smb: server: fix last send credit problem causing disconnects

When we are about to use the last send credit that was
granted to us by the peer, we need to wait until
we are ourself able to grant at least one credit
to the peer. Otherwise it might not be possible
for the peer to grant more credits.

The following sections in MS-SMBD are related to this:

3.1.5.1 Sending Upper Layer Messages
...
If Connection.SendCredits is 1 and the CreditsGranted field of the
message is 0, stop processing.
...

3.1.5.9 Managing Credits Prior to Sending
...
If Connection.ReceiveCredits is zero, or if Connection.SendCredits is
one and the Connection.SendQueue is not empty, the sender MUST allocate
and post at least one receive of size Connection.MaxReceiveSize and MUST
increment Connection.ReceiveCredits by the number allocated and posted.
If no receives are posted, the processing MUST return a value of zero to
indicate to the caller that no Send message can be currently performed.
...

This problem was found by running this on Windows 2025
against ksmbd with required smb signing:
'frametest.exe -r 4k -t 20 -n 2000' after
'frametest.exe -w 4k -t 20 -n 2000'.

Link: https://lore.kernel.org/linux-cifs/b58fa352-2386-4145-b42e-9b4b1d484e17@samba.org/
Cc: <stable@vger.kernel.org> # 6.18.x
Cc: Namjae Jeon <linkinjeon@kernel.org>
Cc: Steve French <smfrench@gmail.com>
Cc: Tom Talpey <tom@talpey.com>
Cc: linux-cifs@vger.kernel.org
Cc: samba-technical@lists.samba.org
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Acked-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>

diff --git a/fs/smb/server/transport_rdma.c b/fs/smb/server/transport_rdma.c
index 38248b6a1b5caf16e98e7a0ebd5e0591f8241803..5c0cc5064e8c004866d11508755f0ea60d8e995b 100644 (file)
--- a/fs/smb/server/transport_rdma.c
+++ b/fs/smb/server/transport_rdma.c
@@ -1033,6 +1033,15 @@ static void smb_direct_post_recv_credits(struct work_struct *work)
 
        atomic_add(credits, &sc->recv_io.credits.available);
 
+       /*
+        * If the last send credit is waiting for credits
+        * it can grant we need to wake it up
+        */
+       if (credits &&
+           atomic_read(&sc->send_io.bcredits.count) == 0 &&
+           atomic_read(&sc->send_io.credits.count) == 0)
+               wake_up(&sc->send_io.credits.wait_queue);
+
        if (credits)
                queue_work(sc->workqueue, &sc->idle.immediate_work);
 }
@@ -1306,6 +1315,7 @@ static int calc_rw_credits(struct smbdirect_socket *sc,
 
 static int smb_direct_create_header(struct smbdirect_socket *sc,
                                    int size, int remaining_data_length,
+                                   int new_credits,
                                    struct smbdirect_send_io **sendmsg_out)
 {
        struct smbdirect_socket_parameters *sp = &sc->parameters;
@@ -1321,7 +1331,7 @@ static int smb_direct_create_header(struct smbdirect_socket *sc,
        /* Fill in the packet header */
        packet = (struct smbdirect_data_transfer *)sendmsg->packet;
        packet->credits_requested = cpu_to_le16(sp->send_credit_target);
-       packet->credits_granted = cpu_to_le16(manage_credits_prior_sending(sc));
+       packet->credits_granted = cpu_to_le16(new_credits);
 
        packet->flags = 0;
        if (manage_keep_alive_before_sending(sc))
@@ -1459,6 +1469,7 @@ static int smb_direct_post_send_data(struct smbdirect_socket *sc,
        int data_length;
        struct scatterlist sg[SMBDIRECT_SEND_IO_MAX_SGE - 1];
        struct smbdirect_send_batch _send_ctx;
+       int new_credits;
 
        if (!send_ctx) {
                smb_direct_send_ctx_init(&_send_ctx, false, 0);
@@ -1477,12 +1488,29 @@ static int smb_direct_post_send_data(struct smbdirect_socket *sc,
        if (ret)
                goto credit_failed;
 
+       new_credits = manage_credits_prior_sending(sc);
+       if (new_credits == 0 &&
+           atomic_read(&sc->send_io.credits.count) == 0 &&
+           atomic_read(&sc->recv_io.credits.count) == 0) {
+               queue_work(sc->workqueue, &sc->recv_io.posted.refill_work);
+               ret = wait_event_interruptible(sc->send_io.credits.wait_queue,
+                                              atomic_read(&sc->send_io.credits.count) >= 1 ||
+                                              atomic_read(&sc->recv_io.credits.available) >= 1 ||
+                                              sc->status != SMBDIRECT_SOCKET_CONNECTED);
+               if (sc->status != SMBDIRECT_SOCKET_CONNECTED)
+                       ret = -ENOTCONN;
+               if (ret < 0)
+                       goto credit_failed;
+
+               new_credits = manage_credits_prior_sending(sc);
+       }
+
        data_length = 0;
        for (i = 0; i < niov; i++)
                data_length += iov[i].iov_len;
 
        ret = smb_direct_create_header(sc, data_length, remaining_data_length,
-                                      &msg);
+                                      new_credits, &msg);
        if (ret)
                goto header_failed;