The df Command Reports Negative Use Of CIFS Mounted Share.

Solution Verified - Updated -


  • Windows 2016
  • Red Hat Enterprise Linux 7.3
  • SMB Protocol 3.0


After mounting some Windows 2016 shares (which have hard limit quotas enabled) using SMB protocol version 3.0, the "df -k" command reports a negative usage:

Filesystem             1K-blocks       Used  Available Use% Mounted on
//   262144000 -261057400  262143996    - /mnt/smb//
//   262144000 -261057400  262143996    - /mnt/smb/


Upgrade to the kernel version 3.10.0-862.el7 or newer.

Root Cause

When a share has quotas applied, the value set to mb.caller_free_alloc_units (which is the total number of free allocation units on the volume that are available to the user associated with the calling thread - See Microsoft documentation) is from the quota set. Because how CIFS was filling the values to then be passed to the userspace utilities through statfs() the value Used from df could be negative.

Diagnostic Steps

  • Take a strace of the command returning wrong values (as per document 17835)

  • Take a tcpdump while running df

  • From the tpcdump check the values returned by the CIFS server:

$ tshark -tad -n -r tcpdump.cap -Y smb2.fs_info.infolevel==7 -T fields -e frame.number -e smb.alloc_size64 -e smb.caller_free_alloc_units -e smb.actual_free_alloc_units -e smb.fs_sector_per_unit -e smb.fs_bytes_per_sector

This solution is part of Red Hat’s fast-track publication program, providing a huge library of solutions that Red Hat engineers have created while supporting our customers. To give you the knowledge you need the instant it becomes available, these articles may be presented in a raw and unedited form.