FAILED: patch "[PATCH] smb/server: fix posix state check for directory rename" failed to apply to 6.6-stable tree

PATCH [email protected] 1 participant 1 message Sep 16

Subsystems (2)

Stable branch Kernel SMB3 server (ksmbd)

lore

Share & tools

lore

[email protected]

author maintainer

2026-09-16 17:41 UTC #0 lore raw

The patch below does not apply to the 6.6-stable tree.
If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <[email protected]>.

To reproduce the conflict and resubmit, you may use the following commands:

git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.6.y
git checkout FETCH_HEAD
git cherry-pick -x 2d99fbd7ad36ef288700f00102aaee11bcae04b4
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<[email protected]>' --in-reply-to '2026091638-tarot-statutory-927c@gregkh' --subject-prefix 'PATCH 6.6.y' 'HEAD^..'

Possible dependencies:

thanks,

greg k-h

------------------ original commit in Linus's tree ------------------

From 2d99fbd7ad36ef288700f00102aaee11bcae04b4 Mon Sep 17 00:00:00 2001
From: ChenXiaoSong <[email protected]>
Date: Mon, 3 Aug 2026 17:21:17 +0900
Subject: [PATCH] smb/server: fix posix state check for directory rename

Pass the source ksmbd_file to the rename helpers and use the per-handle POSIX create-context state when deciding whether open children block a directory rename.

work->tcon->posix_extensions only records whether POSIX extensions were negotiated on the connection. It does not indicate that the handles were opened with POSIX create contexts.

Reproducer:

1. server: systemctl start ksmbd
2. client: mount -t cifs //${server_ip}/export /mnt

     # without posix option
  3. client: mkdir /mnt/dir1/; touch /mnt/dir1/file
  4. client: tail -f /mnt/dir1/file # open file
  5. client: mv /mnt/dir1 /mnt/dir2

Without this fix, the rename can succeed when it should fail with "Permission denied".

Fixes c841bd3d8dec ("ksmbd: deny renaming directory with open children")

Signed-off-by ChenXiaoSong <[email protected]>

Signed-off-by Namjae Jeon <[email protected]>

fs/smb/server/smb2pdu.c +1 -1

index e214d27e4d37..80f5791c687b 100644
@@ -7690,7 +7690,7 @@ static int smb2_rename(struct ksmbd_work *work,
 		goto out;
 
 	smb_break_all_levII_oplock_rename(work, fp);
-	rc = ksmbd_vfs_rename(work, &fp->filp->f_path, new_name, flags);
+	rc = ksmbd_vfs_rename(work, fp, new_name, flags);
 out:
 	kfree(new_name);
 	return rc;

fs/smb/server/vfs.c +3 -3

index ff86e0e88177..0e7d66b0e899 100644
@@ -678,9 +678,10 @@ int ksmbd_vfs_check_rename_share(struct ksmbd_work *work,
 	return err;
 }
 
-int ksmbd_vfs_rename(struct ksmbd_work *work, const struct path *old_path,
+int ksmbd_vfs_rename(struct ksmbd_work *work, struct ksmbd_file *old_fp,
 			     char *newname, int flags)
 {
+	const struct path *old_path = &old_fp->filp->f_path;
 	struct dentry *old_child = old_path->dentry;
 	struct path new_path;
 	struct qstr new_last;

@@ -717,8 +718,7 @@ int ksmbd_vfs_rename(struct ksmbd_work *work, const struct path *old_path,
 	if (err)
 		goto out_drop_write;
 
-	if (!work->tcon->posix_extensions && d_is_dir(old_child) &&
-	    ksmbd_has_open_files(old_child)) {
+	if (d_is_dir(old_child) && ksmbd_has_open_files(old_fp)) {
 		err = -EACCES;
 		goto out3;
 	}

fs/smb/server/vfs.h +2 -2

index 1818b3f1971c..55d099de71f5 100644
@@ -88,8 +88,8 @@ int ksmbd_vfs_remove_file(struct ksmbd_work *work, const struct path *path);
 int ksmbd_vfs_link(struct ksmbd_work *work,
 		   const char *oldname, const char *newname);
 int ksmbd_vfs_getattr(const struct path *path, struct kstat *stat);
-int ksmbd_vfs_rename(struct ksmbd_work *work, const struct path *old_path,
-			     char *newname, int flags);
+int ksmbd_vfs_rename(struct ksmbd_work *work, struct ksmbd_file *old_fp,
+			 char *newname, int flags);
 int ksmbd_vfs_check_rename_share(struct ksmbd_work *work,
 				 const struct path *old_path);
 int ksmbd_vfs_truncate(struct ksmbd_work *work,

fs/smb/server/vfs_cache.c +4 -1

index a35df2ab59c9..eac9886eb6e3 100644
@@ -1137,8 +1137,9 @@ struct ksmbd_file *ksmbd_lookup_fd_inode(struct dentry *dentry)
 	return NULL;
 }
 
-bool ksmbd_has_open_files(struct dentry *dentry)
+bool ksmbd_has_open_files(struct ksmbd_file *old_fp)
 {
+	struct dentry *dentry = old_fp->filp->f_path.dentry;
 	struct ksmbd_file *fp;
 	unsigned int id;
 	bool ret = false;

@@ -1151,6 +1152,8 @@ bool ksmbd_has_open_files(struct dentry *dentry)
 			continue;
 		if (fp_dentry == dentry)
 			continue;
+		if (old_fp->is_posix_ctxt && fp->is_posix_ctxt)
+			continue;
 		if (is_subdir(fp_dentry, dentry)) {
 			ret = true;
 			break;

fs/smb/server/vfs_cache.h +1 -1

index d80f379d4e12..127ea4987e3f 100644
@@ -212,7 +212,7 @@ bool ksmbd_has_stream_without_delete_share(struct ksmbd_file *fp);
 int ksmbd_close_fd_app_instance_id(char *app_instance_id);
 struct ksmbd_file *ksmbd_lookup_fd_cguid(char *cguid);
 struct ksmbd_file *ksmbd_lookup_fd_inode(struct dentry *dentry);
-bool ksmbd_has_open_files(struct dentry *dentry);
+bool ksmbd_has_open_files(struct ksmbd_file *old_fp);
 unsigned int ksmbd_open_durable_fd(struct ksmbd_file *fp);
 struct ksmbd_file *ksmbd_open_fd(struct ksmbd_work *work, struct file *filp);
 void ksmbd_launch_ksmbd_durable_scavenger(void);