Commit 0a96d0d726cd for kernel

commit 0a96d0d726cd380423ac38e2c28f538db2940a1d
Merge: ad724d319c81 cb26524ef4ac
Author: Linus Torvalds <torvalds@linux-foundation.org>
Date:   Thu Sep 10 14:03:48 2026 -0700

    Merge tag 'cifs-fixes-7.3-rc3' of https://git.manguebit.org/linux

    Pull smb client fixes from Paulo Alcantara:

     - File type corruption fixes in reparse point handling: setting S_IFMT
       bits without clearing the existing type first corrupted the file mode
       (e.g. S_IFREG | S_IFCHR == S_IFLNK). Fixed in the WSL, POSIX and
       native symlink reparse parsers. Also fixes an uninitialized SID
       structure in the POSIX readdir path when parsing fails.

     - Ownership mapping fixes: forceuid/forcegid mount options were
       ignored in several code paths (SID-to-id mapping, WSL extended
       attributes, POSIX extensions getattr), allowing an untrusted server
       to dictate local file ownership despite explicit mount overrides.

     - Heap overflow and overflow fixes in DACL rewriting: replacing short
       SIDs with long ones could overflow the DACL buffer, and the u16
       accumulator for DACL size could wrap around with enough ACEs.

     - Reference count leak fixes in oplock break and deferred close:
       duplicate oplock breaks on a queued work item leaked a
       cifsFileInfo reference, and deferred close had a similar leak when
       requeueing a running work item. Both cause busy-inode oopses on
       unmount.

     - DFS superblock use-after-free fix: the iterator callback stored a
       raw superblock pointer without pinning it, racing with automount
       expiry.

     - One-byte slab OOB read in the native symlink parser when handling
       share-root relative paths.

     - Hardening of legacy SMB1 input: reject userspace-crafted
       cifs.idmap key descriptions that bypass kernel origin checks, and
       validate DataOffset in CIFSSMBRead() to prevent heap info
       disclosure from a malicious server.

     - DFS cache fix: defer metadata updates until target copying
       succeeds to prevent partial-state cache entries on allocation
       failure.

    * tag 'cifs-fixes-7.3-rc3' of https://git.manguebit.org/linux:
      smb: client: fix one-byte OOB read in smb2_parse_native_symlink()
      smb: client: fail DACL rewrite when the new DACL exceeds 64K
      smb: client: fix heap overflow in DACL owner/group rewrite
      smb: client: fix file type corruption in cifs_reparse_point_to_fattr()
      smb: client: fix file type corruption in posix_reparse_to_fattr()
      smb: client: fix file type corruption in wsl_to_fattr()
      smb: client: avoid using uninitialized SIDs in cifs_posix_to_fattr()
      smb: client: fix WSL reparse point uid/gid override
      smb: client: honor forceuid/forcegid when mapping SIDs to uid/gid
      smb: client: fix uid/gid override in getattr with posix extensions
      smb: client: fix cifsFileInfo reference leak in deferred close
      smb: client: avoid leaking refcount when cifs_sb_tlink() fails
      smb: client: avoid leaking refcount in cifs_queue_oplock_break()
      smb: client: fill cache fields after populating cache in copy_ref_data()
      smb: client: pin DFS superblock in iterator callback
      smb: client: reject userspace cifs.idmap descriptions
      smb: client: reject out-of-bounds DataOffset in CIFSSMBRead()
      smb: client: reject short READ responses in CIFSSMBRead()