xref: /linux/fs/smb/client/reparse.c (revision e1253a82bb4c0fed6706a5839fc8b6e01be1abe2)
1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3  * Copyright (c) 2024 Paulo Alcantara <pc@manguebit.com>
4  */
5 
6 #include <linux/ctype.h>
7 #include <linux/fs.h>
8 #include <linux/stat.h>
9 #include <linux/slab.h>
10 #include "cifsglob.h"
11 #include "smb2proto.h"
12 #include "cifsproto.h"
13 #include "cifs_unicode.h"
14 #include "cifs_debug.h"
15 #include "fs_context.h"
16 #include "reparse.h"
17 
18 static int mknod_nfs(unsigned int xid, struct inode *inode,
19 		     struct dentry *dentry, struct cifs_tcon *tcon,
20 		     const char *full_path, umode_t mode, dev_t dev,
21 		     const char *symname);
22 
23 static int mknod_wsl(unsigned int xid, struct inode *inode,
24 		     struct dentry *dentry, struct cifs_tcon *tcon,
25 		     const char *full_path, umode_t mode, dev_t dev,
26 		     const char *symname);
27 
28 static int create_native_symlink(const unsigned int xid, struct inode *inode,
29 				 struct dentry *dentry, struct cifs_tcon *tcon,
30 				 const char *full_path, const char *symname);
31 
32 static int detect_directory_symlink_target(struct cifs_sb_info *cifs_sb,
33 					   const unsigned int xid,
34 					   const char *full_path,
35 					   const char *symname,
36 					   bool *directory);
37 
38 int create_reparse_symlink(const unsigned int xid, struct inode *inode,
39 				struct dentry *dentry, struct cifs_tcon *tcon,
40 				const char *full_path, const char *symname)
41 {
42 	switch (cifs_symlink_type(CIFS_SB(inode->i_sb))) {
43 	case CIFS_SYMLINK_TYPE_NATIVE:
44 		return create_native_symlink(xid, inode, dentry, tcon, full_path, symname);
45 	case CIFS_SYMLINK_TYPE_NFS:
46 		return mknod_nfs(xid, inode, dentry, tcon, full_path, S_IFLNK, 0, symname);
47 	case CIFS_SYMLINK_TYPE_WSL:
48 		return mknod_wsl(xid, inode, dentry, tcon, full_path, S_IFLNK, 0, symname);
49 	default:
50 		return -EOPNOTSUPP;
51 	}
52 }
53 
54 static int create_native_symlink(const unsigned int xid, struct inode *inode,
55 				 struct dentry *dentry, struct cifs_tcon *tcon,
56 				 const char *full_path, const char *symname)
57 {
58 	struct reparse_symlink_data_buffer *buf = NULL;
59 	struct cifs_sb_info *cifs_sb = CIFS_SB(inode);
60 	const char *symroot = cifs_sb->ctx->symlinkroot;
61 	struct cifs_open_info_data data = {};
62 	char sep = CIFS_DIR_SEP(cifs_sb);
63 	char *symlink_target = NULL;
64 	u16 len, plen, poff, slen;
65 	unsigned int sbflags;
66 	__le16 *path = NULL;
67 	struct inode *new;
68 	char *sym = NULL;
69 	struct kvec iov;
70 	bool directory;
71 	int path_len;
72 	int rc = 0;
73 
74 	if (strlen(symname) > REPARSE_SYM_PATH_MAX)
75 		return -ENAMETOOLONG;
76 
77 	symlink_target = kstrdup(symname, GFP_KERNEL);
78 	if (!symlink_target) {
79 		rc = -ENOMEM;
80 		goto out;
81 	}
82 
83 	data = (struct cifs_open_info_data) {
84 		.reparse_point = true,
85 		.reparse = { .tag = IO_REPARSE_TAG_SYMLINK, },
86 		.symlink_target = symlink_target,
87 	};
88 
89 	sbflags = cifs_sb_flags(cifs_sb);
90 	if (!(sbflags & CIFS_MOUNT_POSIX_PATHS) && symroot && symname[0] == '/') {
91 		/*
92 		 * This is a request to create an absolute symlink on the server
93 		 * which does not support POSIX paths, and expects symlink in
94 		 * NT-style path. So convert absolute Linux symlink target path
95 		 * to the absolute NT-style path. Root of the NT-style path for
96 		 * symlinks is specified in "symlinkroot" mount option. This will
97 		 * ensure compatibility of this symlink stored in absolute form
98 		 * on the SMB server.
99 		 */
100 		if (!strstarts(symname, symroot)) {
101 			/*
102 			 * If the absolute Linux symlink target path is not
103 			 * inside "symlinkroot" location then there is no way
104 			 * to convert such Linux symlink to NT-style path.
105 			 */
106 			cifs_dbg(VFS,
107 				 "absolute symlink '%s' cannot be converted to NT format "
108 				 "because it is outside of symlinkroot='%s'\n",
109 				 symname, symroot);
110 			rc = -EINVAL;
111 			goto out;
112 		}
113 		len = strlen(symroot);
114 		if (symroot[len - 1] != '/')
115 			len++;
116 		if (symname[len] >= 'a' && symname[len] <= 'z' &&
117 		    (symname[len+1] == '/' || symname[len+1] == '\0')) {
118 			/*
119 			 * Symlink points to Linux target /symlinkroot/x/path/...
120 			 * where 'x' is the lowercase local Windows drive.
121 			 * NT-style path for 'x' has common form \??\X:\path\...
122 			 * with uppercase local Windows drive.
123 			 */
124 			int common_path_len = strlen(symname+len+1)+1;
125 			sym = kzalloc(6+common_path_len, GFP_KERNEL);
126 			if (!sym) {
127 				rc = -ENOMEM;
128 				goto out;
129 			}
130 			memcpy(sym, "\\??\\", 4);
131 			sym[4] = symname[len] - ('a'-'A');
132 			sym[5] = ':';
133 			memcpy(sym+6, symname+len+1, common_path_len);
134 		} else {
135 			/* Unhandled absolute symlink. Report an error. */
136 			cifs_dbg(
137 				 VFS,
138 				 "absolute symlink '%s' cannot be converted to NT format "
139 				 "because it points to unknown target\n",
140 				 symname);
141 			rc = -EINVAL;
142 			goto out;
143 		}
144 	} else {
145 		/*
146 		 * This is request to either create an absolute symlink on
147 		 * server which expects POSIX paths or it is an request to
148 		 * create a relative symlink from the current directory.
149 		 * These paths have same format as relative SMB symlinks,
150 		 * so no conversion is needed. So just take symname as-is.
151 		 */
152 		sym = kstrdup(symname, GFP_KERNEL);
153 		if (!sym) {
154 			rc = -ENOMEM;
155 			goto out;
156 		}
157 	}
158 
159 	if (sep == '\\')
160 		convert_delimiter(sym, sep);
161 
162 	/*
163 	 * Absolute NT symlinks must retain the leading backslash, "\\??\\"
164 	 * prefix and drive-letter colon. cifs_convert_path_to_utf16() strips
165 	 * the leading backslash and maps '?' and ':', so temporarily mask
166 	 * these characters with '_' and restore them after conversion.
167 	 *
168 	 * When symlinkroot is unset, sym comes directly from the caller.
169 	 * Validate the complete "\\??\\X:" prefix before using fixed offsets
170 	 * or subtracting the NT prefix length below. Require an ASCII drive
171 	 * letter so the prefix occupies six characters in UTF-16 too.
172 	 */
173 	if (!(sbflags & CIFS_MOUNT_POSIX_PATHS) && symname[0] == '/') {
174 		if (!strstarts(sym, "\\??\\") || !isascii(sym[4]) ||
175 		    !isalpha(sym[4]) || sym[5] != ':') {
176 			rc = -EINVAL;
177 			goto out;
178 		}
179 		sym[0] = sym[1] = sym[2] = sym[5] = '_';
180 	}
181 
182 	/*
183 	 * On a POSIX paths mount the symlink target is stored verbatim, so
184 	 * convert it with cifs_strndup_to_utf16().  cifs_convert_path_to_utf16()
185 	 * must not be used here: it strips a leading path separator (it is
186 	 * meant for share-relative SMB paths), which would corrupt an absolute
187 	 * POSIX symlink target such as "/foo/bar".  Using NO_MAP_UNI_RSVD also
188 	 * matches the readback path in smb2_parse_native_symlink().
189 	 */
190 	if (sbflags & CIFS_MOUNT_POSIX_PATHS)
191 		path = cifs_strndup_to_utf16(sym, strlen(sym), &path_len,
192 					     cifs_sb->local_nls,
193 					     NO_MAP_UNI_RSVD);
194 	else
195 		path = cifs_convert_path_to_utf16(sym, cifs_sb);
196 
197 	if (!path) {
198 		rc = -ENOMEM;
199 		goto out;
200 	}
201 
202 	if (!(sbflags & CIFS_MOUNT_POSIX_PATHS) && symname[0] == '/') {
203 		sym[0] = '\\';
204 		sym[1] = sym[2] = '?';
205 		sym[5] = ':';
206 		path[0] = cpu_to_le16('\\');
207 		path[1] = path[2] = cpu_to_le16('?');
208 		path[5] = cpu_to_le16(':');
209 	}
210 
211 	/*
212 	 * SMB distinguish between symlink to directory and symlink to file.
213 	 * They cannot be exchanged (symlink of file type which points to
214 	 * directory cannot be resolved and vice-versa). Try to detect if
215 	 * the symlink target could be a directory or not. When detection
216 	 * fails then treat symlink as a file (non-directory) symlink.
217 	 */
218 	directory = false;
219 	rc = detect_directory_symlink_target(cifs_sb, xid, full_path, symname, &directory);
220 	if (rc < 0)
221 		goto out;
222 
223 	slen = 2 * UniStrnlen((wchar_t *)path, REPARSE_SYM_PATH_MAX);
224 	poff = 0;
225 	plen = slen;
226 	if (!(sbflags & CIFS_MOUNT_POSIX_PATHS) && symname[0] == '/') {
227 		/*
228 		 * For absolute NT symlinks skip leading "\\??\\" in PrintName as
229 		 * PrintName is user visible location in DOS/Win32 format (not in NT format).
230 		 */
231 		poff = 4;
232 		plen -= 2 * poff;
233 	}
234 	len = sizeof(*buf) + plen + slen;
235 	buf = kzalloc(len, GFP_KERNEL);
236 	if (!buf) {
237 		rc = -ENOMEM;
238 		goto out;
239 	}
240 
241 	buf->ReparseTag = cpu_to_le32(IO_REPARSE_TAG_SYMLINK);
242 	buf->ReparseDataLength = cpu_to_le16(len - sizeof(struct reparse_data_buffer));
243 
244 	buf->SubstituteNameOffset = cpu_to_le16(plen);
245 	buf->SubstituteNameLength = cpu_to_le16(slen);
246 	memcpy(&buf->PathBuffer[plen], path, slen);
247 
248 	buf->PrintNameOffset = 0;
249 	buf->PrintNameLength = cpu_to_le16(plen);
250 	memcpy(buf->PathBuffer, path+poff, plen);
251 
252 	buf->Flags = cpu_to_le32(*symname != '/' ? SYMLINK_FLAG_RELATIVE : 0);
253 
254 	iov.iov_base = buf;
255 	iov.iov_len = len;
256 	new = tcon->ses->server->ops->create_reparse_inode(
257 				     &data, inode->i_sb, xid,
258 				     tcon, full_path, directory,
259 				     &iov, NULL);
260 	if (!IS_ERR(new))
261 		d_instantiate(dentry, new);
262 	else
263 		rc = PTR_ERR(new);
264 out:
265 	kfree(sym);
266 	kfree(path);
267 	cifs_free_open_info(&data);
268 	kfree(buf);
269 	return rc;
270 }
271 
272 static int detect_directory_symlink_target(struct cifs_sb_info *cifs_sb,
273 					   const unsigned int xid,
274 					   const char *full_path,
275 					   const char *symname,
276 					   bool *directory)
277 {
278 	char sep = CIFS_DIR_SEP(cifs_sb);
279 	struct cifs_open_parms oparms;
280 	struct tcon_link *tlink;
281 	struct cifs_tcon *tcon;
282 	const char *basename;
283 	struct cifs_fid fid;
284 	char *resolved_path;
285 	int full_path_len;
286 	int basename_len;
287 	int symname_len;
288 	char *path_sep;
289 	__u32 oplock;
290 	int open_rc;
291 
292 	/*
293 	 * First do some simple check. If the original Linux symlink target ends
294 	 * with slash, or last path component is dot or dot-dot then it is for
295 	 * sure symlink to the directory.
296 	 */
297 	basename = kbasename(symname);
298 	basename_len = strlen(basename);
299 	if (basename_len == 0 || /* symname ends with slash */
300 	    (basename_len == 1 && basename[0] == '.') || /* last component is "." */
301 	    (basename_len == 2 && basename[0] == '.' && basename[1] == '.')) { /* or ".." */
302 		*directory = true;
303 		return 0;
304 	}
305 
306 	/*
307 	 * For absolute symlinks it is not possible to determine
308 	 * if it should point to directory or file.
309 	 */
310 	if (symname[0] == '/') {
311 		cifs_dbg(FYI,
312 			 "%s: cannot determinate if the symlink target path '%s' "
313 			 "is directory or not, creating '%s' as file symlink\n",
314 			 __func__, symname, full_path);
315 		return 0;
316 	}
317 
318 	/*
319 	 * If it was not detected as directory yet and the symlink is relative
320 	 * then try to resolve the path on the SMB server, check if the path
321 	 * exists and determinate if it is a directory or not.
322 	 */
323 
324 	full_path_len = strlen(full_path);
325 	symname_len = strlen(symname);
326 
327 	tlink = cifs_sb_tlink(cifs_sb);
328 	if (IS_ERR(tlink))
329 		return PTR_ERR(tlink);
330 
331 	resolved_path = kzalloc(full_path_len + symname_len + 1, GFP_KERNEL);
332 	if (!resolved_path) {
333 		cifs_put_tlink(tlink);
334 		return -ENOMEM;
335 	}
336 
337 	/*
338 	 * Compose the resolved SMB symlink path from the SMB full path
339 	 * and Linux target symlink path.
340 	 */
341 	memcpy(resolved_path, full_path, full_path_len+1);
342 	path_sep = strrchr(resolved_path, sep);
343 	if (path_sep)
344 		path_sep++;
345 	else
346 		path_sep = resolved_path;
347 	memcpy(path_sep, symname, symname_len+1);
348 	if (sep == '\\')
349 		convert_delimiter(path_sep, sep);
350 
351 	tcon = tlink_tcon(tlink);
352 	oparms = CIFS_OPARMS(cifs_sb, tcon, resolved_path,
353 			     FILE_READ_ATTRIBUTES, FILE_OPEN, 0, ACL_NO_MODE);
354 	oparms.fid = &fid;
355 
356 	/* Try to open as a directory (NOT_FILE) */
357 	oplock = 0;
358 	oparms.create_options = cifs_create_options(cifs_sb,
359 						    CREATE_NOT_FILE | OPEN_REPARSE_POINT);
360 	open_rc = tcon->ses->server->ops->open(xid, &oparms, &oplock, NULL);
361 	if (open_rc == 0) {
362 		/* Successful open means that the target path is definitely a directory. */
363 		*directory = true;
364 		tcon->ses->server->ops->close(xid, tcon, &fid);
365 	} else if (open_rc == -ENOTDIR) {
366 		/* -ENOTDIR means that the target path is definitely a file. */
367 		*directory = false;
368 	} else if (open_rc == -ENOENT) {
369 		/* -ENOENT means that the target path does not exist. */
370 		cifs_dbg(FYI,
371 			 "%s: symlink target path '%s' does not exist, "
372 			 "creating '%s' as file symlink\n",
373 			 __func__, symname, full_path);
374 	} else {
375 		/* Try to open as a file (NOT_DIR) */
376 		oplock = 0;
377 		oparms.create_options = cifs_create_options(cifs_sb,
378 							    CREATE_NOT_DIR | OPEN_REPARSE_POINT);
379 		open_rc = tcon->ses->server->ops->open(xid, &oparms, &oplock, NULL);
380 		if (open_rc == 0) {
381 			/* Successful open means that the target path is definitely a file. */
382 			*directory = false;
383 			tcon->ses->server->ops->close(xid, tcon, &fid);
384 		} else if (open_rc == -EISDIR) {
385 			/* -EISDIR means that the target path is definitely a directory. */
386 			*directory = true;
387 		} else {
388 			/*
389 			 * This code branch is called when we do not have a permission to
390 			 * open the resolved_path or some other client/process denied
391 			 * opening the resolved_path.
392 			 *
393 			 * TODO: Try to use ops->query_dir_first on the parent directory
394 			 * of resolved_path, search for basename of resolved_path and
395 			 * check if the ATTR_DIRECTORY is set in fi.Attributes. In some
396 			 * case this could work also when opening of the path is denied.
397 			 */
398 			cifs_dbg(FYI,
399 				 "%s: cannot determinate if the symlink target path '%s' "
400 				 "is directory or not, creating '%s' as file symlink\n",
401 				 __func__, symname, full_path);
402 		}
403 	}
404 
405 	kfree(resolved_path);
406 	cifs_put_tlink(tlink);
407 	return 0;
408 }
409 
410 static int create_native_socket(const unsigned int xid, struct inode *inode,
411 				struct dentry *dentry, struct cifs_tcon *tcon,
412 				const char *full_path)
413 {
414 	struct reparse_data_buffer buf = {
415 		.ReparseTag = cpu_to_le32(IO_REPARSE_TAG_AF_UNIX),
416 		.ReparseDataLength = cpu_to_le16(0),
417 	};
418 	struct cifs_open_info_data data = {
419 		.reparse_point = true,
420 		.reparse = { .tag = IO_REPARSE_TAG_AF_UNIX, .buf = &buf, },
421 	};
422 	struct kvec iov = {
423 		.iov_base = &buf,
424 		.iov_len = sizeof(buf),
425 	};
426 	struct inode *new;
427 	int rc = 0;
428 
429 	new = tcon->ses->server->ops->create_reparse_inode(
430 				     &data, inode->i_sb, xid,
431 				     tcon, full_path, false, &iov, NULL);
432 	if (!IS_ERR(new))
433 		d_instantiate(dentry, new);
434 	else
435 		rc = PTR_ERR(new);
436 	cifs_free_open_info(&data);
437 	return rc;
438 }
439 
440 static int nfs_set_reparse_buf(struct reparse_nfs_data_buffer *buf,
441 			       mode_t mode, dev_t dev,
442 			       __le16 *symname_utf16,
443 			       int symname_utf16_len,
444 			       struct kvec *iov)
445 {
446 	u64 type;
447 	u16 len, dlen;
448 
449 	len = sizeof(*buf);
450 
451 	switch ((type = reparse_mode_nfs_type(mode))) {
452 	case NFS_SPECFILE_BLK:
453 	case NFS_SPECFILE_CHR:
454 		dlen = 2 * sizeof(__le32);
455 		((__le32 *)buf->DataBuffer)[0] = cpu_to_le32(MAJOR(dev));
456 		((__le32 *)buf->DataBuffer)[1] = cpu_to_le32(MINOR(dev));
457 		break;
458 	case NFS_SPECFILE_LNK:
459 		dlen = symname_utf16_len;
460 		memcpy(buf->DataBuffer, symname_utf16, symname_utf16_len);
461 		break;
462 	case NFS_SPECFILE_FIFO:
463 	case NFS_SPECFILE_SOCK:
464 		dlen = 0;
465 		break;
466 	default:
467 		return -EOPNOTSUPP;
468 	}
469 
470 	buf->ReparseTag = cpu_to_le32(IO_REPARSE_TAG_NFS);
471 	buf->Reserved = 0;
472 	buf->InodeType = cpu_to_le64(type);
473 	buf->ReparseDataLength = cpu_to_le16(len + dlen -
474 					     sizeof(struct reparse_data_buffer));
475 	iov->iov_base = buf;
476 	iov->iov_len = len + dlen;
477 	return 0;
478 }
479 
480 static int mknod_nfs(unsigned int xid, struct inode *inode,
481 		     struct dentry *dentry, struct cifs_tcon *tcon,
482 		     const char *full_path, umode_t mode, dev_t dev,
483 		     const char *symname)
484 {
485 	struct cifs_sb_info *cifs_sb = CIFS_SB(inode->i_sb);
486 	struct cifs_open_info_data data;
487 	struct reparse_nfs_data_buffer *p = NULL;
488 	__le16 *symname_utf16 = NULL;
489 	int symname_utf16_len = 0;
490 	struct inode *new;
491 	struct kvec iov;
492 	__u8 buf[sizeof(*p) + sizeof(__le64)];
493 	int rc;
494 
495 	if (S_ISLNK(mode)) {
496 		symname_utf16 = cifs_strndup_to_utf16(symname, strlen(symname),
497 						      &symname_utf16_len,
498 						      cifs_sb->local_nls,
499 						      NO_MAP_UNI_RSVD);
500 		if (!symname_utf16) {
501 			rc = -ENOMEM;
502 			goto out;
503 		}
504 		symname_utf16_len -= 2; /* symlink is without trailing wide-nul */
505 		p = kzalloc(sizeof(*p) + symname_utf16_len, GFP_KERNEL);
506 		if (!p) {
507 			rc = -ENOMEM;
508 			goto out;
509 		}
510 	} else {
511 		p = (struct reparse_nfs_data_buffer *)buf;
512 	}
513 	rc = nfs_set_reparse_buf(p, mode, dev, symname_utf16, symname_utf16_len, &iov);
514 	if (rc)
515 		goto out;
516 
517 	data = (struct cifs_open_info_data) {
518 		.reparse_point = true,
519 		.reparse = { .tag = IO_REPARSE_TAG_NFS, .buf = (struct reparse_data_buffer *)p, },
520 		.symlink_target = kstrdup(symname, GFP_KERNEL),
521 	};
522 
523 	new = tcon->ses->server->ops->create_reparse_inode(
524 				     &data, inode->i_sb, xid,
525 				     tcon, full_path, false, &iov, NULL);
526 	if (!IS_ERR(new))
527 		d_instantiate(dentry, new);
528 	else
529 		rc = PTR_ERR(new);
530 	cifs_free_open_info(&data);
531 out:
532 	if (S_ISLNK(mode)) {
533 		kfree(symname_utf16);
534 		kfree(p);
535 	}
536 	return rc;
537 }
538 
539 static int wsl_set_reparse_buf(struct reparse_data_buffer **buf,
540 			       mode_t mode, const char *symname,
541 			       struct cifs_sb_info *cifs_sb,
542 			       struct kvec *iov)
543 {
544 	struct reparse_wsl_symlink_data_buffer *symlink_buf;
545 	__le16 *symname_utf16;
546 	int symname_utf16_len;
547 	int symname_utf8_maxlen;
548 	int symname_utf8_len;
549 	size_t buf_len;
550 	u32 tag;
551 
552 	switch ((tag = reparse_mode_wsl_tag(mode))) {
553 	case IO_REPARSE_TAG_LX_BLK:
554 	case IO_REPARSE_TAG_LX_CHR:
555 	case IO_REPARSE_TAG_LX_FIFO:
556 	case IO_REPARSE_TAG_AF_UNIX:
557 		buf_len = sizeof(struct reparse_data_buffer);
558 		*buf = kzalloc(buf_len, GFP_KERNEL);
559 		if (!*buf)
560 			return -ENOMEM;
561 		break;
562 	case IO_REPARSE_TAG_LX_SYMLINK:
563 		symname_utf16 = cifs_strndup_to_utf16(symname, strlen(symname),
564 						      &symname_utf16_len,
565 						      cifs_sb->local_nls,
566 						      NO_MAP_UNI_RSVD);
567 		if (!symname_utf16)
568 			return -ENOMEM;
569 		symname_utf8_maxlen = symname_utf16_len/2*3;
570 		symlink_buf = kzalloc(sizeof(struct reparse_wsl_symlink_data_buffer) +
571 				      symname_utf8_maxlen, GFP_KERNEL);
572 		if (!symlink_buf) {
573 			kfree(symname_utf16);
574 			return -ENOMEM;
575 		}
576 		/* Version field must be set to 2 (MS-FSCC 2.1.2.7) */
577 		symlink_buf->Version = cpu_to_le32(2);
578 		/* Target for Version 2 is in UTF-8 but without trailing null-term byte */
579 		symname_utf8_len = utf16s_to_utf8s((wchar_t *)symname_utf16, symname_utf16_len/2,
580 						   UTF16_LITTLE_ENDIAN,
581 						   symlink_buf->Target,
582 						   symname_utf8_maxlen);
583 		*buf = (struct reparse_data_buffer *)symlink_buf;
584 		buf_len = sizeof(struct reparse_wsl_symlink_data_buffer) + symname_utf8_len;
585 		kfree(symname_utf16);
586 		break;
587 	default:
588 		return -EOPNOTSUPP;
589 	}
590 
591 	(*buf)->ReparseTag = cpu_to_le32(tag);
592 	(*buf)->Reserved = 0;
593 	(*buf)->ReparseDataLength = cpu_to_le16(buf_len - sizeof(struct reparse_data_buffer));
594 	iov->iov_base = *buf;
595 	iov->iov_len = buf_len;
596 	return 0;
597 }
598 
599 static struct smb2_create_ea_ctx *ea_create_context(u32 dlen, size_t *cc_len)
600 {
601 	struct smb2_create_ea_ctx *cc;
602 
603 	*cc_len = round_up(sizeof(*cc) + dlen, 8);
604 	cc = kzalloc(*cc_len, GFP_KERNEL);
605 	if (!cc)
606 		return ERR_PTR(-ENOMEM);
607 
608 	cc->ctx.NameOffset = cpu_to_le16(offsetof(struct smb2_create_ea_ctx,
609 						  name));
610 	cc->ctx.NameLength = cpu_to_le16(4);
611 	memcpy(cc->name, SMB2_CREATE_EA_BUFFER, strlen(SMB2_CREATE_EA_BUFFER));
612 	cc->ctx.DataOffset = cpu_to_le16(offsetof(struct smb2_create_ea_ctx, ea));
613 	cc->ctx.DataLength = cpu_to_le32(dlen);
614 	return cc;
615 }
616 
617 struct wsl_xattr {
618 	const char	*name;
619 	__le64		value;
620 	u16		size;
621 	u32		next;
622 };
623 
624 static int wsl_set_xattrs(struct inode *inode, umode_t _mode,
625 			  dev_t _dev, struct kvec *iov)
626 {
627 	struct smb2_file_full_ea_info *ea;
628 	struct smb2_create_ea_ctx *cc;
629 	struct smb3_fs_context *ctx = CIFS_SB(inode->i_sb)->ctx;
630 	__le64 uid = cpu_to_le64(from_kuid(current_user_ns(), ctx->linux_uid));
631 	__le64 gid = cpu_to_le64(from_kgid(current_user_ns(), ctx->linux_gid));
632 	__le64 dev = cpu_to_le64(((u64)MINOR(_dev) << 32) | MAJOR(_dev));
633 	__le64 mode = cpu_to_le64(_mode);
634 	struct wsl_xattr xattrs[] = {
635 		{ .name = SMB2_WSL_XATTR_UID,  .value = uid,  .size = SMB2_WSL_XATTR_UID_SIZE, },
636 		{ .name = SMB2_WSL_XATTR_GID,  .value = gid,  .size = SMB2_WSL_XATTR_GID_SIZE, },
637 		{ .name = SMB2_WSL_XATTR_MODE, .value = mode, .size = SMB2_WSL_XATTR_MODE_SIZE, },
638 		{ .name = SMB2_WSL_XATTR_DEV,  .value = dev, .size = SMB2_WSL_XATTR_DEV_SIZE, },
639 	};
640 	size_t cc_len;
641 	u32 dlen = 0, next = 0;
642 	int i, num_xattrs;
643 	u8 name_size = SMB2_WSL_XATTR_NAME_LEN + 1;
644 
645 	memset(iov, 0, sizeof(*iov));
646 
647 	/* Exclude $LXDEV xattr for non-device files */
648 	if (!S_ISBLK(_mode) && !S_ISCHR(_mode))
649 		num_xattrs = ARRAY_SIZE(xattrs) - 1;
650 	else
651 		num_xattrs = ARRAY_SIZE(xattrs);
652 
653 	for (i = 0; i < num_xattrs; i++) {
654 		xattrs[i].next = ALIGN(sizeof(*ea) + name_size +
655 				       xattrs[i].size, 4);
656 		dlen += xattrs[i].next;
657 	}
658 
659 	cc = ea_create_context(dlen, &cc_len);
660 	if (IS_ERR(cc))
661 		return PTR_ERR(cc);
662 
663 	ea = &cc->ea;
664 	for (i = 0; i < num_xattrs; i++) {
665 		ea = (void *)((u8 *)ea + next);
666 		next = xattrs[i].next;
667 		ea->next_entry_offset = cpu_to_le32(next);
668 
669 		ea->ea_name_length = name_size - 1;
670 		ea->ea_value_length = cpu_to_le16(xattrs[i].size);
671 		memcpy(ea->ea_data, xattrs[i].name, name_size);
672 		memcpy(&ea->ea_data[name_size],
673 		       &xattrs[i].value, xattrs[i].size);
674 	}
675 	ea->next_entry_offset = 0;
676 
677 	iov->iov_base = cc;
678 	iov->iov_len = cc_len;
679 	return 0;
680 }
681 
682 static int mknod_wsl(unsigned int xid, struct inode *inode,
683 		     struct dentry *dentry, struct cifs_tcon *tcon,
684 		     const char *full_path, umode_t mode, dev_t dev,
685 		     const char *symname)
686 {
687 	struct cifs_sb_info *cifs_sb = CIFS_SB(inode->i_sb);
688 	struct cifs_open_info_data data;
689 	struct reparse_data_buffer *buf;
690 	struct smb2_create_ea_ctx *cc;
691 	struct inode *new;
692 	unsigned int len;
693 	struct kvec reparse_iov, xattr_iov;
694 	int rc;
695 
696 	rc = wsl_set_reparse_buf(&buf, mode, symname, cifs_sb, &reparse_iov);
697 	if (rc)
698 		return rc;
699 
700 	rc = wsl_set_xattrs(inode, mode, dev, &xattr_iov);
701 	if (rc) {
702 		kfree(buf);
703 		return rc;
704 	}
705 
706 	data = (struct cifs_open_info_data) {
707 		.reparse_point = true,
708 		.reparse = { .tag = le32_to_cpu(buf->ReparseTag), .buf = buf, },
709 		.symlink_target = kstrdup(symname, GFP_KERNEL),
710 	};
711 
712 	cc = xattr_iov.iov_base;
713 	len = le32_to_cpu(cc->ctx.DataLength);
714 	memcpy(data.wsl.eas, &cc->ea, len);
715 	data.wsl.eas_len = len;
716 
717 	new = tcon->ses->server->ops->create_reparse_inode(
718 				     &data, inode->i_sb,
719 				     xid, tcon, full_path, false,
720 				     &reparse_iov, &xattr_iov);
721 	if (!IS_ERR(new))
722 		d_instantiate(dentry, new);
723 	else
724 		rc = PTR_ERR(new);
725 	cifs_free_open_info(&data);
726 	kfree(xattr_iov.iov_base);
727 	kfree(buf);
728 	return rc;
729 }
730 
731 int mknod_reparse(unsigned int xid, struct inode *inode,
732 		       struct dentry *dentry, struct cifs_tcon *tcon,
733 		       const char *full_path, umode_t mode, dev_t dev)
734 {
735 	struct smb3_fs_context *ctx = CIFS_SB(inode->i_sb)->ctx;
736 
737 	if (S_ISSOCK(mode) && !ctx->nonativesocket && ctx->reparse_type != CIFS_REPARSE_TYPE_NONE)
738 		return create_native_socket(xid, inode, dentry, tcon, full_path);
739 
740 	switch (ctx->reparse_type) {
741 	case CIFS_REPARSE_TYPE_NFS:
742 		return mknod_nfs(xid, inode, dentry, tcon, full_path, mode, dev, NULL);
743 	case CIFS_REPARSE_TYPE_WSL:
744 		return mknod_wsl(xid, inode, dentry, tcon, full_path, mode, dev, NULL);
745 	default:
746 		return -EOPNOTSUPP;
747 	}
748 }
749 
750 /* See MS-FSCC 2.1.2.6 for the 'NFS' style reparse tags */
751 static int parse_reparse_nfs(struct reparse_nfs_data_buffer *buf,
752 			       struct cifs_sb_info *cifs_sb,
753 			       struct cifs_open_info_data *data)
754 {
755 	unsigned int len;
756 	u64 type;
757 
758 	len = le16_to_cpu(buf->ReparseDataLength);
759 	if (len < sizeof(buf->InodeType)) {
760 		cifs_dbg(VFS, "srv returned malformed nfs buffer\n");
761 		return smb_EIO2(smb_eio_trace_reparse_nfs_too_short,
762 				len, sizeof(buf->InodeType));
763 	}
764 
765 	len -= sizeof(buf->InodeType);
766 
767 	switch ((type = le64_to_cpu(buf->InodeType))) {
768 	case NFS_SPECFILE_LNK:
769 		if (len == 0 || (len % 2)) {
770 			cifs_dbg(VFS, "srv returned malformed nfs symlink buffer\n");
771 			return smb_EIO1(smb_eio_trace_reparse_nfs_symbuf, len);
772 		}
773 		/*
774 		 * Check that buffer does not contain UTF-16 null codepoint
775 		 * because Linux cannot process symlink with null byte.
776 		 */
777 		if (UniStrnlen((wchar_t *)buf->DataBuffer, len/2) != len/2) {
778 			cifs_dbg(VFS, "srv returned null byte in nfs symlink target location\n");
779 			return smb_EIO1(smb_eio_trace_reparse_nfs_nul, len);
780 		}
781 		data->symlink_target = cifs_strndup_from_utf16(buf->DataBuffer,
782 							       len, true,
783 							       cifs_sb->local_nls);
784 		if (!data->symlink_target)
785 			return -ENOMEM;
786 		cifs_dbg(FYI, "%s: target path: %s\n",
787 			 __func__, data->symlink_target);
788 		break;
789 	case NFS_SPECFILE_CHR:
790 	case NFS_SPECFILE_BLK:
791 		/* DataBuffer for block and char devices contains two 32-bit numbers */
792 		if (len != 8) {
793 			cifs_dbg(VFS, "srv returned malformed nfs buffer for type: 0x%llx\n", type);
794 			return smb_EIO1(smb_eio_trace_reparse_nfs_dev, len);
795 		}
796 		break;
797 	case NFS_SPECFILE_FIFO:
798 	case NFS_SPECFILE_SOCK:
799 		/* DataBuffer for fifos and sockets is empty */
800 		if (len != 0) {
801 			cifs_dbg(VFS, "srv returned malformed nfs buffer for type: 0x%llx\n", type);
802 			return smb_EIO1(smb_eio_trace_reparse_nfs_sockfifo, len);
803 		}
804 		break;
805 	default:
806 		cifs_dbg(VFS, "%s: unhandled inode type: 0x%llx\n",
807 			 __func__, type);
808 		return -EOPNOTSUPP;
809 	}
810 	return 0;
811 }
812 
813 int smb2_parse_native_symlink(char **target, const char *buf, unsigned int len,
814 			      bool relative,
815 			      const char *full_path,
816 			      struct cifs_sb_info *cifs_sb)
817 {
818 	const char *symroot = cifs_sb->ctx->symlinkroot;
819 	char sep = CIFS_DIR_SEP(cifs_sb);
820 	char *linux_target = NULL;
821 	char *smb_target = NULL;
822 	int symlinkroot_len;
823 	int abs_path_len;
824 	char *abs_path;
825 	int levels;
826 	int rc, ulen;
827 	int i;
828 
829 	/* Check that length it valid */
830 	if (!len || (len % 2)) {
831 		cifs_dbg(VFS, "srv returned malformed symlink buffer\n");
832 		rc = smb_EIO1(smb_eio_trace_reparse_native_nul, len);
833 		goto out;
834 	}
835 
836 	/*
837 	 * Check that buffer does not contain UTF-16 null codepoint
838 	 * because Linux cannot process symlink with null byte.
839 	 */
840 	ulen = UniStrnlen((wchar_t *)buf, len/2);
841 	if (ulen != len/2) {
842 		cifs_dbg(VFS, "srv returned null byte in native symlink target location\n");
843 		rc = smb_EIO2(smb_eio_trace_reparse_native_nul, ulen, len);
844 		goto out;
845 	}
846 
847 	smb_target = cifs_strndup_from_utf16(buf, len, true, cifs_sb->local_nls);
848 	if (!smb_target) {
849 		rc = -ENOMEM;
850 		goto out;
851 	}
852 
853 	if (!(cifs_sb_flags(cifs_sb) & CIFS_MOUNT_POSIX_PATHS) &&
854 	    symroot && !relative) {
855 		/*
856 		 * This is an absolute symlink from the server which does not
857 		 * support POSIX paths, so the symlink is in NT-style path.
858 		 * So convert it to absolute Linux symlink target path. Root of
859 		 * the NT-style path for symlinks is specified in "symlinkroot"
860 		 * mount option.
861 		 *
862 		 * Root of the DOS and Win32 paths is at NT path \??\
863 		 * It means that DOS/Win32 path C:\folder\file.txt is
864 		 * NT path \??\C:\folder\file.txt
865 		 *
866 		 * NT systems have some well-known object symlinks in their NT
867 		 * hierarchy, which is needed to take into account when resolving
868 		 * other symlinks. Most commonly used symlink paths are:
869 		 * \?? -> \GLOBAL??
870 		 * \DosDevices -> \??
871 		 * \GLOBAL??\GLOBALROOT -> \
872 		 * \GLOBAL??\Global -> \GLOBAL??
873 		 * \GLOBAL??\NUL -> \Device\Null
874 		 * \GLOBAL??\UNC -> \Device\Mup
875 		 * \GLOBAL??\PhysicalDrive0 -> \Device\Harddisk0\DR0 (for each harddisk)
876 		 * \GLOBAL??\A: -> \Device\Floppy0 (if A: is the first floppy)
877 		 * \GLOBAL??\C: -> \Device\HarddiskVolume1 (if C: is the first harddisk)
878 		 * \GLOBAL??\D: -> \Device\CdRom0 (if D: is first cdrom)
879 		 * \SystemRoot -> \Device\Harddisk0\Partition1\WINDOWS (or where is NT system installed)
880 		 * \Volume{...} -> \Device\HarddiskVolume1 (where ... is system generated guid)
881 		 *
882 		 * In most common cases, absolute NT symlinks points to path on
883 		 * DOS/Win32 drive letter, system-specific Volume or on UNC share.
884 		 * Here are few examples of commonly used absolute NT symlinks
885 		 * created by mklink.exe tool:
886 		 * \??\C:\folder\file.txt
887 		 * \??\\C:\folder\file.txt
888 		 * \??\UNC\server\share\file.txt
889 		 * \??\\UNC\server\share\file.txt
890 		 * \??\Volume{b75e2c83-0000-0000-0000-602f00000000}\folder\file.txt
891 		 *
892 		 * It means that the most common path prefix \??\ is also NT path
893 		 * symlink (to \GLOBAL??). It is less common that second path
894 		 * separator is double backslash, but it is valid.
895 		 *
896 		 * Volume guid is randomly generated by the target system and so
897 		 * only the target system knows the mapping between guid and the
898 		 * hardisk number. Over SMB it is not possible to resolve this
899 		 * mapping, therefore symlinks pointing to target location of
900 		 * volume guids are totally unusable over SMB.
901 		 *
902 		 * For now parse only symlink paths available for DOS and Win32.
903 		 * Those are paths with \??\ prefix or paths which points to \??\
904 		 * via other NT symlink (\DosDevices\, \GLOBAL??\, ...).
905 		 */
906 		abs_path = smb_target;
907 globalroot:
908 		if (strstarts(abs_path, "\\??\\"))
909 			abs_path += sizeof("\\??\\")-1;
910 		else if (strstarts(abs_path, "\\DosDevices\\"))
911 			abs_path += sizeof("\\DosDevices\\")-1;
912 		else if (strstarts(abs_path, "\\GLOBAL??\\"))
913 			abs_path += sizeof("\\GLOBAL??\\")-1;
914 		else
915 			goto out_unhandled_target;
916 
917 		/* Sometimes path separator after \?? is double backslash */
918 		if (abs_path[0] == '\\')
919 			abs_path++;
920 
921 		while (strstarts(abs_path, "Global\\"))
922 			abs_path += sizeof("Global\\")-1;
923 
924 		if (strstarts(abs_path, "GLOBALROOT\\")) {
925 			/* Label globalroot requires path with leading '\\', so do not trim '\\' */
926 			abs_path += sizeof("GLOBALROOT")-1;
927 			goto globalroot;
928 		}
929 
930 		/* For now parse only paths to drive letters */
931 		if (((abs_path[0] >= 'A' && abs_path[0] <= 'Z') ||
932 		     (abs_path[0] >= 'a' && abs_path[0] <= 'z')) &&
933 		    abs_path[1] == ':' &&
934 		    (abs_path[2] == '\\' || abs_path[2] == '\0')) {
935 			/* Convert drive letter to lowercase and drop colon */
936 			char drive_letter = abs_path[0];
937 			if (drive_letter >= 'A' && drive_letter <= 'Z')
938 				drive_letter += 'a'-'A';
939 			abs_path++;
940 			abs_path[0] = drive_letter;
941 		} else {
942 			goto out_unhandled_target;
943 		}
944 
945 		abs_path_len = strlen(abs_path)+1;
946 		symlinkroot_len = strlen(symroot);
947 		if (symroot[symlinkroot_len - 1] == '/')
948 			symlinkroot_len--;
949 		linux_target = kmalloc(symlinkroot_len + 1 + abs_path_len, GFP_KERNEL);
950 		if (!linux_target) {
951 			rc = -ENOMEM;
952 			goto out;
953 		}
954 		memcpy(linux_target, symroot, symlinkroot_len);
955 		linux_target[symlinkroot_len] = '/';
956 		memcpy(linux_target + symlinkroot_len + 1, abs_path, abs_path_len);
957 	} else if (smb_target[0] == sep && relative) {
958 		/*
959 		 * This is a relative SMB symlink from the top of the share,
960 		 * which is the top level directory of the Linux mount point.
961 		 * Linux does not support such relative symlinks, so convert
962 		 * it to the relative symlink from the current directory.
963 		 * full_path is the SMB path to the symlink (from which is
964 		 * extracted current directory) and smb_target is the SMB path
965 		 * where symlink points, therefore full_path must always be on
966 		 * the SMB share.
967 		 */
968 		int smb_target_len = strlen(smb_target)+1;
969 		levels = 0;
970 		for (i = 1; full_path[i]; i++) { /* i=1 to skip leading sep */
971 			if (full_path[i] == sep)
972 				levels++;
973 		}
974 		linux_target = kmalloc(levels*3 + smb_target_len, GFP_KERNEL);
975 		if (!linux_target) {
976 			rc = -ENOMEM;
977 			goto out;
978 		}
979 		for (i = 0; i < levels; i++) {
980 			linux_target[i*3 + 0] = '.';
981 			linux_target[i*3 + 1] = '.';
982 			linux_target[i*3 + 2] = sep;
983 		}
984 		/* +1 to skip leading sep */
985 		memcpy(linux_target + levels*3, smb_target+1, smb_target_len-1);
986 	} else {
987 		/*
988 		 * This is either an absolute symlink in POSIX-style format
989 		 * or relative SMB symlink from the current directory.
990 		 * These paths have same format as Linux symlinks, so no
991 		 * conversion is needed.
992 		 */
993 out_unhandled_target:
994 		linux_target = smb_target;
995 		smb_target = NULL;
996 	}
997 
998 	if (sep == '\\')
999 		convert_delimiter(linux_target, '/');
1000 
1001 	rc = 0;
1002 	*target = linux_target;
1003 
1004 	cifs_dbg(FYI, "%s: symlink target: %s\n", __func__, *target);
1005 
1006 out:
1007 	if (rc != 0)
1008 		kfree(linux_target);
1009 	kfree(smb_target);
1010 	return rc;
1011 }
1012 
1013 static int parse_reparse_native_symlink(struct reparse_symlink_data_buffer *sym,
1014 				 u32 plen,
1015 				 struct cifs_sb_info *cifs_sb,
1016 				 const char *full_path,
1017 				 struct cifs_open_info_data *data)
1018 {
1019 	unsigned int len;
1020 	unsigned int offs;
1021 
1022 	/* We handle Symbolic Link reparse tag here. See: MS-FSCC 2.1.2.4 */
1023 
1024 	offs = le16_to_cpu(sym->SubstituteNameOffset);
1025 	len = le16_to_cpu(sym->SubstituteNameLength);
1026 	if (offs + 20 > plen || offs + len + 20 > plen) {
1027 		cifs_dbg(VFS, "srv returned malformed symlink buffer\n");
1028 		return smb_EIO2(smb_eio_trace_reparse_native_sym_len,
1029 				offs << 16 | len, plen);
1030 	}
1031 
1032 	return smb2_parse_native_symlink(&data->symlink_target,
1033 					 sym->PathBuffer + offs,
1034 					 len,
1035 					 le32_to_cpu(sym->Flags) & SYMLINK_FLAG_RELATIVE,
1036 					 full_path,
1037 					 cifs_sb);
1038 }
1039 
1040 static int parse_reparse_wsl_symlink(struct reparse_wsl_symlink_data_buffer *buf,
1041 				     struct cifs_sb_info *cifs_sb,
1042 				     struct cifs_open_info_data *data)
1043 {
1044 	int len = le16_to_cpu(buf->ReparseDataLength);
1045 	int data_offset = offsetof(typeof(*buf), Target) - offsetof(typeof(*buf), Version);
1046 	int symname_utf8_len;
1047 	__le16 *symname_utf16;
1048 	int symname_utf16_len;
1049 
1050 	if (len <= data_offset) {
1051 		cifs_dbg(VFS, "srv returned malformed wsl symlink buffer\n");
1052 		return smb_EIO2(smb_eio_trace_reparse_wsl_symbuf,
1053 				len, data_offset);
1054 	}
1055 
1056 	/* MS-FSCC 2.1.2.7 defines layout of the Target field only for Version 2. */
1057 	u32 version = le32_to_cpu(buf->Version);
1058 
1059 	if (version != 2) {
1060 		cifs_dbg(VFS, "srv returned unsupported wsl symlink version %u\n", version);
1061 		return smb_EIO1(smb_eio_trace_reparse_wsl_ver, version);
1062 	}
1063 
1064 	/* Target for Version 2 is in UTF-8 but without trailing null-term byte */
1065 	symname_utf8_len = len - data_offset;
1066 	/*
1067 	 * Check that buffer does not contain null byte
1068 	 * because Linux cannot process symlink with null byte.
1069 	 */
1070 	size_t ulen = strnlen(buf->Target, symname_utf8_len);
1071 
1072 	if (ulen != symname_utf8_len) {
1073 		cifs_dbg(VFS, "srv returned null byte in wsl symlink target location\n");
1074 		return smb_EIO2(smb_eio_trace_reparse_wsl_ver,
1075 				ulen, symname_utf8_len);
1076 	}
1077 	symname_utf16 = kzalloc(symname_utf8_len * 2, GFP_KERNEL);
1078 	if (!symname_utf16)
1079 		return -ENOMEM;
1080 	symname_utf16_len = utf8s_to_utf16s(buf->Target, symname_utf8_len,
1081 					    UTF16_LITTLE_ENDIAN,
1082 					    (wchar_t *) symname_utf16, symname_utf8_len * 2);
1083 	if (symname_utf16_len < 0) {
1084 		kfree(symname_utf16);
1085 		return symname_utf16_len;
1086 	}
1087 	symname_utf16_len *= 2; /* utf8s_to_utf16s() returns number of u16 items, not byte length */
1088 
1089 	data->symlink_target = cifs_strndup_from_utf16((u8 *)symname_utf16,
1090 						       symname_utf16_len, true,
1091 						       cifs_sb->local_nls);
1092 	kfree(symname_utf16);
1093 	if (!data->symlink_target)
1094 		return -ENOMEM;
1095 
1096 	return 0;
1097 }
1098 
1099 int parse_reparse_point(struct reparse_data_buffer *buf,
1100 			u32 plen, struct cifs_sb_info *cifs_sb,
1101 			const char *full_path,
1102 			struct cifs_open_info_data *data)
1103 {
1104 	data->reparse.buf = buf;
1105 
1106 	/* See MS-FSCC 2.1.2 */
1107 	switch (le32_to_cpu(buf->ReparseTag)) {
1108 	case IO_REPARSE_TAG_NFS:
1109 		return parse_reparse_nfs((struct reparse_nfs_data_buffer *)buf,
1110 					   cifs_sb, data);
1111 	case IO_REPARSE_TAG_SYMLINK:
1112 		return parse_reparse_native_symlink(
1113 			(struct reparse_symlink_data_buffer *)buf,
1114 			plen, cifs_sb, full_path, data);
1115 	case IO_REPARSE_TAG_LX_SYMLINK:
1116 		return parse_reparse_wsl_symlink(
1117 			(struct reparse_wsl_symlink_data_buffer *)buf,
1118 			cifs_sb, data);
1119 	case IO_REPARSE_TAG_AF_UNIX:
1120 	case IO_REPARSE_TAG_LX_FIFO:
1121 	case IO_REPARSE_TAG_LX_CHR:
1122 	case IO_REPARSE_TAG_LX_BLK: {
1123 		u16 dlen = le16_to_cpu(buf->ReparseDataLength);
1124 
1125 		if (dlen != 0) {
1126 			u32 rtag = le32_to_cpu(buf->ReparseTag);
1127 			cifs_dbg(VFS, "srv returned malformed buffer for reparse point: 0x%08x\n",
1128 				 rtag);
1129 			return smb_EIO2(smb_eio_trace_reparse_data_len, dlen, rtag);
1130 		}
1131 		return 0;
1132 	}
1133 	default:
1134 		return -EOPNOTSUPP;
1135 	}
1136 }
1137 
1138 struct reparse_data_buffer *smb2_get_reparse_point_buffer(const struct kvec *rsp_iov,
1139 							  u32 *plen)
1140 {
1141 	struct smb2_ioctl_rsp *io = rsp_iov->iov_base;
1142 	*plen = le32_to_cpu(io->OutputCount);
1143 	return (struct reparse_data_buffer *)((u8 *)io +
1144 					      le32_to_cpu(io->OutputOffset));
1145 }
1146 
1147 static bool wsl_to_fattr(struct cifs_open_info_data *data,
1148 			 struct cifs_sb_info *cifs_sb,
1149 			 u32 tag, struct cifs_fattr *fattr)
1150 {
1151 	unsigned int sbflags = cifs_sb_flags(cifs_sb);
1152 	kuid_t uid = cifs_sb->ctx->linux_uid;
1153 	kgid_t gid = cifs_sb->ctx->linux_gid;
1154 	struct smb2_file_full_ea_info *ea;
1155 	bool have_xattr_dev = false;
1156 	dev_t rdev = 0;
1157 	umode_t mode;
1158 	u32 next = 0;
1159 
1160 	mode = fattr->cf_mode & ~S_IFMT;
1161 	switch (tag) {
1162 	case IO_REPARSE_TAG_LX_SYMLINK:
1163 		mode |= S_IFLNK;
1164 		break;
1165 	case IO_REPARSE_TAG_LX_FIFO:
1166 		mode |= S_IFIFO;
1167 		break;
1168 	case IO_REPARSE_TAG_AF_UNIX:
1169 		mode |= S_IFSOCK;
1170 		break;
1171 	case IO_REPARSE_TAG_LX_CHR:
1172 		mode |= S_IFCHR;
1173 		break;
1174 	case IO_REPARSE_TAG_LX_BLK:
1175 		mode |= S_IFBLK;
1176 		break;
1177 	}
1178 
1179 	if (!data->wsl.eas_len)
1180 		goto out;
1181 
1182 	ea = (struct smb2_file_full_ea_info *)data->wsl.eas;
1183 	do {
1184 		const char *name;
1185 		void *v;
1186 		u8 nlen;
1187 
1188 		ea = (void *)((u8 *)ea + next);
1189 		next = le32_to_cpu(ea->next_entry_offset);
1190 		if (!le16_to_cpu(ea->ea_value_length))
1191 			continue;
1192 
1193 		name = ea->ea_data;
1194 		nlen = ea->ea_name_length;
1195 		v = (void *)((u8 *)ea->ea_data + ea->ea_name_length + 1);
1196 
1197 		if (!strncmp(name, SMB2_WSL_XATTR_UID, nlen)) {
1198 			if (!(sbflags & CIFS_MOUNT_OVERR_UID))
1199 				uid = wsl_make_kuid(cifs_sb, v);
1200 		} else if (!strncmp(name, SMB2_WSL_XATTR_GID, nlen)) {
1201 			if (!(sbflags & CIFS_MOUNT_OVERR_GID))
1202 				gid = wsl_make_kgid(cifs_sb, v);
1203 		} else if (!strncmp(name, SMB2_WSL_XATTR_MODE, nlen)) {
1204 			/* File type in reparse point tag and in xattr mode must match. */
1205 			if (S_DT(mode) != S_DT(get_unaligned_le32(v)))
1206 				return false;
1207 			mode = get_unaligned_le32(v);
1208 		} else if (!strncmp(name, SMB2_WSL_XATTR_DEV, nlen)) {
1209 			rdev = reparse_mkdev(v);
1210 			have_xattr_dev = true;
1211 		}
1212 	} while (next);
1213 out:
1214 	/* Major and minor numbers for char and block devices are mandatory. */
1215 	if (!have_xattr_dev && (tag == IO_REPARSE_TAG_LX_CHR || tag == IO_REPARSE_TAG_LX_BLK))
1216 		return false;
1217 
1218 	fattr->cf_uid = uid;
1219 	fattr->cf_gid = gid;
1220 	fattr->cf_mode = mode;
1221 	fattr->cf_rdev = rdev;
1222 	return true;
1223 }
1224 
1225 static bool posix_reparse_to_fattr(struct cifs_sb_info *cifs_sb,
1226 				   struct cifs_fattr *fattr,
1227 				   struct cifs_open_info_data *data)
1228 {
1229 	struct reparse_nfs_data_buffer *buf = (struct reparse_nfs_data_buffer *)data->reparse.buf;
1230 	umode_t ftype;
1231 
1232 	if (buf == NULL)
1233 		return true;
1234 
1235 	if (le16_to_cpu(buf->ReparseDataLength) < sizeof(buf->InodeType)) {
1236 		WARN_ON_ONCE(1);
1237 		return false;
1238 	}
1239 
1240 	switch (le64_to_cpu(buf->InodeType)) {
1241 	case NFS_SPECFILE_CHR:
1242 		if (le16_to_cpu(buf->ReparseDataLength) != sizeof(buf->InodeType) + 8) {
1243 			WARN_ON_ONCE(1);
1244 			return false;
1245 		}
1246 		ftype = S_IFCHR;
1247 		fattr->cf_rdev = reparse_mkdev(buf->DataBuffer);
1248 		break;
1249 	case NFS_SPECFILE_BLK:
1250 		if (le16_to_cpu(buf->ReparseDataLength) != sizeof(buf->InodeType) + 8) {
1251 			WARN_ON_ONCE(1);
1252 			return false;
1253 		}
1254 		ftype = S_IFBLK;
1255 		fattr->cf_rdev = reparse_mkdev(buf->DataBuffer);
1256 		break;
1257 	case NFS_SPECFILE_FIFO:
1258 		ftype = S_IFIFO;
1259 		break;
1260 	case NFS_SPECFILE_SOCK:
1261 		ftype = S_IFSOCK;
1262 		break;
1263 	case NFS_SPECFILE_LNK:
1264 		ftype = S_IFLNK;
1265 		break;
1266 	default:
1267 		WARN_ON_ONCE(1);
1268 		return false;
1269 	}
1270 	fattr->cf_mode = (fattr->cf_mode & ~S_IFMT) | ftype;
1271 	return true;
1272 }
1273 
1274 bool cifs_reparse_point_to_fattr(struct cifs_sb_info *cifs_sb,
1275 				 struct cifs_fattr *fattr,
1276 				 struct cifs_open_info_data *data)
1277 {
1278 	u32 tag = data->reparse.tag;
1279 	bool ok;
1280 
1281 	switch (tag) {
1282 	case IO_REPARSE_TAG_LX_SYMLINK:
1283 	case IO_REPARSE_TAG_LX_FIFO:
1284 	case IO_REPARSE_TAG_AF_UNIX:
1285 	case IO_REPARSE_TAG_LX_CHR:
1286 	case IO_REPARSE_TAG_LX_BLK:
1287 		ok = wsl_to_fattr(data, cifs_sb, tag, fattr);
1288 		if (!ok)
1289 			return false;
1290 		break;
1291 	case IO_REPARSE_TAG_NFS:
1292 		ok = posix_reparse_to_fattr(cifs_sb, fattr, data);
1293 		if (!ok)
1294 			return false;
1295 		break;
1296 	case 0: /* SMB1 symlink */
1297 	case IO_REPARSE_TAG_SYMLINK:
1298 		fattr->cf_mode &= ~S_IFMT;
1299 		fattr->cf_mode |= S_IFLNK;
1300 		break;
1301 	default:
1302 		if (!(fattr->cf_cifsattrs & ATTR_DIRECTORY))
1303 			return false;
1304 		if (!IS_REPARSE_TAG_NAME_SURROGATE(tag) &&
1305 		    tag != IO_REPARSE_TAG_INTERNAL)
1306 			return false;
1307 		/* See cifs_create_junction_fattr() */
1308 		fattr->cf_mode = S_IFDIR | 0711;
1309 		break;
1310 	}
1311 
1312 	fattr->cf_dtype = S_DT(fattr->cf_mode);
1313 	return true;
1314 }
1315