1 // SPDX-License-Identifier: LGPL-2.1 2 /* 3 * 4 * Copyright (C) International Business Machines Corp., 2009, 2013 5 * Etersoft, 2012 6 * Author(s): Steve French (sfrench@us.ibm.com) 7 * Pavel Shilovsky (pshilovsky@samba.org) 2012 8 * 9 * Contains the routines for constructing the SMB2 PDUs themselves 10 * 11 */ 12 13 /* SMB2 PDU handling routines here - except for leftovers (eg session setup) */ 14 /* Note that there are handle based routines which must be */ 15 /* treated slightly differently for reconnection purposes since we never */ 16 /* want to reuse a stale file handle and only the caller knows the file info */ 17 18 #include <linux/fs.h> 19 #include <linux/kernel.h> 20 #include <linux/vfs.h> 21 #include <linux/task_io_accounting_ops.h> 22 #include <linux/uaccess.h> 23 #include <linux/uuid.h> 24 #include <linux/pagemap.h> 25 #include <linux/xattr.h> 26 #include <linux/netfs.h> 27 #include <trace/events/netfs.h> 28 #include "cifsglob.h" 29 #include "cifsacl.h" 30 #include "cifsproto.h" 31 #include "smb2proto.h" 32 #include "cifs_unicode.h" 33 #include "cifs_debug.h" 34 #include "ntlmssp.h" 35 #include "../common/smb2status.h" 36 #include "smb2glob.h" 37 #include "cifspdu.h" 38 #include "cifs_spnego.h" 39 #include "smbdirect.h" 40 #include "trace.h" 41 #ifdef CONFIG_CIFS_DFS_UPCALL 42 #include "dfs_cache.h" 43 #endif 44 #include "cached_dir.h" 45 #include "compress.h" 46 #include "fs_context.h" 47 48 /* 49 * The following table defines the expected "StructureSize" of SMB2 requests 50 * in order by SMB2 command. This is similar to "wct" in SMB/CIFS requests. 51 * 52 * Note that commands are defined in smb2pdu.h in le16 but the array below is 53 * indexed by command in host byte order. 54 */ 55 static const int smb2_req_struct_sizes[NUMBER_OF_SMB2_COMMANDS] = { 56 /* SMB2_NEGOTIATE */ 36, 57 /* SMB2_SESSION_SETUP */ 25, 58 /* SMB2_LOGOFF */ 4, 59 /* SMB2_TREE_CONNECT */ 9, 60 /* SMB2_TREE_DISCONNECT */ 4, 61 /* SMB2_CREATE */ 57, 62 /* SMB2_CLOSE */ 24, 63 /* SMB2_FLUSH */ 24, 64 /* SMB2_READ */ 49, 65 /* SMB2_WRITE */ 49, 66 /* SMB2_LOCK */ 48, 67 /* SMB2_IOCTL */ 57, 68 /* SMB2_CANCEL */ 4, 69 /* SMB2_ECHO */ 4, 70 /* SMB2_QUERY_DIRECTORY */ 33, 71 /* SMB2_CHANGE_NOTIFY */ 32, 72 /* SMB2_QUERY_INFO */ 41, 73 /* SMB2_SET_INFO */ 33, 74 /* SMB2_OPLOCK_BREAK */ 24 /* BB this is 36 for LEASE_BREAK variant */ 75 }; 76 77 int smb3_encryption_required(const struct cifs_tcon *tcon) 78 { 79 if (!tcon || !tcon->ses) 80 return 0; 81 if ((tcon->ses->session_flags & SMB2_SESSION_FLAG_ENCRYPT_DATA) || 82 (tcon->share_flags & SHI1005_FLAGS_ENCRYPT_DATA)) 83 return 1; 84 if (tcon->seal && 85 (tcon->ses->server->capabilities & SMB2_GLOBAL_CAP_ENCRYPTION)) 86 return 1; 87 if (((global_secflags & CIFSSEC_MUST_SEAL) == CIFSSEC_MUST_SEAL) && 88 (tcon->ses->server->capabilities & SMB2_GLOBAL_CAP_ENCRYPTION)) 89 return 1; 90 return 0; 91 } 92 93 static void 94 smb2_hdr_assemble(struct smb2_hdr *shdr, __le16 smb2_cmd, 95 const struct cifs_tcon *tcon, 96 struct TCP_Server_Info *server) 97 { 98 struct smb3_hdr_req *smb3_hdr; 99 100 shdr->ProtocolId = SMB2_PROTO_NUMBER; 101 shdr->StructureSize = cpu_to_le16(64); 102 shdr->Command = smb2_cmd; 103 104 if (server) { 105 /* After reconnect SMB3 must set ChannelSequence on subsequent reqs */ 106 if (server->dialect >= SMB30_PROT_ID) { 107 smb3_hdr = (struct smb3_hdr_req *)shdr; 108 /* 109 * if primary channel is not set yet, use default 110 * channel for chan sequence num 111 */ 112 if (SERVER_IS_CHAN(server)) 113 smb3_hdr->ChannelSequence = 114 cpu_to_le16(server->primary_server->channel_sequence_num); 115 else 116 smb3_hdr->ChannelSequence = 117 cpu_to_le16(server->channel_sequence_num); 118 } 119 spin_lock(&server->req_lock); 120 /* Request up to 10 credits but don't go over the limit. */ 121 if (server->credits >= server->max_credits) 122 shdr->CreditRequest = cpu_to_le16(0); 123 else 124 shdr->CreditRequest = cpu_to_le16( 125 min_t(int, server->max_credits - 126 server->credits, 10)); 127 spin_unlock(&server->req_lock); 128 } else { 129 shdr->CreditRequest = cpu_to_le16(2); 130 } 131 shdr->Id.SyncId.ProcessId = cpu_to_le32((__u16)current->tgid); 132 133 if (!tcon) 134 goto out; 135 136 /* GLOBAL_CAP_LARGE_MTU will only be set if dialect > SMB2.02 */ 137 /* See sections 2.2.4 and 3.2.4.1.5 of MS-SMB2 */ 138 if (server && (server->capabilities & SMB2_GLOBAL_CAP_LARGE_MTU)) 139 shdr->CreditCharge = cpu_to_le16(1); 140 /* else CreditCharge MBZ */ 141 142 shdr->Id.SyncId.TreeId = cpu_to_le32(tcon->tid); 143 /* Uid is not converted */ 144 if (tcon->ses) 145 shdr->SessionId = cpu_to_le64(tcon->ses->Suid); 146 147 /* 148 * If we would set SMB2_FLAGS_DFS_OPERATIONS on open we also would have 149 * to pass the path on the Open SMB prefixed by \\server\share. 150 * Not sure when we would need to do the augmented path (if ever) and 151 * setting this flag breaks the SMB2 open operation since it is 152 * illegal to send an empty path name (without \\server\share prefix) 153 * when the DFS flag is set in the SMB open header. We could 154 * consider setting the flag on all operations other than open 155 * but it is safer to net set it for now. 156 */ 157 /* if (tcon->share_flags & SHI1005_FLAGS_DFS) 158 shdr->Flags |= SMB2_FLAGS_DFS_OPERATIONS; */ 159 160 if (server && server->sign && !smb3_encryption_required(tcon)) 161 shdr->Flags |= SMB2_FLAGS_SIGNED; 162 out: 163 return; 164 } 165 166 /* helper function for code reuse */ 167 static int 168 cifs_chan_skip_or_disable(struct cifs_ses *ses, 169 struct TCP_Server_Info *server, 170 bool from_reconnect) 171 { 172 struct TCP_Server_Info *pserver; 173 unsigned int chan_index; 174 175 if (SERVER_IS_CHAN(server)) { 176 cifs_dbg(VFS, 177 "server %s does not support multichannel anymore. Skip secondary channel\n", 178 ses->server->hostname); 179 180 spin_lock(&ses->chan_lock); 181 chan_index = cifs_ses_get_chan_index(ses, server); 182 if (chan_index == CIFS_INVAL_CHAN_INDEX) { 183 spin_unlock(&ses->chan_lock); 184 goto skip_terminate; 185 } 186 187 ses->chans[chan_index].server = NULL; 188 server->terminate = true; 189 spin_unlock(&ses->chan_lock); 190 191 /* 192 * the above reference of server by channel 193 * needs to be dropped without holding chan_lock 194 * as cifs_put_tcp_session takes a higher lock 195 * i.e. cifs_tcp_ses_lock 196 */ 197 cifs_put_tcp_session(server, from_reconnect); 198 199 cifs_signal_cifsd_for_reconnect(server, false); 200 201 /* mark primary server as needing reconnect */ 202 pserver = server->primary_server; 203 cifs_signal_cifsd_for_reconnect(pserver, false); 204 skip_terminate: 205 return -EHOSTDOWN; 206 } 207 208 cifs_server_dbg(VFS, 209 "server does not support multichannel anymore. Disable all other channels\n"); 210 cifs_disable_secondary_channels(ses); 211 212 213 return 0; 214 } 215 216 static int 217 smb2_reconnect(__le16 smb2_command, struct cifs_tcon *tcon, 218 struct TCP_Server_Info *server, bool from_reconnect) 219 { 220 struct cifs_ses *ses; 221 int xid; 222 int rc = 0; 223 224 /* 225 * SMB2s NegProt, SessSetup, Logoff do not have tcon yet so 226 * check for tcp and smb session status done differently 227 * for those three - in the calling routine. 228 */ 229 if (tcon == NULL) 230 return 0; 231 232 if (smb2_command == SMB2_TREE_CONNECT) 233 return 0; 234 235 spin_lock(&tcon->tc_lock); 236 if (tcon->status == TID_EXITING) { 237 /* 238 * only tree disconnect allowed when disconnecting ... 239 */ 240 if (smb2_command != SMB2_TREE_DISCONNECT) { 241 spin_unlock(&tcon->tc_lock); 242 cifs_dbg(FYI, "can not send cmd %d while umounting\n", 243 smb2_command); 244 return -ENODEV; 245 } 246 } 247 spin_unlock(&tcon->tc_lock); 248 249 ses = tcon->ses; 250 if (!ses) 251 return -EIO; 252 spin_lock(&ses->ses_lock); 253 if (ses->ses_status == SES_EXITING) { 254 spin_unlock(&ses->ses_lock); 255 return -EIO; 256 } 257 spin_unlock(&ses->ses_lock); 258 if (!ses->server || !server) 259 return -EIO; 260 261 spin_lock(&server->srv_lock); 262 if (server->tcpStatus == CifsNeedReconnect) { 263 /* 264 * Return to caller for TREE_DISCONNECT and LOGOFF and CLOSE 265 * here since they are implicitly done when session drops. 266 */ 267 switch (smb2_command) { 268 /* 269 * BB Should we keep oplock break and add flush to exceptions? 270 */ 271 case SMB2_TREE_DISCONNECT: 272 case SMB2_CANCEL: 273 case SMB2_CLOSE: 274 case SMB2_OPLOCK_BREAK: 275 spin_unlock(&server->srv_lock); 276 return -EAGAIN; 277 } 278 } 279 280 /* if server is marked for termination, cifsd will cleanup */ 281 if (server->terminate) { 282 spin_unlock(&server->srv_lock); 283 return -EHOSTDOWN; 284 } 285 spin_unlock(&server->srv_lock); 286 287 again: 288 rc = cifs_wait_for_server_reconnect(server, tcon->retry); 289 if (rc) 290 return rc; 291 292 spin_lock(&ses->chan_lock); 293 if (!cifs_chan_needs_reconnect(ses, server) && !tcon->need_reconnect) { 294 spin_unlock(&ses->chan_lock); 295 return 0; 296 } 297 spin_unlock(&ses->chan_lock); 298 cifs_dbg(FYI, "sess reconnect mask: 0x%lx, tcon reconnect: %d", 299 tcon->ses->chans_need_reconnect, 300 tcon->need_reconnect); 301 302 mutex_lock(&ses->session_mutex); 303 /* 304 * Handle the case where a concurrent thread failed to negotiate or 305 * killed a channel. 306 */ 307 spin_lock(&server->srv_lock); 308 switch (server->tcpStatus) { 309 case CifsExiting: 310 spin_unlock(&server->srv_lock); 311 mutex_unlock(&ses->session_mutex); 312 return -EHOSTDOWN; 313 case CifsNeedReconnect: 314 spin_unlock(&server->srv_lock); 315 mutex_unlock(&ses->session_mutex); 316 if (!tcon->retry) 317 return -EHOSTDOWN; 318 goto again; 319 default: 320 break; 321 } 322 spin_unlock(&server->srv_lock); 323 324 /* 325 * need to prevent multiple threads trying to simultaneously 326 * reconnect the same SMB session 327 */ 328 spin_lock(&ses->ses_lock); 329 spin_lock(&ses->chan_lock); 330 if (!cifs_chan_needs_reconnect(ses, server) && 331 ses->ses_status == SES_GOOD) { 332 spin_unlock(&ses->chan_lock); 333 spin_unlock(&ses->ses_lock); 334 /* this means that we only need to tree connect */ 335 if (tcon->need_reconnect) 336 goto skip_sess_setup; 337 338 mutex_unlock(&ses->session_mutex); 339 goto out; 340 } 341 spin_unlock(&ses->chan_lock); 342 spin_unlock(&ses->ses_lock); 343 344 rc = cifs_negotiate_protocol(0, ses, server); 345 if (rc) { 346 mutex_unlock(&ses->session_mutex); 347 if (!tcon->retry) 348 return -EHOSTDOWN; 349 goto again; 350 } 351 /* 352 * if server stopped supporting multichannel 353 * and the first channel reconnected, disable all the others. 354 */ 355 if (ses->chan_count > 1 && 356 !(server->capabilities & SMB2_GLOBAL_CAP_MULTI_CHANNEL)) { 357 rc = cifs_chan_skip_or_disable(ses, server, 358 from_reconnect); 359 if (rc) { 360 mutex_unlock(&ses->session_mutex); 361 goto out; 362 } 363 } 364 365 rc = cifs_setup_session(0, ses, server, ses->local_nls); 366 if ((rc == -EACCES) || (rc == -EKEYEXPIRED) || (rc == -EKEYREVOKED)) { 367 /* 368 * Try alternate password for next reconnect (key rotation 369 * could be enabled on the server e.g.) if an alternate 370 * password is available and the current password is expired, 371 * but do not swap on non pwd related errors like host down 372 */ 373 if (ses->password2) 374 swap(ses->password2, ses->password); 375 } 376 if (rc) { 377 mutex_unlock(&ses->session_mutex); 378 if (rc == -EACCES && !tcon->retry) 379 return -EHOSTDOWN; 380 goto out; 381 } 382 383 skip_sess_setup: 384 if (!tcon->need_reconnect) { 385 mutex_unlock(&ses->session_mutex); 386 goto out; 387 } 388 cifs_mark_open_files_invalid(tcon); 389 if (tcon->use_persistent) 390 tcon->need_reopen_files = true; 391 392 rc = cifs_tree_connect(0, tcon); 393 394 cifs_dbg(FYI, "reconnect tcon rc = %d\n", rc); 395 if (rc) { 396 /* If sess reconnected but tcon didn't, something strange ... */ 397 mutex_unlock(&ses->session_mutex); 398 cifs_dbg(VFS, "reconnect tcon failed rc = %d\n", rc); 399 goto out; 400 } 401 402 spin_lock(&ses->ses_lock); 403 if (ses->flags & CIFS_SES_FLAG_SCALE_CHANNELS) { 404 spin_unlock(&ses->ses_lock); 405 mutex_unlock(&ses->session_mutex); 406 goto skip_add_channels; 407 } 408 ses->flags |= CIFS_SES_FLAG_SCALE_CHANNELS; 409 spin_unlock(&ses->ses_lock); 410 411 if (!rc && 412 (server->capabilities & SMB2_GLOBAL_CAP_MULTI_CHANNEL) && 413 server->ops->query_server_interfaces) { 414 mutex_unlock(&ses->session_mutex); 415 416 /* 417 * query server network interfaces, in case they change 418 */ 419 xid = get_xid(); 420 rc = server->ops->query_server_interfaces(xid, tcon, false); 421 free_xid(xid); 422 423 if (rc == -EOPNOTSUPP && ses->chan_count > 1) { 424 /* 425 * some servers like Azure SMB server do not advertise 426 * that multichannel has been disabled with server 427 * capabilities, rather return STATUS_NOT_IMPLEMENTED. 428 * treat this as server not supporting multichannel 429 */ 430 431 rc = cifs_chan_skip_or_disable(ses, server, 432 from_reconnect); 433 goto skip_add_channels; 434 } else if (rc) 435 cifs_dbg(FYI, "%s: failed to query server interfaces: %d\n", 436 __func__, rc); 437 438 if (ses->chan_max > ses->chan_count && 439 ses->iface_count && 440 !SERVER_IS_CHAN(server)) { 441 if (ses->chan_count == 1) { 442 cifs_server_dbg(VFS, "supports multichannel now\n"); 443 queue_delayed_work(cifsiod_wq, &tcon->query_interfaces, 444 (SMB_INTERFACE_POLL_INTERVAL * HZ)); 445 } 446 447 cifs_try_adding_channels(ses); 448 } 449 } else { 450 mutex_unlock(&ses->session_mutex); 451 } 452 453 skip_add_channels: 454 spin_lock(&ses->ses_lock); 455 ses->flags &= ~CIFS_SES_FLAG_SCALE_CHANNELS; 456 spin_unlock(&ses->ses_lock); 457 458 if (smb2_command != SMB2_INTERNAL_CMD) 459 mod_delayed_work(cifsiod_wq, &server->reconnect, 0); 460 461 atomic_inc(&tconInfoReconnectCount); 462 out: 463 /* 464 * Check if handle based operation so we know whether we can continue 465 * or not without returning to caller to reset file handle. 466 */ 467 /* 468 * BB Is flush done by server on drop of tcp session? Should we special 469 * case it and skip above? 470 */ 471 switch (smb2_command) { 472 case SMB2_FLUSH: 473 case SMB2_READ: 474 case SMB2_WRITE: 475 case SMB2_LOCK: 476 case SMB2_QUERY_DIRECTORY: 477 case SMB2_CHANGE_NOTIFY: 478 case SMB2_QUERY_INFO: 479 case SMB2_SET_INFO: 480 case SMB2_IOCTL: 481 rc = -EAGAIN; 482 } 483 return rc; 484 } 485 486 static void 487 fill_small_buf(__le16 smb2_command, struct cifs_tcon *tcon, 488 struct TCP_Server_Info *server, 489 void *buf, 490 unsigned int *total_len) 491 { 492 struct smb2_pdu *spdu = buf; 493 /* lookup word count ie StructureSize from table */ 494 __u16 parmsize = smb2_req_struct_sizes[le16_to_cpu(smb2_command)]; 495 496 /* 497 * smaller than SMALL_BUFFER_SIZE but bigger than fixed area of 498 * largest operations (Create) 499 */ 500 memset(buf, 0, 256); 501 502 smb2_hdr_assemble(&spdu->hdr, smb2_command, tcon, server); 503 spdu->StructureSize2 = cpu_to_le16(parmsize); 504 505 *total_len = parmsize + sizeof(struct smb2_hdr); 506 } 507 508 /* 509 * Allocate and return pointer to an SMB request hdr, and set basic 510 * SMB information in the SMB header. If the return code is zero, this 511 * function must have filled in request_buf pointer. 512 */ 513 static int __smb2_plain_req_init(__le16 smb2_command, struct cifs_tcon *tcon, 514 struct TCP_Server_Info *server, 515 void **request_buf, unsigned int *total_len) 516 { 517 /* BB eventually switch this to SMB2 specific small buf size */ 518 switch (smb2_command) { 519 case SMB2_SET_INFO: 520 case SMB2_QUERY_INFO: 521 *request_buf = cifs_buf_get(); 522 break; 523 default: 524 *request_buf = cifs_small_buf_get(); 525 break; 526 } 527 if (*request_buf == NULL) { 528 /* BB should we add a retry in here if not a writepage? */ 529 return -ENOMEM; 530 } 531 532 fill_small_buf(smb2_command, tcon, server, 533 (struct smb2_hdr *)(*request_buf), 534 total_len); 535 536 if (tcon != NULL) { 537 uint16_t com_code = le16_to_cpu(smb2_command); 538 cifs_stats_inc(&tcon->stats.smb2_stats.smb2_com_sent[com_code]); 539 cifs_stats_inc(&tcon->num_smbs_sent); 540 } 541 542 return 0; 543 } 544 545 static int smb2_plain_req_init(__le16 smb2_command, struct cifs_tcon *tcon, 546 struct TCP_Server_Info *server, 547 void **request_buf, unsigned int *total_len) 548 { 549 int rc; 550 551 rc = smb2_reconnect(smb2_command, tcon, server, false); 552 if (rc) 553 return rc; 554 555 return __smb2_plain_req_init(smb2_command, tcon, server, request_buf, 556 total_len); 557 } 558 559 static int smb2_ioctl_req_init(u32 opcode, struct cifs_tcon *tcon, 560 struct TCP_Server_Info *server, 561 void **request_buf, unsigned int *total_len) 562 { 563 /* Skip reconnect only for FSCTL_VALIDATE_NEGOTIATE_INFO IOCTLs */ 564 if (opcode == FSCTL_VALIDATE_NEGOTIATE_INFO) { 565 return __smb2_plain_req_init(SMB2_IOCTL, tcon, server, 566 request_buf, total_len); 567 } 568 return smb2_plain_req_init(SMB2_IOCTL, tcon, server, 569 request_buf, total_len); 570 } 571 572 /* For explanation of negotiate contexts see MS-SMB2 section 2.2.3.1 */ 573 574 static void 575 build_preauth_ctxt(struct smb2_preauth_neg_context *pneg_ctxt) 576 { 577 pneg_ctxt->ContextType = SMB2_PREAUTH_INTEGRITY_CAPABILITIES; 578 pneg_ctxt->DataLength = cpu_to_le16(38); 579 pneg_ctxt->HashAlgorithmCount = cpu_to_le16(1); 580 pneg_ctxt->SaltLength = cpu_to_le16(SMB311_SALT_SIZE); 581 get_random_bytes(pneg_ctxt->Salt, SMB311_SALT_SIZE); 582 pneg_ctxt->HashAlgorithms = SMB2_PREAUTH_INTEGRITY_SHA512; 583 } 584 585 static void 586 build_compression_ctxt(struct smb2_compression_capabilities_context *pneg_ctxt) 587 { 588 pneg_ctxt->ContextType = SMB2_COMPRESSION_CAPABILITIES; 589 pneg_ctxt->DataLength = 590 cpu_to_le16(sizeof(struct smb2_compression_capabilities_context) 591 - sizeof(struct smb2_neg_context)); 592 pneg_ctxt->CompressionAlgorithmCount = cpu_to_le16(3); 593 pneg_ctxt->CompressionAlgorithms[0] = SMB3_COMPRESS_LZ77; 594 pneg_ctxt->CompressionAlgorithms[1] = SMB3_COMPRESS_LZ77_HUFF; 595 pneg_ctxt->CompressionAlgorithms[2] = SMB3_COMPRESS_LZNT1; 596 } 597 598 static unsigned int 599 build_signing_ctxt(struct smb2_signing_capabilities *pneg_ctxt) 600 { 601 unsigned int ctxt_len = sizeof(struct smb2_signing_capabilities); 602 unsigned short num_algs = 1; /* number of signing algorithms sent */ 603 604 pneg_ctxt->ContextType = SMB2_SIGNING_CAPABILITIES; 605 /* 606 * Context Data length must be rounded to multiple of 8 for some servers 607 */ 608 pneg_ctxt->DataLength = cpu_to_le16(ALIGN(sizeof(struct smb2_signing_capabilities) - 609 sizeof(struct smb2_neg_context) + 610 (num_algs * sizeof(u16)), 8)); 611 pneg_ctxt->SigningAlgorithmCount = cpu_to_le16(num_algs); 612 pneg_ctxt->SigningAlgorithms[0] = cpu_to_le16(SIGNING_ALG_AES_CMAC); 613 614 ctxt_len += sizeof(__le16) * num_algs; 615 ctxt_len = ALIGN(ctxt_len, 8); 616 return ctxt_len; 617 /* TBD add SIGNING_ALG_AES_GMAC and/or SIGNING_ALG_HMAC_SHA256 */ 618 } 619 620 static void 621 build_encrypt_ctxt(struct smb2_encryption_neg_context *pneg_ctxt) 622 { 623 pneg_ctxt->ContextType = SMB2_ENCRYPTION_CAPABILITIES; 624 if (require_gcm_256) { 625 pneg_ctxt->DataLength = cpu_to_le16(4); /* Cipher Count + 1 cipher */ 626 pneg_ctxt->CipherCount = cpu_to_le16(1); 627 pneg_ctxt->Ciphers[0] = SMB2_ENCRYPTION_AES256_GCM; 628 } else if (enable_gcm_256) { 629 pneg_ctxt->DataLength = cpu_to_le16(8); /* Cipher Count + 3 ciphers */ 630 pneg_ctxt->CipherCount = cpu_to_le16(3); 631 pneg_ctxt->Ciphers[0] = SMB2_ENCRYPTION_AES128_GCM; 632 pneg_ctxt->Ciphers[1] = SMB2_ENCRYPTION_AES256_GCM; 633 pneg_ctxt->Ciphers[2] = SMB2_ENCRYPTION_AES128_CCM; 634 } else { 635 pneg_ctxt->DataLength = cpu_to_le16(6); /* Cipher Count + 2 ciphers */ 636 pneg_ctxt->CipherCount = cpu_to_le16(2); 637 pneg_ctxt->Ciphers[0] = SMB2_ENCRYPTION_AES128_GCM; 638 pneg_ctxt->Ciphers[1] = SMB2_ENCRYPTION_AES128_CCM; 639 } 640 } 641 642 static unsigned int 643 build_netname_ctxt(struct smb2_netname_neg_context *pneg_ctxt, char *hostname) 644 { 645 struct nls_table *cp = load_nls_default(); 646 647 pneg_ctxt->ContextType = SMB2_NETNAME_NEGOTIATE_CONTEXT_ID; 648 649 /* copy up to max of first 100 bytes of server name to NetName field */ 650 pneg_ctxt->DataLength = cpu_to_le16(2 * cifs_strtoUTF16(pneg_ctxt->NetName, hostname, 100, cp)); 651 /* context size is DataLength + minimal smb2_neg_context */ 652 return ALIGN(le16_to_cpu(pneg_ctxt->DataLength) + sizeof(struct smb2_neg_context), 8); 653 } 654 655 static void 656 build_posix_ctxt(struct smb2_posix_neg_context *pneg_ctxt) 657 { 658 pneg_ctxt->ContextType = SMB2_POSIX_EXTENSIONS_AVAILABLE; 659 pneg_ctxt->DataLength = cpu_to_le16(POSIX_CTXT_DATA_LEN); 660 /* SMB2_CREATE_TAG_POSIX is "0x93AD25509CB411E7B42383DE968BCD7C" */ 661 pneg_ctxt->Name[0] = 0x93; 662 pneg_ctxt->Name[1] = 0xAD; 663 pneg_ctxt->Name[2] = 0x25; 664 pneg_ctxt->Name[3] = 0x50; 665 pneg_ctxt->Name[4] = 0x9C; 666 pneg_ctxt->Name[5] = 0xB4; 667 pneg_ctxt->Name[6] = 0x11; 668 pneg_ctxt->Name[7] = 0xE7; 669 pneg_ctxt->Name[8] = 0xB4; 670 pneg_ctxt->Name[9] = 0x23; 671 pneg_ctxt->Name[10] = 0x83; 672 pneg_ctxt->Name[11] = 0xDE; 673 pneg_ctxt->Name[12] = 0x96; 674 pneg_ctxt->Name[13] = 0x8B; 675 pneg_ctxt->Name[14] = 0xCD; 676 pneg_ctxt->Name[15] = 0x7C; 677 } 678 679 static void 680 assemble_neg_contexts(struct smb2_negotiate_req *req, 681 struct TCP_Server_Info *server, unsigned int *total_len) 682 { 683 unsigned int ctxt_len, neg_context_count; 684 struct TCP_Server_Info *pserver; 685 char *pneg_ctxt; 686 char *hostname; 687 688 if (*total_len > 200) { 689 /* In case length corrupted don't want to overrun smb buffer */ 690 cifs_server_dbg(VFS, "Bad frame length assembling neg contexts\n"); 691 return; 692 } 693 694 /* 695 * round up total_len of fixed part of SMB3 negotiate request to 8 696 * byte boundary before adding negotiate contexts 697 */ 698 *total_len = ALIGN(*total_len, 8); 699 700 pneg_ctxt = (*total_len) + (char *)req; 701 req->NegotiateContextOffset = cpu_to_le32(*total_len); 702 703 build_preauth_ctxt((struct smb2_preauth_neg_context *)pneg_ctxt); 704 ctxt_len = ALIGN(sizeof(struct smb2_preauth_neg_context), 8); 705 *total_len += ctxt_len; 706 pneg_ctxt += ctxt_len; 707 708 build_encrypt_ctxt((struct smb2_encryption_neg_context *)pneg_ctxt); 709 ctxt_len = ALIGN(sizeof(struct smb2_encryption_neg_context), 8); 710 *total_len += ctxt_len; 711 pneg_ctxt += ctxt_len; 712 713 /* 714 * secondary channels don't have the hostname field populated 715 * use the hostname field in the primary channel instead 716 */ 717 pserver = SERVER_IS_CHAN(server) ? server->primary_server : server; 718 cifs_server_lock(pserver); 719 hostname = pserver->hostname; 720 if (hostname && (hostname[0] != 0)) { 721 ctxt_len = build_netname_ctxt((struct smb2_netname_neg_context *)pneg_ctxt, 722 hostname); 723 *total_len += ctxt_len; 724 pneg_ctxt += ctxt_len; 725 neg_context_count = 3; 726 } else 727 neg_context_count = 2; 728 cifs_server_unlock(pserver); 729 730 build_posix_ctxt((struct smb2_posix_neg_context *)pneg_ctxt); 731 *total_len += sizeof(struct smb2_posix_neg_context); 732 pneg_ctxt += sizeof(struct smb2_posix_neg_context); 733 neg_context_count++; 734 735 if (server->compression.requested) { 736 build_compression_ctxt((struct smb2_compression_capabilities_context *) 737 pneg_ctxt); 738 ctxt_len = ALIGN(sizeof(struct smb2_compression_capabilities_context), 8); 739 *total_len += ctxt_len; 740 pneg_ctxt += ctxt_len; 741 neg_context_count++; 742 } 743 744 if (enable_negotiate_signing) { 745 ctxt_len = build_signing_ctxt((struct smb2_signing_capabilities *) 746 pneg_ctxt); 747 *total_len += ctxt_len; 748 pneg_ctxt += ctxt_len; 749 neg_context_count++; 750 } 751 752 /* check for and add transport_capabilities and signing capabilities */ 753 req->NegotiateContextCount = cpu_to_le16(neg_context_count); 754 755 } 756 757 /* If invalid preauth context warn but use what we requested, SHA-512 */ 758 static void decode_preauth_context(struct smb2_preauth_neg_context *ctxt) 759 { 760 unsigned int len = le16_to_cpu(ctxt->DataLength); 761 762 /* 763 * Caller checked that DataLength remains within SMB boundary. We still 764 * need to confirm that one HashAlgorithms member is accounted for. 765 */ 766 if (len < MIN_PREAUTH_CTXT_DATA_LEN) { 767 pr_warn_once("server sent bad preauth context\n"); 768 return; 769 } else if (len < MIN_PREAUTH_CTXT_DATA_LEN + le16_to_cpu(ctxt->SaltLength)) { 770 pr_warn_once("server sent invalid SaltLength\n"); 771 return; 772 } 773 if (le16_to_cpu(ctxt->HashAlgorithmCount) != 1) 774 pr_warn_once("Invalid SMB3 hash algorithm count\n"); 775 if (ctxt->HashAlgorithms != SMB2_PREAUTH_INTEGRITY_SHA512) 776 pr_warn_once("unknown SMB3 hash algorithm\n"); 777 } 778 779 static void decode_compress_ctx(struct TCP_Server_Info *server, 780 struct smb2_compression_capabilities_context *ctxt) 781 { 782 unsigned int len = le16_to_cpu(ctxt->DataLength); 783 __le16 alg; 784 785 server->compression.enabled = false; 786 787 /* 788 * Caller checked that DataLength remains within SMB boundary. We still 789 * need to confirm that one CompressionAlgorithms member is accounted 790 * for. 791 */ 792 if (len < 10) { 793 pr_warn_once("server sent bad compression cntxt\n"); 794 return; 795 } 796 797 if (le16_to_cpu(ctxt->CompressionAlgorithmCount) != 1) { 798 pr_warn_once("invalid SMB3 compress algorithm count\n"); 799 return; 800 } 801 802 alg = ctxt->CompressionAlgorithms[0]; 803 804 /* 'NONE' (0) compressor type is never negotiated */ 805 if (alg == 0 || le16_to_cpu(alg) > 3) { 806 pr_warn_once("invalid compression algorithm '%u'\n", alg); 807 return; 808 } 809 810 server->compression.alg = alg; 811 server->compression.enabled = true; 812 } 813 814 static int decode_encrypt_ctx(struct TCP_Server_Info *server, 815 struct smb2_encryption_neg_context *ctxt) 816 { 817 unsigned int len = le16_to_cpu(ctxt->DataLength); 818 819 cifs_dbg(FYI, "decode SMB3.11 encryption neg context of len %d\n", len); 820 /* 821 * Caller checked that DataLength remains within SMB boundary. We still 822 * need to confirm that one Cipher flexible array member is accounted 823 * for. 824 */ 825 if (len < MIN_ENCRYPT_CTXT_DATA_LEN) { 826 pr_warn_once("server sent bad crypto ctxt len\n"); 827 return -EINVAL; 828 } 829 830 if (le16_to_cpu(ctxt->CipherCount) != 1) { 831 pr_warn_once("Invalid SMB3.11 cipher count\n"); 832 return -EINVAL; 833 } 834 cifs_dbg(FYI, "SMB311 cipher type:%d\n", le16_to_cpu(ctxt->Ciphers[0])); 835 if (require_gcm_256) { 836 if (ctxt->Ciphers[0] != SMB2_ENCRYPTION_AES256_GCM) { 837 cifs_dbg(VFS, "Server does not support requested encryption type (AES256 GCM)\n"); 838 return -EOPNOTSUPP; 839 } 840 } else if (ctxt->Ciphers[0] == 0) { 841 /* 842 * e.g. if server only supported AES256_CCM (very unlikely) 843 * or server supported no encryption types or had all disabled. 844 * Since GLOBAL_CAP_ENCRYPTION will be not set, in the case 845 * in which mount requested encryption ("seal") checks later 846 * on during tree connection will return proper rc, but if 847 * seal not requested by client, since server is allowed to 848 * return 0 to indicate no supported cipher, we can't fail here 849 */ 850 server->cipher_type = 0; 851 server->capabilities &= ~SMB2_GLOBAL_CAP_ENCRYPTION; 852 pr_warn_once("Server does not support requested encryption types\n"); 853 return 0; 854 } else if ((ctxt->Ciphers[0] != SMB2_ENCRYPTION_AES128_CCM) && 855 (ctxt->Ciphers[0] != SMB2_ENCRYPTION_AES128_GCM) && 856 (ctxt->Ciphers[0] != SMB2_ENCRYPTION_AES256_GCM)) { 857 /* server returned a cipher we didn't ask for */ 858 pr_warn_once("Invalid SMB3.11 cipher returned\n"); 859 return -EINVAL; 860 } 861 server->cipher_type = ctxt->Ciphers[0]; 862 server->capabilities |= SMB2_GLOBAL_CAP_ENCRYPTION; 863 return 0; 864 } 865 866 static void decode_signing_ctx(struct TCP_Server_Info *server, 867 struct smb2_signing_capabilities *pctxt) 868 { 869 unsigned int len = le16_to_cpu(pctxt->DataLength); 870 871 /* 872 * Caller checked that DataLength remains within SMB boundary. We still 873 * need to confirm that one SigningAlgorithms flexible array member is 874 * accounted for. 875 */ 876 if ((len < 4) || (len > 16)) { 877 pr_warn_once("server sent bad signing negcontext\n"); 878 return; 879 } 880 if (le16_to_cpu(pctxt->SigningAlgorithmCount) != 1) { 881 pr_warn_once("Invalid signing algorithm count\n"); 882 return; 883 } 884 if (le16_to_cpu(pctxt->SigningAlgorithms[0]) > 2) { 885 pr_warn_once("unknown signing algorithm\n"); 886 return; 887 } 888 889 server->signing_negotiated = true; 890 server->signing_algorithm = le16_to_cpu(pctxt->SigningAlgorithms[0]); 891 cifs_dbg(FYI, "signing algorithm %d chosen\n", 892 server->signing_algorithm); 893 } 894 895 896 static int smb311_decode_neg_context(struct smb2_negotiate_rsp *rsp, 897 struct TCP_Server_Info *server, 898 unsigned int len_of_smb) 899 { 900 struct smb2_neg_context *pctx; 901 unsigned int offset = le32_to_cpu(rsp->NegotiateContextOffset); 902 unsigned int ctxt_cnt = le16_to_cpu(rsp->NegotiateContextCount); 903 unsigned int len_of_ctxts, i; 904 int rc = 0; 905 906 cifs_dbg(FYI, "decoding %d negotiate contexts\n", ctxt_cnt); 907 if (len_of_smb <= offset) { 908 cifs_server_dbg(VFS, "Invalid response: negotiate context offset\n"); 909 return -EINVAL; 910 } 911 912 len_of_ctxts = len_of_smb - offset; 913 914 for (i = 0; i < ctxt_cnt; i++) { 915 int clen; 916 /* check that offset is not beyond end of SMB */ 917 if (len_of_ctxts < sizeof(struct smb2_neg_context)) 918 break; 919 920 pctx = (struct smb2_neg_context *)(offset + (char *)rsp); 921 clen = sizeof(struct smb2_neg_context) 922 + le16_to_cpu(pctx->DataLength); 923 /* 924 * 2.2.4 SMB2 NEGOTIATE Response 925 * Subsequent negotiate contexts MUST appear at the first 8-byte 926 * aligned offset following the previous negotiate context. 927 */ 928 if (i + 1 != ctxt_cnt) 929 clen = ALIGN(clen, 8); 930 if (clen > len_of_ctxts) 931 break; 932 933 if (pctx->ContextType == SMB2_PREAUTH_INTEGRITY_CAPABILITIES) 934 decode_preauth_context( 935 (struct smb2_preauth_neg_context *)pctx); 936 else if (pctx->ContextType == SMB2_ENCRYPTION_CAPABILITIES) 937 rc = decode_encrypt_ctx(server, 938 (struct smb2_encryption_neg_context *)pctx); 939 else if (pctx->ContextType == SMB2_COMPRESSION_CAPABILITIES) 940 decode_compress_ctx(server, 941 (struct smb2_compression_capabilities_context *)pctx); 942 else if (pctx->ContextType == SMB2_POSIX_EXTENSIONS_AVAILABLE) 943 server->posix_ext_supported = true; 944 else if (pctx->ContextType == SMB2_SIGNING_CAPABILITIES) 945 decode_signing_ctx(server, 946 (struct smb2_signing_capabilities *)pctx); 947 else 948 cifs_server_dbg(VFS, "unknown negcontext of type %d ignored\n", 949 le16_to_cpu(pctx->ContextType)); 950 if (rc) 951 break; 952 953 offset += clen; 954 len_of_ctxts -= clen; 955 } 956 return rc; 957 } 958 959 static struct create_posix * 960 create_posix_buf(umode_t mode) 961 { 962 struct create_posix *buf; 963 964 buf = kzalloc(sizeof(struct create_posix), 965 GFP_KERNEL); 966 if (!buf) 967 return NULL; 968 969 buf->ccontext.DataOffset = 970 cpu_to_le16(offsetof(struct create_posix, Mode)); 971 buf->ccontext.DataLength = cpu_to_le32(4); 972 buf->ccontext.NameOffset = 973 cpu_to_le16(offsetof(struct create_posix, Name)); 974 buf->ccontext.NameLength = cpu_to_le16(16); 975 976 /* SMB2_CREATE_TAG_POSIX is "0x93AD25509CB411E7B42383DE968BCD7C" */ 977 buf->Name[0] = 0x93; 978 buf->Name[1] = 0xAD; 979 buf->Name[2] = 0x25; 980 buf->Name[3] = 0x50; 981 buf->Name[4] = 0x9C; 982 buf->Name[5] = 0xB4; 983 buf->Name[6] = 0x11; 984 buf->Name[7] = 0xE7; 985 buf->Name[8] = 0xB4; 986 buf->Name[9] = 0x23; 987 buf->Name[10] = 0x83; 988 buf->Name[11] = 0xDE; 989 buf->Name[12] = 0x96; 990 buf->Name[13] = 0x8B; 991 buf->Name[14] = 0xCD; 992 buf->Name[15] = 0x7C; 993 buf->Mode = cpu_to_le32(mode); 994 cifs_dbg(FYI, "mode on posix create 0%o\n", mode); 995 return buf; 996 } 997 998 static int 999 add_posix_context(struct kvec *iov, unsigned int *num_iovec, umode_t mode) 1000 { 1001 unsigned int num = *num_iovec; 1002 1003 iov[num].iov_base = create_posix_buf(mode); 1004 if (mode == ACL_NO_MODE) 1005 cifs_dbg(FYI, "%s: no mode\n", __func__); 1006 if (iov[num].iov_base == NULL) 1007 return -ENOMEM; 1008 iov[num].iov_len = sizeof(struct create_posix); 1009 *num_iovec = num + 1; 1010 return 0; 1011 } 1012 1013 1014 /* 1015 * 1016 * SMB2 Worker functions follow: 1017 * 1018 * The general structure of the worker functions is: 1019 * 1) Call smb2_init (assembles SMB2 header) 1020 * 2) Initialize SMB2 command specific fields in fixed length area of SMB 1021 * 3) Call smb_sendrcv2 (sends request on socket and waits for response) 1022 * 4) Decode SMB2 command specific fields in the fixed length area 1023 * 5) Decode variable length data area (if any for this SMB2 command type) 1024 * 6) Call free smb buffer 1025 * 7) return 1026 * 1027 */ 1028 1029 int 1030 SMB2_negotiate(const unsigned int xid, 1031 struct cifs_ses *ses, 1032 struct TCP_Server_Info *server) 1033 { 1034 struct smb_rqst rqst; 1035 struct smb2_negotiate_req *req; 1036 struct smb2_negotiate_rsp *rsp; 1037 struct kvec iov[1]; 1038 struct kvec rsp_iov; 1039 int rc; 1040 int resp_buftype; 1041 int blob_offset, blob_length; 1042 char *security_blob; 1043 int flags = CIFS_NEG_OP; 1044 unsigned int total_len; 1045 1046 cifs_dbg(FYI, "Negotiate protocol\n"); 1047 1048 if (!server) { 1049 WARN(1, "%s: server is NULL!\n", __func__); 1050 return -EIO; 1051 } 1052 1053 rc = smb2_plain_req_init(SMB2_NEGOTIATE, NULL, server, 1054 (void **) &req, &total_len); 1055 if (rc) 1056 return rc; 1057 1058 req->hdr.SessionId = 0; 1059 1060 memset(server->preauth_sha_hash, 0, SMB2_PREAUTH_HASH_SIZE); 1061 memset(ses->preauth_sha_hash, 0, SMB2_PREAUTH_HASH_SIZE); 1062 1063 if (strcmp(server->vals->version_string, 1064 SMB3ANY_VERSION_STRING) == 0) { 1065 req->Dialects[0] = cpu_to_le16(SMB30_PROT_ID); 1066 req->Dialects[1] = cpu_to_le16(SMB302_PROT_ID); 1067 req->Dialects[2] = cpu_to_le16(SMB311_PROT_ID); 1068 req->DialectCount = cpu_to_le16(3); 1069 total_len += 6; 1070 } else if (strcmp(server->vals->version_string, 1071 SMBDEFAULT_VERSION_STRING) == 0) { 1072 req->Dialects[0] = cpu_to_le16(SMB21_PROT_ID); 1073 req->Dialects[1] = cpu_to_le16(SMB30_PROT_ID); 1074 req->Dialects[2] = cpu_to_le16(SMB302_PROT_ID); 1075 req->Dialects[3] = cpu_to_le16(SMB311_PROT_ID); 1076 req->DialectCount = cpu_to_le16(4); 1077 total_len += 8; 1078 } else { 1079 /* otherwise send specific dialect */ 1080 req->Dialects[0] = cpu_to_le16(server->vals->protocol_id); 1081 req->DialectCount = cpu_to_le16(1); 1082 total_len += 2; 1083 } 1084 1085 /* only one of SMB2 signing flags may be set in SMB2 request */ 1086 if (ses->sign) 1087 req->SecurityMode = cpu_to_le16(SMB2_NEGOTIATE_SIGNING_REQUIRED); 1088 else if (global_secflags & CIFSSEC_MAY_SIGN) 1089 req->SecurityMode = cpu_to_le16(SMB2_NEGOTIATE_SIGNING_ENABLED); 1090 else 1091 req->SecurityMode = 0; 1092 1093 req->Capabilities = cpu_to_le32(server->vals->req_capabilities); 1094 if (ses->chan_max > 1) 1095 req->Capabilities |= cpu_to_le32(SMB2_GLOBAL_CAP_MULTI_CHANNEL); 1096 1097 /* ClientGUID must be zero for SMB2.02 dialect */ 1098 if (server->vals->protocol_id == SMB20_PROT_ID) 1099 memset(req->ClientGUID, 0, SMB2_CLIENT_GUID_SIZE); 1100 else { 1101 memcpy(req->ClientGUID, server->client_guid, 1102 SMB2_CLIENT_GUID_SIZE); 1103 if ((server->vals->protocol_id == SMB311_PROT_ID) || 1104 (strcmp(server->vals->version_string, 1105 SMB3ANY_VERSION_STRING) == 0) || 1106 (strcmp(server->vals->version_string, 1107 SMBDEFAULT_VERSION_STRING) == 0)) 1108 assemble_neg_contexts(req, server, &total_len); 1109 } 1110 iov[0].iov_base = (char *)req; 1111 iov[0].iov_len = total_len; 1112 1113 memset(&rqst, 0, sizeof(struct smb_rqst)); 1114 rqst.rq_iov = iov; 1115 rqst.rq_nvec = 1; 1116 1117 rc = cifs_send_recv(xid, ses, server, 1118 &rqst, &resp_buftype, flags, &rsp_iov); 1119 cifs_small_buf_release(req); 1120 rsp = (struct smb2_negotiate_rsp *)rsp_iov.iov_base; 1121 /* 1122 * No tcon so can't do 1123 * cifs_stats_inc(&tcon->stats.smb2_stats.smb2_com_fail[SMB2...]); 1124 */ 1125 if (rc == -EOPNOTSUPP) { 1126 cifs_server_dbg(VFS, "Dialect not supported by server. Consider specifying vers=1.0 or vers=2.0 on mount for accessing older servers\n"); 1127 goto neg_exit; 1128 } else if (rc != 0) 1129 goto neg_exit; 1130 1131 rc = -EIO; 1132 if (strcmp(server->vals->version_string, 1133 SMB3ANY_VERSION_STRING) == 0) { 1134 if (rsp->DialectRevision == cpu_to_le16(SMB20_PROT_ID)) { 1135 cifs_server_dbg(VFS, 1136 "SMB2 dialect returned but not requested\n"); 1137 goto neg_exit; 1138 } else if (rsp->DialectRevision == cpu_to_le16(SMB21_PROT_ID)) { 1139 cifs_server_dbg(VFS, 1140 "SMB2.1 dialect returned but not requested\n"); 1141 goto neg_exit; 1142 } else if (rsp->DialectRevision == cpu_to_le16(SMB311_PROT_ID)) { 1143 /* ops set to 3.0 by default for default so update */ 1144 server->ops = &smb311_operations; 1145 server->vals = &smb311_values; 1146 } 1147 } else if (strcmp(server->vals->version_string, 1148 SMBDEFAULT_VERSION_STRING) == 0) { 1149 if (rsp->DialectRevision == cpu_to_le16(SMB20_PROT_ID)) { 1150 cifs_server_dbg(VFS, 1151 "SMB2 dialect returned but not requested\n"); 1152 goto neg_exit; 1153 } else if (rsp->DialectRevision == cpu_to_le16(SMB21_PROT_ID)) { 1154 /* ops set to 3.0 by default for default so update */ 1155 server->ops = &smb21_operations; 1156 server->vals = &smb21_values; 1157 } else if (rsp->DialectRevision == cpu_to_le16(SMB311_PROT_ID)) { 1158 server->ops = &smb311_operations; 1159 server->vals = &smb311_values; 1160 } 1161 } else if (le16_to_cpu(rsp->DialectRevision) != 1162 server->vals->protocol_id) { 1163 /* if requested single dialect ensure returned dialect matched */ 1164 cifs_server_dbg(VFS, "Invalid 0x%x dialect returned: not requested\n", 1165 le16_to_cpu(rsp->DialectRevision)); 1166 goto neg_exit; 1167 } 1168 1169 cifs_dbg(FYI, "mode 0x%x\n", rsp->SecurityMode); 1170 1171 if (rsp->DialectRevision == cpu_to_le16(SMB20_PROT_ID)) 1172 cifs_dbg(FYI, "negotiated smb2.0 dialect\n"); 1173 else if (rsp->DialectRevision == cpu_to_le16(SMB21_PROT_ID)) 1174 cifs_dbg(FYI, "negotiated smb2.1 dialect\n"); 1175 else if (rsp->DialectRevision == cpu_to_le16(SMB30_PROT_ID)) 1176 cifs_dbg(FYI, "negotiated smb3.0 dialect\n"); 1177 else if (rsp->DialectRevision == cpu_to_le16(SMB302_PROT_ID)) 1178 cifs_dbg(FYI, "negotiated smb3.02 dialect\n"); 1179 else if (rsp->DialectRevision == cpu_to_le16(SMB311_PROT_ID)) 1180 cifs_dbg(FYI, "negotiated smb3.1.1 dialect\n"); 1181 else { 1182 cifs_server_dbg(VFS, "Invalid dialect returned by server 0x%x\n", 1183 le16_to_cpu(rsp->DialectRevision)); 1184 goto neg_exit; 1185 } 1186 1187 rc = 0; 1188 server->dialect = le16_to_cpu(rsp->DialectRevision); 1189 1190 /* 1191 * Keep a copy of the hash after negprot. This hash will be 1192 * the starting hash value for all sessions made from this 1193 * server. 1194 */ 1195 memcpy(server->preauth_sha_hash, ses->preauth_sha_hash, 1196 SMB2_PREAUTH_HASH_SIZE); 1197 1198 /* SMB2 only has an extended negflavor */ 1199 server->negflavor = CIFS_NEGFLAVOR_EXTENDED; 1200 /* set it to the maximum buffer size value we can send with 1 credit */ 1201 server->maxBuf = min_t(unsigned int, le32_to_cpu(rsp->MaxTransactSize), 1202 SMB2_MAX_BUFFER_SIZE); 1203 server->max_read = le32_to_cpu(rsp->MaxReadSize); 1204 server->max_write = le32_to_cpu(rsp->MaxWriteSize); 1205 server->sec_mode = le16_to_cpu(rsp->SecurityMode); 1206 if ((server->sec_mode & SMB2_SEC_MODE_FLAGS_ALL) != server->sec_mode) 1207 cifs_dbg(FYI, "Server returned unexpected security mode 0x%x\n", 1208 server->sec_mode); 1209 server->capabilities = le32_to_cpu(rsp->Capabilities); 1210 /* Internal types */ 1211 server->capabilities |= SMB2_NT_FIND | SMB2_LARGE_FILES; 1212 1213 /* 1214 * SMB3.0 supports only 1 cipher and doesn't have a encryption neg context 1215 * Set the cipher type manually. 1216 */ 1217 if ((server->dialect == SMB30_PROT_ID || 1218 server->dialect == SMB302_PROT_ID) && 1219 (server->capabilities & SMB2_GLOBAL_CAP_ENCRYPTION)) 1220 server->cipher_type = SMB2_ENCRYPTION_AES128_CCM; 1221 1222 security_blob = smb2_get_data_area_len(&blob_offset, &blob_length, 1223 (struct smb2_hdr *)rsp); 1224 /* 1225 * See MS-SMB2 section 2.2.4: if no blob, client picks default which 1226 * for us will be 1227 * ses->sectype = RawNTLMSSP; 1228 * but for time being this is our only auth choice so doesn't matter. 1229 * We just found a server which sets blob length to zero expecting raw. 1230 */ 1231 if (blob_length == 0) { 1232 cifs_dbg(FYI, "missing security blob on negprot\n"); 1233 server->sec_ntlmssp = true; 1234 } 1235 1236 rc = cifs_enable_signing(server, ses->sign); 1237 if (rc) 1238 goto neg_exit; 1239 if (blob_length) { 1240 rc = decode_negTokenInit(security_blob, blob_length, server); 1241 if (rc == 1) 1242 rc = 0; 1243 else if (rc == 0) 1244 rc = -EIO; 1245 } 1246 1247 if (rsp->DialectRevision == cpu_to_le16(SMB311_PROT_ID)) { 1248 if (rsp->NegotiateContextCount) 1249 rc = smb311_decode_neg_context(rsp, server, 1250 rsp_iov.iov_len); 1251 else 1252 cifs_server_dbg(VFS, "Missing expected negotiate contexts\n"); 1253 } 1254 1255 if (server->cipher_type && !rc) 1256 rc = smb3_crypto_aead_allocate(server); 1257 neg_exit: 1258 free_rsp_buf(resp_buftype, rsp); 1259 return rc; 1260 } 1261 1262 int smb3_validate_negotiate(const unsigned int xid, struct cifs_tcon *tcon) 1263 { 1264 int rc; 1265 struct validate_negotiate_info_req *pneg_inbuf; 1266 struct validate_negotiate_info_rsp *pneg_rsp = NULL; 1267 u32 rsplen; 1268 u32 inbuflen; /* max of 4 dialects */ 1269 struct TCP_Server_Info *server = tcon->ses->server; 1270 1271 cifs_dbg(FYI, "validate negotiate\n"); 1272 1273 /* In SMB3.11 preauth integrity supersedes validate negotiate */ 1274 if (server->dialect == SMB311_PROT_ID) 1275 return 0; 1276 1277 /* 1278 * validation ioctl must be signed, so no point sending this if we 1279 * can not sign it (ie are not known user). Even if signing is not 1280 * required (enabled but not negotiated), in those cases we selectively 1281 * sign just this, the first and only signed request on a connection. 1282 * Having validation of negotiate info helps reduce attack vectors. 1283 */ 1284 if (tcon->ses->session_flags & SMB2_SESSION_FLAG_IS_GUEST) 1285 return 0; /* validation requires signing */ 1286 1287 if (tcon->ses->user_name == NULL) { 1288 cifs_dbg(FYI, "Can't validate negotiate: null user mount\n"); 1289 return 0; /* validation requires signing */ 1290 } 1291 1292 if (tcon->ses->session_flags & SMB2_SESSION_FLAG_IS_NULL) 1293 cifs_tcon_dbg(VFS, "Unexpected null user (anonymous) auth flag sent by server\n"); 1294 1295 pneg_inbuf = kmalloc(sizeof(*pneg_inbuf), GFP_NOFS); 1296 if (!pneg_inbuf) 1297 return -ENOMEM; 1298 1299 pneg_inbuf->Capabilities = 1300 cpu_to_le32(server->vals->req_capabilities); 1301 if (tcon->ses->chan_max > 1) 1302 pneg_inbuf->Capabilities |= cpu_to_le32(SMB2_GLOBAL_CAP_MULTI_CHANNEL); 1303 1304 memcpy(pneg_inbuf->Guid, server->client_guid, 1305 SMB2_CLIENT_GUID_SIZE); 1306 1307 if (tcon->ses->sign) 1308 pneg_inbuf->SecurityMode = 1309 cpu_to_le16(SMB2_NEGOTIATE_SIGNING_REQUIRED); 1310 else if (global_secflags & CIFSSEC_MAY_SIGN) 1311 pneg_inbuf->SecurityMode = 1312 cpu_to_le16(SMB2_NEGOTIATE_SIGNING_ENABLED); 1313 else 1314 pneg_inbuf->SecurityMode = 0; 1315 1316 1317 if (strcmp(server->vals->version_string, 1318 SMB3ANY_VERSION_STRING) == 0) { 1319 pneg_inbuf->Dialects[0] = cpu_to_le16(SMB30_PROT_ID); 1320 pneg_inbuf->Dialects[1] = cpu_to_le16(SMB302_PROT_ID); 1321 pneg_inbuf->Dialects[2] = cpu_to_le16(SMB311_PROT_ID); 1322 pneg_inbuf->DialectCount = cpu_to_le16(3); 1323 /* SMB 2.1 not included so subtract one dialect from len */ 1324 inbuflen = sizeof(*pneg_inbuf) - 1325 (sizeof(pneg_inbuf->Dialects[0])); 1326 } else if (strcmp(server->vals->version_string, 1327 SMBDEFAULT_VERSION_STRING) == 0) { 1328 pneg_inbuf->Dialects[0] = cpu_to_le16(SMB21_PROT_ID); 1329 pneg_inbuf->Dialects[1] = cpu_to_le16(SMB30_PROT_ID); 1330 pneg_inbuf->Dialects[2] = cpu_to_le16(SMB302_PROT_ID); 1331 pneg_inbuf->Dialects[3] = cpu_to_le16(SMB311_PROT_ID); 1332 pneg_inbuf->DialectCount = cpu_to_le16(4); 1333 /* structure is big enough for 4 dialects */ 1334 inbuflen = sizeof(*pneg_inbuf); 1335 } else { 1336 /* otherwise specific dialect was requested */ 1337 pneg_inbuf->Dialects[0] = 1338 cpu_to_le16(server->vals->protocol_id); 1339 pneg_inbuf->DialectCount = cpu_to_le16(1); 1340 /* structure is big enough for 4 dialects, sending only 1 */ 1341 inbuflen = sizeof(*pneg_inbuf) - 1342 sizeof(pneg_inbuf->Dialects[0]) * 3; 1343 } 1344 1345 rc = SMB2_ioctl(xid, tcon, NO_FILE_ID, NO_FILE_ID, 1346 FSCTL_VALIDATE_NEGOTIATE_INFO, 1347 (char *)pneg_inbuf, inbuflen, CIFSMaxBufSize, 1348 (char **)&pneg_rsp, &rsplen); 1349 if (rc == -EOPNOTSUPP) { 1350 /* 1351 * Old Windows versions or Netapp SMB server can return 1352 * not supported error. Client should accept it. 1353 */ 1354 cifs_tcon_dbg(VFS, "Server does not support validate negotiate\n"); 1355 rc = 0; 1356 goto out_free_inbuf; 1357 } else if (rc != 0) { 1358 cifs_tcon_dbg(VFS, "validate protocol negotiate failed: %d\n", 1359 rc); 1360 rc = -EIO; 1361 goto out_free_inbuf; 1362 } 1363 1364 rc = -EIO; 1365 if (rsplen != sizeof(*pneg_rsp)) { 1366 cifs_tcon_dbg(VFS, "Invalid protocol negotiate response size: %d\n", 1367 rsplen); 1368 1369 /* relax check since Mac returns max bufsize allowed on ioctl */ 1370 if (rsplen > CIFSMaxBufSize || rsplen < sizeof(*pneg_rsp)) 1371 goto out_free_rsp; 1372 } 1373 1374 /* check validate negotiate info response matches what we got earlier */ 1375 if (pneg_rsp->Dialect != cpu_to_le16(server->dialect)) 1376 goto vneg_out; 1377 1378 if (pneg_rsp->SecurityMode != cpu_to_le16(server->sec_mode)) 1379 goto vneg_out; 1380 1381 /* do not validate server guid because not saved at negprot time yet */ 1382 1383 if ((le32_to_cpu(pneg_rsp->Capabilities) | SMB2_NT_FIND | 1384 SMB2_LARGE_FILES) != server->capabilities) 1385 goto vneg_out; 1386 1387 /* validate negotiate successful */ 1388 rc = 0; 1389 cifs_dbg(FYI, "validate negotiate info successful\n"); 1390 goto out_free_rsp; 1391 1392 vneg_out: 1393 cifs_tcon_dbg(VFS, "protocol revalidation - security settings mismatch\n"); 1394 out_free_rsp: 1395 kfree(pneg_rsp); 1396 out_free_inbuf: 1397 kfree(pneg_inbuf); 1398 return rc; 1399 } 1400 1401 enum securityEnum 1402 smb2_select_sectype(struct TCP_Server_Info *server, enum securityEnum requested) 1403 { 1404 switch (requested) { 1405 case Kerberos: 1406 case RawNTLMSSP: 1407 return requested; 1408 case NTLMv2: 1409 return RawNTLMSSP; 1410 case Unspecified: 1411 if (server->sec_ntlmssp && 1412 (global_secflags & CIFSSEC_MAY_NTLMSSP)) 1413 return RawNTLMSSP; 1414 if ((server->sec_kerberos || server->sec_mskerberos || server->sec_iakerb) && 1415 (global_secflags & CIFSSEC_MAY_KRB5)) 1416 return Kerberos; 1417 fallthrough; 1418 default: 1419 return Unspecified; 1420 } 1421 } 1422 1423 struct SMB2_sess_data { 1424 unsigned int xid; 1425 struct cifs_ses *ses; 1426 struct TCP_Server_Info *server; 1427 struct nls_table *nls_cp; 1428 void (*func)(struct SMB2_sess_data *); 1429 int result; 1430 u64 previous_session; 1431 1432 /* we will send the SMB in three pieces: 1433 * a fixed length beginning part, an optional 1434 * SPNEGO blob (which can be zero length), and a 1435 * last part which will include the strings 1436 * and rest of bcc area. This allows us to avoid 1437 * a large buffer 17K allocation 1438 */ 1439 int buf0_type; 1440 struct kvec iov[2]; 1441 }; 1442 1443 static int 1444 SMB2_sess_alloc_buffer(struct SMB2_sess_data *sess_data) 1445 { 1446 int rc; 1447 struct cifs_ses *ses = sess_data->ses; 1448 struct TCP_Server_Info *server = sess_data->server; 1449 struct smb2_sess_setup_req *req; 1450 unsigned int total_len; 1451 bool is_binding = false; 1452 1453 rc = smb2_plain_req_init(SMB2_SESSION_SETUP, NULL, server, 1454 (void **) &req, 1455 &total_len); 1456 if (rc) 1457 return rc; 1458 1459 spin_lock(&ses->ses_lock); 1460 is_binding = (ses->ses_status == SES_GOOD); 1461 spin_unlock(&ses->ses_lock); 1462 1463 if (is_binding) { 1464 req->hdr.SessionId = cpu_to_le64(ses->Suid); 1465 req->hdr.Flags |= SMB2_FLAGS_SIGNED; 1466 req->PreviousSessionId = 0; 1467 req->Flags = SMB2_SESSION_REQ_FLAG_BINDING; 1468 cifs_dbg(FYI, "Binding to sess id: %llx\n", ses->Suid); 1469 } else { 1470 /* First session, not a reauthenticate */ 1471 req->hdr.SessionId = 0; 1472 /* 1473 * if reconnect, we need to send previous sess id 1474 * otherwise it is 0 1475 */ 1476 req->PreviousSessionId = cpu_to_le64(sess_data->previous_session); 1477 req->Flags = 0; /* MBZ */ 1478 cifs_dbg(FYI, "Fresh session. Previous: %llx\n", 1479 sess_data->previous_session); 1480 } 1481 1482 /* enough to enable echos and oplocks and one max size write */ 1483 if (server->credits >= server->max_credits) 1484 req->hdr.CreditRequest = cpu_to_le16(0); 1485 else 1486 req->hdr.CreditRequest = cpu_to_le16( 1487 min_t(int, server->max_credits - 1488 server->credits, 130)); 1489 1490 /* only one of SMB2 signing flags may be set in SMB2 request */ 1491 if (server->sign) 1492 req->SecurityMode = SMB2_NEGOTIATE_SIGNING_REQUIRED; 1493 else if (global_secflags & CIFSSEC_MAY_SIGN) /* one flag unlike MUST_ */ 1494 req->SecurityMode = SMB2_NEGOTIATE_SIGNING_ENABLED; 1495 else 1496 req->SecurityMode = 0; 1497 1498 #ifdef CONFIG_CIFS_DFS_UPCALL 1499 req->Capabilities = cpu_to_le32(SMB2_GLOBAL_CAP_DFS); 1500 #else 1501 req->Capabilities = 0; 1502 #endif /* DFS_UPCALL */ 1503 1504 req->Channel = 0; /* MBZ */ 1505 1506 sess_data->iov[0].iov_base = (char *)req; 1507 /* 1 for pad */ 1508 sess_data->iov[0].iov_len = total_len - 1; 1509 /* 1510 * This variable will be used to clear the buffer 1511 * allocated above in case of any error in the calling function. 1512 */ 1513 sess_data->buf0_type = CIFS_SMALL_BUFFER; 1514 1515 return 0; 1516 } 1517 1518 static void 1519 SMB2_sess_free_buffer(struct SMB2_sess_data *sess_data) 1520 { 1521 struct kvec *iov = sess_data->iov; 1522 1523 /* iov[1] is already freed by caller */ 1524 if (sess_data->buf0_type != CIFS_NO_BUFFER && iov[0].iov_base) 1525 memzero_explicit(iov[0].iov_base, iov[0].iov_len); 1526 1527 free_rsp_buf(sess_data->buf0_type, iov[0].iov_base); 1528 sess_data->buf0_type = CIFS_NO_BUFFER; 1529 } 1530 1531 static int 1532 SMB2_sess_sendreceive(struct SMB2_sess_data *sess_data) 1533 { 1534 int rc; 1535 struct smb_rqst rqst; 1536 struct smb2_sess_setup_req *req = sess_data->iov[0].iov_base; 1537 struct kvec rsp_iov = { NULL, 0 }; 1538 1539 /* Testing shows that buffer offset must be at location of Buffer[0] */ 1540 req->SecurityBufferOffset = 1541 cpu_to_le16(sizeof(struct smb2_sess_setup_req)); 1542 req->SecurityBufferLength = cpu_to_le16(sess_data->iov[1].iov_len); 1543 1544 memset(&rqst, 0, sizeof(struct smb_rqst)); 1545 rqst.rq_iov = sess_data->iov; 1546 rqst.rq_nvec = 2; 1547 1548 /* BB add code to build os and lm fields */ 1549 rc = cifs_send_recv(sess_data->xid, sess_data->ses, 1550 sess_data->server, 1551 &rqst, 1552 &sess_data->buf0_type, 1553 CIFS_LOG_ERROR | CIFS_SESS_OP, &rsp_iov); 1554 cifs_small_buf_release(sess_data->iov[0].iov_base); 1555 if (rc == 0) 1556 sess_data->ses->expired_pwd = false; 1557 else if ((rc == -EACCES) || (rc == -EKEYEXPIRED) || (rc == -EKEYREVOKED)) { 1558 if (sess_data->ses->expired_pwd == false) 1559 trace_smb3_key_expired(sess_data->server->hostname, 1560 sess_data->ses->user_name, 1561 sess_data->server->conn_id, 1562 &sess_data->server->dstaddr, rc); 1563 sess_data->ses->expired_pwd = true; 1564 } 1565 1566 memcpy(&sess_data->iov[0], &rsp_iov, sizeof(struct kvec)); 1567 1568 return rc; 1569 } 1570 1571 static int 1572 SMB2_sess_establish_session(struct SMB2_sess_data *sess_data) 1573 { 1574 int rc = 0; 1575 struct cifs_ses *ses = sess_data->ses; 1576 struct TCP_Server_Info *server = sess_data->server; 1577 1578 cifs_server_lock(server); 1579 if (server->ops->generate_signingkey) { 1580 rc = server->ops->generate_signingkey(ses, server); 1581 if (rc) { 1582 cifs_dbg(FYI, 1583 "SMB3 session key generation failed\n"); 1584 cifs_server_unlock(server); 1585 return rc; 1586 } 1587 } 1588 if (!server->session_estab) { 1589 server->sequence_number = 0x2; 1590 server->session_estab = true; 1591 } 1592 cifs_server_unlock(server); 1593 1594 cifs_dbg(FYI, "SMB2/3 session established successfully\n"); 1595 return rc; 1596 } 1597 1598 #ifdef CONFIG_CIFS_UPCALL 1599 static void 1600 SMB2_auth_kerberos(struct SMB2_sess_data *sess_data) 1601 { 1602 int rc; 1603 struct cifs_ses *ses = sess_data->ses; 1604 struct TCP_Server_Info *server = sess_data->server; 1605 struct cifs_spnego_msg *msg; 1606 struct key *spnego_key = NULL; 1607 struct smb2_sess_setup_rsp *rsp = NULL; 1608 bool is_binding = false; 1609 1610 rc = SMB2_sess_alloc_buffer(sess_data); 1611 if (rc) 1612 goto out; 1613 1614 spnego_key = cifs_get_spnego_key(ses, server); 1615 if (IS_ERR(spnego_key)) { 1616 rc = PTR_ERR(spnego_key); 1617 if (rc == -ENOKEY) 1618 cifs_dbg(VFS, "Verify user has a krb5 ticket and keyutils is installed\n"); 1619 spnego_key = NULL; 1620 goto out; 1621 } 1622 1623 msg = spnego_key->payload.data[0]; 1624 /* 1625 * check version field to make sure that cifs.upcall is 1626 * sending us a response in an expected form 1627 */ 1628 if (msg->version != CIFS_SPNEGO_UPCALL_VERSION) { 1629 cifs_dbg(VFS, "bad cifs.upcall version. Expected %d got %d\n", 1630 CIFS_SPNEGO_UPCALL_VERSION, msg->version); 1631 rc = -EKEYREJECTED; 1632 goto out_put_spnego_key; 1633 } 1634 1635 spin_lock(&ses->ses_lock); 1636 is_binding = (ses->ses_status == SES_GOOD); 1637 spin_unlock(&ses->ses_lock); 1638 1639 /* keep session key if binding */ 1640 if (!is_binding) { 1641 kfree_sensitive(ses->auth_key.response); 1642 ses->auth_key.response = kmemdup(msg->data, msg->sesskey_len, 1643 GFP_KERNEL); 1644 if (!ses->auth_key.response) { 1645 cifs_dbg(VFS, "Kerberos can't allocate (%u bytes) memory\n", 1646 msg->sesskey_len); 1647 rc = -ENOMEM; 1648 goto out_put_spnego_key; 1649 } 1650 ses->auth_key.len = msg->sesskey_len; 1651 } 1652 1653 sess_data->iov[1].iov_base = msg->data + msg->sesskey_len; 1654 sess_data->iov[1].iov_len = msg->secblob_len; 1655 1656 rc = SMB2_sess_sendreceive(sess_data); 1657 if (rc) 1658 goto out_put_spnego_key; 1659 1660 rsp = (struct smb2_sess_setup_rsp *)sess_data->iov[0].iov_base; 1661 /* keep session id and flags if binding */ 1662 if (!is_binding) { 1663 ses->Suid = le64_to_cpu(rsp->hdr.SessionId); 1664 ses->session_flags = le16_to_cpu(rsp->SessionFlags); 1665 } 1666 1667 rc = SMB2_sess_establish_session(sess_data); 1668 out_put_spnego_key: 1669 key_invalidate(spnego_key); 1670 key_put(spnego_key); 1671 if (rc) { 1672 kfree_sensitive(ses->auth_key.response); 1673 ses->auth_key.response = NULL; 1674 ses->auth_key.len = 0; 1675 } 1676 out: 1677 sess_data->result = rc; 1678 sess_data->func = NULL; 1679 SMB2_sess_free_buffer(sess_data); 1680 } 1681 #else 1682 static void 1683 SMB2_auth_kerberos(struct SMB2_sess_data *sess_data) 1684 { 1685 cifs_dbg(VFS, "Kerberos negotiated but upcall support disabled!\n"); 1686 sess_data->result = -EOPNOTSUPP; 1687 sess_data->func = NULL; 1688 } 1689 #endif 1690 1691 static void 1692 SMB2_sess_auth_rawntlmssp_authenticate(struct SMB2_sess_data *sess_data); 1693 1694 static void 1695 SMB2_sess_auth_rawntlmssp_negotiate(struct SMB2_sess_data *sess_data) 1696 { 1697 int rc; 1698 struct cifs_ses *ses = sess_data->ses; 1699 struct TCP_Server_Info *server = sess_data->server; 1700 struct smb2_sess_setup_rsp *rsp = NULL; 1701 unsigned char *ntlmssp_blob = NULL; 1702 bool use_spnego = false; /* else use raw ntlmssp */ 1703 u16 blob_length = 0; 1704 bool is_binding = false; 1705 1706 /* 1707 * If memory allocation is successful, caller of this function 1708 * frees it. 1709 */ 1710 ses->ntlmssp = kmalloc(sizeof(struct ntlmssp_auth), GFP_KERNEL); 1711 if (!ses->ntlmssp) { 1712 rc = -ENOMEM; 1713 goto out_err; 1714 } 1715 ses->ntlmssp->sesskey_per_smbsess = true; 1716 1717 rc = SMB2_sess_alloc_buffer(sess_data); 1718 if (rc) 1719 goto out_err; 1720 1721 rc = build_ntlmssp_smb3_negotiate_blob(&ntlmssp_blob, 1722 &blob_length, ses, server, 1723 sess_data->nls_cp); 1724 if (rc) 1725 goto out; 1726 1727 if (use_spnego) { 1728 /* BB eventually need to add this */ 1729 cifs_dbg(VFS, "spnego not supported for SMB2 yet\n"); 1730 rc = -EOPNOTSUPP; 1731 goto out; 1732 } 1733 sess_data->iov[1].iov_base = ntlmssp_blob; 1734 sess_data->iov[1].iov_len = blob_length; 1735 1736 rc = SMB2_sess_sendreceive(sess_data); 1737 rsp = (struct smb2_sess_setup_rsp *)sess_data->iov[0].iov_base; 1738 1739 /* If true, rc here is expected and not an error */ 1740 if (sess_data->buf0_type != CIFS_NO_BUFFER && 1741 rsp->hdr.Status == STATUS_MORE_PROCESSING_REQUIRED) 1742 rc = 0; 1743 1744 if (rc) 1745 goto out; 1746 1747 if (offsetof(struct smb2_sess_setup_rsp, Buffer) != 1748 le16_to_cpu(rsp->SecurityBufferOffset)) { 1749 cifs_dbg(VFS, "Invalid security buffer offset %d\n", 1750 le16_to_cpu(rsp->SecurityBufferOffset)); 1751 rc = -EIO; 1752 goto out; 1753 } 1754 rc = decode_ntlmssp_challenge(rsp->Buffer, 1755 le16_to_cpu(rsp->SecurityBufferLength), ses); 1756 if (rc) 1757 goto out; 1758 1759 cifs_dbg(FYI, "rawntlmssp session setup challenge phase\n"); 1760 1761 spin_lock(&ses->ses_lock); 1762 is_binding = (ses->ses_status == SES_GOOD); 1763 spin_unlock(&ses->ses_lock); 1764 1765 /* keep existing ses id and flags if binding */ 1766 if (!is_binding) { 1767 ses->Suid = le64_to_cpu(rsp->hdr.SessionId); 1768 ses->session_flags = le16_to_cpu(rsp->SessionFlags); 1769 } 1770 1771 out: 1772 kfree_sensitive(ntlmssp_blob); 1773 SMB2_sess_free_buffer(sess_data); 1774 if (!rc) { 1775 sess_data->result = 0; 1776 sess_data->func = SMB2_sess_auth_rawntlmssp_authenticate; 1777 return; 1778 } 1779 out_err: 1780 kfree_sensitive(ses->ntlmssp); 1781 ses->ntlmssp = NULL; 1782 sess_data->result = rc; 1783 sess_data->func = NULL; 1784 } 1785 1786 static void 1787 SMB2_sess_auth_rawntlmssp_authenticate(struct SMB2_sess_data *sess_data) 1788 { 1789 int rc; 1790 struct cifs_ses *ses = sess_data->ses; 1791 struct TCP_Server_Info *server = sess_data->server; 1792 struct smb2_sess_setup_req *req; 1793 struct smb2_sess_setup_rsp *rsp = NULL; 1794 unsigned char *ntlmssp_blob = NULL; 1795 bool use_spnego = false; /* else use raw ntlmssp */ 1796 u16 blob_length = 0; 1797 bool is_binding = false; 1798 1799 rc = SMB2_sess_alloc_buffer(sess_data); 1800 if (rc) 1801 goto out; 1802 1803 req = (struct smb2_sess_setup_req *) sess_data->iov[0].iov_base; 1804 req->hdr.SessionId = cpu_to_le64(ses->Suid); 1805 1806 rc = build_ntlmssp_auth_blob(&ntlmssp_blob, &blob_length, 1807 ses, server, 1808 sess_data->nls_cp); 1809 if (rc) { 1810 cifs_dbg(FYI, "build_ntlmssp_auth_blob failed %d\n", rc); 1811 goto out; 1812 } 1813 1814 if (use_spnego) { 1815 /* BB eventually need to add this */ 1816 cifs_dbg(VFS, "spnego not supported for SMB2 yet\n"); 1817 rc = -EOPNOTSUPP; 1818 goto out; 1819 } 1820 sess_data->iov[1].iov_base = ntlmssp_blob; 1821 sess_data->iov[1].iov_len = blob_length; 1822 1823 rc = SMB2_sess_sendreceive(sess_data); 1824 if (rc) 1825 goto out; 1826 1827 rsp = (struct smb2_sess_setup_rsp *)sess_data->iov[0].iov_base; 1828 1829 spin_lock(&ses->ses_lock); 1830 is_binding = (ses->ses_status == SES_GOOD); 1831 spin_unlock(&ses->ses_lock); 1832 1833 /* keep existing ses id and flags if binding */ 1834 if (!is_binding) { 1835 ses->Suid = le64_to_cpu(rsp->hdr.SessionId); 1836 ses->session_flags = le16_to_cpu(rsp->SessionFlags); 1837 } 1838 1839 rc = SMB2_sess_establish_session(sess_data); 1840 #ifdef CONFIG_CIFS_DEBUG_DUMP_KEYS 1841 if (ses->server->dialect < SMB30_PROT_ID) { 1842 cifs_dbg(VFS, "%s: dumping generated SMB2 session keys\n", __func__); 1843 /* 1844 * The session id is opaque in terms of endianness, so we can't 1845 * print it as a long long. we dump it as we got it on the wire 1846 */ 1847 cifs_dbg(VFS, "Session Id %*ph\n", (int)sizeof(ses->Suid), 1848 &ses->Suid); 1849 cifs_dbg(VFS, "Session Key %*ph\n", 1850 SMB2_NTLMV2_SESSKEY_SIZE, ses->auth_key.response); 1851 cifs_dbg(VFS, "Signing Key %*ph\n", 1852 SMB3_SIGN_KEY_SIZE, ses->auth_key.response); 1853 } 1854 #endif 1855 out: 1856 kfree_sensitive(ntlmssp_blob); 1857 SMB2_sess_free_buffer(sess_data); 1858 kfree_sensitive(ses->ntlmssp); 1859 ses->ntlmssp = NULL; 1860 sess_data->result = rc; 1861 sess_data->func = NULL; 1862 } 1863 1864 static int 1865 SMB2_select_sec(struct SMB2_sess_data *sess_data) 1866 { 1867 int type; 1868 struct cifs_ses *ses = sess_data->ses; 1869 struct TCP_Server_Info *server = sess_data->server; 1870 1871 type = smb2_select_sectype(server, ses->sectype); 1872 cifs_dbg(FYI, "sess setup type %d\n", type); 1873 if (type == Unspecified) { 1874 cifs_dbg(VFS, "Unable to select appropriate authentication method!\n"); 1875 return -EINVAL; 1876 } 1877 1878 switch (type) { 1879 case Kerberos: 1880 sess_data->func = SMB2_auth_kerberos; 1881 break; 1882 case RawNTLMSSP: 1883 sess_data->func = SMB2_sess_auth_rawntlmssp_negotiate; 1884 break; 1885 default: 1886 cifs_dbg(VFS, "secType %d not supported!\n", type); 1887 return -EOPNOTSUPP; 1888 } 1889 1890 return 0; 1891 } 1892 1893 int 1894 SMB2_sess_setup(const unsigned int xid, struct cifs_ses *ses, 1895 struct TCP_Server_Info *server, 1896 const struct nls_table *nls_cp) 1897 { 1898 int rc = 0; 1899 struct SMB2_sess_data *sess_data; 1900 1901 cifs_dbg(FYI, "Session Setup\n"); 1902 1903 if (!server) { 1904 WARN(1, "%s: server is NULL!\n", __func__); 1905 return -EIO; 1906 } 1907 1908 sess_data = kzalloc(sizeof(struct SMB2_sess_data), GFP_KERNEL); 1909 if (!sess_data) 1910 return -ENOMEM; 1911 1912 sess_data->xid = xid; 1913 sess_data->ses = ses; 1914 sess_data->server = server; 1915 sess_data->buf0_type = CIFS_NO_BUFFER; 1916 sess_data->nls_cp = (struct nls_table *) nls_cp; 1917 sess_data->previous_session = ses->Suid; 1918 1919 rc = SMB2_select_sec(sess_data); 1920 if (rc) 1921 goto out; 1922 1923 /* 1924 * Initialize the session hash with the server one. 1925 */ 1926 memcpy(ses->preauth_sha_hash, server->preauth_sha_hash, 1927 SMB2_PREAUTH_HASH_SIZE); 1928 1929 while (sess_data->func) 1930 sess_data->func(sess_data); 1931 1932 if ((ses->session_flags & SMB2_SESSION_FLAG_IS_GUEST) && (ses->sign)) 1933 cifs_server_dbg(VFS, "signing requested but authenticated as guest\n"); 1934 rc = sess_data->result; 1935 out: 1936 kfree_sensitive(sess_data); 1937 return rc; 1938 } 1939 1940 int 1941 SMB2_logoff(const unsigned int xid, struct cifs_ses *ses) 1942 { 1943 struct smb_rqst rqst; 1944 struct smb2_logoff_req *req; /* response is also trivial struct */ 1945 int rc = 0; 1946 struct TCP_Server_Info *server; 1947 int flags = 0; 1948 unsigned int total_len; 1949 struct kvec iov[1]; 1950 struct kvec rsp_iov; 1951 int resp_buf_type; 1952 1953 cifs_dbg(FYI, "disconnect session %p\n", ses); 1954 1955 if (ses && (ses->server)) 1956 server = ses->server; 1957 else 1958 return -EIO; 1959 1960 /* no need to send SMB logoff if uid already closed due to reconnect */ 1961 spin_lock(&ses->chan_lock); 1962 if (CIFS_ALL_CHANS_NEED_RECONNECT(ses)) { 1963 spin_unlock(&ses->chan_lock); 1964 goto smb2_session_already_dead; 1965 } 1966 spin_unlock(&ses->chan_lock); 1967 1968 rc = smb2_plain_req_init(SMB2_LOGOFF, NULL, ses->server, 1969 (void **) &req, &total_len); 1970 if (rc) 1971 return rc; 1972 1973 /* since no tcon, smb2_init can not do this, so do here */ 1974 req->hdr.SessionId = cpu_to_le64(ses->Suid); 1975 1976 if (ses->session_flags & SMB2_SESSION_FLAG_ENCRYPT_DATA) 1977 flags |= CIFS_TRANSFORM_REQ; 1978 else if (server->sign) 1979 req->hdr.Flags |= SMB2_FLAGS_SIGNED; 1980 1981 flags |= CIFS_NO_RSP_BUF; 1982 1983 iov[0].iov_base = (char *)req; 1984 iov[0].iov_len = total_len; 1985 1986 memset(&rqst, 0, sizeof(struct smb_rqst)); 1987 rqst.rq_iov = iov; 1988 rqst.rq_nvec = 1; 1989 1990 rc = cifs_send_recv(xid, ses, ses->server, 1991 &rqst, &resp_buf_type, flags, &rsp_iov); 1992 cifs_small_buf_release(req); 1993 /* 1994 * No tcon so can't do 1995 * cifs_stats_inc(&tcon->stats.smb2_stats.smb2_com_fail[SMB2...]); 1996 */ 1997 1998 smb2_session_already_dead: 1999 return rc; 2000 } 2001 2002 static inline void cifs_stats_fail_inc(struct cifs_tcon *tcon, uint16_t code) 2003 { 2004 cifs_stats_inc(&tcon->stats.smb2_stats.smb2_com_failed[code]); 2005 } 2006 2007 #define MAX_SHARENAME_LENGTH (255 /* server */ + 80 /* share */ + 1 /* NULL */) 2008 2009 /* These are similar values to what Windows uses */ 2010 static inline void init_copy_chunk_defaults(struct cifs_tcon *tcon) 2011 { 2012 tcon->max_chunks = 256; 2013 tcon->max_bytes_chunk = 1048576; 2014 tcon->max_bytes_copy = 16777216; 2015 } 2016 2017 int 2018 SMB2_tcon(const unsigned int xid, struct cifs_ses *ses, const char *tree, 2019 struct cifs_tcon *tcon, const struct nls_table *cp) 2020 { 2021 struct smb_rqst rqst; 2022 struct smb2_tree_connect_req *req; 2023 struct smb2_tree_connect_rsp *rsp = NULL; 2024 struct kvec iov[2]; 2025 struct kvec rsp_iov = { NULL, 0 }; 2026 int rc = 0; 2027 int resp_buftype; 2028 int unc_path_len; 2029 __le16 *unc_path = NULL; 2030 int flags = 0; 2031 unsigned int total_len; 2032 struct TCP_Server_Info *server = cifs_pick_channel(ses); 2033 2034 cifs_dbg(FYI, "TCON\n"); 2035 2036 if (!server || !tree) 2037 return -EIO; 2038 2039 unc_path = kmalloc(MAX_SHARENAME_LENGTH * 2, GFP_KERNEL); 2040 if (unc_path == NULL) 2041 return -ENOMEM; 2042 2043 unc_path_len = cifs_strtoUTF16(unc_path, tree, strlen(tree), cp); 2044 if (unc_path_len <= 0) { 2045 kfree(unc_path); 2046 return -EINVAL; 2047 } 2048 unc_path_len *= 2; 2049 2050 /* SMB2 TREE_CONNECT request must be called with TreeId == 0 */ 2051 tcon->tid = 0; 2052 atomic_set(&tcon->num_remote_opens, 0); 2053 rc = smb2_plain_req_init(SMB2_TREE_CONNECT, tcon, server, 2054 (void **) &req, &total_len); 2055 if (rc) { 2056 kfree(unc_path); 2057 return rc; 2058 } 2059 2060 if (smb3_encryption_required(tcon)) 2061 flags |= CIFS_TRANSFORM_REQ; 2062 2063 iov[0].iov_base = (char *)req; 2064 /* 1 for pad */ 2065 iov[0].iov_len = total_len - 1; 2066 2067 /* Testing shows that buffer offset must be at location of Buffer[0] */ 2068 req->PathOffset = cpu_to_le16(sizeof(struct smb2_tree_connect_req)); 2069 req->PathLength = cpu_to_le16(unc_path_len); 2070 iov[1].iov_base = unc_path; 2071 iov[1].iov_len = unc_path_len; 2072 2073 /* 2074 * 3.11 tcon req must be signed if not encrypted. See MS-SMB2 3.2.4.1.1 2075 * unless it is guest or anonymous user. See MS-SMB2 3.2.5.3.1 2076 * (Samba servers don't always set the flag so also check if null user) 2077 */ 2078 if ((server->dialect == SMB311_PROT_ID) && 2079 !smb3_encryption_required(tcon) && 2080 !(ses->session_flags & 2081 (SMB2_SESSION_FLAG_IS_GUEST|SMB2_SESSION_FLAG_IS_NULL)) && 2082 ((ses->user_name != NULL) || (ses->sectype == Kerberos))) 2083 req->hdr.Flags |= SMB2_FLAGS_SIGNED; 2084 2085 memset(&rqst, 0, sizeof(struct smb_rqst)); 2086 rqst.rq_iov = iov; 2087 rqst.rq_nvec = 2; 2088 2089 /* Need 64 for max size write so ask for more in case not there yet */ 2090 if (server->credits >= server->max_credits) 2091 req->hdr.CreditRequest = cpu_to_le16(0); 2092 else 2093 req->hdr.CreditRequest = cpu_to_le16( 2094 min_t(int, server->max_credits - 2095 server->credits, 64)); 2096 2097 rc = cifs_send_recv(xid, ses, server, 2098 &rqst, &resp_buftype, flags, &rsp_iov); 2099 cifs_small_buf_release(req); 2100 rsp = (struct smb2_tree_connect_rsp *)rsp_iov.iov_base; 2101 trace_smb3_tcon(xid, tcon->tid, ses->Suid, tree, rc); 2102 if ((rc != 0) || (rsp == NULL)) { 2103 cifs_stats_fail_inc(tcon, SMB2_TREE_CONNECT_HE); 2104 tcon->need_reconnect = true; 2105 goto tcon_error_exit; 2106 } 2107 2108 switch (rsp->ShareType) { 2109 case SMB2_SHARE_TYPE_DISK: 2110 cifs_dbg(FYI, "connection to disk share\n"); 2111 break; 2112 case SMB2_SHARE_TYPE_PIPE: 2113 tcon->pipe = true; 2114 cifs_dbg(FYI, "connection to pipe share\n"); 2115 break; 2116 case SMB2_SHARE_TYPE_PRINT: 2117 tcon->print = true; 2118 cifs_dbg(FYI, "connection to printer\n"); 2119 break; 2120 default: 2121 cifs_server_dbg(VFS, "unknown share type %d\n", rsp->ShareType); 2122 rc = -EOPNOTSUPP; 2123 goto tcon_error_exit; 2124 } 2125 2126 tcon->share_flags = le32_to_cpu(rsp->ShareFlags); 2127 tcon->capabilities = rsp->Capabilities; /* we keep caps little endian */ 2128 tcon->maximal_access = le32_to_cpu(rsp->MaximalAccess); 2129 tcon->tid = le32_to_cpu(rsp->hdr.Id.SyncId.TreeId); 2130 strscpy(tcon->tree_name, tree, sizeof(tcon->tree_name)); 2131 2132 if ((rsp->Capabilities & SMB2_SHARE_CAP_DFS) && 2133 ((tcon->share_flags & SHI1005_FLAGS_DFS) == 0)) 2134 cifs_tcon_dbg(VFS, "DFS capability contradicts DFS flag\n"); 2135 2136 if (tcon->seal && 2137 !(server->capabilities & SMB2_GLOBAL_CAP_ENCRYPTION)) 2138 cifs_tcon_dbg(VFS, "Encryption is requested but not supported\n"); 2139 2140 init_copy_chunk_defaults(tcon); 2141 if (server->ops->validate_negotiate) 2142 rc = server->ops->validate_negotiate(xid, tcon); 2143 if (rc == 0) /* See MS-SMB2 2.2.10 and 3.2.5.5 */ 2144 if (tcon->share_flags & SMB2_SHAREFLAG_ISOLATED_TRANSPORT) 2145 server->nosharesock = true; 2146 tcon_exit: 2147 2148 free_rsp_buf(resp_buftype, rsp); 2149 kfree(unc_path); 2150 return rc; 2151 2152 tcon_error_exit: 2153 if (rsp && rsp->hdr.Status == STATUS_BAD_NETWORK_NAME) 2154 cifs_dbg(VFS | ONCE, "BAD_NETWORK_NAME: %s\n", tree); 2155 goto tcon_exit; 2156 } 2157 2158 int 2159 SMB2_tdis(const unsigned int xid, struct cifs_tcon *tcon) 2160 { 2161 struct smb_rqst rqst; 2162 struct smb2_tree_disconnect_req *req; /* response is trivial */ 2163 int rc = 0; 2164 struct cifs_ses *ses = tcon->ses; 2165 struct TCP_Server_Info *server = cifs_pick_channel(ses); 2166 int flags = 0; 2167 unsigned int total_len; 2168 struct kvec iov[1]; 2169 struct kvec rsp_iov; 2170 int resp_buf_type; 2171 2172 cifs_dbg(FYI, "Tree Disconnect\n"); 2173 2174 if (!ses || !(ses->server)) 2175 return -EIO; 2176 2177 trace_smb3_tdis_enter(xid, tcon->tid, ses->Suid, tcon->tree_name); 2178 spin_lock(&ses->chan_lock); 2179 if ((tcon->need_reconnect) || 2180 (CIFS_ALL_CHANS_NEED_RECONNECT(tcon->ses))) { 2181 spin_unlock(&ses->chan_lock); 2182 return 0; 2183 } 2184 spin_unlock(&ses->chan_lock); 2185 2186 invalidate_all_cached_dirs(tcon); 2187 2188 rc = smb2_plain_req_init(SMB2_TREE_DISCONNECT, tcon, server, 2189 (void **) &req, 2190 &total_len); 2191 if (rc) 2192 return rc; 2193 2194 if (smb3_encryption_required(tcon)) 2195 flags |= CIFS_TRANSFORM_REQ; 2196 2197 flags |= CIFS_NO_RSP_BUF; 2198 2199 iov[0].iov_base = (char *)req; 2200 iov[0].iov_len = total_len; 2201 2202 memset(&rqst, 0, sizeof(struct smb_rqst)); 2203 rqst.rq_iov = iov; 2204 rqst.rq_nvec = 1; 2205 2206 rc = cifs_send_recv(xid, ses, server, 2207 &rqst, &resp_buf_type, flags, &rsp_iov); 2208 cifs_small_buf_release(req); 2209 if (rc) { 2210 cifs_stats_fail_inc(tcon, SMB2_TREE_DISCONNECT_HE); 2211 trace_smb3_tdis_err(xid, tcon->tid, ses->Suid, rc); 2212 } 2213 trace_smb3_tdis_done(xid, tcon->tid, ses->Suid); 2214 2215 return rc; 2216 } 2217 2218 2219 static struct create_durable * 2220 create_durable_buf(void) 2221 { 2222 struct create_durable *buf; 2223 2224 buf = kzalloc(sizeof(struct create_durable), GFP_KERNEL); 2225 if (!buf) 2226 return NULL; 2227 2228 buf->ccontext.DataOffset = cpu_to_le16(offsetof 2229 (struct create_durable, Data)); 2230 buf->ccontext.DataLength = cpu_to_le32(16); 2231 buf->ccontext.NameOffset = cpu_to_le16(offsetof 2232 (struct create_durable, Name)); 2233 buf->ccontext.NameLength = cpu_to_le16(4); 2234 /* SMB2_CREATE_DURABLE_HANDLE_REQUEST is "DHnQ" */ 2235 buf->Name[0] = 'D'; 2236 buf->Name[1] = 'H'; 2237 buf->Name[2] = 'n'; 2238 buf->Name[3] = 'Q'; 2239 return buf; 2240 } 2241 2242 static struct create_durable * 2243 create_reconnect_durable_buf(struct cifs_fid *fid) 2244 { 2245 struct create_durable *buf; 2246 2247 buf = kzalloc(sizeof(struct create_durable), GFP_KERNEL); 2248 if (!buf) 2249 return NULL; 2250 2251 buf->ccontext.DataOffset = cpu_to_le16(offsetof 2252 (struct create_durable, Data)); 2253 buf->ccontext.DataLength = cpu_to_le32(16); 2254 buf->ccontext.NameOffset = cpu_to_le16(offsetof 2255 (struct create_durable, Name)); 2256 buf->ccontext.NameLength = cpu_to_le16(4); 2257 buf->Data.Fid.PersistentFileId = fid->persistent_fid; 2258 buf->Data.Fid.VolatileFileId = fid->volatile_fid; 2259 /* SMB2_CREATE_DURABLE_HANDLE_RECONNECT is "DHnC" */ 2260 buf->Name[0] = 'D'; 2261 buf->Name[1] = 'H'; 2262 buf->Name[2] = 'n'; 2263 buf->Name[3] = 'C'; 2264 return buf; 2265 } 2266 2267 static void 2268 parse_query_id_ctxt(struct create_context *cc, struct smb2_file_all_info *buf) 2269 { 2270 struct create_disk_id_rsp *pdisk_id = (struct create_disk_id_rsp *)cc; 2271 2272 cifs_dbg(FYI, "parse query id context 0x%llx 0x%llx\n", 2273 pdisk_id->DiskFileId, pdisk_id->VolumeId); 2274 buf->IndexNumber = pdisk_id->DiskFileId; 2275 } 2276 2277 static void 2278 parse_posix_ctxt(struct create_context *cc, struct smb2_file_all_info *info, 2279 struct create_posix_rsp *posix) 2280 { 2281 int sid_len; 2282 u8 *beg = (u8 *)cc + le16_to_cpu(cc->DataOffset); 2283 u8 *end = beg + le32_to_cpu(cc->DataLength); 2284 u8 *sid; 2285 2286 memset(posix, 0, sizeof(*posix)); 2287 2288 posix->nlink = le32_to_cpu(*(__le32 *)(beg + 0)); 2289 posix->reparse_tag = le32_to_cpu(*(__le32 *)(beg + 4)); 2290 posix->mode = le32_to_cpu(*(__le32 *)(beg + 8)); 2291 2292 sid = beg + 12; 2293 sid_len = posix_info_sid_size(sid, end); 2294 if (sid_len < 0) { 2295 cifs_dbg(VFS, "bad owner sid in posix create response\n"); 2296 return; 2297 } 2298 memcpy(&posix->owner, sid, sid_len); 2299 2300 sid = sid + sid_len; 2301 sid_len = posix_info_sid_size(sid, end); 2302 if (sid_len < 0) { 2303 cifs_dbg(VFS, "bad group sid in posix create response\n"); 2304 return; 2305 } 2306 memcpy(&posix->group, sid, sid_len); 2307 2308 cifs_dbg(FYI, "nlink=%d mode=%o reparse_tag=%x\n", 2309 posix->nlink, posix->mode, posix->reparse_tag); 2310 } 2311 2312 int smb2_parse_contexts(struct TCP_Server_Info *server, 2313 struct kvec *rsp_iov, 2314 __u16 *epoch, 2315 char *lease_key, __u8 *oplock, 2316 struct smb2_file_all_info *buf, 2317 struct create_posix_rsp *posix) 2318 { 2319 struct smb2_create_rsp *rsp = rsp_iov->iov_base; 2320 struct create_context *cc; 2321 size_t rem, off, len; 2322 size_t doff, dlen; 2323 size_t noff, nlen; 2324 char *name; 2325 static const char smb3_create_tag_posix[] = { 2326 0x93, 0xAD, 0x25, 0x50, 0x9C, 2327 0xB4, 0x11, 0xE7, 0xB4, 0x23, 0x83, 2328 0xDE, 0x96, 0x8B, 0xCD, 0x7C 2329 }; 2330 2331 *oplock = 0; 2332 2333 off = le32_to_cpu(rsp->CreateContextsOffset); 2334 rem = le32_to_cpu(rsp->CreateContextsLength); 2335 if (check_add_overflow(off, rem, &len) || len > rsp_iov->iov_len) 2336 return -EINVAL; 2337 cc = (struct create_context *)((u8 *)rsp + off); 2338 2339 /* Initialize inode number to 0 in case no valid data in qfid context */ 2340 if (buf) 2341 buf->IndexNumber = 0; 2342 2343 while (rem >= sizeof(*cc)) { 2344 doff = le16_to_cpu(cc->DataOffset); 2345 dlen = le32_to_cpu(cc->DataLength); 2346 if (check_add_overflow(doff, dlen, &len) || len > rem) 2347 return -EINVAL; 2348 2349 noff = le16_to_cpu(cc->NameOffset); 2350 nlen = le16_to_cpu(cc->NameLength); 2351 if (noff + nlen > doff) 2352 return -EINVAL; 2353 2354 name = (char *)cc + noff; 2355 switch (nlen) { 2356 case 4: 2357 if (!strncmp(name, SMB2_CREATE_REQUEST_LEASE, 4)) { 2358 *oplock = server->ops->parse_lease_buf(cc, epoch, 2359 lease_key); 2360 } else if (buf && 2361 !strncmp(name, SMB2_CREATE_QUERY_ON_DISK_ID, 4)) { 2362 parse_query_id_ctxt(cc, buf); 2363 } 2364 break; 2365 case 16: 2366 if (posix && !memcmp(name, smb3_create_tag_posix, 16)) 2367 parse_posix_ctxt(cc, buf, posix); 2368 break; 2369 default: 2370 cifs_dbg(FYI, "%s: unhandled context (nlen=%zu dlen=%zu)\n", 2371 __func__, nlen, dlen); 2372 if (IS_ENABLED(CONFIG_CIFS_DEBUG2)) 2373 cifs_dump_mem("context data: ", cc, dlen); 2374 break; 2375 } 2376 2377 off = le32_to_cpu(cc->Next); 2378 if (!off) 2379 break; 2380 if (check_sub_overflow(rem, off, &rem)) 2381 return -EINVAL; 2382 cc = (struct create_context *)((u8 *)cc + off); 2383 } 2384 2385 if (rsp->OplockLevel != SMB2_OPLOCK_LEVEL_LEASE) 2386 *oplock = rsp->OplockLevel; 2387 2388 return 0; 2389 } 2390 2391 static int 2392 add_lease_context(struct TCP_Server_Info *server, 2393 struct smb2_create_req *req, 2394 struct kvec *iov, 2395 unsigned int *num_iovec, 2396 u8 *lease_key, 2397 __u8 *oplock, 2398 u8 *parent_lease_key, 2399 __le32 flags) 2400 { 2401 unsigned int num = *num_iovec; 2402 2403 iov[num].iov_base = server->ops->create_lease_buf(lease_key, *oplock, 2404 parent_lease_key, flags); 2405 if (iov[num].iov_base == NULL) 2406 return -ENOMEM; 2407 iov[num].iov_len = server->vals->create_lease_size; 2408 req->RequestedOplockLevel = SMB2_OPLOCK_LEVEL_LEASE; 2409 *num_iovec = num + 1; 2410 return 0; 2411 } 2412 2413 static struct create_durable_v2 * 2414 create_durable_v2_buf(struct cifs_open_parms *oparms) 2415 { 2416 struct cifs_fid *pfid = oparms->fid; 2417 struct create_durable_v2 *buf; 2418 2419 buf = kzalloc(sizeof(struct create_durable_v2), GFP_KERNEL); 2420 if (!buf) 2421 return NULL; 2422 2423 buf->ccontext.DataOffset = cpu_to_le16(offsetof 2424 (struct create_durable_v2, dcontext)); 2425 buf->ccontext.DataLength = cpu_to_le32(sizeof(struct durable_context_v2)); 2426 buf->ccontext.NameOffset = cpu_to_le16(offsetof 2427 (struct create_durable_v2, Name)); 2428 buf->ccontext.NameLength = cpu_to_le16(4); 2429 2430 /* 2431 * NB: Handle timeout defaults to 0, which allows server to choose 2432 * (most servers default to 120 seconds) and most clients default to 0. 2433 * This can be overridden at mount ("handletimeout=") if the user wants 2434 * a different persistent (or resilient) handle timeout for all opens 2435 * on a particular SMB3 mount. 2436 */ 2437 buf->dcontext.Timeout = cpu_to_le32(oparms->tcon->handle_timeout); 2438 buf->dcontext.Flags = cpu_to_le32(SMB2_DHANDLE_FLAG_PERSISTENT); 2439 2440 /* for replay, we should not overwrite the existing create guid */ 2441 if (!oparms->replay) { 2442 generate_random_uuid(buf->dcontext.CreateGuid); 2443 memcpy(pfid->create_guid, buf->dcontext.CreateGuid, 16); 2444 } else 2445 memcpy(buf->dcontext.CreateGuid, pfid->create_guid, 16); 2446 2447 /* SMB2_CREATE_DURABLE_HANDLE_REQUEST is "DH2Q" */ 2448 buf->Name[0] = 'D'; 2449 buf->Name[1] = 'H'; 2450 buf->Name[2] = '2'; 2451 buf->Name[3] = 'Q'; 2452 return buf; 2453 } 2454 2455 static struct create_durable_handle_reconnect_v2 * 2456 create_reconnect_durable_v2_buf(struct cifs_fid *fid) 2457 { 2458 struct create_durable_handle_reconnect_v2 *buf; 2459 2460 buf = kzalloc(sizeof(struct create_durable_handle_reconnect_v2), 2461 GFP_KERNEL); 2462 if (!buf) 2463 return NULL; 2464 2465 buf->ccontext.DataOffset = 2466 cpu_to_le16(offsetof(struct create_durable_handle_reconnect_v2, 2467 dcontext)); 2468 buf->ccontext.DataLength = 2469 cpu_to_le32(sizeof(struct durable_reconnect_context_v2)); 2470 buf->ccontext.NameOffset = 2471 cpu_to_le16(offsetof(struct create_durable_handle_reconnect_v2, 2472 Name)); 2473 buf->ccontext.NameLength = cpu_to_le16(4); 2474 2475 buf->dcontext.Fid.PersistentFileId = fid->persistent_fid; 2476 buf->dcontext.Fid.VolatileFileId = fid->volatile_fid; 2477 buf->dcontext.Flags = cpu_to_le32(SMB2_DHANDLE_FLAG_PERSISTENT); 2478 memcpy(buf->dcontext.CreateGuid, fid->create_guid, 16); 2479 2480 /* SMB2_CREATE_DURABLE_HANDLE_RECONNECT_V2 is "DH2C" */ 2481 buf->Name[0] = 'D'; 2482 buf->Name[1] = 'H'; 2483 buf->Name[2] = '2'; 2484 buf->Name[3] = 'C'; 2485 return buf; 2486 } 2487 2488 static int 2489 add_durable_v2_context(struct kvec *iov, unsigned int *num_iovec, 2490 struct cifs_open_parms *oparms) 2491 { 2492 unsigned int num = *num_iovec; 2493 2494 iov[num].iov_base = create_durable_v2_buf(oparms); 2495 if (iov[num].iov_base == NULL) 2496 return -ENOMEM; 2497 iov[num].iov_len = sizeof(struct create_durable_v2); 2498 *num_iovec = num + 1; 2499 return 0; 2500 } 2501 2502 static int 2503 add_durable_reconnect_v2_context(struct kvec *iov, unsigned int *num_iovec, 2504 struct cifs_open_parms *oparms) 2505 { 2506 unsigned int num = *num_iovec; 2507 2508 /* indicate that we don't need to relock the file */ 2509 oparms->reconnect = false; 2510 2511 iov[num].iov_base = create_reconnect_durable_v2_buf(oparms->fid); 2512 if (iov[num].iov_base == NULL) 2513 return -ENOMEM; 2514 iov[num].iov_len = sizeof(struct create_durable_handle_reconnect_v2); 2515 *num_iovec = num + 1; 2516 return 0; 2517 } 2518 2519 static int 2520 add_durable_context(struct kvec *iov, unsigned int *num_iovec, 2521 struct cifs_open_parms *oparms, bool use_persistent) 2522 { 2523 unsigned int num = *num_iovec; 2524 2525 if (use_persistent) { 2526 if (oparms->reconnect) 2527 return add_durable_reconnect_v2_context(iov, num_iovec, 2528 oparms); 2529 else 2530 return add_durable_v2_context(iov, num_iovec, oparms); 2531 } 2532 2533 if (oparms->reconnect) { 2534 iov[num].iov_base = create_reconnect_durable_buf(oparms->fid); 2535 /* indicate that we don't need to relock the file */ 2536 oparms->reconnect = false; 2537 } else 2538 iov[num].iov_base = create_durable_buf(); 2539 if (iov[num].iov_base == NULL) 2540 return -ENOMEM; 2541 iov[num].iov_len = sizeof(struct create_durable); 2542 *num_iovec = num + 1; 2543 return 0; 2544 } 2545 2546 /* See MS-SMB2 2.2.13.2.7 */ 2547 static struct crt_twarp_ctxt * 2548 create_twarp_buf(__u64 timewarp) 2549 { 2550 struct crt_twarp_ctxt *buf; 2551 2552 buf = kzalloc(sizeof(struct crt_twarp_ctxt), GFP_KERNEL); 2553 if (!buf) 2554 return NULL; 2555 2556 buf->ccontext.DataOffset = cpu_to_le16(offsetof 2557 (struct crt_twarp_ctxt, Timestamp)); 2558 buf->ccontext.DataLength = cpu_to_le32(8); 2559 buf->ccontext.NameOffset = cpu_to_le16(offsetof 2560 (struct crt_twarp_ctxt, Name)); 2561 buf->ccontext.NameLength = cpu_to_le16(4); 2562 /* SMB2_CREATE_TIMEWARP_TOKEN is "TWrp" */ 2563 buf->Name[0] = 'T'; 2564 buf->Name[1] = 'W'; 2565 buf->Name[2] = 'r'; 2566 buf->Name[3] = 'p'; 2567 buf->Timestamp = cpu_to_le64(timewarp); 2568 return buf; 2569 } 2570 2571 /* See MS-SMB2 2.2.13.2.7 */ 2572 static int 2573 add_twarp_context(struct kvec *iov, unsigned int *num_iovec, __u64 timewarp) 2574 { 2575 unsigned int num = *num_iovec; 2576 2577 iov[num].iov_base = create_twarp_buf(timewarp); 2578 if (iov[num].iov_base == NULL) 2579 return -ENOMEM; 2580 iov[num].iov_len = sizeof(struct crt_twarp_ctxt); 2581 *num_iovec = num + 1; 2582 return 0; 2583 } 2584 2585 /* See http://technet.microsoft.com/en-us/library/hh509017(v=ws.10).aspx */ 2586 static void setup_owner_group_sids(char *buf) 2587 { 2588 struct owner_group_sids *sids = (struct owner_group_sids *)buf; 2589 2590 /* Populate the user ownership fields S-1-5-88-1 */ 2591 sids->owner.Revision = 1; 2592 sids->owner.NumAuth = 3; 2593 sids->owner.Authority[5] = 5; 2594 sids->owner.SubAuthorities[0] = cpu_to_le32(88); 2595 sids->owner.SubAuthorities[1] = cpu_to_le32(1); 2596 sids->owner.SubAuthorities[2] = cpu_to_le32(current_fsuid().val); 2597 2598 /* Populate the group ownership fields S-1-5-88-2 */ 2599 sids->group.Revision = 1; 2600 sids->group.NumAuth = 3; 2601 sids->group.Authority[5] = 5; 2602 sids->group.SubAuthorities[0] = cpu_to_le32(88); 2603 sids->group.SubAuthorities[1] = cpu_to_le32(2); 2604 sids->group.SubAuthorities[2] = cpu_to_le32(current_fsgid().val); 2605 2606 cifs_dbg(FYI, "owner S-1-5-88-1-%d, group S-1-5-88-2-%d\n", current_fsuid().val, current_fsgid().val); 2607 } 2608 2609 /* See MS-SMB2 2.2.13.2.2 and MS-DTYP 2.4.6 */ 2610 static struct crt_sd_ctxt * 2611 create_sd_buf(umode_t mode, bool set_owner, unsigned int *len) 2612 { 2613 struct crt_sd_ctxt *buf; 2614 __u8 *ptr, *aclptr; 2615 unsigned int acelen, acl_size, ace_count; 2616 unsigned int owner_offset = 0; 2617 unsigned int group_offset = 0; 2618 struct smb3_acl acl = {}; 2619 2620 *len = round_up(sizeof(struct crt_sd_ctxt) + (sizeof(struct smb_ace) * 4), 8); 2621 2622 if (set_owner) { 2623 /* sizeof(struct owner_group_sids) is already multiple of 8 so no need to round */ 2624 *len += sizeof(struct owner_group_sids); 2625 } 2626 2627 buf = kzalloc(*len, GFP_KERNEL); 2628 if (buf == NULL) 2629 return buf; 2630 2631 ptr = (__u8 *)&buf[1]; 2632 if (set_owner) { 2633 /* offset fields are from beginning of security descriptor not of create context */ 2634 owner_offset = ptr - (__u8 *)&buf->sd; 2635 buf->sd.OffsetOwner = cpu_to_le32(owner_offset); 2636 group_offset = owner_offset + offsetof(struct owner_group_sids, group); 2637 buf->sd.OffsetGroup = cpu_to_le32(group_offset); 2638 2639 setup_owner_group_sids(ptr); 2640 ptr += sizeof(struct owner_group_sids); 2641 } else { 2642 buf->sd.OffsetOwner = 0; 2643 buf->sd.OffsetGroup = 0; 2644 } 2645 2646 buf->ccontext.DataOffset = cpu_to_le16(offsetof(struct crt_sd_ctxt, sd)); 2647 buf->ccontext.NameOffset = cpu_to_le16(offsetof(struct crt_sd_ctxt, Name)); 2648 buf->ccontext.NameLength = cpu_to_le16(4); 2649 /* SMB2_CREATE_SD_BUFFER_TOKEN is "SecD" */ 2650 buf->Name[0] = 'S'; 2651 buf->Name[1] = 'e'; 2652 buf->Name[2] = 'c'; 2653 buf->Name[3] = 'D'; 2654 buf->sd.Revision = 1; /* Must be one see MS-DTYP 2.4.6 */ 2655 2656 /* 2657 * ACL is "self relative" ie ACL is stored in contiguous block of memory 2658 * and "DP" ie the DACL is present 2659 */ 2660 buf->sd.Control = cpu_to_le16(ACL_CONTROL_SR | ACL_CONTROL_DP); 2661 2662 /* offset owner, group and Sbz1 and SACL are all zero */ 2663 buf->sd.OffsetDacl = cpu_to_le32(ptr - (__u8 *)&buf->sd); 2664 /* Ship the ACL for now. we will copy it into buf later. */ 2665 aclptr = ptr; 2666 ptr += sizeof(struct smb3_acl); 2667 2668 /* create one ACE to hold the mode embedded in reserved special SID */ 2669 acelen = setup_special_mode_ACE((struct smb_ace *)ptr, false, (__u64)mode); 2670 ptr += acelen; 2671 acl_size = acelen + sizeof(struct smb3_acl); 2672 ace_count = 1; 2673 2674 if (set_owner) { 2675 /* we do not need to reallocate buffer to add the two more ACEs. plenty of space */ 2676 acelen = setup_special_user_owner_ACE((struct smb_ace *)ptr); 2677 ptr += acelen; 2678 acl_size += acelen; 2679 ace_count += 1; 2680 } 2681 2682 /* and one more ACE to allow access for authenticated users */ 2683 acelen = setup_authusers_ACE((struct smb_ace *)ptr); 2684 ptr += acelen; 2685 acl_size += acelen; 2686 ace_count += 1; 2687 2688 acl.AclRevision = ACL_REVISION; /* See 2.4.4.1 of MS-DTYP */ 2689 acl.AclSize = cpu_to_le16(acl_size); 2690 acl.AceCount = cpu_to_le16(ace_count); 2691 /* acl.Sbz1 and Sbz2 MBZ so are not set here, but initialized above */ 2692 memcpy(aclptr, &acl, sizeof(struct smb3_acl)); 2693 2694 buf->ccontext.DataLength = cpu_to_le32(ptr - (__u8 *)&buf->sd); 2695 *len = round_up((unsigned int)(ptr - (__u8 *)buf), 8); 2696 2697 return buf; 2698 } 2699 2700 static int 2701 add_sd_context(struct kvec *iov, unsigned int *num_iovec, umode_t mode, bool set_owner) 2702 { 2703 unsigned int num = *num_iovec; 2704 unsigned int len = 0; 2705 2706 iov[num].iov_base = create_sd_buf(mode, set_owner, &len); 2707 if (iov[num].iov_base == NULL) 2708 return -ENOMEM; 2709 iov[num].iov_len = len; 2710 *num_iovec = num + 1; 2711 return 0; 2712 } 2713 2714 static struct crt_query_id_ctxt * 2715 create_query_id_buf(void) 2716 { 2717 struct crt_query_id_ctxt *buf; 2718 2719 buf = kzalloc(sizeof(struct crt_query_id_ctxt), GFP_KERNEL); 2720 if (!buf) 2721 return NULL; 2722 2723 buf->ccontext.DataOffset = cpu_to_le16(0); 2724 buf->ccontext.DataLength = cpu_to_le32(0); 2725 buf->ccontext.NameOffset = cpu_to_le16(offsetof 2726 (struct crt_query_id_ctxt, Name)); 2727 buf->ccontext.NameLength = cpu_to_le16(4); 2728 /* SMB2_CREATE_QUERY_ON_DISK_ID is "QFid" */ 2729 buf->Name[0] = 'Q'; 2730 buf->Name[1] = 'F'; 2731 buf->Name[2] = 'i'; 2732 buf->Name[3] = 'd'; 2733 return buf; 2734 } 2735 2736 /* See MS-SMB2 2.2.13.2.9 */ 2737 static int 2738 add_query_id_context(struct kvec *iov, unsigned int *num_iovec) 2739 { 2740 unsigned int num = *num_iovec; 2741 2742 iov[num].iov_base = create_query_id_buf(); 2743 if (iov[num].iov_base == NULL) 2744 return -ENOMEM; 2745 iov[num].iov_len = sizeof(struct crt_query_id_ctxt); 2746 *num_iovec = num + 1; 2747 return 0; 2748 } 2749 2750 static void add_ea_context(struct cifs_open_parms *oparms, 2751 struct kvec *rq_iov, unsigned int *num_iovs) 2752 { 2753 struct kvec *iov = oparms->ea_cctx; 2754 2755 if (iov && iov->iov_base && iov->iov_len) { 2756 rq_iov[(*num_iovs)++] = *iov; 2757 memset(iov, 0, sizeof(*iov)); 2758 } 2759 } 2760 2761 static int 2762 alloc_path_with_tree_prefix(__le16 **out_path, int *out_size, int *out_len, 2763 const char *treename, const __le16 *path) 2764 { 2765 int treename_len, path_len; 2766 struct nls_table *cp; 2767 const __le16 sep[] = {cpu_to_le16('\\'), cpu_to_le16(0x0000)}; 2768 2769 /* 2770 * skip leading "\\" 2771 */ 2772 treename_len = strlen(treename); 2773 if (treename_len < 2 || !(treename[0] == '\\' && treename[1] == '\\')) 2774 return -EINVAL; 2775 2776 treename += 2; 2777 treename_len -= 2; 2778 2779 path_len = UniStrnlen((wchar_t *)path, PATH_MAX); 2780 2781 /* make room for one path separator only if @path isn't empty */ 2782 *out_len = treename_len + (path[0] ? 1 : 0) + path_len; 2783 2784 /* 2785 * final path needs to be 8-byte aligned as specified in 2786 * MS-SMB2 2.2.13 SMB2 CREATE Request. 2787 */ 2788 *out_size = round_up(*out_len * sizeof(__le16), 8); 2789 *out_path = kzalloc(*out_size + sizeof(__le16) /* null */, GFP_KERNEL); 2790 if (!*out_path) 2791 return -ENOMEM; 2792 2793 cp = load_nls_default(); 2794 cifs_strtoUTF16(*out_path, treename, treename_len, cp); 2795 2796 /* Do not append the separator if the path is empty */ 2797 if (path[0] != cpu_to_le16(0x0000)) { 2798 UniStrcat((wchar_t *)*out_path, (wchar_t *)sep); 2799 UniStrcat((wchar_t *)*out_path, (wchar_t *)path); 2800 } 2801 2802 unload_nls(cp); 2803 2804 return 0; 2805 } 2806 2807 int smb311_posix_mkdir(const unsigned int xid, struct inode *inode, 2808 umode_t mode, struct cifs_tcon *tcon, 2809 const char *full_path, 2810 struct cifs_sb_info *cifs_sb) 2811 { 2812 struct smb_rqst rqst; 2813 struct smb2_create_req *req; 2814 struct smb2_create_rsp *rsp = NULL; 2815 struct cifs_ses *ses = tcon->ses; 2816 struct kvec iov[3]; /* make sure at least one for each open context */ 2817 struct kvec rsp_iov = {NULL, 0}; 2818 int resp_buftype; 2819 int uni_path_len; 2820 __le16 *copy_path = NULL; 2821 int copy_size; 2822 int rc = 0; 2823 unsigned int n_iov = 2; 2824 __u32 file_attributes = 0; 2825 char *pc_buf = NULL; 2826 int flags = 0; 2827 unsigned int total_len; 2828 __le16 *utf16_path = NULL; 2829 struct TCP_Server_Info *server; 2830 int retries = 0, cur_sleep = 1; 2831 2832 replay_again: 2833 /* reinitialize for possible replay */ 2834 flags = 0; 2835 n_iov = 2; 2836 server = cifs_pick_channel(ses); 2837 2838 cifs_dbg(FYI, "mkdir\n"); 2839 2840 /* resource #1: path allocation */ 2841 utf16_path = cifs_convert_path_to_utf16(full_path, cifs_sb); 2842 if (!utf16_path) 2843 return -ENOMEM; 2844 2845 if (!ses || !server) { 2846 rc = -EIO; 2847 goto err_free_path; 2848 } 2849 2850 /* resource #2: request */ 2851 rc = smb2_plain_req_init(SMB2_CREATE, tcon, server, 2852 (void **) &req, &total_len); 2853 if (rc) 2854 goto err_free_path; 2855 2856 2857 if (smb3_encryption_required(tcon)) 2858 flags |= CIFS_TRANSFORM_REQ; 2859 2860 req->ImpersonationLevel = IL_IMPERSONATION; 2861 req->DesiredAccess = cpu_to_le32(FILE_WRITE_ATTRIBUTES); 2862 /* File attributes ignored on open (used in create though) */ 2863 req->FileAttributes = cpu_to_le32(file_attributes); 2864 req->ShareAccess = FILE_SHARE_ALL_LE; 2865 req->CreateDisposition = cpu_to_le32(FILE_CREATE); 2866 req->CreateOptions = cpu_to_le32(CREATE_NOT_FILE); 2867 2868 iov[0].iov_base = (char *)req; 2869 /* -1 since last byte is buf[0] which is sent below (path) */ 2870 iov[0].iov_len = total_len - 1; 2871 2872 req->NameOffset = cpu_to_le16(sizeof(struct smb2_create_req)); 2873 2874 /* [MS-SMB2] 2.2.13 NameOffset: 2875 * If SMB2_FLAGS_DFS_OPERATIONS is set in the Flags field of 2876 * the SMB2 header, the file name includes a prefix that will 2877 * be processed during DFS name normalization as specified in 2878 * section 3.3.5.9. Otherwise, the file name is relative to 2879 * the share that is identified by the TreeId in the SMB2 2880 * header. 2881 */ 2882 if (tcon->share_flags & SHI1005_FLAGS_DFS) { 2883 int name_len; 2884 2885 req->hdr.Flags |= SMB2_FLAGS_DFS_OPERATIONS; 2886 rc = alloc_path_with_tree_prefix(©_path, ©_size, 2887 &name_len, 2888 tcon->tree_name, utf16_path); 2889 if (rc) 2890 goto err_free_req; 2891 2892 req->NameLength = cpu_to_le16(name_len * 2); 2893 uni_path_len = copy_size; 2894 /* free before overwriting resource */ 2895 kfree(utf16_path); 2896 utf16_path = copy_path; 2897 } else { 2898 uni_path_len = (2 * UniStrnlen((wchar_t *)utf16_path, PATH_MAX)) + 2; 2899 /* MUST set path len (NameLength) to 0 opening root of share */ 2900 req->NameLength = cpu_to_le16(uni_path_len - 2); 2901 if (uni_path_len % 8 != 0) { 2902 copy_size = roundup(uni_path_len, 8); 2903 copy_path = kzalloc(copy_size, GFP_KERNEL); 2904 if (!copy_path) { 2905 rc = -ENOMEM; 2906 goto err_free_req; 2907 } 2908 memcpy((char *)copy_path, (const char *)utf16_path, 2909 uni_path_len); 2910 uni_path_len = copy_size; 2911 /* free before overwriting resource */ 2912 kfree(utf16_path); 2913 utf16_path = copy_path; 2914 } 2915 } 2916 2917 iov[1].iov_len = uni_path_len; 2918 iov[1].iov_base = utf16_path; 2919 req->RequestedOplockLevel = SMB2_OPLOCK_LEVEL_NONE; 2920 2921 if (tcon->posix_extensions) { 2922 /* resource #3: posix buf */ 2923 rc = add_posix_context(iov, &n_iov, mode); 2924 if (rc) 2925 goto err_free_req; 2926 req->CreateContextsOffset = cpu_to_le32( 2927 sizeof(struct smb2_create_req) + 2928 iov[1].iov_len); 2929 le32_add_cpu(&req->CreateContextsLength, iov[n_iov-1].iov_len); 2930 pc_buf = iov[n_iov-1].iov_base; 2931 } 2932 2933 2934 memset(&rqst, 0, sizeof(struct smb_rqst)); 2935 rqst.rq_iov = iov; 2936 rqst.rq_nvec = n_iov; 2937 2938 /* no need to inc num_remote_opens because we close it just below */ 2939 trace_smb3_posix_mkdir_enter(xid, tcon->tid, ses->Suid, full_path, CREATE_NOT_FILE, 2940 FILE_WRITE_ATTRIBUTES); 2941 2942 if (retries) 2943 smb2_set_replay(server, &rqst); 2944 2945 /* resource #4: response buffer */ 2946 rc = cifs_send_recv(xid, ses, server, 2947 &rqst, &resp_buftype, flags, &rsp_iov); 2948 if (rc) { 2949 cifs_stats_fail_inc(tcon, SMB2_CREATE_HE); 2950 trace_smb3_posix_mkdir_err(xid, tcon->tid, ses->Suid, 2951 CREATE_NOT_FILE, 2952 FILE_WRITE_ATTRIBUTES, rc); 2953 goto err_free_rsp_buf; 2954 } 2955 2956 /* 2957 * Although unlikely to be possible for rsp to be null and rc not set, 2958 * adding check below is slightly safer long term (and quiets Coverity 2959 * warning) 2960 */ 2961 rsp = (struct smb2_create_rsp *)rsp_iov.iov_base; 2962 if (rsp == NULL) { 2963 rc = -EIO; 2964 kfree(pc_buf); 2965 goto err_free_req; 2966 } 2967 2968 trace_smb3_posix_mkdir_done(xid, rsp->PersistentFileId, tcon->tid, ses->Suid, 2969 CREATE_NOT_FILE, FILE_WRITE_ATTRIBUTES); 2970 2971 SMB2_close(xid, tcon, rsp->PersistentFileId, rsp->VolatileFileId); 2972 2973 /* Eventually save off posix specific response info and timestamps */ 2974 2975 err_free_rsp_buf: 2976 free_rsp_buf(resp_buftype, rsp_iov.iov_base); 2977 kfree(pc_buf); 2978 err_free_req: 2979 cifs_small_buf_release(req); 2980 err_free_path: 2981 kfree(utf16_path); 2982 2983 if (is_replayable_error(rc) && 2984 smb2_should_replay(tcon, &retries, &cur_sleep)) 2985 goto replay_again; 2986 2987 return rc; 2988 } 2989 2990 int 2991 SMB2_open_init(struct cifs_tcon *tcon, struct TCP_Server_Info *server, 2992 struct smb_rqst *rqst, __u8 *oplock, 2993 struct cifs_open_parms *oparms, __le16 *path) 2994 { 2995 struct smb2_create_req *req; 2996 unsigned int n_iov = 2; 2997 __u32 file_attributes = 0; 2998 int copy_size; 2999 int uni_path_len; 3000 unsigned int total_len; 3001 struct kvec *iov = rqst->rq_iov; 3002 __le16 *copy_path; 3003 int rc; 3004 3005 rc = smb2_plain_req_init(SMB2_CREATE, tcon, server, 3006 (void **) &req, &total_len); 3007 if (rc) 3008 return rc; 3009 3010 iov[0].iov_base = (char *)req; 3011 /* -1 since last byte is buf[0] which is sent below (path) */ 3012 iov[0].iov_len = total_len - 1; 3013 3014 if (oparms->create_options & CREATE_OPTION_READONLY) 3015 file_attributes |= ATTR_READONLY; 3016 if (oparms->create_options & CREATE_OPTION_SPECIAL) 3017 file_attributes |= ATTR_SYSTEM; 3018 3019 req->ImpersonationLevel = IL_IMPERSONATION; 3020 req->DesiredAccess = cpu_to_le32(oparms->desired_access); 3021 /* File attributes ignored on open (used in create though) */ 3022 req->FileAttributes = cpu_to_le32(file_attributes); 3023 req->ShareAccess = FILE_SHARE_ALL_LE; 3024 3025 req->CreateDisposition = cpu_to_le32(oparms->disposition); 3026 req->CreateOptions = cpu_to_le32(oparms->create_options & CREATE_OPTIONS_MASK); 3027 req->NameOffset = cpu_to_le16(sizeof(struct smb2_create_req)); 3028 3029 /* [MS-SMB2] 2.2.13 NameOffset: 3030 * If SMB2_FLAGS_DFS_OPERATIONS is set in the Flags field of 3031 * the SMB2 header, the file name includes a prefix that will 3032 * be processed during DFS name normalization as specified in 3033 * section 3.3.5.9. Otherwise, the file name is relative to 3034 * the share that is identified by the TreeId in the SMB2 3035 * header. 3036 */ 3037 if (tcon->share_flags & SHI1005_FLAGS_DFS) { 3038 int name_len; 3039 3040 req->hdr.Flags |= SMB2_FLAGS_DFS_OPERATIONS; 3041 rc = alloc_path_with_tree_prefix(©_path, ©_size, 3042 &name_len, 3043 tcon->tree_name, path); 3044 if (rc) 3045 return rc; 3046 req->NameLength = cpu_to_le16(name_len * 2); 3047 uni_path_len = copy_size; 3048 path = copy_path; 3049 } else { 3050 uni_path_len = (2 * UniStrnlen((wchar_t *)path, PATH_MAX)) + 2; 3051 /* MUST set path len (NameLength) to 0 opening root of share */ 3052 req->NameLength = cpu_to_le16(uni_path_len - 2); 3053 copy_size = round_up(uni_path_len, 8); 3054 copy_path = kzalloc(copy_size, GFP_KERNEL); 3055 if (!copy_path) 3056 return -ENOMEM; 3057 memcpy((char *)copy_path, (const char *)path, 3058 uni_path_len); 3059 uni_path_len = copy_size; 3060 path = copy_path; 3061 } 3062 3063 iov[1].iov_len = uni_path_len; 3064 iov[1].iov_base = path; 3065 3066 if ((!server->oplocks) || (tcon->no_lease)) 3067 *oplock = SMB2_OPLOCK_LEVEL_NONE; 3068 3069 if (!(server->capabilities & SMB2_GLOBAL_CAP_LEASING) || 3070 *oplock == SMB2_OPLOCK_LEVEL_NONE) 3071 req->RequestedOplockLevel = *oplock; 3072 else if (!(server->capabilities & SMB2_GLOBAL_CAP_DIRECTORY_LEASING) && 3073 (oparms->create_options & CREATE_NOT_FILE)) 3074 req->RequestedOplockLevel = *oplock; /* no srv lease support */ 3075 else { 3076 rc = add_lease_context(server, req, iov, &n_iov, 3077 oparms->fid->lease_key, oplock, 3078 oparms->fid->parent_lease_key, 3079 oparms->lease_flags); 3080 if (rc) 3081 return rc; 3082 } 3083 3084 if (*oplock == SMB2_OPLOCK_LEVEL_BATCH) { 3085 rc = add_durable_context(iov, &n_iov, oparms, 3086 tcon->use_persistent); 3087 if (rc) 3088 return rc; 3089 } 3090 3091 if (tcon->posix_extensions) { 3092 rc = add_posix_context(iov, &n_iov, oparms->mode); 3093 if (rc) 3094 return rc; 3095 } 3096 3097 if (tcon->snapshot_time) { 3098 cifs_dbg(FYI, "adding snapshot context\n"); 3099 rc = add_twarp_context(iov, &n_iov, tcon->snapshot_time); 3100 if (rc) 3101 return rc; 3102 } 3103 3104 if ((oparms->disposition != FILE_OPEN) && (oparms->cifs_sb)) { 3105 bool set_mode; 3106 bool set_owner; 3107 3108 if ((oparms->cifs_sb->mnt_cifs_flags & CIFS_MOUNT_MODE_FROM_SID) && 3109 (oparms->mode != ACL_NO_MODE)) 3110 set_mode = true; 3111 else { 3112 set_mode = false; 3113 oparms->mode = ACL_NO_MODE; 3114 } 3115 3116 if (oparms->cifs_sb->mnt_cifs_flags & CIFS_MOUNT_UID_FROM_ACL) 3117 set_owner = true; 3118 else 3119 set_owner = false; 3120 3121 if (set_owner | set_mode) { 3122 cifs_dbg(FYI, "add sd with mode 0x%x\n", oparms->mode); 3123 rc = add_sd_context(iov, &n_iov, oparms->mode, set_owner); 3124 if (rc) 3125 return rc; 3126 } 3127 } 3128 3129 add_query_id_context(iov, &n_iov); 3130 add_ea_context(oparms, iov, &n_iov); 3131 3132 if (n_iov > 2) { 3133 /* 3134 * We have create contexts behind iov[1] (the file 3135 * name), point at them from the main create request 3136 */ 3137 req->CreateContextsOffset = cpu_to_le32( 3138 sizeof(struct smb2_create_req) + 3139 iov[1].iov_len); 3140 req->CreateContextsLength = 0; 3141 3142 for (unsigned int i = 2; i < (n_iov-1); i++) { 3143 struct kvec *v = &iov[i]; 3144 size_t len = v->iov_len; 3145 struct create_context *cctx = 3146 (struct create_context *)v->iov_base; 3147 3148 cctx->Next = cpu_to_le32(len); 3149 le32_add_cpu(&req->CreateContextsLength, len); 3150 } 3151 le32_add_cpu(&req->CreateContextsLength, 3152 iov[n_iov-1].iov_len); 3153 } 3154 3155 rqst->rq_nvec = n_iov; 3156 return 0; 3157 } 3158 3159 /* rq_iov[0] is the request and is released by cifs_small_buf_release(). 3160 * All other vectors are freed by kfree(). 3161 */ 3162 void 3163 SMB2_open_free(struct smb_rqst *rqst) 3164 { 3165 int i; 3166 3167 if (rqst && rqst->rq_iov) { 3168 cifs_small_buf_release(rqst->rq_iov[0].iov_base); 3169 for (i = 1; i < rqst->rq_nvec; i++) 3170 if (rqst->rq_iov[i].iov_base != smb2_padding) 3171 kfree(rqst->rq_iov[i].iov_base); 3172 } 3173 } 3174 3175 int 3176 SMB2_open(const unsigned int xid, struct cifs_open_parms *oparms, __le16 *path, 3177 __u8 *oplock, struct smb2_file_all_info *buf, 3178 struct create_posix_rsp *posix, 3179 struct kvec *err_iov, int *buftype) 3180 { 3181 struct smb_rqst rqst; 3182 struct smb2_create_rsp *rsp = NULL; 3183 struct cifs_tcon *tcon = oparms->tcon; 3184 struct cifs_ses *ses = tcon->ses; 3185 struct TCP_Server_Info *server; 3186 struct kvec iov[SMB2_CREATE_IOV_SIZE]; 3187 struct kvec rsp_iov = {NULL, 0}; 3188 int resp_buftype = CIFS_NO_BUFFER; 3189 int rc = 0; 3190 int flags = 0; 3191 int retries = 0, cur_sleep = 1; 3192 3193 replay_again: 3194 /* reinitialize for possible replay */ 3195 flags = 0; 3196 server = cifs_pick_channel(ses); 3197 oparms->replay = !!(retries); 3198 3199 cifs_dbg(FYI, "create/open\n"); 3200 if (!ses || !server) 3201 return -EIO; 3202 3203 if (smb3_encryption_required(tcon)) 3204 flags |= CIFS_TRANSFORM_REQ; 3205 3206 memset(&rqst, 0, sizeof(struct smb_rqst)); 3207 memset(&iov, 0, sizeof(iov)); 3208 rqst.rq_iov = iov; 3209 rqst.rq_nvec = SMB2_CREATE_IOV_SIZE; 3210 3211 rc = SMB2_open_init(tcon, server, 3212 &rqst, oplock, oparms, path); 3213 if (rc) 3214 goto creat_exit; 3215 3216 trace_smb3_open_enter(xid, tcon->tid, tcon->ses->Suid, oparms->path, 3217 oparms->create_options, oparms->desired_access); 3218 3219 if (retries) 3220 smb2_set_replay(server, &rqst); 3221 3222 rc = cifs_send_recv(xid, ses, server, 3223 &rqst, &resp_buftype, flags, 3224 &rsp_iov); 3225 rsp = (struct smb2_create_rsp *)rsp_iov.iov_base; 3226 3227 if (rc != 0) { 3228 cifs_stats_fail_inc(tcon, SMB2_CREATE_HE); 3229 if (err_iov && rsp) { 3230 *err_iov = rsp_iov; 3231 *buftype = resp_buftype; 3232 resp_buftype = CIFS_NO_BUFFER; 3233 rsp = NULL; 3234 } 3235 trace_smb3_open_err(xid, tcon->tid, ses->Suid, 3236 oparms->create_options, oparms->desired_access, rc); 3237 if (rc == -EREMCHG) { 3238 pr_warn_once("server share %s deleted\n", 3239 tcon->tree_name); 3240 tcon->need_reconnect = true; 3241 } 3242 goto creat_exit; 3243 } else if (rsp == NULL) /* unlikely to happen, but safer to check */ 3244 goto creat_exit; 3245 else 3246 trace_smb3_open_done(xid, rsp->PersistentFileId, tcon->tid, ses->Suid, 3247 oparms->create_options, oparms->desired_access); 3248 3249 atomic_inc(&tcon->num_remote_opens); 3250 oparms->fid->persistent_fid = rsp->PersistentFileId; 3251 oparms->fid->volatile_fid = rsp->VolatileFileId; 3252 oparms->fid->access = oparms->desired_access; 3253 #ifdef CONFIG_CIFS_DEBUG2 3254 oparms->fid->mid = le64_to_cpu(rsp->hdr.MessageId); 3255 #endif /* CIFS_DEBUG2 */ 3256 3257 if (buf) { 3258 buf->CreationTime = rsp->CreationTime; 3259 buf->LastAccessTime = rsp->LastAccessTime; 3260 buf->LastWriteTime = rsp->LastWriteTime; 3261 buf->ChangeTime = rsp->ChangeTime; 3262 buf->AllocationSize = rsp->AllocationSize; 3263 buf->EndOfFile = rsp->EndofFile; 3264 buf->Attributes = rsp->FileAttributes; 3265 buf->NumberOfLinks = cpu_to_le32(1); 3266 buf->DeletePending = 0; 3267 } 3268 3269 3270 rc = smb2_parse_contexts(server, &rsp_iov, &oparms->fid->epoch, 3271 oparms->fid->lease_key, oplock, buf, posix); 3272 creat_exit: 3273 SMB2_open_free(&rqst); 3274 free_rsp_buf(resp_buftype, rsp); 3275 3276 if (is_replayable_error(rc) && 3277 smb2_should_replay(tcon, &retries, &cur_sleep)) 3278 goto replay_again; 3279 3280 return rc; 3281 } 3282 3283 int 3284 SMB2_ioctl_init(struct cifs_tcon *tcon, struct TCP_Server_Info *server, 3285 struct smb_rqst *rqst, 3286 u64 persistent_fid, u64 volatile_fid, u32 opcode, 3287 char *in_data, u32 indatalen, 3288 __u32 max_response_size) 3289 { 3290 struct smb2_ioctl_req *req; 3291 struct kvec *iov = rqst->rq_iov; 3292 unsigned int total_len; 3293 int rc; 3294 char *in_data_buf; 3295 3296 rc = smb2_ioctl_req_init(opcode, tcon, server, 3297 (void **) &req, &total_len); 3298 if (rc) 3299 return rc; 3300 3301 if (indatalen) { 3302 /* 3303 * indatalen is usually small at a couple of bytes max, so 3304 * just allocate through generic pool 3305 */ 3306 in_data_buf = kmemdup(in_data, indatalen, GFP_NOFS); 3307 if (!in_data_buf) { 3308 cifs_small_buf_release(req); 3309 return -ENOMEM; 3310 } 3311 } 3312 3313 req->CtlCode = cpu_to_le32(opcode); 3314 req->PersistentFileId = persistent_fid; 3315 req->VolatileFileId = volatile_fid; 3316 3317 iov[0].iov_base = (char *)req; 3318 /* 3319 * If no input data, the size of ioctl struct in 3320 * protocol spec still includes a 1 byte data buffer, 3321 * but if input data passed to ioctl, we do not 3322 * want to double count this, so we do not send 3323 * the dummy one byte of data in iovec[0] if sending 3324 * input data (in iovec[1]). 3325 */ 3326 if (indatalen) { 3327 req->InputCount = cpu_to_le32(indatalen); 3328 /* do not set InputOffset if no input data */ 3329 req->InputOffset = 3330 cpu_to_le32(offsetof(struct smb2_ioctl_req, Buffer)); 3331 rqst->rq_nvec = 2; 3332 iov[0].iov_len = total_len - 1; 3333 iov[1].iov_base = in_data_buf; 3334 iov[1].iov_len = indatalen; 3335 } else { 3336 rqst->rq_nvec = 1; 3337 iov[0].iov_len = total_len; 3338 } 3339 3340 req->OutputOffset = 0; 3341 req->OutputCount = 0; /* MBZ */ 3342 3343 /* 3344 * In most cases max_response_size is set to 16K (CIFSMaxBufSize) 3345 * We Could increase default MaxOutputResponse, but that could require 3346 * more credits. Windows typically sets this smaller, but for some 3347 * ioctls it may be useful to allow server to send more. No point 3348 * limiting what the server can send as long as fits in one credit 3349 * We can not handle more than CIFS_MAX_BUF_SIZE yet but may want 3350 * to increase this limit up in the future. 3351 * Note that for snapshot queries that servers like Azure expect that 3352 * the first query be minimal size (and just used to get the number/size 3353 * of previous versions) so response size must be specified as EXACTLY 3354 * sizeof(struct snapshot_array) which is 16 when rounded up to multiple 3355 * of eight bytes. Currently that is the only case where we set max 3356 * response size smaller. 3357 */ 3358 req->MaxOutputResponse = cpu_to_le32(max_response_size); 3359 req->hdr.CreditCharge = 3360 cpu_to_le16(DIV_ROUND_UP(max(indatalen, max_response_size), 3361 SMB2_MAX_BUFFER_SIZE)); 3362 /* always an FSCTL (for now) */ 3363 req->Flags = cpu_to_le32(SMB2_0_IOCTL_IS_FSCTL); 3364 3365 /* validate negotiate request must be signed - see MS-SMB2 3.2.5.5 */ 3366 if (opcode == FSCTL_VALIDATE_NEGOTIATE_INFO) 3367 req->hdr.Flags |= SMB2_FLAGS_SIGNED; 3368 3369 return 0; 3370 } 3371 3372 void 3373 SMB2_ioctl_free(struct smb_rqst *rqst) 3374 { 3375 int i; 3376 3377 if (rqst && rqst->rq_iov) { 3378 cifs_small_buf_release(rqst->rq_iov[0].iov_base); /* request */ 3379 for (i = 1; i < rqst->rq_nvec; i++) 3380 if (rqst->rq_iov[i].iov_base != smb2_padding) 3381 kfree(rqst->rq_iov[i].iov_base); 3382 } 3383 } 3384 3385 3386 /* 3387 * SMB2 IOCTL is used for both IOCTLs and FSCTLs 3388 */ 3389 int 3390 SMB2_ioctl(const unsigned int xid, struct cifs_tcon *tcon, u64 persistent_fid, 3391 u64 volatile_fid, u32 opcode, char *in_data, u32 indatalen, 3392 u32 max_out_data_len, char **out_data, 3393 u32 *plen /* returned data len */) 3394 { 3395 struct smb_rqst rqst; 3396 struct smb2_ioctl_rsp *rsp = NULL; 3397 struct cifs_ses *ses; 3398 struct TCP_Server_Info *server; 3399 struct kvec iov[SMB2_IOCTL_IOV_SIZE]; 3400 struct kvec rsp_iov = {NULL, 0}; 3401 int resp_buftype = CIFS_NO_BUFFER; 3402 int rc = 0; 3403 int flags = 0; 3404 int retries = 0, cur_sleep = 1; 3405 3406 if (!tcon) 3407 return -EIO; 3408 3409 ses = tcon->ses; 3410 if (!ses) 3411 return -EIO; 3412 3413 replay_again: 3414 /* reinitialize for possible replay */ 3415 flags = 0; 3416 server = cifs_pick_channel(ses); 3417 3418 if (!server) 3419 return -EIO; 3420 3421 cifs_dbg(FYI, "SMB2 IOCTL\n"); 3422 3423 if (out_data != NULL) 3424 *out_data = NULL; 3425 3426 /* zero out returned data len, in case of error */ 3427 if (plen) 3428 *plen = 0; 3429 3430 if (smb3_encryption_required(tcon)) 3431 flags |= CIFS_TRANSFORM_REQ; 3432 3433 memset(&rqst, 0, sizeof(struct smb_rqst)); 3434 memset(&iov, 0, sizeof(iov)); 3435 rqst.rq_iov = iov; 3436 rqst.rq_nvec = SMB2_IOCTL_IOV_SIZE; 3437 3438 rc = SMB2_ioctl_init(tcon, server, 3439 &rqst, persistent_fid, volatile_fid, opcode, 3440 in_data, indatalen, max_out_data_len); 3441 if (rc) 3442 goto ioctl_exit; 3443 3444 if (retries) 3445 smb2_set_replay(server, &rqst); 3446 3447 rc = cifs_send_recv(xid, ses, server, 3448 &rqst, &resp_buftype, flags, 3449 &rsp_iov); 3450 rsp = (struct smb2_ioctl_rsp *)rsp_iov.iov_base; 3451 3452 if (rc != 0) 3453 trace_smb3_fsctl_err(xid, persistent_fid, tcon->tid, 3454 ses->Suid, 0, opcode, rc); 3455 3456 if ((rc != 0) && (rc != -EINVAL) && (rc != -E2BIG)) { 3457 cifs_stats_fail_inc(tcon, SMB2_IOCTL_HE); 3458 goto ioctl_exit; 3459 } else if (rc == -EINVAL) { 3460 if ((opcode != FSCTL_SRV_COPYCHUNK_WRITE) && 3461 (opcode != FSCTL_SRV_COPYCHUNK)) { 3462 cifs_stats_fail_inc(tcon, SMB2_IOCTL_HE); 3463 goto ioctl_exit; 3464 } 3465 } else if (rc == -E2BIG) { 3466 if (opcode != FSCTL_QUERY_ALLOCATED_RANGES) { 3467 cifs_stats_fail_inc(tcon, SMB2_IOCTL_HE); 3468 goto ioctl_exit; 3469 } 3470 } 3471 3472 /* check if caller wants to look at return data or just return rc */ 3473 if ((plen == NULL) || (out_data == NULL)) 3474 goto ioctl_exit; 3475 3476 /* 3477 * Although unlikely to be possible for rsp to be null and rc not set, 3478 * adding check below is slightly safer long term (and quiets Coverity 3479 * warning) 3480 */ 3481 if (rsp == NULL) { 3482 rc = -EIO; 3483 goto ioctl_exit; 3484 } 3485 3486 *plen = le32_to_cpu(rsp->OutputCount); 3487 3488 /* We check for obvious errors in the output buffer length and offset */ 3489 if (*plen == 0) 3490 goto ioctl_exit; /* server returned no data */ 3491 else if (*plen > rsp_iov.iov_len || *plen > 0xFF00) { 3492 cifs_tcon_dbg(VFS, "srv returned invalid ioctl length: %d\n", *plen); 3493 *plen = 0; 3494 rc = -EIO; 3495 goto ioctl_exit; 3496 } 3497 3498 if (rsp_iov.iov_len - *plen < le32_to_cpu(rsp->OutputOffset)) { 3499 cifs_tcon_dbg(VFS, "Malformed ioctl resp: len %d offset %d\n", *plen, 3500 le32_to_cpu(rsp->OutputOffset)); 3501 *plen = 0; 3502 rc = -EIO; 3503 goto ioctl_exit; 3504 } 3505 3506 *out_data = kmemdup((char *)rsp + le32_to_cpu(rsp->OutputOffset), 3507 *plen, GFP_KERNEL); 3508 if (*out_data == NULL) { 3509 rc = -ENOMEM; 3510 goto ioctl_exit; 3511 } 3512 3513 ioctl_exit: 3514 SMB2_ioctl_free(&rqst); 3515 free_rsp_buf(resp_buftype, rsp); 3516 3517 if (is_replayable_error(rc) && 3518 smb2_should_replay(tcon, &retries, &cur_sleep)) 3519 goto replay_again; 3520 3521 return rc; 3522 } 3523 3524 /* 3525 * Individual callers to ioctl worker function follow 3526 */ 3527 3528 int 3529 SMB2_set_compression(const unsigned int xid, struct cifs_tcon *tcon, 3530 u64 persistent_fid, u64 volatile_fid) 3531 { 3532 int rc; 3533 struct compress_ioctl fsctl_input; 3534 char *ret_data = NULL; 3535 3536 fsctl_input.CompressionState = 3537 cpu_to_le16(COMPRESSION_FORMAT_DEFAULT); 3538 3539 rc = SMB2_ioctl(xid, tcon, persistent_fid, volatile_fid, 3540 FSCTL_SET_COMPRESSION, 3541 (char *)&fsctl_input /* data input */, 3542 2 /* in data len */, CIFSMaxBufSize /* max out data */, 3543 &ret_data /* out data */, NULL); 3544 3545 cifs_dbg(FYI, "set compression rc %d\n", rc); 3546 3547 return rc; 3548 } 3549 3550 int 3551 SMB2_close_init(struct cifs_tcon *tcon, struct TCP_Server_Info *server, 3552 struct smb_rqst *rqst, 3553 u64 persistent_fid, u64 volatile_fid, bool query_attrs) 3554 { 3555 struct smb2_close_req *req; 3556 struct kvec *iov = rqst->rq_iov; 3557 unsigned int total_len; 3558 int rc; 3559 3560 rc = smb2_plain_req_init(SMB2_CLOSE, tcon, server, 3561 (void **) &req, &total_len); 3562 if (rc) 3563 return rc; 3564 3565 req->PersistentFileId = persistent_fid; 3566 req->VolatileFileId = volatile_fid; 3567 if (query_attrs) 3568 req->Flags = SMB2_CLOSE_FLAG_POSTQUERY_ATTRIB; 3569 else 3570 req->Flags = 0; 3571 iov[0].iov_base = (char *)req; 3572 iov[0].iov_len = total_len; 3573 3574 return 0; 3575 } 3576 3577 void 3578 SMB2_close_free(struct smb_rqst *rqst) 3579 { 3580 if (rqst && rqst->rq_iov) 3581 cifs_small_buf_release(rqst->rq_iov[0].iov_base); /* request */ 3582 } 3583 3584 int 3585 __SMB2_close(const unsigned int xid, struct cifs_tcon *tcon, 3586 u64 persistent_fid, u64 volatile_fid, 3587 struct smb2_file_network_open_info *pbuf) 3588 { 3589 struct smb_rqst rqst; 3590 struct smb2_close_rsp *rsp = NULL; 3591 struct cifs_ses *ses = tcon->ses; 3592 struct TCP_Server_Info *server; 3593 struct kvec iov[1]; 3594 struct kvec rsp_iov; 3595 int resp_buftype = CIFS_NO_BUFFER; 3596 int rc = 0; 3597 int flags = 0; 3598 bool query_attrs = false; 3599 int retries = 0, cur_sleep = 1; 3600 3601 replay_again: 3602 /* reinitialize for possible replay */ 3603 flags = 0; 3604 query_attrs = false; 3605 server = cifs_pick_channel(ses); 3606 3607 cifs_dbg(FYI, "Close\n"); 3608 3609 if (!ses || !server) 3610 return -EIO; 3611 3612 if (smb3_encryption_required(tcon)) 3613 flags |= CIFS_TRANSFORM_REQ; 3614 3615 memset(&rqst, 0, sizeof(struct smb_rqst)); 3616 memset(&iov, 0, sizeof(iov)); 3617 rqst.rq_iov = iov; 3618 rqst.rq_nvec = 1; 3619 3620 /* check if need to ask server to return timestamps in close response */ 3621 if (pbuf) 3622 query_attrs = true; 3623 3624 trace_smb3_close_enter(xid, persistent_fid, tcon->tid, ses->Suid); 3625 rc = SMB2_close_init(tcon, server, 3626 &rqst, persistent_fid, volatile_fid, 3627 query_attrs); 3628 if (rc) 3629 goto close_exit; 3630 3631 if (retries) 3632 smb2_set_replay(server, &rqst); 3633 3634 rc = cifs_send_recv(xid, ses, server, 3635 &rqst, &resp_buftype, flags, &rsp_iov); 3636 rsp = (struct smb2_close_rsp *)rsp_iov.iov_base; 3637 3638 if (rc != 0) { 3639 cifs_stats_fail_inc(tcon, SMB2_CLOSE_HE); 3640 trace_smb3_close_err(xid, persistent_fid, tcon->tid, ses->Suid, 3641 rc); 3642 goto close_exit; 3643 } else { 3644 trace_smb3_close_done(xid, persistent_fid, tcon->tid, 3645 ses->Suid); 3646 if (pbuf) 3647 memcpy(&pbuf->network_open_info, 3648 &rsp->network_open_info, 3649 sizeof(pbuf->network_open_info)); 3650 atomic_dec(&tcon->num_remote_opens); 3651 } 3652 3653 close_exit: 3654 SMB2_close_free(&rqst); 3655 free_rsp_buf(resp_buftype, rsp); 3656 3657 /* retry close in a worker thread if this one is interrupted */ 3658 if (is_interrupt_error(rc)) { 3659 int tmp_rc; 3660 3661 tmp_rc = smb2_handle_cancelled_close(tcon, persistent_fid, 3662 volatile_fid); 3663 if (tmp_rc) 3664 cifs_dbg(VFS, "handle cancelled close fid 0x%llx returned error %d\n", 3665 persistent_fid, tmp_rc); 3666 } 3667 3668 if (is_replayable_error(rc) && 3669 smb2_should_replay(tcon, &retries, &cur_sleep)) 3670 goto replay_again; 3671 3672 return rc; 3673 } 3674 3675 int 3676 SMB2_close(const unsigned int xid, struct cifs_tcon *tcon, 3677 u64 persistent_fid, u64 volatile_fid) 3678 { 3679 return __SMB2_close(xid, tcon, persistent_fid, volatile_fid, NULL); 3680 } 3681 3682 int 3683 smb2_validate_iov(unsigned int offset, unsigned int buffer_length, 3684 struct kvec *iov, unsigned int min_buf_size) 3685 { 3686 unsigned int smb_len = iov->iov_len; 3687 char *end_of_smb = smb_len + (char *)iov->iov_base; 3688 char *begin_of_buf = offset + (char *)iov->iov_base; 3689 char *end_of_buf = begin_of_buf + buffer_length; 3690 3691 3692 if (buffer_length < min_buf_size) { 3693 cifs_dbg(VFS, "buffer length %d smaller than minimum size %d\n", 3694 buffer_length, min_buf_size); 3695 return -EINVAL; 3696 } 3697 3698 /* check if beyond RFC1001 maximum length */ 3699 if ((smb_len > 0x7FFFFF) || (buffer_length > 0x7FFFFF)) { 3700 cifs_dbg(VFS, "buffer length %d or smb length %d too large\n", 3701 buffer_length, smb_len); 3702 return -EINVAL; 3703 } 3704 3705 if ((begin_of_buf > end_of_smb) || (end_of_buf > end_of_smb)) { 3706 cifs_dbg(VFS, "Invalid server response, bad offset to data\n"); 3707 return -EINVAL; 3708 } 3709 3710 return 0; 3711 } 3712 3713 /* 3714 * If SMB buffer fields are valid, copy into temporary buffer to hold result. 3715 * Caller must free buffer. 3716 */ 3717 int 3718 smb2_validate_and_copy_iov(unsigned int offset, unsigned int buffer_length, 3719 struct kvec *iov, unsigned int minbufsize, 3720 char *data) 3721 { 3722 char *begin_of_buf = offset + (char *)iov->iov_base; 3723 int rc; 3724 3725 if (!data) 3726 return -EINVAL; 3727 3728 rc = smb2_validate_iov(offset, buffer_length, iov, minbufsize); 3729 if (rc) 3730 return rc; 3731 3732 memcpy(data, begin_of_buf, minbufsize); 3733 3734 return 0; 3735 } 3736 3737 int 3738 SMB2_query_info_init(struct cifs_tcon *tcon, struct TCP_Server_Info *server, 3739 struct smb_rqst *rqst, 3740 u64 persistent_fid, u64 volatile_fid, 3741 u8 info_class, u8 info_type, u32 additional_info, 3742 size_t output_len, size_t input_len, void *input) 3743 { 3744 struct smb2_query_info_req *req; 3745 struct kvec *iov = rqst->rq_iov; 3746 unsigned int total_len; 3747 size_t len; 3748 int rc; 3749 3750 if (unlikely(check_add_overflow(input_len, sizeof(*req), &len) || 3751 len > CIFSMaxBufSize)) 3752 return -EINVAL; 3753 3754 rc = smb2_plain_req_init(SMB2_QUERY_INFO, tcon, server, 3755 (void **) &req, &total_len); 3756 if (rc) 3757 return rc; 3758 3759 req->InfoType = info_type; 3760 req->FileInfoClass = info_class; 3761 req->PersistentFileId = persistent_fid; 3762 req->VolatileFileId = volatile_fid; 3763 req->AdditionalInformation = cpu_to_le32(additional_info); 3764 3765 req->OutputBufferLength = cpu_to_le32(output_len); 3766 if (input_len) { 3767 req->InputBufferLength = cpu_to_le32(input_len); 3768 /* total_len for smb query request never close to le16 max */ 3769 req->InputBufferOffset = cpu_to_le16(total_len - 1); 3770 memcpy(req->Buffer, input, input_len); 3771 } 3772 3773 iov[0].iov_base = (char *)req; 3774 /* 1 for Buffer */ 3775 iov[0].iov_len = len; 3776 return 0; 3777 } 3778 3779 void 3780 SMB2_query_info_free(struct smb_rqst *rqst) 3781 { 3782 if (rqst && rqst->rq_iov) 3783 cifs_buf_release(rqst->rq_iov[0].iov_base); /* request */ 3784 } 3785 3786 static int 3787 query_info(const unsigned int xid, struct cifs_tcon *tcon, 3788 u64 persistent_fid, u64 volatile_fid, u8 info_class, u8 info_type, 3789 u32 additional_info, size_t output_len, size_t min_len, void **data, 3790 u32 *dlen) 3791 { 3792 struct smb_rqst rqst; 3793 struct smb2_query_info_rsp *rsp = NULL; 3794 struct kvec iov[1]; 3795 struct kvec rsp_iov; 3796 int rc = 0; 3797 int resp_buftype = CIFS_NO_BUFFER; 3798 struct cifs_ses *ses = tcon->ses; 3799 struct TCP_Server_Info *server; 3800 int flags = 0; 3801 bool allocated = false; 3802 int retries = 0, cur_sleep = 1; 3803 3804 cifs_dbg(FYI, "Query Info\n"); 3805 3806 if (!ses) 3807 return -EIO; 3808 3809 replay_again: 3810 /* reinitialize for possible replay */ 3811 flags = 0; 3812 allocated = false; 3813 server = cifs_pick_channel(ses); 3814 3815 if (!server) 3816 return -EIO; 3817 3818 if (smb3_encryption_required(tcon)) 3819 flags |= CIFS_TRANSFORM_REQ; 3820 3821 memset(&rqst, 0, sizeof(struct smb_rqst)); 3822 memset(&iov, 0, sizeof(iov)); 3823 rqst.rq_iov = iov; 3824 rqst.rq_nvec = 1; 3825 3826 rc = SMB2_query_info_init(tcon, server, 3827 &rqst, persistent_fid, volatile_fid, 3828 info_class, info_type, additional_info, 3829 output_len, 0, NULL); 3830 if (rc) 3831 goto qinf_exit; 3832 3833 trace_smb3_query_info_enter(xid, persistent_fid, tcon->tid, 3834 ses->Suid, info_class, (__u32)info_type); 3835 3836 if (retries) 3837 smb2_set_replay(server, &rqst); 3838 3839 rc = cifs_send_recv(xid, ses, server, 3840 &rqst, &resp_buftype, flags, &rsp_iov); 3841 rsp = (struct smb2_query_info_rsp *)rsp_iov.iov_base; 3842 3843 if (rc) { 3844 cifs_stats_fail_inc(tcon, SMB2_QUERY_INFO_HE); 3845 trace_smb3_query_info_err(xid, persistent_fid, tcon->tid, 3846 ses->Suid, info_class, (__u32)info_type, rc); 3847 goto qinf_exit; 3848 } 3849 3850 trace_smb3_query_info_done(xid, persistent_fid, tcon->tid, 3851 ses->Suid, info_class, (__u32)info_type); 3852 3853 if (dlen) { 3854 *dlen = le32_to_cpu(rsp->OutputBufferLength); 3855 if (!*data) { 3856 *data = kmalloc(*dlen, GFP_KERNEL); 3857 if (!*data) { 3858 cifs_tcon_dbg(VFS, 3859 "Error %d allocating memory for acl\n", 3860 rc); 3861 *dlen = 0; 3862 rc = -ENOMEM; 3863 goto qinf_exit; 3864 } 3865 allocated = true; 3866 } 3867 } 3868 3869 rc = smb2_validate_and_copy_iov(le16_to_cpu(rsp->OutputBufferOffset), 3870 le32_to_cpu(rsp->OutputBufferLength), 3871 &rsp_iov, dlen ? *dlen : min_len, *data); 3872 if (rc && allocated) { 3873 kfree(*data); 3874 *data = NULL; 3875 *dlen = 0; 3876 } 3877 3878 qinf_exit: 3879 SMB2_query_info_free(&rqst); 3880 free_rsp_buf(resp_buftype, rsp); 3881 3882 if (is_replayable_error(rc) && 3883 smb2_should_replay(tcon, &retries, &cur_sleep)) 3884 goto replay_again; 3885 3886 return rc; 3887 } 3888 3889 int SMB2_query_info(const unsigned int xid, struct cifs_tcon *tcon, 3890 u64 persistent_fid, u64 volatile_fid, struct smb2_file_all_info *data) 3891 { 3892 return query_info(xid, tcon, persistent_fid, volatile_fid, 3893 FILE_ALL_INFORMATION, SMB2_O_INFO_FILE, 0, 3894 sizeof(struct smb2_file_all_info) + PATH_MAX * 2, 3895 sizeof(struct smb2_file_all_info), (void **)&data, 3896 NULL); 3897 } 3898 3899 #if 0 3900 /* currently unused, as now we are doing compounding instead (see smb311_posix_query_path_info) */ 3901 int 3902 SMB311_posix_query_info(const unsigned int xid, struct cifs_tcon *tcon, 3903 u64 persistent_fid, u64 volatile_fid, struct smb311_posix_qinfo *data, u32 *plen) 3904 { 3905 size_t output_len = sizeof(struct smb311_posix_qinfo *) + 3906 (sizeof(struct smb_sid) * 2) + (PATH_MAX * 2); 3907 *plen = 0; 3908 3909 return query_info(xid, tcon, persistent_fid, volatile_fid, 3910 SMB_FIND_FILE_POSIX_INFO, SMB2_O_INFO_FILE, 0, 3911 output_len, sizeof(struct smb311_posix_qinfo), (void **)&data, plen); 3912 /* Note caller must free "data" (passed in above). It may be allocated in query_info call */ 3913 } 3914 #endif 3915 3916 int 3917 SMB2_query_acl(const unsigned int xid, struct cifs_tcon *tcon, 3918 u64 persistent_fid, u64 volatile_fid, 3919 void **data, u32 *plen, u32 extra_info) 3920 { 3921 *plen = 0; 3922 3923 return query_info(xid, tcon, persistent_fid, volatile_fid, 3924 0, SMB2_O_INFO_SECURITY, extra_info, 3925 SMB2_MAX_BUFFER_SIZE, MIN_SEC_DESC_LEN, data, plen); 3926 } 3927 3928 int 3929 SMB2_get_srv_num(const unsigned int xid, struct cifs_tcon *tcon, 3930 u64 persistent_fid, u64 volatile_fid, __le64 *uniqueid) 3931 { 3932 return query_info(xid, tcon, persistent_fid, volatile_fid, 3933 FILE_INTERNAL_INFORMATION, SMB2_O_INFO_FILE, 0, 3934 sizeof(struct smb2_file_internal_info), 3935 sizeof(struct smb2_file_internal_info), 3936 (void **)&uniqueid, NULL); 3937 } 3938 3939 /* 3940 * CHANGE_NOTIFY Request is sent to get notifications on changes to a directory 3941 * See MS-SMB2 2.2.35 and 2.2.36 3942 */ 3943 3944 static int 3945 SMB2_notify_init(const unsigned int xid, struct smb_rqst *rqst, 3946 struct cifs_tcon *tcon, struct TCP_Server_Info *server, 3947 u64 persistent_fid, u64 volatile_fid, 3948 u32 completion_filter, bool watch_tree) 3949 { 3950 struct smb2_change_notify_req *req; 3951 struct kvec *iov = rqst->rq_iov; 3952 unsigned int total_len; 3953 int rc; 3954 3955 rc = smb2_plain_req_init(SMB2_CHANGE_NOTIFY, tcon, server, 3956 (void **) &req, &total_len); 3957 if (rc) 3958 return rc; 3959 3960 req->PersistentFileId = persistent_fid; 3961 req->VolatileFileId = volatile_fid; 3962 /* See note 354 of MS-SMB2, 64K max */ 3963 req->OutputBufferLength = 3964 cpu_to_le32(SMB2_MAX_BUFFER_SIZE - MAX_SMB2_HDR_SIZE); 3965 req->CompletionFilter = cpu_to_le32(completion_filter); 3966 if (watch_tree) 3967 req->Flags = cpu_to_le16(SMB2_WATCH_TREE); 3968 else 3969 req->Flags = 0; 3970 3971 iov[0].iov_base = (char *)req; 3972 iov[0].iov_len = total_len; 3973 3974 return 0; 3975 } 3976 3977 int 3978 SMB2_change_notify(const unsigned int xid, struct cifs_tcon *tcon, 3979 u64 persistent_fid, u64 volatile_fid, bool watch_tree, 3980 u32 completion_filter, u32 max_out_data_len, char **out_data, 3981 u32 *plen /* returned data len */) 3982 { 3983 struct cifs_ses *ses = tcon->ses; 3984 struct TCP_Server_Info *server; 3985 struct smb_rqst rqst; 3986 struct smb2_change_notify_rsp *smb_rsp; 3987 struct kvec iov[1]; 3988 struct kvec rsp_iov = {NULL, 0}; 3989 int resp_buftype = CIFS_NO_BUFFER; 3990 int flags = 0; 3991 int rc = 0; 3992 int retries = 0, cur_sleep = 1; 3993 3994 replay_again: 3995 /* reinitialize for possible replay */ 3996 flags = 0; 3997 server = cifs_pick_channel(ses); 3998 3999 cifs_dbg(FYI, "change notify\n"); 4000 if (!ses || !server) 4001 return -EIO; 4002 4003 if (smb3_encryption_required(tcon)) 4004 flags |= CIFS_TRANSFORM_REQ; 4005 4006 memset(&rqst, 0, sizeof(struct smb_rqst)); 4007 memset(&iov, 0, sizeof(iov)); 4008 if (plen) 4009 *plen = 0; 4010 4011 rqst.rq_iov = iov; 4012 rqst.rq_nvec = 1; 4013 4014 rc = SMB2_notify_init(xid, &rqst, tcon, server, 4015 persistent_fid, volatile_fid, 4016 completion_filter, watch_tree); 4017 if (rc) 4018 goto cnotify_exit; 4019 4020 trace_smb3_notify_enter(xid, persistent_fid, tcon->tid, ses->Suid, 4021 (u8)watch_tree, completion_filter); 4022 4023 if (retries) 4024 smb2_set_replay(server, &rqst); 4025 4026 rc = cifs_send_recv(xid, ses, server, 4027 &rqst, &resp_buftype, flags, &rsp_iov); 4028 4029 if (rc != 0) { 4030 cifs_stats_fail_inc(tcon, SMB2_CHANGE_NOTIFY_HE); 4031 trace_smb3_notify_err(xid, persistent_fid, tcon->tid, ses->Suid, 4032 (u8)watch_tree, completion_filter, rc); 4033 } else { 4034 trace_smb3_notify_done(xid, persistent_fid, tcon->tid, 4035 ses->Suid, (u8)watch_tree, completion_filter); 4036 /* validate that notify information is plausible */ 4037 if ((rsp_iov.iov_base == NULL) || 4038 (rsp_iov.iov_len < sizeof(struct smb2_change_notify_rsp) + 1)) 4039 goto cnotify_exit; 4040 4041 smb_rsp = (struct smb2_change_notify_rsp *)rsp_iov.iov_base; 4042 4043 smb2_validate_iov(le16_to_cpu(smb_rsp->OutputBufferOffset), 4044 le32_to_cpu(smb_rsp->OutputBufferLength), &rsp_iov, 4045 sizeof(struct file_notify_information)); 4046 4047 *out_data = kmemdup((char *)smb_rsp + le16_to_cpu(smb_rsp->OutputBufferOffset), 4048 le32_to_cpu(smb_rsp->OutputBufferLength), GFP_KERNEL); 4049 if (*out_data == NULL) { 4050 rc = -ENOMEM; 4051 goto cnotify_exit; 4052 } else if (plen) 4053 *plen = le32_to_cpu(smb_rsp->OutputBufferLength); 4054 } 4055 4056 cnotify_exit: 4057 if (rqst.rq_iov) 4058 cifs_small_buf_release(rqst.rq_iov[0].iov_base); /* request */ 4059 free_rsp_buf(resp_buftype, rsp_iov.iov_base); 4060 4061 if (is_replayable_error(rc) && 4062 smb2_should_replay(tcon, &retries, &cur_sleep)) 4063 goto replay_again; 4064 4065 return rc; 4066 } 4067 4068 4069 4070 /* 4071 * This is a no-op for now. We're not really interested in the reply, but 4072 * rather in the fact that the server sent one and that server->lstrp 4073 * gets updated. 4074 * 4075 * FIXME: maybe we should consider checking that the reply matches request? 4076 */ 4077 static void 4078 smb2_echo_callback(struct mid_q_entry *mid) 4079 { 4080 struct TCP_Server_Info *server = mid->callback_data; 4081 struct smb2_echo_rsp *rsp = (struct smb2_echo_rsp *)mid->resp_buf; 4082 struct cifs_credits credits = { .value = 0, .instance = 0 }; 4083 4084 if (mid->mid_state == MID_RESPONSE_RECEIVED 4085 || mid->mid_state == MID_RESPONSE_MALFORMED) { 4086 credits.value = le16_to_cpu(rsp->hdr.CreditRequest); 4087 credits.instance = server->reconnect_instance; 4088 } 4089 4090 release_mid(mid); 4091 add_credits(server, &credits, CIFS_ECHO_OP); 4092 } 4093 4094 static void cifs_renegotiate_iosize(struct TCP_Server_Info *server, 4095 struct cifs_tcon *tcon) 4096 { 4097 struct cifs_sb_info *cifs_sb; 4098 4099 if (server == NULL || tcon == NULL) 4100 return; 4101 4102 spin_lock(&tcon->sb_list_lock); 4103 list_for_each_entry(cifs_sb, &tcon->cifs_sb_list, tcon_sb_link) 4104 cifs_negotiate_iosize(server, cifs_sb->ctx, tcon); 4105 spin_unlock(&tcon->sb_list_lock); 4106 } 4107 4108 void smb2_reconnect_server(struct work_struct *work) 4109 { 4110 struct TCP_Server_Info *server = container_of(work, 4111 struct TCP_Server_Info, reconnect.work); 4112 struct TCP_Server_Info *pserver; 4113 struct cifs_ses *ses, *ses2; 4114 struct cifs_tcon *tcon, *tcon2; 4115 struct list_head tmp_list, tmp_ses_list; 4116 bool ses_exist = false; 4117 bool tcon_selected = false; 4118 int rc; 4119 bool resched = false; 4120 4121 /* first check if ref count has reached 0, if not inc ref count */ 4122 spin_lock(&cifs_tcp_ses_lock); 4123 if (!server->srv_count) { 4124 spin_unlock(&cifs_tcp_ses_lock); 4125 return; 4126 } 4127 server->srv_count++; 4128 spin_unlock(&cifs_tcp_ses_lock); 4129 4130 /* If server is a channel, select the primary channel */ 4131 pserver = SERVER_IS_CHAN(server) ? server->primary_server : server; 4132 4133 /* Prevent simultaneous reconnects that can corrupt tcon->rlist list */ 4134 mutex_lock(&pserver->reconnect_mutex); 4135 4136 /* if the server is marked for termination, drop the ref count here */ 4137 if (server->terminate) { 4138 cifs_put_tcp_session(server, true); 4139 mutex_unlock(&pserver->reconnect_mutex); 4140 return; 4141 } 4142 4143 INIT_LIST_HEAD(&tmp_list); 4144 INIT_LIST_HEAD(&tmp_ses_list); 4145 cifs_dbg(FYI, "Reconnecting tcons and channels\n"); 4146 4147 spin_lock(&cifs_tcp_ses_lock); 4148 list_for_each_entry(ses, &pserver->smb_ses_list, smb_ses_list) { 4149 spin_lock(&ses->ses_lock); 4150 if (ses->ses_status == SES_EXITING) { 4151 spin_unlock(&ses->ses_lock); 4152 continue; 4153 } 4154 spin_unlock(&ses->ses_lock); 4155 4156 tcon_selected = false; 4157 4158 list_for_each_entry(tcon, &ses->tcon_list, tcon_list) { 4159 if (tcon->need_reconnect || tcon->need_reopen_files) { 4160 tcon->tc_count++; 4161 trace_smb3_tcon_ref(tcon->debug_id, tcon->tc_count, 4162 netfs_trace_tcon_ref_get_reconnect_server); 4163 list_add_tail(&tcon->rlist, &tmp_list); 4164 tcon_selected = true; 4165 } 4166 } 4167 /* 4168 * IPC has the same lifetime as its session and uses its 4169 * refcount. 4170 */ 4171 if (ses->tcon_ipc && ses->tcon_ipc->need_reconnect) { 4172 list_add_tail(&ses->tcon_ipc->rlist, &tmp_list); 4173 tcon_selected = true; 4174 cifs_smb_ses_inc_refcount(ses); 4175 } 4176 /* 4177 * handle the case where channel needs to reconnect 4178 * binding session, but tcon is healthy (some other channel 4179 * is active) 4180 */ 4181 spin_lock(&ses->chan_lock); 4182 if (!tcon_selected && cifs_chan_needs_reconnect(ses, server)) { 4183 list_add_tail(&ses->rlist, &tmp_ses_list); 4184 ses_exist = true; 4185 cifs_smb_ses_inc_refcount(ses); 4186 } 4187 spin_unlock(&ses->chan_lock); 4188 } 4189 spin_unlock(&cifs_tcp_ses_lock); 4190 4191 list_for_each_entry_safe(tcon, tcon2, &tmp_list, rlist) { 4192 rc = smb2_reconnect(SMB2_INTERNAL_CMD, tcon, server, true); 4193 if (!rc) { 4194 cifs_renegotiate_iosize(server, tcon); 4195 cifs_reopen_persistent_handles(tcon); 4196 } else 4197 resched = true; 4198 list_del_init(&tcon->rlist); 4199 if (tcon->ipc) 4200 cifs_put_smb_ses(tcon->ses); 4201 else 4202 cifs_put_tcon(tcon, netfs_trace_tcon_ref_put_reconnect_server); 4203 } 4204 4205 if (!ses_exist) 4206 goto done; 4207 4208 /* allocate a dummy tcon struct used for reconnect */ 4209 tcon = tcon_info_alloc(false, netfs_trace_tcon_ref_new_reconnect_server); 4210 if (!tcon) { 4211 resched = true; 4212 list_for_each_entry_safe(ses, ses2, &tmp_ses_list, rlist) { 4213 list_del_init(&ses->rlist); 4214 cifs_put_smb_ses(ses); 4215 } 4216 goto done; 4217 } 4218 4219 tcon->status = TID_GOOD; 4220 tcon->retry = false; 4221 tcon->need_reconnect = false; 4222 4223 /* now reconnect sessions for necessary channels */ 4224 list_for_each_entry_safe(ses, ses2, &tmp_ses_list, rlist) { 4225 tcon->ses = ses; 4226 rc = smb2_reconnect(SMB2_INTERNAL_CMD, tcon, server, true); 4227 if (rc) 4228 resched = true; 4229 list_del_init(&ses->rlist); 4230 cifs_put_smb_ses(ses); 4231 } 4232 tconInfoFree(tcon, netfs_trace_tcon_ref_free_reconnect_server); 4233 4234 done: 4235 cifs_dbg(FYI, "Reconnecting tcons and channels finished\n"); 4236 if (resched) 4237 queue_delayed_work(cifsiod_wq, &server->reconnect, 2 * HZ); 4238 mutex_unlock(&pserver->reconnect_mutex); 4239 4240 /* now we can safely release srv struct */ 4241 cifs_put_tcp_session(server, true); 4242 } 4243 4244 int 4245 SMB2_echo(struct TCP_Server_Info *server) 4246 { 4247 struct smb2_echo_req *req; 4248 int rc = 0; 4249 struct kvec iov[1]; 4250 struct smb_rqst rqst = { .rq_iov = iov, 4251 .rq_nvec = 1 }; 4252 unsigned int total_len; 4253 4254 cifs_dbg(FYI, "In echo request for conn_id %lld\n", server->conn_id); 4255 4256 spin_lock(&server->srv_lock); 4257 if (server->ops->need_neg && 4258 server->ops->need_neg(server)) { 4259 spin_unlock(&server->srv_lock); 4260 /* No need to send echo on newly established connections */ 4261 mod_delayed_work(cifsiod_wq, &server->reconnect, 0); 4262 return rc; 4263 } 4264 spin_unlock(&server->srv_lock); 4265 4266 rc = smb2_plain_req_init(SMB2_ECHO, NULL, server, 4267 (void **)&req, &total_len); 4268 if (rc) 4269 return rc; 4270 4271 req->hdr.CreditRequest = cpu_to_le16(1); 4272 4273 iov[0].iov_len = total_len; 4274 iov[0].iov_base = (char *)req; 4275 4276 rc = cifs_call_async(server, &rqst, NULL, smb2_echo_callback, NULL, 4277 server, CIFS_ECHO_OP, NULL); 4278 if (rc) 4279 cifs_dbg(FYI, "Echo request failed: %d\n", rc); 4280 4281 cifs_small_buf_release(req); 4282 return rc; 4283 } 4284 4285 void 4286 SMB2_flush_free(struct smb_rqst *rqst) 4287 { 4288 if (rqst && rqst->rq_iov) 4289 cifs_small_buf_release(rqst->rq_iov[0].iov_base); /* request */ 4290 } 4291 4292 int 4293 SMB2_flush_init(const unsigned int xid, struct smb_rqst *rqst, 4294 struct cifs_tcon *tcon, struct TCP_Server_Info *server, 4295 u64 persistent_fid, u64 volatile_fid) 4296 { 4297 struct smb2_flush_req *req; 4298 struct kvec *iov = rqst->rq_iov; 4299 unsigned int total_len; 4300 int rc; 4301 4302 rc = smb2_plain_req_init(SMB2_FLUSH, tcon, server, 4303 (void **) &req, &total_len); 4304 if (rc) 4305 return rc; 4306 4307 req->PersistentFileId = persistent_fid; 4308 req->VolatileFileId = volatile_fid; 4309 4310 iov[0].iov_base = (char *)req; 4311 iov[0].iov_len = total_len; 4312 4313 return 0; 4314 } 4315 4316 int 4317 SMB2_flush(const unsigned int xid, struct cifs_tcon *tcon, u64 persistent_fid, 4318 u64 volatile_fid) 4319 { 4320 struct cifs_ses *ses = tcon->ses; 4321 struct smb_rqst rqst; 4322 struct kvec iov[1]; 4323 struct kvec rsp_iov = {NULL, 0}; 4324 struct TCP_Server_Info *server; 4325 int resp_buftype = CIFS_NO_BUFFER; 4326 int flags = 0; 4327 int rc = 0; 4328 int retries = 0, cur_sleep = 1; 4329 4330 replay_again: 4331 /* reinitialize for possible replay */ 4332 flags = 0; 4333 server = cifs_pick_channel(ses); 4334 4335 cifs_dbg(FYI, "flush\n"); 4336 if (!ses || !(ses->server)) 4337 return -EIO; 4338 4339 if (smb3_encryption_required(tcon)) 4340 flags |= CIFS_TRANSFORM_REQ; 4341 4342 memset(&rqst, 0, sizeof(struct smb_rqst)); 4343 memset(&iov, 0, sizeof(iov)); 4344 rqst.rq_iov = iov; 4345 rqst.rq_nvec = 1; 4346 4347 rc = SMB2_flush_init(xid, &rqst, tcon, server, 4348 persistent_fid, volatile_fid); 4349 if (rc) 4350 goto flush_exit; 4351 4352 trace_smb3_flush_enter(xid, persistent_fid, tcon->tid, ses->Suid); 4353 4354 if (retries) 4355 smb2_set_replay(server, &rqst); 4356 4357 rc = cifs_send_recv(xid, ses, server, 4358 &rqst, &resp_buftype, flags, &rsp_iov); 4359 4360 if (rc != 0) { 4361 cifs_stats_fail_inc(tcon, SMB2_FLUSH_HE); 4362 trace_smb3_flush_err(xid, persistent_fid, tcon->tid, ses->Suid, 4363 rc); 4364 } else 4365 trace_smb3_flush_done(xid, persistent_fid, tcon->tid, 4366 ses->Suid); 4367 4368 flush_exit: 4369 SMB2_flush_free(&rqst); 4370 free_rsp_buf(resp_buftype, rsp_iov.iov_base); 4371 4372 if (is_replayable_error(rc) && 4373 smb2_should_replay(tcon, &retries, &cur_sleep)) 4374 goto replay_again; 4375 4376 return rc; 4377 } 4378 4379 #ifdef CONFIG_CIFS_SMB_DIRECT 4380 static inline bool smb3_use_rdma_offload(struct cifs_io_parms *io_parms) 4381 { 4382 struct TCP_Server_Info *server = io_parms->server; 4383 struct cifs_tcon *tcon = io_parms->tcon; 4384 4385 /* we can only offload if we're connected */ 4386 if (!server || !tcon) 4387 return false; 4388 4389 /* we can only offload on an rdma connection */ 4390 if (!server->rdma || !server->smbd_conn) 4391 return false; 4392 4393 /* we don't support signed offload yet */ 4394 if (server->sign) 4395 return false; 4396 4397 /* we don't support encrypted offload yet */ 4398 if (smb3_encryption_required(tcon)) 4399 return false; 4400 4401 /* offload also has its overhead, so only do it if desired */ 4402 if (io_parms->length < server->smbd_conn->rdma_readwrite_threshold) 4403 return false; 4404 4405 return true; 4406 } 4407 #endif /* CONFIG_CIFS_SMB_DIRECT */ 4408 4409 /* 4410 * To form a chain of read requests, any read requests after the first should 4411 * have the end_of_chain boolean set to true. 4412 */ 4413 static int 4414 smb2_new_read_req(void **buf, unsigned int *total_len, 4415 struct cifs_io_parms *io_parms, struct cifs_io_subrequest *rdata, 4416 unsigned int remaining_bytes, int request_type) 4417 { 4418 int rc = -EACCES; 4419 struct smb2_read_req *req = NULL; 4420 struct smb2_hdr *shdr; 4421 struct TCP_Server_Info *server = io_parms->server; 4422 4423 rc = smb2_plain_req_init(SMB2_READ, io_parms->tcon, server, 4424 (void **) &req, total_len); 4425 if (rc) 4426 return rc; 4427 4428 if (server == NULL) 4429 return -ECONNABORTED; 4430 4431 shdr = &req->hdr; 4432 shdr->Id.SyncId.ProcessId = cpu_to_le32(io_parms->pid); 4433 4434 req->PersistentFileId = io_parms->persistent_fid; 4435 req->VolatileFileId = io_parms->volatile_fid; 4436 req->ReadChannelInfoOffset = 0; /* reserved */ 4437 req->ReadChannelInfoLength = 0; /* reserved */ 4438 req->Channel = 0; /* reserved */ 4439 req->MinimumCount = 0; 4440 req->Length = cpu_to_le32(io_parms->length); 4441 req->Offset = cpu_to_le64(io_parms->offset); 4442 4443 trace_smb3_read_enter(rdata ? rdata->rreq->debug_id : 0, 4444 rdata ? rdata->subreq.debug_index : 0, 4445 rdata ? rdata->xid : 0, 4446 io_parms->persistent_fid, 4447 io_parms->tcon->tid, io_parms->tcon->ses->Suid, 4448 io_parms->offset, io_parms->length); 4449 #ifdef CONFIG_CIFS_SMB_DIRECT 4450 /* 4451 * If we want to do a RDMA write, fill in and append 4452 * smbd_buffer_descriptor_v1 to the end of read request 4453 */ 4454 if (rdata && smb3_use_rdma_offload(io_parms)) { 4455 struct smbd_buffer_descriptor_v1 *v1; 4456 bool need_invalidate = server->dialect == SMB30_PROT_ID; 4457 4458 rdata->mr = smbd_register_mr(server->smbd_conn, &rdata->subreq.io_iter, 4459 true, need_invalidate); 4460 if (!rdata->mr) 4461 return -EAGAIN; 4462 4463 req->Channel = SMB2_CHANNEL_RDMA_V1_INVALIDATE; 4464 if (need_invalidate) 4465 req->Channel = SMB2_CHANNEL_RDMA_V1; 4466 req->ReadChannelInfoOffset = 4467 cpu_to_le16(offsetof(struct smb2_read_req, Buffer)); 4468 req->ReadChannelInfoLength = 4469 cpu_to_le16(sizeof(struct smbd_buffer_descriptor_v1)); 4470 v1 = (struct smbd_buffer_descriptor_v1 *) &req->Buffer[0]; 4471 v1->offset = cpu_to_le64(rdata->mr->mr->iova); 4472 v1->token = cpu_to_le32(rdata->mr->mr->rkey); 4473 v1->length = cpu_to_le32(rdata->mr->mr->length); 4474 4475 *total_len += sizeof(*v1) - 1; 4476 } 4477 #endif 4478 if (request_type & CHAINED_REQUEST) { 4479 if (!(request_type & END_OF_CHAIN)) { 4480 /* next 8-byte aligned request */ 4481 *total_len = ALIGN(*total_len, 8); 4482 shdr->NextCommand = cpu_to_le32(*total_len); 4483 } else /* END_OF_CHAIN */ 4484 shdr->NextCommand = 0; 4485 if (request_type & RELATED_REQUEST) { 4486 shdr->Flags |= SMB2_FLAGS_RELATED_OPERATIONS; 4487 /* 4488 * Related requests use info from previous read request 4489 * in chain. 4490 */ 4491 shdr->SessionId = cpu_to_le64(0xFFFFFFFFFFFFFFFF); 4492 shdr->Id.SyncId.TreeId = cpu_to_le32(0xFFFFFFFF); 4493 req->PersistentFileId = (u64)-1; 4494 req->VolatileFileId = (u64)-1; 4495 } 4496 } 4497 if (remaining_bytes > io_parms->length) 4498 req->RemainingBytes = cpu_to_le32(remaining_bytes); 4499 else 4500 req->RemainingBytes = 0; 4501 4502 *buf = req; 4503 return rc; 4504 } 4505 4506 static void 4507 smb2_readv_callback(struct mid_q_entry *mid) 4508 { 4509 struct cifs_io_subrequest *rdata = mid->callback_data; 4510 struct netfs_inode *ictx = netfs_inode(rdata->rreq->inode); 4511 struct cifs_tcon *tcon = tlink_tcon(rdata->req->cfile->tlink); 4512 struct TCP_Server_Info *server = rdata->server; 4513 struct smb2_hdr *shdr = 4514 (struct smb2_hdr *)rdata->iov[0].iov_base; 4515 struct cifs_credits credits = { 4516 .value = 0, 4517 .instance = 0, 4518 .rreq_debug_id = rdata->rreq->debug_id, 4519 .rreq_debug_index = rdata->subreq.debug_index, 4520 }; 4521 struct smb_rqst rqst = { .rq_iov = &rdata->iov[1], .rq_nvec = 1 }; 4522 unsigned int rreq_debug_id = rdata->rreq->debug_id; 4523 unsigned int subreq_debug_index = rdata->subreq.debug_index; 4524 4525 if (rdata->got_bytes) { 4526 rqst.rq_iter = rdata->subreq.io_iter; 4527 } 4528 4529 WARN_ONCE(rdata->server != mid->server, 4530 "rdata server %p != mid server %p", 4531 rdata->server, mid->server); 4532 4533 cifs_dbg(FYI, "%s: mid=%llu state=%d result=%d bytes=%zu/%zu\n", 4534 __func__, mid->mid, mid->mid_state, rdata->result, 4535 rdata->got_bytes, rdata->subreq.len - rdata->subreq.transferred); 4536 4537 switch (mid->mid_state) { 4538 case MID_RESPONSE_RECEIVED: 4539 credits.value = le16_to_cpu(shdr->CreditRequest); 4540 credits.instance = server->reconnect_instance; 4541 /* result already set, check signature */ 4542 if (server->sign && !mid->decrypted) { 4543 int rc; 4544 4545 iov_iter_truncate(&rqst.rq_iter, rdata->got_bytes); 4546 rc = smb2_verify_signature(&rqst, server); 4547 if (rc) 4548 cifs_tcon_dbg(VFS, "SMB signature verification returned error = %d\n", 4549 rc); 4550 } 4551 /* FIXME: should this be counted toward the initiating task? */ 4552 task_io_account_read(rdata->got_bytes); 4553 cifs_stats_bytes_read(tcon, rdata->got_bytes); 4554 break; 4555 case MID_REQUEST_SUBMITTED: 4556 case MID_RETRY_NEEDED: 4557 __set_bit(NETFS_SREQ_NEED_RETRY, &rdata->subreq.flags); 4558 rdata->result = -EAGAIN; 4559 if (server->sign && rdata->got_bytes) 4560 /* reset bytes number since we can not check a sign */ 4561 rdata->got_bytes = 0; 4562 /* FIXME: should this be counted toward the initiating task? */ 4563 task_io_account_read(rdata->got_bytes); 4564 cifs_stats_bytes_read(tcon, rdata->got_bytes); 4565 break; 4566 case MID_RESPONSE_MALFORMED: 4567 credits.value = le16_to_cpu(shdr->CreditRequest); 4568 credits.instance = server->reconnect_instance; 4569 fallthrough; 4570 default: 4571 rdata->result = -EIO; 4572 } 4573 #ifdef CONFIG_CIFS_SMB_DIRECT 4574 /* 4575 * If this rdata has a memory registered, the MR can be freed 4576 * MR needs to be freed as soon as I/O finishes to prevent deadlock 4577 * because they have limited number and are used for future I/Os 4578 */ 4579 if (rdata->mr) { 4580 smbd_deregister_mr(rdata->mr); 4581 rdata->mr = NULL; 4582 } 4583 #endif 4584 if (rdata->result && rdata->result != -ENODATA) { 4585 cifs_stats_fail_inc(tcon, SMB2_READ_HE); 4586 trace_smb3_read_err(rdata->rreq->debug_id, 4587 rdata->subreq.debug_index, 4588 rdata->xid, 4589 rdata->req->cfile->fid.persistent_fid, 4590 tcon->tid, tcon->ses->Suid, 4591 rdata->subreq.start + rdata->subreq.transferred, 4592 rdata->subreq.len - rdata->subreq.transferred, 4593 rdata->result); 4594 } else 4595 trace_smb3_read_done(rdata->rreq->debug_id, 4596 rdata->subreq.debug_index, 4597 rdata->xid, 4598 rdata->req->cfile->fid.persistent_fid, 4599 tcon->tid, tcon->ses->Suid, 4600 rdata->subreq.start + rdata->subreq.transferred, 4601 rdata->got_bytes); 4602 4603 if (rdata->result == -ENODATA) { 4604 __set_bit(NETFS_SREQ_HIT_EOF, &rdata->subreq.flags); 4605 rdata->result = 0; 4606 } else { 4607 size_t trans = rdata->subreq.transferred + rdata->got_bytes; 4608 if (trans < rdata->subreq.len && 4609 rdata->subreq.start + trans == ictx->remote_i_size) { 4610 __set_bit(NETFS_SREQ_HIT_EOF, &rdata->subreq.flags); 4611 rdata->result = 0; 4612 } 4613 if (rdata->got_bytes) 4614 __set_bit(NETFS_SREQ_MADE_PROGRESS, &rdata->subreq.flags); 4615 } 4616 trace_smb3_rw_credits(rreq_debug_id, subreq_debug_index, rdata->credits.value, 4617 server->credits, server->in_flight, 4618 0, cifs_trace_rw_credits_read_response_clear); 4619 rdata->credits.value = 0; 4620 rdata->subreq.error = rdata->result; 4621 rdata->subreq.transferred += rdata->got_bytes; 4622 trace_netfs_sreq(&rdata->subreq, netfs_sreq_trace_io_progress); 4623 netfs_read_subreq_terminated(&rdata->subreq); 4624 release_mid(mid); 4625 trace_smb3_rw_credits(rreq_debug_id, subreq_debug_index, 0, 4626 server->credits, server->in_flight, 4627 credits.value, cifs_trace_rw_credits_read_response_add); 4628 add_credits(server, &credits, 0); 4629 } 4630 4631 /* smb2_async_readv - send an async read, and set up mid to handle result */ 4632 int 4633 smb2_async_readv(struct cifs_io_subrequest *rdata) 4634 { 4635 int rc, flags = 0; 4636 char *buf; 4637 struct netfs_io_subrequest *subreq = &rdata->subreq; 4638 struct smb2_hdr *shdr; 4639 struct cifs_io_parms io_parms; 4640 struct smb_rqst rqst = { .rq_iov = rdata->iov, 4641 .rq_nvec = 1 }; 4642 struct TCP_Server_Info *server; 4643 struct cifs_tcon *tcon = tlink_tcon(rdata->req->cfile->tlink); 4644 unsigned int total_len; 4645 int credit_request; 4646 4647 cifs_dbg(FYI, "%s: offset=%llu bytes=%zu\n", 4648 __func__, subreq->start, subreq->len); 4649 4650 if (!rdata->server) 4651 rdata->server = cifs_pick_channel(tcon->ses); 4652 4653 io_parms.tcon = tlink_tcon(rdata->req->cfile->tlink); 4654 io_parms.server = server = rdata->server; 4655 io_parms.offset = subreq->start + subreq->transferred; 4656 io_parms.length = subreq->len - subreq->transferred; 4657 io_parms.persistent_fid = rdata->req->cfile->fid.persistent_fid; 4658 io_parms.volatile_fid = rdata->req->cfile->fid.volatile_fid; 4659 io_parms.pid = rdata->req->pid; 4660 4661 rc = smb2_new_read_req( 4662 (void **) &buf, &total_len, &io_parms, rdata, 0, 0); 4663 if (rc) 4664 return rc; 4665 4666 if (smb3_encryption_required(io_parms.tcon)) 4667 flags |= CIFS_TRANSFORM_REQ; 4668 4669 rdata->iov[0].iov_base = buf; 4670 rdata->iov[0].iov_len = total_len; 4671 rdata->got_bytes = 0; 4672 rdata->result = 0; 4673 4674 shdr = (struct smb2_hdr *)buf; 4675 4676 if (rdata->credits.value > 0) { 4677 shdr->CreditCharge = cpu_to_le16(DIV_ROUND_UP(io_parms.length, 4678 SMB2_MAX_BUFFER_SIZE)); 4679 credit_request = le16_to_cpu(shdr->CreditCharge) + 8; 4680 if (server->credits >= server->max_credits) 4681 shdr->CreditRequest = cpu_to_le16(0); 4682 else 4683 shdr->CreditRequest = cpu_to_le16( 4684 min_t(int, server->max_credits - 4685 server->credits, credit_request)); 4686 4687 rc = adjust_credits(server, rdata, cifs_trace_rw_credits_call_readv_adjust); 4688 if (rc) 4689 goto async_readv_out; 4690 4691 flags |= CIFS_HAS_CREDITS; 4692 } 4693 4694 rc = cifs_call_async(server, &rqst, 4695 cifs_readv_receive, smb2_readv_callback, 4696 smb3_handle_read_data, rdata, flags, 4697 &rdata->credits); 4698 if (rc) { 4699 cifs_stats_fail_inc(io_parms.tcon, SMB2_READ_HE); 4700 trace_smb3_read_err(rdata->rreq->debug_id, 4701 subreq->debug_index, 4702 rdata->xid, io_parms.persistent_fid, 4703 io_parms.tcon->tid, 4704 io_parms.tcon->ses->Suid, 4705 io_parms.offset, 4706 subreq->len - subreq->transferred, rc); 4707 } 4708 4709 async_readv_out: 4710 cifs_small_buf_release(buf); 4711 return rc; 4712 } 4713 4714 int 4715 SMB2_read(const unsigned int xid, struct cifs_io_parms *io_parms, 4716 unsigned int *nbytes, char **buf, int *buf_type) 4717 { 4718 struct smb_rqst rqst; 4719 int resp_buftype, rc; 4720 struct smb2_read_req *req = NULL; 4721 struct smb2_read_rsp *rsp = NULL; 4722 struct kvec iov[1]; 4723 struct kvec rsp_iov; 4724 unsigned int total_len; 4725 int flags = CIFS_LOG_ERROR; 4726 struct cifs_ses *ses = io_parms->tcon->ses; 4727 4728 if (!io_parms->server) 4729 io_parms->server = cifs_pick_channel(io_parms->tcon->ses); 4730 4731 *nbytes = 0; 4732 rc = smb2_new_read_req((void **)&req, &total_len, io_parms, NULL, 0, 0); 4733 if (rc) 4734 return rc; 4735 4736 if (smb3_encryption_required(io_parms->tcon)) 4737 flags |= CIFS_TRANSFORM_REQ; 4738 4739 iov[0].iov_base = (char *)req; 4740 iov[0].iov_len = total_len; 4741 4742 memset(&rqst, 0, sizeof(struct smb_rqst)); 4743 rqst.rq_iov = iov; 4744 rqst.rq_nvec = 1; 4745 4746 rc = cifs_send_recv(xid, ses, io_parms->server, 4747 &rqst, &resp_buftype, flags, &rsp_iov); 4748 rsp = (struct smb2_read_rsp *)rsp_iov.iov_base; 4749 4750 if (rc) { 4751 if (rc != -ENODATA) { 4752 cifs_stats_fail_inc(io_parms->tcon, SMB2_READ_HE); 4753 cifs_dbg(VFS, "Send error in read = %d\n", rc); 4754 trace_smb3_read_err(0, 0, xid, 4755 req->PersistentFileId, 4756 io_parms->tcon->tid, ses->Suid, 4757 io_parms->offset, io_parms->length, 4758 rc); 4759 } else 4760 trace_smb3_read_done(0, 0, xid, 4761 req->PersistentFileId, io_parms->tcon->tid, 4762 ses->Suid, io_parms->offset, 0); 4763 free_rsp_buf(resp_buftype, rsp_iov.iov_base); 4764 cifs_small_buf_release(req); 4765 return rc == -ENODATA ? 0 : rc; 4766 } else 4767 trace_smb3_read_done(0, 0, xid, 4768 req->PersistentFileId, 4769 io_parms->tcon->tid, ses->Suid, 4770 io_parms->offset, io_parms->length); 4771 4772 cifs_small_buf_release(req); 4773 4774 *nbytes = le32_to_cpu(rsp->DataLength); 4775 if ((*nbytes > CIFS_MAX_MSGSIZE) || 4776 (*nbytes > io_parms->length)) { 4777 cifs_dbg(FYI, "bad length %d for count %d\n", 4778 *nbytes, io_parms->length); 4779 rc = -EIO; 4780 *nbytes = 0; 4781 } 4782 4783 if (*buf) { 4784 memcpy(*buf, (char *)rsp + rsp->DataOffset, *nbytes); 4785 free_rsp_buf(resp_buftype, rsp_iov.iov_base); 4786 } else if (resp_buftype != CIFS_NO_BUFFER) { 4787 *buf = rsp_iov.iov_base; 4788 if (resp_buftype == CIFS_SMALL_BUFFER) 4789 *buf_type = CIFS_SMALL_BUFFER; 4790 else if (resp_buftype == CIFS_LARGE_BUFFER) 4791 *buf_type = CIFS_LARGE_BUFFER; 4792 } 4793 return rc; 4794 } 4795 4796 /* 4797 * Check the mid_state and signature on received buffer (if any), and queue the 4798 * workqueue completion task. 4799 */ 4800 static void 4801 smb2_writev_callback(struct mid_q_entry *mid) 4802 { 4803 struct cifs_io_subrequest *wdata = mid->callback_data; 4804 struct cifs_tcon *tcon = tlink_tcon(wdata->req->cfile->tlink); 4805 struct TCP_Server_Info *server = wdata->server; 4806 struct smb2_write_rsp *rsp = (struct smb2_write_rsp *)mid->resp_buf; 4807 struct cifs_credits credits = { 4808 .value = 0, 4809 .instance = 0, 4810 .rreq_debug_id = wdata->rreq->debug_id, 4811 .rreq_debug_index = wdata->subreq.debug_index, 4812 }; 4813 unsigned int rreq_debug_id = wdata->rreq->debug_id; 4814 unsigned int subreq_debug_index = wdata->subreq.debug_index; 4815 ssize_t result = 0; 4816 size_t written; 4817 4818 WARN_ONCE(wdata->server != mid->server, 4819 "wdata server %p != mid server %p", 4820 wdata->server, mid->server); 4821 4822 switch (mid->mid_state) { 4823 case MID_RESPONSE_RECEIVED: 4824 credits.value = le16_to_cpu(rsp->hdr.CreditRequest); 4825 credits.instance = server->reconnect_instance; 4826 result = smb2_check_receive(mid, server, 0); 4827 if (result != 0) 4828 break; 4829 4830 written = le32_to_cpu(rsp->DataLength); 4831 /* 4832 * Mask off high 16 bits when bytes written as returned 4833 * by the server is greater than bytes requested by the 4834 * client. OS/2 servers are known to set incorrect 4835 * CountHigh values. 4836 */ 4837 if (written > wdata->subreq.len) 4838 written &= 0xFFFF; 4839 4840 cifs_stats_bytes_written(tcon, written); 4841 4842 if (written < wdata->subreq.len) { 4843 wdata->result = -ENOSPC; 4844 } else if (written > 0) { 4845 wdata->subreq.len = written; 4846 __set_bit(NETFS_SREQ_MADE_PROGRESS, &wdata->subreq.flags); 4847 } 4848 break; 4849 case MID_REQUEST_SUBMITTED: 4850 case MID_RETRY_NEEDED: 4851 result = -EAGAIN; 4852 break; 4853 case MID_RESPONSE_MALFORMED: 4854 credits.value = le16_to_cpu(rsp->hdr.CreditRequest); 4855 credits.instance = server->reconnect_instance; 4856 fallthrough; 4857 default: 4858 result = -EIO; 4859 break; 4860 } 4861 #ifdef CONFIG_CIFS_SMB_DIRECT 4862 /* 4863 * If this wdata has a memory registered, the MR can be freed 4864 * The number of MRs available is limited, it's important to recover 4865 * used MR as soon as I/O is finished. Hold MR longer in the later 4866 * I/O process can possibly result in I/O deadlock due to lack of MR 4867 * to send request on I/O retry 4868 */ 4869 if (wdata->mr) { 4870 smbd_deregister_mr(wdata->mr); 4871 wdata->mr = NULL; 4872 } 4873 #endif 4874 if (result) { 4875 cifs_stats_fail_inc(tcon, SMB2_WRITE_HE); 4876 trace_smb3_write_err(wdata->rreq->debug_id, 4877 wdata->subreq.debug_index, 4878 wdata->xid, 4879 wdata->req->cfile->fid.persistent_fid, 4880 tcon->tid, tcon->ses->Suid, wdata->subreq.start, 4881 wdata->subreq.len, wdata->result); 4882 if (wdata->result == -ENOSPC) 4883 pr_warn_once("Out of space writing to %s\n", 4884 tcon->tree_name); 4885 } else 4886 trace_smb3_write_done(wdata->rreq->debug_id, 4887 wdata->subreq.debug_index, 4888 wdata->xid, 4889 wdata->req->cfile->fid.persistent_fid, 4890 tcon->tid, tcon->ses->Suid, 4891 wdata->subreq.start, wdata->subreq.len); 4892 4893 trace_smb3_rw_credits(rreq_debug_id, subreq_debug_index, wdata->credits.value, 4894 server->credits, server->in_flight, 4895 0, cifs_trace_rw_credits_write_response_clear); 4896 wdata->credits.value = 0; 4897 trace_netfs_sreq(&wdata->subreq, netfs_sreq_trace_io_progress); 4898 cifs_write_subrequest_terminated(wdata, result ?: written); 4899 release_mid(mid); 4900 trace_smb3_rw_credits(rreq_debug_id, subreq_debug_index, 0, 4901 server->credits, server->in_flight, 4902 credits.value, cifs_trace_rw_credits_write_response_add); 4903 add_credits(server, &credits, 0); 4904 } 4905 4906 /* smb2_async_writev - send an async write, and set up mid to handle result */ 4907 void 4908 smb2_async_writev(struct cifs_io_subrequest *wdata) 4909 { 4910 int rc = -EACCES, flags = 0; 4911 struct smb2_write_req *req = NULL; 4912 struct smb2_hdr *shdr; 4913 struct cifs_tcon *tcon = tlink_tcon(wdata->req->cfile->tlink); 4914 struct TCP_Server_Info *server = wdata->server; 4915 struct kvec iov[1]; 4916 struct smb_rqst rqst = { }; 4917 unsigned int total_len, xid = wdata->xid; 4918 struct cifs_io_parms _io_parms; 4919 struct cifs_io_parms *io_parms = NULL; 4920 int credit_request; 4921 4922 /* 4923 * in future we may get cifs_io_parms passed in from the caller, 4924 * but for now we construct it here... 4925 */ 4926 _io_parms = (struct cifs_io_parms) { 4927 .tcon = tcon, 4928 .server = server, 4929 .offset = wdata->subreq.start, 4930 .length = wdata->subreq.len, 4931 .persistent_fid = wdata->req->cfile->fid.persistent_fid, 4932 .volatile_fid = wdata->req->cfile->fid.volatile_fid, 4933 .pid = wdata->req->pid, 4934 }; 4935 io_parms = &_io_parms; 4936 4937 rc = smb2_plain_req_init(SMB2_WRITE, tcon, server, 4938 (void **) &req, &total_len); 4939 if (rc) 4940 goto out; 4941 4942 rqst.rq_iov = iov; 4943 rqst.rq_iter = wdata->subreq.io_iter; 4944 4945 rqst.rq_iov[0].iov_len = total_len - 1; 4946 rqst.rq_iov[0].iov_base = (char *)req; 4947 rqst.rq_nvec += 1; 4948 4949 if (smb3_encryption_required(tcon)) 4950 flags |= CIFS_TRANSFORM_REQ; 4951 4952 shdr = (struct smb2_hdr *)req; 4953 shdr->Id.SyncId.ProcessId = cpu_to_le32(io_parms->pid); 4954 4955 req->PersistentFileId = io_parms->persistent_fid; 4956 req->VolatileFileId = io_parms->volatile_fid; 4957 req->WriteChannelInfoOffset = 0; 4958 req->WriteChannelInfoLength = 0; 4959 req->Channel = SMB2_CHANNEL_NONE; 4960 req->Length = cpu_to_le32(io_parms->length); 4961 req->Offset = cpu_to_le64(io_parms->offset); 4962 req->DataOffset = cpu_to_le16( 4963 offsetof(struct smb2_write_req, Buffer)); 4964 req->RemainingBytes = 0; 4965 4966 trace_smb3_write_enter(wdata->rreq->debug_id, 4967 wdata->subreq.debug_index, 4968 wdata->xid, 4969 io_parms->persistent_fid, 4970 io_parms->tcon->tid, 4971 io_parms->tcon->ses->Suid, 4972 io_parms->offset, 4973 io_parms->length); 4974 4975 #ifdef CONFIG_CIFS_SMB_DIRECT 4976 /* 4977 * If we want to do a server RDMA read, fill in and append 4978 * smbd_buffer_descriptor_v1 to the end of write request 4979 */ 4980 if (smb3_use_rdma_offload(io_parms)) { 4981 struct smbd_buffer_descriptor_v1 *v1; 4982 bool need_invalidate = server->dialect == SMB30_PROT_ID; 4983 4984 wdata->mr = smbd_register_mr(server->smbd_conn, &wdata->subreq.io_iter, 4985 false, need_invalidate); 4986 if (!wdata->mr) { 4987 rc = -EAGAIN; 4988 goto async_writev_out; 4989 } 4990 /* For RDMA read, I/O size is in RemainingBytes not in Length */ 4991 req->RemainingBytes = req->Length; 4992 req->Length = 0; 4993 req->DataOffset = 0; 4994 req->Channel = SMB2_CHANNEL_RDMA_V1_INVALIDATE; 4995 if (need_invalidate) 4996 req->Channel = SMB2_CHANNEL_RDMA_V1; 4997 req->WriteChannelInfoOffset = 4998 cpu_to_le16(offsetof(struct smb2_write_req, Buffer)); 4999 req->WriteChannelInfoLength = 5000 cpu_to_le16(sizeof(struct smbd_buffer_descriptor_v1)); 5001 v1 = (struct smbd_buffer_descriptor_v1 *) &req->Buffer[0]; 5002 v1->offset = cpu_to_le64(wdata->mr->mr->iova); 5003 v1->token = cpu_to_le32(wdata->mr->mr->rkey); 5004 v1->length = cpu_to_le32(wdata->mr->mr->length); 5005 5006 rqst.rq_iov[0].iov_len += sizeof(*v1); 5007 5008 /* 5009 * We keep wdata->subreq.io_iter, 5010 * but we have to truncate rqst.rq_iter 5011 */ 5012 iov_iter_truncate(&rqst.rq_iter, 0); 5013 } 5014 #endif 5015 5016 if (wdata->subreq.retry_count > 0) 5017 smb2_set_replay(server, &rqst); 5018 5019 cifs_dbg(FYI, "async write at %llu %u bytes iter=%zx\n", 5020 io_parms->offset, io_parms->length, iov_iter_count(&wdata->subreq.io_iter)); 5021 5022 if (wdata->credits.value > 0) { 5023 shdr->CreditCharge = cpu_to_le16(DIV_ROUND_UP(wdata->subreq.len, 5024 SMB2_MAX_BUFFER_SIZE)); 5025 credit_request = le16_to_cpu(shdr->CreditCharge) + 8; 5026 if (server->credits >= server->max_credits) 5027 shdr->CreditRequest = cpu_to_le16(0); 5028 else 5029 shdr->CreditRequest = cpu_to_le16( 5030 min_t(int, server->max_credits - 5031 server->credits, credit_request)); 5032 5033 rc = adjust_credits(server, wdata, cifs_trace_rw_credits_call_writev_adjust); 5034 if (rc) 5035 goto async_writev_out; 5036 5037 flags |= CIFS_HAS_CREDITS; 5038 } 5039 5040 /* XXX: compression + encryption is unsupported for now */ 5041 if (((flags & CIFS_TRANSFORM_REQ) != CIFS_TRANSFORM_REQ) && should_compress(tcon, &rqst)) 5042 flags |= CIFS_COMPRESS_REQ; 5043 5044 rc = cifs_call_async(server, &rqst, NULL, smb2_writev_callback, NULL, 5045 wdata, flags, &wdata->credits); 5046 /* Can't touch wdata if rc == 0 */ 5047 if (rc) { 5048 trace_smb3_write_err(wdata->rreq->debug_id, 5049 wdata->subreq.debug_index, 5050 xid, 5051 io_parms->persistent_fid, 5052 io_parms->tcon->tid, 5053 io_parms->tcon->ses->Suid, 5054 io_parms->offset, 5055 io_parms->length, 5056 rc); 5057 cifs_stats_fail_inc(tcon, SMB2_WRITE_HE); 5058 } 5059 5060 async_writev_out: 5061 cifs_small_buf_release(req); 5062 out: 5063 if (rc) { 5064 trace_smb3_rw_credits(wdata->rreq->debug_id, 5065 wdata->subreq.debug_index, 5066 wdata->credits.value, 5067 server->credits, server->in_flight, 5068 -(int)wdata->credits.value, 5069 cifs_trace_rw_credits_write_response_clear); 5070 add_credits_and_wake_if(wdata->server, &wdata->credits, 0); 5071 cifs_write_subrequest_terminated(wdata, rc); 5072 } 5073 } 5074 5075 /* 5076 * SMB2_write function gets iov pointer to kvec array with n_vec as a length. 5077 * The length field from io_parms must be at least 1 and indicates a number of 5078 * elements with data to write that begins with position 1 in iov array. All 5079 * data length is specified by count. 5080 */ 5081 int 5082 SMB2_write(const unsigned int xid, struct cifs_io_parms *io_parms, 5083 unsigned int *nbytes, struct kvec *iov, int n_vec) 5084 { 5085 struct smb_rqst rqst; 5086 int rc = 0; 5087 struct smb2_write_req *req = NULL; 5088 struct smb2_write_rsp *rsp = NULL; 5089 int resp_buftype; 5090 struct kvec rsp_iov; 5091 int flags = 0; 5092 unsigned int total_len; 5093 struct TCP_Server_Info *server; 5094 int retries = 0, cur_sleep = 1; 5095 5096 replay_again: 5097 /* reinitialize for possible replay */ 5098 flags = 0; 5099 *nbytes = 0; 5100 if (!io_parms->server) 5101 io_parms->server = cifs_pick_channel(io_parms->tcon->ses); 5102 server = io_parms->server; 5103 if (server == NULL) 5104 return -ECONNABORTED; 5105 5106 if (n_vec < 1) 5107 return rc; 5108 5109 rc = smb2_plain_req_init(SMB2_WRITE, io_parms->tcon, server, 5110 (void **) &req, &total_len); 5111 if (rc) 5112 return rc; 5113 5114 if (smb3_encryption_required(io_parms->tcon)) 5115 flags |= CIFS_TRANSFORM_REQ; 5116 5117 req->hdr.Id.SyncId.ProcessId = cpu_to_le32(io_parms->pid); 5118 5119 req->PersistentFileId = io_parms->persistent_fid; 5120 req->VolatileFileId = io_parms->volatile_fid; 5121 req->WriteChannelInfoOffset = 0; 5122 req->WriteChannelInfoLength = 0; 5123 req->Channel = 0; 5124 req->Length = cpu_to_le32(io_parms->length); 5125 req->Offset = cpu_to_le64(io_parms->offset); 5126 req->DataOffset = cpu_to_le16( 5127 offsetof(struct smb2_write_req, Buffer)); 5128 req->RemainingBytes = 0; 5129 5130 trace_smb3_write_enter(0, 0, xid, io_parms->persistent_fid, 5131 io_parms->tcon->tid, io_parms->tcon->ses->Suid, 5132 io_parms->offset, io_parms->length); 5133 5134 iov[0].iov_base = (char *)req; 5135 /* 1 for Buffer */ 5136 iov[0].iov_len = total_len - 1; 5137 5138 memset(&rqst, 0, sizeof(struct smb_rqst)); 5139 rqst.rq_iov = iov; 5140 rqst.rq_nvec = n_vec + 1; 5141 5142 if (retries) 5143 smb2_set_replay(server, &rqst); 5144 5145 rc = cifs_send_recv(xid, io_parms->tcon->ses, server, 5146 &rqst, 5147 &resp_buftype, flags, &rsp_iov); 5148 rsp = (struct smb2_write_rsp *)rsp_iov.iov_base; 5149 5150 if (rc) { 5151 trace_smb3_write_err(0, 0, xid, 5152 req->PersistentFileId, 5153 io_parms->tcon->tid, 5154 io_parms->tcon->ses->Suid, 5155 io_parms->offset, io_parms->length, rc); 5156 cifs_stats_fail_inc(io_parms->tcon, SMB2_WRITE_HE); 5157 cifs_dbg(VFS, "Send error in write = %d\n", rc); 5158 } else { 5159 *nbytes = le32_to_cpu(rsp->DataLength); 5160 cifs_stats_bytes_written(io_parms->tcon, *nbytes); 5161 trace_smb3_write_done(0, 0, xid, 5162 req->PersistentFileId, 5163 io_parms->tcon->tid, 5164 io_parms->tcon->ses->Suid, 5165 io_parms->offset, *nbytes); 5166 } 5167 5168 cifs_small_buf_release(req); 5169 free_rsp_buf(resp_buftype, rsp); 5170 5171 if (is_replayable_error(rc) && 5172 smb2_should_replay(io_parms->tcon, &retries, &cur_sleep)) 5173 goto replay_again; 5174 5175 return rc; 5176 } 5177 5178 int posix_info_sid_size(const void *beg, const void *end) 5179 { 5180 size_t subauth; 5181 int total; 5182 5183 if (beg + 1 > end) 5184 return -1; 5185 5186 subauth = *(u8 *)(beg+1); 5187 if (subauth < 1 || subauth > 15) 5188 return -1; 5189 5190 total = 1 + 1 + 6 + 4*subauth; 5191 if (beg + total > end) 5192 return -1; 5193 5194 return total; 5195 } 5196 5197 int posix_info_parse(const void *beg, const void *end, 5198 struct smb2_posix_info_parsed *out) 5199 5200 { 5201 int total_len = 0; 5202 int owner_len, group_len; 5203 int name_len; 5204 const void *owner_sid; 5205 const void *group_sid; 5206 const void *name; 5207 5208 /* if no end bound given, assume payload to be correct */ 5209 if (!end) { 5210 const struct smb2_posix_info *p = beg; 5211 5212 end = beg + le32_to_cpu(p->NextEntryOffset); 5213 /* last element will have a 0 offset, pick a sensible bound */ 5214 if (end == beg) 5215 end += 0xFFFF; 5216 } 5217 5218 /* check base buf */ 5219 if (beg + sizeof(struct smb2_posix_info) > end) 5220 return -1; 5221 total_len = sizeof(struct smb2_posix_info); 5222 5223 /* check owner sid */ 5224 owner_sid = beg + total_len; 5225 owner_len = posix_info_sid_size(owner_sid, end); 5226 if (owner_len < 0) 5227 return -1; 5228 total_len += owner_len; 5229 5230 /* check group sid */ 5231 group_sid = beg + total_len; 5232 group_len = posix_info_sid_size(group_sid, end); 5233 if (group_len < 0) 5234 return -1; 5235 total_len += group_len; 5236 5237 /* check name len */ 5238 if (beg + total_len + 4 > end) 5239 return -1; 5240 name_len = le32_to_cpu(*(__le32 *)(beg + total_len)); 5241 if (name_len < 1 || name_len > 0xFFFF) 5242 return -1; 5243 total_len += 4; 5244 5245 /* check name */ 5246 name = beg + total_len; 5247 if (name + name_len > end) 5248 return -1; 5249 total_len += name_len; 5250 5251 if (out) { 5252 out->base = beg; 5253 out->size = total_len; 5254 out->name_len = name_len; 5255 out->name = name; 5256 memcpy(&out->owner, owner_sid, owner_len); 5257 memcpy(&out->group, group_sid, group_len); 5258 } 5259 return total_len; 5260 } 5261 5262 static int posix_info_extra_size(const void *beg, const void *end) 5263 { 5264 int len = posix_info_parse(beg, end, NULL); 5265 5266 if (len < 0) 5267 return -1; 5268 return len - sizeof(struct smb2_posix_info); 5269 } 5270 5271 static unsigned int 5272 num_entries(int infotype, char *bufstart, char *end_of_buf, char **lastentry, 5273 size_t size) 5274 { 5275 int len; 5276 unsigned int entrycount = 0; 5277 unsigned int next_offset = 0; 5278 char *entryptr; 5279 FILE_DIRECTORY_INFO *dir_info; 5280 5281 if (bufstart == NULL) 5282 return 0; 5283 5284 entryptr = bufstart; 5285 5286 while (1) { 5287 if (entryptr + next_offset < entryptr || 5288 entryptr + next_offset > end_of_buf || 5289 entryptr + next_offset + size > end_of_buf) { 5290 cifs_dbg(VFS, "malformed search entry would overflow\n"); 5291 break; 5292 } 5293 5294 entryptr = entryptr + next_offset; 5295 dir_info = (FILE_DIRECTORY_INFO *)entryptr; 5296 5297 if (infotype == SMB_FIND_FILE_POSIX_INFO) 5298 len = posix_info_extra_size(entryptr, end_of_buf); 5299 else 5300 len = le32_to_cpu(dir_info->FileNameLength); 5301 5302 if (len < 0 || 5303 entryptr + len < entryptr || 5304 entryptr + len > end_of_buf || 5305 entryptr + len + size > end_of_buf) { 5306 cifs_dbg(VFS, "directory entry name would overflow frame end of buf %p\n", 5307 end_of_buf); 5308 break; 5309 } 5310 5311 *lastentry = entryptr; 5312 entrycount++; 5313 5314 next_offset = le32_to_cpu(dir_info->NextEntryOffset); 5315 if (!next_offset) 5316 break; 5317 } 5318 5319 return entrycount; 5320 } 5321 5322 /* 5323 * Readdir/FindFirst 5324 */ 5325 int SMB2_query_directory_init(const unsigned int xid, 5326 struct cifs_tcon *tcon, 5327 struct TCP_Server_Info *server, 5328 struct smb_rqst *rqst, 5329 u64 persistent_fid, u64 volatile_fid, 5330 int index, int info_level) 5331 { 5332 struct smb2_query_directory_req *req; 5333 unsigned char *bufptr; 5334 __le16 asteriks = cpu_to_le16('*'); 5335 unsigned int output_size = CIFSMaxBufSize - 5336 MAX_SMB2_CREATE_RESPONSE_SIZE - 5337 MAX_SMB2_CLOSE_RESPONSE_SIZE; 5338 unsigned int total_len; 5339 struct kvec *iov = rqst->rq_iov; 5340 int len, rc; 5341 5342 rc = smb2_plain_req_init(SMB2_QUERY_DIRECTORY, tcon, server, 5343 (void **) &req, &total_len); 5344 if (rc) 5345 return rc; 5346 5347 switch (info_level) { 5348 case SMB_FIND_FILE_DIRECTORY_INFO: 5349 req->FileInformationClass = FILE_DIRECTORY_INFORMATION; 5350 break; 5351 case SMB_FIND_FILE_ID_FULL_DIR_INFO: 5352 req->FileInformationClass = FILEID_FULL_DIRECTORY_INFORMATION; 5353 break; 5354 case SMB_FIND_FILE_POSIX_INFO: 5355 req->FileInformationClass = SMB_FIND_FILE_POSIX_INFO; 5356 break; 5357 case SMB_FIND_FILE_FULL_DIRECTORY_INFO: 5358 req->FileInformationClass = FILE_FULL_DIRECTORY_INFORMATION; 5359 break; 5360 default: 5361 cifs_tcon_dbg(VFS, "info level %u isn't supported\n", 5362 info_level); 5363 return -EINVAL; 5364 } 5365 5366 req->FileIndex = cpu_to_le32(index); 5367 req->PersistentFileId = persistent_fid; 5368 req->VolatileFileId = volatile_fid; 5369 5370 len = 0x2; 5371 bufptr = req->Buffer; 5372 memcpy(bufptr, &asteriks, len); 5373 5374 req->FileNameOffset = 5375 cpu_to_le16(sizeof(struct smb2_query_directory_req)); 5376 req->FileNameLength = cpu_to_le16(len); 5377 /* 5378 * BB could be 30 bytes or so longer if we used SMB2 specific 5379 * buffer lengths, but this is safe and close enough. 5380 */ 5381 output_size = min_t(unsigned int, output_size, server->maxBuf); 5382 output_size = min_t(unsigned int, output_size, 2 << 15); 5383 req->OutputBufferLength = cpu_to_le32(output_size); 5384 5385 iov[0].iov_base = (char *)req; 5386 /* 1 for Buffer */ 5387 iov[0].iov_len = total_len - 1; 5388 5389 iov[1].iov_base = (char *)(req->Buffer); 5390 iov[1].iov_len = len; 5391 5392 trace_smb3_query_dir_enter(xid, persistent_fid, tcon->tid, 5393 tcon->ses->Suid, index, output_size); 5394 5395 return 0; 5396 } 5397 5398 void SMB2_query_directory_free(struct smb_rqst *rqst) 5399 { 5400 if (rqst && rqst->rq_iov) { 5401 cifs_small_buf_release(rqst->rq_iov[0].iov_base); /* request */ 5402 } 5403 } 5404 5405 int 5406 smb2_parse_query_directory(struct cifs_tcon *tcon, 5407 struct kvec *rsp_iov, 5408 int resp_buftype, 5409 struct cifs_search_info *srch_inf) 5410 { 5411 struct smb2_query_directory_rsp *rsp; 5412 size_t info_buf_size; 5413 char *end_of_smb; 5414 int rc; 5415 5416 rsp = (struct smb2_query_directory_rsp *)rsp_iov->iov_base; 5417 5418 switch (srch_inf->info_level) { 5419 case SMB_FIND_FILE_DIRECTORY_INFO: 5420 info_buf_size = sizeof(FILE_DIRECTORY_INFO); 5421 break; 5422 case SMB_FIND_FILE_ID_FULL_DIR_INFO: 5423 info_buf_size = sizeof(SEARCH_ID_FULL_DIR_INFO); 5424 break; 5425 case SMB_FIND_FILE_POSIX_INFO: 5426 /* note that posix payload are variable size */ 5427 info_buf_size = sizeof(struct smb2_posix_info); 5428 break; 5429 case SMB_FIND_FILE_FULL_DIRECTORY_INFO: 5430 info_buf_size = sizeof(FILE_FULL_DIRECTORY_INFO); 5431 break; 5432 default: 5433 cifs_tcon_dbg(VFS, "info level %u isn't supported\n", 5434 srch_inf->info_level); 5435 return -EINVAL; 5436 } 5437 5438 rc = smb2_validate_iov(le16_to_cpu(rsp->OutputBufferOffset), 5439 le32_to_cpu(rsp->OutputBufferLength), rsp_iov, 5440 info_buf_size); 5441 if (rc) { 5442 cifs_tcon_dbg(VFS, "bad info payload"); 5443 return rc; 5444 } 5445 5446 srch_inf->unicode = true; 5447 5448 if (srch_inf->ntwrk_buf_start) { 5449 if (srch_inf->smallBuf) 5450 cifs_small_buf_release(srch_inf->ntwrk_buf_start); 5451 else 5452 cifs_buf_release(srch_inf->ntwrk_buf_start); 5453 } 5454 srch_inf->ntwrk_buf_start = (char *)rsp; 5455 srch_inf->srch_entries_start = srch_inf->last_entry = 5456 (char *)rsp + le16_to_cpu(rsp->OutputBufferOffset); 5457 end_of_smb = rsp_iov->iov_len + (char *)rsp; 5458 5459 srch_inf->entries_in_buffer = num_entries( 5460 srch_inf->info_level, 5461 srch_inf->srch_entries_start, 5462 end_of_smb, 5463 &srch_inf->last_entry, 5464 info_buf_size); 5465 5466 srch_inf->index_of_last_entry += srch_inf->entries_in_buffer; 5467 cifs_dbg(FYI, "num entries %d last_index %lld srch start %p srch end %p\n", 5468 srch_inf->entries_in_buffer, srch_inf->index_of_last_entry, 5469 srch_inf->srch_entries_start, srch_inf->last_entry); 5470 if (resp_buftype == CIFS_LARGE_BUFFER) 5471 srch_inf->smallBuf = false; 5472 else if (resp_buftype == CIFS_SMALL_BUFFER) 5473 srch_inf->smallBuf = true; 5474 else 5475 cifs_tcon_dbg(VFS, "Invalid search buffer type\n"); 5476 5477 return 0; 5478 } 5479 5480 int 5481 SMB2_query_directory(const unsigned int xid, struct cifs_tcon *tcon, 5482 u64 persistent_fid, u64 volatile_fid, int index, 5483 struct cifs_search_info *srch_inf) 5484 { 5485 struct smb_rqst rqst; 5486 struct kvec iov[SMB2_QUERY_DIRECTORY_IOV_SIZE]; 5487 struct smb2_query_directory_rsp *rsp = NULL; 5488 int resp_buftype = CIFS_NO_BUFFER; 5489 struct kvec rsp_iov; 5490 int rc = 0; 5491 struct cifs_ses *ses = tcon->ses; 5492 struct TCP_Server_Info *server; 5493 int flags = 0; 5494 int retries = 0, cur_sleep = 1; 5495 5496 replay_again: 5497 /* reinitialize for possible replay */ 5498 flags = 0; 5499 server = cifs_pick_channel(ses); 5500 5501 if (!ses || !(ses->server)) 5502 return -EIO; 5503 5504 if (smb3_encryption_required(tcon)) 5505 flags |= CIFS_TRANSFORM_REQ; 5506 5507 memset(&rqst, 0, sizeof(struct smb_rqst)); 5508 memset(&iov, 0, sizeof(iov)); 5509 rqst.rq_iov = iov; 5510 rqst.rq_nvec = SMB2_QUERY_DIRECTORY_IOV_SIZE; 5511 5512 rc = SMB2_query_directory_init(xid, tcon, server, 5513 &rqst, persistent_fid, 5514 volatile_fid, index, 5515 srch_inf->info_level); 5516 if (rc) 5517 goto qdir_exit; 5518 5519 if (retries) 5520 smb2_set_replay(server, &rqst); 5521 5522 rc = cifs_send_recv(xid, ses, server, 5523 &rqst, &resp_buftype, flags, &rsp_iov); 5524 rsp = (struct smb2_query_directory_rsp *)rsp_iov.iov_base; 5525 5526 if (rc) { 5527 if (rc == -ENODATA && 5528 rsp->hdr.Status == STATUS_NO_MORE_FILES) { 5529 trace_smb3_query_dir_done(xid, persistent_fid, 5530 tcon->tid, tcon->ses->Suid, index, 0); 5531 srch_inf->endOfSearch = true; 5532 rc = 0; 5533 } else { 5534 trace_smb3_query_dir_err(xid, persistent_fid, tcon->tid, 5535 tcon->ses->Suid, index, 0, rc); 5536 cifs_stats_fail_inc(tcon, SMB2_QUERY_DIRECTORY_HE); 5537 } 5538 goto qdir_exit; 5539 } 5540 5541 rc = smb2_parse_query_directory(tcon, &rsp_iov, resp_buftype, 5542 srch_inf); 5543 if (rc) { 5544 trace_smb3_query_dir_err(xid, persistent_fid, tcon->tid, 5545 tcon->ses->Suid, index, 0, rc); 5546 goto qdir_exit; 5547 } 5548 resp_buftype = CIFS_NO_BUFFER; 5549 5550 trace_smb3_query_dir_done(xid, persistent_fid, tcon->tid, 5551 tcon->ses->Suid, index, srch_inf->entries_in_buffer); 5552 5553 qdir_exit: 5554 SMB2_query_directory_free(&rqst); 5555 free_rsp_buf(resp_buftype, rsp); 5556 5557 if (is_replayable_error(rc) && 5558 smb2_should_replay(tcon, &retries, &cur_sleep)) 5559 goto replay_again; 5560 5561 return rc; 5562 } 5563 5564 int 5565 SMB2_set_info_init(struct cifs_tcon *tcon, struct TCP_Server_Info *server, 5566 struct smb_rqst *rqst, 5567 u64 persistent_fid, u64 volatile_fid, u32 pid, 5568 u8 info_class, u8 info_type, u32 additional_info, 5569 void **data, unsigned int *size) 5570 { 5571 struct smb2_set_info_req *req; 5572 struct kvec *iov = rqst->rq_iov; 5573 unsigned int i, total_len; 5574 int rc; 5575 5576 rc = smb2_plain_req_init(SMB2_SET_INFO, tcon, server, 5577 (void **) &req, &total_len); 5578 if (rc) 5579 return rc; 5580 5581 req->hdr.Id.SyncId.ProcessId = cpu_to_le32(pid); 5582 req->InfoType = info_type; 5583 req->FileInfoClass = info_class; 5584 req->PersistentFileId = persistent_fid; 5585 req->VolatileFileId = volatile_fid; 5586 req->AdditionalInformation = cpu_to_le32(additional_info); 5587 5588 req->BufferOffset = cpu_to_le16(sizeof(struct smb2_set_info_req)); 5589 req->BufferLength = cpu_to_le32(*size); 5590 5591 memcpy(req->Buffer, *data, *size); 5592 total_len += *size; 5593 5594 iov[0].iov_base = (char *)req; 5595 /* 1 for Buffer */ 5596 iov[0].iov_len = total_len - 1; 5597 5598 for (i = 1; i < rqst->rq_nvec; i++) { 5599 le32_add_cpu(&req->BufferLength, size[i]); 5600 iov[i].iov_base = (char *)data[i]; 5601 iov[i].iov_len = size[i]; 5602 } 5603 5604 return 0; 5605 } 5606 5607 void 5608 SMB2_set_info_free(struct smb_rqst *rqst) 5609 { 5610 if (rqst && rqst->rq_iov) 5611 cifs_buf_release(rqst->rq_iov[0].iov_base); /* request */ 5612 } 5613 5614 static int 5615 send_set_info(const unsigned int xid, struct cifs_tcon *tcon, 5616 u64 persistent_fid, u64 volatile_fid, u32 pid, u8 info_class, 5617 u8 info_type, u32 additional_info, unsigned int num, 5618 void **data, unsigned int *size) 5619 { 5620 struct smb_rqst rqst; 5621 struct smb2_set_info_rsp *rsp = NULL; 5622 struct kvec *iov; 5623 struct kvec rsp_iov; 5624 int rc = 0; 5625 int resp_buftype; 5626 struct cifs_ses *ses = tcon->ses; 5627 struct TCP_Server_Info *server; 5628 int flags = 0; 5629 int retries = 0, cur_sleep = 1; 5630 5631 replay_again: 5632 /* reinitialize for possible replay */ 5633 flags = 0; 5634 server = cifs_pick_channel(ses); 5635 5636 if (!ses || !server) 5637 return -EIO; 5638 5639 if (!num) 5640 return -EINVAL; 5641 5642 if (smb3_encryption_required(tcon)) 5643 flags |= CIFS_TRANSFORM_REQ; 5644 5645 iov = kmalloc_array(num, sizeof(struct kvec), GFP_KERNEL); 5646 if (!iov) 5647 return -ENOMEM; 5648 5649 memset(&rqst, 0, sizeof(struct smb_rqst)); 5650 rqst.rq_iov = iov; 5651 rqst.rq_nvec = num; 5652 5653 rc = SMB2_set_info_init(tcon, server, 5654 &rqst, persistent_fid, volatile_fid, pid, 5655 info_class, info_type, additional_info, 5656 data, size); 5657 if (rc) { 5658 kfree(iov); 5659 return rc; 5660 } 5661 5662 if (retries) 5663 smb2_set_replay(server, &rqst); 5664 5665 rc = cifs_send_recv(xid, ses, server, 5666 &rqst, &resp_buftype, flags, 5667 &rsp_iov); 5668 SMB2_set_info_free(&rqst); 5669 rsp = (struct smb2_set_info_rsp *)rsp_iov.iov_base; 5670 5671 if (rc != 0) { 5672 cifs_stats_fail_inc(tcon, SMB2_SET_INFO_HE); 5673 trace_smb3_set_info_err(xid, persistent_fid, tcon->tid, 5674 ses->Suid, info_class, (__u32)info_type, rc); 5675 } 5676 5677 free_rsp_buf(resp_buftype, rsp); 5678 kfree(iov); 5679 5680 if (is_replayable_error(rc) && 5681 smb2_should_replay(tcon, &retries, &cur_sleep)) 5682 goto replay_again; 5683 5684 return rc; 5685 } 5686 5687 int 5688 SMB2_set_eof(const unsigned int xid, struct cifs_tcon *tcon, u64 persistent_fid, 5689 u64 volatile_fid, u32 pid, loff_t new_eof) 5690 { 5691 struct smb2_file_eof_info info; 5692 void *data; 5693 unsigned int size; 5694 5695 info.EndOfFile = cpu_to_le64(new_eof); 5696 5697 data = &info; 5698 size = sizeof(struct smb2_file_eof_info); 5699 5700 trace_smb3_set_eof(xid, persistent_fid, tcon->tid, tcon->ses->Suid, new_eof); 5701 5702 return send_set_info(xid, tcon, persistent_fid, volatile_fid, 5703 pid, FILE_END_OF_FILE_INFORMATION, SMB2_O_INFO_FILE, 5704 0, 1, &data, &size); 5705 } 5706 5707 int 5708 SMB2_set_acl(const unsigned int xid, struct cifs_tcon *tcon, 5709 u64 persistent_fid, u64 volatile_fid, 5710 struct smb_ntsd *pnntsd, int pacllen, int aclflag) 5711 { 5712 return send_set_info(xid, tcon, persistent_fid, volatile_fid, 5713 current->tgid, 0, SMB2_O_INFO_SECURITY, aclflag, 5714 1, (void **)&pnntsd, &pacllen); 5715 } 5716 5717 int 5718 SMB2_set_ea(const unsigned int xid, struct cifs_tcon *tcon, 5719 u64 persistent_fid, u64 volatile_fid, 5720 struct smb2_file_full_ea_info *buf, int len) 5721 { 5722 return send_set_info(xid, tcon, persistent_fid, volatile_fid, 5723 current->tgid, FILE_FULL_EA_INFORMATION, SMB2_O_INFO_FILE, 5724 0, 1, (void **)&buf, &len); 5725 } 5726 5727 int 5728 SMB2_oplock_break(const unsigned int xid, struct cifs_tcon *tcon, 5729 const u64 persistent_fid, const u64 volatile_fid, 5730 __u8 oplock_level) 5731 { 5732 struct smb_rqst rqst; 5733 int rc; 5734 struct smb2_oplock_break *req = NULL; 5735 struct cifs_ses *ses = tcon->ses; 5736 struct TCP_Server_Info *server; 5737 int flags = CIFS_OBREAK_OP; 5738 unsigned int total_len; 5739 struct kvec iov[1]; 5740 struct kvec rsp_iov; 5741 int resp_buf_type; 5742 int retries = 0, cur_sleep = 1; 5743 5744 replay_again: 5745 /* reinitialize for possible replay */ 5746 flags = CIFS_OBREAK_OP; 5747 server = cifs_pick_channel(ses); 5748 5749 cifs_dbg(FYI, "SMB2_oplock_break\n"); 5750 rc = smb2_plain_req_init(SMB2_OPLOCK_BREAK, tcon, server, 5751 (void **) &req, &total_len); 5752 if (rc) 5753 return rc; 5754 5755 if (smb3_encryption_required(tcon)) 5756 flags |= CIFS_TRANSFORM_REQ; 5757 5758 req->VolatileFid = volatile_fid; 5759 req->PersistentFid = persistent_fid; 5760 req->OplockLevel = oplock_level; 5761 req->hdr.CreditRequest = cpu_to_le16(1); 5762 5763 flags |= CIFS_NO_RSP_BUF; 5764 5765 iov[0].iov_base = (char *)req; 5766 iov[0].iov_len = total_len; 5767 5768 memset(&rqst, 0, sizeof(struct smb_rqst)); 5769 rqst.rq_iov = iov; 5770 rqst.rq_nvec = 1; 5771 5772 if (retries) 5773 smb2_set_replay(server, &rqst); 5774 5775 rc = cifs_send_recv(xid, ses, server, 5776 &rqst, &resp_buf_type, flags, &rsp_iov); 5777 cifs_small_buf_release(req); 5778 if (rc) { 5779 cifs_stats_fail_inc(tcon, SMB2_OPLOCK_BREAK_HE); 5780 cifs_dbg(FYI, "Send error in Oplock Break = %d\n", rc); 5781 } 5782 5783 if (is_replayable_error(rc) && 5784 smb2_should_replay(tcon, &retries, &cur_sleep)) 5785 goto replay_again; 5786 5787 return rc; 5788 } 5789 5790 void 5791 smb2_copy_fs_info_to_kstatfs(struct smb2_fs_full_size_info *pfs_inf, 5792 struct kstatfs *kst) 5793 { 5794 kst->f_bsize = le32_to_cpu(pfs_inf->BytesPerSector) * 5795 le32_to_cpu(pfs_inf->SectorsPerAllocationUnit); 5796 kst->f_blocks = le64_to_cpu(pfs_inf->TotalAllocationUnits); 5797 kst->f_bfree = kst->f_bavail = 5798 le64_to_cpu(pfs_inf->CallerAvailableAllocationUnits); 5799 return; 5800 } 5801 5802 static void 5803 copy_posix_fs_info_to_kstatfs(FILE_SYSTEM_POSIX_INFO *response_data, 5804 struct kstatfs *kst) 5805 { 5806 kst->f_bsize = le32_to_cpu(response_data->BlockSize); 5807 kst->f_blocks = le64_to_cpu(response_data->TotalBlocks); 5808 kst->f_bfree = le64_to_cpu(response_data->BlocksAvail); 5809 if (response_data->UserBlocksAvail == cpu_to_le64(-1)) 5810 kst->f_bavail = kst->f_bfree; 5811 else 5812 kst->f_bavail = le64_to_cpu(response_data->UserBlocksAvail); 5813 if (response_data->TotalFileNodes != cpu_to_le64(-1)) 5814 kst->f_files = le64_to_cpu(response_data->TotalFileNodes); 5815 if (response_data->FreeFileNodes != cpu_to_le64(-1)) 5816 kst->f_ffree = le64_to_cpu(response_data->FreeFileNodes); 5817 5818 return; 5819 } 5820 5821 static int 5822 build_qfs_info_req(struct kvec *iov, struct cifs_tcon *tcon, 5823 struct TCP_Server_Info *server, 5824 int level, int outbuf_len, u64 persistent_fid, 5825 u64 volatile_fid) 5826 { 5827 int rc; 5828 struct smb2_query_info_req *req; 5829 unsigned int total_len; 5830 5831 cifs_dbg(FYI, "Query FSInfo level %d\n", level); 5832 5833 if ((tcon->ses == NULL) || server == NULL) 5834 return -EIO; 5835 5836 rc = smb2_plain_req_init(SMB2_QUERY_INFO, tcon, server, 5837 (void **) &req, &total_len); 5838 if (rc) 5839 return rc; 5840 5841 req->InfoType = SMB2_O_INFO_FILESYSTEM; 5842 req->FileInfoClass = level; 5843 req->PersistentFileId = persistent_fid; 5844 req->VolatileFileId = volatile_fid; 5845 /* 1 for pad */ 5846 req->InputBufferOffset = 5847 cpu_to_le16(sizeof(struct smb2_query_info_req)); 5848 req->OutputBufferLength = cpu_to_le32( 5849 outbuf_len + sizeof(struct smb2_query_info_rsp)); 5850 5851 iov->iov_base = (char *)req; 5852 iov->iov_len = total_len; 5853 return 0; 5854 } 5855 5856 static inline void free_qfs_info_req(struct kvec *iov) 5857 { 5858 cifs_buf_release(iov->iov_base); 5859 } 5860 5861 int 5862 SMB311_posix_qfs_info(const unsigned int xid, struct cifs_tcon *tcon, 5863 u64 persistent_fid, u64 volatile_fid, struct kstatfs *fsdata) 5864 { 5865 struct smb_rqst rqst; 5866 struct smb2_query_info_rsp *rsp = NULL; 5867 struct kvec iov; 5868 struct kvec rsp_iov; 5869 int rc = 0; 5870 int resp_buftype; 5871 struct cifs_ses *ses = tcon->ses; 5872 struct TCP_Server_Info *server; 5873 FILE_SYSTEM_POSIX_INFO *info = NULL; 5874 int flags = 0; 5875 int retries = 0, cur_sleep = 1; 5876 5877 replay_again: 5878 /* reinitialize for possible replay */ 5879 flags = 0; 5880 server = cifs_pick_channel(ses); 5881 5882 rc = build_qfs_info_req(&iov, tcon, server, 5883 FS_POSIX_INFORMATION, 5884 sizeof(FILE_SYSTEM_POSIX_INFO), 5885 persistent_fid, volatile_fid); 5886 if (rc) 5887 return rc; 5888 5889 if (smb3_encryption_required(tcon)) 5890 flags |= CIFS_TRANSFORM_REQ; 5891 5892 memset(&rqst, 0, sizeof(struct smb_rqst)); 5893 rqst.rq_iov = &iov; 5894 rqst.rq_nvec = 1; 5895 5896 if (retries) 5897 smb2_set_replay(server, &rqst); 5898 5899 rc = cifs_send_recv(xid, ses, server, 5900 &rqst, &resp_buftype, flags, &rsp_iov); 5901 free_qfs_info_req(&iov); 5902 if (rc) { 5903 cifs_stats_fail_inc(tcon, SMB2_QUERY_INFO_HE); 5904 goto posix_qfsinf_exit; 5905 } 5906 rsp = (struct smb2_query_info_rsp *)rsp_iov.iov_base; 5907 5908 info = (FILE_SYSTEM_POSIX_INFO *)( 5909 le16_to_cpu(rsp->OutputBufferOffset) + (char *)rsp); 5910 rc = smb2_validate_iov(le16_to_cpu(rsp->OutputBufferOffset), 5911 le32_to_cpu(rsp->OutputBufferLength), &rsp_iov, 5912 sizeof(FILE_SYSTEM_POSIX_INFO)); 5913 if (!rc) 5914 copy_posix_fs_info_to_kstatfs(info, fsdata); 5915 5916 posix_qfsinf_exit: 5917 free_rsp_buf(resp_buftype, rsp_iov.iov_base); 5918 5919 if (is_replayable_error(rc) && 5920 smb2_should_replay(tcon, &retries, &cur_sleep)) 5921 goto replay_again; 5922 5923 return rc; 5924 } 5925 5926 int 5927 SMB2_QFS_attr(const unsigned int xid, struct cifs_tcon *tcon, 5928 u64 persistent_fid, u64 volatile_fid, int level) 5929 { 5930 struct smb_rqst rqst; 5931 struct smb2_query_info_rsp *rsp = NULL; 5932 struct kvec iov; 5933 struct kvec rsp_iov; 5934 int rc = 0; 5935 int resp_buftype, max_len, min_len; 5936 struct cifs_ses *ses = tcon->ses; 5937 struct TCP_Server_Info *server; 5938 unsigned int rsp_len, offset; 5939 int flags = 0; 5940 int retries = 0, cur_sleep = 1; 5941 5942 replay_again: 5943 /* reinitialize for possible replay */ 5944 flags = 0; 5945 server = cifs_pick_channel(ses); 5946 5947 if (level == FS_DEVICE_INFORMATION) { 5948 max_len = sizeof(FILE_SYSTEM_DEVICE_INFO); 5949 min_len = sizeof(FILE_SYSTEM_DEVICE_INFO); 5950 } else if (level == FS_ATTRIBUTE_INFORMATION) { 5951 max_len = sizeof(FILE_SYSTEM_ATTRIBUTE_INFO); 5952 min_len = MIN_FS_ATTR_INFO_SIZE; 5953 } else if (level == FS_SECTOR_SIZE_INFORMATION) { 5954 max_len = sizeof(struct smb3_fs_ss_info); 5955 min_len = sizeof(struct smb3_fs_ss_info); 5956 } else if (level == FS_VOLUME_INFORMATION) { 5957 max_len = sizeof(struct smb3_fs_vol_info) + MAX_VOL_LABEL_LEN; 5958 min_len = sizeof(struct smb3_fs_vol_info); 5959 } else { 5960 cifs_dbg(FYI, "Invalid qfsinfo level %d\n", level); 5961 return -EINVAL; 5962 } 5963 5964 rc = build_qfs_info_req(&iov, tcon, server, 5965 level, max_len, 5966 persistent_fid, volatile_fid); 5967 if (rc) 5968 return rc; 5969 5970 if (smb3_encryption_required(tcon)) 5971 flags |= CIFS_TRANSFORM_REQ; 5972 5973 memset(&rqst, 0, sizeof(struct smb_rqst)); 5974 rqst.rq_iov = &iov; 5975 rqst.rq_nvec = 1; 5976 5977 if (retries) 5978 smb2_set_replay(server, &rqst); 5979 5980 rc = cifs_send_recv(xid, ses, server, 5981 &rqst, &resp_buftype, flags, &rsp_iov); 5982 free_qfs_info_req(&iov); 5983 if (rc) { 5984 cifs_stats_fail_inc(tcon, SMB2_QUERY_INFO_HE); 5985 goto qfsattr_exit; 5986 } 5987 rsp = (struct smb2_query_info_rsp *)rsp_iov.iov_base; 5988 5989 rsp_len = le32_to_cpu(rsp->OutputBufferLength); 5990 offset = le16_to_cpu(rsp->OutputBufferOffset); 5991 rc = smb2_validate_iov(offset, rsp_len, &rsp_iov, min_len); 5992 if (rc) 5993 goto qfsattr_exit; 5994 5995 if (level == FS_ATTRIBUTE_INFORMATION) 5996 memcpy(&tcon->fsAttrInfo, offset 5997 + (char *)rsp, min_t(unsigned int, 5998 rsp_len, max_len)); 5999 else if (level == FS_DEVICE_INFORMATION) 6000 memcpy(&tcon->fsDevInfo, offset 6001 + (char *)rsp, sizeof(FILE_SYSTEM_DEVICE_INFO)); 6002 else if (level == FS_SECTOR_SIZE_INFORMATION) { 6003 struct smb3_fs_ss_info *ss_info = (struct smb3_fs_ss_info *) 6004 (offset + (char *)rsp); 6005 tcon->ss_flags = le32_to_cpu(ss_info->Flags); 6006 tcon->perf_sector_size = 6007 le32_to_cpu(ss_info->PhysicalBytesPerSectorForPerf); 6008 } else if (level == FS_VOLUME_INFORMATION) { 6009 struct smb3_fs_vol_info *vol_info = (struct smb3_fs_vol_info *) 6010 (offset + (char *)rsp); 6011 tcon->vol_serial_number = vol_info->VolumeSerialNumber; 6012 tcon->vol_create_time = vol_info->VolumeCreationTime; 6013 } 6014 6015 qfsattr_exit: 6016 free_rsp_buf(resp_buftype, rsp_iov.iov_base); 6017 6018 if (is_replayable_error(rc) && 6019 smb2_should_replay(tcon, &retries, &cur_sleep)) 6020 goto replay_again; 6021 6022 return rc; 6023 } 6024 6025 int 6026 smb2_lockv(const unsigned int xid, struct cifs_tcon *tcon, 6027 const __u64 persist_fid, const __u64 volatile_fid, const __u32 pid, 6028 const __u32 num_lock, struct smb2_lock_element *buf) 6029 { 6030 struct smb_rqst rqst; 6031 int rc = 0; 6032 struct smb2_lock_req *req = NULL; 6033 struct kvec iov[2]; 6034 struct kvec rsp_iov; 6035 int resp_buf_type; 6036 unsigned int count; 6037 int flags = CIFS_NO_RSP_BUF; 6038 unsigned int total_len; 6039 struct TCP_Server_Info *server; 6040 int retries = 0, cur_sleep = 1; 6041 6042 replay_again: 6043 /* reinitialize for possible replay */ 6044 flags = CIFS_NO_RSP_BUF; 6045 server = cifs_pick_channel(tcon->ses); 6046 6047 cifs_dbg(FYI, "smb2_lockv num lock %d\n", num_lock); 6048 6049 rc = smb2_plain_req_init(SMB2_LOCK, tcon, server, 6050 (void **) &req, &total_len); 6051 if (rc) 6052 return rc; 6053 6054 if (smb3_encryption_required(tcon)) 6055 flags |= CIFS_TRANSFORM_REQ; 6056 6057 req->hdr.Id.SyncId.ProcessId = cpu_to_le32(pid); 6058 req->LockCount = cpu_to_le16(num_lock); 6059 6060 req->PersistentFileId = persist_fid; 6061 req->VolatileFileId = volatile_fid; 6062 6063 count = num_lock * sizeof(struct smb2_lock_element); 6064 6065 iov[0].iov_base = (char *)req; 6066 iov[0].iov_len = total_len - sizeof(struct smb2_lock_element); 6067 iov[1].iov_base = (char *)buf; 6068 iov[1].iov_len = count; 6069 6070 cifs_stats_inc(&tcon->stats.cifs_stats.num_locks); 6071 6072 memset(&rqst, 0, sizeof(struct smb_rqst)); 6073 rqst.rq_iov = iov; 6074 rqst.rq_nvec = 2; 6075 6076 if (retries) 6077 smb2_set_replay(server, &rqst); 6078 6079 rc = cifs_send_recv(xid, tcon->ses, server, 6080 &rqst, &resp_buf_type, flags, 6081 &rsp_iov); 6082 cifs_small_buf_release(req); 6083 if (rc) { 6084 cifs_dbg(FYI, "Send error in smb2_lockv = %d\n", rc); 6085 cifs_stats_fail_inc(tcon, SMB2_LOCK_HE); 6086 trace_smb3_lock_err(xid, persist_fid, tcon->tid, 6087 tcon->ses->Suid, rc); 6088 } 6089 6090 if (is_replayable_error(rc) && 6091 smb2_should_replay(tcon, &retries, &cur_sleep)) 6092 goto replay_again; 6093 6094 return rc; 6095 } 6096 6097 int 6098 SMB2_lock(const unsigned int xid, struct cifs_tcon *tcon, 6099 const __u64 persist_fid, const __u64 volatile_fid, const __u32 pid, 6100 const __u64 length, const __u64 offset, const __u32 lock_flags, 6101 const bool wait) 6102 { 6103 struct smb2_lock_element lock; 6104 6105 lock.Offset = cpu_to_le64(offset); 6106 lock.Length = cpu_to_le64(length); 6107 lock.Flags = cpu_to_le32(lock_flags); 6108 if (!wait && lock_flags != SMB2_LOCKFLAG_UNLOCK) 6109 lock.Flags |= cpu_to_le32(SMB2_LOCKFLAG_FAIL_IMMEDIATELY); 6110 6111 return smb2_lockv(xid, tcon, persist_fid, volatile_fid, pid, 1, &lock); 6112 } 6113 6114 int 6115 SMB2_lease_break(const unsigned int xid, struct cifs_tcon *tcon, 6116 __u8 *lease_key, const __le32 lease_state) 6117 { 6118 struct smb_rqst rqst; 6119 int rc; 6120 struct smb2_lease_ack *req = NULL; 6121 struct cifs_ses *ses = tcon->ses; 6122 int flags = CIFS_OBREAK_OP; 6123 unsigned int total_len; 6124 struct kvec iov[1]; 6125 struct kvec rsp_iov; 6126 int resp_buf_type; 6127 __u64 *please_key_high; 6128 __u64 *please_key_low; 6129 struct TCP_Server_Info *server = cifs_pick_channel(tcon->ses); 6130 6131 cifs_dbg(FYI, "SMB2_lease_break\n"); 6132 rc = smb2_plain_req_init(SMB2_OPLOCK_BREAK, tcon, server, 6133 (void **) &req, &total_len); 6134 if (rc) 6135 return rc; 6136 6137 if (smb3_encryption_required(tcon)) 6138 flags |= CIFS_TRANSFORM_REQ; 6139 6140 req->hdr.CreditRequest = cpu_to_le16(1); 6141 req->StructureSize = cpu_to_le16(36); 6142 total_len += 12; 6143 6144 memcpy(req->LeaseKey, lease_key, SMB2_LEASE_KEY_SIZE); 6145 req->LeaseState = lease_state; 6146 6147 flags |= CIFS_NO_RSP_BUF; 6148 6149 iov[0].iov_base = (char *)req; 6150 iov[0].iov_len = total_len; 6151 6152 memset(&rqst, 0, sizeof(struct smb_rqst)); 6153 rqst.rq_iov = iov; 6154 rqst.rq_nvec = 1; 6155 6156 rc = cifs_send_recv(xid, ses, server, 6157 &rqst, &resp_buf_type, flags, &rsp_iov); 6158 cifs_small_buf_release(req); 6159 6160 please_key_low = (__u64 *)lease_key; 6161 please_key_high = (__u64 *)(lease_key+8); 6162 if (rc) { 6163 cifs_stats_fail_inc(tcon, SMB2_OPLOCK_BREAK_HE); 6164 trace_smb3_lease_err(le32_to_cpu(lease_state), tcon->tid, 6165 ses->Suid, *please_key_low, *please_key_high, rc); 6166 cifs_dbg(FYI, "Send error in Lease Break = %d\n", rc); 6167 } else 6168 trace_smb3_lease_done(le32_to_cpu(lease_state), tcon->tid, 6169 ses->Suid, *please_key_low, *please_key_high); 6170 6171 return rc; 6172 } 6173