Merge tag 'cifs-fixes-7.4-rc1' of https://git.manguebit.org/linux

Pull smb client fixes from Paulo Alcantara:

 - Validate the offsets and lengths a server puts in its responses
   before using them, so that a malicious or broken server can no longer
   make the client read past the received data:
     - POSIX lock data (which leaked kernel bytes through F_GETLK)
     - NT transaction responses and SMB1 EA lists (both wrapping their
       pointer checks on 32-bit)
     - short SESSION_SETUP responses (which sent stale buffer content
       back to the server in the NTLMv2 AUTHENTICATE message)
     - SMB2 READ data areas
     - empty truncated fiemap responses

 - Fix a heap overflow in SMB2_tcon() with UNC paths longer than
   MAX_SHARENAME_LENGTH

 - Fix a slab-out-of-bounds write when chmod() rewrites a security
   descriptor that needs more room than was reserved

 - Fix a use-after-free of the server info between the cifsd thread and
   the release of the last session reference (reported by syzbot)

 - Fix a use-after-free in the demultiplex thread when a receive error
   reconnects and frees the read request still being processed

 - Fix a double teardown of a tcon that the cached directory laundromat
   took a reference on while it was being freed

 - Fix a NULL pointer dereference when /proc/fs/cifs/DebugData is read
   while the module is still initializing

* tag 'cifs-fixes-7.4-rc1' of https://git.manguebit.org/linux:
  smb: client: validate SMB1 EA list bounds before parsing
  smb: client: stop processing a read response after a receive error
  smb: client: don't resurrect an exiting tcon from cached dir workers
  smb: client: fix early procfs exposure race
  smb: client: fix slab-out-of-bounds write in id_mode_to_cifs_acl()
  smb: client: hold server info until cifsd exits
  smb: client: fix fiemap wild read on empty truncated response
  smb: client: validate the data area in SMB2_read()
  smb: client: reject short SESSION_SETUP responses
  smb: client: fix buffer overflow in SMB2_tcon()
  smb: client: validate NT transaction response layout and offsets
  smb: client: bound POSIX lock data area by response length

0 files changed, 0 insertions, 0 deletions