Patch Detail
get:
Show a patch.
patch:
Update a patch.
put:
Update a patch.
GET /api/1.1/patches/2223729/?format=api
{ "id": 2223729, "url": "http://patchwork.ozlabs.org/api/1.1/patches/2223729/?format=api", "web_url": "http://patchwork.ozlabs.org/project/linux-cifs-client/patch/20260416022811.2692096-1-charsyam@gmail.com/", "project": { "id": 12, "url": "http://patchwork.ozlabs.org/api/1.1/projects/12/?format=api", "name": "Linux CIFS Client", "link_name": "linux-cifs-client", "list_id": "linux-cifs.vger.kernel.org", "list_email": "linux-cifs@vger.kernel.org", "web_url": "", "scm_url": "", "webscm_url": "" }, "msgid": "<20260416022811.2692096-1-charsyam@gmail.com>", "date": "2026-04-16T02:28:11", "name": "smb/client: fix chan_max race and rollback in smb3_reconfigure", "commit_ref": null, "pull_url": null, "state": "new", "archived": false, "hash": "cc756d6da51d617d0a1fcf7bad60251f6638336b", "submitter": { "id": 93166, "url": "http://patchwork.ozlabs.org/api/1.1/people/93166/?format=api", "name": "DaeMyung Kang", "email": "charsyam@gmail.com" }, "delegate": null, "mbox": "http://patchwork.ozlabs.org/project/linux-cifs-client/patch/20260416022811.2692096-1-charsyam@gmail.com/mbox/", "series": [ { "id": 500069, "url": "http://patchwork.ozlabs.org/api/1.1/series/500069/?format=api", "web_url": "http://patchwork.ozlabs.org/project/linux-cifs-client/list/?series=500069", "date": "2026-04-16T02:28:11", "name": "smb/client: fix chan_max race and rollback in smb3_reconfigure", "version": 1, "mbox": "http://patchwork.ozlabs.org/series/500069/mbox/" } ], "comments": "http://patchwork.ozlabs.org/api/patches/2223729/comments/", "check": "pending", "checks": "http://patchwork.ozlabs.org/api/patches/2223729/checks/", "tags": {}, "headers": { "Return-Path": "\n <linux-cifs+bounces-10845-incoming=patchwork.ozlabs.org@vger.kernel.org>", "X-Original-To": [ "incoming@patchwork.ozlabs.org", "linux-cifs@vger.kernel.org" ], "Delivered-To": "patchwork-incoming@legolas.ozlabs.org", "Authentication-Results": [ "legolas.ozlabs.org;\n\tdkim=pass (2048-bit key;\n unprotected) header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256\n header.s=20251104 header.b=qTRvua96;\n\tdkim-atps=neutral", "legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=vger.kernel.org\n (client-ip=2600:3c09:e001:a7::12fc:5321; helo=sto.lore.kernel.org;\n envelope-from=linux-cifs+bounces-10845-incoming=patchwork.ozlabs.org@vger.kernel.org;\n receiver=patchwork.ozlabs.org)", "smtp.subspace.kernel.org;\n\tdkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com\n header.b=\"qTRvua96\"", "smtp.subspace.kernel.org;\n arc=none smtp.client-ip=209.85.214.170", "smtp.subspace.kernel.org;\n dmarc=pass (p=none dis=none) header.from=gmail.com", "smtp.subspace.kernel.org;\n spf=pass smtp.mailfrom=gmail.com" ], "Received": [ "from sto.lore.kernel.org (sto.lore.kernel.org\n [IPv6:2600:3c09:e001:a7::12fc:5321])\n\t(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n\t key-exchange x25519 server-signature ECDSA (secp384r1) server-digest SHA384)\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4fx24Y6wNqz1yCv\n\tfor <incoming@patchwork.ozlabs.org>; Thu, 16 Apr 2026 12:28:29 +1000 (AEST)", "from smtp.subspace.kernel.org (conduit.subspace.kernel.org\n [100.90.174.1])\n\tby sto.lore.kernel.org (Postfix) with ESMTP id ECA4230479A5\n\tfor <incoming@patchwork.ozlabs.org>; Thu, 16 Apr 2026 02:28:25 +0000 (UTC)", "from localhost.localdomain (localhost.localdomain [127.0.0.1])\n\tby smtp.subspace.kernel.org (Postfix) with ESMTP id B0DA62566F7;\n\tThu, 16 Apr 2026 02:28:21 +0000 (UTC)", "from mail-pl1-f170.google.com (mail-pl1-f170.google.com\n [209.85.214.170])\n\t(using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits))\n\t(No client certificate requested)\n\tby smtp.subspace.kernel.org (Postfix) with ESMTPS id CCBD424A05D\n\tfor <linux-cifs@vger.kernel.org>; Thu, 16 Apr 2026 02:28:19 +0000 (UTC)", "by mail-pl1-f170.google.com with SMTP id\n d9443c01a7336-2ab08e6c553so7845085ad.3\n for <linux-cifs@vger.kernel.org>;\n Wed, 15 Apr 2026 19:28:19 -0700 (PDT)", "from ser8.. ([221.156.231.192])\n by smtp.gmail.com with ESMTPSA id\n d9443c01a7336-2b4782cb32csm38417295ad.79.2026.04.15.19.28.16\n (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);\n Wed, 15 Apr 2026 19:28:18 -0700 (PDT)" ], "ARC-Seal": "i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;\n\tt=1776306501; cv=none;\n b=sVr7aNzHfg1UhEF9zqpE/KPZZSqpuhALE3MOgG0uVSP0BNTKgz3pXWuZPGrmeKWcZTBBnikXNT7mVULyVIJ4nj0a1TGdTcpM5yFc8G9NfOnikyets0+3eI4hXT8wpWlXcI12g9/WCdOsbOjNTilSeNivS2om5quSEhFJJWupxYo=", "ARC-Message-Signature": "i=1; a=rsa-sha256; d=subspace.kernel.org;\n\ts=arc-20240116; t=1776306501; c=relaxed/simple;\n\tbh=KKIpoYq2uErfaHaKJ+Vur6Kcodxd4Fi9QHqXgTG5Zvg=;\n\th=From:To:Cc:Subject:Date:Message-ID:MIME-Version:Content-Type;\n b=h4Lmx/y/Nm6UNxePXImnoVBK6TPxCqOQHduMQmSw1CK7iBa/IEuw7ZqLeOjd24LvPFiXyQxfaFGjYUOtFgGZTg8PxekIqrDb8aHmPvTkv08gwNPQMz0b6LG0EtlIsHWMtbY5/3s6TdRS0/To2Jd6APG0GlMPSw+fqQr5q42tubE=", "ARC-Authentication-Results": "i=1; smtp.subspace.kernel.org;\n dmarc=pass (p=none dis=none) header.from=gmail.com;\n spf=pass smtp.mailfrom=gmail.com;\n dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com\n header.b=qTRvua96; arc=none smtp.client-ip=209.85.214.170", "DKIM-Signature": "v=1; a=rsa-sha256; c=relaxed/relaxed;\n d=gmail.com; s=20251104; t=1776306499; x=1776911299;\n darn=vger.kernel.org;\n h=content-transfer-encoding:mime-version:message-id:date:subject:cc\n :to:from:from:to:cc:subject:date:message-id:reply-to;\n bh=mJGzIbGnleMhmFoh5QkhawpHd8PMOA09v6aeOmjNus8=;\n b=qTRvua96RpnB2CUnJUlFltedgHQ0yaX4rcD72uyFFrNJXEvYhjAbBz2LonBqr6CWds\n 47r3j/lwH4nkTSOyOrItogftCKsT392eqHsWXCrGqZfX4JCS464TvzGO/MPaw4+558fw\n 7dWiH4BLP+evx6UzJWttIl/t8p0lTUJCWz0pbv+coIOn5cag+UHvs0jDv8VelE/STURb\n ZHgqD2WzhTbZc7eHO9P9/2DXvXLFTtLQmpXFc8lOdozujkjMW/nAW/ejWPZYBCnF0ViL\n d+KwxPjIkiIG/RcolSStBCku3ZtW1kgcFdFco3Z/uZpM/AgxLuUv497BLpxEhit2+lGs\n SUYw==", "X-Google-DKIM-Signature": "v=1; a=rsa-sha256; c=relaxed/relaxed;\n d=1e100.net; s=20251104; t=1776306499; x=1776911299;\n h=content-transfer-encoding:mime-version:message-id:date:subject:cc\n :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date\n :message-id:reply-to;\n bh=mJGzIbGnleMhmFoh5QkhawpHd8PMOA09v6aeOmjNus8=;\n b=HZW1yEFRXFL+zVYO2IClRgfGmbrrrBgZPCEjuraPR91NASvgaSKlIepDOUKJKeoM5L\n 4dc0otCH3XrSIfKwG0ooA+U81zd8Ad6JVhsnfJiQu/0aEuRDeB/9Q4YHZhucv9nw/fwE\n 4hijBaxGX+KE1eRfqUfHgDTRg8rrFGVTdjzEJs6+Nx1I3HL+G9SN5GJrLNccL17mlVmZ\n +QMt8R6URSHGHqABFhPFM9DXQYNNCXcZRKyZRPbRVOhiRbHuQthC+wfa/yh8aNpeTx3T\n pb75FNjZ8ShOQq1Nu5YynHxxLKqKHaEf3qbmzs5pcKEBRKJr1XbaHpSTsRpPP26dt8Rx\n JOqQ==", "X-Forwarded-Encrypted": "i=1;\n AFNElJ+V7tgStcESvfcLmoJm9bo5TvqVPuyAbU+ZJChVa4OxkaWTGyYDkfL6iTqpi5FjtKxkSlXT1ulr2bv7@vger.kernel.org", "X-Gm-Message-State": "AOJu0YzPrnSAlxyoJuk6LoIzIqtWZ+OwAYDt6BfcaAePkG6HrEtg4Wjj\n\trUpYl50WaVKKlpSP8Xd9NBNw3M124Ba4TYaZrEPbHOav51hkgcpMlW4O", "X-Gm-Gg": "AeBDieuTg1j2AqRYoAR8DB2HtBKMVcvi/fPpbZYcchV4tdmW1EJUtA3VNQlzNg20dbU\n\tlKZkY5qOt0UFBdFE1ZmxMIxVjkLsgjig2XMiY7rqKjGKW443kGXbsi5WFNeCR1hxkYpW5LJ9vDL\n\tUpYmbdQJQet7CpPliTMoDGAdSW0q64okgYBYSehRCLF0lAjyeCmI9Ns1xqEhW7KkEllRS/2aWaK\n\t5H3lNB1tPRsgbHm20Mgi/6Q3vgQDZhzPToOhLiAsunzK0V9HQATOKXC3rkrHXLgjVKPN9+yVLTP\n\t+lNYzpC85ygTp1VAiAIgiHPTu4zNW/ZlzwPvF6nXeAwFyZHDgDxEmkV3Qo1VM1Gwyt8F24VehgD\n\tBYuIqB4g1J8K7I5eK5Zy0qYwBFNdF/Ru2F8dyd9Qcpc5paviYji2rgdIQww16RsF+2cDo/ta0Kr\n\thXyfDbcxxxgGJq4rIG", "X-Received": "by 2002:a17:903:2292:b0:2b2:4f56:d571 with SMTP id\n d9443c01a7336-2b5eda2f0c6mr4588475ad.4.1776306499043;\n Wed, 15 Apr 2026 19:28:19 -0700 (PDT)", "From": "DaeMyung Kang <charsyam@gmail.com>", "To": "sfrench@samba.org", "Cc": "pc@manguebit.org,\n\tronniesahlberg@gmail.com,\n\tsprasad@microsoft.com,\n\ttom@talpey.com,\n\tbharathsm@microsoft.com,\n\trajasimandal@microsoft.com,\n\tlinux-cifs@vger.kernel.org,\n\tsamba-technical@lists.samba.org,\n\tlinux-kernel@vger.kernel.org,\n\tDaeMyung Kang <charsyam@gmail.com>", "Subject": "[PATCH] smb/client: fix chan_max race and rollback in\n smb3_reconfigure", "Date": "Thu, 16 Apr 2026 11:28:11 +0900", "Message-ID": "<20260416022811.2692096-1-charsyam@gmail.com>", "X-Mailer": "git-send-email 2.43.0", "Precedence": "bulk", "X-Mailing-List": "linux-cifs@vger.kernel.org", "List-Id": "<linux-cifs.vger.kernel.org>", "List-Subscribe": "<mailto:linux-cifs+subscribe@vger.kernel.org>", "List-Unsubscribe": "<mailto:linux-cifs+unsubscribe@vger.kernel.org>", "MIME-Version": "1.0", "Content-Type": "text/plain; charset=UTF-8", "Content-Transfer-Encoding": "8bit" }, "content": "smb3_reconfigure() has two bugs when handling multichannel remount:\n\n1) smb3_sync_ses_chan_max() is called before acquiring\n CIFS_SES_FLAG_SCALE_CHANNELS. If a concurrent operation (e.g.\n smb2_reconnect) holds the flag, the current thread takes the\n loser path and returns -EINVAL, but ses->chan_max has already\n been updated to the new value. This leaves chan_max inconsistent\n with the actual channel state.\n\n2) When smb3_update_ses_channels() fails, chan_max is not rolled\n back to its previous value and the error is not propagated to\n the caller. The mount command returns success even though the\n channel configuration was not applied, and repeated failures\n cause chan_max to drift further from reality.\n\nFix both by moving smb3_sync_ses_chan_max() after the\nCIFS_SES_FLAG_SCALE_CHANNELS acquisition so the loser path cannot\ncorrupt chan_max, and by restoring chan_max from old_chan_max on\nupdate failure while still holding the scaling flag to prevent a\nconcurrent reconfigure from observing the intermediate state.\nPropagate the error to the caller so userspace is informed.\n\nNote: smb3_reconfigure() is not fully transactional — credentials\nare committed before the multichannel block, so any early return\n(including the existing CIFS_SES_FLAG_SCALE_CHANNELS loser path)\ncan leave ses->password updated while cifs_sb->ctx is not yet\nsynced. Making the entire function atomic is a larger refactor\nand is left for a separate patch.\n\nTested with a QEMU VM (ksmbd + cifs) using module-parameter-based\nfault injection:\n - Forced smb3_update_ses_channels() failure via module param and\n verified chan_max is preserved at the old value after remount\n failure (fault-injection test for rollback).\n - Pre-set CIFS_SES_FLAG_SCALE_CHANNELS before entering the\n scaling path and verified the loser path returns -EINVAL\n without corrupting chan_max (loser-path invariant test).\n - Repeated 19 forced-failure remounts with varying max_channels\n (range 2-8) and confirmed no chan_max drift (stress test).\nAll three scenarios pass with the patch and fail without it.\n\nFixes: ef529f655a2c (\"cifs: client: allow changing multichannel mount options on remount\")\nSigned-off-by: DaeMyung Kang <charsyam@gmail.com>\n---\n fs/smb/client/fs_context.c | 19 ++++++++++++++++---\n 1 file changed, 16 insertions(+), 3 deletions(-)", "diff": "diff --git a/fs/smb/client/fs_context.c b/fs/smb/client/fs_context.c\nindex b9544eb0381b..99e62c2dbf50 100644\n--- a/fs/smb/client/fs_context.c\n+++ b/fs/smb/client/fs_context.c\n@@ -1085,6 +1085,7 @@ static int smb3_reconfigure(struct fs_context *fc)\n \tstruct dentry *root = fc->root;\n \tstruct cifs_sb_info *cifs_sb = CIFS_SB(root->d_sb);\n \tstruct cifs_ses *ses = cifs_sb_master_tcon(cifs_sb)->ses;\n+\tunsigned int old_chan_max;\n \tunsigned int rsize = ctx->rsize, wsize = ctx->wsize;\n \tchar *new_password = NULL, *new_password2 = NULL;\n \tbool need_recon = false;\n@@ -1170,9 +1171,6 @@ static int smb3_reconfigure(struct fs_context *fc)\n \tif ((ctx->multichannel != cifs_sb->ctx->multichannel) ||\n \t (ctx->max_channels != cifs_sb->ctx->max_channels)) {\n \n-\t\t/* Synchronize ses->chan_max with the new mount context */\n-\t\tsmb3_sync_ses_chan_max(ses, ctx->max_channels);\n-\t\t/* Now update the session's channels to match the new configuration */\n \t\t/* Prevent concurrent scaling operations */\n \t\tspin_lock(&ses->ses_lock);\n \t\tif (ses->flags & CIFS_SES_FLAG_SCALE_CHANNELS) {\n@@ -1183,16 +1181,31 @@ static int smb3_reconfigure(struct fs_context *fc)\n \t\tses->flags |= CIFS_SES_FLAG_SCALE_CHANNELS;\n \t\tspin_unlock(&ses->ses_lock);\n \n+\t\told_chan_max = ses->chan_max;\n+\t\t/* Synchronize ses->chan_max with the new mount context */\n+\t\tsmb3_sync_ses_chan_max(ses, ctx->max_channels);\n+\n \t\tmutex_unlock(&ses->session_mutex);\n \n \t\trc = smb3_update_ses_channels(ses, ses->server,\n \t\t\t\t\t false /* from_reconnect */,\n \t\t\t\t\t false /* disable_mchan */);\n \n+\t\t/*\n+\t\t * On failure, restore chan_max while still holding\n+\t\t * CIFS_SES_FLAG_SCALE_CHANNELS so a concurrent reconfigure\n+\t\t * cannot observe or race with the rollback.\n+\t\t */\n+\t\tif (rc < 0)\n+\t\t\tsmb3_sync_ses_chan_max(ses, old_chan_max);\n+\n \t\t/* Clear scaling flag after operation */\n \t\tspin_lock(&ses->ses_lock);\n \t\tses->flags &= ~CIFS_SES_FLAG_SCALE_CHANNELS;\n \t\tspin_unlock(&ses->ses_lock);\n+\n+\t\tif (rc < 0)\n+\t\t\treturn rc;\n \t} else {\n \t\tmutex_unlock(&ses->session_mutex);\n \t}\n", "prefixes": [] }