Bug 2499750 - CIFS driver: openat with O_TMPFILE returns -1 ENOENT for existing directories
Summary: CIFS driver: openat with O_TMPFILE returns -1 ENOENT for existing directories
Keywords:
Status: NEW
Alias: None
Product: Fedora
Classification: Fedora
Component: kernel
Version: 44
Hardware: x86_64
OS: Linux
unspecified
high
Target Milestone: ---
Assignee: Justin M. Forbes
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-07-13 18:09 UTC by Mikhail
Modified: 2026-07-17 16:23 UTC (History)
14 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Type: ---
Embargoed:


Attachments (Terms of Use)
Kernel logs (175.56 KB, text/plain)
2026-07-13 18:10 UTC, Mikhail
no flags Details
Krita strace logs (812.99 KB, text/plain)
2026-07-13 18:15 UTC, Mikhail
no flags Details
SMB server options (198.55 KB, image/png)
2026-07-15 09:36 UTC, Mikhail
no flags Details

Description Mikhail 2026-07-13 18:09:37 UTC
1. Please describe the problem:
Since the implementation of O_TMPFILE support in the cifs driver, openat() system calls using the O_TMPFILE flag are failing on valid, reachable SMB/CIFS mounts. The driver returns -1 ENOENT (No such file or directory), even though the parent directory is accessible via standard open() calls. Applications attempting to use O_TMPFILE for atomic/safe file creation (e.g., Krita) fail to save files to the network share, reporting that the file could not be opened or the directory does not exist.


2. What is the Version-Release number of the kernel:
Operating System: Fedora Linux 44
KDE Plasma Version: 6.7.2
KDE Frameworks Version: 6.28.0
Qt Version: 6.11.1
Kernel Version: 7.1.3-200.fc44.x86_64 (64-bit)
Graphics Platform: Wayland


3. Did it work previously in Fedora? If so, what kernel version did the issue
   *first* appear?  Old kernels are available for download at
   https://koji.fedoraproject.org/koji/packageinfo?packageID=8 :
Yes, kernels before 7.1


4. Can you reproduce this issue? If so, please provide the steps to reproduce
   the issue below:
1. Mount a CIFS/SMB share (e.g., /mnt/vault/).
2. Use strace to monitor an openat call using the O_TMPFILE flag on a subdirectory of that mount.

Example: 
openat(AT_FDCWD, "/mnt/vault/home/Drive/Sketchbook/Studies/6.07.26.kra", O_RDONLY|O_CLOEXEC) = 37
openat(AT_FDCWD, "/mnt/vault/home/Drive/Sketchbook/Studies", O_RDWR|O_CLOEXEC|O_TMPFILE, 0600) = -1 ENOENT (No such file or directory)


5. Does this problem occur with the latest Rawhide kernel? To install the
   Rawhide kernel, run ``sudo dnf install fedora-repos-rawhide`` followed by
   ``sudo dnf update --enablerepo=rawhide kernel``:
Yes, kernel 7.2.0-rc2



6. Are you running any modules that not shipped with directly Fedora's kernel?:
No


7. Please attach the kernel logs. You can get the complete kernel log
   for a boot with ``journalctl --no-hostname -k > dmesg.txt``. If the
   issue occurred on a previous boot, use the journalctl ``-b`` flag.

Reproducible: Always

Comment 1 Mikhail 2026-07-13 18:10:53 UTC
Created attachment 2148518 [details]
Kernel logs

Comment 2 Mikhail 2026-07-13 18:15:23 UTC
Created attachment 2148519 [details]
Krita strace logs

Lines 6307-6449 show that the directory exists, however line 7153 shows an openat() fail on that directory with an ENOENT

Comment 3 Mikhail 2026-07-15 09:34:41 UTC
Additional details on the mount

$ cat /etc/fstab | grep cifs
//vault/home                                /mnt/vault/home   cifs    credentials=/home/mstefan99/.vaultcredentials,uid=mstefan99,gid=mstefan99,noatime,_netdev,nofail,iocharset=utf8   0 0 

$ mount | grep cifs
//vault/home on /mnt/vault/home type cifs (rw,relatime,vers=3.1.1,cache=strict,upcall_target=app,username=MStefan99,uid=1000,forceuid,gid=1000,forcegid,addr=192.168.1.10,file_mode=0755,dir_mode=0755,iocharset=utf8,soft,nounix,serverino,mapposix,reparse=nfs,nativesocket,symlink=native,rsize=4194304,wsize=4194304,bsize=1048576,echo_interval=60,actimeo=1,closetimeo=1,_netdev)

Server info:
Model: Synology DS218
DSM version: DSM 7.3.2-86009 Update 4

Comment 4 Mikhail 2026-07-15 09:36:41 UTC
Created attachment 2148680 [details]
SMB server options

Comment 5 Mikhail 2026-07-17 15:54:05 UTC
Additional logs with verbose cifs logging enabled:

[  106.251673] CIFS: fs/smb/client/dir.c: VFS: in cifs_tmpfile as Xid: 2886 with uid: 1000
[  106.252152] CIFS: Status code returned 0xc0000034 STATUS_OBJECT_NAME_NOT_FOUND
[  106.252154] CIFS: fs/smb/client/smb2maperror.c: Mapping SMB2 status code 0xc0000034 to POSIX err -2
[  106.252157] CIFS: fs/smb/client/dir.c: cifs_create returned 0xfffffffe
[  106.252159] CIFS: fs/smb/client/dir.c: VFS: leaving cifs_tmpfile (xid = 2886) rc = -2

Comment 6 Mikhail 2026-07-17 16:23:52 UTC
Observed with the following SMB servers:

$ smbd --version
Version 4.15.13
Synology Build 86304, Mar  4 2026 12:31:12


Windows 11 Pro
Version 25H2
OS Build 26200.8655


Note You need to log in before you can comment on or make changes to this bug.