[GIT PULL] Ceph fixes for 7.2-rc5

[Ilya Dryomov]

Hi Linus,

The following changes since commit 1590cf0329716306e948a8fc29f1d3ee87d3989f:

  Linux 7.2-rc4 (2026-07-19 13:54:41 -0700)

are available in the Git repository at:

  https://github.com/ceph/ceph-client.git tags/ceph-for-7.2-rc5

for you to fetch changes up to 5b602344a49e039e792ce5a8923bcc61412ee134:

  ceph: avoid fs reclaim while using current->journal_info (2026-07-23 20:29:42 +0200)

----------------------------------------------------------------
A bunch of assorted fixes with the majority being hardening against
malformed input and invalid data scenarios that don't happen in real
deployments but can be utilized to trigger use-after-free and similar
issues, some error path leak fixups and two patches from Max to avoid
a potential hang in __ceph_get_caps() and unintended nesting of
current->journal_info while handling replies from the MDS.  All marked
for stable.

----------------------------------------------------------------
Bryam Vargas (1):
      ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps()

Douya Le (3):
      libceph: reject zero bucket types in crush_decode
      libceph: bound get_version reply decode to front len
      libceph: remove debugfs files before client teardown

Max Kellermann (3):
      ceph: fix hanging __ceph_get_caps() with stale mds_wanted
      ceph: add owner/capability checks for CEPH_IOC_SET_LAYOUT*
      ceph: avoid fs reclaim while using current->journal_info

Pavitra Jha (1):
      libceph: fix two unsafe bare decodes in decode_lockers()

Raphael Zimmer (3):
      libceph: Fix multiplication overflow in decode_new_up_state_weight()
      libceph: Reject monmaps advertising zero monitors
      rbd: Reset positive result codes to zero in object map update path

Shuangpeng Bai (1):
      libceph: refresh auth->authorizer_buf{,_len} after authorizer update

WenTao Liang (1):
      ceph: fix refcount leak in ceph_readdir()

Wentao Liang (1):
      ceph: fix writeback_count leak in write_folio_nounlock()

Xiang Mei (1):
      libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE

Zhao Zhang (1):
      libceph: guard missing CRUSH type name lookup

 drivers/block/rbd.c        |  7 ++++++-
 fs/ceph/addr.c             |  9 +++++++++
 fs/ceph/caps.c             | 18 ++++++++++++++++--
 fs/ceph/dir.c              |  7 ++++++-
 fs/ceph/file.c             |  9 +++++----
 fs/ceph/ioctl.c            |  6 ++++++
 fs/ceph/mds_client.c       | 11 +++++++++++
 fs/ceph/mds_client.h       |  1 +
 net/ceph/auth_x.c          |  9 ++++++++-
 net/ceph/ceph_common.c     |  4 ++--
 net/ceph/cls_lock_client.c |  8 ++++++--
 net/ceph/mon_client.c      |  4 ++--
 net/ceph/osdmap.c          | 16 ++++++++++++----
 13 files changed, 90 insertions(+), 19 deletions(-)