diff options
| author | Adarsh Das <adarshdas950@gmail.com> | 2026-09-19 16:27:32 +0530 |
|---|---|---|
| committer | Paulo Alcantara <pc@manguebit.org> | 2026-09-20 00:58:39 -0300 |
| commit | 8f6f8a48399f82f4a83f7b9f25b9707e0062a4f9 (patch) | |
| tree | 20b70c35352f52e18d8f875130075e1c6f3dc85c /tools/lib/python/kdoc/python_version.py | |
| parent | 17e7b8eacf4cac800a4fc89a28729df72a2dabda (diff) | |
| download | linux-next-8f6f8a48399f82f4a83f7b9f25b9707e0062a4f9.tar.gz linux-next-8f6f8a48399f82f4a83f7b9f25b9707e0062a4f9.zip | |
smb: client: delete compound mids on send failure before unlock
When sending a compound request fails, smb_send_rqst() kicks off a
reconnect. compound_send_recv() still has those mids on pending_mid_q,
but it unlocks the server without removing them first.
During reconnect, cifs_abort_connection() walks pending_mid_q and runs
each mid callback. With no response yet, those callbacks return credits
and drop in_flight. Then compound_send_recv()'s send-error path returns
the same credits again. in_flight ends up decremented twice and
smb2_add_credits() WARNs.
syzbot hits this during SMB2_negotiate when the socket send fails.
cifs_call_async() already calls delete_mid() before unlock on send
failure. Do the same for compound chains and set cancelled_mid[] so the
out: path does not delete them again.
Fixes: ee258d79159a ("CIFS: Move credit processing to mid callbacks for SMB3")
Reported-by: syzbot+eeb58d2197d88720a228@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/r/6a727d22.40259c87.584f4.04ce.GAE@google.com
Tested-by: syzbot+eeb58d2197d88720a228@syzkaller.appspotmail.com
Assisted-by: LLM
Cc: stable@vger.kernel.org
Signed-off-by: Adarsh Das <adarshdas950@gmail.com>
Signed-off-by: Paulo Alcantara <pc@manguebit.org>
Diffstat (limited to 'tools/lib/python/kdoc/python_version.py')
0 files changed, 0 insertions, 0 deletions