1 // SPDX-License-Identifier: LGPL-2.1 2 /* 3 * 4 * Copyright (C) International Business Machines Corp., 2002,2008 5 * Author(s): Steve French (sfrench@us.ibm.com) 6 * Jeremy Allison (jra@samba.org) 2006. 7 * 8 */ 9 10 #include <linux/fs.h> 11 #include <linux/list.h> 12 #include <linux/gfp.h> 13 #include <linux/wait.h> 14 #include <linux/net.h> 15 #include <linux/delay.h> 16 #include <linux/freezer.h> 17 #include <linux/tcp.h> 18 #include <linux/bvec.h> 19 #include <linux/highmem.h> 20 #include <linux/uaccess.h> 21 #include <linux/processor.h> 22 #include <linux/mempool.h> 23 #include <linux/sched/signal.h> 24 #include <linux/task_io_accounting_ops.h> 25 #include "cifsglob.h" 26 #include "cifsproto.h" 27 #include "smb1proto.h" 28 #include "smb2proto.h" 29 #include "cifs_debug.h" 30 #include "smbdirect.h" 31 #include "compress.h" 32 #include "cifs_debug.h" 33 34 /* Max number of iovectors we can use off the stack when sending requests. */ 35 #define CIFS_MAX_IOV_SIZE 8 36 37 static struct mid_q_entry * 38 alloc_mid(const struct smb_hdr *smb_buffer, struct TCP_Server_Info *server) 39 { 40 struct mid_q_entry *temp; 41 42 if (server == NULL) { 43 cifs_dbg(VFS, "%s: null TCP session\n", __func__); 44 return NULL; 45 } 46 47 temp = mempool_alloc(&cifs_mid_pool, GFP_NOFS); 48 memset(temp, 0, sizeof(struct mid_q_entry)); 49 refcount_set(&temp->refcount, 1); 50 spin_lock_init(&temp->mid_lock); 51 temp->mid = get_mid(smb_buffer); 52 temp->pid = current->pid; 53 temp->command = cpu_to_le16(smb_buffer->Command); 54 cifs_dbg(FYI, "For smb_command %d\n", smb_buffer->Command); 55 /* easier to use jiffies */ 56 /* when mid allocated can be before when sent */ 57 temp->when_alloc = jiffies; 58 59 /* 60 * The default is for the mid to be synchronous, so the 61 * default callback just wakes up the current task. 62 */ 63 get_task_struct(current); 64 temp->creator = current; 65 temp->callback = cifs_wake_up_task; 66 temp->callback_data = current; 67 68 atomic_inc(&mid_count); 69 temp->mid_state = MID_REQUEST_ALLOCATED; 70 return temp; 71 } 72 73 static int allocate_mid(struct cifs_ses *ses, struct smb_hdr *in_buf, 74 struct mid_q_entry **ppmidQ) 75 { 76 spin_lock(&ses->ses_lock); 77 if (ses->ses_status == SES_NEW) { 78 if ((in_buf->Command != SMB_COM_SESSION_SETUP_ANDX) && 79 (in_buf->Command != SMB_COM_NEGOTIATE)) { 80 spin_unlock(&ses->ses_lock); 81 return -EAGAIN; 82 } 83 /* else ok - we are setting up session */ 84 } 85 86 if (ses->ses_status == SES_EXITING) { 87 /* check if SMB session is bad because we are setting it up */ 88 if (in_buf->Command != SMB_COM_LOGOFF_ANDX) { 89 spin_unlock(&ses->ses_lock); 90 return -EAGAIN; 91 } 92 /* else ok - we are shutting down session */ 93 } 94 spin_unlock(&ses->ses_lock); 95 96 *ppmidQ = alloc_mid(in_buf, ses->server); 97 if (*ppmidQ == NULL) 98 return -ENOMEM; 99 spin_lock(&ses->server->mid_queue_lock); 100 list_add_tail(&(*ppmidQ)->qhead, &ses->server->pending_mid_q); 101 spin_unlock(&ses->server->mid_queue_lock); 102 return 0; 103 } 104 105 struct mid_q_entry * 106 cifs_setup_async_request(struct TCP_Server_Info *server, struct smb_rqst *rqst) 107 { 108 int rc; 109 struct smb_hdr *hdr = (struct smb_hdr *)rqst->rq_iov[0].iov_base; 110 struct mid_q_entry *mid; 111 112 /* enable signing if server requires it */ 113 if (server->sign) 114 hdr->Flags2 |= SMBFLG2_SECURITY_SIGNATURE; 115 116 mid = alloc_mid(hdr, server); 117 if (mid == NULL) 118 return ERR_PTR(-ENOMEM); 119 120 rc = cifs_sign_rqst(rqst, server, &mid->sequence_number); 121 if (rc) { 122 release_mid(server, mid); 123 return ERR_PTR(rc); 124 } 125 126 return mid; 127 } 128 129 /* 130 * 131 * Send an SMB Request. No response info (other than return code) 132 * needs to be parsed. 133 * 134 * flags indicate the type of request buffer and how long to wait 135 * and whether to log NT STATUS code (error) before mapping it to POSIX error 136 * 137 */ 138 int 139 SendReceiveNoRsp(const unsigned int xid, struct cifs_ses *ses, 140 char *in_buf, unsigned int in_len, int flags) 141 { 142 int rc; 143 struct kvec iov[1]; 144 struct kvec rsp_iov; 145 int resp_buf_type; 146 147 iov[0].iov_base = in_buf; 148 iov[0].iov_len = in_len; 149 flags |= CIFS_NO_RSP_BUF; 150 rc = SendReceive2(xid, ses, iov, 1, &resp_buf_type, flags, &rsp_iov); 151 cifs_dbg(NOISY, "SendRcvNoRsp flags %d rc %d\n", flags, rc); 152 153 return rc; 154 } 155 156 int 157 cifs_check_receive(struct mid_q_entry *mid, struct TCP_Server_Info *server, 158 bool log_error) 159 { 160 unsigned int len = mid->response_pdu_len; 161 162 dump_smb(mid->resp_buf, min_t(u32, 92, len)); 163 164 /* convert the length into a more usable form */ 165 if (server->sign) { 166 struct kvec iov[1]; 167 int rc = 0; 168 struct smb_rqst rqst = { .rq_iov = iov, 169 .rq_nvec = ARRAY_SIZE(iov) }; 170 171 iov[0].iov_base = mid->resp_buf; 172 iov[0].iov_len = len; 173 /* FIXME: add code to kill session */ 174 rc = cifs_verify_signature(&rqst, server, 175 mid->sequence_number); 176 if (rc) 177 cifs_server_dbg(VFS, "SMB signature verification returned error = %d\n", 178 rc); 179 } 180 181 /* BB special case reconnect tid and uid here? */ 182 return map_and_check_smb_error(server, mid, log_error); 183 } 184 185 struct mid_q_entry * 186 cifs_setup_request(struct cifs_ses *ses, struct TCP_Server_Info *server, 187 struct smb_rqst *rqst) 188 { 189 int rc; 190 struct smb_hdr *hdr = (struct smb_hdr *)rqst->rq_iov[0].iov_base; 191 struct mid_q_entry *mid; 192 193 rc = allocate_mid(ses, hdr, &mid); 194 if (rc) 195 return ERR_PTR(rc); 196 rc = cifs_sign_rqst(rqst, server, &mid->sequence_number); 197 if (rc) { 198 delete_mid(server, mid); 199 return ERR_PTR(rc); 200 } 201 return mid; 202 } 203 204 int 205 SendReceive2(const unsigned int xid, struct cifs_ses *ses, 206 struct kvec *iov, int n_vec, int *resp_buf_type /* ret */, 207 const int flags, struct kvec *resp_iov) 208 { 209 struct smb_rqst rqst = { 210 .rq_iov = iov, 211 .rq_nvec = n_vec, 212 }; 213 214 return cifs_send_recv(xid, ses, ses->server, 215 &rqst, resp_buf_type, flags, resp_iov); 216 } 217 218 int 219 SendReceive(const unsigned int xid, struct cifs_ses *ses, 220 struct smb_hdr *in_buf, unsigned int in_len, 221 struct smb_hdr *out_buf, int *pbytes_returned, const int flags) 222 { 223 struct TCP_Server_Info *server; 224 struct kvec resp_iov = {}; 225 struct kvec iov = { .iov_base = in_buf, .iov_len = in_len }; 226 struct smb_rqst rqst = { .rq_iov = &iov, .rq_nvec = 1 }; 227 int resp_buf_type; 228 int rc = 0; 229 230 if (WARN_ON_ONCE(in_len > 0xffffff)) 231 return smb_EIO1(smb_eio_trace_tx_too_long, in_len); 232 if (ses == NULL) { 233 cifs_dbg(VFS, "Null smb session\n"); 234 return smb_EIO(smb_eio_trace_null_pointers); 235 } 236 server = ses->server; 237 if (server == NULL) { 238 cifs_dbg(VFS, "Null tcp session\n"); 239 return smb_EIO(smb_eio_trace_null_pointers); 240 } 241 242 /* Ensure that we do not send more than 50 overlapping requests 243 to the same server. We may make this configurable later or 244 use ses->maxReq */ 245 246 if (in_len > CIFSMaxBufSize + MAX_CIFS_HDR_SIZE) { 247 cifs_server_dbg(VFS, "Invalid length, greater than maximum frame, %d\n", 248 in_len); 249 return smb_EIO1(smb_eio_trace_tx_too_long, in_len); 250 } 251 252 rc = cifs_send_recv(xid, ses, ses->server, 253 &rqst, &resp_buf_type, flags, &resp_iov); 254 if (rc < 0) 255 goto out; 256 257 if (out_buf) { 258 *pbytes_returned = resp_iov.iov_len; 259 if (resp_iov.iov_len) 260 memcpy(out_buf, resp_iov.iov_base, resp_iov.iov_len); 261 } 262 263 out: 264 free_rsp_buf(resp_buf_type, resp_iov.iov_base); 265 return rc; 266 } 267 268 /* 269 return codes: 270 0 not a transact2, or all data present 271 >0 transact2 with that much data missing 272 -EINVAL invalid transact2 273 */ 274 static int 275 check2ndT2(char *buf) 276 { 277 struct smb_hdr *pSMB = (struct smb_hdr *)buf; 278 struct smb_t2_rsp *pSMBt; 279 int remaining; 280 __u16 total_data_size, data_in_this_rsp; 281 282 if (pSMB->Command != SMB_COM_TRANSACTION2) 283 return 0; 284 285 /* check for plausible wct, bcc and t2 data and parm sizes */ 286 /* check for parm and data offset going beyond end of smb */ 287 if (pSMB->WordCount != 10) { /* coalesce_t2 depends on this */ 288 cifs_dbg(FYI, "Invalid transact2 word count\n"); 289 return -EINVAL; 290 } 291 292 pSMBt = (struct smb_t2_rsp *)pSMB; 293 294 total_data_size = get_unaligned_le16(&pSMBt->t2_rsp.TotalDataCount); 295 data_in_this_rsp = get_unaligned_le16(&pSMBt->t2_rsp.DataCount); 296 297 if (total_data_size == data_in_this_rsp) 298 return 0; 299 else if (total_data_size < data_in_this_rsp) { 300 cifs_dbg(FYI, "total data %d smaller than data in frame %d\n", 301 total_data_size, data_in_this_rsp); 302 return -EINVAL; 303 } 304 305 remaining = total_data_size - data_in_this_rsp; 306 307 cifs_dbg(FYI, "missing %d bytes from transact2, check next response\n", 308 remaining); 309 if (total_data_size > CIFSMaxBufSize) { 310 cifs_dbg(VFS, "TotalDataSize %d is over maximum buffer %d\n", 311 total_data_size, CIFSMaxBufSize); 312 return -EINVAL; 313 } 314 return remaining; 315 } 316 317 static int 318 coalesce_t2(char *second_buf, struct smb_hdr *target_hdr, unsigned int *pdu_len) 319 { 320 struct smb_t2_rsp *pSMBs = (struct smb_t2_rsp *)second_buf; 321 struct smb_t2_rsp *pSMBt = (struct smb_t2_rsp *)target_hdr; 322 char *data_area_of_tgt; 323 char *data_area_of_src; 324 int remaining; 325 unsigned int byte_count, total_in_tgt; 326 __u16 tgt_total_cnt, src_total_cnt, total_in_src; 327 328 src_total_cnt = get_unaligned_le16(&pSMBs->t2_rsp.TotalDataCount); 329 tgt_total_cnt = get_unaligned_le16(&pSMBt->t2_rsp.TotalDataCount); 330 331 if (tgt_total_cnt != src_total_cnt) 332 cifs_dbg(FYI, "total data count of primary and secondary t2 differ source=%hu target=%hu\n", 333 src_total_cnt, tgt_total_cnt); 334 335 total_in_tgt = get_unaligned_le16(&pSMBt->t2_rsp.DataCount); 336 337 remaining = tgt_total_cnt - total_in_tgt; 338 339 if (remaining < 0) { 340 cifs_dbg(FYI, "Server sent too much data. tgt_total_cnt=%hu total_in_tgt=%u\n", 341 tgt_total_cnt, total_in_tgt); 342 return -EPROTO; 343 } 344 345 if (remaining == 0) { 346 /* nothing to do, ignore */ 347 cifs_dbg(FYI, "no more data remains\n"); 348 return 0; 349 } 350 351 total_in_src = get_unaligned_le16(&pSMBs->t2_rsp.DataCount); 352 if (remaining < total_in_src) 353 cifs_dbg(FYI, "transact2 2nd response contains too much data\n"); 354 355 /* find end of first SMB data area */ 356 data_area_of_tgt = (char *)&pSMBt->hdr.Protocol + 357 get_unaligned_le16(&pSMBt->t2_rsp.DataOffset); 358 359 /* validate target area */ 360 data_area_of_src = (char *)&pSMBs->hdr.Protocol + 361 get_unaligned_le16(&pSMBs->t2_rsp.DataOffset); 362 363 data_area_of_tgt += total_in_tgt; 364 365 total_in_tgt += total_in_src; 366 /* is the result too big for the field? */ 367 if (total_in_tgt > USHRT_MAX) { 368 cifs_dbg(FYI, "coalesced DataCount too large (%u)\n", 369 total_in_tgt); 370 return -EPROTO; 371 } 372 put_unaligned_le16(total_in_tgt, &pSMBt->t2_rsp.DataCount); 373 374 /* fix up the BCC */ 375 byte_count = get_bcc(target_hdr); 376 byte_count += total_in_src; 377 /* is the result too big for the field? */ 378 if (byte_count > USHRT_MAX) { 379 cifs_dbg(FYI, "coalesced BCC too large (%u)\n", byte_count); 380 return -EPROTO; 381 } 382 put_bcc(byte_count, target_hdr); 383 384 byte_count = *pdu_len; 385 byte_count += total_in_src; 386 /* don't allow buffer to overflow */ 387 if (byte_count > CIFSMaxBufSize + MAX_CIFS_HDR_SIZE) { 388 cifs_dbg(FYI, "coalesced BCC exceeds buffer size (%u)\n", 389 byte_count); 390 return -ENOBUFS; 391 } 392 *pdu_len = byte_count; 393 394 /* copy second buffer into end of first buffer */ 395 memcpy(data_area_of_tgt, data_area_of_src, total_in_src); 396 397 if (remaining != total_in_src) { 398 /* more responses to go */ 399 cifs_dbg(FYI, "waiting for more secondary responses\n"); 400 return 1; 401 } 402 403 /* we are done */ 404 cifs_dbg(FYI, "found the last secondary response\n"); 405 return 0; 406 } 407 408 bool 409 cifs_check_trans2(struct mid_q_entry *mid, struct TCP_Server_Info *server, 410 char *buf, int malformed) 411 { 412 if (malformed) 413 return false; 414 if (check2ndT2(buf) <= 0) 415 return false; 416 mid->multiRsp = true; 417 if (mid->resp_buf) { 418 /* merge response - fix up 1st*/ 419 malformed = coalesce_t2(buf, mid->resp_buf, &mid->response_pdu_len); 420 if (malformed > 0) 421 return true; 422 /* All parts received or packet is malformed. */ 423 mid->multiEnd = true; 424 dequeue_mid(server, mid, malformed); 425 return true; 426 } 427 if (!server->large_buf) { 428 /*FIXME: switch to already allocated largebuf?*/ 429 cifs_dbg(VFS, "1st trans2 resp needs bigbuf\n"); 430 } else { 431 /* Have first buffer */ 432 mid->resp_buf = buf; 433 mid->large_buf = true; 434 server->bigbuf = NULL; 435 } 436 return true; 437 } 438 439 static int 440 check_smb_hdr(struct smb_hdr *smb) 441 { 442 /* does it have the right SMB "signature" ? */ 443 if (*(__le32 *) smb->Protocol != SMB1_PROTO_NUMBER) { 444 cifs_dbg(VFS, "Bad protocol string signature header 0x%x\n", 445 *(unsigned int *)smb->Protocol); 446 return 1; 447 } 448 449 /* if it's a response then accept */ 450 if (smb->Flags & SMBFLG_RESPONSE) 451 return 0; 452 453 /* only one valid case where server sends us request */ 454 if (smb->Command == SMB_COM_LOCKING_ANDX) 455 return 0; 456 457 /* 458 * Windows NT server returns error resposne (e.g. STATUS_DELETE_PENDING 459 * or STATUS_OBJECT_NAME_NOT_FOUND or ERRDOS/ERRbadfile or any other) 460 * for some TRANS2 requests without the RESPONSE flag set in header. 461 */ 462 if (smb->Command == SMB_COM_TRANSACTION2 && smb->Status.CifsError != 0) 463 return 0; 464 465 cifs_dbg(VFS, "Server sent request, not response. mid=%u\n", 466 get_mid(smb)); 467 return 1; 468 } 469 470 int 471 checkSMB(char *buf, unsigned int pdu_len, unsigned int total_read, 472 struct TCP_Server_Info *server) 473 { 474 struct smb_hdr *smb = (struct smb_hdr *)buf; 475 __u32 rfclen = pdu_len; 476 __u32 clc_len; /* calculated length */ 477 cifs_dbg(FYI, "checkSMB Length: 0x%x, smb_buf_length: 0x%x\n", 478 total_read, rfclen); 479 480 /* is this frame too small to even get to a BCC? */ 481 if (total_read < 2 + sizeof(struct smb_hdr)) { 482 if ((total_read >= sizeof(struct smb_hdr) - 1) 483 && (smb->Status.CifsError != 0)) { 484 /* it's an error return */ 485 smb->WordCount = 0; 486 /* some error cases do not return wct and bcc */ 487 return 0; 488 } else if ((total_read == sizeof(struct smb_hdr) + 1) && 489 (smb->WordCount == 0)) { 490 char *tmp = (char *)smb; 491 /* Need to work around a bug in two servers here */ 492 /* First, check if the part of bcc they sent was zero */ 493 if (tmp[sizeof(struct smb_hdr)] == 0) { 494 /* some servers return only half of bcc 495 * on simple responses (wct, bcc both zero) 496 * in particular have seen this on 497 * ulogoffX and FindClose. This leaves 498 * one byte of bcc potentially uninitialized 499 */ 500 /* zero rest of bcc */ 501 tmp[sizeof(struct smb_hdr)+1] = 0; 502 return 0; 503 } 504 cifs_dbg(VFS, "rcvd invalid byte count (bcc)\n"); 505 return smb_EIO1(smb_eio_trace_rx_inv_bcc, tmp[sizeof(struct smb_hdr)]); 506 } else { 507 cifs_dbg(VFS, "Length less than smb header size\n"); 508 return smb_EIO2(smb_eio_trace_rx_too_short, 509 total_read, smb->WordCount); 510 } 511 } else if (total_read < sizeof(*smb) + 2 * smb->WordCount) { 512 cifs_dbg(VFS, "%s: can't read BCC due to invalid WordCount(%u)\n", 513 __func__, smb->WordCount); 514 return smb_EIO2(smb_eio_trace_rx_check_rsp, 515 total_read, 2 + sizeof(struct smb_hdr)); 516 } 517 518 /* otherwise, there is enough to get to the BCC */ 519 if (check_smb_hdr(smb)) 520 return smb_EIO1(smb_eio_trace_rx_rfc1002_magic, *(u32 *)smb->Protocol); 521 clc_len = smbCalcSize(smb); 522 523 if (rfclen != total_read) { 524 cifs_dbg(VFS, "Length read does not match RFC1001 length %d/%d\n", 525 rfclen, total_read); 526 return smb_EIO2(smb_eio_trace_rx_check_rsp, 527 total_read, rfclen); 528 } 529 530 if (rfclen != clc_len) { 531 __u16 mid = get_mid(smb); 532 /* check if bcc wrapped around for large read responses */ 533 if ((rfclen > 64 * 1024) && (rfclen > clc_len)) { 534 /* check if lengths match mod 64K */ 535 if (((rfclen) & 0xFFFF) == (clc_len & 0xFFFF)) 536 return 0; /* bcc wrapped */ 537 } 538 cifs_dbg(FYI, "Calculated size %u vs length %u mismatch for mid=%u\n", 539 clc_len, rfclen, mid); 540 541 if (rfclen < clc_len) { 542 cifs_dbg(VFS, "RFC1001 size %u smaller than SMB for mid=%u\n", 543 rfclen, mid); 544 return smb_EIO2(smb_eio_trace_rx_calc_len_too_big, 545 rfclen, clc_len); 546 } else if (rfclen > clc_len + 512) { 547 /* 548 * Some servers (Windows XP in particular) send more 549 * data than the lengths in the SMB packet would 550 * indicate on certain calls (byte range locks and 551 * trans2 find first calls in particular). While the 552 * client can handle such a frame by ignoring the 553 * trailing data, we choose limit the amount of extra 554 * data to 512 bytes. 555 */ 556 cifs_dbg(VFS, "RFC1001 size %u more than 512 bytes larger than SMB for mid=%u\n", 557 rfclen, mid); 558 return smb_EIO2(smb_eio_trace_rx_overlong, 559 rfclen, clc_len + 512); 560 } 561 } 562 return 0; 563 } 564