Re: [RFC PATCH samba] smbd: deny rename if the destination has non-POSIX opens

Ralph Boehme <[email protected]> Wed, 5 Aug 2026 21:35:08 +0200

Newsgroups	org.kernel.vger.linux-cifs
Message-ID	<[email protected]>

On 8/5/26 3:31 PM, ChenXiaoSong wrote:
> From: ChenXiaoSong <[email protected]>
> 
> Check the destination share mode entries with
> has_other_nonposix_opens() before replacing it, and return
> NT_STATUS_ACCESS_DENIED if a non-POSIX open exists.
thanks for looking into this!

I'm afraid though that the issue is more subtle then just adjusting the 
check in that place.

In fact, back when I implemented Directory Leases, I added the full 
logic to check for open files and possible H-leases on them on
- the src of the rename
- iirc also the parent of the src of the rename
- the parent of the dst
- and the dst

All that logic lives in a few levels avove rename_internals_fsp() inside 
smbd_smb2_setinfo_lease_break_check().

The function that deals with the dst is 
smbd_smb2_setinfo_rename_dst_check(). That one already correctly uses 
has_other_nonposix_opens() while holding a lock on the locking.tdb 
record of the destination.

The check with files_forall() inside rename_internals_fsp() is a clutch 
that already check for opens in the same process, not globally. And we 
can't expand it to be global, as that requires taking the lock on the 
locking.tdb record which is prohibitted by the fact that we already have 
the lck on the src when rename_internals_fsp() is called. Locking two 
records simultaneously is not allowed in Samba, as it could lead to 
deadlocks.

So I guess the best we can do is remove the redundant check altogether 
from rename_internals_fsp() and rely on the correct logic from 
smbd_smb2_setinfo_lease_break_check(). We have to live with the toctou 
race window anyway, it just enlarges the window a bit, but only for the 
case of open files by the same client. Opens from other clients, are not 
detected anyway by the files_forall() as said above.

OpenPGP_signature.asc (application/pgp-signature, 840 B)