Commit 51b4bf5fe7c9 for kernel

commit 51b4bf5fe7c90ebf08599b9a3c7620b4a3fd4b22
Merge: 69eac8481741 ddc7a7e1eeb1
Author: Linus Torvalds <torvalds@linux-foundation.org>
Date:   Fri Oct 30 13:40:03 2026 -1000

    Merge tag 'cifs-fixes-7.4-rc1' of https://git.manguebit.org/linux

    Pull smb client fixes from Paulo Alcantara:

     - Validate the offsets and lengths a server puts in its responses
       before using them, so that a malicious or broken server can no longer
       make the client read past the received data:
         - POSIX lock data (which leaked kernel bytes through F_GETLK)
         - NT transaction responses and SMB1 EA lists (both wrapping their
           pointer checks on 32-bit)
         - short SESSION_SETUP responses (which sent stale buffer content
           back to the server in the NTLMv2 AUTHENTICATE message)
         - SMB2 READ data areas
         - empty truncated fiemap responses

     - Fix a heap overflow in SMB2_tcon() with UNC paths longer than
       MAX_SHARENAME_LENGTH

     - Fix a slab-out-of-bounds write when chmod() rewrites a security
       descriptor that needs more room than was reserved

     - Fix a use-after-free of the server info between the cifsd thread and
       the release of the last session reference (reported by syzbot)

     - Fix a use-after-free in the demultiplex thread when a receive error
       reconnects and frees the read request still being processed

     - Fix a double teardown of a tcon that the cached directory laundromat
       took a reference on while it was being freed

     - Fix a NULL pointer dereference when /proc/fs/cifs/DebugData is read
       while the module is still initializing

    * tag 'cifs-fixes-7.4-rc1' of https://git.manguebit.org/linux:
      smb: client: validate SMB1 EA list bounds before parsing
      smb: client: stop processing a read response after a receive error
      smb: client: don't resurrect an exiting tcon from cached dir workers
      smb: client: fix early procfs exposure race
      smb: client: fix slab-out-of-bounds write in id_mode_to_cifs_acl()
      smb: client: hold server info until cifsd exits
      smb: client: fix fiemap wild read on empty truncated response
      smb: client: validate the data area in SMB2_read()
      smb: client: reject short SESSION_SETUP responses
      smb: client: fix buffer overflow in SMB2_tcon()
      smb: client: validate NT transaction response layout and offsets
      smb: client: bound POSIX lock data area by response length