xref: /linux/fs/smb/client/smb2file.c (revision 78fbf08b4e637515b63682fea7fb94dfec335193)
1 // SPDX-License-Identifier: LGPL-2.1
2 /*
3  *
4  *   Copyright (C) International Business Machines  Corp., 2002, 2011
5  *   Author(s): Steve French (sfrench@us.ibm.com),
6  *              Pavel Shilovsky ((pshilovsky@samba.org) 2012
7  *
8  */
9 #include <linux/fs.h>
10 #include <linux/filelock.h>
11 #include <linux/stat.h>
12 #include <linux/slab.h>
13 #include <linux/pagemap.h>
14 #include <asm/div64.h>
15 #include "cifsfs.h"
16 #include "cifsglob.h"
17 #include "cifsproto.h"
18 #include "cifs_debug.h"
19 #include "cifs_fs_sb.h"
20 #include "cifs_unicode.h"
21 #include "fscache.h"
22 #include "smb2proto.h"
23 #include "../common/smb2status.h"
24 #include "../common/smbfsctl.h"
25 
26 static struct smb2_symlink_err_rsp *symlink_data(const struct kvec *iov)
27 {
28 	struct smb2_err_rsp *err = iov->iov_base;
29 	struct smb2_symlink_err_rsp *sym = ERR_PTR(-EINVAL);
30 	u8 *end = (u8 *)err + iov->iov_len;
31 	u32 len;
32 
33 	/*
34 	 * Per [MS-SMB2] section 2.2.2, a STATUS_STOPPED_ON_SYMLINK response has to
35 	 * carry a Symbolic Link Error Response, so ByteCount cannot be zero.  Some
36 	 * servers (e.g. the macOS built-in SMB server) violate this and return an
37 	 * empty error response, with both ErrorContextCount and ByteCount set to
38 	 * zero, i.e. without the symlink target.  Detect this and return -ENODATA
39 	 * so that callers can tell "server did not send the target" apart from a
40 	 * malformed response, and retrieve the target with FSCTL_GET_REPARSE_POINT
41 	 * instead.
42 	 */
43 	if (!err->ErrorContextCount && !le32_to_cpu(err->ByteCount))
44 		return ERR_PTR(-ENODATA);
45 
46 	if (err->ErrorContextCount) {
47 		struct smb2_error_context_rsp *p;
48 
49 		len = (u32)err->ErrorContextCount * (offsetof(struct smb2_error_context_rsp,
50 							      ErrorContextData) +
51 						     sizeof(struct smb2_symlink_err_rsp));
52 		if (le32_to_cpu(err->ByteCount) < len || iov->iov_len < len + sizeof(*err) + 1)
53 			return ERR_PTR(-EINVAL);
54 
55 		p = (struct smb2_error_context_rsp *)err->ErrorData;
56 		while ((u8 *)p + sizeof(*p) <= end) {
57 			if (le32_to_cpu(p->ErrorId) == SMB2_ERROR_ID_DEFAULT) {
58 				sym = (struct smb2_symlink_err_rsp *)p->ErrorContextData;
59 				break;
60 			}
61 			cifs_dbg(FYI, "%s: skipping unhandled error context: 0x%x\n",
62 				 __func__, le32_to_cpu(p->ErrorId));
63 
64 			len = ALIGN(le32_to_cpu(p->ErrorDataLength), 8);
65 			if (len > end - ((u8 *)p + sizeof(*p)))
66 				return ERR_PTR(-EINVAL);
67 
68 			p = (struct smb2_error_context_rsp *)(p->ErrorContextData + len);
69 		}
70 	} else if (le32_to_cpu(err->ByteCount) >= sizeof(*sym) &&
71 		   iov->iov_len >= SMB2_SYMLINK_STRUCT_SIZE) {
72 		sym = (struct smb2_symlink_err_rsp *)err->ErrorData;
73 	}
74 
75 	if (!IS_ERR(sym) &&
76 	    ((u8 *)sym + sizeof(*sym) > end ||
77 	     le32_to_cpu(sym->SymLinkErrorTag) != SYMLINK_ERROR_TAG ||
78 	     le32_to_cpu(sym->ReparseTag) != IO_REPARSE_TAG_SYMLINK))
79 		sym = ERR_PTR(-EINVAL);
80 
81 	return sym;
82 }
83 
84 int smb2_fix_symlink_target_type(char **target, bool directory, struct cifs_sb_info *cifs_sb)
85 {
86 	char *buf;
87 	int len;
88 
89 	/*
90 	 * POSIX server does not distinguish between symlinks to file and
91 	 * symlink directory. So nothing is needed to fix on the client side.
92 	 */
93 	if (cifs_sb_flags(cifs_sb) & CIFS_MOUNT_POSIX_PATHS)
94 		return 0;
95 
96 	if (!*target)
97 		return smb_EIO(smb_eio_trace_null_pointers);
98 
99 	len = strlen(*target);
100 	if (!len)
101 		return smb_EIO1(smb_eio_trace_sym_target_len, len);
102 
103 	/*
104 	 * If this is directory symlink and it does not have trailing slash then
105 	 * append it. Trailing slash simulates Windows/SMB behavior which do not
106 	 * allow resolving directory symlink to file.
107 	 */
108 	if (directory && (*target)[len-1] != '/') {
109 		buf = krealloc(*target, len+2, GFP_KERNEL);
110 		if (!buf)
111 			return -ENOMEM;
112 		buf[len] = '/';
113 		buf[len+1] = '\0';
114 		*target = buf;
115 		len++;
116 	}
117 
118 	/*
119 	 * If this is a file (non-directory) symlink and it points to path name
120 	 * with trailing slash then this is an invalid symlink because file name
121 	 * cannot contain slash character. File name with slash is invalid on
122 	 * both Windows and Linux systems. So return an error for such symlink.
123 	 */
124 	if (!directory && (*target)[len-1] == '/')
125 		return smb_EIO(smb_eio_trace_sym_slash);
126 
127 	return 0;
128 }
129 
130 int smb2_parse_symlink_response(struct cifs_sb_info *cifs_sb, const struct kvec *iov,
131 				const char *full_path, char **path)
132 {
133 	struct smb2_symlink_err_rsp *sym;
134 	unsigned int sub_offs, sub_len;
135 	unsigned int print_offs, print_len;
136 
137 	if (!cifs_sb || !iov || !iov->iov_base || !iov->iov_len || !path)
138 		return -EINVAL;
139 
140 	sym = symlink_data(iov);
141 	if (IS_ERR(sym))
142 		return PTR_ERR(sym);
143 
144 	sub_len = le16_to_cpu(sym->SubstituteNameLength);
145 	sub_offs = le16_to_cpu(sym->SubstituteNameOffset);
146 	print_len = le16_to_cpu(sym->PrintNameLength);
147 	print_offs = le16_to_cpu(sym->PrintNameOffset);
148 
149 	if ((char *)sym->PathBuffer + sub_offs + sub_len >
150 		(char *)iov->iov_base + iov->iov_len ||
151 	    (char *)sym->PathBuffer + print_offs + print_len >
152 		(char *)iov->iov_base + iov->iov_len)
153 		return -EINVAL;
154 
155 	return smb2_parse_native_symlink(path,
156 					 (char *)sym->PathBuffer + sub_offs,
157 					 sub_len,
158 					 le32_to_cpu(sym->Flags) & SYMLINK_FLAG_RELATIVE,
159 					 full_path,
160 					 cifs_sb);
161 }
162 
163 int smb2_open_file(const unsigned int xid, struct cifs_open_parms *oparms,
164 		   __u32 *oplock, void *buf)
165 {
166 	int rc;
167 	__le16 *smb2_path;
168 	__u8 smb2_oplock;
169 	struct cifs_open_info_data *data = buf;
170 	struct kvec err_iov = {};
171 	int err_buftype = CIFS_NO_BUFFER;
172 	struct cifs_fid *fid = oparms->fid;
173 	struct network_resiliency_req nr_ioctl_req;
174 	bool retry_without_read_attributes = false;
175 
176 	smb2_path = cifs_convert_path_to_utf16(oparms->path, oparms->cifs_sb);
177 	if (smb2_path == NULL)
178 		return -ENOMEM;
179 
180 	/*
181 	 * GENERIC_READ, GENERIC_EXECUTE, GENERIC_ALL and MAXIMUM_ALLOWED
182 	 * contains also FILE_READ_ATTRIBUTES access right. So do not append
183 	 * FILE_READ_ATTRIBUTES when not needed and prevent calling code path
184 	 * for retry_without_read_attributes.
185 	 */
186 	if (!(oparms->desired_access & FILE_READ_ATTRIBUTES) &&
187 	    !(oparms->desired_access & GENERIC_READ) &&
188 	    !(oparms->desired_access & GENERIC_EXECUTE) &&
189 	    !(oparms->desired_access & GENERIC_ALL) &&
190 	    !(oparms->desired_access & MAXIMUM_ALLOWED)) {
191 		oparms->desired_access |= FILE_READ_ATTRIBUTES;
192 		retry_without_read_attributes = true;
193 	}
194 	smb2_oplock = SMB2_OPLOCK_LEVEL_BATCH;
195 
196 	rc = SMB2_open(xid, oparms, smb2_path, &smb2_oplock, data, NULL, &err_iov,
197 		       &err_buftype);
198 	if (rc == -EACCES && retry_without_read_attributes) {
199 		free_rsp_buf(err_buftype, err_iov.iov_base);
200 		memset(&err_iov, 0, sizeof(err_iov));
201 		err_buftype = CIFS_NO_BUFFER;
202 		oparms->desired_access &= ~FILE_READ_ATTRIBUTES;
203 		rc = SMB2_open(xid, oparms, smb2_path, &smb2_oplock, data, NULL, &err_iov,
204 			       &err_buftype);
205 	}
206 	if (rc && data) {
207 		struct smb2_hdr *hdr = err_iov.iov_base;
208 
209 		if (unlikely(!err_iov.iov_base || err_buftype == CIFS_NO_BUFFER))
210 			goto out;
211 		if (hdr->Status == STATUS_STOPPED_ON_SYMLINK) {
212 			rc = smb2_parse_symlink_response(oparms->cifs_sb, &err_iov,
213 							 oparms->path,
214 							 &data->symlink_target);
215 			/*
216 			 * If smb2_parse_symlink_response returned -ENODATA then the
217 			 * symlink_target was not sent. Treat this as if the SMB2_open()
218 			 * failed with STATUS_IO_REPARSE_TAG_NOT_HANDLED status, which is
219 			 * indicated by the -EIO errno.
220 			 */
221 			if (rc == -ENODATA)
222 				rc = -EIO;
223 			if (!rc) {
224 				memset(&data->fi, 0, sizeof(data->fi));
225 				oparms->create_options |= OPEN_REPARSE_POINT;
226 				rc = SMB2_open(xid, oparms, smb2_path, &smb2_oplock, data,
227 					       NULL, NULL, NULL);
228 				oparms->create_options &= ~OPEN_REPARSE_POINT;
229 			}
230 			if (!rc) {
231 				bool directory = le32_to_cpu(data->fi.Attributes) & ATTR_DIRECTORY;
232 				rc = smb2_fix_symlink_target_type(&data->symlink_target,
233 								  directory, oparms->cifs_sb);
234 			}
235 		}
236 	}
237 
238 	if (rc)
239 		goto out;
240 
241 	if (oparms->tcon->use_resilient) {
242 		/* default timeout is 0, servers pick default (120 seconds) */
243 		nr_ioctl_req.Timeout =
244 			cpu_to_le32(oparms->tcon->handle_timeout);
245 		nr_ioctl_req.Reserved = 0;
246 		rc = SMB2_ioctl(xid, oparms->tcon, fid->persistent_fid,
247 			fid->volatile_fid, FSCTL_LMR_REQUEST_RESILIENCY,
248 			(char *)&nr_ioctl_req, sizeof(nr_ioctl_req),
249 			CIFSMaxBufSize, NULL, NULL /* no return info */);
250 		if (rc == -EOPNOTSUPP) {
251 			cifs_dbg(VFS,
252 			     "resiliency not supported by server, disabling\n");
253 			oparms->tcon->use_resilient = false;
254 		} else if (rc)
255 			cifs_dbg(FYI, "error %d setting resiliency\n", rc);
256 
257 		rc = 0;
258 	}
259 
260 	if (data) {
261 		/* if open response does not have IndexNumber field - get it */
262 		if (data->fi.IndexNumber == 0) {
263 			rc = SMB2_get_srv_num(xid, oparms->tcon,
264 				      fid->persistent_fid,
265 				      fid->volatile_fid,
266 				      &data->fi.IndexNumber);
267 			if (rc) {
268 				/*
269 				 * let get_inode_info disable server inode
270 				 * numbers
271 				 */
272 				data->fi.IndexNumber = 0;
273 				rc = 0;
274 			}
275 		}
276 	}
277 
278 	*oplock = smb2_oplock;
279 out:
280 	free_rsp_buf(err_buftype, err_iov.iov_base);
281 	kfree(smb2_path);
282 	return rc;
283 }
284 
285 int
286 smb2_unlock_range(struct cifsFileInfo *cfile, struct file_lock *flock,
287 		  const unsigned int xid)
288 {
289 	int rc = 0, stored_rc;
290 	unsigned int max_num, num = 0, max_buf;
291 	struct smb2_lock_element *buf, *cur;
292 	struct cifs_tcon *tcon = tlink_tcon(cfile->tlink);
293 	struct cifsInodeInfo *cinode = CIFS_I(d_inode(cfile->dentry));
294 	struct cifsLockInfo *li, *tmp;
295 	__u64 length = 1 + flock->fl_end - flock->fl_start;
296 	LIST_HEAD(tmp_llist);
297 
298 	/*
299 	 * Accessing maxBuf is racy with cifs_reconnect - need to store value
300 	 * and check it before using.
301 	 */
302 	max_buf = tcon->ses->server->maxBuf;
303 	if (max_buf < sizeof(struct smb2_lock_element))
304 		return -EINVAL;
305 
306 	BUILD_BUG_ON(sizeof(struct smb2_lock_element) > PAGE_SIZE);
307 	max_buf = min_t(unsigned int, max_buf, PAGE_SIZE);
308 	max_num = max_buf / sizeof(struct smb2_lock_element);
309 	buf = kzalloc_objs(struct smb2_lock_element, max_num);
310 	if (!buf)
311 		return -ENOMEM;
312 
313 	cur = buf;
314 
315 	cifs_down_write(&cinode->lock_sem);
316 	list_for_each_entry_safe(li, tmp, &cfile->llist->locks, llist) {
317 		if (flock->fl_start > li->offset ||
318 		    (flock->fl_start + length) <
319 		    (li->offset + li->length))
320 			continue;
321 		if (current->tgid != li->pid)
322 			/*
323 			 * flock and OFD lock are associated with an open
324 			 * file description, not the process.
325 			 */
326 			if (!(flock->c.flc_flags & (FL_FLOCK | FL_OFDLCK)))
327 				continue;
328 		if (cinode->can_cache_brlcks) {
329 			/*
330 			 * We can cache brlock requests - simply remove a lock
331 			 * from the file's list.
332 			 */
333 			list_del(&li->llist);
334 			cifs_del_lock_waiters(li);
335 			kfree(li);
336 			continue;
337 		}
338 		cur->Length = cpu_to_le64(li->length);
339 		cur->Offset = cpu_to_le64(li->offset);
340 		cur->Flags = cpu_to_le32(SMB2_LOCKFLAG_UNLOCK);
341 		/*
342 		 * We need to save a lock here to let us add it again to the
343 		 * file's list if the unlock range request fails on the server.
344 		 */
345 		list_move(&li->llist, &tmp_llist);
346 		if (++num == max_num) {
347 			stored_rc = smb2_lockv(xid, tcon,
348 					       cfile->fid.persistent_fid,
349 					       cfile->fid.volatile_fid,
350 					       current->tgid, num, buf);
351 			if (stored_rc) {
352 				/*
353 				 * We failed on the unlock range request - add
354 				 * all locks from the tmp list to the head of
355 				 * the file's list.
356 				 */
357 				cifs_move_llist(&tmp_llist,
358 						&cfile->llist->locks);
359 				rc = stored_rc;
360 			} else
361 				/*
362 				 * The unlock range request succeed - free the
363 				 * tmp list.
364 				 */
365 				cifs_free_llist(&tmp_llist);
366 			cur = buf;
367 			num = 0;
368 		} else
369 			cur++;
370 	}
371 	if (num) {
372 		stored_rc = smb2_lockv(xid, tcon, cfile->fid.persistent_fid,
373 				       cfile->fid.volatile_fid, current->tgid,
374 				       num, buf);
375 		if (stored_rc) {
376 			cifs_move_llist(&tmp_llist, &cfile->llist->locks);
377 			rc = stored_rc;
378 		} else
379 			cifs_free_llist(&tmp_llist);
380 	}
381 	up_write(&cinode->lock_sem);
382 
383 	kfree(buf);
384 	return rc;
385 }
386 
387 static int
388 smb2_push_mand_fdlocks(struct cifs_fid_locks *fdlocks, const unsigned int xid,
389 		       struct smb2_lock_element *buf, unsigned int max_num)
390 {
391 	int rc = 0, stored_rc;
392 	struct cifsFileInfo *cfile = fdlocks->cfile;
393 	struct cifsLockInfo *li;
394 	unsigned int num = 0;
395 	struct smb2_lock_element *cur = buf;
396 	struct cifs_tcon *tcon = tlink_tcon(cfile->tlink);
397 
398 	list_for_each_entry(li, &fdlocks->locks, llist) {
399 		cur->Length = cpu_to_le64(li->length);
400 		cur->Offset = cpu_to_le64(li->offset);
401 		cur->Flags = cpu_to_le32(li->type |
402 						SMB2_LOCKFLAG_FAIL_IMMEDIATELY);
403 		if (++num == max_num) {
404 			stored_rc = smb2_lockv(xid, tcon,
405 					       cfile->fid.persistent_fid,
406 					       cfile->fid.volatile_fid,
407 					       current->tgid, num, buf);
408 			if (stored_rc)
409 				rc = stored_rc;
410 			cur = buf;
411 			num = 0;
412 		} else
413 			cur++;
414 	}
415 	if (num) {
416 		stored_rc = smb2_lockv(xid, tcon,
417 				       cfile->fid.persistent_fid,
418 				       cfile->fid.volatile_fid,
419 				       current->tgid, num, buf);
420 		if (stored_rc)
421 			rc = stored_rc;
422 	}
423 
424 	return rc;
425 }
426 
427 int
428 smb2_push_mandatory_locks(struct cifsFileInfo *cfile)
429 {
430 	int rc = 0, stored_rc;
431 	unsigned int xid;
432 	unsigned int max_num, max_buf;
433 	struct smb2_lock_element *buf;
434 	struct cifsInodeInfo *cinode = CIFS_I(d_inode(cfile->dentry));
435 	struct cifs_fid_locks *fdlocks;
436 
437 	xid = get_xid();
438 
439 	/*
440 	 * Accessing maxBuf is racy with cifs_reconnect - need to store value
441 	 * and check it for zero before using.
442 	 */
443 	max_buf = tlink_tcon(cfile->tlink)->ses->server->maxBuf;
444 	if (max_buf < sizeof(struct smb2_lock_element)) {
445 		free_xid(xid);
446 		return -EINVAL;
447 	}
448 
449 	BUILD_BUG_ON(sizeof(struct smb2_lock_element) > PAGE_SIZE);
450 	max_buf = min_t(unsigned int, max_buf, PAGE_SIZE);
451 	max_num = max_buf / sizeof(struct smb2_lock_element);
452 	buf = kzalloc_objs(struct smb2_lock_element, max_num);
453 	if (!buf) {
454 		free_xid(xid);
455 		return -ENOMEM;
456 	}
457 
458 	list_for_each_entry(fdlocks, &cinode->llist, llist) {
459 		stored_rc = smb2_push_mand_fdlocks(fdlocks, xid, buf, max_num);
460 		if (stored_rc)
461 			rc = stored_rc;
462 	}
463 
464 	kfree(buf);
465 	free_xid(xid);
466 	return rc;
467 }
468