FAILED: patch "[PATCH] smb: client: clean up failed cached directory opens" failed to apply to 5.15-stable tree

PATCH New [email protected] 2 participants 2 messages Sep 29 – Sep 30

Subsystems (2)

Stable branch SMB client (CIFS)

lore

Share & tools

lore

[email protected]

author maintainer

2026-09-29 11:51 UTC #0 lore raw

The patch below does not apply to the 5.15-stable tree.
If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <[email protected]>.

To reproduce the conflict and resubmit, you may use the following commands:

git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.15.y
git checkout FETCH_HEAD
git cherry-pick -x d2ff5fb93ea83034025850266b5eed391f96b825
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<[email protected]>' --in-reply-to '2026092903-oyster-vicinity-b159@gregkh' --subject-prefix 'PATCH 5.15.y' 'HEAD^..'

Possible dependencies:

thanks,

greg k-h

------------------ original commit in Linus's tree ------------------

From d2ff5fb93ea83034025850266b5eed391f96b825 Mon Sep 17 00:00:00 2001
From: Zihan Xi <[email protected]>
Date: Wed, 16 Sep 2026 15:29:27 +0000
Subject: [PATCH] smb: client: clean up failed cached directory opens

open_cached_dir() sends CREATE and QUERY_INFO as a compound request. If the CREATE succeeds but a later command returns an error, the function must retain the CREATE FID so common cleanup can issue SMB2_close(). It also must not treat a response error as a valid CREATE.

Validate the CREATE response before using its fields, record the FIDs, and mark the handle open before handling errors from later compound commands. Move the -EREMCHG reconnect handling before response validation so a missing response does not hide the reconnect request. Count the handle when it is marked open; confirmed close responses decrement the counter, while existing close retry behavior remains best effort on transport failures.

Fixes b0f6df737a1c ("cifs: cache FILE_ALL_INFO for the shared root handle")

Cc [email protected]

Reported-by Vega <[email protected]>

Assisted-by LLM

Co-developed-by Luxing Yin <[email protected]>

Signed-off-by Luxing Yin <[email protected]>

Signed-off-by Zihan Xi <[email protected]>

Tested-by Frank Sorenson <[email protected]>

Signed-off-by Paulo Alcantara <[email protected]>

fs/smb/client/cached_dir.c +22 ~~-10~~

index 88d5e9a32f28..647fa26da4d2 100644
@@ -8,6 +8,7 @@
 #include <linux/namei.h>
 #include "cifsglob.h"
 #include "cifsproto.h"
+#include "../common/smb2status.h"
 #include "cifs_debug.h"
 #include "smb2proto.h"
 #include "cached_dir.h"

@@ -323,25 +324,37 @@ replay_again:
 	rc = compound_send_recv(xid, ses, server,
 				flags, 2, rqst,
 				resp_buftype, rsp_iov);
-	if (rc) {
-		if (rc == -EREMCHG) {
-			tcon->need_reconnect = true;
-			pr_warn_once("server share %s deleted\n",
-				     tcon->tree_name);
-		}
+	if (rc == -EREMCHG) {
+		tcon->need_reconnect = true;
+		pr_warn_once("server share %s deleted\n",
+			     tcon->tree_name);
+	}
+
+	if (!rsp_iov[0].iov_base || rsp_iov[0].iov_len < sizeof(*o_rsp)) {
+		if (!rc)
+			rc = -EIO;
 		goto oshr_free;
 	}
-	cfid->is_open = true;
-
-	spin_lock(&cfids->cfid_list_lock);
 
 	o_rsp = (struct smb2_create_rsp *)rsp_iov[0].iov_base;
+	if (o_rsp->hdr.Status != STATUS_SUCCESS) {
+		if (!rc)
+			rc = -EIO;
+		goto oshr_free;
+	}
+
 	oparms.fid->persistent_fid = o_rsp->PersistentFileId;
 	oparms.fid->volatile_fid = o_rsp->VolatileFileId;
 #ifdef CONFIG_CIFS_DEBUG2
 	oparms.fid->mid = le64_to_cpu(o_rsp->hdr.MessageId);
 #endif /* CIFS_DEBUG2 */
+	cfid->is_open = true;
+	atomic_inc(&tcon->num_remote_opens);
 
+	if (rc)
+		goto oshr_free;
+
+	spin_lock(&cfids->cfid_list_lock);
 
 	if (o_rsp->OplockLevel != SMB2_OPLOCK_LEVEL_LEASE) {
 		spin_unlock(&cfids->cfid_list_lock);

@@ -408,7 +421,6 @@ out:
 		close_cached_dir(cfid);
 	} else {
 		*ret_cfid = cfid;
-		atomic_inc(&tcon->num_remote_opens);
 	}
 	kfree(utf16_path);

Sasha Levin

maintainer

2026-09-30 19:15 UTC #1 lore raw

PATCH 1/1 smb: client: clean up failed cached directory opens

From: Zihan Xi <[email protected]>

[ Upstream commit d2ff5fb93ea83034025850266b5eed391f96b825 ]

Fixes b0f6df737a1c ("cifs: cache FILE_ALL_INFO for the shared root handle")

Cc [email protected]

Reported-by Vega <[email protected]>

Assisted-by LLM

Co-developed-by Luxing Yin <[email protected]>

Signed-off-by Luxing Yin <[email protected]>

Signed-off-by Zihan Xi <[email protected]>

Tested-by Frank Sorenson <[email protected]>

Signed-off-by Paulo Alcantara <[email protected]>

[ Adapted cached-directory cleanup to the older shared-root cache in fs/cifs/smb2ops.c. ]

Signed-off-by Sasha Levin <[email protected]>

---
 fs/cifs/smb2ops.c | 54 ++++++++++++++++++++++++++++-------------------
 1 file changed, 32 insertions(+), 22 deletions(-)

fs/cifs/smb2ops.c +32 ~~-22~~

index 3aaa45375d8ba..1539e834e8b55 100644
@@ -761,6 +761,7 @@ int open_cached_dir(unsigned int xid, struct cifs_tcon *tcon,
 	u8 oplock = SMB2_OPLOCK_LEVEL_II;
 	struct cifs_fid *pfid;
 	struct dentry *dentry;
+	bool is_open = false;
 
 	if (tcon->nohandlecache)
 		return -ENOTSUPP;

@@ -843,6 +844,28 @@ int open_cached_dir(unsigned int xid, struct cifs_tcon *tcon,
 	rc = compound_send_recv(xid, ses, server,
 				flags, 2, rqst,
 				resp_buftype, rsp_iov);
+	if (rc == -EREMCHG) {
+		tcon->need_reconnect = true;
+		pr_warn_once("server share %s deleted\n",
+			     tcon->treeName);
+	}
+
+	if (!rsp_iov[0].iov_base || rsp_iov[0].iov_len < sizeof(*o_rsp)) {
+		if (!rc)
+			rc = -EIO;
+		goto oshr_free;
+	}
+
+	o_rsp = (struct smb2_create_rsp *)rsp_iov[0].iov_base;
+	if (o_rsp->hdr.Status != STATUS_SUCCESS) {
+		if (!rc)
+			rc = -EIO;
+		goto oshr_free;
+	}
+
+	is_open = true;
+	atomic_inc(&tcon->num_remote_opens);
+
 	mutex_lock(&tcon->crfid.fid_mutex);
 
 	/*

@@ -855,8 +878,8 @@ int open_cached_dir(unsigned int xid, struct cifs_tcon *tcon,
 
 		/* stash fids for close() later */
 		struct cifs_fid fid = {
-			.persistent_fid = pfid->persistent_fid,
-			.volatile_fid = pfid->volatile_fid,
+			.persistent_fid = o_rsp->PersistentFileId,
+			.volatile_fid = o_rsp->VolatileFileId,
 		};
 
 		/*

@@ -867,26 +890,17 @@ int open_cached_dir(unsigned int xid, struct cifs_tcon *tcon,
 
 		mutex_unlock(&tcon->crfid.fid_mutex);
 
-		if (rc == 0) {
-			/* close extra handle outside of crit sec */
-			SMB2_close(xid, tcon, fid.persistent_fid, fid.volatile_fid);
-		}
+		/* close extra handle outside of crit sec */
+		SMB2_close(xid, tcon, fid.persistent_fid, fid.volatile_fid);
 		rc = 0;
 		goto oshr_free;
 	}
 
 	/* Cached root is still invalid, continue normaly */
 
-	if (rc) {
-		if (rc == -EREMCHG) {
-			tcon->need_reconnect = true;
-			pr_warn_once("server share %s deleted\n",
-				     tcon->treeName);
-		}
+	if (rc)
 		goto oshr_exit;
-	}
 
-	o_rsp = (struct smb2_create_rsp *)rsp_iov[0].iov_base;
 	oparms.fid->persistent_fid = o_rsp->PersistentFileId;
 	oparms.fid->volatile_fid = o_rsp->VolatileFileId;
 #ifdef CONFIG_CIFS_DEBUG2

@@ -936,17 +950,13 @@ int open_cached_dir(unsigned int xid, struct cifs_tcon *tcon,
 oshr_free:
 	SMB2_open_free(&rqst[0]);
 	SMB2_query_info_free(&rqst[1]);
+	if (rc && is_open)
+		SMB2_close(0, tcon, o_rsp->PersistentFileId,
+			   o_rsp->VolatileFileId);
 	free_rsp_buf(resp_buftype[0], rsp_iov[0].iov_base);
 	free_rsp_buf(resp_buftype[1], rsp_iov[1].iov_base);
-	if (rc) {
-		if (tcon->crfid.is_valid)
-			SMB2_close(0, tcon, oparms.fid->persistent_fid,
-				   oparms.fid->volatile_fid);
-	}
-	if (rc == 0) {
+	if (rc == 0)
 		*cfid = &tcon->crfid;
-		atomic_inc(&tcon->num_remote_opens);
-	}
 	return rc;
 }

Signature · 1 line

2.53.0