Merge tag 'cifs-fixes-7.3-rc3' of https://git.manguebit.org/linux

Pull smb client fixes from Paulo Alcantara:

 - File type corruption fixes in reparse point handling: setting S_IFMT
   bits without clearing the existing type first corrupted the file mode
   (e.g. S_IFREG | S_IFCHR == S_IFLNK). Fixed in the WSL, POSIX and
   native symlink reparse parsers. Also fixes an uninitialized SID
   structure in the POSIX readdir path when parsing fails.

 - Ownership mapping fixes: forceuid/forcegid mount options were
   ignored in several code paths (SID-to-id mapping, WSL extended
   attributes, POSIX extensions getattr), allowing an untrusted server
   to dictate local file ownership despite explicit mount overrides.

 - Heap overflow and overflow fixes in DACL rewriting: replacing short
   SIDs with long ones could overflow the DACL buffer, and the u16
   accumulator for DACL size could wrap around with enough ACEs.

 - Reference count leak fixes in oplock break and deferred close:
   duplicate oplock breaks on a queued work item leaked a
   cifsFileInfo reference, and deferred close had a similar leak when
   requeueing a running work item. Both cause busy-inode oopses on
   unmount.

 - DFS superblock use-after-free fix: the iterator callback stored a
   raw superblock pointer without pinning it, racing with automount
   expiry.

 - One-byte slab OOB read in the native symlink parser when handling
   share-root relative paths.

 - Hardening of legacy SMB1 input: reject userspace-crafted
   cifs.idmap key descriptions that bypass kernel origin checks, and
   validate DataOffset in CIFSSMBRead() to prevent heap info
   disclosure from a malicious server.

 - DFS cache fix: defer metadata updates until target copying
   succeeds to prevent partial-state cache entries on allocation
   failure.

* tag 'cifs-fixes-7.3-rc3' of https://git.manguebit.org/linux:
  smb: client: fix one-byte OOB read in smb2_parse_native_symlink()
  smb: client: fail DACL rewrite when the new DACL exceeds 64K
  smb: client: fix heap overflow in DACL owner/group rewrite
  smb: client: fix file type corruption in cifs_reparse_point_to_fattr()
  smb: client: fix file type corruption in posix_reparse_to_fattr()
  smb: client: fix file type corruption in wsl_to_fattr()
  smb: client: avoid using uninitialized SIDs in cifs_posix_to_fattr()
  smb: client: fix WSL reparse point uid/gid override
  smb: client: honor forceuid/forcegid when mapping SIDs to uid/gid
  smb: client: fix uid/gid override in getattr with posix extensions
  smb: client: fix cifsFileInfo reference leak in deferred close
  smb: client: avoid leaking refcount when cifs_sb_tlink() fails
  smb: client: avoid leaking refcount in cifs_queue_oplock_break()
  smb: client: fill cache fields after populating cache in copy_ref_data()
  smb: client: pin DFS superblock in iterator callback
  smb: client: reject userspace cifs.idmap descriptions
  smb: client: reject out-of-bounds DataOffset in CIFSSMBRead()
  smb: client: reject short READ responses in CIFSSMBRead()

0 files changed, 0 insertions, 0 deletions