1 // SPDX-License-Identifier: LGPL-2.1 2 /* 3 * 4 * Copyright (C) International Business Machines Corp., 2009, 2013 5 * Etersoft, 2012 6 * Author(s): Steve French (sfrench@us.ibm.com) 7 * Pavel Shilovsky (pshilovsky@samba.org) 2012 8 * 9 * Contains the routines for constructing the SMB2 PDUs themselves 10 * 11 */ 12 13 /* SMB2 PDU handling routines here - except for leftovers (eg session setup) */ 14 /* Note that there are handle based routines which must be */ 15 /* treated slightly differently for reconnection purposes since we never */ 16 /* want to reuse a stale file handle and only the caller knows the file info */ 17 18 #include <linux/fs.h> 19 #include <linux/kernel.h> 20 #include <linux/vfs.h> 21 #include <linux/task_io_accounting_ops.h> 22 #include <linux/uaccess.h> 23 #include <linux/uuid.h> 24 #include <linux/pagemap.h> 25 #include <linux/xattr.h> 26 #include "cifsglob.h" 27 #include "cifsacl.h" 28 #include "cifsproto.h" 29 #include "smb2proto.h" 30 #include "cifs_unicode.h" 31 #include "cifs_debug.h" 32 #include "ntlmssp.h" 33 #include "smb2status.h" 34 #include "smb2glob.h" 35 #include "cifspdu.h" 36 #include "cifs_spnego.h" 37 #include "smbdirect.h" 38 #include "trace.h" 39 #ifdef CONFIG_CIFS_DFS_UPCALL 40 #include "dfs_cache.h" 41 #endif 42 #include "cached_dir.h" 43 44 /* 45 * The following table defines the expected "StructureSize" of SMB2 requests 46 * in order by SMB2 command. This is similar to "wct" in SMB/CIFS requests. 47 * 48 * Note that commands are defined in smb2pdu.h in le16 but the array below is 49 * indexed by command in host byte order. 50 */ 51 static const int smb2_req_struct_sizes[NUMBER_OF_SMB2_COMMANDS] = { 52 /* SMB2_NEGOTIATE */ 36, 53 /* SMB2_SESSION_SETUP */ 25, 54 /* SMB2_LOGOFF */ 4, 55 /* SMB2_TREE_CONNECT */ 9, 56 /* SMB2_TREE_DISCONNECT */ 4, 57 /* SMB2_CREATE */ 57, 58 /* SMB2_CLOSE */ 24, 59 /* SMB2_FLUSH */ 24, 60 /* SMB2_READ */ 49, 61 /* SMB2_WRITE */ 49, 62 /* SMB2_LOCK */ 48, 63 /* SMB2_IOCTL */ 57, 64 /* SMB2_CANCEL */ 4, 65 /* SMB2_ECHO */ 4, 66 /* SMB2_QUERY_DIRECTORY */ 33, 67 /* SMB2_CHANGE_NOTIFY */ 32, 68 /* SMB2_QUERY_INFO */ 41, 69 /* SMB2_SET_INFO */ 33, 70 /* SMB2_OPLOCK_BREAK */ 24 /* BB this is 36 for LEASE_BREAK variant */ 71 }; 72 73 int smb3_encryption_required(const struct cifs_tcon *tcon) 74 { 75 if (!tcon || !tcon->ses) 76 return 0; 77 if ((tcon->ses->session_flags & SMB2_SESSION_FLAG_ENCRYPT_DATA) || 78 (tcon->share_flags & SHI1005_FLAGS_ENCRYPT_DATA)) 79 return 1; 80 if (tcon->seal && 81 (tcon->ses->server->capabilities & SMB2_GLOBAL_CAP_ENCRYPTION)) 82 return 1; 83 return 0; 84 } 85 86 static void 87 smb2_hdr_assemble(struct smb2_hdr *shdr, __le16 smb2_cmd, 88 const struct cifs_tcon *tcon, 89 struct TCP_Server_Info *server) 90 { 91 struct smb3_hdr_req *smb3_hdr; 92 shdr->ProtocolId = SMB2_PROTO_NUMBER; 93 shdr->StructureSize = cpu_to_le16(64); 94 shdr->Command = smb2_cmd; 95 if (server->dialect >= SMB30_PROT_ID) { 96 /* After reconnect SMB3 must set ChannelSequence on subsequent reqs */ 97 smb3_hdr = (struct smb3_hdr_req *)shdr; 98 /* if primary channel is not set yet, use default channel for chan sequence num */ 99 if (SERVER_IS_CHAN(server)) 100 smb3_hdr->ChannelSequence = 101 cpu_to_le16(server->primary_server->channel_sequence_num); 102 else 103 smb3_hdr->ChannelSequence = cpu_to_le16(server->channel_sequence_num); 104 } 105 if (server) { 106 spin_lock(&server->req_lock); 107 /* Request up to 10 credits but don't go over the limit. */ 108 if (server->credits >= server->max_credits) 109 shdr->CreditRequest = cpu_to_le16(0); 110 else 111 shdr->CreditRequest = cpu_to_le16( 112 min_t(int, server->max_credits - 113 server->credits, 10)); 114 spin_unlock(&server->req_lock); 115 } else { 116 shdr->CreditRequest = cpu_to_le16(2); 117 } 118 shdr->Id.SyncId.ProcessId = cpu_to_le32((__u16)current->tgid); 119 120 if (!tcon) 121 goto out; 122 123 /* GLOBAL_CAP_LARGE_MTU will only be set if dialect > SMB2.02 */ 124 /* See sections 2.2.4 and 3.2.4.1.5 of MS-SMB2 */ 125 if (server && (server->capabilities & SMB2_GLOBAL_CAP_LARGE_MTU)) 126 shdr->CreditCharge = cpu_to_le16(1); 127 /* else CreditCharge MBZ */ 128 129 shdr->Id.SyncId.TreeId = cpu_to_le32(tcon->tid); 130 /* Uid is not converted */ 131 if (tcon->ses) 132 shdr->SessionId = cpu_to_le64(tcon->ses->Suid); 133 134 /* 135 * If we would set SMB2_FLAGS_DFS_OPERATIONS on open we also would have 136 * to pass the path on the Open SMB prefixed by \\server\share. 137 * Not sure when we would need to do the augmented path (if ever) and 138 * setting this flag breaks the SMB2 open operation since it is 139 * illegal to send an empty path name (without \\server\share prefix) 140 * when the DFS flag is set in the SMB open header. We could 141 * consider setting the flag on all operations other than open 142 * but it is safer to net set it for now. 143 */ 144 /* if (tcon->share_flags & SHI1005_FLAGS_DFS) 145 shdr->Flags |= SMB2_FLAGS_DFS_OPERATIONS; */ 146 147 if (server && server->sign && !smb3_encryption_required(tcon)) 148 shdr->Flags |= SMB2_FLAGS_SIGNED; 149 out: 150 return; 151 } 152 153 static int 154 smb2_reconnect(__le16 smb2_command, struct cifs_tcon *tcon, 155 struct TCP_Server_Info *server) 156 { 157 int rc = 0; 158 struct nls_table *nls_codepage = NULL; 159 struct cifs_ses *ses; 160 161 /* 162 * SMB2s NegProt, SessSetup, Logoff do not have tcon yet so 163 * check for tcp and smb session status done differently 164 * for those three - in the calling routine. 165 */ 166 if (tcon == NULL) 167 return 0; 168 169 /* 170 * Need to also skip SMB2_IOCTL because it is used for checking nested dfs links in 171 * cifs_tree_connect(). 172 */ 173 if (smb2_command == SMB2_TREE_CONNECT || smb2_command == SMB2_IOCTL) 174 return 0; 175 176 spin_lock(&tcon->tc_lock); 177 if (tcon->status == TID_EXITING) { 178 /* 179 * only tree disconnect allowed when disconnecting ... 180 */ 181 if (smb2_command != SMB2_TREE_DISCONNECT) { 182 spin_unlock(&tcon->tc_lock); 183 cifs_dbg(FYI, "can not send cmd %d while umounting\n", 184 smb2_command); 185 return -ENODEV; 186 } 187 } 188 spin_unlock(&tcon->tc_lock); 189 190 ses = tcon->ses; 191 if (!ses) 192 return -EIO; 193 spin_lock(&ses->ses_lock); 194 if (ses->ses_status == SES_EXITING) { 195 spin_unlock(&ses->ses_lock); 196 return -EIO; 197 } 198 spin_unlock(&ses->ses_lock); 199 if (!ses->server || !server) 200 return -EIO; 201 202 spin_lock(&server->srv_lock); 203 if (server->tcpStatus == CifsNeedReconnect) { 204 /* 205 * Return to caller for TREE_DISCONNECT and LOGOFF and CLOSE 206 * here since they are implicitly done when session drops. 207 */ 208 switch (smb2_command) { 209 /* 210 * BB Should we keep oplock break and add flush to exceptions? 211 */ 212 case SMB2_TREE_DISCONNECT: 213 case SMB2_CANCEL: 214 case SMB2_CLOSE: 215 case SMB2_OPLOCK_BREAK: 216 spin_unlock(&server->srv_lock); 217 return -EAGAIN; 218 } 219 } 220 spin_unlock(&server->srv_lock); 221 222 again: 223 rc = cifs_wait_for_server_reconnect(server, tcon->retry); 224 if (rc) 225 return rc; 226 227 spin_lock(&ses->chan_lock); 228 if (!cifs_chan_needs_reconnect(ses, server) && !tcon->need_reconnect) { 229 spin_unlock(&ses->chan_lock); 230 return 0; 231 } 232 spin_unlock(&ses->chan_lock); 233 cifs_dbg(FYI, "sess reconnect mask: 0x%lx, tcon reconnect: %d", 234 tcon->ses->chans_need_reconnect, 235 tcon->need_reconnect); 236 237 mutex_lock(&ses->session_mutex); 238 /* 239 * Recheck after acquire mutex. If another thread is negotiating 240 * and the server never sends an answer the socket will be closed 241 * and tcpStatus set to reconnect. 242 */ 243 spin_lock(&server->srv_lock); 244 if (server->tcpStatus == CifsNeedReconnect) { 245 spin_unlock(&server->srv_lock); 246 mutex_unlock(&ses->session_mutex); 247 248 if (tcon->retry) 249 goto again; 250 251 rc = -EHOSTDOWN; 252 goto out; 253 } 254 spin_unlock(&server->srv_lock); 255 256 nls_codepage = ses->local_nls; 257 258 /* 259 * need to prevent multiple threads trying to simultaneously 260 * reconnect the same SMB session 261 */ 262 spin_lock(&ses->ses_lock); 263 spin_lock(&ses->chan_lock); 264 if (!cifs_chan_needs_reconnect(ses, server) && 265 ses->ses_status == SES_GOOD) { 266 spin_unlock(&ses->chan_lock); 267 spin_unlock(&ses->ses_lock); 268 /* this means that we only need to tree connect */ 269 if (tcon->need_reconnect) 270 goto skip_sess_setup; 271 272 mutex_unlock(&ses->session_mutex); 273 goto out; 274 } 275 spin_unlock(&ses->chan_lock); 276 spin_unlock(&ses->ses_lock); 277 278 rc = cifs_negotiate_protocol(0, ses, server); 279 if (!rc) { 280 rc = cifs_setup_session(0, ses, server, nls_codepage); 281 if ((rc == -EACCES) && !tcon->retry) { 282 mutex_unlock(&ses->session_mutex); 283 rc = -EHOSTDOWN; 284 goto failed; 285 } else if (rc) { 286 mutex_unlock(&ses->session_mutex); 287 goto out; 288 } 289 } else { 290 mutex_unlock(&ses->session_mutex); 291 goto out; 292 } 293 294 skip_sess_setup: 295 if (!tcon->need_reconnect) { 296 mutex_unlock(&ses->session_mutex); 297 goto out; 298 } 299 cifs_mark_open_files_invalid(tcon); 300 if (tcon->use_persistent) 301 tcon->need_reopen_files = true; 302 303 rc = cifs_tree_connect(0, tcon, nls_codepage); 304 mutex_unlock(&ses->session_mutex); 305 306 cifs_dbg(FYI, "reconnect tcon rc = %d\n", rc); 307 if (rc) { 308 /* If sess reconnected but tcon didn't, something strange ... */ 309 cifs_dbg(VFS, "reconnect tcon failed rc = %d\n", rc); 310 goto out; 311 } 312 313 if (smb2_command != SMB2_INTERNAL_CMD) 314 mod_delayed_work(cifsiod_wq, &server->reconnect, 0); 315 316 atomic_inc(&tconInfoReconnectCount); 317 out: 318 /* 319 * Check if handle based operation so we know whether we can continue 320 * or not without returning to caller to reset file handle. 321 */ 322 /* 323 * BB Is flush done by server on drop of tcp session? Should we special 324 * case it and skip above? 325 */ 326 switch (smb2_command) { 327 case SMB2_FLUSH: 328 case SMB2_READ: 329 case SMB2_WRITE: 330 case SMB2_LOCK: 331 case SMB2_QUERY_DIRECTORY: 332 case SMB2_CHANGE_NOTIFY: 333 case SMB2_QUERY_INFO: 334 case SMB2_SET_INFO: 335 rc = -EAGAIN; 336 } 337 failed: 338 return rc; 339 } 340 341 static void 342 fill_small_buf(__le16 smb2_command, struct cifs_tcon *tcon, 343 struct TCP_Server_Info *server, 344 void *buf, 345 unsigned int *total_len) 346 { 347 struct smb2_pdu *spdu = buf; 348 /* lookup word count ie StructureSize from table */ 349 __u16 parmsize = smb2_req_struct_sizes[le16_to_cpu(smb2_command)]; 350 351 /* 352 * smaller than SMALL_BUFFER_SIZE but bigger than fixed area of 353 * largest operations (Create) 354 */ 355 memset(buf, 0, 256); 356 357 smb2_hdr_assemble(&spdu->hdr, smb2_command, tcon, server); 358 spdu->StructureSize2 = cpu_to_le16(parmsize); 359 360 *total_len = parmsize + sizeof(struct smb2_hdr); 361 } 362 363 /* 364 * Allocate and return pointer to an SMB request hdr, and set basic 365 * SMB information in the SMB header. If the return code is zero, this 366 * function must have filled in request_buf pointer. 367 */ 368 static int __smb2_plain_req_init(__le16 smb2_command, struct cifs_tcon *tcon, 369 struct TCP_Server_Info *server, 370 void **request_buf, unsigned int *total_len) 371 { 372 /* BB eventually switch this to SMB2 specific small buf size */ 373 if (smb2_command == SMB2_SET_INFO) 374 *request_buf = cifs_buf_get(); 375 else 376 *request_buf = cifs_small_buf_get(); 377 if (*request_buf == NULL) { 378 /* BB should we add a retry in here if not a writepage? */ 379 return -ENOMEM; 380 } 381 382 fill_small_buf(smb2_command, tcon, server, 383 (struct smb2_hdr *)(*request_buf), 384 total_len); 385 386 if (tcon != NULL) { 387 uint16_t com_code = le16_to_cpu(smb2_command); 388 cifs_stats_inc(&tcon->stats.smb2_stats.smb2_com_sent[com_code]); 389 cifs_stats_inc(&tcon->num_smbs_sent); 390 } 391 392 return 0; 393 } 394 395 static int smb2_plain_req_init(__le16 smb2_command, struct cifs_tcon *tcon, 396 struct TCP_Server_Info *server, 397 void **request_buf, unsigned int *total_len) 398 { 399 int rc; 400 401 rc = smb2_reconnect(smb2_command, tcon, server); 402 if (rc) 403 return rc; 404 405 return __smb2_plain_req_init(smb2_command, tcon, server, request_buf, 406 total_len); 407 } 408 409 static int smb2_ioctl_req_init(u32 opcode, struct cifs_tcon *tcon, 410 struct TCP_Server_Info *server, 411 void **request_buf, unsigned int *total_len) 412 { 413 /* Skip reconnect only for FSCTL_VALIDATE_NEGOTIATE_INFO IOCTLs */ 414 if (opcode == FSCTL_VALIDATE_NEGOTIATE_INFO) { 415 return __smb2_plain_req_init(SMB2_IOCTL, tcon, server, 416 request_buf, total_len); 417 } 418 return smb2_plain_req_init(SMB2_IOCTL, tcon, server, 419 request_buf, total_len); 420 } 421 422 /* For explanation of negotiate contexts see MS-SMB2 section 2.2.3.1 */ 423 424 static void 425 build_preauth_ctxt(struct smb2_preauth_neg_context *pneg_ctxt) 426 { 427 pneg_ctxt->ContextType = SMB2_PREAUTH_INTEGRITY_CAPABILITIES; 428 pneg_ctxt->DataLength = cpu_to_le16(38); 429 pneg_ctxt->HashAlgorithmCount = cpu_to_le16(1); 430 pneg_ctxt->SaltLength = cpu_to_le16(SMB311_SALT_SIZE); 431 get_random_bytes(pneg_ctxt->Salt, SMB311_SALT_SIZE); 432 pneg_ctxt->HashAlgorithms = SMB2_PREAUTH_INTEGRITY_SHA512; 433 } 434 435 static void 436 build_compression_ctxt(struct smb2_compression_capabilities_context *pneg_ctxt) 437 { 438 pneg_ctxt->ContextType = SMB2_COMPRESSION_CAPABILITIES; 439 pneg_ctxt->DataLength = 440 cpu_to_le16(sizeof(struct smb2_compression_capabilities_context) 441 - sizeof(struct smb2_neg_context)); 442 pneg_ctxt->CompressionAlgorithmCount = cpu_to_le16(3); 443 pneg_ctxt->CompressionAlgorithms[0] = SMB3_COMPRESS_LZ77; 444 pneg_ctxt->CompressionAlgorithms[1] = SMB3_COMPRESS_LZ77_HUFF; 445 pneg_ctxt->CompressionAlgorithms[2] = SMB3_COMPRESS_LZNT1; 446 } 447 448 static unsigned int 449 build_signing_ctxt(struct smb2_signing_capabilities *pneg_ctxt) 450 { 451 unsigned int ctxt_len = sizeof(struct smb2_signing_capabilities); 452 unsigned short num_algs = 1; /* number of signing algorithms sent */ 453 454 pneg_ctxt->ContextType = SMB2_SIGNING_CAPABILITIES; 455 /* 456 * Context Data length must be rounded to multiple of 8 for some servers 457 */ 458 pneg_ctxt->DataLength = cpu_to_le16(ALIGN(sizeof(struct smb2_signing_capabilities) - 459 sizeof(struct smb2_neg_context) + 460 (num_algs * sizeof(u16)), 8)); 461 pneg_ctxt->SigningAlgorithmCount = cpu_to_le16(num_algs); 462 pneg_ctxt->SigningAlgorithms[0] = cpu_to_le16(SIGNING_ALG_AES_CMAC); 463 464 ctxt_len += sizeof(__le16) * num_algs; 465 ctxt_len = ALIGN(ctxt_len, 8); 466 return ctxt_len; 467 /* TBD add SIGNING_ALG_AES_GMAC and/or SIGNING_ALG_HMAC_SHA256 */ 468 } 469 470 static void 471 build_encrypt_ctxt(struct smb2_encryption_neg_context *pneg_ctxt) 472 { 473 pneg_ctxt->ContextType = SMB2_ENCRYPTION_CAPABILITIES; 474 if (require_gcm_256) { 475 pneg_ctxt->DataLength = cpu_to_le16(4); /* Cipher Count + 1 cipher */ 476 pneg_ctxt->CipherCount = cpu_to_le16(1); 477 pneg_ctxt->Ciphers[0] = SMB2_ENCRYPTION_AES256_GCM; 478 } else if (enable_gcm_256) { 479 pneg_ctxt->DataLength = cpu_to_le16(8); /* Cipher Count + 3 ciphers */ 480 pneg_ctxt->CipherCount = cpu_to_le16(3); 481 pneg_ctxt->Ciphers[0] = SMB2_ENCRYPTION_AES128_GCM; 482 pneg_ctxt->Ciphers[1] = SMB2_ENCRYPTION_AES256_GCM; 483 pneg_ctxt->Ciphers[2] = SMB2_ENCRYPTION_AES128_CCM; 484 } else { 485 pneg_ctxt->DataLength = cpu_to_le16(6); /* Cipher Count + 2 ciphers */ 486 pneg_ctxt->CipherCount = cpu_to_le16(2); 487 pneg_ctxt->Ciphers[0] = SMB2_ENCRYPTION_AES128_GCM; 488 pneg_ctxt->Ciphers[1] = SMB2_ENCRYPTION_AES128_CCM; 489 } 490 } 491 492 static unsigned int 493 build_netname_ctxt(struct smb2_netname_neg_context *pneg_ctxt, char *hostname) 494 { 495 struct nls_table *cp = load_nls_default(); 496 497 pneg_ctxt->ContextType = SMB2_NETNAME_NEGOTIATE_CONTEXT_ID; 498 499 /* copy up to max of first 100 bytes of server name to NetName field */ 500 pneg_ctxt->DataLength = cpu_to_le16(2 * cifs_strtoUTF16(pneg_ctxt->NetName, hostname, 100, cp)); 501 /* context size is DataLength + minimal smb2_neg_context */ 502 return ALIGN(le16_to_cpu(pneg_ctxt->DataLength) + sizeof(struct smb2_neg_context), 8); 503 } 504 505 static void 506 build_posix_ctxt(struct smb2_posix_neg_context *pneg_ctxt) 507 { 508 pneg_ctxt->ContextType = SMB2_POSIX_EXTENSIONS_AVAILABLE; 509 pneg_ctxt->DataLength = cpu_to_le16(POSIX_CTXT_DATA_LEN); 510 /* SMB2_CREATE_TAG_POSIX is "0x93AD25509CB411E7B42383DE968BCD7C" */ 511 pneg_ctxt->Name[0] = 0x93; 512 pneg_ctxt->Name[1] = 0xAD; 513 pneg_ctxt->Name[2] = 0x25; 514 pneg_ctxt->Name[3] = 0x50; 515 pneg_ctxt->Name[4] = 0x9C; 516 pneg_ctxt->Name[5] = 0xB4; 517 pneg_ctxt->Name[6] = 0x11; 518 pneg_ctxt->Name[7] = 0xE7; 519 pneg_ctxt->Name[8] = 0xB4; 520 pneg_ctxt->Name[9] = 0x23; 521 pneg_ctxt->Name[10] = 0x83; 522 pneg_ctxt->Name[11] = 0xDE; 523 pneg_ctxt->Name[12] = 0x96; 524 pneg_ctxt->Name[13] = 0x8B; 525 pneg_ctxt->Name[14] = 0xCD; 526 pneg_ctxt->Name[15] = 0x7C; 527 } 528 529 static void 530 assemble_neg_contexts(struct smb2_negotiate_req *req, 531 struct TCP_Server_Info *server, unsigned int *total_len) 532 { 533 unsigned int ctxt_len, neg_context_count; 534 struct TCP_Server_Info *pserver; 535 char *pneg_ctxt; 536 char *hostname; 537 538 if (*total_len > 200) { 539 /* In case length corrupted don't want to overrun smb buffer */ 540 cifs_server_dbg(VFS, "Bad frame length assembling neg contexts\n"); 541 return; 542 } 543 544 /* 545 * round up total_len of fixed part of SMB3 negotiate request to 8 546 * byte boundary before adding negotiate contexts 547 */ 548 *total_len = ALIGN(*total_len, 8); 549 550 pneg_ctxt = (*total_len) + (char *)req; 551 req->NegotiateContextOffset = cpu_to_le32(*total_len); 552 553 build_preauth_ctxt((struct smb2_preauth_neg_context *)pneg_ctxt); 554 ctxt_len = ALIGN(sizeof(struct smb2_preauth_neg_context), 8); 555 *total_len += ctxt_len; 556 pneg_ctxt += ctxt_len; 557 558 build_encrypt_ctxt((struct smb2_encryption_neg_context *)pneg_ctxt); 559 ctxt_len = ALIGN(sizeof(struct smb2_encryption_neg_context), 8); 560 *total_len += ctxt_len; 561 pneg_ctxt += ctxt_len; 562 563 /* 564 * secondary channels don't have the hostname field populated 565 * use the hostname field in the primary channel instead 566 */ 567 pserver = SERVER_IS_CHAN(server) ? server->primary_server : server; 568 cifs_server_lock(pserver); 569 hostname = pserver->hostname; 570 if (hostname && (hostname[0] != 0)) { 571 ctxt_len = build_netname_ctxt((struct smb2_netname_neg_context *)pneg_ctxt, 572 hostname); 573 *total_len += ctxt_len; 574 pneg_ctxt += ctxt_len; 575 neg_context_count = 3; 576 } else 577 neg_context_count = 2; 578 cifs_server_unlock(pserver); 579 580 build_posix_ctxt((struct smb2_posix_neg_context *)pneg_ctxt); 581 *total_len += sizeof(struct smb2_posix_neg_context); 582 pneg_ctxt += sizeof(struct smb2_posix_neg_context); 583 neg_context_count++; 584 585 if (server->compress_algorithm) { 586 build_compression_ctxt((struct smb2_compression_capabilities_context *) 587 pneg_ctxt); 588 ctxt_len = ALIGN(sizeof(struct smb2_compression_capabilities_context), 8); 589 *total_len += ctxt_len; 590 pneg_ctxt += ctxt_len; 591 neg_context_count++; 592 } 593 594 if (enable_negotiate_signing) { 595 ctxt_len = build_signing_ctxt((struct smb2_signing_capabilities *) 596 pneg_ctxt); 597 *total_len += ctxt_len; 598 pneg_ctxt += ctxt_len; 599 neg_context_count++; 600 } 601 602 /* check for and add transport_capabilities and signing capabilities */ 603 req->NegotiateContextCount = cpu_to_le16(neg_context_count); 604 605 } 606 607 /* If invalid preauth context warn but use what we requested, SHA-512 */ 608 static void decode_preauth_context(struct smb2_preauth_neg_context *ctxt) 609 { 610 unsigned int len = le16_to_cpu(ctxt->DataLength); 611 612 /* 613 * Caller checked that DataLength remains within SMB boundary. We still 614 * need to confirm that one HashAlgorithms member is accounted for. 615 */ 616 if (len < MIN_PREAUTH_CTXT_DATA_LEN) { 617 pr_warn_once("server sent bad preauth context\n"); 618 return; 619 } else if (len < MIN_PREAUTH_CTXT_DATA_LEN + le16_to_cpu(ctxt->SaltLength)) { 620 pr_warn_once("server sent invalid SaltLength\n"); 621 return; 622 } 623 if (le16_to_cpu(ctxt->HashAlgorithmCount) != 1) 624 pr_warn_once("Invalid SMB3 hash algorithm count\n"); 625 if (ctxt->HashAlgorithms != SMB2_PREAUTH_INTEGRITY_SHA512) 626 pr_warn_once("unknown SMB3 hash algorithm\n"); 627 } 628 629 static void decode_compress_ctx(struct TCP_Server_Info *server, 630 struct smb2_compression_capabilities_context *ctxt) 631 { 632 unsigned int len = le16_to_cpu(ctxt->DataLength); 633 634 /* 635 * Caller checked that DataLength remains within SMB boundary. We still 636 * need to confirm that one CompressionAlgorithms member is accounted 637 * for. 638 */ 639 if (len < 10) { 640 pr_warn_once("server sent bad compression cntxt\n"); 641 return; 642 } 643 if (le16_to_cpu(ctxt->CompressionAlgorithmCount) != 1) { 644 pr_warn_once("Invalid SMB3 compress algorithm count\n"); 645 return; 646 } 647 if (le16_to_cpu(ctxt->CompressionAlgorithms[0]) > 3) { 648 pr_warn_once("unknown compression algorithm\n"); 649 return; 650 } 651 server->compress_algorithm = ctxt->CompressionAlgorithms[0]; 652 } 653 654 static int decode_encrypt_ctx(struct TCP_Server_Info *server, 655 struct smb2_encryption_neg_context *ctxt) 656 { 657 unsigned int len = le16_to_cpu(ctxt->DataLength); 658 659 cifs_dbg(FYI, "decode SMB3.11 encryption neg context of len %d\n", len); 660 /* 661 * Caller checked that DataLength remains within SMB boundary. We still 662 * need to confirm that one Cipher flexible array member is accounted 663 * for. 664 */ 665 if (len < MIN_ENCRYPT_CTXT_DATA_LEN) { 666 pr_warn_once("server sent bad crypto ctxt len\n"); 667 return -EINVAL; 668 } 669 670 if (le16_to_cpu(ctxt->CipherCount) != 1) { 671 pr_warn_once("Invalid SMB3.11 cipher count\n"); 672 return -EINVAL; 673 } 674 cifs_dbg(FYI, "SMB311 cipher type:%d\n", le16_to_cpu(ctxt->Ciphers[0])); 675 if (require_gcm_256) { 676 if (ctxt->Ciphers[0] != SMB2_ENCRYPTION_AES256_GCM) { 677 cifs_dbg(VFS, "Server does not support requested encryption type (AES256 GCM)\n"); 678 return -EOPNOTSUPP; 679 } 680 } else if (ctxt->Ciphers[0] == 0) { 681 /* 682 * e.g. if server only supported AES256_CCM (very unlikely) 683 * or server supported no encryption types or had all disabled. 684 * Since GLOBAL_CAP_ENCRYPTION will be not set, in the case 685 * in which mount requested encryption ("seal") checks later 686 * on during tree connection will return proper rc, but if 687 * seal not requested by client, since server is allowed to 688 * return 0 to indicate no supported cipher, we can't fail here 689 */ 690 server->cipher_type = 0; 691 server->capabilities &= ~SMB2_GLOBAL_CAP_ENCRYPTION; 692 pr_warn_once("Server does not support requested encryption types\n"); 693 return 0; 694 } else if ((ctxt->Ciphers[0] != SMB2_ENCRYPTION_AES128_CCM) && 695 (ctxt->Ciphers[0] != SMB2_ENCRYPTION_AES128_GCM) && 696 (ctxt->Ciphers[0] != SMB2_ENCRYPTION_AES256_GCM)) { 697 /* server returned a cipher we didn't ask for */ 698 pr_warn_once("Invalid SMB3.11 cipher returned\n"); 699 return -EINVAL; 700 } 701 server->cipher_type = ctxt->Ciphers[0]; 702 server->capabilities |= SMB2_GLOBAL_CAP_ENCRYPTION; 703 return 0; 704 } 705 706 static void decode_signing_ctx(struct TCP_Server_Info *server, 707 struct smb2_signing_capabilities *pctxt) 708 { 709 unsigned int len = le16_to_cpu(pctxt->DataLength); 710 711 /* 712 * Caller checked that DataLength remains within SMB boundary. We still 713 * need to confirm that one SigningAlgorithms flexible array member is 714 * accounted for. 715 */ 716 if ((len < 4) || (len > 16)) { 717 pr_warn_once("server sent bad signing negcontext\n"); 718 return; 719 } 720 if (le16_to_cpu(pctxt->SigningAlgorithmCount) != 1) { 721 pr_warn_once("Invalid signing algorithm count\n"); 722 return; 723 } 724 if (le16_to_cpu(pctxt->SigningAlgorithms[0]) > 2) { 725 pr_warn_once("unknown signing algorithm\n"); 726 return; 727 } 728 729 server->signing_negotiated = true; 730 server->signing_algorithm = le16_to_cpu(pctxt->SigningAlgorithms[0]); 731 cifs_dbg(FYI, "signing algorithm %d chosen\n", 732 server->signing_algorithm); 733 } 734 735 736 static int smb311_decode_neg_context(struct smb2_negotiate_rsp *rsp, 737 struct TCP_Server_Info *server, 738 unsigned int len_of_smb) 739 { 740 struct smb2_neg_context *pctx; 741 unsigned int offset = le32_to_cpu(rsp->NegotiateContextOffset); 742 unsigned int ctxt_cnt = le16_to_cpu(rsp->NegotiateContextCount); 743 unsigned int len_of_ctxts, i; 744 int rc = 0; 745 746 cifs_dbg(FYI, "decoding %d negotiate contexts\n", ctxt_cnt); 747 if (len_of_smb <= offset) { 748 cifs_server_dbg(VFS, "Invalid response: negotiate context offset\n"); 749 return -EINVAL; 750 } 751 752 len_of_ctxts = len_of_smb - offset; 753 754 for (i = 0; i < ctxt_cnt; i++) { 755 int clen; 756 /* check that offset is not beyond end of SMB */ 757 if (len_of_ctxts < sizeof(struct smb2_neg_context)) 758 break; 759 760 pctx = (struct smb2_neg_context *)(offset + (char *)rsp); 761 clen = sizeof(struct smb2_neg_context) 762 + le16_to_cpu(pctx->DataLength); 763 /* 764 * 2.2.4 SMB2 NEGOTIATE Response 765 * Subsequent negotiate contexts MUST appear at the first 8-byte 766 * aligned offset following the previous negotiate context. 767 */ 768 if (i + 1 != ctxt_cnt) 769 clen = ALIGN(clen, 8); 770 if (clen > len_of_ctxts) 771 break; 772 773 if (pctx->ContextType == SMB2_PREAUTH_INTEGRITY_CAPABILITIES) 774 decode_preauth_context( 775 (struct smb2_preauth_neg_context *)pctx); 776 else if (pctx->ContextType == SMB2_ENCRYPTION_CAPABILITIES) 777 rc = decode_encrypt_ctx(server, 778 (struct smb2_encryption_neg_context *)pctx); 779 else if (pctx->ContextType == SMB2_COMPRESSION_CAPABILITIES) 780 decode_compress_ctx(server, 781 (struct smb2_compression_capabilities_context *)pctx); 782 else if (pctx->ContextType == SMB2_POSIX_EXTENSIONS_AVAILABLE) 783 server->posix_ext_supported = true; 784 else if (pctx->ContextType == SMB2_SIGNING_CAPABILITIES) 785 decode_signing_ctx(server, 786 (struct smb2_signing_capabilities *)pctx); 787 else 788 cifs_server_dbg(VFS, "unknown negcontext of type %d ignored\n", 789 le16_to_cpu(pctx->ContextType)); 790 if (rc) 791 break; 792 793 offset += clen; 794 len_of_ctxts -= clen; 795 } 796 return rc; 797 } 798 799 static struct create_posix * 800 create_posix_buf(umode_t mode) 801 { 802 struct create_posix *buf; 803 804 buf = kzalloc(sizeof(struct create_posix), 805 GFP_KERNEL); 806 if (!buf) 807 return NULL; 808 809 buf->ccontext.DataOffset = 810 cpu_to_le16(offsetof(struct create_posix, Mode)); 811 buf->ccontext.DataLength = cpu_to_le32(4); 812 buf->ccontext.NameOffset = 813 cpu_to_le16(offsetof(struct create_posix, Name)); 814 buf->ccontext.NameLength = cpu_to_le16(16); 815 816 /* SMB2_CREATE_TAG_POSIX is "0x93AD25509CB411E7B42383DE968BCD7C" */ 817 buf->Name[0] = 0x93; 818 buf->Name[1] = 0xAD; 819 buf->Name[2] = 0x25; 820 buf->Name[3] = 0x50; 821 buf->Name[4] = 0x9C; 822 buf->Name[5] = 0xB4; 823 buf->Name[6] = 0x11; 824 buf->Name[7] = 0xE7; 825 buf->Name[8] = 0xB4; 826 buf->Name[9] = 0x23; 827 buf->Name[10] = 0x83; 828 buf->Name[11] = 0xDE; 829 buf->Name[12] = 0x96; 830 buf->Name[13] = 0x8B; 831 buf->Name[14] = 0xCD; 832 buf->Name[15] = 0x7C; 833 buf->Mode = cpu_to_le32(mode); 834 cifs_dbg(FYI, "mode on posix create 0%o\n", mode); 835 return buf; 836 } 837 838 static int 839 add_posix_context(struct kvec *iov, unsigned int *num_iovec, umode_t mode) 840 { 841 unsigned int num = *num_iovec; 842 843 iov[num].iov_base = create_posix_buf(mode); 844 if (mode == ACL_NO_MODE) 845 cifs_dbg(FYI, "Invalid mode\n"); 846 if (iov[num].iov_base == NULL) 847 return -ENOMEM; 848 iov[num].iov_len = sizeof(struct create_posix); 849 *num_iovec = num + 1; 850 return 0; 851 } 852 853 854 /* 855 * 856 * SMB2 Worker functions follow: 857 * 858 * The general structure of the worker functions is: 859 * 1) Call smb2_init (assembles SMB2 header) 860 * 2) Initialize SMB2 command specific fields in fixed length area of SMB 861 * 3) Call smb_sendrcv2 (sends request on socket and waits for response) 862 * 4) Decode SMB2 command specific fields in the fixed length area 863 * 5) Decode variable length data area (if any for this SMB2 command type) 864 * 6) Call free smb buffer 865 * 7) return 866 * 867 */ 868 869 int 870 SMB2_negotiate(const unsigned int xid, 871 struct cifs_ses *ses, 872 struct TCP_Server_Info *server) 873 { 874 struct smb_rqst rqst; 875 struct smb2_negotiate_req *req; 876 struct smb2_negotiate_rsp *rsp; 877 struct kvec iov[1]; 878 struct kvec rsp_iov; 879 int rc; 880 int resp_buftype; 881 int blob_offset, blob_length; 882 char *security_blob; 883 int flags = CIFS_NEG_OP; 884 unsigned int total_len; 885 886 cifs_dbg(FYI, "Negotiate protocol\n"); 887 888 if (!server) { 889 WARN(1, "%s: server is NULL!\n", __func__); 890 return -EIO; 891 } 892 893 rc = smb2_plain_req_init(SMB2_NEGOTIATE, NULL, server, 894 (void **) &req, &total_len); 895 if (rc) 896 return rc; 897 898 req->hdr.SessionId = 0; 899 900 memset(server->preauth_sha_hash, 0, SMB2_PREAUTH_HASH_SIZE); 901 memset(ses->preauth_sha_hash, 0, SMB2_PREAUTH_HASH_SIZE); 902 903 if (strcmp(server->vals->version_string, 904 SMB3ANY_VERSION_STRING) == 0) { 905 req->Dialects[0] = cpu_to_le16(SMB30_PROT_ID); 906 req->Dialects[1] = cpu_to_le16(SMB302_PROT_ID); 907 req->Dialects[2] = cpu_to_le16(SMB311_PROT_ID); 908 req->DialectCount = cpu_to_le16(3); 909 total_len += 6; 910 } else if (strcmp(server->vals->version_string, 911 SMBDEFAULT_VERSION_STRING) == 0) { 912 req->Dialects[0] = cpu_to_le16(SMB21_PROT_ID); 913 req->Dialects[1] = cpu_to_le16(SMB30_PROT_ID); 914 req->Dialects[2] = cpu_to_le16(SMB302_PROT_ID); 915 req->Dialects[3] = cpu_to_le16(SMB311_PROT_ID); 916 req->DialectCount = cpu_to_le16(4); 917 total_len += 8; 918 } else { 919 /* otherwise send specific dialect */ 920 req->Dialects[0] = cpu_to_le16(server->vals->protocol_id); 921 req->DialectCount = cpu_to_le16(1); 922 total_len += 2; 923 } 924 925 /* only one of SMB2 signing flags may be set in SMB2 request */ 926 if (ses->sign) 927 req->SecurityMode = cpu_to_le16(SMB2_NEGOTIATE_SIGNING_REQUIRED); 928 else if (global_secflags & CIFSSEC_MAY_SIGN) 929 req->SecurityMode = cpu_to_le16(SMB2_NEGOTIATE_SIGNING_ENABLED); 930 else 931 req->SecurityMode = 0; 932 933 req->Capabilities = cpu_to_le32(server->vals->req_capabilities); 934 if (ses->chan_max > 1) 935 req->Capabilities |= cpu_to_le32(SMB2_GLOBAL_CAP_MULTI_CHANNEL); 936 937 /* ClientGUID must be zero for SMB2.02 dialect */ 938 if (server->vals->protocol_id == SMB20_PROT_ID) 939 memset(req->ClientGUID, 0, SMB2_CLIENT_GUID_SIZE); 940 else { 941 memcpy(req->ClientGUID, server->client_guid, 942 SMB2_CLIENT_GUID_SIZE); 943 if ((server->vals->protocol_id == SMB311_PROT_ID) || 944 (strcmp(server->vals->version_string, 945 SMB3ANY_VERSION_STRING) == 0) || 946 (strcmp(server->vals->version_string, 947 SMBDEFAULT_VERSION_STRING) == 0)) 948 assemble_neg_contexts(req, server, &total_len); 949 } 950 iov[0].iov_base = (char *)req; 951 iov[0].iov_len = total_len; 952 953 memset(&rqst, 0, sizeof(struct smb_rqst)); 954 rqst.rq_iov = iov; 955 rqst.rq_nvec = 1; 956 957 rc = cifs_send_recv(xid, ses, server, 958 &rqst, &resp_buftype, flags, &rsp_iov); 959 cifs_small_buf_release(req); 960 rsp = (struct smb2_negotiate_rsp *)rsp_iov.iov_base; 961 /* 962 * No tcon so can't do 963 * cifs_stats_inc(&tcon->stats.smb2_stats.smb2_com_fail[SMB2...]); 964 */ 965 if (rc == -EOPNOTSUPP) { 966 cifs_server_dbg(VFS, "Dialect not supported by server. Consider specifying vers=1.0 or vers=2.0 on mount for accessing older servers\n"); 967 goto neg_exit; 968 } else if (rc != 0) 969 goto neg_exit; 970 971 rc = -EIO; 972 if (strcmp(server->vals->version_string, 973 SMB3ANY_VERSION_STRING) == 0) { 974 if (rsp->DialectRevision == cpu_to_le16(SMB20_PROT_ID)) { 975 cifs_server_dbg(VFS, 976 "SMB2 dialect returned but not requested\n"); 977 goto neg_exit; 978 } else if (rsp->DialectRevision == cpu_to_le16(SMB21_PROT_ID)) { 979 cifs_server_dbg(VFS, 980 "SMB2.1 dialect returned but not requested\n"); 981 goto neg_exit; 982 } else if (rsp->DialectRevision == cpu_to_le16(SMB311_PROT_ID)) { 983 /* ops set to 3.0 by default for default so update */ 984 server->ops = &smb311_operations; 985 server->vals = &smb311_values; 986 } 987 } else if (strcmp(server->vals->version_string, 988 SMBDEFAULT_VERSION_STRING) == 0) { 989 if (rsp->DialectRevision == cpu_to_le16(SMB20_PROT_ID)) { 990 cifs_server_dbg(VFS, 991 "SMB2 dialect returned but not requested\n"); 992 goto neg_exit; 993 } else if (rsp->DialectRevision == cpu_to_le16(SMB21_PROT_ID)) { 994 /* ops set to 3.0 by default for default so update */ 995 server->ops = &smb21_operations; 996 server->vals = &smb21_values; 997 } else if (rsp->DialectRevision == cpu_to_le16(SMB311_PROT_ID)) { 998 server->ops = &smb311_operations; 999 server->vals = &smb311_values; 1000 } 1001 } else if (le16_to_cpu(rsp->DialectRevision) != 1002 server->vals->protocol_id) { 1003 /* if requested single dialect ensure returned dialect matched */ 1004 cifs_server_dbg(VFS, "Invalid 0x%x dialect returned: not requested\n", 1005 le16_to_cpu(rsp->DialectRevision)); 1006 goto neg_exit; 1007 } 1008 1009 cifs_dbg(FYI, "mode 0x%x\n", rsp->SecurityMode); 1010 1011 if (rsp->DialectRevision == cpu_to_le16(SMB20_PROT_ID)) 1012 cifs_dbg(FYI, "negotiated smb2.0 dialect\n"); 1013 else if (rsp->DialectRevision == cpu_to_le16(SMB21_PROT_ID)) 1014 cifs_dbg(FYI, "negotiated smb2.1 dialect\n"); 1015 else if (rsp->DialectRevision == cpu_to_le16(SMB30_PROT_ID)) 1016 cifs_dbg(FYI, "negotiated smb3.0 dialect\n"); 1017 else if (rsp->DialectRevision == cpu_to_le16(SMB302_PROT_ID)) 1018 cifs_dbg(FYI, "negotiated smb3.02 dialect\n"); 1019 else if (rsp->DialectRevision == cpu_to_le16(SMB311_PROT_ID)) 1020 cifs_dbg(FYI, "negotiated smb3.1.1 dialect\n"); 1021 else { 1022 cifs_server_dbg(VFS, "Invalid dialect returned by server 0x%x\n", 1023 le16_to_cpu(rsp->DialectRevision)); 1024 goto neg_exit; 1025 } 1026 1027 rc = 0; 1028 server->dialect = le16_to_cpu(rsp->DialectRevision); 1029 1030 /* 1031 * Keep a copy of the hash after negprot. This hash will be 1032 * the starting hash value for all sessions made from this 1033 * server. 1034 */ 1035 memcpy(server->preauth_sha_hash, ses->preauth_sha_hash, 1036 SMB2_PREAUTH_HASH_SIZE); 1037 1038 /* SMB2 only has an extended negflavor */ 1039 server->negflavor = CIFS_NEGFLAVOR_EXTENDED; 1040 /* set it to the maximum buffer size value we can send with 1 credit */ 1041 server->maxBuf = min_t(unsigned int, le32_to_cpu(rsp->MaxTransactSize), 1042 SMB2_MAX_BUFFER_SIZE); 1043 server->max_read = le32_to_cpu(rsp->MaxReadSize); 1044 server->max_write = le32_to_cpu(rsp->MaxWriteSize); 1045 server->sec_mode = le16_to_cpu(rsp->SecurityMode); 1046 if ((server->sec_mode & SMB2_SEC_MODE_FLAGS_ALL) != server->sec_mode) 1047 cifs_dbg(FYI, "Server returned unexpected security mode 0x%x\n", 1048 server->sec_mode); 1049 server->capabilities = le32_to_cpu(rsp->Capabilities); 1050 /* Internal types */ 1051 server->capabilities |= SMB2_NT_FIND | SMB2_LARGE_FILES; 1052 1053 /* 1054 * SMB3.0 supports only 1 cipher and doesn't have a encryption neg context 1055 * Set the cipher type manually. 1056 */ 1057 if (server->dialect == SMB30_PROT_ID && (server->capabilities & SMB2_GLOBAL_CAP_ENCRYPTION)) 1058 server->cipher_type = SMB2_ENCRYPTION_AES128_CCM; 1059 1060 security_blob = smb2_get_data_area_len(&blob_offset, &blob_length, 1061 (struct smb2_hdr *)rsp); 1062 /* 1063 * See MS-SMB2 section 2.2.4: if no blob, client picks default which 1064 * for us will be 1065 * ses->sectype = RawNTLMSSP; 1066 * but for time being this is our only auth choice so doesn't matter. 1067 * We just found a server which sets blob length to zero expecting raw. 1068 */ 1069 if (blob_length == 0) { 1070 cifs_dbg(FYI, "missing security blob on negprot\n"); 1071 server->sec_ntlmssp = true; 1072 } 1073 1074 rc = cifs_enable_signing(server, ses->sign); 1075 if (rc) 1076 goto neg_exit; 1077 if (blob_length) { 1078 rc = decode_negTokenInit(security_blob, blob_length, server); 1079 if (rc == 1) 1080 rc = 0; 1081 else if (rc == 0) 1082 rc = -EIO; 1083 } 1084 1085 if (rsp->DialectRevision == cpu_to_le16(SMB311_PROT_ID)) { 1086 if (rsp->NegotiateContextCount) 1087 rc = smb311_decode_neg_context(rsp, server, 1088 rsp_iov.iov_len); 1089 else 1090 cifs_server_dbg(VFS, "Missing expected negotiate contexts\n"); 1091 } 1092 neg_exit: 1093 free_rsp_buf(resp_buftype, rsp); 1094 return rc; 1095 } 1096 1097 int smb3_validate_negotiate(const unsigned int xid, struct cifs_tcon *tcon) 1098 { 1099 int rc; 1100 struct validate_negotiate_info_req *pneg_inbuf; 1101 struct validate_negotiate_info_rsp *pneg_rsp = NULL; 1102 u32 rsplen; 1103 u32 inbuflen; /* max of 4 dialects */ 1104 struct TCP_Server_Info *server = tcon->ses->server; 1105 1106 cifs_dbg(FYI, "validate negotiate\n"); 1107 1108 /* In SMB3.11 preauth integrity supersedes validate negotiate */ 1109 if (server->dialect == SMB311_PROT_ID) 1110 return 0; 1111 1112 /* 1113 * validation ioctl must be signed, so no point sending this if we 1114 * can not sign it (ie are not known user). Even if signing is not 1115 * required (enabled but not negotiated), in those cases we selectively 1116 * sign just this, the first and only signed request on a connection. 1117 * Having validation of negotiate info helps reduce attack vectors. 1118 */ 1119 if (tcon->ses->session_flags & SMB2_SESSION_FLAG_IS_GUEST) 1120 return 0; /* validation requires signing */ 1121 1122 if (tcon->ses->user_name == NULL) { 1123 cifs_dbg(FYI, "Can't validate negotiate: null user mount\n"); 1124 return 0; /* validation requires signing */ 1125 } 1126 1127 if (tcon->ses->session_flags & SMB2_SESSION_FLAG_IS_NULL) 1128 cifs_tcon_dbg(VFS, "Unexpected null user (anonymous) auth flag sent by server\n"); 1129 1130 pneg_inbuf = kmalloc(sizeof(*pneg_inbuf), GFP_NOFS); 1131 if (!pneg_inbuf) 1132 return -ENOMEM; 1133 1134 pneg_inbuf->Capabilities = 1135 cpu_to_le32(server->vals->req_capabilities); 1136 if (tcon->ses->chan_max > 1) 1137 pneg_inbuf->Capabilities |= cpu_to_le32(SMB2_GLOBAL_CAP_MULTI_CHANNEL); 1138 1139 memcpy(pneg_inbuf->Guid, server->client_guid, 1140 SMB2_CLIENT_GUID_SIZE); 1141 1142 if (tcon->ses->sign) 1143 pneg_inbuf->SecurityMode = 1144 cpu_to_le16(SMB2_NEGOTIATE_SIGNING_REQUIRED); 1145 else if (global_secflags & CIFSSEC_MAY_SIGN) 1146 pneg_inbuf->SecurityMode = 1147 cpu_to_le16(SMB2_NEGOTIATE_SIGNING_ENABLED); 1148 else 1149 pneg_inbuf->SecurityMode = 0; 1150 1151 1152 if (strcmp(server->vals->version_string, 1153 SMB3ANY_VERSION_STRING) == 0) { 1154 pneg_inbuf->Dialects[0] = cpu_to_le16(SMB30_PROT_ID); 1155 pneg_inbuf->Dialects[1] = cpu_to_le16(SMB302_PROT_ID); 1156 pneg_inbuf->Dialects[2] = cpu_to_le16(SMB311_PROT_ID); 1157 pneg_inbuf->DialectCount = cpu_to_le16(3); 1158 /* SMB 2.1 not included so subtract one dialect from len */ 1159 inbuflen = sizeof(*pneg_inbuf) - 1160 (sizeof(pneg_inbuf->Dialects[0])); 1161 } else if (strcmp(server->vals->version_string, 1162 SMBDEFAULT_VERSION_STRING) == 0) { 1163 pneg_inbuf->Dialects[0] = cpu_to_le16(SMB21_PROT_ID); 1164 pneg_inbuf->Dialects[1] = cpu_to_le16(SMB30_PROT_ID); 1165 pneg_inbuf->Dialects[2] = cpu_to_le16(SMB302_PROT_ID); 1166 pneg_inbuf->Dialects[3] = cpu_to_le16(SMB311_PROT_ID); 1167 pneg_inbuf->DialectCount = cpu_to_le16(4); 1168 /* structure is big enough for 4 dialects */ 1169 inbuflen = sizeof(*pneg_inbuf); 1170 } else { 1171 /* otherwise specific dialect was requested */ 1172 pneg_inbuf->Dialects[0] = 1173 cpu_to_le16(server->vals->protocol_id); 1174 pneg_inbuf->DialectCount = cpu_to_le16(1); 1175 /* structure is big enough for 4 dialects, sending only 1 */ 1176 inbuflen = sizeof(*pneg_inbuf) - 1177 sizeof(pneg_inbuf->Dialects[0]) * 3; 1178 } 1179 1180 rc = SMB2_ioctl(xid, tcon, NO_FILE_ID, NO_FILE_ID, 1181 FSCTL_VALIDATE_NEGOTIATE_INFO, 1182 (char *)pneg_inbuf, inbuflen, CIFSMaxBufSize, 1183 (char **)&pneg_rsp, &rsplen); 1184 if (rc == -EOPNOTSUPP) { 1185 /* 1186 * Old Windows versions or Netapp SMB server can return 1187 * not supported error. Client should accept it. 1188 */ 1189 cifs_tcon_dbg(VFS, "Server does not support validate negotiate\n"); 1190 rc = 0; 1191 goto out_free_inbuf; 1192 } else if (rc != 0) { 1193 cifs_tcon_dbg(VFS, "validate protocol negotiate failed: %d\n", 1194 rc); 1195 rc = -EIO; 1196 goto out_free_inbuf; 1197 } 1198 1199 rc = -EIO; 1200 if (rsplen != sizeof(*pneg_rsp)) { 1201 cifs_tcon_dbg(VFS, "Invalid protocol negotiate response size: %d\n", 1202 rsplen); 1203 1204 /* relax check since Mac returns max bufsize allowed on ioctl */ 1205 if (rsplen > CIFSMaxBufSize || rsplen < sizeof(*pneg_rsp)) 1206 goto out_free_rsp; 1207 } 1208 1209 /* check validate negotiate info response matches what we got earlier */ 1210 if (pneg_rsp->Dialect != cpu_to_le16(server->dialect)) 1211 goto vneg_out; 1212 1213 if (pneg_rsp->SecurityMode != cpu_to_le16(server->sec_mode)) 1214 goto vneg_out; 1215 1216 /* do not validate server guid because not saved at negprot time yet */ 1217 1218 if ((le32_to_cpu(pneg_rsp->Capabilities) | SMB2_NT_FIND | 1219 SMB2_LARGE_FILES) != server->capabilities) 1220 goto vneg_out; 1221 1222 /* validate negotiate successful */ 1223 rc = 0; 1224 cifs_dbg(FYI, "validate negotiate info successful\n"); 1225 goto out_free_rsp; 1226 1227 vneg_out: 1228 cifs_tcon_dbg(VFS, "protocol revalidation - security settings mismatch\n"); 1229 out_free_rsp: 1230 kfree(pneg_rsp); 1231 out_free_inbuf: 1232 kfree(pneg_inbuf); 1233 return rc; 1234 } 1235 1236 enum securityEnum 1237 smb2_select_sectype(struct TCP_Server_Info *server, enum securityEnum requested) 1238 { 1239 switch (requested) { 1240 case Kerberos: 1241 case RawNTLMSSP: 1242 return requested; 1243 case NTLMv2: 1244 return RawNTLMSSP; 1245 case Unspecified: 1246 if (server->sec_ntlmssp && 1247 (global_secflags & CIFSSEC_MAY_NTLMSSP)) 1248 return RawNTLMSSP; 1249 if ((server->sec_kerberos || server->sec_mskerberos) && 1250 (global_secflags & CIFSSEC_MAY_KRB5)) 1251 return Kerberos; 1252 fallthrough; 1253 default: 1254 return Unspecified; 1255 } 1256 } 1257 1258 struct SMB2_sess_data { 1259 unsigned int xid; 1260 struct cifs_ses *ses; 1261 struct TCP_Server_Info *server; 1262 struct nls_table *nls_cp; 1263 void (*func)(struct SMB2_sess_data *); 1264 int result; 1265 u64 previous_session; 1266 1267 /* we will send the SMB in three pieces: 1268 * a fixed length beginning part, an optional 1269 * SPNEGO blob (which can be zero length), and a 1270 * last part which will include the strings 1271 * and rest of bcc area. This allows us to avoid 1272 * a large buffer 17K allocation 1273 */ 1274 int buf0_type; 1275 struct kvec iov[2]; 1276 }; 1277 1278 static int 1279 SMB2_sess_alloc_buffer(struct SMB2_sess_data *sess_data) 1280 { 1281 int rc; 1282 struct cifs_ses *ses = sess_data->ses; 1283 struct TCP_Server_Info *server = sess_data->server; 1284 struct smb2_sess_setup_req *req; 1285 unsigned int total_len; 1286 bool is_binding = false; 1287 1288 rc = smb2_plain_req_init(SMB2_SESSION_SETUP, NULL, server, 1289 (void **) &req, 1290 &total_len); 1291 if (rc) 1292 return rc; 1293 1294 spin_lock(&ses->ses_lock); 1295 is_binding = (ses->ses_status == SES_GOOD); 1296 spin_unlock(&ses->ses_lock); 1297 1298 if (is_binding) { 1299 req->hdr.SessionId = cpu_to_le64(ses->Suid); 1300 req->hdr.Flags |= SMB2_FLAGS_SIGNED; 1301 req->PreviousSessionId = 0; 1302 req->Flags = SMB2_SESSION_REQ_FLAG_BINDING; 1303 cifs_dbg(FYI, "Binding to sess id: %llx\n", ses->Suid); 1304 } else { 1305 /* First session, not a reauthenticate */ 1306 req->hdr.SessionId = 0; 1307 /* 1308 * if reconnect, we need to send previous sess id 1309 * otherwise it is 0 1310 */ 1311 req->PreviousSessionId = cpu_to_le64(sess_data->previous_session); 1312 req->Flags = 0; /* MBZ */ 1313 cifs_dbg(FYI, "Fresh session. Previous: %llx\n", 1314 sess_data->previous_session); 1315 } 1316 1317 /* enough to enable echos and oplocks and one max size write */ 1318 if (server->credits >= server->max_credits) 1319 req->hdr.CreditRequest = cpu_to_le16(0); 1320 else 1321 req->hdr.CreditRequest = cpu_to_le16( 1322 min_t(int, server->max_credits - 1323 server->credits, 130)); 1324 1325 /* only one of SMB2 signing flags may be set in SMB2 request */ 1326 if (server->sign) 1327 req->SecurityMode = SMB2_NEGOTIATE_SIGNING_REQUIRED; 1328 else if (global_secflags & CIFSSEC_MAY_SIGN) /* one flag unlike MUST_ */ 1329 req->SecurityMode = SMB2_NEGOTIATE_SIGNING_ENABLED; 1330 else 1331 req->SecurityMode = 0; 1332 1333 #ifdef CONFIG_CIFS_DFS_UPCALL 1334 req->Capabilities = cpu_to_le32(SMB2_GLOBAL_CAP_DFS); 1335 #else 1336 req->Capabilities = 0; 1337 #endif /* DFS_UPCALL */ 1338 1339 req->Channel = 0; /* MBZ */ 1340 1341 sess_data->iov[0].iov_base = (char *)req; 1342 /* 1 for pad */ 1343 sess_data->iov[0].iov_len = total_len - 1; 1344 /* 1345 * This variable will be used to clear the buffer 1346 * allocated above in case of any error in the calling function. 1347 */ 1348 sess_data->buf0_type = CIFS_SMALL_BUFFER; 1349 1350 return 0; 1351 } 1352 1353 static void 1354 SMB2_sess_free_buffer(struct SMB2_sess_data *sess_data) 1355 { 1356 struct kvec *iov = sess_data->iov; 1357 1358 /* iov[1] is already freed by caller */ 1359 if (sess_data->buf0_type != CIFS_NO_BUFFER && iov[0].iov_base) 1360 memzero_explicit(iov[0].iov_base, iov[0].iov_len); 1361 1362 free_rsp_buf(sess_data->buf0_type, iov[0].iov_base); 1363 sess_data->buf0_type = CIFS_NO_BUFFER; 1364 } 1365 1366 static int 1367 SMB2_sess_sendreceive(struct SMB2_sess_data *sess_data) 1368 { 1369 int rc; 1370 struct smb_rqst rqst; 1371 struct smb2_sess_setup_req *req = sess_data->iov[0].iov_base; 1372 struct kvec rsp_iov = { NULL, 0 }; 1373 1374 /* Testing shows that buffer offset must be at location of Buffer[0] */ 1375 req->SecurityBufferOffset = 1376 cpu_to_le16(sizeof(struct smb2_sess_setup_req)); 1377 req->SecurityBufferLength = cpu_to_le16(sess_data->iov[1].iov_len); 1378 1379 memset(&rqst, 0, sizeof(struct smb_rqst)); 1380 rqst.rq_iov = sess_data->iov; 1381 rqst.rq_nvec = 2; 1382 1383 /* BB add code to build os and lm fields */ 1384 rc = cifs_send_recv(sess_data->xid, sess_data->ses, 1385 sess_data->server, 1386 &rqst, 1387 &sess_data->buf0_type, 1388 CIFS_LOG_ERROR | CIFS_SESS_OP, &rsp_iov); 1389 cifs_small_buf_release(sess_data->iov[0].iov_base); 1390 memcpy(&sess_data->iov[0], &rsp_iov, sizeof(struct kvec)); 1391 1392 return rc; 1393 } 1394 1395 static int 1396 SMB2_sess_establish_session(struct SMB2_sess_data *sess_data) 1397 { 1398 int rc = 0; 1399 struct cifs_ses *ses = sess_data->ses; 1400 struct TCP_Server_Info *server = sess_data->server; 1401 1402 cifs_server_lock(server); 1403 if (server->ops->generate_signingkey) { 1404 rc = server->ops->generate_signingkey(ses, server); 1405 if (rc) { 1406 cifs_dbg(FYI, 1407 "SMB3 session key generation failed\n"); 1408 cifs_server_unlock(server); 1409 return rc; 1410 } 1411 } 1412 if (!server->session_estab) { 1413 server->sequence_number = 0x2; 1414 server->session_estab = true; 1415 } 1416 cifs_server_unlock(server); 1417 1418 cifs_dbg(FYI, "SMB2/3 session established successfully\n"); 1419 return rc; 1420 } 1421 1422 #ifdef CONFIG_CIFS_UPCALL 1423 static void 1424 SMB2_auth_kerberos(struct SMB2_sess_data *sess_data) 1425 { 1426 int rc; 1427 struct cifs_ses *ses = sess_data->ses; 1428 struct TCP_Server_Info *server = sess_data->server; 1429 struct cifs_spnego_msg *msg; 1430 struct key *spnego_key = NULL; 1431 struct smb2_sess_setup_rsp *rsp = NULL; 1432 bool is_binding = false; 1433 1434 rc = SMB2_sess_alloc_buffer(sess_data); 1435 if (rc) 1436 goto out; 1437 1438 spnego_key = cifs_get_spnego_key(ses, server); 1439 if (IS_ERR(spnego_key)) { 1440 rc = PTR_ERR(spnego_key); 1441 if (rc == -ENOKEY) 1442 cifs_dbg(VFS, "Verify user has a krb5 ticket and keyutils is installed\n"); 1443 spnego_key = NULL; 1444 goto out; 1445 } 1446 1447 msg = spnego_key->payload.data[0]; 1448 /* 1449 * check version field to make sure that cifs.upcall is 1450 * sending us a response in an expected form 1451 */ 1452 if (msg->version != CIFS_SPNEGO_UPCALL_VERSION) { 1453 cifs_dbg(VFS, "bad cifs.upcall version. Expected %d got %d\n", 1454 CIFS_SPNEGO_UPCALL_VERSION, msg->version); 1455 rc = -EKEYREJECTED; 1456 goto out_put_spnego_key; 1457 } 1458 1459 spin_lock(&ses->ses_lock); 1460 is_binding = (ses->ses_status == SES_GOOD); 1461 spin_unlock(&ses->ses_lock); 1462 1463 /* keep session key if binding */ 1464 if (!is_binding) { 1465 kfree_sensitive(ses->auth_key.response); 1466 ses->auth_key.response = kmemdup(msg->data, msg->sesskey_len, 1467 GFP_KERNEL); 1468 if (!ses->auth_key.response) { 1469 cifs_dbg(VFS, "Kerberos can't allocate (%u bytes) memory\n", 1470 msg->sesskey_len); 1471 rc = -ENOMEM; 1472 goto out_put_spnego_key; 1473 } 1474 ses->auth_key.len = msg->sesskey_len; 1475 } 1476 1477 sess_data->iov[1].iov_base = msg->data + msg->sesskey_len; 1478 sess_data->iov[1].iov_len = msg->secblob_len; 1479 1480 rc = SMB2_sess_sendreceive(sess_data); 1481 if (rc) 1482 goto out_put_spnego_key; 1483 1484 rsp = (struct smb2_sess_setup_rsp *)sess_data->iov[0].iov_base; 1485 /* keep session id and flags if binding */ 1486 if (!is_binding) { 1487 ses->Suid = le64_to_cpu(rsp->hdr.SessionId); 1488 ses->session_flags = le16_to_cpu(rsp->SessionFlags); 1489 } 1490 1491 rc = SMB2_sess_establish_session(sess_data); 1492 out_put_spnego_key: 1493 key_invalidate(spnego_key); 1494 key_put(spnego_key); 1495 if (rc) { 1496 kfree_sensitive(ses->auth_key.response); 1497 ses->auth_key.response = NULL; 1498 ses->auth_key.len = 0; 1499 } 1500 out: 1501 sess_data->result = rc; 1502 sess_data->func = NULL; 1503 SMB2_sess_free_buffer(sess_data); 1504 } 1505 #else 1506 static void 1507 SMB2_auth_kerberos(struct SMB2_sess_data *sess_data) 1508 { 1509 cifs_dbg(VFS, "Kerberos negotiated but upcall support disabled!\n"); 1510 sess_data->result = -EOPNOTSUPP; 1511 sess_data->func = NULL; 1512 } 1513 #endif 1514 1515 static void 1516 SMB2_sess_auth_rawntlmssp_authenticate(struct SMB2_sess_data *sess_data); 1517 1518 static void 1519 SMB2_sess_auth_rawntlmssp_negotiate(struct SMB2_sess_data *sess_data) 1520 { 1521 int rc; 1522 struct cifs_ses *ses = sess_data->ses; 1523 struct TCP_Server_Info *server = sess_data->server; 1524 struct smb2_sess_setup_rsp *rsp = NULL; 1525 unsigned char *ntlmssp_blob = NULL; 1526 bool use_spnego = false; /* else use raw ntlmssp */ 1527 u16 blob_length = 0; 1528 bool is_binding = false; 1529 1530 /* 1531 * If memory allocation is successful, caller of this function 1532 * frees it. 1533 */ 1534 ses->ntlmssp = kmalloc(sizeof(struct ntlmssp_auth), GFP_KERNEL); 1535 if (!ses->ntlmssp) { 1536 rc = -ENOMEM; 1537 goto out_err; 1538 } 1539 ses->ntlmssp->sesskey_per_smbsess = true; 1540 1541 rc = SMB2_sess_alloc_buffer(sess_data); 1542 if (rc) 1543 goto out_err; 1544 1545 rc = build_ntlmssp_smb3_negotiate_blob(&ntlmssp_blob, 1546 &blob_length, ses, server, 1547 sess_data->nls_cp); 1548 if (rc) 1549 goto out; 1550 1551 if (use_spnego) { 1552 /* BB eventually need to add this */ 1553 cifs_dbg(VFS, "spnego not supported for SMB2 yet\n"); 1554 rc = -EOPNOTSUPP; 1555 goto out; 1556 } 1557 sess_data->iov[1].iov_base = ntlmssp_blob; 1558 sess_data->iov[1].iov_len = blob_length; 1559 1560 rc = SMB2_sess_sendreceive(sess_data); 1561 rsp = (struct smb2_sess_setup_rsp *)sess_data->iov[0].iov_base; 1562 1563 /* If true, rc here is expected and not an error */ 1564 if (sess_data->buf0_type != CIFS_NO_BUFFER && 1565 rsp->hdr.Status == STATUS_MORE_PROCESSING_REQUIRED) 1566 rc = 0; 1567 1568 if (rc) 1569 goto out; 1570 1571 if (offsetof(struct smb2_sess_setup_rsp, Buffer) != 1572 le16_to_cpu(rsp->SecurityBufferOffset)) { 1573 cifs_dbg(VFS, "Invalid security buffer offset %d\n", 1574 le16_to_cpu(rsp->SecurityBufferOffset)); 1575 rc = -EIO; 1576 goto out; 1577 } 1578 rc = decode_ntlmssp_challenge(rsp->Buffer, 1579 le16_to_cpu(rsp->SecurityBufferLength), ses); 1580 if (rc) 1581 goto out; 1582 1583 cifs_dbg(FYI, "rawntlmssp session setup challenge phase\n"); 1584 1585 spin_lock(&ses->ses_lock); 1586 is_binding = (ses->ses_status == SES_GOOD); 1587 spin_unlock(&ses->ses_lock); 1588 1589 /* keep existing ses id and flags if binding */ 1590 if (!is_binding) { 1591 ses->Suid = le64_to_cpu(rsp->hdr.SessionId); 1592 ses->session_flags = le16_to_cpu(rsp->SessionFlags); 1593 } 1594 1595 out: 1596 kfree_sensitive(ntlmssp_blob); 1597 SMB2_sess_free_buffer(sess_data); 1598 if (!rc) { 1599 sess_data->result = 0; 1600 sess_data->func = SMB2_sess_auth_rawntlmssp_authenticate; 1601 return; 1602 } 1603 out_err: 1604 kfree_sensitive(ses->ntlmssp); 1605 ses->ntlmssp = NULL; 1606 sess_data->result = rc; 1607 sess_data->func = NULL; 1608 } 1609 1610 static void 1611 SMB2_sess_auth_rawntlmssp_authenticate(struct SMB2_sess_data *sess_data) 1612 { 1613 int rc; 1614 struct cifs_ses *ses = sess_data->ses; 1615 struct TCP_Server_Info *server = sess_data->server; 1616 struct smb2_sess_setup_req *req; 1617 struct smb2_sess_setup_rsp *rsp = NULL; 1618 unsigned char *ntlmssp_blob = NULL; 1619 bool use_spnego = false; /* else use raw ntlmssp */ 1620 u16 blob_length = 0; 1621 bool is_binding = false; 1622 1623 rc = SMB2_sess_alloc_buffer(sess_data); 1624 if (rc) 1625 goto out; 1626 1627 req = (struct smb2_sess_setup_req *) sess_data->iov[0].iov_base; 1628 req->hdr.SessionId = cpu_to_le64(ses->Suid); 1629 1630 rc = build_ntlmssp_auth_blob(&ntlmssp_blob, &blob_length, 1631 ses, server, 1632 sess_data->nls_cp); 1633 if (rc) { 1634 cifs_dbg(FYI, "build_ntlmssp_auth_blob failed %d\n", rc); 1635 goto out; 1636 } 1637 1638 if (use_spnego) { 1639 /* BB eventually need to add this */ 1640 cifs_dbg(VFS, "spnego not supported for SMB2 yet\n"); 1641 rc = -EOPNOTSUPP; 1642 goto out; 1643 } 1644 sess_data->iov[1].iov_base = ntlmssp_blob; 1645 sess_data->iov[1].iov_len = blob_length; 1646 1647 rc = SMB2_sess_sendreceive(sess_data); 1648 if (rc) 1649 goto out; 1650 1651 rsp = (struct smb2_sess_setup_rsp *)sess_data->iov[0].iov_base; 1652 1653 spin_lock(&ses->ses_lock); 1654 is_binding = (ses->ses_status == SES_GOOD); 1655 spin_unlock(&ses->ses_lock); 1656 1657 /* keep existing ses id and flags if binding */ 1658 if (!is_binding) { 1659 ses->Suid = le64_to_cpu(rsp->hdr.SessionId); 1660 ses->session_flags = le16_to_cpu(rsp->SessionFlags); 1661 } 1662 1663 rc = SMB2_sess_establish_session(sess_data); 1664 #ifdef CONFIG_CIFS_DEBUG_DUMP_KEYS 1665 if (ses->server->dialect < SMB30_PROT_ID) { 1666 cifs_dbg(VFS, "%s: dumping generated SMB2 session keys\n", __func__); 1667 /* 1668 * The session id is opaque in terms of endianness, so we can't 1669 * print it as a long long. we dump it as we got it on the wire 1670 */ 1671 cifs_dbg(VFS, "Session Id %*ph\n", (int)sizeof(ses->Suid), 1672 &ses->Suid); 1673 cifs_dbg(VFS, "Session Key %*ph\n", 1674 SMB2_NTLMV2_SESSKEY_SIZE, ses->auth_key.response); 1675 cifs_dbg(VFS, "Signing Key %*ph\n", 1676 SMB3_SIGN_KEY_SIZE, ses->auth_key.response); 1677 } 1678 #endif 1679 out: 1680 kfree_sensitive(ntlmssp_blob); 1681 SMB2_sess_free_buffer(sess_data); 1682 kfree_sensitive(ses->ntlmssp); 1683 ses->ntlmssp = NULL; 1684 sess_data->result = rc; 1685 sess_data->func = NULL; 1686 } 1687 1688 static int 1689 SMB2_select_sec(struct SMB2_sess_data *sess_data) 1690 { 1691 int type; 1692 struct cifs_ses *ses = sess_data->ses; 1693 struct TCP_Server_Info *server = sess_data->server; 1694 1695 type = smb2_select_sectype(server, ses->sectype); 1696 cifs_dbg(FYI, "sess setup type %d\n", type); 1697 if (type == Unspecified) { 1698 cifs_dbg(VFS, "Unable to select appropriate authentication method!\n"); 1699 return -EINVAL; 1700 } 1701 1702 switch (type) { 1703 case Kerberos: 1704 sess_data->func = SMB2_auth_kerberos; 1705 break; 1706 case RawNTLMSSP: 1707 sess_data->func = SMB2_sess_auth_rawntlmssp_negotiate; 1708 break; 1709 default: 1710 cifs_dbg(VFS, "secType %d not supported!\n", type); 1711 return -EOPNOTSUPP; 1712 } 1713 1714 return 0; 1715 } 1716 1717 int 1718 SMB2_sess_setup(const unsigned int xid, struct cifs_ses *ses, 1719 struct TCP_Server_Info *server, 1720 const struct nls_table *nls_cp) 1721 { 1722 int rc = 0; 1723 struct SMB2_sess_data *sess_data; 1724 1725 cifs_dbg(FYI, "Session Setup\n"); 1726 1727 if (!server) { 1728 WARN(1, "%s: server is NULL!\n", __func__); 1729 return -EIO; 1730 } 1731 1732 sess_data = kzalloc(sizeof(struct SMB2_sess_data), GFP_KERNEL); 1733 if (!sess_data) 1734 return -ENOMEM; 1735 1736 sess_data->xid = xid; 1737 sess_data->ses = ses; 1738 sess_data->server = server; 1739 sess_data->buf0_type = CIFS_NO_BUFFER; 1740 sess_data->nls_cp = (struct nls_table *) nls_cp; 1741 sess_data->previous_session = ses->Suid; 1742 1743 rc = SMB2_select_sec(sess_data); 1744 if (rc) 1745 goto out; 1746 1747 /* 1748 * Initialize the session hash with the server one. 1749 */ 1750 memcpy(ses->preauth_sha_hash, server->preauth_sha_hash, 1751 SMB2_PREAUTH_HASH_SIZE); 1752 1753 while (sess_data->func) 1754 sess_data->func(sess_data); 1755 1756 if ((ses->session_flags & SMB2_SESSION_FLAG_IS_GUEST) && (ses->sign)) 1757 cifs_server_dbg(VFS, "signing requested but authenticated as guest\n"); 1758 rc = sess_data->result; 1759 out: 1760 kfree_sensitive(sess_data); 1761 return rc; 1762 } 1763 1764 int 1765 SMB2_logoff(const unsigned int xid, struct cifs_ses *ses) 1766 { 1767 struct smb_rqst rqst; 1768 struct smb2_logoff_req *req; /* response is also trivial struct */ 1769 int rc = 0; 1770 struct TCP_Server_Info *server; 1771 int flags = 0; 1772 unsigned int total_len; 1773 struct kvec iov[1]; 1774 struct kvec rsp_iov; 1775 int resp_buf_type; 1776 1777 cifs_dbg(FYI, "disconnect session %p\n", ses); 1778 1779 if (ses && (ses->server)) 1780 server = ses->server; 1781 else 1782 return -EIO; 1783 1784 /* no need to send SMB logoff if uid already closed due to reconnect */ 1785 spin_lock(&ses->chan_lock); 1786 if (CIFS_ALL_CHANS_NEED_RECONNECT(ses)) { 1787 spin_unlock(&ses->chan_lock); 1788 goto smb2_session_already_dead; 1789 } 1790 spin_unlock(&ses->chan_lock); 1791 1792 rc = smb2_plain_req_init(SMB2_LOGOFF, NULL, ses->server, 1793 (void **) &req, &total_len); 1794 if (rc) 1795 return rc; 1796 1797 /* since no tcon, smb2_init can not do this, so do here */ 1798 req->hdr.SessionId = cpu_to_le64(ses->Suid); 1799 1800 if (ses->session_flags & SMB2_SESSION_FLAG_ENCRYPT_DATA) 1801 flags |= CIFS_TRANSFORM_REQ; 1802 else if (server->sign) 1803 req->hdr.Flags |= SMB2_FLAGS_SIGNED; 1804 1805 flags |= CIFS_NO_RSP_BUF; 1806 1807 iov[0].iov_base = (char *)req; 1808 iov[0].iov_len = total_len; 1809 1810 memset(&rqst, 0, sizeof(struct smb_rqst)); 1811 rqst.rq_iov = iov; 1812 rqst.rq_nvec = 1; 1813 1814 rc = cifs_send_recv(xid, ses, ses->server, 1815 &rqst, &resp_buf_type, flags, &rsp_iov); 1816 cifs_small_buf_release(req); 1817 /* 1818 * No tcon so can't do 1819 * cifs_stats_inc(&tcon->stats.smb2_stats.smb2_com_fail[SMB2...]); 1820 */ 1821 1822 smb2_session_already_dead: 1823 return rc; 1824 } 1825 1826 static inline void cifs_stats_fail_inc(struct cifs_tcon *tcon, uint16_t code) 1827 { 1828 cifs_stats_inc(&tcon->stats.smb2_stats.smb2_com_failed[code]); 1829 } 1830 1831 #define MAX_SHARENAME_LENGTH (255 /* server */ + 80 /* share */ + 1 /* NULL */) 1832 1833 /* These are similar values to what Windows uses */ 1834 static inline void init_copy_chunk_defaults(struct cifs_tcon *tcon) 1835 { 1836 tcon->max_chunks = 256; 1837 tcon->max_bytes_chunk = 1048576; 1838 tcon->max_bytes_copy = 16777216; 1839 } 1840 1841 int 1842 SMB2_tcon(const unsigned int xid, struct cifs_ses *ses, const char *tree, 1843 struct cifs_tcon *tcon, const struct nls_table *cp) 1844 { 1845 struct smb_rqst rqst; 1846 struct smb2_tree_connect_req *req; 1847 struct smb2_tree_connect_rsp *rsp = NULL; 1848 struct kvec iov[2]; 1849 struct kvec rsp_iov = { NULL, 0 }; 1850 int rc = 0; 1851 int resp_buftype; 1852 int unc_path_len; 1853 __le16 *unc_path = NULL; 1854 int flags = 0; 1855 unsigned int total_len; 1856 struct TCP_Server_Info *server; 1857 1858 /* always use master channel */ 1859 server = ses->server; 1860 1861 cifs_dbg(FYI, "TCON\n"); 1862 1863 if (!server || !tree) 1864 return -EIO; 1865 1866 unc_path = kmalloc(MAX_SHARENAME_LENGTH * 2, GFP_KERNEL); 1867 if (unc_path == NULL) 1868 return -ENOMEM; 1869 1870 unc_path_len = cifs_strtoUTF16(unc_path, tree, strlen(tree), cp); 1871 if (unc_path_len <= 0) { 1872 kfree(unc_path); 1873 return -EINVAL; 1874 } 1875 unc_path_len *= 2; 1876 1877 /* SMB2 TREE_CONNECT request must be called with TreeId == 0 */ 1878 tcon->tid = 0; 1879 atomic_set(&tcon->num_remote_opens, 0); 1880 rc = smb2_plain_req_init(SMB2_TREE_CONNECT, tcon, server, 1881 (void **) &req, &total_len); 1882 if (rc) { 1883 kfree(unc_path); 1884 return rc; 1885 } 1886 1887 if (smb3_encryption_required(tcon)) 1888 flags |= CIFS_TRANSFORM_REQ; 1889 1890 iov[0].iov_base = (char *)req; 1891 /* 1 for pad */ 1892 iov[0].iov_len = total_len - 1; 1893 1894 /* Testing shows that buffer offset must be at location of Buffer[0] */ 1895 req->PathOffset = cpu_to_le16(sizeof(struct smb2_tree_connect_req)); 1896 req->PathLength = cpu_to_le16(unc_path_len); 1897 iov[1].iov_base = unc_path; 1898 iov[1].iov_len = unc_path_len; 1899 1900 /* 1901 * 3.11 tcon req must be signed if not encrypted. See MS-SMB2 3.2.4.1.1 1902 * unless it is guest or anonymous user. See MS-SMB2 3.2.5.3.1 1903 * (Samba servers don't always set the flag so also check if null user) 1904 */ 1905 if ((server->dialect == SMB311_PROT_ID) && 1906 !smb3_encryption_required(tcon) && 1907 !(ses->session_flags & 1908 (SMB2_SESSION_FLAG_IS_GUEST|SMB2_SESSION_FLAG_IS_NULL)) && 1909 ((ses->user_name != NULL) || (ses->sectype == Kerberos))) 1910 req->hdr.Flags |= SMB2_FLAGS_SIGNED; 1911 1912 memset(&rqst, 0, sizeof(struct smb_rqst)); 1913 rqst.rq_iov = iov; 1914 rqst.rq_nvec = 2; 1915 1916 /* Need 64 for max size write so ask for more in case not there yet */ 1917 if (server->credits >= server->max_credits) 1918 req->hdr.CreditRequest = cpu_to_le16(0); 1919 else 1920 req->hdr.CreditRequest = cpu_to_le16( 1921 min_t(int, server->max_credits - 1922 server->credits, 64)); 1923 1924 rc = cifs_send_recv(xid, ses, server, 1925 &rqst, &resp_buftype, flags, &rsp_iov); 1926 cifs_small_buf_release(req); 1927 rsp = (struct smb2_tree_connect_rsp *)rsp_iov.iov_base; 1928 trace_smb3_tcon(xid, tcon->tid, ses->Suid, tree, rc); 1929 if ((rc != 0) || (rsp == NULL)) { 1930 cifs_stats_fail_inc(tcon, SMB2_TREE_CONNECT_HE); 1931 tcon->need_reconnect = true; 1932 goto tcon_error_exit; 1933 } 1934 1935 switch (rsp->ShareType) { 1936 case SMB2_SHARE_TYPE_DISK: 1937 cifs_dbg(FYI, "connection to disk share\n"); 1938 break; 1939 case SMB2_SHARE_TYPE_PIPE: 1940 tcon->pipe = true; 1941 cifs_dbg(FYI, "connection to pipe share\n"); 1942 break; 1943 case SMB2_SHARE_TYPE_PRINT: 1944 tcon->print = true; 1945 cifs_dbg(FYI, "connection to printer\n"); 1946 break; 1947 default: 1948 cifs_server_dbg(VFS, "unknown share type %d\n", rsp->ShareType); 1949 rc = -EOPNOTSUPP; 1950 goto tcon_error_exit; 1951 } 1952 1953 tcon->share_flags = le32_to_cpu(rsp->ShareFlags); 1954 tcon->capabilities = rsp->Capabilities; /* we keep caps little endian */ 1955 tcon->maximal_access = le32_to_cpu(rsp->MaximalAccess); 1956 tcon->tid = le32_to_cpu(rsp->hdr.Id.SyncId.TreeId); 1957 strscpy(tcon->tree_name, tree, sizeof(tcon->tree_name)); 1958 1959 if ((rsp->Capabilities & SMB2_SHARE_CAP_DFS) && 1960 ((tcon->share_flags & SHI1005_FLAGS_DFS) == 0)) 1961 cifs_tcon_dbg(VFS, "DFS capability contradicts DFS flag\n"); 1962 1963 if (tcon->seal && 1964 !(server->capabilities & SMB2_GLOBAL_CAP_ENCRYPTION)) 1965 cifs_tcon_dbg(VFS, "Encryption is requested but not supported\n"); 1966 1967 init_copy_chunk_defaults(tcon); 1968 if (server->ops->validate_negotiate) 1969 rc = server->ops->validate_negotiate(xid, tcon); 1970 if (rc == 0) /* See MS-SMB2 2.2.10 and 3.2.5.5 */ 1971 if (tcon->share_flags & SMB2_SHAREFLAG_ISOLATED_TRANSPORT) 1972 server->nosharesock = true; 1973 tcon_exit: 1974 1975 free_rsp_buf(resp_buftype, rsp); 1976 kfree(unc_path); 1977 return rc; 1978 1979 tcon_error_exit: 1980 if (rsp && rsp->hdr.Status == STATUS_BAD_NETWORK_NAME) 1981 cifs_tcon_dbg(VFS, "BAD_NETWORK_NAME: %s\n", tree); 1982 goto tcon_exit; 1983 } 1984 1985 int 1986 SMB2_tdis(const unsigned int xid, struct cifs_tcon *tcon) 1987 { 1988 struct smb_rqst rqst; 1989 struct smb2_tree_disconnect_req *req; /* response is trivial */ 1990 int rc = 0; 1991 struct cifs_ses *ses = tcon->ses; 1992 int flags = 0; 1993 unsigned int total_len; 1994 struct kvec iov[1]; 1995 struct kvec rsp_iov; 1996 int resp_buf_type; 1997 1998 cifs_dbg(FYI, "Tree Disconnect\n"); 1999 2000 if (!ses || !(ses->server)) 2001 return -EIO; 2002 2003 trace_smb3_tdis_enter(xid, tcon->tid, ses->Suid, tcon->tree_name); 2004 spin_lock(&ses->chan_lock); 2005 if ((tcon->need_reconnect) || 2006 (CIFS_ALL_CHANS_NEED_RECONNECT(tcon->ses))) { 2007 spin_unlock(&ses->chan_lock); 2008 return 0; 2009 } 2010 spin_unlock(&ses->chan_lock); 2011 2012 invalidate_all_cached_dirs(tcon); 2013 2014 rc = smb2_plain_req_init(SMB2_TREE_DISCONNECT, tcon, ses->server, 2015 (void **) &req, 2016 &total_len); 2017 if (rc) 2018 return rc; 2019 2020 if (smb3_encryption_required(tcon)) 2021 flags |= CIFS_TRANSFORM_REQ; 2022 2023 flags |= CIFS_NO_RSP_BUF; 2024 2025 iov[0].iov_base = (char *)req; 2026 iov[0].iov_len = total_len; 2027 2028 memset(&rqst, 0, sizeof(struct smb_rqst)); 2029 rqst.rq_iov = iov; 2030 rqst.rq_nvec = 1; 2031 2032 rc = cifs_send_recv(xid, ses, ses->server, 2033 &rqst, &resp_buf_type, flags, &rsp_iov); 2034 cifs_small_buf_release(req); 2035 if (rc) { 2036 cifs_stats_fail_inc(tcon, SMB2_TREE_DISCONNECT_HE); 2037 trace_smb3_tdis_err(xid, tcon->tid, ses->Suid, rc); 2038 } 2039 trace_smb3_tdis_done(xid, tcon->tid, ses->Suid); 2040 2041 return rc; 2042 } 2043 2044 2045 static struct create_durable * 2046 create_durable_buf(void) 2047 { 2048 struct create_durable *buf; 2049 2050 buf = kzalloc(sizeof(struct create_durable), GFP_KERNEL); 2051 if (!buf) 2052 return NULL; 2053 2054 buf->ccontext.DataOffset = cpu_to_le16(offsetof 2055 (struct create_durable, Data)); 2056 buf->ccontext.DataLength = cpu_to_le32(16); 2057 buf->ccontext.NameOffset = cpu_to_le16(offsetof 2058 (struct create_durable, Name)); 2059 buf->ccontext.NameLength = cpu_to_le16(4); 2060 /* SMB2_CREATE_DURABLE_HANDLE_REQUEST is "DHnQ" */ 2061 buf->Name[0] = 'D'; 2062 buf->Name[1] = 'H'; 2063 buf->Name[2] = 'n'; 2064 buf->Name[3] = 'Q'; 2065 return buf; 2066 } 2067 2068 static struct create_durable * 2069 create_reconnect_durable_buf(struct cifs_fid *fid) 2070 { 2071 struct create_durable *buf; 2072 2073 buf = kzalloc(sizeof(struct create_durable), GFP_KERNEL); 2074 if (!buf) 2075 return NULL; 2076 2077 buf->ccontext.DataOffset = cpu_to_le16(offsetof 2078 (struct create_durable, Data)); 2079 buf->ccontext.DataLength = cpu_to_le32(16); 2080 buf->ccontext.NameOffset = cpu_to_le16(offsetof 2081 (struct create_durable, Name)); 2082 buf->ccontext.NameLength = cpu_to_le16(4); 2083 buf->Data.Fid.PersistentFileId = fid->persistent_fid; 2084 buf->Data.Fid.VolatileFileId = fid->volatile_fid; 2085 /* SMB2_CREATE_DURABLE_HANDLE_RECONNECT is "DHnC" */ 2086 buf->Name[0] = 'D'; 2087 buf->Name[1] = 'H'; 2088 buf->Name[2] = 'n'; 2089 buf->Name[3] = 'C'; 2090 return buf; 2091 } 2092 2093 static void 2094 parse_query_id_ctxt(struct create_context *cc, struct smb2_file_all_info *buf) 2095 { 2096 struct create_disk_id_rsp *pdisk_id = (struct create_disk_id_rsp *)cc; 2097 2098 cifs_dbg(FYI, "parse query id context 0x%llx 0x%llx\n", 2099 pdisk_id->DiskFileId, pdisk_id->VolumeId); 2100 buf->IndexNumber = pdisk_id->DiskFileId; 2101 } 2102 2103 static void 2104 parse_posix_ctxt(struct create_context *cc, struct smb2_file_all_info *info, 2105 struct create_posix_rsp *posix) 2106 { 2107 int sid_len; 2108 u8 *beg = (u8 *)cc + le16_to_cpu(cc->DataOffset); 2109 u8 *end = beg + le32_to_cpu(cc->DataLength); 2110 u8 *sid; 2111 2112 memset(posix, 0, sizeof(*posix)); 2113 2114 posix->nlink = le32_to_cpu(*(__le32 *)(beg + 0)); 2115 posix->reparse_tag = le32_to_cpu(*(__le32 *)(beg + 4)); 2116 posix->mode = le32_to_cpu(*(__le32 *)(beg + 8)); 2117 2118 sid = beg + 12; 2119 sid_len = posix_info_sid_size(sid, end); 2120 if (sid_len < 0) { 2121 cifs_dbg(VFS, "bad owner sid in posix create response\n"); 2122 return; 2123 } 2124 memcpy(&posix->owner, sid, sid_len); 2125 2126 sid = sid + sid_len; 2127 sid_len = posix_info_sid_size(sid, end); 2128 if (sid_len < 0) { 2129 cifs_dbg(VFS, "bad group sid in posix create response\n"); 2130 return; 2131 } 2132 memcpy(&posix->group, sid, sid_len); 2133 2134 cifs_dbg(FYI, "nlink=%d mode=%o reparse_tag=%x\n", 2135 posix->nlink, posix->mode, posix->reparse_tag); 2136 } 2137 2138 void 2139 smb2_parse_contexts(struct TCP_Server_Info *server, 2140 struct smb2_create_rsp *rsp, 2141 unsigned int *epoch, char *lease_key, __u8 *oplock, 2142 struct smb2_file_all_info *buf, 2143 struct create_posix_rsp *posix) 2144 { 2145 char *data_offset; 2146 struct create_context *cc; 2147 unsigned int next; 2148 unsigned int remaining; 2149 char *name; 2150 static const char smb3_create_tag_posix[] = { 2151 0x93, 0xAD, 0x25, 0x50, 0x9C, 2152 0xB4, 0x11, 0xE7, 0xB4, 0x23, 0x83, 2153 0xDE, 0x96, 0x8B, 0xCD, 0x7C 2154 }; 2155 2156 *oplock = 0; 2157 data_offset = (char *)rsp + le32_to_cpu(rsp->CreateContextsOffset); 2158 remaining = le32_to_cpu(rsp->CreateContextsLength); 2159 cc = (struct create_context *)data_offset; 2160 2161 /* Initialize inode number to 0 in case no valid data in qfid context */ 2162 if (buf) 2163 buf->IndexNumber = 0; 2164 2165 while (remaining >= sizeof(struct create_context)) { 2166 name = le16_to_cpu(cc->NameOffset) + (char *)cc; 2167 if (le16_to_cpu(cc->NameLength) == 4 && 2168 strncmp(name, SMB2_CREATE_REQUEST_LEASE, 4) == 0) 2169 *oplock = server->ops->parse_lease_buf(cc, epoch, 2170 lease_key); 2171 else if (buf && (le16_to_cpu(cc->NameLength) == 4) && 2172 strncmp(name, SMB2_CREATE_QUERY_ON_DISK_ID, 4) == 0) 2173 parse_query_id_ctxt(cc, buf); 2174 else if ((le16_to_cpu(cc->NameLength) == 16)) { 2175 if (posix && 2176 memcmp(name, smb3_create_tag_posix, 16) == 0) 2177 parse_posix_ctxt(cc, buf, posix); 2178 } 2179 /* else { 2180 cifs_dbg(FYI, "Context not matched with len %d\n", 2181 le16_to_cpu(cc->NameLength)); 2182 cifs_dump_mem("Cctxt name: ", name, 4); 2183 } */ 2184 2185 next = le32_to_cpu(cc->Next); 2186 if (!next) 2187 break; 2188 remaining -= next; 2189 cc = (struct create_context *)((char *)cc + next); 2190 } 2191 2192 if (rsp->OplockLevel != SMB2_OPLOCK_LEVEL_LEASE) 2193 *oplock = rsp->OplockLevel; 2194 2195 return; 2196 } 2197 2198 static int 2199 add_lease_context(struct TCP_Server_Info *server, 2200 struct smb2_create_req *req, 2201 struct kvec *iov, 2202 unsigned int *num_iovec, u8 *lease_key, __u8 *oplock) 2203 { 2204 unsigned int num = *num_iovec; 2205 2206 iov[num].iov_base = server->ops->create_lease_buf(lease_key, *oplock); 2207 if (iov[num].iov_base == NULL) 2208 return -ENOMEM; 2209 iov[num].iov_len = server->vals->create_lease_size; 2210 req->RequestedOplockLevel = SMB2_OPLOCK_LEVEL_LEASE; 2211 *num_iovec = num + 1; 2212 return 0; 2213 } 2214 2215 static struct create_durable_v2 * 2216 create_durable_v2_buf(struct cifs_open_parms *oparms) 2217 { 2218 struct cifs_fid *pfid = oparms->fid; 2219 struct create_durable_v2 *buf; 2220 2221 buf = kzalloc(sizeof(struct create_durable_v2), GFP_KERNEL); 2222 if (!buf) 2223 return NULL; 2224 2225 buf->ccontext.DataOffset = cpu_to_le16(offsetof 2226 (struct create_durable_v2, dcontext)); 2227 buf->ccontext.DataLength = cpu_to_le32(sizeof(struct durable_context_v2)); 2228 buf->ccontext.NameOffset = cpu_to_le16(offsetof 2229 (struct create_durable_v2, Name)); 2230 buf->ccontext.NameLength = cpu_to_le16(4); 2231 2232 /* 2233 * NB: Handle timeout defaults to 0, which allows server to choose 2234 * (most servers default to 120 seconds) and most clients default to 0. 2235 * This can be overridden at mount ("handletimeout=") if the user wants 2236 * a different persistent (or resilient) handle timeout for all opens 2237 * opens on a particular SMB3 mount. 2238 */ 2239 buf->dcontext.Timeout = cpu_to_le32(oparms->tcon->handle_timeout); 2240 buf->dcontext.Flags = cpu_to_le32(SMB2_DHANDLE_FLAG_PERSISTENT); 2241 generate_random_uuid(buf->dcontext.CreateGuid); 2242 memcpy(pfid->create_guid, buf->dcontext.CreateGuid, 16); 2243 2244 /* SMB2_CREATE_DURABLE_HANDLE_REQUEST is "DH2Q" */ 2245 buf->Name[0] = 'D'; 2246 buf->Name[1] = 'H'; 2247 buf->Name[2] = '2'; 2248 buf->Name[3] = 'Q'; 2249 return buf; 2250 } 2251 2252 static struct create_durable_handle_reconnect_v2 * 2253 create_reconnect_durable_v2_buf(struct cifs_fid *fid) 2254 { 2255 struct create_durable_handle_reconnect_v2 *buf; 2256 2257 buf = kzalloc(sizeof(struct create_durable_handle_reconnect_v2), 2258 GFP_KERNEL); 2259 if (!buf) 2260 return NULL; 2261 2262 buf->ccontext.DataOffset = 2263 cpu_to_le16(offsetof(struct create_durable_handle_reconnect_v2, 2264 dcontext)); 2265 buf->ccontext.DataLength = 2266 cpu_to_le32(sizeof(struct durable_reconnect_context_v2)); 2267 buf->ccontext.NameOffset = 2268 cpu_to_le16(offsetof(struct create_durable_handle_reconnect_v2, 2269 Name)); 2270 buf->ccontext.NameLength = cpu_to_le16(4); 2271 2272 buf->dcontext.Fid.PersistentFileId = fid->persistent_fid; 2273 buf->dcontext.Fid.VolatileFileId = fid->volatile_fid; 2274 buf->dcontext.Flags = cpu_to_le32(SMB2_DHANDLE_FLAG_PERSISTENT); 2275 memcpy(buf->dcontext.CreateGuid, fid->create_guid, 16); 2276 2277 /* SMB2_CREATE_DURABLE_HANDLE_RECONNECT_V2 is "DH2C" */ 2278 buf->Name[0] = 'D'; 2279 buf->Name[1] = 'H'; 2280 buf->Name[2] = '2'; 2281 buf->Name[3] = 'C'; 2282 return buf; 2283 } 2284 2285 static int 2286 add_durable_v2_context(struct kvec *iov, unsigned int *num_iovec, 2287 struct cifs_open_parms *oparms) 2288 { 2289 unsigned int num = *num_iovec; 2290 2291 iov[num].iov_base = create_durable_v2_buf(oparms); 2292 if (iov[num].iov_base == NULL) 2293 return -ENOMEM; 2294 iov[num].iov_len = sizeof(struct create_durable_v2); 2295 *num_iovec = num + 1; 2296 return 0; 2297 } 2298 2299 static int 2300 add_durable_reconnect_v2_context(struct kvec *iov, unsigned int *num_iovec, 2301 struct cifs_open_parms *oparms) 2302 { 2303 unsigned int num = *num_iovec; 2304 2305 /* indicate that we don't need to relock the file */ 2306 oparms->reconnect = false; 2307 2308 iov[num].iov_base = create_reconnect_durable_v2_buf(oparms->fid); 2309 if (iov[num].iov_base == NULL) 2310 return -ENOMEM; 2311 iov[num].iov_len = sizeof(struct create_durable_handle_reconnect_v2); 2312 *num_iovec = num + 1; 2313 return 0; 2314 } 2315 2316 static int 2317 add_durable_context(struct kvec *iov, unsigned int *num_iovec, 2318 struct cifs_open_parms *oparms, bool use_persistent) 2319 { 2320 unsigned int num = *num_iovec; 2321 2322 if (use_persistent) { 2323 if (oparms->reconnect) 2324 return add_durable_reconnect_v2_context(iov, num_iovec, 2325 oparms); 2326 else 2327 return add_durable_v2_context(iov, num_iovec, oparms); 2328 } 2329 2330 if (oparms->reconnect) { 2331 iov[num].iov_base = create_reconnect_durable_buf(oparms->fid); 2332 /* indicate that we don't need to relock the file */ 2333 oparms->reconnect = false; 2334 } else 2335 iov[num].iov_base = create_durable_buf(); 2336 if (iov[num].iov_base == NULL) 2337 return -ENOMEM; 2338 iov[num].iov_len = sizeof(struct create_durable); 2339 *num_iovec = num + 1; 2340 return 0; 2341 } 2342 2343 /* See MS-SMB2 2.2.13.2.7 */ 2344 static struct crt_twarp_ctxt * 2345 create_twarp_buf(__u64 timewarp) 2346 { 2347 struct crt_twarp_ctxt *buf; 2348 2349 buf = kzalloc(sizeof(struct crt_twarp_ctxt), GFP_KERNEL); 2350 if (!buf) 2351 return NULL; 2352 2353 buf->ccontext.DataOffset = cpu_to_le16(offsetof 2354 (struct crt_twarp_ctxt, Timestamp)); 2355 buf->ccontext.DataLength = cpu_to_le32(8); 2356 buf->ccontext.NameOffset = cpu_to_le16(offsetof 2357 (struct crt_twarp_ctxt, Name)); 2358 buf->ccontext.NameLength = cpu_to_le16(4); 2359 /* SMB2_CREATE_TIMEWARP_TOKEN is "TWrp" */ 2360 buf->Name[0] = 'T'; 2361 buf->Name[1] = 'W'; 2362 buf->Name[2] = 'r'; 2363 buf->Name[3] = 'p'; 2364 buf->Timestamp = cpu_to_le64(timewarp); 2365 return buf; 2366 } 2367 2368 /* See MS-SMB2 2.2.13.2.7 */ 2369 static int 2370 add_twarp_context(struct kvec *iov, unsigned int *num_iovec, __u64 timewarp) 2371 { 2372 unsigned int num = *num_iovec; 2373 2374 iov[num].iov_base = create_twarp_buf(timewarp); 2375 if (iov[num].iov_base == NULL) 2376 return -ENOMEM; 2377 iov[num].iov_len = sizeof(struct crt_twarp_ctxt); 2378 *num_iovec = num + 1; 2379 return 0; 2380 } 2381 2382 /* See See http://technet.microsoft.com/en-us/library/hh509017(v=ws.10).aspx */ 2383 static void setup_owner_group_sids(char *buf) 2384 { 2385 struct owner_group_sids *sids = (struct owner_group_sids *)buf; 2386 2387 /* Populate the user ownership fields S-1-5-88-1 */ 2388 sids->owner.Revision = 1; 2389 sids->owner.NumAuth = 3; 2390 sids->owner.Authority[5] = 5; 2391 sids->owner.SubAuthorities[0] = cpu_to_le32(88); 2392 sids->owner.SubAuthorities[1] = cpu_to_le32(1); 2393 sids->owner.SubAuthorities[2] = cpu_to_le32(current_fsuid().val); 2394 2395 /* Populate the group ownership fields S-1-5-88-2 */ 2396 sids->group.Revision = 1; 2397 sids->group.NumAuth = 3; 2398 sids->group.Authority[5] = 5; 2399 sids->group.SubAuthorities[0] = cpu_to_le32(88); 2400 sids->group.SubAuthorities[1] = cpu_to_le32(2); 2401 sids->group.SubAuthorities[2] = cpu_to_le32(current_fsgid().val); 2402 2403 cifs_dbg(FYI, "owner S-1-5-88-1-%d, group S-1-5-88-2-%d\n", current_fsuid().val, current_fsgid().val); 2404 } 2405 2406 /* See MS-SMB2 2.2.13.2.2 and MS-DTYP 2.4.6 */ 2407 static struct crt_sd_ctxt * 2408 create_sd_buf(umode_t mode, bool set_owner, unsigned int *len) 2409 { 2410 struct crt_sd_ctxt *buf; 2411 __u8 *ptr, *aclptr; 2412 unsigned int acelen, acl_size, ace_count; 2413 unsigned int owner_offset = 0; 2414 unsigned int group_offset = 0; 2415 struct smb3_acl acl = {}; 2416 2417 *len = round_up(sizeof(struct crt_sd_ctxt) + (sizeof(struct cifs_ace) * 4), 8); 2418 2419 if (set_owner) { 2420 /* sizeof(struct owner_group_sids) is already multiple of 8 so no need to round */ 2421 *len += sizeof(struct owner_group_sids); 2422 } 2423 2424 buf = kzalloc(*len, GFP_KERNEL); 2425 if (buf == NULL) 2426 return buf; 2427 2428 ptr = (__u8 *)&buf[1]; 2429 if (set_owner) { 2430 /* offset fields are from beginning of security descriptor not of create context */ 2431 owner_offset = ptr - (__u8 *)&buf->sd; 2432 buf->sd.OffsetOwner = cpu_to_le32(owner_offset); 2433 group_offset = owner_offset + offsetof(struct owner_group_sids, group); 2434 buf->sd.OffsetGroup = cpu_to_le32(group_offset); 2435 2436 setup_owner_group_sids(ptr); 2437 ptr += sizeof(struct owner_group_sids); 2438 } else { 2439 buf->sd.OffsetOwner = 0; 2440 buf->sd.OffsetGroup = 0; 2441 } 2442 2443 buf->ccontext.DataOffset = cpu_to_le16(offsetof(struct crt_sd_ctxt, sd)); 2444 buf->ccontext.NameOffset = cpu_to_le16(offsetof(struct crt_sd_ctxt, Name)); 2445 buf->ccontext.NameLength = cpu_to_le16(4); 2446 /* SMB2_CREATE_SD_BUFFER_TOKEN is "SecD" */ 2447 buf->Name[0] = 'S'; 2448 buf->Name[1] = 'e'; 2449 buf->Name[2] = 'c'; 2450 buf->Name[3] = 'D'; 2451 buf->sd.Revision = 1; /* Must be one see MS-DTYP 2.4.6 */ 2452 2453 /* 2454 * ACL is "self relative" ie ACL is stored in contiguous block of memory 2455 * and "DP" ie the DACL is present 2456 */ 2457 buf->sd.Control = cpu_to_le16(ACL_CONTROL_SR | ACL_CONTROL_DP); 2458 2459 /* offset owner, group and Sbz1 and SACL are all zero */ 2460 buf->sd.OffsetDacl = cpu_to_le32(ptr - (__u8 *)&buf->sd); 2461 /* Ship the ACL for now. we will copy it into buf later. */ 2462 aclptr = ptr; 2463 ptr += sizeof(struct smb3_acl); 2464 2465 /* create one ACE to hold the mode embedded in reserved special SID */ 2466 acelen = setup_special_mode_ACE((struct cifs_ace *)ptr, (__u64)mode); 2467 ptr += acelen; 2468 acl_size = acelen + sizeof(struct smb3_acl); 2469 ace_count = 1; 2470 2471 if (set_owner) { 2472 /* we do not need to reallocate buffer to add the two more ACEs. plenty of space */ 2473 acelen = setup_special_user_owner_ACE((struct cifs_ace *)ptr); 2474 ptr += acelen; 2475 acl_size += acelen; 2476 ace_count += 1; 2477 } 2478 2479 /* and one more ACE to allow access for authenticated users */ 2480 acelen = setup_authusers_ACE((struct cifs_ace *)ptr); 2481 ptr += acelen; 2482 acl_size += acelen; 2483 ace_count += 1; 2484 2485 acl.AclRevision = ACL_REVISION; /* See 2.4.4.1 of MS-DTYP */ 2486 acl.AclSize = cpu_to_le16(acl_size); 2487 acl.AceCount = cpu_to_le16(ace_count); 2488 /* acl.Sbz1 and Sbz2 MBZ so are not set here, but initialized above */ 2489 memcpy(aclptr, &acl, sizeof(struct smb3_acl)); 2490 2491 buf->ccontext.DataLength = cpu_to_le32(ptr - (__u8 *)&buf->sd); 2492 *len = round_up((unsigned int)(ptr - (__u8 *)buf), 8); 2493 2494 return buf; 2495 } 2496 2497 static int 2498 add_sd_context(struct kvec *iov, unsigned int *num_iovec, umode_t mode, bool set_owner) 2499 { 2500 unsigned int num = *num_iovec; 2501 unsigned int len = 0; 2502 2503 iov[num].iov_base = create_sd_buf(mode, set_owner, &len); 2504 if (iov[num].iov_base == NULL) 2505 return -ENOMEM; 2506 iov[num].iov_len = len; 2507 *num_iovec = num + 1; 2508 return 0; 2509 } 2510 2511 static struct crt_query_id_ctxt * 2512 create_query_id_buf(void) 2513 { 2514 struct crt_query_id_ctxt *buf; 2515 2516 buf = kzalloc(sizeof(struct crt_query_id_ctxt), GFP_KERNEL); 2517 if (!buf) 2518 return NULL; 2519 2520 buf->ccontext.DataOffset = cpu_to_le16(0); 2521 buf->ccontext.DataLength = cpu_to_le32(0); 2522 buf->ccontext.NameOffset = cpu_to_le16(offsetof 2523 (struct crt_query_id_ctxt, Name)); 2524 buf->ccontext.NameLength = cpu_to_le16(4); 2525 /* SMB2_CREATE_QUERY_ON_DISK_ID is "QFid" */ 2526 buf->Name[0] = 'Q'; 2527 buf->Name[1] = 'F'; 2528 buf->Name[2] = 'i'; 2529 buf->Name[3] = 'd'; 2530 return buf; 2531 } 2532 2533 /* See MS-SMB2 2.2.13.2.9 */ 2534 static int 2535 add_query_id_context(struct kvec *iov, unsigned int *num_iovec) 2536 { 2537 unsigned int num = *num_iovec; 2538 2539 iov[num].iov_base = create_query_id_buf(); 2540 if (iov[num].iov_base == NULL) 2541 return -ENOMEM; 2542 iov[num].iov_len = sizeof(struct crt_query_id_ctxt); 2543 *num_iovec = num + 1; 2544 return 0; 2545 } 2546 2547 static int 2548 alloc_path_with_tree_prefix(__le16 **out_path, int *out_size, int *out_len, 2549 const char *treename, const __le16 *path) 2550 { 2551 int treename_len, path_len; 2552 struct nls_table *cp; 2553 const __le16 sep[] = {cpu_to_le16('\\'), cpu_to_le16(0x0000)}; 2554 2555 /* 2556 * skip leading "\\" 2557 */ 2558 treename_len = strlen(treename); 2559 if (treename_len < 2 || !(treename[0] == '\\' && treename[1] == '\\')) 2560 return -EINVAL; 2561 2562 treename += 2; 2563 treename_len -= 2; 2564 2565 path_len = UniStrnlen((wchar_t *)path, PATH_MAX); 2566 2567 /* make room for one path separator only if @path isn't empty */ 2568 *out_len = treename_len + (path[0] ? 1 : 0) + path_len; 2569 2570 /* 2571 * final path needs to be 8-byte aligned as specified in 2572 * MS-SMB2 2.2.13 SMB2 CREATE Request. 2573 */ 2574 *out_size = round_up(*out_len * sizeof(__le16), 8); 2575 *out_path = kzalloc(*out_size + sizeof(__le16) /* null */, GFP_KERNEL); 2576 if (!*out_path) 2577 return -ENOMEM; 2578 2579 cp = load_nls_default(); 2580 cifs_strtoUTF16(*out_path, treename, treename_len, cp); 2581 2582 /* Do not append the separator if the path is empty */ 2583 if (path[0] != cpu_to_le16(0x0000)) { 2584 UniStrcat((wchar_t *)*out_path, (wchar_t *)sep); 2585 UniStrcat((wchar_t *)*out_path, (wchar_t *)path); 2586 } 2587 2588 unload_nls(cp); 2589 2590 return 0; 2591 } 2592 2593 int smb311_posix_mkdir(const unsigned int xid, struct inode *inode, 2594 umode_t mode, struct cifs_tcon *tcon, 2595 const char *full_path, 2596 struct cifs_sb_info *cifs_sb) 2597 { 2598 struct smb_rqst rqst; 2599 struct smb2_create_req *req; 2600 struct smb2_create_rsp *rsp = NULL; 2601 struct cifs_ses *ses = tcon->ses; 2602 struct kvec iov[3]; /* make sure at least one for each open context */ 2603 struct kvec rsp_iov = {NULL, 0}; 2604 int resp_buftype; 2605 int uni_path_len; 2606 __le16 *copy_path = NULL; 2607 int copy_size; 2608 int rc = 0; 2609 unsigned int n_iov = 2; 2610 __u32 file_attributes = 0; 2611 char *pc_buf = NULL; 2612 int flags = 0; 2613 unsigned int total_len; 2614 __le16 *utf16_path = NULL; 2615 struct TCP_Server_Info *server = cifs_pick_channel(ses); 2616 2617 cifs_dbg(FYI, "mkdir\n"); 2618 2619 /* resource #1: path allocation */ 2620 utf16_path = cifs_convert_path_to_utf16(full_path, cifs_sb); 2621 if (!utf16_path) 2622 return -ENOMEM; 2623 2624 if (!ses || !server) { 2625 rc = -EIO; 2626 goto err_free_path; 2627 } 2628 2629 /* resource #2: request */ 2630 rc = smb2_plain_req_init(SMB2_CREATE, tcon, server, 2631 (void **) &req, &total_len); 2632 if (rc) 2633 goto err_free_path; 2634 2635 2636 if (smb3_encryption_required(tcon)) 2637 flags |= CIFS_TRANSFORM_REQ; 2638 2639 req->ImpersonationLevel = IL_IMPERSONATION; 2640 req->DesiredAccess = cpu_to_le32(FILE_WRITE_ATTRIBUTES); 2641 /* File attributes ignored on open (used in create though) */ 2642 req->FileAttributes = cpu_to_le32(file_attributes); 2643 req->ShareAccess = FILE_SHARE_ALL_LE; 2644 req->CreateDisposition = cpu_to_le32(FILE_CREATE); 2645 req->CreateOptions = cpu_to_le32(CREATE_NOT_FILE); 2646 2647 iov[0].iov_base = (char *)req; 2648 /* -1 since last byte is buf[0] which is sent below (path) */ 2649 iov[0].iov_len = total_len - 1; 2650 2651 req->NameOffset = cpu_to_le16(sizeof(struct smb2_create_req)); 2652 2653 /* [MS-SMB2] 2.2.13 NameOffset: 2654 * If SMB2_FLAGS_DFS_OPERATIONS is set in the Flags field of 2655 * the SMB2 header, the file name includes a prefix that will 2656 * be processed during DFS name normalization as specified in 2657 * section 3.3.5.9. Otherwise, the file name is relative to 2658 * the share that is identified by the TreeId in the SMB2 2659 * header. 2660 */ 2661 if (tcon->share_flags & SHI1005_FLAGS_DFS) { 2662 int name_len; 2663 2664 req->hdr.Flags |= SMB2_FLAGS_DFS_OPERATIONS; 2665 rc = alloc_path_with_tree_prefix(©_path, ©_size, 2666 &name_len, 2667 tcon->tree_name, utf16_path); 2668 if (rc) 2669 goto err_free_req; 2670 2671 req->NameLength = cpu_to_le16(name_len * 2); 2672 uni_path_len = copy_size; 2673 /* free before overwriting resource */ 2674 kfree(utf16_path); 2675 utf16_path = copy_path; 2676 } else { 2677 uni_path_len = (2 * UniStrnlen((wchar_t *)utf16_path, PATH_MAX)) + 2; 2678 /* MUST set path len (NameLength) to 0 opening root of share */ 2679 req->NameLength = cpu_to_le16(uni_path_len - 2); 2680 if (uni_path_len % 8 != 0) { 2681 copy_size = roundup(uni_path_len, 8); 2682 copy_path = kzalloc(copy_size, GFP_KERNEL); 2683 if (!copy_path) { 2684 rc = -ENOMEM; 2685 goto err_free_req; 2686 } 2687 memcpy((char *)copy_path, (const char *)utf16_path, 2688 uni_path_len); 2689 uni_path_len = copy_size; 2690 /* free before overwriting resource */ 2691 kfree(utf16_path); 2692 utf16_path = copy_path; 2693 } 2694 } 2695 2696 iov[1].iov_len = uni_path_len; 2697 iov[1].iov_base = utf16_path; 2698 req->RequestedOplockLevel = SMB2_OPLOCK_LEVEL_NONE; 2699 2700 if (tcon->posix_extensions) { 2701 /* resource #3: posix buf */ 2702 rc = add_posix_context(iov, &n_iov, mode); 2703 if (rc) 2704 goto err_free_req; 2705 req->CreateContextsOffset = cpu_to_le32( 2706 sizeof(struct smb2_create_req) + 2707 iov[1].iov_len); 2708 pc_buf = iov[n_iov-1].iov_base; 2709 } 2710 2711 2712 memset(&rqst, 0, sizeof(struct smb_rqst)); 2713 rqst.rq_iov = iov; 2714 rqst.rq_nvec = n_iov; 2715 2716 /* no need to inc num_remote_opens because we close it just below */ 2717 trace_smb3_posix_mkdir_enter(xid, tcon->tid, ses->Suid, full_path, CREATE_NOT_FILE, 2718 FILE_WRITE_ATTRIBUTES); 2719 /* resource #4: response buffer */ 2720 rc = cifs_send_recv(xid, ses, server, 2721 &rqst, &resp_buftype, flags, &rsp_iov); 2722 if (rc) { 2723 cifs_stats_fail_inc(tcon, SMB2_CREATE_HE); 2724 trace_smb3_posix_mkdir_err(xid, tcon->tid, ses->Suid, 2725 CREATE_NOT_FILE, 2726 FILE_WRITE_ATTRIBUTES, rc); 2727 goto err_free_rsp_buf; 2728 } 2729 2730 /* 2731 * Although unlikely to be possible for rsp to be null and rc not set, 2732 * adding check below is slightly safer long term (and quiets Coverity 2733 * warning) 2734 */ 2735 rsp = (struct smb2_create_rsp *)rsp_iov.iov_base; 2736 if (rsp == NULL) { 2737 rc = -EIO; 2738 kfree(pc_buf); 2739 goto err_free_req; 2740 } 2741 2742 trace_smb3_posix_mkdir_done(xid, rsp->PersistentFileId, tcon->tid, ses->Suid, 2743 CREATE_NOT_FILE, FILE_WRITE_ATTRIBUTES); 2744 2745 SMB2_close(xid, tcon, rsp->PersistentFileId, rsp->VolatileFileId); 2746 2747 /* Eventually save off posix specific response info and timestaps */ 2748 2749 err_free_rsp_buf: 2750 free_rsp_buf(resp_buftype, rsp); 2751 kfree(pc_buf); 2752 err_free_req: 2753 cifs_small_buf_release(req); 2754 err_free_path: 2755 kfree(utf16_path); 2756 return rc; 2757 } 2758 2759 int 2760 SMB2_open_init(struct cifs_tcon *tcon, struct TCP_Server_Info *server, 2761 struct smb_rqst *rqst, __u8 *oplock, 2762 struct cifs_open_parms *oparms, __le16 *path) 2763 { 2764 struct smb2_create_req *req; 2765 unsigned int n_iov = 2; 2766 __u32 file_attributes = 0; 2767 int copy_size; 2768 int uni_path_len; 2769 unsigned int total_len; 2770 struct kvec *iov = rqst->rq_iov; 2771 __le16 *copy_path; 2772 int rc; 2773 2774 rc = smb2_plain_req_init(SMB2_CREATE, tcon, server, 2775 (void **) &req, &total_len); 2776 if (rc) 2777 return rc; 2778 2779 iov[0].iov_base = (char *)req; 2780 /* -1 since last byte is buf[0] which is sent below (path) */ 2781 iov[0].iov_len = total_len - 1; 2782 2783 if (oparms->create_options & CREATE_OPTION_READONLY) 2784 file_attributes |= ATTR_READONLY; 2785 if (oparms->create_options & CREATE_OPTION_SPECIAL) 2786 file_attributes |= ATTR_SYSTEM; 2787 2788 req->ImpersonationLevel = IL_IMPERSONATION; 2789 req->DesiredAccess = cpu_to_le32(oparms->desired_access); 2790 /* File attributes ignored on open (used in create though) */ 2791 req->FileAttributes = cpu_to_le32(file_attributes); 2792 req->ShareAccess = FILE_SHARE_ALL_LE; 2793 2794 req->CreateDisposition = cpu_to_le32(oparms->disposition); 2795 req->CreateOptions = cpu_to_le32(oparms->create_options & CREATE_OPTIONS_MASK); 2796 req->NameOffset = cpu_to_le16(sizeof(struct smb2_create_req)); 2797 2798 /* [MS-SMB2] 2.2.13 NameOffset: 2799 * If SMB2_FLAGS_DFS_OPERATIONS is set in the Flags field of 2800 * the SMB2 header, the file name includes a prefix that will 2801 * be processed during DFS name normalization as specified in 2802 * section 3.3.5.9. Otherwise, the file name is relative to 2803 * the share that is identified by the TreeId in the SMB2 2804 * header. 2805 */ 2806 if (tcon->share_flags & SHI1005_FLAGS_DFS) { 2807 int name_len; 2808 2809 req->hdr.Flags |= SMB2_FLAGS_DFS_OPERATIONS; 2810 rc = alloc_path_with_tree_prefix(©_path, ©_size, 2811 &name_len, 2812 tcon->tree_name, path); 2813 if (rc) 2814 return rc; 2815 req->NameLength = cpu_to_le16(name_len * 2); 2816 uni_path_len = copy_size; 2817 path = copy_path; 2818 } else { 2819 uni_path_len = (2 * UniStrnlen((wchar_t *)path, PATH_MAX)) + 2; 2820 /* MUST set path len (NameLength) to 0 opening root of share */ 2821 req->NameLength = cpu_to_le16(uni_path_len - 2); 2822 copy_size = round_up(uni_path_len, 8); 2823 copy_path = kzalloc(copy_size, GFP_KERNEL); 2824 if (!copy_path) 2825 return -ENOMEM; 2826 memcpy((char *)copy_path, (const char *)path, 2827 uni_path_len); 2828 uni_path_len = copy_size; 2829 path = copy_path; 2830 } 2831 2832 iov[1].iov_len = uni_path_len; 2833 iov[1].iov_base = path; 2834 2835 if ((!server->oplocks) || (tcon->no_lease)) 2836 *oplock = SMB2_OPLOCK_LEVEL_NONE; 2837 2838 if (!(server->capabilities & SMB2_GLOBAL_CAP_LEASING) || 2839 *oplock == SMB2_OPLOCK_LEVEL_NONE) 2840 req->RequestedOplockLevel = *oplock; 2841 else if (!(server->capabilities & SMB2_GLOBAL_CAP_DIRECTORY_LEASING) && 2842 (oparms->create_options & CREATE_NOT_FILE)) 2843 req->RequestedOplockLevel = *oplock; /* no srv lease support */ 2844 else { 2845 rc = add_lease_context(server, req, iov, &n_iov, 2846 oparms->fid->lease_key, oplock); 2847 if (rc) 2848 return rc; 2849 } 2850 2851 if (*oplock == SMB2_OPLOCK_LEVEL_BATCH) { 2852 rc = add_durable_context(iov, &n_iov, oparms, 2853 tcon->use_persistent); 2854 if (rc) 2855 return rc; 2856 } 2857 2858 if (tcon->posix_extensions) { 2859 rc = add_posix_context(iov, &n_iov, oparms->mode); 2860 if (rc) 2861 return rc; 2862 } 2863 2864 if (tcon->snapshot_time) { 2865 cifs_dbg(FYI, "adding snapshot context\n"); 2866 rc = add_twarp_context(iov, &n_iov, tcon->snapshot_time); 2867 if (rc) 2868 return rc; 2869 } 2870 2871 if ((oparms->disposition != FILE_OPEN) && (oparms->cifs_sb)) { 2872 bool set_mode; 2873 bool set_owner; 2874 2875 if ((oparms->cifs_sb->mnt_cifs_flags & CIFS_MOUNT_MODE_FROM_SID) && 2876 (oparms->mode != ACL_NO_MODE)) 2877 set_mode = true; 2878 else { 2879 set_mode = false; 2880 oparms->mode = ACL_NO_MODE; 2881 } 2882 2883 if (oparms->cifs_sb->mnt_cifs_flags & CIFS_MOUNT_UID_FROM_ACL) 2884 set_owner = true; 2885 else 2886 set_owner = false; 2887 2888 if (set_owner | set_mode) { 2889 cifs_dbg(FYI, "add sd with mode 0x%x\n", oparms->mode); 2890 rc = add_sd_context(iov, &n_iov, oparms->mode, set_owner); 2891 if (rc) 2892 return rc; 2893 } 2894 } 2895 2896 add_query_id_context(iov, &n_iov); 2897 2898 if (n_iov > 2) { 2899 /* 2900 * We have create contexts behind iov[1] (the file 2901 * name), point at them from the main create request 2902 */ 2903 req->CreateContextsOffset = cpu_to_le32( 2904 sizeof(struct smb2_create_req) + 2905 iov[1].iov_len); 2906 req->CreateContextsLength = 0; 2907 2908 for (unsigned int i = 2; i < (n_iov-1); i++) { 2909 struct kvec *v = &iov[i]; 2910 size_t len = v->iov_len; 2911 struct create_context *cctx = 2912 (struct create_context *)v->iov_base; 2913 2914 cctx->Next = cpu_to_le32(len); 2915 le32_add_cpu(&req->CreateContextsLength, len); 2916 } 2917 le32_add_cpu(&req->CreateContextsLength, 2918 iov[n_iov-1].iov_len); 2919 } 2920 2921 rqst->rq_nvec = n_iov; 2922 return 0; 2923 } 2924 2925 /* rq_iov[0] is the request and is released by cifs_small_buf_release(). 2926 * All other vectors are freed by kfree(). 2927 */ 2928 void 2929 SMB2_open_free(struct smb_rqst *rqst) 2930 { 2931 int i; 2932 2933 if (rqst && rqst->rq_iov) { 2934 cifs_small_buf_release(rqst->rq_iov[0].iov_base); 2935 for (i = 1; i < rqst->rq_nvec; i++) 2936 if (rqst->rq_iov[i].iov_base != smb2_padding) 2937 kfree(rqst->rq_iov[i].iov_base); 2938 } 2939 } 2940 2941 int 2942 SMB2_open(const unsigned int xid, struct cifs_open_parms *oparms, __le16 *path, 2943 __u8 *oplock, struct smb2_file_all_info *buf, 2944 struct create_posix_rsp *posix, 2945 struct kvec *err_iov, int *buftype) 2946 { 2947 struct smb_rqst rqst; 2948 struct smb2_create_rsp *rsp = NULL; 2949 struct cifs_tcon *tcon = oparms->tcon; 2950 struct cifs_ses *ses = tcon->ses; 2951 struct TCP_Server_Info *server = cifs_pick_channel(ses); 2952 struct kvec iov[SMB2_CREATE_IOV_SIZE]; 2953 struct kvec rsp_iov = {NULL, 0}; 2954 int resp_buftype = CIFS_NO_BUFFER; 2955 int rc = 0; 2956 int flags = 0; 2957 2958 cifs_dbg(FYI, "create/open\n"); 2959 if (!ses || !server) 2960 return -EIO; 2961 2962 if (smb3_encryption_required(tcon)) 2963 flags |= CIFS_TRANSFORM_REQ; 2964 2965 memset(&rqst, 0, sizeof(struct smb_rqst)); 2966 memset(&iov, 0, sizeof(iov)); 2967 rqst.rq_iov = iov; 2968 rqst.rq_nvec = SMB2_CREATE_IOV_SIZE; 2969 2970 rc = SMB2_open_init(tcon, server, 2971 &rqst, oplock, oparms, path); 2972 if (rc) 2973 goto creat_exit; 2974 2975 trace_smb3_open_enter(xid, tcon->tid, tcon->ses->Suid, oparms->path, 2976 oparms->create_options, oparms->desired_access); 2977 2978 rc = cifs_send_recv(xid, ses, server, 2979 &rqst, &resp_buftype, flags, 2980 &rsp_iov); 2981 rsp = (struct smb2_create_rsp *)rsp_iov.iov_base; 2982 2983 if (rc != 0) { 2984 cifs_stats_fail_inc(tcon, SMB2_CREATE_HE); 2985 if (err_iov && rsp) { 2986 *err_iov = rsp_iov; 2987 *buftype = resp_buftype; 2988 resp_buftype = CIFS_NO_BUFFER; 2989 rsp = NULL; 2990 } 2991 trace_smb3_open_err(xid, tcon->tid, ses->Suid, 2992 oparms->create_options, oparms->desired_access, rc); 2993 if (rc == -EREMCHG) { 2994 pr_warn_once("server share %s deleted\n", 2995 tcon->tree_name); 2996 tcon->need_reconnect = true; 2997 } 2998 goto creat_exit; 2999 } else if (rsp == NULL) /* unlikely to happen, but safer to check */ 3000 goto creat_exit; 3001 else 3002 trace_smb3_open_done(xid, rsp->PersistentFileId, tcon->tid, ses->Suid, 3003 oparms->create_options, oparms->desired_access); 3004 3005 atomic_inc(&tcon->num_remote_opens); 3006 oparms->fid->persistent_fid = rsp->PersistentFileId; 3007 oparms->fid->volatile_fid = rsp->VolatileFileId; 3008 oparms->fid->access = oparms->desired_access; 3009 #ifdef CONFIG_CIFS_DEBUG2 3010 oparms->fid->mid = le64_to_cpu(rsp->hdr.MessageId); 3011 #endif /* CIFS_DEBUG2 */ 3012 3013 if (buf) { 3014 buf->CreationTime = rsp->CreationTime; 3015 buf->LastAccessTime = rsp->LastAccessTime; 3016 buf->LastWriteTime = rsp->LastWriteTime; 3017 buf->ChangeTime = rsp->ChangeTime; 3018 buf->AllocationSize = rsp->AllocationSize; 3019 buf->EndOfFile = rsp->EndofFile; 3020 buf->Attributes = rsp->FileAttributes; 3021 buf->NumberOfLinks = cpu_to_le32(1); 3022 buf->DeletePending = 0; 3023 } 3024 3025 3026 smb2_parse_contexts(server, rsp, &oparms->fid->epoch, 3027 oparms->fid->lease_key, oplock, buf, posix); 3028 creat_exit: 3029 SMB2_open_free(&rqst); 3030 free_rsp_buf(resp_buftype, rsp); 3031 return rc; 3032 } 3033 3034 int 3035 SMB2_ioctl_init(struct cifs_tcon *tcon, struct TCP_Server_Info *server, 3036 struct smb_rqst *rqst, 3037 u64 persistent_fid, u64 volatile_fid, u32 opcode, 3038 char *in_data, u32 indatalen, 3039 __u32 max_response_size) 3040 { 3041 struct smb2_ioctl_req *req; 3042 struct kvec *iov = rqst->rq_iov; 3043 unsigned int total_len; 3044 int rc; 3045 char *in_data_buf; 3046 3047 rc = smb2_ioctl_req_init(opcode, tcon, server, 3048 (void **) &req, &total_len); 3049 if (rc) 3050 return rc; 3051 3052 if (indatalen) { 3053 /* 3054 * indatalen is usually small at a couple of bytes max, so 3055 * just allocate through generic pool 3056 */ 3057 in_data_buf = kmemdup(in_data, indatalen, GFP_NOFS); 3058 if (!in_data_buf) { 3059 cifs_small_buf_release(req); 3060 return -ENOMEM; 3061 } 3062 } 3063 3064 req->CtlCode = cpu_to_le32(opcode); 3065 req->PersistentFileId = persistent_fid; 3066 req->VolatileFileId = volatile_fid; 3067 3068 iov[0].iov_base = (char *)req; 3069 /* 3070 * If no input data, the size of ioctl struct in 3071 * protocol spec still includes a 1 byte data buffer, 3072 * but if input data passed to ioctl, we do not 3073 * want to double count this, so we do not send 3074 * the dummy one byte of data in iovec[0] if sending 3075 * input data (in iovec[1]). 3076 */ 3077 if (indatalen) { 3078 req->InputCount = cpu_to_le32(indatalen); 3079 /* do not set InputOffset if no input data */ 3080 req->InputOffset = 3081 cpu_to_le32(offsetof(struct smb2_ioctl_req, Buffer)); 3082 rqst->rq_nvec = 2; 3083 iov[0].iov_len = total_len - 1; 3084 iov[1].iov_base = in_data_buf; 3085 iov[1].iov_len = indatalen; 3086 } else { 3087 rqst->rq_nvec = 1; 3088 iov[0].iov_len = total_len; 3089 } 3090 3091 req->OutputOffset = 0; 3092 req->OutputCount = 0; /* MBZ */ 3093 3094 /* 3095 * In most cases max_response_size is set to 16K (CIFSMaxBufSize) 3096 * We Could increase default MaxOutputResponse, but that could require 3097 * more credits. Windows typically sets this smaller, but for some 3098 * ioctls it may be useful to allow server to send more. No point 3099 * limiting what the server can send as long as fits in one credit 3100 * We can not handle more than CIFS_MAX_BUF_SIZE yet but may want 3101 * to increase this limit up in the future. 3102 * Note that for snapshot queries that servers like Azure expect that 3103 * the first query be minimal size (and just used to get the number/size 3104 * of previous versions) so response size must be specified as EXACTLY 3105 * sizeof(struct snapshot_array) which is 16 when rounded up to multiple 3106 * of eight bytes. Currently that is the only case where we set max 3107 * response size smaller. 3108 */ 3109 req->MaxOutputResponse = cpu_to_le32(max_response_size); 3110 req->hdr.CreditCharge = 3111 cpu_to_le16(DIV_ROUND_UP(max(indatalen, max_response_size), 3112 SMB2_MAX_BUFFER_SIZE)); 3113 /* always an FSCTL (for now) */ 3114 req->Flags = cpu_to_le32(SMB2_0_IOCTL_IS_FSCTL); 3115 3116 /* validate negotiate request must be signed - see MS-SMB2 3.2.5.5 */ 3117 if (opcode == FSCTL_VALIDATE_NEGOTIATE_INFO) 3118 req->hdr.Flags |= SMB2_FLAGS_SIGNED; 3119 3120 return 0; 3121 } 3122 3123 void 3124 SMB2_ioctl_free(struct smb_rqst *rqst) 3125 { 3126 int i; 3127 if (rqst && rqst->rq_iov) { 3128 cifs_small_buf_release(rqst->rq_iov[0].iov_base); /* request */ 3129 for (i = 1; i < rqst->rq_nvec; i++) 3130 if (rqst->rq_iov[i].iov_base != smb2_padding) 3131 kfree(rqst->rq_iov[i].iov_base); 3132 } 3133 } 3134 3135 3136 /* 3137 * SMB2 IOCTL is used for both IOCTLs and FSCTLs 3138 */ 3139 int 3140 SMB2_ioctl(const unsigned int xid, struct cifs_tcon *tcon, u64 persistent_fid, 3141 u64 volatile_fid, u32 opcode, char *in_data, u32 indatalen, 3142 u32 max_out_data_len, char **out_data, 3143 u32 *plen /* returned data len */) 3144 { 3145 struct smb_rqst rqst; 3146 struct smb2_ioctl_rsp *rsp = NULL; 3147 struct cifs_ses *ses; 3148 struct TCP_Server_Info *server; 3149 struct kvec iov[SMB2_IOCTL_IOV_SIZE]; 3150 struct kvec rsp_iov = {NULL, 0}; 3151 int resp_buftype = CIFS_NO_BUFFER; 3152 int rc = 0; 3153 int flags = 0; 3154 3155 cifs_dbg(FYI, "SMB2 IOCTL\n"); 3156 3157 if (out_data != NULL) 3158 *out_data = NULL; 3159 3160 /* zero out returned data len, in case of error */ 3161 if (plen) 3162 *plen = 0; 3163 3164 if (!tcon) 3165 return -EIO; 3166 3167 ses = tcon->ses; 3168 if (!ses) 3169 return -EIO; 3170 3171 server = cifs_pick_channel(ses); 3172 if (!server) 3173 return -EIO; 3174 3175 if (smb3_encryption_required(tcon)) 3176 flags |= CIFS_TRANSFORM_REQ; 3177 3178 memset(&rqst, 0, sizeof(struct smb_rqst)); 3179 memset(&iov, 0, sizeof(iov)); 3180 rqst.rq_iov = iov; 3181 rqst.rq_nvec = SMB2_IOCTL_IOV_SIZE; 3182 3183 rc = SMB2_ioctl_init(tcon, server, 3184 &rqst, persistent_fid, volatile_fid, opcode, 3185 in_data, indatalen, max_out_data_len); 3186 if (rc) 3187 goto ioctl_exit; 3188 3189 rc = cifs_send_recv(xid, ses, server, 3190 &rqst, &resp_buftype, flags, 3191 &rsp_iov); 3192 rsp = (struct smb2_ioctl_rsp *)rsp_iov.iov_base; 3193 3194 if (rc != 0) 3195 trace_smb3_fsctl_err(xid, persistent_fid, tcon->tid, 3196 ses->Suid, 0, opcode, rc); 3197 3198 if ((rc != 0) && (rc != -EINVAL) && (rc != -E2BIG)) { 3199 cifs_stats_fail_inc(tcon, SMB2_IOCTL_HE); 3200 goto ioctl_exit; 3201 } else if (rc == -EINVAL) { 3202 if ((opcode != FSCTL_SRV_COPYCHUNK_WRITE) && 3203 (opcode != FSCTL_SRV_COPYCHUNK)) { 3204 cifs_stats_fail_inc(tcon, SMB2_IOCTL_HE); 3205 goto ioctl_exit; 3206 } 3207 } else if (rc == -E2BIG) { 3208 if (opcode != FSCTL_QUERY_ALLOCATED_RANGES) { 3209 cifs_stats_fail_inc(tcon, SMB2_IOCTL_HE); 3210 goto ioctl_exit; 3211 } 3212 } 3213 3214 /* check if caller wants to look at return data or just return rc */ 3215 if ((plen == NULL) || (out_data == NULL)) 3216 goto ioctl_exit; 3217 3218 /* 3219 * Although unlikely to be possible for rsp to be null and rc not set, 3220 * adding check below is slightly safer long term (and quiets Coverity 3221 * warning) 3222 */ 3223 if (rsp == NULL) { 3224 rc = -EIO; 3225 goto ioctl_exit; 3226 } 3227 3228 *plen = le32_to_cpu(rsp->OutputCount); 3229 3230 /* We check for obvious errors in the output buffer length and offset */ 3231 if (*plen == 0) 3232 goto ioctl_exit; /* server returned no data */ 3233 else if (*plen > rsp_iov.iov_len || *plen > 0xFF00) { 3234 cifs_tcon_dbg(VFS, "srv returned invalid ioctl length: %d\n", *plen); 3235 *plen = 0; 3236 rc = -EIO; 3237 goto ioctl_exit; 3238 } 3239 3240 if (rsp_iov.iov_len - *plen < le32_to_cpu(rsp->OutputOffset)) { 3241 cifs_tcon_dbg(VFS, "Malformed ioctl resp: len %d offset %d\n", *plen, 3242 le32_to_cpu(rsp->OutputOffset)); 3243 *plen = 0; 3244 rc = -EIO; 3245 goto ioctl_exit; 3246 } 3247 3248 *out_data = kmemdup((char *)rsp + le32_to_cpu(rsp->OutputOffset), 3249 *plen, GFP_KERNEL); 3250 if (*out_data == NULL) { 3251 rc = -ENOMEM; 3252 goto ioctl_exit; 3253 } 3254 3255 ioctl_exit: 3256 SMB2_ioctl_free(&rqst); 3257 free_rsp_buf(resp_buftype, rsp); 3258 return rc; 3259 } 3260 3261 /* 3262 * Individual callers to ioctl worker function follow 3263 */ 3264 3265 int 3266 SMB2_set_compression(const unsigned int xid, struct cifs_tcon *tcon, 3267 u64 persistent_fid, u64 volatile_fid) 3268 { 3269 int rc; 3270 struct compress_ioctl fsctl_input; 3271 char *ret_data = NULL; 3272 3273 fsctl_input.CompressionState = 3274 cpu_to_le16(COMPRESSION_FORMAT_DEFAULT); 3275 3276 rc = SMB2_ioctl(xid, tcon, persistent_fid, volatile_fid, 3277 FSCTL_SET_COMPRESSION, 3278 (char *)&fsctl_input /* data input */, 3279 2 /* in data len */, CIFSMaxBufSize /* max out data */, 3280 &ret_data /* out data */, NULL); 3281 3282 cifs_dbg(FYI, "set compression rc %d\n", rc); 3283 3284 return rc; 3285 } 3286 3287 int 3288 SMB2_close_init(struct cifs_tcon *tcon, struct TCP_Server_Info *server, 3289 struct smb_rqst *rqst, 3290 u64 persistent_fid, u64 volatile_fid, bool query_attrs) 3291 { 3292 struct smb2_close_req *req; 3293 struct kvec *iov = rqst->rq_iov; 3294 unsigned int total_len; 3295 int rc; 3296 3297 rc = smb2_plain_req_init(SMB2_CLOSE, tcon, server, 3298 (void **) &req, &total_len); 3299 if (rc) 3300 return rc; 3301 3302 req->PersistentFileId = persistent_fid; 3303 req->VolatileFileId = volatile_fid; 3304 if (query_attrs) 3305 req->Flags = SMB2_CLOSE_FLAG_POSTQUERY_ATTRIB; 3306 else 3307 req->Flags = 0; 3308 iov[0].iov_base = (char *)req; 3309 iov[0].iov_len = total_len; 3310 3311 return 0; 3312 } 3313 3314 void 3315 SMB2_close_free(struct smb_rqst *rqst) 3316 { 3317 if (rqst && rqst->rq_iov) 3318 cifs_small_buf_release(rqst->rq_iov[0].iov_base); /* request */ 3319 } 3320 3321 int 3322 __SMB2_close(const unsigned int xid, struct cifs_tcon *tcon, 3323 u64 persistent_fid, u64 volatile_fid, 3324 struct smb2_file_network_open_info *pbuf) 3325 { 3326 struct smb_rqst rqst; 3327 struct smb2_close_rsp *rsp = NULL; 3328 struct cifs_ses *ses = tcon->ses; 3329 struct TCP_Server_Info *server = cifs_pick_channel(ses); 3330 struct kvec iov[1]; 3331 struct kvec rsp_iov; 3332 int resp_buftype = CIFS_NO_BUFFER; 3333 int rc = 0; 3334 int flags = 0; 3335 bool query_attrs = false; 3336 3337 cifs_dbg(FYI, "Close\n"); 3338 3339 if (!ses || !server) 3340 return -EIO; 3341 3342 if (smb3_encryption_required(tcon)) 3343 flags |= CIFS_TRANSFORM_REQ; 3344 3345 memset(&rqst, 0, sizeof(struct smb_rqst)); 3346 memset(&iov, 0, sizeof(iov)); 3347 rqst.rq_iov = iov; 3348 rqst.rq_nvec = 1; 3349 3350 /* check if need to ask server to return timestamps in close response */ 3351 if (pbuf) 3352 query_attrs = true; 3353 3354 trace_smb3_close_enter(xid, persistent_fid, tcon->tid, ses->Suid); 3355 rc = SMB2_close_init(tcon, server, 3356 &rqst, persistent_fid, volatile_fid, 3357 query_attrs); 3358 if (rc) 3359 goto close_exit; 3360 3361 rc = cifs_send_recv(xid, ses, server, 3362 &rqst, &resp_buftype, flags, &rsp_iov); 3363 rsp = (struct smb2_close_rsp *)rsp_iov.iov_base; 3364 3365 if (rc != 0) { 3366 cifs_stats_fail_inc(tcon, SMB2_CLOSE_HE); 3367 trace_smb3_close_err(xid, persistent_fid, tcon->tid, ses->Suid, 3368 rc); 3369 goto close_exit; 3370 } else { 3371 trace_smb3_close_done(xid, persistent_fid, tcon->tid, 3372 ses->Suid); 3373 /* 3374 * Note that have to subtract 4 since struct network_open_info 3375 * has a final 4 byte pad that close response does not have 3376 */ 3377 if (pbuf) 3378 memcpy(pbuf, (char *)&rsp->CreationTime, sizeof(*pbuf) - 4); 3379 } 3380 3381 atomic_dec(&tcon->num_remote_opens); 3382 close_exit: 3383 SMB2_close_free(&rqst); 3384 free_rsp_buf(resp_buftype, rsp); 3385 3386 /* retry close in a worker thread if this one is interrupted */ 3387 if (is_interrupt_error(rc)) { 3388 int tmp_rc; 3389 3390 tmp_rc = smb2_handle_cancelled_close(tcon, persistent_fid, 3391 volatile_fid); 3392 if (tmp_rc) 3393 cifs_dbg(VFS, "handle cancelled close fid 0x%llx returned error %d\n", 3394 persistent_fid, tmp_rc); 3395 } 3396 return rc; 3397 } 3398 3399 int 3400 SMB2_close(const unsigned int xid, struct cifs_tcon *tcon, 3401 u64 persistent_fid, u64 volatile_fid) 3402 { 3403 return __SMB2_close(xid, tcon, persistent_fid, volatile_fid, NULL); 3404 } 3405 3406 int 3407 smb2_validate_iov(unsigned int offset, unsigned int buffer_length, 3408 struct kvec *iov, unsigned int min_buf_size) 3409 { 3410 unsigned int smb_len = iov->iov_len; 3411 char *end_of_smb = smb_len + (char *)iov->iov_base; 3412 char *begin_of_buf = offset + (char *)iov->iov_base; 3413 char *end_of_buf = begin_of_buf + buffer_length; 3414 3415 3416 if (buffer_length < min_buf_size) { 3417 cifs_dbg(VFS, "buffer length %d smaller than minimum size %d\n", 3418 buffer_length, min_buf_size); 3419 return -EINVAL; 3420 } 3421 3422 /* check if beyond RFC1001 maximum length */ 3423 if ((smb_len > 0x7FFFFF) || (buffer_length > 0x7FFFFF)) { 3424 cifs_dbg(VFS, "buffer length %d or smb length %d too large\n", 3425 buffer_length, smb_len); 3426 return -EINVAL; 3427 } 3428 3429 if ((begin_of_buf > end_of_smb) || (end_of_buf > end_of_smb)) { 3430 cifs_dbg(VFS, "Invalid server response, bad offset to data\n"); 3431 return -EINVAL; 3432 } 3433 3434 return 0; 3435 } 3436 3437 /* 3438 * If SMB buffer fields are valid, copy into temporary buffer to hold result. 3439 * Caller must free buffer. 3440 */ 3441 int 3442 smb2_validate_and_copy_iov(unsigned int offset, unsigned int buffer_length, 3443 struct kvec *iov, unsigned int minbufsize, 3444 char *data) 3445 { 3446 char *begin_of_buf = offset + (char *)iov->iov_base; 3447 int rc; 3448 3449 if (!data) 3450 return -EINVAL; 3451 3452 rc = smb2_validate_iov(offset, buffer_length, iov, minbufsize); 3453 if (rc) 3454 return rc; 3455 3456 memcpy(data, begin_of_buf, minbufsize); 3457 3458 return 0; 3459 } 3460 3461 int 3462 SMB2_query_info_init(struct cifs_tcon *tcon, struct TCP_Server_Info *server, 3463 struct smb_rqst *rqst, 3464 u64 persistent_fid, u64 volatile_fid, 3465 u8 info_class, u8 info_type, u32 additional_info, 3466 size_t output_len, size_t input_len, void *input) 3467 { 3468 struct smb2_query_info_req *req; 3469 struct kvec *iov = rqst->rq_iov; 3470 unsigned int total_len; 3471 int rc; 3472 3473 rc = smb2_plain_req_init(SMB2_QUERY_INFO, tcon, server, 3474 (void **) &req, &total_len); 3475 if (rc) 3476 return rc; 3477 3478 req->InfoType = info_type; 3479 req->FileInfoClass = info_class; 3480 req->PersistentFileId = persistent_fid; 3481 req->VolatileFileId = volatile_fid; 3482 req->AdditionalInformation = cpu_to_le32(additional_info); 3483 3484 req->OutputBufferLength = cpu_to_le32(output_len); 3485 if (input_len) { 3486 req->InputBufferLength = cpu_to_le32(input_len); 3487 /* total_len for smb query request never close to le16 max */ 3488 req->InputBufferOffset = cpu_to_le16(total_len - 1); 3489 memcpy(req->Buffer, input, input_len); 3490 } 3491 3492 iov[0].iov_base = (char *)req; 3493 /* 1 for Buffer */ 3494 iov[0].iov_len = total_len - 1 + input_len; 3495 return 0; 3496 } 3497 3498 void 3499 SMB2_query_info_free(struct smb_rqst *rqst) 3500 { 3501 if (rqst && rqst->rq_iov) 3502 cifs_small_buf_release(rqst->rq_iov[0].iov_base); /* request */ 3503 } 3504 3505 static int 3506 query_info(const unsigned int xid, struct cifs_tcon *tcon, 3507 u64 persistent_fid, u64 volatile_fid, u8 info_class, u8 info_type, 3508 u32 additional_info, size_t output_len, size_t min_len, void **data, 3509 u32 *dlen) 3510 { 3511 struct smb_rqst rqst; 3512 struct smb2_query_info_rsp *rsp = NULL; 3513 struct kvec iov[1]; 3514 struct kvec rsp_iov; 3515 int rc = 0; 3516 int resp_buftype = CIFS_NO_BUFFER; 3517 struct cifs_ses *ses = tcon->ses; 3518 struct TCP_Server_Info *server; 3519 int flags = 0; 3520 bool allocated = false; 3521 3522 cifs_dbg(FYI, "Query Info\n"); 3523 3524 if (!ses) 3525 return -EIO; 3526 server = cifs_pick_channel(ses); 3527 if (!server) 3528 return -EIO; 3529 3530 if (smb3_encryption_required(tcon)) 3531 flags |= CIFS_TRANSFORM_REQ; 3532 3533 memset(&rqst, 0, sizeof(struct smb_rqst)); 3534 memset(&iov, 0, sizeof(iov)); 3535 rqst.rq_iov = iov; 3536 rqst.rq_nvec = 1; 3537 3538 rc = SMB2_query_info_init(tcon, server, 3539 &rqst, persistent_fid, volatile_fid, 3540 info_class, info_type, additional_info, 3541 output_len, 0, NULL); 3542 if (rc) 3543 goto qinf_exit; 3544 3545 trace_smb3_query_info_enter(xid, persistent_fid, tcon->tid, 3546 ses->Suid, info_class, (__u32)info_type); 3547 3548 rc = cifs_send_recv(xid, ses, server, 3549 &rqst, &resp_buftype, flags, &rsp_iov); 3550 rsp = (struct smb2_query_info_rsp *)rsp_iov.iov_base; 3551 3552 if (rc) { 3553 cifs_stats_fail_inc(tcon, SMB2_QUERY_INFO_HE); 3554 trace_smb3_query_info_err(xid, persistent_fid, tcon->tid, 3555 ses->Suid, info_class, (__u32)info_type, rc); 3556 goto qinf_exit; 3557 } 3558 3559 trace_smb3_query_info_done(xid, persistent_fid, tcon->tid, 3560 ses->Suid, info_class, (__u32)info_type); 3561 3562 if (dlen) { 3563 *dlen = le32_to_cpu(rsp->OutputBufferLength); 3564 if (!*data) { 3565 *data = kmalloc(*dlen, GFP_KERNEL); 3566 if (!*data) { 3567 cifs_tcon_dbg(VFS, 3568 "Error %d allocating memory for acl\n", 3569 rc); 3570 *dlen = 0; 3571 rc = -ENOMEM; 3572 goto qinf_exit; 3573 } 3574 allocated = true; 3575 } 3576 } 3577 3578 rc = smb2_validate_and_copy_iov(le16_to_cpu(rsp->OutputBufferOffset), 3579 le32_to_cpu(rsp->OutputBufferLength), 3580 &rsp_iov, dlen ? *dlen : min_len, *data); 3581 if (rc && allocated) { 3582 kfree(*data); 3583 *data = NULL; 3584 *dlen = 0; 3585 } 3586 3587 qinf_exit: 3588 SMB2_query_info_free(&rqst); 3589 free_rsp_buf(resp_buftype, rsp); 3590 return rc; 3591 } 3592 3593 int SMB2_query_info(const unsigned int xid, struct cifs_tcon *tcon, 3594 u64 persistent_fid, u64 volatile_fid, struct smb2_file_all_info *data) 3595 { 3596 return query_info(xid, tcon, persistent_fid, volatile_fid, 3597 FILE_ALL_INFORMATION, SMB2_O_INFO_FILE, 0, 3598 sizeof(struct smb2_file_all_info) + PATH_MAX * 2, 3599 sizeof(struct smb2_file_all_info), (void **)&data, 3600 NULL); 3601 } 3602 3603 #if 0 3604 /* currently unused, as now we are doing compounding instead (see smb311_posix_query_path_info) */ 3605 int 3606 SMB311_posix_query_info(const unsigned int xid, struct cifs_tcon *tcon, 3607 u64 persistent_fid, u64 volatile_fid, struct smb311_posix_qinfo *data, u32 *plen) 3608 { 3609 size_t output_len = sizeof(struct smb311_posix_qinfo *) + 3610 (sizeof(struct cifs_sid) * 2) + (PATH_MAX * 2); 3611 *plen = 0; 3612 3613 return query_info(xid, tcon, persistent_fid, volatile_fid, 3614 SMB_FIND_FILE_POSIX_INFO, SMB2_O_INFO_FILE, 0, 3615 output_len, sizeof(struct smb311_posix_qinfo), (void **)&data, plen); 3616 /* Note caller must free "data" (passed in above). It may be allocated in query_info call */ 3617 } 3618 #endif 3619 3620 int 3621 SMB2_query_acl(const unsigned int xid, struct cifs_tcon *tcon, 3622 u64 persistent_fid, u64 volatile_fid, 3623 void **data, u32 *plen, u32 extra_info) 3624 { 3625 __u32 additional_info = OWNER_SECINFO | GROUP_SECINFO | DACL_SECINFO | 3626 extra_info; 3627 *plen = 0; 3628 3629 return query_info(xid, tcon, persistent_fid, volatile_fid, 3630 0, SMB2_O_INFO_SECURITY, additional_info, 3631 SMB2_MAX_BUFFER_SIZE, MIN_SEC_DESC_LEN, data, plen); 3632 } 3633 3634 int 3635 SMB2_get_srv_num(const unsigned int xid, struct cifs_tcon *tcon, 3636 u64 persistent_fid, u64 volatile_fid, __le64 *uniqueid) 3637 { 3638 return query_info(xid, tcon, persistent_fid, volatile_fid, 3639 FILE_INTERNAL_INFORMATION, SMB2_O_INFO_FILE, 0, 3640 sizeof(struct smb2_file_internal_info), 3641 sizeof(struct smb2_file_internal_info), 3642 (void **)&uniqueid, NULL); 3643 } 3644 3645 /* 3646 * CHANGE_NOTIFY Request is sent to get notifications on changes to a directory 3647 * See MS-SMB2 2.2.35 and 2.2.36 3648 */ 3649 3650 static int 3651 SMB2_notify_init(const unsigned int xid, struct smb_rqst *rqst, 3652 struct cifs_tcon *tcon, struct TCP_Server_Info *server, 3653 u64 persistent_fid, u64 volatile_fid, 3654 u32 completion_filter, bool watch_tree) 3655 { 3656 struct smb2_change_notify_req *req; 3657 struct kvec *iov = rqst->rq_iov; 3658 unsigned int total_len; 3659 int rc; 3660 3661 rc = smb2_plain_req_init(SMB2_CHANGE_NOTIFY, tcon, server, 3662 (void **) &req, &total_len); 3663 if (rc) 3664 return rc; 3665 3666 req->PersistentFileId = persistent_fid; 3667 req->VolatileFileId = volatile_fid; 3668 /* See note 354 of MS-SMB2, 64K max */ 3669 req->OutputBufferLength = 3670 cpu_to_le32(SMB2_MAX_BUFFER_SIZE - MAX_SMB2_HDR_SIZE); 3671 req->CompletionFilter = cpu_to_le32(completion_filter); 3672 if (watch_tree) 3673 req->Flags = cpu_to_le16(SMB2_WATCH_TREE); 3674 else 3675 req->Flags = 0; 3676 3677 iov[0].iov_base = (char *)req; 3678 iov[0].iov_len = total_len; 3679 3680 return 0; 3681 } 3682 3683 int 3684 SMB2_change_notify(const unsigned int xid, struct cifs_tcon *tcon, 3685 u64 persistent_fid, u64 volatile_fid, bool watch_tree, 3686 u32 completion_filter, u32 max_out_data_len, char **out_data, 3687 u32 *plen /* returned data len */) 3688 { 3689 struct cifs_ses *ses = tcon->ses; 3690 struct TCP_Server_Info *server = cifs_pick_channel(ses); 3691 struct smb_rqst rqst; 3692 struct smb2_change_notify_rsp *smb_rsp; 3693 struct kvec iov[1]; 3694 struct kvec rsp_iov = {NULL, 0}; 3695 int resp_buftype = CIFS_NO_BUFFER; 3696 int flags = 0; 3697 int rc = 0; 3698 3699 cifs_dbg(FYI, "change notify\n"); 3700 if (!ses || !server) 3701 return -EIO; 3702 3703 if (smb3_encryption_required(tcon)) 3704 flags |= CIFS_TRANSFORM_REQ; 3705 3706 memset(&rqst, 0, sizeof(struct smb_rqst)); 3707 memset(&iov, 0, sizeof(iov)); 3708 if (plen) 3709 *plen = 0; 3710 3711 rqst.rq_iov = iov; 3712 rqst.rq_nvec = 1; 3713 3714 rc = SMB2_notify_init(xid, &rqst, tcon, server, 3715 persistent_fid, volatile_fid, 3716 completion_filter, watch_tree); 3717 if (rc) 3718 goto cnotify_exit; 3719 3720 trace_smb3_notify_enter(xid, persistent_fid, tcon->tid, ses->Suid, 3721 (u8)watch_tree, completion_filter); 3722 rc = cifs_send_recv(xid, ses, server, 3723 &rqst, &resp_buftype, flags, &rsp_iov); 3724 3725 if (rc != 0) { 3726 cifs_stats_fail_inc(tcon, SMB2_CHANGE_NOTIFY_HE); 3727 trace_smb3_notify_err(xid, persistent_fid, tcon->tid, ses->Suid, 3728 (u8)watch_tree, completion_filter, rc); 3729 } else { 3730 trace_smb3_notify_done(xid, persistent_fid, tcon->tid, 3731 ses->Suid, (u8)watch_tree, completion_filter); 3732 /* validate that notify information is plausible */ 3733 if ((rsp_iov.iov_base == NULL) || 3734 (rsp_iov.iov_len < sizeof(struct smb2_change_notify_rsp) + 1)) 3735 goto cnotify_exit; 3736 3737 smb_rsp = (struct smb2_change_notify_rsp *)rsp_iov.iov_base; 3738 3739 smb2_validate_iov(le16_to_cpu(smb_rsp->OutputBufferOffset), 3740 le32_to_cpu(smb_rsp->OutputBufferLength), &rsp_iov, 3741 sizeof(struct file_notify_information)); 3742 3743 *out_data = kmemdup((char *)smb_rsp + le16_to_cpu(smb_rsp->OutputBufferOffset), 3744 le32_to_cpu(smb_rsp->OutputBufferLength), GFP_KERNEL); 3745 if (*out_data == NULL) { 3746 rc = -ENOMEM; 3747 goto cnotify_exit; 3748 } else if (plen) 3749 *plen = le32_to_cpu(smb_rsp->OutputBufferLength); 3750 } 3751 3752 cnotify_exit: 3753 if (rqst.rq_iov) 3754 cifs_small_buf_release(rqst.rq_iov[0].iov_base); /* request */ 3755 free_rsp_buf(resp_buftype, rsp_iov.iov_base); 3756 return rc; 3757 } 3758 3759 3760 3761 /* 3762 * This is a no-op for now. We're not really interested in the reply, but 3763 * rather in the fact that the server sent one and that server->lstrp 3764 * gets updated. 3765 * 3766 * FIXME: maybe we should consider checking that the reply matches request? 3767 */ 3768 static void 3769 smb2_echo_callback(struct mid_q_entry *mid) 3770 { 3771 struct TCP_Server_Info *server = mid->callback_data; 3772 struct smb2_echo_rsp *rsp = (struct smb2_echo_rsp *)mid->resp_buf; 3773 struct cifs_credits credits = { .value = 0, .instance = 0 }; 3774 3775 if (mid->mid_state == MID_RESPONSE_RECEIVED 3776 || mid->mid_state == MID_RESPONSE_MALFORMED) { 3777 credits.value = le16_to_cpu(rsp->hdr.CreditRequest); 3778 credits.instance = server->reconnect_instance; 3779 } 3780 3781 release_mid(mid); 3782 add_credits(server, &credits, CIFS_ECHO_OP); 3783 } 3784 3785 void smb2_reconnect_server(struct work_struct *work) 3786 { 3787 struct TCP_Server_Info *server = container_of(work, 3788 struct TCP_Server_Info, reconnect.work); 3789 struct TCP_Server_Info *pserver; 3790 struct cifs_ses *ses, *ses2; 3791 struct cifs_tcon *tcon, *tcon2; 3792 struct list_head tmp_list, tmp_ses_list; 3793 bool tcon_exist = false, ses_exist = false; 3794 bool tcon_selected = false; 3795 int rc; 3796 bool resched = false; 3797 3798 /* If server is a channel, select the primary channel */ 3799 pserver = SERVER_IS_CHAN(server) ? server->primary_server : server; 3800 3801 /* Prevent simultaneous reconnects that can corrupt tcon->rlist list */ 3802 mutex_lock(&pserver->reconnect_mutex); 3803 3804 INIT_LIST_HEAD(&tmp_list); 3805 INIT_LIST_HEAD(&tmp_ses_list); 3806 cifs_dbg(FYI, "Reconnecting tcons and channels\n"); 3807 3808 spin_lock(&cifs_tcp_ses_lock); 3809 list_for_each_entry(ses, &pserver->smb_ses_list, smb_ses_list) { 3810 spin_lock(&ses->ses_lock); 3811 if (ses->ses_status == SES_EXITING) { 3812 spin_unlock(&ses->ses_lock); 3813 continue; 3814 } 3815 spin_unlock(&ses->ses_lock); 3816 3817 tcon_selected = false; 3818 3819 list_for_each_entry(tcon, &ses->tcon_list, tcon_list) { 3820 if (tcon->need_reconnect || tcon->need_reopen_files) { 3821 tcon->tc_count++; 3822 list_add_tail(&tcon->rlist, &tmp_list); 3823 tcon_selected = tcon_exist = true; 3824 } 3825 } 3826 /* 3827 * IPC has the same lifetime as its session and uses its 3828 * refcount. 3829 */ 3830 if (ses->tcon_ipc && ses->tcon_ipc->need_reconnect) { 3831 list_add_tail(&ses->tcon_ipc->rlist, &tmp_list); 3832 tcon_selected = tcon_exist = true; 3833 cifs_smb_ses_inc_refcount(ses); 3834 } 3835 /* 3836 * handle the case where channel needs to reconnect 3837 * binding session, but tcon is healthy (some other channel 3838 * is active) 3839 */ 3840 spin_lock(&ses->chan_lock); 3841 if (!tcon_selected && cifs_chan_needs_reconnect(ses, server)) { 3842 list_add_tail(&ses->rlist, &tmp_ses_list); 3843 ses_exist = true; 3844 cifs_smb_ses_inc_refcount(ses); 3845 } 3846 spin_unlock(&ses->chan_lock); 3847 } 3848 /* 3849 * Get the reference to server struct to be sure that the last call of 3850 * cifs_put_tcon() in the loop below won't release the server pointer. 3851 */ 3852 if (tcon_exist || ses_exist) 3853 server->srv_count++; 3854 3855 spin_unlock(&cifs_tcp_ses_lock); 3856 3857 list_for_each_entry_safe(tcon, tcon2, &tmp_list, rlist) { 3858 rc = smb2_reconnect(SMB2_INTERNAL_CMD, tcon, server); 3859 if (!rc) 3860 cifs_reopen_persistent_handles(tcon); 3861 else 3862 resched = true; 3863 list_del_init(&tcon->rlist); 3864 if (tcon->ipc) 3865 cifs_put_smb_ses(tcon->ses); 3866 else 3867 cifs_put_tcon(tcon); 3868 } 3869 3870 if (!ses_exist) 3871 goto done; 3872 3873 /* allocate a dummy tcon struct used for reconnect */ 3874 tcon = tconInfoAlloc(); 3875 if (!tcon) { 3876 resched = true; 3877 list_for_each_entry_safe(ses, ses2, &tmp_ses_list, rlist) { 3878 list_del_init(&ses->rlist); 3879 cifs_put_smb_ses(ses); 3880 } 3881 goto done; 3882 } 3883 3884 tcon->status = TID_GOOD; 3885 tcon->retry = false; 3886 tcon->need_reconnect = false; 3887 3888 /* now reconnect sessions for necessary channels */ 3889 list_for_each_entry_safe(ses, ses2, &tmp_ses_list, rlist) { 3890 tcon->ses = ses; 3891 rc = smb2_reconnect(SMB2_INTERNAL_CMD, tcon, server); 3892 if (rc) 3893 resched = true; 3894 list_del_init(&ses->rlist); 3895 cifs_put_smb_ses(ses); 3896 } 3897 tconInfoFree(tcon); 3898 3899 done: 3900 cifs_dbg(FYI, "Reconnecting tcons and channels finished\n"); 3901 if (resched) 3902 queue_delayed_work(cifsiod_wq, &server->reconnect, 2 * HZ); 3903 mutex_unlock(&pserver->reconnect_mutex); 3904 3905 /* now we can safely release srv struct */ 3906 if (tcon_exist || ses_exist) 3907 cifs_put_tcp_session(server, 1); 3908 } 3909 3910 int 3911 SMB2_echo(struct TCP_Server_Info *server) 3912 { 3913 struct smb2_echo_req *req; 3914 int rc = 0; 3915 struct kvec iov[1]; 3916 struct smb_rqst rqst = { .rq_iov = iov, 3917 .rq_nvec = 1 }; 3918 unsigned int total_len; 3919 3920 cifs_dbg(FYI, "In echo request for conn_id %lld\n", server->conn_id); 3921 3922 spin_lock(&server->srv_lock); 3923 if (server->ops->need_neg && 3924 server->ops->need_neg(server)) { 3925 spin_unlock(&server->srv_lock); 3926 /* No need to send echo on newly established connections */ 3927 mod_delayed_work(cifsiod_wq, &server->reconnect, 0); 3928 return rc; 3929 } 3930 spin_unlock(&server->srv_lock); 3931 3932 rc = smb2_plain_req_init(SMB2_ECHO, NULL, server, 3933 (void **)&req, &total_len); 3934 if (rc) 3935 return rc; 3936 3937 req->hdr.CreditRequest = cpu_to_le16(1); 3938 3939 iov[0].iov_len = total_len; 3940 iov[0].iov_base = (char *)req; 3941 3942 rc = cifs_call_async(server, &rqst, NULL, smb2_echo_callback, NULL, 3943 server, CIFS_ECHO_OP, NULL); 3944 if (rc) 3945 cifs_dbg(FYI, "Echo request failed: %d\n", rc); 3946 3947 cifs_small_buf_release(req); 3948 return rc; 3949 } 3950 3951 void 3952 SMB2_flush_free(struct smb_rqst *rqst) 3953 { 3954 if (rqst && rqst->rq_iov) 3955 cifs_small_buf_release(rqst->rq_iov[0].iov_base); /* request */ 3956 } 3957 3958 int 3959 SMB2_flush_init(const unsigned int xid, struct smb_rqst *rqst, 3960 struct cifs_tcon *tcon, struct TCP_Server_Info *server, 3961 u64 persistent_fid, u64 volatile_fid) 3962 { 3963 struct smb2_flush_req *req; 3964 struct kvec *iov = rqst->rq_iov; 3965 unsigned int total_len; 3966 int rc; 3967 3968 rc = smb2_plain_req_init(SMB2_FLUSH, tcon, server, 3969 (void **) &req, &total_len); 3970 if (rc) 3971 return rc; 3972 3973 req->PersistentFileId = persistent_fid; 3974 req->VolatileFileId = volatile_fid; 3975 3976 iov[0].iov_base = (char *)req; 3977 iov[0].iov_len = total_len; 3978 3979 return 0; 3980 } 3981 3982 int 3983 SMB2_flush(const unsigned int xid, struct cifs_tcon *tcon, u64 persistent_fid, 3984 u64 volatile_fid) 3985 { 3986 struct cifs_ses *ses = tcon->ses; 3987 struct smb_rqst rqst; 3988 struct kvec iov[1]; 3989 struct kvec rsp_iov = {NULL, 0}; 3990 struct TCP_Server_Info *server = cifs_pick_channel(ses); 3991 int resp_buftype = CIFS_NO_BUFFER; 3992 int flags = 0; 3993 int rc = 0; 3994 3995 cifs_dbg(FYI, "flush\n"); 3996 if (!ses || !(ses->server)) 3997 return -EIO; 3998 3999 if (smb3_encryption_required(tcon)) 4000 flags |= CIFS_TRANSFORM_REQ; 4001 4002 memset(&rqst, 0, sizeof(struct smb_rqst)); 4003 memset(&iov, 0, sizeof(iov)); 4004 rqst.rq_iov = iov; 4005 rqst.rq_nvec = 1; 4006 4007 rc = SMB2_flush_init(xid, &rqst, tcon, server, 4008 persistent_fid, volatile_fid); 4009 if (rc) 4010 goto flush_exit; 4011 4012 trace_smb3_flush_enter(xid, persistent_fid, tcon->tid, ses->Suid); 4013 rc = cifs_send_recv(xid, ses, server, 4014 &rqst, &resp_buftype, flags, &rsp_iov); 4015 4016 if (rc != 0) { 4017 cifs_stats_fail_inc(tcon, SMB2_FLUSH_HE); 4018 trace_smb3_flush_err(xid, persistent_fid, tcon->tid, ses->Suid, 4019 rc); 4020 } else 4021 trace_smb3_flush_done(xid, persistent_fid, tcon->tid, 4022 ses->Suid); 4023 4024 flush_exit: 4025 SMB2_flush_free(&rqst); 4026 free_rsp_buf(resp_buftype, rsp_iov.iov_base); 4027 return rc; 4028 } 4029 4030 #ifdef CONFIG_CIFS_SMB_DIRECT 4031 static inline bool smb3_use_rdma_offload(struct cifs_io_parms *io_parms) 4032 { 4033 struct TCP_Server_Info *server = io_parms->server; 4034 struct cifs_tcon *tcon = io_parms->tcon; 4035 4036 /* we can only offload if we're connected */ 4037 if (!server || !tcon) 4038 return false; 4039 4040 /* we can only offload on an rdma connection */ 4041 if (!server->rdma || !server->smbd_conn) 4042 return false; 4043 4044 /* we don't support signed offload yet */ 4045 if (server->sign) 4046 return false; 4047 4048 /* we don't support encrypted offload yet */ 4049 if (smb3_encryption_required(tcon)) 4050 return false; 4051 4052 /* offload also has its overhead, so only do it if desired */ 4053 if (io_parms->length < server->smbd_conn->rdma_readwrite_threshold) 4054 return false; 4055 4056 return true; 4057 } 4058 #endif /* CONFIG_CIFS_SMB_DIRECT */ 4059 4060 /* 4061 * To form a chain of read requests, any read requests after the first should 4062 * have the end_of_chain boolean set to true. 4063 */ 4064 static int 4065 smb2_new_read_req(void **buf, unsigned int *total_len, 4066 struct cifs_io_parms *io_parms, struct cifs_readdata *rdata, 4067 unsigned int remaining_bytes, int request_type) 4068 { 4069 int rc = -EACCES; 4070 struct smb2_read_req *req = NULL; 4071 struct smb2_hdr *shdr; 4072 struct TCP_Server_Info *server = io_parms->server; 4073 4074 rc = smb2_plain_req_init(SMB2_READ, io_parms->tcon, server, 4075 (void **) &req, total_len); 4076 if (rc) 4077 return rc; 4078 4079 if (server == NULL) 4080 return -ECONNABORTED; 4081 4082 shdr = &req->hdr; 4083 shdr->Id.SyncId.ProcessId = cpu_to_le32(io_parms->pid); 4084 4085 req->PersistentFileId = io_parms->persistent_fid; 4086 req->VolatileFileId = io_parms->volatile_fid; 4087 req->ReadChannelInfoOffset = 0; /* reserved */ 4088 req->ReadChannelInfoLength = 0; /* reserved */ 4089 req->Channel = 0; /* reserved */ 4090 req->MinimumCount = 0; 4091 req->Length = cpu_to_le32(io_parms->length); 4092 req->Offset = cpu_to_le64(io_parms->offset); 4093 4094 trace_smb3_read_enter(0 /* xid */, 4095 io_parms->persistent_fid, 4096 io_parms->tcon->tid, io_parms->tcon->ses->Suid, 4097 io_parms->offset, io_parms->length); 4098 #ifdef CONFIG_CIFS_SMB_DIRECT 4099 /* 4100 * If we want to do a RDMA write, fill in and append 4101 * smbd_buffer_descriptor_v1 to the end of read request 4102 */ 4103 if (smb3_use_rdma_offload(io_parms)) { 4104 struct smbd_buffer_descriptor_v1 *v1; 4105 bool need_invalidate = server->dialect == SMB30_PROT_ID; 4106 4107 rdata->mr = smbd_register_mr(server->smbd_conn, &rdata->iter, 4108 true, need_invalidate); 4109 if (!rdata->mr) 4110 return -EAGAIN; 4111 4112 req->Channel = SMB2_CHANNEL_RDMA_V1_INVALIDATE; 4113 if (need_invalidate) 4114 req->Channel = SMB2_CHANNEL_RDMA_V1; 4115 req->ReadChannelInfoOffset = 4116 cpu_to_le16(offsetof(struct smb2_read_req, Buffer)); 4117 req->ReadChannelInfoLength = 4118 cpu_to_le16(sizeof(struct smbd_buffer_descriptor_v1)); 4119 v1 = (struct smbd_buffer_descriptor_v1 *) &req->Buffer[0]; 4120 v1->offset = cpu_to_le64(rdata->mr->mr->iova); 4121 v1->token = cpu_to_le32(rdata->mr->mr->rkey); 4122 v1->length = cpu_to_le32(rdata->mr->mr->length); 4123 4124 *total_len += sizeof(*v1) - 1; 4125 } 4126 #endif 4127 if (request_type & CHAINED_REQUEST) { 4128 if (!(request_type & END_OF_CHAIN)) { 4129 /* next 8-byte aligned request */ 4130 *total_len = ALIGN(*total_len, 8); 4131 shdr->NextCommand = cpu_to_le32(*total_len); 4132 } else /* END_OF_CHAIN */ 4133 shdr->NextCommand = 0; 4134 if (request_type & RELATED_REQUEST) { 4135 shdr->Flags |= SMB2_FLAGS_RELATED_OPERATIONS; 4136 /* 4137 * Related requests use info from previous read request 4138 * in chain. 4139 */ 4140 shdr->SessionId = cpu_to_le64(0xFFFFFFFFFFFFFFFF); 4141 shdr->Id.SyncId.TreeId = cpu_to_le32(0xFFFFFFFF); 4142 req->PersistentFileId = (u64)-1; 4143 req->VolatileFileId = (u64)-1; 4144 } 4145 } 4146 if (remaining_bytes > io_parms->length) 4147 req->RemainingBytes = cpu_to_le32(remaining_bytes); 4148 else 4149 req->RemainingBytes = 0; 4150 4151 *buf = req; 4152 return rc; 4153 } 4154 4155 static void 4156 smb2_readv_callback(struct mid_q_entry *mid) 4157 { 4158 struct cifs_readdata *rdata = mid->callback_data; 4159 struct cifs_tcon *tcon = tlink_tcon(rdata->cfile->tlink); 4160 struct TCP_Server_Info *server = rdata->server; 4161 struct smb2_hdr *shdr = 4162 (struct smb2_hdr *)rdata->iov[0].iov_base; 4163 struct cifs_credits credits = { .value = 0, .instance = 0 }; 4164 struct smb_rqst rqst = { .rq_iov = &rdata->iov[1], .rq_nvec = 1 }; 4165 4166 if (rdata->got_bytes) { 4167 rqst.rq_iter = rdata->iter; 4168 rqst.rq_iter_size = iov_iter_count(&rdata->iter); 4169 } 4170 4171 WARN_ONCE(rdata->server != mid->server, 4172 "rdata server %p != mid server %p", 4173 rdata->server, mid->server); 4174 4175 cifs_dbg(FYI, "%s: mid=%llu state=%d result=%d bytes=%u\n", 4176 __func__, mid->mid, mid->mid_state, rdata->result, 4177 rdata->bytes); 4178 4179 switch (mid->mid_state) { 4180 case MID_RESPONSE_RECEIVED: 4181 credits.value = le16_to_cpu(shdr->CreditRequest); 4182 credits.instance = server->reconnect_instance; 4183 /* result already set, check signature */ 4184 if (server->sign && !mid->decrypted) { 4185 int rc; 4186 4187 iov_iter_revert(&rqst.rq_iter, rdata->got_bytes); 4188 iov_iter_truncate(&rqst.rq_iter, rdata->got_bytes); 4189 rc = smb2_verify_signature(&rqst, server); 4190 if (rc) 4191 cifs_tcon_dbg(VFS, "SMB signature verification returned error = %d\n", 4192 rc); 4193 } 4194 /* FIXME: should this be counted toward the initiating task? */ 4195 task_io_account_read(rdata->got_bytes); 4196 cifs_stats_bytes_read(tcon, rdata->got_bytes); 4197 break; 4198 case MID_REQUEST_SUBMITTED: 4199 case MID_RETRY_NEEDED: 4200 rdata->result = -EAGAIN; 4201 if (server->sign && rdata->got_bytes) 4202 /* reset bytes number since we can not check a sign */ 4203 rdata->got_bytes = 0; 4204 /* FIXME: should this be counted toward the initiating task? */ 4205 task_io_account_read(rdata->got_bytes); 4206 cifs_stats_bytes_read(tcon, rdata->got_bytes); 4207 break; 4208 case MID_RESPONSE_MALFORMED: 4209 credits.value = le16_to_cpu(shdr->CreditRequest); 4210 credits.instance = server->reconnect_instance; 4211 fallthrough; 4212 default: 4213 rdata->result = -EIO; 4214 } 4215 #ifdef CONFIG_CIFS_SMB_DIRECT 4216 /* 4217 * If this rdata has a memmory registered, the MR can be freed 4218 * MR needs to be freed as soon as I/O finishes to prevent deadlock 4219 * because they have limited number and are used for future I/Os 4220 */ 4221 if (rdata->mr) { 4222 smbd_deregister_mr(rdata->mr); 4223 rdata->mr = NULL; 4224 } 4225 #endif 4226 if (rdata->result && rdata->result != -ENODATA) { 4227 cifs_stats_fail_inc(tcon, SMB2_READ_HE); 4228 trace_smb3_read_err(0 /* xid */, 4229 rdata->cfile->fid.persistent_fid, 4230 tcon->tid, tcon->ses->Suid, rdata->offset, 4231 rdata->bytes, rdata->result); 4232 } else 4233 trace_smb3_read_done(0 /* xid */, 4234 rdata->cfile->fid.persistent_fid, 4235 tcon->tid, tcon->ses->Suid, 4236 rdata->offset, rdata->got_bytes); 4237 4238 queue_work(cifsiod_wq, &rdata->work); 4239 release_mid(mid); 4240 add_credits(server, &credits, 0); 4241 } 4242 4243 /* smb2_async_readv - send an async read, and set up mid to handle result */ 4244 int 4245 smb2_async_readv(struct cifs_readdata *rdata) 4246 { 4247 int rc, flags = 0; 4248 char *buf; 4249 struct smb2_hdr *shdr; 4250 struct cifs_io_parms io_parms; 4251 struct smb_rqst rqst = { .rq_iov = rdata->iov, 4252 .rq_nvec = 1 }; 4253 struct TCP_Server_Info *server; 4254 struct cifs_tcon *tcon = tlink_tcon(rdata->cfile->tlink); 4255 unsigned int total_len; 4256 int credit_request; 4257 4258 cifs_dbg(FYI, "%s: offset=%llu bytes=%u\n", 4259 __func__, rdata->offset, rdata->bytes); 4260 4261 if (!rdata->server) 4262 rdata->server = cifs_pick_channel(tcon->ses); 4263 4264 io_parms.tcon = tlink_tcon(rdata->cfile->tlink); 4265 io_parms.server = server = rdata->server; 4266 io_parms.offset = rdata->offset; 4267 io_parms.length = rdata->bytes; 4268 io_parms.persistent_fid = rdata->cfile->fid.persistent_fid; 4269 io_parms.volatile_fid = rdata->cfile->fid.volatile_fid; 4270 io_parms.pid = rdata->pid; 4271 4272 rc = smb2_new_read_req( 4273 (void **) &buf, &total_len, &io_parms, rdata, 0, 0); 4274 if (rc) 4275 return rc; 4276 4277 if (smb3_encryption_required(io_parms.tcon)) 4278 flags |= CIFS_TRANSFORM_REQ; 4279 4280 rdata->iov[0].iov_base = buf; 4281 rdata->iov[0].iov_len = total_len; 4282 4283 shdr = (struct smb2_hdr *)buf; 4284 4285 if (rdata->credits.value > 0) { 4286 shdr->CreditCharge = cpu_to_le16(DIV_ROUND_UP(rdata->bytes, 4287 SMB2_MAX_BUFFER_SIZE)); 4288 credit_request = le16_to_cpu(shdr->CreditCharge) + 8; 4289 if (server->credits >= server->max_credits) 4290 shdr->CreditRequest = cpu_to_le16(0); 4291 else 4292 shdr->CreditRequest = cpu_to_le16( 4293 min_t(int, server->max_credits - 4294 server->credits, credit_request)); 4295 4296 rc = adjust_credits(server, &rdata->credits, rdata->bytes); 4297 if (rc) 4298 goto async_readv_out; 4299 4300 flags |= CIFS_HAS_CREDITS; 4301 } 4302 4303 kref_get(&rdata->refcount); 4304 rc = cifs_call_async(server, &rqst, 4305 cifs_readv_receive, smb2_readv_callback, 4306 smb3_handle_read_data, rdata, flags, 4307 &rdata->credits); 4308 if (rc) { 4309 kref_put(&rdata->refcount, cifs_readdata_release); 4310 cifs_stats_fail_inc(io_parms.tcon, SMB2_READ_HE); 4311 trace_smb3_read_err(0 /* xid */, io_parms.persistent_fid, 4312 io_parms.tcon->tid, 4313 io_parms.tcon->ses->Suid, 4314 io_parms.offset, io_parms.length, rc); 4315 } 4316 4317 async_readv_out: 4318 cifs_small_buf_release(buf); 4319 return rc; 4320 } 4321 4322 int 4323 SMB2_read(const unsigned int xid, struct cifs_io_parms *io_parms, 4324 unsigned int *nbytes, char **buf, int *buf_type) 4325 { 4326 struct smb_rqst rqst; 4327 int resp_buftype, rc; 4328 struct smb2_read_req *req = NULL; 4329 struct smb2_read_rsp *rsp = NULL; 4330 struct kvec iov[1]; 4331 struct kvec rsp_iov; 4332 unsigned int total_len; 4333 int flags = CIFS_LOG_ERROR; 4334 struct cifs_ses *ses = io_parms->tcon->ses; 4335 4336 if (!io_parms->server) 4337 io_parms->server = cifs_pick_channel(io_parms->tcon->ses); 4338 4339 *nbytes = 0; 4340 rc = smb2_new_read_req((void **)&req, &total_len, io_parms, NULL, 0, 0); 4341 if (rc) 4342 return rc; 4343 4344 if (smb3_encryption_required(io_parms->tcon)) 4345 flags |= CIFS_TRANSFORM_REQ; 4346 4347 iov[0].iov_base = (char *)req; 4348 iov[0].iov_len = total_len; 4349 4350 memset(&rqst, 0, sizeof(struct smb_rqst)); 4351 rqst.rq_iov = iov; 4352 rqst.rq_nvec = 1; 4353 4354 rc = cifs_send_recv(xid, ses, io_parms->server, 4355 &rqst, &resp_buftype, flags, &rsp_iov); 4356 rsp = (struct smb2_read_rsp *)rsp_iov.iov_base; 4357 4358 if (rc) { 4359 if (rc != -ENODATA) { 4360 cifs_stats_fail_inc(io_parms->tcon, SMB2_READ_HE); 4361 cifs_dbg(VFS, "Send error in read = %d\n", rc); 4362 trace_smb3_read_err(xid, 4363 req->PersistentFileId, 4364 io_parms->tcon->tid, ses->Suid, 4365 io_parms->offset, io_parms->length, 4366 rc); 4367 } else 4368 trace_smb3_read_done(xid, req->PersistentFileId, io_parms->tcon->tid, 4369 ses->Suid, io_parms->offset, 0); 4370 free_rsp_buf(resp_buftype, rsp_iov.iov_base); 4371 cifs_small_buf_release(req); 4372 return rc == -ENODATA ? 0 : rc; 4373 } else 4374 trace_smb3_read_done(xid, 4375 req->PersistentFileId, 4376 io_parms->tcon->tid, ses->Suid, 4377 io_parms->offset, io_parms->length); 4378 4379 cifs_small_buf_release(req); 4380 4381 *nbytes = le32_to_cpu(rsp->DataLength); 4382 if ((*nbytes > CIFS_MAX_MSGSIZE) || 4383 (*nbytes > io_parms->length)) { 4384 cifs_dbg(FYI, "bad length %d for count %d\n", 4385 *nbytes, io_parms->length); 4386 rc = -EIO; 4387 *nbytes = 0; 4388 } 4389 4390 if (*buf) { 4391 memcpy(*buf, (char *)rsp + rsp->DataOffset, *nbytes); 4392 free_rsp_buf(resp_buftype, rsp_iov.iov_base); 4393 } else if (resp_buftype != CIFS_NO_BUFFER) { 4394 *buf = rsp_iov.iov_base; 4395 if (resp_buftype == CIFS_SMALL_BUFFER) 4396 *buf_type = CIFS_SMALL_BUFFER; 4397 else if (resp_buftype == CIFS_LARGE_BUFFER) 4398 *buf_type = CIFS_LARGE_BUFFER; 4399 } 4400 return rc; 4401 } 4402 4403 /* 4404 * Check the mid_state and signature on received buffer (if any), and queue the 4405 * workqueue completion task. 4406 */ 4407 static void 4408 smb2_writev_callback(struct mid_q_entry *mid) 4409 { 4410 struct cifs_writedata *wdata = mid->callback_data; 4411 struct cifs_tcon *tcon = tlink_tcon(wdata->cfile->tlink); 4412 struct TCP_Server_Info *server = wdata->server; 4413 unsigned int written; 4414 struct smb2_write_rsp *rsp = (struct smb2_write_rsp *)mid->resp_buf; 4415 struct cifs_credits credits = { .value = 0, .instance = 0 }; 4416 4417 WARN_ONCE(wdata->server != mid->server, 4418 "wdata server %p != mid server %p", 4419 wdata->server, mid->server); 4420 4421 switch (mid->mid_state) { 4422 case MID_RESPONSE_RECEIVED: 4423 credits.value = le16_to_cpu(rsp->hdr.CreditRequest); 4424 credits.instance = server->reconnect_instance; 4425 wdata->result = smb2_check_receive(mid, server, 0); 4426 if (wdata->result != 0) 4427 break; 4428 4429 written = le32_to_cpu(rsp->DataLength); 4430 /* 4431 * Mask off high 16 bits when bytes written as returned 4432 * by the server is greater than bytes requested by the 4433 * client. OS/2 servers are known to set incorrect 4434 * CountHigh values. 4435 */ 4436 if (written > wdata->bytes) 4437 written &= 0xFFFF; 4438 4439 if (written < wdata->bytes) 4440 wdata->result = -ENOSPC; 4441 else 4442 wdata->bytes = written; 4443 break; 4444 case MID_REQUEST_SUBMITTED: 4445 case MID_RETRY_NEEDED: 4446 wdata->result = -EAGAIN; 4447 break; 4448 case MID_RESPONSE_MALFORMED: 4449 credits.value = le16_to_cpu(rsp->hdr.CreditRequest); 4450 credits.instance = server->reconnect_instance; 4451 fallthrough; 4452 default: 4453 wdata->result = -EIO; 4454 break; 4455 } 4456 #ifdef CONFIG_CIFS_SMB_DIRECT 4457 /* 4458 * If this wdata has a memory registered, the MR can be freed 4459 * The number of MRs available is limited, it's important to recover 4460 * used MR as soon as I/O is finished. Hold MR longer in the later 4461 * I/O process can possibly result in I/O deadlock due to lack of MR 4462 * to send request on I/O retry 4463 */ 4464 if (wdata->mr) { 4465 smbd_deregister_mr(wdata->mr); 4466 wdata->mr = NULL; 4467 } 4468 #endif 4469 if (wdata->result) { 4470 cifs_stats_fail_inc(tcon, SMB2_WRITE_HE); 4471 trace_smb3_write_err(0 /* no xid */, 4472 wdata->cfile->fid.persistent_fid, 4473 tcon->tid, tcon->ses->Suid, wdata->offset, 4474 wdata->bytes, wdata->result); 4475 if (wdata->result == -ENOSPC) 4476 pr_warn_once("Out of space writing to %s\n", 4477 tcon->tree_name); 4478 } else 4479 trace_smb3_write_done(0 /* no xid */, 4480 wdata->cfile->fid.persistent_fid, 4481 tcon->tid, tcon->ses->Suid, 4482 wdata->offset, wdata->bytes); 4483 4484 queue_work(cifsiod_wq, &wdata->work); 4485 release_mid(mid); 4486 add_credits(server, &credits, 0); 4487 } 4488 4489 /* smb2_async_writev - send an async write, and set up mid to handle result */ 4490 int 4491 smb2_async_writev(struct cifs_writedata *wdata, 4492 void (*release)(struct kref *kref)) 4493 { 4494 int rc = -EACCES, flags = 0; 4495 struct smb2_write_req *req = NULL; 4496 struct smb2_hdr *shdr; 4497 struct cifs_tcon *tcon = tlink_tcon(wdata->cfile->tlink); 4498 struct TCP_Server_Info *server = wdata->server; 4499 struct kvec iov[1]; 4500 struct smb_rqst rqst = { }; 4501 unsigned int total_len; 4502 struct cifs_io_parms _io_parms; 4503 struct cifs_io_parms *io_parms = NULL; 4504 int credit_request; 4505 4506 if (!wdata->server) 4507 server = wdata->server = cifs_pick_channel(tcon->ses); 4508 4509 /* 4510 * in future we may get cifs_io_parms passed in from the caller, 4511 * but for now we construct it here... 4512 */ 4513 _io_parms = (struct cifs_io_parms) { 4514 .tcon = tcon, 4515 .server = server, 4516 .offset = wdata->offset, 4517 .length = wdata->bytes, 4518 .persistent_fid = wdata->cfile->fid.persistent_fid, 4519 .volatile_fid = wdata->cfile->fid.volatile_fid, 4520 .pid = wdata->pid, 4521 }; 4522 io_parms = &_io_parms; 4523 4524 rc = smb2_plain_req_init(SMB2_WRITE, tcon, server, 4525 (void **) &req, &total_len); 4526 if (rc) 4527 return rc; 4528 4529 if (smb3_encryption_required(tcon)) 4530 flags |= CIFS_TRANSFORM_REQ; 4531 4532 shdr = (struct smb2_hdr *)req; 4533 shdr->Id.SyncId.ProcessId = cpu_to_le32(io_parms->pid); 4534 4535 req->PersistentFileId = io_parms->persistent_fid; 4536 req->VolatileFileId = io_parms->volatile_fid; 4537 req->WriteChannelInfoOffset = 0; 4538 req->WriteChannelInfoLength = 0; 4539 req->Channel = SMB2_CHANNEL_NONE; 4540 req->Offset = cpu_to_le64(io_parms->offset); 4541 req->DataOffset = cpu_to_le16( 4542 offsetof(struct smb2_write_req, Buffer)); 4543 req->RemainingBytes = 0; 4544 4545 trace_smb3_write_enter(0 /* xid */, 4546 io_parms->persistent_fid, 4547 io_parms->tcon->tid, 4548 io_parms->tcon->ses->Suid, 4549 io_parms->offset, 4550 io_parms->length); 4551 4552 #ifdef CONFIG_CIFS_SMB_DIRECT 4553 /* 4554 * If we want to do a server RDMA read, fill in and append 4555 * smbd_buffer_descriptor_v1 to the end of write request 4556 */ 4557 if (smb3_use_rdma_offload(io_parms)) { 4558 struct smbd_buffer_descriptor_v1 *v1; 4559 size_t data_size = iov_iter_count(&wdata->iter); 4560 bool need_invalidate = server->dialect == SMB30_PROT_ID; 4561 4562 wdata->mr = smbd_register_mr(server->smbd_conn, &wdata->iter, 4563 false, need_invalidate); 4564 if (!wdata->mr) { 4565 rc = -EAGAIN; 4566 goto async_writev_out; 4567 } 4568 req->Length = 0; 4569 req->DataOffset = 0; 4570 req->RemainingBytes = cpu_to_le32(data_size); 4571 req->Channel = SMB2_CHANNEL_RDMA_V1_INVALIDATE; 4572 if (need_invalidate) 4573 req->Channel = SMB2_CHANNEL_RDMA_V1; 4574 req->WriteChannelInfoOffset = 4575 cpu_to_le16(offsetof(struct smb2_write_req, Buffer)); 4576 req->WriteChannelInfoLength = 4577 cpu_to_le16(sizeof(struct smbd_buffer_descriptor_v1)); 4578 v1 = (struct smbd_buffer_descriptor_v1 *) &req->Buffer[0]; 4579 v1->offset = cpu_to_le64(wdata->mr->mr->iova); 4580 v1->token = cpu_to_le32(wdata->mr->mr->rkey); 4581 v1->length = cpu_to_le32(wdata->mr->mr->length); 4582 } 4583 #endif 4584 iov[0].iov_len = total_len - 1; 4585 iov[0].iov_base = (char *)req; 4586 4587 rqst.rq_iov = iov; 4588 rqst.rq_nvec = 1; 4589 rqst.rq_iter = wdata->iter; 4590 rqst.rq_iter_size = iov_iter_count(&rqst.rq_iter); 4591 #ifdef CONFIG_CIFS_SMB_DIRECT 4592 if (wdata->mr) 4593 iov[0].iov_len += sizeof(struct smbd_buffer_descriptor_v1); 4594 #endif 4595 cifs_dbg(FYI, "async write at %llu %u bytes iter=%zx\n", 4596 io_parms->offset, io_parms->length, iov_iter_count(&rqst.rq_iter)); 4597 4598 #ifdef CONFIG_CIFS_SMB_DIRECT 4599 /* For RDMA read, I/O size is in RemainingBytes not in Length */ 4600 if (!wdata->mr) 4601 req->Length = cpu_to_le32(io_parms->length); 4602 #else 4603 req->Length = cpu_to_le32(io_parms->length); 4604 #endif 4605 4606 if (wdata->credits.value > 0) { 4607 shdr->CreditCharge = cpu_to_le16(DIV_ROUND_UP(wdata->bytes, 4608 SMB2_MAX_BUFFER_SIZE)); 4609 credit_request = le16_to_cpu(shdr->CreditCharge) + 8; 4610 if (server->credits >= server->max_credits) 4611 shdr->CreditRequest = cpu_to_le16(0); 4612 else 4613 shdr->CreditRequest = cpu_to_le16( 4614 min_t(int, server->max_credits - 4615 server->credits, credit_request)); 4616 4617 rc = adjust_credits(server, &wdata->credits, io_parms->length); 4618 if (rc) 4619 goto async_writev_out; 4620 4621 flags |= CIFS_HAS_CREDITS; 4622 } 4623 4624 kref_get(&wdata->refcount); 4625 rc = cifs_call_async(server, &rqst, NULL, smb2_writev_callback, NULL, 4626 wdata, flags, &wdata->credits); 4627 4628 if (rc) { 4629 trace_smb3_write_err(0 /* no xid */, 4630 io_parms->persistent_fid, 4631 io_parms->tcon->tid, 4632 io_parms->tcon->ses->Suid, 4633 io_parms->offset, 4634 io_parms->length, 4635 rc); 4636 kref_put(&wdata->refcount, release); 4637 cifs_stats_fail_inc(tcon, SMB2_WRITE_HE); 4638 } 4639 4640 async_writev_out: 4641 cifs_small_buf_release(req); 4642 return rc; 4643 } 4644 4645 /* 4646 * SMB2_write function gets iov pointer to kvec array with n_vec as a length. 4647 * The length field from io_parms must be at least 1 and indicates a number of 4648 * elements with data to write that begins with position 1 in iov array. All 4649 * data length is specified by count. 4650 */ 4651 int 4652 SMB2_write(const unsigned int xid, struct cifs_io_parms *io_parms, 4653 unsigned int *nbytes, struct kvec *iov, int n_vec) 4654 { 4655 struct smb_rqst rqst; 4656 int rc = 0; 4657 struct smb2_write_req *req = NULL; 4658 struct smb2_write_rsp *rsp = NULL; 4659 int resp_buftype; 4660 struct kvec rsp_iov; 4661 int flags = 0; 4662 unsigned int total_len; 4663 struct TCP_Server_Info *server; 4664 4665 *nbytes = 0; 4666 4667 if (n_vec < 1) 4668 return rc; 4669 4670 if (!io_parms->server) 4671 io_parms->server = cifs_pick_channel(io_parms->tcon->ses); 4672 server = io_parms->server; 4673 if (server == NULL) 4674 return -ECONNABORTED; 4675 4676 rc = smb2_plain_req_init(SMB2_WRITE, io_parms->tcon, server, 4677 (void **) &req, &total_len); 4678 if (rc) 4679 return rc; 4680 4681 if (smb3_encryption_required(io_parms->tcon)) 4682 flags |= CIFS_TRANSFORM_REQ; 4683 4684 req->hdr.Id.SyncId.ProcessId = cpu_to_le32(io_parms->pid); 4685 4686 req->PersistentFileId = io_parms->persistent_fid; 4687 req->VolatileFileId = io_parms->volatile_fid; 4688 req->WriteChannelInfoOffset = 0; 4689 req->WriteChannelInfoLength = 0; 4690 req->Channel = 0; 4691 req->Length = cpu_to_le32(io_parms->length); 4692 req->Offset = cpu_to_le64(io_parms->offset); 4693 req->DataOffset = cpu_to_le16( 4694 offsetof(struct smb2_write_req, Buffer)); 4695 req->RemainingBytes = 0; 4696 4697 trace_smb3_write_enter(xid, io_parms->persistent_fid, 4698 io_parms->tcon->tid, io_parms->tcon->ses->Suid, 4699 io_parms->offset, io_parms->length); 4700 4701 iov[0].iov_base = (char *)req; 4702 /* 1 for Buffer */ 4703 iov[0].iov_len = total_len - 1; 4704 4705 memset(&rqst, 0, sizeof(struct smb_rqst)); 4706 rqst.rq_iov = iov; 4707 rqst.rq_nvec = n_vec + 1; 4708 4709 rc = cifs_send_recv(xid, io_parms->tcon->ses, server, 4710 &rqst, 4711 &resp_buftype, flags, &rsp_iov); 4712 rsp = (struct smb2_write_rsp *)rsp_iov.iov_base; 4713 4714 if (rc) { 4715 trace_smb3_write_err(xid, 4716 req->PersistentFileId, 4717 io_parms->tcon->tid, 4718 io_parms->tcon->ses->Suid, 4719 io_parms->offset, io_parms->length, rc); 4720 cifs_stats_fail_inc(io_parms->tcon, SMB2_WRITE_HE); 4721 cifs_dbg(VFS, "Send error in write = %d\n", rc); 4722 } else { 4723 *nbytes = le32_to_cpu(rsp->DataLength); 4724 trace_smb3_write_done(xid, 4725 req->PersistentFileId, 4726 io_parms->tcon->tid, 4727 io_parms->tcon->ses->Suid, 4728 io_parms->offset, *nbytes); 4729 } 4730 4731 cifs_small_buf_release(req); 4732 free_rsp_buf(resp_buftype, rsp); 4733 return rc; 4734 } 4735 4736 int posix_info_sid_size(const void *beg, const void *end) 4737 { 4738 size_t subauth; 4739 int total; 4740 4741 if (beg + 1 > end) 4742 return -1; 4743 4744 subauth = *(u8 *)(beg+1); 4745 if (subauth < 1 || subauth > 15) 4746 return -1; 4747 4748 total = 1 + 1 + 6 + 4*subauth; 4749 if (beg + total > end) 4750 return -1; 4751 4752 return total; 4753 } 4754 4755 int posix_info_parse(const void *beg, const void *end, 4756 struct smb2_posix_info_parsed *out) 4757 4758 { 4759 int total_len = 0; 4760 int owner_len, group_len; 4761 int name_len; 4762 const void *owner_sid; 4763 const void *group_sid; 4764 const void *name; 4765 4766 /* if no end bound given, assume payload to be correct */ 4767 if (!end) { 4768 const struct smb2_posix_info *p = beg; 4769 4770 end = beg + le32_to_cpu(p->NextEntryOffset); 4771 /* last element will have a 0 offset, pick a sensible bound */ 4772 if (end == beg) 4773 end += 0xFFFF; 4774 } 4775 4776 /* check base buf */ 4777 if (beg + sizeof(struct smb2_posix_info) > end) 4778 return -1; 4779 total_len = sizeof(struct smb2_posix_info); 4780 4781 /* check owner sid */ 4782 owner_sid = beg + total_len; 4783 owner_len = posix_info_sid_size(owner_sid, end); 4784 if (owner_len < 0) 4785 return -1; 4786 total_len += owner_len; 4787 4788 /* check group sid */ 4789 group_sid = beg + total_len; 4790 group_len = posix_info_sid_size(group_sid, end); 4791 if (group_len < 0) 4792 return -1; 4793 total_len += group_len; 4794 4795 /* check name len */ 4796 if (beg + total_len + 4 > end) 4797 return -1; 4798 name_len = le32_to_cpu(*(__le32 *)(beg + total_len)); 4799 if (name_len < 1 || name_len > 0xFFFF) 4800 return -1; 4801 total_len += 4; 4802 4803 /* check name */ 4804 name = beg + total_len; 4805 if (name + name_len > end) 4806 return -1; 4807 total_len += name_len; 4808 4809 if (out) { 4810 out->base = beg; 4811 out->size = total_len; 4812 out->name_len = name_len; 4813 out->name = name; 4814 memcpy(&out->owner, owner_sid, owner_len); 4815 memcpy(&out->group, group_sid, group_len); 4816 } 4817 return total_len; 4818 } 4819 4820 static int posix_info_extra_size(const void *beg, const void *end) 4821 { 4822 int len = posix_info_parse(beg, end, NULL); 4823 4824 if (len < 0) 4825 return -1; 4826 return len - sizeof(struct smb2_posix_info); 4827 } 4828 4829 static unsigned int 4830 num_entries(int infotype, char *bufstart, char *end_of_buf, char **lastentry, 4831 size_t size) 4832 { 4833 int len; 4834 unsigned int entrycount = 0; 4835 unsigned int next_offset = 0; 4836 char *entryptr; 4837 FILE_DIRECTORY_INFO *dir_info; 4838 4839 if (bufstart == NULL) 4840 return 0; 4841 4842 entryptr = bufstart; 4843 4844 while (1) { 4845 if (entryptr + next_offset < entryptr || 4846 entryptr + next_offset > end_of_buf || 4847 entryptr + next_offset + size > end_of_buf) { 4848 cifs_dbg(VFS, "malformed search entry would overflow\n"); 4849 break; 4850 } 4851 4852 entryptr = entryptr + next_offset; 4853 dir_info = (FILE_DIRECTORY_INFO *)entryptr; 4854 4855 if (infotype == SMB_FIND_FILE_POSIX_INFO) 4856 len = posix_info_extra_size(entryptr, end_of_buf); 4857 else 4858 len = le32_to_cpu(dir_info->FileNameLength); 4859 4860 if (len < 0 || 4861 entryptr + len < entryptr || 4862 entryptr + len > end_of_buf || 4863 entryptr + len + size > end_of_buf) { 4864 cifs_dbg(VFS, "directory entry name would overflow frame end of buf %p\n", 4865 end_of_buf); 4866 break; 4867 } 4868 4869 *lastentry = entryptr; 4870 entrycount++; 4871 4872 next_offset = le32_to_cpu(dir_info->NextEntryOffset); 4873 if (!next_offset) 4874 break; 4875 } 4876 4877 return entrycount; 4878 } 4879 4880 /* 4881 * Readdir/FindFirst 4882 */ 4883 int SMB2_query_directory_init(const unsigned int xid, 4884 struct cifs_tcon *tcon, 4885 struct TCP_Server_Info *server, 4886 struct smb_rqst *rqst, 4887 u64 persistent_fid, u64 volatile_fid, 4888 int index, int info_level) 4889 { 4890 struct smb2_query_directory_req *req; 4891 unsigned char *bufptr; 4892 __le16 asteriks = cpu_to_le16('*'); 4893 unsigned int output_size = CIFSMaxBufSize - 4894 MAX_SMB2_CREATE_RESPONSE_SIZE - 4895 MAX_SMB2_CLOSE_RESPONSE_SIZE; 4896 unsigned int total_len; 4897 struct kvec *iov = rqst->rq_iov; 4898 int len, rc; 4899 4900 rc = smb2_plain_req_init(SMB2_QUERY_DIRECTORY, tcon, server, 4901 (void **) &req, &total_len); 4902 if (rc) 4903 return rc; 4904 4905 switch (info_level) { 4906 case SMB_FIND_FILE_DIRECTORY_INFO: 4907 req->FileInformationClass = FILE_DIRECTORY_INFORMATION; 4908 break; 4909 case SMB_FIND_FILE_ID_FULL_DIR_INFO: 4910 req->FileInformationClass = FILEID_FULL_DIRECTORY_INFORMATION; 4911 break; 4912 case SMB_FIND_FILE_POSIX_INFO: 4913 req->FileInformationClass = SMB_FIND_FILE_POSIX_INFO; 4914 break; 4915 default: 4916 cifs_tcon_dbg(VFS, "info level %u isn't supported\n", 4917 info_level); 4918 return -EINVAL; 4919 } 4920 4921 req->FileIndex = cpu_to_le32(index); 4922 req->PersistentFileId = persistent_fid; 4923 req->VolatileFileId = volatile_fid; 4924 4925 len = 0x2; 4926 bufptr = req->Buffer; 4927 memcpy(bufptr, &asteriks, len); 4928 4929 req->FileNameOffset = 4930 cpu_to_le16(sizeof(struct smb2_query_directory_req)); 4931 req->FileNameLength = cpu_to_le16(len); 4932 /* 4933 * BB could be 30 bytes or so longer if we used SMB2 specific 4934 * buffer lengths, but this is safe and close enough. 4935 */ 4936 output_size = min_t(unsigned int, output_size, server->maxBuf); 4937 output_size = min_t(unsigned int, output_size, 2 << 15); 4938 req->OutputBufferLength = cpu_to_le32(output_size); 4939 4940 iov[0].iov_base = (char *)req; 4941 /* 1 for Buffer */ 4942 iov[0].iov_len = total_len - 1; 4943 4944 iov[1].iov_base = (char *)(req->Buffer); 4945 iov[1].iov_len = len; 4946 4947 trace_smb3_query_dir_enter(xid, persistent_fid, tcon->tid, 4948 tcon->ses->Suid, index, output_size); 4949 4950 return 0; 4951 } 4952 4953 void SMB2_query_directory_free(struct smb_rqst *rqst) 4954 { 4955 if (rqst && rqst->rq_iov) { 4956 cifs_small_buf_release(rqst->rq_iov[0].iov_base); /* request */ 4957 } 4958 } 4959 4960 int 4961 smb2_parse_query_directory(struct cifs_tcon *tcon, 4962 struct kvec *rsp_iov, 4963 int resp_buftype, 4964 struct cifs_search_info *srch_inf) 4965 { 4966 struct smb2_query_directory_rsp *rsp; 4967 size_t info_buf_size; 4968 char *end_of_smb; 4969 int rc; 4970 4971 rsp = (struct smb2_query_directory_rsp *)rsp_iov->iov_base; 4972 4973 switch (srch_inf->info_level) { 4974 case SMB_FIND_FILE_DIRECTORY_INFO: 4975 info_buf_size = sizeof(FILE_DIRECTORY_INFO); 4976 break; 4977 case SMB_FIND_FILE_ID_FULL_DIR_INFO: 4978 info_buf_size = sizeof(SEARCH_ID_FULL_DIR_INFO); 4979 break; 4980 case SMB_FIND_FILE_POSIX_INFO: 4981 /* note that posix payload are variable size */ 4982 info_buf_size = sizeof(struct smb2_posix_info); 4983 break; 4984 default: 4985 cifs_tcon_dbg(VFS, "info level %u isn't supported\n", 4986 srch_inf->info_level); 4987 return -EINVAL; 4988 } 4989 4990 rc = smb2_validate_iov(le16_to_cpu(rsp->OutputBufferOffset), 4991 le32_to_cpu(rsp->OutputBufferLength), rsp_iov, 4992 info_buf_size); 4993 if (rc) { 4994 cifs_tcon_dbg(VFS, "bad info payload"); 4995 return rc; 4996 } 4997 4998 srch_inf->unicode = true; 4999 5000 if (srch_inf->ntwrk_buf_start) { 5001 if (srch_inf->smallBuf) 5002 cifs_small_buf_release(srch_inf->ntwrk_buf_start); 5003 else 5004 cifs_buf_release(srch_inf->ntwrk_buf_start); 5005 } 5006 srch_inf->ntwrk_buf_start = (char *)rsp; 5007 srch_inf->srch_entries_start = srch_inf->last_entry = 5008 (char *)rsp + le16_to_cpu(rsp->OutputBufferOffset); 5009 end_of_smb = rsp_iov->iov_len + (char *)rsp; 5010 5011 srch_inf->entries_in_buffer = num_entries( 5012 srch_inf->info_level, 5013 srch_inf->srch_entries_start, 5014 end_of_smb, 5015 &srch_inf->last_entry, 5016 info_buf_size); 5017 5018 srch_inf->index_of_last_entry += srch_inf->entries_in_buffer; 5019 cifs_dbg(FYI, "num entries %d last_index %lld srch start %p srch end %p\n", 5020 srch_inf->entries_in_buffer, srch_inf->index_of_last_entry, 5021 srch_inf->srch_entries_start, srch_inf->last_entry); 5022 if (resp_buftype == CIFS_LARGE_BUFFER) 5023 srch_inf->smallBuf = false; 5024 else if (resp_buftype == CIFS_SMALL_BUFFER) 5025 srch_inf->smallBuf = true; 5026 else 5027 cifs_tcon_dbg(VFS, "Invalid search buffer type\n"); 5028 5029 return 0; 5030 } 5031 5032 int 5033 SMB2_query_directory(const unsigned int xid, struct cifs_tcon *tcon, 5034 u64 persistent_fid, u64 volatile_fid, int index, 5035 struct cifs_search_info *srch_inf) 5036 { 5037 struct smb_rqst rqst; 5038 struct kvec iov[SMB2_QUERY_DIRECTORY_IOV_SIZE]; 5039 struct smb2_query_directory_rsp *rsp = NULL; 5040 int resp_buftype = CIFS_NO_BUFFER; 5041 struct kvec rsp_iov; 5042 int rc = 0; 5043 struct cifs_ses *ses = tcon->ses; 5044 struct TCP_Server_Info *server = cifs_pick_channel(ses); 5045 int flags = 0; 5046 5047 if (!ses || !(ses->server)) 5048 return -EIO; 5049 5050 if (smb3_encryption_required(tcon)) 5051 flags |= CIFS_TRANSFORM_REQ; 5052 5053 memset(&rqst, 0, sizeof(struct smb_rqst)); 5054 memset(&iov, 0, sizeof(iov)); 5055 rqst.rq_iov = iov; 5056 rqst.rq_nvec = SMB2_QUERY_DIRECTORY_IOV_SIZE; 5057 5058 rc = SMB2_query_directory_init(xid, tcon, server, 5059 &rqst, persistent_fid, 5060 volatile_fid, index, 5061 srch_inf->info_level); 5062 if (rc) 5063 goto qdir_exit; 5064 5065 rc = cifs_send_recv(xid, ses, server, 5066 &rqst, &resp_buftype, flags, &rsp_iov); 5067 rsp = (struct smb2_query_directory_rsp *)rsp_iov.iov_base; 5068 5069 if (rc) { 5070 if (rc == -ENODATA && 5071 rsp->hdr.Status == STATUS_NO_MORE_FILES) { 5072 trace_smb3_query_dir_done(xid, persistent_fid, 5073 tcon->tid, tcon->ses->Suid, index, 0); 5074 srch_inf->endOfSearch = true; 5075 rc = 0; 5076 } else { 5077 trace_smb3_query_dir_err(xid, persistent_fid, tcon->tid, 5078 tcon->ses->Suid, index, 0, rc); 5079 cifs_stats_fail_inc(tcon, SMB2_QUERY_DIRECTORY_HE); 5080 } 5081 goto qdir_exit; 5082 } 5083 5084 rc = smb2_parse_query_directory(tcon, &rsp_iov, resp_buftype, 5085 srch_inf); 5086 if (rc) { 5087 trace_smb3_query_dir_err(xid, persistent_fid, tcon->tid, 5088 tcon->ses->Suid, index, 0, rc); 5089 goto qdir_exit; 5090 } 5091 resp_buftype = CIFS_NO_BUFFER; 5092 5093 trace_smb3_query_dir_done(xid, persistent_fid, tcon->tid, 5094 tcon->ses->Suid, index, srch_inf->entries_in_buffer); 5095 5096 qdir_exit: 5097 SMB2_query_directory_free(&rqst); 5098 free_rsp_buf(resp_buftype, rsp); 5099 return rc; 5100 } 5101 5102 int 5103 SMB2_set_info_init(struct cifs_tcon *tcon, struct TCP_Server_Info *server, 5104 struct smb_rqst *rqst, 5105 u64 persistent_fid, u64 volatile_fid, u32 pid, 5106 u8 info_class, u8 info_type, u32 additional_info, 5107 void **data, unsigned int *size) 5108 { 5109 struct smb2_set_info_req *req; 5110 struct kvec *iov = rqst->rq_iov; 5111 unsigned int i, total_len; 5112 int rc; 5113 5114 rc = smb2_plain_req_init(SMB2_SET_INFO, tcon, server, 5115 (void **) &req, &total_len); 5116 if (rc) 5117 return rc; 5118 5119 req->hdr.Id.SyncId.ProcessId = cpu_to_le32(pid); 5120 req->InfoType = info_type; 5121 req->FileInfoClass = info_class; 5122 req->PersistentFileId = persistent_fid; 5123 req->VolatileFileId = volatile_fid; 5124 req->AdditionalInformation = cpu_to_le32(additional_info); 5125 5126 req->BufferOffset = cpu_to_le16(sizeof(struct smb2_set_info_req)); 5127 req->BufferLength = cpu_to_le32(*size); 5128 5129 memcpy(req->Buffer, *data, *size); 5130 total_len += *size; 5131 5132 iov[0].iov_base = (char *)req; 5133 /* 1 for Buffer */ 5134 iov[0].iov_len = total_len - 1; 5135 5136 for (i = 1; i < rqst->rq_nvec; i++) { 5137 le32_add_cpu(&req->BufferLength, size[i]); 5138 iov[i].iov_base = (char *)data[i]; 5139 iov[i].iov_len = size[i]; 5140 } 5141 5142 return 0; 5143 } 5144 5145 void 5146 SMB2_set_info_free(struct smb_rqst *rqst) 5147 { 5148 if (rqst && rqst->rq_iov) 5149 cifs_buf_release(rqst->rq_iov[0].iov_base); /* request */ 5150 } 5151 5152 static int 5153 send_set_info(const unsigned int xid, struct cifs_tcon *tcon, 5154 u64 persistent_fid, u64 volatile_fid, u32 pid, u8 info_class, 5155 u8 info_type, u32 additional_info, unsigned int num, 5156 void **data, unsigned int *size) 5157 { 5158 struct smb_rqst rqst; 5159 struct smb2_set_info_rsp *rsp = NULL; 5160 struct kvec *iov; 5161 struct kvec rsp_iov; 5162 int rc = 0; 5163 int resp_buftype; 5164 struct cifs_ses *ses = tcon->ses; 5165 struct TCP_Server_Info *server = cifs_pick_channel(ses); 5166 int flags = 0; 5167 5168 if (!ses || !server) 5169 return -EIO; 5170 5171 if (!num) 5172 return -EINVAL; 5173 5174 if (smb3_encryption_required(tcon)) 5175 flags |= CIFS_TRANSFORM_REQ; 5176 5177 iov = kmalloc_array(num, sizeof(struct kvec), GFP_KERNEL); 5178 if (!iov) 5179 return -ENOMEM; 5180 5181 memset(&rqst, 0, sizeof(struct smb_rqst)); 5182 rqst.rq_iov = iov; 5183 rqst.rq_nvec = num; 5184 5185 rc = SMB2_set_info_init(tcon, server, 5186 &rqst, persistent_fid, volatile_fid, pid, 5187 info_class, info_type, additional_info, 5188 data, size); 5189 if (rc) { 5190 kfree(iov); 5191 return rc; 5192 } 5193 5194 5195 rc = cifs_send_recv(xid, ses, server, 5196 &rqst, &resp_buftype, flags, 5197 &rsp_iov); 5198 SMB2_set_info_free(&rqst); 5199 rsp = (struct smb2_set_info_rsp *)rsp_iov.iov_base; 5200 5201 if (rc != 0) { 5202 cifs_stats_fail_inc(tcon, SMB2_SET_INFO_HE); 5203 trace_smb3_set_info_err(xid, persistent_fid, tcon->tid, 5204 ses->Suid, info_class, (__u32)info_type, rc); 5205 } 5206 5207 free_rsp_buf(resp_buftype, rsp); 5208 kfree(iov); 5209 return rc; 5210 } 5211 5212 int 5213 SMB2_set_eof(const unsigned int xid, struct cifs_tcon *tcon, u64 persistent_fid, 5214 u64 volatile_fid, u32 pid, __le64 *eof) 5215 { 5216 struct smb2_file_eof_info info; 5217 void *data; 5218 unsigned int size; 5219 5220 info.EndOfFile = *eof; 5221 5222 data = &info; 5223 size = sizeof(struct smb2_file_eof_info); 5224 5225 trace_smb3_set_eof(xid, persistent_fid, tcon->tid, tcon->ses->Suid, le64_to_cpu(*eof)); 5226 5227 return send_set_info(xid, tcon, persistent_fid, volatile_fid, 5228 pid, FILE_END_OF_FILE_INFORMATION, SMB2_O_INFO_FILE, 5229 0, 1, &data, &size); 5230 } 5231 5232 int 5233 SMB2_set_acl(const unsigned int xid, struct cifs_tcon *tcon, 5234 u64 persistent_fid, u64 volatile_fid, 5235 struct cifs_ntsd *pnntsd, int pacllen, int aclflag) 5236 { 5237 return send_set_info(xid, tcon, persistent_fid, volatile_fid, 5238 current->tgid, 0, SMB2_O_INFO_SECURITY, aclflag, 5239 1, (void **)&pnntsd, &pacllen); 5240 } 5241 5242 int 5243 SMB2_set_ea(const unsigned int xid, struct cifs_tcon *tcon, 5244 u64 persistent_fid, u64 volatile_fid, 5245 struct smb2_file_full_ea_info *buf, int len) 5246 { 5247 return send_set_info(xid, tcon, persistent_fid, volatile_fid, 5248 current->tgid, FILE_FULL_EA_INFORMATION, SMB2_O_INFO_FILE, 5249 0, 1, (void **)&buf, &len); 5250 } 5251 5252 int 5253 SMB2_oplock_break(const unsigned int xid, struct cifs_tcon *tcon, 5254 const u64 persistent_fid, const u64 volatile_fid, 5255 __u8 oplock_level) 5256 { 5257 struct smb_rqst rqst; 5258 int rc; 5259 struct smb2_oplock_break *req = NULL; 5260 struct cifs_ses *ses = tcon->ses; 5261 struct TCP_Server_Info *server = cifs_pick_channel(ses); 5262 int flags = CIFS_OBREAK_OP; 5263 unsigned int total_len; 5264 struct kvec iov[1]; 5265 struct kvec rsp_iov; 5266 int resp_buf_type; 5267 5268 cifs_dbg(FYI, "SMB2_oplock_break\n"); 5269 rc = smb2_plain_req_init(SMB2_OPLOCK_BREAK, tcon, server, 5270 (void **) &req, &total_len); 5271 if (rc) 5272 return rc; 5273 5274 if (smb3_encryption_required(tcon)) 5275 flags |= CIFS_TRANSFORM_REQ; 5276 5277 req->VolatileFid = volatile_fid; 5278 req->PersistentFid = persistent_fid; 5279 req->OplockLevel = oplock_level; 5280 req->hdr.CreditRequest = cpu_to_le16(1); 5281 5282 flags |= CIFS_NO_RSP_BUF; 5283 5284 iov[0].iov_base = (char *)req; 5285 iov[0].iov_len = total_len; 5286 5287 memset(&rqst, 0, sizeof(struct smb_rqst)); 5288 rqst.rq_iov = iov; 5289 rqst.rq_nvec = 1; 5290 5291 rc = cifs_send_recv(xid, ses, server, 5292 &rqst, &resp_buf_type, flags, &rsp_iov); 5293 cifs_small_buf_release(req); 5294 5295 if (rc) { 5296 cifs_stats_fail_inc(tcon, SMB2_OPLOCK_BREAK_HE); 5297 cifs_dbg(FYI, "Send error in Oplock Break = %d\n", rc); 5298 } 5299 5300 return rc; 5301 } 5302 5303 void 5304 smb2_copy_fs_info_to_kstatfs(struct smb2_fs_full_size_info *pfs_inf, 5305 struct kstatfs *kst) 5306 { 5307 kst->f_bsize = le32_to_cpu(pfs_inf->BytesPerSector) * 5308 le32_to_cpu(pfs_inf->SectorsPerAllocationUnit); 5309 kst->f_blocks = le64_to_cpu(pfs_inf->TotalAllocationUnits); 5310 kst->f_bfree = kst->f_bavail = 5311 le64_to_cpu(pfs_inf->CallerAvailableAllocationUnits); 5312 return; 5313 } 5314 5315 static void 5316 copy_posix_fs_info_to_kstatfs(FILE_SYSTEM_POSIX_INFO *response_data, 5317 struct kstatfs *kst) 5318 { 5319 kst->f_bsize = le32_to_cpu(response_data->BlockSize); 5320 kst->f_blocks = le64_to_cpu(response_data->TotalBlocks); 5321 kst->f_bfree = le64_to_cpu(response_data->BlocksAvail); 5322 if (response_data->UserBlocksAvail == cpu_to_le64(-1)) 5323 kst->f_bavail = kst->f_bfree; 5324 else 5325 kst->f_bavail = le64_to_cpu(response_data->UserBlocksAvail); 5326 if (response_data->TotalFileNodes != cpu_to_le64(-1)) 5327 kst->f_files = le64_to_cpu(response_data->TotalFileNodes); 5328 if (response_data->FreeFileNodes != cpu_to_le64(-1)) 5329 kst->f_ffree = le64_to_cpu(response_data->FreeFileNodes); 5330 5331 return; 5332 } 5333 5334 static int 5335 build_qfs_info_req(struct kvec *iov, struct cifs_tcon *tcon, 5336 struct TCP_Server_Info *server, 5337 int level, int outbuf_len, u64 persistent_fid, 5338 u64 volatile_fid) 5339 { 5340 int rc; 5341 struct smb2_query_info_req *req; 5342 unsigned int total_len; 5343 5344 cifs_dbg(FYI, "Query FSInfo level %d\n", level); 5345 5346 if ((tcon->ses == NULL) || server == NULL) 5347 return -EIO; 5348 5349 rc = smb2_plain_req_init(SMB2_QUERY_INFO, tcon, server, 5350 (void **) &req, &total_len); 5351 if (rc) 5352 return rc; 5353 5354 req->InfoType = SMB2_O_INFO_FILESYSTEM; 5355 req->FileInfoClass = level; 5356 req->PersistentFileId = persistent_fid; 5357 req->VolatileFileId = volatile_fid; 5358 /* 1 for pad */ 5359 req->InputBufferOffset = 5360 cpu_to_le16(sizeof(struct smb2_query_info_req)); 5361 req->OutputBufferLength = cpu_to_le32( 5362 outbuf_len + sizeof(struct smb2_query_info_rsp)); 5363 5364 iov->iov_base = (char *)req; 5365 iov->iov_len = total_len; 5366 return 0; 5367 } 5368 5369 int 5370 SMB311_posix_qfs_info(const unsigned int xid, struct cifs_tcon *tcon, 5371 u64 persistent_fid, u64 volatile_fid, struct kstatfs *fsdata) 5372 { 5373 struct smb_rqst rqst; 5374 struct smb2_query_info_rsp *rsp = NULL; 5375 struct kvec iov; 5376 struct kvec rsp_iov; 5377 int rc = 0; 5378 int resp_buftype; 5379 struct cifs_ses *ses = tcon->ses; 5380 struct TCP_Server_Info *server = cifs_pick_channel(ses); 5381 FILE_SYSTEM_POSIX_INFO *info = NULL; 5382 int flags = 0; 5383 5384 rc = build_qfs_info_req(&iov, tcon, server, 5385 FS_POSIX_INFORMATION, 5386 sizeof(FILE_SYSTEM_POSIX_INFO), 5387 persistent_fid, volatile_fid); 5388 if (rc) 5389 return rc; 5390 5391 if (smb3_encryption_required(tcon)) 5392 flags |= CIFS_TRANSFORM_REQ; 5393 5394 memset(&rqst, 0, sizeof(struct smb_rqst)); 5395 rqst.rq_iov = &iov; 5396 rqst.rq_nvec = 1; 5397 5398 rc = cifs_send_recv(xid, ses, server, 5399 &rqst, &resp_buftype, flags, &rsp_iov); 5400 cifs_small_buf_release(iov.iov_base); 5401 if (rc) { 5402 cifs_stats_fail_inc(tcon, SMB2_QUERY_INFO_HE); 5403 goto posix_qfsinf_exit; 5404 } 5405 rsp = (struct smb2_query_info_rsp *)rsp_iov.iov_base; 5406 5407 info = (FILE_SYSTEM_POSIX_INFO *)( 5408 le16_to_cpu(rsp->OutputBufferOffset) + (char *)rsp); 5409 rc = smb2_validate_iov(le16_to_cpu(rsp->OutputBufferOffset), 5410 le32_to_cpu(rsp->OutputBufferLength), &rsp_iov, 5411 sizeof(FILE_SYSTEM_POSIX_INFO)); 5412 if (!rc) 5413 copy_posix_fs_info_to_kstatfs(info, fsdata); 5414 5415 posix_qfsinf_exit: 5416 free_rsp_buf(resp_buftype, rsp_iov.iov_base); 5417 return rc; 5418 } 5419 5420 int 5421 SMB2_QFS_info(const unsigned int xid, struct cifs_tcon *tcon, 5422 u64 persistent_fid, u64 volatile_fid, struct kstatfs *fsdata) 5423 { 5424 struct smb_rqst rqst; 5425 struct smb2_query_info_rsp *rsp = NULL; 5426 struct kvec iov; 5427 struct kvec rsp_iov; 5428 int rc = 0; 5429 int resp_buftype; 5430 struct cifs_ses *ses = tcon->ses; 5431 struct TCP_Server_Info *server = cifs_pick_channel(ses); 5432 struct smb2_fs_full_size_info *info = NULL; 5433 int flags = 0; 5434 5435 rc = build_qfs_info_req(&iov, tcon, server, 5436 FS_FULL_SIZE_INFORMATION, 5437 sizeof(struct smb2_fs_full_size_info), 5438 persistent_fid, volatile_fid); 5439 if (rc) 5440 return rc; 5441 5442 if (smb3_encryption_required(tcon)) 5443 flags |= CIFS_TRANSFORM_REQ; 5444 5445 memset(&rqst, 0, sizeof(struct smb_rqst)); 5446 rqst.rq_iov = &iov; 5447 rqst.rq_nvec = 1; 5448 5449 rc = cifs_send_recv(xid, ses, server, 5450 &rqst, &resp_buftype, flags, &rsp_iov); 5451 cifs_small_buf_release(iov.iov_base); 5452 if (rc) { 5453 cifs_stats_fail_inc(tcon, SMB2_QUERY_INFO_HE); 5454 goto qfsinf_exit; 5455 } 5456 rsp = (struct smb2_query_info_rsp *)rsp_iov.iov_base; 5457 5458 info = (struct smb2_fs_full_size_info *)( 5459 le16_to_cpu(rsp->OutputBufferOffset) + (char *)rsp); 5460 rc = smb2_validate_iov(le16_to_cpu(rsp->OutputBufferOffset), 5461 le32_to_cpu(rsp->OutputBufferLength), &rsp_iov, 5462 sizeof(struct smb2_fs_full_size_info)); 5463 if (!rc) 5464 smb2_copy_fs_info_to_kstatfs(info, fsdata); 5465 5466 qfsinf_exit: 5467 free_rsp_buf(resp_buftype, rsp_iov.iov_base); 5468 return rc; 5469 } 5470 5471 int 5472 SMB2_QFS_attr(const unsigned int xid, struct cifs_tcon *tcon, 5473 u64 persistent_fid, u64 volatile_fid, int level) 5474 { 5475 struct smb_rqst rqst; 5476 struct smb2_query_info_rsp *rsp = NULL; 5477 struct kvec iov; 5478 struct kvec rsp_iov; 5479 int rc = 0; 5480 int resp_buftype, max_len, min_len; 5481 struct cifs_ses *ses = tcon->ses; 5482 struct TCP_Server_Info *server = cifs_pick_channel(ses); 5483 unsigned int rsp_len, offset; 5484 int flags = 0; 5485 5486 if (level == FS_DEVICE_INFORMATION) { 5487 max_len = sizeof(FILE_SYSTEM_DEVICE_INFO); 5488 min_len = sizeof(FILE_SYSTEM_DEVICE_INFO); 5489 } else if (level == FS_ATTRIBUTE_INFORMATION) { 5490 max_len = sizeof(FILE_SYSTEM_ATTRIBUTE_INFO); 5491 min_len = MIN_FS_ATTR_INFO_SIZE; 5492 } else if (level == FS_SECTOR_SIZE_INFORMATION) { 5493 max_len = sizeof(struct smb3_fs_ss_info); 5494 min_len = sizeof(struct smb3_fs_ss_info); 5495 } else if (level == FS_VOLUME_INFORMATION) { 5496 max_len = sizeof(struct smb3_fs_vol_info) + MAX_VOL_LABEL_LEN; 5497 min_len = sizeof(struct smb3_fs_vol_info); 5498 } else { 5499 cifs_dbg(FYI, "Invalid qfsinfo level %d\n", level); 5500 return -EINVAL; 5501 } 5502 5503 rc = build_qfs_info_req(&iov, tcon, server, 5504 level, max_len, 5505 persistent_fid, volatile_fid); 5506 if (rc) 5507 return rc; 5508 5509 if (smb3_encryption_required(tcon)) 5510 flags |= CIFS_TRANSFORM_REQ; 5511 5512 memset(&rqst, 0, sizeof(struct smb_rqst)); 5513 rqst.rq_iov = &iov; 5514 rqst.rq_nvec = 1; 5515 5516 rc = cifs_send_recv(xid, ses, server, 5517 &rqst, &resp_buftype, flags, &rsp_iov); 5518 cifs_small_buf_release(iov.iov_base); 5519 if (rc) { 5520 cifs_stats_fail_inc(tcon, SMB2_QUERY_INFO_HE); 5521 goto qfsattr_exit; 5522 } 5523 rsp = (struct smb2_query_info_rsp *)rsp_iov.iov_base; 5524 5525 rsp_len = le32_to_cpu(rsp->OutputBufferLength); 5526 offset = le16_to_cpu(rsp->OutputBufferOffset); 5527 rc = smb2_validate_iov(offset, rsp_len, &rsp_iov, min_len); 5528 if (rc) 5529 goto qfsattr_exit; 5530 5531 if (level == FS_ATTRIBUTE_INFORMATION) 5532 memcpy(&tcon->fsAttrInfo, offset 5533 + (char *)rsp, min_t(unsigned int, 5534 rsp_len, max_len)); 5535 else if (level == FS_DEVICE_INFORMATION) 5536 memcpy(&tcon->fsDevInfo, offset 5537 + (char *)rsp, sizeof(FILE_SYSTEM_DEVICE_INFO)); 5538 else if (level == FS_SECTOR_SIZE_INFORMATION) { 5539 struct smb3_fs_ss_info *ss_info = (struct smb3_fs_ss_info *) 5540 (offset + (char *)rsp); 5541 tcon->ss_flags = le32_to_cpu(ss_info->Flags); 5542 tcon->perf_sector_size = 5543 le32_to_cpu(ss_info->PhysicalBytesPerSectorForPerf); 5544 } else if (level == FS_VOLUME_INFORMATION) { 5545 struct smb3_fs_vol_info *vol_info = (struct smb3_fs_vol_info *) 5546 (offset + (char *)rsp); 5547 tcon->vol_serial_number = vol_info->VolumeSerialNumber; 5548 tcon->vol_create_time = vol_info->VolumeCreationTime; 5549 } 5550 5551 qfsattr_exit: 5552 free_rsp_buf(resp_buftype, rsp_iov.iov_base); 5553 return rc; 5554 } 5555 5556 int 5557 smb2_lockv(const unsigned int xid, struct cifs_tcon *tcon, 5558 const __u64 persist_fid, const __u64 volatile_fid, const __u32 pid, 5559 const __u32 num_lock, struct smb2_lock_element *buf) 5560 { 5561 struct smb_rqst rqst; 5562 int rc = 0; 5563 struct smb2_lock_req *req = NULL; 5564 struct kvec iov[2]; 5565 struct kvec rsp_iov; 5566 int resp_buf_type; 5567 unsigned int count; 5568 int flags = CIFS_NO_RSP_BUF; 5569 unsigned int total_len; 5570 struct TCP_Server_Info *server = cifs_pick_channel(tcon->ses); 5571 5572 cifs_dbg(FYI, "smb2_lockv num lock %d\n", num_lock); 5573 5574 rc = smb2_plain_req_init(SMB2_LOCK, tcon, server, 5575 (void **) &req, &total_len); 5576 if (rc) 5577 return rc; 5578 5579 if (smb3_encryption_required(tcon)) 5580 flags |= CIFS_TRANSFORM_REQ; 5581 5582 req->hdr.Id.SyncId.ProcessId = cpu_to_le32(pid); 5583 req->LockCount = cpu_to_le16(num_lock); 5584 5585 req->PersistentFileId = persist_fid; 5586 req->VolatileFileId = volatile_fid; 5587 5588 count = num_lock * sizeof(struct smb2_lock_element); 5589 5590 iov[0].iov_base = (char *)req; 5591 iov[0].iov_len = total_len - sizeof(struct smb2_lock_element); 5592 iov[1].iov_base = (char *)buf; 5593 iov[1].iov_len = count; 5594 5595 cifs_stats_inc(&tcon->stats.cifs_stats.num_locks); 5596 5597 memset(&rqst, 0, sizeof(struct smb_rqst)); 5598 rqst.rq_iov = iov; 5599 rqst.rq_nvec = 2; 5600 5601 rc = cifs_send_recv(xid, tcon->ses, server, 5602 &rqst, &resp_buf_type, flags, 5603 &rsp_iov); 5604 cifs_small_buf_release(req); 5605 if (rc) { 5606 cifs_dbg(FYI, "Send error in smb2_lockv = %d\n", rc); 5607 cifs_stats_fail_inc(tcon, SMB2_LOCK_HE); 5608 trace_smb3_lock_err(xid, persist_fid, tcon->tid, 5609 tcon->ses->Suid, rc); 5610 } 5611 5612 return rc; 5613 } 5614 5615 int 5616 SMB2_lock(const unsigned int xid, struct cifs_tcon *tcon, 5617 const __u64 persist_fid, const __u64 volatile_fid, const __u32 pid, 5618 const __u64 length, const __u64 offset, const __u32 lock_flags, 5619 const bool wait) 5620 { 5621 struct smb2_lock_element lock; 5622 5623 lock.Offset = cpu_to_le64(offset); 5624 lock.Length = cpu_to_le64(length); 5625 lock.Flags = cpu_to_le32(lock_flags); 5626 if (!wait && lock_flags != SMB2_LOCKFLAG_UNLOCK) 5627 lock.Flags |= cpu_to_le32(SMB2_LOCKFLAG_FAIL_IMMEDIATELY); 5628 5629 return smb2_lockv(xid, tcon, persist_fid, volatile_fid, pid, 1, &lock); 5630 } 5631 5632 int 5633 SMB2_lease_break(const unsigned int xid, struct cifs_tcon *tcon, 5634 __u8 *lease_key, const __le32 lease_state) 5635 { 5636 struct smb_rqst rqst; 5637 int rc; 5638 struct smb2_lease_ack *req = NULL; 5639 struct cifs_ses *ses = tcon->ses; 5640 int flags = CIFS_OBREAK_OP; 5641 unsigned int total_len; 5642 struct kvec iov[1]; 5643 struct kvec rsp_iov; 5644 int resp_buf_type; 5645 __u64 *please_key_high; 5646 __u64 *please_key_low; 5647 struct TCP_Server_Info *server = cifs_pick_channel(tcon->ses); 5648 5649 cifs_dbg(FYI, "SMB2_lease_break\n"); 5650 rc = smb2_plain_req_init(SMB2_OPLOCK_BREAK, tcon, server, 5651 (void **) &req, &total_len); 5652 if (rc) 5653 return rc; 5654 5655 if (smb3_encryption_required(tcon)) 5656 flags |= CIFS_TRANSFORM_REQ; 5657 5658 req->hdr.CreditRequest = cpu_to_le16(1); 5659 req->StructureSize = cpu_to_le16(36); 5660 total_len += 12; 5661 5662 memcpy(req->LeaseKey, lease_key, 16); 5663 req->LeaseState = lease_state; 5664 5665 flags |= CIFS_NO_RSP_BUF; 5666 5667 iov[0].iov_base = (char *)req; 5668 iov[0].iov_len = total_len; 5669 5670 memset(&rqst, 0, sizeof(struct smb_rqst)); 5671 rqst.rq_iov = iov; 5672 rqst.rq_nvec = 1; 5673 5674 rc = cifs_send_recv(xid, ses, server, 5675 &rqst, &resp_buf_type, flags, &rsp_iov); 5676 cifs_small_buf_release(req); 5677 5678 please_key_low = (__u64 *)lease_key; 5679 please_key_high = (__u64 *)(lease_key+8); 5680 if (rc) { 5681 cifs_stats_fail_inc(tcon, SMB2_OPLOCK_BREAK_HE); 5682 trace_smb3_lease_err(le32_to_cpu(lease_state), tcon->tid, 5683 ses->Suid, *please_key_low, *please_key_high, rc); 5684 cifs_dbg(FYI, "Send error in Lease Break = %d\n", rc); 5685 } else 5686 trace_smb3_lease_done(le32_to_cpu(lease_state), tcon->tid, 5687 ses->Suid, *please_key_low, *please_key_high); 5688 5689 return rc; 5690 } 5691