Re: [PATCH] nfs: fix ENXIO on O_CREAT open of existing symlink over NFSv3

On Sun, 2026-06-14 at 12:29 +0000, Michael Nemanov wrote:
> When open(2) is called with O_CREAT on a path that already exists as
> a
> symlink, over an NFSv3 mount with a cold dcache, the kernel returns
> ENXIO instead of following the symlink to its target.
>=20
> Reproducer script (MNT is an NFSv3 mount, kernel is 7.1-rc6):
>=20
> MNT=3D/mnt/export
> ln -sf /tmp/target $MNT/mylink
> echo 3 | sudo tee /proc/sys/vm/drop_caches=C2=A0=C2=A0 # cold dcache
>=20
> python3 - <<'EOF'
> import os
> fd =3D os.open('/mnt/export/mylink', os.O_WRONLY | os.O_CREAT |
> os.O_APPEND, 0o666)
> os.close(fd)
> EOF
>=20
> Expected: success (follow symlink, open target)
> Actual:=C2=A0=C2=A0 OSError: [Errno 6] No such device or address
>=20
> The bug does not trigger when the dcache is warm (e.g. after a prior
> stat(2)), because lookup_open() then finds a positive dentry and
> skips
> atomic_open entirely, leaving symlink resolution to the VFS.
>=20
> Root cause:
> nfs_atomic_open_v23(), registered as inode->i_op->atomic_open for
> NFSv3, handles O_CREAT by sending a CREATE UNCHECKED RPC. As
> implemented in nfsd3_create_file() (fs/nfsd/nfs3proc.c) and as
> required
> by RFC 1813 (3.3.8), when the name already exists as a non-regular
> file
> the server returns NFS3_OK with the existing object's file handle
> rather
> than NFS3ERR_EXIST causing nfs_do_create() to return 0 with the
> dentry now pointing to a symlink.
> The code then unconditionally calls finish_open(), which dispatches
> through inode->i_fop->open(). Symlink inodes never have i_fop set =E2=80=
=94
> the
> VFS initialises it to &no_open_fops because POSIX requires open(2) to
> follow symlinks, never open them directly. no_open() returns -ENXIO.
>=20
> Fix:
> After nfs_do_create() succeeds, verify the returned inode is a
> regular
> file before calling finish_open(). If the object is not regular,
> return
> finish_no_open() so the VFS follows the symlink through the normal
> open path.
> !S_ISREG() is used rather than S_ISLNK() to cover any other non-
> regular types
> a server might return.
>=20
> Fixes: 7c6c5249f061 ("NFS: add atomic_open for NFSv3 to handle
> O_TRUNC correctly.")
> Signed-off-by: Michael Nemanov <michael.nemanov-8Du6NiZp2BlWk0Htik3J/[email protected]>
> Tested-by: Michael Nemanov <michael.nemanov-8Du6NiZp2BlWk0Htik3J/[email protected]>
> ---
> =C2=A0fs/nfs/dir.c | 7 +++++++
> =C2=A01 file changed, 7 insertions(+)
>=20
> diff --git a/fs/nfs/dir.c b/fs/nfs/dir.c
> index e9ce1883288c5..6c78b06dd8699 100644
> --- a/fs/nfs/dir.c
> +++ b/fs/nfs/dir.c
> @@ -2317,6 +2317,13 @@ int nfs_atomic_open_v23(struct inode *dir,
> struct dentry *dentry,
> =C2=A0	if (open_flags & O_CREAT) {
> =C2=A0		error =3D nfs_do_create(dir, dentry, mode,
> open_flags);
> =C2=A0		if (!error) {
> +			/* With UNCHECKED mode, a server may return
> NFS3_OK for
> +			 * a pre-existing non-regular file (e.g. a
> symlink).
> +			 * Let the VFS handle it; calling
> finish_open() would
> +			 * hit no_open() and return -ENXIO.
> +			 */
> +			if (d_inode(dentry) &&
> !S_ISREG(d_inode(dentry)->i_mode))
> +				return finish_no_open(file, dentry);

This will cause the dentry to underflow the refcount. It needs to be
finish_no_open(file, NULL).

> =C2=A0			file->f_mode |=3D FMODE_CREATED;
> =C2=A0			return finish_open(file, dentry, NULL);
> =C2=A0		} else if (error !=3D -EEXIST || open_flags & O_EXCL)

--=20
Trond Myklebust
Linux NFS client maintainer, Hammerspace
[email protected], trond.myklebust-F/[email protected]