cifs: remove all cifs files before kill super

cifs: remove all cifs files before kill super

[zhangjian (CG)]

Cifs files may be put into fileinfo_put_wq during umounting cifs.
After umount done, cifsFileInfo_put_final is called, which cause
following BUG:

BUG: kernel NULL pointer dereference, address: 0000000000000000
...
[  134.222152]  list_lru_add+0x64/0x1a0
[  134.222399]  ? cifs_put_tcon+0x171/0x340 [cifs]
[  134.222772]  d_lru_add+0x44/0x60
[  134.222997]  dput+0x1fc/0x210
[  134.223213]  cifsFileInfo_put_final+0x11a/0x140 [cifs]
[  134.223576]  process_one_work+0x17c/0x320
[  134.223843]  worker_thread+0x188/0x280
[  134.224084]  ? __pfx_worker_thread+0x10/0x10
[  134.224366]  kthread+0xcc/0x100
[  134.224576]  ? __pfx_kthread+0x10/0x10
[  134.224827]  ret_from_fork+0x30/0x50
[  134.225063]  ? __pfx_kthread+0x10/0x10
[  134.225328]  ret_from_fork_asm+0x1b/0x30

This can be reproduce by following:
unshare -n bash -c "
mkdir -p ${CIFS_MNT}
ip netns attach root 1
ip link add eth0 type veth peer veth0 netns root
ip link set eth0 up
ip -n root link set veth0 up
ip addr add 192.168.0.2/24 dev eth0
ip -n root addr add 192.168.0.1/24 dev veth0
ip route add default via 192.168.0.1 dev eth0
ip netns exec root sysctl net.ipv4.ip_forward=1
ip netns exec root iptables -t nat -A POSTROUTING -s 192.168.0.2 -o
${DEV} -j MASQUERADE
mount -t cifs ${CIFS_PATH} ${CIFS_MNT} -o
vers=3.0,sec=ntlmssp,credentials=${CIFS_CRED},rsize=65536,wsize=65536,cache=none,echo_interval=1
touch ${CIFS_MNT}/a.txt
ip netns exec root iptables -t nat -D POSTROUTING -s 192.168.0.2 -o
${DEV} -j MASQUERADE
"
umount ${CIFS_MNT}

Fixes: 340cea84f69 ("cifs: open files should not hold ref on superblock")

Signed-off-by: Jian Zhang <zhangjian496@huawei.com>
---
 fs/smb/client/connect.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/fs/smb/client/connect.c b/fs/smb/client/connect.c
index dcde25d..7d09f07 100644
--- a/fs/smb/client/connect.c
+++ b/fs/smb/client/connect.c
@@ -3996,6 +3996,9 @@ cifs_umount(struct cifs_sb_info *cifs_sb)
 	}
 	spin_unlock(&cifs_sb->tlink_tree_lock);

+    flush_workqueue(serverclose_wq);
+    flush_workqueue(fileinfo_put_wq);
+
 	kfree(cifs_sb->prepath);
 	call_rcu(&cifs_sb->rcu, delayed_free);
 }
-- 
2.23.0

Re: cifs: remove all cifs files before kill super

[kernel test robot]

Hi zhangjian,

kernel test robot noticed the following build warnings:

[auto build test WARNING on cifs/for-next]
[also build test WARNING on linus/master v7.1-rc5 next-20260525]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]

url:    https://github.com/intel-lab-lkp/linux/commits/zhangjian-CG/cifs-remove-all-cifs-files-before-kill-super/20260519-185913
base:   git://git.samba.org/sfrench/cifs-2.6.git for-next
patch link:    https://lore.kernel.org/r/616cbc26-d8a9-418a-91f3-11e470087aa4%40huawei.com
patch subject: cifs: remove all cifs files before kill super
config: x86_64-randconfig-161 (https://download.01.org/0day-ci/archive/20260526/202605260611.gcFkHRJk-lkp@intel.com/config)
compiler: gcc-14 (Debian 14.2.0-19) 14.2.0
smatch: v0.5.0-9185-gbcc58b9c

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202605260611.gcFkHRJk-lkp@intel.com/

New smatch warnings:
fs/smb/client/connect.c:3999 cifs_umount() warn: inconsistent indenting

Old smatch warnings:
fs/smb/client/connect.c:3369 generic_ip_connect() error: we previously assumed 'server->ssocket' could be null (see line 3356)

vim +3999 fs/smb/client/connect.c

  3966	
  3967	void
  3968	cifs_umount(struct cifs_sb_info *cifs_sb)
  3969	{
  3970		struct rb_root *root = &cifs_sb->tlink_tree;
  3971		struct rb_node *node;
  3972		struct tcon_link *tlink;
  3973		struct cifs_tcon *tcon = NULL;
  3974	
  3975		cancel_delayed_work_sync(&cifs_sb->prune_tlinks);
  3976	
  3977		if (cifs_sb->master_tlink) {
  3978			tcon = cifs_sb->master_tlink->tl_tcon;
  3979			if (tcon) {
  3980				spin_lock(&tcon->sb_list_lock);
  3981				list_del_init(&cifs_sb->tcon_sb_link);
  3982				spin_unlock(&tcon->sb_list_lock);
  3983			}
  3984		}
  3985	
  3986		spin_lock(&cifs_sb->tlink_tree_lock);
  3987		while ((node = rb_first(root))) {
  3988			tlink = rb_entry(node, struct tcon_link, tl_rbnode);
  3989			cifs_get_tlink(tlink);
  3990			clear_bit(TCON_LINK_IN_TREE, &tlink->tl_flags);
  3991			rb_erase(node, root);
  3992	
  3993			spin_unlock(&cifs_sb->tlink_tree_lock);
  3994			cifs_put_tlink(tlink);
  3995			spin_lock(&cifs_sb->tlink_tree_lock);
  3996		}
  3997		spin_unlock(&cifs_sb->tlink_tree_lock);
  3998	
> 3999	    flush_workqueue(serverclose_wq);
  4000	    flush_workqueue(fileinfo_put_wq);
  4001	
  4002		kfree(cifs_sb->prepath);
  4003		call_rcu(&cifs_sb->rcu, delayed_free);
  4004	}
  4005	

--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki