Pull ntfs fixes from Namjae Jeon:

 - Keep RECALL_ON_OPEN in inode flags when reloading them from
   $FILE_NAME

 - Check runlist reallocation sizes for negative values and overflow

 - Drop stale page cache after shrinking non-resident attributes to
   prevent writeback failures and data loss

* tag 'ntfs-for-7.2-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/ntfs:
  ntfs: drop stale page-cache when shrinking a non-resident attr
  ntfs: harden runlist realloc size calculations
  ntfs: preserve RECALL_ON_OPEN on WSL special-file reparse points

Pull smb server fixes from Steve French:

 - Use memcmp() when comparing fixed-size binary ClientGUIDs, so
   embedded NUL bytes are handled correctly

 - Reject repeated SMB2 NEGOTIATE requests after dialect selection

   This prevents preauth_info leaks, enforces the SMB2 protocol
   requirements, and serializes negotiation state updates.

 - Fix a use-after-free in __close_file_table_ids() by removing the
   volatile file ID from the owning IDR before dropping the IDR
   reference

* tag 'v7.2-rc5-smb3-server-fixes' of git://git.samba.org/ksmbd:
  ksmbd: use memcmp() to compare ClientGUIDs
  ksmbd: reject repeated SMB2 NEGOTIATE requests
  ksmbd: fix use-after-free in __close_file_table_ids()

Pull smb client fixes from Steve French:

 - fix SMB1 read and write potential buffer leaks

 - netfs error handling fix

 - fix check for last write time in truncate and setattr and cleanup use
   of smb_store_release()

 - fscache fix and cleanup

 - validate idmap key payload length

 - minor SMB1 error mapping cleanup

 - witness protocol memory allocation fix

* tag 'v7.2-rc5-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6:
  cifs: add fscache_resize_cookie() to cifs_setsize()
  cifs: fix time_last_write stamp placement in setattr/truncate paths
  cifs: consolidate time_last_write stamp into _cifsFileInfo_put()
  smb: client: simplify cifs_fscache_get_super_cookie()
  smb: client: free partially allocated transform folio queue
  cifs: validate idmap key payload length
  smb: client: remove conditional return with no effect
  smb: client: fix buffer leaks in SMB1 read and write
  smb: client: use GFP_KERNEL for registry allocation

ClientGUID is a fixed-size binary value and can contain embedded NUL
bytes. strncmp() stops comparing at the first NUL byte, so different
ClientGUID values can incorrectly be treated as equal.

Use memcmp() in SMB3 multichannel session binding and
FSCTL_VALIDATE_NEGOTIATE_INFO to compare all SMB2_CLIENT_GUID_SIZE
bytes.

Fixes: f5a544e3bab7 ("ksmbd: add support for SMB3 multichannel")
Fixes: e2f34481b24d ("cifsd: add server-side procedures for SMB3")
Reported-by: Samu <nomomentomori@gmail.com>
Suggested-by: Samu <nomomentomori@gmail.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>

Unauthenticated client can send multiple successful SMB2 NEGOTIATE
requests on one connection before SESSION_SETUP. While the connection is
in KSMBD_SESS_NEED_SETUP, smb2_handle_negotiate() accepts another
SMB3.1.1 NEGOTIATE and overwrites conn->preauth_info with a new allocation.
Only the final allocation is freed when the connection is released, leaking
one object for every additional successful request.

A repeated SMB2 NEGOTIATE after a dialect has been selected is a protocol
violation. MS-SMB2 section 3.3.5.4 requires the server to disconnect
without replying in this case. Set the connection exiting when rejecting
the request, in addition to suppressing the response.

Reject SMB2 NEGOTIATE unless the connection is new or is waiting for the
SMB2 NEGOTIATE that follows an SMB1 multi-protocol negotiate. Serialize
both SMB1 and SMB2 negotiation paths under conn->srv_mutex, since they
update connection-wide dialect and negotiation state.

Move the locking contract to ksmbd_smb_negotiate_common(), where the state
and dialect are selected, and add ksmbd_conn_new() for consistent state
access.

Fixes: e2f34481b24d ("cifsd: add server-side procedures for SMB3")
Cc: stable@vger.kernel.org
Reported-by: Runa Takemoto <takemotoruna223@gmail.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>

A ksmbd_file can remain alive after logical close while another session
holds a temporary reference obtained through ksmbd_lookup_fd_inode().
ksmbd_close_fd() currently marks the file closed and drops the idr-owned
reference, but leaves the pointer published in the closing session's idr
until the final reference is dropped.

If the foreign holder performs the final ksmbd_fd_put(), __put_fd_final()
supplies the foreign session's file table to __ksmbd_close_fd(). The object
is then freed without being removed from its owner's idr, and the owner
session later dereferences the stale pointer during file-table teardown.

Remove the volatile id from the owner's idr while ksmbd_close_fd() still
holds that table's lock, and clear volatile_id before dropping
the idr-owned reference. A later foreign final put then only performs
physical destruction and cannot remove the object from the wrong table.

Fixes: 8510a043d334 ("ksmbd: increment reference count of parent fp")
Reported-by: Yunseong Kim <yunseong.kim@est.tech>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>

Pull btrfs fixes from David Sterba:
 "Zoned mode:
   - fix assertion and handle case of finished zone and truncated extent
   - fix zone metadata write pointer on actual zone reset
   - fix deadlock caused metadata writeback and transaction commit
   - fix return value reuse leading to confusion about chunk
     reservations

  raid56 scrub:
   - fix tracking of sector checksums when there are not checksums found
   - fix inverted logic when submitting parity read bio

  mount/remount fixes:
   - fix leaking 'remount in progress' state which can break other
     operations to work (qgroup rescan, autodefrag, reclaim)
   - adjust using global block reserve after read-only mount when using
     rescue= option
   - handle missing raid stripe tree when mounted with 'ignorebadroots'

  Misc:
   - fix -Wmaybe-uninitialized warning in GET_CSUMS ioctl"

* tag 'for-7.2-rc5-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux:
  btrfs: raid56: fix scrub read assembly submitting no reads
  btrfs: zoned: skip fully truncated ordered extents at zone finish
  btrfs: initialize 'args' to avoid compiler warning in btrfs_ioctl_get_csums()
  btrfs: zoned: fix missing chunk metadata reservation
  btrfs: raid56: fix an incorrect csum skip during scrub
  btrfs: report missing raid stripe tree root during lookup
  btrfs: skip global block reserve accounting for rescue mounts
  btrfs: zoned: reset meta_write_pointer on zone reset
  btrfs: zoned: fix deadlock between metadata writeback and transaction commit
  btrfs: fix leaking BTRFS_FS_STATE_REMOUNTING flag

Several code paths update the VFS inode size by calling
netfs_resize_file() and cifs_setsize(), but omit the corresponding
fscache_resize_cookie() call, leaving the fscache cookie out of sync
with the actual file size:

  - cifs_file_set_size() in inode.c: server-side truncation via setattr
  - cifs_do_truncate() in file.c: truncates to zero on O_TRUNC open
  - smb2_duplicate_extents() in smb2ops.c: file clone extending EOF
  - smb3_simple_falloc() in smb2ops.c: two branches that extend EOF
    via write-range and SMB2_set_eof respectively

Since every caller of cifs_setsize() must resize the fscache cookie,
add the call to cifs_setsize() itself, consistent with how
truncate_pagecache() is already consolidated there.

Fixes: 70431bfd825d ("cifs: Support fscache indexing rewrite")
Fixes: 93a43155127f ("cifs: Fix missing set of remote_i_size")
Fixes: 110fee6b9bb5 ("smb: client: fix missing timestamp updates with O_TRUNC")
Fixes: 7a06d3b816d7 ("smb/client: emulate small EOF-extending mode 0 fallocate ranges")
Cc: stable@vger.kernel.org
Cc: David Howells <dhowells@redhat.com>
Cc: Paulo Alcantara <pc@manguebit.org>
Cc: Huiwen He <hehuiwen@kylinos.cn>
Signed-off-by: Frank Sorenson <sorenson@redhat.com>
Reviewed-by: Paulo Alcantara <pc@manguebit.org>
Signed-off-by: Steve French <stfrench@microsoft.com>

cifs_file_set_size() calls cifs_setsize() on success, which calls
i_size_write(), updating i_size to the new value.  The subsequent
check attrs->ia_size != i_size_read() in both cifs_setattr_unix()
and cifs_setattr_nounix() therefore always evaluates false after a
successful cifs_file_set_size(), making the smp_store_release() of
time_last_write dead code.  The truncate path was unprotected against
stale readdir size updates.

Move the stamp to before the cifs_file_set_size() RPC call, guarded
by attrs->ia_size != i_size_read() to exclude no-op same-size
ftruncate(2) calls from stamping time_last_write unnecessarily.

On the error path the stamp remains rather than being restored:
restoring a stale snapshot (prev_tlw) could silently erase a
concurrent _cifsFileInfo_put() close stamp if that close arrived
between the READ_ONCE and the smp_store_release.  readdir is
suppressed until the stamp expires, which extends beyond one acregmax
if the caller retries failed truncations.  stat() is unaffected: the
cifs_revalidate_dentry_attr() path calls cifs_fattr_to_inode() with
from_readdir=false, which bypasses the time_last_write check in
is_size_safe_to_change() entirely and always writes the authoritative
QUERY_INFO result to i_size.

Remove the now-unreachable stamp from the dead block in both functions.

Fixes: e8a8d54c2d50 ("cifs: prevent readdir from changing file size due to stale directory metadata")
Signed-off-by: Frank Sorenson <sorenson@redhat.com>
Reviewed-by: Paulo Alcantara (Red Hat) <pc@manguebit.org>
Signed-off-by: Steve French <stfrench@microsoft.com>

The time_last_write stamp was scattered across cifs_close(),
smb2_deferred_work_close(), and the three drain functions in misc.c.
This missed the case where background I/O holds the final reference
after userspace close() returns, and required explicit maintenance at
each close-path site.

Move the smp_store_release() into _cifsFileInfo_put(), immediately
before releasing open_file_lock.  This single location covers all
close paths unconditionally: normal close, background I/O dropping the
final reference, deferred close via timer or external drain.  The
spinlock's store-release/load-acquire pairing with is_inode_writable()
already provides the ordering guarantee documented in
is_size_safe_to_change().

Remove the now-redundant stamps from cifs_close(),
smb2_deferred_work_close(), and all six stamp sites in the misc.c
deferred-close drain functions.

Fixes: e8a8d54c2d50 ("cifs: prevent readdir from changing file size due to stale directory metadata")
Signed-off-by: Frank Sorenson <sorenson@redhat.com>
Reviewed-by: Paulo Alcantara (Red Hat) <pc@manguebit.org>
Signed-off-by: Steve French <stfrench@microsoft.com>