1 // SPDX-License-Identifier: LGPL-2.1 2 /* 3 * 4 * Copyright (C) International Business Machines Corp., 2009, 2013 5 * Etersoft, 2012 6 * Author(s): Steve French (sfrench@us.ibm.com) 7 * Pavel Shilovsky (pshilovsky@samba.org) 2012 8 * 9 * Contains the routines for constructing the SMB2 PDUs themselves 10 * 11 */ 12 13 /* SMB2 PDU handling routines here - except for leftovers (eg session setup) */ 14 /* Note that there are handle based routines which must be */ 15 /* treated slightly differently for reconnection purposes since we never */ 16 /* want to reuse a stale file handle and only the caller knows the file info */ 17 18 #include <linux/fs.h> 19 #include <linux/kernel.h> 20 #include <linux/vfs.h> 21 #include <linux/task_io_accounting_ops.h> 22 #include <linux/uaccess.h> 23 #include <linux/uuid.h> 24 #include <linux/pagemap.h> 25 #include <linux/xattr.h> 26 #include <linux/netfs.h> 27 #include <trace/events/netfs.h> 28 #include "cifsglob.h" 29 #include "cifsproto.h" 30 #include "cifsacl.h" 31 #include "smb2proto.h" 32 #include "cifs_unicode.h" 33 #include "cifs_debug.h" 34 #include "ntlmssp.h" 35 #include "../common/smbfsctl.h" 36 #include "../common/smb2status.h" 37 #include "smb2glob.h" 38 #include "cifs_spnego.h" 39 #include "../common/smbdirect/smbdirect.h" 40 #include "smbdirect.h" 41 #include "trace.h" 42 #ifdef CONFIG_CIFS_DFS_UPCALL 43 #include "dfs_cache.h" 44 #endif 45 #include "cached_dir.h" 46 #include "compress.h" 47 #include "fs_context.h" 48 49 /* 50 * The following table defines the expected "StructureSize" of SMB2 requests 51 * in order by SMB2 command. This is similar to "wct" in SMB/CIFS requests. 52 * 53 * Note that commands are defined in smb2pdu.h in le16 but the array below is 54 * indexed by command in host byte order. 55 */ 56 static const int smb2_req_struct_sizes[NUMBER_OF_SMB2_COMMANDS] = { 57 /* SMB2_NEGOTIATE */ 36, 58 /* SMB2_SESSION_SETUP */ 25, 59 /* SMB2_LOGOFF */ 4, 60 /* SMB2_TREE_CONNECT */ 9, 61 /* SMB2_TREE_DISCONNECT */ 4, 62 /* SMB2_CREATE */ 57, 63 /* SMB2_CLOSE */ 24, 64 /* SMB2_FLUSH */ 24, 65 /* SMB2_READ */ 49, 66 /* SMB2_WRITE */ 49, 67 /* SMB2_LOCK */ 48, 68 /* SMB2_IOCTL */ 57, 69 /* SMB2_CANCEL */ 4, 70 /* SMB2_ECHO */ 4, 71 /* SMB2_QUERY_DIRECTORY */ 33, 72 /* SMB2_CHANGE_NOTIFY */ 32, 73 /* SMB2_QUERY_INFO */ 41, 74 /* SMB2_SET_INFO */ 33, 75 /* SMB2_OPLOCK_BREAK */ 24 /* BB this is 36 for LEASE_BREAK variant */ 76 }; 77 78 int smb3_encryption_required(const struct cifs_tcon *tcon) 79 { 80 if (!tcon || !tcon->ses) 81 return 0; 82 if ((tcon->ses->session_flags & SMB2_SESSION_FLAG_ENCRYPT_DATA) || 83 (tcon->share_flags & SHI1005_FLAGS_ENCRYPT_DATA)) 84 return 1; 85 if (tcon->seal && 86 (tcon->ses->server->capabilities & SMB2_GLOBAL_CAP_ENCRYPTION)) 87 return 1; 88 if (((global_secflags & CIFSSEC_MUST_SEAL) == CIFSSEC_MUST_SEAL) && 89 (tcon->ses->server->capabilities & SMB2_GLOBAL_CAP_ENCRYPTION)) 90 return 1; 91 return 0; 92 } 93 94 static void 95 smb2_hdr_assemble(struct smb2_hdr *shdr, __le16 smb2_cmd, 96 const struct cifs_tcon *tcon, 97 struct TCP_Server_Info *server) 98 { 99 struct smb3_hdr_req *smb3_hdr; 100 101 shdr->ProtocolId = SMB2_PROTO_NUMBER; 102 shdr->StructureSize = cpu_to_le16(64); 103 shdr->Command = smb2_cmd; 104 105 if (server) { 106 /* After reconnect SMB3 must set ChannelSequence on subsequent reqs */ 107 if (server->dialect >= SMB30_PROT_ID) { 108 smb3_hdr = (struct smb3_hdr_req *)shdr; 109 /* 110 * if primary channel is not set yet, use default 111 * channel for chan sequence num 112 */ 113 if (SERVER_IS_CHAN(server)) 114 smb3_hdr->ChannelSequence = 115 cpu_to_le16(server->primary_server->channel_sequence_num); 116 else 117 smb3_hdr->ChannelSequence = 118 cpu_to_le16(server->channel_sequence_num); 119 } 120 spin_lock(&server->req_lock); 121 /* Request up to 10 credits but don't go over the limit. */ 122 if (server->credits >= server->max_credits) 123 shdr->CreditRequest = cpu_to_le16(0); 124 else 125 shdr->CreditRequest = cpu_to_le16( 126 min_t(int, server->max_credits - 127 server->credits, 10)); 128 spin_unlock(&server->req_lock); 129 } else { 130 shdr->CreditRequest = cpu_to_le16(2); 131 } 132 shdr->Id.SyncId.ProcessId = cpu_to_le32((__u16)current->tgid); 133 134 if (!tcon) 135 goto out; 136 137 /* GLOBAL_CAP_LARGE_MTU will only be set if dialect > SMB2.02 */ 138 /* See sections 2.2.4 and 3.2.4.1.5 of MS-SMB2 */ 139 if (server && (server->capabilities & SMB2_GLOBAL_CAP_LARGE_MTU)) 140 shdr->CreditCharge = cpu_to_le16(1); 141 /* else CreditCharge MBZ */ 142 143 shdr->Id.SyncId.TreeId = cpu_to_le32(tcon->tid); 144 /* Uid is not converted */ 145 if (tcon->ses) 146 shdr->SessionId = cpu_to_le64(tcon->ses->Suid); 147 148 /* 149 * If we would set SMB2_FLAGS_DFS_OPERATIONS on open we also would have 150 * to pass the path on the Open SMB prefixed by \\server\share. 151 * Not sure when we would need to do the augmented path (if ever) and 152 * setting this flag breaks the SMB2 open operation since it is 153 * illegal to send an empty path name (without \\server\share prefix) 154 * when the DFS flag is set in the SMB open header. We could 155 * consider setting the flag on all operations other than open 156 * but it is safer to net set it for now. 157 */ 158 /* if (tcon->share_flags & SHI1005_FLAGS_DFS) 159 shdr->Flags |= SMB2_FLAGS_DFS_OPERATIONS; */ 160 161 if (server && server->sign && !smb3_encryption_required(tcon)) 162 shdr->Flags |= SMB2_FLAGS_SIGNED; 163 out: 164 return; 165 } 166 167 /* helper function for code reuse */ 168 static int 169 cifs_chan_skip_or_disable(struct cifs_ses *ses, 170 struct TCP_Server_Info *server, 171 bool from_reconnect, bool disable_mchan) 172 { 173 struct TCP_Server_Info *pserver; 174 unsigned int chan_index; 175 176 if (SERVER_IS_CHAN(server)) { 177 cifs_dbg(VFS, 178 "server %s does not support multichannel anymore. Skip secondary channel\n", 179 ses->server->hostname); 180 181 spin_lock(&ses->chan_lock); 182 chan_index = cifs_ses_get_chan_index(ses, server); 183 if (chan_index == CIFS_INVAL_CHAN_INDEX) { 184 spin_unlock(&ses->chan_lock); 185 goto skip_terminate; 186 } 187 188 ses->chans[chan_index].server = NULL; 189 server->terminate = true; 190 spin_unlock(&ses->chan_lock); 191 192 /* 193 * the above reference of server by channel 194 * needs to be dropped without holding chan_lock 195 * as cifs_put_tcp_session takes a higher lock 196 * i.e. cifs_tcp_ses_lock 197 */ 198 cifs_put_tcp_session(server, from_reconnect); 199 200 cifs_signal_cifsd_for_reconnect(server, false); 201 202 /* mark primary server as needing reconnect */ 203 pserver = server->primary_server; 204 cifs_signal_cifsd_for_reconnect(pserver, false); 205 skip_terminate: 206 return -EHOSTDOWN; 207 } 208 209 cifs_decrease_secondary_channels(ses, disable_mchan); 210 211 return 0; 212 } 213 214 /* 215 * smb3_update_ses_channels - Synchronize session channels with new configuration 216 * @ses: pointer to the CIFS session structure 217 * @server: pointer to the TCP server info structure 218 * @from_reconnect: indicates if called from reconnect context 219 * @disable_mchan: indicates if called from reconnect to disable multichannel 220 * 221 * Returns 0 on success or error code on failure. 222 * 223 * Outside of reconfigure, this function is called from cifs_mount() during mount 224 * and from reconnect scenarios to adjust channel count when the 225 * server's multichannel support changes. 226 */ 227 int smb3_update_ses_channels(struct cifs_ses *ses, struct TCP_Server_Info *server, 228 bool from_reconnect, bool disable_mchan) 229 { 230 int rc = 0; 231 /* 232 * Manage session channels based on current count vs max: 233 * - If disable requested, skip or disable the channel 234 * - If below max channels, attempt to add more 235 * - If above max channels, skip or disable excess channels 236 */ 237 if (disable_mchan) 238 rc = cifs_chan_skip_or_disable(ses, server, from_reconnect, disable_mchan); 239 else { 240 if (ses->chan_count < ses->chan_max) 241 rc = cifs_try_adding_channels(ses); 242 else if (ses->chan_count > ses->chan_max) 243 rc = cifs_chan_skip_or_disable(ses, server, from_reconnect, disable_mchan); 244 } 245 246 return rc; 247 } 248 249 static int 250 smb2_reconnect(__le16 smb2_command, struct cifs_tcon *tcon, 251 struct TCP_Server_Info *server, bool from_reconnect) 252 { 253 struct cifs_ses *ses; 254 int xid; 255 int rc = 0; 256 257 /* 258 * SMB2s NegProt, SessSetup, Logoff do not have tcon yet so 259 * check for tcp and smb session status done differently 260 * for those three - in the calling routine. 261 */ 262 if (tcon == NULL) 263 return 0; 264 265 if (smb2_command == SMB2_TREE_CONNECT) 266 return 0; 267 268 spin_lock(&tcon->tc_lock); 269 if (tcon->status == TID_EXITING) { 270 /* 271 * only tree disconnect allowed when disconnecting ... 272 */ 273 if (smb2_command != SMB2_TREE_DISCONNECT) { 274 spin_unlock(&tcon->tc_lock); 275 cifs_tcon_dbg(FYI, "can not send cmd %d while umounting\n", 276 smb2_command); 277 return -ENODEV; 278 } 279 } 280 spin_unlock(&tcon->tc_lock); 281 282 ses = tcon->ses; 283 if (!ses) 284 return smb_EIO(smb_eio_trace_null_pointers); 285 spin_lock(&ses->ses_lock); 286 if (ses->ses_status == SES_EXITING) { 287 spin_unlock(&ses->ses_lock); 288 return smb_EIO(smb_eio_trace_sess_exiting); 289 } 290 spin_unlock(&ses->ses_lock); 291 if (!ses->server || !server) 292 return smb_EIO(smb_eio_trace_null_pointers); 293 294 spin_lock(&server->srv_lock); 295 if (server->tcpStatus == CifsNeedReconnect) { 296 /* 297 * Return to caller for TREE_DISCONNECT and LOGOFF and CLOSE 298 * here since they are implicitly done when session drops. 299 */ 300 switch (smb2_command) { 301 /* 302 * BB Should we keep oplock break and add flush to exceptions? 303 */ 304 case SMB2_TREE_DISCONNECT: 305 case SMB2_CANCEL: 306 case SMB2_CLOSE: 307 case SMB2_OPLOCK_BREAK: 308 spin_unlock(&server->srv_lock); 309 return -EAGAIN; 310 } 311 } 312 313 /* if server is marked for termination, cifsd will cleanup */ 314 if (server->terminate) { 315 spin_unlock(&server->srv_lock); 316 return -EHOSTDOWN; 317 } 318 spin_unlock(&server->srv_lock); 319 320 again: 321 rc = cifs_wait_for_server_reconnect(server, tcon->retry); 322 if (rc) 323 return rc; 324 325 spin_lock(&ses->chan_lock); 326 if (!cifs_chan_needs_reconnect(ses, server) && !tcon->need_reconnect) { 327 spin_unlock(&ses->chan_lock); 328 return 0; 329 } 330 spin_unlock(&ses->chan_lock); 331 cifs_tcon_dbg(FYI, "sess reconnect mask: 0x%lx, tcon reconnect: %d\n", 332 tcon->ses->chans_need_reconnect, 333 tcon->need_reconnect); 334 335 mutex_lock(&ses->session_mutex); 336 /* 337 * Handle the case where a concurrent thread failed to negotiate or 338 * killed a channel. 339 */ 340 spin_lock(&server->srv_lock); 341 switch (server->tcpStatus) { 342 case CifsExiting: 343 spin_unlock(&server->srv_lock); 344 mutex_unlock(&ses->session_mutex); 345 return -EHOSTDOWN; 346 case CifsNeedReconnect: 347 spin_unlock(&server->srv_lock); 348 mutex_unlock(&ses->session_mutex); 349 if (!tcon->retry) 350 return -EHOSTDOWN; 351 goto again; 352 default: 353 break; 354 } 355 spin_unlock(&server->srv_lock); 356 357 /* 358 * need to prevent multiple threads trying to simultaneously 359 * reconnect the same SMB session 360 */ 361 spin_lock(&ses->ses_lock); 362 spin_lock(&ses->chan_lock); 363 if (!cifs_chan_needs_reconnect(ses, server) && 364 ses->ses_status == SES_GOOD) { 365 spin_unlock(&ses->chan_lock); 366 spin_unlock(&ses->ses_lock); 367 /* this means that we only need to tree connect */ 368 if (tcon->need_reconnect) 369 goto skip_sess_setup; 370 371 mutex_unlock(&ses->session_mutex); 372 goto out; 373 } 374 spin_unlock(&ses->chan_lock); 375 spin_unlock(&ses->ses_lock); 376 377 rc = cifs_negotiate_protocol(0, ses, server); 378 if (rc) { 379 mutex_unlock(&ses->session_mutex); 380 if (!tcon->retry) 381 return -EHOSTDOWN; 382 goto again; 383 } 384 /* 385 * if server stopped supporting multichannel 386 * and the first channel reconnected, disable all the others. 387 */ 388 if (ses->chan_count > 1 && 389 !(server->capabilities & SMB2_GLOBAL_CAP_MULTI_CHANNEL)) { 390 rc = smb3_update_ses_channels(ses, server, 391 from_reconnect, true /* disable_mchan */); 392 if (rc) { 393 mutex_unlock(&ses->session_mutex); 394 goto out; 395 } 396 } 397 398 rc = cifs_setup_session(0, ses, server, ses->local_nls); 399 if ((rc == -EACCES) || (rc == -EKEYEXPIRED) || (rc == -EKEYREVOKED)) { 400 /* 401 * Try alternate password for next reconnect (key rotation 402 * could be enabled on the server e.g.) if an alternate 403 * password is available and the current password is expired, 404 * but do not swap on non pwd related errors like host down 405 */ 406 if (ses->password2) 407 swap(ses->password2, ses->password); 408 } 409 if (rc) { 410 mutex_unlock(&ses->session_mutex); 411 if (rc == -EACCES && !tcon->retry) 412 return -EHOSTDOWN; 413 goto out; 414 } 415 416 skip_sess_setup: 417 if (!tcon->need_reconnect) { 418 mutex_unlock(&ses->session_mutex); 419 goto out; 420 } 421 cifs_mark_open_files_invalid(tcon); 422 if (tcon->use_persistent) 423 tcon->need_reopen_files = true; 424 425 rc = cifs_tree_connect(0, tcon); 426 427 cifs_tcon_dbg(FYI, "reconnect tcon rc = %d\n", rc); 428 if (rc) { 429 /* If sess reconnected but tcon didn't, something strange ... */ 430 mutex_unlock(&ses->session_mutex); 431 cifs_tcon_dbg(VFS, "reconnect tcon failed rc = %d\n", rc); 432 goto out; 433 } 434 435 spin_lock(&ses->ses_lock); 436 if (ses->flags & CIFS_SES_FLAG_SCALE_CHANNELS) { 437 spin_unlock(&ses->ses_lock); 438 mutex_unlock(&ses->session_mutex); 439 goto skip_add_channels; 440 } 441 ses->flags |= CIFS_SES_FLAG_SCALE_CHANNELS; 442 spin_unlock(&ses->ses_lock); 443 444 if (!rc && 445 (server->capabilities & SMB2_GLOBAL_CAP_MULTI_CHANNEL) && 446 server->ops->query_server_interfaces) { 447 /* 448 * query server network interfaces, in case they change. 449 * Also mark the session as pending this update while the query 450 * is in progress. This will be used to avoid calling 451 * smb2_reconnect recursively. 452 */ 453 ses->flags |= CIFS_SES_FLAGS_PENDING_QUERY_INTERFACES; 454 xid = get_xid(); 455 rc = server->ops->query_server_interfaces(xid, tcon, false); 456 free_xid(xid); 457 ses->flags &= ~CIFS_SES_FLAGS_PENDING_QUERY_INTERFACES; 458 459 if (!tcon->ipc && !tcon->dummy) 460 queue_delayed_work(cifsiod_wq, &tcon->query_interfaces, 461 (SMB_INTERFACE_POLL_INTERVAL * HZ)); 462 463 mutex_unlock(&ses->session_mutex); 464 465 if (rc == -EOPNOTSUPP && ses->chan_count > 1) { 466 /* 467 * some servers like Azure SMB server do not advertise 468 * that multichannel has been disabled with server 469 * capabilities, rather return STATUS_NOT_IMPLEMENTED. 470 * treat this as server not supporting multichannel 471 */ 472 473 rc = smb3_update_ses_channels(ses, server, 474 from_reconnect, 475 true /* disable_mchan */); 476 goto skip_add_channels; 477 } else if (rc) 478 cifs_tcon_dbg(FYI, "%s: failed to query server interfaces: %d\n", 479 __func__, rc); 480 481 if (ses->chan_max > ses->chan_count && 482 ses->iface_count && 483 !SERVER_IS_CHAN(server)) { 484 if (ses->chan_count == 1) 485 cifs_server_dbg(VFS, "supports multichannel now\n"); 486 487 smb3_update_ses_channels(ses, server, from_reconnect, 488 false /* disable_mchan */); 489 } 490 } else { 491 mutex_unlock(&ses->session_mutex); 492 } 493 494 skip_add_channels: 495 spin_lock(&ses->ses_lock); 496 ses->flags &= ~CIFS_SES_FLAG_SCALE_CHANNELS; 497 spin_unlock(&ses->ses_lock); 498 499 if (smb2_command != SMB2_INTERNAL_CMD) 500 cifs_queue_server_reconn(server); 501 502 atomic_inc(&tconInfoReconnectCount); 503 out: 504 /* 505 * Check if handle based operation so we know whether we can continue 506 * or not without returning to caller to reset file handle. 507 */ 508 /* 509 * BB Is flush done by server on drop of tcp session? Should we special 510 * case it and skip above? 511 */ 512 switch (smb2_command) { 513 case SMB2_FLUSH: 514 case SMB2_READ: 515 case SMB2_WRITE: 516 case SMB2_LOCK: 517 case SMB2_QUERY_DIRECTORY: 518 case SMB2_CHANGE_NOTIFY: 519 case SMB2_QUERY_INFO: 520 case SMB2_SET_INFO: 521 case SMB2_IOCTL: 522 rc = -EAGAIN; 523 } 524 return rc; 525 } 526 527 static void 528 fill_small_buf(__le16 smb2_command, struct cifs_tcon *tcon, 529 struct TCP_Server_Info *server, 530 void *buf, 531 unsigned int *total_len) 532 { 533 struct smb2_pdu *spdu = buf; 534 /* lookup word count ie StructureSize from table */ 535 __u16 parmsize = smb2_req_struct_sizes[le16_to_cpu(smb2_command)]; 536 537 /* 538 * smaller than SMALL_BUFFER_SIZE but bigger than fixed area of 539 * largest operations (Create) 540 */ 541 memset(buf, 0, 256); 542 543 smb2_hdr_assemble(&spdu->hdr, smb2_command, tcon, server); 544 spdu->StructureSize2 = cpu_to_le16(parmsize); 545 546 *total_len = parmsize + sizeof(struct smb2_hdr); 547 } 548 549 /* 550 * Allocate and return pointer to an SMB request hdr, and set basic 551 * SMB information in the SMB header. If the return code is zero, this 552 * function must have filled in request_buf pointer. 553 */ 554 static int __smb2_plain_req_init(__le16 smb2_command, struct cifs_tcon *tcon, 555 struct TCP_Server_Info *server, 556 void **request_buf, unsigned int *total_len) 557 { 558 /* BB eventually switch this to SMB2 specific small buf size */ 559 switch (smb2_command) { 560 case SMB2_SET_INFO: 561 case SMB2_QUERY_INFO: 562 *request_buf = cifs_buf_get(); 563 break; 564 default: 565 *request_buf = cifs_small_buf_get(); 566 break; 567 } 568 if (*request_buf == NULL) { 569 /* BB should we add a retry in here if not a writepage? */ 570 return -ENOMEM; 571 } 572 573 fill_small_buf(smb2_command, tcon, server, 574 (struct smb2_hdr *)(*request_buf), 575 total_len); 576 577 if (tcon != NULL) { 578 uint16_t com_code = le16_to_cpu(smb2_command); 579 cifs_stats_inc(&tcon->stats.smb2_stats.smb2_com_sent[com_code]); 580 cifs_stats_inc(&tcon->num_smbs_sent); 581 } 582 583 return 0; 584 } 585 586 static int smb2_plain_req_init(__le16 smb2_command, struct cifs_tcon *tcon, 587 struct TCP_Server_Info *server, 588 void **request_buf, unsigned int *total_len) 589 { 590 int rc; 591 592 rc = smb2_reconnect(smb2_command, tcon, server, false); 593 if (rc) 594 return rc; 595 596 return __smb2_plain_req_init(smb2_command, tcon, server, request_buf, 597 total_len); 598 } 599 600 static int smb2_ioctl_req_init(u32 opcode, struct cifs_tcon *tcon, 601 struct TCP_Server_Info *server, 602 void **request_buf, unsigned int *total_len) 603 { 604 /* 605 * Skip reconnect in one of the following cases: 606 * 1. For FSCTL_VALIDATE_NEGOTIATE_INFO IOCTLs 607 * 2. For FSCTL_QUERY_NETWORK_INTERFACE_INFO IOCTL when called from 608 * smb2_reconnect (indicated by CIFS_SES_FLAG_SCALE_CHANNELS ses flag) 609 */ 610 if (opcode == FSCTL_VALIDATE_NEGOTIATE_INFO || 611 (opcode == FSCTL_QUERY_NETWORK_INTERFACE_INFO && 612 (tcon->ses->flags & CIFS_SES_FLAGS_PENDING_QUERY_INTERFACES))) 613 return __smb2_plain_req_init(SMB2_IOCTL, tcon, server, 614 request_buf, total_len); 615 616 return smb2_plain_req_init(SMB2_IOCTL, tcon, server, 617 request_buf, total_len); 618 } 619 620 /* For explanation of negotiate contexts see MS-SMB2 section 2.2.3.1 */ 621 622 static void 623 build_preauth_ctxt(struct smb2_preauth_neg_context *pneg_ctxt) 624 { 625 pneg_ctxt->ContextType = SMB2_PREAUTH_INTEGRITY_CAPABILITIES; 626 pneg_ctxt->DataLength = cpu_to_le16(38); 627 pneg_ctxt->HashAlgorithmCount = cpu_to_le16(1); 628 pneg_ctxt->SaltLength = cpu_to_le16(SMB311_SALT_SIZE); 629 get_random_bytes(pneg_ctxt->Salt, SMB311_SALT_SIZE); 630 pneg_ctxt->HashAlgorithms = SMB2_PREAUTH_INTEGRITY_SHA512; 631 } 632 633 static void 634 build_compression_ctxt(struct smb2_compression_capabilities_context *pneg_ctxt) 635 { 636 pneg_ctxt->ContextType = SMB2_COMPRESSION_CAPABILITIES; 637 pneg_ctxt->DataLength = 638 cpu_to_le16(sizeof(struct smb2_compression_capabilities_context) 639 - sizeof(struct smb2_neg_context)); 640 pneg_ctxt->CompressionAlgorithmCount = cpu_to_le16(3); 641 pneg_ctxt->CompressionAlgorithms[0] = SMB3_COMPRESS_LZ77; 642 pneg_ctxt->CompressionAlgorithms[1] = SMB3_COMPRESS_LZ77_HUFF; 643 pneg_ctxt->CompressionAlgorithms[2] = SMB3_COMPRESS_LZNT1; 644 } 645 646 static unsigned int 647 build_signing_ctxt(struct smb2_signing_capabilities *pneg_ctxt) 648 { 649 unsigned int ctxt_len = sizeof(struct smb2_signing_capabilities); 650 unsigned short num_algs = 1; /* number of signing algorithms sent */ 651 652 pneg_ctxt->ContextType = SMB2_SIGNING_CAPABILITIES; 653 /* 654 * Context Data length must be rounded to multiple of 8 for some servers 655 */ 656 pneg_ctxt->DataLength = cpu_to_le16(ALIGN(sizeof(struct smb2_signing_capabilities) - 657 sizeof(struct smb2_neg_context) + 658 (num_algs * sizeof(u16)), 8)); 659 pneg_ctxt->SigningAlgorithmCount = cpu_to_le16(num_algs); 660 pneg_ctxt->SigningAlgorithms[0] = cpu_to_le16(SIGNING_ALG_AES_CMAC); 661 662 ctxt_len += sizeof(__le16) * num_algs; 663 ctxt_len = ALIGN(ctxt_len, 8); 664 return ctxt_len; 665 /* TBD add SIGNING_ALG_AES_GMAC and/or SIGNING_ALG_HMAC_SHA256 */ 666 } 667 668 static void 669 build_encrypt_ctxt(struct smb2_encryption_neg_context *pneg_ctxt) 670 { 671 pneg_ctxt->ContextType = SMB2_ENCRYPTION_CAPABILITIES; 672 if (require_gcm_256) { 673 pneg_ctxt->DataLength = cpu_to_le16(4); /* Cipher Count + 1 cipher */ 674 pneg_ctxt->CipherCount = cpu_to_le16(1); 675 pneg_ctxt->Ciphers[0] = SMB2_ENCRYPTION_AES256_GCM; 676 } else if (enable_gcm_256) { 677 pneg_ctxt->DataLength = cpu_to_le16(8); /* Cipher Count + 3 ciphers */ 678 pneg_ctxt->CipherCount = cpu_to_le16(3); 679 pneg_ctxt->Ciphers[0] = SMB2_ENCRYPTION_AES128_GCM; 680 pneg_ctxt->Ciphers[1] = SMB2_ENCRYPTION_AES256_GCM; 681 pneg_ctxt->Ciphers[2] = SMB2_ENCRYPTION_AES128_CCM; 682 } else { 683 pneg_ctxt->DataLength = cpu_to_le16(6); /* Cipher Count + 2 ciphers */ 684 pneg_ctxt->CipherCount = cpu_to_le16(2); 685 pneg_ctxt->Ciphers[0] = SMB2_ENCRYPTION_AES128_GCM; 686 pneg_ctxt->Ciphers[1] = SMB2_ENCRYPTION_AES128_CCM; 687 } 688 } 689 690 static unsigned int 691 build_netname_ctxt(struct smb2_netname_neg_context *pneg_ctxt, char *hostname) 692 { 693 struct nls_table *cp = load_nls_default(); 694 695 pneg_ctxt->ContextType = SMB2_NETNAME_NEGOTIATE_CONTEXT_ID; 696 697 /* copy up to max of first 100 bytes of server name to NetName field */ 698 pneg_ctxt->DataLength = cpu_to_le16(2 * cifs_strtoUTF16(pneg_ctxt->NetName, hostname, 100, cp)); 699 /* context size is DataLength + minimal smb2_neg_context */ 700 return ALIGN(le16_to_cpu(pneg_ctxt->DataLength) + sizeof(struct smb2_neg_context), 8); 701 } 702 703 static void 704 build_posix_ctxt(struct smb2_posix_neg_context *pneg_ctxt) 705 { 706 pneg_ctxt->ContextType = SMB2_POSIX_EXTENSIONS_AVAILABLE; 707 pneg_ctxt->DataLength = cpu_to_le16(POSIX_CTXT_DATA_LEN); 708 /* SMB2_CREATE_TAG_POSIX is "0x93AD25509CB411E7B42383DE968BCD7C" */ 709 pneg_ctxt->Name[0] = 0x93; 710 pneg_ctxt->Name[1] = 0xAD; 711 pneg_ctxt->Name[2] = 0x25; 712 pneg_ctxt->Name[3] = 0x50; 713 pneg_ctxt->Name[4] = 0x9C; 714 pneg_ctxt->Name[5] = 0xB4; 715 pneg_ctxt->Name[6] = 0x11; 716 pneg_ctxt->Name[7] = 0xE7; 717 pneg_ctxt->Name[8] = 0xB4; 718 pneg_ctxt->Name[9] = 0x23; 719 pneg_ctxt->Name[10] = 0x83; 720 pneg_ctxt->Name[11] = 0xDE; 721 pneg_ctxt->Name[12] = 0x96; 722 pneg_ctxt->Name[13] = 0x8B; 723 pneg_ctxt->Name[14] = 0xCD; 724 pneg_ctxt->Name[15] = 0x7C; 725 } 726 727 static void 728 assemble_neg_contexts(struct smb2_negotiate_req *req, 729 struct TCP_Server_Info *server, unsigned int *total_len) 730 { 731 unsigned int ctxt_len, neg_context_count; 732 struct TCP_Server_Info *pserver; 733 char *pneg_ctxt; 734 char *hostname; 735 736 if (*total_len > 200) { 737 /* In case length corrupted don't want to overrun smb buffer */ 738 cifs_server_dbg(VFS, "Bad frame length assembling neg contexts\n"); 739 return; 740 } 741 742 /* 743 * round up total_len of fixed part of SMB3 negotiate request to 8 744 * byte boundary before adding negotiate contexts 745 */ 746 *total_len = ALIGN(*total_len, 8); 747 748 pneg_ctxt = (*total_len) + (char *)req; 749 req->NegotiateContextOffset = cpu_to_le32(*total_len); 750 751 build_preauth_ctxt((struct smb2_preauth_neg_context *)pneg_ctxt); 752 ctxt_len = ALIGN(sizeof(struct smb2_preauth_neg_context), 8); 753 *total_len += ctxt_len; 754 pneg_ctxt += ctxt_len; 755 756 build_encrypt_ctxt((struct smb2_encryption_neg_context *)pneg_ctxt); 757 ctxt_len = ALIGN(sizeof(struct smb2_encryption_neg_context), 8); 758 *total_len += ctxt_len; 759 pneg_ctxt += ctxt_len; 760 761 /* 762 * secondary channels don't have the hostname field populated 763 * use the hostname field in the primary channel instead 764 */ 765 pserver = SERVER_IS_CHAN(server) ? server->primary_server : server; 766 cifs_server_lock(pserver); 767 hostname = pserver->hostname; 768 if (hostname && (hostname[0] != 0)) { 769 ctxt_len = build_netname_ctxt((struct smb2_netname_neg_context *)pneg_ctxt, 770 hostname); 771 *total_len += ctxt_len; 772 pneg_ctxt += ctxt_len; 773 neg_context_count = 3; 774 } else 775 neg_context_count = 2; 776 cifs_server_unlock(pserver); 777 778 build_posix_ctxt((struct smb2_posix_neg_context *)pneg_ctxt); 779 *total_len += sizeof(struct smb2_posix_neg_context); 780 pneg_ctxt += sizeof(struct smb2_posix_neg_context); 781 neg_context_count++; 782 783 if (server->compression.requested) { 784 build_compression_ctxt((struct smb2_compression_capabilities_context *) 785 pneg_ctxt); 786 ctxt_len = ALIGN(sizeof(struct smb2_compression_capabilities_context), 8); 787 *total_len += ctxt_len; 788 pneg_ctxt += ctxt_len; 789 neg_context_count++; 790 } 791 792 if (enable_negotiate_signing) { 793 ctxt_len = build_signing_ctxt((struct smb2_signing_capabilities *) 794 pneg_ctxt); 795 *total_len += ctxt_len; 796 pneg_ctxt += ctxt_len; 797 neg_context_count++; 798 } 799 800 /* check for and add transport_capabilities and signing capabilities */ 801 req->NegotiateContextCount = cpu_to_le16(neg_context_count); 802 803 } 804 805 /* If invalid preauth context warn but use what we requested, SHA-512 */ 806 static void decode_preauth_context(struct smb2_preauth_neg_context *ctxt) 807 { 808 unsigned int len = le16_to_cpu(ctxt->DataLength); 809 810 /* 811 * Caller checked that DataLength remains within SMB boundary. We still 812 * need to confirm that one HashAlgorithms member is accounted for. 813 */ 814 if (len < MIN_PREAUTH_CTXT_DATA_LEN) { 815 pr_warn_once("server sent bad preauth context\n"); 816 return; 817 } else if (len < MIN_PREAUTH_CTXT_DATA_LEN + le16_to_cpu(ctxt->SaltLength)) { 818 pr_warn_once("server sent invalid SaltLength\n"); 819 return; 820 } 821 if (le16_to_cpu(ctxt->HashAlgorithmCount) != 1) 822 pr_warn_once("Invalid SMB3 hash algorithm count\n"); 823 if (ctxt->HashAlgorithms != SMB2_PREAUTH_INTEGRITY_SHA512) 824 pr_warn_once("unknown SMB3 hash algorithm\n"); 825 } 826 827 static void decode_compress_ctx(struct TCP_Server_Info *server, 828 struct smb2_compression_capabilities_context *ctxt) 829 { 830 unsigned int len = le16_to_cpu(ctxt->DataLength); 831 __le16 alg; 832 833 server->compression.enabled = false; 834 835 /* 836 * Caller checked that DataLength remains within SMB boundary. We still 837 * need to confirm that one CompressionAlgorithms member is accounted 838 * for. 839 */ 840 if (len < 10) { 841 pr_warn_once("server sent bad compression cntxt\n"); 842 return; 843 } 844 845 if (le16_to_cpu(ctxt->CompressionAlgorithmCount) != 1) { 846 pr_warn_once("invalid SMB3 compress algorithm count\n"); 847 return; 848 } 849 850 alg = ctxt->CompressionAlgorithms[0]; 851 852 /* 'NONE' (0) compressor type is never negotiated */ 853 if (alg == 0 || le16_to_cpu(alg) > 3) { 854 pr_warn_once("invalid compression algorithm '%u'\n", alg); 855 return; 856 } 857 858 server->compression.alg = alg; 859 server->compression.enabled = true; 860 } 861 862 static int decode_encrypt_ctx(struct TCP_Server_Info *server, 863 struct smb2_encryption_neg_context *ctxt) 864 { 865 unsigned int len = le16_to_cpu(ctxt->DataLength); 866 867 cifs_dbg(FYI, "decode SMB3.11 encryption neg context of len %d\n", len); 868 /* 869 * Caller checked that DataLength remains within SMB boundary. We still 870 * need to confirm that one Cipher flexible array member is accounted 871 * for. 872 */ 873 if (len < MIN_ENCRYPT_CTXT_DATA_LEN) { 874 pr_warn_once("server sent bad crypto ctxt len\n"); 875 return -EINVAL; 876 } 877 878 if (le16_to_cpu(ctxt->CipherCount) != 1) { 879 pr_warn_once("Invalid SMB3.11 cipher count\n"); 880 return -EINVAL; 881 } 882 cifs_dbg(FYI, "SMB311 cipher type:%d\n", le16_to_cpu(ctxt->Ciphers[0])); 883 if (require_gcm_256) { 884 if (ctxt->Ciphers[0] != SMB2_ENCRYPTION_AES256_GCM) { 885 cifs_dbg(VFS, "Server does not support requested encryption type (AES256 GCM)\n"); 886 return -EOPNOTSUPP; 887 } 888 } else if (ctxt->Ciphers[0] == 0) { 889 /* 890 * e.g. if server only supported AES256_CCM (very unlikely) 891 * or server supported no encryption types or had all disabled. 892 * Since GLOBAL_CAP_ENCRYPTION will be not set, in the case 893 * in which mount requested encryption ("seal") checks later 894 * on during tree connection will return proper rc, but if 895 * seal not requested by client, since server is allowed to 896 * return 0 to indicate no supported cipher, we can't fail here 897 */ 898 server->cipher_type = 0; 899 server->capabilities &= ~SMB2_GLOBAL_CAP_ENCRYPTION; 900 pr_warn_once("Server does not support requested encryption types\n"); 901 return 0; 902 } else if ((ctxt->Ciphers[0] != SMB2_ENCRYPTION_AES128_CCM) && 903 (ctxt->Ciphers[0] != SMB2_ENCRYPTION_AES128_GCM) && 904 (ctxt->Ciphers[0] != SMB2_ENCRYPTION_AES256_GCM)) { 905 /* server returned a cipher we didn't ask for */ 906 pr_warn_once("Invalid SMB3.11 cipher returned\n"); 907 return -EINVAL; 908 } 909 server->cipher_type = ctxt->Ciphers[0]; 910 server->capabilities |= SMB2_GLOBAL_CAP_ENCRYPTION; 911 return 0; 912 } 913 914 static void decode_signing_ctx(struct TCP_Server_Info *server, 915 struct smb2_signing_capabilities *pctxt) 916 { 917 unsigned int len = le16_to_cpu(pctxt->DataLength); 918 919 /* 920 * Caller checked that DataLength remains within SMB boundary. We still 921 * need to confirm that one SigningAlgorithms flexible array member is 922 * accounted for. 923 */ 924 if ((len < 4) || (len > 16)) { 925 pr_warn_once("server sent bad signing negcontext\n"); 926 return; 927 } 928 if (le16_to_cpu(pctxt->SigningAlgorithmCount) != 1) { 929 pr_warn_once("Invalid signing algorithm count\n"); 930 return; 931 } 932 if (le16_to_cpu(pctxt->SigningAlgorithms[0]) > 2) { 933 pr_warn_once("unknown signing algorithm\n"); 934 return; 935 } 936 937 server->signing_negotiated = true; 938 server->signing_algorithm = le16_to_cpu(pctxt->SigningAlgorithms[0]); 939 cifs_dbg(FYI, "signing algorithm %d chosen\n", 940 server->signing_algorithm); 941 } 942 943 944 static int smb311_decode_neg_context(struct smb2_negotiate_rsp *rsp, 945 struct TCP_Server_Info *server, 946 unsigned int len_of_smb) 947 { 948 struct smb2_neg_context *pctx; 949 unsigned int offset = le32_to_cpu(rsp->NegotiateContextOffset); 950 unsigned int ctxt_cnt = le16_to_cpu(rsp->NegotiateContextCount); 951 unsigned int len_of_ctxts, i; 952 int rc = 0; 953 954 cifs_dbg(FYI, "decoding %d negotiate contexts\n", ctxt_cnt); 955 if (len_of_smb <= offset) { 956 cifs_server_dbg(VFS, "Invalid response: negotiate context offset\n"); 957 return -EINVAL; 958 } 959 960 len_of_ctxts = len_of_smb - offset; 961 962 for (i = 0; i < ctxt_cnt; i++) { 963 int clen; 964 /* check that offset is not beyond end of SMB */ 965 if (len_of_ctxts < sizeof(struct smb2_neg_context)) 966 break; 967 968 pctx = (struct smb2_neg_context *)(offset + (char *)rsp); 969 clen = sizeof(struct smb2_neg_context) 970 + le16_to_cpu(pctx->DataLength); 971 /* 972 * 2.2.4 SMB2 NEGOTIATE Response 973 * Subsequent negotiate contexts MUST appear at the first 8-byte 974 * aligned offset following the previous negotiate context. 975 */ 976 if (i + 1 != ctxt_cnt) 977 clen = ALIGN(clen, 8); 978 if (clen > len_of_ctxts) 979 break; 980 981 if (pctx->ContextType == SMB2_PREAUTH_INTEGRITY_CAPABILITIES) 982 decode_preauth_context( 983 (struct smb2_preauth_neg_context *)pctx); 984 else if (pctx->ContextType == SMB2_ENCRYPTION_CAPABILITIES) 985 rc = decode_encrypt_ctx(server, 986 (struct smb2_encryption_neg_context *)pctx); 987 else if (pctx->ContextType == SMB2_COMPRESSION_CAPABILITIES) 988 decode_compress_ctx(server, 989 (struct smb2_compression_capabilities_context *)pctx); 990 else if (pctx->ContextType == SMB2_POSIX_EXTENSIONS_AVAILABLE) 991 server->posix_ext_supported = true; 992 else if (pctx->ContextType == SMB2_SIGNING_CAPABILITIES) 993 decode_signing_ctx(server, 994 (struct smb2_signing_capabilities *)pctx); 995 else 996 cifs_server_dbg(VFS, "unknown negcontext of type %d ignored\n", 997 le16_to_cpu(pctx->ContextType)); 998 if (rc) 999 break; 1000 1001 offset += clen; 1002 len_of_ctxts -= clen; 1003 } 1004 return rc; 1005 } 1006 1007 static struct create_posix * 1008 create_posix_buf(umode_t mode) 1009 { 1010 struct create_posix *buf; 1011 1012 buf = kzalloc_obj(struct create_posix); 1013 if (!buf) 1014 return NULL; 1015 1016 buf->ccontext.DataOffset = 1017 cpu_to_le16(offsetof(struct create_posix, Mode)); 1018 buf->ccontext.DataLength = cpu_to_le32(4); 1019 buf->ccontext.NameOffset = 1020 cpu_to_le16(offsetof(struct create_posix, Name)); 1021 buf->ccontext.NameLength = cpu_to_le16(16); 1022 1023 /* SMB2_CREATE_TAG_POSIX is "0x93AD25509CB411E7B42383DE968BCD7C" */ 1024 buf->Name[0] = 0x93; 1025 buf->Name[1] = 0xAD; 1026 buf->Name[2] = 0x25; 1027 buf->Name[3] = 0x50; 1028 buf->Name[4] = 0x9C; 1029 buf->Name[5] = 0xB4; 1030 buf->Name[6] = 0x11; 1031 buf->Name[7] = 0xE7; 1032 buf->Name[8] = 0xB4; 1033 buf->Name[9] = 0x23; 1034 buf->Name[10] = 0x83; 1035 buf->Name[11] = 0xDE; 1036 buf->Name[12] = 0x96; 1037 buf->Name[13] = 0x8B; 1038 buf->Name[14] = 0xCD; 1039 buf->Name[15] = 0x7C; 1040 buf->Mode = cpu_to_le32(mode); 1041 cifs_dbg(FYI, "mode on posix create 0%o\n", mode); 1042 return buf; 1043 } 1044 1045 static int 1046 add_posix_context(struct kvec *iov, unsigned int *num_iovec, umode_t mode) 1047 { 1048 unsigned int num = *num_iovec; 1049 1050 iov[num].iov_base = create_posix_buf(mode); 1051 if (mode == ACL_NO_MODE) 1052 cifs_dbg(FYI, "%s: no mode\n", __func__); 1053 if (iov[num].iov_base == NULL) 1054 return -ENOMEM; 1055 iov[num].iov_len = sizeof(struct create_posix); 1056 *num_iovec = num + 1; 1057 return 0; 1058 } 1059 1060 1061 /* 1062 * 1063 * SMB2 Worker functions follow: 1064 * 1065 * The general structure of the worker functions is: 1066 * 1) Call smb2_init (assembles SMB2 header) 1067 * 2) Initialize SMB2 command specific fields in fixed length area of SMB 1068 * 3) Call smb_sendrcv2 (sends request on socket and waits for response) 1069 * 4) Decode SMB2 command specific fields in the fixed length area 1070 * 5) Decode variable length data area (if any for this SMB2 command type) 1071 * 6) Call free smb buffer 1072 * 7) return 1073 * 1074 */ 1075 1076 int 1077 SMB2_negotiate(const unsigned int xid, 1078 struct cifs_ses *ses, 1079 struct TCP_Server_Info *server) 1080 { 1081 struct smb_rqst rqst; 1082 struct smb2_negotiate_req *req; 1083 struct smb2_negotiate_rsp *rsp; 1084 struct kvec iov[1]; 1085 struct kvec rsp_iov; 1086 int rc; 1087 int resp_buftype; 1088 int blob_offset, blob_length; 1089 char *security_blob; 1090 int flags = CIFS_NEG_OP; 1091 unsigned int total_len; 1092 1093 cifs_dbg(FYI, "Negotiate protocol\n"); 1094 1095 if (!server) { 1096 WARN(1, "%s: server is NULL!\n", __func__); 1097 return smb_EIO(smb_eio_trace_null_pointers); 1098 } 1099 1100 rc = smb2_plain_req_init(SMB2_NEGOTIATE, NULL, server, 1101 (void **) &req, &total_len); 1102 if (rc) 1103 return rc; 1104 1105 req->hdr.SessionId = 0; 1106 1107 memset(server->preauth_sha_hash, 0, SMB2_PREAUTH_HASH_SIZE); 1108 memset(ses->preauth_sha_hash, 0, SMB2_PREAUTH_HASH_SIZE); 1109 1110 if (strcmp(server->vals->version_string, 1111 SMB3ANY_VERSION_STRING) == 0) { 1112 req->Dialects[0] = cpu_to_le16(SMB30_PROT_ID); 1113 req->Dialects[1] = cpu_to_le16(SMB302_PROT_ID); 1114 req->Dialects[2] = cpu_to_le16(SMB311_PROT_ID); 1115 req->DialectCount = cpu_to_le16(3); 1116 total_len += 6; 1117 } else if (strcmp(server->vals->version_string, 1118 SMBDEFAULT_VERSION_STRING) == 0) { 1119 req->Dialects[0] = cpu_to_le16(SMB21_PROT_ID); 1120 req->Dialects[1] = cpu_to_le16(SMB30_PROT_ID); 1121 req->Dialects[2] = cpu_to_le16(SMB302_PROT_ID); 1122 req->Dialects[3] = cpu_to_le16(SMB311_PROT_ID); 1123 req->DialectCount = cpu_to_le16(4); 1124 total_len += 8; 1125 } else { 1126 /* otherwise send specific dialect */ 1127 req->Dialects[0] = cpu_to_le16(server->vals->protocol_id); 1128 req->DialectCount = cpu_to_le16(1); 1129 total_len += 2; 1130 } 1131 1132 /* only one of SMB2 signing flags may be set in SMB2 request */ 1133 if (ses->sign) 1134 req->SecurityMode = cpu_to_le16(SMB2_NEGOTIATE_SIGNING_REQUIRED); 1135 else if (global_secflags & CIFSSEC_MAY_SIGN) 1136 req->SecurityMode = cpu_to_le16(SMB2_NEGOTIATE_SIGNING_ENABLED); 1137 else 1138 req->SecurityMode = 0; 1139 1140 req->Capabilities = cpu_to_le32(server->vals->req_capabilities); 1141 req->Capabilities |= cpu_to_le32(SMB2_GLOBAL_CAP_MULTI_CHANNEL); 1142 1143 /* ClientGUID must be zero for SMB2.02 dialect */ 1144 if (server->vals->protocol_id == SMB20_PROT_ID) 1145 memset(req->ClientGUID, 0, SMB2_CLIENT_GUID_SIZE); 1146 else { 1147 memcpy(req->ClientGUID, server->client_guid, 1148 SMB2_CLIENT_GUID_SIZE); 1149 if ((server->vals->protocol_id == SMB311_PROT_ID) || 1150 (strcmp(server->vals->version_string, 1151 SMB3ANY_VERSION_STRING) == 0) || 1152 (strcmp(server->vals->version_string, 1153 SMBDEFAULT_VERSION_STRING) == 0)) 1154 assemble_neg_contexts(req, server, &total_len); 1155 } 1156 iov[0].iov_base = (char *)req; 1157 iov[0].iov_len = total_len; 1158 1159 memset(&rqst, 0, sizeof(struct smb_rqst)); 1160 rqst.rq_iov = iov; 1161 rqst.rq_nvec = 1; 1162 1163 rc = cifs_send_recv(xid, ses, server, 1164 &rqst, &resp_buftype, flags, &rsp_iov); 1165 cifs_small_buf_release(req); 1166 rsp = (struct smb2_negotiate_rsp *)rsp_iov.iov_base; 1167 /* 1168 * No tcon so can't do 1169 * cifs_stats_inc(&tcon->stats.smb2_stats.smb2_com_fail[SMB2...]); 1170 */ 1171 if (rc == -EOPNOTSUPP) { 1172 cifs_server_dbg(VFS, "Dialect not supported by server. Consider specifying vers=1.0 or vers=2.0 on mount for accessing older servers\n"); 1173 goto neg_exit; 1174 } else if (rc != 0) 1175 goto neg_exit; 1176 1177 u16 dialect = le16_to_cpu(rsp->DialectRevision); 1178 if (strcmp(server->vals->version_string, 1179 SMB3ANY_VERSION_STRING) == 0) { 1180 switch (dialect) { 1181 case SMB20_PROT_ID: 1182 cifs_server_dbg(VFS, 1183 "SMB2 dialect returned but not requested\n"); 1184 rc = smb_EIO2(smb_eio_trace_neg_unreq_dialect, dialect, 3); 1185 goto neg_exit; 1186 case SMB21_PROT_ID: 1187 cifs_server_dbg(VFS, 1188 "SMB2.1 dialect returned but not requested\n"); 1189 rc = smb_EIO2(smb_eio_trace_neg_unreq_dialect, dialect, 3); 1190 goto neg_exit; 1191 case SMB311_PROT_ID: 1192 /* ops set to 3.0 by default for default so update */ 1193 server->ops = &smb311_operations; 1194 server->vals = &smb311_values; 1195 break; 1196 default: 1197 break; 1198 } 1199 } else if (strcmp(server->vals->version_string, 1200 SMBDEFAULT_VERSION_STRING) == 0) { 1201 switch (dialect) { 1202 case SMB20_PROT_ID: 1203 cifs_server_dbg(VFS, 1204 "SMB2 dialect returned but not requested\n"); 1205 rc = smb_EIO2(smb_eio_trace_neg_unreq_dialect, dialect, 0); 1206 goto neg_exit; 1207 case SMB21_PROT_ID: 1208 /* ops set to 3.0 by default for default so update */ 1209 server->ops = &smb21_operations; 1210 server->vals = &smb21_values; 1211 break; 1212 case SMB311_PROT_ID: 1213 server->ops = &smb311_operations; 1214 server->vals = &smb311_values; 1215 break; 1216 default: 1217 break; 1218 } 1219 } else if (dialect != server->vals->protocol_id) { 1220 /* if requested single dialect ensure returned dialect matched */ 1221 cifs_server_dbg(VFS, "Invalid 0x%x dialect returned: not requested\n", 1222 dialect); 1223 rc = smb_EIO2(smb_eio_trace_neg_unreq_dialect, 1224 dialect, server->vals->protocol_id); 1225 goto neg_exit; 1226 } 1227 1228 cifs_dbg(FYI, "mode 0x%x\n", rsp->SecurityMode); 1229 1230 switch (dialect) { 1231 case SMB20_PROT_ID: 1232 cifs_dbg(FYI, "negotiated smb2.0 dialect\n"); 1233 break; 1234 case SMB21_PROT_ID: 1235 cifs_dbg(FYI, "negotiated smb2.1 dialect\n"); 1236 break; 1237 case SMB30_PROT_ID: 1238 cifs_dbg(FYI, "negotiated smb3.0 dialect\n"); 1239 break; 1240 case SMB302_PROT_ID: 1241 cifs_dbg(FYI, "negotiated smb3.02 dialect\n"); 1242 break; 1243 case SMB311_PROT_ID: 1244 cifs_dbg(FYI, "negotiated smb3.1.1 dialect\n"); 1245 break; 1246 default: 1247 cifs_server_dbg(VFS, "Invalid dialect returned by server 0x%x\n", 1248 dialect); 1249 rc = smb_EIO1(smb_eio_trace_neg_inval_dialect, dialect); 1250 goto neg_exit; 1251 } 1252 1253 rc = 0; 1254 server->dialect = dialect; 1255 1256 /* 1257 * Keep a copy of the hash after negprot. This hash will be 1258 * the starting hash value for all sessions made from this 1259 * server. 1260 */ 1261 memcpy(server->preauth_sha_hash, ses->preauth_sha_hash, 1262 SMB2_PREAUTH_HASH_SIZE); 1263 1264 /* SMB2 only has an extended negflavor */ 1265 server->negflavor = CIFS_NEGFLAVOR_EXTENDED; 1266 /* set it to the maximum buffer size value we can send with 1 credit */ 1267 server->maxBuf = min_t(unsigned int, le32_to_cpu(rsp->MaxTransactSize), 1268 SMB2_MAX_BUFFER_SIZE); 1269 server->max_read = le32_to_cpu(rsp->MaxReadSize); 1270 server->max_write = le32_to_cpu(rsp->MaxWriteSize); 1271 server->sec_mode = le16_to_cpu(rsp->SecurityMode); 1272 if ((server->sec_mode & SMB2_SEC_MODE_FLAGS_ALL) != server->sec_mode) 1273 cifs_dbg(FYI, "Server returned unexpected security mode 0x%x\n", 1274 server->sec_mode); 1275 server->capabilities = le32_to_cpu(rsp->Capabilities); 1276 /* Internal types */ 1277 server->capabilities |= SMB2_NT_FIND | SMB2_LARGE_FILES; 1278 1279 /* 1280 * SMB3.0 supports only 1 cipher and doesn't have a encryption neg context 1281 * Set the cipher type manually. 1282 */ 1283 if ((server->dialect == SMB30_PROT_ID || 1284 server->dialect == SMB302_PROT_ID) && 1285 (server->capabilities & SMB2_GLOBAL_CAP_ENCRYPTION)) 1286 server->cipher_type = SMB2_ENCRYPTION_AES128_CCM; 1287 1288 security_blob = smb2_get_data_area_len(&blob_offset, &blob_length, 1289 (struct smb2_hdr *)rsp); 1290 /* 1291 * See MS-SMB2 section 2.2.4: if no blob, client picks default which 1292 * for us will be 1293 * ses->sectype = RawNTLMSSP; 1294 * but for time being this is our only auth choice so doesn't matter. 1295 * We just found a server which sets blob length to zero expecting raw. 1296 */ 1297 if (blob_length == 0) { 1298 cifs_dbg(FYI, "missing security blob on negprot\n"); 1299 server->sec_ntlmssp = true; 1300 } 1301 1302 rc = cifs_enable_signing(server, ses->sign); 1303 if (rc) 1304 goto neg_exit; 1305 if (blob_length) { 1306 rc = decode_negTokenInit(security_blob, blob_length, server); 1307 if (rc == 1) 1308 rc = 0; 1309 else if (rc == 0) 1310 rc = smb_EIO1(smb_eio_trace_neg_decode_token, rc); 1311 } 1312 1313 if (server->dialect == SMB311_PROT_ID) { 1314 if (rsp->NegotiateContextCount) 1315 rc = smb311_decode_neg_context(rsp, server, 1316 rsp_iov.iov_len); 1317 else 1318 cifs_server_dbg(VFS, "Missing expected negotiate contexts\n"); 1319 } 1320 1321 if (server->cipher_type && !rc) 1322 rc = smb3_crypto_aead_allocate(server); 1323 neg_exit: 1324 free_rsp_buf(resp_buftype, rsp); 1325 return rc; 1326 } 1327 1328 int smb3_validate_negotiate(const unsigned int xid, struct cifs_tcon *tcon) 1329 { 1330 int rc; 1331 struct validate_negotiate_info_req *pneg_inbuf; 1332 struct validate_negotiate_info_rsp *pneg_rsp = NULL; 1333 u32 rsplen; 1334 u32 inbuflen; /* max of 4 dialects */ 1335 struct TCP_Server_Info *server = tcon->ses->server; 1336 1337 cifs_dbg(FYI, "validate negotiate\n"); 1338 1339 /* In SMB3.11 preauth integrity supersedes validate negotiate */ 1340 if (server->dialect == SMB311_PROT_ID) 1341 return 0; 1342 1343 /* 1344 * validation ioctl must be signed, so no point sending this if we 1345 * can not sign it (ie are not known user). Even if signing is not 1346 * required (enabled but not negotiated), in those cases we selectively 1347 * sign just this, the first and only signed request on a connection. 1348 * Having validation of negotiate info helps reduce attack vectors. 1349 */ 1350 if (tcon->ses->session_flags & SMB2_SESSION_FLAG_IS_GUEST) 1351 return 0; /* validation requires signing */ 1352 1353 if (tcon->ses->user_name == NULL) { 1354 cifs_dbg(FYI, "Can't validate negotiate: null user mount\n"); 1355 return 0; /* validation requires signing */ 1356 } 1357 1358 if (tcon->ses->session_flags & SMB2_SESSION_FLAG_IS_NULL) 1359 cifs_tcon_dbg(VFS, "Unexpected null user (anonymous) auth flag sent by server\n"); 1360 1361 pneg_inbuf = kmalloc_obj(*pneg_inbuf, GFP_NOFS); 1362 if (!pneg_inbuf) 1363 return -ENOMEM; 1364 1365 pneg_inbuf->Capabilities = 1366 cpu_to_le32(server->vals->req_capabilities); 1367 pneg_inbuf->Capabilities |= cpu_to_le32(SMB2_GLOBAL_CAP_MULTI_CHANNEL); 1368 1369 memcpy(pneg_inbuf->Guid, server->client_guid, 1370 SMB2_CLIENT_GUID_SIZE); 1371 1372 if (tcon->ses->sign) 1373 pneg_inbuf->SecurityMode = 1374 cpu_to_le16(SMB2_NEGOTIATE_SIGNING_REQUIRED); 1375 else if (global_secflags & CIFSSEC_MAY_SIGN) 1376 pneg_inbuf->SecurityMode = 1377 cpu_to_le16(SMB2_NEGOTIATE_SIGNING_ENABLED); 1378 else 1379 pneg_inbuf->SecurityMode = 0; 1380 1381 1382 if (strcmp(server->vals->version_string, 1383 SMB3ANY_VERSION_STRING) == 0) { 1384 pneg_inbuf->Dialects[0] = cpu_to_le16(SMB30_PROT_ID); 1385 pneg_inbuf->Dialects[1] = cpu_to_le16(SMB302_PROT_ID); 1386 pneg_inbuf->Dialects[2] = cpu_to_le16(SMB311_PROT_ID); 1387 pneg_inbuf->DialectCount = cpu_to_le16(3); 1388 /* SMB 2.1 not included so subtract one dialect from len */ 1389 inbuflen = sizeof(*pneg_inbuf) - 1390 (sizeof(pneg_inbuf->Dialects[0])); 1391 } else if (strcmp(server->vals->version_string, 1392 SMBDEFAULT_VERSION_STRING) == 0) { 1393 pneg_inbuf->Dialects[0] = cpu_to_le16(SMB21_PROT_ID); 1394 pneg_inbuf->Dialects[1] = cpu_to_le16(SMB30_PROT_ID); 1395 pneg_inbuf->Dialects[2] = cpu_to_le16(SMB302_PROT_ID); 1396 pneg_inbuf->Dialects[3] = cpu_to_le16(SMB311_PROT_ID); 1397 pneg_inbuf->DialectCount = cpu_to_le16(4); 1398 /* structure is big enough for 4 dialects */ 1399 inbuflen = sizeof(*pneg_inbuf); 1400 } else { 1401 /* otherwise specific dialect was requested */ 1402 pneg_inbuf->Dialects[0] = 1403 cpu_to_le16(server->vals->protocol_id); 1404 pneg_inbuf->DialectCount = cpu_to_le16(1); 1405 /* structure is big enough for 4 dialects, sending only 1 */ 1406 inbuflen = sizeof(*pneg_inbuf) - 1407 sizeof(pneg_inbuf->Dialects[0]) * 3; 1408 } 1409 1410 rc = SMB2_ioctl(xid, tcon, NO_FILE_ID, NO_FILE_ID, 1411 FSCTL_VALIDATE_NEGOTIATE_INFO, 1412 (char *)pneg_inbuf, inbuflen, CIFSMaxBufSize, 1413 (char **)&pneg_rsp, &rsplen); 1414 if (rc == -EOPNOTSUPP) { 1415 /* 1416 * Old Windows versions or Netapp SMB server can return 1417 * not supported error. Client should accept it. 1418 */ 1419 cifs_tcon_dbg(VFS, "Server does not support validate negotiate\n"); 1420 rc = 0; 1421 goto out_free_inbuf; 1422 } else if (rc != 0) { 1423 cifs_tcon_dbg(VFS, "validate protocol negotiate failed: %d\n", 1424 rc); 1425 rc = smb_EIO1(smb_eio_trace_neg_info_fail, rc); 1426 goto out_free_inbuf; 1427 } 1428 1429 if (rsplen != sizeof(*pneg_rsp)) { 1430 cifs_tcon_dbg(VFS, "Invalid protocol negotiate response size: %d\n", 1431 rsplen); 1432 1433 /* relax check since Mac returns max bufsize allowed on ioctl */ 1434 if (rsplen > CIFSMaxBufSize || rsplen < sizeof(*pneg_rsp)) { 1435 rc = smb_EIO1(smb_eio_trace_neg_bad_rsplen, rsplen); 1436 goto out_free_rsp; 1437 } 1438 } 1439 1440 /* check validate negotiate info response matches what we got earlier */ 1441 u16 dialect = le16_to_cpu(pneg_rsp->Dialect); 1442 1443 if (dialect != server->dialect) { 1444 rc = smb_EIO2(smb_eio_trace_neg_info_dialect, 1445 dialect, server->dialect); 1446 goto vneg_out; 1447 } 1448 1449 u16 sec_mode = le16_to_cpu(pneg_rsp->SecurityMode); 1450 1451 if (sec_mode != server->sec_mode) { 1452 rc = smb_EIO2(smb_eio_trace_neg_info_sec_mode, 1453 sec_mode, server->sec_mode); 1454 goto vneg_out; 1455 } 1456 1457 /* do not validate server guid because not saved at negprot time yet */ 1458 u32 caps = le32_to_cpu(pneg_rsp->Capabilities); 1459 1460 if ((caps | SMB2_NT_FIND | 1461 SMB2_LARGE_FILES) != server->capabilities) { 1462 rc = smb_EIO2(smb_eio_trace_neg_info_caps, 1463 caps, server->capabilities); 1464 goto vneg_out; 1465 } 1466 1467 /* validate negotiate successful */ 1468 rc = 0; 1469 cifs_dbg(FYI, "validate negotiate info successful\n"); 1470 goto out_free_rsp; 1471 1472 vneg_out: 1473 cifs_tcon_dbg(VFS, "protocol revalidation - security settings mismatch\n"); 1474 out_free_rsp: 1475 kfree(pneg_rsp); 1476 out_free_inbuf: 1477 kfree(pneg_inbuf); 1478 return rc; 1479 } 1480 1481 enum securityEnum 1482 smb2_select_sectype(struct TCP_Server_Info *server, enum securityEnum requested) 1483 { 1484 switch (requested) { 1485 case Kerberos: 1486 case RawNTLMSSP: 1487 return requested; 1488 case NTLMv2: 1489 return RawNTLMSSP; 1490 case Unspecified: 1491 if (server->sec_ntlmssp && 1492 (global_secflags & CIFSSEC_MAY_NTLMSSP)) 1493 return RawNTLMSSP; 1494 if ((server->sec_kerberos || server->sec_mskerberos || server->sec_iakerb) && 1495 (global_secflags & CIFSSEC_MAY_KRB5)) 1496 return Kerberos; 1497 fallthrough; 1498 default: 1499 return Unspecified; 1500 } 1501 } 1502 1503 struct SMB2_sess_data { 1504 unsigned int xid; 1505 struct cifs_ses *ses; 1506 struct TCP_Server_Info *server; 1507 struct nls_table *nls_cp; 1508 void (*func)(struct SMB2_sess_data *); 1509 int result; 1510 u64 previous_session; 1511 1512 /* we will send the SMB in three pieces: 1513 * a fixed length beginning part, an optional 1514 * SPNEGO blob (which can be zero length), and a 1515 * last part which will include the strings 1516 * and rest of bcc area. This allows us to avoid 1517 * a large buffer 17K allocation 1518 */ 1519 int buf0_type; 1520 struct kvec iov[2]; 1521 }; 1522 1523 static int 1524 SMB2_sess_alloc_buffer(struct SMB2_sess_data *sess_data) 1525 { 1526 int rc; 1527 struct cifs_ses *ses = sess_data->ses; 1528 struct TCP_Server_Info *server = sess_data->server; 1529 struct smb2_sess_setup_req *req; 1530 unsigned int total_len; 1531 bool is_binding = false; 1532 1533 rc = smb2_plain_req_init(SMB2_SESSION_SETUP, NULL, server, 1534 (void **) &req, 1535 &total_len); 1536 if (rc) 1537 return rc; 1538 1539 spin_lock(&ses->ses_lock); 1540 is_binding = (ses->ses_status == SES_GOOD); 1541 spin_unlock(&ses->ses_lock); 1542 1543 if (is_binding) { 1544 req->hdr.SessionId = cpu_to_le64(ses->Suid); 1545 req->hdr.Flags |= SMB2_FLAGS_SIGNED; 1546 req->PreviousSessionId = 0; 1547 req->Flags = SMB2_SESSION_REQ_FLAG_BINDING; 1548 cifs_dbg(FYI, "Binding to sess id: %llx\n", ses->Suid); 1549 } else { 1550 /* First session, not a reauthenticate */ 1551 req->hdr.SessionId = 0; 1552 /* 1553 * if reconnect, we need to send previous sess id 1554 * otherwise it is 0 1555 */ 1556 req->PreviousSessionId = cpu_to_le64(sess_data->previous_session); 1557 req->Flags = 0; /* MBZ */ 1558 cifs_dbg(FYI, "Fresh session. Previous: %llx\n", 1559 sess_data->previous_session); 1560 } 1561 1562 /* enough to enable echos and oplocks and one max size write */ 1563 if (server->credits >= server->max_credits) 1564 req->hdr.CreditRequest = cpu_to_le16(0); 1565 else 1566 req->hdr.CreditRequest = cpu_to_le16( 1567 min_t(int, server->max_credits - 1568 server->credits, 130)); 1569 1570 /* only one of SMB2 signing flags may be set in SMB2 request */ 1571 if (server->sign) 1572 req->SecurityMode = SMB2_NEGOTIATE_SIGNING_REQUIRED; 1573 else if (global_secflags & CIFSSEC_MAY_SIGN) /* one flag unlike MUST_ */ 1574 req->SecurityMode = SMB2_NEGOTIATE_SIGNING_ENABLED; 1575 else 1576 req->SecurityMode = 0; 1577 1578 #ifdef CONFIG_CIFS_DFS_UPCALL 1579 req->Capabilities = cpu_to_le32(SMB2_GLOBAL_CAP_DFS); 1580 #else 1581 req->Capabilities = 0; 1582 #endif /* DFS_UPCALL */ 1583 1584 req->Channel = 0; /* MBZ */ 1585 1586 sess_data->iov[0].iov_base = (char *)req; 1587 /* 1 for pad */ 1588 sess_data->iov[0].iov_len = total_len - 1; 1589 /* 1590 * This variable will be used to clear the buffer 1591 * allocated above in case of any error in the calling function. 1592 */ 1593 sess_data->buf0_type = CIFS_SMALL_BUFFER; 1594 1595 return 0; 1596 } 1597 1598 static void 1599 SMB2_sess_free_buffer(struct SMB2_sess_data *sess_data) 1600 { 1601 struct kvec *iov = sess_data->iov; 1602 1603 /* iov[1] is already freed by caller */ 1604 if (sess_data->buf0_type != CIFS_NO_BUFFER && iov[0].iov_base) 1605 memzero_explicit(iov[0].iov_base, iov[0].iov_len); 1606 1607 free_rsp_buf(sess_data->buf0_type, iov[0].iov_base); 1608 sess_data->buf0_type = CIFS_NO_BUFFER; 1609 } 1610 1611 static int 1612 SMB2_sess_sendreceive(struct SMB2_sess_data *sess_data) 1613 { 1614 int rc; 1615 struct smb_rqst rqst; 1616 struct smb2_sess_setup_req *req = sess_data->iov[0].iov_base; 1617 struct kvec rsp_iov = { NULL, 0 }; 1618 1619 /* Testing shows that buffer offset must be at location of Buffer[0] */ 1620 req->SecurityBufferOffset = 1621 cpu_to_le16(sizeof(struct smb2_sess_setup_req)); 1622 req->SecurityBufferLength = cpu_to_le16(sess_data->iov[1].iov_len); 1623 1624 memset(&rqst, 0, sizeof(struct smb_rqst)); 1625 rqst.rq_iov = sess_data->iov; 1626 rqst.rq_nvec = 2; 1627 1628 /* BB add code to build os and lm fields */ 1629 rc = cifs_send_recv(sess_data->xid, sess_data->ses, 1630 sess_data->server, 1631 &rqst, 1632 &sess_data->buf0_type, 1633 CIFS_LOG_ERROR | CIFS_SESS_OP, &rsp_iov); 1634 cifs_small_buf_release(sess_data->iov[0].iov_base); 1635 if (rc == 0) 1636 sess_data->ses->expired_pwd = false; 1637 else if ((rc == -EACCES) || (rc == -EKEYEXPIRED) || (rc == -EKEYREVOKED)) { 1638 if (sess_data->ses->expired_pwd == false) 1639 trace_smb3_key_expired(sess_data->server->hostname, 1640 sess_data->ses->user_name, 1641 sess_data->server->conn_id, 1642 &sess_data->server->dstaddr, rc); 1643 sess_data->ses->expired_pwd = true; 1644 } 1645 1646 memcpy(&sess_data->iov[0], &rsp_iov, sizeof(struct kvec)); 1647 1648 return rc; 1649 } 1650 1651 static int 1652 SMB2_sess_establish_session(struct SMB2_sess_data *sess_data) 1653 { 1654 int rc = 0; 1655 struct cifs_ses *ses = sess_data->ses; 1656 struct TCP_Server_Info *server = sess_data->server; 1657 1658 cifs_server_lock(server); 1659 if (server->ops->generate_signingkey) { 1660 rc = server->ops->generate_signingkey(ses, server); 1661 if (rc) { 1662 cifs_dbg(FYI, 1663 "SMB3 session key generation failed\n"); 1664 cifs_server_unlock(server); 1665 return rc; 1666 } 1667 } 1668 if (!server->session_estab) { 1669 server->sequence_number = 0x2; 1670 server->session_estab = true; 1671 } 1672 cifs_server_unlock(server); 1673 1674 cifs_dbg(FYI, "SMB2/3 session established successfully\n"); 1675 return rc; 1676 } 1677 1678 #ifdef CONFIG_CIFS_UPCALL 1679 static void 1680 SMB2_auth_kerberos(struct SMB2_sess_data *sess_data) 1681 { 1682 int rc; 1683 struct cifs_ses *ses = sess_data->ses; 1684 struct TCP_Server_Info *server = sess_data->server; 1685 struct cifs_spnego_msg *msg; 1686 struct key *spnego_key = NULL; 1687 struct smb2_sess_setup_rsp *rsp = NULL; 1688 bool is_binding = false; 1689 1690 rc = SMB2_sess_alloc_buffer(sess_data); 1691 if (rc) 1692 goto out; 1693 1694 spnego_key = cifs_get_spnego_key(ses, server); 1695 if (IS_ERR(spnego_key)) { 1696 rc = PTR_ERR(spnego_key); 1697 spnego_key = NULL; 1698 goto out; 1699 } 1700 1701 msg = spnego_key->payload.data[0]; 1702 /* 1703 * check version field to make sure that cifs.upcall is 1704 * sending us a response in an expected form 1705 */ 1706 if (msg->version != CIFS_SPNEGO_UPCALL_VERSION) { 1707 cifs_dbg(VFS, "bad cifs.upcall version. Expected %d got %d\n", 1708 CIFS_SPNEGO_UPCALL_VERSION, msg->version); 1709 rc = -EKEYREJECTED; 1710 goto out_put_spnego_key; 1711 } 1712 1713 spin_lock(&ses->ses_lock); 1714 is_binding = (ses->ses_status == SES_GOOD); 1715 spin_unlock(&ses->ses_lock); 1716 1717 kfree_sensitive(ses->auth_key.response); 1718 ses->auth_key.response = kmemdup(msg->data, 1719 msg->sesskey_len, 1720 GFP_KERNEL); 1721 if (!ses->auth_key.response) { 1722 cifs_dbg(VFS, "%s: can't allocate (%u bytes) memory\n", 1723 __func__, msg->sesskey_len); 1724 rc = -ENOMEM; 1725 goto out_put_spnego_key; 1726 } 1727 ses->auth_key.len = msg->sesskey_len; 1728 1729 sess_data->iov[1].iov_base = msg->data + msg->sesskey_len; 1730 sess_data->iov[1].iov_len = msg->secblob_len; 1731 1732 rc = SMB2_sess_sendreceive(sess_data); 1733 if (rc) 1734 goto out_put_spnego_key; 1735 1736 rsp = (struct smb2_sess_setup_rsp *)sess_data->iov[0].iov_base; 1737 /* keep session id and flags if binding */ 1738 if (!is_binding) { 1739 ses->Suid = le64_to_cpu(rsp->hdr.SessionId); 1740 ses->session_flags = le16_to_cpu(rsp->SessionFlags); 1741 } 1742 1743 rc = SMB2_sess_establish_session(sess_data); 1744 out_put_spnego_key: 1745 key_invalidate(spnego_key); 1746 key_put(spnego_key); 1747 if (rc) { 1748 kfree_sensitive(ses->auth_key.response); 1749 ses->auth_key.response = NULL; 1750 ses->auth_key.len = 0; 1751 } 1752 out: 1753 sess_data->result = rc; 1754 sess_data->func = NULL; 1755 SMB2_sess_free_buffer(sess_data); 1756 } 1757 #else 1758 static void 1759 SMB2_auth_kerberos(struct SMB2_sess_data *sess_data) 1760 { 1761 cifs_dbg(VFS, "Kerberos negotiated but upcall support disabled!\n"); 1762 sess_data->result = -EOPNOTSUPP; 1763 sess_data->func = NULL; 1764 } 1765 #endif 1766 1767 static void 1768 SMB2_sess_auth_rawntlmssp_authenticate(struct SMB2_sess_data *sess_data); 1769 1770 static void 1771 SMB2_sess_auth_rawntlmssp_negotiate(struct SMB2_sess_data *sess_data) 1772 { 1773 int rc; 1774 struct cifs_ses *ses = sess_data->ses; 1775 struct TCP_Server_Info *server = sess_data->server; 1776 struct smb2_sess_setup_rsp *rsp = NULL; 1777 unsigned char *ntlmssp_blob = NULL; 1778 bool use_spnego = false; /* else use raw ntlmssp */ 1779 u16 blob_length = 0; 1780 bool is_binding = false; 1781 1782 /* 1783 * If memory allocation is successful, caller of this function 1784 * frees it. 1785 */ 1786 ses->ntlmssp = kmalloc_obj(struct ntlmssp_auth); 1787 if (!ses->ntlmssp) { 1788 rc = -ENOMEM; 1789 goto out_err; 1790 } 1791 ses->ntlmssp->sesskey_per_smbsess = true; 1792 1793 rc = SMB2_sess_alloc_buffer(sess_data); 1794 if (rc) 1795 goto out_err; 1796 1797 rc = build_ntlmssp_smb3_negotiate_blob(&ntlmssp_blob, 1798 &blob_length, ses, server, 1799 sess_data->nls_cp); 1800 if (rc) 1801 goto out; 1802 1803 if (use_spnego) { 1804 /* BB eventually need to add this */ 1805 cifs_dbg(VFS, "spnego not supported for SMB2 yet\n"); 1806 rc = -EOPNOTSUPP; 1807 goto out; 1808 } 1809 sess_data->iov[1].iov_base = ntlmssp_blob; 1810 sess_data->iov[1].iov_len = blob_length; 1811 1812 rc = SMB2_sess_sendreceive(sess_data); 1813 rsp = (struct smb2_sess_setup_rsp *)sess_data->iov[0].iov_base; 1814 1815 /* If true, rc here is expected and not an error */ 1816 if (sess_data->buf0_type != CIFS_NO_BUFFER && 1817 rsp->hdr.Status == STATUS_MORE_PROCESSING_REQUIRED) 1818 rc = 0; 1819 1820 if (rc) 1821 goto out; 1822 1823 u16 boff = le16_to_cpu(rsp->SecurityBufferOffset); 1824 1825 if (offsetof(struct smb2_sess_setup_rsp, Buffer) != boff) { 1826 cifs_dbg(VFS, "Invalid security buffer offset %d\n", boff); 1827 rc = smb_EIO1(smb_eio_trace_sess_buf_off, boff); 1828 goto out; 1829 } 1830 rc = decode_ntlmssp_challenge(rsp->Buffer, 1831 le16_to_cpu(rsp->SecurityBufferLength), ses); 1832 if (rc) 1833 goto out; 1834 1835 cifs_dbg(FYI, "rawntlmssp session setup challenge phase\n"); 1836 1837 spin_lock(&ses->ses_lock); 1838 is_binding = (ses->ses_status == SES_GOOD); 1839 spin_unlock(&ses->ses_lock); 1840 1841 /* keep existing ses id and flags if binding */ 1842 if (!is_binding) { 1843 ses->Suid = le64_to_cpu(rsp->hdr.SessionId); 1844 ses->session_flags = le16_to_cpu(rsp->SessionFlags); 1845 } 1846 1847 out: 1848 kfree_sensitive(ntlmssp_blob); 1849 SMB2_sess_free_buffer(sess_data); 1850 if (!rc) { 1851 sess_data->result = 0; 1852 sess_data->func = SMB2_sess_auth_rawntlmssp_authenticate; 1853 return; 1854 } 1855 out_err: 1856 kfree_sensitive(ses->ntlmssp); 1857 ses->ntlmssp = NULL; 1858 sess_data->result = rc; 1859 sess_data->func = NULL; 1860 } 1861 1862 static void 1863 SMB2_sess_auth_rawntlmssp_authenticate(struct SMB2_sess_data *sess_data) 1864 { 1865 int rc; 1866 struct cifs_ses *ses = sess_data->ses; 1867 struct TCP_Server_Info *server = sess_data->server; 1868 struct smb2_sess_setup_req *req; 1869 struct smb2_sess_setup_rsp *rsp = NULL; 1870 unsigned char *ntlmssp_blob = NULL; 1871 bool use_spnego = false; /* else use raw ntlmssp */ 1872 u16 blob_length = 0; 1873 bool is_binding = false; 1874 1875 rc = SMB2_sess_alloc_buffer(sess_data); 1876 if (rc) 1877 goto out; 1878 1879 req = (struct smb2_sess_setup_req *) sess_data->iov[0].iov_base; 1880 req->hdr.SessionId = cpu_to_le64(ses->Suid); 1881 1882 rc = build_ntlmssp_auth_blob(&ntlmssp_blob, &blob_length, 1883 ses, server, 1884 sess_data->nls_cp); 1885 if (rc) { 1886 cifs_dbg(FYI, "build_ntlmssp_auth_blob failed %d\n", rc); 1887 goto out; 1888 } 1889 1890 if (use_spnego) { 1891 /* BB eventually need to add this */ 1892 cifs_dbg(VFS, "spnego not supported for SMB2 yet\n"); 1893 rc = -EOPNOTSUPP; 1894 goto out; 1895 } 1896 sess_data->iov[1].iov_base = ntlmssp_blob; 1897 sess_data->iov[1].iov_len = blob_length; 1898 1899 rc = SMB2_sess_sendreceive(sess_data); 1900 if (rc) 1901 goto out; 1902 1903 rsp = (struct smb2_sess_setup_rsp *)sess_data->iov[0].iov_base; 1904 1905 spin_lock(&ses->ses_lock); 1906 is_binding = (ses->ses_status == SES_GOOD); 1907 spin_unlock(&ses->ses_lock); 1908 1909 /* keep existing ses id and flags if binding */ 1910 if (!is_binding) { 1911 ses->Suid = le64_to_cpu(rsp->hdr.SessionId); 1912 ses->session_flags = le16_to_cpu(rsp->SessionFlags); 1913 } 1914 1915 rc = SMB2_sess_establish_session(sess_data); 1916 #ifdef CONFIG_CIFS_DEBUG_DUMP_KEYS 1917 if (ses->server->dialect < SMB30_PROT_ID) { 1918 cifs_dbg(VFS, "%s: dumping generated SMB2 session keys\n", __func__); 1919 /* 1920 * The session id is opaque in terms of endianness, so we can't 1921 * print it as a long long. we dump it as we got it on the wire 1922 */ 1923 cifs_dbg(VFS, "Session Id %*ph\n", (int)sizeof(ses->Suid), 1924 &ses->Suid); 1925 cifs_dbg(VFS, "Session Key %*ph\n", 1926 SMB2_NTLMV2_SESSKEY_SIZE, ses->auth_key.response); 1927 cifs_dbg(VFS, "Signing Key %*ph\n", 1928 SMB3_SIGN_KEY_SIZE, ses->auth_key.response); 1929 } 1930 #endif 1931 out: 1932 kfree_sensitive(ntlmssp_blob); 1933 SMB2_sess_free_buffer(sess_data); 1934 kfree_sensitive(ses->ntlmssp); 1935 ses->ntlmssp = NULL; 1936 sess_data->result = rc; 1937 sess_data->func = NULL; 1938 } 1939 1940 static int 1941 SMB2_select_sec(struct SMB2_sess_data *sess_data) 1942 { 1943 int type; 1944 struct cifs_ses *ses = sess_data->ses; 1945 struct TCP_Server_Info *server = sess_data->server; 1946 1947 type = smb2_select_sectype(server, ses->sectype); 1948 cifs_dbg(FYI, "sess setup type %d\n", type); 1949 if (type == Unspecified) { 1950 cifs_dbg(VFS, "Unable to select appropriate authentication method!\n"); 1951 return -EINVAL; 1952 } 1953 1954 switch (type) { 1955 case Kerberos: 1956 sess_data->func = SMB2_auth_kerberos; 1957 break; 1958 case RawNTLMSSP: 1959 sess_data->func = SMB2_sess_auth_rawntlmssp_negotiate; 1960 break; 1961 default: 1962 cifs_dbg(VFS, "secType %d not supported!\n", type); 1963 return -EOPNOTSUPP; 1964 } 1965 1966 return 0; 1967 } 1968 1969 int 1970 SMB2_sess_setup(const unsigned int xid, struct cifs_ses *ses, 1971 struct TCP_Server_Info *server, 1972 const struct nls_table *nls_cp) 1973 { 1974 int rc = 0; 1975 struct SMB2_sess_data *sess_data; 1976 1977 cifs_dbg(FYI, "Session Setup\n"); 1978 1979 if (!server) { 1980 WARN(1, "%s: server is NULL!\n", __func__); 1981 return smb_EIO(smb_eio_trace_null_pointers); 1982 } 1983 1984 sess_data = kzalloc_obj(struct SMB2_sess_data); 1985 if (!sess_data) 1986 return -ENOMEM; 1987 1988 sess_data->xid = xid; 1989 sess_data->ses = ses; 1990 sess_data->server = server; 1991 sess_data->buf0_type = CIFS_NO_BUFFER; 1992 sess_data->nls_cp = (struct nls_table *) nls_cp; 1993 sess_data->previous_session = ses->Suid; 1994 1995 rc = SMB2_select_sec(sess_data); 1996 if (rc) 1997 goto out; 1998 1999 /* 2000 * Initialize the session hash with the server one. 2001 */ 2002 memcpy(ses->preauth_sha_hash, server->preauth_sha_hash, 2003 SMB2_PREAUTH_HASH_SIZE); 2004 2005 while (sess_data->func) 2006 sess_data->func(sess_data); 2007 2008 if ((ses->session_flags & SMB2_SESSION_FLAG_IS_GUEST) && (ses->sign)) 2009 cifs_server_dbg(VFS, "signing requested but authenticated as guest\n"); 2010 rc = sess_data->result; 2011 out: 2012 kfree_sensitive(sess_data); 2013 return rc; 2014 } 2015 2016 int 2017 SMB2_logoff(const unsigned int xid, struct cifs_ses *ses) 2018 { 2019 struct smb_rqst rqst; 2020 struct smb2_logoff_req *req; /* response is also trivial struct */ 2021 int rc = 0; 2022 struct TCP_Server_Info *server; 2023 int flags = 0; 2024 unsigned int total_len; 2025 struct kvec iov[1]; 2026 struct kvec rsp_iov; 2027 int resp_buf_type; 2028 2029 cifs_dbg(FYI, "disconnect session %p\n", ses); 2030 2031 if (!ses || !ses->server) 2032 return smb_EIO(smb_eio_trace_null_pointers); 2033 server = ses->server; 2034 2035 /* no need to send SMB logoff if uid already closed due to reconnect */ 2036 spin_lock(&ses->chan_lock); 2037 if (CIFS_ALL_CHANS_NEED_RECONNECT(ses)) { 2038 spin_unlock(&ses->chan_lock); 2039 goto smb2_session_already_dead; 2040 } 2041 spin_unlock(&ses->chan_lock); 2042 2043 rc = smb2_plain_req_init(SMB2_LOGOFF, NULL, ses->server, 2044 (void **) &req, &total_len); 2045 if (rc) 2046 return rc; 2047 2048 /* since no tcon, smb2_init can not do this, so do here */ 2049 req->hdr.SessionId = cpu_to_le64(ses->Suid); 2050 2051 if (ses->session_flags & SMB2_SESSION_FLAG_ENCRYPT_DATA) 2052 flags |= CIFS_TRANSFORM_REQ; 2053 else if (server->sign) 2054 req->hdr.Flags |= SMB2_FLAGS_SIGNED; 2055 2056 flags |= CIFS_NO_RSP_BUF; 2057 2058 iov[0].iov_base = (char *)req; 2059 iov[0].iov_len = total_len; 2060 2061 memset(&rqst, 0, sizeof(struct smb_rqst)); 2062 rqst.rq_iov = iov; 2063 rqst.rq_nvec = 1; 2064 2065 rc = cifs_send_recv(xid, ses, ses->server, 2066 &rqst, &resp_buf_type, flags, &rsp_iov); 2067 cifs_small_buf_release(req); 2068 /* 2069 * No tcon so can't do 2070 * cifs_stats_inc(&tcon->stats.smb2_stats.smb2_com_fail[SMB2...]); 2071 */ 2072 2073 smb2_session_already_dead: 2074 return rc; 2075 } 2076 2077 static inline void cifs_stats_fail_inc(struct cifs_tcon *tcon, uint16_t code) 2078 { 2079 cifs_stats_inc(&tcon->stats.smb2_stats.smb2_com_failed[code]); 2080 } 2081 2082 #define MAX_SHARENAME_LENGTH (255 /* server */ + 80 /* share */ + 1 /* NULL */) 2083 2084 /* These are similar values to what Windows uses */ 2085 static inline void init_copy_chunk_defaults(struct cifs_tcon *tcon) 2086 { 2087 tcon->max_chunks = 256; 2088 tcon->max_bytes_chunk = 1048576; 2089 tcon->max_bytes_copy = 16777216; 2090 } 2091 2092 int 2093 SMB2_tcon(const unsigned int xid, struct cifs_ses *ses, const char *tree, 2094 struct cifs_tcon *tcon, const struct nls_table *cp) 2095 { 2096 struct smb_rqst rqst; 2097 struct smb2_tree_connect_req *req; 2098 struct smb2_tree_connect_rsp *rsp = NULL; 2099 struct kvec iov[2]; 2100 struct kvec rsp_iov = { NULL, 0 }; 2101 int rc = 0; 2102 int resp_buftype; 2103 int unc_path_len; 2104 __le16 *unc_path = NULL; 2105 int flags = 0; 2106 unsigned int total_len; 2107 struct TCP_Server_Info *server = cifs_pick_channel(ses); 2108 2109 cifs_dbg(FYI, "TCON\n"); 2110 2111 if (!server || !tree) 2112 return smb_EIO(smb_eio_trace_null_pointers); 2113 2114 unc_path = kmalloc(MAX_SHARENAME_LENGTH * 2, GFP_KERNEL); 2115 if (unc_path == NULL) 2116 return -ENOMEM; 2117 2118 unc_path_len = cifs_strtoUTF16(unc_path, tree, strlen(tree), cp); 2119 if (unc_path_len <= 0) { 2120 kfree(unc_path); 2121 return -EINVAL; 2122 } 2123 unc_path_len *= 2; 2124 2125 /* SMB2 TREE_CONNECT request must be called with TreeId == 0 */ 2126 tcon->tid = 0; 2127 atomic_set(&tcon->num_remote_opens, 0); 2128 rc = smb2_plain_req_init(SMB2_TREE_CONNECT, tcon, server, 2129 (void **) &req, &total_len); 2130 if (rc) { 2131 kfree(unc_path); 2132 return rc; 2133 } 2134 2135 if (smb3_encryption_required(tcon)) 2136 flags |= CIFS_TRANSFORM_REQ; 2137 2138 iov[0].iov_base = (char *)req; 2139 /* 1 for pad */ 2140 iov[0].iov_len = total_len - 1; 2141 2142 /* Testing shows that buffer offset must be at location of Buffer[0] */ 2143 req->PathOffset = cpu_to_le16(sizeof(struct smb2_tree_connect_req)); 2144 req->PathLength = cpu_to_le16(unc_path_len); 2145 iov[1].iov_base = unc_path; 2146 iov[1].iov_len = unc_path_len; 2147 2148 /* 2149 * 3.11 tcon req must be signed if not encrypted. See MS-SMB2 3.2.4.1.1 2150 * unless it is guest or anonymous user. See MS-SMB2 3.2.5.3.1 2151 * (Samba servers don't always set the flag so also check if null user) 2152 */ 2153 if ((server->dialect == SMB311_PROT_ID) && 2154 !smb3_encryption_required(tcon) && 2155 !(ses->session_flags & 2156 (SMB2_SESSION_FLAG_IS_GUEST|SMB2_SESSION_FLAG_IS_NULL)) && 2157 ((ses->user_name != NULL) || (ses->sectype == Kerberos))) 2158 req->hdr.Flags |= SMB2_FLAGS_SIGNED; 2159 2160 memset(&rqst, 0, sizeof(struct smb_rqst)); 2161 rqst.rq_iov = iov; 2162 rqst.rq_nvec = 2; 2163 2164 /* Need 64 for max size write so ask for more in case not there yet */ 2165 if (server->credits >= server->max_credits) 2166 req->hdr.CreditRequest = cpu_to_le16(0); 2167 else 2168 req->hdr.CreditRequest = cpu_to_le16( 2169 min_t(int, server->max_credits - 2170 server->credits, 64)); 2171 2172 rc = cifs_send_recv(xid, ses, server, 2173 &rqst, &resp_buftype, flags, &rsp_iov); 2174 cifs_small_buf_release(req); 2175 rsp = (struct smb2_tree_connect_rsp *)rsp_iov.iov_base; 2176 trace_smb3_tcon(xid, tcon->tid, ses->Suid, tree, rc); 2177 if ((rc != 0) || (rsp == NULL)) { 2178 cifs_stats_fail_inc(tcon, SMB2_TREE_CONNECT_HE); 2179 tcon->need_reconnect = true; 2180 goto tcon_error_exit; 2181 } 2182 2183 switch (rsp->ShareType) { 2184 case SMB2_SHARE_TYPE_DISK: 2185 cifs_dbg(FYI, "connection to disk share\n"); 2186 break; 2187 case SMB2_SHARE_TYPE_PIPE: 2188 tcon->pipe = true; 2189 cifs_dbg(FYI, "connection to pipe share\n"); 2190 break; 2191 case SMB2_SHARE_TYPE_PRINT: 2192 tcon->print = true; 2193 cifs_dbg(FYI, "connection to printer\n"); 2194 break; 2195 default: 2196 cifs_server_dbg(VFS, "unknown share type %d\n", rsp->ShareType); 2197 rc = -EOPNOTSUPP; 2198 goto tcon_error_exit; 2199 } 2200 2201 tcon->share_flags = le32_to_cpu(rsp->ShareFlags); 2202 tcon->capabilities = rsp->Capabilities; /* we keep caps little endian */ 2203 tcon->maximal_access = le32_to_cpu(rsp->MaximalAccess); 2204 tcon->tid = le32_to_cpu(rsp->hdr.Id.SyncId.TreeId); 2205 strscpy(tcon->tree_name, tree, sizeof(tcon->tree_name)); 2206 2207 if ((rsp->Capabilities & SMB2_SHARE_CAP_DFS) && 2208 ((tcon->share_flags & SHI1005_FLAGS_DFS) == 0)) 2209 cifs_tcon_dbg(VFS, "DFS capability contradicts DFS flag\n"); 2210 2211 if (tcon->seal && 2212 !(server->capabilities & SMB2_GLOBAL_CAP_ENCRYPTION)) 2213 cifs_tcon_dbg(VFS, "Encryption is requested but not supported\n"); 2214 2215 init_copy_chunk_defaults(tcon); 2216 if (server->ops->validate_negotiate) 2217 rc = server->ops->validate_negotiate(xid, tcon); 2218 if (rc == 0) /* See MS-SMB2 2.2.10 and 3.2.5.5 */ 2219 if (tcon->share_flags & SMB2_SHAREFLAG_ISOLATED_TRANSPORT) 2220 server->nosharesock = true; 2221 tcon_exit: 2222 2223 free_rsp_buf(resp_buftype, rsp); 2224 kfree(unc_path); 2225 return rc; 2226 2227 tcon_error_exit: 2228 if (rsp && rsp->hdr.Status == STATUS_BAD_NETWORK_NAME) 2229 cifs_dbg(VFS | ONCE, "BAD_NETWORK_NAME: %s\n", tree); 2230 goto tcon_exit; 2231 } 2232 2233 int 2234 SMB2_tdis(const unsigned int xid, struct cifs_tcon *tcon) 2235 { 2236 struct smb_rqst rqst; 2237 struct smb2_tree_disconnect_req *req; /* response is trivial */ 2238 int rc = 0; 2239 struct cifs_ses *ses = tcon->ses; 2240 struct TCP_Server_Info *server = cifs_pick_channel(ses); 2241 int flags = 0; 2242 unsigned int total_len; 2243 struct kvec iov[1]; 2244 struct kvec rsp_iov; 2245 int resp_buf_type; 2246 2247 cifs_dbg(FYI, "Tree Disconnect\n"); 2248 2249 if (!ses || !(ses->server)) 2250 return smb_EIO(smb_eio_trace_null_pointers); 2251 2252 trace_smb3_tdis_enter(xid, tcon->tid, ses->Suid, tcon->tree_name); 2253 spin_lock(&ses->chan_lock); 2254 if ((tcon->need_reconnect) || 2255 (CIFS_ALL_CHANS_NEED_RECONNECT(tcon->ses))) { 2256 spin_unlock(&ses->chan_lock); 2257 return 0; 2258 } 2259 spin_unlock(&ses->chan_lock); 2260 2261 invalidate_all_cached_dirs(tcon); 2262 2263 rc = smb2_plain_req_init(SMB2_TREE_DISCONNECT, tcon, server, 2264 (void **) &req, 2265 &total_len); 2266 if (rc) 2267 return rc; 2268 2269 if (smb3_encryption_required(tcon)) 2270 flags |= CIFS_TRANSFORM_REQ; 2271 2272 flags |= CIFS_NO_RSP_BUF; 2273 2274 iov[0].iov_base = (char *)req; 2275 iov[0].iov_len = total_len; 2276 2277 memset(&rqst, 0, sizeof(struct smb_rqst)); 2278 rqst.rq_iov = iov; 2279 rqst.rq_nvec = 1; 2280 2281 rc = cifs_send_recv(xid, ses, server, 2282 &rqst, &resp_buf_type, flags, &rsp_iov); 2283 cifs_small_buf_release(req); 2284 if (rc) { 2285 cifs_stats_fail_inc(tcon, SMB2_TREE_DISCONNECT_HE); 2286 trace_smb3_tdis_err(xid, tcon->tid, ses->Suid, rc); 2287 } 2288 trace_smb3_tdis_done(xid, tcon->tid, ses->Suid); 2289 2290 return rc; 2291 } 2292 2293 static create_durable_req_t * 2294 create_durable_buf(void) 2295 { 2296 create_durable_req_t *buf; 2297 2298 buf = kzalloc_obj(create_durable_req_t); 2299 if (!buf) 2300 return NULL; 2301 2302 buf->ccontext.DataOffset = cpu_to_le16(offsetof 2303 (create_durable_req_t, Data)); 2304 buf->ccontext.DataLength = cpu_to_le32(16); 2305 buf->ccontext.NameOffset = cpu_to_le16(offsetof 2306 (create_durable_req_t, Name)); 2307 buf->ccontext.NameLength = cpu_to_le16(4); 2308 /* SMB2_CREATE_DURABLE_HANDLE_REQUEST is "DHnQ" */ 2309 buf->Name[0] = 'D'; 2310 buf->Name[1] = 'H'; 2311 buf->Name[2] = 'n'; 2312 buf->Name[3] = 'Q'; 2313 return buf; 2314 } 2315 2316 static create_durable_req_t * 2317 create_reconnect_durable_buf(struct cifs_fid *fid) 2318 { 2319 create_durable_req_t *buf; 2320 2321 buf = kzalloc_obj(create_durable_req_t); 2322 if (!buf) 2323 return NULL; 2324 2325 buf->ccontext.DataOffset = cpu_to_le16(offsetof 2326 (create_durable_req_t, Data)); 2327 buf->ccontext.DataLength = cpu_to_le32(16); 2328 buf->ccontext.NameOffset = cpu_to_le16(offsetof 2329 (create_durable_req_t, Name)); 2330 buf->ccontext.NameLength = cpu_to_le16(4); 2331 buf->Data.Fid.PersistentFileId = fid->persistent_fid; 2332 buf->Data.Fid.VolatileFileId = fid->volatile_fid; 2333 /* SMB2_CREATE_DURABLE_HANDLE_RECONNECT is "DHnC" */ 2334 buf->Name[0] = 'D'; 2335 buf->Name[1] = 'H'; 2336 buf->Name[2] = 'n'; 2337 buf->Name[3] = 'C'; 2338 return buf; 2339 } 2340 2341 static void 2342 parse_query_id_ctxt(struct create_context *cc, struct smb2_file_all_info *buf) 2343 { 2344 struct create_disk_id_rsp *pdisk_id = (struct create_disk_id_rsp *)cc; 2345 2346 cifs_dbg(FYI, "parse query id context 0x%llx 0x%llx\n", 2347 pdisk_id->DiskFileId, pdisk_id->VolumeId); 2348 buf->IndexNumber = pdisk_id->DiskFileId; 2349 } 2350 2351 static void 2352 parse_posix_ctxt(struct create_context *cc, struct smb2_file_all_info *info, 2353 struct create_posix_rsp *posix) 2354 { 2355 int sid_len; 2356 u8 *beg = (u8 *)cc + le16_to_cpu(cc->DataOffset); 2357 u8 *end = beg + le32_to_cpu(cc->DataLength); 2358 u8 *sid; 2359 2360 memset(posix, 0, sizeof(*posix)); 2361 2362 posix->nlink = le32_to_cpu(*(__le32 *)(beg + 0)); 2363 posix->reparse_tag = le32_to_cpu(*(__le32 *)(beg + 4)); 2364 posix->mode = le32_to_cpu(*(__le32 *)(beg + 8)); 2365 2366 sid = beg + 12; 2367 sid_len = posix_info_sid_size(sid, end); 2368 if (sid_len < 0) { 2369 cifs_dbg(VFS, "bad owner sid in posix create response\n"); 2370 return; 2371 } 2372 memcpy(&posix->owner, sid, sid_len); 2373 2374 sid = sid + sid_len; 2375 sid_len = posix_info_sid_size(sid, end); 2376 if (sid_len < 0) { 2377 cifs_dbg(VFS, "bad group sid in posix create response\n"); 2378 return; 2379 } 2380 memcpy(&posix->group, sid, sid_len); 2381 2382 cifs_dbg(FYI, "nlink=%d mode=%o reparse_tag=%x\n", 2383 posix->nlink, posix->mode, posix->reparse_tag); 2384 } 2385 2386 int smb2_parse_contexts(struct TCP_Server_Info *server, 2387 struct kvec *rsp_iov, 2388 __u16 *epoch, 2389 char *lease_key, __u8 *oplock, 2390 struct smb2_file_all_info *buf, 2391 struct create_posix_rsp *posix) 2392 { 2393 struct smb2_create_rsp *rsp = rsp_iov->iov_base; 2394 struct create_context *cc; 2395 size_t rem, off, len; 2396 size_t doff, dlen; 2397 size_t noff, nlen; 2398 char *name; 2399 static const char smb3_create_tag_posix[] = { 2400 0x93, 0xAD, 0x25, 0x50, 0x9C, 2401 0xB4, 0x11, 0xE7, 0xB4, 0x23, 0x83, 2402 0xDE, 0x96, 0x8B, 0xCD, 0x7C 2403 }; 2404 2405 *oplock = 0; 2406 2407 off = le32_to_cpu(rsp->CreateContextsOffset); 2408 rem = le32_to_cpu(rsp->CreateContextsLength); 2409 if (check_add_overflow(off, rem, &len) || len > rsp_iov->iov_len) 2410 return -EINVAL; 2411 cc = (struct create_context *)((u8 *)rsp + off); 2412 2413 /* Initialize inode number to 0 in case no valid data in qfid context */ 2414 if (buf) 2415 buf->IndexNumber = 0; 2416 2417 while (rem >= sizeof(*cc)) { 2418 doff = le16_to_cpu(cc->DataOffset); 2419 dlen = le32_to_cpu(cc->DataLength); 2420 if (check_add_overflow(doff, dlen, &len) || len > rem) 2421 return -EINVAL; 2422 2423 noff = le16_to_cpu(cc->NameOffset); 2424 nlen = le16_to_cpu(cc->NameLength); 2425 if (noff + nlen > doff) 2426 return -EINVAL; 2427 2428 name = (char *)cc + noff; 2429 switch (nlen) { 2430 case 4: 2431 if (!strncmp(name, SMB2_CREATE_REQUEST_LEASE, 4)) { 2432 *oplock = server->ops->parse_lease_buf(cc, epoch, 2433 lease_key); 2434 } else if (buf && 2435 !strncmp(name, SMB2_CREATE_QUERY_ON_DISK_ID, 4)) { 2436 parse_query_id_ctxt(cc, buf); 2437 } 2438 break; 2439 case 16: 2440 if (posix && !memcmp(name, smb3_create_tag_posix, 16)) 2441 parse_posix_ctxt(cc, buf, posix); 2442 break; 2443 default: 2444 cifs_dbg(FYI, "%s: unhandled context (nlen=%zu dlen=%zu)\n", 2445 __func__, nlen, dlen); 2446 if (IS_ENABLED(CONFIG_CIFS_DEBUG2)) 2447 cifs_dump_mem("context data: ", cc, dlen); 2448 break; 2449 } 2450 2451 off = le32_to_cpu(cc->Next); 2452 if (!off) 2453 break; 2454 if (check_sub_overflow(rem, off, &rem)) 2455 return -EINVAL; 2456 cc = (struct create_context *)((u8 *)cc + off); 2457 } 2458 2459 if (rsp->OplockLevel != SMB2_OPLOCK_LEVEL_LEASE) 2460 *oplock = rsp->OplockLevel; 2461 2462 return 0; 2463 } 2464 2465 static int 2466 add_lease_context(struct TCP_Server_Info *server, 2467 struct smb2_create_req *req, 2468 struct kvec *iov, 2469 unsigned int *num_iovec, 2470 u8 *lease_key, 2471 __u8 *oplock, 2472 u8 *parent_lease_key, 2473 __le32 flags) 2474 { 2475 unsigned int num = *num_iovec; 2476 2477 iov[num].iov_base = server->ops->create_lease_buf(lease_key, *oplock, 2478 parent_lease_key, flags); 2479 if (iov[num].iov_base == NULL) 2480 return -ENOMEM; 2481 iov[num].iov_len = server->vals->create_lease_size; 2482 req->RequestedOplockLevel = SMB2_OPLOCK_LEVEL_LEASE; 2483 *num_iovec = num + 1; 2484 return 0; 2485 } 2486 2487 static struct create_durable_req_v2 * 2488 create_durable_v2_buf(struct cifs_open_parms *oparms) 2489 { 2490 struct cifs_fid *pfid = oparms->fid; 2491 struct create_durable_req_v2 *buf; 2492 2493 buf = kzalloc_obj(struct create_durable_req_v2); 2494 if (!buf) 2495 return NULL; 2496 2497 buf->ccontext.DataOffset = cpu_to_le16(offsetof 2498 (struct create_durable_req_v2, dcontext)); 2499 buf->ccontext.DataLength = cpu_to_le32(sizeof(struct durable_context_v2_req)); 2500 buf->ccontext.NameOffset = cpu_to_le16(offsetof 2501 (struct create_durable_req_v2, Name)); 2502 buf->ccontext.NameLength = cpu_to_le16(4); 2503 2504 /* 2505 * NB: Handle timeout defaults to 0, which allows server to choose 2506 * (most servers default to 120 seconds) and most clients default to 0. 2507 * This can be overridden at mount ("handletimeout=") if the user wants 2508 * a different persistent (or resilient) handle timeout for all opens 2509 * on a particular SMB3 mount. 2510 */ 2511 buf->dcontext.Timeout = cpu_to_le32(oparms->tcon->handle_timeout); 2512 buf->dcontext.Flags = cpu_to_le32(SMB2_DHANDLE_FLAG_PERSISTENT); 2513 2514 /* for replay, we should not overwrite the existing create guid */ 2515 if (!oparms->replay) { 2516 generate_random_uuid(buf->dcontext.CreateGuid); 2517 memcpy(pfid->create_guid, buf->dcontext.CreateGuid, 16); 2518 } else 2519 memcpy(buf->dcontext.CreateGuid, pfid->create_guid, 16); 2520 2521 /* SMB2_CREATE_DURABLE_HANDLE_REQUEST is "DH2Q" */ 2522 buf->Name[0] = 'D'; 2523 buf->Name[1] = 'H'; 2524 buf->Name[2] = '2'; 2525 buf->Name[3] = 'Q'; 2526 return buf; 2527 } 2528 2529 static struct create_durable_handle_reconnect_v2 * 2530 create_reconnect_durable_v2_buf(struct cifs_fid *fid) 2531 { 2532 struct create_durable_handle_reconnect_v2 *buf; 2533 2534 buf = kzalloc_obj(struct create_durable_handle_reconnect_v2); 2535 if (!buf) 2536 return NULL; 2537 2538 buf->ccontext.DataOffset = 2539 cpu_to_le16(offsetof(struct create_durable_handle_reconnect_v2, 2540 dcontext)); 2541 buf->ccontext.DataLength = 2542 cpu_to_le32(sizeof(struct durable_reconnect_context_v2)); 2543 buf->ccontext.NameOffset = 2544 cpu_to_le16(offsetof(struct create_durable_handle_reconnect_v2, 2545 Name)); 2546 buf->ccontext.NameLength = cpu_to_le16(4); 2547 2548 buf->dcontext.Fid.PersistentFileId = fid->persistent_fid; 2549 buf->dcontext.Fid.VolatileFileId = fid->volatile_fid; 2550 buf->dcontext.Flags = cpu_to_le32(SMB2_DHANDLE_FLAG_PERSISTENT); 2551 memcpy(buf->dcontext.CreateGuid, fid->create_guid, 16); 2552 2553 /* SMB2_CREATE_DURABLE_HANDLE_RECONNECT_V2 is "DH2C" */ 2554 buf->Name[0] = 'D'; 2555 buf->Name[1] = 'H'; 2556 buf->Name[2] = '2'; 2557 buf->Name[3] = 'C'; 2558 return buf; 2559 } 2560 2561 static int 2562 add_durable_v2_context(struct kvec *iov, unsigned int *num_iovec, 2563 struct cifs_open_parms *oparms) 2564 { 2565 unsigned int num = *num_iovec; 2566 2567 iov[num].iov_base = create_durable_v2_buf(oparms); 2568 if (iov[num].iov_base == NULL) 2569 return -ENOMEM; 2570 iov[num].iov_len = sizeof(struct create_durable_req_v2); 2571 *num_iovec = num + 1; 2572 return 0; 2573 } 2574 2575 static int 2576 add_durable_reconnect_v2_context(struct kvec *iov, unsigned int *num_iovec, 2577 struct cifs_open_parms *oparms) 2578 { 2579 unsigned int num = *num_iovec; 2580 2581 /* indicate that we don't need to relock the file */ 2582 oparms->reconnect = false; 2583 2584 iov[num].iov_base = create_reconnect_durable_v2_buf(oparms->fid); 2585 if (iov[num].iov_base == NULL) 2586 return -ENOMEM; 2587 iov[num].iov_len = sizeof(struct create_durable_handle_reconnect_v2); 2588 *num_iovec = num + 1; 2589 return 0; 2590 } 2591 2592 static int 2593 add_durable_context(struct kvec *iov, unsigned int *num_iovec, 2594 struct cifs_open_parms *oparms, bool use_persistent) 2595 { 2596 unsigned int num = *num_iovec; 2597 2598 if (use_persistent) { 2599 if (oparms->reconnect) 2600 return add_durable_reconnect_v2_context(iov, num_iovec, 2601 oparms); 2602 else 2603 return add_durable_v2_context(iov, num_iovec, oparms); 2604 } 2605 2606 if (oparms->reconnect) { 2607 iov[num].iov_base = create_reconnect_durable_buf(oparms->fid); 2608 /* indicate that we don't need to relock the file */ 2609 oparms->reconnect = false; 2610 } else 2611 iov[num].iov_base = create_durable_buf(); 2612 if (iov[num].iov_base == NULL) 2613 return -ENOMEM; 2614 iov[num].iov_len = sizeof(create_durable_req_t); 2615 *num_iovec = num + 1; 2616 return 0; 2617 } 2618 2619 /* See MS-SMB2 2.2.13.2.7 */ 2620 static struct crt_twarp_ctxt * 2621 create_twarp_buf(__u64 timewarp) 2622 { 2623 struct crt_twarp_ctxt *buf; 2624 2625 buf = kzalloc_obj(struct crt_twarp_ctxt); 2626 if (!buf) 2627 return NULL; 2628 2629 buf->ccontext.DataOffset = cpu_to_le16(offsetof 2630 (struct crt_twarp_ctxt, Timestamp)); 2631 buf->ccontext.DataLength = cpu_to_le32(8); 2632 buf->ccontext.NameOffset = cpu_to_le16(offsetof 2633 (struct crt_twarp_ctxt, Name)); 2634 buf->ccontext.NameLength = cpu_to_le16(4); 2635 /* SMB2_CREATE_TIMEWARP_TOKEN is "TWrp" */ 2636 buf->Name[0] = 'T'; 2637 buf->Name[1] = 'W'; 2638 buf->Name[2] = 'r'; 2639 buf->Name[3] = 'p'; 2640 buf->Timestamp = cpu_to_le64(timewarp); 2641 return buf; 2642 } 2643 2644 /* See MS-SMB2 2.2.13.2.7 */ 2645 static int 2646 add_twarp_context(struct kvec *iov, unsigned int *num_iovec, __u64 timewarp) 2647 { 2648 unsigned int num = *num_iovec; 2649 2650 iov[num].iov_base = create_twarp_buf(timewarp); 2651 if (iov[num].iov_base == NULL) 2652 return -ENOMEM; 2653 iov[num].iov_len = sizeof(struct crt_twarp_ctxt); 2654 *num_iovec = num + 1; 2655 return 0; 2656 } 2657 2658 /* See http://technet.microsoft.com/en-us/library/hh509017(v=ws.10).aspx */ 2659 static void setup_owner_group_sids(char *buf) 2660 { 2661 struct owner_group_sids *sids = (struct owner_group_sids *)buf; 2662 2663 /* Populate the user ownership fields S-1-5-88-1 */ 2664 sids->owner.Revision = 1; 2665 sids->owner.NumAuth = 3; 2666 sids->owner.Authority[5] = 5; 2667 sids->owner.SubAuthorities[0] = cpu_to_le32(88); 2668 sids->owner.SubAuthorities[1] = cpu_to_le32(1); 2669 sids->owner.SubAuthorities[2] = cpu_to_le32(current_fsuid().val); 2670 2671 /* Populate the group ownership fields S-1-5-88-2 */ 2672 sids->group.Revision = 1; 2673 sids->group.NumAuth = 3; 2674 sids->group.Authority[5] = 5; 2675 sids->group.SubAuthorities[0] = cpu_to_le32(88); 2676 sids->group.SubAuthorities[1] = cpu_to_le32(2); 2677 sids->group.SubAuthorities[2] = cpu_to_le32(current_fsgid().val); 2678 2679 cifs_dbg(FYI, "owner S-1-5-88-1-%d, group S-1-5-88-2-%d\n", current_fsuid().val, current_fsgid().val); 2680 } 2681 2682 /* See MS-SMB2 2.2.13.2.2 and MS-DTYP 2.4.6 */ 2683 static struct crt_sd_ctxt * 2684 create_sd_buf(umode_t mode, bool set_owner, unsigned int *len) 2685 { 2686 struct crt_sd_ctxt *buf; 2687 __u8 *ptr, *aclptr; 2688 unsigned int acelen, acl_size, ace_count; 2689 unsigned int owner_offset = 0; 2690 unsigned int group_offset = 0; 2691 struct smb3_acl acl = {}; 2692 2693 *len = round_up(sizeof(struct crt_sd_ctxt) + (sizeof(struct smb_ace) * 4), 8); 2694 2695 if (set_owner) { 2696 /* sizeof(struct owner_group_sids) is already multiple of 8 so no need to round */ 2697 *len += sizeof(struct owner_group_sids); 2698 } 2699 2700 buf = kzalloc(*len, GFP_KERNEL); 2701 if (buf == NULL) 2702 return buf; 2703 2704 ptr = (__u8 *)&buf[1]; 2705 if (set_owner) { 2706 /* offset fields are from beginning of security descriptor not of create context */ 2707 owner_offset = ptr - (__u8 *)&buf->sd; 2708 buf->sd.OffsetOwner = cpu_to_le32(owner_offset); 2709 group_offset = owner_offset + offsetof(struct owner_group_sids, group); 2710 buf->sd.OffsetGroup = cpu_to_le32(group_offset); 2711 2712 setup_owner_group_sids(ptr); 2713 ptr += sizeof(struct owner_group_sids); 2714 } else { 2715 buf->sd.OffsetOwner = 0; 2716 buf->sd.OffsetGroup = 0; 2717 } 2718 2719 buf->ccontext.DataOffset = cpu_to_le16(offsetof(struct crt_sd_ctxt, sd)); 2720 buf->ccontext.NameOffset = cpu_to_le16(offsetof(struct crt_sd_ctxt, Name)); 2721 buf->ccontext.NameLength = cpu_to_le16(4); 2722 /* SMB2_CREATE_SD_BUFFER_TOKEN is "SecD" */ 2723 buf->Name[0] = 'S'; 2724 buf->Name[1] = 'e'; 2725 buf->Name[2] = 'c'; 2726 buf->Name[3] = 'D'; 2727 buf->sd.Revision = 1; /* Must be one see MS-DTYP 2.4.6 */ 2728 2729 /* 2730 * ACL is "self relative" ie ACL is stored in contiguous block of memory 2731 * and "DP" ie the DACL is present 2732 */ 2733 buf->sd.Control = cpu_to_le16(ACL_CONTROL_SR | ACL_CONTROL_DP); 2734 2735 /* offset owner, group and Sbz1 and SACL are all zero */ 2736 buf->sd.OffsetDacl = cpu_to_le32(ptr - (__u8 *)&buf->sd); 2737 /* Ship the ACL for now. we will copy it into buf later. */ 2738 aclptr = ptr; 2739 ptr += sizeof(struct smb3_acl); 2740 2741 /* create one ACE to hold the mode embedded in reserved special SID */ 2742 acelen = setup_special_mode_ACE((struct smb_ace *)ptr, false, (__u64)mode); 2743 ptr += acelen; 2744 acl_size = acelen + sizeof(struct smb3_acl); 2745 ace_count = 1; 2746 2747 if (set_owner) { 2748 /* we do not need to reallocate buffer to add the two more ACEs. plenty of space */ 2749 acelen = setup_special_user_owner_ACE((struct smb_ace *)ptr); 2750 ptr += acelen; 2751 acl_size += acelen; 2752 ace_count += 1; 2753 } 2754 2755 /* and one more ACE to allow access for authenticated users */ 2756 acelen = setup_authusers_ACE((struct smb_ace *)ptr); 2757 ptr += acelen; 2758 acl_size += acelen; 2759 ace_count += 1; 2760 2761 acl.AclRevision = ACL_REVISION; /* See 2.4.4.1 of MS-DTYP */ 2762 acl.AclSize = cpu_to_le16(acl_size); 2763 acl.AceCount = cpu_to_le16(ace_count); 2764 /* acl.Sbz1 and Sbz2 MBZ so are not set here, but initialized above */ 2765 memcpy(aclptr, &acl, sizeof(struct smb3_acl)); 2766 2767 buf->ccontext.DataLength = cpu_to_le32(ptr - (__u8 *)&buf->sd); 2768 *len = round_up((unsigned int)(ptr - (__u8 *)buf), 8); 2769 2770 return buf; 2771 } 2772 2773 static int 2774 add_sd_context(struct kvec *iov, unsigned int *num_iovec, umode_t mode, bool set_owner) 2775 { 2776 unsigned int num = *num_iovec; 2777 unsigned int len = 0; 2778 2779 iov[num].iov_base = create_sd_buf(mode, set_owner, &len); 2780 if (iov[num].iov_base == NULL) 2781 return -ENOMEM; 2782 iov[num].iov_len = len; 2783 *num_iovec = num + 1; 2784 return 0; 2785 } 2786 2787 static struct crt_query_id_ctxt * 2788 create_query_id_buf(void) 2789 { 2790 struct crt_query_id_ctxt *buf; 2791 2792 buf = kzalloc_obj(struct crt_query_id_ctxt); 2793 if (!buf) 2794 return NULL; 2795 2796 buf->ccontext.DataOffset = cpu_to_le16(0); 2797 buf->ccontext.DataLength = cpu_to_le32(0); 2798 buf->ccontext.NameOffset = cpu_to_le16(offsetof 2799 (struct crt_query_id_ctxt, Name)); 2800 buf->ccontext.NameLength = cpu_to_le16(4); 2801 /* SMB2_CREATE_QUERY_ON_DISK_ID is "QFid" */ 2802 buf->Name[0] = 'Q'; 2803 buf->Name[1] = 'F'; 2804 buf->Name[2] = 'i'; 2805 buf->Name[3] = 'd'; 2806 return buf; 2807 } 2808 2809 /* See MS-SMB2 2.2.13.2.9 */ 2810 static int 2811 add_query_id_context(struct kvec *iov, unsigned int *num_iovec) 2812 { 2813 unsigned int num = *num_iovec; 2814 2815 iov[num].iov_base = create_query_id_buf(); 2816 if (iov[num].iov_base == NULL) 2817 return -ENOMEM; 2818 iov[num].iov_len = sizeof(struct crt_query_id_ctxt); 2819 *num_iovec = num + 1; 2820 return 0; 2821 } 2822 2823 static void add_ea_context(struct cifs_open_parms *oparms, 2824 struct kvec *rq_iov, unsigned int *num_iovs) 2825 { 2826 struct kvec *iov = oparms->ea_cctx; 2827 2828 if (iov && iov->iov_base && iov->iov_len) { 2829 rq_iov[(*num_iovs)++] = *iov; 2830 memset(iov, 0, sizeof(*iov)); 2831 } 2832 } 2833 2834 static int 2835 alloc_path_with_tree_prefix(__le16 **out_path, int *out_size, int *out_len, 2836 const char *treename, const __le16 *path) 2837 { 2838 int treename_len, path_len; 2839 struct nls_table *cp; 2840 const __le16 sep[] = {cpu_to_le16('\\'), cpu_to_le16(0x0000)}; 2841 2842 /* 2843 * skip leading "\\" 2844 */ 2845 treename_len = strlen(treename); 2846 if (treename_len < 2 || !(treename[0] == '\\' && treename[1] == '\\')) 2847 return -EINVAL; 2848 2849 treename += 2; 2850 treename_len -= 2; 2851 2852 path_len = UniStrnlen((wchar_t *)path, PATH_MAX); 2853 2854 /* make room for one path separator only if @path isn't empty */ 2855 *out_len = treename_len + (path[0] ? 1 : 0) + path_len; 2856 2857 /* 2858 * final path needs to be 8-byte aligned as specified in 2859 * MS-SMB2 2.2.13 SMB2 CREATE Request. 2860 */ 2861 *out_size = round_up(*out_len * sizeof(__le16), 8); 2862 *out_path = kzalloc(*out_size + sizeof(__le16) /* null */, GFP_KERNEL); 2863 if (!*out_path) 2864 return -ENOMEM; 2865 2866 cp = load_nls_default(); 2867 cifs_strtoUTF16(*out_path, treename, treename_len, cp); 2868 2869 /* Do not append the separator if the path is empty */ 2870 if (path[0] != cpu_to_le16(0x0000)) { 2871 UniStrcat((wchar_t *)*out_path, (wchar_t *)sep); 2872 UniStrcat((wchar_t *)*out_path, (wchar_t *)path); 2873 } 2874 2875 unload_nls(cp); 2876 2877 return 0; 2878 } 2879 2880 int smb311_posix_mkdir(const unsigned int xid, struct inode *inode, 2881 umode_t mode, struct cifs_tcon *tcon, 2882 const char *full_path, 2883 struct cifs_sb_info *cifs_sb) 2884 { 2885 struct smb_rqst rqst; 2886 struct smb2_create_req *req; 2887 struct smb2_create_rsp *rsp = NULL; 2888 struct cifs_ses *ses = tcon->ses; 2889 struct kvec iov[3]; /* make sure at least one for each open context */ 2890 struct kvec rsp_iov = {NULL, 0}; 2891 int resp_buftype; 2892 int uni_path_len; 2893 __le16 *copy_path = NULL; 2894 int copy_size; 2895 int rc = 0; 2896 unsigned int n_iov = 2; 2897 __u32 file_attributes = 0; 2898 char *pc_buf = NULL; 2899 int flags = 0; 2900 unsigned int total_len; 2901 __le16 *utf16_path = NULL; 2902 struct TCP_Server_Info *server; 2903 int retries = 0, cur_sleep = 0; 2904 2905 replay_again: 2906 /* reinitialize for possible replay */ 2907 pc_buf = NULL; 2908 flags = 0; 2909 n_iov = 2; 2910 server = cifs_pick_channel(ses); 2911 2912 cifs_dbg(FYI, "mkdir\n"); 2913 2914 /* resource #1: path allocation */ 2915 utf16_path = cifs_convert_path_to_utf16(full_path, cifs_sb); 2916 if (!utf16_path) 2917 return -ENOMEM; 2918 2919 if (!ses || !server) { 2920 rc = smb_EIO(smb_eio_trace_null_pointers); 2921 goto err_free_path; 2922 } 2923 2924 /* resource #2: request */ 2925 rc = smb2_plain_req_init(SMB2_CREATE, tcon, server, 2926 (void **) &req, &total_len); 2927 if (rc) 2928 goto err_free_path; 2929 2930 2931 if (smb3_encryption_required(tcon)) 2932 flags |= CIFS_TRANSFORM_REQ; 2933 2934 req->ImpersonationLevel = IL_IMPERSONATION; 2935 req->DesiredAccess = cpu_to_le32(FILE_WRITE_ATTRIBUTES); 2936 /* File attributes ignored on open (used in create though) */ 2937 req->FileAttributes = cpu_to_le32(file_attributes); 2938 req->ShareAccess = FILE_SHARE_ALL_LE; 2939 req->CreateDisposition = cpu_to_le32(FILE_CREATE); 2940 req->CreateOptions = cpu_to_le32(CREATE_NOT_FILE); 2941 2942 iov[0].iov_base = (char *)req; 2943 /* -1 since last byte is buf[0] which is sent below (path) */ 2944 iov[0].iov_len = total_len - 1; 2945 2946 req->NameOffset = cpu_to_le16(sizeof(struct smb2_create_req)); 2947 2948 /* [MS-SMB2] 2.2.13 NameOffset: 2949 * If SMB2_FLAGS_DFS_OPERATIONS is set in the Flags field of 2950 * the SMB2 header, the file name includes a prefix that will 2951 * be processed during DFS name normalization as specified in 2952 * section 3.3.5.9. Otherwise, the file name is relative to 2953 * the share that is identified by the TreeId in the SMB2 2954 * header. 2955 */ 2956 if (tcon->share_flags & SHI1005_FLAGS_DFS) { 2957 int name_len; 2958 2959 req->hdr.Flags |= SMB2_FLAGS_DFS_OPERATIONS; 2960 rc = alloc_path_with_tree_prefix(©_path, ©_size, 2961 &name_len, 2962 tcon->tree_name, utf16_path); 2963 if (rc) 2964 goto err_free_req; 2965 2966 req->NameLength = cpu_to_le16(name_len * 2); 2967 uni_path_len = copy_size; 2968 /* free before overwriting resource */ 2969 kfree(utf16_path); 2970 utf16_path = copy_path; 2971 } else { 2972 uni_path_len = (2 * UniStrnlen((wchar_t *)utf16_path, PATH_MAX)) + 2; 2973 /* MUST set path len (NameLength) to 0 opening root of share */ 2974 req->NameLength = cpu_to_le16(uni_path_len - 2); 2975 if (uni_path_len % 8 != 0) { 2976 copy_size = roundup(uni_path_len, 8); 2977 copy_path = kzalloc(copy_size, GFP_KERNEL); 2978 if (!copy_path) { 2979 rc = -ENOMEM; 2980 goto err_free_req; 2981 } 2982 memcpy((char *)copy_path, (const char *)utf16_path, 2983 uni_path_len); 2984 uni_path_len = copy_size; 2985 /* free before overwriting resource */ 2986 kfree(utf16_path); 2987 utf16_path = copy_path; 2988 } 2989 } 2990 2991 iov[1].iov_len = uni_path_len; 2992 iov[1].iov_base = utf16_path; 2993 req->RequestedOplockLevel = SMB2_OPLOCK_LEVEL_NONE; 2994 2995 if (tcon->posix_extensions) { 2996 /* resource #3: posix buf */ 2997 rc = add_posix_context(iov, &n_iov, mode); 2998 if (rc) 2999 goto err_free_req; 3000 req->CreateContextsOffset = cpu_to_le32( 3001 sizeof(struct smb2_create_req) + 3002 iov[1].iov_len); 3003 le32_add_cpu(&req->CreateContextsLength, iov[n_iov-1].iov_len); 3004 pc_buf = iov[n_iov-1].iov_base; 3005 } 3006 3007 3008 memset(&rqst, 0, sizeof(struct smb_rqst)); 3009 rqst.rq_iov = iov; 3010 rqst.rq_nvec = n_iov; 3011 3012 /* no need to inc num_remote_opens because we close it just below */ 3013 trace_smb3_posix_mkdir_enter(xid, tcon->tid, ses->Suid, full_path, CREATE_NOT_FILE, 3014 FILE_WRITE_ATTRIBUTES); 3015 3016 if (retries) { 3017 /* Back-off before retry */ 3018 if (cur_sleep) 3019 msleep(cur_sleep); 3020 smb2_set_replay(server, &rqst); 3021 } 3022 3023 /* resource #4: response buffer */ 3024 rc = cifs_send_recv(xid, ses, server, 3025 &rqst, &resp_buftype, flags, &rsp_iov); 3026 if (rc) { 3027 cifs_stats_fail_inc(tcon, SMB2_CREATE_HE); 3028 trace_smb3_posix_mkdir_err(xid, tcon->tid, ses->Suid, 3029 CREATE_NOT_FILE, 3030 FILE_WRITE_ATTRIBUTES, rc); 3031 goto err_free_rsp_buf; 3032 } 3033 3034 /* 3035 * Although unlikely to be possible for rsp to be null and rc not set, 3036 * adding check below is slightly safer long term (and quiets Coverity 3037 * warning) 3038 */ 3039 rsp = (struct smb2_create_rsp *)rsp_iov.iov_base; 3040 if (rsp == NULL) { 3041 rc = smb_EIO(smb_eio_trace_mkdir_no_rsp); 3042 kfree(pc_buf); 3043 goto err_free_req; 3044 } 3045 3046 trace_smb3_posix_mkdir_done(xid, rsp->PersistentFileId, tcon->tid, ses->Suid, 3047 CREATE_NOT_FILE, FILE_WRITE_ATTRIBUTES); 3048 3049 SMB2_close(xid, tcon, rsp->PersistentFileId, rsp->VolatileFileId); 3050 3051 /* Eventually save off posix specific response info and timestamps */ 3052 3053 err_free_rsp_buf: 3054 free_rsp_buf(resp_buftype, rsp_iov.iov_base); 3055 kfree(pc_buf); 3056 err_free_req: 3057 cifs_small_buf_release(req); 3058 err_free_path: 3059 kfree(utf16_path); 3060 3061 if (is_replayable_error(rc) && 3062 smb2_should_replay(tcon, &retries, &cur_sleep)) 3063 goto replay_again; 3064 3065 return rc; 3066 } 3067 3068 int 3069 SMB2_open_init(struct cifs_tcon *tcon, struct TCP_Server_Info *server, 3070 struct smb_rqst *rqst, __u8 *oplock, 3071 struct cifs_open_parms *oparms, __le16 *path) 3072 { 3073 struct smb2_create_req *req; 3074 unsigned int n_iov = 2; 3075 __u32 file_attributes = 0; 3076 int copy_size; 3077 int uni_path_len; 3078 unsigned int total_len; 3079 struct kvec *iov = rqst->rq_iov; 3080 __le16 *copy_path; 3081 int rc; 3082 3083 rc = smb2_plain_req_init(SMB2_CREATE, tcon, server, 3084 (void **) &req, &total_len); 3085 if (rc) 3086 return rc; 3087 3088 iov[0].iov_base = (char *)req; 3089 /* -1 since last byte is buf[0] which is sent below (path) */ 3090 iov[0].iov_len = total_len - 1; 3091 3092 if (oparms->create_options & CREATE_OPTION_READONLY) 3093 file_attributes |= ATTR_READONLY; 3094 if (oparms->create_options & CREATE_OPTION_SPECIAL) 3095 file_attributes |= ATTR_SYSTEM; 3096 3097 req->ImpersonationLevel = IL_IMPERSONATION; 3098 req->DesiredAccess = cpu_to_le32(oparms->desired_access); 3099 /* File attributes ignored on open (used in create though) */ 3100 req->FileAttributes = cpu_to_le32(file_attributes); 3101 req->ShareAccess = FILE_SHARE_ALL_LE; 3102 3103 req->CreateDisposition = cpu_to_le32(oparms->disposition); 3104 req->CreateOptions = cpu_to_le32(oparms->create_options & CREATE_OPTIONS_MASK); 3105 req->NameOffset = cpu_to_le16(sizeof(struct smb2_create_req)); 3106 3107 /* [MS-SMB2] 2.2.13 NameOffset: 3108 * If SMB2_FLAGS_DFS_OPERATIONS is set in the Flags field of 3109 * the SMB2 header, the file name includes a prefix that will 3110 * be processed during DFS name normalization as specified in 3111 * section 3.3.5.9. Otherwise, the file name is relative to 3112 * the share that is identified by the TreeId in the SMB2 3113 * header. 3114 */ 3115 if (tcon->share_flags & SHI1005_FLAGS_DFS) { 3116 int name_len; 3117 3118 req->hdr.Flags |= SMB2_FLAGS_DFS_OPERATIONS; 3119 rc = alloc_path_with_tree_prefix(©_path, ©_size, 3120 &name_len, 3121 tcon->tree_name, path); 3122 if (rc) 3123 return rc; 3124 req->NameLength = cpu_to_le16(name_len * 2); 3125 uni_path_len = copy_size; 3126 path = copy_path; 3127 } else { 3128 uni_path_len = (2 * UniStrnlen((wchar_t *)path, PATH_MAX)) + 2; 3129 /* MUST set path len (NameLength) to 0 opening root of share */ 3130 req->NameLength = cpu_to_le16(uni_path_len - 2); 3131 copy_size = round_up(uni_path_len, 8); 3132 copy_path = kzalloc(copy_size, GFP_KERNEL); 3133 if (!copy_path) 3134 return -ENOMEM; 3135 memcpy((char *)copy_path, (const char *)path, 3136 uni_path_len); 3137 uni_path_len = copy_size; 3138 path = copy_path; 3139 } 3140 3141 iov[1].iov_len = uni_path_len; 3142 iov[1].iov_base = path; 3143 3144 if ((!server->oplocks) || (tcon->no_lease)) 3145 *oplock = SMB2_OPLOCK_LEVEL_NONE; 3146 3147 if (!(server->capabilities & SMB2_GLOBAL_CAP_LEASING) || 3148 *oplock == SMB2_OPLOCK_LEVEL_NONE) 3149 req->RequestedOplockLevel = *oplock; 3150 else if (!(server->capabilities & SMB2_GLOBAL_CAP_DIRECTORY_LEASING) && 3151 (oparms->create_options & CREATE_NOT_FILE)) 3152 req->RequestedOplockLevel = *oplock; /* no srv lease support */ 3153 else { 3154 rc = add_lease_context(server, req, iov, &n_iov, 3155 oparms->fid->lease_key, oplock, 3156 oparms->fid->parent_lease_key, 3157 oparms->lease_flags); 3158 if (rc) 3159 return rc; 3160 } 3161 3162 if (*oplock == SMB2_OPLOCK_LEVEL_BATCH) { 3163 rc = add_durable_context(iov, &n_iov, oparms, 3164 tcon->use_persistent); 3165 if (rc) 3166 return rc; 3167 } 3168 3169 if (tcon->posix_extensions) { 3170 rc = add_posix_context(iov, &n_iov, oparms->mode); 3171 if (rc) 3172 return rc; 3173 } 3174 3175 if (tcon->snapshot_time) { 3176 cifs_dbg(FYI, "adding snapshot context\n"); 3177 rc = add_twarp_context(iov, &n_iov, tcon->snapshot_time); 3178 if (rc) 3179 return rc; 3180 } 3181 3182 if ((oparms->disposition != FILE_OPEN) && (oparms->cifs_sb)) { 3183 unsigned int sbflags = cifs_sb_flags(oparms->cifs_sb); 3184 bool set_mode; 3185 bool set_owner; 3186 3187 if ((sbflags & CIFS_MOUNT_MODE_FROM_SID) && 3188 oparms->mode != ACL_NO_MODE) { 3189 set_mode = true; 3190 } else { 3191 set_mode = false; 3192 oparms->mode = ACL_NO_MODE; 3193 } 3194 3195 set_owner = sbflags & CIFS_MOUNT_UID_FROM_ACL; 3196 if (set_owner | set_mode) { 3197 cifs_dbg(FYI, "add sd with mode 0x%x\n", oparms->mode); 3198 rc = add_sd_context(iov, &n_iov, oparms->mode, set_owner); 3199 if (rc) 3200 return rc; 3201 } 3202 } 3203 3204 add_query_id_context(iov, &n_iov); 3205 add_ea_context(oparms, iov, &n_iov); 3206 3207 if (n_iov > 2) { 3208 /* 3209 * We have create contexts behind iov[1] (the file 3210 * name), point at them from the main create request 3211 */ 3212 req->CreateContextsOffset = cpu_to_le32( 3213 sizeof(struct smb2_create_req) + 3214 iov[1].iov_len); 3215 req->CreateContextsLength = 0; 3216 3217 for (unsigned int i = 2; i < (n_iov-1); i++) { 3218 struct kvec *v = &iov[i]; 3219 size_t len = v->iov_len; 3220 struct create_context *cctx = 3221 (struct create_context *)v->iov_base; 3222 3223 cctx->Next = cpu_to_le32(len); 3224 le32_add_cpu(&req->CreateContextsLength, len); 3225 } 3226 le32_add_cpu(&req->CreateContextsLength, 3227 iov[n_iov-1].iov_len); 3228 } 3229 3230 rqst->rq_nvec = n_iov; 3231 return 0; 3232 } 3233 3234 /* rq_iov[0] is the request and is released by cifs_small_buf_release(). 3235 * All other vectors are freed by kfree(). 3236 */ 3237 void 3238 SMB2_open_free(struct smb_rqst *rqst) 3239 { 3240 int i; 3241 3242 if (rqst && rqst->rq_iov) { 3243 cifs_small_buf_release(rqst->rq_iov[0].iov_base); 3244 for (i = 1; i < rqst->rq_nvec; i++) 3245 if (rqst->rq_iov[i].iov_base != smb2_padding) 3246 kfree(rqst->rq_iov[i].iov_base); 3247 } 3248 } 3249 3250 int 3251 SMB2_open(const unsigned int xid, struct cifs_open_parms *oparms, __le16 *path, 3252 __u8 *oplock, struct smb2_file_all_info *buf, 3253 struct create_posix_rsp *posix, 3254 struct kvec *err_iov, int *buftype) 3255 { 3256 struct smb_rqst rqst; 3257 struct smb2_create_rsp *rsp = NULL; 3258 struct cifs_tcon *tcon = oparms->tcon; 3259 struct cifs_ses *ses = tcon->ses; 3260 struct TCP_Server_Info *server; 3261 struct kvec iov[SMB2_CREATE_IOV_SIZE]; 3262 struct kvec rsp_iov = {NULL, 0}; 3263 int resp_buftype = CIFS_NO_BUFFER; 3264 int rc = 0; 3265 int flags = 0; 3266 int retries = 0, cur_sleep = 0; 3267 3268 replay_again: 3269 /* reinitialize for possible replay */ 3270 flags = 0; 3271 server = cifs_pick_channel(ses); 3272 oparms->replay = !!(retries); 3273 3274 cifs_dbg(FYI, "create/open\n"); 3275 if (!ses || !server) 3276 return smb_EIO(smb_eio_trace_null_pointers); 3277 3278 if (smb3_encryption_required(tcon)) 3279 flags |= CIFS_TRANSFORM_REQ; 3280 3281 memset(&rqst, 0, sizeof(struct smb_rqst)); 3282 memset(&iov, 0, sizeof(iov)); 3283 rqst.rq_iov = iov; 3284 rqst.rq_nvec = SMB2_CREATE_IOV_SIZE; 3285 3286 rc = SMB2_open_init(tcon, server, 3287 &rqst, oplock, oparms, path); 3288 if (rc) 3289 goto creat_exit; 3290 3291 trace_smb3_open_enter(xid, tcon->tid, tcon->ses->Suid, oparms->path, 3292 oparms->create_options, oparms->desired_access); 3293 3294 if (retries) { 3295 /* Back-off before retry */ 3296 if (cur_sleep) 3297 msleep(cur_sleep); 3298 smb2_set_replay(server, &rqst); 3299 } 3300 3301 rc = cifs_send_recv(xid, ses, server, 3302 &rqst, &resp_buftype, flags, 3303 &rsp_iov); 3304 rsp = (struct smb2_create_rsp *)rsp_iov.iov_base; 3305 3306 if (rc != 0) { 3307 cifs_stats_fail_inc(tcon, SMB2_CREATE_HE); 3308 if (err_iov && rsp) { 3309 *err_iov = rsp_iov; 3310 *buftype = resp_buftype; 3311 resp_buftype = CIFS_NO_BUFFER; 3312 rsp = NULL; 3313 } 3314 trace_smb3_open_err(xid, tcon->tid, ses->Suid, 3315 oparms->create_options, oparms->desired_access, rc); 3316 if (rc == -EREMCHG) { 3317 pr_warn_once("server share %s deleted\n", 3318 tcon->tree_name); 3319 tcon->need_reconnect = true; 3320 } 3321 goto creat_exit; 3322 } else if (rsp == NULL) /* unlikely to happen, but safer to check */ 3323 goto creat_exit; 3324 else 3325 trace_smb3_open_done(xid, rsp->PersistentFileId, tcon->tid, ses->Suid, 3326 oparms->create_options, oparms->desired_access); 3327 3328 atomic_inc(&tcon->num_remote_opens); 3329 oparms->fid->persistent_fid = rsp->PersistentFileId; 3330 oparms->fid->volatile_fid = rsp->VolatileFileId; 3331 oparms->fid->access = oparms->desired_access; 3332 #ifdef CONFIG_CIFS_DEBUG2 3333 oparms->fid->mid = le64_to_cpu(rsp->hdr.MessageId); 3334 #endif /* CIFS_DEBUG2 */ 3335 3336 if (buf) { 3337 buf->CreationTime = rsp->CreationTime; 3338 buf->LastAccessTime = rsp->LastAccessTime; 3339 buf->LastWriteTime = rsp->LastWriteTime; 3340 buf->ChangeTime = rsp->ChangeTime; 3341 buf->AllocationSize = rsp->AllocationSize; 3342 buf->EndOfFile = rsp->EndofFile; 3343 buf->Attributes = rsp->FileAttributes; 3344 buf->NumberOfLinks = cpu_to_le32(1); 3345 buf->DeletePending = 0; /* successful open = not delete pending */ 3346 } 3347 3348 3349 rc = smb2_parse_contexts(server, &rsp_iov, &oparms->fid->epoch, 3350 oparms->fid->lease_key, oplock, buf, posix); 3351 creat_exit: 3352 SMB2_open_free(&rqst); 3353 free_rsp_buf(resp_buftype, rsp); 3354 3355 if (is_replayable_error(rc) && 3356 smb2_should_replay(tcon, &retries, &cur_sleep)) 3357 goto replay_again; 3358 3359 return rc; 3360 } 3361 3362 int 3363 SMB2_ioctl_init(struct cifs_tcon *tcon, struct TCP_Server_Info *server, 3364 struct smb_rqst *rqst, 3365 u64 persistent_fid, u64 volatile_fid, u32 opcode, 3366 char *in_data, u32 indatalen, 3367 __u32 max_response_size) 3368 { 3369 struct smb2_ioctl_req *req; 3370 struct kvec *iov = rqst->rq_iov; 3371 unsigned int total_len; 3372 int rc; 3373 char *in_data_buf; 3374 3375 rc = smb2_ioctl_req_init(opcode, tcon, server, 3376 (void **) &req, &total_len); 3377 if (rc) 3378 return rc; 3379 3380 if (indatalen) { 3381 /* 3382 * indatalen is usually small at a couple of bytes max, so 3383 * just allocate through generic pool 3384 */ 3385 in_data_buf = kmemdup(in_data, indatalen, GFP_NOFS); 3386 if (!in_data_buf) { 3387 cifs_small_buf_release(req); 3388 return -ENOMEM; 3389 } 3390 } 3391 3392 req->CtlCode = cpu_to_le32(opcode); 3393 req->PersistentFileId = persistent_fid; 3394 req->VolatileFileId = volatile_fid; 3395 3396 iov[0].iov_base = (char *)req; 3397 /* 3398 * If no input data, the size of ioctl struct in 3399 * protocol spec still includes a 1 byte data buffer, 3400 * but if input data passed to ioctl, we do not 3401 * want to double count this, so we do not send 3402 * the dummy one byte of data in iovec[0] if sending 3403 * input data (in iovec[1]). 3404 */ 3405 if (indatalen) { 3406 req->InputCount = cpu_to_le32(indatalen); 3407 /* do not set InputOffset if no input data */ 3408 req->InputOffset = 3409 cpu_to_le32(offsetof(struct smb2_ioctl_req, Buffer)); 3410 rqst->rq_nvec = 2; 3411 iov[0].iov_len = total_len - 1; 3412 iov[1].iov_base = in_data_buf; 3413 iov[1].iov_len = indatalen; 3414 } else { 3415 rqst->rq_nvec = 1; 3416 iov[0].iov_len = total_len; 3417 } 3418 3419 req->OutputOffset = 0; 3420 req->OutputCount = 0; /* MBZ */ 3421 3422 /* 3423 * In most cases max_response_size is set to 16K (CIFSMaxBufSize) 3424 * We Could increase default MaxOutputResponse, but that could require 3425 * more credits. Windows typically sets this smaller, but for some 3426 * ioctls it may be useful to allow server to send more. No point 3427 * limiting what the server can send as long as fits in one credit 3428 * We can not handle more than CIFS_MAX_BUF_SIZE yet but may want 3429 * to increase this limit up in the future. 3430 * Note that for snapshot queries that servers like Azure expect that 3431 * the first query be minimal size (and just used to get the number/size 3432 * of previous versions) so response size must be specified as EXACTLY 3433 * sizeof(struct snapshot_array) which is 16 when rounded up to multiple 3434 * of eight bytes. Currently that is the only case where we set max 3435 * response size smaller. 3436 */ 3437 req->MaxOutputResponse = cpu_to_le32(max_response_size); 3438 req->hdr.CreditCharge = 3439 cpu_to_le16(DIV_ROUND_UP(max(indatalen, max_response_size), 3440 SMB2_MAX_BUFFER_SIZE)); 3441 /* always an FSCTL (for now) */ 3442 req->Flags = cpu_to_le32(SMB2_0_IOCTL_IS_FSCTL); 3443 3444 /* validate negotiate request must be signed - see MS-SMB2 3.2.5.5 */ 3445 if (opcode == FSCTL_VALIDATE_NEGOTIATE_INFO) 3446 req->hdr.Flags |= SMB2_FLAGS_SIGNED; 3447 3448 return 0; 3449 } 3450 3451 void 3452 SMB2_ioctl_free(struct smb_rqst *rqst) 3453 { 3454 int i; 3455 3456 if (rqst && rqst->rq_iov) { 3457 cifs_small_buf_release(rqst->rq_iov[0].iov_base); /* request */ 3458 for (i = 1; i < rqst->rq_nvec; i++) 3459 if (rqst->rq_iov[i].iov_base != smb2_padding) 3460 kfree(rqst->rq_iov[i].iov_base); 3461 } 3462 } 3463 3464 3465 /* 3466 * SMB2 IOCTL is used for both IOCTLs and FSCTLs 3467 */ 3468 int 3469 SMB2_ioctl(const unsigned int xid, struct cifs_tcon *tcon, u64 persistent_fid, 3470 u64 volatile_fid, u32 opcode, char *in_data, u32 indatalen, 3471 u32 max_out_data_len, char **out_data, 3472 u32 *plen /* returned data len */) 3473 { 3474 struct smb_rqst rqst; 3475 struct smb2_ioctl_rsp *rsp = NULL; 3476 struct cifs_ses *ses; 3477 struct TCP_Server_Info *server; 3478 struct kvec iov[SMB2_IOCTL_IOV_SIZE]; 3479 struct kvec rsp_iov = {NULL, 0}; 3480 int resp_buftype = CIFS_NO_BUFFER; 3481 int rc = 0; 3482 int flags = 0; 3483 int retries = 0, cur_sleep = 0; 3484 3485 if (!tcon) 3486 return smb_EIO(smb_eio_trace_null_pointers); 3487 3488 ses = tcon->ses; 3489 if (!ses) 3490 return smb_EIO(smb_eio_trace_null_pointers); 3491 3492 replay_again: 3493 /* reinitialize for possible replay */ 3494 flags = 0; 3495 server = cifs_pick_channel(ses); 3496 3497 if (!server) 3498 return smb_EIO(smb_eio_trace_null_pointers); 3499 3500 cifs_dbg(FYI, "SMB2 IOCTL\n"); 3501 3502 if (out_data != NULL) 3503 *out_data = NULL; 3504 3505 /* zero out returned data len, in case of error */ 3506 if (plen) 3507 *plen = 0; 3508 3509 if (smb3_encryption_required(tcon)) 3510 flags |= CIFS_TRANSFORM_REQ; 3511 3512 memset(&rqst, 0, sizeof(struct smb_rqst)); 3513 memset(&iov, 0, sizeof(iov)); 3514 rqst.rq_iov = iov; 3515 rqst.rq_nvec = SMB2_IOCTL_IOV_SIZE; 3516 3517 rc = SMB2_ioctl_init(tcon, server, 3518 &rqst, persistent_fid, volatile_fid, opcode, 3519 in_data, indatalen, max_out_data_len); 3520 if (rc) 3521 goto ioctl_exit; 3522 3523 if (retries) { 3524 /* Back-off before retry */ 3525 if (cur_sleep) 3526 msleep(cur_sleep); 3527 smb2_set_replay(server, &rqst); 3528 } 3529 3530 rc = cifs_send_recv(xid, ses, server, 3531 &rqst, &resp_buftype, flags, 3532 &rsp_iov); 3533 rsp = (struct smb2_ioctl_rsp *)rsp_iov.iov_base; 3534 3535 if (rc != 0) 3536 trace_smb3_fsctl_err(xid, persistent_fid, tcon->tid, 3537 ses->Suid, 0, opcode, rc); 3538 3539 if ((rc != 0) && (rc != -EINVAL) && (rc != -E2BIG)) { 3540 cifs_stats_fail_inc(tcon, SMB2_IOCTL_HE); 3541 goto ioctl_exit; 3542 } else if (rc == -EINVAL) { 3543 if ((opcode != FSCTL_SRV_COPYCHUNK_WRITE) && 3544 (opcode != FSCTL_SRV_COPYCHUNK)) { 3545 cifs_stats_fail_inc(tcon, SMB2_IOCTL_HE); 3546 goto ioctl_exit; 3547 } 3548 } else if (rc == -E2BIG) { 3549 if (opcode != FSCTL_QUERY_ALLOCATED_RANGES) { 3550 cifs_stats_fail_inc(tcon, SMB2_IOCTL_HE); 3551 goto ioctl_exit; 3552 } 3553 } 3554 3555 /* check if caller wants to look at return data or just return rc */ 3556 if ((plen == NULL) || (out_data == NULL)) 3557 goto ioctl_exit; 3558 3559 /* 3560 * Although unlikely to be possible for rsp to be null and rc not set, 3561 * adding check below is slightly safer long term (and quiets Coverity 3562 * warning) 3563 */ 3564 if (rsp == NULL) { 3565 rc = smb_EIO(smb_eio_trace_ioctl_no_rsp); 3566 goto ioctl_exit; 3567 } 3568 3569 *plen = le32_to_cpu(rsp->OutputCount); 3570 3571 /* We check for obvious errors in the output buffer length and offset */ 3572 if (*plen == 0) 3573 goto ioctl_exit; /* server returned no data */ 3574 else if (*plen > rsp_iov.iov_len || *plen > 0xFF00) { 3575 cifs_tcon_dbg(VFS, "srv returned invalid ioctl length: %d\n", *plen); 3576 rc = smb_EIO2(smb_eio_trace_ioctl_data_len, *plen, rsp_iov.iov_len); 3577 *plen = 0; 3578 goto ioctl_exit; 3579 } 3580 3581 u32 outoff = le32_to_cpu(rsp->OutputOffset); 3582 3583 if (rsp_iov.iov_len - *plen < outoff) { 3584 cifs_tcon_dbg(VFS, "Malformed ioctl resp: len %d offset %d\n", 3585 *plen, outoff); 3586 rc = smb_EIO2(smb_eio_trace_ioctl_out_off, rsp_iov.iov_len - *plen, outoff); 3587 *plen = 0; 3588 goto ioctl_exit; 3589 } 3590 3591 *out_data = kmemdup((char *)rsp + le32_to_cpu(rsp->OutputOffset), 3592 *plen, GFP_KERNEL); 3593 if (*out_data == NULL) { 3594 rc = -ENOMEM; 3595 goto ioctl_exit; 3596 } 3597 3598 ioctl_exit: 3599 SMB2_ioctl_free(&rqst); 3600 free_rsp_buf(resp_buftype, rsp); 3601 3602 if (is_replayable_error(rc) && 3603 smb2_should_replay(tcon, &retries, &cur_sleep)) 3604 goto replay_again; 3605 3606 return rc; 3607 } 3608 3609 /* 3610 * Individual callers to ioctl worker function follow 3611 */ 3612 3613 int 3614 SMB2_set_compression(const unsigned int xid, struct cifs_tcon *tcon, 3615 u64 persistent_fid, u64 volatile_fid) 3616 { 3617 int rc; 3618 struct compress_ioctl fsctl_input; 3619 char *ret_data = NULL; 3620 3621 fsctl_input.CompressionState = 3622 cpu_to_le16(COMPRESSION_FORMAT_DEFAULT); 3623 3624 rc = SMB2_ioctl(xid, tcon, persistent_fid, volatile_fid, 3625 FSCTL_SET_COMPRESSION, 3626 (char *)&fsctl_input /* data input */, 3627 2 /* in data len */, CIFSMaxBufSize /* max out data */, 3628 &ret_data /* out data */, NULL); 3629 3630 cifs_dbg(FYI, "set compression rc %d\n", rc); 3631 3632 return rc; 3633 } 3634 3635 int 3636 SMB2_close_init(struct cifs_tcon *tcon, struct TCP_Server_Info *server, 3637 struct smb_rqst *rqst, 3638 u64 persistent_fid, u64 volatile_fid, bool query_attrs) 3639 { 3640 struct smb2_close_req *req; 3641 struct kvec *iov = rqst->rq_iov; 3642 unsigned int total_len; 3643 int rc; 3644 3645 rc = smb2_plain_req_init(SMB2_CLOSE, tcon, server, 3646 (void **) &req, &total_len); 3647 if (rc) 3648 return rc; 3649 3650 req->PersistentFileId = persistent_fid; 3651 req->VolatileFileId = volatile_fid; 3652 if (query_attrs) 3653 req->Flags = SMB2_CLOSE_FLAG_POSTQUERY_ATTRIB; 3654 else 3655 req->Flags = 0; 3656 iov[0].iov_base = (char *)req; 3657 iov[0].iov_len = total_len; 3658 3659 return 0; 3660 } 3661 3662 void 3663 SMB2_close_free(struct smb_rqst *rqst) 3664 { 3665 if (rqst && rqst->rq_iov) 3666 cifs_small_buf_release(rqst->rq_iov[0].iov_base); /* request */ 3667 } 3668 3669 int 3670 __SMB2_close(const unsigned int xid, struct cifs_tcon *tcon, 3671 u64 persistent_fid, u64 volatile_fid, 3672 struct smb2_file_network_open_info *pbuf) 3673 { 3674 struct smb_rqst rqst; 3675 struct smb2_close_rsp *rsp = NULL; 3676 struct cifs_ses *ses = tcon->ses; 3677 struct TCP_Server_Info *server; 3678 struct kvec iov[1]; 3679 struct kvec rsp_iov; 3680 int resp_buftype = CIFS_NO_BUFFER; 3681 int rc = 0; 3682 int flags = 0; 3683 bool query_attrs = false; 3684 int retries = 0, cur_sleep = 0; 3685 3686 replay_again: 3687 /* reinitialize for possible replay */ 3688 flags = 0; 3689 query_attrs = false; 3690 server = cifs_pick_channel(ses); 3691 3692 cifs_dbg(FYI, "Close\n"); 3693 3694 if (!ses || !server) 3695 return smb_EIO(smb_eio_trace_null_pointers); 3696 3697 if (smb3_encryption_required(tcon)) 3698 flags |= CIFS_TRANSFORM_REQ; 3699 3700 memset(&rqst, 0, sizeof(struct smb_rqst)); 3701 memset(&iov, 0, sizeof(iov)); 3702 rqst.rq_iov = iov; 3703 rqst.rq_nvec = 1; 3704 3705 /* check if need to ask server to return timestamps in close response */ 3706 if (pbuf) 3707 query_attrs = true; 3708 3709 trace_smb3_close_enter(xid, persistent_fid, tcon->tid, ses->Suid); 3710 rc = SMB2_close_init(tcon, server, 3711 &rqst, persistent_fid, volatile_fid, 3712 query_attrs); 3713 if (rc) 3714 goto close_exit; 3715 3716 if (retries) { 3717 /* Back-off before retry */ 3718 if (cur_sleep) 3719 msleep(cur_sleep); 3720 smb2_set_replay(server, &rqst); 3721 } 3722 3723 rc = cifs_send_recv(xid, ses, server, 3724 &rqst, &resp_buftype, flags, &rsp_iov); 3725 rsp = (struct smb2_close_rsp *)rsp_iov.iov_base; 3726 3727 if (rc != 0) { 3728 cifs_stats_fail_inc(tcon, SMB2_CLOSE_HE); 3729 trace_smb3_close_err(xid, persistent_fid, tcon->tid, ses->Suid, 3730 rc); 3731 goto close_exit; 3732 } else { 3733 trace_smb3_close_done(xid, persistent_fid, tcon->tid, 3734 ses->Suid); 3735 if (pbuf) 3736 memcpy(&pbuf->network_open_info, 3737 &rsp->network_open_info, 3738 sizeof(pbuf->network_open_info)); 3739 atomic_dec(&tcon->num_remote_opens); 3740 } 3741 3742 close_exit: 3743 SMB2_close_free(&rqst); 3744 free_rsp_buf(resp_buftype, rsp); 3745 3746 /* retry close in a worker thread if this one is interrupted */ 3747 if (is_interrupt_error(rc)) { 3748 int tmp_rc; 3749 3750 tmp_rc = smb2_handle_cancelled_close(tcon, persistent_fid, 3751 volatile_fid); 3752 if (tmp_rc) 3753 cifs_dbg(VFS, "handle cancelled close fid 0x%llx returned error %d\n", 3754 persistent_fid, tmp_rc); 3755 } 3756 3757 if (is_replayable_error(rc) && 3758 smb2_should_replay(tcon, &retries, &cur_sleep)) 3759 goto replay_again; 3760 3761 return rc; 3762 } 3763 3764 int 3765 SMB2_close(const unsigned int xid, struct cifs_tcon *tcon, 3766 u64 persistent_fid, u64 volatile_fid) 3767 { 3768 return __SMB2_close(xid, tcon, persistent_fid, volatile_fid, NULL); 3769 } 3770 3771 int 3772 smb2_validate_iov(unsigned int offset, unsigned int buffer_length, 3773 struct kvec *iov, unsigned int min_buf_size) 3774 { 3775 unsigned int smb_len = iov->iov_len; 3776 char *end_of_smb = smb_len + (char *)iov->iov_base; 3777 char *begin_of_buf = offset + (char *)iov->iov_base; 3778 char *end_of_buf = begin_of_buf + buffer_length; 3779 3780 3781 if (buffer_length < min_buf_size) { 3782 cifs_dbg(VFS, "buffer length %d smaller than minimum size %d\n", 3783 buffer_length, min_buf_size); 3784 return -EINVAL; 3785 } 3786 3787 /* check if beyond RFC1001 maximum length */ 3788 if ((smb_len > 0x7FFFFF) || (buffer_length > 0x7FFFFF)) { 3789 cifs_dbg(VFS, "buffer length %d or smb length %d too large\n", 3790 buffer_length, smb_len); 3791 return -EINVAL; 3792 } 3793 3794 if ((begin_of_buf > end_of_smb) || (end_of_buf > end_of_smb)) { 3795 cifs_dbg(VFS, "Invalid server response, bad offset to data\n"); 3796 return -EINVAL; 3797 } 3798 3799 return 0; 3800 } 3801 3802 /* 3803 * If SMB buffer fields are valid, copy into temporary buffer to hold result. 3804 * Caller must free buffer. 3805 */ 3806 int 3807 smb2_validate_and_copy_iov(unsigned int offset, unsigned int buffer_length, 3808 struct kvec *iov, unsigned int minbufsize, 3809 char *data) 3810 { 3811 char *begin_of_buf = offset + (char *)iov->iov_base; 3812 int rc; 3813 3814 if (!data) 3815 return -EINVAL; 3816 3817 rc = smb2_validate_iov(offset, buffer_length, iov, minbufsize); 3818 if (rc) 3819 return rc; 3820 3821 memcpy(data, begin_of_buf, minbufsize); 3822 3823 return 0; 3824 } 3825 3826 int 3827 SMB2_query_info_init(struct cifs_tcon *tcon, struct TCP_Server_Info *server, 3828 struct smb_rqst *rqst, 3829 u64 persistent_fid, u64 volatile_fid, 3830 u8 info_class, u8 info_type, u32 additional_info, 3831 size_t output_len, size_t input_len, void *input) 3832 { 3833 struct smb2_query_info_req *req; 3834 struct kvec *iov = rqst->rq_iov; 3835 unsigned int total_len; 3836 size_t len; 3837 int rc; 3838 3839 if (unlikely(check_add_overflow(input_len, sizeof(*req), &len) || 3840 len > CIFSMaxBufSize)) 3841 return -EINVAL; 3842 3843 rc = smb2_plain_req_init(SMB2_QUERY_INFO, tcon, server, 3844 (void **) &req, &total_len); 3845 if (rc) 3846 return rc; 3847 3848 req->InfoType = info_type; 3849 req->FileInfoClass = info_class; 3850 req->PersistentFileId = persistent_fid; 3851 req->VolatileFileId = volatile_fid; 3852 req->AdditionalInformation = cpu_to_le32(additional_info); 3853 3854 req->OutputBufferLength = cpu_to_le32(output_len); 3855 if (input_len) { 3856 req->InputBufferLength = cpu_to_le32(input_len); 3857 /* total_len for smb query request never close to le16 max */ 3858 req->InputBufferOffset = cpu_to_le16(total_len - 1); 3859 memcpy(req->Buffer, input, input_len); 3860 } 3861 3862 iov[0].iov_base = (char *)req; 3863 /* 1 for Buffer */ 3864 iov[0].iov_len = len; 3865 return 0; 3866 } 3867 3868 void 3869 SMB2_query_info_free(struct smb_rqst *rqst) 3870 { 3871 if (rqst && rqst->rq_iov) 3872 cifs_buf_release(rqst->rq_iov[0].iov_base); /* request */ 3873 } 3874 3875 static int 3876 query_info(const unsigned int xid, struct cifs_tcon *tcon, 3877 u64 persistent_fid, u64 volatile_fid, u8 info_class, u8 info_type, 3878 u32 additional_info, size_t output_len, size_t min_len, void **data, 3879 u32 *dlen) 3880 { 3881 struct smb_rqst rqst; 3882 struct smb2_query_info_rsp *rsp = NULL; 3883 struct kvec iov[1]; 3884 struct kvec rsp_iov; 3885 int rc = 0; 3886 int resp_buftype = CIFS_NO_BUFFER; 3887 struct cifs_ses *ses = tcon->ses; 3888 struct TCP_Server_Info *server; 3889 int flags = 0; 3890 bool allocated = false; 3891 int retries = 0, cur_sleep = 0; 3892 3893 cifs_dbg(FYI, "Query Info\n"); 3894 3895 if (!ses) 3896 return smb_EIO(smb_eio_trace_null_pointers); 3897 3898 replay_again: 3899 /* reinitialize for possible replay */ 3900 flags = 0; 3901 allocated = false; 3902 server = cifs_pick_channel(ses); 3903 3904 if (!server) 3905 return smb_EIO(smb_eio_trace_null_pointers); 3906 3907 if (smb3_encryption_required(tcon)) 3908 flags |= CIFS_TRANSFORM_REQ; 3909 3910 memset(&rqst, 0, sizeof(struct smb_rqst)); 3911 memset(&iov, 0, sizeof(iov)); 3912 rqst.rq_iov = iov; 3913 rqst.rq_nvec = 1; 3914 3915 rc = SMB2_query_info_init(tcon, server, 3916 &rqst, persistent_fid, volatile_fid, 3917 info_class, info_type, additional_info, 3918 output_len, 0, NULL); 3919 if (rc) 3920 goto qinf_exit; 3921 3922 trace_smb3_query_info_enter(xid, persistent_fid, tcon->tid, 3923 ses->Suid, info_class, (__u32)info_type); 3924 3925 if (retries) { 3926 /* Back-off before retry */ 3927 if (cur_sleep) 3928 msleep(cur_sleep); 3929 smb2_set_replay(server, &rqst); 3930 } 3931 3932 rc = cifs_send_recv(xid, ses, server, 3933 &rqst, &resp_buftype, flags, &rsp_iov); 3934 rsp = (struct smb2_query_info_rsp *)rsp_iov.iov_base; 3935 3936 if (rc) { 3937 cifs_stats_fail_inc(tcon, SMB2_QUERY_INFO_HE); 3938 trace_smb3_query_info_err(xid, persistent_fid, tcon->tid, 3939 ses->Suid, info_class, (__u32)info_type, rc); 3940 goto qinf_exit; 3941 } 3942 3943 trace_smb3_query_info_done(xid, persistent_fid, tcon->tid, 3944 ses->Suid, info_class, (__u32)info_type); 3945 3946 if (dlen) { 3947 *dlen = le32_to_cpu(rsp->OutputBufferLength); 3948 if (!*data) { 3949 *data = kmalloc(*dlen, GFP_KERNEL); 3950 if (!*data) { 3951 cifs_tcon_dbg(VFS, 3952 "Error %d allocating memory for acl\n", 3953 rc); 3954 *dlen = 0; 3955 rc = -ENOMEM; 3956 goto qinf_exit; 3957 } 3958 allocated = true; 3959 } 3960 } 3961 3962 rc = smb2_validate_and_copy_iov(le16_to_cpu(rsp->OutputBufferOffset), 3963 le32_to_cpu(rsp->OutputBufferLength), 3964 &rsp_iov, dlen ? *dlen : min_len, *data); 3965 if (rc && allocated) { 3966 kfree(*data); 3967 *data = NULL; 3968 *dlen = 0; 3969 } 3970 3971 qinf_exit: 3972 SMB2_query_info_free(&rqst); 3973 free_rsp_buf(resp_buftype, rsp); 3974 3975 if (is_replayable_error(rc) && 3976 smb2_should_replay(tcon, &retries, &cur_sleep)) 3977 goto replay_again; 3978 3979 return rc; 3980 } 3981 3982 int SMB2_query_info(const unsigned int xid, struct cifs_tcon *tcon, 3983 u64 persistent_fid, u64 volatile_fid, struct smb2_file_all_info *data) 3984 { 3985 return query_info(xid, tcon, persistent_fid, volatile_fid, 3986 FILE_ALL_INFORMATION, SMB2_O_INFO_FILE, 0, 3987 sizeof(struct smb2_file_all_info) + PATH_MAX * 2, 3988 sizeof(struct smb2_file_all_info), (void **)&data, 3989 NULL); 3990 } 3991 3992 #if 0 3993 /* currently unused, as now we are doing compounding instead (see smb311_posix_query_path_info) */ 3994 int 3995 SMB311_posix_query_info(const unsigned int xid, struct cifs_tcon *tcon, 3996 u64 persistent_fid, u64 volatile_fid, 3997 struct smb311_posix_qinfo *data, u32 *plen) 3998 { 3999 size_t output_len = sizeof(struct smb311_posix_qinfo *) + 4000 (sizeof(struct smb_sid) * 2) + (PATH_MAX * 2); 4001 *plen = 0; 4002 4003 return query_info(xid, tcon, persistent_fid, volatile_fid, 4004 SMB_FIND_FILE_POSIX_INFO, SMB2_O_INFO_FILE, 0, 4005 output_len, sizeof(struct smb311_posix_qinfo), (void **)&data, plen); 4006 /* Note caller must free "data" (passed in above). It may be allocated in query_info call */ 4007 } 4008 #endif 4009 4010 int 4011 SMB2_query_acl(const unsigned int xid, struct cifs_tcon *tcon, 4012 u64 persistent_fid, u64 volatile_fid, 4013 void **data, u32 *plen, u32 extra_info) 4014 { 4015 *plen = 0; 4016 4017 return query_info(xid, tcon, persistent_fid, volatile_fid, 4018 0, SMB2_O_INFO_SECURITY, extra_info, 4019 SMB2_MAX_BUFFER_SIZE, MIN_SEC_DESC_LEN, data, plen); 4020 } 4021 4022 int 4023 SMB2_get_srv_num(const unsigned int xid, struct cifs_tcon *tcon, 4024 u64 persistent_fid, u64 volatile_fid, __le64 *uniqueid) 4025 { 4026 return query_info(xid, tcon, persistent_fid, volatile_fid, 4027 FILE_INTERNAL_INFORMATION, SMB2_O_INFO_FILE, 0, 4028 sizeof(struct smb2_file_internal_info), 4029 sizeof(struct smb2_file_internal_info), 4030 (void **)&uniqueid, NULL); 4031 } 4032 4033 /* 4034 * CHANGE_NOTIFY Request is sent to get notifications on changes to a directory 4035 * See MS-SMB2 2.2.35 and 2.2.36 4036 */ 4037 4038 static int 4039 SMB2_notify_init(const unsigned int xid, struct smb_rqst *rqst, 4040 struct cifs_tcon *tcon, struct TCP_Server_Info *server, 4041 u64 persistent_fid, u64 volatile_fid, 4042 u32 completion_filter, bool watch_tree) 4043 { 4044 struct smb2_change_notify_req *req; 4045 struct kvec *iov = rqst->rq_iov; 4046 unsigned int total_len; 4047 int rc; 4048 4049 rc = smb2_plain_req_init(SMB2_CHANGE_NOTIFY, tcon, server, 4050 (void **) &req, &total_len); 4051 if (rc) 4052 return rc; 4053 4054 req->PersistentFileId = persistent_fid; 4055 req->VolatileFileId = volatile_fid; 4056 /* See note 354 of MS-SMB2, 64K max */ 4057 req->OutputBufferLength = 4058 cpu_to_le32(SMB2_MAX_BUFFER_SIZE - MAX_SMB2_HDR_SIZE); 4059 req->CompletionFilter = cpu_to_le32(completion_filter); 4060 if (watch_tree) 4061 req->Flags = cpu_to_le16(SMB2_WATCH_TREE); 4062 else 4063 req->Flags = 0; 4064 4065 iov[0].iov_base = (char *)req; 4066 iov[0].iov_len = total_len; 4067 4068 return 0; 4069 } 4070 4071 int 4072 SMB2_change_notify(const unsigned int xid, struct cifs_tcon *tcon, 4073 u64 persistent_fid, u64 volatile_fid, bool watch_tree, 4074 u32 completion_filter, u32 max_out_data_len, char **out_data, 4075 u32 *plen /* returned data len */) 4076 { 4077 struct cifs_ses *ses = tcon->ses; 4078 struct TCP_Server_Info *server; 4079 struct smb_rqst rqst; 4080 struct smb2_change_notify_rsp *smb_rsp; 4081 struct kvec iov[1]; 4082 struct kvec rsp_iov = {NULL, 0}; 4083 int resp_buftype = CIFS_NO_BUFFER; 4084 int flags = 0; 4085 int rc = 0; 4086 int retries = 0, cur_sleep = 0; 4087 4088 replay_again: 4089 /* reinitialize for possible replay */ 4090 flags = 0; 4091 server = cifs_pick_channel(ses); 4092 4093 cifs_dbg(FYI, "change notify\n"); 4094 if (!ses || !server) 4095 return smb_EIO(smb_eio_trace_null_pointers); 4096 4097 if (smb3_encryption_required(tcon)) 4098 flags |= CIFS_TRANSFORM_REQ; 4099 4100 memset(&rqst, 0, sizeof(struct smb_rqst)); 4101 memset(&iov, 0, sizeof(iov)); 4102 if (plen) 4103 *plen = 0; 4104 4105 rqst.rq_iov = iov; 4106 rqst.rq_nvec = 1; 4107 4108 rc = SMB2_notify_init(xid, &rqst, tcon, server, 4109 persistent_fid, volatile_fid, 4110 completion_filter, watch_tree); 4111 if (rc) 4112 goto cnotify_exit; 4113 4114 trace_smb3_notify_enter(xid, persistent_fid, tcon->tid, ses->Suid, 4115 (u8)watch_tree, completion_filter); 4116 4117 if (retries) { 4118 /* Back-off before retry */ 4119 if (cur_sleep) 4120 msleep(cur_sleep); 4121 smb2_set_replay(server, &rqst); 4122 } 4123 4124 rc = cifs_send_recv(xid, ses, server, 4125 &rqst, &resp_buftype, flags, &rsp_iov); 4126 4127 if (rc != 0) { 4128 cifs_stats_fail_inc(tcon, SMB2_CHANGE_NOTIFY_HE); 4129 trace_smb3_notify_err(xid, persistent_fid, tcon->tid, ses->Suid, 4130 (u8)watch_tree, completion_filter, rc); 4131 } else { 4132 trace_smb3_notify_done(xid, persistent_fid, tcon->tid, 4133 ses->Suid, (u8)watch_tree, completion_filter); 4134 /* validate that notify information is plausible */ 4135 if ((rsp_iov.iov_base == NULL) || 4136 (rsp_iov.iov_len < sizeof(struct smb2_change_notify_rsp) + 1)) 4137 goto cnotify_exit; 4138 4139 smb_rsp = (struct smb2_change_notify_rsp *)rsp_iov.iov_base; 4140 4141 rc = smb2_validate_iov(le16_to_cpu(smb_rsp->OutputBufferOffset), 4142 le32_to_cpu(smb_rsp->OutputBufferLength), 4143 &rsp_iov, 4144 sizeof(struct file_notify_information)); 4145 if (rc) 4146 goto cnotify_exit; 4147 4148 *out_data = kmemdup((char *)smb_rsp + le16_to_cpu(smb_rsp->OutputBufferOffset), 4149 le32_to_cpu(smb_rsp->OutputBufferLength), GFP_KERNEL); 4150 if (*out_data == NULL) { 4151 rc = -ENOMEM; 4152 goto cnotify_exit; 4153 } else if (plen) 4154 *plen = le32_to_cpu(smb_rsp->OutputBufferLength); 4155 } 4156 4157 cnotify_exit: 4158 if (rqst.rq_iov) 4159 cifs_small_buf_release(rqst.rq_iov[0].iov_base); /* request */ 4160 free_rsp_buf(resp_buftype, rsp_iov.iov_base); 4161 4162 if (is_replayable_error(rc) && 4163 smb2_should_replay(tcon, &retries, &cur_sleep)) 4164 goto replay_again; 4165 4166 return rc; 4167 } 4168 4169 4170 4171 /* 4172 * This is a no-op for now. We're not really interested in the reply, but 4173 * rather in the fact that the server sent one and that server->lstrp 4174 * gets updated. 4175 * 4176 * FIXME: maybe we should consider checking that the reply matches request? 4177 */ 4178 static void 4179 smb2_echo_callback(struct TCP_Server_Info *server, struct mid_q_entry *mid) 4180 { 4181 struct smb2_echo_rsp *rsp = (struct smb2_echo_rsp *)mid->resp_buf; 4182 struct cifs_credits credits = { .value = 0, .instance = 0 }; 4183 4184 if (mid->mid_state == MID_RESPONSE_RECEIVED 4185 || mid->mid_state == MID_RESPONSE_MALFORMED) { 4186 credits.value = le16_to_cpu(rsp->hdr.CreditRequest); 4187 credits.instance = server->reconnect_instance; 4188 } 4189 4190 release_mid(server, mid); 4191 add_credits(server, &credits, CIFS_ECHO_OP); 4192 } 4193 4194 static void cifs_renegotiate_iosize(struct TCP_Server_Info *server, 4195 struct cifs_tcon *tcon) 4196 { 4197 struct cifs_sb_info *cifs_sb; 4198 4199 if (server == NULL || tcon == NULL) 4200 return; 4201 4202 spin_lock(&tcon->sb_list_lock); 4203 list_for_each_entry(cifs_sb, &tcon->cifs_sb_list, tcon_sb_link) 4204 cifs_negotiate_iosize(server, cifs_sb->ctx, tcon); 4205 spin_unlock(&tcon->sb_list_lock); 4206 } 4207 4208 void smb2_reconnect_server(struct work_struct *work) 4209 { 4210 struct TCP_Server_Info *server = container_of(work, 4211 struct TCP_Server_Info, reconnect.work); 4212 struct TCP_Server_Info *pserver; 4213 struct cifs_ses *ses, *ses2; 4214 struct cifs_tcon *tcon, *tcon2; 4215 struct list_head tmp_list, tmp_ses_list; 4216 bool ses_exist = false; 4217 bool tcon_selected = false; 4218 int rc; 4219 bool resched = false; 4220 4221 /* first check if ref count has reached 0, if not inc ref count */ 4222 spin_lock(&cifs_tcp_ses_lock); 4223 if (!server->srv_count) { 4224 spin_unlock(&cifs_tcp_ses_lock); 4225 return; 4226 } 4227 server->srv_count++; 4228 spin_unlock(&cifs_tcp_ses_lock); 4229 4230 /* If server is a channel, select the primary channel */ 4231 pserver = SERVER_IS_CHAN(server) ? server->primary_server : server; 4232 4233 /* Prevent simultaneous reconnects that can corrupt tcon->rlist list */ 4234 mutex_lock(&pserver->reconnect_mutex); 4235 4236 /* if the server is marked for termination, drop the ref count here */ 4237 if (server->terminate) { 4238 cifs_put_tcp_session(server, true); 4239 mutex_unlock(&pserver->reconnect_mutex); 4240 return; 4241 } 4242 4243 INIT_LIST_HEAD(&tmp_list); 4244 INIT_LIST_HEAD(&tmp_ses_list); 4245 cifs_dbg(FYI, "Reconnecting tcons and channels\n"); 4246 4247 spin_lock(&cifs_tcp_ses_lock); 4248 list_for_each_entry(ses, &pserver->smb_ses_list, smb_ses_list) { 4249 spin_lock(&ses->ses_lock); 4250 if (ses->ses_status == SES_EXITING) { 4251 spin_unlock(&ses->ses_lock); 4252 continue; 4253 } 4254 spin_unlock(&ses->ses_lock); 4255 4256 tcon_selected = false; 4257 4258 list_for_each_entry(tcon, &ses->tcon_list, tcon_list) { 4259 if (tcon->need_reconnect || tcon->need_reopen_files) { 4260 spin_lock(&tcon->tc_lock); 4261 tcon->tc_count++; 4262 spin_unlock(&tcon->tc_lock); 4263 trace_smb3_tcon_ref(tcon->debug_id, tcon->tc_count, 4264 netfs_trace_tcon_ref_get_reconnect_server); 4265 list_add_tail(&tcon->rlist, &tmp_list); 4266 tcon_selected = true; 4267 } 4268 } 4269 /* 4270 * IPC has the same lifetime as its session and uses its 4271 * refcount. 4272 */ 4273 if (ses->tcon_ipc && ses->tcon_ipc->need_reconnect) { 4274 list_add_tail(&ses->tcon_ipc->rlist, &tmp_list); 4275 tcon_selected = true; 4276 cifs_smb_ses_inc_refcount(ses); 4277 } 4278 /* 4279 * handle the case where channel needs to reconnect 4280 * binding session, but tcon is healthy (some other channel 4281 * is active) 4282 */ 4283 spin_lock(&ses->chan_lock); 4284 if (!tcon_selected && cifs_chan_needs_reconnect(ses, server)) { 4285 list_add_tail(&ses->rlist, &tmp_ses_list); 4286 ses_exist = true; 4287 cifs_smb_ses_inc_refcount(ses); 4288 } 4289 spin_unlock(&ses->chan_lock); 4290 } 4291 spin_unlock(&cifs_tcp_ses_lock); 4292 4293 list_for_each_entry_safe(tcon, tcon2, &tmp_list, rlist) { 4294 rc = smb2_reconnect(SMB2_INTERNAL_CMD, tcon, server, true); 4295 if (!rc) { 4296 cifs_renegotiate_iosize(server, tcon); 4297 cifs_reopen_persistent_handles(tcon); 4298 } else 4299 resched = true; 4300 list_del_init(&tcon->rlist); 4301 if (tcon->ipc) 4302 cifs_put_smb_ses(tcon->ses); 4303 else 4304 cifs_put_tcon(tcon, netfs_trace_tcon_ref_put_reconnect_server); 4305 } 4306 4307 if (!ses_exist) 4308 goto done; 4309 4310 /* allocate a dummy tcon struct used for reconnect */ 4311 tcon = tcon_info_alloc(false, netfs_trace_tcon_ref_new_reconnect_server); 4312 if (!tcon) { 4313 resched = true; 4314 list_for_each_entry_safe(ses, ses2, &tmp_ses_list, rlist) { 4315 list_del_init(&ses->rlist); 4316 cifs_put_smb_ses(ses); 4317 } 4318 goto done; 4319 } 4320 tcon->status = TID_GOOD; 4321 tcon->dummy = true; 4322 4323 /* now reconnect sessions for necessary channels */ 4324 list_for_each_entry_safe(ses, ses2, &tmp_ses_list, rlist) { 4325 tcon->ses = ses; 4326 rc = smb2_reconnect(SMB2_INTERNAL_CMD, tcon, server, true); 4327 if (rc) 4328 resched = true; 4329 list_del_init(&ses->rlist); 4330 cifs_put_smb_ses(ses); 4331 } 4332 tconInfoFree(tcon, netfs_trace_tcon_ref_free_reconnect_server); 4333 4334 done: 4335 cifs_dbg(FYI, "Reconnecting tcons and channels finished\n"); 4336 if (resched) 4337 cifs_requeue_server_reconn(server); 4338 mutex_unlock(&pserver->reconnect_mutex); 4339 4340 /* now we can safely release srv struct */ 4341 cifs_put_tcp_session(server, true); 4342 } 4343 4344 int 4345 SMB2_echo(struct TCP_Server_Info *server) 4346 { 4347 struct smb2_echo_req *req; 4348 int rc = 0; 4349 struct kvec iov[1]; 4350 struct smb_rqst rqst = { .rq_iov = iov, 4351 .rq_nvec = 1 }; 4352 unsigned int total_len; 4353 4354 cifs_dbg(FYI, "In echo request for conn_id %lld\n", server->conn_id); 4355 4356 spin_lock(&server->srv_lock); 4357 if (server->ops->need_neg && 4358 server->ops->need_neg(server)) { 4359 spin_unlock(&server->srv_lock); 4360 /* No need to send echo on newly established connections */ 4361 cifs_queue_server_reconn(server); 4362 return rc; 4363 } 4364 spin_unlock(&server->srv_lock); 4365 4366 rc = smb2_plain_req_init(SMB2_ECHO, NULL, server, 4367 (void **)&req, &total_len); 4368 if (rc) 4369 return rc; 4370 4371 req->hdr.CreditRequest = cpu_to_le16(1); 4372 4373 iov[0].iov_len = total_len; 4374 iov[0].iov_base = (char *)req; 4375 4376 rc = cifs_call_async(server, &rqst, NULL, smb2_echo_callback, NULL, 4377 server, CIFS_ECHO_OP, NULL); 4378 if (rc) 4379 cifs_dbg(FYI, "Echo request failed: %d\n", rc); 4380 4381 cifs_small_buf_release(req); 4382 return rc; 4383 } 4384 4385 void 4386 SMB2_flush_free(struct smb_rqst *rqst) 4387 { 4388 if (rqst && rqst->rq_iov) 4389 cifs_small_buf_release(rqst->rq_iov[0].iov_base); /* request */ 4390 } 4391 4392 int 4393 SMB2_flush_init(const unsigned int xid, struct smb_rqst *rqst, 4394 struct cifs_tcon *tcon, struct TCP_Server_Info *server, 4395 u64 persistent_fid, u64 volatile_fid) 4396 { 4397 struct smb2_flush_req *req; 4398 struct kvec *iov = rqst->rq_iov; 4399 unsigned int total_len; 4400 int rc; 4401 4402 rc = smb2_plain_req_init(SMB2_FLUSH, tcon, server, 4403 (void **) &req, &total_len); 4404 if (rc) 4405 return rc; 4406 4407 req->PersistentFileId = persistent_fid; 4408 req->VolatileFileId = volatile_fid; 4409 4410 iov[0].iov_base = (char *)req; 4411 iov[0].iov_len = total_len; 4412 4413 return 0; 4414 } 4415 4416 int 4417 SMB2_flush(const unsigned int xid, struct cifs_tcon *tcon, u64 persistent_fid, 4418 u64 volatile_fid) 4419 { 4420 struct cifs_ses *ses = tcon->ses; 4421 struct smb_rqst rqst; 4422 struct kvec iov[1]; 4423 struct kvec rsp_iov = {NULL, 0}; 4424 struct TCP_Server_Info *server; 4425 int resp_buftype = CIFS_NO_BUFFER; 4426 int flags = 0; 4427 int rc = 0; 4428 int retries = 0, cur_sleep = 0; 4429 4430 replay_again: 4431 /* reinitialize for possible replay */ 4432 flags = 0; 4433 server = cifs_pick_channel(ses); 4434 4435 cifs_dbg(FYI, "flush\n"); 4436 if (!ses || !(ses->server)) 4437 return smb_EIO(smb_eio_trace_null_pointers); 4438 4439 if (smb3_encryption_required(tcon)) 4440 flags |= CIFS_TRANSFORM_REQ; 4441 4442 memset(&rqst, 0, sizeof(struct smb_rqst)); 4443 memset(&iov, 0, sizeof(iov)); 4444 rqst.rq_iov = iov; 4445 rqst.rq_nvec = 1; 4446 4447 rc = SMB2_flush_init(xid, &rqst, tcon, server, 4448 persistent_fid, volatile_fid); 4449 if (rc) 4450 goto flush_exit; 4451 4452 trace_smb3_flush_enter(xid, persistent_fid, tcon->tid, ses->Suid); 4453 4454 if (retries) { 4455 /* Back-off before retry */ 4456 if (cur_sleep) 4457 msleep(cur_sleep); 4458 smb2_set_replay(server, &rqst); 4459 } 4460 4461 rc = cifs_send_recv(xid, ses, server, 4462 &rqst, &resp_buftype, flags, &rsp_iov); 4463 4464 if (rc != 0) { 4465 cifs_stats_fail_inc(tcon, SMB2_FLUSH_HE); 4466 trace_smb3_flush_err(xid, persistent_fid, tcon->tid, ses->Suid, 4467 rc); 4468 } else 4469 trace_smb3_flush_done(xid, persistent_fid, tcon->tid, 4470 ses->Suid); 4471 4472 flush_exit: 4473 SMB2_flush_free(&rqst); 4474 free_rsp_buf(resp_buftype, rsp_iov.iov_base); 4475 4476 if (is_replayable_error(rc) && 4477 smb2_should_replay(tcon, &retries, &cur_sleep)) 4478 goto replay_again; 4479 4480 return rc; 4481 } 4482 4483 #ifdef CONFIG_CIFS_SMB_DIRECT 4484 static inline bool smb3_use_rdma_offload(struct cifs_io_parms *io_parms) 4485 { 4486 struct TCP_Server_Info *server = io_parms->server; 4487 struct cifs_tcon *tcon = io_parms->tcon; 4488 4489 /* we can only offload if we're connected */ 4490 if (!server || !tcon) 4491 return false; 4492 4493 /* we can only offload on an rdma connection */ 4494 if (!server->rdma || !server->smbd_conn) 4495 return false; 4496 4497 /* we don't support signed offload yet */ 4498 if (server->sign) 4499 return false; 4500 4501 /* we don't support encrypted offload yet */ 4502 if (smb3_encryption_required(tcon)) 4503 return false; 4504 4505 /* offload also has its overhead, so only do it if desired */ 4506 if (io_parms->length < server->rdma_readwrite_threshold) 4507 return false; 4508 4509 return true; 4510 } 4511 #endif /* CONFIG_CIFS_SMB_DIRECT */ 4512 4513 /* 4514 * To form a chain of read requests, any read requests after the first should 4515 * have the end_of_chain boolean set to true. 4516 */ 4517 static int 4518 smb2_new_read_req(void **buf, unsigned int *total_len, 4519 struct cifs_io_parms *io_parms, struct cifs_io_subrequest *rdata, 4520 unsigned int remaining_bytes, int request_type) 4521 { 4522 int rc = -EACCES; 4523 struct smb2_read_req *req = NULL; 4524 struct smb2_hdr *shdr; 4525 struct TCP_Server_Info *server = io_parms->server; 4526 4527 rc = smb2_plain_req_init(SMB2_READ, io_parms->tcon, server, 4528 (void **) &req, total_len); 4529 if (rc) 4530 return rc; 4531 4532 if (server == NULL) 4533 return -ECONNABORTED; 4534 4535 shdr = &req->hdr; 4536 shdr->Id.SyncId.ProcessId = cpu_to_le32(io_parms->pid); 4537 4538 req->PersistentFileId = io_parms->persistent_fid; 4539 req->VolatileFileId = io_parms->volatile_fid; 4540 req->ReadChannelInfoOffset = 0; /* reserved */ 4541 req->ReadChannelInfoLength = 0; /* reserved */ 4542 req->Channel = 0; /* reserved */ 4543 req->MinimumCount = 0; 4544 req->Length = cpu_to_le32(io_parms->length); 4545 req->Offset = cpu_to_le64(io_parms->offset); 4546 4547 trace_smb3_read_enter(rdata ? rdata->rreq->debug_id : 0, 4548 rdata ? rdata->subreq.debug_index : 0, 4549 rdata ? rdata->xid : 0, 4550 io_parms->persistent_fid, 4551 io_parms->tcon->tid, io_parms->tcon->ses->Suid, 4552 io_parms->offset, io_parms->length); 4553 #ifdef CONFIG_CIFS_SMB_DIRECT 4554 /* 4555 * If we want to do a RDMA write, fill in and append 4556 * smbdirect_buffer_descriptor_v1 to the end of read request 4557 */ 4558 if (rdata && smb3_use_rdma_offload(io_parms)) { 4559 struct smbdirect_buffer_descriptor_v1 *v1; 4560 bool need_invalidate = server->dialect == SMB30_PROT_ID; 4561 4562 rdata->mr = smbd_register_mr(server->smbd_conn, &rdata->subreq.io_iter, 4563 true, need_invalidate); 4564 if (!rdata->mr) 4565 return -EAGAIN; 4566 4567 req->Channel = SMB2_CHANNEL_RDMA_V1_INVALIDATE; 4568 if (need_invalidate) 4569 req->Channel = SMB2_CHANNEL_RDMA_V1; 4570 req->ReadChannelInfoOffset = 4571 cpu_to_le16(offsetof(struct smb2_read_req, Buffer)); 4572 req->ReadChannelInfoLength = 4573 cpu_to_le16(sizeof(struct smbdirect_buffer_descriptor_v1)); 4574 v1 = (struct smbdirect_buffer_descriptor_v1 *) &req->Buffer[0]; 4575 v1->offset = cpu_to_le64(rdata->mr->mr->iova); 4576 v1->token = cpu_to_le32(rdata->mr->mr->rkey); 4577 v1->length = cpu_to_le32(rdata->mr->mr->length); 4578 4579 *total_len += sizeof(*v1) - 1; 4580 } 4581 #endif 4582 if (request_type & CHAINED_REQUEST) { 4583 if (!(request_type & END_OF_CHAIN)) { 4584 /* next 8-byte aligned request */ 4585 *total_len = ALIGN(*total_len, 8); 4586 shdr->NextCommand = cpu_to_le32(*total_len); 4587 } else /* END_OF_CHAIN */ 4588 shdr->NextCommand = 0; 4589 if (request_type & RELATED_REQUEST) { 4590 shdr->Flags |= SMB2_FLAGS_RELATED_OPERATIONS; 4591 /* 4592 * Related requests use info from previous read request 4593 * in chain. 4594 */ 4595 shdr->SessionId = cpu_to_le64(0xFFFFFFFFFFFFFFFF); 4596 shdr->Id.SyncId.TreeId = cpu_to_le32(0xFFFFFFFF); 4597 req->PersistentFileId = (u64)-1; 4598 req->VolatileFileId = (u64)-1; 4599 } 4600 } 4601 if (remaining_bytes > io_parms->length) 4602 req->RemainingBytes = cpu_to_le32(remaining_bytes); 4603 else 4604 req->RemainingBytes = 0; 4605 4606 *buf = req; 4607 return rc; 4608 } 4609 4610 static void 4611 smb2_readv_callback(struct TCP_Server_Info *server, struct mid_q_entry *mid) 4612 { 4613 struct cifs_io_subrequest *rdata = mid->callback_data; 4614 struct netfs_inode *ictx = netfs_inode(rdata->rreq->inode); 4615 struct cifs_tcon *tcon = tlink_tcon(rdata->req->cfile->tlink); 4616 struct smb2_hdr *shdr = (struct smb2_hdr *)rdata->iov[0].iov_base; 4617 struct cifs_credits credits = { 4618 .value = 0, 4619 .instance = 0, 4620 .rreq_debug_id = rdata->rreq->debug_id, 4621 .rreq_debug_index = rdata->subreq.debug_index, 4622 }; 4623 struct smb_rqst rqst = { .rq_iov = &rdata->iov[0], .rq_nvec = 1 }; 4624 unsigned int rreq_debug_id = rdata->rreq->debug_id; 4625 unsigned int subreq_debug_index = rdata->subreq.debug_index; 4626 4627 if (rdata->got_bytes) { 4628 rqst.rq_iter = rdata->subreq.io_iter; 4629 } 4630 4631 WARN_ONCE(rdata->server != server, 4632 "rdata server %p != mid server %p", 4633 rdata->server, server); 4634 4635 cifs_dbg(FYI, "%s: mid=%llu state=%d result=%d bytes=%zu/%zu\n", 4636 __func__, mid->mid, mid->mid_state, rdata->result, 4637 rdata->got_bytes, rdata->subreq.len - rdata->subreq.transferred); 4638 4639 switch (mid->mid_state) { 4640 case MID_RESPONSE_RECEIVED: 4641 credits.value = le16_to_cpu(shdr->CreditRequest); 4642 credits.instance = server->reconnect_instance; 4643 /* result already set, check signature */ 4644 if (server->sign && !mid->decrypted) { 4645 int rc; 4646 4647 iov_iter_truncate(&rqst.rq_iter, rdata->got_bytes); 4648 rc = smb2_verify_signature(&rqst, server); 4649 if (rc) { 4650 cifs_tcon_dbg(VFS, "SMB signature verification returned error = %d\n", 4651 rc); 4652 rdata->subreq.error = rc; 4653 rdata->result = rc; 4654 4655 if (is_replayable_error(rc)) { 4656 trace_netfs_sreq(&rdata->subreq, netfs_sreq_trace_io_retry_needed); 4657 __set_bit(NETFS_SREQ_NEED_RETRY, &rdata->subreq.flags); 4658 } else 4659 trace_netfs_sreq(&rdata->subreq, netfs_sreq_trace_io_bad); 4660 } else 4661 trace_netfs_sreq(&rdata->subreq, netfs_sreq_trace_io_progress); 4662 } 4663 /* FIXME: should this be counted toward the initiating task? */ 4664 task_io_account_read(rdata->got_bytes); 4665 cifs_stats_bytes_read(tcon, rdata->got_bytes); 4666 break; 4667 case MID_REQUEST_SUBMITTED: 4668 trace_netfs_sreq(&rdata->subreq, netfs_sreq_trace_io_req_submitted); 4669 goto do_retry; 4670 case MID_RETRY_NEEDED: 4671 trace_netfs_sreq(&rdata->subreq, netfs_sreq_trace_io_retry_needed); 4672 do_retry: 4673 __set_bit(NETFS_SREQ_NEED_RETRY, &rdata->subreq.flags); 4674 rdata->result = -EAGAIN; 4675 if (server->sign && rdata->got_bytes) 4676 /* reset bytes number since we can not check a sign */ 4677 rdata->got_bytes = 0; 4678 /* FIXME: should this be counted toward the initiating task? */ 4679 task_io_account_read(rdata->got_bytes); 4680 cifs_stats_bytes_read(tcon, rdata->got_bytes); 4681 break; 4682 case MID_RESPONSE_MALFORMED: 4683 trace_netfs_sreq(&rdata->subreq, netfs_sreq_trace_io_malformed); 4684 credits.value = le16_to_cpu(shdr->CreditRequest); 4685 credits.instance = server->reconnect_instance; 4686 rdata->result = smb_EIO(smb_eio_trace_read_rsp_malformed); 4687 break; 4688 default: 4689 trace_netfs_sreq(&rdata->subreq, netfs_sreq_trace_io_unknown); 4690 rdata->result = smb_EIO1(smb_eio_trace_read_mid_state_unknown, 4691 mid->mid_state); 4692 break; 4693 } 4694 #ifdef CONFIG_CIFS_SMB_DIRECT 4695 /* 4696 * If this rdata has a memory registered, the MR can be freed 4697 * MR needs to be freed as soon as I/O finishes to prevent deadlock 4698 * because they have limited number and are used for future I/Os 4699 */ 4700 if (rdata->mr) { 4701 smbd_deregister_mr(rdata->mr); 4702 rdata->mr = NULL; 4703 } 4704 #endif 4705 if (rdata->result && rdata->result != -ENODATA) { 4706 cifs_stats_fail_inc(tcon, SMB2_READ_HE); 4707 trace_smb3_read_err(rdata->rreq->debug_id, 4708 rdata->subreq.debug_index, 4709 rdata->xid, 4710 rdata->req->cfile->fid.persistent_fid, 4711 tcon->tid, tcon->ses->Suid, 4712 rdata->subreq.start + rdata->subreq.transferred, 4713 rdata->subreq.len - rdata->subreq.transferred, 4714 rdata->result); 4715 } else 4716 trace_smb3_read_done(rdata->rreq->debug_id, 4717 rdata->subreq.debug_index, 4718 rdata->xid, 4719 rdata->req->cfile->fid.persistent_fid, 4720 tcon->tid, tcon->ses->Suid, 4721 rdata->subreq.start + rdata->subreq.transferred, 4722 rdata->got_bytes); 4723 4724 if (rdata->result == -ENODATA) { 4725 __set_bit(NETFS_SREQ_HIT_EOF, &rdata->subreq.flags); 4726 rdata->result = 0; 4727 } else { 4728 size_t trans = rdata->subreq.transferred + rdata->got_bytes; 4729 if (trans < rdata->subreq.len && 4730 rdata->subreq.start + trans >= ictx->remote_i_size) { 4731 __set_bit(NETFS_SREQ_HIT_EOF, &rdata->subreq.flags); 4732 rdata->result = 0; 4733 } 4734 if (rdata->got_bytes) 4735 __set_bit(NETFS_SREQ_MADE_PROGRESS, &rdata->subreq.flags); 4736 } 4737 4738 /* see if we need to retry */ 4739 if (is_replayable_error(rdata->result) && 4740 smb2_should_replay(tcon, 4741 &rdata->retries, 4742 &rdata->cur_sleep)) 4743 rdata->replay = true; 4744 4745 trace_smb3_rw_credits(rreq_debug_id, subreq_debug_index, rdata->credits.value, 4746 server->credits, server->in_flight, 4747 0, cifs_trace_rw_credits_read_response_clear); 4748 rdata->credits.value = 0; 4749 rdata->subreq.error = rdata->result; 4750 rdata->subreq.transferred += rdata->got_bytes; 4751 trace_netfs_sreq(&rdata->subreq, netfs_sreq_trace_io_progress); 4752 netfs_read_subreq_terminated(&rdata->subreq); 4753 release_mid(server, mid); 4754 trace_smb3_rw_credits(rreq_debug_id, subreq_debug_index, 0, 4755 server->credits, server->in_flight, 4756 credits.value, cifs_trace_rw_credits_read_response_add); 4757 add_credits(server, &credits, 0); 4758 } 4759 4760 /* smb2_async_readv - send an async read, and set up mid to handle result */ 4761 int 4762 smb2_async_readv(struct cifs_io_subrequest *rdata) 4763 { 4764 int rc, flags = 0; 4765 char *buf; 4766 struct netfs_io_subrequest *subreq = &rdata->subreq; 4767 struct smb2_hdr *shdr; 4768 struct cifs_io_parms io_parms; 4769 struct smb_rqst rqst = { .rq_iov = rdata->iov, 4770 .rq_nvec = 1 }; 4771 struct TCP_Server_Info *server; 4772 struct cifs_tcon *tcon = tlink_tcon(rdata->req->cfile->tlink); 4773 unsigned int total_len; 4774 int credit_request; 4775 4776 cifs_dbg(FYI, "%s: offset=%llu bytes=%zu\n", 4777 __func__, subreq->start, subreq->len); 4778 4779 if (!rdata->server) 4780 rdata->server = cifs_pick_channel(tcon->ses); 4781 4782 io_parms.tcon = tlink_tcon(rdata->req->cfile->tlink); 4783 io_parms.server = server = rdata->server; 4784 io_parms.offset = subreq->start + subreq->transferred; 4785 io_parms.length = subreq->len - subreq->transferred; 4786 io_parms.persistent_fid = rdata->req->cfile->fid.persistent_fid; 4787 io_parms.volatile_fid = rdata->req->cfile->fid.volatile_fid; 4788 io_parms.pid = rdata->req->pid; 4789 4790 rc = smb2_new_read_req( 4791 (void **) &buf, &total_len, &io_parms, rdata, 0, 0); 4792 if (rc) 4793 goto out; 4794 4795 if (smb3_encryption_required(io_parms.tcon)) 4796 flags |= CIFS_TRANSFORM_REQ; 4797 4798 rdata->iov[0].iov_base = buf; 4799 rdata->iov[0].iov_len = total_len; 4800 rdata->got_bytes = 0; 4801 rdata->result = 0; 4802 4803 shdr = (struct smb2_hdr *)buf; 4804 4805 if (rdata->replay) { 4806 /* Back-off before retry */ 4807 if (rdata->cur_sleep) 4808 msleep(rdata->cur_sleep); 4809 smb2_set_replay(server, &rqst); 4810 } 4811 4812 if (rdata->credits.value > 0) { 4813 shdr->CreditCharge = cpu_to_le16(DIV_ROUND_UP(io_parms.length, 4814 SMB2_MAX_BUFFER_SIZE)); 4815 credit_request = le16_to_cpu(shdr->CreditCharge) + 8; 4816 if (server->credits >= server->max_credits) 4817 shdr->CreditRequest = cpu_to_le16(0); 4818 else 4819 shdr->CreditRequest = cpu_to_le16( 4820 min_t(int, server->max_credits - 4821 server->credits, credit_request)); 4822 4823 rc = adjust_credits(server, rdata, cifs_trace_rw_credits_call_readv_adjust); 4824 if (rc) 4825 goto async_readv_out; 4826 4827 flags |= CIFS_HAS_CREDITS; 4828 } 4829 4830 rc = cifs_call_async(server, &rqst, 4831 cifs_readv_receive, smb2_readv_callback, 4832 smb3_handle_read_data, rdata, flags, 4833 &rdata->credits); 4834 if (rc) { 4835 cifs_stats_fail_inc(io_parms.tcon, SMB2_READ_HE); 4836 trace_smb3_read_err(rdata->rreq->debug_id, 4837 subreq->debug_index, 4838 rdata->xid, io_parms.persistent_fid, 4839 io_parms.tcon->tid, 4840 io_parms.tcon->ses->Suid, 4841 io_parms.offset, 4842 subreq->len - subreq->transferred, rc); 4843 } 4844 4845 async_readv_out: 4846 cifs_small_buf_release(buf); 4847 4848 out: 4849 /* if the send error is retryable, let netfs know about it */ 4850 if (is_replayable_error(rc) && 4851 smb2_should_replay(tcon, 4852 &rdata->retries, 4853 &rdata->cur_sleep)) { 4854 trace_netfs_sreq(&rdata->subreq, netfs_sreq_trace_io_retry_needed); 4855 __set_bit(NETFS_SREQ_NEED_RETRY, &rdata->subreq.flags); 4856 } 4857 4858 return rc; 4859 } 4860 4861 int 4862 SMB2_read(const unsigned int xid, struct cifs_io_parms *io_parms, 4863 unsigned int *nbytes, char **buf, int *buf_type) 4864 { 4865 struct smb_rqst rqst; 4866 int resp_buftype, rc; 4867 struct smb2_read_req *req = NULL; 4868 struct smb2_read_rsp *rsp = NULL; 4869 struct kvec iov[1]; 4870 struct kvec rsp_iov; 4871 unsigned int total_len; 4872 int flags = CIFS_LOG_ERROR; 4873 struct cifs_ses *ses = io_parms->tcon->ses; 4874 4875 if (!io_parms->server) 4876 io_parms->server = cifs_pick_channel(io_parms->tcon->ses); 4877 4878 *nbytes = 0; 4879 rc = smb2_new_read_req((void **)&req, &total_len, io_parms, NULL, 0, 0); 4880 if (rc) 4881 return rc; 4882 4883 if (smb3_encryption_required(io_parms->tcon)) 4884 flags |= CIFS_TRANSFORM_REQ; 4885 4886 iov[0].iov_base = (char *)req; 4887 iov[0].iov_len = total_len; 4888 4889 memset(&rqst, 0, sizeof(struct smb_rqst)); 4890 rqst.rq_iov = iov; 4891 rqst.rq_nvec = 1; 4892 4893 rc = cifs_send_recv(xid, ses, io_parms->server, 4894 &rqst, &resp_buftype, flags, &rsp_iov); 4895 rsp = (struct smb2_read_rsp *)rsp_iov.iov_base; 4896 4897 if (rc) { 4898 if (rc != -ENODATA) { 4899 cifs_stats_fail_inc(io_parms->tcon, SMB2_READ_HE); 4900 cifs_dbg(VFS, "Send error in read = %d\n", rc); 4901 trace_smb3_read_err(0, 0, xid, 4902 req->PersistentFileId, 4903 io_parms->tcon->tid, ses->Suid, 4904 io_parms->offset, io_parms->length, 4905 rc); 4906 } else 4907 trace_smb3_read_done(0, 0, xid, 4908 req->PersistentFileId, io_parms->tcon->tid, 4909 ses->Suid, io_parms->offset, 0); 4910 free_rsp_buf(resp_buftype, rsp_iov.iov_base); 4911 cifs_small_buf_release(req); 4912 return rc == -ENODATA ? 0 : rc; 4913 } else 4914 trace_smb3_read_done(0, 0, xid, 4915 req->PersistentFileId, 4916 io_parms->tcon->tid, ses->Suid, 4917 io_parms->offset, io_parms->length); 4918 4919 cifs_small_buf_release(req); 4920 4921 *nbytes = le32_to_cpu(rsp->DataLength); 4922 if ((*nbytes > CIFS_MAX_MSGSIZE) || 4923 (*nbytes > io_parms->length)) { 4924 cifs_dbg(FYI, "bad length %d for count %d\n", 4925 *nbytes, io_parms->length); 4926 rc = smb_EIO2(smb_eio_trace_read_overlarge, 4927 *nbytes, io_parms->length); 4928 *nbytes = 0; 4929 } 4930 4931 if (*buf) { 4932 memcpy(*buf, (char *)rsp + rsp->DataOffset, *nbytes); 4933 free_rsp_buf(resp_buftype, rsp_iov.iov_base); 4934 } else if (resp_buftype != CIFS_NO_BUFFER) { 4935 *buf = rsp_iov.iov_base; 4936 if (resp_buftype == CIFS_SMALL_BUFFER) 4937 *buf_type = CIFS_SMALL_BUFFER; 4938 else if (resp_buftype == CIFS_LARGE_BUFFER) 4939 *buf_type = CIFS_LARGE_BUFFER; 4940 } 4941 return rc; 4942 } 4943 4944 /* 4945 * Check the mid_state and signature on received buffer (if any), and queue the 4946 * workqueue completion task. 4947 */ 4948 static void 4949 smb2_writev_callback(struct TCP_Server_Info *server, struct mid_q_entry *mid) 4950 { 4951 struct cifs_io_subrequest *wdata = mid->callback_data; 4952 struct cifs_tcon *tcon = tlink_tcon(wdata->req->cfile->tlink); 4953 struct smb2_write_rsp *rsp = (struct smb2_write_rsp *)mid->resp_buf; 4954 struct cifs_credits credits = { 4955 .value = 0, 4956 .instance = 0, 4957 .rreq_debug_id = wdata->rreq->debug_id, 4958 .rreq_debug_index = wdata->subreq.debug_index, 4959 }; 4960 unsigned int rreq_debug_id = wdata->rreq->debug_id; 4961 unsigned int subreq_debug_index = wdata->subreq.debug_index; 4962 ssize_t result = 0; 4963 size_t written; 4964 4965 WARN_ONCE(wdata->server != server, 4966 "wdata server %p != mid server %p", 4967 wdata->server, server); 4968 4969 switch (mid->mid_state) { 4970 case MID_RESPONSE_RECEIVED: 4971 credits.value = le16_to_cpu(rsp->hdr.CreditRequest); 4972 credits.instance = server->reconnect_instance; 4973 result = smb2_check_receive(mid, server, 0); 4974 if (result != 0) { 4975 if (is_replayable_error(result)) { 4976 trace_netfs_sreq(&wdata->subreq, netfs_sreq_trace_io_retry_needed); 4977 __set_bit(NETFS_SREQ_NEED_RETRY, &wdata->subreq.flags); 4978 } else { 4979 wdata->subreq.error = result; 4980 trace_netfs_sreq(&wdata->subreq, netfs_sreq_trace_io_bad); 4981 } 4982 break; 4983 } 4984 trace_netfs_sreq(&wdata->subreq, netfs_sreq_trace_io_progress); 4985 4986 written = le32_to_cpu(rsp->DataLength); 4987 /* 4988 * Mask off high 16 bits when bytes written as returned 4989 * by the server is greater than bytes requested by the 4990 * client. OS/2 servers are known to set incorrect 4991 * CountHigh values. 4992 */ 4993 if (written > wdata->subreq.len) 4994 written &= 0xFFFF; 4995 4996 cifs_stats_bytes_written(tcon, written); 4997 4998 if (written < wdata->subreq.len) { 4999 result = -ENOSPC; 5000 } else if (written > 0) { 5001 wdata->subreq.len = written; 5002 __set_bit(NETFS_SREQ_MADE_PROGRESS, &wdata->subreq.flags); 5003 } 5004 break; 5005 case MID_REQUEST_SUBMITTED: 5006 trace_netfs_sreq(&wdata->subreq, netfs_sreq_trace_io_req_submitted); 5007 __set_bit(NETFS_SREQ_NEED_RETRY, &wdata->subreq.flags); 5008 result = -EAGAIN; 5009 break; 5010 case MID_RETRY_NEEDED: 5011 trace_netfs_sreq(&wdata->subreq, netfs_sreq_trace_io_retry_needed); 5012 __set_bit(NETFS_SREQ_NEED_RETRY, &wdata->subreq.flags); 5013 result = -EAGAIN; 5014 break; 5015 case MID_RESPONSE_MALFORMED: 5016 trace_netfs_sreq(&wdata->subreq, netfs_sreq_trace_io_malformed); 5017 credits.value = le16_to_cpu(rsp->hdr.CreditRequest); 5018 credits.instance = server->reconnect_instance; 5019 result = smb_EIO(smb_eio_trace_write_rsp_malformed); 5020 break; 5021 default: 5022 trace_netfs_sreq(&wdata->subreq, netfs_sreq_trace_io_unknown); 5023 result = smb_EIO1(smb_eio_trace_write_mid_state_unknown, 5024 mid->mid_state); 5025 break; 5026 } 5027 #ifdef CONFIG_CIFS_SMB_DIRECT 5028 /* 5029 * If this wdata has a memory registered, the MR can be freed 5030 * The number of MRs available is limited, it's important to recover 5031 * used MR as soon as I/O is finished. Hold MR longer in the later 5032 * I/O process can possibly result in I/O deadlock due to lack of MR 5033 * to send request on I/O retry 5034 */ 5035 if (wdata->mr) { 5036 smbd_deregister_mr(wdata->mr); 5037 wdata->mr = NULL; 5038 } 5039 #endif 5040 if (result) { 5041 wdata->result = result; 5042 cifs_stats_fail_inc(tcon, SMB2_WRITE_HE); 5043 trace_smb3_write_err(wdata->rreq->debug_id, 5044 wdata->subreq.debug_index, 5045 wdata->xid, 5046 wdata->req->cfile->fid.persistent_fid, 5047 tcon->tid, tcon->ses->Suid, wdata->subreq.start, 5048 wdata->subreq.len, wdata->result); 5049 if (wdata->result == -ENOSPC) 5050 pr_warn_once("Out of space writing to %s\n", 5051 tcon->tree_name); 5052 } else 5053 trace_smb3_write_done(wdata->rreq->debug_id, 5054 wdata->subreq.debug_index, 5055 wdata->xid, 5056 wdata->req->cfile->fid.persistent_fid, 5057 tcon->tid, tcon->ses->Suid, 5058 wdata->subreq.start, wdata->subreq.len); 5059 5060 trace_smb3_rw_credits(rreq_debug_id, subreq_debug_index, wdata->credits.value, 5061 server->credits, server->in_flight, 5062 0, cifs_trace_rw_credits_write_response_clear); 5063 wdata->credits.value = 0; 5064 5065 /* see if we need to retry */ 5066 if (is_replayable_error(wdata->result) && 5067 smb2_should_replay(tcon, 5068 &wdata->retries, 5069 &wdata->cur_sleep)) 5070 wdata->replay = true; 5071 5072 cifs_write_subrequest_terminated(wdata, result ?: written); 5073 release_mid(server, mid); 5074 trace_smb3_rw_credits(rreq_debug_id, subreq_debug_index, 0, 5075 server->credits, server->in_flight, 5076 credits.value, cifs_trace_rw_credits_write_response_add); 5077 add_credits(server, &credits, 0); 5078 } 5079 5080 /* smb2_async_writev - send an async write, and set up mid to handle result */ 5081 void 5082 smb2_async_writev(struct cifs_io_subrequest *wdata) 5083 { 5084 int rc = -EACCES, flags = 0; 5085 struct smb2_write_req *req = NULL; 5086 struct smb2_hdr *shdr; 5087 struct cifs_tcon *tcon = tlink_tcon(wdata->req->cfile->tlink); 5088 struct TCP_Server_Info *server = wdata->server; 5089 struct kvec iov[1]; 5090 struct smb_rqst rqst = { }; 5091 unsigned int total_len, xid = wdata->xid; 5092 struct cifs_io_parms _io_parms; 5093 struct cifs_io_parms *io_parms = NULL; 5094 int credit_request; 5095 5096 /* 5097 * in future we may get cifs_io_parms passed in from the caller, 5098 * but for now we construct it here... 5099 */ 5100 _io_parms = (struct cifs_io_parms) { 5101 .tcon = tcon, 5102 .server = server, 5103 .offset = wdata->subreq.start, 5104 .length = wdata->subreq.len, 5105 .persistent_fid = wdata->req->cfile->fid.persistent_fid, 5106 .volatile_fid = wdata->req->cfile->fid.volatile_fid, 5107 .pid = wdata->req->pid, 5108 }; 5109 io_parms = &_io_parms; 5110 5111 rc = smb2_plain_req_init(SMB2_WRITE, tcon, server, 5112 (void **) &req, &total_len); 5113 if (rc) 5114 goto out; 5115 5116 rqst.rq_iov = iov; 5117 rqst.rq_iter = wdata->subreq.io_iter; 5118 5119 rqst.rq_iov[0].iov_len = total_len - 1; 5120 rqst.rq_iov[0].iov_base = (char *)req; 5121 rqst.rq_nvec += 1; 5122 5123 if (smb3_encryption_required(tcon)) 5124 flags |= CIFS_TRANSFORM_REQ; 5125 5126 shdr = (struct smb2_hdr *)req; 5127 shdr->Id.SyncId.ProcessId = cpu_to_le32(io_parms->pid); 5128 5129 req->PersistentFileId = io_parms->persistent_fid; 5130 req->VolatileFileId = io_parms->volatile_fid; 5131 req->WriteChannelInfoOffset = 0; 5132 req->WriteChannelInfoLength = 0; 5133 req->Channel = SMB2_CHANNEL_NONE; 5134 req->Length = cpu_to_le32(io_parms->length); 5135 req->Offset = cpu_to_le64(io_parms->offset); 5136 req->DataOffset = cpu_to_le16( 5137 offsetof(struct smb2_write_req, Buffer)); 5138 req->RemainingBytes = 0; 5139 5140 trace_smb3_write_enter(wdata->rreq->debug_id, 5141 wdata->subreq.debug_index, 5142 wdata->xid, 5143 io_parms->persistent_fid, 5144 io_parms->tcon->tid, 5145 io_parms->tcon->ses->Suid, 5146 io_parms->offset, 5147 io_parms->length); 5148 5149 #ifdef CONFIG_CIFS_SMB_DIRECT 5150 /* 5151 * If we want to do a server RDMA read, fill in and append 5152 * smbdirect_buffer_descriptor_v1 to the end of write request 5153 */ 5154 if (smb3_use_rdma_offload(io_parms)) { 5155 struct smbdirect_buffer_descriptor_v1 *v1; 5156 bool need_invalidate = server->dialect == SMB30_PROT_ID; 5157 5158 wdata->mr = smbd_register_mr(server->smbd_conn, &wdata->subreq.io_iter, 5159 false, need_invalidate); 5160 if (!wdata->mr) { 5161 rc = -EAGAIN; 5162 goto async_writev_out; 5163 } 5164 /* For RDMA read, I/O size is in RemainingBytes not in Length */ 5165 req->RemainingBytes = req->Length; 5166 req->Length = 0; 5167 req->DataOffset = 0; 5168 req->Channel = SMB2_CHANNEL_RDMA_V1_INVALIDATE; 5169 if (need_invalidate) 5170 req->Channel = SMB2_CHANNEL_RDMA_V1; 5171 req->WriteChannelInfoOffset = 5172 cpu_to_le16(offsetof(struct smb2_write_req, Buffer)); 5173 req->WriteChannelInfoLength = 5174 cpu_to_le16(sizeof(struct smbdirect_buffer_descriptor_v1)); 5175 v1 = (struct smbdirect_buffer_descriptor_v1 *) &req->Buffer[0]; 5176 v1->offset = cpu_to_le64(wdata->mr->mr->iova); 5177 v1->token = cpu_to_le32(wdata->mr->mr->rkey); 5178 v1->length = cpu_to_le32(wdata->mr->mr->length); 5179 5180 rqst.rq_iov[0].iov_len += sizeof(*v1); 5181 5182 /* 5183 * We keep wdata->subreq.io_iter, 5184 * but we have to truncate rqst.rq_iter 5185 */ 5186 iov_iter_truncate(&rqst.rq_iter, 0); 5187 } 5188 #endif 5189 5190 if (wdata->replay) { 5191 /* Back-off before retry */ 5192 if (wdata->cur_sleep) 5193 msleep(wdata->cur_sleep); 5194 smb2_set_replay(server, &rqst); 5195 } 5196 5197 cifs_dbg(FYI, "async write at %llu %u bytes iter=%zx\n", 5198 io_parms->offset, io_parms->length, iov_iter_count(&wdata->subreq.io_iter)); 5199 5200 if (wdata->credits.value > 0) { 5201 shdr->CreditCharge = cpu_to_le16(DIV_ROUND_UP(wdata->subreq.len, 5202 SMB2_MAX_BUFFER_SIZE)); 5203 credit_request = le16_to_cpu(shdr->CreditCharge) + 8; 5204 if (server->credits >= server->max_credits) 5205 shdr->CreditRequest = cpu_to_le16(0); 5206 else 5207 shdr->CreditRequest = cpu_to_le16( 5208 min_t(int, server->max_credits - 5209 server->credits, credit_request)); 5210 5211 rc = adjust_credits(server, wdata, cifs_trace_rw_credits_call_writev_adjust); 5212 if (rc) 5213 goto async_writev_out; 5214 5215 flags |= CIFS_HAS_CREDITS; 5216 } 5217 5218 /* XXX: compression + encryption is unsupported for now */ 5219 if (((flags & CIFS_TRANSFORM_REQ) != CIFS_TRANSFORM_REQ) && should_compress(tcon, &rqst)) 5220 flags |= CIFS_COMPRESS_REQ; 5221 5222 rc = cifs_call_async(server, &rqst, NULL, smb2_writev_callback, NULL, 5223 wdata, flags, &wdata->credits); 5224 /* Can't touch wdata if rc == 0 */ 5225 if (rc) { 5226 trace_smb3_write_err(wdata->rreq->debug_id, 5227 wdata->subreq.debug_index, 5228 xid, 5229 io_parms->persistent_fid, 5230 io_parms->tcon->tid, 5231 io_parms->tcon->ses->Suid, 5232 io_parms->offset, 5233 io_parms->length, 5234 rc); 5235 cifs_stats_fail_inc(tcon, SMB2_WRITE_HE); 5236 } 5237 5238 async_writev_out: 5239 cifs_small_buf_release(req); 5240 out: 5241 /* if the send error is retryable, let netfs know about it */ 5242 if (is_replayable_error(rc) && 5243 smb2_should_replay(tcon, 5244 &wdata->retries, 5245 &wdata->cur_sleep)) { 5246 wdata->replay = true; 5247 trace_netfs_sreq(&wdata->subreq, netfs_sreq_trace_io_retry_needed); 5248 __set_bit(NETFS_SREQ_NEED_RETRY, &wdata->subreq.flags); 5249 } 5250 5251 if (rc) { 5252 trace_smb3_rw_credits(wdata->rreq->debug_id, 5253 wdata->subreq.debug_index, 5254 wdata->credits.value, 5255 server->credits, server->in_flight, 5256 -(int)wdata->credits.value, 5257 cifs_trace_rw_credits_write_response_clear); 5258 add_credits_and_wake_if(wdata->server, &wdata->credits, 0); 5259 cifs_write_subrequest_terminated(wdata, rc); 5260 } 5261 } 5262 5263 /* 5264 * SMB2_write function gets iov pointer to kvec array with n_vec as a length. 5265 * The length field from io_parms must be at least 1 and indicates a number of 5266 * elements with data to write that begins with position 1 in iov array. All 5267 * data length is specified by count. 5268 */ 5269 int 5270 SMB2_write(const unsigned int xid, struct cifs_io_parms *io_parms, 5271 unsigned int *nbytes, struct kvec *iov, int n_vec) 5272 { 5273 struct smb_rqst rqst; 5274 int rc = 0; 5275 struct smb2_write_req *req = NULL; 5276 struct smb2_write_rsp *rsp = NULL; 5277 int resp_buftype; 5278 struct kvec rsp_iov; 5279 int flags = 0; 5280 unsigned int total_len; 5281 struct TCP_Server_Info *server; 5282 int retries = 0, cur_sleep = 0; 5283 5284 replay_again: 5285 /* reinitialize for possible replay */ 5286 flags = 0; 5287 *nbytes = 0; 5288 if (!io_parms->server) 5289 io_parms->server = cifs_pick_channel(io_parms->tcon->ses); 5290 server = io_parms->server; 5291 if (server == NULL) 5292 return -ECONNABORTED; 5293 5294 if (n_vec < 1) 5295 return rc; 5296 5297 rc = smb2_plain_req_init(SMB2_WRITE, io_parms->tcon, server, 5298 (void **) &req, &total_len); 5299 if (rc) 5300 return rc; 5301 5302 if (smb3_encryption_required(io_parms->tcon)) 5303 flags |= CIFS_TRANSFORM_REQ; 5304 5305 req->hdr.Id.SyncId.ProcessId = cpu_to_le32(io_parms->pid); 5306 5307 req->PersistentFileId = io_parms->persistent_fid; 5308 req->VolatileFileId = io_parms->volatile_fid; 5309 req->WriteChannelInfoOffset = 0; 5310 req->WriteChannelInfoLength = 0; 5311 req->Channel = 0; 5312 req->Length = cpu_to_le32(io_parms->length); 5313 req->Offset = cpu_to_le64(io_parms->offset); 5314 req->DataOffset = cpu_to_le16( 5315 offsetof(struct smb2_write_req, Buffer)); 5316 req->RemainingBytes = 0; 5317 5318 trace_smb3_write_enter(0, 0, xid, io_parms->persistent_fid, 5319 io_parms->tcon->tid, io_parms->tcon->ses->Suid, 5320 io_parms->offset, io_parms->length); 5321 5322 iov[0].iov_base = (char *)req; 5323 /* 1 for Buffer */ 5324 iov[0].iov_len = total_len - 1; 5325 5326 memset(&rqst, 0, sizeof(struct smb_rqst)); 5327 rqst.rq_iov = iov; 5328 rqst.rq_nvec = n_vec + 1; 5329 5330 if (retries) { 5331 /* Back-off before retry */ 5332 if (cur_sleep) 5333 msleep(cur_sleep); 5334 smb2_set_replay(server, &rqst); 5335 } 5336 5337 rc = cifs_send_recv(xid, io_parms->tcon->ses, server, 5338 &rqst, 5339 &resp_buftype, flags, &rsp_iov); 5340 rsp = (struct smb2_write_rsp *)rsp_iov.iov_base; 5341 5342 if (rc) { 5343 trace_smb3_write_err(0, 0, xid, 5344 req->PersistentFileId, 5345 io_parms->tcon->tid, 5346 io_parms->tcon->ses->Suid, 5347 io_parms->offset, io_parms->length, rc); 5348 cifs_stats_fail_inc(io_parms->tcon, SMB2_WRITE_HE); 5349 cifs_dbg(VFS, "Send error in write = %d\n", rc); 5350 } else { 5351 *nbytes = le32_to_cpu(rsp->DataLength); 5352 cifs_stats_bytes_written(io_parms->tcon, *nbytes); 5353 trace_smb3_write_done(0, 0, xid, 5354 req->PersistentFileId, 5355 io_parms->tcon->tid, 5356 io_parms->tcon->ses->Suid, 5357 io_parms->offset, *nbytes); 5358 } 5359 5360 cifs_small_buf_release(req); 5361 free_rsp_buf(resp_buftype, rsp); 5362 5363 if (is_replayable_error(rc) && 5364 smb2_should_replay(io_parms->tcon, &retries, &cur_sleep)) 5365 goto replay_again; 5366 5367 return rc; 5368 } 5369 5370 int posix_info_sid_size(const void *beg, const void *end) 5371 { 5372 size_t subauth; 5373 int total; 5374 5375 if (beg + 1 > end) 5376 return -1; 5377 5378 subauth = *(u8 *)(beg+1); 5379 if (subauth < 1 || subauth > 15) 5380 return -1; 5381 5382 total = 1 + 1 + 6 + 4*subauth; 5383 if (beg + total > end) 5384 return -1; 5385 5386 return total; 5387 } 5388 5389 int posix_info_parse(const void *beg, const void *end, 5390 struct smb2_posix_info_parsed *out) 5391 5392 { 5393 int total_len = 0; 5394 int owner_len, group_len; 5395 int name_len; 5396 const void *owner_sid; 5397 const void *group_sid; 5398 const void *name; 5399 5400 /* if no end bound given, assume payload to be correct */ 5401 if (!end) { 5402 const struct smb2_posix_info *p = beg; 5403 5404 end = beg + le32_to_cpu(p->NextEntryOffset); 5405 /* last element will have a 0 offset, pick a sensible bound */ 5406 if (end == beg) 5407 end += 0xFFFF; 5408 } 5409 5410 /* check base buf */ 5411 if (beg + sizeof(struct smb2_posix_info) > end) 5412 return -1; 5413 total_len = sizeof(struct smb2_posix_info); 5414 5415 /* check owner sid */ 5416 owner_sid = beg + total_len; 5417 owner_len = posix_info_sid_size(owner_sid, end); 5418 if (owner_len < 0) 5419 return -1; 5420 total_len += owner_len; 5421 5422 /* check group sid */ 5423 group_sid = beg + total_len; 5424 group_len = posix_info_sid_size(group_sid, end); 5425 if (group_len < 0) 5426 return -1; 5427 total_len += group_len; 5428 5429 /* check name len */ 5430 if (beg + total_len + 4 > end) 5431 return -1; 5432 name_len = le32_to_cpu(*(__le32 *)(beg + total_len)); 5433 if (name_len < 1 || name_len > 0xFFFF) 5434 return -1; 5435 total_len += 4; 5436 5437 /* check name */ 5438 name = beg + total_len; 5439 if (name + name_len > end) 5440 return -1; 5441 total_len += name_len; 5442 5443 if (out) { 5444 out->base = beg; 5445 out->size = total_len; 5446 out->name_len = name_len; 5447 out->name = name; 5448 memcpy(&out->owner, owner_sid, owner_len); 5449 memcpy(&out->group, group_sid, group_len); 5450 } 5451 return total_len; 5452 } 5453 5454 static int posix_info_extra_size(const void *beg, const void *end) 5455 { 5456 int len = posix_info_parse(beg, end, NULL); 5457 5458 if (len < 0) 5459 return -1; 5460 return len - sizeof(struct smb2_posix_info); 5461 } 5462 5463 static unsigned int 5464 num_entries(int infotype, char *bufstart, char *end_of_buf, char **lastentry, 5465 size_t size) 5466 { 5467 int len; 5468 unsigned int entrycount = 0; 5469 unsigned int next_offset = 0; 5470 char *entryptr; 5471 FILE_DIRECTORY_INFO *dir_info; 5472 5473 if (bufstart == NULL) 5474 return 0; 5475 5476 entryptr = bufstart; 5477 5478 while (1) { 5479 if (entryptr + next_offset < entryptr || 5480 entryptr + next_offset > end_of_buf || 5481 entryptr + next_offset + size > end_of_buf) { 5482 cifs_dbg(VFS, "malformed search entry would overflow\n"); 5483 break; 5484 } 5485 5486 entryptr = entryptr + next_offset; 5487 dir_info = (FILE_DIRECTORY_INFO *)entryptr; 5488 5489 if (infotype == SMB_FIND_FILE_POSIX_INFO) 5490 len = posix_info_extra_size(entryptr, end_of_buf); 5491 else 5492 len = le32_to_cpu(dir_info->FileNameLength); 5493 5494 if (len < 0 || 5495 entryptr + len < entryptr || 5496 entryptr + len > end_of_buf || 5497 entryptr + len + size > end_of_buf) { 5498 cifs_dbg(VFS, "directory entry name would overflow frame end of buf %p\n", 5499 end_of_buf); 5500 break; 5501 } 5502 5503 *lastentry = entryptr; 5504 entrycount++; 5505 5506 next_offset = le32_to_cpu(dir_info->NextEntryOffset); 5507 if (!next_offset) 5508 break; 5509 } 5510 5511 return entrycount; 5512 } 5513 5514 /* 5515 * Readdir/FindFirst 5516 */ 5517 int SMB2_query_directory_init(const unsigned int xid, 5518 struct cifs_tcon *tcon, 5519 struct TCP_Server_Info *server, 5520 struct smb_rqst *rqst, 5521 u64 persistent_fid, u64 volatile_fid, 5522 int index, int info_level) 5523 { 5524 struct smb2_query_directory_req *req; 5525 unsigned char *bufptr; 5526 __le16 asteriks = cpu_to_le16('*'); 5527 unsigned int output_size = CIFSMaxBufSize - 5528 MAX_SMB2_CREATE_RESPONSE_SIZE - 5529 MAX_SMB2_CLOSE_RESPONSE_SIZE; 5530 unsigned int total_len; 5531 struct kvec *iov = rqst->rq_iov; 5532 int len, rc; 5533 5534 rc = smb2_plain_req_init(SMB2_QUERY_DIRECTORY, tcon, server, 5535 (void **) &req, &total_len); 5536 if (rc) 5537 return rc; 5538 5539 switch (info_level) { 5540 case SMB_FIND_FILE_DIRECTORY_INFO: 5541 req->FileInformationClass = FILE_DIRECTORY_INFORMATION; 5542 break; 5543 case SMB_FIND_FILE_ID_FULL_DIR_INFO: 5544 req->FileInformationClass = FILEID_FULL_DIRECTORY_INFORMATION; 5545 break; 5546 case SMB_FIND_FILE_POSIX_INFO: 5547 req->FileInformationClass = SMB_FIND_FILE_POSIX_INFO; 5548 break; 5549 case SMB_FIND_FILE_FULL_DIRECTORY_INFO: 5550 req->FileInformationClass = FILE_FULL_DIRECTORY_INFORMATION; 5551 break; 5552 default: 5553 cifs_tcon_dbg(VFS, "info level %u isn't supported\n", 5554 info_level); 5555 return -EINVAL; 5556 } 5557 5558 req->FileIndex = cpu_to_le32(index); 5559 req->PersistentFileId = persistent_fid; 5560 req->VolatileFileId = volatile_fid; 5561 5562 len = 0x2; 5563 bufptr = req->Buffer; 5564 memcpy(bufptr, &asteriks, len); 5565 5566 req->FileNameOffset = 5567 cpu_to_le16(sizeof(struct smb2_query_directory_req)); 5568 req->FileNameLength = cpu_to_le16(len); 5569 /* 5570 * BB could be 30 bytes or so longer if we used SMB2 specific 5571 * buffer lengths, but this is safe and close enough. 5572 */ 5573 output_size = min_t(unsigned int, output_size, server->maxBuf); 5574 output_size = min_t(unsigned int, output_size, 2 << 15); 5575 req->OutputBufferLength = cpu_to_le32(output_size); 5576 5577 iov[0].iov_base = (char *)req; 5578 /* 1 for Buffer */ 5579 iov[0].iov_len = total_len - 1; 5580 5581 iov[1].iov_base = (char *)(req->Buffer); 5582 iov[1].iov_len = len; 5583 5584 trace_smb3_query_dir_enter(xid, persistent_fid, tcon->tid, 5585 tcon->ses->Suid, index, output_size); 5586 5587 return 0; 5588 } 5589 5590 void SMB2_query_directory_free(struct smb_rqst *rqst) 5591 { 5592 if (rqst && rqst->rq_iov) { 5593 cifs_small_buf_release(rqst->rq_iov[0].iov_base); /* request */ 5594 } 5595 } 5596 5597 int 5598 smb2_parse_query_directory(struct cifs_tcon *tcon, 5599 struct kvec *rsp_iov, 5600 int resp_buftype, 5601 struct cifs_search_info *srch_inf) 5602 { 5603 struct smb2_query_directory_rsp *rsp; 5604 size_t info_buf_size; 5605 char *end_of_smb; 5606 int rc; 5607 5608 rsp = (struct smb2_query_directory_rsp *)rsp_iov->iov_base; 5609 5610 switch (srch_inf->info_level) { 5611 case SMB_FIND_FILE_DIRECTORY_INFO: 5612 info_buf_size = sizeof(FILE_DIRECTORY_INFO); 5613 break; 5614 case SMB_FIND_FILE_ID_FULL_DIR_INFO: 5615 info_buf_size = sizeof(FILE_ID_FULL_DIR_INFO); 5616 break; 5617 case SMB_FIND_FILE_POSIX_INFO: 5618 /* note that posix payload are variable size */ 5619 info_buf_size = sizeof(struct smb2_posix_info); 5620 break; 5621 case SMB_FIND_FILE_FULL_DIRECTORY_INFO: 5622 info_buf_size = sizeof(FILE_FULL_DIRECTORY_INFO); 5623 break; 5624 default: 5625 cifs_tcon_dbg(VFS, "info level %u isn't supported\n", 5626 srch_inf->info_level); 5627 return -EINVAL; 5628 } 5629 5630 rc = smb2_validate_iov(le16_to_cpu(rsp->OutputBufferOffset), 5631 le32_to_cpu(rsp->OutputBufferLength), rsp_iov, 5632 info_buf_size); 5633 if (rc) { 5634 cifs_tcon_dbg(VFS, "bad info payload"); 5635 return rc; 5636 } 5637 5638 srch_inf->unicode = true; 5639 5640 if (srch_inf->ntwrk_buf_start) { 5641 if (srch_inf->smallBuf) 5642 cifs_small_buf_release(srch_inf->ntwrk_buf_start); 5643 else 5644 cifs_buf_release(srch_inf->ntwrk_buf_start); 5645 } 5646 srch_inf->ntwrk_buf_start = (char *)rsp; 5647 srch_inf->srch_entries_start = srch_inf->last_entry = 5648 (char *)rsp + le16_to_cpu(rsp->OutputBufferOffset); 5649 end_of_smb = rsp_iov->iov_len + (char *)rsp; 5650 5651 srch_inf->entries_in_buffer = num_entries( 5652 srch_inf->info_level, 5653 srch_inf->srch_entries_start, 5654 end_of_smb, 5655 &srch_inf->last_entry, 5656 info_buf_size); 5657 5658 srch_inf->index_of_last_entry += srch_inf->entries_in_buffer; 5659 cifs_dbg(FYI, "num entries %d last_index %lld srch start %p srch end %p\n", 5660 srch_inf->entries_in_buffer, srch_inf->index_of_last_entry, 5661 srch_inf->srch_entries_start, srch_inf->last_entry); 5662 if (resp_buftype == CIFS_LARGE_BUFFER) 5663 srch_inf->smallBuf = false; 5664 else if (resp_buftype == CIFS_SMALL_BUFFER) 5665 srch_inf->smallBuf = true; 5666 else 5667 cifs_tcon_dbg(VFS, "Invalid search buffer type\n"); 5668 5669 return 0; 5670 } 5671 5672 int 5673 SMB2_query_directory(const unsigned int xid, struct cifs_tcon *tcon, 5674 u64 persistent_fid, u64 volatile_fid, int index, 5675 struct cifs_search_info *srch_inf) 5676 { 5677 struct smb_rqst rqst; 5678 struct kvec iov[SMB2_QUERY_DIRECTORY_IOV_SIZE]; 5679 struct smb2_query_directory_rsp *rsp = NULL; 5680 int resp_buftype = CIFS_NO_BUFFER; 5681 struct kvec rsp_iov; 5682 int rc = 0; 5683 struct cifs_ses *ses = tcon->ses; 5684 struct TCP_Server_Info *server; 5685 int flags = 0; 5686 int retries = 0, cur_sleep = 0; 5687 5688 replay_again: 5689 /* reinitialize for possible replay */ 5690 flags = 0; 5691 server = cifs_pick_channel(ses); 5692 5693 if (!ses || !(ses->server)) 5694 return smb_EIO(smb_eio_trace_null_pointers); 5695 5696 if (smb3_encryption_required(tcon)) 5697 flags |= CIFS_TRANSFORM_REQ; 5698 5699 memset(&rqst, 0, sizeof(struct smb_rqst)); 5700 memset(&iov, 0, sizeof(iov)); 5701 rqst.rq_iov = iov; 5702 rqst.rq_nvec = SMB2_QUERY_DIRECTORY_IOV_SIZE; 5703 5704 rc = SMB2_query_directory_init(xid, tcon, server, 5705 &rqst, persistent_fid, 5706 volatile_fid, index, 5707 srch_inf->info_level); 5708 if (rc) 5709 goto qdir_exit; 5710 5711 if (retries) { 5712 /* Back-off before retry */ 5713 if (cur_sleep) 5714 msleep(cur_sleep); 5715 smb2_set_replay(server, &rqst); 5716 } 5717 5718 rc = cifs_send_recv(xid, ses, server, 5719 &rqst, &resp_buftype, flags, &rsp_iov); 5720 rsp = (struct smb2_query_directory_rsp *)rsp_iov.iov_base; 5721 5722 if (rc) { 5723 if (rc == -ENODATA && 5724 rsp->hdr.Status == STATUS_NO_MORE_FILES) { 5725 trace_smb3_query_dir_done(xid, persistent_fid, 5726 tcon->tid, tcon->ses->Suid, index, 0); 5727 srch_inf->endOfSearch = true; 5728 rc = 0; 5729 } else { 5730 trace_smb3_query_dir_err(xid, persistent_fid, tcon->tid, 5731 tcon->ses->Suid, index, 0, rc); 5732 cifs_stats_fail_inc(tcon, SMB2_QUERY_DIRECTORY_HE); 5733 } 5734 goto qdir_exit; 5735 } 5736 5737 rc = smb2_parse_query_directory(tcon, &rsp_iov, resp_buftype, 5738 srch_inf); 5739 if (rc) { 5740 trace_smb3_query_dir_err(xid, persistent_fid, tcon->tid, 5741 tcon->ses->Suid, index, 0, rc); 5742 goto qdir_exit; 5743 } 5744 resp_buftype = CIFS_NO_BUFFER; 5745 5746 trace_smb3_query_dir_done(xid, persistent_fid, tcon->tid, 5747 tcon->ses->Suid, index, srch_inf->entries_in_buffer); 5748 5749 qdir_exit: 5750 SMB2_query_directory_free(&rqst); 5751 free_rsp_buf(resp_buftype, rsp); 5752 5753 if (is_replayable_error(rc) && 5754 smb2_should_replay(tcon, &retries, &cur_sleep)) 5755 goto replay_again; 5756 5757 return rc; 5758 } 5759 5760 int 5761 SMB2_set_info_init(struct cifs_tcon *tcon, struct TCP_Server_Info *server, 5762 struct smb_rqst *rqst, 5763 u64 persistent_fid, u64 volatile_fid, u32 pid, 5764 u8 info_class, u8 info_type, u32 additional_info, 5765 void **data, unsigned int *size) 5766 { 5767 struct smb2_set_info_req *req; 5768 struct kvec *iov = rqst->rq_iov; 5769 unsigned int i, total_len; 5770 int rc; 5771 5772 rc = smb2_plain_req_init(SMB2_SET_INFO, tcon, server, 5773 (void **) &req, &total_len); 5774 if (rc) 5775 return rc; 5776 5777 req->hdr.Id.SyncId.ProcessId = cpu_to_le32(pid); 5778 req->InfoType = info_type; 5779 req->FileInfoClass = info_class; 5780 req->PersistentFileId = persistent_fid; 5781 req->VolatileFileId = volatile_fid; 5782 req->AdditionalInformation = cpu_to_le32(additional_info); 5783 5784 req->BufferOffset = cpu_to_le16(sizeof(struct smb2_set_info_req)); 5785 req->BufferLength = cpu_to_le32(*size); 5786 5787 memcpy(req->Buffer, *data, *size); 5788 total_len += *size; 5789 5790 iov[0].iov_base = (char *)req; 5791 /* 1 for Buffer */ 5792 iov[0].iov_len = total_len - 1; 5793 5794 for (i = 1; i < rqst->rq_nvec; i++) { 5795 le32_add_cpu(&req->BufferLength, size[i]); 5796 iov[i].iov_base = (char *)data[i]; 5797 iov[i].iov_len = size[i]; 5798 } 5799 5800 return 0; 5801 } 5802 5803 void 5804 SMB2_set_info_free(struct smb_rqst *rqst) 5805 { 5806 if (rqst && rqst->rq_iov) 5807 cifs_buf_release(rqst->rq_iov[0].iov_base); /* request */ 5808 } 5809 5810 static int 5811 send_set_info(const unsigned int xid, struct cifs_tcon *tcon, 5812 u64 persistent_fid, u64 volatile_fid, u32 pid, u8 info_class, 5813 u8 info_type, u32 additional_info, unsigned int num, 5814 void **data, unsigned int *size) 5815 { 5816 struct smb_rqst rqst; 5817 struct smb2_set_info_rsp *rsp = NULL; 5818 struct kvec *iov; 5819 struct kvec rsp_iov; 5820 int rc = 0; 5821 int resp_buftype; 5822 struct cifs_ses *ses = tcon->ses; 5823 struct TCP_Server_Info *server; 5824 int flags = 0; 5825 int retries = 0, cur_sleep = 0; 5826 5827 replay_again: 5828 /* reinitialize for possible replay */ 5829 flags = 0; 5830 server = cifs_pick_channel(ses); 5831 5832 if (!ses || !server) 5833 return smb_EIO(smb_eio_trace_null_pointers); 5834 5835 if (!num) 5836 return -EINVAL; 5837 5838 if (smb3_encryption_required(tcon)) 5839 flags |= CIFS_TRANSFORM_REQ; 5840 5841 iov = kmalloc_objs(struct kvec, num); 5842 if (!iov) 5843 return -ENOMEM; 5844 5845 memset(&rqst, 0, sizeof(struct smb_rqst)); 5846 rqst.rq_iov = iov; 5847 rqst.rq_nvec = num; 5848 5849 rc = SMB2_set_info_init(tcon, server, 5850 &rqst, persistent_fid, volatile_fid, pid, 5851 info_class, info_type, additional_info, 5852 data, size); 5853 if (rc) { 5854 kfree(iov); 5855 return rc; 5856 } 5857 5858 if (retries) { 5859 /* Back-off before retry */ 5860 if (cur_sleep) 5861 msleep(cur_sleep); 5862 smb2_set_replay(server, &rqst); 5863 } 5864 5865 rc = cifs_send_recv(xid, ses, server, 5866 &rqst, &resp_buftype, flags, 5867 &rsp_iov); 5868 SMB2_set_info_free(&rqst); 5869 rsp = (struct smb2_set_info_rsp *)rsp_iov.iov_base; 5870 5871 if (rc != 0) { 5872 cifs_stats_fail_inc(tcon, SMB2_SET_INFO_HE); 5873 trace_smb3_set_info_err(xid, persistent_fid, tcon->tid, 5874 ses->Suid, info_class, (__u32)info_type, rc); 5875 } 5876 5877 free_rsp_buf(resp_buftype, rsp); 5878 kfree(iov); 5879 5880 if (is_replayable_error(rc) && 5881 smb2_should_replay(tcon, &retries, &cur_sleep)) 5882 goto replay_again; 5883 5884 return rc; 5885 } 5886 5887 int 5888 SMB2_set_eof(const unsigned int xid, struct cifs_tcon *tcon, u64 persistent_fid, 5889 u64 volatile_fid, u32 pid, loff_t new_eof) 5890 { 5891 struct smb2_file_eof_info info; 5892 void *data; 5893 unsigned int size; 5894 5895 info.EndOfFile = cpu_to_le64(new_eof); 5896 5897 data = &info; 5898 size = sizeof(struct smb2_file_eof_info); 5899 5900 trace_smb3_set_eof(xid, persistent_fid, tcon->tid, tcon->ses->Suid, new_eof); 5901 5902 return send_set_info(xid, tcon, persistent_fid, volatile_fid, 5903 pid, FILE_END_OF_FILE_INFORMATION, SMB2_O_INFO_FILE, 5904 0, 1, &data, &size); 5905 } 5906 5907 int 5908 SMB2_set_acl(const unsigned int xid, struct cifs_tcon *tcon, 5909 u64 persistent_fid, u64 volatile_fid, 5910 struct smb_ntsd *pnntsd, int pacllen, int aclflag) 5911 { 5912 return send_set_info(xid, tcon, persistent_fid, volatile_fid, 5913 current->tgid, 0, SMB2_O_INFO_SECURITY, aclflag, 5914 1, (void **)&pnntsd, &pacllen); 5915 } 5916 5917 int 5918 SMB2_set_ea(const unsigned int xid, struct cifs_tcon *tcon, 5919 u64 persistent_fid, u64 volatile_fid, 5920 struct smb2_file_full_ea_info *buf, int len) 5921 { 5922 return send_set_info(xid, tcon, persistent_fid, volatile_fid, 5923 current->tgid, FILE_FULL_EA_INFORMATION, SMB2_O_INFO_FILE, 5924 0, 1, (void **)&buf, &len); 5925 } 5926 5927 int 5928 SMB2_oplock_break(const unsigned int xid, struct cifs_tcon *tcon, 5929 const u64 persistent_fid, const u64 volatile_fid, 5930 __u8 oplock_level) 5931 { 5932 struct smb_rqst rqst; 5933 int rc; 5934 struct smb2_oplock_break *req = NULL; 5935 struct cifs_ses *ses = tcon->ses; 5936 struct TCP_Server_Info *server; 5937 int flags = CIFS_OBREAK_OP; 5938 unsigned int total_len; 5939 struct kvec iov[1]; 5940 struct kvec rsp_iov; 5941 int resp_buf_type; 5942 int retries = 0, cur_sleep = 0; 5943 5944 replay_again: 5945 /* reinitialize for possible replay */ 5946 flags = CIFS_OBREAK_OP; 5947 server = cifs_pick_channel(ses); 5948 5949 cifs_dbg(FYI, "SMB2_oplock_break\n"); 5950 rc = smb2_plain_req_init(SMB2_OPLOCK_BREAK, tcon, server, 5951 (void **) &req, &total_len); 5952 if (rc) 5953 return rc; 5954 5955 if (smb3_encryption_required(tcon)) 5956 flags |= CIFS_TRANSFORM_REQ; 5957 5958 req->VolatileFid = volatile_fid; 5959 req->PersistentFid = persistent_fid; 5960 req->OplockLevel = oplock_level; 5961 req->hdr.CreditRequest = cpu_to_le16(1); 5962 5963 flags |= CIFS_NO_RSP_BUF; 5964 5965 iov[0].iov_base = (char *)req; 5966 iov[0].iov_len = total_len; 5967 5968 memset(&rqst, 0, sizeof(struct smb_rqst)); 5969 rqst.rq_iov = iov; 5970 rqst.rq_nvec = 1; 5971 5972 if (retries) { 5973 /* Back-off before retry */ 5974 if (cur_sleep) 5975 msleep(cur_sleep); 5976 smb2_set_replay(server, &rqst); 5977 } 5978 5979 rc = cifs_send_recv(xid, ses, server, 5980 &rqst, &resp_buf_type, flags, &rsp_iov); 5981 cifs_small_buf_release(req); 5982 if (rc) { 5983 cifs_stats_fail_inc(tcon, SMB2_OPLOCK_BREAK_HE); 5984 cifs_dbg(FYI, "Send error in Oplock Break = %d\n", rc); 5985 } 5986 5987 if (is_replayable_error(rc) && 5988 smb2_should_replay(tcon, &retries, &cur_sleep)) 5989 goto replay_again; 5990 5991 return rc; 5992 } 5993 5994 void 5995 smb2_copy_fs_info_to_kstatfs(struct smb2_fs_full_size_info *pfs_inf, 5996 struct kstatfs *kst) 5997 { 5998 kst->f_bsize = le32_to_cpu(pfs_inf->BytesPerSector) * 5999 le32_to_cpu(pfs_inf->SectorsPerAllocationUnit); 6000 kst->f_blocks = le64_to_cpu(pfs_inf->TotalAllocationUnits); 6001 kst->f_bfree = kst->f_bavail = 6002 le64_to_cpu(pfs_inf->CallerAvailableAllocationUnits); 6003 return; 6004 } 6005 6006 static void 6007 copy_posix_fs_info_to_kstatfs(FILE_SYSTEM_POSIX_INFO *response_data, 6008 struct kstatfs *kst) 6009 { 6010 kst->f_bsize = le32_to_cpu(response_data->BlockSize); 6011 kst->f_blocks = le64_to_cpu(response_data->TotalBlocks); 6012 kst->f_bfree = le64_to_cpu(response_data->BlocksAvail); 6013 if (response_data->UserBlocksAvail == cpu_to_le64(-1)) 6014 kst->f_bavail = kst->f_bfree; 6015 else 6016 kst->f_bavail = le64_to_cpu(response_data->UserBlocksAvail); 6017 if (response_data->TotalFileNodes != cpu_to_le64(-1)) 6018 kst->f_files = le64_to_cpu(response_data->TotalFileNodes); 6019 if (response_data->FreeFileNodes != cpu_to_le64(-1)) 6020 kst->f_ffree = le64_to_cpu(response_data->FreeFileNodes); 6021 6022 return; 6023 } 6024 6025 static int 6026 build_qfs_info_req(struct kvec *iov, struct cifs_tcon *tcon, 6027 struct TCP_Server_Info *server, 6028 int level, int outbuf_len, u64 persistent_fid, 6029 u64 volatile_fid) 6030 { 6031 int rc; 6032 struct smb2_query_info_req *req; 6033 unsigned int total_len; 6034 6035 cifs_dbg(FYI, "Query FSInfo level %d\n", level); 6036 6037 if ((tcon->ses == NULL) || server == NULL) 6038 return smb_EIO(smb_eio_trace_null_pointers); 6039 6040 rc = smb2_plain_req_init(SMB2_QUERY_INFO, tcon, server, 6041 (void **) &req, &total_len); 6042 if (rc) 6043 return rc; 6044 6045 req->InfoType = SMB2_O_INFO_FILESYSTEM; 6046 req->FileInfoClass = level; 6047 req->PersistentFileId = persistent_fid; 6048 req->VolatileFileId = volatile_fid; 6049 /* 1 for pad */ 6050 req->InputBufferOffset = 6051 cpu_to_le16(sizeof(struct smb2_query_info_req)); 6052 req->OutputBufferLength = cpu_to_le32( 6053 outbuf_len + sizeof(struct smb2_query_info_rsp)); 6054 6055 iov->iov_base = (char *)req; 6056 iov->iov_len = total_len; 6057 return 0; 6058 } 6059 6060 static inline void free_qfs_info_req(struct kvec *iov) 6061 { 6062 cifs_buf_release(iov->iov_base); 6063 } 6064 6065 int 6066 SMB311_posix_qfs_info(const unsigned int xid, struct cifs_tcon *tcon, 6067 u64 persistent_fid, u64 volatile_fid, struct kstatfs *fsdata) 6068 { 6069 struct smb_rqst rqst; 6070 struct smb2_query_info_rsp *rsp = NULL; 6071 struct kvec iov; 6072 struct kvec rsp_iov; 6073 int rc = 0; 6074 int resp_buftype; 6075 struct cifs_ses *ses = tcon->ses; 6076 struct TCP_Server_Info *server; 6077 FILE_SYSTEM_POSIX_INFO *info = NULL; 6078 int flags = 0; 6079 int retries = 0, cur_sleep = 0; 6080 6081 replay_again: 6082 /* reinitialize for possible replay */ 6083 flags = 0; 6084 server = cifs_pick_channel(ses); 6085 6086 rc = build_qfs_info_req(&iov, tcon, server, 6087 FS_POSIX_INFORMATION, 6088 sizeof(FILE_SYSTEM_POSIX_INFO), 6089 persistent_fid, volatile_fid); 6090 if (rc) 6091 return rc; 6092 6093 if (smb3_encryption_required(tcon)) 6094 flags |= CIFS_TRANSFORM_REQ; 6095 6096 memset(&rqst, 0, sizeof(struct smb_rqst)); 6097 rqst.rq_iov = &iov; 6098 rqst.rq_nvec = 1; 6099 6100 if (retries) { 6101 /* Back-off before retry */ 6102 if (cur_sleep) 6103 msleep(cur_sleep); 6104 smb2_set_replay(server, &rqst); 6105 } 6106 6107 rc = cifs_send_recv(xid, ses, server, 6108 &rqst, &resp_buftype, flags, &rsp_iov); 6109 free_qfs_info_req(&iov); 6110 if (rc) { 6111 cifs_stats_fail_inc(tcon, SMB2_QUERY_INFO_HE); 6112 goto posix_qfsinf_exit; 6113 } 6114 rsp = (struct smb2_query_info_rsp *)rsp_iov.iov_base; 6115 6116 info = (FILE_SYSTEM_POSIX_INFO *)( 6117 le16_to_cpu(rsp->OutputBufferOffset) + (char *)rsp); 6118 rc = smb2_validate_iov(le16_to_cpu(rsp->OutputBufferOffset), 6119 le32_to_cpu(rsp->OutputBufferLength), &rsp_iov, 6120 sizeof(FILE_SYSTEM_POSIX_INFO)); 6121 if (!rc) 6122 copy_posix_fs_info_to_kstatfs(info, fsdata); 6123 6124 posix_qfsinf_exit: 6125 free_rsp_buf(resp_buftype, rsp_iov.iov_base); 6126 6127 if (is_replayable_error(rc) && 6128 smb2_should_replay(tcon, &retries, &cur_sleep)) 6129 goto replay_again; 6130 6131 return rc; 6132 } 6133 6134 int 6135 SMB2_QFS_attr(const unsigned int xid, struct cifs_tcon *tcon, 6136 u64 persistent_fid, u64 volatile_fid, int level) 6137 { 6138 struct smb_rqst rqst; 6139 struct smb2_query_info_rsp *rsp = NULL; 6140 struct kvec iov; 6141 struct kvec rsp_iov; 6142 int rc = 0; 6143 int resp_buftype, max_len, min_len; 6144 struct cifs_ses *ses = tcon->ses; 6145 struct TCP_Server_Info *server; 6146 unsigned int rsp_len, offset; 6147 int flags = 0; 6148 int retries = 0, cur_sleep = 0; 6149 6150 replay_again: 6151 /* reinitialize for possible replay */ 6152 flags = 0; 6153 server = cifs_pick_channel(ses); 6154 6155 if (level == FS_DEVICE_INFORMATION) { 6156 max_len = sizeof(FILE_SYSTEM_DEVICE_INFO); 6157 min_len = sizeof(FILE_SYSTEM_DEVICE_INFO); 6158 } else if (level == FS_ATTRIBUTE_INFORMATION) { 6159 max_len = sizeof(FILE_SYSTEM_ATTRIBUTE_INFO) + MAX_FS_NAME_LEN; 6160 min_len = sizeof(FILE_SYSTEM_ATTRIBUTE_INFO); 6161 } else if (level == FS_SECTOR_SIZE_INFORMATION) { 6162 max_len = sizeof(struct smb3_fs_ss_info); 6163 min_len = sizeof(struct smb3_fs_ss_info); 6164 } else if (level == FS_VOLUME_INFORMATION) { 6165 max_len = sizeof(struct smb3_fs_vol_info) + MAX_VOL_LABEL_LEN; 6166 min_len = sizeof(struct smb3_fs_vol_info); 6167 } else { 6168 cifs_dbg(FYI, "Invalid qfsinfo level %d\n", level); 6169 return -EINVAL; 6170 } 6171 6172 rc = build_qfs_info_req(&iov, tcon, server, 6173 level, max_len, 6174 persistent_fid, volatile_fid); 6175 if (rc) 6176 return rc; 6177 6178 if (smb3_encryption_required(tcon)) 6179 flags |= CIFS_TRANSFORM_REQ; 6180 6181 memset(&rqst, 0, sizeof(struct smb_rqst)); 6182 rqst.rq_iov = &iov; 6183 rqst.rq_nvec = 1; 6184 6185 if (retries) { 6186 /* Back-off before retry */ 6187 if (cur_sleep) 6188 msleep(cur_sleep); 6189 smb2_set_replay(server, &rqst); 6190 } 6191 6192 rc = cifs_send_recv(xid, ses, server, 6193 &rqst, &resp_buftype, flags, &rsp_iov); 6194 free_qfs_info_req(&iov); 6195 if (rc) { 6196 cifs_stats_fail_inc(tcon, SMB2_QUERY_INFO_HE); 6197 goto qfsattr_exit; 6198 } 6199 rsp = (struct smb2_query_info_rsp *)rsp_iov.iov_base; 6200 6201 rsp_len = le32_to_cpu(rsp->OutputBufferLength); 6202 offset = le16_to_cpu(rsp->OutputBufferOffset); 6203 rc = smb2_validate_iov(offset, rsp_len, &rsp_iov, min_len); 6204 if (rc) 6205 goto qfsattr_exit; 6206 6207 if (level == FS_ATTRIBUTE_INFORMATION) 6208 memcpy(&tcon->fsAttrInfo, offset 6209 + (char *)rsp, min_t(unsigned int, 6210 rsp_len, min_len)); 6211 else if (level == FS_DEVICE_INFORMATION) 6212 memcpy(&tcon->fsDevInfo, offset 6213 + (char *)rsp, sizeof(FILE_SYSTEM_DEVICE_INFO)); 6214 else if (level == FS_SECTOR_SIZE_INFORMATION) { 6215 struct smb3_fs_ss_info *ss_info = (struct smb3_fs_ss_info *) 6216 (offset + (char *)rsp); 6217 tcon->ss_flags = le32_to_cpu(ss_info->Flags); 6218 tcon->perf_sector_size = 6219 le32_to_cpu(ss_info->PhysicalBytesPerSectorForPerf); 6220 } else if (level == FS_VOLUME_INFORMATION) { 6221 struct smb3_fs_vol_info *vol_info = (struct smb3_fs_vol_info *) 6222 (offset + (char *)rsp); 6223 tcon->vol_serial_number = vol_info->VolumeSerialNumber; 6224 tcon->vol_create_time = vol_info->VolumeCreationTime; 6225 } 6226 6227 qfsattr_exit: 6228 free_rsp_buf(resp_buftype, rsp_iov.iov_base); 6229 6230 if (is_replayable_error(rc) && 6231 smb2_should_replay(tcon, &retries, &cur_sleep)) 6232 goto replay_again; 6233 6234 return rc; 6235 } 6236 6237 int 6238 smb2_lockv(const unsigned int xid, struct cifs_tcon *tcon, 6239 const __u64 persist_fid, const __u64 volatile_fid, const __u32 pid, 6240 const __u32 num_lock, struct smb2_lock_element *buf) 6241 { 6242 struct smb_rqst rqst; 6243 int rc = 0; 6244 struct smb2_lock_req *req = NULL; 6245 struct kvec iov[2]; 6246 struct kvec rsp_iov; 6247 int resp_buf_type; 6248 unsigned int count; 6249 int flags = CIFS_NO_RSP_BUF; 6250 unsigned int total_len; 6251 struct TCP_Server_Info *server; 6252 int retries = 0, cur_sleep = 0; 6253 6254 replay_again: 6255 /* reinitialize for possible replay */ 6256 flags = CIFS_NO_RSP_BUF; 6257 server = cifs_pick_channel(tcon->ses); 6258 6259 cifs_dbg(FYI, "smb2_lockv num lock %d\n", num_lock); 6260 6261 rc = smb2_plain_req_init(SMB2_LOCK, tcon, server, 6262 (void **) &req, &total_len); 6263 if (rc) 6264 return rc; 6265 6266 if (smb3_encryption_required(tcon)) 6267 flags |= CIFS_TRANSFORM_REQ; 6268 6269 req->hdr.Id.SyncId.ProcessId = cpu_to_le32(pid); 6270 req->LockCount = cpu_to_le16(num_lock); 6271 6272 req->PersistentFileId = persist_fid; 6273 req->VolatileFileId = volatile_fid; 6274 6275 count = num_lock * sizeof(struct smb2_lock_element); 6276 6277 iov[0].iov_base = (char *)req; 6278 iov[0].iov_len = total_len - sizeof(struct smb2_lock_element); 6279 iov[1].iov_base = (char *)buf; 6280 iov[1].iov_len = count; 6281 6282 cifs_stats_inc(&tcon->stats.cifs_stats.num_locks); 6283 6284 memset(&rqst, 0, sizeof(struct smb_rqst)); 6285 rqst.rq_iov = iov; 6286 rqst.rq_nvec = 2; 6287 6288 if (retries) { 6289 /* Back-off before retry */ 6290 if (cur_sleep) 6291 msleep(cur_sleep); 6292 smb2_set_replay(server, &rqst); 6293 } 6294 6295 rc = cifs_send_recv(xid, tcon->ses, server, 6296 &rqst, &resp_buf_type, flags, 6297 &rsp_iov); 6298 cifs_small_buf_release(req); 6299 if (rc) { 6300 cifs_dbg(FYI, "Send error in smb2_lockv = %d\n", rc); 6301 cifs_stats_fail_inc(tcon, SMB2_LOCK_HE); 6302 trace_smb3_lock_err(xid, persist_fid, tcon->tid, 6303 tcon->ses->Suid, rc); 6304 } 6305 6306 if (is_replayable_error(rc) && 6307 smb2_should_replay(tcon, &retries, &cur_sleep)) 6308 goto replay_again; 6309 6310 return rc; 6311 } 6312 6313 int 6314 SMB2_lock(const unsigned int xid, struct cifs_tcon *tcon, 6315 const __u64 persist_fid, const __u64 volatile_fid, const __u32 pid, 6316 const __u64 length, const __u64 offset, const __u32 lock_flags, 6317 const bool wait) 6318 { 6319 struct smb2_lock_element lock; 6320 6321 lock.Offset = cpu_to_le64(offset); 6322 lock.Length = cpu_to_le64(length); 6323 lock.Flags = cpu_to_le32(lock_flags); 6324 if (!wait && lock_flags != SMB2_LOCKFLAG_UNLOCK) 6325 lock.Flags |= cpu_to_le32(SMB2_LOCKFLAG_FAIL_IMMEDIATELY); 6326 6327 return smb2_lockv(xid, tcon, persist_fid, volatile_fid, pid, 1, &lock); 6328 } 6329 6330 int 6331 SMB2_lease_break(const unsigned int xid, struct cifs_tcon *tcon, 6332 __u8 *lease_key, const __le32 lease_state) 6333 { 6334 struct smb_rqst rqst; 6335 int rc; 6336 struct smb2_lease_ack *req = NULL; 6337 struct cifs_ses *ses = tcon->ses; 6338 int flags = CIFS_OBREAK_OP; 6339 unsigned int total_len; 6340 struct kvec iov[1]; 6341 struct kvec rsp_iov; 6342 int resp_buf_type; 6343 __u64 *please_key_high; 6344 __u64 *please_key_low; 6345 struct TCP_Server_Info *server = cifs_pick_channel(tcon->ses); 6346 6347 cifs_dbg(FYI, "SMB2_lease_break\n"); 6348 rc = smb2_plain_req_init(SMB2_OPLOCK_BREAK, tcon, server, 6349 (void **) &req, &total_len); 6350 if (rc) 6351 return rc; 6352 6353 if (smb3_encryption_required(tcon)) 6354 flags |= CIFS_TRANSFORM_REQ; 6355 6356 req->hdr.CreditRequest = cpu_to_le16(1); 6357 req->StructureSize = cpu_to_le16(36); 6358 total_len += 12; 6359 6360 memcpy(req->LeaseKey, lease_key, SMB2_LEASE_KEY_SIZE); 6361 req->LeaseState = lease_state; 6362 6363 flags |= CIFS_NO_RSP_BUF; 6364 6365 iov[0].iov_base = (char *)req; 6366 iov[0].iov_len = total_len; 6367 6368 memset(&rqst, 0, sizeof(struct smb_rqst)); 6369 rqst.rq_iov = iov; 6370 rqst.rq_nvec = 1; 6371 6372 rc = cifs_send_recv(xid, ses, server, 6373 &rqst, &resp_buf_type, flags, &rsp_iov); 6374 cifs_small_buf_release(req); 6375 6376 please_key_low = (__u64 *)lease_key; 6377 please_key_high = (__u64 *)(lease_key+8); 6378 if (rc) { 6379 cifs_stats_fail_inc(tcon, SMB2_OPLOCK_BREAK_HE); 6380 trace_smb3_lease_ack_err(le32_to_cpu(lease_state), tcon->tid, 6381 ses->Suid, *please_key_low, *please_key_high, rc); 6382 cifs_dbg(FYI, "Send error in Lease Break = %d\n", rc); 6383 } else 6384 trace_smb3_lease_ack_done(le32_to_cpu(lease_state), tcon->tid, 6385 ses->Suid, *please_key_low, *please_key_high); 6386 6387 return rc; 6388 } 6389