[PATCH] smb: client: handle unmatched encrypted read responses

[Weiming Shi <bestswngs@gmail.com>]

receive_encrypted_read() advertises one MID before decrypting a large
response, but it does not populate the corresponding bufs entry.  When the
response MessageId is not pending, smb2_find_mid() returns NULL.  The demux
thread then passes the empty buffer slot to is_oplock_break(), causing a
NULL pointer dereference.

Initialize the output count to zero.  For an unmatched response, account
the credit grant from the decrypted header and leave it unadvertised.
Publish one entry only after finding a MID.  This avoids sending a partial
linear response through generic unsolicited-message handling.

Cc: stable@vger.kernel.org
Fixes: b24df3e30cbf ("cifs: update receive_encrypted_standard to handle compounded responses")
Reported-by: <co+3a967895833044fc@bugs.sh>
Assisted-by: LLM
Signed-off-by: Weiming Shi <bestswngs@gmail.com>
---
 fs/smb/client/cifsproto.h | 2 ++
 fs/smb/client/connect.c   | 2 +-
 fs/smb/client/smb2ops.c   | 4 +++-
 3 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/fs/smb/client/cifsproto.h b/fs/smb/client/cifsproto.h
index 00168839c..fb181e727 100644
--- a/fs/smb/client/cifsproto.h
+++ b/fs/smb/client/cifsproto.h
@@ -88,6 +88,8 @@ void cifs_wake_up_task(struct TCP_Server_Info *server,
 		       struct mid_q_entry *mid);
 int cifs_handle_standard(struct TCP_Server_Info *server,
 			 struct mid_q_entry *mid);
+void smb2_add_credits_from_hdr(char *buffer,
+			       struct TCP_Server_Info *server);
 char *smb3_fs_context_fullpath(const struct smb3_fs_context *ctx, char dirsep);
 int smb3_parse_devname(const char *devname, struct smb3_fs_context *ctx);
 int cifs_ipaddr_cmp(struct sockaddr *srcaddr, struct sockaddr *rhs);
diff --git a/fs/smb/client/connect.c b/fs/smb/client/connect.c
index b6e98eb31..d47f166e2 100644
--- a/fs/smb/client/connect.c
+++ b/fs/smb/client/connect.c
@@ -1221,7 +1221,7 @@ cifs_handle_standard(struct TCP_Server_Info *server, struct mid_q_entry *mid)
 	return 0;
 }
 
-static void
+void
 smb2_add_credits_from_hdr(char *buffer, struct TCP_Server_Info *server)
 {
 	struct smb2_hdr *shdr = (struct smb2_hdr *)buffer;
diff --git a/fs/smb/client/smb2ops.c b/fs/smb/client/smb2ops.c
index cb4fd09f9..6f75e6620 100644
--- a/fs/smb/client/smb2ops.c
+++ b/fs/smb/client/smb2ops.c
@@ -5236,7 +5236,7 @@ receive_encrypted_read(struct TCP_Server_Info *server, struct mid_q_entry **mid,
 	INIT_WORK(&dw->decrypt, smb2_decrypt_offload);
 	dw->server = server;
 
-	*num_mids = 1;
+	*num_mids = 0;
 	len = min_t(unsigned int, buflen, server->vals->read_rsp_size +
 		sizeof(struct smb2_transform_hdr)) - HEADER_SIZE(server) + 1;
 
@@ -5306,8 +5306,10 @@ receive_encrypted_read(struct TCP_Server_Info *server, struct mid_q_entry **mid,
 	*mid = smb2_find_mid(server, buf);
 	if (*mid == NULL) {
 		cifs_dbg(FYI, "mid not found\n");
+		smb2_add_credits_from_hdr(buf, server);
 	} else {
 		cifs_dbg(FYI, "mid found\n");
+		*num_mids = 1;
 		(*mid)->decrypted = true;
 		rc = handle_read_data(server, *mid, buf,
 				      server->vals->read_rsp_size,
-- 
2.56.0