samba - Aug 2025 - Sequence of actions resulting in data loss

On Fri, 1 Aug 2025 14:19:36 +0200
Ralph Boehme via samba <samba at lists.samba.org> wrote:
> On 8/1/25 1:20 PM, Jean-Baptiste Denis via samba wrote:
> > Sorry about that and thank you for warning me.
> > 
> > pcap:
> > https://dl.pasteur.fr/fop/vkuc87yJ/file_delete_reproducer.pcap.zst
> > reproducer: https://dl.pasteur.fr/fop/doQKcwvv/reproducer3.sh
> 
> looks like the client is doing it:
> 
> after the server rightly refuses the rename in packets 102-109 (the 
> client tries multiple times), in packet 110 the client it sets 
> delete-on-close on the the X.sh and a bit later after the last open 
> handle to X.sh is closed, the server rightly deletes the file.
> 
> The deletion might be done by the `mv` command or it might be some
> code in the cifs kernel client triggered by the rename failure.
> 
> I guess the next step would be to write a minimal C POSIX programm
> that replicates this to have full control over the application. If
> that still fails it must be something in the cifs client in the
> kernel.
> 
> -slow
> 
I don't know if this helps, but the 'mv' command works if you move
the
file to a non-existent file e.g. mv x XX.sh

Rowland

On 8/1/25 2:19 PM, Ralph Boehme wrote:

 > looks like the client is doing it:
 >
 > after the server rightly refuses the rename in packets 102-109 (the client
tries multiple times), in packet 110 the
 > client it sets delete-on-close on the the X.sh and a bit later after the
last open handle to X.sh is closed,
 > the server rightly deletes the file.

OK.

 > The deletion might be done by the `mv` command or it might be some code in
the cifs kernel client triggered by the
 > rename failure.
 >
 > I guess the next step would be to write a minimal C POSIX programm that
replicates this to have full control over the
 > application. If that still fails it must be something in the cifs client
in the kernel.

Here is a proposition:

https://dl.pasteur.fr/fop/54w5g1Ex/reproducer.tgz

On a local filesystem:
$ make
gcc -Wall -Wextra -pedantic -std=c11 -o myscript myscript.c
gcc -Wall -Wextra -pedantic -std=c11 -o reproducer reproducer.c

$ make test
echo 'new script version' > myscript.replacement
./reproducer
sleep for 5 seconds...
myscript contains 19 characters.
rm -f myscript.replacement
$

On a cifs mount:
$ make
gcc -Wall -Wextra -pedantic -std=c11 -o myscript myscript.c
gcc -Wall -Wextra -pedantic -std=c11 -o reproducer reproducer.c

$ make test
echo 'new script version' > myscript.replacement
./reproducer
sleep for 5 seconds...
(main) failed to rename myscript.replacement to myscript: No such file or
directory
(readf) failed to open file './myscript': No such file or directory
make: *** [Makefile:13: test] Error 1
$

Thank you for your help.

Jean-Baptiste

On 8/1/25 2:40 PM, Rowland Penny via samba wrote:
> I don't know if this helps, but the 'mv' command works if you
move the
> file to a non-existent file e.g. mv x XX.sh
I'm not concerned by the failure of the mv command (which is OK with the
Windows specs, see the first answer of Ralph).
What I'd like to understand is why the X.sh is deleted in this succession of
operations.