1 // SPDX-License-Identifier: GPL-2.0-or-later 2 /* 3 * Copyright (C) 2016 Namjae Jeon <linkinjeon@kernel.org> 4 * Copyright (C) 2018 Samsung Electronics Co., Ltd. 5 */ 6 7 #include <crypto/utils.h> 8 #include <linux/inetdevice.h> 9 #include <net/addrconf.h> 10 #include <linux/syscalls.h> 11 #include <linux/namei.h> 12 #include <linux/fs_struct.h> 13 #include <linux/statfs.h> 14 #include <linux/ethtool.h> 15 #include <linux/falloc.h> 16 #include <linux/mount.h> 17 #include <linux/filelock.h> 18 #include <linux/fileattr.h> 19 20 #include "glob.h" 21 #include "../common/smbfsctl.h" 22 #include "oplock.h" 23 #include "smbacl.h" 24 25 #include "auth.h" 26 #include "asn1.h" 27 #include "connection.h" 28 #include "transport_ipc.h" 29 #include "transport_rdma.h" 30 #include "vfs.h" 31 #include "vfs_cache.h" 32 #include "misc.h" 33 34 #include "server.h" 35 #include "smb_common.h" 36 #include "../common/smb2status.h" 37 #include "ksmbd_work.h" 38 #include "mgmt/user_config.h" 39 #include "mgmt/share_config.h" 40 #include "mgmt/tree_connect.h" 41 #include "mgmt/user_session.h" 42 #include "mgmt/ksmbd_ida.h" 43 #include "ndr.h" 44 #include "stats.h" 45 #include "transport_tcp.h" 46 #include "compress.h" 47 48 static void __wbuf(struct ksmbd_work *work, void **req, void **rsp) 49 { 50 if (work->next_smb2_rcv_hdr_off) { 51 *req = ksmbd_req_buf_next(work); 52 *rsp = ksmbd_resp_buf_next(work); 53 } else { 54 *req = smb_get_msg(work->request_buf); 55 *rsp = smb_get_msg(work->response_buf); 56 } 57 } 58 59 #define WORK_BUFFERS(w, rq, rs) __wbuf((w), (void **)&(rq), (void **)&(rs)) 60 61 #define SMB2_CREATE_FILE_ATTRIBUTE_MASK \ 62 (FILE_ATTRIBUTE_MASK & ~(FILE_ATTRIBUTE_INTEGRITY_STREAM | \ 63 FILE_ATTRIBUTE_NO_SCRUB_DATA)) 64 65 /* Windows reports automatic write-time updates at roughly 15 ms resolution. */ 66 #define KSMBD_WRITE_TIME_RESOLUTION (15ULL * 10000) 67 68 /** 69 * check_session_id() - check for valid session id in smb header 70 * @conn: connection instance 71 * @id: session id from smb header 72 * 73 * Return: 1 if valid session id, otherwise 0 74 */ 75 static inline bool check_session_id(struct ksmbd_conn *conn, u64 id) 76 { 77 struct ksmbd_session *sess; 78 79 if (id == 0 || id == -1) 80 return false; 81 82 sess = ksmbd_session_lookup_all(conn, id); 83 if (sess) { 84 ksmbd_user_session_put(sess); 85 return true; 86 } 87 pr_err("Invalid user session id: %llu\n", id); 88 return false; 89 } 90 91 struct channel *lookup_chann_list(struct ksmbd_session *sess, struct ksmbd_conn *conn) 92 { 93 struct channel *chann; 94 95 down_read(&sess->chann_lock); 96 chann = xa_load(&sess->ksmbd_chann_list, (long)conn); 97 up_read(&sess->chann_lock); 98 99 return chann; 100 } 101 102 #define KSMBD_MAX_CHANNELS 32 103 104 static int register_session_channel(struct ksmbd_session *sess, 105 struct ksmbd_conn *conn, 106 const char *sess_key) 107 { 108 struct channel *chann, *old; 109 unsigned long index; 110 unsigned int count = 0; 111 int rc = 0; 112 113 down_write(&sess->chann_lock); 114 if (xa_load(&sess->ksmbd_chann_list, (long)conn)) 115 goto out; 116 117 xa_for_each(&sess->ksmbd_chann_list, index, chann) 118 count++; 119 if (count >= KSMBD_MAX_CHANNELS) { 120 rc = -ENOSPC; 121 goto out; 122 } 123 124 chann = kmalloc_obj(struct channel, KSMBD_DEFAULT_GFP); 125 if (!chann) { 126 rc = -ENOMEM; 127 goto out; 128 } 129 130 chann->conn = conn; 131 memcpy(chann->sess_key, sess_key, sizeof(chann->sess_key)); 132 old = xa_store(&sess->ksmbd_chann_list, (long)conn, chann, 133 KSMBD_DEFAULT_GFP); 134 if (xa_is_err(old)) { 135 kfree_sensitive(chann); 136 rc = xa_err(old); 137 } 138 out: 139 up_write(&sess->chann_lock); 140 return rc; 141 } 142 143 /** 144 * smb2_get_ksmbd_tcon() - get tree connection information using a tree id. 145 * @work: smb work 146 * 147 * Return: 0 if there is a tree connection matched or these are 148 * skipable commands, otherwise error 149 */ 150 int smb2_get_ksmbd_tcon(struct ksmbd_work *work) 151 { 152 struct smb2_hdr *req_hdr = ksmbd_req_buf_next(work); 153 unsigned int cmd = le16_to_cpu(req_hdr->Command); 154 unsigned int tree_id; 155 156 if (cmd == SMB2_TREE_CONNECT_HE || 157 cmd == SMB2_CANCEL_HE || 158 cmd == SMB2_LOGOFF_HE) { 159 ksmbd_debug(SMB, "skip to check tree connect request\n"); 160 return 0; 161 } 162 163 if (xa_empty(&work->sess->tree_conns)) { 164 ksmbd_debug(SMB, "NO tree connected\n"); 165 return -ENOENT; 166 } 167 168 tree_id = le32_to_cpu(req_hdr->Id.SyncId.TreeId); 169 170 /* 171 * If request is not the first in Compound request, 172 * Just validate tree id in header with work->tcon->id. 173 */ 174 if (work->next_smb2_rcv_hdr_off) { 175 if (!work->tcon) { 176 pr_err("The first operation in the compound does not have tcon\n"); 177 return -EINVAL; 178 } 179 if (work->tcon->t_state != TREE_CONNECTED) 180 return -ENOENT; 181 if (tree_id != UINT_MAX && work->tcon->id != tree_id) { 182 pr_err("tree id(%u) is different with id(%u) in first operation\n", 183 tree_id, work->tcon->id); 184 return -EINVAL; 185 } 186 return 1; 187 } 188 189 work->tcon = ksmbd_tree_conn_lookup(work->sess, tree_id); 190 if (!work->tcon) { 191 pr_err("Invalid tid %d\n", tree_id); 192 return -ENOENT; 193 } 194 195 return 1; 196 } 197 198 /** 199 * smb2_set_err_rsp() - set error response code on smb response 200 * @work: smb work containing response buffer 201 */ 202 void smb2_set_err_rsp(struct ksmbd_work *work) 203 { 204 struct smb2_err_rsp *err_rsp; 205 206 if (work->next_smb2_rcv_hdr_off) 207 err_rsp = ksmbd_resp_buf_next(work); 208 else 209 err_rsp = smb_get_msg(work->response_buf); 210 211 if (err_rsp->hdr.Status != STATUS_STOPPED_ON_SYMLINK) { 212 int err; 213 214 err_rsp->StructureSize = SMB2_ERROR_STRUCTURE_SIZE2_LE; 215 err_rsp->ErrorContextCount = 0; 216 err_rsp->Reserved = 0; 217 err_rsp->ByteCount = 0; 218 err_rsp->ErrorData[0] = 0; 219 err = ksmbd_iov_pin_rsp(work, (void *)err_rsp, 220 __SMB2_HEADER_STRUCTURE_SIZE + 221 SMB2_ERROR_STRUCTURE_SIZE2); 222 if (err) 223 work->send_no_response = 1; 224 } 225 } 226 227 /** 228 * is_smb2_neg_cmd() - is it smb2 negotiation command 229 * @work: smb work containing smb header 230 * 231 * Return: true if smb2 negotiation command, otherwise false 232 */ 233 bool is_smb2_neg_cmd(struct ksmbd_work *work) 234 { 235 struct smb2_hdr *hdr = smb_get_msg(work->request_buf); 236 237 /* is it SMB2 header ? */ 238 if (hdr->ProtocolId != SMB2_PROTO_NUMBER) 239 return false; 240 241 /* make sure it is request not response message */ 242 if (hdr->Flags & SMB2_FLAGS_SERVER_TO_REDIR) 243 return false; 244 245 if (hdr->Command != SMB2_NEGOTIATE) 246 return false; 247 248 return true; 249 } 250 251 /** 252 * is_smb2_rsp() - is it smb2 response 253 * @work: smb work containing smb response buffer 254 * 255 * Return: true if smb2 response, otherwise false 256 */ 257 bool is_smb2_rsp(struct ksmbd_work *work) 258 { 259 struct smb2_hdr *hdr = smb_get_msg(work->response_buf); 260 261 /* is it SMB2 header ? */ 262 if (hdr->ProtocolId != SMB2_PROTO_NUMBER) 263 return false; 264 265 /* make sure it is response not request message */ 266 if (!(hdr->Flags & SMB2_FLAGS_SERVER_TO_REDIR)) 267 return false; 268 269 return true; 270 } 271 272 /** 273 * get_smb2_cmd_val() - get smb command code from smb header 274 * @work: smb work containing smb request buffer 275 * 276 * Return: smb2 request command value 277 */ 278 u16 get_smb2_cmd_val(struct ksmbd_work *work) 279 { 280 struct smb2_hdr *rcv_hdr; 281 282 if (work->next_smb2_rcv_hdr_off) 283 rcv_hdr = ksmbd_req_buf_next(work); 284 else 285 rcv_hdr = smb_get_msg(work->request_buf); 286 return le16_to_cpu(rcv_hdr->Command); 287 } 288 289 /** 290 * set_smb2_rsp_status() - set error response code on smb2 header 291 * @work: smb work containing response buffer 292 * @err: error response code 293 */ 294 void set_smb2_rsp_status(struct ksmbd_work *work, __le32 err) 295 { 296 struct smb2_hdr *rsp_hdr; 297 298 if (work->next_smb2_rcv_hdr_off) { 299 rsp_hdr = ksmbd_resp_buf_next(work); 300 rsp_hdr->Status = err; 301 smb2_set_err_rsp(work); 302 return; 303 } 304 305 rsp_hdr = smb_get_msg(work->response_buf); 306 rsp_hdr->Status = err; 307 308 work->iov_idx = 0; 309 work->iov_cnt = 0; 310 work->next_smb2_rcv_hdr_off = 0; 311 smb2_set_err_rsp(work); 312 } 313 314 /** 315 * init_smb2_neg_rsp() - initialize smb2 response for negotiate command 316 * @work: smb work containing smb request buffer 317 * 318 * smb2 negotiate response is sent in reply of smb1 negotiate command for 319 * dialect auto-negotiation. 320 */ 321 int init_smb2_neg_rsp(struct ksmbd_work *work) 322 { 323 struct smb2_hdr *rsp_hdr; 324 struct smb2_negotiate_rsp *rsp; 325 struct ksmbd_conn *conn = work->conn; 326 int err; 327 328 rsp_hdr = smb_get_msg(work->response_buf); 329 memset(rsp_hdr, 0, sizeof(struct smb2_hdr) + 2); 330 rsp_hdr->ProtocolId = SMB2_PROTO_NUMBER; 331 rsp_hdr->StructureSize = SMB2_HEADER_STRUCTURE_SIZE; 332 rsp_hdr->CreditRequest = cpu_to_le16(2); 333 rsp_hdr->Command = SMB2_NEGOTIATE; 334 rsp_hdr->Flags = (SMB2_FLAGS_SERVER_TO_REDIR); 335 rsp_hdr->NextCommand = 0; 336 rsp_hdr->MessageId = 0; 337 rsp_hdr->Id.SyncId.ProcessId = 0; 338 rsp_hdr->Id.SyncId.TreeId = 0; 339 rsp_hdr->SessionId = 0; 340 memset(rsp_hdr->Signature, 0, 16); 341 342 rsp = smb_get_msg(work->response_buf); 343 344 WARN_ON(ksmbd_conn_good(conn)); 345 346 rsp->StructureSize = cpu_to_le16(65); 347 ksmbd_debug(SMB, "conn->dialect 0x%x\n", conn->dialect); 348 rsp->DialectRevision = cpu_to_le16(conn->dialect); 349 /* Not setting conn guid rsp->ServerGUID, as it 350 * not used by client for identifying connection 351 */ 352 rsp->Capabilities = cpu_to_le32(conn->vals->req_capabilities); 353 /* Default Max Message Size till SMB2.0, 64K*/ 354 rsp->MaxTransactSize = cpu_to_le32(conn->vals->max_trans_size); 355 rsp->MaxReadSize = cpu_to_le32(conn->vals->max_read_size); 356 rsp->MaxWriteSize = cpu_to_le32(conn->vals->max_write_size); 357 358 rsp->SystemTime = cpu_to_le64(ksmbd_systime()); 359 rsp->ServerStartTime = 0; 360 361 rsp->SecurityBufferOffset = cpu_to_le16(128); 362 rsp->SecurityBufferLength = cpu_to_le16(AUTH_GSS_LENGTH); 363 ksmbd_copy_gss_neg_header((char *)(&rsp->hdr) + 364 le16_to_cpu(rsp->SecurityBufferOffset)); 365 rsp->SecurityMode = SMB2_NEGOTIATE_SIGNING_ENABLED_LE; 366 if (server_conf.signing == KSMBD_CONFIG_OPT_MANDATORY) 367 rsp->SecurityMode |= SMB2_NEGOTIATE_SIGNING_REQUIRED_LE; 368 err = ksmbd_iov_pin_rsp(work, rsp, 369 sizeof(struct smb2_negotiate_rsp) + AUTH_GSS_LENGTH); 370 if (err) 371 return err; 372 conn->use_spnego = true; 373 374 ksmbd_conn_set_need_negotiate(conn); 375 return 0; 376 } 377 378 /** 379 * smb2_set_rsp_credits() - set number of credits in response buffer 380 * @work: smb work containing smb response buffer 381 */ 382 int smb2_set_rsp_credits(struct ksmbd_work *work) 383 { 384 struct smb2_hdr *req_hdr = ksmbd_req_buf_next(work); 385 struct smb2_hdr *hdr = ksmbd_resp_buf_next(work); 386 struct ksmbd_conn *conn = work->conn; 387 unsigned short credits_requested, aux_max; 388 unsigned short credit_charge, credits_granted = 0; 389 390 if (work->send_no_response) 391 return 0; 392 393 hdr->CreditCharge = req_hdr->CreditCharge; 394 395 if (conn->total_credits > conn->vals->max_credits) { 396 hdr->CreditRequest = 0; 397 pr_err("Total credits overflow: %d\n", conn->total_credits); 398 return -EINVAL; 399 } 400 401 credit_charge = max_t(unsigned short, 402 le16_to_cpu(req_hdr->CreditCharge), 1); 403 if (credit_charge > conn->total_credits) { 404 ksmbd_debug(SMB, "Insufficient credits granted, given: %u, granted: %u\n", 405 credit_charge, conn->total_credits); 406 return -EINVAL; 407 } 408 409 conn->total_credits -= credit_charge; 410 conn->outstanding_credits -= credit_charge; 411 work->credit_charge = 0; 412 credits_requested = max_t(unsigned short, 413 le16_to_cpu(req_hdr->CreditRequest), 1); 414 415 /* according to smb2.credits smbtorture, Windows server 416 * 2016 or later grant up to 8192 credits at once. 417 * 418 * TODO: Need to adjuct CreditRequest value according to 419 * current cpu load 420 */ 421 if (hdr->Command == SMB2_NEGOTIATE) 422 aux_max = 1; 423 else 424 aux_max = conn->vals->max_credits - conn->total_credits; 425 credits_granted = min_t(unsigned short, credits_requested, aux_max); 426 427 conn->total_credits += credits_granted; 428 work->credits_granted += credits_granted; 429 430 if (!req_hdr->NextCommand) { 431 /* Update CreditRequest in last request */ 432 hdr->CreditRequest = cpu_to_le16(work->credits_granted); 433 } 434 ksmbd_debug(SMB, 435 "credits: requested[%d] granted[%d] total_granted[%d]\n", 436 credits_requested, credits_granted, 437 conn->total_credits); 438 return 0; 439 } 440 441 /** 442 * init_chained_smb2_rsp() - initialize smb2 chained response 443 * @work: smb work containing smb response buffer 444 */ 445 static void init_chained_smb2_rsp(struct ksmbd_work *work) 446 { 447 struct smb2_hdr *req = ksmbd_req_buf_next(work); 448 struct smb2_hdr *rsp = ksmbd_resp_buf_next(work); 449 struct smb2_hdr *rsp_hdr; 450 struct smb2_hdr *rcv_hdr; 451 int next_hdr_offset = 0; 452 int len, new_len; 453 454 /* Len of this response = updated RFC len - offset of previous cmd 455 * in the compound rsp 456 */ 457 458 /* Storing the current local FID which may be needed by subsequent 459 * command in the compound request 460 */ 461 if (req->Command == SMB2_CREATE && rsp->Status == STATUS_SUCCESS) { 462 work->compound_fid = ((struct smb2_create_rsp *)rsp)->VolatileFileId; 463 work->compound_pfid = ((struct smb2_create_rsp *)rsp)->PersistentFileId; 464 work->compound_sid = le64_to_cpu(rsp->SessionId); 465 work->compound_status = STATUS_SUCCESS; 466 } else if ((req->Command == SMB2_FLUSH || 467 req->Command == SMB2_READ || 468 req->Command == SMB2_WRITE) && 469 rsp->Status == STATUS_SUCCESS) { 470 u64 volatile_id = KSMBD_NO_FID; 471 u64 persistent_id = KSMBD_NO_FID; 472 473 if (req->Command == SMB2_FLUSH) { 474 struct smb2_flush_req *flush_req = 475 (struct smb2_flush_req *)req; 476 477 volatile_id = flush_req->VolatileFileId; 478 persistent_id = flush_req->PersistentFileId; 479 } else if (req->Command == SMB2_READ) { 480 struct smb2_read_req *read_req = 481 (struct smb2_read_req *)req; 482 483 volatile_id = read_req->VolatileFileId; 484 persistent_id = read_req->PersistentFileId; 485 } else { 486 struct smb2_write_req *write_req = 487 (struct smb2_write_req *)req; 488 489 volatile_id = write_req->VolatileFileId; 490 persistent_id = write_req->PersistentFileId; 491 } 492 493 if (has_file_id(volatile_id)) { 494 work->compound_fid = volatile_id; 495 work->compound_pfid = persistent_id; 496 work->compound_sid = le64_to_cpu(rsp->SessionId); 497 work->compound_status = STATUS_SUCCESS; 498 } 499 } else if (req->Command == SMB2_CREATE) { 500 work->compound_fid = KSMBD_NO_FID; 501 work->compound_pfid = KSMBD_NO_FID; 502 work->compound_sid = le64_to_cpu(rsp->SessionId); 503 work->compound_status = rsp->Status; 504 } else if (rsp->Status != STATUS_SUCCESS) { 505 work->compound_sid = le64_to_cpu(rsp->SessionId); 506 /* 507 * Only carry the failed status forward when the failing command 508 * was itself part of the related chain. An unrelated command 509 * that fails (e.g. a standalone request with a bad session id) 510 * must not seed the status for a following related command, 511 * which has to be evaluated on its own (and may legitimately 512 * fail with a different status such as INVALID_PARAMETER). The 513 * compound session id is still tracked so a following related 514 * command can validate it. 515 */ 516 if (req->Flags & SMB2_FLAGS_RELATED_OPERATIONS) 517 work->compound_status = rsp->Status; 518 } 519 520 len = get_rfc1002_len(work->response_buf) - work->next_smb2_rsp_hdr_off; 521 next_hdr_offset = le32_to_cpu(req->NextCommand); 522 523 new_len = ALIGN(len, 8); 524 work->iov[work->iov_idx].iov_len += (new_len - len); 525 inc_rfc1001_len(work->response_buf, new_len - len); 526 rsp->NextCommand = cpu_to_le32(new_len); 527 528 work->next_smb2_rcv_hdr_off += next_hdr_offset; 529 work->curr_smb2_rsp_hdr_off = work->next_smb2_rsp_hdr_off; 530 work->next_smb2_rsp_hdr_off += new_len; 531 ksmbd_debug(SMB, 532 "Compound req new_len = %d rcv off = %d rsp off = %d\n", 533 new_len, work->next_smb2_rcv_hdr_off, 534 work->next_smb2_rsp_hdr_off); 535 536 rsp_hdr = ksmbd_resp_buf_next(work); 537 rcv_hdr = ksmbd_req_buf_next(work); 538 539 if (!(rcv_hdr->Flags & SMB2_FLAGS_RELATED_OPERATIONS)) { 540 ksmbd_debug(SMB, "related flag should be set\n"); 541 work->compound_fid = KSMBD_NO_FID; 542 work->compound_pfid = KSMBD_NO_FID; 543 work->compound_status = STATUS_SUCCESS; 544 } 545 memset((char *)rsp_hdr, 0, sizeof(struct smb2_hdr) + 2); 546 rsp_hdr->ProtocolId = SMB2_PROTO_NUMBER; 547 rsp_hdr->StructureSize = SMB2_HEADER_STRUCTURE_SIZE; 548 rsp_hdr->Command = rcv_hdr->Command; 549 550 /* 551 * Message is response. We don't grant oplock yet. 552 */ 553 rsp_hdr->Flags = (SMB2_FLAGS_SERVER_TO_REDIR | 554 SMB2_FLAGS_RELATED_OPERATIONS); 555 rsp_hdr->NextCommand = 0; 556 rsp_hdr->MessageId = rcv_hdr->MessageId; 557 rsp_hdr->Id.SyncId.ProcessId = rcv_hdr->Id.SyncId.ProcessId; 558 rsp_hdr->Id.SyncId.TreeId = rcv_hdr->Id.SyncId.TreeId; 559 rsp_hdr->SessionId = rcv_hdr->SessionId; 560 memcpy(rsp_hdr->Signature, rcv_hdr->Signature, 16); 561 } 562 563 static bool smb2_compound_has_failed(struct ksmbd_work *work, 564 struct smb2_hdr *rsp) 565 { 566 if (!work->next_smb2_rcv_hdr_off || 567 has_file_id(work->compound_fid) || 568 work->compound_status == STATUS_SUCCESS) 569 return false; 570 571 rsp->Status = work->compound_status; 572 smb2_set_err_rsp(work); 573 return true; 574 } 575 576 /** 577 * is_chained_smb2_message() - check for chained command 578 * @work: smb work containing smb request buffer 579 * 580 * Return: true if chained request, otherwise false 581 */ 582 bool is_chained_smb2_message(struct ksmbd_work *work) 583 { 584 struct smb2_hdr *hdr = smb_get_msg(work->request_buf); 585 unsigned int len, next_cmd; 586 587 if (hdr->ProtocolId != SMB2_PROTO_NUMBER) 588 return false; 589 590 hdr = ksmbd_req_buf_next(work); 591 next_cmd = le32_to_cpu(hdr->NextCommand); 592 if (next_cmd > 0) { 593 if ((u64)work->next_smb2_rcv_hdr_off + next_cmd + 594 __SMB2_HEADER_STRUCTURE_SIZE > 595 get_rfc1002_len(work->request_buf)) { 596 pr_err("next command(%u) offset exceeds smb msg size\n", 597 next_cmd); 598 return false; 599 } 600 601 if ((u64)get_rfc1002_len(work->response_buf) + MAX_CIFS_SMALL_BUFFER_SIZE > 602 work->response_sz) { 603 pr_err("next response offset exceeds response buffer size\n"); 604 return false; 605 } 606 607 ksmbd_debug(SMB, "got SMB2 chained command\n"); 608 init_chained_smb2_rsp(work); 609 return true; 610 } else if (work->next_smb2_rcv_hdr_off) { 611 /* 612 * This is last request in chained command, 613 * align response to 8 byte 614 */ 615 len = ALIGN(get_rfc1002_len(work->response_buf), 8); 616 len = len - get_rfc1002_len(work->response_buf); 617 if (len) { 618 ksmbd_debug(SMB, "padding len %u\n", len); 619 work->iov[work->iov_idx].iov_len += len; 620 inc_rfc1001_len(work->response_buf, len); 621 } 622 work->curr_smb2_rsp_hdr_off = work->next_smb2_rsp_hdr_off; 623 } 624 return false; 625 } 626 627 /** 628 * init_smb2_rsp_hdr() - initialize smb2 response 629 * @work: smb work containing smb request buffer 630 * 631 * Return: 0 632 */ 633 int init_smb2_rsp_hdr(struct ksmbd_work *work) 634 { 635 struct smb2_hdr *rsp_hdr = smb_get_msg(work->response_buf); 636 struct smb2_hdr *rcv_hdr = smb_get_msg(work->request_buf); 637 638 memset(rsp_hdr, 0, sizeof(struct smb2_hdr) + 2); 639 rsp_hdr->ProtocolId = rcv_hdr->ProtocolId; 640 rsp_hdr->StructureSize = SMB2_HEADER_STRUCTURE_SIZE; 641 rsp_hdr->Command = rcv_hdr->Command; 642 643 /* 644 * Message is response. We don't grant oplock yet. 645 */ 646 rsp_hdr->Flags = (SMB2_FLAGS_SERVER_TO_REDIR); 647 rsp_hdr->NextCommand = 0; 648 rsp_hdr->MessageId = rcv_hdr->MessageId; 649 rsp_hdr->Id.SyncId.ProcessId = rcv_hdr->Id.SyncId.ProcessId; 650 rsp_hdr->Id.SyncId.TreeId = rcv_hdr->Id.SyncId.TreeId; 651 rsp_hdr->SessionId = rcv_hdr->SessionId; 652 memcpy(rsp_hdr->Signature, rcv_hdr->Signature, 16); 653 654 return 0; 655 } 656 657 /** 658 * smb2_allocate_rsp_buf() - allocate smb2 response buffer 659 * @work: smb work containing smb request buffer 660 * 661 * Return: 0 on success, otherwise error 662 */ 663 int smb2_allocate_rsp_buf(struct ksmbd_work *work) 664 { 665 struct smb2_hdr *hdr = smb_get_msg(work->request_buf); 666 size_t small_sz = MAX_CIFS_SMALL_BUFFER_SIZE; 667 size_t large_sz = small_sz + work->conn->vals->max_trans_size; 668 size_t sz = small_sz; 669 int cmd = le16_to_cpu(hdr->Command); 670 671 if (cmd == SMB2_IOCTL_HE || cmd == SMB2_QUERY_DIRECTORY_HE) 672 sz = large_sz; 673 674 if (cmd == SMB2_QUERY_INFO_HE) { 675 struct smb2_query_info_req *req; 676 677 if (get_rfc1002_len(work->request_buf) < 678 offsetof(struct smb2_query_info_req, OutputBufferLength)) 679 return -EINVAL; 680 681 req = smb_get_msg(work->request_buf); 682 if ((req->InfoType == SMB2_O_INFO_FILE && 683 (req->FileInfoClass == FILE_FULL_EA_INFORMATION || 684 req->FileInfoClass == FILE_ALL_INFORMATION)) || 685 req->InfoType == SMB2_O_INFO_SECURITY) 686 sz = large_sz; 687 } 688 689 /* allocate large response buf for chained commands */ 690 if (le32_to_cpu(hdr->NextCommand) > 0) 691 sz = large_sz; 692 693 work->response_buf = kvzalloc(sz, KSMBD_DEFAULT_GFP); 694 if (!work->response_buf) 695 return -ENOMEM; 696 697 work->response_sz = sz; 698 return 0; 699 } 700 701 /** 702 * smb2_check_user_session() - check for valid session for a user 703 * @work: smb work containing smb request buffer 704 * 705 * Return: 0 on success, otherwise error 706 */ 707 int smb2_check_user_session(struct ksmbd_work *work) 708 { 709 struct smb2_hdr *req_hdr = ksmbd_req_buf_next(work); 710 struct ksmbd_conn *conn = work->conn; 711 unsigned int cmd = le16_to_cpu(req_hdr->Command); 712 unsigned long long sess_id; 713 714 /* 715 * SMB2_ECHO, SMB2_NEGOTIATE, SMB2_SESSION_SETUP command do not 716 * require a session id, so no need to validate user session's for 717 * these commands. 718 */ 719 if (cmd == SMB2_ECHO_HE || cmd == SMB2_NEGOTIATE_HE || 720 cmd == SMB2_SESSION_SETUP_HE) 721 return 0; 722 723 if (!ksmbd_conn_good(conn)) 724 return -EIO; 725 726 sess_id = le64_to_cpu(req_hdr->SessionId); 727 728 /* 729 * If request is not the first in Compound request, 730 * Just validate session id in header with work->sess->id. 731 */ 732 if (work->next_smb2_rcv_hdr_off) { 733 if (!work->sess) { 734 pr_err("The first operation in the compound does not have sess\n"); 735 return -EINVAL; 736 } 737 if (sess_id != ULLONG_MAX && work->sess->id != sess_id) { 738 pr_err("session id(%llu) is different with the first operation(%lld)\n", 739 sess_id, work->sess->id); 740 return -EINVAL; 741 } 742 if (work->sess->state != SMB2_SESSION_VALID) { 743 pr_err("compound request on a non-valid session (state %d)\n", 744 work->sess->state); 745 return -EINVAL; 746 } 747 return 1; 748 } 749 750 /* Check for validity of user session */ 751 work->sess = ksmbd_session_lookup_all(conn, sess_id); 752 if (work->sess) 753 return 1; 754 ksmbd_debug(SMB, "Invalid user session, Uid %llu\n", sess_id); 755 return -ENOENT; 756 } 757 758 /** 759 * smb2_get_name() - get filename string from on the wire smb format 760 * @src: source buffer 761 * @maxlen: maxlen of source string 762 * @local_nls: nls_table pointer 763 * 764 * Return: matching converted filename on success, otherwise error ptr 765 */ 766 static char * 767 smb2_get_name(const char *src, const int maxlen, struct nls_table *local_nls) 768 { 769 char *name; 770 771 name = smb_strndup_from_utf16(src, maxlen, 1, local_nls); 772 if (IS_ERR(name)) { 773 pr_err("failed to get name %ld\n", PTR_ERR(name)); 774 return name; 775 } 776 777 if (*name == '\0') { 778 kfree(name); 779 return ERR_PTR(-EINVAL); 780 } 781 782 if (*name == '\\') { 783 pr_err("not allow directory name included leading slash\n"); 784 kfree(name); 785 return ERR_PTR(-EINVAL); 786 } 787 788 ksmbd_conv_path_to_unix(name); 789 ksmbd_strip_last_slash(name); 790 return name; 791 } 792 793 int setup_async_work(struct ksmbd_work *work, void (*fn)(void **), void **arg) 794 { 795 struct ksmbd_conn *conn = work->conn; 796 int id; 797 798 id = ksmbd_acquire_async_msg_id(&conn->async_ida); 799 if (id < 0) { 800 pr_err("Failed to alloc async message id\n"); 801 return id; 802 } 803 work->asynchronous = true; 804 work->async_id = id; 805 806 ksmbd_debug(SMB, 807 "Send interim Response to inform async request id : %d\n", 808 work->async_id); 809 810 work->cancel_fn = fn; 811 work->cancel_argv = arg; 812 813 if (list_empty(&work->async_request_entry)) { 814 spin_lock(&conn->request_lock); 815 list_add_tail(&work->async_request_entry, &conn->async_requests); 816 spin_unlock(&conn->request_lock); 817 } 818 819 return 0; 820 } 821 822 void release_async_work(struct ksmbd_work *work) 823 { 824 struct ksmbd_conn *conn = work->conn; 825 826 spin_lock(&conn->request_lock); 827 list_del_init(&work->async_request_entry); 828 spin_unlock(&conn->request_lock); 829 830 work->asynchronous = 0; 831 work->cancel_fn = NULL; 832 kfree(work->cancel_argv); 833 work->cancel_argv = NULL; 834 if (work->async_id) { 835 ksmbd_release_id(&conn->async_ida, work->async_id); 836 work->async_id = 0; 837 } 838 } 839 840 void smb2_send_interim_resp(struct ksmbd_work *work, __le32 status) 841 { 842 struct smb2_hdr *rsp_hdr; 843 struct ksmbd_work *in_work = ksmbd_alloc_work_struct(); 844 845 if (!in_work) 846 return; 847 848 if (allocate_interim_rsp_buf(in_work)) { 849 pr_err("smb_allocate_rsp_buf failed!\n"); 850 ksmbd_free_work_struct(in_work); 851 return; 852 } 853 854 in_work->conn = work->conn; 855 memcpy(smb_get_msg(in_work->response_buf), ksmbd_resp_buf_next(work), 856 __SMB2_HEADER_STRUCTURE_SIZE); 857 858 rsp_hdr = smb_get_msg(in_work->response_buf); 859 rsp_hdr->Flags |= SMB2_FLAGS_ASYNC_COMMAND; 860 rsp_hdr->Id.AsyncId = cpu_to_le64(work->async_id); 861 smb2_set_err_rsp(in_work); 862 rsp_hdr->Status = status; 863 864 ksmbd_conn_write(in_work); 865 ksmbd_free_work_struct(in_work); 866 } 867 868 static __le32 smb2_get_reparse_tag_special_file(umode_t mode) 869 { 870 if (S_ISDIR(mode) || S_ISREG(mode)) 871 return 0; 872 873 if (S_ISLNK(mode)) 874 return IO_REPARSE_TAG_LX_SYMLINK_LE; 875 else if (S_ISFIFO(mode)) 876 return IO_REPARSE_TAG_LX_FIFO_LE; 877 else if (S_ISSOCK(mode)) 878 return IO_REPARSE_TAG_AF_UNIX_LE; 879 else if (S_ISCHR(mode)) 880 return IO_REPARSE_TAG_LX_CHR_LE; 881 else if (S_ISBLK(mode)) 882 return IO_REPARSE_TAG_LX_BLK_LE; 883 884 return 0; 885 } 886 887 /** 888 * smb2_get_dos_mode() - get file mode in dos format from unix mode 889 * @stat: kstat containing file mode 890 * @attribute: attribute flags 891 * 892 * Return: converted dos mode 893 */ 894 static int smb2_get_dos_mode(struct kstat *stat, int attribute) 895 { 896 int attr = 0; 897 898 if (S_ISDIR(stat->mode)) { 899 attr = FILE_ATTRIBUTE_DIRECTORY | 900 (attribute & (FILE_ATTRIBUTE_HIDDEN | FILE_ATTRIBUTE_SYSTEM)); 901 } else { 902 attr = (attribute & 0x00005137) | FILE_ATTRIBUTE_ARCHIVE; 903 attr &= ~(FILE_ATTRIBUTE_DIRECTORY); 904 if (S_ISREG(stat->mode) && (server_conf.share_fake_fscaps & 905 FILE_SUPPORTS_SPARSE_FILES)) 906 attr |= FILE_ATTRIBUTE_SPARSE_FILE; 907 908 if (smb2_get_reparse_tag_special_file(stat->mode)) 909 attr |= FILE_ATTRIBUTE_REPARSE_POINT; 910 } 911 912 return attr; 913 } 914 915 static void build_preauth_ctxt(struct smb2_preauth_neg_context *pneg_ctxt, 916 __le16 hash_id) 917 { 918 pneg_ctxt->ContextType = SMB2_PREAUTH_INTEGRITY_CAPABILITIES; 919 pneg_ctxt->DataLength = cpu_to_le16(38); 920 pneg_ctxt->HashAlgorithmCount = cpu_to_le16(1); 921 pneg_ctxt->Reserved = cpu_to_le32(0); 922 pneg_ctxt->SaltLength = cpu_to_le16(SMB311_SALT_SIZE); 923 get_random_bytes(pneg_ctxt->Salt, SMB311_SALT_SIZE); 924 pneg_ctxt->HashAlgorithms = hash_id; 925 } 926 927 static void build_encrypt_ctxt(struct smb2_encryption_neg_context *pneg_ctxt, 928 __le16 cipher_type) 929 { 930 pneg_ctxt->ContextType = SMB2_ENCRYPTION_CAPABILITIES; 931 pneg_ctxt->DataLength = cpu_to_le16(4); 932 pneg_ctxt->Reserved = cpu_to_le32(0); 933 pneg_ctxt->CipherCount = cpu_to_le16(1); 934 pneg_ctxt->Ciphers[0] = cipher_type; 935 } 936 937 static void build_compress_ctxt(struct smb2_compression_capabilities_context *pneg_ctxt, 938 __le16 compress_algorithm, bool compress_chained, 939 bool compress_pattern) 940 { 941 /* 942 * Return only algorithms implemented by ksmbd. Pattern_V1 is advertised 943 * as a second ID when the client also enabled chained transforms. 944 */ 945 pneg_ctxt->ContextType = SMB2_COMPRESSION_CAPABILITIES; 946 pneg_ctxt->DataLength = cpu_to_le16(compress_pattern ? 12 : 10); 947 pneg_ctxt->Reserved = cpu_to_le32(0); 948 pneg_ctxt->CompressionAlgorithmCount = 949 cpu_to_le16(compress_pattern ? 2 : 1); 950 pneg_ctxt->Padding = cpu_to_le16(0); 951 pneg_ctxt->Flags = compress_chained ? 952 SMB2_COMPRESSION_CAPABILITIES_FLAG_CHAINED : 953 SMB2_COMPRESSION_CAPABILITIES_FLAG_NONE; 954 pneg_ctxt->CompressionAlgorithms[0] = compress_algorithm; 955 pneg_ctxt->CompressionAlgorithms[1] = compress_pattern ? 956 SMB3_COMPRESS_PATTERN : 0; 957 pneg_ctxt->CompressionAlgorithms[2] = 0; 958 pneg_ctxt->CompressionAlgorithms[3] = 0; 959 } 960 961 static void build_sign_cap_ctxt(struct smb2_signing_capabilities *pneg_ctxt, 962 __le16 sign_algo) 963 { 964 pneg_ctxt->ContextType = SMB2_SIGNING_CAPABILITIES; 965 pneg_ctxt->DataLength = 966 cpu_to_le16((sizeof(struct smb2_signing_capabilities) + 2) 967 - sizeof(struct smb2_neg_context)); 968 pneg_ctxt->Reserved = cpu_to_le32(0); 969 pneg_ctxt->SigningAlgorithmCount = cpu_to_le16(1); 970 pneg_ctxt->SigningAlgorithms[0] = sign_algo; 971 } 972 973 static void build_posix_ctxt(struct smb2_posix_neg_context *pneg_ctxt) 974 { 975 pneg_ctxt->ContextType = SMB2_POSIX_EXTENSIONS_AVAILABLE; 976 pneg_ctxt->DataLength = cpu_to_le16(POSIX_CTXT_DATA_LEN); 977 /* SMB2_CREATE_TAG_POSIX is "0x93AD25509CB411E7B42383DE968BCD7C" */ 978 pneg_ctxt->Name[0] = 0x93; 979 pneg_ctxt->Name[1] = 0xAD; 980 pneg_ctxt->Name[2] = 0x25; 981 pneg_ctxt->Name[3] = 0x50; 982 pneg_ctxt->Name[4] = 0x9C; 983 pneg_ctxt->Name[5] = 0xB4; 984 pneg_ctxt->Name[6] = 0x11; 985 pneg_ctxt->Name[7] = 0xE7; 986 pneg_ctxt->Name[8] = 0xB4; 987 pneg_ctxt->Name[9] = 0x23; 988 pneg_ctxt->Name[10] = 0x83; 989 pneg_ctxt->Name[11] = 0xDE; 990 pneg_ctxt->Name[12] = 0x96; 991 pneg_ctxt->Name[13] = 0x8B; 992 pneg_ctxt->Name[14] = 0xCD; 993 pneg_ctxt->Name[15] = 0x7C; 994 } 995 996 static unsigned int assemble_neg_contexts(struct ksmbd_conn *conn, 997 struct smb2_negotiate_rsp *rsp) 998 { 999 char * const pneg_ctxt = (char *)rsp + 1000 le32_to_cpu(rsp->NegotiateContextOffset); 1001 int neg_ctxt_cnt = 1; 1002 int ctxt_size; 1003 1004 ksmbd_debug(SMB, 1005 "assemble SMB2_PREAUTH_INTEGRITY_CAPABILITIES context\n"); 1006 build_preauth_ctxt((struct smb2_preauth_neg_context *)pneg_ctxt, 1007 conn->preauth_info->Preauth_HashId); 1008 ctxt_size = sizeof(struct smb2_preauth_neg_context); 1009 1010 if (conn->cipher_type) { 1011 /* Round to 8 byte boundary */ 1012 ctxt_size = round_up(ctxt_size, 8); 1013 ksmbd_debug(SMB, 1014 "assemble SMB2_ENCRYPTION_CAPABILITIES context\n"); 1015 build_encrypt_ctxt((struct smb2_encryption_neg_context *) 1016 (pneg_ctxt + ctxt_size), 1017 conn->cipher_type); 1018 neg_ctxt_cnt++; 1019 ctxt_size += sizeof(struct smb2_encryption_neg_context) + 2; 1020 } 1021 1022 if (conn->compress_algorithm != SMB3_COMPRESS_NONE) { 1023 ctxt_size = round_up(ctxt_size, 8); 1024 ksmbd_debug(SMB, 1025 "assemble SMB2_COMPRESSION_CAPABILITIES context\n"); 1026 build_compress_ctxt((struct smb2_compression_capabilities_context *) 1027 (pneg_ctxt + ctxt_size), 1028 conn->compress_algorithm, 1029 conn->compress_chained, 1030 conn->compress_pattern); 1031 neg_ctxt_cnt++; 1032 ctxt_size += sizeof(struct smb2_neg_context) + 1033 (conn->compress_pattern ? 12 : 10); 1034 } 1035 1036 if (conn->posix_ext_supported) { 1037 ctxt_size = round_up(ctxt_size, 8); 1038 ksmbd_debug(SMB, 1039 "assemble SMB2_POSIX_EXTENSIONS_AVAILABLE context\n"); 1040 build_posix_ctxt((struct smb2_posix_neg_context *) 1041 (pneg_ctxt + ctxt_size)); 1042 neg_ctxt_cnt++; 1043 ctxt_size += sizeof(struct smb2_posix_neg_context); 1044 } 1045 1046 if (conn->signing_negotiated) { 1047 ctxt_size = round_up(ctxt_size, 8); 1048 ksmbd_debug(SMB, 1049 "assemble SMB2_SIGNING_CAPABILITIES context\n"); 1050 build_sign_cap_ctxt((struct smb2_signing_capabilities *) 1051 (pneg_ctxt + ctxt_size), 1052 conn->signing_algorithm); 1053 neg_ctxt_cnt++; 1054 ctxt_size += sizeof(struct smb2_signing_capabilities) + 2; 1055 } 1056 1057 rsp->NegotiateContextCount = cpu_to_le16(neg_ctxt_cnt); 1058 return ctxt_size + AUTH_GSS_PADDING; 1059 } 1060 1061 static __le32 decode_preauth_ctxt(struct ksmbd_conn *conn, 1062 struct smb2_preauth_neg_context *pneg_ctxt, 1063 int ctxt_len) 1064 { 1065 /* 1066 * sizeof(smb2_preauth_neg_context) assumes SMB311_SALT_SIZE Salt, 1067 * which may not be present. Only check for used HashAlgorithms[1]. 1068 */ 1069 if (ctxt_len < 1070 sizeof(struct smb2_neg_context) + MIN_PREAUTH_CTXT_DATA_LEN) 1071 return STATUS_INVALID_PARAMETER; 1072 1073 if (pneg_ctxt->HashAlgorithms != SMB2_PREAUTH_INTEGRITY_SHA512) 1074 return STATUS_SMB_NO_PREAUTH_INTEGRITY_HASH_OVERLAP; 1075 1076 conn->preauth_info->Preauth_HashId = SMB2_PREAUTH_INTEGRITY_SHA512; 1077 return STATUS_SUCCESS; 1078 } 1079 1080 static void decode_encrypt_ctxt(struct ksmbd_conn *conn, 1081 struct smb2_encryption_neg_context *pneg_ctxt, 1082 int ctxt_len) 1083 { 1084 int cph_cnt; 1085 int i, cphs_size; 1086 1087 if (sizeof(struct smb2_encryption_neg_context) > ctxt_len) { 1088 pr_err("Invalid SMB2_ENCRYPTION_CAPABILITIES context size\n"); 1089 return; 1090 } 1091 1092 conn->cipher_type = 0; 1093 1094 cph_cnt = le16_to_cpu(pneg_ctxt->CipherCount); 1095 cphs_size = cph_cnt * sizeof(__le16); 1096 1097 if (sizeof(struct smb2_encryption_neg_context) + cphs_size > 1098 ctxt_len) { 1099 pr_err("Invalid cipher count(%d)\n", cph_cnt); 1100 return; 1101 } 1102 1103 if (server_conf.flags & KSMBD_GLOBAL_FLAG_SMB2_ENCRYPTION_OFF) 1104 return; 1105 1106 for (i = 0; i < cph_cnt; i++) { 1107 if (pneg_ctxt->Ciphers[i] == SMB2_ENCRYPTION_AES128_GCM || 1108 pneg_ctxt->Ciphers[i] == SMB2_ENCRYPTION_AES128_CCM || 1109 pneg_ctxt->Ciphers[i] == SMB2_ENCRYPTION_AES256_CCM || 1110 pneg_ctxt->Ciphers[i] == SMB2_ENCRYPTION_AES256_GCM) { 1111 ksmbd_debug(SMB, "Cipher ID = 0x%x\n", 1112 pneg_ctxt->Ciphers[i]); 1113 conn->cipher_type = pneg_ctxt->Ciphers[i]; 1114 break; 1115 } 1116 } 1117 } 1118 1119 /** 1120 * smb3_encryption_negotiated() - checks if server and client agreed on enabling encryption 1121 * @conn: smb connection 1122 * 1123 * Return: true if connection should be encrypted, else false 1124 */ 1125 bool smb3_encryption_negotiated(struct ksmbd_conn *conn) 1126 { 1127 if (!conn->ops->generate_encryptionkey) 1128 return false; 1129 1130 /* 1131 * SMB 3.0 and 3.0.2 dialects use the SMB2_GLOBAL_CAP_ENCRYPTION flag. 1132 * SMB 3.1.1 uses the cipher_type field. 1133 */ 1134 return (conn->vals->req_capabilities & SMB2_GLOBAL_CAP_ENCRYPTION) || 1135 conn->cipher_type; 1136 } 1137 1138 static __le32 decode_compress_ctxt(struct ksmbd_conn *conn, 1139 struct smb2_compression_capabilities_context *pneg_ctxt, 1140 int ctxt_len) 1141 { 1142 int alg_cnt, algs_size, i; 1143 __le16 *algs; 1144 1145 if (sizeof(struct smb2_neg_context) + 10 > ctxt_len) { 1146 pr_err("Invalid SMB2_COMPRESSION_CAPABILITIES context length\n"); 1147 return STATUS_INVALID_PARAMETER; 1148 } 1149 1150 conn->compress_algorithm = SMB3_COMPRESS_NONE; 1151 conn->compress_chained = false; 1152 conn->compress_pattern = false; 1153 1154 alg_cnt = le16_to_cpu(pneg_ctxt->CompressionAlgorithmCount); 1155 if (!alg_cnt) 1156 return STATUS_INVALID_PARAMETER; 1157 1158 if (pneg_ctxt->Flags != SMB2_COMPRESSION_CAPABILITIES_FLAG_NONE && 1159 pneg_ctxt->Flags != SMB2_COMPRESSION_CAPABILITIES_FLAG_CHAINED) 1160 return STATUS_INVALID_PARAMETER; 1161 1162 algs_size = alg_cnt * sizeof(__le16); 1163 if (sizeof(struct smb2_neg_context) + 8 + algs_size > ctxt_len) { 1164 pr_err("Invalid compression algorithm count(%d)\n", alg_cnt); 1165 return STATUS_INVALID_PARAMETER; 1166 } 1167 1168 /* 1169 * CompressionAlgorithms[] is declared as a fixed 4-element array, but 1170 * the actual element count is variable (clients such as Windows may 1171 * advertise more). The on-wire length was validated above, so walk the 1172 * algorithms through a pointer to avoid a fixed-array bounds check. 1173 */ 1174 algs = pneg_ctxt->CompressionAlgorithms; 1175 for (i = 0; i < alg_cnt; i++) { 1176 __le16 alg = algs[i]; 1177 1178 /* 1179 * LZ77 is the required general-purpose codec. Pattern_V1 is an 1180 * optional chained payload type and cannot stand alone. 1181 */ 1182 if (alg == SMB3_COMPRESS_LZ77) { 1183 conn->compress_algorithm = alg; 1184 conn->compress_chained = 1185 pneg_ctxt->Flags == 1186 SMB2_COMPRESSION_CAPABILITIES_FLAG_CHAINED; 1187 ksmbd_debug(SMB, "Compression Algorithm ID = 0x%x\n", 1188 le16_to_cpu(alg)); 1189 } else if (alg == SMB3_COMPRESS_PATTERN) { 1190 conn->compress_pattern = true; 1191 } 1192 } 1193 1194 if (conn->compress_algorithm == SMB3_COMPRESS_NONE || 1195 !conn->compress_chained) 1196 conn->compress_pattern = false; 1197 1198 return STATUS_SUCCESS; 1199 } 1200 1201 static void decode_sign_cap_ctxt(struct ksmbd_conn *conn, 1202 struct smb2_signing_capabilities *pneg_ctxt, 1203 int ctxt_len) 1204 { 1205 int sign_algo_cnt; 1206 int i, sign_alos_size; 1207 1208 if (sizeof(struct smb2_signing_capabilities) > ctxt_len) { 1209 pr_err("Invalid SMB2_SIGNING_CAPABILITIES context length\n"); 1210 return; 1211 } 1212 1213 conn->signing_negotiated = false; 1214 sign_algo_cnt = le16_to_cpu(pneg_ctxt->SigningAlgorithmCount); 1215 sign_alos_size = sign_algo_cnt * sizeof(__le16); 1216 1217 if (sizeof(struct smb2_signing_capabilities) + sign_alos_size > 1218 ctxt_len) { 1219 pr_err("Invalid signing algorithm count(%d)\n", sign_algo_cnt); 1220 return; 1221 } 1222 1223 for (i = 0; i < sign_algo_cnt; i++) { 1224 if (pneg_ctxt->SigningAlgorithms[i] == SIGNING_ALG_HMAC_SHA256_LE || 1225 pneg_ctxt->SigningAlgorithms[i] == SIGNING_ALG_AES_CMAC_LE) { 1226 ksmbd_debug(SMB, "Signing Algorithm ID = 0x%x\n", 1227 pneg_ctxt->SigningAlgorithms[i]); 1228 conn->signing_negotiated = true; 1229 conn->signing_algorithm = 1230 pneg_ctxt->SigningAlgorithms[i]; 1231 break; 1232 } 1233 } 1234 } 1235 1236 static __le32 deassemble_neg_contexts(struct ksmbd_conn *conn, 1237 struct smb2_negotiate_req *req, 1238 unsigned int len_of_smb) 1239 { 1240 /* +4 is to account for the RFC1001 len field */ 1241 struct smb2_neg_context *pctx = (struct smb2_neg_context *)req; 1242 int i = 0, len_of_ctxts; 1243 unsigned int offset = le32_to_cpu(req->NegotiateContextOffset); 1244 unsigned int neg_ctxt_cnt = le16_to_cpu(req->NegotiateContextCount); 1245 __le32 status = STATUS_INVALID_PARAMETER; 1246 int compress_ctxt_cnt = 0; 1247 1248 ksmbd_debug(SMB, "decoding %d negotiate contexts\n", neg_ctxt_cnt); 1249 if (len_of_smb <= offset) { 1250 ksmbd_debug(SMB, "Invalid response: negotiate context offset\n"); 1251 return status; 1252 } 1253 1254 len_of_ctxts = len_of_smb - offset; 1255 1256 while (i++ < neg_ctxt_cnt) { 1257 int clen, ctxt_len; 1258 1259 if (len_of_ctxts < (int)sizeof(struct smb2_neg_context)) 1260 break; 1261 1262 pctx = (struct smb2_neg_context *)((char *)pctx + offset); 1263 clen = le16_to_cpu(pctx->DataLength); 1264 ctxt_len = clen + sizeof(struct smb2_neg_context); 1265 1266 if (ctxt_len > len_of_ctxts) 1267 break; 1268 1269 if (pctx->ContextType == SMB2_PREAUTH_INTEGRITY_CAPABILITIES) { 1270 ksmbd_debug(SMB, 1271 "deassemble SMB2_PREAUTH_INTEGRITY_CAPABILITIES context\n"); 1272 if (conn->preauth_info->Preauth_HashId) 1273 break; 1274 1275 status = decode_preauth_ctxt(conn, 1276 (struct smb2_preauth_neg_context *)pctx, 1277 ctxt_len); 1278 if (status != STATUS_SUCCESS) 1279 break; 1280 } else if (pctx->ContextType == SMB2_ENCRYPTION_CAPABILITIES) { 1281 ksmbd_debug(SMB, 1282 "deassemble SMB2_ENCRYPTION_CAPABILITIES context\n"); 1283 if (conn->cipher_type) 1284 break; 1285 1286 decode_encrypt_ctxt(conn, 1287 (struct smb2_encryption_neg_context *)pctx, 1288 ctxt_len); 1289 } else if (pctx->ContextType == SMB2_COMPRESSION_CAPABILITIES) { 1290 ksmbd_debug(SMB, 1291 "deassemble SMB2_COMPRESSION_CAPABILITIES context\n"); 1292 if (compress_ctxt_cnt++) { 1293 status = STATUS_INVALID_PARAMETER; 1294 break; 1295 } 1296 1297 status = decode_compress_ctxt(conn, 1298 (struct smb2_compression_capabilities_context *) 1299 pctx, ctxt_len); 1300 if (status != STATUS_SUCCESS) 1301 break; 1302 } else if (pctx->ContextType == SMB2_NETNAME_NEGOTIATE_CONTEXT_ID) { 1303 ksmbd_debug(SMB, 1304 "deassemble SMB2_NETNAME_NEGOTIATE_CONTEXT_ID context\n"); 1305 } else if (pctx->ContextType == SMB2_POSIX_EXTENSIONS_AVAILABLE) { 1306 ksmbd_debug(SMB, 1307 "deassemble SMB2_POSIX_EXTENSIONS_AVAILABLE context\n"); 1308 conn->posix_ext_supported = true; 1309 } else if (pctx->ContextType == SMB2_SIGNING_CAPABILITIES) { 1310 ksmbd_debug(SMB, 1311 "deassemble SMB2_SIGNING_CAPABILITIES context\n"); 1312 1313 decode_sign_cap_ctxt(conn, 1314 (struct smb2_signing_capabilities *)pctx, 1315 ctxt_len); 1316 } 1317 1318 /* offsets must be 8 byte aligned */ 1319 offset = (ctxt_len + 7) & ~0x7; 1320 len_of_ctxts -= offset; 1321 } 1322 return status; 1323 } 1324 1325 /** 1326 * smb2_handle_negotiate() - handler for smb2 negotiate command 1327 * @work: smb work containing smb request buffer 1328 * 1329 * The caller holds conn->srv_mutex. 1330 * 1331 * Return: 0 1332 */ 1333 int smb2_handle_negotiate(struct ksmbd_work *work) 1334 { 1335 struct ksmbd_conn *conn = work->conn; 1336 struct smb2_negotiate_req *req = smb_get_msg(work->request_buf); 1337 struct smb2_negotiate_rsp *rsp = smb_get_msg(work->response_buf); 1338 int rc = 0; 1339 unsigned int smb2_buf_len, smb2_neg_size, neg_ctxt_len = 0; 1340 __le32 status; 1341 1342 ksmbd_debug(SMB, "Received negotiate request\n"); 1343 conn->need_neg = false; 1344 smb2_buf_len = get_rfc1002_len(work->request_buf); 1345 smb2_neg_size = offsetof(struct smb2_negotiate_req, Dialects); 1346 if (smb2_neg_size > smb2_buf_len) { 1347 rsp->hdr.Status = STATUS_INVALID_PARAMETER; 1348 rc = -EINVAL; 1349 goto err_out; 1350 } 1351 1352 if (req->DialectCount == 0) { 1353 pr_err("malformed packet\n"); 1354 rsp->hdr.Status = STATUS_INVALID_PARAMETER; 1355 rc = -EINVAL; 1356 goto err_out; 1357 } 1358 1359 if (conn->dialect == SMB311_PROT_ID) { 1360 unsigned int nego_ctxt_off = le32_to_cpu(req->NegotiateContextOffset); 1361 1362 if (smb2_buf_len < nego_ctxt_off) { 1363 rsp->hdr.Status = STATUS_INVALID_PARAMETER; 1364 rc = -EINVAL; 1365 goto err_out; 1366 } 1367 1368 if (smb2_neg_size > nego_ctxt_off) { 1369 rsp->hdr.Status = STATUS_INVALID_PARAMETER; 1370 rc = -EINVAL; 1371 goto err_out; 1372 } 1373 1374 if (smb2_neg_size + le16_to_cpu(req->DialectCount) * sizeof(__le16) > 1375 nego_ctxt_off) { 1376 rsp->hdr.Status = STATUS_INVALID_PARAMETER; 1377 rc = -EINVAL; 1378 goto err_out; 1379 } 1380 } else { 1381 if (smb2_neg_size + le16_to_cpu(req->DialectCount) * sizeof(__le16) > 1382 smb2_buf_len) { 1383 rsp->hdr.Status = STATUS_INVALID_PARAMETER; 1384 rc = -EINVAL; 1385 goto err_out; 1386 } 1387 } 1388 1389 conn->cli_cap = le32_to_cpu(req->Capabilities); 1390 switch (conn->dialect) { 1391 case SMB311_PROT_ID: 1392 conn->preauth_info = 1393 kzalloc_obj(struct preauth_integrity_info, 1394 KSMBD_DEFAULT_GFP); 1395 if (!conn->preauth_info) { 1396 rc = -ENOMEM; 1397 rsp->hdr.Status = STATUS_INVALID_PARAMETER; 1398 goto err_out; 1399 } 1400 1401 status = deassemble_neg_contexts(conn, req, 1402 get_rfc1002_len(work->request_buf)); 1403 if (status != STATUS_SUCCESS) { 1404 pr_err("deassemble_neg_contexts error(0x%x)\n", 1405 status); 1406 rsp->hdr.Status = status; 1407 rc = -EINVAL; 1408 kfree(conn->preauth_info); 1409 conn->preauth_info = NULL; 1410 goto err_out; 1411 } 1412 1413 rc = init_smb3_11_server(conn); 1414 if (rc < 0) { 1415 rsp->hdr.Status = STATUS_INVALID_PARAMETER; 1416 kfree(conn->preauth_info); 1417 conn->preauth_info = NULL; 1418 goto err_out; 1419 } 1420 1421 ksmbd_gen_preauth_integrity_hash(conn, 1422 work->request_buf, 1423 conn->preauth_info->Preauth_HashValue); 1424 rsp->NegotiateContextOffset = 1425 cpu_to_le32(OFFSET_OF_NEG_CONTEXT); 1426 neg_ctxt_len = assemble_neg_contexts(conn, rsp); 1427 break; 1428 case SMB302_PROT_ID: 1429 init_smb3_02_server(conn); 1430 break; 1431 case SMB30_PROT_ID: 1432 init_smb3_0_server(conn); 1433 break; 1434 case SMB21_PROT_ID: 1435 init_smb2_1_server(conn); 1436 break; 1437 case SMB2X_PROT_ID: 1438 case BAD_PROT_ID: 1439 default: 1440 ksmbd_debug(SMB, "Server dialect :0x%x not supported\n", 1441 conn->dialect); 1442 rsp->hdr.Status = STATUS_NOT_SUPPORTED; 1443 rc = -EINVAL; 1444 goto err_out; 1445 } 1446 rsp->Capabilities = cpu_to_le32(conn->vals->req_capabilities); 1447 1448 /* For stats */ 1449 conn->connection_type = conn->dialect; 1450 1451 rsp->MaxTransactSize = cpu_to_le32(conn->vals->max_trans_size); 1452 rsp->MaxReadSize = cpu_to_le32(conn->vals->max_read_size); 1453 rsp->MaxWriteSize = cpu_to_le32(conn->vals->max_write_size); 1454 1455 memcpy(conn->ClientGUID, req->ClientGUID, 1456 SMB2_CLIENT_GUID_SIZE); 1457 conn->cli_sec_mode = le16_to_cpu(req->SecurityMode); 1458 1459 rsp->StructureSize = cpu_to_le16(65); 1460 rsp->DialectRevision = cpu_to_le16(conn->dialect); 1461 /* Not setting conn guid rsp->ServerGUID, as it 1462 * not used by client for identifying server 1463 */ 1464 memset(rsp->ServerGUID, 0, SMB2_CLIENT_GUID_SIZE); 1465 1466 rsp->SystemTime = cpu_to_le64(ksmbd_systime()); 1467 rsp->ServerStartTime = 0; 1468 ksmbd_debug(SMB, "negotiate context offset %d, count %d\n", 1469 le32_to_cpu(rsp->NegotiateContextOffset), 1470 le16_to_cpu(rsp->NegotiateContextCount)); 1471 1472 rsp->SecurityBufferOffset = cpu_to_le16(128); 1473 rsp->SecurityBufferLength = cpu_to_le16(AUTH_GSS_LENGTH); 1474 ksmbd_copy_gss_neg_header((char *)(&rsp->hdr) + 1475 le16_to_cpu(rsp->SecurityBufferOffset)); 1476 1477 rsp->SecurityMode = SMB2_NEGOTIATE_SIGNING_ENABLED_LE; 1478 conn->use_spnego = true; 1479 1480 if ((server_conf.signing == KSMBD_CONFIG_OPT_AUTO || 1481 server_conf.signing == KSMBD_CONFIG_OPT_DISABLED) && 1482 req->SecurityMode & SMB2_NEGOTIATE_SIGNING_REQUIRED_LE) 1483 conn->sign = true; 1484 else if (server_conf.signing == KSMBD_CONFIG_OPT_MANDATORY) { 1485 server_conf.enforced_signing = true; 1486 rsp->SecurityMode |= SMB2_NEGOTIATE_SIGNING_REQUIRED_LE; 1487 conn->sign = true; 1488 } 1489 1490 conn->srv_sec_mode = le16_to_cpu(rsp->SecurityMode); 1491 ksmbd_conn_set_need_setup(conn); 1492 1493 err_out: 1494 if (rc) 1495 rsp->hdr.Status = STATUS_INSUFFICIENT_RESOURCES; 1496 1497 if (!rc) 1498 rc = ksmbd_iov_pin_rsp(work, rsp, 1499 sizeof(struct smb2_negotiate_rsp) + 1500 AUTH_GSS_LENGTH + neg_ctxt_len); 1501 if (rc < 0) 1502 smb2_set_err_rsp(work); 1503 return rc; 1504 } 1505 1506 static int alloc_preauth_hash(struct ksmbd_session *sess, 1507 struct ksmbd_conn *conn) 1508 { 1509 if (sess->Preauth_HashValue) 1510 return 0; 1511 1512 if (!conn->preauth_info) 1513 return -ENOMEM; 1514 1515 sess->Preauth_HashValue = kmemdup(conn->preauth_info->Preauth_HashValue, 1516 PREAUTH_HASHVALUE_SIZE, KSMBD_DEFAULT_GFP); 1517 if (!sess->Preauth_HashValue) 1518 return -ENOMEM; 1519 1520 return 0; 1521 } 1522 1523 static int generate_preauth_hash(struct ksmbd_work *work) 1524 { 1525 struct ksmbd_conn *conn = work->conn; 1526 struct ksmbd_session *sess = work->sess; 1527 u8 *preauth_hash; 1528 1529 if (conn->dialect != SMB311_PROT_ID) 1530 return 0; 1531 1532 if (conn->binding) { 1533 struct preauth_session *preauth_sess; 1534 1535 preauth_sess = ksmbd_preauth_session_lookup(conn, sess->id); 1536 if (!preauth_sess) { 1537 preauth_sess = ksmbd_preauth_session_alloc(conn, sess->id); 1538 if (!preauth_sess) 1539 return -ENOMEM; 1540 } 1541 1542 preauth_hash = preauth_sess->Preauth_HashValue; 1543 } else { 1544 if (!sess->Preauth_HashValue) 1545 if (alloc_preauth_hash(sess, conn)) 1546 return -ENOMEM; 1547 preauth_hash = sess->Preauth_HashValue; 1548 } 1549 1550 ksmbd_gen_preauth_integrity_hash(conn, work->request_buf, preauth_hash); 1551 return 0; 1552 } 1553 1554 static int decode_negotiation_token(struct ksmbd_conn *conn, 1555 struct negotiate_message *negblob, 1556 size_t sz) 1557 { 1558 if (!conn->use_spnego) 1559 return -EINVAL; 1560 1561 if (ksmbd_decode_negTokenInit((char *)negblob, sz, conn)) { 1562 if (ksmbd_decode_negTokenTarg((char *)negblob, sz, conn)) { 1563 conn->auth_mechs |= KSMBD_AUTH_NTLMSSP; 1564 conn->preferred_auth_mech = KSMBD_AUTH_NTLMSSP; 1565 conn->use_spnego = false; 1566 } 1567 } 1568 return 0; 1569 } 1570 1571 static int ntlm_negotiate(struct ksmbd_work *work, 1572 struct negotiate_message *negblob, 1573 size_t negblob_len, struct smb2_sess_setup_rsp *rsp) 1574 { 1575 struct challenge_message *chgblob; 1576 unsigned char *spnego_blob = NULL; 1577 u16 spnego_blob_len; 1578 char *neg_blob; 1579 int sz, rc; 1580 1581 ksmbd_debug(SMB, "negotiate phase\n"); 1582 rc = ksmbd_decode_ntlmssp_neg_blob(negblob, negblob_len, work->conn); 1583 if (rc) 1584 return rc; 1585 1586 sz = le16_to_cpu(rsp->SecurityBufferOffset); 1587 chgblob = (struct challenge_message *)rsp->Buffer; 1588 memset(chgblob, 0, sizeof(struct challenge_message)); 1589 1590 if (!work->conn->use_spnego) { 1591 sz = ksmbd_build_ntlmssp_challenge_blob(chgblob, work->conn); 1592 if (sz < 0) 1593 return -ENOMEM; 1594 1595 rsp->SecurityBufferLength = cpu_to_le16(sz); 1596 return 0; 1597 } 1598 1599 sz = sizeof(struct challenge_message); 1600 sz += (strlen(ksmbd_netbios_name()) * 2 + 1 + 4) * 6; 1601 1602 neg_blob = kzalloc(sz, KSMBD_DEFAULT_GFP); 1603 if (!neg_blob) 1604 return -ENOMEM; 1605 1606 chgblob = (struct challenge_message *)neg_blob; 1607 sz = ksmbd_build_ntlmssp_challenge_blob(chgblob, work->conn); 1608 if (sz < 0) { 1609 rc = -ENOMEM; 1610 goto out; 1611 } 1612 1613 rc = build_spnego_ntlmssp_neg_blob(&spnego_blob, &spnego_blob_len, 1614 neg_blob, sz); 1615 if (rc) { 1616 rc = -ENOMEM; 1617 goto out; 1618 } 1619 1620 memcpy(rsp->Buffer, spnego_blob, spnego_blob_len); 1621 rsp->SecurityBufferLength = cpu_to_le16(spnego_blob_len); 1622 1623 out: 1624 kfree(spnego_blob); 1625 kfree(neg_blob); 1626 return rc; 1627 } 1628 1629 static struct authenticate_message *user_authblob(struct ksmbd_conn *conn, 1630 struct smb2_sess_setup_req *req) 1631 { 1632 int sz; 1633 1634 if (conn->use_spnego && conn->mechToken) 1635 return (struct authenticate_message *)conn->mechToken; 1636 1637 sz = le16_to_cpu(req->SecurityBufferOffset); 1638 return (struct authenticate_message *)((char *)&req->hdr.ProtocolId 1639 + sz); 1640 } 1641 1642 static struct ksmbd_user *session_user(struct ksmbd_conn *conn, 1643 struct smb2_sess_setup_req *req) 1644 { 1645 struct authenticate_message *authblob; 1646 struct ksmbd_user *user; 1647 char *name; 1648 unsigned int name_off, name_len, secbuf_len; 1649 1650 if (conn->use_spnego && conn->mechToken) 1651 secbuf_len = conn->mechTokenLen; 1652 else 1653 secbuf_len = le16_to_cpu(req->SecurityBufferLength); 1654 if (secbuf_len < sizeof(struct authenticate_message)) { 1655 ksmbd_debug(SMB, "blob len %d too small\n", secbuf_len); 1656 return NULL; 1657 } 1658 authblob = user_authblob(conn, req); 1659 name_off = le32_to_cpu(authblob->UserName.BufferOffset); 1660 name_len = le16_to_cpu(authblob->UserName.Length); 1661 1662 if (secbuf_len < (u64)name_off + name_len) 1663 return NULL; 1664 1665 name = smb_strndup_from_utf16((const char *)authblob + name_off, 1666 name_len, 1667 true, 1668 conn->local_nls); 1669 if (IS_ERR(name)) { 1670 pr_err("cannot allocate memory\n"); 1671 return NULL; 1672 } 1673 1674 ksmbd_debug(SMB, "session setup request for user %s\n", name); 1675 user = ksmbd_login_user(name); 1676 kfree(name); 1677 return user; 1678 } 1679 1680 static int ntlm_authenticate(struct ksmbd_work *work, 1681 struct smb2_sess_setup_req *req, 1682 struct smb2_sess_setup_rsp *rsp) 1683 { 1684 struct ksmbd_conn *conn = work->conn; 1685 struct ksmbd_session *sess = work->sess; 1686 struct ksmbd_user *user; 1687 char channel_key[CIFS_KEY_SIZE] = {}; 1688 char *auth_key = conn->binding ? channel_key : sess->sess_key; 1689 u64 prev_id; 1690 bool binding = conn->binding; 1691 int sz, rc; 1692 1693 ksmbd_debug(SMB, "authenticate phase\n"); 1694 if (conn->use_spnego) { 1695 unsigned char *spnego_blob; 1696 u16 spnego_blob_len; 1697 1698 rc = build_spnego_ntlmssp_auth_blob(&spnego_blob, 1699 &spnego_blob_len, 1700 0); 1701 if (rc) 1702 return -ENOMEM; 1703 1704 memcpy(rsp->Buffer, spnego_blob, spnego_blob_len); 1705 rsp->SecurityBufferLength = cpu_to_le16(spnego_blob_len); 1706 kfree(spnego_blob); 1707 } 1708 1709 user = session_user(conn, req); 1710 if (!user) { 1711 ksmbd_debug(SMB, "Unknown user name or an error\n"); 1712 return -EPERM; 1713 } 1714 1715 if (sess->state == SMB2_SESSION_VALID) { 1716 /* 1717 * Reuse session if anonymous try to connect 1718 * on reauthetication. 1719 */ 1720 if (conn->binding == false && ksmbd_anonymous_user(user)) { 1721 ksmbd_free_user(user); 1722 return 0; 1723 } 1724 1725 if (!ksmbd_compare_user(sess->user, user)) { 1726 ksmbd_free_user(user); 1727 return -EKEYREJECTED; 1728 } 1729 ksmbd_free_user(user); 1730 } else { 1731 sess->user = user; 1732 } 1733 1734 if (conn->binding == false && user_guest(sess->user)) { 1735 rsp->SessionFlags = SMB2_SESSION_FLAG_IS_GUEST_LE; 1736 } else { 1737 struct authenticate_message *authblob; 1738 1739 authblob = user_authblob(conn, req); 1740 if (conn->use_spnego && conn->mechToken) 1741 sz = conn->mechTokenLen; 1742 else 1743 sz = le16_to_cpu(req->SecurityBufferLength); 1744 rc = ksmbd_decode_ntlmssp_auth_blob(authblob, sz, conn, sess, 1745 auth_key); 1746 if (rc) { 1747 set_user_flag(sess->user, KSMBD_USER_FLAG_BAD_PASSWORD); 1748 ksmbd_debug(SMB, "authentication failed\n"); 1749 rc = -EPERM; 1750 goto out; 1751 } 1752 } 1753 1754 prev_id = le64_to_cpu(req->PreviousSessionId); 1755 if (prev_id && prev_id != sess->id) 1756 destroy_previous_session(conn, sess->user, prev_id); 1757 1758 /* 1759 * If session state is SMB2_SESSION_VALID, We can assume 1760 * that it is reauthentication. And the user/password 1761 * has been verified, so return it here. 1762 */ 1763 if (sess->state == SMB2_SESSION_VALID) { 1764 if (conn->binding) 1765 goto binding_session; 1766 return 0; 1767 } 1768 1769 if ((rsp->SessionFlags != SMB2_SESSION_FLAG_IS_GUEST_LE && 1770 (conn->sign || server_conf.enforced_signing)) || 1771 (req->SecurityMode & SMB2_NEGOTIATE_SIGNING_REQUIRED)) 1772 sess->sign = true; 1773 1774 if (smb3_encryption_negotiated(conn) && 1775 !(req->Flags & SMB2_SESSION_REQ_FLAG_BINDING)) { 1776 conn->ops->generate_encryptionkey(conn, sess); 1777 sess->enc = true; 1778 if (server_conf.flags & KSMBD_GLOBAL_FLAG_SMB2_ENCRYPTION) 1779 rsp->SessionFlags = SMB2_SESSION_FLAG_ENCRYPT_DATA_LE; 1780 /* 1781 * signing is disable if encryption is enable 1782 * on this session 1783 */ 1784 sess->sign = false; 1785 } 1786 1787 binding_session: 1788 if (conn->dialect >= SMB30_PROT_ID) { 1789 rc = register_session_channel(sess, conn, auth_key); 1790 if (rc) 1791 goto out; 1792 } 1793 1794 if (conn->ops->generate_signingkey) { 1795 rc = conn->ops->generate_signingkey(sess, conn); 1796 if (rc) { 1797 ksmbd_debug(SMB, "SMB3 signing key generation failed\n"); 1798 rc = -EINVAL; 1799 goto out; 1800 } 1801 } 1802 1803 if (!ksmbd_conn_lookup_dialect(conn)) { 1804 pr_err("fail to verify the dialect\n"); 1805 rc = -ENOENT; 1806 goto out; 1807 } 1808 rc = 0; 1809 out: 1810 if (binding) 1811 memzero_explicit(channel_key, sizeof(channel_key)); 1812 return rc; 1813 } 1814 1815 #ifdef CONFIG_SMB_SERVER_KERBEROS5 1816 static int krb5_authenticate(struct ksmbd_work *work, 1817 struct smb2_sess_setup_req *req, 1818 struct smb2_sess_setup_rsp *rsp) 1819 { 1820 struct ksmbd_conn *conn = work->conn; 1821 struct ksmbd_session *sess = work->sess; 1822 char *in_blob, *out_blob; 1823 char channel_key[CIFS_KEY_SIZE] = {}; 1824 char *auth_key = conn->binding ? channel_key : sess->sess_key; 1825 u64 prev_sess_id; 1826 bool binding = conn->binding; 1827 int in_len, out_len; 1828 int retval; 1829 1830 in_blob = (char *)&req->hdr.ProtocolId + 1831 le16_to_cpu(req->SecurityBufferOffset); 1832 in_len = le16_to_cpu(req->SecurityBufferLength); 1833 out_blob = (char *)&rsp->hdr.ProtocolId + 1834 le16_to_cpu(rsp->SecurityBufferOffset); 1835 out_len = work->response_sz - 1836 (le16_to_cpu(rsp->SecurityBufferOffset) + 4); 1837 1838 retval = ksmbd_krb5_authenticate(sess, in_blob, in_len, 1839 out_blob, &out_len, auth_key); 1840 if (retval) { 1841 ksmbd_debug(SMB, "krb5 authentication failed\n"); 1842 if (retval != -EKEYREJECTED) 1843 retval = -EINVAL; 1844 goto out; 1845 } 1846 1847 /* Check previous session */ 1848 prev_sess_id = le64_to_cpu(req->PreviousSessionId); 1849 if (prev_sess_id && prev_sess_id != sess->id) 1850 destroy_previous_session(conn, sess->user, prev_sess_id); 1851 1852 rsp->SecurityBufferLength = cpu_to_le16(out_len); 1853 1854 /* 1855 * If session state is SMB2_SESSION_VALID, We can assume 1856 * that it is reauthentication. And the user/password 1857 * has been verified, so return it here. 1858 */ 1859 if (sess->state == SMB2_SESSION_VALID) { 1860 if (conn->binding) 1861 goto binding_session; 1862 return 0; 1863 } 1864 1865 if ((rsp->SessionFlags != SMB2_SESSION_FLAG_IS_GUEST_LE && 1866 (conn->sign || server_conf.enforced_signing)) || 1867 (req->SecurityMode & SMB2_NEGOTIATE_SIGNING_REQUIRED)) 1868 sess->sign = true; 1869 1870 if (smb3_encryption_negotiated(conn) && 1871 !(req->Flags & SMB2_SESSION_REQ_FLAG_BINDING)) { 1872 conn->ops->generate_encryptionkey(conn, sess); 1873 sess->enc = true; 1874 if (server_conf.flags & KSMBD_GLOBAL_FLAG_SMB2_ENCRYPTION) 1875 rsp->SessionFlags = SMB2_SESSION_FLAG_ENCRYPT_DATA_LE; 1876 sess->sign = false; 1877 } 1878 1879 binding_session: 1880 if (conn->dialect >= SMB30_PROT_ID) { 1881 retval = register_session_channel(sess, conn, auth_key); 1882 if (retval) 1883 goto out; 1884 } 1885 1886 if (conn->ops->generate_signingkey) { 1887 retval = conn->ops->generate_signingkey(sess, conn); 1888 if (retval) { 1889 ksmbd_debug(SMB, "SMB3 signing key generation failed\n"); 1890 retval = -EINVAL; 1891 goto out; 1892 } 1893 } 1894 1895 if (!ksmbd_conn_lookup_dialect(conn)) { 1896 pr_err("fail to verify the dialect\n"); 1897 retval = -ENOENT; 1898 goto out; 1899 } 1900 retval = 0; 1901 out: 1902 if (binding) 1903 memzero_explicit(channel_key, sizeof(channel_key)); 1904 return retval; 1905 } 1906 #else 1907 static int krb5_authenticate(struct ksmbd_work *work, 1908 struct smb2_sess_setup_req *req, 1909 struct smb2_sess_setup_rsp *rsp) 1910 { 1911 return -EOPNOTSUPP; 1912 } 1913 #endif 1914 1915 int smb2_sess_setup(struct ksmbd_work *work) 1916 { 1917 struct ksmbd_conn *conn = work->conn; 1918 struct smb2_sess_setup_req *req; 1919 struct smb2_sess_setup_rsp *rsp; 1920 struct ksmbd_session *sess; 1921 struct negotiate_message *negblob; 1922 unsigned int negblob_len, negblob_off; 1923 int rc = 0; 1924 1925 ksmbd_debug(SMB, "Received smb2 session setup request\n"); 1926 1927 if (!ksmbd_conn_need_setup(conn) && !ksmbd_conn_good(conn)) { 1928 work->send_no_response = 1; 1929 return rc; 1930 } 1931 1932 WORK_BUFFERS(work, req, rsp); 1933 1934 rsp->StructureSize = cpu_to_le16(9); 1935 rsp->SessionFlags = 0; 1936 rsp->SecurityBufferOffset = cpu_to_le16(72); 1937 rsp->SecurityBufferLength = 0; 1938 1939 ksmbd_conn_lock(conn); 1940 if (!req->hdr.SessionId) { 1941 sess = ksmbd_smb2_session_create(); 1942 if (!sess) { 1943 rc = -ENOMEM; 1944 goto out_err; 1945 } 1946 rsp->hdr.SessionId = cpu_to_le64(sess->id); 1947 rc = ksmbd_session_register(conn, sess); 1948 if (rc) 1949 goto out_err; 1950 1951 conn->binding = false; 1952 } else if (conn->dialect >= SMB30_PROT_ID && 1953 (server_conf.flags & KSMBD_GLOBAL_FLAG_SMB3_MULTICHANNEL) && 1954 req->Flags & SMB2_SESSION_REQ_FLAG_BINDING) { 1955 u64 sess_id = le64_to_cpu(req->hdr.SessionId); 1956 1957 sess = ksmbd_session_lookup_slowpath(sess_id); 1958 if (!sess) { 1959 rc = -ENOENT; 1960 goto out_err; 1961 } 1962 1963 if (conn->dialect != sess->dialect) { 1964 rc = -EINVAL; 1965 goto out_err; 1966 } 1967 1968 if (!(req->hdr.Flags & SMB2_FLAGS_SIGNED)) { 1969 rc = -EINVAL; 1970 goto out_err; 1971 } 1972 1973 if (memcmp(conn->ClientGUID, sess->ClientGUID, 1974 SMB2_CLIENT_GUID_SIZE)) { 1975 rc = -ENOENT; 1976 goto out_err; 1977 } 1978 1979 if (sess->state == SMB2_SESSION_IN_PROGRESS) { 1980 rc = -EACCES; 1981 goto out_err; 1982 } 1983 1984 if (sess->state == SMB2_SESSION_EXPIRED) { 1985 rc = -EFAULT; 1986 goto out_err; 1987 } 1988 1989 if (ksmbd_conn_need_reconnect(conn)) { 1990 rc = -EFAULT; 1991 ksmbd_user_session_put(sess); 1992 sess = NULL; 1993 goto out_err; 1994 } 1995 1996 if (is_ksmbd_session_in_connection(conn, sess_id)) { 1997 rc = -EACCES; 1998 goto out_err; 1999 } 2000 2001 if (user_guest(sess->user)) { 2002 rc = -EOPNOTSUPP; 2003 goto out_err; 2004 } 2005 2006 conn->binding = true; 2007 } else if ((conn->dialect < SMB30_PROT_ID || 2008 server_conf.flags & KSMBD_GLOBAL_FLAG_SMB3_MULTICHANNEL) && 2009 (req->Flags & SMB2_SESSION_REQ_FLAG_BINDING)) { 2010 sess = ksmbd_session_lookup_slowpath(le64_to_cpu(req->hdr.SessionId)); 2011 if (sess) { 2012 int sign_ret; 2013 2014 work->sess = sess; 2015 if (sess->dialect >= SMB30_PROT_ID) 2016 sign_ret = smb3_check_sign_req(work); 2017 else 2018 sign_ret = smb2_check_sign_req(work); 2019 if (sess->state != SMB2_SESSION_VALID || 2020 !(req->hdr.Flags & SMB2_FLAGS_SIGNED) || 2021 !sign_ret) { 2022 ksmbd_user_session_put(sess); 2023 work->sess = NULL; 2024 sess = NULL; 2025 } 2026 } 2027 rc = -EACCES; 2028 goto out_err; 2029 } else { 2030 sess = ksmbd_session_lookup(conn, 2031 le64_to_cpu(req->hdr.SessionId)); 2032 if (!sess) { 2033 sess = ksmbd_session_lookup_slowpath(le64_to_cpu(req->hdr.SessionId)); 2034 if (sess && !lookup_chann_list(sess, conn)) { 2035 ksmbd_user_session_put(sess); 2036 sess = NULL; 2037 } 2038 } 2039 if (!sess) { 2040 rc = -ENOENT; 2041 goto out_err; 2042 } 2043 2044 if (sess->state == SMB2_SESSION_EXPIRED) { 2045 rc = -EFAULT; 2046 goto out_err; 2047 } 2048 2049 if (ksmbd_conn_need_reconnect(conn)) { 2050 rc = -EFAULT; 2051 ksmbd_user_session_put(sess); 2052 sess = NULL; 2053 goto out_err; 2054 } 2055 2056 conn->binding = false; 2057 } 2058 work->sess = sess; 2059 2060 negblob_off = le16_to_cpu(req->SecurityBufferOffset); 2061 negblob_len = le16_to_cpu(req->SecurityBufferLength); 2062 if (negblob_off < offsetof(struct smb2_sess_setup_req, Buffer)) { 2063 rc = -EINVAL; 2064 goto out_err; 2065 } 2066 2067 negblob = (struct negotiate_message *)((char *)&req->hdr.ProtocolId + 2068 negblob_off); 2069 2070 if (decode_negotiation_token(conn, negblob, negblob_len) == 0) { 2071 if (conn->mechToken) { 2072 negblob = (struct negotiate_message *)conn->mechToken; 2073 negblob_len = conn->mechTokenLen; 2074 } 2075 } 2076 2077 if (negblob_len < offsetof(struct negotiate_message, NegotiateFlags)) { 2078 rc = -EINVAL; 2079 goto out_err; 2080 } 2081 2082 if (server_conf.auth_mechs & conn->auth_mechs) { 2083 rc = generate_preauth_hash(work); 2084 if (rc) 2085 goto out_err; 2086 2087 if (conn->preferred_auth_mech & 2088 (KSMBD_AUTH_KRB5 | KSMBD_AUTH_MSKRB5)) { 2089 rc = krb5_authenticate(work, req, rsp); 2090 if (rc) { 2091 rc = -EINVAL; 2092 goto out_err; 2093 } 2094 2095 if (!ksmbd_conn_need_reconnect(conn)) { 2096 ksmbd_conn_set_good(conn); 2097 sess->state = SMB2_SESSION_VALID; 2098 } 2099 } else if (conn->preferred_auth_mech == KSMBD_AUTH_NTLMSSP) { 2100 if (negblob->MessageType == NtLmNegotiate) { 2101 rc = ntlm_negotiate(work, negblob, negblob_len, rsp); 2102 if (rc) 2103 goto out_err; 2104 rsp->hdr.Status = 2105 STATUS_MORE_PROCESSING_REQUIRED; 2106 } else if (negblob->MessageType == NtLmAuthenticate) { 2107 rc = ntlm_authenticate(work, req, rsp); 2108 if (rc) 2109 goto out_err; 2110 2111 if (!ksmbd_conn_need_reconnect(conn)) { 2112 ksmbd_conn_set_good(conn); 2113 sess->state = SMB2_SESSION_VALID; 2114 } 2115 if (conn->binding) { 2116 struct preauth_session *preauth_sess; 2117 2118 preauth_sess = 2119 ksmbd_preauth_session_lookup(conn, sess->id); 2120 if (preauth_sess) { 2121 list_del(&preauth_sess->preauth_entry); 2122 kfree(preauth_sess); 2123 } 2124 } 2125 } else { 2126 pr_info_ratelimited("Unknown NTLMSSP message type : 0x%x\n", 2127 le32_to_cpu(negblob->MessageType)); 2128 rc = -EINVAL; 2129 } 2130 } else { 2131 /* TODO: need one more negotiation */ 2132 pr_err("Not support the preferred authentication\n"); 2133 rc = -EINVAL; 2134 } 2135 } else { 2136 pr_err("Not support authentication\n"); 2137 rc = -EINVAL; 2138 } 2139 2140 out_err: 2141 if (rc == -EINVAL) 2142 rsp->hdr.Status = STATUS_INVALID_PARAMETER; 2143 else if (rc == -ENOENT) 2144 rsp->hdr.Status = STATUS_USER_SESSION_DELETED; 2145 else if (rc == -EACCES) 2146 rsp->hdr.Status = STATUS_REQUEST_NOT_ACCEPTED; 2147 else if (rc == -EFAULT) 2148 rsp->hdr.Status = STATUS_NETWORK_SESSION_EXPIRED; 2149 else if (rc == -ENOMEM || rc == -ENOSPC) 2150 rsp->hdr.Status = STATUS_INSUFFICIENT_RESOURCES; 2151 else if (rc == -EOPNOTSUPP) 2152 rsp->hdr.Status = STATUS_NOT_SUPPORTED; 2153 else if (rc == -EKEYREJECTED) 2154 rsp->hdr.Status = STATUS_ACCESS_DENIED; 2155 else if (rc) 2156 rsp->hdr.Status = STATUS_LOGON_FAILURE; 2157 if ((rsp->hdr.Status == STATUS_USER_SESSION_DELETED || 2158 (rsp->hdr.Status == STATUS_INVALID_PARAMETER && 2159 (req->Flags & SMB2_SESSION_REQ_FLAG_BINDING))) && 2160 (req->hdr.Flags & SMB2_FLAGS_SIGNED)) 2161 rsp->hdr.Flags |= SMB2_FLAGS_SIGNED; 2162 2163 if (conn->mechToken) { 2164 kfree(conn->mechToken); 2165 conn->mechToken = NULL; 2166 } 2167 2168 if (rc < 0) { 2169 if (sess && conn->dialect == SMB311_PROT_ID && 2170 (req->Flags & SMB2_SESSION_REQ_FLAG_BINDING)) { 2171 struct preauth_session *preauth_sess; 2172 2173 preauth_sess = ksmbd_preauth_session_lookup(conn, sess->id); 2174 if (preauth_sess) { 2175 list_del(&preauth_sess->preauth_entry); 2176 kfree(preauth_sess); 2177 } 2178 } 2179 2180 /* 2181 * SecurityBufferOffset should be set to zero 2182 * in session setup error response. 2183 */ 2184 rsp->SecurityBufferOffset = 0; 2185 2186 if (sess) { 2187 bool try_delay = false; 2188 2189 /* 2190 * To avoid dictionary attacks (repeated session setups rapidly sent) to 2191 * connect to server, ksmbd make a delay of a 5 seconds on session setup 2192 * failure to make it harder to send enough random connection requests 2193 * to break into a server. 2194 */ 2195 if (sess->user && sess->user->flags & KSMBD_USER_FLAG_DELAY_SESSION) 2196 try_delay = true; 2197 2198 /* 2199 * For binding requests, session belongs to another 2200 * connection. Do not expire it. 2201 */ 2202 if (!(req->Flags & SMB2_SESSION_REQ_FLAG_BINDING)) { 2203 sess->last_active = jiffies; 2204 sess->state = SMB2_SESSION_EXPIRED; 2205 } 2206 /* 2207 * Keep the binding session reference until the response is 2208 * signed and sent. Error responses for a signed binding 2209 * request are signed with the existing session signing key. 2210 */ 2211 if (!(req->Flags & SMB2_SESSION_REQ_FLAG_BINDING) || 2212 work->sess != sess) { 2213 ksmbd_user_session_put(sess); 2214 work->sess = NULL; 2215 } 2216 if (try_delay) { 2217 ksmbd_conn_set_need_reconnect(conn); 2218 ssleep(5); 2219 ksmbd_conn_set_need_setup(conn); 2220 } 2221 } 2222 smb2_set_err_rsp(work); 2223 conn->binding = false; 2224 } else { 2225 unsigned int iov_len; 2226 2227 if (rsp->SecurityBufferLength) 2228 iov_len = offsetof(struct smb2_sess_setup_rsp, Buffer) + 2229 le16_to_cpu(rsp->SecurityBufferLength); 2230 else 2231 iov_len = sizeof(struct smb2_sess_setup_rsp); 2232 rc = ksmbd_iov_pin_rsp(work, rsp, iov_len); 2233 if (rc) 2234 rsp->hdr.Status = STATUS_INSUFFICIENT_RESOURCES; 2235 } 2236 2237 ksmbd_conn_unlock(conn); 2238 return rc; 2239 } 2240 2241 /** 2242 * smb2_tree_connect() - handler for smb2 tree connect command 2243 * @work: smb work containing smb request buffer 2244 * 2245 * Return: 0 on success, otherwise error 2246 */ 2247 int smb2_tree_connect(struct ksmbd_work *work) 2248 { 2249 struct ksmbd_conn *conn = work->conn; 2250 struct smb2_tree_connect_req *req; 2251 struct smb2_tree_connect_rsp *rsp; 2252 struct ksmbd_session *sess = work->sess; 2253 char *treename = NULL, *name = NULL; 2254 struct ksmbd_tree_conn_status status; 2255 struct ksmbd_share_config *share = NULL; 2256 int rc = -EINVAL; 2257 2258 ksmbd_debug(SMB, "Received smb2 tree connect request\n"); 2259 2260 WORK_BUFFERS(work, req, rsp); 2261 2262 treename = smb_strndup_from_utf16((char *)req + le16_to_cpu(req->PathOffset), 2263 le16_to_cpu(req->PathLength), true, 2264 conn->local_nls); 2265 if (IS_ERR(treename)) { 2266 pr_err("treename is NULL\n"); 2267 status.ret = KSMBD_TREE_CONN_STATUS_ERROR; 2268 goto out_err1; 2269 } 2270 2271 name = ksmbd_extract_sharename(conn->um, treename); 2272 if (IS_ERR(name)) { 2273 status.ret = KSMBD_TREE_CONN_STATUS_ERROR; 2274 goto out_err1; 2275 } 2276 2277 ksmbd_debug(SMB, "tree connect request for tree %s treename %s\n", 2278 name, treename); 2279 2280 status = ksmbd_tree_conn_connect(work, name); 2281 if (status.ret == KSMBD_TREE_CONN_STATUS_OK) 2282 rsp->hdr.Id.SyncId.TreeId = cpu_to_le32(status.tree_conn->id); 2283 else 2284 goto out_err1; 2285 2286 share = status.tree_conn->share_conf; 2287 if (test_share_config_flag(share, KSMBD_SHARE_FLAG_PIPE)) { 2288 ksmbd_debug(SMB, "IPC share path request\n"); 2289 rsp->ShareType = SMB2_SHARE_TYPE_PIPE; 2290 rsp->MaximalAccess = FILE_READ_DATA_LE | FILE_READ_EA_LE | 2291 FILE_EXECUTE_LE | FILE_READ_ATTRIBUTES_LE | 2292 FILE_DELETE_LE | FILE_READ_CONTROL_LE | 2293 FILE_WRITE_DAC_LE | FILE_WRITE_OWNER_LE | 2294 FILE_SYNCHRONIZE_LE; 2295 } else { 2296 rsp->ShareType = SMB2_SHARE_TYPE_DISK; 2297 rsp->MaximalAccess = FILE_READ_DATA_LE | FILE_READ_EA_LE | 2298 FILE_EXECUTE_LE | FILE_READ_ATTRIBUTES_LE; 2299 if (test_tree_conn_flag(status.tree_conn, 2300 KSMBD_TREE_CONN_FLAG_WRITABLE)) { 2301 rsp->MaximalAccess |= FILE_WRITE_DATA_LE | 2302 FILE_APPEND_DATA_LE | FILE_WRITE_EA_LE | 2303 FILE_DELETE_LE | FILE_WRITE_ATTRIBUTES_LE | 2304 FILE_DELETE_CHILD_LE | FILE_READ_CONTROL_LE | 2305 FILE_WRITE_DAC_LE | FILE_WRITE_OWNER_LE | 2306 FILE_SYNCHRONIZE_LE; 2307 } 2308 } 2309 2310 status.tree_conn->maximal_access = le32_to_cpu(rsp->MaximalAccess); 2311 if (conn->posix_ext_supported) 2312 status.tree_conn->posix_extensions = true; 2313 2314 down_write(&sess->tree_conns_lock); 2315 status.tree_conn->t_state = TREE_CONNECTED; 2316 up_write(&sess->tree_conns_lock); 2317 rsp->StructureSize = cpu_to_le16(16); 2318 out_err1: 2319 if (server_conf.flags & KSMBD_GLOBAL_FLAG_DURABLE_HANDLE && share && 2320 test_share_config_flag(share, 2321 KSMBD_SHARE_FLAG_CONTINUOUS_AVAILABILITY)) 2322 rsp->Capabilities = SMB2_SHARE_CAP_CONTINUOUS_AVAILABILITY; 2323 else 2324 rsp->Capabilities = 0; 2325 rsp->Reserved = 0; 2326 /* default manual caching */ 2327 rsp->ShareFlags = SMB2_SHAREFLAG_MANUAL_CACHING; 2328 /* Tell the client that READ requests may request compressed responses. */ 2329 if (conn->dialect == SMB311_PROT_ID && 2330 conn->compress_algorithm != SMB3_COMPRESS_NONE) 2331 rsp->ShareFlags |= cpu_to_le32(SMB2_SHAREFLAG_COMPRESS_DATA); 2332 2333 rc = ksmbd_iov_pin_rsp(work, rsp, sizeof(struct smb2_tree_connect_rsp)); 2334 if (rc) 2335 status.ret = KSMBD_TREE_CONN_STATUS_NOMEM; 2336 2337 if (!IS_ERR(treename)) 2338 kfree(treename); 2339 if (!IS_ERR(name)) 2340 kfree(name); 2341 2342 switch (status.ret) { 2343 case KSMBD_TREE_CONN_STATUS_OK: 2344 rsp->hdr.Status = STATUS_SUCCESS; 2345 rc = 0; 2346 break; 2347 case -ESTALE: 2348 case -ENOENT: 2349 case KSMBD_TREE_CONN_STATUS_NO_SHARE: 2350 rsp->hdr.Status = STATUS_BAD_NETWORK_NAME; 2351 break; 2352 case -ENOMEM: 2353 case KSMBD_TREE_CONN_STATUS_NOMEM: 2354 rsp->hdr.Status = STATUS_NO_MEMORY; 2355 break; 2356 case KSMBD_TREE_CONN_STATUS_ERROR: 2357 case KSMBD_TREE_CONN_STATUS_TOO_MANY_CONNS: 2358 case KSMBD_TREE_CONN_STATUS_TOO_MANY_SESSIONS: 2359 rsp->hdr.Status = STATUS_ACCESS_DENIED; 2360 break; 2361 case -EINVAL: 2362 rsp->hdr.Status = STATUS_INVALID_PARAMETER; 2363 break; 2364 default: 2365 rsp->hdr.Status = STATUS_ACCESS_DENIED; 2366 } 2367 2368 if (status.ret != KSMBD_TREE_CONN_STATUS_OK) 2369 smb2_set_err_rsp(work); 2370 2371 return rc; 2372 } 2373 2374 /** 2375 * smb2_create_open_flags() - convert smb open flags to unix open flags 2376 * @file_present: is file already present 2377 * @access: file access flags 2378 * @disposition: file disposition flags 2379 * @may_flags: set with MAY_ flags 2380 * @coptions: file creation options 2381 * @mode: file mode 2382 * 2383 * Return: file open flags 2384 */ 2385 static int smb2_create_open_flags(bool file_present, __le32 access, 2386 __le32 disposition, 2387 int *may_flags, 2388 __le32 coptions, 2389 umode_t mode) 2390 { 2391 int oflags = O_NONBLOCK | O_LARGEFILE; 2392 2393 if (coptions & FILE_DIRECTORY_FILE_LE || S_ISDIR(mode)) { 2394 access &= ~FILE_WRITE_DESIRE_ACCESS_LE; 2395 ksmbd_debug(SMB, "Discard write access to a directory\n"); 2396 } 2397 2398 if (access & FILE_READ_DESIRED_ACCESS_LE && 2399 access & FILE_WRITE_DESIRE_ACCESS_LE) { 2400 oflags |= O_RDWR; 2401 *may_flags = MAY_OPEN | MAY_READ | MAY_WRITE; 2402 } else if (access & FILE_WRITE_DESIRE_ACCESS_LE) { 2403 oflags |= O_WRONLY; 2404 *may_flags = MAY_OPEN | MAY_WRITE; 2405 } else { 2406 oflags |= O_RDONLY; 2407 *may_flags = MAY_OPEN | MAY_READ; 2408 } 2409 2410 if (access == FILE_READ_ATTRIBUTES_LE || S_ISBLK(mode) || S_ISCHR(mode)) 2411 oflags |= O_PATH; 2412 2413 if (file_present) { 2414 switch (disposition & FILE_CREATE_MASK_LE) { 2415 case FILE_OPEN_LE: 2416 case FILE_CREATE_LE: 2417 break; 2418 case FILE_SUPERSEDE_LE: 2419 case FILE_OVERWRITE_LE: 2420 case FILE_OVERWRITE_IF_LE: 2421 oflags |= O_TRUNC; 2422 break; 2423 default: 2424 break; 2425 } 2426 } else { 2427 switch (disposition & FILE_CREATE_MASK_LE) { 2428 case FILE_SUPERSEDE_LE: 2429 case FILE_CREATE_LE: 2430 case FILE_OPEN_IF_LE: 2431 case FILE_OVERWRITE_IF_LE: 2432 oflags |= O_CREAT; 2433 break; 2434 case FILE_OPEN_LE: 2435 case FILE_OVERWRITE_LE: 2436 oflags &= ~O_CREAT; 2437 break; 2438 default: 2439 break; 2440 } 2441 } 2442 2443 return oflags; 2444 } 2445 2446 /** 2447 * smb2_tree_disconnect() - handler for smb tree connect request 2448 * @work: smb work containing request buffer 2449 * 2450 * Return: 0 on success, otherwise error 2451 */ 2452 int smb2_tree_disconnect(struct ksmbd_work *work) 2453 { 2454 struct smb2_tree_disconnect_rsp *rsp; 2455 struct smb2_tree_disconnect_req *req; 2456 struct ksmbd_session *sess = work->sess; 2457 struct ksmbd_tree_connect *tcon = work->tcon; 2458 int err; 2459 2460 ksmbd_debug(SMB, "Received smb2 tree disconnect request\n"); 2461 2462 WORK_BUFFERS(work, req, rsp); 2463 2464 if (!tcon) { 2465 ksmbd_debug(SMB, "Invalid tid %d\n", req->hdr.Id.SyncId.TreeId); 2466 2467 rsp->hdr.Status = STATUS_NETWORK_NAME_DELETED; 2468 err = -ENOENT; 2469 goto err_out; 2470 } 2471 2472 ksmbd_close_tree_conn_fds(work); 2473 2474 down_write(&sess->tree_conns_lock); 2475 if (tcon->t_state == TREE_DISCONNECTED) { 2476 up_write(&sess->tree_conns_lock); 2477 rsp->hdr.Status = STATUS_NETWORK_NAME_DELETED; 2478 err = -ENOENT; 2479 goto err_out; 2480 } 2481 2482 tcon->t_state = TREE_DISCONNECTED; 2483 up_write(&sess->tree_conns_lock); 2484 2485 err = ksmbd_tree_conn_disconnect(sess, tcon); 2486 if (err) { 2487 rsp->hdr.Status = STATUS_NETWORK_NAME_DELETED; 2488 goto err_out; 2489 } 2490 2491 rsp->StructureSize = cpu_to_le16(4); 2492 err = ksmbd_iov_pin_rsp(work, rsp, 2493 sizeof(struct smb2_tree_disconnect_rsp)); 2494 if (err) { 2495 rsp->hdr.Status = STATUS_INSUFFICIENT_RESOURCES; 2496 goto err_out; 2497 } 2498 2499 return 0; 2500 2501 err_out: 2502 smb2_set_err_rsp(work); 2503 return err; 2504 2505 } 2506 2507 /** 2508 * smb2_session_logoff() - handler for session log off request 2509 * @work: smb work containing request buffer 2510 * 2511 * Return: 0 on success, otherwise error 2512 */ 2513 int smb2_session_logoff(struct ksmbd_work *work) 2514 { 2515 struct ksmbd_conn *conn = work->conn; 2516 struct ksmbd_session *sess = work->sess; 2517 struct smb2_logoff_req *req; 2518 struct smb2_logoff_rsp *rsp; 2519 u64 sess_id; 2520 int err; 2521 2522 WORK_BUFFERS(work, req, rsp); 2523 2524 ksmbd_debug(SMB, "Received smb2 session logoff request\n"); 2525 2526 ksmbd_conn_lock(conn); 2527 if (!ksmbd_conn_good(conn)) { 2528 ksmbd_conn_unlock(conn); 2529 rsp->hdr.Status = STATUS_NETWORK_NAME_DELETED; 2530 smb2_set_err_rsp(work); 2531 return -ENOENT; 2532 } 2533 sess_id = le64_to_cpu(req->hdr.SessionId); 2534 ksmbd_all_conn_set_status(sess_id, KSMBD_SESS_NEED_RECONNECT); 2535 ksmbd_conn_unlock(conn); 2536 2537 ksmbd_close_session_fds(work); 2538 ksmbd_conn_wait_idle(conn); 2539 2540 if (ksmbd_tree_conn_session_logoff(sess)) { 2541 ksmbd_debug(SMB, "Invalid tid %d\n", req->hdr.Id.SyncId.TreeId); 2542 rsp->hdr.Status = STATUS_NETWORK_NAME_DELETED; 2543 smb2_set_err_rsp(work); 2544 return -ENOENT; 2545 } 2546 2547 down_write(&conn->session_lock); 2548 sess->state = SMB2_SESSION_EXPIRED; 2549 up_write(&conn->session_lock); 2550 2551 ksmbd_all_conn_set_status(sess_id, KSMBD_SESS_NEED_SETUP); 2552 2553 rsp->StructureSize = cpu_to_le16(4); 2554 err = ksmbd_iov_pin_rsp(work, rsp, sizeof(struct smb2_logoff_rsp)); 2555 if (err) { 2556 rsp->hdr.Status = STATUS_INSUFFICIENT_RESOURCES; 2557 smb2_set_err_rsp(work); 2558 return err; 2559 } 2560 return 0; 2561 } 2562 2563 /** 2564 * create_smb2_pipe() - create IPC pipe 2565 * @work: smb work containing request buffer 2566 * 2567 * Return: 0 on success, otherwise error 2568 */ 2569 static noinline int create_smb2_pipe(struct ksmbd_work *work) 2570 { 2571 struct smb2_create_rsp *rsp; 2572 struct smb2_create_req *req; 2573 int id = -1; 2574 int err; 2575 char *name; 2576 2577 WORK_BUFFERS(work, req, rsp); 2578 2579 name = smb_strndup_from_utf16(req->Buffer, le16_to_cpu(req->NameLength), 2580 1, work->conn->local_nls); 2581 if (IS_ERR(name)) { 2582 rsp->hdr.Status = STATUS_NO_MEMORY; 2583 err = PTR_ERR(name); 2584 goto out; 2585 } 2586 2587 id = ksmbd_session_rpc_open(work->sess, name); 2588 if (id < 0) { 2589 pr_err("Unable to open RPC pipe: %d\n", id); 2590 err = id; 2591 goto out; 2592 } 2593 2594 rsp->hdr.Status = STATUS_SUCCESS; 2595 rsp->StructureSize = cpu_to_le16(89); 2596 rsp->OplockLevel = SMB2_OPLOCK_LEVEL_NONE; 2597 rsp->Flags = 0; 2598 rsp->CreateAction = cpu_to_le32(FILE_OPENED); 2599 2600 rsp->CreationTime = cpu_to_le64(0); 2601 rsp->LastAccessTime = cpu_to_le64(0); 2602 rsp->ChangeTime = cpu_to_le64(0); 2603 rsp->AllocationSize = cpu_to_le64(0); 2604 rsp->EndofFile = cpu_to_le64(0); 2605 rsp->FileAttributes = FILE_ATTRIBUTE_NORMAL_LE; 2606 rsp->Reserved2 = 0; 2607 rsp->VolatileFileId = id; 2608 rsp->PersistentFileId = 0; 2609 rsp->CreateContextsOffset = 0; 2610 rsp->CreateContextsLength = 0; 2611 2612 err = ksmbd_iov_pin_rsp(work, rsp, offsetof(struct smb2_create_rsp, Buffer)); 2613 if (err) 2614 goto out; 2615 2616 kfree(name); 2617 return 0; 2618 2619 out: 2620 switch (err) { 2621 case -EINVAL: 2622 rsp->hdr.Status = STATUS_INVALID_PARAMETER; 2623 break; 2624 case -ENOSPC: 2625 case -ENOMEM: 2626 rsp->hdr.Status = STATUS_NO_MEMORY; 2627 break; 2628 } 2629 2630 if (id >= 0) 2631 ksmbd_session_rpc_close(work->sess, id); 2632 2633 if (!IS_ERR(name)) 2634 kfree(name); 2635 2636 smb2_set_err_rsp(work); 2637 return err; 2638 } 2639 2640 /** 2641 * smb2_set_ea() - handler for setting extended attributes using set 2642 * info command 2643 * @eabuf: set info command buffer 2644 * @buf_len: set info command buffer length 2645 * @path: dentry path for get ea 2646 * @get_write: get write access to a mount 2647 * 2648 * Return: 0 on success, otherwise error 2649 */ 2650 static int smb2_set_ea(struct smb2_ea_info *eabuf, unsigned int buf_len, 2651 const struct path *path, bool get_write) 2652 { 2653 struct mnt_idmap *idmap = mnt_idmap(path->mnt); 2654 char *attr_name = NULL, *value; 2655 int rc = 0; 2656 unsigned int next = 0; 2657 2658 if (buf_len < sizeof(struct smb2_ea_info) + eabuf->EaNameLength + 1 + 2659 le16_to_cpu(eabuf->EaValueLength)) 2660 return -EINVAL; 2661 2662 attr_name = kmalloc(XATTR_NAME_MAX + 1, KSMBD_DEFAULT_GFP); 2663 if (!attr_name) 2664 return -ENOMEM; 2665 2666 do { 2667 if (!eabuf->EaNameLength) 2668 goto next; 2669 2670 ksmbd_debug(SMB, 2671 "name : <%s>, name_len : %u, value_len : %u, next : %u\n", 2672 eabuf->name, eabuf->EaNameLength, 2673 le16_to_cpu(eabuf->EaValueLength), 2674 le32_to_cpu(eabuf->NextEntryOffset)); 2675 2676 if (eabuf->EaNameLength > 2677 (XATTR_NAME_MAX - XATTR_USER_PREFIX_LEN)) { 2678 rc = -EINVAL; 2679 break; 2680 } 2681 2682 memcpy(attr_name, XATTR_USER_PREFIX, XATTR_USER_PREFIX_LEN); 2683 memcpy(&attr_name[XATTR_USER_PREFIX_LEN], eabuf->name, 2684 eabuf->EaNameLength); 2685 attr_name[XATTR_USER_PREFIX_LEN + eabuf->EaNameLength] = '\0'; 2686 value = (char *)&eabuf->name + eabuf->EaNameLength + 1; 2687 2688 if (!eabuf->EaValueLength) { 2689 rc = ksmbd_vfs_casexattr_len(idmap, 2690 path->dentry, 2691 attr_name, 2692 XATTR_USER_PREFIX_LEN + 2693 eabuf->EaNameLength); 2694 2695 /* delete the EA only when it exits */ 2696 if (rc > 0) { 2697 rc = ksmbd_vfs_remove_xattr(idmap, 2698 path, 2699 attr_name, 2700 get_write); 2701 2702 if (rc < 0) { 2703 ksmbd_debug(SMB, 2704 "remove xattr failed(%d)\n", 2705 rc); 2706 break; 2707 } 2708 } 2709 2710 /* if the EA doesn't exist, just do nothing. */ 2711 rc = 0; 2712 } else { 2713 rc = ksmbd_vfs_setxattr(idmap, path, attr_name, value, 2714 le16_to_cpu(eabuf->EaValueLength), 2715 0, get_write); 2716 if (rc < 0) { 2717 ksmbd_debug(SMB, 2718 "ksmbd_vfs_setxattr is failed(%d)\n", 2719 rc); 2720 break; 2721 } 2722 } 2723 2724 next: 2725 next = le32_to_cpu(eabuf->NextEntryOffset); 2726 if (next == 0 || buf_len < next) 2727 break; 2728 buf_len -= next; 2729 eabuf = (struct smb2_ea_info *)((char *)eabuf + next); 2730 if (buf_len < sizeof(struct smb2_ea_info)) { 2731 rc = -EINVAL; 2732 break; 2733 } 2734 2735 if (buf_len < sizeof(struct smb2_ea_info) + eabuf->EaNameLength + 1 + 2736 le16_to_cpu(eabuf->EaValueLength)) { 2737 rc = -EINVAL; 2738 break; 2739 } 2740 } while (next != 0); 2741 2742 kfree(attr_name); 2743 return rc; 2744 } 2745 2746 static noinline int smb2_set_stream_name_xattr(const struct path *path, 2747 struct ksmbd_file *fp, 2748 char *stream_name, int s_type) 2749 { 2750 struct mnt_idmap *idmap = mnt_idmap(path->mnt); 2751 size_t xattr_stream_size; 2752 char *xattr_stream_name; 2753 int rc; 2754 2755 rc = ksmbd_vfs_xattr_stream_name(stream_name, 2756 &xattr_stream_name, 2757 &xattr_stream_size, 2758 s_type); 2759 if (rc) 2760 return rc; 2761 2762 fp->stream.name = xattr_stream_name; 2763 fp->stream.size = xattr_stream_size; 2764 2765 /* Check if there is stream prefix in xattr space */ 2766 rc = ksmbd_vfs_casexattr_len(idmap, 2767 path->dentry, 2768 xattr_stream_name, 2769 xattr_stream_size); 2770 if (rc >= 0) 2771 return 0; 2772 2773 if (fp->cdoption == FILE_OPEN_LE) { 2774 ksmbd_debug(SMB, "XATTR stream name lookup failed: %d\n", rc); 2775 return -EBADF; 2776 } 2777 2778 rc = ksmbd_vfs_setxattr(idmap, path, xattr_stream_name, NULL, 0, 0, false); 2779 if (rc < 0) 2780 pr_err("Failed to store XATTR stream name :%d\n", rc); 2781 return 0; 2782 } 2783 2784 static int smb2_remove_smb_xattrs(const struct path *path) 2785 { 2786 struct mnt_idmap *idmap = mnt_idmap(path->mnt); 2787 char *name, *xattr_list = NULL; 2788 ssize_t xattr_list_len; 2789 int err = 0; 2790 2791 xattr_list_len = ksmbd_vfs_listxattr(path->dentry, &xattr_list); 2792 if (xattr_list_len < 0) { 2793 goto out; 2794 } else if (!xattr_list_len) { 2795 ksmbd_debug(SMB, "empty xattr in the file\n"); 2796 goto out; 2797 } 2798 2799 for (name = xattr_list; name - xattr_list < xattr_list_len; 2800 name += strlen(name) + 1) { 2801 ksmbd_debug(SMB, "%s, len %zd\n", name, strlen(name)); 2802 2803 if (!strncmp(name, XATTR_USER_PREFIX, XATTR_USER_PREFIX_LEN) && 2804 !strncmp(&name[XATTR_USER_PREFIX_LEN], STREAM_PREFIX, 2805 STREAM_PREFIX_LEN)) { 2806 err = ksmbd_vfs_remove_xattr(idmap, path, 2807 name, true); 2808 if (err) 2809 ksmbd_debug(SMB, "remove xattr failed : %s\n", 2810 name); 2811 } 2812 } 2813 out: 2814 kvfree(xattr_list); 2815 return err; 2816 } 2817 2818 static int smb2_create_truncate(const struct path *path) 2819 { 2820 int rc = vfs_truncate(path, 0); 2821 2822 if (rc) { 2823 pr_err("vfs_truncate failed, rc %d\n", rc); 2824 return rc; 2825 } 2826 2827 rc = smb2_remove_smb_xattrs(path); 2828 if (rc == -EOPNOTSUPP) 2829 rc = 0; 2830 if (rc) 2831 ksmbd_debug(SMB, 2832 "ksmbd_truncate_stream_name_xattr failed, rc %d\n", 2833 rc); 2834 return rc; 2835 } 2836 2837 static void smb2_new_xattrs(struct ksmbd_tree_connect *tcon, const struct path *path, 2838 struct ksmbd_file *fp) 2839 { 2840 struct xattr_dos_attrib da = {0}; 2841 int rc; 2842 2843 if (!test_share_config_flag(tcon->share_conf, 2844 KSMBD_SHARE_FLAG_STORE_DOS_ATTRS)) 2845 return; 2846 2847 da.version = 4; 2848 da.attr = le32_to_cpu(fp->f_ci->m_fattr); 2849 da.itime = da.create_time = fp->create_time; 2850 da.flags = XATTR_DOSINFO_ATTRIB | XATTR_DOSINFO_CREATE_TIME | 2851 XATTR_DOSINFO_ITIME; 2852 2853 rc = ksmbd_vfs_set_dos_attrib_xattr(mnt_idmap(path->mnt), path, &da, true); 2854 if (rc) 2855 ksmbd_debug(SMB, "failed to store file attribute into xattr\n"); 2856 } 2857 2858 static void smb2_update_xattrs(struct ksmbd_tree_connect *tcon, 2859 const struct path *path, struct ksmbd_file *fp) 2860 { 2861 struct xattr_dos_attrib da; 2862 int rc; 2863 2864 fp->f_ci->m_fattr &= ~(FILE_ATTRIBUTE_HIDDEN_LE | FILE_ATTRIBUTE_SYSTEM_LE); 2865 2866 /* get FileAttributes from XATTR_NAME_DOS_ATTRIBUTE */ 2867 if (!test_share_config_flag(tcon->share_conf, 2868 KSMBD_SHARE_FLAG_STORE_DOS_ATTRS)) 2869 return; 2870 2871 rc = ksmbd_vfs_get_dos_attrib_xattr(mnt_idmap(path->mnt), 2872 path->dentry, &da); 2873 if (rc > 0) { 2874 fp->f_ci->m_fattr = cpu_to_le32(da.attr); 2875 fp->create_time = da.create_time; 2876 fp->itime = da.itime; 2877 } 2878 } 2879 2880 static int smb2_creat(struct ksmbd_work *work, 2881 struct path *path, char *name, int open_flags, 2882 umode_t posix_mode, bool is_dir) 2883 { 2884 struct ksmbd_tree_connect *tcon = work->tcon; 2885 struct ksmbd_share_config *share = tcon->share_conf; 2886 umode_t mode; 2887 int rc; 2888 2889 if (!(open_flags & O_CREAT)) 2890 return -EBADF; 2891 2892 ksmbd_debug(SMB, "file does not exist, so creating\n"); 2893 if (is_dir == true) { 2894 ksmbd_debug(SMB, "creating directory\n"); 2895 2896 mode = share_config_directory_mode(share, posix_mode); 2897 rc = ksmbd_vfs_mkdir(work, name, mode); 2898 if (rc) 2899 return rc; 2900 } else { 2901 ksmbd_debug(SMB, "creating regular file\n"); 2902 2903 mode = share_config_create_mode(share, posix_mode); 2904 rc = ksmbd_vfs_create(work, name, mode); 2905 if (rc) 2906 return rc; 2907 } 2908 2909 rc = ksmbd_vfs_kern_path(work, name, 0, path, 0); 2910 if (rc) { 2911 pr_err("cannot get linux path (%s), err = %d\n", 2912 name, rc); 2913 return rc; 2914 } 2915 return 0; 2916 } 2917 2918 static int smb2_create_sd_buffer(struct ksmbd_work *work, 2919 struct smb2_create_req *req, 2920 const struct path *path) 2921 { 2922 struct create_context *context; 2923 struct create_sd_buf_req *sd_buf; 2924 2925 if (!req->CreateContextsOffset) 2926 return -ENOENT; 2927 2928 /* Parse SD BUFFER create contexts */ 2929 context = smb2_find_context_vals(req, SMB2_CREATE_SD_BUFFER, 4); 2930 if (!context) 2931 return -ENOENT; 2932 else if (IS_ERR(context)) 2933 return PTR_ERR(context); 2934 2935 ksmbd_debug(SMB, 2936 "Set ACLs using SMB2_CREATE_SD_BUFFER context\n"); 2937 sd_buf = (struct create_sd_buf_req *)context; 2938 if (le16_to_cpu(context->DataOffset) + 2939 le32_to_cpu(context->DataLength) < 2940 sizeof(struct create_sd_buf_req)) 2941 return -EINVAL; 2942 return set_info_sec(work->conn, work->tcon, path, &sd_buf->ntsd, 2943 le32_to_cpu(sd_buf->ccontext.DataLength), true, false); 2944 } 2945 2946 static void ksmbd_acls_fattr(struct smb_fattr *fattr, 2947 struct mnt_idmap *idmap, 2948 struct inode *inode) 2949 { 2950 vfsuid_t vfsuid = i_uid_into_vfsuid(idmap, inode); 2951 vfsgid_t vfsgid = i_gid_into_vfsgid(idmap, inode); 2952 2953 fattr->cf_uid = vfsuid_into_kuid(vfsuid); 2954 fattr->cf_gid = vfsgid_into_kgid(vfsgid); 2955 fattr->cf_mode = inode->i_mode; 2956 fattr->cf_acls = NULL; 2957 fattr->cf_dacls = NULL; 2958 2959 if (IS_ENABLED(CONFIG_FS_POSIX_ACL)) { 2960 fattr->cf_acls = get_inode_acl(inode, ACL_TYPE_ACCESS); 2961 if (S_ISDIR(inode->i_mode)) 2962 fattr->cf_dacls = get_inode_acl(inode, ACL_TYPE_DEFAULT); 2963 } 2964 } 2965 2966 enum { 2967 DURABLE_RECONN_V2 = 1, 2968 DURABLE_RECONN, 2969 DURABLE_REQ_V2, 2970 DURABLE_REQ, 2971 }; 2972 2973 struct durable_info { 2974 struct ksmbd_file *fp; 2975 unsigned short int type; 2976 bool persistent; 2977 bool reconnected; 2978 bool app_instance_id; 2979 unsigned int timeout; 2980 char *CreateGuid; 2981 char AppInstanceId[SMB2_CREATE_GUID_SIZE]; 2982 }; 2983 2984 static int parse_durable_handle_context(struct ksmbd_work *work, 2985 struct smb2_create_req *req, 2986 struct lease_ctx_info *lc, 2987 struct durable_info *dh_info) 2988 { 2989 struct ksmbd_conn *conn = work->conn; 2990 struct create_context *context; 2991 int dh_idx, err = 0; 2992 u64 persistent_id = 0; 2993 int req_op_level; 2994 static const char * const durable_arr[] = {"DH2C", "DHnC", "DH2Q", "DHnQ"}; 2995 2996 req_op_level = req->RequestedOplockLevel; 2997 for (dh_idx = DURABLE_RECONN_V2; dh_idx <= ARRAY_SIZE(durable_arr); 2998 dh_idx++) { 2999 context = smb2_find_context_vals(req, durable_arr[dh_idx - 1], 4); 3000 if (IS_ERR(context)) { 3001 err = PTR_ERR(context); 3002 goto out; 3003 } 3004 if (!context) 3005 continue; 3006 3007 switch (dh_idx) { 3008 case DURABLE_RECONN_V2: 3009 { 3010 struct create_durable_handle_reconnect_v2 *recon_v2; 3011 3012 if (dh_info->type == DURABLE_RECONN || 3013 dh_info->type == DURABLE_REQ_V2) { 3014 err = -EINVAL; 3015 goto out; 3016 } 3017 3018 if (le32_to_cpu(context->DataLength) < 3019 sizeof(recon_v2->dcontext)) { 3020 err = -EINVAL; 3021 goto out; 3022 } 3023 3024 recon_v2 = (struct create_durable_handle_reconnect_v2 *)context; 3025 persistent_id = recon_v2->dcontext.Fid.PersistentFileId; 3026 dh_info->fp = ksmbd_lookup_durable_fd(persistent_id); 3027 if (!dh_info->fp) { 3028 ksmbd_debug(SMB, "Failed to get durable handle state\n"); 3029 err = -EBADF; 3030 goto out; 3031 } 3032 3033 if (dh_info->fp->durable_volatile_id != 3034 recon_v2->dcontext.Fid.VolatileFileId) { 3035 err = -EBADF; 3036 ksmbd_put_durable_fd(dh_info->fp); 3037 goto out; 3038 } 3039 3040 if (memcmp(dh_info->fp->create_guid, recon_v2->dcontext.CreateGuid, 3041 SMB2_CREATE_GUID_SIZE)) { 3042 err = -EBADF; 3043 ksmbd_put_durable_fd(dh_info->fp); 3044 goto out; 3045 } 3046 3047 dh_info->type = dh_idx; 3048 dh_info->reconnected = true; 3049 ksmbd_debug(SMB, 3050 "reconnect v2 Persistent-id from reconnect = %llu\n", 3051 persistent_id); 3052 break; 3053 } 3054 case DURABLE_RECONN: 3055 { 3056 create_durable_reconn_t *recon; 3057 3058 if (dh_info->type == DURABLE_RECONN_V2 || 3059 dh_info->type == DURABLE_REQ_V2) { 3060 err = -EINVAL; 3061 goto out; 3062 } 3063 3064 if (le32_to_cpu(context->DataLength) < 3065 sizeof(recon->Data)) { 3066 err = -EINVAL; 3067 goto out; 3068 } 3069 3070 recon = (create_durable_reconn_t *)context; 3071 persistent_id = recon->Data.Fid.PersistentFileId; 3072 dh_info->fp = ksmbd_lookup_durable_fd(persistent_id); 3073 if (!dh_info->fp) { 3074 ksmbd_debug(SMB, "Failed to get durable handle state\n"); 3075 err = -EBADF; 3076 goto out; 3077 } 3078 3079 if (dh_info->fp->durable_volatile_id != 3080 recon->Data.Fid.VolatileFileId) { 3081 err = -EBADF; 3082 ksmbd_put_durable_fd(dh_info->fp); 3083 goto out; 3084 } 3085 3086 dh_info->type = dh_idx; 3087 dh_info->reconnected = true; 3088 ksmbd_debug(SMB, "reconnect Persistent-id from reconnect = %llu\n", 3089 persistent_id); 3090 break; 3091 } 3092 case DURABLE_REQ_V2: 3093 { 3094 struct create_durable_req_v2 *durable_v2_blob; 3095 3096 if (dh_info->type == DURABLE_RECONN || 3097 dh_info->type == DURABLE_RECONN_V2) { 3098 err = -EINVAL; 3099 goto out; 3100 } 3101 3102 if (le32_to_cpu(context->DataLength) < 3103 sizeof(durable_v2_blob->dcontext)) { 3104 err = -EINVAL; 3105 goto out; 3106 } 3107 3108 durable_v2_blob = 3109 (struct create_durable_req_v2 *)context; 3110 ksmbd_debug(SMB, "Request for durable v2 open\n"); 3111 dh_info->fp = ksmbd_lookup_fd_cguid(durable_v2_blob->dcontext.CreateGuid); 3112 if (dh_info->fp) { 3113 if (!memcmp(conn->ClientGUID, dh_info->fp->client_guid, 3114 SMB2_CLIENT_GUID_SIZE)) { 3115 if (!(req->hdr.Flags & SMB2_FLAGS_REPLAY_OPERATION)) { 3116 err = -ENOEXEC; 3117 ksmbd_put_durable_fd(dh_info->fp); 3118 goto out; 3119 } 3120 3121 if (dh_info->fp->conn) { 3122 ksmbd_put_durable_fd(dh_info->fp); 3123 err = -EBADF; 3124 goto out; 3125 } 3126 dh_info->reconnected = true; 3127 goto out; 3128 } 3129 ksmbd_put_durable_fd(dh_info->fp); 3130 dh_info->fp = NULL; 3131 } 3132 3133 if ((lc && (lc->req_state & SMB2_LEASE_HANDLE_CACHING_LE)) || 3134 req_op_level == SMB2_OPLOCK_LEVEL_BATCH) { 3135 dh_info->CreateGuid = 3136 durable_v2_blob->dcontext.CreateGuid; 3137 dh_info->persistent = 3138 le32_to_cpu(durable_v2_blob->dcontext.Flags); 3139 dh_info->timeout = 3140 le32_to_cpu(durable_v2_blob->dcontext.Timeout); 3141 dh_info->type = dh_idx; 3142 } 3143 break; 3144 } 3145 case DURABLE_REQ: 3146 if (dh_info->type == DURABLE_RECONN) 3147 goto out; 3148 if (dh_info->type == DURABLE_RECONN_V2 || 3149 dh_info->type == DURABLE_REQ_V2) { 3150 err = -EINVAL; 3151 goto out; 3152 } 3153 3154 if ((lc && (lc->req_state & SMB2_LEASE_HANDLE_CACHING_LE)) || 3155 req_op_level == SMB2_OPLOCK_LEVEL_BATCH) { 3156 ksmbd_debug(SMB, "Request for durable open\n"); 3157 dh_info->type = dh_idx; 3158 } 3159 } 3160 } 3161 3162 out: 3163 return err; 3164 } 3165 3166 static int parse_app_instance_id(struct smb2_create_req *req, 3167 struct durable_info *dh_info) 3168 { 3169 struct create_context *context; 3170 char *data; 3171 3172 context = smb2_find_context_vals(req, SMB2_CREATE_APP_INSTANCE_ID, 3173 SMB2_CREATE_GUID_SIZE); 3174 if (IS_ERR(context)) 3175 return PTR_ERR(context); 3176 if (!context) 3177 return 0; 3178 3179 if (le32_to_cpu(context->DataLength) < 20) 3180 return -EINVAL; 3181 3182 data = (char *)context + le16_to_cpu(context->DataOffset); 3183 if (data[0] != 20 || data[1]) 3184 return -EINVAL; 3185 3186 memcpy(dh_info->AppInstanceId, data + 4, SMB2_CREATE_GUID_SIZE); 3187 dh_info->app_instance_id = true; 3188 return 0; 3189 } 3190 3191 /** 3192 * smb2_open() - handler for smb file open request 3193 * @work: smb work containing request buffer 3194 * 3195 * Return: 0 on success, otherwise error 3196 */ 3197 int smb2_open(struct ksmbd_work *work) 3198 { 3199 struct ksmbd_conn *conn = work->conn; 3200 struct ksmbd_session *sess = work->sess; 3201 struct ksmbd_tree_connect *tcon = work->tcon; 3202 struct smb2_create_req *req; 3203 struct smb2_create_rsp *rsp; 3204 struct path path; 3205 struct ksmbd_share_config *share = tcon->share_conf; 3206 struct ksmbd_file *fp = NULL; 3207 struct file *filp = NULL; 3208 struct mnt_idmap *idmap = NULL; 3209 struct kstat stat; 3210 struct create_context *context; 3211 struct lease_ctx_info *lc = NULL; 3212 struct create_ea_buf_req *ea_buf = NULL; 3213 struct oplock_info *opinfo; 3214 struct durable_info dh_info = {0}; 3215 __le32 *next_ptr = NULL; 3216 int req_op_level = 0, open_flags = 0, may_flags = 0, file_info = 0; 3217 int rc = 0; 3218 int contxt_cnt = 0, query_disk_id = 0; 3219 bool maximal_access_ctxt = false, posix_ctxt = false; 3220 int s_type = 0; 3221 int next_off = 0; 3222 char *name = NULL; 3223 char *stream_name = NULL; 3224 bool file_present = false, created = false, already_permitted = false; 3225 int share_ret, need_truncate = 0; 3226 u64 time, alloc_size = 0; 3227 umode_t posix_mode = 0; 3228 __le32 daccess, maximal_access = 0; 3229 int iov_len = 0; 3230 3231 ksmbd_debug(SMB, "Received smb2 create request\n"); 3232 3233 WORK_BUFFERS(work, req, rsp); 3234 3235 if (req->hdr.NextCommand && !work->next_smb2_rcv_hdr_off && 3236 (req->hdr.Flags & SMB2_FLAGS_RELATED_OPERATIONS)) { 3237 ksmbd_debug(SMB, "invalid flag in chained command\n"); 3238 rsp->hdr.Status = STATUS_INVALID_PARAMETER; 3239 smb2_set_err_rsp(work); 3240 return -EINVAL; 3241 } 3242 3243 if (test_share_config_flag(share, KSMBD_SHARE_FLAG_PIPE)) { 3244 ksmbd_debug(SMB, "IPC pipe create request\n"); 3245 return create_smb2_pipe(work); 3246 } 3247 3248 if (req->CreateContextsOffset && tcon->posix_extensions) { 3249 context = smb2_find_context_vals(req, SMB2_CREATE_TAG_POSIX, 16); 3250 if (IS_ERR(context)) { 3251 rc = PTR_ERR(context); 3252 goto err_out2; 3253 } else if (context) { 3254 struct create_posix *posix = (struct create_posix *)context; 3255 3256 if (le16_to_cpu(context->DataOffset) + 3257 le32_to_cpu(context->DataLength) < 3258 sizeof(struct create_posix) - 4) { 3259 rc = -EINVAL; 3260 goto err_out2; 3261 } 3262 ksmbd_debug(SMB, "get posix context\n"); 3263 3264 posix_mode = le32_to_cpu(posix->Mode); 3265 posix_ctxt = true; 3266 } 3267 } 3268 3269 if (req->NameLength) { 3270 name = smb2_get_name((char *)req + le16_to_cpu(req->NameOffset), 3271 le16_to_cpu(req->NameLength), 3272 work->conn->local_nls); 3273 if (IS_ERR(name)) { 3274 rc = PTR_ERR(name); 3275 name = NULL; 3276 goto err_out2; 3277 } 3278 3279 ksmbd_debug(SMB, "converted name = %s\n", name); 3280 3281 if (posix_ctxt == false) { 3282 if (strchr(name, ':')) { 3283 if (!test_share_config_flag(work->tcon->share_conf, 3284 KSMBD_SHARE_FLAG_STREAMS)) { 3285 rc = -EBADF; 3286 goto err_out2; 3287 } 3288 rc = parse_stream_name(name, &stream_name, &s_type); 3289 if (rc < 0) 3290 goto err_out2; 3291 } 3292 3293 rc = ksmbd_validate_filename(name); 3294 if (rc < 0) 3295 goto err_out2; 3296 } 3297 3298 if (ksmbd_share_veto_filename(share, name)) { 3299 rc = -ENOENT; 3300 ksmbd_debug(SMB, "Reject open(), vetoed file: %s\n", 3301 name); 3302 goto err_out2; 3303 } 3304 } else { 3305 name = kstrdup("", KSMBD_DEFAULT_GFP); 3306 if (!name) { 3307 rc = -ENOMEM; 3308 goto err_out2; 3309 } 3310 } 3311 3312 req_op_level = req->RequestedOplockLevel; 3313 3314 if (server_conf.flags & KSMBD_GLOBAL_FLAG_DURABLE_HANDLE && 3315 req->CreateContextsOffset) { 3316 lc = parse_lease_state(req); 3317 if (IS_ERR(lc)) { 3318 rc = PTR_ERR(lc); 3319 lc = NULL; 3320 goto err_out2; 3321 } 3322 if (lc && lc->version == 2 && conn->dialect < SMB30_PROT_ID) { 3323 kfree(lc); 3324 lc = NULL; 3325 if (req_op_level == SMB2_OPLOCK_LEVEL_LEASE) 3326 req_op_level = SMB2_OPLOCK_LEVEL_NONE; 3327 } 3328 rc = parse_durable_handle_context(work, req, lc, &dh_info); 3329 if (rc) { 3330 ksmbd_debug(SMB, "error parsing durable handle context\n"); 3331 goto err_out2; 3332 } 3333 rc = parse_app_instance_id(req, &dh_info); 3334 if (rc) 3335 goto err_out2; 3336 3337 if (dh_info.reconnected == true) { 3338 rc = smb2_check_durable_oplock(conn, share, dh_info.fp, 3339 lc, sess->user, name); 3340 if (rc) 3341 goto err_out2; 3342 3343 rc = ksmbd_reopen_durable_fd(work, dh_info.fp); 3344 if (rc) 3345 goto err_out2; 3346 3347 fp = dh_info.fp; 3348 3349 if (ksmbd_override_fsids(work)) { 3350 rc = -ENOMEM; 3351 goto err_out2; 3352 } 3353 3354 file_info = FILE_OPENED; 3355 3356 rc = ksmbd_vfs_getattr(&fp->filp->f_path, &stat); 3357 if (rc) 3358 goto err_out2; 3359 3360 goto reconnected_fp; 3361 } 3362 3363 if (dh_info.type == DURABLE_REQ_V2 && dh_info.app_instance_id) 3364 ksmbd_close_fd_app_instance_id(dh_info.AppInstanceId); 3365 } else if (req_op_level == SMB2_OPLOCK_LEVEL_LEASE) { 3366 lc = parse_lease_state(req); 3367 if (IS_ERR(lc)) { 3368 rc = PTR_ERR(lc); 3369 lc = NULL; 3370 goto err_out2; 3371 } 3372 if (lc && lc->version == 2 && conn->dialect < SMB30_PROT_ID) { 3373 kfree(lc); 3374 lc = NULL; 3375 req_op_level = SMB2_OPLOCK_LEVEL_NONE; 3376 } 3377 } 3378 3379 if (le32_to_cpu(req->ImpersonationLevel) > le32_to_cpu(IL_DELEGATE)) { 3380 pr_err("Invalid impersonationlevel : 0x%x\n", 3381 le32_to_cpu(req->ImpersonationLevel)); 3382 rc = -EIO; 3383 rsp->hdr.Status = STATUS_BAD_IMPERSONATION_LEVEL; 3384 goto err_out2; 3385 } 3386 3387 if (req->CreateOptions && !(req->CreateOptions & CREATE_OPTIONS_MASK_LE)) { 3388 pr_err("Invalid create options : 0x%x\n", 3389 le32_to_cpu(req->CreateOptions)); 3390 rc = -EINVAL; 3391 goto err_out2; 3392 } else { 3393 if (req->CreateOptions & FILE_SEQUENTIAL_ONLY_LE && 3394 req->CreateOptions & FILE_RANDOM_ACCESS_LE) 3395 req->CreateOptions &= ~FILE_SEQUENTIAL_ONLY_LE; 3396 3397 if (req->CreateOptions & 3398 (FILE_OPEN_BY_FILE_ID_LE | CREATE_TREE_CONNECTION | 3399 FILE_RESERVE_OPFILTER_LE)) { 3400 rc = -EOPNOTSUPP; 3401 goto err_out2; 3402 } 3403 3404 if (req->CreateOptions & FILE_DIRECTORY_FILE_LE) { 3405 if (req->CreateOptions & FILE_NON_DIRECTORY_FILE_LE) { 3406 rc = -EINVAL; 3407 goto err_out2; 3408 } else if (req->CreateOptions & FILE_NO_COMPRESSION_LE) { 3409 req->CreateOptions &= ~FILE_NO_COMPRESSION_LE; 3410 } 3411 } 3412 } 3413 3414 if (le32_to_cpu(req->CreateDisposition) > 3415 le32_to_cpu(FILE_OVERWRITE_IF_LE)) { 3416 pr_err("Invalid create disposition : 0x%x\n", 3417 le32_to_cpu(req->CreateDisposition)); 3418 rc = -EINVAL; 3419 goto err_out2; 3420 } 3421 3422 if (!(req->DesiredAccess & DESIRED_ACCESS_MASK)) { 3423 pr_err("Invalid desired access : 0x%x\n", 3424 le32_to_cpu(req->DesiredAccess)); 3425 rc = -EACCES; 3426 goto err_out2; 3427 } 3428 3429 if (req->DesiredAccess == FILE_SYNCHRONIZE_LE && 3430 req->CreateDisposition == FILE_OPEN_IF_LE && 3431 !req->FileAttributes) { 3432 rc = -EACCES; 3433 goto err_out2; 3434 } 3435 3436 if (req->FileAttributes && 3437 (req->FileAttributes & ~cpu_to_le32(SMB2_CREATE_FILE_ATTRIBUTE_MASK))) { 3438 pr_err("Invalid file attribute : 0x%x\n", 3439 le32_to_cpu(req->FileAttributes)); 3440 rc = -EINVAL; 3441 goto err_out2; 3442 } 3443 3444 if (req->CreateContextsOffset) { 3445 /* Parse non-durable handle create contexts */ 3446 context = smb2_find_context_vals(req, SMB2_CREATE_EA_BUFFER, 4); 3447 if (IS_ERR(context)) { 3448 rc = PTR_ERR(context); 3449 goto err_out2; 3450 } else if (context) { 3451 ea_buf = (struct create_ea_buf_req *)context; 3452 if (le16_to_cpu(context->DataOffset) + 3453 le32_to_cpu(context->DataLength) < 3454 sizeof(struct create_ea_buf_req)) { 3455 rc = -EINVAL; 3456 goto err_out2; 3457 } 3458 if (req->CreateOptions & FILE_NO_EA_KNOWLEDGE_LE) { 3459 rsp->hdr.Status = STATUS_ACCESS_DENIED; 3460 rc = -EACCES; 3461 goto err_out2; 3462 } 3463 } 3464 3465 context = smb2_find_context_vals(req, 3466 SMB2_CREATE_QUERY_MAXIMAL_ACCESS_REQUEST, 4); 3467 if (IS_ERR(context)) { 3468 rc = PTR_ERR(context); 3469 goto err_out2; 3470 } else if (context) { 3471 ksmbd_debug(SMB, 3472 "get query maximal access context\n"); 3473 maximal_access_ctxt = 1; 3474 } 3475 3476 context = smb2_find_context_vals(req, 3477 SMB2_CREATE_TIMEWARP_REQUEST, 4); 3478 if (IS_ERR(context)) { 3479 rc = PTR_ERR(context); 3480 goto err_out2; 3481 } else if (context) { 3482 ksmbd_debug(SMB, "get timewarp context\n"); 3483 rc = -EBADF; 3484 goto err_out2; 3485 } 3486 } 3487 3488 if (ksmbd_override_fsids(work)) { 3489 rc = -ENOMEM; 3490 goto err_out2; 3491 } 3492 3493 rc = ksmbd_vfs_kern_path(work, name, LOOKUP_NO_SYMLINKS, 3494 &path, 1); 3495 3496 /* 3497 * A durable handle opened with delete-on-close is preserved across a 3498 * disconnect so it can be reclaimed by a durable reconnect. When a new 3499 * delete-on-close open for the same name arrives instead, the 3500 * disconnected handle must give way: close it so its delete-on-close 3501 * removes the file, then re-resolve so this open can create a fresh one. 3502 */ 3503 if (!rc && (req->CreateOptions & FILE_DELETE_ON_CLOSE_LE) && 3504 (req->CreateDisposition == FILE_OVERWRITE_IF_LE || 3505 req->CreateDisposition == FILE_OPEN_IF_LE) && 3506 ksmbd_close_disconnected_durable_delete_on_close(path.dentry)) { 3507 path_put(&path); 3508 rc = ksmbd_vfs_kern_path(work, name, LOOKUP_NO_SYMLINKS, 3509 &path, 1); 3510 } 3511 3512 if (!rc) { 3513 file_present = true; 3514 3515 if (req->CreateOptions & FILE_DELETE_ON_CLOSE_LE) { 3516 /* 3517 * If file exists with under flags, return access 3518 * denied error. 3519 */ 3520 if (req->CreateDisposition == FILE_OVERWRITE_IF_LE || 3521 req->CreateDisposition == FILE_OPEN_IF_LE) { 3522 rc = -EACCES; 3523 goto err_out; 3524 } 3525 3526 if (!test_tree_conn_flag(tcon, KSMBD_TREE_CONN_FLAG_WRITABLE)) { 3527 ksmbd_debug(SMB, 3528 "User does not have write permission\n"); 3529 rc = -EACCES; 3530 goto err_out; 3531 } 3532 } else if (d_is_symlink(path.dentry)) { 3533 rc = -EACCES; 3534 goto err_out; 3535 } 3536 3537 idmap = mnt_idmap(path.mnt); 3538 } else { 3539 if (rc != -ENOENT) 3540 goto err_out; 3541 ksmbd_debug(SMB, "can not get linux path for %s, rc = %d\n", 3542 name, rc); 3543 rc = 0; 3544 } 3545 3546 /* 3547 * An explicit ::$DATA suffix names the unnamed data stream and is 3548 * canonicalized to a NULL stream name (base file), but the request 3549 * still has to be validated against the data-stream type, e.g. opening 3550 * <dir>::$DATA with FILE_DIRECTORY_FILE must fail with 3551 * STATUS_NOT_A_DIRECTORY. 3552 */ 3553 if (stream_name || s_type == DATA_STREAM) { 3554 if (req->CreateOptions & FILE_DIRECTORY_FILE_LE) { 3555 if (s_type == DATA_STREAM) { 3556 rc = -EIO; 3557 rsp->hdr.Status = STATUS_NOT_A_DIRECTORY; 3558 } 3559 } else { 3560 if (file_present && S_ISDIR(d_inode(path.dentry)->i_mode) && 3561 s_type == DATA_STREAM) { 3562 rc = -EIO; 3563 rsp->hdr.Status = STATUS_FILE_IS_A_DIRECTORY; 3564 } 3565 } 3566 3567 if (req->CreateOptions & FILE_DIRECTORY_FILE_LE && 3568 req->FileAttributes & FILE_ATTRIBUTE_NORMAL_LE) { 3569 rsp->hdr.Status = STATUS_NOT_A_DIRECTORY; 3570 rc = -EIO; 3571 } 3572 3573 if (rc < 0) 3574 goto err_out; 3575 } 3576 3577 if (file_present && req->CreateOptions & FILE_NON_DIRECTORY_FILE_LE && 3578 S_ISDIR(d_inode(path.dentry)->i_mode) && 3579 !(req->CreateOptions & FILE_DELETE_ON_CLOSE_LE)) { 3580 ksmbd_debug(SMB, "open() argument is a directory: %s, %x\n", 3581 name, req->CreateOptions); 3582 rsp->hdr.Status = STATUS_FILE_IS_A_DIRECTORY; 3583 rc = -EIO; 3584 goto err_out; 3585 } 3586 3587 if (file_present && (req->CreateOptions & FILE_DIRECTORY_FILE_LE) && 3588 !(req->CreateDisposition == FILE_CREATE_LE) && 3589 !S_ISDIR(d_inode(path.dentry)->i_mode)) { 3590 rsp->hdr.Status = STATUS_NOT_A_DIRECTORY; 3591 rc = -EIO; 3592 goto err_out; 3593 } 3594 3595 if (!stream_name && file_present && 3596 req->CreateDisposition == FILE_CREATE_LE) { 3597 rc = -EEXIST; 3598 goto err_out; 3599 } 3600 3601 daccess = smb_map_generic_desired_access(req->DesiredAccess); 3602 3603 if (file_present && !(req->CreateOptions & FILE_DELETE_ON_CLOSE_LE)) { 3604 rc = smb_check_perm_dacl(conn, &path, &daccess, 3605 sess->user->uid); 3606 if (rc) 3607 goto err_out; 3608 } 3609 3610 if (daccess & FILE_MAXIMAL_ACCESS_LE) { 3611 if (!file_present) { 3612 daccess = cpu_to_le32(GENERIC_ALL_FLAGS); 3613 } else { 3614 ksmbd_vfs_query_maximal_access(idmap, 3615 path.dentry, 3616 &daccess); 3617 already_permitted = true; 3618 } 3619 maximal_access = daccess; 3620 } 3621 3622 open_flags = smb2_create_open_flags(file_present, daccess, 3623 req->CreateDisposition, 3624 &may_flags, 3625 req->CreateOptions, 3626 file_present ? d_inode(path.dentry)->i_mode : 0); 3627 3628 if (!test_tree_conn_flag(tcon, KSMBD_TREE_CONN_FLAG_WRITABLE)) { 3629 if (open_flags & (O_CREAT | O_TRUNC)) { 3630 ksmbd_debug(SMB, 3631 "User does not have write permission\n"); 3632 rc = -EACCES; 3633 goto err_out; 3634 } 3635 } 3636 3637 /*create file if not present */ 3638 if (!file_present) { 3639 rc = smb2_creat(work, &path, name, open_flags, 3640 posix_mode, 3641 req->CreateOptions & FILE_DIRECTORY_FILE_LE); 3642 if (rc) { 3643 if (rc == -ENOENT) { 3644 rc = -EIO; 3645 rsp->hdr.Status = STATUS_OBJECT_PATH_NOT_FOUND; 3646 } 3647 goto err_out; 3648 } 3649 3650 created = true; 3651 idmap = mnt_idmap(path.mnt); 3652 if (ea_buf) { 3653 if (le32_to_cpu(ea_buf->ccontext.DataLength) < 3654 sizeof(struct smb2_ea_info)) { 3655 rc = -EINVAL; 3656 goto err_out; 3657 } 3658 3659 rc = smb2_set_ea(&ea_buf->ea, 3660 le32_to_cpu(ea_buf->ccontext.DataLength), 3661 &path, false); 3662 if (rc == -EOPNOTSUPP) 3663 rc = 0; 3664 else if (rc) 3665 goto err_out; 3666 } 3667 } else if (!already_permitted) { 3668 /* FILE_READ_ATTRIBUTE is allowed without inode_permission, 3669 * because execute(search) permission on a parent directory, 3670 * is already granted. 3671 */ 3672 if (daccess & ~(FILE_READ_ATTRIBUTES_LE | FILE_READ_CONTROL_LE)) { 3673 rc = inode_permission(idmap, 3674 d_inode(path.dentry), 3675 may_flags); 3676 if (rc) 3677 goto err_out; 3678 3679 if ((daccess & FILE_DELETE_LE) || 3680 (req->CreateOptions & FILE_DELETE_ON_CLOSE_LE)) { 3681 rc = inode_permission(idmap, 3682 d_inode(path.dentry->d_parent), 3683 MAY_EXEC | MAY_WRITE); 3684 if (rc) 3685 goto err_out; 3686 } 3687 } 3688 } 3689 3690 rc = ksmbd_query_inode_status(path.dentry->d_parent); 3691 if (rc == KSMBD_INODE_STATUS_PENDING_DELETE) { 3692 rc = -EBUSY; 3693 goto err_out; 3694 } 3695 3696 rc = 0; 3697 filp = dentry_open(&path, open_flags, current_cred()); 3698 if (IS_ERR(filp)) { 3699 rc = PTR_ERR(filp); 3700 pr_err("dentry open for dir failed, rc %d\n", rc); 3701 goto err_out; 3702 } 3703 3704 if (file_present) { 3705 if (!(open_flags & O_TRUNC)) 3706 file_info = FILE_OPENED; 3707 else 3708 file_info = FILE_OVERWRITTEN; 3709 3710 if ((req->CreateDisposition & FILE_CREATE_MASK_LE) == 3711 FILE_SUPERSEDE_LE) 3712 file_info = FILE_SUPERSEDED; 3713 } else if (open_flags & O_CREAT) { 3714 file_info = FILE_CREATED; 3715 } 3716 3717 ksmbd_vfs_set_fadvise(filp, req->CreateOptions); 3718 3719 /* Obtain Volatile-ID */ 3720 fp = ksmbd_open_fd(work, filp); 3721 if (IS_ERR(fp)) { 3722 fput(filp); 3723 rc = PTR_ERR(fp); 3724 fp = NULL; 3725 goto err_out; 3726 } 3727 3728 /* Get Persistent-ID */ 3729 ksmbd_open_durable_fd(fp); 3730 if (!has_file_id(fp->persistent_id)) { 3731 rc = -ENOMEM; 3732 goto err_out; 3733 } 3734 3735 fp->cdoption = req->CreateDisposition; 3736 fp->daccess = daccess; 3737 fp->saccess = req->ShareAccess; 3738 fp->coption = req->CreateOptions; 3739 3740 /* Set default windows and posix acls if creating new file */ 3741 if (created) { 3742 int posix_acl_rc; 3743 struct inode *inode = d_inode(path.dentry); 3744 3745 posix_acl_rc = ksmbd_vfs_inherit_posix_acl(idmap, 3746 &path, 3747 d_inode(path.dentry->d_parent)); 3748 if (posix_acl_rc) 3749 ksmbd_debug(SMB, "inherit posix acl failed : %d\n", posix_acl_rc); 3750 3751 rc = smb2_create_sd_buffer(work, req, &path); 3752 if (rc && rc != -ENOENT) 3753 goto err_out; 3754 3755 if (rc == -ENOENT) { 3756 if (test_share_config_flag(work->tcon->share_conf, 3757 KSMBD_SHARE_FLAG_ACL_XATTR)) { 3758 rc = smb_inherit_dacl(conn, &path, sess->user->uid, 3759 sess->user->gid); 3760 } 3761 if (rc) { 3762 if (posix_acl_rc) 3763 ksmbd_vfs_set_init_posix_acl(idmap, 3764 &path); 3765 3766 if (test_share_config_flag(work->tcon->share_conf, 3767 KSMBD_SHARE_FLAG_ACL_XATTR)) { 3768 struct smb_fattr fattr; 3769 struct smb_ntsd *pntsd; 3770 int pntsd_size; 3771 size_t scratch_len; 3772 3773 ksmbd_acls_fattr(&fattr, idmap, inode); 3774 scratch_len = smb_acl_sec_desc_scratch_len(&fattr, 3775 NULL, 0, 3776 OWNER_SECINFO | GROUP_SECINFO | 3777 DACL_SECINFO); 3778 if (!scratch_len || scratch_len == SIZE_MAX) { 3779 rc = -EFBIG; 3780 posix_acl_release(fattr.cf_acls); 3781 posix_acl_release(fattr.cf_dacls); 3782 goto err_out; 3783 } 3784 3785 pntsd = kvzalloc(scratch_len, KSMBD_DEFAULT_GFP); 3786 if (!pntsd) { 3787 rc = -ENOMEM; 3788 posix_acl_release(fattr.cf_acls); 3789 posix_acl_release(fattr.cf_dacls); 3790 goto err_out; 3791 } 3792 3793 rc = build_sec_desc(idmap, 3794 pntsd, NULL, 0, 3795 OWNER_SECINFO | 3796 GROUP_SECINFO | 3797 DACL_SECINFO, 3798 &pntsd_size, &fattr); 3799 posix_acl_release(fattr.cf_acls); 3800 posix_acl_release(fattr.cf_dacls); 3801 if (rc) { 3802 kvfree(pntsd); 3803 goto err_out; 3804 } 3805 3806 rc = ksmbd_vfs_set_sd_xattr(conn, 3807 idmap, 3808 &path, 3809 pntsd, 3810 pntsd_size, 3811 false); 3812 kvfree(pntsd); 3813 if (rc) 3814 pr_err("failed to store ntacl in xattr : %d\n", 3815 rc); 3816 } 3817 } 3818 } 3819 rc = 0; 3820 } 3821 3822 if (stream_name) { 3823 rc = smb2_set_stream_name_xattr(&path, 3824 fp, 3825 stream_name, 3826 s_type); 3827 if (rc) 3828 goto err_out; 3829 file_info = FILE_CREATED; 3830 } 3831 3832 fp->attrib_only = !(req->DesiredAccess & ~(FILE_READ_ATTRIBUTES_LE | 3833 FILE_WRITE_ATTRIBUTES_LE | FILE_SYNCHRONIZE_LE)); 3834 3835 fp->is_posix_ctxt = posix_ctxt; 3836 3837 /* fp should be searchable through ksmbd_inode.m_fp_list 3838 * after daccess, saccess, attrib_only, and stream are 3839 * initialized. 3840 */ 3841 down_write(&fp->f_ci->m_lock); 3842 list_add(&fp->node, &fp->f_ci->m_fp_list); 3843 up_write(&fp->f_ci->m_lock); 3844 3845 /* Check delete pending among previous fp before oplock break */ 3846 if (ksmbd_inode_pending_delete(fp)) { 3847 rc = -EBUSY; 3848 goto err_out; 3849 } 3850 3851 if (!stream_name && daccess & FILE_DELETE_LE && 3852 ksmbd_has_stream_without_delete_share(fp)) { 3853 rc = -EPERM; 3854 goto err_out; 3855 } 3856 3857 if (file_present || created) 3858 path_put(&path); 3859 3860 if (!S_ISDIR(file_inode(filp)->i_mode) && open_flags & O_TRUNC && 3861 !fp->attrib_only && !stream_name) { 3862 smb_break_all_oplock(work, fp); 3863 need_truncate = 1; 3864 } 3865 3866 share_ret = ksmbd_smb_check_shared_mode(fp->filp, fp); 3867 if (!test_share_config_flag(work->tcon->share_conf, KSMBD_SHARE_FLAG_OPLOCKS) || 3868 (req_op_level == SMB2_OPLOCK_LEVEL_LEASE && 3869 !(conn->vals->req_capabilities & SMB2_GLOBAL_CAP_LEASING))) { 3870 if (share_ret < 0 && !S_ISDIR(file_inode(fp->filp)->i_mode)) { 3871 rc = share_ret; 3872 goto err_out1; 3873 } 3874 } else { 3875 if (req_op_level == SMB2_OPLOCK_LEVEL_LEASE && lc) { 3876 if (S_ISDIR(file_inode(filp)->i_mode)) { 3877 lc->req_state &= ~SMB2_LEASE_WRITE_CACHING_LE; 3878 lc->is_dir = true; 3879 } 3880 3881 /* 3882 * Compare parent lease using parent key. If there is no 3883 * a lease that has same parent key, Send lease break 3884 * notification. 3885 */ 3886 smb_send_parent_lease_break_noti(fp, lc); 3887 3888 req_op_level = smb2_map_lease_to_oplock(lc->req_state); 3889 ksmbd_debug(SMB, 3890 "lease req for(%s) req oplock state 0x%x, lease state 0x%x\n", 3891 name, req_op_level, lc->req_state); 3892 rc = find_same_lease_key(conn, fp->f_ci, lc); 3893 if (rc) 3894 goto err_out1; 3895 } else if (open_flags == O_RDONLY && 3896 (req_op_level == SMB2_OPLOCK_LEVEL_BATCH || 3897 req_op_level == SMB2_OPLOCK_LEVEL_EXCLUSIVE)) 3898 req_op_level = SMB2_OPLOCK_LEVEL_II; 3899 3900 rc = smb_grant_oplock(work, req_op_level, 3901 fp->persistent_id, fp, 3902 le32_to_cpu(req->hdr.Id.SyncId.TreeId), 3903 lc, share_ret); 3904 if (rc < 0) 3905 goto err_out1; 3906 } 3907 3908 if (req->CreateOptions & FILE_DELETE_ON_CLOSE_LE) { 3909 smb_break_all_levII_oplock_for_delete(work, fp); 3910 ksmbd_fd_set_delete_on_close(fp, file_info); 3911 } 3912 3913 if (need_truncate) { 3914 rc = smb2_create_truncate(&fp->filp->f_path); 3915 if (rc) 3916 goto err_out1; 3917 } 3918 3919 if (req->CreateContextsOffset) { 3920 struct create_alloc_size_req *az_req; 3921 3922 az_req = (struct create_alloc_size_req *)smb2_find_context_vals(req, 3923 SMB2_CREATE_ALLOCATION_SIZE, 4); 3924 if (IS_ERR(az_req)) { 3925 rc = PTR_ERR(az_req); 3926 goto err_out1; 3927 } else if (az_req) { 3928 int err; 3929 3930 if (le16_to_cpu(az_req->ccontext.DataOffset) + 3931 le32_to_cpu(az_req->ccontext.DataLength) < 3932 sizeof(struct create_alloc_size_req)) { 3933 rc = -EINVAL; 3934 goto err_out1; 3935 } 3936 alloc_size = le64_to_cpu(az_req->AllocationSize); 3937 ksmbd_debug(SMB, 3938 "request smb2 create allocate size : %llu\n", 3939 alloc_size); 3940 smb_break_all_levII_oplock(work, fp, 1); 3941 err = vfs_fallocate(fp->filp, FALLOC_FL_KEEP_SIZE, 0, 3942 alloc_size); 3943 if (err < 0) 3944 ksmbd_debug(SMB, 3945 "vfs_fallocate is failed : %d\n", 3946 err); 3947 } 3948 3949 context = smb2_find_context_vals(req, SMB2_CREATE_QUERY_ON_DISK_ID, 4); 3950 if (IS_ERR(context)) { 3951 rc = PTR_ERR(context); 3952 goto err_out1; 3953 } else if (context) { 3954 ksmbd_debug(SMB, "get query on disk id context\n"); 3955 query_disk_id = 1; 3956 } 3957 3958 if (conn->is_aapl == false) { 3959 context = smb2_find_context_vals(req, SMB2_CREATE_AAPL, 4); 3960 if (IS_ERR(context)) { 3961 rc = PTR_ERR(context); 3962 goto err_out1; 3963 } else if (context) 3964 conn->is_aapl = true; 3965 } 3966 } 3967 3968 rc = ksmbd_vfs_getattr(&path, &stat); 3969 if (rc) 3970 goto err_out1; 3971 3972 if (stat.result_mask & STATX_BTIME) 3973 fp->create_time = ksmbd_UnixTimeToNT(stat.btime); 3974 else 3975 fp->create_time = ksmbd_UnixTimeToNT(stat.ctime); 3976 fp->change_time = ksmbd_UnixTimeToNT(stat.ctime); 3977 fp->allocation_size = S_ISDIR(stat.mode) ? 0 : 3978 (alloc_size ?: stat.blocks << 9); 3979 if (req->FileAttributes || fp->f_ci->m_fattr == 0) 3980 fp->f_ci->m_fattr = 3981 cpu_to_le32(smb2_get_dos_mode(&stat, le32_to_cpu(req->FileAttributes))); 3982 3983 if (!created) 3984 smb2_update_xattrs(tcon, &path, fp); 3985 3986 ksmbd_vfs_update_compressed_fattr(path.dentry, &fp->f_ci->m_fattr); 3987 3988 if (created) 3989 smb2_new_xattrs(tcon, &path, fp); 3990 3991 memcpy(fp->client_guid, conn->ClientGUID, SMB2_CLIENT_GUID_SIZE); 3992 3993 if (dh_info.type == DURABLE_REQ_V2 || dh_info.type == DURABLE_REQ) { 3994 if (dh_info.type == DURABLE_REQ_V2 && dh_info.persistent && 3995 test_share_config_flag(work->tcon->share_conf, 3996 KSMBD_SHARE_FLAG_CONTINUOUS_AVAILABILITY)) 3997 fp->is_persistent = true; 3998 else 3999 fp->is_durable = true; 4000 4001 if (dh_info.type == DURABLE_REQ_V2) { 4002 memcpy(fp->create_guid, dh_info.CreateGuid, 4003 SMB2_CREATE_GUID_SIZE); 4004 if (dh_info.app_instance_id) 4005 memcpy(fp->app_instance_id, 4006 dh_info.AppInstanceId, 4007 SMB2_CREATE_GUID_SIZE); 4008 if (dh_info.timeout) 4009 fp->durable_timeout = 4010 min_t(unsigned int, dh_info.timeout, 4011 DURABLE_HANDLE_MAX_TIMEOUT); 4012 else 4013 fp->durable_timeout = 60; 4014 } 4015 } 4016 4017 reconnected_fp: 4018 rsp->StructureSize = cpu_to_le16(89); 4019 opinfo = opinfo_get(fp); 4020 rsp->OplockLevel = opinfo != NULL ? opinfo->level : 0; 4021 rsp->Flags = 0; 4022 rsp->CreateAction = cpu_to_le32(file_info); 4023 rsp->CreationTime = cpu_to_le64(fp->create_time); 4024 time = ksmbd_UnixTimeToNT(stat.atime); 4025 rsp->LastAccessTime = cpu_to_le64(time); 4026 time = ksmbd_UnixTimeToNT(stat.mtime); 4027 fp->open_mtime = time; 4028 rsp->LastWriteTime = cpu_to_le64(time); 4029 rsp->ChangeTime = cpu_to_le64(fp->change_time); 4030 /* 4031 * The cached allocation size hides filesystem rounding for the 4032 * requested allocation, but it can go stale when the file grows past 4033 * it via writes (e.g. across a durable reconnect). Refresh it once the 4034 * file exceeds the cached value, rounding the end of file up to the 4035 * volume allocation unit (the filesystem block size, matching the 4036 * SectorsPerAllocationUnit/BytesPerSector ksmbd advertises) rather than 4037 * using the raw on-disk block count, which can include filesystem 4038 * preallocation and metadata rounding. 4039 */ 4040 if (!S_ISDIR(stat.mode) && stat.size > fp->allocation_size) 4041 fp->allocation_size = round_up(stat.size, stat.blksize); 4042 rsp->AllocationSize = cpu_to_le64(fp->allocation_size); 4043 rsp->EndofFile = S_ISDIR(stat.mode) ? 0 : cpu_to_le64(stat.size); 4044 rsp->FileAttributes = fp->f_ci->m_fattr; 4045 4046 rsp->Reserved2 = 0; 4047 4048 rsp->PersistentFileId = fp->persistent_id; 4049 rsp->VolatileFileId = fp->volatile_id; 4050 4051 rsp->CreateContextsOffset = 0; 4052 rsp->CreateContextsLength = 0; 4053 iov_len = offsetof(struct smb2_create_rsp, Buffer); 4054 4055 /* If lease is request send lease context response */ 4056 if (opinfo && opinfo->is_lease) { 4057 struct create_context *lease_ccontext; 4058 4059 ksmbd_debug(SMB, "lease granted on(%s) lease state 0x%x\n", 4060 name, opinfo->o_lease->state); 4061 rsp->OplockLevel = SMB2_OPLOCK_LEVEL_LEASE; 4062 4063 lease_ccontext = (struct create_context *)rsp->Buffer; 4064 contxt_cnt++; 4065 create_lease_buf(rsp->Buffer, opinfo->o_lease); 4066 le32_add_cpu(&rsp->CreateContextsLength, 4067 conn->vals->create_lease_size); 4068 iov_len += conn->vals->create_lease_size; 4069 next_ptr = &lease_ccontext->Next; 4070 next_off = conn->vals->create_lease_size; 4071 } 4072 opinfo_put(opinfo); 4073 4074 if (maximal_access_ctxt) { 4075 struct create_context *mxac_ccontext; 4076 4077 if (maximal_access == 0) 4078 ksmbd_vfs_query_maximal_access(idmap, 4079 path.dentry, 4080 &maximal_access); 4081 mxac_ccontext = (struct create_context *)(rsp->Buffer + 4082 le32_to_cpu(rsp->CreateContextsLength)); 4083 contxt_cnt++; 4084 create_mxac_rsp_buf(rsp->Buffer + 4085 le32_to_cpu(rsp->CreateContextsLength), 4086 le32_to_cpu(maximal_access)); 4087 le32_add_cpu(&rsp->CreateContextsLength, 4088 conn->vals->create_mxac_size); 4089 iov_len += conn->vals->create_mxac_size; 4090 if (next_ptr) 4091 *next_ptr = cpu_to_le32(next_off); 4092 next_ptr = &mxac_ccontext->Next; 4093 next_off = conn->vals->create_mxac_size; 4094 } 4095 4096 if (query_disk_id) { 4097 struct create_context *disk_id_ccontext; 4098 4099 disk_id_ccontext = (struct create_context *)(rsp->Buffer + 4100 le32_to_cpu(rsp->CreateContextsLength)); 4101 contxt_cnt++; 4102 create_disk_id_rsp_buf(rsp->Buffer + 4103 le32_to_cpu(rsp->CreateContextsLength), 4104 stat.ino, tcon->id); 4105 le32_add_cpu(&rsp->CreateContextsLength, 4106 conn->vals->create_disk_id_size); 4107 iov_len += conn->vals->create_disk_id_size; 4108 if (next_ptr) 4109 *next_ptr = cpu_to_le32(next_off); 4110 next_ptr = &disk_id_ccontext->Next; 4111 next_off = conn->vals->create_disk_id_size; 4112 } 4113 4114 if (dh_info.type == DURABLE_REQ || dh_info.type == DURABLE_REQ_V2) { 4115 struct create_context *durable_ccontext; 4116 4117 durable_ccontext = (struct create_context *)(rsp->Buffer + 4118 le32_to_cpu(rsp->CreateContextsLength)); 4119 contxt_cnt++; 4120 if (dh_info.type == DURABLE_REQ) { 4121 create_durable_rsp_buf(rsp->Buffer + 4122 le32_to_cpu(rsp->CreateContextsLength)); 4123 le32_add_cpu(&rsp->CreateContextsLength, 4124 conn->vals->create_durable_size); 4125 iov_len += conn->vals->create_durable_size; 4126 } else { 4127 create_durable_v2_rsp_buf(rsp->Buffer + 4128 le32_to_cpu(rsp->CreateContextsLength), 4129 fp); 4130 le32_add_cpu(&rsp->CreateContextsLength, 4131 conn->vals->create_durable_v2_size); 4132 iov_len += conn->vals->create_durable_v2_size; 4133 } 4134 4135 if (next_ptr) 4136 *next_ptr = cpu_to_le32(next_off); 4137 next_ptr = &durable_ccontext->Next; 4138 next_off = conn->vals->create_durable_size; 4139 } 4140 4141 if (posix_ctxt) { 4142 contxt_cnt++; 4143 create_posix_rsp_buf(rsp->Buffer + 4144 le32_to_cpu(rsp->CreateContextsLength), 4145 fp); 4146 le32_add_cpu(&rsp->CreateContextsLength, 4147 conn->vals->create_posix_size); 4148 iov_len += conn->vals->create_posix_size; 4149 if (next_ptr) 4150 *next_ptr = cpu_to_le32(next_off); 4151 } 4152 4153 if (contxt_cnt > 0) { 4154 rsp->CreateContextsOffset = 4155 cpu_to_le32(offsetof(struct smb2_create_rsp, Buffer)); 4156 } 4157 4158 err_out: 4159 if (rc && (file_present || created)) 4160 path_put(&path); 4161 4162 err_out1: 4163 ksmbd_revert_fsids(work); 4164 4165 err_out2: 4166 if (!rc) { 4167 rc = ksmbd_update_fstate(&work->sess->file_table, fp, 4168 FP_INITED); 4169 if (!rc) 4170 rc = ksmbd_iov_pin_rsp(work, (void *)rsp, iov_len); 4171 } 4172 if (rc) { 4173 if (rc == -EINVAL) 4174 rsp->hdr.Status = STATUS_INVALID_PARAMETER; 4175 else if (rc == -EOPNOTSUPP) 4176 rsp->hdr.Status = STATUS_NOT_SUPPORTED; 4177 else if (rc == -EACCES || rc == -ESTALE || rc == -EXDEV) 4178 rsp->hdr.Status = STATUS_ACCESS_DENIED; 4179 else if (rc == -ENOENT) 4180 rsp->hdr.Status = STATUS_OBJECT_NAME_INVALID; 4181 else if (rc == -EPERM) 4182 rsp->hdr.Status = STATUS_SHARING_VIOLATION; 4183 else if (rc == -EBUSY) 4184 rsp->hdr.Status = STATUS_DELETE_PENDING; 4185 else if (rc == -EBADF) 4186 rsp->hdr.Status = STATUS_OBJECT_NAME_NOT_FOUND; 4187 else if (rc == -ENOEXEC) 4188 rsp->hdr.Status = STATUS_DUPLICATE_OBJECTID; 4189 else if (rc == -ENXIO) 4190 rsp->hdr.Status = STATUS_NO_SUCH_DEVICE; 4191 else if (rc == -EEXIST) 4192 rsp->hdr.Status = STATUS_OBJECT_NAME_COLLISION; 4193 else if (rc == -EMFILE) 4194 rsp->hdr.Status = STATUS_INSUFFICIENT_RESOURCES; 4195 if (!rsp->hdr.Status) 4196 rsp->hdr.Status = STATUS_UNEXPECTED_IO_ERROR; 4197 4198 if (fp) 4199 ksmbd_fd_put(work, fp); 4200 smb2_set_err_rsp(work); 4201 ksmbd_debug(SMB, "Error response: %x\n", rsp->hdr.Status); 4202 } 4203 4204 if (dh_info.reconnected) { 4205 /* 4206 * If reconnect succeeded, fp was republished in the 4207 * session file table. On a later error, ksmbd_fd_put() 4208 * above drops the session reference; drop the durable 4209 * lookup reference through the same session-aware path so 4210 * final close removes the volatile id before freeing fp. 4211 */ 4212 if (rc && fp == dh_info.fp) 4213 ksmbd_fd_put(work, dh_info.fp); 4214 else 4215 ksmbd_put_durable_fd(dh_info.fp); 4216 } 4217 4218 kfree(name); 4219 kfree(lc); 4220 4221 return rc; 4222 } 4223 4224 static int readdir_info_level_struct_sz(int info_level) 4225 { 4226 switch (info_level) { 4227 case FILE_FULL_DIRECTORY_INFORMATION: 4228 return sizeof(FILE_FULL_DIRECTORY_INFO); 4229 case FILE_BOTH_DIRECTORY_INFORMATION: 4230 return sizeof(FILE_BOTH_DIRECTORY_INFO); 4231 case FILE_DIRECTORY_INFORMATION: 4232 return sizeof(FILE_DIRECTORY_INFO); 4233 case FILE_NAMES_INFORMATION: 4234 return sizeof(struct file_names_info); 4235 case FILEID_FULL_DIRECTORY_INFORMATION: 4236 return sizeof(FILE_ID_FULL_DIR_INFO); 4237 case FILEID_BOTH_DIRECTORY_INFORMATION: 4238 return sizeof(struct file_id_both_directory_info); 4239 case SMB_FIND_FILE_POSIX_INFO: 4240 return sizeof(struct smb2_posix_info); 4241 default: 4242 return -EOPNOTSUPP; 4243 } 4244 } 4245 4246 static int dentry_name(struct ksmbd_dir_info *d_info, int info_level) 4247 { 4248 switch (info_level) { 4249 case FILE_FULL_DIRECTORY_INFORMATION: 4250 { 4251 FILE_FULL_DIRECTORY_INFO *ffdinfo; 4252 4253 ffdinfo = (FILE_FULL_DIRECTORY_INFO *)d_info->rptr; 4254 d_info->rptr += le32_to_cpu(ffdinfo->NextEntryOffset); 4255 d_info->name = ffdinfo->FileName; 4256 d_info->name_len = le32_to_cpu(ffdinfo->FileNameLength); 4257 return 0; 4258 } 4259 case FILE_BOTH_DIRECTORY_INFORMATION: 4260 { 4261 FILE_BOTH_DIRECTORY_INFO *fbdinfo; 4262 4263 fbdinfo = (FILE_BOTH_DIRECTORY_INFO *)d_info->rptr; 4264 d_info->rptr += le32_to_cpu(fbdinfo->NextEntryOffset); 4265 d_info->name = fbdinfo->FileName; 4266 d_info->name_len = le32_to_cpu(fbdinfo->FileNameLength); 4267 return 0; 4268 } 4269 case FILE_DIRECTORY_INFORMATION: 4270 { 4271 FILE_DIRECTORY_INFO *fdinfo; 4272 4273 fdinfo = (FILE_DIRECTORY_INFO *)d_info->rptr; 4274 d_info->rptr += le32_to_cpu(fdinfo->NextEntryOffset); 4275 d_info->name = fdinfo->FileName; 4276 d_info->name_len = le32_to_cpu(fdinfo->FileNameLength); 4277 return 0; 4278 } 4279 case FILE_NAMES_INFORMATION: 4280 { 4281 struct file_names_info *fninfo; 4282 4283 fninfo = (struct file_names_info *)d_info->rptr; 4284 d_info->rptr += le32_to_cpu(fninfo->NextEntryOffset); 4285 d_info->name = fninfo->FileName; 4286 d_info->name_len = le32_to_cpu(fninfo->FileNameLength); 4287 return 0; 4288 } 4289 case FILEID_FULL_DIRECTORY_INFORMATION: 4290 { 4291 FILE_ID_FULL_DIR_INFO *dinfo; 4292 4293 dinfo = (FILE_ID_FULL_DIR_INFO *)d_info->rptr; 4294 d_info->rptr += le32_to_cpu(dinfo->NextEntryOffset); 4295 d_info->name = dinfo->FileName; 4296 d_info->name_len = le32_to_cpu(dinfo->FileNameLength); 4297 return 0; 4298 } 4299 case FILEID_BOTH_DIRECTORY_INFORMATION: 4300 { 4301 struct file_id_both_directory_info *fibdinfo; 4302 4303 fibdinfo = (struct file_id_both_directory_info *)d_info->rptr; 4304 d_info->rptr += le32_to_cpu(fibdinfo->NextEntryOffset); 4305 d_info->name = fibdinfo->FileName; 4306 d_info->name_len = le32_to_cpu(fibdinfo->FileNameLength); 4307 return 0; 4308 } 4309 case SMB_FIND_FILE_POSIX_INFO: 4310 { 4311 struct smb2_posix_info *posix_info; 4312 4313 posix_info = (struct smb2_posix_info *)d_info->rptr; 4314 d_info->rptr += le32_to_cpu(posix_info->NextEntryOffset); 4315 d_info->name = posix_info->name; 4316 d_info->name_len = le32_to_cpu(posix_info->name_len); 4317 return 0; 4318 } 4319 default: 4320 return -EINVAL; 4321 } 4322 } 4323 4324 /** 4325 * smb2_populate_readdir_entry() - encode directory entry in smb2 response 4326 * buffer 4327 * @conn: connection instance 4328 * @info_level: smb information level 4329 * @d_info: structure included variables for query dir 4330 * @ksmbd_kstat: ksmbd wrapper of dirent stat information 4331 * 4332 * if directory has many entries, find first can't read it fully. 4333 * find next might be called multiple times to read remaining dir entries 4334 * 4335 * Return: 0 on success, otherwise error 4336 */ 4337 static int smb2_populate_readdir_entry(struct ksmbd_conn *conn, int info_level, 4338 struct ksmbd_dir_info *d_info, 4339 struct ksmbd_kstat *ksmbd_kstat) 4340 { 4341 int next_entry_offset = 0; 4342 char *conv_name; 4343 int conv_len; 4344 void *kstat; 4345 int struct_sz, rc = 0; 4346 4347 conv_name = ksmbd_convert_dir_info_name(d_info, 4348 conn->local_nls, 4349 &conv_len); 4350 if (!conv_name) 4351 return -ENOMEM; 4352 4353 /* Somehow the name has only terminating NULL bytes */ 4354 if (conv_len < 0) { 4355 rc = -EINVAL; 4356 goto free_conv_name; 4357 } 4358 4359 struct_sz = readdir_info_level_struct_sz(info_level); 4360 if (struct_sz == -EOPNOTSUPP) { 4361 rc = -EINVAL; 4362 goto free_conv_name; 4363 } 4364 4365 struct_sz += conv_len; 4366 next_entry_offset = ALIGN(struct_sz, KSMBD_DIR_INFO_ALIGNMENT); 4367 d_info->last_entry_off_align = next_entry_offset - struct_sz; 4368 4369 if (next_entry_offset > d_info->out_buf_len) { 4370 d_info->out_buf_len = 0; 4371 rc = -ENOSPC; 4372 goto free_conv_name; 4373 } 4374 4375 kstat = d_info->wptr; 4376 if (info_level != FILE_NAMES_INFORMATION) 4377 kstat = ksmbd_vfs_init_kstat(&d_info->wptr, ksmbd_kstat); 4378 4379 switch (info_level) { 4380 case FILE_FULL_DIRECTORY_INFORMATION: 4381 { 4382 FILE_FULL_DIRECTORY_INFO *ffdinfo; 4383 4384 ffdinfo = (FILE_FULL_DIRECTORY_INFO *)kstat; 4385 ffdinfo->FileNameLength = cpu_to_le32(conv_len); 4386 ffdinfo->EaSize = 4387 smb2_get_reparse_tag_special_file(ksmbd_kstat->kstat->mode); 4388 if (ffdinfo->EaSize) 4389 ffdinfo->ExtFileAttributes = FILE_ATTRIBUTE_REPARSE_POINT_LE; 4390 if (d_info->hide_dot_file && d_info->name[0] == '.') 4391 ffdinfo->ExtFileAttributes |= FILE_ATTRIBUTE_HIDDEN_LE; 4392 memcpy(ffdinfo->FileName, conv_name, conv_len); 4393 ffdinfo->NextEntryOffset = cpu_to_le32(next_entry_offset); 4394 break; 4395 } 4396 case FILE_BOTH_DIRECTORY_INFORMATION: 4397 { 4398 FILE_BOTH_DIRECTORY_INFO *fbdinfo; 4399 4400 fbdinfo = (FILE_BOTH_DIRECTORY_INFO *)kstat; 4401 fbdinfo->FileNameLength = cpu_to_le32(conv_len); 4402 fbdinfo->EaSize = 4403 smb2_get_reparse_tag_special_file(ksmbd_kstat->kstat->mode); 4404 if (fbdinfo->EaSize) 4405 fbdinfo->ExtFileAttributes = FILE_ATTRIBUTE_REPARSE_POINT_LE; 4406 fbdinfo->ShortNameLength = 0; 4407 fbdinfo->Reserved = 0; 4408 if (d_info->hide_dot_file && d_info->name[0] == '.') 4409 fbdinfo->ExtFileAttributes |= FILE_ATTRIBUTE_HIDDEN_LE; 4410 memcpy(fbdinfo->FileName, conv_name, conv_len); 4411 fbdinfo->NextEntryOffset = cpu_to_le32(next_entry_offset); 4412 break; 4413 } 4414 case FILE_DIRECTORY_INFORMATION: 4415 { 4416 FILE_DIRECTORY_INFO *fdinfo; 4417 4418 fdinfo = (FILE_DIRECTORY_INFO *)kstat; 4419 fdinfo->FileNameLength = cpu_to_le32(conv_len); 4420 if (d_info->hide_dot_file && d_info->name[0] == '.') 4421 fdinfo->ExtFileAttributes |= FILE_ATTRIBUTE_HIDDEN_LE; 4422 memcpy(fdinfo->FileName, conv_name, conv_len); 4423 fdinfo->NextEntryOffset = cpu_to_le32(next_entry_offset); 4424 break; 4425 } 4426 case FILE_NAMES_INFORMATION: 4427 { 4428 struct file_names_info *fninfo; 4429 4430 fninfo = (struct file_names_info *)kstat; 4431 fninfo->FileNameLength = cpu_to_le32(conv_len); 4432 memcpy(fninfo->FileName, conv_name, conv_len); 4433 fninfo->NextEntryOffset = cpu_to_le32(next_entry_offset); 4434 break; 4435 } 4436 case FILEID_FULL_DIRECTORY_INFORMATION: 4437 { 4438 FILE_ID_FULL_DIR_INFO *dinfo; 4439 4440 dinfo = (FILE_ID_FULL_DIR_INFO *)kstat; 4441 dinfo->FileNameLength = cpu_to_le32(conv_len); 4442 dinfo->EaSize = 4443 smb2_get_reparse_tag_special_file(ksmbd_kstat->kstat->mode); 4444 if (dinfo->EaSize) 4445 dinfo->ExtFileAttributes = FILE_ATTRIBUTE_REPARSE_POINT_LE; 4446 dinfo->Reserved = 0; 4447 if (conn->is_aapl) 4448 dinfo->UniqueId = 0; 4449 else 4450 dinfo->UniqueId = cpu_to_le64(ksmbd_kstat->kstat->ino); 4451 if (d_info->hide_dot_file && d_info->name[0] == '.') 4452 dinfo->ExtFileAttributes |= FILE_ATTRIBUTE_HIDDEN_LE; 4453 memcpy(dinfo->FileName, conv_name, conv_len); 4454 dinfo->NextEntryOffset = cpu_to_le32(next_entry_offset); 4455 break; 4456 } 4457 case FILEID_BOTH_DIRECTORY_INFORMATION: 4458 { 4459 struct file_id_both_directory_info *fibdinfo; 4460 4461 fibdinfo = (struct file_id_both_directory_info *)kstat; 4462 fibdinfo->FileNameLength = cpu_to_le32(conv_len); 4463 fibdinfo->EaSize = 4464 smb2_get_reparse_tag_special_file(ksmbd_kstat->kstat->mode); 4465 if (fibdinfo->EaSize) 4466 fibdinfo->ExtFileAttributes = FILE_ATTRIBUTE_REPARSE_POINT_LE; 4467 if (conn->is_aapl) 4468 fibdinfo->UniqueId = 0; 4469 else 4470 fibdinfo->UniqueId = cpu_to_le64(ksmbd_kstat->kstat->ino); 4471 fibdinfo->ShortNameLength = 0; 4472 fibdinfo->Reserved = 0; 4473 fibdinfo->Reserved2 = cpu_to_le16(0); 4474 if (d_info->hide_dot_file && d_info->name[0] == '.') 4475 fibdinfo->ExtFileAttributes |= FILE_ATTRIBUTE_HIDDEN_LE; 4476 memcpy(fibdinfo->FileName, conv_name, conv_len); 4477 fibdinfo->NextEntryOffset = cpu_to_le32(next_entry_offset); 4478 break; 4479 } 4480 case SMB_FIND_FILE_POSIX_INFO: 4481 { 4482 struct smb2_posix_info *posix_info; 4483 u64 time; 4484 4485 posix_info = (struct smb2_posix_info *)kstat; 4486 posix_info->Ignored = 0; 4487 posix_info->CreationTime = cpu_to_le64(ksmbd_kstat->create_time); 4488 time = ksmbd_UnixTimeToNT(ksmbd_kstat->kstat->ctime); 4489 posix_info->ChangeTime = cpu_to_le64(time); 4490 time = ksmbd_UnixTimeToNT(ksmbd_kstat->kstat->atime); 4491 posix_info->LastAccessTime = cpu_to_le64(time); 4492 time = ksmbd_UnixTimeToNT(ksmbd_kstat->kstat->mtime); 4493 posix_info->LastWriteTime = cpu_to_le64(time); 4494 posix_info->EndOfFile = cpu_to_le64(ksmbd_kstat->kstat->size); 4495 posix_info->AllocationSize = cpu_to_le64(ksmbd_kstat->kstat->blocks << 9); 4496 posix_info->DeviceId = cpu_to_le32(ksmbd_kstat->kstat->rdev); 4497 posix_info->HardLinks = cpu_to_le32(ksmbd_kstat->kstat->nlink); 4498 posix_info->Mode = cpu_to_le32(ksmbd_kstat->kstat->mode & 0777); 4499 switch (ksmbd_kstat->kstat->mode & S_IFMT) { 4500 case S_IFDIR: 4501 posix_info->Mode |= cpu_to_le32(POSIX_TYPE_DIR << POSIX_FILETYPE_SHIFT); 4502 break; 4503 case S_IFLNK: 4504 posix_info->Mode |= cpu_to_le32(POSIX_TYPE_SYMLINK << POSIX_FILETYPE_SHIFT); 4505 break; 4506 case S_IFCHR: 4507 posix_info->Mode |= cpu_to_le32(POSIX_TYPE_CHARDEV << POSIX_FILETYPE_SHIFT); 4508 break; 4509 case S_IFBLK: 4510 posix_info->Mode |= cpu_to_le32(POSIX_TYPE_BLKDEV << POSIX_FILETYPE_SHIFT); 4511 break; 4512 case S_IFIFO: 4513 posix_info->Mode |= cpu_to_le32(POSIX_TYPE_FIFO << POSIX_FILETYPE_SHIFT); 4514 break; 4515 case S_IFSOCK: 4516 posix_info->Mode |= cpu_to_le32(POSIX_TYPE_SOCKET << POSIX_FILETYPE_SHIFT); 4517 } 4518 4519 posix_info->Inode = cpu_to_le64(ksmbd_kstat->kstat->ino); 4520 posix_info->DosAttributes = 4521 S_ISDIR(ksmbd_kstat->kstat->mode) ? 4522 FILE_ATTRIBUTE_DIRECTORY_LE : FILE_ATTRIBUTE_ARCHIVE_LE; 4523 if (d_info->hide_dot_file && d_info->name[0] == '.') 4524 posix_info->DosAttributes |= FILE_ATTRIBUTE_HIDDEN_LE; 4525 /* 4526 * SidBuffer(32) contain two sids(Domain sid(16), UNIX group sid(16)). 4527 * UNIX sid(16) = revision(1) + num_subauth(1) + authority(6) + 4528 * sub_auth(4 * 1(num_subauth)) + RID(4). 4529 */ 4530 id_to_sid(from_kuid_munged(&init_user_ns, ksmbd_kstat->kstat->uid), 4531 SIDUNIX_USER, (struct smb_sid *)&posix_info->SidBuffer[0]); 4532 id_to_sid(from_kgid_munged(&init_user_ns, ksmbd_kstat->kstat->gid), 4533 SIDUNIX_GROUP, (struct smb_sid *)&posix_info->SidBuffer[16]); 4534 memcpy(posix_info->name, conv_name, conv_len); 4535 posix_info->name_len = cpu_to_le32(conv_len); 4536 posix_info->NextEntryOffset = cpu_to_le32(next_entry_offset); 4537 break; 4538 } 4539 4540 } /* switch (info_level) */ 4541 4542 d_info->last_entry_offset = d_info->data_count; 4543 d_info->data_count += next_entry_offset; 4544 d_info->out_buf_len -= next_entry_offset; 4545 d_info->wptr += next_entry_offset; 4546 4547 ksmbd_debug(SMB, 4548 "info_level : %d, buf_len :%d, next_offset : %d, data_count : %d\n", 4549 info_level, d_info->out_buf_len, 4550 next_entry_offset, d_info->data_count); 4551 4552 free_conv_name: 4553 kfree(conv_name); 4554 return rc; 4555 } 4556 4557 struct smb2_query_dir_private { 4558 struct ksmbd_work *work; 4559 char *search_pattern; 4560 struct ksmbd_file *dir_fp; 4561 4562 struct ksmbd_dir_info *d_info; 4563 int info_level; 4564 }; 4565 4566 static int process_query_dir_entries(struct smb2_query_dir_private *priv) 4567 { 4568 struct mnt_idmap *idmap = file_mnt_idmap(priv->dir_fp->filp); 4569 struct kstat kstat; 4570 struct ksmbd_kstat ksmbd_kstat; 4571 int rc; 4572 int i; 4573 4574 for (i = 0; i < priv->d_info->num_entry; i++) { 4575 struct dentry *dent; 4576 4577 if (dentry_name(priv->d_info, priv->info_level)) 4578 return -EINVAL; 4579 4580 dent = lookup_one_unlocked(idmap, 4581 &QSTR_LEN(priv->d_info->name, 4582 priv->d_info->name_len), 4583 priv->dir_fp->filp->f_path.dentry); 4584 4585 if (IS_ERR(dent)) { 4586 ksmbd_debug(SMB, "Cannot lookup `%s' [%ld]\n", 4587 priv->d_info->name, 4588 PTR_ERR(dent)); 4589 continue; 4590 } 4591 if (unlikely(d_is_negative(dent))) { 4592 dput(dent); 4593 ksmbd_debug(SMB, "Negative dentry `%s'\n", 4594 priv->d_info->name); 4595 continue; 4596 } 4597 4598 ksmbd_kstat.kstat = &kstat; 4599 if (priv->info_level != FILE_NAMES_INFORMATION) { 4600 rc = ksmbd_vfs_fill_dentry_attrs(priv->work, 4601 idmap, 4602 dent, 4603 &ksmbd_kstat); 4604 if (rc) { 4605 dput(dent); 4606 continue; 4607 } 4608 } 4609 4610 rc = smb2_populate_readdir_entry(priv->work->conn, 4611 priv->info_level, 4612 priv->d_info, 4613 &ksmbd_kstat); 4614 dput(dent); 4615 if (rc) 4616 return rc; 4617 } 4618 return 0; 4619 } 4620 4621 static int reserve_populate_dentry(struct ksmbd_dir_info *d_info, 4622 int info_level) 4623 { 4624 int struct_sz; 4625 int conv_len; 4626 int next_entry_offset; 4627 4628 struct_sz = readdir_info_level_struct_sz(info_level); 4629 if (struct_sz == -EOPNOTSUPP) 4630 return -EOPNOTSUPP; 4631 4632 conv_len = (d_info->name_len + 1) * 2; 4633 next_entry_offset = ALIGN(struct_sz + conv_len, 4634 KSMBD_DIR_INFO_ALIGNMENT); 4635 4636 if (next_entry_offset > d_info->out_buf_len) { 4637 d_info->out_buf_len = 0; 4638 return -ENOSPC; 4639 } 4640 4641 switch (info_level) { 4642 case FILE_FULL_DIRECTORY_INFORMATION: 4643 { 4644 FILE_FULL_DIRECTORY_INFO *ffdinfo; 4645 4646 ffdinfo = (FILE_FULL_DIRECTORY_INFO *)d_info->wptr; 4647 memcpy(ffdinfo->FileName, d_info->name, d_info->name_len); 4648 ffdinfo->FileName[d_info->name_len] = 0x00; 4649 ffdinfo->FileNameLength = cpu_to_le32(d_info->name_len); 4650 ffdinfo->NextEntryOffset = cpu_to_le32(next_entry_offset); 4651 break; 4652 } 4653 case FILE_BOTH_DIRECTORY_INFORMATION: 4654 { 4655 FILE_BOTH_DIRECTORY_INFO *fbdinfo; 4656 4657 fbdinfo = (FILE_BOTH_DIRECTORY_INFO *)d_info->wptr; 4658 memcpy(fbdinfo->FileName, d_info->name, d_info->name_len); 4659 fbdinfo->FileName[d_info->name_len] = 0x00; 4660 fbdinfo->FileNameLength = cpu_to_le32(d_info->name_len); 4661 fbdinfo->NextEntryOffset = cpu_to_le32(next_entry_offset); 4662 break; 4663 } 4664 case FILE_DIRECTORY_INFORMATION: 4665 { 4666 FILE_DIRECTORY_INFO *fdinfo; 4667 4668 fdinfo = (FILE_DIRECTORY_INFO *)d_info->wptr; 4669 memcpy(fdinfo->FileName, d_info->name, d_info->name_len); 4670 fdinfo->FileName[d_info->name_len] = 0x00; 4671 fdinfo->FileNameLength = cpu_to_le32(d_info->name_len); 4672 fdinfo->NextEntryOffset = cpu_to_le32(next_entry_offset); 4673 break; 4674 } 4675 case FILE_NAMES_INFORMATION: 4676 { 4677 struct file_names_info *fninfo; 4678 4679 fninfo = (struct file_names_info *)d_info->wptr; 4680 memcpy(fninfo->FileName, d_info->name, d_info->name_len); 4681 fninfo->FileName[d_info->name_len] = 0x00; 4682 fninfo->FileNameLength = cpu_to_le32(d_info->name_len); 4683 fninfo->NextEntryOffset = cpu_to_le32(next_entry_offset); 4684 break; 4685 } 4686 case FILEID_FULL_DIRECTORY_INFORMATION: 4687 { 4688 FILE_ID_FULL_DIR_INFO *dinfo; 4689 4690 dinfo = (FILE_ID_FULL_DIR_INFO *)d_info->wptr; 4691 memcpy(dinfo->FileName, d_info->name, d_info->name_len); 4692 dinfo->FileName[d_info->name_len] = 0x00; 4693 dinfo->FileNameLength = cpu_to_le32(d_info->name_len); 4694 dinfo->NextEntryOffset = cpu_to_le32(next_entry_offset); 4695 break; 4696 } 4697 case FILEID_BOTH_DIRECTORY_INFORMATION: 4698 { 4699 struct file_id_both_directory_info *fibdinfo; 4700 4701 fibdinfo = (struct file_id_both_directory_info *)d_info->wptr; 4702 memcpy(fibdinfo->FileName, d_info->name, d_info->name_len); 4703 fibdinfo->FileName[d_info->name_len] = 0x00; 4704 fibdinfo->FileNameLength = cpu_to_le32(d_info->name_len); 4705 fibdinfo->NextEntryOffset = cpu_to_le32(next_entry_offset); 4706 break; 4707 } 4708 case SMB_FIND_FILE_POSIX_INFO: 4709 { 4710 struct smb2_posix_info *posix_info; 4711 4712 posix_info = (struct smb2_posix_info *)d_info->wptr; 4713 memcpy(posix_info->name, d_info->name, d_info->name_len); 4714 posix_info->name[d_info->name_len] = 0x00; 4715 posix_info->name_len = cpu_to_le32(d_info->name_len); 4716 posix_info->NextEntryOffset = 4717 cpu_to_le32(next_entry_offset); 4718 break; 4719 } 4720 } /* switch (info_level) */ 4721 4722 d_info->num_entry++; 4723 d_info->out_buf_len -= next_entry_offset; 4724 d_info->wptr += next_entry_offset; 4725 return 0; 4726 } 4727 4728 static bool __query_dir(struct dir_context *ctx, const char *name, int namlen, 4729 loff_t offset, u64 ino, unsigned int d_type) 4730 { 4731 struct ksmbd_readdir_data *buf; 4732 struct smb2_query_dir_private *priv; 4733 struct ksmbd_dir_info *d_info; 4734 int rc; 4735 4736 buf = container_of(ctx, struct ksmbd_readdir_data, ctx); 4737 priv = buf->private; 4738 d_info = priv->d_info; 4739 4740 /* dot and dotdot entries are already reserved */ 4741 if (!strcmp(".", name) || !strcmp("..", name)) 4742 return true; 4743 d_info->num_scan++; 4744 if (ksmbd_share_veto_filename(priv->work->tcon->share_conf, name)) 4745 return true; 4746 if (!match_pattern(name, namlen, priv->search_pattern)) 4747 return true; 4748 4749 d_info->name = name; 4750 d_info->name_len = namlen; 4751 rc = reserve_populate_dentry(d_info, priv->info_level); 4752 if (rc) 4753 return false; 4754 if (d_info->flags & SMB2_RETURN_SINGLE_ENTRY) 4755 d_info->out_buf_len = 0; 4756 return true; 4757 } 4758 4759 static int verify_info_level(int info_level) 4760 { 4761 switch (info_level) { 4762 case FILE_FULL_DIRECTORY_INFORMATION: 4763 case FILE_BOTH_DIRECTORY_INFORMATION: 4764 case FILE_DIRECTORY_INFORMATION: 4765 case FILE_NAMES_INFORMATION: 4766 case FILEID_FULL_DIRECTORY_INFORMATION: 4767 case FILEID_BOTH_DIRECTORY_INFORMATION: 4768 case SMB_FIND_FILE_POSIX_INFO: 4769 break; 4770 default: 4771 return -EOPNOTSUPP; 4772 } 4773 4774 return 0; 4775 } 4776 4777 static int smb2_resp_buf_len(struct ksmbd_work *work, unsigned short hdr2_len) 4778 { 4779 int free_len; 4780 4781 free_len = (int)(work->response_sz - 4782 (get_rfc1002_len(work->response_buf) + 4)) - hdr2_len; 4783 return free_len; 4784 } 4785 4786 static int smb2_calc_max_out_buf_len(struct ksmbd_work *work, 4787 unsigned short hdr2_len, 4788 unsigned int out_buf_len) 4789 { 4790 int free_len; 4791 4792 if (out_buf_len > work->conn->vals->max_trans_size) 4793 return -EINVAL; 4794 4795 free_len = smb2_resp_buf_len(work, hdr2_len); 4796 if (free_len < 0) 4797 return -EINVAL; 4798 4799 return min_t(int, out_buf_len, free_len); 4800 } 4801 4802 int smb2_query_dir(struct ksmbd_work *work) 4803 { 4804 struct ksmbd_conn *conn = work->conn; 4805 struct smb2_query_directory_req *req; 4806 struct smb2_query_directory_rsp *rsp; 4807 struct ksmbd_share_config *share = work->tcon->share_conf; 4808 struct ksmbd_file *dir_fp = NULL; 4809 struct ksmbd_dir_info d_info; 4810 int rc = 0; 4811 char *srch_ptr = NULL; 4812 unsigned char srch_flag; 4813 int buffer_sz; 4814 struct smb2_query_dir_private query_dir_private = {NULL, }; 4815 unsigned int id = KSMBD_NO_FID, pid = KSMBD_NO_FID; 4816 4817 ksmbd_debug(SMB, "Received smb2 query directory request\n"); 4818 4819 WORK_BUFFERS(work, req, rsp); 4820 4821 if (smb2_compound_has_failed(work, &rsp->hdr)) 4822 return -EACCES; 4823 4824 if (work->next_smb2_rcv_hdr_off && 4825 !has_file_id(req->VolatileFileId)) { 4826 ksmbd_debug(SMB, "Compound request set FID = %llu\n", 4827 work->compound_fid); 4828 id = work->compound_fid; 4829 pid = work->compound_pfid; 4830 } 4831 4832 if (!has_file_id(id)) { 4833 id = req->VolatileFileId; 4834 pid = req->PersistentFileId; 4835 } 4836 4837 if (ksmbd_override_fsids(work)) { 4838 rsp->hdr.Status = STATUS_NO_MEMORY; 4839 smb2_set_err_rsp(work); 4840 return -ENOMEM; 4841 } 4842 4843 rc = verify_info_level(req->FileInformationClass); 4844 if (rc) { 4845 rc = -EFAULT; 4846 goto err_out2; 4847 } 4848 4849 dir_fp = ksmbd_lookup_fd_slow(work, id, pid); 4850 if (!dir_fp) { 4851 rc = -EBADF; 4852 goto err_out2; 4853 } 4854 4855 if (!(dir_fp->daccess & FILE_LIST_DIRECTORY_LE) || 4856 inode_permission(file_mnt_idmap(dir_fp->filp), 4857 file_inode(dir_fp->filp), 4858 MAY_READ | MAY_EXEC)) { 4859 pr_err("no right to enumerate directory (%pD)\n", dir_fp->filp); 4860 rc = -EACCES; 4861 goto err_out2; 4862 } 4863 4864 if (!S_ISDIR(file_inode(dir_fp->filp)->i_mode)) { 4865 pr_err("can't do query dir for a file\n"); 4866 rc = -EINVAL; 4867 goto err_out2; 4868 } 4869 4870 srch_flag = req->Flags; 4871 srch_ptr = smb_strndup_from_utf16((char *)req + le16_to_cpu(req->FileNameOffset), 4872 le16_to_cpu(req->FileNameLength), 1, 4873 conn->local_nls); 4874 if (IS_ERR(srch_ptr)) { 4875 ksmbd_debug(SMB, "Search Pattern not found\n"); 4876 rc = -EINVAL; 4877 goto err_out2; 4878 } else { 4879 ksmbd_debug(SMB, "Search pattern is %s\n", srch_ptr); 4880 } 4881 4882 mutex_lock(&dir_fp->readdir_lock); 4883 4884 if (srch_flag & SMB2_REOPEN || srch_flag & SMB2_RESTART_SCANS) { 4885 ksmbd_debug(SMB, "Restart directory scan\n"); 4886 generic_file_llseek(dir_fp->filp, 0, SEEK_SET); 4887 } 4888 4889 memset(&d_info, 0, sizeof(struct ksmbd_dir_info)); 4890 d_info.wptr = (char *)rsp->Buffer; 4891 d_info.rptr = (char *)rsp->Buffer; 4892 d_info.out_buf_len = 4893 smb2_calc_max_out_buf_len(work, 4894 offsetof(struct smb2_query_directory_rsp, Buffer), 4895 le32_to_cpu(req->OutputBufferLength)); 4896 if (d_info.out_buf_len < 0) { 4897 rc = -EINVAL; 4898 goto err_out; 4899 } 4900 d_info.flags = srch_flag; 4901 4902 /* 4903 * reserve dot and dotdot entries in head of buffer 4904 * in first response 4905 */ 4906 rc = ksmbd_populate_dot_dotdot_entries(work, req->FileInformationClass, 4907 dir_fp, &d_info, srch_ptr, 4908 smb2_populate_readdir_entry); 4909 if (rc == -ENOSPC) 4910 rc = 0; 4911 else if (rc) 4912 goto err_out; 4913 4914 if (test_share_config_flag(share, KSMBD_SHARE_FLAG_HIDE_DOT_FILES)) 4915 d_info.hide_dot_file = true; 4916 4917 buffer_sz = d_info.out_buf_len; 4918 d_info.rptr = d_info.wptr; 4919 query_dir_private.work = work; 4920 query_dir_private.search_pattern = srch_ptr; 4921 query_dir_private.dir_fp = dir_fp; 4922 query_dir_private.d_info = &d_info; 4923 query_dir_private.info_level = req->FileInformationClass; 4924 dir_fp->readdir_data.private = &query_dir_private; 4925 set_ctx_actor(&dir_fp->readdir_data.ctx, __query_dir); 4926 again: 4927 d_info.num_scan = 0; 4928 rc = iterate_dir(dir_fp->filp, &dir_fp->readdir_data.ctx); 4929 /* 4930 * num_entry can be 0 if the directory iteration stops before reaching 4931 * the end of the directory and no file is matched with the search 4932 * pattern. 4933 */ 4934 if (rc >= 0 && !d_info.num_entry && d_info.num_scan && 4935 d_info.out_buf_len > 0) 4936 goto again; 4937 /* 4938 * req->OutputBufferLength is too small to contain even one entry. 4939 * In this case, it immediately returns OutputBufferLength 0 to client. 4940 */ 4941 if (!d_info.out_buf_len && !d_info.num_entry) 4942 goto no_buf_len; 4943 if (rc > 0 || rc == -ENOSPC) 4944 rc = 0; 4945 else if (rc) 4946 goto err_out; 4947 4948 d_info.wptr = d_info.rptr; 4949 d_info.out_buf_len = buffer_sz; 4950 rc = process_query_dir_entries(&query_dir_private); 4951 if (rc) 4952 goto err_out; 4953 4954 if (!d_info.data_count && d_info.out_buf_len >= 0) { 4955 if (srch_flag & SMB2_RETURN_SINGLE_ENTRY && !is_asterisk(srch_ptr)) { 4956 rsp->hdr.Status = STATUS_NO_SUCH_FILE; 4957 } else { 4958 dir_fp->dot_dotdot[0] = dir_fp->dot_dotdot[1] = 0; 4959 rsp->hdr.Status = STATUS_NO_MORE_FILES; 4960 } 4961 rsp->StructureSize = cpu_to_le16(9); 4962 rsp->OutputBufferOffset = cpu_to_le16(0); 4963 rsp->OutputBufferLength = cpu_to_le32(0); 4964 rsp->Buffer[0] = 0; 4965 rc = ksmbd_iov_pin_rsp(work, (void *)rsp, 4966 offsetof(struct smb2_query_directory_rsp, Buffer) 4967 + 1); 4968 if (rc) 4969 goto err_out; 4970 } else { 4971 no_buf_len: 4972 ((FILE_DIRECTORY_INFO *) 4973 ((char *)rsp->Buffer + d_info.last_entry_offset)) 4974 ->NextEntryOffset = 0; 4975 if (d_info.data_count >= d_info.last_entry_off_align) 4976 d_info.data_count -= d_info.last_entry_off_align; 4977 4978 rsp->StructureSize = cpu_to_le16(9); 4979 rsp->OutputBufferOffset = cpu_to_le16(72); 4980 rsp->OutputBufferLength = cpu_to_le32(d_info.data_count); 4981 rc = ksmbd_iov_pin_rsp(work, (void *)rsp, 4982 offsetof(struct smb2_query_directory_rsp, Buffer) + 4983 d_info.data_count); 4984 if (rc) 4985 goto err_out; 4986 } 4987 4988 mutex_unlock(&dir_fp->readdir_lock); 4989 kfree(srch_ptr); 4990 ksmbd_fd_put(work, dir_fp); 4991 ksmbd_revert_fsids(work); 4992 return 0; 4993 4994 err_out: 4995 pr_err("error while processing smb2 query dir rc = %d\n", rc); 4996 mutex_unlock(&dir_fp->readdir_lock); 4997 kfree(srch_ptr); 4998 4999 err_out2: 5000 if (rc == -EINVAL) 5001 rsp->hdr.Status = STATUS_INVALID_PARAMETER; 5002 else if (rc == -EACCES) 5003 rsp->hdr.Status = STATUS_ACCESS_DENIED; 5004 else if (rc == -ENOENT) 5005 rsp->hdr.Status = STATUS_NO_SUCH_FILE; 5006 else if (rc == -EBADF) 5007 rsp->hdr.Status = STATUS_FILE_CLOSED; 5008 else if (rc == -ENOMEM) 5009 rsp->hdr.Status = STATUS_NO_MEMORY; 5010 else if (rc == -EFAULT) 5011 rsp->hdr.Status = STATUS_INVALID_INFO_CLASS; 5012 else if (rc == -EIO) 5013 rsp->hdr.Status = STATUS_FILE_CORRUPT_ERROR; 5014 if (!rsp->hdr.Status) 5015 rsp->hdr.Status = STATUS_UNEXPECTED_IO_ERROR; 5016 5017 smb2_set_err_rsp(work); 5018 ksmbd_fd_put(work, dir_fp); 5019 ksmbd_revert_fsids(work); 5020 return rc; 5021 } 5022 5023 /** 5024 * buffer_check_err() - helper function to check buffer errors 5025 * @reqOutputBufferLength: max buffer length expected in command response 5026 * @rsp: query info response buffer contains output buffer length 5027 * @rsp_org: base response buffer pointer in case of chained response 5028 * 5029 * Return: 0 on success, otherwise error 5030 */ 5031 static int buffer_check_err(int reqOutputBufferLength, 5032 struct smb2_query_info_rsp *rsp, 5033 void *rsp_org) 5034 { 5035 if (reqOutputBufferLength < le32_to_cpu(rsp->OutputBufferLength)) { 5036 pr_err("Invalid Buffer Size Requested\n"); 5037 rsp->hdr.Status = STATUS_INFO_LENGTH_MISMATCH; 5038 *(__be32 *)rsp_org = cpu_to_be32(sizeof(struct smb2_hdr)); 5039 return -EINVAL; 5040 } 5041 return 0; 5042 } 5043 5044 static void get_standard_info_pipe(struct smb2_query_info_rsp *rsp, 5045 void *rsp_org) 5046 { 5047 struct smb2_file_standard_info *sinfo; 5048 5049 sinfo = (struct smb2_file_standard_info *)rsp->Buffer; 5050 5051 sinfo->AllocationSize = cpu_to_le64(4096); 5052 sinfo->EndOfFile = cpu_to_le64(0); 5053 sinfo->NumberOfLinks = cpu_to_le32(1); 5054 sinfo->DeletePending = 1; 5055 sinfo->Directory = 0; 5056 rsp->OutputBufferLength = 5057 cpu_to_le32(sizeof(struct smb2_file_standard_info)); 5058 } 5059 5060 static void get_internal_info_pipe(struct smb2_query_info_rsp *rsp, u64 num, 5061 void *rsp_org) 5062 { 5063 struct smb2_file_internal_info *file_info; 5064 5065 file_info = (struct smb2_file_internal_info *)rsp->Buffer; 5066 5067 /* any unique number */ 5068 file_info->IndexNumber = cpu_to_le64(num | (1ULL << 63)); 5069 rsp->OutputBufferLength = 5070 cpu_to_le32(sizeof(struct smb2_file_internal_info)); 5071 } 5072 5073 static int smb2_get_info_file_pipe(struct ksmbd_session *sess, 5074 struct smb2_query_info_req *req, 5075 struct smb2_query_info_rsp *rsp, 5076 void *rsp_org) 5077 { 5078 u64 id; 5079 int rc; 5080 5081 /* 5082 * Windows can sometime send query file info request on 5083 * pipe without opening it, checking error condition here 5084 */ 5085 id = req->VolatileFileId; 5086 5087 lockdep_assert_not_held(&sess->rpc_lock); 5088 5089 down_read(&sess->rpc_lock); 5090 if (!ksmbd_session_rpc_method(sess, id)) { 5091 up_read(&sess->rpc_lock); 5092 return -ENOENT; 5093 } 5094 up_read(&sess->rpc_lock); 5095 5096 ksmbd_debug(SMB, "FileInfoClass %u, FileId 0x%llx\n", 5097 req->FileInfoClass, req->VolatileFileId); 5098 5099 switch (req->FileInfoClass) { 5100 case FILE_STANDARD_INFORMATION: 5101 get_standard_info_pipe(rsp, rsp_org); 5102 rc = buffer_check_err(le32_to_cpu(req->OutputBufferLength), 5103 rsp, rsp_org); 5104 break; 5105 case FILE_INTERNAL_INFORMATION: 5106 get_internal_info_pipe(rsp, id, rsp_org); 5107 rc = buffer_check_err(le32_to_cpu(req->OutputBufferLength), 5108 rsp, rsp_org); 5109 break; 5110 default: 5111 ksmbd_debug(SMB, "smb2_info_file_pipe for %u not supported\n", 5112 req->FileInfoClass); 5113 rc = -EOPNOTSUPP; 5114 } 5115 return rc; 5116 } 5117 5118 /** 5119 * smb2_get_ea() - handler for smb2 get extended attribute command 5120 * @work: smb work containing query info command buffer 5121 * @fp: ksmbd_file pointer 5122 * @req: get extended attribute request 5123 * @rsp: response buffer pointer 5124 * @rsp_org: base response buffer pointer in case of chained response 5125 * 5126 * Return: 0 on success, otherwise error 5127 */ 5128 static int smb2_get_ea(struct ksmbd_work *work, struct ksmbd_file *fp, 5129 struct smb2_query_info_req *req, 5130 struct smb2_query_info_rsp *rsp, void *rsp_org) 5131 { 5132 struct smb2_ea_info *eainfo, *prev_eainfo; 5133 char *name, *ptr, *xattr_list = NULL, *buf; 5134 int rc, name_len, value_len, xattr_list_len, idx; 5135 ssize_t buf_free_len, alignment_bytes, next_offset, rsp_data_cnt = 0; 5136 struct smb2_ea_info_req *ea_req = NULL; 5137 const struct path *path; 5138 struct mnt_idmap *idmap = file_mnt_idmap(fp->filp); 5139 5140 if (!(fp->daccess & FILE_READ_EA_LE)) { 5141 pr_err("Not permitted to read ext attr : 0x%x\n", 5142 fp->daccess); 5143 return -EACCES; 5144 } 5145 5146 path = &fp->filp->f_path; 5147 /* single EA entry is requested with given user.* name */ 5148 if (req->InputBufferLength) { 5149 if (le32_to_cpu(req->InputBufferLength) <= 5150 sizeof(struct smb2_ea_info_req)) 5151 return -EINVAL; 5152 5153 ea_req = (struct smb2_ea_info_req *)((char *)req + 5154 le16_to_cpu(req->InputBufferOffset)); 5155 5156 if (le32_to_cpu(req->InputBufferLength) < 5157 offsetof(struct smb2_ea_info_req, name) + 5158 ea_req->EaNameLength) 5159 return -EINVAL; 5160 } else { 5161 /* need to send all EAs, if no specific EA is requested*/ 5162 if (le32_to_cpu(req->Flags) & SL_RETURN_SINGLE_ENTRY) 5163 ksmbd_debug(SMB, 5164 "All EAs are requested but need to send single EA entry in rsp flags 0x%x\n", 5165 le32_to_cpu(req->Flags)); 5166 } 5167 5168 buf_free_len = 5169 smb2_calc_max_out_buf_len(work, 5170 offsetof(struct smb2_query_info_rsp, Buffer), 5171 le32_to_cpu(req->OutputBufferLength)); 5172 if (buf_free_len < 0) 5173 return -EINVAL; 5174 5175 rc = ksmbd_vfs_listxattr(path->dentry, &xattr_list); 5176 if (rc < 0) { 5177 rsp->hdr.Status = STATUS_INVALID_HANDLE; 5178 goto out; 5179 } else if (!rc) { /* there is no EA in the file */ 5180 ksmbd_debug(SMB, "no ea data in the file\n"); 5181 goto done; 5182 } 5183 xattr_list_len = rc; 5184 5185 ptr = (char *)rsp->Buffer; 5186 eainfo = (struct smb2_ea_info *)ptr; 5187 prev_eainfo = eainfo; 5188 idx = 0; 5189 5190 while (idx < xattr_list_len) { 5191 name = xattr_list + idx; 5192 name_len = strlen(name); 5193 5194 ksmbd_debug(SMB, "%s, len %d\n", name, name_len); 5195 idx += name_len + 1; 5196 5197 /* 5198 * CIFS does not support EA other than user.* namespace, 5199 * still keep the framework generic, to list other attrs 5200 * in future. 5201 */ 5202 if (strncmp(name, XATTR_USER_PREFIX, XATTR_USER_PREFIX_LEN)) 5203 continue; 5204 5205 if (!strncmp(&name[XATTR_USER_PREFIX_LEN], STREAM_PREFIX, 5206 STREAM_PREFIX_LEN)) 5207 continue; 5208 5209 if (req->InputBufferLength && 5210 strncmp(&name[XATTR_USER_PREFIX_LEN], ea_req->name, 5211 ea_req->EaNameLength)) 5212 continue; 5213 5214 if (!strncmp(&name[XATTR_USER_PREFIX_LEN], 5215 DOS_ATTRIBUTE_PREFIX, DOS_ATTRIBUTE_PREFIX_LEN)) 5216 continue; 5217 5218 if (!strncmp(name, XATTR_USER_PREFIX, XATTR_USER_PREFIX_LEN)) 5219 name_len -= XATTR_USER_PREFIX_LEN; 5220 5221 ptr = eainfo->name + name_len + 1; 5222 buf_free_len -= (offsetof(struct smb2_ea_info, name) + 5223 name_len + 1); 5224 /* bailout if xattr can't fit in buf_free_len */ 5225 value_len = ksmbd_vfs_getxattr(idmap, path->dentry, 5226 name, &buf); 5227 if (value_len <= 0) { 5228 rc = -ENOENT; 5229 rsp->hdr.Status = STATUS_INVALID_HANDLE; 5230 goto out; 5231 } 5232 5233 buf_free_len -= value_len; 5234 if (buf_free_len < 0) { 5235 kfree(buf); 5236 break; 5237 } 5238 5239 memcpy(ptr, buf, value_len); 5240 kfree(buf); 5241 5242 ptr += value_len; 5243 eainfo->Flags = 0; 5244 eainfo->EaNameLength = name_len; 5245 5246 if (!strncmp(name, XATTR_USER_PREFIX, XATTR_USER_PREFIX_LEN)) 5247 memcpy(eainfo->name, &name[XATTR_USER_PREFIX_LEN], 5248 name_len); 5249 else 5250 memcpy(eainfo->name, name, name_len); 5251 5252 eainfo->name[name_len] = '\0'; 5253 eainfo->EaValueLength = cpu_to_le16(value_len); 5254 next_offset = offsetof(struct smb2_ea_info, name) + 5255 name_len + 1 + value_len; 5256 5257 /* align next xattr entry at 4 byte bundary */ 5258 alignment_bytes = ((next_offset + 3) & ~3) - next_offset; 5259 if (alignment_bytes) { 5260 if (buf_free_len < alignment_bytes) 5261 break; 5262 memset(ptr, '\0', alignment_bytes); 5263 ptr += alignment_bytes; 5264 next_offset += alignment_bytes; 5265 buf_free_len -= alignment_bytes; 5266 } 5267 eainfo->NextEntryOffset = cpu_to_le32(next_offset); 5268 prev_eainfo = eainfo; 5269 eainfo = (struct smb2_ea_info *)ptr; 5270 rsp_data_cnt += next_offset; 5271 5272 if (req->InputBufferLength) { 5273 ksmbd_debug(SMB, "single entry requested\n"); 5274 break; 5275 } 5276 } 5277 5278 /* no more ea entries */ 5279 prev_eainfo->NextEntryOffset = 0; 5280 done: 5281 rc = 0; 5282 if (rsp_data_cnt == 0) 5283 rsp->hdr.Status = STATUS_NO_EAS_ON_FILE; 5284 rsp->OutputBufferLength = cpu_to_le32(rsp_data_cnt); 5285 out: 5286 kvfree(xattr_list); 5287 return rc; 5288 } 5289 5290 static void get_file_access_info(struct smb2_query_info_rsp *rsp, 5291 struct ksmbd_file *fp, void *rsp_org) 5292 { 5293 struct smb2_file_access_info *file_info; 5294 5295 file_info = (struct smb2_file_access_info *)rsp->Buffer; 5296 file_info->AccessFlags = fp->daccess; 5297 rsp->OutputBufferLength = 5298 cpu_to_le32(sizeof(struct smb2_file_access_info)); 5299 } 5300 5301 static int get_file_basic_info(struct smb2_query_info_rsp *rsp, 5302 struct ksmbd_file *fp, void *rsp_org) 5303 { 5304 struct file_basic_info *basic_info; 5305 struct kstat stat; 5306 u64 time; 5307 int ret; 5308 5309 if (!(fp->daccess & FILE_READ_ATTRIBUTES_LE)) { 5310 pr_err("no right to read the attributes : 0x%x\n", 5311 fp->daccess); 5312 return -EACCES; 5313 } 5314 5315 ret = vfs_getattr(&fp->filp->f_path, &stat, STATX_BASIC_STATS, 5316 AT_STATX_SYNC_AS_STAT); 5317 if (ret) 5318 return ret; 5319 5320 basic_info = (struct file_basic_info *)rsp->Buffer; 5321 basic_info->CreationTime = cpu_to_le64(fp->create_time); 5322 time = ksmbd_UnixTimeToNT(stat.atime); 5323 basic_info->LastAccessTime = cpu_to_le64(time); 5324 time = ksmbd_UnixTimeToNT(stat.mtime); 5325 basic_info->LastWriteTime = cpu_to_le64(time); 5326 basic_info->ChangeTime = cpu_to_le64(fp->change_time); 5327 basic_info->Attributes = fp->f_ci->m_fattr; 5328 basic_info->Pad = 0; 5329 rsp->OutputBufferLength = 5330 cpu_to_le32(sizeof(struct file_basic_info)); 5331 return 0; 5332 } 5333 5334 static int get_file_standard_info(struct smb2_query_info_rsp *rsp, 5335 struct ksmbd_file *fp, void *rsp_org) 5336 { 5337 struct smb2_file_standard_info *sinfo; 5338 unsigned int delete_pending; 5339 struct kstat stat; 5340 int ret; 5341 5342 ret = vfs_getattr(&fp->filp->f_path, &stat, STATX_BASIC_STATS, 5343 AT_STATX_SYNC_AS_STAT); 5344 if (ret) 5345 return ret; 5346 5347 sinfo = (struct smb2_file_standard_info *)rsp->Buffer; 5348 delete_pending = ksmbd_inode_pending_delete(fp); 5349 5350 if (ksmbd_stream_fd(fp) == false) { 5351 sinfo->AllocationSize = cpu_to_le64(fp->allocation_size); 5352 sinfo->EndOfFile = S_ISDIR(stat.mode) ? 0 : cpu_to_le64(stat.size); 5353 } else { 5354 sinfo->AllocationSize = cpu_to_le64(fp->stream.size); 5355 sinfo->EndOfFile = cpu_to_le64(fp->stream.size); 5356 } 5357 sinfo->NumberOfLinks = cpu_to_le32(get_nlink(&stat) - delete_pending); 5358 sinfo->DeletePending = delete_pending; 5359 sinfo->Directory = S_ISDIR(stat.mode) ? 1 : 0; 5360 rsp->OutputBufferLength = 5361 cpu_to_le32(sizeof(struct smb2_file_standard_info)); 5362 5363 return 0; 5364 } 5365 5366 static void get_file_alignment_info(struct smb2_query_info_rsp *rsp, 5367 void *rsp_org) 5368 { 5369 struct smb2_file_alignment_info *file_info; 5370 5371 file_info = (struct smb2_file_alignment_info *)rsp->Buffer; 5372 file_info->AlignmentRequirement = 0; 5373 rsp->OutputBufferLength = 5374 cpu_to_le32(sizeof(struct smb2_file_alignment_info)); 5375 } 5376 5377 static int get_file_all_info(struct ksmbd_work *work, 5378 struct smb2_query_info_rsp *rsp, 5379 struct ksmbd_file *fp, 5380 void *rsp_org) 5381 { 5382 struct ksmbd_conn *conn = work->conn; 5383 struct smb2_file_all_info *file_info; 5384 unsigned int delete_pending; 5385 struct kstat stat; 5386 int conv_len; 5387 char *filename; 5388 u64 time; 5389 int ret, buf_free_len, filename_len; 5390 struct smb2_query_info_req *req = ksmbd_req_buf_next(work); 5391 5392 if (!(fp->daccess & FILE_READ_ATTRIBUTES_LE)) { 5393 ksmbd_debug(SMB, "no right to read the attributes : 0x%x\n", 5394 fp->daccess); 5395 return -EACCES; 5396 } 5397 5398 filename = convert_to_nt_pathname(work->tcon->share_conf, &fp->filp->f_path); 5399 if (IS_ERR(filename)) 5400 return PTR_ERR(filename); 5401 5402 filename_len = strlen(filename); 5403 buf_free_len = smb2_calc_max_out_buf_len(work, 5404 offsetof(struct smb2_query_info_rsp, Buffer) + 5405 offsetof(struct smb2_file_all_info, FileName), 5406 le32_to_cpu(req->OutputBufferLength)); 5407 if (buf_free_len < (filename_len + 1) * 2) { 5408 kfree(filename); 5409 return -EINVAL; 5410 } 5411 5412 ret = vfs_getattr(&fp->filp->f_path, &stat, STATX_BASIC_STATS, 5413 AT_STATX_SYNC_AS_STAT); 5414 if (ret) { 5415 kfree(filename); 5416 return ret; 5417 } 5418 5419 ksmbd_debug(SMB, "filename = %s\n", filename); 5420 delete_pending = ksmbd_inode_pending_delete(fp); 5421 file_info = (struct smb2_file_all_info *)rsp->Buffer; 5422 5423 file_info->CreationTime = cpu_to_le64(fp->create_time); 5424 time = ksmbd_UnixTimeToNT(stat.atime); 5425 file_info->LastAccessTime = cpu_to_le64(time); 5426 time = ksmbd_UnixTimeToNT(stat.mtime); 5427 file_info->LastWriteTime = cpu_to_le64(time); 5428 file_info->ChangeTime = cpu_to_le64(fp->change_time); 5429 file_info->Attributes = fp->f_ci->m_fattr; 5430 file_info->Pad1 = 0; 5431 if (ksmbd_stream_fd(fp) == false) { 5432 file_info->AllocationSize = cpu_to_le64(fp->allocation_size); 5433 file_info->EndOfFile = S_ISDIR(stat.mode) ? 0 : cpu_to_le64(stat.size); 5434 } else { 5435 file_info->AllocationSize = cpu_to_le64(fp->stream.size); 5436 file_info->EndOfFile = cpu_to_le64(fp->stream.size); 5437 } 5438 file_info->NumberOfLinks = 5439 cpu_to_le32(get_nlink(&stat) - delete_pending); 5440 file_info->DeletePending = delete_pending; 5441 file_info->Directory = S_ISDIR(stat.mode) ? 1 : 0; 5442 file_info->Pad2 = 0; 5443 file_info->IndexNumber = cpu_to_le64(stat.ino); 5444 file_info->EASize = 0; 5445 file_info->AccessFlags = fp->daccess; 5446 if (ksmbd_stream_fd(fp) == false) 5447 file_info->CurrentByteOffset = cpu_to_le64(fp->filp->f_pos); 5448 else 5449 file_info->CurrentByteOffset = cpu_to_le64(fp->stream.pos); 5450 file_info->Mode = fp->coption; 5451 file_info->AlignmentRequirement = 0; 5452 conv_len = smbConvertToUTF16((__le16 *)file_info->FileName, filename, 5453 min(filename_len, PATH_MAX), 5454 conn->local_nls, 0); 5455 conv_len *= 2; 5456 file_info->FileNameLength = cpu_to_le32(conv_len); 5457 rsp->OutputBufferLength = 5458 cpu_to_le32(sizeof(struct smb2_file_all_info) + conv_len - 1); 5459 kfree(filename); 5460 return 0; 5461 } 5462 5463 static void get_file_alternate_info(struct ksmbd_work *work, 5464 struct smb2_query_info_rsp *rsp, 5465 struct ksmbd_file *fp, 5466 void *rsp_org) 5467 { 5468 struct ksmbd_conn *conn = work->conn; 5469 struct smb2_file_alt_name_info *file_info; 5470 struct dentry *dentry = fp->filp->f_path.dentry; 5471 int conv_len; 5472 5473 spin_lock(&dentry->d_lock); 5474 file_info = (struct smb2_file_alt_name_info *)rsp->Buffer; 5475 conv_len = ksmbd_extract_shortname(conn, 5476 dentry->d_name.name, 5477 file_info->FileName); 5478 spin_unlock(&dentry->d_lock); 5479 file_info->FileNameLength = cpu_to_le32(conv_len); 5480 rsp->OutputBufferLength = 5481 cpu_to_le32(struct_size(file_info, FileName, conv_len)); 5482 } 5483 5484 static int get_file_stream_info(struct ksmbd_work *work, 5485 struct smb2_query_info_rsp *rsp, 5486 struct ksmbd_file *fp, 5487 void *rsp_org) 5488 { 5489 struct ksmbd_conn *conn = work->conn; 5490 struct smb2_file_stream_info *file_info; 5491 char *stream_name, *xattr_list = NULL, *stream_buf; 5492 struct kstat stat; 5493 const struct path *path = &fp->filp->f_path; 5494 ssize_t xattr_list_len; 5495 int nbytes = 0, streamlen, stream_name_len, next, idx = 0; 5496 int buf_free_len; 5497 struct smb2_query_info_req *req = ksmbd_req_buf_next(work); 5498 int ret; 5499 5500 ret = vfs_getattr(&fp->filp->f_path, &stat, STATX_BASIC_STATS, 5501 AT_STATX_SYNC_AS_STAT); 5502 if (ret) 5503 return ret; 5504 5505 file_info = (struct smb2_file_stream_info *)rsp->Buffer; 5506 5507 buf_free_len = 5508 smb2_calc_max_out_buf_len(work, 5509 offsetof(struct smb2_query_info_rsp, Buffer), 5510 le32_to_cpu(req->OutputBufferLength)); 5511 if (buf_free_len < 0) 5512 goto out; 5513 5514 xattr_list_len = ksmbd_vfs_listxattr(path->dentry, &xattr_list); 5515 if (xattr_list_len < 0) { 5516 goto out; 5517 } else if (!xattr_list_len) { 5518 ksmbd_debug(SMB, "empty xattr in the file\n"); 5519 goto out; 5520 } 5521 5522 while (idx < xattr_list_len) { 5523 stream_name = xattr_list + idx; 5524 streamlen = strlen(stream_name); 5525 idx += streamlen + 1; 5526 5527 ksmbd_debug(SMB, "%s, len %d\n", stream_name, streamlen); 5528 5529 if (strncmp(&stream_name[XATTR_USER_PREFIX_LEN], 5530 STREAM_PREFIX, STREAM_PREFIX_LEN)) 5531 continue; 5532 5533 stream_name_len = streamlen - (XATTR_USER_PREFIX_LEN + 5534 STREAM_PREFIX_LEN); 5535 streamlen = stream_name_len; 5536 5537 /* plus : size */ 5538 streamlen += 1; 5539 stream_buf = kmalloc(streamlen + 1, KSMBD_DEFAULT_GFP); 5540 if (!stream_buf) 5541 break; 5542 5543 streamlen = snprintf(stream_buf, streamlen + 1, 5544 ":%s", &stream_name[XATTR_NAME_STREAM_LEN]); 5545 5546 next = sizeof(struct smb2_file_stream_info) + streamlen * 2; 5547 if (next > buf_free_len) { 5548 kfree(stream_buf); 5549 break; 5550 } 5551 5552 file_info = (struct smb2_file_stream_info *)&rsp->Buffer[nbytes]; 5553 streamlen = smbConvertToUTF16((__le16 *)file_info->StreamName, 5554 stream_buf, streamlen, 5555 conn->local_nls, 0); 5556 streamlen *= 2; 5557 kfree(stream_buf); 5558 file_info->StreamNameLength = cpu_to_le32(streamlen); 5559 file_info->StreamSize = cpu_to_le64(stream_name_len); 5560 file_info->StreamAllocationSize = cpu_to_le64(stream_name_len); 5561 5562 nbytes += next; 5563 buf_free_len -= next; 5564 file_info->NextEntryOffset = cpu_to_le32(next); 5565 } 5566 5567 out: 5568 if (!S_ISDIR(stat.mode) && 5569 buf_free_len >= sizeof(struct smb2_file_stream_info) + 7 * 2) { 5570 file_info = (struct smb2_file_stream_info *) 5571 &rsp->Buffer[nbytes]; 5572 streamlen = smbConvertToUTF16((__le16 *)file_info->StreamName, 5573 "::$DATA", 7, conn->local_nls, 0); 5574 streamlen *= 2; 5575 file_info->StreamNameLength = cpu_to_le32(streamlen); 5576 file_info->StreamSize = cpu_to_le64(stat.size); 5577 file_info->StreamAllocationSize = cpu_to_le64(stat.blocks << 9); 5578 nbytes += sizeof(struct smb2_file_stream_info) + streamlen; 5579 } 5580 5581 /* last entry offset should be 0 */ 5582 file_info->NextEntryOffset = 0; 5583 kvfree(xattr_list); 5584 5585 rsp->OutputBufferLength = cpu_to_le32(nbytes); 5586 5587 return 0; 5588 } 5589 5590 static int get_file_internal_info(struct smb2_query_info_rsp *rsp, 5591 struct ksmbd_file *fp, void *rsp_org) 5592 { 5593 struct smb2_file_internal_info *file_info; 5594 struct kstat stat; 5595 int ret; 5596 5597 ret = vfs_getattr(&fp->filp->f_path, &stat, STATX_BASIC_STATS, 5598 AT_STATX_SYNC_AS_STAT); 5599 if (ret) 5600 return ret; 5601 5602 file_info = (struct smb2_file_internal_info *)rsp->Buffer; 5603 file_info->IndexNumber = cpu_to_le64(stat.ino); 5604 rsp->OutputBufferLength = 5605 cpu_to_le32(sizeof(struct smb2_file_internal_info)); 5606 5607 return 0; 5608 } 5609 5610 static int get_file_network_open_info(struct smb2_query_info_rsp *rsp, 5611 struct ksmbd_file *fp, void *rsp_org) 5612 { 5613 struct smb2_file_network_open_info *file_info; 5614 struct kstat stat; 5615 u64 time; 5616 int ret; 5617 5618 if (!(fp->daccess & FILE_READ_ATTRIBUTES_LE)) { 5619 pr_err("no right to read the attributes : 0x%x\n", 5620 fp->daccess); 5621 return -EACCES; 5622 } 5623 5624 ret = vfs_getattr(&fp->filp->f_path, &stat, STATX_BASIC_STATS, 5625 AT_STATX_SYNC_AS_STAT); 5626 if (ret) 5627 return ret; 5628 5629 file_info = (struct smb2_file_network_open_info *)rsp->Buffer; 5630 5631 file_info->CreationTime = cpu_to_le64(fp->create_time); 5632 time = ksmbd_UnixTimeToNT(stat.atime); 5633 file_info->LastAccessTime = cpu_to_le64(time); 5634 time = ksmbd_UnixTimeToNT(stat.mtime); 5635 file_info->LastWriteTime = cpu_to_le64(time); 5636 file_info->ChangeTime = cpu_to_le64(fp->change_time); 5637 file_info->Attributes = fp->f_ci->m_fattr; 5638 if (ksmbd_stream_fd(fp) == false) { 5639 file_info->AllocationSize = cpu_to_le64(fp->allocation_size); 5640 file_info->EndOfFile = S_ISDIR(stat.mode) ? 0 : cpu_to_le64(stat.size); 5641 } else { 5642 file_info->AllocationSize = cpu_to_le64(fp->stream.size); 5643 file_info->EndOfFile = cpu_to_le64(fp->stream.size); 5644 } 5645 file_info->Reserved = cpu_to_le32(0); 5646 rsp->OutputBufferLength = 5647 cpu_to_le32(sizeof(struct smb2_file_network_open_info)); 5648 return 0; 5649 } 5650 5651 static void get_file_ea_info(struct smb2_query_info_rsp *rsp, void *rsp_org) 5652 { 5653 struct smb2_file_ea_info *file_info; 5654 5655 file_info = (struct smb2_file_ea_info *)rsp->Buffer; 5656 file_info->EASize = 0; 5657 rsp->OutputBufferLength = 5658 cpu_to_le32(sizeof(struct smb2_file_ea_info)); 5659 } 5660 5661 static void get_file_position_info(struct smb2_query_info_rsp *rsp, 5662 struct ksmbd_file *fp, void *rsp_org) 5663 { 5664 struct smb2_file_pos_info *file_info; 5665 5666 file_info = (struct smb2_file_pos_info *)rsp->Buffer; 5667 if (ksmbd_stream_fd(fp) == false) 5668 file_info->CurrentByteOffset = cpu_to_le64(fp->filp->f_pos); 5669 else 5670 file_info->CurrentByteOffset = cpu_to_le64(fp->stream.pos); 5671 5672 rsp->OutputBufferLength = 5673 cpu_to_le32(sizeof(struct smb2_file_pos_info)); 5674 } 5675 5676 static void get_file_mode_info(struct smb2_query_info_rsp *rsp, 5677 struct ksmbd_file *fp, void *rsp_org) 5678 { 5679 struct smb2_file_mode_info *file_info; 5680 5681 file_info = (struct smb2_file_mode_info *)rsp->Buffer; 5682 file_info->Mode = fp->coption & FILE_MODE_INFO_MASK; 5683 rsp->OutputBufferLength = 5684 cpu_to_le32(sizeof(struct smb2_file_mode_info)); 5685 } 5686 5687 static int get_file_compression_info(struct smb2_query_info_rsp *rsp, 5688 struct ksmbd_file *fp, void *rsp_org) 5689 { 5690 struct smb2_file_comp_info *file_info; 5691 struct kstat stat; 5692 u16 fmt; 5693 int ret; 5694 5695 ret = vfs_getattr(&fp->filp->f_path, &stat, STATX_BASIC_STATS, 5696 AT_STATX_SYNC_AS_STAT); 5697 if (ret) 5698 return ret; 5699 5700 ret = ksmbd_vfs_get_compression(fp, &fmt); 5701 if (ret) 5702 return ret; 5703 5704 file_info = (struct smb2_file_comp_info *)rsp->Buffer; 5705 file_info->CompressedFileSize = cpu_to_le64(min_t(u64, stat.blocks << 9, stat.size)); 5706 file_info->CompressionFormat = cpu_to_le16(fmt); 5707 file_info->CompressionUnitShift = 0; 5708 file_info->ChunkShift = 0; 5709 file_info->ClusterShift = 0; 5710 memset(&file_info->Reserved[0], 0, 3); 5711 5712 rsp->OutputBufferLength = 5713 cpu_to_le32(sizeof(struct smb2_file_comp_info)); 5714 5715 return 0; 5716 } 5717 5718 static int get_file_attribute_tag_info(struct smb2_query_info_rsp *rsp, 5719 struct ksmbd_file *fp, void *rsp_org) 5720 { 5721 struct smb2_file_attr_tag_info *file_info; 5722 5723 if (!(fp->daccess & FILE_READ_ATTRIBUTES_LE)) { 5724 pr_err("no right to read the attributes : 0x%x\n", 5725 fp->daccess); 5726 return -EACCES; 5727 } 5728 5729 file_info = (struct smb2_file_attr_tag_info *)rsp->Buffer; 5730 file_info->FileAttributes = fp->f_ci->m_fattr; 5731 file_info->ReparseTag = 0; 5732 rsp->OutputBufferLength = 5733 cpu_to_le32(sizeof(struct smb2_file_attr_tag_info)); 5734 return 0; 5735 } 5736 5737 static int find_file_posix_info(struct smb2_query_info_rsp *rsp, 5738 struct ksmbd_file *fp, void *rsp_org) 5739 { 5740 struct smb311_posix_qinfo *file_info; 5741 struct inode *inode = file_inode(fp->filp); 5742 struct mnt_idmap *idmap = file_mnt_idmap(fp->filp); 5743 vfsuid_t vfsuid = i_uid_into_vfsuid(idmap, inode); 5744 vfsgid_t vfsgid = i_gid_into_vfsgid(idmap, inode); 5745 struct kstat stat; 5746 u64 time; 5747 int out_buf_len = sizeof(struct smb311_posix_qinfo) + 32; 5748 int ret; 5749 5750 if (!(fp->daccess & FILE_READ_ATTRIBUTES_LE)) { 5751 pr_err("no right to read the attributes : 0x%x\n", 5752 fp->daccess); 5753 return -EACCES; 5754 } 5755 5756 ret = vfs_getattr(&fp->filp->f_path, &stat, STATX_BASIC_STATS, 5757 AT_STATX_SYNC_AS_STAT); 5758 if (ret) 5759 return ret; 5760 5761 file_info = (struct smb311_posix_qinfo *)rsp->Buffer; 5762 file_info->CreationTime = cpu_to_le64(fp->create_time); 5763 time = ksmbd_UnixTimeToNT(stat.atime); 5764 file_info->LastAccessTime = cpu_to_le64(time); 5765 time = ksmbd_UnixTimeToNT(stat.mtime); 5766 file_info->LastWriteTime = cpu_to_le64(time); 5767 file_info->ChangeTime = cpu_to_le64(fp->change_time); 5768 file_info->DosAttributes = fp->f_ci->m_fattr; 5769 file_info->Inode = cpu_to_le64(stat.ino); 5770 if (ksmbd_stream_fd(fp) == false) { 5771 file_info->EndOfFile = cpu_to_le64(stat.size); 5772 file_info->AllocationSize = cpu_to_le64(fp->allocation_size); 5773 } else { 5774 file_info->EndOfFile = cpu_to_le64(fp->stream.size); 5775 file_info->AllocationSize = cpu_to_le64(fp->stream.size); 5776 } 5777 file_info->HardLinks = cpu_to_le32(stat.nlink); 5778 file_info->Mode = cpu_to_le32(stat.mode & 0777); 5779 switch (stat.mode & S_IFMT) { 5780 case S_IFDIR: 5781 file_info->Mode |= cpu_to_le32(POSIX_TYPE_DIR << POSIX_FILETYPE_SHIFT); 5782 break; 5783 case S_IFLNK: 5784 file_info->Mode |= cpu_to_le32(POSIX_TYPE_SYMLINK << POSIX_FILETYPE_SHIFT); 5785 break; 5786 case S_IFCHR: 5787 file_info->Mode |= cpu_to_le32(POSIX_TYPE_CHARDEV << POSIX_FILETYPE_SHIFT); 5788 break; 5789 case S_IFBLK: 5790 file_info->Mode |= cpu_to_le32(POSIX_TYPE_BLKDEV << POSIX_FILETYPE_SHIFT); 5791 break; 5792 case S_IFIFO: 5793 file_info->Mode |= cpu_to_le32(POSIX_TYPE_FIFO << POSIX_FILETYPE_SHIFT); 5794 break; 5795 case S_IFSOCK: 5796 file_info->Mode |= cpu_to_le32(POSIX_TYPE_SOCKET << POSIX_FILETYPE_SHIFT); 5797 } 5798 5799 file_info->DeviceId = cpu_to_le32(stat.rdev); 5800 5801 /* 5802 * Sids(32) contain two sids(Domain sid(16), UNIX group sid(16)). 5803 * UNIX sid(16) = revision(1) + num_subauth(1) + authority(6) + 5804 * sub_auth(4 * 1(num_subauth)) + RID(4). 5805 */ 5806 id_to_sid(from_kuid_munged(&init_user_ns, vfsuid_into_kuid(vfsuid)), 5807 SIDUNIX_USER, (struct smb_sid *)&file_info->Sids[0]); 5808 id_to_sid(from_kgid_munged(&init_user_ns, vfsgid_into_kgid(vfsgid)), 5809 SIDUNIX_GROUP, (struct smb_sid *)&file_info->Sids[16]); 5810 5811 rsp->OutputBufferLength = cpu_to_le32(out_buf_len); 5812 5813 return 0; 5814 } 5815 5816 static int smb2_get_info_file(struct ksmbd_work *work, 5817 struct smb2_query_info_req *req, 5818 struct smb2_query_info_rsp *rsp) 5819 { 5820 struct ksmbd_file *fp; 5821 int fileinfoclass = 0; 5822 int rc = 0; 5823 unsigned int id = KSMBD_NO_FID, pid = KSMBD_NO_FID; 5824 5825 if (test_share_config_flag(work->tcon->share_conf, 5826 KSMBD_SHARE_FLAG_PIPE)) { 5827 /* smb2 info file called for pipe */ 5828 rc = smb2_get_info_file_pipe(work->sess, req, rsp, 5829 work->response_buf); 5830 goto iov_pin_out; 5831 } 5832 5833 if (work->next_smb2_rcv_hdr_off) { 5834 if (!has_file_id(req->VolatileFileId)) { 5835 ksmbd_debug(SMB, "Compound request set FID = %llu\n", 5836 work->compound_fid); 5837 id = work->compound_fid; 5838 pid = work->compound_pfid; 5839 } 5840 } 5841 5842 if (!has_file_id(id)) { 5843 id = req->VolatileFileId; 5844 pid = req->PersistentFileId; 5845 } 5846 5847 fp = ksmbd_lookup_fd_slow(work, id, pid); 5848 if (!fp) 5849 return -ENOENT; 5850 5851 fileinfoclass = req->FileInfoClass; 5852 5853 switch (fileinfoclass) { 5854 case FILE_ACCESS_INFORMATION: 5855 get_file_access_info(rsp, fp, work->response_buf); 5856 break; 5857 5858 case FILE_BASIC_INFORMATION: 5859 rc = get_file_basic_info(rsp, fp, work->response_buf); 5860 break; 5861 5862 case FILE_STANDARD_INFORMATION: 5863 rc = get_file_standard_info(rsp, fp, work->response_buf); 5864 break; 5865 5866 case FILE_ALIGNMENT_INFORMATION: 5867 get_file_alignment_info(rsp, work->response_buf); 5868 break; 5869 5870 case FILE_ALL_INFORMATION: 5871 rc = get_file_all_info(work, rsp, fp, work->response_buf); 5872 break; 5873 5874 case FILE_ALTERNATE_NAME_INFORMATION: 5875 get_file_alternate_info(work, rsp, fp, work->response_buf); 5876 break; 5877 5878 case FILE_STREAM_INFORMATION: 5879 rc = get_file_stream_info(work, rsp, fp, work->response_buf); 5880 break; 5881 5882 case FILE_INTERNAL_INFORMATION: 5883 rc = get_file_internal_info(rsp, fp, work->response_buf); 5884 break; 5885 5886 case FILE_NETWORK_OPEN_INFORMATION: 5887 rc = get_file_network_open_info(rsp, fp, work->response_buf); 5888 break; 5889 5890 case FILE_EA_INFORMATION: 5891 get_file_ea_info(rsp, work->response_buf); 5892 break; 5893 5894 case FILE_FULL_EA_INFORMATION: 5895 rc = smb2_get_ea(work, fp, req, rsp, work->response_buf); 5896 break; 5897 5898 case FILE_POSITION_INFORMATION: 5899 get_file_position_info(rsp, fp, work->response_buf); 5900 break; 5901 5902 case FILE_MODE_INFORMATION: 5903 get_file_mode_info(rsp, fp, work->response_buf); 5904 break; 5905 5906 case FILE_COMPRESSION_INFORMATION: 5907 rc = get_file_compression_info(rsp, fp, work->response_buf); 5908 break; 5909 5910 case FILE_ATTRIBUTE_TAG_INFORMATION: 5911 rc = get_file_attribute_tag_info(rsp, fp, work->response_buf); 5912 break; 5913 case SMB_FIND_FILE_POSIX_INFO: 5914 if (!work->tcon->posix_extensions) { 5915 pr_err("client doesn't negotiate with SMB3.1.1 POSIX Extensions\n"); 5916 rc = -EOPNOTSUPP; 5917 } else { 5918 rc = find_file_posix_info(rsp, fp, work->response_buf); 5919 } 5920 break; 5921 default: 5922 ksmbd_debug(SMB, "fileinfoclass %d not supported yet\n", 5923 fileinfoclass); 5924 rc = -EOPNOTSUPP; 5925 } 5926 if (!rc) 5927 rc = buffer_check_err(le32_to_cpu(req->OutputBufferLength), 5928 rsp, work->response_buf); 5929 ksmbd_fd_put(work, fp); 5930 5931 iov_pin_out: 5932 if (!rc) 5933 rc = ksmbd_iov_pin_rsp(work, (void *)rsp, 5934 offsetof(struct smb2_query_info_rsp, Buffer) + 5935 le32_to_cpu(rsp->OutputBufferLength)); 5936 return rc; 5937 } 5938 5939 static int smb2_get_info_filesystem(struct ksmbd_work *work, 5940 struct smb2_query_info_req *req, 5941 struct smb2_query_info_rsp *rsp) 5942 { 5943 struct ksmbd_conn *conn = work->conn; 5944 struct ksmbd_share_config *share = work->tcon->share_conf; 5945 int fsinfoclass = 0; 5946 struct kstatfs stfs; 5947 struct path path; 5948 int rc = 0, len; 5949 5950 if (!share->path) 5951 return -EIO; 5952 5953 scoped_with_init_fs() 5954 rc = kern_path(share->path, LOOKUP_NO_SYMLINKS, &path); 5955 if (rc) { 5956 pr_err("cannot create vfs path\n"); 5957 return -EIO; 5958 } 5959 5960 rc = vfs_statfs(&path, &stfs); 5961 if (rc) { 5962 pr_err("cannot do stat of path %s\n", share->path); 5963 path_put(&path); 5964 return -EIO; 5965 } 5966 5967 fsinfoclass = req->FileInfoClass; 5968 5969 switch (fsinfoclass) { 5970 case FS_DEVICE_INFORMATION: 5971 { 5972 FILE_SYSTEM_DEVICE_INFO *info; 5973 5974 info = (FILE_SYSTEM_DEVICE_INFO *)rsp->Buffer; 5975 5976 info->DeviceType = cpu_to_le32(FILE_DEVICE_DISK); 5977 info->DeviceCharacteristics = 5978 cpu_to_le32(FILE_DEVICE_IS_MOUNTED); 5979 if (!test_tree_conn_flag(work->tcon, 5980 KSMBD_TREE_CONN_FLAG_WRITABLE)) 5981 info->DeviceCharacteristics |= 5982 cpu_to_le32(FILE_READ_ONLY_DEVICE); 5983 rsp->OutputBufferLength = cpu_to_le32(8); 5984 break; 5985 } 5986 case FS_ATTRIBUTE_INFORMATION: 5987 { 5988 FILE_SYSTEM_ATTRIBUTE_INFO *info; 5989 struct file_kattr fa = {}; 5990 size_t sz; 5991 u32 attrs; 5992 int err; 5993 5994 info = (FILE_SYSTEM_ATTRIBUTE_INFO *)rsp->Buffer; 5995 attrs = FILE_SUPPORTS_OBJECT_IDS | 5996 FILE_PERSISTENT_ACLS | 5997 FILE_UNICODE_ON_DISK | 5998 FILE_SUPPORTS_BLOCK_REFCOUNTING; 5999 6000 err = vfs_fileattr_get(path.dentry, &fa); 6001 /* 6002 * -EINVAL, -EOPNOTSUPP: ntfs-3g and other FUSE 6003 * filesystems that lack FS_IOC_FSGETXATTR support. 6004 */ 6005 if (err && err != -ENOIOCTLCMD && err != -ENOTTY && 6006 err != -EINVAL && err != -EOPNOTSUPP) { 6007 path_put(&path); 6008 return err; 6009 } 6010 if (!(fa.fsx_xflags & FS_XFLAG_CASEFOLD)) 6011 attrs |= FILE_CASE_SENSITIVE_SEARCH; 6012 if (!(fa.fsx_xflags & FS_XFLAG_CASENONPRESERVING)) 6013 attrs |= FILE_CASE_PRESERVED_NAMES; 6014 6015 info->Attributes = cpu_to_le32(attrs); 6016 info->Attributes |= cpu_to_le32(server_conf.share_fake_fscaps); 6017 6018 if (test_share_config_flag(work->tcon->share_conf, 6019 KSMBD_SHARE_FLAG_STREAMS)) 6020 info->Attributes |= cpu_to_le32(FILE_NAMED_STREAMS); 6021 6022 info->MaxPathNameComponentLength = cpu_to_le32(stfs.f_namelen); 6023 /* 6024 * some application(potableapp) can not run on ksmbd share 6025 * because only NTFS handle security setting on windows. 6026 * So Although local fs(EXT4 or F2fs, etc) is not NTFS, 6027 * ksmbd should show share as NTFS. Later, If needed, we can add 6028 * fs type(s) parameter to change fs type user wanted. 6029 */ 6030 len = smbConvertToUTF16((__le16 *)info->FileSystemName, 6031 "NTFS", PATH_MAX, conn->local_nls, 0); 6032 len = len * 2; 6033 info->FileSystemNameLen = cpu_to_le32(len); 6034 sz = sizeof(FILE_SYSTEM_ATTRIBUTE_INFO) + len; 6035 rsp->OutputBufferLength = cpu_to_le32(sz); 6036 break; 6037 } 6038 case FS_VOLUME_INFORMATION: 6039 { 6040 struct filesystem_vol_info *info; 6041 size_t sz; 6042 unsigned int serial_crc = 0; 6043 6044 info = (struct filesystem_vol_info *)(rsp->Buffer); 6045 info->VolumeCreationTime = 0; 6046 serial_crc = crc32_le(serial_crc, share->name, 6047 strlen(share->name)); 6048 serial_crc = crc32_le(serial_crc, share->path, 6049 strlen(share->path)); 6050 serial_crc = crc32_le(serial_crc, ksmbd_netbios_name(), 6051 strlen(ksmbd_netbios_name())); 6052 /* Taking dummy value of serial number*/ 6053 info->VolumeSerialNumber = cpu_to_le32(serial_crc); 6054 len = smbConvertToUTF16((__le16 *)info->VolumeLabel, 6055 share->name, PATH_MAX, 6056 conn->local_nls, 0); 6057 len = len * 2; 6058 info->VolumeLabelLength = cpu_to_le32(len); 6059 info->Reserved = 0; 6060 info->SupportsObjects = 0; 6061 sz = sizeof(struct filesystem_vol_info) + len; 6062 rsp->OutputBufferLength = cpu_to_le32(sz); 6063 break; 6064 } 6065 case FS_SIZE_INFORMATION: 6066 { 6067 FILE_SYSTEM_SIZE_INFO *info; 6068 6069 info = (FILE_SYSTEM_SIZE_INFO *)(rsp->Buffer); 6070 info->TotalAllocationUnits = cpu_to_le64(stfs.f_blocks); 6071 info->AvailableAllocationUnits = cpu_to_le64(stfs.f_bfree); 6072 info->SectorsPerAllocationUnit = cpu_to_le32(1); 6073 info->BytesPerSector = cpu_to_le32(stfs.f_bsize); 6074 rsp->OutputBufferLength = cpu_to_le32(24); 6075 break; 6076 } 6077 case FS_FULL_SIZE_INFORMATION: 6078 { 6079 struct smb2_fs_full_size_info *info; 6080 6081 info = (struct smb2_fs_full_size_info *)(rsp->Buffer); 6082 info->TotalAllocationUnits = cpu_to_le64(stfs.f_blocks); 6083 info->CallerAvailableAllocationUnits = 6084 cpu_to_le64(stfs.f_bavail); 6085 info->ActualAvailableAllocationUnits = 6086 cpu_to_le64(stfs.f_bfree); 6087 info->SectorsPerAllocationUnit = cpu_to_le32(1); 6088 info->BytesPerSector = cpu_to_le32(stfs.f_bsize); 6089 rsp->OutputBufferLength = cpu_to_le32(32); 6090 break; 6091 } 6092 case FS_OBJECT_ID_INFORMATION: 6093 { 6094 struct object_id_info *info; 6095 6096 info = (struct object_id_info *)(rsp->Buffer); 6097 6098 if (path.mnt->mnt_sb->s_uuid_len == 16) 6099 memcpy(info->objid, path.mnt->mnt_sb->s_uuid.b, 6100 path.mnt->mnt_sb->s_uuid_len); 6101 else 6102 memcpy(info->objid, &stfs.f_fsid, sizeof(stfs.f_fsid)); 6103 6104 info->extended_info.magic = cpu_to_le32(EXTENDED_INFO_MAGIC); 6105 info->extended_info.version = cpu_to_le32(1); 6106 info->extended_info.release = cpu_to_le32(1); 6107 info->extended_info.rel_date = 0; 6108 memcpy(info->extended_info.version_string, "1.1.0", strlen("1.1.0")); 6109 rsp->OutputBufferLength = cpu_to_le32(64); 6110 break; 6111 } 6112 case FS_SECTOR_SIZE_INFORMATION: 6113 { 6114 struct smb3_fs_ss_info *info; 6115 unsigned int sector_size = 6116 min_t(unsigned int, path.mnt->mnt_sb->s_blocksize, 4096); 6117 6118 info = (struct smb3_fs_ss_info *)(rsp->Buffer); 6119 6120 info->LogicalBytesPerSector = cpu_to_le32(sector_size); 6121 info->PhysicalBytesPerSectorForAtomicity = 6122 cpu_to_le32(sector_size); 6123 info->PhysicalBytesPerSectorForPerf = cpu_to_le32(sector_size); 6124 info->FSEffPhysicalBytesPerSectorForAtomicity = 6125 cpu_to_le32(sector_size); 6126 info->Flags = cpu_to_le32(SSINFO_FLAGS_ALIGNED_DEVICE | 6127 SSINFO_FLAGS_PARTITION_ALIGNED_ON_DEVICE); 6128 info->ByteOffsetForSectorAlignment = 0; 6129 info->ByteOffsetForPartitionAlignment = 0; 6130 rsp->OutputBufferLength = cpu_to_le32(28); 6131 break; 6132 } 6133 case FS_CONTROL_INFORMATION: 6134 { 6135 /* 6136 * TODO : The current implementation is based on 6137 * test result with win7(NTFS) server. It's need to 6138 * modify this to get valid Quota values 6139 * from Linux kernel 6140 */ 6141 struct smb2_fs_control_info *info; 6142 6143 info = (struct smb2_fs_control_info *)(rsp->Buffer); 6144 info->FreeSpaceStartFiltering = 0; 6145 info->FreeSpaceThreshold = 0; 6146 info->FreeSpaceStopFiltering = 0; 6147 info->DefaultQuotaThreshold = cpu_to_le64(SMB2_NO_FID); 6148 info->DefaultQuotaLimit = cpu_to_le64(SMB2_NO_FID); 6149 info->Padding = 0; 6150 rsp->OutputBufferLength = cpu_to_le32(48); 6151 break; 6152 } 6153 case FS_POSIX_INFORMATION: 6154 { 6155 FILE_SYSTEM_POSIX_INFO *info; 6156 6157 if (!work->tcon->posix_extensions) { 6158 pr_err("client doesn't negotiate with SMB3.1.1 POSIX Extensions\n"); 6159 path_put(&path); 6160 return -EOPNOTSUPP; 6161 } else { 6162 info = (FILE_SYSTEM_POSIX_INFO *)(rsp->Buffer); 6163 info->OptimalTransferSize = cpu_to_le32(stfs.f_bsize); 6164 info->BlockSize = cpu_to_le32(stfs.f_bsize); 6165 info->TotalBlocks = cpu_to_le64(stfs.f_blocks); 6166 info->BlocksAvail = cpu_to_le64(stfs.f_bfree); 6167 info->UserBlocksAvail = cpu_to_le64(stfs.f_bavail); 6168 info->TotalFileNodes = cpu_to_le64(stfs.f_files); 6169 info->FreeFileNodes = cpu_to_le64(stfs.f_ffree); 6170 rsp->OutputBufferLength = cpu_to_le32(56); 6171 } 6172 break; 6173 } 6174 default: 6175 path_put(&path); 6176 return -EOPNOTSUPP; 6177 } 6178 rc = buffer_check_err(le32_to_cpu(req->OutputBufferLength), 6179 rsp, work->response_buf); 6180 path_put(&path); 6181 6182 if (!rc) 6183 rc = ksmbd_iov_pin_rsp(work, (void *)rsp, 6184 offsetof(struct smb2_query_info_rsp, Buffer) + 6185 le32_to_cpu(rsp->OutputBufferLength)); 6186 return rc; 6187 } 6188 6189 static int smb2_get_info_sec(struct ksmbd_work *work, 6190 struct smb2_query_info_req *req, 6191 struct smb2_query_info_rsp *rsp) 6192 { 6193 struct ksmbd_file *fp; 6194 struct mnt_idmap *idmap; 6195 struct smb_ntsd *pntsd = NULL, *ppntsd = NULL; 6196 struct smb_fattr fattr = {{0}}; 6197 struct inode *inode; 6198 __u32 secdesclen = 0; 6199 unsigned int id = KSMBD_NO_FID, pid = KSMBD_NO_FID; 6200 int addition_info = le32_to_cpu(req->AdditionalInformation); 6201 int rc = 0, ppntsd_size = 0, max_len; 6202 size_t scratch_len = 0; 6203 6204 if (addition_info & ~(OWNER_SECINFO | GROUP_SECINFO | DACL_SECINFO | 6205 PROTECTED_DACL_SECINFO | 6206 UNPROTECTED_DACL_SECINFO)) { 6207 ksmbd_debug(SMB, "Unsupported addition info: 0x%x)\n", 6208 addition_info); 6209 6210 rsp->hdr.Status = STATUS_NOT_SUPPORTED; 6211 return -EINVAL; 6212 } 6213 6214 if (work->next_smb2_rcv_hdr_off) { 6215 if (!has_file_id(req->VolatileFileId)) { 6216 ksmbd_debug(SMB, "Compound request set FID = %llu\n", 6217 work->compound_fid); 6218 id = work->compound_fid; 6219 pid = work->compound_pfid; 6220 } 6221 } 6222 6223 if (!has_file_id(id)) { 6224 id = req->VolatileFileId; 6225 pid = req->PersistentFileId; 6226 } 6227 6228 fp = ksmbd_lookup_fd_slow(work, id, pid); 6229 if (!fp) 6230 return -ENOENT; 6231 6232 idmap = file_mnt_idmap(fp->filp); 6233 inode = file_inode(fp->filp); 6234 ksmbd_acls_fattr(&fattr, idmap, inode); 6235 6236 if (test_share_config_flag(work->tcon->share_conf, 6237 KSMBD_SHARE_FLAG_ACL_XATTR)) 6238 ppntsd_size = ksmbd_vfs_get_sd_xattr(work->conn, idmap, 6239 fp->filp->f_path.dentry, 6240 &ppntsd); 6241 6242 /* Check if sd buffer size exceeds response buffer size */ 6243 max_len = smb2_calc_max_out_buf_len(work, 6244 offsetof(struct smb2_query_info_rsp, Buffer), 6245 le32_to_cpu(req->OutputBufferLength)); 6246 if (max_len < 0) { 6247 rc = -EINVAL; 6248 goto release_acl; 6249 } 6250 6251 scratch_len = smb_acl_sec_desc_scratch_len(&fattr, ppntsd, 6252 ppntsd_size, addition_info); 6253 if (!scratch_len || scratch_len == SIZE_MAX) { 6254 rc = -EFBIG; 6255 goto release_acl; 6256 } 6257 6258 pntsd = kvzalloc(scratch_len, KSMBD_DEFAULT_GFP); 6259 if (!pntsd) { 6260 rc = -ENOMEM; 6261 goto release_acl; 6262 } 6263 6264 rc = build_sec_desc(idmap, pntsd, ppntsd, ppntsd_size, 6265 addition_info, &secdesclen, &fattr); 6266 6267 release_acl: 6268 posix_acl_release(fattr.cf_acls); 6269 posix_acl_release(fattr.cf_dacls); 6270 kfree(ppntsd); 6271 ksmbd_fd_put(work, fp); 6272 6273 if (!rc && ALIGN(secdesclen, 8) > scratch_len) 6274 rc = -EFBIG; 6275 if (rc) 6276 goto err_out; 6277 6278 rsp->OutputBufferLength = cpu_to_le32(secdesclen); 6279 rc = buffer_check_err(le32_to_cpu(req->OutputBufferLength), 6280 rsp, work->response_buf); 6281 if (rc) 6282 goto err_out; 6283 6284 rc = ksmbd_iov_pin_rsp_read(work, (void *)rsp, 6285 offsetof(struct smb2_query_info_rsp, Buffer), 6286 pntsd, secdesclen); 6287 err_out: 6288 if (rc) { 6289 rsp->OutputBufferLength = 0; 6290 kvfree(pntsd); 6291 } 6292 6293 return rc; 6294 } 6295 6296 /** 6297 * smb2_query_info() - handler for smb2 query info command 6298 * @work: smb work containing query info request buffer 6299 * 6300 * Return: 0 on success, otherwise error 6301 */ 6302 int smb2_query_info(struct ksmbd_work *work) 6303 { 6304 struct smb2_query_info_req *req; 6305 struct smb2_query_info_rsp *rsp; 6306 int rc = 0; 6307 6308 ksmbd_debug(SMB, "Received request smb2 query info request\n"); 6309 6310 WORK_BUFFERS(work, req, rsp); 6311 6312 if (smb2_compound_has_failed(work, &rsp->hdr)) 6313 return -EACCES; 6314 6315 if (ksmbd_override_fsids(work)) { 6316 rc = -ENOMEM; 6317 goto err_out; 6318 } 6319 6320 rsp->StructureSize = cpu_to_le16(9); 6321 rsp->OutputBufferOffset = cpu_to_le16(72); 6322 6323 switch (req->InfoType) { 6324 case SMB2_O_INFO_FILE: 6325 ksmbd_debug(SMB, "GOT SMB2_O_INFO_FILE\n"); 6326 rc = smb2_get_info_file(work, req, rsp); 6327 break; 6328 case SMB2_O_INFO_FILESYSTEM: 6329 ksmbd_debug(SMB, "GOT SMB2_O_INFO_FILESYSTEM\n"); 6330 rc = smb2_get_info_filesystem(work, req, rsp); 6331 break; 6332 case SMB2_O_INFO_SECURITY: 6333 ksmbd_debug(SMB, "GOT SMB2_O_INFO_SECURITY\n"); 6334 rc = smb2_get_info_sec(work, req, rsp); 6335 break; 6336 default: 6337 ksmbd_debug(SMB, "InfoType %d not supported yet\n", 6338 req->InfoType); 6339 rc = -EOPNOTSUPP; 6340 } 6341 ksmbd_revert_fsids(work); 6342 6343 err_out: 6344 if (rc < 0) { 6345 if (rc == -EACCES) 6346 rsp->hdr.Status = STATUS_ACCESS_DENIED; 6347 else if (rc == -ENOENT) 6348 rsp->hdr.Status = STATUS_FILE_CLOSED; 6349 else if (rc == -EIO) 6350 rsp->hdr.Status = STATUS_UNEXPECTED_IO_ERROR; 6351 else if (rc == -ENOMEM) 6352 rsp->hdr.Status = STATUS_INSUFFICIENT_RESOURCES; 6353 else if (rc == -EINVAL && rsp->hdr.Status == 0) 6354 rsp->hdr.Status = STATUS_INVALID_PARAMETER; 6355 else if (rc == -EOPNOTSUPP || rsp->hdr.Status == 0) 6356 rsp->hdr.Status = STATUS_INVALID_INFO_CLASS; 6357 smb2_set_err_rsp(work); 6358 6359 ksmbd_debug(SMB, "error while processing smb2 query rc = %d\n", 6360 rc); 6361 return rc; 6362 } 6363 return 0; 6364 } 6365 6366 /** 6367 * smb2_close_pipe() - handler for closing IPC pipe 6368 * @work: smb work containing close request buffer 6369 * 6370 * Return: 0 6371 */ 6372 static noinline int smb2_close_pipe(struct ksmbd_work *work) 6373 { 6374 u64 id; 6375 struct smb2_close_req *req; 6376 struct smb2_close_rsp *rsp; 6377 6378 WORK_BUFFERS(work, req, rsp); 6379 6380 id = req->VolatileFileId; 6381 ksmbd_session_rpc_close(work->sess, id); 6382 6383 rsp->StructureSize = cpu_to_le16(60); 6384 rsp->Flags = 0; 6385 rsp->Reserved = 0; 6386 rsp->CreationTime = 0; 6387 rsp->LastAccessTime = 0; 6388 rsp->LastWriteTime = 0; 6389 rsp->ChangeTime = 0; 6390 rsp->AllocationSize = 0; 6391 rsp->EndOfFile = 0; 6392 rsp->Attributes = 0; 6393 6394 return ksmbd_iov_pin_rsp(work, (void *)rsp, 6395 sizeof(struct smb2_close_rsp)); 6396 } 6397 6398 /** 6399 * smb2_close() - handler for smb2 close file command 6400 * @work: smb work containing close request buffer 6401 * 6402 * Return: 0 on success, otherwise error 6403 */ 6404 int smb2_close(struct ksmbd_work *work) 6405 { 6406 u64 volatile_id = KSMBD_NO_FID; 6407 u64 sess_id; 6408 struct smb2_close_req *req; 6409 struct smb2_close_rsp *rsp; 6410 struct ksmbd_conn *conn = work->conn; 6411 struct ksmbd_file *fp; 6412 u64 time; 6413 int err = 0; 6414 6415 ksmbd_debug(SMB, "Received smb2 close request\n"); 6416 6417 WORK_BUFFERS(work, req, rsp); 6418 6419 if (smb2_compound_has_failed(work, &rsp->hdr)) 6420 return -EACCES; 6421 6422 if (test_share_config_flag(work->tcon->share_conf, 6423 KSMBD_SHARE_FLAG_PIPE)) { 6424 ksmbd_debug(SMB, "IPC pipe close request\n"); 6425 return smb2_close_pipe(work); 6426 } 6427 6428 sess_id = le64_to_cpu(req->hdr.SessionId); 6429 if (req->hdr.Flags & SMB2_FLAGS_RELATED_OPERATIONS) 6430 sess_id = work->compound_sid; 6431 6432 work->compound_sid = 0; 6433 if (check_session_id(conn, sess_id)) { 6434 work->compound_sid = sess_id; 6435 } else { 6436 rsp->hdr.Status = STATUS_USER_SESSION_DELETED; 6437 if (req->hdr.Flags & SMB2_FLAGS_RELATED_OPERATIONS) 6438 rsp->hdr.Status = STATUS_INVALID_PARAMETER; 6439 err = -EBADF; 6440 goto out; 6441 } 6442 6443 if (work->next_smb2_rcv_hdr_off && 6444 !has_file_id(req->VolatileFileId)) { 6445 if (!has_file_id(work->compound_fid)) { 6446 /* file already closed, return FILE_CLOSED */ 6447 ksmbd_debug(SMB, "file already closed\n"); 6448 rsp->hdr.Status = STATUS_FILE_CLOSED; 6449 err = -EBADF; 6450 goto out; 6451 } else { 6452 ksmbd_debug(SMB, 6453 "Compound request set FID = %llu:%llu\n", 6454 work->compound_fid, 6455 work->compound_pfid); 6456 volatile_id = work->compound_fid; 6457 6458 /* file closed, stored id is not valid anymore */ 6459 work->compound_fid = KSMBD_NO_FID; 6460 work->compound_pfid = KSMBD_NO_FID; 6461 } 6462 } else { 6463 volatile_id = req->VolatileFileId; 6464 } 6465 ksmbd_debug(SMB, "volatile_id = %llu\n", volatile_id); 6466 6467 rsp->StructureSize = cpu_to_le16(60); 6468 rsp->Reserved = 0; 6469 6470 if (req->Flags == SMB2_CLOSE_FLAG_POSTQUERY_ATTRIB) { 6471 struct kstat stat; 6472 int ret; 6473 6474 fp = ksmbd_lookup_fd_fast(work, volatile_id); 6475 if (!fp) { 6476 err = -ENOENT; 6477 goto out; 6478 } 6479 6480 ret = vfs_getattr(&fp->filp->f_path, &stat, STATX_BASIC_STATS, 6481 AT_STATX_SYNC_AS_STAT); 6482 if (ret) { 6483 ksmbd_fd_put(work, fp); 6484 goto out; 6485 } 6486 6487 rsp->Flags = SMB2_CLOSE_FLAG_POSTQUERY_ATTRIB; 6488 rsp->AllocationSize = cpu_to_le64(fp->allocation_size); 6489 rsp->EndOfFile = cpu_to_le64(stat.size); 6490 rsp->Attributes = fp->f_ci->m_fattr; 6491 rsp->CreationTime = cpu_to_le64(fp->create_time); 6492 time = ksmbd_UnixTimeToNT(stat.atime); 6493 rsp->LastAccessTime = cpu_to_le64(time); 6494 time = ksmbd_UnixTimeToNT(stat.mtime); 6495 if (time > fp->open_mtime && 6496 time - fp->open_mtime < KSMBD_WRITE_TIME_RESOLUTION) 6497 time = fp->open_mtime; 6498 rsp->LastWriteTime = cpu_to_le64(time); 6499 rsp->ChangeTime = cpu_to_le64(fp->change_time); 6500 ksmbd_fd_put(work, fp); 6501 } else { 6502 rsp->Flags = 0; 6503 rsp->AllocationSize = 0; 6504 rsp->EndOfFile = 0; 6505 rsp->Attributes = 0; 6506 rsp->CreationTime = 0; 6507 rsp->LastAccessTime = 0; 6508 rsp->LastWriteTime = 0; 6509 rsp->ChangeTime = 0; 6510 } 6511 6512 err = ksmbd_close_fd(work, volatile_id); 6513 out: 6514 if (!err) 6515 err = ksmbd_iov_pin_rsp(work, (void *)rsp, 6516 sizeof(struct smb2_close_rsp)); 6517 6518 if (err) { 6519 if (rsp->hdr.Status == 0) 6520 rsp->hdr.Status = STATUS_FILE_CLOSED; 6521 smb2_set_err_rsp(work); 6522 } 6523 6524 return err; 6525 } 6526 6527 /** 6528 * smb2_echo() - handler for smb2 echo(ping) command 6529 * @work: smb work containing echo request buffer 6530 * 6531 * Return: 0 on success, otherwise error 6532 */ 6533 int smb2_echo(struct ksmbd_work *work) 6534 { 6535 struct smb2_echo_rsp *rsp = smb_get_msg(work->response_buf); 6536 6537 ksmbd_debug(SMB, "Received smb2 echo request\n"); 6538 6539 if (work->next_smb2_rcv_hdr_off) 6540 rsp = ksmbd_resp_buf_next(work); 6541 6542 rsp->StructureSize = cpu_to_le16(4); 6543 rsp->Reserved = 0; 6544 return ksmbd_iov_pin_rsp(work, rsp, sizeof(struct smb2_echo_rsp)); 6545 } 6546 6547 static int smb2_rename(struct ksmbd_work *work, 6548 struct ksmbd_file *fp, 6549 struct smb2_file_rename_info *file_info, 6550 struct nls_table *local_nls) 6551 { 6552 struct ksmbd_share_config *share = fp->tcon->share_conf; 6553 char *new_name = NULL; 6554 int rc, flags = 0; 6555 6556 ksmbd_debug(SMB, "setting FILE_RENAME_INFO\n"); 6557 new_name = smb2_get_name(file_info->FileName, 6558 le32_to_cpu(file_info->FileNameLength), 6559 local_nls); 6560 if (IS_ERR(new_name)) 6561 return PTR_ERR(new_name); 6562 6563 if (fp->is_posix_ctxt == false && strchr(new_name, ':')) { 6564 int s_type; 6565 char *xattr_stream_name, *stream_name = NULL; 6566 size_t xattr_stream_size; 6567 int len; 6568 6569 rc = parse_stream_name(new_name, &stream_name, &s_type); 6570 if (rc < 0) 6571 goto out; 6572 6573 len = strlen(new_name); 6574 if (len > 0 && new_name[len - 1] != '/') { 6575 pr_err("not allow base filename in rename\n"); 6576 rc = -ESHARE; 6577 goto out; 6578 } 6579 6580 rc = ksmbd_vfs_xattr_stream_name(stream_name, 6581 &xattr_stream_name, 6582 &xattr_stream_size, 6583 s_type); 6584 if (rc) 6585 goto out; 6586 6587 rc = ksmbd_vfs_setxattr(file_mnt_idmap(fp->filp), 6588 &fp->filp->f_path, 6589 xattr_stream_name, 6590 NULL, 0, 0, true); 6591 if (rc < 0) { 6592 pr_err("failed to store stream name in xattr: %d\n", 6593 rc); 6594 rc = -EINVAL; 6595 } 6596 kfree(xattr_stream_name); 6597 goto out; 6598 } 6599 6600 ksmbd_debug(SMB, "new name %s\n", new_name); 6601 if (ksmbd_share_veto_filename(share, new_name)) { 6602 rc = -ENOENT; 6603 ksmbd_debug(SMB, "Can't rename vetoed file: %s\n", new_name); 6604 goto out; 6605 } 6606 6607 if (!file_info->ReplaceIfExists) 6608 flags = RENAME_NOREPLACE; 6609 6610 rc = ksmbd_vfs_rename(work, &fp->filp->f_path, new_name, flags); 6611 if (!rc) 6612 smb_break_all_levII_oplock(work, fp, 0); 6613 out: 6614 kfree(new_name); 6615 return rc; 6616 } 6617 6618 static int smb2_create_link(struct ksmbd_work *work, 6619 struct ksmbd_share_config *share, 6620 struct smb2_file_link_info *file_info, 6621 unsigned int buf_len, struct file *filp, 6622 struct nls_table *local_nls) 6623 { 6624 char *link_name = NULL, *target_name = NULL, *pathname = NULL; 6625 struct path path; 6626 int rc; 6627 6628 if (buf_len < (u64)sizeof(struct smb2_file_link_info) + 6629 le32_to_cpu(file_info->FileNameLength)) 6630 return -EINVAL; 6631 6632 ksmbd_debug(SMB, "setting FILE_LINK_INFORMATION\n"); 6633 pathname = kmalloc(PATH_MAX, KSMBD_DEFAULT_GFP); 6634 if (!pathname) 6635 return -ENOMEM; 6636 6637 link_name = smb2_get_name(file_info->FileName, 6638 le32_to_cpu(file_info->FileNameLength), 6639 local_nls); 6640 if (IS_ERR(link_name) || S_ISDIR(file_inode(filp)->i_mode)) { 6641 rc = -EINVAL; 6642 goto out; 6643 } 6644 6645 ksmbd_debug(SMB, "link name is %s\n", link_name); 6646 target_name = file_path(filp, pathname, PATH_MAX); 6647 if (IS_ERR(target_name)) { 6648 rc = -EINVAL; 6649 goto out; 6650 } 6651 6652 ksmbd_debug(SMB, "target name is %s\n", target_name); 6653 rc = ksmbd_vfs_kern_path_start_removing(work, link_name, LOOKUP_NO_SYMLINKS, 6654 &path, 0); 6655 if (rc) { 6656 if (rc != -ENOENT) 6657 goto out; 6658 } else { 6659 if (file_info->ReplaceIfExists) { 6660 rc = ksmbd_vfs_remove_file(work, &path); 6661 if (rc) { 6662 rc = -EINVAL; 6663 ksmbd_debug(SMB, "cannot delete %s\n", 6664 link_name); 6665 } 6666 } else { 6667 rc = -EEXIST; 6668 ksmbd_debug(SMB, "link already exists\n"); 6669 } 6670 ksmbd_vfs_kern_path_end_removing(&path); 6671 if (rc) 6672 goto out; 6673 } 6674 rc = ksmbd_vfs_link(work, target_name, link_name); 6675 if (rc) 6676 rc = -EINVAL; 6677 out: 6678 6679 if (!IS_ERR(link_name)) 6680 kfree(link_name); 6681 kfree(pathname); 6682 return rc; 6683 } 6684 6685 static int set_file_basic_info(struct ksmbd_file *fp, 6686 struct file_basic_info *file_info, 6687 struct ksmbd_share_config *share) 6688 { 6689 struct iattr attrs; 6690 struct file *filp; 6691 struct inode *inode; 6692 struct mnt_idmap *idmap; 6693 int rc = 0; 6694 6695 if (!(fp->daccess & FILE_WRITE_ATTRIBUTES_LE)) 6696 return -EACCES; 6697 6698 attrs.ia_valid = 0; 6699 filp = fp->filp; 6700 inode = file_inode(filp); 6701 idmap = file_mnt_idmap(filp); 6702 6703 if (file_info->CreationTime) 6704 fp->create_time = le64_to_cpu(file_info->CreationTime); 6705 6706 if (file_info->LastAccessTime) { 6707 attrs.ia_atime = ksmbd_NTtimeToUnix(file_info->LastAccessTime); 6708 attrs.ia_valid |= (ATTR_ATIME | ATTR_ATIME_SET); 6709 } 6710 6711 if (file_info->ChangeTime) { 6712 fp->change_time = le64_to_cpu(file_info->ChangeTime); 6713 inode_set_ctime_to_ts(inode, 6714 ksmbd_NTtimeToUnix(file_info->ChangeTime)); 6715 } 6716 6717 if (file_info->LastWriteTime) { 6718 attrs.ia_mtime = ksmbd_NTtimeToUnix(file_info->LastWriteTime); 6719 attrs.ia_valid |= (ATTR_MTIME | ATTR_MTIME_SET | ATTR_CTIME); 6720 } 6721 6722 if (file_info->Attributes) { 6723 if (!S_ISDIR(inode->i_mode) && 6724 file_info->Attributes & FILE_ATTRIBUTE_DIRECTORY_LE) { 6725 pr_err("can't change a file to a directory\n"); 6726 return -EINVAL; 6727 } 6728 6729 if (!(S_ISDIR(inode->i_mode) && file_info->Attributes == FILE_ATTRIBUTE_NORMAL_LE)) 6730 fp->f_ci->m_fattr = file_info->Attributes | 6731 (fp->f_ci->m_fattr & FILE_ATTRIBUTE_DIRECTORY_LE); 6732 } 6733 6734 if (test_share_config_flag(share, KSMBD_SHARE_FLAG_STORE_DOS_ATTRS) && 6735 (file_info->CreationTime || file_info->Attributes)) { 6736 struct xattr_dos_attrib da = {0}; 6737 6738 da.version = 4; 6739 da.itime = fp->itime; 6740 da.create_time = fp->create_time; 6741 da.attr = le32_to_cpu(fp->f_ci->m_fattr); 6742 da.flags = XATTR_DOSINFO_ATTRIB | XATTR_DOSINFO_CREATE_TIME | 6743 XATTR_DOSINFO_ITIME; 6744 6745 rc = ksmbd_vfs_set_dos_attrib_xattr(idmap, &filp->f_path, &da, 6746 true); 6747 if (rc) 6748 ksmbd_debug(SMB, 6749 "failed to restore file attribute in EA\n"); 6750 rc = 0; 6751 } 6752 6753 if (attrs.ia_valid) { 6754 struct dentry *dentry = filp->f_path.dentry; 6755 struct inode *inode = d_inode(dentry); 6756 6757 if (IS_IMMUTABLE(inode) || IS_APPEND(inode)) 6758 return -EACCES; 6759 6760 inode_lock(inode); 6761 rc = notify_change(idmap, dentry, &attrs, NULL); 6762 inode_unlock(inode); 6763 } 6764 return rc; 6765 } 6766 6767 static int set_file_allocation_info(struct ksmbd_work *work, 6768 struct ksmbd_file *fp, 6769 struct smb2_file_alloc_info *file_alloc_info) 6770 { 6771 /* 6772 * TODO : It's working fine only when store dos attributes 6773 * is not yes. need to implement a logic which works 6774 * properly with any smb.conf option 6775 */ 6776 6777 loff_t alloc_blks; 6778 u64 alloc_size; 6779 struct inode *inode; 6780 struct kstat stat; 6781 int rc; 6782 6783 if (!(fp->daccess & FILE_WRITE_DATA_LE)) 6784 return -EACCES; 6785 6786 if (ksmbd_stream_fd(fp) == true) 6787 return 0; 6788 6789 rc = vfs_getattr(&fp->filp->f_path, &stat, STATX_BASIC_STATS, 6790 AT_STATX_SYNC_AS_STAT); 6791 if (rc) 6792 return rc; 6793 6794 /* 6795 * AllocationSize is fully client-controlled (the caller only 6796 * validates the fixed 8-byte buffer length). Reject values that 6797 * would overflow the "round up to 512-byte blocks" conversion 6798 * below instead of silently wrapping it to a tiny block count, 6799 * which would truncate the file to a size the client never 6800 * asked for. 6801 */ 6802 alloc_size = le64_to_cpu(file_alloc_info->AllocationSize); 6803 if (alloc_size > MAX_LFS_FILESIZE - 511) 6804 return -EINVAL; 6805 6806 alloc_blks = (alloc_size + 511) >> 9; 6807 inode = file_inode(fp->filp); 6808 6809 if (alloc_blks > stat.blocks) { 6810 smb_break_all_levII_oplock(work, fp, 1); 6811 rc = vfs_fallocate(fp->filp, FALLOC_FL_KEEP_SIZE, 0, 6812 alloc_blks * 512); 6813 if (rc && rc != -EOPNOTSUPP) { 6814 pr_err("vfs_fallocate is failed : %d\n", rc); 6815 return rc; 6816 } 6817 } else if (alloc_blks < stat.blocks) { 6818 loff_t size; 6819 6820 /* 6821 * Allocation size could be smaller than original one 6822 * which means allocated blocks in file should be 6823 * deallocated. use truncate to cut out it, but inode 6824 * size is also updated with truncate offset. 6825 * inode size is retained by backup inode size. 6826 */ 6827 size = i_size_read(inode); 6828 rc = ksmbd_vfs_truncate(work, fp, alloc_blks * 512); 6829 if (rc) { 6830 pr_err("truncate failed!, err %d\n", rc); 6831 return rc; 6832 } 6833 if (size < alloc_blks * 512) 6834 i_size_write(inode, size); 6835 } 6836 6837 fp->allocation_size = le64_to_cpu(file_alloc_info->AllocationSize); 6838 return 0; 6839 } 6840 6841 static int set_end_of_file_info(struct ksmbd_work *work, struct ksmbd_file *fp, 6842 struct smb2_file_eof_info *file_eof_info) 6843 { 6844 loff_t newsize; 6845 struct inode *inode; 6846 int rc; 6847 6848 if (!(fp->daccess & FILE_WRITE_DATA_LE)) 6849 return -EACCES; 6850 6851 newsize = le64_to_cpu(file_eof_info->EndOfFile); 6852 inode = file_inode(fp->filp); 6853 6854 /* 6855 * If FILE_END_OF_FILE_INFORMATION of set_info_file is called 6856 * on FAT32 shared device, truncate execution time is too long 6857 * and network error could cause from windows client. because 6858 * truncate of some filesystem like FAT32 fill zero data in 6859 * truncated range. 6860 */ 6861 if (inode->i_sb->s_magic != MSDOS_SUPER_MAGIC && 6862 ksmbd_stream_fd(fp) == false) { 6863 ksmbd_debug(SMB, "truncated to newsize %lld\n", newsize); 6864 rc = ksmbd_vfs_truncate(work, fp, newsize); 6865 if (rc) { 6866 ksmbd_debug(SMB, "truncate failed!, err %d\n", rc); 6867 if (rc != -EAGAIN) 6868 rc = -EBADF; 6869 return rc; 6870 } 6871 } 6872 return 0; 6873 } 6874 6875 static int set_rename_info(struct ksmbd_work *work, struct ksmbd_file *fp, 6876 struct smb2_file_rename_info *rename_info, 6877 unsigned int buf_len) 6878 { 6879 if (!(fp->daccess & FILE_DELETE_LE)) { 6880 pr_err("no right to delete : 0x%x\n", fp->daccess); 6881 return -EACCES; 6882 } 6883 6884 if (buf_len < (u64)sizeof(struct smb2_file_rename_info) + 6885 le32_to_cpu(rename_info->FileNameLength)) 6886 return -EINVAL; 6887 6888 if (!le32_to_cpu(rename_info->FileNameLength)) 6889 return -EINVAL; 6890 6891 return smb2_rename(work, fp, rename_info, work->conn->local_nls); 6892 } 6893 6894 static int set_file_disposition_info(struct ksmbd_work *work, 6895 struct ksmbd_file *fp, 6896 struct smb2_file_disposition_info *file_info) 6897 { 6898 struct inode *inode; 6899 6900 if (!(fp->daccess & FILE_DELETE_LE)) { 6901 pr_err("no right to delete : 0x%x\n", fp->daccess); 6902 return -EACCES; 6903 } 6904 6905 inode = file_inode(fp->filp); 6906 if (file_info->DeletePending) { 6907 if (ksmbd_has_stream_without_delete_share(fp)) 6908 return -ESHARE; 6909 6910 if (S_ISDIR(inode->i_mode) && 6911 ksmbd_vfs_empty_dir(fp) == -ENOTEMPTY) 6912 return -EBUSY; 6913 smb_break_all_levII_oplock_for_delete(work, fp); 6914 ksmbd_set_inode_pending_delete(fp); 6915 } else { 6916 ksmbd_clear_inode_pending_delete(fp); 6917 } 6918 return 0; 6919 } 6920 6921 static int set_file_position_info(struct ksmbd_file *fp, 6922 struct smb2_file_pos_info *file_info) 6923 { 6924 loff_t current_byte_offset; 6925 unsigned long sector_size; 6926 struct inode *inode; 6927 6928 inode = file_inode(fp->filp); 6929 current_byte_offset = le64_to_cpu(file_info->CurrentByteOffset); 6930 sector_size = inode->i_sb->s_blocksize; 6931 6932 if (current_byte_offset < 0 || 6933 (fp->coption == FILE_NO_INTERMEDIATE_BUFFERING_LE && 6934 current_byte_offset & (sector_size - 1))) { 6935 pr_err("CurrentByteOffset is not valid : %llu\n", 6936 current_byte_offset); 6937 return -EINVAL; 6938 } 6939 6940 if (ksmbd_stream_fd(fp) == false) 6941 fp->filp->f_pos = current_byte_offset; 6942 else { 6943 if (current_byte_offset > XATTR_SIZE_MAX) 6944 current_byte_offset = XATTR_SIZE_MAX; 6945 fp->stream.pos = current_byte_offset; 6946 } 6947 return 0; 6948 } 6949 6950 static int set_file_mode_info(struct ksmbd_file *fp, 6951 struct smb2_file_mode_info *file_info) 6952 { 6953 __le32 mode; 6954 6955 mode = file_info->Mode; 6956 6957 if ((mode & ~FILE_MODE_INFO_MASK)) { 6958 pr_err("Mode is not valid : 0x%x\n", le32_to_cpu(mode)); 6959 return -EINVAL; 6960 } 6961 6962 /* 6963 * TODO : need to implement consideration for 6964 * FILE_SYNCHRONOUS_IO_ALERT and FILE_SYNCHRONOUS_IO_NONALERT 6965 */ 6966 ksmbd_vfs_set_fadvise(fp->filp, mode); 6967 fp->coption = mode; 6968 return 0; 6969 } 6970 6971 /** 6972 * smb2_set_info_file() - handler for smb2 set info command 6973 * @work: smb work containing set info command buffer 6974 * @fp: ksmbd_file pointer 6975 * @req: request buffer pointer 6976 * @share: ksmbd_share_config pointer 6977 * 6978 * Return: 0 on success, otherwise error 6979 */ 6980 static int smb2_set_info_file(struct ksmbd_work *work, struct ksmbd_file *fp, 6981 struct smb2_set_info_req *req, 6982 struct ksmbd_share_config *share) 6983 { 6984 unsigned int buf_len = le32_to_cpu(req->BufferLength); 6985 char *buffer = (char *)req + le16_to_cpu(req->BufferOffset); 6986 6987 switch (req->FileInfoClass) { 6988 case FILE_BASIC_INFORMATION: 6989 { 6990 if (buf_len < sizeof(struct file_basic_info)) 6991 return -EMSGSIZE; 6992 6993 return set_file_basic_info(fp, (struct file_basic_info *)buffer, share); 6994 } 6995 case FILE_ALLOCATION_INFORMATION: 6996 { 6997 if (buf_len < sizeof(struct smb2_file_alloc_info)) 6998 return -EMSGSIZE; 6999 7000 return set_file_allocation_info(work, fp, 7001 (struct smb2_file_alloc_info *)buffer); 7002 } 7003 case FILE_END_OF_FILE_INFORMATION: 7004 { 7005 if (buf_len < sizeof(struct smb2_file_eof_info)) 7006 return -EMSGSIZE; 7007 7008 return set_end_of_file_info(work, fp, 7009 (struct smb2_file_eof_info *)buffer); 7010 } 7011 case FILE_RENAME_INFORMATION: 7012 { 7013 if (buf_len < sizeof(struct smb2_file_rename_info)) 7014 return -EMSGSIZE; 7015 7016 return set_rename_info(work, fp, 7017 (struct smb2_file_rename_info *)buffer, 7018 buf_len); 7019 } 7020 case FILE_LINK_INFORMATION: 7021 { 7022 struct smb2_file_link_info *file_info; 7023 7024 if (buf_len < sizeof(struct smb2_file_link_info)) 7025 return -EMSGSIZE; 7026 7027 file_info = (struct smb2_file_link_info *)buffer; 7028 if (file_info->ReplaceIfExists && !(fp->daccess & FILE_DELETE_LE)) { 7029 pr_err("no right to delete : 0x%x\n", fp->daccess); 7030 return -EACCES; 7031 } 7032 7033 return smb2_create_link(work, work->tcon->share_conf, file_info, 7034 buf_len, fp->filp, 7035 work->conn->local_nls); 7036 } 7037 case FILE_DISPOSITION_INFORMATION: 7038 { 7039 if (buf_len < sizeof(struct smb2_file_disposition_info)) 7040 return -EMSGSIZE; 7041 7042 return set_file_disposition_info(work, fp, 7043 (struct smb2_file_disposition_info *)buffer); 7044 } 7045 case FILE_FULL_EA_INFORMATION: 7046 { 7047 if (!(fp->daccess & FILE_WRITE_EA_LE)) { 7048 pr_err("Not permitted to write ext attr: 0x%x\n", 7049 fp->daccess); 7050 return -EACCES; 7051 } 7052 7053 if (buf_len < sizeof(struct smb2_ea_info)) 7054 return -EMSGSIZE; 7055 7056 return smb2_set_ea((struct smb2_ea_info *)buffer, 7057 buf_len, &fp->filp->f_path, true); 7058 } 7059 case FILE_POSITION_INFORMATION: 7060 { 7061 if (buf_len < sizeof(struct smb2_file_pos_info)) 7062 return -EMSGSIZE; 7063 7064 return set_file_position_info(fp, (struct smb2_file_pos_info *)buffer); 7065 } 7066 case FILE_MODE_INFORMATION: 7067 { 7068 if (buf_len < sizeof(struct smb2_file_mode_info)) 7069 return -EMSGSIZE; 7070 7071 return set_file_mode_info(fp, (struct smb2_file_mode_info *)buffer); 7072 } 7073 } 7074 7075 pr_err("Unimplemented Fileinfoclass :%d\n", req->FileInfoClass); 7076 return -EOPNOTSUPP; 7077 } 7078 7079 static int smb2_set_info_sec(struct ksmbd_file *fp, int addition_info, 7080 char *buffer, int buf_len) 7081 { 7082 struct smb_ntsd *pntsd = (struct smb_ntsd *)buffer; 7083 7084 fp->saccess |= FILE_SHARE_DELETE_LE; 7085 7086 if (!(fp->daccess & (FILE_WRITE_DAC_LE | FILE_WRITE_OWNER_LE))) 7087 return -EACCES; 7088 7089 return set_info_sec(fp->conn, fp->tcon, &fp->filp->f_path, pntsd, 7090 buf_len, false, true); 7091 } 7092 7093 /** 7094 * smb2_set_info() - handler for smb2 set info command handler 7095 * @work: smb work containing set info request buffer 7096 * 7097 * Return: 0 on success, otherwise error 7098 */ 7099 int smb2_set_info(struct ksmbd_work *work) 7100 { 7101 const struct cred *saved_cred; 7102 struct smb2_set_info_req *req; 7103 struct smb2_set_info_rsp *rsp; 7104 struct ksmbd_file *fp = NULL; 7105 int rc = 0; 7106 unsigned int id = KSMBD_NO_FID, pid = KSMBD_NO_FID; 7107 7108 ksmbd_debug(SMB, "Received smb2 set info request\n"); 7109 7110 if (work->next_smb2_rcv_hdr_off) { 7111 req = ksmbd_req_buf_next(work); 7112 rsp = ksmbd_resp_buf_next(work); 7113 if (smb2_compound_has_failed(work, &rsp->hdr)) 7114 return -EACCES; 7115 if (!has_file_id(req->VolatileFileId)) { 7116 ksmbd_debug(SMB, "Compound request set FID = %llu\n", 7117 work->compound_fid); 7118 id = work->compound_fid; 7119 pid = work->compound_pfid; 7120 } 7121 } else { 7122 req = smb_get_msg(work->request_buf); 7123 rsp = smb_get_msg(work->response_buf); 7124 } 7125 7126 if (!test_tree_conn_flag(work->tcon, KSMBD_TREE_CONN_FLAG_WRITABLE)) { 7127 ksmbd_debug(SMB, "User does not have write permission\n"); 7128 pr_err("User does not have write permission\n"); 7129 rc = -EACCES; 7130 goto err_out; 7131 } 7132 7133 if (!has_file_id(id)) { 7134 id = req->VolatileFileId; 7135 pid = req->PersistentFileId; 7136 } 7137 7138 fp = ksmbd_lookup_fd_slow(work, id, pid); 7139 if (!fp) { 7140 ksmbd_debug(SMB, "Invalid id for close: %u\n", id); 7141 rc = -ENOENT; 7142 goto err_out; 7143 } 7144 7145 saved_cred = override_creds(fp->filp->f_cred); 7146 switch (req->InfoType) { 7147 case SMB2_O_INFO_FILE: 7148 ksmbd_debug(SMB, "GOT SMB2_O_INFO_FILE\n"); 7149 rc = smb2_set_info_file(work, fp, req, work->tcon->share_conf); 7150 break; 7151 case SMB2_O_INFO_SECURITY: 7152 ksmbd_debug(SMB, "GOT SMB2_O_INFO_SECURITY\n"); 7153 rc = smb2_set_info_sec(fp, 7154 le32_to_cpu(req->AdditionalInformation), 7155 (char *)req + le16_to_cpu(req->BufferOffset), 7156 le32_to_cpu(req->BufferLength)); 7157 break; 7158 default: 7159 rc = -EOPNOTSUPP; 7160 } 7161 revert_creds(saved_cred); 7162 7163 if (rc < 0) 7164 goto err_out; 7165 7166 rsp->StructureSize = cpu_to_le16(2); 7167 rc = ksmbd_iov_pin_rsp(work, (void *)rsp, 7168 sizeof(struct smb2_set_info_rsp)); 7169 if (rc) 7170 goto err_out; 7171 ksmbd_fd_put(work, fp); 7172 return 0; 7173 7174 err_out: 7175 if (rc == -EACCES || rc == -EPERM || rc == -EXDEV) 7176 rsp->hdr.Status = STATUS_ACCESS_DENIED; 7177 else if (rc == -EINVAL) 7178 rsp->hdr.Status = STATUS_INVALID_PARAMETER; 7179 else if (rc == -EMSGSIZE) 7180 rsp->hdr.Status = STATUS_INFO_LENGTH_MISMATCH; 7181 else if (rc == -ENOSPC || rc == -EFBIG) 7182 rsp->hdr.Status = STATUS_DISK_FULL; 7183 else if (rc == -ESHARE) 7184 rsp->hdr.Status = STATUS_SHARING_VIOLATION; 7185 else if (rc == -ENOENT) 7186 rsp->hdr.Status = STATUS_OBJECT_NAME_INVALID; 7187 else if (rc == -EBUSY || rc == -ENOTEMPTY) 7188 rsp->hdr.Status = STATUS_DIRECTORY_NOT_EMPTY; 7189 else if (rc == -EAGAIN) 7190 rsp->hdr.Status = STATUS_FILE_LOCK_CONFLICT; 7191 else if (rc == -EBADF || rc == -ESTALE) 7192 rsp->hdr.Status = STATUS_INVALID_HANDLE; 7193 else if (rc == -EEXIST) 7194 rsp->hdr.Status = STATUS_OBJECT_NAME_COLLISION; 7195 else if (rsp->hdr.Status == 0 || rc == -EOPNOTSUPP) 7196 rsp->hdr.Status = STATUS_INVALID_INFO_CLASS; 7197 smb2_set_err_rsp(work); 7198 ksmbd_fd_put(work, fp); 7199 ksmbd_debug(SMB, "error while processing smb2 query rc = %d\n", rc); 7200 return rc; 7201 } 7202 7203 /** 7204 * smb2_read_pipe() - handler for smb2 read from IPC pipe 7205 * @work: smb work containing read IPC pipe command buffer 7206 * 7207 * Return: 0 on success, otherwise error 7208 */ 7209 static noinline int smb2_read_pipe(struct ksmbd_work *work) 7210 { 7211 int nbytes = 0, err; 7212 u64 id; 7213 struct ksmbd_rpc_command *rpc_resp; 7214 struct smb2_read_req *req; 7215 struct smb2_read_rsp *rsp; 7216 7217 WORK_BUFFERS(work, req, rsp); 7218 7219 id = req->VolatileFileId; 7220 7221 rpc_resp = ksmbd_rpc_read(work->sess, id); 7222 if (rpc_resp) { 7223 void *aux_payload_buf; 7224 7225 if (rpc_resp->flags != KSMBD_RPC_OK) { 7226 err = -EINVAL; 7227 goto out; 7228 } 7229 7230 aux_payload_buf = 7231 kvmalloc(rpc_resp->payload_sz, KSMBD_DEFAULT_GFP); 7232 if (!aux_payload_buf) { 7233 err = -ENOMEM; 7234 goto out; 7235 } 7236 7237 memcpy(aux_payload_buf, rpc_resp->payload, rpc_resp->payload_sz); 7238 7239 nbytes = rpc_resp->payload_sz; 7240 err = ksmbd_iov_pin_rsp_read(work, (void *)rsp, 7241 offsetof(struct smb2_read_rsp, Buffer), 7242 aux_payload_buf, nbytes); 7243 if (err) { 7244 kvfree(aux_payload_buf); 7245 goto out; 7246 } 7247 kvfree(rpc_resp); 7248 } else { 7249 err = ksmbd_iov_pin_rsp(work, (void *)rsp, 7250 offsetof(struct smb2_read_rsp, Buffer)); 7251 if (err) 7252 goto out; 7253 } 7254 7255 rsp->StructureSize = cpu_to_le16(17); 7256 rsp->DataOffset = 80; 7257 rsp->Reserved = 0; 7258 rsp->DataLength = cpu_to_le32(nbytes); 7259 rsp->DataRemaining = 0; 7260 rsp->Flags = 0; 7261 return 0; 7262 7263 out: 7264 rsp->hdr.Status = STATUS_UNEXPECTED_IO_ERROR; 7265 smb2_set_err_rsp(work); 7266 kvfree(rpc_resp); 7267 return err; 7268 } 7269 7270 static int smb2_set_remote_key_for_rdma(struct ksmbd_work *work, 7271 struct smbdirect_buffer_descriptor_v1 *desc, 7272 __le32 Channel, 7273 __le16 ChannelInfoLength) 7274 { 7275 unsigned int i, ch_count; 7276 7277 if (work->conn->dialect == SMB30_PROT_ID && 7278 Channel != SMB2_CHANNEL_RDMA_V1) 7279 return -EINVAL; 7280 7281 ch_count = le16_to_cpu(ChannelInfoLength) / sizeof(*desc); 7282 if (ksmbd_debug_types & KSMBD_DEBUG_RDMA) { 7283 for (i = 0; i < ch_count; i++) { 7284 pr_info("RDMA r/w request %#x: token %#x, length %#x\n", 7285 i, 7286 le32_to_cpu(desc[i].token), 7287 le32_to_cpu(desc[i].length)); 7288 } 7289 } 7290 if (!ch_count) 7291 return -EINVAL; 7292 7293 work->need_invalidate_rkey = 7294 (Channel == SMB2_CHANNEL_RDMA_V1_INVALIDATE); 7295 if (Channel == SMB2_CHANNEL_RDMA_V1_INVALIDATE) 7296 work->remote_key = le32_to_cpu(desc->token); 7297 return 0; 7298 } 7299 7300 static ssize_t smb2_read_rdma_channel(struct ksmbd_work *work, 7301 struct smb2_read_req *req, void *data_buf, 7302 size_t length) 7303 { 7304 int err; 7305 7306 err = ksmbd_conn_rdma_write(work->conn, data_buf, length, 7307 (struct smbdirect_buffer_descriptor_v1 *) 7308 ((char *)req + le16_to_cpu(req->ReadChannelInfoOffset)), 7309 le16_to_cpu(req->ReadChannelInfoLength)); 7310 if (err) 7311 return err; 7312 7313 return length; 7314 } 7315 7316 /** 7317 * smb2_read() - handler for smb2 read from file 7318 * @work: smb work containing read command buffer 7319 * 7320 * Return: 0 on success, otherwise error 7321 */ 7322 int smb2_read(struct ksmbd_work *work) 7323 { 7324 struct ksmbd_conn *conn = work->conn; 7325 struct smb2_read_req *req; 7326 struct smb2_read_rsp *rsp; 7327 struct ksmbd_file *fp = NULL; 7328 loff_t offset; 7329 size_t length, mincount; 7330 ssize_t nbytes = 0, remain_bytes = 0; 7331 int err = 0; 7332 bool is_rdma_channel = false, async_interim = false; 7333 unsigned int max_read_size = conn->vals->max_read_size; 7334 unsigned int id = KSMBD_NO_FID, pid = KSMBD_NO_FID; 7335 void *aux_payload_buf; 7336 7337 ksmbd_debug(SMB, "Received smb2 read request\n"); 7338 7339 if (test_share_config_flag(work->tcon->share_conf, 7340 KSMBD_SHARE_FLAG_PIPE)) { 7341 ksmbd_debug(SMB, "IPC pipe read request\n"); 7342 return smb2_read_pipe(work); 7343 } 7344 7345 if (work->next_smb2_rcv_hdr_off) { 7346 req = ksmbd_req_buf_next(work); 7347 rsp = ksmbd_resp_buf_next(work); 7348 if (smb2_compound_has_failed(work, &rsp->hdr)) 7349 return -EACCES; 7350 if (!has_file_id(req->VolatileFileId)) { 7351 ksmbd_debug(SMB, "Compound request set FID = %llu\n", 7352 work->compound_fid); 7353 id = work->compound_fid; 7354 pid = work->compound_pfid; 7355 } 7356 } else { 7357 req = smb_get_msg(work->request_buf); 7358 rsp = smb_get_msg(work->response_buf); 7359 } 7360 7361 if (!has_file_id(id)) { 7362 id = req->VolatileFileId; 7363 pid = req->PersistentFileId; 7364 } 7365 7366 if (req->Channel == SMB2_CHANNEL_RDMA_V1_INVALIDATE || 7367 req->Channel == SMB2_CHANNEL_RDMA_V1) { 7368 is_rdma_channel = true; 7369 max_read_size = get_smbd_max_read_write_size(work->conn->transport); 7370 if (max_read_size == 0) { 7371 err = -EINVAL; 7372 goto out; 7373 } 7374 } 7375 7376 if (is_rdma_channel == true) { 7377 unsigned int ch_offset = le16_to_cpu(req->ReadChannelInfoOffset); 7378 7379 if (ch_offset < offsetof(struct smb2_read_req, Buffer)) { 7380 err = -EINVAL; 7381 goto out; 7382 } 7383 err = smb2_set_remote_key_for_rdma(work, 7384 (struct smbdirect_buffer_descriptor_v1 *) 7385 ((char *)req + ch_offset), 7386 req->Channel, 7387 req->ReadChannelInfoLength); 7388 if (err) 7389 goto out; 7390 } 7391 7392 fp = ksmbd_lookup_fd_slow(work, id, pid); 7393 if (!fp) { 7394 err = -ENOENT; 7395 goto out; 7396 } 7397 7398 if (!(fp->daccess & (FILE_READ_DATA_LE | FILE_READ_ATTRIBUTES_LE))) { 7399 pr_err("Not permitted to read : 0x%x\n", fp->daccess); 7400 err = -EACCES; 7401 goto out; 7402 } 7403 7404 if (work->next_smb2_rcv_hdr_off && !req->hdr.NextCommand) { 7405 err = setup_async_work(work, NULL, NULL); 7406 if (err) 7407 goto out; 7408 smb2_send_interim_resp(work, STATUS_PENDING); 7409 async_interim = true; 7410 } 7411 7412 offset = le64_to_cpu(req->Offset); 7413 if (offset < 0) { 7414 err = -EINVAL; 7415 goto out; 7416 } 7417 length = le32_to_cpu(req->Length); 7418 mincount = le32_to_cpu(req->MinimumCount); 7419 7420 if (length > max_read_size) { 7421 ksmbd_debug(SMB, "limiting read size to max size(%u)\n", 7422 max_read_size); 7423 err = -EINVAL; 7424 goto out; 7425 } 7426 7427 ksmbd_debug(SMB, "filename %pD, offset %lld, len %zu\n", 7428 fp->filp, offset, length); 7429 7430 aux_payload_buf = kvmalloc(ALIGN(length, 8), KSMBD_DEFAULT_GFP); 7431 if (!aux_payload_buf) { 7432 err = -ENOMEM; 7433 goto out; 7434 } 7435 7436 nbytes = ksmbd_vfs_read(work, fp, length, &offset, aux_payload_buf); 7437 if (nbytes < 0) { 7438 kvfree(aux_payload_buf); 7439 err = nbytes; 7440 goto out; 7441 } 7442 7443 /* 7444 * ksmbd_vfs_read() fills only nbytes; the [nbytes, ALIGN(nbytes, 8)) 7445 * tail of the un-zeroed buffer is transmitted as compound-response 7446 * alignment padding, leaking uninitialized kernel memory to the 7447 * client. Zero just that tail. 7448 */ 7449 if (nbytes & 7) 7450 memset(aux_payload_buf + nbytes, 0, ALIGN(nbytes, 8) - nbytes); 7451 7452 if ((nbytes == 0 && length != 0) || nbytes < mincount) { 7453 kvfree(aux_payload_buf); 7454 rsp->hdr.Status = STATUS_END_OF_FILE; 7455 smb2_set_err_rsp(work); 7456 if (async_interim) 7457 release_async_work(work); 7458 ksmbd_fd_put(work, fp); 7459 return -ENODATA; 7460 } 7461 7462 ksmbd_debug(SMB, "nbytes %zu, offset %lld mincount %zu\n", 7463 nbytes, offset, mincount); 7464 7465 if (is_rdma_channel == true) { 7466 /* write data to the client using rdma channel */ 7467 remain_bytes = smb2_read_rdma_channel(work, req, 7468 aux_payload_buf, 7469 nbytes); 7470 kvfree(aux_payload_buf); 7471 aux_payload_buf = NULL; 7472 nbytes = 0; 7473 if (remain_bytes < 0) { 7474 err = (int)remain_bytes; 7475 goto out; 7476 } 7477 } 7478 7479 rsp->StructureSize = cpu_to_le16(17); 7480 rsp->DataOffset = 80; 7481 rsp->Reserved = 0; 7482 rsp->DataLength = cpu_to_le32(nbytes); 7483 rsp->DataRemaining = cpu_to_le32(remain_bytes); 7484 rsp->Flags = 0; 7485 err = ksmbd_iov_pin_rsp_read(work, (void *)rsp, 7486 offsetof(struct smb2_read_rsp, Buffer), 7487 aux_payload_buf, nbytes); 7488 if (err) { 7489 kvfree(aux_payload_buf); 7490 goto out; 7491 } 7492 if (async_interim) 7493 release_async_work(work); 7494 /* 7495 * RDMA responses are transferred through channel buffers and encrypted 7496 * responses use the encryption transform, so only normal SMB transport 7497 * responses are candidates for compression. 7498 */ 7499 if (!is_rdma_channel && nbytes && 7500 (req->Flags & SMB2_READFLAG_REQUEST_COMPRESSED) && 7501 conn->compress_algorithm != SMB3_COMPRESS_NONE) 7502 work->compress_response = true; 7503 ksmbd_fd_put(work, fp); 7504 return 0; 7505 7506 out: 7507 if (async_interim) 7508 release_async_work(work); 7509 if (err) { 7510 if (err == -EISDIR) 7511 rsp->hdr.Status = STATUS_INVALID_DEVICE_REQUEST; 7512 else if (err == -EAGAIN) 7513 rsp->hdr.Status = STATUS_FILE_LOCK_CONFLICT; 7514 else if (err == -ENOENT) 7515 rsp->hdr.Status = STATUS_FILE_CLOSED; 7516 else if (err == -EACCES) 7517 rsp->hdr.Status = STATUS_ACCESS_DENIED; 7518 else if (err == -ESHARE) 7519 rsp->hdr.Status = STATUS_SHARING_VIOLATION; 7520 else if (err == -EINVAL) 7521 rsp->hdr.Status = STATUS_INVALID_PARAMETER; 7522 else 7523 rsp->hdr.Status = STATUS_INVALID_HANDLE; 7524 7525 smb2_set_err_rsp(work); 7526 } 7527 ksmbd_fd_put(work, fp); 7528 return err; 7529 } 7530 7531 /** 7532 * smb2_write_pipe() - handler for smb2 write on IPC pipe 7533 * @work: smb work containing write IPC pipe command buffer 7534 * 7535 * Return: 0 on success, otherwise error 7536 */ 7537 static noinline int smb2_write_pipe(struct ksmbd_work *work) 7538 { 7539 struct smb2_write_req *req; 7540 struct smb2_write_rsp *rsp; 7541 struct ksmbd_rpc_command *rpc_resp; 7542 u64 id = 0; 7543 int err = 0, ret = 0; 7544 char *data_buf; 7545 size_t length; 7546 7547 WORK_BUFFERS(work, req, rsp); 7548 7549 length = le32_to_cpu(req->Length); 7550 id = req->VolatileFileId; 7551 7552 if ((u64)le16_to_cpu(req->DataOffset) + length > 7553 get_rfc1002_len(work->request_buf)) { 7554 pr_err("invalid write data offset %u, smb_len %u\n", 7555 le16_to_cpu(req->DataOffset), 7556 get_rfc1002_len(work->request_buf)); 7557 err = -EINVAL; 7558 goto out; 7559 } 7560 7561 data_buf = (char *)(((char *)&req->hdr.ProtocolId) + 7562 le16_to_cpu(req->DataOffset)); 7563 7564 rpc_resp = ksmbd_rpc_write(work->sess, id, data_buf, length); 7565 if (rpc_resp) { 7566 if (rpc_resp->flags == KSMBD_RPC_ENOTIMPLEMENTED) { 7567 rsp->hdr.Status = STATUS_NOT_SUPPORTED; 7568 kvfree(rpc_resp); 7569 smb2_set_err_rsp(work); 7570 return -EOPNOTSUPP; 7571 } 7572 if (rpc_resp->flags != KSMBD_RPC_OK) { 7573 rsp->hdr.Status = STATUS_INVALID_HANDLE; 7574 smb2_set_err_rsp(work); 7575 kvfree(rpc_resp); 7576 return ret; 7577 } 7578 kvfree(rpc_resp); 7579 } 7580 7581 rsp->StructureSize = cpu_to_le16(17); 7582 rsp->DataOffset = 0; 7583 rsp->Reserved = 0; 7584 rsp->DataLength = cpu_to_le32(length); 7585 rsp->DataRemaining = 0; 7586 rsp->Reserved2 = 0; 7587 err = ksmbd_iov_pin_rsp(work, (void *)rsp, 7588 offsetof(struct smb2_write_rsp, Buffer)); 7589 out: 7590 if (err) { 7591 rsp->hdr.Status = STATUS_INVALID_HANDLE; 7592 smb2_set_err_rsp(work); 7593 } 7594 7595 return err; 7596 } 7597 7598 static ssize_t smb2_write_rdma_channel(struct ksmbd_work *work, 7599 struct smb2_write_req *req, 7600 struct ksmbd_file *fp, 7601 loff_t offset, size_t length, bool sync) 7602 { 7603 char *data_buf; 7604 int ret; 7605 ssize_t nbytes; 7606 7607 data_buf = kvzalloc(length, KSMBD_DEFAULT_GFP); 7608 if (!data_buf) 7609 return -ENOMEM; 7610 7611 ret = ksmbd_conn_rdma_read(work->conn, data_buf, length, 7612 (struct smbdirect_buffer_descriptor_v1 *) 7613 ((char *)req + le16_to_cpu(req->WriteChannelInfoOffset)), 7614 le16_to_cpu(req->WriteChannelInfoLength)); 7615 if (ret < 0) { 7616 kvfree(data_buf); 7617 return ret; 7618 } 7619 7620 ret = ksmbd_vfs_write(work, fp, data_buf, length, &offset, sync, &nbytes); 7621 kvfree(data_buf); 7622 if (ret < 0) 7623 return ret; 7624 7625 return nbytes; 7626 } 7627 7628 /** 7629 * smb2_write() - handler for smb2 write from file 7630 * @work: smb work containing write command buffer 7631 * 7632 * Return: 0 on success, otherwise error 7633 */ 7634 int smb2_write(struct ksmbd_work *work) 7635 { 7636 struct smb2_write_req *req; 7637 struct smb2_write_rsp *rsp; 7638 struct ksmbd_file *fp = NULL; 7639 loff_t offset; 7640 size_t length; 7641 ssize_t nbytes; 7642 char *data_buf; 7643 bool writethrough = false, is_rdma_channel = false; 7644 bool async_interim = false; 7645 int err = 0; 7646 unsigned int max_write_size = work->conn->vals->max_write_size; 7647 unsigned int id = KSMBD_NO_FID, pid = KSMBD_NO_FID; 7648 7649 ksmbd_debug(SMB, "Received smb2 write request\n"); 7650 7651 WORK_BUFFERS(work, req, rsp); 7652 7653 if (smb2_compound_has_failed(work, &rsp->hdr)) 7654 return -EACCES; 7655 7656 if (work->next_smb2_rcv_hdr_off && 7657 !has_file_id(req->VolatileFileId)) { 7658 ksmbd_debug(SMB, "Compound request set FID = %llu\n", 7659 work->compound_fid); 7660 id = work->compound_fid; 7661 pid = work->compound_pfid; 7662 } 7663 7664 if (!has_file_id(id)) { 7665 id = req->VolatileFileId; 7666 pid = req->PersistentFileId; 7667 } 7668 7669 if (test_share_config_flag(work->tcon->share_conf, KSMBD_SHARE_FLAG_PIPE)) { 7670 ksmbd_debug(SMB, "IPC pipe write request\n"); 7671 return smb2_write_pipe(work); 7672 } 7673 7674 offset = le64_to_cpu(req->Offset); 7675 if (offset < 0) 7676 return -EINVAL; 7677 length = le32_to_cpu(req->Length); 7678 7679 if (req->Channel == SMB2_CHANNEL_RDMA_V1 || 7680 req->Channel == SMB2_CHANNEL_RDMA_V1_INVALIDATE) { 7681 is_rdma_channel = true; 7682 max_write_size = get_smbd_max_read_write_size(work->conn->transport); 7683 if (max_write_size == 0) { 7684 err = -EINVAL; 7685 goto out; 7686 } 7687 length = le32_to_cpu(req->RemainingBytes); 7688 } 7689 7690 if (is_rdma_channel == true) { 7691 unsigned int ch_offset = le16_to_cpu(req->WriteChannelInfoOffset); 7692 7693 if (req->Length != 0 || req->DataOffset != 0 || 7694 ch_offset < offsetof(struct smb2_write_req, Buffer)) { 7695 err = -EINVAL; 7696 goto out; 7697 } 7698 err = smb2_set_remote_key_for_rdma(work, 7699 (struct smbdirect_buffer_descriptor_v1 *) 7700 ((char *)req + ch_offset), 7701 req->Channel, 7702 req->WriteChannelInfoLength); 7703 if (err) 7704 goto out; 7705 } 7706 7707 if (!test_tree_conn_flag(work->tcon, KSMBD_TREE_CONN_FLAG_WRITABLE)) { 7708 ksmbd_debug(SMB, "User does not have write permission\n"); 7709 err = -EACCES; 7710 goto out; 7711 } 7712 7713 fp = ksmbd_lookup_fd_slow(work, id, pid); 7714 if (!fp) { 7715 err = -ENOENT; 7716 goto out; 7717 } 7718 7719 if (!(fp->daccess & (FILE_WRITE_DATA_LE | FILE_READ_ATTRIBUTES_LE))) { 7720 pr_err("Not permitted to write : 0x%x\n", fp->daccess); 7721 err = -EACCES; 7722 goto out; 7723 } 7724 7725 if (work->next_smb2_rcv_hdr_off && !req->hdr.NextCommand) { 7726 err = setup_async_work(work, NULL, NULL); 7727 if (err) 7728 goto out; 7729 smb2_send_interim_resp(work, STATUS_PENDING); 7730 async_interim = true; 7731 } 7732 7733 if (length > max_write_size) { 7734 ksmbd_debug(SMB, "limiting write size to max size(%u)\n", 7735 max_write_size); 7736 err = -EINVAL; 7737 goto out; 7738 } 7739 7740 ksmbd_debug(SMB, "flags %u\n", le32_to_cpu(req->Flags)); 7741 if (le32_to_cpu(req->Flags) & SMB2_WRITEFLAG_WRITE_THROUGH) 7742 writethrough = true; 7743 7744 if (is_rdma_channel == false) { 7745 if (le16_to_cpu(req->DataOffset) < 7746 offsetof(struct smb2_write_req, Buffer)) { 7747 err = -EINVAL; 7748 goto out; 7749 } 7750 7751 data_buf = (char *)(((char *)&req->hdr.ProtocolId) + 7752 le16_to_cpu(req->DataOffset)); 7753 7754 ksmbd_debug(SMB, "filename %pD, offset %lld, len %zu\n", 7755 fp->filp, offset, length); 7756 err = ksmbd_vfs_write(work, fp, data_buf, length, &offset, 7757 writethrough, &nbytes); 7758 if (err < 0) 7759 goto out; 7760 } else { 7761 /* read data from the client using rdma channel, and 7762 * write the data. 7763 */ 7764 nbytes = smb2_write_rdma_channel(work, req, fp, offset, length, 7765 writethrough); 7766 if (nbytes < 0) { 7767 err = (int)nbytes; 7768 goto out; 7769 } 7770 } 7771 7772 rsp->StructureSize = cpu_to_le16(17); 7773 rsp->DataOffset = 0; 7774 rsp->Reserved = 0; 7775 rsp->DataLength = cpu_to_le32(nbytes); 7776 rsp->DataRemaining = 0; 7777 rsp->Reserved2 = 0; 7778 err = ksmbd_iov_pin_rsp(work, rsp, offsetof(struct smb2_write_rsp, Buffer)); 7779 if (err) 7780 goto out; 7781 if (async_interim) 7782 release_async_work(work); 7783 ksmbd_fd_put(work, fp); 7784 return 0; 7785 7786 out: 7787 if (async_interim) 7788 release_async_work(work); 7789 7790 if (err == -EAGAIN) 7791 rsp->hdr.Status = STATUS_FILE_LOCK_CONFLICT; 7792 else if (err == -ENOSPC || err == -EFBIG) 7793 rsp->hdr.Status = STATUS_DISK_FULL; 7794 else if (err == -ENOENT) 7795 rsp->hdr.Status = STATUS_FILE_CLOSED; 7796 else if (err == -EACCES) 7797 rsp->hdr.Status = STATUS_ACCESS_DENIED; 7798 else if (err == -ESHARE) 7799 rsp->hdr.Status = STATUS_SHARING_VIOLATION; 7800 else if (err == -EINVAL) 7801 rsp->hdr.Status = STATUS_INVALID_PARAMETER; 7802 else 7803 rsp->hdr.Status = STATUS_INVALID_HANDLE; 7804 7805 smb2_set_err_rsp(work); 7806 ksmbd_fd_put(work, fp); 7807 return err; 7808 } 7809 7810 /** 7811 * smb2_flush() - handler for smb2 flush file - fsync 7812 * @work: smb work containing flush command buffer 7813 * 7814 * Return: 0 on success, otherwise error 7815 */ 7816 int smb2_flush(struct ksmbd_work *work) 7817 { 7818 struct smb2_flush_req *req; 7819 struct smb2_flush_rsp *rsp; 7820 u64 id = KSMBD_NO_FID, pid = KSMBD_NO_FID; 7821 int err; 7822 7823 WORK_BUFFERS(work, req, rsp); 7824 7825 ksmbd_debug(SMB, "Received smb2 flush request(fid : %llu)\n", req->VolatileFileId); 7826 7827 if (smb2_compound_has_failed(work, &rsp->hdr)) 7828 return -EACCES; 7829 7830 if (work->next_smb2_rcv_hdr_off && 7831 !has_file_id(req->VolatileFileId)) { 7832 ksmbd_debug(SMB, "Compound request set FID = %llu\n", 7833 work->compound_fid); 7834 id = work->compound_fid; 7835 pid = work->compound_pfid; 7836 } 7837 7838 if (!has_file_id(id)) { 7839 id = req->VolatileFileId; 7840 pid = req->PersistentFileId; 7841 } 7842 7843 err = ksmbd_vfs_fsync(work, id, pid); 7844 if (err) 7845 goto out; 7846 7847 rsp->StructureSize = cpu_to_le16(4); 7848 rsp->Reserved = 0; 7849 return ksmbd_iov_pin_rsp(work, rsp, sizeof(struct smb2_flush_rsp)); 7850 7851 out: 7852 rsp->hdr.Status = STATUS_INVALID_HANDLE; 7853 smb2_set_err_rsp(work); 7854 return err; 7855 } 7856 7857 /** 7858 * smb2_cancel() - handler for smb2 cancel command 7859 * @work: smb work containing cancel command buffer 7860 * 7861 * Return: 0 on success, otherwise error 7862 */ 7863 int smb2_cancel(struct ksmbd_work *work) 7864 { 7865 struct ksmbd_conn *conn = work->conn; 7866 struct smb2_hdr *hdr = smb_get_msg(work->request_buf); 7867 struct smb2_hdr *chdr; 7868 struct ksmbd_work *iter; 7869 struct list_head *command_list; 7870 7871 if (work->next_smb2_rcv_hdr_off) 7872 hdr = ksmbd_resp_buf_next(work); 7873 7874 ksmbd_debug(SMB, "smb2 cancel called on mid %llu, async flags 0x%x\n", 7875 le64_to_cpu(hdr->MessageId), 7876 le32_to_cpu(hdr->Flags)); 7877 7878 if (hdr->Flags & SMB2_FLAGS_ASYNC_COMMAND) { 7879 command_list = &conn->async_requests; 7880 7881 spin_lock(&conn->request_lock); 7882 list_for_each_entry(iter, command_list, 7883 async_request_entry) { 7884 chdr = smb_get_msg(iter->request_buf); 7885 7886 if (iter->async_id != 7887 le64_to_cpu(hdr->Id.AsyncId)) 7888 continue; 7889 7890 /* 7891 * Only an ACTIVE deferred work may have its cancel_fn 7892 * fired. A CANCELLED or CLOSED work already took the 7893 * smb2_lock() non-ACTIVE early-exit that frees the 7894 * file_lock and skips release_async_work(), so it is 7895 * still on conn->async_requests with a live cancel_fn 7896 * pointing at the freed file_lock. 7897 */ 7898 if (iter->state != KSMBD_WORK_ACTIVE) 7899 break; 7900 7901 ksmbd_debug(SMB, 7902 "smb2 with AsyncId %llu cancelled command = 0x%x\n", 7903 le64_to_cpu(hdr->Id.AsyncId), 7904 le16_to_cpu(chdr->Command)); 7905 iter->state = KSMBD_WORK_CANCELLED; 7906 if (iter->cancel_fn) 7907 iter->cancel_fn(iter->cancel_argv); 7908 break; 7909 } 7910 spin_unlock(&conn->request_lock); 7911 } else { 7912 command_list = &conn->requests; 7913 7914 spin_lock(&conn->request_lock); 7915 list_for_each_entry(iter, command_list, request_entry) { 7916 chdr = smb_get_msg(iter->request_buf); 7917 7918 if (chdr->MessageId != hdr->MessageId || 7919 iter == work) 7920 continue; 7921 7922 ksmbd_debug(SMB, 7923 "smb2 with mid %llu cancelled command = 0x%x\n", 7924 le64_to_cpu(hdr->MessageId), 7925 le16_to_cpu(chdr->Command)); 7926 iter->state = KSMBD_WORK_CANCELLED; 7927 break; 7928 } 7929 spin_unlock(&conn->request_lock); 7930 } 7931 7932 /* For SMB2_CANCEL command itself send no response*/ 7933 work->send_no_response = 1; 7934 return 0; 7935 } 7936 7937 struct file_lock *smb_flock_init(struct file *f) 7938 { 7939 struct file_lock *fl; 7940 7941 fl = locks_alloc_lock(); 7942 if (!fl) 7943 goto out; 7944 7945 locks_init_lock(fl); 7946 7947 fl->c.flc_owner = f; 7948 fl->c.flc_pid = current->tgid; 7949 fl->c.flc_file = f; 7950 fl->c.flc_flags = FL_POSIX; 7951 fl->fl_ops = NULL; 7952 fl->fl_lmops = NULL; 7953 7954 out: 7955 return fl; 7956 } 7957 7958 static int smb2_set_flock_flags(struct file_lock *flock, int flags) 7959 { 7960 int cmd = -EINVAL; 7961 7962 /* Checking for wrong flag combination during lock request*/ 7963 switch (flags) { 7964 case SMB2_LOCKFLAG_SHARED: 7965 ksmbd_debug(SMB, "received shared request\n"); 7966 cmd = F_SETLKW; 7967 flock->c.flc_type = F_RDLCK; 7968 flock->c.flc_flags |= FL_SLEEP; 7969 break; 7970 case SMB2_LOCKFLAG_EXCLUSIVE: 7971 ksmbd_debug(SMB, "received exclusive request\n"); 7972 cmd = F_SETLKW; 7973 flock->c.flc_type = F_WRLCK; 7974 flock->c.flc_flags |= FL_SLEEP; 7975 break; 7976 case SMB2_LOCKFLAG_SHARED | SMB2_LOCKFLAG_FAIL_IMMEDIATELY: 7977 ksmbd_debug(SMB, 7978 "received shared & fail immediately request\n"); 7979 cmd = F_SETLK; 7980 flock->c.flc_type = F_RDLCK; 7981 break; 7982 case SMB2_LOCKFLAG_EXCLUSIVE | SMB2_LOCKFLAG_FAIL_IMMEDIATELY: 7983 ksmbd_debug(SMB, 7984 "received exclusive & fail immediately request\n"); 7985 cmd = F_SETLK; 7986 flock->c.flc_type = F_WRLCK; 7987 break; 7988 case SMB2_LOCKFLAG_UNLOCK: 7989 ksmbd_debug(SMB, "received unlock request\n"); 7990 flock->c.flc_type = F_UNLCK; 7991 cmd = F_SETLK; 7992 break; 7993 } 7994 7995 return cmd; 7996 } 7997 7998 static struct ksmbd_lock *smb2_lock_init(struct file_lock *flock, 7999 unsigned int cmd, int flags, 8000 struct list_head *lock_list) 8001 { 8002 struct ksmbd_lock *lock; 8003 8004 lock = kzalloc_obj(struct ksmbd_lock, KSMBD_DEFAULT_GFP); 8005 if (!lock) 8006 return NULL; 8007 8008 lock->cmd = cmd; 8009 lock->fl = flock; 8010 lock->start = flock->fl_start; 8011 lock->end = flock->fl_end; 8012 lock->flags = flags; 8013 if (lock->start == lock->end) 8014 lock->zero_len = 1; 8015 INIT_LIST_HEAD(&lock->clist); 8016 INIT_LIST_HEAD(&lock->flist); 8017 INIT_LIST_HEAD(&lock->llist); 8018 list_add_tail(&lock->llist, lock_list); 8019 8020 return lock; 8021 } 8022 8023 static void smb2_remove_blocked_lock(void **argv) 8024 { 8025 struct file_lock *flock = (struct file_lock *)argv[0]; 8026 8027 ksmbd_vfs_posix_lock_unblock(flock); 8028 locks_wake_up(flock); 8029 } 8030 8031 static inline bool lock_defer_pending(struct file_lock *fl) 8032 { 8033 /* check pending lock waiters */ 8034 return waitqueue_active(&fl->c.flc_wait); 8035 } 8036 8037 /** 8038 * smb2_lock() - handler for smb2 file lock command 8039 * @work: smb work containing lock command buffer 8040 * 8041 * Return: 0 on success, otherwise error 8042 */ 8043 int smb2_lock(struct ksmbd_work *work) 8044 { 8045 struct smb2_lock_req *req; 8046 struct smb2_lock_rsp *rsp; 8047 struct smb2_lock_element *lock_ele; 8048 struct ksmbd_file *fp = NULL; 8049 struct file_lock *flock = NULL; 8050 struct file *filp = NULL; 8051 int lock_count; 8052 int flags = 0; 8053 int cmd = 0; 8054 int err = -EIO, i, rc = 0; 8055 u64 lock_start, lock_length; 8056 struct ksmbd_lock *smb_lock = NULL, *cmp_lock, *tmp, *tmp2; 8057 struct ksmbd_conn *conn; 8058 int nolock = 0; 8059 LIST_HEAD(lock_list); 8060 LIST_HEAD(rollback_list); 8061 int prior_lock = 0, bkt; 8062 unsigned int id = KSMBD_NO_FID, pid = KSMBD_NO_FID; 8063 8064 WORK_BUFFERS(work, req, rsp); 8065 8066 ksmbd_debug(SMB, "Received smb2 lock request\n"); 8067 8068 if (smb2_compound_has_failed(work, &rsp->hdr)) 8069 return -EACCES; 8070 8071 if (work->next_smb2_rcv_hdr_off && 8072 !has_file_id(req->VolatileFileId)) { 8073 ksmbd_debug(SMB, "Compound request set FID = %llu\n", 8074 work->compound_fid); 8075 id = work->compound_fid; 8076 pid = work->compound_pfid; 8077 } 8078 8079 if (!has_file_id(id)) { 8080 id = req->VolatileFileId; 8081 pid = req->PersistentFileId; 8082 } 8083 8084 fp = ksmbd_lookup_fd_slow(work, id, pid); 8085 if (!fp) { 8086 ksmbd_debug(SMB, "Invalid file id for lock : %llu\n", req->VolatileFileId); 8087 err = -ENOENT; 8088 goto out2; 8089 } 8090 8091 filp = fp->filp; 8092 lock_count = le16_to_cpu(req->LockCount); 8093 lock_ele = req->locks; 8094 8095 ksmbd_debug(SMB, "lock count is %d\n", lock_count); 8096 /* 8097 * Cap lock_count at 64. The MS-SMB2 spec defines Open.LockSequenceArray 8098 * as exactly 64 entries so 64 is the intended ceiling. No real workload 8099 * comes close to this in a single request. 8100 */ 8101 if (!lock_count || lock_count > 64) { 8102 err = -EINVAL; 8103 goto out2; 8104 } 8105 8106 for (i = 0; i < lock_count; i++) { 8107 flags = le32_to_cpu(lock_ele[i].Flags); 8108 8109 flock = smb_flock_init(filp); 8110 if (!flock) 8111 goto out; 8112 8113 cmd = smb2_set_flock_flags(flock, flags); 8114 8115 lock_start = le64_to_cpu(lock_ele[i].Offset); 8116 lock_length = le64_to_cpu(lock_ele[i].Length); 8117 if (lock_start > U64_MAX - lock_length) { 8118 pr_err("Invalid lock range requested\n"); 8119 rsp->hdr.Status = STATUS_INVALID_LOCK_RANGE; 8120 locks_free_lock(flock); 8121 goto out; 8122 } 8123 8124 if (lock_start > OFFSET_MAX) 8125 flock->fl_start = OFFSET_MAX; 8126 else 8127 flock->fl_start = lock_start; 8128 8129 lock_length = le64_to_cpu(lock_ele[i].Length); 8130 if (lock_length > OFFSET_MAX - flock->fl_start) 8131 lock_length = OFFSET_MAX - flock->fl_start; 8132 8133 flock->fl_end = flock->fl_start + lock_length; 8134 8135 if (flock->fl_end < flock->fl_start) { 8136 ksmbd_debug(SMB, 8137 "the end offset(%llx) is smaller than the start offset(%llx)\n", 8138 flock->fl_end, flock->fl_start); 8139 rsp->hdr.Status = STATUS_INVALID_LOCK_RANGE; 8140 locks_free_lock(flock); 8141 goto out; 8142 } 8143 8144 /* Check conflict locks in one request */ 8145 list_for_each_entry(cmp_lock, &lock_list, llist) { 8146 if (cmp_lock->fl->fl_start <= flock->fl_start && 8147 cmp_lock->fl->fl_end >= flock->fl_end) { 8148 if (cmp_lock->fl->c.flc_type != F_UNLCK && 8149 flock->c.flc_type != F_UNLCK) { 8150 pr_err("conflict two locks in one request\n"); 8151 err = -EINVAL; 8152 locks_free_lock(flock); 8153 goto out; 8154 } 8155 } 8156 } 8157 8158 smb_lock = smb2_lock_init(flock, cmd, flags, &lock_list); 8159 if (!smb_lock) { 8160 err = -EINVAL; 8161 locks_free_lock(flock); 8162 goto out; 8163 } 8164 } 8165 8166 list_for_each_entry_safe(smb_lock, tmp, &lock_list, llist) { 8167 if (smb_lock->cmd < 0) { 8168 err = -EINVAL; 8169 goto out; 8170 } 8171 8172 if (!(smb_lock->flags & SMB2_LOCKFLAG_MASK)) { 8173 err = -EINVAL; 8174 goto out; 8175 } 8176 8177 if ((prior_lock & (SMB2_LOCKFLAG_EXCLUSIVE | SMB2_LOCKFLAG_SHARED) && 8178 smb_lock->flags & SMB2_LOCKFLAG_UNLOCK) || 8179 (prior_lock == SMB2_LOCKFLAG_UNLOCK && 8180 !(smb_lock->flags & SMB2_LOCKFLAG_UNLOCK))) { 8181 err = -EINVAL; 8182 goto out; 8183 } 8184 8185 prior_lock = smb_lock->flags; 8186 8187 if (!(smb_lock->flags & SMB2_LOCKFLAG_UNLOCK) && 8188 !(smb_lock->flags & SMB2_LOCKFLAG_FAIL_IMMEDIATELY)) 8189 goto no_check_cl; 8190 8191 nolock = 1; 8192 /* check locks in connection list */ 8193 down_read(&conn_list_lock); 8194 hash_for_each(conn_list, bkt, conn, hlist) { 8195 spin_lock(&conn->llist_lock); 8196 list_for_each_entry_safe(cmp_lock, tmp2, &conn->lock_list, clist) { 8197 if (file_inode(cmp_lock->fl->c.flc_file) != 8198 file_inode(smb_lock->fl->c.flc_file)) 8199 continue; 8200 8201 if (lock_is_unlock(smb_lock->fl)) { 8202 if (cmp_lock->fl->c.flc_file == smb_lock->fl->c.flc_file && 8203 cmp_lock->start == smb_lock->start && 8204 cmp_lock->end == smb_lock->end && 8205 !lock_defer_pending(cmp_lock->fl)) { 8206 nolock = 0; 8207 list_del(&cmp_lock->flist); 8208 list_del(&cmp_lock->clist); 8209 cmp_lock->conn = NULL; 8210 spin_unlock(&conn->llist_lock); 8211 up_read(&conn_list_lock); 8212 8213 ksmbd_conn_put(conn); 8214 locks_free_lock(cmp_lock->fl); 8215 kfree(cmp_lock); 8216 goto out_check_cl; 8217 } 8218 continue; 8219 } 8220 8221 if (cmp_lock->fl->c.flc_file == smb_lock->fl->c.flc_file) { 8222 if (smb_lock->flags & SMB2_LOCKFLAG_SHARED) 8223 continue; 8224 } else { 8225 if (cmp_lock->flags & SMB2_LOCKFLAG_SHARED) 8226 continue; 8227 } 8228 8229 /* check zero byte lock range */ 8230 if (cmp_lock->zero_len && !smb_lock->zero_len && 8231 cmp_lock->start > smb_lock->start && 8232 cmp_lock->start < smb_lock->end) { 8233 spin_unlock(&conn->llist_lock); 8234 up_read(&conn_list_lock); 8235 pr_err("previous lock conflict with zero byte lock range\n"); 8236 goto out; 8237 } 8238 8239 if (smb_lock->zero_len && !cmp_lock->zero_len && 8240 smb_lock->start > cmp_lock->start && 8241 smb_lock->start < cmp_lock->end) { 8242 spin_unlock(&conn->llist_lock); 8243 up_read(&conn_list_lock); 8244 pr_err("current lock conflict with zero byte lock range\n"); 8245 goto out; 8246 } 8247 8248 if (((cmp_lock->start <= smb_lock->start && 8249 cmp_lock->end > smb_lock->start) || 8250 (cmp_lock->start < smb_lock->end && 8251 cmp_lock->end >= smb_lock->end)) && 8252 !cmp_lock->zero_len && !smb_lock->zero_len) { 8253 spin_unlock(&conn->llist_lock); 8254 up_read(&conn_list_lock); 8255 pr_err("Not allow lock operation on exclusive lock range\n"); 8256 goto out; 8257 } 8258 } 8259 spin_unlock(&conn->llist_lock); 8260 } 8261 up_read(&conn_list_lock); 8262 out_check_cl: 8263 if (lock_is_unlock(smb_lock->fl) && nolock) { 8264 pr_err("Try to unlock nolocked range\n"); 8265 rsp->hdr.Status = STATUS_RANGE_NOT_LOCKED; 8266 goto out; 8267 } 8268 8269 no_check_cl: 8270 flock = smb_lock->fl; 8271 list_del(&smb_lock->llist); 8272 8273 if (smb_lock->zero_len) { 8274 err = 0; 8275 goto skip; 8276 } 8277 retry: 8278 rc = vfs_lock_file(filp, smb_lock->cmd, flock, NULL); 8279 skip: 8280 if (smb_lock->flags & SMB2_LOCKFLAG_UNLOCK) { 8281 locks_free_lock(flock); 8282 kfree(smb_lock); 8283 if (!rc) { 8284 ksmbd_debug(SMB, "File unlocked\n"); 8285 } else if (rc == -ENOENT) { 8286 rsp->hdr.Status = STATUS_NOT_LOCKED; 8287 err = rc; 8288 goto out; 8289 } 8290 } else { 8291 if (rc == FILE_LOCK_DEFERRED) { 8292 void **argv; 8293 8294 ksmbd_debug(SMB, 8295 "would have to wait for getting lock\n"); 8296 list_add(&smb_lock->llist, &rollback_list); 8297 8298 argv = kmalloc(sizeof(void *), KSMBD_DEFAULT_GFP); 8299 if (!argv) { 8300 err = -ENOMEM; 8301 goto out; 8302 } 8303 argv[0] = flock; 8304 8305 rc = setup_async_work(work, 8306 smb2_remove_blocked_lock, 8307 argv); 8308 if (rc) { 8309 kfree(argv); 8310 err = -ENOMEM; 8311 goto out; 8312 } 8313 spin_lock(&fp->f_lock); 8314 list_add(&work->fp_entry, &fp->blocked_works); 8315 spin_unlock(&fp->f_lock); 8316 8317 smb2_send_interim_resp(work, STATUS_PENDING); 8318 8319 ksmbd_vfs_posix_lock_wait(flock); 8320 8321 spin_lock(&fp->f_lock); 8322 list_del(&work->fp_entry); 8323 spin_unlock(&fp->f_lock); 8324 8325 list_del(&smb_lock->llist); 8326 release_async_work(work); 8327 8328 if (work->state == KSMBD_WORK_ACTIVE) 8329 goto retry; 8330 8331 locks_free_lock(flock); 8332 8333 if (work->state == KSMBD_WORK_CANCELLED) { 8334 rsp->hdr.Status = STATUS_CANCELLED; 8335 kfree(smb_lock); 8336 smb2_send_interim_resp(work, 8337 STATUS_CANCELLED); 8338 work->send_no_response = 1; 8339 goto out; 8340 } 8341 8342 rsp->hdr.Status = 8343 STATUS_RANGE_NOT_LOCKED; 8344 kfree(smb_lock); 8345 goto out2; 8346 } else if (!rc) { 8347 list_add(&smb_lock->llist, &rollback_list); 8348 smb_lock->conn = ksmbd_conn_get(work->conn); 8349 spin_lock(&work->conn->llist_lock); 8350 list_add_tail(&smb_lock->clist, 8351 &work->conn->lock_list); 8352 list_add_tail(&smb_lock->flist, 8353 &fp->lock_list); 8354 spin_unlock(&work->conn->llist_lock); 8355 ksmbd_debug(SMB, "successful in taking lock\n"); 8356 } else { 8357 locks_free_lock(flock); 8358 kfree(smb_lock); 8359 err = rc; 8360 goto out; 8361 } 8362 } 8363 } 8364 8365 if (atomic_read(&fp->f_ci->op_count) > 1) 8366 smb_break_all_oplock(work, fp); 8367 8368 rsp->StructureSize = cpu_to_le16(4); 8369 ksmbd_debug(SMB, "successful in taking lock\n"); 8370 rsp->hdr.Status = STATUS_SUCCESS; 8371 rsp->Reserved = 0; 8372 err = ksmbd_iov_pin_rsp(work, rsp, sizeof(struct smb2_lock_rsp)); 8373 if (err) 8374 goto out; 8375 8376 ksmbd_fd_put(work, fp); 8377 return 0; 8378 8379 out: 8380 list_for_each_entry_safe(smb_lock, tmp, &lock_list, llist) { 8381 locks_free_lock(smb_lock->fl); 8382 list_del(&smb_lock->llist); 8383 kfree(smb_lock); 8384 } 8385 8386 list_for_each_entry_safe(smb_lock, tmp, &rollback_list, llist) { 8387 struct file_lock *rlock = NULL; 8388 8389 rlock = smb_flock_init(filp); 8390 if (rlock) { 8391 rlock->c.flc_type = F_UNLCK; 8392 rlock->fl_start = smb_lock->start; 8393 rlock->fl_end = smb_lock->end; 8394 8395 rc = vfs_lock_file(filp, F_SETLK, rlock, NULL); 8396 if (rc) 8397 pr_err("rollback unlock fail : %d\n", rc); 8398 } else { 8399 pr_err("rollback unlock alloc failed\n"); 8400 } 8401 8402 list_del(&smb_lock->llist); 8403 conn = smb_lock->conn; 8404 spin_lock(&conn->llist_lock); 8405 if (!list_empty(&smb_lock->flist)) 8406 list_del(&smb_lock->flist); 8407 list_del(&smb_lock->clist); 8408 smb_lock->conn = NULL; 8409 spin_unlock(&conn->llist_lock); 8410 ksmbd_conn_put(conn); 8411 8412 locks_free_lock(smb_lock->fl); 8413 if (rlock) 8414 locks_free_lock(rlock); 8415 kfree(smb_lock); 8416 } 8417 out2: 8418 ksmbd_debug(SMB, "failed in taking lock(flags : %x), err : %d\n", flags, err); 8419 8420 if (!rsp->hdr.Status) { 8421 if (err == -EINVAL) 8422 rsp->hdr.Status = STATUS_INVALID_PARAMETER; 8423 else if (err == -ENOMEM) 8424 rsp->hdr.Status = STATUS_INSUFFICIENT_RESOURCES; 8425 else if (err == -ENOENT) 8426 rsp->hdr.Status = STATUS_FILE_CLOSED; 8427 else 8428 rsp->hdr.Status = STATUS_LOCK_NOT_GRANTED; 8429 } 8430 8431 smb2_set_err_rsp(work); 8432 ksmbd_fd_put(work, fp); 8433 return err; 8434 } 8435 8436 static int fsctl_copychunk(struct ksmbd_work *work, 8437 struct copychunk_ioctl_req *ci_req, 8438 unsigned int cnt_code, 8439 unsigned int input_count, 8440 unsigned long long volatile_id, 8441 unsigned long long persistent_id, 8442 struct smb2_ioctl_rsp *rsp) 8443 { 8444 struct copychunk_ioctl_rsp *ci_rsp; 8445 struct ksmbd_file *src_fp = NULL, *dst_fp = NULL; 8446 struct srv_copychunk *chunks; 8447 unsigned int i, chunk_count, chunk_count_written = 0; 8448 unsigned int chunk_size_written = 0; 8449 loff_t total_size_written = 0; 8450 int ret = 0; 8451 8452 ci_rsp = (struct copychunk_ioctl_rsp *)&rsp->Buffer[0]; 8453 8454 rsp->VolatileFileId = volatile_id; 8455 rsp->PersistentFileId = persistent_id; 8456 ci_rsp->ChunksWritten = 8457 cpu_to_le32(ksmbd_server_side_copy_max_chunk_count()); 8458 ci_rsp->ChunkBytesWritten = 8459 cpu_to_le32(ksmbd_server_side_copy_max_chunk_size()); 8460 ci_rsp->TotalBytesWritten = 8461 cpu_to_le32(ksmbd_server_side_copy_max_total_size()); 8462 8463 chunk_count = le32_to_cpu(ci_req->ChunkCount); 8464 if (chunk_count == 0) 8465 goto out; 8466 total_size_written = 0; 8467 8468 /* verify the SRV_COPYCHUNK_COPY packet */ 8469 if (chunk_count > ksmbd_server_side_copy_max_chunk_count() || 8470 input_count < struct_size(ci_req, Chunks, chunk_count)) { 8471 rsp->hdr.Status = STATUS_INVALID_PARAMETER; 8472 return -EINVAL; 8473 } 8474 8475 chunks = &ci_req->Chunks[0]; 8476 for (i = 0; i < chunk_count; i++) { 8477 if (le32_to_cpu(chunks[i].Length) == 0 || 8478 le32_to_cpu(chunks[i].Length) > ksmbd_server_side_copy_max_chunk_size()) 8479 break; 8480 total_size_written += le32_to_cpu(chunks[i].Length); 8481 } 8482 8483 if (i < chunk_count || 8484 total_size_written > ksmbd_server_side_copy_max_total_size()) { 8485 rsp->hdr.Status = STATUS_INVALID_PARAMETER; 8486 return -EINVAL; 8487 } 8488 8489 src_fp = ksmbd_lookup_foreign_fd(work, 8490 le64_to_cpu(ci_req->SourceKeyU64[0])); 8491 dst_fp = ksmbd_lookup_fd_slow(work, volatile_id, persistent_id); 8492 ret = -EINVAL; 8493 if (!src_fp || 8494 src_fp->persistent_id != le64_to_cpu(ci_req->SourceKeyU64[1])) { 8495 rsp->hdr.Status = STATUS_OBJECT_NAME_NOT_FOUND; 8496 goto out; 8497 } 8498 8499 if (!dst_fp) { 8500 rsp->hdr.Status = STATUS_FILE_CLOSED; 8501 goto out; 8502 } 8503 8504 /* 8505 * FILE_READ_DATA should only be included in 8506 * the FSCTL_SRV_COPYCHUNK case 8507 */ 8508 if (cnt_code == FSCTL_SRV_COPYCHUNK && 8509 !(dst_fp->daccess & (FILE_READ_DATA_LE | FILE_GENERIC_READ_LE))) { 8510 rsp->hdr.Status = STATUS_ACCESS_DENIED; 8511 goto out; 8512 } 8513 8514 ret = ksmbd_vfs_copy_file_ranges(work, src_fp, dst_fp, 8515 chunks, chunk_count, 8516 &chunk_count_written, 8517 &chunk_size_written, 8518 &total_size_written); 8519 if (ret < 0) { 8520 if (ret == -EACCES) 8521 rsp->hdr.Status = STATUS_ACCESS_DENIED; 8522 if (ret == -EAGAIN) 8523 rsp->hdr.Status = STATUS_FILE_LOCK_CONFLICT; 8524 else if (ret == -EBADF) 8525 rsp->hdr.Status = STATUS_INVALID_HANDLE; 8526 else if (ret == -EFBIG || ret == -ENOSPC) 8527 rsp->hdr.Status = STATUS_DISK_FULL; 8528 else if (ret == -EINVAL) 8529 rsp->hdr.Status = STATUS_INVALID_PARAMETER; 8530 else if (ret == -EISDIR) 8531 rsp->hdr.Status = STATUS_FILE_IS_A_DIRECTORY; 8532 else if (ret == -E2BIG) 8533 rsp->hdr.Status = STATUS_INVALID_VIEW_SIZE; 8534 else 8535 rsp->hdr.Status = STATUS_UNEXPECTED_IO_ERROR; 8536 } 8537 8538 ci_rsp->ChunksWritten = cpu_to_le32(chunk_count_written); 8539 ci_rsp->ChunkBytesWritten = cpu_to_le32(chunk_size_written); 8540 ci_rsp->TotalBytesWritten = cpu_to_le32(total_size_written); 8541 out: 8542 ksmbd_fd_put(work, src_fp); 8543 ksmbd_fd_put(work, dst_fp); 8544 return ret; 8545 } 8546 8547 static __be32 idev_ipv4_address(struct in_device *idev) 8548 { 8549 __be32 addr = 0; 8550 8551 struct in_ifaddr *ifa; 8552 8553 rcu_read_lock(); 8554 in_dev_for_each_ifa_rcu(ifa, idev) { 8555 if (ifa->ifa_flags & IFA_F_SECONDARY) 8556 continue; 8557 8558 addr = ifa->ifa_address; 8559 break; 8560 } 8561 rcu_read_unlock(); 8562 return addr; 8563 } 8564 8565 static int fsctl_query_iface_info_ioctl(struct ksmbd_conn *conn, 8566 struct smb2_ioctl_rsp *rsp, 8567 unsigned int out_buf_len) 8568 { 8569 struct network_interface_info_ioctl_rsp *nii_rsp = NULL; 8570 int nbytes = 0; 8571 struct net_device *netdev; 8572 struct sockaddr_storage_rsp *sockaddr_storage; 8573 unsigned int flags; 8574 unsigned long long speed; 8575 8576 rtnl_lock(); 8577 for_each_netdev(&init_net, netdev) { 8578 bool ipv4_set = false; 8579 8580 if (netdev->type == ARPHRD_LOOPBACK) 8581 continue; 8582 8583 if (!ksmbd_find_netdev_name_iface_list(netdev->name)) 8584 continue; 8585 8586 flags = netif_get_flags(netdev); 8587 if (!(flags & IFF_RUNNING)) 8588 continue; 8589 ipv6_retry: 8590 if (out_buf_len < 8591 nbytes + sizeof(struct network_interface_info_ioctl_rsp)) { 8592 rtnl_unlock(); 8593 return -ENOSPC; 8594 } 8595 8596 nii_rsp = (struct network_interface_info_ioctl_rsp *) 8597 &rsp->Buffer[nbytes]; 8598 nii_rsp->IfIndex = cpu_to_le32(netdev->ifindex); 8599 8600 nii_rsp->Capability = 0; 8601 if (netdev->real_num_tx_queues > 1) 8602 nii_rsp->Capability |= RSS_CAPABLE; 8603 if (ksmbd_rdma_capable_netdev(netdev)) 8604 nii_rsp->Capability |= RDMA_CAPABLE; 8605 8606 nii_rsp->Next = cpu_to_le32(152); 8607 nii_rsp->Reserved = 0; 8608 8609 if (netdev->ethtool_ops->get_link_ksettings) { 8610 struct ethtool_link_ksettings cmd; 8611 8612 netdev->ethtool_ops->get_link_ksettings(netdev, &cmd); 8613 speed = cmd.base.speed; 8614 } else { 8615 ksmbd_debug(SMB, "%s %s\n", netdev->name, 8616 "speed is unknown, defaulting to 1Gb/sec"); 8617 speed = SPEED_1000; 8618 } 8619 8620 speed *= 1000000; 8621 nii_rsp->LinkSpeed = cpu_to_le64(speed); 8622 8623 sockaddr_storage = (struct sockaddr_storage_rsp *) 8624 nii_rsp->SockAddr_Storage; 8625 memset(sockaddr_storage, 0, 128); 8626 8627 if (!ipv4_set) { 8628 struct in_device *idev; 8629 8630 sockaddr_storage->Family = INTERNETWORK; 8631 sockaddr_storage->addr4.Port = 0; 8632 8633 idev = __in_dev_get_rtnl(netdev); 8634 if (!idev) 8635 continue; 8636 sockaddr_storage->addr4.IPv4Address = 8637 idev_ipv4_address(idev); 8638 nbytes += sizeof(struct network_interface_info_ioctl_rsp); 8639 ipv4_set = true; 8640 goto ipv6_retry; 8641 } else { 8642 struct inet6_dev *idev6; 8643 struct inet6_ifaddr *ifa; 8644 __u8 *ipv6_addr = sockaddr_storage->addr6.IPv6Address; 8645 8646 sockaddr_storage->Family = INTERNETWORKV6; 8647 sockaddr_storage->addr6.Port = 0; 8648 sockaddr_storage->addr6.FlowInfo = 0; 8649 8650 idev6 = __in6_dev_get(netdev); 8651 if (!idev6) 8652 continue; 8653 8654 list_for_each_entry(ifa, &idev6->addr_list, if_list) { 8655 if (ifa->flags & (IFA_F_TENTATIVE | 8656 IFA_F_DEPRECATED)) 8657 continue; 8658 memcpy(ipv6_addr, ifa->addr.s6_addr, 16); 8659 break; 8660 } 8661 sockaddr_storage->addr6.ScopeId = 0; 8662 nbytes += sizeof(struct network_interface_info_ioctl_rsp); 8663 } 8664 } 8665 rtnl_unlock(); 8666 8667 /* zero if this is last one */ 8668 if (nii_rsp) 8669 nii_rsp->Next = 0; 8670 8671 rsp->PersistentFileId = SMB2_NO_FID; 8672 rsp->VolatileFileId = SMB2_NO_FID; 8673 return nbytes; 8674 } 8675 8676 static int fsctl_validate_negotiate_info(struct ksmbd_conn *conn, 8677 struct validate_negotiate_info_req *neg_req, 8678 struct validate_negotiate_info_rsp *neg_rsp, 8679 unsigned int in_buf_len) 8680 { 8681 int ret = 0; 8682 int dialect; 8683 8684 if (in_buf_len < offsetof(struct validate_negotiate_info_req, Dialects) + 8685 le16_to_cpu(neg_req->DialectCount) * sizeof(__le16)) 8686 return -EINVAL; 8687 8688 dialect = ksmbd_lookup_dialect_by_id(neg_req->Dialects, 8689 neg_req->DialectCount); 8690 if (dialect == BAD_PROT_ID || dialect != conn->dialect) { 8691 ret = -EINVAL; 8692 goto err_out; 8693 } 8694 8695 if (memcmp(neg_req->Guid, conn->ClientGUID, SMB2_CLIENT_GUID_SIZE)) { 8696 ret = -EINVAL; 8697 goto err_out; 8698 } 8699 8700 if (le16_to_cpu(neg_req->SecurityMode) != conn->cli_sec_mode) { 8701 ret = -EINVAL; 8702 goto err_out; 8703 } 8704 8705 if (le32_to_cpu(neg_req->Capabilities) != conn->cli_cap) { 8706 ret = -EINVAL; 8707 goto err_out; 8708 } 8709 8710 neg_rsp->Capabilities = cpu_to_le32(conn->vals->req_capabilities); 8711 memset(neg_rsp->Guid, 0, SMB2_CLIENT_GUID_SIZE); 8712 neg_rsp->SecurityMode = cpu_to_le16(conn->srv_sec_mode); 8713 neg_rsp->Dialect = cpu_to_le16(conn->dialect); 8714 err_out: 8715 return ret; 8716 } 8717 8718 static int fsctl_query_allocated_ranges(struct ksmbd_work *work, u64 id, 8719 struct file_allocated_range_buffer *qar_req, 8720 struct file_allocated_range_buffer *qar_rsp, 8721 unsigned int in_count, unsigned int *out_count) 8722 { 8723 struct ksmbd_file *fp; 8724 loff_t start, length; 8725 int ret = 0; 8726 8727 *out_count = 0; 8728 if (in_count == 0) 8729 return -EINVAL; 8730 8731 start = le64_to_cpu(qar_req->file_offset); 8732 length = le64_to_cpu(qar_req->length); 8733 8734 if (start < 0 || length < 0) 8735 return -EINVAL; 8736 8737 fp = ksmbd_lookup_fd_fast(work, id); 8738 if (!fp) 8739 return -ENOENT; 8740 8741 ret = ksmbd_vfs_fqar_lseek(fp, start, length, 8742 qar_rsp, in_count, out_count); 8743 if (ret && ret != -E2BIG) 8744 *out_count = 0; 8745 8746 ksmbd_fd_put(work, fp); 8747 return ret; 8748 } 8749 8750 static int fsctl_pipe_transceive(struct ksmbd_work *work, u64 id, 8751 unsigned int out_buf_len, 8752 struct smb2_ioctl_req *req, 8753 struct smb2_ioctl_rsp *rsp) 8754 { 8755 struct ksmbd_rpc_command *rpc_resp; 8756 char *data_buf = (char *)req + le32_to_cpu(req->InputOffset); 8757 int nbytes = 0; 8758 8759 rpc_resp = ksmbd_rpc_ioctl(work->sess, id, data_buf, 8760 le32_to_cpu(req->InputCount)); 8761 if (rpc_resp) { 8762 if (rpc_resp->flags == KSMBD_RPC_SOME_NOT_MAPPED) { 8763 /* 8764 * set STATUS_SOME_NOT_MAPPED response 8765 * for unknown domain sid. 8766 */ 8767 rsp->hdr.Status = STATUS_SOME_NOT_MAPPED; 8768 } else if (rpc_resp->flags == KSMBD_RPC_ENOTIMPLEMENTED) { 8769 rsp->hdr.Status = STATUS_NOT_SUPPORTED; 8770 goto out; 8771 } else if (rpc_resp->flags != KSMBD_RPC_OK) { 8772 rsp->hdr.Status = STATUS_INVALID_PARAMETER; 8773 goto out; 8774 } 8775 8776 nbytes = rpc_resp->payload_sz; 8777 if (rpc_resp->payload_sz > out_buf_len) { 8778 rsp->hdr.Status = STATUS_BUFFER_OVERFLOW; 8779 nbytes = out_buf_len; 8780 } 8781 8782 if (!rpc_resp->payload_sz) { 8783 rsp->hdr.Status = 8784 STATUS_UNEXPECTED_IO_ERROR; 8785 goto out; 8786 } 8787 8788 memcpy((char *)rsp->Buffer, rpc_resp->payload, nbytes); 8789 } 8790 out: 8791 kvfree(rpc_resp); 8792 return nbytes; 8793 } 8794 8795 static inline int fsctl_set_sparse(struct ksmbd_work *work, u64 id, 8796 struct file_sparse *sparse) 8797 { 8798 struct ksmbd_file *fp; 8799 struct mnt_idmap *idmap; 8800 int ret = 0; 8801 __le32 old_fattr; 8802 8803 if (!test_tree_conn_flag(work->tcon, KSMBD_TREE_CONN_FLAG_WRITABLE)) { 8804 ksmbd_debug(SMB, "User does not have write permission\n"); 8805 return -EACCES; 8806 } 8807 8808 fp = ksmbd_lookup_fd_fast(work, id); 8809 if (!fp) 8810 return -ENOENT; 8811 8812 if (!(fp->daccess & (FILE_WRITE_DATA_LE | FILE_WRITE_ATTRIBUTES_LE))) { 8813 ret = -EACCES; 8814 goto out; 8815 } 8816 8817 idmap = file_mnt_idmap(fp->filp); 8818 8819 old_fattr = fp->f_ci->m_fattr; 8820 if (sparse->SetSparse) 8821 fp->f_ci->m_fattr |= FILE_ATTRIBUTE_SPARSE_FILE_LE; 8822 else 8823 fp->f_ci->m_fattr &= ~FILE_ATTRIBUTE_SPARSE_FILE_LE; 8824 8825 if (fp->f_ci->m_fattr != old_fattr && 8826 test_share_config_flag(work->tcon->share_conf, 8827 KSMBD_SHARE_FLAG_STORE_DOS_ATTRS)) { 8828 const struct cred *saved_cred; 8829 struct xattr_dos_attrib da; 8830 8831 ret = ksmbd_vfs_get_dos_attrib_xattr(idmap, 8832 fp->filp->f_path.dentry, &da); 8833 if (ret <= 0) 8834 goto out; 8835 8836 da.attr = le32_to_cpu(fp->f_ci->m_fattr); 8837 saved_cred = override_creds(fp->filp->f_cred); 8838 ret = ksmbd_vfs_set_dos_attrib_xattr(idmap, 8839 &fp->filp->f_path, 8840 &da, true); 8841 revert_creds(saved_cred); 8842 if (ret) 8843 fp->f_ci->m_fattr = old_fattr; 8844 } 8845 8846 out: 8847 ksmbd_fd_put(work, fp); 8848 return ret; 8849 } 8850 8851 static int fsctl_request_resume_key(struct ksmbd_work *work, 8852 struct smb2_ioctl_req *req, 8853 struct resume_key_ioctl_rsp *key_rsp) 8854 { 8855 struct ksmbd_file *fp; 8856 8857 fp = ksmbd_lookup_fd_slow(work, req->VolatileFileId, req->PersistentFileId); 8858 if (!fp) 8859 return -ENOENT; 8860 8861 memset(key_rsp, 0, sizeof(*key_rsp)); 8862 key_rsp->ResumeKeyU64[0] = req->VolatileFileId; 8863 key_rsp->ResumeKeyU64[1] = req->PersistentFileId; 8864 ksmbd_fd_put(work, fp); 8865 8866 return 0; 8867 } 8868 8869 /** 8870 * smb2_ioctl() - handler for smb2 ioctl command 8871 * @work: smb work containing ioctl command buffer 8872 * 8873 * Return: 0 on success, otherwise error 8874 */ 8875 int smb2_ioctl(struct ksmbd_work *work) 8876 { 8877 struct smb2_ioctl_req *req; 8878 struct smb2_ioctl_rsp *rsp; 8879 unsigned int cnt_code, nbytes = 0, out_buf_len, in_buf_len; 8880 u64 id = KSMBD_NO_FID; 8881 struct ksmbd_conn *conn = work->conn; 8882 int ret = 0; 8883 char *buffer; 8884 8885 ksmbd_debug(SMB, "Received smb2 ioctl request\n"); 8886 8887 if (work->next_smb2_rcv_hdr_off) { 8888 req = ksmbd_req_buf_next(work); 8889 rsp = ksmbd_resp_buf_next(work); 8890 if (smb2_compound_has_failed(work, &rsp->hdr)) 8891 return -EACCES; 8892 if (!has_file_id(req->VolatileFileId)) { 8893 ksmbd_debug(SMB, "Compound request set FID = %llu\n", 8894 work->compound_fid); 8895 id = work->compound_fid; 8896 } 8897 } else { 8898 req = smb_get_msg(work->request_buf); 8899 rsp = smb_get_msg(work->response_buf); 8900 } 8901 8902 if (!has_file_id(id)) 8903 id = req->VolatileFileId; 8904 8905 if (req->Flags != cpu_to_le32(SMB2_0_IOCTL_IS_FSCTL)) { 8906 ret = -EOPNOTSUPP; 8907 goto out; 8908 } 8909 8910 buffer = (char *)req + le32_to_cpu(req->InputOffset); 8911 8912 cnt_code = le32_to_cpu(req->CtlCode); 8913 ret = smb2_calc_max_out_buf_len(work, 8914 offsetof(struct smb2_ioctl_rsp, Buffer), 8915 le32_to_cpu(req->MaxOutputResponse)); 8916 if (ret < 0) { 8917 rsp->hdr.Status = STATUS_INVALID_PARAMETER; 8918 goto out; 8919 } 8920 out_buf_len = (unsigned int)ret; 8921 in_buf_len = le32_to_cpu(req->InputCount); 8922 8923 switch (cnt_code) { 8924 case FSCTL_DFS_GET_REFERRALS: 8925 case FSCTL_DFS_GET_REFERRALS_EX: 8926 /* Not support DFS yet */ 8927 ret = -EOPNOTSUPP; 8928 rsp->hdr.Status = STATUS_FS_DRIVER_REQUIRED; 8929 goto out2; 8930 case FSCTL_GET_COMPRESSION: { 8931 struct compress_ioctl *cmpr_rsp; 8932 struct ksmbd_file *fp; 8933 u16 fmt; 8934 8935 if (out_buf_len < sizeof(struct compress_ioctl)) { 8936 ret = -EINVAL; 8937 goto out; 8938 } 8939 8940 fp = ksmbd_lookup_fd_fast(work, id); 8941 if (!fp) { 8942 ret = -ENOENT; 8943 goto out; 8944 } 8945 8946 ret = ksmbd_vfs_get_compression(fp, &fmt); 8947 ksmbd_fd_put(work, fp); 8948 if (ret < 0) 8949 goto out; 8950 8951 cmpr_rsp = (struct compress_ioctl *)&rsp->Buffer[0]; 8952 cmpr_rsp->CompressionState = cpu_to_le16(fmt); 8953 nbytes = sizeof(struct compress_ioctl); 8954 rsp->PersistentFileId = req->PersistentFileId; 8955 rsp->VolatileFileId = req->VolatileFileId; 8956 break; 8957 } 8958 case FSCTL_SET_COMPRESSION: { 8959 struct compress_ioctl *cmpr_req; 8960 struct ksmbd_file *fp; 8961 8962 if (in_buf_len < sizeof(struct compress_ioctl)) { 8963 ret = -EINVAL; 8964 goto out; 8965 } 8966 8967 if (!test_tree_conn_flag(work->tcon, KSMBD_TREE_CONN_FLAG_WRITABLE)) { 8968 ksmbd_debug(SMB, "User does not have write permission\n"); 8969 ret = -EACCES; 8970 goto out; 8971 } 8972 8973 cmpr_req = (struct compress_ioctl *)buffer; 8974 fp = ksmbd_lookup_fd_fast(work, id); 8975 if (!fp) { 8976 ret = -ENOENT; 8977 goto out; 8978 } 8979 8980 ret = ksmbd_vfs_set_compression(work, fp, le16_to_cpu(cmpr_req->CompressionState)); 8981 ksmbd_fd_put(work, fp); 8982 if (ret) 8983 goto out; 8984 break; 8985 } 8986 case FSCTL_CREATE_OR_GET_OBJECT_ID: 8987 { 8988 struct file_object_buf_type1_ioctl_rsp *obj_buf; 8989 struct ksmbd_file *fp; 8990 8991 fp = ksmbd_lookup_fd_fast(work, id); 8992 if (!fp) { 8993 ret = -EBADF; 8994 rsp->hdr.Status = STATUS_FILE_CLOSED; 8995 goto out2; 8996 } 8997 ksmbd_fd_put(work, fp); 8998 8999 nbytes = sizeof(struct file_object_buf_type1_ioctl_rsp); 9000 obj_buf = (struct file_object_buf_type1_ioctl_rsp *) 9001 &rsp->Buffer[0]; 9002 9003 /* 9004 * TODO: This is dummy implementation to pass smbtorture 9005 * Need to check correct response later 9006 */ 9007 memset(obj_buf->ObjectId, 0x0, 16); 9008 memset(obj_buf->BirthVolumeId, 0x0, 16); 9009 memset(obj_buf->BirthObjectId, 0x0, 16); 9010 memset(obj_buf->DomainId, 0x0, 16); 9011 9012 break; 9013 } 9014 case FSCTL_PIPE_TRANSCEIVE: 9015 out_buf_len = min_t(u32, KSMBD_IPC_MAX_PAYLOAD, out_buf_len); 9016 nbytes = fsctl_pipe_transceive(work, id, out_buf_len, req, rsp); 9017 break; 9018 case FSCTL_VALIDATE_NEGOTIATE_INFO: 9019 if (conn->dialect < SMB30_PROT_ID) { 9020 ret = -EOPNOTSUPP; 9021 goto out; 9022 } 9023 9024 if (in_buf_len < offsetof(struct validate_negotiate_info_req, 9025 Dialects)) { 9026 ret = -EINVAL; 9027 goto out; 9028 } 9029 9030 if (out_buf_len < sizeof(struct validate_negotiate_info_rsp)) { 9031 ret = -EINVAL; 9032 goto out; 9033 } 9034 9035 ret = fsctl_validate_negotiate_info(conn, 9036 (struct validate_negotiate_info_req *)buffer, 9037 (struct validate_negotiate_info_rsp *)&rsp->Buffer[0], 9038 in_buf_len); 9039 if (ret < 0) 9040 goto out; 9041 9042 nbytes = sizeof(struct validate_negotiate_info_rsp); 9043 rsp->PersistentFileId = SMB2_NO_FID; 9044 rsp->VolatileFileId = SMB2_NO_FID; 9045 break; 9046 case FSCTL_QUERY_NETWORK_INTERFACE_INFO: 9047 ret = fsctl_query_iface_info_ioctl(conn, rsp, out_buf_len); 9048 if (ret < 0) 9049 goto out; 9050 nbytes = ret; 9051 break; 9052 case FSCTL_SRV_REQUEST_RESUME_KEY: 9053 if (out_buf_len < sizeof(struct resume_key_ioctl_rsp)) { 9054 ret = -EINVAL; 9055 goto out; 9056 } 9057 9058 ret = fsctl_request_resume_key(work, req, 9059 (struct resume_key_ioctl_rsp *)&rsp->Buffer[0]); 9060 if (ret < 0) 9061 goto out; 9062 rsp->PersistentFileId = req->PersistentFileId; 9063 rsp->VolatileFileId = req->VolatileFileId; 9064 nbytes = sizeof(struct resume_key_ioctl_rsp); 9065 break; 9066 case FSCTL_SRV_COPYCHUNK: 9067 case FSCTL_SRV_COPYCHUNK_WRITE: 9068 if (!test_tree_conn_flag(work->tcon, KSMBD_TREE_CONN_FLAG_WRITABLE)) { 9069 ksmbd_debug(SMB, 9070 "User does not have write permission\n"); 9071 ret = -EACCES; 9072 goto out; 9073 } 9074 9075 if (in_buf_len <= sizeof(struct copychunk_ioctl_req)) { 9076 ret = -EINVAL; 9077 goto out; 9078 } 9079 9080 if (out_buf_len < sizeof(struct copychunk_ioctl_rsp)) { 9081 ret = -EINVAL; 9082 goto out; 9083 } 9084 9085 nbytes = sizeof(struct copychunk_ioctl_rsp); 9086 rsp->VolatileFileId = req->VolatileFileId; 9087 rsp->PersistentFileId = req->PersistentFileId; 9088 fsctl_copychunk(work, 9089 (struct copychunk_ioctl_req *)buffer, 9090 le32_to_cpu(req->CtlCode), 9091 le32_to_cpu(req->InputCount), 9092 req->VolatileFileId, 9093 req->PersistentFileId, 9094 rsp); 9095 break; 9096 case FSCTL_SET_SPARSE: 9097 if (in_buf_len < sizeof(struct file_sparse)) { 9098 ret = -EINVAL; 9099 goto out; 9100 } 9101 9102 ret = fsctl_set_sparse(work, id, (struct file_sparse *)buffer); 9103 if (ret < 0) 9104 goto out; 9105 break; 9106 case FSCTL_SET_ZERO_DATA: 9107 { 9108 struct file_zero_data_information *zero_data; 9109 struct ksmbd_file *fp; 9110 loff_t off, len, bfz; 9111 9112 if (!test_tree_conn_flag(work->tcon, KSMBD_TREE_CONN_FLAG_WRITABLE)) { 9113 ksmbd_debug(SMB, 9114 "User does not have write permission\n"); 9115 ret = -EACCES; 9116 goto out; 9117 } 9118 9119 if (in_buf_len < sizeof(struct file_zero_data_information)) { 9120 ret = -EINVAL; 9121 goto out; 9122 } 9123 9124 zero_data = 9125 (struct file_zero_data_information *)buffer; 9126 9127 off = le64_to_cpu(zero_data->FileOffset); 9128 bfz = le64_to_cpu(zero_data->BeyondFinalZero); 9129 if (off < 0 || bfz < 0 || off > bfz) { 9130 ret = -EINVAL; 9131 goto out; 9132 } 9133 9134 len = bfz - off; 9135 if (len) { 9136 fp = ksmbd_lookup_fd_fast(work, id); 9137 if (!fp) { 9138 ret = -ENOENT; 9139 goto out; 9140 } 9141 9142 if (!(fp->daccess & FILE_WRITE_DATA_LE)) { 9143 ksmbd_fd_put(work, fp); 9144 ret = -EACCES; 9145 goto out; 9146 } 9147 9148 ret = ksmbd_vfs_zero_data(work, fp, off, len); 9149 ksmbd_fd_put(work, fp); 9150 if (ret < 0) 9151 goto out; 9152 } 9153 break; 9154 } 9155 case FSCTL_QUERY_ALLOCATED_RANGES: 9156 if (in_buf_len < sizeof(struct file_allocated_range_buffer)) { 9157 ret = -EINVAL; 9158 goto out; 9159 } 9160 9161 ret = fsctl_query_allocated_ranges(work, id, 9162 (struct file_allocated_range_buffer *)buffer, 9163 (struct file_allocated_range_buffer *)&rsp->Buffer[0], 9164 out_buf_len / 9165 sizeof(struct file_allocated_range_buffer), &nbytes); 9166 if (ret == -E2BIG) { 9167 rsp->hdr.Status = STATUS_BUFFER_OVERFLOW; 9168 } else if (ret < 0) { 9169 nbytes = 0; 9170 goto out; 9171 } 9172 9173 nbytes *= sizeof(struct file_allocated_range_buffer); 9174 break; 9175 case FSCTL_GET_REPARSE_POINT: 9176 { 9177 struct reparse_data_buffer *reparse_ptr; 9178 struct ksmbd_file *fp; 9179 9180 reparse_ptr = (struct reparse_data_buffer *)&rsp->Buffer[0]; 9181 fp = ksmbd_lookup_fd_fast(work, id); 9182 if (!fp) { 9183 pr_err("not found fp!!\n"); 9184 ret = -ENOENT; 9185 goto out; 9186 } 9187 9188 reparse_ptr->ReparseTag = 9189 smb2_get_reparse_tag_special_file(file_inode(fp->filp)->i_mode); 9190 reparse_ptr->ReparseDataLength = 0; 9191 ksmbd_fd_put(work, fp); 9192 nbytes = sizeof(struct reparse_data_buffer); 9193 break; 9194 } 9195 case FSCTL_DUPLICATE_EXTENTS_TO_FILE: 9196 { 9197 struct ksmbd_file *fp_in, *fp_out = NULL; 9198 struct duplicate_extents_to_file *dup_ext; 9199 loff_t src_off, dst_off, length, cloned; 9200 9201 if (in_buf_len < sizeof(struct duplicate_extents_to_file)) { 9202 ret = -EINVAL; 9203 goto out; 9204 } 9205 9206 dup_ext = (struct duplicate_extents_to_file *)buffer; 9207 9208 fp_in = ksmbd_lookup_fd_slow(work, dup_ext->VolatileFileHandle, 9209 dup_ext->PersistentFileHandle); 9210 if (!fp_in) { 9211 pr_err("not found file handle in duplicate extent to file\n"); 9212 ret = -ENOENT; 9213 goto out; 9214 } 9215 9216 fp_out = ksmbd_lookup_fd_fast(work, id); 9217 if (!fp_out) { 9218 pr_err("not found fp\n"); 9219 ret = -ENOENT; 9220 goto dup_ext_out; 9221 } 9222 9223 if (!test_tree_conn_flag(work->tcon, 9224 KSMBD_TREE_CONN_FLAG_WRITABLE)) { 9225 ret = -EACCES; 9226 goto dup_ext_out; 9227 } 9228 9229 if (!(fp_out->daccess & FILE_WRITE_DATA_LE)) { 9230 ret = -EACCES; 9231 goto dup_ext_out; 9232 } 9233 if (!(fp_in->daccess & FILE_READ_DATA_LE)) { 9234 ret = -EACCES; 9235 goto dup_ext_out; 9236 } 9237 9238 src_off = le64_to_cpu(dup_ext->SourceFileOffset); 9239 dst_off = le64_to_cpu(dup_ext->TargetFileOffset); 9240 length = le64_to_cpu(dup_ext->ByteCount); 9241 /* 9242 * XXX: It is not clear if FSCTL_DUPLICATE_EXTENTS_TO_FILE 9243 * should fall back to vfs_copy_file_range(). This could be 9244 * beneficial when re-exporting nfs/smb mount, but note that 9245 * this can result in partial copy that returns an error status. 9246 * If/when FSCTL_DUPLICATE_EXTENTS_TO_FILE_EX is implemented, 9247 * fall back to vfs_copy_file_range(), should be avoided when 9248 * the flag DUPLICATE_EXTENTS_DATA_EX_SOURCE_ATOMIC is set. 9249 */ 9250 cloned = vfs_clone_file_range(fp_in->filp, src_off, 9251 fp_out->filp, dst_off, length, 0); 9252 if (cloned == -EXDEV || cloned == -EOPNOTSUPP) { 9253 ret = -EOPNOTSUPP; 9254 goto dup_ext_out; 9255 } else if (cloned != length) { 9256 cloned = vfs_copy_file_range(fp_in->filp, src_off, 9257 fp_out->filp, dst_off, 9258 length, 0); 9259 if (cloned != length) { 9260 if (cloned < 0) 9261 ret = cloned; 9262 else 9263 ret = -EINVAL; 9264 } 9265 } 9266 9267 dup_ext_out: 9268 ksmbd_fd_put(work, fp_in); 9269 ksmbd_fd_put(work, fp_out); 9270 if (ret < 0) 9271 goto out; 9272 break; 9273 } 9274 default: 9275 ksmbd_debug(SMB, "not implemented yet ioctl command 0x%x\n", 9276 cnt_code); 9277 ret = -EOPNOTSUPP; 9278 goto out; 9279 } 9280 9281 rsp->CtlCode = cpu_to_le32(cnt_code); 9282 rsp->InputCount = cpu_to_le32(0); 9283 rsp->InputOffset = cpu_to_le32(112); 9284 rsp->OutputOffset = cpu_to_le32(112); 9285 rsp->OutputCount = cpu_to_le32(nbytes); 9286 rsp->StructureSize = cpu_to_le16(49); 9287 rsp->Reserved = cpu_to_le16(0); 9288 rsp->Flags = cpu_to_le32(0); 9289 rsp->Reserved2 = cpu_to_le32(0); 9290 ret = ksmbd_iov_pin_rsp(work, rsp, sizeof(struct smb2_ioctl_rsp) + nbytes); 9291 if (!ret) 9292 return ret; 9293 9294 out: 9295 if (ret == -EACCES) 9296 rsp->hdr.Status = STATUS_ACCESS_DENIED; 9297 else if (ret == -ENOENT) 9298 rsp->hdr.Status = STATUS_OBJECT_NAME_NOT_FOUND; 9299 else if (ret == -EOPNOTSUPP) 9300 rsp->hdr.Status = STATUS_NOT_SUPPORTED; 9301 else if (ret == -ENOSPC) 9302 rsp->hdr.Status = STATUS_BUFFER_TOO_SMALL; 9303 else if (ret < 0 || rsp->hdr.Status == 0) 9304 rsp->hdr.Status = STATUS_INVALID_PARAMETER; 9305 9306 out2: 9307 smb2_set_err_rsp(work); 9308 return ret; 9309 } 9310 9311 /** 9312 * smb20_oplock_break_ack() - handler for smb2.0 oplock break command 9313 * @work: smb work containing oplock break command buffer 9314 * 9315 * Return: 0 9316 */ 9317 static void smb20_oplock_break_ack(struct ksmbd_work *work) 9318 { 9319 struct smb2_oplock_break *req; 9320 struct smb2_oplock_break *rsp; 9321 struct ksmbd_file *fp; 9322 struct oplock_info *opinfo = NULL; 9323 __le32 status = STATUS_SUCCESS; 9324 int ret; 9325 u64 volatile_id, persistent_id; 9326 char req_oplevel = 0, rsp_oplevel = 0; 9327 9328 WORK_BUFFERS(work, req, rsp); 9329 9330 volatile_id = req->VolatileFid; 9331 persistent_id = req->PersistentFid; 9332 req_oplevel = req->OplockLevel; 9333 ksmbd_debug(OPLOCK, "v_id %llu, p_id %llu request oplock level %d\n", 9334 volatile_id, persistent_id, req_oplevel); 9335 9336 fp = ksmbd_lookup_fd_slow(work, volatile_id, persistent_id); 9337 if (!fp) { 9338 rsp->hdr.Status = STATUS_FILE_CLOSED; 9339 smb2_set_err_rsp(work); 9340 return; 9341 } 9342 9343 opinfo = opinfo_get(fp); 9344 if (!opinfo) { 9345 pr_err("unexpected null oplock_info\n"); 9346 rsp->hdr.Status = STATUS_INVALID_OPLOCK_PROTOCOL; 9347 smb2_set_err_rsp(work); 9348 ksmbd_fd_put(work, fp); 9349 return; 9350 } 9351 9352 if (opinfo->op_state != OPLOCK_ACK_WAIT) { 9353 ksmbd_debug(SMB, "unexpected oplock state 0x%x\n", 9354 opinfo->op_state); 9355 if (opinfo->level == SMB2_OPLOCK_LEVEL_NONE) 9356 status = STATUS_INVALID_OPLOCK_PROTOCOL; 9357 else 9358 status = STATUS_INVALID_DEVICE_STATE; 9359 goto err_out; 9360 } 9361 9362 if (req_oplevel == SMB2_OPLOCK_LEVEL_LEASE) { 9363 opinfo->level = SMB2_OPLOCK_LEVEL_NONE; 9364 status = STATUS_INVALID_PARAMETER; 9365 goto err_out; 9366 } 9367 9368 if (opinfo->level == SMB2_OPLOCK_LEVEL_NONE) { 9369 status = STATUS_INVALID_OPLOCK_PROTOCOL; 9370 goto err_out; 9371 } 9372 9373 if (opinfo->level == SMB2_OPLOCK_LEVEL_EXCLUSIVE && 9374 req_oplevel != SMB2_OPLOCK_LEVEL_II && 9375 req_oplevel != SMB2_OPLOCK_LEVEL_NONE) { 9376 opinfo->level = SMB2_OPLOCK_LEVEL_NONE; 9377 status = STATUS_INVALID_OPLOCK_PROTOCOL; 9378 goto err_out; 9379 } 9380 9381 if (opinfo->level == SMB2_OPLOCK_LEVEL_BATCH && 9382 req_oplevel != SMB2_OPLOCK_LEVEL_II && 9383 req_oplevel != SMB2_OPLOCK_LEVEL_NONE && 9384 req_oplevel != SMB2_OPLOCK_LEVEL_EXCLUSIVE) { 9385 opinfo->level = SMB2_OPLOCK_LEVEL_NONE; 9386 status = STATUS_INVALID_OPLOCK_PROTOCOL; 9387 goto err_out; 9388 } 9389 9390 if (opinfo->level == SMB2_OPLOCK_LEVEL_II && 9391 req_oplevel != SMB2_OPLOCK_LEVEL_NONE) { 9392 opinfo->level = SMB2_OPLOCK_LEVEL_NONE; 9393 status = STATUS_INVALID_OPLOCK_PROTOCOL; 9394 goto err_out; 9395 } 9396 9397 if (req_oplevel == SMB2_OPLOCK_LEVEL_EXCLUSIVE) 9398 rsp_oplevel = SMB2_OPLOCK_LEVEL_NONE; 9399 else 9400 rsp_oplevel = req_oplevel; 9401 9402 opinfo->level = rsp_oplevel; 9403 9404 rsp->StructureSize = cpu_to_le16(24); 9405 rsp->OplockLevel = rsp_oplevel; 9406 rsp->Reserved = 0; 9407 rsp->Reserved2 = 0; 9408 rsp->VolatileFid = volatile_id; 9409 rsp->PersistentFid = persistent_id; 9410 ret = ksmbd_iov_pin_rsp(work, rsp, sizeof(struct smb2_oplock_break)); 9411 if (ret) 9412 ksmbd_debug(SMB, "failed to pin oplock break response: %d\n", 9413 ret); 9414 goto out; 9415 9416 err_out: 9417 rsp->hdr.Status = status; 9418 smb2_set_err_rsp(work); 9419 9420 out: 9421 opinfo->op_state = OPLOCK_STATE_NONE; 9422 wake_up_interruptible_all(&opinfo->oplock_q); 9423 opinfo_put(opinfo); 9424 ksmbd_fd_put(work, fp); 9425 } 9426 9427 static bool smb2_lease_state_valid(__le32 state) 9428 { 9429 return !(state & ~(SMB2_LEASE_READ_CACHING_LE | 9430 SMB2_LEASE_HANDLE_CACHING_LE | 9431 SMB2_LEASE_WRITE_CACHING_LE)); 9432 } 9433 9434 static int check_lease_state(struct lease *lease, __le32 req_state) 9435 { 9436 if (smb2_lease_state_valid(req_state) && 9437 !(req_state & ~lease->new_state)) 9438 return 0; 9439 9440 return 1; 9441 } 9442 9443 /** 9444 * smb21_lease_break_ack() - handler for smb2.1 lease break command 9445 * @work: smb work containing lease break command buffer 9446 * 9447 * Return: 0 9448 */ 9449 static void smb21_lease_break_ack(struct ksmbd_work *work) 9450 { 9451 struct ksmbd_conn *conn = work->conn; 9452 struct smb2_lease_ack *req; 9453 struct smb2_lease_ack *rsp; 9454 struct oplock_info *opinfo; 9455 int ret = 0; 9456 __le32 lease_state; 9457 struct lease *lease; 9458 9459 WORK_BUFFERS(work, req, rsp); 9460 9461 ksmbd_debug(OPLOCK, "smb21 lease break, lease state(0x%x)\n", 9462 le32_to_cpu(req->LeaseState)); 9463 opinfo = lookup_lease_in_table(conn, req->LeaseKey); 9464 if (!opinfo) { 9465 ksmbd_debug(OPLOCK, "file not opened\n"); 9466 smb2_set_err_rsp(work); 9467 rsp->hdr.Status = STATUS_UNSUCCESSFUL; 9468 return; 9469 } 9470 lease = opinfo->o_lease; 9471 9472 if (opinfo->op_state == OPLOCK_STATE_NONE) { 9473 pr_err("unexpected lease break state 0x%x\n", 9474 opinfo->op_state); 9475 rsp->hdr.Status = STATUS_UNSUCCESSFUL; 9476 goto err_out; 9477 } 9478 9479 if (!atomic_read(&opinfo->breaking_cnt)) { 9480 rsp->hdr.Status = STATUS_UNSUCCESSFUL; 9481 goto err_out; 9482 } 9483 9484 if (check_lease_state(lease, req->LeaseState)) { 9485 rsp->hdr.Status = STATUS_REQUEST_NOT_ACCEPTED; 9486 ksmbd_debug(OPLOCK, 9487 "req lease state: 0x%x, expected state: 0x%x\n", 9488 req->LeaseState, lease->new_state); 9489 goto err_out; 9490 } 9491 9492 lease_state = req->LeaseState; 9493 lease->state = lease_state; 9494 lease->new_state = SMB2_LEASE_NONE_LE; 9495 lease_update_oplock_levels(lease); 9496 9497 rsp->StructureSize = cpu_to_le16(36); 9498 rsp->Reserved = 0; 9499 rsp->Flags = 0; 9500 memcpy(rsp->LeaseKey, req->LeaseKey, 16); 9501 rsp->LeaseState = lease_state; 9502 rsp->LeaseDuration = 0; 9503 ret = ksmbd_iov_pin_rsp(work, rsp, sizeof(struct smb2_lease_ack)); 9504 if (ret) 9505 goto err_out; 9506 9507 opinfo->op_state = OPLOCK_STATE_NONE; 9508 wake_up_interruptible_all(&opinfo->oplock_q); 9509 atomic_dec(&opinfo->breaking_cnt); 9510 wake_up_interruptible_all(&opinfo->oplock_brk); 9511 opinfo_put(opinfo); 9512 return; 9513 9514 err_out: 9515 smb2_set_err_rsp(work); 9516 opinfo_put(opinfo); 9517 return; 9518 } 9519 9520 /** 9521 * smb2_oplock_break() - dispatcher for smb2.0 and 2.1 oplock/lease break 9522 * @work: smb work containing oplock/lease break command buffer 9523 * 9524 * Return: 0 on success, otherwise error 9525 */ 9526 int smb2_oplock_break(struct ksmbd_work *work) 9527 { 9528 struct smb2_oplock_break *req; 9529 struct smb2_oplock_break *rsp; 9530 9531 ksmbd_debug(SMB, "Received smb2 oplock break acknowledgment request\n"); 9532 9533 WORK_BUFFERS(work, req, rsp); 9534 9535 switch (le16_to_cpu(req->StructureSize)) { 9536 case OP_BREAK_STRUCT_SIZE_20: 9537 smb20_oplock_break_ack(work); 9538 break; 9539 case OP_BREAK_STRUCT_SIZE_21: 9540 smb21_lease_break_ack(work); 9541 break; 9542 default: 9543 ksmbd_debug(OPLOCK, "invalid break cmd %d\n", 9544 le16_to_cpu(req->StructureSize)); 9545 rsp->hdr.Status = STATUS_INVALID_PARAMETER; 9546 smb2_set_err_rsp(work); 9547 return -EINVAL; 9548 } 9549 9550 return 0; 9551 } 9552 9553 /** 9554 * smb2_notify() - handler for smb2 notify request 9555 * @work: smb work containing notify command buffer 9556 * 9557 * Return: 0 on success, otherwise error 9558 */ 9559 int smb2_notify(struct ksmbd_work *work) 9560 { 9561 struct smb2_change_notify_req *req; 9562 struct smb2_change_notify_rsp *rsp; 9563 9564 ksmbd_debug(SMB, "Received smb2 notify\n"); 9565 9566 WORK_BUFFERS(work, req, rsp); 9567 9568 if (smb2_compound_has_failed(work, &rsp->hdr)) 9569 return -EACCES; 9570 9571 if (work->next_smb2_rcv_hdr_off && req->hdr.NextCommand) { 9572 rsp->hdr.Status = STATUS_INTERNAL_ERROR; 9573 smb2_set_err_rsp(work); 9574 return -EIO; 9575 } 9576 9577 smb2_set_err_rsp(work); 9578 rsp->hdr.Status = STATUS_NOT_IMPLEMENTED; 9579 return -EOPNOTSUPP; 9580 } 9581 9582 /** 9583 * smb2_is_sign_req() - handler for checking packet signing status 9584 * @work: smb work containing notify command buffer 9585 * @command: SMB2 command id 9586 * 9587 * Return: true if packed is signed, false otherwise 9588 */ 9589 bool smb2_is_sign_req(struct ksmbd_work *work, unsigned int command) 9590 { 9591 struct smb2_hdr *rcv_hdr2 = smb_get_msg(work->request_buf); 9592 9593 if ((rcv_hdr2->Flags & SMB2_FLAGS_SIGNED) && 9594 command != SMB2_NEGOTIATE_HE) 9595 return true; 9596 9597 return false; 9598 } 9599 9600 /** 9601 * smb2_check_sign_req() - handler for req packet sign processing 9602 * @work: smb work containing notify command buffer 9603 * 9604 * Return: 1 on success, 0 otherwise 9605 */ 9606 int smb2_check_sign_req(struct ksmbd_work *work) 9607 { 9608 struct smb2_hdr *hdr; 9609 char signature_req[SMB2_SIGNATURE_SIZE]; 9610 char signature[SMB2_HMACSHA256_SIZE]; 9611 struct kvec iov[1]; 9612 size_t len; 9613 9614 hdr = smb_get_msg(work->request_buf); 9615 if (work->next_smb2_rcv_hdr_off) 9616 hdr = ksmbd_req_buf_next(work); 9617 9618 if (!hdr->NextCommand && !work->next_smb2_rcv_hdr_off) 9619 len = get_rfc1002_len(work->request_buf); 9620 else if (hdr->NextCommand) 9621 len = le32_to_cpu(hdr->NextCommand); 9622 else 9623 len = get_rfc1002_len(work->request_buf) - 9624 work->next_smb2_rcv_hdr_off; 9625 9626 memcpy(signature_req, hdr->Signature, SMB2_SIGNATURE_SIZE); 9627 memset(hdr->Signature, 0, SMB2_SIGNATURE_SIZE); 9628 9629 iov[0].iov_base = (char *)&hdr->ProtocolId; 9630 iov[0].iov_len = len; 9631 9632 ksmbd_sign_smb2_pdu(work->conn, work->sess->sess_key, iov, 1, 9633 signature); 9634 9635 if (crypto_memneq(signature, signature_req, SMB2_SIGNATURE_SIZE)) { 9636 pr_err("bad smb2 signature\n"); 9637 return 0; 9638 } 9639 9640 return 1; 9641 } 9642 9643 /** 9644 * smb2_set_sign_rsp() - handler for rsp packet sign processing 9645 * @work: smb work containing notify command buffer 9646 * 9647 */ 9648 void smb2_set_sign_rsp(struct ksmbd_work *work) 9649 { 9650 struct smb2_hdr *hdr; 9651 char signature[SMB2_HMACSHA256_SIZE]; 9652 struct kvec *iov; 9653 int n_vec = 1; 9654 9655 hdr = ksmbd_resp_buf_curr(work); 9656 hdr->Flags |= SMB2_FLAGS_SIGNED; 9657 memset(hdr->Signature, 0, SMB2_SIGNATURE_SIZE); 9658 9659 if (hdr->Command == SMB2_READ) { 9660 iov = &work->iov[work->iov_idx - 1]; 9661 n_vec++; 9662 } else { 9663 iov = &work->iov[work->iov_idx]; 9664 } 9665 9666 ksmbd_sign_smb2_pdu(work->conn, work->sess->sess_key, iov, n_vec, 9667 signature); 9668 memcpy(hdr->Signature, signature, SMB2_SIGNATURE_SIZE); 9669 } 9670 9671 /** 9672 * smb3_check_sign_req() - handler for req packet sign processing 9673 * @work: smb work containing notify command buffer 9674 * 9675 * Return: 1 on success, 0 otherwise 9676 */ 9677 int smb3_check_sign_req(struct ksmbd_work *work) 9678 { 9679 struct ksmbd_conn *conn = work->conn; 9680 char *signing_key; 9681 struct smb2_hdr *hdr; 9682 struct channel *chann; 9683 char signature_req[SMB2_SIGNATURE_SIZE]; 9684 char signature[SMB2_CMACAES_SIZE]; 9685 struct kvec iov[1]; 9686 size_t len; 9687 9688 hdr = smb_get_msg(work->request_buf); 9689 if (work->next_smb2_rcv_hdr_off) 9690 hdr = ksmbd_req_buf_next(work); 9691 9692 if (!hdr->NextCommand && !work->next_smb2_rcv_hdr_off) 9693 len = get_rfc1002_len(work->request_buf); 9694 else if (hdr->NextCommand) 9695 len = le32_to_cpu(hdr->NextCommand); 9696 else 9697 len = get_rfc1002_len(work->request_buf) - 9698 work->next_smb2_rcv_hdr_off; 9699 9700 if (le16_to_cpu(hdr->Command) == SMB2_SESSION_SETUP_HE) { 9701 signing_key = work->sess->smb3signingkey; 9702 } else { 9703 chann = lookup_chann_list(work->sess, conn); 9704 if (!chann) { 9705 if (le16_to_cpu(hdr->Command) != SMB2_SESSION_SETUP_HE || 9706 !(hdr->Flags & SMB2_FLAGS_SIGNED)) 9707 return 0; 9708 signing_key = work->sess->smb3signingkey; 9709 } else { 9710 signing_key = chann->smb3signingkey; 9711 } 9712 } 9713 9714 if (!signing_key) { 9715 pr_err("SMB3 signing key is not generated\n"); 9716 return 0; 9717 } 9718 9719 memcpy(signature_req, hdr->Signature, SMB2_SIGNATURE_SIZE); 9720 memset(hdr->Signature, 0, SMB2_SIGNATURE_SIZE); 9721 iov[0].iov_base = (char *)&hdr->ProtocolId; 9722 iov[0].iov_len = len; 9723 9724 ksmbd_sign_smb3_pdu(conn, signing_key, iov, 1, signature); 9725 9726 if (crypto_memneq(signature, signature_req, SMB2_SIGNATURE_SIZE)) { 9727 pr_err("bad smb2 signature\n"); 9728 return 0; 9729 } 9730 9731 return 1; 9732 } 9733 9734 /** 9735 * smb3_set_sign_rsp() - handler for rsp packet sign processing 9736 * @work: smb work containing notify command buffer 9737 * 9738 */ 9739 void smb3_set_sign_rsp(struct ksmbd_work *work) 9740 { 9741 struct ksmbd_conn *conn = work->conn; 9742 struct smb2_hdr *hdr; 9743 struct channel *chann; 9744 char signature[SMB2_CMACAES_SIZE]; 9745 struct kvec *iov; 9746 u16 command = conn->ops->get_cmd_val(work); 9747 int n_vec = 1; 9748 char *signing_key; 9749 9750 hdr = ksmbd_resp_buf_curr(work); 9751 9752 if (command == SMB2_SESSION_SETUP_HE && 9753 (!conn->binding || hdr->Status != STATUS_SUCCESS)) { 9754 signing_key = work->sess->smb3signingkey; 9755 } else { 9756 chann = lookup_chann_list(work->sess, work->conn); 9757 if (!chann) { 9758 return; 9759 } 9760 signing_key = chann->smb3signingkey; 9761 } 9762 9763 if (!signing_key) 9764 return; 9765 9766 hdr->Flags |= SMB2_FLAGS_SIGNED; 9767 memset(hdr->Signature, 0, SMB2_SIGNATURE_SIZE); 9768 9769 if (hdr->Command == SMB2_READ) { 9770 iov = &work->iov[work->iov_idx - 1]; 9771 n_vec++; 9772 } else { 9773 iov = &work->iov[work->iov_idx]; 9774 } 9775 9776 ksmbd_sign_smb3_pdu(conn, signing_key, iov, n_vec, signature); 9777 memcpy(hdr->Signature, signature, SMB2_SIGNATURE_SIZE); 9778 } 9779 9780 /** 9781 * smb3_preauth_hash_rsp() - handler for computing preauth hash on response 9782 * @work: smb work containing response buffer 9783 * 9784 */ 9785 void smb3_preauth_hash_rsp(struct ksmbd_work *work) 9786 { 9787 struct ksmbd_conn *conn = work->conn; 9788 struct ksmbd_session *sess = work->sess; 9789 struct smb2_hdr *req, *rsp; 9790 9791 if (conn->dialect != SMB311_PROT_ID) 9792 return; 9793 9794 WORK_BUFFERS(work, req, rsp); 9795 9796 if (le16_to_cpu(req->Command) == SMB2_NEGOTIATE_HE) { 9797 ksmbd_conn_lock(conn); 9798 if (conn->preauth_info) 9799 ksmbd_gen_preauth_integrity_hash(conn, work->response_buf, 9800 conn->preauth_info->Preauth_HashValue); 9801 ksmbd_conn_unlock(conn); 9802 } 9803 9804 if (le16_to_cpu(rsp->Command) == SMB2_SESSION_SETUP_HE && sess) { 9805 ksmbd_conn_lock(conn); 9806 9807 if (conn->binding) { 9808 struct preauth_session *preauth_sess; 9809 9810 preauth_sess = ksmbd_preauth_session_lookup(conn, sess->id); 9811 if (preauth_sess) 9812 ksmbd_gen_preauth_integrity_hash(conn, 9813 work->response_buf, 9814 preauth_sess->Preauth_HashValue); 9815 } else if (sess->Preauth_HashValue) { 9816 ksmbd_gen_preauth_integrity_hash(conn, work->response_buf, 9817 sess->Preauth_HashValue); 9818 } 9819 ksmbd_conn_unlock(conn); 9820 } 9821 } 9822 9823 static void fill_transform_hdr(void *tr_buf, char *old_buf, __le16 cipher_type) 9824 { 9825 struct smb2_transform_hdr *tr_hdr = tr_buf + 4; 9826 struct smb2_hdr *hdr = smb_get_msg(old_buf); 9827 unsigned int orig_len = get_rfc1002_len(old_buf); 9828 9829 /* tr_buf must be cleared by the caller */ 9830 tr_hdr->ProtocolId = SMB2_TRANSFORM_PROTO_NUM; 9831 tr_hdr->OriginalMessageSize = cpu_to_le32(orig_len); 9832 tr_hdr->Flags = cpu_to_le16(TRANSFORM_FLAG_ENCRYPTED); 9833 if (cipher_type == SMB2_ENCRYPTION_AES128_GCM || 9834 cipher_type == SMB2_ENCRYPTION_AES256_GCM) 9835 get_random_bytes(&tr_hdr->Nonce, SMB3_AES_GCM_NONCE); 9836 else 9837 get_random_bytes(&tr_hdr->Nonce, SMB3_AES_CCM_NONCE); 9838 memcpy(&tr_hdr->SessionId, &hdr->SessionId, 8); 9839 inc_rfc1001_len(tr_buf, sizeof(struct smb2_transform_hdr)); 9840 inc_rfc1001_len(tr_buf, orig_len); 9841 } 9842 9843 int smb3_encrypt_resp(struct ksmbd_work *work) 9844 { 9845 struct kvec *iov = work->iov; 9846 int rc = -ENOMEM; 9847 void *tr_buf; 9848 9849 tr_buf = kzalloc(sizeof(struct smb2_transform_hdr) + 4, KSMBD_DEFAULT_GFP); 9850 if (!tr_buf) 9851 return rc; 9852 9853 /* fill transform header */ 9854 fill_transform_hdr(tr_buf, work->response_buf, work->conn->cipher_type); 9855 9856 iov[0].iov_base = tr_buf; 9857 iov[0].iov_len = sizeof(struct smb2_transform_hdr) + 4; 9858 work->tr_buf = tr_buf; 9859 9860 return ksmbd_crypt_message(work, iov, work->iov_idx + 1, 1); 9861 } 9862 9863 bool smb3_is_transform_hdr(void *buf) 9864 { 9865 struct smb2_transform_hdr *trhdr = smb_get_msg(buf); 9866 9867 return trhdr->ProtocolId == SMB2_TRANSFORM_PROTO_NUM; 9868 } 9869 9870 int smb3_decrypt_req(struct ksmbd_work *work) 9871 { 9872 struct ksmbd_session *sess; 9873 char *buf = work->request_buf; 9874 unsigned int pdu_length = get_rfc1002_len(buf); 9875 struct kvec iov[2]; 9876 int buf_data_size = pdu_length - sizeof(struct smb2_transform_hdr); 9877 struct smb2_transform_hdr *tr_hdr = smb_get_msg(buf); 9878 int rc = 0; 9879 9880 if (pdu_length < sizeof(struct smb2_transform_hdr) || 9881 buf_data_size < sizeof(struct smb2_hdr)) { 9882 pr_err("Transform message is too small (%u)\n", 9883 pdu_length); 9884 return -ECONNABORTED; 9885 } 9886 9887 if (buf_data_size < le32_to_cpu(tr_hdr->OriginalMessageSize)) { 9888 pr_err("Transform message is broken\n"); 9889 return -ECONNABORTED; 9890 } 9891 9892 sess = ksmbd_session_lookup_all(work->conn, le64_to_cpu(tr_hdr->SessionId)); 9893 if (!sess) { 9894 pr_err("invalid session id(%llx) in transform header\n", 9895 le64_to_cpu(tr_hdr->SessionId)); 9896 return -ECONNABORTED; 9897 } 9898 ksmbd_user_session_put(sess); 9899 9900 iov[0].iov_base = buf; 9901 iov[0].iov_len = sizeof(struct smb2_transform_hdr) + 4; 9902 iov[1].iov_base = buf + sizeof(struct smb2_transform_hdr) + 4; 9903 iov[1].iov_len = buf_data_size; 9904 rc = ksmbd_crypt_message(work, iov, 2, 0); 9905 if (rc) 9906 return rc; 9907 9908 memmove(buf + 4, iov[1].iov_base, buf_data_size); 9909 *(__be32 *)buf = cpu_to_be32(buf_data_size); 9910 9911 return rc; 9912 } 9913 9914 bool smb3_11_final_sess_setup_resp(struct ksmbd_work *work) 9915 { 9916 struct ksmbd_conn *conn = work->conn; 9917 struct ksmbd_session *sess = work->sess; 9918 struct smb2_hdr *rsp = smb_get_msg(work->response_buf); 9919 9920 if (conn->dialect < SMB30_PROT_ID) 9921 return false; 9922 9923 if (work->next_smb2_rcv_hdr_off) 9924 rsp = ksmbd_resp_buf_next(work); 9925 9926 if (le16_to_cpu(rsp->Command) == SMB2_SESSION_SETUP_HE && 9927 sess->user && !user_guest(sess->user) && 9928 rsp->Status == STATUS_SUCCESS) 9929 return true; 9930 return false; 9931 } 9932