smb: client: make use of smbdirect_socket.recv_io.credits.available

The logic off managing recv credits by counting posted recv_io and
granted credits is racy.

That's because the peer might already consumed a credit,
but between receiving the incoming recv at the hardware
and processing the completion in the 'recv_done' functions
we likely have a window where we grant credits, which
don't really exist.

So we better have a decicated counter for the
available credits, which will be incremented
when we posted new recv buffers and drained when
we grant the credits to the peer.

Fixes: 5fb9b459b368 ("smb: client: count the number of posted recv_io messages in order to calculated credits")
Cc: <stable@vger.kernel.org> # 6.18.x
Cc: Steve French <smfrench@gmail.com>
Cc: Tom Talpey <tom@talpey.com>
Cc: Long Li <longli@microsoft.com>
Cc: Namjae Jeon <linkinjeon@kernel.org>
Cc: linux-cifs@vger.kernel.org
Cc: samba-technical@lists.samba.org
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Signed-off-by: Steve French <stfrench@microsoft.com>

diff --git a/fs/smb/client/smbdirect.c b/fs/smb/client/smbdirect.c
index 788a0670c4a8da597ae88dae820fee56f03a7c89..6679abbb9797c0fdb615cee89b6dfdf2ee2f8e27 100644 (file)
--- a/fs/smb/client/smbdirect.c
+++ b/fs/smb/client/smbdirect.c
@@ -618,6 +618,7 @@ static void smbd_post_send_credits(struct work_struct *work)
        struct smbdirect_recv_io *response;
        struct smbdirect_socket *sc =
                container_of(work, struct smbdirect_socket, recv_io.posted.refill_work);
+       int posted = 0;
 
        if (sc->status != SMBDIRECT_SOCKET_CONNECTED) {
                return;
@@ -640,9 +641,12 @@ static void smbd_post_send_credits(struct work_struct *work)
                        }
 
                        atomic_inc(&sc->recv_io.posted.count);
+                       posted += 1;
                }
        }
 
+       atomic_add(posted, &sc->recv_io.credits.available);
+
        /* Promptly send an immediate packet as defined in [MS-SMBD] 3.1.1.1 */
        if (atomic_read(&sc->recv_io.credits.count) <
                sc->recv_io.credits.target - 1) {
@@ -1033,19 +1037,38 @@ dma_mapping_failed:
  */
 static int manage_credits_prior_sending(struct smbdirect_socket *sc)
 {
+       int missing;
+       int available;
        int new_credits;
 
        if (atomic_read(&sc->recv_io.credits.count) >= sc->recv_io.credits.target)
                return 0;
 
-       new_credits = atomic_read(&sc->recv_io.posted.count);
-       if (new_credits == 0)
+       missing = (int)sc->recv_io.credits.target - atomic_read(&sc->recv_io.credits.count);
+       available = atomic_xchg(&sc->recv_io.credits.available, 0);
+       new_credits = (u16)min3(U16_MAX, missing, available);
+       if (new_credits <= 0) {
+               /*
+                * If credits are available, but not granted
+                * we need to re-add them again.
+                */
+               if (available)
+                       atomic_add(available, &sc->recv_io.credits.available);
                return 0;
+       }
 
-       new_credits -= atomic_read(&sc->recv_io.credits.count);
-       if (new_credits <= 0)
-               return 0;
+       if (new_credits < available) {
+               /*
+                * Readd the remaining available again.
+                */
+               available -= new_credits;
+               atomic_add(available, &sc->recv_io.credits.available);
+       }
 
+       /*
+        * Remember we granted the credits
+        */
+       atomic_add(new_credits, &sc->recv_io.credits.count);
        return new_credits;
 }
 
@@ -1217,7 +1240,6 @@ wait_credit:
        packet->credits_requested = cpu_to_le16(sp->send_credit_target);
 
        new_credits = manage_credits_prior_sending(sc);
-       atomic_add(new_credits, &sc->recv_io.credits.count);
        packet->credits_granted = cpu_to_le16(new_credits);
 
        packet->flags = 0;