smb: client: fix file open check in __cifs_unlink()

JIRA: https://issues.redhat.com/browse/RHEL-108683

commit 251090e
Author: Paulo Alcantara <pc@manguebit.org>
Date:   Thu Sep 18 12:30:32 2025 -0300

    smb: client: fix file open check in __cifs_unlink()
    
    Fix the file open check to decide whether or not silly-rename the file
    in SMB2+.
    
    Fixes: c5ea306 ("smb: client: fix data loss due to broken rename(2)")
    Signed-off-by: Paulo Alcantara (Red Hat) <pc@manguebit.org>
    Cc: Frank Sorenson <sorenson@redhat.com>
    Reviewed-by: David Howells <dhowells@redhat.com>
    Cc: linux-cifs@vger.kernel.org
    Signed-off-by: Steve French <stfrench@microsoft.com>

Signed-off-by: Paulo Alcantara <paalcant@redhat.com>

Author: pcacjr

fs/smb/client/inode.c

@@ -2003,8 +2003,21 @@ static int __cifs_unlink(struct inode *dir, struct dentry *dentry, bool sillyren
 		goto psx_del_no_retry;
 	}
 
-	if (sillyrename || (server->vals->protocol_id > SMB10_PROT_ID &&
-			    d_is_positive(dentry) && d_count(dentry) > 2))
+	/* For SMB2+, if the file is open, we always perform a silly rename.
+	 *
+	 * We check for d_count() right after calling
+	 * cifs_close_deferred_file_under_dentry() to make sure that the
+	 * dentry's refcount gets dropped in case the file had any deferred
+	 * close.
+	 */
+	if (!sillyrename && server->vals->protocol_id > SMB10_PROT_ID) {
+		spin_lock(&dentry->d_lock);
+		if (d_count(dentry) > 1)
+			sillyrename = true;
+		spin_unlock(&dentry->d_lock);
+	}
+
+	if (sillyrename)
 		rc = -EBUSY;
 	else
 		rc = server->ops->unlink(xid, tcon, full_path, cifs_sb, dentry);