github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-06-05 21:15:53 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

smb: server: let send_done handle a completion without IB_SEND_SIGNALED

Browse Source 
With smbdirect_send_batch processing we likely have requests without
IB_SEND_SIGNALED, which will be destroyed in the final request
that has IB_SEND_SIGNALED set.

If the connection is broken all requests are signaled
even without explicit IB_SEND_SIGNALED.

Cc: <stable@vger.kernel.org> # 6.18.x
Cc: Namjae Jeon <linkinjeon@kernel.org>
Cc: Steve French <smfrench@gmail.com>
Cc: Tom Talpey <tom@talpey.com>
Cc: linux-cifs@vger.kernel.org
Cc: samba-technical@lists.samba.org
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Acked-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
This commit is contained in:
Stefan Metzmacher 2026-01-22 18:16:47 +01:00 committed by Steve French
parent 8cf2bbac62
commit 9da82dc73c
1 changed files with 26 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

26
fs/smb/server/transport_rdma.c
View File

@ -1059,6 +1059,31 @@ static void send_done(struct ib_cq *cq, struct ib_wc *wc)
ib_wc_status_msg(wc->status), wc->status,
wc->opcode);
if (unlikely(!(sendmsg->wr.send_flags & IB_SEND_SIGNALED))) {
/*
* This happens when smbdirect_send_io is a sibling
* before the final message, it is signaled on
* error anyway, so we need to skip
* smbdirect_connection_free_send_io here,
* otherwise is will destroy the memory
* of the siblings too, which will cause
* use after free problems for the others
* triggered from ib_drain_qp().
*/
if (wc->status != IB_WC_SUCCESS)
goto skip_free;
/*
* This should not happen!
* But we better just close the
* connection...
*/
pr_err("unexpected send completion wc->status=%s (%d) wc->opcode=%d\n",
ib_wc_status_msg(wc->status), wc->status, wc->opcode);
smb_direct_disconnect_rdma_connection(sc);
return;
}
/*
* Free possible siblings and then the main send_io
*/
@ -1072,6 +1097,7 @@ static void send_done(struct ib_cq *cq, struct ib_wc *wc)
lcredits += 1;
if (wc->status != IB_WC_SUCCESS || wc->opcode != IB_WC_SEND) {
skip_free:
pr_err("Send error. status='%s (%d)', opcode=%d\n",
ib_wc_status_msg(wc->status), wc->status,
wc->opcode);