linux/fs/smb/client
Frank Sorenson 19465a9aeb smb: client: split cifsFileInfo bitfields to avoid shared-byte RMW races
The invalidHandle, swapfile, oplock_break_cancelled, offload,
and status_file_deleted fields are stored in the same bitfield byte
in struct cifsFileInfo, but are updated in different code paths that
may run simultaneously, and are protected by different locks.  Since
bitfield assignments generate byte-level read-modify-write operations,
a modification to one flag can overwrite a concurrent modification to
another flag.

To avoid these races, convert these flags from a bitfield to
separate bool fields.

Closes: https://lore.kernel.org/r/7689764e-c0f6-4016-9557-b54cf4a3de4e@redhat.com
Fixes: 3bc303c254 ("cifs: convert oplock breaks to use slow_work facility (try #4)")
Fixes: 4e8aea30f7 ("smb3: enable swap on SMB3 mounts")
Fixes: ffceb7640c ("smb: client: do not defer close open handles to deleted files")
Fixes: 173217bd73 ("smb3: retrying on failed server close")
Signed-off-by: Frank Sorenson <sorenson@redhat.com>
Cc: stable@vger.kernel.org
Reviewed-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Paulo Alcantara <pc@manguebit.org>
2026-09-30 23:17:30 -03:00
..
.gitignore smb/client: autogenerate SMB1 DOS/SRV to POSIX error mapping 2026-04-05 19:58:40 -05:00
asn1.c
cached_dir.c smb: client: clean up failed cached directory opens 2026-09-21 21:40:17 -03:00
cached_dir.h smb: client: fix (remove) drop_dir_cache module parameter 2026-04-22 09:54:21 -05:00
cifs_debug.c cifs: fix clearing stats for fastest execution of each smb2 command 2026-08-24 17:08:52 -03:00
cifs_debug.h cifs: SMB1 split: cifs_debug.c 2026-02-08 17:07:45 -06:00
cifs_fs_sb.h smb: client: fix busy dentry warning on unmount after DIO 2026-07-08 18:44:42 -05:00
cifs_ioctl.h smb: client: use atomic_t for mnt_cifs_flags 2026-02-26 18:17:08 -06:00
cifs_spnego_negtokeninit.asn1
cifs_spnego.c smb: client: reject userspace cifs.spnego descriptions 2026-05-19 10:43:05 -05:00
cifs_spnego.h cifs: Scripted clean up fs/smb/client/cifs_spnego.h 2026-02-08 17:07:44 -06:00
cifs_swn.c treewide: refresh kmalloc_obj() conversions 2026-09-04 21:37:00 -07:00
cifs_swn.h cifs: Scripted clean up fs/smb/client/cifs_swn.h 2026-02-08 17:07:44 -06:00
cifs_unicode.c smb: client: Remove obsolete cmac(aes) allocation 2026-04-22 09:56:10 -05:00
cifs_unicode.h smb: client: use atomic_t for mnt_cifs_flags 2026-02-26 18:17:08 -06:00
cifsacl.c smb: client: fail DACL rewrite when the new DACL exceeds 64K 2026-09-09 11:56:47 -03:00
cifsacl.h
cifsencrypt.c smb: client: Clear sensitive stack data in cifsencrypt.c 2026-08-24 17:08:53 -03:00
cifsfs.c smb: client: drain and invalidate before server-side copy/clone 2026-09-30 14:23:37 -03:00
cifsfs.h smb: client: clear post-EOF pagecache when extending a file via truncate 2026-09-30 14:22:57 -03:00
cifsglob.h smb: client: split cifsFileInfo bitfields to avoid shared-byte RMW races 2026-09-30 23:17:30 -03:00
cifspdu.h cifs: SMB1 split: Move BCC access functions 2026-02-08 17:07:45 -06:00
cifsproto.h cifs: Show reason why autodisabling serverino support 2026-07-09 08:03:19 -05:00
cifsroot.c
cifssmb.c smb: client: fix reparse buffer bounds in cifs_query_reparse_point() 2026-09-17 15:04:26 -03:00
compress.c smb: move LZ77 compression into common code 2026-06-16 18:57:21 -05:00
compress.h smb: move LZ77 compression into common code 2026-06-16 18:57:21 -05:00
connect.c smb: client: fix smbd_connection leak on cifs_get_tcp_session() error 2026-09-13 15:25:24 -03:00
dfs_cache.c smb: client: use GFP_KERNEL in get_targets() 2026-09-22 22:20:18 -03:00
dfs_cache.h cifs: Scripted clean up fs/smb/client/dfs_cache.h 2026-02-08 17:07:44 -06:00
dfs.c
dfs.h Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
dir.c smb: client: use finish_no_open() for non-regular inodes 2026-09-24 10:50:39 -03:00
dns_resolve.c
dns_resolve.h cifs: Scripted clean up fs/smb/client/dns_resolve.h 2026-02-08 17:07:44 -06:00
export.c
file.c smb: client: drain outstanding I/O before truncating on O_TRUNC open 2026-09-30 14:23:26 -03:00
fs_context.c 14 smb3 client fixes 2026-06-18 09:18:00 -07:00
fs_context.h smb: client: allow both 'lease' and 'nolease' mount options 2026-04-13 09:14:54 -05:00
fscache.c smb: client: simplify cifs_fscache_get_super_cookie() 2026-07-27 18:12:16 -05:00
fscache.h cifs: SMB1 split: Separate out SMB1 decls into smb1proto.h 2026-02-08 17:07:45 -06:00
gen_smb1_mapping smb/client: autogenerate SMB1 DOS/SRV to POSIX error mapping 2026-04-05 19:58:40 -05:00
gen_smb2_mapping cifs: Autogenerate SMB2 error mapping table 2026-02-08 21:23:53 -06:00
inode.c smb: client: require stable pages for signed connections 2026-09-30 14:24:21 -03:00
ioctl.c smb: client: remove redundant NULL check before kfree() 2026-08-24 17:08:53 -03:00
Kconfig 18 ksmbd server fixes 2026-04-23 17:04:18 -07:00
link.c smb/client: zero-initialize stack-allocated cifs_open_info_data 2026-07-09 07:55:55 -05:00
Makefile smb: move LZ77 compression into common code 2026-06-16 18:57:21 -05:00
misc.c smb: client: fix missing lower-bound check on DFS referral string offsets 2026-09-17 15:03:59 -03:00
namespace.c cifs: Implement fileattr_get for case sensitivity 2026-05-11 16:50:29 +02:00
netlink.c smb: client: require net admin for CIFS SWN netlink 2026-05-21 11:15:17 -05:00
netlink.h cifs: Scripted clean up fs/smb/client/netlink.h 2026-02-08 17:07:44 -06:00
netmisc.c cifs: SMB1 split: netmisc.c 2026-02-08 17:07:45 -06:00
nterr.h smb/client: replace nt_errs with ntstatus_to_dos_map 2026-04-05 19:58:40 -05:00
ntlmssp.h cifs: Scripted clean up fs/smb/client/ntlmssp.h 2026-02-08 17:07:45 -06:00
readdir.c smb: client: avoid using uninitialized SIDs in cifs_posix_to_fattr() 2026-09-08 11:29:57 -03:00
reparse.c smb: client: fix fattr leaking on wsl_to_fattr() failure 2026-09-14 21:53:08 -03:00
reparse.h smb: client: fix unaligned access in WSL reparse point parser 2026-09-14 21:52:55 -03:00
rfc1002pdu.h smb: fix some warnings reported by scripts/checkpatch.pl 2025-11-30 21:11:45 -06:00
sess.c smb: client: fix use-after-free of iface in cifs_try_adding_channels() 2026-09-16 15:39:06 -03:00
smb1debug.c cifs: SMB1 split: cifs_debug.c 2026-02-08 17:07:45 -06:00
smb1encrypt.c smb: client: Clear sensitive stack data in smb1encrypt.c 2026-08-24 17:08:53 -03:00
smb1maperror_test.c smb/client: Use EXPORT_SYMBOL_IF_KUNIT() to export symbols 2026-07-14 21:48:00 -05:00
smb1maperror.c smb: client: remove conditional return with no effect 2026-07-26 17:40:20 -05:00
smb1misc.c smb: client: restore the data_offset bound in is_valid_oplock_break() 2026-08-24 17:08:53 -03:00
smb1ops.c smb: client: fix copy-paste error in WSL EA length accounting for $LXDEV 2026-08-24 17:08:53 -03:00
smb1pdu.h smb: move compression definitions into common/fscc.h 2026-06-16 18:57:21 -05:00
smb1proto.h smb/client: allow FS_IOC_SETFLAGS to clear compression 2026-06-14 15:12:23 -05:00
smb1session.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
smb1transport.c smb: client: fix UAF and buffer leak in cifs_check_trans2() for malformed secondary T2 2026-08-24 17:08:53 -03:00
smb2file.c smb: client: fix ALIGN() overflow in symlink_data() error context loop 2026-08-24 17:08:53 -03:00
smb2glob.h smb/client: make SMB2 maperror KUnit tests a separate module 2026-03-01 17:59:52 -06:00
smb2inode.c smb: client: preserve create-context parsing errors 2026-09-21 21:40:17 -03:00
smb2maperror_test.c smb/client: Use EXPORT_SYMBOL_IF_KUNIT() to export symbols in SMB2 2026-07-14 21:51:19 -05:00
smb2maperror.c smb/client: Use EXPORT_SYMBOL_IF_KUNIT() to export symbols in SMB2 2026-07-14 21:51:19 -05:00
smb2misc.c smb: client: close completed creates on compound wait errors 2026-09-21 21:40:17 -03:00
smb2ops.c smb: client: only require read lease for size-extending preallocate 2026-09-30 14:24:01 -03:00
smb2pdu.c smb: client: distinguish real EOF from a stale remote_i_size on read 2026-09-30 14:24:16 -03:00
smb2pdu.h smb: client: update POSIX extension specification references 2026-09-22 22:12:10 -03:00
smb2proto.h smb/client: refresh allocation after EOF-extending fallocate 2026-07-13 10:37:55 -05:00
smb2transport.c There are thirty-three client fixes: 2026-08-24 18:11:49 -07:00
smbdirect.c smb: smbdirect: introduce and use include/linux/smbdirect.h 2026-05-01 16:24:25 -05:00
smbdirect.h smb: smbdirect: introduce and use include/linux/smbdirect.h 2026-05-01 16:24:25 -05:00
smbencrypt.c cifs: SMB1 split: Adjust #includes 2026-02-08 17:07:45 -06:00
smberr.h smb/client: introduce KUnit tests to check DOS/SRV err mapping search 2026-04-05 19:58:40 -05:00
trace.c smb: client: Add tracepoint for krb5 auth 2025-12-05 17:40:42 -06:00
trace.h smb: client: fix OOB struct field reads in move_smb2_ea_to_cifs() 2026-09-17 15:04:07 -03:00
transport.c smb: client: close completed creates on compound wait errors 2026-09-21 21:40:17 -03:00
unc.c
winucase.c
xattr.c smb/client: clean up a type issue in cifs_xattr_get() 2026-06-14 15:12:24 -05:00