For reentrant VFS calls where the incoming pathname refers to a file in a snapshot, the function convert_sbuf() which implements the logic behind shadow:fixinodes isn't called.
This bug was referenced in samba master:
Created attachment 16702 [details]
Patch for 4.14 cherry-picked from master with additional patch
Backport from master. Needed an additional patch, cf 7/8.
Please remember to add your signed-off to 7/8 if you're happy with the patch. Thanks!
Fwiw, not backporting this to 4.13 as the tests won't work there due to the lack of the dev/ino path/handle check in openat_pathref_fsp().
I think the fix itself is correct even for 4.13, but without the test to prove this I'd much rather keep 4.13 unchanged/broken and 4.14 and 4.15 fixed.