Description of problem:

A list corruption of cifsInodeInfo->openFileList can occur due to a race condition between multiple processes opening/closing the same file.  The list corruption then results in a crash while walking the list in is_inode_writeable()


[ 1623.170714] general protection fault: 0000 [#1] SMP PTI
[ 1623.170749] CPU: 2 PID: 13949 Comm: R Kdump: loaded Not tainted 4.18.0-80.1.2.el8_0.x86_64 #1
[ 1623.170778] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 04/05/2016
[ 1623.170841] RIP: 0010:is_size_safe_to_change+0x57/0xb0 [cifs]
...
[ 1623.171273]  cifs_fattr_to_inode+0x146/0x580 [cifs]
[ 1623.171302]  cifs_get_file_info+0xed/0x360 [cifs]
[ 1623.171329]  cifs_llseek+0x4a/0xc0 [cifs]
[ 1623.171349]  ksys_lseek+0x62/0xb0
[ 1623.171366]  do_syscall_64+0x5b/0x1b0
[ 1623.171382]  entry_SYSCALL_64_after_hwframe+0x65/0xca



Version-Release number of selected component (if applicable):

4.18.0-80.1.2.el8_0.x86_64
(also seen previously in RHEL 7)


How reproducible:

simple; see reproducer below


Steps to Reproduce:


test program /tmp/openloop.py
#!/usr/bin/env python
from __future__ import print_function
i=0
while True:
    with open('testfile', 'r') as myfile:
        content = myfile.read()
        print("test {}\r".format(i), end="")
        i = i + 1



# mount.cifs //vm1/share /mnt/vm1 --verbose -o vers=2.1,sec=krb5,multiuser
# cd /mnt/vm1
# echo testing > testfile

start 3 copies of the test program, each with different krb5 creds:

# su - user1
$ kinit -kt krb5-smbuser1.keytab -c /tmp/krb5cc_$UID smbuser1
$ cd /mnt/vm1
$ /tmp/openloop.py

# su - user2
$ kinit -kt krb5-smbuser2.keytab -c /tmp/krb5cc_$UID smbuser2
$ cd /mnt/vm1
$ /tmp/openloop.py

# su - user3
$ kinit -kt krb5-smbuser3.keytab -c /tmp/krb5cc_$UID smbuser3
$ cd /mnt/vm1
$ /tmp/openloop.py


The crash will usually occur within several minutes


Actual results:

kernel crash


Expected results:

no crash


Additional info:

also see RHEL 7 BZ 1580165 for this issue