xref: /linux/fs/smb/client/smb2file.c (revision 3a2c4d55e32ad65efebdb6de44eef3bfa08bb49d)
1 // SPDX-License-Identifier: LGPL-2.1
2 /*
3  *
4  *   Copyright (C) International Business Machines  Corp., 2002, 2011
5  *   Author(s): Steve French (sfrench@us.ibm.com),
6  *              Pavel Shilovsky ((pshilovsky@samba.org) 2012
7  *
8  */
9 #include <linux/fs.h>
10 #include <linux/filelock.h>
11 #include <linux/stat.h>
12 #include <linux/slab.h>
13 #include <linux/pagemap.h>
14 #include <asm/div64.h>
15 #include "cifsfs.h"
16 #include "cifsglob.h"
17 #include "cifsproto.h"
18 #include "cifs_debug.h"
19 #include "cifs_fs_sb.h"
20 #include "cifs_unicode.h"
21 #include "fscache.h"
22 #include "smb2proto.h"
23 #include "../common/smb2status.h"
24 #include "../common/smbfsctl.h"
25 
26 static struct smb2_symlink_err_rsp *symlink_data(const struct kvec *iov)
27 {
28 	struct smb2_err_rsp *err = iov->iov_base;
29 	struct smb2_symlink_err_rsp *sym = ERR_PTR(-EINVAL);
30 	u8 *end = (u8 *)err + iov->iov_len;
31 	u32 len;
32 
33 	/*
34 	 * Per [MS-SMB2] section 2.2.2, a STATUS_STOPPED_ON_SYMLINK response has to
35 	 * carry a Symbolic Link Error Response, so ByteCount cannot be zero.  Some
36 	 * servers (e.g. the macOS built-in SMB server) violate this and return an
37 	 * empty error response, with both ErrorContextCount and ByteCount set to
38 	 * zero, i.e. without the symlink target.  Detect this and return -ENODATA
39 	 * so that callers can tell "server did not send the target" apart from a
40 	 * malformed response, and retrieve the target with FSCTL_GET_REPARSE_POINT
41 	 * instead.
42 	 */
43 	if (!err->ErrorContextCount && !le32_to_cpu(err->ByteCount))
44 		return ERR_PTR(-ENODATA);
45 
46 	if (err->ErrorContextCount) {
47 		struct smb2_error_context_rsp *p;
48 
49 		len = (u32)err->ErrorContextCount * (offsetof(struct smb2_error_context_rsp,
50 							      ErrorContextData) +
51 						     sizeof(struct smb2_symlink_err_rsp));
52 		if (le32_to_cpu(err->ByteCount) < len || iov->iov_len < len + sizeof(*err) + 1)
53 			return ERR_PTR(-EINVAL);
54 
55 		p = (struct smb2_error_context_rsp *)err->ErrorData;
56 		while ((u8 *)p + sizeof(*p) <= end) {
57 			if (le32_to_cpu(p->ErrorId) == SMB2_ERROR_ID_DEFAULT) {
58 				sym = (struct smb2_symlink_err_rsp *)p->ErrorContextData;
59 				break;
60 			}
61 			cifs_dbg(FYI, "%s: skipping unhandled error context: 0x%x\n",
62 				 __func__, le32_to_cpu(p->ErrorId));
63 
64 			len = le32_to_cpu(p->ErrorDataLength);
65 			if (len > end - ((u8 *)p + sizeof(*p)))
66 				return ERR_PTR(-EINVAL);
67 			len = ALIGN(len, 8);
68 			if (len > end - ((u8 *)p + sizeof(*p)))
69 				return ERR_PTR(-EINVAL);
70 
71 			p = (struct smb2_error_context_rsp *)(p->ErrorContextData + len);
72 		}
73 	} else if (le32_to_cpu(err->ByteCount) >= sizeof(*sym) &&
74 		   iov->iov_len >= SMB2_SYMLINK_STRUCT_SIZE) {
75 		sym = (struct smb2_symlink_err_rsp *)err->ErrorData;
76 	}
77 
78 	if (!IS_ERR(sym) &&
79 	    ((u8 *)sym + sizeof(*sym) > end ||
80 	     le32_to_cpu(sym->SymLinkErrorTag) != SYMLINK_ERROR_TAG ||
81 	     le32_to_cpu(sym->ReparseTag) != IO_REPARSE_TAG_SYMLINK))
82 		sym = ERR_PTR(-EINVAL);
83 
84 	return sym;
85 }
86 
87 int smb2_fix_symlink_target_type(char **target, bool directory, struct cifs_sb_info *cifs_sb)
88 {
89 	char *buf;
90 	int len;
91 
92 	/*
93 	 * POSIX server does not distinguish between symlinks to file and
94 	 * symlink directory. So nothing is needed to fix on the client side.
95 	 */
96 	if (cifs_sb_flags(cifs_sb) & CIFS_MOUNT_POSIX_PATHS)
97 		return 0;
98 
99 	if (!*target)
100 		return smb_EIO(smb_eio_trace_null_pointers);
101 
102 	len = strlen(*target);
103 	if (!len)
104 		return smb_EIO1(smb_eio_trace_sym_target_len, len);
105 
106 	/*
107 	 * If this is directory symlink and it does not have trailing slash then
108 	 * append it. Trailing slash simulates Windows/SMB behavior which do not
109 	 * allow resolving directory symlink to file.
110 	 */
111 	if (directory && (*target)[len-1] != '/') {
112 		buf = krealloc(*target, len+2, GFP_KERNEL);
113 		if (!buf)
114 			return -ENOMEM;
115 		buf[len] = '/';
116 		buf[len+1] = '\0';
117 		*target = buf;
118 		len++;
119 	}
120 
121 	/*
122 	 * If this is a file (non-directory) symlink and it points to path name
123 	 * with trailing slash then this is an invalid symlink because file name
124 	 * cannot contain slash character. File name with slash is invalid on
125 	 * both Windows and Linux systems. So return an error for such symlink.
126 	 */
127 	if (!directory && (*target)[len-1] == '/')
128 		return smb_EIO(smb_eio_trace_sym_slash);
129 
130 	return 0;
131 }
132 
133 int smb2_parse_symlink_response(struct cifs_sb_info *cifs_sb, const struct kvec *iov,
134 				const char *full_path, char **path)
135 {
136 	struct smb2_symlink_err_rsp *sym;
137 	unsigned int sub_offs, sub_len;
138 	unsigned int print_offs, print_len;
139 
140 	if (!cifs_sb || !iov || !iov->iov_base || !iov->iov_len || !path)
141 		return -EINVAL;
142 
143 	sym = symlink_data(iov);
144 	if (IS_ERR(sym))
145 		return PTR_ERR(sym);
146 
147 	sub_len = le16_to_cpu(sym->SubstituteNameLength);
148 	sub_offs = le16_to_cpu(sym->SubstituteNameOffset);
149 	print_len = le16_to_cpu(sym->PrintNameLength);
150 	print_offs = le16_to_cpu(sym->PrintNameOffset);
151 
152 	if ((char *)sym->PathBuffer + sub_offs + sub_len >
153 		(char *)iov->iov_base + iov->iov_len ||
154 	    (char *)sym->PathBuffer + print_offs + print_len >
155 		(char *)iov->iov_base + iov->iov_len)
156 		return -EINVAL;
157 
158 	return smb2_parse_native_symlink(path,
159 					 (char *)sym->PathBuffer + sub_offs,
160 					 sub_len,
161 					 le32_to_cpu(sym->Flags) & SYMLINK_FLAG_RELATIVE,
162 					 full_path,
163 					 cifs_sb);
164 }
165 
166 int smb2_open_file(const unsigned int xid, struct cifs_open_parms *oparms,
167 		   __u32 *oplock, void *buf)
168 {
169 	int rc;
170 	__le16 *smb2_path;
171 	__u8 smb2_oplock;
172 	struct cifs_open_info_data *data = buf;
173 	struct kvec err_iov = {};
174 	int err_buftype = CIFS_NO_BUFFER;
175 	struct cifs_fid *fid = oparms->fid;
176 	struct network_resiliency_req nr_ioctl_req;
177 	bool retry_without_read_attributes = false;
178 
179 	smb2_path = cifs_convert_path_to_utf16(oparms->path, oparms->cifs_sb);
180 	if (smb2_path == NULL)
181 		return -ENOMEM;
182 
183 	/*
184 	 * GENERIC_READ, GENERIC_EXECUTE, GENERIC_ALL and MAXIMUM_ALLOWED
185 	 * contains also FILE_READ_ATTRIBUTES access right. So do not append
186 	 * FILE_READ_ATTRIBUTES when not needed and prevent calling code path
187 	 * for retry_without_read_attributes.
188 	 */
189 	if (!(oparms->desired_access & FILE_READ_ATTRIBUTES) &&
190 	    !(oparms->desired_access & GENERIC_READ) &&
191 	    !(oparms->desired_access & GENERIC_EXECUTE) &&
192 	    !(oparms->desired_access & GENERIC_ALL) &&
193 	    !(oparms->desired_access & MAXIMUM_ALLOWED)) {
194 		oparms->desired_access |= FILE_READ_ATTRIBUTES;
195 		retry_without_read_attributes = true;
196 	}
197 	smb2_oplock = SMB2_OPLOCK_LEVEL_BATCH;
198 
199 	rc = SMB2_open(xid, oparms, smb2_path, &smb2_oplock, data, NULL, &err_iov,
200 		       &err_buftype);
201 	if (rc == -EACCES && retry_without_read_attributes) {
202 		free_rsp_buf(err_buftype, err_iov.iov_base);
203 		memset(&err_iov, 0, sizeof(err_iov));
204 		err_buftype = CIFS_NO_BUFFER;
205 		oparms->desired_access &= ~FILE_READ_ATTRIBUTES;
206 		rc = SMB2_open(xid, oparms, smb2_path, &smb2_oplock, data, NULL, &err_iov,
207 			       &err_buftype);
208 	}
209 	if (rc && data) {
210 		struct smb2_hdr *hdr = err_iov.iov_base;
211 
212 		if (unlikely(!err_iov.iov_base || err_buftype == CIFS_NO_BUFFER))
213 			goto out;
214 		if (hdr->Status == STATUS_STOPPED_ON_SYMLINK) {
215 			rc = smb2_parse_symlink_response(oparms->cifs_sb, &err_iov,
216 							 oparms->path,
217 							 &data->symlink_target);
218 			/*
219 			 * If smb2_parse_symlink_response returned -ENODATA then the
220 			 * symlink_target was not sent. Treat this as if the SMB2_open()
221 			 * failed with STATUS_IO_REPARSE_TAG_NOT_HANDLED status, which is
222 			 * indicated by the -EIO errno.
223 			 */
224 			if (rc == -ENODATA)
225 				rc = -EIO;
226 			if (!rc) {
227 				memset(&data->fi, 0, sizeof(data->fi));
228 				oparms->create_options |= OPEN_REPARSE_POINT;
229 				rc = SMB2_open(xid, oparms, smb2_path, &smb2_oplock, data,
230 					       NULL, NULL, NULL);
231 				oparms->create_options &= ~OPEN_REPARSE_POINT;
232 			}
233 			if (!rc) {
234 				bool directory = le32_to_cpu(data->fi.Attributes) & ATTR_DIRECTORY;
235 				rc = smb2_fix_symlink_target_type(&data->symlink_target,
236 								  directory, oparms->cifs_sb);
237 			}
238 		}
239 	}
240 
241 	if (rc)
242 		goto out;
243 
244 	if (oparms->tcon->use_resilient) {
245 		/* default timeout is 0, servers pick default (120 seconds) */
246 		nr_ioctl_req.Timeout =
247 			cpu_to_le32(oparms->tcon->handle_timeout);
248 		nr_ioctl_req.Reserved = 0;
249 		rc = SMB2_ioctl(xid, oparms->tcon, fid->persistent_fid,
250 			fid->volatile_fid, FSCTL_LMR_REQUEST_RESILIENCY,
251 			(char *)&nr_ioctl_req, sizeof(nr_ioctl_req),
252 			CIFSMaxBufSize, NULL, NULL /* no return info */);
253 		if (rc == -EOPNOTSUPP) {
254 			cifs_dbg(VFS,
255 			     "resiliency not supported by server, disabling\n");
256 			oparms->tcon->use_resilient = false;
257 		} else if (rc)
258 			cifs_dbg(FYI, "error %d setting resiliency\n", rc);
259 
260 		rc = 0;
261 	}
262 
263 	if (data) {
264 		/* if open response does not have IndexNumber field - get it */
265 		if (data->fi.IndexNumber == 0) {
266 			rc = SMB2_get_srv_num(xid, oparms->tcon,
267 				      fid->persistent_fid,
268 				      fid->volatile_fid,
269 				      &data->fi.IndexNumber);
270 			if (rc) {
271 				/*
272 				 * let get_inode_info disable server inode
273 				 * numbers
274 				 */
275 				data->fi.IndexNumber = 0;
276 				rc = 0;
277 			}
278 		}
279 	}
280 
281 	*oplock = smb2_oplock;
282 out:
283 	free_rsp_buf(err_buftype, err_iov.iov_base);
284 	kfree(smb2_path);
285 	return rc;
286 }
287 
288 int
289 smb2_unlock_range(struct cifsFileInfo *cfile, struct file_lock *flock,
290 		  const unsigned int xid)
291 {
292 	int rc = 0, stored_rc;
293 	unsigned int max_num, num = 0, max_buf;
294 	struct smb2_lock_element *buf, *cur;
295 	struct cifs_tcon *tcon = tlink_tcon(cfile->tlink);
296 	struct cifsInodeInfo *cinode = CIFS_I(d_inode(cfile->dentry));
297 	struct cifsLockInfo *li, *tmp;
298 	__u64 length = 1 + flock->fl_end - flock->fl_start;
299 	LIST_HEAD(tmp_llist);
300 
301 	/*
302 	 * Accessing maxBuf is racy with cifs_reconnect - need to store value
303 	 * and check it before using.
304 	 */
305 	max_buf = tcon->ses->server->maxBuf;
306 	if (max_buf < sizeof(struct smb2_lock_element))
307 		return -EINVAL;
308 
309 	BUILD_BUG_ON(sizeof(struct smb2_lock_element) > PAGE_SIZE);
310 	max_buf = min_t(unsigned int, max_buf, PAGE_SIZE);
311 	max_num = max_buf / sizeof(struct smb2_lock_element);
312 	buf = kzalloc_objs(struct smb2_lock_element, max_num);
313 	if (!buf)
314 		return -ENOMEM;
315 
316 	cur = buf;
317 
318 	cifs_down_write(&cinode->lock_sem);
319 	list_for_each_entry_safe(li, tmp, &cfile->llist->locks, llist) {
320 		if (flock->fl_start > li->offset ||
321 		    (flock->fl_start + length) <
322 		    (li->offset + li->length))
323 			continue;
324 		if (current->tgid != li->pid)
325 			/*
326 			 * flock and OFD lock are associated with an open
327 			 * file description, not the process.
328 			 */
329 			if (!(flock->c.flc_flags & (FL_FLOCK | FL_OFDLCK)))
330 				continue;
331 		if (cinode->can_cache_brlcks) {
332 			/*
333 			 * We can cache brlock requests - simply remove a lock
334 			 * from the file's list.
335 			 */
336 			list_del(&li->llist);
337 			cifs_del_lock_waiters(li);
338 			kfree(li);
339 			continue;
340 		}
341 		cur->Length = cpu_to_le64(li->length);
342 		cur->Offset = cpu_to_le64(li->offset);
343 		cur->Flags = cpu_to_le32(SMB2_LOCKFLAG_UNLOCK);
344 		/*
345 		 * We need to save a lock here to let us add it again to the
346 		 * file's list if the unlock range request fails on the server.
347 		 */
348 		list_move(&li->llist, &tmp_llist);
349 		if (++num == max_num) {
350 			stored_rc = smb2_lockv(xid, tcon,
351 					       cfile->fid.persistent_fid,
352 					       cfile->fid.volatile_fid,
353 					       current->tgid, num, buf);
354 			if (stored_rc) {
355 				/*
356 				 * We failed on the unlock range request - add
357 				 * all locks from the tmp list to the head of
358 				 * the file's list.
359 				 */
360 				cifs_move_llist(&tmp_llist,
361 						&cfile->llist->locks);
362 				rc = stored_rc;
363 			} else
364 				/*
365 				 * The unlock range request succeed - free the
366 				 * tmp list.
367 				 */
368 				cifs_free_llist(&tmp_llist);
369 			cur = buf;
370 			num = 0;
371 		} else
372 			cur++;
373 	}
374 	if (num) {
375 		stored_rc = smb2_lockv(xid, tcon, cfile->fid.persistent_fid,
376 				       cfile->fid.volatile_fid, current->tgid,
377 				       num, buf);
378 		if (stored_rc) {
379 			cifs_move_llist(&tmp_llist, &cfile->llist->locks);
380 			rc = stored_rc;
381 		} else
382 			cifs_free_llist(&tmp_llist);
383 	}
384 	up_write(&cinode->lock_sem);
385 
386 	kfree(buf);
387 	return rc;
388 }
389 
390 static int
391 smb2_push_mand_fdlocks(struct cifs_fid_locks *fdlocks, const unsigned int xid,
392 		       struct smb2_lock_element *buf, unsigned int max_num)
393 {
394 	int rc = 0, stored_rc;
395 	struct cifsFileInfo *cfile = fdlocks->cfile;
396 	struct cifsLockInfo *li;
397 	unsigned int num = 0;
398 	struct smb2_lock_element *cur = buf;
399 	struct cifs_tcon *tcon = tlink_tcon(cfile->tlink);
400 
401 	list_for_each_entry(li, &fdlocks->locks, llist) {
402 		cur->Length = cpu_to_le64(li->length);
403 		cur->Offset = cpu_to_le64(li->offset);
404 		cur->Flags = cpu_to_le32(li->type |
405 						SMB2_LOCKFLAG_FAIL_IMMEDIATELY);
406 		if (++num == max_num) {
407 			stored_rc = smb2_lockv(xid, tcon,
408 					       cfile->fid.persistent_fid,
409 					       cfile->fid.volatile_fid,
410 					       current->tgid, num, buf);
411 			if (stored_rc)
412 				rc = stored_rc;
413 			cur = buf;
414 			num = 0;
415 		} else
416 			cur++;
417 	}
418 	if (num) {
419 		stored_rc = smb2_lockv(xid, tcon,
420 				       cfile->fid.persistent_fid,
421 				       cfile->fid.volatile_fid,
422 				       current->tgid, num, buf);
423 		if (stored_rc)
424 			rc = stored_rc;
425 	}
426 
427 	return rc;
428 }
429 
430 int
431 smb2_push_mandatory_locks(struct cifsFileInfo *cfile)
432 {
433 	int rc = 0, stored_rc;
434 	unsigned int xid;
435 	unsigned int max_num, max_buf;
436 	struct smb2_lock_element *buf;
437 	struct cifsInodeInfo *cinode = CIFS_I(d_inode(cfile->dentry));
438 	struct cifs_fid_locks *fdlocks;
439 
440 	xid = get_xid();
441 
442 	/*
443 	 * Accessing maxBuf is racy with cifs_reconnect - need to store value
444 	 * and check it for zero before using.
445 	 */
446 	max_buf = tlink_tcon(cfile->tlink)->ses->server->maxBuf;
447 	if (max_buf < sizeof(struct smb2_lock_element)) {
448 		free_xid(xid);
449 		return -EINVAL;
450 	}
451 
452 	BUILD_BUG_ON(sizeof(struct smb2_lock_element) > PAGE_SIZE);
453 	max_buf = min_t(unsigned int, max_buf, PAGE_SIZE);
454 	max_num = max_buf / sizeof(struct smb2_lock_element);
455 	buf = kzalloc_objs(struct smb2_lock_element, max_num);
456 	if (!buf) {
457 		free_xid(xid);
458 		return -ENOMEM;
459 	}
460 
461 	list_for_each_entry(fdlocks, &cinode->llist, llist) {
462 		stored_rc = smb2_push_mand_fdlocks(fdlocks, xid, buf, max_num);
463 		if (stored_rc)
464 			rc = stored_rc;
465 	}
466 
467 	kfree(buf);
468 	free_xid(xid);
469 	return rc;
470 }
471