[SRU][N][PATCH 1/1] smb: server: let send_done handle a completion without IB_SEND_SIGNALED

[Cengiz Can]

From: Stefan Metzmacher <metze at samba.org>

With smbdirect_send_batch processing we likely have requests without
IB_SEND_SIGNALED, which will be destroyed in the final request
that has IB_SEND_SIGNALED set.

If the connection is broken all requests are signaled
even without explicit IB_SEND_SIGNALED.

Cc: <stable at vger.kernel.org> # 6.18.x
Cc: Namjae Jeon <linkinjeon at kernel.org>
Cc: Steve French <smfrench at gmail.com>
Cc: Tom Talpey <tom at talpey.com>
Cc: linux-cifs at vger.kernel.org
Cc: samba-technical at lists.samba.org
Signed-off-by: Stefan Metzmacher <metze at samba.org>
Acked-by: Namjae Jeon <linkinjeon at kernel.org>
Signed-off-by: Steve French <stfrench at microsoft.com>
(backported from commit 9da82dc73cb03e85d716a2609364572367a5ff47)
[bot_kybele: This tree's send_done predates the smbdirect_socket refactor: it
 uses transport 't' (not 'sc') and frees siblings via a reverse '->list' walk at
 the end rather than sibling_list/lcredits, so I used 't', dropped the
 lcredits/sibling_list free block, and moved the existing reverse-list free loop
 above the error-check block so the upstream-added 'goto skip_free' actually
 bypasses the freeing; comment wording adapted to
 smb_direct_sendmsg/smb_direct_free_sendmsg.]
CVE-2026-31536
Assisted-by: kybele:claude-opus-4.8
Signed-off-by: Cengiz Can <cengiz.can at canonical.com>
---
 fs/smb/server/transport_rdma.c | 39 ++++++++++++++++++++++++++++------
 1 file changed, 32 insertions(+), 7 deletions(-)

diff --git a/fs/smb/server/transport_rdma.c b/fs/smb/server/transport_rdma.c
index 8c450e5fd4f0..3aa46cfe0a03 100644
--- a/fs/smb/server/transport_rdma.c
+++ b/fs/smb/server/transport_rdma.c
@@ -864,16 +864,30 @@ static void send_done(struct ib_cq *cq, struct ib_wc *wc)
 		    ib_wc_status_msg(wc->status), wc->status,
 		    wc->opcode);
 
-	if (wc->status != IB_WC_SUCCESS || wc->opcode != IB_WC_SEND) {
-		pr_err("Send error. status='%s (%d)', opcode=%d\n",
-		       ib_wc_status_msg(wc->status), wc->status,
-		       wc->opcode);
+	if (unlikely(!(sendmsg->wr.send_flags & IB_SEND_SIGNALED))) {
+		/*
+		 * This happens when smb_direct_sendmsg is a sibling
+		 * before the final message, it is signaled on
+		 * error anyway, so we need to skip the freeing
+		 * below here, otherwise it will destroy the memory
+		 * of the siblings too, which will cause
+		 * use after free problems for the others
+		 * triggered from ib_drain_qp().
+		 */
+		if (wc->status != IB_WC_SUCCESS)
+			goto skip_free;
+
+		/*
+		 * This should not happen!
+		 * But we better just close the
+		 * connection...
+		 */
+		pr_err("unexpected send completion wc->status=%s (%d) wc->opcode=%d\n",
+		       ib_wc_status_msg(wc->status), wc->status, wc->opcode);
 		smb_direct_disconnect_rdma_connection(t);
+		return;
 	}
 
-	if (atomic_dec_and_test(&t->send_pending))
-		wake_up(&t->wait_send_pending);
-
 	/* iterate and free the list of messages in reverse. the list's head
 	 * is invalid.
 	 */
@@ -885,6 +899,17 @@ static void send_done(struct ib_cq *cq, struct ib_wc *wc)
 
 	sibling = container_of(pos, struct smb_direct_sendmsg, list);
 	smb_direct_free_sendmsg(t, sibling);
+
+	if (wc->status != IB_WC_SUCCESS || wc->opcode != IB_WC_SEND) {
+skip_free:
+		pr_err("Send error. status='%s (%d)', opcode=%d\n",
+		       ib_wc_status_msg(wc->status), wc->status,
+		       wc->opcode);
+		smb_direct_disconnect_rdma_connection(t);
+	}
+
+	if (atomic_dec_and_test(&t->send_pending))
+		wake_up(&t->wait_send_pending);
 }
 
 static int manage_credits_prior_sending(struct smb_direct_transport *t)
-- 
2.43.0