1 // SPDX-License-Identifier: LGPL-2.1 2 /* 3 * 4 * Copyright (C) International Business Machines Corp., 2009, 2013 5 * Etersoft, 2012 6 * Author(s): Steve French (sfrench@us.ibm.com) 7 * Pavel Shilovsky (pshilovsky@samba.org) 2012 8 * 9 * Contains the routines for constructing the SMB2 PDUs themselves 10 * 11 */ 12 13 /* SMB2 PDU handling routines here - except for leftovers (eg session setup) */ 14 /* Note that there are handle based routines which must be */ 15 /* treated slightly differently for reconnection purposes since we never */ 16 /* want to reuse a stale file handle and only the caller knows the file info */ 17 18 #include <linux/fs.h> 19 #include <linux/kernel.h> 20 #include <linux/vfs.h> 21 #include <linux/task_io_accounting_ops.h> 22 #include <linux/uaccess.h> 23 #include <linux/uuid.h> 24 #include <linux/pagemap.h> 25 #include <linux/xattr.h> 26 #include <linux/netfs.h> 27 #include <trace/events/netfs.h> 28 #include "cifsglob.h" 29 #include "cifsacl.h" 30 #include "cifsproto.h" 31 #include "smb2proto.h" 32 #include "cifs_unicode.h" 33 #include "cifs_debug.h" 34 #include "ntlmssp.h" 35 #include "../common/smb2status.h" 36 #include "smb2glob.h" 37 #include "cifspdu.h" 38 #include "cifs_spnego.h" 39 #include "../common/smbdirect/smbdirect.h" 40 #include "smbdirect.h" 41 #include "trace.h" 42 #ifdef CONFIG_CIFS_DFS_UPCALL 43 #include "dfs_cache.h" 44 #endif 45 #include "cached_dir.h" 46 #include "compress.h" 47 #include "fs_context.h" 48 49 /* 50 * The following table defines the expected "StructureSize" of SMB2 requests 51 * in order by SMB2 command. This is similar to "wct" in SMB/CIFS requests. 52 * 53 * Note that commands are defined in smb2pdu.h in le16 but the array below is 54 * indexed by command in host byte order. 55 */ 56 static const int smb2_req_struct_sizes[NUMBER_OF_SMB2_COMMANDS] = { 57 /* SMB2_NEGOTIATE */ 36, 58 /* SMB2_SESSION_SETUP */ 25, 59 /* SMB2_LOGOFF */ 4, 60 /* SMB2_TREE_CONNECT */ 9, 61 /* SMB2_TREE_DISCONNECT */ 4, 62 /* SMB2_CREATE */ 57, 63 /* SMB2_CLOSE */ 24, 64 /* SMB2_FLUSH */ 24, 65 /* SMB2_READ */ 49, 66 /* SMB2_WRITE */ 49, 67 /* SMB2_LOCK */ 48, 68 /* SMB2_IOCTL */ 57, 69 /* SMB2_CANCEL */ 4, 70 /* SMB2_ECHO */ 4, 71 /* SMB2_QUERY_DIRECTORY */ 33, 72 /* SMB2_CHANGE_NOTIFY */ 32, 73 /* SMB2_QUERY_INFO */ 41, 74 /* SMB2_SET_INFO */ 33, 75 /* SMB2_OPLOCK_BREAK */ 24 /* BB this is 36 for LEASE_BREAK variant */ 76 }; 77 78 int smb3_encryption_required(const struct cifs_tcon *tcon) 79 { 80 if (!tcon || !tcon->ses) 81 return 0; 82 if ((tcon->ses->session_flags & SMB2_SESSION_FLAG_ENCRYPT_DATA) || 83 (tcon->share_flags & SHI1005_FLAGS_ENCRYPT_DATA)) 84 return 1; 85 if (tcon->seal && 86 (tcon->ses->server->capabilities & SMB2_GLOBAL_CAP_ENCRYPTION)) 87 return 1; 88 if (((global_secflags & CIFSSEC_MUST_SEAL) == CIFSSEC_MUST_SEAL) && 89 (tcon->ses->server->capabilities & SMB2_GLOBAL_CAP_ENCRYPTION)) 90 return 1; 91 return 0; 92 } 93 94 static void 95 smb2_hdr_assemble(struct smb2_hdr *shdr, __le16 smb2_cmd, 96 const struct cifs_tcon *tcon, 97 struct TCP_Server_Info *server) 98 { 99 struct smb3_hdr_req *smb3_hdr; 100 101 shdr->ProtocolId = SMB2_PROTO_NUMBER; 102 shdr->StructureSize = cpu_to_le16(64); 103 shdr->Command = smb2_cmd; 104 105 if (server) { 106 /* After reconnect SMB3 must set ChannelSequence on subsequent reqs */ 107 if (server->dialect >= SMB30_PROT_ID) { 108 smb3_hdr = (struct smb3_hdr_req *)shdr; 109 /* 110 * if primary channel is not set yet, use default 111 * channel for chan sequence num 112 */ 113 if (SERVER_IS_CHAN(server)) 114 smb3_hdr->ChannelSequence = 115 cpu_to_le16(server->primary_server->channel_sequence_num); 116 else 117 smb3_hdr->ChannelSequence = 118 cpu_to_le16(server->channel_sequence_num); 119 } 120 spin_lock(&server->req_lock); 121 /* Request up to 10 credits but don't go over the limit. */ 122 if (server->credits >= server->max_credits) 123 shdr->CreditRequest = cpu_to_le16(0); 124 else 125 shdr->CreditRequest = cpu_to_le16( 126 min_t(int, server->max_credits - 127 server->credits, 10)); 128 spin_unlock(&server->req_lock); 129 } else { 130 shdr->CreditRequest = cpu_to_le16(2); 131 } 132 shdr->Id.SyncId.ProcessId = cpu_to_le32((__u16)current->tgid); 133 134 if (!tcon) 135 goto out; 136 137 /* GLOBAL_CAP_LARGE_MTU will only be set if dialect > SMB2.02 */ 138 /* See sections 2.2.4 and 3.2.4.1.5 of MS-SMB2 */ 139 if (server && (server->capabilities & SMB2_GLOBAL_CAP_LARGE_MTU)) 140 shdr->CreditCharge = cpu_to_le16(1); 141 /* else CreditCharge MBZ */ 142 143 shdr->Id.SyncId.TreeId = cpu_to_le32(tcon->tid); 144 /* Uid is not converted */ 145 if (tcon->ses) 146 shdr->SessionId = cpu_to_le64(tcon->ses->Suid); 147 148 /* 149 * If we would set SMB2_FLAGS_DFS_OPERATIONS on open we also would have 150 * to pass the path on the Open SMB prefixed by \\server\share. 151 * Not sure when we would need to do the augmented path (if ever) and 152 * setting this flag breaks the SMB2 open operation since it is 153 * illegal to send an empty path name (without \\server\share prefix) 154 * when the DFS flag is set in the SMB open header. We could 155 * consider setting the flag on all operations other than open 156 * but it is safer to net set it for now. 157 */ 158 /* if (tcon->share_flags & SHI1005_FLAGS_DFS) 159 shdr->Flags |= SMB2_FLAGS_DFS_OPERATIONS; */ 160 161 if (server && server->sign && !smb3_encryption_required(tcon)) 162 shdr->Flags |= SMB2_FLAGS_SIGNED; 163 out: 164 return; 165 } 166 167 /* helper function for code reuse */ 168 static int 169 cifs_chan_skip_or_disable(struct cifs_ses *ses, 170 struct TCP_Server_Info *server, 171 bool from_reconnect) 172 { 173 struct TCP_Server_Info *pserver; 174 unsigned int chan_index; 175 176 if (SERVER_IS_CHAN(server)) { 177 cifs_dbg(VFS, 178 "server %s does not support multichannel anymore. Skip secondary channel\n", 179 ses->server->hostname); 180 181 spin_lock(&ses->chan_lock); 182 chan_index = cifs_ses_get_chan_index(ses, server); 183 if (chan_index == CIFS_INVAL_CHAN_INDEX) { 184 spin_unlock(&ses->chan_lock); 185 goto skip_terminate; 186 } 187 188 ses->chans[chan_index].server = NULL; 189 server->terminate = true; 190 spin_unlock(&ses->chan_lock); 191 192 /* 193 * the above reference of server by channel 194 * needs to be dropped without holding chan_lock 195 * as cifs_put_tcp_session takes a higher lock 196 * i.e. cifs_tcp_ses_lock 197 */ 198 cifs_put_tcp_session(server, from_reconnect); 199 200 cifs_signal_cifsd_for_reconnect(server, false); 201 202 /* mark primary server as needing reconnect */ 203 pserver = server->primary_server; 204 cifs_signal_cifsd_for_reconnect(pserver, false); 205 skip_terminate: 206 return -EHOSTDOWN; 207 } 208 209 cifs_server_dbg(VFS, 210 "server does not support multichannel anymore. Disable all other channels\n"); 211 cifs_disable_secondary_channels(ses); 212 213 214 return 0; 215 } 216 217 static int 218 smb2_reconnect(__le16 smb2_command, struct cifs_tcon *tcon, 219 struct TCP_Server_Info *server, bool from_reconnect) 220 { 221 struct cifs_ses *ses; 222 int xid; 223 int rc = 0; 224 225 /* 226 * SMB2s NegProt, SessSetup, Logoff do not have tcon yet so 227 * check for tcp and smb session status done differently 228 * for those three - in the calling routine. 229 */ 230 if (tcon == NULL) 231 return 0; 232 233 if (smb2_command == SMB2_TREE_CONNECT) 234 return 0; 235 236 spin_lock(&tcon->tc_lock); 237 if (tcon->status == TID_EXITING) { 238 /* 239 * only tree disconnect allowed when disconnecting ... 240 */ 241 if (smb2_command != SMB2_TREE_DISCONNECT) { 242 spin_unlock(&tcon->tc_lock); 243 cifs_tcon_dbg(FYI, "can not send cmd %d while umounting\n", 244 smb2_command); 245 return -ENODEV; 246 } 247 } 248 spin_unlock(&tcon->tc_lock); 249 250 ses = tcon->ses; 251 if (!ses) 252 return -EIO; 253 spin_lock(&ses->ses_lock); 254 if (ses->ses_status == SES_EXITING) { 255 spin_unlock(&ses->ses_lock); 256 return -EIO; 257 } 258 spin_unlock(&ses->ses_lock); 259 if (!ses->server || !server) 260 return -EIO; 261 262 spin_lock(&server->srv_lock); 263 if (server->tcpStatus == CifsNeedReconnect) { 264 /* 265 * Return to caller for TREE_DISCONNECT and LOGOFF and CLOSE 266 * here since they are implicitly done when session drops. 267 */ 268 switch (smb2_command) { 269 /* 270 * BB Should we keep oplock break and add flush to exceptions? 271 */ 272 case SMB2_TREE_DISCONNECT: 273 case SMB2_CANCEL: 274 case SMB2_CLOSE: 275 case SMB2_OPLOCK_BREAK: 276 spin_unlock(&server->srv_lock); 277 return -EAGAIN; 278 } 279 } 280 281 /* if server is marked for termination, cifsd will cleanup */ 282 if (server->terminate) { 283 spin_unlock(&server->srv_lock); 284 return -EHOSTDOWN; 285 } 286 spin_unlock(&server->srv_lock); 287 288 again: 289 rc = cifs_wait_for_server_reconnect(server, tcon->retry); 290 if (rc) 291 return rc; 292 293 spin_lock(&ses->chan_lock); 294 if (!cifs_chan_needs_reconnect(ses, server) && !tcon->need_reconnect) { 295 spin_unlock(&ses->chan_lock); 296 return 0; 297 } 298 spin_unlock(&ses->chan_lock); 299 cifs_tcon_dbg(FYI, "sess reconnect mask: 0x%lx, tcon reconnect: %d\n", 300 tcon->ses->chans_need_reconnect, 301 tcon->need_reconnect); 302 303 mutex_lock(&ses->session_mutex); 304 /* 305 * Handle the case where a concurrent thread failed to negotiate or 306 * killed a channel. 307 */ 308 spin_lock(&server->srv_lock); 309 switch (server->tcpStatus) { 310 case CifsExiting: 311 spin_unlock(&server->srv_lock); 312 mutex_unlock(&ses->session_mutex); 313 return -EHOSTDOWN; 314 case CifsNeedReconnect: 315 spin_unlock(&server->srv_lock); 316 mutex_unlock(&ses->session_mutex); 317 if (!tcon->retry) 318 return -EHOSTDOWN; 319 goto again; 320 default: 321 break; 322 } 323 spin_unlock(&server->srv_lock); 324 325 /* 326 * need to prevent multiple threads trying to simultaneously 327 * reconnect the same SMB session 328 */ 329 spin_lock(&ses->ses_lock); 330 spin_lock(&ses->chan_lock); 331 if (!cifs_chan_needs_reconnect(ses, server) && 332 ses->ses_status == SES_GOOD) { 333 spin_unlock(&ses->chan_lock); 334 spin_unlock(&ses->ses_lock); 335 /* this means that we only need to tree connect */ 336 if (tcon->need_reconnect) 337 goto skip_sess_setup; 338 339 mutex_unlock(&ses->session_mutex); 340 goto out; 341 } 342 spin_unlock(&ses->chan_lock); 343 spin_unlock(&ses->ses_lock); 344 345 rc = cifs_negotiate_protocol(0, ses, server); 346 if (rc) { 347 mutex_unlock(&ses->session_mutex); 348 if (!tcon->retry) 349 return -EHOSTDOWN; 350 goto again; 351 } 352 /* 353 * if server stopped supporting multichannel 354 * and the first channel reconnected, disable all the others. 355 */ 356 if (ses->chan_count > 1 && 357 !(server->capabilities & SMB2_GLOBAL_CAP_MULTI_CHANNEL)) { 358 rc = cifs_chan_skip_or_disable(ses, server, 359 from_reconnect); 360 if (rc) { 361 mutex_unlock(&ses->session_mutex); 362 goto out; 363 } 364 } 365 366 rc = cifs_setup_session(0, ses, server, ses->local_nls); 367 if ((rc == -EACCES) || (rc == -EKEYEXPIRED) || (rc == -EKEYREVOKED)) { 368 /* 369 * Try alternate password for next reconnect (key rotation 370 * could be enabled on the server e.g.) if an alternate 371 * password is available and the current password is expired, 372 * but do not swap on non pwd related errors like host down 373 */ 374 if (ses->password2) 375 swap(ses->password2, ses->password); 376 } 377 if (rc) { 378 mutex_unlock(&ses->session_mutex); 379 if (rc == -EACCES && !tcon->retry) 380 return -EHOSTDOWN; 381 goto out; 382 } 383 384 skip_sess_setup: 385 if (!tcon->need_reconnect) { 386 mutex_unlock(&ses->session_mutex); 387 goto out; 388 } 389 cifs_mark_open_files_invalid(tcon); 390 if (tcon->use_persistent) 391 tcon->need_reopen_files = true; 392 393 rc = cifs_tree_connect(0, tcon); 394 395 cifs_tcon_dbg(FYI, "reconnect tcon rc = %d\n", rc); 396 if (rc) { 397 /* If sess reconnected but tcon didn't, something strange ... */ 398 mutex_unlock(&ses->session_mutex); 399 cifs_tcon_dbg(VFS, "reconnect tcon failed rc = %d\n", rc); 400 goto out; 401 } 402 403 spin_lock(&ses->ses_lock); 404 if (ses->flags & CIFS_SES_FLAG_SCALE_CHANNELS) { 405 spin_unlock(&ses->ses_lock); 406 mutex_unlock(&ses->session_mutex); 407 goto skip_add_channels; 408 } 409 ses->flags |= CIFS_SES_FLAG_SCALE_CHANNELS; 410 spin_unlock(&ses->ses_lock); 411 412 if (!rc && 413 (server->capabilities & SMB2_GLOBAL_CAP_MULTI_CHANNEL) && 414 server->ops->query_server_interfaces) { 415 /* 416 * query server network interfaces, in case they change. 417 * Also mark the session as pending this update while the query 418 * is in progress. This will be used to avoid calling 419 * smb2_reconnect recursively. 420 */ 421 ses->flags |= CIFS_SES_FLAGS_PENDING_QUERY_INTERFACES; 422 xid = get_xid(); 423 rc = server->ops->query_server_interfaces(xid, tcon, false); 424 free_xid(xid); 425 ses->flags &= ~CIFS_SES_FLAGS_PENDING_QUERY_INTERFACES; 426 427 if (!tcon->ipc && !tcon->dummy) 428 queue_delayed_work(cifsiod_wq, &tcon->query_interfaces, 429 (SMB_INTERFACE_POLL_INTERVAL * HZ)); 430 431 mutex_unlock(&ses->session_mutex); 432 433 if (rc == -EOPNOTSUPP && ses->chan_count > 1) { 434 /* 435 * some servers like Azure SMB server do not advertise 436 * that multichannel has been disabled with server 437 * capabilities, rather return STATUS_NOT_IMPLEMENTED. 438 * treat this as server not supporting multichannel 439 */ 440 441 rc = cifs_chan_skip_or_disable(ses, server, 442 from_reconnect); 443 goto skip_add_channels; 444 } else if (rc) 445 cifs_tcon_dbg(FYI, "%s: failed to query server interfaces: %d\n", 446 __func__, rc); 447 448 if (ses->chan_max > ses->chan_count && 449 ses->iface_count && 450 !SERVER_IS_CHAN(server)) { 451 if (ses->chan_count == 1) 452 cifs_server_dbg(VFS, "supports multichannel now\n"); 453 454 cifs_try_adding_channels(ses); 455 } 456 } else { 457 mutex_unlock(&ses->session_mutex); 458 } 459 460 skip_add_channels: 461 spin_lock(&ses->ses_lock); 462 ses->flags &= ~CIFS_SES_FLAG_SCALE_CHANNELS; 463 spin_unlock(&ses->ses_lock); 464 465 if (smb2_command != SMB2_INTERNAL_CMD) 466 mod_delayed_work(cifsiod_wq, &server->reconnect, 0); 467 468 atomic_inc(&tconInfoReconnectCount); 469 out: 470 /* 471 * Check if handle based operation so we know whether we can continue 472 * or not without returning to caller to reset file handle. 473 */ 474 /* 475 * BB Is flush done by server on drop of tcp session? Should we special 476 * case it and skip above? 477 */ 478 switch (smb2_command) { 479 case SMB2_FLUSH: 480 case SMB2_READ: 481 case SMB2_WRITE: 482 case SMB2_LOCK: 483 case SMB2_QUERY_DIRECTORY: 484 case SMB2_CHANGE_NOTIFY: 485 case SMB2_QUERY_INFO: 486 case SMB2_SET_INFO: 487 case SMB2_IOCTL: 488 rc = -EAGAIN; 489 } 490 return rc; 491 } 492 493 static void 494 fill_small_buf(__le16 smb2_command, struct cifs_tcon *tcon, 495 struct TCP_Server_Info *server, 496 void *buf, 497 unsigned int *total_len) 498 { 499 struct smb2_pdu *spdu = buf; 500 /* lookup word count ie StructureSize from table */ 501 __u16 parmsize = smb2_req_struct_sizes[le16_to_cpu(smb2_command)]; 502 503 /* 504 * smaller than SMALL_BUFFER_SIZE but bigger than fixed area of 505 * largest operations (Create) 506 */ 507 memset(buf, 0, 256); 508 509 smb2_hdr_assemble(&spdu->hdr, smb2_command, tcon, server); 510 spdu->StructureSize2 = cpu_to_le16(parmsize); 511 512 *total_len = parmsize + sizeof(struct smb2_hdr); 513 } 514 515 /* 516 * Allocate and return pointer to an SMB request hdr, and set basic 517 * SMB information in the SMB header. If the return code is zero, this 518 * function must have filled in request_buf pointer. 519 */ 520 static int __smb2_plain_req_init(__le16 smb2_command, struct cifs_tcon *tcon, 521 struct TCP_Server_Info *server, 522 void **request_buf, unsigned int *total_len) 523 { 524 /* BB eventually switch this to SMB2 specific small buf size */ 525 switch (smb2_command) { 526 case SMB2_SET_INFO: 527 case SMB2_QUERY_INFO: 528 *request_buf = cifs_buf_get(); 529 break; 530 default: 531 *request_buf = cifs_small_buf_get(); 532 break; 533 } 534 if (*request_buf == NULL) { 535 /* BB should we add a retry in here if not a writepage? */ 536 return -ENOMEM; 537 } 538 539 fill_small_buf(smb2_command, tcon, server, 540 (struct smb2_hdr *)(*request_buf), 541 total_len); 542 543 if (tcon != NULL) { 544 uint16_t com_code = le16_to_cpu(smb2_command); 545 cifs_stats_inc(&tcon->stats.smb2_stats.smb2_com_sent[com_code]); 546 cifs_stats_inc(&tcon->num_smbs_sent); 547 } 548 549 return 0; 550 } 551 552 static int smb2_plain_req_init(__le16 smb2_command, struct cifs_tcon *tcon, 553 struct TCP_Server_Info *server, 554 void **request_buf, unsigned int *total_len) 555 { 556 int rc; 557 558 rc = smb2_reconnect(smb2_command, tcon, server, false); 559 if (rc) 560 return rc; 561 562 return __smb2_plain_req_init(smb2_command, tcon, server, request_buf, 563 total_len); 564 } 565 566 static int smb2_ioctl_req_init(u32 opcode, struct cifs_tcon *tcon, 567 struct TCP_Server_Info *server, 568 void **request_buf, unsigned int *total_len) 569 { 570 /* 571 * Skip reconnect in one of the following cases: 572 * 1. For FSCTL_VALIDATE_NEGOTIATE_INFO IOCTLs 573 * 2. For FSCTL_QUERY_NETWORK_INTERFACE_INFO IOCTL when called from 574 * smb2_reconnect (indicated by CIFS_SES_FLAG_SCALE_CHANNELS ses flag) 575 */ 576 if (opcode == FSCTL_VALIDATE_NEGOTIATE_INFO || 577 (opcode == FSCTL_QUERY_NETWORK_INTERFACE_INFO && 578 (tcon->ses->flags & CIFS_SES_FLAGS_PENDING_QUERY_INTERFACES))) 579 return __smb2_plain_req_init(SMB2_IOCTL, tcon, server, 580 request_buf, total_len); 581 582 return smb2_plain_req_init(SMB2_IOCTL, tcon, server, 583 request_buf, total_len); 584 } 585 586 /* For explanation of negotiate contexts see MS-SMB2 section 2.2.3.1 */ 587 588 static void 589 build_preauth_ctxt(struct smb2_preauth_neg_context *pneg_ctxt) 590 { 591 pneg_ctxt->ContextType = SMB2_PREAUTH_INTEGRITY_CAPABILITIES; 592 pneg_ctxt->DataLength = cpu_to_le16(38); 593 pneg_ctxt->HashAlgorithmCount = cpu_to_le16(1); 594 pneg_ctxt->SaltLength = cpu_to_le16(SMB311_SALT_SIZE); 595 get_random_bytes(pneg_ctxt->Salt, SMB311_SALT_SIZE); 596 pneg_ctxt->HashAlgorithms = SMB2_PREAUTH_INTEGRITY_SHA512; 597 } 598 599 static void 600 build_compression_ctxt(struct smb2_compression_capabilities_context *pneg_ctxt) 601 { 602 pneg_ctxt->ContextType = SMB2_COMPRESSION_CAPABILITIES; 603 pneg_ctxt->DataLength = 604 cpu_to_le16(sizeof(struct smb2_compression_capabilities_context) 605 - sizeof(struct smb2_neg_context)); 606 pneg_ctxt->CompressionAlgorithmCount = cpu_to_le16(3); 607 pneg_ctxt->CompressionAlgorithms[0] = SMB3_COMPRESS_LZ77; 608 pneg_ctxt->CompressionAlgorithms[1] = SMB3_COMPRESS_LZ77_HUFF; 609 pneg_ctxt->CompressionAlgorithms[2] = SMB3_COMPRESS_LZNT1; 610 } 611 612 static unsigned int 613 build_signing_ctxt(struct smb2_signing_capabilities *pneg_ctxt) 614 { 615 unsigned int ctxt_len = sizeof(struct smb2_signing_capabilities); 616 unsigned short num_algs = 1; /* number of signing algorithms sent */ 617 618 pneg_ctxt->ContextType = SMB2_SIGNING_CAPABILITIES; 619 /* 620 * Context Data length must be rounded to multiple of 8 for some servers 621 */ 622 pneg_ctxt->DataLength = cpu_to_le16(ALIGN(sizeof(struct smb2_signing_capabilities) - 623 sizeof(struct smb2_neg_context) + 624 (num_algs * sizeof(u16)), 8)); 625 pneg_ctxt->SigningAlgorithmCount = cpu_to_le16(num_algs); 626 pneg_ctxt->SigningAlgorithms[0] = cpu_to_le16(SIGNING_ALG_AES_CMAC); 627 628 ctxt_len += sizeof(__le16) * num_algs; 629 ctxt_len = ALIGN(ctxt_len, 8); 630 return ctxt_len; 631 /* TBD add SIGNING_ALG_AES_GMAC and/or SIGNING_ALG_HMAC_SHA256 */ 632 } 633 634 static void 635 build_encrypt_ctxt(struct smb2_encryption_neg_context *pneg_ctxt) 636 { 637 pneg_ctxt->ContextType = SMB2_ENCRYPTION_CAPABILITIES; 638 if (require_gcm_256) { 639 pneg_ctxt->DataLength = cpu_to_le16(4); /* Cipher Count + 1 cipher */ 640 pneg_ctxt->CipherCount = cpu_to_le16(1); 641 pneg_ctxt->Ciphers[0] = SMB2_ENCRYPTION_AES256_GCM; 642 } else if (enable_gcm_256) { 643 pneg_ctxt->DataLength = cpu_to_le16(8); /* Cipher Count + 3 ciphers */ 644 pneg_ctxt->CipherCount = cpu_to_le16(3); 645 pneg_ctxt->Ciphers[0] = SMB2_ENCRYPTION_AES128_GCM; 646 pneg_ctxt->Ciphers[1] = SMB2_ENCRYPTION_AES256_GCM; 647 pneg_ctxt->Ciphers[2] = SMB2_ENCRYPTION_AES128_CCM; 648 } else { 649 pneg_ctxt->DataLength = cpu_to_le16(6); /* Cipher Count + 2 ciphers */ 650 pneg_ctxt->CipherCount = cpu_to_le16(2); 651 pneg_ctxt->Ciphers[0] = SMB2_ENCRYPTION_AES128_GCM; 652 pneg_ctxt->Ciphers[1] = SMB2_ENCRYPTION_AES128_CCM; 653 } 654 } 655 656 static unsigned int 657 build_netname_ctxt(struct smb2_netname_neg_context *pneg_ctxt, char *hostname) 658 { 659 struct nls_table *cp = load_nls_default(); 660 661 pneg_ctxt->ContextType = SMB2_NETNAME_NEGOTIATE_CONTEXT_ID; 662 663 /* copy up to max of first 100 bytes of server name to NetName field */ 664 pneg_ctxt->DataLength = cpu_to_le16(2 * cifs_strtoUTF16(pneg_ctxt->NetName, hostname, 100, cp)); 665 /* context size is DataLength + minimal smb2_neg_context */ 666 return ALIGN(le16_to_cpu(pneg_ctxt->DataLength) + sizeof(struct smb2_neg_context), 8); 667 } 668 669 static void 670 build_posix_ctxt(struct smb2_posix_neg_context *pneg_ctxt) 671 { 672 pneg_ctxt->ContextType = SMB2_POSIX_EXTENSIONS_AVAILABLE; 673 pneg_ctxt->DataLength = cpu_to_le16(POSIX_CTXT_DATA_LEN); 674 /* SMB2_CREATE_TAG_POSIX is "0x93AD25509CB411E7B42383DE968BCD7C" */ 675 pneg_ctxt->Name[0] = 0x93; 676 pneg_ctxt->Name[1] = 0xAD; 677 pneg_ctxt->Name[2] = 0x25; 678 pneg_ctxt->Name[3] = 0x50; 679 pneg_ctxt->Name[4] = 0x9C; 680 pneg_ctxt->Name[5] = 0xB4; 681 pneg_ctxt->Name[6] = 0x11; 682 pneg_ctxt->Name[7] = 0xE7; 683 pneg_ctxt->Name[8] = 0xB4; 684 pneg_ctxt->Name[9] = 0x23; 685 pneg_ctxt->Name[10] = 0x83; 686 pneg_ctxt->Name[11] = 0xDE; 687 pneg_ctxt->Name[12] = 0x96; 688 pneg_ctxt->Name[13] = 0x8B; 689 pneg_ctxt->Name[14] = 0xCD; 690 pneg_ctxt->Name[15] = 0x7C; 691 } 692 693 static void 694 assemble_neg_contexts(struct smb2_negotiate_req *req, 695 struct TCP_Server_Info *server, unsigned int *total_len) 696 { 697 unsigned int ctxt_len, neg_context_count; 698 struct TCP_Server_Info *pserver; 699 char *pneg_ctxt; 700 char *hostname; 701 702 if (*total_len > 200) { 703 /* In case length corrupted don't want to overrun smb buffer */ 704 cifs_server_dbg(VFS, "Bad frame length assembling neg contexts\n"); 705 return; 706 } 707 708 /* 709 * round up total_len of fixed part of SMB3 negotiate request to 8 710 * byte boundary before adding negotiate contexts 711 */ 712 *total_len = ALIGN(*total_len, 8); 713 714 pneg_ctxt = (*total_len) + (char *)req; 715 req->NegotiateContextOffset = cpu_to_le32(*total_len); 716 717 build_preauth_ctxt((struct smb2_preauth_neg_context *)pneg_ctxt); 718 ctxt_len = ALIGN(sizeof(struct smb2_preauth_neg_context), 8); 719 *total_len += ctxt_len; 720 pneg_ctxt += ctxt_len; 721 722 build_encrypt_ctxt((struct smb2_encryption_neg_context *)pneg_ctxt); 723 ctxt_len = ALIGN(sizeof(struct smb2_encryption_neg_context), 8); 724 *total_len += ctxt_len; 725 pneg_ctxt += ctxt_len; 726 727 /* 728 * secondary channels don't have the hostname field populated 729 * use the hostname field in the primary channel instead 730 */ 731 pserver = SERVER_IS_CHAN(server) ? server->primary_server : server; 732 cifs_server_lock(pserver); 733 hostname = pserver->hostname; 734 if (hostname && (hostname[0] != 0)) { 735 ctxt_len = build_netname_ctxt((struct smb2_netname_neg_context *)pneg_ctxt, 736 hostname); 737 *total_len += ctxt_len; 738 pneg_ctxt += ctxt_len; 739 neg_context_count = 3; 740 } else 741 neg_context_count = 2; 742 cifs_server_unlock(pserver); 743 744 build_posix_ctxt((struct smb2_posix_neg_context *)pneg_ctxt); 745 *total_len += sizeof(struct smb2_posix_neg_context); 746 pneg_ctxt += sizeof(struct smb2_posix_neg_context); 747 neg_context_count++; 748 749 if (server->compression.requested) { 750 build_compression_ctxt((struct smb2_compression_capabilities_context *) 751 pneg_ctxt); 752 ctxt_len = ALIGN(sizeof(struct smb2_compression_capabilities_context), 8); 753 *total_len += ctxt_len; 754 pneg_ctxt += ctxt_len; 755 neg_context_count++; 756 } 757 758 if (enable_negotiate_signing) { 759 ctxt_len = build_signing_ctxt((struct smb2_signing_capabilities *) 760 pneg_ctxt); 761 *total_len += ctxt_len; 762 pneg_ctxt += ctxt_len; 763 neg_context_count++; 764 } 765 766 /* check for and add transport_capabilities and signing capabilities */ 767 req->NegotiateContextCount = cpu_to_le16(neg_context_count); 768 769 } 770 771 /* If invalid preauth context warn but use what we requested, SHA-512 */ 772 static void decode_preauth_context(struct smb2_preauth_neg_context *ctxt) 773 { 774 unsigned int len = le16_to_cpu(ctxt->DataLength); 775 776 /* 777 * Caller checked that DataLength remains within SMB boundary. We still 778 * need to confirm that one HashAlgorithms member is accounted for. 779 */ 780 if (len < MIN_PREAUTH_CTXT_DATA_LEN) { 781 pr_warn_once("server sent bad preauth context\n"); 782 return; 783 } else if (len < MIN_PREAUTH_CTXT_DATA_LEN + le16_to_cpu(ctxt->SaltLength)) { 784 pr_warn_once("server sent invalid SaltLength\n"); 785 return; 786 } 787 if (le16_to_cpu(ctxt->HashAlgorithmCount) != 1) 788 pr_warn_once("Invalid SMB3 hash algorithm count\n"); 789 if (ctxt->HashAlgorithms != SMB2_PREAUTH_INTEGRITY_SHA512) 790 pr_warn_once("unknown SMB3 hash algorithm\n"); 791 } 792 793 static void decode_compress_ctx(struct TCP_Server_Info *server, 794 struct smb2_compression_capabilities_context *ctxt) 795 { 796 unsigned int len = le16_to_cpu(ctxt->DataLength); 797 __le16 alg; 798 799 server->compression.enabled = false; 800 801 /* 802 * Caller checked that DataLength remains within SMB boundary. We still 803 * need to confirm that one CompressionAlgorithms member is accounted 804 * for. 805 */ 806 if (len < 10) { 807 pr_warn_once("server sent bad compression cntxt\n"); 808 return; 809 } 810 811 if (le16_to_cpu(ctxt->CompressionAlgorithmCount) != 1) { 812 pr_warn_once("invalid SMB3 compress algorithm count\n"); 813 return; 814 } 815 816 alg = ctxt->CompressionAlgorithms[0]; 817 818 /* 'NONE' (0) compressor type is never negotiated */ 819 if (alg == 0 || le16_to_cpu(alg) > 3) { 820 pr_warn_once("invalid compression algorithm '%u'\n", alg); 821 return; 822 } 823 824 server->compression.alg = alg; 825 server->compression.enabled = true; 826 } 827 828 static int decode_encrypt_ctx(struct TCP_Server_Info *server, 829 struct smb2_encryption_neg_context *ctxt) 830 { 831 unsigned int len = le16_to_cpu(ctxt->DataLength); 832 833 cifs_dbg(FYI, "decode SMB3.11 encryption neg context of len %d\n", len); 834 /* 835 * Caller checked that DataLength remains within SMB boundary. We still 836 * need to confirm that one Cipher flexible array member is accounted 837 * for. 838 */ 839 if (len < MIN_ENCRYPT_CTXT_DATA_LEN) { 840 pr_warn_once("server sent bad crypto ctxt len\n"); 841 return -EINVAL; 842 } 843 844 if (le16_to_cpu(ctxt->CipherCount) != 1) { 845 pr_warn_once("Invalid SMB3.11 cipher count\n"); 846 return -EINVAL; 847 } 848 cifs_dbg(FYI, "SMB311 cipher type:%d\n", le16_to_cpu(ctxt->Ciphers[0])); 849 if (require_gcm_256) { 850 if (ctxt->Ciphers[0] != SMB2_ENCRYPTION_AES256_GCM) { 851 cifs_dbg(VFS, "Server does not support requested encryption type (AES256 GCM)\n"); 852 return -EOPNOTSUPP; 853 } 854 } else if (ctxt->Ciphers[0] == 0) { 855 /* 856 * e.g. if server only supported AES256_CCM (very unlikely) 857 * or server supported no encryption types or had all disabled. 858 * Since GLOBAL_CAP_ENCRYPTION will be not set, in the case 859 * in which mount requested encryption ("seal") checks later 860 * on during tree connection will return proper rc, but if 861 * seal not requested by client, since server is allowed to 862 * return 0 to indicate no supported cipher, we can't fail here 863 */ 864 server->cipher_type = 0; 865 server->capabilities &= ~SMB2_GLOBAL_CAP_ENCRYPTION; 866 pr_warn_once("Server does not support requested encryption types\n"); 867 return 0; 868 } else if ((ctxt->Ciphers[0] != SMB2_ENCRYPTION_AES128_CCM) && 869 (ctxt->Ciphers[0] != SMB2_ENCRYPTION_AES128_GCM) && 870 (ctxt->Ciphers[0] != SMB2_ENCRYPTION_AES256_GCM)) { 871 /* server returned a cipher we didn't ask for */ 872 pr_warn_once("Invalid SMB3.11 cipher returned\n"); 873 return -EINVAL; 874 } 875 server->cipher_type = ctxt->Ciphers[0]; 876 server->capabilities |= SMB2_GLOBAL_CAP_ENCRYPTION; 877 return 0; 878 } 879 880 static void decode_signing_ctx(struct TCP_Server_Info *server, 881 struct smb2_signing_capabilities *pctxt) 882 { 883 unsigned int len = le16_to_cpu(pctxt->DataLength); 884 885 /* 886 * Caller checked that DataLength remains within SMB boundary. We still 887 * need to confirm that one SigningAlgorithms flexible array member is 888 * accounted for. 889 */ 890 if ((len < 4) || (len > 16)) { 891 pr_warn_once("server sent bad signing negcontext\n"); 892 return; 893 } 894 if (le16_to_cpu(pctxt->SigningAlgorithmCount) != 1) { 895 pr_warn_once("Invalid signing algorithm count\n"); 896 return; 897 } 898 if (le16_to_cpu(pctxt->SigningAlgorithms[0]) > 2) { 899 pr_warn_once("unknown signing algorithm\n"); 900 return; 901 } 902 903 server->signing_negotiated = true; 904 server->signing_algorithm = le16_to_cpu(pctxt->SigningAlgorithms[0]); 905 cifs_dbg(FYI, "signing algorithm %d chosen\n", 906 server->signing_algorithm); 907 } 908 909 910 static int smb311_decode_neg_context(struct smb2_negotiate_rsp *rsp, 911 struct TCP_Server_Info *server, 912 unsigned int len_of_smb) 913 { 914 struct smb2_neg_context *pctx; 915 unsigned int offset = le32_to_cpu(rsp->NegotiateContextOffset); 916 unsigned int ctxt_cnt = le16_to_cpu(rsp->NegotiateContextCount); 917 unsigned int len_of_ctxts, i; 918 int rc = 0; 919 920 cifs_dbg(FYI, "decoding %d negotiate contexts\n", ctxt_cnt); 921 if (len_of_smb <= offset) { 922 cifs_server_dbg(VFS, "Invalid response: negotiate context offset\n"); 923 return -EINVAL; 924 } 925 926 len_of_ctxts = len_of_smb - offset; 927 928 for (i = 0; i < ctxt_cnt; i++) { 929 int clen; 930 /* check that offset is not beyond end of SMB */ 931 if (len_of_ctxts < sizeof(struct smb2_neg_context)) 932 break; 933 934 pctx = (struct smb2_neg_context *)(offset + (char *)rsp); 935 clen = sizeof(struct smb2_neg_context) 936 + le16_to_cpu(pctx->DataLength); 937 /* 938 * 2.2.4 SMB2 NEGOTIATE Response 939 * Subsequent negotiate contexts MUST appear at the first 8-byte 940 * aligned offset following the previous negotiate context. 941 */ 942 if (i + 1 != ctxt_cnt) 943 clen = ALIGN(clen, 8); 944 if (clen > len_of_ctxts) 945 break; 946 947 if (pctx->ContextType == SMB2_PREAUTH_INTEGRITY_CAPABILITIES) 948 decode_preauth_context( 949 (struct smb2_preauth_neg_context *)pctx); 950 else if (pctx->ContextType == SMB2_ENCRYPTION_CAPABILITIES) 951 rc = decode_encrypt_ctx(server, 952 (struct smb2_encryption_neg_context *)pctx); 953 else if (pctx->ContextType == SMB2_COMPRESSION_CAPABILITIES) 954 decode_compress_ctx(server, 955 (struct smb2_compression_capabilities_context *)pctx); 956 else if (pctx->ContextType == SMB2_POSIX_EXTENSIONS_AVAILABLE) 957 server->posix_ext_supported = true; 958 else if (pctx->ContextType == SMB2_SIGNING_CAPABILITIES) 959 decode_signing_ctx(server, 960 (struct smb2_signing_capabilities *)pctx); 961 else 962 cifs_server_dbg(VFS, "unknown negcontext of type %d ignored\n", 963 le16_to_cpu(pctx->ContextType)); 964 if (rc) 965 break; 966 967 offset += clen; 968 len_of_ctxts -= clen; 969 } 970 return rc; 971 } 972 973 static struct create_posix * 974 create_posix_buf(umode_t mode) 975 { 976 struct create_posix *buf; 977 978 buf = kzalloc(sizeof(struct create_posix), 979 GFP_KERNEL); 980 if (!buf) 981 return NULL; 982 983 buf->ccontext.DataOffset = 984 cpu_to_le16(offsetof(struct create_posix, Mode)); 985 buf->ccontext.DataLength = cpu_to_le32(4); 986 buf->ccontext.NameOffset = 987 cpu_to_le16(offsetof(struct create_posix, Name)); 988 buf->ccontext.NameLength = cpu_to_le16(16); 989 990 /* SMB2_CREATE_TAG_POSIX is "0x93AD25509CB411E7B42383DE968BCD7C" */ 991 buf->Name[0] = 0x93; 992 buf->Name[1] = 0xAD; 993 buf->Name[2] = 0x25; 994 buf->Name[3] = 0x50; 995 buf->Name[4] = 0x9C; 996 buf->Name[5] = 0xB4; 997 buf->Name[6] = 0x11; 998 buf->Name[7] = 0xE7; 999 buf->Name[8] = 0xB4; 1000 buf->Name[9] = 0x23; 1001 buf->Name[10] = 0x83; 1002 buf->Name[11] = 0xDE; 1003 buf->Name[12] = 0x96; 1004 buf->Name[13] = 0x8B; 1005 buf->Name[14] = 0xCD; 1006 buf->Name[15] = 0x7C; 1007 buf->Mode = cpu_to_le32(mode); 1008 cifs_dbg(FYI, "mode on posix create 0%o\n", mode); 1009 return buf; 1010 } 1011 1012 static int 1013 add_posix_context(struct kvec *iov, unsigned int *num_iovec, umode_t mode) 1014 { 1015 unsigned int num = *num_iovec; 1016 1017 iov[num].iov_base = create_posix_buf(mode); 1018 if (mode == ACL_NO_MODE) 1019 cifs_dbg(FYI, "%s: no mode\n", __func__); 1020 if (iov[num].iov_base == NULL) 1021 return -ENOMEM; 1022 iov[num].iov_len = sizeof(struct create_posix); 1023 *num_iovec = num + 1; 1024 return 0; 1025 } 1026 1027 1028 /* 1029 * 1030 * SMB2 Worker functions follow: 1031 * 1032 * The general structure of the worker functions is: 1033 * 1) Call smb2_init (assembles SMB2 header) 1034 * 2) Initialize SMB2 command specific fields in fixed length area of SMB 1035 * 3) Call smb_sendrcv2 (sends request on socket and waits for response) 1036 * 4) Decode SMB2 command specific fields in the fixed length area 1037 * 5) Decode variable length data area (if any for this SMB2 command type) 1038 * 6) Call free smb buffer 1039 * 7) return 1040 * 1041 */ 1042 1043 int 1044 SMB2_negotiate(const unsigned int xid, 1045 struct cifs_ses *ses, 1046 struct TCP_Server_Info *server) 1047 { 1048 struct smb_rqst rqst; 1049 struct smb2_negotiate_req *req; 1050 struct smb2_negotiate_rsp *rsp; 1051 struct kvec iov[1]; 1052 struct kvec rsp_iov; 1053 int rc; 1054 int resp_buftype; 1055 int blob_offset, blob_length; 1056 char *security_blob; 1057 int flags = CIFS_NEG_OP; 1058 unsigned int total_len; 1059 1060 cifs_dbg(FYI, "Negotiate protocol\n"); 1061 1062 if (!server) { 1063 WARN(1, "%s: server is NULL!\n", __func__); 1064 return -EIO; 1065 } 1066 1067 rc = smb2_plain_req_init(SMB2_NEGOTIATE, NULL, server, 1068 (void **) &req, &total_len); 1069 if (rc) 1070 return rc; 1071 1072 req->hdr.SessionId = 0; 1073 1074 memset(server->preauth_sha_hash, 0, SMB2_PREAUTH_HASH_SIZE); 1075 memset(ses->preauth_sha_hash, 0, SMB2_PREAUTH_HASH_SIZE); 1076 1077 if (strcmp(server->vals->version_string, 1078 SMB3ANY_VERSION_STRING) == 0) { 1079 req->Dialects[0] = cpu_to_le16(SMB30_PROT_ID); 1080 req->Dialects[1] = cpu_to_le16(SMB302_PROT_ID); 1081 req->Dialects[2] = cpu_to_le16(SMB311_PROT_ID); 1082 req->DialectCount = cpu_to_le16(3); 1083 total_len += 6; 1084 } else if (strcmp(server->vals->version_string, 1085 SMBDEFAULT_VERSION_STRING) == 0) { 1086 req->Dialects[0] = cpu_to_le16(SMB21_PROT_ID); 1087 req->Dialects[1] = cpu_to_le16(SMB30_PROT_ID); 1088 req->Dialects[2] = cpu_to_le16(SMB302_PROT_ID); 1089 req->Dialects[3] = cpu_to_le16(SMB311_PROT_ID); 1090 req->DialectCount = cpu_to_le16(4); 1091 total_len += 8; 1092 } else { 1093 /* otherwise send specific dialect */ 1094 req->Dialects[0] = cpu_to_le16(server->vals->protocol_id); 1095 req->DialectCount = cpu_to_le16(1); 1096 total_len += 2; 1097 } 1098 1099 /* only one of SMB2 signing flags may be set in SMB2 request */ 1100 if (ses->sign) 1101 req->SecurityMode = cpu_to_le16(SMB2_NEGOTIATE_SIGNING_REQUIRED); 1102 else if (global_secflags & CIFSSEC_MAY_SIGN) 1103 req->SecurityMode = cpu_to_le16(SMB2_NEGOTIATE_SIGNING_ENABLED); 1104 else 1105 req->SecurityMode = 0; 1106 1107 req->Capabilities = cpu_to_le32(server->vals->req_capabilities); 1108 if (ses->chan_max > 1) 1109 req->Capabilities |= cpu_to_le32(SMB2_GLOBAL_CAP_MULTI_CHANNEL); 1110 1111 /* ClientGUID must be zero for SMB2.02 dialect */ 1112 if (server->vals->protocol_id == SMB20_PROT_ID) 1113 memset(req->ClientGUID, 0, SMB2_CLIENT_GUID_SIZE); 1114 else { 1115 memcpy(req->ClientGUID, server->client_guid, 1116 SMB2_CLIENT_GUID_SIZE); 1117 if ((server->vals->protocol_id == SMB311_PROT_ID) || 1118 (strcmp(server->vals->version_string, 1119 SMB3ANY_VERSION_STRING) == 0) || 1120 (strcmp(server->vals->version_string, 1121 SMBDEFAULT_VERSION_STRING) == 0)) 1122 assemble_neg_contexts(req, server, &total_len); 1123 } 1124 iov[0].iov_base = (char *)req; 1125 iov[0].iov_len = total_len; 1126 1127 memset(&rqst, 0, sizeof(struct smb_rqst)); 1128 rqst.rq_iov = iov; 1129 rqst.rq_nvec = 1; 1130 1131 rc = cifs_send_recv(xid, ses, server, 1132 &rqst, &resp_buftype, flags, &rsp_iov); 1133 cifs_small_buf_release(req); 1134 rsp = (struct smb2_negotiate_rsp *)rsp_iov.iov_base; 1135 /* 1136 * No tcon so can't do 1137 * cifs_stats_inc(&tcon->stats.smb2_stats.smb2_com_fail[SMB2...]); 1138 */ 1139 if (rc == -EOPNOTSUPP) { 1140 cifs_server_dbg(VFS, "Dialect not supported by server. Consider specifying vers=1.0 or vers=2.0 on mount for accessing older servers\n"); 1141 goto neg_exit; 1142 } else if (rc != 0) 1143 goto neg_exit; 1144 1145 rc = -EIO; 1146 if (strcmp(server->vals->version_string, 1147 SMB3ANY_VERSION_STRING) == 0) { 1148 if (rsp->DialectRevision == cpu_to_le16(SMB20_PROT_ID)) { 1149 cifs_server_dbg(VFS, 1150 "SMB2 dialect returned but not requested\n"); 1151 goto neg_exit; 1152 } else if (rsp->DialectRevision == cpu_to_le16(SMB21_PROT_ID)) { 1153 cifs_server_dbg(VFS, 1154 "SMB2.1 dialect returned but not requested\n"); 1155 goto neg_exit; 1156 } else if (rsp->DialectRevision == cpu_to_le16(SMB311_PROT_ID)) { 1157 /* ops set to 3.0 by default for default so update */ 1158 server->ops = &smb311_operations; 1159 server->vals = &smb311_values; 1160 } 1161 } else if (strcmp(server->vals->version_string, 1162 SMBDEFAULT_VERSION_STRING) == 0) { 1163 if (rsp->DialectRevision == cpu_to_le16(SMB20_PROT_ID)) { 1164 cifs_server_dbg(VFS, 1165 "SMB2 dialect returned but not requested\n"); 1166 goto neg_exit; 1167 } else if (rsp->DialectRevision == cpu_to_le16(SMB21_PROT_ID)) { 1168 /* ops set to 3.0 by default for default so update */ 1169 server->ops = &smb21_operations; 1170 server->vals = &smb21_values; 1171 } else if (rsp->DialectRevision == cpu_to_le16(SMB311_PROT_ID)) { 1172 server->ops = &smb311_operations; 1173 server->vals = &smb311_values; 1174 } 1175 } else if (le16_to_cpu(rsp->DialectRevision) != 1176 server->vals->protocol_id) { 1177 /* if requested single dialect ensure returned dialect matched */ 1178 cifs_server_dbg(VFS, "Invalid 0x%x dialect returned: not requested\n", 1179 le16_to_cpu(rsp->DialectRevision)); 1180 goto neg_exit; 1181 } 1182 1183 cifs_dbg(FYI, "mode 0x%x\n", rsp->SecurityMode); 1184 1185 if (rsp->DialectRevision == cpu_to_le16(SMB20_PROT_ID)) 1186 cifs_dbg(FYI, "negotiated smb2.0 dialect\n"); 1187 else if (rsp->DialectRevision == cpu_to_le16(SMB21_PROT_ID)) 1188 cifs_dbg(FYI, "negotiated smb2.1 dialect\n"); 1189 else if (rsp->DialectRevision == cpu_to_le16(SMB30_PROT_ID)) 1190 cifs_dbg(FYI, "negotiated smb3.0 dialect\n"); 1191 else if (rsp->DialectRevision == cpu_to_le16(SMB302_PROT_ID)) 1192 cifs_dbg(FYI, "negotiated smb3.02 dialect\n"); 1193 else if (rsp->DialectRevision == cpu_to_le16(SMB311_PROT_ID)) 1194 cifs_dbg(FYI, "negotiated smb3.1.1 dialect\n"); 1195 else { 1196 cifs_server_dbg(VFS, "Invalid dialect returned by server 0x%x\n", 1197 le16_to_cpu(rsp->DialectRevision)); 1198 goto neg_exit; 1199 } 1200 1201 rc = 0; 1202 server->dialect = le16_to_cpu(rsp->DialectRevision); 1203 1204 /* 1205 * Keep a copy of the hash after negprot. This hash will be 1206 * the starting hash value for all sessions made from this 1207 * server. 1208 */ 1209 memcpy(server->preauth_sha_hash, ses->preauth_sha_hash, 1210 SMB2_PREAUTH_HASH_SIZE); 1211 1212 /* SMB2 only has an extended negflavor */ 1213 server->negflavor = CIFS_NEGFLAVOR_EXTENDED; 1214 /* set it to the maximum buffer size value we can send with 1 credit */ 1215 server->maxBuf = min_t(unsigned int, le32_to_cpu(rsp->MaxTransactSize), 1216 SMB2_MAX_BUFFER_SIZE); 1217 server->max_read = le32_to_cpu(rsp->MaxReadSize); 1218 server->max_write = le32_to_cpu(rsp->MaxWriteSize); 1219 server->sec_mode = le16_to_cpu(rsp->SecurityMode); 1220 if ((server->sec_mode & SMB2_SEC_MODE_FLAGS_ALL) != server->sec_mode) 1221 cifs_dbg(FYI, "Server returned unexpected security mode 0x%x\n", 1222 server->sec_mode); 1223 server->capabilities = le32_to_cpu(rsp->Capabilities); 1224 /* Internal types */ 1225 server->capabilities |= SMB2_NT_FIND | SMB2_LARGE_FILES; 1226 1227 /* 1228 * SMB3.0 supports only 1 cipher and doesn't have a encryption neg context 1229 * Set the cipher type manually. 1230 */ 1231 if ((server->dialect == SMB30_PROT_ID || 1232 server->dialect == SMB302_PROT_ID) && 1233 (server->capabilities & SMB2_GLOBAL_CAP_ENCRYPTION)) 1234 server->cipher_type = SMB2_ENCRYPTION_AES128_CCM; 1235 1236 security_blob = smb2_get_data_area_len(&blob_offset, &blob_length, 1237 (struct smb2_hdr *)rsp); 1238 /* 1239 * See MS-SMB2 section 2.2.4: if no blob, client picks default which 1240 * for us will be 1241 * ses->sectype = RawNTLMSSP; 1242 * but for time being this is our only auth choice so doesn't matter. 1243 * We just found a server which sets blob length to zero expecting raw. 1244 */ 1245 if (blob_length == 0) { 1246 cifs_dbg(FYI, "missing security blob on negprot\n"); 1247 server->sec_ntlmssp = true; 1248 } 1249 1250 rc = cifs_enable_signing(server, ses->sign); 1251 if (rc) 1252 goto neg_exit; 1253 if (blob_length) { 1254 rc = decode_negTokenInit(security_blob, blob_length, server); 1255 if (rc == 1) 1256 rc = 0; 1257 else if (rc == 0) 1258 rc = -EIO; 1259 } 1260 1261 if (rsp->DialectRevision == cpu_to_le16(SMB311_PROT_ID)) { 1262 if (rsp->NegotiateContextCount) 1263 rc = smb311_decode_neg_context(rsp, server, 1264 rsp_iov.iov_len); 1265 else 1266 cifs_server_dbg(VFS, "Missing expected negotiate contexts\n"); 1267 } 1268 1269 if (server->cipher_type && !rc) 1270 rc = smb3_crypto_aead_allocate(server); 1271 neg_exit: 1272 free_rsp_buf(resp_buftype, rsp); 1273 return rc; 1274 } 1275 1276 int smb3_validate_negotiate(const unsigned int xid, struct cifs_tcon *tcon) 1277 { 1278 int rc; 1279 struct validate_negotiate_info_req *pneg_inbuf; 1280 struct validate_negotiate_info_rsp *pneg_rsp = NULL; 1281 u32 rsplen; 1282 u32 inbuflen; /* max of 4 dialects */ 1283 struct TCP_Server_Info *server = tcon->ses->server; 1284 1285 cifs_dbg(FYI, "validate negotiate\n"); 1286 1287 /* In SMB3.11 preauth integrity supersedes validate negotiate */ 1288 if (server->dialect == SMB311_PROT_ID) 1289 return 0; 1290 1291 /* 1292 * validation ioctl must be signed, so no point sending this if we 1293 * can not sign it (ie are not known user). Even if signing is not 1294 * required (enabled but not negotiated), in those cases we selectively 1295 * sign just this, the first and only signed request on a connection. 1296 * Having validation of negotiate info helps reduce attack vectors. 1297 */ 1298 if (tcon->ses->session_flags & SMB2_SESSION_FLAG_IS_GUEST) 1299 return 0; /* validation requires signing */ 1300 1301 if (tcon->ses->user_name == NULL) { 1302 cifs_dbg(FYI, "Can't validate negotiate: null user mount\n"); 1303 return 0; /* validation requires signing */ 1304 } 1305 1306 if (tcon->ses->session_flags & SMB2_SESSION_FLAG_IS_NULL) 1307 cifs_tcon_dbg(VFS, "Unexpected null user (anonymous) auth flag sent by server\n"); 1308 1309 pneg_inbuf = kmalloc(sizeof(*pneg_inbuf), GFP_NOFS); 1310 if (!pneg_inbuf) 1311 return -ENOMEM; 1312 1313 pneg_inbuf->Capabilities = 1314 cpu_to_le32(server->vals->req_capabilities); 1315 if (tcon->ses->chan_max > 1) 1316 pneg_inbuf->Capabilities |= cpu_to_le32(SMB2_GLOBAL_CAP_MULTI_CHANNEL); 1317 1318 memcpy(pneg_inbuf->Guid, server->client_guid, 1319 SMB2_CLIENT_GUID_SIZE); 1320 1321 if (tcon->ses->sign) 1322 pneg_inbuf->SecurityMode = 1323 cpu_to_le16(SMB2_NEGOTIATE_SIGNING_REQUIRED); 1324 else if (global_secflags & CIFSSEC_MAY_SIGN) 1325 pneg_inbuf->SecurityMode = 1326 cpu_to_le16(SMB2_NEGOTIATE_SIGNING_ENABLED); 1327 else 1328 pneg_inbuf->SecurityMode = 0; 1329 1330 1331 if (strcmp(server->vals->version_string, 1332 SMB3ANY_VERSION_STRING) == 0) { 1333 pneg_inbuf->Dialects[0] = cpu_to_le16(SMB30_PROT_ID); 1334 pneg_inbuf->Dialects[1] = cpu_to_le16(SMB302_PROT_ID); 1335 pneg_inbuf->Dialects[2] = cpu_to_le16(SMB311_PROT_ID); 1336 pneg_inbuf->DialectCount = cpu_to_le16(3); 1337 /* SMB 2.1 not included so subtract one dialect from len */ 1338 inbuflen = sizeof(*pneg_inbuf) - 1339 (sizeof(pneg_inbuf->Dialects[0])); 1340 } else if (strcmp(server->vals->version_string, 1341 SMBDEFAULT_VERSION_STRING) == 0) { 1342 pneg_inbuf->Dialects[0] = cpu_to_le16(SMB21_PROT_ID); 1343 pneg_inbuf->Dialects[1] = cpu_to_le16(SMB30_PROT_ID); 1344 pneg_inbuf->Dialects[2] = cpu_to_le16(SMB302_PROT_ID); 1345 pneg_inbuf->Dialects[3] = cpu_to_le16(SMB311_PROT_ID); 1346 pneg_inbuf->DialectCount = cpu_to_le16(4); 1347 /* structure is big enough for 4 dialects */ 1348 inbuflen = sizeof(*pneg_inbuf); 1349 } else { 1350 /* otherwise specific dialect was requested */ 1351 pneg_inbuf->Dialects[0] = 1352 cpu_to_le16(server->vals->protocol_id); 1353 pneg_inbuf->DialectCount = cpu_to_le16(1); 1354 /* structure is big enough for 4 dialects, sending only 1 */ 1355 inbuflen = sizeof(*pneg_inbuf) - 1356 sizeof(pneg_inbuf->Dialects[0]) * 3; 1357 } 1358 1359 rc = SMB2_ioctl(xid, tcon, NO_FILE_ID, NO_FILE_ID, 1360 FSCTL_VALIDATE_NEGOTIATE_INFO, 1361 (char *)pneg_inbuf, inbuflen, CIFSMaxBufSize, 1362 (char **)&pneg_rsp, &rsplen); 1363 if (rc == -EOPNOTSUPP) { 1364 /* 1365 * Old Windows versions or Netapp SMB server can return 1366 * not supported error. Client should accept it. 1367 */ 1368 cifs_tcon_dbg(VFS, "Server does not support validate negotiate\n"); 1369 rc = 0; 1370 goto out_free_inbuf; 1371 } else if (rc != 0) { 1372 cifs_tcon_dbg(VFS, "validate protocol negotiate failed: %d\n", 1373 rc); 1374 rc = -EIO; 1375 goto out_free_inbuf; 1376 } 1377 1378 rc = -EIO; 1379 if (rsplen != sizeof(*pneg_rsp)) { 1380 cifs_tcon_dbg(VFS, "Invalid protocol negotiate response size: %d\n", 1381 rsplen); 1382 1383 /* relax check since Mac returns max bufsize allowed on ioctl */ 1384 if (rsplen > CIFSMaxBufSize || rsplen < sizeof(*pneg_rsp)) 1385 goto out_free_rsp; 1386 } 1387 1388 /* check validate negotiate info response matches what we got earlier */ 1389 if (pneg_rsp->Dialect != cpu_to_le16(server->dialect)) 1390 goto vneg_out; 1391 1392 if (pneg_rsp->SecurityMode != cpu_to_le16(server->sec_mode)) 1393 goto vneg_out; 1394 1395 /* do not validate server guid because not saved at negprot time yet */ 1396 1397 if ((le32_to_cpu(pneg_rsp->Capabilities) | SMB2_NT_FIND | 1398 SMB2_LARGE_FILES) != server->capabilities) 1399 goto vneg_out; 1400 1401 /* validate negotiate successful */ 1402 rc = 0; 1403 cifs_dbg(FYI, "validate negotiate info successful\n"); 1404 goto out_free_rsp; 1405 1406 vneg_out: 1407 cifs_tcon_dbg(VFS, "protocol revalidation - security settings mismatch\n"); 1408 out_free_rsp: 1409 kfree(pneg_rsp); 1410 out_free_inbuf: 1411 kfree(pneg_inbuf); 1412 return rc; 1413 } 1414 1415 enum securityEnum 1416 smb2_select_sectype(struct TCP_Server_Info *server, enum securityEnum requested) 1417 { 1418 switch (requested) { 1419 case Kerberos: 1420 case RawNTLMSSP: 1421 return requested; 1422 case NTLMv2: 1423 return RawNTLMSSP; 1424 case Unspecified: 1425 if (server->sec_ntlmssp && 1426 (global_secflags & CIFSSEC_MAY_NTLMSSP)) 1427 return RawNTLMSSP; 1428 if ((server->sec_kerberos || server->sec_mskerberos || server->sec_iakerb) && 1429 (global_secflags & CIFSSEC_MAY_KRB5)) 1430 return Kerberos; 1431 fallthrough; 1432 default: 1433 return Unspecified; 1434 } 1435 } 1436 1437 struct SMB2_sess_data { 1438 unsigned int xid; 1439 struct cifs_ses *ses; 1440 struct TCP_Server_Info *server; 1441 struct nls_table *nls_cp; 1442 void (*func)(struct SMB2_sess_data *); 1443 int result; 1444 u64 previous_session; 1445 1446 /* we will send the SMB in three pieces: 1447 * a fixed length beginning part, an optional 1448 * SPNEGO blob (which can be zero length), and a 1449 * last part which will include the strings 1450 * and rest of bcc area. This allows us to avoid 1451 * a large buffer 17K allocation 1452 */ 1453 int buf0_type; 1454 struct kvec iov[2]; 1455 }; 1456 1457 static int 1458 SMB2_sess_alloc_buffer(struct SMB2_sess_data *sess_data) 1459 { 1460 int rc; 1461 struct cifs_ses *ses = sess_data->ses; 1462 struct TCP_Server_Info *server = sess_data->server; 1463 struct smb2_sess_setup_req *req; 1464 unsigned int total_len; 1465 bool is_binding = false; 1466 1467 rc = smb2_plain_req_init(SMB2_SESSION_SETUP, NULL, server, 1468 (void **) &req, 1469 &total_len); 1470 if (rc) 1471 return rc; 1472 1473 spin_lock(&ses->ses_lock); 1474 is_binding = (ses->ses_status == SES_GOOD); 1475 spin_unlock(&ses->ses_lock); 1476 1477 if (is_binding) { 1478 req->hdr.SessionId = cpu_to_le64(ses->Suid); 1479 req->hdr.Flags |= SMB2_FLAGS_SIGNED; 1480 req->PreviousSessionId = 0; 1481 req->Flags = SMB2_SESSION_REQ_FLAG_BINDING; 1482 cifs_dbg(FYI, "Binding to sess id: %llx\n", ses->Suid); 1483 } else { 1484 /* First session, not a reauthenticate */ 1485 req->hdr.SessionId = 0; 1486 /* 1487 * if reconnect, we need to send previous sess id 1488 * otherwise it is 0 1489 */ 1490 req->PreviousSessionId = cpu_to_le64(sess_data->previous_session); 1491 req->Flags = 0; /* MBZ */ 1492 cifs_dbg(FYI, "Fresh session. Previous: %llx\n", 1493 sess_data->previous_session); 1494 } 1495 1496 /* enough to enable echos and oplocks and one max size write */ 1497 if (server->credits >= server->max_credits) 1498 req->hdr.CreditRequest = cpu_to_le16(0); 1499 else 1500 req->hdr.CreditRequest = cpu_to_le16( 1501 min_t(int, server->max_credits - 1502 server->credits, 130)); 1503 1504 /* only one of SMB2 signing flags may be set in SMB2 request */ 1505 if (server->sign) 1506 req->SecurityMode = SMB2_NEGOTIATE_SIGNING_REQUIRED; 1507 else if (global_secflags & CIFSSEC_MAY_SIGN) /* one flag unlike MUST_ */ 1508 req->SecurityMode = SMB2_NEGOTIATE_SIGNING_ENABLED; 1509 else 1510 req->SecurityMode = 0; 1511 1512 #ifdef CONFIG_CIFS_DFS_UPCALL 1513 req->Capabilities = cpu_to_le32(SMB2_GLOBAL_CAP_DFS); 1514 #else 1515 req->Capabilities = 0; 1516 #endif /* DFS_UPCALL */ 1517 1518 req->Channel = 0; /* MBZ */ 1519 1520 sess_data->iov[0].iov_base = (char *)req; 1521 /* 1 for pad */ 1522 sess_data->iov[0].iov_len = total_len - 1; 1523 /* 1524 * This variable will be used to clear the buffer 1525 * allocated above in case of any error in the calling function. 1526 */ 1527 sess_data->buf0_type = CIFS_SMALL_BUFFER; 1528 1529 return 0; 1530 } 1531 1532 static void 1533 SMB2_sess_free_buffer(struct SMB2_sess_data *sess_data) 1534 { 1535 struct kvec *iov = sess_data->iov; 1536 1537 /* iov[1] is already freed by caller */ 1538 if (sess_data->buf0_type != CIFS_NO_BUFFER && iov[0].iov_base) 1539 memzero_explicit(iov[0].iov_base, iov[0].iov_len); 1540 1541 free_rsp_buf(sess_data->buf0_type, iov[0].iov_base); 1542 sess_data->buf0_type = CIFS_NO_BUFFER; 1543 } 1544 1545 static int 1546 SMB2_sess_sendreceive(struct SMB2_sess_data *sess_data) 1547 { 1548 int rc; 1549 struct smb_rqst rqst; 1550 struct smb2_sess_setup_req *req = sess_data->iov[0].iov_base; 1551 struct kvec rsp_iov = { NULL, 0 }; 1552 1553 /* Testing shows that buffer offset must be at location of Buffer[0] */ 1554 req->SecurityBufferOffset = 1555 cpu_to_le16(sizeof(struct smb2_sess_setup_req)); 1556 req->SecurityBufferLength = cpu_to_le16(sess_data->iov[1].iov_len); 1557 1558 memset(&rqst, 0, sizeof(struct smb_rqst)); 1559 rqst.rq_iov = sess_data->iov; 1560 rqst.rq_nvec = 2; 1561 1562 /* BB add code to build os and lm fields */ 1563 rc = cifs_send_recv(sess_data->xid, sess_data->ses, 1564 sess_data->server, 1565 &rqst, 1566 &sess_data->buf0_type, 1567 CIFS_LOG_ERROR | CIFS_SESS_OP, &rsp_iov); 1568 cifs_small_buf_release(sess_data->iov[0].iov_base); 1569 if (rc == 0) 1570 sess_data->ses->expired_pwd = false; 1571 else if ((rc == -EACCES) || (rc == -EKEYEXPIRED) || (rc == -EKEYREVOKED)) { 1572 if (sess_data->ses->expired_pwd == false) 1573 trace_smb3_key_expired(sess_data->server->hostname, 1574 sess_data->ses->user_name, 1575 sess_data->server->conn_id, 1576 &sess_data->server->dstaddr, rc); 1577 sess_data->ses->expired_pwd = true; 1578 } 1579 1580 memcpy(&sess_data->iov[0], &rsp_iov, sizeof(struct kvec)); 1581 1582 return rc; 1583 } 1584 1585 static int 1586 SMB2_sess_establish_session(struct SMB2_sess_data *sess_data) 1587 { 1588 int rc = 0; 1589 struct cifs_ses *ses = sess_data->ses; 1590 struct TCP_Server_Info *server = sess_data->server; 1591 1592 cifs_server_lock(server); 1593 if (server->ops->generate_signingkey) { 1594 rc = server->ops->generate_signingkey(ses, server); 1595 if (rc) { 1596 cifs_dbg(FYI, 1597 "SMB3 session key generation failed\n"); 1598 cifs_server_unlock(server); 1599 return rc; 1600 } 1601 } 1602 if (!server->session_estab) { 1603 server->sequence_number = 0x2; 1604 server->session_estab = true; 1605 } 1606 cifs_server_unlock(server); 1607 1608 cifs_dbg(FYI, "SMB2/3 session established successfully\n"); 1609 return rc; 1610 } 1611 1612 #ifdef CONFIG_CIFS_UPCALL 1613 static void 1614 SMB2_auth_kerberos(struct SMB2_sess_data *sess_data) 1615 { 1616 int rc; 1617 struct cifs_ses *ses = sess_data->ses; 1618 struct TCP_Server_Info *server = sess_data->server; 1619 struct cifs_spnego_msg *msg; 1620 struct key *spnego_key = NULL; 1621 struct smb2_sess_setup_rsp *rsp = NULL; 1622 bool is_binding = false; 1623 1624 rc = SMB2_sess_alloc_buffer(sess_data); 1625 if (rc) 1626 goto out; 1627 1628 spnego_key = cifs_get_spnego_key(ses, server); 1629 if (IS_ERR(spnego_key)) { 1630 rc = PTR_ERR(spnego_key); 1631 if (rc == -ENOKEY) 1632 cifs_dbg(VFS, "Verify user has a krb5 ticket and keyutils is installed\n"); 1633 spnego_key = NULL; 1634 goto out; 1635 } 1636 1637 msg = spnego_key->payload.data[0]; 1638 /* 1639 * check version field to make sure that cifs.upcall is 1640 * sending us a response in an expected form 1641 */ 1642 if (msg->version != CIFS_SPNEGO_UPCALL_VERSION) { 1643 cifs_dbg(VFS, "bad cifs.upcall version. Expected %d got %d\n", 1644 CIFS_SPNEGO_UPCALL_VERSION, msg->version); 1645 rc = -EKEYREJECTED; 1646 goto out_put_spnego_key; 1647 } 1648 1649 spin_lock(&ses->ses_lock); 1650 is_binding = (ses->ses_status == SES_GOOD); 1651 spin_unlock(&ses->ses_lock); 1652 1653 /* keep session key if binding */ 1654 if (!is_binding) { 1655 kfree_sensitive(ses->auth_key.response); 1656 ses->auth_key.response = kmemdup(msg->data, msg->sesskey_len, 1657 GFP_KERNEL); 1658 if (!ses->auth_key.response) { 1659 cifs_dbg(VFS, "Kerberos can't allocate (%u bytes) memory\n", 1660 msg->sesskey_len); 1661 rc = -ENOMEM; 1662 goto out_put_spnego_key; 1663 } 1664 ses->auth_key.len = msg->sesskey_len; 1665 } 1666 1667 sess_data->iov[1].iov_base = msg->data + msg->sesskey_len; 1668 sess_data->iov[1].iov_len = msg->secblob_len; 1669 1670 rc = SMB2_sess_sendreceive(sess_data); 1671 if (rc) 1672 goto out_put_spnego_key; 1673 1674 rsp = (struct smb2_sess_setup_rsp *)sess_data->iov[0].iov_base; 1675 /* keep session id and flags if binding */ 1676 if (!is_binding) { 1677 ses->Suid = le64_to_cpu(rsp->hdr.SessionId); 1678 ses->session_flags = le16_to_cpu(rsp->SessionFlags); 1679 } 1680 1681 rc = SMB2_sess_establish_session(sess_data); 1682 out_put_spnego_key: 1683 key_invalidate(spnego_key); 1684 key_put(spnego_key); 1685 if (rc) { 1686 kfree_sensitive(ses->auth_key.response); 1687 ses->auth_key.response = NULL; 1688 ses->auth_key.len = 0; 1689 } 1690 out: 1691 sess_data->result = rc; 1692 sess_data->func = NULL; 1693 SMB2_sess_free_buffer(sess_data); 1694 } 1695 #else 1696 static void 1697 SMB2_auth_kerberos(struct SMB2_sess_data *sess_data) 1698 { 1699 cifs_dbg(VFS, "Kerberos negotiated but upcall support disabled!\n"); 1700 sess_data->result = -EOPNOTSUPP; 1701 sess_data->func = NULL; 1702 } 1703 #endif 1704 1705 static void 1706 SMB2_sess_auth_rawntlmssp_authenticate(struct SMB2_sess_data *sess_data); 1707 1708 static void 1709 SMB2_sess_auth_rawntlmssp_negotiate(struct SMB2_sess_data *sess_data) 1710 { 1711 int rc; 1712 struct cifs_ses *ses = sess_data->ses; 1713 struct TCP_Server_Info *server = sess_data->server; 1714 struct smb2_sess_setup_rsp *rsp = NULL; 1715 unsigned char *ntlmssp_blob = NULL; 1716 bool use_spnego = false; /* else use raw ntlmssp */ 1717 u16 blob_length = 0; 1718 bool is_binding = false; 1719 1720 /* 1721 * If memory allocation is successful, caller of this function 1722 * frees it. 1723 */ 1724 ses->ntlmssp = kmalloc(sizeof(struct ntlmssp_auth), GFP_KERNEL); 1725 if (!ses->ntlmssp) { 1726 rc = -ENOMEM; 1727 goto out_err; 1728 } 1729 ses->ntlmssp->sesskey_per_smbsess = true; 1730 1731 rc = SMB2_sess_alloc_buffer(sess_data); 1732 if (rc) 1733 goto out_err; 1734 1735 rc = build_ntlmssp_smb3_negotiate_blob(&ntlmssp_blob, 1736 &blob_length, ses, server, 1737 sess_data->nls_cp); 1738 if (rc) 1739 goto out; 1740 1741 if (use_spnego) { 1742 /* BB eventually need to add this */ 1743 cifs_dbg(VFS, "spnego not supported for SMB2 yet\n"); 1744 rc = -EOPNOTSUPP; 1745 goto out; 1746 } 1747 sess_data->iov[1].iov_base = ntlmssp_blob; 1748 sess_data->iov[1].iov_len = blob_length; 1749 1750 rc = SMB2_sess_sendreceive(sess_data); 1751 rsp = (struct smb2_sess_setup_rsp *)sess_data->iov[0].iov_base; 1752 1753 /* If true, rc here is expected and not an error */ 1754 if (sess_data->buf0_type != CIFS_NO_BUFFER && 1755 rsp->hdr.Status == STATUS_MORE_PROCESSING_REQUIRED) 1756 rc = 0; 1757 1758 if (rc) 1759 goto out; 1760 1761 if (offsetof(struct smb2_sess_setup_rsp, Buffer) != 1762 le16_to_cpu(rsp->SecurityBufferOffset)) { 1763 cifs_dbg(VFS, "Invalid security buffer offset %d\n", 1764 le16_to_cpu(rsp->SecurityBufferOffset)); 1765 rc = -EIO; 1766 goto out; 1767 } 1768 rc = decode_ntlmssp_challenge(rsp->Buffer, 1769 le16_to_cpu(rsp->SecurityBufferLength), ses); 1770 if (rc) 1771 goto out; 1772 1773 cifs_dbg(FYI, "rawntlmssp session setup challenge phase\n"); 1774 1775 spin_lock(&ses->ses_lock); 1776 is_binding = (ses->ses_status == SES_GOOD); 1777 spin_unlock(&ses->ses_lock); 1778 1779 /* keep existing ses id and flags if binding */ 1780 if (!is_binding) { 1781 ses->Suid = le64_to_cpu(rsp->hdr.SessionId); 1782 ses->session_flags = le16_to_cpu(rsp->SessionFlags); 1783 } 1784 1785 out: 1786 kfree_sensitive(ntlmssp_blob); 1787 SMB2_sess_free_buffer(sess_data); 1788 if (!rc) { 1789 sess_data->result = 0; 1790 sess_data->func = SMB2_sess_auth_rawntlmssp_authenticate; 1791 return; 1792 } 1793 out_err: 1794 kfree_sensitive(ses->ntlmssp); 1795 ses->ntlmssp = NULL; 1796 sess_data->result = rc; 1797 sess_data->func = NULL; 1798 } 1799 1800 static void 1801 SMB2_sess_auth_rawntlmssp_authenticate(struct SMB2_sess_data *sess_data) 1802 { 1803 int rc; 1804 struct cifs_ses *ses = sess_data->ses; 1805 struct TCP_Server_Info *server = sess_data->server; 1806 struct smb2_sess_setup_req *req; 1807 struct smb2_sess_setup_rsp *rsp = NULL; 1808 unsigned char *ntlmssp_blob = NULL; 1809 bool use_spnego = false; /* else use raw ntlmssp */ 1810 u16 blob_length = 0; 1811 bool is_binding = false; 1812 1813 rc = SMB2_sess_alloc_buffer(sess_data); 1814 if (rc) 1815 goto out; 1816 1817 req = (struct smb2_sess_setup_req *) sess_data->iov[0].iov_base; 1818 req->hdr.SessionId = cpu_to_le64(ses->Suid); 1819 1820 rc = build_ntlmssp_auth_blob(&ntlmssp_blob, &blob_length, 1821 ses, server, 1822 sess_data->nls_cp); 1823 if (rc) { 1824 cifs_dbg(FYI, "build_ntlmssp_auth_blob failed %d\n", rc); 1825 goto out; 1826 } 1827 1828 if (use_spnego) { 1829 /* BB eventually need to add this */ 1830 cifs_dbg(VFS, "spnego not supported for SMB2 yet\n"); 1831 rc = -EOPNOTSUPP; 1832 goto out; 1833 } 1834 sess_data->iov[1].iov_base = ntlmssp_blob; 1835 sess_data->iov[1].iov_len = blob_length; 1836 1837 rc = SMB2_sess_sendreceive(sess_data); 1838 if (rc) 1839 goto out; 1840 1841 rsp = (struct smb2_sess_setup_rsp *)sess_data->iov[0].iov_base; 1842 1843 spin_lock(&ses->ses_lock); 1844 is_binding = (ses->ses_status == SES_GOOD); 1845 spin_unlock(&ses->ses_lock); 1846 1847 /* keep existing ses id and flags if binding */ 1848 if (!is_binding) { 1849 ses->Suid = le64_to_cpu(rsp->hdr.SessionId); 1850 ses->session_flags = le16_to_cpu(rsp->SessionFlags); 1851 } 1852 1853 rc = SMB2_sess_establish_session(sess_data); 1854 #ifdef CONFIG_CIFS_DEBUG_DUMP_KEYS 1855 if (ses->server->dialect < SMB30_PROT_ID) { 1856 cifs_dbg(VFS, "%s: dumping generated SMB2 session keys\n", __func__); 1857 /* 1858 * The session id is opaque in terms of endianness, so we can't 1859 * print it as a long long. we dump it as we got it on the wire 1860 */ 1861 cifs_dbg(VFS, "Session Id %*ph\n", (int)sizeof(ses->Suid), 1862 &ses->Suid); 1863 cifs_dbg(VFS, "Session Key %*ph\n", 1864 SMB2_NTLMV2_SESSKEY_SIZE, ses->auth_key.response); 1865 cifs_dbg(VFS, "Signing Key %*ph\n", 1866 SMB3_SIGN_KEY_SIZE, ses->auth_key.response); 1867 } 1868 #endif 1869 out: 1870 kfree_sensitive(ntlmssp_blob); 1871 SMB2_sess_free_buffer(sess_data); 1872 kfree_sensitive(ses->ntlmssp); 1873 ses->ntlmssp = NULL; 1874 sess_data->result = rc; 1875 sess_data->func = NULL; 1876 } 1877 1878 static int 1879 SMB2_select_sec(struct SMB2_sess_data *sess_data) 1880 { 1881 int type; 1882 struct cifs_ses *ses = sess_data->ses; 1883 struct TCP_Server_Info *server = sess_data->server; 1884 1885 type = smb2_select_sectype(server, ses->sectype); 1886 cifs_dbg(FYI, "sess setup type %d\n", type); 1887 if (type == Unspecified) { 1888 cifs_dbg(VFS, "Unable to select appropriate authentication method!\n"); 1889 return -EINVAL; 1890 } 1891 1892 switch (type) { 1893 case Kerberos: 1894 sess_data->func = SMB2_auth_kerberos; 1895 break; 1896 case RawNTLMSSP: 1897 sess_data->func = SMB2_sess_auth_rawntlmssp_negotiate; 1898 break; 1899 default: 1900 cifs_dbg(VFS, "secType %d not supported!\n", type); 1901 return -EOPNOTSUPP; 1902 } 1903 1904 return 0; 1905 } 1906 1907 int 1908 SMB2_sess_setup(const unsigned int xid, struct cifs_ses *ses, 1909 struct TCP_Server_Info *server, 1910 const struct nls_table *nls_cp) 1911 { 1912 int rc = 0; 1913 struct SMB2_sess_data *sess_data; 1914 1915 cifs_dbg(FYI, "Session Setup\n"); 1916 1917 if (!server) { 1918 WARN(1, "%s: server is NULL!\n", __func__); 1919 return -EIO; 1920 } 1921 1922 sess_data = kzalloc(sizeof(struct SMB2_sess_data), GFP_KERNEL); 1923 if (!sess_data) 1924 return -ENOMEM; 1925 1926 sess_data->xid = xid; 1927 sess_data->ses = ses; 1928 sess_data->server = server; 1929 sess_data->buf0_type = CIFS_NO_BUFFER; 1930 sess_data->nls_cp = (struct nls_table *) nls_cp; 1931 sess_data->previous_session = ses->Suid; 1932 1933 rc = SMB2_select_sec(sess_data); 1934 if (rc) 1935 goto out; 1936 1937 /* 1938 * Initialize the session hash with the server one. 1939 */ 1940 memcpy(ses->preauth_sha_hash, server->preauth_sha_hash, 1941 SMB2_PREAUTH_HASH_SIZE); 1942 1943 while (sess_data->func) 1944 sess_data->func(sess_data); 1945 1946 if ((ses->session_flags & SMB2_SESSION_FLAG_IS_GUEST) && (ses->sign)) 1947 cifs_server_dbg(VFS, "signing requested but authenticated as guest\n"); 1948 rc = sess_data->result; 1949 out: 1950 kfree_sensitive(sess_data); 1951 return rc; 1952 } 1953 1954 int 1955 SMB2_logoff(const unsigned int xid, struct cifs_ses *ses) 1956 { 1957 struct smb_rqst rqst; 1958 struct smb2_logoff_req *req; /* response is also trivial struct */ 1959 int rc = 0; 1960 struct TCP_Server_Info *server; 1961 int flags = 0; 1962 unsigned int total_len; 1963 struct kvec iov[1]; 1964 struct kvec rsp_iov; 1965 int resp_buf_type; 1966 1967 cifs_dbg(FYI, "disconnect session %p\n", ses); 1968 1969 if (ses && (ses->server)) 1970 server = ses->server; 1971 else 1972 return -EIO; 1973 1974 /* no need to send SMB logoff if uid already closed due to reconnect */ 1975 spin_lock(&ses->chan_lock); 1976 if (CIFS_ALL_CHANS_NEED_RECONNECT(ses)) { 1977 spin_unlock(&ses->chan_lock); 1978 goto smb2_session_already_dead; 1979 } 1980 spin_unlock(&ses->chan_lock); 1981 1982 rc = smb2_plain_req_init(SMB2_LOGOFF, NULL, ses->server, 1983 (void **) &req, &total_len); 1984 if (rc) 1985 return rc; 1986 1987 /* since no tcon, smb2_init can not do this, so do here */ 1988 req->hdr.SessionId = cpu_to_le64(ses->Suid); 1989 1990 if (ses->session_flags & SMB2_SESSION_FLAG_ENCRYPT_DATA) 1991 flags |= CIFS_TRANSFORM_REQ; 1992 else if (server->sign) 1993 req->hdr.Flags |= SMB2_FLAGS_SIGNED; 1994 1995 flags |= CIFS_NO_RSP_BUF; 1996 1997 iov[0].iov_base = (char *)req; 1998 iov[0].iov_len = total_len; 1999 2000 memset(&rqst, 0, sizeof(struct smb_rqst)); 2001 rqst.rq_iov = iov; 2002 rqst.rq_nvec = 1; 2003 2004 rc = cifs_send_recv(xid, ses, ses->server, 2005 &rqst, &resp_buf_type, flags, &rsp_iov); 2006 cifs_small_buf_release(req); 2007 /* 2008 * No tcon so can't do 2009 * cifs_stats_inc(&tcon->stats.smb2_stats.smb2_com_fail[SMB2...]); 2010 */ 2011 2012 smb2_session_already_dead: 2013 return rc; 2014 } 2015 2016 static inline void cifs_stats_fail_inc(struct cifs_tcon *tcon, uint16_t code) 2017 { 2018 cifs_stats_inc(&tcon->stats.smb2_stats.smb2_com_failed[code]); 2019 } 2020 2021 #define MAX_SHARENAME_LENGTH (255 /* server */ + 80 /* share */ + 1 /* NULL */) 2022 2023 /* These are similar values to what Windows uses */ 2024 static inline void init_copy_chunk_defaults(struct cifs_tcon *tcon) 2025 { 2026 tcon->max_chunks = 256; 2027 tcon->max_bytes_chunk = 1048576; 2028 tcon->max_bytes_copy = 16777216; 2029 } 2030 2031 int 2032 SMB2_tcon(const unsigned int xid, struct cifs_ses *ses, const char *tree, 2033 struct cifs_tcon *tcon, const struct nls_table *cp) 2034 { 2035 struct smb_rqst rqst; 2036 struct smb2_tree_connect_req *req; 2037 struct smb2_tree_connect_rsp *rsp = NULL; 2038 struct kvec iov[2]; 2039 struct kvec rsp_iov = { NULL, 0 }; 2040 int rc = 0; 2041 int resp_buftype; 2042 int unc_path_len; 2043 __le16 *unc_path = NULL; 2044 int flags = 0; 2045 unsigned int total_len; 2046 struct TCP_Server_Info *server = cifs_pick_channel(ses); 2047 2048 cifs_dbg(FYI, "TCON\n"); 2049 2050 if (!server || !tree) 2051 return -EIO; 2052 2053 unc_path = kmalloc(MAX_SHARENAME_LENGTH * 2, GFP_KERNEL); 2054 if (unc_path == NULL) 2055 return -ENOMEM; 2056 2057 unc_path_len = cifs_strtoUTF16(unc_path, tree, strlen(tree), cp); 2058 if (unc_path_len <= 0) { 2059 kfree(unc_path); 2060 return -EINVAL; 2061 } 2062 unc_path_len *= 2; 2063 2064 /* SMB2 TREE_CONNECT request must be called with TreeId == 0 */ 2065 tcon->tid = 0; 2066 atomic_set(&tcon->num_remote_opens, 0); 2067 rc = smb2_plain_req_init(SMB2_TREE_CONNECT, tcon, server, 2068 (void **) &req, &total_len); 2069 if (rc) { 2070 kfree(unc_path); 2071 return rc; 2072 } 2073 2074 if (smb3_encryption_required(tcon)) 2075 flags |= CIFS_TRANSFORM_REQ; 2076 2077 iov[0].iov_base = (char *)req; 2078 /* 1 for pad */ 2079 iov[0].iov_len = total_len - 1; 2080 2081 /* Testing shows that buffer offset must be at location of Buffer[0] */ 2082 req->PathOffset = cpu_to_le16(sizeof(struct smb2_tree_connect_req)); 2083 req->PathLength = cpu_to_le16(unc_path_len); 2084 iov[1].iov_base = unc_path; 2085 iov[1].iov_len = unc_path_len; 2086 2087 /* 2088 * 3.11 tcon req must be signed if not encrypted. See MS-SMB2 3.2.4.1.1 2089 * unless it is guest or anonymous user. See MS-SMB2 3.2.5.3.1 2090 * (Samba servers don't always set the flag so also check if null user) 2091 */ 2092 if ((server->dialect == SMB311_PROT_ID) && 2093 !smb3_encryption_required(tcon) && 2094 !(ses->session_flags & 2095 (SMB2_SESSION_FLAG_IS_GUEST|SMB2_SESSION_FLAG_IS_NULL)) && 2096 ((ses->user_name != NULL) || (ses->sectype == Kerberos))) 2097 req->hdr.Flags |= SMB2_FLAGS_SIGNED; 2098 2099 memset(&rqst, 0, sizeof(struct smb_rqst)); 2100 rqst.rq_iov = iov; 2101 rqst.rq_nvec = 2; 2102 2103 /* Need 64 for max size write so ask for more in case not there yet */ 2104 if (server->credits >= server->max_credits) 2105 req->hdr.CreditRequest = cpu_to_le16(0); 2106 else 2107 req->hdr.CreditRequest = cpu_to_le16( 2108 min_t(int, server->max_credits - 2109 server->credits, 64)); 2110 2111 rc = cifs_send_recv(xid, ses, server, 2112 &rqst, &resp_buftype, flags, &rsp_iov); 2113 cifs_small_buf_release(req); 2114 rsp = (struct smb2_tree_connect_rsp *)rsp_iov.iov_base; 2115 trace_smb3_tcon(xid, tcon->tid, ses->Suid, tree, rc); 2116 if ((rc != 0) || (rsp == NULL)) { 2117 cifs_stats_fail_inc(tcon, SMB2_TREE_CONNECT_HE); 2118 tcon->need_reconnect = true; 2119 goto tcon_error_exit; 2120 } 2121 2122 switch (rsp->ShareType) { 2123 case SMB2_SHARE_TYPE_DISK: 2124 cifs_dbg(FYI, "connection to disk share\n"); 2125 break; 2126 case SMB2_SHARE_TYPE_PIPE: 2127 tcon->pipe = true; 2128 cifs_dbg(FYI, "connection to pipe share\n"); 2129 break; 2130 case SMB2_SHARE_TYPE_PRINT: 2131 tcon->print = true; 2132 cifs_dbg(FYI, "connection to printer\n"); 2133 break; 2134 default: 2135 cifs_server_dbg(VFS, "unknown share type %d\n", rsp->ShareType); 2136 rc = -EOPNOTSUPP; 2137 goto tcon_error_exit; 2138 } 2139 2140 tcon->share_flags = le32_to_cpu(rsp->ShareFlags); 2141 tcon->capabilities = rsp->Capabilities; /* we keep caps little endian */ 2142 tcon->maximal_access = le32_to_cpu(rsp->MaximalAccess); 2143 tcon->tid = le32_to_cpu(rsp->hdr.Id.SyncId.TreeId); 2144 strscpy(tcon->tree_name, tree, sizeof(tcon->tree_name)); 2145 2146 if ((rsp->Capabilities & SMB2_SHARE_CAP_DFS) && 2147 ((tcon->share_flags & SHI1005_FLAGS_DFS) == 0)) 2148 cifs_tcon_dbg(VFS, "DFS capability contradicts DFS flag\n"); 2149 2150 if (tcon->seal && 2151 !(server->capabilities & SMB2_GLOBAL_CAP_ENCRYPTION)) 2152 cifs_tcon_dbg(VFS, "Encryption is requested but not supported\n"); 2153 2154 init_copy_chunk_defaults(tcon); 2155 if (server->ops->validate_negotiate) 2156 rc = server->ops->validate_negotiate(xid, tcon); 2157 if (rc == 0) /* See MS-SMB2 2.2.10 and 3.2.5.5 */ 2158 if (tcon->share_flags & SMB2_SHAREFLAG_ISOLATED_TRANSPORT) 2159 server->nosharesock = true; 2160 tcon_exit: 2161 2162 free_rsp_buf(resp_buftype, rsp); 2163 kfree(unc_path); 2164 return rc; 2165 2166 tcon_error_exit: 2167 if (rsp && rsp->hdr.Status == STATUS_BAD_NETWORK_NAME) 2168 cifs_dbg(VFS | ONCE, "BAD_NETWORK_NAME: %s\n", tree); 2169 goto tcon_exit; 2170 } 2171 2172 int 2173 SMB2_tdis(const unsigned int xid, struct cifs_tcon *tcon) 2174 { 2175 struct smb_rqst rqst; 2176 struct smb2_tree_disconnect_req *req; /* response is trivial */ 2177 int rc = 0; 2178 struct cifs_ses *ses = tcon->ses; 2179 struct TCP_Server_Info *server = cifs_pick_channel(ses); 2180 int flags = 0; 2181 unsigned int total_len; 2182 struct kvec iov[1]; 2183 struct kvec rsp_iov; 2184 int resp_buf_type; 2185 2186 cifs_dbg(FYI, "Tree Disconnect\n"); 2187 2188 if (!ses || !(ses->server)) 2189 return -EIO; 2190 2191 trace_smb3_tdis_enter(xid, tcon->tid, ses->Suid, tcon->tree_name); 2192 spin_lock(&ses->chan_lock); 2193 if ((tcon->need_reconnect) || 2194 (CIFS_ALL_CHANS_NEED_RECONNECT(tcon->ses))) { 2195 spin_unlock(&ses->chan_lock); 2196 return 0; 2197 } 2198 spin_unlock(&ses->chan_lock); 2199 2200 invalidate_all_cached_dirs(tcon); 2201 2202 rc = smb2_plain_req_init(SMB2_TREE_DISCONNECT, tcon, server, 2203 (void **) &req, 2204 &total_len); 2205 if (rc) 2206 return rc; 2207 2208 if (smb3_encryption_required(tcon)) 2209 flags |= CIFS_TRANSFORM_REQ; 2210 2211 flags |= CIFS_NO_RSP_BUF; 2212 2213 iov[0].iov_base = (char *)req; 2214 iov[0].iov_len = total_len; 2215 2216 memset(&rqst, 0, sizeof(struct smb_rqst)); 2217 rqst.rq_iov = iov; 2218 rqst.rq_nvec = 1; 2219 2220 rc = cifs_send_recv(xid, ses, server, 2221 &rqst, &resp_buf_type, flags, &rsp_iov); 2222 cifs_small_buf_release(req); 2223 if (rc) { 2224 cifs_stats_fail_inc(tcon, SMB2_TREE_DISCONNECT_HE); 2225 trace_smb3_tdis_err(xid, tcon->tid, ses->Suid, rc); 2226 } 2227 trace_smb3_tdis_done(xid, tcon->tid, ses->Suid); 2228 2229 return rc; 2230 } 2231 2232 static create_durable_req_t * 2233 create_durable_buf(void) 2234 { 2235 create_durable_req_t *buf; 2236 2237 buf = kzalloc(sizeof(create_durable_req_t), GFP_KERNEL); 2238 if (!buf) 2239 return NULL; 2240 2241 buf->ccontext.DataOffset = cpu_to_le16(offsetof 2242 (create_durable_req_t, Data)); 2243 buf->ccontext.DataLength = cpu_to_le32(16); 2244 buf->ccontext.NameOffset = cpu_to_le16(offsetof 2245 (create_durable_req_t, Name)); 2246 buf->ccontext.NameLength = cpu_to_le16(4); 2247 /* SMB2_CREATE_DURABLE_HANDLE_REQUEST is "DHnQ" */ 2248 buf->Name[0] = 'D'; 2249 buf->Name[1] = 'H'; 2250 buf->Name[2] = 'n'; 2251 buf->Name[3] = 'Q'; 2252 return buf; 2253 } 2254 2255 static create_durable_req_t * 2256 create_reconnect_durable_buf(struct cifs_fid *fid) 2257 { 2258 create_durable_req_t *buf; 2259 2260 buf = kzalloc(sizeof(create_durable_req_t), GFP_KERNEL); 2261 if (!buf) 2262 return NULL; 2263 2264 buf->ccontext.DataOffset = cpu_to_le16(offsetof 2265 (create_durable_req_t, Data)); 2266 buf->ccontext.DataLength = cpu_to_le32(16); 2267 buf->ccontext.NameOffset = cpu_to_le16(offsetof 2268 (create_durable_req_t, Name)); 2269 buf->ccontext.NameLength = cpu_to_le16(4); 2270 buf->Data.Fid.PersistentFileId = fid->persistent_fid; 2271 buf->Data.Fid.VolatileFileId = fid->volatile_fid; 2272 /* SMB2_CREATE_DURABLE_HANDLE_RECONNECT is "DHnC" */ 2273 buf->Name[0] = 'D'; 2274 buf->Name[1] = 'H'; 2275 buf->Name[2] = 'n'; 2276 buf->Name[3] = 'C'; 2277 return buf; 2278 } 2279 2280 static void 2281 parse_query_id_ctxt(struct create_context *cc, struct smb2_file_all_info *buf) 2282 { 2283 struct create_disk_id_rsp *pdisk_id = (struct create_disk_id_rsp *)cc; 2284 2285 cifs_dbg(FYI, "parse query id context 0x%llx 0x%llx\n", 2286 pdisk_id->DiskFileId, pdisk_id->VolumeId); 2287 buf->IndexNumber = pdisk_id->DiskFileId; 2288 } 2289 2290 static void 2291 parse_posix_ctxt(struct create_context *cc, struct smb2_file_all_info *info, 2292 struct create_posix_rsp *posix) 2293 { 2294 int sid_len; 2295 u8 *beg = (u8 *)cc + le16_to_cpu(cc->DataOffset); 2296 u8 *end = beg + le32_to_cpu(cc->DataLength); 2297 u8 *sid; 2298 2299 memset(posix, 0, sizeof(*posix)); 2300 2301 posix->nlink = le32_to_cpu(*(__le32 *)(beg + 0)); 2302 posix->reparse_tag = le32_to_cpu(*(__le32 *)(beg + 4)); 2303 posix->mode = le32_to_cpu(*(__le32 *)(beg + 8)); 2304 2305 sid = beg + 12; 2306 sid_len = posix_info_sid_size(sid, end); 2307 if (sid_len < 0) { 2308 cifs_dbg(VFS, "bad owner sid in posix create response\n"); 2309 return; 2310 } 2311 memcpy(&posix->owner, sid, sid_len); 2312 2313 sid = sid + sid_len; 2314 sid_len = posix_info_sid_size(sid, end); 2315 if (sid_len < 0) { 2316 cifs_dbg(VFS, "bad group sid in posix create response\n"); 2317 return; 2318 } 2319 memcpy(&posix->group, sid, sid_len); 2320 2321 cifs_dbg(FYI, "nlink=%d mode=%o reparse_tag=%x\n", 2322 posix->nlink, posix->mode, posix->reparse_tag); 2323 } 2324 2325 int smb2_parse_contexts(struct TCP_Server_Info *server, 2326 struct kvec *rsp_iov, 2327 __u16 *epoch, 2328 char *lease_key, __u8 *oplock, 2329 struct smb2_file_all_info *buf, 2330 struct create_posix_rsp *posix) 2331 { 2332 struct smb2_create_rsp *rsp = rsp_iov->iov_base; 2333 struct create_context *cc; 2334 size_t rem, off, len; 2335 size_t doff, dlen; 2336 size_t noff, nlen; 2337 char *name; 2338 static const char smb3_create_tag_posix[] = { 2339 0x93, 0xAD, 0x25, 0x50, 0x9C, 2340 0xB4, 0x11, 0xE7, 0xB4, 0x23, 0x83, 2341 0xDE, 0x96, 0x8B, 0xCD, 0x7C 2342 }; 2343 2344 *oplock = 0; 2345 2346 off = le32_to_cpu(rsp->CreateContextsOffset); 2347 rem = le32_to_cpu(rsp->CreateContextsLength); 2348 if (check_add_overflow(off, rem, &len) || len > rsp_iov->iov_len) 2349 return -EINVAL; 2350 cc = (struct create_context *)((u8 *)rsp + off); 2351 2352 /* Initialize inode number to 0 in case no valid data in qfid context */ 2353 if (buf) 2354 buf->IndexNumber = 0; 2355 2356 while (rem >= sizeof(*cc)) { 2357 doff = le16_to_cpu(cc->DataOffset); 2358 dlen = le32_to_cpu(cc->DataLength); 2359 if (check_add_overflow(doff, dlen, &len) || len > rem) 2360 return -EINVAL; 2361 2362 noff = le16_to_cpu(cc->NameOffset); 2363 nlen = le16_to_cpu(cc->NameLength); 2364 if (noff + nlen > doff) 2365 return -EINVAL; 2366 2367 name = (char *)cc + noff; 2368 switch (nlen) { 2369 case 4: 2370 if (!strncmp(name, SMB2_CREATE_REQUEST_LEASE, 4)) { 2371 *oplock = server->ops->parse_lease_buf(cc, epoch, 2372 lease_key); 2373 } else if (buf && 2374 !strncmp(name, SMB2_CREATE_QUERY_ON_DISK_ID, 4)) { 2375 parse_query_id_ctxt(cc, buf); 2376 } 2377 break; 2378 case 16: 2379 if (posix && !memcmp(name, smb3_create_tag_posix, 16)) 2380 parse_posix_ctxt(cc, buf, posix); 2381 break; 2382 default: 2383 cifs_dbg(FYI, "%s: unhandled context (nlen=%zu dlen=%zu)\n", 2384 __func__, nlen, dlen); 2385 if (IS_ENABLED(CONFIG_CIFS_DEBUG2)) 2386 cifs_dump_mem("context data: ", cc, dlen); 2387 break; 2388 } 2389 2390 off = le32_to_cpu(cc->Next); 2391 if (!off) 2392 break; 2393 if (check_sub_overflow(rem, off, &rem)) 2394 return -EINVAL; 2395 cc = (struct create_context *)((u8 *)cc + off); 2396 } 2397 2398 if (rsp->OplockLevel != SMB2_OPLOCK_LEVEL_LEASE) 2399 *oplock = rsp->OplockLevel; 2400 2401 return 0; 2402 } 2403 2404 static int 2405 add_lease_context(struct TCP_Server_Info *server, 2406 struct smb2_create_req *req, 2407 struct kvec *iov, 2408 unsigned int *num_iovec, 2409 u8 *lease_key, 2410 __u8 *oplock, 2411 u8 *parent_lease_key, 2412 __le32 flags) 2413 { 2414 unsigned int num = *num_iovec; 2415 2416 iov[num].iov_base = server->ops->create_lease_buf(lease_key, *oplock, 2417 parent_lease_key, flags); 2418 if (iov[num].iov_base == NULL) 2419 return -ENOMEM; 2420 iov[num].iov_len = server->vals->create_lease_size; 2421 req->RequestedOplockLevel = SMB2_OPLOCK_LEVEL_LEASE; 2422 *num_iovec = num + 1; 2423 return 0; 2424 } 2425 2426 static struct create_durable_req_v2 * 2427 create_durable_v2_buf(struct cifs_open_parms *oparms) 2428 { 2429 struct cifs_fid *pfid = oparms->fid; 2430 struct create_durable_req_v2 *buf; 2431 2432 buf = kzalloc(sizeof(struct create_durable_req_v2), GFP_KERNEL); 2433 if (!buf) 2434 return NULL; 2435 2436 buf->ccontext.DataOffset = cpu_to_le16(offsetof 2437 (struct create_durable_req_v2, dcontext)); 2438 buf->ccontext.DataLength = cpu_to_le32(sizeof(struct durable_context_v2_req)); 2439 buf->ccontext.NameOffset = cpu_to_le16(offsetof 2440 (struct create_durable_req_v2, Name)); 2441 buf->ccontext.NameLength = cpu_to_le16(4); 2442 2443 /* 2444 * NB: Handle timeout defaults to 0, which allows server to choose 2445 * (most servers default to 120 seconds) and most clients default to 0. 2446 * This can be overridden at mount ("handletimeout=") if the user wants 2447 * a different persistent (or resilient) handle timeout for all opens 2448 * on a particular SMB3 mount. 2449 */ 2450 buf->dcontext.Timeout = cpu_to_le32(oparms->tcon->handle_timeout); 2451 buf->dcontext.Flags = cpu_to_le32(SMB2_DHANDLE_FLAG_PERSISTENT); 2452 2453 /* for replay, we should not overwrite the existing create guid */ 2454 if (!oparms->replay) { 2455 generate_random_uuid(buf->dcontext.CreateGuid); 2456 memcpy(pfid->create_guid, buf->dcontext.CreateGuid, 16); 2457 } else 2458 memcpy(buf->dcontext.CreateGuid, pfid->create_guid, 16); 2459 2460 /* SMB2_CREATE_DURABLE_HANDLE_REQUEST is "DH2Q" */ 2461 buf->Name[0] = 'D'; 2462 buf->Name[1] = 'H'; 2463 buf->Name[2] = '2'; 2464 buf->Name[3] = 'Q'; 2465 return buf; 2466 } 2467 2468 static struct create_durable_handle_reconnect_v2 * 2469 create_reconnect_durable_v2_buf(struct cifs_fid *fid) 2470 { 2471 struct create_durable_handle_reconnect_v2 *buf; 2472 2473 buf = kzalloc(sizeof(struct create_durable_handle_reconnect_v2), 2474 GFP_KERNEL); 2475 if (!buf) 2476 return NULL; 2477 2478 buf->ccontext.DataOffset = 2479 cpu_to_le16(offsetof(struct create_durable_handle_reconnect_v2, 2480 dcontext)); 2481 buf->ccontext.DataLength = 2482 cpu_to_le32(sizeof(struct durable_reconnect_context_v2)); 2483 buf->ccontext.NameOffset = 2484 cpu_to_le16(offsetof(struct create_durable_handle_reconnect_v2, 2485 Name)); 2486 buf->ccontext.NameLength = cpu_to_le16(4); 2487 2488 buf->dcontext.Fid.PersistentFileId = fid->persistent_fid; 2489 buf->dcontext.Fid.VolatileFileId = fid->volatile_fid; 2490 buf->dcontext.Flags = cpu_to_le32(SMB2_DHANDLE_FLAG_PERSISTENT); 2491 memcpy(buf->dcontext.CreateGuid, fid->create_guid, 16); 2492 2493 /* SMB2_CREATE_DURABLE_HANDLE_RECONNECT_V2 is "DH2C" */ 2494 buf->Name[0] = 'D'; 2495 buf->Name[1] = 'H'; 2496 buf->Name[2] = '2'; 2497 buf->Name[3] = 'C'; 2498 return buf; 2499 } 2500 2501 static int 2502 add_durable_v2_context(struct kvec *iov, unsigned int *num_iovec, 2503 struct cifs_open_parms *oparms) 2504 { 2505 unsigned int num = *num_iovec; 2506 2507 iov[num].iov_base = create_durable_v2_buf(oparms); 2508 if (iov[num].iov_base == NULL) 2509 return -ENOMEM; 2510 iov[num].iov_len = sizeof(struct create_durable_req_v2); 2511 *num_iovec = num + 1; 2512 return 0; 2513 } 2514 2515 static int 2516 add_durable_reconnect_v2_context(struct kvec *iov, unsigned int *num_iovec, 2517 struct cifs_open_parms *oparms) 2518 { 2519 unsigned int num = *num_iovec; 2520 2521 /* indicate that we don't need to relock the file */ 2522 oparms->reconnect = false; 2523 2524 iov[num].iov_base = create_reconnect_durable_v2_buf(oparms->fid); 2525 if (iov[num].iov_base == NULL) 2526 return -ENOMEM; 2527 iov[num].iov_len = sizeof(struct create_durable_handle_reconnect_v2); 2528 *num_iovec = num + 1; 2529 return 0; 2530 } 2531 2532 static int 2533 add_durable_context(struct kvec *iov, unsigned int *num_iovec, 2534 struct cifs_open_parms *oparms, bool use_persistent) 2535 { 2536 unsigned int num = *num_iovec; 2537 2538 if (use_persistent) { 2539 if (oparms->reconnect) 2540 return add_durable_reconnect_v2_context(iov, num_iovec, 2541 oparms); 2542 else 2543 return add_durable_v2_context(iov, num_iovec, oparms); 2544 } 2545 2546 if (oparms->reconnect) { 2547 iov[num].iov_base = create_reconnect_durable_buf(oparms->fid); 2548 /* indicate that we don't need to relock the file */ 2549 oparms->reconnect = false; 2550 } else 2551 iov[num].iov_base = create_durable_buf(); 2552 if (iov[num].iov_base == NULL) 2553 return -ENOMEM; 2554 iov[num].iov_len = sizeof(create_durable_req_t); 2555 *num_iovec = num + 1; 2556 return 0; 2557 } 2558 2559 /* See MS-SMB2 2.2.13.2.7 */ 2560 static struct crt_twarp_ctxt * 2561 create_twarp_buf(__u64 timewarp) 2562 { 2563 struct crt_twarp_ctxt *buf; 2564 2565 buf = kzalloc(sizeof(struct crt_twarp_ctxt), GFP_KERNEL); 2566 if (!buf) 2567 return NULL; 2568 2569 buf->ccontext.DataOffset = cpu_to_le16(offsetof 2570 (struct crt_twarp_ctxt, Timestamp)); 2571 buf->ccontext.DataLength = cpu_to_le32(8); 2572 buf->ccontext.NameOffset = cpu_to_le16(offsetof 2573 (struct crt_twarp_ctxt, Name)); 2574 buf->ccontext.NameLength = cpu_to_le16(4); 2575 /* SMB2_CREATE_TIMEWARP_TOKEN is "TWrp" */ 2576 buf->Name[0] = 'T'; 2577 buf->Name[1] = 'W'; 2578 buf->Name[2] = 'r'; 2579 buf->Name[3] = 'p'; 2580 buf->Timestamp = cpu_to_le64(timewarp); 2581 return buf; 2582 } 2583 2584 /* See MS-SMB2 2.2.13.2.7 */ 2585 static int 2586 add_twarp_context(struct kvec *iov, unsigned int *num_iovec, __u64 timewarp) 2587 { 2588 unsigned int num = *num_iovec; 2589 2590 iov[num].iov_base = create_twarp_buf(timewarp); 2591 if (iov[num].iov_base == NULL) 2592 return -ENOMEM; 2593 iov[num].iov_len = sizeof(struct crt_twarp_ctxt); 2594 *num_iovec = num + 1; 2595 return 0; 2596 } 2597 2598 /* See http://technet.microsoft.com/en-us/library/hh509017(v=ws.10).aspx */ 2599 static void setup_owner_group_sids(char *buf) 2600 { 2601 struct owner_group_sids *sids = (struct owner_group_sids *)buf; 2602 2603 /* Populate the user ownership fields S-1-5-88-1 */ 2604 sids->owner.Revision = 1; 2605 sids->owner.NumAuth = 3; 2606 sids->owner.Authority[5] = 5; 2607 sids->owner.SubAuthorities[0] = cpu_to_le32(88); 2608 sids->owner.SubAuthorities[1] = cpu_to_le32(1); 2609 sids->owner.SubAuthorities[2] = cpu_to_le32(current_fsuid().val); 2610 2611 /* Populate the group ownership fields S-1-5-88-2 */ 2612 sids->group.Revision = 1; 2613 sids->group.NumAuth = 3; 2614 sids->group.Authority[5] = 5; 2615 sids->group.SubAuthorities[0] = cpu_to_le32(88); 2616 sids->group.SubAuthorities[1] = cpu_to_le32(2); 2617 sids->group.SubAuthorities[2] = cpu_to_le32(current_fsgid().val); 2618 2619 cifs_dbg(FYI, "owner S-1-5-88-1-%d, group S-1-5-88-2-%d\n", current_fsuid().val, current_fsgid().val); 2620 } 2621 2622 /* See MS-SMB2 2.2.13.2.2 and MS-DTYP 2.4.6 */ 2623 static struct crt_sd_ctxt * 2624 create_sd_buf(umode_t mode, bool set_owner, unsigned int *len) 2625 { 2626 struct crt_sd_ctxt *buf; 2627 __u8 *ptr, *aclptr; 2628 unsigned int acelen, acl_size, ace_count; 2629 unsigned int owner_offset = 0; 2630 unsigned int group_offset = 0; 2631 struct smb3_acl acl = {}; 2632 2633 *len = round_up(sizeof(struct crt_sd_ctxt) + (sizeof(struct smb_ace) * 4), 8); 2634 2635 if (set_owner) { 2636 /* sizeof(struct owner_group_sids) is already multiple of 8 so no need to round */ 2637 *len += sizeof(struct owner_group_sids); 2638 } 2639 2640 buf = kzalloc(*len, GFP_KERNEL); 2641 if (buf == NULL) 2642 return buf; 2643 2644 ptr = (__u8 *)&buf[1]; 2645 if (set_owner) { 2646 /* offset fields are from beginning of security descriptor not of create context */ 2647 owner_offset = ptr - (__u8 *)&buf->sd; 2648 buf->sd.OffsetOwner = cpu_to_le32(owner_offset); 2649 group_offset = owner_offset + offsetof(struct owner_group_sids, group); 2650 buf->sd.OffsetGroup = cpu_to_le32(group_offset); 2651 2652 setup_owner_group_sids(ptr); 2653 ptr += sizeof(struct owner_group_sids); 2654 } else { 2655 buf->sd.OffsetOwner = 0; 2656 buf->sd.OffsetGroup = 0; 2657 } 2658 2659 buf->ccontext.DataOffset = cpu_to_le16(offsetof(struct crt_sd_ctxt, sd)); 2660 buf->ccontext.NameOffset = cpu_to_le16(offsetof(struct crt_sd_ctxt, Name)); 2661 buf->ccontext.NameLength = cpu_to_le16(4); 2662 /* SMB2_CREATE_SD_BUFFER_TOKEN is "SecD" */ 2663 buf->Name[0] = 'S'; 2664 buf->Name[1] = 'e'; 2665 buf->Name[2] = 'c'; 2666 buf->Name[3] = 'D'; 2667 buf->sd.Revision = 1; /* Must be one see MS-DTYP 2.4.6 */ 2668 2669 /* 2670 * ACL is "self relative" ie ACL is stored in contiguous block of memory 2671 * and "DP" ie the DACL is present 2672 */ 2673 buf->sd.Control = cpu_to_le16(ACL_CONTROL_SR | ACL_CONTROL_DP); 2674 2675 /* offset owner, group and Sbz1 and SACL are all zero */ 2676 buf->sd.OffsetDacl = cpu_to_le32(ptr - (__u8 *)&buf->sd); 2677 /* Ship the ACL for now. we will copy it into buf later. */ 2678 aclptr = ptr; 2679 ptr += sizeof(struct smb3_acl); 2680 2681 /* create one ACE to hold the mode embedded in reserved special SID */ 2682 acelen = setup_special_mode_ACE((struct smb_ace *)ptr, false, (__u64)mode); 2683 ptr += acelen; 2684 acl_size = acelen + sizeof(struct smb3_acl); 2685 ace_count = 1; 2686 2687 if (set_owner) { 2688 /* we do not need to reallocate buffer to add the two more ACEs. plenty of space */ 2689 acelen = setup_special_user_owner_ACE((struct smb_ace *)ptr); 2690 ptr += acelen; 2691 acl_size += acelen; 2692 ace_count += 1; 2693 } 2694 2695 /* and one more ACE to allow access for authenticated users */ 2696 acelen = setup_authusers_ACE((struct smb_ace *)ptr); 2697 ptr += acelen; 2698 acl_size += acelen; 2699 ace_count += 1; 2700 2701 acl.AclRevision = ACL_REVISION; /* See 2.4.4.1 of MS-DTYP */ 2702 acl.AclSize = cpu_to_le16(acl_size); 2703 acl.AceCount = cpu_to_le16(ace_count); 2704 /* acl.Sbz1 and Sbz2 MBZ so are not set here, but initialized above */ 2705 memcpy(aclptr, &acl, sizeof(struct smb3_acl)); 2706 2707 buf->ccontext.DataLength = cpu_to_le32(ptr - (__u8 *)&buf->sd); 2708 *len = round_up((unsigned int)(ptr - (__u8 *)buf), 8); 2709 2710 return buf; 2711 } 2712 2713 static int 2714 add_sd_context(struct kvec *iov, unsigned int *num_iovec, umode_t mode, bool set_owner) 2715 { 2716 unsigned int num = *num_iovec; 2717 unsigned int len = 0; 2718 2719 iov[num].iov_base = create_sd_buf(mode, set_owner, &len); 2720 if (iov[num].iov_base == NULL) 2721 return -ENOMEM; 2722 iov[num].iov_len = len; 2723 *num_iovec = num + 1; 2724 return 0; 2725 } 2726 2727 static struct crt_query_id_ctxt * 2728 create_query_id_buf(void) 2729 { 2730 struct crt_query_id_ctxt *buf; 2731 2732 buf = kzalloc(sizeof(struct crt_query_id_ctxt), GFP_KERNEL); 2733 if (!buf) 2734 return NULL; 2735 2736 buf->ccontext.DataOffset = cpu_to_le16(0); 2737 buf->ccontext.DataLength = cpu_to_le32(0); 2738 buf->ccontext.NameOffset = cpu_to_le16(offsetof 2739 (struct crt_query_id_ctxt, Name)); 2740 buf->ccontext.NameLength = cpu_to_le16(4); 2741 /* SMB2_CREATE_QUERY_ON_DISK_ID is "QFid" */ 2742 buf->Name[0] = 'Q'; 2743 buf->Name[1] = 'F'; 2744 buf->Name[2] = 'i'; 2745 buf->Name[3] = 'd'; 2746 return buf; 2747 } 2748 2749 /* See MS-SMB2 2.2.13.2.9 */ 2750 static int 2751 add_query_id_context(struct kvec *iov, unsigned int *num_iovec) 2752 { 2753 unsigned int num = *num_iovec; 2754 2755 iov[num].iov_base = create_query_id_buf(); 2756 if (iov[num].iov_base == NULL) 2757 return -ENOMEM; 2758 iov[num].iov_len = sizeof(struct crt_query_id_ctxt); 2759 *num_iovec = num + 1; 2760 return 0; 2761 } 2762 2763 static void add_ea_context(struct cifs_open_parms *oparms, 2764 struct kvec *rq_iov, unsigned int *num_iovs) 2765 { 2766 struct kvec *iov = oparms->ea_cctx; 2767 2768 if (iov && iov->iov_base && iov->iov_len) { 2769 rq_iov[(*num_iovs)++] = *iov; 2770 memset(iov, 0, sizeof(*iov)); 2771 } 2772 } 2773 2774 static int 2775 alloc_path_with_tree_prefix(__le16 **out_path, int *out_size, int *out_len, 2776 const char *treename, const __le16 *path) 2777 { 2778 int treename_len, path_len; 2779 struct nls_table *cp; 2780 const __le16 sep[] = {cpu_to_le16('\\'), cpu_to_le16(0x0000)}; 2781 2782 /* 2783 * skip leading "\\" 2784 */ 2785 treename_len = strlen(treename); 2786 if (treename_len < 2 || !(treename[0] == '\\' && treename[1] == '\\')) 2787 return -EINVAL; 2788 2789 treename += 2; 2790 treename_len -= 2; 2791 2792 path_len = UniStrnlen((wchar_t *)path, PATH_MAX); 2793 2794 /* make room for one path separator only if @path isn't empty */ 2795 *out_len = treename_len + (path[0] ? 1 : 0) + path_len; 2796 2797 /* 2798 * final path needs to be 8-byte aligned as specified in 2799 * MS-SMB2 2.2.13 SMB2 CREATE Request. 2800 */ 2801 *out_size = round_up(*out_len * sizeof(__le16), 8); 2802 *out_path = kzalloc(*out_size + sizeof(__le16) /* null */, GFP_KERNEL); 2803 if (!*out_path) 2804 return -ENOMEM; 2805 2806 cp = load_nls_default(); 2807 cifs_strtoUTF16(*out_path, treename, treename_len, cp); 2808 2809 /* Do not append the separator if the path is empty */ 2810 if (path[0] != cpu_to_le16(0x0000)) { 2811 UniStrcat((wchar_t *)*out_path, (wchar_t *)sep); 2812 UniStrcat((wchar_t *)*out_path, (wchar_t *)path); 2813 } 2814 2815 unload_nls(cp); 2816 2817 return 0; 2818 } 2819 2820 int smb311_posix_mkdir(const unsigned int xid, struct inode *inode, 2821 umode_t mode, struct cifs_tcon *tcon, 2822 const char *full_path, 2823 struct cifs_sb_info *cifs_sb) 2824 { 2825 struct smb_rqst rqst; 2826 struct smb2_create_req *req; 2827 struct smb2_create_rsp *rsp = NULL; 2828 struct cifs_ses *ses = tcon->ses; 2829 struct kvec iov[3]; /* make sure at least one for each open context */ 2830 struct kvec rsp_iov = {NULL, 0}; 2831 int resp_buftype; 2832 int uni_path_len; 2833 __le16 *copy_path = NULL; 2834 int copy_size; 2835 int rc = 0; 2836 unsigned int n_iov = 2; 2837 __u32 file_attributes = 0; 2838 char *pc_buf = NULL; 2839 int flags = 0; 2840 unsigned int total_len; 2841 __le16 *utf16_path = NULL; 2842 struct TCP_Server_Info *server; 2843 int retries = 0, cur_sleep = 1; 2844 2845 replay_again: 2846 /* reinitialize for possible replay */ 2847 flags = 0; 2848 n_iov = 2; 2849 server = cifs_pick_channel(ses); 2850 2851 cifs_dbg(FYI, "mkdir\n"); 2852 2853 /* resource #1: path allocation */ 2854 utf16_path = cifs_convert_path_to_utf16(full_path, cifs_sb); 2855 if (!utf16_path) 2856 return -ENOMEM; 2857 2858 if (!ses || !server) { 2859 rc = -EIO; 2860 goto err_free_path; 2861 } 2862 2863 /* resource #2: request */ 2864 rc = smb2_plain_req_init(SMB2_CREATE, tcon, server, 2865 (void **) &req, &total_len); 2866 if (rc) 2867 goto err_free_path; 2868 2869 2870 if (smb3_encryption_required(tcon)) 2871 flags |= CIFS_TRANSFORM_REQ; 2872 2873 req->ImpersonationLevel = IL_IMPERSONATION; 2874 req->DesiredAccess = cpu_to_le32(FILE_WRITE_ATTRIBUTES); 2875 /* File attributes ignored on open (used in create though) */ 2876 req->FileAttributes = cpu_to_le32(file_attributes); 2877 req->ShareAccess = FILE_SHARE_ALL_LE; 2878 req->CreateDisposition = cpu_to_le32(FILE_CREATE); 2879 req->CreateOptions = cpu_to_le32(CREATE_NOT_FILE); 2880 2881 iov[0].iov_base = (char *)req; 2882 /* -1 since last byte is buf[0] which is sent below (path) */ 2883 iov[0].iov_len = total_len - 1; 2884 2885 req->NameOffset = cpu_to_le16(sizeof(struct smb2_create_req)); 2886 2887 /* [MS-SMB2] 2.2.13 NameOffset: 2888 * If SMB2_FLAGS_DFS_OPERATIONS is set in the Flags field of 2889 * the SMB2 header, the file name includes a prefix that will 2890 * be processed during DFS name normalization as specified in 2891 * section 3.3.5.9. Otherwise, the file name is relative to 2892 * the share that is identified by the TreeId in the SMB2 2893 * header. 2894 */ 2895 if (tcon->share_flags & SHI1005_FLAGS_DFS) { 2896 int name_len; 2897 2898 req->hdr.Flags |= SMB2_FLAGS_DFS_OPERATIONS; 2899 rc = alloc_path_with_tree_prefix(©_path, ©_size, 2900 &name_len, 2901 tcon->tree_name, utf16_path); 2902 if (rc) 2903 goto err_free_req; 2904 2905 req->NameLength = cpu_to_le16(name_len * 2); 2906 uni_path_len = copy_size; 2907 /* free before overwriting resource */ 2908 kfree(utf16_path); 2909 utf16_path = copy_path; 2910 } else { 2911 uni_path_len = (2 * UniStrnlen((wchar_t *)utf16_path, PATH_MAX)) + 2; 2912 /* MUST set path len (NameLength) to 0 opening root of share */ 2913 req->NameLength = cpu_to_le16(uni_path_len - 2); 2914 if (uni_path_len % 8 != 0) { 2915 copy_size = roundup(uni_path_len, 8); 2916 copy_path = kzalloc(copy_size, GFP_KERNEL); 2917 if (!copy_path) { 2918 rc = -ENOMEM; 2919 goto err_free_req; 2920 } 2921 memcpy((char *)copy_path, (const char *)utf16_path, 2922 uni_path_len); 2923 uni_path_len = copy_size; 2924 /* free before overwriting resource */ 2925 kfree(utf16_path); 2926 utf16_path = copy_path; 2927 } 2928 } 2929 2930 iov[1].iov_len = uni_path_len; 2931 iov[1].iov_base = utf16_path; 2932 req->RequestedOplockLevel = SMB2_OPLOCK_LEVEL_NONE; 2933 2934 if (tcon->posix_extensions) { 2935 /* resource #3: posix buf */ 2936 rc = add_posix_context(iov, &n_iov, mode); 2937 if (rc) 2938 goto err_free_req; 2939 req->CreateContextsOffset = cpu_to_le32( 2940 sizeof(struct smb2_create_req) + 2941 iov[1].iov_len); 2942 le32_add_cpu(&req->CreateContextsLength, iov[n_iov-1].iov_len); 2943 pc_buf = iov[n_iov-1].iov_base; 2944 } 2945 2946 2947 memset(&rqst, 0, sizeof(struct smb_rqst)); 2948 rqst.rq_iov = iov; 2949 rqst.rq_nvec = n_iov; 2950 2951 /* no need to inc num_remote_opens because we close it just below */ 2952 trace_smb3_posix_mkdir_enter(xid, tcon->tid, ses->Suid, full_path, CREATE_NOT_FILE, 2953 FILE_WRITE_ATTRIBUTES); 2954 2955 if (retries) 2956 smb2_set_replay(server, &rqst); 2957 2958 /* resource #4: response buffer */ 2959 rc = cifs_send_recv(xid, ses, server, 2960 &rqst, &resp_buftype, flags, &rsp_iov); 2961 if (rc) { 2962 cifs_stats_fail_inc(tcon, SMB2_CREATE_HE); 2963 trace_smb3_posix_mkdir_err(xid, tcon->tid, ses->Suid, 2964 CREATE_NOT_FILE, 2965 FILE_WRITE_ATTRIBUTES, rc); 2966 goto err_free_rsp_buf; 2967 } 2968 2969 /* 2970 * Although unlikely to be possible for rsp to be null and rc not set, 2971 * adding check below is slightly safer long term (and quiets Coverity 2972 * warning) 2973 */ 2974 rsp = (struct smb2_create_rsp *)rsp_iov.iov_base; 2975 if (rsp == NULL) { 2976 rc = -EIO; 2977 kfree(pc_buf); 2978 goto err_free_req; 2979 } 2980 2981 trace_smb3_posix_mkdir_done(xid, rsp->PersistentFileId, tcon->tid, ses->Suid, 2982 CREATE_NOT_FILE, FILE_WRITE_ATTRIBUTES); 2983 2984 SMB2_close(xid, tcon, rsp->PersistentFileId, rsp->VolatileFileId); 2985 2986 /* Eventually save off posix specific response info and timestamps */ 2987 2988 err_free_rsp_buf: 2989 free_rsp_buf(resp_buftype, rsp_iov.iov_base); 2990 kfree(pc_buf); 2991 err_free_req: 2992 cifs_small_buf_release(req); 2993 err_free_path: 2994 kfree(utf16_path); 2995 2996 if (is_replayable_error(rc) && 2997 smb2_should_replay(tcon, &retries, &cur_sleep)) 2998 goto replay_again; 2999 3000 return rc; 3001 } 3002 3003 int 3004 SMB2_open_init(struct cifs_tcon *tcon, struct TCP_Server_Info *server, 3005 struct smb_rqst *rqst, __u8 *oplock, 3006 struct cifs_open_parms *oparms, __le16 *path) 3007 { 3008 struct smb2_create_req *req; 3009 unsigned int n_iov = 2; 3010 __u32 file_attributes = 0; 3011 int copy_size; 3012 int uni_path_len; 3013 unsigned int total_len; 3014 struct kvec *iov = rqst->rq_iov; 3015 __le16 *copy_path; 3016 int rc; 3017 3018 rc = smb2_plain_req_init(SMB2_CREATE, tcon, server, 3019 (void **) &req, &total_len); 3020 if (rc) 3021 return rc; 3022 3023 iov[0].iov_base = (char *)req; 3024 /* -1 since last byte is buf[0] which is sent below (path) */ 3025 iov[0].iov_len = total_len - 1; 3026 3027 if (oparms->create_options & CREATE_OPTION_READONLY) 3028 file_attributes |= ATTR_READONLY; 3029 if (oparms->create_options & CREATE_OPTION_SPECIAL) 3030 file_attributes |= ATTR_SYSTEM; 3031 3032 req->ImpersonationLevel = IL_IMPERSONATION; 3033 req->DesiredAccess = cpu_to_le32(oparms->desired_access); 3034 /* File attributes ignored on open (used in create though) */ 3035 req->FileAttributes = cpu_to_le32(file_attributes); 3036 req->ShareAccess = FILE_SHARE_ALL_LE; 3037 3038 req->CreateDisposition = cpu_to_le32(oparms->disposition); 3039 req->CreateOptions = cpu_to_le32(oparms->create_options & CREATE_OPTIONS_MASK); 3040 req->NameOffset = cpu_to_le16(sizeof(struct smb2_create_req)); 3041 3042 /* [MS-SMB2] 2.2.13 NameOffset: 3043 * If SMB2_FLAGS_DFS_OPERATIONS is set in the Flags field of 3044 * the SMB2 header, the file name includes a prefix that will 3045 * be processed during DFS name normalization as specified in 3046 * section 3.3.5.9. Otherwise, the file name is relative to 3047 * the share that is identified by the TreeId in the SMB2 3048 * header. 3049 */ 3050 if (tcon->share_flags & SHI1005_FLAGS_DFS) { 3051 int name_len; 3052 3053 req->hdr.Flags |= SMB2_FLAGS_DFS_OPERATIONS; 3054 rc = alloc_path_with_tree_prefix(©_path, ©_size, 3055 &name_len, 3056 tcon->tree_name, path); 3057 if (rc) 3058 return rc; 3059 req->NameLength = cpu_to_le16(name_len * 2); 3060 uni_path_len = copy_size; 3061 path = copy_path; 3062 } else { 3063 uni_path_len = (2 * UniStrnlen((wchar_t *)path, PATH_MAX)) + 2; 3064 /* MUST set path len (NameLength) to 0 opening root of share */ 3065 req->NameLength = cpu_to_le16(uni_path_len - 2); 3066 copy_size = round_up(uni_path_len, 8); 3067 copy_path = kzalloc(copy_size, GFP_KERNEL); 3068 if (!copy_path) 3069 return -ENOMEM; 3070 memcpy((char *)copy_path, (const char *)path, 3071 uni_path_len); 3072 uni_path_len = copy_size; 3073 path = copy_path; 3074 } 3075 3076 iov[1].iov_len = uni_path_len; 3077 iov[1].iov_base = path; 3078 3079 if ((!server->oplocks) || (tcon->no_lease)) 3080 *oplock = SMB2_OPLOCK_LEVEL_NONE; 3081 3082 if (!(server->capabilities & SMB2_GLOBAL_CAP_LEASING) || 3083 *oplock == SMB2_OPLOCK_LEVEL_NONE) 3084 req->RequestedOplockLevel = *oplock; 3085 else if (!(server->capabilities & SMB2_GLOBAL_CAP_DIRECTORY_LEASING) && 3086 (oparms->create_options & CREATE_NOT_FILE)) 3087 req->RequestedOplockLevel = *oplock; /* no srv lease support */ 3088 else { 3089 rc = add_lease_context(server, req, iov, &n_iov, 3090 oparms->fid->lease_key, oplock, 3091 oparms->fid->parent_lease_key, 3092 oparms->lease_flags); 3093 if (rc) 3094 return rc; 3095 } 3096 3097 if (*oplock == SMB2_OPLOCK_LEVEL_BATCH) { 3098 rc = add_durable_context(iov, &n_iov, oparms, 3099 tcon->use_persistent); 3100 if (rc) 3101 return rc; 3102 } 3103 3104 if (tcon->posix_extensions) { 3105 rc = add_posix_context(iov, &n_iov, oparms->mode); 3106 if (rc) 3107 return rc; 3108 } 3109 3110 if (tcon->snapshot_time) { 3111 cifs_dbg(FYI, "adding snapshot context\n"); 3112 rc = add_twarp_context(iov, &n_iov, tcon->snapshot_time); 3113 if (rc) 3114 return rc; 3115 } 3116 3117 if ((oparms->disposition != FILE_OPEN) && (oparms->cifs_sb)) { 3118 bool set_mode; 3119 bool set_owner; 3120 3121 if ((oparms->cifs_sb->mnt_cifs_flags & CIFS_MOUNT_MODE_FROM_SID) && 3122 (oparms->mode != ACL_NO_MODE)) 3123 set_mode = true; 3124 else { 3125 set_mode = false; 3126 oparms->mode = ACL_NO_MODE; 3127 } 3128 3129 if (oparms->cifs_sb->mnt_cifs_flags & CIFS_MOUNT_UID_FROM_ACL) 3130 set_owner = true; 3131 else 3132 set_owner = false; 3133 3134 if (set_owner | set_mode) { 3135 cifs_dbg(FYI, "add sd with mode 0x%x\n", oparms->mode); 3136 rc = add_sd_context(iov, &n_iov, oparms->mode, set_owner); 3137 if (rc) 3138 return rc; 3139 } 3140 } 3141 3142 add_query_id_context(iov, &n_iov); 3143 add_ea_context(oparms, iov, &n_iov); 3144 3145 if (n_iov > 2) { 3146 /* 3147 * We have create contexts behind iov[1] (the file 3148 * name), point at them from the main create request 3149 */ 3150 req->CreateContextsOffset = cpu_to_le32( 3151 sizeof(struct smb2_create_req) + 3152 iov[1].iov_len); 3153 req->CreateContextsLength = 0; 3154 3155 for (unsigned int i = 2; i < (n_iov-1); i++) { 3156 struct kvec *v = &iov[i]; 3157 size_t len = v->iov_len; 3158 struct create_context *cctx = 3159 (struct create_context *)v->iov_base; 3160 3161 cctx->Next = cpu_to_le32(len); 3162 le32_add_cpu(&req->CreateContextsLength, len); 3163 } 3164 le32_add_cpu(&req->CreateContextsLength, 3165 iov[n_iov-1].iov_len); 3166 } 3167 3168 rqst->rq_nvec = n_iov; 3169 return 0; 3170 } 3171 3172 /* rq_iov[0] is the request and is released by cifs_small_buf_release(). 3173 * All other vectors are freed by kfree(). 3174 */ 3175 void 3176 SMB2_open_free(struct smb_rqst *rqst) 3177 { 3178 int i; 3179 3180 if (rqst && rqst->rq_iov) { 3181 cifs_small_buf_release(rqst->rq_iov[0].iov_base); 3182 for (i = 1; i < rqst->rq_nvec; i++) 3183 if (rqst->rq_iov[i].iov_base != smb2_padding) 3184 kfree(rqst->rq_iov[i].iov_base); 3185 } 3186 } 3187 3188 int 3189 SMB2_open(const unsigned int xid, struct cifs_open_parms *oparms, __le16 *path, 3190 __u8 *oplock, struct smb2_file_all_info *buf, 3191 struct create_posix_rsp *posix, 3192 struct kvec *err_iov, int *buftype) 3193 { 3194 struct smb_rqst rqst; 3195 struct smb2_create_rsp *rsp = NULL; 3196 struct cifs_tcon *tcon = oparms->tcon; 3197 struct cifs_ses *ses = tcon->ses; 3198 struct TCP_Server_Info *server; 3199 struct kvec iov[SMB2_CREATE_IOV_SIZE]; 3200 struct kvec rsp_iov = {NULL, 0}; 3201 int resp_buftype = CIFS_NO_BUFFER; 3202 int rc = 0; 3203 int flags = 0; 3204 int retries = 0, cur_sleep = 1; 3205 3206 replay_again: 3207 /* reinitialize for possible replay */ 3208 flags = 0; 3209 server = cifs_pick_channel(ses); 3210 oparms->replay = !!(retries); 3211 3212 cifs_dbg(FYI, "create/open\n"); 3213 if (!ses || !server) 3214 return -EIO; 3215 3216 if (smb3_encryption_required(tcon)) 3217 flags |= CIFS_TRANSFORM_REQ; 3218 3219 memset(&rqst, 0, sizeof(struct smb_rqst)); 3220 memset(&iov, 0, sizeof(iov)); 3221 rqst.rq_iov = iov; 3222 rqst.rq_nvec = SMB2_CREATE_IOV_SIZE; 3223 3224 rc = SMB2_open_init(tcon, server, 3225 &rqst, oplock, oparms, path); 3226 if (rc) 3227 goto creat_exit; 3228 3229 trace_smb3_open_enter(xid, tcon->tid, tcon->ses->Suid, oparms->path, 3230 oparms->create_options, oparms->desired_access); 3231 3232 if (retries) 3233 smb2_set_replay(server, &rqst); 3234 3235 rc = cifs_send_recv(xid, ses, server, 3236 &rqst, &resp_buftype, flags, 3237 &rsp_iov); 3238 rsp = (struct smb2_create_rsp *)rsp_iov.iov_base; 3239 3240 if (rc != 0) { 3241 cifs_stats_fail_inc(tcon, SMB2_CREATE_HE); 3242 if (err_iov && rsp) { 3243 *err_iov = rsp_iov; 3244 *buftype = resp_buftype; 3245 resp_buftype = CIFS_NO_BUFFER; 3246 rsp = NULL; 3247 } 3248 trace_smb3_open_err(xid, tcon->tid, ses->Suid, 3249 oparms->create_options, oparms->desired_access, rc); 3250 if (rc == -EREMCHG) { 3251 pr_warn_once("server share %s deleted\n", 3252 tcon->tree_name); 3253 tcon->need_reconnect = true; 3254 } 3255 goto creat_exit; 3256 } else if (rsp == NULL) /* unlikely to happen, but safer to check */ 3257 goto creat_exit; 3258 else 3259 trace_smb3_open_done(xid, rsp->PersistentFileId, tcon->tid, ses->Suid, 3260 oparms->create_options, oparms->desired_access); 3261 3262 atomic_inc(&tcon->num_remote_opens); 3263 oparms->fid->persistent_fid = rsp->PersistentFileId; 3264 oparms->fid->volatile_fid = rsp->VolatileFileId; 3265 oparms->fid->access = oparms->desired_access; 3266 #ifdef CONFIG_CIFS_DEBUG2 3267 oparms->fid->mid = le64_to_cpu(rsp->hdr.MessageId); 3268 #endif /* CIFS_DEBUG2 */ 3269 3270 if (buf) { 3271 buf->CreationTime = rsp->CreationTime; 3272 buf->LastAccessTime = rsp->LastAccessTime; 3273 buf->LastWriteTime = rsp->LastWriteTime; 3274 buf->ChangeTime = rsp->ChangeTime; 3275 buf->AllocationSize = rsp->AllocationSize; 3276 buf->EndOfFile = rsp->EndofFile; 3277 buf->Attributes = rsp->FileAttributes; 3278 buf->NumberOfLinks = cpu_to_le32(1); 3279 buf->DeletePending = 0; /* successful open = not delete pending */ 3280 } 3281 3282 3283 rc = smb2_parse_contexts(server, &rsp_iov, &oparms->fid->epoch, 3284 oparms->fid->lease_key, oplock, buf, posix); 3285 creat_exit: 3286 SMB2_open_free(&rqst); 3287 free_rsp_buf(resp_buftype, rsp); 3288 3289 if (is_replayable_error(rc) && 3290 smb2_should_replay(tcon, &retries, &cur_sleep)) 3291 goto replay_again; 3292 3293 return rc; 3294 } 3295 3296 int 3297 SMB2_ioctl_init(struct cifs_tcon *tcon, struct TCP_Server_Info *server, 3298 struct smb_rqst *rqst, 3299 u64 persistent_fid, u64 volatile_fid, u32 opcode, 3300 char *in_data, u32 indatalen, 3301 __u32 max_response_size) 3302 { 3303 struct smb2_ioctl_req *req; 3304 struct kvec *iov = rqst->rq_iov; 3305 unsigned int total_len; 3306 int rc; 3307 char *in_data_buf; 3308 3309 rc = smb2_ioctl_req_init(opcode, tcon, server, 3310 (void **) &req, &total_len); 3311 if (rc) 3312 return rc; 3313 3314 if (indatalen) { 3315 /* 3316 * indatalen is usually small at a couple of bytes max, so 3317 * just allocate through generic pool 3318 */ 3319 in_data_buf = kmemdup(in_data, indatalen, GFP_NOFS); 3320 if (!in_data_buf) { 3321 cifs_small_buf_release(req); 3322 return -ENOMEM; 3323 } 3324 } 3325 3326 req->CtlCode = cpu_to_le32(opcode); 3327 req->PersistentFileId = persistent_fid; 3328 req->VolatileFileId = volatile_fid; 3329 3330 iov[0].iov_base = (char *)req; 3331 /* 3332 * If no input data, the size of ioctl struct in 3333 * protocol spec still includes a 1 byte data buffer, 3334 * but if input data passed to ioctl, we do not 3335 * want to double count this, so we do not send 3336 * the dummy one byte of data in iovec[0] if sending 3337 * input data (in iovec[1]). 3338 */ 3339 if (indatalen) { 3340 req->InputCount = cpu_to_le32(indatalen); 3341 /* do not set InputOffset if no input data */ 3342 req->InputOffset = 3343 cpu_to_le32(offsetof(struct smb2_ioctl_req, Buffer)); 3344 rqst->rq_nvec = 2; 3345 iov[0].iov_len = total_len - 1; 3346 iov[1].iov_base = in_data_buf; 3347 iov[1].iov_len = indatalen; 3348 } else { 3349 rqst->rq_nvec = 1; 3350 iov[0].iov_len = total_len; 3351 } 3352 3353 req->OutputOffset = 0; 3354 req->OutputCount = 0; /* MBZ */ 3355 3356 /* 3357 * In most cases max_response_size is set to 16K (CIFSMaxBufSize) 3358 * We Could increase default MaxOutputResponse, but that could require 3359 * more credits. Windows typically sets this smaller, but for some 3360 * ioctls it may be useful to allow server to send more. No point 3361 * limiting what the server can send as long as fits in one credit 3362 * We can not handle more than CIFS_MAX_BUF_SIZE yet but may want 3363 * to increase this limit up in the future. 3364 * Note that for snapshot queries that servers like Azure expect that 3365 * the first query be minimal size (and just used to get the number/size 3366 * of previous versions) so response size must be specified as EXACTLY 3367 * sizeof(struct snapshot_array) which is 16 when rounded up to multiple 3368 * of eight bytes. Currently that is the only case where we set max 3369 * response size smaller. 3370 */ 3371 req->MaxOutputResponse = cpu_to_le32(max_response_size); 3372 req->hdr.CreditCharge = 3373 cpu_to_le16(DIV_ROUND_UP(max(indatalen, max_response_size), 3374 SMB2_MAX_BUFFER_SIZE)); 3375 /* always an FSCTL (for now) */ 3376 req->Flags = cpu_to_le32(SMB2_0_IOCTL_IS_FSCTL); 3377 3378 /* validate negotiate request must be signed - see MS-SMB2 3.2.5.5 */ 3379 if (opcode == FSCTL_VALIDATE_NEGOTIATE_INFO) 3380 req->hdr.Flags |= SMB2_FLAGS_SIGNED; 3381 3382 return 0; 3383 } 3384 3385 void 3386 SMB2_ioctl_free(struct smb_rqst *rqst) 3387 { 3388 int i; 3389 3390 if (rqst && rqst->rq_iov) { 3391 cifs_small_buf_release(rqst->rq_iov[0].iov_base); /* request */ 3392 for (i = 1; i < rqst->rq_nvec; i++) 3393 if (rqst->rq_iov[i].iov_base != smb2_padding) 3394 kfree(rqst->rq_iov[i].iov_base); 3395 } 3396 } 3397 3398 3399 /* 3400 * SMB2 IOCTL is used for both IOCTLs and FSCTLs 3401 */ 3402 int 3403 SMB2_ioctl(const unsigned int xid, struct cifs_tcon *tcon, u64 persistent_fid, 3404 u64 volatile_fid, u32 opcode, char *in_data, u32 indatalen, 3405 u32 max_out_data_len, char **out_data, 3406 u32 *plen /* returned data len */) 3407 { 3408 struct smb_rqst rqst; 3409 struct smb2_ioctl_rsp *rsp = NULL; 3410 struct cifs_ses *ses; 3411 struct TCP_Server_Info *server; 3412 struct kvec iov[SMB2_IOCTL_IOV_SIZE]; 3413 struct kvec rsp_iov = {NULL, 0}; 3414 int resp_buftype = CIFS_NO_BUFFER; 3415 int rc = 0; 3416 int flags = 0; 3417 int retries = 0, cur_sleep = 1; 3418 3419 if (!tcon) 3420 return -EIO; 3421 3422 ses = tcon->ses; 3423 if (!ses) 3424 return -EIO; 3425 3426 replay_again: 3427 /* reinitialize for possible replay */ 3428 flags = 0; 3429 server = cifs_pick_channel(ses); 3430 3431 if (!server) 3432 return -EIO; 3433 3434 cifs_dbg(FYI, "SMB2 IOCTL\n"); 3435 3436 if (out_data != NULL) 3437 *out_data = NULL; 3438 3439 /* zero out returned data len, in case of error */ 3440 if (plen) 3441 *plen = 0; 3442 3443 if (smb3_encryption_required(tcon)) 3444 flags |= CIFS_TRANSFORM_REQ; 3445 3446 memset(&rqst, 0, sizeof(struct smb_rqst)); 3447 memset(&iov, 0, sizeof(iov)); 3448 rqst.rq_iov = iov; 3449 rqst.rq_nvec = SMB2_IOCTL_IOV_SIZE; 3450 3451 rc = SMB2_ioctl_init(tcon, server, 3452 &rqst, persistent_fid, volatile_fid, opcode, 3453 in_data, indatalen, max_out_data_len); 3454 if (rc) 3455 goto ioctl_exit; 3456 3457 if (retries) 3458 smb2_set_replay(server, &rqst); 3459 3460 rc = cifs_send_recv(xid, ses, server, 3461 &rqst, &resp_buftype, flags, 3462 &rsp_iov); 3463 rsp = (struct smb2_ioctl_rsp *)rsp_iov.iov_base; 3464 3465 if (rc != 0) 3466 trace_smb3_fsctl_err(xid, persistent_fid, tcon->tid, 3467 ses->Suid, 0, opcode, rc); 3468 3469 if ((rc != 0) && (rc != -EINVAL) && (rc != -E2BIG)) { 3470 cifs_stats_fail_inc(tcon, SMB2_IOCTL_HE); 3471 goto ioctl_exit; 3472 } else if (rc == -EINVAL) { 3473 if ((opcode != FSCTL_SRV_COPYCHUNK_WRITE) && 3474 (opcode != FSCTL_SRV_COPYCHUNK)) { 3475 cifs_stats_fail_inc(tcon, SMB2_IOCTL_HE); 3476 goto ioctl_exit; 3477 } 3478 } else if (rc == -E2BIG) { 3479 if (opcode != FSCTL_QUERY_ALLOCATED_RANGES) { 3480 cifs_stats_fail_inc(tcon, SMB2_IOCTL_HE); 3481 goto ioctl_exit; 3482 } 3483 } 3484 3485 /* check if caller wants to look at return data or just return rc */ 3486 if ((plen == NULL) || (out_data == NULL)) 3487 goto ioctl_exit; 3488 3489 /* 3490 * Although unlikely to be possible for rsp to be null and rc not set, 3491 * adding check below is slightly safer long term (and quiets Coverity 3492 * warning) 3493 */ 3494 if (rsp == NULL) { 3495 rc = -EIO; 3496 goto ioctl_exit; 3497 } 3498 3499 *plen = le32_to_cpu(rsp->OutputCount); 3500 3501 /* We check for obvious errors in the output buffer length and offset */ 3502 if (*plen == 0) 3503 goto ioctl_exit; /* server returned no data */ 3504 else if (*plen > rsp_iov.iov_len || *plen > 0xFF00) { 3505 cifs_tcon_dbg(VFS, "srv returned invalid ioctl length: %d\n", *plen); 3506 *plen = 0; 3507 rc = -EIO; 3508 goto ioctl_exit; 3509 } 3510 3511 if (rsp_iov.iov_len - *plen < le32_to_cpu(rsp->OutputOffset)) { 3512 cifs_tcon_dbg(VFS, "Malformed ioctl resp: len %d offset %d\n", *plen, 3513 le32_to_cpu(rsp->OutputOffset)); 3514 *plen = 0; 3515 rc = -EIO; 3516 goto ioctl_exit; 3517 } 3518 3519 *out_data = kmemdup((char *)rsp + le32_to_cpu(rsp->OutputOffset), 3520 *plen, GFP_KERNEL); 3521 if (*out_data == NULL) { 3522 rc = -ENOMEM; 3523 goto ioctl_exit; 3524 } 3525 3526 ioctl_exit: 3527 SMB2_ioctl_free(&rqst); 3528 free_rsp_buf(resp_buftype, rsp); 3529 3530 if (is_replayable_error(rc) && 3531 smb2_should_replay(tcon, &retries, &cur_sleep)) 3532 goto replay_again; 3533 3534 return rc; 3535 } 3536 3537 /* 3538 * Individual callers to ioctl worker function follow 3539 */ 3540 3541 int 3542 SMB2_set_compression(const unsigned int xid, struct cifs_tcon *tcon, 3543 u64 persistent_fid, u64 volatile_fid) 3544 { 3545 int rc; 3546 struct compress_ioctl fsctl_input; 3547 char *ret_data = NULL; 3548 3549 fsctl_input.CompressionState = 3550 cpu_to_le16(COMPRESSION_FORMAT_DEFAULT); 3551 3552 rc = SMB2_ioctl(xid, tcon, persistent_fid, volatile_fid, 3553 FSCTL_SET_COMPRESSION, 3554 (char *)&fsctl_input /* data input */, 3555 2 /* in data len */, CIFSMaxBufSize /* max out data */, 3556 &ret_data /* out data */, NULL); 3557 3558 cifs_dbg(FYI, "set compression rc %d\n", rc); 3559 3560 return rc; 3561 } 3562 3563 int 3564 SMB2_close_init(struct cifs_tcon *tcon, struct TCP_Server_Info *server, 3565 struct smb_rqst *rqst, 3566 u64 persistent_fid, u64 volatile_fid, bool query_attrs) 3567 { 3568 struct smb2_close_req *req; 3569 struct kvec *iov = rqst->rq_iov; 3570 unsigned int total_len; 3571 int rc; 3572 3573 rc = smb2_plain_req_init(SMB2_CLOSE, tcon, server, 3574 (void **) &req, &total_len); 3575 if (rc) 3576 return rc; 3577 3578 req->PersistentFileId = persistent_fid; 3579 req->VolatileFileId = volatile_fid; 3580 if (query_attrs) 3581 req->Flags = SMB2_CLOSE_FLAG_POSTQUERY_ATTRIB; 3582 else 3583 req->Flags = 0; 3584 iov[0].iov_base = (char *)req; 3585 iov[0].iov_len = total_len; 3586 3587 return 0; 3588 } 3589 3590 void 3591 SMB2_close_free(struct smb_rqst *rqst) 3592 { 3593 if (rqst && rqst->rq_iov) 3594 cifs_small_buf_release(rqst->rq_iov[0].iov_base); /* request */ 3595 } 3596 3597 int 3598 __SMB2_close(const unsigned int xid, struct cifs_tcon *tcon, 3599 u64 persistent_fid, u64 volatile_fid, 3600 struct smb2_file_network_open_info *pbuf) 3601 { 3602 struct smb_rqst rqst; 3603 struct smb2_close_rsp *rsp = NULL; 3604 struct cifs_ses *ses = tcon->ses; 3605 struct TCP_Server_Info *server; 3606 struct kvec iov[1]; 3607 struct kvec rsp_iov; 3608 int resp_buftype = CIFS_NO_BUFFER; 3609 int rc = 0; 3610 int flags = 0; 3611 bool query_attrs = false; 3612 int retries = 0, cur_sleep = 1; 3613 3614 replay_again: 3615 /* reinitialize for possible replay */ 3616 flags = 0; 3617 query_attrs = false; 3618 server = cifs_pick_channel(ses); 3619 3620 cifs_dbg(FYI, "Close\n"); 3621 3622 if (!ses || !server) 3623 return -EIO; 3624 3625 if (smb3_encryption_required(tcon)) 3626 flags |= CIFS_TRANSFORM_REQ; 3627 3628 memset(&rqst, 0, sizeof(struct smb_rqst)); 3629 memset(&iov, 0, sizeof(iov)); 3630 rqst.rq_iov = iov; 3631 rqst.rq_nvec = 1; 3632 3633 /* check if need to ask server to return timestamps in close response */ 3634 if (pbuf) 3635 query_attrs = true; 3636 3637 trace_smb3_close_enter(xid, persistent_fid, tcon->tid, ses->Suid); 3638 rc = SMB2_close_init(tcon, server, 3639 &rqst, persistent_fid, volatile_fid, 3640 query_attrs); 3641 if (rc) 3642 goto close_exit; 3643 3644 if (retries) 3645 smb2_set_replay(server, &rqst); 3646 3647 rc = cifs_send_recv(xid, ses, server, 3648 &rqst, &resp_buftype, flags, &rsp_iov); 3649 rsp = (struct smb2_close_rsp *)rsp_iov.iov_base; 3650 3651 if (rc != 0) { 3652 cifs_stats_fail_inc(tcon, SMB2_CLOSE_HE); 3653 trace_smb3_close_err(xid, persistent_fid, tcon->tid, ses->Suid, 3654 rc); 3655 goto close_exit; 3656 } else { 3657 trace_smb3_close_done(xid, persistent_fid, tcon->tid, 3658 ses->Suid); 3659 if (pbuf) 3660 memcpy(&pbuf->network_open_info, 3661 &rsp->network_open_info, 3662 sizeof(pbuf->network_open_info)); 3663 atomic_dec(&tcon->num_remote_opens); 3664 } 3665 3666 close_exit: 3667 SMB2_close_free(&rqst); 3668 free_rsp_buf(resp_buftype, rsp); 3669 3670 /* retry close in a worker thread if this one is interrupted */ 3671 if (is_interrupt_error(rc)) { 3672 int tmp_rc; 3673 3674 tmp_rc = smb2_handle_cancelled_close(tcon, persistent_fid, 3675 volatile_fid); 3676 if (tmp_rc) 3677 cifs_dbg(VFS, "handle cancelled close fid 0x%llx returned error %d\n", 3678 persistent_fid, tmp_rc); 3679 } 3680 3681 if (is_replayable_error(rc) && 3682 smb2_should_replay(tcon, &retries, &cur_sleep)) 3683 goto replay_again; 3684 3685 return rc; 3686 } 3687 3688 int 3689 SMB2_close(const unsigned int xid, struct cifs_tcon *tcon, 3690 u64 persistent_fid, u64 volatile_fid) 3691 { 3692 return __SMB2_close(xid, tcon, persistent_fid, volatile_fid, NULL); 3693 } 3694 3695 int 3696 smb2_validate_iov(unsigned int offset, unsigned int buffer_length, 3697 struct kvec *iov, unsigned int min_buf_size) 3698 { 3699 unsigned int smb_len = iov->iov_len; 3700 char *end_of_smb = smb_len + (char *)iov->iov_base; 3701 char *begin_of_buf = offset + (char *)iov->iov_base; 3702 char *end_of_buf = begin_of_buf + buffer_length; 3703 3704 3705 if (buffer_length < min_buf_size) { 3706 cifs_dbg(VFS, "buffer length %d smaller than minimum size %d\n", 3707 buffer_length, min_buf_size); 3708 return -EINVAL; 3709 } 3710 3711 /* check if beyond RFC1001 maximum length */ 3712 if ((smb_len > 0x7FFFFF) || (buffer_length > 0x7FFFFF)) { 3713 cifs_dbg(VFS, "buffer length %d or smb length %d too large\n", 3714 buffer_length, smb_len); 3715 return -EINVAL; 3716 } 3717 3718 if ((begin_of_buf > end_of_smb) || (end_of_buf > end_of_smb)) { 3719 cifs_dbg(VFS, "Invalid server response, bad offset to data\n"); 3720 return -EINVAL; 3721 } 3722 3723 return 0; 3724 } 3725 3726 /* 3727 * If SMB buffer fields are valid, copy into temporary buffer to hold result. 3728 * Caller must free buffer. 3729 */ 3730 int 3731 smb2_validate_and_copy_iov(unsigned int offset, unsigned int buffer_length, 3732 struct kvec *iov, unsigned int minbufsize, 3733 char *data) 3734 { 3735 char *begin_of_buf = offset + (char *)iov->iov_base; 3736 int rc; 3737 3738 if (!data) 3739 return -EINVAL; 3740 3741 rc = smb2_validate_iov(offset, buffer_length, iov, minbufsize); 3742 if (rc) 3743 return rc; 3744 3745 memcpy(data, begin_of_buf, minbufsize); 3746 3747 return 0; 3748 } 3749 3750 int 3751 SMB2_query_info_init(struct cifs_tcon *tcon, struct TCP_Server_Info *server, 3752 struct smb_rqst *rqst, 3753 u64 persistent_fid, u64 volatile_fid, 3754 u8 info_class, u8 info_type, u32 additional_info, 3755 size_t output_len, size_t input_len, void *input) 3756 { 3757 struct smb2_query_info_req *req; 3758 struct kvec *iov = rqst->rq_iov; 3759 unsigned int total_len; 3760 size_t len; 3761 int rc; 3762 3763 if (unlikely(check_add_overflow(input_len, sizeof(*req), &len) || 3764 len > CIFSMaxBufSize)) 3765 return -EINVAL; 3766 3767 rc = smb2_plain_req_init(SMB2_QUERY_INFO, tcon, server, 3768 (void **) &req, &total_len); 3769 if (rc) 3770 return rc; 3771 3772 req->InfoType = info_type; 3773 req->FileInfoClass = info_class; 3774 req->PersistentFileId = persistent_fid; 3775 req->VolatileFileId = volatile_fid; 3776 req->AdditionalInformation = cpu_to_le32(additional_info); 3777 3778 req->OutputBufferLength = cpu_to_le32(output_len); 3779 if (input_len) { 3780 req->InputBufferLength = cpu_to_le32(input_len); 3781 /* total_len for smb query request never close to le16 max */ 3782 req->InputBufferOffset = cpu_to_le16(total_len - 1); 3783 memcpy(req->Buffer, input, input_len); 3784 } 3785 3786 iov[0].iov_base = (char *)req; 3787 /* 1 for Buffer */ 3788 iov[0].iov_len = len; 3789 return 0; 3790 } 3791 3792 void 3793 SMB2_query_info_free(struct smb_rqst *rqst) 3794 { 3795 if (rqst && rqst->rq_iov) 3796 cifs_buf_release(rqst->rq_iov[0].iov_base); /* request */ 3797 } 3798 3799 static int 3800 query_info(const unsigned int xid, struct cifs_tcon *tcon, 3801 u64 persistent_fid, u64 volatile_fid, u8 info_class, u8 info_type, 3802 u32 additional_info, size_t output_len, size_t min_len, void **data, 3803 u32 *dlen) 3804 { 3805 struct smb_rqst rqst; 3806 struct smb2_query_info_rsp *rsp = NULL; 3807 struct kvec iov[1]; 3808 struct kvec rsp_iov; 3809 int rc = 0; 3810 int resp_buftype = CIFS_NO_BUFFER; 3811 struct cifs_ses *ses = tcon->ses; 3812 struct TCP_Server_Info *server; 3813 int flags = 0; 3814 bool allocated = false; 3815 int retries = 0, cur_sleep = 1; 3816 3817 cifs_dbg(FYI, "Query Info\n"); 3818 3819 if (!ses) 3820 return -EIO; 3821 3822 replay_again: 3823 /* reinitialize for possible replay */ 3824 flags = 0; 3825 allocated = false; 3826 server = cifs_pick_channel(ses); 3827 3828 if (!server) 3829 return -EIO; 3830 3831 if (smb3_encryption_required(tcon)) 3832 flags |= CIFS_TRANSFORM_REQ; 3833 3834 memset(&rqst, 0, sizeof(struct smb_rqst)); 3835 memset(&iov, 0, sizeof(iov)); 3836 rqst.rq_iov = iov; 3837 rqst.rq_nvec = 1; 3838 3839 rc = SMB2_query_info_init(tcon, server, 3840 &rqst, persistent_fid, volatile_fid, 3841 info_class, info_type, additional_info, 3842 output_len, 0, NULL); 3843 if (rc) 3844 goto qinf_exit; 3845 3846 trace_smb3_query_info_enter(xid, persistent_fid, tcon->tid, 3847 ses->Suid, info_class, (__u32)info_type); 3848 3849 if (retries) 3850 smb2_set_replay(server, &rqst); 3851 3852 rc = cifs_send_recv(xid, ses, server, 3853 &rqst, &resp_buftype, flags, &rsp_iov); 3854 rsp = (struct smb2_query_info_rsp *)rsp_iov.iov_base; 3855 3856 if (rc) { 3857 cifs_stats_fail_inc(tcon, SMB2_QUERY_INFO_HE); 3858 trace_smb3_query_info_err(xid, persistent_fid, tcon->tid, 3859 ses->Suid, info_class, (__u32)info_type, rc); 3860 goto qinf_exit; 3861 } 3862 3863 trace_smb3_query_info_done(xid, persistent_fid, tcon->tid, 3864 ses->Suid, info_class, (__u32)info_type); 3865 3866 if (dlen) { 3867 *dlen = le32_to_cpu(rsp->OutputBufferLength); 3868 if (!*data) { 3869 *data = kmalloc(*dlen, GFP_KERNEL); 3870 if (!*data) { 3871 cifs_tcon_dbg(VFS, 3872 "Error %d allocating memory for acl\n", 3873 rc); 3874 *dlen = 0; 3875 rc = -ENOMEM; 3876 goto qinf_exit; 3877 } 3878 allocated = true; 3879 } 3880 } 3881 3882 rc = smb2_validate_and_copy_iov(le16_to_cpu(rsp->OutputBufferOffset), 3883 le32_to_cpu(rsp->OutputBufferLength), 3884 &rsp_iov, dlen ? *dlen : min_len, *data); 3885 if (rc && allocated) { 3886 kfree(*data); 3887 *data = NULL; 3888 *dlen = 0; 3889 } 3890 3891 qinf_exit: 3892 SMB2_query_info_free(&rqst); 3893 free_rsp_buf(resp_buftype, rsp); 3894 3895 if (is_replayable_error(rc) && 3896 smb2_should_replay(tcon, &retries, &cur_sleep)) 3897 goto replay_again; 3898 3899 return rc; 3900 } 3901 3902 int SMB2_query_info(const unsigned int xid, struct cifs_tcon *tcon, 3903 u64 persistent_fid, u64 volatile_fid, struct smb2_file_all_info *data) 3904 { 3905 return query_info(xid, tcon, persistent_fid, volatile_fid, 3906 FILE_ALL_INFORMATION, SMB2_O_INFO_FILE, 0, 3907 sizeof(struct smb2_file_all_info) + PATH_MAX * 2, 3908 sizeof(struct smb2_file_all_info), (void **)&data, 3909 NULL); 3910 } 3911 3912 #if 0 3913 /* currently unused, as now we are doing compounding instead (see smb311_posix_query_path_info) */ 3914 int 3915 SMB311_posix_query_info(const unsigned int xid, struct cifs_tcon *tcon, 3916 u64 persistent_fid, u64 volatile_fid, struct smb311_posix_qinfo *data, u32 *plen) 3917 { 3918 size_t output_len = sizeof(struct smb311_posix_qinfo *) + 3919 (sizeof(struct smb_sid) * 2) + (PATH_MAX * 2); 3920 *plen = 0; 3921 3922 return query_info(xid, tcon, persistent_fid, volatile_fid, 3923 SMB_FIND_FILE_POSIX_INFO, SMB2_O_INFO_FILE, 0, 3924 output_len, sizeof(struct smb311_posix_qinfo), (void **)&data, plen); 3925 /* Note caller must free "data" (passed in above). It may be allocated in query_info call */ 3926 } 3927 #endif 3928 3929 int 3930 SMB2_query_acl(const unsigned int xid, struct cifs_tcon *tcon, 3931 u64 persistent_fid, u64 volatile_fid, 3932 void **data, u32 *plen, u32 extra_info) 3933 { 3934 *plen = 0; 3935 3936 return query_info(xid, tcon, persistent_fid, volatile_fid, 3937 0, SMB2_O_INFO_SECURITY, extra_info, 3938 SMB2_MAX_BUFFER_SIZE, MIN_SEC_DESC_LEN, data, plen); 3939 } 3940 3941 int 3942 SMB2_get_srv_num(const unsigned int xid, struct cifs_tcon *tcon, 3943 u64 persistent_fid, u64 volatile_fid, __le64 *uniqueid) 3944 { 3945 return query_info(xid, tcon, persistent_fid, volatile_fid, 3946 FILE_INTERNAL_INFORMATION, SMB2_O_INFO_FILE, 0, 3947 sizeof(struct smb2_file_internal_info), 3948 sizeof(struct smb2_file_internal_info), 3949 (void **)&uniqueid, NULL); 3950 } 3951 3952 /* 3953 * CHANGE_NOTIFY Request is sent to get notifications on changes to a directory 3954 * See MS-SMB2 2.2.35 and 2.2.36 3955 */ 3956 3957 static int 3958 SMB2_notify_init(const unsigned int xid, struct smb_rqst *rqst, 3959 struct cifs_tcon *tcon, struct TCP_Server_Info *server, 3960 u64 persistent_fid, u64 volatile_fid, 3961 u32 completion_filter, bool watch_tree) 3962 { 3963 struct smb2_change_notify_req *req; 3964 struct kvec *iov = rqst->rq_iov; 3965 unsigned int total_len; 3966 int rc; 3967 3968 rc = smb2_plain_req_init(SMB2_CHANGE_NOTIFY, tcon, server, 3969 (void **) &req, &total_len); 3970 if (rc) 3971 return rc; 3972 3973 req->PersistentFileId = persistent_fid; 3974 req->VolatileFileId = volatile_fid; 3975 /* See note 354 of MS-SMB2, 64K max */ 3976 req->OutputBufferLength = 3977 cpu_to_le32(SMB2_MAX_BUFFER_SIZE - MAX_SMB2_HDR_SIZE); 3978 req->CompletionFilter = cpu_to_le32(completion_filter); 3979 if (watch_tree) 3980 req->Flags = cpu_to_le16(SMB2_WATCH_TREE); 3981 else 3982 req->Flags = 0; 3983 3984 iov[0].iov_base = (char *)req; 3985 iov[0].iov_len = total_len; 3986 3987 return 0; 3988 } 3989 3990 int 3991 SMB2_change_notify(const unsigned int xid, struct cifs_tcon *tcon, 3992 u64 persistent_fid, u64 volatile_fid, bool watch_tree, 3993 u32 completion_filter, u32 max_out_data_len, char **out_data, 3994 u32 *plen /* returned data len */) 3995 { 3996 struct cifs_ses *ses = tcon->ses; 3997 struct TCP_Server_Info *server; 3998 struct smb_rqst rqst; 3999 struct smb2_change_notify_rsp *smb_rsp; 4000 struct kvec iov[1]; 4001 struct kvec rsp_iov = {NULL, 0}; 4002 int resp_buftype = CIFS_NO_BUFFER; 4003 int flags = 0; 4004 int rc = 0; 4005 int retries = 0, cur_sleep = 1; 4006 4007 replay_again: 4008 /* reinitialize for possible replay */ 4009 flags = 0; 4010 server = cifs_pick_channel(ses); 4011 4012 cifs_dbg(FYI, "change notify\n"); 4013 if (!ses || !server) 4014 return -EIO; 4015 4016 if (smb3_encryption_required(tcon)) 4017 flags |= CIFS_TRANSFORM_REQ; 4018 4019 memset(&rqst, 0, sizeof(struct smb_rqst)); 4020 memset(&iov, 0, sizeof(iov)); 4021 if (plen) 4022 *plen = 0; 4023 4024 rqst.rq_iov = iov; 4025 rqst.rq_nvec = 1; 4026 4027 rc = SMB2_notify_init(xid, &rqst, tcon, server, 4028 persistent_fid, volatile_fid, 4029 completion_filter, watch_tree); 4030 if (rc) 4031 goto cnotify_exit; 4032 4033 trace_smb3_notify_enter(xid, persistent_fid, tcon->tid, ses->Suid, 4034 (u8)watch_tree, completion_filter); 4035 4036 if (retries) 4037 smb2_set_replay(server, &rqst); 4038 4039 rc = cifs_send_recv(xid, ses, server, 4040 &rqst, &resp_buftype, flags, &rsp_iov); 4041 4042 if (rc != 0) { 4043 cifs_stats_fail_inc(tcon, SMB2_CHANGE_NOTIFY_HE); 4044 trace_smb3_notify_err(xid, persistent_fid, tcon->tid, ses->Suid, 4045 (u8)watch_tree, completion_filter, rc); 4046 } else { 4047 trace_smb3_notify_done(xid, persistent_fid, tcon->tid, 4048 ses->Suid, (u8)watch_tree, completion_filter); 4049 /* validate that notify information is plausible */ 4050 if ((rsp_iov.iov_base == NULL) || 4051 (rsp_iov.iov_len < sizeof(struct smb2_change_notify_rsp) + 1)) 4052 goto cnotify_exit; 4053 4054 smb_rsp = (struct smb2_change_notify_rsp *)rsp_iov.iov_base; 4055 4056 rc = smb2_validate_iov(le16_to_cpu(smb_rsp->OutputBufferOffset), 4057 le32_to_cpu(smb_rsp->OutputBufferLength), 4058 &rsp_iov, 4059 sizeof(struct file_notify_information)); 4060 if (rc) 4061 goto cnotify_exit; 4062 4063 *out_data = kmemdup((char *)smb_rsp + le16_to_cpu(smb_rsp->OutputBufferOffset), 4064 le32_to_cpu(smb_rsp->OutputBufferLength), GFP_KERNEL); 4065 if (*out_data == NULL) { 4066 rc = -ENOMEM; 4067 goto cnotify_exit; 4068 } else if (plen) 4069 *plen = le32_to_cpu(smb_rsp->OutputBufferLength); 4070 } 4071 4072 cnotify_exit: 4073 if (rqst.rq_iov) 4074 cifs_small_buf_release(rqst.rq_iov[0].iov_base); /* request */ 4075 free_rsp_buf(resp_buftype, rsp_iov.iov_base); 4076 4077 if (is_replayable_error(rc) && 4078 smb2_should_replay(tcon, &retries, &cur_sleep)) 4079 goto replay_again; 4080 4081 return rc; 4082 } 4083 4084 4085 4086 /* 4087 * This is a no-op for now. We're not really interested in the reply, but 4088 * rather in the fact that the server sent one and that server->lstrp 4089 * gets updated. 4090 * 4091 * FIXME: maybe we should consider checking that the reply matches request? 4092 */ 4093 static void 4094 smb2_echo_callback(struct mid_q_entry *mid) 4095 { 4096 struct TCP_Server_Info *server = mid->callback_data; 4097 struct smb2_echo_rsp *rsp = (struct smb2_echo_rsp *)mid->resp_buf; 4098 struct cifs_credits credits = { .value = 0, .instance = 0 }; 4099 4100 if (mid->mid_state == MID_RESPONSE_RECEIVED 4101 || mid->mid_state == MID_RESPONSE_MALFORMED) { 4102 credits.value = le16_to_cpu(rsp->hdr.CreditRequest); 4103 credits.instance = server->reconnect_instance; 4104 } 4105 4106 release_mid(mid); 4107 add_credits(server, &credits, CIFS_ECHO_OP); 4108 } 4109 4110 static void cifs_renegotiate_iosize(struct TCP_Server_Info *server, 4111 struct cifs_tcon *tcon) 4112 { 4113 struct cifs_sb_info *cifs_sb; 4114 4115 if (server == NULL || tcon == NULL) 4116 return; 4117 4118 spin_lock(&tcon->sb_list_lock); 4119 list_for_each_entry(cifs_sb, &tcon->cifs_sb_list, tcon_sb_link) 4120 cifs_negotiate_iosize(server, cifs_sb->ctx, tcon); 4121 spin_unlock(&tcon->sb_list_lock); 4122 } 4123 4124 void smb2_reconnect_server(struct work_struct *work) 4125 { 4126 struct TCP_Server_Info *server = container_of(work, 4127 struct TCP_Server_Info, reconnect.work); 4128 struct TCP_Server_Info *pserver; 4129 struct cifs_ses *ses, *ses2; 4130 struct cifs_tcon *tcon, *tcon2; 4131 struct list_head tmp_list, tmp_ses_list; 4132 bool ses_exist = false; 4133 bool tcon_selected = false; 4134 int rc; 4135 bool resched = false; 4136 4137 /* first check if ref count has reached 0, if not inc ref count */ 4138 spin_lock(&cifs_tcp_ses_lock); 4139 if (!server->srv_count) { 4140 spin_unlock(&cifs_tcp_ses_lock); 4141 return; 4142 } 4143 server->srv_count++; 4144 spin_unlock(&cifs_tcp_ses_lock); 4145 4146 /* If server is a channel, select the primary channel */ 4147 pserver = SERVER_IS_CHAN(server) ? server->primary_server : server; 4148 4149 /* Prevent simultaneous reconnects that can corrupt tcon->rlist list */ 4150 mutex_lock(&pserver->reconnect_mutex); 4151 4152 /* if the server is marked for termination, drop the ref count here */ 4153 if (server->terminate) { 4154 cifs_put_tcp_session(server, true); 4155 mutex_unlock(&pserver->reconnect_mutex); 4156 return; 4157 } 4158 4159 INIT_LIST_HEAD(&tmp_list); 4160 INIT_LIST_HEAD(&tmp_ses_list); 4161 cifs_dbg(FYI, "Reconnecting tcons and channels\n"); 4162 4163 spin_lock(&cifs_tcp_ses_lock); 4164 list_for_each_entry(ses, &pserver->smb_ses_list, smb_ses_list) { 4165 spin_lock(&ses->ses_lock); 4166 if (ses->ses_status == SES_EXITING) { 4167 spin_unlock(&ses->ses_lock); 4168 continue; 4169 } 4170 spin_unlock(&ses->ses_lock); 4171 4172 tcon_selected = false; 4173 4174 list_for_each_entry(tcon, &ses->tcon_list, tcon_list) { 4175 if (tcon->need_reconnect || tcon->need_reopen_files) { 4176 tcon->tc_count++; 4177 trace_smb3_tcon_ref(tcon->debug_id, tcon->tc_count, 4178 netfs_trace_tcon_ref_get_reconnect_server); 4179 list_add_tail(&tcon->rlist, &tmp_list); 4180 tcon_selected = true; 4181 } 4182 } 4183 /* 4184 * IPC has the same lifetime as its session and uses its 4185 * refcount. 4186 */ 4187 if (ses->tcon_ipc && ses->tcon_ipc->need_reconnect) { 4188 list_add_tail(&ses->tcon_ipc->rlist, &tmp_list); 4189 tcon_selected = true; 4190 cifs_smb_ses_inc_refcount(ses); 4191 } 4192 /* 4193 * handle the case where channel needs to reconnect 4194 * binding session, but tcon is healthy (some other channel 4195 * is active) 4196 */ 4197 spin_lock(&ses->chan_lock); 4198 if (!tcon_selected && cifs_chan_needs_reconnect(ses, server)) { 4199 list_add_tail(&ses->rlist, &tmp_ses_list); 4200 ses_exist = true; 4201 cifs_smb_ses_inc_refcount(ses); 4202 } 4203 spin_unlock(&ses->chan_lock); 4204 } 4205 spin_unlock(&cifs_tcp_ses_lock); 4206 4207 list_for_each_entry_safe(tcon, tcon2, &tmp_list, rlist) { 4208 rc = smb2_reconnect(SMB2_INTERNAL_CMD, tcon, server, true); 4209 if (!rc) { 4210 cifs_renegotiate_iosize(server, tcon); 4211 cifs_reopen_persistent_handles(tcon); 4212 } else 4213 resched = true; 4214 list_del_init(&tcon->rlist); 4215 if (tcon->ipc) 4216 cifs_put_smb_ses(tcon->ses); 4217 else 4218 cifs_put_tcon(tcon, netfs_trace_tcon_ref_put_reconnect_server); 4219 } 4220 4221 if (!ses_exist) 4222 goto done; 4223 4224 /* allocate a dummy tcon struct used for reconnect */ 4225 tcon = tcon_info_alloc(false, netfs_trace_tcon_ref_new_reconnect_server); 4226 if (!tcon) { 4227 resched = true; 4228 list_for_each_entry_safe(ses, ses2, &tmp_ses_list, rlist) { 4229 list_del_init(&ses->rlist); 4230 cifs_put_smb_ses(ses); 4231 } 4232 goto done; 4233 } 4234 tcon->status = TID_GOOD; 4235 tcon->dummy = true; 4236 4237 /* now reconnect sessions for necessary channels */ 4238 list_for_each_entry_safe(ses, ses2, &tmp_ses_list, rlist) { 4239 tcon->ses = ses; 4240 rc = smb2_reconnect(SMB2_INTERNAL_CMD, tcon, server, true); 4241 if (rc) 4242 resched = true; 4243 list_del_init(&ses->rlist); 4244 cifs_put_smb_ses(ses); 4245 } 4246 tconInfoFree(tcon, netfs_trace_tcon_ref_free_reconnect_server); 4247 4248 done: 4249 cifs_dbg(FYI, "Reconnecting tcons and channels finished\n"); 4250 if (resched) 4251 queue_delayed_work(cifsiod_wq, &server->reconnect, 2 * HZ); 4252 mutex_unlock(&pserver->reconnect_mutex); 4253 4254 /* now we can safely release srv struct */ 4255 cifs_put_tcp_session(server, true); 4256 } 4257 4258 int 4259 SMB2_echo(struct TCP_Server_Info *server) 4260 { 4261 struct smb2_echo_req *req; 4262 int rc = 0; 4263 struct kvec iov[1]; 4264 struct smb_rqst rqst = { .rq_iov = iov, 4265 .rq_nvec = 1 }; 4266 unsigned int total_len; 4267 4268 cifs_dbg(FYI, "In echo request for conn_id %lld\n", server->conn_id); 4269 4270 spin_lock(&server->srv_lock); 4271 if (server->ops->need_neg && 4272 server->ops->need_neg(server)) { 4273 spin_unlock(&server->srv_lock); 4274 /* No need to send echo on newly established connections */ 4275 mod_delayed_work(cifsiod_wq, &server->reconnect, 0); 4276 return rc; 4277 } 4278 spin_unlock(&server->srv_lock); 4279 4280 rc = smb2_plain_req_init(SMB2_ECHO, NULL, server, 4281 (void **)&req, &total_len); 4282 if (rc) 4283 return rc; 4284 4285 req->hdr.CreditRequest = cpu_to_le16(1); 4286 4287 iov[0].iov_len = total_len; 4288 iov[0].iov_base = (char *)req; 4289 4290 rc = cifs_call_async(server, &rqst, NULL, smb2_echo_callback, NULL, 4291 server, CIFS_ECHO_OP, NULL); 4292 if (rc) 4293 cifs_dbg(FYI, "Echo request failed: %d\n", rc); 4294 4295 cifs_small_buf_release(req); 4296 return rc; 4297 } 4298 4299 void 4300 SMB2_flush_free(struct smb_rqst *rqst) 4301 { 4302 if (rqst && rqst->rq_iov) 4303 cifs_small_buf_release(rqst->rq_iov[0].iov_base); /* request */ 4304 } 4305 4306 int 4307 SMB2_flush_init(const unsigned int xid, struct smb_rqst *rqst, 4308 struct cifs_tcon *tcon, struct TCP_Server_Info *server, 4309 u64 persistent_fid, u64 volatile_fid) 4310 { 4311 struct smb2_flush_req *req; 4312 struct kvec *iov = rqst->rq_iov; 4313 unsigned int total_len; 4314 int rc; 4315 4316 rc = smb2_plain_req_init(SMB2_FLUSH, tcon, server, 4317 (void **) &req, &total_len); 4318 if (rc) 4319 return rc; 4320 4321 req->PersistentFileId = persistent_fid; 4322 req->VolatileFileId = volatile_fid; 4323 4324 iov[0].iov_base = (char *)req; 4325 iov[0].iov_len = total_len; 4326 4327 return 0; 4328 } 4329 4330 int 4331 SMB2_flush(const unsigned int xid, struct cifs_tcon *tcon, u64 persistent_fid, 4332 u64 volatile_fid) 4333 { 4334 struct cifs_ses *ses = tcon->ses; 4335 struct smb_rqst rqst; 4336 struct kvec iov[1]; 4337 struct kvec rsp_iov = {NULL, 0}; 4338 struct TCP_Server_Info *server; 4339 int resp_buftype = CIFS_NO_BUFFER; 4340 int flags = 0; 4341 int rc = 0; 4342 int retries = 0, cur_sleep = 1; 4343 4344 replay_again: 4345 /* reinitialize for possible replay */ 4346 flags = 0; 4347 server = cifs_pick_channel(ses); 4348 4349 cifs_dbg(FYI, "flush\n"); 4350 if (!ses || !(ses->server)) 4351 return -EIO; 4352 4353 if (smb3_encryption_required(tcon)) 4354 flags |= CIFS_TRANSFORM_REQ; 4355 4356 memset(&rqst, 0, sizeof(struct smb_rqst)); 4357 memset(&iov, 0, sizeof(iov)); 4358 rqst.rq_iov = iov; 4359 rqst.rq_nvec = 1; 4360 4361 rc = SMB2_flush_init(xid, &rqst, tcon, server, 4362 persistent_fid, volatile_fid); 4363 if (rc) 4364 goto flush_exit; 4365 4366 trace_smb3_flush_enter(xid, persistent_fid, tcon->tid, ses->Suid); 4367 4368 if (retries) 4369 smb2_set_replay(server, &rqst); 4370 4371 rc = cifs_send_recv(xid, ses, server, 4372 &rqst, &resp_buftype, flags, &rsp_iov); 4373 4374 if (rc != 0) { 4375 cifs_stats_fail_inc(tcon, SMB2_FLUSH_HE); 4376 trace_smb3_flush_err(xid, persistent_fid, tcon->tid, ses->Suid, 4377 rc); 4378 } else 4379 trace_smb3_flush_done(xid, persistent_fid, tcon->tid, 4380 ses->Suid); 4381 4382 flush_exit: 4383 SMB2_flush_free(&rqst); 4384 free_rsp_buf(resp_buftype, rsp_iov.iov_base); 4385 4386 if (is_replayable_error(rc) && 4387 smb2_should_replay(tcon, &retries, &cur_sleep)) 4388 goto replay_again; 4389 4390 return rc; 4391 } 4392 4393 #ifdef CONFIG_CIFS_SMB_DIRECT 4394 static inline bool smb3_use_rdma_offload(struct cifs_io_parms *io_parms) 4395 { 4396 struct TCP_Server_Info *server = io_parms->server; 4397 struct cifs_tcon *tcon = io_parms->tcon; 4398 4399 /* we can only offload if we're connected */ 4400 if (!server || !tcon) 4401 return false; 4402 4403 /* we can only offload on an rdma connection */ 4404 if (!server->rdma || !server->smbd_conn) 4405 return false; 4406 4407 /* we don't support signed offload yet */ 4408 if (server->sign) 4409 return false; 4410 4411 /* we don't support encrypted offload yet */ 4412 if (smb3_encryption_required(tcon)) 4413 return false; 4414 4415 /* offload also has its overhead, so only do it if desired */ 4416 if (io_parms->length < server->rdma_readwrite_threshold) 4417 return false; 4418 4419 return true; 4420 } 4421 #endif /* CONFIG_CIFS_SMB_DIRECT */ 4422 4423 /* 4424 * To form a chain of read requests, any read requests after the first should 4425 * have the end_of_chain boolean set to true. 4426 */ 4427 static int 4428 smb2_new_read_req(void **buf, unsigned int *total_len, 4429 struct cifs_io_parms *io_parms, struct cifs_io_subrequest *rdata, 4430 unsigned int remaining_bytes, int request_type) 4431 { 4432 int rc = -EACCES; 4433 struct smb2_read_req *req = NULL; 4434 struct smb2_hdr *shdr; 4435 struct TCP_Server_Info *server = io_parms->server; 4436 4437 rc = smb2_plain_req_init(SMB2_READ, io_parms->tcon, server, 4438 (void **) &req, total_len); 4439 if (rc) 4440 return rc; 4441 4442 if (server == NULL) 4443 return -ECONNABORTED; 4444 4445 shdr = &req->hdr; 4446 shdr->Id.SyncId.ProcessId = cpu_to_le32(io_parms->pid); 4447 4448 req->PersistentFileId = io_parms->persistent_fid; 4449 req->VolatileFileId = io_parms->volatile_fid; 4450 req->ReadChannelInfoOffset = 0; /* reserved */ 4451 req->ReadChannelInfoLength = 0; /* reserved */ 4452 req->Channel = 0; /* reserved */ 4453 req->MinimumCount = 0; 4454 req->Length = cpu_to_le32(io_parms->length); 4455 req->Offset = cpu_to_le64(io_parms->offset); 4456 4457 trace_smb3_read_enter(rdata ? rdata->rreq->debug_id : 0, 4458 rdata ? rdata->subreq.debug_index : 0, 4459 rdata ? rdata->xid : 0, 4460 io_parms->persistent_fid, 4461 io_parms->tcon->tid, io_parms->tcon->ses->Suid, 4462 io_parms->offset, io_parms->length); 4463 #ifdef CONFIG_CIFS_SMB_DIRECT 4464 /* 4465 * If we want to do a RDMA write, fill in and append 4466 * smbdirect_buffer_descriptor_v1 to the end of read request 4467 */ 4468 if (rdata && smb3_use_rdma_offload(io_parms)) { 4469 struct smbdirect_buffer_descriptor_v1 *v1; 4470 bool need_invalidate = server->dialect == SMB30_PROT_ID; 4471 4472 rdata->mr = smbd_register_mr(server->smbd_conn, &rdata->subreq.io_iter, 4473 true, need_invalidate); 4474 if (!rdata->mr) 4475 return -EAGAIN; 4476 4477 req->Channel = SMB2_CHANNEL_RDMA_V1_INVALIDATE; 4478 if (need_invalidate) 4479 req->Channel = SMB2_CHANNEL_RDMA_V1; 4480 req->ReadChannelInfoOffset = 4481 cpu_to_le16(offsetof(struct smb2_read_req, Buffer)); 4482 req->ReadChannelInfoLength = 4483 cpu_to_le16(sizeof(struct smbdirect_buffer_descriptor_v1)); 4484 v1 = (struct smbdirect_buffer_descriptor_v1 *) &req->Buffer[0]; 4485 v1->offset = cpu_to_le64(rdata->mr->mr->iova); 4486 v1->token = cpu_to_le32(rdata->mr->mr->rkey); 4487 v1->length = cpu_to_le32(rdata->mr->mr->length); 4488 4489 *total_len += sizeof(*v1) - 1; 4490 } 4491 #endif 4492 if (request_type & CHAINED_REQUEST) { 4493 if (!(request_type & END_OF_CHAIN)) { 4494 /* next 8-byte aligned request */ 4495 *total_len = ALIGN(*total_len, 8); 4496 shdr->NextCommand = cpu_to_le32(*total_len); 4497 } else /* END_OF_CHAIN */ 4498 shdr->NextCommand = 0; 4499 if (request_type & RELATED_REQUEST) { 4500 shdr->Flags |= SMB2_FLAGS_RELATED_OPERATIONS; 4501 /* 4502 * Related requests use info from previous read request 4503 * in chain. 4504 */ 4505 shdr->SessionId = cpu_to_le64(0xFFFFFFFFFFFFFFFF); 4506 shdr->Id.SyncId.TreeId = cpu_to_le32(0xFFFFFFFF); 4507 req->PersistentFileId = (u64)-1; 4508 req->VolatileFileId = (u64)-1; 4509 } 4510 } 4511 if (remaining_bytes > io_parms->length) 4512 req->RemainingBytes = cpu_to_le32(remaining_bytes); 4513 else 4514 req->RemainingBytes = 0; 4515 4516 *buf = req; 4517 return rc; 4518 } 4519 4520 static void 4521 smb2_readv_callback(struct mid_q_entry *mid) 4522 { 4523 struct cifs_io_subrequest *rdata = mid->callback_data; 4524 struct netfs_inode *ictx = netfs_inode(rdata->rreq->inode); 4525 struct cifs_tcon *tcon = tlink_tcon(rdata->req->cfile->tlink); 4526 struct TCP_Server_Info *server = rdata->server; 4527 struct smb2_hdr *shdr = 4528 (struct smb2_hdr *)rdata->iov[0].iov_base; 4529 struct cifs_credits credits = { 4530 .value = 0, 4531 .instance = 0, 4532 .rreq_debug_id = rdata->rreq->debug_id, 4533 .rreq_debug_index = rdata->subreq.debug_index, 4534 }; 4535 struct smb_rqst rqst = { .rq_iov = &rdata->iov[1], .rq_nvec = 1 }; 4536 unsigned int rreq_debug_id = rdata->rreq->debug_id; 4537 unsigned int subreq_debug_index = rdata->subreq.debug_index; 4538 4539 if (rdata->got_bytes) { 4540 rqst.rq_iter = rdata->subreq.io_iter; 4541 } 4542 4543 WARN_ONCE(rdata->server != mid->server, 4544 "rdata server %p != mid server %p", 4545 rdata->server, mid->server); 4546 4547 cifs_dbg(FYI, "%s: mid=%llu state=%d result=%d bytes=%zu/%zu\n", 4548 __func__, mid->mid, mid->mid_state, rdata->result, 4549 rdata->got_bytes, rdata->subreq.len - rdata->subreq.transferred); 4550 4551 switch (mid->mid_state) { 4552 case MID_RESPONSE_RECEIVED: 4553 credits.value = le16_to_cpu(shdr->CreditRequest); 4554 credits.instance = server->reconnect_instance; 4555 /* result already set, check signature */ 4556 if (server->sign && !mid->decrypted) { 4557 int rc; 4558 4559 iov_iter_truncate(&rqst.rq_iter, rdata->got_bytes); 4560 rc = smb2_verify_signature(&rqst, server); 4561 if (rc) 4562 cifs_tcon_dbg(VFS, "SMB signature verification returned error = %d\n", 4563 rc); 4564 } 4565 /* FIXME: should this be counted toward the initiating task? */ 4566 task_io_account_read(rdata->got_bytes); 4567 cifs_stats_bytes_read(tcon, rdata->got_bytes); 4568 break; 4569 case MID_REQUEST_SUBMITTED: 4570 trace_netfs_sreq(&rdata->subreq, netfs_sreq_trace_io_req_submitted); 4571 goto do_retry; 4572 case MID_RETRY_NEEDED: 4573 trace_netfs_sreq(&rdata->subreq, netfs_sreq_trace_io_retry_needed); 4574 do_retry: 4575 __set_bit(NETFS_SREQ_NEED_RETRY, &rdata->subreq.flags); 4576 rdata->result = -EAGAIN; 4577 if (server->sign && rdata->got_bytes) 4578 /* reset bytes number since we can not check a sign */ 4579 rdata->got_bytes = 0; 4580 /* FIXME: should this be counted toward the initiating task? */ 4581 task_io_account_read(rdata->got_bytes); 4582 cifs_stats_bytes_read(tcon, rdata->got_bytes); 4583 break; 4584 case MID_RESPONSE_MALFORMED: 4585 trace_netfs_sreq(&rdata->subreq, netfs_sreq_trace_io_malformed); 4586 credits.value = le16_to_cpu(shdr->CreditRequest); 4587 credits.instance = server->reconnect_instance; 4588 rdata->result = -EIO; 4589 break; 4590 default: 4591 trace_netfs_sreq(&rdata->subreq, netfs_sreq_trace_io_unknown); 4592 rdata->result = -EIO; 4593 break; 4594 } 4595 #ifdef CONFIG_CIFS_SMB_DIRECT 4596 /* 4597 * If this rdata has a memory registered, the MR can be freed 4598 * MR needs to be freed as soon as I/O finishes to prevent deadlock 4599 * because they have limited number and are used for future I/Os 4600 */ 4601 if (rdata->mr) { 4602 smbd_deregister_mr(rdata->mr); 4603 rdata->mr = NULL; 4604 } 4605 #endif 4606 if (rdata->result && rdata->result != -ENODATA) { 4607 cifs_stats_fail_inc(tcon, SMB2_READ_HE); 4608 trace_smb3_read_err(rdata->rreq->debug_id, 4609 rdata->subreq.debug_index, 4610 rdata->xid, 4611 rdata->req->cfile->fid.persistent_fid, 4612 tcon->tid, tcon->ses->Suid, 4613 rdata->subreq.start + rdata->subreq.transferred, 4614 rdata->subreq.len - rdata->subreq.transferred, 4615 rdata->result); 4616 } else 4617 trace_smb3_read_done(rdata->rreq->debug_id, 4618 rdata->subreq.debug_index, 4619 rdata->xid, 4620 rdata->req->cfile->fid.persistent_fid, 4621 tcon->tid, tcon->ses->Suid, 4622 rdata->subreq.start + rdata->subreq.transferred, 4623 rdata->got_bytes); 4624 4625 if (rdata->result == -ENODATA) { 4626 __set_bit(NETFS_SREQ_HIT_EOF, &rdata->subreq.flags); 4627 rdata->result = 0; 4628 } else { 4629 size_t trans = rdata->subreq.transferred + rdata->got_bytes; 4630 if (trans < rdata->subreq.len && 4631 rdata->subreq.start + trans == ictx->remote_i_size) { 4632 __set_bit(NETFS_SREQ_HIT_EOF, &rdata->subreq.flags); 4633 rdata->result = 0; 4634 } 4635 if (rdata->got_bytes) 4636 __set_bit(NETFS_SREQ_MADE_PROGRESS, &rdata->subreq.flags); 4637 } 4638 trace_smb3_rw_credits(rreq_debug_id, subreq_debug_index, rdata->credits.value, 4639 server->credits, server->in_flight, 4640 0, cifs_trace_rw_credits_read_response_clear); 4641 rdata->credits.value = 0; 4642 rdata->subreq.error = rdata->result; 4643 rdata->subreq.transferred += rdata->got_bytes; 4644 trace_netfs_sreq(&rdata->subreq, netfs_sreq_trace_io_progress); 4645 netfs_read_subreq_terminated(&rdata->subreq); 4646 release_mid(mid); 4647 trace_smb3_rw_credits(rreq_debug_id, subreq_debug_index, 0, 4648 server->credits, server->in_flight, 4649 credits.value, cifs_trace_rw_credits_read_response_add); 4650 add_credits(server, &credits, 0); 4651 } 4652 4653 /* smb2_async_readv - send an async read, and set up mid to handle result */ 4654 int 4655 smb2_async_readv(struct cifs_io_subrequest *rdata) 4656 { 4657 int rc, flags = 0; 4658 char *buf; 4659 struct netfs_io_subrequest *subreq = &rdata->subreq; 4660 struct smb2_hdr *shdr; 4661 struct cifs_io_parms io_parms; 4662 struct smb_rqst rqst = { .rq_iov = rdata->iov, 4663 .rq_nvec = 1 }; 4664 struct TCP_Server_Info *server; 4665 struct cifs_tcon *tcon = tlink_tcon(rdata->req->cfile->tlink); 4666 unsigned int total_len; 4667 int credit_request; 4668 4669 cifs_dbg(FYI, "%s: offset=%llu bytes=%zu\n", 4670 __func__, subreq->start, subreq->len); 4671 4672 if (!rdata->server) 4673 rdata->server = cifs_pick_channel(tcon->ses); 4674 4675 io_parms.tcon = tlink_tcon(rdata->req->cfile->tlink); 4676 io_parms.server = server = rdata->server; 4677 io_parms.offset = subreq->start + subreq->transferred; 4678 io_parms.length = subreq->len - subreq->transferred; 4679 io_parms.persistent_fid = rdata->req->cfile->fid.persistent_fid; 4680 io_parms.volatile_fid = rdata->req->cfile->fid.volatile_fid; 4681 io_parms.pid = rdata->req->pid; 4682 4683 rc = smb2_new_read_req( 4684 (void **) &buf, &total_len, &io_parms, rdata, 0, 0); 4685 if (rc) 4686 return rc; 4687 4688 if (smb3_encryption_required(io_parms.tcon)) 4689 flags |= CIFS_TRANSFORM_REQ; 4690 4691 rdata->iov[0].iov_base = buf; 4692 rdata->iov[0].iov_len = total_len; 4693 rdata->got_bytes = 0; 4694 rdata->result = 0; 4695 4696 shdr = (struct smb2_hdr *)buf; 4697 4698 if (rdata->credits.value > 0) { 4699 shdr->CreditCharge = cpu_to_le16(DIV_ROUND_UP(io_parms.length, 4700 SMB2_MAX_BUFFER_SIZE)); 4701 credit_request = le16_to_cpu(shdr->CreditCharge) + 8; 4702 if (server->credits >= server->max_credits) 4703 shdr->CreditRequest = cpu_to_le16(0); 4704 else 4705 shdr->CreditRequest = cpu_to_le16( 4706 min_t(int, server->max_credits - 4707 server->credits, credit_request)); 4708 4709 rc = adjust_credits(server, rdata, cifs_trace_rw_credits_call_readv_adjust); 4710 if (rc) 4711 goto async_readv_out; 4712 4713 flags |= CIFS_HAS_CREDITS; 4714 } 4715 4716 rc = cifs_call_async(server, &rqst, 4717 cifs_readv_receive, smb2_readv_callback, 4718 smb3_handle_read_data, rdata, flags, 4719 &rdata->credits); 4720 if (rc) { 4721 cifs_stats_fail_inc(io_parms.tcon, SMB2_READ_HE); 4722 trace_smb3_read_err(rdata->rreq->debug_id, 4723 subreq->debug_index, 4724 rdata->xid, io_parms.persistent_fid, 4725 io_parms.tcon->tid, 4726 io_parms.tcon->ses->Suid, 4727 io_parms.offset, 4728 subreq->len - subreq->transferred, rc); 4729 } 4730 4731 async_readv_out: 4732 cifs_small_buf_release(buf); 4733 return rc; 4734 } 4735 4736 int 4737 SMB2_read(const unsigned int xid, struct cifs_io_parms *io_parms, 4738 unsigned int *nbytes, char **buf, int *buf_type) 4739 { 4740 struct smb_rqst rqst; 4741 int resp_buftype, rc; 4742 struct smb2_read_req *req = NULL; 4743 struct smb2_read_rsp *rsp = NULL; 4744 struct kvec iov[1]; 4745 struct kvec rsp_iov; 4746 unsigned int total_len; 4747 int flags = CIFS_LOG_ERROR; 4748 struct cifs_ses *ses = io_parms->tcon->ses; 4749 4750 if (!io_parms->server) 4751 io_parms->server = cifs_pick_channel(io_parms->tcon->ses); 4752 4753 *nbytes = 0; 4754 rc = smb2_new_read_req((void **)&req, &total_len, io_parms, NULL, 0, 0); 4755 if (rc) 4756 return rc; 4757 4758 if (smb3_encryption_required(io_parms->tcon)) 4759 flags |= CIFS_TRANSFORM_REQ; 4760 4761 iov[0].iov_base = (char *)req; 4762 iov[0].iov_len = total_len; 4763 4764 memset(&rqst, 0, sizeof(struct smb_rqst)); 4765 rqst.rq_iov = iov; 4766 rqst.rq_nvec = 1; 4767 4768 rc = cifs_send_recv(xid, ses, io_parms->server, 4769 &rqst, &resp_buftype, flags, &rsp_iov); 4770 rsp = (struct smb2_read_rsp *)rsp_iov.iov_base; 4771 4772 if (rc) { 4773 if (rc != -ENODATA) { 4774 cifs_stats_fail_inc(io_parms->tcon, SMB2_READ_HE); 4775 cifs_dbg(VFS, "Send error in read = %d\n", rc); 4776 trace_smb3_read_err(0, 0, xid, 4777 req->PersistentFileId, 4778 io_parms->tcon->tid, ses->Suid, 4779 io_parms->offset, io_parms->length, 4780 rc); 4781 } else 4782 trace_smb3_read_done(0, 0, xid, 4783 req->PersistentFileId, io_parms->tcon->tid, 4784 ses->Suid, io_parms->offset, 0); 4785 free_rsp_buf(resp_buftype, rsp_iov.iov_base); 4786 cifs_small_buf_release(req); 4787 return rc == -ENODATA ? 0 : rc; 4788 } else 4789 trace_smb3_read_done(0, 0, xid, 4790 req->PersistentFileId, 4791 io_parms->tcon->tid, ses->Suid, 4792 io_parms->offset, io_parms->length); 4793 4794 cifs_small_buf_release(req); 4795 4796 *nbytes = le32_to_cpu(rsp->DataLength); 4797 if ((*nbytes > CIFS_MAX_MSGSIZE) || 4798 (*nbytes > io_parms->length)) { 4799 cifs_dbg(FYI, "bad length %d for count %d\n", 4800 *nbytes, io_parms->length); 4801 rc = -EIO; 4802 *nbytes = 0; 4803 } 4804 4805 if (*buf) { 4806 memcpy(*buf, (char *)rsp + rsp->DataOffset, *nbytes); 4807 free_rsp_buf(resp_buftype, rsp_iov.iov_base); 4808 } else if (resp_buftype != CIFS_NO_BUFFER) { 4809 *buf = rsp_iov.iov_base; 4810 if (resp_buftype == CIFS_SMALL_BUFFER) 4811 *buf_type = CIFS_SMALL_BUFFER; 4812 else if (resp_buftype == CIFS_LARGE_BUFFER) 4813 *buf_type = CIFS_LARGE_BUFFER; 4814 } 4815 return rc; 4816 } 4817 4818 /* 4819 * Check the mid_state and signature on received buffer (if any), and queue the 4820 * workqueue completion task. 4821 */ 4822 static void 4823 smb2_writev_callback(struct mid_q_entry *mid) 4824 { 4825 struct cifs_io_subrequest *wdata = mid->callback_data; 4826 struct cifs_tcon *tcon = tlink_tcon(wdata->req->cfile->tlink); 4827 struct TCP_Server_Info *server = wdata->server; 4828 struct smb2_write_rsp *rsp = (struct smb2_write_rsp *)mid->resp_buf; 4829 struct cifs_credits credits = { 4830 .value = 0, 4831 .instance = 0, 4832 .rreq_debug_id = wdata->rreq->debug_id, 4833 .rreq_debug_index = wdata->subreq.debug_index, 4834 }; 4835 unsigned int rreq_debug_id = wdata->rreq->debug_id; 4836 unsigned int subreq_debug_index = wdata->subreq.debug_index; 4837 ssize_t result = 0; 4838 size_t written; 4839 4840 WARN_ONCE(wdata->server != mid->server, 4841 "wdata server %p != mid server %p", 4842 wdata->server, mid->server); 4843 4844 switch (mid->mid_state) { 4845 case MID_RESPONSE_RECEIVED: 4846 trace_netfs_sreq(&wdata->subreq, netfs_sreq_trace_io_progress); 4847 credits.value = le16_to_cpu(rsp->hdr.CreditRequest); 4848 credits.instance = server->reconnect_instance; 4849 result = smb2_check_receive(mid, server, 0); 4850 if (result != 0) { 4851 trace_netfs_sreq(&wdata->subreq, netfs_sreq_trace_io_bad); 4852 break; 4853 } 4854 4855 written = le32_to_cpu(rsp->DataLength); 4856 /* 4857 * Mask off high 16 bits when bytes written as returned 4858 * by the server is greater than bytes requested by the 4859 * client. OS/2 servers are known to set incorrect 4860 * CountHigh values. 4861 */ 4862 if (written > wdata->subreq.len) 4863 written &= 0xFFFF; 4864 4865 cifs_stats_bytes_written(tcon, written); 4866 4867 if (written < wdata->subreq.len) { 4868 wdata->result = -ENOSPC; 4869 } else if (written > 0) { 4870 wdata->subreq.len = written; 4871 __set_bit(NETFS_SREQ_MADE_PROGRESS, &wdata->subreq.flags); 4872 } 4873 break; 4874 case MID_REQUEST_SUBMITTED: 4875 trace_netfs_sreq(&wdata->subreq, netfs_sreq_trace_io_req_submitted); 4876 __set_bit(NETFS_SREQ_NEED_RETRY, &wdata->subreq.flags); 4877 result = -EAGAIN; 4878 break; 4879 case MID_RETRY_NEEDED: 4880 trace_netfs_sreq(&wdata->subreq, netfs_sreq_trace_io_retry_needed); 4881 __set_bit(NETFS_SREQ_NEED_RETRY, &wdata->subreq.flags); 4882 result = -EAGAIN; 4883 break; 4884 case MID_RESPONSE_MALFORMED: 4885 trace_netfs_sreq(&wdata->subreq, netfs_sreq_trace_io_malformed); 4886 credits.value = le16_to_cpu(rsp->hdr.CreditRequest); 4887 credits.instance = server->reconnect_instance; 4888 result = -EIO; 4889 break; 4890 default: 4891 trace_netfs_sreq(&wdata->subreq, netfs_sreq_trace_io_unknown); 4892 result = -EIO; 4893 break; 4894 } 4895 #ifdef CONFIG_CIFS_SMB_DIRECT 4896 /* 4897 * If this wdata has a memory registered, the MR can be freed 4898 * The number of MRs available is limited, it's important to recover 4899 * used MR as soon as I/O is finished. Hold MR longer in the later 4900 * I/O process can possibly result in I/O deadlock due to lack of MR 4901 * to send request on I/O retry 4902 */ 4903 if (wdata->mr) { 4904 smbd_deregister_mr(wdata->mr); 4905 wdata->mr = NULL; 4906 } 4907 #endif 4908 if (result) { 4909 cifs_stats_fail_inc(tcon, SMB2_WRITE_HE); 4910 trace_smb3_write_err(wdata->rreq->debug_id, 4911 wdata->subreq.debug_index, 4912 wdata->xid, 4913 wdata->req->cfile->fid.persistent_fid, 4914 tcon->tid, tcon->ses->Suid, wdata->subreq.start, 4915 wdata->subreq.len, wdata->result); 4916 if (wdata->result == -ENOSPC) 4917 pr_warn_once("Out of space writing to %s\n", 4918 tcon->tree_name); 4919 } else 4920 trace_smb3_write_done(wdata->rreq->debug_id, 4921 wdata->subreq.debug_index, 4922 wdata->xid, 4923 wdata->req->cfile->fid.persistent_fid, 4924 tcon->tid, tcon->ses->Suid, 4925 wdata->subreq.start, wdata->subreq.len); 4926 4927 trace_smb3_rw_credits(rreq_debug_id, subreq_debug_index, wdata->credits.value, 4928 server->credits, server->in_flight, 4929 0, cifs_trace_rw_credits_write_response_clear); 4930 wdata->credits.value = 0; 4931 cifs_write_subrequest_terminated(wdata, result ?: written); 4932 release_mid(mid); 4933 trace_smb3_rw_credits(rreq_debug_id, subreq_debug_index, 0, 4934 server->credits, server->in_flight, 4935 credits.value, cifs_trace_rw_credits_write_response_add); 4936 add_credits(server, &credits, 0); 4937 } 4938 4939 /* smb2_async_writev - send an async write, and set up mid to handle result */ 4940 void 4941 smb2_async_writev(struct cifs_io_subrequest *wdata) 4942 { 4943 int rc = -EACCES, flags = 0; 4944 struct smb2_write_req *req = NULL; 4945 struct smb2_hdr *shdr; 4946 struct cifs_tcon *tcon = tlink_tcon(wdata->req->cfile->tlink); 4947 struct TCP_Server_Info *server = wdata->server; 4948 struct kvec iov[1]; 4949 struct smb_rqst rqst = { }; 4950 unsigned int total_len, xid = wdata->xid; 4951 struct cifs_io_parms _io_parms; 4952 struct cifs_io_parms *io_parms = NULL; 4953 int credit_request; 4954 4955 /* 4956 * in future we may get cifs_io_parms passed in from the caller, 4957 * but for now we construct it here... 4958 */ 4959 _io_parms = (struct cifs_io_parms) { 4960 .tcon = tcon, 4961 .server = server, 4962 .offset = wdata->subreq.start, 4963 .length = wdata->subreq.len, 4964 .persistent_fid = wdata->req->cfile->fid.persistent_fid, 4965 .volatile_fid = wdata->req->cfile->fid.volatile_fid, 4966 .pid = wdata->req->pid, 4967 }; 4968 io_parms = &_io_parms; 4969 4970 rc = smb2_plain_req_init(SMB2_WRITE, tcon, server, 4971 (void **) &req, &total_len); 4972 if (rc) 4973 goto out; 4974 4975 rqst.rq_iov = iov; 4976 rqst.rq_iter = wdata->subreq.io_iter; 4977 4978 rqst.rq_iov[0].iov_len = total_len - 1; 4979 rqst.rq_iov[0].iov_base = (char *)req; 4980 rqst.rq_nvec += 1; 4981 4982 if (smb3_encryption_required(tcon)) 4983 flags |= CIFS_TRANSFORM_REQ; 4984 4985 shdr = (struct smb2_hdr *)req; 4986 shdr->Id.SyncId.ProcessId = cpu_to_le32(io_parms->pid); 4987 4988 req->PersistentFileId = io_parms->persistent_fid; 4989 req->VolatileFileId = io_parms->volatile_fid; 4990 req->WriteChannelInfoOffset = 0; 4991 req->WriteChannelInfoLength = 0; 4992 req->Channel = SMB2_CHANNEL_NONE; 4993 req->Length = cpu_to_le32(io_parms->length); 4994 req->Offset = cpu_to_le64(io_parms->offset); 4995 req->DataOffset = cpu_to_le16( 4996 offsetof(struct smb2_write_req, Buffer)); 4997 req->RemainingBytes = 0; 4998 4999 trace_smb3_write_enter(wdata->rreq->debug_id, 5000 wdata->subreq.debug_index, 5001 wdata->xid, 5002 io_parms->persistent_fid, 5003 io_parms->tcon->tid, 5004 io_parms->tcon->ses->Suid, 5005 io_parms->offset, 5006 io_parms->length); 5007 5008 #ifdef CONFIG_CIFS_SMB_DIRECT 5009 /* 5010 * If we want to do a server RDMA read, fill in and append 5011 * smbdirect_buffer_descriptor_v1 to the end of write request 5012 */ 5013 if (smb3_use_rdma_offload(io_parms)) { 5014 struct smbdirect_buffer_descriptor_v1 *v1; 5015 bool need_invalidate = server->dialect == SMB30_PROT_ID; 5016 5017 wdata->mr = smbd_register_mr(server->smbd_conn, &wdata->subreq.io_iter, 5018 false, need_invalidate); 5019 if (!wdata->mr) { 5020 rc = -EAGAIN; 5021 goto async_writev_out; 5022 } 5023 /* For RDMA read, I/O size is in RemainingBytes not in Length */ 5024 req->RemainingBytes = req->Length; 5025 req->Length = 0; 5026 req->DataOffset = 0; 5027 req->Channel = SMB2_CHANNEL_RDMA_V1_INVALIDATE; 5028 if (need_invalidate) 5029 req->Channel = SMB2_CHANNEL_RDMA_V1; 5030 req->WriteChannelInfoOffset = 5031 cpu_to_le16(offsetof(struct smb2_write_req, Buffer)); 5032 req->WriteChannelInfoLength = 5033 cpu_to_le16(sizeof(struct smbdirect_buffer_descriptor_v1)); 5034 v1 = (struct smbdirect_buffer_descriptor_v1 *) &req->Buffer[0]; 5035 v1->offset = cpu_to_le64(wdata->mr->mr->iova); 5036 v1->token = cpu_to_le32(wdata->mr->mr->rkey); 5037 v1->length = cpu_to_le32(wdata->mr->mr->length); 5038 5039 rqst.rq_iov[0].iov_len += sizeof(*v1); 5040 5041 /* 5042 * We keep wdata->subreq.io_iter, 5043 * but we have to truncate rqst.rq_iter 5044 */ 5045 iov_iter_truncate(&rqst.rq_iter, 0); 5046 } 5047 #endif 5048 5049 if (wdata->subreq.retry_count > 0) 5050 smb2_set_replay(server, &rqst); 5051 5052 cifs_dbg(FYI, "async write at %llu %u bytes iter=%zx\n", 5053 io_parms->offset, io_parms->length, iov_iter_count(&wdata->subreq.io_iter)); 5054 5055 if (wdata->credits.value > 0) { 5056 shdr->CreditCharge = cpu_to_le16(DIV_ROUND_UP(wdata->subreq.len, 5057 SMB2_MAX_BUFFER_SIZE)); 5058 credit_request = le16_to_cpu(shdr->CreditCharge) + 8; 5059 if (server->credits >= server->max_credits) 5060 shdr->CreditRequest = cpu_to_le16(0); 5061 else 5062 shdr->CreditRequest = cpu_to_le16( 5063 min_t(int, server->max_credits - 5064 server->credits, credit_request)); 5065 5066 rc = adjust_credits(server, wdata, cifs_trace_rw_credits_call_writev_adjust); 5067 if (rc) 5068 goto async_writev_out; 5069 5070 flags |= CIFS_HAS_CREDITS; 5071 } 5072 5073 /* XXX: compression + encryption is unsupported for now */ 5074 if (((flags & CIFS_TRANSFORM_REQ) != CIFS_TRANSFORM_REQ) && should_compress(tcon, &rqst)) 5075 flags |= CIFS_COMPRESS_REQ; 5076 5077 rc = cifs_call_async(server, &rqst, NULL, smb2_writev_callback, NULL, 5078 wdata, flags, &wdata->credits); 5079 /* Can't touch wdata if rc == 0 */ 5080 if (rc) { 5081 trace_smb3_write_err(wdata->rreq->debug_id, 5082 wdata->subreq.debug_index, 5083 xid, 5084 io_parms->persistent_fid, 5085 io_parms->tcon->tid, 5086 io_parms->tcon->ses->Suid, 5087 io_parms->offset, 5088 io_parms->length, 5089 rc); 5090 cifs_stats_fail_inc(tcon, SMB2_WRITE_HE); 5091 } 5092 5093 async_writev_out: 5094 cifs_small_buf_release(req); 5095 out: 5096 if (rc) { 5097 trace_smb3_rw_credits(wdata->rreq->debug_id, 5098 wdata->subreq.debug_index, 5099 wdata->credits.value, 5100 server->credits, server->in_flight, 5101 -(int)wdata->credits.value, 5102 cifs_trace_rw_credits_write_response_clear); 5103 add_credits_and_wake_if(wdata->server, &wdata->credits, 0); 5104 cifs_write_subrequest_terminated(wdata, rc); 5105 } 5106 } 5107 5108 /* 5109 * SMB2_write function gets iov pointer to kvec array with n_vec as a length. 5110 * The length field from io_parms must be at least 1 and indicates a number of 5111 * elements with data to write that begins with position 1 in iov array. All 5112 * data length is specified by count. 5113 */ 5114 int 5115 SMB2_write(const unsigned int xid, struct cifs_io_parms *io_parms, 5116 unsigned int *nbytes, struct kvec *iov, int n_vec) 5117 { 5118 struct smb_rqst rqst; 5119 int rc = 0; 5120 struct smb2_write_req *req = NULL; 5121 struct smb2_write_rsp *rsp = NULL; 5122 int resp_buftype; 5123 struct kvec rsp_iov; 5124 int flags = 0; 5125 unsigned int total_len; 5126 struct TCP_Server_Info *server; 5127 int retries = 0, cur_sleep = 1; 5128 5129 replay_again: 5130 /* reinitialize for possible replay */ 5131 flags = 0; 5132 *nbytes = 0; 5133 if (!io_parms->server) 5134 io_parms->server = cifs_pick_channel(io_parms->tcon->ses); 5135 server = io_parms->server; 5136 if (server == NULL) 5137 return -ECONNABORTED; 5138 5139 if (n_vec < 1) 5140 return rc; 5141 5142 rc = smb2_plain_req_init(SMB2_WRITE, io_parms->tcon, server, 5143 (void **) &req, &total_len); 5144 if (rc) 5145 return rc; 5146 5147 if (smb3_encryption_required(io_parms->tcon)) 5148 flags |= CIFS_TRANSFORM_REQ; 5149 5150 req->hdr.Id.SyncId.ProcessId = cpu_to_le32(io_parms->pid); 5151 5152 req->PersistentFileId = io_parms->persistent_fid; 5153 req->VolatileFileId = io_parms->volatile_fid; 5154 req->WriteChannelInfoOffset = 0; 5155 req->WriteChannelInfoLength = 0; 5156 req->Channel = 0; 5157 req->Length = cpu_to_le32(io_parms->length); 5158 req->Offset = cpu_to_le64(io_parms->offset); 5159 req->DataOffset = cpu_to_le16( 5160 offsetof(struct smb2_write_req, Buffer)); 5161 req->RemainingBytes = 0; 5162 5163 trace_smb3_write_enter(0, 0, xid, io_parms->persistent_fid, 5164 io_parms->tcon->tid, io_parms->tcon->ses->Suid, 5165 io_parms->offset, io_parms->length); 5166 5167 iov[0].iov_base = (char *)req; 5168 /* 1 for Buffer */ 5169 iov[0].iov_len = total_len - 1; 5170 5171 memset(&rqst, 0, sizeof(struct smb_rqst)); 5172 rqst.rq_iov = iov; 5173 rqst.rq_nvec = n_vec + 1; 5174 5175 if (retries) 5176 smb2_set_replay(server, &rqst); 5177 5178 rc = cifs_send_recv(xid, io_parms->tcon->ses, server, 5179 &rqst, 5180 &resp_buftype, flags, &rsp_iov); 5181 rsp = (struct smb2_write_rsp *)rsp_iov.iov_base; 5182 5183 if (rc) { 5184 trace_smb3_write_err(0, 0, xid, 5185 req->PersistentFileId, 5186 io_parms->tcon->tid, 5187 io_parms->tcon->ses->Suid, 5188 io_parms->offset, io_parms->length, rc); 5189 cifs_stats_fail_inc(io_parms->tcon, SMB2_WRITE_HE); 5190 cifs_dbg(VFS, "Send error in write = %d\n", rc); 5191 } else { 5192 *nbytes = le32_to_cpu(rsp->DataLength); 5193 cifs_stats_bytes_written(io_parms->tcon, *nbytes); 5194 trace_smb3_write_done(0, 0, xid, 5195 req->PersistentFileId, 5196 io_parms->tcon->tid, 5197 io_parms->tcon->ses->Suid, 5198 io_parms->offset, *nbytes); 5199 } 5200 5201 cifs_small_buf_release(req); 5202 free_rsp_buf(resp_buftype, rsp); 5203 5204 if (is_replayable_error(rc) && 5205 smb2_should_replay(io_parms->tcon, &retries, &cur_sleep)) 5206 goto replay_again; 5207 5208 return rc; 5209 } 5210 5211 int posix_info_sid_size(const void *beg, const void *end) 5212 { 5213 size_t subauth; 5214 int total; 5215 5216 if (beg + 1 > end) 5217 return -1; 5218 5219 subauth = *(u8 *)(beg+1); 5220 if (subauth < 1 || subauth > 15) 5221 return -1; 5222 5223 total = 1 + 1 + 6 + 4*subauth; 5224 if (beg + total > end) 5225 return -1; 5226 5227 return total; 5228 } 5229 5230 int posix_info_parse(const void *beg, const void *end, 5231 struct smb2_posix_info_parsed *out) 5232 5233 { 5234 int total_len = 0; 5235 int owner_len, group_len; 5236 int name_len; 5237 const void *owner_sid; 5238 const void *group_sid; 5239 const void *name; 5240 5241 /* if no end bound given, assume payload to be correct */ 5242 if (!end) { 5243 const struct smb2_posix_info *p = beg; 5244 5245 end = beg + le32_to_cpu(p->NextEntryOffset); 5246 /* last element will have a 0 offset, pick a sensible bound */ 5247 if (end == beg) 5248 end += 0xFFFF; 5249 } 5250 5251 /* check base buf */ 5252 if (beg + sizeof(struct smb2_posix_info) > end) 5253 return -1; 5254 total_len = sizeof(struct smb2_posix_info); 5255 5256 /* check owner sid */ 5257 owner_sid = beg + total_len; 5258 owner_len = posix_info_sid_size(owner_sid, end); 5259 if (owner_len < 0) 5260 return -1; 5261 total_len += owner_len; 5262 5263 /* check group sid */ 5264 group_sid = beg + total_len; 5265 group_len = posix_info_sid_size(group_sid, end); 5266 if (group_len < 0) 5267 return -1; 5268 total_len += group_len; 5269 5270 /* check name len */ 5271 if (beg + total_len + 4 > end) 5272 return -1; 5273 name_len = le32_to_cpu(*(__le32 *)(beg + total_len)); 5274 if (name_len < 1 || name_len > 0xFFFF) 5275 return -1; 5276 total_len += 4; 5277 5278 /* check name */ 5279 name = beg + total_len; 5280 if (name + name_len > end) 5281 return -1; 5282 total_len += name_len; 5283 5284 if (out) { 5285 out->base = beg; 5286 out->size = total_len; 5287 out->name_len = name_len; 5288 out->name = name; 5289 memcpy(&out->owner, owner_sid, owner_len); 5290 memcpy(&out->group, group_sid, group_len); 5291 } 5292 return total_len; 5293 } 5294 5295 static int posix_info_extra_size(const void *beg, const void *end) 5296 { 5297 int len = posix_info_parse(beg, end, NULL); 5298 5299 if (len < 0) 5300 return -1; 5301 return len - sizeof(struct smb2_posix_info); 5302 } 5303 5304 static unsigned int 5305 num_entries(int infotype, char *bufstart, char *end_of_buf, char **lastentry, 5306 size_t size) 5307 { 5308 int len; 5309 unsigned int entrycount = 0; 5310 unsigned int next_offset = 0; 5311 char *entryptr; 5312 FILE_DIRECTORY_INFO *dir_info; 5313 5314 if (bufstart == NULL) 5315 return 0; 5316 5317 entryptr = bufstart; 5318 5319 while (1) { 5320 if (entryptr + next_offset < entryptr || 5321 entryptr + next_offset > end_of_buf || 5322 entryptr + next_offset + size > end_of_buf) { 5323 cifs_dbg(VFS, "malformed search entry would overflow\n"); 5324 break; 5325 } 5326 5327 entryptr = entryptr + next_offset; 5328 dir_info = (FILE_DIRECTORY_INFO *)entryptr; 5329 5330 if (infotype == SMB_FIND_FILE_POSIX_INFO) 5331 len = posix_info_extra_size(entryptr, end_of_buf); 5332 else 5333 len = le32_to_cpu(dir_info->FileNameLength); 5334 5335 if (len < 0 || 5336 entryptr + len < entryptr || 5337 entryptr + len > end_of_buf || 5338 entryptr + len + size > end_of_buf) { 5339 cifs_dbg(VFS, "directory entry name would overflow frame end of buf %p\n", 5340 end_of_buf); 5341 break; 5342 } 5343 5344 *lastentry = entryptr; 5345 entrycount++; 5346 5347 next_offset = le32_to_cpu(dir_info->NextEntryOffset); 5348 if (!next_offset) 5349 break; 5350 } 5351 5352 return entrycount; 5353 } 5354 5355 /* 5356 * Readdir/FindFirst 5357 */ 5358 int SMB2_query_directory_init(const unsigned int xid, 5359 struct cifs_tcon *tcon, 5360 struct TCP_Server_Info *server, 5361 struct smb_rqst *rqst, 5362 u64 persistent_fid, u64 volatile_fid, 5363 int index, int info_level) 5364 { 5365 struct smb2_query_directory_req *req; 5366 unsigned char *bufptr; 5367 __le16 asteriks = cpu_to_le16('*'); 5368 unsigned int output_size = CIFSMaxBufSize - 5369 MAX_SMB2_CREATE_RESPONSE_SIZE - 5370 MAX_SMB2_CLOSE_RESPONSE_SIZE; 5371 unsigned int total_len; 5372 struct kvec *iov = rqst->rq_iov; 5373 int len, rc; 5374 5375 rc = smb2_plain_req_init(SMB2_QUERY_DIRECTORY, tcon, server, 5376 (void **) &req, &total_len); 5377 if (rc) 5378 return rc; 5379 5380 switch (info_level) { 5381 case SMB_FIND_FILE_DIRECTORY_INFO: 5382 req->FileInformationClass = FILE_DIRECTORY_INFORMATION; 5383 break; 5384 case SMB_FIND_FILE_ID_FULL_DIR_INFO: 5385 req->FileInformationClass = FILEID_FULL_DIRECTORY_INFORMATION; 5386 break; 5387 case SMB_FIND_FILE_POSIX_INFO: 5388 req->FileInformationClass = SMB_FIND_FILE_POSIX_INFO; 5389 break; 5390 case SMB_FIND_FILE_FULL_DIRECTORY_INFO: 5391 req->FileInformationClass = FILE_FULL_DIRECTORY_INFORMATION; 5392 break; 5393 default: 5394 cifs_tcon_dbg(VFS, "info level %u isn't supported\n", 5395 info_level); 5396 return -EINVAL; 5397 } 5398 5399 req->FileIndex = cpu_to_le32(index); 5400 req->PersistentFileId = persistent_fid; 5401 req->VolatileFileId = volatile_fid; 5402 5403 len = 0x2; 5404 bufptr = req->Buffer; 5405 memcpy(bufptr, &asteriks, len); 5406 5407 req->FileNameOffset = 5408 cpu_to_le16(sizeof(struct smb2_query_directory_req)); 5409 req->FileNameLength = cpu_to_le16(len); 5410 /* 5411 * BB could be 30 bytes or so longer if we used SMB2 specific 5412 * buffer lengths, but this is safe and close enough. 5413 */ 5414 output_size = min_t(unsigned int, output_size, server->maxBuf); 5415 output_size = min_t(unsigned int, output_size, 2 << 15); 5416 req->OutputBufferLength = cpu_to_le32(output_size); 5417 5418 iov[0].iov_base = (char *)req; 5419 /* 1 for Buffer */ 5420 iov[0].iov_len = total_len - 1; 5421 5422 iov[1].iov_base = (char *)(req->Buffer); 5423 iov[1].iov_len = len; 5424 5425 trace_smb3_query_dir_enter(xid, persistent_fid, tcon->tid, 5426 tcon->ses->Suid, index, output_size); 5427 5428 return 0; 5429 } 5430 5431 void SMB2_query_directory_free(struct smb_rqst *rqst) 5432 { 5433 if (rqst && rqst->rq_iov) { 5434 cifs_small_buf_release(rqst->rq_iov[0].iov_base); /* request */ 5435 } 5436 } 5437 5438 int 5439 smb2_parse_query_directory(struct cifs_tcon *tcon, 5440 struct kvec *rsp_iov, 5441 int resp_buftype, 5442 struct cifs_search_info *srch_inf) 5443 { 5444 struct smb2_query_directory_rsp *rsp; 5445 size_t info_buf_size; 5446 char *end_of_smb; 5447 int rc; 5448 5449 rsp = (struct smb2_query_directory_rsp *)rsp_iov->iov_base; 5450 5451 switch (srch_inf->info_level) { 5452 case SMB_FIND_FILE_DIRECTORY_INFO: 5453 info_buf_size = sizeof(FILE_DIRECTORY_INFO); 5454 break; 5455 case SMB_FIND_FILE_ID_FULL_DIR_INFO: 5456 info_buf_size = sizeof(FILE_ID_FULL_DIR_INFO); 5457 break; 5458 case SMB_FIND_FILE_POSIX_INFO: 5459 /* note that posix payload are variable size */ 5460 info_buf_size = sizeof(struct smb2_posix_info); 5461 break; 5462 case SMB_FIND_FILE_FULL_DIRECTORY_INFO: 5463 info_buf_size = sizeof(FILE_FULL_DIRECTORY_INFO); 5464 break; 5465 default: 5466 cifs_tcon_dbg(VFS, "info level %u isn't supported\n", 5467 srch_inf->info_level); 5468 return -EINVAL; 5469 } 5470 5471 rc = smb2_validate_iov(le16_to_cpu(rsp->OutputBufferOffset), 5472 le32_to_cpu(rsp->OutputBufferLength), rsp_iov, 5473 info_buf_size); 5474 if (rc) { 5475 cifs_tcon_dbg(VFS, "bad info payload"); 5476 return rc; 5477 } 5478 5479 srch_inf->unicode = true; 5480 5481 if (srch_inf->ntwrk_buf_start) { 5482 if (srch_inf->smallBuf) 5483 cifs_small_buf_release(srch_inf->ntwrk_buf_start); 5484 else 5485 cifs_buf_release(srch_inf->ntwrk_buf_start); 5486 } 5487 srch_inf->ntwrk_buf_start = (char *)rsp; 5488 srch_inf->srch_entries_start = srch_inf->last_entry = 5489 (char *)rsp + le16_to_cpu(rsp->OutputBufferOffset); 5490 end_of_smb = rsp_iov->iov_len + (char *)rsp; 5491 5492 srch_inf->entries_in_buffer = num_entries( 5493 srch_inf->info_level, 5494 srch_inf->srch_entries_start, 5495 end_of_smb, 5496 &srch_inf->last_entry, 5497 info_buf_size); 5498 5499 srch_inf->index_of_last_entry += srch_inf->entries_in_buffer; 5500 cifs_dbg(FYI, "num entries %d last_index %lld srch start %p srch end %p\n", 5501 srch_inf->entries_in_buffer, srch_inf->index_of_last_entry, 5502 srch_inf->srch_entries_start, srch_inf->last_entry); 5503 if (resp_buftype == CIFS_LARGE_BUFFER) 5504 srch_inf->smallBuf = false; 5505 else if (resp_buftype == CIFS_SMALL_BUFFER) 5506 srch_inf->smallBuf = true; 5507 else 5508 cifs_tcon_dbg(VFS, "Invalid search buffer type\n"); 5509 5510 return 0; 5511 } 5512 5513 int 5514 SMB2_query_directory(const unsigned int xid, struct cifs_tcon *tcon, 5515 u64 persistent_fid, u64 volatile_fid, int index, 5516 struct cifs_search_info *srch_inf) 5517 { 5518 struct smb_rqst rqst; 5519 struct kvec iov[SMB2_QUERY_DIRECTORY_IOV_SIZE]; 5520 struct smb2_query_directory_rsp *rsp = NULL; 5521 int resp_buftype = CIFS_NO_BUFFER; 5522 struct kvec rsp_iov; 5523 int rc = 0; 5524 struct cifs_ses *ses = tcon->ses; 5525 struct TCP_Server_Info *server; 5526 int flags = 0; 5527 int retries = 0, cur_sleep = 1; 5528 5529 replay_again: 5530 /* reinitialize for possible replay */ 5531 flags = 0; 5532 server = cifs_pick_channel(ses); 5533 5534 if (!ses || !(ses->server)) 5535 return -EIO; 5536 5537 if (smb3_encryption_required(tcon)) 5538 flags |= CIFS_TRANSFORM_REQ; 5539 5540 memset(&rqst, 0, sizeof(struct smb_rqst)); 5541 memset(&iov, 0, sizeof(iov)); 5542 rqst.rq_iov = iov; 5543 rqst.rq_nvec = SMB2_QUERY_DIRECTORY_IOV_SIZE; 5544 5545 rc = SMB2_query_directory_init(xid, tcon, server, 5546 &rqst, persistent_fid, 5547 volatile_fid, index, 5548 srch_inf->info_level); 5549 if (rc) 5550 goto qdir_exit; 5551 5552 if (retries) 5553 smb2_set_replay(server, &rqst); 5554 5555 rc = cifs_send_recv(xid, ses, server, 5556 &rqst, &resp_buftype, flags, &rsp_iov); 5557 rsp = (struct smb2_query_directory_rsp *)rsp_iov.iov_base; 5558 5559 if (rc) { 5560 if (rc == -ENODATA && 5561 rsp->hdr.Status == STATUS_NO_MORE_FILES) { 5562 trace_smb3_query_dir_done(xid, persistent_fid, 5563 tcon->tid, tcon->ses->Suid, index, 0); 5564 srch_inf->endOfSearch = true; 5565 rc = 0; 5566 } else { 5567 trace_smb3_query_dir_err(xid, persistent_fid, tcon->tid, 5568 tcon->ses->Suid, index, 0, rc); 5569 cifs_stats_fail_inc(tcon, SMB2_QUERY_DIRECTORY_HE); 5570 } 5571 goto qdir_exit; 5572 } 5573 5574 rc = smb2_parse_query_directory(tcon, &rsp_iov, resp_buftype, 5575 srch_inf); 5576 if (rc) { 5577 trace_smb3_query_dir_err(xid, persistent_fid, tcon->tid, 5578 tcon->ses->Suid, index, 0, rc); 5579 goto qdir_exit; 5580 } 5581 resp_buftype = CIFS_NO_BUFFER; 5582 5583 trace_smb3_query_dir_done(xid, persistent_fid, tcon->tid, 5584 tcon->ses->Suid, index, srch_inf->entries_in_buffer); 5585 5586 qdir_exit: 5587 SMB2_query_directory_free(&rqst); 5588 free_rsp_buf(resp_buftype, rsp); 5589 5590 if (is_replayable_error(rc) && 5591 smb2_should_replay(tcon, &retries, &cur_sleep)) 5592 goto replay_again; 5593 5594 return rc; 5595 } 5596 5597 int 5598 SMB2_set_info_init(struct cifs_tcon *tcon, struct TCP_Server_Info *server, 5599 struct smb_rqst *rqst, 5600 u64 persistent_fid, u64 volatile_fid, u32 pid, 5601 u8 info_class, u8 info_type, u32 additional_info, 5602 void **data, unsigned int *size) 5603 { 5604 struct smb2_set_info_req *req; 5605 struct kvec *iov = rqst->rq_iov; 5606 unsigned int i, total_len; 5607 int rc; 5608 5609 rc = smb2_plain_req_init(SMB2_SET_INFO, tcon, server, 5610 (void **) &req, &total_len); 5611 if (rc) 5612 return rc; 5613 5614 req->hdr.Id.SyncId.ProcessId = cpu_to_le32(pid); 5615 req->InfoType = info_type; 5616 req->FileInfoClass = info_class; 5617 req->PersistentFileId = persistent_fid; 5618 req->VolatileFileId = volatile_fid; 5619 req->AdditionalInformation = cpu_to_le32(additional_info); 5620 5621 req->BufferOffset = cpu_to_le16(sizeof(struct smb2_set_info_req)); 5622 req->BufferLength = cpu_to_le32(*size); 5623 5624 memcpy(req->Buffer, *data, *size); 5625 total_len += *size; 5626 5627 iov[0].iov_base = (char *)req; 5628 /* 1 for Buffer */ 5629 iov[0].iov_len = total_len - 1; 5630 5631 for (i = 1; i < rqst->rq_nvec; i++) { 5632 le32_add_cpu(&req->BufferLength, size[i]); 5633 iov[i].iov_base = (char *)data[i]; 5634 iov[i].iov_len = size[i]; 5635 } 5636 5637 return 0; 5638 } 5639 5640 void 5641 SMB2_set_info_free(struct smb_rqst *rqst) 5642 { 5643 if (rqst && rqst->rq_iov) 5644 cifs_buf_release(rqst->rq_iov[0].iov_base); /* request */ 5645 } 5646 5647 static int 5648 send_set_info(const unsigned int xid, struct cifs_tcon *tcon, 5649 u64 persistent_fid, u64 volatile_fid, u32 pid, u8 info_class, 5650 u8 info_type, u32 additional_info, unsigned int num, 5651 void **data, unsigned int *size) 5652 { 5653 struct smb_rqst rqst; 5654 struct smb2_set_info_rsp *rsp = NULL; 5655 struct kvec *iov; 5656 struct kvec rsp_iov; 5657 int rc = 0; 5658 int resp_buftype; 5659 struct cifs_ses *ses = tcon->ses; 5660 struct TCP_Server_Info *server; 5661 int flags = 0; 5662 int retries = 0, cur_sleep = 1; 5663 5664 replay_again: 5665 /* reinitialize for possible replay */ 5666 flags = 0; 5667 server = cifs_pick_channel(ses); 5668 5669 if (!ses || !server) 5670 return -EIO; 5671 5672 if (!num) 5673 return -EINVAL; 5674 5675 if (smb3_encryption_required(tcon)) 5676 flags |= CIFS_TRANSFORM_REQ; 5677 5678 iov = kmalloc_array(num, sizeof(struct kvec), GFP_KERNEL); 5679 if (!iov) 5680 return -ENOMEM; 5681 5682 memset(&rqst, 0, sizeof(struct smb_rqst)); 5683 rqst.rq_iov = iov; 5684 rqst.rq_nvec = num; 5685 5686 rc = SMB2_set_info_init(tcon, server, 5687 &rqst, persistent_fid, volatile_fid, pid, 5688 info_class, info_type, additional_info, 5689 data, size); 5690 if (rc) { 5691 kfree(iov); 5692 return rc; 5693 } 5694 5695 if (retries) 5696 smb2_set_replay(server, &rqst); 5697 5698 rc = cifs_send_recv(xid, ses, server, 5699 &rqst, &resp_buftype, flags, 5700 &rsp_iov); 5701 SMB2_set_info_free(&rqst); 5702 rsp = (struct smb2_set_info_rsp *)rsp_iov.iov_base; 5703 5704 if (rc != 0) { 5705 cifs_stats_fail_inc(tcon, SMB2_SET_INFO_HE); 5706 trace_smb3_set_info_err(xid, persistent_fid, tcon->tid, 5707 ses->Suid, info_class, (__u32)info_type, rc); 5708 } 5709 5710 free_rsp_buf(resp_buftype, rsp); 5711 kfree(iov); 5712 5713 if (is_replayable_error(rc) && 5714 smb2_should_replay(tcon, &retries, &cur_sleep)) 5715 goto replay_again; 5716 5717 return rc; 5718 } 5719 5720 int 5721 SMB2_set_eof(const unsigned int xid, struct cifs_tcon *tcon, u64 persistent_fid, 5722 u64 volatile_fid, u32 pid, loff_t new_eof) 5723 { 5724 struct smb2_file_eof_info info; 5725 void *data; 5726 unsigned int size; 5727 5728 info.EndOfFile = cpu_to_le64(new_eof); 5729 5730 data = &info; 5731 size = sizeof(struct smb2_file_eof_info); 5732 5733 trace_smb3_set_eof(xid, persistent_fid, tcon->tid, tcon->ses->Suid, new_eof); 5734 5735 return send_set_info(xid, tcon, persistent_fid, volatile_fid, 5736 pid, FILE_END_OF_FILE_INFORMATION, SMB2_O_INFO_FILE, 5737 0, 1, &data, &size); 5738 } 5739 5740 int 5741 SMB2_set_acl(const unsigned int xid, struct cifs_tcon *tcon, 5742 u64 persistent_fid, u64 volatile_fid, 5743 struct smb_ntsd *pnntsd, int pacllen, int aclflag) 5744 { 5745 return send_set_info(xid, tcon, persistent_fid, volatile_fid, 5746 current->tgid, 0, SMB2_O_INFO_SECURITY, aclflag, 5747 1, (void **)&pnntsd, &pacllen); 5748 } 5749 5750 int 5751 SMB2_set_ea(const unsigned int xid, struct cifs_tcon *tcon, 5752 u64 persistent_fid, u64 volatile_fid, 5753 struct smb2_file_full_ea_info *buf, int len) 5754 { 5755 return send_set_info(xid, tcon, persistent_fid, volatile_fid, 5756 current->tgid, FILE_FULL_EA_INFORMATION, SMB2_O_INFO_FILE, 5757 0, 1, (void **)&buf, &len); 5758 } 5759 5760 int 5761 SMB2_oplock_break(const unsigned int xid, struct cifs_tcon *tcon, 5762 const u64 persistent_fid, const u64 volatile_fid, 5763 __u8 oplock_level) 5764 { 5765 struct smb_rqst rqst; 5766 int rc; 5767 struct smb2_oplock_break *req = NULL; 5768 struct cifs_ses *ses = tcon->ses; 5769 struct TCP_Server_Info *server; 5770 int flags = CIFS_OBREAK_OP; 5771 unsigned int total_len; 5772 struct kvec iov[1]; 5773 struct kvec rsp_iov; 5774 int resp_buf_type; 5775 int retries = 0, cur_sleep = 1; 5776 5777 replay_again: 5778 /* reinitialize for possible replay */ 5779 flags = CIFS_OBREAK_OP; 5780 server = cifs_pick_channel(ses); 5781 5782 cifs_dbg(FYI, "SMB2_oplock_break\n"); 5783 rc = smb2_plain_req_init(SMB2_OPLOCK_BREAK, tcon, server, 5784 (void **) &req, &total_len); 5785 if (rc) 5786 return rc; 5787 5788 if (smb3_encryption_required(tcon)) 5789 flags |= CIFS_TRANSFORM_REQ; 5790 5791 req->VolatileFid = volatile_fid; 5792 req->PersistentFid = persistent_fid; 5793 req->OplockLevel = oplock_level; 5794 req->hdr.CreditRequest = cpu_to_le16(1); 5795 5796 flags |= CIFS_NO_RSP_BUF; 5797 5798 iov[0].iov_base = (char *)req; 5799 iov[0].iov_len = total_len; 5800 5801 memset(&rqst, 0, sizeof(struct smb_rqst)); 5802 rqst.rq_iov = iov; 5803 rqst.rq_nvec = 1; 5804 5805 if (retries) 5806 smb2_set_replay(server, &rqst); 5807 5808 rc = cifs_send_recv(xid, ses, server, 5809 &rqst, &resp_buf_type, flags, &rsp_iov); 5810 cifs_small_buf_release(req); 5811 if (rc) { 5812 cifs_stats_fail_inc(tcon, SMB2_OPLOCK_BREAK_HE); 5813 cifs_dbg(FYI, "Send error in Oplock Break = %d\n", rc); 5814 } 5815 5816 if (is_replayable_error(rc) && 5817 smb2_should_replay(tcon, &retries, &cur_sleep)) 5818 goto replay_again; 5819 5820 return rc; 5821 } 5822 5823 void 5824 smb2_copy_fs_info_to_kstatfs(struct smb2_fs_full_size_info *pfs_inf, 5825 struct kstatfs *kst) 5826 { 5827 kst->f_bsize = le32_to_cpu(pfs_inf->BytesPerSector) * 5828 le32_to_cpu(pfs_inf->SectorsPerAllocationUnit); 5829 kst->f_blocks = le64_to_cpu(pfs_inf->TotalAllocationUnits); 5830 kst->f_bfree = kst->f_bavail = 5831 le64_to_cpu(pfs_inf->CallerAvailableAllocationUnits); 5832 return; 5833 } 5834 5835 static void 5836 copy_posix_fs_info_to_kstatfs(FILE_SYSTEM_POSIX_INFO *response_data, 5837 struct kstatfs *kst) 5838 { 5839 kst->f_bsize = le32_to_cpu(response_data->BlockSize); 5840 kst->f_blocks = le64_to_cpu(response_data->TotalBlocks); 5841 kst->f_bfree = le64_to_cpu(response_data->BlocksAvail); 5842 if (response_data->UserBlocksAvail == cpu_to_le64(-1)) 5843 kst->f_bavail = kst->f_bfree; 5844 else 5845 kst->f_bavail = le64_to_cpu(response_data->UserBlocksAvail); 5846 if (response_data->TotalFileNodes != cpu_to_le64(-1)) 5847 kst->f_files = le64_to_cpu(response_data->TotalFileNodes); 5848 if (response_data->FreeFileNodes != cpu_to_le64(-1)) 5849 kst->f_ffree = le64_to_cpu(response_data->FreeFileNodes); 5850 5851 return; 5852 } 5853 5854 static int 5855 build_qfs_info_req(struct kvec *iov, struct cifs_tcon *tcon, 5856 struct TCP_Server_Info *server, 5857 int level, int outbuf_len, u64 persistent_fid, 5858 u64 volatile_fid) 5859 { 5860 int rc; 5861 struct smb2_query_info_req *req; 5862 unsigned int total_len; 5863 5864 cifs_dbg(FYI, "Query FSInfo level %d\n", level); 5865 5866 if ((tcon->ses == NULL) || server == NULL) 5867 return -EIO; 5868 5869 rc = smb2_plain_req_init(SMB2_QUERY_INFO, tcon, server, 5870 (void **) &req, &total_len); 5871 if (rc) 5872 return rc; 5873 5874 req->InfoType = SMB2_O_INFO_FILESYSTEM; 5875 req->FileInfoClass = level; 5876 req->PersistentFileId = persistent_fid; 5877 req->VolatileFileId = volatile_fid; 5878 /* 1 for pad */ 5879 req->InputBufferOffset = 5880 cpu_to_le16(sizeof(struct smb2_query_info_req)); 5881 req->OutputBufferLength = cpu_to_le32( 5882 outbuf_len + sizeof(struct smb2_query_info_rsp)); 5883 5884 iov->iov_base = (char *)req; 5885 iov->iov_len = total_len; 5886 return 0; 5887 } 5888 5889 static inline void free_qfs_info_req(struct kvec *iov) 5890 { 5891 cifs_buf_release(iov->iov_base); 5892 } 5893 5894 int 5895 SMB311_posix_qfs_info(const unsigned int xid, struct cifs_tcon *tcon, 5896 u64 persistent_fid, u64 volatile_fid, struct kstatfs *fsdata) 5897 { 5898 struct smb_rqst rqst; 5899 struct smb2_query_info_rsp *rsp = NULL; 5900 struct kvec iov; 5901 struct kvec rsp_iov; 5902 int rc = 0; 5903 int resp_buftype; 5904 struct cifs_ses *ses = tcon->ses; 5905 struct TCP_Server_Info *server; 5906 FILE_SYSTEM_POSIX_INFO *info = NULL; 5907 int flags = 0; 5908 int retries = 0, cur_sleep = 1; 5909 5910 replay_again: 5911 /* reinitialize for possible replay */ 5912 flags = 0; 5913 server = cifs_pick_channel(ses); 5914 5915 rc = build_qfs_info_req(&iov, tcon, server, 5916 FS_POSIX_INFORMATION, 5917 sizeof(FILE_SYSTEM_POSIX_INFO), 5918 persistent_fid, volatile_fid); 5919 if (rc) 5920 return rc; 5921 5922 if (smb3_encryption_required(tcon)) 5923 flags |= CIFS_TRANSFORM_REQ; 5924 5925 memset(&rqst, 0, sizeof(struct smb_rqst)); 5926 rqst.rq_iov = &iov; 5927 rqst.rq_nvec = 1; 5928 5929 if (retries) 5930 smb2_set_replay(server, &rqst); 5931 5932 rc = cifs_send_recv(xid, ses, server, 5933 &rqst, &resp_buftype, flags, &rsp_iov); 5934 free_qfs_info_req(&iov); 5935 if (rc) { 5936 cifs_stats_fail_inc(tcon, SMB2_QUERY_INFO_HE); 5937 goto posix_qfsinf_exit; 5938 } 5939 rsp = (struct smb2_query_info_rsp *)rsp_iov.iov_base; 5940 5941 info = (FILE_SYSTEM_POSIX_INFO *)( 5942 le16_to_cpu(rsp->OutputBufferOffset) + (char *)rsp); 5943 rc = smb2_validate_iov(le16_to_cpu(rsp->OutputBufferOffset), 5944 le32_to_cpu(rsp->OutputBufferLength), &rsp_iov, 5945 sizeof(FILE_SYSTEM_POSIX_INFO)); 5946 if (!rc) 5947 copy_posix_fs_info_to_kstatfs(info, fsdata); 5948 5949 posix_qfsinf_exit: 5950 free_rsp_buf(resp_buftype, rsp_iov.iov_base); 5951 5952 if (is_replayable_error(rc) && 5953 smb2_should_replay(tcon, &retries, &cur_sleep)) 5954 goto replay_again; 5955 5956 return rc; 5957 } 5958 5959 int 5960 SMB2_QFS_attr(const unsigned int xid, struct cifs_tcon *tcon, 5961 u64 persistent_fid, u64 volatile_fid, int level) 5962 { 5963 struct smb_rqst rqst; 5964 struct smb2_query_info_rsp *rsp = NULL; 5965 struct kvec iov; 5966 struct kvec rsp_iov; 5967 int rc = 0; 5968 int resp_buftype, max_len, min_len; 5969 struct cifs_ses *ses = tcon->ses; 5970 struct TCP_Server_Info *server; 5971 unsigned int rsp_len, offset; 5972 int flags = 0; 5973 int retries = 0, cur_sleep = 1; 5974 5975 replay_again: 5976 /* reinitialize for possible replay */ 5977 flags = 0; 5978 server = cifs_pick_channel(ses); 5979 5980 if (level == FS_DEVICE_INFORMATION) { 5981 max_len = sizeof(FILE_SYSTEM_DEVICE_INFO); 5982 min_len = sizeof(FILE_SYSTEM_DEVICE_INFO); 5983 } else if (level == FS_ATTRIBUTE_INFORMATION) { 5984 max_len = sizeof(FILE_SYSTEM_ATTRIBUTE_INFO) + MAX_FS_NAME_LEN; 5985 min_len = sizeof(FILE_SYSTEM_ATTRIBUTE_INFO); 5986 } else if (level == FS_SECTOR_SIZE_INFORMATION) { 5987 max_len = sizeof(struct smb3_fs_ss_info); 5988 min_len = sizeof(struct smb3_fs_ss_info); 5989 } else if (level == FS_VOLUME_INFORMATION) { 5990 max_len = sizeof(struct smb3_fs_vol_info) + MAX_VOL_LABEL_LEN; 5991 min_len = sizeof(struct smb3_fs_vol_info); 5992 } else { 5993 cifs_dbg(FYI, "Invalid qfsinfo level %d\n", level); 5994 return -EINVAL; 5995 } 5996 5997 rc = build_qfs_info_req(&iov, tcon, server, 5998 level, max_len, 5999 persistent_fid, volatile_fid); 6000 if (rc) 6001 return rc; 6002 6003 if (smb3_encryption_required(tcon)) 6004 flags |= CIFS_TRANSFORM_REQ; 6005 6006 memset(&rqst, 0, sizeof(struct smb_rqst)); 6007 rqst.rq_iov = &iov; 6008 rqst.rq_nvec = 1; 6009 6010 if (retries) 6011 smb2_set_replay(server, &rqst); 6012 6013 rc = cifs_send_recv(xid, ses, server, 6014 &rqst, &resp_buftype, flags, &rsp_iov); 6015 free_qfs_info_req(&iov); 6016 if (rc) { 6017 cifs_stats_fail_inc(tcon, SMB2_QUERY_INFO_HE); 6018 goto qfsattr_exit; 6019 } 6020 rsp = (struct smb2_query_info_rsp *)rsp_iov.iov_base; 6021 6022 rsp_len = le32_to_cpu(rsp->OutputBufferLength); 6023 offset = le16_to_cpu(rsp->OutputBufferOffset); 6024 rc = smb2_validate_iov(offset, rsp_len, &rsp_iov, min_len); 6025 if (rc) 6026 goto qfsattr_exit; 6027 6028 if (level == FS_ATTRIBUTE_INFORMATION) 6029 memcpy(&tcon->fsAttrInfo, offset 6030 + (char *)rsp, min_t(unsigned int, 6031 rsp_len, min_len)); 6032 else if (level == FS_DEVICE_INFORMATION) 6033 memcpy(&tcon->fsDevInfo, offset 6034 + (char *)rsp, sizeof(FILE_SYSTEM_DEVICE_INFO)); 6035 else if (level == FS_SECTOR_SIZE_INFORMATION) { 6036 struct smb3_fs_ss_info *ss_info = (struct smb3_fs_ss_info *) 6037 (offset + (char *)rsp); 6038 tcon->ss_flags = le32_to_cpu(ss_info->Flags); 6039 tcon->perf_sector_size = 6040 le32_to_cpu(ss_info->PhysicalBytesPerSectorForPerf); 6041 } else if (level == FS_VOLUME_INFORMATION) { 6042 struct smb3_fs_vol_info *vol_info = (struct smb3_fs_vol_info *) 6043 (offset + (char *)rsp); 6044 tcon->vol_serial_number = vol_info->VolumeSerialNumber; 6045 tcon->vol_create_time = vol_info->VolumeCreationTime; 6046 } 6047 6048 qfsattr_exit: 6049 free_rsp_buf(resp_buftype, rsp_iov.iov_base); 6050 6051 if (is_replayable_error(rc) && 6052 smb2_should_replay(tcon, &retries, &cur_sleep)) 6053 goto replay_again; 6054 6055 return rc; 6056 } 6057 6058 int 6059 smb2_lockv(const unsigned int xid, struct cifs_tcon *tcon, 6060 const __u64 persist_fid, const __u64 volatile_fid, const __u32 pid, 6061 const __u32 num_lock, struct smb2_lock_element *buf) 6062 { 6063 struct smb_rqst rqst; 6064 int rc = 0; 6065 struct smb2_lock_req *req = NULL; 6066 struct kvec iov[2]; 6067 struct kvec rsp_iov; 6068 int resp_buf_type; 6069 unsigned int count; 6070 int flags = CIFS_NO_RSP_BUF; 6071 unsigned int total_len; 6072 struct TCP_Server_Info *server; 6073 int retries = 0, cur_sleep = 1; 6074 6075 replay_again: 6076 /* reinitialize for possible replay */ 6077 flags = CIFS_NO_RSP_BUF; 6078 server = cifs_pick_channel(tcon->ses); 6079 6080 cifs_dbg(FYI, "smb2_lockv num lock %d\n", num_lock); 6081 6082 rc = smb2_plain_req_init(SMB2_LOCK, tcon, server, 6083 (void **) &req, &total_len); 6084 if (rc) 6085 return rc; 6086 6087 if (smb3_encryption_required(tcon)) 6088 flags |= CIFS_TRANSFORM_REQ; 6089 6090 req->hdr.Id.SyncId.ProcessId = cpu_to_le32(pid); 6091 req->LockCount = cpu_to_le16(num_lock); 6092 6093 req->PersistentFileId = persist_fid; 6094 req->VolatileFileId = volatile_fid; 6095 6096 count = num_lock * sizeof(struct smb2_lock_element); 6097 6098 iov[0].iov_base = (char *)req; 6099 iov[0].iov_len = total_len - sizeof(struct smb2_lock_element); 6100 iov[1].iov_base = (char *)buf; 6101 iov[1].iov_len = count; 6102 6103 cifs_stats_inc(&tcon->stats.cifs_stats.num_locks); 6104 6105 memset(&rqst, 0, sizeof(struct smb_rqst)); 6106 rqst.rq_iov = iov; 6107 rqst.rq_nvec = 2; 6108 6109 if (retries) 6110 smb2_set_replay(server, &rqst); 6111 6112 rc = cifs_send_recv(xid, tcon->ses, server, 6113 &rqst, &resp_buf_type, flags, 6114 &rsp_iov); 6115 cifs_small_buf_release(req); 6116 if (rc) { 6117 cifs_dbg(FYI, "Send error in smb2_lockv = %d\n", rc); 6118 cifs_stats_fail_inc(tcon, SMB2_LOCK_HE); 6119 trace_smb3_lock_err(xid, persist_fid, tcon->tid, 6120 tcon->ses->Suid, rc); 6121 } 6122 6123 if (is_replayable_error(rc) && 6124 smb2_should_replay(tcon, &retries, &cur_sleep)) 6125 goto replay_again; 6126 6127 return rc; 6128 } 6129 6130 int 6131 SMB2_lock(const unsigned int xid, struct cifs_tcon *tcon, 6132 const __u64 persist_fid, const __u64 volatile_fid, const __u32 pid, 6133 const __u64 length, const __u64 offset, const __u32 lock_flags, 6134 const bool wait) 6135 { 6136 struct smb2_lock_element lock; 6137 6138 lock.Offset = cpu_to_le64(offset); 6139 lock.Length = cpu_to_le64(length); 6140 lock.Flags = cpu_to_le32(lock_flags); 6141 if (!wait && lock_flags != SMB2_LOCKFLAG_UNLOCK) 6142 lock.Flags |= cpu_to_le32(SMB2_LOCKFLAG_FAIL_IMMEDIATELY); 6143 6144 return smb2_lockv(xid, tcon, persist_fid, volatile_fid, pid, 1, &lock); 6145 } 6146 6147 int 6148 SMB2_lease_break(const unsigned int xid, struct cifs_tcon *tcon, 6149 __u8 *lease_key, const __le32 lease_state) 6150 { 6151 struct smb_rqst rqst; 6152 int rc; 6153 struct smb2_lease_ack *req = NULL; 6154 struct cifs_ses *ses = tcon->ses; 6155 int flags = CIFS_OBREAK_OP; 6156 unsigned int total_len; 6157 struct kvec iov[1]; 6158 struct kvec rsp_iov; 6159 int resp_buf_type; 6160 __u64 *please_key_high; 6161 __u64 *please_key_low; 6162 struct TCP_Server_Info *server = cifs_pick_channel(tcon->ses); 6163 6164 cifs_dbg(FYI, "SMB2_lease_break\n"); 6165 rc = smb2_plain_req_init(SMB2_OPLOCK_BREAK, tcon, server, 6166 (void **) &req, &total_len); 6167 if (rc) 6168 return rc; 6169 6170 if (smb3_encryption_required(tcon)) 6171 flags |= CIFS_TRANSFORM_REQ; 6172 6173 req->hdr.CreditRequest = cpu_to_le16(1); 6174 req->StructureSize = cpu_to_le16(36); 6175 total_len += 12; 6176 6177 memcpy(req->LeaseKey, lease_key, SMB2_LEASE_KEY_SIZE); 6178 req->LeaseState = lease_state; 6179 6180 flags |= CIFS_NO_RSP_BUF; 6181 6182 iov[0].iov_base = (char *)req; 6183 iov[0].iov_len = total_len; 6184 6185 memset(&rqst, 0, sizeof(struct smb_rqst)); 6186 rqst.rq_iov = iov; 6187 rqst.rq_nvec = 1; 6188 6189 rc = cifs_send_recv(xid, ses, server, 6190 &rqst, &resp_buf_type, flags, &rsp_iov); 6191 cifs_small_buf_release(req); 6192 6193 please_key_low = (__u64 *)lease_key; 6194 please_key_high = (__u64 *)(lease_key+8); 6195 if (rc) { 6196 cifs_stats_fail_inc(tcon, SMB2_OPLOCK_BREAK_HE); 6197 trace_smb3_lease_ack_err(le32_to_cpu(lease_state), tcon->tid, 6198 ses->Suid, *please_key_low, *please_key_high, rc); 6199 cifs_dbg(FYI, "Send error in Lease Break = %d\n", rc); 6200 } else 6201 trace_smb3_lease_ack_done(le32_to_cpu(lease_state), tcon->tid, 6202 ses->Suid, *please_key_low, *please_key_high); 6203 6204 return rc; 6205 } 6206