Re: [PATCH] ksmbd: take credits lock for SMB1 negotiate accounting

[Ian Bridges]

On Sun, 08 Nov 2026 22:34:09 +0000, Noah Weinberger wrote:
> The SMB1 multi-protocol negotiate path increments
> conn->outstanding_credits outside conn->credits_lock, while every other
> writer of that counter holds the lock.

I can confirm this. smb2_validate_credit_charge(),
smb2_set_rsp_credits() and the release on the send path all update
outstanding_credits under credits_lock. The increment in
ksmbd_verify_smb_message() is the only one outside it. The suggested
change moves it into the critical section that already follows it. The
increment is still returned by smb2_set_rsp_credits() as before.

I also tried to reproduce the issue, with and without the change. After
an SMB1 negotiate, an SMB2 session and a few requests, the counter is
back at 0. Two SMB1 negotiates sent in one write are answered one after
the other. An SMB1 negotiate on a connection that is already on SMB2 is
ignored. This matches your reasoning that the race cannot happen.

Thanks,
Ian