[PATCH 0/2] smb/server: fix posix state check for directory rename

[PATCH 0/2] smb/server: fix posix state check for directory rename

[ChenXiaoSong]

From: ChenXiaoSong <chenxiaosong@kylinos.cn>

ChenXiaoSong (2):
  smb/server: pass source ksmbd_file to rename helpers
  smb/server: fix posix state check for directory rename

 fs/smb/server/smb2pdu.c   | 2 +-
 fs/smb/server/vfs.c       | 6 +++---
 fs/smb/server/vfs.h       | 4 ++--
 fs/smb/server/vfs_cache.c | 5 ++++-
 fs/smb/server/vfs_cache.h | 2 +-
 5 files changed, 11 insertions(+), 8 deletions(-)

-- 
2.54.0

[PATCH 1/2] smb/server: pass source ksmbd_file to rename helpers

[ChenXiaoSong]

From: ChenXiaoSong <chenxiaosong@kylinos.cn>

Pass the source ksmbd_file to ksmbd_vfs_rename() and
ksmbd_has_open_files().

This is a preparatory change for the next patch. Keeping the interface
change separate makes the functional fix easier to review.

No functional change.

Signed-off-by: ChenXiaoSong <chenxiaosong@kylinos.cn>
---
 fs/smb/server/smb2pdu.c   | 2 +-
 fs/smb/server/vfs.c       | 5 +++--
 fs/smb/server/vfs.h       | 4 ++--
 fs/smb/server/vfs_cache.c | 3 ++-
 fs/smb/server/vfs_cache.h | 2 +-
 5 files changed, 9 insertions(+), 7 deletions(-)

diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c
index 2039a44d4b17..cb6c222b937b 100644
--- a/fs/smb/server/smb2pdu.c
+++ b/fs/smb/server/smb2pdu.c
@@ -7690,7 +7690,7 @@ static int smb2_rename(struct ksmbd_work *work,
 		goto out;
 
 	smb_break_all_levII_oplock_rename(work, fp);
-	rc = ksmbd_vfs_rename(work, &fp->filp->f_path, new_name, flags);
+	rc = ksmbd_vfs_rename(work, fp, new_name, flags);
 out:
 	kfree(new_name);
 	return rc;
diff --git a/fs/smb/server/vfs.c b/fs/smb/server/vfs.c
index 8a80d6d8e02d..34975e18528c 100644
--- a/fs/smb/server/vfs.c
+++ b/fs/smb/server/vfs.c
@@ -681,9 +681,10 @@ int ksmbd_vfs_check_rename_share(struct ksmbd_work *work,
 	return err;
 }
 
-int ksmbd_vfs_rename(struct ksmbd_work *work, const struct path *old_path,
+int ksmbd_vfs_rename(struct ksmbd_work *work, struct ksmbd_file *old_fp,
 			     char *newname, int flags)
 {
+	const struct path *old_path = &old_fp->filp->f_path;
 	struct dentry *old_child = old_path->dentry;
 	struct path new_path;
 	struct qstr new_last;
@@ -721,7 +722,7 @@ int ksmbd_vfs_rename(struct ksmbd_work *work, const struct path *old_path,
 		goto out_drop_write;
 
 	if (!work->tcon->posix_extensions && d_is_dir(old_child) &&
-	    ksmbd_has_open_files(old_child)) {
+	    ksmbd_has_open_files(old_fp)) {
 		err = -EACCES;
 		goto out3;
 	}
diff --git a/fs/smb/server/vfs.h b/fs/smb/server/vfs.h
index 1818b3f1971c..f922cd15ce3e 100644
--- a/fs/smb/server/vfs.h
+++ b/fs/smb/server/vfs.h
@@ -88,8 +88,8 @@ int ksmbd_vfs_remove_file(struct ksmbd_work *work, const struct path *path);
 int ksmbd_vfs_link(struct ksmbd_work *work,
 		   const char *oldname, const char *newname);
 int ksmbd_vfs_getattr(const struct path *path, struct kstat *stat);
-int ksmbd_vfs_rename(struct ksmbd_work *work, const struct path *old_path,
-			     char *newname, int flags);
+int ksmbd_vfs_rename(struct ksmbd_work *work, struct ksmbd_file *old_fp,
+		     char *newname, int flags);
 int ksmbd_vfs_check_rename_share(struct ksmbd_work *work,
 				 const struct path *old_path);
 int ksmbd_vfs_truncate(struct ksmbd_work *work,
diff --git a/fs/smb/server/vfs_cache.c b/fs/smb/server/vfs_cache.c
index a35df2ab59c9..c66584ed23ab 100644
--- a/fs/smb/server/vfs_cache.c
+++ b/fs/smb/server/vfs_cache.c
@@ -1137,8 +1137,9 @@ struct ksmbd_file *ksmbd_lookup_fd_inode(struct dentry *dentry)
 	return NULL;
 }
 
-bool ksmbd_has_open_files(struct dentry *dentry)
+bool ksmbd_has_open_files(struct ksmbd_file *old_fp)
 {
+	struct dentry *dentry = old_fp->filp->f_path.dentry;
 	struct ksmbd_file *fp;
 	unsigned int id;
 	bool ret = false;
diff --git a/fs/smb/server/vfs_cache.h b/fs/smb/server/vfs_cache.h
index d80f379d4e12..127ea4987e3f 100644
--- a/fs/smb/server/vfs_cache.h
+++ b/fs/smb/server/vfs_cache.h
@@ -212,7 +212,7 @@ bool ksmbd_has_stream_without_delete_share(struct ksmbd_file *fp);
 int ksmbd_close_fd_app_instance_id(char *app_instance_id);
 struct ksmbd_file *ksmbd_lookup_fd_cguid(char *cguid);
 struct ksmbd_file *ksmbd_lookup_fd_inode(struct dentry *dentry);
-bool ksmbd_has_open_files(struct dentry *dentry);
+bool ksmbd_has_open_files(struct ksmbd_file *old_fp);
 unsigned int ksmbd_open_durable_fd(struct ksmbd_file *fp);
 struct ksmbd_file *ksmbd_open_fd(struct ksmbd_work *work, struct file *filp);
 void ksmbd_launch_ksmbd_durable_scavenger(void);
-- 
2.54.0

[PATCH 2/2] smb/server: fix posix state check for directory rename

[ChenXiaoSong]

From: ChenXiaoSong <chenxiaosong@kylinos.cn>

Reproducer:

  1. server: systemctl start ksmbd
  2. client: mount -t cifs //${server_ip}/export /mnt # without posix option
  3. client: mkdir /mnt/dir1/; touch /mnt/dir1/file
  4. client: tail -f /mnt/dir1/file # open file
  5. client: mv /mnt/dir1 /mnt/dir2
             rename succeeded, but it was expected to fail with "Permission denied"

See POSIX-FSA 2.1.3.1.

work->tcon->posix_extensions only records whether POSIX extensions were
negotiated on the connection. It does not indicate that the handles
were opened with POSIX create contexts.

Fixes: c841bd3d8dec ("ksmbd: deny renaming directory with open children")
Signed-off-by: ChenXiaoSong <chenxiaosong@kylinos.cn>
---
 fs/smb/server/vfs.c       | 3 +--
 fs/smb/server/vfs_cache.c | 2 ++
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/fs/smb/server/vfs.c b/fs/smb/server/vfs.c
index 34975e18528c..28940c7b5f83 100644
--- a/fs/smb/server/vfs.c
+++ b/fs/smb/server/vfs.c
@@ -721,8 +721,7 @@ int ksmbd_vfs_rename(struct ksmbd_work *work, struct ksmbd_file *old_fp,
 	if (err)
 		goto out_drop_write;
 
-	if (!work->tcon->posix_extensions && d_is_dir(old_child) &&
-	    ksmbd_has_open_files(old_fp)) {
+	if (d_is_dir(old_child) && ksmbd_has_open_files(old_fp)) {
 		err = -EACCES;
 		goto out3;
 	}
diff --git a/fs/smb/server/vfs_cache.c b/fs/smb/server/vfs_cache.c
index c66584ed23ab..eac9886eb6e3 100644
--- a/fs/smb/server/vfs_cache.c
+++ b/fs/smb/server/vfs_cache.c
@@ -1152,6 +1152,8 @@ bool ksmbd_has_open_files(struct ksmbd_file *old_fp)
 			continue;
 		if (fp_dentry == dentry)
 			continue;
+		if (old_fp->is_posix_ctxt && fp->is_posix_ctxt)
+			continue;
 		if (is_subdir(fp_dentry, dentry)) {
 			ret = true;
 			break;
-- 
2.54.0

Re: [PATCH 0/2] smb/server: fix posix state check for directory rename

[Namjae Jeon]

On Mon, Aug 3, 2026 at 2:09 AM ChenXiaoSong
<chenxiaosong@chenxiaosong.com> wrote:
>
> From: ChenXiaoSong <chenxiaosong@kylinos.cn>
>
> ChenXiaoSong (2):
>   smb/server: pass source ksmbd_file to rename helpers
>   smb/server: fix posix state check for directory rename
The argument-only change in 0002 patch has no standalone functional
purpose, so there is no reason to keep it as a separate patch.
Additionally, 0002 patch must be applied first, and applying only 0001
patch can result in a build failure. This is another source of error
caused by unnecessarily splitting the change. Therefore, I squashed
the two patches into a single patch and applied it to
#ksmbd-for-next-next.
Thanks!

Re: [PATCH 0/2] smb/server: fix posix state check for directory rename

[ChenXiaoSong]

Agreed. Squashing them into a single patch is fine.

On 8/3/26 16:48, Namjae Jeon wrote:
> The argument-only change in 0002 patch has no standalone functional
> purpose, so there is no reason to keep it as a separate patch.
> Additionally, 0002 patch must be applied first, and applying only 0001
> patch can result in a build failure. This is another source of error
> caused by unnecessarily splitting the change. Therefore, I squashed
> the two patches into a single patch and applied it to
> #ksmbd-for-next-next.
> Thanks!

-- 
ChenXiaoSong <chenxiaosong@chenxiaosong.com>
Chinese Homepage: https://chenxiaosong.com
English Homepage: https://chenxiaosong.com/en