1 // SPDX-License-Identifier: LGPL-2.1 2 /* 3 * 4 * Copyright (C) International Business Machines Corp., 2009, 2013 5 * Etersoft, 2012 6 * Author(s): Steve French (sfrench@us.ibm.com) 7 * Pavel Shilovsky (pshilovsky@samba.org) 2012 8 * 9 * Contains the routines for constructing the SMB2 PDUs themselves 10 * 11 */ 12 13 /* SMB2 PDU handling routines here - except for leftovers (eg session setup) */ 14 /* Note that there are handle based routines which must be */ 15 /* treated slightly differently for reconnection purposes since we never */ 16 /* want to reuse a stale file handle and only the caller knows the file info */ 17 18 #include <linux/fs.h> 19 #include <linux/kernel.h> 20 #include <linux/vfs.h> 21 #include <linux/task_io_accounting_ops.h> 22 #include <linux/uaccess.h> 23 #include <linux/uuid.h> 24 #include <linux/pagemap.h> 25 #include <linux/xattr.h> 26 #include "cifsglob.h" 27 #include "cifsacl.h" 28 #include "cifsproto.h" 29 #include "smb2proto.h" 30 #include "cifs_unicode.h" 31 #include "cifs_debug.h" 32 #include "ntlmssp.h" 33 #include "smb2status.h" 34 #include "smb2glob.h" 35 #include "cifspdu.h" 36 #include "cifs_spnego.h" 37 #include "smbdirect.h" 38 #include "trace.h" 39 #ifdef CONFIG_CIFS_DFS_UPCALL 40 #include "dfs_cache.h" 41 #endif 42 #include "cached_dir.h" 43 44 /* 45 * The following table defines the expected "StructureSize" of SMB2 requests 46 * in order by SMB2 command. This is similar to "wct" in SMB/CIFS requests. 47 * 48 * Note that commands are defined in smb2pdu.h in le16 but the array below is 49 * indexed by command in host byte order. 50 */ 51 static const int smb2_req_struct_sizes[NUMBER_OF_SMB2_COMMANDS] = { 52 /* SMB2_NEGOTIATE */ 36, 53 /* SMB2_SESSION_SETUP */ 25, 54 /* SMB2_LOGOFF */ 4, 55 /* SMB2_TREE_CONNECT */ 9, 56 /* SMB2_TREE_DISCONNECT */ 4, 57 /* SMB2_CREATE */ 57, 58 /* SMB2_CLOSE */ 24, 59 /* SMB2_FLUSH */ 24, 60 /* SMB2_READ */ 49, 61 /* SMB2_WRITE */ 49, 62 /* SMB2_LOCK */ 48, 63 /* SMB2_IOCTL */ 57, 64 /* SMB2_CANCEL */ 4, 65 /* SMB2_ECHO */ 4, 66 /* SMB2_QUERY_DIRECTORY */ 33, 67 /* SMB2_CHANGE_NOTIFY */ 32, 68 /* SMB2_QUERY_INFO */ 41, 69 /* SMB2_SET_INFO */ 33, 70 /* SMB2_OPLOCK_BREAK */ 24 /* BB this is 36 for LEASE_BREAK variant */ 71 }; 72 73 int smb3_encryption_required(const struct cifs_tcon *tcon) 74 { 75 if (!tcon || !tcon->ses) 76 return 0; 77 if ((tcon->ses->session_flags & SMB2_SESSION_FLAG_ENCRYPT_DATA) || 78 (tcon->share_flags & SHI1005_FLAGS_ENCRYPT_DATA)) 79 return 1; 80 if (tcon->seal && 81 (tcon->ses->server->capabilities & SMB2_GLOBAL_CAP_ENCRYPTION)) 82 return 1; 83 return 0; 84 } 85 86 static void 87 smb2_hdr_assemble(struct smb2_hdr *shdr, __le16 smb2_cmd, 88 const struct cifs_tcon *tcon, 89 struct TCP_Server_Info *server) 90 { 91 struct smb3_hdr_req *smb3_hdr; 92 93 shdr->ProtocolId = SMB2_PROTO_NUMBER; 94 shdr->StructureSize = cpu_to_le16(64); 95 shdr->Command = smb2_cmd; 96 97 if (server) { 98 /* After reconnect SMB3 must set ChannelSequence on subsequent reqs */ 99 if (server->dialect >= SMB30_PROT_ID) { 100 smb3_hdr = (struct smb3_hdr_req *)shdr; 101 /* 102 * if primary channel is not set yet, use default 103 * channel for chan sequence num 104 */ 105 if (SERVER_IS_CHAN(server)) 106 smb3_hdr->ChannelSequence = 107 cpu_to_le16(server->primary_server->channel_sequence_num); 108 else 109 smb3_hdr->ChannelSequence = 110 cpu_to_le16(server->channel_sequence_num); 111 } 112 spin_lock(&server->req_lock); 113 /* Request up to 10 credits but don't go over the limit. */ 114 if (server->credits >= server->max_credits) 115 shdr->CreditRequest = cpu_to_le16(0); 116 else 117 shdr->CreditRequest = cpu_to_le16( 118 min_t(int, server->max_credits - 119 server->credits, 10)); 120 spin_unlock(&server->req_lock); 121 } else { 122 shdr->CreditRequest = cpu_to_le16(2); 123 } 124 shdr->Id.SyncId.ProcessId = cpu_to_le32((__u16)current->tgid); 125 126 if (!tcon) 127 goto out; 128 129 /* GLOBAL_CAP_LARGE_MTU will only be set if dialect > SMB2.02 */ 130 /* See sections 2.2.4 and 3.2.4.1.5 of MS-SMB2 */ 131 if (server && (server->capabilities & SMB2_GLOBAL_CAP_LARGE_MTU)) 132 shdr->CreditCharge = cpu_to_le16(1); 133 /* else CreditCharge MBZ */ 134 135 shdr->Id.SyncId.TreeId = cpu_to_le32(tcon->tid); 136 /* Uid is not converted */ 137 if (tcon->ses) 138 shdr->SessionId = cpu_to_le64(tcon->ses->Suid); 139 140 /* 141 * If we would set SMB2_FLAGS_DFS_OPERATIONS on open we also would have 142 * to pass the path on the Open SMB prefixed by \\server\share. 143 * Not sure when we would need to do the augmented path (if ever) and 144 * setting this flag breaks the SMB2 open operation since it is 145 * illegal to send an empty path name (without \\server\share prefix) 146 * when the DFS flag is set in the SMB open header. We could 147 * consider setting the flag on all operations other than open 148 * but it is safer to net set it for now. 149 */ 150 /* if (tcon->share_flags & SHI1005_FLAGS_DFS) 151 shdr->Flags |= SMB2_FLAGS_DFS_OPERATIONS; */ 152 153 if (server && server->sign && !smb3_encryption_required(tcon)) 154 shdr->Flags |= SMB2_FLAGS_SIGNED; 155 out: 156 return; 157 } 158 159 /* helper function for code reuse */ 160 static int 161 cifs_chan_skip_or_disable(struct cifs_ses *ses, 162 struct TCP_Server_Info *server, 163 bool from_reconnect) 164 { 165 struct TCP_Server_Info *pserver; 166 unsigned int chan_index; 167 168 if (SERVER_IS_CHAN(server)) { 169 cifs_dbg(VFS, 170 "server %s does not support multichannel anymore. Skip secondary channel\n", 171 ses->server->hostname); 172 173 spin_lock(&ses->chan_lock); 174 chan_index = cifs_ses_get_chan_index(ses, server); 175 if (chan_index == CIFS_INVAL_CHAN_INDEX) { 176 spin_unlock(&ses->chan_lock); 177 goto skip_terminate; 178 } 179 180 ses->chans[chan_index].server = NULL; 181 server->terminate = true; 182 spin_unlock(&ses->chan_lock); 183 184 /* 185 * the above reference of server by channel 186 * needs to be dropped without holding chan_lock 187 * as cifs_put_tcp_session takes a higher lock 188 * i.e. cifs_tcp_ses_lock 189 */ 190 cifs_put_tcp_session(server, from_reconnect); 191 192 cifs_signal_cifsd_for_reconnect(server, false); 193 194 /* mark primary server as needing reconnect */ 195 pserver = server->primary_server; 196 cifs_signal_cifsd_for_reconnect(pserver, false); 197 skip_terminate: 198 return -EHOSTDOWN; 199 } 200 201 cifs_server_dbg(VFS, 202 "server does not support multichannel anymore. Disable all other channels\n"); 203 cifs_disable_secondary_channels(ses); 204 205 206 return 0; 207 } 208 209 static int 210 smb2_reconnect(__le16 smb2_command, struct cifs_tcon *tcon, 211 struct TCP_Server_Info *server, bool from_reconnect) 212 { 213 int rc = 0; 214 struct nls_table *nls_codepage = NULL; 215 struct cifs_ses *ses; 216 int xid; 217 218 /* 219 * SMB2s NegProt, SessSetup, Logoff do not have tcon yet so 220 * check for tcp and smb session status done differently 221 * for those three - in the calling routine. 222 */ 223 if (tcon == NULL) 224 return 0; 225 226 /* 227 * Need to also skip SMB2_IOCTL because it is used for checking nested dfs links in 228 * cifs_tree_connect(). 229 */ 230 if (smb2_command == SMB2_TREE_CONNECT || smb2_command == SMB2_IOCTL) 231 return 0; 232 233 spin_lock(&tcon->tc_lock); 234 if (tcon->status == TID_EXITING) { 235 /* 236 * only tree disconnect allowed when disconnecting ... 237 */ 238 if (smb2_command != SMB2_TREE_DISCONNECT) { 239 spin_unlock(&tcon->tc_lock); 240 cifs_dbg(FYI, "can not send cmd %d while umounting\n", 241 smb2_command); 242 return -ENODEV; 243 } 244 } 245 spin_unlock(&tcon->tc_lock); 246 247 ses = tcon->ses; 248 if (!ses) 249 return -EIO; 250 spin_lock(&ses->ses_lock); 251 if (ses->ses_status == SES_EXITING) { 252 spin_unlock(&ses->ses_lock); 253 return -EIO; 254 } 255 spin_unlock(&ses->ses_lock); 256 if (!ses->server || !server) 257 return -EIO; 258 259 spin_lock(&server->srv_lock); 260 if (server->tcpStatus == CifsNeedReconnect) { 261 /* 262 * Return to caller for TREE_DISCONNECT and LOGOFF and CLOSE 263 * here since they are implicitly done when session drops. 264 */ 265 switch (smb2_command) { 266 /* 267 * BB Should we keep oplock break and add flush to exceptions? 268 */ 269 case SMB2_TREE_DISCONNECT: 270 case SMB2_CANCEL: 271 case SMB2_CLOSE: 272 case SMB2_OPLOCK_BREAK: 273 spin_unlock(&server->srv_lock); 274 return -EAGAIN; 275 } 276 } 277 278 /* if server is marked for termination, cifsd will cleanup */ 279 if (server->terminate) { 280 spin_unlock(&server->srv_lock); 281 return -EHOSTDOWN; 282 } 283 spin_unlock(&server->srv_lock); 284 285 again: 286 rc = cifs_wait_for_server_reconnect(server, tcon->retry); 287 if (rc) 288 return rc; 289 290 spin_lock(&ses->chan_lock); 291 if (!cifs_chan_needs_reconnect(ses, server) && !tcon->need_reconnect) { 292 spin_unlock(&ses->chan_lock); 293 return 0; 294 } 295 spin_unlock(&ses->chan_lock); 296 cifs_dbg(FYI, "sess reconnect mask: 0x%lx, tcon reconnect: %d", 297 tcon->ses->chans_need_reconnect, 298 tcon->need_reconnect); 299 300 mutex_lock(&ses->session_mutex); 301 /* 302 * if this is called by delayed work, and the channel has been disabled 303 * in parallel, the delayed work can continue to execute in parallel 304 * there's a chance that this channel may not exist anymore 305 */ 306 spin_lock(&server->srv_lock); 307 if (server->tcpStatus == CifsExiting) { 308 spin_unlock(&server->srv_lock); 309 mutex_unlock(&ses->session_mutex); 310 rc = -EHOSTDOWN; 311 goto out; 312 } 313 314 /* 315 * Recheck after acquire mutex. If another thread is negotiating 316 * and the server never sends an answer the socket will be closed 317 * and tcpStatus set to reconnect. 318 */ 319 if (server->tcpStatus == CifsNeedReconnect) { 320 spin_unlock(&server->srv_lock); 321 mutex_unlock(&ses->session_mutex); 322 323 if (tcon->retry) 324 goto again; 325 326 rc = -EHOSTDOWN; 327 goto out; 328 } 329 spin_unlock(&server->srv_lock); 330 331 nls_codepage = ses->local_nls; 332 333 /* 334 * need to prevent multiple threads trying to simultaneously 335 * reconnect the same SMB session 336 */ 337 spin_lock(&ses->ses_lock); 338 spin_lock(&ses->chan_lock); 339 if (!cifs_chan_needs_reconnect(ses, server) && 340 ses->ses_status == SES_GOOD) { 341 spin_unlock(&ses->chan_lock); 342 spin_unlock(&ses->ses_lock); 343 /* this means that we only need to tree connect */ 344 if (tcon->need_reconnect) 345 goto skip_sess_setup; 346 347 mutex_unlock(&ses->session_mutex); 348 goto out; 349 } 350 spin_unlock(&ses->chan_lock); 351 spin_unlock(&ses->ses_lock); 352 353 rc = cifs_negotiate_protocol(0, ses, server); 354 if (!rc) { 355 /* 356 * if server stopped supporting multichannel 357 * and the first channel reconnected, disable all the others. 358 */ 359 if (ses->chan_count > 1 && 360 !(server->capabilities & SMB2_GLOBAL_CAP_MULTI_CHANNEL)) { 361 rc = cifs_chan_skip_or_disable(ses, server, 362 from_reconnect); 363 if (rc) { 364 mutex_unlock(&ses->session_mutex); 365 goto out; 366 } 367 } 368 369 rc = cifs_setup_session(0, ses, server, nls_codepage); 370 if ((rc == -EACCES) && !tcon->retry) { 371 mutex_unlock(&ses->session_mutex); 372 rc = -EHOSTDOWN; 373 goto failed; 374 } else if (rc) { 375 mutex_unlock(&ses->session_mutex); 376 goto out; 377 } 378 } else { 379 mutex_unlock(&ses->session_mutex); 380 goto out; 381 } 382 383 skip_sess_setup: 384 if (!tcon->need_reconnect) { 385 mutex_unlock(&ses->session_mutex); 386 goto out; 387 } 388 cifs_mark_open_files_invalid(tcon); 389 if (tcon->use_persistent) 390 tcon->need_reopen_files = true; 391 392 rc = cifs_tree_connect(0, tcon, nls_codepage); 393 394 cifs_dbg(FYI, "reconnect tcon rc = %d\n", rc); 395 if (rc) { 396 /* If sess reconnected but tcon didn't, something strange ... */ 397 mutex_unlock(&ses->session_mutex); 398 cifs_dbg(VFS, "reconnect tcon failed rc = %d\n", rc); 399 goto out; 400 } 401 402 spin_lock(&ses->ses_lock); 403 if (ses->flags & CIFS_SES_FLAG_SCALE_CHANNELS) { 404 spin_unlock(&ses->ses_lock); 405 mutex_unlock(&ses->session_mutex); 406 goto skip_add_channels; 407 } 408 ses->flags |= CIFS_SES_FLAG_SCALE_CHANNELS; 409 spin_unlock(&ses->ses_lock); 410 411 if (!rc && 412 (server->capabilities & SMB2_GLOBAL_CAP_MULTI_CHANNEL)) { 413 mutex_unlock(&ses->session_mutex); 414 415 /* 416 * query server network interfaces, in case they change 417 */ 418 xid = get_xid(); 419 rc = SMB3_request_interfaces(xid, tcon, false); 420 free_xid(xid); 421 422 if (rc == -EOPNOTSUPP && ses->chan_count > 1) { 423 /* 424 * some servers like Azure SMB server do not advertise 425 * that multichannel has been disabled with server 426 * capabilities, rather return STATUS_NOT_IMPLEMENTED. 427 * treat this as server not supporting multichannel 428 */ 429 430 rc = cifs_chan_skip_or_disable(ses, server, 431 from_reconnect); 432 goto skip_add_channels; 433 } else if (rc) 434 cifs_dbg(FYI, "%s: failed to query server interfaces: %d\n", 435 __func__, rc); 436 437 if (ses->chan_max > ses->chan_count && 438 ses->iface_count && 439 !SERVER_IS_CHAN(server)) { 440 if (ses->chan_count == 1) { 441 cifs_server_dbg(VFS, "supports multichannel now\n"); 442 queue_delayed_work(cifsiod_wq, &tcon->query_interfaces, 443 (SMB_INTERFACE_POLL_INTERVAL * HZ)); 444 } 445 446 cifs_try_adding_channels(ses); 447 } 448 } else { 449 mutex_unlock(&ses->session_mutex); 450 } 451 452 skip_add_channels: 453 spin_lock(&ses->ses_lock); 454 ses->flags &= ~CIFS_SES_FLAG_SCALE_CHANNELS; 455 spin_unlock(&ses->ses_lock); 456 457 if (smb2_command != SMB2_INTERNAL_CMD) 458 mod_delayed_work(cifsiod_wq, &server->reconnect, 0); 459 460 atomic_inc(&tconInfoReconnectCount); 461 out: 462 /* 463 * Check if handle based operation so we know whether we can continue 464 * or not without returning to caller to reset file handle. 465 */ 466 /* 467 * BB Is flush done by server on drop of tcp session? Should we special 468 * case it and skip above? 469 */ 470 switch (smb2_command) { 471 case SMB2_FLUSH: 472 case SMB2_READ: 473 case SMB2_WRITE: 474 case SMB2_LOCK: 475 case SMB2_QUERY_DIRECTORY: 476 case SMB2_CHANGE_NOTIFY: 477 case SMB2_QUERY_INFO: 478 case SMB2_SET_INFO: 479 rc = -EAGAIN; 480 } 481 failed: 482 return rc; 483 } 484 485 static void 486 fill_small_buf(__le16 smb2_command, struct cifs_tcon *tcon, 487 struct TCP_Server_Info *server, 488 void *buf, 489 unsigned int *total_len) 490 { 491 struct smb2_pdu *spdu = buf; 492 /* lookup word count ie StructureSize from table */ 493 __u16 parmsize = smb2_req_struct_sizes[le16_to_cpu(smb2_command)]; 494 495 /* 496 * smaller than SMALL_BUFFER_SIZE but bigger than fixed area of 497 * largest operations (Create) 498 */ 499 memset(buf, 0, 256); 500 501 smb2_hdr_assemble(&spdu->hdr, smb2_command, tcon, server); 502 spdu->StructureSize2 = cpu_to_le16(parmsize); 503 504 *total_len = parmsize + sizeof(struct smb2_hdr); 505 } 506 507 /* 508 * Allocate and return pointer to an SMB request hdr, and set basic 509 * SMB information in the SMB header. If the return code is zero, this 510 * function must have filled in request_buf pointer. 511 */ 512 static int __smb2_plain_req_init(__le16 smb2_command, struct cifs_tcon *tcon, 513 struct TCP_Server_Info *server, 514 void **request_buf, unsigned int *total_len) 515 { 516 /* BB eventually switch this to SMB2 specific small buf size */ 517 switch (smb2_command) { 518 case SMB2_SET_INFO: 519 case SMB2_QUERY_INFO: 520 *request_buf = cifs_buf_get(); 521 break; 522 default: 523 *request_buf = cifs_small_buf_get(); 524 break; 525 } 526 if (*request_buf == NULL) { 527 /* BB should we add a retry in here if not a writepage? */ 528 return -ENOMEM; 529 } 530 531 fill_small_buf(smb2_command, tcon, server, 532 (struct smb2_hdr *)(*request_buf), 533 total_len); 534 535 if (tcon != NULL) { 536 uint16_t com_code = le16_to_cpu(smb2_command); 537 cifs_stats_inc(&tcon->stats.smb2_stats.smb2_com_sent[com_code]); 538 cifs_stats_inc(&tcon->num_smbs_sent); 539 } 540 541 return 0; 542 } 543 544 static int smb2_plain_req_init(__le16 smb2_command, struct cifs_tcon *tcon, 545 struct TCP_Server_Info *server, 546 void **request_buf, unsigned int *total_len) 547 { 548 int rc; 549 550 rc = smb2_reconnect(smb2_command, tcon, server, false); 551 if (rc) 552 return rc; 553 554 return __smb2_plain_req_init(smb2_command, tcon, server, request_buf, 555 total_len); 556 } 557 558 static int smb2_ioctl_req_init(u32 opcode, struct cifs_tcon *tcon, 559 struct TCP_Server_Info *server, 560 void **request_buf, unsigned int *total_len) 561 { 562 /* Skip reconnect only for FSCTL_VALIDATE_NEGOTIATE_INFO IOCTLs */ 563 if (opcode == FSCTL_VALIDATE_NEGOTIATE_INFO) { 564 return __smb2_plain_req_init(SMB2_IOCTL, tcon, server, 565 request_buf, total_len); 566 } 567 return smb2_plain_req_init(SMB2_IOCTL, tcon, server, 568 request_buf, total_len); 569 } 570 571 /* For explanation of negotiate contexts see MS-SMB2 section 2.2.3.1 */ 572 573 static void 574 build_preauth_ctxt(struct smb2_preauth_neg_context *pneg_ctxt) 575 { 576 pneg_ctxt->ContextType = SMB2_PREAUTH_INTEGRITY_CAPABILITIES; 577 pneg_ctxt->DataLength = cpu_to_le16(38); 578 pneg_ctxt->HashAlgorithmCount = cpu_to_le16(1); 579 pneg_ctxt->SaltLength = cpu_to_le16(SMB311_SALT_SIZE); 580 get_random_bytes(pneg_ctxt->Salt, SMB311_SALT_SIZE); 581 pneg_ctxt->HashAlgorithms = SMB2_PREAUTH_INTEGRITY_SHA512; 582 } 583 584 static void 585 build_compression_ctxt(struct smb2_compression_capabilities_context *pneg_ctxt) 586 { 587 pneg_ctxt->ContextType = SMB2_COMPRESSION_CAPABILITIES; 588 pneg_ctxt->DataLength = 589 cpu_to_le16(sizeof(struct smb2_compression_capabilities_context) 590 - sizeof(struct smb2_neg_context)); 591 pneg_ctxt->CompressionAlgorithmCount = cpu_to_le16(3); 592 pneg_ctxt->CompressionAlgorithms[0] = SMB3_COMPRESS_LZ77; 593 pneg_ctxt->CompressionAlgorithms[1] = SMB3_COMPRESS_LZ77_HUFF; 594 pneg_ctxt->CompressionAlgorithms[2] = SMB3_COMPRESS_LZNT1; 595 } 596 597 static unsigned int 598 build_signing_ctxt(struct smb2_signing_capabilities *pneg_ctxt) 599 { 600 unsigned int ctxt_len = sizeof(struct smb2_signing_capabilities); 601 unsigned short num_algs = 1; /* number of signing algorithms sent */ 602 603 pneg_ctxt->ContextType = SMB2_SIGNING_CAPABILITIES; 604 /* 605 * Context Data length must be rounded to multiple of 8 for some servers 606 */ 607 pneg_ctxt->DataLength = cpu_to_le16(ALIGN(sizeof(struct smb2_signing_capabilities) - 608 sizeof(struct smb2_neg_context) + 609 (num_algs * sizeof(u16)), 8)); 610 pneg_ctxt->SigningAlgorithmCount = cpu_to_le16(num_algs); 611 pneg_ctxt->SigningAlgorithms[0] = cpu_to_le16(SIGNING_ALG_AES_CMAC); 612 613 ctxt_len += sizeof(__le16) * num_algs; 614 ctxt_len = ALIGN(ctxt_len, 8); 615 return ctxt_len; 616 /* TBD add SIGNING_ALG_AES_GMAC and/or SIGNING_ALG_HMAC_SHA256 */ 617 } 618 619 static void 620 build_encrypt_ctxt(struct smb2_encryption_neg_context *pneg_ctxt) 621 { 622 pneg_ctxt->ContextType = SMB2_ENCRYPTION_CAPABILITIES; 623 if (require_gcm_256) { 624 pneg_ctxt->DataLength = cpu_to_le16(4); /* Cipher Count + 1 cipher */ 625 pneg_ctxt->CipherCount = cpu_to_le16(1); 626 pneg_ctxt->Ciphers[0] = SMB2_ENCRYPTION_AES256_GCM; 627 } else if (enable_gcm_256) { 628 pneg_ctxt->DataLength = cpu_to_le16(8); /* Cipher Count + 3 ciphers */ 629 pneg_ctxt->CipherCount = cpu_to_le16(3); 630 pneg_ctxt->Ciphers[0] = SMB2_ENCRYPTION_AES128_GCM; 631 pneg_ctxt->Ciphers[1] = SMB2_ENCRYPTION_AES256_GCM; 632 pneg_ctxt->Ciphers[2] = SMB2_ENCRYPTION_AES128_CCM; 633 } else { 634 pneg_ctxt->DataLength = cpu_to_le16(6); /* Cipher Count + 2 ciphers */ 635 pneg_ctxt->CipherCount = cpu_to_le16(2); 636 pneg_ctxt->Ciphers[0] = SMB2_ENCRYPTION_AES128_GCM; 637 pneg_ctxt->Ciphers[1] = SMB2_ENCRYPTION_AES128_CCM; 638 } 639 } 640 641 static unsigned int 642 build_netname_ctxt(struct smb2_netname_neg_context *pneg_ctxt, char *hostname) 643 { 644 struct nls_table *cp = load_nls_default(); 645 646 pneg_ctxt->ContextType = SMB2_NETNAME_NEGOTIATE_CONTEXT_ID; 647 648 /* copy up to max of first 100 bytes of server name to NetName field */ 649 pneg_ctxt->DataLength = cpu_to_le16(2 * cifs_strtoUTF16(pneg_ctxt->NetName, hostname, 100, cp)); 650 /* context size is DataLength + minimal smb2_neg_context */ 651 return ALIGN(le16_to_cpu(pneg_ctxt->DataLength) + sizeof(struct smb2_neg_context), 8); 652 } 653 654 static void 655 build_posix_ctxt(struct smb2_posix_neg_context *pneg_ctxt) 656 { 657 pneg_ctxt->ContextType = SMB2_POSIX_EXTENSIONS_AVAILABLE; 658 pneg_ctxt->DataLength = cpu_to_le16(POSIX_CTXT_DATA_LEN); 659 /* SMB2_CREATE_TAG_POSIX is "0x93AD25509CB411E7B42383DE968BCD7C" */ 660 pneg_ctxt->Name[0] = 0x93; 661 pneg_ctxt->Name[1] = 0xAD; 662 pneg_ctxt->Name[2] = 0x25; 663 pneg_ctxt->Name[3] = 0x50; 664 pneg_ctxt->Name[4] = 0x9C; 665 pneg_ctxt->Name[5] = 0xB4; 666 pneg_ctxt->Name[6] = 0x11; 667 pneg_ctxt->Name[7] = 0xE7; 668 pneg_ctxt->Name[8] = 0xB4; 669 pneg_ctxt->Name[9] = 0x23; 670 pneg_ctxt->Name[10] = 0x83; 671 pneg_ctxt->Name[11] = 0xDE; 672 pneg_ctxt->Name[12] = 0x96; 673 pneg_ctxt->Name[13] = 0x8B; 674 pneg_ctxt->Name[14] = 0xCD; 675 pneg_ctxt->Name[15] = 0x7C; 676 } 677 678 static void 679 assemble_neg_contexts(struct smb2_negotiate_req *req, 680 struct TCP_Server_Info *server, unsigned int *total_len) 681 { 682 unsigned int ctxt_len, neg_context_count; 683 struct TCP_Server_Info *pserver; 684 char *pneg_ctxt; 685 char *hostname; 686 687 if (*total_len > 200) { 688 /* In case length corrupted don't want to overrun smb buffer */ 689 cifs_server_dbg(VFS, "Bad frame length assembling neg contexts\n"); 690 return; 691 } 692 693 /* 694 * round up total_len of fixed part of SMB3 negotiate request to 8 695 * byte boundary before adding negotiate contexts 696 */ 697 *total_len = ALIGN(*total_len, 8); 698 699 pneg_ctxt = (*total_len) + (char *)req; 700 req->NegotiateContextOffset = cpu_to_le32(*total_len); 701 702 build_preauth_ctxt((struct smb2_preauth_neg_context *)pneg_ctxt); 703 ctxt_len = ALIGN(sizeof(struct smb2_preauth_neg_context), 8); 704 *total_len += ctxt_len; 705 pneg_ctxt += ctxt_len; 706 707 build_encrypt_ctxt((struct smb2_encryption_neg_context *)pneg_ctxt); 708 ctxt_len = ALIGN(sizeof(struct smb2_encryption_neg_context), 8); 709 *total_len += ctxt_len; 710 pneg_ctxt += ctxt_len; 711 712 /* 713 * secondary channels don't have the hostname field populated 714 * use the hostname field in the primary channel instead 715 */ 716 pserver = SERVER_IS_CHAN(server) ? server->primary_server : server; 717 cifs_server_lock(pserver); 718 hostname = pserver->hostname; 719 if (hostname && (hostname[0] != 0)) { 720 ctxt_len = build_netname_ctxt((struct smb2_netname_neg_context *)pneg_ctxt, 721 hostname); 722 *total_len += ctxt_len; 723 pneg_ctxt += ctxt_len; 724 neg_context_count = 3; 725 } else 726 neg_context_count = 2; 727 cifs_server_unlock(pserver); 728 729 build_posix_ctxt((struct smb2_posix_neg_context *)pneg_ctxt); 730 *total_len += sizeof(struct smb2_posix_neg_context); 731 pneg_ctxt += sizeof(struct smb2_posix_neg_context); 732 neg_context_count++; 733 734 if (server->compress_algorithm) { 735 build_compression_ctxt((struct smb2_compression_capabilities_context *) 736 pneg_ctxt); 737 ctxt_len = ALIGN(sizeof(struct smb2_compression_capabilities_context), 8); 738 *total_len += ctxt_len; 739 pneg_ctxt += ctxt_len; 740 neg_context_count++; 741 } 742 743 if (enable_negotiate_signing) { 744 ctxt_len = build_signing_ctxt((struct smb2_signing_capabilities *) 745 pneg_ctxt); 746 *total_len += ctxt_len; 747 pneg_ctxt += ctxt_len; 748 neg_context_count++; 749 } 750 751 /* check for and add transport_capabilities and signing capabilities */ 752 req->NegotiateContextCount = cpu_to_le16(neg_context_count); 753 754 } 755 756 /* If invalid preauth context warn but use what we requested, SHA-512 */ 757 static void decode_preauth_context(struct smb2_preauth_neg_context *ctxt) 758 { 759 unsigned int len = le16_to_cpu(ctxt->DataLength); 760 761 /* 762 * Caller checked that DataLength remains within SMB boundary. We still 763 * need to confirm that one HashAlgorithms member is accounted for. 764 */ 765 if (len < MIN_PREAUTH_CTXT_DATA_LEN) { 766 pr_warn_once("server sent bad preauth context\n"); 767 return; 768 } else if (len < MIN_PREAUTH_CTXT_DATA_LEN + le16_to_cpu(ctxt->SaltLength)) { 769 pr_warn_once("server sent invalid SaltLength\n"); 770 return; 771 } 772 if (le16_to_cpu(ctxt->HashAlgorithmCount) != 1) 773 pr_warn_once("Invalid SMB3 hash algorithm count\n"); 774 if (ctxt->HashAlgorithms != SMB2_PREAUTH_INTEGRITY_SHA512) 775 pr_warn_once("unknown SMB3 hash algorithm\n"); 776 } 777 778 static void decode_compress_ctx(struct TCP_Server_Info *server, 779 struct smb2_compression_capabilities_context *ctxt) 780 { 781 unsigned int len = le16_to_cpu(ctxt->DataLength); 782 783 /* 784 * Caller checked that DataLength remains within SMB boundary. We still 785 * need to confirm that one CompressionAlgorithms member is accounted 786 * for. 787 */ 788 if (len < 10) { 789 pr_warn_once("server sent bad compression cntxt\n"); 790 return; 791 } 792 if (le16_to_cpu(ctxt->CompressionAlgorithmCount) != 1) { 793 pr_warn_once("Invalid SMB3 compress algorithm count\n"); 794 return; 795 } 796 if (le16_to_cpu(ctxt->CompressionAlgorithms[0]) > 3) { 797 pr_warn_once("unknown compression algorithm\n"); 798 return; 799 } 800 server->compress_algorithm = ctxt->CompressionAlgorithms[0]; 801 } 802 803 static int decode_encrypt_ctx(struct TCP_Server_Info *server, 804 struct smb2_encryption_neg_context *ctxt) 805 { 806 unsigned int len = le16_to_cpu(ctxt->DataLength); 807 808 cifs_dbg(FYI, "decode SMB3.11 encryption neg context of len %d\n", len); 809 /* 810 * Caller checked that DataLength remains within SMB boundary. We still 811 * need to confirm that one Cipher flexible array member is accounted 812 * for. 813 */ 814 if (len < MIN_ENCRYPT_CTXT_DATA_LEN) { 815 pr_warn_once("server sent bad crypto ctxt len\n"); 816 return -EINVAL; 817 } 818 819 if (le16_to_cpu(ctxt->CipherCount) != 1) { 820 pr_warn_once("Invalid SMB3.11 cipher count\n"); 821 return -EINVAL; 822 } 823 cifs_dbg(FYI, "SMB311 cipher type:%d\n", le16_to_cpu(ctxt->Ciphers[0])); 824 if (require_gcm_256) { 825 if (ctxt->Ciphers[0] != SMB2_ENCRYPTION_AES256_GCM) { 826 cifs_dbg(VFS, "Server does not support requested encryption type (AES256 GCM)\n"); 827 return -EOPNOTSUPP; 828 } 829 } else if (ctxt->Ciphers[0] == 0) { 830 /* 831 * e.g. if server only supported AES256_CCM (very unlikely) 832 * or server supported no encryption types or had all disabled. 833 * Since GLOBAL_CAP_ENCRYPTION will be not set, in the case 834 * in which mount requested encryption ("seal") checks later 835 * on during tree connection will return proper rc, but if 836 * seal not requested by client, since server is allowed to 837 * return 0 to indicate no supported cipher, we can't fail here 838 */ 839 server->cipher_type = 0; 840 server->capabilities &= ~SMB2_GLOBAL_CAP_ENCRYPTION; 841 pr_warn_once("Server does not support requested encryption types\n"); 842 return 0; 843 } else if ((ctxt->Ciphers[0] != SMB2_ENCRYPTION_AES128_CCM) && 844 (ctxt->Ciphers[0] != SMB2_ENCRYPTION_AES128_GCM) && 845 (ctxt->Ciphers[0] != SMB2_ENCRYPTION_AES256_GCM)) { 846 /* server returned a cipher we didn't ask for */ 847 pr_warn_once("Invalid SMB3.11 cipher returned\n"); 848 return -EINVAL; 849 } 850 server->cipher_type = ctxt->Ciphers[0]; 851 server->capabilities |= SMB2_GLOBAL_CAP_ENCRYPTION; 852 return 0; 853 } 854 855 static void decode_signing_ctx(struct TCP_Server_Info *server, 856 struct smb2_signing_capabilities *pctxt) 857 { 858 unsigned int len = le16_to_cpu(pctxt->DataLength); 859 860 /* 861 * Caller checked that DataLength remains within SMB boundary. We still 862 * need to confirm that one SigningAlgorithms flexible array member is 863 * accounted for. 864 */ 865 if ((len < 4) || (len > 16)) { 866 pr_warn_once("server sent bad signing negcontext\n"); 867 return; 868 } 869 if (le16_to_cpu(pctxt->SigningAlgorithmCount) != 1) { 870 pr_warn_once("Invalid signing algorithm count\n"); 871 return; 872 } 873 if (le16_to_cpu(pctxt->SigningAlgorithms[0]) > 2) { 874 pr_warn_once("unknown signing algorithm\n"); 875 return; 876 } 877 878 server->signing_negotiated = true; 879 server->signing_algorithm = le16_to_cpu(pctxt->SigningAlgorithms[0]); 880 cifs_dbg(FYI, "signing algorithm %d chosen\n", 881 server->signing_algorithm); 882 } 883 884 885 static int smb311_decode_neg_context(struct smb2_negotiate_rsp *rsp, 886 struct TCP_Server_Info *server, 887 unsigned int len_of_smb) 888 { 889 struct smb2_neg_context *pctx; 890 unsigned int offset = le32_to_cpu(rsp->NegotiateContextOffset); 891 unsigned int ctxt_cnt = le16_to_cpu(rsp->NegotiateContextCount); 892 unsigned int len_of_ctxts, i; 893 int rc = 0; 894 895 cifs_dbg(FYI, "decoding %d negotiate contexts\n", ctxt_cnt); 896 if (len_of_smb <= offset) { 897 cifs_server_dbg(VFS, "Invalid response: negotiate context offset\n"); 898 return -EINVAL; 899 } 900 901 len_of_ctxts = len_of_smb - offset; 902 903 for (i = 0; i < ctxt_cnt; i++) { 904 int clen; 905 /* check that offset is not beyond end of SMB */ 906 if (len_of_ctxts < sizeof(struct smb2_neg_context)) 907 break; 908 909 pctx = (struct smb2_neg_context *)(offset + (char *)rsp); 910 clen = sizeof(struct smb2_neg_context) 911 + le16_to_cpu(pctx->DataLength); 912 /* 913 * 2.2.4 SMB2 NEGOTIATE Response 914 * Subsequent negotiate contexts MUST appear at the first 8-byte 915 * aligned offset following the previous negotiate context. 916 */ 917 if (i + 1 != ctxt_cnt) 918 clen = ALIGN(clen, 8); 919 if (clen > len_of_ctxts) 920 break; 921 922 if (pctx->ContextType == SMB2_PREAUTH_INTEGRITY_CAPABILITIES) 923 decode_preauth_context( 924 (struct smb2_preauth_neg_context *)pctx); 925 else if (pctx->ContextType == SMB2_ENCRYPTION_CAPABILITIES) 926 rc = decode_encrypt_ctx(server, 927 (struct smb2_encryption_neg_context *)pctx); 928 else if (pctx->ContextType == SMB2_COMPRESSION_CAPABILITIES) 929 decode_compress_ctx(server, 930 (struct smb2_compression_capabilities_context *)pctx); 931 else if (pctx->ContextType == SMB2_POSIX_EXTENSIONS_AVAILABLE) 932 server->posix_ext_supported = true; 933 else if (pctx->ContextType == SMB2_SIGNING_CAPABILITIES) 934 decode_signing_ctx(server, 935 (struct smb2_signing_capabilities *)pctx); 936 else 937 cifs_server_dbg(VFS, "unknown negcontext of type %d ignored\n", 938 le16_to_cpu(pctx->ContextType)); 939 if (rc) 940 break; 941 942 offset += clen; 943 len_of_ctxts -= clen; 944 } 945 return rc; 946 } 947 948 static struct create_posix * 949 create_posix_buf(umode_t mode) 950 { 951 struct create_posix *buf; 952 953 buf = kzalloc(sizeof(struct create_posix), 954 GFP_KERNEL); 955 if (!buf) 956 return NULL; 957 958 buf->ccontext.DataOffset = 959 cpu_to_le16(offsetof(struct create_posix, Mode)); 960 buf->ccontext.DataLength = cpu_to_le32(4); 961 buf->ccontext.NameOffset = 962 cpu_to_le16(offsetof(struct create_posix, Name)); 963 buf->ccontext.NameLength = cpu_to_le16(16); 964 965 /* SMB2_CREATE_TAG_POSIX is "0x93AD25509CB411E7B42383DE968BCD7C" */ 966 buf->Name[0] = 0x93; 967 buf->Name[1] = 0xAD; 968 buf->Name[2] = 0x25; 969 buf->Name[3] = 0x50; 970 buf->Name[4] = 0x9C; 971 buf->Name[5] = 0xB4; 972 buf->Name[6] = 0x11; 973 buf->Name[7] = 0xE7; 974 buf->Name[8] = 0xB4; 975 buf->Name[9] = 0x23; 976 buf->Name[10] = 0x83; 977 buf->Name[11] = 0xDE; 978 buf->Name[12] = 0x96; 979 buf->Name[13] = 0x8B; 980 buf->Name[14] = 0xCD; 981 buf->Name[15] = 0x7C; 982 buf->Mode = cpu_to_le32(mode); 983 cifs_dbg(FYI, "mode on posix create 0%o\n", mode); 984 return buf; 985 } 986 987 static int 988 add_posix_context(struct kvec *iov, unsigned int *num_iovec, umode_t mode) 989 { 990 unsigned int num = *num_iovec; 991 992 iov[num].iov_base = create_posix_buf(mode); 993 if (mode == ACL_NO_MODE) 994 cifs_dbg(FYI, "%s: no mode\n", __func__); 995 if (iov[num].iov_base == NULL) 996 return -ENOMEM; 997 iov[num].iov_len = sizeof(struct create_posix); 998 *num_iovec = num + 1; 999 return 0; 1000 } 1001 1002 1003 /* 1004 * 1005 * SMB2 Worker functions follow: 1006 * 1007 * The general structure of the worker functions is: 1008 * 1) Call smb2_init (assembles SMB2 header) 1009 * 2) Initialize SMB2 command specific fields in fixed length area of SMB 1010 * 3) Call smb_sendrcv2 (sends request on socket and waits for response) 1011 * 4) Decode SMB2 command specific fields in the fixed length area 1012 * 5) Decode variable length data area (if any for this SMB2 command type) 1013 * 6) Call free smb buffer 1014 * 7) return 1015 * 1016 */ 1017 1018 int 1019 SMB2_negotiate(const unsigned int xid, 1020 struct cifs_ses *ses, 1021 struct TCP_Server_Info *server) 1022 { 1023 struct smb_rqst rqst; 1024 struct smb2_negotiate_req *req; 1025 struct smb2_negotiate_rsp *rsp; 1026 struct kvec iov[1]; 1027 struct kvec rsp_iov; 1028 int rc; 1029 int resp_buftype; 1030 int blob_offset, blob_length; 1031 char *security_blob; 1032 int flags = CIFS_NEG_OP; 1033 unsigned int total_len; 1034 1035 cifs_dbg(FYI, "Negotiate protocol\n"); 1036 1037 if (!server) { 1038 WARN(1, "%s: server is NULL!\n", __func__); 1039 return -EIO; 1040 } 1041 1042 rc = smb2_plain_req_init(SMB2_NEGOTIATE, NULL, server, 1043 (void **) &req, &total_len); 1044 if (rc) 1045 return rc; 1046 1047 req->hdr.SessionId = 0; 1048 1049 memset(server->preauth_sha_hash, 0, SMB2_PREAUTH_HASH_SIZE); 1050 memset(ses->preauth_sha_hash, 0, SMB2_PREAUTH_HASH_SIZE); 1051 1052 if (strcmp(server->vals->version_string, 1053 SMB3ANY_VERSION_STRING) == 0) { 1054 req->Dialects[0] = cpu_to_le16(SMB30_PROT_ID); 1055 req->Dialects[1] = cpu_to_le16(SMB302_PROT_ID); 1056 req->Dialects[2] = cpu_to_le16(SMB311_PROT_ID); 1057 req->DialectCount = cpu_to_le16(3); 1058 total_len += 6; 1059 } else if (strcmp(server->vals->version_string, 1060 SMBDEFAULT_VERSION_STRING) == 0) { 1061 req->Dialects[0] = cpu_to_le16(SMB21_PROT_ID); 1062 req->Dialects[1] = cpu_to_le16(SMB30_PROT_ID); 1063 req->Dialects[2] = cpu_to_le16(SMB302_PROT_ID); 1064 req->Dialects[3] = cpu_to_le16(SMB311_PROT_ID); 1065 req->DialectCount = cpu_to_le16(4); 1066 total_len += 8; 1067 } else { 1068 /* otherwise send specific dialect */ 1069 req->Dialects[0] = cpu_to_le16(server->vals->protocol_id); 1070 req->DialectCount = cpu_to_le16(1); 1071 total_len += 2; 1072 } 1073 1074 /* only one of SMB2 signing flags may be set in SMB2 request */ 1075 if (ses->sign) 1076 req->SecurityMode = cpu_to_le16(SMB2_NEGOTIATE_SIGNING_REQUIRED); 1077 else if (global_secflags & CIFSSEC_MAY_SIGN) 1078 req->SecurityMode = cpu_to_le16(SMB2_NEGOTIATE_SIGNING_ENABLED); 1079 else 1080 req->SecurityMode = 0; 1081 1082 req->Capabilities = cpu_to_le32(server->vals->req_capabilities); 1083 if (ses->chan_max > 1) 1084 req->Capabilities |= cpu_to_le32(SMB2_GLOBAL_CAP_MULTI_CHANNEL); 1085 1086 /* ClientGUID must be zero for SMB2.02 dialect */ 1087 if (server->vals->protocol_id == SMB20_PROT_ID) 1088 memset(req->ClientGUID, 0, SMB2_CLIENT_GUID_SIZE); 1089 else { 1090 memcpy(req->ClientGUID, server->client_guid, 1091 SMB2_CLIENT_GUID_SIZE); 1092 if ((server->vals->protocol_id == SMB311_PROT_ID) || 1093 (strcmp(server->vals->version_string, 1094 SMB3ANY_VERSION_STRING) == 0) || 1095 (strcmp(server->vals->version_string, 1096 SMBDEFAULT_VERSION_STRING) == 0)) 1097 assemble_neg_contexts(req, server, &total_len); 1098 } 1099 iov[0].iov_base = (char *)req; 1100 iov[0].iov_len = total_len; 1101 1102 memset(&rqst, 0, sizeof(struct smb_rqst)); 1103 rqst.rq_iov = iov; 1104 rqst.rq_nvec = 1; 1105 1106 rc = cifs_send_recv(xid, ses, server, 1107 &rqst, &resp_buftype, flags, &rsp_iov); 1108 cifs_small_buf_release(req); 1109 rsp = (struct smb2_negotiate_rsp *)rsp_iov.iov_base; 1110 /* 1111 * No tcon so can't do 1112 * cifs_stats_inc(&tcon->stats.smb2_stats.smb2_com_fail[SMB2...]); 1113 */ 1114 if (rc == -EOPNOTSUPP) { 1115 cifs_server_dbg(VFS, "Dialect not supported by server. Consider specifying vers=1.0 or vers=2.0 on mount for accessing older servers\n"); 1116 goto neg_exit; 1117 } else if (rc != 0) 1118 goto neg_exit; 1119 1120 rc = -EIO; 1121 if (strcmp(server->vals->version_string, 1122 SMB3ANY_VERSION_STRING) == 0) { 1123 if (rsp->DialectRevision == cpu_to_le16(SMB20_PROT_ID)) { 1124 cifs_server_dbg(VFS, 1125 "SMB2 dialect returned but not requested\n"); 1126 goto neg_exit; 1127 } else if (rsp->DialectRevision == cpu_to_le16(SMB21_PROT_ID)) { 1128 cifs_server_dbg(VFS, 1129 "SMB2.1 dialect returned but not requested\n"); 1130 goto neg_exit; 1131 } else if (rsp->DialectRevision == cpu_to_le16(SMB311_PROT_ID)) { 1132 /* ops set to 3.0 by default for default so update */ 1133 server->ops = &smb311_operations; 1134 server->vals = &smb311_values; 1135 } 1136 } else if (strcmp(server->vals->version_string, 1137 SMBDEFAULT_VERSION_STRING) == 0) { 1138 if (rsp->DialectRevision == cpu_to_le16(SMB20_PROT_ID)) { 1139 cifs_server_dbg(VFS, 1140 "SMB2 dialect returned but not requested\n"); 1141 goto neg_exit; 1142 } else if (rsp->DialectRevision == cpu_to_le16(SMB21_PROT_ID)) { 1143 /* ops set to 3.0 by default for default so update */ 1144 server->ops = &smb21_operations; 1145 server->vals = &smb21_values; 1146 } else if (rsp->DialectRevision == cpu_to_le16(SMB311_PROT_ID)) { 1147 server->ops = &smb311_operations; 1148 server->vals = &smb311_values; 1149 } 1150 } else if (le16_to_cpu(rsp->DialectRevision) != 1151 server->vals->protocol_id) { 1152 /* if requested single dialect ensure returned dialect matched */ 1153 cifs_server_dbg(VFS, "Invalid 0x%x dialect returned: not requested\n", 1154 le16_to_cpu(rsp->DialectRevision)); 1155 goto neg_exit; 1156 } 1157 1158 cifs_dbg(FYI, "mode 0x%x\n", rsp->SecurityMode); 1159 1160 if (rsp->DialectRevision == cpu_to_le16(SMB20_PROT_ID)) 1161 cifs_dbg(FYI, "negotiated smb2.0 dialect\n"); 1162 else if (rsp->DialectRevision == cpu_to_le16(SMB21_PROT_ID)) 1163 cifs_dbg(FYI, "negotiated smb2.1 dialect\n"); 1164 else if (rsp->DialectRevision == cpu_to_le16(SMB30_PROT_ID)) 1165 cifs_dbg(FYI, "negotiated smb3.0 dialect\n"); 1166 else if (rsp->DialectRevision == cpu_to_le16(SMB302_PROT_ID)) 1167 cifs_dbg(FYI, "negotiated smb3.02 dialect\n"); 1168 else if (rsp->DialectRevision == cpu_to_le16(SMB311_PROT_ID)) 1169 cifs_dbg(FYI, "negotiated smb3.1.1 dialect\n"); 1170 else { 1171 cifs_server_dbg(VFS, "Invalid dialect returned by server 0x%x\n", 1172 le16_to_cpu(rsp->DialectRevision)); 1173 goto neg_exit; 1174 } 1175 1176 rc = 0; 1177 server->dialect = le16_to_cpu(rsp->DialectRevision); 1178 1179 /* 1180 * Keep a copy of the hash after negprot. This hash will be 1181 * the starting hash value for all sessions made from this 1182 * server. 1183 */ 1184 memcpy(server->preauth_sha_hash, ses->preauth_sha_hash, 1185 SMB2_PREAUTH_HASH_SIZE); 1186 1187 /* SMB2 only has an extended negflavor */ 1188 server->negflavor = CIFS_NEGFLAVOR_EXTENDED; 1189 /* set it to the maximum buffer size value we can send with 1 credit */ 1190 server->maxBuf = min_t(unsigned int, le32_to_cpu(rsp->MaxTransactSize), 1191 SMB2_MAX_BUFFER_SIZE); 1192 server->max_read = le32_to_cpu(rsp->MaxReadSize); 1193 server->max_write = le32_to_cpu(rsp->MaxWriteSize); 1194 server->sec_mode = le16_to_cpu(rsp->SecurityMode); 1195 if ((server->sec_mode & SMB2_SEC_MODE_FLAGS_ALL) != server->sec_mode) 1196 cifs_dbg(FYI, "Server returned unexpected security mode 0x%x\n", 1197 server->sec_mode); 1198 server->capabilities = le32_to_cpu(rsp->Capabilities); 1199 /* Internal types */ 1200 server->capabilities |= SMB2_NT_FIND | SMB2_LARGE_FILES; 1201 1202 /* 1203 * SMB3.0 supports only 1 cipher and doesn't have a encryption neg context 1204 * Set the cipher type manually. 1205 */ 1206 if (server->dialect == SMB30_PROT_ID && (server->capabilities & SMB2_GLOBAL_CAP_ENCRYPTION)) 1207 server->cipher_type = SMB2_ENCRYPTION_AES128_CCM; 1208 1209 security_blob = smb2_get_data_area_len(&blob_offset, &blob_length, 1210 (struct smb2_hdr *)rsp); 1211 /* 1212 * See MS-SMB2 section 2.2.4: if no blob, client picks default which 1213 * for us will be 1214 * ses->sectype = RawNTLMSSP; 1215 * but for time being this is our only auth choice so doesn't matter. 1216 * We just found a server which sets blob length to zero expecting raw. 1217 */ 1218 if (blob_length == 0) { 1219 cifs_dbg(FYI, "missing security blob on negprot\n"); 1220 server->sec_ntlmssp = true; 1221 } 1222 1223 rc = cifs_enable_signing(server, ses->sign); 1224 if (rc) 1225 goto neg_exit; 1226 if (blob_length) { 1227 rc = decode_negTokenInit(security_blob, blob_length, server); 1228 if (rc == 1) 1229 rc = 0; 1230 else if (rc == 0) 1231 rc = -EIO; 1232 } 1233 1234 if (rsp->DialectRevision == cpu_to_le16(SMB311_PROT_ID)) { 1235 if (rsp->NegotiateContextCount) 1236 rc = smb311_decode_neg_context(rsp, server, 1237 rsp_iov.iov_len); 1238 else 1239 cifs_server_dbg(VFS, "Missing expected negotiate contexts\n"); 1240 } 1241 neg_exit: 1242 free_rsp_buf(resp_buftype, rsp); 1243 return rc; 1244 } 1245 1246 int smb3_validate_negotiate(const unsigned int xid, struct cifs_tcon *tcon) 1247 { 1248 int rc; 1249 struct validate_negotiate_info_req *pneg_inbuf; 1250 struct validate_negotiate_info_rsp *pneg_rsp = NULL; 1251 u32 rsplen; 1252 u32 inbuflen; /* max of 4 dialects */ 1253 struct TCP_Server_Info *server = tcon->ses->server; 1254 1255 cifs_dbg(FYI, "validate negotiate\n"); 1256 1257 /* In SMB3.11 preauth integrity supersedes validate negotiate */ 1258 if (server->dialect == SMB311_PROT_ID) 1259 return 0; 1260 1261 /* 1262 * validation ioctl must be signed, so no point sending this if we 1263 * can not sign it (ie are not known user). Even if signing is not 1264 * required (enabled but not negotiated), in those cases we selectively 1265 * sign just this, the first and only signed request on a connection. 1266 * Having validation of negotiate info helps reduce attack vectors. 1267 */ 1268 if (tcon->ses->session_flags & SMB2_SESSION_FLAG_IS_GUEST) 1269 return 0; /* validation requires signing */ 1270 1271 if (tcon->ses->user_name == NULL) { 1272 cifs_dbg(FYI, "Can't validate negotiate: null user mount\n"); 1273 return 0; /* validation requires signing */ 1274 } 1275 1276 if (tcon->ses->session_flags & SMB2_SESSION_FLAG_IS_NULL) 1277 cifs_tcon_dbg(VFS, "Unexpected null user (anonymous) auth flag sent by server\n"); 1278 1279 pneg_inbuf = kmalloc(sizeof(*pneg_inbuf), GFP_NOFS); 1280 if (!pneg_inbuf) 1281 return -ENOMEM; 1282 1283 pneg_inbuf->Capabilities = 1284 cpu_to_le32(server->vals->req_capabilities); 1285 if (tcon->ses->chan_max > 1) 1286 pneg_inbuf->Capabilities |= cpu_to_le32(SMB2_GLOBAL_CAP_MULTI_CHANNEL); 1287 1288 memcpy(pneg_inbuf->Guid, server->client_guid, 1289 SMB2_CLIENT_GUID_SIZE); 1290 1291 if (tcon->ses->sign) 1292 pneg_inbuf->SecurityMode = 1293 cpu_to_le16(SMB2_NEGOTIATE_SIGNING_REQUIRED); 1294 else if (global_secflags & CIFSSEC_MAY_SIGN) 1295 pneg_inbuf->SecurityMode = 1296 cpu_to_le16(SMB2_NEGOTIATE_SIGNING_ENABLED); 1297 else 1298 pneg_inbuf->SecurityMode = 0; 1299 1300 1301 if (strcmp(server->vals->version_string, 1302 SMB3ANY_VERSION_STRING) == 0) { 1303 pneg_inbuf->Dialects[0] = cpu_to_le16(SMB30_PROT_ID); 1304 pneg_inbuf->Dialects[1] = cpu_to_le16(SMB302_PROT_ID); 1305 pneg_inbuf->Dialects[2] = cpu_to_le16(SMB311_PROT_ID); 1306 pneg_inbuf->DialectCount = cpu_to_le16(3); 1307 /* SMB 2.1 not included so subtract one dialect from len */ 1308 inbuflen = sizeof(*pneg_inbuf) - 1309 (sizeof(pneg_inbuf->Dialects[0])); 1310 } else if (strcmp(server->vals->version_string, 1311 SMBDEFAULT_VERSION_STRING) == 0) { 1312 pneg_inbuf->Dialects[0] = cpu_to_le16(SMB21_PROT_ID); 1313 pneg_inbuf->Dialects[1] = cpu_to_le16(SMB30_PROT_ID); 1314 pneg_inbuf->Dialects[2] = cpu_to_le16(SMB302_PROT_ID); 1315 pneg_inbuf->Dialects[3] = cpu_to_le16(SMB311_PROT_ID); 1316 pneg_inbuf->DialectCount = cpu_to_le16(4); 1317 /* structure is big enough for 4 dialects */ 1318 inbuflen = sizeof(*pneg_inbuf); 1319 } else { 1320 /* otherwise specific dialect was requested */ 1321 pneg_inbuf->Dialects[0] = 1322 cpu_to_le16(server->vals->protocol_id); 1323 pneg_inbuf->DialectCount = cpu_to_le16(1); 1324 /* structure is big enough for 4 dialects, sending only 1 */ 1325 inbuflen = sizeof(*pneg_inbuf) - 1326 sizeof(pneg_inbuf->Dialects[0]) * 3; 1327 } 1328 1329 rc = SMB2_ioctl(xid, tcon, NO_FILE_ID, NO_FILE_ID, 1330 FSCTL_VALIDATE_NEGOTIATE_INFO, 1331 (char *)pneg_inbuf, inbuflen, CIFSMaxBufSize, 1332 (char **)&pneg_rsp, &rsplen); 1333 if (rc == -EOPNOTSUPP) { 1334 /* 1335 * Old Windows versions or Netapp SMB server can return 1336 * not supported error. Client should accept it. 1337 */ 1338 cifs_tcon_dbg(VFS, "Server does not support validate negotiate\n"); 1339 rc = 0; 1340 goto out_free_inbuf; 1341 } else if (rc != 0) { 1342 cifs_tcon_dbg(VFS, "validate protocol negotiate failed: %d\n", 1343 rc); 1344 rc = -EIO; 1345 goto out_free_inbuf; 1346 } 1347 1348 rc = -EIO; 1349 if (rsplen != sizeof(*pneg_rsp)) { 1350 cifs_tcon_dbg(VFS, "Invalid protocol negotiate response size: %d\n", 1351 rsplen); 1352 1353 /* relax check since Mac returns max bufsize allowed on ioctl */ 1354 if (rsplen > CIFSMaxBufSize || rsplen < sizeof(*pneg_rsp)) 1355 goto out_free_rsp; 1356 } 1357 1358 /* check validate negotiate info response matches what we got earlier */ 1359 if (pneg_rsp->Dialect != cpu_to_le16(server->dialect)) 1360 goto vneg_out; 1361 1362 if (pneg_rsp->SecurityMode != cpu_to_le16(server->sec_mode)) 1363 goto vneg_out; 1364 1365 /* do not validate server guid because not saved at negprot time yet */ 1366 1367 if ((le32_to_cpu(pneg_rsp->Capabilities) | SMB2_NT_FIND | 1368 SMB2_LARGE_FILES) != server->capabilities) 1369 goto vneg_out; 1370 1371 /* validate negotiate successful */ 1372 rc = 0; 1373 cifs_dbg(FYI, "validate negotiate info successful\n"); 1374 goto out_free_rsp; 1375 1376 vneg_out: 1377 cifs_tcon_dbg(VFS, "protocol revalidation - security settings mismatch\n"); 1378 out_free_rsp: 1379 kfree(pneg_rsp); 1380 out_free_inbuf: 1381 kfree(pneg_inbuf); 1382 return rc; 1383 } 1384 1385 enum securityEnum 1386 smb2_select_sectype(struct TCP_Server_Info *server, enum securityEnum requested) 1387 { 1388 switch (requested) { 1389 case Kerberos: 1390 case RawNTLMSSP: 1391 return requested; 1392 case NTLMv2: 1393 return RawNTLMSSP; 1394 case Unspecified: 1395 if (server->sec_ntlmssp && 1396 (global_secflags & CIFSSEC_MAY_NTLMSSP)) 1397 return RawNTLMSSP; 1398 if ((server->sec_kerberos || server->sec_mskerberos) && 1399 (global_secflags & CIFSSEC_MAY_KRB5)) 1400 return Kerberos; 1401 fallthrough; 1402 default: 1403 return Unspecified; 1404 } 1405 } 1406 1407 struct SMB2_sess_data { 1408 unsigned int xid; 1409 struct cifs_ses *ses; 1410 struct TCP_Server_Info *server; 1411 struct nls_table *nls_cp; 1412 void (*func)(struct SMB2_sess_data *); 1413 int result; 1414 u64 previous_session; 1415 1416 /* we will send the SMB in three pieces: 1417 * a fixed length beginning part, an optional 1418 * SPNEGO blob (which can be zero length), and a 1419 * last part which will include the strings 1420 * and rest of bcc area. This allows us to avoid 1421 * a large buffer 17K allocation 1422 */ 1423 int buf0_type; 1424 struct kvec iov[2]; 1425 }; 1426 1427 static int 1428 SMB2_sess_alloc_buffer(struct SMB2_sess_data *sess_data) 1429 { 1430 int rc; 1431 struct cifs_ses *ses = sess_data->ses; 1432 struct TCP_Server_Info *server = sess_data->server; 1433 struct smb2_sess_setup_req *req; 1434 unsigned int total_len; 1435 bool is_binding = false; 1436 1437 rc = smb2_plain_req_init(SMB2_SESSION_SETUP, NULL, server, 1438 (void **) &req, 1439 &total_len); 1440 if (rc) 1441 return rc; 1442 1443 spin_lock(&ses->ses_lock); 1444 is_binding = (ses->ses_status == SES_GOOD); 1445 spin_unlock(&ses->ses_lock); 1446 1447 if (is_binding) { 1448 req->hdr.SessionId = cpu_to_le64(ses->Suid); 1449 req->hdr.Flags |= SMB2_FLAGS_SIGNED; 1450 req->PreviousSessionId = 0; 1451 req->Flags = SMB2_SESSION_REQ_FLAG_BINDING; 1452 cifs_dbg(FYI, "Binding to sess id: %llx\n", ses->Suid); 1453 } else { 1454 /* First session, not a reauthenticate */ 1455 req->hdr.SessionId = 0; 1456 /* 1457 * if reconnect, we need to send previous sess id 1458 * otherwise it is 0 1459 */ 1460 req->PreviousSessionId = cpu_to_le64(sess_data->previous_session); 1461 req->Flags = 0; /* MBZ */ 1462 cifs_dbg(FYI, "Fresh session. Previous: %llx\n", 1463 sess_data->previous_session); 1464 } 1465 1466 /* enough to enable echos and oplocks and one max size write */ 1467 if (server->credits >= server->max_credits) 1468 req->hdr.CreditRequest = cpu_to_le16(0); 1469 else 1470 req->hdr.CreditRequest = cpu_to_le16( 1471 min_t(int, server->max_credits - 1472 server->credits, 130)); 1473 1474 /* only one of SMB2 signing flags may be set in SMB2 request */ 1475 if (server->sign) 1476 req->SecurityMode = SMB2_NEGOTIATE_SIGNING_REQUIRED; 1477 else if (global_secflags & CIFSSEC_MAY_SIGN) /* one flag unlike MUST_ */ 1478 req->SecurityMode = SMB2_NEGOTIATE_SIGNING_ENABLED; 1479 else 1480 req->SecurityMode = 0; 1481 1482 #ifdef CONFIG_CIFS_DFS_UPCALL 1483 req->Capabilities = cpu_to_le32(SMB2_GLOBAL_CAP_DFS); 1484 #else 1485 req->Capabilities = 0; 1486 #endif /* DFS_UPCALL */ 1487 1488 req->Channel = 0; /* MBZ */ 1489 1490 sess_data->iov[0].iov_base = (char *)req; 1491 /* 1 for pad */ 1492 sess_data->iov[0].iov_len = total_len - 1; 1493 /* 1494 * This variable will be used to clear the buffer 1495 * allocated above in case of any error in the calling function. 1496 */ 1497 sess_data->buf0_type = CIFS_SMALL_BUFFER; 1498 1499 return 0; 1500 } 1501 1502 static void 1503 SMB2_sess_free_buffer(struct SMB2_sess_data *sess_data) 1504 { 1505 struct kvec *iov = sess_data->iov; 1506 1507 /* iov[1] is already freed by caller */ 1508 if (sess_data->buf0_type != CIFS_NO_BUFFER && iov[0].iov_base) 1509 memzero_explicit(iov[0].iov_base, iov[0].iov_len); 1510 1511 free_rsp_buf(sess_data->buf0_type, iov[0].iov_base); 1512 sess_data->buf0_type = CIFS_NO_BUFFER; 1513 } 1514 1515 static int 1516 SMB2_sess_sendreceive(struct SMB2_sess_data *sess_data) 1517 { 1518 int rc; 1519 struct smb_rqst rqst; 1520 struct smb2_sess_setup_req *req = sess_data->iov[0].iov_base; 1521 struct kvec rsp_iov = { NULL, 0 }; 1522 1523 /* Testing shows that buffer offset must be at location of Buffer[0] */ 1524 req->SecurityBufferOffset = 1525 cpu_to_le16(sizeof(struct smb2_sess_setup_req)); 1526 req->SecurityBufferLength = cpu_to_le16(sess_data->iov[1].iov_len); 1527 1528 memset(&rqst, 0, sizeof(struct smb_rqst)); 1529 rqst.rq_iov = sess_data->iov; 1530 rqst.rq_nvec = 2; 1531 1532 /* BB add code to build os and lm fields */ 1533 rc = cifs_send_recv(sess_data->xid, sess_data->ses, 1534 sess_data->server, 1535 &rqst, 1536 &sess_data->buf0_type, 1537 CIFS_LOG_ERROR | CIFS_SESS_OP, &rsp_iov); 1538 cifs_small_buf_release(sess_data->iov[0].iov_base); 1539 memcpy(&sess_data->iov[0], &rsp_iov, sizeof(struct kvec)); 1540 1541 return rc; 1542 } 1543 1544 static int 1545 SMB2_sess_establish_session(struct SMB2_sess_data *sess_data) 1546 { 1547 int rc = 0; 1548 struct cifs_ses *ses = sess_data->ses; 1549 struct TCP_Server_Info *server = sess_data->server; 1550 1551 cifs_server_lock(server); 1552 if (server->ops->generate_signingkey) { 1553 rc = server->ops->generate_signingkey(ses, server); 1554 if (rc) { 1555 cifs_dbg(FYI, 1556 "SMB3 session key generation failed\n"); 1557 cifs_server_unlock(server); 1558 return rc; 1559 } 1560 } 1561 if (!server->session_estab) { 1562 server->sequence_number = 0x2; 1563 server->session_estab = true; 1564 } 1565 cifs_server_unlock(server); 1566 1567 cifs_dbg(FYI, "SMB2/3 session established successfully\n"); 1568 return rc; 1569 } 1570 1571 #ifdef CONFIG_CIFS_UPCALL 1572 static void 1573 SMB2_auth_kerberos(struct SMB2_sess_data *sess_data) 1574 { 1575 int rc; 1576 struct cifs_ses *ses = sess_data->ses; 1577 struct TCP_Server_Info *server = sess_data->server; 1578 struct cifs_spnego_msg *msg; 1579 struct key *spnego_key = NULL; 1580 struct smb2_sess_setup_rsp *rsp = NULL; 1581 bool is_binding = false; 1582 1583 rc = SMB2_sess_alloc_buffer(sess_data); 1584 if (rc) 1585 goto out; 1586 1587 spnego_key = cifs_get_spnego_key(ses, server); 1588 if (IS_ERR(spnego_key)) { 1589 rc = PTR_ERR(spnego_key); 1590 if (rc == -ENOKEY) 1591 cifs_dbg(VFS, "Verify user has a krb5 ticket and keyutils is installed\n"); 1592 spnego_key = NULL; 1593 goto out; 1594 } 1595 1596 msg = spnego_key->payload.data[0]; 1597 /* 1598 * check version field to make sure that cifs.upcall is 1599 * sending us a response in an expected form 1600 */ 1601 if (msg->version != CIFS_SPNEGO_UPCALL_VERSION) { 1602 cifs_dbg(VFS, "bad cifs.upcall version. Expected %d got %d\n", 1603 CIFS_SPNEGO_UPCALL_VERSION, msg->version); 1604 rc = -EKEYREJECTED; 1605 goto out_put_spnego_key; 1606 } 1607 1608 spin_lock(&ses->ses_lock); 1609 is_binding = (ses->ses_status == SES_GOOD); 1610 spin_unlock(&ses->ses_lock); 1611 1612 /* keep session key if binding */ 1613 if (!is_binding) { 1614 kfree_sensitive(ses->auth_key.response); 1615 ses->auth_key.response = kmemdup(msg->data, msg->sesskey_len, 1616 GFP_KERNEL); 1617 if (!ses->auth_key.response) { 1618 cifs_dbg(VFS, "Kerberos can't allocate (%u bytes) memory\n", 1619 msg->sesskey_len); 1620 rc = -ENOMEM; 1621 goto out_put_spnego_key; 1622 } 1623 ses->auth_key.len = msg->sesskey_len; 1624 } 1625 1626 sess_data->iov[1].iov_base = msg->data + msg->sesskey_len; 1627 sess_data->iov[1].iov_len = msg->secblob_len; 1628 1629 rc = SMB2_sess_sendreceive(sess_data); 1630 if (rc) 1631 goto out_put_spnego_key; 1632 1633 rsp = (struct smb2_sess_setup_rsp *)sess_data->iov[0].iov_base; 1634 /* keep session id and flags if binding */ 1635 if (!is_binding) { 1636 ses->Suid = le64_to_cpu(rsp->hdr.SessionId); 1637 ses->session_flags = le16_to_cpu(rsp->SessionFlags); 1638 } 1639 1640 rc = SMB2_sess_establish_session(sess_data); 1641 out_put_spnego_key: 1642 key_invalidate(spnego_key); 1643 key_put(spnego_key); 1644 if (rc) { 1645 kfree_sensitive(ses->auth_key.response); 1646 ses->auth_key.response = NULL; 1647 ses->auth_key.len = 0; 1648 } 1649 out: 1650 sess_data->result = rc; 1651 sess_data->func = NULL; 1652 SMB2_sess_free_buffer(sess_data); 1653 } 1654 #else 1655 static void 1656 SMB2_auth_kerberos(struct SMB2_sess_data *sess_data) 1657 { 1658 cifs_dbg(VFS, "Kerberos negotiated but upcall support disabled!\n"); 1659 sess_data->result = -EOPNOTSUPP; 1660 sess_data->func = NULL; 1661 } 1662 #endif 1663 1664 static void 1665 SMB2_sess_auth_rawntlmssp_authenticate(struct SMB2_sess_data *sess_data); 1666 1667 static void 1668 SMB2_sess_auth_rawntlmssp_negotiate(struct SMB2_sess_data *sess_data) 1669 { 1670 int rc; 1671 struct cifs_ses *ses = sess_data->ses; 1672 struct TCP_Server_Info *server = sess_data->server; 1673 struct smb2_sess_setup_rsp *rsp = NULL; 1674 unsigned char *ntlmssp_blob = NULL; 1675 bool use_spnego = false; /* else use raw ntlmssp */ 1676 u16 blob_length = 0; 1677 bool is_binding = false; 1678 1679 /* 1680 * If memory allocation is successful, caller of this function 1681 * frees it. 1682 */ 1683 ses->ntlmssp = kmalloc(sizeof(struct ntlmssp_auth), GFP_KERNEL); 1684 if (!ses->ntlmssp) { 1685 rc = -ENOMEM; 1686 goto out_err; 1687 } 1688 ses->ntlmssp->sesskey_per_smbsess = true; 1689 1690 rc = SMB2_sess_alloc_buffer(sess_data); 1691 if (rc) 1692 goto out_err; 1693 1694 rc = build_ntlmssp_smb3_negotiate_blob(&ntlmssp_blob, 1695 &blob_length, ses, server, 1696 sess_data->nls_cp); 1697 if (rc) 1698 goto out; 1699 1700 if (use_spnego) { 1701 /* BB eventually need to add this */ 1702 cifs_dbg(VFS, "spnego not supported for SMB2 yet\n"); 1703 rc = -EOPNOTSUPP; 1704 goto out; 1705 } 1706 sess_data->iov[1].iov_base = ntlmssp_blob; 1707 sess_data->iov[1].iov_len = blob_length; 1708 1709 rc = SMB2_sess_sendreceive(sess_data); 1710 rsp = (struct smb2_sess_setup_rsp *)sess_data->iov[0].iov_base; 1711 1712 /* If true, rc here is expected and not an error */ 1713 if (sess_data->buf0_type != CIFS_NO_BUFFER && 1714 rsp->hdr.Status == STATUS_MORE_PROCESSING_REQUIRED) 1715 rc = 0; 1716 1717 if (rc) 1718 goto out; 1719 1720 if (offsetof(struct smb2_sess_setup_rsp, Buffer) != 1721 le16_to_cpu(rsp->SecurityBufferOffset)) { 1722 cifs_dbg(VFS, "Invalid security buffer offset %d\n", 1723 le16_to_cpu(rsp->SecurityBufferOffset)); 1724 rc = -EIO; 1725 goto out; 1726 } 1727 rc = decode_ntlmssp_challenge(rsp->Buffer, 1728 le16_to_cpu(rsp->SecurityBufferLength), ses); 1729 if (rc) 1730 goto out; 1731 1732 cifs_dbg(FYI, "rawntlmssp session setup challenge phase\n"); 1733 1734 spin_lock(&ses->ses_lock); 1735 is_binding = (ses->ses_status == SES_GOOD); 1736 spin_unlock(&ses->ses_lock); 1737 1738 /* keep existing ses id and flags if binding */ 1739 if (!is_binding) { 1740 ses->Suid = le64_to_cpu(rsp->hdr.SessionId); 1741 ses->session_flags = le16_to_cpu(rsp->SessionFlags); 1742 } 1743 1744 out: 1745 kfree_sensitive(ntlmssp_blob); 1746 SMB2_sess_free_buffer(sess_data); 1747 if (!rc) { 1748 sess_data->result = 0; 1749 sess_data->func = SMB2_sess_auth_rawntlmssp_authenticate; 1750 return; 1751 } 1752 out_err: 1753 kfree_sensitive(ses->ntlmssp); 1754 ses->ntlmssp = NULL; 1755 sess_data->result = rc; 1756 sess_data->func = NULL; 1757 } 1758 1759 static void 1760 SMB2_sess_auth_rawntlmssp_authenticate(struct SMB2_sess_data *sess_data) 1761 { 1762 int rc; 1763 struct cifs_ses *ses = sess_data->ses; 1764 struct TCP_Server_Info *server = sess_data->server; 1765 struct smb2_sess_setup_req *req; 1766 struct smb2_sess_setup_rsp *rsp = NULL; 1767 unsigned char *ntlmssp_blob = NULL; 1768 bool use_spnego = false; /* else use raw ntlmssp */ 1769 u16 blob_length = 0; 1770 bool is_binding = false; 1771 1772 rc = SMB2_sess_alloc_buffer(sess_data); 1773 if (rc) 1774 goto out; 1775 1776 req = (struct smb2_sess_setup_req *) sess_data->iov[0].iov_base; 1777 req->hdr.SessionId = cpu_to_le64(ses->Suid); 1778 1779 rc = build_ntlmssp_auth_blob(&ntlmssp_blob, &blob_length, 1780 ses, server, 1781 sess_data->nls_cp); 1782 if (rc) { 1783 cifs_dbg(FYI, "build_ntlmssp_auth_blob failed %d\n", rc); 1784 goto out; 1785 } 1786 1787 if (use_spnego) { 1788 /* BB eventually need to add this */ 1789 cifs_dbg(VFS, "spnego not supported for SMB2 yet\n"); 1790 rc = -EOPNOTSUPP; 1791 goto out; 1792 } 1793 sess_data->iov[1].iov_base = ntlmssp_blob; 1794 sess_data->iov[1].iov_len = blob_length; 1795 1796 rc = SMB2_sess_sendreceive(sess_data); 1797 if (rc) 1798 goto out; 1799 1800 rsp = (struct smb2_sess_setup_rsp *)sess_data->iov[0].iov_base; 1801 1802 spin_lock(&ses->ses_lock); 1803 is_binding = (ses->ses_status == SES_GOOD); 1804 spin_unlock(&ses->ses_lock); 1805 1806 /* keep existing ses id and flags if binding */ 1807 if (!is_binding) { 1808 ses->Suid = le64_to_cpu(rsp->hdr.SessionId); 1809 ses->session_flags = le16_to_cpu(rsp->SessionFlags); 1810 } 1811 1812 rc = SMB2_sess_establish_session(sess_data); 1813 #ifdef CONFIG_CIFS_DEBUG_DUMP_KEYS 1814 if (ses->server->dialect < SMB30_PROT_ID) { 1815 cifs_dbg(VFS, "%s: dumping generated SMB2 session keys\n", __func__); 1816 /* 1817 * The session id is opaque in terms of endianness, so we can't 1818 * print it as a long long. we dump it as we got it on the wire 1819 */ 1820 cifs_dbg(VFS, "Session Id %*ph\n", (int)sizeof(ses->Suid), 1821 &ses->Suid); 1822 cifs_dbg(VFS, "Session Key %*ph\n", 1823 SMB2_NTLMV2_SESSKEY_SIZE, ses->auth_key.response); 1824 cifs_dbg(VFS, "Signing Key %*ph\n", 1825 SMB3_SIGN_KEY_SIZE, ses->auth_key.response); 1826 } 1827 #endif 1828 out: 1829 kfree_sensitive(ntlmssp_blob); 1830 SMB2_sess_free_buffer(sess_data); 1831 kfree_sensitive(ses->ntlmssp); 1832 ses->ntlmssp = NULL; 1833 sess_data->result = rc; 1834 sess_data->func = NULL; 1835 } 1836 1837 static int 1838 SMB2_select_sec(struct SMB2_sess_data *sess_data) 1839 { 1840 int type; 1841 struct cifs_ses *ses = sess_data->ses; 1842 struct TCP_Server_Info *server = sess_data->server; 1843 1844 type = smb2_select_sectype(server, ses->sectype); 1845 cifs_dbg(FYI, "sess setup type %d\n", type); 1846 if (type == Unspecified) { 1847 cifs_dbg(VFS, "Unable to select appropriate authentication method!\n"); 1848 return -EINVAL; 1849 } 1850 1851 switch (type) { 1852 case Kerberos: 1853 sess_data->func = SMB2_auth_kerberos; 1854 break; 1855 case RawNTLMSSP: 1856 sess_data->func = SMB2_sess_auth_rawntlmssp_negotiate; 1857 break; 1858 default: 1859 cifs_dbg(VFS, "secType %d not supported!\n", type); 1860 return -EOPNOTSUPP; 1861 } 1862 1863 return 0; 1864 } 1865 1866 int 1867 SMB2_sess_setup(const unsigned int xid, struct cifs_ses *ses, 1868 struct TCP_Server_Info *server, 1869 const struct nls_table *nls_cp) 1870 { 1871 int rc = 0; 1872 struct SMB2_sess_data *sess_data; 1873 1874 cifs_dbg(FYI, "Session Setup\n"); 1875 1876 if (!server) { 1877 WARN(1, "%s: server is NULL!\n", __func__); 1878 return -EIO; 1879 } 1880 1881 sess_data = kzalloc(sizeof(struct SMB2_sess_data), GFP_KERNEL); 1882 if (!sess_data) 1883 return -ENOMEM; 1884 1885 sess_data->xid = xid; 1886 sess_data->ses = ses; 1887 sess_data->server = server; 1888 sess_data->buf0_type = CIFS_NO_BUFFER; 1889 sess_data->nls_cp = (struct nls_table *) nls_cp; 1890 sess_data->previous_session = ses->Suid; 1891 1892 rc = SMB2_select_sec(sess_data); 1893 if (rc) 1894 goto out; 1895 1896 /* 1897 * Initialize the session hash with the server one. 1898 */ 1899 memcpy(ses->preauth_sha_hash, server->preauth_sha_hash, 1900 SMB2_PREAUTH_HASH_SIZE); 1901 1902 while (sess_data->func) 1903 sess_data->func(sess_data); 1904 1905 if ((ses->session_flags & SMB2_SESSION_FLAG_IS_GUEST) && (ses->sign)) 1906 cifs_server_dbg(VFS, "signing requested but authenticated as guest\n"); 1907 rc = sess_data->result; 1908 out: 1909 kfree_sensitive(sess_data); 1910 return rc; 1911 } 1912 1913 int 1914 SMB2_logoff(const unsigned int xid, struct cifs_ses *ses) 1915 { 1916 struct smb_rqst rqst; 1917 struct smb2_logoff_req *req; /* response is also trivial struct */ 1918 int rc = 0; 1919 struct TCP_Server_Info *server; 1920 int flags = 0; 1921 unsigned int total_len; 1922 struct kvec iov[1]; 1923 struct kvec rsp_iov; 1924 int resp_buf_type; 1925 1926 cifs_dbg(FYI, "disconnect session %p\n", ses); 1927 1928 if (ses && (ses->server)) 1929 server = ses->server; 1930 else 1931 return -EIO; 1932 1933 /* no need to send SMB logoff if uid already closed due to reconnect */ 1934 spin_lock(&ses->chan_lock); 1935 if (CIFS_ALL_CHANS_NEED_RECONNECT(ses)) { 1936 spin_unlock(&ses->chan_lock); 1937 goto smb2_session_already_dead; 1938 } 1939 spin_unlock(&ses->chan_lock); 1940 1941 rc = smb2_plain_req_init(SMB2_LOGOFF, NULL, ses->server, 1942 (void **) &req, &total_len); 1943 if (rc) 1944 return rc; 1945 1946 /* since no tcon, smb2_init can not do this, so do here */ 1947 req->hdr.SessionId = cpu_to_le64(ses->Suid); 1948 1949 if (ses->session_flags & SMB2_SESSION_FLAG_ENCRYPT_DATA) 1950 flags |= CIFS_TRANSFORM_REQ; 1951 else if (server->sign) 1952 req->hdr.Flags |= SMB2_FLAGS_SIGNED; 1953 1954 flags |= CIFS_NO_RSP_BUF; 1955 1956 iov[0].iov_base = (char *)req; 1957 iov[0].iov_len = total_len; 1958 1959 memset(&rqst, 0, sizeof(struct smb_rqst)); 1960 rqst.rq_iov = iov; 1961 rqst.rq_nvec = 1; 1962 1963 rc = cifs_send_recv(xid, ses, ses->server, 1964 &rqst, &resp_buf_type, flags, &rsp_iov); 1965 cifs_small_buf_release(req); 1966 /* 1967 * No tcon so can't do 1968 * cifs_stats_inc(&tcon->stats.smb2_stats.smb2_com_fail[SMB2...]); 1969 */ 1970 1971 smb2_session_already_dead: 1972 return rc; 1973 } 1974 1975 static inline void cifs_stats_fail_inc(struct cifs_tcon *tcon, uint16_t code) 1976 { 1977 cifs_stats_inc(&tcon->stats.smb2_stats.smb2_com_failed[code]); 1978 } 1979 1980 #define MAX_SHARENAME_LENGTH (255 /* server */ + 80 /* share */ + 1 /* NULL */) 1981 1982 /* These are similar values to what Windows uses */ 1983 static inline void init_copy_chunk_defaults(struct cifs_tcon *tcon) 1984 { 1985 tcon->max_chunks = 256; 1986 tcon->max_bytes_chunk = 1048576; 1987 tcon->max_bytes_copy = 16777216; 1988 } 1989 1990 int 1991 SMB2_tcon(const unsigned int xid, struct cifs_ses *ses, const char *tree, 1992 struct cifs_tcon *tcon, const struct nls_table *cp) 1993 { 1994 struct smb_rqst rqst; 1995 struct smb2_tree_connect_req *req; 1996 struct smb2_tree_connect_rsp *rsp = NULL; 1997 struct kvec iov[2]; 1998 struct kvec rsp_iov = { NULL, 0 }; 1999 int rc = 0; 2000 int resp_buftype; 2001 int unc_path_len; 2002 __le16 *unc_path = NULL; 2003 int flags = 0; 2004 unsigned int total_len; 2005 struct TCP_Server_Info *server = cifs_pick_channel(ses); 2006 2007 cifs_dbg(FYI, "TCON\n"); 2008 2009 if (!server || !tree) 2010 return -EIO; 2011 2012 unc_path = kmalloc(MAX_SHARENAME_LENGTH * 2, GFP_KERNEL); 2013 if (unc_path == NULL) 2014 return -ENOMEM; 2015 2016 unc_path_len = cifs_strtoUTF16(unc_path, tree, strlen(tree), cp); 2017 if (unc_path_len <= 0) { 2018 kfree(unc_path); 2019 return -EINVAL; 2020 } 2021 unc_path_len *= 2; 2022 2023 /* SMB2 TREE_CONNECT request must be called with TreeId == 0 */ 2024 tcon->tid = 0; 2025 atomic_set(&tcon->num_remote_opens, 0); 2026 rc = smb2_plain_req_init(SMB2_TREE_CONNECT, tcon, server, 2027 (void **) &req, &total_len); 2028 if (rc) { 2029 kfree(unc_path); 2030 return rc; 2031 } 2032 2033 if (smb3_encryption_required(tcon)) 2034 flags |= CIFS_TRANSFORM_REQ; 2035 2036 iov[0].iov_base = (char *)req; 2037 /* 1 for pad */ 2038 iov[0].iov_len = total_len - 1; 2039 2040 /* Testing shows that buffer offset must be at location of Buffer[0] */ 2041 req->PathOffset = cpu_to_le16(sizeof(struct smb2_tree_connect_req)); 2042 req->PathLength = cpu_to_le16(unc_path_len); 2043 iov[1].iov_base = unc_path; 2044 iov[1].iov_len = unc_path_len; 2045 2046 /* 2047 * 3.11 tcon req must be signed if not encrypted. See MS-SMB2 3.2.4.1.1 2048 * unless it is guest or anonymous user. See MS-SMB2 3.2.5.3.1 2049 * (Samba servers don't always set the flag so also check if null user) 2050 */ 2051 if ((server->dialect == SMB311_PROT_ID) && 2052 !smb3_encryption_required(tcon) && 2053 !(ses->session_flags & 2054 (SMB2_SESSION_FLAG_IS_GUEST|SMB2_SESSION_FLAG_IS_NULL)) && 2055 ((ses->user_name != NULL) || (ses->sectype == Kerberos))) 2056 req->hdr.Flags |= SMB2_FLAGS_SIGNED; 2057 2058 memset(&rqst, 0, sizeof(struct smb_rqst)); 2059 rqst.rq_iov = iov; 2060 rqst.rq_nvec = 2; 2061 2062 /* Need 64 for max size write so ask for more in case not there yet */ 2063 if (server->credits >= server->max_credits) 2064 req->hdr.CreditRequest = cpu_to_le16(0); 2065 else 2066 req->hdr.CreditRequest = cpu_to_le16( 2067 min_t(int, server->max_credits - 2068 server->credits, 64)); 2069 2070 rc = cifs_send_recv(xid, ses, server, 2071 &rqst, &resp_buftype, flags, &rsp_iov); 2072 cifs_small_buf_release(req); 2073 rsp = (struct smb2_tree_connect_rsp *)rsp_iov.iov_base; 2074 trace_smb3_tcon(xid, tcon->tid, ses->Suid, tree, rc); 2075 if ((rc != 0) || (rsp == NULL)) { 2076 cifs_stats_fail_inc(tcon, SMB2_TREE_CONNECT_HE); 2077 tcon->need_reconnect = true; 2078 goto tcon_error_exit; 2079 } 2080 2081 switch (rsp->ShareType) { 2082 case SMB2_SHARE_TYPE_DISK: 2083 cifs_dbg(FYI, "connection to disk share\n"); 2084 break; 2085 case SMB2_SHARE_TYPE_PIPE: 2086 tcon->pipe = true; 2087 cifs_dbg(FYI, "connection to pipe share\n"); 2088 break; 2089 case SMB2_SHARE_TYPE_PRINT: 2090 tcon->print = true; 2091 cifs_dbg(FYI, "connection to printer\n"); 2092 break; 2093 default: 2094 cifs_server_dbg(VFS, "unknown share type %d\n", rsp->ShareType); 2095 rc = -EOPNOTSUPP; 2096 goto tcon_error_exit; 2097 } 2098 2099 tcon->share_flags = le32_to_cpu(rsp->ShareFlags); 2100 tcon->capabilities = rsp->Capabilities; /* we keep caps little endian */ 2101 tcon->maximal_access = le32_to_cpu(rsp->MaximalAccess); 2102 tcon->tid = le32_to_cpu(rsp->hdr.Id.SyncId.TreeId); 2103 strscpy(tcon->tree_name, tree, sizeof(tcon->tree_name)); 2104 2105 if ((rsp->Capabilities & SMB2_SHARE_CAP_DFS) && 2106 ((tcon->share_flags & SHI1005_FLAGS_DFS) == 0)) 2107 cifs_tcon_dbg(VFS, "DFS capability contradicts DFS flag\n"); 2108 2109 if (tcon->seal && 2110 !(server->capabilities & SMB2_GLOBAL_CAP_ENCRYPTION)) 2111 cifs_tcon_dbg(VFS, "Encryption is requested but not supported\n"); 2112 2113 init_copy_chunk_defaults(tcon); 2114 if (server->ops->validate_negotiate) 2115 rc = server->ops->validate_negotiate(xid, tcon); 2116 if (rc == 0) /* See MS-SMB2 2.2.10 and 3.2.5.5 */ 2117 if (tcon->share_flags & SMB2_SHAREFLAG_ISOLATED_TRANSPORT) 2118 server->nosharesock = true; 2119 tcon_exit: 2120 2121 free_rsp_buf(resp_buftype, rsp); 2122 kfree(unc_path); 2123 return rc; 2124 2125 tcon_error_exit: 2126 if (rsp && rsp->hdr.Status == STATUS_BAD_NETWORK_NAME) 2127 cifs_tcon_dbg(VFS, "BAD_NETWORK_NAME: %s\n", tree); 2128 goto tcon_exit; 2129 } 2130 2131 int 2132 SMB2_tdis(const unsigned int xid, struct cifs_tcon *tcon) 2133 { 2134 struct smb_rqst rqst; 2135 struct smb2_tree_disconnect_req *req; /* response is trivial */ 2136 int rc = 0; 2137 struct cifs_ses *ses = tcon->ses; 2138 struct TCP_Server_Info *server = cifs_pick_channel(ses); 2139 int flags = 0; 2140 unsigned int total_len; 2141 struct kvec iov[1]; 2142 struct kvec rsp_iov; 2143 int resp_buf_type; 2144 2145 cifs_dbg(FYI, "Tree Disconnect\n"); 2146 2147 if (!ses || !(ses->server)) 2148 return -EIO; 2149 2150 trace_smb3_tdis_enter(xid, tcon->tid, ses->Suid, tcon->tree_name); 2151 spin_lock(&ses->chan_lock); 2152 if ((tcon->need_reconnect) || 2153 (CIFS_ALL_CHANS_NEED_RECONNECT(tcon->ses))) { 2154 spin_unlock(&ses->chan_lock); 2155 return 0; 2156 } 2157 spin_unlock(&ses->chan_lock); 2158 2159 invalidate_all_cached_dirs(tcon); 2160 2161 rc = smb2_plain_req_init(SMB2_TREE_DISCONNECT, tcon, server, 2162 (void **) &req, 2163 &total_len); 2164 if (rc) 2165 return rc; 2166 2167 if (smb3_encryption_required(tcon)) 2168 flags |= CIFS_TRANSFORM_REQ; 2169 2170 flags |= CIFS_NO_RSP_BUF; 2171 2172 iov[0].iov_base = (char *)req; 2173 iov[0].iov_len = total_len; 2174 2175 memset(&rqst, 0, sizeof(struct smb_rqst)); 2176 rqst.rq_iov = iov; 2177 rqst.rq_nvec = 1; 2178 2179 rc = cifs_send_recv(xid, ses, server, 2180 &rqst, &resp_buf_type, flags, &rsp_iov); 2181 cifs_small_buf_release(req); 2182 if (rc) { 2183 cifs_stats_fail_inc(tcon, SMB2_TREE_DISCONNECT_HE); 2184 trace_smb3_tdis_err(xid, tcon->tid, ses->Suid, rc); 2185 } 2186 trace_smb3_tdis_done(xid, tcon->tid, ses->Suid); 2187 2188 return rc; 2189 } 2190 2191 2192 static struct create_durable * 2193 create_durable_buf(void) 2194 { 2195 struct create_durable *buf; 2196 2197 buf = kzalloc(sizeof(struct create_durable), GFP_KERNEL); 2198 if (!buf) 2199 return NULL; 2200 2201 buf->ccontext.DataOffset = cpu_to_le16(offsetof 2202 (struct create_durable, Data)); 2203 buf->ccontext.DataLength = cpu_to_le32(16); 2204 buf->ccontext.NameOffset = cpu_to_le16(offsetof 2205 (struct create_durable, Name)); 2206 buf->ccontext.NameLength = cpu_to_le16(4); 2207 /* SMB2_CREATE_DURABLE_HANDLE_REQUEST is "DHnQ" */ 2208 buf->Name[0] = 'D'; 2209 buf->Name[1] = 'H'; 2210 buf->Name[2] = 'n'; 2211 buf->Name[3] = 'Q'; 2212 return buf; 2213 } 2214 2215 static struct create_durable * 2216 create_reconnect_durable_buf(struct cifs_fid *fid) 2217 { 2218 struct create_durable *buf; 2219 2220 buf = kzalloc(sizeof(struct create_durable), GFP_KERNEL); 2221 if (!buf) 2222 return NULL; 2223 2224 buf->ccontext.DataOffset = cpu_to_le16(offsetof 2225 (struct create_durable, Data)); 2226 buf->ccontext.DataLength = cpu_to_le32(16); 2227 buf->ccontext.NameOffset = cpu_to_le16(offsetof 2228 (struct create_durable, Name)); 2229 buf->ccontext.NameLength = cpu_to_le16(4); 2230 buf->Data.Fid.PersistentFileId = fid->persistent_fid; 2231 buf->Data.Fid.VolatileFileId = fid->volatile_fid; 2232 /* SMB2_CREATE_DURABLE_HANDLE_RECONNECT is "DHnC" */ 2233 buf->Name[0] = 'D'; 2234 buf->Name[1] = 'H'; 2235 buf->Name[2] = 'n'; 2236 buf->Name[3] = 'C'; 2237 return buf; 2238 } 2239 2240 static void 2241 parse_query_id_ctxt(struct create_context *cc, struct smb2_file_all_info *buf) 2242 { 2243 struct create_disk_id_rsp *pdisk_id = (struct create_disk_id_rsp *)cc; 2244 2245 cifs_dbg(FYI, "parse query id context 0x%llx 0x%llx\n", 2246 pdisk_id->DiskFileId, pdisk_id->VolumeId); 2247 buf->IndexNumber = pdisk_id->DiskFileId; 2248 } 2249 2250 static void 2251 parse_posix_ctxt(struct create_context *cc, struct smb2_file_all_info *info, 2252 struct create_posix_rsp *posix) 2253 { 2254 int sid_len; 2255 u8 *beg = (u8 *)cc + le16_to_cpu(cc->DataOffset); 2256 u8 *end = beg + le32_to_cpu(cc->DataLength); 2257 u8 *sid; 2258 2259 memset(posix, 0, sizeof(*posix)); 2260 2261 posix->nlink = le32_to_cpu(*(__le32 *)(beg + 0)); 2262 posix->reparse_tag = le32_to_cpu(*(__le32 *)(beg + 4)); 2263 posix->mode = le32_to_cpu(*(__le32 *)(beg + 8)); 2264 2265 sid = beg + 12; 2266 sid_len = posix_info_sid_size(sid, end); 2267 if (sid_len < 0) { 2268 cifs_dbg(VFS, "bad owner sid in posix create response\n"); 2269 return; 2270 } 2271 memcpy(&posix->owner, sid, sid_len); 2272 2273 sid = sid + sid_len; 2274 sid_len = posix_info_sid_size(sid, end); 2275 if (sid_len < 0) { 2276 cifs_dbg(VFS, "bad group sid in posix create response\n"); 2277 return; 2278 } 2279 memcpy(&posix->group, sid, sid_len); 2280 2281 cifs_dbg(FYI, "nlink=%d mode=%o reparse_tag=%x\n", 2282 posix->nlink, posix->mode, posix->reparse_tag); 2283 } 2284 2285 int smb2_parse_contexts(struct TCP_Server_Info *server, 2286 struct kvec *rsp_iov, 2287 unsigned int *epoch, 2288 char *lease_key, __u8 *oplock, 2289 struct smb2_file_all_info *buf, 2290 struct create_posix_rsp *posix) 2291 { 2292 struct smb2_create_rsp *rsp = rsp_iov->iov_base; 2293 struct create_context *cc; 2294 size_t rem, off, len; 2295 size_t doff, dlen; 2296 size_t noff, nlen; 2297 char *name; 2298 static const char smb3_create_tag_posix[] = { 2299 0x93, 0xAD, 0x25, 0x50, 0x9C, 2300 0xB4, 0x11, 0xE7, 0xB4, 0x23, 0x83, 2301 0xDE, 0x96, 0x8B, 0xCD, 0x7C 2302 }; 2303 2304 *oplock = 0; 2305 2306 off = le32_to_cpu(rsp->CreateContextsOffset); 2307 rem = le32_to_cpu(rsp->CreateContextsLength); 2308 if (check_add_overflow(off, rem, &len) || len > rsp_iov->iov_len) 2309 return -EINVAL; 2310 cc = (struct create_context *)((u8 *)rsp + off); 2311 2312 /* Initialize inode number to 0 in case no valid data in qfid context */ 2313 if (buf) 2314 buf->IndexNumber = 0; 2315 2316 while (rem >= sizeof(*cc)) { 2317 doff = le16_to_cpu(cc->DataOffset); 2318 dlen = le32_to_cpu(cc->DataLength); 2319 if (check_add_overflow(doff, dlen, &len) || len > rem) 2320 return -EINVAL; 2321 2322 noff = le16_to_cpu(cc->NameOffset); 2323 nlen = le16_to_cpu(cc->NameLength); 2324 if (noff + nlen > doff) 2325 return -EINVAL; 2326 2327 name = (char *)cc + noff; 2328 switch (nlen) { 2329 case 4: 2330 if (!strncmp(name, SMB2_CREATE_REQUEST_LEASE, 4)) { 2331 *oplock = server->ops->parse_lease_buf(cc, epoch, 2332 lease_key); 2333 } else if (buf && 2334 !strncmp(name, SMB2_CREATE_QUERY_ON_DISK_ID, 4)) { 2335 parse_query_id_ctxt(cc, buf); 2336 } 2337 break; 2338 case 16: 2339 if (posix && !memcmp(name, smb3_create_tag_posix, 16)) 2340 parse_posix_ctxt(cc, buf, posix); 2341 break; 2342 default: 2343 cifs_dbg(FYI, "%s: unhandled context (nlen=%zu dlen=%zu)\n", 2344 __func__, nlen, dlen); 2345 if (IS_ENABLED(CONFIG_CIFS_DEBUG2)) 2346 cifs_dump_mem("context data: ", cc, dlen); 2347 break; 2348 } 2349 2350 off = le32_to_cpu(cc->Next); 2351 if (!off) 2352 break; 2353 if (check_sub_overflow(rem, off, &rem)) 2354 return -EINVAL; 2355 cc = (struct create_context *)((u8 *)cc + off); 2356 } 2357 2358 if (rsp->OplockLevel != SMB2_OPLOCK_LEVEL_LEASE) 2359 *oplock = rsp->OplockLevel; 2360 2361 return 0; 2362 } 2363 2364 static int 2365 add_lease_context(struct TCP_Server_Info *server, 2366 struct smb2_create_req *req, 2367 struct kvec *iov, 2368 unsigned int *num_iovec, u8 *lease_key, __u8 *oplock) 2369 { 2370 unsigned int num = *num_iovec; 2371 2372 iov[num].iov_base = server->ops->create_lease_buf(lease_key, *oplock); 2373 if (iov[num].iov_base == NULL) 2374 return -ENOMEM; 2375 iov[num].iov_len = server->vals->create_lease_size; 2376 req->RequestedOplockLevel = SMB2_OPLOCK_LEVEL_LEASE; 2377 *num_iovec = num + 1; 2378 return 0; 2379 } 2380 2381 static struct create_durable_v2 * 2382 create_durable_v2_buf(struct cifs_open_parms *oparms) 2383 { 2384 struct cifs_fid *pfid = oparms->fid; 2385 struct create_durable_v2 *buf; 2386 2387 buf = kzalloc(sizeof(struct create_durable_v2), GFP_KERNEL); 2388 if (!buf) 2389 return NULL; 2390 2391 buf->ccontext.DataOffset = cpu_to_le16(offsetof 2392 (struct create_durable_v2, dcontext)); 2393 buf->ccontext.DataLength = cpu_to_le32(sizeof(struct durable_context_v2)); 2394 buf->ccontext.NameOffset = cpu_to_le16(offsetof 2395 (struct create_durable_v2, Name)); 2396 buf->ccontext.NameLength = cpu_to_le16(4); 2397 2398 /* 2399 * NB: Handle timeout defaults to 0, which allows server to choose 2400 * (most servers default to 120 seconds) and most clients default to 0. 2401 * This can be overridden at mount ("handletimeout=") if the user wants 2402 * a different persistent (or resilient) handle timeout for all opens 2403 * on a particular SMB3 mount. 2404 */ 2405 buf->dcontext.Timeout = cpu_to_le32(oparms->tcon->handle_timeout); 2406 buf->dcontext.Flags = cpu_to_le32(SMB2_DHANDLE_FLAG_PERSISTENT); 2407 2408 /* for replay, we should not overwrite the existing create guid */ 2409 if (!oparms->replay) { 2410 generate_random_uuid(buf->dcontext.CreateGuid); 2411 memcpy(pfid->create_guid, buf->dcontext.CreateGuid, 16); 2412 } else 2413 memcpy(buf->dcontext.CreateGuid, pfid->create_guid, 16); 2414 2415 /* SMB2_CREATE_DURABLE_HANDLE_REQUEST is "DH2Q" */ 2416 buf->Name[0] = 'D'; 2417 buf->Name[1] = 'H'; 2418 buf->Name[2] = '2'; 2419 buf->Name[3] = 'Q'; 2420 return buf; 2421 } 2422 2423 static struct create_durable_handle_reconnect_v2 * 2424 create_reconnect_durable_v2_buf(struct cifs_fid *fid) 2425 { 2426 struct create_durable_handle_reconnect_v2 *buf; 2427 2428 buf = kzalloc(sizeof(struct create_durable_handle_reconnect_v2), 2429 GFP_KERNEL); 2430 if (!buf) 2431 return NULL; 2432 2433 buf->ccontext.DataOffset = 2434 cpu_to_le16(offsetof(struct create_durable_handle_reconnect_v2, 2435 dcontext)); 2436 buf->ccontext.DataLength = 2437 cpu_to_le32(sizeof(struct durable_reconnect_context_v2)); 2438 buf->ccontext.NameOffset = 2439 cpu_to_le16(offsetof(struct create_durable_handle_reconnect_v2, 2440 Name)); 2441 buf->ccontext.NameLength = cpu_to_le16(4); 2442 2443 buf->dcontext.Fid.PersistentFileId = fid->persistent_fid; 2444 buf->dcontext.Fid.VolatileFileId = fid->volatile_fid; 2445 buf->dcontext.Flags = cpu_to_le32(SMB2_DHANDLE_FLAG_PERSISTENT); 2446 memcpy(buf->dcontext.CreateGuid, fid->create_guid, 16); 2447 2448 /* SMB2_CREATE_DURABLE_HANDLE_RECONNECT_V2 is "DH2C" */ 2449 buf->Name[0] = 'D'; 2450 buf->Name[1] = 'H'; 2451 buf->Name[2] = '2'; 2452 buf->Name[3] = 'C'; 2453 return buf; 2454 } 2455 2456 static int 2457 add_durable_v2_context(struct kvec *iov, unsigned int *num_iovec, 2458 struct cifs_open_parms *oparms) 2459 { 2460 unsigned int num = *num_iovec; 2461 2462 iov[num].iov_base = create_durable_v2_buf(oparms); 2463 if (iov[num].iov_base == NULL) 2464 return -ENOMEM; 2465 iov[num].iov_len = sizeof(struct create_durable_v2); 2466 *num_iovec = num + 1; 2467 return 0; 2468 } 2469 2470 static int 2471 add_durable_reconnect_v2_context(struct kvec *iov, unsigned int *num_iovec, 2472 struct cifs_open_parms *oparms) 2473 { 2474 unsigned int num = *num_iovec; 2475 2476 /* indicate that we don't need to relock the file */ 2477 oparms->reconnect = false; 2478 2479 iov[num].iov_base = create_reconnect_durable_v2_buf(oparms->fid); 2480 if (iov[num].iov_base == NULL) 2481 return -ENOMEM; 2482 iov[num].iov_len = sizeof(struct create_durable_handle_reconnect_v2); 2483 *num_iovec = num + 1; 2484 return 0; 2485 } 2486 2487 static int 2488 add_durable_context(struct kvec *iov, unsigned int *num_iovec, 2489 struct cifs_open_parms *oparms, bool use_persistent) 2490 { 2491 unsigned int num = *num_iovec; 2492 2493 if (use_persistent) { 2494 if (oparms->reconnect) 2495 return add_durable_reconnect_v2_context(iov, num_iovec, 2496 oparms); 2497 else 2498 return add_durable_v2_context(iov, num_iovec, oparms); 2499 } 2500 2501 if (oparms->reconnect) { 2502 iov[num].iov_base = create_reconnect_durable_buf(oparms->fid); 2503 /* indicate that we don't need to relock the file */ 2504 oparms->reconnect = false; 2505 } else 2506 iov[num].iov_base = create_durable_buf(); 2507 if (iov[num].iov_base == NULL) 2508 return -ENOMEM; 2509 iov[num].iov_len = sizeof(struct create_durable); 2510 *num_iovec = num + 1; 2511 return 0; 2512 } 2513 2514 /* See MS-SMB2 2.2.13.2.7 */ 2515 static struct crt_twarp_ctxt * 2516 create_twarp_buf(__u64 timewarp) 2517 { 2518 struct crt_twarp_ctxt *buf; 2519 2520 buf = kzalloc(sizeof(struct crt_twarp_ctxt), GFP_KERNEL); 2521 if (!buf) 2522 return NULL; 2523 2524 buf->ccontext.DataOffset = cpu_to_le16(offsetof 2525 (struct crt_twarp_ctxt, Timestamp)); 2526 buf->ccontext.DataLength = cpu_to_le32(8); 2527 buf->ccontext.NameOffset = cpu_to_le16(offsetof 2528 (struct crt_twarp_ctxt, Name)); 2529 buf->ccontext.NameLength = cpu_to_le16(4); 2530 /* SMB2_CREATE_TIMEWARP_TOKEN is "TWrp" */ 2531 buf->Name[0] = 'T'; 2532 buf->Name[1] = 'W'; 2533 buf->Name[2] = 'r'; 2534 buf->Name[3] = 'p'; 2535 buf->Timestamp = cpu_to_le64(timewarp); 2536 return buf; 2537 } 2538 2539 /* See MS-SMB2 2.2.13.2.7 */ 2540 static int 2541 add_twarp_context(struct kvec *iov, unsigned int *num_iovec, __u64 timewarp) 2542 { 2543 unsigned int num = *num_iovec; 2544 2545 iov[num].iov_base = create_twarp_buf(timewarp); 2546 if (iov[num].iov_base == NULL) 2547 return -ENOMEM; 2548 iov[num].iov_len = sizeof(struct crt_twarp_ctxt); 2549 *num_iovec = num + 1; 2550 return 0; 2551 } 2552 2553 /* See http://technet.microsoft.com/en-us/library/hh509017(v=ws.10).aspx */ 2554 static void setup_owner_group_sids(char *buf) 2555 { 2556 struct owner_group_sids *sids = (struct owner_group_sids *)buf; 2557 2558 /* Populate the user ownership fields S-1-5-88-1 */ 2559 sids->owner.Revision = 1; 2560 sids->owner.NumAuth = 3; 2561 sids->owner.Authority[5] = 5; 2562 sids->owner.SubAuthorities[0] = cpu_to_le32(88); 2563 sids->owner.SubAuthorities[1] = cpu_to_le32(1); 2564 sids->owner.SubAuthorities[2] = cpu_to_le32(current_fsuid().val); 2565 2566 /* Populate the group ownership fields S-1-5-88-2 */ 2567 sids->group.Revision = 1; 2568 sids->group.NumAuth = 3; 2569 sids->group.Authority[5] = 5; 2570 sids->group.SubAuthorities[0] = cpu_to_le32(88); 2571 sids->group.SubAuthorities[1] = cpu_to_le32(2); 2572 sids->group.SubAuthorities[2] = cpu_to_le32(current_fsgid().val); 2573 2574 cifs_dbg(FYI, "owner S-1-5-88-1-%d, group S-1-5-88-2-%d\n", current_fsuid().val, current_fsgid().val); 2575 } 2576 2577 /* See MS-SMB2 2.2.13.2.2 and MS-DTYP 2.4.6 */ 2578 static struct crt_sd_ctxt * 2579 create_sd_buf(umode_t mode, bool set_owner, unsigned int *len) 2580 { 2581 struct crt_sd_ctxt *buf; 2582 __u8 *ptr, *aclptr; 2583 unsigned int acelen, acl_size, ace_count; 2584 unsigned int owner_offset = 0; 2585 unsigned int group_offset = 0; 2586 struct smb3_acl acl = {}; 2587 2588 *len = round_up(sizeof(struct crt_sd_ctxt) + (sizeof(struct cifs_ace) * 4), 8); 2589 2590 if (set_owner) { 2591 /* sizeof(struct owner_group_sids) is already multiple of 8 so no need to round */ 2592 *len += sizeof(struct owner_group_sids); 2593 } 2594 2595 buf = kzalloc(*len, GFP_KERNEL); 2596 if (buf == NULL) 2597 return buf; 2598 2599 ptr = (__u8 *)&buf[1]; 2600 if (set_owner) { 2601 /* offset fields are from beginning of security descriptor not of create context */ 2602 owner_offset = ptr - (__u8 *)&buf->sd; 2603 buf->sd.OffsetOwner = cpu_to_le32(owner_offset); 2604 group_offset = owner_offset + offsetof(struct owner_group_sids, group); 2605 buf->sd.OffsetGroup = cpu_to_le32(group_offset); 2606 2607 setup_owner_group_sids(ptr); 2608 ptr += sizeof(struct owner_group_sids); 2609 } else { 2610 buf->sd.OffsetOwner = 0; 2611 buf->sd.OffsetGroup = 0; 2612 } 2613 2614 buf->ccontext.DataOffset = cpu_to_le16(offsetof(struct crt_sd_ctxt, sd)); 2615 buf->ccontext.NameOffset = cpu_to_le16(offsetof(struct crt_sd_ctxt, Name)); 2616 buf->ccontext.NameLength = cpu_to_le16(4); 2617 /* SMB2_CREATE_SD_BUFFER_TOKEN is "SecD" */ 2618 buf->Name[0] = 'S'; 2619 buf->Name[1] = 'e'; 2620 buf->Name[2] = 'c'; 2621 buf->Name[3] = 'D'; 2622 buf->sd.Revision = 1; /* Must be one see MS-DTYP 2.4.6 */ 2623 2624 /* 2625 * ACL is "self relative" ie ACL is stored in contiguous block of memory 2626 * and "DP" ie the DACL is present 2627 */ 2628 buf->sd.Control = cpu_to_le16(ACL_CONTROL_SR | ACL_CONTROL_DP); 2629 2630 /* offset owner, group and Sbz1 and SACL are all zero */ 2631 buf->sd.OffsetDacl = cpu_to_le32(ptr - (__u8 *)&buf->sd); 2632 /* Ship the ACL for now. we will copy it into buf later. */ 2633 aclptr = ptr; 2634 ptr += sizeof(struct smb3_acl); 2635 2636 /* create one ACE to hold the mode embedded in reserved special SID */ 2637 acelen = setup_special_mode_ACE((struct cifs_ace *)ptr, (__u64)mode); 2638 ptr += acelen; 2639 acl_size = acelen + sizeof(struct smb3_acl); 2640 ace_count = 1; 2641 2642 if (set_owner) { 2643 /* we do not need to reallocate buffer to add the two more ACEs. plenty of space */ 2644 acelen = setup_special_user_owner_ACE((struct cifs_ace *)ptr); 2645 ptr += acelen; 2646 acl_size += acelen; 2647 ace_count += 1; 2648 } 2649 2650 /* and one more ACE to allow access for authenticated users */ 2651 acelen = setup_authusers_ACE((struct cifs_ace *)ptr); 2652 ptr += acelen; 2653 acl_size += acelen; 2654 ace_count += 1; 2655 2656 acl.AclRevision = ACL_REVISION; /* See 2.4.4.1 of MS-DTYP */ 2657 acl.AclSize = cpu_to_le16(acl_size); 2658 acl.AceCount = cpu_to_le16(ace_count); 2659 /* acl.Sbz1 and Sbz2 MBZ so are not set here, but initialized above */ 2660 memcpy(aclptr, &acl, sizeof(struct smb3_acl)); 2661 2662 buf->ccontext.DataLength = cpu_to_le32(ptr - (__u8 *)&buf->sd); 2663 *len = round_up((unsigned int)(ptr - (__u8 *)buf), 8); 2664 2665 return buf; 2666 } 2667 2668 static int 2669 add_sd_context(struct kvec *iov, unsigned int *num_iovec, umode_t mode, bool set_owner) 2670 { 2671 unsigned int num = *num_iovec; 2672 unsigned int len = 0; 2673 2674 iov[num].iov_base = create_sd_buf(mode, set_owner, &len); 2675 if (iov[num].iov_base == NULL) 2676 return -ENOMEM; 2677 iov[num].iov_len = len; 2678 *num_iovec = num + 1; 2679 return 0; 2680 } 2681 2682 static struct crt_query_id_ctxt * 2683 create_query_id_buf(void) 2684 { 2685 struct crt_query_id_ctxt *buf; 2686 2687 buf = kzalloc(sizeof(struct crt_query_id_ctxt), GFP_KERNEL); 2688 if (!buf) 2689 return NULL; 2690 2691 buf->ccontext.DataOffset = cpu_to_le16(0); 2692 buf->ccontext.DataLength = cpu_to_le32(0); 2693 buf->ccontext.NameOffset = cpu_to_le16(offsetof 2694 (struct crt_query_id_ctxt, Name)); 2695 buf->ccontext.NameLength = cpu_to_le16(4); 2696 /* SMB2_CREATE_QUERY_ON_DISK_ID is "QFid" */ 2697 buf->Name[0] = 'Q'; 2698 buf->Name[1] = 'F'; 2699 buf->Name[2] = 'i'; 2700 buf->Name[3] = 'd'; 2701 return buf; 2702 } 2703 2704 /* See MS-SMB2 2.2.13.2.9 */ 2705 static int 2706 add_query_id_context(struct kvec *iov, unsigned int *num_iovec) 2707 { 2708 unsigned int num = *num_iovec; 2709 2710 iov[num].iov_base = create_query_id_buf(); 2711 if (iov[num].iov_base == NULL) 2712 return -ENOMEM; 2713 iov[num].iov_len = sizeof(struct crt_query_id_ctxt); 2714 *num_iovec = num + 1; 2715 return 0; 2716 } 2717 2718 static int 2719 alloc_path_with_tree_prefix(__le16 **out_path, int *out_size, int *out_len, 2720 const char *treename, const __le16 *path) 2721 { 2722 int treename_len, path_len; 2723 struct nls_table *cp; 2724 const __le16 sep[] = {cpu_to_le16('\\'), cpu_to_le16(0x0000)}; 2725 2726 /* 2727 * skip leading "\\" 2728 */ 2729 treename_len = strlen(treename); 2730 if (treename_len < 2 || !(treename[0] == '\\' && treename[1] == '\\')) 2731 return -EINVAL; 2732 2733 treename += 2; 2734 treename_len -= 2; 2735 2736 path_len = UniStrnlen((wchar_t *)path, PATH_MAX); 2737 2738 /* make room for one path separator only if @path isn't empty */ 2739 *out_len = treename_len + (path[0] ? 1 : 0) + path_len; 2740 2741 /* 2742 * final path needs to be 8-byte aligned as specified in 2743 * MS-SMB2 2.2.13 SMB2 CREATE Request. 2744 */ 2745 *out_size = round_up(*out_len * sizeof(__le16), 8); 2746 *out_path = kzalloc(*out_size + sizeof(__le16) /* null */, GFP_KERNEL); 2747 if (!*out_path) 2748 return -ENOMEM; 2749 2750 cp = load_nls_default(); 2751 cifs_strtoUTF16(*out_path, treename, treename_len, cp); 2752 2753 /* Do not append the separator if the path is empty */ 2754 if (path[0] != cpu_to_le16(0x0000)) { 2755 UniStrcat((wchar_t *)*out_path, (wchar_t *)sep); 2756 UniStrcat((wchar_t *)*out_path, (wchar_t *)path); 2757 } 2758 2759 unload_nls(cp); 2760 2761 return 0; 2762 } 2763 2764 int smb311_posix_mkdir(const unsigned int xid, struct inode *inode, 2765 umode_t mode, struct cifs_tcon *tcon, 2766 const char *full_path, 2767 struct cifs_sb_info *cifs_sb) 2768 { 2769 struct smb_rqst rqst; 2770 struct smb2_create_req *req; 2771 struct smb2_create_rsp *rsp = NULL; 2772 struct cifs_ses *ses = tcon->ses; 2773 struct kvec iov[3]; /* make sure at least one for each open context */ 2774 struct kvec rsp_iov = {NULL, 0}; 2775 int resp_buftype; 2776 int uni_path_len; 2777 __le16 *copy_path = NULL; 2778 int copy_size; 2779 int rc = 0; 2780 unsigned int n_iov = 2; 2781 __u32 file_attributes = 0; 2782 char *pc_buf = NULL; 2783 int flags = 0; 2784 unsigned int total_len; 2785 __le16 *utf16_path = NULL; 2786 struct TCP_Server_Info *server; 2787 int retries = 0, cur_sleep = 1; 2788 2789 replay_again: 2790 /* reinitialize for possible replay */ 2791 flags = 0; 2792 n_iov = 2; 2793 server = cifs_pick_channel(ses); 2794 2795 cifs_dbg(FYI, "mkdir\n"); 2796 2797 /* resource #1: path allocation */ 2798 utf16_path = cifs_convert_path_to_utf16(full_path, cifs_sb); 2799 if (!utf16_path) 2800 return -ENOMEM; 2801 2802 if (!ses || !server) { 2803 rc = -EIO; 2804 goto err_free_path; 2805 } 2806 2807 /* resource #2: request */ 2808 rc = smb2_plain_req_init(SMB2_CREATE, tcon, server, 2809 (void **) &req, &total_len); 2810 if (rc) 2811 goto err_free_path; 2812 2813 2814 if (smb3_encryption_required(tcon)) 2815 flags |= CIFS_TRANSFORM_REQ; 2816 2817 req->ImpersonationLevel = IL_IMPERSONATION; 2818 req->DesiredAccess = cpu_to_le32(FILE_WRITE_ATTRIBUTES); 2819 /* File attributes ignored on open (used in create though) */ 2820 req->FileAttributes = cpu_to_le32(file_attributes); 2821 req->ShareAccess = FILE_SHARE_ALL_LE; 2822 req->CreateDisposition = cpu_to_le32(FILE_CREATE); 2823 req->CreateOptions = cpu_to_le32(CREATE_NOT_FILE); 2824 2825 iov[0].iov_base = (char *)req; 2826 /* -1 since last byte is buf[0] which is sent below (path) */ 2827 iov[0].iov_len = total_len - 1; 2828 2829 req->NameOffset = cpu_to_le16(sizeof(struct smb2_create_req)); 2830 2831 /* [MS-SMB2] 2.2.13 NameOffset: 2832 * If SMB2_FLAGS_DFS_OPERATIONS is set in the Flags field of 2833 * the SMB2 header, the file name includes a prefix that will 2834 * be processed during DFS name normalization as specified in 2835 * section 3.3.5.9. Otherwise, the file name is relative to 2836 * the share that is identified by the TreeId in the SMB2 2837 * header. 2838 */ 2839 if (tcon->share_flags & SHI1005_FLAGS_DFS) { 2840 int name_len; 2841 2842 req->hdr.Flags |= SMB2_FLAGS_DFS_OPERATIONS; 2843 rc = alloc_path_with_tree_prefix(©_path, ©_size, 2844 &name_len, 2845 tcon->tree_name, utf16_path); 2846 if (rc) 2847 goto err_free_req; 2848 2849 req->NameLength = cpu_to_le16(name_len * 2); 2850 uni_path_len = copy_size; 2851 /* free before overwriting resource */ 2852 kfree(utf16_path); 2853 utf16_path = copy_path; 2854 } else { 2855 uni_path_len = (2 * UniStrnlen((wchar_t *)utf16_path, PATH_MAX)) + 2; 2856 /* MUST set path len (NameLength) to 0 opening root of share */ 2857 req->NameLength = cpu_to_le16(uni_path_len - 2); 2858 if (uni_path_len % 8 != 0) { 2859 copy_size = roundup(uni_path_len, 8); 2860 copy_path = kzalloc(copy_size, GFP_KERNEL); 2861 if (!copy_path) { 2862 rc = -ENOMEM; 2863 goto err_free_req; 2864 } 2865 memcpy((char *)copy_path, (const char *)utf16_path, 2866 uni_path_len); 2867 uni_path_len = copy_size; 2868 /* free before overwriting resource */ 2869 kfree(utf16_path); 2870 utf16_path = copy_path; 2871 } 2872 } 2873 2874 iov[1].iov_len = uni_path_len; 2875 iov[1].iov_base = utf16_path; 2876 req->RequestedOplockLevel = SMB2_OPLOCK_LEVEL_NONE; 2877 2878 if (tcon->posix_extensions) { 2879 /* resource #3: posix buf */ 2880 rc = add_posix_context(iov, &n_iov, mode); 2881 if (rc) 2882 goto err_free_req; 2883 req->CreateContextsOffset = cpu_to_le32( 2884 sizeof(struct smb2_create_req) + 2885 iov[1].iov_len); 2886 pc_buf = iov[n_iov-1].iov_base; 2887 } 2888 2889 2890 memset(&rqst, 0, sizeof(struct smb_rqst)); 2891 rqst.rq_iov = iov; 2892 rqst.rq_nvec = n_iov; 2893 2894 /* no need to inc num_remote_opens because we close it just below */ 2895 trace_smb3_posix_mkdir_enter(xid, tcon->tid, ses->Suid, full_path, CREATE_NOT_FILE, 2896 FILE_WRITE_ATTRIBUTES); 2897 2898 if (retries) 2899 smb2_set_replay(server, &rqst); 2900 2901 /* resource #4: response buffer */ 2902 rc = cifs_send_recv(xid, ses, server, 2903 &rqst, &resp_buftype, flags, &rsp_iov); 2904 if (rc) { 2905 cifs_stats_fail_inc(tcon, SMB2_CREATE_HE); 2906 trace_smb3_posix_mkdir_err(xid, tcon->tid, ses->Suid, 2907 CREATE_NOT_FILE, 2908 FILE_WRITE_ATTRIBUTES, rc); 2909 goto err_free_rsp_buf; 2910 } 2911 2912 /* 2913 * Although unlikely to be possible for rsp to be null and rc not set, 2914 * adding check below is slightly safer long term (and quiets Coverity 2915 * warning) 2916 */ 2917 rsp = (struct smb2_create_rsp *)rsp_iov.iov_base; 2918 if (rsp == NULL) { 2919 rc = -EIO; 2920 kfree(pc_buf); 2921 goto err_free_req; 2922 } 2923 2924 trace_smb3_posix_mkdir_done(xid, rsp->PersistentFileId, tcon->tid, ses->Suid, 2925 CREATE_NOT_FILE, FILE_WRITE_ATTRIBUTES); 2926 2927 SMB2_close(xid, tcon, rsp->PersistentFileId, rsp->VolatileFileId); 2928 2929 /* Eventually save off posix specific response info and timestaps */ 2930 2931 err_free_rsp_buf: 2932 free_rsp_buf(resp_buftype, rsp); 2933 kfree(pc_buf); 2934 err_free_req: 2935 cifs_small_buf_release(req); 2936 err_free_path: 2937 kfree(utf16_path); 2938 2939 if (is_replayable_error(rc) && 2940 smb2_should_replay(tcon, &retries, &cur_sleep)) 2941 goto replay_again; 2942 2943 return rc; 2944 } 2945 2946 int 2947 SMB2_open_init(struct cifs_tcon *tcon, struct TCP_Server_Info *server, 2948 struct smb_rqst *rqst, __u8 *oplock, 2949 struct cifs_open_parms *oparms, __le16 *path) 2950 { 2951 struct smb2_create_req *req; 2952 unsigned int n_iov = 2; 2953 __u32 file_attributes = 0; 2954 int copy_size; 2955 int uni_path_len; 2956 unsigned int total_len; 2957 struct kvec *iov = rqst->rq_iov; 2958 __le16 *copy_path; 2959 int rc; 2960 2961 rc = smb2_plain_req_init(SMB2_CREATE, tcon, server, 2962 (void **) &req, &total_len); 2963 if (rc) 2964 return rc; 2965 2966 iov[0].iov_base = (char *)req; 2967 /* -1 since last byte is buf[0] which is sent below (path) */ 2968 iov[0].iov_len = total_len - 1; 2969 2970 if (oparms->create_options & CREATE_OPTION_READONLY) 2971 file_attributes |= ATTR_READONLY; 2972 if (oparms->create_options & CREATE_OPTION_SPECIAL) 2973 file_attributes |= ATTR_SYSTEM; 2974 2975 req->ImpersonationLevel = IL_IMPERSONATION; 2976 req->DesiredAccess = cpu_to_le32(oparms->desired_access); 2977 /* File attributes ignored on open (used in create though) */ 2978 req->FileAttributes = cpu_to_le32(file_attributes); 2979 req->ShareAccess = FILE_SHARE_ALL_LE; 2980 2981 req->CreateDisposition = cpu_to_le32(oparms->disposition); 2982 req->CreateOptions = cpu_to_le32(oparms->create_options & CREATE_OPTIONS_MASK); 2983 req->NameOffset = cpu_to_le16(sizeof(struct smb2_create_req)); 2984 2985 /* [MS-SMB2] 2.2.13 NameOffset: 2986 * If SMB2_FLAGS_DFS_OPERATIONS is set in the Flags field of 2987 * the SMB2 header, the file name includes a prefix that will 2988 * be processed during DFS name normalization as specified in 2989 * section 3.3.5.9. Otherwise, the file name is relative to 2990 * the share that is identified by the TreeId in the SMB2 2991 * header. 2992 */ 2993 if (tcon->share_flags & SHI1005_FLAGS_DFS) { 2994 int name_len; 2995 2996 req->hdr.Flags |= SMB2_FLAGS_DFS_OPERATIONS; 2997 rc = alloc_path_with_tree_prefix(©_path, ©_size, 2998 &name_len, 2999 tcon->tree_name, path); 3000 if (rc) 3001 return rc; 3002 req->NameLength = cpu_to_le16(name_len * 2); 3003 uni_path_len = copy_size; 3004 path = copy_path; 3005 } else { 3006 uni_path_len = (2 * UniStrnlen((wchar_t *)path, PATH_MAX)) + 2; 3007 /* MUST set path len (NameLength) to 0 opening root of share */ 3008 req->NameLength = cpu_to_le16(uni_path_len - 2); 3009 copy_size = round_up(uni_path_len, 8); 3010 copy_path = kzalloc(copy_size, GFP_KERNEL); 3011 if (!copy_path) 3012 return -ENOMEM; 3013 memcpy((char *)copy_path, (const char *)path, 3014 uni_path_len); 3015 uni_path_len = copy_size; 3016 path = copy_path; 3017 } 3018 3019 iov[1].iov_len = uni_path_len; 3020 iov[1].iov_base = path; 3021 3022 if ((!server->oplocks) || (tcon->no_lease)) 3023 *oplock = SMB2_OPLOCK_LEVEL_NONE; 3024 3025 if (!(server->capabilities & SMB2_GLOBAL_CAP_LEASING) || 3026 *oplock == SMB2_OPLOCK_LEVEL_NONE) 3027 req->RequestedOplockLevel = *oplock; 3028 else if (!(server->capabilities & SMB2_GLOBAL_CAP_DIRECTORY_LEASING) && 3029 (oparms->create_options & CREATE_NOT_FILE)) 3030 req->RequestedOplockLevel = *oplock; /* no srv lease support */ 3031 else { 3032 rc = add_lease_context(server, req, iov, &n_iov, 3033 oparms->fid->lease_key, oplock); 3034 if (rc) 3035 return rc; 3036 } 3037 3038 if (*oplock == SMB2_OPLOCK_LEVEL_BATCH) { 3039 rc = add_durable_context(iov, &n_iov, oparms, 3040 tcon->use_persistent); 3041 if (rc) 3042 return rc; 3043 } 3044 3045 if (tcon->posix_extensions) { 3046 rc = add_posix_context(iov, &n_iov, oparms->mode); 3047 if (rc) 3048 return rc; 3049 } 3050 3051 if (tcon->snapshot_time) { 3052 cifs_dbg(FYI, "adding snapshot context\n"); 3053 rc = add_twarp_context(iov, &n_iov, tcon->snapshot_time); 3054 if (rc) 3055 return rc; 3056 } 3057 3058 if ((oparms->disposition != FILE_OPEN) && (oparms->cifs_sb)) { 3059 bool set_mode; 3060 bool set_owner; 3061 3062 if ((oparms->cifs_sb->mnt_cifs_flags & CIFS_MOUNT_MODE_FROM_SID) && 3063 (oparms->mode != ACL_NO_MODE)) 3064 set_mode = true; 3065 else { 3066 set_mode = false; 3067 oparms->mode = ACL_NO_MODE; 3068 } 3069 3070 if (oparms->cifs_sb->mnt_cifs_flags & CIFS_MOUNT_UID_FROM_ACL) 3071 set_owner = true; 3072 else 3073 set_owner = false; 3074 3075 if (set_owner | set_mode) { 3076 cifs_dbg(FYI, "add sd with mode 0x%x\n", oparms->mode); 3077 rc = add_sd_context(iov, &n_iov, oparms->mode, set_owner); 3078 if (rc) 3079 return rc; 3080 } 3081 } 3082 3083 add_query_id_context(iov, &n_iov); 3084 3085 if (n_iov > 2) { 3086 /* 3087 * We have create contexts behind iov[1] (the file 3088 * name), point at them from the main create request 3089 */ 3090 req->CreateContextsOffset = cpu_to_le32( 3091 sizeof(struct smb2_create_req) + 3092 iov[1].iov_len); 3093 req->CreateContextsLength = 0; 3094 3095 for (unsigned int i = 2; i < (n_iov-1); i++) { 3096 struct kvec *v = &iov[i]; 3097 size_t len = v->iov_len; 3098 struct create_context *cctx = 3099 (struct create_context *)v->iov_base; 3100 3101 cctx->Next = cpu_to_le32(len); 3102 le32_add_cpu(&req->CreateContextsLength, len); 3103 } 3104 le32_add_cpu(&req->CreateContextsLength, 3105 iov[n_iov-1].iov_len); 3106 } 3107 3108 rqst->rq_nvec = n_iov; 3109 return 0; 3110 } 3111 3112 /* rq_iov[0] is the request and is released by cifs_small_buf_release(). 3113 * All other vectors are freed by kfree(). 3114 */ 3115 void 3116 SMB2_open_free(struct smb_rqst *rqst) 3117 { 3118 int i; 3119 3120 if (rqst && rqst->rq_iov) { 3121 cifs_small_buf_release(rqst->rq_iov[0].iov_base); 3122 for (i = 1; i < rqst->rq_nvec; i++) 3123 if (rqst->rq_iov[i].iov_base != smb2_padding) 3124 kfree(rqst->rq_iov[i].iov_base); 3125 } 3126 } 3127 3128 int 3129 SMB2_open(const unsigned int xid, struct cifs_open_parms *oparms, __le16 *path, 3130 __u8 *oplock, struct smb2_file_all_info *buf, 3131 struct create_posix_rsp *posix, 3132 struct kvec *err_iov, int *buftype) 3133 { 3134 struct smb_rqst rqst; 3135 struct smb2_create_rsp *rsp = NULL; 3136 struct cifs_tcon *tcon = oparms->tcon; 3137 struct cifs_ses *ses = tcon->ses; 3138 struct TCP_Server_Info *server; 3139 struct kvec iov[SMB2_CREATE_IOV_SIZE]; 3140 struct kvec rsp_iov = {NULL, 0}; 3141 int resp_buftype = CIFS_NO_BUFFER; 3142 int rc = 0; 3143 int flags = 0; 3144 int retries = 0, cur_sleep = 1; 3145 3146 replay_again: 3147 /* reinitialize for possible replay */ 3148 flags = 0; 3149 server = cifs_pick_channel(ses); 3150 oparms->replay = !!(retries); 3151 3152 cifs_dbg(FYI, "create/open\n"); 3153 if (!ses || !server) 3154 return -EIO; 3155 3156 if (smb3_encryption_required(tcon)) 3157 flags |= CIFS_TRANSFORM_REQ; 3158 3159 memset(&rqst, 0, sizeof(struct smb_rqst)); 3160 memset(&iov, 0, sizeof(iov)); 3161 rqst.rq_iov = iov; 3162 rqst.rq_nvec = SMB2_CREATE_IOV_SIZE; 3163 3164 rc = SMB2_open_init(tcon, server, 3165 &rqst, oplock, oparms, path); 3166 if (rc) 3167 goto creat_exit; 3168 3169 trace_smb3_open_enter(xid, tcon->tid, tcon->ses->Suid, oparms->path, 3170 oparms->create_options, oparms->desired_access); 3171 3172 if (retries) 3173 smb2_set_replay(server, &rqst); 3174 3175 rc = cifs_send_recv(xid, ses, server, 3176 &rqst, &resp_buftype, flags, 3177 &rsp_iov); 3178 rsp = (struct smb2_create_rsp *)rsp_iov.iov_base; 3179 3180 if (rc != 0) { 3181 cifs_stats_fail_inc(tcon, SMB2_CREATE_HE); 3182 if (err_iov && rsp) { 3183 *err_iov = rsp_iov; 3184 *buftype = resp_buftype; 3185 resp_buftype = CIFS_NO_BUFFER; 3186 rsp = NULL; 3187 } 3188 trace_smb3_open_err(xid, tcon->tid, ses->Suid, 3189 oparms->create_options, oparms->desired_access, rc); 3190 if (rc == -EREMCHG) { 3191 pr_warn_once("server share %s deleted\n", 3192 tcon->tree_name); 3193 tcon->need_reconnect = true; 3194 } 3195 goto creat_exit; 3196 } else if (rsp == NULL) /* unlikely to happen, but safer to check */ 3197 goto creat_exit; 3198 else 3199 trace_smb3_open_done(xid, rsp->PersistentFileId, tcon->tid, ses->Suid, 3200 oparms->create_options, oparms->desired_access); 3201 3202 atomic_inc(&tcon->num_remote_opens); 3203 oparms->fid->persistent_fid = rsp->PersistentFileId; 3204 oparms->fid->volatile_fid = rsp->VolatileFileId; 3205 oparms->fid->access = oparms->desired_access; 3206 #ifdef CONFIG_CIFS_DEBUG2 3207 oparms->fid->mid = le64_to_cpu(rsp->hdr.MessageId); 3208 #endif /* CIFS_DEBUG2 */ 3209 3210 if (buf) { 3211 buf->CreationTime = rsp->CreationTime; 3212 buf->LastAccessTime = rsp->LastAccessTime; 3213 buf->LastWriteTime = rsp->LastWriteTime; 3214 buf->ChangeTime = rsp->ChangeTime; 3215 buf->AllocationSize = rsp->AllocationSize; 3216 buf->EndOfFile = rsp->EndofFile; 3217 buf->Attributes = rsp->FileAttributes; 3218 buf->NumberOfLinks = cpu_to_le32(1); 3219 buf->DeletePending = 0; 3220 } 3221 3222 3223 rc = smb2_parse_contexts(server, &rsp_iov, &oparms->fid->epoch, 3224 oparms->fid->lease_key, oplock, buf, posix); 3225 creat_exit: 3226 SMB2_open_free(&rqst); 3227 free_rsp_buf(resp_buftype, rsp); 3228 3229 if (is_replayable_error(rc) && 3230 smb2_should_replay(tcon, &retries, &cur_sleep)) 3231 goto replay_again; 3232 3233 return rc; 3234 } 3235 3236 int 3237 SMB2_ioctl_init(struct cifs_tcon *tcon, struct TCP_Server_Info *server, 3238 struct smb_rqst *rqst, 3239 u64 persistent_fid, u64 volatile_fid, u32 opcode, 3240 char *in_data, u32 indatalen, 3241 __u32 max_response_size) 3242 { 3243 struct smb2_ioctl_req *req; 3244 struct kvec *iov = rqst->rq_iov; 3245 unsigned int total_len; 3246 int rc; 3247 char *in_data_buf; 3248 3249 rc = smb2_ioctl_req_init(opcode, tcon, server, 3250 (void **) &req, &total_len); 3251 if (rc) 3252 return rc; 3253 3254 if (indatalen) { 3255 /* 3256 * indatalen is usually small at a couple of bytes max, so 3257 * just allocate through generic pool 3258 */ 3259 in_data_buf = kmemdup(in_data, indatalen, GFP_NOFS); 3260 if (!in_data_buf) { 3261 cifs_small_buf_release(req); 3262 return -ENOMEM; 3263 } 3264 } 3265 3266 req->CtlCode = cpu_to_le32(opcode); 3267 req->PersistentFileId = persistent_fid; 3268 req->VolatileFileId = volatile_fid; 3269 3270 iov[0].iov_base = (char *)req; 3271 /* 3272 * If no input data, the size of ioctl struct in 3273 * protocol spec still includes a 1 byte data buffer, 3274 * but if input data passed to ioctl, we do not 3275 * want to double count this, so we do not send 3276 * the dummy one byte of data in iovec[0] if sending 3277 * input data (in iovec[1]). 3278 */ 3279 if (indatalen) { 3280 req->InputCount = cpu_to_le32(indatalen); 3281 /* do not set InputOffset if no input data */ 3282 req->InputOffset = 3283 cpu_to_le32(offsetof(struct smb2_ioctl_req, Buffer)); 3284 rqst->rq_nvec = 2; 3285 iov[0].iov_len = total_len - 1; 3286 iov[1].iov_base = in_data_buf; 3287 iov[1].iov_len = indatalen; 3288 } else { 3289 rqst->rq_nvec = 1; 3290 iov[0].iov_len = total_len; 3291 } 3292 3293 req->OutputOffset = 0; 3294 req->OutputCount = 0; /* MBZ */ 3295 3296 /* 3297 * In most cases max_response_size is set to 16K (CIFSMaxBufSize) 3298 * We Could increase default MaxOutputResponse, but that could require 3299 * more credits. Windows typically sets this smaller, but for some 3300 * ioctls it may be useful to allow server to send more. No point 3301 * limiting what the server can send as long as fits in one credit 3302 * We can not handle more than CIFS_MAX_BUF_SIZE yet but may want 3303 * to increase this limit up in the future. 3304 * Note that for snapshot queries that servers like Azure expect that 3305 * the first query be minimal size (and just used to get the number/size 3306 * of previous versions) so response size must be specified as EXACTLY 3307 * sizeof(struct snapshot_array) which is 16 when rounded up to multiple 3308 * of eight bytes. Currently that is the only case where we set max 3309 * response size smaller. 3310 */ 3311 req->MaxOutputResponse = cpu_to_le32(max_response_size); 3312 req->hdr.CreditCharge = 3313 cpu_to_le16(DIV_ROUND_UP(max(indatalen, max_response_size), 3314 SMB2_MAX_BUFFER_SIZE)); 3315 /* always an FSCTL (for now) */ 3316 req->Flags = cpu_to_le32(SMB2_0_IOCTL_IS_FSCTL); 3317 3318 /* validate negotiate request must be signed - see MS-SMB2 3.2.5.5 */ 3319 if (opcode == FSCTL_VALIDATE_NEGOTIATE_INFO) 3320 req->hdr.Flags |= SMB2_FLAGS_SIGNED; 3321 3322 return 0; 3323 } 3324 3325 void 3326 SMB2_ioctl_free(struct smb_rqst *rqst) 3327 { 3328 int i; 3329 3330 if (rqst && rqst->rq_iov) { 3331 cifs_small_buf_release(rqst->rq_iov[0].iov_base); /* request */ 3332 for (i = 1; i < rqst->rq_nvec; i++) 3333 if (rqst->rq_iov[i].iov_base != smb2_padding) 3334 kfree(rqst->rq_iov[i].iov_base); 3335 } 3336 } 3337 3338 3339 /* 3340 * SMB2 IOCTL is used for both IOCTLs and FSCTLs 3341 */ 3342 int 3343 SMB2_ioctl(const unsigned int xid, struct cifs_tcon *tcon, u64 persistent_fid, 3344 u64 volatile_fid, u32 opcode, char *in_data, u32 indatalen, 3345 u32 max_out_data_len, char **out_data, 3346 u32 *plen /* returned data len */) 3347 { 3348 struct smb_rqst rqst; 3349 struct smb2_ioctl_rsp *rsp = NULL; 3350 struct cifs_ses *ses; 3351 struct TCP_Server_Info *server; 3352 struct kvec iov[SMB2_IOCTL_IOV_SIZE]; 3353 struct kvec rsp_iov = {NULL, 0}; 3354 int resp_buftype = CIFS_NO_BUFFER; 3355 int rc = 0; 3356 int flags = 0; 3357 int retries = 0, cur_sleep = 1; 3358 3359 if (!tcon) 3360 return -EIO; 3361 3362 ses = tcon->ses; 3363 if (!ses) 3364 return -EIO; 3365 3366 replay_again: 3367 /* reinitialize for possible replay */ 3368 flags = 0; 3369 server = cifs_pick_channel(ses); 3370 3371 if (!server) 3372 return -EIO; 3373 3374 cifs_dbg(FYI, "SMB2 IOCTL\n"); 3375 3376 if (out_data != NULL) 3377 *out_data = NULL; 3378 3379 /* zero out returned data len, in case of error */ 3380 if (plen) 3381 *plen = 0; 3382 3383 if (smb3_encryption_required(tcon)) 3384 flags |= CIFS_TRANSFORM_REQ; 3385 3386 memset(&rqst, 0, sizeof(struct smb_rqst)); 3387 memset(&iov, 0, sizeof(iov)); 3388 rqst.rq_iov = iov; 3389 rqst.rq_nvec = SMB2_IOCTL_IOV_SIZE; 3390 3391 rc = SMB2_ioctl_init(tcon, server, 3392 &rqst, persistent_fid, volatile_fid, opcode, 3393 in_data, indatalen, max_out_data_len); 3394 if (rc) 3395 goto ioctl_exit; 3396 3397 if (retries) 3398 smb2_set_replay(server, &rqst); 3399 3400 rc = cifs_send_recv(xid, ses, server, 3401 &rqst, &resp_buftype, flags, 3402 &rsp_iov); 3403 rsp = (struct smb2_ioctl_rsp *)rsp_iov.iov_base; 3404 3405 if (rc != 0) 3406 trace_smb3_fsctl_err(xid, persistent_fid, tcon->tid, 3407 ses->Suid, 0, opcode, rc); 3408 3409 if ((rc != 0) && (rc != -EINVAL) && (rc != -E2BIG)) { 3410 cifs_stats_fail_inc(tcon, SMB2_IOCTL_HE); 3411 goto ioctl_exit; 3412 } else if (rc == -EINVAL) { 3413 if ((opcode != FSCTL_SRV_COPYCHUNK_WRITE) && 3414 (opcode != FSCTL_SRV_COPYCHUNK)) { 3415 cifs_stats_fail_inc(tcon, SMB2_IOCTL_HE); 3416 goto ioctl_exit; 3417 } 3418 } else if (rc == -E2BIG) { 3419 if (opcode != FSCTL_QUERY_ALLOCATED_RANGES) { 3420 cifs_stats_fail_inc(tcon, SMB2_IOCTL_HE); 3421 goto ioctl_exit; 3422 } 3423 } 3424 3425 /* check if caller wants to look at return data or just return rc */ 3426 if ((plen == NULL) || (out_data == NULL)) 3427 goto ioctl_exit; 3428 3429 /* 3430 * Although unlikely to be possible for rsp to be null and rc not set, 3431 * adding check below is slightly safer long term (and quiets Coverity 3432 * warning) 3433 */ 3434 if (rsp == NULL) { 3435 rc = -EIO; 3436 goto ioctl_exit; 3437 } 3438 3439 *plen = le32_to_cpu(rsp->OutputCount); 3440 3441 /* We check for obvious errors in the output buffer length and offset */ 3442 if (*plen == 0) 3443 goto ioctl_exit; /* server returned no data */ 3444 else if (*plen > rsp_iov.iov_len || *plen > 0xFF00) { 3445 cifs_tcon_dbg(VFS, "srv returned invalid ioctl length: %d\n", *plen); 3446 *plen = 0; 3447 rc = -EIO; 3448 goto ioctl_exit; 3449 } 3450 3451 if (rsp_iov.iov_len - *plen < le32_to_cpu(rsp->OutputOffset)) { 3452 cifs_tcon_dbg(VFS, "Malformed ioctl resp: len %d offset %d\n", *plen, 3453 le32_to_cpu(rsp->OutputOffset)); 3454 *plen = 0; 3455 rc = -EIO; 3456 goto ioctl_exit; 3457 } 3458 3459 *out_data = kmemdup((char *)rsp + le32_to_cpu(rsp->OutputOffset), 3460 *plen, GFP_KERNEL); 3461 if (*out_data == NULL) { 3462 rc = -ENOMEM; 3463 goto ioctl_exit; 3464 } 3465 3466 ioctl_exit: 3467 SMB2_ioctl_free(&rqst); 3468 free_rsp_buf(resp_buftype, rsp); 3469 3470 if (is_replayable_error(rc) && 3471 smb2_should_replay(tcon, &retries, &cur_sleep)) 3472 goto replay_again; 3473 3474 return rc; 3475 } 3476 3477 /* 3478 * Individual callers to ioctl worker function follow 3479 */ 3480 3481 int 3482 SMB2_set_compression(const unsigned int xid, struct cifs_tcon *tcon, 3483 u64 persistent_fid, u64 volatile_fid) 3484 { 3485 int rc; 3486 struct compress_ioctl fsctl_input; 3487 char *ret_data = NULL; 3488 3489 fsctl_input.CompressionState = 3490 cpu_to_le16(COMPRESSION_FORMAT_DEFAULT); 3491 3492 rc = SMB2_ioctl(xid, tcon, persistent_fid, volatile_fid, 3493 FSCTL_SET_COMPRESSION, 3494 (char *)&fsctl_input /* data input */, 3495 2 /* in data len */, CIFSMaxBufSize /* max out data */, 3496 &ret_data /* out data */, NULL); 3497 3498 cifs_dbg(FYI, "set compression rc %d\n", rc); 3499 3500 return rc; 3501 } 3502 3503 int 3504 SMB2_close_init(struct cifs_tcon *tcon, struct TCP_Server_Info *server, 3505 struct smb_rqst *rqst, 3506 u64 persistent_fid, u64 volatile_fid, bool query_attrs) 3507 { 3508 struct smb2_close_req *req; 3509 struct kvec *iov = rqst->rq_iov; 3510 unsigned int total_len; 3511 int rc; 3512 3513 rc = smb2_plain_req_init(SMB2_CLOSE, tcon, server, 3514 (void **) &req, &total_len); 3515 if (rc) 3516 return rc; 3517 3518 req->PersistentFileId = persistent_fid; 3519 req->VolatileFileId = volatile_fid; 3520 if (query_attrs) 3521 req->Flags = SMB2_CLOSE_FLAG_POSTQUERY_ATTRIB; 3522 else 3523 req->Flags = 0; 3524 iov[0].iov_base = (char *)req; 3525 iov[0].iov_len = total_len; 3526 3527 return 0; 3528 } 3529 3530 void 3531 SMB2_close_free(struct smb_rqst *rqst) 3532 { 3533 if (rqst && rqst->rq_iov) 3534 cifs_small_buf_release(rqst->rq_iov[0].iov_base); /* request */ 3535 } 3536 3537 int 3538 __SMB2_close(const unsigned int xid, struct cifs_tcon *tcon, 3539 u64 persistent_fid, u64 volatile_fid, 3540 struct smb2_file_network_open_info *pbuf) 3541 { 3542 struct smb_rqst rqst; 3543 struct smb2_close_rsp *rsp = NULL; 3544 struct cifs_ses *ses = tcon->ses; 3545 struct TCP_Server_Info *server; 3546 struct kvec iov[1]; 3547 struct kvec rsp_iov; 3548 int resp_buftype = CIFS_NO_BUFFER; 3549 int rc = 0; 3550 int flags = 0; 3551 bool query_attrs = false; 3552 int retries = 0, cur_sleep = 1; 3553 3554 replay_again: 3555 /* reinitialize for possible replay */ 3556 flags = 0; 3557 query_attrs = false; 3558 server = cifs_pick_channel(ses); 3559 3560 cifs_dbg(FYI, "Close\n"); 3561 3562 if (!ses || !server) 3563 return -EIO; 3564 3565 if (smb3_encryption_required(tcon)) 3566 flags |= CIFS_TRANSFORM_REQ; 3567 3568 memset(&rqst, 0, sizeof(struct smb_rqst)); 3569 memset(&iov, 0, sizeof(iov)); 3570 rqst.rq_iov = iov; 3571 rqst.rq_nvec = 1; 3572 3573 /* check if need to ask server to return timestamps in close response */ 3574 if (pbuf) 3575 query_attrs = true; 3576 3577 trace_smb3_close_enter(xid, persistent_fid, tcon->tid, ses->Suid); 3578 rc = SMB2_close_init(tcon, server, 3579 &rqst, persistent_fid, volatile_fid, 3580 query_attrs); 3581 if (rc) 3582 goto close_exit; 3583 3584 if (retries) 3585 smb2_set_replay(server, &rqst); 3586 3587 rc = cifs_send_recv(xid, ses, server, 3588 &rqst, &resp_buftype, flags, &rsp_iov); 3589 rsp = (struct smb2_close_rsp *)rsp_iov.iov_base; 3590 3591 if (rc != 0) { 3592 cifs_stats_fail_inc(tcon, SMB2_CLOSE_HE); 3593 trace_smb3_close_err(xid, persistent_fid, tcon->tid, ses->Suid, 3594 rc); 3595 goto close_exit; 3596 } else { 3597 trace_smb3_close_done(xid, persistent_fid, tcon->tid, 3598 ses->Suid); 3599 if (pbuf) 3600 memcpy(&pbuf->network_open_info, 3601 &rsp->network_open_info, 3602 sizeof(pbuf->network_open_info)); 3603 } 3604 3605 atomic_dec(&tcon->num_remote_opens); 3606 close_exit: 3607 SMB2_close_free(&rqst); 3608 free_rsp_buf(resp_buftype, rsp); 3609 3610 /* retry close in a worker thread if this one is interrupted */ 3611 if (is_interrupt_error(rc)) { 3612 int tmp_rc; 3613 3614 tmp_rc = smb2_handle_cancelled_close(tcon, persistent_fid, 3615 volatile_fid); 3616 if (tmp_rc) 3617 cifs_dbg(VFS, "handle cancelled close fid 0x%llx returned error %d\n", 3618 persistent_fid, tmp_rc); 3619 } 3620 3621 if (is_replayable_error(rc) && 3622 smb2_should_replay(tcon, &retries, &cur_sleep)) 3623 goto replay_again; 3624 3625 return rc; 3626 } 3627 3628 int 3629 SMB2_close(const unsigned int xid, struct cifs_tcon *tcon, 3630 u64 persistent_fid, u64 volatile_fid) 3631 { 3632 return __SMB2_close(xid, tcon, persistent_fid, volatile_fid, NULL); 3633 } 3634 3635 int 3636 smb2_validate_iov(unsigned int offset, unsigned int buffer_length, 3637 struct kvec *iov, unsigned int min_buf_size) 3638 { 3639 unsigned int smb_len = iov->iov_len; 3640 char *end_of_smb = smb_len + (char *)iov->iov_base; 3641 char *begin_of_buf = offset + (char *)iov->iov_base; 3642 char *end_of_buf = begin_of_buf + buffer_length; 3643 3644 3645 if (buffer_length < min_buf_size) { 3646 cifs_dbg(VFS, "buffer length %d smaller than minimum size %d\n", 3647 buffer_length, min_buf_size); 3648 return -EINVAL; 3649 } 3650 3651 /* check if beyond RFC1001 maximum length */ 3652 if ((smb_len > 0x7FFFFF) || (buffer_length > 0x7FFFFF)) { 3653 cifs_dbg(VFS, "buffer length %d or smb length %d too large\n", 3654 buffer_length, smb_len); 3655 return -EINVAL; 3656 } 3657 3658 if ((begin_of_buf > end_of_smb) || (end_of_buf > end_of_smb)) { 3659 cifs_dbg(VFS, "Invalid server response, bad offset to data\n"); 3660 return -EINVAL; 3661 } 3662 3663 return 0; 3664 } 3665 3666 /* 3667 * If SMB buffer fields are valid, copy into temporary buffer to hold result. 3668 * Caller must free buffer. 3669 */ 3670 int 3671 smb2_validate_and_copy_iov(unsigned int offset, unsigned int buffer_length, 3672 struct kvec *iov, unsigned int minbufsize, 3673 char *data) 3674 { 3675 char *begin_of_buf = offset + (char *)iov->iov_base; 3676 int rc; 3677 3678 if (!data) 3679 return -EINVAL; 3680 3681 rc = smb2_validate_iov(offset, buffer_length, iov, minbufsize); 3682 if (rc) 3683 return rc; 3684 3685 memcpy(data, begin_of_buf, minbufsize); 3686 3687 return 0; 3688 } 3689 3690 int 3691 SMB2_query_info_init(struct cifs_tcon *tcon, struct TCP_Server_Info *server, 3692 struct smb_rqst *rqst, 3693 u64 persistent_fid, u64 volatile_fid, 3694 u8 info_class, u8 info_type, u32 additional_info, 3695 size_t output_len, size_t input_len, void *input) 3696 { 3697 struct smb2_query_info_req *req; 3698 struct kvec *iov = rqst->rq_iov; 3699 unsigned int total_len; 3700 size_t len; 3701 int rc; 3702 3703 if (unlikely(check_add_overflow(input_len, sizeof(*req), &len) || 3704 len > CIFSMaxBufSize)) 3705 return -EINVAL; 3706 3707 rc = smb2_plain_req_init(SMB2_QUERY_INFO, tcon, server, 3708 (void **) &req, &total_len); 3709 if (rc) 3710 return rc; 3711 3712 req->InfoType = info_type; 3713 req->FileInfoClass = info_class; 3714 req->PersistentFileId = persistent_fid; 3715 req->VolatileFileId = volatile_fid; 3716 req->AdditionalInformation = cpu_to_le32(additional_info); 3717 3718 req->OutputBufferLength = cpu_to_le32(output_len); 3719 if (input_len) { 3720 req->InputBufferLength = cpu_to_le32(input_len); 3721 /* total_len for smb query request never close to le16 max */ 3722 req->InputBufferOffset = cpu_to_le16(total_len - 1); 3723 memcpy(req->Buffer, input, input_len); 3724 } 3725 3726 iov[0].iov_base = (char *)req; 3727 /* 1 for Buffer */ 3728 iov[0].iov_len = len; 3729 return 0; 3730 } 3731 3732 void 3733 SMB2_query_info_free(struct smb_rqst *rqst) 3734 { 3735 if (rqst && rqst->rq_iov) 3736 cifs_buf_release(rqst->rq_iov[0].iov_base); /* request */ 3737 } 3738 3739 static int 3740 query_info(const unsigned int xid, struct cifs_tcon *tcon, 3741 u64 persistent_fid, u64 volatile_fid, u8 info_class, u8 info_type, 3742 u32 additional_info, size_t output_len, size_t min_len, void **data, 3743 u32 *dlen) 3744 { 3745 struct smb_rqst rqst; 3746 struct smb2_query_info_rsp *rsp = NULL; 3747 struct kvec iov[1]; 3748 struct kvec rsp_iov; 3749 int rc = 0; 3750 int resp_buftype = CIFS_NO_BUFFER; 3751 struct cifs_ses *ses = tcon->ses; 3752 struct TCP_Server_Info *server; 3753 int flags = 0; 3754 bool allocated = false; 3755 int retries = 0, cur_sleep = 1; 3756 3757 cifs_dbg(FYI, "Query Info\n"); 3758 3759 if (!ses) 3760 return -EIO; 3761 3762 replay_again: 3763 /* reinitialize for possible replay */ 3764 flags = 0; 3765 allocated = false; 3766 server = cifs_pick_channel(ses); 3767 3768 if (!server) 3769 return -EIO; 3770 3771 if (smb3_encryption_required(tcon)) 3772 flags |= CIFS_TRANSFORM_REQ; 3773 3774 memset(&rqst, 0, sizeof(struct smb_rqst)); 3775 memset(&iov, 0, sizeof(iov)); 3776 rqst.rq_iov = iov; 3777 rqst.rq_nvec = 1; 3778 3779 rc = SMB2_query_info_init(tcon, server, 3780 &rqst, persistent_fid, volatile_fid, 3781 info_class, info_type, additional_info, 3782 output_len, 0, NULL); 3783 if (rc) 3784 goto qinf_exit; 3785 3786 trace_smb3_query_info_enter(xid, persistent_fid, tcon->tid, 3787 ses->Suid, info_class, (__u32)info_type); 3788 3789 if (retries) 3790 smb2_set_replay(server, &rqst); 3791 3792 rc = cifs_send_recv(xid, ses, server, 3793 &rqst, &resp_buftype, flags, &rsp_iov); 3794 rsp = (struct smb2_query_info_rsp *)rsp_iov.iov_base; 3795 3796 if (rc) { 3797 cifs_stats_fail_inc(tcon, SMB2_QUERY_INFO_HE); 3798 trace_smb3_query_info_err(xid, persistent_fid, tcon->tid, 3799 ses->Suid, info_class, (__u32)info_type, rc); 3800 goto qinf_exit; 3801 } 3802 3803 trace_smb3_query_info_done(xid, persistent_fid, tcon->tid, 3804 ses->Suid, info_class, (__u32)info_type); 3805 3806 if (dlen) { 3807 *dlen = le32_to_cpu(rsp->OutputBufferLength); 3808 if (!*data) { 3809 *data = kmalloc(*dlen, GFP_KERNEL); 3810 if (!*data) { 3811 cifs_tcon_dbg(VFS, 3812 "Error %d allocating memory for acl\n", 3813 rc); 3814 *dlen = 0; 3815 rc = -ENOMEM; 3816 goto qinf_exit; 3817 } 3818 allocated = true; 3819 } 3820 } 3821 3822 rc = smb2_validate_and_copy_iov(le16_to_cpu(rsp->OutputBufferOffset), 3823 le32_to_cpu(rsp->OutputBufferLength), 3824 &rsp_iov, dlen ? *dlen : min_len, *data); 3825 if (rc && allocated) { 3826 kfree(*data); 3827 *data = NULL; 3828 *dlen = 0; 3829 } 3830 3831 qinf_exit: 3832 SMB2_query_info_free(&rqst); 3833 free_rsp_buf(resp_buftype, rsp); 3834 3835 if (is_replayable_error(rc) && 3836 smb2_should_replay(tcon, &retries, &cur_sleep)) 3837 goto replay_again; 3838 3839 return rc; 3840 } 3841 3842 int SMB2_query_info(const unsigned int xid, struct cifs_tcon *tcon, 3843 u64 persistent_fid, u64 volatile_fid, struct smb2_file_all_info *data) 3844 { 3845 return query_info(xid, tcon, persistent_fid, volatile_fid, 3846 FILE_ALL_INFORMATION, SMB2_O_INFO_FILE, 0, 3847 sizeof(struct smb2_file_all_info) + PATH_MAX * 2, 3848 sizeof(struct smb2_file_all_info), (void **)&data, 3849 NULL); 3850 } 3851 3852 #if 0 3853 /* currently unused, as now we are doing compounding instead (see smb311_posix_query_path_info) */ 3854 int 3855 SMB311_posix_query_info(const unsigned int xid, struct cifs_tcon *tcon, 3856 u64 persistent_fid, u64 volatile_fid, struct smb311_posix_qinfo *data, u32 *plen) 3857 { 3858 size_t output_len = sizeof(struct smb311_posix_qinfo *) + 3859 (sizeof(struct cifs_sid) * 2) + (PATH_MAX * 2); 3860 *plen = 0; 3861 3862 return query_info(xid, tcon, persistent_fid, volatile_fid, 3863 SMB_FIND_FILE_POSIX_INFO, SMB2_O_INFO_FILE, 0, 3864 output_len, sizeof(struct smb311_posix_qinfo), (void **)&data, plen); 3865 /* Note caller must free "data" (passed in above). It may be allocated in query_info call */ 3866 } 3867 #endif 3868 3869 int 3870 SMB2_query_acl(const unsigned int xid, struct cifs_tcon *tcon, 3871 u64 persistent_fid, u64 volatile_fid, 3872 void **data, u32 *plen, u32 extra_info) 3873 { 3874 __u32 additional_info = OWNER_SECINFO | GROUP_SECINFO | DACL_SECINFO | 3875 extra_info; 3876 *plen = 0; 3877 3878 return query_info(xid, tcon, persistent_fid, volatile_fid, 3879 0, SMB2_O_INFO_SECURITY, additional_info, 3880 SMB2_MAX_BUFFER_SIZE, MIN_SEC_DESC_LEN, data, plen); 3881 } 3882 3883 int 3884 SMB2_get_srv_num(const unsigned int xid, struct cifs_tcon *tcon, 3885 u64 persistent_fid, u64 volatile_fid, __le64 *uniqueid) 3886 { 3887 return query_info(xid, tcon, persistent_fid, volatile_fid, 3888 FILE_INTERNAL_INFORMATION, SMB2_O_INFO_FILE, 0, 3889 sizeof(struct smb2_file_internal_info), 3890 sizeof(struct smb2_file_internal_info), 3891 (void **)&uniqueid, NULL); 3892 } 3893 3894 /* 3895 * CHANGE_NOTIFY Request is sent to get notifications on changes to a directory 3896 * See MS-SMB2 2.2.35 and 2.2.36 3897 */ 3898 3899 static int 3900 SMB2_notify_init(const unsigned int xid, struct smb_rqst *rqst, 3901 struct cifs_tcon *tcon, struct TCP_Server_Info *server, 3902 u64 persistent_fid, u64 volatile_fid, 3903 u32 completion_filter, bool watch_tree) 3904 { 3905 struct smb2_change_notify_req *req; 3906 struct kvec *iov = rqst->rq_iov; 3907 unsigned int total_len; 3908 int rc; 3909 3910 rc = smb2_plain_req_init(SMB2_CHANGE_NOTIFY, tcon, server, 3911 (void **) &req, &total_len); 3912 if (rc) 3913 return rc; 3914 3915 req->PersistentFileId = persistent_fid; 3916 req->VolatileFileId = volatile_fid; 3917 /* See note 354 of MS-SMB2, 64K max */ 3918 req->OutputBufferLength = 3919 cpu_to_le32(SMB2_MAX_BUFFER_SIZE - MAX_SMB2_HDR_SIZE); 3920 req->CompletionFilter = cpu_to_le32(completion_filter); 3921 if (watch_tree) 3922 req->Flags = cpu_to_le16(SMB2_WATCH_TREE); 3923 else 3924 req->Flags = 0; 3925 3926 iov[0].iov_base = (char *)req; 3927 iov[0].iov_len = total_len; 3928 3929 return 0; 3930 } 3931 3932 int 3933 SMB2_change_notify(const unsigned int xid, struct cifs_tcon *tcon, 3934 u64 persistent_fid, u64 volatile_fid, bool watch_tree, 3935 u32 completion_filter, u32 max_out_data_len, char **out_data, 3936 u32 *plen /* returned data len */) 3937 { 3938 struct cifs_ses *ses = tcon->ses; 3939 struct TCP_Server_Info *server; 3940 struct smb_rqst rqst; 3941 struct smb2_change_notify_rsp *smb_rsp; 3942 struct kvec iov[1]; 3943 struct kvec rsp_iov = {NULL, 0}; 3944 int resp_buftype = CIFS_NO_BUFFER; 3945 int flags = 0; 3946 int rc = 0; 3947 int retries = 0, cur_sleep = 1; 3948 3949 replay_again: 3950 /* reinitialize for possible replay */ 3951 flags = 0; 3952 server = cifs_pick_channel(ses); 3953 3954 cifs_dbg(FYI, "change notify\n"); 3955 if (!ses || !server) 3956 return -EIO; 3957 3958 if (smb3_encryption_required(tcon)) 3959 flags |= CIFS_TRANSFORM_REQ; 3960 3961 memset(&rqst, 0, sizeof(struct smb_rqst)); 3962 memset(&iov, 0, sizeof(iov)); 3963 if (plen) 3964 *plen = 0; 3965 3966 rqst.rq_iov = iov; 3967 rqst.rq_nvec = 1; 3968 3969 rc = SMB2_notify_init(xid, &rqst, tcon, server, 3970 persistent_fid, volatile_fid, 3971 completion_filter, watch_tree); 3972 if (rc) 3973 goto cnotify_exit; 3974 3975 trace_smb3_notify_enter(xid, persistent_fid, tcon->tid, ses->Suid, 3976 (u8)watch_tree, completion_filter); 3977 3978 if (retries) 3979 smb2_set_replay(server, &rqst); 3980 3981 rc = cifs_send_recv(xid, ses, server, 3982 &rqst, &resp_buftype, flags, &rsp_iov); 3983 3984 if (rc != 0) { 3985 cifs_stats_fail_inc(tcon, SMB2_CHANGE_NOTIFY_HE); 3986 trace_smb3_notify_err(xid, persistent_fid, tcon->tid, ses->Suid, 3987 (u8)watch_tree, completion_filter, rc); 3988 } else { 3989 trace_smb3_notify_done(xid, persistent_fid, tcon->tid, 3990 ses->Suid, (u8)watch_tree, completion_filter); 3991 /* validate that notify information is plausible */ 3992 if ((rsp_iov.iov_base == NULL) || 3993 (rsp_iov.iov_len < sizeof(struct smb2_change_notify_rsp) + 1)) 3994 goto cnotify_exit; 3995 3996 smb_rsp = (struct smb2_change_notify_rsp *)rsp_iov.iov_base; 3997 3998 smb2_validate_iov(le16_to_cpu(smb_rsp->OutputBufferOffset), 3999 le32_to_cpu(smb_rsp->OutputBufferLength), &rsp_iov, 4000 sizeof(struct file_notify_information)); 4001 4002 *out_data = kmemdup((char *)smb_rsp + le16_to_cpu(smb_rsp->OutputBufferOffset), 4003 le32_to_cpu(smb_rsp->OutputBufferLength), GFP_KERNEL); 4004 if (*out_data == NULL) { 4005 rc = -ENOMEM; 4006 goto cnotify_exit; 4007 } else if (plen) 4008 *plen = le32_to_cpu(smb_rsp->OutputBufferLength); 4009 } 4010 4011 cnotify_exit: 4012 if (rqst.rq_iov) 4013 cifs_small_buf_release(rqst.rq_iov[0].iov_base); /* request */ 4014 free_rsp_buf(resp_buftype, rsp_iov.iov_base); 4015 4016 if (is_replayable_error(rc) && 4017 smb2_should_replay(tcon, &retries, &cur_sleep)) 4018 goto replay_again; 4019 4020 return rc; 4021 } 4022 4023 4024 4025 /* 4026 * This is a no-op for now. We're not really interested in the reply, but 4027 * rather in the fact that the server sent one and that server->lstrp 4028 * gets updated. 4029 * 4030 * FIXME: maybe we should consider checking that the reply matches request? 4031 */ 4032 static void 4033 smb2_echo_callback(struct mid_q_entry *mid) 4034 { 4035 struct TCP_Server_Info *server = mid->callback_data; 4036 struct smb2_echo_rsp *rsp = (struct smb2_echo_rsp *)mid->resp_buf; 4037 struct cifs_credits credits = { .value = 0, .instance = 0 }; 4038 4039 if (mid->mid_state == MID_RESPONSE_RECEIVED 4040 || mid->mid_state == MID_RESPONSE_MALFORMED) { 4041 credits.value = le16_to_cpu(rsp->hdr.CreditRequest); 4042 credits.instance = server->reconnect_instance; 4043 } 4044 4045 release_mid(mid); 4046 add_credits(server, &credits, CIFS_ECHO_OP); 4047 } 4048 4049 void smb2_reconnect_server(struct work_struct *work) 4050 { 4051 struct TCP_Server_Info *server = container_of(work, 4052 struct TCP_Server_Info, reconnect.work); 4053 struct TCP_Server_Info *pserver; 4054 struct cifs_ses *ses, *ses2; 4055 struct cifs_tcon *tcon, *tcon2; 4056 struct list_head tmp_list, tmp_ses_list; 4057 bool ses_exist = false; 4058 bool tcon_selected = false; 4059 int rc; 4060 bool resched = false; 4061 4062 /* first check if ref count has reached 0, if not inc ref count */ 4063 spin_lock(&cifs_tcp_ses_lock); 4064 if (!server->srv_count) { 4065 spin_unlock(&cifs_tcp_ses_lock); 4066 return; 4067 } 4068 server->srv_count++; 4069 spin_unlock(&cifs_tcp_ses_lock); 4070 4071 /* If server is a channel, select the primary channel */ 4072 pserver = SERVER_IS_CHAN(server) ? server->primary_server : server; 4073 4074 /* Prevent simultaneous reconnects that can corrupt tcon->rlist list */ 4075 mutex_lock(&pserver->reconnect_mutex); 4076 4077 /* if the server is marked for termination, drop the ref count here */ 4078 if (server->terminate) { 4079 cifs_put_tcp_session(server, true); 4080 mutex_unlock(&pserver->reconnect_mutex); 4081 return; 4082 } 4083 4084 INIT_LIST_HEAD(&tmp_list); 4085 INIT_LIST_HEAD(&tmp_ses_list); 4086 cifs_dbg(FYI, "Reconnecting tcons and channels\n"); 4087 4088 spin_lock(&cifs_tcp_ses_lock); 4089 list_for_each_entry(ses, &pserver->smb_ses_list, smb_ses_list) { 4090 spin_lock(&ses->ses_lock); 4091 if (ses->ses_status == SES_EXITING) { 4092 spin_unlock(&ses->ses_lock); 4093 continue; 4094 } 4095 spin_unlock(&ses->ses_lock); 4096 4097 tcon_selected = false; 4098 4099 list_for_each_entry(tcon, &ses->tcon_list, tcon_list) { 4100 if (tcon->need_reconnect || tcon->need_reopen_files) { 4101 tcon->tc_count++; 4102 list_add_tail(&tcon->rlist, &tmp_list); 4103 tcon_selected = true; 4104 } 4105 } 4106 /* 4107 * IPC has the same lifetime as its session and uses its 4108 * refcount. 4109 */ 4110 if (ses->tcon_ipc && ses->tcon_ipc->need_reconnect) { 4111 list_add_tail(&ses->tcon_ipc->rlist, &tmp_list); 4112 tcon_selected = true; 4113 cifs_smb_ses_inc_refcount(ses); 4114 } 4115 /* 4116 * handle the case where channel needs to reconnect 4117 * binding session, but tcon is healthy (some other channel 4118 * is active) 4119 */ 4120 spin_lock(&ses->chan_lock); 4121 if (!tcon_selected && cifs_chan_needs_reconnect(ses, server)) { 4122 list_add_tail(&ses->rlist, &tmp_ses_list); 4123 ses_exist = true; 4124 cifs_smb_ses_inc_refcount(ses); 4125 } 4126 spin_unlock(&ses->chan_lock); 4127 } 4128 spin_unlock(&cifs_tcp_ses_lock); 4129 4130 list_for_each_entry_safe(tcon, tcon2, &tmp_list, rlist) { 4131 rc = smb2_reconnect(SMB2_INTERNAL_CMD, tcon, server, true); 4132 if (!rc) 4133 cifs_reopen_persistent_handles(tcon); 4134 else 4135 resched = true; 4136 list_del_init(&tcon->rlist); 4137 if (tcon->ipc) 4138 cifs_put_smb_ses(tcon->ses); 4139 else 4140 cifs_put_tcon(tcon); 4141 } 4142 4143 if (!ses_exist) 4144 goto done; 4145 4146 /* allocate a dummy tcon struct used for reconnect */ 4147 tcon = tcon_info_alloc(false); 4148 if (!tcon) { 4149 resched = true; 4150 list_for_each_entry_safe(ses, ses2, &tmp_ses_list, rlist) { 4151 list_del_init(&ses->rlist); 4152 cifs_put_smb_ses(ses); 4153 } 4154 goto done; 4155 } 4156 4157 tcon->status = TID_GOOD; 4158 tcon->retry = false; 4159 tcon->need_reconnect = false; 4160 4161 /* now reconnect sessions for necessary channels */ 4162 list_for_each_entry_safe(ses, ses2, &tmp_ses_list, rlist) { 4163 tcon->ses = ses; 4164 rc = smb2_reconnect(SMB2_INTERNAL_CMD, tcon, server, true); 4165 if (rc) 4166 resched = true; 4167 list_del_init(&ses->rlist); 4168 cifs_put_smb_ses(ses); 4169 } 4170 tconInfoFree(tcon); 4171 4172 done: 4173 cifs_dbg(FYI, "Reconnecting tcons and channels finished\n"); 4174 if (resched) 4175 queue_delayed_work(cifsiod_wq, &server->reconnect, 2 * HZ); 4176 mutex_unlock(&pserver->reconnect_mutex); 4177 4178 /* now we can safely release srv struct */ 4179 cifs_put_tcp_session(server, true); 4180 } 4181 4182 int 4183 SMB2_echo(struct TCP_Server_Info *server) 4184 { 4185 struct smb2_echo_req *req; 4186 int rc = 0; 4187 struct kvec iov[1]; 4188 struct smb_rqst rqst = { .rq_iov = iov, 4189 .rq_nvec = 1 }; 4190 unsigned int total_len; 4191 4192 cifs_dbg(FYI, "In echo request for conn_id %lld\n", server->conn_id); 4193 4194 spin_lock(&server->srv_lock); 4195 if (server->ops->need_neg && 4196 server->ops->need_neg(server)) { 4197 spin_unlock(&server->srv_lock); 4198 /* No need to send echo on newly established connections */ 4199 mod_delayed_work(cifsiod_wq, &server->reconnect, 0); 4200 return rc; 4201 } 4202 spin_unlock(&server->srv_lock); 4203 4204 rc = smb2_plain_req_init(SMB2_ECHO, NULL, server, 4205 (void **)&req, &total_len); 4206 if (rc) 4207 return rc; 4208 4209 req->hdr.CreditRequest = cpu_to_le16(1); 4210 4211 iov[0].iov_len = total_len; 4212 iov[0].iov_base = (char *)req; 4213 4214 rc = cifs_call_async(server, &rqst, NULL, smb2_echo_callback, NULL, 4215 server, CIFS_ECHO_OP, NULL); 4216 if (rc) 4217 cifs_dbg(FYI, "Echo request failed: %d\n", rc); 4218 4219 cifs_small_buf_release(req); 4220 return rc; 4221 } 4222 4223 void 4224 SMB2_flush_free(struct smb_rqst *rqst) 4225 { 4226 if (rqst && rqst->rq_iov) 4227 cifs_small_buf_release(rqst->rq_iov[0].iov_base); /* request */ 4228 } 4229 4230 int 4231 SMB2_flush_init(const unsigned int xid, struct smb_rqst *rqst, 4232 struct cifs_tcon *tcon, struct TCP_Server_Info *server, 4233 u64 persistent_fid, u64 volatile_fid) 4234 { 4235 struct smb2_flush_req *req; 4236 struct kvec *iov = rqst->rq_iov; 4237 unsigned int total_len; 4238 int rc; 4239 4240 rc = smb2_plain_req_init(SMB2_FLUSH, tcon, server, 4241 (void **) &req, &total_len); 4242 if (rc) 4243 return rc; 4244 4245 req->PersistentFileId = persistent_fid; 4246 req->VolatileFileId = volatile_fid; 4247 4248 iov[0].iov_base = (char *)req; 4249 iov[0].iov_len = total_len; 4250 4251 return 0; 4252 } 4253 4254 int 4255 SMB2_flush(const unsigned int xid, struct cifs_tcon *tcon, u64 persistent_fid, 4256 u64 volatile_fid) 4257 { 4258 struct cifs_ses *ses = tcon->ses; 4259 struct smb_rqst rqst; 4260 struct kvec iov[1]; 4261 struct kvec rsp_iov = {NULL, 0}; 4262 struct TCP_Server_Info *server; 4263 int resp_buftype = CIFS_NO_BUFFER; 4264 int flags = 0; 4265 int rc = 0; 4266 int retries = 0, cur_sleep = 1; 4267 4268 replay_again: 4269 /* reinitialize for possible replay */ 4270 flags = 0; 4271 server = cifs_pick_channel(ses); 4272 4273 cifs_dbg(FYI, "flush\n"); 4274 if (!ses || !(ses->server)) 4275 return -EIO; 4276 4277 if (smb3_encryption_required(tcon)) 4278 flags |= CIFS_TRANSFORM_REQ; 4279 4280 memset(&rqst, 0, sizeof(struct smb_rqst)); 4281 memset(&iov, 0, sizeof(iov)); 4282 rqst.rq_iov = iov; 4283 rqst.rq_nvec = 1; 4284 4285 rc = SMB2_flush_init(xid, &rqst, tcon, server, 4286 persistent_fid, volatile_fid); 4287 if (rc) 4288 goto flush_exit; 4289 4290 trace_smb3_flush_enter(xid, persistent_fid, tcon->tid, ses->Suid); 4291 4292 if (retries) 4293 smb2_set_replay(server, &rqst); 4294 4295 rc = cifs_send_recv(xid, ses, server, 4296 &rqst, &resp_buftype, flags, &rsp_iov); 4297 4298 if (rc != 0) { 4299 cifs_stats_fail_inc(tcon, SMB2_FLUSH_HE); 4300 trace_smb3_flush_err(xid, persistent_fid, tcon->tid, ses->Suid, 4301 rc); 4302 } else 4303 trace_smb3_flush_done(xid, persistent_fid, tcon->tid, 4304 ses->Suid); 4305 4306 flush_exit: 4307 SMB2_flush_free(&rqst); 4308 free_rsp_buf(resp_buftype, rsp_iov.iov_base); 4309 4310 if (is_replayable_error(rc) && 4311 smb2_should_replay(tcon, &retries, &cur_sleep)) 4312 goto replay_again; 4313 4314 return rc; 4315 } 4316 4317 #ifdef CONFIG_CIFS_SMB_DIRECT 4318 static inline bool smb3_use_rdma_offload(struct cifs_io_parms *io_parms) 4319 { 4320 struct TCP_Server_Info *server = io_parms->server; 4321 struct cifs_tcon *tcon = io_parms->tcon; 4322 4323 /* we can only offload if we're connected */ 4324 if (!server || !tcon) 4325 return false; 4326 4327 /* we can only offload on an rdma connection */ 4328 if (!server->rdma || !server->smbd_conn) 4329 return false; 4330 4331 /* we don't support signed offload yet */ 4332 if (server->sign) 4333 return false; 4334 4335 /* we don't support encrypted offload yet */ 4336 if (smb3_encryption_required(tcon)) 4337 return false; 4338 4339 /* offload also has its overhead, so only do it if desired */ 4340 if (io_parms->length < server->smbd_conn->rdma_readwrite_threshold) 4341 return false; 4342 4343 return true; 4344 } 4345 #endif /* CONFIG_CIFS_SMB_DIRECT */ 4346 4347 /* 4348 * To form a chain of read requests, any read requests after the first should 4349 * have the end_of_chain boolean set to true. 4350 */ 4351 static int 4352 smb2_new_read_req(void **buf, unsigned int *total_len, 4353 struct cifs_io_parms *io_parms, struct cifs_readdata *rdata, 4354 unsigned int remaining_bytes, int request_type) 4355 { 4356 int rc = -EACCES; 4357 struct smb2_read_req *req = NULL; 4358 struct smb2_hdr *shdr; 4359 struct TCP_Server_Info *server = io_parms->server; 4360 4361 rc = smb2_plain_req_init(SMB2_READ, io_parms->tcon, server, 4362 (void **) &req, total_len); 4363 if (rc) 4364 return rc; 4365 4366 if (server == NULL) 4367 return -ECONNABORTED; 4368 4369 shdr = &req->hdr; 4370 shdr->Id.SyncId.ProcessId = cpu_to_le32(io_parms->pid); 4371 4372 req->PersistentFileId = io_parms->persistent_fid; 4373 req->VolatileFileId = io_parms->volatile_fid; 4374 req->ReadChannelInfoOffset = 0; /* reserved */ 4375 req->ReadChannelInfoLength = 0; /* reserved */ 4376 req->Channel = 0; /* reserved */ 4377 req->MinimumCount = 0; 4378 req->Length = cpu_to_le32(io_parms->length); 4379 req->Offset = cpu_to_le64(io_parms->offset); 4380 4381 trace_smb3_read_enter(0 /* xid */, 4382 io_parms->persistent_fid, 4383 io_parms->tcon->tid, io_parms->tcon->ses->Suid, 4384 io_parms->offset, io_parms->length); 4385 #ifdef CONFIG_CIFS_SMB_DIRECT 4386 /* 4387 * If we want to do a RDMA write, fill in and append 4388 * smbd_buffer_descriptor_v1 to the end of read request 4389 */ 4390 if (smb3_use_rdma_offload(io_parms)) { 4391 struct smbd_buffer_descriptor_v1 *v1; 4392 bool need_invalidate = server->dialect == SMB30_PROT_ID; 4393 4394 rdata->mr = smbd_register_mr(server->smbd_conn, &rdata->iter, 4395 true, need_invalidate); 4396 if (!rdata->mr) 4397 return -EAGAIN; 4398 4399 req->Channel = SMB2_CHANNEL_RDMA_V1_INVALIDATE; 4400 if (need_invalidate) 4401 req->Channel = SMB2_CHANNEL_RDMA_V1; 4402 req->ReadChannelInfoOffset = 4403 cpu_to_le16(offsetof(struct smb2_read_req, Buffer)); 4404 req->ReadChannelInfoLength = 4405 cpu_to_le16(sizeof(struct smbd_buffer_descriptor_v1)); 4406 v1 = (struct smbd_buffer_descriptor_v1 *) &req->Buffer[0]; 4407 v1->offset = cpu_to_le64(rdata->mr->mr->iova); 4408 v1->token = cpu_to_le32(rdata->mr->mr->rkey); 4409 v1->length = cpu_to_le32(rdata->mr->mr->length); 4410 4411 *total_len += sizeof(*v1) - 1; 4412 } 4413 #endif 4414 if (request_type & CHAINED_REQUEST) { 4415 if (!(request_type & END_OF_CHAIN)) { 4416 /* next 8-byte aligned request */ 4417 *total_len = ALIGN(*total_len, 8); 4418 shdr->NextCommand = cpu_to_le32(*total_len); 4419 } else /* END_OF_CHAIN */ 4420 shdr->NextCommand = 0; 4421 if (request_type & RELATED_REQUEST) { 4422 shdr->Flags |= SMB2_FLAGS_RELATED_OPERATIONS; 4423 /* 4424 * Related requests use info from previous read request 4425 * in chain. 4426 */ 4427 shdr->SessionId = cpu_to_le64(0xFFFFFFFFFFFFFFFF); 4428 shdr->Id.SyncId.TreeId = cpu_to_le32(0xFFFFFFFF); 4429 req->PersistentFileId = (u64)-1; 4430 req->VolatileFileId = (u64)-1; 4431 } 4432 } 4433 if (remaining_bytes > io_parms->length) 4434 req->RemainingBytes = cpu_to_le32(remaining_bytes); 4435 else 4436 req->RemainingBytes = 0; 4437 4438 *buf = req; 4439 return rc; 4440 } 4441 4442 static void 4443 smb2_readv_callback(struct mid_q_entry *mid) 4444 { 4445 struct cifs_readdata *rdata = mid->callback_data; 4446 struct cifs_tcon *tcon = tlink_tcon(rdata->cfile->tlink); 4447 struct TCP_Server_Info *server = rdata->server; 4448 struct smb2_hdr *shdr = 4449 (struct smb2_hdr *)rdata->iov[0].iov_base; 4450 struct cifs_credits credits = { .value = 0, .instance = 0 }; 4451 struct smb_rqst rqst = { .rq_iov = &rdata->iov[1], .rq_nvec = 1 }; 4452 4453 if (rdata->got_bytes) { 4454 rqst.rq_iter = rdata->iter; 4455 rqst.rq_iter_size = iov_iter_count(&rdata->iter); 4456 } 4457 4458 WARN_ONCE(rdata->server != mid->server, 4459 "rdata server %p != mid server %p", 4460 rdata->server, mid->server); 4461 4462 cifs_dbg(FYI, "%s: mid=%llu state=%d result=%d bytes=%u\n", 4463 __func__, mid->mid, mid->mid_state, rdata->result, 4464 rdata->bytes); 4465 4466 switch (mid->mid_state) { 4467 case MID_RESPONSE_RECEIVED: 4468 credits.value = le16_to_cpu(shdr->CreditRequest); 4469 credits.instance = server->reconnect_instance; 4470 /* result already set, check signature */ 4471 if (server->sign && !mid->decrypted) { 4472 int rc; 4473 4474 iov_iter_revert(&rqst.rq_iter, rdata->got_bytes); 4475 iov_iter_truncate(&rqst.rq_iter, rdata->got_bytes); 4476 rc = smb2_verify_signature(&rqst, server); 4477 if (rc) 4478 cifs_tcon_dbg(VFS, "SMB signature verification returned error = %d\n", 4479 rc); 4480 } 4481 /* FIXME: should this be counted toward the initiating task? */ 4482 task_io_account_read(rdata->got_bytes); 4483 cifs_stats_bytes_read(tcon, rdata->got_bytes); 4484 break; 4485 case MID_REQUEST_SUBMITTED: 4486 case MID_RETRY_NEEDED: 4487 rdata->result = -EAGAIN; 4488 if (server->sign && rdata->got_bytes) 4489 /* reset bytes number since we can not check a sign */ 4490 rdata->got_bytes = 0; 4491 /* FIXME: should this be counted toward the initiating task? */ 4492 task_io_account_read(rdata->got_bytes); 4493 cifs_stats_bytes_read(tcon, rdata->got_bytes); 4494 break; 4495 case MID_RESPONSE_MALFORMED: 4496 credits.value = le16_to_cpu(shdr->CreditRequest); 4497 credits.instance = server->reconnect_instance; 4498 fallthrough; 4499 default: 4500 rdata->result = -EIO; 4501 } 4502 #ifdef CONFIG_CIFS_SMB_DIRECT 4503 /* 4504 * If this rdata has a memmory registered, the MR can be freed 4505 * MR needs to be freed as soon as I/O finishes to prevent deadlock 4506 * because they have limited number and are used for future I/Os 4507 */ 4508 if (rdata->mr) { 4509 smbd_deregister_mr(rdata->mr); 4510 rdata->mr = NULL; 4511 } 4512 #endif 4513 if (rdata->result && rdata->result != -ENODATA) { 4514 cifs_stats_fail_inc(tcon, SMB2_READ_HE); 4515 trace_smb3_read_err(0 /* xid */, 4516 rdata->cfile->fid.persistent_fid, 4517 tcon->tid, tcon->ses->Suid, rdata->offset, 4518 rdata->bytes, rdata->result); 4519 } else 4520 trace_smb3_read_done(0 /* xid */, 4521 rdata->cfile->fid.persistent_fid, 4522 tcon->tid, tcon->ses->Suid, 4523 rdata->offset, rdata->got_bytes); 4524 4525 queue_work(cifsiod_wq, &rdata->work); 4526 release_mid(mid); 4527 add_credits(server, &credits, 0); 4528 } 4529 4530 /* smb2_async_readv - send an async read, and set up mid to handle result */ 4531 int 4532 smb2_async_readv(struct cifs_readdata *rdata) 4533 { 4534 int rc, flags = 0; 4535 char *buf; 4536 struct smb2_hdr *shdr; 4537 struct cifs_io_parms io_parms; 4538 struct smb_rqst rqst = { .rq_iov = rdata->iov, 4539 .rq_nvec = 1 }; 4540 struct TCP_Server_Info *server; 4541 struct cifs_tcon *tcon = tlink_tcon(rdata->cfile->tlink); 4542 unsigned int total_len; 4543 int credit_request; 4544 4545 cifs_dbg(FYI, "%s: offset=%llu bytes=%u\n", 4546 __func__, rdata->offset, rdata->bytes); 4547 4548 if (!rdata->server) 4549 rdata->server = cifs_pick_channel(tcon->ses); 4550 4551 io_parms.tcon = tlink_tcon(rdata->cfile->tlink); 4552 io_parms.server = server = rdata->server; 4553 io_parms.offset = rdata->offset; 4554 io_parms.length = rdata->bytes; 4555 io_parms.persistent_fid = rdata->cfile->fid.persistent_fid; 4556 io_parms.volatile_fid = rdata->cfile->fid.volatile_fid; 4557 io_parms.pid = rdata->pid; 4558 4559 rc = smb2_new_read_req( 4560 (void **) &buf, &total_len, &io_parms, rdata, 0, 0); 4561 if (rc) 4562 return rc; 4563 4564 if (smb3_encryption_required(io_parms.tcon)) 4565 flags |= CIFS_TRANSFORM_REQ; 4566 4567 rdata->iov[0].iov_base = buf; 4568 rdata->iov[0].iov_len = total_len; 4569 4570 shdr = (struct smb2_hdr *)buf; 4571 4572 if (rdata->credits.value > 0) { 4573 shdr->CreditCharge = cpu_to_le16(DIV_ROUND_UP(rdata->bytes, 4574 SMB2_MAX_BUFFER_SIZE)); 4575 credit_request = le16_to_cpu(shdr->CreditCharge) + 8; 4576 if (server->credits >= server->max_credits) 4577 shdr->CreditRequest = cpu_to_le16(0); 4578 else 4579 shdr->CreditRequest = cpu_to_le16( 4580 min_t(int, server->max_credits - 4581 server->credits, credit_request)); 4582 4583 rc = adjust_credits(server, &rdata->credits, rdata->bytes); 4584 if (rc) 4585 goto async_readv_out; 4586 4587 flags |= CIFS_HAS_CREDITS; 4588 } 4589 4590 kref_get(&rdata->refcount); 4591 rc = cifs_call_async(server, &rqst, 4592 cifs_readv_receive, smb2_readv_callback, 4593 smb3_handle_read_data, rdata, flags, 4594 &rdata->credits); 4595 if (rc) { 4596 kref_put(&rdata->refcount, cifs_readdata_release); 4597 cifs_stats_fail_inc(io_parms.tcon, SMB2_READ_HE); 4598 trace_smb3_read_err(0 /* xid */, io_parms.persistent_fid, 4599 io_parms.tcon->tid, 4600 io_parms.tcon->ses->Suid, 4601 io_parms.offset, io_parms.length, rc); 4602 } 4603 4604 async_readv_out: 4605 cifs_small_buf_release(buf); 4606 return rc; 4607 } 4608 4609 int 4610 SMB2_read(const unsigned int xid, struct cifs_io_parms *io_parms, 4611 unsigned int *nbytes, char **buf, int *buf_type) 4612 { 4613 struct smb_rqst rqst; 4614 int resp_buftype, rc; 4615 struct smb2_read_req *req = NULL; 4616 struct smb2_read_rsp *rsp = NULL; 4617 struct kvec iov[1]; 4618 struct kvec rsp_iov; 4619 unsigned int total_len; 4620 int flags = CIFS_LOG_ERROR; 4621 struct cifs_ses *ses = io_parms->tcon->ses; 4622 4623 if (!io_parms->server) 4624 io_parms->server = cifs_pick_channel(io_parms->tcon->ses); 4625 4626 *nbytes = 0; 4627 rc = smb2_new_read_req((void **)&req, &total_len, io_parms, NULL, 0, 0); 4628 if (rc) 4629 return rc; 4630 4631 if (smb3_encryption_required(io_parms->tcon)) 4632 flags |= CIFS_TRANSFORM_REQ; 4633 4634 iov[0].iov_base = (char *)req; 4635 iov[0].iov_len = total_len; 4636 4637 memset(&rqst, 0, sizeof(struct smb_rqst)); 4638 rqst.rq_iov = iov; 4639 rqst.rq_nvec = 1; 4640 4641 rc = cifs_send_recv(xid, ses, io_parms->server, 4642 &rqst, &resp_buftype, flags, &rsp_iov); 4643 rsp = (struct smb2_read_rsp *)rsp_iov.iov_base; 4644 4645 if (rc) { 4646 if (rc != -ENODATA) { 4647 cifs_stats_fail_inc(io_parms->tcon, SMB2_READ_HE); 4648 cifs_dbg(VFS, "Send error in read = %d\n", rc); 4649 trace_smb3_read_err(xid, 4650 req->PersistentFileId, 4651 io_parms->tcon->tid, ses->Suid, 4652 io_parms->offset, io_parms->length, 4653 rc); 4654 } else 4655 trace_smb3_read_done(xid, req->PersistentFileId, io_parms->tcon->tid, 4656 ses->Suid, io_parms->offset, 0); 4657 free_rsp_buf(resp_buftype, rsp_iov.iov_base); 4658 cifs_small_buf_release(req); 4659 return rc == -ENODATA ? 0 : rc; 4660 } else 4661 trace_smb3_read_done(xid, 4662 req->PersistentFileId, 4663 io_parms->tcon->tid, ses->Suid, 4664 io_parms->offset, io_parms->length); 4665 4666 cifs_small_buf_release(req); 4667 4668 *nbytes = le32_to_cpu(rsp->DataLength); 4669 if ((*nbytes > CIFS_MAX_MSGSIZE) || 4670 (*nbytes > io_parms->length)) { 4671 cifs_dbg(FYI, "bad length %d for count %d\n", 4672 *nbytes, io_parms->length); 4673 rc = -EIO; 4674 *nbytes = 0; 4675 } 4676 4677 if (*buf) { 4678 memcpy(*buf, (char *)rsp + rsp->DataOffset, *nbytes); 4679 free_rsp_buf(resp_buftype, rsp_iov.iov_base); 4680 } else if (resp_buftype != CIFS_NO_BUFFER) { 4681 *buf = rsp_iov.iov_base; 4682 if (resp_buftype == CIFS_SMALL_BUFFER) 4683 *buf_type = CIFS_SMALL_BUFFER; 4684 else if (resp_buftype == CIFS_LARGE_BUFFER) 4685 *buf_type = CIFS_LARGE_BUFFER; 4686 } 4687 return rc; 4688 } 4689 4690 /* 4691 * Check the mid_state and signature on received buffer (if any), and queue the 4692 * workqueue completion task. 4693 */ 4694 static void 4695 smb2_writev_callback(struct mid_q_entry *mid) 4696 { 4697 struct cifs_writedata *wdata = mid->callback_data; 4698 struct cifs_tcon *tcon = tlink_tcon(wdata->cfile->tlink); 4699 struct TCP_Server_Info *server = wdata->server; 4700 unsigned int written; 4701 struct smb2_write_rsp *rsp = (struct smb2_write_rsp *)mid->resp_buf; 4702 struct cifs_credits credits = { .value = 0, .instance = 0 }; 4703 4704 WARN_ONCE(wdata->server != mid->server, 4705 "wdata server %p != mid server %p", 4706 wdata->server, mid->server); 4707 4708 switch (mid->mid_state) { 4709 case MID_RESPONSE_RECEIVED: 4710 credits.value = le16_to_cpu(rsp->hdr.CreditRequest); 4711 credits.instance = server->reconnect_instance; 4712 wdata->result = smb2_check_receive(mid, server, 0); 4713 if (wdata->result != 0) 4714 break; 4715 4716 written = le32_to_cpu(rsp->DataLength); 4717 /* 4718 * Mask off high 16 bits when bytes written as returned 4719 * by the server is greater than bytes requested by the 4720 * client. OS/2 servers are known to set incorrect 4721 * CountHigh values. 4722 */ 4723 if (written > wdata->bytes) 4724 written &= 0xFFFF; 4725 4726 if (written < wdata->bytes) 4727 wdata->result = -ENOSPC; 4728 else 4729 wdata->bytes = written; 4730 break; 4731 case MID_REQUEST_SUBMITTED: 4732 case MID_RETRY_NEEDED: 4733 wdata->result = -EAGAIN; 4734 break; 4735 case MID_RESPONSE_MALFORMED: 4736 credits.value = le16_to_cpu(rsp->hdr.CreditRequest); 4737 credits.instance = server->reconnect_instance; 4738 fallthrough; 4739 default: 4740 wdata->result = -EIO; 4741 break; 4742 } 4743 #ifdef CONFIG_CIFS_SMB_DIRECT 4744 /* 4745 * If this wdata has a memory registered, the MR can be freed 4746 * The number of MRs available is limited, it's important to recover 4747 * used MR as soon as I/O is finished. Hold MR longer in the later 4748 * I/O process can possibly result in I/O deadlock due to lack of MR 4749 * to send request on I/O retry 4750 */ 4751 if (wdata->mr) { 4752 smbd_deregister_mr(wdata->mr); 4753 wdata->mr = NULL; 4754 } 4755 #endif 4756 if (wdata->result) { 4757 cifs_stats_fail_inc(tcon, SMB2_WRITE_HE); 4758 trace_smb3_write_err(0 /* no xid */, 4759 wdata->cfile->fid.persistent_fid, 4760 tcon->tid, tcon->ses->Suid, wdata->offset, 4761 wdata->bytes, wdata->result); 4762 if (wdata->result == -ENOSPC) 4763 pr_warn_once("Out of space writing to %s\n", 4764 tcon->tree_name); 4765 } else 4766 trace_smb3_write_done(0 /* no xid */, 4767 wdata->cfile->fid.persistent_fid, 4768 tcon->tid, tcon->ses->Suid, 4769 wdata->offset, wdata->bytes); 4770 4771 queue_work(cifsiod_wq, &wdata->work); 4772 release_mid(mid); 4773 add_credits(server, &credits, 0); 4774 } 4775 4776 /* smb2_async_writev - send an async write, and set up mid to handle result */ 4777 int 4778 smb2_async_writev(struct cifs_writedata *wdata, 4779 void (*release)(struct kref *kref)) 4780 { 4781 int rc = -EACCES, flags = 0; 4782 struct smb2_write_req *req = NULL; 4783 struct smb2_hdr *shdr; 4784 struct cifs_tcon *tcon = tlink_tcon(wdata->cfile->tlink); 4785 struct TCP_Server_Info *server = wdata->server; 4786 struct kvec iov[1]; 4787 struct smb_rqst rqst = { }; 4788 unsigned int total_len; 4789 struct cifs_io_parms _io_parms; 4790 struct cifs_io_parms *io_parms = NULL; 4791 int credit_request; 4792 4793 if (!wdata->server || wdata->replay) 4794 server = wdata->server = cifs_pick_channel(tcon->ses); 4795 4796 /* 4797 * in future we may get cifs_io_parms passed in from the caller, 4798 * but for now we construct it here... 4799 */ 4800 _io_parms = (struct cifs_io_parms) { 4801 .tcon = tcon, 4802 .server = server, 4803 .offset = wdata->offset, 4804 .length = wdata->bytes, 4805 .persistent_fid = wdata->cfile->fid.persistent_fid, 4806 .volatile_fid = wdata->cfile->fid.volatile_fid, 4807 .pid = wdata->pid, 4808 }; 4809 io_parms = &_io_parms; 4810 4811 rc = smb2_plain_req_init(SMB2_WRITE, tcon, server, 4812 (void **) &req, &total_len); 4813 if (rc) 4814 return rc; 4815 4816 if (smb3_encryption_required(tcon)) 4817 flags |= CIFS_TRANSFORM_REQ; 4818 4819 shdr = (struct smb2_hdr *)req; 4820 shdr->Id.SyncId.ProcessId = cpu_to_le32(io_parms->pid); 4821 4822 req->PersistentFileId = io_parms->persistent_fid; 4823 req->VolatileFileId = io_parms->volatile_fid; 4824 req->WriteChannelInfoOffset = 0; 4825 req->WriteChannelInfoLength = 0; 4826 req->Channel = SMB2_CHANNEL_NONE; 4827 req->Offset = cpu_to_le64(io_parms->offset); 4828 req->DataOffset = cpu_to_le16( 4829 offsetof(struct smb2_write_req, Buffer)); 4830 req->RemainingBytes = 0; 4831 4832 trace_smb3_write_enter(0 /* xid */, 4833 io_parms->persistent_fid, 4834 io_parms->tcon->tid, 4835 io_parms->tcon->ses->Suid, 4836 io_parms->offset, 4837 io_parms->length); 4838 4839 #ifdef CONFIG_CIFS_SMB_DIRECT 4840 /* 4841 * If we want to do a server RDMA read, fill in and append 4842 * smbd_buffer_descriptor_v1 to the end of write request 4843 */ 4844 if (smb3_use_rdma_offload(io_parms)) { 4845 struct smbd_buffer_descriptor_v1 *v1; 4846 size_t data_size = iov_iter_count(&wdata->iter); 4847 bool need_invalidate = server->dialect == SMB30_PROT_ID; 4848 4849 wdata->mr = smbd_register_mr(server->smbd_conn, &wdata->iter, 4850 false, need_invalidate); 4851 if (!wdata->mr) { 4852 rc = -EAGAIN; 4853 goto async_writev_out; 4854 } 4855 req->Length = 0; 4856 req->DataOffset = 0; 4857 req->RemainingBytes = cpu_to_le32(data_size); 4858 req->Channel = SMB2_CHANNEL_RDMA_V1_INVALIDATE; 4859 if (need_invalidate) 4860 req->Channel = SMB2_CHANNEL_RDMA_V1; 4861 req->WriteChannelInfoOffset = 4862 cpu_to_le16(offsetof(struct smb2_write_req, Buffer)); 4863 req->WriteChannelInfoLength = 4864 cpu_to_le16(sizeof(struct smbd_buffer_descriptor_v1)); 4865 v1 = (struct smbd_buffer_descriptor_v1 *) &req->Buffer[0]; 4866 v1->offset = cpu_to_le64(wdata->mr->mr->iova); 4867 v1->token = cpu_to_le32(wdata->mr->mr->rkey); 4868 v1->length = cpu_to_le32(wdata->mr->mr->length); 4869 } 4870 #endif 4871 iov[0].iov_len = total_len - 1; 4872 iov[0].iov_base = (char *)req; 4873 4874 rqst.rq_iov = iov; 4875 rqst.rq_nvec = 1; 4876 rqst.rq_iter = wdata->iter; 4877 rqst.rq_iter_size = iov_iter_count(&rqst.rq_iter); 4878 if (wdata->replay) 4879 smb2_set_replay(server, &rqst); 4880 #ifdef CONFIG_CIFS_SMB_DIRECT 4881 if (wdata->mr) 4882 iov[0].iov_len += sizeof(struct smbd_buffer_descriptor_v1); 4883 #endif 4884 cifs_dbg(FYI, "async write at %llu %u bytes iter=%zx\n", 4885 io_parms->offset, io_parms->length, iov_iter_count(&rqst.rq_iter)); 4886 4887 #ifdef CONFIG_CIFS_SMB_DIRECT 4888 /* For RDMA read, I/O size is in RemainingBytes not in Length */ 4889 if (!wdata->mr) 4890 req->Length = cpu_to_le32(io_parms->length); 4891 #else 4892 req->Length = cpu_to_le32(io_parms->length); 4893 #endif 4894 4895 if (wdata->credits.value > 0) { 4896 shdr->CreditCharge = cpu_to_le16(DIV_ROUND_UP(wdata->bytes, 4897 SMB2_MAX_BUFFER_SIZE)); 4898 credit_request = le16_to_cpu(shdr->CreditCharge) + 8; 4899 if (server->credits >= server->max_credits) 4900 shdr->CreditRequest = cpu_to_le16(0); 4901 else 4902 shdr->CreditRequest = cpu_to_le16( 4903 min_t(int, server->max_credits - 4904 server->credits, credit_request)); 4905 4906 rc = adjust_credits(server, &wdata->credits, io_parms->length); 4907 if (rc) 4908 goto async_writev_out; 4909 4910 flags |= CIFS_HAS_CREDITS; 4911 } 4912 4913 kref_get(&wdata->refcount); 4914 rc = cifs_call_async(server, &rqst, NULL, smb2_writev_callback, NULL, 4915 wdata, flags, &wdata->credits); 4916 4917 if (rc) { 4918 trace_smb3_write_err(0 /* no xid */, 4919 io_parms->persistent_fid, 4920 io_parms->tcon->tid, 4921 io_parms->tcon->ses->Suid, 4922 io_parms->offset, 4923 io_parms->length, 4924 rc); 4925 kref_put(&wdata->refcount, release); 4926 cifs_stats_fail_inc(tcon, SMB2_WRITE_HE); 4927 } 4928 4929 async_writev_out: 4930 cifs_small_buf_release(req); 4931 return rc; 4932 } 4933 4934 /* 4935 * SMB2_write function gets iov pointer to kvec array with n_vec as a length. 4936 * The length field from io_parms must be at least 1 and indicates a number of 4937 * elements with data to write that begins with position 1 in iov array. All 4938 * data length is specified by count. 4939 */ 4940 int 4941 SMB2_write(const unsigned int xid, struct cifs_io_parms *io_parms, 4942 unsigned int *nbytes, struct kvec *iov, int n_vec) 4943 { 4944 struct smb_rqst rqst; 4945 int rc = 0; 4946 struct smb2_write_req *req = NULL; 4947 struct smb2_write_rsp *rsp = NULL; 4948 int resp_buftype; 4949 struct kvec rsp_iov; 4950 int flags = 0; 4951 unsigned int total_len; 4952 struct TCP_Server_Info *server; 4953 int retries = 0, cur_sleep = 1; 4954 4955 replay_again: 4956 /* reinitialize for possible replay */ 4957 flags = 0; 4958 *nbytes = 0; 4959 if (!io_parms->server) 4960 io_parms->server = cifs_pick_channel(io_parms->tcon->ses); 4961 server = io_parms->server; 4962 if (server == NULL) 4963 return -ECONNABORTED; 4964 4965 if (n_vec < 1) 4966 return rc; 4967 4968 rc = smb2_plain_req_init(SMB2_WRITE, io_parms->tcon, server, 4969 (void **) &req, &total_len); 4970 if (rc) 4971 return rc; 4972 4973 if (smb3_encryption_required(io_parms->tcon)) 4974 flags |= CIFS_TRANSFORM_REQ; 4975 4976 req->hdr.Id.SyncId.ProcessId = cpu_to_le32(io_parms->pid); 4977 4978 req->PersistentFileId = io_parms->persistent_fid; 4979 req->VolatileFileId = io_parms->volatile_fid; 4980 req->WriteChannelInfoOffset = 0; 4981 req->WriteChannelInfoLength = 0; 4982 req->Channel = 0; 4983 req->Length = cpu_to_le32(io_parms->length); 4984 req->Offset = cpu_to_le64(io_parms->offset); 4985 req->DataOffset = cpu_to_le16( 4986 offsetof(struct smb2_write_req, Buffer)); 4987 req->RemainingBytes = 0; 4988 4989 trace_smb3_write_enter(xid, io_parms->persistent_fid, 4990 io_parms->tcon->tid, io_parms->tcon->ses->Suid, 4991 io_parms->offset, io_parms->length); 4992 4993 iov[0].iov_base = (char *)req; 4994 /* 1 for Buffer */ 4995 iov[0].iov_len = total_len - 1; 4996 4997 memset(&rqst, 0, sizeof(struct smb_rqst)); 4998 rqst.rq_iov = iov; 4999 rqst.rq_nvec = n_vec + 1; 5000 5001 if (retries) 5002 smb2_set_replay(server, &rqst); 5003 5004 rc = cifs_send_recv(xid, io_parms->tcon->ses, server, 5005 &rqst, 5006 &resp_buftype, flags, &rsp_iov); 5007 rsp = (struct smb2_write_rsp *)rsp_iov.iov_base; 5008 5009 if (rc) { 5010 trace_smb3_write_err(xid, 5011 req->PersistentFileId, 5012 io_parms->tcon->tid, 5013 io_parms->tcon->ses->Suid, 5014 io_parms->offset, io_parms->length, rc); 5015 cifs_stats_fail_inc(io_parms->tcon, SMB2_WRITE_HE); 5016 cifs_dbg(VFS, "Send error in write = %d\n", rc); 5017 } else { 5018 *nbytes = le32_to_cpu(rsp->DataLength); 5019 trace_smb3_write_done(xid, 5020 req->PersistentFileId, 5021 io_parms->tcon->tid, 5022 io_parms->tcon->ses->Suid, 5023 io_parms->offset, *nbytes); 5024 } 5025 5026 cifs_small_buf_release(req); 5027 free_rsp_buf(resp_buftype, rsp); 5028 5029 if (is_replayable_error(rc) && 5030 smb2_should_replay(io_parms->tcon, &retries, &cur_sleep)) 5031 goto replay_again; 5032 5033 return rc; 5034 } 5035 5036 int posix_info_sid_size(const void *beg, const void *end) 5037 { 5038 size_t subauth; 5039 int total; 5040 5041 if (beg + 1 > end) 5042 return -1; 5043 5044 subauth = *(u8 *)(beg+1); 5045 if (subauth < 1 || subauth > 15) 5046 return -1; 5047 5048 total = 1 + 1 + 6 + 4*subauth; 5049 if (beg + total > end) 5050 return -1; 5051 5052 return total; 5053 } 5054 5055 int posix_info_parse(const void *beg, const void *end, 5056 struct smb2_posix_info_parsed *out) 5057 5058 { 5059 int total_len = 0; 5060 int owner_len, group_len; 5061 int name_len; 5062 const void *owner_sid; 5063 const void *group_sid; 5064 const void *name; 5065 5066 /* if no end bound given, assume payload to be correct */ 5067 if (!end) { 5068 const struct smb2_posix_info *p = beg; 5069 5070 end = beg + le32_to_cpu(p->NextEntryOffset); 5071 /* last element will have a 0 offset, pick a sensible bound */ 5072 if (end == beg) 5073 end += 0xFFFF; 5074 } 5075 5076 /* check base buf */ 5077 if (beg + sizeof(struct smb2_posix_info) > end) 5078 return -1; 5079 total_len = sizeof(struct smb2_posix_info); 5080 5081 /* check owner sid */ 5082 owner_sid = beg + total_len; 5083 owner_len = posix_info_sid_size(owner_sid, end); 5084 if (owner_len < 0) 5085 return -1; 5086 total_len += owner_len; 5087 5088 /* check group sid */ 5089 group_sid = beg + total_len; 5090 group_len = posix_info_sid_size(group_sid, end); 5091 if (group_len < 0) 5092 return -1; 5093 total_len += group_len; 5094 5095 /* check name len */ 5096 if (beg + total_len + 4 > end) 5097 return -1; 5098 name_len = le32_to_cpu(*(__le32 *)(beg + total_len)); 5099 if (name_len < 1 || name_len > 0xFFFF) 5100 return -1; 5101 total_len += 4; 5102 5103 /* check name */ 5104 name = beg + total_len; 5105 if (name + name_len > end) 5106 return -1; 5107 total_len += name_len; 5108 5109 if (out) { 5110 out->base = beg; 5111 out->size = total_len; 5112 out->name_len = name_len; 5113 out->name = name; 5114 memcpy(&out->owner, owner_sid, owner_len); 5115 memcpy(&out->group, group_sid, group_len); 5116 } 5117 return total_len; 5118 } 5119 5120 static int posix_info_extra_size(const void *beg, const void *end) 5121 { 5122 int len = posix_info_parse(beg, end, NULL); 5123 5124 if (len < 0) 5125 return -1; 5126 return len - sizeof(struct smb2_posix_info); 5127 } 5128 5129 static unsigned int 5130 num_entries(int infotype, char *bufstart, char *end_of_buf, char **lastentry, 5131 size_t size) 5132 { 5133 int len; 5134 unsigned int entrycount = 0; 5135 unsigned int next_offset = 0; 5136 char *entryptr; 5137 FILE_DIRECTORY_INFO *dir_info; 5138 5139 if (bufstart == NULL) 5140 return 0; 5141 5142 entryptr = bufstart; 5143 5144 while (1) { 5145 if (entryptr + next_offset < entryptr || 5146 entryptr + next_offset > end_of_buf || 5147 entryptr + next_offset + size > end_of_buf) { 5148 cifs_dbg(VFS, "malformed search entry would overflow\n"); 5149 break; 5150 } 5151 5152 entryptr = entryptr + next_offset; 5153 dir_info = (FILE_DIRECTORY_INFO *)entryptr; 5154 5155 if (infotype == SMB_FIND_FILE_POSIX_INFO) 5156 len = posix_info_extra_size(entryptr, end_of_buf); 5157 else 5158 len = le32_to_cpu(dir_info->FileNameLength); 5159 5160 if (len < 0 || 5161 entryptr + len < entryptr || 5162 entryptr + len > end_of_buf || 5163 entryptr + len + size > end_of_buf) { 5164 cifs_dbg(VFS, "directory entry name would overflow frame end of buf %p\n", 5165 end_of_buf); 5166 break; 5167 } 5168 5169 *lastentry = entryptr; 5170 entrycount++; 5171 5172 next_offset = le32_to_cpu(dir_info->NextEntryOffset); 5173 if (!next_offset) 5174 break; 5175 } 5176 5177 return entrycount; 5178 } 5179 5180 /* 5181 * Readdir/FindFirst 5182 */ 5183 int SMB2_query_directory_init(const unsigned int xid, 5184 struct cifs_tcon *tcon, 5185 struct TCP_Server_Info *server, 5186 struct smb_rqst *rqst, 5187 u64 persistent_fid, u64 volatile_fid, 5188 int index, int info_level) 5189 { 5190 struct smb2_query_directory_req *req; 5191 unsigned char *bufptr; 5192 __le16 asteriks = cpu_to_le16('*'); 5193 unsigned int output_size = CIFSMaxBufSize - 5194 MAX_SMB2_CREATE_RESPONSE_SIZE - 5195 MAX_SMB2_CLOSE_RESPONSE_SIZE; 5196 unsigned int total_len; 5197 struct kvec *iov = rqst->rq_iov; 5198 int len, rc; 5199 5200 rc = smb2_plain_req_init(SMB2_QUERY_DIRECTORY, tcon, server, 5201 (void **) &req, &total_len); 5202 if (rc) 5203 return rc; 5204 5205 switch (info_level) { 5206 case SMB_FIND_FILE_DIRECTORY_INFO: 5207 req->FileInformationClass = FILE_DIRECTORY_INFORMATION; 5208 break; 5209 case SMB_FIND_FILE_ID_FULL_DIR_INFO: 5210 req->FileInformationClass = FILEID_FULL_DIRECTORY_INFORMATION; 5211 break; 5212 case SMB_FIND_FILE_POSIX_INFO: 5213 req->FileInformationClass = SMB_FIND_FILE_POSIX_INFO; 5214 break; 5215 case SMB_FIND_FILE_FULL_DIRECTORY_INFO: 5216 req->FileInformationClass = FILE_FULL_DIRECTORY_INFORMATION; 5217 break; 5218 default: 5219 cifs_tcon_dbg(VFS, "info level %u isn't supported\n", 5220 info_level); 5221 return -EINVAL; 5222 } 5223 5224 req->FileIndex = cpu_to_le32(index); 5225 req->PersistentFileId = persistent_fid; 5226 req->VolatileFileId = volatile_fid; 5227 5228 len = 0x2; 5229 bufptr = req->Buffer; 5230 memcpy(bufptr, &asteriks, len); 5231 5232 req->FileNameOffset = 5233 cpu_to_le16(sizeof(struct smb2_query_directory_req)); 5234 req->FileNameLength = cpu_to_le16(len); 5235 /* 5236 * BB could be 30 bytes or so longer if we used SMB2 specific 5237 * buffer lengths, but this is safe and close enough. 5238 */ 5239 output_size = min_t(unsigned int, output_size, server->maxBuf); 5240 output_size = min_t(unsigned int, output_size, 2 << 15); 5241 req->OutputBufferLength = cpu_to_le32(output_size); 5242 5243 iov[0].iov_base = (char *)req; 5244 /* 1 for Buffer */ 5245 iov[0].iov_len = total_len - 1; 5246 5247 iov[1].iov_base = (char *)(req->Buffer); 5248 iov[1].iov_len = len; 5249 5250 trace_smb3_query_dir_enter(xid, persistent_fid, tcon->tid, 5251 tcon->ses->Suid, index, output_size); 5252 5253 return 0; 5254 } 5255 5256 void SMB2_query_directory_free(struct smb_rqst *rqst) 5257 { 5258 if (rqst && rqst->rq_iov) { 5259 cifs_small_buf_release(rqst->rq_iov[0].iov_base); /* request */ 5260 } 5261 } 5262 5263 int 5264 smb2_parse_query_directory(struct cifs_tcon *tcon, 5265 struct kvec *rsp_iov, 5266 int resp_buftype, 5267 struct cifs_search_info *srch_inf) 5268 { 5269 struct smb2_query_directory_rsp *rsp; 5270 size_t info_buf_size; 5271 char *end_of_smb; 5272 int rc; 5273 5274 rsp = (struct smb2_query_directory_rsp *)rsp_iov->iov_base; 5275 5276 switch (srch_inf->info_level) { 5277 case SMB_FIND_FILE_DIRECTORY_INFO: 5278 info_buf_size = sizeof(FILE_DIRECTORY_INFO); 5279 break; 5280 case SMB_FIND_FILE_ID_FULL_DIR_INFO: 5281 info_buf_size = sizeof(SEARCH_ID_FULL_DIR_INFO); 5282 break; 5283 case SMB_FIND_FILE_POSIX_INFO: 5284 /* note that posix payload are variable size */ 5285 info_buf_size = sizeof(struct smb2_posix_info); 5286 break; 5287 case SMB_FIND_FILE_FULL_DIRECTORY_INFO: 5288 info_buf_size = sizeof(FILE_FULL_DIRECTORY_INFO); 5289 break; 5290 default: 5291 cifs_tcon_dbg(VFS, "info level %u isn't supported\n", 5292 srch_inf->info_level); 5293 return -EINVAL; 5294 } 5295 5296 rc = smb2_validate_iov(le16_to_cpu(rsp->OutputBufferOffset), 5297 le32_to_cpu(rsp->OutputBufferLength), rsp_iov, 5298 info_buf_size); 5299 if (rc) { 5300 cifs_tcon_dbg(VFS, "bad info payload"); 5301 return rc; 5302 } 5303 5304 srch_inf->unicode = true; 5305 5306 if (srch_inf->ntwrk_buf_start) { 5307 if (srch_inf->smallBuf) 5308 cifs_small_buf_release(srch_inf->ntwrk_buf_start); 5309 else 5310 cifs_buf_release(srch_inf->ntwrk_buf_start); 5311 } 5312 srch_inf->ntwrk_buf_start = (char *)rsp; 5313 srch_inf->srch_entries_start = srch_inf->last_entry = 5314 (char *)rsp + le16_to_cpu(rsp->OutputBufferOffset); 5315 end_of_smb = rsp_iov->iov_len + (char *)rsp; 5316 5317 srch_inf->entries_in_buffer = num_entries( 5318 srch_inf->info_level, 5319 srch_inf->srch_entries_start, 5320 end_of_smb, 5321 &srch_inf->last_entry, 5322 info_buf_size); 5323 5324 srch_inf->index_of_last_entry += srch_inf->entries_in_buffer; 5325 cifs_dbg(FYI, "num entries %d last_index %lld srch start %p srch end %p\n", 5326 srch_inf->entries_in_buffer, srch_inf->index_of_last_entry, 5327 srch_inf->srch_entries_start, srch_inf->last_entry); 5328 if (resp_buftype == CIFS_LARGE_BUFFER) 5329 srch_inf->smallBuf = false; 5330 else if (resp_buftype == CIFS_SMALL_BUFFER) 5331 srch_inf->smallBuf = true; 5332 else 5333 cifs_tcon_dbg(VFS, "Invalid search buffer type\n"); 5334 5335 return 0; 5336 } 5337 5338 int 5339 SMB2_query_directory(const unsigned int xid, struct cifs_tcon *tcon, 5340 u64 persistent_fid, u64 volatile_fid, int index, 5341 struct cifs_search_info *srch_inf) 5342 { 5343 struct smb_rqst rqst; 5344 struct kvec iov[SMB2_QUERY_DIRECTORY_IOV_SIZE]; 5345 struct smb2_query_directory_rsp *rsp = NULL; 5346 int resp_buftype = CIFS_NO_BUFFER; 5347 struct kvec rsp_iov; 5348 int rc = 0; 5349 struct cifs_ses *ses = tcon->ses; 5350 struct TCP_Server_Info *server; 5351 int flags = 0; 5352 int retries = 0, cur_sleep = 1; 5353 5354 replay_again: 5355 /* reinitialize for possible replay */ 5356 flags = 0; 5357 server = cifs_pick_channel(ses); 5358 5359 if (!ses || !(ses->server)) 5360 return -EIO; 5361 5362 if (smb3_encryption_required(tcon)) 5363 flags |= CIFS_TRANSFORM_REQ; 5364 5365 memset(&rqst, 0, sizeof(struct smb_rqst)); 5366 memset(&iov, 0, sizeof(iov)); 5367 rqst.rq_iov = iov; 5368 rqst.rq_nvec = SMB2_QUERY_DIRECTORY_IOV_SIZE; 5369 5370 rc = SMB2_query_directory_init(xid, tcon, server, 5371 &rqst, persistent_fid, 5372 volatile_fid, index, 5373 srch_inf->info_level); 5374 if (rc) 5375 goto qdir_exit; 5376 5377 if (retries) 5378 smb2_set_replay(server, &rqst); 5379 5380 rc = cifs_send_recv(xid, ses, server, 5381 &rqst, &resp_buftype, flags, &rsp_iov); 5382 rsp = (struct smb2_query_directory_rsp *)rsp_iov.iov_base; 5383 5384 if (rc) { 5385 if (rc == -ENODATA && 5386 rsp->hdr.Status == STATUS_NO_MORE_FILES) { 5387 trace_smb3_query_dir_done(xid, persistent_fid, 5388 tcon->tid, tcon->ses->Suid, index, 0); 5389 srch_inf->endOfSearch = true; 5390 rc = 0; 5391 } else { 5392 trace_smb3_query_dir_err(xid, persistent_fid, tcon->tid, 5393 tcon->ses->Suid, index, 0, rc); 5394 cifs_stats_fail_inc(tcon, SMB2_QUERY_DIRECTORY_HE); 5395 } 5396 goto qdir_exit; 5397 } 5398 5399 rc = smb2_parse_query_directory(tcon, &rsp_iov, resp_buftype, 5400 srch_inf); 5401 if (rc) { 5402 trace_smb3_query_dir_err(xid, persistent_fid, tcon->tid, 5403 tcon->ses->Suid, index, 0, rc); 5404 goto qdir_exit; 5405 } 5406 resp_buftype = CIFS_NO_BUFFER; 5407 5408 trace_smb3_query_dir_done(xid, persistent_fid, tcon->tid, 5409 tcon->ses->Suid, index, srch_inf->entries_in_buffer); 5410 5411 qdir_exit: 5412 SMB2_query_directory_free(&rqst); 5413 free_rsp_buf(resp_buftype, rsp); 5414 5415 if (is_replayable_error(rc) && 5416 smb2_should_replay(tcon, &retries, &cur_sleep)) 5417 goto replay_again; 5418 5419 return rc; 5420 } 5421 5422 int 5423 SMB2_set_info_init(struct cifs_tcon *tcon, struct TCP_Server_Info *server, 5424 struct smb_rqst *rqst, 5425 u64 persistent_fid, u64 volatile_fid, u32 pid, 5426 u8 info_class, u8 info_type, u32 additional_info, 5427 void **data, unsigned int *size) 5428 { 5429 struct smb2_set_info_req *req; 5430 struct kvec *iov = rqst->rq_iov; 5431 unsigned int i, total_len; 5432 int rc; 5433 5434 rc = smb2_plain_req_init(SMB2_SET_INFO, tcon, server, 5435 (void **) &req, &total_len); 5436 if (rc) 5437 return rc; 5438 5439 req->hdr.Id.SyncId.ProcessId = cpu_to_le32(pid); 5440 req->InfoType = info_type; 5441 req->FileInfoClass = info_class; 5442 req->PersistentFileId = persistent_fid; 5443 req->VolatileFileId = volatile_fid; 5444 req->AdditionalInformation = cpu_to_le32(additional_info); 5445 5446 req->BufferOffset = cpu_to_le16(sizeof(struct smb2_set_info_req)); 5447 req->BufferLength = cpu_to_le32(*size); 5448 5449 memcpy(req->Buffer, *data, *size); 5450 total_len += *size; 5451 5452 iov[0].iov_base = (char *)req; 5453 /* 1 for Buffer */ 5454 iov[0].iov_len = total_len - 1; 5455 5456 for (i = 1; i < rqst->rq_nvec; i++) { 5457 le32_add_cpu(&req->BufferLength, size[i]); 5458 iov[i].iov_base = (char *)data[i]; 5459 iov[i].iov_len = size[i]; 5460 } 5461 5462 return 0; 5463 } 5464 5465 void 5466 SMB2_set_info_free(struct smb_rqst *rqst) 5467 { 5468 if (rqst && rqst->rq_iov) 5469 cifs_buf_release(rqst->rq_iov[0].iov_base); /* request */ 5470 } 5471 5472 static int 5473 send_set_info(const unsigned int xid, struct cifs_tcon *tcon, 5474 u64 persistent_fid, u64 volatile_fid, u32 pid, u8 info_class, 5475 u8 info_type, u32 additional_info, unsigned int num, 5476 void **data, unsigned int *size) 5477 { 5478 struct smb_rqst rqst; 5479 struct smb2_set_info_rsp *rsp = NULL; 5480 struct kvec *iov; 5481 struct kvec rsp_iov; 5482 int rc = 0; 5483 int resp_buftype; 5484 struct cifs_ses *ses = tcon->ses; 5485 struct TCP_Server_Info *server; 5486 int flags = 0; 5487 int retries = 0, cur_sleep = 1; 5488 5489 replay_again: 5490 /* reinitialize for possible replay */ 5491 flags = 0; 5492 server = cifs_pick_channel(ses); 5493 5494 if (!ses || !server) 5495 return -EIO; 5496 5497 if (!num) 5498 return -EINVAL; 5499 5500 if (smb3_encryption_required(tcon)) 5501 flags |= CIFS_TRANSFORM_REQ; 5502 5503 iov = kmalloc_array(num, sizeof(struct kvec), GFP_KERNEL); 5504 if (!iov) 5505 return -ENOMEM; 5506 5507 memset(&rqst, 0, sizeof(struct smb_rqst)); 5508 rqst.rq_iov = iov; 5509 rqst.rq_nvec = num; 5510 5511 rc = SMB2_set_info_init(tcon, server, 5512 &rqst, persistent_fid, volatile_fid, pid, 5513 info_class, info_type, additional_info, 5514 data, size); 5515 if (rc) { 5516 kfree(iov); 5517 return rc; 5518 } 5519 5520 if (retries) 5521 smb2_set_replay(server, &rqst); 5522 5523 rc = cifs_send_recv(xid, ses, server, 5524 &rqst, &resp_buftype, flags, 5525 &rsp_iov); 5526 SMB2_set_info_free(&rqst); 5527 rsp = (struct smb2_set_info_rsp *)rsp_iov.iov_base; 5528 5529 if (rc != 0) { 5530 cifs_stats_fail_inc(tcon, SMB2_SET_INFO_HE); 5531 trace_smb3_set_info_err(xid, persistent_fid, tcon->tid, 5532 ses->Suid, info_class, (__u32)info_type, rc); 5533 } 5534 5535 free_rsp_buf(resp_buftype, rsp); 5536 kfree(iov); 5537 5538 if (is_replayable_error(rc) && 5539 smb2_should_replay(tcon, &retries, &cur_sleep)) 5540 goto replay_again; 5541 5542 return rc; 5543 } 5544 5545 int 5546 SMB2_set_eof(const unsigned int xid, struct cifs_tcon *tcon, u64 persistent_fid, 5547 u64 volatile_fid, u32 pid, loff_t new_eof) 5548 { 5549 struct smb2_file_eof_info info; 5550 void *data; 5551 unsigned int size; 5552 5553 info.EndOfFile = cpu_to_le64(new_eof); 5554 5555 data = &info; 5556 size = sizeof(struct smb2_file_eof_info); 5557 5558 trace_smb3_set_eof(xid, persistent_fid, tcon->tid, tcon->ses->Suid, new_eof); 5559 5560 return send_set_info(xid, tcon, persistent_fid, volatile_fid, 5561 pid, FILE_END_OF_FILE_INFORMATION, SMB2_O_INFO_FILE, 5562 0, 1, &data, &size); 5563 } 5564 5565 int 5566 SMB2_set_acl(const unsigned int xid, struct cifs_tcon *tcon, 5567 u64 persistent_fid, u64 volatile_fid, 5568 struct cifs_ntsd *pnntsd, int pacllen, int aclflag) 5569 { 5570 return send_set_info(xid, tcon, persistent_fid, volatile_fid, 5571 current->tgid, 0, SMB2_O_INFO_SECURITY, aclflag, 5572 1, (void **)&pnntsd, &pacllen); 5573 } 5574 5575 int 5576 SMB2_set_ea(const unsigned int xid, struct cifs_tcon *tcon, 5577 u64 persistent_fid, u64 volatile_fid, 5578 struct smb2_file_full_ea_info *buf, int len) 5579 { 5580 return send_set_info(xid, tcon, persistent_fid, volatile_fid, 5581 current->tgid, FILE_FULL_EA_INFORMATION, SMB2_O_INFO_FILE, 5582 0, 1, (void **)&buf, &len); 5583 } 5584 5585 int 5586 SMB2_oplock_break(const unsigned int xid, struct cifs_tcon *tcon, 5587 const u64 persistent_fid, const u64 volatile_fid, 5588 __u8 oplock_level) 5589 { 5590 struct smb_rqst rqst; 5591 int rc; 5592 struct smb2_oplock_break *req = NULL; 5593 struct cifs_ses *ses = tcon->ses; 5594 struct TCP_Server_Info *server; 5595 int flags = CIFS_OBREAK_OP; 5596 unsigned int total_len; 5597 struct kvec iov[1]; 5598 struct kvec rsp_iov; 5599 int resp_buf_type; 5600 int retries = 0, cur_sleep = 1; 5601 5602 replay_again: 5603 /* reinitialize for possible replay */ 5604 flags = CIFS_OBREAK_OP; 5605 server = cifs_pick_channel(ses); 5606 5607 cifs_dbg(FYI, "SMB2_oplock_break\n"); 5608 rc = smb2_plain_req_init(SMB2_OPLOCK_BREAK, tcon, server, 5609 (void **) &req, &total_len); 5610 if (rc) 5611 return rc; 5612 5613 if (smb3_encryption_required(tcon)) 5614 flags |= CIFS_TRANSFORM_REQ; 5615 5616 req->VolatileFid = volatile_fid; 5617 req->PersistentFid = persistent_fid; 5618 req->OplockLevel = oplock_level; 5619 req->hdr.CreditRequest = cpu_to_le16(1); 5620 5621 flags |= CIFS_NO_RSP_BUF; 5622 5623 iov[0].iov_base = (char *)req; 5624 iov[0].iov_len = total_len; 5625 5626 memset(&rqst, 0, sizeof(struct smb_rqst)); 5627 rqst.rq_iov = iov; 5628 rqst.rq_nvec = 1; 5629 5630 if (retries) 5631 smb2_set_replay(server, &rqst); 5632 5633 rc = cifs_send_recv(xid, ses, server, 5634 &rqst, &resp_buf_type, flags, &rsp_iov); 5635 cifs_small_buf_release(req); 5636 if (rc) { 5637 cifs_stats_fail_inc(tcon, SMB2_OPLOCK_BREAK_HE); 5638 cifs_dbg(FYI, "Send error in Oplock Break = %d\n", rc); 5639 } 5640 5641 if (is_replayable_error(rc) && 5642 smb2_should_replay(tcon, &retries, &cur_sleep)) 5643 goto replay_again; 5644 5645 return rc; 5646 } 5647 5648 void 5649 smb2_copy_fs_info_to_kstatfs(struct smb2_fs_full_size_info *pfs_inf, 5650 struct kstatfs *kst) 5651 { 5652 kst->f_bsize = le32_to_cpu(pfs_inf->BytesPerSector) * 5653 le32_to_cpu(pfs_inf->SectorsPerAllocationUnit); 5654 kst->f_blocks = le64_to_cpu(pfs_inf->TotalAllocationUnits); 5655 kst->f_bfree = kst->f_bavail = 5656 le64_to_cpu(pfs_inf->CallerAvailableAllocationUnits); 5657 return; 5658 } 5659 5660 static void 5661 copy_posix_fs_info_to_kstatfs(FILE_SYSTEM_POSIX_INFO *response_data, 5662 struct kstatfs *kst) 5663 { 5664 kst->f_bsize = le32_to_cpu(response_data->BlockSize); 5665 kst->f_blocks = le64_to_cpu(response_data->TotalBlocks); 5666 kst->f_bfree = le64_to_cpu(response_data->BlocksAvail); 5667 if (response_data->UserBlocksAvail == cpu_to_le64(-1)) 5668 kst->f_bavail = kst->f_bfree; 5669 else 5670 kst->f_bavail = le64_to_cpu(response_data->UserBlocksAvail); 5671 if (response_data->TotalFileNodes != cpu_to_le64(-1)) 5672 kst->f_files = le64_to_cpu(response_data->TotalFileNodes); 5673 if (response_data->FreeFileNodes != cpu_to_le64(-1)) 5674 kst->f_ffree = le64_to_cpu(response_data->FreeFileNodes); 5675 5676 return; 5677 } 5678 5679 static int 5680 build_qfs_info_req(struct kvec *iov, struct cifs_tcon *tcon, 5681 struct TCP_Server_Info *server, 5682 int level, int outbuf_len, u64 persistent_fid, 5683 u64 volatile_fid) 5684 { 5685 int rc; 5686 struct smb2_query_info_req *req; 5687 unsigned int total_len; 5688 5689 cifs_dbg(FYI, "Query FSInfo level %d\n", level); 5690 5691 if ((tcon->ses == NULL) || server == NULL) 5692 return -EIO; 5693 5694 rc = smb2_plain_req_init(SMB2_QUERY_INFO, tcon, server, 5695 (void **) &req, &total_len); 5696 if (rc) 5697 return rc; 5698 5699 req->InfoType = SMB2_O_INFO_FILESYSTEM; 5700 req->FileInfoClass = level; 5701 req->PersistentFileId = persistent_fid; 5702 req->VolatileFileId = volatile_fid; 5703 /* 1 for pad */ 5704 req->InputBufferOffset = 5705 cpu_to_le16(sizeof(struct smb2_query_info_req)); 5706 req->OutputBufferLength = cpu_to_le32( 5707 outbuf_len + sizeof(struct smb2_query_info_rsp)); 5708 5709 iov->iov_base = (char *)req; 5710 iov->iov_len = total_len; 5711 return 0; 5712 } 5713 5714 static inline void free_qfs_info_req(struct kvec *iov) 5715 { 5716 cifs_buf_release(iov->iov_base); 5717 } 5718 5719 int 5720 SMB311_posix_qfs_info(const unsigned int xid, struct cifs_tcon *tcon, 5721 u64 persistent_fid, u64 volatile_fid, struct kstatfs *fsdata) 5722 { 5723 struct smb_rqst rqst; 5724 struct smb2_query_info_rsp *rsp = NULL; 5725 struct kvec iov; 5726 struct kvec rsp_iov; 5727 int rc = 0; 5728 int resp_buftype; 5729 struct cifs_ses *ses = tcon->ses; 5730 struct TCP_Server_Info *server; 5731 FILE_SYSTEM_POSIX_INFO *info = NULL; 5732 int flags = 0; 5733 int retries = 0, cur_sleep = 1; 5734 5735 replay_again: 5736 /* reinitialize for possible replay */ 5737 flags = 0; 5738 server = cifs_pick_channel(ses); 5739 5740 rc = build_qfs_info_req(&iov, tcon, server, 5741 FS_POSIX_INFORMATION, 5742 sizeof(FILE_SYSTEM_POSIX_INFO), 5743 persistent_fid, volatile_fid); 5744 if (rc) 5745 return rc; 5746 5747 if (smb3_encryption_required(tcon)) 5748 flags |= CIFS_TRANSFORM_REQ; 5749 5750 memset(&rqst, 0, sizeof(struct smb_rqst)); 5751 rqst.rq_iov = &iov; 5752 rqst.rq_nvec = 1; 5753 5754 if (retries) 5755 smb2_set_replay(server, &rqst); 5756 5757 rc = cifs_send_recv(xid, ses, server, 5758 &rqst, &resp_buftype, flags, &rsp_iov); 5759 free_qfs_info_req(&iov); 5760 if (rc) { 5761 cifs_stats_fail_inc(tcon, SMB2_QUERY_INFO_HE); 5762 goto posix_qfsinf_exit; 5763 } 5764 rsp = (struct smb2_query_info_rsp *)rsp_iov.iov_base; 5765 5766 info = (FILE_SYSTEM_POSIX_INFO *)( 5767 le16_to_cpu(rsp->OutputBufferOffset) + (char *)rsp); 5768 rc = smb2_validate_iov(le16_to_cpu(rsp->OutputBufferOffset), 5769 le32_to_cpu(rsp->OutputBufferLength), &rsp_iov, 5770 sizeof(FILE_SYSTEM_POSIX_INFO)); 5771 if (!rc) 5772 copy_posix_fs_info_to_kstatfs(info, fsdata); 5773 5774 posix_qfsinf_exit: 5775 free_rsp_buf(resp_buftype, rsp_iov.iov_base); 5776 5777 if (is_replayable_error(rc) && 5778 smb2_should_replay(tcon, &retries, &cur_sleep)) 5779 goto replay_again; 5780 5781 return rc; 5782 } 5783 5784 int 5785 SMB2_QFS_info(const unsigned int xid, struct cifs_tcon *tcon, 5786 u64 persistent_fid, u64 volatile_fid, struct kstatfs *fsdata) 5787 { 5788 struct smb_rqst rqst; 5789 struct smb2_query_info_rsp *rsp = NULL; 5790 struct kvec iov; 5791 struct kvec rsp_iov; 5792 int rc = 0; 5793 int resp_buftype; 5794 struct cifs_ses *ses = tcon->ses; 5795 struct TCP_Server_Info *server; 5796 struct smb2_fs_full_size_info *info = NULL; 5797 int flags = 0; 5798 int retries = 0, cur_sleep = 1; 5799 5800 replay_again: 5801 /* reinitialize for possible replay */ 5802 flags = 0; 5803 server = cifs_pick_channel(ses); 5804 5805 rc = build_qfs_info_req(&iov, tcon, server, 5806 FS_FULL_SIZE_INFORMATION, 5807 sizeof(struct smb2_fs_full_size_info), 5808 persistent_fid, volatile_fid); 5809 if (rc) 5810 return rc; 5811 5812 if (smb3_encryption_required(tcon)) 5813 flags |= CIFS_TRANSFORM_REQ; 5814 5815 memset(&rqst, 0, sizeof(struct smb_rqst)); 5816 rqst.rq_iov = &iov; 5817 rqst.rq_nvec = 1; 5818 5819 if (retries) 5820 smb2_set_replay(server, &rqst); 5821 5822 rc = cifs_send_recv(xid, ses, server, 5823 &rqst, &resp_buftype, flags, &rsp_iov); 5824 free_qfs_info_req(&iov); 5825 if (rc) { 5826 cifs_stats_fail_inc(tcon, SMB2_QUERY_INFO_HE); 5827 goto qfsinf_exit; 5828 } 5829 rsp = (struct smb2_query_info_rsp *)rsp_iov.iov_base; 5830 5831 info = (struct smb2_fs_full_size_info *)( 5832 le16_to_cpu(rsp->OutputBufferOffset) + (char *)rsp); 5833 rc = smb2_validate_iov(le16_to_cpu(rsp->OutputBufferOffset), 5834 le32_to_cpu(rsp->OutputBufferLength), &rsp_iov, 5835 sizeof(struct smb2_fs_full_size_info)); 5836 if (!rc) 5837 smb2_copy_fs_info_to_kstatfs(info, fsdata); 5838 5839 qfsinf_exit: 5840 free_rsp_buf(resp_buftype, rsp_iov.iov_base); 5841 5842 if (is_replayable_error(rc) && 5843 smb2_should_replay(tcon, &retries, &cur_sleep)) 5844 goto replay_again; 5845 5846 return rc; 5847 } 5848 5849 int 5850 SMB2_QFS_attr(const unsigned int xid, struct cifs_tcon *tcon, 5851 u64 persistent_fid, u64 volatile_fid, int level) 5852 { 5853 struct smb_rqst rqst; 5854 struct smb2_query_info_rsp *rsp = NULL; 5855 struct kvec iov; 5856 struct kvec rsp_iov; 5857 int rc = 0; 5858 int resp_buftype, max_len, min_len; 5859 struct cifs_ses *ses = tcon->ses; 5860 struct TCP_Server_Info *server; 5861 unsigned int rsp_len, offset; 5862 int flags = 0; 5863 int retries = 0, cur_sleep = 1; 5864 5865 replay_again: 5866 /* reinitialize for possible replay */ 5867 flags = 0; 5868 server = cifs_pick_channel(ses); 5869 5870 if (level == FS_DEVICE_INFORMATION) { 5871 max_len = sizeof(FILE_SYSTEM_DEVICE_INFO); 5872 min_len = sizeof(FILE_SYSTEM_DEVICE_INFO); 5873 } else if (level == FS_ATTRIBUTE_INFORMATION) { 5874 max_len = sizeof(FILE_SYSTEM_ATTRIBUTE_INFO); 5875 min_len = MIN_FS_ATTR_INFO_SIZE; 5876 } else if (level == FS_SECTOR_SIZE_INFORMATION) { 5877 max_len = sizeof(struct smb3_fs_ss_info); 5878 min_len = sizeof(struct smb3_fs_ss_info); 5879 } else if (level == FS_VOLUME_INFORMATION) { 5880 max_len = sizeof(struct smb3_fs_vol_info) + MAX_VOL_LABEL_LEN; 5881 min_len = sizeof(struct smb3_fs_vol_info); 5882 } else { 5883 cifs_dbg(FYI, "Invalid qfsinfo level %d\n", level); 5884 return -EINVAL; 5885 } 5886 5887 rc = build_qfs_info_req(&iov, tcon, server, 5888 level, max_len, 5889 persistent_fid, volatile_fid); 5890 if (rc) 5891 return rc; 5892 5893 if (smb3_encryption_required(tcon)) 5894 flags |= CIFS_TRANSFORM_REQ; 5895 5896 memset(&rqst, 0, sizeof(struct smb_rqst)); 5897 rqst.rq_iov = &iov; 5898 rqst.rq_nvec = 1; 5899 5900 if (retries) 5901 smb2_set_replay(server, &rqst); 5902 5903 rc = cifs_send_recv(xid, ses, server, 5904 &rqst, &resp_buftype, flags, &rsp_iov); 5905 free_qfs_info_req(&iov); 5906 if (rc) { 5907 cifs_stats_fail_inc(tcon, SMB2_QUERY_INFO_HE); 5908 goto qfsattr_exit; 5909 } 5910 rsp = (struct smb2_query_info_rsp *)rsp_iov.iov_base; 5911 5912 rsp_len = le32_to_cpu(rsp->OutputBufferLength); 5913 offset = le16_to_cpu(rsp->OutputBufferOffset); 5914 rc = smb2_validate_iov(offset, rsp_len, &rsp_iov, min_len); 5915 if (rc) 5916 goto qfsattr_exit; 5917 5918 if (level == FS_ATTRIBUTE_INFORMATION) 5919 memcpy(&tcon->fsAttrInfo, offset 5920 + (char *)rsp, min_t(unsigned int, 5921 rsp_len, max_len)); 5922 else if (level == FS_DEVICE_INFORMATION) 5923 memcpy(&tcon->fsDevInfo, offset 5924 + (char *)rsp, sizeof(FILE_SYSTEM_DEVICE_INFO)); 5925 else if (level == FS_SECTOR_SIZE_INFORMATION) { 5926 struct smb3_fs_ss_info *ss_info = (struct smb3_fs_ss_info *) 5927 (offset + (char *)rsp); 5928 tcon->ss_flags = le32_to_cpu(ss_info->Flags); 5929 tcon->perf_sector_size = 5930 le32_to_cpu(ss_info->PhysicalBytesPerSectorForPerf); 5931 } else if (level == FS_VOLUME_INFORMATION) { 5932 struct smb3_fs_vol_info *vol_info = (struct smb3_fs_vol_info *) 5933 (offset + (char *)rsp); 5934 tcon->vol_serial_number = vol_info->VolumeSerialNumber; 5935 tcon->vol_create_time = vol_info->VolumeCreationTime; 5936 } 5937 5938 qfsattr_exit: 5939 free_rsp_buf(resp_buftype, rsp_iov.iov_base); 5940 5941 if (is_replayable_error(rc) && 5942 smb2_should_replay(tcon, &retries, &cur_sleep)) 5943 goto replay_again; 5944 5945 return rc; 5946 } 5947 5948 int 5949 smb2_lockv(const unsigned int xid, struct cifs_tcon *tcon, 5950 const __u64 persist_fid, const __u64 volatile_fid, const __u32 pid, 5951 const __u32 num_lock, struct smb2_lock_element *buf) 5952 { 5953 struct smb_rqst rqst; 5954 int rc = 0; 5955 struct smb2_lock_req *req = NULL; 5956 struct kvec iov[2]; 5957 struct kvec rsp_iov; 5958 int resp_buf_type; 5959 unsigned int count; 5960 int flags = CIFS_NO_RSP_BUF; 5961 unsigned int total_len; 5962 struct TCP_Server_Info *server; 5963 int retries = 0, cur_sleep = 1; 5964 5965 replay_again: 5966 /* reinitialize for possible replay */ 5967 flags = CIFS_NO_RSP_BUF; 5968 server = cifs_pick_channel(tcon->ses); 5969 5970 cifs_dbg(FYI, "smb2_lockv num lock %d\n", num_lock); 5971 5972 rc = smb2_plain_req_init(SMB2_LOCK, tcon, server, 5973 (void **) &req, &total_len); 5974 if (rc) 5975 return rc; 5976 5977 if (smb3_encryption_required(tcon)) 5978 flags |= CIFS_TRANSFORM_REQ; 5979 5980 req->hdr.Id.SyncId.ProcessId = cpu_to_le32(pid); 5981 req->LockCount = cpu_to_le16(num_lock); 5982 5983 req->PersistentFileId = persist_fid; 5984 req->VolatileFileId = volatile_fid; 5985 5986 count = num_lock * sizeof(struct smb2_lock_element); 5987 5988 iov[0].iov_base = (char *)req; 5989 iov[0].iov_len = total_len - sizeof(struct smb2_lock_element); 5990 iov[1].iov_base = (char *)buf; 5991 iov[1].iov_len = count; 5992 5993 cifs_stats_inc(&tcon->stats.cifs_stats.num_locks); 5994 5995 memset(&rqst, 0, sizeof(struct smb_rqst)); 5996 rqst.rq_iov = iov; 5997 rqst.rq_nvec = 2; 5998 5999 if (retries) 6000 smb2_set_replay(server, &rqst); 6001 6002 rc = cifs_send_recv(xid, tcon->ses, server, 6003 &rqst, &resp_buf_type, flags, 6004 &rsp_iov); 6005 cifs_small_buf_release(req); 6006 if (rc) { 6007 cifs_dbg(FYI, "Send error in smb2_lockv = %d\n", rc); 6008 cifs_stats_fail_inc(tcon, SMB2_LOCK_HE); 6009 trace_smb3_lock_err(xid, persist_fid, tcon->tid, 6010 tcon->ses->Suid, rc); 6011 } 6012 6013 if (is_replayable_error(rc) && 6014 smb2_should_replay(tcon, &retries, &cur_sleep)) 6015 goto replay_again; 6016 6017 return rc; 6018 } 6019 6020 int 6021 SMB2_lock(const unsigned int xid, struct cifs_tcon *tcon, 6022 const __u64 persist_fid, const __u64 volatile_fid, const __u32 pid, 6023 const __u64 length, const __u64 offset, const __u32 lock_flags, 6024 const bool wait) 6025 { 6026 struct smb2_lock_element lock; 6027 6028 lock.Offset = cpu_to_le64(offset); 6029 lock.Length = cpu_to_le64(length); 6030 lock.Flags = cpu_to_le32(lock_flags); 6031 if (!wait && lock_flags != SMB2_LOCKFLAG_UNLOCK) 6032 lock.Flags |= cpu_to_le32(SMB2_LOCKFLAG_FAIL_IMMEDIATELY); 6033 6034 return smb2_lockv(xid, tcon, persist_fid, volatile_fid, pid, 1, &lock); 6035 } 6036 6037 int 6038 SMB2_lease_break(const unsigned int xid, struct cifs_tcon *tcon, 6039 __u8 *lease_key, const __le32 lease_state) 6040 { 6041 struct smb_rqst rqst; 6042 int rc; 6043 struct smb2_lease_ack *req = NULL; 6044 struct cifs_ses *ses = tcon->ses; 6045 int flags = CIFS_OBREAK_OP; 6046 unsigned int total_len; 6047 struct kvec iov[1]; 6048 struct kvec rsp_iov; 6049 int resp_buf_type; 6050 __u64 *please_key_high; 6051 __u64 *please_key_low; 6052 struct TCP_Server_Info *server = cifs_pick_channel(tcon->ses); 6053 6054 cifs_dbg(FYI, "SMB2_lease_break\n"); 6055 rc = smb2_plain_req_init(SMB2_OPLOCK_BREAK, tcon, server, 6056 (void **) &req, &total_len); 6057 if (rc) 6058 return rc; 6059 6060 if (smb3_encryption_required(tcon)) 6061 flags |= CIFS_TRANSFORM_REQ; 6062 6063 req->hdr.CreditRequest = cpu_to_le16(1); 6064 req->StructureSize = cpu_to_le16(36); 6065 total_len += 12; 6066 6067 memcpy(req->LeaseKey, lease_key, 16); 6068 req->LeaseState = lease_state; 6069 6070 flags |= CIFS_NO_RSP_BUF; 6071 6072 iov[0].iov_base = (char *)req; 6073 iov[0].iov_len = total_len; 6074 6075 memset(&rqst, 0, sizeof(struct smb_rqst)); 6076 rqst.rq_iov = iov; 6077 rqst.rq_nvec = 1; 6078 6079 rc = cifs_send_recv(xid, ses, server, 6080 &rqst, &resp_buf_type, flags, &rsp_iov); 6081 cifs_small_buf_release(req); 6082 6083 please_key_low = (__u64 *)lease_key; 6084 please_key_high = (__u64 *)(lease_key+8); 6085 if (rc) { 6086 cifs_stats_fail_inc(tcon, SMB2_OPLOCK_BREAK_HE); 6087 trace_smb3_lease_err(le32_to_cpu(lease_state), tcon->tid, 6088 ses->Suid, *please_key_low, *please_key_high, rc); 6089 cifs_dbg(FYI, "Send error in Lease Break = %d\n", rc); 6090 } else 6091 trace_smb3_lease_done(le32_to_cpu(lease_state), tcon->tid, 6092 ses->Suid, *please_key_low, *please_key_high); 6093 6094 return rc; 6095 } 6096