1 // SPDX-License-Identifier: LGPL-2.1 2 /* 3 * 4 * Copyright (C) International Business Machines Corp., 2002,2008 5 * Author(s): Steve French (sfrench@us.ibm.com) 6 * Jeremy Allison (jra@samba.org) 2006. 7 * 8 */ 9 10 #include <linux/fs.h> 11 #include <linux/list.h> 12 #include <linux/gfp.h> 13 #include <linux/wait.h> 14 #include <linux/net.h> 15 #include <linux/delay.h> 16 #include <linux/freezer.h> 17 #include <linux/tcp.h> 18 #include <linux/bvec.h> 19 #include <linux/highmem.h> 20 #include <linux/uaccess.h> 21 #include <linux/processor.h> 22 #include <linux/mempool.h> 23 #include <linux/sched/signal.h> 24 #include <linux/task_io_accounting_ops.h> 25 #include "cifsglob.h" 26 #include "cifsproto.h" 27 #include "smb1proto.h" 28 #include "smb2proto.h" 29 #include "cifs_debug.h" 30 #include "smbdirect.h" 31 #include "compress.h" 32 33 /* Max number of iovectors we can use off the stack when sending requests. */ 34 #define CIFS_MAX_IOV_SIZE 8 35 36 static struct mid_q_entry * 37 alloc_mid(const struct smb_hdr *smb_buffer, struct TCP_Server_Info *server) 38 { 39 struct mid_q_entry *temp; 40 41 if (server == NULL) { 42 cifs_dbg(VFS, "%s: null TCP session\n", __func__); 43 return NULL; 44 } 45 46 temp = mempool_alloc(&cifs_mid_pool, GFP_NOFS); 47 memset(temp, 0, sizeof(struct mid_q_entry)); 48 refcount_set(&temp->refcount, 1); 49 spin_lock_init(&temp->mid_lock); 50 temp->mid = get_mid(smb_buffer); 51 temp->pid = current->pid; 52 temp->command = cpu_to_le16(smb_buffer->Command); 53 cifs_dbg(FYI, "For smb_command %d\n", smb_buffer->Command); 54 /* easier to use jiffies */ 55 /* when mid allocated can be before when sent */ 56 temp->when_alloc = jiffies; 57 58 /* 59 * The default is for the mid to be synchronous, so the 60 * default callback just wakes up the current task. 61 */ 62 get_task_struct(current); 63 temp->creator = current; 64 temp->callback = cifs_wake_up_task; 65 temp->callback_data = current; 66 67 atomic_inc(&mid_count); 68 temp->mid_state = MID_REQUEST_ALLOCATED; 69 return temp; 70 } 71 72 static int allocate_mid(struct cifs_ses *ses, struct smb_hdr *in_buf, 73 struct mid_q_entry **ppmidQ) 74 { 75 spin_lock(&ses->ses_lock); 76 if (ses->ses_status == SES_NEW) { 77 if ((in_buf->Command != SMB_COM_SESSION_SETUP_ANDX) && 78 (in_buf->Command != SMB_COM_NEGOTIATE)) { 79 spin_unlock(&ses->ses_lock); 80 return -EAGAIN; 81 } 82 /* else ok - we are setting up session */ 83 } 84 85 if (ses->ses_status == SES_EXITING) { 86 /* check if SMB session is bad because we are setting it up */ 87 if (in_buf->Command != SMB_COM_LOGOFF_ANDX) { 88 spin_unlock(&ses->ses_lock); 89 return -EAGAIN; 90 } 91 /* else ok - we are shutting down session */ 92 } 93 spin_unlock(&ses->ses_lock); 94 95 *ppmidQ = alloc_mid(in_buf, ses->server); 96 if (*ppmidQ == NULL) 97 return -ENOMEM; 98 spin_lock(&ses->server->mid_queue_lock); 99 list_add_tail(&(*ppmidQ)->qhead, &ses->server->pending_mid_q); 100 spin_unlock(&ses->server->mid_queue_lock); 101 return 0; 102 } 103 104 struct mid_q_entry * 105 cifs_setup_async_request(struct TCP_Server_Info *server, struct smb_rqst *rqst) 106 { 107 int rc; 108 struct smb_hdr *hdr = (struct smb_hdr *)rqst->rq_iov[0].iov_base; 109 struct mid_q_entry *mid; 110 111 /* enable signing if server requires it */ 112 if (server->sign) 113 hdr->Flags2 |= SMBFLG2_SECURITY_SIGNATURE; 114 115 mid = alloc_mid(hdr, server); 116 if (mid == NULL) 117 return ERR_PTR(-ENOMEM); 118 119 rc = cifs_sign_rqst(rqst, server, &mid->sequence_number); 120 if (rc) { 121 release_mid(server, mid); 122 return ERR_PTR(rc); 123 } 124 125 return mid; 126 } 127 128 /* 129 * 130 * Send an SMB Request. No response info (other than return code) 131 * needs to be parsed. 132 * 133 * flags indicate the type of request buffer and how long to wait 134 * and whether to log NT STATUS code (error) before mapping it to POSIX error 135 * 136 */ 137 int 138 SendReceiveNoRsp(const unsigned int xid, struct cifs_ses *ses, 139 char *in_buf, unsigned int in_len, int flags) 140 { 141 int rc; 142 struct kvec iov[1]; 143 struct kvec rsp_iov; 144 int resp_buf_type; 145 146 iov[0].iov_base = in_buf; 147 iov[0].iov_len = in_len; 148 flags |= CIFS_NO_RSP_BUF; 149 rc = SendReceive2(xid, ses, iov, 1, &resp_buf_type, flags, &rsp_iov); 150 cifs_dbg(NOISY, "SendRcvNoRsp flags %d rc %d\n", flags, rc); 151 152 return rc; 153 } 154 155 int 156 cifs_check_receive(struct mid_q_entry *mid, struct TCP_Server_Info *server, 157 bool log_error) 158 { 159 unsigned int len = mid->response_pdu_len; 160 161 dump_smb(mid->resp_buf, min_t(u32, 92, len)); 162 163 /* convert the length into a more usable form */ 164 if (server->sign) { 165 struct kvec iov[1]; 166 int rc = 0; 167 struct smb_rqst rqst = { .rq_iov = iov, 168 .rq_nvec = ARRAY_SIZE(iov) }; 169 170 iov[0].iov_base = mid->resp_buf; 171 iov[0].iov_len = len; 172 173 rc = cifs_verify_signature(&rqst, server, 174 mid->sequence_number); 175 if (rc) { 176 cifs_server_dbg(VFS, "SMB signature verification returned error = %d\n", 177 rc); 178 179 if (!(server->sec_mode & SECMODE_SIGN_REQUIRED)) { 180 cifs_reconnect(server, true); 181 return rc; 182 } 183 } 184 } 185 186 /* BB special case reconnect tid and uid here? */ 187 return map_and_check_smb_error(server, mid, log_error); 188 } 189 190 struct mid_q_entry * 191 cifs_setup_request(struct cifs_ses *ses, struct TCP_Server_Info *server, 192 struct smb_rqst *rqst) 193 { 194 int rc; 195 struct smb_hdr *hdr = (struct smb_hdr *)rqst->rq_iov[0].iov_base; 196 struct mid_q_entry *mid; 197 198 rc = allocate_mid(ses, hdr, &mid); 199 if (rc) 200 return ERR_PTR(rc); 201 rc = cifs_sign_rqst(rqst, server, &mid->sequence_number); 202 if (rc) { 203 delete_mid(server, mid); 204 return ERR_PTR(rc); 205 } 206 return mid; 207 } 208 209 int 210 SendReceive2(const unsigned int xid, struct cifs_ses *ses, 211 struct kvec *iov, int n_vec, int *resp_buf_type /* ret */, 212 const int flags, struct kvec *resp_iov) 213 { 214 struct smb_rqst rqst = { 215 .rq_iov = iov, 216 .rq_nvec = n_vec, 217 }; 218 219 return cifs_send_recv(xid, ses, ses->server, 220 &rqst, resp_buf_type, flags, resp_iov); 221 } 222 223 int 224 SendReceive(const unsigned int xid, struct cifs_ses *ses, 225 struct smb_hdr *in_buf, unsigned int in_len, 226 struct smb_hdr *out_buf, int *pbytes_returned, const int flags) 227 { 228 struct TCP_Server_Info *server; 229 struct kvec resp_iov = {}; 230 struct kvec iov = { .iov_base = in_buf, .iov_len = in_len }; 231 struct smb_rqst rqst = { .rq_iov = &iov, .rq_nvec = 1 }; 232 int resp_buf_type; 233 int rc = 0; 234 235 if (WARN_ON_ONCE(in_len > 0xffffff)) 236 return smb_EIO1(smb_eio_trace_tx_too_long, in_len); 237 if (ses == NULL) { 238 cifs_dbg(VFS, "Null smb session\n"); 239 return smb_EIO(smb_eio_trace_null_pointers); 240 } 241 server = ses->server; 242 if (server == NULL) { 243 cifs_dbg(VFS, "Null tcp session\n"); 244 return smb_EIO(smb_eio_trace_null_pointers); 245 } 246 247 /* Ensure that we do not send more than 50 overlapping requests 248 to the same server. We may make this configurable later or 249 use ses->maxReq */ 250 251 if (in_len > CIFSMaxBufSize + MAX_CIFS_HDR_SIZE) { 252 cifs_server_dbg(VFS, "Invalid length, greater than maximum frame, %d\n", 253 in_len); 254 return smb_EIO1(smb_eio_trace_tx_too_long, in_len); 255 } 256 257 rc = cifs_send_recv(xid, ses, ses->server, 258 &rqst, &resp_buf_type, flags, &resp_iov); 259 if (rc < 0) 260 goto out; 261 262 if (out_buf) { 263 *pbytes_returned = resp_iov.iov_len; 264 if (resp_iov.iov_len) 265 memcpy(out_buf, resp_iov.iov_base, resp_iov.iov_len); 266 } 267 268 out: 269 free_rsp_buf(resp_buf_type, resp_iov.iov_base); 270 return rc; 271 } 272 273 /* 274 return codes: 275 0 not a transact2, or all data present 276 >0 transact2 with that much data missing 277 -EINVAL invalid transact2 278 */ 279 static int 280 check2ndT2(char *buf) 281 { 282 struct smb_hdr *pSMB = (struct smb_hdr *)buf; 283 struct smb_t2_rsp *pSMBt; 284 int remaining; 285 __u16 total_data_size, data_in_this_rsp; 286 287 if (pSMB->Command != SMB_COM_TRANSACTION2) 288 return 0; 289 290 /* check for plausible wct, bcc and t2 data and parm sizes */ 291 /* check for parm and data offset going beyond end of smb */ 292 if (pSMB->WordCount != 10) { /* coalesce_t2 depends on this */ 293 cifs_dbg(FYI, "Invalid transact2 word count\n"); 294 return -EINVAL; 295 } 296 297 pSMBt = (struct smb_t2_rsp *)pSMB; 298 299 total_data_size = get_unaligned_le16(&pSMBt->t2_rsp.TotalDataCount); 300 data_in_this_rsp = get_unaligned_le16(&pSMBt->t2_rsp.DataCount); 301 302 if (total_data_size == data_in_this_rsp) 303 return 0; 304 else if (total_data_size < data_in_this_rsp) { 305 cifs_dbg(FYI, "total data %d smaller than data in frame %d\n", 306 total_data_size, data_in_this_rsp); 307 return -EINVAL; 308 } 309 310 remaining = total_data_size - data_in_this_rsp; 311 312 cifs_dbg(FYI, "missing %d bytes from transact2, check next response\n", 313 remaining); 314 if (total_data_size > CIFSMaxBufSize) { 315 cifs_dbg(VFS, "TotalDataSize %d is over maximum buffer %d\n", 316 total_data_size, CIFSMaxBufSize); 317 return -EINVAL; 318 } 319 return remaining; 320 } 321 322 static int 323 coalesce_t2(char *second_buf, struct smb_hdr *target_hdr, unsigned int *pdu_len) 324 { 325 struct smb_t2_rsp *pSMBs = (struct smb_t2_rsp *)second_buf; 326 struct smb_t2_rsp *pSMBt = (struct smb_t2_rsp *)target_hdr; 327 char *data_area_of_tgt; 328 char *data_area_of_src; 329 int remaining; 330 unsigned int byte_count, total_in_tgt; 331 __u16 tgt_total_cnt, src_total_cnt, total_in_src; 332 333 src_total_cnt = get_unaligned_le16(&pSMBs->t2_rsp.TotalDataCount); 334 tgt_total_cnt = get_unaligned_le16(&pSMBt->t2_rsp.TotalDataCount); 335 336 if (tgt_total_cnt != src_total_cnt) 337 cifs_dbg(FYI, "total data count of primary and secondary t2 differ source=%hu target=%hu\n", 338 src_total_cnt, tgt_total_cnt); 339 340 total_in_tgt = get_unaligned_le16(&pSMBt->t2_rsp.DataCount); 341 342 remaining = tgt_total_cnt - total_in_tgt; 343 344 if (remaining < 0) { 345 cifs_dbg(FYI, "Server sent too much data. tgt_total_cnt=%hu total_in_tgt=%u\n", 346 tgt_total_cnt, total_in_tgt); 347 return -EPROTO; 348 } 349 350 if (remaining == 0) { 351 /* nothing to do, ignore */ 352 cifs_dbg(FYI, "no more data remains\n"); 353 return 0; 354 } 355 356 total_in_src = get_unaligned_le16(&pSMBs->t2_rsp.DataCount); 357 if (remaining < total_in_src) 358 cifs_dbg(FYI, "transact2 2nd response contains too much data\n"); 359 360 /* find end of first SMB data area */ 361 data_area_of_tgt = (char *)&pSMBt->hdr.Protocol + 362 get_unaligned_le16(&pSMBt->t2_rsp.DataOffset); 363 364 /* validate target area */ 365 data_area_of_src = (char *)&pSMBs->hdr.Protocol + 366 get_unaligned_le16(&pSMBs->t2_rsp.DataOffset); 367 368 data_area_of_tgt += total_in_tgt; 369 370 total_in_tgt += total_in_src; 371 /* is the result too big for the field? */ 372 if (total_in_tgt > USHRT_MAX) { 373 cifs_dbg(FYI, "coalesced DataCount too large (%u)\n", 374 total_in_tgt); 375 return -EPROTO; 376 } 377 put_unaligned_le16(total_in_tgt, &pSMBt->t2_rsp.DataCount); 378 379 /* fix up the BCC */ 380 byte_count = get_bcc(target_hdr); 381 byte_count += total_in_src; 382 /* is the result too big for the field? */ 383 if (byte_count > USHRT_MAX) { 384 cifs_dbg(FYI, "coalesced BCC too large (%u)\n", byte_count); 385 return -EPROTO; 386 } 387 put_bcc(byte_count, target_hdr); 388 389 byte_count = *pdu_len; 390 byte_count += total_in_src; 391 /* don't allow buffer to overflow */ 392 if (byte_count > CIFSMaxBufSize + MAX_CIFS_HDR_SIZE) { 393 cifs_dbg(FYI, "coalesced BCC exceeds buffer size (%u)\n", 394 byte_count); 395 return -ENOBUFS; 396 } 397 *pdu_len = byte_count; 398 399 /* copy second buffer into end of first buffer */ 400 memcpy(data_area_of_tgt, data_area_of_src, total_in_src); 401 402 if (remaining != total_in_src) { 403 /* more responses to go */ 404 cifs_dbg(FYI, "waiting for more secondary responses\n"); 405 return 1; 406 } 407 408 /* we are done */ 409 cifs_dbg(FYI, "found the last secondary response\n"); 410 return 0; 411 } 412 413 bool 414 cifs_check_trans2(struct mid_q_entry *mid, struct TCP_Server_Info *server, 415 char *buf, int malformed) 416 { 417 if (malformed) 418 return false; 419 if (check2ndT2(buf) <= 0) 420 return false; 421 mid->multiRsp = true; 422 if (mid->resp_buf) { 423 /* merge response - fix up 1st*/ 424 malformed = coalesce_t2(buf, mid->resp_buf, &mid->response_pdu_len); 425 if (malformed > 0) 426 return true; 427 /* All parts received or packet is malformed. */ 428 mid->multiEnd = true; 429 dequeue_mid(server, mid, malformed); 430 return true; 431 } 432 if (!server->large_buf) { 433 /*FIXME: switch to already allocated largebuf?*/ 434 cifs_dbg(VFS, "1st trans2 resp needs bigbuf\n"); 435 } else { 436 /* Have first buffer */ 437 mid->resp_buf = buf; 438 mid->large_buf = true; 439 server->bigbuf = NULL; 440 } 441 return true; 442 } 443 444 static int 445 check_smb_hdr(struct smb_hdr *smb) 446 { 447 /* does it have the right SMB "signature" ? */ 448 if (*(__le32 *) smb->Protocol != SMB1_PROTO_NUMBER) { 449 cifs_dbg(VFS, "Bad protocol string signature header 0x%x\n", 450 *(unsigned int *)smb->Protocol); 451 return 1; 452 } 453 454 /* if it's a response then accept */ 455 if (smb->Flags & SMBFLG_RESPONSE) 456 return 0; 457 458 /* only one valid case where server sends us request */ 459 if (smb->Command == SMB_COM_LOCKING_ANDX) 460 return 0; 461 462 /* 463 * Windows NT server returns error resposne (e.g. STATUS_DELETE_PENDING 464 * or STATUS_OBJECT_NAME_NOT_FOUND or ERRDOS/ERRbadfile or any other) 465 * for some TRANS2 requests without the RESPONSE flag set in header. 466 */ 467 if (smb->Command == SMB_COM_TRANSACTION2 && smb->Status.CifsError != 0) 468 return 0; 469 470 cifs_dbg(VFS, "Server sent request, not response. mid=%u\n", 471 get_mid(smb)); 472 return 1; 473 } 474 475 int 476 checkSMB(char *buf, unsigned int pdu_len, unsigned int total_read, 477 struct TCP_Server_Info *server) 478 { 479 struct smb_hdr *smb = (struct smb_hdr *)buf; 480 __u32 rfclen = pdu_len; 481 __u32 clc_len; /* calculated length */ 482 cifs_dbg(FYI, "checkSMB Length: 0x%x, smb_buf_length: 0x%x\n", 483 total_read, rfclen); 484 485 /* is this frame too small to even get to a BCC? */ 486 if (total_read < 2 + sizeof(struct smb_hdr)) { 487 if ((total_read >= sizeof(struct smb_hdr) - 1) 488 && (smb->Status.CifsError != 0)) { 489 /* it's an error return */ 490 smb->WordCount = 0; 491 /* some error cases do not return wct and bcc */ 492 return 0; 493 } else if ((total_read == sizeof(struct smb_hdr) + 1) && 494 (smb->WordCount == 0)) { 495 char *tmp = (char *)smb; 496 /* Need to work around a bug in two servers here */ 497 /* First, check if the part of bcc they sent was zero */ 498 if (tmp[sizeof(struct smb_hdr)] == 0) { 499 /* some servers return only half of bcc 500 * on simple responses (wct, bcc both zero) 501 * in particular have seen this on 502 * ulogoffX and FindClose. This leaves 503 * one byte of bcc potentially uninitialized 504 */ 505 /* zero rest of bcc */ 506 tmp[sizeof(struct smb_hdr)+1] = 0; 507 return 0; 508 } 509 cifs_dbg(VFS, "rcvd invalid byte count (bcc)\n"); 510 return smb_EIO1(smb_eio_trace_rx_inv_bcc, tmp[sizeof(struct smb_hdr)]); 511 } else { 512 cifs_dbg(VFS, "Length less than smb header size\n"); 513 return smb_EIO2(smb_eio_trace_rx_too_short, 514 total_read, smb->WordCount); 515 } 516 } else if (total_read < sizeof(*smb) + 2 * smb->WordCount) { 517 cifs_dbg(VFS, "%s: can't read BCC due to invalid WordCount(%u)\n", 518 __func__, smb->WordCount); 519 return smb_EIO2(smb_eio_trace_rx_check_rsp, 520 total_read, 2 + sizeof(struct smb_hdr)); 521 } 522 523 /* otherwise, there is enough to get to the BCC */ 524 if (check_smb_hdr(smb)) 525 return smb_EIO1(smb_eio_trace_rx_rfc1002_magic, *(u32 *)smb->Protocol); 526 clc_len = smbCalcSize(smb); 527 528 if (rfclen != total_read) { 529 cifs_dbg(VFS, "Length read does not match RFC1001 length %d/%d\n", 530 rfclen, total_read); 531 return smb_EIO2(smb_eio_trace_rx_check_rsp, 532 total_read, rfclen); 533 } 534 535 if (rfclen != clc_len) { 536 __u16 mid = get_mid(smb); 537 /* check if bcc wrapped around for large read responses */ 538 if ((rfclen > 64 * 1024) && (rfclen > clc_len)) { 539 /* check if lengths match mod 64K */ 540 if (((rfclen) & 0xFFFF) == (clc_len & 0xFFFF)) 541 return 0; /* bcc wrapped */ 542 } 543 cifs_dbg(FYI, "Calculated size %u vs length %u mismatch for mid=%u\n", 544 clc_len, rfclen, mid); 545 546 if (rfclen < clc_len) { 547 cifs_dbg(VFS, "RFC1001 size %u smaller than SMB for mid=%u\n", 548 rfclen, mid); 549 return smb_EIO2(smb_eio_trace_rx_calc_len_too_big, 550 rfclen, clc_len); 551 } else if (rfclen > clc_len + 512) { 552 /* 553 * Some servers (Windows XP in particular) send more 554 * data than the lengths in the SMB packet would 555 * indicate on certain calls (byte range locks and 556 * trans2 find first calls in particular). While the 557 * client can handle such a frame by ignoring the 558 * trailing data, we choose limit the amount of extra 559 * data to 512 bytes. 560 */ 561 cifs_dbg(VFS, "RFC1001 size %u more than 512 bytes larger than SMB for mid=%u\n", 562 rfclen, mid); 563 return smb_EIO2(smb_eio_trace_rx_overlong, 564 rfclen, clc_len + 512); 565 } 566 } 567 return 0; 568 } 569