smb: client: fix double-free in SMB2_close() replay

commit f96e1cdcb63ed3321142ff2fcdf784e32cda8fee upstream.

A response-bearing attempt can return a replayable error and free its
response buffer. If SMB2_close_init() fails before the next send, cleanup
retains the previous buffer type and frees that response again.

Reset response bookkeeping before each attempt to prevent the stale free.

BUG=b/543619726
TEST=presubmit
RELEASE_NOTE=Fixed CVE-2026-64597 in the Linux kernel.

cos-patch: security-moderate
Fixes: 4f1fffa23769 ("cifs: commands that are retried should have replay flag set")
Cc: stable@vger.kernel.org
Change-Id: I319959a4630e589ec43d6f4ba73655f362d7f2d2
Signed-off-by: Henrique Carvalho <henrique.carvalho@suse.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Dom Huh <domhuh@google.com>
Reviewed-on: https://cos-review.googlesource.com/c/third_party/kernel/+/184246
Tested-by: Cusky Presubmit Bot <presubmit@cos-infra-prod.iam.gserviceaccount.com>
Reviewed-by: Derek Taylor <ddtaylor@google.com>