1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /*
3 * Copyright (C) 2018 Samsung Electronics Co., Ltd.
4 */
5
6 #include <linux/list.h>
7 #include <linux/slab.h>
8 #include <linux/rwsem.h>
9 #include <linux/xarray.h>
10
11 #include "ksmbd_ida.h"
12 #include "user_session.h"
13 #include "user_config.h"
14 #include "tree_connect.h"
15 #include "../transport_ipc.h"
16 #include "../connection.h"
17 #include "../vfs_cache.h"
18
19 static DEFINE_IDA(session_ida);
20
21 #define SESSION_HASH_BITS 3
22 static DEFINE_HASHTABLE(sessions_table, SESSION_HASH_BITS);
23 static DECLARE_RWSEM(sessions_table_lock);
24
25 struct ksmbd_session_rpc {
26 int id;
27 unsigned int method;
28 };
29
free_channel_list(struct ksmbd_session * sess)30 static void free_channel_list(struct ksmbd_session *sess)
31 {
32 struct channel *chann;
33 unsigned long index;
34
35 xa_for_each(&sess->ksmbd_chann_list, index, chann) {
36 xa_erase(&sess->ksmbd_chann_list, index);
37 kfree(chann);
38 }
39
40 xa_destroy(&sess->ksmbd_chann_list);
41 }
42
__session_rpc_close(struct ksmbd_session * sess,struct ksmbd_session_rpc * entry)43 static void __session_rpc_close(struct ksmbd_session *sess,
44 struct ksmbd_session_rpc *entry)
45 {
46 struct ksmbd_rpc_command *resp;
47
48 resp = ksmbd_rpc_close(sess, entry->id);
49 if (!resp)
50 pr_err("Unable to close RPC pipe %d\n", entry->id);
51
52 kvfree(resp);
53 ksmbd_rpc_id_free(entry->id);
54 kfree(entry);
55 }
56
ksmbd_session_rpc_clear_list(struct ksmbd_session * sess)57 static void ksmbd_session_rpc_clear_list(struct ksmbd_session *sess)
58 {
59 struct ksmbd_session_rpc *entry;
60 long index;
61
62 xa_for_each(&sess->rpc_handle_list, index, entry) {
63 xa_erase(&sess->rpc_handle_list, index);
64 __session_rpc_close(sess, entry);
65 }
66
67 xa_destroy(&sess->rpc_handle_list);
68 }
69
__rpc_method(char * rpc_name)70 static int __rpc_method(char *rpc_name)
71 {
72 if (!strcmp(rpc_name, "\\srvsvc") || !strcmp(rpc_name, "srvsvc"))
73 return KSMBD_RPC_SRVSVC_METHOD_INVOKE;
74
75 if (!strcmp(rpc_name, "\\wkssvc") || !strcmp(rpc_name, "wkssvc"))
76 return KSMBD_RPC_WKSSVC_METHOD_INVOKE;
77
78 if (!strcmp(rpc_name, "LANMAN") || !strcmp(rpc_name, "lanman"))
79 return KSMBD_RPC_RAP_METHOD;
80
81 if (!strcmp(rpc_name, "\\samr") || !strcmp(rpc_name, "samr"))
82 return KSMBD_RPC_SAMR_METHOD_INVOKE;
83
84 if (!strcmp(rpc_name, "\\lsarpc") || !strcmp(rpc_name, "lsarpc"))
85 return KSMBD_RPC_LSARPC_METHOD_INVOKE;
86
87 pr_err("Unsupported RPC: %s\n", rpc_name);
88 return 0;
89 }
90
ksmbd_session_rpc_open(struct ksmbd_session * sess,char * rpc_name)91 int ksmbd_session_rpc_open(struct ksmbd_session *sess, char *rpc_name)
92 {
93 struct ksmbd_session_rpc *entry;
94 struct ksmbd_rpc_command *resp;
95 int method;
96
97 method = __rpc_method(rpc_name);
98 if (!method)
99 return -EINVAL;
100
101 entry = kzalloc(sizeof(struct ksmbd_session_rpc), GFP_KERNEL);
102 if (!entry)
103 return -ENOMEM;
104
105 entry->method = method;
106 entry->id = ksmbd_ipc_id_alloc();
107 if (entry->id < 0)
108 goto free_entry;
109 xa_store(&sess->rpc_handle_list, entry->id, entry, GFP_KERNEL);
110
111 resp = ksmbd_rpc_open(sess, entry->id);
112 if (!resp)
113 goto free_id;
114
115 kvfree(resp);
116 return entry->id;
117 free_id:
118 xa_erase(&sess->rpc_handle_list, entry->id);
119 ksmbd_rpc_id_free(entry->id);
120 free_entry:
121 kfree(entry);
122 return -EINVAL;
123 }
124
ksmbd_session_rpc_close(struct ksmbd_session * sess,int id)125 void ksmbd_session_rpc_close(struct ksmbd_session *sess, int id)
126 {
127 struct ksmbd_session_rpc *entry;
128
129 entry = xa_erase(&sess->rpc_handle_list, id);
130 if (entry)
131 __session_rpc_close(sess, entry);
132 }
133
ksmbd_session_rpc_method(struct ksmbd_session * sess,int id)134 int ksmbd_session_rpc_method(struct ksmbd_session *sess, int id)
135 {
136 struct ksmbd_session_rpc *entry;
137
138 entry = xa_load(&sess->rpc_handle_list, id);
139 return entry ? entry->method : 0;
140 }
141
ksmbd_session_destroy(struct ksmbd_session * sess)142 void ksmbd_session_destroy(struct ksmbd_session *sess)
143 {
144 if (!sess)
145 return;
146
147 if (sess->user)
148 ksmbd_free_user(sess->user);
149
150 ksmbd_tree_conn_session_logoff(sess);
151 ksmbd_destroy_file_table(&sess->file_table);
152 ksmbd_launch_ksmbd_durable_scavenger();
153 ksmbd_session_rpc_clear_list(sess);
154 free_channel_list(sess);
155 kfree(sess->Preauth_HashValue);
156 ksmbd_release_id(&session_ida, sess->id);
157 kfree(sess);
158 }
159
__session_lookup(unsigned long long id)160 struct ksmbd_session *__session_lookup(unsigned long long id)
161 {
162 struct ksmbd_session *sess;
163
164 hash_for_each_possible(sessions_table, sess, hlist, id) {
165 if (id == sess->id) {
166 sess->last_active = jiffies;
167 return sess;
168 }
169 }
170 return NULL;
171 }
172
ksmbd_expire_session(struct ksmbd_conn * conn)173 static void ksmbd_expire_session(struct ksmbd_conn *conn)
174 {
175 unsigned long id;
176 struct ksmbd_session *sess;
177
178 down_write(&conn->session_lock);
179 xa_for_each(&conn->sessions, id, sess) {
180 if (sess->state != SMB2_SESSION_VALID ||
181 time_after(jiffies,
182 sess->last_active + SMB2_SESSION_TIMEOUT)) {
183 xa_erase(&conn->sessions, sess->id);
184 hash_del(&sess->hlist);
185 ksmbd_session_destroy(sess);
186 continue;
187 }
188 }
189 up_write(&conn->session_lock);
190 }
191
ksmbd_session_register(struct ksmbd_conn * conn,struct ksmbd_session * sess)192 int ksmbd_session_register(struct ksmbd_conn *conn,
193 struct ksmbd_session *sess)
194 {
195 sess->dialect = conn->dialect;
196 memcpy(sess->ClientGUID, conn->ClientGUID, SMB2_CLIENT_GUID_SIZE);
197 ksmbd_expire_session(conn);
198 return xa_err(xa_store(&conn->sessions, sess->id, sess, GFP_KERNEL));
199 }
200
ksmbd_chann_del(struct ksmbd_conn * conn,struct ksmbd_session * sess)201 static int ksmbd_chann_del(struct ksmbd_conn *conn, struct ksmbd_session *sess)
202 {
203 struct channel *chann;
204
205 chann = xa_erase(&sess->ksmbd_chann_list, (long)conn);
206 if (!chann)
207 return -ENOENT;
208
209 kfree(chann);
210 return 0;
211 }
212
ksmbd_sessions_deregister(struct ksmbd_conn * conn)213 void ksmbd_sessions_deregister(struct ksmbd_conn *conn)
214 {
215 struct ksmbd_session *sess;
216 unsigned long id;
217
218 down_write(&sessions_table_lock);
219 if (conn->binding) {
220 int bkt;
221 struct hlist_node *tmp;
222
223 hash_for_each_safe(sessions_table, bkt, tmp, sess, hlist) {
224 if (!ksmbd_chann_del(conn, sess) &&
225 xa_empty(&sess->ksmbd_chann_list)) {
226 hash_del(&sess->hlist);
227 ksmbd_session_destroy(sess);
228 }
229 }
230 }
231 up_write(&sessions_table_lock);
232
233 down_write(&conn->session_lock);
234 xa_for_each(&conn->sessions, id, sess) {
235 unsigned long chann_id;
236 struct channel *chann;
237
238 xa_for_each(&sess->ksmbd_chann_list, chann_id, chann) {
239 if (chann->conn != conn)
240 ksmbd_conn_set_exiting(chann->conn);
241 }
242
243 ksmbd_chann_del(conn, sess);
244 if (xa_empty(&sess->ksmbd_chann_list)) {
245 xa_erase(&conn->sessions, sess->id);
246 hash_del(&sess->hlist);
247 ksmbd_session_destroy(sess);
248 }
249 }
250 up_write(&conn->session_lock);
251 }
252
ksmbd_session_lookup(struct ksmbd_conn * conn,unsigned long long id)253 struct ksmbd_session *ksmbd_session_lookup(struct ksmbd_conn *conn,
254 unsigned long long id)
255 {
256 struct ksmbd_session *sess;
257
258 down_read(&conn->session_lock);
259 sess = xa_load(&conn->sessions, id);
260 if (sess)
261 sess->last_active = jiffies;
262 up_read(&conn->session_lock);
263 return sess;
264 }
265
ksmbd_session_lookup_slowpath(unsigned long long id)266 struct ksmbd_session *ksmbd_session_lookup_slowpath(unsigned long long id)
267 {
268 struct ksmbd_session *sess;
269
270 down_read(&sessions_table_lock);
271 sess = __session_lookup(id);
272 if (sess)
273 sess->last_active = jiffies;
274 up_read(&sessions_table_lock);
275
276 return sess;
277 }
278
ksmbd_session_lookup_all(struct ksmbd_conn * conn,unsigned long long id)279 struct ksmbd_session *ksmbd_session_lookup_all(struct ksmbd_conn *conn,
280 unsigned long long id)
281 {
282 struct ksmbd_session *sess;
283
284 sess = ksmbd_session_lookup(conn, id);
285 if (!sess && conn->binding)
286 sess = ksmbd_session_lookup_slowpath(id);
287 if (sess && sess->state != SMB2_SESSION_VALID)
288 sess = NULL;
289 return sess;
290 }
291
ksmbd_preauth_session_alloc(struct ksmbd_conn * conn,u64 sess_id)292 struct preauth_session *ksmbd_preauth_session_alloc(struct ksmbd_conn *conn,
293 u64 sess_id)
294 {
295 struct preauth_session *sess;
296
297 sess = kmalloc(sizeof(struct preauth_session), GFP_KERNEL);
298 if (!sess)
299 return NULL;
300
301 sess->id = sess_id;
302 memcpy(sess->Preauth_HashValue, conn->preauth_info->Preauth_HashValue,
303 PREAUTH_HASHVALUE_SIZE);
304 list_add(&sess->preauth_entry, &conn->preauth_sess_table);
305
306 return sess;
307 }
308
destroy_previous_session(struct ksmbd_conn * conn,struct ksmbd_user * user,u64 id)309 void destroy_previous_session(struct ksmbd_conn *conn,
310 struct ksmbd_user *user, u64 id)
311 {
312 struct ksmbd_session *prev_sess;
313 struct ksmbd_user *prev_user;
314 int err;
315
316 down_write(&sessions_table_lock);
317 down_write(&conn->session_lock);
318 prev_sess = __session_lookup(id);
319 if (!prev_sess || prev_sess->state == SMB2_SESSION_EXPIRED)
320 goto out;
321
322 prev_user = prev_sess->user;
323 if (!prev_user ||
324 strcmp(user->name, prev_user->name) ||
325 user->passkey_sz != prev_user->passkey_sz ||
326 memcmp(user->passkey, prev_user->passkey, user->passkey_sz))
327 goto out;
328
329 ksmbd_all_conn_set_status(id, KSMBD_SESS_NEED_RECONNECT);
330 err = ksmbd_conn_wait_idle_sess_id(conn, id);
331 if (err) {
332 ksmbd_all_conn_set_status(id, KSMBD_SESS_NEED_NEGOTIATE);
333 goto out;
334 }
335
336 ksmbd_destroy_file_table(&prev_sess->file_table);
337 prev_sess->state = SMB2_SESSION_EXPIRED;
338 ksmbd_all_conn_set_status(id, KSMBD_SESS_NEED_NEGOTIATE);
339 ksmbd_launch_ksmbd_durable_scavenger();
340 out:
341 up_write(&conn->session_lock);
342 up_write(&sessions_table_lock);
343 }
344
ksmbd_preauth_session_id_match(struct preauth_session * sess,unsigned long long id)345 static bool ksmbd_preauth_session_id_match(struct preauth_session *sess,
346 unsigned long long id)
347 {
348 return sess->id == id;
349 }
350
ksmbd_preauth_session_lookup(struct ksmbd_conn * conn,unsigned long long id)351 struct preauth_session *ksmbd_preauth_session_lookup(struct ksmbd_conn *conn,
352 unsigned long long id)
353 {
354 struct preauth_session *sess = NULL;
355
356 list_for_each_entry(sess, &conn->preauth_sess_table, preauth_entry) {
357 if (ksmbd_preauth_session_id_match(sess, id))
358 return sess;
359 }
360 return NULL;
361 }
362
__init_smb2_session(struct ksmbd_session * sess)363 static int __init_smb2_session(struct ksmbd_session *sess)
364 {
365 int id = ksmbd_acquire_smb2_uid(&session_ida);
366
367 if (id < 0)
368 return -EINVAL;
369 sess->id = id;
370 return 0;
371 }
372
__session_create(int protocol)373 static struct ksmbd_session *__session_create(int protocol)
374 {
375 struct ksmbd_session *sess;
376 int ret;
377
378 if (protocol != CIFDS_SESSION_FLAG_SMB2)
379 return NULL;
380
381 sess = kzalloc(sizeof(struct ksmbd_session), GFP_KERNEL);
382 if (!sess)
383 return NULL;
384
385 if (ksmbd_init_file_table(&sess->file_table))
386 goto error;
387
388 sess->last_active = jiffies;
389 sess->state = SMB2_SESSION_IN_PROGRESS;
390 set_session_flag(sess, protocol);
391 xa_init(&sess->tree_conns);
392 xa_init(&sess->ksmbd_chann_list);
393 xa_init(&sess->rpc_handle_list);
394 sess->sequence_number = 1;
395 rwlock_init(&sess->tree_conns_lock);
396
397 ret = __init_smb2_session(sess);
398 if (ret)
399 goto error;
400
401 ida_init(&sess->tree_conn_ida);
402
403 down_write(&sessions_table_lock);
404 hash_add(sessions_table, &sess->hlist, sess->id);
405 up_write(&sessions_table_lock);
406
407 return sess;
408
409 error:
410 ksmbd_session_destroy(sess);
411 return NULL;
412 }
413
ksmbd_smb2_session_create(void)414 struct ksmbd_session *ksmbd_smb2_session_create(void)
415 {
416 return __session_create(CIFDS_SESSION_FLAG_SMB2);
417 }
418
ksmbd_acquire_tree_conn_id(struct ksmbd_session * sess)419 int ksmbd_acquire_tree_conn_id(struct ksmbd_session *sess)
420 {
421 int id = -EINVAL;
422
423 if (test_session_flag(sess, CIFDS_SESSION_FLAG_SMB2))
424 id = ksmbd_acquire_smb2_tid(&sess->tree_conn_ida);
425
426 return id;
427 }
428
ksmbd_release_tree_conn_id(struct ksmbd_session * sess,int id)429 void ksmbd_release_tree_conn_id(struct ksmbd_session *sess, int id)
430 {
431 if (id >= 0)
432 ksmbd_release_id(&sess->tree_conn_ida, id);
433 }
434