1 // SPDX-License-Identifier: LGPL-2.1 2 /* 3 * 4 * Copyright (C) International Business Machines Corp., 2009, 2013 5 * Etersoft, 2012 6 * Author(s): Steve French (sfrench@us.ibm.com) 7 * Pavel Shilovsky (pshilovsky@samba.org) 2012 8 * 9 * Contains the routines for constructing the SMB2 PDUs themselves 10 * 11 */ 12 13 /* SMB2 PDU handling routines here - except for leftovers (eg session setup) */ 14 /* Note that there are handle based routines which must be */ 15 /* treated slightly differently for reconnection purposes since we never */ 16 /* want to reuse a stale file handle and only the caller knows the file info */ 17 18 #include <linux/fs.h> 19 #include <linux/kernel.h> 20 #include <linux/vfs.h> 21 #include <linux/task_io_accounting_ops.h> 22 #include <linux/uaccess.h> 23 #include <linux/uuid.h> 24 #include <linux/pagemap.h> 25 #include <linux/xattr.h> 26 #include <linux/netfs.h> 27 #include <trace/events/netfs.h> 28 #include "cifsglob.h" 29 #include "cifsacl.h" 30 #include "cifsproto.h" 31 #include "smb2proto.h" 32 #include "cifs_unicode.h" 33 #include "cifs_debug.h" 34 #include "ntlmssp.h" 35 #include "../common/smb2status.h" 36 #include "smb2glob.h" 37 #include "cifspdu.h" 38 #include "cifs_spnego.h" 39 #include "smbdirect.h" 40 #include "trace.h" 41 #ifdef CONFIG_CIFS_DFS_UPCALL 42 #include "dfs_cache.h" 43 #endif 44 #include "cached_dir.h" 45 #include "compress.h" 46 47 /* 48 * The following table defines the expected "StructureSize" of SMB2 requests 49 * in order by SMB2 command. This is similar to "wct" in SMB/CIFS requests. 50 * 51 * Note that commands are defined in smb2pdu.h in le16 but the array below is 52 * indexed by command in host byte order. 53 */ 54 static const int smb2_req_struct_sizes[NUMBER_OF_SMB2_COMMANDS] = { 55 /* SMB2_NEGOTIATE */ 36, 56 /* SMB2_SESSION_SETUP */ 25, 57 /* SMB2_LOGOFF */ 4, 58 /* SMB2_TREE_CONNECT */ 9, 59 /* SMB2_TREE_DISCONNECT */ 4, 60 /* SMB2_CREATE */ 57, 61 /* SMB2_CLOSE */ 24, 62 /* SMB2_FLUSH */ 24, 63 /* SMB2_READ */ 49, 64 /* SMB2_WRITE */ 49, 65 /* SMB2_LOCK */ 48, 66 /* SMB2_IOCTL */ 57, 67 /* SMB2_CANCEL */ 4, 68 /* SMB2_ECHO */ 4, 69 /* SMB2_QUERY_DIRECTORY */ 33, 70 /* SMB2_CHANGE_NOTIFY */ 32, 71 /* SMB2_QUERY_INFO */ 41, 72 /* SMB2_SET_INFO */ 33, 73 /* SMB2_OPLOCK_BREAK */ 24 /* BB this is 36 for LEASE_BREAK variant */ 74 }; 75 76 int smb3_encryption_required(const struct cifs_tcon *tcon) 77 { 78 if (!tcon || !tcon->ses) 79 return 0; 80 if ((tcon->ses->session_flags & SMB2_SESSION_FLAG_ENCRYPT_DATA) || 81 (tcon->share_flags & SHI1005_FLAGS_ENCRYPT_DATA)) 82 return 1; 83 if (tcon->seal && 84 (tcon->ses->server->capabilities & SMB2_GLOBAL_CAP_ENCRYPTION)) 85 return 1; 86 if (((global_secflags & CIFSSEC_MUST_SEAL) == CIFSSEC_MUST_SEAL) && 87 (tcon->ses->server->capabilities & SMB2_GLOBAL_CAP_ENCRYPTION)) 88 return 1; 89 return 0; 90 } 91 92 static void 93 smb2_hdr_assemble(struct smb2_hdr *shdr, __le16 smb2_cmd, 94 const struct cifs_tcon *tcon, 95 struct TCP_Server_Info *server) 96 { 97 struct smb3_hdr_req *smb3_hdr; 98 99 shdr->ProtocolId = SMB2_PROTO_NUMBER; 100 shdr->StructureSize = cpu_to_le16(64); 101 shdr->Command = smb2_cmd; 102 103 if (server) { 104 /* After reconnect SMB3 must set ChannelSequence on subsequent reqs */ 105 if (server->dialect >= SMB30_PROT_ID) { 106 smb3_hdr = (struct smb3_hdr_req *)shdr; 107 /* 108 * if primary channel is not set yet, use default 109 * channel for chan sequence num 110 */ 111 if (SERVER_IS_CHAN(server)) 112 smb3_hdr->ChannelSequence = 113 cpu_to_le16(server->primary_server->channel_sequence_num); 114 else 115 smb3_hdr->ChannelSequence = 116 cpu_to_le16(server->channel_sequence_num); 117 } 118 spin_lock(&server->req_lock); 119 /* Request up to 10 credits but don't go over the limit. */ 120 if (server->credits >= server->max_credits) 121 shdr->CreditRequest = cpu_to_le16(0); 122 else 123 shdr->CreditRequest = cpu_to_le16( 124 min_t(int, server->max_credits - 125 server->credits, 10)); 126 spin_unlock(&server->req_lock); 127 } else { 128 shdr->CreditRequest = cpu_to_le16(2); 129 } 130 shdr->Id.SyncId.ProcessId = cpu_to_le32((__u16)current->tgid); 131 132 if (!tcon) 133 goto out; 134 135 /* GLOBAL_CAP_LARGE_MTU will only be set if dialect > SMB2.02 */ 136 /* See sections 2.2.4 and 3.2.4.1.5 of MS-SMB2 */ 137 if (server && (server->capabilities & SMB2_GLOBAL_CAP_LARGE_MTU)) 138 shdr->CreditCharge = cpu_to_le16(1); 139 /* else CreditCharge MBZ */ 140 141 shdr->Id.SyncId.TreeId = cpu_to_le32(tcon->tid); 142 /* Uid is not converted */ 143 if (tcon->ses) 144 shdr->SessionId = cpu_to_le64(tcon->ses->Suid); 145 146 /* 147 * If we would set SMB2_FLAGS_DFS_OPERATIONS on open we also would have 148 * to pass the path on the Open SMB prefixed by \\server\share. 149 * Not sure when we would need to do the augmented path (if ever) and 150 * setting this flag breaks the SMB2 open operation since it is 151 * illegal to send an empty path name (without \\server\share prefix) 152 * when the DFS flag is set in the SMB open header. We could 153 * consider setting the flag on all operations other than open 154 * but it is safer to net set it for now. 155 */ 156 /* if (tcon->share_flags & SHI1005_FLAGS_DFS) 157 shdr->Flags |= SMB2_FLAGS_DFS_OPERATIONS; */ 158 159 if (server && server->sign && !smb3_encryption_required(tcon)) 160 shdr->Flags |= SMB2_FLAGS_SIGNED; 161 out: 162 return; 163 } 164 165 /* helper function for code reuse */ 166 static int 167 cifs_chan_skip_or_disable(struct cifs_ses *ses, 168 struct TCP_Server_Info *server, 169 bool from_reconnect) 170 { 171 struct TCP_Server_Info *pserver; 172 unsigned int chan_index; 173 174 if (SERVER_IS_CHAN(server)) { 175 cifs_dbg(VFS, 176 "server %s does not support multichannel anymore. Skip secondary channel\n", 177 ses->server->hostname); 178 179 spin_lock(&ses->chan_lock); 180 chan_index = cifs_ses_get_chan_index(ses, server); 181 if (chan_index == CIFS_INVAL_CHAN_INDEX) { 182 spin_unlock(&ses->chan_lock); 183 goto skip_terminate; 184 } 185 186 ses->chans[chan_index].server = NULL; 187 server->terminate = true; 188 spin_unlock(&ses->chan_lock); 189 190 /* 191 * the above reference of server by channel 192 * needs to be dropped without holding chan_lock 193 * as cifs_put_tcp_session takes a higher lock 194 * i.e. cifs_tcp_ses_lock 195 */ 196 cifs_put_tcp_session(server, from_reconnect); 197 198 cifs_signal_cifsd_for_reconnect(server, false); 199 200 /* mark primary server as needing reconnect */ 201 pserver = server->primary_server; 202 cifs_signal_cifsd_for_reconnect(pserver, false); 203 skip_terminate: 204 return -EHOSTDOWN; 205 } 206 207 cifs_server_dbg(VFS, 208 "server does not support multichannel anymore. Disable all other channels\n"); 209 cifs_disable_secondary_channels(ses); 210 211 212 return 0; 213 } 214 215 static int 216 smb2_reconnect(__le16 smb2_command, struct cifs_tcon *tcon, 217 struct TCP_Server_Info *server, bool from_reconnect) 218 { 219 int rc = 0; 220 struct nls_table *nls_codepage = NULL; 221 struct cifs_ses *ses; 222 int xid; 223 224 /* 225 * SMB2s NegProt, SessSetup, Logoff do not have tcon yet so 226 * check for tcp and smb session status done differently 227 * for those three - in the calling routine. 228 */ 229 if (tcon == NULL) 230 return 0; 231 232 /* 233 * Need to also skip SMB2_IOCTL because it is used for checking nested dfs links in 234 * cifs_tree_connect(). 235 */ 236 if (smb2_command == SMB2_TREE_CONNECT || smb2_command == SMB2_IOCTL) 237 return 0; 238 239 spin_lock(&tcon->tc_lock); 240 if (tcon->status == TID_EXITING) { 241 /* 242 * only tree disconnect allowed when disconnecting ... 243 */ 244 if (smb2_command != SMB2_TREE_DISCONNECT) { 245 spin_unlock(&tcon->tc_lock); 246 cifs_dbg(FYI, "can not send cmd %d while umounting\n", 247 smb2_command); 248 return -ENODEV; 249 } 250 } 251 spin_unlock(&tcon->tc_lock); 252 253 ses = tcon->ses; 254 if (!ses) 255 return -EIO; 256 spin_lock(&ses->ses_lock); 257 if (ses->ses_status == SES_EXITING) { 258 spin_unlock(&ses->ses_lock); 259 return -EIO; 260 } 261 spin_unlock(&ses->ses_lock); 262 if (!ses->server || !server) 263 return -EIO; 264 265 spin_lock(&server->srv_lock); 266 if (server->tcpStatus == CifsNeedReconnect) { 267 /* 268 * Return to caller for TREE_DISCONNECT and LOGOFF and CLOSE 269 * here since they are implicitly done when session drops. 270 */ 271 switch (smb2_command) { 272 /* 273 * BB Should we keep oplock break and add flush to exceptions? 274 */ 275 case SMB2_TREE_DISCONNECT: 276 case SMB2_CANCEL: 277 case SMB2_CLOSE: 278 case SMB2_OPLOCK_BREAK: 279 spin_unlock(&server->srv_lock); 280 return -EAGAIN; 281 } 282 } 283 284 /* if server is marked for termination, cifsd will cleanup */ 285 if (server->terminate) { 286 spin_unlock(&server->srv_lock); 287 return -EHOSTDOWN; 288 } 289 spin_unlock(&server->srv_lock); 290 291 again: 292 rc = cifs_wait_for_server_reconnect(server, tcon->retry); 293 if (rc) 294 return rc; 295 296 spin_lock(&ses->chan_lock); 297 if (!cifs_chan_needs_reconnect(ses, server) && !tcon->need_reconnect) { 298 spin_unlock(&ses->chan_lock); 299 return 0; 300 } 301 spin_unlock(&ses->chan_lock); 302 cifs_dbg(FYI, "sess reconnect mask: 0x%lx, tcon reconnect: %d", 303 tcon->ses->chans_need_reconnect, 304 tcon->need_reconnect); 305 306 mutex_lock(&ses->session_mutex); 307 /* 308 * if this is called by delayed work, and the channel has been disabled 309 * in parallel, the delayed work can continue to execute in parallel 310 * there's a chance that this channel may not exist anymore 311 */ 312 spin_lock(&server->srv_lock); 313 if (server->tcpStatus == CifsExiting) { 314 spin_unlock(&server->srv_lock); 315 mutex_unlock(&ses->session_mutex); 316 rc = -EHOSTDOWN; 317 goto out; 318 } 319 320 /* 321 * Recheck after acquire mutex. If another thread is negotiating 322 * and the server never sends an answer the socket will be closed 323 * and tcpStatus set to reconnect. 324 */ 325 if (server->tcpStatus == CifsNeedReconnect) { 326 spin_unlock(&server->srv_lock); 327 mutex_unlock(&ses->session_mutex); 328 329 if (tcon->retry) 330 goto again; 331 332 rc = -EHOSTDOWN; 333 goto out; 334 } 335 spin_unlock(&server->srv_lock); 336 337 nls_codepage = ses->local_nls; 338 339 /* 340 * need to prevent multiple threads trying to simultaneously 341 * reconnect the same SMB session 342 */ 343 spin_lock(&ses->ses_lock); 344 spin_lock(&ses->chan_lock); 345 if (!cifs_chan_needs_reconnect(ses, server) && 346 ses->ses_status == SES_GOOD) { 347 spin_unlock(&ses->chan_lock); 348 spin_unlock(&ses->ses_lock); 349 /* this means that we only need to tree connect */ 350 if (tcon->need_reconnect) 351 goto skip_sess_setup; 352 353 mutex_unlock(&ses->session_mutex); 354 goto out; 355 } 356 spin_unlock(&ses->chan_lock); 357 spin_unlock(&ses->ses_lock); 358 359 rc = cifs_negotiate_protocol(0, ses, server); 360 if (!rc) { 361 /* 362 * if server stopped supporting multichannel 363 * and the first channel reconnected, disable all the others. 364 */ 365 if (ses->chan_count > 1 && 366 !(server->capabilities & SMB2_GLOBAL_CAP_MULTI_CHANNEL)) { 367 rc = cifs_chan_skip_or_disable(ses, server, 368 from_reconnect); 369 if (rc) { 370 mutex_unlock(&ses->session_mutex); 371 goto out; 372 } 373 } 374 375 rc = cifs_setup_session(0, ses, server, nls_codepage); 376 if ((rc == -EACCES) || (rc == -EKEYEXPIRED) || (rc == -EKEYREVOKED)) { 377 /* 378 * Try alternate password for next reconnect (key rotation 379 * could be enabled on the server e.g.) if an alternate 380 * password is available and the current password is expired, 381 * but do not swap on non pwd related errors like host down 382 */ 383 if (ses->password2) 384 swap(ses->password2, ses->password); 385 } 386 387 if ((rc == -EACCES) && !tcon->retry) { 388 mutex_unlock(&ses->session_mutex); 389 rc = -EHOSTDOWN; 390 goto failed; 391 } else if (rc) { 392 mutex_unlock(&ses->session_mutex); 393 goto out; 394 } 395 } else { 396 mutex_unlock(&ses->session_mutex); 397 goto out; 398 } 399 400 skip_sess_setup: 401 if (!tcon->need_reconnect) { 402 mutex_unlock(&ses->session_mutex); 403 goto out; 404 } 405 cifs_mark_open_files_invalid(tcon); 406 if (tcon->use_persistent) 407 tcon->need_reopen_files = true; 408 409 rc = cifs_tree_connect(0, tcon, nls_codepage); 410 411 cifs_dbg(FYI, "reconnect tcon rc = %d\n", rc); 412 if (rc) { 413 /* If sess reconnected but tcon didn't, something strange ... */ 414 mutex_unlock(&ses->session_mutex); 415 cifs_dbg(VFS, "reconnect tcon failed rc = %d\n", rc); 416 goto out; 417 } 418 419 spin_lock(&ses->ses_lock); 420 if (ses->flags & CIFS_SES_FLAG_SCALE_CHANNELS) { 421 spin_unlock(&ses->ses_lock); 422 mutex_unlock(&ses->session_mutex); 423 goto skip_add_channels; 424 } 425 ses->flags |= CIFS_SES_FLAG_SCALE_CHANNELS; 426 spin_unlock(&ses->ses_lock); 427 428 if (!rc && 429 (server->capabilities & SMB2_GLOBAL_CAP_MULTI_CHANNEL) && 430 server->ops->query_server_interfaces) { 431 mutex_unlock(&ses->session_mutex); 432 433 /* 434 * query server network interfaces, in case they change 435 */ 436 xid = get_xid(); 437 rc = server->ops->query_server_interfaces(xid, tcon, false); 438 free_xid(xid); 439 440 if (rc == -EOPNOTSUPP && ses->chan_count > 1) { 441 /* 442 * some servers like Azure SMB server do not advertise 443 * that multichannel has been disabled with server 444 * capabilities, rather return STATUS_NOT_IMPLEMENTED. 445 * treat this as server not supporting multichannel 446 */ 447 448 rc = cifs_chan_skip_or_disable(ses, server, 449 from_reconnect); 450 goto skip_add_channels; 451 } else if (rc) 452 cifs_dbg(FYI, "%s: failed to query server interfaces: %d\n", 453 __func__, rc); 454 455 if (ses->chan_max > ses->chan_count && 456 ses->iface_count && 457 !SERVER_IS_CHAN(server)) { 458 if (ses->chan_count == 1) { 459 cifs_server_dbg(VFS, "supports multichannel now\n"); 460 queue_delayed_work(cifsiod_wq, &tcon->query_interfaces, 461 (SMB_INTERFACE_POLL_INTERVAL * HZ)); 462 } 463 464 cifs_try_adding_channels(ses); 465 } 466 } else { 467 mutex_unlock(&ses->session_mutex); 468 } 469 470 skip_add_channels: 471 spin_lock(&ses->ses_lock); 472 ses->flags &= ~CIFS_SES_FLAG_SCALE_CHANNELS; 473 spin_unlock(&ses->ses_lock); 474 475 if (smb2_command != SMB2_INTERNAL_CMD) 476 mod_delayed_work(cifsiod_wq, &server->reconnect, 0); 477 478 atomic_inc(&tconInfoReconnectCount); 479 out: 480 /* 481 * Check if handle based operation so we know whether we can continue 482 * or not without returning to caller to reset file handle. 483 */ 484 /* 485 * BB Is flush done by server on drop of tcp session? Should we special 486 * case it and skip above? 487 */ 488 switch (smb2_command) { 489 case SMB2_FLUSH: 490 case SMB2_READ: 491 case SMB2_WRITE: 492 case SMB2_LOCK: 493 case SMB2_QUERY_DIRECTORY: 494 case SMB2_CHANGE_NOTIFY: 495 case SMB2_QUERY_INFO: 496 case SMB2_SET_INFO: 497 rc = -EAGAIN; 498 } 499 failed: 500 return rc; 501 } 502 503 static void 504 fill_small_buf(__le16 smb2_command, struct cifs_tcon *tcon, 505 struct TCP_Server_Info *server, 506 void *buf, 507 unsigned int *total_len) 508 { 509 struct smb2_pdu *spdu = buf; 510 /* lookup word count ie StructureSize from table */ 511 __u16 parmsize = smb2_req_struct_sizes[le16_to_cpu(smb2_command)]; 512 513 /* 514 * smaller than SMALL_BUFFER_SIZE but bigger than fixed area of 515 * largest operations (Create) 516 */ 517 memset(buf, 0, 256); 518 519 smb2_hdr_assemble(&spdu->hdr, smb2_command, tcon, server); 520 spdu->StructureSize2 = cpu_to_le16(parmsize); 521 522 *total_len = parmsize + sizeof(struct smb2_hdr); 523 } 524 525 /* 526 * Allocate and return pointer to an SMB request hdr, and set basic 527 * SMB information in the SMB header. If the return code is zero, this 528 * function must have filled in request_buf pointer. 529 */ 530 static int __smb2_plain_req_init(__le16 smb2_command, struct cifs_tcon *tcon, 531 struct TCP_Server_Info *server, 532 void **request_buf, unsigned int *total_len) 533 { 534 /* BB eventually switch this to SMB2 specific small buf size */ 535 switch (smb2_command) { 536 case SMB2_SET_INFO: 537 case SMB2_QUERY_INFO: 538 *request_buf = cifs_buf_get(); 539 break; 540 default: 541 *request_buf = cifs_small_buf_get(); 542 break; 543 } 544 if (*request_buf == NULL) { 545 /* BB should we add a retry in here if not a writepage? */ 546 return -ENOMEM; 547 } 548 549 fill_small_buf(smb2_command, tcon, server, 550 (struct smb2_hdr *)(*request_buf), 551 total_len); 552 553 if (tcon != NULL) { 554 uint16_t com_code = le16_to_cpu(smb2_command); 555 cifs_stats_inc(&tcon->stats.smb2_stats.smb2_com_sent[com_code]); 556 cifs_stats_inc(&tcon->num_smbs_sent); 557 } 558 559 return 0; 560 } 561 562 static int smb2_plain_req_init(__le16 smb2_command, struct cifs_tcon *tcon, 563 struct TCP_Server_Info *server, 564 void **request_buf, unsigned int *total_len) 565 { 566 int rc; 567 568 rc = smb2_reconnect(smb2_command, tcon, server, false); 569 if (rc) 570 return rc; 571 572 return __smb2_plain_req_init(smb2_command, tcon, server, request_buf, 573 total_len); 574 } 575 576 static int smb2_ioctl_req_init(u32 opcode, struct cifs_tcon *tcon, 577 struct TCP_Server_Info *server, 578 void **request_buf, unsigned int *total_len) 579 { 580 /* Skip reconnect only for FSCTL_VALIDATE_NEGOTIATE_INFO IOCTLs */ 581 if (opcode == FSCTL_VALIDATE_NEGOTIATE_INFO) { 582 return __smb2_plain_req_init(SMB2_IOCTL, tcon, server, 583 request_buf, total_len); 584 } 585 return smb2_plain_req_init(SMB2_IOCTL, tcon, server, 586 request_buf, total_len); 587 } 588 589 /* For explanation of negotiate contexts see MS-SMB2 section 2.2.3.1 */ 590 591 static void 592 build_preauth_ctxt(struct smb2_preauth_neg_context *pneg_ctxt) 593 { 594 pneg_ctxt->ContextType = SMB2_PREAUTH_INTEGRITY_CAPABILITIES; 595 pneg_ctxt->DataLength = cpu_to_le16(38); 596 pneg_ctxt->HashAlgorithmCount = cpu_to_le16(1); 597 pneg_ctxt->SaltLength = cpu_to_le16(SMB311_SALT_SIZE); 598 get_random_bytes(pneg_ctxt->Salt, SMB311_SALT_SIZE); 599 pneg_ctxt->HashAlgorithms = SMB2_PREAUTH_INTEGRITY_SHA512; 600 } 601 602 static void 603 build_compression_ctxt(struct smb2_compression_capabilities_context *pneg_ctxt) 604 { 605 pneg_ctxt->ContextType = SMB2_COMPRESSION_CAPABILITIES; 606 pneg_ctxt->DataLength = 607 cpu_to_le16(sizeof(struct smb2_compression_capabilities_context) 608 - sizeof(struct smb2_neg_context)); 609 pneg_ctxt->CompressionAlgorithmCount = cpu_to_le16(3); 610 pneg_ctxt->CompressionAlgorithms[0] = SMB3_COMPRESS_LZ77; 611 pneg_ctxt->CompressionAlgorithms[1] = SMB3_COMPRESS_LZ77_HUFF; 612 pneg_ctxt->CompressionAlgorithms[2] = SMB3_COMPRESS_LZNT1; 613 } 614 615 static unsigned int 616 build_signing_ctxt(struct smb2_signing_capabilities *pneg_ctxt) 617 { 618 unsigned int ctxt_len = sizeof(struct smb2_signing_capabilities); 619 unsigned short num_algs = 1; /* number of signing algorithms sent */ 620 621 pneg_ctxt->ContextType = SMB2_SIGNING_CAPABILITIES; 622 /* 623 * Context Data length must be rounded to multiple of 8 for some servers 624 */ 625 pneg_ctxt->DataLength = cpu_to_le16(ALIGN(sizeof(struct smb2_signing_capabilities) - 626 sizeof(struct smb2_neg_context) + 627 (num_algs * sizeof(u16)), 8)); 628 pneg_ctxt->SigningAlgorithmCount = cpu_to_le16(num_algs); 629 pneg_ctxt->SigningAlgorithms[0] = cpu_to_le16(SIGNING_ALG_AES_CMAC); 630 631 ctxt_len += sizeof(__le16) * num_algs; 632 ctxt_len = ALIGN(ctxt_len, 8); 633 return ctxt_len; 634 /* TBD add SIGNING_ALG_AES_GMAC and/or SIGNING_ALG_HMAC_SHA256 */ 635 } 636 637 static void 638 build_encrypt_ctxt(struct smb2_encryption_neg_context *pneg_ctxt) 639 { 640 pneg_ctxt->ContextType = SMB2_ENCRYPTION_CAPABILITIES; 641 if (require_gcm_256) { 642 pneg_ctxt->DataLength = cpu_to_le16(4); /* Cipher Count + 1 cipher */ 643 pneg_ctxt->CipherCount = cpu_to_le16(1); 644 pneg_ctxt->Ciphers[0] = SMB2_ENCRYPTION_AES256_GCM; 645 } else if (enable_gcm_256) { 646 pneg_ctxt->DataLength = cpu_to_le16(8); /* Cipher Count + 3 ciphers */ 647 pneg_ctxt->CipherCount = cpu_to_le16(3); 648 pneg_ctxt->Ciphers[0] = SMB2_ENCRYPTION_AES128_GCM; 649 pneg_ctxt->Ciphers[1] = SMB2_ENCRYPTION_AES256_GCM; 650 pneg_ctxt->Ciphers[2] = SMB2_ENCRYPTION_AES128_CCM; 651 } else { 652 pneg_ctxt->DataLength = cpu_to_le16(6); /* Cipher Count + 2 ciphers */ 653 pneg_ctxt->CipherCount = cpu_to_le16(2); 654 pneg_ctxt->Ciphers[0] = SMB2_ENCRYPTION_AES128_GCM; 655 pneg_ctxt->Ciphers[1] = SMB2_ENCRYPTION_AES128_CCM; 656 } 657 } 658 659 static unsigned int 660 build_netname_ctxt(struct smb2_netname_neg_context *pneg_ctxt, char *hostname) 661 { 662 struct nls_table *cp = load_nls_default(); 663 664 pneg_ctxt->ContextType = SMB2_NETNAME_NEGOTIATE_CONTEXT_ID; 665 666 /* copy up to max of first 100 bytes of server name to NetName field */ 667 pneg_ctxt->DataLength = cpu_to_le16(2 * cifs_strtoUTF16(pneg_ctxt->NetName, hostname, 100, cp)); 668 /* context size is DataLength + minimal smb2_neg_context */ 669 return ALIGN(le16_to_cpu(pneg_ctxt->DataLength) + sizeof(struct smb2_neg_context), 8); 670 } 671 672 static void 673 build_posix_ctxt(struct smb2_posix_neg_context *pneg_ctxt) 674 { 675 pneg_ctxt->ContextType = SMB2_POSIX_EXTENSIONS_AVAILABLE; 676 pneg_ctxt->DataLength = cpu_to_le16(POSIX_CTXT_DATA_LEN); 677 /* SMB2_CREATE_TAG_POSIX is "0x93AD25509CB411E7B42383DE968BCD7C" */ 678 pneg_ctxt->Name[0] = 0x93; 679 pneg_ctxt->Name[1] = 0xAD; 680 pneg_ctxt->Name[2] = 0x25; 681 pneg_ctxt->Name[3] = 0x50; 682 pneg_ctxt->Name[4] = 0x9C; 683 pneg_ctxt->Name[5] = 0xB4; 684 pneg_ctxt->Name[6] = 0x11; 685 pneg_ctxt->Name[7] = 0xE7; 686 pneg_ctxt->Name[8] = 0xB4; 687 pneg_ctxt->Name[9] = 0x23; 688 pneg_ctxt->Name[10] = 0x83; 689 pneg_ctxt->Name[11] = 0xDE; 690 pneg_ctxt->Name[12] = 0x96; 691 pneg_ctxt->Name[13] = 0x8B; 692 pneg_ctxt->Name[14] = 0xCD; 693 pneg_ctxt->Name[15] = 0x7C; 694 } 695 696 static void 697 assemble_neg_contexts(struct smb2_negotiate_req *req, 698 struct TCP_Server_Info *server, unsigned int *total_len) 699 { 700 unsigned int ctxt_len, neg_context_count; 701 struct TCP_Server_Info *pserver; 702 char *pneg_ctxt; 703 char *hostname; 704 705 if (*total_len > 200) { 706 /* In case length corrupted don't want to overrun smb buffer */ 707 cifs_server_dbg(VFS, "Bad frame length assembling neg contexts\n"); 708 return; 709 } 710 711 /* 712 * round up total_len of fixed part of SMB3 negotiate request to 8 713 * byte boundary before adding negotiate contexts 714 */ 715 *total_len = ALIGN(*total_len, 8); 716 717 pneg_ctxt = (*total_len) + (char *)req; 718 req->NegotiateContextOffset = cpu_to_le32(*total_len); 719 720 build_preauth_ctxt((struct smb2_preauth_neg_context *)pneg_ctxt); 721 ctxt_len = ALIGN(sizeof(struct smb2_preauth_neg_context), 8); 722 *total_len += ctxt_len; 723 pneg_ctxt += ctxt_len; 724 725 build_encrypt_ctxt((struct smb2_encryption_neg_context *)pneg_ctxt); 726 ctxt_len = ALIGN(sizeof(struct smb2_encryption_neg_context), 8); 727 *total_len += ctxt_len; 728 pneg_ctxt += ctxt_len; 729 730 /* 731 * secondary channels don't have the hostname field populated 732 * use the hostname field in the primary channel instead 733 */ 734 pserver = SERVER_IS_CHAN(server) ? server->primary_server : server; 735 cifs_server_lock(pserver); 736 hostname = pserver->hostname; 737 if (hostname && (hostname[0] != 0)) { 738 ctxt_len = build_netname_ctxt((struct smb2_netname_neg_context *)pneg_ctxt, 739 hostname); 740 *total_len += ctxt_len; 741 pneg_ctxt += ctxt_len; 742 neg_context_count = 3; 743 } else 744 neg_context_count = 2; 745 cifs_server_unlock(pserver); 746 747 build_posix_ctxt((struct smb2_posix_neg_context *)pneg_ctxt); 748 *total_len += sizeof(struct smb2_posix_neg_context); 749 pneg_ctxt += sizeof(struct smb2_posix_neg_context); 750 neg_context_count++; 751 752 if (server->compression.requested) { 753 build_compression_ctxt((struct smb2_compression_capabilities_context *) 754 pneg_ctxt); 755 ctxt_len = ALIGN(sizeof(struct smb2_compression_capabilities_context), 8); 756 *total_len += ctxt_len; 757 pneg_ctxt += ctxt_len; 758 neg_context_count++; 759 } 760 761 if (enable_negotiate_signing) { 762 ctxt_len = build_signing_ctxt((struct smb2_signing_capabilities *) 763 pneg_ctxt); 764 *total_len += ctxt_len; 765 pneg_ctxt += ctxt_len; 766 neg_context_count++; 767 } 768 769 /* check for and add transport_capabilities and signing capabilities */ 770 req->NegotiateContextCount = cpu_to_le16(neg_context_count); 771 772 } 773 774 /* If invalid preauth context warn but use what we requested, SHA-512 */ 775 static void decode_preauth_context(struct smb2_preauth_neg_context *ctxt) 776 { 777 unsigned int len = le16_to_cpu(ctxt->DataLength); 778 779 /* 780 * Caller checked that DataLength remains within SMB boundary. We still 781 * need to confirm that one HashAlgorithms member is accounted for. 782 */ 783 if (len < MIN_PREAUTH_CTXT_DATA_LEN) { 784 pr_warn_once("server sent bad preauth context\n"); 785 return; 786 } else if (len < MIN_PREAUTH_CTXT_DATA_LEN + le16_to_cpu(ctxt->SaltLength)) { 787 pr_warn_once("server sent invalid SaltLength\n"); 788 return; 789 } 790 if (le16_to_cpu(ctxt->HashAlgorithmCount) != 1) 791 pr_warn_once("Invalid SMB3 hash algorithm count\n"); 792 if (ctxt->HashAlgorithms != SMB2_PREAUTH_INTEGRITY_SHA512) 793 pr_warn_once("unknown SMB3 hash algorithm\n"); 794 } 795 796 static void decode_compress_ctx(struct TCP_Server_Info *server, 797 struct smb2_compression_capabilities_context *ctxt) 798 { 799 unsigned int len = le16_to_cpu(ctxt->DataLength); 800 __le16 alg; 801 802 server->compression.enabled = false; 803 804 /* 805 * Caller checked that DataLength remains within SMB boundary. We still 806 * need to confirm that one CompressionAlgorithms member is accounted 807 * for. 808 */ 809 if (len < 10) { 810 pr_warn_once("server sent bad compression cntxt\n"); 811 return; 812 } 813 814 if (le16_to_cpu(ctxt->CompressionAlgorithmCount) != 1) { 815 pr_warn_once("invalid SMB3 compress algorithm count\n"); 816 return; 817 } 818 819 alg = ctxt->CompressionAlgorithms[0]; 820 821 /* 'NONE' (0) compressor type is never negotiated */ 822 if (alg == 0 || le16_to_cpu(alg) > 3) { 823 pr_warn_once("invalid compression algorithm '%u'\n", alg); 824 return; 825 } 826 827 server->compression.alg = alg; 828 server->compression.enabled = true; 829 } 830 831 static int decode_encrypt_ctx(struct TCP_Server_Info *server, 832 struct smb2_encryption_neg_context *ctxt) 833 { 834 unsigned int len = le16_to_cpu(ctxt->DataLength); 835 836 cifs_dbg(FYI, "decode SMB3.11 encryption neg context of len %d\n", len); 837 /* 838 * Caller checked that DataLength remains within SMB boundary. We still 839 * need to confirm that one Cipher flexible array member is accounted 840 * for. 841 */ 842 if (len < MIN_ENCRYPT_CTXT_DATA_LEN) { 843 pr_warn_once("server sent bad crypto ctxt len\n"); 844 return -EINVAL; 845 } 846 847 if (le16_to_cpu(ctxt->CipherCount) != 1) { 848 pr_warn_once("Invalid SMB3.11 cipher count\n"); 849 return -EINVAL; 850 } 851 cifs_dbg(FYI, "SMB311 cipher type:%d\n", le16_to_cpu(ctxt->Ciphers[0])); 852 if (require_gcm_256) { 853 if (ctxt->Ciphers[0] != SMB2_ENCRYPTION_AES256_GCM) { 854 cifs_dbg(VFS, "Server does not support requested encryption type (AES256 GCM)\n"); 855 return -EOPNOTSUPP; 856 } 857 } else if (ctxt->Ciphers[0] == 0) { 858 /* 859 * e.g. if server only supported AES256_CCM (very unlikely) 860 * or server supported no encryption types or had all disabled. 861 * Since GLOBAL_CAP_ENCRYPTION will be not set, in the case 862 * in which mount requested encryption ("seal") checks later 863 * on during tree connection will return proper rc, but if 864 * seal not requested by client, since server is allowed to 865 * return 0 to indicate no supported cipher, we can't fail here 866 */ 867 server->cipher_type = 0; 868 server->capabilities &= ~SMB2_GLOBAL_CAP_ENCRYPTION; 869 pr_warn_once("Server does not support requested encryption types\n"); 870 return 0; 871 } else if ((ctxt->Ciphers[0] != SMB2_ENCRYPTION_AES128_CCM) && 872 (ctxt->Ciphers[0] != SMB2_ENCRYPTION_AES128_GCM) && 873 (ctxt->Ciphers[0] != SMB2_ENCRYPTION_AES256_GCM)) { 874 /* server returned a cipher we didn't ask for */ 875 pr_warn_once("Invalid SMB3.11 cipher returned\n"); 876 return -EINVAL; 877 } 878 server->cipher_type = ctxt->Ciphers[0]; 879 server->capabilities |= SMB2_GLOBAL_CAP_ENCRYPTION; 880 return 0; 881 } 882 883 static void decode_signing_ctx(struct TCP_Server_Info *server, 884 struct smb2_signing_capabilities *pctxt) 885 { 886 unsigned int len = le16_to_cpu(pctxt->DataLength); 887 888 /* 889 * Caller checked that DataLength remains within SMB boundary. We still 890 * need to confirm that one SigningAlgorithms flexible array member is 891 * accounted for. 892 */ 893 if ((len < 4) || (len > 16)) { 894 pr_warn_once("server sent bad signing negcontext\n"); 895 return; 896 } 897 if (le16_to_cpu(pctxt->SigningAlgorithmCount) != 1) { 898 pr_warn_once("Invalid signing algorithm count\n"); 899 return; 900 } 901 if (le16_to_cpu(pctxt->SigningAlgorithms[0]) > 2) { 902 pr_warn_once("unknown signing algorithm\n"); 903 return; 904 } 905 906 server->signing_negotiated = true; 907 server->signing_algorithm = le16_to_cpu(pctxt->SigningAlgorithms[0]); 908 cifs_dbg(FYI, "signing algorithm %d chosen\n", 909 server->signing_algorithm); 910 } 911 912 913 static int smb311_decode_neg_context(struct smb2_negotiate_rsp *rsp, 914 struct TCP_Server_Info *server, 915 unsigned int len_of_smb) 916 { 917 struct smb2_neg_context *pctx; 918 unsigned int offset = le32_to_cpu(rsp->NegotiateContextOffset); 919 unsigned int ctxt_cnt = le16_to_cpu(rsp->NegotiateContextCount); 920 unsigned int len_of_ctxts, i; 921 int rc = 0; 922 923 cifs_dbg(FYI, "decoding %d negotiate contexts\n", ctxt_cnt); 924 if (len_of_smb <= offset) { 925 cifs_server_dbg(VFS, "Invalid response: negotiate context offset\n"); 926 return -EINVAL; 927 } 928 929 len_of_ctxts = len_of_smb - offset; 930 931 for (i = 0; i < ctxt_cnt; i++) { 932 int clen; 933 /* check that offset is not beyond end of SMB */ 934 if (len_of_ctxts < sizeof(struct smb2_neg_context)) 935 break; 936 937 pctx = (struct smb2_neg_context *)(offset + (char *)rsp); 938 clen = sizeof(struct smb2_neg_context) 939 + le16_to_cpu(pctx->DataLength); 940 /* 941 * 2.2.4 SMB2 NEGOTIATE Response 942 * Subsequent negotiate contexts MUST appear at the first 8-byte 943 * aligned offset following the previous negotiate context. 944 */ 945 if (i + 1 != ctxt_cnt) 946 clen = ALIGN(clen, 8); 947 if (clen > len_of_ctxts) 948 break; 949 950 if (pctx->ContextType == SMB2_PREAUTH_INTEGRITY_CAPABILITIES) 951 decode_preauth_context( 952 (struct smb2_preauth_neg_context *)pctx); 953 else if (pctx->ContextType == SMB2_ENCRYPTION_CAPABILITIES) 954 rc = decode_encrypt_ctx(server, 955 (struct smb2_encryption_neg_context *)pctx); 956 else if (pctx->ContextType == SMB2_COMPRESSION_CAPABILITIES) 957 decode_compress_ctx(server, 958 (struct smb2_compression_capabilities_context *)pctx); 959 else if (pctx->ContextType == SMB2_POSIX_EXTENSIONS_AVAILABLE) 960 server->posix_ext_supported = true; 961 else if (pctx->ContextType == SMB2_SIGNING_CAPABILITIES) 962 decode_signing_ctx(server, 963 (struct smb2_signing_capabilities *)pctx); 964 else 965 cifs_server_dbg(VFS, "unknown negcontext of type %d ignored\n", 966 le16_to_cpu(pctx->ContextType)); 967 if (rc) 968 break; 969 970 offset += clen; 971 len_of_ctxts -= clen; 972 } 973 return rc; 974 } 975 976 static struct create_posix * 977 create_posix_buf(umode_t mode) 978 { 979 struct create_posix *buf; 980 981 buf = kzalloc(sizeof(struct create_posix), 982 GFP_KERNEL); 983 if (!buf) 984 return NULL; 985 986 buf->ccontext.DataOffset = 987 cpu_to_le16(offsetof(struct create_posix, Mode)); 988 buf->ccontext.DataLength = cpu_to_le32(4); 989 buf->ccontext.NameOffset = 990 cpu_to_le16(offsetof(struct create_posix, Name)); 991 buf->ccontext.NameLength = cpu_to_le16(16); 992 993 /* SMB2_CREATE_TAG_POSIX is "0x93AD25509CB411E7B42383DE968BCD7C" */ 994 buf->Name[0] = 0x93; 995 buf->Name[1] = 0xAD; 996 buf->Name[2] = 0x25; 997 buf->Name[3] = 0x50; 998 buf->Name[4] = 0x9C; 999 buf->Name[5] = 0xB4; 1000 buf->Name[6] = 0x11; 1001 buf->Name[7] = 0xE7; 1002 buf->Name[8] = 0xB4; 1003 buf->Name[9] = 0x23; 1004 buf->Name[10] = 0x83; 1005 buf->Name[11] = 0xDE; 1006 buf->Name[12] = 0x96; 1007 buf->Name[13] = 0x8B; 1008 buf->Name[14] = 0xCD; 1009 buf->Name[15] = 0x7C; 1010 buf->Mode = cpu_to_le32(mode); 1011 cifs_dbg(FYI, "mode on posix create 0%o\n", mode); 1012 return buf; 1013 } 1014 1015 static int 1016 add_posix_context(struct kvec *iov, unsigned int *num_iovec, umode_t mode) 1017 { 1018 unsigned int num = *num_iovec; 1019 1020 iov[num].iov_base = create_posix_buf(mode); 1021 if (mode == ACL_NO_MODE) 1022 cifs_dbg(FYI, "%s: no mode\n", __func__); 1023 if (iov[num].iov_base == NULL) 1024 return -ENOMEM; 1025 iov[num].iov_len = sizeof(struct create_posix); 1026 *num_iovec = num + 1; 1027 return 0; 1028 } 1029 1030 1031 /* 1032 * 1033 * SMB2 Worker functions follow: 1034 * 1035 * The general structure of the worker functions is: 1036 * 1) Call smb2_init (assembles SMB2 header) 1037 * 2) Initialize SMB2 command specific fields in fixed length area of SMB 1038 * 3) Call smb_sendrcv2 (sends request on socket and waits for response) 1039 * 4) Decode SMB2 command specific fields in the fixed length area 1040 * 5) Decode variable length data area (if any for this SMB2 command type) 1041 * 6) Call free smb buffer 1042 * 7) return 1043 * 1044 */ 1045 1046 int 1047 SMB2_negotiate(const unsigned int xid, 1048 struct cifs_ses *ses, 1049 struct TCP_Server_Info *server) 1050 { 1051 struct smb_rqst rqst; 1052 struct smb2_negotiate_req *req; 1053 struct smb2_negotiate_rsp *rsp; 1054 struct kvec iov[1]; 1055 struct kvec rsp_iov; 1056 int rc; 1057 int resp_buftype; 1058 int blob_offset, blob_length; 1059 char *security_blob; 1060 int flags = CIFS_NEG_OP; 1061 unsigned int total_len; 1062 1063 cifs_dbg(FYI, "Negotiate protocol\n"); 1064 1065 if (!server) { 1066 WARN(1, "%s: server is NULL!\n", __func__); 1067 return -EIO; 1068 } 1069 1070 rc = smb2_plain_req_init(SMB2_NEGOTIATE, NULL, server, 1071 (void **) &req, &total_len); 1072 if (rc) 1073 return rc; 1074 1075 req->hdr.SessionId = 0; 1076 1077 memset(server->preauth_sha_hash, 0, SMB2_PREAUTH_HASH_SIZE); 1078 memset(ses->preauth_sha_hash, 0, SMB2_PREAUTH_HASH_SIZE); 1079 1080 if (strcmp(server->vals->version_string, 1081 SMB3ANY_VERSION_STRING) == 0) { 1082 req->Dialects[0] = cpu_to_le16(SMB30_PROT_ID); 1083 req->Dialects[1] = cpu_to_le16(SMB302_PROT_ID); 1084 req->Dialects[2] = cpu_to_le16(SMB311_PROT_ID); 1085 req->DialectCount = cpu_to_le16(3); 1086 total_len += 6; 1087 } else if (strcmp(server->vals->version_string, 1088 SMBDEFAULT_VERSION_STRING) == 0) { 1089 req->Dialects[0] = cpu_to_le16(SMB21_PROT_ID); 1090 req->Dialects[1] = cpu_to_le16(SMB30_PROT_ID); 1091 req->Dialects[2] = cpu_to_le16(SMB302_PROT_ID); 1092 req->Dialects[3] = cpu_to_le16(SMB311_PROT_ID); 1093 req->DialectCount = cpu_to_le16(4); 1094 total_len += 8; 1095 } else { 1096 /* otherwise send specific dialect */ 1097 req->Dialects[0] = cpu_to_le16(server->vals->protocol_id); 1098 req->DialectCount = cpu_to_le16(1); 1099 total_len += 2; 1100 } 1101 1102 /* only one of SMB2 signing flags may be set in SMB2 request */ 1103 if (ses->sign) 1104 req->SecurityMode = cpu_to_le16(SMB2_NEGOTIATE_SIGNING_REQUIRED); 1105 else if (global_secflags & CIFSSEC_MAY_SIGN) 1106 req->SecurityMode = cpu_to_le16(SMB2_NEGOTIATE_SIGNING_ENABLED); 1107 else 1108 req->SecurityMode = 0; 1109 1110 req->Capabilities = cpu_to_le32(server->vals->req_capabilities); 1111 if (ses->chan_max > 1) 1112 req->Capabilities |= cpu_to_le32(SMB2_GLOBAL_CAP_MULTI_CHANNEL); 1113 1114 /* ClientGUID must be zero for SMB2.02 dialect */ 1115 if (server->vals->protocol_id == SMB20_PROT_ID) 1116 memset(req->ClientGUID, 0, SMB2_CLIENT_GUID_SIZE); 1117 else { 1118 memcpy(req->ClientGUID, server->client_guid, 1119 SMB2_CLIENT_GUID_SIZE); 1120 if ((server->vals->protocol_id == SMB311_PROT_ID) || 1121 (strcmp(server->vals->version_string, 1122 SMB3ANY_VERSION_STRING) == 0) || 1123 (strcmp(server->vals->version_string, 1124 SMBDEFAULT_VERSION_STRING) == 0)) 1125 assemble_neg_contexts(req, server, &total_len); 1126 } 1127 iov[0].iov_base = (char *)req; 1128 iov[0].iov_len = total_len; 1129 1130 memset(&rqst, 0, sizeof(struct smb_rqst)); 1131 rqst.rq_iov = iov; 1132 rqst.rq_nvec = 1; 1133 1134 rc = cifs_send_recv(xid, ses, server, 1135 &rqst, &resp_buftype, flags, &rsp_iov); 1136 cifs_small_buf_release(req); 1137 rsp = (struct smb2_negotiate_rsp *)rsp_iov.iov_base; 1138 /* 1139 * No tcon so can't do 1140 * cifs_stats_inc(&tcon->stats.smb2_stats.smb2_com_fail[SMB2...]); 1141 */ 1142 if (rc == -EOPNOTSUPP) { 1143 cifs_server_dbg(VFS, "Dialect not supported by server. Consider specifying vers=1.0 or vers=2.0 on mount for accessing older servers\n"); 1144 goto neg_exit; 1145 } else if (rc != 0) 1146 goto neg_exit; 1147 1148 rc = -EIO; 1149 if (strcmp(server->vals->version_string, 1150 SMB3ANY_VERSION_STRING) == 0) { 1151 if (rsp->DialectRevision == cpu_to_le16(SMB20_PROT_ID)) { 1152 cifs_server_dbg(VFS, 1153 "SMB2 dialect returned but not requested\n"); 1154 goto neg_exit; 1155 } else if (rsp->DialectRevision == cpu_to_le16(SMB21_PROT_ID)) { 1156 cifs_server_dbg(VFS, 1157 "SMB2.1 dialect returned but not requested\n"); 1158 goto neg_exit; 1159 } else if (rsp->DialectRevision == cpu_to_le16(SMB311_PROT_ID)) { 1160 /* ops set to 3.0 by default for default so update */ 1161 server->ops = &smb311_operations; 1162 server->vals = &smb311_values; 1163 } 1164 } else if (strcmp(server->vals->version_string, 1165 SMBDEFAULT_VERSION_STRING) == 0) { 1166 if (rsp->DialectRevision == cpu_to_le16(SMB20_PROT_ID)) { 1167 cifs_server_dbg(VFS, 1168 "SMB2 dialect returned but not requested\n"); 1169 goto neg_exit; 1170 } else if (rsp->DialectRevision == cpu_to_le16(SMB21_PROT_ID)) { 1171 /* ops set to 3.0 by default for default so update */ 1172 server->ops = &smb21_operations; 1173 server->vals = &smb21_values; 1174 } else if (rsp->DialectRevision == cpu_to_le16(SMB311_PROT_ID)) { 1175 server->ops = &smb311_operations; 1176 server->vals = &smb311_values; 1177 } 1178 } else if (le16_to_cpu(rsp->DialectRevision) != 1179 server->vals->protocol_id) { 1180 /* if requested single dialect ensure returned dialect matched */ 1181 cifs_server_dbg(VFS, "Invalid 0x%x dialect returned: not requested\n", 1182 le16_to_cpu(rsp->DialectRevision)); 1183 goto neg_exit; 1184 } 1185 1186 cifs_dbg(FYI, "mode 0x%x\n", rsp->SecurityMode); 1187 1188 if (rsp->DialectRevision == cpu_to_le16(SMB20_PROT_ID)) 1189 cifs_dbg(FYI, "negotiated smb2.0 dialect\n"); 1190 else if (rsp->DialectRevision == cpu_to_le16(SMB21_PROT_ID)) 1191 cifs_dbg(FYI, "negotiated smb2.1 dialect\n"); 1192 else if (rsp->DialectRevision == cpu_to_le16(SMB30_PROT_ID)) 1193 cifs_dbg(FYI, "negotiated smb3.0 dialect\n"); 1194 else if (rsp->DialectRevision == cpu_to_le16(SMB302_PROT_ID)) 1195 cifs_dbg(FYI, "negotiated smb3.02 dialect\n"); 1196 else if (rsp->DialectRevision == cpu_to_le16(SMB311_PROT_ID)) 1197 cifs_dbg(FYI, "negotiated smb3.1.1 dialect\n"); 1198 else { 1199 cifs_server_dbg(VFS, "Invalid dialect returned by server 0x%x\n", 1200 le16_to_cpu(rsp->DialectRevision)); 1201 goto neg_exit; 1202 } 1203 1204 rc = 0; 1205 server->dialect = le16_to_cpu(rsp->DialectRevision); 1206 1207 /* 1208 * Keep a copy of the hash after negprot. This hash will be 1209 * the starting hash value for all sessions made from this 1210 * server. 1211 */ 1212 memcpy(server->preauth_sha_hash, ses->preauth_sha_hash, 1213 SMB2_PREAUTH_HASH_SIZE); 1214 1215 /* SMB2 only has an extended negflavor */ 1216 server->negflavor = CIFS_NEGFLAVOR_EXTENDED; 1217 /* set it to the maximum buffer size value we can send with 1 credit */ 1218 server->maxBuf = min_t(unsigned int, le32_to_cpu(rsp->MaxTransactSize), 1219 SMB2_MAX_BUFFER_SIZE); 1220 server->max_read = le32_to_cpu(rsp->MaxReadSize); 1221 server->max_write = le32_to_cpu(rsp->MaxWriteSize); 1222 server->sec_mode = le16_to_cpu(rsp->SecurityMode); 1223 if ((server->sec_mode & SMB2_SEC_MODE_FLAGS_ALL) != server->sec_mode) 1224 cifs_dbg(FYI, "Server returned unexpected security mode 0x%x\n", 1225 server->sec_mode); 1226 server->capabilities = le32_to_cpu(rsp->Capabilities); 1227 /* Internal types */ 1228 server->capabilities |= SMB2_NT_FIND | SMB2_LARGE_FILES; 1229 1230 /* 1231 * SMB3.0 supports only 1 cipher and doesn't have a encryption neg context 1232 * Set the cipher type manually. 1233 */ 1234 if (server->dialect == SMB30_PROT_ID && (server->capabilities & SMB2_GLOBAL_CAP_ENCRYPTION)) 1235 server->cipher_type = SMB2_ENCRYPTION_AES128_CCM; 1236 1237 security_blob = smb2_get_data_area_len(&blob_offset, &blob_length, 1238 (struct smb2_hdr *)rsp); 1239 /* 1240 * See MS-SMB2 section 2.2.4: if no blob, client picks default which 1241 * for us will be 1242 * ses->sectype = RawNTLMSSP; 1243 * but for time being this is our only auth choice so doesn't matter. 1244 * We just found a server which sets blob length to zero expecting raw. 1245 */ 1246 if (blob_length == 0) { 1247 cifs_dbg(FYI, "missing security blob on negprot\n"); 1248 server->sec_ntlmssp = true; 1249 } 1250 1251 rc = cifs_enable_signing(server, ses->sign); 1252 if (rc) 1253 goto neg_exit; 1254 if (blob_length) { 1255 rc = decode_negTokenInit(security_blob, blob_length, server); 1256 if (rc == 1) 1257 rc = 0; 1258 else if (rc == 0) 1259 rc = -EIO; 1260 } 1261 1262 if (rsp->DialectRevision == cpu_to_le16(SMB311_PROT_ID)) { 1263 if (rsp->NegotiateContextCount) 1264 rc = smb311_decode_neg_context(rsp, server, 1265 rsp_iov.iov_len); 1266 else 1267 cifs_server_dbg(VFS, "Missing expected negotiate contexts\n"); 1268 } 1269 neg_exit: 1270 free_rsp_buf(resp_buftype, rsp); 1271 return rc; 1272 } 1273 1274 int smb3_validate_negotiate(const unsigned int xid, struct cifs_tcon *tcon) 1275 { 1276 int rc; 1277 struct validate_negotiate_info_req *pneg_inbuf; 1278 struct validate_negotiate_info_rsp *pneg_rsp = NULL; 1279 u32 rsplen; 1280 u32 inbuflen; /* max of 4 dialects */ 1281 struct TCP_Server_Info *server = tcon->ses->server; 1282 1283 cifs_dbg(FYI, "validate negotiate\n"); 1284 1285 /* In SMB3.11 preauth integrity supersedes validate negotiate */ 1286 if (server->dialect == SMB311_PROT_ID) 1287 return 0; 1288 1289 /* 1290 * validation ioctl must be signed, so no point sending this if we 1291 * can not sign it (ie are not known user). Even if signing is not 1292 * required (enabled but not negotiated), in those cases we selectively 1293 * sign just this, the first and only signed request on a connection. 1294 * Having validation of negotiate info helps reduce attack vectors. 1295 */ 1296 if (tcon->ses->session_flags & SMB2_SESSION_FLAG_IS_GUEST) 1297 return 0; /* validation requires signing */ 1298 1299 if (tcon->ses->user_name == NULL) { 1300 cifs_dbg(FYI, "Can't validate negotiate: null user mount\n"); 1301 return 0; /* validation requires signing */ 1302 } 1303 1304 if (tcon->ses->session_flags & SMB2_SESSION_FLAG_IS_NULL) 1305 cifs_tcon_dbg(VFS, "Unexpected null user (anonymous) auth flag sent by server\n"); 1306 1307 pneg_inbuf = kmalloc(sizeof(*pneg_inbuf), GFP_NOFS); 1308 if (!pneg_inbuf) 1309 return -ENOMEM; 1310 1311 pneg_inbuf->Capabilities = 1312 cpu_to_le32(server->vals->req_capabilities); 1313 if (tcon->ses->chan_max > 1) 1314 pneg_inbuf->Capabilities |= cpu_to_le32(SMB2_GLOBAL_CAP_MULTI_CHANNEL); 1315 1316 memcpy(pneg_inbuf->Guid, server->client_guid, 1317 SMB2_CLIENT_GUID_SIZE); 1318 1319 if (tcon->ses->sign) 1320 pneg_inbuf->SecurityMode = 1321 cpu_to_le16(SMB2_NEGOTIATE_SIGNING_REQUIRED); 1322 else if (global_secflags & CIFSSEC_MAY_SIGN) 1323 pneg_inbuf->SecurityMode = 1324 cpu_to_le16(SMB2_NEGOTIATE_SIGNING_ENABLED); 1325 else 1326 pneg_inbuf->SecurityMode = 0; 1327 1328 1329 if (strcmp(server->vals->version_string, 1330 SMB3ANY_VERSION_STRING) == 0) { 1331 pneg_inbuf->Dialects[0] = cpu_to_le16(SMB30_PROT_ID); 1332 pneg_inbuf->Dialects[1] = cpu_to_le16(SMB302_PROT_ID); 1333 pneg_inbuf->Dialects[2] = cpu_to_le16(SMB311_PROT_ID); 1334 pneg_inbuf->DialectCount = cpu_to_le16(3); 1335 /* SMB 2.1 not included so subtract one dialect from len */ 1336 inbuflen = sizeof(*pneg_inbuf) - 1337 (sizeof(pneg_inbuf->Dialects[0])); 1338 } else if (strcmp(server->vals->version_string, 1339 SMBDEFAULT_VERSION_STRING) == 0) { 1340 pneg_inbuf->Dialects[0] = cpu_to_le16(SMB21_PROT_ID); 1341 pneg_inbuf->Dialects[1] = cpu_to_le16(SMB30_PROT_ID); 1342 pneg_inbuf->Dialects[2] = cpu_to_le16(SMB302_PROT_ID); 1343 pneg_inbuf->Dialects[3] = cpu_to_le16(SMB311_PROT_ID); 1344 pneg_inbuf->DialectCount = cpu_to_le16(4); 1345 /* structure is big enough for 4 dialects */ 1346 inbuflen = sizeof(*pneg_inbuf); 1347 } else { 1348 /* otherwise specific dialect was requested */ 1349 pneg_inbuf->Dialects[0] = 1350 cpu_to_le16(server->vals->protocol_id); 1351 pneg_inbuf->DialectCount = cpu_to_le16(1); 1352 /* structure is big enough for 4 dialects, sending only 1 */ 1353 inbuflen = sizeof(*pneg_inbuf) - 1354 sizeof(pneg_inbuf->Dialects[0]) * 3; 1355 } 1356 1357 rc = SMB2_ioctl(xid, tcon, NO_FILE_ID, NO_FILE_ID, 1358 FSCTL_VALIDATE_NEGOTIATE_INFO, 1359 (char *)pneg_inbuf, inbuflen, CIFSMaxBufSize, 1360 (char **)&pneg_rsp, &rsplen); 1361 if (rc == -EOPNOTSUPP) { 1362 /* 1363 * Old Windows versions or Netapp SMB server can return 1364 * not supported error. Client should accept it. 1365 */ 1366 cifs_tcon_dbg(VFS, "Server does not support validate negotiate\n"); 1367 rc = 0; 1368 goto out_free_inbuf; 1369 } else if (rc != 0) { 1370 cifs_tcon_dbg(VFS, "validate protocol negotiate failed: %d\n", 1371 rc); 1372 rc = -EIO; 1373 goto out_free_inbuf; 1374 } 1375 1376 rc = -EIO; 1377 if (rsplen != sizeof(*pneg_rsp)) { 1378 cifs_tcon_dbg(VFS, "Invalid protocol negotiate response size: %d\n", 1379 rsplen); 1380 1381 /* relax check since Mac returns max bufsize allowed on ioctl */ 1382 if (rsplen > CIFSMaxBufSize || rsplen < sizeof(*pneg_rsp)) 1383 goto out_free_rsp; 1384 } 1385 1386 /* check validate negotiate info response matches what we got earlier */ 1387 if (pneg_rsp->Dialect != cpu_to_le16(server->dialect)) 1388 goto vneg_out; 1389 1390 if (pneg_rsp->SecurityMode != cpu_to_le16(server->sec_mode)) 1391 goto vneg_out; 1392 1393 /* do not validate server guid because not saved at negprot time yet */ 1394 1395 if ((le32_to_cpu(pneg_rsp->Capabilities) | SMB2_NT_FIND | 1396 SMB2_LARGE_FILES) != server->capabilities) 1397 goto vneg_out; 1398 1399 /* validate negotiate successful */ 1400 rc = 0; 1401 cifs_dbg(FYI, "validate negotiate info successful\n"); 1402 goto out_free_rsp; 1403 1404 vneg_out: 1405 cifs_tcon_dbg(VFS, "protocol revalidation - security settings mismatch\n"); 1406 out_free_rsp: 1407 kfree(pneg_rsp); 1408 out_free_inbuf: 1409 kfree(pneg_inbuf); 1410 return rc; 1411 } 1412 1413 enum securityEnum 1414 smb2_select_sectype(struct TCP_Server_Info *server, enum securityEnum requested) 1415 { 1416 switch (requested) { 1417 case Kerberos: 1418 case RawNTLMSSP: 1419 return requested; 1420 case NTLMv2: 1421 return RawNTLMSSP; 1422 case Unspecified: 1423 if (server->sec_ntlmssp && 1424 (global_secflags & CIFSSEC_MAY_NTLMSSP)) 1425 return RawNTLMSSP; 1426 if ((server->sec_kerberos || server->sec_mskerberos) && 1427 (global_secflags & CIFSSEC_MAY_KRB5)) 1428 return Kerberos; 1429 fallthrough; 1430 default: 1431 return Unspecified; 1432 } 1433 } 1434 1435 struct SMB2_sess_data { 1436 unsigned int xid; 1437 struct cifs_ses *ses; 1438 struct TCP_Server_Info *server; 1439 struct nls_table *nls_cp; 1440 void (*func)(struct SMB2_sess_data *); 1441 int result; 1442 u64 previous_session; 1443 1444 /* we will send the SMB in three pieces: 1445 * a fixed length beginning part, an optional 1446 * SPNEGO blob (which can be zero length), and a 1447 * last part which will include the strings 1448 * and rest of bcc area. This allows us to avoid 1449 * a large buffer 17K allocation 1450 */ 1451 int buf0_type; 1452 struct kvec iov[2]; 1453 }; 1454 1455 static int 1456 SMB2_sess_alloc_buffer(struct SMB2_sess_data *sess_data) 1457 { 1458 int rc; 1459 struct cifs_ses *ses = sess_data->ses; 1460 struct TCP_Server_Info *server = sess_data->server; 1461 struct smb2_sess_setup_req *req; 1462 unsigned int total_len; 1463 bool is_binding = false; 1464 1465 rc = smb2_plain_req_init(SMB2_SESSION_SETUP, NULL, server, 1466 (void **) &req, 1467 &total_len); 1468 if (rc) 1469 return rc; 1470 1471 spin_lock(&ses->ses_lock); 1472 is_binding = (ses->ses_status == SES_GOOD); 1473 spin_unlock(&ses->ses_lock); 1474 1475 if (is_binding) { 1476 req->hdr.SessionId = cpu_to_le64(ses->Suid); 1477 req->hdr.Flags |= SMB2_FLAGS_SIGNED; 1478 req->PreviousSessionId = 0; 1479 req->Flags = SMB2_SESSION_REQ_FLAG_BINDING; 1480 cifs_dbg(FYI, "Binding to sess id: %llx\n", ses->Suid); 1481 } else { 1482 /* First session, not a reauthenticate */ 1483 req->hdr.SessionId = 0; 1484 /* 1485 * if reconnect, we need to send previous sess id 1486 * otherwise it is 0 1487 */ 1488 req->PreviousSessionId = cpu_to_le64(sess_data->previous_session); 1489 req->Flags = 0; /* MBZ */ 1490 cifs_dbg(FYI, "Fresh session. Previous: %llx\n", 1491 sess_data->previous_session); 1492 } 1493 1494 /* enough to enable echos and oplocks and one max size write */ 1495 if (server->credits >= server->max_credits) 1496 req->hdr.CreditRequest = cpu_to_le16(0); 1497 else 1498 req->hdr.CreditRequest = cpu_to_le16( 1499 min_t(int, server->max_credits - 1500 server->credits, 130)); 1501 1502 /* only one of SMB2 signing flags may be set in SMB2 request */ 1503 if (server->sign) 1504 req->SecurityMode = SMB2_NEGOTIATE_SIGNING_REQUIRED; 1505 else if (global_secflags & CIFSSEC_MAY_SIGN) /* one flag unlike MUST_ */ 1506 req->SecurityMode = SMB2_NEGOTIATE_SIGNING_ENABLED; 1507 else 1508 req->SecurityMode = 0; 1509 1510 #ifdef CONFIG_CIFS_DFS_UPCALL 1511 req->Capabilities = cpu_to_le32(SMB2_GLOBAL_CAP_DFS); 1512 #else 1513 req->Capabilities = 0; 1514 #endif /* DFS_UPCALL */ 1515 1516 req->Channel = 0; /* MBZ */ 1517 1518 sess_data->iov[0].iov_base = (char *)req; 1519 /* 1 for pad */ 1520 sess_data->iov[0].iov_len = total_len - 1; 1521 /* 1522 * This variable will be used to clear the buffer 1523 * allocated above in case of any error in the calling function. 1524 */ 1525 sess_data->buf0_type = CIFS_SMALL_BUFFER; 1526 1527 return 0; 1528 } 1529 1530 static void 1531 SMB2_sess_free_buffer(struct SMB2_sess_data *sess_data) 1532 { 1533 struct kvec *iov = sess_data->iov; 1534 1535 /* iov[1] is already freed by caller */ 1536 if (sess_data->buf0_type != CIFS_NO_BUFFER && iov[0].iov_base) 1537 memzero_explicit(iov[0].iov_base, iov[0].iov_len); 1538 1539 free_rsp_buf(sess_data->buf0_type, iov[0].iov_base); 1540 sess_data->buf0_type = CIFS_NO_BUFFER; 1541 } 1542 1543 static int 1544 SMB2_sess_sendreceive(struct SMB2_sess_data *sess_data) 1545 { 1546 int rc; 1547 struct smb_rqst rqst; 1548 struct smb2_sess_setup_req *req = sess_data->iov[0].iov_base; 1549 struct kvec rsp_iov = { NULL, 0 }; 1550 1551 /* Testing shows that buffer offset must be at location of Buffer[0] */ 1552 req->SecurityBufferOffset = 1553 cpu_to_le16(sizeof(struct smb2_sess_setup_req)); 1554 req->SecurityBufferLength = cpu_to_le16(sess_data->iov[1].iov_len); 1555 1556 memset(&rqst, 0, sizeof(struct smb_rqst)); 1557 rqst.rq_iov = sess_data->iov; 1558 rqst.rq_nvec = 2; 1559 1560 /* BB add code to build os and lm fields */ 1561 rc = cifs_send_recv(sess_data->xid, sess_data->ses, 1562 sess_data->server, 1563 &rqst, 1564 &sess_data->buf0_type, 1565 CIFS_LOG_ERROR | CIFS_SESS_OP, &rsp_iov); 1566 cifs_small_buf_release(sess_data->iov[0].iov_base); 1567 if (rc == 0) 1568 sess_data->ses->expired_pwd = false; 1569 else if ((rc == -EACCES) || (rc == -EKEYEXPIRED) || (rc == -EKEYREVOKED)) { 1570 if (sess_data->ses->expired_pwd == false) 1571 trace_smb3_key_expired(sess_data->server->hostname, 1572 sess_data->ses->user_name, 1573 sess_data->server->conn_id, 1574 &sess_data->server->dstaddr, rc); 1575 sess_data->ses->expired_pwd = true; 1576 } 1577 1578 memcpy(&sess_data->iov[0], &rsp_iov, sizeof(struct kvec)); 1579 1580 return rc; 1581 } 1582 1583 static int 1584 SMB2_sess_establish_session(struct SMB2_sess_data *sess_data) 1585 { 1586 int rc = 0; 1587 struct cifs_ses *ses = sess_data->ses; 1588 struct TCP_Server_Info *server = sess_data->server; 1589 1590 cifs_server_lock(server); 1591 if (server->ops->generate_signingkey) { 1592 rc = server->ops->generate_signingkey(ses, server); 1593 if (rc) { 1594 cifs_dbg(FYI, 1595 "SMB3 session key generation failed\n"); 1596 cifs_server_unlock(server); 1597 return rc; 1598 } 1599 } 1600 if (!server->session_estab) { 1601 server->sequence_number = 0x2; 1602 server->session_estab = true; 1603 } 1604 cifs_server_unlock(server); 1605 1606 cifs_dbg(FYI, "SMB2/3 session established successfully\n"); 1607 return rc; 1608 } 1609 1610 #ifdef CONFIG_CIFS_UPCALL 1611 static void 1612 SMB2_auth_kerberos(struct SMB2_sess_data *sess_data) 1613 { 1614 int rc; 1615 struct cifs_ses *ses = sess_data->ses; 1616 struct TCP_Server_Info *server = sess_data->server; 1617 struct cifs_spnego_msg *msg; 1618 struct key *spnego_key = NULL; 1619 struct smb2_sess_setup_rsp *rsp = NULL; 1620 bool is_binding = false; 1621 1622 rc = SMB2_sess_alloc_buffer(sess_data); 1623 if (rc) 1624 goto out; 1625 1626 spnego_key = cifs_get_spnego_key(ses, server); 1627 if (IS_ERR(spnego_key)) { 1628 rc = PTR_ERR(spnego_key); 1629 if (rc == -ENOKEY) 1630 cifs_dbg(VFS, "Verify user has a krb5 ticket and keyutils is installed\n"); 1631 spnego_key = NULL; 1632 goto out; 1633 } 1634 1635 msg = spnego_key->payload.data[0]; 1636 /* 1637 * check version field to make sure that cifs.upcall is 1638 * sending us a response in an expected form 1639 */ 1640 if (msg->version != CIFS_SPNEGO_UPCALL_VERSION) { 1641 cifs_dbg(VFS, "bad cifs.upcall version. Expected %d got %d\n", 1642 CIFS_SPNEGO_UPCALL_VERSION, msg->version); 1643 rc = -EKEYREJECTED; 1644 goto out_put_spnego_key; 1645 } 1646 1647 spin_lock(&ses->ses_lock); 1648 is_binding = (ses->ses_status == SES_GOOD); 1649 spin_unlock(&ses->ses_lock); 1650 1651 /* keep session key if binding */ 1652 if (!is_binding) { 1653 kfree_sensitive(ses->auth_key.response); 1654 ses->auth_key.response = kmemdup(msg->data, msg->sesskey_len, 1655 GFP_KERNEL); 1656 if (!ses->auth_key.response) { 1657 cifs_dbg(VFS, "Kerberos can't allocate (%u bytes) memory\n", 1658 msg->sesskey_len); 1659 rc = -ENOMEM; 1660 goto out_put_spnego_key; 1661 } 1662 ses->auth_key.len = msg->sesskey_len; 1663 } 1664 1665 sess_data->iov[1].iov_base = msg->data + msg->sesskey_len; 1666 sess_data->iov[1].iov_len = msg->secblob_len; 1667 1668 rc = SMB2_sess_sendreceive(sess_data); 1669 if (rc) 1670 goto out_put_spnego_key; 1671 1672 rsp = (struct smb2_sess_setup_rsp *)sess_data->iov[0].iov_base; 1673 /* keep session id and flags if binding */ 1674 if (!is_binding) { 1675 ses->Suid = le64_to_cpu(rsp->hdr.SessionId); 1676 ses->session_flags = le16_to_cpu(rsp->SessionFlags); 1677 } 1678 1679 rc = SMB2_sess_establish_session(sess_data); 1680 out_put_spnego_key: 1681 key_invalidate(spnego_key); 1682 key_put(spnego_key); 1683 if (rc) { 1684 kfree_sensitive(ses->auth_key.response); 1685 ses->auth_key.response = NULL; 1686 ses->auth_key.len = 0; 1687 } 1688 out: 1689 sess_data->result = rc; 1690 sess_data->func = NULL; 1691 SMB2_sess_free_buffer(sess_data); 1692 } 1693 #else 1694 static void 1695 SMB2_auth_kerberos(struct SMB2_sess_data *sess_data) 1696 { 1697 cifs_dbg(VFS, "Kerberos negotiated but upcall support disabled!\n"); 1698 sess_data->result = -EOPNOTSUPP; 1699 sess_data->func = NULL; 1700 } 1701 #endif 1702 1703 static void 1704 SMB2_sess_auth_rawntlmssp_authenticate(struct SMB2_sess_data *sess_data); 1705 1706 static void 1707 SMB2_sess_auth_rawntlmssp_negotiate(struct SMB2_sess_data *sess_data) 1708 { 1709 int rc; 1710 struct cifs_ses *ses = sess_data->ses; 1711 struct TCP_Server_Info *server = sess_data->server; 1712 struct smb2_sess_setup_rsp *rsp = NULL; 1713 unsigned char *ntlmssp_blob = NULL; 1714 bool use_spnego = false; /* else use raw ntlmssp */ 1715 u16 blob_length = 0; 1716 bool is_binding = false; 1717 1718 /* 1719 * If memory allocation is successful, caller of this function 1720 * frees it. 1721 */ 1722 ses->ntlmssp = kmalloc(sizeof(struct ntlmssp_auth), GFP_KERNEL); 1723 if (!ses->ntlmssp) { 1724 rc = -ENOMEM; 1725 goto out_err; 1726 } 1727 ses->ntlmssp->sesskey_per_smbsess = true; 1728 1729 rc = SMB2_sess_alloc_buffer(sess_data); 1730 if (rc) 1731 goto out_err; 1732 1733 rc = build_ntlmssp_smb3_negotiate_blob(&ntlmssp_blob, 1734 &blob_length, ses, server, 1735 sess_data->nls_cp); 1736 if (rc) 1737 goto out; 1738 1739 if (use_spnego) { 1740 /* BB eventually need to add this */ 1741 cifs_dbg(VFS, "spnego not supported for SMB2 yet\n"); 1742 rc = -EOPNOTSUPP; 1743 goto out; 1744 } 1745 sess_data->iov[1].iov_base = ntlmssp_blob; 1746 sess_data->iov[1].iov_len = blob_length; 1747 1748 rc = SMB2_sess_sendreceive(sess_data); 1749 rsp = (struct smb2_sess_setup_rsp *)sess_data->iov[0].iov_base; 1750 1751 /* If true, rc here is expected and not an error */ 1752 if (sess_data->buf0_type != CIFS_NO_BUFFER && 1753 rsp->hdr.Status == STATUS_MORE_PROCESSING_REQUIRED) 1754 rc = 0; 1755 1756 if (rc) 1757 goto out; 1758 1759 if (offsetof(struct smb2_sess_setup_rsp, Buffer) != 1760 le16_to_cpu(rsp->SecurityBufferOffset)) { 1761 cifs_dbg(VFS, "Invalid security buffer offset %d\n", 1762 le16_to_cpu(rsp->SecurityBufferOffset)); 1763 rc = -EIO; 1764 goto out; 1765 } 1766 rc = decode_ntlmssp_challenge(rsp->Buffer, 1767 le16_to_cpu(rsp->SecurityBufferLength), ses); 1768 if (rc) 1769 goto out; 1770 1771 cifs_dbg(FYI, "rawntlmssp session setup challenge phase\n"); 1772 1773 spin_lock(&ses->ses_lock); 1774 is_binding = (ses->ses_status == SES_GOOD); 1775 spin_unlock(&ses->ses_lock); 1776 1777 /* keep existing ses id and flags if binding */ 1778 if (!is_binding) { 1779 ses->Suid = le64_to_cpu(rsp->hdr.SessionId); 1780 ses->session_flags = le16_to_cpu(rsp->SessionFlags); 1781 } 1782 1783 out: 1784 kfree_sensitive(ntlmssp_blob); 1785 SMB2_sess_free_buffer(sess_data); 1786 if (!rc) { 1787 sess_data->result = 0; 1788 sess_data->func = SMB2_sess_auth_rawntlmssp_authenticate; 1789 return; 1790 } 1791 out_err: 1792 kfree_sensitive(ses->ntlmssp); 1793 ses->ntlmssp = NULL; 1794 sess_data->result = rc; 1795 sess_data->func = NULL; 1796 } 1797 1798 static void 1799 SMB2_sess_auth_rawntlmssp_authenticate(struct SMB2_sess_data *sess_data) 1800 { 1801 int rc; 1802 struct cifs_ses *ses = sess_data->ses; 1803 struct TCP_Server_Info *server = sess_data->server; 1804 struct smb2_sess_setup_req *req; 1805 struct smb2_sess_setup_rsp *rsp = NULL; 1806 unsigned char *ntlmssp_blob = NULL; 1807 bool use_spnego = false; /* else use raw ntlmssp */ 1808 u16 blob_length = 0; 1809 bool is_binding = false; 1810 1811 rc = SMB2_sess_alloc_buffer(sess_data); 1812 if (rc) 1813 goto out; 1814 1815 req = (struct smb2_sess_setup_req *) sess_data->iov[0].iov_base; 1816 req->hdr.SessionId = cpu_to_le64(ses->Suid); 1817 1818 rc = build_ntlmssp_auth_blob(&ntlmssp_blob, &blob_length, 1819 ses, server, 1820 sess_data->nls_cp); 1821 if (rc) { 1822 cifs_dbg(FYI, "build_ntlmssp_auth_blob failed %d\n", rc); 1823 goto out; 1824 } 1825 1826 if (use_spnego) { 1827 /* BB eventually need to add this */ 1828 cifs_dbg(VFS, "spnego not supported for SMB2 yet\n"); 1829 rc = -EOPNOTSUPP; 1830 goto out; 1831 } 1832 sess_data->iov[1].iov_base = ntlmssp_blob; 1833 sess_data->iov[1].iov_len = blob_length; 1834 1835 rc = SMB2_sess_sendreceive(sess_data); 1836 if (rc) 1837 goto out; 1838 1839 rsp = (struct smb2_sess_setup_rsp *)sess_data->iov[0].iov_base; 1840 1841 spin_lock(&ses->ses_lock); 1842 is_binding = (ses->ses_status == SES_GOOD); 1843 spin_unlock(&ses->ses_lock); 1844 1845 /* keep existing ses id and flags if binding */ 1846 if (!is_binding) { 1847 ses->Suid = le64_to_cpu(rsp->hdr.SessionId); 1848 ses->session_flags = le16_to_cpu(rsp->SessionFlags); 1849 } 1850 1851 rc = SMB2_sess_establish_session(sess_data); 1852 #ifdef CONFIG_CIFS_DEBUG_DUMP_KEYS 1853 if (ses->server->dialect < SMB30_PROT_ID) { 1854 cifs_dbg(VFS, "%s: dumping generated SMB2 session keys\n", __func__); 1855 /* 1856 * The session id is opaque in terms of endianness, so we can't 1857 * print it as a long long. we dump it as we got it on the wire 1858 */ 1859 cifs_dbg(VFS, "Session Id %*ph\n", (int)sizeof(ses->Suid), 1860 &ses->Suid); 1861 cifs_dbg(VFS, "Session Key %*ph\n", 1862 SMB2_NTLMV2_SESSKEY_SIZE, ses->auth_key.response); 1863 cifs_dbg(VFS, "Signing Key %*ph\n", 1864 SMB3_SIGN_KEY_SIZE, ses->auth_key.response); 1865 } 1866 #endif 1867 out: 1868 kfree_sensitive(ntlmssp_blob); 1869 SMB2_sess_free_buffer(sess_data); 1870 kfree_sensitive(ses->ntlmssp); 1871 ses->ntlmssp = NULL; 1872 sess_data->result = rc; 1873 sess_data->func = NULL; 1874 } 1875 1876 static int 1877 SMB2_select_sec(struct SMB2_sess_data *sess_data) 1878 { 1879 int type; 1880 struct cifs_ses *ses = sess_data->ses; 1881 struct TCP_Server_Info *server = sess_data->server; 1882 1883 type = smb2_select_sectype(server, ses->sectype); 1884 cifs_dbg(FYI, "sess setup type %d\n", type); 1885 if (type == Unspecified) { 1886 cifs_dbg(VFS, "Unable to select appropriate authentication method!\n"); 1887 return -EINVAL; 1888 } 1889 1890 switch (type) { 1891 case Kerberos: 1892 sess_data->func = SMB2_auth_kerberos; 1893 break; 1894 case RawNTLMSSP: 1895 sess_data->func = SMB2_sess_auth_rawntlmssp_negotiate; 1896 break; 1897 default: 1898 cifs_dbg(VFS, "secType %d not supported!\n", type); 1899 return -EOPNOTSUPP; 1900 } 1901 1902 return 0; 1903 } 1904 1905 int 1906 SMB2_sess_setup(const unsigned int xid, struct cifs_ses *ses, 1907 struct TCP_Server_Info *server, 1908 const struct nls_table *nls_cp) 1909 { 1910 int rc = 0; 1911 struct SMB2_sess_data *sess_data; 1912 1913 cifs_dbg(FYI, "Session Setup\n"); 1914 1915 if (!server) { 1916 WARN(1, "%s: server is NULL!\n", __func__); 1917 return -EIO; 1918 } 1919 1920 sess_data = kzalloc(sizeof(struct SMB2_sess_data), GFP_KERNEL); 1921 if (!sess_data) 1922 return -ENOMEM; 1923 1924 sess_data->xid = xid; 1925 sess_data->ses = ses; 1926 sess_data->server = server; 1927 sess_data->buf0_type = CIFS_NO_BUFFER; 1928 sess_data->nls_cp = (struct nls_table *) nls_cp; 1929 sess_data->previous_session = ses->Suid; 1930 1931 rc = SMB2_select_sec(sess_data); 1932 if (rc) 1933 goto out; 1934 1935 /* 1936 * Initialize the session hash with the server one. 1937 */ 1938 memcpy(ses->preauth_sha_hash, server->preauth_sha_hash, 1939 SMB2_PREAUTH_HASH_SIZE); 1940 1941 while (sess_data->func) 1942 sess_data->func(sess_data); 1943 1944 if ((ses->session_flags & SMB2_SESSION_FLAG_IS_GUEST) && (ses->sign)) 1945 cifs_server_dbg(VFS, "signing requested but authenticated as guest\n"); 1946 rc = sess_data->result; 1947 out: 1948 kfree_sensitive(sess_data); 1949 return rc; 1950 } 1951 1952 int 1953 SMB2_logoff(const unsigned int xid, struct cifs_ses *ses) 1954 { 1955 struct smb_rqst rqst; 1956 struct smb2_logoff_req *req; /* response is also trivial struct */ 1957 int rc = 0; 1958 struct TCP_Server_Info *server; 1959 int flags = 0; 1960 unsigned int total_len; 1961 struct kvec iov[1]; 1962 struct kvec rsp_iov; 1963 int resp_buf_type; 1964 1965 cifs_dbg(FYI, "disconnect session %p\n", ses); 1966 1967 if (ses && (ses->server)) 1968 server = ses->server; 1969 else 1970 return -EIO; 1971 1972 /* no need to send SMB logoff if uid already closed due to reconnect */ 1973 spin_lock(&ses->chan_lock); 1974 if (CIFS_ALL_CHANS_NEED_RECONNECT(ses)) { 1975 spin_unlock(&ses->chan_lock); 1976 goto smb2_session_already_dead; 1977 } 1978 spin_unlock(&ses->chan_lock); 1979 1980 rc = smb2_plain_req_init(SMB2_LOGOFF, NULL, ses->server, 1981 (void **) &req, &total_len); 1982 if (rc) 1983 return rc; 1984 1985 /* since no tcon, smb2_init can not do this, so do here */ 1986 req->hdr.SessionId = cpu_to_le64(ses->Suid); 1987 1988 if (ses->session_flags & SMB2_SESSION_FLAG_ENCRYPT_DATA) 1989 flags |= CIFS_TRANSFORM_REQ; 1990 else if (server->sign) 1991 req->hdr.Flags |= SMB2_FLAGS_SIGNED; 1992 1993 flags |= CIFS_NO_RSP_BUF; 1994 1995 iov[0].iov_base = (char *)req; 1996 iov[0].iov_len = total_len; 1997 1998 memset(&rqst, 0, sizeof(struct smb_rqst)); 1999 rqst.rq_iov = iov; 2000 rqst.rq_nvec = 1; 2001 2002 rc = cifs_send_recv(xid, ses, ses->server, 2003 &rqst, &resp_buf_type, flags, &rsp_iov); 2004 cifs_small_buf_release(req); 2005 /* 2006 * No tcon so can't do 2007 * cifs_stats_inc(&tcon->stats.smb2_stats.smb2_com_fail[SMB2...]); 2008 */ 2009 2010 smb2_session_already_dead: 2011 return rc; 2012 } 2013 2014 static inline void cifs_stats_fail_inc(struct cifs_tcon *tcon, uint16_t code) 2015 { 2016 cifs_stats_inc(&tcon->stats.smb2_stats.smb2_com_failed[code]); 2017 } 2018 2019 #define MAX_SHARENAME_LENGTH (255 /* server */ + 80 /* share */ + 1 /* NULL */) 2020 2021 /* These are similar values to what Windows uses */ 2022 static inline void init_copy_chunk_defaults(struct cifs_tcon *tcon) 2023 { 2024 tcon->max_chunks = 256; 2025 tcon->max_bytes_chunk = 1048576; 2026 tcon->max_bytes_copy = 16777216; 2027 } 2028 2029 int 2030 SMB2_tcon(const unsigned int xid, struct cifs_ses *ses, const char *tree, 2031 struct cifs_tcon *tcon, const struct nls_table *cp) 2032 { 2033 struct smb_rqst rqst; 2034 struct smb2_tree_connect_req *req; 2035 struct smb2_tree_connect_rsp *rsp = NULL; 2036 struct kvec iov[2]; 2037 struct kvec rsp_iov = { NULL, 0 }; 2038 int rc = 0; 2039 int resp_buftype; 2040 int unc_path_len; 2041 __le16 *unc_path = NULL; 2042 int flags = 0; 2043 unsigned int total_len; 2044 struct TCP_Server_Info *server = cifs_pick_channel(ses); 2045 2046 cifs_dbg(FYI, "TCON\n"); 2047 2048 if (!server || !tree) 2049 return -EIO; 2050 2051 unc_path = kmalloc(MAX_SHARENAME_LENGTH * 2, GFP_KERNEL); 2052 if (unc_path == NULL) 2053 return -ENOMEM; 2054 2055 unc_path_len = cifs_strtoUTF16(unc_path, tree, strlen(tree), cp); 2056 if (unc_path_len <= 0) { 2057 kfree(unc_path); 2058 return -EINVAL; 2059 } 2060 unc_path_len *= 2; 2061 2062 /* SMB2 TREE_CONNECT request must be called with TreeId == 0 */ 2063 tcon->tid = 0; 2064 atomic_set(&tcon->num_remote_opens, 0); 2065 rc = smb2_plain_req_init(SMB2_TREE_CONNECT, tcon, server, 2066 (void **) &req, &total_len); 2067 if (rc) { 2068 kfree(unc_path); 2069 return rc; 2070 } 2071 2072 if (smb3_encryption_required(tcon)) 2073 flags |= CIFS_TRANSFORM_REQ; 2074 2075 iov[0].iov_base = (char *)req; 2076 /* 1 for pad */ 2077 iov[0].iov_len = total_len - 1; 2078 2079 /* Testing shows that buffer offset must be at location of Buffer[0] */ 2080 req->PathOffset = cpu_to_le16(sizeof(struct smb2_tree_connect_req)); 2081 req->PathLength = cpu_to_le16(unc_path_len); 2082 iov[1].iov_base = unc_path; 2083 iov[1].iov_len = unc_path_len; 2084 2085 /* 2086 * 3.11 tcon req must be signed if not encrypted. See MS-SMB2 3.2.4.1.1 2087 * unless it is guest or anonymous user. See MS-SMB2 3.2.5.3.1 2088 * (Samba servers don't always set the flag so also check if null user) 2089 */ 2090 if ((server->dialect == SMB311_PROT_ID) && 2091 !smb3_encryption_required(tcon) && 2092 !(ses->session_flags & 2093 (SMB2_SESSION_FLAG_IS_GUEST|SMB2_SESSION_FLAG_IS_NULL)) && 2094 ((ses->user_name != NULL) || (ses->sectype == Kerberos))) 2095 req->hdr.Flags |= SMB2_FLAGS_SIGNED; 2096 2097 memset(&rqst, 0, sizeof(struct smb_rqst)); 2098 rqst.rq_iov = iov; 2099 rqst.rq_nvec = 2; 2100 2101 /* Need 64 for max size write so ask for more in case not there yet */ 2102 if (server->credits >= server->max_credits) 2103 req->hdr.CreditRequest = cpu_to_le16(0); 2104 else 2105 req->hdr.CreditRequest = cpu_to_le16( 2106 min_t(int, server->max_credits - 2107 server->credits, 64)); 2108 2109 rc = cifs_send_recv(xid, ses, server, 2110 &rqst, &resp_buftype, flags, &rsp_iov); 2111 cifs_small_buf_release(req); 2112 rsp = (struct smb2_tree_connect_rsp *)rsp_iov.iov_base; 2113 trace_smb3_tcon(xid, tcon->tid, ses->Suid, tree, rc); 2114 if ((rc != 0) || (rsp == NULL)) { 2115 cifs_stats_fail_inc(tcon, SMB2_TREE_CONNECT_HE); 2116 tcon->need_reconnect = true; 2117 goto tcon_error_exit; 2118 } 2119 2120 switch (rsp->ShareType) { 2121 case SMB2_SHARE_TYPE_DISK: 2122 cifs_dbg(FYI, "connection to disk share\n"); 2123 break; 2124 case SMB2_SHARE_TYPE_PIPE: 2125 tcon->pipe = true; 2126 cifs_dbg(FYI, "connection to pipe share\n"); 2127 break; 2128 case SMB2_SHARE_TYPE_PRINT: 2129 tcon->print = true; 2130 cifs_dbg(FYI, "connection to printer\n"); 2131 break; 2132 default: 2133 cifs_server_dbg(VFS, "unknown share type %d\n", rsp->ShareType); 2134 rc = -EOPNOTSUPP; 2135 goto tcon_error_exit; 2136 } 2137 2138 tcon->share_flags = le32_to_cpu(rsp->ShareFlags); 2139 tcon->capabilities = rsp->Capabilities; /* we keep caps little endian */ 2140 tcon->maximal_access = le32_to_cpu(rsp->MaximalAccess); 2141 tcon->tid = le32_to_cpu(rsp->hdr.Id.SyncId.TreeId); 2142 strscpy(tcon->tree_name, tree, sizeof(tcon->tree_name)); 2143 2144 if ((rsp->Capabilities & SMB2_SHARE_CAP_DFS) && 2145 ((tcon->share_flags & SHI1005_FLAGS_DFS) == 0)) 2146 cifs_tcon_dbg(VFS, "DFS capability contradicts DFS flag\n"); 2147 2148 if (tcon->seal && 2149 !(server->capabilities & SMB2_GLOBAL_CAP_ENCRYPTION)) 2150 cifs_tcon_dbg(VFS, "Encryption is requested but not supported\n"); 2151 2152 init_copy_chunk_defaults(tcon); 2153 if (server->ops->validate_negotiate) 2154 rc = server->ops->validate_negotiate(xid, tcon); 2155 if (rc == 0) /* See MS-SMB2 2.2.10 and 3.2.5.5 */ 2156 if (tcon->share_flags & SMB2_SHAREFLAG_ISOLATED_TRANSPORT) 2157 server->nosharesock = true; 2158 tcon_exit: 2159 2160 free_rsp_buf(resp_buftype, rsp); 2161 kfree(unc_path); 2162 return rc; 2163 2164 tcon_error_exit: 2165 if (rsp && rsp->hdr.Status == STATUS_BAD_NETWORK_NAME) 2166 cifs_tcon_dbg(VFS, "BAD_NETWORK_NAME: %s\n", tree); 2167 goto tcon_exit; 2168 } 2169 2170 int 2171 SMB2_tdis(const unsigned int xid, struct cifs_tcon *tcon) 2172 { 2173 struct smb_rqst rqst; 2174 struct smb2_tree_disconnect_req *req; /* response is trivial */ 2175 int rc = 0; 2176 struct cifs_ses *ses = tcon->ses; 2177 struct TCP_Server_Info *server = cifs_pick_channel(ses); 2178 int flags = 0; 2179 unsigned int total_len; 2180 struct kvec iov[1]; 2181 struct kvec rsp_iov; 2182 int resp_buf_type; 2183 2184 cifs_dbg(FYI, "Tree Disconnect\n"); 2185 2186 if (!ses || !(ses->server)) 2187 return -EIO; 2188 2189 trace_smb3_tdis_enter(xid, tcon->tid, ses->Suid, tcon->tree_name); 2190 spin_lock(&ses->chan_lock); 2191 if ((tcon->need_reconnect) || 2192 (CIFS_ALL_CHANS_NEED_RECONNECT(tcon->ses))) { 2193 spin_unlock(&ses->chan_lock); 2194 return 0; 2195 } 2196 spin_unlock(&ses->chan_lock); 2197 2198 invalidate_all_cached_dirs(tcon); 2199 2200 rc = smb2_plain_req_init(SMB2_TREE_DISCONNECT, tcon, server, 2201 (void **) &req, 2202 &total_len); 2203 if (rc) 2204 return rc; 2205 2206 if (smb3_encryption_required(tcon)) 2207 flags |= CIFS_TRANSFORM_REQ; 2208 2209 flags |= CIFS_NO_RSP_BUF; 2210 2211 iov[0].iov_base = (char *)req; 2212 iov[0].iov_len = total_len; 2213 2214 memset(&rqst, 0, sizeof(struct smb_rqst)); 2215 rqst.rq_iov = iov; 2216 rqst.rq_nvec = 1; 2217 2218 rc = cifs_send_recv(xid, ses, server, 2219 &rqst, &resp_buf_type, flags, &rsp_iov); 2220 cifs_small_buf_release(req); 2221 if (rc) { 2222 cifs_stats_fail_inc(tcon, SMB2_TREE_DISCONNECT_HE); 2223 trace_smb3_tdis_err(xid, tcon->tid, ses->Suid, rc); 2224 } 2225 trace_smb3_tdis_done(xid, tcon->tid, ses->Suid); 2226 2227 return rc; 2228 } 2229 2230 2231 static struct create_durable * 2232 create_durable_buf(void) 2233 { 2234 struct create_durable *buf; 2235 2236 buf = kzalloc(sizeof(struct create_durable), GFP_KERNEL); 2237 if (!buf) 2238 return NULL; 2239 2240 buf->ccontext.DataOffset = cpu_to_le16(offsetof 2241 (struct create_durable, Data)); 2242 buf->ccontext.DataLength = cpu_to_le32(16); 2243 buf->ccontext.NameOffset = cpu_to_le16(offsetof 2244 (struct create_durable, Name)); 2245 buf->ccontext.NameLength = cpu_to_le16(4); 2246 /* SMB2_CREATE_DURABLE_HANDLE_REQUEST is "DHnQ" */ 2247 buf->Name[0] = 'D'; 2248 buf->Name[1] = 'H'; 2249 buf->Name[2] = 'n'; 2250 buf->Name[3] = 'Q'; 2251 return buf; 2252 } 2253 2254 static struct create_durable * 2255 create_reconnect_durable_buf(struct cifs_fid *fid) 2256 { 2257 struct create_durable *buf; 2258 2259 buf = kzalloc(sizeof(struct create_durable), GFP_KERNEL); 2260 if (!buf) 2261 return NULL; 2262 2263 buf->ccontext.DataOffset = cpu_to_le16(offsetof 2264 (struct create_durable, Data)); 2265 buf->ccontext.DataLength = cpu_to_le32(16); 2266 buf->ccontext.NameOffset = cpu_to_le16(offsetof 2267 (struct create_durable, Name)); 2268 buf->ccontext.NameLength = cpu_to_le16(4); 2269 buf->Data.Fid.PersistentFileId = fid->persistent_fid; 2270 buf->Data.Fid.VolatileFileId = fid->volatile_fid; 2271 /* SMB2_CREATE_DURABLE_HANDLE_RECONNECT is "DHnC" */ 2272 buf->Name[0] = 'D'; 2273 buf->Name[1] = 'H'; 2274 buf->Name[2] = 'n'; 2275 buf->Name[3] = 'C'; 2276 return buf; 2277 } 2278 2279 static void 2280 parse_query_id_ctxt(struct create_context *cc, struct smb2_file_all_info *buf) 2281 { 2282 struct create_disk_id_rsp *pdisk_id = (struct create_disk_id_rsp *)cc; 2283 2284 cifs_dbg(FYI, "parse query id context 0x%llx 0x%llx\n", 2285 pdisk_id->DiskFileId, pdisk_id->VolumeId); 2286 buf->IndexNumber = pdisk_id->DiskFileId; 2287 } 2288 2289 static void 2290 parse_posix_ctxt(struct create_context *cc, struct smb2_file_all_info *info, 2291 struct create_posix_rsp *posix) 2292 { 2293 int sid_len; 2294 u8 *beg = (u8 *)cc + le16_to_cpu(cc->DataOffset); 2295 u8 *end = beg + le32_to_cpu(cc->DataLength); 2296 u8 *sid; 2297 2298 memset(posix, 0, sizeof(*posix)); 2299 2300 posix->nlink = le32_to_cpu(*(__le32 *)(beg + 0)); 2301 posix->reparse_tag = le32_to_cpu(*(__le32 *)(beg + 4)); 2302 posix->mode = le32_to_cpu(*(__le32 *)(beg + 8)); 2303 2304 sid = beg + 12; 2305 sid_len = posix_info_sid_size(sid, end); 2306 if (sid_len < 0) { 2307 cifs_dbg(VFS, "bad owner sid in posix create response\n"); 2308 return; 2309 } 2310 memcpy(&posix->owner, sid, sid_len); 2311 2312 sid = sid + sid_len; 2313 sid_len = posix_info_sid_size(sid, end); 2314 if (sid_len < 0) { 2315 cifs_dbg(VFS, "bad group sid in posix create response\n"); 2316 return; 2317 } 2318 memcpy(&posix->group, sid, sid_len); 2319 2320 cifs_dbg(FYI, "nlink=%d mode=%o reparse_tag=%x\n", 2321 posix->nlink, posix->mode, posix->reparse_tag); 2322 } 2323 2324 int smb2_parse_contexts(struct TCP_Server_Info *server, 2325 struct kvec *rsp_iov, 2326 unsigned int *epoch, 2327 char *lease_key, __u8 *oplock, 2328 struct smb2_file_all_info *buf, 2329 struct create_posix_rsp *posix) 2330 { 2331 struct smb2_create_rsp *rsp = rsp_iov->iov_base; 2332 struct create_context *cc; 2333 size_t rem, off, len; 2334 size_t doff, dlen; 2335 size_t noff, nlen; 2336 char *name; 2337 static const char smb3_create_tag_posix[] = { 2338 0x93, 0xAD, 0x25, 0x50, 0x9C, 2339 0xB4, 0x11, 0xE7, 0xB4, 0x23, 0x83, 2340 0xDE, 0x96, 0x8B, 0xCD, 0x7C 2341 }; 2342 2343 *oplock = 0; 2344 2345 off = le32_to_cpu(rsp->CreateContextsOffset); 2346 rem = le32_to_cpu(rsp->CreateContextsLength); 2347 if (check_add_overflow(off, rem, &len) || len > rsp_iov->iov_len) 2348 return -EINVAL; 2349 cc = (struct create_context *)((u8 *)rsp + off); 2350 2351 /* Initialize inode number to 0 in case no valid data in qfid context */ 2352 if (buf) 2353 buf->IndexNumber = 0; 2354 2355 while (rem >= sizeof(*cc)) { 2356 doff = le16_to_cpu(cc->DataOffset); 2357 dlen = le32_to_cpu(cc->DataLength); 2358 if (check_add_overflow(doff, dlen, &len) || len > rem) 2359 return -EINVAL; 2360 2361 noff = le16_to_cpu(cc->NameOffset); 2362 nlen = le16_to_cpu(cc->NameLength); 2363 if (noff + nlen > doff) 2364 return -EINVAL; 2365 2366 name = (char *)cc + noff; 2367 switch (nlen) { 2368 case 4: 2369 if (!strncmp(name, SMB2_CREATE_REQUEST_LEASE, 4)) { 2370 *oplock = server->ops->parse_lease_buf(cc, epoch, 2371 lease_key); 2372 } else if (buf && 2373 !strncmp(name, SMB2_CREATE_QUERY_ON_DISK_ID, 4)) { 2374 parse_query_id_ctxt(cc, buf); 2375 } 2376 break; 2377 case 16: 2378 if (posix && !memcmp(name, smb3_create_tag_posix, 16)) 2379 parse_posix_ctxt(cc, buf, posix); 2380 break; 2381 default: 2382 cifs_dbg(FYI, "%s: unhandled context (nlen=%zu dlen=%zu)\n", 2383 __func__, nlen, dlen); 2384 if (IS_ENABLED(CONFIG_CIFS_DEBUG2)) 2385 cifs_dump_mem("context data: ", cc, dlen); 2386 break; 2387 } 2388 2389 off = le32_to_cpu(cc->Next); 2390 if (!off) 2391 break; 2392 if (check_sub_overflow(rem, off, &rem)) 2393 return -EINVAL; 2394 cc = (struct create_context *)((u8 *)cc + off); 2395 } 2396 2397 if (rsp->OplockLevel != SMB2_OPLOCK_LEVEL_LEASE) 2398 *oplock = rsp->OplockLevel; 2399 2400 return 0; 2401 } 2402 2403 static int 2404 add_lease_context(struct TCP_Server_Info *server, 2405 struct smb2_create_req *req, 2406 struct kvec *iov, 2407 unsigned int *num_iovec, u8 *lease_key, __u8 *oplock) 2408 { 2409 unsigned int num = *num_iovec; 2410 2411 iov[num].iov_base = server->ops->create_lease_buf(lease_key, *oplock); 2412 if (iov[num].iov_base == NULL) 2413 return -ENOMEM; 2414 iov[num].iov_len = server->vals->create_lease_size; 2415 req->RequestedOplockLevel = SMB2_OPLOCK_LEVEL_LEASE; 2416 *num_iovec = num + 1; 2417 return 0; 2418 } 2419 2420 static struct create_durable_v2 * 2421 create_durable_v2_buf(struct cifs_open_parms *oparms) 2422 { 2423 struct cifs_fid *pfid = oparms->fid; 2424 struct create_durable_v2 *buf; 2425 2426 buf = kzalloc(sizeof(struct create_durable_v2), GFP_KERNEL); 2427 if (!buf) 2428 return NULL; 2429 2430 buf->ccontext.DataOffset = cpu_to_le16(offsetof 2431 (struct create_durable_v2, dcontext)); 2432 buf->ccontext.DataLength = cpu_to_le32(sizeof(struct durable_context_v2)); 2433 buf->ccontext.NameOffset = cpu_to_le16(offsetof 2434 (struct create_durable_v2, Name)); 2435 buf->ccontext.NameLength = cpu_to_le16(4); 2436 2437 /* 2438 * NB: Handle timeout defaults to 0, which allows server to choose 2439 * (most servers default to 120 seconds) and most clients default to 0. 2440 * This can be overridden at mount ("handletimeout=") if the user wants 2441 * a different persistent (or resilient) handle timeout for all opens 2442 * on a particular SMB3 mount. 2443 */ 2444 buf->dcontext.Timeout = cpu_to_le32(oparms->tcon->handle_timeout); 2445 buf->dcontext.Flags = cpu_to_le32(SMB2_DHANDLE_FLAG_PERSISTENT); 2446 2447 /* for replay, we should not overwrite the existing create guid */ 2448 if (!oparms->replay) { 2449 generate_random_uuid(buf->dcontext.CreateGuid); 2450 memcpy(pfid->create_guid, buf->dcontext.CreateGuid, 16); 2451 } else 2452 memcpy(buf->dcontext.CreateGuid, pfid->create_guid, 16); 2453 2454 /* SMB2_CREATE_DURABLE_HANDLE_REQUEST is "DH2Q" */ 2455 buf->Name[0] = 'D'; 2456 buf->Name[1] = 'H'; 2457 buf->Name[2] = '2'; 2458 buf->Name[3] = 'Q'; 2459 return buf; 2460 } 2461 2462 static struct create_durable_handle_reconnect_v2 * 2463 create_reconnect_durable_v2_buf(struct cifs_fid *fid) 2464 { 2465 struct create_durable_handle_reconnect_v2 *buf; 2466 2467 buf = kzalloc(sizeof(struct create_durable_handle_reconnect_v2), 2468 GFP_KERNEL); 2469 if (!buf) 2470 return NULL; 2471 2472 buf->ccontext.DataOffset = 2473 cpu_to_le16(offsetof(struct create_durable_handle_reconnect_v2, 2474 dcontext)); 2475 buf->ccontext.DataLength = 2476 cpu_to_le32(sizeof(struct durable_reconnect_context_v2)); 2477 buf->ccontext.NameOffset = 2478 cpu_to_le16(offsetof(struct create_durable_handle_reconnect_v2, 2479 Name)); 2480 buf->ccontext.NameLength = cpu_to_le16(4); 2481 2482 buf->dcontext.Fid.PersistentFileId = fid->persistent_fid; 2483 buf->dcontext.Fid.VolatileFileId = fid->volatile_fid; 2484 buf->dcontext.Flags = cpu_to_le32(SMB2_DHANDLE_FLAG_PERSISTENT); 2485 memcpy(buf->dcontext.CreateGuid, fid->create_guid, 16); 2486 2487 /* SMB2_CREATE_DURABLE_HANDLE_RECONNECT_V2 is "DH2C" */ 2488 buf->Name[0] = 'D'; 2489 buf->Name[1] = 'H'; 2490 buf->Name[2] = '2'; 2491 buf->Name[3] = 'C'; 2492 return buf; 2493 } 2494 2495 static int 2496 add_durable_v2_context(struct kvec *iov, unsigned int *num_iovec, 2497 struct cifs_open_parms *oparms) 2498 { 2499 unsigned int num = *num_iovec; 2500 2501 iov[num].iov_base = create_durable_v2_buf(oparms); 2502 if (iov[num].iov_base == NULL) 2503 return -ENOMEM; 2504 iov[num].iov_len = sizeof(struct create_durable_v2); 2505 *num_iovec = num + 1; 2506 return 0; 2507 } 2508 2509 static int 2510 add_durable_reconnect_v2_context(struct kvec *iov, unsigned int *num_iovec, 2511 struct cifs_open_parms *oparms) 2512 { 2513 unsigned int num = *num_iovec; 2514 2515 /* indicate that we don't need to relock the file */ 2516 oparms->reconnect = false; 2517 2518 iov[num].iov_base = create_reconnect_durable_v2_buf(oparms->fid); 2519 if (iov[num].iov_base == NULL) 2520 return -ENOMEM; 2521 iov[num].iov_len = sizeof(struct create_durable_handle_reconnect_v2); 2522 *num_iovec = num + 1; 2523 return 0; 2524 } 2525 2526 static int 2527 add_durable_context(struct kvec *iov, unsigned int *num_iovec, 2528 struct cifs_open_parms *oparms, bool use_persistent) 2529 { 2530 unsigned int num = *num_iovec; 2531 2532 if (use_persistent) { 2533 if (oparms->reconnect) 2534 return add_durable_reconnect_v2_context(iov, num_iovec, 2535 oparms); 2536 else 2537 return add_durable_v2_context(iov, num_iovec, oparms); 2538 } 2539 2540 if (oparms->reconnect) { 2541 iov[num].iov_base = create_reconnect_durable_buf(oparms->fid); 2542 /* indicate that we don't need to relock the file */ 2543 oparms->reconnect = false; 2544 } else 2545 iov[num].iov_base = create_durable_buf(); 2546 if (iov[num].iov_base == NULL) 2547 return -ENOMEM; 2548 iov[num].iov_len = sizeof(struct create_durable); 2549 *num_iovec = num + 1; 2550 return 0; 2551 } 2552 2553 /* See MS-SMB2 2.2.13.2.7 */ 2554 static struct crt_twarp_ctxt * 2555 create_twarp_buf(__u64 timewarp) 2556 { 2557 struct crt_twarp_ctxt *buf; 2558 2559 buf = kzalloc(sizeof(struct crt_twarp_ctxt), GFP_KERNEL); 2560 if (!buf) 2561 return NULL; 2562 2563 buf->ccontext.DataOffset = cpu_to_le16(offsetof 2564 (struct crt_twarp_ctxt, Timestamp)); 2565 buf->ccontext.DataLength = cpu_to_le32(8); 2566 buf->ccontext.NameOffset = cpu_to_le16(offsetof 2567 (struct crt_twarp_ctxt, Name)); 2568 buf->ccontext.NameLength = cpu_to_le16(4); 2569 /* SMB2_CREATE_TIMEWARP_TOKEN is "TWrp" */ 2570 buf->Name[0] = 'T'; 2571 buf->Name[1] = 'W'; 2572 buf->Name[2] = 'r'; 2573 buf->Name[3] = 'p'; 2574 buf->Timestamp = cpu_to_le64(timewarp); 2575 return buf; 2576 } 2577 2578 /* See MS-SMB2 2.2.13.2.7 */ 2579 static int 2580 add_twarp_context(struct kvec *iov, unsigned int *num_iovec, __u64 timewarp) 2581 { 2582 unsigned int num = *num_iovec; 2583 2584 iov[num].iov_base = create_twarp_buf(timewarp); 2585 if (iov[num].iov_base == NULL) 2586 return -ENOMEM; 2587 iov[num].iov_len = sizeof(struct crt_twarp_ctxt); 2588 *num_iovec = num + 1; 2589 return 0; 2590 } 2591 2592 /* See http://technet.microsoft.com/en-us/library/hh509017(v=ws.10).aspx */ 2593 static void setup_owner_group_sids(char *buf) 2594 { 2595 struct owner_group_sids *sids = (struct owner_group_sids *)buf; 2596 2597 /* Populate the user ownership fields S-1-5-88-1 */ 2598 sids->owner.Revision = 1; 2599 sids->owner.NumAuth = 3; 2600 sids->owner.Authority[5] = 5; 2601 sids->owner.SubAuthorities[0] = cpu_to_le32(88); 2602 sids->owner.SubAuthorities[1] = cpu_to_le32(1); 2603 sids->owner.SubAuthorities[2] = cpu_to_le32(current_fsuid().val); 2604 2605 /* Populate the group ownership fields S-1-5-88-2 */ 2606 sids->group.Revision = 1; 2607 sids->group.NumAuth = 3; 2608 sids->group.Authority[5] = 5; 2609 sids->group.SubAuthorities[0] = cpu_to_le32(88); 2610 sids->group.SubAuthorities[1] = cpu_to_le32(2); 2611 sids->group.SubAuthorities[2] = cpu_to_le32(current_fsgid().val); 2612 2613 cifs_dbg(FYI, "owner S-1-5-88-1-%d, group S-1-5-88-2-%d\n", current_fsuid().val, current_fsgid().val); 2614 } 2615 2616 /* See MS-SMB2 2.2.13.2.2 and MS-DTYP 2.4.6 */ 2617 static struct crt_sd_ctxt * 2618 create_sd_buf(umode_t mode, bool set_owner, unsigned int *len) 2619 { 2620 struct crt_sd_ctxt *buf; 2621 __u8 *ptr, *aclptr; 2622 unsigned int acelen, acl_size, ace_count; 2623 unsigned int owner_offset = 0; 2624 unsigned int group_offset = 0; 2625 struct smb3_acl acl = {}; 2626 2627 *len = round_up(sizeof(struct crt_sd_ctxt) + (sizeof(struct smb_ace) * 4), 8); 2628 2629 if (set_owner) { 2630 /* sizeof(struct owner_group_sids) is already multiple of 8 so no need to round */ 2631 *len += sizeof(struct owner_group_sids); 2632 } 2633 2634 buf = kzalloc(*len, GFP_KERNEL); 2635 if (buf == NULL) 2636 return buf; 2637 2638 ptr = (__u8 *)&buf[1]; 2639 if (set_owner) { 2640 /* offset fields are from beginning of security descriptor not of create context */ 2641 owner_offset = ptr - (__u8 *)&buf->sd; 2642 buf->sd.OffsetOwner = cpu_to_le32(owner_offset); 2643 group_offset = owner_offset + offsetof(struct owner_group_sids, group); 2644 buf->sd.OffsetGroup = cpu_to_le32(group_offset); 2645 2646 setup_owner_group_sids(ptr); 2647 ptr += sizeof(struct owner_group_sids); 2648 } else { 2649 buf->sd.OffsetOwner = 0; 2650 buf->sd.OffsetGroup = 0; 2651 } 2652 2653 buf->ccontext.DataOffset = cpu_to_le16(offsetof(struct crt_sd_ctxt, sd)); 2654 buf->ccontext.NameOffset = cpu_to_le16(offsetof(struct crt_sd_ctxt, Name)); 2655 buf->ccontext.NameLength = cpu_to_le16(4); 2656 /* SMB2_CREATE_SD_BUFFER_TOKEN is "SecD" */ 2657 buf->Name[0] = 'S'; 2658 buf->Name[1] = 'e'; 2659 buf->Name[2] = 'c'; 2660 buf->Name[3] = 'D'; 2661 buf->sd.Revision = 1; /* Must be one see MS-DTYP 2.4.6 */ 2662 2663 /* 2664 * ACL is "self relative" ie ACL is stored in contiguous block of memory 2665 * and "DP" ie the DACL is present 2666 */ 2667 buf->sd.Control = cpu_to_le16(ACL_CONTROL_SR | ACL_CONTROL_DP); 2668 2669 /* offset owner, group and Sbz1 and SACL are all zero */ 2670 buf->sd.OffsetDacl = cpu_to_le32(ptr - (__u8 *)&buf->sd); 2671 /* Ship the ACL for now. we will copy it into buf later. */ 2672 aclptr = ptr; 2673 ptr += sizeof(struct smb3_acl); 2674 2675 /* create one ACE to hold the mode embedded in reserved special SID */ 2676 acelen = setup_special_mode_ACE((struct smb_ace *)ptr, (__u64)mode); 2677 ptr += acelen; 2678 acl_size = acelen + sizeof(struct smb3_acl); 2679 ace_count = 1; 2680 2681 if (set_owner) { 2682 /* we do not need to reallocate buffer to add the two more ACEs. plenty of space */ 2683 acelen = setup_special_user_owner_ACE((struct smb_ace *)ptr); 2684 ptr += acelen; 2685 acl_size += acelen; 2686 ace_count += 1; 2687 } 2688 2689 /* and one more ACE to allow access for authenticated users */ 2690 acelen = setup_authusers_ACE((struct smb_ace *)ptr); 2691 ptr += acelen; 2692 acl_size += acelen; 2693 ace_count += 1; 2694 2695 acl.AclRevision = ACL_REVISION; /* See 2.4.4.1 of MS-DTYP */ 2696 acl.AclSize = cpu_to_le16(acl_size); 2697 acl.AceCount = cpu_to_le16(ace_count); 2698 /* acl.Sbz1 and Sbz2 MBZ so are not set here, but initialized above */ 2699 memcpy(aclptr, &acl, sizeof(struct smb3_acl)); 2700 2701 buf->ccontext.DataLength = cpu_to_le32(ptr - (__u8 *)&buf->sd); 2702 *len = round_up((unsigned int)(ptr - (__u8 *)buf), 8); 2703 2704 return buf; 2705 } 2706 2707 static int 2708 add_sd_context(struct kvec *iov, unsigned int *num_iovec, umode_t mode, bool set_owner) 2709 { 2710 unsigned int num = *num_iovec; 2711 unsigned int len = 0; 2712 2713 iov[num].iov_base = create_sd_buf(mode, set_owner, &len); 2714 if (iov[num].iov_base == NULL) 2715 return -ENOMEM; 2716 iov[num].iov_len = len; 2717 *num_iovec = num + 1; 2718 return 0; 2719 } 2720 2721 static struct crt_query_id_ctxt * 2722 create_query_id_buf(void) 2723 { 2724 struct crt_query_id_ctxt *buf; 2725 2726 buf = kzalloc(sizeof(struct crt_query_id_ctxt), GFP_KERNEL); 2727 if (!buf) 2728 return NULL; 2729 2730 buf->ccontext.DataOffset = cpu_to_le16(0); 2731 buf->ccontext.DataLength = cpu_to_le32(0); 2732 buf->ccontext.NameOffset = cpu_to_le16(offsetof 2733 (struct crt_query_id_ctxt, Name)); 2734 buf->ccontext.NameLength = cpu_to_le16(4); 2735 /* SMB2_CREATE_QUERY_ON_DISK_ID is "QFid" */ 2736 buf->Name[0] = 'Q'; 2737 buf->Name[1] = 'F'; 2738 buf->Name[2] = 'i'; 2739 buf->Name[3] = 'd'; 2740 return buf; 2741 } 2742 2743 /* See MS-SMB2 2.2.13.2.9 */ 2744 static int 2745 add_query_id_context(struct kvec *iov, unsigned int *num_iovec) 2746 { 2747 unsigned int num = *num_iovec; 2748 2749 iov[num].iov_base = create_query_id_buf(); 2750 if (iov[num].iov_base == NULL) 2751 return -ENOMEM; 2752 iov[num].iov_len = sizeof(struct crt_query_id_ctxt); 2753 *num_iovec = num + 1; 2754 return 0; 2755 } 2756 2757 static void add_ea_context(struct cifs_open_parms *oparms, 2758 struct kvec *rq_iov, unsigned int *num_iovs) 2759 { 2760 struct kvec *iov = oparms->ea_cctx; 2761 2762 if (iov && iov->iov_base && iov->iov_len) { 2763 rq_iov[(*num_iovs)++] = *iov; 2764 memset(iov, 0, sizeof(*iov)); 2765 } 2766 } 2767 2768 static int 2769 alloc_path_with_tree_prefix(__le16 **out_path, int *out_size, int *out_len, 2770 const char *treename, const __le16 *path) 2771 { 2772 int treename_len, path_len; 2773 struct nls_table *cp; 2774 const __le16 sep[] = {cpu_to_le16('\\'), cpu_to_le16(0x0000)}; 2775 2776 /* 2777 * skip leading "\\" 2778 */ 2779 treename_len = strlen(treename); 2780 if (treename_len < 2 || !(treename[0] == '\\' && treename[1] == '\\')) 2781 return -EINVAL; 2782 2783 treename += 2; 2784 treename_len -= 2; 2785 2786 path_len = UniStrnlen((wchar_t *)path, PATH_MAX); 2787 2788 /* make room for one path separator only if @path isn't empty */ 2789 *out_len = treename_len + (path[0] ? 1 : 0) + path_len; 2790 2791 /* 2792 * final path needs to be 8-byte aligned as specified in 2793 * MS-SMB2 2.2.13 SMB2 CREATE Request. 2794 */ 2795 *out_size = round_up(*out_len * sizeof(__le16), 8); 2796 *out_path = kzalloc(*out_size + sizeof(__le16) /* null */, GFP_KERNEL); 2797 if (!*out_path) 2798 return -ENOMEM; 2799 2800 cp = load_nls_default(); 2801 cifs_strtoUTF16(*out_path, treename, treename_len, cp); 2802 2803 /* Do not append the separator if the path is empty */ 2804 if (path[0] != cpu_to_le16(0x0000)) { 2805 UniStrcat((wchar_t *)*out_path, (wchar_t *)sep); 2806 UniStrcat((wchar_t *)*out_path, (wchar_t *)path); 2807 } 2808 2809 unload_nls(cp); 2810 2811 return 0; 2812 } 2813 2814 int smb311_posix_mkdir(const unsigned int xid, struct inode *inode, 2815 umode_t mode, struct cifs_tcon *tcon, 2816 const char *full_path, 2817 struct cifs_sb_info *cifs_sb) 2818 { 2819 struct smb_rqst rqst; 2820 struct smb2_create_req *req; 2821 struct smb2_create_rsp *rsp = NULL; 2822 struct cifs_ses *ses = tcon->ses; 2823 struct kvec iov[3]; /* make sure at least one for each open context */ 2824 struct kvec rsp_iov = {NULL, 0}; 2825 int resp_buftype; 2826 int uni_path_len; 2827 __le16 *copy_path = NULL; 2828 int copy_size; 2829 int rc = 0; 2830 unsigned int n_iov = 2; 2831 __u32 file_attributes = 0; 2832 char *pc_buf = NULL; 2833 int flags = 0; 2834 unsigned int total_len; 2835 __le16 *utf16_path = NULL; 2836 struct TCP_Server_Info *server; 2837 int retries = 0, cur_sleep = 1; 2838 2839 replay_again: 2840 /* reinitialize for possible replay */ 2841 flags = 0; 2842 n_iov = 2; 2843 server = cifs_pick_channel(ses); 2844 2845 cifs_dbg(FYI, "mkdir\n"); 2846 2847 /* resource #1: path allocation */ 2848 utf16_path = cifs_convert_path_to_utf16(full_path, cifs_sb); 2849 if (!utf16_path) 2850 return -ENOMEM; 2851 2852 if (!ses || !server) { 2853 rc = -EIO; 2854 goto err_free_path; 2855 } 2856 2857 /* resource #2: request */ 2858 rc = smb2_plain_req_init(SMB2_CREATE, tcon, server, 2859 (void **) &req, &total_len); 2860 if (rc) 2861 goto err_free_path; 2862 2863 2864 if (smb3_encryption_required(tcon)) 2865 flags |= CIFS_TRANSFORM_REQ; 2866 2867 req->ImpersonationLevel = IL_IMPERSONATION; 2868 req->DesiredAccess = cpu_to_le32(FILE_WRITE_ATTRIBUTES); 2869 /* File attributes ignored on open (used in create though) */ 2870 req->FileAttributes = cpu_to_le32(file_attributes); 2871 req->ShareAccess = FILE_SHARE_ALL_LE; 2872 req->CreateDisposition = cpu_to_le32(FILE_CREATE); 2873 req->CreateOptions = cpu_to_le32(CREATE_NOT_FILE); 2874 2875 iov[0].iov_base = (char *)req; 2876 /* -1 since last byte is buf[0] which is sent below (path) */ 2877 iov[0].iov_len = total_len - 1; 2878 2879 req->NameOffset = cpu_to_le16(sizeof(struct smb2_create_req)); 2880 2881 /* [MS-SMB2] 2.2.13 NameOffset: 2882 * If SMB2_FLAGS_DFS_OPERATIONS is set in the Flags field of 2883 * the SMB2 header, the file name includes a prefix that will 2884 * be processed during DFS name normalization as specified in 2885 * section 3.3.5.9. Otherwise, the file name is relative to 2886 * the share that is identified by the TreeId in the SMB2 2887 * header. 2888 */ 2889 if (tcon->share_flags & SHI1005_FLAGS_DFS) { 2890 int name_len; 2891 2892 req->hdr.Flags |= SMB2_FLAGS_DFS_OPERATIONS; 2893 rc = alloc_path_with_tree_prefix(©_path, ©_size, 2894 &name_len, 2895 tcon->tree_name, utf16_path); 2896 if (rc) 2897 goto err_free_req; 2898 2899 req->NameLength = cpu_to_le16(name_len * 2); 2900 uni_path_len = copy_size; 2901 /* free before overwriting resource */ 2902 kfree(utf16_path); 2903 utf16_path = copy_path; 2904 } else { 2905 uni_path_len = (2 * UniStrnlen((wchar_t *)utf16_path, PATH_MAX)) + 2; 2906 /* MUST set path len (NameLength) to 0 opening root of share */ 2907 req->NameLength = cpu_to_le16(uni_path_len - 2); 2908 if (uni_path_len % 8 != 0) { 2909 copy_size = roundup(uni_path_len, 8); 2910 copy_path = kzalloc(copy_size, GFP_KERNEL); 2911 if (!copy_path) { 2912 rc = -ENOMEM; 2913 goto err_free_req; 2914 } 2915 memcpy((char *)copy_path, (const char *)utf16_path, 2916 uni_path_len); 2917 uni_path_len = copy_size; 2918 /* free before overwriting resource */ 2919 kfree(utf16_path); 2920 utf16_path = copy_path; 2921 } 2922 } 2923 2924 iov[1].iov_len = uni_path_len; 2925 iov[1].iov_base = utf16_path; 2926 req->RequestedOplockLevel = SMB2_OPLOCK_LEVEL_NONE; 2927 2928 if (tcon->posix_extensions) { 2929 /* resource #3: posix buf */ 2930 rc = add_posix_context(iov, &n_iov, mode); 2931 if (rc) 2932 goto err_free_req; 2933 req->CreateContextsOffset = cpu_to_le32( 2934 sizeof(struct smb2_create_req) + 2935 iov[1].iov_len); 2936 pc_buf = iov[n_iov-1].iov_base; 2937 } 2938 2939 2940 memset(&rqst, 0, sizeof(struct smb_rqst)); 2941 rqst.rq_iov = iov; 2942 rqst.rq_nvec = n_iov; 2943 2944 /* no need to inc num_remote_opens because we close it just below */ 2945 trace_smb3_posix_mkdir_enter(xid, tcon->tid, ses->Suid, full_path, CREATE_NOT_FILE, 2946 FILE_WRITE_ATTRIBUTES); 2947 2948 if (retries) 2949 smb2_set_replay(server, &rqst); 2950 2951 /* resource #4: response buffer */ 2952 rc = cifs_send_recv(xid, ses, server, 2953 &rqst, &resp_buftype, flags, &rsp_iov); 2954 if (rc) { 2955 cifs_stats_fail_inc(tcon, SMB2_CREATE_HE); 2956 trace_smb3_posix_mkdir_err(xid, tcon->tid, ses->Suid, 2957 CREATE_NOT_FILE, 2958 FILE_WRITE_ATTRIBUTES, rc); 2959 goto err_free_rsp_buf; 2960 } 2961 2962 /* 2963 * Although unlikely to be possible for rsp to be null and rc not set, 2964 * adding check below is slightly safer long term (and quiets Coverity 2965 * warning) 2966 */ 2967 rsp = (struct smb2_create_rsp *)rsp_iov.iov_base; 2968 if (rsp == NULL) { 2969 rc = -EIO; 2970 kfree(pc_buf); 2971 goto err_free_req; 2972 } 2973 2974 trace_smb3_posix_mkdir_done(xid, rsp->PersistentFileId, tcon->tid, ses->Suid, 2975 CREATE_NOT_FILE, FILE_WRITE_ATTRIBUTES); 2976 2977 SMB2_close(xid, tcon, rsp->PersistentFileId, rsp->VolatileFileId); 2978 2979 /* Eventually save off posix specific response info and timestaps */ 2980 2981 err_free_rsp_buf: 2982 free_rsp_buf(resp_buftype, rsp); 2983 kfree(pc_buf); 2984 err_free_req: 2985 cifs_small_buf_release(req); 2986 err_free_path: 2987 kfree(utf16_path); 2988 2989 if (is_replayable_error(rc) && 2990 smb2_should_replay(tcon, &retries, &cur_sleep)) 2991 goto replay_again; 2992 2993 return rc; 2994 } 2995 2996 int 2997 SMB2_open_init(struct cifs_tcon *tcon, struct TCP_Server_Info *server, 2998 struct smb_rqst *rqst, __u8 *oplock, 2999 struct cifs_open_parms *oparms, __le16 *path) 3000 { 3001 struct smb2_create_req *req; 3002 unsigned int n_iov = 2; 3003 __u32 file_attributes = 0; 3004 int copy_size; 3005 int uni_path_len; 3006 unsigned int total_len; 3007 struct kvec *iov = rqst->rq_iov; 3008 __le16 *copy_path; 3009 int rc; 3010 3011 rc = smb2_plain_req_init(SMB2_CREATE, tcon, server, 3012 (void **) &req, &total_len); 3013 if (rc) 3014 return rc; 3015 3016 iov[0].iov_base = (char *)req; 3017 /* -1 since last byte is buf[0] which is sent below (path) */ 3018 iov[0].iov_len = total_len - 1; 3019 3020 if (oparms->create_options & CREATE_OPTION_READONLY) 3021 file_attributes |= ATTR_READONLY; 3022 if (oparms->create_options & CREATE_OPTION_SPECIAL) 3023 file_attributes |= ATTR_SYSTEM; 3024 3025 req->ImpersonationLevel = IL_IMPERSONATION; 3026 req->DesiredAccess = cpu_to_le32(oparms->desired_access); 3027 /* File attributes ignored on open (used in create though) */ 3028 req->FileAttributes = cpu_to_le32(file_attributes); 3029 req->ShareAccess = FILE_SHARE_ALL_LE; 3030 3031 req->CreateDisposition = cpu_to_le32(oparms->disposition); 3032 req->CreateOptions = cpu_to_le32(oparms->create_options & CREATE_OPTIONS_MASK); 3033 req->NameOffset = cpu_to_le16(sizeof(struct smb2_create_req)); 3034 3035 /* [MS-SMB2] 2.2.13 NameOffset: 3036 * If SMB2_FLAGS_DFS_OPERATIONS is set in the Flags field of 3037 * the SMB2 header, the file name includes a prefix that will 3038 * be processed during DFS name normalization as specified in 3039 * section 3.3.5.9. Otherwise, the file name is relative to 3040 * the share that is identified by the TreeId in the SMB2 3041 * header. 3042 */ 3043 if (tcon->share_flags & SHI1005_FLAGS_DFS) { 3044 int name_len; 3045 3046 req->hdr.Flags |= SMB2_FLAGS_DFS_OPERATIONS; 3047 rc = alloc_path_with_tree_prefix(©_path, ©_size, 3048 &name_len, 3049 tcon->tree_name, path); 3050 if (rc) 3051 return rc; 3052 req->NameLength = cpu_to_le16(name_len * 2); 3053 uni_path_len = copy_size; 3054 path = copy_path; 3055 } else { 3056 uni_path_len = (2 * UniStrnlen((wchar_t *)path, PATH_MAX)) + 2; 3057 /* MUST set path len (NameLength) to 0 opening root of share */ 3058 req->NameLength = cpu_to_le16(uni_path_len - 2); 3059 copy_size = round_up(uni_path_len, 8); 3060 copy_path = kzalloc(copy_size, GFP_KERNEL); 3061 if (!copy_path) 3062 return -ENOMEM; 3063 memcpy((char *)copy_path, (const char *)path, 3064 uni_path_len); 3065 uni_path_len = copy_size; 3066 path = copy_path; 3067 } 3068 3069 iov[1].iov_len = uni_path_len; 3070 iov[1].iov_base = path; 3071 3072 if ((!server->oplocks) || (tcon->no_lease)) 3073 *oplock = SMB2_OPLOCK_LEVEL_NONE; 3074 3075 if (!(server->capabilities & SMB2_GLOBAL_CAP_LEASING) || 3076 *oplock == SMB2_OPLOCK_LEVEL_NONE) 3077 req->RequestedOplockLevel = *oplock; 3078 else if (!(server->capabilities & SMB2_GLOBAL_CAP_DIRECTORY_LEASING) && 3079 (oparms->create_options & CREATE_NOT_FILE)) 3080 req->RequestedOplockLevel = *oplock; /* no srv lease support */ 3081 else { 3082 rc = add_lease_context(server, req, iov, &n_iov, 3083 oparms->fid->lease_key, oplock); 3084 if (rc) 3085 return rc; 3086 } 3087 3088 if (*oplock == SMB2_OPLOCK_LEVEL_BATCH) { 3089 rc = add_durable_context(iov, &n_iov, oparms, 3090 tcon->use_persistent); 3091 if (rc) 3092 return rc; 3093 } 3094 3095 if (tcon->posix_extensions) { 3096 rc = add_posix_context(iov, &n_iov, oparms->mode); 3097 if (rc) 3098 return rc; 3099 } 3100 3101 if (tcon->snapshot_time) { 3102 cifs_dbg(FYI, "adding snapshot context\n"); 3103 rc = add_twarp_context(iov, &n_iov, tcon->snapshot_time); 3104 if (rc) 3105 return rc; 3106 } 3107 3108 if ((oparms->disposition != FILE_OPEN) && (oparms->cifs_sb)) { 3109 bool set_mode; 3110 bool set_owner; 3111 3112 if ((oparms->cifs_sb->mnt_cifs_flags & CIFS_MOUNT_MODE_FROM_SID) && 3113 (oparms->mode != ACL_NO_MODE)) 3114 set_mode = true; 3115 else { 3116 set_mode = false; 3117 oparms->mode = ACL_NO_MODE; 3118 } 3119 3120 if (oparms->cifs_sb->mnt_cifs_flags & CIFS_MOUNT_UID_FROM_ACL) 3121 set_owner = true; 3122 else 3123 set_owner = false; 3124 3125 if (set_owner | set_mode) { 3126 cifs_dbg(FYI, "add sd with mode 0x%x\n", oparms->mode); 3127 rc = add_sd_context(iov, &n_iov, oparms->mode, set_owner); 3128 if (rc) 3129 return rc; 3130 } 3131 } 3132 3133 add_query_id_context(iov, &n_iov); 3134 add_ea_context(oparms, iov, &n_iov); 3135 3136 if (n_iov > 2) { 3137 /* 3138 * We have create contexts behind iov[1] (the file 3139 * name), point at them from the main create request 3140 */ 3141 req->CreateContextsOffset = cpu_to_le32( 3142 sizeof(struct smb2_create_req) + 3143 iov[1].iov_len); 3144 req->CreateContextsLength = 0; 3145 3146 for (unsigned int i = 2; i < (n_iov-1); i++) { 3147 struct kvec *v = &iov[i]; 3148 size_t len = v->iov_len; 3149 struct create_context *cctx = 3150 (struct create_context *)v->iov_base; 3151 3152 cctx->Next = cpu_to_le32(len); 3153 le32_add_cpu(&req->CreateContextsLength, len); 3154 } 3155 le32_add_cpu(&req->CreateContextsLength, 3156 iov[n_iov-1].iov_len); 3157 } 3158 3159 rqst->rq_nvec = n_iov; 3160 return 0; 3161 } 3162 3163 /* rq_iov[0] is the request and is released by cifs_small_buf_release(). 3164 * All other vectors are freed by kfree(). 3165 */ 3166 void 3167 SMB2_open_free(struct smb_rqst *rqst) 3168 { 3169 int i; 3170 3171 if (rqst && rqst->rq_iov) { 3172 cifs_small_buf_release(rqst->rq_iov[0].iov_base); 3173 for (i = 1; i < rqst->rq_nvec; i++) 3174 if (rqst->rq_iov[i].iov_base != smb2_padding) 3175 kfree(rqst->rq_iov[i].iov_base); 3176 } 3177 } 3178 3179 int 3180 SMB2_open(const unsigned int xid, struct cifs_open_parms *oparms, __le16 *path, 3181 __u8 *oplock, struct smb2_file_all_info *buf, 3182 struct create_posix_rsp *posix, 3183 struct kvec *err_iov, int *buftype) 3184 { 3185 struct smb_rqst rqst; 3186 struct smb2_create_rsp *rsp = NULL; 3187 struct cifs_tcon *tcon = oparms->tcon; 3188 struct cifs_ses *ses = tcon->ses; 3189 struct TCP_Server_Info *server; 3190 struct kvec iov[SMB2_CREATE_IOV_SIZE]; 3191 struct kvec rsp_iov = {NULL, 0}; 3192 int resp_buftype = CIFS_NO_BUFFER; 3193 int rc = 0; 3194 int flags = 0; 3195 int retries = 0, cur_sleep = 1; 3196 3197 replay_again: 3198 /* reinitialize for possible replay */ 3199 flags = 0; 3200 server = cifs_pick_channel(ses); 3201 oparms->replay = !!(retries); 3202 3203 cifs_dbg(FYI, "create/open\n"); 3204 if (!ses || !server) 3205 return -EIO; 3206 3207 if (smb3_encryption_required(tcon)) 3208 flags |= CIFS_TRANSFORM_REQ; 3209 3210 memset(&rqst, 0, sizeof(struct smb_rqst)); 3211 memset(&iov, 0, sizeof(iov)); 3212 rqst.rq_iov = iov; 3213 rqst.rq_nvec = SMB2_CREATE_IOV_SIZE; 3214 3215 rc = SMB2_open_init(tcon, server, 3216 &rqst, oplock, oparms, path); 3217 if (rc) 3218 goto creat_exit; 3219 3220 trace_smb3_open_enter(xid, tcon->tid, tcon->ses->Suid, oparms->path, 3221 oparms->create_options, oparms->desired_access); 3222 3223 if (retries) 3224 smb2_set_replay(server, &rqst); 3225 3226 rc = cifs_send_recv(xid, ses, server, 3227 &rqst, &resp_buftype, flags, 3228 &rsp_iov); 3229 rsp = (struct smb2_create_rsp *)rsp_iov.iov_base; 3230 3231 if (rc != 0) { 3232 cifs_stats_fail_inc(tcon, SMB2_CREATE_HE); 3233 if (err_iov && rsp) { 3234 *err_iov = rsp_iov; 3235 *buftype = resp_buftype; 3236 resp_buftype = CIFS_NO_BUFFER; 3237 rsp = NULL; 3238 } 3239 trace_smb3_open_err(xid, tcon->tid, ses->Suid, 3240 oparms->create_options, oparms->desired_access, rc); 3241 if (rc == -EREMCHG) { 3242 pr_warn_once("server share %s deleted\n", 3243 tcon->tree_name); 3244 tcon->need_reconnect = true; 3245 } 3246 goto creat_exit; 3247 } else if (rsp == NULL) /* unlikely to happen, but safer to check */ 3248 goto creat_exit; 3249 else 3250 trace_smb3_open_done(xid, rsp->PersistentFileId, tcon->tid, ses->Suid, 3251 oparms->create_options, oparms->desired_access); 3252 3253 atomic_inc(&tcon->num_remote_opens); 3254 oparms->fid->persistent_fid = rsp->PersistentFileId; 3255 oparms->fid->volatile_fid = rsp->VolatileFileId; 3256 oparms->fid->access = oparms->desired_access; 3257 #ifdef CONFIG_CIFS_DEBUG2 3258 oparms->fid->mid = le64_to_cpu(rsp->hdr.MessageId); 3259 #endif /* CIFS_DEBUG2 */ 3260 3261 if (buf) { 3262 buf->CreationTime = rsp->CreationTime; 3263 buf->LastAccessTime = rsp->LastAccessTime; 3264 buf->LastWriteTime = rsp->LastWriteTime; 3265 buf->ChangeTime = rsp->ChangeTime; 3266 buf->AllocationSize = rsp->AllocationSize; 3267 buf->EndOfFile = rsp->EndofFile; 3268 buf->Attributes = rsp->FileAttributes; 3269 buf->NumberOfLinks = cpu_to_le32(1); 3270 buf->DeletePending = 0; 3271 } 3272 3273 3274 rc = smb2_parse_contexts(server, &rsp_iov, &oparms->fid->epoch, 3275 oparms->fid->lease_key, oplock, buf, posix); 3276 creat_exit: 3277 SMB2_open_free(&rqst); 3278 free_rsp_buf(resp_buftype, rsp); 3279 3280 if (is_replayable_error(rc) && 3281 smb2_should_replay(tcon, &retries, &cur_sleep)) 3282 goto replay_again; 3283 3284 return rc; 3285 } 3286 3287 int 3288 SMB2_ioctl_init(struct cifs_tcon *tcon, struct TCP_Server_Info *server, 3289 struct smb_rqst *rqst, 3290 u64 persistent_fid, u64 volatile_fid, u32 opcode, 3291 char *in_data, u32 indatalen, 3292 __u32 max_response_size) 3293 { 3294 struct smb2_ioctl_req *req; 3295 struct kvec *iov = rqst->rq_iov; 3296 unsigned int total_len; 3297 int rc; 3298 char *in_data_buf; 3299 3300 rc = smb2_ioctl_req_init(opcode, tcon, server, 3301 (void **) &req, &total_len); 3302 if (rc) 3303 return rc; 3304 3305 if (indatalen) { 3306 /* 3307 * indatalen is usually small at a couple of bytes max, so 3308 * just allocate through generic pool 3309 */ 3310 in_data_buf = kmemdup(in_data, indatalen, GFP_NOFS); 3311 if (!in_data_buf) { 3312 cifs_small_buf_release(req); 3313 return -ENOMEM; 3314 } 3315 } 3316 3317 req->CtlCode = cpu_to_le32(opcode); 3318 req->PersistentFileId = persistent_fid; 3319 req->VolatileFileId = volatile_fid; 3320 3321 iov[0].iov_base = (char *)req; 3322 /* 3323 * If no input data, the size of ioctl struct in 3324 * protocol spec still includes a 1 byte data buffer, 3325 * but if input data passed to ioctl, we do not 3326 * want to double count this, so we do not send 3327 * the dummy one byte of data in iovec[0] if sending 3328 * input data (in iovec[1]). 3329 */ 3330 if (indatalen) { 3331 req->InputCount = cpu_to_le32(indatalen); 3332 /* do not set InputOffset if no input data */ 3333 req->InputOffset = 3334 cpu_to_le32(offsetof(struct smb2_ioctl_req, Buffer)); 3335 rqst->rq_nvec = 2; 3336 iov[0].iov_len = total_len - 1; 3337 iov[1].iov_base = in_data_buf; 3338 iov[1].iov_len = indatalen; 3339 } else { 3340 rqst->rq_nvec = 1; 3341 iov[0].iov_len = total_len; 3342 } 3343 3344 req->OutputOffset = 0; 3345 req->OutputCount = 0; /* MBZ */ 3346 3347 /* 3348 * In most cases max_response_size is set to 16K (CIFSMaxBufSize) 3349 * We Could increase default MaxOutputResponse, but that could require 3350 * more credits. Windows typically sets this smaller, but for some 3351 * ioctls it may be useful to allow server to send more. No point 3352 * limiting what the server can send as long as fits in one credit 3353 * We can not handle more than CIFS_MAX_BUF_SIZE yet but may want 3354 * to increase this limit up in the future. 3355 * Note that for snapshot queries that servers like Azure expect that 3356 * the first query be minimal size (and just used to get the number/size 3357 * of previous versions) so response size must be specified as EXACTLY 3358 * sizeof(struct snapshot_array) which is 16 when rounded up to multiple 3359 * of eight bytes. Currently that is the only case where we set max 3360 * response size smaller. 3361 */ 3362 req->MaxOutputResponse = cpu_to_le32(max_response_size); 3363 req->hdr.CreditCharge = 3364 cpu_to_le16(DIV_ROUND_UP(max(indatalen, max_response_size), 3365 SMB2_MAX_BUFFER_SIZE)); 3366 /* always an FSCTL (for now) */ 3367 req->Flags = cpu_to_le32(SMB2_0_IOCTL_IS_FSCTL); 3368 3369 /* validate negotiate request must be signed - see MS-SMB2 3.2.5.5 */ 3370 if (opcode == FSCTL_VALIDATE_NEGOTIATE_INFO) 3371 req->hdr.Flags |= SMB2_FLAGS_SIGNED; 3372 3373 return 0; 3374 } 3375 3376 void 3377 SMB2_ioctl_free(struct smb_rqst *rqst) 3378 { 3379 int i; 3380 3381 if (rqst && rqst->rq_iov) { 3382 cifs_small_buf_release(rqst->rq_iov[0].iov_base); /* request */ 3383 for (i = 1; i < rqst->rq_nvec; i++) 3384 if (rqst->rq_iov[i].iov_base != smb2_padding) 3385 kfree(rqst->rq_iov[i].iov_base); 3386 } 3387 } 3388 3389 3390 /* 3391 * SMB2 IOCTL is used for both IOCTLs and FSCTLs 3392 */ 3393 int 3394 SMB2_ioctl(const unsigned int xid, struct cifs_tcon *tcon, u64 persistent_fid, 3395 u64 volatile_fid, u32 opcode, char *in_data, u32 indatalen, 3396 u32 max_out_data_len, char **out_data, 3397 u32 *plen /* returned data len */) 3398 { 3399 struct smb_rqst rqst; 3400 struct smb2_ioctl_rsp *rsp = NULL; 3401 struct cifs_ses *ses; 3402 struct TCP_Server_Info *server; 3403 struct kvec iov[SMB2_IOCTL_IOV_SIZE]; 3404 struct kvec rsp_iov = {NULL, 0}; 3405 int resp_buftype = CIFS_NO_BUFFER; 3406 int rc = 0; 3407 int flags = 0; 3408 int retries = 0, cur_sleep = 1; 3409 3410 if (!tcon) 3411 return -EIO; 3412 3413 ses = tcon->ses; 3414 if (!ses) 3415 return -EIO; 3416 3417 replay_again: 3418 /* reinitialize for possible replay */ 3419 flags = 0; 3420 server = cifs_pick_channel(ses); 3421 3422 if (!server) 3423 return -EIO; 3424 3425 cifs_dbg(FYI, "SMB2 IOCTL\n"); 3426 3427 if (out_data != NULL) 3428 *out_data = NULL; 3429 3430 /* zero out returned data len, in case of error */ 3431 if (plen) 3432 *plen = 0; 3433 3434 if (smb3_encryption_required(tcon)) 3435 flags |= CIFS_TRANSFORM_REQ; 3436 3437 memset(&rqst, 0, sizeof(struct smb_rqst)); 3438 memset(&iov, 0, sizeof(iov)); 3439 rqst.rq_iov = iov; 3440 rqst.rq_nvec = SMB2_IOCTL_IOV_SIZE; 3441 3442 rc = SMB2_ioctl_init(tcon, server, 3443 &rqst, persistent_fid, volatile_fid, opcode, 3444 in_data, indatalen, max_out_data_len); 3445 if (rc) 3446 goto ioctl_exit; 3447 3448 if (retries) 3449 smb2_set_replay(server, &rqst); 3450 3451 rc = cifs_send_recv(xid, ses, server, 3452 &rqst, &resp_buftype, flags, 3453 &rsp_iov); 3454 rsp = (struct smb2_ioctl_rsp *)rsp_iov.iov_base; 3455 3456 if (rc != 0) 3457 trace_smb3_fsctl_err(xid, persistent_fid, tcon->tid, 3458 ses->Suid, 0, opcode, rc); 3459 3460 if ((rc != 0) && (rc != -EINVAL) && (rc != -E2BIG)) { 3461 cifs_stats_fail_inc(tcon, SMB2_IOCTL_HE); 3462 goto ioctl_exit; 3463 } else if (rc == -EINVAL) { 3464 if ((opcode != FSCTL_SRV_COPYCHUNK_WRITE) && 3465 (opcode != FSCTL_SRV_COPYCHUNK)) { 3466 cifs_stats_fail_inc(tcon, SMB2_IOCTL_HE); 3467 goto ioctl_exit; 3468 } 3469 } else if (rc == -E2BIG) { 3470 if (opcode != FSCTL_QUERY_ALLOCATED_RANGES) { 3471 cifs_stats_fail_inc(tcon, SMB2_IOCTL_HE); 3472 goto ioctl_exit; 3473 } 3474 } 3475 3476 /* check if caller wants to look at return data or just return rc */ 3477 if ((plen == NULL) || (out_data == NULL)) 3478 goto ioctl_exit; 3479 3480 /* 3481 * Although unlikely to be possible for rsp to be null and rc not set, 3482 * adding check below is slightly safer long term (and quiets Coverity 3483 * warning) 3484 */ 3485 if (rsp == NULL) { 3486 rc = -EIO; 3487 goto ioctl_exit; 3488 } 3489 3490 *plen = le32_to_cpu(rsp->OutputCount); 3491 3492 /* We check for obvious errors in the output buffer length and offset */ 3493 if (*plen == 0) 3494 goto ioctl_exit; /* server returned no data */ 3495 else if (*plen > rsp_iov.iov_len || *plen > 0xFF00) { 3496 cifs_tcon_dbg(VFS, "srv returned invalid ioctl length: %d\n", *plen); 3497 *plen = 0; 3498 rc = -EIO; 3499 goto ioctl_exit; 3500 } 3501 3502 if (rsp_iov.iov_len - *plen < le32_to_cpu(rsp->OutputOffset)) { 3503 cifs_tcon_dbg(VFS, "Malformed ioctl resp: len %d offset %d\n", *plen, 3504 le32_to_cpu(rsp->OutputOffset)); 3505 *plen = 0; 3506 rc = -EIO; 3507 goto ioctl_exit; 3508 } 3509 3510 *out_data = kmemdup((char *)rsp + le32_to_cpu(rsp->OutputOffset), 3511 *plen, GFP_KERNEL); 3512 if (*out_data == NULL) { 3513 rc = -ENOMEM; 3514 goto ioctl_exit; 3515 } 3516 3517 ioctl_exit: 3518 SMB2_ioctl_free(&rqst); 3519 free_rsp_buf(resp_buftype, rsp); 3520 3521 if (is_replayable_error(rc) && 3522 smb2_should_replay(tcon, &retries, &cur_sleep)) 3523 goto replay_again; 3524 3525 return rc; 3526 } 3527 3528 /* 3529 * Individual callers to ioctl worker function follow 3530 */ 3531 3532 int 3533 SMB2_set_compression(const unsigned int xid, struct cifs_tcon *tcon, 3534 u64 persistent_fid, u64 volatile_fid) 3535 { 3536 int rc; 3537 struct compress_ioctl fsctl_input; 3538 char *ret_data = NULL; 3539 3540 fsctl_input.CompressionState = 3541 cpu_to_le16(COMPRESSION_FORMAT_DEFAULT); 3542 3543 rc = SMB2_ioctl(xid, tcon, persistent_fid, volatile_fid, 3544 FSCTL_SET_COMPRESSION, 3545 (char *)&fsctl_input /* data input */, 3546 2 /* in data len */, CIFSMaxBufSize /* max out data */, 3547 &ret_data /* out data */, NULL); 3548 3549 cifs_dbg(FYI, "set compression rc %d\n", rc); 3550 3551 return rc; 3552 } 3553 3554 int 3555 SMB2_close_init(struct cifs_tcon *tcon, struct TCP_Server_Info *server, 3556 struct smb_rqst *rqst, 3557 u64 persistent_fid, u64 volatile_fid, bool query_attrs) 3558 { 3559 struct smb2_close_req *req; 3560 struct kvec *iov = rqst->rq_iov; 3561 unsigned int total_len; 3562 int rc; 3563 3564 rc = smb2_plain_req_init(SMB2_CLOSE, tcon, server, 3565 (void **) &req, &total_len); 3566 if (rc) 3567 return rc; 3568 3569 req->PersistentFileId = persistent_fid; 3570 req->VolatileFileId = volatile_fid; 3571 if (query_attrs) 3572 req->Flags = SMB2_CLOSE_FLAG_POSTQUERY_ATTRIB; 3573 else 3574 req->Flags = 0; 3575 iov[0].iov_base = (char *)req; 3576 iov[0].iov_len = total_len; 3577 3578 return 0; 3579 } 3580 3581 void 3582 SMB2_close_free(struct smb_rqst *rqst) 3583 { 3584 if (rqst && rqst->rq_iov) 3585 cifs_small_buf_release(rqst->rq_iov[0].iov_base); /* request */ 3586 } 3587 3588 int 3589 __SMB2_close(const unsigned int xid, struct cifs_tcon *tcon, 3590 u64 persistent_fid, u64 volatile_fid, 3591 struct smb2_file_network_open_info *pbuf) 3592 { 3593 struct smb_rqst rqst; 3594 struct smb2_close_rsp *rsp = NULL; 3595 struct cifs_ses *ses = tcon->ses; 3596 struct TCP_Server_Info *server; 3597 struct kvec iov[1]; 3598 struct kvec rsp_iov; 3599 int resp_buftype = CIFS_NO_BUFFER; 3600 int rc = 0; 3601 int flags = 0; 3602 bool query_attrs = false; 3603 int retries = 0, cur_sleep = 1; 3604 3605 replay_again: 3606 /* reinitialize for possible replay */ 3607 flags = 0; 3608 query_attrs = false; 3609 server = cifs_pick_channel(ses); 3610 3611 cifs_dbg(FYI, "Close\n"); 3612 3613 if (!ses || !server) 3614 return -EIO; 3615 3616 if (smb3_encryption_required(tcon)) 3617 flags |= CIFS_TRANSFORM_REQ; 3618 3619 memset(&rqst, 0, sizeof(struct smb_rqst)); 3620 memset(&iov, 0, sizeof(iov)); 3621 rqst.rq_iov = iov; 3622 rqst.rq_nvec = 1; 3623 3624 /* check if need to ask server to return timestamps in close response */ 3625 if (pbuf) 3626 query_attrs = true; 3627 3628 trace_smb3_close_enter(xid, persistent_fid, tcon->tid, ses->Suid); 3629 rc = SMB2_close_init(tcon, server, 3630 &rqst, persistent_fid, volatile_fid, 3631 query_attrs); 3632 if (rc) 3633 goto close_exit; 3634 3635 if (retries) 3636 smb2_set_replay(server, &rqst); 3637 3638 rc = cifs_send_recv(xid, ses, server, 3639 &rqst, &resp_buftype, flags, &rsp_iov); 3640 rsp = (struct smb2_close_rsp *)rsp_iov.iov_base; 3641 3642 if (rc != 0) { 3643 cifs_stats_fail_inc(tcon, SMB2_CLOSE_HE); 3644 trace_smb3_close_err(xid, persistent_fid, tcon->tid, ses->Suid, 3645 rc); 3646 goto close_exit; 3647 } else { 3648 trace_smb3_close_done(xid, persistent_fid, tcon->tid, 3649 ses->Suid); 3650 if (pbuf) 3651 memcpy(&pbuf->network_open_info, 3652 &rsp->network_open_info, 3653 sizeof(pbuf->network_open_info)); 3654 atomic_dec(&tcon->num_remote_opens); 3655 } 3656 3657 close_exit: 3658 SMB2_close_free(&rqst); 3659 free_rsp_buf(resp_buftype, rsp); 3660 3661 /* retry close in a worker thread if this one is interrupted */ 3662 if (is_interrupt_error(rc)) { 3663 int tmp_rc; 3664 3665 tmp_rc = smb2_handle_cancelled_close(tcon, persistent_fid, 3666 volatile_fid); 3667 if (tmp_rc) 3668 cifs_dbg(VFS, "handle cancelled close fid 0x%llx returned error %d\n", 3669 persistent_fid, tmp_rc); 3670 } 3671 3672 if (is_replayable_error(rc) && 3673 smb2_should_replay(tcon, &retries, &cur_sleep)) 3674 goto replay_again; 3675 3676 return rc; 3677 } 3678 3679 int 3680 SMB2_close(const unsigned int xid, struct cifs_tcon *tcon, 3681 u64 persistent_fid, u64 volatile_fid) 3682 { 3683 return __SMB2_close(xid, tcon, persistent_fid, volatile_fid, NULL); 3684 } 3685 3686 int 3687 smb2_validate_iov(unsigned int offset, unsigned int buffer_length, 3688 struct kvec *iov, unsigned int min_buf_size) 3689 { 3690 unsigned int smb_len = iov->iov_len; 3691 char *end_of_smb = smb_len + (char *)iov->iov_base; 3692 char *begin_of_buf = offset + (char *)iov->iov_base; 3693 char *end_of_buf = begin_of_buf + buffer_length; 3694 3695 3696 if (buffer_length < min_buf_size) { 3697 cifs_dbg(VFS, "buffer length %d smaller than minimum size %d\n", 3698 buffer_length, min_buf_size); 3699 return -EINVAL; 3700 } 3701 3702 /* check if beyond RFC1001 maximum length */ 3703 if ((smb_len > 0x7FFFFF) || (buffer_length > 0x7FFFFF)) { 3704 cifs_dbg(VFS, "buffer length %d or smb length %d too large\n", 3705 buffer_length, smb_len); 3706 return -EINVAL; 3707 } 3708 3709 if ((begin_of_buf > end_of_smb) || (end_of_buf > end_of_smb)) { 3710 cifs_dbg(VFS, "Invalid server response, bad offset to data\n"); 3711 return -EINVAL; 3712 } 3713 3714 return 0; 3715 } 3716 3717 /* 3718 * If SMB buffer fields are valid, copy into temporary buffer to hold result. 3719 * Caller must free buffer. 3720 */ 3721 int 3722 smb2_validate_and_copy_iov(unsigned int offset, unsigned int buffer_length, 3723 struct kvec *iov, unsigned int minbufsize, 3724 char *data) 3725 { 3726 char *begin_of_buf = offset + (char *)iov->iov_base; 3727 int rc; 3728 3729 if (!data) 3730 return -EINVAL; 3731 3732 rc = smb2_validate_iov(offset, buffer_length, iov, minbufsize); 3733 if (rc) 3734 return rc; 3735 3736 memcpy(data, begin_of_buf, minbufsize); 3737 3738 return 0; 3739 } 3740 3741 int 3742 SMB2_query_info_init(struct cifs_tcon *tcon, struct TCP_Server_Info *server, 3743 struct smb_rqst *rqst, 3744 u64 persistent_fid, u64 volatile_fid, 3745 u8 info_class, u8 info_type, u32 additional_info, 3746 size_t output_len, size_t input_len, void *input) 3747 { 3748 struct smb2_query_info_req *req; 3749 struct kvec *iov = rqst->rq_iov; 3750 unsigned int total_len; 3751 size_t len; 3752 int rc; 3753 3754 if (unlikely(check_add_overflow(input_len, sizeof(*req), &len) || 3755 len > CIFSMaxBufSize)) 3756 return -EINVAL; 3757 3758 rc = smb2_plain_req_init(SMB2_QUERY_INFO, tcon, server, 3759 (void **) &req, &total_len); 3760 if (rc) 3761 return rc; 3762 3763 req->InfoType = info_type; 3764 req->FileInfoClass = info_class; 3765 req->PersistentFileId = persistent_fid; 3766 req->VolatileFileId = volatile_fid; 3767 req->AdditionalInformation = cpu_to_le32(additional_info); 3768 3769 req->OutputBufferLength = cpu_to_le32(output_len); 3770 if (input_len) { 3771 req->InputBufferLength = cpu_to_le32(input_len); 3772 /* total_len for smb query request never close to le16 max */ 3773 req->InputBufferOffset = cpu_to_le16(total_len - 1); 3774 memcpy(req->Buffer, input, input_len); 3775 } 3776 3777 iov[0].iov_base = (char *)req; 3778 /* 1 for Buffer */ 3779 iov[0].iov_len = len; 3780 return 0; 3781 } 3782 3783 void 3784 SMB2_query_info_free(struct smb_rqst *rqst) 3785 { 3786 if (rqst && rqst->rq_iov) 3787 cifs_buf_release(rqst->rq_iov[0].iov_base); /* request */ 3788 } 3789 3790 static int 3791 query_info(const unsigned int xid, struct cifs_tcon *tcon, 3792 u64 persistent_fid, u64 volatile_fid, u8 info_class, u8 info_type, 3793 u32 additional_info, size_t output_len, size_t min_len, void **data, 3794 u32 *dlen) 3795 { 3796 struct smb_rqst rqst; 3797 struct smb2_query_info_rsp *rsp = NULL; 3798 struct kvec iov[1]; 3799 struct kvec rsp_iov; 3800 int rc = 0; 3801 int resp_buftype = CIFS_NO_BUFFER; 3802 struct cifs_ses *ses = tcon->ses; 3803 struct TCP_Server_Info *server; 3804 int flags = 0; 3805 bool allocated = false; 3806 int retries = 0, cur_sleep = 1; 3807 3808 cifs_dbg(FYI, "Query Info\n"); 3809 3810 if (!ses) 3811 return -EIO; 3812 3813 replay_again: 3814 /* reinitialize for possible replay */ 3815 flags = 0; 3816 allocated = false; 3817 server = cifs_pick_channel(ses); 3818 3819 if (!server) 3820 return -EIO; 3821 3822 if (smb3_encryption_required(tcon)) 3823 flags |= CIFS_TRANSFORM_REQ; 3824 3825 memset(&rqst, 0, sizeof(struct smb_rqst)); 3826 memset(&iov, 0, sizeof(iov)); 3827 rqst.rq_iov = iov; 3828 rqst.rq_nvec = 1; 3829 3830 rc = SMB2_query_info_init(tcon, server, 3831 &rqst, persistent_fid, volatile_fid, 3832 info_class, info_type, additional_info, 3833 output_len, 0, NULL); 3834 if (rc) 3835 goto qinf_exit; 3836 3837 trace_smb3_query_info_enter(xid, persistent_fid, tcon->tid, 3838 ses->Suid, info_class, (__u32)info_type); 3839 3840 if (retries) 3841 smb2_set_replay(server, &rqst); 3842 3843 rc = cifs_send_recv(xid, ses, server, 3844 &rqst, &resp_buftype, flags, &rsp_iov); 3845 rsp = (struct smb2_query_info_rsp *)rsp_iov.iov_base; 3846 3847 if (rc) { 3848 cifs_stats_fail_inc(tcon, SMB2_QUERY_INFO_HE); 3849 trace_smb3_query_info_err(xid, persistent_fid, tcon->tid, 3850 ses->Suid, info_class, (__u32)info_type, rc); 3851 goto qinf_exit; 3852 } 3853 3854 trace_smb3_query_info_done(xid, persistent_fid, tcon->tid, 3855 ses->Suid, info_class, (__u32)info_type); 3856 3857 if (dlen) { 3858 *dlen = le32_to_cpu(rsp->OutputBufferLength); 3859 if (!*data) { 3860 *data = kmalloc(*dlen, GFP_KERNEL); 3861 if (!*data) { 3862 cifs_tcon_dbg(VFS, 3863 "Error %d allocating memory for acl\n", 3864 rc); 3865 *dlen = 0; 3866 rc = -ENOMEM; 3867 goto qinf_exit; 3868 } 3869 allocated = true; 3870 } 3871 } 3872 3873 rc = smb2_validate_and_copy_iov(le16_to_cpu(rsp->OutputBufferOffset), 3874 le32_to_cpu(rsp->OutputBufferLength), 3875 &rsp_iov, dlen ? *dlen : min_len, *data); 3876 if (rc && allocated) { 3877 kfree(*data); 3878 *data = NULL; 3879 *dlen = 0; 3880 } 3881 3882 qinf_exit: 3883 SMB2_query_info_free(&rqst); 3884 free_rsp_buf(resp_buftype, rsp); 3885 3886 if (is_replayable_error(rc) && 3887 smb2_should_replay(tcon, &retries, &cur_sleep)) 3888 goto replay_again; 3889 3890 return rc; 3891 } 3892 3893 int SMB2_query_info(const unsigned int xid, struct cifs_tcon *tcon, 3894 u64 persistent_fid, u64 volatile_fid, struct smb2_file_all_info *data) 3895 { 3896 return query_info(xid, tcon, persistent_fid, volatile_fid, 3897 FILE_ALL_INFORMATION, SMB2_O_INFO_FILE, 0, 3898 sizeof(struct smb2_file_all_info) + PATH_MAX * 2, 3899 sizeof(struct smb2_file_all_info), (void **)&data, 3900 NULL); 3901 } 3902 3903 #if 0 3904 /* currently unused, as now we are doing compounding instead (see smb311_posix_query_path_info) */ 3905 int 3906 SMB311_posix_query_info(const unsigned int xid, struct cifs_tcon *tcon, 3907 u64 persistent_fid, u64 volatile_fid, struct smb311_posix_qinfo *data, u32 *plen) 3908 { 3909 size_t output_len = sizeof(struct smb311_posix_qinfo *) + 3910 (sizeof(struct smb_sid) * 2) + (PATH_MAX * 2); 3911 *plen = 0; 3912 3913 return query_info(xid, tcon, persistent_fid, volatile_fid, 3914 SMB_FIND_FILE_POSIX_INFO, SMB2_O_INFO_FILE, 0, 3915 output_len, sizeof(struct smb311_posix_qinfo), (void **)&data, plen); 3916 /* Note caller must free "data" (passed in above). It may be allocated in query_info call */ 3917 } 3918 #endif 3919 3920 int 3921 SMB2_query_acl(const unsigned int xid, struct cifs_tcon *tcon, 3922 u64 persistent_fid, u64 volatile_fid, 3923 void **data, u32 *plen, u32 extra_info) 3924 { 3925 __u32 additional_info = OWNER_SECINFO | GROUP_SECINFO | DACL_SECINFO | 3926 extra_info; 3927 *plen = 0; 3928 3929 return query_info(xid, tcon, persistent_fid, volatile_fid, 3930 0, SMB2_O_INFO_SECURITY, additional_info, 3931 SMB2_MAX_BUFFER_SIZE, MIN_SEC_DESC_LEN, data, plen); 3932 } 3933 3934 int 3935 SMB2_get_srv_num(const unsigned int xid, struct cifs_tcon *tcon, 3936 u64 persistent_fid, u64 volatile_fid, __le64 *uniqueid) 3937 { 3938 return query_info(xid, tcon, persistent_fid, volatile_fid, 3939 FILE_INTERNAL_INFORMATION, SMB2_O_INFO_FILE, 0, 3940 sizeof(struct smb2_file_internal_info), 3941 sizeof(struct smb2_file_internal_info), 3942 (void **)&uniqueid, NULL); 3943 } 3944 3945 /* 3946 * CHANGE_NOTIFY Request is sent to get notifications on changes to a directory 3947 * See MS-SMB2 2.2.35 and 2.2.36 3948 */ 3949 3950 static int 3951 SMB2_notify_init(const unsigned int xid, struct smb_rqst *rqst, 3952 struct cifs_tcon *tcon, struct TCP_Server_Info *server, 3953 u64 persistent_fid, u64 volatile_fid, 3954 u32 completion_filter, bool watch_tree) 3955 { 3956 struct smb2_change_notify_req *req; 3957 struct kvec *iov = rqst->rq_iov; 3958 unsigned int total_len; 3959 int rc; 3960 3961 rc = smb2_plain_req_init(SMB2_CHANGE_NOTIFY, tcon, server, 3962 (void **) &req, &total_len); 3963 if (rc) 3964 return rc; 3965 3966 req->PersistentFileId = persistent_fid; 3967 req->VolatileFileId = volatile_fid; 3968 /* See note 354 of MS-SMB2, 64K max */ 3969 req->OutputBufferLength = 3970 cpu_to_le32(SMB2_MAX_BUFFER_SIZE - MAX_SMB2_HDR_SIZE); 3971 req->CompletionFilter = cpu_to_le32(completion_filter); 3972 if (watch_tree) 3973 req->Flags = cpu_to_le16(SMB2_WATCH_TREE); 3974 else 3975 req->Flags = 0; 3976 3977 iov[0].iov_base = (char *)req; 3978 iov[0].iov_len = total_len; 3979 3980 return 0; 3981 } 3982 3983 int 3984 SMB2_change_notify(const unsigned int xid, struct cifs_tcon *tcon, 3985 u64 persistent_fid, u64 volatile_fid, bool watch_tree, 3986 u32 completion_filter, u32 max_out_data_len, char **out_data, 3987 u32 *plen /* returned data len */) 3988 { 3989 struct cifs_ses *ses = tcon->ses; 3990 struct TCP_Server_Info *server; 3991 struct smb_rqst rqst; 3992 struct smb2_change_notify_rsp *smb_rsp; 3993 struct kvec iov[1]; 3994 struct kvec rsp_iov = {NULL, 0}; 3995 int resp_buftype = CIFS_NO_BUFFER; 3996 int flags = 0; 3997 int rc = 0; 3998 int retries = 0, cur_sleep = 1; 3999 4000 replay_again: 4001 /* reinitialize for possible replay */ 4002 flags = 0; 4003 server = cifs_pick_channel(ses); 4004 4005 cifs_dbg(FYI, "change notify\n"); 4006 if (!ses || !server) 4007 return -EIO; 4008 4009 if (smb3_encryption_required(tcon)) 4010 flags |= CIFS_TRANSFORM_REQ; 4011 4012 memset(&rqst, 0, sizeof(struct smb_rqst)); 4013 memset(&iov, 0, sizeof(iov)); 4014 if (plen) 4015 *plen = 0; 4016 4017 rqst.rq_iov = iov; 4018 rqst.rq_nvec = 1; 4019 4020 rc = SMB2_notify_init(xid, &rqst, tcon, server, 4021 persistent_fid, volatile_fid, 4022 completion_filter, watch_tree); 4023 if (rc) 4024 goto cnotify_exit; 4025 4026 trace_smb3_notify_enter(xid, persistent_fid, tcon->tid, ses->Suid, 4027 (u8)watch_tree, completion_filter); 4028 4029 if (retries) 4030 smb2_set_replay(server, &rqst); 4031 4032 rc = cifs_send_recv(xid, ses, server, 4033 &rqst, &resp_buftype, flags, &rsp_iov); 4034 4035 if (rc != 0) { 4036 cifs_stats_fail_inc(tcon, SMB2_CHANGE_NOTIFY_HE); 4037 trace_smb3_notify_err(xid, persistent_fid, tcon->tid, ses->Suid, 4038 (u8)watch_tree, completion_filter, rc); 4039 } else { 4040 trace_smb3_notify_done(xid, persistent_fid, tcon->tid, 4041 ses->Suid, (u8)watch_tree, completion_filter); 4042 /* validate that notify information is plausible */ 4043 if ((rsp_iov.iov_base == NULL) || 4044 (rsp_iov.iov_len < sizeof(struct smb2_change_notify_rsp) + 1)) 4045 goto cnotify_exit; 4046 4047 smb_rsp = (struct smb2_change_notify_rsp *)rsp_iov.iov_base; 4048 4049 smb2_validate_iov(le16_to_cpu(smb_rsp->OutputBufferOffset), 4050 le32_to_cpu(smb_rsp->OutputBufferLength), &rsp_iov, 4051 sizeof(struct file_notify_information)); 4052 4053 *out_data = kmemdup((char *)smb_rsp + le16_to_cpu(smb_rsp->OutputBufferOffset), 4054 le32_to_cpu(smb_rsp->OutputBufferLength), GFP_KERNEL); 4055 if (*out_data == NULL) { 4056 rc = -ENOMEM; 4057 goto cnotify_exit; 4058 } else if (plen) 4059 *plen = le32_to_cpu(smb_rsp->OutputBufferLength); 4060 } 4061 4062 cnotify_exit: 4063 if (rqst.rq_iov) 4064 cifs_small_buf_release(rqst.rq_iov[0].iov_base); /* request */ 4065 free_rsp_buf(resp_buftype, rsp_iov.iov_base); 4066 4067 if (is_replayable_error(rc) && 4068 smb2_should_replay(tcon, &retries, &cur_sleep)) 4069 goto replay_again; 4070 4071 return rc; 4072 } 4073 4074 4075 4076 /* 4077 * This is a no-op for now. We're not really interested in the reply, but 4078 * rather in the fact that the server sent one and that server->lstrp 4079 * gets updated. 4080 * 4081 * FIXME: maybe we should consider checking that the reply matches request? 4082 */ 4083 static void 4084 smb2_echo_callback(struct mid_q_entry *mid) 4085 { 4086 struct TCP_Server_Info *server = mid->callback_data; 4087 struct smb2_echo_rsp *rsp = (struct smb2_echo_rsp *)mid->resp_buf; 4088 struct cifs_credits credits = { .value = 0, .instance = 0 }; 4089 4090 if (mid->mid_state == MID_RESPONSE_RECEIVED 4091 || mid->mid_state == MID_RESPONSE_MALFORMED) { 4092 credits.value = le16_to_cpu(rsp->hdr.CreditRequest); 4093 credits.instance = server->reconnect_instance; 4094 } 4095 4096 release_mid(mid); 4097 add_credits(server, &credits, CIFS_ECHO_OP); 4098 } 4099 4100 void smb2_reconnect_server(struct work_struct *work) 4101 { 4102 struct TCP_Server_Info *server = container_of(work, 4103 struct TCP_Server_Info, reconnect.work); 4104 struct TCP_Server_Info *pserver; 4105 struct cifs_ses *ses, *ses2; 4106 struct cifs_tcon *tcon, *tcon2; 4107 struct list_head tmp_list, tmp_ses_list; 4108 bool ses_exist = false; 4109 bool tcon_selected = false; 4110 int rc; 4111 bool resched = false; 4112 4113 /* first check if ref count has reached 0, if not inc ref count */ 4114 spin_lock(&cifs_tcp_ses_lock); 4115 if (!server->srv_count) { 4116 spin_unlock(&cifs_tcp_ses_lock); 4117 return; 4118 } 4119 server->srv_count++; 4120 spin_unlock(&cifs_tcp_ses_lock); 4121 4122 /* If server is a channel, select the primary channel */ 4123 pserver = SERVER_IS_CHAN(server) ? server->primary_server : server; 4124 4125 /* Prevent simultaneous reconnects that can corrupt tcon->rlist list */ 4126 mutex_lock(&pserver->reconnect_mutex); 4127 4128 /* if the server is marked for termination, drop the ref count here */ 4129 if (server->terminate) { 4130 cifs_put_tcp_session(server, true); 4131 mutex_unlock(&pserver->reconnect_mutex); 4132 return; 4133 } 4134 4135 INIT_LIST_HEAD(&tmp_list); 4136 INIT_LIST_HEAD(&tmp_ses_list); 4137 cifs_dbg(FYI, "Reconnecting tcons and channels\n"); 4138 4139 spin_lock(&cifs_tcp_ses_lock); 4140 list_for_each_entry(ses, &pserver->smb_ses_list, smb_ses_list) { 4141 spin_lock(&ses->ses_lock); 4142 if (ses->ses_status == SES_EXITING) { 4143 spin_unlock(&ses->ses_lock); 4144 continue; 4145 } 4146 spin_unlock(&ses->ses_lock); 4147 4148 tcon_selected = false; 4149 4150 list_for_each_entry(tcon, &ses->tcon_list, tcon_list) { 4151 if (tcon->need_reconnect || tcon->need_reopen_files) { 4152 tcon->tc_count++; 4153 trace_smb3_tcon_ref(tcon->debug_id, tcon->tc_count, 4154 netfs_trace_tcon_ref_get_reconnect_server); 4155 list_add_tail(&tcon->rlist, &tmp_list); 4156 tcon_selected = true; 4157 } 4158 } 4159 /* 4160 * IPC has the same lifetime as its session and uses its 4161 * refcount. 4162 */ 4163 if (ses->tcon_ipc && ses->tcon_ipc->need_reconnect) { 4164 list_add_tail(&ses->tcon_ipc->rlist, &tmp_list); 4165 tcon_selected = true; 4166 cifs_smb_ses_inc_refcount(ses); 4167 } 4168 /* 4169 * handle the case where channel needs to reconnect 4170 * binding session, but tcon is healthy (some other channel 4171 * is active) 4172 */ 4173 spin_lock(&ses->chan_lock); 4174 if (!tcon_selected && cifs_chan_needs_reconnect(ses, server)) { 4175 list_add_tail(&ses->rlist, &tmp_ses_list); 4176 ses_exist = true; 4177 cifs_smb_ses_inc_refcount(ses); 4178 } 4179 spin_unlock(&ses->chan_lock); 4180 } 4181 spin_unlock(&cifs_tcp_ses_lock); 4182 4183 list_for_each_entry_safe(tcon, tcon2, &tmp_list, rlist) { 4184 rc = smb2_reconnect(SMB2_INTERNAL_CMD, tcon, server, true); 4185 if (!rc) 4186 cifs_reopen_persistent_handles(tcon); 4187 else 4188 resched = true; 4189 list_del_init(&tcon->rlist); 4190 if (tcon->ipc) 4191 cifs_put_smb_ses(tcon->ses); 4192 else 4193 cifs_put_tcon(tcon, netfs_trace_tcon_ref_put_reconnect_server); 4194 } 4195 4196 if (!ses_exist) 4197 goto done; 4198 4199 /* allocate a dummy tcon struct used for reconnect */ 4200 tcon = tcon_info_alloc(false, netfs_trace_tcon_ref_new_reconnect_server); 4201 if (!tcon) { 4202 resched = true; 4203 list_for_each_entry_safe(ses, ses2, &tmp_ses_list, rlist) { 4204 list_del_init(&ses->rlist); 4205 cifs_put_smb_ses(ses); 4206 } 4207 goto done; 4208 } 4209 4210 tcon->status = TID_GOOD; 4211 tcon->retry = false; 4212 tcon->need_reconnect = false; 4213 4214 /* now reconnect sessions for necessary channels */ 4215 list_for_each_entry_safe(ses, ses2, &tmp_ses_list, rlist) { 4216 tcon->ses = ses; 4217 rc = smb2_reconnect(SMB2_INTERNAL_CMD, tcon, server, true); 4218 if (rc) 4219 resched = true; 4220 list_del_init(&ses->rlist); 4221 cifs_put_smb_ses(ses); 4222 } 4223 tconInfoFree(tcon, netfs_trace_tcon_ref_free_reconnect_server); 4224 4225 done: 4226 cifs_dbg(FYI, "Reconnecting tcons and channels finished\n"); 4227 if (resched) 4228 queue_delayed_work(cifsiod_wq, &server->reconnect, 2 * HZ); 4229 mutex_unlock(&pserver->reconnect_mutex); 4230 4231 /* now we can safely release srv struct */ 4232 cifs_put_tcp_session(server, true); 4233 } 4234 4235 int 4236 SMB2_echo(struct TCP_Server_Info *server) 4237 { 4238 struct smb2_echo_req *req; 4239 int rc = 0; 4240 struct kvec iov[1]; 4241 struct smb_rqst rqst = { .rq_iov = iov, 4242 .rq_nvec = 1 }; 4243 unsigned int total_len; 4244 4245 cifs_dbg(FYI, "In echo request for conn_id %lld\n", server->conn_id); 4246 4247 spin_lock(&server->srv_lock); 4248 if (server->ops->need_neg && 4249 server->ops->need_neg(server)) { 4250 spin_unlock(&server->srv_lock); 4251 /* No need to send echo on newly established connections */ 4252 mod_delayed_work(cifsiod_wq, &server->reconnect, 0); 4253 return rc; 4254 } 4255 spin_unlock(&server->srv_lock); 4256 4257 rc = smb2_plain_req_init(SMB2_ECHO, NULL, server, 4258 (void **)&req, &total_len); 4259 if (rc) 4260 return rc; 4261 4262 req->hdr.CreditRequest = cpu_to_le16(1); 4263 4264 iov[0].iov_len = total_len; 4265 iov[0].iov_base = (char *)req; 4266 4267 rc = cifs_call_async(server, &rqst, NULL, smb2_echo_callback, NULL, 4268 server, CIFS_ECHO_OP, NULL); 4269 if (rc) 4270 cifs_dbg(FYI, "Echo request failed: %d\n", rc); 4271 4272 cifs_small_buf_release(req); 4273 return rc; 4274 } 4275 4276 void 4277 SMB2_flush_free(struct smb_rqst *rqst) 4278 { 4279 if (rqst && rqst->rq_iov) 4280 cifs_small_buf_release(rqst->rq_iov[0].iov_base); /* request */ 4281 } 4282 4283 int 4284 SMB2_flush_init(const unsigned int xid, struct smb_rqst *rqst, 4285 struct cifs_tcon *tcon, struct TCP_Server_Info *server, 4286 u64 persistent_fid, u64 volatile_fid) 4287 { 4288 struct smb2_flush_req *req; 4289 struct kvec *iov = rqst->rq_iov; 4290 unsigned int total_len; 4291 int rc; 4292 4293 rc = smb2_plain_req_init(SMB2_FLUSH, tcon, server, 4294 (void **) &req, &total_len); 4295 if (rc) 4296 return rc; 4297 4298 req->PersistentFileId = persistent_fid; 4299 req->VolatileFileId = volatile_fid; 4300 4301 iov[0].iov_base = (char *)req; 4302 iov[0].iov_len = total_len; 4303 4304 return 0; 4305 } 4306 4307 int 4308 SMB2_flush(const unsigned int xid, struct cifs_tcon *tcon, u64 persistent_fid, 4309 u64 volatile_fid) 4310 { 4311 struct cifs_ses *ses = tcon->ses; 4312 struct smb_rqst rqst; 4313 struct kvec iov[1]; 4314 struct kvec rsp_iov = {NULL, 0}; 4315 struct TCP_Server_Info *server; 4316 int resp_buftype = CIFS_NO_BUFFER; 4317 int flags = 0; 4318 int rc = 0; 4319 int retries = 0, cur_sleep = 1; 4320 4321 replay_again: 4322 /* reinitialize for possible replay */ 4323 flags = 0; 4324 server = cifs_pick_channel(ses); 4325 4326 cifs_dbg(FYI, "flush\n"); 4327 if (!ses || !(ses->server)) 4328 return -EIO; 4329 4330 if (smb3_encryption_required(tcon)) 4331 flags |= CIFS_TRANSFORM_REQ; 4332 4333 memset(&rqst, 0, sizeof(struct smb_rqst)); 4334 memset(&iov, 0, sizeof(iov)); 4335 rqst.rq_iov = iov; 4336 rqst.rq_nvec = 1; 4337 4338 rc = SMB2_flush_init(xid, &rqst, tcon, server, 4339 persistent_fid, volatile_fid); 4340 if (rc) 4341 goto flush_exit; 4342 4343 trace_smb3_flush_enter(xid, persistent_fid, tcon->tid, ses->Suid); 4344 4345 if (retries) 4346 smb2_set_replay(server, &rqst); 4347 4348 rc = cifs_send_recv(xid, ses, server, 4349 &rqst, &resp_buftype, flags, &rsp_iov); 4350 4351 if (rc != 0) { 4352 cifs_stats_fail_inc(tcon, SMB2_FLUSH_HE); 4353 trace_smb3_flush_err(xid, persistent_fid, tcon->tid, ses->Suid, 4354 rc); 4355 } else 4356 trace_smb3_flush_done(xid, persistent_fid, tcon->tid, 4357 ses->Suid); 4358 4359 flush_exit: 4360 SMB2_flush_free(&rqst); 4361 free_rsp_buf(resp_buftype, rsp_iov.iov_base); 4362 4363 if (is_replayable_error(rc) && 4364 smb2_should_replay(tcon, &retries, &cur_sleep)) 4365 goto replay_again; 4366 4367 return rc; 4368 } 4369 4370 #ifdef CONFIG_CIFS_SMB_DIRECT 4371 static inline bool smb3_use_rdma_offload(struct cifs_io_parms *io_parms) 4372 { 4373 struct TCP_Server_Info *server = io_parms->server; 4374 struct cifs_tcon *tcon = io_parms->tcon; 4375 4376 /* we can only offload if we're connected */ 4377 if (!server || !tcon) 4378 return false; 4379 4380 /* we can only offload on an rdma connection */ 4381 if (!server->rdma || !server->smbd_conn) 4382 return false; 4383 4384 /* we don't support signed offload yet */ 4385 if (server->sign) 4386 return false; 4387 4388 /* we don't support encrypted offload yet */ 4389 if (smb3_encryption_required(tcon)) 4390 return false; 4391 4392 /* offload also has its overhead, so only do it if desired */ 4393 if (io_parms->length < server->smbd_conn->rdma_readwrite_threshold) 4394 return false; 4395 4396 return true; 4397 } 4398 #endif /* CONFIG_CIFS_SMB_DIRECT */ 4399 4400 /* 4401 * To form a chain of read requests, any read requests after the first should 4402 * have the end_of_chain boolean set to true. 4403 */ 4404 static int 4405 smb2_new_read_req(void **buf, unsigned int *total_len, 4406 struct cifs_io_parms *io_parms, struct cifs_io_subrequest *rdata, 4407 unsigned int remaining_bytes, int request_type) 4408 { 4409 int rc = -EACCES; 4410 struct smb2_read_req *req = NULL; 4411 struct smb2_hdr *shdr; 4412 struct TCP_Server_Info *server = io_parms->server; 4413 4414 rc = smb2_plain_req_init(SMB2_READ, io_parms->tcon, server, 4415 (void **) &req, total_len); 4416 if (rc) 4417 return rc; 4418 4419 if (server == NULL) 4420 return -ECONNABORTED; 4421 4422 shdr = &req->hdr; 4423 shdr->Id.SyncId.ProcessId = cpu_to_le32(io_parms->pid); 4424 4425 req->PersistentFileId = io_parms->persistent_fid; 4426 req->VolatileFileId = io_parms->volatile_fid; 4427 req->ReadChannelInfoOffset = 0; /* reserved */ 4428 req->ReadChannelInfoLength = 0; /* reserved */ 4429 req->Channel = 0; /* reserved */ 4430 req->MinimumCount = 0; 4431 req->Length = cpu_to_le32(io_parms->length); 4432 req->Offset = cpu_to_le64(io_parms->offset); 4433 4434 trace_smb3_read_enter(rdata ? rdata->rreq->debug_id : 0, 4435 rdata ? rdata->subreq.debug_index : 0, 4436 rdata ? rdata->xid : 0, 4437 io_parms->persistent_fid, 4438 io_parms->tcon->tid, io_parms->tcon->ses->Suid, 4439 io_parms->offset, io_parms->length); 4440 #ifdef CONFIG_CIFS_SMB_DIRECT 4441 /* 4442 * If we want to do a RDMA write, fill in and append 4443 * smbd_buffer_descriptor_v1 to the end of read request 4444 */ 4445 if (rdata && smb3_use_rdma_offload(io_parms)) { 4446 struct smbd_buffer_descriptor_v1 *v1; 4447 bool need_invalidate = server->dialect == SMB30_PROT_ID; 4448 4449 rdata->mr = smbd_register_mr(server->smbd_conn, &rdata->subreq.io_iter, 4450 true, need_invalidate); 4451 if (!rdata->mr) 4452 return -EAGAIN; 4453 4454 req->Channel = SMB2_CHANNEL_RDMA_V1_INVALIDATE; 4455 if (need_invalidate) 4456 req->Channel = SMB2_CHANNEL_RDMA_V1; 4457 req->ReadChannelInfoOffset = 4458 cpu_to_le16(offsetof(struct smb2_read_req, Buffer)); 4459 req->ReadChannelInfoLength = 4460 cpu_to_le16(sizeof(struct smbd_buffer_descriptor_v1)); 4461 v1 = (struct smbd_buffer_descriptor_v1 *) &req->Buffer[0]; 4462 v1->offset = cpu_to_le64(rdata->mr->mr->iova); 4463 v1->token = cpu_to_le32(rdata->mr->mr->rkey); 4464 v1->length = cpu_to_le32(rdata->mr->mr->length); 4465 4466 *total_len += sizeof(*v1) - 1; 4467 } 4468 #endif 4469 if (request_type & CHAINED_REQUEST) { 4470 if (!(request_type & END_OF_CHAIN)) { 4471 /* next 8-byte aligned request */ 4472 *total_len = ALIGN(*total_len, 8); 4473 shdr->NextCommand = cpu_to_le32(*total_len); 4474 } else /* END_OF_CHAIN */ 4475 shdr->NextCommand = 0; 4476 if (request_type & RELATED_REQUEST) { 4477 shdr->Flags |= SMB2_FLAGS_RELATED_OPERATIONS; 4478 /* 4479 * Related requests use info from previous read request 4480 * in chain. 4481 */ 4482 shdr->SessionId = cpu_to_le64(0xFFFFFFFFFFFFFFFF); 4483 shdr->Id.SyncId.TreeId = cpu_to_le32(0xFFFFFFFF); 4484 req->PersistentFileId = (u64)-1; 4485 req->VolatileFileId = (u64)-1; 4486 } 4487 } 4488 if (remaining_bytes > io_parms->length) 4489 req->RemainingBytes = cpu_to_le32(remaining_bytes); 4490 else 4491 req->RemainingBytes = 0; 4492 4493 *buf = req; 4494 return rc; 4495 } 4496 4497 static void smb2_readv_worker(struct work_struct *work) 4498 { 4499 struct cifs_io_subrequest *rdata = 4500 container_of(work, struct cifs_io_subrequest, subreq.work); 4501 4502 netfs_read_subreq_terminated(&rdata->subreq, rdata->result, false); 4503 } 4504 4505 static void 4506 smb2_readv_callback(struct mid_q_entry *mid) 4507 { 4508 struct cifs_io_subrequest *rdata = mid->callback_data; 4509 struct netfs_inode *ictx = netfs_inode(rdata->rreq->inode); 4510 struct cifs_tcon *tcon = tlink_tcon(rdata->req->cfile->tlink); 4511 struct TCP_Server_Info *server = rdata->server; 4512 struct smb2_hdr *shdr = 4513 (struct smb2_hdr *)rdata->iov[0].iov_base; 4514 struct cifs_credits credits = { 4515 .value = 0, 4516 .instance = 0, 4517 .rreq_debug_id = rdata->rreq->debug_id, 4518 .rreq_debug_index = rdata->subreq.debug_index, 4519 }; 4520 struct smb_rqst rqst = { .rq_iov = &rdata->iov[1], .rq_nvec = 1 }; 4521 unsigned int rreq_debug_id = rdata->rreq->debug_id; 4522 unsigned int subreq_debug_index = rdata->subreq.debug_index; 4523 4524 if (rdata->got_bytes) { 4525 rqst.rq_iter = rdata->subreq.io_iter; 4526 } 4527 4528 WARN_ONCE(rdata->server != mid->server, 4529 "rdata server %p != mid server %p", 4530 rdata->server, mid->server); 4531 4532 cifs_dbg(FYI, "%s: mid=%llu state=%d result=%d bytes=%zu/%zu\n", 4533 __func__, mid->mid, mid->mid_state, rdata->result, 4534 rdata->got_bytes, rdata->subreq.len - rdata->subreq.transferred); 4535 4536 switch (mid->mid_state) { 4537 case MID_RESPONSE_RECEIVED: 4538 credits.value = le16_to_cpu(shdr->CreditRequest); 4539 credits.instance = server->reconnect_instance; 4540 /* result already set, check signature */ 4541 if (server->sign && !mid->decrypted) { 4542 int rc; 4543 4544 iov_iter_truncate(&rqst.rq_iter, rdata->got_bytes); 4545 rc = smb2_verify_signature(&rqst, server); 4546 if (rc) 4547 cifs_tcon_dbg(VFS, "SMB signature verification returned error = %d\n", 4548 rc); 4549 } 4550 /* FIXME: should this be counted toward the initiating task? */ 4551 task_io_account_read(rdata->got_bytes); 4552 cifs_stats_bytes_read(tcon, rdata->got_bytes); 4553 break; 4554 case MID_REQUEST_SUBMITTED: 4555 case MID_RETRY_NEEDED: 4556 __set_bit(NETFS_SREQ_NEED_RETRY, &rdata->subreq.flags); 4557 rdata->result = -EAGAIN; 4558 if (server->sign && rdata->got_bytes) 4559 /* reset bytes number since we can not check a sign */ 4560 rdata->got_bytes = 0; 4561 /* FIXME: should this be counted toward the initiating task? */ 4562 task_io_account_read(rdata->got_bytes); 4563 cifs_stats_bytes_read(tcon, rdata->got_bytes); 4564 break; 4565 case MID_RESPONSE_MALFORMED: 4566 credits.value = le16_to_cpu(shdr->CreditRequest); 4567 credits.instance = server->reconnect_instance; 4568 fallthrough; 4569 default: 4570 rdata->result = -EIO; 4571 } 4572 #ifdef CONFIG_CIFS_SMB_DIRECT 4573 /* 4574 * If this rdata has a memmory registered, the MR can be freed 4575 * MR needs to be freed as soon as I/O finishes to prevent deadlock 4576 * because they have limited number and are used for future I/Os 4577 */ 4578 if (rdata->mr) { 4579 smbd_deregister_mr(rdata->mr); 4580 rdata->mr = NULL; 4581 } 4582 #endif 4583 if (rdata->result && rdata->result != -ENODATA) { 4584 cifs_stats_fail_inc(tcon, SMB2_READ_HE); 4585 trace_smb3_read_err(rdata->rreq->debug_id, 4586 rdata->subreq.debug_index, 4587 rdata->xid, 4588 rdata->req->cfile->fid.persistent_fid, 4589 tcon->tid, tcon->ses->Suid, 4590 rdata->subreq.start + rdata->subreq.transferred, 4591 rdata->subreq.len - rdata->subreq.transferred, 4592 rdata->result); 4593 } else 4594 trace_smb3_read_done(rdata->rreq->debug_id, 4595 rdata->subreq.debug_index, 4596 rdata->xid, 4597 rdata->req->cfile->fid.persistent_fid, 4598 tcon->tid, tcon->ses->Suid, 4599 rdata->subreq.start + rdata->subreq.transferred, 4600 rdata->got_bytes); 4601 4602 if (rdata->result == -ENODATA) { 4603 __set_bit(NETFS_SREQ_HIT_EOF, &rdata->subreq.flags); 4604 rdata->result = 0; 4605 } else { 4606 size_t trans = rdata->subreq.transferred + rdata->got_bytes; 4607 if (trans < rdata->subreq.len && 4608 rdata->subreq.start + trans == ictx->remote_i_size) { 4609 __set_bit(NETFS_SREQ_HIT_EOF, &rdata->subreq.flags); 4610 rdata->result = 0; 4611 } 4612 } 4613 trace_smb3_rw_credits(rreq_debug_id, subreq_debug_index, rdata->credits.value, 4614 server->credits, server->in_flight, 4615 0, cifs_trace_rw_credits_read_response_clear); 4616 rdata->credits.value = 0; 4617 rdata->subreq.transferred += rdata->got_bytes; 4618 trace_netfs_sreq(&rdata->subreq, netfs_sreq_trace_io_progress); 4619 INIT_WORK(&rdata->subreq.work, smb2_readv_worker); 4620 queue_work(cifsiod_wq, &rdata->subreq.work); 4621 release_mid(mid); 4622 trace_smb3_rw_credits(rreq_debug_id, subreq_debug_index, 0, 4623 server->credits, server->in_flight, 4624 credits.value, cifs_trace_rw_credits_read_response_add); 4625 add_credits(server, &credits, 0); 4626 } 4627 4628 /* smb2_async_readv - send an async read, and set up mid to handle result */ 4629 int 4630 smb2_async_readv(struct cifs_io_subrequest *rdata) 4631 { 4632 int rc, flags = 0; 4633 char *buf; 4634 struct netfs_io_subrequest *subreq = &rdata->subreq; 4635 struct smb2_hdr *shdr; 4636 struct cifs_io_parms io_parms; 4637 struct smb_rqst rqst = { .rq_iov = rdata->iov, 4638 .rq_nvec = 1 }; 4639 struct TCP_Server_Info *server; 4640 struct cifs_tcon *tcon = tlink_tcon(rdata->req->cfile->tlink); 4641 unsigned int total_len; 4642 int credit_request; 4643 4644 cifs_dbg(FYI, "%s: offset=%llu bytes=%zu\n", 4645 __func__, subreq->start, subreq->len); 4646 4647 if (!rdata->server) 4648 rdata->server = cifs_pick_channel(tcon->ses); 4649 4650 io_parms.tcon = tlink_tcon(rdata->req->cfile->tlink); 4651 io_parms.server = server = rdata->server; 4652 io_parms.offset = subreq->start + subreq->transferred; 4653 io_parms.length = subreq->len - subreq->transferred; 4654 io_parms.persistent_fid = rdata->req->cfile->fid.persistent_fid; 4655 io_parms.volatile_fid = rdata->req->cfile->fid.volatile_fid; 4656 io_parms.pid = rdata->req->pid; 4657 4658 rc = smb2_new_read_req( 4659 (void **) &buf, &total_len, &io_parms, rdata, 0, 0); 4660 if (rc) 4661 return rc; 4662 4663 if (smb3_encryption_required(io_parms.tcon)) 4664 flags |= CIFS_TRANSFORM_REQ; 4665 4666 rdata->iov[0].iov_base = buf; 4667 rdata->iov[0].iov_len = total_len; 4668 rdata->got_bytes = 0; 4669 rdata->result = 0; 4670 4671 shdr = (struct smb2_hdr *)buf; 4672 4673 if (rdata->credits.value > 0) { 4674 shdr->CreditCharge = cpu_to_le16(DIV_ROUND_UP(io_parms.length, 4675 SMB2_MAX_BUFFER_SIZE)); 4676 credit_request = le16_to_cpu(shdr->CreditCharge) + 8; 4677 if (server->credits >= server->max_credits) 4678 shdr->CreditRequest = cpu_to_le16(0); 4679 else 4680 shdr->CreditRequest = cpu_to_le16( 4681 min_t(int, server->max_credits - 4682 server->credits, credit_request)); 4683 4684 rc = adjust_credits(server, rdata, cifs_trace_rw_credits_call_readv_adjust); 4685 if (rc) 4686 goto async_readv_out; 4687 4688 flags |= CIFS_HAS_CREDITS; 4689 } 4690 4691 rc = cifs_call_async(server, &rqst, 4692 cifs_readv_receive, smb2_readv_callback, 4693 smb3_handle_read_data, rdata, flags, 4694 &rdata->credits); 4695 if (rc) { 4696 cifs_stats_fail_inc(io_parms.tcon, SMB2_READ_HE); 4697 trace_smb3_read_err(rdata->rreq->debug_id, 4698 subreq->debug_index, 4699 rdata->xid, io_parms.persistent_fid, 4700 io_parms.tcon->tid, 4701 io_parms.tcon->ses->Suid, 4702 io_parms.offset, 4703 subreq->len - subreq->transferred, rc); 4704 } 4705 4706 async_readv_out: 4707 cifs_small_buf_release(buf); 4708 return rc; 4709 } 4710 4711 int 4712 SMB2_read(const unsigned int xid, struct cifs_io_parms *io_parms, 4713 unsigned int *nbytes, char **buf, int *buf_type) 4714 { 4715 struct smb_rqst rqst; 4716 int resp_buftype, rc; 4717 struct smb2_read_req *req = NULL; 4718 struct smb2_read_rsp *rsp = NULL; 4719 struct kvec iov[1]; 4720 struct kvec rsp_iov; 4721 unsigned int total_len; 4722 int flags = CIFS_LOG_ERROR; 4723 struct cifs_ses *ses = io_parms->tcon->ses; 4724 4725 if (!io_parms->server) 4726 io_parms->server = cifs_pick_channel(io_parms->tcon->ses); 4727 4728 *nbytes = 0; 4729 rc = smb2_new_read_req((void **)&req, &total_len, io_parms, NULL, 0, 0); 4730 if (rc) 4731 return rc; 4732 4733 if (smb3_encryption_required(io_parms->tcon)) 4734 flags |= CIFS_TRANSFORM_REQ; 4735 4736 iov[0].iov_base = (char *)req; 4737 iov[0].iov_len = total_len; 4738 4739 memset(&rqst, 0, sizeof(struct smb_rqst)); 4740 rqst.rq_iov = iov; 4741 rqst.rq_nvec = 1; 4742 4743 rc = cifs_send_recv(xid, ses, io_parms->server, 4744 &rqst, &resp_buftype, flags, &rsp_iov); 4745 rsp = (struct smb2_read_rsp *)rsp_iov.iov_base; 4746 4747 if (rc) { 4748 if (rc != -ENODATA) { 4749 cifs_stats_fail_inc(io_parms->tcon, SMB2_READ_HE); 4750 cifs_dbg(VFS, "Send error in read = %d\n", rc); 4751 trace_smb3_read_err(0, 0, xid, 4752 req->PersistentFileId, 4753 io_parms->tcon->tid, ses->Suid, 4754 io_parms->offset, io_parms->length, 4755 rc); 4756 } else 4757 trace_smb3_read_done(0, 0, xid, 4758 req->PersistentFileId, io_parms->tcon->tid, 4759 ses->Suid, io_parms->offset, 0); 4760 free_rsp_buf(resp_buftype, rsp_iov.iov_base); 4761 cifs_small_buf_release(req); 4762 return rc == -ENODATA ? 0 : rc; 4763 } else 4764 trace_smb3_read_done(0, 0, xid, 4765 req->PersistentFileId, 4766 io_parms->tcon->tid, ses->Suid, 4767 io_parms->offset, io_parms->length); 4768 4769 cifs_small_buf_release(req); 4770 4771 *nbytes = le32_to_cpu(rsp->DataLength); 4772 if ((*nbytes > CIFS_MAX_MSGSIZE) || 4773 (*nbytes > io_parms->length)) { 4774 cifs_dbg(FYI, "bad length %d for count %d\n", 4775 *nbytes, io_parms->length); 4776 rc = -EIO; 4777 *nbytes = 0; 4778 } 4779 4780 if (*buf) { 4781 memcpy(*buf, (char *)rsp + rsp->DataOffset, *nbytes); 4782 free_rsp_buf(resp_buftype, rsp_iov.iov_base); 4783 } else if (resp_buftype != CIFS_NO_BUFFER) { 4784 *buf = rsp_iov.iov_base; 4785 if (resp_buftype == CIFS_SMALL_BUFFER) 4786 *buf_type = CIFS_SMALL_BUFFER; 4787 else if (resp_buftype == CIFS_LARGE_BUFFER) 4788 *buf_type = CIFS_LARGE_BUFFER; 4789 } 4790 return rc; 4791 } 4792 4793 /* 4794 * Check the mid_state and signature on received buffer (if any), and queue the 4795 * workqueue completion task. 4796 */ 4797 static void 4798 smb2_writev_callback(struct mid_q_entry *mid) 4799 { 4800 struct cifs_io_subrequest *wdata = mid->callback_data; 4801 struct cifs_tcon *tcon = tlink_tcon(wdata->req->cfile->tlink); 4802 struct TCP_Server_Info *server = wdata->server; 4803 struct smb2_write_rsp *rsp = (struct smb2_write_rsp *)mid->resp_buf; 4804 struct cifs_credits credits = { 4805 .value = 0, 4806 .instance = 0, 4807 .rreq_debug_id = wdata->rreq->debug_id, 4808 .rreq_debug_index = wdata->subreq.debug_index, 4809 }; 4810 unsigned int rreq_debug_id = wdata->rreq->debug_id; 4811 unsigned int subreq_debug_index = wdata->subreq.debug_index; 4812 ssize_t result = 0; 4813 size_t written; 4814 4815 WARN_ONCE(wdata->server != mid->server, 4816 "wdata server %p != mid server %p", 4817 wdata->server, mid->server); 4818 4819 switch (mid->mid_state) { 4820 case MID_RESPONSE_RECEIVED: 4821 credits.value = le16_to_cpu(rsp->hdr.CreditRequest); 4822 credits.instance = server->reconnect_instance; 4823 result = smb2_check_receive(mid, server, 0); 4824 if (result != 0) 4825 break; 4826 4827 written = le32_to_cpu(rsp->DataLength); 4828 /* 4829 * Mask off high 16 bits when bytes written as returned 4830 * by the server is greater than bytes requested by the 4831 * client. OS/2 servers are known to set incorrect 4832 * CountHigh values. 4833 */ 4834 if (written > wdata->subreq.len) 4835 written &= 0xFFFF; 4836 4837 if (written < wdata->subreq.len) 4838 wdata->result = -ENOSPC; 4839 else 4840 wdata->subreq.len = written; 4841 break; 4842 case MID_REQUEST_SUBMITTED: 4843 case MID_RETRY_NEEDED: 4844 result = -EAGAIN; 4845 break; 4846 case MID_RESPONSE_MALFORMED: 4847 credits.value = le16_to_cpu(rsp->hdr.CreditRequest); 4848 credits.instance = server->reconnect_instance; 4849 fallthrough; 4850 default: 4851 result = -EIO; 4852 break; 4853 } 4854 #ifdef CONFIG_CIFS_SMB_DIRECT 4855 /* 4856 * If this wdata has a memory registered, the MR can be freed 4857 * The number of MRs available is limited, it's important to recover 4858 * used MR as soon as I/O is finished. Hold MR longer in the later 4859 * I/O process can possibly result in I/O deadlock due to lack of MR 4860 * to send request on I/O retry 4861 */ 4862 if (wdata->mr) { 4863 smbd_deregister_mr(wdata->mr); 4864 wdata->mr = NULL; 4865 } 4866 #endif 4867 if (result) { 4868 cifs_stats_fail_inc(tcon, SMB2_WRITE_HE); 4869 trace_smb3_write_err(wdata->xid, 4870 wdata->req->cfile->fid.persistent_fid, 4871 tcon->tid, tcon->ses->Suid, wdata->subreq.start, 4872 wdata->subreq.len, wdata->result); 4873 if (wdata->result == -ENOSPC) 4874 pr_warn_once("Out of space writing to %s\n", 4875 tcon->tree_name); 4876 } else 4877 trace_smb3_write_done(0 /* no xid */, 4878 wdata->req->cfile->fid.persistent_fid, 4879 tcon->tid, tcon->ses->Suid, 4880 wdata->subreq.start, wdata->subreq.len); 4881 4882 trace_smb3_rw_credits(rreq_debug_id, subreq_debug_index, wdata->credits.value, 4883 server->credits, server->in_flight, 4884 0, cifs_trace_rw_credits_write_response_clear); 4885 wdata->credits.value = 0; 4886 trace_netfs_sreq(&wdata->subreq, netfs_sreq_trace_io_progress); 4887 cifs_write_subrequest_terminated(wdata, result ?: written, true); 4888 release_mid(mid); 4889 trace_smb3_rw_credits(rreq_debug_id, subreq_debug_index, 0, 4890 server->credits, server->in_flight, 4891 credits.value, cifs_trace_rw_credits_write_response_add); 4892 add_credits(server, &credits, 0); 4893 } 4894 4895 /* smb2_async_writev - send an async write, and set up mid to handle result */ 4896 void 4897 smb2_async_writev(struct cifs_io_subrequest *wdata) 4898 { 4899 int rc = -EACCES, flags = 0; 4900 struct smb2_write_req *req = NULL; 4901 struct smb2_hdr *shdr; 4902 struct cifs_tcon *tcon = tlink_tcon(wdata->req->cfile->tlink); 4903 struct TCP_Server_Info *server = wdata->server; 4904 struct kvec iov[1]; 4905 struct smb_rqst rqst = { }; 4906 unsigned int total_len, xid = wdata->xid; 4907 struct cifs_io_parms _io_parms; 4908 struct cifs_io_parms *io_parms = NULL; 4909 int credit_request; 4910 4911 /* 4912 * in future we may get cifs_io_parms passed in from the caller, 4913 * but for now we construct it here... 4914 */ 4915 _io_parms = (struct cifs_io_parms) { 4916 .tcon = tcon, 4917 .server = server, 4918 .offset = wdata->subreq.start, 4919 .length = wdata->subreq.len, 4920 .persistent_fid = wdata->req->cfile->fid.persistent_fid, 4921 .volatile_fid = wdata->req->cfile->fid.volatile_fid, 4922 .pid = wdata->req->pid, 4923 }; 4924 io_parms = &_io_parms; 4925 4926 rc = smb2_plain_req_init(SMB2_WRITE, tcon, server, 4927 (void **) &req, &total_len); 4928 if (rc) 4929 goto out; 4930 4931 rqst.rq_iov = iov; 4932 rqst.rq_iter = wdata->subreq.io_iter; 4933 4934 rqst.rq_iov[0].iov_len = total_len - 1; 4935 rqst.rq_iov[0].iov_base = (char *)req; 4936 rqst.rq_nvec += 1; 4937 4938 if (smb3_encryption_required(tcon)) 4939 flags |= CIFS_TRANSFORM_REQ; 4940 4941 shdr = (struct smb2_hdr *)req; 4942 shdr->Id.SyncId.ProcessId = cpu_to_le32(io_parms->pid); 4943 4944 req->PersistentFileId = io_parms->persistent_fid; 4945 req->VolatileFileId = io_parms->volatile_fid; 4946 req->WriteChannelInfoOffset = 0; 4947 req->WriteChannelInfoLength = 0; 4948 req->Channel = SMB2_CHANNEL_NONE; 4949 req->Length = cpu_to_le32(io_parms->length); 4950 req->Offset = cpu_to_le64(io_parms->offset); 4951 req->DataOffset = cpu_to_le16( 4952 offsetof(struct smb2_write_req, Buffer)); 4953 req->RemainingBytes = 0; 4954 4955 trace_smb3_write_enter(wdata->xid, 4956 io_parms->persistent_fid, 4957 io_parms->tcon->tid, 4958 io_parms->tcon->ses->Suid, 4959 io_parms->offset, 4960 io_parms->length); 4961 4962 #ifdef CONFIG_CIFS_SMB_DIRECT 4963 /* 4964 * If we want to do a server RDMA read, fill in and append 4965 * smbd_buffer_descriptor_v1 to the end of write request 4966 */ 4967 if (smb3_use_rdma_offload(io_parms)) { 4968 struct smbd_buffer_descriptor_v1 *v1; 4969 bool need_invalidate = server->dialect == SMB30_PROT_ID; 4970 4971 wdata->mr = smbd_register_mr(server->smbd_conn, &wdata->subreq.io_iter, 4972 false, need_invalidate); 4973 if (!wdata->mr) { 4974 rc = -EAGAIN; 4975 goto async_writev_out; 4976 } 4977 /* For RDMA read, I/O size is in RemainingBytes not in Length */ 4978 req->RemainingBytes = req->Length; 4979 req->Length = 0; 4980 req->DataOffset = 0; 4981 req->Channel = SMB2_CHANNEL_RDMA_V1_INVALIDATE; 4982 if (need_invalidate) 4983 req->Channel = SMB2_CHANNEL_RDMA_V1; 4984 req->WriteChannelInfoOffset = 4985 cpu_to_le16(offsetof(struct smb2_write_req, Buffer)); 4986 req->WriteChannelInfoLength = 4987 cpu_to_le16(sizeof(struct smbd_buffer_descriptor_v1)); 4988 v1 = (struct smbd_buffer_descriptor_v1 *) &req->Buffer[0]; 4989 v1->offset = cpu_to_le64(wdata->mr->mr->iova); 4990 v1->token = cpu_to_le32(wdata->mr->mr->rkey); 4991 v1->length = cpu_to_le32(wdata->mr->mr->length); 4992 4993 rqst.rq_iov[0].iov_len += sizeof(*v1); 4994 4995 /* 4996 * We keep wdata->subreq.io_iter, 4997 * but we have to truncate rqst.rq_iter 4998 */ 4999 iov_iter_truncate(&rqst.rq_iter, 0); 5000 } 5001 #endif 5002 5003 if (test_bit(NETFS_SREQ_RETRYING, &wdata->subreq.flags)) 5004 smb2_set_replay(server, &rqst); 5005 5006 cifs_dbg(FYI, "async write at %llu %u bytes iter=%zx\n", 5007 io_parms->offset, io_parms->length, iov_iter_count(&wdata->subreq.io_iter)); 5008 5009 if (wdata->credits.value > 0) { 5010 shdr->CreditCharge = cpu_to_le16(DIV_ROUND_UP(wdata->subreq.len, 5011 SMB2_MAX_BUFFER_SIZE)); 5012 credit_request = le16_to_cpu(shdr->CreditCharge) + 8; 5013 if (server->credits >= server->max_credits) 5014 shdr->CreditRequest = cpu_to_le16(0); 5015 else 5016 shdr->CreditRequest = cpu_to_le16( 5017 min_t(int, server->max_credits - 5018 server->credits, credit_request)); 5019 5020 rc = adjust_credits(server, wdata, cifs_trace_rw_credits_call_writev_adjust); 5021 if (rc) 5022 goto async_writev_out; 5023 5024 flags |= CIFS_HAS_CREDITS; 5025 } 5026 5027 /* XXX: compression + encryption is unsupported for now */ 5028 if (((flags & CIFS_TRANSFORM_REQ) != CIFS_TRANSFORM_REQ) && should_compress(tcon, &rqst)) 5029 flags |= CIFS_COMPRESS_REQ; 5030 5031 rc = cifs_call_async(server, &rqst, NULL, smb2_writev_callback, NULL, 5032 wdata, flags, &wdata->credits); 5033 /* Can't touch wdata if rc == 0 */ 5034 if (rc) { 5035 trace_smb3_write_err(xid, 5036 io_parms->persistent_fid, 5037 io_parms->tcon->tid, 5038 io_parms->tcon->ses->Suid, 5039 io_parms->offset, 5040 io_parms->length, 5041 rc); 5042 cifs_stats_fail_inc(tcon, SMB2_WRITE_HE); 5043 } 5044 5045 async_writev_out: 5046 cifs_small_buf_release(req); 5047 out: 5048 if (rc) { 5049 trace_smb3_rw_credits(wdata->rreq->debug_id, 5050 wdata->subreq.debug_index, 5051 wdata->credits.value, 5052 server->credits, server->in_flight, 5053 -(int)wdata->credits.value, 5054 cifs_trace_rw_credits_write_response_clear); 5055 add_credits_and_wake_if(wdata->server, &wdata->credits, 0); 5056 cifs_write_subrequest_terminated(wdata, rc, true); 5057 } 5058 } 5059 5060 /* 5061 * SMB2_write function gets iov pointer to kvec array with n_vec as a length. 5062 * The length field from io_parms must be at least 1 and indicates a number of 5063 * elements with data to write that begins with position 1 in iov array. All 5064 * data length is specified by count. 5065 */ 5066 int 5067 SMB2_write(const unsigned int xid, struct cifs_io_parms *io_parms, 5068 unsigned int *nbytes, struct kvec *iov, int n_vec) 5069 { 5070 struct smb_rqst rqst; 5071 int rc = 0; 5072 struct smb2_write_req *req = NULL; 5073 struct smb2_write_rsp *rsp = NULL; 5074 int resp_buftype; 5075 struct kvec rsp_iov; 5076 int flags = 0; 5077 unsigned int total_len; 5078 struct TCP_Server_Info *server; 5079 int retries = 0, cur_sleep = 1; 5080 5081 replay_again: 5082 /* reinitialize for possible replay */ 5083 flags = 0; 5084 *nbytes = 0; 5085 if (!io_parms->server) 5086 io_parms->server = cifs_pick_channel(io_parms->tcon->ses); 5087 server = io_parms->server; 5088 if (server == NULL) 5089 return -ECONNABORTED; 5090 5091 if (n_vec < 1) 5092 return rc; 5093 5094 rc = smb2_plain_req_init(SMB2_WRITE, io_parms->tcon, server, 5095 (void **) &req, &total_len); 5096 if (rc) 5097 return rc; 5098 5099 if (smb3_encryption_required(io_parms->tcon)) 5100 flags |= CIFS_TRANSFORM_REQ; 5101 5102 req->hdr.Id.SyncId.ProcessId = cpu_to_le32(io_parms->pid); 5103 5104 req->PersistentFileId = io_parms->persistent_fid; 5105 req->VolatileFileId = io_parms->volatile_fid; 5106 req->WriteChannelInfoOffset = 0; 5107 req->WriteChannelInfoLength = 0; 5108 req->Channel = 0; 5109 req->Length = cpu_to_le32(io_parms->length); 5110 req->Offset = cpu_to_le64(io_parms->offset); 5111 req->DataOffset = cpu_to_le16( 5112 offsetof(struct smb2_write_req, Buffer)); 5113 req->RemainingBytes = 0; 5114 5115 trace_smb3_write_enter(xid, io_parms->persistent_fid, 5116 io_parms->tcon->tid, io_parms->tcon->ses->Suid, 5117 io_parms->offset, io_parms->length); 5118 5119 iov[0].iov_base = (char *)req; 5120 /* 1 for Buffer */ 5121 iov[0].iov_len = total_len - 1; 5122 5123 memset(&rqst, 0, sizeof(struct smb_rqst)); 5124 rqst.rq_iov = iov; 5125 rqst.rq_nvec = n_vec + 1; 5126 5127 if (retries) 5128 smb2_set_replay(server, &rqst); 5129 5130 rc = cifs_send_recv(xid, io_parms->tcon->ses, server, 5131 &rqst, 5132 &resp_buftype, flags, &rsp_iov); 5133 rsp = (struct smb2_write_rsp *)rsp_iov.iov_base; 5134 5135 if (rc) { 5136 trace_smb3_write_err(xid, 5137 req->PersistentFileId, 5138 io_parms->tcon->tid, 5139 io_parms->tcon->ses->Suid, 5140 io_parms->offset, io_parms->length, rc); 5141 cifs_stats_fail_inc(io_parms->tcon, SMB2_WRITE_HE); 5142 cifs_dbg(VFS, "Send error in write = %d\n", rc); 5143 } else { 5144 *nbytes = le32_to_cpu(rsp->DataLength); 5145 trace_smb3_write_done(xid, 5146 req->PersistentFileId, 5147 io_parms->tcon->tid, 5148 io_parms->tcon->ses->Suid, 5149 io_parms->offset, *nbytes); 5150 } 5151 5152 cifs_small_buf_release(req); 5153 free_rsp_buf(resp_buftype, rsp); 5154 5155 if (is_replayable_error(rc) && 5156 smb2_should_replay(io_parms->tcon, &retries, &cur_sleep)) 5157 goto replay_again; 5158 5159 return rc; 5160 } 5161 5162 int posix_info_sid_size(const void *beg, const void *end) 5163 { 5164 size_t subauth; 5165 int total; 5166 5167 if (beg + 1 > end) 5168 return -1; 5169 5170 subauth = *(u8 *)(beg+1); 5171 if (subauth < 1 || subauth > 15) 5172 return -1; 5173 5174 total = 1 + 1 + 6 + 4*subauth; 5175 if (beg + total > end) 5176 return -1; 5177 5178 return total; 5179 } 5180 5181 int posix_info_parse(const void *beg, const void *end, 5182 struct smb2_posix_info_parsed *out) 5183 5184 { 5185 int total_len = 0; 5186 int owner_len, group_len; 5187 int name_len; 5188 const void *owner_sid; 5189 const void *group_sid; 5190 const void *name; 5191 5192 /* if no end bound given, assume payload to be correct */ 5193 if (!end) { 5194 const struct smb2_posix_info *p = beg; 5195 5196 end = beg + le32_to_cpu(p->NextEntryOffset); 5197 /* last element will have a 0 offset, pick a sensible bound */ 5198 if (end == beg) 5199 end += 0xFFFF; 5200 } 5201 5202 /* check base buf */ 5203 if (beg + sizeof(struct smb2_posix_info) > end) 5204 return -1; 5205 total_len = sizeof(struct smb2_posix_info); 5206 5207 /* check owner sid */ 5208 owner_sid = beg + total_len; 5209 owner_len = posix_info_sid_size(owner_sid, end); 5210 if (owner_len < 0) 5211 return -1; 5212 total_len += owner_len; 5213 5214 /* check group sid */ 5215 group_sid = beg + total_len; 5216 group_len = posix_info_sid_size(group_sid, end); 5217 if (group_len < 0) 5218 return -1; 5219 total_len += group_len; 5220 5221 /* check name len */ 5222 if (beg + total_len + 4 > end) 5223 return -1; 5224 name_len = le32_to_cpu(*(__le32 *)(beg + total_len)); 5225 if (name_len < 1 || name_len > 0xFFFF) 5226 return -1; 5227 total_len += 4; 5228 5229 /* check name */ 5230 name = beg + total_len; 5231 if (name + name_len > end) 5232 return -1; 5233 total_len += name_len; 5234 5235 if (out) { 5236 out->base = beg; 5237 out->size = total_len; 5238 out->name_len = name_len; 5239 out->name = name; 5240 memcpy(&out->owner, owner_sid, owner_len); 5241 memcpy(&out->group, group_sid, group_len); 5242 } 5243 return total_len; 5244 } 5245 5246 static int posix_info_extra_size(const void *beg, const void *end) 5247 { 5248 int len = posix_info_parse(beg, end, NULL); 5249 5250 if (len < 0) 5251 return -1; 5252 return len - sizeof(struct smb2_posix_info); 5253 } 5254 5255 static unsigned int 5256 num_entries(int infotype, char *bufstart, char *end_of_buf, char **lastentry, 5257 size_t size) 5258 { 5259 int len; 5260 unsigned int entrycount = 0; 5261 unsigned int next_offset = 0; 5262 char *entryptr; 5263 FILE_DIRECTORY_INFO *dir_info; 5264 5265 if (bufstart == NULL) 5266 return 0; 5267 5268 entryptr = bufstart; 5269 5270 while (1) { 5271 if (entryptr + next_offset < entryptr || 5272 entryptr + next_offset > end_of_buf || 5273 entryptr + next_offset + size > end_of_buf) { 5274 cifs_dbg(VFS, "malformed search entry would overflow\n"); 5275 break; 5276 } 5277 5278 entryptr = entryptr + next_offset; 5279 dir_info = (FILE_DIRECTORY_INFO *)entryptr; 5280 5281 if (infotype == SMB_FIND_FILE_POSIX_INFO) 5282 len = posix_info_extra_size(entryptr, end_of_buf); 5283 else 5284 len = le32_to_cpu(dir_info->FileNameLength); 5285 5286 if (len < 0 || 5287 entryptr + len < entryptr || 5288 entryptr + len > end_of_buf || 5289 entryptr + len + size > end_of_buf) { 5290 cifs_dbg(VFS, "directory entry name would overflow frame end of buf %p\n", 5291 end_of_buf); 5292 break; 5293 } 5294 5295 *lastentry = entryptr; 5296 entrycount++; 5297 5298 next_offset = le32_to_cpu(dir_info->NextEntryOffset); 5299 if (!next_offset) 5300 break; 5301 } 5302 5303 return entrycount; 5304 } 5305 5306 /* 5307 * Readdir/FindFirst 5308 */ 5309 int SMB2_query_directory_init(const unsigned int xid, 5310 struct cifs_tcon *tcon, 5311 struct TCP_Server_Info *server, 5312 struct smb_rqst *rqst, 5313 u64 persistent_fid, u64 volatile_fid, 5314 int index, int info_level) 5315 { 5316 struct smb2_query_directory_req *req; 5317 unsigned char *bufptr; 5318 __le16 asteriks = cpu_to_le16('*'); 5319 unsigned int output_size = CIFSMaxBufSize - 5320 MAX_SMB2_CREATE_RESPONSE_SIZE - 5321 MAX_SMB2_CLOSE_RESPONSE_SIZE; 5322 unsigned int total_len; 5323 struct kvec *iov = rqst->rq_iov; 5324 int len, rc; 5325 5326 rc = smb2_plain_req_init(SMB2_QUERY_DIRECTORY, tcon, server, 5327 (void **) &req, &total_len); 5328 if (rc) 5329 return rc; 5330 5331 switch (info_level) { 5332 case SMB_FIND_FILE_DIRECTORY_INFO: 5333 req->FileInformationClass = FILE_DIRECTORY_INFORMATION; 5334 break; 5335 case SMB_FIND_FILE_ID_FULL_DIR_INFO: 5336 req->FileInformationClass = FILEID_FULL_DIRECTORY_INFORMATION; 5337 break; 5338 case SMB_FIND_FILE_POSIX_INFO: 5339 req->FileInformationClass = SMB_FIND_FILE_POSIX_INFO; 5340 break; 5341 case SMB_FIND_FILE_FULL_DIRECTORY_INFO: 5342 req->FileInformationClass = FILE_FULL_DIRECTORY_INFORMATION; 5343 break; 5344 default: 5345 cifs_tcon_dbg(VFS, "info level %u isn't supported\n", 5346 info_level); 5347 return -EINVAL; 5348 } 5349 5350 req->FileIndex = cpu_to_le32(index); 5351 req->PersistentFileId = persistent_fid; 5352 req->VolatileFileId = volatile_fid; 5353 5354 len = 0x2; 5355 bufptr = req->Buffer; 5356 memcpy(bufptr, &asteriks, len); 5357 5358 req->FileNameOffset = 5359 cpu_to_le16(sizeof(struct smb2_query_directory_req)); 5360 req->FileNameLength = cpu_to_le16(len); 5361 /* 5362 * BB could be 30 bytes or so longer if we used SMB2 specific 5363 * buffer lengths, but this is safe and close enough. 5364 */ 5365 output_size = min_t(unsigned int, output_size, server->maxBuf); 5366 output_size = min_t(unsigned int, output_size, 2 << 15); 5367 req->OutputBufferLength = cpu_to_le32(output_size); 5368 5369 iov[0].iov_base = (char *)req; 5370 /* 1 for Buffer */ 5371 iov[0].iov_len = total_len - 1; 5372 5373 iov[1].iov_base = (char *)(req->Buffer); 5374 iov[1].iov_len = len; 5375 5376 trace_smb3_query_dir_enter(xid, persistent_fid, tcon->tid, 5377 tcon->ses->Suid, index, output_size); 5378 5379 return 0; 5380 } 5381 5382 void SMB2_query_directory_free(struct smb_rqst *rqst) 5383 { 5384 if (rqst && rqst->rq_iov) { 5385 cifs_small_buf_release(rqst->rq_iov[0].iov_base); /* request */ 5386 } 5387 } 5388 5389 int 5390 smb2_parse_query_directory(struct cifs_tcon *tcon, 5391 struct kvec *rsp_iov, 5392 int resp_buftype, 5393 struct cifs_search_info *srch_inf) 5394 { 5395 struct smb2_query_directory_rsp *rsp; 5396 size_t info_buf_size; 5397 char *end_of_smb; 5398 int rc; 5399 5400 rsp = (struct smb2_query_directory_rsp *)rsp_iov->iov_base; 5401 5402 switch (srch_inf->info_level) { 5403 case SMB_FIND_FILE_DIRECTORY_INFO: 5404 info_buf_size = sizeof(FILE_DIRECTORY_INFO); 5405 break; 5406 case SMB_FIND_FILE_ID_FULL_DIR_INFO: 5407 info_buf_size = sizeof(SEARCH_ID_FULL_DIR_INFO); 5408 break; 5409 case SMB_FIND_FILE_POSIX_INFO: 5410 /* note that posix payload are variable size */ 5411 info_buf_size = sizeof(struct smb2_posix_info); 5412 break; 5413 case SMB_FIND_FILE_FULL_DIRECTORY_INFO: 5414 info_buf_size = sizeof(FILE_FULL_DIRECTORY_INFO); 5415 break; 5416 default: 5417 cifs_tcon_dbg(VFS, "info level %u isn't supported\n", 5418 srch_inf->info_level); 5419 return -EINVAL; 5420 } 5421 5422 rc = smb2_validate_iov(le16_to_cpu(rsp->OutputBufferOffset), 5423 le32_to_cpu(rsp->OutputBufferLength), rsp_iov, 5424 info_buf_size); 5425 if (rc) { 5426 cifs_tcon_dbg(VFS, "bad info payload"); 5427 return rc; 5428 } 5429 5430 srch_inf->unicode = true; 5431 5432 if (srch_inf->ntwrk_buf_start) { 5433 if (srch_inf->smallBuf) 5434 cifs_small_buf_release(srch_inf->ntwrk_buf_start); 5435 else 5436 cifs_buf_release(srch_inf->ntwrk_buf_start); 5437 } 5438 srch_inf->ntwrk_buf_start = (char *)rsp; 5439 srch_inf->srch_entries_start = srch_inf->last_entry = 5440 (char *)rsp + le16_to_cpu(rsp->OutputBufferOffset); 5441 end_of_smb = rsp_iov->iov_len + (char *)rsp; 5442 5443 srch_inf->entries_in_buffer = num_entries( 5444 srch_inf->info_level, 5445 srch_inf->srch_entries_start, 5446 end_of_smb, 5447 &srch_inf->last_entry, 5448 info_buf_size); 5449 5450 srch_inf->index_of_last_entry += srch_inf->entries_in_buffer; 5451 cifs_dbg(FYI, "num entries %d last_index %lld srch start %p srch end %p\n", 5452 srch_inf->entries_in_buffer, srch_inf->index_of_last_entry, 5453 srch_inf->srch_entries_start, srch_inf->last_entry); 5454 if (resp_buftype == CIFS_LARGE_BUFFER) 5455 srch_inf->smallBuf = false; 5456 else if (resp_buftype == CIFS_SMALL_BUFFER) 5457 srch_inf->smallBuf = true; 5458 else 5459 cifs_tcon_dbg(VFS, "Invalid search buffer type\n"); 5460 5461 return 0; 5462 } 5463 5464 int 5465 SMB2_query_directory(const unsigned int xid, struct cifs_tcon *tcon, 5466 u64 persistent_fid, u64 volatile_fid, int index, 5467 struct cifs_search_info *srch_inf) 5468 { 5469 struct smb_rqst rqst; 5470 struct kvec iov[SMB2_QUERY_DIRECTORY_IOV_SIZE]; 5471 struct smb2_query_directory_rsp *rsp = NULL; 5472 int resp_buftype = CIFS_NO_BUFFER; 5473 struct kvec rsp_iov; 5474 int rc = 0; 5475 struct cifs_ses *ses = tcon->ses; 5476 struct TCP_Server_Info *server; 5477 int flags = 0; 5478 int retries = 0, cur_sleep = 1; 5479 5480 replay_again: 5481 /* reinitialize for possible replay */ 5482 flags = 0; 5483 server = cifs_pick_channel(ses); 5484 5485 if (!ses || !(ses->server)) 5486 return -EIO; 5487 5488 if (smb3_encryption_required(tcon)) 5489 flags |= CIFS_TRANSFORM_REQ; 5490 5491 memset(&rqst, 0, sizeof(struct smb_rqst)); 5492 memset(&iov, 0, sizeof(iov)); 5493 rqst.rq_iov = iov; 5494 rqst.rq_nvec = SMB2_QUERY_DIRECTORY_IOV_SIZE; 5495 5496 rc = SMB2_query_directory_init(xid, tcon, server, 5497 &rqst, persistent_fid, 5498 volatile_fid, index, 5499 srch_inf->info_level); 5500 if (rc) 5501 goto qdir_exit; 5502 5503 if (retries) 5504 smb2_set_replay(server, &rqst); 5505 5506 rc = cifs_send_recv(xid, ses, server, 5507 &rqst, &resp_buftype, flags, &rsp_iov); 5508 rsp = (struct smb2_query_directory_rsp *)rsp_iov.iov_base; 5509 5510 if (rc) { 5511 if (rc == -ENODATA && 5512 rsp->hdr.Status == STATUS_NO_MORE_FILES) { 5513 trace_smb3_query_dir_done(xid, persistent_fid, 5514 tcon->tid, tcon->ses->Suid, index, 0); 5515 srch_inf->endOfSearch = true; 5516 rc = 0; 5517 } else { 5518 trace_smb3_query_dir_err(xid, persistent_fid, tcon->tid, 5519 tcon->ses->Suid, index, 0, rc); 5520 cifs_stats_fail_inc(tcon, SMB2_QUERY_DIRECTORY_HE); 5521 } 5522 goto qdir_exit; 5523 } 5524 5525 rc = smb2_parse_query_directory(tcon, &rsp_iov, resp_buftype, 5526 srch_inf); 5527 if (rc) { 5528 trace_smb3_query_dir_err(xid, persistent_fid, tcon->tid, 5529 tcon->ses->Suid, index, 0, rc); 5530 goto qdir_exit; 5531 } 5532 resp_buftype = CIFS_NO_BUFFER; 5533 5534 trace_smb3_query_dir_done(xid, persistent_fid, tcon->tid, 5535 tcon->ses->Suid, index, srch_inf->entries_in_buffer); 5536 5537 qdir_exit: 5538 SMB2_query_directory_free(&rqst); 5539 free_rsp_buf(resp_buftype, rsp); 5540 5541 if (is_replayable_error(rc) && 5542 smb2_should_replay(tcon, &retries, &cur_sleep)) 5543 goto replay_again; 5544 5545 return rc; 5546 } 5547 5548 int 5549 SMB2_set_info_init(struct cifs_tcon *tcon, struct TCP_Server_Info *server, 5550 struct smb_rqst *rqst, 5551 u64 persistent_fid, u64 volatile_fid, u32 pid, 5552 u8 info_class, u8 info_type, u32 additional_info, 5553 void **data, unsigned int *size) 5554 { 5555 struct smb2_set_info_req *req; 5556 struct kvec *iov = rqst->rq_iov; 5557 unsigned int i, total_len; 5558 int rc; 5559 5560 rc = smb2_plain_req_init(SMB2_SET_INFO, tcon, server, 5561 (void **) &req, &total_len); 5562 if (rc) 5563 return rc; 5564 5565 req->hdr.Id.SyncId.ProcessId = cpu_to_le32(pid); 5566 req->InfoType = info_type; 5567 req->FileInfoClass = info_class; 5568 req->PersistentFileId = persistent_fid; 5569 req->VolatileFileId = volatile_fid; 5570 req->AdditionalInformation = cpu_to_le32(additional_info); 5571 5572 req->BufferOffset = cpu_to_le16(sizeof(struct smb2_set_info_req)); 5573 req->BufferLength = cpu_to_le32(*size); 5574 5575 memcpy(req->Buffer, *data, *size); 5576 total_len += *size; 5577 5578 iov[0].iov_base = (char *)req; 5579 /* 1 for Buffer */ 5580 iov[0].iov_len = total_len - 1; 5581 5582 for (i = 1; i < rqst->rq_nvec; i++) { 5583 le32_add_cpu(&req->BufferLength, size[i]); 5584 iov[i].iov_base = (char *)data[i]; 5585 iov[i].iov_len = size[i]; 5586 } 5587 5588 return 0; 5589 } 5590 5591 void 5592 SMB2_set_info_free(struct smb_rqst *rqst) 5593 { 5594 if (rqst && rqst->rq_iov) 5595 cifs_buf_release(rqst->rq_iov[0].iov_base); /* request */ 5596 } 5597 5598 static int 5599 send_set_info(const unsigned int xid, struct cifs_tcon *tcon, 5600 u64 persistent_fid, u64 volatile_fid, u32 pid, u8 info_class, 5601 u8 info_type, u32 additional_info, unsigned int num, 5602 void **data, unsigned int *size) 5603 { 5604 struct smb_rqst rqst; 5605 struct smb2_set_info_rsp *rsp = NULL; 5606 struct kvec *iov; 5607 struct kvec rsp_iov; 5608 int rc = 0; 5609 int resp_buftype; 5610 struct cifs_ses *ses = tcon->ses; 5611 struct TCP_Server_Info *server; 5612 int flags = 0; 5613 int retries = 0, cur_sleep = 1; 5614 5615 replay_again: 5616 /* reinitialize for possible replay */ 5617 flags = 0; 5618 server = cifs_pick_channel(ses); 5619 5620 if (!ses || !server) 5621 return -EIO; 5622 5623 if (!num) 5624 return -EINVAL; 5625 5626 if (smb3_encryption_required(tcon)) 5627 flags |= CIFS_TRANSFORM_REQ; 5628 5629 iov = kmalloc_array(num, sizeof(struct kvec), GFP_KERNEL); 5630 if (!iov) 5631 return -ENOMEM; 5632 5633 memset(&rqst, 0, sizeof(struct smb_rqst)); 5634 rqst.rq_iov = iov; 5635 rqst.rq_nvec = num; 5636 5637 rc = SMB2_set_info_init(tcon, server, 5638 &rqst, persistent_fid, volatile_fid, pid, 5639 info_class, info_type, additional_info, 5640 data, size); 5641 if (rc) { 5642 kfree(iov); 5643 return rc; 5644 } 5645 5646 if (retries) 5647 smb2_set_replay(server, &rqst); 5648 5649 rc = cifs_send_recv(xid, ses, server, 5650 &rqst, &resp_buftype, flags, 5651 &rsp_iov); 5652 SMB2_set_info_free(&rqst); 5653 rsp = (struct smb2_set_info_rsp *)rsp_iov.iov_base; 5654 5655 if (rc != 0) { 5656 cifs_stats_fail_inc(tcon, SMB2_SET_INFO_HE); 5657 trace_smb3_set_info_err(xid, persistent_fid, tcon->tid, 5658 ses->Suid, info_class, (__u32)info_type, rc); 5659 } 5660 5661 free_rsp_buf(resp_buftype, rsp); 5662 kfree(iov); 5663 5664 if (is_replayable_error(rc) && 5665 smb2_should_replay(tcon, &retries, &cur_sleep)) 5666 goto replay_again; 5667 5668 return rc; 5669 } 5670 5671 int 5672 SMB2_set_eof(const unsigned int xid, struct cifs_tcon *tcon, u64 persistent_fid, 5673 u64 volatile_fid, u32 pid, loff_t new_eof) 5674 { 5675 struct smb2_file_eof_info info; 5676 void *data; 5677 unsigned int size; 5678 5679 info.EndOfFile = cpu_to_le64(new_eof); 5680 5681 data = &info; 5682 size = sizeof(struct smb2_file_eof_info); 5683 5684 trace_smb3_set_eof(xid, persistent_fid, tcon->tid, tcon->ses->Suid, new_eof); 5685 5686 return send_set_info(xid, tcon, persistent_fid, volatile_fid, 5687 pid, FILE_END_OF_FILE_INFORMATION, SMB2_O_INFO_FILE, 5688 0, 1, &data, &size); 5689 } 5690 5691 int 5692 SMB2_set_acl(const unsigned int xid, struct cifs_tcon *tcon, 5693 u64 persistent_fid, u64 volatile_fid, 5694 struct smb_ntsd *pnntsd, int pacllen, int aclflag) 5695 { 5696 return send_set_info(xid, tcon, persistent_fid, volatile_fid, 5697 current->tgid, 0, SMB2_O_INFO_SECURITY, aclflag, 5698 1, (void **)&pnntsd, &pacllen); 5699 } 5700 5701 int 5702 SMB2_set_ea(const unsigned int xid, struct cifs_tcon *tcon, 5703 u64 persistent_fid, u64 volatile_fid, 5704 struct smb2_file_full_ea_info *buf, int len) 5705 { 5706 return send_set_info(xid, tcon, persistent_fid, volatile_fid, 5707 current->tgid, FILE_FULL_EA_INFORMATION, SMB2_O_INFO_FILE, 5708 0, 1, (void **)&buf, &len); 5709 } 5710 5711 int 5712 SMB2_oplock_break(const unsigned int xid, struct cifs_tcon *tcon, 5713 const u64 persistent_fid, const u64 volatile_fid, 5714 __u8 oplock_level) 5715 { 5716 struct smb_rqst rqst; 5717 int rc; 5718 struct smb2_oplock_break *req = NULL; 5719 struct cifs_ses *ses = tcon->ses; 5720 struct TCP_Server_Info *server; 5721 int flags = CIFS_OBREAK_OP; 5722 unsigned int total_len; 5723 struct kvec iov[1]; 5724 struct kvec rsp_iov; 5725 int resp_buf_type; 5726 int retries = 0, cur_sleep = 1; 5727 5728 replay_again: 5729 /* reinitialize for possible replay */ 5730 flags = CIFS_OBREAK_OP; 5731 server = cifs_pick_channel(ses); 5732 5733 cifs_dbg(FYI, "SMB2_oplock_break\n"); 5734 rc = smb2_plain_req_init(SMB2_OPLOCK_BREAK, tcon, server, 5735 (void **) &req, &total_len); 5736 if (rc) 5737 return rc; 5738 5739 if (smb3_encryption_required(tcon)) 5740 flags |= CIFS_TRANSFORM_REQ; 5741 5742 req->VolatileFid = volatile_fid; 5743 req->PersistentFid = persistent_fid; 5744 req->OplockLevel = oplock_level; 5745 req->hdr.CreditRequest = cpu_to_le16(1); 5746 5747 flags |= CIFS_NO_RSP_BUF; 5748 5749 iov[0].iov_base = (char *)req; 5750 iov[0].iov_len = total_len; 5751 5752 memset(&rqst, 0, sizeof(struct smb_rqst)); 5753 rqst.rq_iov = iov; 5754 rqst.rq_nvec = 1; 5755 5756 if (retries) 5757 smb2_set_replay(server, &rqst); 5758 5759 rc = cifs_send_recv(xid, ses, server, 5760 &rqst, &resp_buf_type, flags, &rsp_iov); 5761 cifs_small_buf_release(req); 5762 if (rc) { 5763 cifs_stats_fail_inc(tcon, SMB2_OPLOCK_BREAK_HE); 5764 cifs_dbg(FYI, "Send error in Oplock Break = %d\n", rc); 5765 } 5766 5767 if (is_replayable_error(rc) && 5768 smb2_should_replay(tcon, &retries, &cur_sleep)) 5769 goto replay_again; 5770 5771 return rc; 5772 } 5773 5774 void 5775 smb2_copy_fs_info_to_kstatfs(struct smb2_fs_full_size_info *pfs_inf, 5776 struct kstatfs *kst) 5777 { 5778 kst->f_bsize = le32_to_cpu(pfs_inf->BytesPerSector) * 5779 le32_to_cpu(pfs_inf->SectorsPerAllocationUnit); 5780 kst->f_blocks = le64_to_cpu(pfs_inf->TotalAllocationUnits); 5781 kst->f_bfree = kst->f_bavail = 5782 le64_to_cpu(pfs_inf->CallerAvailableAllocationUnits); 5783 return; 5784 } 5785 5786 static void 5787 copy_posix_fs_info_to_kstatfs(FILE_SYSTEM_POSIX_INFO *response_data, 5788 struct kstatfs *kst) 5789 { 5790 kst->f_bsize = le32_to_cpu(response_data->BlockSize); 5791 kst->f_blocks = le64_to_cpu(response_data->TotalBlocks); 5792 kst->f_bfree = le64_to_cpu(response_data->BlocksAvail); 5793 if (response_data->UserBlocksAvail == cpu_to_le64(-1)) 5794 kst->f_bavail = kst->f_bfree; 5795 else 5796 kst->f_bavail = le64_to_cpu(response_data->UserBlocksAvail); 5797 if (response_data->TotalFileNodes != cpu_to_le64(-1)) 5798 kst->f_files = le64_to_cpu(response_data->TotalFileNodes); 5799 if (response_data->FreeFileNodes != cpu_to_le64(-1)) 5800 kst->f_ffree = le64_to_cpu(response_data->FreeFileNodes); 5801 5802 return; 5803 } 5804 5805 static int 5806 build_qfs_info_req(struct kvec *iov, struct cifs_tcon *tcon, 5807 struct TCP_Server_Info *server, 5808 int level, int outbuf_len, u64 persistent_fid, 5809 u64 volatile_fid) 5810 { 5811 int rc; 5812 struct smb2_query_info_req *req; 5813 unsigned int total_len; 5814 5815 cifs_dbg(FYI, "Query FSInfo level %d\n", level); 5816 5817 if ((tcon->ses == NULL) || server == NULL) 5818 return -EIO; 5819 5820 rc = smb2_plain_req_init(SMB2_QUERY_INFO, tcon, server, 5821 (void **) &req, &total_len); 5822 if (rc) 5823 return rc; 5824 5825 req->InfoType = SMB2_O_INFO_FILESYSTEM; 5826 req->FileInfoClass = level; 5827 req->PersistentFileId = persistent_fid; 5828 req->VolatileFileId = volatile_fid; 5829 /* 1 for pad */ 5830 req->InputBufferOffset = 5831 cpu_to_le16(sizeof(struct smb2_query_info_req)); 5832 req->OutputBufferLength = cpu_to_le32( 5833 outbuf_len + sizeof(struct smb2_query_info_rsp)); 5834 5835 iov->iov_base = (char *)req; 5836 iov->iov_len = total_len; 5837 return 0; 5838 } 5839 5840 static inline void free_qfs_info_req(struct kvec *iov) 5841 { 5842 cifs_buf_release(iov->iov_base); 5843 } 5844 5845 int 5846 SMB311_posix_qfs_info(const unsigned int xid, struct cifs_tcon *tcon, 5847 u64 persistent_fid, u64 volatile_fid, struct kstatfs *fsdata) 5848 { 5849 struct smb_rqst rqst; 5850 struct smb2_query_info_rsp *rsp = NULL; 5851 struct kvec iov; 5852 struct kvec rsp_iov; 5853 int rc = 0; 5854 int resp_buftype; 5855 struct cifs_ses *ses = tcon->ses; 5856 struct TCP_Server_Info *server; 5857 FILE_SYSTEM_POSIX_INFO *info = NULL; 5858 int flags = 0; 5859 int retries = 0, cur_sleep = 1; 5860 5861 replay_again: 5862 /* reinitialize for possible replay */ 5863 flags = 0; 5864 server = cifs_pick_channel(ses); 5865 5866 rc = build_qfs_info_req(&iov, tcon, server, 5867 FS_POSIX_INFORMATION, 5868 sizeof(FILE_SYSTEM_POSIX_INFO), 5869 persistent_fid, volatile_fid); 5870 if (rc) 5871 return rc; 5872 5873 if (smb3_encryption_required(tcon)) 5874 flags |= CIFS_TRANSFORM_REQ; 5875 5876 memset(&rqst, 0, sizeof(struct smb_rqst)); 5877 rqst.rq_iov = &iov; 5878 rqst.rq_nvec = 1; 5879 5880 if (retries) 5881 smb2_set_replay(server, &rqst); 5882 5883 rc = cifs_send_recv(xid, ses, server, 5884 &rqst, &resp_buftype, flags, &rsp_iov); 5885 free_qfs_info_req(&iov); 5886 if (rc) { 5887 cifs_stats_fail_inc(tcon, SMB2_QUERY_INFO_HE); 5888 goto posix_qfsinf_exit; 5889 } 5890 rsp = (struct smb2_query_info_rsp *)rsp_iov.iov_base; 5891 5892 info = (FILE_SYSTEM_POSIX_INFO *)( 5893 le16_to_cpu(rsp->OutputBufferOffset) + (char *)rsp); 5894 rc = smb2_validate_iov(le16_to_cpu(rsp->OutputBufferOffset), 5895 le32_to_cpu(rsp->OutputBufferLength), &rsp_iov, 5896 sizeof(FILE_SYSTEM_POSIX_INFO)); 5897 if (!rc) 5898 copy_posix_fs_info_to_kstatfs(info, fsdata); 5899 5900 posix_qfsinf_exit: 5901 free_rsp_buf(resp_buftype, rsp_iov.iov_base); 5902 5903 if (is_replayable_error(rc) && 5904 smb2_should_replay(tcon, &retries, &cur_sleep)) 5905 goto replay_again; 5906 5907 return rc; 5908 } 5909 5910 int 5911 SMB2_QFS_info(const unsigned int xid, struct cifs_tcon *tcon, 5912 u64 persistent_fid, u64 volatile_fid, struct kstatfs *fsdata) 5913 { 5914 struct smb_rqst rqst; 5915 struct smb2_query_info_rsp *rsp = NULL; 5916 struct kvec iov; 5917 struct kvec rsp_iov; 5918 int rc = 0; 5919 int resp_buftype; 5920 struct cifs_ses *ses = tcon->ses; 5921 struct TCP_Server_Info *server; 5922 struct smb2_fs_full_size_info *info = NULL; 5923 int flags = 0; 5924 int retries = 0, cur_sleep = 1; 5925 5926 replay_again: 5927 /* reinitialize for possible replay */ 5928 flags = 0; 5929 server = cifs_pick_channel(ses); 5930 5931 rc = build_qfs_info_req(&iov, tcon, server, 5932 FS_FULL_SIZE_INFORMATION, 5933 sizeof(struct smb2_fs_full_size_info), 5934 persistent_fid, volatile_fid); 5935 if (rc) 5936 return rc; 5937 5938 if (smb3_encryption_required(tcon)) 5939 flags |= CIFS_TRANSFORM_REQ; 5940 5941 memset(&rqst, 0, sizeof(struct smb_rqst)); 5942 rqst.rq_iov = &iov; 5943 rqst.rq_nvec = 1; 5944 5945 if (retries) 5946 smb2_set_replay(server, &rqst); 5947 5948 rc = cifs_send_recv(xid, ses, server, 5949 &rqst, &resp_buftype, flags, &rsp_iov); 5950 free_qfs_info_req(&iov); 5951 if (rc) { 5952 cifs_stats_fail_inc(tcon, SMB2_QUERY_INFO_HE); 5953 goto qfsinf_exit; 5954 } 5955 rsp = (struct smb2_query_info_rsp *)rsp_iov.iov_base; 5956 5957 info = (struct smb2_fs_full_size_info *)( 5958 le16_to_cpu(rsp->OutputBufferOffset) + (char *)rsp); 5959 rc = smb2_validate_iov(le16_to_cpu(rsp->OutputBufferOffset), 5960 le32_to_cpu(rsp->OutputBufferLength), &rsp_iov, 5961 sizeof(struct smb2_fs_full_size_info)); 5962 if (!rc) 5963 smb2_copy_fs_info_to_kstatfs(info, fsdata); 5964 5965 qfsinf_exit: 5966 free_rsp_buf(resp_buftype, rsp_iov.iov_base); 5967 5968 if (is_replayable_error(rc) && 5969 smb2_should_replay(tcon, &retries, &cur_sleep)) 5970 goto replay_again; 5971 5972 return rc; 5973 } 5974 5975 int 5976 SMB2_QFS_attr(const unsigned int xid, struct cifs_tcon *tcon, 5977 u64 persistent_fid, u64 volatile_fid, int level) 5978 { 5979 struct smb_rqst rqst; 5980 struct smb2_query_info_rsp *rsp = NULL; 5981 struct kvec iov; 5982 struct kvec rsp_iov; 5983 int rc = 0; 5984 int resp_buftype, max_len, min_len; 5985 struct cifs_ses *ses = tcon->ses; 5986 struct TCP_Server_Info *server; 5987 unsigned int rsp_len, offset; 5988 int flags = 0; 5989 int retries = 0, cur_sleep = 1; 5990 5991 replay_again: 5992 /* reinitialize for possible replay */ 5993 flags = 0; 5994 server = cifs_pick_channel(ses); 5995 5996 if (level == FS_DEVICE_INFORMATION) { 5997 max_len = sizeof(FILE_SYSTEM_DEVICE_INFO); 5998 min_len = sizeof(FILE_SYSTEM_DEVICE_INFO); 5999 } else if (level == FS_ATTRIBUTE_INFORMATION) { 6000 max_len = sizeof(FILE_SYSTEM_ATTRIBUTE_INFO); 6001 min_len = MIN_FS_ATTR_INFO_SIZE; 6002 } else if (level == FS_SECTOR_SIZE_INFORMATION) { 6003 max_len = sizeof(struct smb3_fs_ss_info); 6004 min_len = sizeof(struct smb3_fs_ss_info); 6005 } else if (level == FS_VOLUME_INFORMATION) { 6006 max_len = sizeof(struct smb3_fs_vol_info) + MAX_VOL_LABEL_LEN; 6007 min_len = sizeof(struct smb3_fs_vol_info); 6008 } else { 6009 cifs_dbg(FYI, "Invalid qfsinfo level %d\n", level); 6010 return -EINVAL; 6011 } 6012 6013 rc = build_qfs_info_req(&iov, tcon, server, 6014 level, max_len, 6015 persistent_fid, volatile_fid); 6016 if (rc) 6017 return rc; 6018 6019 if (smb3_encryption_required(tcon)) 6020 flags |= CIFS_TRANSFORM_REQ; 6021 6022 memset(&rqst, 0, sizeof(struct smb_rqst)); 6023 rqst.rq_iov = &iov; 6024 rqst.rq_nvec = 1; 6025 6026 if (retries) 6027 smb2_set_replay(server, &rqst); 6028 6029 rc = cifs_send_recv(xid, ses, server, 6030 &rqst, &resp_buftype, flags, &rsp_iov); 6031 free_qfs_info_req(&iov); 6032 if (rc) { 6033 cifs_stats_fail_inc(tcon, SMB2_QUERY_INFO_HE); 6034 goto qfsattr_exit; 6035 } 6036 rsp = (struct smb2_query_info_rsp *)rsp_iov.iov_base; 6037 6038 rsp_len = le32_to_cpu(rsp->OutputBufferLength); 6039 offset = le16_to_cpu(rsp->OutputBufferOffset); 6040 rc = smb2_validate_iov(offset, rsp_len, &rsp_iov, min_len); 6041 if (rc) 6042 goto qfsattr_exit; 6043 6044 if (level == FS_ATTRIBUTE_INFORMATION) 6045 memcpy(&tcon->fsAttrInfo, offset 6046 + (char *)rsp, min_t(unsigned int, 6047 rsp_len, max_len)); 6048 else if (level == FS_DEVICE_INFORMATION) 6049 memcpy(&tcon->fsDevInfo, offset 6050 + (char *)rsp, sizeof(FILE_SYSTEM_DEVICE_INFO)); 6051 else if (level == FS_SECTOR_SIZE_INFORMATION) { 6052 struct smb3_fs_ss_info *ss_info = (struct smb3_fs_ss_info *) 6053 (offset + (char *)rsp); 6054 tcon->ss_flags = le32_to_cpu(ss_info->Flags); 6055 tcon->perf_sector_size = 6056 le32_to_cpu(ss_info->PhysicalBytesPerSectorForPerf); 6057 } else if (level == FS_VOLUME_INFORMATION) { 6058 struct smb3_fs_vol_info *vol_info = (struct smb3_fs_vol_info *) 6059 (offset + (char *)rsp); 6060 tcon->vol_serial_number = vol_info->VolumeSerialNumber; 6061 tcon->vol_create_time = vol_info->VolumeCreationTime; 6062 } 6063 6064 qfsattr_exit: 6065 free_rsp_buf(resp_buftype, rsp_iov.iov_base); 6066 6067 if (is_replayable_error(rc) && 6068 smb2_should_replay(tcon, &retries, &cur_sleep)) 6069 goto replay_again; 6070 6071 return rc; 6072 } 6073 6074 int 6075 smb2_lockv(const unsigned int xid, struct cifs_tcon *tcon, 6076 const __u64 persist_fid, const __u64 volatile_fid, const __u32 pid, 6077 const __u32 num_lock, struct smb2_lock_element *buf) 6078 { 6079 struct smb_rqst rqst; 6080 int rc = 0; 6081 struct smb2_lock_req *req = NULL; 6082 struct kvec iov[2]; 6083 struct kvec rsp_iov; 6084 int resp_buf_type; 6085 unsigned int count; 6086 int flags = CIFS_NO_RSP_BUF; 6087 unsigned int total_len; 6088 struct TCP_Server_Info *server; 6089 int retries = 0, cur_sleep = 1; 6090 6091 replay_again: 6092 /* reinitialize for possible replay */ 6093 flags = CIFS_NO_RSP_BUF; 6094 server = cifs_pick_channel(tcon->ses); 6095 6096 cifs_dbg(FYI, "smb2_lockv num lock %d\n", num_lock); 6097 6098 rc = smb2_plain_req_init(SMB2_LOCK, tcon, server, 6099 (void **) &req, &total_len); 6100 if (rc) 6101 return rc; 6102 6103 if (smb3_encryption_required(tcon)) 6104 flags |= CIFS_TRANSFORM_REQ; 6105 6106 req->hdr.Id.SyncId.ProcessId = cpu_to_le32(pid); 6107 req->LockCount = cpu_to_le16(num_lock); 6108 6109 req->PersistentFileId = persist_fid; 6110 req->VolatileFileId = volatile_fid; 6111 6112 count = num_lock * sizeof(struct smb2_lock_element); 6113 6114 iov[0].iov_base = (char *)req; 6115 iov[0].iov_len = total_len - sizeof(struct smb2_lock_element); 6116 iov[1].iov_base = (char *)buf; 6117 iov[1].iov_len = count; 6118 6119 cifs_stats_inc(&tcon->stats.cifs_stats.num_locks); 6120 6121 memset(&rqst, 0, sizeof(struct smb_rqst)); 6122 rqst.rq_iov = iov; 6123 rqst.rq_nvec = 2; 6124 6125 if (retries) 6126 smb2_set_replay(server, &rqst); 6127 6128 rc = cifs_send_recv(xid, tcon->ses, server, 6129 &rqst, &resp_buf_type, flags, 6130 &rsp_iov); 6131 cifs_small_buf_release(req); 6132 if (rc) { 6133 cifs_dbg(FYI, "Send error in smb2_lockv = %d\n", rc); 6134 cifs_stats_fail_inc(tcon, SMB2_LOCK_HE); 6135 trace_smb3_lock_err(xid, persist_fid, tcon->tid, 6136 tcon->ses->Suid, rc); 6137 } 6138 6139 if (is_replayable_error(rc) && 6140 smb2_should_replay(tcon, &retries, &cur_sleep)) 6141 goto replay_again; 6142 6143 return rc; 6144 } 6145 6146 int 6147 SMB2_lock(const unsigned int xid, struct cifs_tcon *tcon, 6148 const __u64 persist_fid, const __u64 volatile_fid, const __u32 pid, 6149 const __u64 length, const __u64 offset, const __u32 lock_flags, 6150 const bool wait) 6151 { 6152 struct smb2_lock_element lock; 6153 6154 lock.Offset = cpu_to_le64(offset); 6155 lock.Length = cpu_to_le64(length); 6156 lock.Flags = cpu_to_le32(lock_flags); 6157 if (!wait && lock_flags != SMB2_LOCKFLAG_UNLOCK) 6158 lock.Flags |= cpu_to_le32(SMB2_LOCKFLAG_FAIL_IMMEDIATELY); 6159 6160 return smb2_lockv(xid, tcon, persist_fid, volatile_fid, pid, 1, &lock); 6161 } 6162 6163 int 6164 SMB2_lease_break(const unsigned int xid, struct cifs_tcon *tcon, 6165 __u8 *lease_key, const __le32 lease_state) 6166 { 6167 struct smb_rqst rqst; 6168 int rc; 6169 struct smb2_lease_ack *req = NULL; 6170 struct cifs_ses *ses = tcon->ses; 6171 int flags = CIFS_OBREAK_OP; 6172 unsigned int total_len; 6173 struct kvec iov[1]; 6174 struct kvec rsp_iov; 6175 int resp_buf_type; 6176 __u64 *please_key_high; 6177 __u64 *please_key_low; 6178 struct TCP_Server_Info *server = cifs_pick_channel(tcon->ses); 6179 6180 cifs_dbg(FYI, "SMB2_lease_break\n"); 6181 rc = smb2_plain_req_init(SMB2_OPLOCK_BREAK, tcon, server, 6182 (void **) &req, &total_len); 6183 if (rc) 6184 return rc; 6185 6186 if (smb3_encryption_required(tcon)) 6187 flags |= CIFS_TRANSFORM_REQ; 6188 6189 req->hdr.CreditRequest = cpu_to_le16(1); 6190 req->StructureSize = cpu_to_le16(36); 6191 total_len += 12; 6192 6193 memcpy(req->LeaseKey, lease_key, 16); 6194 req->LeaseState = lease_state; 6195 6196 flags |= CIFS_NO_RSP_BUF; 6197 6198 iov[0].iov_base = (char *)req; 6199 iov[0].iov_len = total_len; 6200 6201 memset(&rqst, 0, sizeof(struct smb_rqst)); 6202 rqst.rq_iov = iov; 6203 rqst.rq_nvec = 1; 6204 6205 rc = cifs_send_recv(xid, ses, server, 6206 &rqst, &resp_buf_type, flags, &rsp_iov); 6207 cifs_small_buf_release(req); 6208 6209 please_key_low = (__u64 *)lease_key; 6210 please_key_high = (__u64 *)(lease_key+8); 6211 if (rc) { 6212 cifs_stats_fail_inc(tcon, SMB2_OPLOCK_BREAK_HE); 6213 trace_smb3_lease_err(le32_to_cpu(lease_state), tcon->tid, 6214 ses->Suid, *please_key_low, *please_key_high, rc); 6215 cifs_dbg(FYI, "Send error in Lease Break = %d\n", rc); 6216 } else 6217 trace_smb3_lease_done(le32_to_cpu(lease_state), tcon->tid, 6218 ses->Suid, *please_key_low, *please_key_high); 6219 6220 return rc; 6221 } 6222