Commit 3db1c74a20f0 for kernel

commit 3db1c74a20f0552fadc2c6886a43feee8894fa19
Merge: b970ee43be13 25912ed3b75d
Author: Linus Torvalds <torvalds@linux-foundation.org>
Date:   Fri Nov 13 09:56:22 2026 -0800

    Merge tag 'cifs-fixes-7.4-rc3' of https://git.manguebit.org/linux

    Pull smb client fixes from Paulo Alcantara:

      - Fix silent data loss in writeback

        Since the move to netfslib a transient failure (a reconnect, a lost
        handle, an interrupted wait, -ENOMEM, or a task killed while close()
        flushes its dirty pages) ended writeback with the folios clean and
        no error, dropping the write.

        Retry it instead, bounded by the hard and retrans mount options, and
        have umount -f abort the retries and the reconnect and credit waits
        so the unmount's own sync can't hang

      - Prefer a non-O_DIRECT handle for writeback, as Windows rejects
        unaligned I/O on O_DIRECT handles and silently dropped about 1% of
        the writes in generic/051

      - netfs: keep the prepare_read() and prepare_write() errno across a
        reissue, and don't hang a read whose retry is abandoned (the
        writeback fixes depend on these)

      - Fix an out-of-bounds write when compounding an encrypted SMB2_IOCTL
        with a large input, which an unprivileged user can trigger with a
        long symlink target

      - Fix an out-of-bounds read parsing a DFS target referral, and a
        double conversion of the DFS path in setup_dfs_ref()

      - Validate security descriptor headers before allocating the query
        result, and compare owner and group SIDs by their encoded lengths

      - Hold a server reference while queueing reconnect work so the server
        can't be freed under the worker

      - Hold the inode across cifs_oplock_break() so dropping the handle
        reference can't free it before the break is acknowledged

      - Flush an inode's deferred handles before opening another of its hard
        links, so the open doesn't reuse the lease key under a mismatched
        name and get rejected with STATUS_INVALID_PARAMETER

      - Skip a NULL channel in __cifs_put_smb_ses()

      - Bound the invalid NTLMSSP signature diagnostic

    * tag 'cifs-fixes-7.4-rc3' of https://git.manguebit.org/linux: (29 commits)
      smb: client: flush deferred handles of other names before a hard link open
      smb: client: hold the inode across cifs_oplock_break()
      smb: client: stop reconnecting and replaying during a forced unmount
      smb: client: fail writeback sends and reopens fast when the server is gone
      smb: client: don't replay handle reopens inside SMB2_open()
      smb: client: let umount -f stop waiting for reconnects on hard mounts
      smb: client: retry writeback after losing the connection, share or handle
      smb: client: retry writes that couldn't be issued due to a reconnect
      smb: client: don't block dying tasks waiting for writeback on fsync
      smb: client: retry writeback on interrupts and allocation failures
      smb: client: don't fail writeback preparation if the task is dying
      smb: client: issue writes from a worker if the task is dying
      smb: client: don't block dying tasks waiting for writeback on close
      smb: client: don't spend read retries on reads cut short by a reconnect
      smb: client: don't retry failed writes forever regardless of mount options
      smb: client: don't give up writeback on the first replayable error
      smb: client: let umount -f abort retried reads and writes
      netfs: don't hang a read whose retry is abandoned
      netfs: keep the prepare_read errno when abandoning read retries
      netfs: preserve prepare_write errno on reissue
      ...