[SRU][J][PATCH 1/1] smb: server: let send_done handle a completion without IB_SEND_SIGNALED

[Cengiz Can]

From: Stefan Metzmacher <metze at samba.org>

With smbdirect_send_batch processing we likely have requests without
IB_SEND_SIGNALED, which will be destroyed in the final request
that has IB_SEND_SIGNALED set.

If the connection is broken all requests are signaled
even without explicit IB_SEND_SIGNALED.

Cc: <stable at vger.kernel.org> # 6.18.x
Cc: Namjae Jeon <linkinjeon at kernel.org>
Cc: Steve French <smfrench at gmail.com>
Cc: Tom Talpey <tom at talpey.com>
Cc: linux-cifs at vger.kernel.org
Cc: samba-technical at lists.samba.org
Signed-off-by: Stefan Metzmacher <metze at samba.org>
Acked-by: Namjae Jeon <linkinjeon at kernel.org>
Signed-off-by: Steve French <stfrench at microsoft.com>
(backported from commit 9da82dc73cb03e85d716a2609364572367a5ff47)
[bot_kybele: Applied to fs/ksmbd/transport_rdma.c (the real analogue;
 fs/smb/server/ does not exist in this jammy tree, am 3-way merged into a
 phantom path which I git-rm'd). Renamed to this tree's older symbols
 (smb_direct_sendmsg, smb_direct_free_sendmsg, transport t, IB_SEND_SIGNALED via
 sendmsg->wr.send_flags). The 5.15 send_done frees siblings unconditionally at
 the end with no skip_free label and no early return on error, so the
 unsignaled+error case uses a plain return to skip the free instead of...]
CVE-2026-31536
Assisted-by: kybele:claude-opus-4.8
Signed-off-by: Cengiz Can <cengiz.can at canonical.com>
---
 fs/ksmbd/transport_rdma.c | 25 +++++++++++++++++++++++++
 1 file changed, 25 insertions(+)

diff --git a/fs/ksmbd/transport_rdma.c b/fs/ksmbd/transport_rdma.c
index 741e0e3670dc..b46558fa8110 100644
--- a/fs/ksmbd/transport_rdma.c
+++ b/fs/ksmbd/transport_rdma.c
@@ -840,6 +840,31 @@ static void send_done(struct ib_cq *cq, struct ib_wc *wc)
 		    ib_wc_status_msg(wc->status), wc->status,
 		    wc->opcode);
 
+	if (unlikely(!(sendmsg->wr.send_flags & IB_SEND_SIGNALED))) {
+		/*
+		 * This happens when smb_direct_sendmsg is a sibling
+		 * before the final message, it is signaled on
+		 * error anyway, so we need to skip
+		 * smb_direct_free_sendmsg here,
+		 * otherwise it will destroy the memory
+		 * of the siblings too, which will cause
+		 * use after free problems for the others
+		 * triggered from ib_drain_qp().
+		 */
+		if (wc->status != IB_WC_SUCCESS)
+			return;
+
+		/*
+		 * This should not happen!
+		 * But we better just close the
+		 * connection...
+		 */
+		pr_err("unexpected send completion wc->status=%s (%d) wc->opcode=%d\n",
+		       ib_wc_status_msg(wc->status), wc->status, wc->opcode);
+		smb_direct_disconnect_rdma_connection(t);
+		return;
+	}
+
 	if (wc->status != IB_WC_SUCCESS || wc->opcode != IB_WC_SEND) {
 		pr_err("Send error. status='%s (%d)', opcode=%d\n",
 		       ib_wc_status_msg(wc->status), wc->status,
-- 
2.43.0