1 // SPDX-License-Identifier: LGPL-2.1 2 /* 3 * 4 * Copyright (C) International Business Machines Corp., 2009, 2013 5 * Etersoft, 2012 6 * Author(s): Steve French (sfrench@us.ibm.com) 7 * Pavel Shilovsky (pshilovsky@samba.org) 2012 8 * 9 * Contains the routines for constructing the SMB2 PDUs themselves 10 * 11 */ 12 13 /* SMB2 PDU handling routines here - except for leftovers (eg session setup) */ 14 /* Note that there are handle based routines which must be */ 15 /* treated slightly differently for reconnection purposes since we never */ 16 /* want to reuse a stale file handle and only the caller knows the file info */ 17 18 #include <linux/fs.h> 19 #include <linux/kernel.h> 20 #include <linux/vfs.h> 21 #include <linux/task_io_accounting_ops.h> 22 #include <linux/uaccess.h> 23 #include <linux/uuid.h> 24 #include <linux/pagemap.h> 25 #include <linux/xattr.h> 26 #include "cifsglob.h" 27 #include "cifsacl.h" 28 #include "cifsproto.h" 29 #include "smb2proto.h" 30 #include "cifs_unicode.h" 31 #include "cifs_debug.h" 32 #include "ntlmssp.h" 33 #include "smb2status.h" 34 #include "smb2glob.h" 35 #include "cifspdu.h" 36 #include "cifs_spnego.h" 37 #include "smbdirect.h" 38 #include "trace.h" 39 #ifdef CONFIG_CIFS_DFS_UPCALL 40 #include "dfs_cache.h" 41 #endif 42 #include "cached_dir.h" 43 44 /* 45 * The following table defines the expected "StructureSize" of SMB2 requests 46 * in order by SMB2 command. This is similar to "wct" in SMB/CIFS requests. 47 * 48 * Note that commands are defined in smb2pdu.h in le16 but the array below is 49 * indexed by command in host byte order. 50 */ 51 static const int smb2_req_struct_sizes[NUMBER_OF_SMB2_COMMANDS] = { 52 /* SMB2_NEGOTIATE */ 36, 53 /* SMB2_SESSION_SETUP */ 25, 54 /* SMB2_LOGOFF */ 4, 55 /* SMB2_TREE_CONNECT */ 9, 56 /* SMB2_TREE_DISCONNECT */ 4, 57 /* SMB2_CREATE */ 57, 58 /* SMB2_CLOSE */ 24, 59 /* SMB2_FLUSH */ 24, 60 /* SMB2_READ */ 49, 61 /* SMB2_WRITE */ 49, 62 /* SMB2_LOCK */ 48, 63 /* SMB2_IOCTL */ 57, 64 /* SMB2_CANCEL */ 4, 65 /* SMB2_ECHO */ 4, 66 /* SMB2_QUERY_DIRECTORY */ 33, 67 /* SMB2_CHANGE_NOTIFY */ 32, 68 /* SMB2_QUERY_INFO */ 41, 69 /* SMB2_SET_INFO */ 33, 70 /* SMB2_OPLOCK_BREAK */ 24 /* BB this is 36 for LEASE_BREAK variant */ 71 }; 72 73 int smb3_encryption_required(const struct cifs_tcon *tcon) 74 { 75 if (!tcon || !tcon->ses) 76 return 0; 77 if ((tcon->ses->session_flags & SMB2_SESSION_FLAG_ENCRYPT_DATA) || 78 (tcon->share_flags & SHI1005_FLAGS_ENCRYPT_DATA)) 79 return 1; 80 if (tcon->seal && 81 (tcon->ses->server->capabilities & SMB2_GLOBAL_CAP_ENCRYPTION)) 82 return 1; 83 return 0; 84 } 85 86 static void 87 smb2_hdr_assemble(struct smb2_hdr *shdr, __le16 smb2_cmd, 88 const struct cifs_tcon *tcon, 89 struct TCP_Server_Info *server) 90 { 91 struct smb3_hdr_req *smb3_hdr; 92 93 shdr->ProtocolId = SMB2_PROTO_NUMBER; 94 shdr->StructureSize = cpu_to_le16(64); 95 shdr->Command = smb2_cmd; 96 97 if (server) { 98 /* After reconnect SMB3 must set ChannelSequence on subsequent reqs */ 99 if (server->dialect >= SMB30_PROT_ID) { 100 smb3_hdr = (struct smb3_hdr_req *)shdr; 101 /* 102 * if primary channel is not set yet, use default 103 * channel for chan sequence num 104 */ 105 if (SERVER_IS_CHAN(server)) 106 smb3_hdr->ChannelSequence = 107 cpu_to_le16(server->primary_server->channel_sequence_num); 108 else 109 smb3_hdr->ChannelSequence = 110 cpu_to_le16(server->channel_sequence_num); 111 } 112 spin_lock(&server->req_lock); 113 /* Request up to 10 credits but don't go over the limit. */ 114 if (server->credits >= server->max_credits) 115 shdr->CreditRequest = cpu_to_le16(0); 116 else 117 shdr->CreditRequest = cpu_to_le16( 118 min_t(int, server->max_credits - 119 server->credits, 10)); 120 spin_unlock(&server->req_lock); 121 } else { 122 shdr->CreditRequest = cpu_to_le16(2); 123 } 124 shdr->Id.SyncId.ProcessId = cpu_to_le32((__u16)current->tgid); 125 126 if (!tcon) 127 goto out; 128 129 /* GLOBAL_CAP_LARGE_MTU will only be set if dialect > SMB2.02 */ 130 /* See sections 2.2.4 and 3.2.4.1.5 of MS-SMB2 */ 131 if (server && (server->capabilities & SMB2_GLOBAL_CAP_LARGE_MTU)) 132 shdr->CreditCharge = cpu_to_le16(1); 133 /* else CreditCharge MBZ */ 134 135 shdr->Id.SyncId.TreeId = cpu_to_le32(tcon->tid); 136 /* Uid is not converted */ 137 if (tcon->ses) 138 shdr->SessionId = cpu_to_le64(tcon->ses->Suid); 139 140 /* 141 * If we would set SMB2_FLAGS_DFS_OPERATIONS on open we also would have 142 * to pass the path on the Open SMB prefixed by \\server\share. 143 * Not sure when we would need to do the augmented path (if ever) and 144 * setting this flag breaks the SMB2 open operation since it is 145 * illegal to send an empty path name (without \\server\share prefix) 146 * when the DFS flag is set in the SMB open header. We could 147 * consider setting the flag on all operations other than open 148 * but it is safer to net set it for now. 149 */ 150 /* if (tcon->share_flags & SHI1005_FLAGS_DFS) 151 shdr->Flags |= SMB2_FLAGS_DFS_OPERATIONS; */ 152 153 if (server && server->sign && !smb3_encryption_required(tcon)) 154 shdr->Flags |= SMB2_FLAGS_SIGNED; 155 out: 156 return; 157 } 158 159 /* helper function for code reuse */ 160 static int 161 cifs_chan_skip_or_disable(struct cifs_ses *ses, 162 struct TCP_Server_Info *server, 163 bool from_reconnect) 164 { 165 struct TCP_Server_Info *pserver; 166 unsigned int chan_index; 167 168 if (SERVER_IS_CHAN(server)) { 169 cifs_dbg(VFS, 170 "server %s does not support multichannel anymore. Skip secondary channel\n", 171 ses->server->hostname); 172 173 spin_lock(&ses->chan_lock); 174 chan_index = cifs_ses_get_chan_index(ses, server); 175 if (chan_index == CIFS_INVAL_CHAN_INDEX) { 176 spin_unlock(&ses->chan_lock); 177 goto skip_terminate; 178 } 179 180 ses->chans[chan_index].server = NULL; 181 server->terminate = true; 182 spin_unlock(&ses->chan_lock); 183 184 /* 185 * the above reference of server by channel 186 * needs to be dropped without holding chan_lock 187 * as cifs_put_tcp_session takes a higher lock 188 * i.e. cifs_tcp_ses_lock 189 */ 190 cifs_put_tcp_session(server, from_reconnect); 191 192 cifs_signal_cifsd_for_reconnect(server, false); 193 194 /* mark primary server as needing reconnect */ 195 pserver = server->primary_server; 196 cifs_signal_cifsd_for_reconnect(pserver, false); 197 skip_terminate: 198 return -EHOSTDOWN; 199 } 200 201 cifs_server_dbg(VFS, 202 "server does not support multichannel anymore. Disable all other channels\n"); 203 cifs_disable_secondary_channels(ses); 204 205 206 return 0; 207 } 208 209 static int 210 smb2_reconnect(__le16 smb2_command, struct cifs_tcon *tcon, 211 struct TCP_Server_Info *server, bool from_reconnect) 212 { 213 int rc = 0; 214 struct nls_table *nls_codepage = NULL; 215 struct cifs_ses *ses; 216 int xid; 217 218 /* 219 * SMB2s NegProt, SessSetup, Logoff do not have tcon yet so 220 * check for tcp and smb session status done differently 221 * for those three - in the calling routine. 222 */ 223 if (tcon == NULL) 224 return 0; 225 226 /* 227 * Need to also skip SMB2_IOCTL because it is used for checking nested dfs links in 228 * cifs_tree_connect(). 229 */ 230 if (smb2_command == SMB2_TREE_CONNECT || smb2_command == SMB2_IOCTL) 231 return 0; 232 233 spin_lock(&tcon->tc_lock); 234 if (tcon->status == TID_EXITING) { 235 /* 236 * only tree disconnect allowed when disconnecting ... 237 */ 238 if (smb2_command != SMB2_TREE_DISCONNECT) { 239 spin_unlock(&tcon->tc_lock); 240 cifs_dbg(FYI, "can not send cmd %d while umounting\n", 241 smb2_command); 242 return -ENODEV; 243 } 244 } 245 spin_unlock(&tcon->tc_lock); 246 247 ses = tcon->ses; 248 if (!ses) 249 return -EIO; 250 spin_lock(&ses->ses_lock); 251 if (ses->ses_status == SES_EXITING) { 252 spin_unlock(&ses->ses_lock); 253 return -EIO; 254 } 255 spin_unlock(&ses->ses_lock); 256 if (!ses->server || !server) 257 return -EIO; 258 259 spin_lock(&server->srv_lock); 260 if (server->tcpStatus == CifsNeedReconnect) { 261 /* 262 * Return to caller for TREE_DISCONNECT and LOGOFF and CLOSE 263 * here since they are implicitly done when session drops. 264 */ 265 switch (smb2_command) { 266 /* 267 * BB Should we keep oplock break and add flush to exceptions? 268 */ 269 case SMB2_TREE_DISCONNECT: 270 case SMB2_CANCEL: 271 case SMB2_CLOSE: 272 case SMB2_OPLOCK_BREAK: 273 spin_unlock(&server->srv_lock); 274 return -EAGAIN; 275 } 276 } 277 278 /* if server is marked for termination, cifsd will cleanup */ 279 if (server->terminate) { 280 spin_unlock(&server->srv_lock); 281 return -EHOSTDOWN; 282 } 283 spin_unlock(&server->srv_lock); 284 285 again: 286 rc = cifs_wait_for_server_reconnect(server, tcon->retry); 287 if (rc) 288 return rc; 289 290 spin_lock(&ses->chan_lock); 291 if (!cifs_chan_needs_reconnect(ses, server) && !tcon->need_reconnect) { 292 spin_unlock(&ses->chan_lock); 293 return 0; 294 } 295 spin_unlock(&ses->chan_lock); 296 cifs_dbg(FYI, "sess reconnect mask: 0x%lx, tcon reconnect: %d", 297 tcon->ses->chans_need_reconnect, 298 tcon->need_reconnect); 299 300 mutex_lock(&ses->session_mutex); 301 /* 302 * if this is called by delayed work, and the channel has been disabled 303 * in parallel, the delayed work can continue to execute in parallel 304 * there's a chance that this channel may not exist anymore 305 */ 306 spin_lock(&server->srv_lock); 307 if (server->tcpStatus == CifsExiting) { 308 spin_unlock(&server->srv_lock); 309 mutex_unlock(&ses->session_mutex); 310 rc = -EHOSTDOWN; 311 goto out; 312 } 313 314 /* 315 * Recheck after acquire mutex. If another thread is negotiating 316 * and the server never sends an answer the socket will be closed 317 * and tcpStatus set to reconnect. 318 */ 319 if (server->tcpStatus == CifsNeedReconnect) { 320 spin_unlock(&server->srv_lock); 321 mutex_unlock(&ses->session_mutex); 322 323 if (tcon->retry) 324 goto again; 325 326 rc = -EHOSTDOWN; 327 goto out; 328 } 329 spin_unlock(&server->srv_lock); 330 331 nls_codepage = ses->local_nls; 332 333 /* 334 * need to prevent multiple threads trying to simultaneously 335 * reconnect the same SMB session 336 */ 337 spin_lock(&ses->ses_lock); 338 spin_lock(&ses->chan_lock); 339 if (!cifs_chan_needs_reconnect(ses, server) && 340 ses->ses_status == SES_GOOD) { 341 spin_unlock(&ses->chan_lock); 342 spin_unlock(&ses->ses_lock); 343 /* this means that we only need to tree connect */ 344 if (tcon->need_reconnect) 345 goto skip_sess_setup; 346 347 mutex_unlock(&ses->session_mutex); 348 goto out; 349 } 350 spin_unlock(&ses->chan_lock); 351 spin_unlock(&ses->ses_lock); 352 353 rc = cifs_negotiate_protocol(0, ses, server); 354 if (!rc) { 355 /* 356 * if server stopped supporting multichannel 357 * and the first channel reconnected, disable all the others. 358 */ 359 if (ses->chan_count > 1 && 360 !(server->capabilities & SMB2_GLOBAL_CAP_MULTI_CHANNEL)) { 361 rc = cifs_chan_skip_or_disable(ses, server, 362 from_reconnect); 363 if (rc) { 364 mutex_unlock(&ses->session_mutex); 365 goto out; 366 } 367 } 368 369 rc = cifs_setup_session(0, ses, server, nls_codepage); 370 if ((rc == -EACCES) && !tcon->retry) { 371 mutex_unlock(&ses->session_mutex); 372 rc = -EHOSTDOWN; 373 goto failed; 374 } else if (rc) { 375 mutex_unlock(&ses->session_mutex); 376 goto out; 377 } 378 } else { 379 mutex_unlock(&ses->session_mutex); 380 goto out; 381 } 382 383 skip_sess_setup: 384 if (!tcon->need_reconnect) { 385 mutex_unlock(&ses->session_mutex); 386 goto out; 387 } 388 cifs_mark_open_files_invalid(tcon); 389 if (tcon->use_persistent) 390 tcon->need_reopen_files = true; 391 392 rc = cifs_tree_connect(0, tcon, nls_codepage); 393 394 cifs_dbg(FYI, "reconnect tcon rc = %d\n", rc); 395 if (rc) { 396 /* If sess reconnected but tcon didn't, something strange ... */ 397 mutex_unlock(&ses->session_mutex); 398 cifs_dbg(VFS, "reconnect tcon failed rc = %d\n", rc); 399 goto out; 400 } 401 402 spin_lock(&ses->ses_lock); 403 if (ses->flags & CIFS_SES_FLAG_SCALE_CHANNELS) { 404 spin_unlock(&ses->ses_lock); 405 mutex_unlock(&ses->session_mutex); 406 goto skip_add_channels; 407 } 408 ses->flags |= CIFS_SES_FLAG_SCALE_CHANNELS; 409 spin_unlock(&ses->ses_lock); 410 411 if (!rc && 412 (server->capabilities & SMB2_GLOBAL_CAP_MULTI_CHANNEL) && 413 server->ops->query_server_interfaces) { 414 mutex_unlock(&ses->session_mutex); 415 416 /* 417 * query server network interfaces, in case they change 418 */ 419 xid = get_xid(); 420 rc = server->ops->query_server_interfaces(xid, tcon, false); 421 free_xid(xid); 422 423 if (rc == -EOPNOTSUPP && ses->chan_count > 1) { 424 /* 425 * some servers like Azure SMB server do not advertise 426 * that multichannel has been disabled with server 427 * capabilities, rather return STATUS_NOT_IMPLEMENTED. 428 * treat this as server not supporting multichannel 429 */ 430 431 rc = cifs_chan_skip_or_disable(ses, server, 432 from_reconnect); 433 goto skip_add_channels; 434 } else if (rc) 435 cifs_dbg(FYI, "%s: failed to query server interfaces: %d\n", 436 __func__, rc); 437 438 if (ses->chan_max > ses->chan_count && 439 ses->iface_count && 440 !SERVER_IS_CHAN(server)) { 441 if (ses->chan_count == 1) { 442 cifs_server_dbg(VFS, "supports multichannel now\n"); 443 queue_delayed_work(cifsiod_wq, &tcon->query_interfaces, 444 (SMB_INTERFACE_POLL_INTERVAL * HZ)); 445 } 446 447 cifs_try_adding_channels(ses); 448 } 449 } else { 450 mutex_unlock(&ses->session_mutex); 451 } 452 453 skip_add_channels: 454 spin_lock(&ses->ses_lock); 455 ses->flags &= ~CIFS_SES_FLAG_SCALE_CHANNELS; 456 spin_unlock(&ses->ses_lock); 457 458 if (smb2_command != SMB2_INTERNAL_CMD) 459 mod_delayed_work(cifsiod_wq, &server->reconnect, 0); 460 461 atomic_inc(&tconInfoReconnectCount); 462 out: 463 /* 464 * Check if handle based operation so we know whether we can continue 465 * or not without returning to caller to reset file handle. 466 */ 467 /* 468 * BB Is flush done by server on drop of tcp session? Should we special 469 * case it and skip above? 470 */ 471 switch (smb2_command) { 472 case SMB2_FLUSH: 473 case SMB2_READ: 474 case SMB2_WRITE: 475 case SMB2_LOCK: 476 case SMB2_QUERY_DIRECTORY: 477 case SMB2_CHANGE_NOTIFY: 478 case SMB2_QUERY_INFO: 479 case SMB2_SET_INFO: 480 rc = -EAGAIN; 481 } 482 failed: 483 return rc; 484 } 485 486 static void 487 fill_small_buf(__le16 smb2_command, struct cifs_tcon *tcon, 488 struct TCP_Server_Info *server, 489 void *buf, 490 unsigned int *total_len) 491 { 492 struct smb2_pdu *spdu = buf; 493 /* lookup word count ie StructureSize from table */ 494 __u16 parmsize = smb2_req_struct_sizes[le16_to_cpu(smb2_command)]; 495 496 /* 497 * smaller than SMALL_BUFFER_SIZE but bigger than fixed area of 498 * largest operations (Create) 499 */ 500 memset(buf, 0, 256); 501 502 smb2_hdr_assemble(&spdu->hdr, smb2_command, tcon, server); 503 spdu->StructureSize2 = cpu_to_le16(parmsize); 504 505 *total_len = parmsize + sizeof(struct smb2_hdr); 506 } 507 508 /* 509 * Allocate and return pointer to an SMB request hdr, and set basic 510 * SMB information in the SMB header. If the return code is zero, this 511 * function must have filled in request_buf pointer. 512 */ 513 static int __smb2_plain_req_init(__le16 smb2_command, struct cifs_tcon *tcon, 514 struct TCP_Server_Info *server, 515 void **request_buf, unsigned int *total_len) 516 { 517 /* BB eventually switch this to SMB2 specific small buf size */ 518 switch (smb2_command) { 519 case SMB2_SET_INFO: 520 case SMB2_QUERY_INFO: 521 *request_buf = cifs_buf_get(); 522 break; 523 default: 524 *request_buf = cifs_small_buf_get(); 525 break; 526 } 527 if (*request_buf == NULL) { 528 /* BB should we add a retry in here if not a writepage? */ 529 return -ENOMEM; 530 } 531 532 fill_small_buf(smb2_command, tcon, server, 533 (struct smb2_hdr *)(*request_buf), 534 total_len); 535 536 if (tcon != NULL) { 537 uint16_t com_code = le16_to_cpu(smb2_command); 538 cifs_stats_inc(&tcon->stats.smb2_stats.smb2_com_sent[com_code]); 539 cifs_stats_inc(&tcon->num_smbs_sent); 540 } 541 542 return 0; 543 } 544 545 static int smb2_plain_req_init(__le16 smb2_command, struct cifs_tcon *tcon, 546 struct TCP_Server_Info *server, 547 void **request_buf, unsigned int *total_len) 548 { 549 int rc; 550 551 rc = smb2_reconnect(smb2_command, tcon, server, false); 552 if (rc) 553 return rc; 554 555 return __smb2_plain_req_init(smb2_command, tcon, server, request_buf, 556 total_len); 557 } 558 559 static int smb2_ioctl_req_init(u32 opcode, struct cifs_tcon *tcon, 560 struct TCP_Server_Info *server, 561 void **request_buf, unsigned int *total_len) 562 { 563 /* Skip reconnect only for FSCTL_VALIDATE_NEGOTIATE_INFO IOCTLs */ 564 if (opcode == FSCTL_VALIDATE_NEGOTIATE_INFO) { 565 return __smb2_plain_req_init(SMB2_IOCTL, tcon, server, 566 request_buf, total_len); 567 } 568 return smb2_plain_req_init(SMB2_IOCTL, tcon, server, 569 request_buf, total_len); 570 } 571 572 /* For explanation of negotiate contexts see MS-SMB2 section 2.2.3.1 */ 573 574 static void 575 build_preauth_ctxt(struct smb2_preauth_neg_context *pneg_ctxt) 576 { 577 pneg_ctxt->ContextType = SMB2_PREAUTH_INTEGRITY_CAPABILITIES; 578 pneg_ctxt->DataLength = cpu_to_le16(38); 579 pneg_ctxt->HashAlgorithmCount = cpu_to_le16(1); 580 pneg_ctxt->SaltLength = cpu_to_le16(SMB311_SALT_SIZE); 581 get_random_bytes(pneg_ctxt->Salt, SMB311_SALT_SIZE); 582 pneg_ctxt->HashAlgorithms = SMB2_PREAUTH_INTEGRITY_SHA512; 583 } 584 585 static void 586 build_compression_ctxt(struct smb2_compression_capabilities_context *pneg_ctxt) 587 { 588 pneg_ctxt->ContextType = SMB2_COMPRESSION_CAPABILITIES; 589 pneg_ctxt->DataLength = 590 cpu_to_le16(sizeof(struct smb2_compression_capabilities_context) 591 - sizeof(struct smb2_neg_context)); 592 pneg_ctxt->CompressionAlgorithmCount = cpu_to_le16(3); 593 pneg_ctxt->CompressionAlgorithms[0] = SMB3_COMPRESS_LZ77; 594 pneg_ctxt->CompressionAlgorithms[1] = SMB3_COMPRESS_LZ77_HUFF; 595 pneg_ctxt->CompressionAlgorithms[2] = SMB3_COMPRESS_LZNT1; 596 } 597 598 static unsigned int 599 build_signing_ctxt(struct smb2_signing_capabilities *pneg_ctxt) 600 { 601 unsigned int ctxt_len = sizeof(struct smb2_signing_capabilities); 602 unsigned short num_algs = 1; /* number of signing algorithms sent */ 603 604 pneg_ctxt->ContextType = SMB2_SIGNING_CAPABILITIES; 605 /* 606 * Context Data length must be rounded to multiple of 8 for some servers 607 */ 608 pneg_ctxt->DataLength = cpu_to_le16(ALIGN(sizeof(struct smb2_signing_capabilities) - 609 sizeof(struct smb2_neg_context) + 610 (num_algs * sizeof(u16)), 8)); 611 pneg_ctxt->SigningAlgorithmCount = cpu_to_le16(num_algs); 612 pneg_ctxt->SigningAlgorithms[0] = cpu_to_le16(SIGNING_ALG_AES_CMAC); 613 614 ctxt_len += sizeof(__le16) * num_algs; 615 ctxt_len = ALIGN(ctxt_len, 8); 616 return ctxt_len; 617 /* TBD add SIGNING_ALG_AES_GMAC and/or SIGNING_ALG_HMAC_SHA256 */ 618 } 619 620 static void 621 build_encrypt_ctxt(struct smb2_encryption_neg_context *pneg_ctxt) 622 { 623 pneg_ctxt->ContextType = SMB2_ENCRYPTION_CAPABILITIES; 624 if (require_gcm_256) { 625 pneg_ctxt->DataLength = cpu_to_le16(4); /* Cipher Count + 1 cipher */ 626 pneg_ctxt->CipherCount = cpu_to_le16(1); 627 pneg_ctxt->Ciphers[0] = SMB2_ENCRYPTION_AES256_GCM; 628 } else if (enable_gcm_256) { 629 pneg_ctxt->DataLength = cpu_to_le16(8); /* Cipher Count + 3 ciphers */ 630 pneg_ctxt->CipherCount = cpu_to_le16(3); 631 pneg_ctxt->Ciphers[0] = SMB2_ENCRYPTION_AES128_GCM; 632 pneg_ctxt->Ciphers[1] = SMB2_ENCRYPTION_AES256_GCM; 633 pneg_ctxt->Ciphers[2] = SMB2_ENCRYPTION_AES128_CCM; 634 } else { 635 pneg_ctxt->DataLength = cpu_to_le16(6); /* Cipher Count + 2 ciphers */ 636 pneg_ctxt->CipherCount = cpu_to_le16(2); 637 pneg_ctxt->Ciphers[0] = SMB2_ENCRYPTION_AES128_GCM; 638 pneg_ctxt->Ciphers[1] = SMB2_ENCRYPTION_AES128_CCM; 639 } 640 } 641 642 static unsigned int 643 build_netname_ctxt(struct smb2_netname_neg_context *pneg_ctxt, char *hostname) 644 { 645 struct nls_table *cp = load_nls_default(); 646 647 pneg_ctxt->ContextType = SMB2_NETNAME_NEGOTIATE_CONTEXT_ID; 648 649 /* copy up to max of first 100 bytes of server name to NetName field */ 650 pneg_ctxt->DataLength = cpu_to_le16(2 * cifs_strtoUTF16(pneg_ctxt->NetName, hostname, 100, cp)); 651 /* context size is DataLength + minimal smb2_neg_context */ 652 return ALIGN(le16_to_cpu(pneg_ctxt->DataLength) + sizeof(struct smb2_neg_context), 8); 653 } 654 655 static void 656 build_posix_ctxt(struct smb2_posix_neg_context *pneg_ctxt) 657 { 658 pneg_ctxt->ContextType = SMB2_POSIX_EXTENSIONS_AVAILABLE; 659 pneg_ctxt->DataLength = cpu_to_le16(POSIX_CTXT_DATA_LEN); 660 /* SMB2_CREATE_TAG_POSIX is "0x93AD25509CB411E7B42383DE968BCD7C" */ 661 pneg_ctxt->Name[0] = 0x93; 662 pneg_ctxt->Name[1] = 0xAD; 663 pneg_ctxt->Name[2] = 0x25; 664 pneg_ctxt->Name[3] = 0x50; 665 pneg_ctxt->Name[4] = 0x9C; 666 pneg_ctxt->Name[5] = 0xB4; 667 pneg_ctxt->Name[6] = 0x11; 668 pneg_ctxt->Name[7] = 0xE7; 669 pneg_ctxt->Name[8] = 0xB4; 670 pneg_ctxt->Name[9] = 0x23; 671 pneg_ctxt->Name[10] = 0x83; 672 pneg_ctxt->Name[11] = 0xDE; 673 pneg_ctxt->Name[12] = 0x96; 674 pneg_ctxt->Name[13] = 0x8B; 675 pneg_ctxt->Name[14] = 0xCD; 676 pneg_ctxt->Name[15] = 0x7C; 677 } 678 679 static void 680 assemble_neg_contexts(struct smb2_negotiate_req *req, 681 struct TCP_Server_Info *server, unsigned int *total_len) 682 { 683 unsigned int ctxt_len, neg_context_count; 684 struct TCP_Server_Info *pserver; 685 char *pneg_ctxt; 686 char *hostname; 687 688 if (*total_len > 200) { 689 /* In case length corrupted don't want to overrun smb buffer */ 690 cifs_server_dbg(VFS, "Bad frame length assembling neg contexts\n"); 691 return; 692 } 693 694 /* 695 * round up total_len of fixed part of SMB3 negotiate request to 8 696 * byte boundary before adding negotiate contexts 697 */ 698 *total_len = ALIGN(*total_len, 8); 699 700 pneg_ctxt = (*total_len) + (char *)req; 701 req->NegotiateContextOffset = cpu_to_le32(*total_len); 702 703 build_preauth_ctxt((struct smb2_preauth_neg_context *)pneg_ctxt); 704 ctxt_len = ALIGN(sizeof(struct smb2_preauth_neg_context), 8); 705 *total_len += ctxt_len; 706 pneg_ctxt += ctxt_len; 707 708 build_encrypt_ctxt((struct smb2_encryption_neg_context *)pneg_ctxt); 709 ctxt_len = ALIGN(sizeof(struct smb2_encryption_neg_context), 8); 710 *total_len += ctxt_len; 711 pneg_ctxt += ctxt_len; 712 713 /* 714 * secondary channels don't have the hostname field populated 715 * use the hostname field in the primary channel instead 716 */ 717 pserver = SERVER_IS_CHAN(server) ? server->primary_server : server; 718 cifs_server_lock(pserver); 719 hostname = pserver->hostname; 720 if (hostname && (hostname[0] != 0)) { 721 ctxt_len = build_netname_ctxt((struct smb2_netname_neg_context *)pneg_ctxt, 722 hostname); 723 *total_len += ctxt_len; 724 pneg_ctxt += ctxt_len; 725 neg_context_count = 3; 726 } else 727 neg_context_count = 2; 728 cifs_server_unlock(pserver); 729 730 build_posix_ctxt((struct smb2_posix_neg_context *)pneg_ctxt); 731 *total_len += sizeof(struct smb2_posix_neg_context); 732 pneg_ctxt += sizeof(struct smb2_posix_neg_context); 733 neg_context_count++; 734 735 if (server->compression.requested) { 736 build_compression_ctxt((struct smb2_compression_capabilities_context *) 737 pneg_ctxt); 738 ctxt_len = ALIGN(sizeof(struct smb2_compression_capabilities_context), 8); 739 *total_len += ctxt_len; 740 pneg_ctxt += ctxt_len; 741 neg_context_count++; 742 } 743 744 if (enable_negotiate_signing) { 745 ctxt_len = build_signing_ctxt((struct smb2_signing_capabilities *) 746 pneg_ctxt); 747 *total_len += ctxt_len; 748 pneg_ctxt += ctxt_len; 749 neg_context_count++; 750 } 751 752 /* check for and add transport_capabilities and signing capabilities */ 753 req->NegotiateContextCount = cpu_to_le16(neg_context_count); 754 755 } 756 757 /* If invalid preauth context warn but use what we requested, SHA-512 */ 758 static void decode_preauth_context(struct smb2_preauth_neg_context *ctxt) 759 { 760 unsigned int len = le16_to_cpu(ctxt->DataLength); 761 762 /* 763 * Caller checked that DataLength remains within SMB boundary. We still 764 * need to confirm that one HashAlgorithms member is accounted for. 765 */ 766 if (len < MIN_PREAUTH_CTXT_DATA_LEN) { 767 pr_warn_once("server sent bad preauth context\n"); 768 return; 769 } else if (len < MIN_PREAUTH_CTXT_DATA_LEN + le16_to_cpu(ctxt->SaltLength)) { 770 pr_warn_once("server sent invalid SaltLength\n"); 771 return; 772 } 773 if (le16_to_cpu(ctxt->HashAlgorithmCount) != 1) 774 pr_warn_once("Invalid SMB3 hash algorithm count\n"); 775 if (ctxt->HashAlgorithms != SMB2_PREAUTH_INTEGRITY_SHA512) 776 pr_warn_once("unknown SMB3 hash algorithm\n"); 777 } 778 779 static void decode_compress_ctx(struct TCP_Server_Info *server, 780 struct smb2_compression_capabilities_context *ctxt) 781 { 782 unsigned int len = le16_to_cpu(ctxt->DataLength); 783 __le16 alg; 784 785 server->compression.enabled = false; 786 787 /* 788 * Caller checked that DataLength remains within SMB boundary. We still 789 * need to confirm that one CompressionAlgorithms member is accounted 790 * for. 791 */ 792 if (len < 10) { 793 pr_warn_once("server sent bad compression cntxt\n"); 794 return; 795 } 796 797 if (le16_to_cpu(ctxt->CompressionAlgorithmCount) != 1) { 798 pr_warn_once("invalid SMB3 compress algorithm count\n"); 799 return; 800 } 801 802 alg = ctxt->CompressionAlgorithms[0]; 803 804 /* 'NONE' (0) compressor type is never negotiated */ 805 if (alg == 0 || le16_to_cpu(alg) > 3) { 806 pr_warn_once("invalid compression algorithm '%u'\n", alg); 807 return; 808 } 809 810 server->compression.alg = alg; 811 server->compression.enabled = true; 812 } 813 814 static int decode_encrypt_ctx(struct TCP_Server_Info *server, 815 struct smb2_encryption_neg_context *ctxt) 816 { 817 unsigned int len = le16_to_cpu(ctxt->DataLength); 818 819 cifs_dbg(FYI, "decode SMB3.11 encryption neg context of len %d\n", len); 820 /* 821 * Caller checked that DataLength remains within SMB boundary. We still 822 * need to confirm that one Cipher flexible array member is accounted 823 * for. 824 */ 825 if (len < MIN_ENCRYPT_CTXT_DATA_LEN) { 826 pr_warn_once("server sent bad crypto ctxt len\n"); 827 return -EINVAL; 828 } 829 830 if (le16_to_cpu(ctxt->CipherCount) != 1) { 831 pr_warn_once("Invalid SMB3.11 cipher count\n"); 832 return -EINVAL; 833 } 834 cifs_dbg(FYI, "SMB311 cipher type:%d\n", le16_to_cpu(ctxt->Ciphers[0])); 835 if (require_gcm_256) { 836 if (ctxt->Ciphers[0] != SMB2_ENCRYPTION_AES256_GCM) { 837 cifs_dbg(VFS, "Server does not support requested encryption type (AES256 GCM)\n"); 838 return -EOPNOTSUPP; 839 } 840 } else if (ctxt->Ciphers[0] == 0) { 841 /* 842 * e.g. if server only supported AES256_CCM (very unlikely) 843 * or server supported no encryption types or had all disabled. 844 * Since GLOBAL_CAP_ENCRYPTION will be not set, in the case 845 * in which mount requested encryption ("seal") checks later 846 * on during tree connection will return proper rc, but if 847 * seal not requested by client, since server is allowed to 848 * return 0 to indicate no supported cipher, we can't fail here 849 */ 850 server->cipher_type = 0; 851 server->capabilities &= ~SMB2_GLOBAL_CAP_ENCRYPTION; 852 pr_warn_once("Server does not support requested encryption types\n"); 853 return 0; 854 } else if ((ctxt->Ciphers[0] != SMB2_ENCRYPTION_AES128_CCM) && 855 (ctxt->Ciphers[0] != SMB2_ENCRYPTION_AES128_GCM) && 856 (ctxt->Ciphers[0] != SMB2_ENCRYPTION_AES256_GCM)) { 857 /* server returned a cipher we didn't ask for */ 858 pr_warn_once("Invalid SMB3.11 cipher returned\n"); 859 return -EINVAL; 860 } 861 server->cipher_type = ctxt->Ciphers[0]; 862 server->capabilities |= SMB2_GLOBAL_CAP_ENCRYPTION; 863 return 0; 864 } 865 866 static void decode_signing_ctx(struct TCP_Server_Info *server, 867 struct smb2_signing_capabilities *pctxt) 868 { 869 unsigned int len = le16_to_cpu(pctxt->DataLength); 870 871 /* 872 * Caller checked that DataLength remains within SMB boundary. We still 873 * need to confirm that one SigningAlgorithms flexible array member is 874 * accounted for. 875 */ 876 if ((len < 4) || (len > 16)) { 877 pr_warn_once("server sent bad signing negcontext\n"); 878 return; 879 } 880 if (le16_to_cpu(pctxt->SigningAlgorithmCount) != 1) { 881 pr_warn_once("Invalid signing algorithm count\n"); 882 return; 883 } 884 if (le16_to_cpu(pctxt->SigningAlgorithms[0]) > 2) { 885 pr_warn_once("unknown signing algorithm\n"); 886 return; 887 } 888 889 server->signing_negotiated = true; 890 server->signing_algorithm = le16_to_cpu(pctxt->SigningAlgorithms[0]); 891 cifs_dbg(FYI, "signing algorithm %d chosen\n", 892 server->signing_algorithm); 893 } 894 895 896 static int smb311_decode_neg_context(struct smb2_negotiate_rsp *rsp, 897 struct TCP_Server_Info *server, 898 unsigned int len_of_smb) 899 { 900 struct smb2_neg_context *pctx; 901 unsigned int offset = le32_to_cpu(rsp->NegotiateContextOffset); 902 unsigned int ctxt_cnt = le16_to_cpu(rsp->NegotiateContextCount); 903 unsigned int len_of_ctxts, i; 904 int rc = 0; 905 906 cifs_dbg(FYI, "decoding %d negotiate contexts\n", ctxt_cnt); 907 if (len_of_smb <= offset) { 908 cifs_server_dbg(VFS, "Invalid response: negotiate context offset\n"); 909 return -EINVAL; 910 } 911 912 len_of_ctxts = len_of_smb - offset; 913 914 for (i = 0; i < ctxt_cnt; i++) { 915 int clen; 916 /* check that offset is not beyond end of SMB */ 917 if (len_of_ctxts < sizeof(struct smb2_neg_context)) 918 break; 919 920 pctx = (struct smb2_neg_context *)(offset + (char *)rsp); 921 clen = sizeof(struct smb2_neg_context) 922 + le16_to_cpu(pctx->DataLength); 923 /* 924 * 2.2.4 SMB2 NEGOTIATE Response 925 * Subsequent negotiate contexts MUST appear at the first 8-byte 926 * aligned offset following the previous negotiate context. 927 */ 928 if (i + 1 != ctxt_cnt) 929 clen = ALIGN(clen, 8); 930 if (clen > len_of_ctxts) 931 break; 932 933 if (pctx->ContextType == SMB2_PREAUTH_INTEGRITY_CAPABILITIES) 934 decode_preauth_context( 935 (struct smb2_preauth_neg_context *)pctx); 936 else if (pctx->ContextType == SMB2_ENCRYPTION_CAPABILITIES) 937 rc = decode_encrypt_ctx(server, 938 (struct smb2_encryption_neg_context *)pctx); 939 else if (pctx->ContextType == SMB2_COMPRESSION_CAPABILITIES) 940 decode_compress_ctx(server, 941 (struct smb2_compression_capabilities_context *)pctx); 942 else if (pctx->ContextType == SMB2_POSIX_EXTENSIONS_AVAILABLE) 943 server->posix_ext_supported = true; 944 else if (pctx->ContextType == SMB2_SIGNING_CAPABILITIES) 945 decode_signing_ctx(server, 946 (struct smb2_signing_capabilities *)pctx); 947 else 948 cifs_server_dbg(VFS, "unknown negcontext of type %d ignored\n", 949 le16_to_cpu(pctx->ContextType)); 950 if (rc) 951 break; 952 953 offset += clen; 954 len_of_ctxts -= clen; 955 } 956 return rc; 957 } 958 959 static struct create_posix * 960 create_posix_buf(umode_t mode) 961 { 962 struct create_posix *buf; 963 964 buf = kzalloc(sizeof(struct create_posix), 965 GFP_KERNEL); 966 if (!buf) 967 return NULL; 968 969 buf->ccontext.DataOffset = 970 cpu_to_le16(offsetof(struct create_posix, Mode)); 971 buf->ccontext.DataLength = cpu_to_le32(4); 972 buf->ccontext.NameOffset = 973 cpu_to_le16(offsetof(struct create_posix, Name)); 974 buf->ccontext.NameLength = cpu_to_le16(16); 975 976 /* SMB2_CREATE_TAG_POSIX is "0x93AD25509CB411E7B42383DE968BCD7C" */ 977 buf->Name[0] = 0x93; 978 buf->Name[1] = 0xAD; 979 buf->Name[2] = 0x25; 980 buf->Name[3] = 0x50; 981 buf->Name[4] = 0x9C; 982 buf->Name[5] = 0xB4; 983 buf->Name[6] = 0x11; 984 buf->Name[7] = 0xE7; 985 buf->Name[8] = 0xB4; 986 buf->Name[9] = 0x23; 987 buf->Name[10] = 0x83; 988 buf->Name[11] = 0xDE; 989 buf->Name[12] = 0x96; 990 buf->Name[13] = 0x8B; 991 buf->Name[14] = 0xCD; 992 buf->Name[15] = 0x7C; 993 buf->Mode = cpu_to_le32(mode); 994 cifs_dbg(FYI, "mode on posix create 0%o\n", mode); 995 return buf; 996 } 997 998 static int 999 add_posix_context(struct kvec *iov, unsigned int *num_iovec, umode_t mode) 1000 { 1001 unsigned int num = *num_iovec; 1002 1003 iov[num].iov_base = create_posix_buf(mode); 1004 if (mode == ACL_NO_MODE) 1005 cifs_dbg(FYI, "%s: no mode\n", __func__); 1006 if (iov[num].iov_base == NULL) 1007 return -ENOMEM; 1008 iov[num].iov_len = sizeof(struct create_posix); 1009 *num_iovec = num + 1; 1010 return 0; 1011 } 1012 1013 1014 /* 1015 * 1016 * SMB2 Worker functions follow: 1017 * 1018 * The general structure of the worker functions is: 1019 * 1) Call smb2_init (assembles SMB2 header) 1020 * 2) Initialize SMB2 command specific fields in fixed length area of SMB 1021 * 3) Call smb_sendrcv2 (sends request on socket and waits for response) 1022 * 4) Decode SMB2 command specific fields in the fixed length area 1023 * 5) Decode variable length data area (if any for this SMB2 command type) 1024 * 6) Call free smb buffer 1025 * 7) return 1026 * 1027 */ 1028 1029 int 1030 SMB2_negotiate(const unsigned int xid, 1031 struct cifs_ses *ses, 1032 struct TCP_Server_Info *server) 1033 { 1034 struct smb_rqst rqst; 1035 struct smb2_negotiate_req *req; 1036 struct smb2_negotiate_rsp *rsp; 1037 struct kvec iov[1]; 1038 struct kvec rsp_iov; 1039 int rc; 1040 int resp_buftype; 1041 int blob_offset, blob_length; 1042 char *security_blob; 1043 int flags = CIFS_NEG_OP; 1044 unsigned int total_len; 1045 1046 cifs_dbg(FYI, "Negotiate protocol\n"); 1047 1048 if (!server) { 1049 WARN(1, "%s: server is NULL!\n", __func__); 1050 return -EIO; 1051 } 1052 1053 rc = smb2_plain_req_init(SMB2_NEGOTIATE, NULL, server, 1054 (void **) &req, &total_len); 1055 if (rc) 1056 return rc; 1057 1058 req->hdr.SessionId = 0; 1059 1060 memset(server->preauth_sha_hash, 0, SMB2_PREAUTH_HASH_SIZE); 1061 memset(ses->preauth_sha_hash, 0, SMB2_PREAUTH_HASH_SIZE); 1062 1063 if (strcmp(server->vals->version_string, 1064 SMB3ANY_VERSION_STRING) == 0) { 1065 req->Dialects[0] = cpu_to_le16(SMB30_PROT_ID); 1066 req->Dialects[1] = cpu_to_le16(SMB302_PROT_ID); 1067 req->Dialects[2] = cpu_to_le16(SMB311_PROT_ID); 1068 req->DialectCount = cpu_to_le16(3); 1069 total_len += 6; 1070 } else if (strcmp(server->vals->version_string, 1071 SMBDEFAULT_VERSION_STRING) == 0) { 1072 req->Dialects[0] = cpu_to_le16(SMB21_PROT_ID); 1073 req->Dialects[1] = cpu_to_le16(SMB30_PROT_ID); 1074 req->Dialects[2] = cpu_to_le16(SMB302_PROT_ID); 1075 req->Dialects[3] = cpu_to_le16(SMB311_PROT_ID); 1076 req->DialectCount = cpu_to_le16(4); 1077 total_len += 8; 1078 } else { 1079 /* otherwise send specific dialect */ 1080 req->Dialects[0] = cpu_to_le16(server->vals->protocol_id); 1081 req->DialectCount = cpu_to_le16(1); 1082 total_len += 2; 1083 } 1084 1085 /* only one of SMB2 signing flags may be set in SMB2 request */ 1086 if (ses->sign) 1087 req->SecurityMode = cpu_to_le16(SMB2_NEGOTIATE_SIGNING_REQUIRED); 1088 else if (global_secflags & CIFSSEC_MAY_SIGN) 1089 req->SecurityMode = cpu_to_le16(SMB2_NEGOTIATE_SIGNING_ENABLED); 1090 else 1091 req->SecurityMode = 0; 1092 1093 req->Capabilities = cpu_to_le32(server->vals->req_capabilities); 1094 if (ses->chan_max > 1) 1095 req->Capabilities |= cpu_to_le32(SMB2_GLOBAL_CAP_MULTI_CHANNEL); 1096 1097 /* ClientGUID must be zero for SMB2.02 dialect */ 1098 if (server->vals->protocol_id == SMB20_PROT_ID) 1099 memset(req->ClientGUID, 0, SMB2_CLIENT_GUID_SIZE); 1100 else { 1101 memcpy(req->ClientGUID, server->client_guid, 1102 SMB2_CLIENT_GUID_SIZE); 1103 if ((server->vals->protocol_id == SMB311_PROT_ID) || 1104 (strcmp(server->vals->version_string, 1105 SMB3ANY_VERSION_STRING) == 0) || 1106 (strcmp(server->vals->version_string, 1107 SMBDEFAULT_VERSION_STRING) == 0)) 1108 assemble_neg_contexts(req, server, &total_len); 1109 } 1110 iov[0].iov_base = (char *)req; 1111 iov[0].iov_len = total_len; 1112 1113 memset(&rqst, 0, sizeof(struct smb_rqst)); 1114 rqst.rq_iov = iov; 1115 rqst.rq_nvec = 1; 1116 1117 rc = cifs_send_recv(xid, ses, server, 1118 &rqst, &resp_buftype, flags, &rsp_iov); 1119 cifs_small_buf_release(req); 1120 rsp = (struct smb2_negotiate_rsp *)rsp_iov.iov_base; 1121 /* 1122 * No tcon so can't do 1123 * cifs_stats_inc(&tcon->stats.smb2_stats.smb2_com_fail[SMB2...]); 1124 */ 1125 if (rc == -EOPNOTSUPP) { 1126 cifs_server_dbg(VFS, "Dialect not supported by server. Consider specifying vers=1.0 or vers=2.0 on mount for accessing older servers\n"); 1127 goto neg_exit; 1128 } else if (rc != 0) 1129 goto neg_exit; 1130 1131 rc = -EIO; 1132 if (strcmp(server->vals->version_string, 1133 SMB3ANY_VERSION_STRING) == 0) { 1134 if (rsp->DialectRevision == cpu_to_le16(SMB20_PROT_ID)) { 1135 cifs_server_dbg(VFS, 1136 "SMB2 dialect returned but not requested\n"); 1137 goto neg_exit; 1138 } else if (rsp->DialectRevision == cpu_to_le16(SMB21_PROT_ID)) { 1139 cifs_server_dbg(VFS, 1140 "SMB2.1 dialect returned but not requested\n"); 1141 goto neg_exit; 1142 } else if (rsp->DialectRevision == cpu_to_le16(SMB311_PROT_ID)) { 1143 /* ops set to 3.0 by default for default so update */ 1144 server->ops = &smb311_operations; 1145 server->vals = &smb311_values; 1146 } 1147 } else if (strcmp(server->vals->version_string, 1148 SMBDEFAULT_VERSION_STRING) == 0) { 1149 if (rsp->DialectRevision == cpu_to_le16(SMB20_PROT_ID)) { 1150 cifs_server_dbg(VFS, 1151 "SMB2 dialect returned but not requested\n"); 1152 goto neg_exit; 1153 } else if (rsp->DialectRevision == cpu_to_le16(SMB21_PROT_ID)) { 1154 /* ops set to 3.0 by default for default so update */ 1155 server->ops = &smb21_operations; 1156 server->vals = &smb21_values; 1157 } else if (rsp->DialectRevision == cpu_to_le16(SMB311_PROT_ID)) { 1158 server->ops = &smb311_operations; 1159 server->vals = &smb311_values; 1160 } 1161 } else if (le16_to_cpu(rsp->DialectRevision) != 1162 server->vals->protocol_id) { 1163 /* if requested single dialect ensure returned dialect matched */ 1164 cifs_server_dbg(VFS, "Invalid 0x%x dialect returned: not requested\n", 1165 le16_to_cpu(rsp->DialectRevision)); 1166 goto neg_exit; 1167 } 1168 1169 cifs_dbg(FYI, "mode 0x%x\n", rsp->SecurityMode); 1170 1171 if (rsp->DialectRevision == cpu_to_le16(SMB20_PROT_ID)) 1172 cifs_dbg(FYI, "negotiated smb2.0 dialect\n"); 1173 else if (rsp->DialectRevision == cpu_to_le16(SMB21_PROT_ID)) 1174 cifs_dbg(FYI, "negotiated smb2.1 dialect\n"); 1175 else if (rsp->DialectRevision == cpu_to_le16(SMB30_PROT_ID)) 1176 cifs_dbg(FYI, "negotiated smb3.0 dialect\n"); 1177 else if (rsp->DialectRevision == cpu_to_le16(SMB302_PROT_ID)) 1178 cifs_dbg(FYI, "negotiated smb3.02 dialect\n"); 1179 else if (rsp->DialectRevision == cpu_to_le16(SMB311_PROT_ID)) 1180 cifs_dbg(FYI, "negotiated smb3.1.1 dialect\n"); 1181 else { 1182 cifs_server_dbg(VFS, "Invalid dialect returned by server 0x%x\n", 1183 le16_to_cpu(rsp->DialectRevision)); 1184 goto neg_exit; 1185 } 1186 1187 rc = 0; 1188 server->dialect = le16_to_cpu(rsp->DialectRevision); 1189 1190 /* 1191 * Keep a copy of the hash after negprot. This hash will be 1192 * the starting hash value for all sessions made from this 1193 * server. 1194 */ 1195 memcpy(server->preauth_sha_hash, ses->preauth_sha_hash, 1196 SMB2_PREAUTH_HASH_SIZE); 1197 1198 /* SMB2 only has an extended negflavor */ 1199 server->negflavor = CIFS_NEGFLAVOR_EXTENDED; 1200 /* set it to the maximum buffer size value we can send with 1 credit */ 1201 server->maxBuf = min_t(unsigned int, le32_to_cpu(rsp->MaxTransactSize), 1202 SMB2_MAX_BUFFER_SIZE); 1203 server->max_read = le32_to_cpu(rsp->MaxReadSize); 1204 server->max_write = le32_to_cpu(rsp->MaxWriteSize); 1205 server->sec_mode = le16_to_cpu(rsp->SecurityMode); 1206 if ((server->sec_mode & SMB2_SEC_MODE_FLAGS_ALL) != server->sec_mode) 1207 cifs_dbg(FYI, "Server returned unexpected security mode 0x%x\n", 1208 server->sec_mode); 1209 server->capabilities = le32_to_cpu(rsp->Capabilities); 1210 /* Internal types */ 1211 server->capabilities |= SMB2_NT_FIND | SMB2_LARGE_FILES; 1212 1213 /* 1214 * SMB3.0 supports only 1 cipher and doesn't have a encryption neg context 1215 * Set the cipher type manually. 1216 */ 1217 if (server->dialect == SMB30_PROT_ID && (server->capabilities & SMB2_GLOBAL_CAP_ENCRYPTION)) 1218 server->cipher_type = SMB2_ENCRYPTION_AES128_CCM; 1219 1220 security_blob = smb2_get_data_area_len(&blob_offset, &blob_length, 1221 (struct smb2_hdr *)rsp); 1222 /* 1223 * See MS-SMB2 section 2.2.4: if no blob, client picks default which 1224 * for us will be 1225 * ses->sectype = RawNTLMSSP; 1226 * but for time being this is our only auth choice so doesn't matter. 1227 * We just found a server which sets blob length to zero expecting raw. 1228 */ 1229 if (blob_length == 0) { 1230 cifs_dbg(FYI, "missing security blob on negprot\n"); 1231 server->sec_ntlmssp = true; 1232 } 1233 1234 rc = cifs_enable_signing(server, ses->sign); 1235 if (rc) 1236 goto neg_exit; 1237 if (blob_length) { 1238 rc = decode_negTokenInit(security_blob, blob_length, server); 1239 if (rc == 1) 1240 rc = 0; 1241 else if (rc == 0) 1242 rc = -EIO; 1243 } 1244 1245 if (rsp->DialectRevision == cpu_to_le16(SMB311_PROT_ID)) { 1246 if (rsp->NegotiateContextCount) 1247 rc = smb311_decode_neg_context(rsp, server, 1248 rsp_iov.iov_len); 1249 else 1250 cifs_server_dbg(VFS, "Missing expected negotiate contexts\n"); 1251 } 1252 neg_exit: 1253 free_rsp_buf(resp_buftype, rsp); 1254 return rc; 1255 } 1256 1257 int smb3_validate_negotiate(const unsigned int xid, struct cifs_tcon *tcon) 1258 { 1259 int rc; 1260 struct validate_negotiate_info_req *pneg_inbuf; 1261 struct validate_negotiate_info_rsp *pneg_rsp = NULL; 1262 u32 rsplen; 1263 u32 inbuflen; /* max of 4 dialects */ 1264 struct TCP_Server_Info *server = tcon->ses->server; 1265 1266 cifs_dbg(FYI, "validate negotiate\n"); 1267 1268 /* In SMB3.11 preauth integrity supersedes validate negotiate */ 1269 if (server->dialect == SMB311_PROT_ID) 1270 return 0; 1271 1272 /* 1273 * validation ioctl must be signed, so no point sending this if we 1274 * can not sign it (ie are not known user). Even if signing is not 1275 * required (enabled but not negotiated), in those cases we selectively 1276 * sign just this, the first and only signed request on a connection. 1277 * Having validation of negotiate info helps reduce attack vectors. 1278 */ 1279 if (tcon->ses->session_flags & SMB2_SESSION_FLAG_IS_GUEST) 1280 return 0; /* validation requires signing */ 1281 1282 if (tcon->ses->user_name == NULL) { 1283 cifs_dbg(FYI, "Can't validate negotiate: null user mount\n"); 1284 return 0; /* validation requires signing */ 1285 } 1286 1287 if (tcon->ses->session_flags & SMB2_SESSION_FLAG_IS_NULL) 1288 cifs_tcon_dbg(VFS, "Unexpected null user (anonymous) auth flag sent by server\n"); 1289 1290 pneg_inbuf = kmalloc(sizeof(*pneg_inbuf), GFP_NOFS); 1291 if (!pneg_inbuf) 1292 return -ENOMEM; 1293 1294 pneg_inbuf->Capabilities = 1295 cpu_to_le32(server->vals->req_capabilities); 1296 if (tcon->ses->chan_max > 1) 1297 pneg_inbuf->Capabilities |= cpu_to_le32(SMB2_GLOBAL_CAP_MULTI_CHANNEL); 1298 1299 memcpy(pneg_inbuf->Guid, server->client_guid, 1300 SMB2_CLIENT_GUID_SIZE); 1301 1302 if (tcon->ses->sign) 1303 pneg_inbuf->SecurityMode = 1304 cpu_to_le16(SMB2_NEGOTIATE_SIGNING_REQUIRED); 1305 else if (global_secflags & CIFSSEC_MAY_SIGN) 1306 pneg_inbuf->SecurityMode = 1307 cpu_to_le16(SMB2_NEGOTIATE_SIGNING_ENABLED); 1308 else 1309 pneg_inbuf->SecurityMode = 0; 1310 1311 1312 if (strcmp(server->vals->version_string, 1313 SMB3ANY_VERSION_STRING) == 0) { 1314 pneg_inbuf->Dialects[0] = cpu_to_le16(SMB30_PROT_ID); 1315 pneg_inbuf->Dialects[1] = cpu_to_le16(SMB302_PROT_ID); 1316 pneg_inbuf->Dialects[2] = cpu_to_le16(SMB311_PROT_ID); 1317 pneg_inbuf->DialectCount = cpu_to_le16(3); 1318 /* SMB 2.1 not included so subtract one dialect from len */ 1319 inbuflen = sizeof(*pneg_inbuf) - 1320 (sizeof(pneg_inbuf->Dialects[0])); 1321 } else if (strcmp(server->vals->version_string, 1322 SMBDEFAULT_VERSION_STRING) == 0) { 1323 pneg_inbuf->Dialects[0] = cpu_to_le16(SMB21_PROT_ID); 1324 pneg_inbuf->Dialects[1] = cpu_to_le16(SMB30_PROT_ID); 1325 pneg_inbuf->Dialects[2] = cpu_to_le16(SMB302_PROT_ID); 1326 pneg_inbuf->Dialects[3] = cpu_to_le16(SMB311_PROT_ID); 1327 pneg_inbuf->DialectCount = cpu_to_le16(4); 1328 /* structure is big enough for 4 dialects */ 1329 inbuflen = sizeof(*pneg_inbuf); 1330 } else { 1331 /* otherwise specific dialect was requested */ 1332 pneg_inbuf->Dialects[0] = 1333 cpu_to_le16(server->vals->protocol_id); 1334 pneg_inbuf->DialectCount = cpu_to_le16(1); 1335 /* structure is big enough for 4 dialects, sending only 1 */ 1336 inbuflen = sizeof(*pneg_inbuf) - 1337 sizeof(pneg_inbuf->Dialects[0]) * 3; 1338 } 1339 1340 rc = SMB2_ioctl(xid, tcon, NO_FILE_ID, NO_FILE_ID, 1341 FSCTL_VALIDATE_NEGOTIATE_INFO, 1342 (char *)pneg_inbuf, inbuflen, CIFSMaxBufSize, 1343 (char **)&pneg_rsp, &rsplen); 1344 if (rc == -EOPNOTSUPP) { 1345 /* 1346 * Old Windows versions or Netapp SMB server can return 1347 * not supported error. Client should accept it. 1348 */ 1349 cifs_tcon_dbg(VFS, "Server does not support validate negotiate\n"); 1350 rc = 0; 1351 goto out_free_inbuf; 1352 } else if (rc != 0) { 1353 cifs_tcon_dbg(VFS, "validate protocol negotiate failed: %d\n", 1354 rc); 1355 rc = -EIO; 1356 goto out_free_inbuf; 1357 } 1358 1359 rc = -EIO; 1360 if (rsplen != sizeof(*pneg_rsp)) { 1361 cifs_tcon_dbg(VFS, "Invalid protocol negotiate response size: %d\n", 1362 rsplen); 1363 1364 /* relax check since Mac returns max bufsize allowed on ioctl */ 1365 if (rsplen > CIFSMaxBufSize || rsplen < sizeof(*pneg_rsp)) 1366 goto out_free_rsp; 1367 } 1368 1369 /* check validate negotiate info response matches what we got earlier */ 1370 if (pneg_rsp->Dialect != cpu_to_le16(server->dialect)) 1371 goto vneg_out; 1372 1373 if (pneg_rsp->SecurityMode != cpu_to_le16(server->sec_mode)) 1374 goto vneg_out; 1375 1376 /* do not validate server guid because not saved at negprot time yet */ 1377 1378 if ((le32_to_cpu(pneg_rsp->Capabilities) | SMB2_NT_FIND | 1379 SMB2_LARGE_FILES) != server->capabilities) 1380 goto vneg_out; 1381 1382 /* validate negotiate successful */ 1383 rc = 0; 1384 cifs_dbg(FYI, "validate negotiate info successful\n"); 1385 goto out_free_rsp; 1386 1387 vneg_out: 1388 cifs_tcon_dbg(VFS, "protocol revalidation - security settings mismatch\n"); 1389 out_free_rsp: 1390 kfree(pneg_rsp); 1391 out_free_inbuf: 1392 kfree(pneg_inbuf); 1393 return rc; 1394 } 1395 1396 enum securityEnum 1397 smb2_select_sectype(struct TCP_Server_Info *server, enum securityEnum requested) 1398 { 1399 switch (requested) { 1400 case Kerberos: 1401 case RawNTLMSSP: 1402 return requested; 1403 case NTLMv2: 1404 return RawNTLMSSP; 1405 case Unspecified: 1406 if (server->sec_ntlmssp && 1407 (global_secflags & CIFSSEC_MAY_NTLMSSP)) 1408 return RawNTLMSSP; 1409 if ((server->sec_kerberos || server->sec_mskerberos) && 1410 (global_secflags & CIFSSEC_MAY_KRB5)) 1411 return Kerberos; 1412 fallthrough; 1413 default: 1414 return Unspecified; 1415 } 1416 } 1417 1418 struct SMB2_sess_data { 1419 unsigned int xid; 1420 struct cifs_ses *ses; 1421 struct TCP_Server_Info *server; 1422 struct nls_table *nls_cp; 1423 void (*func)(struct SMB2_sess_data *); 1424 int result; 1425 u64 previous_session; 1426 1427 /* we will send the SMB in three pieces: 1428 * a fixed length beginning part, an optional 1429 * SPNEGO blob (which can be zero length), and a 1430 * last part which will include the strings 1431 * and rest of bcc area. This allows us to avoid 1432 * a large buffer 17K allocation 1433 */ 1434 int buf0_type; 1435 struct kvec iov[2]; 1436 }; 1437 1438 static int 1439 SMB2_sess_alloc_buffer(struct SMB2_sess_data *sess_data) 1440 { 1441 int rc; 1442 struct cifs_ses *ses = sess_data->ses; 1443 struct TCP_Server_Info *server = sess_data->server; 1444 struct smb2_sess_setup_req *req; 1445 unsigned int total_len; 1446 bool is_binding = false; 1447 1448 rc = smb2_plain_req_init(SMB2_SESSION_SETUP, NULL, server, 1449 (void **) &req, 1450 &total_len); 1451 if (rc) 1452 return rc; 1453 1454 spin_lock(&ses->ses_lock); 1455 is_binding = (ses->ses_status == SES_GOOD); 1456 spin_unlock(&ses->ses_lock); 1457 1458 if (is_binding) { 1459 req->hdr.SessionId = cpu_to_le64(ses->Suid); 1460 req->hdr.Flags |= SMB2_FLAGS_SIGNED; 1461 req->PreviousSessionId = 0; 1462 req->Flags = SMB2_SESSION_REQ_FLAG_BINDING; 1463 cifs_dbg(FYI, "Binding to sess id: %llx\n", ses->Suid); 1464 } else { 1465 /* First session, not a reauthenticate */ 1466 req->hdr.SessionId = 0; 1467 /* 1468 * if reconnect, we need to send previous sess id 1469 * otherwise it is 0 1470 */ 1471 req->PreviousSessionId = cpu_to_le64(sess_data->previous_session); 1472 req->Flags = 0; /* MBZ */ 1473 cifs_dbg(FYI, "Fresh session. Previous: %llx\n", 1474 sess_data->previous_session); 1475 } 1476 1477 /* enough to enable echos and oplocks and one max size write */ 1478 if (server->credits >= server->max_credits) 1479 req->hdr.CreditRequest = cpu_to_le16(0); 1480 else 1481 req->hdr.CreditRequest = cpu_to_le16( 1482 min_t(int, server->max_credits - 1483 server->credits, 130)); 1484 1485 /* only one of SMB2 signing flags may be set in SMB2 request */ 1486 if (server->sign) 1487 req->SecurityMode = SMB2_NEGOTIATE_SIGNING_REQUIRED; 1488 else if (global_secflags & CIFSSEC_MAY_SIGN) /* one flag unlike MUST_ */ 1489 req->SecurityMode = SMB2_NEGOTIATE_SIGNING_ENABLED; 1490 else 1491 req->SecurityMode = 0; 1492 1493 #ifdef CONFIG_CIFS_DFS_UPCALL 1494 req->Capabilities = cpu_to_le32(SMB2_GLOBAL_CAP_DFS); 1495 #else 1496 req->Capabilities = 0; 1497 #endif /* DFS_UPCALL */ 1498 1499 req->Channel = 0; /* MBZ */ 1500 1501 sess_data->iov[0].iov_base = (char *)req; 1502 /* 1 for pad */ 1503 sess_data->iov[0].iov_len = total_len - 1; 1504 /* 1505 * This variable will be used to clear the buffer 1506 * allocated above in case of any error in the calling function. 1507 */ 1508 sess_data->buf0_type = CIFS_SMALL_BUFFER; 1509 1510 return 0; 1511 } 1512 1513 static void 1514 SMB2_sess_free_buffer(struct SMB2_sess_data *sess_data) 1515 { 1516 struct kvec *iov = sess_data->iov; 1517 1518 /* iov[1] is already freed by caller */ 1519 if (sess_data->buf0_type != CIFS_NO_BUFFER && iov[0].iov_base) 1520 memzero_explicit(iov[0].iov_base, iov[0].iov_len); 1521 1522 free_rsp_buf(sess_data->buf0_type, iov[0].iov_base); 1523 sess_data->buf0_type = CIFS_NO_BUFFER; 1524 } 1525 1526 static int 1527 SMB2_sess_sendreceive(struct SMB2_sess_data *sess_data) 1528 { 1529 int rc; 1530 struct smb_rqst rqst; 1531 struct smb2_sess_setup_req *req = sess_data->iov[0].iov_base; 1532 struct kvec rsp_iov = { NULL, 0 }; 1533 1534 /* Testing shows that buffer offset must be at location of Buffer[0] */ 1535 req->SecurityBufferOffset = 1536 cpu_to_le16(sizeof(struct smb2_sess_setup_req)); 1537 req->SecurityBufferLength = cpu_to_le16(sess_data->iov[1].iov_len); 1538 1539 memset(&rqst, 0, sizeof(struct smb_rqst)); 1540 rqst.rq_iov = sess_data->iov; 1541 rqst.rq_nvec = 2; 1542 1543 /* BB add code to build os and lm fields */ 1544 rc = cifs_send_recv(sess_data->xid, sess_data->ses, 1545 sess_data->server, 1546 &rqst, 1547 &sess_data->buf0_type, 1548 CIFS_LOG_ERROR | CIFS_SESS_OP, &rsp_iov); 1549 cifs_small_buf_release(sess_data->iov[0].iov_base); 1550 if (rc == 0) 1551 sess_data->ses->expired_pwd = false; 1552 else if ((rc == -EACCES) || (rc == -EKEYEXPIRED) || (rc == -EKEYREVOKED)) 1553 sess_data->ses->expired_pwd = true; 1554 1555 memcpy(&sess_data->iov[0], &rsp_iov, sizeof(struct kvec)); 1556 1557 return rc; 1558 } 1559 1560 static int 1561 SMB2_sess_establish_session(struct SMB2_sess_data *sess_data) 1562 { 1563 int rc = 0; 1564 struct cifs_ses *ses = sess_data->ses; 1565 struct TCP_Server_Info *server = sess_data->server; 1566 1567 cifs_server_lock(server); 1568 if (server->ops->generate_signingkey) { 1569 rc = server->ops->generate_signingkey(ses, server); 1570 if (rc) { 1571 cifs_dbg(FYI, 1572 "SMB3 session key generation failed\n"); 1573 cifs_server_unlock(server); 1574 return rc; 1575 } 1576 } 1577 if (!server->session_estab) { 1578 server->sequence_number = 0x2; 1579 server->session_estab = true; 1580 } 1581 cifs_server_unlock(server); 1582 1583 cifs_dbg(FYI, "SMB2/3 session established successfully\n"); 1584 return rc; 1585 } 1586 1587 #ifdef CONFIG_CIFS_UPCALL 1588 static void 1589 SMB2_auth_kerberos(struct SMB2_sess_data *sess_data) 1590 { 1591 int rc; 1592 struct cifs_ses *ses = sess_data->ses; 1593 struct TCP_Server_Info *server = sess_data->server; 1594 struct cifs_spnego_msg *msg; 1595 struct key *spnego_key = NULL; 1596 struct smb2_sess_setup_rsp *rsp = NULL; 1597 bool is_binding = false; 1598 1599 rc = SMB2_sess_alloc_buffer(sess_data); 1600 if (rc) 1601 goto out; 1602 1603 spnego_key = cifs_get_spnego_key(ses, server); 1604 if (IS_ERR(spnego_key)) { 1605 rc = PTR_ERR(spnego_key); 1606 if (rc == -ENOKEY) 1607 cifs_dbg(VFS, "Verify user has a krb5 ticket and keyutils is installed\n"); 1608 spnego_key = NULL; 1609 goto out; 1610 } 1611 1612 msg = spnego_key->payload.data[0]; 1613 /* 1614 * check version field to make sure that cifs.upcall is 1615 * sending us a response in an expected form 1616 */ 1617 if (msg->version != CIFS_SPNEGO_UPCALL_VERSION) { 1618 cifs_dbg(VFS, "bad cifs.upcall version. Expected %d got %d\n", 1619 CIFS_SPNEGO_UPCALL_VERSION, msg->version); 1620 rc = -EKEYREJECTED; 1621 goto out_put_spnego_key; 1622 } 1623 1624 spin_lock(&ses->ses_lock); 1625 is_binding = (ses->ses_status == SES_GOOD); 1626 spin_unlock(&ses->ses_lock); 1627 1628 /* keep session key if binding */ 1629 if (!is_binding) { 1630 kfree_sensitive(ses->auth_key.response); 1631 ses->auth_key.response = kmemdup(msg->data, msg->sesskey_len, 1632 GFP_KERNEL); 1633 if (!ses->auth_key.response) { 1634 cifs_dbg(VFS, "Kerberos can't allocate (%u bytes) memory\n", 1635 msg->sesskey_len); 1636 rc = -ENOMEM; 1637 goto out_put_spnego_key; 1638 } 1639 ses->auth_key.len = msg->sesskey_len; 1640 } 1641 1642 sess_data->iov[1].iov_base = msg->data + msg->sesskey_len; 1643 sess_data->iov[1].iov_len = msg->secblob_len; 1644 1645 rc = SMB2_sess_sendreceive(sess_data); 1646 if (rc) 1647 goto out_put_spnego_key; 1648 1649 rsp = (struct smb2_sess_setup_rsp *)sess_data->iov[0].iov_base; 1650 /* keep session id and flags if binding */ 1651 if (!is_binding) { 1652 ses->Suid = le64_to_cpu(rsp->hdr.SessionId); 1653 ses->session_flags = le16_to_cpu(rsp->SessionFlags); 1654 } 1655 1656 rc = SMB2_sess_establish_session(sess_data); 1657 out_put_spnego_key: 1658 key_invalidate(spnego_key); 1659 key_put(spnego_key); 1660 if (rc) { 1661 kfree_sensitive(ses->auth_key.response); 1662 ses->auth_key.response = NULL; 1663 ses->auth_key.len = 0; 1664 } 1665 out: 1666 sess_data->result = rc; 1667 sess_data->func = NULL; 1668 SMB2_sess_free_buffer(sess_data); 1669 } 1670 #else 1671 static void 1672 SMB2_auth_kerberos(struct SMB2_sess_data *sess_data) 1673 { 1674 cifs_dbg(VFS, "Kerberos negotiated but upcall support disabled!\n"); 1675 sess_data->result = -EOPNOTSUPP; 1676 sess_data->func = NULL; 1677 } 1678 #endif 1679 1680 static void 1681 SMB2_sess_auth_rawntlmssp_authenticate(struct SMB2_sess_data *sess_data); 1682 1683 static void 1684 SMB2_sess_auth_rawntlmssp_negotiate(struct SMB2_sess_data *sess_data) 1685 { 1686 int rc; 1687 struct cifs_ses *ses = sess_data->ses; 1688 struct TCP_Server_Info *server = sess_data->server; 1689 struct smb2_sess_setup_rsp *rsp = NULL; 1690 unsigned char *ntlmssp_blob = NULL; 1691 bool use_spnego = false; /* else use raw ntlmssp */ 1692 u16 blob_length = 0; 1693 bool is_binding = false; 1694 1695 /* 1696 * If memory allocation is successful, caller of this function 1697 * frees it. 1698 */ 1699 ses->ntlmssp = kmalloc(sizeof(struct ntlmssp_auth), GFP_KERNEL); 1700 if (!ses->ntlmssp) { 1701 rc = -ENOMEM; 1702 goto out_err; 1703 } 1704 ses->ntlmssp->sesskey_per_smbsess = true; 1705 1706 rc = SMB2_sess_alloc_buffer(sess_data); 1707 if (rc) 1708 goto out_err; 1709 1710 rc = build_ntlmssp_smb3_negotiate_blob(&ntlmssp_blob, 1711 &blob_length, ses, server, 1712 sess_data->nls_cp); 1713 if (rc) 1714 goto out; 1715 1716 if (use_spnego) { 1717 /* BB eventually need to add this */ 1718 cifs_dbg(VFS, "spnego not supported for SMB2 yet\n"); 1719 rc = -EOPNOTSUPP; 1720 goto out; 1721 } 1722 sess_data->iov[1].iov_base = ntlmssp_blob; 1723 sess_data->iov[1].iov_len = blob_length; 1724 1725 rc = SMB2_sess_sendreceive(sess_data); 1726 rsp = (struct smb2_sess_setup_rsp *)sess_data->iov[0].iov_base; 1727 1728 /* If true, rc here is expected and not an error */ 1729 if (sess_data->buf0_type != CIFS_NO_BUFFER && 1730 rsp->hdr.Status == STATUS_MORE_PROCESSING_REQUIRED) 1731 rc = 0; 1732 1733 if (rc) 1734 goto out; 1735 1736 if (offsetof(struct smb2_sess_setup_rsp, Buffer) != 1737 le16_to_cpu(rsp->SecurityBufferOffset)) { 1738 cifs_dbg(VFS, "Invalid security buffer offset %d\n", 1739 le16_to_cpu(rsp->SecurityBufferOffset)); 1740 rc = -EIO; 1741 goto out; 1742 } 1743 rc = decode_ntlmssp_challenge(rsp->Buffer, 1744 le16_to_cpu(rsp->SecurityBufferLength), ses); 1745 if (rc) 1746 goto out; 1747 1748 cifs_dbg(FYI, "rawntlmssp session setup challenge phase\n"); 1749 1750 spin_lock(&ses->ses_lock); 1751 is_binding = (ses->ses_status == SES_GOOD); 1752 spin_unlock(&ses->ses_lock); 1753 1754 /* keep existing ses id and flags if binding */ 1755 if (!is_binding) { 1756 ses->Suid = le64_to_cpu(rsp->hdr.SessionId); 1757 ses->session_flags = le16_to_cpu(rsp->SessionFlags); 1758 } 1759 1760 out: 1761 kfree_sensitive(ntlmssp_blob); 1762 SMB2_sess_free_buffer(sess_data); 1763 if (!rc) { 1764 sess_data->result = 0; 1765 sess_data->func = SMB2_sess_auth_rawntlmssp_authenticate; 1766 return; 1767 } 1768 out_err: 1769 kfree_sensitive(ses->ntlmssp); 1770 ses->ntlmssp = NULL; 1771 sess_data->result = rc; 1772 sess_data->func = NULL; 1773 } 1774 1775 static void 1776 SMB2_sess_auth_rawntlmssp_authenticate(struct SMB2_sess_data *sess_data) 1777 { 1778 int rc; 1779 struct cifs_ses *ses = sess_data->ses; 1780 struct TCP_Server_Info *server = sess_data->server; 1781 struct smb2_sess_setup_req *req; 1782 struct smb2_sess_setup_rsp *rsp = NULL; 1783 unsigned char *ntlmssp_blob = NULL; 1784 bool use_spnego = false; /* else use raw ntlmssp */ 1785 u16 blob_length = 0; 1786 bool is_binding = false; 1787 1788 rc = SMB2_sess_alloc_buffer(sess_data); 1789 if (rc) 1790 goto out; 1791 1792 req = (struct smb2_sess_setup_req *) sess_data->iov[0].iov_base; 1793 req->hdr.SessionId = cpu_to_le64(ses->Suid); 1794 1795 rc = build_ntlmssp_auth_blob(&ntlmssp_blob, &blob_length, 1796 ses, server, 1797 sess_data->nls_cp); 1798 if (rc) { 1799 cifs_dbg(FYI, "build_ntlmssp_auth_blob failed %d\n", rc); 1800 goto out; 1801 } 1802 1803 if (use_spnego) { 1804 /* BB eventually need to add this */ 1805 cifs_dbg(VFS, "spnego not supported for SMB2 yet\n"); 1806 rc = -EOPNOTSUPP; 1807 goto out; 1808 } 1809 sess_data->iov[1].iov_base = ntlmssp_blob; 1810 sess_data->iov[1].iov_len = blob_length; 1811 1812 rc = SMB2_sess_sendreceive(sess_data); 1813 if (rc) 1814 goto out; 1815 1816 rsp = (struct smb2_sess_setup_rsp *)sess_data->iov[0].iov_base; 1817 1818 spin_lock(&ses->ses_lock); 1819 is_binding = (ses->ses_status == SES_GOOD); 1820 spin_unlock(&ses->ses_lock); 1821 1822 /* keep existing ses id and flags if binding */ 1823 if (!is_binding) { 1824 ses->Suid = le64_to_cpu(rsp->hdr.SessionId); 1825 ses->session_flags = le16_to_cpu(rsp->SessionFlags); 1826 } 1827 1828 rc = SMB2_sess_establish_session(sess_data); 1829 #ifdef CONFIG_CIFS_DEBUG_DUMP_KEYS 1830 if (ses->server->dialect < SMB30_PROT_ID) { 1831 cifs_dbg(VFS, "%s: dumping generated SMB2 session keys\n", __func__); 1832 /* 1833 * The session id is opaque in terms of endianness, so we can't 1834 * print it as a long long. we dump it as we got it on the wire 1835 */ 1836 cifs_dbg(VFS, "Session Id %*ph\n", (int)sizeof(ses->Suid), 1837 &ses->Suid); 1838 cifs_dbg(VFS, "Session Key %*ph\n", 1839 SMB2_NTLMV2_SESSKEY_SIZE, ses->auth_key.response); 1840 cifs_dbg(VFS, "Signing Key %*ph\n", 1841 SMB3_SIGN_KEY_SIZE, ses->auth_key.response); 1842 } 1843 #endif 1844 out: 1845 kfree_sensitive(ntlmssp_blob); 1846 SMB2_sess_free_buffer(sess_data); 1847 kfree_sensitive(ses->ntlmssp); 1848 ses->ntlmssp = NULL; 1849 sess_data->result = rc; 1850 sess_data->func = NULL; 1851 } 1852 1853 static int 1854 SMB2_select_sec(struct SMB2_sess_data *sess_data) 1855 { 1856 int type; 1857 struct cifs_ses *ses = sess_data->ses; 1858 struct TCP_Server_Info *server = sess_data->server; 1859 1860 type = smb2_select_sectype(server, ses->sectype); 1861 cifs_dbg(FYI, "sess setup type %d\n", type); 1862 if (type == Unspecified) { 1863 cifs_dbg(VFS, "Unable to select appropriate authentication method!\n"); 1864 return -EINVAL; 1865 } 1866 1867 switch (type) { 1868 case Kerberos: 1869 sess_data->func = SMB2_auth_kerberos; 1870 break; 1871 case RawNTLMSSP: 1872 sess_data->func = SMB2_sess_auth_rawntlmssp_negotiate; 1873 break; 1874 default: 1875 cifs_dbg(VFS, "secType %d not supported!\n", type); 1876 return -EOPNOTSUPP; 1877 } 1878 1879 return 0; 1880 } 1881 1882 int 1883 SMB2_sess_setup(const unsigned int xid, struct cifs_ses *ses, 1884 struct TCP_Server_Info *server, 1885 const struct nls_table *nls_cp) 1886 { 1887 int rc = 0; 1888 struct SMB2_sess_data *sess_data; 1889 1890 cifs_dbg(FYI, "Session Setup\n"); 1891 1892 if (!server) { 1893 WARN(1, "%s: server is NULL!\n", __func__); 1894 return -EIO; 1895 } 1896 1897 sess_data = kzalloc(sizeof(struct SMB2_sess_data), GFP_KERNEL); 1898 if (!sess_data) 1899 return -ENOMEM; 1900 1901 sess_data->xid = xid; 1902 sess_data->ses = ses; 1903 sess_data->server = server; 1904 sess_data->buf0_type = CIFS_NO_BUFFER; 1905 sess_data->nls_cp = (struct nls_table *) nls_cp; 1906 sess_data->previous_session = ses->Suid; 1907 1908 rc = SMB2_select_sec(sess_data); 1909 if (rc) 1910 goto out; 1911 1912 /* 1913 * Initialize the session hash with the server one. 1914 */ 1915 memcpy(ses->preauth_sha_hash, server->preauth_sha_hash, 1916 SMB2_PREAUTH_HASH_SIZE); 1917 1918 while (sess_data->func) 1919 sess_data->func(sess_data); 1920 1921 if ((ses->session_flags & SMB2_SESSION_FLAG_IS_GUEST) && (ses->sign)) 1922 cifs_server_dbg(VFS, "signing requested but authenticated as guest\n"); 1923 rc = sess_data->result; 1924 out: 1925 kfree_sensitive(sess_data); 1926 return rc; 1927 } 1928 1929 int 1930 SMB2_logoff(const unsigned int xid, struct cifs_ses *ses) 1931 { 1932 struct smb_rqst rqst; 1933 struct smb2_logoff_req *req; /* response is also trivial struct */ 1934 int rc = 0; 1935 struct TCP_Server_Info *server; 1936 int flags = 0; 1937 unsigned int total_len; 1938 struct kvec iov[1]; 1939 struct kvec rsp_iov; 1940 int resp_buf_type; 1941 1942 cifs_dbg(FYI, "disconnect session %p\n", ses); 1943 1944 if (ses && (ses->server)) 1945 server = ses->server; 1946 else 1947 return -EIO; 1948 1949 /* no need to send SMB logoff if uid already closed due to reconnect */ 1950 spin_lock(&ses->chan_lock); 1951 if (CIFS_ALL_CHANS_NEED_RECONNECT(ses)) { 1952 spin_unlock(&ses->chan_lock); 1953 goto smb2_session_already_dead; 1954 } 1955 spin_unlock(&ses->chan_lock); 1956 1957 rc = smb2_plain_req_init(SMB2_LOGOFF, NULL, ses->server, 1958 (void **) &req, &total_len); 1959 if (rc) 1960 return rc; 1961 1962 /* since no tcon, smb2_init can not do this, so do here */ 1963 req->hdr.SessionId = cpu_to_le64(ses->Suid); 1964 1965 if (ses->session_flags & SMB2_SESSION_FLAG_ENCRYPT_DATA) 1966 flags |= CIFS_TRANSFORM_REQ; 1967 else if (server->sign) 1968 req->hdr.Flags |= SMB2_FLAGS_SIGNED; 1969 1970 flags |= CIFS_NO_RSP_BUF; 1971 1972 iov[0].iov_base = (char *)req; 1973 iov[0].iov_len = total_len; 1974 1975 memset(&rqst, 0, sizeof(struct smb_rqst)); 1976 rqst.rq_iov = iov; 1977 rqst.rq_nvec = 1; 1978 1979 rc = cifs_send_recv(xid, ses, ses->server, 1980 &rqst, &resp_buf_type, flags, &rsp_iov); 1981 cifs_small_buf_release(req); 1982 /* 1983 * No tcon so can't do 1984 * cifs_stats_inc(&tcon->stats.smb2_stats.smb2_com_fail[SMB2...]); 1985 */ 1986 1987 smb2_session_already_dead: 1988 return rc; 1989 } 1990 1991 static inline void cifs_stats_fail_inc(struct cifs_tcon *tcon, uint16_t code) 1992 { 1993 cifs_stats_inc(&tcon->stats.smb2_stats.smb2_com_failed[code]); 1994 } 1995 1996 #define MAX_SHARENAME_LENGTH (255 /* server */ + 80 /* share */ + 1 /* NULL */) 1997 1998 /* These are similar values to what Windows uses */ 1999 static inline void init_copy_chunk_defaults(struct cifs_tcon *tcon) 2000 { 2001 tcon->max_chunks = 256; 2002 tcon->max_bytes_chunk = 1048576; 2003 tcon->max_bytes_copy = 16777216; 2004 } 2005 2006 int 2007 SMB2_tcon(const unsigned int xid, struct cifs_ses *ses, const char *tree, 2008 struct cifs_tcon *tcon, const struct nls_table *cp) 2009 { 2010 struct smb_rqst rqst; 2011 struct smb2_tree_connect_req *req; 2012 struct smb2_tree_connect_rsp *rsp = NULL; 2013 struct kvec iov[2]; 2014 struct kvec rsp_iov = { NULL, 0 }; 2015 int rc = 0; 2016 int resp_buftype; 2017 int unc_path_len; 2018 __le16 *unc_path = NULL; 2019 int flags = 0; 2020 unsigned int total_len; 2021 struct TCP_Server_Info *server = cifs_pick_channel(ses); 2022 2023 cifs_dbg(FYI, "TCON\n"); 2024 2025 if (!server || !tree) 2026 return -EIO; 2027 2028 unc_path = kmalloc(MAX_SHARENAME_LENGTH * 2, GFP_KERNEL); 2029 if (unc_path == NULL) 2030 return -ENOMEM; 2031 2032 unc_path_len = cifs_strtoUTF16(unc_path, tree, strlen(tree), cp); 2033 if (unc_path_len <= 0) { 2034 kfree(unc_path); 2035 return -EINVAL; 2036 } 2037 unc_path_len *= 2; 2038 2039 /* SMB2 TREE_CONNECT request must be called with TreeId == 0 */ 2040 tcon->tid = 0; 2041 atomic_set(&tcon->num_remote_opens, 0); 2042 rc = smb2_plain_req_init(SMB2_TREE_CONNECT, tcon, server, 2043 (void **) &req, &total_len); 2044 if (rc) { 2045 kfree(unc_path); 2046 return rc; 2047 } 2048 2049 if (smb3_encryption_required(tcon)) 2050 flags |= CIFS_TRANSFORM_REQ; 2051 2052 iov[0].iov_base = (char *)req; 2053 /* 1 for pad */ 2054 iov[0].iov_len = total_len - 1; 2055 2056 /* Testing shows that buffer offset must be at location of Buffer[0] */ 2057 req->PathOffset = cpu_to_le16(sizeof(struct smb2_tree_connect_req)); 2058 req->PathLength = cpu_to_le16(unc_path_len); 2059 iov[1].iov_base = unc_path; 2060 iov[1].iov_len = unc_path_len; 2061 2062 /* 2063 * 3.11 tcon req must be signed if not encrypted. See MS-SMB2 3.2.4.1.1 2064 * unless it is guest or anonymous user. See MS-SMB2 3.2.5.3.1 2065 * (Samba servers don't always set the flag so also check if null user) 2066 */ 2067 if ((server->dialect == SMB311_PROT_ID) && 2068 !smb3_encryption_required(tcon) && 2069 !(ses->session_flags & 2070 (SMB2_SESSION_FLAG_IS_GUEST|SMB2_SESSION_FLAG_IS_NULL)) && 2071 ((ses->user_name != NULL) || (ses->sectype == Kerberos))) 2072 req->hdr.Flags |= SMB2_FLAGS_SIGNED; 2073 2074 memset(&rqst, 0, sizeof(struct smb_rqst)); 2075 rqst.rq_iov = iov; 2076 rqst.rq_nvec = 2; 2077 2078 /* Need 64 for max size write so ask for more in case not there yet */ 2079 if (server->credits >= server->max_credits) 2080 req->hdr.CreditRequest = cpu_to_le16(0); 2081 else 2082 req->hdr.CreditRequest = cpu_to_le16( 2083 min_t(int, server->max_credits - 2084 server->credits, 64)); 2085 2086 rc = cifs_send_recv(xid, ses, server, 2087 &rqst, &resp_buftype, flags, &rsp_iov); 2088 cifs_small_buf_release(req); 2089 rsp = (struct smb2_tree_connect_rsp *)rsp_iov.iov_base; 2090 trace_smb3_tcon(xid, tcon->tid, ses->Suid, tree, rc); 2091 if ((rc != 0) || (rsp == NULL)) { 2092 cifs_stats_fail_inc(tcon, SMB2_TREE_CONNECT_HE); 2093 tcon->need_reconnect = true; 2094 goto tcon_error_exit; 2095 } 2096 2097 switch (rsp->ShareType) { 2098 case SMB2_SHARE_TYPE_DISK: 2099 cifs_dbg(FYI, "connection to disk share\n"); 2100 break; 2101 case SMB2_SHARE_TYPE_PIPE: 2102 tcon->pipe = true; 2103 cifs_dbg(FYI, "connection to pipe share\n"); 2104 break; 2105 case SMB2_SHARE_TYPE_PRINT: 2106 tcon->print = true; 2107 cifs_dbg(FYI, "connection to printer\n"); 2108 break; 2109 default: 2110 cifs_server_dbg(VFS, "unknown share type %d\n", rsp->ShareType); 2111 rc = -EOPNOTSUPP; 2112 goto tcon_error_exit; 2113 } 2114 2115 tcon->share_flags = le32_to_cpu(rsp->ShareFlags); 2116 tcon->capabilities = rsp->Capabilities; /* we keep caps little endian */ 2117 tcon->maximal_access = le32_to_cpu(rsp->MaximalAccess); 2118 tcon->tid = le32_to_cpu(rsp->hdr.Id.SyncId.TreeId); 2119 strscpy(tcon->tree_name, tree, sizeof(tcon->tree_name)); 2120 2121 if ((rsp->Capabilities & SMB2_SHARE_CAP_DFS) && 2122 ((tcon->share_flags & SHI1005_FLAGS_DFS) == 0)) 2123 cifs_tcon_dbg(VFS, "DFS capability contradicts DFS flag\n"); 2124 2125 if (tcon->seal && 2126 !(server->capabilities & SMB2_GLOBAL_CAP_ENCRYPTION)) 2127 cifs_tcon_dbg(VFS, "Encryption is requested but not supported\n"); 2128 2129 init_copy_chunk_defaults(tcon); 2130 if (server->ops->validate_negotiate) 2131 rc = server->ops->validate_negotiate(xid, tcon); 2132 if (rc == 0) /* See MS-SMB2 2.2.10 and 3.2.5.5 */ 2133 if (tcon->share_flags & SMB2_SHAREFLAG_ISOLATED_TRANSPORT) 2134 server->nosharesock = true; 2135 tcon_exit: 2136 2137 free_rsp_buf(resp_buftype, rsp); 2138 kfree(unc_path); 2139 return rc; 2140 2141 tcon_error_exit: 2142 if (rsp && rsp->hdr.Status == STATUS_BAD_NETWORK_NAME) 2143 cifs_tcon_dbg(VFS, "BAD_NETWORK_NAME: %s\n", tree); 2144 goto tcon_exit; 2145 } 2146 2147 int 2148 SMB2_tdis(const unsigned int xid, struct cifs_tcon *tcon) 2149 { 2150 struct smb_rqst rqst; 2151 struct smb2_tree_disconnect_req *req; /* response is trivial */ 2152 int rc = 0; 2153 struct cifs_ses *ses = tcon->ses; 2154 struct TCP_Server_Info *server = cifs_pick_channel(ses); 2155 int flags = 0; 2156 unsigned int total_len; 2157 struct kvec iov[1]; 2158 struct kvec rsp_iov; 2159 int resp_buf_type; 2160 2161 cifs_dbg(FYI, "Tree Disconnect\n"); 2162 2163 if (!ses || !(ses->server)) 2164 return -EIO; 2165 2166 trace_smb3_tdis_enter(xid, tcon->tid, ses->Suid, tcon->tree_name); 2167 spin_lock(&ses->chan_lock); 2168 if ((tcon->need_reconnect) || 2169 (CIFS_ALL_CHANS_NEED_RECONNECT(tcon->ses))) { 2170 spin_unlock(&ses->chan_lock); 2171 return 0; 2172 } 2173 spin_unlock(&ses->chan_lock); 2174 2175 invalidate_all_cached_dirs(tcon); 2176 2177 rc = smb2_plain_req_init(SMB2_TREE_DISCONNECT, tcon, server, 2178 (void **) &req, 2179 &total_len); 2180 if (rc) 2181 return rc; 2182 2183 if (smb3_encryption_required(tcon)) 2184 flags |= CIFS_TRANSFORM_REQ; 2185 2186 flags |= CIFS_NO_RSP_BUF; 2187 2188 iov[0].iov_base = (char *)req; 2189 iov[0].iov_len = total_len; 2190 2191 memset(&rqst, 0, sizeof(struct smb_rqst)); 2192 rqst.rq_iov = iov; 2193 rqst.rq_nvec = 1; 2194 2195 rc = cifs_send_recv(xid, ses, server, 2196 &rqst, &resp_buf_type, flags, &rsp_iov); 2197 cifs_small_buf_release(req); 2198 if (rc) { 2199 cifs_stats_fail_inc(tcon, SMB2_TREE_DISCONNECT_HE); 2200 trace_smb3_tdis_err(xid, tcon->tid, ses->Suid, rc); 2201 } 2202 trace_smb3_tdis_done(xid, tcon->tid, ses->Suid); 2203 2204 return rc; 2205 } 2206 2207 2208 static struct create_durable * 2209 create_durable_buf(void) 2210 { 2211 struct create_durable *buf; 2212 2213 buf = kzalloc(sizeof(struct create_durable), GFP_KERNEL); 2214 if (!buf) 2215 return NULL; 2216 2217 buf->ccontext.DataOffset = cpu_to_le16(offsetof 2218 (struct create_durable, Data)); 2219 buf->ccontext.DataLength = cpu_to_le32(16); 2220 buf->ccontext.NameOffset = cpu_to_le16(offsetof 2221 (struct create_durable, Name)); 2222 buf->ccontext.NameLength = cpu_to_le16(4); 2223 /* SMB2_CREATE_DURABLE_HANDLE_REQUEST is "DHnQ" */ 2224 buf->Name[0] = 'D'; 2225 buf->Name[1] = 'H'; 2226 buf->Name[2] = 'n'; 2227 buf->Name[3] = 'Q'; 2228 return buf; 2229 } 2230 2231 static struct create_durable * 2232 create_reconnect_durable_buf(struct cifs_fid *fid) 2233 { 2234 struct create_durable *buf; 2235 2236 buf = kzalloc(sizeof(struct create_durable), GFP_KERNEL); 2237 if (!buf) 2238 return NULL; 2239 2240 buf->ccontext.DataOffset = cpu_to_le16(offsetof 2241 (struct create_durable, Data)); 2242 buf->ccontext.DataLength = cpu_to_le32(16); 2243 buf->ccontext.NameOffset = cpu_to_le16(offsetof 2244 (struct create_durable, Name)); 2245 buf->ccontext.NameLength = cpu_to_le16(4); 2246 buf->Data.Fid.PersistentFileId = fid->persistent_fid; 2247 buf->Data.Fid.VolatileFileId = fid->volatile_fid; 2248 /* SMB2_CREATE_DURABLE_HANDLE_RECONNECT is "DHnC" */ 2249 buf->Name[0] = 'D'; 2250 buf->Name[1] = 'H'; 2251 buf->Name[2] = 'n'; 2252 buf->Name[3] = 'C'; 2253 return buf; 2254 } 2255 2256 static void 2257 parse_query_id_ctxt(struct create_context *cc, struct smb2_file_all_info *buf) 2258 { 2259 struct create_disk_id_rsp *pdisk_id = (struct create_disk_id_rsp *)cc; 2260 2261 cifs_dbg(FYI, "parse query id context 0x%llx 0x%llx\n", 2262 pdisk_id->DiskFileId, pdisk_id->VolumeId); 2263 buf->IndexNumber = pdisk_id->DiskFileId; 2264 } 2265 2266 static void 2267 parse_posix_ctxt(struct create_context *cc, struct smb2_file_all_info *info, 2268 struct create_posix_rsp *posix) 2269 { 2270 int sid_len; 2271 u8 *beg = (u8 *)cc + le16_to_cpu(cc->DataOffset); 2272 u8 *end = beg + le32_to_cpu(cc->DataLength); 2273 u8 *sid; 2274 2275 memset(posix, 0, sizeof(*posix)); 2276 2277 posix->nlink = le32_to_cpu(*(__le32 *)(beg + 0)); 2278 posix->reparse_tag = le32_to_cpu(*(__le32 *)(beg + 4)); 2279 posix->mode = le32_to_cpu(*(__le32 *)(beg + 8)); 2280 2281 sid = beg + 12; 2282 sid_len = posix_info_sid_size(sid, end); 2283 if (sid_len < 0) { 2284 cifs_dbg(VFS, "bad owner sid in posix create response\n"); 2285 return; 2286 } 2287 memcpy(&posix->owner, sid, sid_len); 2288 2289 sid = sid + sid_len; 2290 sid_len = posix_info_sid_size(sid, end); 2291 if (sid_len < 0) { 2292 cifs_dbg(VFS, "bad group sid in posix create response\n"); 2293 return; 2294 } 2295 memcpy(&posix->group, sid, sid_len); 2296 2297 cifs_dbg(FYI, "nlink=%d mode=%o reparse_tag=%x\n", 2298 posix->nlink, posix->mode, posix->reparse_tag); 2299 } 2300 2301 int smb2_parse_contexts(struct TCP_Server_Info *server, 2302 struct kvec *rsp_iov, 2303 unsigned int *epoch, 2304 char *lease_key, __u8 *oplock, 2305 struct smb2_file_all_info *buf, 2306 struct create_posix_rsp *posix) 2307 { 2308 struct smb2_create_rsp *rsp = rsp_iov->iov_base; 2309 struct create_context *cc; 2310 size_t rem, off, len; 2311 size_t doff, dlen; 2312 size_t noff, nlen; 2313 char *name; 2314 static const char smb3_create_tag_posix[] = { 2315 0x93, 0xAD, 0x25, 0x50, 0x9C, 2316 0xB4, 0x11, 0xE7, 0xB4, 0x23, 0x83, 2317 0xDE, 0x96, 0x8B, 0xCD, 0x7C 2318 }; 2319 2320 *oplock = 0; 2321 2322 off = le32_to_cpu(rsp->CreateContextsOffset); 2323 rem = le32_to_cpu(rsp->CreateContextsLength); 2324 if (check_add_overflow(off, rem, &len) || len > rsp_iov->iov_len) 2325 return -EINVAL; 2326 cc = (struct create_context *)((u8 *)rsp + off); 2327 2328 /* Initialize inode number to 0 in case no valid data in qfid context */ 2329 if (buf) 2330 buf->IndexNumber = 0; 2331 2332 while (rem >= sizeof(*cc)) { 2333 doff = le16_to_cpu(cc->DataOffset); 2334 dlen = le32_to_cpu(cc->DataLength); 2335 if (check_add_overflow(doff, dlen, &len) || len > rem) 2336 return -EINVAL; 2337 2338 noff = le16_to_cpu(cc->NameOffset); 2339 nlen = le16_to_cpu(cc->NameLength); 2340 if (noff + nlen > doff) 2341 return -EINVAL; 2342 2343 name = (char *)cc + noff; 2344 switch (nlen) { 2345 case 4: 2346 if (!strncmp(name, SMB2_CREATE_REQUEST_LEASE, 4)) { 2347 *oplock = server->ops->parse_lease_buf(cc, epoch, 2348 lease_key); 2349 } else if (buf && 2350 !strncmp(name, SMB2_CREATE_QUERY_ON_DISK_ID, 4)) { 2351 parse_query_id_ctxt(cc, buf); 2352 } 2353 break; 2354 case 16: 2355 if (posix && !memcmp(name, smb3_create_tag_posix, 16)) 2356 parse_posix_ctxt(cc, buf, posix); 2357 break; 2358 default: 2359 cifs_dbg(FYI, "%s: unhandled context (nlen=%zu dlen=%zu)\n", 2360 __func__, nlen, dlen); 2361 if (IS_ENABLED(CONFIG_CIFS_DEBUG2)) 2362 cifs_dump_mem("context data: ", cc, dlen); 2363 break; 2364 } 2365 2366 off = le32_to_cpu(cc->Next); 2367 if (!off) 2368 break; 2369 if (check_sub_overflow(rem, off, &rem)) 2370 return -EINVAL; 2371 cc = (struct create_context *)((u8 *)cc + off); 2372 } 2373 2374 if (rsp->OplockLevel != SMB2_OPLOCK_LEVEL_LEASE) 2375 *oplock = rsp->OplockLevel; 2376 2377 return 0; 2378 } 2379 2380 static int 2381 add_lease_context(struct TCP_Server_Info *server, 2382 struct smb2_create_req *req, 2383 struct kvec *iov, 2384 unsigned int *num_iovec, u8 *lease_key, __u8 *oplock) 2385 { 2386 unsigned int num = *num_iovec; 2387 2388 iov[num].iov_base = server->ops->create_lease_buf(lease_key, *oplock); 2389 if (iov[num].iov_base == NULL) 2390 return -ENOMEM; 2391 iov[num].iov_len = server->vals->create_lease_size; 2392 req->RequestedOplockLevel = SMB2_OPLOCK_LEVEL_LEASE; 2393 *num_iovec = num + 1; 2394 return 0; 2395 } 2396 2397 static struct create_durable_v2 * 2398 create_durable_v2_buf(struct cifs_open_parms *oparms) 2399 { 2400 struct cifs_fid *pfid = oparms->fid; 2401 struct create_durable_v2 *buf; 2402 2403 buf = kzalloc(sizeof(struct create_durable_v2), GFP_KERNEL); 2404 if (!buf) 2405 return NULL; 2406 2407 buf->ccontext.DataOffset = cpu_to_le16(offsetof 2408 (struct create_durable_v2, dcontext)); 2409 buf->ccontext.DataLength = cpu_to_le32(sizeof(struct durable_context_v2)); 2410 buf->ccontext.NameOffset = cpu_to_le16(offsetof 2411 (struct create_durable_v2, Name)); 2412 buf->ccontext.NameLength = cpu_to_le16(4); 2413 2414 /* 2415 * NB: Handle timeout defaults to 0, which allows server to choose 2416 * (most servers default to 120 seconds) and most clients default to 0. 2417 * This can be overridden at mount ("handletimeout=") if the user wants 2418 * a different persistent (or resilient) handle timeout for all opens 2419 * on a particular SMB3 mount. 2420 */ 2421 buf->dcontext.Timeout = cpu_to_le32(oparms->tcon->handle_timeout); 2422 buf->dcontext.Flags = cpu_to_le32(SMB2_DHANDLE_FLAG_PERSISTENT); 2423 2424 /* for replay, we should not overwrite the existing create guid */ 2425 if (!oparms->replay) { 2426 generate_random_uuid(buf->dcontext.CreateGuid); 2427 memcpy(pfid->create_guid, buf->dcontext.CreateGuid, 16); 2428 } else 2429 memcpy(buf->dcontext.CreateGuid, pfid->create_guid, 16); 2430 2431 /* SMB2_CREATE_DURABLE_HANDLE_REQUEST is "DH2Q" */ 2432 buf->Name[0] = 'D'; 2433 buf->Name[1] = 'H'; 2434 buf->Name[2] = '2'; 2435 buf->Name[3] = 'Q'; 2436 return buf; 2437 } 2438 2439 static struct create_durable_handle_reconnect_v2 * 2440 create_reconnect_durable_v2_buf(struct cifs_fid *fid) 2441 { 2442 struct create_durable_handle_reconnect_v2 *buf; 2443 2444 buf = kzalloc(sizeof(struct create_durable_handle_reconnect_v2), 2445 GFP_KERNEL); 2446 if (!buf) 2447 return NULL; 2448 2449 buf->ccontext.DataOffset = 2450 cpu_to_le16(offsetof(struct create_durable_handle_reconnect_v2, 2451 dcontext)); 2452 buf->ccontext.DataLength = 2453 cpu_to_le32(sizeof(struct durable_reconnect_context_v2)); 2454 buf->ccontext.NameOffset = 2455 cpu_to_le16(offsetof(struct create_durable_handle_reconnect_v2, 2456 Name)); 2457 buf->ccontext.NameLength = cpu_to_le16(4); 2458 2459 buf->dcontext.Fid.PersistentFileId = fid->persistent_fid; 2460 buf->dcontext.Fid.VolatileFileId = fid->volatile_fid; 2461 buf->dcontext.Flags = cpu_to_le32(SMB2_DHANDLE_FLAG_PERSISTENT); 2462 memcpy(buf->dcontext.CreateGuid, fid->create_guid, 16); 2463 2464 /* SMB2_CREATE_DURABLE_HANDLE_RECONNECT_V2 is "DH2C" */ 2465 buf->Name[0] = 'D'; 2466 buf->Name[1] = 'H'; 2467 buf->Name[2] = '2'; 2468 buf->Name[3] = 'C'; 2469 return buf; 2470 } 2471 2472 static int 2473 add_durable_v2_context(struct kvec *iov, unsigned int *num_iovec, 2474 struct cifs_open_parms *oparms) 2475 { 2476 unsigned int num = *num_iovec; 2477 2478 iov[num].iov_base = create_durable_v2_buf(oparms); 2479 if (iov[num].iov_base == NULL) 2480 return -ENOMEM; 2481 iov[num].iov_len = sizeof(struct create_durable_v2); 2482 *num_iovec = num + 1; 2483 return 0; 2484 } 2485 2486 static int 2487 add_durable_reconnect_v2_context(struct kvec *iov, unsigned int *num_iovec, 2488 struct cifs_open_parms *oparms) 2489 { 2490 unsigned int num = *num_iovec; 2491 2492 /* indicate that we don't need to relock the file */ 2493 oparms->reconnect = false; 2494 2495 iov[num].iov_base = create_reconnect_durable_v2_buf(oparms->fid); 2496 if (iov[num].iov_base == NULL) 2497 return -ENOMEM; 2498 iov[num].iov_len = sizeof(struct create_durable_handle_reconnect_v2); 2499 *num_iovec = num + 1; 2500 return 0; 2501 } 2502 2503 static int 2504 add_durable_context(struct kvec *iov, unsigned int *num_iovec, 2505 struct cifs_open_parms *oparms, bool use_persistent) 2506 { 2507 unsigned int num = *num_iovec; 2508 2509 if (use_persistent) { 2510 if (oparms->reconnect) 2511 return add_durable_reconnect_v2_context(iov, num_iovec, 2512 oparms); 2513 else 2514 return add_durable_v2_context(iov, num_iovec, oparms); 2515 } 2516 2517 if (oparms->reconnect) { 2518 iov[num].iov_base = create_reconnect_durable_buf(oparms->fid); 2519 /* indicate that we don't need to relock the file */ 2520 oparms->reconnect = false; 2521 } else 2522 iov[num].iov_base = create_durable_buf(); 2523 if (iov[num].iov_base == NULL) 2524 return -ENOMEM; 2525 iov[num].iov_len = sizeof(struct create_durable); 2526 *num_iovec = num + 1; 2527 return 0; 2528 } 2529 2530 /* See MS-SMB2 2.2.13.2.7 */ 2531 static struct crt_twarp_ctxt * 2532 create_twarp_buf(__u64 timewarp) 2533 { 2534 struct crt_twarp_ctxt *buf; 2535 2536 buf = kzalloc(sizeof(struct crt_twarp_ctxt), GFP_KERNEL); 2537 if (!buf) 2538 return NULL; 2539 2540 buf->ccontext.DataOffset = cpu_to_le16(offsetof 2541 (struct crt_twarp_ctxt, Timestamp)); 2542 buf->ccontext.DataLength = cpu_to_le32(8); 2543 buf->ccontext.NameOffset = cpu_to_le16(offsetof 2544 (struct crt_twarp_ctxt, Name)); 2545 buf->ccontext.NameLength = cpu_to_le16(4); 2546 /* SMB2_CREATE_TIMEWARP_TOKEN is "TWrp" */ 2547 buf->Name[0] = 'T'; 2548 buf->Name[1] = 'W'; 2549 buf->Name[2] = 'r'; 2550 buf->Name[3] = 'p'; 2551 buf->Timestamp = cpu_to_le64(timewarp); 2552 return buf; 2553 } 2554 2555 /* See MS-SMB2 2.2.13.2.7 */ 2556 static int 2557 add_twarp_context(struct kvec *iov, unsigned int *num_iovec, __u64 timewarp) 2558 { 2559 unsigned int num = *num_iovec; 2560 2561 iov[num].iov_base = create_twarp_buf(timewarp); 2562 if (iov[num].iov_base == NULL) 2563 return -ENOMEM; 2564 iov[num].iov_len = sizeof(struct crt_twarp_ctxt); 2565 *num_iovec = num + 1; 2566 return 0; 2567 } 2568 2569 /* See http://technet.microsoft.com/en-us/library/hh509017(v=ws.10).aspx */ 2570 static void setup_owner_group_sids(char *buf) 2571 { 2572 struct owner_group_sids *sids = (struct owner_group_sids *)buf; 2573 2574 /* Populate the user ownership fields S-1-5-88-1 */ 2575 sids->owner.Revision = 1; 2576 sids->owner.NumAuth = 3; 2577 sids->owner.Authority[5] = 5; 2578 sids->owner.SubAuthorities[0] = cpu_to_le32(88); 2579 sids->owner.SubAuthorities[1] = cpu_to_le32(1); 2580 sids->owner.SubAuthorities[2] = cpu_to_le32(current_fsuid().val); 2581 2582 /* Populate the group ownership fields S-1-5-88-2 */ 2583 sids->group.Revision = 1; 2584 sids->group.NumAuth = 3; 2585 sids->group.Authority[5] = 5; 2586 sids->group.SubAuthorities[0] = cpu_to_le32(88); 2587 sids->group.SubAuthorities[1] = cpu_to_le32(2); 2588 sids->group.SubAuthorities[2] = cpu_to_le32(current_fsgid().val); 2589 2590 cifs_dbg(FYI, "owner S-1-5-88-1-%d, group S-1-5-88-2-%d\n", current_fsuid().val, current_fsgid().val); 2591 } 2592 2593 /* See MS-SMB2 2.2.13.2.2 and MS-DTYP 2.4.6 */ 2594 static struct crt_sd_ctxt * 2595 create_sd_buf(umode_t mode, bool set_owner, unsigned int *len) 2596 { 2597 struct crt_sd_ctxt *buf; 2598 __u8 *ptr, *aclptr; 2599 unsigned int acelen, acl_size, ace_count; 2600 unsigned int owner_offset = 0; 2601 unsigned int group_offset = 0; 2602 struct smb3_acl acl = {}; 2603 2604 *len = round_up(sizeof(struct crt_sd_ctxt) + (sizeof(struct cifs_ace) * 4), 8); 2605 2606 if (set_owner) { 2607 /* sizeof(struct owner_group_sids) is already multiple of 8 so no need to round */ 2608 *len += sizeof(struct owner_group_sids); 2609 } 2610 2611 buf = kzalloc(*len, GFP_KERNEL); 2612 if (buf == NULL) 2613 return buf; 2614 2615 ptr = (__u8 *)&buf[1]; 2616 if (set_owner) { 2617 /* offset fields are from beginning of security descriptor not of create context */ 2618 owner_offset = ptr - (__u8 *)&buf->sd; 2619 buf->sd.OffsetOwner = cpu_to_le32(owner_offset); 2620 group_offset = owner_offset + offsetof(struct owner_group_sids, group); 2621 buf->sd.OffsetGroup = cpu_to_le32(group_offset); 2622 2623 setup_owner_group_sids(ptr); 2624 ptr += sizeof(struct owner_group_sids); 2625 } else { 2626 buf->sd.OffsetOwner = 0; 2627 buf->sd.OffsetGroup = 0; 2628 } 2629 2630 buf->ccontext.DataOffset = cpu_to_le16(offsetof(struct crt_sd_ctxt, sd)); 2631 buf->ccontext.NameOffset = cpu_to_le16(offsetof(struct crt_sd_ctxt, Name)); 2632 buf->ccontext.NameLength = cpu_to_le16(4); 2633 /* SMB2_CREATE_SD_BUFFER_TOKEN is "SecD" */ 2634 buf->Name[0] = 'S'; 2635 buf->Name[1] = 'e'; 2636 buf->Name[2] = 'c'; 2637 buf->Name[3] = 'D'; 2638 buf->sd.Revision = 1; /* Must be one see MS-DTYP 2.4.6 */ 2639 2640 /* 2641 * ACL is "self relative" ie ACL is stored in contiguous block of memory 2642 * and "DP" ie the DACL is present 2643 */ 2644 buf->sd.Control = cpu_to_le16(ACL_CONTROL_SR | ACL_CONTROL_DP); 2645 2646 /* offset owner, group and Sbz1 and SACL are all zero */ 2647 buf->sd.OffsetDacl = cpu_to_le32(ptr - (__u8 *)&buf->sd); 2648 /* Ship the ACL for now. we will copy it into buf later. */ 2649 aclptr = ptr; 2650 ptr += sizeof(struct smb3_acl); 2651 2652 /* create one ACE to hold the mode embedded in reserved special SID */ 2653 acelen = setup_special_mode_ACE((struct cifs_ace *)ptr, (__u64)mode); 2654 ptr += acelen; 2655 acl_size = acelen + sizeof(struct smb3_acl); 2656 ace_count = 1; 2657 2658 if (set_owner) { 2659 /* we do not need to reallocate buffer to add the two more ACEs. plenty of space */ 2660 acelen = setup_special_user_owner_ACE((struct cifs_ace *)ptr); 2661 ptr += acelen; 2662 acl_size += acelen; 2663 ace_count += 1; 2664 } 2665 2666 /* and one more ACE to allow access for authenticated users */ 2667 acelen = setup_authusers_ACE((struct cifs_ace *)ptr); 2668 ptr += acelen; 2669 acl_size += acelen; 2670 ace_count += 1; 2671 2672 acl.AclRevision = ACL_REVISION; /* See 2.4.4.1 of MS-DTYP */ 2673 acl.AclSize = cpu_to_le16(acl_size); 2674 acl.AceCount = cpu_to_le16(ace_count); 2675 /* acl.Sbz1 and Sbz2 MBZ so are not set here, but initialized above */ 2676 memcpy(aclptr, &acl, sizeof(struct smb3_acl)); 2677 2678 buf->ccontext.DataLength = cpu_to_le32(ptr - (__u8 *)&buf->sd); 2679 *len = round_up((unsigned int)(ptr - (__u8 *)buf), 8); 2680 2681 return buf; 2682 } 2683 2684 static int 2685 add_sd_context(struct kvec *iov, unsigned int *num_iovec, umode_t mode, bool set_owner) 2686 { 2687 unsigned int num = *num_iovec; 2688 unsigned int len = 0; 2689 2690 iov[num].iov_base = create_sd_buf(mode, set_owner, &len); 2691 if (iov[num].iov_base == NULL) 2692 return -ENOMEM; 2693 iov[num].iov_len = len; 2694 *num_iovec = num + 1; 2695 return 0; 2696 } 2697 2698 static struct crt_query_id_ctxt * 2699 create_query_id_buf(void) 2700 { 2701 struct crt_query_id_ctxt *buf; 2702 2703 buf = kzalloc(sizeof(struct crt_query_id_ctxt), GFP_KERNEL); 2704 if (!buf) 2705 return NULL; 2706 2707 buf->ccontext.DataOffset = cpu_to_le16(0); 2708 buf->ccontext.DataLength = cpu_to_le32(0); 2709 buf->ccontext.NameOffset = cpu_to_le16(offsetof 2710 (struct crt_query_id_ctxt, Name)); 2711 buf->ccontext.NameLength = cpu_to_le16(4); 2712 /* SMB2_CREATE_QUERY_ON_DISK_ID is "QFid" */ 2713 buf->Name[0] = 'Q'; 2714 buf->Name[1] = 'F'; 2715 buf->Name[2] = 'i'; 2716 buf->Name[3] = 'd'; 2717 return buf; 2718 } 2719 2720 /* See MS-SMB2 2.2.13.2.9 */ 2721 static int 2722 add_query_id_context(struct kvec *iov, unsigned int *num_iovec) 2723 { 2724 unsigned int num = *num_iovec; 2725 2726 iov[num].iov_base = create_query_id_buf(); 2727 if (iov[num].iov_base == NULL) 2728 return -ENOMEM; 2729 iov[num].iov_len = sizeof(struct crt_query_id_ctxt); 2730 *num_iovec = num + 1; 2731 return 0; 2732 } 2733 2734 static void add_ea_context(struct cifs_open_parms *oparms, 2735 struct kvec *rq_iov, unsigned int *num_iovs) 2736 { 2737 struct kvec *iov = oparms->ea_cctx; 2738 2739 if (iov && iov->iov_base && iov->iov_len) { 2740 rq_iov[(*num_iovs)++] = *iov; 2741 memset(iov, 0, sizeof(*iov)); 2742 } 2743 } 2744 2745 static int 2746 alloc_path_with_tree_prefix(__le16 **out_path, int *out_size, int *out_len, 2747 const char *treename, const __le16 *path) 2748 { 2749 int treename_len, path_len; 2750 struct nls_table *cp; 2751 const __le16 sep[] = {cpu_to_le16('\\'), cpu_to_le16(0x0000)}; 2752 2753 /* 2754 * skip leading "\\" 2755 */ 2756 treename_len = strlen(treename); 2757 if (treename_len < 2 || !(treename[0] == '\\' && treename[1] == '\\')) 2758 return -EINVAL; 2759 2760 treename += 2; 2761 treename_len -= 2; 2762 2763 path_len = UniStrnlen((wchar_t *)path, PATH_MAX); 2764 2765 /* make room for one path separator only if @path isn't empty */ 2766 *out_len = treename_len + (path[0] ? 1 : 0) + path_len; 2767 2768 /* 2769 * final path needs to be 8-byte aligned as specified in 2770 * MS-SMB2 2.2.13 SMB2 CREATE Request. 2771 */ 2772 *out_size = round_up(*out_len * sizeof(__le16), 8); 2773 *out_path = kzalloc(*out_size + sizeof(__le16) /* null */, GFP_KERNEL); 2774 if (!*out_path) 2775 return -ENOMEM; 2776 2777 cp = load_nls_default(); 2778 cifs_strtoUTF16(*out_path, treename, treename_len, cp); 2779 2780 /* Do not append the separator if the path is empty */ 2781 if (path[0] != cpu_to_le16(0x0000)) { 2782 UniStrcat((wchar_t *)*out_path, (wchar_t *)sep); 2783 UniStrcat((wchar_t *)*out_path, (wchar_t *)path); 2784 } 2785 2786 unload_nls(cp); 2787 2788 return 0; 2789 } 2790 2791 int smb311_posix_mkdir(const unsigned int xid, struct inode *inode, 2792 umode_t mode, struct cifs_tcon *tcon, 2793 const char *full_path, 2794 struct cifs_sb_info *cifs_sb) 2795 { 2796 struct smb_rqst rqst; 2797 struct smb2_create_req *req; 2798 struct smb2_create_rsp *rsp = NULL; 2799 struct cifs_ses *ses = tcon->ses; 2800 struct kvec iov[3]; /* make sure at least one for each open context */ 2801 struct kvec rsp_iov = {NULL, 0}; 2802 int resp_buftype; 2803 int uni_path_len; 2804 __le16 *copy_path = NULL; 2805 int copy_size; 2806 int rc = 0; 2807 unsigned int n_iov = 2; 2808 __u32 file_attributes = 0; 2809 char *pc_buf = NULL; 2810 int flags = 0; 2811 unsigned int total_len; 2812 __le16 *utf16_path = NULL; 2813 struct TCP_Server_Info *server; 2814 int retries = 0, cur_sleep = 1; 2815 2816 replay_again: 2817 /* reinitialize for possible replay */ 2818 flags = 0; 2819 n_iov = 2; 2820 server = cifs_pick_channel(ses); 2821 2822 cifs_dbg(FYI, "mkdir\n"); 2823 2824 /* resource #1: path allocation */ 2825 utf16_path = cifs_convert_path_to_utf16(full_path, cifs_sb); 2826 if (!utf16_path) 2827 return -ENOMEM; 2828 2829 if (!ses || !server) { 2830 rc = -EIO; 2831 goto err_free_path; 2832 } 2833 2834 /* resource #2: request */ 2835 rc = smb2_plain_req_init(SMB2_CREATE, tcon, server, 2836 (void **) &req, &total_len); 2837 if (rc) 2838 goto err_free_path; 2839 2840 2841 if (smb3_encryption_required(tcon)) 2842 flags |= CIFS_TRANSFORM_REQ; 2843 2844 req->ImpersonationLevel = IL_IMPERSONATION; 2845 req->DesiredAccess = cpu_to_le32(FILE_WRITE_ATTRIBUTES); 2846 /* File attributes ignored on open (used in create though) */ 2847 req->FileAttributes = cpu_to_le32(file_attributes); 2848 req->ShareAccess = FILE_SHARE_ALL_LE; 2849 req->CreateDisposition = cpu_to_le32(FILE_CREATE); 2850 req->CreateOptions = cpu_to_le32(CREATE_NOT_FILE); 2851 2852 iov[0].iov_base = (char *)req; 2853 /* -1 since last byte is buf[0] which is sent below (path) */ 2854 iov[0].iov_len = total_len - 1; 2855 2856 req->NameOffset = cpu_to_le16(sizeof(struct smb2_create_req)); 2857 2858 /* [MS-SMB2] 2.2.13 NameOffset: 2859 * If SMB2_FLAGS_DFS_OPERATIONS is set in the Flags field of 2860 * the SMB2 header, the file name includes a prefix that will 2861 * be processed during DFS name normalization as specified in 2862 * section 3.3.5.9. Otherwise, the file name is relative to 2863 * the share that is identified by the TreeId in the SMB2 2864 * header. 2865 */ 2866 if (tcon->share_flags & SHI1005_FLAGS_DFS) { 2867 int name_len; 2868 2869 req->hdr.Flags |= SMB2_FLAGS_DFS_OPERATIONS; 2870 rc = alloc_path_with_tree_prefix(©_path, ©_size, 2871 &name_len, 2872 tcon->tree_name, utf16_path); 2873 if (rc) 2874 goto err_free_req; 2875 2876 req->NameLength = cpu_to_le16(name_len * 2); 2877 uni_path_len = copy_size; 2878 /* free before overwriting resource */ 2879 kfree(utf16_path); 2880 utf16_path = copy_path; 2881 } else { 2882 uni_path_len = (2 * UniStrnlen((wchar_t *)utf16_path, PATH_MAX)) + 2; 2883 /* MUST set path len (NameLength) to 0 opening root of share */ 2884 req->NameLength = cpu_to_le16(uni_path_len - 2); 2885 if (uni_path_len % 8 != 0) { 2886 copy_size = roundup(uni_path_len, 8); 2887 copy_path = kzalloc(copy_size, GFP_KERNEL); 2888 if (!copy_path) { 2889 rc = -ENOMEM; 2890 goto err_free_req; 2891 } 2892 memcpy((char *)copy_path, (const char *)utf16_path, 2893 uni_path_len); 2894 uni_path_len = copy_size; 2895 /* free before overwriting resource */ 2896 kfree(utf16_path); 2897 utf16_path = copy_path; 2898 } 2899 } 2900 2901 iov[1].iov_len = uni_path_len; 2902 iov[1].iov_base = utf16_path; 2903 req->RequestedOplockLevel = SMB2_OPLOCK_LEVEL_NONE; 2904 2905 if (tcon->posix_extensions) { 2906 /* resource #3: posix buf */ 2907 rc = add_posix_context(iov, &n_iov, mode); 2908 if (rc) 2909 goto err_free_req; 2910 req->CreateContextsOffset = cpu_to_le32( 2911 sizeof(struct smb2_create_req) + 2912 iov[1].iov_len); 2913 pc_buf = iov[n_iov-1].iov_base; 2914 } 2915 2916 2917 memset(&rqst, 0, sizeof(struct smb_rqst)); 2918 rqst.rq_iov = iov; 2919 rqst.rq_nvec = n_iov; 2920 2921 /* no need to inc num_remote_opens because we close it just below */ 2922 trace_smb3_posix_mkdir_enter(xid, tcon->tid, ses->Suid, full_path, CREATE_NOT_FILE, 2923 FILE_WRITE_ATTRIBUTES); 2924 2925 if (retries) 2926 smb2_set_replay(server, &rqst); 2927 2928 /* resource #4: response buffer */ 2929 rc = cifs_send_recv(xid, ses, server, 2930 &rqst, &resp_buftype, flags, &rsp_iov); 2931 if (rc) { 2932 cifs_stats_fail_inc(tcon, SMB2_CREATE_HE); 2933 trace_smb3_posix_mkdir_err(xid, tcon->tid, ses->Suid, 2934 CREATE_NOT_FILE, 2935 FILE_WRITE_ATTRIBUTES, rc); 2936 goto err_free_rsp_buf; 2937 } 2938 2939 /* 2940 * Although unlikely to be possible for rsp to be null and rc not set, 2941 * adding check below is slightly safer long term (and quiets Coverity 2942 * warning) 2943 */ 2944 rsp = (struct smb2_create_rsp *)rsp_iov.iov_base; 2945 if (rsp == NULL) { 2946 rc = -EIO; 2947 kfree(pc_buf); 2948 goto err_free_req; 2949 } 2950 2951 trace_smb3_posix_mkdir_done(xid, rsp->PersistentFileId, tcon->tid, ses->Suid, 2952 CREATE_NOT_FILE, FILE_WRITE_ATTRIBUTES); 2953 2954 SMB2_close(xid, tcon, rsp->PersistentFileId, rsp->VolatileFileId); 2955 2956 /* Eventually save off posix specific response info and timestaps */ 2957 2958 err_free_rsp_buf: 2959 free_rsp_buf(resp_buftype, rsp); 2960 kfree(pc_buf); 2961 err_free_req: 2962 cifs_small_buf_release(req); 2963 err_free_path: 2964 kfree(utf16_path); 2965 2966 if (is_replayable_error(rc) && 2967 smb2_should_replay(tcon, &retries, &cur_sleep)) 2968 goto replay_again; 2969 2970 return rc; 2971 } 2972 2973 int 2974 SMB2_open_init(struct cifs_tcon *tcon, struct TCP_Server_Info *server, 2975 struct smb_rqst *rqst, __u8 *oplock, 2976 struct cifs_open_parms *oparms, __le16 *path) 2977 { 2978 struct smb2_create_req *req; 2979 unsigned int n_iov = 2; 2980 __u32 file_attributes = 0; 2981 int copy_size; 2982 int uni_path_len; 2983 unsigned int total_len; 2984 struct kvec *iov = rqst->rq_iov; 2985 __le16 *copy_path; 2986 int rc; 2987 2988 rc = smb2_plain_req_init(SMB2_CREATE, tcon, server, 2989 (void **) &req, &total_len); 2990 if (rc) 2991 return rc; 2992 2993 iov[0].iov_base = (char *)req; 2994 /* -1 since last byte is buf[0] which is sent below (path) */ 2995 iov[0].iov_len = total_len - 1; 2996 2997 if (oparms->create_options & CREATE_OPTION_READONLY) 2998 file_attributes |= ATTR_READONLY; 2999 if (oparms->create_options & CREATE_OPTION_SPECIAL) 3000 file_attributes |= ATTR_SYSTEM; 3001 3002 req->ImpersonationLevel = IL_IMPERSONATION; 3003 req->DesiredAccess = cpu_to_le32(oparms->desired_access); 3004 /* File attributes ignored on open (used in create though) */ 3005 req->FileAttributes = cpu_to_le32(file_attributes); 3006 req->ShareAccess = FILE_SHARE_ALL_LE; 3007 3008 req->CreateDisposition = cpu_to_le32(oparms->disposition); 3009 req->CreateOptions = cpu_to_le32(oparms->create_options & CREATE_OPTIONS_MASK); 3010 req->NameOffset = cpu_to_le16(sizeof(struct smb2_create_req)); 3011 3012 /* [MS-SMB2] 2.2.13 NameOffset: 3013 * If SMB2_FLAGS_DFS_OPERATIONS is set in the Flags field of 3014 * the SMB2 header, the file name includes a prefix that will 3015 * be processed during DFS name normalization as specified in 3016 * section 3.3.5.9. Otherwise, the file name is relative to 3017 * the share that is identified by the TreeId in the SMB2 3018 * header. 3019 */ 3020 if (tcon->share_flags & SHI1005_FLAGS_DFS) { 3021 int name_len; 3022 3023 req->hdr.Flags |= SMB2_FLAGS_DFS_OPERATIONS; 3024 rc = alloc_path_with_tree_prefix(©_path, ©_size, 3025 &name_len, 3026 tcon->tree_name, path); 3027 if (rc) 3028 return rc; 3029 req->NameLength = cpu_to_le16(name_len * 2); 3030 uni_path_len = copy_size; 3031 path = copy_path; 3032 } else { 3033 uni_path_len = (2 * UniStrnlen((wchar_t *)path, PATH_MAX)) + 2; 3034 /* MUST set path len (NameLength) to 0 opening root of share */ 3035 req->NameLength = cpu_to_le16(uni_path_len - 2); 3036 copy_size = round_up(uni_path_len, 8); 3037 copy_path = kzalloc(copy_size, GFP_KERNEL); 3038 if (!copy_path) 3039 return -ENOMEM; 3040 memcpy((char *)copy_path, (const char *)path, 3041 uni_path_len); 3042 uni_path_len = copy_size; 3043 path = copy_path; 3044 } 3045 3046 iov[1].iov_len = uni_path_len; 3047 iov[1].iov_base = path; 3048 3049 if ((!server->oplocks) || (tcon->no_lease)) 3050 *oplock = SMB2_OPLOCK_LEVEL_NONE; 3051 3052 if (!(server->capabilities & SMB2_GLOBAL_CAP_LEASING) || 3053 *oplock == SMB2_OPLOCK_LEVEL_NONE) 3054 req->RequestedOplockLevel = *oplock; 3055 else if (!(server->capabilities & SMB2_GLOBAL_CAP_DIRECTORY_LEASING) && 3056 (oparms->create_options & CREATE_NOT_FILE)) 3057 req->RequestedOplockLevel = *oplock; /* no srv lease support */ 3058 else { 3059 rc = add_lease_context(server, req, iov, &n_iov, 3060 oparms->fid->lease_key, oplock); 3061 if (rc) 3062 return rc; 3063 } 3064 3065 if (*oplock == SMB2_OPLOCK_LEVEL_BATCH) { 3066 rc = add_durable_context(iov, &n_iov, oparms, 3067 tcon->use_persistent); 3068 if (rc) 3069 return rc; 3070 } 3071 3072 if (tcon->posix_extensions) { 3073 rc = add_posix_context(iov, &n_iov, oparms->mode); 3074 if (rc) 3075 return rc; 3076 } 3077 3078 if (tcon->snapshot_time) { 3079 cifs_dbg(FYI, "adding snapshot context\n"); 3080 rc = add_twarp_context(iov, &n_iov, tcon->snapshot_time); 3081 if (rc) 3082 return rc; 3083 } 3084 3085 if ((oparms->disposition != FILE_OPEN) && (oparms->cifs_sb)) { 3086 bool set_mode; 3087 bool set_owner; 3088 3089 if ((oparms->cifs_sb->mnt_cifs_flags & CIFS_MOUNT_MODE_FROM_SID) && 3090 (oparms->mode != ACL_NO_MODE)) 3091 set_mode = true; 3092 else { 3093 set_mode = false; 3094 oparms->mode = ACL_NO_MODE; 3095 } 3096 3097 if (oparms->cifs_sb->mnt_cifs_flags & CIFS_MOUNT_UID_FROM_ACL) 3098 set_owner = true; 3099 else 3100 set_owner = false; 3101 3102 if (set_owner | set_mode) { 3103 cifs_dbg(FYI, "add sd with mode 0x%x\n", oparms->mode); 3104 rc = add_sd_context(iov, &n_iov, oparms->mode, set_owner); 3105 if (rc) 3106 return rc; 3107 } 3108 } 3109 3110 add_query_id_context(iov, &n_iov); 3111 add_ea_context(oparms, iov, &n_iov); 3112 3113 if (n_iov > 2) { 3114 /* 3115 * We have create contexts behind iov[1] (the file 3116 * name), point at them from the main create request 3117 */ 3118 req->CreateContextsOffset = cpu_to_le32( 3119 sizeof(struct smb2_create_req) + 3120 iov[1].iov_len); 3121 req->CreateContextsLength = 0; 3122 3123 for (unsigned int i = 2; i < (n_iov-1); i++) { 3124 struct kvec *v = &iov[i]; 3125 size_t len = v->iov_len; 3126 struct create_context *cctx = 3127 (struct create_context *)v->iov_base; 3128 3129 cctx->Next = cpu_to_le32(len); 3130 le32_add_cpu(&req->CreateContextsLength, len); 3131 } 3132 le32_add_cpu(&req->CreateContextsLength, 3133 iov[n_iov-1].iov_len); 3134 } 3135 3136 rqst->rq_nvec = n_iov; 3137 return 0; 3138 } 3139 3140 /* rq_iov[0] is the request and is released by cifs_small_buf_release(). 3141 * All other vectors are freed by kfree(). 3142 */ 3143 void 3144 SMB2_open_free(struct smb_rqst *rqst) 3145 { 3146 int i; 3147 3148 if (rqst && rqst->rq_iov) { 3149 cifs_small_buf_release(rqst->rq_iov[0].iov_base); 3150 for (i = 1; i < rqst->rq_nvec; i++) 3151 if (rqst->rq_iov[i].iov_base != smb2_padding) 3152 kfree(rqst->rq_iov[i].iov_base); 3153 } 3154 } 3155 3156 int 3157 SMB2_open(const unsigned int xid, struct cifs_open_parms *oparms, __le16 *path, 3158 __u8 *oplock, struct smb2_file_all_info *buf, 3159 struct create_posix_rsp *posix, 3160 struct kvec *err_iov, int *buftype) 3161 { 3162 struct smb_rqst rqst; 3163 struct smb2_create_rsp *rsp = NULL; 3164 struct cifs_tcon *tcon = oparms->tcon; 3165 struct cifs_ses *ses = tcon->ses; 3166 struct TCP_Server_Info *server; 3167 struct kvec iov[SMB2_CREATE_IOV_SIZE]; 3168 struct kvec rsp_iov = {NULL, 0}; 3169 int resp_buftype = CIFS_NO_BUFFER; 3170 int rc = 0; 3171 int flags = 0; 3172 int retries = 0, cur_sleep = 1; 3173 3174 replay_again: 3175 /* reinitialize for possible replay */ 3176 flags = 0; 3177 server = cifs_pick_channel(ses); 3178 oparms->replay = !!(retries); 3179 3180 cifs_dbg(FYI, "create/open\n"); 3181 if (!ses || !server) 3182 return -EIO; 3183 3184 if (smb3_encryption_required(tcon)) 3185 flags |= CIFS_TRANSFORM_REQ; 3186 3187 memset(&rqst, 0, sizeof(struct smb_rqst)); 3188 memset(&iov, 0, sizeof(iov)); 3189 rqst.rq_iov = iov; 3190 rqst.rq_nvec = SMB2_CREATE_IOV_SIZE; 3191 3192 rc = SMB2_open_init(tcon, server, 3193 &rqst, oplock, oparms, path); 3194 if (rc) 3195 goto creat_exit; 3196 3197 trace_smb3_open_enter(xid, tcon->tid, tcon->ses->Suid, oparms->path, 3198 oparms->create_options, oparms->desired_access); 3199 3200 if (retries) 3201 smb2_set_replay(server, &rqst); 3202 3203 rc = cifs_send_recv(xid, ses, server, 3204 &rqst, &resp_buftype, flags, 3205 &rsp_iov); 3206 rsp = (struct smb2_create_rsp *)rsp_iov.iov_base; 3207 3208 if (rc != 0) { 3209 cifs_stats_fail_inc(tcon, SMB2_CREATE_HE); 3210 if (err_iov && rsp) { 3211 *err_iov = rsp_iov; 3212 *buftype = resp_buftype; 3213 resp_buftype = CIFS_NO_BUFFER; 3214 rsp = NULL; 3215 } 3216 trace_smb3_open_err(xid, tcon->tid, ses->Suid, 3217 oparms->create_options, oparms->desired_access, rc); 3218 if (rc == -EREMCHG) { 3219 pr_warn_once("server share %s deleted\n", 3220 tcon->tree_name); 3221 tcon->need_reconnect = true; 3222 } 3223 goto creat_exit; 3224 } else if (rsp == NULL) /* unlikely to happen, but safer to check */ 3225 goto creat_exit; 3226 else 3227 trace_smb3_open_done(xid, rsp->PersistentFileId, tcon->tid, ses->Suid, 3228 oparms->create_options, oparms->desired_access); 3229 3230 atomic_inc(&tcon->num_remote_opens); 3231 oparms->fid->persistent_fid = rsp->PersistentFileId; 3232 oparms->fid->volatile_fid = rsp->VolatileFileId; 3233 oparms->fid->access = oparms->desired_access; 3234 #ifdef CONFIG_CIFS_DEBUG2 3235 oparms->fid->mid = le64_to_cpu(rsp->hdr.MessageId); 3236 #endif /* CIFS_DEBUG2 */ 3237 3238 if (buf) { 3239 buf->CreationTime = rsp->CreationTime; 3240 buf->LastAccessTime = rsp->LastAccessTime; 3241 buf->LastWriteTime = rsp->LastWriteTime; 3242 buf->ChangeTime = rsp->ChangeTime; 3243 buf->AllocationSize = rsp->AllocationSize; 3244 buf->EndOfFile = rsp->EndofFile; 3245 buf->Attributes = rsp->FileAttributes; 3246 buf->NumberOfLinks = cpu_to_le32(1); 3247 buf->DeletePending = 0; 3248 } 3249 3250 3251 rc = smb2_parse_contexts(server, &rsp_iov, &oparms->fid->epoch, 3252 oparms->fid->lease_key, oplock, buf, posix); 3253 creat_exit: 3254 SMB2_open_free(&rqst); 3255 free_rsp_buf(resp_buftype, rsp); 3256 3257 if (is_replayable_error(rc) && 3258 smb2_should_replay(tcon, &retries, &cur_sleep)) 3259 goto replay_again; 3260 3261 return rc; 3262 } 3263 3264 int 3265 SMB2_ioctl_init(struct cifs_tcon *tcon, struct TCP_Server_Info *server, 3266 struct smb_rqst *rqst, 3267 u64 persistent_fid, u64 volatile_fid, u32 opcode, 3268 char *in_data, u32 indatalen, 3269 __u32 max_response_size) 3270 { 3271 struct smb2_ioctl_req *req; 3272 struct kvec *iov = rqst->rq_iov; 3273 unsigned int total_len; 3274 int rc; 3275 char *in_data_buf; 3276 3277 rc = smb2_ioctl_req_init(opcode, tcon, server, 3278 (void **) &req, &total_len); 3279 if (rc) 3280 return rc; 3281 3282 if (indatalen) { 3283 /* 3284 * indatalen is usually small at a couple of bytes max, so 3285 * just allocate through generic pool 3286 */ 3287 in_data_buf = kmemdup(in_data, indatalen, GFP_NOFS); 3288 if (!in_data_buf) { 3289 cifs_small_buf_release(req); 3290 return -ENOMEM; 3291 } 3292 } 3293 3294 req->CtlCode = cpu_to_le32(opcode); 3295 req->PersistentFileId = persistent_fid; 3296 req->VolatileFileId = volatile_fid; 3297 3298 iov[0].iov_base = (char *)req; 3299 /* 3300 * If no input data, the size of ioctl struct in 3301 * protocol spec still includes a 1 byte data buffer, 3302 * but if input data passed to ioctl, we do not 3303 * want to double count this, so we do not send 3304 * the dummy one byte of data in iovec[0] if sending 3305 * input data (in iovec[1]). 3306 */ 3307 if (indatalen) { 3308 req->InputCount = cpu_to_le32(indatalen); 3309 /* do not set InputOffset if no input data */ 3310 req->InputOffset = 3311 cpu_to_le32(offsetof(struct smb2_ioctl_req, Buffer)); 3312 rqst->rq_nvec = 2; 3313 iov[0].iov_len = total_len - 1; 3314 iov[1].iov_base = in_data_buf; 3315 iov[1].iov_len = indatalen; 3316 } else { 3317 rqst->rq_nvec = 1; 3318 iov[0].iov_len = total_len; 3319 } 3320 3321 req->OutputOffset = 0; 3322 req->OutputCount = 0; /* MBZ */ 3323 3324 /* 3325 * In most cases max_response_size is set to 16K (CIFSMaxBufSize) 3326 * We Could increase default MaxOutputResponse, but that could require 3327 * more credits. Windows typically sets this smaller, but for some 3328 * ioctls it may be useful to allow server to send more. No point 3329 * limiting what the server can send as long as fits in one credit 3330 * We can not handle more than CIFS_MAX_BUF_SIZE yet but may want 3331 * to increase this limit up in the future. 3332 * Note that for snapshot queries that servers like Azure expect that 3333 * the first query be minimal size (and just used to get the number/size 3334 * of previous versions) so response size must be specified as EXACTLY 3335 * sizeof(struct snapshot_array) which is 16 when rounded up to multiple 3336 * of eight bytes. Currently that is the only case where we set max 3337 * response size smaller. 3338 */ 3339 req->MaxOutputResponse = cpu_to_le32(max_response_size); 3340 req->hdr.CreditCharge = 3341 cpu_to_le16(DIV_ROUND_UP(max(indatalen, max_response_size), 3342 SMB2_MAX_BUFFER_SIZE)); 3343 /* always an FSCTL (for now) */ 3344 req->Flags = cpu_to_le32(SMB2_0_IOCTL_IS_FSCTL); 3345 3346 /* validate negotiate request must be signed - see MS-SMB2 3.2.5.5 */ 3347 if (opcode == FSCTL_VALIDATE_NEGOTIATE_INFO) 3348 req->hdr.Flags |= SMB2_FLAGS_SIGNED; 3349 3350 return 0; 3351 } 3352 3353 void 3354 SMB2_ioctl_free(struct smb_rqst *rqst) 3355 { 3356 int i; 3357 3358 if (rqst && rqst->rq_iov) { 3359 cifs_small_buf_release(rqst->rq_iov[0].iov_base); /* request */ 3360 for (i = 1; i < rqst->rq_nvec; i++) 3361 if (rqst->rq_iov[i].iov_base != smb2_padding) 3362 kfree(rqst->rq_iov[i].iov_base); 3363 } 3364 } 3365 3366 3367 /* 3368 * SMB2 IOCTL is used for both IOCTLs and FSCTLs 3369 */ 3370 int 3371 SMB2_ioctl(const unsigned int xid, struct cifs_tcon *tcon, u64 persistent_fid, 3372 u64 volatile_fid, u32 opcode, char *in_data, u32 indatalen, 3373 u32 max_out_data_len, char **out_data, 3374 u32 *plen /* returned data len */) 3375 { 3376 struct smb_rqst rqst; 3377 struct smb2_ioctl_rsp *rsp = NULL; 3378 struct cifs_ses *ses; 3379 struct TCP_Server_Info *server; 3380 struct kvec iov[SMB2_IOCTL_IOV_SIZE]; 3381 struct kvec rsp_iov = {NULL, 0}; 3382 int resp_buftype = CIFS_NO_BUFFER; 3383 int rc = 0; 3384 int flags = 0; 3385 int retries = 0, cur_sleep = 1; 3386 3387 if (!tcon) 3388 return -EIO; 3389 3390 ses = tcon->ses; 3391 if (!ses) 3392 return -EIO; 3393 3394 replay_again: 3395 /* reinitialize for possible replay */ 3396 flags = 0; 3397 server = cifs_pick_channel(ses); 3398 3399 if (!server) 3400 return -EIO; 3401 3402 cifs_dbg(FYI, "SMB2 IOCTL\n"); 3403 3404 if (out_data != NULL) 3405 *out_data = NULL; 3406 3407 /* zero out returned data len, in case of error */ 3408 if (plen) 3409 *plen = 0; 3410 3411 if (smb3_encryption_required(tcon)) 3412 flags |= CIFS_TRANSFORM_REQ; 3413 3414 memset(&rqst, 0, sizeof(struct smb_rqst)); 3415 memset(&iov, 0, sizeof(iov)); 3416 rqst.rq_iov = iov; 3417 rqst.rq_nvec = SMB2_IOCTL_IOV_SIZE; 3418 3419 rc = SMB2_ioctl_init(tcon, server, 3420 &rqst, persistent_fid, volatile_fid, opcode, 3421 in_data, indatalen, max_out_data_len); 3422 if (rc) 3423 goto ioctl_exit; 3424 3425 if (retries) 3426 smb2_set_replay(server, &rqst); 3427 3428 rc = cifs_send_recv(xid, ses, server, 3429 &rqst, &resp_buftype, flags, 3430 &rsp_iov); 3431 rsp = (struct smb2_ioctl_rsp *)rsp_iov.iov_base; 3432 3433 if (rc != 0) 3434 trace_smb3_fsctl_err(xid, persistent_fid, tcon->tid, 3435 ses->Suid, 0, opcode, rc); 3436 3437 if ((rc != 0) && (rc != -EINVAL) && (rc != -E2BIG)) { 3438 cifs_stats_fail_inc(tcon, SMB2_IOCTL_HE); 3439 goto ioctl_exit; 3440 } else if (rc == -EINVAL) { 3441 if ((opcode != FSCTL_SRV_COPYCHUNK_WRITE) && 3442 (opcode != FSCTL_SRV_COPYCHUNK)) { 3443 cifs_stats_fail_inc(tcon, SMB2_IOCTL_HE); 3444 goto ioctl_exit; 3445 } 3446 } else if (rc == -E2BIG) { 3447 if (opcode != FSCTL_QUERY_ALLOCATED_RANGES) { 3448 cifs_stats_fail_inc(tcon, SMB2_IOCTL_HE); 3449 goto ioctl_exit; 3450 } 3451 } 3452 3453 /* check if caller wants to look at return data or just return rc */ 3454 if ((plen == NULL) || (out_data == NULL)) 3455 goto ioctl_exit; 3456 3457 /* 3458 * Although unlikely to be possible for rsp to be null and rc not set, 3459 * adding check below is slightly safer long term (and quiets Coverity 3460 * warning) 3461 */ 3462 if (rsp == NULL) { 3463 rc = -EIO; 3464 goto ioctl_exit; 3465 } 3466 3467 *plen = le32_to_cpu(rsp->OutputCount); 3468 3469 /* We check for obvious errors in the output buffer length and offset */ 3470 if (*plen == 0) 3471 goto ioctl_exit; /* server returned no data */ 3472 else if (*plen > rsp_iov.iov_len || *plen > 0xFF00) { 3473 cifs_tcon_dbg(VFS, "srv returned invalid ioctl length: %d\n", *plen); 3474 *plen = 0; 3475 rc = -EIO; 3476 goto ioctl_exit; 3477 } 3478 3479 if (rsp_iov.iov_len - *plen < le32_to_cpu(rsp->OutputOffset)) { 3480 cifs_tcon_dbg(VFS, "Malformed ioctl resp: len %d offset %d\n", *plen, 3481 le32_to_cpu(rsp->OutputOffset)); 3482 *plen = 0; 3483 rc = -EIO; 3484 goto ioctl_exit; 3485 } 3486 3487 *out_data = kmemdup((char *)rsp + le32_to_cpu(rsp->OutputOffset), 3488 *plen, GFP_KERNEL); 3489 if (*out_data == NULL) { 3490 rc = -ENOMEM; 3491 goto ioctl_exit; 3492 } 3493 3494 ioctl_exit: 3495 SMB2_ioctl_free(&rqst); 3496 free_rsp_buf(resp_buftype, rsp); 3497 3498 if (is_replayable_error(rc) && 3499 smb2_should_replay(tcon, &retries, &cur_sleep)) 3500 goto replay_again; 3501 3502 return rc; 3503 } 3504 3505 /* 3506 * Individual callers to ioctl worker function follow 3507 */ 3508 3509 int 3510 SMB2_set_compression(const unsigned int xid, struct cifs_tcon *tcon, 3511 u64 persistent_fid, u64 volatile_fid) 3512 { 3513 int rc; 3514 struct compress_ioctl fsctl_input; 3515 char *ret_data = NULL; 3516 3517 fsctl_input.CompressionState = 3518 cpu_to_le16(COMPRESSION_FORMAT_DEFAULT); 3519 3520 rc = SMB2_ioctl(xid, tcon, persistent_fid, volatile_fid, 3521 FSCTL_SET_COMPRESSION, 3522 (char *)&fsctl_input /* data input */, 3523 2 /* in data len */, CIFSMaxBufSize /* max out data */, 3524 &ret_data /* out data */, NULL); 3525 3526 cifs_dbg(FYI, "set compression rc %d\n", rc); 3527 3528 return rc; 3529 } 3530 3531 int 3532 SMB2_close_init(struct cifs_tcon *tcon, struct TCP_Server_Info *server, 3533 struct smb_rqst *rqst, 3534 u64 persistent_fid, u64 volatile_fid, bool query_attrs) 3535 { 3536 struct smb2_close_req *req; 3537 struct kvec *iov = rqst->rq_iov; 3538 unsigned int total_len; 3539 int rc; 3540 3541 rc = smb2_plain_req_init(SMB2_CLOSE, tcon, server, 3542 (void **) &req, &total_len); 3543 if (rc) 3544 return rc; 3545 3546 req->PersistentFileId = persistent_fid; 3547 req->VolatileFileId = volatile_fid; 3548 if (query_attrs) 3549 req->Flags = SMB2_CLOSE_FLAG_POSTQUERY_ATTRIB; 3550 else 3551 req->Flags = 0; 3552 iov[0].iov_base = (char *)req; 3553 iov[0].iov_len = total_len; 3554 3555 return 0; 3556 } 3557 3558 void 3559 SMB2_close_free(struct smb_rqst *rqst) 3560 { 3561 if (rqst && rqst->rq_iov) 3562 cifs_small_buf_release(rqst->rq_iov[0].iov_base); /* request */ 3563 } 3564 3565 int 3566 __SMB2_close(const unsigned int xid, struct cifs_tcon *tcon, 3567 u64 persistent_fid, u64 volatile_fid, 3568 struct smb2_file_network_open_info *pbuf) 3569 { 3570 struct smb_rqst rqst; 3571 struct smb2_close_rsp *rsp = NULL; 3572 struct cifs_ses *ses = tcon->ses; 3573 struct TCP_Server_Info *server; 3574 struct kvec iov[1]; 3575 struct kvec rsp_iov; 3576 int resp_buftype = CIFS_NO_BUFFER; 3577 int rc = 0; 3578 int flags = 0; 3579 bool query_attrs = false; 3580 int retries = 0, cur_sleep = 1; 3581 3582 replay_again: 3583 /* reinitialize for possible replay */ 3584 flags = 0; 3585 query_attrs = false; 3586 server = cifs_pick_channel(ses); 3587 3588 cifs_dbg(FYI, "Close\n"); 3589 3590 if (!ses || !server) 3591 return -EIO; 3592 3593 if (smb3_encryption_required(tcon)) 3594 flags |= CIFS_TRANSFORM_REQ; 3595 3596 memset(&rqst, 0, sizeof(struct smb_rqst)); 3597 memset(&iov, 0, sizeof(iov)); 3598 rqst.rq_iov = iov; 3599 rqst.rq_nvec = 1; 3600 3601 /* check if need to ask server to return timestamps in close response */ 3602 if (pbuf) 3603 query_attrs = true; 3604 3605 trace_smb3_close_enter(xid, persistent_fid, tcon->tid, ses->Suid); 3606 rc = SMB2_close_init(tcon, server, 3607 &rqst, persistent_fid, volatile_fid, 3608 query_attrs); 3609 if (rc) 3610 goto close_exit; 3611 3612 if (retries) 3613 smb2_set_replay(server, &rqst); 3614 3615 rc = cifs_send_recv(xid, ses, server, 3616 &rqst, &resp_buftype, flags, &rsp_iov); 3617 rsp = (struct smb2_close_rsp *)rsp_iov.iov_base; 3618 3619 if (rc != 0) { 3620 cifs_stats_fail_inc(tcon, SMB2_CLOSE_HE); 3621 trace_smb3_close_err(xid, persistent_fid, tcon->tid, ses->Suid, 3622 rc); 3623 goto close_exit; 3624 } else { 3625 trace_smb3_close_done(xid, persistent_fid, tcon->tid, 3626 ses->Suid); 3627 if (pbuf) 3628 memcpy(&pbuf->network_open_info, 3629 &rsp->network_open_info, 3630 sizeof(pbuf->network_open_info)); 3631 atomic_dec(&tcon->num_remote_opens); 3632 } 3633 3634 close_exit: 3635 SMB2_close_free(&rqst); 3636 free_rsp_buf(resp_buftype, rsp); 3637 3638 /* retry close in a worker thread if this one is interrupted */ 3639 if (is_interrupt_error(rc)) { 3640 int tmp_rc; 3641 3642 tmp_rc = smb2_handle_cancelled_close(tcon, persistent_fid, 3643 volatile_fid); 3644 if (tmp_rc) 3645 cifs_dbg(VFS, "handle cancelled close fid 0x%llx returned error %d\n", 3646 persistent_fid, tmp_rc); 3647 } 3648 3649 if (is_replayable_error(rc) && 3650 smb2_should_replay(tcon, &retries, &cur_sleep)) 3651 goto replay_again; 3652 3653 return rc; 3654 } 3655 3656 int 3657 SMB2_close(const unsigned int xid, struct cifs_tcon *tcon, 3658 u64 persistent_fid, u64 volatile_fid) 3659 { 3660 return __SMB2_close(xid, tcon, persistent_fid, volatile_fid, NULL); 3661 } 3662 3663 int 3664 smb2_validate_iov(unsigned int offset, unsigned int buffer_length, 3665 struct kvec *iov, unsigned int min_buf_size) 3666 { 3667 unsigned int smb_len = iov->iov_len; 3668 char *end_of_smb = smb_len + (char *)iov->iov_base; 3669 char *begin_of_buf = offset + (char *)iov->iov_base; 3670 char *end_of_buf = begin_of_buf + buffer_length; 3671 3672 3673 if (buffer_length < min_buf_size) { 3674 cifs_dbg(VFS, "buffer length %d smaller than minimum size %d\n", 3675 buffer_length, min_buf_size); 3676 return -EINVAL; 3677 } 3678 3679 /* check if beyond RFC1001 maximum length */ 3680 if ((smb_len > 0x7FFFFF) || (buffer_length > 0x7FFFFF)) { 3681 cifs_dbg(VFS, "buffer length %d or smb length %d too large\n", 3682 buffer_length, smb_len); 3683 return -EINVAL; 3684 } 3685 3686 if ((begin_of_buf > end_of_smb) || (end_of_buf > end_of_smb)) { 3687 cifs_dbg(VFS, "Invalid server response, bad offset to data\n"); 3688 return -EINVAL; 3689 } 3690 3691 return 0; 3692 } 3693 3694 /* 3695 * If SMB buffer fields are valid, copy into temporary buffer to hold result. 3696 * Caller must free buffer. 3697 */ 3698 int 3699 smb2_validate_and_copy_iov(unsigned int offset, unsigned int buffer_length, 3700 struct kvec *iov, unsigned int minbufsize, 3701 char *data) 3702 { 3703 char *begin_of_buf = offset + (char *)iov->iov_base; 3704 int rc; 3705 3706 if (!data) 3707 return -EINVAL; 3708 3709 rc = smb2_validate_iov(offset, buffer_length, iov, minbufsize); 3710 if (rc) 3711 return rc; 3712 3713 memcpy(data, begin_of_buf, minbufsize); 3714 3715 return 0; 3716 } 3717 3718 int 3719 SMB2_query_info_init(struct cifs_tcon *tcon, struct TCP_Server_Info *server, 3720 struct smb_rqst *rqst, 3721 u64 persistent_fid, u64 volatile_fid, 3722 u8 info_class, u8 info_type, u32 additional_info, 3723 size_t output_len, size_t input_len, void *input) 3724 { 3725 struct smb2_query_info_req *req; 3726 struct kvec *iov = rqst->rq_iov; 3727 unsigned int total_len; 3728 size_t len; 3729 int rc; 3730 3731 if (unlikely(check_add_overflow(input_len, sizeof(*req), &len) || 3732 len > CIFSMaxBufSize)) 3733 return -EINVAL; 3734 3735 rc = smb2_plain_req_init(SMB2_QUERY_INFO, tcon, server, 3736 (void **) &req, &total_len); 3737 if (rc) 3738 return rc; 3739 3740 req->InfoType = info_type; 3741 req->FileInfoClass = info_class; 3742 req->PersistentFileId = persistent_fid; 3743 req->VolatileFileId = volatile_fid; 3744 req->AdditionalInformation = cpu_to_le32(additional_info); 3745 3746 req->OutputBufferLength = cpu_to_le32(output_len); 3747 if (input_len) { 3748 req->InputBufferLength = cpu_to_le32(input_len); 3749 /* total_len for smb query request never close to le16 max */ 3750 req->InputBufferOffset = cpu_to_le16(total_len - 1); 3751 memcpy(req->Buffer, input, input_len); 3752 } 3753 3754 iov[0].iov_base = (char *)req; 3755 /* 1 for Buffer */ 3756 iov[0].iov_len = len; 3757 return 0; 3758 } 3759 3760 void 3761 SMB2_query_info_free(struct smb_rqst *rqst) 3762 { 3763 if (rqst && rqst->rq_iov) 3764 cifs_buf_release(rqst->rq_iov[0].iov_base); /* request */ 3765 } 3766 3767 static int 3768 query_info(const unsigned int xid, struct cifs_tcon *tcon, 3769 u64 persistent_fid, u64 volatile_fid, u8 info_class, u8 info_type, 3770 u32 additional_info, size_t output_len, size_t min_len, void **data, 3771 u32 *dlen) 3772 { 3773 struct smb_rqst rqst; 3774 struct smb2_query_info_rsp *rsp = NULL; 3775 struct kvec iov[1]; 3776 struct kvec rsp_iov; 3777 int rc = 0; 3778 int resp_buftype = CIFS_NO_BUFFER; 3779 struct cifs_ses *ses = tcon->ses; 3780 struct TCP_Server_Info *server; 3781 int flags = 0; 3782 bool allocated = false; 3783 int retries = 0, cur_sleep = 1; 3784 3785 cifs_dbg(FYI, "Query Info\n"); 3786 3787 if (!ses) 3788 return -EIO; 3789 3790 replay_again: 3791 /* reinitialize for possible replay */ 3792 flags = 0; 3793 allocated = false; 3794 server = cifs_pick_channel(ses); 3795 3796 if (!server) 3797 return -EIO; 3798 3799 if (smb3_encryption_required(tcon)) 3800 flags |= CIFS_TRANSFORM_REQ; 3801 3802 memset(&rqst, 0, sizeof(struct smb_rqst)); 3803 memset(&iov, 0, sizeof(iov)); 3804 rqst.rq_iov = iov; 3805 rqst.rq_nvec = 1; 3806 3807 rc = SMB2_query_info_init(tcon, server, 3808 &rqst, persistent_fid, volatile_fid, 3809 info_class, info_type, additional_info, 3810 output_len, 0, NULL); 3811 if (rc) 3812 goto qinf_exit; 3813 3814 trace_smb3_query_info_enter(xid, persistent_fid, tcon->tid, 3815 ses->Suid, info_class, (__u32)info_type); 3816 3817 if (retries) 3818 smb2_set_replay(server, &rqst); 3819 3820 rc = cifs_send_recv(xid, ses, server, 3821 &rqst, &resp_buftype, flags, &rsp_iov); 3822 rsp = (struct smb2_query_info_rsp *)rsp_iov.iov_base; 3823 3824 if (rc) { 3825 cifs_stats_fail_inc(tcon, SMB2_QUERY_INFO_HE); 3826 trace_smb3_query_info_err(xid, persistent_fid, tcon->tid, 3827 ses->Suid, info_class, (__u32)info_type, rc); 3828 goto qinf_exit; 3829 } 3830 3831 trace_smb3_query_info_done(xid, persistent_fid, tcon->tid, 3832 ses->Suid, info_class, (__u32)info_type); 3833 3834 if (dlen) { 3835 *dlen = le32_to_cpu(rsp->OutputBufferLength); 3836 if (!*data) { 3837 *data = kmalloc(*dlen, GFP_KERNEL); 3838 if (!*data) { 3839 cifs_tcon_dbg(VFS, 3840 "Error %d allocating memory for acl\n", 3841 rc); 3842 *dlen = 0; 3843 rc = -ENOMEM; 3844 goto qinf_exit; 3845 } 3846 allocated = true; 3847 } 3848 } 3849 3850 rc = smb2_validate_and_copy_iov(le16_to_cpu(rsp->OutputBufferOffset), 3851 le32_to_cpu(rsp->OutputBufferLength), 3852 &rsp_iov, dlen ? *dlen : min_len, *data); 3853 if (rc && allocated) { 3854 kfree(*data); 3855 *data = NULL; 3856 *dlen = 0; 3857 } 3858 3859 qinf_exit: 3860 SMB2_query_info_free(&rqst); 3861 free_rsp_buf(resp_buftype, rsp); 3862 3863 if (is_replayable_error(rc) && 3864 smb2_should_replay(tcon, &retries, &cur_sleep)) 3865 goto replay_again; 3866 3867 return rc; 3868 } 3869 3870 int SMB2_query_info(const unsigned int xid, struct cifs_tcon *tcon, 3871 u64 persistent_fid, u64 volatile_fid, struct smb2_file_all_info *data) 3872 { 3873 return query_info(xid, tcon, persistent_fid, volatile_fid, 3874 FILE_ALL_INFORMATION, SMB2_O_INFO_FILE, 0, 3875 sizeof(struct smb2_file_all_info) + PATH_MAX * 2, 3876 sizeof(struct smb2_file_all_info), (void **)&data, 3877 NULL); 3878 } 3879 3880 #if 0 3881 /* currently unused, as now we are doing compounding instead (see smb311_posix_query_path_info) */ 3882 int 3883 SMB311_posix_query_info(const unsigned int xid, struct cifs_tcon *tcon, 3884 u64 persistent_fid, u64 volatile_fid, struct smb311_posix_qinfo *data, u32 *plen) 3885 { 3886 size_t output_len = sizeof(struct smb311_posix_qinfo *) + 3887 (sizeof(struct cifs_sid) * 2) + (PATH_MAX * 2); 3888 *plen = 0; 3889 3890 return query_info(xid, tcon, persistent_fid, volatile_fid, 3891 SMB_FIND_FILE_POSIX_INFO, SMB2_O_INFO_FILE, 0, 3892 output_len, sizeof(struct smb311_posix_qinfo), (void **)&data, plen); 3893 /* Note caller must free "data" (passed in above). It may be allocated in query_info call */ 3894 } 3895 #endif 3896 3897 int 3898 SMB2_query_acl(const unsigned int xid, struct cifs_tcon *tcon, 3899 u64 persistent_fid, u64 volatile_fid, 3900 void **data, u32 *plen, u32 extra_info) 3901 { 3902 __u32 additional_info = OWNER_SECINFO | GROUP_SECINFO | DACL_SECINFO | 3903 extra_info; 3904 *plen = 0; 3905 3906 return query_info(xid, tcon, persistent_fid, volatile_fid, 3907 0, SMB2_O_INFO_SECURITY, additional_info, 3908 SMB2_MAX_BUFFER_SIZE, MIN_SEC_DESC_LEN, data, plen); 3909 } 3910 3911 int 3912 SMB2_get_srv_num(const unsigned int xid, struct cifs_tcon *tcon, 3913 u64 persistent_fid, u64 volatile_fid, __le64 *uniqueid) 3914 { 3915 return query_info(xid, tcon, persistent_fid, volatile_fid, 3916 FILE_INTERNAL_INFORMATION, SMB2_O_INFO_FILE, 0, 3917 sizeof(struct smb2_file_internal_info), 3918 sizeof(struct smb2_file_internal_info), 3919 (void **)&uniqueid, NULL); 3920 } 3921 3922 /* 3923 * CHANGE_NOTIFY Request is sent to get notifications on changes to a directory 3924 * See MS-SMB2 2.2.35 and 2.2.36 3925 */ 3926 3927 static int 3928 SMB2_notify_init(const unsigned int xid, struct smb_rqst *rqst, 3929 struct cifs_tcon *tcon, struct TCP_Server_Info *server, 3930 u64 persistent_fid, u64 volatile_fid, 3931 u32 completion_filter, bool watch_tree) 3932 { 3933 struct smb2_change_notify_req *req; 3934 struct kvec *iov = rqst->rq_iov; 3935 unsigned int total_len; 3936 int rc; 3937 3938 rc = smb2_plain_req_init(SMB2_CHANGE_NOTIFY, tcon, server, 3939 (void **) &req, &total_len); 3940 if (rc) 3941 return rc; 3942 3943 req->PersistentFileId = persistent_fid; 3944 req->VolatileFileId = volatile_fid; 3945 /* See note 354 of MS-SMB2, 64K max */ 3946 req->OutputBufferLength = 3947 cpu_to_le32(SMB2_MAX_BUFFER_SIZE - MAX_SMB2_HDR_SIZE); 3948 req->CompletionFilter = cpu_to_le32(completion_filter); 3949 if (watch_tree) 3950 req->Flags = cpu_to_le16(SMB2_WATCH_TREE); 3951 else 3952 req->Flags = 0; 3953 3954 iov[0].iov_base = (char *)req; 3955 iov[0].iov_len = total_len; 3956 3957 return 0; 3958 } 3959 3960 int 3961 SMB2_change_notify(const unsigned int xid, struct cifs_tcon *tcon, 3962 u64 persistent_fid, u64 volatile_fid, bool watch_tree, 3963 u32 completion_filter, u32 max_out_data_len, char **out_data, 3964 u32 *plen /* returned data len */) 3965 { 3966 struct cifs_ses *ses = tcon->ses; 3967 struct TCP_Server_Info *server; 3968 struct smb_rqst rqst; 3969 struct smb2_change_notify_rsp *smb_rsp; 3970 struct kvec iov[1]; 3971 struct kvec rsp_iov = {NULL, 0}; 3972 int resp_buftype = CIFS_NO_BUFFER; 3973 int flags = 0; 3974 int rc = 0; 3975 int retries = 0, cur_sleep = 1; 3976 3977 replay_again: 3978 /* reinitialize for possible replay */ 3979 flags = 0; 3980 server = cifs_pick_channel(ses); 3981 3982 cifs_dbg(FYI, "change notify\n"); 3983 if (!ses || !server) 3984 return -EIO; 3985 3986 if (smb3_encryption_required(tcon)) 3987 flags |= CIFS_TRANSFORM_REQ; 3988 3989 memset(&rqst, 0, sizeof(struct smb_rqst)); 3990 memset(&iov, 0, sizeof(iov)); 3991 if (plen) 3992 *plen = 0; 3993 3994 rqst.rq_iov = iov; 3995 rqst.rq_nvec = 1; 3996 3997 rc = SMB2_notify_init(xid, &rqst, tcon, server, 3998 persistent_fid, volatile_fid, 3999 completion_filter, watch_tree); 4000 if (rc) 4001 goto cnotify_exit; 4002 4003 trace_smb3_notify_enter(xid, persistent_fid, tcon->tid, ses->Suid, 4004 (u8)watch_tree, completion_filter); 4005 4006 if (retries) 4007 smb2_set_replay(server, &rqst); 4008 4009 rc = cifs_send_recv(xid, ses, server, 4010 &rqst, &resp_buftype, flags, &rsp_iov); 4011 4012 if (rc != 0) { 4013 cifs_stats_fail_inc(tcon, SMB2_CHANGE_NOTIFY_HE); 4014 trace_smb3_notify_err(xid, persistent_fid, tcon->tid, ses->Suid, 4015 (u8)watch_tree, completion_filter, rc); 4016 } else { 4017 trace_smb3_notify_done(xid, persistent_fid, tcon->tid, 4018 ses->Suid, (u8)watch_tree, completion_filter); 4019 /* validate that notify information is plausible */ 4020 if ((rsp_iov.iov_base == NULL) || 4021 (rsp_iov.iov_len < sizeof(struct smb2_change_notify_rsp) + 1)) 4022 goto cnotify_exit; 4023 4024 smb_rsp = (struct smb2_change_notify_rsp *)rsp_iov.iov_base; 4025 4026 smb2_validate_iov(le16_to_cpu(smb_rsp->OutputBufferOffset), 4027 le32_to_cpu(smb_rsp->OutputBufferLength), &rsp_iov, 4028 sizeof(struct file_notify_information)); 4029 4030 *out_data = kmemdup((char *)smb_rsp + le16_to_cpu(smb_rsp->OutputBufferOffset), 4031 le32_to_cpu(smb_rsp->OutputBufferLength), GFP_KERNEL); 4032 if (*out_data == NULL) { 4033 rc = -ENOMEM; 4034 goto cnotify_exit; 4035 } else if (plen) 4036 *plen = le32_to_cpu(smb_rsp->OutputBufferLength); 4037 } 4038 4039 cnotify_exit: 4040 if (rqst.rq_iov) 4041 cifs_small_buf_release(rqst.rq_iov[0].iov_base); /* request */ 4042 free_rsp_buf(resp_buftype, rsp_iov.iov_base); 4043 4044 if (is_replayable_error(rc) && 4045 smb2_should_replay(tcon, &retries, &cur_sleep)) 4046 goto replay_again; 4047 4048 return rc; 4049 } 4050 4051 4052 4053 /* 4054 * This is a no-op for now. We're not really interested in the reply, but 4055 * rather in the fact that the server sent one and that server->lstrp 4056 * gets updated. 4057 * 4058 * FIXME: maybe we should consider checking that the reply matches request? 4059 */ 4060 static void 4061 smb2_echo_callback(struct mid_q_entry *mid) 4062 { 4063 struct TCP_Server_Info *server = mid->callback_data; 4064 struct smb2_echo_rsp *rsp = (struct smb2_echo_rsp *)mid->resp_buf; 4065 struct cifs_credits credits = { .value = 0, .instance = 0 }; 4066 4067 if (mid->mid_state == MID_RESPONSE_RECEIVED 4068 || mid->mid_state == MID_RESPONSE_MALFORMED) { 4069 credits.value = le16_to_cpu(rsp->hdr.CreditRequest); 4070 credits.instance = server->reconnect_instance; 4071 } 4072 4073 release_mid(mid); 4074 add_credits(server, &credits, CIFS_ECHO_OP); 4075 } 4076 4077 void smb2_reconnect_server(struct work_struct *work) 4078 { 4079 struct TCP_Server_Info *server = container_of(work, 4080 struct TCP_Server_Info, reconnect.work); 4081 struct TCP_Server_Info *pserver; 4082 struct cifs_ses *ses, *ses2; 4083 struct cifs_tcon *tcon, *tcon2; 4084 struct list_head tmp_list, tmp_ses_list; 4085 bool ses_exist = false; 4086 bool tcon_selected = false; 4087 int rc; 4088 bool resched = false; 4089 4090 /* first check if ref count has reached 0, if not inc ref count */ 4091 spin_lock(&cifs_tcp_ses_lock); 4092 if (!server->srv_count) { 4093 spin_unlock(&cifs_tcp_ses_lock); 4094 return; 4095 } 4096 server->srv_count++; 4097 spin_unlock(&cifs_tcp_ses_lock); 4098 4099 /* If server is a channel, select the primary channel */ 4100 pserver = SERVER_IS_CHAN(server) ? server->primary_server : server; 4101 4102 /* Prevent simultaneous reconnects that can corrupt tcon->rlist list */ 4103 mutex_lock(&pserver->reconnect_mutex); 4104 4105 /* if the server is marked for termination, drop the ref count here */ 4106 if (server->terminate) { 4107 cifs_put_tcp_session(server, true); 4108 mutex_unlock(&pserver->reconnect_mutex); 4109 return; 4110 } 4111 4112 INIT_LIST_HEAD(&tmp_list); 4113 INIT_LIST_HEAD(&tmp_ses_list); 4114 cifs_dbg(FYI, "Reconnecting tcons and channels\n"); 4115 4116 spin_lock(&cifs_tcp_ses_lock); 4117 list_for_each_entry(ses, &pserver->smb_ses_list, smb_ses_list) { 4118 spin_lock(&ses->ses_lock); 4119 if (ses->ses_status == SES_EXITING) { 4120 spin_unlock(&ses->ses_lock); 4121 continue; 4122 } 4123 spin_unlock(&ses->ses_lock); 4124 4125 tcon_selected = false; 4126 4127 list_for_each_entry(tcon, &ses->tcon_list, tcon_list) { 4128 if (tcon->need_reconnect || tcon->need_reopen_files) { 4129 tcon->tc_count++; 4130 list_add_tail(&tcon->rlist, &tmp_list); 4131 tcon_selected = true; 4132 } 4133 } 4134 /* 4135 * IPC has the same lifetime as its session and uses its 4136 * refcount. 4137 */ 4138 if (ses->tcon_ipc && ses->tcon_ipc->need_reconnect) { 4139 list_add_tail(&ses->tcon_ipc->rlist, &tmp_list); 4140 tcon_selected = true; 4141 cifs_smb_ses_inc_refcount(ses); 4142 } 4143 /* 4144 * handle the case where channel needs to reconnect 4145 * binding session, but tcon is healthy (some other channel 4146 * is active) 4147 */ 4148 spin_lock(&ses->chan_lock); 4149 if (!tcon_selected && cifs_chan_needs_reconnect(ses, server)) { 4150 list_add_tail(&ses->rlist, &tmp_ses_list); 4151 ses_exist = true; 4152 cifs_smb_ses_inc_refcount(ses); 4153 } 4154 spin_unlock(&ses->chan_lock); 4155 } 4156 spin_unlock(&cifs_tcp_ses_lock); 4157 4158 list_for_each_entry_safe(tcon, tcon2, &tmp_list, rlist) { 4159 rc = smb2_reconnect(SMB2_INTERNAL_CMD, tcon, server, true); 4160 if (!rc) 4161 cifs_reopen_persistent_handles(tcon); 4162 else 4163 resched = true; 4164 list_del_init(&tcon->rlist); 4165 if (tcon->ipc) 4166 cifs_put_smb_ses(tcon->ses); 4167 else 4168 cifs_put_tcon(tcon); 4169 } 4170 4171 if (!ses_exist) 4172 goto done; 4173 4174 /* allocate a dummy tcon struct used for reconnect */ 4175 tcon = tcon_info_alloc(false); 4176 if (!tcon) { 4177 resched = true; 4178 list_for_each_entry_safe(ses, ses2, &tmp_ses_list, rlist) { 4179 list_del_init(&ses->rlist); 4180 cifs_put_smb_ses(ses); 4181 } 4182 goto done; 4183 } 4184 4185 tcon->status = TID_GOOD; 4186 tcon->retry = false; 4187 tcon->need_reconnect = false; 4188 4189 /* now reconnect sessions for necessary channels */ 4190 list_for_each_entry_safe(ses, ses2, &tmp_ses_list, rlist) { 4191 tcon->ses = ses; 4192 rc = smb2_reconnect(SMB2_INTERNAL_CMD, tcon, server, true); 4193 if (rc) 4194 resched = true; 4195 list_del_init(&ses->rlist); 4196 cifs_put_smb_ses(ses); 4197 } 4198 tconInfoFree(tcon); 4199 4200 done: 4201 cifs_dbg(FYI, "Reconnecting tcons and channels finished\n"); 4202 if (resched) 4203 queue_delayed_work(cifsiod_wq, &server->reconnect, 2 * HZ); 4204 mutex_unlock(&pserver->reconnect_mutex); 4205 4206 /* now we can safely release srv struct */ 4207 cifs_put_tcp_session(server, true); 4208 } 4209 4210 int 4211 SMB2_echo(struct TCP_Server_Info *server) 4212 { 4213 struct smb2_echo_req *req; 4214 int rc = 0; 4215 struct kvec iov[1]; 4216 struct smb_rqst rqst = { .rq_iov = iov, 4217 .rq_nvec = 1 }; 4218 unsigned int total_len; 4219 4220 cifs_dbg(FYI, "In echo request for conn_id %lld\n", server->conn_id); 4221 4222 spin_lock(&server->srv_lock); 4223 if (server->ops->need_neg && 4224 server->ops->need_neg(server)) { 4225 spin_unlock(&server->srv_lock); 4226 /* No need to send echo on newly established connections */ 4227 mod_delayed_work(cifsiod_wq, &server->reconnect, 0); 4228 return rc; 4229 } 4230 spin_unlock(&server->srv_lock); 4231 4232 rc = smb2_plain_req_init(SMB2_ECHO, NULL, server, 4233 (void **)&req, &total_len); 4234 if (rc) 4235 return rc; 4236 4237 req->hdr.CreditRequest = cpu_to_le16(1); 4238 4239 iov[0].iov_len = total_len; 4240 iov[0].iov_base = (char *)req; 4241 4242 rc = cifs_call_async(server, &rqst, NULL, smb2_echo_callback, NULL, 4243 server, CIFS_ECHO_OP, NULL); 4244 if (rc) 4245 cifs_dbg(FYI, "Echo request failed: %d\n", rc); 4246 4247 cifs_small_buf_release(req); 4248 return rc; 4249 } 4250 4251 void 4252 SMB2_flush_free(struct smb_rqst *rqst) 4253 { 4254 if (rqst && rqst->rq_iov) 4255 cifs_small_buf_release(rqst->rq_iov[0].iov_base); /* request */ 4256 } 4257 4258 int 4259 SMB2_flush_init(const unsigned int xid, struct smb_rqst *rqst, 4260 struct cifs_tcon *tcon, struct TCP_Server_Info *server, 4261 u64 persistent_fid, u64 volatile_fid) 4262 { 4263 struct smb2_flush_req *req; 4264 struct kvec *iov = rqst->rq_iov; 4265 unsigned int total_len; 4266 int rc; 4267 4268 rc = smb2_plain_req_init(SMB2_FLUSH, tcon, server, 4269 (void **) &req, &total_len); 4270 if (rc) 4271 return rc; 4272 4273 req->PersistentFileId = persistent_fid; 4274 req->VolatileFileId = volatile_fid; 4275 4276 iov[0].iov_base = (char *)req; 4277 iov[0].iov_len = total_len; 4278 4279 return 0; 4280 } 4281 4282 int 4283 SMB2_flush(const unsigned int xid, struct cifs_tcon *tcon, u64 persistent_fid, 4284 u64 volatile_fid) 4285 { 4286 struct cifs_ses *ses = tcon->ses; 4287 struct smb_rqst rqst; 4288 struct kvec iov[1]; 4289 struct kvec rsp_iov = {NULL, 0}; 4290 struct TCP_Server_Info *server; 4291 int resp_buftype = CIFS_NO_BUFFER; 4292 int flags = 0; 4293 int rc = 0; 4294 int retries = 0, cur_sleep = 1; 4295 4296 replay_again: 4297 /* reinitialize for possible replay */ 4298 flags = 0; 4299 server = cifs_pick_channel(ses); 4300 4301 cifs_dbg(FYI, "flush\n"); 4302 if (!ses || !(ses->server)) 4303 return -EIO; 4304 4305 if (smb3_encryption_required(tcon)) 4306 flags |= CIFS_TRANSFORM_REQ; 4307 4308 memset(&rqst, 0, sizeof(struct smb_rqst)); 4309 memset(&iov, 0, sizeof(iov)); 4310 rqst.rq_iov = iov; 4311 rqst.rq_nvec = 1; 4312 4313 rc = SMB2_flush_init(xid, &rqst, tcon, server, 4314 persistent_fid, volatile_fid); 4315 if (rc) 4316 goto flush_exit; 4317 4318 trace_smb3_flush_enter(xid, persistent_fid, tcon->tid, ses->Suid); 4319 4320 if (retries) 4321 smb2_set_replay(server, &rqst); 4322 4323 rc = cifs_send_recv(xid, ses, server, 4324 &rqst, &resp_buftype, flags, &rsp_iov); 4325 4326 if (rc != 0) { 4327 cifs_stats_fail_inc(tcon, SMB2_FLUSH_HE); 4328 trace_smb3_flush_err(xid, persistent_fid, tcon->tid, ses->Suid, 4329 rc); 4330 } else 4331 trace_smb3_flush_done(xid, persistent_fid, tcon->tid, 4332 ses->Suid); 4333 4334 flush_exit: 4335 SMB2_flush_free(&rqst); 4336 free_rsp_buf(resp_buftype, rsp_iov.iov_base); 4337 4338 if (is_replayable_error(rc) && 4339 smb2_should_replay(tcon, &retries, &cur_sleep)) 4340 goto replay_again; 4341 4342 return rc; 4343 } 4344 4345 #ifdef CONFIG_CIFS_SMB_DIRECT 4346 static inline bool smb3_use_rdma_offload(struct cifs_io_parms *io_parms) 4347 { 4348 struct TCP_Server_Info *server = io_parms->server; 4349 struct cifs_tcon *tcon = io_parms->tcon; 4350 4351 /* we can only offload if we're connected */ 4352 if (!server || !tcon) 4353 return false; 4354 4355 /* we can only offload on an rdma connection */ 4356 if (!server->rdma || !server->smbd_conn) 4357 return false; 4358 4359 /* we don't support signed offload yet */ 4360 if (server->sign) 4361 return false; 4362 4363 /* we don't support encrypted offload yet */ 4364 if (smb3_encryption_required(tcon)) 4365 return false; 4366 4367 /* offload also has its overhead, so only do it if desired */ 4368 if (io_parms->length < server->smbd_conn->rdma_readwrite_threshold) 4369 return false; 4370 4371 return true; 4372 } 4373 #endif /* CONFIG_CIFS_SMB_DIRECT */ 4374 4375 /* 4376 * To form a chain of read requests, any read requests after the first should 4377 * have the end_of_chain boolean set to true. 4378 */ 4379 static int 4380 smb2_new_read_req(void **buf, unsigned int *total_len, 4381 struct cifs_io_parms *io_parms, struct cifs_readdata *rdata, 4382 unsigned int remaining_bytes, int request_type) 4383 { 4384 int rc = -EACCES; 4385 struct smb2_read_req *req = NULL; 4386 struct smb2_hdr *shdr; 4387 struct TCP_Server_Info *server = io_parms->server; 4388 4389 rc = smb2_plain_req_init(SMB2_READ, io_parms->tcon, server, 4390 (void **) &req, total_len); 4391 if (rc) 4392 return rc; 4393 4394 if (server == NULL) 4395 return -ECONNABORTED; 4396 4397 shdr = &req->hdr; 4398 shdr->Id.SyncId.ProcessId = cpu_to_le32(io_parms->pid); 4399 4400 req->PersistentFileId = io_parms->persistent_fid; 4401 req->VolatileFileId = io_parms->volatile_fid; 4402 req->ReadChannelInfoOffset = 0; /* reserved */ 4403 req->ReadChannelInfoLength = 0; /* reserved */ 4404 req->Channel = 0; /* reserved */ 4405 req->MinimumCount = 0; 4406 req->Length = cpu_to_le32(io_parms->length); 4407 req->Offset = cpu_to_le64(io_parms->offset); 4408 4409 trace_smb3_read_enter(0 /* xid */, 4410 io_parms->persistent_fid, 4411 io_parms->tcon->tid, io_parms->tcon->ses->Suid, 4412 io_parms->offset, io_parms->length); 4413 #ifdef CONFIG_CIFS_SMB_DIRECT 4414 /* 4415 * If we want to do a RDMA write, fill in and append 4416 * smbd_buffer_descriptor_v1 to the end of read request 4417 */ 4418 if (smb3_use_rdma_offload(io_parms)) { 4419 struct smbd_buffer_descriptor_v1 *v1; 4420 bool need_invalidate = server->dialect == SMB30_PROT_ID; 4421 4422 rdata->mr = smbd_register_mr(server->smbd_conn, &rdata->iter, 4423 true, need_invalidate); 4424 if (!rdata->mr) 4425 return -EAGAIN; 4426 4427 req->Channel = SMB2_CHANNEL_RDMA_V1_INVALIDATE; 4428 if (need_invalidate) 4429 req->Channel = SMB2_CHANNEL_RDMA_V1; 4430 req->ReadChannelInfoOffset = 4431 cpu_to_le16(offsetof(struct smb2_read_req, Buffer)); 4432 req->ReadChannelInfoLength = 4433 cpu_to_le16(sizeof(struct smbd_buffer_descriptor_v1)); 4434 v1 = (struct smbd_buffer_descriptor_v1 *) &req->Buffer[0]; 4435 v1->offset = cpu_to_le64(rdata->mr->mr->iova); 4436 v1->token = cpu_to_le32(rdata->mr->mr->rkey); 4437 v1->length = cpu_to_le32(rdata->mr->mr->length); 4438 4439 *total_len += sizeof(*v1) - 1; 4440 } 4441 #endif 4442 if (request_type & CHAINED_REQUEST) { 4443 if (!(request_type & END_OF_CHAIN)) { 4444 /* next 8-byte aligned request */ 4445 *total_len = ALIGN(*total_len, 8); 4446 shdr->NextCommand = cpu_to_le32(*total_len); 4447 } else /* END_OF_CHAIN */ 4448 shdr->NextCommand = 0; 4449 if (request_type & RELATED_REQUEST) { 4450 shdr->Flags |= SMB2_FLAGS_RELATED_OPERATIONS; 4451 /* 4452 * Related requests use info from previous read request 4453 * in chain. 4454 */ 4455 shdr->SessionId = cpu_to_le64(0xFFFFFFFFFFFFFFFF); 4456 shdr->Id.SyncId.TreeId = cpu_to_le32(0xFFFFFFFF); 4457 req->PersistentFileId = (u64)-1; 4458 req->VolatileFileId = (u64)-1; 4459 } 4460 } 4461 if (remaining_bytes > io_parms->length) 4462 req->RemainingBytes = cpu_to_le32(remaining_bytes); 4463 else 4464 req->RemainingBytes = 0; 4465 4466 *buf = req; 4467 return rc; 4468 } 4469 4470 static void 4471 smb2_readv_callback(struct mid_q_entry *mid) 4472 { 4473 struct cifs_readdata *rdata = mid->callback_data; 4474 struct cifs_tcon *tcon = tlink_tcon(rdata->cfile->tlink); 4475 struct TCP_Server_Info *server = rdata->server; 4476 struct smb2_hdr *shdr = 4477 (struct smb2_hdr *)rdata->iov[0].iov_base; 4478 struct cifs_credits credits = { .value = 0, .instance = 0 }; 4479 struct smb_rqst rqst = { .rq_iov = &rdata->iov[1], .rq_nvec = 1 }; 4480 4481 if (rdata->got_bytes) { 4482 rqst.rq_iter = rdata->iter; 4483 rqst.rq_iter_size = iov_iter_count(&rdata->iter); 4484 } 4485 4486 WARN_ONCE(rdata->server != mid->server, 4487 "rdata server %p != mid server %p", 4488 rdata->server, mid->server); 4489 4490 cifs_dbg(FYI, "%s: mid=%llu state=%d result=%d bytes=%u\n", 4491 __func__, mid->mid, mid->mid_state, rdata->result, 4492 rdata->bytes); 4493 4494 switch (mid->mid_state) { 4495 case MID_RESPONSE_RECEIVED: 4496 credits.value = le16_to_cpu(shdr->CreditRequest); 4497 credits.instance = server->reconnect_instance; 4498 /* result already set, check signature */ 4499 if (server->sign && !mid->decrypted) { 4500 int rc; 4501 4502 iov_iter_revert(&rqst.rq_iter, rdata->got_bytes); 4503 iov_iter_truncate(&rqst.rq_iter, rdata->got_bytes); 4504 rc = smb2_verify_signature(&rqst, server); 4505 if (rc) 4506 cifs_tcon_dbg(VFS, "SMB signature verification returned error = %d\n", 4507 rc); 4508 } 4509 /* FIXME: should this be counted toward the initiating task? */ 4510 task_io_account_read(rdata->got_bytes); 4511 cifs_stats_bytes_read(tcon, rdata->got_bytes); 4512 break; 4513 case MID_REQUEST_SUBMITTED: 4514 case MID_RETRY_NEEDED: 4515 rdata->result = -EAGAIN; 4516 if (server->sign && rdata->got_bytes) 4517 /* reset bytes number since we can not check a sign */ 4518 rdata->got_bytes = 0; 4519 /* FIXME: should this be counted toward the initiating task? */ 4520 task_io_account_read(rdata->got_bytes); 4521 cifs_stats_bytes_read(tcon, rdata->got_bytes); 4522 break; 4523 case MID_RESPONSE_MALFORMED: 4524 credits.value = le16_to_cpu(shdr->CreditRequest); 4525 credits.instance = server->reconnect_instance; 4526 fallthrough; 4527 default: 4528 rdata->result = -EIO; 4529 } 4530 #ifdef CONFIG_CIFS_SMB_DIRECT 4531 /* 4532 * If this rdata has a memmory registered, the MR can be freed 4533 * MR needs to be freed as soon as I/O finishes to prevent deadlock 4534 * because they have limited number and are used for future I/Os 4535 */ 4536 if (rdata->mr) { 4537 smbd_deregister_mr(rdata->mr); 4538 rdata->mr = NULL; 4539 } 4540 #endif 4541 if (rdata->result && rdata->result != -ENODATA) { 4542 cifs_stats_fail_inc(tcon, SMB2_READ_HE); 4543 trace_smb3_read_err(0 /* xid */, 4544 rdata->cfile->fid.persistent_fid, 4545 tcon->tid, tcon->ses->Suid, rdata->offset, 4546 rdata->bytes, rdata->result); 4547 } else 4548 trace_smb3_read_done(0 /* xid */, 4549 rdata->cfile->fid.persistent_fid, 4550 tcon->tid, tcon->ses->Suid, 4551 rdata->offset, rdata->got_bytes); 4552 4553 queue_work(cifsiod_wq, &rdata->work); 4554 release_mid(mid); 4555 add_credits(server, &credits, 0); 4556 } 4557 4558 /* smb2_async_readv - send an async read, and set up mid to handle result */ 4559 int 4560 smb2_async_readv(struct cifs_readdata *rdata) 4561 { 4562 int rc, flags = 0; 4563 char *buf; 4564 struct smb2_hdr *shdr; 4565 struct cifs_io_parms io_parms; 4566 struct smb_rqst rqst = { .rq_iov = rdata->iov, 4567 .rq_nvec = 1 }; 4568 struct TCP_Server_Info *server; 4569 struct cifs_tcon *tcon = tlink_tcon(rdata->cfile->tlink); 4570 unsigned int total_len; 4571 int credit_request; 4572 4573 cifs_dbg(FYI, "%s: offset=%llu bytes=%u\n", 4574 __func__, rdata->offset, rdata->bytes); 4575 4576 if (!rdata->server) 4577 rdata->server = cifs_pick_channel(tcon->ses); 4578 4579 io_parms.tcon = tlink_tcon(rdata->cfile->tlink); 4580 io_parms.server = server = rdata->server; 4581 io_parms.offset = rdata->offset; 4582 io_parms.length = rdata->bytes; 4583 io_parms.persistent_fid = rdata->cfile->fid.persistent_fid; 4584 io_parms.volatile_fid = rdata->cfile->fid.volatile_fid; 4585 io_parms.pid = rdata->pid; 4586 4587 rc = smb2_new_read_req( 4588 (void **) &buf, &total_len, &io_parms, rdata, 0, 0); 4589 if (rc) 4590 return rc; 4591 4592 if (smb3_encryption_required(io_parms.tcon)) 4593 flags |= CIFS_TRANSFORM_REQ; 4594 4595 rdata->iov[0].iov_base = buf; 4596 rdata->iov[0].iov_len = total_len; 4597 4598 shdr = (struct smb2_hdr *)buf; 4599 4600 if (rdata->credits.value > 0) { 4601 shdr->CreditCharge = cpu_to_le16(DIV_ROUND_UP(rdata->bytes, 4602 SMB2_MAX_BUFFER_SIZE)); 4603 credit_request = le16_to_cpu(shdr->CreditCharge) + 8; 4604 if (server->credits >= server->max_credits) 4605 shdr->CreditRequest = cpu_to_le16(0); 4606 else 4607 shdr->CreditRequest = cpu_to_le16( 4608 min_t(int, server->max_credits - 4609 server->credits, credit_request)); 4610 4611 rc = adjust_credits(server, &rdata->credits, rdata->bytes); 4612 if (rc) 4613 goto async_readv_out; 4614 4615 flags |= CIFS_HAS_CREDITS; 4616 } 4617 4618 kref_get(&rdata->refcount); 4619 rc = cifs_call_async(server, &rqst, 4620 cifs_readv_receive, smb2_readv_callback, 4621 smb3_handle_read_data, rdata, flags, 4622 &rdata->credits); 4623 if (rc) { 4624 kref_put(&rdata->refcount, cifs_readdata_release); 4625 cifs_stats_fail_inc(io_parms.tcon, SMB2_READ_HE); 4626 trace_smb3_read_err(0 /* xid */, io_parms.persistent_fid, 4627 io_parms.tcon->tid, 4628 io_parms.tcon->ses->Suid, 4629 io_parms.offset, io_parms.length, rc); 4630 } 4631 4632 async_readv_out: 4633 cifs_small_buf_release(buf); 4634 return rc; 4635 } 4636 4637 int 4638 SMB2_read(const unsigned int xid, struct cifs_io_parms *io_parms, 4639 unsigned int *nbytes, char **buf, int *buf_type) 4640 { 4641 struct smb_rqst rqst; 4642 int resp_buftype, rc; 4643 struct smb2_read_req *req = NULL; 4644 struct smb2_read_rsp *rsp = NULL; 4645 struct kvec iov[1]; 4646 struct kvec rsp_iov; 4647 unsigned int total_len; 4648 int flags = CIFS_LOG_ERROR; 4649 struct cifs_ses *ses = io_parms->tcon->ses; 4650 4651 if (!io_parms->server) 4652 io_parms->server = cifs_pick_channel(io_parms->tcon->ses); 4653 4654 *nbytes = 0; 4655 rc = smb2_new_read_req((void **)&req, &total_len, io_parms, NULL, 0, 0); 4656 if (rc) 4657 return rc; 4658 4659 if (smb3_encryption_required(io_parms->tcon)) 4660 flags |= CIFS_TRANSFORM_REQ; 4661 4662 iov[0].iov_base = (char *)req; 4663 iov[0].iov_len = total_len; 4664 4665 memset(&rqst, 0, sizeof(struct smb_rqst)); 4666 rqst.rq_iov = iov; 4667 rqst.rq_nvec = 1; 4668 4669 rc = cifs_send_recv(xid, ses, io_parms->server, 4670 &rqst, &resp_buftype, flags, &rsp_iov); 4671 rsp = (struct smb2_read_rsp *)rsp_iov.iov_base; 4672 4673 if (rc) { 4674 if (rc != -ENODATA) { 4675 cifs_stats_fail_inc(io_parms->tcon, SMB2_READ_HE); 4676 cifs_dbg(VFS, "Send error in read = %d\n", rc); 4677 trace_smb3_read_err(xid, 4678 req->PersistentFileId, 4679 io_parms->tcon->tid, ses->Suid, 4680 io_parms->offset, io_parms->length, 4681 rc); 4682 } else 4683 trace_smb3_read_done(xid, req->PersistentFileId, io_parms->tcon->tid, 4684 ses->Suid, io_parms->offset, 0); 4685 free_rsp_buf(resp_buftype, rsp_iov.iov_base); 4686 cifs_small_buf_release(req); 4687 return rc == -ENODATA ? 0 : rc; 4688 } else 4689 trace_smb3_read_done(xid, 4690 req->PersistentFileId, 4691 io_parms->tcon->tid, ses->Suid, 4692 io_parms->offset, io_parms->length); 4693 4694 cifs_small_buf_release(req); 4695 4696 *nbytes = le32_to_cpu(rsp->DataLength); 4697 if ((*nbytes > CIFS_MAX_MSGSIZE) || 4698 (*nbytes > io_parms->length)) { 4699 cifs_dbg(FYI, "bad length %d for count %d\n", 4700 *nbytes, io_parms->length); 4701 rc = -EIO; 4702 *nbytes = 0; 4703 } 4704 4705 if (*buf) { 4706 memcpy(*buf, (char *)rsp + rsp->DataOffset, *nbytes); 4707 free_rsp_buf(resp_buftype, rsp_iov.iov_base); 4708 } else if (resp_buftype != CIFS_NO_BUFFER) { 4709 *buf = rsp_iov.iov_base; 4710 if (resp_buftype == CIFS_SMALL_BUFFER) 4711 *buf_type = CIFS_SMALL_BUFFER; 4712 else if (resp_buftype == CIFS_LARGE_BUFFER) 4713 *buf_type = CIFS_LARGE_BUFFER; 4714 } 4715 return rc; 4716 } 4717 4718 /* 4719 * Check the mid_state and signature on received buffer (if any), and queue the 4720 * workqueue completion task. 4721 */ 4722 static void 4723 smb2_writev_callback(struct mid_q_entry *mid) 4724 { 4725 struct cifs_writedata *wdata = mid->callback_data; 4726 struct cifs_tcon *tcon = tlink_tcon(wdata->cfile->tlink); 4727 struct TCP_Server_Info *server = wdata->server; 4728 unsigned int written; 4729 struct smb2_write_rsp *rsp = (struct smb2_write_rsp *)mid->resp_buf; 4730 struct cifs_credits credits = { .value = 0, .instance = 0 }; 4731 4732 WARN_ONCE(wdata->server != mid->server, 4733 "wdata server %p != mid server %p", 4734 wdata->server, mid->server); 4735 4736 switch (mid->mid_state) { 4737 case MID_RESPONSE_RECEIVED: 4738 credits.value = le16_to_cpu(rsp->hdr.CreditRequest); 4739 credits.instance = server->reconnect_instance; 4740 wdata->result = smb2_check_receive(mid, server, 0); 4741 if (wdata->result != 0) 4742 break; 4743 4744 written = le32_to_cpu(rsp->DataLength); 4745 /* 4746 * Mask off high 16 bits when bytes written as returned 4747 * by the server is greater than bytes requested by the 4748 * client. OS/2 servers are known to set incorrect 4749 * CountHigh values. 4750 */ 4751 if (written > wdata->bytes) 4752 written &= 0xFFFF; 4753 4754 if (written < wdata->bytes) 4755 wdata->result = -ENOSPC; 4756 else 4757 wdata->bytes = written; 4758 break; 4759 case MID_REQUEST_SUBMITTED: 4760 case MID_RETRY_NEEDED: 4761 wdata->result = -EAGAIN; 4762 break; 4763 case MID_RESPONSE_MALFORMED: 4764 credits.value = le16_to_cpu(rsp->hdr.CreditRequest); 4765 credits.instance = server->reconnect_instance; 4766 fallthrough; 4767 default: 4768 wdata->result = -EIO; 4769 break; 4770 } 4771 #ifdef CONFIG_CIFS_SMB_DIRECT 4772 /* 4773 * If this wdata has a memory registered, the MR can be freed 4774 * The number of MRs available is limited, it's important to recover 4775 * used MR as soon as I/O is finished. Hold MR longer in the later 4776 * I/O process can possibly result in I/O deadlock due to lack of MR 4777 * to send request on I/O retry 4778 */ 4779 if (wdata->mr) { 4780 smbd_deregister_mr(wdata->mr); 4781 wdata->mr = NULL; 4782 } 4783 #endif 4784 if (wdata->result) { 4785 cifs_stats_fail_inc(tcon, SMB2_WRITE_HE); 4786 trace_smb3_write_err(0 /* no xid */, 4787 wdata->cfile->fid.persistent_fid, 4788 tcon->tid, tcon->ses->Suid, wdata->offset, 4789 wdata->bytes, wdata->result); 4790 if (wdata->result == -ENOSPC) 4791 pr_warn_once("Out of space writing to %s\n", 4792 tcon->tree_name); 4793 } else 4794 trace_smb3_write_done(0 /* no xid */, 4795 wdata->cfile->fid.persistent_fid, 4796 tcon->tid, tcon->ses->Suid, 4797 wdata->offset, wdata->bytes); 4798 4799 queue_work(cifsiod_wq, &wdata->work); 4800 release_mid(mid); 4801 add_credits(server, &credits, 0); 4802 } 4803 4804 /* smb2_async_writev - send an async write, and set up mid to handle result */ 4805 int 4806 smb2_async_writev(struct cifs_writedata *wdata, 4807 void (*release)(struct kref *kref)) 4808 { 4809 int rc = -EACCES, flags = 0; 4810 struct smb2_write_req *req = NULL; 4811 struct smb2_hdr *shdr; 4812 struct cifs_tcon *tcon = tlink_tcon(wdata->cfile->tlink); 4813 struct TCP_Server_Info *server = wdata->server; 4814 struct kvec iov[1]; 4815 struct smb_rqst rqst = { }; 4816 unsigned int total_len; 4817 struct cifs_io_parms _io_parms; 4818 struct cifs_io_parms *io_parms = NULL; 4819 int credit_request; 4820 4821 if (!wdata->server || wdata->replay) 4822 server = wdata->server = cifs_pick_channel(tcon->ses); 4823 4824 /* 4825 * in future we may get cifs_io_parms passed in from the caller, 4826 * but for now we construct it here... 4827 */ 4828 _io_parms = (struct cifs_io_parms) { 4829 .tcon = tcon, 4830 .server = server, 4831 .offset = wdata->offset, 4832 .length = wdata->bytes, 4833 .persistent_fid = wdata->cfile->fid.persistent_fid, 4834 .volatile_fid = wdata->cfile->fid.volatile_fid, 4835 .pid = wdata->pid, 4836 }; 4837 io_parms = &_io_parms; 4838 4839 rc = smb2_plain_req_init(SMB2_WRITE, tcon, server, 4840 (void **) &req, &total_len); 4841 if (rc) 4842 return rc; 4843 4844 if (smb3_encryption_required(tcon)) 4845 flags |= CIFS_TRANSFORM_REQ; 4846 4847 shdr = (struct smb2_hdr *)req; 4848 shdr->Id.SyncId.ProcessId = cpu_to_le32(io_parms->pid); 4849 4850 req->PersistentFileId = io_parms->persistent_fid; 4851 req->VolatileFileId = io_parms->volatile_fid; 4852 req->WriteChannelInfoOffset = 0; 4853 req->WriteChannelInfoLength = 0; 4854 req->Channel = SMB2_CHANNEL_NONE; 4855 req->Offset = cpu_to_le64(io_parms->offset); 4856 req->DataOffset = cpu_to_le16( 4857 offsetof(struct smb2_write_req, Buffer)); 4858 req->RemainingBytes = 0; 4859 4860 trace_smb3_write_enter(0 /* xid */, 4861 io_parms->persistent_fid, 4862 io_parms->tcon->tid, 4863 io_parms->tcon->ses->Suid, 4864 io_parms->offset, 4865 io_parms->length); 4866 4867 #ifdef CONFIG_CIFS_SMB_DIRECT 4868 /* 4869 * If we want to do a server RDMA read, fill in and append 4870 * smbd_buffer_descriptor_v1 to the end of write request 4871 */ 4872 if (smb3_use_rdma_offload(io_parms)) { 4873 struct smbd_buffer_descriptor_v1 *v1; 4874 size_t data_size = iov_iter_count(&wdata->iter); 4875 bool need_invalidate = server->dialect == SMB30_PROT_ID; 4876 4877 wdata->mr = smbd_register_mr(server->smbd_conn, &wdata->iter, 4878 false, need_invalidate); 4879 if (!wdata->mr) { 4880 rc = -EAGAIN; 4881 goto async_writev_out; 4882 } 4883 req->Length = 0; 4884 req->DataOffset = 0; 4885 req->RemainingBytes = cpu_to_le32(data_size); 4886 req->Channel = SMB2_CHANNEL_RDMA_V1_INVALIDATE; 4887 if (need_invalidate) 4888 req->Channel = SMB2_CHANNEL_RDMA_V1; 4889 req->WriteChannelInfoOffset = 4890 cpu_to_le16(offsetof(struct smb2_write_req, Buffer)); 4891 req->WriteChannelInfoLength = 4892 cpu_to_le16(sizeof(struct smbd_buffer_descriptor_v1)); 4893 v1 = (struct smbd_buffer_descriptor_v1 *) &req->Buffer[0]; 4894 v1->offset = cpu_to_le64(wdata->mr->mr->iova); 4895 v1->token = cpu_to_le32(wdata->mr->mr->rkey); 4896 v1->length = cpu_to_le32(wdata->mr->mr->length); 4897 } 4898 #endif 4899 iov[0].iov_len = total_len - 1; 4900 iov[0].iov_base = (char *)req; 4901 4902 rqst.rq_iov = iov; 4903 rqst.rq_nvec = 1; 4904 rqst.rq_iter = wdata->iter; 4905 rqst.rq_iter_size = iov_iter_count(&rqst.rq_iter); 4906 if (wdata->replay) 4907 smb2_set_replay(server, &rqst); 4908 #ifdef CONFIG_CIFS_SMB_DIRECT 4909 if (wdata->mr) 4910 iov[0].iov_len += sizeof(struct smbd_buffer_descriptor_v1); 4911 #endif 4912 cifs_dbg(FYI, "async write at %llu %u bytes iter=%zx\n", 4913 io_parms->offset, io_parms->length, iov_iter_count(&rqst.rq_iter)); 4914 4915 #ifdef CONFIG_CIFS_SMB_DIRECT 4916 /* For RDMA read, I/O size is in RemainingBytes not in Length */ 4917 if (!wdata->mr) 4918 req->Length = cpu_to_le32(io_parms->length); 4919 #else 4920 req->Length = cpu_to_le32(io_parms->length); 4921 #endif 4922 4923 if (wdata->credits.value > 0) { 4924 shdr->CreditCharge = cpu_to_le16(DIV_ROUND_UP(wdata->bytes, 4925 SMB2_MAX_BUFFER_SIZE)); 4926 credit_request = le16_to_cpu(shdr->CreditCharge) + 8; 4927 if (server->credits >= server->max_credits) 4928 shdr->CreditRequest = cpu_to_le16(0); 4929 else 4930 shdr->CreditRequest = cpu_to_le16( 4931 min_t(int, server->max_credits - 4932 server->credits, credit_request)); 4933 4934 rc = adjust_credits(server, &wdata->credits, io_parms->length); 4935 if (rc) 4936 goto async_writev_out; 4937 4938 flags |= CIFS_HAS_CREDITS; 4939 } 4940 4941 kref_get(&wdata->refcount); 4942 rc = cifs_call_async(server, &rqst, NULL, smb2_writev_callback, NULL, 4943 wdata, flags, &wdata->credits); 4944 4945 if (rc) { 4946 trace_smb3_write_err(0 /* no xid */, 4947 io_parms->persistent_fid, 4948 io_parms->tcon->tid, 4949 io_parms->tcon->ses->Suid, 4950 io_parms->offset, 4951 io_parms->length, 4952 rc); 4953 kref_put(&wdata->refcount, release); 4954 cifs_stats_fail_inc(tcon, SMB2_WRITE_HE); 4955 } 4956 4957 async_writev_out: 4958 cifs_small_buf_release(req); 4959 return rc; 4960 } 4961 4962 /* 4963 * SMB2_write function gets iov pointer to kvec array with n_vec as a length. 4964 * The length field from io_parms must be at least 1 and indicates a number of 4965 * elements with data to write that begins with position 1 in iov array. All 4966 * data length is specified by count. 4967 */ 4968 int 4969 SMB2_write(const unsigned int xid, struct cifs_io_parms *io_parms, 4970 unsigned int *nbytes, struct kvec *iov, int n_vec) 4971 { 4972 struct smb_rqst rqst; 4973 int rc = 0; 4974 struct smb2_write_req *req = NULL; 4975 struct smb2_write_rsp *rsp = NULL; 4976 int resp_buftype; 4977 struct kvec rsp_iov; 4978 int flags = 0; 4979 unsigned int total_len; 4980 struct TCP_Server_Info *server; 4981 int retries = 0, cur_sleep = 1; 4982 4983 replay_again: 4984 /* reinitialize for possible replay */ 4985 flags = 0; 4986 *nbytes = 0; 4987 if (!io_parms->server) 4988 io_parms->server = cifs_pick_channel(io_parms->tcon->ses); 4989 server = io_parms->server; 4990 if (server == NULL) 4991 return -ECONNABORTED; 4992 4993 if (n_vec < 1) 4994 return rc; 4995 4996 rc = smb2_plain_req_init(SMB2_WRITE, io_parms->tcon, server, 4997 (void **) &req, &total_len); 4998 if (rc) 4999 return rc; 5000 5001 if (smb3_encryption_required(io_parms->tcon)) 5002 flags |= CIFS_TRANSFORM_REQ; 5003 5004 req->hdr.Id.SyncId.ProcessId = cpu_to_le32(io_parms->pid); 5005 5006 req->PersistentFileId = io_parms->persistent_fid; 5007 req->VolatileFileId = io_parms->volatile_fid; 5008 req->WriteChannelInfoOffset = 0; 5009 req->WriteChannelInfoLength = 0; 5010 req->Channel = 0; 5011 req->Length = cpu_to_le32(io_parms->length); 5012 req->Offset = cpu_to_le64(io_parms->offset); 5013 req->DataOffset = cpu_to_le16( 5014 offsetof(struct smb2_write_req, Buffer)); 5015 req->RemainingBytes = 0; 5016 5017 trace_smb3_write_enter(xid, io_parms->persistent_fid, 5018 io_parms->tcon->tid, io_parms->tcon->ses->Suid, 5019 io_parms->offset, io_parms->length); 5020 5021 iov[0].iov_base = (char *)req; 5022 /* 1 for Buffer */ 5023 iov[0].iov_len = total_len - 1; 5024 5025 memset(&rqst, 0, sizeof(struct smb_rqst)); 5026 rqst.rq_iov = iov; 5027 rqst.rq_nvec = n_vec + 1; 5028 5029 if (retries) 5030 smb2_set_replay(server, &rqst); 5031 5032 rc = cifs_send_recv(xid, io_parms->tcon->ses, server, 5033 &rqst, 5034 &resp_buftype, flags, &rsp_iov); 5035 rsp = (struct smb2_write_rsp *)rsp_iov.iov_base; 5036 5037 if (rc) { 5038 trace_smb3_write_err(xid, 5039 req->PersistentFileId, 5040 io_parms->tcon->tid, 5041 io_parms->tcon->ses->Suid, 5042 io_parms->offset, io_parms->length, rc); 5043 cifs_stats_fail_inc(io_parms->tcon, SMB2_WRITE_HE); 5044 cifs_dbg(VFS, "Send error in write = %d\n", rc); 5045 } else { 5046 *nbytes = le32_to_cpu(rsp->DataLength); 5047 trace_smb3_write_done(xid, 5048 req->PersistentFileId, 5049 io_parms->tcon->tid, 5050 io_parms->tcon->ses->Suid, 5051 io_parms->offset, *nbytes); 5052 } 5053 5054 cifs_small_buf_release(req); 5055 free_rsp_buf(resp_buftype, rsp); 5056 5057 if (is_replayable_error(rc) && 5058 smb2_should_replay(io_parms->tcon, &retries, &cur_sleep)) 5059 goto replay_again; 5060 5061 return rc; 5062 } 5063 5064 int posix_info_sid_size(const void *beg, const void *end) 5065 { 5066 size_t subauth; 5067 int total; 5068 5069 if (beg + 1 > end) 5070 return -1; 5071 5072 subauth = *(u8 *)(beg+1); 5073 if (subauth < 1 || subauth > 15) 5074 return -1; 5075 5076 total = 1 + 1 + 6 + 4*subauth; 5077 if (beg + total > end) 5078 return -1; 5079 5080 return total; 5081 } 5082 5083 int posix_info_parse(const void *beg, const void *end, 5084 struct smb2_posix_info_parsed *out) 5085 5086 { 5087 int total_len = 0; 5088 int owner_len, group_len; 5089 int name_len; 5090 const void *owner_sid; 5091 const void *group_sid; 5092 const void *name; 5093 5094 /* if no end bound given, assume payload to be correct */ 5095 if (!end) { 5096 const struct smb2_posix_info *p = beg; 5097 5098 end = beg + le32_to_cpu(p->NextEntryOffset); 5099 /* last element will have a 0 offset, pick a sensible bound */ 5100 if (end == beg) 5101 end += 0xFFFF; 5102 } 5103 5104 /* check base buf */ 5105 if (beg + sizeof(struct smb2_posix_info) > end) 5106 return -1; 5107 total_len = sizeof(struct smb2_posix_info); 5108 5109 /* check owner sid */ 5110 owner_sid = beg + total_len; 5111 owner_len = posix_info_sid_size(owner_sid, end); 5112 if (owner_len < 0) 5113 return -1; 5114 total_len += owner_len; 5115 5116 /* check group sid */ 5117 group_sid = beg + total_len; 5118 group_len = posix_info_sid_size(group_sid, end); 5119 if (group_len < 0) 5120 return -1; 5121 total_len += group_len; 5122 5123 /* check name len */ 5124 if (beg + total_len + 4 > end) 5125 return -1; 5126 name_len = le32_to_cpu(*(__le32 *)(beg + total_len)); 5127 if (name_len < 1 || name_len > 0xFFFF) 5128 return -1; 5129 total_len += 4; 5130 5131 /* check name */ 5132 name = beg + total_len; 5133 if (name + name_len > end) 5134 return -1; 5135 total_len += name_len; 5136 5137 if (out) { 5138 out->base = beg; 5139 out->size = total_len; 5140 out->name_len = name_len; 5141 out->name = name; 5142 memcpy(&out->owner, owner_sid, owner_len); 5143 memcpy(&out->group, group_sid, group_len); 5144 } 5145 return total_len; 5146 } 5147 5148 static int posix_info_extra_size(const void *beg, const void *end) 5149 { 5150 int len = posix_info_parse(beg, end, NULL); 5151 5152 if (len < 0) 5153 return -1; 5154 return len - sizeof(struct smb2_posix_info); 5155 } 5156 5157 static unsigned int 5158 num_entries(int infotype, char *bufstart, char *end_of_buf, char **lastentry, 5159 size_t size) 5160 { 5161 int len; 5162 unsigned int entrycount = 0; 5163 unsigned int next_offset = 0; 5164 char *entryptr; 5165 FILE_DIRECTORY_INFO *dir_info; 5166 5167 if (bufstart == NULL) 5168 return 0; 5169 5170 entryptr = bufstart; 5171 5172 while (1) { 5173 if (entryptr + next_offset < entryptr || 5174 entryptr + next_offset > end_of_buf || 5175 entryptr + next_offset + size > end_of_buf) { 5176 cifs_dbg(VFS, "malformed search entry would overflow\n"); 5177 break; 5178 } 5179 5180 entryptr = entryptr + next_offset; 5181 dir_info = (FILE_DIRECTORY_INFO *)entryptr; 5182 5183 if (infotype == SMB_FIND_FILE_POSIX_INFO) 5184 len = posix_info_extra_size(entryptr, end_of_buf); 5185 else 5186 len = le32_to_cpu(dir_info->FileNameLength); 5187 5188 if (len < 0 || 5189 entryptr + len < entryptr || 5190 entryptr + len > end_of_buf || 5191 entryptr + len + size > end_of_buf) { 5192 cifs_dbg(VFS, "directory entry name would overflow frame end of buf %p\n", 5193 end_of_buf); 5194 break; 5195 } 5196 5197 *lastentry = entryptr; 5198 entrycount++; 5199 5200 next_offset = le32_to_cpu(dir_info->NextEntryOffset); 5201 if (!next_offset) 5202 break; 5203 } 5204 5205 return entrycount; 5206 } 5207 5208 /* 5209 * Readdir/FindFirst 5210 */ 5211 int SMB2_query_directory_init(const unsigned int xid, 5212 struct cifs_tcon *tcon, 5213 struct TCP_Server_Info *server, 5214 struct smb_rqst *rqst, 5215 u64 persistent_fid, u64 volatile_fid, 5216 int index, int info_level) 5217 { 5218 struct smb2_query_directory_req *req; 5219 unsigned char *bufptr; 5220 __le16 asteriks = cpu_to_le16('*'); 5221 unsigned int output_size = CIFSMaxBufSize - 5222 MAX_SMB2_CREATE_RESPONSE_SIZE - 5223 MAX_SMB2_CLOSE_RESPONSE_SIZE; 5224 unsigned int total_len; 5225 struct kvec *iov = rqst->rq_iov; 5226 int len, rc; 5227 5228 rc = smb2_plain_req_init(SMB2_QUERY_DIRECTORY, tcon, server, 5229 (void **) &req, &total_len); 5230 if (rc) 5231 return rc; 5232 5233 switch (info_level) { 5234 case SMB_FIND_FILE_DIRECTORY_INFO: 5235 req->FileInformationClass = FILE_DIRECTORY_INFORMATION; 5236 break; 5237 case SMB_FIND_FILE_ID_FULL_DIR_INFO: 5238 req->FileInformationClass = FILEID_FULL_DIRECTORY_INFORMATION; 5239 break; 5240 case SMB_FIND_FILE_POSIX_INFO: 5241 req->FileInformationClass = SMB_FIND_FILE_POSIX_INFO; 5242 break; 5243 case SMB_FIND_FILE_FULL_DIRECTORY_INFO: 5244 req->FileInformationClass = FILE_FULL_DIRECTORY_INFORMATION; 5245 break; 5246 default: 5247 cifs_tcon_dbg(VFS, "info level %u isn't supported\n", 5248 info_level); 5249 return -EINVAL; 5250 } 5251 5252 req->FileIndex = cpu_to_le32(index); 5253 req->PersistentFileId = persistent_fid; 5254 req->VolatileFileId = volatile_fid; 5255 5256 len = 0x2; 5257 bufptr = req->Buffer; 5258 memcpy(bufptr, &asteriks, len); 5259 5260 req->FileNameOffset = 5261 cpu_to_le16(sizeof(struct smb2_query_directory_req)); 5262 req->FileNameLength = cpu_to_le16(len); 5263 /* 5264 * BB could be 30 bytes or so longer if we used SMB2 specific 5265 * buffer lengths, but this is safe and close enough. 5266 */ 5267 output_size = min_t(unsigned int, output_size, server->maxBuf); 5268 output_size = min_t(unsigned int, output_size, 2 << 15); 5269 req->OutputBufferLength = cpu_to_le32(output_size); 5270 5271 iov[0].iov_base = (char *)req; 5272 /* 1 for Buffer */ 5273 iov[0].iov_len = total_len - 1; 5274 5275 iov[1].iov_base = (char *)(req->Buffer); 5276 iov[1].iov_len = len; 5277 5278 trace_smb3_query_dir_enter(xid, persistent_fid, tcon->tid, 5279 tcon->ses->Suid, index, output_size); 5280 5281 return 0; 5282 } 5283 5284 void SMB2_query_directory_free(struct smb_rqst *rqst) 5285 { 5286 if (rqst && rqst->rq_iov) { 5287 cifs_small_buf_release(rqst->rq_iov[0].iov_base); /* request */ 5288 } 5289 } 5290 5291 int 5292 smb2_parse_query_directory(struct cifs_tcon *tcon, 5293 struct kvec *rsp_iov, 5294 int resp_buftype, 5295 struct cifs_search_info *srch_inf) 5296 { 5297 struct smb2_query_directory_rsp *rsp; 5298 size_t info_buf_size; 5299 char *end_of_smb; 5300 int rc; 5301 5302 rsp = (struct smb2_query_directory_rsp *)rsp_iov->iov_base; 5303 5304 switch (srch_inf->info_level) { 5305 case SMB_FIND_FILE_DIRECTORY_INFO: 5306 info_buf_size = sizeof(FILE_DIRECTORY_INFO); 5307 break; 5308 case SMB_FIND_FILE_ID_FULL_DIR_INFO: 5309 info_buf_size = sizeof(SEARCH_ID_FULL_DIR_INFO); 5310 break; 5311 case SMB_FIND_FILE_POSIX_INFO: 5312 /* note that posix payload are variable size */ 5313 info_buf_size = sizeof(struct smb2_posix_info); 5314 break; 5315 case SMB_FIND_FILE_FULL_DIRECTORY_INFO: 5316 info_buf_size = sizeof(FILE_FULL_DIRECTORY_INFO); 5317 break; 5318 default: 5319 cifs_tcon_dbg(VFS, "info level %u isn't supported\n", 5320 srch_inf->info_level); 5321 return -EINVAL; 5322 } 5323 5324 rc = smb2_validate_iov(le16_to_cpu(rsp->OutputBufferOffset), 5325 le32_to_cpu(rsp->OutputBufferLength), rsp_iov, 5326 info_buf_size); 5327 if (rc) { 5328 cifs_tcon_dbg(VFS, "bad info payload"); 5329 return rc; 5330 } 5331 5332 srch_inf->unicode = true; 5333 5334 if (srch_inf->ntwrk_buf_start) { 5335 if (srch_inf->smallBuf) 5336 cifs_small_buf_release(srch_inf->ntwrk_buf_start); 5337 else 5338 cifs_buf_release(srch_inf->ntwrk_buf_start); 5339 } 5340 srch_inf->ntwrk_buf_start = (char *)rsp; 5341 srch_inf->srch_entries_start = srch_inf->last_entry = 5342 (char *)rsp + le16_to_cpu(rsp->OutputBufferOffset); 5343 end_of_smb = rsp_iov->iov_len + (char *)rsp; 5344 5345 srch_inf->entries_in_buffer = num_entries( 5346 srch_inf->info_level, 5347 srch_inf->srch_entries_start, 5348 end_of_smb, 5349 &srch_inf->last_entry, 5350 info_buf_size); 5351 5352 srch_inf->index_of_last_entry += srch_inf->entries_in_buffer; 5353 cifs_dbg(FYI, "num entries %d last_index %lld srch start %p srch end %p\n", 5354 srch_inf->entries_in_buffer, srch_inf->index_of_last_entry, 5355 srch_inf->srch_entries_start, srch_inf->last_entry); 5356 if (resp_buftype == CIFS_LARGE_BUFFER) 5357 srch_inf->smallBuf = false; 5358 else if (resp_buftype == CIFS_SMALL_BUFFER) 5359 srch_inf->smallBuf = true; 5360 else 5361 cifs_tcon_dbg(VFS, "Invalid search buffer type\n"); 5362 5363 return 0; 5364 } 5365 5366 int 5367 SMB2_query_directory(const unsigned int xid, struct cifs_tcon *tcon, 5368 u64 persistent_fid, u64 volatile_fid, int index, 5369 struct cifs_search_info *srch_inf) 5370 { 5371 struct smb_rqst rqst; 5372 struct kvec iov[SMB2_QUERY_DIRECTORY_IOV_SIZE]; 5373 struct smb2_query_directory_rsp *rsp = NULL; 5374 int resp_buftype = CIFS_NO_BUFFER; 5375 struct kvec rsp_iov; 5376 int rc = 0; 5377 struct cifs_ses *ses = tcon->ses; 5378 struct TCP_Server_Info *server; 5379 int flags = 0; 5380 int retries = 0, cur_sleep = 1; 5381 5382 replay_again: 5383 /* reinitialize for possible replay */ 5384 flags = 0; 5385 server = cifs_pick_channel(ses); 5386 5387 if (!ses || !(ses->server)) 5388 return -EIO; 5389 5390 if (smb3_encryption_required(tcon)) 5391 flags |= CIFS_TRANSFORM_REQ; 5392 5393 memset(&rqst, 0, sizeof(struct smb_rqst)); 5394 memset(&iov, 0, sizeof(iov)); 5395 rqst.rq_iov = iov; 5396 rqst.rq_nvec = SMB2_QUERY_DIRECTORY_IOV_SIZE; 5397 5398 rc = SMB2_query_directory_init(xid, tcon, server, 5399 &rqst, persistent_fid, 5400 volatile_fid, index, 5401 srch_inf->info_level); 5402 if (rc) 5403 goto qdir_exit; 5404 5405 if (retries) 5406 smb2_set_replay(server, &rqst); 5407 5408 rc = cifs_send_recv(xid, ses, server, 5409 &rqst, &resp_buftype, flags, &rsp_iov); 5410 rsp = (struct smb2_query_directory_rsp *)rsp_iov.iov_base; 5411 5412 if (rc) { 5413 if (rc == -ENODATA && 5414 rsp->hdr.Status == STATUS_NO_MORE_FILES) { 5415 trace_smb3_query_dir_done(xid, persistent_fid, 5416 tcon->tid, tcon->ses->Suid, index, 0); 5417 srch_inf->endOfSearch = true; 5418 rc = 0; 5419 } else { 5420 trace_smb3_query_dir_err(xid, persistent_fid, tcon->tid, 5421 tcon->ses->Suid, index, 0, rc); 5422 cifs_stats_fail_inc(tcon, SMB2_QUERY_DIRECTORY_HE); 5423 } 5424 goto qdir_exit; 5425 } 5426 5427 rc = smb2_parse_query_directory(tcon, &rsp_iov, resp_buftype, 5428 srch_inf); 5429 if (rc) { 5430 trace_smb3_query_dir_err(xid, persistent_fid, tcon->tid, 5431 tcon->ses->Suid, index, 0, rc); 5432 goto qdir_exit; 5433 } 5434 resp_buftype = CIFS_NO_BUFFER; 5435 5436 trace_smb3_query_dir_done(xid, persistent_fid, tcon->tid, 5437 tcon->ses->Suid, index, srch_inf->entries_in_buffer); 5438 5439 qdir_exit: 5440 SMB2_query_directory_free(&rqst); 5441 free_rsp_buf(resp_buftype, rsp); 5442 5443 if (is_replayable_error(rc) && 5444 smb2_should_replay(tcon, &retries, &cur_sleep)) 5445 goto replay_again; 5446 5447 return rc; 5448 } 5449 5450 int 5451 SMB2_set_info_init(struct cifs_tcon *tcon, struct TCP_Server_Info *server, 5452 struct smb_rqst *rqst, 5453 u64 persistent_fid, u64 volatile_fid, u32 pid, 5454 u8 info_class, u8 info_type, u32 additional_info, 5455 void **data, unsigned int *size) 5456 { 5457 struct smb2_set_info_req *req; 5458 struct kvec *iov = rqst->rq_iov; 5459 unsigned int i, total_len; 5460 int rc; 5461 5462 rc = smb2_plain_req_init(SMB2_SET_INFO, tcon, server, 5463 (void **) &req, &total_len); 5464 if (rc) 5465 return rc; 5466 5467 req->hdr.Id.SyncId.ProcessId = cpu_to_le32(pid); 5468 req->InfoType = info_type; 5469 req->FileInfoClass = info_class; 5470 req->PersistentFileId = persistent_fid; 5471 req->VolatileFileId = volatile_fid; 5472 req->AdditionalInformation = cpu_to_le32(additional_info); 5473 5474 req->BufferOffset = cpu_to_le16(sizeof(struct smb2_set_info_req)); 5475 req->BufferLength = cpu_to_le32(*size); 5476 5477 memcpy(req->Buffer, *data, *size); 5478 total_len += *size; 5479 5480 iov[0].iov_base = (char *)req; 5481 /* 1 for Buffer */ 5482 iov[0].iov_len = total_len - 1; 5483 5484 for (i = 1; i < rqst->rq_nvec; i++) { 5485 le32_add_cpu(&req->BufferLength, size[i]); 5486 iov[i].iov_base = (char *)data[i]; 5487 iov[i].iov_len = size[i]; 5488 } 5489 5490 return 0; 5491 } 5492 5493 void 5494 SMB2_set_info_free(struct smb_rqst *rqst) 5495 { 5496 if (rqst && rqst->rq_iov) 5497 cifs_buf_release(rqst->rq_iov[0].iov_base); /* request */ 5498 } 5499 5500 static int 5501 send_set_info(const unsigned int xid, struct cifs_tcon *tcon, 5502 u64 persistent_fid, u64 volatile_fid, u32 pid, u8 info_class, 5503 u8 info_type, u32 additional_info, unsigned int num, 5504 void **data, unsigned int *size) 5505 { 5506 struct smb_rqst rqst; 5507 struct smb2_set_info_rsp *rsp = NULL; 5508 struct kvec *iov; 5509 struct kvec rsp_iov; 5510 int rc = 0; 5511 int resp_buftype; 5512 struct cifs_ses *ses = tcon->ses; 5513 struct TCP_Server_Info *server; 5514 int flags = 0; 5515 int retries = 0, cur_sleep = 1; 5516 5517 replay_again: 5518 /* reinitialize for possible replay */ 5519 flags = 0; 5520 server = cifs_pick_channel(ses); 5521 5522 if (!ses || !server) 5523 return -EIO; 5524 5525 if (!num) 5526 return -EINVAL; 5527 5528 if (smb3_encryption_required(tcon)) 5529 flags |= CIFS_TRANSFORM_REQ; 5530 5531 iov = kmalloc_array(num, sizeof(struct kvec), GFP_KERNEL); 5532 if (!iov) 5533 return -ENOMEM; 5534 5535 memset(&rqst, 0, sizeof(struct smb_rqst)); 5536 rqst.rq_iov = iov; 5537 rqst.rq_nvec = num; 5538 5539 rc = SMB2_set_info_init(tcon, server, 5540 &rqst, persistent_fid, volatile_fid, pid, 5541 info_class, info_type, additional_info, 5542 data, size); 5543 if (rc) { 5544 kfree(iov); 5545 return rc; 5546 } 5547 5548 if (retries) 5549 smb2_set_replay(server, &rqst); 5550 5551 rc = cifs_send_recv(xid, ses, server, 5552 &rqst, &resp_buftype, flags, 5553 &rsp_iov); 5554 SMB2_set_info_free(&rqst); 5555 rsp = (struct smb2_set_info_rsp *)rsp_iov.iov_base; 5556 5557 if (rc != 0) { 5558 cifs_stats_fail_inc(tcon, SMB2_SET_INFO_HE); 5559 trace_smb3_set_info_err(xid, persistent_fid, tcon->tid, 5560 ses->Suid, info_class, (__u32)info_type, rc); 5561 } 5562 5563 free_rsp_buf(resp_buftype, rsp); 5564 kfree(iov); 5565 5566 if (is_replayable_error(rc) && 5567 smb2_should_replay(tcon, &retries, &cur_sleep)) 5568 goto replay_again; 5569 5570 return rc; 5571 } 5572 5573 int 5574 SMB2_set_eof(const unsigned int xid, struct cifs_tcon *tcon, u64 persistent_fid, 5575 u64 volatile_fid, u32 pid, loff_t new_eof) 5576 { 5577 struct smb2_file_eof_info info; 5578 void *data; 5579 unsigned int size; 5580 5581 info.EndOfFile = cpu_to_le64(new_eof); 5582 5583 data = &info; 5584 size = sizeof(struct smb2_file_eof_info); 5585 5586 trace_smb3_set_eof(xid, persistent_fid, tcon->tid, tcon->ses->Suid, new_eof); 5587 5588 return send_set_info(xid, tcon, persistent_fid, volatile_fid, 5589 pid, FILE_END_OF_FILE_INFORMATION, SMB2_O_INFO_FILE, 5590 0, 1, &data, &size); 5591 } 5592 5593 int 5594 SMB2_set_acl(const unsigned int xid, struct cifs_tcon *tcon, 5595 u64 persistent_fid, u64 volatile_fid, 5596 struct cifs_ntsd *pnntsd, int pacllen, int aclflag) 5597 { 5598 return send_set_info(xid, tcon, persistent_fid, volatile_fid, 5599 current->tgid, 0, SMB2_O_INFO_SECURITY, aclflag, 5600 1, (void **)&pnntsd, &pacllen); 5601 } 5602 5603 int 5604 SMB2_set_ea(const unsigned int xid, struct cifs_tcon *tcon, 5605 u64 persistent_fid, u64 volatile_fid, 5606 struct smb2_file_full_ea_info *buf, int len) 5607 { 5608 return send_set_info(xid, tcon, persistent_fid, volatile_fid, 5609 current->tgid, FILE_FULL_EA_INFORMATION, SMB2_O_INFO_FILE, 5610 0, 1, (void **)&buf, &len); 5611 } 5612 5613 int 5614 SMB2_oplock_break(const unsigned int xid, struct cifs_tcon *tcon, 5615 const u64 persistent_fid, const u64 volatile_fid, 5616 __u8 oplock_level) 5617 { 5618 struct smb_rqst rqst; 5619 int rc; 5620 struct smb2_oplock_break *req = NULL; 5621 struct cifs_ses *ses = tcon->ses; 5622 struct TCP_Server_Info *server; 5623 int flags = CIFS_OBREAK_OP; 5624 unsigned int total_len; 5625 struct kvec iov[1]; 5626 struct kvec rsp_iov; 5627 int resp_buf_type; 5628 int retries = 0, cur_sleep = 1; 5629 5630 replay_again: 5631 /* reinitialize for possible replay */ 5632 flags = CIFS_OBREAK_OP; 5633 server = cifs_pick_channel(ses); 5634 5635 cifs_dbg(FYI, "SMB2_oplock_break\n"); 5636 rc = smb2_plain_req_init(SMB2_OPLOCK_BREAK, tcon, server, 5637 (void **) &req, &total_len); 5638 if (rc) 5639 return rc; 5640 5641 if (smb3_encryption_required(tcon)) 5642 flags |= CIFS_TRANSFORM_REQ; 5643 5644 req->VolatileFid = volatile_fid; 5645 req->PersistentFid = persistent_fid; 5646 req->OplockLevel = oplock_level; 5647 req->hdr.CreditRequest = cpu_to_le16(1); 5648 5649 flags |= CIFS_NO_RSP_BUF; 5650 5651 iov[0].iov_base = (char *)req; 5652 iov[0].iov_len = total_len; 5653 5654 memset(&rqst, 0, sizeof(struct smb_rqst)); 5655 rqst.rq_iov = iov; 5656 rqst.rq_nvec = 1; 5657 5658 if (retries) 5659 smb2_set_replay(server, &rqst); 5660 5661 rc = cifs_send_recv(xid, ses, server, 5662 &rqst, &resp_buf_type, flags, &rsp_iov); 5663 cifs_small_buf_release(req); 5664 if (rc) { 5665 cifs_stats_fail_inc(tcon, SMB2_OPLOCK_BREAK_HE); 5666 cifs_dbg(FYI, "Send error in Oplock Break = %d\n", rc); 5667 } 5668 5669 if (is_replayable_error(rc) && 5670 smb2_should_replay(tcon, &retries, &cur_sleep)) 5671 goto replay_again; 5672 5673 return rc; 5674 } 5675 5676 void 5677 smb2_copy_fs_info_to_kstatfs(struct smb2_fs_full_size_info *pfs_inf, 5678 struct kstatfs *kst) 5679 { 5680 kst->f_bsize = le32_to_cpu(pfs_inf->BytesPerSector) * 5681 le32_to_cpu(pfs_inf->SectorsPerAllocationUnit); 5682 kst->f_blocks = le64_to_cpu(pfs_inf->TotalAllocationUnits); 5683 kst->f_bfree = kst->f_bavail = 5684 le64_to_cpu(pfs_inf->CallerAvailableAllocationUnits); 5685 return; 5686 } 5687 5688 static void 5689 copy_posix_fs_info_to_kstatfs(FILE_SYSTEM_POSIX_INFO *response_data, 5690 struct kstatfs *kst) 5691 { 5692 kst->f_bsize = le32_to_cpu(response_data->BlockSize); 5693 kst->f_blocks = le64_to_cpu(response_data->TotalBlocks); 5694 kst->f_bfree = le64_to_cpu(response_data->BlocksAvail); 5695 if (response_data->UserBlocksAvail == cpu_to_le64(-1)) 5696 kst->f_bavail = kst->f_bfree; 5697 else 5698 kst->f_bavail = le64_to_cpu(response_data->UserBlocksAvail); 5699 if (response_data->TotalFileNodes != cpu_to_le64(-1)) 5700 kst->f_files = le64_to_cpu(response_data->TotalFileNodes); 5701 if (response_data->FreeFileNodes != cpu_to_le64(-1)) 5702 kst->f_ffree = le64_to_cpu(response_data->FreeFileNodes); 5703 5704 return; 5705 } 5706 5707 static int 5708 build_qfs_info_req(struct kvec *iov, struct cifs_tcon *tcon, 5709 struct TCP_Server_Info *server, 5710 int level, int outbuf_len, u64 persistent_fid, 5711 u64 volatile_fid) 5712 { 5713 int rc; 5714 struct smb2_query_info_req *req; 5715 unsigned int total_len; 5716 5717 cifs_dbg(FYI, "Query FSInfo level %d\n", level); 5718 5719 if ((tcon->ses == NULL) || server == NULL) 5720 return -EIO; 5721 5722 rc = smb2_plain_req_init(SMB2_QUERY_INFO, tcon, server, 5723 (void **) &req, &total_len); 5724 if (rc) 5725 return rc; 5726 5727 req->InfoType = SMB2_O_INFO_FILESYSTEM; 5728 req->FileInfoClass = level; 5729 req->PersistentFileId = persistent_fid; 5730 req->VolatileFileId = volatile_fid; 5731 /* 1 for pad */ 5732 req->InputBufferOffset = 5733 cpu_to_le16(sizeof(struct smb2_query_info_req)); 5734 req->OutputBufferLength = cpu_to_le32( 5735 outbuf_len + sizeof(struct smb2_query_info_rsp)); 5736 5737 iov->iov_base = (char *)req; 5738 iov->iov_len = total_len; 5739 return 0; 5740 } 5741 5742 static inline void free_qfs_info_req(struct kvec *iov) 5743 { 5744 cifs_buf_release(iov->iov_base); 5745 } 5746 5747 int 5748 SMB311_posix_qfs_info(const unsigned int xid, struct cifs_tcon *tcon, 5749 u64 persistent_fid, u64 volatile_fid, struct kstatfs *fsdata) 5750 { 5751 struct smb_rqst rqst; 5752 struct smb2_query_info_rsp *rsp = NULL; 5753 struct kvec iov; 5754 struct kvec rsp_iov; 5755 int rc = 0; 5756 int resp_buftype; 5757 struct cifs_ses *ses = tcon->ses; 5758 struct TCP_Server_Info *server; 5759 FILE_SYSTEM_POSIX_INFO *info = NULL; 5760 int flags = 0; 5761 int retries = 0, cur_sleep = 1; 5762 5763 replay_again: 5764 /* reinitialize for possible replay */ 5765 flags = 0; 5766 server = cifs_pick_channel(ses); 5767 5768 rc = build_qfs_info_req(&iov, tcon, server, 5769 FS_POSIX_INFORMATION, 5770 sizeof(FILE_SYSTEM_POSIX_INFO), 5771 persistent_fid, volatile_fid); 5772 if (rc) 5773 return rc; 5774 5775 if (smb3_encryption_required(tcon)) 5776 flags |= CIFS_TRANSFORM_REQ; 5777 5778 memset(&rqst, 0, sizeof(struct smb_rqst)); 5779 rqst.rq_iov = &iov; 5780 rqst.rq_nvec = 1; 5781 5782 if (retries) 5783 smb2_set_replay(server, &rqst); 5784 5785 rc = cifs_send_recv(xid, ses, server, 5786 &rqst, &resp_buftype, flags, &rsp_iov); 5787 free_qfs_info_req(&iov); 5788 if (rc) { 5789 cifs_stats_fail_inc(tcon, SMB2_QUERY_INFO_HE); 5790 goto posix_qfsinf_exit; 5791 } 5792 rsp = (struct smb2_query_info_rsp *)rsp_iov.iov_base; 5793 5794 info = (FILE_SYSTEM_POSIX_INFO *)( 5795 le16_to_cpu(rsp->OutputBufferOffset) + (char *)rsp); 5796 rc = smb2_validate_iov(le16_to_cpu(rsp->OutputBufferOffset), 5797 le32_to_cpu(rsp->OutputBufferLength), &rsp_iov, 5798 sizeof(FILE_SYSTEM_POSIX_INFO)); 5799 if (!rc) 5800 copy_posix_fs_info_to_kstatfs(info, fsdata); 5801 5802 posix_qfsinf_exit: 5803 free_rsp_buf(resp_buftype, rsp_iov.iov_base); 5804 5805 if (is_replayable_error(rc) && 5806 smb2_should_replay(tcon, &retries, &cur_sleep)) 5807 goto replay_again; 5808 5809 return rc; 5810 } 5811 5812 int 5813 SMB2_QFS_info(const unsigned int xid, struct cifs_tcon *tcon, 5814 u64 persistent_fid, u64 volatile_fid, struct kstatfs *fsdata) 5815 { 5816 struct smb_rqst rqst; 5817 struct smb2_query_info_rsp *rsp = NULL; 5818 struct kvec iov; 5819 struct kvec rsp_iov; 5820 int rc = 0; 5821 int resp_buftype; 5822 struct cifs_ses *ses = tcon->ses; 5823 struct TCP_Server_Info *server; 5824 struct smb2_fs_full_size_info *info = NULL; 5825 int flags = 0; 5826 int retries = 0, cur_sleep = 1; 5827 5828 replay_again: 5829 /* reinitialize for possible replay */ 5830 flags = 0; 5831 server = cifs_pick_channel(ses); 5832 5833 rc = build_qfs_info_req(&iov, tcon, server, 5834 FS_FULL_SIZE_INFORMATION, 5835 sizeof(struct smb2_fs_full_size_info), 5836 persistent_fid, volatile_fid); 5837 if (rc) 5838 return rc; 5839 5840 if (smb3_encryption_required(tcon)) 5841 flags |= CIFS_TRANSFORM_REQ; 5842 5843 memset(&rqst, 0, sizeof(struct smb_rqst)); 5844 rqst.rq_iov = &iov; 5845 rqst.rq_nvec = 1; 5846 5847 if (retries) 5848 smb2_set_replay(server, &rqst); 5849 5850 rc = cifs_send_recv(xid, ses, server, 5851 &rqst, &resp_buftype, flags, &rsp_iov); 5852 free_qfs_info_req(&iov); 5853 if (rc) { 5854 cifs_stats_fail_inc(tcon, SMB2_QUERY_INFO_HE); 5855 goto qfsinf_exit; 5856 } 5857 rsp = (struct smb2_query_info_rsp *)rsp_iov.iov_base; 5858 5859 info = (struct smb2_fs_full_size_info *)( 5860 le16_to_cpu(rsp->OutputBufferOffset) + (char *)rsp); 5861 rc = smb2_validate_iov(le16_to_cpu(rsp->OutputBufferOffset), 5862 le32_to_cpu(rsp->OutputBufferLength), &rsp_iov, 5863 sizeof(struct smb2_fs_full_size_info)); 5864 if (!rc) 5865 smb2_copy_fs_info_to_kstatfs(info, fsdata); 5866 5867 qfsinf_exit: 5868 free_rsp_buf(resp_buftype, rsp_iov.iov_base); 5869 5870 if (is_replayable_error(rc) && 5871 smb2_should_replay(tcon, &retries, &cur_sleep)) 5872 goto replay_again; 5873 5874 return rc; 5875 } 5876 5877 int 5878 SMB2_QFS_attr(const unsigned int xid, struct cifs_tcon *tcon, 5879 u64 persistent_fid, u64 volatile_fid, int level) 5880 { 5881 struct smb_rqst rqst; 5882 struct smb2_query_info_rsp *rsp = NULL; 5883 struct kvec iov; 5884 struct kvec rsp_iov; 5885 int rc = 0; 5886 int resp_buftype, max_len, min_len; 5887 struct cifs_ses *ses = tcon->ses; 5888 struct TCP_Server_Info *server; 5889 unsigned int rsp_len, offset; 5890 int flags = 0; 5891 int retries = 0, cur_sleep = 1; 5892 5893 replay_again: 5894 /* reinitialize for possible replay */ 5895 flags = 0; 5896 server = cifs_pick_channel(ses); 5897 5898 if (level == FS_DEVICE_INFORMATION) { 5899 max_len = sizeof(FILE_SYSTEM_DEVICE_INFO); 5900 min_len = sizeof(FILE_SYSTEM_DEVICE_INFO); 5901 } else if (level == FS_ATTRIBUTE_INFORMATION) { 5902 max_len = sizeof(FILE_SYSTEM_ATTRIBUTE_INFO); 5903 min_len = MIN_FS_ATTR_INFO_SIZE; 5904 } else if (level == FS_SECTOR_SIZE_INFORMATION) { 5905 max_len = sizeof(struct smb3_fs_ss_info); 5906 min_len = sizeof(struct smb3_fs_ss_info); 5907 } else if (level == FS_VOLUME_INFORMATION) { 5908 max_len = sizeof(struct smb3_fs_vol_info) + MAX_VOL_LABEL_LEN; 5909 min_len = sizeof(struct smb3_fs_vol_info); 5910 } else { 5911 cifs_dbg(FYI, "Invalid qfsinfo level %d\n", level); 5912 return -EINVAL; 5913 } 5914 5915 rc = build_qfs_info_req(&iov, tcon, server, 5916 level, max_len, 5917 persistent_fid, volatile_fid); 5918 if (rc) 5919 return rc; 5920 5921 if (smb3_encryption_required(tcon)) 5922 flags |= CIFS_TRANSFORM_REQ; 5923 5924 memset(&rqst, 0, sizeof(struct smb_rqst)); 5925 rqst.rq_iov = &iov; 5926 rqst.rq_nvec = 1; 5927 5928 if (retries) 5929 smb2_set_replay(server, &rqst); 5930 5931 rc = cifs_send_recv(xid, ses, server, 5932 &rqst, &resp_buftype, flags, &rsp_iov); 5933 free_qfs_info_req(&iov); 5934 if (rc) { 5935 cifs_stats_fail_inc(tcon, SMB2_QUERY_INFO_HE); 5936 goto qfsattr_exit; 5937 } 5938 rsp = (struct smb2_query_info_rsp *)rsp_iov.iov_base; 5939 5940 rsp_len = le32_to_cpu(rsp->OutputBufferLength); 5941 offset = le16_to_cpu(rsp->OutputBufferOffset); 5942 rc = smb2_validate_iov(offset, rsp_len, &rsp_iov, min_len); 5943 if (rc) 5944 goto qfsattr_exit; 5945 5946 if (level == FS_ATTRIBUTE_INFORMATION) 5947 memcpy(&tcon->fsAttrInfo, offset 5948 + (char *)rsp, min_t(unsigned int, 5949 rsp_len, max_len)); 5950 else if (level == FS_DEVICE_INFORMATION) 5951 memcpy(&tcon->fsDevInfo, offset 5952 + (char *)rsp, sizeof(FILE_SYSTEM_DEVICE_INFO)); 5953 else if (level == FS_SECTOR_SIZE_INFORMATION) { 5954 struct smb3_fs_ss_info *ss_info = (struct smb3_fs_ss_info *) 5955 (offset + (char *)rsp); 5956 tcon->ss_flags = le32_to_cpu(ss_info->Flags); 5957 tcon->perf_sector_size = 5958 le32_to_cpu(ss_info->PhysicalBytesPerSectorForPerf); 5959 } else if (level == FS_VOLUME_INFORMATION) { 5960 struct smb3_fs_vol_info *vol_info = (struct smb3_fs_vol_info *) 5961 (offset + (char *)rsp); 5962 tcon->vol_serial_number = vol_info->VolumeSerialNumber; 5963 tcon->vol_create_time = vol_info->VolumeCreationTime; 5964 } 5965 5966 qfsattr_exit: 5967 free_rsp_buf(resp_buftype, rsp_iov.iov_base); 5968 5969 if (is_replayable_error(rc) && 5970 smb2_should_replay(tcon, &retries, &cur_sleep)) 5971 goto replay_again; 5972 5973 return rc; 5974 } 5975 5976 int 5977 smb2_lockv(const unsigned int xid, struct cifs_tcon *tcon, 5978 const __u64 persist_fid, const __u64 volatile_fid, const __u32 pid, 5979 const __u32 num_lock, struct smb2_lock_element *buf) 5980 { 5981 struct smb_rqst rqst; 5982 int rc = 0; 5983 struct smb2_lock_req *req = NULL; 5984 struct kvec iov[2]; 5985 struct kvec rsp_iov; 5986 int resp_buf_type; 5987 unsigned int count; 5988 int flags = CIFS_NO_RSP_BUF; 5989 unsigned int total_len; 5990 struct TCP_Server_Info *server; 5991 int retries = 0, cur_sleep = 1; 5992 5993 replay_again: 5994 /* reinitialize for possible replay */ 5995 flags = CIFS_NO_RSP_BUF; 5996 server = cifs_pick_channel(tcon->ses); 5997 5998 cifs_dbg(FYI, "smb2_lockv num lock %d\n", num_lock); 5999 6000 rc = smb2_plain_req_init(SMB2_LOCK, tcon, server, 6001 (void **) &req, &total_len); 6002 if (rc) 6003 return rc; 6004 6005 if (smb3_encryption_required(tcon)) 6006 flags |= CIFS_TRANSFORM_REQ; 6007 6008 req->hdr.Id.SyncId.ProcessId = cpu_to_le32(pid); 6009 req->LockCount = cpu_to_le16(num_lock); 6010 6011 req->PersistentFileId = persist_fid; 6012 req->VolatileFileId = volatile_fid; 6013 6014 count = num_lock * sizeof(struct smb2_lock_element); 6015 6016 iov[0].iov_base = (char *)req; 6017 iov[0].iov_len = total_len - sizeof(struct smb2_lock_element); 6018 iov[1].iov_base = (char *)buf; 6019 iov[1].iov_len = count; 6020 6021 cifs_stats_inc(&tcon->stats.cifs_stats.num_locks); 6022 6023 memset(&rqst, 0, sizeof(struct smb_rqst)); 6024 rqst.rq_iov = iov; 6025 rqst.rq_nvec = 2; 6026 6027 if (retries) 6028 smb2_set_replay(server, &rqst); 6029 6030 rc = cifs_send_recv(xid, tcon->ses, server, 6031 &rqst, &resp_buf_type, flags, 6032 &rsp_iov); 6033 cifs_small_buf_release(req); 6034 if (rc) { 6035 cifs_dbg(FYI, "Send error in smb2_lockv = %d\n", rc); 6036 cifs_stats_fail_inc(tcon, SMB2_LOCK_HE); 6037 trace_smb3_lock_err(xid, persist_fid, tcon->tid, 6038 tcon->ses->Suid, rc); 6039 } 6040 6041 if (is_replayable_error(rc) && 6042 smb2_should_replay(tcon, &retries, &cur_sleep)) 6043 goto replay_again; 6044 6045 return rc; 6046 } 6047 6048 int 6049 SMB2_lock(const unsigned int xid, struct cifs_tcon *tcon, 6050 const __u64 persist_fid, const __u64 volatile_fid, const __u32 pid, 6051 const __u64 length, const __u64 offset, const __u32 lock_flags, 6052 const bool wait) 6053 { 6054 struct smb2_lock_element lock; 6055 6056 lock.Offset = cpu_to_le64(offset); 6057 lock.Length = cpu_to_le64(length); 6058 lock.Flags = cpu_to_le32(lock_flags); 6059 if (!wait && lock_flags != SMB2_LOCKFLAG_UNLOCK) 6060 lock.Flags |= cpu_to_le32(SMB2_LOCKFLAG_FAIL_IMMEDIATELY); 6061 6062 return smb2_lockv(xid, tcon, persist_fid, volatile_fid, pid, 1, &lock); 6063 } 6064 6065 int 6066 SMB2_lease_break(const unsigned int xid, struct cifs_tcon *tcon, 6067 __u8 *lease_key, const __le32 lease_state) 6068 { 6069 struct smb_rqst rqst; 6070 int rc; 6071 struct smb2_lease_ack *req = NULL; 6072 struct cifs_ses *ses = tcon->ses; 6073 int flags = CIFS_OBREAK_OP; 6074 unsigned int total_len; 6075 struct kvec iov[1]; 6076 struct kvec rsp_iov; 6077 int resp_buf_type; 6078 __u64 *please_key_high; 6079 __u64 *please_key_low; 6080 struct TCP_Server_Info *server = cifs_pick_channel(tcon->ses); 6081 6082 cifs_dbg(FYI, "SMB2_lease_break\n"); 6083 rc = smb2_plain_req_init(SMB2_OPLOCK_BREAK, tcon, server, 6084 (void **) &req, &total_len); 6085 if (rc) 6086 return rc; 6087 6088 if (smb3_encryption_required(tcon)) 6089 flags |= CIFS_TRANSFORM_REQ; 6090 6091 req->hdr.CreditRequest = cpu_to_le16(1); 6092 req->StructureSize = cpu_to_le16(36); 6093 total_len += 12; 6094 6095 memcpy(req->LeaseKey, lease_key, 16); 6096 req->LeaseState = lease_state; 6097 6098 flags |= CIFS_NO_RSP_BUF; 6099 6100 iov[0].iov_base = (char *)req; 6101 iov[0].iov_len = total_len; 6102 6103 memset(&rqst, 0, sizeof(struct smb_rqst)); 6104 rqst.rq_iov = iov; 6105 rqst.rq_nvec = 1; 6106 6107 rc = cifs_send_recv(xid, ses, server, 6108 &rqst, &resp_buf_type, flags, &rsp_iov); 6109 cifs_small_buf_release(req); 6110 6111 please_key_low = (__u64 *)lease_key; 6112 please_key_high = (__u64 *)(lease_key+8); 6113 if (rc) { 6114 cifs_stats_fail_inc(tcon, SMB2_OPLOCK_BREAK_HE); 6115 trace_smb3_lease_err(le32_to_cpu(lease_state), tcon->tid, 6116 ses->Suid, *please_key_low, *please_key_high, rc); 6117 cifs_dbg(FYI, "Send error in Lease Break = %d\n", rc); 6118 } else 6119 trace_smb3_lease_done(le32_to_cpu(lease_state), tcon->tid, 6120 ses->Suid, *please_key_low, *please_key_high); 6121 6122 return rc; 6123 } 6124