From f347aff6159fa9e29558e9d6e8a72aa7771ef21f Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Sun, 17 Aug 2025 12:00:04 +0200 Subject: [PATCH] 6.12-stable patches added patches: smb-client-don-t-wait-for-info-send_pending-0-on-error.patch smb-client-let-send_done-cleanup-before-calling-smbd_disconnect_rdma_connection.patch --- queue-6.12/series | 2 + ...ait-for-info-send_pending-0-on-error.patch | 54 ++++++++++++++++++ ...ling-smbd_disconnect_rdma_connection.patch | 57 +++++++++++++++++++ 3 files changed, 113 insertions(+) create mode 100644 queue-6.12/smb-client-don-t-wait-for-info-send_pending-0-on-error.patch create mode 100644 queue-6.12/smb-client-let-send_done-cleanup-before-calling-smbd_disconnect_rdma_connection.patch diff --git a/queue-6.12/series b/queue-6.12/series index 61295a552b..9631a44aa1 100644 --- a/queue-6.12/series +++ b/queue-6.12/series @@ -40,3 +40,5 @@ acpi-processor-perflib-fix-initial-_ppc-limit-application.patch acpi-processor-perflib-move-problematic-pr-performance-check.patch block-make-req_op_zone_finish-a-write-operation.patch mm-memory-tier-fix-abstract-distance-calculation-overflow.patch +smb-client-let-send_done-cleanup-before-calling-smbd_disconnect_rdma_connection.patch +smb-client-don-t-wait-for-info-send_pending-0-on-error.patch diff --git a/queue-6.12/smb-client-don-t-wait-for-info-send_pending-0-on-error.patch b/queue-6.12/smb-client-don-t-wait-for-info-send_pending-0-on-error.patch new file mode 100644 index 0000000000..eca3a71dd4 --- /dev/null +++ b/queue-6.12/smb-client-don-t-wait-for-info-send_pending-0-on-error.patch @@ -0,0 +1,54 @@ +From 8c48e1c7520321cc87ff651e96093e2f412785fb Mon Sep 17 00:00:00 2001 +From: Stefan Metzmacher +Date: Tue, 12 Aug 2025 18:45:06 +0200 +Subject: smb: client: don't wait for info->send_pending == 0 on error + +From: Stefan Metzmacher + +commit 8c48e1c7520321cc87ff651e96093e2f412785fb upstream. + +We already called ib_drain_qp() before and that makes sure +send_done() was called with IB_WC_WR_FLUSH_ERR, but +didn't called atomic_dec_and_test(&sc->send_io.pending.count) + +So we may never reach the info->send_pending == 0 condition. + +Cc: Steve French +Cc: Tom Talpey +Cc: Long Li +Cc: linux-cifs@vger.kernel.org +Cc: samba-technical@lists.samba.org +Fixes: 5349ae5e05fa ("smb: client: let send_done() cleanup before calling smbd_disconnect_rdma_connection()") +Signed-off-by: Stefan Metzmacher +Signed-off-by: Steve French +Signed-off-by: Greg Kroah-Hartman +--- + fs/smb/client/smbdirect.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +--- a/fs/smb/client/smbdirect.c ++++ b/fs/smb/client/smbdirect.c +@@ -1316,10 +1316,6 @@ void smbd_destroy(struct TCP_Server_Info + log_rdma_event(INFO, "cancelling idle timer\n"); + cancel_delayed_work_sync(&info->idle_timer_work); + +- log_rdma_event(INFO, "wait for all send posted to IB to finish\n"); +- wait_event(info->wait_send_pending, +- atomic_read(&info->send_pending) == 0); +- + /* It's not possible for upper layer to get to reassembly */ + log_rdma_event(INFO, "drain the reassembly queue\n"); + do { +@@ -1965,7 +1961,11 @@ int smbd_send(struct TCP_Server_Info *se + */ + + wait_event(info->wait_send_pending, +- atomic_read(&info->send_pending) == 0); ++ atomic_read(&info->send_pending) == 0 || ++ sc->status != SMBDIRECT_SOCKET_CONNECTED); ++ ++ if (sc->status != SMBDIRECT_SOCKET_CONNECTED && rc == 0) ++ rc = -EAGAIN; + + return rc; + } diff --git a/queue-6.12/smb-client-let-send_done-cleanup-before-calling-smbd_disconnect_rdma_connection.patch b/queue-6.12/smb-client-let-send_done-cleanup-before-calling-smbd_disconnect_rdma_connection.patch new file mode 100644 index 0000000000..99ff8f9274 --- /dev/null +++ b/queue-6.12/smb-client-let-send_done-cleanup-before-calling-smbd_disconnect_rdma_connection.patch @@ -0,0 +1,57 @@ +From 5349ae5e05fa37409fd48a1eb483b199c32c889b Mon Sep 17 00:00:00 2001 +From: Stefan Metzmacher +Date: Mon, 4 Aug 2025 14:10:12 +0200 +Subject: smb: client: let send_done() cleanup before calling smbd_disconnect_rdma_connection() + +From: Stefan Metzmacher + +commit 5349ae5e05fa37409fd48a1eb483b199c32c889b upstream. + +We should call ib_dma_unmap_single() and mempool_free() before calling +smbd_disconnect_rdma_connection(). + +And smbd_disconnect_rdma_connection() needs to be the last function to +call as all other state might already be gone after it returns. + +Cc: Steve French +Cc: Tom Talpey +Cc: Long Li +Cc: linux-cifs@vger.kernel.org +Cc: samba-technical@lists.samba.org +Fixes: f198186aa9bb ("CIFS: SMBD: Establish SMB Direct connection") +Signed-off-by: Stefan Metzmacher +Signed-off-by: Steve French +Signed-off-by: Greg Kroah-Hartman +--- + fs/smb/client/smbdirect.c | 14 ++++++++------ + 1 file changed, 8 insertions(+), 6 deletions(-) + +--- a/fs/smb/client/smbdirect.c ++++ b/fs/smb/client/smbdirect.c +@@ -277,18 +277,20 @@ static void send_done(struct ib_cq *cq, + log_rdma_send(INFO, "smbd_request 0x%p completed wc->status=%d\n", + request, wc->status); + +- if (wc->status != IB_WC_SUCCESS || wc->opcode != IB_WC_SEND) { +- log_rdma_send(ERR, "wc->status=%d wc->opcode=%d\n", +- wc->status, wc->opcode); +- smbd_disconnect_rdma_connection(request->info); +- } +- + for (i = 0; i < request->num_sge; i++) + ib_dma_unmap_single(sc->ib.dev, + request->sge[i].addr, + request->sge[i].length, + DMA_TO_DEVICE); + ++ if (wc->status != IB_WC_SUCCESS || wc->opcode != IB_WC_SEND) { ++ log_rdma_send(ERR, "wc->status=%d wc->opcode=%d\n", ++ wc->status, wc->opcode); ++ mempool_free(request, info->request_mempool); ++ smbd_disconnect_rdma_connection(info); ++ return; ++ } ++ + if (atomic_dec_and_test(&request->info->send_pending)) + wake_up(&request->info->wait_send_pending); + -- 2.47.3