Re: [PATCH] smb: client: delete compound mids on send failure before unlock

[Paulo Alcantara]

Adarsh Das <adarshdas950@xxxxxxxxx> writes:

> When sending a compound request fails, smb_send_rqst() kicks off a
> reconnect. compound_send_recv() still has those mids on pending_mid_q,
> but it unlocks the server without removing them first.
>
> During reconnect, cifs_abort_connection() walks pending_mid_q and runs
> each mid callback. With no response yet, those callbacks return credits
> and drop in_flight. Then compound_send_recv()'s send-error path returns
> the same credits again. in_flight ends up decremented twice and
> smb2_add_credits() WARNs.
>
> syzbot hits this during SMB2_negotiate when the socket send fails.
>
> cifs_call_async() already calls delete_mid() before unlock on send
> failure. Do the same for compound chains and set cancelled_mid[] so the
> out: path does not delete them again.
> ...

Applied.