Commit 17e7b8eacf4c for kernel

commit 17e7b8eacf4cac800a4fc89a28729df72a2dabda
Merge: 925724c0816e 717e0a25036b
Author: Linus Torvalds <torvalds@linux-foundation.org>
Date:   Fri Sep 18 13:44:59 2026 -0700

    Merge tag 'cifs-fixes-7.3-rc4' of https://git.manguebit.org/linux

    Pull smb client fixes from Paulo Alcantara:
     "A batch of bug fixes for the smb client:

       - Fix multiple out-of-bounds reads and use-after-frees in the SMB2/3
         receive path that are reachable from a malicious or compromised
         server: a stale next_buffer pointer and an integer overflow in
         compound encrypted frame handling, missing minimum-PDU-size and
         per-sub-PDU length validation before parsing command-specific
         response fields, missing bounds checks in DFS referral, server
         interface list, EA list, POSIX SID, snapshot enumeration and SMB1
         reparse point parsing

       - Fix use-after-frees and races in multichannel and connection
         teardown, including an interface freed while still in use when
         adding channels, a server used after its channel reference was
         dropped, a reconnect work item left queued after the server is
         freed and an uninitialized reconnect list node

       - Fix a heap overflow in the native symlink parser: an absolute
         target without an NT drive prefix caused out-of-bounds writes and a
         u16 length underflow leading to a 64K memcpy into a small buffer,
         triggerable by a user with write access to a mounted share under
         default settings

       - Fix WSL reparse point parsing: use unaligned accessors for the
         packed extended-attribute payload to avoid alignment faults on some
         architectures and stop leaving partially mutated fattr fields on
         parse failure

       - Fix lease break ACKs being sent through the wrong session on
         multiuser mounts, which caused read failures (e.g. on NetApp
         ONTAP/Azure Files) when copying files

       - Fix an smbd_connection leak when cifs_get_tcp_session() fails after
         an RDMA connection was already established"

    * tag 'cifs-fixes-7.3-rc4' of https://git.manguebit.org/linux:
      cifs: Fix server use-after-free in cifs_chan_skip_or_disable()
      smb: client: fix reparse buffer bounds in cifs_query_reparse_point()
      smb: client: fix potential OOB read in smb3_enum_snapshots()
      smb: client: fix missing iov bounds check in parse_posix_sids()
      smb: client: fix OOB struct field reads in move_smb2_ea_to_cifs()
      smb: client: reject short Next offsets in parse_server_interfaces()
      smb: client: fix missing lower-bound check on DFS referral string offsets
      smb: client: fix server->total_read for compound encrypted PDUs
      smb: client: validate minimum PDU size before smb2_get_data_area_len()
      smb: client: fix next_buffer UAF and NextCommand bounds in compound PDUs
      smb: client: fix use-after-free of iface in cifs_try_adding_channels()
      smb: client: fix fattr leaking on wsl_to_fattr() failure
      smb: client: fix unaligned access in WSL reparse point parser
      smb: client: fix smbd_connection leak on cifs_get_tcp_session() error
      smb: client: fix rlist race and missing initialization
      smb: client: cancel reconnect work in clean_demultiplex_info()
      smb/client: send lease break ACKs thru correct session for multiuser mounts
      smb: client: validate absolute native symlink targets before NT fixups