[PATCH v2 0/8] smb: client: remount reconfigure option fixes

From: Rajasi Mandal <[email protected]>

This series makes several mount options actually take effect (or be
cleanly rejected) on remount instead of being silently ignored, and
fixes the option-comparison baseline so a bare 'mount -o remount' is
neither wrongly rejected nor allowed to clobber live runtime state.

Overview:
  1: build the reconfigure baseline from the live mount (a private,
     runtime-synced dup of cifs_sb->ctx) instead of init defaults.
  2: reject connection-tied options that cannot change on remount,
     using that baseline so bare remounts and /proc/mounts replays
     are still accepted.
  3: propagate retrans to the live server on remount.
  4: reject cache=ro / cache=singleclient changes on remount.
  5: apply rasize on remount.
  6: move struct tcon_list to cifsglob.h (no functional change).
  7: make nolease take effect on remount and evict lease-bearing
     cached state.
  8: take tc_lock around the tc_count bump in cached_dir_lease_break().

Changes since v1:
  - Patch 1: corrected the "Not addressed" note.  The pre-existing
    unserialized cifs_sb->ctx access is a potential use-after-free
    read of freed string fields (e.g. iocharset), not merely a torn
    or stale value as v1 claimed; the note now also acknowledges that
    the reconfigure-time dup adds one more reader on that same
    footing.  No code change.
  - Patch 3: cifs_construct_tcon() (sess.c) now reads server->retrans
    with READ_ONCE(); it was the one remaining plain read that would
    race the new WRITE_ONCE() writer.  (Reported by automated review.)
  - Patch 5: documented in the commit message the two pre-existing
    items previously noted only here (sub-PAGE_SIZE rsize/wsize
    realign, and the STEAL_STRING() source NULL window vs DFS
    reconnect).
  - Patch 7: invalidate_all_cached_dirs_sb() is now documented as
    best-effort if the tcon-array allocation fails under memory
    pressure -- future opens still honor the new nolease via the
    tcon->no_lease propagation, and the n<count walk bound is
    commented.  (Reported by automated review.)
  - New Patch 8: take tcon->tc_lock around the tc_count bump in
    cached_dir_lease_break() -- the sole tc_count writer that lacked
    it, letting a lease break race another put/get.  (Reported by
    automated review.)

Known pre-existing issues intentionally NOT addressed here (each is
called out in the relevant commit message):
  - cifs_sb->ctx has no lifetime protection: cifs_show_options() and
    other lockless readers can take a use-after-free read of string
    fields while smb3_reconfigure() frees/replaces them in place.  The
    reader side (/proc/mounts) is unprivileged but a hit still needs a
    concurrent privileged remount of that same mount.  The correct fix
    is an RCU/refcount ctx lifetime touching every reader (iocharset,
    source/devname, the reconfigure dup, DFS source lookup, ...) and
    is best done as its own change.  (Patch 1, Patch 5)
  - tcon->unix_ext shares a bitfield word with other lockless writers;
    theoretical word-tearing only.  (Patch 1)
  - Explicit 'mount -o remount,port=<active-default>' is rejected; not
    reachable via tooling since port is not in /proc/mounts.  (Patch 2)
  - A bare remount realigns a sub-PAGE_SIZE negotiated rsize/wsize up
    to PAGE_SIZE via CIFS_ALIGN_*; pre-existing and independent of the
    rasize change here.  (Patch 5)
  - cfids_laundromat_worker() can resurrect a tcon from tc_count 0
    while cifs_put_tcon() tears it down, and the cifs_debug dirs knob
    invalidates with close_handles=false.  Pre-existing and unrelated
    to nolease.  (Patch 7)

Testing:
  - checkpatch --strict clean (bar one pre-existing CamelCase CHECK on
    ses->domainName); each patch builds standalone (bisectable).
  - Functional testing on Azure Files (SMB 3.1.1): a bare remount
    preserves the full /proc/mounts option set; retrans/nolease/rasize
    apply on remount; vers / echo_interval and other non-reconfigurable
    changes are rejected with -EINVAL; a remount replaying a
    server-displayed option is accepted; I/O works and dmesg is clean.

Rajasi Mandal (8):
  smb: client: sync runtime state into ctx on reconfigure
  smb: client: block non-reconfigurable option changes on remount
  smb: client: sync retrans on remount
  smb: client: block cache=ro and cache=singleclient on remount
  smb: client: apply rasize on remount
  smb: client: move struct tcon_list to cifsglob.h
  smb: client: allow nolease option to be reconfigured on remount
  smb: client: take tc_lock around tc_count bump in
    cached_dir_lease_break()

 fs/smb/client/cached_dir.c |  91 +++++++-
 fs/smb/client/cached_dir.h |   4 +-
 fs/smb/client/cifs_debug.c |   2 +-
 fs/smb/client/cifs_swn.h   |  14 +-
 fs/smb/client/cifsfs.c     |   6 +-
 fs/smb/client/cifsglob.h   |   7 +-
 fs/smb/client/connect.c    |   4 +-
 fs/smb/client/file.c       |   2 +-
 fs/smb/client/fs_context.c | 446 ++++++++++++++++++++++++++++++++++++-
 fs/smb/client/misc.c       |   5 -
 fs/smb/client/sess.c       |   2 +-
 fs/smb/client/smb1ops.c    |   7 +-
 fs/smb/client/smb2ops.c    |   2 +-
 fs/smb/client/smb2pdu.c    |  13 +-
 fs/smb/client/trace.h      |   2 +
 15 files changed, 576 insertions(+), 31 deletions(-)


base-commit: c0a27675eaf08255017b3cabc28c99c0cd71f468
-- 
2.43.0