6.16-stable patches

added patches:
	smb-client-don-t-wait-for-info-send_pending-0-on-error.patch
	smb-client-let-send_done-cleanup-before-calling-smbd_disconnect_rdma_connection.patch

diff --git a/queue-6.16/series b/queue-6.16/series
index 8a30aa84eb516d8fced4ca92cf6e9fd730f113ab..ade774e76d82b45fff1b243062030f7c969636db 100644 (file)
--- a/queue-6.16/series
+++ b/queue-6.16/series
@@ -54,3 +54,5 @@ acpi-processor-perflib-move-problematic-pr-performance-check.patch
 block-make-req_op_zone_finish-a-write-operation.patch
 mm-memory-tier-fix-abstract-distance-calculation-overflow.patch
 mfd-cros_ec-separate-charge-control-probing-from-usb-pd.patch
+smb-client-let-send_done-cleanup-before-calling-smbd_disconnect_rdma_connection.patch
+smb-client-don-t-wait-for-info-send_pending-0-on-error.patch

diff --git a/queue-6.16/smb-client-don-t-wait-for-info-send_pending-0-on-error.patch b/queue-6.16/smb-client-don-t-wait-for-info-send_pending-0-on-error.patch
new file mode 100644 (file)
index 0000000..eca3a71
--- /dev/null
+++ b/queue-6.16/smb-client-don-t-wait-for-info-send_pending-0-on-error.patch
@@ -0,0 +1,54 @@
+From 8c48e1c7520321cc87ff651e96093e2f412785fb Mon Sep 17 00:00:00 2001
+From: Stefan Metzmacher <metze@samba.org>
+Date: Tue, 12 Aug 2025 18:45:06 +0200
+Subject: smb: client: don't wait for info->send_pending == 0 on error
+
+From: Stefan Metzmacher <metze@samba.org>
+
+commit 8c48e1c7520321cc87ff651e96093e2f412785fb upstream.
+
+We already called ib_drain_qp() before and that makes sure
+send_done() was called with IB_WC_WR_FLUSH_ERR, but
+didn't called atomic_dec_and_test(&sc->send_io.pending.count)
+
+So we may never reach the info->send_pending == 0 condition.
+
+Cc: Steve French <smfrench@gmail.com>
+Cc: Tom Talpey <tom@talpey.com>
+Cc: Long Li <longli@microsoft.com>
+Cc: linux-cifs@vger.kernel.org
+Cc: samba-technical@lists.samba.org
+Fixes: 5349ae5e05fa ("smb: client: let send_done() cleanup before calling smbd_disconnect_rdma_connection()")
+Signed-off-by: Stefan Metzmacher <metze@samba.org>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/smb/client/smbdirect.c |   10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+--- a/fs/smb/client/smbdirect.c
++++ b/fs/smb/client/smbdirect.c
+@@ -1316,10 +1316,6 @@ void smbd_destroy(struct TCP_Server_Info
+       log_rdma_event(INFO, "cancelling idle timer\n");
+       cancel_delayed_work_sync(&info->idle_timer_work);
+ 
+-      log_rdma_event(INFO, "wait for all send posted to IB to finish\n");
+-      wait_event(info->wait_send_pending,
+-              atomic_read(&info->send_pending) == 0);
+-
+       /* It's not possible for upper layer to get to reassembly */
+       log_rdma_event(INFO, "drain the reassembly queue\n");
+       do {
+@@ -1965,7 +1961,11 @@ int smbd_send(struct TCP_Server_Info *se
+        */
+ 
+       wait_event(info->wait_send_pending,
+-              atomic_read(&info->send_pending) == 0);
++              atomic_read(&info->send_pending) == 0 ||
++              sc->status != SMBDIRECT_SOCKET_CONNECTED);
++
++      if (sc->status != SMBDIRECT_SOCKET_CONNECTED && rc == 0)
++              rc = -EAGAIN;
+ 
+       return rc;
+ }

diff --git a/queue-6.16/smb-client-let-send_done-cleanup-before-calling-smbd_disconnect_rdma_connection.patch b/queue-6.16/smb-client-let-send_done-cleanup-before-calling-smbd_disconnect_rdma_connection.patch
new file mode 100644 (file)
index 0000000..99ff8f9
--- /dev/null
+++ b/queue-6.16/smb-client-let-send_done-cleanup-before-calling-smbd_disconnect_rdma_connection.patch
@@ -0,0 +1,57 @@
+From 5349ae5e05fa37409fd48a1eb483b199c32c889b Mon Sep 17 00:00:00 2001
+From: Stefan Metzmacher <metze@samba.org>
+Date: Mon, 4 Aug 2025 14:10:12 +0200
+Subject: smb: client: let send_done() cleanup before calling smbd_disconnect_rdma_connection()
+
+From: Stefan Metzmacher <metze@samba.org>
+
+commit 5349ae5e05fa37409fd48a1eb483b199c32c889b upstream.
+
+We should call ib_dma_unmap_single() and mempool_free() before calling
+smbd_disconnect_rdma_connection().
+
+And smbd_disconnect_rdma_connection() needs to be the last function to
+call as all other state might already be gone after it returns.
+
+Cc: Steve French <smfrench@gmail.com>
+Cc: Tom Talpey <tom@talpey.com>
+Cc: Long Li <longli@microsoft.com>
+Cc: linux-cifs@vger.kernel.org
+Cc: samba-technical@lists.samba.org
+Fixes: f198186aa9bb ("CIFS: SMBD: Establish SMB Direct connection")
+Signed-off-by: Stefan Metzmacher <metze@samba.org>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/smb/client/smbdirect.c |   14 ++++++++------
+ 1 file changed, 8 insertions(+), 6 deletions(-)
+
+--- a/fs/smb/client/smbdirect.c
++++ b/fs/smb/client/smbdirect.c
+@@ -277,18 +277,20 @@ static void send_done(struct ib_cq *cq,
+       log_rdma_send(INFO, "smbd_request 0x%p completed wc->status=%d\n",
+               request, wc->status);
+ 
+-      if (wc->status != IB_WC_SUCCESS || wc->opcode != IB_WC_SEND) {
+-              log_rdma_send(ERR, "wc->status=%d wc->opcode=%d\n",
+-                      wc->status, wc->opcode);
+-              smbd_disconnect_rdma_connection(request->info);
+-      }
+-
+       for (i = 0; i < request->num_sge; i++)
+               ib_dma_unmap_single(sc->ib.dev,
+                       request->sge[i].addr,
+                       request->sge[i].length,
+                       DMA_TO_DEVICE);
+ 
++      if (wc->status != IB_WC_SUCCESS || wc->opcode != IB_WC_SEND) {
++              log_rdma_send(ERR, "wc->status=%d wc->opcode=%d\n",
++                      wc->status, wc->opcode);
++              mempool_free(request, info->request_mempool);
++              smbd_disconnect_rdma_connection(info);
++              return;
++      }
++
+       if (atomic_dec_and_test(&request->info->send_pending))
+               wake_up(&request->info->wait_send_pending);
+