1 // SPDX-License-Identifier: LGPL-2.1 2 /* 3 * 4 * Copyright (C) International Business Machines Corp., 2002,2011 5 * Etersoft, 2012 6 * Author(s): Steve French (sfrench@us.ibm.com) 7 * Pavel Shilovsky (pshilovsky@samba.org) 2012 8 * 9 */ 10 #include <crypto/sha2.h> 11 #include <linux/ctype.h> 12 #include "cifsglob.h" 13 #include "cifsproto.h" 14 #include "smb2proto.h" 15 #include "cifs_debug.h" 16 #include "cifs_unicode.h" 17 #include "../common/smb2status.h" 18 #include "smb2glob.h" 19 #include "nterr.h" 20 #include "cached_dir.h" 21 22 static unsigned int __smb2_calc_size(void *buf, bool *have_data, 23 bool *data_area_overlap); 24 25 static int 26 check_smb2_hdr(struct smb2_hdr *shdr, __u64 mid) 27 { 28 __u64 wire_mid = le64_to_cpu(shdr->MessageId); 29 30 /* 31 * Make sure that this really is an SMB, that it is a response, 32 * and that the message ids match. 33 */ 34 if ((shdr->ProtocolId == SMB2_PROTO_NUMBER) && 35 (mid == wire_mid)) { 36 if (shdr->Flags & SMB2_FLAGS_SERVER_TO_REDIR) 37 return 0; 38 else { 39 /* only one valid case where server sends us request */ 40 if (shdr->Command == SMB2_OPLOCK_BREAK) 41 return 0; 42 else 43 cifs_dbg(VFS, "Received Request not response\n"); 44 } 45 } else { /* bad signature or mid */ 46 if (shdr->ProtocolId != SMB2_PROTO_NUMBER) 47 cifs_dbg(VFS, "Bad protocol string signature header %x\n", 48 le32_to_cpu(shdr->ProtocolId)); 49 if (mid != wire_mid) 50 cifs_dbg(VFS, "Mids do not match: %llu and %llu\n", 51 mid, wire_mid); 52 } 53 cifs_dbg(VFS, "Bad SMB detected. The Mid=%llu\n", wire_mid); 54 return 1; 55 } 56 57 /* 58 * The following table defines the expected "StructureSize" of SMB2 responses 59 * in order by SMB2 command. This is similar to "wct" in SMB/CIFS responses. 60 * 61 * Note that commands are defined in smb2pdu.h in le16 but the array below is 62 * indexed by command in host byte order 63 */ 64 static const __le16 smb2_rsp_struct_sizes[NUMBER_OF_SMB2_COMMANDS] = { 65 /* SMB2_NEGOTIATE */ cpu_to_le16(65), 66 /* SMB2_SESSION_SETUP */ cpu_to_le16(9), 67 /* SMB2_LOGOFF */ cpu_to_le16(4), 68 /* SMB2_TREE_CONNECT */ cpu_to_le16(16), 69 /* SMB2_TREE_DISCONNECT */ cpu_to_le16(4), 70 /* SMB2_CREATE */ cpu_to_le16(89), 71 /* SMB2_CLOSE */ cpu_to_le16(60), 72 /* SMB2_FLUSH */ cpu_to_le16(4), 73 /* SMB2_READ */ cpu_to_le16(17), 74 /* SMB2_WRITE */ cpu_to_le16(17), 75 /* SMB2_LOCK */ cpu_to_le16(4), 76 /* SMB2_IOCTL */ cpu_to_le16(49), 77 /* BB CHECK this ... not listed in documentation */ 78 /* SMB2_CANCEL */ cpu_to_le16(0), 79 /* SMB2_ECHO */ cpu_to_le16(4), 80 /* SMB2_QUERY_DIRECTORY */ cpu_to_le16(9), 81 /* SMB2_CHANGE_NOTIFY */ cpu_to_le16(9), 82 /* SMB2_QUERY_INFO */ cpu_to_le16(9), 83 /* SMB2_SET_INFO */ cpu_to_le16(2), 84 /* BB FIXME can also be 44 for lease break */ 85 /* SMB2_OPLOCK_BREAK */ cpu_to_le16(24) 86 }; 87 88 /* 89 * Minimum received PDU size for commands whose response carries a 90 * variable-length data area. A non-zero entry marks the command as 91 * having one, and gives the length smb2_check_message() requires 92 * before smb2_get_data_area_len() reads the offset and length fields 93 * out of the fixed response struct. 94 */ 95 static const size_t smb2_min_pdu_len[NUMBER_OF_SMB2_COMMANDS] = { 96 /* SMB2_NEGOTIATE */ sizeof(struct smb2_negotiate_rsp), 97 /* SMB2_SESSION_SETUP */ sizeof(struct smb2_sess_setup_rsp), 98 /* SMB2_LOGOFF */ 0, 99 /* SMB2_TREE_CONNECT */ 0, 100 /* SMB2_TREE_DISCONNECT */ 0, 101 /* SMB2_CREATE */ sizeof(struct smb2_create_rsp), 102 /* SMB2_CLOSE */ 0, 103 /* SMB2_FLUSH */ 0, 104 /* SMB2_READ */ sizeof(struct smb2_read_rsp), 105 /* SMB2_WRITE */ 0, 106 /* SMB2_LOCK */ 0, 107 /* SMB2_IOCTL */ sizeof(struct smb2_ioctl_rsp), 108 /* SMB2_CANCEL */ 0, 109 /* SMB2_ECHO */ 0, 110 /* SMB2_QUERY_DIRECTORY */ sizeof(struct smb2_query_directory_rsp), 111 /* SMB2_CHANGE_NOTIFY */ sizeof(struct smb2_change_notify_rsp), 112 /* SMB2_QUERY_INFO */ sizeof(struct smb2_query_info_rsp), 113 /* SMB2_SET_INFO */ 0, 114 /* SMB2_OPLOCK_BREAK */ 0, 115 }; 116 117 #define smb2_has_data_area(cmd) (smb2_min_pdu_len[cmd] != 0) 118 #define SMB311_NEGPROT_BASE_SIZE (sizeof(struct smb2_hdr) + sizeof(struct smb2_negotiate_rsp)) 119 120 static __u32 get_neg_ctxt_len(struct smb2_hdr *hdr, __u32 len, 121 __u32 non_ctxlen) 122 { 123 __u16 neg_count; 124 __u32 nc_offset, size_of_pad_before_neg_ctxts; 125 struct smb2_negotiate_rsp *pneg_rsp = (struct smb2_negotiate_rsp *)hdr; 126 127 /* Negotiate contexts are only valid for latest dialect SMB3.11 */ 128 neg_count = le16_to_cpu(pneg_rsp->NegotiateContextCount); 129 if ((neg_count == 0) || 130 (pneg_rsp->DialectRevision != cpu_to_le16(SMB311_PROT_ID))) 131 return 0; 132 133 /* 134 * if SPNEGO blob present (ie the RFC2478 GSS info which indicates 135 * which security mechanisms the server supports) make sure that 136 * the negotiate contexts start after it 137 */ 138 nc_offset = le32_to_cpu(pneg_rsp->NegotiateContextOffset); 139 /* 140 * non_ctxlen is at least shdr->StructureSize + pdu->StructureSize2 141 * and the latter is 1 byte bigger than the fix-sized area of the 142 * NEGOTIATE response 143 */ 144 if (nc_offset + 1 < non_ctxlen) { 145 pr_warn_once("Invalid negotiate context offset %d\n", nc_offset); 146 return 0; 147 } else if (nc_offset + 1 == non_ctxlen) { 148 cifs_dbg(FYI, "no SPNEGO security blob in negprot rsp\n"); 149 size_of_pad_before_neg_ctxts = 0; 150 } else if (non_ctxlen == SMB311_NEGPROT_BASE_SIZE + 1) 151 /* has padding, but no SPNEGO blob */ 152 size_of_pad_before_neg_ctxts = nc_offset - non_ctxlen + 1; 153 else 154 size_of_pad_before_neg_ctxts = nc_offset - non_ctxlen; 155 156 /* Verify that at least minimal negotiate contexts fit within frame */ 157 if (len < nc_offset + (neg_count * sizeof(struct smb2_neg_context))) { 158 pr_warn_once("negotiate context goes beyond end\n"); 159 return 0; 160 } 161 162 cifs_dbg(FYI, "length of negcontexts %d pad %d\n", 163 len - nc_offset, size_of_pad_before_neg_ctxts); 164 165 /* length of negcontexts including pad from end of sec blob to them */ 166 return (len - nc_offset) + size_of_pad_before_neg_ctxts; 167 } 168 169 int 170 smb2_check_message(char *buf, unsigned int pdu_len, unsigned int len, 171 struct TCP_Server_Info *server) 172 { 173 struct TCP_Server_Info *pserver; 174 struct smb2_hdr *shdr = (struct smb2_hdr *)buf; 175 struct smb2_pdu *pdu = (struct smb2_pdu *)shdr; 176 int hdr_size = sizeof(struct smb2_hdr); 177 int pdu_size = sizeof(struct smb2_pdu); 178 int command; 179 __u32 calc_len; /* calculated length */ 180 __u64 mid; 181 bool have_data; 182 bool data_area_overlap; 183 184 /* If server is a channel, select the primary channel */ 185 pserver = SERVER_IS_CHAN(server) ? server->primary_server : server; 186 187 /* 188 * Add function to do table lookup of StructureSize by command 189 * ie Validate the wct via smb2_struct_sizes table above 190 */ 191 if (shdr->ProtocolId == SMB2_TRANSFORM_PROTO_NUM) { 192 struct smb2_transform_hdr *thdr = 193 (struct smb2_transform_hdr *)buf; 194 struct cifs_ses *ses = NULL; 195 struct cifs_ses *iter; 196 197 /* decrypt frame now that it is completely read in */ 198 spin_lock(&cifs_tcp_ses_lock); 199 list_for_each_entry(iter, &pserver->smb_ses_list, smb_ses_list) { 200 if (iter->Suid == le64_to_cpu(thdr->SessionId)) { 201 ses = iter; 202 break; 203 } 204 } 205 spin_unlock(&cifs_tcp_ses_lock); 206 if (!ses) { 207 cifs_dbg(VFS, "no decryption - session id not found\n"); 208 return 1; 209 } 210 } 211 212 mid = le64_to_cpu(shdr->MessageId); 213 if (check_smb2_hdr(shdr, mid)) 214 return 1; 215 216 if (shdr->StructureSize != SMB2_HEADER_STRUCTURE_SIZE) { 217 cifs_dbg(VFS, "Invalid structure size %u\n", 218 le16_to_cpu(shdr->StructureSize)); 219 return 1; 220 } 221 222 command = le16_to_cpu(shdr->Command); 223 if (command >= NUMBER_OF_SMB2_COMMANDS) { 224 cifs_dbg(VFS, "Invalid SMB2 command %d\n", command); 225 return 1; 226 } 227 228 if (len < pdu_size) { 229 if ((len >= hdr_size) 230 && (shdr->Status != 0)) { 231 pdu->StructureSize2 = 0; 232 /* 233 * As with SMB/CIFS, on some error cases servers may 234 * not return wct properly 235 */ 236 return 0; 237 } else { 238 cifs_dbg(VFS, "Length less than SMB header size\n"); 239 } 240 return 1; 241 } 242 if (len > CIFSMaxBufSize + MAX_SMB2_HDR_SIZE) { 243 cifs_dbg(VFS, "SMB length greater than maximum, mid=%llu\n", 244 mid); 245 return 1; 246 } 247 248 if (smb2_rsp_struct_sizes[command] != pdu->StructureSize2) { 249 if (command != SMB2_OPLOCK_BREAK_HE && (shdr->Status == 0 || 250 pdu->StructureSize2 != SMB2_ERROR_STRUCTURE_SIZE2_LE)) { 251 /* error packets have 9 byte structure size */ 252 cifs_dbg(VFS, "Invalid response size %u for command %d\n", 253 le16_to_cpu(pdu->StructureSize2), command); 254 return 1; 255 } else if (command == SMB2_OPLOCK_BREAK_HE 256 && (shdr->Status == 0) 257 && (le16_to_cpu(pdu->StructureSize2) != 44) 258 && (le16_to_cpu(pdu->StructureSize2) != 36)) { 259 /* special case for SMB2.1 lease break message */ 260 cifs_dbg(VFS, "Invalid response size %d for oplock break\n", 261 le16_to_cpu(pdu->StructureSize2)); 262 return 1; 263 } 264 } 265 266 if ((shdr->Status == STATUS_SUCCESS || 267 shdr->Status == STATUS_MORE_PROCESSING_REQUIRED || 268 pdu->StructureSize2 != SMB2_ERROR_STRUCTURE_SIZE2_LE) && 269 smb2_has_data_area(command) && 270 len < smb2_min_pdu_len[command]) { 271 cifs_server_dbg(VFS, "SMB2 command %d response too short: %u < %zu\n", 272 command, len, smb2_min_pdu_len[command]); 273 return 1; 274 } 275 276 have_data = false; 277 data_area_overlap = false; 278 calc_len = __smb2_calc_size(buf, &have_data, &data_area_overlap); 279 280 /* Reject responses whose data area overlaps the fixed area. */ 281 if (data_area_overlap) 282 return 1; 283 284 /* For SMB2_IOCTL, OutputOffset and OutputLength are optional, so might 285 * be 0, and not a real miscalculation */ 286 if (command == SMB2_IOCTL_HE && calc_len == 0) 287 return 0; 288 289 if (command == SMB2_NEGOTIATE_HE) 290 calc_len += get_neg_ctxt_len(shdr, len, calc_len); 291 292 if (len != calc_len) { 293 /* create failed on symlink */ 294 if (command == SMB2_CREATE_HE && 295 shdr->Status == STATUS_STOPPED_ON_SYMLINK && 296 len > calc_len) 297 return 0; 298 /* Windows 7 server returns 24 bytes more */ 299 if (calc_len + 24 == len && command == SMB2_OPLOCK_BREAK_HE) 300 return 0; 301 /* 302 * Server can return one byte more due to implied bcc[0]. 303 * Allow it only when there is no data area; if data_length > 0 304 * the +1 gap indicates an overreported data length rather than 305 * the bcc[0] omission. 306 */ 307 if (calc_len == len + 1 && !have_data) 308 return 0; 309 310 /* 311 * Some windows servers (win2016) will pad also the final 312 * PDU in a compound to 8 bytes. 313 */ 314 if (ALIGN(calc_len, 8) == len) 315 return 0; 316 317 /* 318 * MacOS server pads after SMB2.1 write response with 3 bytes 319 * of junk. Other servers match RFC1001 len to actual 320 * SMB2/SMB3 frame length (header + smb2 response specific data) 321 * Some windows servers also pad up to 8 bytes when compounding. 322 */ 323 if (calc_len < len) 324 return 0; 325 326 /* Only log a message if len was really miscalculated */ 327 if (unlikely(cifsFYI)) 328 cifs_dbg(FYI, "Server response too short: calculated " 329 "length %u doesn't match read length %u (cmd=%d, mid=%llu)\n", 330 calc_len, len, command, mid); 331 else 332 pr_warn("Server response too short: calculated length " 333 "%u doesn't match read length %u (cmd=%d, mid=%llu)\n", 334 calc_len, len, command, mid); 335 336 return 1; 337 } 338 return 0; 339 } 340 341 /* 342 * Returns the pointer to the beginning of the data area. Length of the data 343 * area and the offset to it (from the beginning of the smb are also returned. 344 */ 345 char * 346 smb2_get_data_area_len(int *off, int *len, struct smb2_hdr *shdr) 347 { 348 const int max_off = 4096; 349 const int max_len = 128 * 1024; 350 351 *off = 0; 352 *len = 0; 353 354 /* error responses do not have data area */ 355 if (shdr->Status && shdr->Status != STATUS_MORE_PROCESSING_REQUIRED && 356 (((struct smb2_err_rsp *)shdr)->StructureSize) == 357 SMB2_ERROR_STRUCTURE_SIZE2_LE) 358 return NULL; 359 360 /* 361 * Following commands have data areas so we have to get the location 362 * of the data buffer offset and data buffer length for the particular 363 * command. 364 */ 365 switch (shdr->Command) { 366 case SMB2_NEGOTIATE: 367 *off = le16_to_cpu( 368 ((struct smb2_negotiate_rsp *)shdr)->SecurityBufferOffset); 369 *len = le16_to_cpu( 370 ((struct smb2_negotiate_rsp *)shdr)->SecurityBufferLength); 371 break; 372 case SMB2_SESSION_SETUP: 373 *off = le16_to_cpu( 374 ((struct smb2_sess_setup_rsp *)shdr)->SecurityBufferOffset); 375 *len = le16_to_cpu( 376 ((struct smb2_sess_setup_rsp *)shdr)->SecurityBufferLength); 377 break; 378 case SMB2_CREATE: 379 *off = le32_to_cpu( 380 ((struct smb2_create_rsp *)shdr)->CreateContextsOffset); 381 *len = le32_to_cpu( 382 ((struct smb2_create_rsp *)shdr)->CreateContextsLength); 383 break; 384 case SMB2_QUERY_INFO: 385 *off = le16_to_cpu( 386 ((struct smb2_query_info_rsp *)shdr)->OutputBufferOffset); 387 *len = le32_to_cpu( 388 ((struct smb2_query_info_rsp *)shdr)->OutputBufferLength); 389 break; 390 case SMB2_READ: 391 /* TODO: is this a bug ? */ 392 *off = ((struct smb2_read_rsp *)shdr)->DataOffset; 393 *len = le32_to_cpu(((struct smb2_read_rsp *)shdr)->DataLength); 394 break; 395 case SMB2_QUERY_DIRECTORY: 396 *off = le16_to_cpu( 397 ((struct smb2_query_directory_rsp *)shdr)->OutputBufferOffset); 398 *len = le32_to_cpu( 399 ((struct smb2_query_directory_rsp *)shdr)->OutputBufferLength); 400 break; 401 case SMB2_IOCTL: 402 *off = le32_to_cpu( 403 ((struct smb2_ioctl_rsp *)shdr)->OutputOffset); 404 *len = le32_to_cpu( 405 ((struct smb2_ioctl_rsp *)shdr)->OutputCount); 406 break; 407 case SMB2_CHANGE_NOTIFY: 408 *off = le16_to_cpu( 409 ((struct smb2_change_notify_rsp *)shdr)->OutputBufferOffset); 410 *len = le32_to_cpu( 411 ((struct smb2_change_notify_rsp *)shdr)->OutputBufferLength); 412 break; 413 default: 414 cifs_dbg(VFS, "no length check for command %d\n", le16_to_cpu(shdr->Command)); 415 break; 416 } 417 418 /* 419 * Invalid length or offset probably means data area is invalid, but 420 * we have little choice but to ignore the data area in this case. 421 */ 422 if (unlikely(*off < 0 || *off > max_off || 423 *len < 0 || *len > max_len)) { 424 cifs_dbg(VFS, "%s: invalid data area (off=%d len=%d)\n", 425 __func__, *off, *len); 426 *off = 0; 427 *len = 0; 428 } else if (*off == 0) { 429 *len = 0; 430 } 431 432 /* return pointer to beginning of data area, ie offset from SMB start */ 433 if (*off > 0 && *len > 0) 434 return (char *)shdr + *off; 435 return NULL; 436 } 437 438 /* 439 * Calculate the size of the SMB message based on the fixed header, fixed 440 * parameter area, and variable data area. 441 * 442 * If have_data is not NULL, it is set when a non-empty data area is found. 443 * If data_area_overlap is not NULL, it is set when the data area overlaps 444 * the fixed area. 445 */ 446 static unsigned int 447 __smb2_calc_size(void *buf, bool *have_data, bool *data_area_overlap) 448 { 449 struct smb2_pdu *pdu = buf; 450 struct smb2_hdr *shdr = &pdu->hdr; 451 int offset; /* the offset from the beginning of SMB to data area */ 452 int data_length = 0; /* the length of the variable length data area */ 453 /* Structure Size has already been checked to make sure it is 64 */ 454 int len = le16_to_cpu(shdr->StructureSize); 455 456 if (have_data) 457 *have_data = false; 458 if (data_area_overlap) 459 *data_area_overlap = false; 460 461 /* 462 * StructureSize2, ie length of fixed parameter area has already 463 * been checked to make sure it is the correct length. 464 */ 465 len += le16_to_cpu(pdu->StructureSize2); 466 467 if (!smb2_has_data_area(le16_to_cpu(shdr->Command))) 468 goto calc_size_exit; 469 470 smb2_get_data_area_len(&offset, &data_length, shdr); 471 cifs_dbg(FYI, "SMB2 data length %d offset %d\n", data_length, offset); 472 473 if (data_length > 0) { 474 /* 475 * Check to make sure that data area begins after fixed area, 476 * Note that last byte of the fixed area is part of data area 477 * for some commands, typically those with odd StructureSize, 478 * so we must add one to the calculation. 479 */ 480 if (offset + 1 < len) { 481 cifs_dbg(VFS, "data area offset %d overlaps SMB2 header %d\n", 482 offset + 1, len); 483 if (data_area_overlap) 484 *data_area_overlap = true; 485 data_length = 0; 486 goto calc_size_exit; 487 } else { 488 len = offset + data_length; 489 } 490 } 491 calc_size_exit: 492 cifs_dbg(FYI, "SMB2 len %d\n", len); 493 if (have_data) 494 *have_data = (data_length > 0); 495 return len; 496 } 497 498 unsigned int 499 smb2_calc_size(void *buf) 500 { 501 return __smb2_calc_size(buf, NULL, NULL); 502 } 503 504 /* Note: caller must free return buffer */ 505 __le16 * 506 cifs_convert_path_to_utf16(const char *from, struct cifs_sb_info *cifs_sb) 507 { 508 const char *start_of_path; 509 int len; 510 511 /* Windows doesn't allow paths beginning with \ */ 512 if (from[0] == '\\') 513 start_of_path = from + 1; 514 515 /* SMB311 POSIX extensions paths do not include leading slash */ 516 else if (cifs_sb_master_tlink(cifs_sb) && 517 cifs_sb_master_tcon(cifs_sb)->posix_extensions && 518 (from[0] == '/')) { 519 start_of_path = from + 1; 520 } else 521 start_of_path = from; 522 523 return cifs_strndup_to_utf16(start_of_path, PATH_MAX, &len, 524 cifs_sb->local_nls, cifs_remap(cifs_sb)); 525 } 526 527 __le32 smb2_get_lease_state(struct cifsInodeInfo *cinode, unsigned int oplock) 528 { 529 unsigned int sbflags = cifs_sb_flags(CIFS_SB(cinode)); 530 __le32 lease = 0; 531 532 if ((oplock & CIFS_CACHE_WRITE_FLG) || (sbflags & CIFS_MOUNT_RW_CACHE)) 533 lease |= SMB2_LEASE_WRITE_CACHING_LE; 534 if (oplock & CIFS_CACHE_HANDLE_FLG) 535 lease |= SMB2_LEASE_HANDLE_CACHING_LE; 536 if ((oplock & CIFS_CACHE_READ_FLG) || (sbflags & CIFS_MOUNT_RO_CACHE)) 537 lease |= SMB2_LEASE_READ_CACHING_LE; 538 return lease; 539 } 540 541 struct smb2_lease_break_work { 542 struct work_struct lease_break; 543 struct tcon_link *tlink; 544 __u8 lease_key[16]; 545 __le32 lease_state; 546 }; 547 548 static void 549 cifs_ses_oplock_break(struct work_struct *work) 550 { 551 struct smb2_lease_break_work *lw = container_of(work, 552 struct smb2_lease_break_work, lease_break); 553 int rc = 0; 554 555 rc = SMB2_lease_break(0, tlink_tcon(lw->tlink), lw->lease_key, 556 lw->lease_state); 557 558 cifs_dbg(FYI, "Lease release rc %d\n", rc); 559 cifs_put_tlink(lw->tlink); 560 kfree(lw); 561 } 562 563 static void 564 smb2_queue_pending_open_break(struct tcon_link *tlink, __u8 *lease_key, 565 __le32 new_lease_state) 566 { 567 struct smb2_lease_break_work *lw; 568 569 lw = kmalloc_obj(struct smb2_lease_break_work); 570 if (!lw) { 571 cifs_put_tlink(tlink); 572 return; 573 } 574 575 INIT_WORK(&lw->lease_break, cifs_ses_oplock_break); 576 lw->tlink = tlink; 577 lw->lease_state = new_lease_state; 578 memcpy(lw->lease_key, lease_key, SMB2_LEASE_KEY_SIZE); 579 queue_work(cifsiod_wq, &lw->lease_break); 580 } 581 582 static bool 583 smb2_tcon_has_lease(struct cifs_tcon *tcon, struct smb2_lease_break *rsp) 584 { 585 __u8 lease_state; 586 struct cifsFileInfo *cfile; 587 struct cifsInodeInfo *cinode; 588 int ack_req = le32_to_cpu(rsp->Flags & 589 SMB2_NOTIFY_BREAK_LEASE_FLAG_ACK_REQUIRED); 590 591 lease_state = le32_to_cpu(rsp->NewLeaseState); 592 593 list_for_each_entry(cfile, &tcon->openFileList, tlist) { 594 cinode = CIFS_I(d_inode(cfile->dentry)); 595 596 if (memcmp(cinode->lease_key, rsp->LeaseKey, 597 SMB2_LEASE_KEY_SIZE)) 598 continue; 599 600 cifs_dbg(FYI, "found in the open list\n"); 601 cifs_dbg(FYI, "lease key match, lease break 0x%x\n", 602 lease_state); 603 604 if (ack_req) 605 cfile->oplock_break_cancelled = false; 606 else 607 cfile->oplock_break_cancelled = true; 608 609 set_bit(CIFS_INODE_PENDING_OPLOCK_BREAK, &cinode->flags); 610 611 cfile->oplock_epoch = le16_to_cpu(rsp->Epoch); 612 cfile->oplock_level = lease_state; 613 614 cifs_queue_oplock_break(cfile); 615 return true; 616 } 617 618 return false; 619 } 620 621 static struct cifs_pending_open * 622 smb2_tcon_find_pending_open_lease(struct cifs_tcon *tcon, 623 struct smb2_lease_break *rsp) 624 { 625 __u8 lease_state = le32_to_cpu(rsp->NewLeaseState); 626 int ack_req = le32_to_cpu(rsp->Flags & 627 SMB2_NOTIFY_BREAK_LEASE_FLAG_ACK_REQUIRED); 628 struct cifs_pending_open *open; 629 struct cifs_pending_open *found = NULL; 630 631 list_for_each_entry(open, &tcon->pending_opens, olist) { 632 if (memcmp(open->lease_key, rsp->LeaseKey, 633 SMB2_LEASE_KEY_SIZE)) 634 continue; 635 636 if (!found && ack_req) { 637 found = open; 638 } 639 640 cifs_dbg(FYI, "found in the pending open list\n"); 641 cifs_dbg(FYI, "lease key match, lease break 0x%x\n", 642 lease_state); 643 644 open->oplock = lease_state; 645 } 646 647 return found; 648 } 649 650 static bool 651 smb2_is_valid_lease_break(char *buffer, struct TCP_Server_Info *server) 652 { 653 struct smb2_lease_break *rsp = (struct smb2_lease_break *)buffer; 654 struct TCP_Server_Info *pserver; 655 struct cifs_ses *ses; 656 struct cifs_tcon *tcon; 657 struct cifs_pending_open *open; 658 659 /* Trace receipt of lease break request from server */ 660 trace_smb3_lease_break_enter(le32_to_cpu(rsp->CurrentLeaseState), 661 le32_to_cpu(rsp->Flags), 662 le16_to_cpu(rsp->Epoch), 663 le32_to_cpu(rsp->hdr.Id.SyncId.TreeId), 664 le64_to_cpu(rsp->hdr.SessionId), 665 *((u64 *)rsp->LeaseKey), 666 *((u64 *)&rsp->LeaseKey[8])); 667 668 cifs_dbg(FYI, "Checking for lease break\n"); 669 670 /* If server is a channel, select the primary channel */ 671 pserver = SERVER_IS_CHAN(server) ? server->primary_server : server; 672 673 /* look up tcon based on tid & uid */ 674 spin_lock(&cifs_tcp_ses_lock); 675 list_for_each_entry(ses, &pserver->smb_ses_list, smb_ses_list) { 676 if (cifs_ses_exiting(ses)) 677 continue; 678 list_for_each_entry(tcon, &ses->tcon_list, tcon_list) { 679 spin_lock(&tcon->open_file_lock); 680 cifs_stats_inc( 681 &tcon->stats.cifs_stats.num_oplock_brks); 682 if (smb2_tcon_has_lease(tcon, rsp)) { 683 spin_unlock(&tcon->open_file_lock); 684 spin_unlock(&cifs_tcp_ses_lock); 685 return true; 686 } 687 open = smb2_tcon_find_pending_open_lease(tcon, 688 rsp); 689 if (open) { 690 __u8 lease_key[SMB2_LEASE_KEY_SIZE]; 691 struct tcon_link *tlink; 692 693 tlink = cifs_get_tlink(open->tlink); 694 memcpy(lease_key, open->lease_key, 695 SMB2_LEASE_KEY_SIZE); 696 spin_unlock(&tcon->open_file_lock); 697 spin_unlock(&cifs_tcp_ses_lock); 698 smb2_queue_pending_open_break(tlink, 699 lease_key, 700 rsp->NewLeaseState); 701 return true; 702 } 703 spin_unlock(&tcon->open_file_lock); 704 705 if (cached_dir_lease_break(tcon, rsp->LeaseKey)) { 706 spin_unlock(&cifs_tcp_ses_lock); 707 return true; 708 } 709 } 710 } 711 spin_unlock(&cifs_tcp_ses_lock); 712 cifs_dbg(FYI, "Can not process lease break - no lease matched\n"); 713 trace_smb3_lease_not_found(le32_to_cpu(rsp->CurrentLeaseState), 714 le32_to_cpu(rsp->Flags), 715 le16_to_cpu(rsp->Epoch), 716 le32_to_cpu(rsp->hdr.Id.SyncId.TreeId), 717 le64_to_cpu(rsp->hdr.SessionId), 718 *((u64 *)rsp->LeaseKey), 719 *((u64 *)&rsp->LeaseKey[8])); 720 721 return false; 722 } 723 724 bool 725 smb2_is_valid_oplock_break(char *buffer, struct TCP_Server_Info *server) 726 { 727 struct smb2_oplock_break *rsp = (struct smb2_oplock_break *)buffer; 728 struct TCP_Server_Info *pserver; 729 struct cifs_ses *ses; 730 struct cifs_tcon *tcon; 731 struct cifsInodeInfo *cinode; 732 struct cifsFileInfo *cfile; 733 734 cifs_dbg(FYI, "Checking for oplock break\n"); 735 736 if (rsp->hdr.Command != SMB2_OPLOCK_BREAK) 737 return false; 738 739 if (rsp->StructureSize != 740 smb2_rsp_struct_sizes[SMB2_OPLOCK_BREAK_HE]) { 741 if (le16_to_cpu(rsp->StructureSize) == 44) 742 return smb2_is_valid_lease_break(buffer, server); 743 else 744 return false; 745 } 746 747 cifs_dbg(FYI, "oplock level 0x%x\n", rsp->OplockLevel); 748 749 /* If server is a channel, select the primary channel */ 750 pserver = SERVER_IS_CHAN(server) ? server->primary_server : server; 751 752 /* look up tcon based on tid & uid */ 753 spin_lock(&cifs_tcp_ses_lock); 754 list_for_each_entry(ses, &pserver->smb_ses_list, smb_ses_list) { 755 if (cifs_ses_exiting(ses)) 756 continue; 757 list_for_each_entry(tcon, &ses->tcon_list, tcon_list) { 758 759 spin_lock(&tcon->open_file_lock); 760 list_for_each_entry(cfile, &tcon->openFileList, tlist) { 761 if (rsp->PersistentFid != 762 cfile->fid.persistent_fid || 763 rsp->VolatileFid != 764 cfile->fid.volatile_fid) 765 continue; 766 767 cifs_dbg(FYI, "file id match, oplock break\n"); 768 cifs_stats_inc( 769 &tcon->stats.cifs_stats.num_oplock_brks); 770 cinode = CIFS_I(d_inode(cfile->dentry)); 771 spin_lock(&cfile->file_info_lock); 772 if (!CIFS_CACHE_WRITE(cinode) && 773 rsp->OplockLevel == SMB2_OPLOCK_LEVEL_NONE) 774 cfile->oplock_break_cancelled = true; 775 else 776 cfile->oplock_break_cancelled = false; 777 778 set_bit(CIFS_INODE_PENDING_OPLOCK_BREAK, 779 &cinode->flags); 780 781 cfile->oplock_epoch = 0; 782 cfile->oplock_level = rsp->OplockLevel; 783 784 spin_unlock(&cfile->file_info_lock); 785 786 cifs_queue_oplock_break(cfile); 787 788 spin_unlock(&tcon->open_file_lock); 789 spin_unlock(&cifs_tcp_ses_lock); 790 return true; 791 } 792 spin_unlock(&tcon->open_file_lock); 793 } 794 } 795 spin_unlock(&cifs_tcp_ses_lock); 796 cifs_dbg(FYI, "No file id matched, oplock break ignored\n"); 797 trace_smb3_oplock_not_found(0 /* no xid */, rsp->PersistentFid, 798 le32_to_cpu(rsp->hdr.Id.SyncId.TreeId), 799 le64_to_cpu(rsp->hdr.SessionId)); 800 801 return true; 802 } 803 804 void 805 smb2_cancelled_close_fid(struct work_struct *work) 806 { 807 struct close_cancelled_open *cancelled = container_of(work, 808 struct close_cancelled_open, work); 809 struct cifs_tcon *tcon = cancelled->tcon; 810 int rc; 811 812 if (cancelled->mid) 813 cifs_tcon_dbg(VFS, "Close unmatched open for MID:%llu\n", 814 cancelled->mid); 815 else 816 cifs_tcon_dbg(VFS, "Close interrupted close\n"); 817 818 rc = SMB2_close(0, tcon, cancelled->fid.persistent_fid, 819 cancelled->fid.volatile_fid); 820 if (rc) 821 cifs_tcon_dbg(VFS, "Close cancelled mid failed rc:%d\n", rc); 822 823 cifs_put_tcon(tcon, netfs_trace_tcon_ref_put_cancelled_close_fid); 824 kfree(cancelled); 825 } 826 827 /* 828 * Caller should already has an extra reference to @tcon 829 * This function is used to queue work to close a handle to prevent leaks 830 * on the server. 831 * We handle two cases. If an open was interrupted after we sent the 832 * SMB2_CREATE to the server but before we processed the reply, and second 833 * if a close was interrupted before we sent the SMB2_CLOSE to the server. 834 */ 835 static int 836 __smb2_handle_cancelled_cmd(struct cifs_tcon *tcon, __u16 cmd, __u64 mid, 837 __u64 persistent_fid, __u64 volatile_fid) 838 { 839 struct close_cancelled_open *cancelled; 840 841 cancelled = kzalloc_obj(*cancelled); 842 if (!cancelled) 843 return -ENOMEM; 844 845 cancelled->fid.persistent_fid = persistent_fid; 846 cancelled->fid.volatile_fid = volatile_fid; 847 cancelled->tcon = tcon; 848 cancelled->cmd = cmd; 849 cancelled->mid = mid; 850 INIT_WORK(&cancelled->work, smb2_cancelled_close_fid); 851 WARN_ON(queue_work(cifsiod_wq, &cancelled->work) == false); 852 853 return 0; 854 } 855 856 int 857 smb2_handle_cancelled_close(struct cifs_tcon *tcon, __u64 persistent_fid, 858 __u64 volatile_fid) 859 { 860 int rc; 861 862 cifs_dbg(FYI, "%s: tc_count=%d\n", __func__, tcon->tc_count); 863 spin_lock(&tcon->tc_lock); 864 if (tcon->tc_count <= 0) { 865 struct TCP_Server_Info *server = NULL; 866 867 trace_smb3_tcon_ref(tcon->debug_id, tcon->tc_count, 868 netfs_trace_tcon_ref_see_cancelled_close); 869 WARN_ONCE(tcon->tc_count < 0, "tcon refcount is negative"); 870 spin_unlock(&tcon->tc_lock); 871 872 if (tcon->ses) { 873 server = tcon->ses->server; 874 cifs_server_dbg(FYI, 875 "tid=0x%x: tcon is closing, skipping async close retry of fid %llu %llu\n", 876 tcon->tid, persistent_fid, volatile_fid); 877 } 878 879 return 0; 880 } 881 tcon->tc_count++; 882 trace_smb3_tcon_ref(tcon->debug_id, tcon->tc_count, 883 netfs_trace_tcon_ref_get_cancelled_close); 884 spin_unlock(&tcon->tc_lock); 885 886 rc = __smb2_handle_cancelled_cmd(tcon, SMB2_CLOSE_HE, 0, 887 persistent_fid, volatile_fid); 888 if (rc) 889 cifs_put_tcon(tcon, netfs_trace_tcon_ref_put_cancelled_close); 890 891 return rc; 892 } 893 894 int 895 smb2_handle_cancelled_mid(struct mid_q_entry *mid, struct TCP_Server_Info *server) 896 { 897 struct smb2_hdr *hdr = mid->resp_buf; 898 struct smb2_create_rsp *rsp = mid->resp_buf; 899 struct cifs_tcon *tcon; 900 int rc; 901 902 if ((mid->optype & CIFS_CP_CREATE_CLOSE_OP) || hdr->Command != SMB2_CREATE || 903 hdr->Status != STATUS_SUCCESS) 904 return 0; 905 906 tcon = smb2_find_smb_tcon(server, le64_to_cpu(hdr->SessionId), 907 le32_to_cpu(hdr->Id.SyncId.TreeId)); 908 if (!tcon) 909 return -ENOENT; 910 911 rc = __smb2_handle_cancelled_cmd(tcon, 912 le16_to_cpu(hdr->Command), 913 le64_to_cpu(hdr->MessageId), 914 rsp->PersistentFileId, 915 rsp->VolatileFileId); 916 if (rc) 917 cifs_put_tcon(tcon, netfs_trace_tcon_ref_put_cancelled_mid); 918 919 return rc; 920 } 921 922 /** 923 * smb311_update_preauth_hash - update @ses hash with the packet data in @iov 924 * 925 * Assumes @iov does not contain the rfc1002 length and iov[0] has the 926 * SMB2 header. 927 * 928 * @ses: server session structure 929 * @server: pointer to server info 930 * @iov: array containing the SMB request we will send to the server 931 * @nvec: number of array entries for the iov 932 */ 933 void 934 smb311_update_preauth_hash(struct cifs_ses *ses, struct TCP_Server_Info *server, 935 struct kvec *iov, int nvec) 936 { 937 int i; 938 struct smb2_hdr *hdr; 939 struct sha512_ctx sha_ctx; 940 941 hdr = (struct smb2_hdr *)iov[0].iov_base; 942 /* neg prot are always taken */ 943 if (hdr->Command == SMB2_NEGOTIATE) 944 goto ok; 945 946 /* 947 * If we process a command which wasn't a negprot it means the 948 * neg prot was already done, so the server dialect was set 949 * and we can test it. Preauth requires 3.1.1 for now. 950 */ 951 if (server->dialect != SMB311_PROT_ID) 952 return; 953 954 if (hdr->Command != SMB2_SESSION_SETUP) 955 return; 956 957 /* skip last sess setup response */ 958 if ((hdr->Flags & SMB2_FLAGS_SERVER_TO_REDIR) 959 && (hdr->Status == NT_STATUS_OK 960 || (hdr->Status != 961 cpu_to_le32(NT_STATUS_MORE_PROCESSING_REQUIRED)))) 962 return; 963 964 ok: 965 sha512_init(&sha_ctx); 966 sha512_update(&sha_ctx, ses->preauth_sha_hash, SMB2_PREAUTH_HASH_SIZE); 967 for (i = 0; i < nvec; i++) 968 sha512_update(&sha_ctx, iov[i].iov_base, iov[i].iov_len); 969 sha512_final(&sha_ctx, ses->preauth_sha_hash); 970 } 971