smb: server: let send_done handle a completion without IB_SEND_SIGNALED

commit 9da82dc73cb03e85d716a2609364572367a5ff47 upstream.

With smbdirect_send_batch processing we likely have requests without
IB_SEND_SIGNALED, which will be destroyed in the final request
that has IB_SEND_SIGNALED set.

If the connection is broken all requests are signaled
even without explicit IB_SEND_SIGNALED.

Cc: <stable@vger.kernel.org> # 6.18.x
Cc: Namjae Jeon <linkinjeon@kernel.org>
Cc: Steve French <smfrench@gmail.com>
Cc: Tom Talpey <tom@talpey.com>
Cc: linux-cifs@vger.kernel.org
Cc: samba-technical@lists.samba.org
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Acked-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/fs/smb/server/transport_rdma.c b/fs/smb/server/transport_rdma.c
index 21baabb1988fe9f5eae3f039527b42cefd3ae9e8..4e74934e1f2778a33c5a75f7b39659f508bfd311 100644 (file)
--- a/fs/smb/server/transport_rdma.c
+++ b/fs/smb/server/transport_rdma.c
@@ -957,6 +957,31 @@ static void send_done(struct ib_cq *cq, struct ib_wc *wc)
                    ib_wc_status_msg(wc->status), wc->status,
                    wc->opcode);
 
+       if (unlikely(!(sendmsg->wr.send_flags & IB_SEND_SIGNALED))) {
+               /*
+                * This happens when smbdirect_send_io is a sibling
+                * before the final message, it is signaled on
+                * error anyway, so we need to skip
+                * smbdirect_connection_free_send_io here,
+                * otherwise is will destroy the memory
+                * of the siblings too, which will cause
+                * use after free problems for the others
+                * triggered from ib_drain_qp().
+                */
+               if (wc->status != IB_WC_SUCCESS)
+                       goto skip_free;
+
+               /*
+                * This should not happen!
+                * But we better just close the
+                * connection...
+                */
+               pr_err("unexpected send completion wc->status=%s (%d) wc->opcode=%d\n",
+                      ib_wc_status_msg(wc->status), wc->status, wc->opcode);
+               smb_direct_disconnect_rdma_connection(sc);
+               return;
+       }
+
        /*
         * Free possible siblings and then the main send_io
         */
@@ -970,6 +995,7 @@ static void send_done(struct ib_cq *cq, struct ib_wc *wc)
        lcredits += 1;
 
        if (wc->status != IB_WC_SUCCESS || wc->opcode != IB_WC_SEND) {
+skip_free:
                pr_err("Send error. status='%s (%d)', opcode=%d\n",
                       ib_wc_status_msg(wc->status), wc->status,
                       wc->opcode);