5.15-stable patches

added patches:
	smb-client-don-t-wait-for-info-send_pending-0-on-error.patch

diff --git a/queue-5.15/series b/queue-5.15/series
index 059ff2464709d77eef8be9ab665cb7014fffdb11..39f94d28a16af03e14181f74aef0373c6dcda456 100644 (file)
--- a/queue-5.15/series
+++ b/queue-5.15/series
@@ -271,3 +271,4 @@ eventpoll-fix-semi-unbounded-recursion.patch
 documentation-acpi-fix-parent-device-references.patch
 acpi-processor-perflib-fix-initial-_ppc-limit-application.patch
 acpi-processor-perflib-move-problematic-pr-performance-check.patch
+smb-client-don-t-wait-for-info-send_pending-0-on-error.patch

diff --git a/queue-5.15/smb-client-don-t-wait-for-info-send_pending-0-on-error.patch b/queue-5.15/smb-client-don-t-wait-for-info-send_pending-0-on-error.patch
new file mode 100644 (file)
index 0000000..d902298
--- /dev/null
+++ b/queue-5.15/smb-client-don-t-wait-for-info-send_pending-0-on-error.patch
@@ -0,0 +1,59 @@
+From 8c48e1c7520321cc87ff651e96093e2f412785fb Mon Sep 17 00:00:00 2001
+From: Stefan Metzmacher <metze@samba.org>
+Date: Tue, 12 Aug 2025 18:45:06 +0200
+Subject: smb: client: don't wait for info->send_pending == 0 on error
+
+From: Stefan Metzmacher <metze@samba.org>
+
+commit 8c48e1c7520321cc87ff651e96093e2f412785fb upstream.
+
+We already called ib_drain_qp() before and that makes sure
+send_done() was called with IB_WC_WR_FLUSH_ERR, but
+didn't called atomic_dec_and_test(&sc->send_io.pending.count)
+
+So we may never reach the info->send_pending == 0 condition.
+
+Cc: Steve French <smfrench@gmail.com>
+Cc: Tom Talpey <tom@talpey.com>
+Cc: Long Li <longli@microsoft.com>
+Cc: linux-cifs@vger.kernel.org
+Cc: samba-technical@lists.samba.org
+Fixes: 5349ae5e05fa ("smb: client: let send_done() cleanup before calling smbd_disconnect_rdma_connection()")
+Signed-off-by: Stefan Metzmacher <metze@samba.org>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/smb/client/smbdirect.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/fs/smb/client/smbdirect.c b/fs/smb/client/smbdirect.c
+index c628e91c328b..02d6db431fd4 100644
+--- a/fs/smb/client/smbdirect.c
++++ b/fs/smb/client/smbdirect.c
+@@ -1337,10 +1337,6 @@ void smbd_destroy(struct TCP_Server_Info *server)
+       log_rdma_event(INFO, "cancelling idle timer\n");
+       cancel_delayed_work_sync(&info->idle_timer_work);
+ 
+-      log_rdma_event(INFO, "wait for all send posted to IB to finish\n");
+-      wait_event(info->wait_send_pending,
+-              atomic_read(&info->send_pending) == 0);
+-
+       /* It's not possible for upper layer to get to reassembly */
+       log_rdma_event(INFO, "drain the reassembly queue\n");
+       do {
+@@ -1986,7 +1982,11 @@ int smbd_send(struct TCP_Server_Info *server,
+        */
+ 
+       wait_event(info->wait_send_pending,
+-              atomic_read(&info->send_pending) == 0);
++              atomic_read(&info->send_pending) == 0 ||
++              sc->status != SMBDIRECT_SOCKET_CONNECTED);
++
++      if (sc->status != SMBDIRECT_SOCKET_CONNECTED && rc == 0)
++              rc = -EAGAIN;
+ 
+       return rc;
+ }
+-- 
+2.50.1
+