smb: server: let send_done handle a completion without IB_SEND_SIGNALED

With smbdirect_send_batch processing we likely have requests without
IB_SEND_SIGNALED, which will be destroyed in the final request
that has IB_SEND_SIGNALED set.

If the connection is broken all requests are signaled
even without explicit IB_SEND_SIGNALED.

Cc: <stable@vger.kernel.org> # 6.18.x
Cc: Namjae Jeon <linkinjeon@kernel.org>
Cc: Steve French <smfrench@gmail.com>
Cc: Tom Talpey <tom@talpey.com>
Cc: linux-cifs@vger.kernel.org
Cc: samba-technical@lists.samba.org
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Acked-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>

diff --git a/fs/smb/server/transport_rdma.c b/fs/smb/server/transport_rdma.c
index 5c0cc5064e8c004866d11508755f0ea60d8e995b..c94068b78a1d2d549926151654dd13b752203c58 100644 (file)
--- a/fs/smb/server/transport_rdma.c
+++ b/fs/smb/server/transport_rdma.c
@@ -1059,6 +1059,31 @@ static void send_done(struct ib_cq *cq, struct ib_wc *wc)
                    ib_wc_status_msg(wc->status), wc->status,
                    wc->opcode);
 
+       if (unlikely(!(sendmsg->wr.send_flags & IB_SEND_SIGNALED))) {
+               /*
+                * This happens when smbdirect_send_io is a sibling
+                * before the final message, it is signaled on
+                * error anyway, so we need to skip
+                * smbdirect_connection_free_send_io here,
+                * otherwise is will destroy the memory
+                * of the siblings too, which will cause
+                * use after free problems for the others
+                * triggered from ib_drain_qp().
+                */
+               if (wc->status != IB_WC_SUCCESS)
+                       goto skip_free;
+
+               /*
+                * This should not happen!
+                * But we better just close the
+                * connection...
+                */
+               pr_err("unexpected send completion wc->status=%s (%d) wc->opcode=%d\n",
+                      ib_wc_status_msg(wc->status), wc->status, wc->opcode);
+               smb_direct_disconnect_rdma_connection(sc);
+               return;
+       }
+
        /*
         * Free possible siblings and then the main send_io
         */
@@ -1072,6 +1097,7 @@ static void send_done(struct ib_cq *cq, struct ib_wc *wc)
        lcredits += 1;
 
        if (wc->status != IB_WC_SUCCESS || wc->opcode != IB_WC_SEND) {
+skip_free:
                pr_err("Send error. status='%s (%d)', opcode=%d\n",
                       ib_wc_status_msg(wc->status), wc->status,
                       wc->opcode);