retry is abandoned
      smb: client: let umount -f abort retried reads and writes
      smb: client: don't give up writeback on the first replayable error
      smb: client: don't retry failed writes forever regardless of mount options
      smb: client: don't spend read retries on reads cut short by a reconnect
      smb: client: don't block dying tasks waiting for writeback on close
      smb: client: issue writes from a worker if the task is dying
      smb: client: don't fail writeback preparation if the task is dying
      smb: client: retry writeback on interrupts and allocation failures
      smb: client: don't block dying tasks waiting for writeback on fsync
      smb: client: retry writes that couldn't be issued due to a reconnect
      smb: client: retry writeback after losing the connection, share or handle
      smb: client: let umount -f stop waiting for reconnects on hard mounts
      smb: client: don't replay handle reopens inside SMB2_open()
      smb: client: fail writeback sends and reopens fast when the server is gone
      smb: client: stop reconnecting and replaying during a forced unmount
      smb: client: flush deferred handles of other names before a hard link open

Yifan Zhang (1):
      smb: client: bound invalid NTLMSSP signature diagnostic

liuyong (2):
      smb: client: validate descriptor headers before query result allocation
      smb: client: compare owner and group SIDs using their encoded lengths

 fs/netfs/read_retry.c      |  17 +-
 fs/netfs/write_issue.c     |   4 +-
 fs/smb/client/cifs_fs_sb.h |   2 +
 fs/smb/client/cifsacl.c    |   5 +-
 fs/smb/client/cifsacl.h    |  14 -
 fs/smb/client/cifsfs.c     | 186 ++++++++++---
 fs/smb/client/cifsglob.h   |  50 +++-
 fs/smb/client/cifsproto.h  |  12 +-
 fs/smb/client/cifssmb.c    |  15 +-
 fs/smb/client/connect.c    |  78 +++++-
 fs/smb/client/dfs.c        |  12 +-
 fs/smb/client/file.c       | 667 ++++++++++++++++++++++++++++++++++++++++++---
 fs/smb/client/misc.c       |  22 +-
 fs/smb/client/sess.c       |   4 +-
 fs/smb/client/smb2file.c   |  18 +-
 fs/smb/client/smb2ops.c    |  22 +-
 fs/smb/client/smb2pdu.c    | 206 ++++++++++----
 fs/smb/client/smb2proto.h  |   9 +
 fs/smb/client/transport.c  |  22 +-
 19 files changed, 1158 insertions(+), 207 deletions(-)