This is a note to let you know that I've just added the patch titled SMB3: force unmount was failing to close deferred close files to the 6.2-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: smb3-force-unmount-was-failing-to-close-deferred-close-files.patch and it can be found in the queue-6.2 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable@xxxxxxxxxxxxxxx> know about it. >From 2cb6f968775a9fd60c90a6042b9550bcec3ea087 Mon Sep 17 00:00:00 2001 From: Steve French <stfrench@xxxxxxxxxxxxx> Date: Tue, 9 May 2023 01:00:42 -0500 Subject: SMB3: force unmount was failing to close deferred close files From: Steve French <stfrench@xxxxxxxxxxxxx> commit 2cb6f968775a9fd60c90a6042b9550bcec3ea087 upstream. In investigating a failure with xfstest generic/392 it was noticed that mounts were reusing a superblock that should already have been freed. This turned out to be related to deferred close files keeping a reference count until the closetimeo expired. Currently the only way an fs knows that mount is beginning is when force unmount is called, but when this, ie umount_begin(), is called all deferred close files on the share (tree connection) should be closed immediately (unless shared by another mount) to avoid using excess resources on the server and to avoid reusing a superblock which should already be freed. In umount_begin, close all deferred close handles for that share if this is the last mount using that share on this client (ie send the SMB3 close request over the wire for those that have been already closed by the app but that we have kept a handle lease open for and have not sent closes to the server for yet). Reported-by: David Howells <dhowells@xxxxxxxxxx> Acked-by: Bharath SM <bharathsm@xxxxxxxxxxxxx> Cc: <stable@xxxxxxxxxxxxxxx> Fixes: 78c09634f7dc ("Cifs: Fix kernel oops caused by deferred close for files.") Signed-off-by: Steve French <stfrench@xxxxxxxxxxxxx> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- fs/cifs/cifsfs.c | 1 + 1 file changed, 1 insertion(+) --- a/fs/cifs/cifsfs.c +++ b/fs/cifs/cifsfs.c @@ -743,6 +743,7 @@ static void cifs_umount_begin(struct sup spin_unlock(&tcon->tc_lock); spin_unlock(&cifs_tcp_ses_lock); + cifs_close_all_deferred_files(tcon); /* cancel_brl_requests(tcon); */ /* BB mark all brl mids as exiting */ /* cancel_notify_requests(tcon); */ if (tcon->ses && tcon->ses->server) { Patches currently in stable-queue which might be from stfrench@xxxxxxxxxxxxx are queue-6.2/cifs-fix-pcchunk-length-type-in-smb2_copychunk_range.patch queue-6.2/ksmbd-fix-racy-issue-from-smb2-close-and-logoff-with.patch queue-6.2/ksmbd-implements-sess-ksmbd_chann_list-as-xarray.patch queue-6.2/smb3-fix-problem-remounting-a-share-after-shutdown.patch queue-6.2/ksmbd-fix-racy-issue-from-session-setup-and-logoff.patch queue-6.2/cifs-release-leases-for-deferred-close-handles-when-freezing.patch queue-6.2/smb3-force-unmount-was-failing-to-close-deferred-close-files.patch queue-6.2/cifs-check-only-tcon-status-on-tcon-related-function.patch queue-6.2/ksmbd-destroy-expired-sessions.patch queue-6.2/cifs-avoid-potential-races-when-handling-multiple-df.patch queue-6.2/ksmbd-block-asynchronous-requests-when-making-a-dela.patch