[SRU][Q][PATCH 1/1] smb: server: let send_done handle a completion without IB_SEND_SIGNALED

[Cengiz Can]

From: Stefan Metzmacher <metze at samba.org>

With smbdirect_send_batch processing we likely have requests without
IB_SEND_SIGNALED, which will be destroyed in the final request
that has IB_SEND_SIGNALED set.

If the connection is broken all requests are signaled
even without explicit IB_SEND_SIGNALED.

Cc: <stable at vger.kernel.org> # 6.18.x
Cc: Namjae Jeon <linkinjeon at kernel.org>
Cc: Steve French <smfrench at gmail.com>
Cc: Tom Talpey <tom at talpey.com>
Cc: linux-cifs at vger.kernel.org
Cc: samba-technical at lists.samba.org
Signed-off-by: Stefan Metzmacher <metze at samba.org>
Acked-by: Namjae Jeon <linkinjeon at kernel.org>
Signed-off-by: Steve French <stfrench at microsoft.com>
(backported from commit 9da82dc73cb03e85d716a2609364572367a5ff47)
[bot_kybele: This pre-smbdirect_socket tree's send_done uses
 smb_direct_transport *t (not sc) and frees the whole batch via a reverse
 for-loop at the END of the function (no sibling_list); only the last batched
 msg is IB_SEND_SIGNALED (line ~990), siblings get send_flags=0. Since freeing
 happens after the error block here, upstream's forward "goto skip_free" cannot
 skip the free, so I used early "return" in the unsignaled guard (and dropped
 the now-unused skip_free label) and adapted disconnect to use t....]
CVE-2026-31536
Assisted-by: kybele:claude-opus-4.8
Signed-off-by: Cengiz Can <cengiz.can at canonical.com>
---
 fs/smb/server/transport_rdma.c | 23 +++++++++++++++++++++++
 1 file changed, 23 insertions(+)

diff --git a/fs/smb/server/transport_rdma.c b/fs/smb/server/transport_rdma.c
index 8b5c8e663baa..4fce03c8eac9 100644
--- a/fs/smb/server/transport_rdma.c
+++ b/fs/smb/server/transport_rdma.c
@@ -860,6 +860,29 @@ static void send_done(struct ib_cq *cq, struct ib_wc *wc)
 		    ib_wc_status_msg(wc->status), wc->status,
 		    wc->opcode);
 
+	if (unlikely(!(sendmsg->wr.send_flags & IB_SEND_SIGNALED))) {
+		/*
+		 * This happens when a sendmsg is a sibling before the
+		 * final message; it is signaled on error anyway, so we
+		 * must skip freeing the message list here, otherwise it
+		 * will destroy the memory of the siblings too, which
+		 * will cause use after free problems for the others
+		 * triggered from ib_drain_qp().
+		 */
+		if (wc->status != IB_WC_SUCCESS)
+			return;
+
+		/*
+		 * This should not happen!
+		 * But we better just close the
+		 * connection...
+		 */
+		pr_err("unexpected send completion wc->status=%s (%d) wc->opcode=%d\n",
+		       ib_wc_status_msg(wc->status), wc->status, wc->opcode);
+		smb_direct_disconnect_rdma_connection(t);
+		return;
+	}
+
 	if (wc->status != IB_WC_SUCCESS || wc->opcode != IB_WC_SEND) {
 		pr_err("Send error. status='%s (%d)', opcode=%d\n",
 		       ib_wc_status_msg(wc->status), wc->status,
-- 
2.43.0