smb: smbdirect: destroy QP before mem pools on accept failure

On the rdma_accept_failed error path of
smbdirect_accept_connect_request(), the receive io posted just above is
owned by the QP (recv_io is set to NULL after a successful post).  The
error path fell through to smbdirect_connection_destroy_mem_pools()
before smbdirect_connection_destroy_qp(), so the mem pools and the
recv_io slab cache were destroyed while that recv_io was still
outstanding on the QP.

The drain in smbdirect_connection_destroy_qp() (ib_drain_qp()) is what
runs the recv completion that returns the recv_io to the free list, so
destroying the pools first leaves the object outstanding at
kmem_cache_destroy() time ("Slab cache still has objects") and later
frees it into an already-destroyed mempool (mempool_free_bulk
NULL-pointer dereference).

Give rdma_accept_failed its own teardown that drains the QP first, then
destroys the mem pools, and returns.  The remaining labels
(post_recv_io_failed onward) run before the recv_io was ever posted, so
they keep the mem-pools-then-qp order.

The outstanding recv_io at kmem_cache_destroy() time:

[ 3487.344647] =============================================================================
[ 3487.349942] BUG smbdirect_recv_io_cache_ffff88811ba99000 (Not tainted): Objects remaining on __kmem_cache_shutdown()
[ 3487.356078] -----------------------------------------------------------------------------
[ 3487.356078]
[ 3487.356738] Object 0xffff8881511c3440 @offset=13376
[ 3487.358464] Allocated in mempool_alloc_noprof+0x18c/0x290 age=1194 cpu=6 pid=22254
[ 3487.361197]  mempool_alloc_noprof+0x18c/0x290
[ 3487.361542]  smbdirect_connection_create_mem_pools+0x405/0x780
[ 3487.361972]  smbdirect_accept_connect_request+0x5a8/0x1b80
[ 3487.362359]  smbdirect_listen_rdma_event_handler+0x1579/0x1b90
[ 3487.362779]  cma_cm_event_handler+0x9c/0x230
[ 3487.363096]  cma_ib_req_handler+0x2682/0x45d0
[ 3487.363414]  cm_process_work+0x56/0x3d0
[ 3487.363676]  cm_work_handler+0x8a0e/0xd000
[ 3487.367496]  process_scheduled_works+0xa07/0x13a0
[ 3487.367859]  worker_thread+0x7c9/0xc80
[ 3487.368148]  kthread+0x341/0x430
[ 3487.368407]  ret_from_fork+0x3a8/0x7a0
[ 3487.368704]  ret_from_fork_asm+0x1a/0x30
[ 3487.370307] Slab 0xffffea0005447000 objects=19 used=1 fp=0xffff8881511c0040 flags=0x100000000000240(workingset|head|node=0|zone=2)
[ 3487.372840] ------------[ cut here ]------------
[ 3487.373195] WARNING: mm/slub.c:1244 at __slab_err+0x1a/0x30, CPU#6: kworker/6:84/22254
[ 3487.373759] Modules linked in:
[ 3487.373993] CPU: 6 UID: 0 PID: 22254 Comm: kworker/6:84 Tainted: G    B               7.1.0-next-20260623+ #88 PREEMPT(lazy)
[ 3487.374778] Tainted: [B]=BAD_PAGE
[ 3487.377830] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-debian-1.17.0-1 04/01/2014
[ 3487.378515] Workqueue: ib_cm cm_work_handler
[ 3487.378820] RIP: 0010:__slab_err+0x1a/0x30
[ 3487.379129] Code: 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 44 00 00 e8 36 00 00 00 bf 05 00 00 00 be 01 00 00 00 e8 f7 75 45 00 90 <0f> 0b 90 c3 cc cc cc cc cc 66 66 66 66 2e 0f 1f 84 00 00 00 00 00
[ 3487.383255] RSP: 0018:ffff888220fc7050 EFLAGS: 00010093
[ 3487.383643] RAX: ffffffff8168e60a RBX: ffff88810955e640 RCX: ffff88821c381d80
[ 3487.384158] RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffffffff870fa080
[ 3487.384662] RBP: ffff888220fc7068 R08: ffffffff870fa087 R09: 1ffffffff0e1f410
[ 3487.385192] R10: dffffc0000000000 R11: fffffbfff0e1f411 R12: ffffea0005447210
[ 3487.385674] R13: ffffea0005447000 R14: ffff888220fc7068 R15: ffff88812a8ab300
[ 3487.388932] FS:  0000000000000000(0000) GS:ffff888427e76000(0000) knlGS:0000000000000000
[ 3487.389529] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 3487.389934] CR2: 00007ffcf2d84fd8 CR3: 0000000111d64006 CR4: 0000000000f72ef0
[ 3487.390440] PKRU: 55555554
[ 3487.390641] Call Trace:
[ 3487.390826]  <TASK>
[ 3487.391209]  __kmem_cache_shutdown+0x1aa/0x2b0
[ 3487.392062]  ? smbdirect_connection_destroy_mem_pools+0x239/0x300
[ 3487.393565]  kmem_cache_destroy+0x9d/0x180
[ 3487.398663]  smbdirect_connection_destroy_mem_pools+0x239/0x300
[ 3487.403534]  ? __pfx_smb_direct_logging_needed+0x10/0x10
[ 3487.407562]  smbdirect_accept_connect_request+0x95c/0x1b80
[ 3487.412391]  ? __pfx_smbdirect_accept_connect_request+0x10/0x10
[ 3487.416753]  ? do_raw_spin_lock+0x130/0x300
[ 3487.420623]  ? smbdirect_socket_set_initial_parameters+0x28b/0x6a0
[ 3487.424322]  ? lock_acquire+0x4c/0x270
[ 3487.424409] ksmbd: can't change a file to a directory
[ 3487.426321]  ? trace_irq_enable+0x36/0x120
[ 3487.429144]  smbdirect_listen_rdma_event_handler+0x1579/0x1b90
[ 3487.432606]  ? __pfx_smbdirect_listen_rdma_event_handler+0x10/0x10
[ 3487.433595]  ? trace_cm_event_handler+0x51/0x170
[ 3487.435183]  ? __pfx_smbdirect_listen_rdma_event_handler+0x10/0x10
[ 3487.435646]  ? cma_listen_handler+0xf6/0x150
[ 3487.435975]  cma_cm_event_handler+0x9c/0x230
[ 3487.436288]  cma_ib_req_handler+0x2682/0x45d0
[ 3487.439039]  ? __pfx_cma_ib_req_handler+0x10/0x10
[ 3487.439540]  ? __pfx_roce_resolve_route_from_path+0x10/0x10
[ 3487.439972]  ? stack_depot_save_flags+0x34/0x840
[ 3487.440374]  ? __xas_nomem+0xa9/0x410
[ 3487.443356]  ? xas_clear_mark+0x26c/0x4a0
[ 3487.443673]  cm_process_work+0x56/0x3d0
[ 3487.443969]  ? _raw_spin_unlock_irq+0x28/0x50
[ 3487.444317]  cm_work_handler+0x8a0e/0xd000
[ 3487.444624]  ? __pfx_cm_work_handler+0x10/0x10
[ 3487.444971]  ? pwq_dec_nr_in_flight+0xa73/0xdf0
[ 3487.445344]  ? __pfx_pwq_dec_nr_in_flight+0x10/0x10
[ 3487.445737]  ? lock_acquire+0x4c/0x270
[ 3487.448833]  ? process_scheduled_works+0x995/0x13a0
[ 3487.449230]  ? process_scheduled_works+0x995/0x13a0
[ 3487.449588]  process_scheduled_works+0xa07/0x13a0
[ 3487.449938]  ? __pfx_process_scheduled_works+0x10/0x10
[ 3487.450334]  ? do_raw_spin_lock+0x130/0x300
[ 3487.450639]  ? assign_work+0x3bb/0x5c0
[ 3487.450916]  worker_thread+0x7c9/0xc80
[ 3487.451211]  kthread+0x341/0x430
[ 3487.451453]  ? __pfx_worker_thread+0x10/0x10
[ 3487.451756]  ? __pfx_kthread+0x10/0x10
[ 3487.454814]  ret_from_fork+0x3a8/0x7a0
[ 3487.455114]  ? __pfx_ret_from_fork+0x10/0x10
[ 3487.455450]  ? __switch_to+0xb76/0x1110
[ 3487.455772]  ? __pfx_kthread+0x10/0x10
[ 3487.456081]  ret_from_fork_asm+0x1a/0x30
[ 3487.456384]  </TASK>
[ 3487.456549] irq event stamp: 0
[ 3487.456767] hardirqs last  enabled at (0): [<0000000000000000>] 0x0
[ 3487.460124] hardirqs last disabled at (0): [<ffffffff81684648>] copy_process+0xa08/0x3a10
[ 3487.460726] softirqs last  enabled at (0): [<ffffffff81684648>] copy_process+0xa08/0x3a10
[ 3487.461328] softirqs last disabled at (0): [<0000000000000000>] 0x0
[ 3487.461778] ---[ end trace 0000000000000000 ]---
[ 3487.543875] ksmbd: can't change a file to a directory
[ 3487.599675] ksmbd: can't change a file to a directory
[ 3487.626694] ksmbd: can't change a file to a directory
[ 3487.824687] ksmbd: can't change a file to a directory
[ 3487.871840] ksmbd: can't change a file to a directory
[ 3487.986207] ------------[ cut here ]------------
[ 3487.987157] kmem_cache_destroy smbdirect_recv_io_cache_ffff88811ba99000: Slab cache still has objects when called from smbdirect_connection_destroy_mem_pools+0x239/0x300
[ 3487.987183] WARNING: mm/slab_common.c:572 at kmem_cache_destroy+0x15c/0x180, CPU#6: kworker/6:84/22254
[ 3487.999821] Modules linked in:
[ 3488.001902] CPU: 6 UID: 0 PID: 22254 Comm: kworker/6:84 Tainted: G    B   W           7.1.0-next-20260623+ #88 PREEMPT(lazy)
[ 3488.008289] Tainted: [B]=BAD_PAGE, [W]=WARN
[ 3488.010459] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-debian-1.17.0-1 04/01/2014
[ 3488.014502] Workqueue: ib_cm cm_work_handler
[ 3488.017790] RIP: 0010:kmem_cache_destroy+0x16a/0x180
[ 3488.020662] Code: fd ff 48 8b 3d 2f c0 9c 06 48 89 de 5b 41 5e 5d e9 5b a3 0e 00 48 8d 3d a4 07 12 04 48 8b 53 58 48 c7 c6 91 9d 3e 85 4c 89 f1 <67> 48 0f b9 3a e9 33 ff ff ff 66 66 66 2e 0f 1f 84 00 00 00 00 00
[ 3488.028077] RSP: 0018:ffff888220fc70b8 EFLAGS: 00010202
[ 3488.032038] RAX: 0000000000000001 RBX: ffff88810955e640 RCX: ffffffff822bc079
[ 3488.035742] RDX: ffff88812404ec40 RSI: ffffffff853e9d91 RDI: ffffffff85f7ac50
[ 3488.037830] RBP: 0000000000000001 R08: ffff8883aef3e843 R09: 1ffff11075de7d08
[ 3488.041076] R10: dffffc0000000000 R11: ffffed1075de7d09 R12: 1ffff11024fa6c3c
[ 3488.045376] R13: ffff888127d361e8 R14: ffffffff822bc079 R15: ffff88811ba99538
[ 3488.049073] FS:  0000000000000000(0000) GS:ffff888427e76000(0000) knlGS:0000000000000000
[ 3488.052515] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 3488.054934] CR2: 00007ffcf2d84fd8 CR3: 0000000111d64006 CR4: 0000000000f72ef0
[ 3488.058529] PKRU: 55555554
[ 3488.060542] Call Trace:
[ 3488.061595]  <TASK>
[ 3488.062006]  smbdirect_connection_destroy_mem_pools+0x239/0x300
[ 3488.066041]  ? __pfx_smb_direct_logging_needed+0x10/0x10
[ 3488.068620]  smbdirect_accept_connect_request+0x95c/0x1b80
[ 3488.071594]  ? __pfx_smbdirect_accept_connect_request+0x10/0x10
[ 3488.073218] ksmbd: not allow base filename in rename
[ 3488.074751]  ? do_raw_spin_lock+0x130/0x300
[ 3488.076792] ksmbd: can't change a file to a directory
[ 3488.077942]  ? smbdirect_socket_set_initial_parameters+0x28b/0x6a0
[ 3488.080143]  ? lock_acquire+0x4c/0x270
[ 3488.080747]  ? trace_irq_enable+0x36/0x120
[ 3488.081400]  smbdirect_listen_rdma_event_handler+0x1579/0x1b90
[ 3488.085089]  ? __pfx_smbdirect_listen_rdma_event_handler+0x10/0x10
[ 3488.089333]  ? trace_cm_event_handler+0x51/0x170
[ 3488.092637]  ? __pfx_smbdirect_listen_rdma_event_handler+0x10/0x10
[ 3488.095741]  ? cma_listen_handler+0xf6/0x150
[ 3488.099638]  cma_cm_event_handler+0x9c/0x230
[ 3488.101552]  cma_ib_req_handler+0x2682/0x45d0
[ 3488.104571]  ? __pfx_cma_ib_req_handler+0x10/0x10
[ 3488.106790]  ? __pfx_roce_resolve_route_from_path+0x10/0x10
[ 3488.109799]  ? stack_depot_save_flags+0x34/0x840
[ 3488.112174]  ? __xas_nomem+0xa9/0x410
[ 3488.114217]  ? xas_clear_mark+0x26c/0x4a0
[ 3488.116854]  cm_process_work+0x56/0x3d0
[ 3488.118179]  ? _raw_spin_unlock_irq+0x28/0x50
[ 3488.120034]  cm_work_handler+0x8a0e/0xd000
[ 3488.121677]  ? __pfx_cm_work_handler+0x10/0x10
[ 3488.123682]  ? pwq_dec_nr_in_flight+0xa73/0xdf0
[ 3488.126928]  ? __pfx_pwq_dec_nr_in_flight+0x10/0x10
[ 3488.129390]  ? lock_acquire+0x4c/0x270
[ 3488.131432]  ? process_scheduled_works+0x995/0x13a0
[ 3488.132694] ksmbd: can't change a file to a directory
[ 3488.136702]  ? process_scheduled_works+0x995/0x13a0
[ 3488.140060]  process_scheduled_works+0xa07/0x13a0
[ 3488.143379]  ? __pfx_process_scheduled_works+0x10/0x10
[ 3488.147221]  ? do_raw_spin_lock+0x130/0x300
[ 3488.150790]  ? assign_work+0x3bb/0x5c0
[ 3488.154259]  worker_thread+0x7c9/0xc80
[ 3488.155730]  kthread+0x341/0x430
[ 3488.158309]  ? __pfx_worker_thread+0x10/0x10
[ 3488.160865]  ? __pfx_kthread+0x10/0x10
[ 3488.164384]  ret_from_fork+0x3a8/0x7a0
[ 3488.167020]  ? __pfx_ret_from_fork+0x10/0x10
[ 3488.170050]  ? __switch_to+0xb76/0x1110
[ 3488.171809]  ? __pfx_kthread+0x10/0x10
[ 3488.174955]  ret_from_fork_asm+0x1a/0x30
[ 3488.175605]  </TASK>
[ 3488.176206] irq event stamp: 0
[ 3488.179360] hardirqs last  enabled at (0): [<0000000000000000>] 0x0
[ 3488.186521] hardirqs last disabled at (0): [<ffffffff81684648>] copy_process+0xa08/0x3a10
[ 3488.191889] softirqs last  enabled at (0): [<ffffffff81684648>] copy_process+0xa08/0x3a10
[ 3488.196853] softirqs last disabled at (0): [<0000000000000000>] 0x0
[ 3488.200870] ---[ end trace 0000000000000000 ]---

Found with ksmbdzzer [2], a KSMBD fuzzer that drives libFuzzer with a
kcov-dataflow [1] coverage vector: it folds each instrumented
comparison/argument's runtime operand value together with its PC (the
default arm mixes them as pc⊕val) so that a new operand value at a known
site counts as new coverage.

[1] https://lwn.net/Articles/1077606/
[2] https://github.com/yskzalloc/kcov-dataflow

Fixes: eb3ed1e9048c ("smb: smbdirect: introduce smbdirect_accept_connect_request()")
Signed-off-by: Yunseong Kim <yunseong.kim@est.tech>
Acked-by: Stefan Metzmacher <metze@samba.org>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>

0 files changed, 0 insertions, 0 deletions