Skip to content

Commit 0fb8b27

Browse files
pcacjrpcacjr
committed
smb: client: rename server mid_lock to mid_queue_lock
JIRA: https://issues.redhat.com/browse/RHEL-109507 commit f3ba7c9 Author: Wang Zhaolong <wangzhaolong@huaweicloud.com> Date: Mon Aug 4 21:40:03 2025 +0800 smb: client: rename server mid_lock to mid_queue_lock This is step 1/4 of a patch series to fix mid_q_entry memory leaks caused by race conditions in callback execution. The current mid_lock name is somewhat ambiguous about what it protects. To prepare for splitting this lock into separate, more granular locks, this patch renames mid_lock to mid_queue_lock to clearly indicate its specific responsibility for protecting the pending_mid_q list and related queue operations. No functional changes are made in this patch - it only prepares the codebase for the lock splitting that follows. - mid_queue_lock for queue operations - mid_counter_lock for mid counter operations - per-mid locks for individual mid state management Signed-off-by: Wang Zhaolong <wangzhaolong@huaweicloud.com> Acked-by: Enzo Matsumiya <ematsumiya@suse.de> Signed-off-by: Steve French <stfrench@microsoft.com> Signed-off-by: Paulo Alcantara <paalcant@redhat.com>
1 parent 449b26b commit 0fb8b27

File tree

7 files changed

+54
-54
lines changed

7 files changed

+54
-54
lines changed

‎fs/smb/client/cifs_debug.c‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -60,7 +60,7 @@ void cifs_dump_mids(struct TCP_Server_Info *server)
6060
return;
6161

6262
cifs_dbg(VFS, "Dump pending requests:\n");
63-
spin_lock(&server->mid_lock);
63+
spin_lock(&server->mid_queue_lock);
6464
list_for_each_entry(mid_entry, &server->pending_mid_q, qhead) {
6565
cifs_dbg(VFS, "State: %d Cmd: %d Pid: %d Cbdata: %p Mid %llu\n",
6666
mid_entry->mid_state,
@@ -83,7 +83,7 @@ void cifs_dump_mids(struct TCP_Server_Info *server)
8383
mid_entry->resp_buf, 62);
8484
}
8585
}
86-
spin_unlock(&server->mid_lock);
86+
spin_unlock(&server->mid_queue_lock);
8787
#endif /* CONFIG_CIFS_DEBUG2 */
8888
}
8989

@@ -667,7 +667,7 @@ static int cifs_debug_data_proc_show(struct seq_file *m, void *v)
667667

668668
seq_printf(m, "\n\tServer ConnectionId: 0x%llx",
669669
chan_server->conn_id);
670-
spin_lock(&chan_server->mid_lock);
670+
spin_lock(&chan_server->mid_queue_lock);
671671
list_for_each_entry(mid_entry, &chan_server->pending_mid_q, qhead) {
672672
seq_printf(m, "\n\t\tState: %d com: %d pid: %d cbdata: %p mid %llu",
673673
mid_entry->mid_state,
@@ -676,7 +676,7 @@ static int cifs_debug_data_proc_show(struct seq_file *m, void *v)
676676
mid_entry->callback_data,
677677
mid_entry->mid);
678678
}
679-
spin_unlock(&chan_server->mid_lock);
679+
spin_unlock(&chan_server->mid_queue_lock);
680680
}
681681
spin_unlock(&ses->chan_lock);
682682
seq_puts(m, "\n--\n");

‎fs/smb/client/cifsglob.h‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -737,7 +737,7 @@ struct TCP_Server_Info {
737737
#endif
738738
wait_queue_head_t response_q;
739739
wait_queue_head_t request_q; /* if more than maxmpx to srvr must block*/
740-
spinlock_t mid_lock; /* protect mid queue and it's entries */
740+
spinlock_t mid_queue_lock; /* protect mid queue */
741741
struct list_head pending_mid_q;
742742
bool noblocksnd; /* use blocking sendmsg */
743743
bool noautotune; /* do not autotune send buf sizes */
@@ -2064,7 +2064,7 @@ require use of the stronger protocol */
20642064
* GlobalCurrentXid
20652065
* GlobalTotalActiveXid
20662066
* TCP_Server_Info->srv_lock (anything in struct not protected by another lock and can change)
2067-
* TCP_Server_Info->mid_lock TCP_Server_Info->pending_mid_q cifs_get_tcp_session
2067+
* TCP_Server_Info->mid_queue_lock TCP_Server_Info->pending_mid_q cifs_get_tcp_session
20682068
* ->CurrentMid
20692069
* (any changes in mid_q_entry fields)
20702070
* TCP_Server_Info->req_lock TCP_Server_Info->in_flight cifs_get_tcp_session

‎fs/smb/client/connect.c‎

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -321,15 +321,15 @@ cifs_abort_connection(struct TCP_Server_Info *server)
321321
/* mark submitted MIDs for retry and issue callback */
322322
INIT_LIST_HEAD(&retry_list);
323323
cifs_dbg(FYI, "%s: moving mids to private list\n", __func__);
324-
spin_lock(&server->mid_lock);
324+
spin_lock(&server->mid_queue_lock);
325325
list_for_each_entry_safe(mid, nmid, &server->pending_mid_q, qhead) {
326326
kref_get(&mid->refcount);
327327
if (mid->mid_state == MID_REQUEST_SUBMITTED)
328328
mid->mid_state = MID_RETRY_NEEDED;
329329
list_move(&mid->qhead, &retry_list);
330330
mid->mid_flags |= MID_DELETED;
331331
}
332-
spin_unlock(&server->mid_lock);
332+
spin_unlock(&server->mid_queue_lock);
333333
cifs_server_unlock(server);
334334

335335
cifs_dbg(FYI, "%s: issuing mid callbacks\n", __func__);
@@ -886,13 +886,13 @@ is_smb_response(struct TCP_Server_Info *server, unsigned char type)
886886
* server there should be exactly one pending mid
887887
* corresponding to SMB1/SMB2 Negotiate packet.
888888
*/
889-
spin_lock(&server->mid_lock);
889+
spin_lock(&server->mid_queue_lock);
890890
list_for_each_entry_safe(mid, nmid, &server->pending_mid_q, qhead) {
891891
kref_get(&mid->refcount);
892892
list_move(&mid->qhead, &dispose_list);
893893
mid->mid_flags |= MID_DELETED;
894894
}
895-
spin_unlock(&server->mid_lock);
895+
spin_unlock(&server->mid_queue_lock);
896896

897897
/* Now try to reconnect once with NetBIOS session. */
898898
server->with_rfc1001 = true;
@@ -959,7 +959,7 @@ dequeue_mid(struct mid_q_entry *mid, bool malformed)
959959
#ifdef CONFIG_CIFS_STATS2
960960
mid->when_received = jiffies;
961961
#endif
962-
spin_lock(&mid->server->mid_lock);
962+
spin_lock(&mid->server->mid_queue_lock);
963963
if (!malformed)
964964
mid->mid_state = MID_RESPONSE_RECEIVED;
965965
else
@@ -969,12 +969,12 @@ dequeue_mid(struct mid_q_entry *mid, bool malformed)
969969
* function has finished processing it is a bug.
970970
*/
971971
if (mid->mid_flags & MID_DELETED) {
972-
spin_unlock(&mid->server->mid_lock);
972+
spin_unlock(&mid->server->mid_queue_lock);
973973
pr_warn_once("trying to dequeue a deleted mid\n");
974974
} else {
975975
list_del_init(&mid->qhead);
976976
mid->mid_flags |= MID_DELETED;
977-
spin_unlock(&mid->server->mid_lock);
977+
spin_unlock(&mid->server->mid_queue_lock);
978978
}
979979
}
980980

@@ -1103,7 +1103,7 @@ clean_demultiplex_info(struct TCP_Server_Info *server)
11031103
struct list_head *tmp, *tmp2;
11041104
LIST_HEAD(dispose_list);
11051105

1106-
spin_lock(&server->mid_lock);
1106+
spin_lock(&server->mid_queue_lock);
11071107
list_for_each_safe(tmp, tmp2, &server->pending_mid_q) {
11081108
mid_entry = list_entry(tmp, struct mid_q_entry, qhead);
11091109
cifs_dbg(FYI, "Clearing mid %llu\n", mid_entry->mid);
@@ -1112,7 +1112,7 @@ clean_demultiplex_info(struct TCP_Server_Info *server)
11121112
list_move(&mid_entry->qhead, &dispose_list);
11131113
mid_entry->mid_flags |= MID_DELETED;
11141114
}
1115-
spin_unlock(&server->mid_lock);
1115+
spin_unlock(&server->mid_queue_lock);
11161116

11171117
/* now walk dispose list and issue callbacks */
11181118
list_for_each_safe(tmp, tmp2, &dispose_list) {
@@ -1824,7 +1824,7 @@ cifs_get_tcp_session(struct smb3_fs_context *ctx,
18241824
tcp_ses->compression.requested = ctx->compress;
18251825
spin_lock_init(&tcp_ses->req_lock);
18261826
spin_lock_init(&tcp_ses->srv_lock);
1827-
spin_lock_init(&tcp_ses->mid_lock);
1827+
spin_lock_init(&tcp_ses->mid_queue_lock);
18281828
INIT_LIST_HEAD(&tcp_ses->tcp_ses_list);
18291829
INIT_LIST_HEAD(&tcp_ses->smb_ses_list);
18301830
INIT_DELAYED_WORK(&tcp_ses->echo, cifs_echo_request);

‎fs/smb/client/smb1ops.c‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -95,17 +95,17 @@ cifs_find_mid(struct TCP_Server_Info *server, char *buffer)
9595
struct smb_hdr *buf = (struct smb_hdr *)buffer;
9696
struct mid_q_entry *mid;
9797

98-
spin_lock(&server->mid_lock);
98+
spin_lock(&server->mid_queue_lock);
9999
list_for_each_entry(mid, &server->pending_mid_q, qhead) {
100100
if (compare_mid(mid->mid, buf) &&
101101
mid->mid_state == MID_REQUEST_SUBMITTED &&
102102
le16_to_cpu(mid->command) == buf->Command) {
103103
kref_get(&mid->refcount);
104-
spin_unlock(&server->mid_lock);
104+
spin_unlock(&server->mid_queue_lock);
105105
return mid;
106106
}
107107
}
108-
spin_unlock(&server->mid_lock);
108+
spin_unlock(&server->mid_queue_lock);
109109
return NULL;
110110
}
111111

@@ -169,7 +169,7 @@ cifs_get_next_mid(struct TCP_Server_Info *server)
169169
__u16 last_mid, cur_mid;
170170
bool collision, reconnect = false;
171171

172-
spin_lock(&server->mid_lock);
172+
spin_lock(&server->mid_queue_lock);
173173

174174
/* mid is 16 bit only for CIFS/SMB */
175175
cur_mid = (__u16)((server->CurrentMid) & 0xffff);
@@ -228,7 +228,7 @@ cifs_get_next_mid(struct TCP_Server_Info *server)
228228
}
229229
cur_mid++;
230230
}
231-
spin_unlock(&server->mid_lock);
231+
spin_unlock(&server->mid_queue_lock);
232232

233233
if (reconnect) {
234234
cifs_signal_cifsd_for_reconnect(server, false);

‎fs/smb/client/smb2ops.c‎

Lines changed: 13 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -338,19 +338,19 @@ smb2_get_next_mid(struct TCP_Server_Info *server)
338338
{
339339
__u64 mid;
340340
/* for SMB2 we need the current value */
341-
spin_lock(&server->mid_lock);
341+
spin_lock(&server->mid_queue_lock);
342342
mid = server->CurrentMid++;
343-
spin_unlock(&server->mid_lock);
343+
spin_unlock(&server->mid_queue_lock);
344344
return mid;
345345
}
346346

347347
static void
348348
smb2_revert_current_mid(struct TCP_Server_Info *server, const unsigned int val)
349349
{
350-
spin_lock(&server->mid_lock);
350+
spin_lock(&server->mid_queue_lock);
351351
if (server->CurrentMid >= val)
352352
server->CurrentMid -= val;
353-
spin_unlock(&server->mid_lock);
353+
spin_unlock(&server->mid_queue_lock);
354354
}
355355

356356
static struct mid_q_entry *
@@ -365,7 +365,7 @@ __smb2_find_mid(struct TCP_Server_Info *server, char *buf, bool dequeue)
365365
return NULL;
366366
}
367367

368-
spin_lock(&server->mid_lock);
368+
spin_lock(&server->mid_queue_lock);
369369
list_for_each_entry(mid, &server->pending_mid_q, qhead) {
370370
if ((mid->mid == wire_mid) &&
371371
(mid->mid_state == MID_REQUEST_SUBMITTED) &&
@@ -375,11 +375,11 @@ __smb2_find_mid(struct TCP_Server_Info *server, char *buf, bool dequeue)
375375
list_del_init(&mid->qhead);
376376
mid->mid_flags |= MID_DELETED;
377377
}
378-
spin_unlock(&server->mid_lock);
378+
spin_unlock(&server->mid_queue_lock);
379379
return mid;
380380
}
381381
}
382-
spin_unlock(&server->mid_lock);
382+
spin_unlock(&server->mid_queue_lock);
383383
return NULL;
384384
}
385385

@@ -424,9 +424,9 @@ smb2_negotiate(const unsigned int xid,
424424
{
425425
int rc;
426426

427-
spin_lock(&server->mid_lock);
427+
spin_lock(&server->mid_queue_lock);
428428
server->CurrentMid = 0;
429-
spin_unlock(&server->mid_lock);
429+
spin_unlock(&server->mid_queue_lock);
430430
rc = SMB2_negotiate(xid, ses, server);
431431
return rc;
432432
}
@@ -4745,18 +4745,18 @@ static void smb2_decrypt_offload(struct work_struct *work)
47454745
} else {
47464746
spin_lock(&dw->server->srv_lock);
47474747
if (dw->server->tcpStatus == CifsNeedReconnect) {
4748-
spin_lock(&dw->server->mid_lock);
4748+
spin_lock(&dw->server->mid_queue_lock);
47494749
mid->mid_state = MID_RETRY_NEEDED;
4750-
spin_unlock(&dw->server->mid_lock);
4750+
spin_unlock(&dw->server->mid_queue_lock);
47514751
spin_unlock(&dw->server->srv_lock);
47524752
mid->callback(mid);
47534753
} else {
4754-
spin_lock(&dw->server->mid_lock);
4754+
spin_lock(&dw->server->mid_queue_lock);
47554755
mid->mid_state = MID_REQUEST_SUBMITTED;
47564756
mid->mid_flags &= ~(MID_DELETED);
47574757
list_add_tail(&mid->qhead,
47584758
&dw->server->pending_mid_q);
4759-
spin_unlock(&dw->server->mid_lock);
4759+
spin_unlock(&dw->server->mid_queue_lock);
47604760
spin_unlock(&dw->server->srv_lock);
47614761
}
47624762
}

‎fs/smb/client/smb2transport.c‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -840,9 +840,9 @@ smb2_get_mid_entry(struct cifs_ses *ses, struct TCP_Server_Info *server,
840840
*mid = smb2_mid_entry_alloc(shdr, server);
841841
if (*mid == NULL)
842842
return -ENOMEM;
843-
spin_lock(&server->mid_lock);
843+
spin_lock(&server->mid_queue_lock);
844844
list_add_tail(&(*mid)->qhead, &server->pending_mid_q);
845-
spin_unlock(&server->mid_lock);
845+
spin_unlock(&server->mid_queue_lock);
846846

847847
return 0;
848848
}

‎fs/smb/client/transport.c‎

Lines changed: 18 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -160,12 +160,12 @@ void __release_mid(struct kref *refcount)
160160
void
161161
delete_mid(struct mid_q_entry *mid)
162162
{
163-
spin_lock(&mid->server->mid_lock);
163+
spin_lock(&mid->server->mid_queue_lock);
164164
if (!(mid->mid_flags & MID_DELETED)) {
165165
list_del_init(&mid->qhead);
166166
mid->mid_flags |= MID_DELETED;
167167
}
168-
spin_unlock(&mid->server->mid_lock);
168+
spin_unlock(&mid->server->mid_queue_lock);
169169

170170
release_mid(mid);
171171
}
@@ -743,9 +743,9 @@ static int allocate_mid(struct cifs_ses *ses, struct smb_hdr *in_buf,
743743
*ppmidQ = alloc_mid(in_buf, ses->server);
744744
if (*ppmidQ == NULL)
745745
return -ENOMEM;
746-
spin_lock(&ses->server->mid_lock);
746+
spin_lock(&ses->server->mid_queue_lock);
747747
list_add_tail(&(*ppmidQ)->qhead, &ses->server->pending_mid_q);
748-
spin_unlock(&ses->server->mid_lock);
748+
spin_unlock(&ses->server->mid_queue_lock);
749749
return 0;
750750
}
751751

@@ -846,9 +846,9 @@ cifs_call_async(struct TCP_Server_Info *server, struct smb_rqst *rqst,
846846
mid->mid_state = MID_REQUEST_SUBMITTED;
847847

848848
/* put it on the pending_mid_q */
849-
spin_lock(&server->mid_lock);
849+
spin_lock(&server->mid_queue_lock);
850850
list_add_tail(&mid->qhead, &server->pending_mid_q);
851-
spin_unlock(&server->mid_lock);
851+
spin_unlock(&server->mid_queue_lock);
852852

853853
/*
854854
* Need to store the time in mid before calling I/O. For call_async,
@@ -907,10 +907,10 @@ cifs_sync_mid_result(struct mid_q_entry *mid, struct TCP_Server_Info *server)
907907
cifs_dbg(FYI, "%s: cmd=%d mid=%llu state=%d\n",
908908
__func__, le16_to_cpu(mid->command), mid->mid, mid->mid_state);
909909

910-
spin_lock(&server->mid_lock);
910+
spin_lock(&server->mid_queue_lock);
911911
switch (mid->mid_state) {
912912
case MID_RESPONSE_READY:
913-
spin_unlock(&server->mid_lock);
913+
spin_unlock(&server->mid_queue_lock);
914914
return rc;
915915
case MID_RETRY_NEEDED:
916916
rc = -EAGAIN;
@@ -929,13 +929,13 @@ cifs_sync_mid_result(struct mid_q_entry *mid, struct TCP_Server_Info *server)
929929
list_del_init(&mid->qhead);
930930
mid->mid_flags |= MID_DELETED;
931931
}
932-
spin_unlock(&server->mid_lock);
932+
spin_unlock(&server->mid_queue_lock);
933933
cifs_server_dbg(VFS, "%s: invalid mid state mid=%llu state=%d\n",
934934
__func__, mid->mid, mid->mid_state);
935935
rc = -EIO;
936936
goto sync_mid_done;
937937
}
938-
spin_unlock(&server->mid_lock);
938+
spin_unlock(&server->mid_queue_lock);
939939

940940
sync_mid_done:
941941
release_mid(mid);
@@ -1240,15 +1240,15 @@ compound_send_recv(const unsigned int xid, struct cifs_ses *ses,
12401240
cifs_server_dbg(FYI, "Cancelling wait for mid %llu cmd: %d\n",
12411241
midQ[i]->mid, le16_to_cpu(midQ[i]->command));
12421242
send_cancel(server, &rqst[i], midQ[i]);
1243-
spin_lock(&server->mid_lock);
1243+
spin_lock(&server->mid_queue_lock);
12441244
midQ[i]->mid_flags |= MID_WAIT_CANCELLED;
12451245
if (midQ[i]->mid_state == MID_REQUEST_SUBMITTED ||
12461246
midQ[i]->mid_state == MID_RESPONSE_RECEIVED) {
12471247
midQ[i]->callback = cifs_cancelled_callback;
12481248
cancelled_mid[i] = true;
12491249
credits[i].value = 0;
12501250
}
1251-
spin_unlock(&server->mid_lock);
1251+
spin_unlock(&server->mid_queue_lock);
12521252
}
12531253
}
12541254

@@ -1450,16 +1450,16 @@ SendReceive(const unsigned int xid, struct cifs_ses *ses,
14501450
rc = wait_for_response(server, midQ);
14511451
if (rc != 0) {
14521452
send_cancel(server, &rqst, midQ);
1453-
spin_lock(&server->mid_lock);
1453+
spin_lock(&server->mid_queue_lock);
14541454
if (midQ->mid_state == MID_REQUEST_SUBMITTED ||
14551455
midQ->mid_state == MID_RESPONSE_RECEIVED) {
14561456
/* no longer considered to be "in-flight" */
14571457
midQ->callback = release_mid;
1458-
spin_unlock(&server->mid_lock);
1458+
spin_unlock(&server->mid_queue_lock);
14591459
add_credits(server, &credits, 0);
14601460
return rc;
14611461
}
1462-
spin_unlock(&server->mid_lock);
1462+
spin_unlock(&server->mid_queue_lock);
14631463
}
14641464

14651465
rc = cifs_sync_mid_result(midQ, server);
@@ -1632,15 +1632,15 @@ SendReceiveBlockingLock(const unsigned int xid, struct cifs_tcon *tcon,
16321632
rc = wait_for_response(server, midQ);
16331633
if (rc) {
16341634
send_cancel(server, &rqst, midQ);
1635-
spin_lock(&server->mid_lock);
1635+
spin_lock(&server->mid_queue_lock);
16361636
if (midQ->mid_state == MID_REQUEST_SUBMITTED ||
16371637
midQ->mid_state == MID_RESPONSE_RECEIVED) {
16381638
/* no longer considered to be "in-flight" */
16391639
midQ->callback = release_mid;
1640-
spin_unlock(&server->mid_lock);
1640+
spin_unlock(&server->mid_queue_lock);
16411641
return rc;
16421642
}
1643-
spin_unlock(&server->mid_lock);
1643+
spin_unlock(&server->mid_queue_lock);
16441644
}
16451645

16461646
/* We got the response - restart system call. */

0 commit comments

Comments
 (0)