[RFC] cifs: Fix credit handling in cifs_io_subrequest cleanup

When a cifs_io_subrequest (wrapping a netfs_io_subrequest) is cleaned up in
cifs_free_subrequest(), it releases any credits that are left in
rdata->credits.  However, this is a problem because smb2_writev_callback()
calls add_credits() to add the new credits from the response header
CreditRequest to the available pool.

This can cause a warning to be emitted in smb2_add_credits() as
server->in_flight gets doubly decremented and a later operation sees it
having prematurely reached 0.

Fix this by clearing the credit count after actually issuing the request on
the assumption that we've given the credits back to the server (it will
give us new credits in the reply).

Signed-off-by: David Howells <dhowells@redhat.com>
cc: Steve French <sfrench@samba.org>
cc: Paulo Alcantara <pc@manguebit.com>
cc: Shyam Prasad N <nspmangalore@gmail.com>
cc: Rohith Surabattula <rohiths.msft@gmail.com>
cc: Jeff Layton <jlayton@kernel.org>
cc: linux-cifs@vger.kernel.org
cc: netfs@lists.linux.dev
cc: linux-fsdevel@vger.kernel.org
---
 fs/smb/client/file.c |    7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

On 5/22/2024 6:59 PM, David Howells wrote:
>      
> When a cifs_io_subrequest (wrapping a netfs_io_subrequest) is cleaned up in
> cifs_free_subrequest(), it releases any credits that are left in
> rdata->credits.  However, this is a problem because smb2_writev_callback()
> calls add_credits() to add the new credits from the response header
> CreditRequest to the available pool.
> 
> This can cause a warning to be emitted in smb2_add_credits() as
> server->in_flight gets doubly decremented and a later operation sees it
> having prematurely reached 0.
> 
> Fix this by clearing the credit count after actually issuing the request on
> the assumption that we've given the credits back to the server (it will
> give us new credits in the reply).

 From a protocol standpoint it's correct to reserve the credits while the
operation is in flight. But from a code standpoint it seems risky to
stop accounting for them. What if the operation is canceled, or times
out?

I'd quibble with the assertion that the server will "give us new credits
in the response". The number of granted credits is always the server's
decision, not guaranteed by the protocol (except for certain edge
conditions).

I guess I'd suggest a deeper review by someone familiar with the
mechanics of fs/smb/client credit accounting. It might be ok!

Tom.

> Signed-off-by: David Howells <dhowells@redhat.com>
> cc: Steve French <sfrench@samba.org>
> cc: Paulo Alcantara <pc@manguebit.com>
> cc: Shyam Prasad N <nspmangalore@gmail.com>
> cc: Rohith Surabattula <rohiths.msft@gmail.com>
> cc: Jeff Layton <jlayton@kernel.org>
> cc: linux-cifs@vger.kernel.org
> cc: netfs@lists.linux.dev
> cc: linux-fsdevel@vger.kernel.org
> ---
>   fs/smb/client/file.c |    7 +++++--
>   1 file changed, 5 insertions(+), 2 deletions(-)
> 
> diff --git a/fs/smb/client/file.c b/fs/smb/client/file.c
> index 9d5c2440abfc..73e2765c4d2f 100644
> --- a/fs/smb/client/file.c
> +++ b/fs/smb/client/file.c
> @@ -110,6 +110,7 @@ static void cifs_issue_write(struct netfs_io_subrequest *subreq)
>   		goto fail;
>   
>   	wdata->server->ops->async_writev(wdata);
> +	wdata->credits.value = 0;
>   out:
>   	return;
>   
> @@ -205,10 +206,12 @@ static void cifs_req_issue_read(struct netfs_io_subrequest *subreq)
>   
>   	rc = adjust_credits(rdata->server, &rdata->credits, rdata->subreq.len);
>   	if (!rc) {
> -		if (rdata->req->cfile->invalidHandle)
> +		if (rdata->req->cfile->invalidHandle) {
>   			rc = -EAGAIN;
> -		else
> +		} else {
>   			rc = rdata->server->ops->async_readv(rdata);
> +			rdata->credits.value = 0;
> +		}
>   	}
>   
>   out:
> 
> 
>

Tom Talpey <tom@talpey.com> wrote:

> From a protocol standpoint it's correct to reserve the credits while the
> operation is in flight. But from a code standpoint it seems risky to
> stop accounting for them. What if the operation is canceled, or times
> out?

No idea, TBH - SMB credits wrangling isn't my area of expertise.  Note the
patch is superfluous as smb2_readv/writev_callback() clear the credits at the
end; worse, it's actually wrong as we're not allowed to touch [rw]data after
calling ->async_readv()/->async_writev().

> I'd quibble with the assertion that the server will "give us new credits
> in the response". The number of granted credits is always the server's
> decision, not guaranteed by the protocol (except for certain edge
> conditions).

It does give us new credits in the response, doesn't it?  In
hdr.CreditRequest - though I suppose this could be zero.

> I guess I'd suggest a deeper review by someone familiar with the
> mechanics of fs/smb/client credit accounting. It might be ok!

I've given Steve a patch to try and find where the double add occurs.

David

On 5/23/2024 10:52 AM, David Howells wrote:
> Tom Talpey <tom@talpey.com> wrote:
> 
>>  From a protocol standpoint it's correct to reserve the credits while the
>> operation is in flight. But from a code standpoint it seems risky to
>> stop accounting for them. What if the operation is canceled, or times
>> out?
> 
> No idea, TBH - SMB credits wrangling isn't my area of expertise.  Note the
> patch is superfluous as smb2_readv/writev_callback() clear the credits at the
> end; worse, it's actually wrong as we're not allowed to touch [rw]data after
> calling ->async_readv()/->async_writev().
> 
>> I'd quibble with the assertion that the server will "give us new credits
>> in the response". The number of granted credits is always the server's
>> decision, not guaranteed by the protocol (except for certain edge
>> conditions).
> 
> It does give us new credits in the response, doesn't it?  In
> hdr.CreditRequest - though I suppose this could be zero.

Yes, credits are consumed by requests and replenished in responses. One
credit is needed for any request or response, plus one credit per 64KB
chunk of payload (read, write, etc).

The value in hdr.CreditRequest is a hint when sent in a request, and
a small-ish integer, very possibly zero, in a response. Often, it
replenishes the credits consumed by the request it matches, but it can
be higher or lower at the server's choice. And it can be sent in any
response, before or after the one you might expect.

Tom.

>> I guess I'd suggest a deeper review by someone familiar with the
>> mechanics of fs/smb/client credit accounting. It might be ok!
> 
> I've given Steve a patch to try and find where the double add occurs.
> 
> David
> 
>