Re: [PATCH] ksmbd: fix AsyncId zeroed before use in smb2_lock() cancel response

On Fri, Jul 17, 2026 at 4:37 PM Gaël Blivet-Bailly
<[email protected]> wrote:
>
> From: Gael Blivet <[email protected]>
>
> release_async_work() zeroes work->async_id before the CANCELLED path
> calls smb2_send_interim_resp(work, STATUS_CANCELLED), which reads
> work->async_id to build the response's AsyncId field. The cancellation
> response for a cancelled blocked-lock request is sent with AsyncId=0
> instead of the id the client received in the original STATUS_PENDING
> response for this request.
>
> Checked against every other release_async_work() call site in this
> file: smb2_read()/smb2_write() don't send a further async response
> afterward (their status goes out on the synchronous path instead), and
> smb2_notify()'s two async paths already transfer the id to a separate
> struct before releasing, so this reordering is scoped to smb2_lock()
> only.
>
> Send the STATUS_CANCELLED response while work->async_id is still valid,
> then release the async work afterward.
>
> Signed-off-by: Gael Blivet <[email protected]>
> Assisted-by: Claude:claude-sonnet-5
Applied it to #ksmbd-for-next-next.
Thanks!