[SRU][J][PATCH 1/1] smb: server: let send_done handle a completion without IB_SEND_SIGNALED

[Manuel Diewald]

On Tue, Jun 23, 2026 at 07:20:00AM +0300, Cengiz Can via kernel-team wrote:
> From: Stefan Metzmacher <metze at samba.org>
> 
> With smbdirect_send_batch processing we likely have requests without
> IB_SEND_SIGNALED, which will be destroyed in the final request
> that has IB_SEND_SIGNALED set.
> 
> If the connection is broken all requests are signaled
> even without explicit IB_SEND_SIGNALED.
> 
> Cc: <stable at vger.kernel.org> # 6.18.x
> Cc: Namjae Jeon <linkinjeon at kernel.org>
> Cc: Steve French <smfrench at gmail.com>
> Cc: Tom Talpey <tom at talpey.com>
> Cc: linux-cifs at vger.kernel.org
> Cc: samba-technical at lists.samba.org
> Signed-off-by: Stefan Metzmacher <metze at samba.org>
> Acked-by: Namjae Jeon <linkinjeon at kernel.org>
> Signed-off-by: Steve French <stfrench at microsoft.com>
> (backported from commit 9da82dc73cb03e85d716a2609364572367a5ff47)
> [bot_kybele: Applied to fs/ksmbd/transport_rdma.c (the real analogue;
>  fs/smb/server/ does not exist in this jammy tree, am 3-way merged into a
>  phantom path which I git-rm'd). Renamed to this tree's older symbols
>  (smb_direct_sendmsg, smb_direct_free_sendmsg, transport t, IB_SEND_SIGNALED via
>  sendmsg->wr.send_flags). The 5.15 send_done frees siblings unconditionally at
>  the end with no skip_free label and no early return on error, so the
>  unsignaled+error case uses a plain return to skip the free instead of...]
> CVE-2026-31536
> Assisted-by: kybele:claude-opus-4.8
> Signed-off-by: Cengiz Can <cengiz.can at canonical.com>
> ---
>  fs/ksmbd/transport_rdma.c | 25 +++++++++++++++++++++++++
>  1 file changed, 25 insertions(+)
> 
> diff --git a/fs/ksmbd/transport_rdma.c b/fs/ksmbd/transport_rdma.c
> index 741e0e3670dc..b46558fa8110 100644
> --- a/fs/ksmbd/transport_rdma.c
> +++ b/fs/ksmbd/transport_rdma.c
> @@ -840,6 +840,31 @@ static void send_done(struct ib_cq *cq, struct ib_wc *wc)
>  		    ib_wc_status_msg(wc->status), wc->status,
>  		    wc->opcode);
>  
> +	if (unlikely(!(sendmsg->wr.send_flags & IB_SEND_SIGNALED))) {
> +		/*
> +		 * This happens when smb_direct_sendmsg is a sibling
> +		 * before the final message, it is signaled on
> +		 * error anyway, so we need to skip
> +		 * smb_direct_free_sendmsg here,
> +		 * otherwise it will destroy the memory
> +		 * of the siblings too, which will cause
> +		 * use after free problems for the others
> +		 * triggered from ib_drain_qp().
> +		 */
> +		if (wc->status != IB_WC_SUCCESS)
> +			return;

The upstream patch goes to skip_free which prints an error message and
calls smb_direct_disconnect_rdma_connection(). Both this jammy and the
questing backport just return here instead which means we're not calling
smb_direct_disconnect_rdma_connection(). I'm not sure what the
consequences of that missing call are but we probably should have
another look. What do you think?

> +
> +		/*
> +		 * This should not happen!
> +		 * But we better just close the
> +		 * connection...
> +		 */
> +		pr_err("unexpected send completion wc->status=%s (%d) wc->opcode=%d\n",
> +		       ib_wc_status_msg(wc->status), wc->status, wc->opcode);
> +		smb_direct_disconnect_rdma_connection(t);
> +		return;
> +	}
> +
>  	if (wc->status != IB_WC_SUCCESS || wc->opcode != IB_WC_SEND) {
>  		pr_err("Send error. status='%s (%d)', opcode=%d\n",
>  		       ib_wc_status_msg(wc->status), wc->status,
> -- 
> 2.43.0
> 
> 
> -- 
> kernel-team mailing list
> kernel-team at lists.ubuntu.com
> https://lists.ubuntu.com/mailman/listinfo/kernel-team

-- 
 Manuel
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: not available
URL: <https://lists.ubuntu.com/archives/kernel-team/attachments/20260716/103c0a2b/attachment-0001.sig>