xref: /linux/fs/smb/client/smb2pdu.c (revision eb01fe7abbe2d0b38824d2a93fdb4cc3eaf2ccc1)
1 // SPDX-License-Identifier: LGPL-2.1
2 /*
3  *
4  *   Copyright (C) International Business Machines  Corp., 2009, 2013
5  *                 Etersoft, 2012
6  *   Author(s): Steve French (sfrench@us.ibm.com)
7  *              Pavel Shilovsky (pshilovsky@samba.org) 2012
8  *
9  *   Contains the routines for constructing the SMB2 PDUs themselves
10  *
11  */
12 
13  /* SMB2 PDU handling routines here - except for leftovers (eg session setup) */
14  /* Note that there are handle based routines which must be		      */
15  /* treated slightly differently for reconnection purposes since we never     */
16  /* want to reuse a stale file handle and only the caller knows the file info */
17 
18 #include <linux/fs.h>
19 #include <linux/kernel.h>
20 #include <linux/vfs.h>
21 #include <linux/task_io_accounting_ops.h>
22 #include <linux/uaccess.h>
23 #include <linux/uuid.h>
24 #include <linux/pagemap.h>
25 #include <linux/xattr.h>
26 #include "cifsglob.h"
27 #include "cifsacl.h"
28 #include "cifsproto.h"
29 #include "smb2proto.h"
30 #include "cifs_unicode.h"
31 #include "cifs_debug.h"
32 #include "ntlmssp.h"
33 #include "smb2status.h"
34 #include "smb2glob.h"
35 #include "cifspdu.h"
36 #include "cifs_spnego.h"
37 #include "smbdirect.h"
38 #include "trace.h"
39 #ifdef CONFIG_CIFS_DFS_UPCALL
40 #include "dfs_cache.h"
41 #endif
42 #include "cached_dir.h"
43 
44 /*
45  *  The following table defines the expected "StructureSize" of SMB2 requests
46  *  in order by SMB2 command.  This is similar to "wct" in SMB/CIFS requests.
47  *
48  *  Note that commands are defined in smb2pdu.h in le16 but the array below is
49  *  indexed by command in host byte order.
50  */
51 static const int smb2_req_struct_sizes[NUMBER_OF_SMB2_COMMANDS] = {
52 	/* SMB2_NEGOTIATE */ 36,
53 	/* SMB2_SESSION_SETUP */ 25,
54 	/* SMB2_LOGOFF */ 4,
55 	/* SMB2_TREE_CONNECT */	9,
56 	/* SMB2_TREE_DISCONNECT */ 4,
57 	/* SMB2_CREATE */ 57,
58 	/* SMB2_CLOSE */ 24,
59 	/* SMB2_FLUSH */ 24,
60 	/* SMB2_READ */	49,
61 	/* SMB2_WRITE */ 49,
62 	/* SMB2_LOCK */	48,
63 	/* SMB2_IOCTL */ 57,
64 	/* SMB2_CANCEL */ 4,
65 	/* SMB2_ECHO */ 4,
66 	/* SMB2_QUERY_DIRECTORY */ 33,
67 	/* SMB2_CHANGE_NOTIFY */ 32,
68 	/* SMB2_QUERY_INFO */ 41,
69 	/* SMB2_SET_INFO */ 33,
70 	/* SMB2_OPLOCK_BREAK */ 24 /* BB this is 36 for LEASE_BREAK variant */
71 };
72 
73 int smb3_encryption_required(const struct cifs_tcon *tcon)
74 {
75 	if (!tcon || !tcon->ses)
76 		return 0;
77 	if ((tcon->ses->session_flags & SMB2_SESSION_FLAG_ENCRYPT_DATA) ||
78 	    (tcon->share_flags & SHI1005_FLAGS_ENCRYPT_DATA))
79 		return 1;
80 	if (tcon->seal &&
81 	    (tcon->ses->server->capabilities & SMB2_GLOBAL_CAP_ENCRYPTION))
82 		return 1;
83 	return 0;
84 }
85 
86 static void
87 smb2_hdr_assemble(struct smb2_hdr *shdr, __le16 smb2_cmd,
88 		  const struct cifs_tcon *tcon,
89 		  struct TCP_Server_Info *server)
90 {
91 	struct smb3_hdr_req *smb3_hdr;
92 
93 	shdr->ProtocolId = SMB2_PROTO_NUMBER;
94 	shdr->StructureSize = cpu_to_le16(64);
95 	shdr->Command = smb2_cmd;
96 
97 	if (server) {
98 		/* After reconnect SMB3 must set ChannelSequence on subsequent reqs */
99 		if (server->dialect >= SMB30_PROT_ID) {
100 			smb3_hdr = (struct smb3_hdr_req *)shdr;
101 			/*
102 			 * if primary channel is not set yet, use default
103 			 * channel for chan sequence num
104 			 */
105 			if (SERVER_IS_CHAN(server))
106 				smb3_hdr->ChannelSequence =
107 					cpu_to_le16(server->primary_server->channel_sequence_num);
108 			else
109 				smb3_hdr->ChannelSequence =
110 					cpu_to_le16(server->channel_sequence_num);
111 		}
112 		spin_lock(&server->req_lock);
113 		/* Request up to 10 credits but don't go over the limit. */
114 		if (server->credits >= server->max_credits)
115 			shdr->CreditRequest = cpu_to_le16(0);
116 		else
117 			shdr->CreditRequest = cpu_to_le16(
118 				min_t(int, server->max_credits -
119 						server->credits, 10));
120 		spin_unlock(&server->req_lock);
121 	} else {
122 		shdr->CreditRequest = cpu_to_le16(2);
123 	}
124 	shdr->Id.SyncId.ProcessId = cpu_to_le32((__u16)current->tgid);
125 
126 	if (!tcon)
127 		goto out;
128 
129 	/* GLOBAL_CAP_LARGE_MTU will only be set if dialect > SMB2.02 */
130 	/* See sections 2.2.4 and 3.2.4.1.5 of MS-SMB2 */
131 	if (server && (server->capabilities & SMB2_GLOBAL_CAP_LARGE_MTU))
132 		shdr->CreditCharge = cpu_to_le16(1);
133 	/* else CreditCharge MBZ */
134 
135 	shdr->Id.SyncId.TreeId = cpu_to_le32(tcon->tid);
136 	/* Uid is not converted */
137 	if (tcon->ses)
138 		shdr->SessionId = cpu_to_le64(tcon->ses->Suid);
139 
140 	/*
141 	 * If we would set SMB2_FLAGS_DFS_OPERATIONS on open we also would have
142 	 * to pass the path on the Open SMB prefixed by \\server\share.
143 	 * Not sure when we would need to do the augmented path (if ever) and
144 	 * setting this flag breaks the SMB2 open operation since it is
145 	 * illegal to send an empty path name (without \\server\share prefix)
146 	 * when the DFS flag is set in the SMB open header. We could
147 	 * consider setting the flag on all operations other than open
148 	 * but it is safer to net set it for now.
149 	 */
150 /*	if (tcon->share_flags & SHI1005_FLAGS_DFS)
151 		shdr->Flags |= SMB2_FLAGS_DFS_OPERATIONS; */
152 
153 	if (server && server->sign && !smb3_encryption_required(tcon))
154 		shdr->Flags |= SMB2_FLAGS_SIGNED;
155 out:
156 	return;
157 }
158 
159 /* helper function for code reuse */
160 static int
161 cifs_chan_skip_or_disable(struct cifs_ses *ses,
162 			  struct TCP_Server_Info *server,
163 			  bool from_reconnect)
164 {
165 	struct TCP_Server_Info *pserver;
166 	unsigned int chan_index;
167 
168 	if (SERVER_IS_CHAN(server)) {
169 		cifs_dbg(VFS,
170 			"server %s does not support multichannel anymore. Skip secondary channel\n",
171 			 ses->server->hostname);
172 
173 		spin_lock(&ses->chan_lock);
174 		chan_index = cifs_ses_get_chan_index(ses, server);
175 		if (chan_index == CIFS_INVAL_CHAN_INDEX) {
176 			spin_unlock(&ses->chan_lock);
177 			goto skip_terminate;
178 		}
179 
180 		ses->chans[chan_index].server = NULL;
181 		server->terminate = true;
182 		spin_unlock(&ses->chan_lock);
183 
184 		/*
185 		 * the above reference of server by channel
186 		 * needs to be dropped without holding chan_lock
187 		 * as cifs_put_tcp_session takes a higher lock
188 		 * i.e. cifs_tcp_ses_lock
189 		 */
190 		cifs_put_tcp_session(server, from_reconnect);
191 
192 		cifs_signal_cifsd_for_reconnect(server, false);
193 
194 		/* mark primary server as needing reconnect */
195 		pserver = server->primary_server;
196 		cifs_signal_cifsd_for_reconnect(pserver, false);
197 skip_terminate:
198 		return -EHOSTDOWN;
199 	}
200 
201 	cifs_server_dbg(VFS,
202 		"server does not support multichannel anymore. Disable all other channels\n");
203 	cifs_disable_secondary_channels(ses);
204 
205 
206 	return 0;
207 }
208 
209 static int
210 smb2_reconnect(__le16 smb2_command, struct cifs_tcon *tcon,
211 	       struct TCP_Server_Info *server, bool from_reconnect)
212 {
213 	int rc = 0;
214 	struct nls_table *nls_codepage = NULL;
215 	struct cifs_ses *ses;
216 	int xid;
217 
218 	/*
219 	 * SMB2s NegProt, SessSetup, Logoff do not have tcon yet so
220 	 * check for tcp and smb session status done differently
221 	 * for those three - in the calling routine.
222 	 */
223 	if (tcon == NULL)
224 		return 0;
225 
226 	/*
227 	 * Need to also skip SMB2_IOCTL because it is used for checking nested dfs links in
228 	 * cifs_tree_connect().
229 	 */
230 	if (smb2_command == SMB2_TREE_CONNECT || smb2_command == SMB2_IOCTL)
231 		return 0;
232 
233 	spin_lock(&tcon->tc_lock);
234 	if (tcon->status == TID_EXITING) {
235 		/*
236 		 * only tree disconnect allowed when disconnecting ...
237 		 */
238 		if (smb2_command != SMB2_TREE_DISCONNECT) {
239 			spin_unlock(&tcon->tc_lock);
240 			cifs_dbg(FYI, "can not send cmd %d while umounting\n",
241 				 smb2_command);
242 			return -ENODEV;
243 		}
244 	}
245 	spin_unlock(&tcon->tc_lock);
246 
247 	ses = tcon->ses;
248 	if (!ses)
249 		return -EIO;
250 	spin_lock(&ses->ses_lock);
251 	if (ses->ses_status == SES_EXITING) {
252 		spin_unlock(&ses->ses_lock);
253 		return -EIO;
254 	}
255 	spin_unlock(&ses->ses_lock);
256 	if (!ses->server || !server)
257 		return -EIO;
258 
259 	spin_lock(&server->srv_lock);
260 	if (server->tcpStatus == CifsNeedReconnect) {
261 		/*
262 		 * Return to caller for TREE_DISCONNECT and LOGOFF and CLOSE
263 		 * here since they are implicitly done when session drops.
264 		 */
265 		switch (smb2_command) {
266 		/*
267 		 * BB Should we keep oplock break and add flush to exceptions?
268 		 */
269 		case SMB2_TREE_DISCONNECT:
270 		case SMB2_CANCEL:
271 		case SMB2_CLOSE:
272 		case SMB2_OPLOCK_BREAK:
273 			spin_unlock(&server->srv_lock);
274 			return -EAGAIN;
275 		}
276 	}
277 
278 	/* if server is marked for termination, cifsd will cleanup */
279 	if (server->terminate) {
280 		spin_unlock(&server->srv_lock);
281 		return -EHOSTDOWN;
282 	}
283 	spin_unlock(&server->srv_lock);
284 
285 again:
286 	rc = cifs_wait_for_server_reconnect(server, tcon->retry);
287 	if (rc)
288 		return rc;
289 
290 	spin_lock(&ses->chan_lock);
291 	if (!cifs_chan_needs_reconnect(ses, server) && !tcon->need_reconnect) {
292 		spin_unlock(&ses->chan_lock);
293 		return 0;
294 	}
295 	spin_unlock(&ses->chan_lock);
296 	cifs_dbg(FYI, "sess reconnect mask: 0x%lx, tcon reconnect: %d",
297 		 tcon->ses->chans_need_reconnect,
298 		 tcon->need_reconnect);
299 
300 	mutex_lock(&ses->session_mutex);
301 	/*
302 	 * if this is called by delayed work, and the channel has been disabled
303 	 * in parallel, the delayed work can continue to execute in parallel
304 	 * there's a chance that this channel may not exist anymore
305 	 */
306 	spin_lock(&server->srv_lock);
307 	if (server->tcpStatus == CifsExiting) {
308 		spin_unlock(&server->srv_lock);
309 		mutex_unlock(&ses->session_mutex);
310 		rc = -EHOSTDOWN;
311 		goto out;
312 	}
313 
314 	/*
315 	 * Recheck after acquire mutex. If another thread is negotiating
316 	 * and the server never sends an answer the socket will be closed
317 	 * and tcpStatus set to reconnect.
318 	 */
319 	if (server->tcpStatus == CifsNeedReconnect) {
320 		spin_unlock(&server->srv_lock);
321 		mutex_unlock(&ses->session_mutex);
322 
323 		if (tcon->retry)
324 			goto again;
325 
326 		rc = -EHOSTDOWN;
327 		goto out;
328 	}
329 	spin_unlock(&server->srv_lock);
330 
331 	nls_codepage = ses->local_nls;
332 
333 	/*
334 	 * need to prevent multiple threads trying to simultaneously
335 	 * reconnect the same SMB session
336 	 */
337 	spin_lock(&ses->ses_lock);
338 	spin_lock(&ses->chan_lock);
339 	if (!cifs_chan_needs_reconnect(ses, server) &&
340 	    ses->ses_status == SES_GOOD) {
341 		spin_unlock(&ses->chan_lock);
342 		spin_unlock(&ses->ses_lock);
343 		/* this means that we only need to tree connect */
344 		if (tcon->need_reconnect)
345 			goto skip_sess_setup;
346 
347 		mutex_unlock(&ses->session_mutex);
348 		goto out;
349 	}
350 	spin_unlock(&ses->chan_lock);
351 	spin_unlock(&ses->ses_lock);
352 
353 	rc = cifs_negotiate_protocol(0, ses, server);
354 	if (!rc) {
355 		/*
356 		 * if server stopped supporting multichannel
357 		 * and the first channel reconnected, disable all the others.
358 		 */
359 		if (ses->chan_count > 1 &&
360 		    !(server->capabilities & SMB2_GLOBAL_CAP_MULTI_CHANNEL)) {
361 			rc = cifs_chan_skip_or_disable(ses, server,
362 						       from_reconnect);
363 			if (rc) {
364 				mutex_unlock(&ses->session_mutex);
365 				goto out;
366 			}
367 		}
368 
369 		rc = cifs_setup_session(0, ses, server, nls_codepage);
370 		if ((rc == -EACCES) && !tcon->retry) {
371 			mutex_unlock(&ses->session_mutex);
372 			rc = -EHOSTDOWN;
373 			goto failed;
374 		} else if (rc) {
375 			mutex_unlock(&ses->session_mutex);
376 			goto out;
377 		}
378 	} else {
379 		mutex_unlock(&ses->session_mutex);
380 		goto out;
381 	}
382 
383 skip_sess_setup:
384 	if (!tcon->need_reconnect) {
385 		mutex_unlock(&ses->session_mutex);
386 		goto out;
387 	}
388 	cifs_mark_open_files_invalid(tcon);
389 	if (tcon->use_persistent)
390 		tcon->need_reopen_files = true;
391 
392 	rc = cifs_tree_connect(0, tcon, nls_codepage);
393 
394 	cifs_dbg(FYI, "reconnect tcon rc = %d\n", rc);
395 	if (rc) {
396 		/* If sess reconnected but tcon didn't, something strange ... */
397 		mutex_unlock(&ses->session_mutex);
398 		cifs_dbg(VFS, "reconnect tcon failed rc = %d\n", rc);
399 		goto out;
400 	}
401 
402 	spin_lock(&ses->ses_lock);
403 	if (ses->flags & CIFS_SES_FLAG_SCALE_CHANNELS) {
404 		spin_unlock(&ses->ses_lock);
405 		mutex_unlock(&ses->session_mutex);
406 		goto skip_add_channels;
407 	}
408 	ses->flags |= CIFS_SES_FLAG_SCALE_CHANNELS;
409 	spin_unlock(&ses->ses_lock);
410 
411 	if (!rc &&
412 	    (server->capabilities & SMB2_GLOBAL_CAP_MULTI_CHANNEL)) {
413 		mutex_unlock(&ses->session_mutex);
414 
415 		/*
416 		 * query server network interfaces, in case they change
417 		 */
418 		xid = get_xid();
419 		rc = SMB3_request_interfaces(xid, tcon, false);
420 		free_xid(xid);
421 
422 		if (rc == -EOPNOTSUPP && ses->chan_count > 1) {
423 			/*
424 			 * some servers like Azure SMB server do not advertise
425 			 * that multichannel has been disabled with server
426 			 * capabilities, rather return STATUS_NOT_IMPLEMENTED.
427 			 * treat this as server not supporting multichannel
428 			 */
429 
430 			rc = cifs_chan_skip_or_disable(ses, server,
431 						       from_reconnect);
432 			goto skip_add_channels;
433 		} else if (rc)
434 			cifs_dbg(FYI, "%s: failed to query server interfaces: %d\n",
435 				 __func__, rc);
436 
437 		if (ses->chan_max > ses->chan_count &&
438 		    ses->iface_count &&
439 		    !SERVER_IS_CHAN(server)) {
440 			if (ses->chan_count == 1) {
441 				cifs_server_dbg(VFS, "supports multichannel now\n");
442 				queue_delayed_work(cifsiod_wq, &tcon->query_interfaces,
443 						 (SMB_INTERFACE_POLL_INTERVAL * HZ));
444 			}
445 
446 			cifs_try_adding_channels(ses);
447 		}
448 	} else {
449 		mutex_unlock(&ses->session_mutex);
450 	}
451 
452 skip_add_channels:
453 	spin_lock(&ses->ses_lock);
454 	ses->flags &= ~CIFS_SES_FLAG_SCALE_CHANNELS;
455 	spin_unlock(&ses->ses_lock);
456 
457 	if (smb2_command != SMB2_INTERNAL_CMD)
458 		mod_delayed_work(cifsiod_wq, &server->reconnect, 0);
459 
460 	atomic_inc(&tconInfoReconnectCount);
461 out:
462 	/*
463 	 * Check if handle based operation so we know whether we can continue
464 	 * or not without returning to caller to reset file handle.
465 	 */
466 	/*
467 	 * BB Is flush done by server on drop of tcp session? Should we special
468 	 * case it and skip above?
469 	 */
470 	switch (smb2_command) {
471 	case SMB2_FLUSH:
472 	case SMB2_READ:
473 	case SMB2_WRITE:
474 	case SMB2_LOCK:
475 	case SMB2_QUERY_DIRECTORY:
476 	case SMB2_CHANGE_NOTIFY:
477 	case SMB2_QUERY_INFO:
478 	case SMB2_SET_INFO:
479 		rc = -EAGAIN;
480 	}
481 failed:
482 	return rc;
483 }
484 
485 static void
486 fill_small_buf(__le16 smb2_command, struct cifs_tcon *tcon,
487 	       struct TCP_Server_Info *server,
488 	       void *buf,
489 	       unsigned int *total_len)
490 {
491 	struct smb2_pdu *spdu = buf;
492 	/* lookup word count ie StructureSize from table */
493 	__u16 parmsize = smb2_req_struct_sizes[le16_to_cpu(smb2_command)];
494 
495 	/*
496 	 * smaller than SMALL_BUFFER_SIZE but bigger than fixed area of
497 	 * largest operations (Create)
498 	 */
499 	memset(buf, 0, 256);
500 
501 	smb2_hdr_assemble(&spdu->hdr, smb2_command, tcon, server);
502 	spdu->StructureSize2 = cpu_to_le16(parmsize);
503 
504 	*total_len = parmsize + sizeof(struct smb2_hdr);
505 }
506 
507 /*
508  * Allocate and return pointer to an SMB request hdr, and set basic
509  * SMB information in the SMB header. If the return code is zero, this
510  * function must have filled in request_buf pointer.
511  */
512 static int __smb2_plain_req_init(__le16 smb2_command, struct cifs_tcon *tcon,
513 				 struct TCP_Server_Info *server,
514 				 void **request_buf, unsigned int *total_len)
515 {
516 	/* BB eventually switch this to SMB2 specific small buf size */
517 	switch (smb2_command) {
518 	case SMB2_SET_INFO:
519 	case SMB2_QUERY_INFO:
520 		*request_buf = cifs_buf_get();
521 		break;
522 	default:
523 		*request_buf = cifs_small_buf_get();
524 		break;
525 	}
526 	if (*request_buf == NULL) {
527 		/* BB should we add a retry in here if not a writepage? */
528 		return -ENOMEM;
529 	}
530 
531 	fill_small_buf(smb2_command, tcon, server,
532 		       (struct smb2_hdr *)(*request_buf),
533 		       total_len);
534 
535 	if (tcon != NULL) {
536 		uint16_t com_code = le16_to_cpu(smb2_command);
537 		cifs_stats_inc(&tcon->stats.smb2_stats.smb2_com_sent[com_code]);
538 		cifs_stats_inc(&tcon->num_smbs_sent);
539 	}
540 
541 	return 0;
542 }
543 
544 static int smb2_plain_req_init(__le16 smb2_command, struct cifs_tcon *tcon,
545 			       struct TCP_Server_Info *server,
546 			       void **request_buf, unsigned int *total_len)
547 {
548 	int rc;
549 
550 	rc = smb2_reconnect(smb2_command, tcon, server, false);
551 	if (rc)
552 		return rc;
553 
554 	return __smb2_plain_req_init(smb2_command, tcon, server, request_buf,
555 				     total_len);
556 }
557 
558 static int smb2_ioctl_req_init(u32 opcode, struct cifs_tcon *tcon,
559 			       struct TCP_Server_Info *server,
560 			       void **request_buf, unsigned int *total_len)
561 {
562 	/* Skip reconnect only for FSCTL_VALIDATE_NEGOTIATE_INFO IOCTLs */
563 	if (opcode == FSCTL_VALIDATE_NEGOTIATE_INFO) {
564 		return __smb2_plain_req_init(SMB2_IOCTL, tcon, server,
565 					     request_buf, total_len);
566 	}
567 	return smb2_plain_req_init(SMB2_IOCTL, tcon, server,
568 				   request_buf, total_len);
569 }
570 
571 /* For explanation of negotiate contexts see MS-SMB2 section 2.2.3.1 */
572 
573 static void
574 build_preauth_ctxt(struct smb2_preauth_neg_context *pneg_ctxt)
575 {
576 	pneg_ctxt->ContextType = SMB2_PREAUTH_INTEGRITY_CAPABILITIES;
577 	pneg_ctxt->DataLength = cpu_to_le16(38);
578 	pneg_ctxt->HashAlgorithmCount = cpu_to_le16(1);
579 	pneg_ctxt->SaltLength = cpu_to_le16(SMB311_SALT_SIZE);
580 	get_random_bytes(pneg_ctxt->Salt, SMB311_SALT_SIZE);
581 	pneg_ctxt->HashAlgorithms = SMB2_PREAUTH_INTEGRITY_SHA512;
582 }
583 
584 static void
585 build_compression_ctxt(struct smb2_compression_capabilities_context *pneg_ctxt)
586 {
587 	pneg_ctxt->ContextType = SMB2_COMPRESSION_CAPABILITIES;
588 	pneg_ctxt->DataLength =
589 		cpu_to_le16(sizeof(struct smb2_compression_capabilities_context)
590 			  - sizeof(struct smb2_neg_context));
591 	pneg_ctxt->CompressionAlgorithmCount = cpu_to_le16(3);
592 	pneg_ctxt->CompressionAlgorithms[0] = SMB3_COMPRESS_LZ77;
593 	pneg_ctxt->CompressionAlgorithms[1] = SMB3_COMPRESS_LZ77_HUFF;
594 	pneg_ctxt->CompressionAlgorithms[2] = SMB3_COMPRESS_LZNT1;
595 }
596 
597 static unsigned int
598 build_signing_ctxt(struct smb2_signing_capabilities *pneg_ctxt)
599 {
600 	unsigned int ctxt_len = sizeof(struct smb2_signing_capabilities);
601 	unsigned short num_algs = 1; /* number of signing algorithms sent */
602 
603 	pneg_ctxt->ContextType = SMB2_SIGNING_CAPABILITIES;
604 	/*
605 	 * Context Data length must be rounded to multiple of 8 for some servers
606 	 */
607 	pneg_ctxt->DataLength = cpu_to_le16(ALIGN(sizeof(struct smb2_signing_capabilities) -
608 					    sizeof(struct smb2_neg_context) +
609 					    (num_algs * sizeof(u16)), 8));
610 	pneg_ctxt->SigningAlgorithmCount = cpu_to_le16(num_algs);
611 	pneg_ctxt->SigningAlgorithms[0] = cpu_to_le16(SIGNING_ALG_AES_CMAC);
612 
613 	ctxt_len += sizeof(__le16) * num_algs;
614 	ctxt_len = ALIGN(ctxt_len, 8);
615 	return ctxt_len;
616 	/* TBD add SIGNING_ALG_AES_GMAC and/or SIGNING_ALG_HMAC_SHA256 */
617 }
618 
619 static void
620 build_encrypt_ctxt(struct smb2_encryption_neg_context *pneg_ctxt)
621 {
622 	pneg_ctxt->ContextType = SMB2_ENCRYPTION_CAPABILITIES;
623 	if (require_gcm_256) {
624 		pneg_ctxt->DataLength = cpu_to_le16(4); /* Cipher Count + 1 cipher */
625 		pneg_ctxt->CipherCount = cpu_to_le16(1);
626 		pneg_ctxt->Ciphers[0] = SMB2_ENCRYPTION_AES256_GCM;
627 	} else if (enable_gcm_256) {
628 		pneg_ctxt->DataLength = cpu_to_le16(8); /* Cipher Count + 3 ciphers */
629 		pneg_ctxt->CipherCount = cpu_to_le16(3);
630 		pneg_ctxt->Ciphers[0] = SMB2_ENCRYPTION_AES128_GCM;
631 		pneg_ctxt->Ciphers[1] = SMB2_ENCRYPTION_AES256_GCM;
632 		pneg_ctxt->Ciphers[2] = SMB2_ENCRYPTION_AES128_CCM;
633 	} else {
634 		pneg_ctxt->DataLength = cpu_to_le16(6); /* Cipher Count + 2 ciphers */
635 		pneg_ctxt->CipherCount = cpu_to_le16(2);
636 		pneg_ctxt->Ciphers[0] = SMB2_ENCRYPTION_AES128_GCM;
637 		pneg_ctxt->Ciphers[1] = SMB2_ENCRYPTION_AES128_CCM;
638 	}
639 }
640 
641 static unsigned int
642 build_netname_ctxt(struct smb2_netname_neg_context *pneg_ctxt, char *hostname)
643 {
644 	struct nls_table *cp = load_nls_default();
645 
646 	pneg_ctxt->ContextType = SMB2_NETNAME_NEGOTIATE_CONTEXT_ID;
647 
648 	/* copy up to max of first 100 bytes of server name to NetName field */
649 	pneg_ctxt->DataLength = cpu_to_le16(2 * cifs_strtoUTF16(pneg_ctxt->NetName, hostname, 100, cp));
650 	/* context size is DataLength + minimal smb2_neg_context */
651 	return ALIGN(le16_to_cpu(pneg_ctxt->DataLength) + sizeof(struct smb2_neg_context), 8);
652 }
653 
654 static void
655 build_posix_ctxt(struct smb2_posix_neg_context *pneg_ctxt)
656 {
657 	pneg_ctxt->ContextType = SMB2_POSIX_EXTENSIONS_AVAILABLE;
658 	pneg_ctxt->DataLength = cpu_to_le16(POSIX_CTXT_DATA_LEN);
659 	/* SMB2_CREATE_TAG_POSIX is "0x93AD25509CB411E7B42383DE968BCD7C" */
660 	pneg_ctxt->Name[0] = 0x93;
661 	pneg_ctxt->Name[1] = 0xAD;
662 	pneg_ctxt->Name[2] = 0x25;
663 	pneg_ctxt->Name[3] = 0x50;
664 	pneg_ctxt->Name[4] = 0x9C;
665 	pneg_ctxt->Name[5] = 0xB4;
666 	pneg_ctxt->Name[6] = 0x11;
667 	pneg_ctxt->Name[7] = 0xE7;
668 	pneg_ctxt->Name[8] = 0xB4;
669 	pneg_ctxt->Name[9] = 0x23;
670 	pneg_ctxt->Name[10] = 0x83;
671 	pneg_ctxt->Name[11] = 0xDE;
672 	pneg_ctxt->Name[12] = 0x96;
673 	pneg_ctxt->Name[13] = 0x8B;
674 	pneg_ctxt->Name[14] = 0xCD;
675 	pneg_ctxt->Name[15] = 0x7C;
676 }
677 
678 static void
679 assemble_neg_contexts(struct smb2_negotiate_req *req,
680 		      struct TCP_Server_Info *server, unsigned int *total_len)
681 {
682 	unsigned int ctxt_len, neg_context_count;
683 	struct TCP_Server_Info *pserver;
684 	char *pneg_ctxt;
685 	char *hostname;
686 
687 	if (*total_len > 200) {
688 		/* In case length corrupted don't want to overrun smb buffer */
689 		cifs_server_dbg(VFS, "Bad frame length assembling neg contexts\n");
690 		return;
691 	}
692 
693 	/*
694 	 * round up total_len of fixed part of SMB3 negotiate request to 8
695 	 * byte boundary before adding negotiate contexts
696 	 */
697 	*total_len = ALIGN(*total_len, 8);
698 
699 	pneg_ctxt = (*total_len) + (char *)req;
700 	req->NegotiateContextOffset = cpu_to_le32(*total_len);
701 
702 	build_preauth_ctxt((struct smb2_preauth_neg_context *)pneg_ctxt);
703 	ctxt_len = ALIGN(sizeof(struct smb2_preauth_neg_context), 8);
704 	*total_len += ctxt_len;
705 	pneg_ctxt += ctxt_len;
706 
707 	build_encrypt_ctxt((struct smb2_encryption_neg_context *)pneg_ctxt);
708 	ctxt_len = ALIGN(sizeof(struct smb2_encryption_neg_context), 8);
709 	*total_len += ctxt_len;
710 	pneg_ctxt += ctxt_len;
711 
712 	/*
713 	 * secondary channels don't have the hostname field populated
714 	 * use the hostname field in the primary channel instead
715 	 */
716 	pserver = SERVER_IS_CHAN(server) ? server->primary_server : server;
717 	cifs_server_lock(pserver);
718 	hostname = pserver->hostname;
719 	if (hostname && (hostname[0] != 0)) {
720 		ctxt_len = build_netname_ctxt((struct smb2_netname_neg_context *)pneg_ctxt,
721 					      hostname);
722 		*total_len += ctxt_len;
723 		pneg_ctxt += ctxt_len;
724 		neg_context_count = 3;
725 	} else
726 		neg_context_count = 2;
727 	cifs_server_unlock(pserver);
728 
729 	build_posix_ctxt((struct smb2_posix_neg_context *)pneg_ctxt);
730 	*total_len += sizeof(struct smb2_posix_neg_context);
731 	pneg_ctxt += sizeof(struct smb2_posix_neg_context);
732 	neg_context_count++;
733 
734 	if (server->compression.requested) {
735 		build_compression_ctxt((struct smb2_compression_capabilities_context *)
736 				pneg_ctxt);
737 		ctxt_len = ALIGN(sizeof(struct smb2_compression_capabilities_context), 8);
738 		*total_len += ctxt_len;
739 		pneg_ctxt += ctxt_len;
740 		neg_context_count++;
741 	}
742 
743 	if (enable_negotiate_signing) {
744 		ctxt_len = build_signing_ctxt((struct smb2_signing_capabilities *)
745 				pneg_ctxt);
746 		*total_len += ctxt_len;
747 		pneg_ctxt += ctxt_len;
748 		neg_context_count++;
749 	}
750 
751 	/* check for and add transport_capabilities and signing capabilities */
752 	req->NegotiateContextCount = cpu_to_le16(neg_context_count);
753 
754 }
755 
756 /* If invalid preauth context warn but use what we requested, SHA-512 */
757 static void decode_preauth_context(struct smb2_preauth_neg_context *ctxt)
758 {
759 	unsigned int len = le16_to_cpu(ctxt->DataLength);
760 
761 	/*
762 	 * Caller checked that DataLength remains within SMB boundary. We still
763 	 * need to confirm that one HashAlgorithms member is accounted for.
764 	 */
765 	if (len < MIN_PREAUTH_CTXT_DATA_LEN) {
766 		pr_warn_once("server sent bad preauth context\n");
767 		return;
768 	} else if (len < MIN_PREAUTH_CTXT_DATA_LEN + le16_to_cpu(ctxt->SaltLength)) {
769 		pr_warn_once("server sent invalid SaltLength\n");
770 		return;
771 	}
772 	if (le16_to_cpu(ctxt->HashAlgorithmCount) != 1)
773 		pr_warn_once("Invalid SMB3 hash algorithm count\n");
774 	if (ctxt->HashAlgorithms != SMB2_PREAUTH_INTEGRITY_SHA512)
775 		pr_warn_once("unknown SMB3 hash algorithm\n");
776 }
777 
778 static void decode_compress_ctx(struct TCP_Server_Info *server,
779 			 struct smb2_compression_capabilities_context *ctxt)
780 {
781 	unsigned int len = le16_to_cpu(ctxt->DataLength);
782 	__le16 alg;
783 
784 	server->compression.enabled = false;
785 
786 	/*
787 	 * Caller checked that DataLength remains within SMB boundary. We still
788 	 * need to confirm that one CompressionAlgorithms member is accounted
789 	 * for.
790 	 */
791 	if (len < 10) {
792 		pr_warn_once("server sent bad compression cntxt\n");
793 		return;
794 	}
795 
796 	if (le16_to_cpu(ctxt->CompressionAlgorithmCount) != 1) {
797 		pr_warn_once("invalid SMB3 compress algorithm count\n");
798 		return;
799 	}
800 
801 	alg = ctxt->CompressionAlgorithms[0];
802 
803 	/* 'NONE' (0) compressor type is never negotiated */
804 	if (alg == 0 || le16_to_cpu(alg) > 3) {
805 		pr_warn_once("invalid compression algorithm '%u'\n", alg);
806 		return;
807 	}
808 
809 	server->compression.alg = alg;
810 	server->compression.enabled = true;
811 }
812 
813 static int decode_encrypt_ctx(struct TCP_Server_Info *server,
814 			      struct smb2_encryption_neg_context *ctxt)
815 {
816 	unsigned int len = le16_to_cpu(ctxt->DataLength);
817 
818 	cifs_dbg(FYI, "decode SMB3.11 encryption neg context of len %d\n", len);
819 	/*
820 	 * Caller checked that DataLength remains within SMB boundary. We still
821 	 * need to confirm that one Cipher flexible array member is accounted
822 	 * for.
823 	 */
824 	if (len < MIN_ENCRYPT_CTXT_DATA_LEN) {
825 		pr_warn_once("server sent bad crypto ctxt len\n");
826 		return -EINVAL;
827 	}
828 
829 	if (le16_to_cpu(ctxt->CipherCount) != 1) {
830 		pr_warn_once("Invalid SMB3.11 cipher count\n");
831 		return -EINVAL;
832 	}
833 	cifs_dbg(FYI, "SMB311 cipher type:%d\n", le16_to_cpu(ctxt->Ciphers[0]));
834 	if (require_gcm_256) {
835 		if (ctxt->Ciphers[0] != SMB2_ENCRYPTION_AES256_GCM) {
836 			cifs_dbg(VFS, "Server does not support requested encryption type (AES256 GCM)\n");
837 			return -EOPNOTSUPP;
838 		}
839 	} else if (ctxt->Ciphers[0] == 0) {
840 		/*
841 		 * e.g. if server only supported AES256_CCM (very unlikely)
842 		 * or server supported no encryption types or had all disabled.
843 		 * Since GLOBAL_CAP_ENCRYPTION will be not set, in the case
844 		 * in which mount requested encryption ("seal") checks later
845 		 * on during tree connection will return proper rc, but if
846 		 * seal not requested by client, since server is allowed to
847 		 * return 0 to indicate no supported cipher, we can't fail here
848 		 */
849 		server->cipher_type = 0;
850 		server->capabilities &= ~SMB2_GLOBAL_CAP_ENCRYPTION;
851 		pr_warn_once("Server does not support requested encryption types\n");
852 		return 0;
853 	} else if ((ctxt->Ciphers[0] != SMB2_ENCRYPTION_AES128_CCM) &&
854 		   (ctxt->Ciphers[0] != SMB2_ENCRYPTION_AES128_GCM) &&
855 		   (ctxt->Ciphers[0] != SMB2_ENCRYPTION_AES256_GCM)) {
856 		/* server returned a cipher we didn't ask for */
857 		pr_warn_once("Invalid SMB3.11 cipher returned\n");
858 		return -EINVAL;
859 	}
860 	server->cipher_type = ctxt->Ciphers[0];
861 	server->capabilities |= SMB2_GLOBAL_CAP_ENCRYPTION;
862 	return 0;
863 }
864 
865 static void decode_signing_ctx(struct TCP_Server_Info *server,
866 			       struct smb2_signing_capabilities *pctxt)
867 {
868 	unsigned int len = le16_to_cpu(pctxt->DataLength);
869 
870 	/*
871 	 * Caller checked that DataLength remains within SMB boundary. We still
872 	 * need to confirm that one SigningAlgorithms flexible array member is
873 	 * accounted for.
874 	 */
875 	if ((len < 4) || (len > 16)) {
876 		pr_warn_once("server sent bad signing negcontext\n");
877 		return;
878 	}
879 	if (le16_to_cpu(pctxt->SigningAlgorithmCount) != 1) {
880 		pr_warn_once("Invalid signing algorithm count\n");
881 		return;
882 	}
883 	if (le16_to_cpu(pctxt->SigningAlgorithms[0]) > 2) {
884 		pr_warn_once("unknown signing algorithm\n");
885 		return;
886 	}
887 
888 	server->signing_negotiated = true;
889 	server->signing_algorithm = le16_to_cpu(pctxt->SigningAlgorithms[0]);
890 	cifs_dbg(FYI, "signing algorithm %d chosen\n",
891 		     server->signing_algorithm);
892 }
893 
894 
895 static int smb311_decode_neg_context(struct smb2_negotiate_rsp *rsp,
896 				     struct TCP_Server_Info *server,
897 				     unsigned int len_of_smb)
898 {
899 	struct smb2_neg_context *pctx;
900 	unsigned int offset = le32_to_cpu(rsp->NegotiateContextOffset);
901 	unsigned int ctxt_cnt = le16_to_cpu(rsp->NegotiateContextCount);
902 	unsigned int len_of_ctxts, i;
903 	int rc = 0;
904 
905 	cifs_dbg(FYI, "decoding %d negotiate contexts\n", ctxt_cnt);
906 	if (len_of_smb <= offset) {
907 		cifs_server_dbg(VFS, "Invalid response: negotiate context offset\n");
908 		return -EINVAL;
909 	}
910 
911 	len_of_ctxts = len_of_smb - offset;
912 
913 	for (i = 0; i < ctxt_cnt; i++) {
914 		int clen;
915 		/* check that offset is not beyond end of SMB */
916 		if (len_of_ctxts < sizeof(struct smb2_neg_context))
917 			break;
918 
919 		pctx = (struct smb2_neg_context *)(offset + (char *)rsp);
920 		clen = sizeof(struct smb2_neg_context)
921 			+ le16_to_cpu(pctx->DataLength);
922 		/*
923 		 * 2.2.4 SMB2 NEGOTIATE Response
924 		 * Subsequent negotiate contexts MUST appear at the first 8-byte
925 		 * aligned offset following the previous negotiate context.
926 		 */
927 		if (i + 1 != ctxt_cnt)
928 			clen = ALIGN(clen, 8);
929 		if (clen > len_of_ctxts)
930 			break;
931 
932 		if (pctx->ContextType == SMB2_PREAUTH_INTEGRITY_CAPABILITIES)
933 			decode_preauth_context(
934 				(struct smb2_preauth_neg_context *)pctx);
935 		else if (pctx->ContextType == SMB2_ENCRYPTION_CAPABILITIES)
936 			rc = decode_encrypt_ctx(server,
937 				(struct smb2_encryption_neg_context *)pctx);
938 		else if (pctx->ContextType == SMB2_COMPRESSION_CAPABILITIES)
939 			decode_compress_ctx(server,
940 				(struct smb2_compression_capabilities_context *)pctx);
941 		else if (pctx->ContextType == SMB2_POSIX_EXTENSIONS_AVAILABLE)
942 			server->posix_ext_supported = true;
943 		else if (pctx->ContextType == SMB2_SIGNING_CAPABILITIES)
944 			decode_signing_ctx(server,
945 				(struct smb2_signing_capabilities *)pctx);
946 		else
947 			cifs_server_dbg(VFS, "unknown negcontext of type %d ignored\n",
948 				le16_to_cpu(pctx->ContextType));
949 		if (rc)
950 			break;
951 
952 		offset += clen;
953 		len_of_ctxts -= clen;
954 	}
955 	return rc;
956 }
957 
958 static struct create_posix *
959 create_posix_buf(umode_t mode)
960 {
961 	struct create_posix *buf;
962 
963 	buf = kzalloc(sizeof(struct create_posix),
964 			GFP_KERNEL);
965 	if (!buf)
966 		return NULL;
967 
968 	buf->ccontext.DataOffset =
969 		cpu_to_le16(offsetof(struct create_posix, Mode));
970 	buf->ccontext.DataLength = cpu_to_le32(4);
971 	buf->ccontext.NameOffset =
972 		cpu_to_le16(offsetof(struct create_posix, Name));
973 	buf->ccontext.NameLength = cpu_to_le16(16);
974 
975 	/* SMB2_CREATE_TAG_POSIX is "0x93AD25509CB411E7B42383DE968BCD7C" */
976 	buf->Name[0] = 0x93;
977 	buf->Name[1] = 0xAD;
978 	buf->Name[2] = 0x25;
979 	buf->Name[3] = 0x50;
980 	buf->Name[4] = 0x9C;
981 	buf->Name[5] = 0xB4;
982 	buf->Name[6] = 0x11;
983 	buf->Name[7] = 0xE7;
984 	buf->Name[8] = 0xB4;
985 	buf->Name[9] = 0x23;
986 	buf->Name[10] = 0x83;
987 	buf->Name[11] = 0xDE;
988 	buf->Name[12] = 0x96;
989 	buf->Name[13] = 0x8B;
990 	buf->Name[14] = 0xCD;
991 	buf->Name[15] = 0x7C;
992 	buf->Mode = cpu_to_le32(mode);
993 	cifs_dbg(FYI, "mode on posix create 0%o\n", mode);
994 	return buf;
995 }
996 
997 static int
998 add_posix_context(struct kvec *iov, unsigned int *num_iovec, umode_t mode)
999 {
1000 	unsigned int num = *num_iovec;
1001 
1002 	iov[num].iov_base = create_posix_buf(mode);
1003 	if (mode == ACL_NO_MODE)
1004 		cifs_dbg(FYI, "%s: no mode\n", __func__);
1005 	if (iov[num].iov_base == NULL)
1006 		return -ENOMEM;
1007 	iov[num].iov_len = sizeof(struct create_posix);
1008 	*num_iovec = num + 1;
1009 	return 0;
1010 }
1011 
1012 
1013 /*
1014  *
1015  *	SMB2 Worker functions follow:
1016  *
1017  *	The general structure of the worker functions is:
1018  *	1) Call smb2_init (assembles SMB2 header)
1019  *	2) Initialize SMB2 command specific fields in fixed length area of SMB
1020  *	3) Call smb_sendrcv2 (sends request on socket and waits for response)
1021  *	4) Decode SMB2 command specific fields in the fixed length area
1022  *	5) Decode variable length data area (if any for this SMB2 command type)
1023  *	6) Call free smb buffer
1024  *	7) return
1025  *
1026  */
1027 
1028 int
1029 SMB2_negotiate(const unsigned int xid,
1030 	       struct cifs_ses *ses,
1031 	       struct TCP_Server_Info *server)
1032 {
1033 	struct smb_rqst rqst;
1034 	struct smb2_negotiate_req *req;
1035 	struct smb2_negotiate_rsp *rsp;
1036 	struct kvec iov[1];
1037 	struct kvec rsp_iov;
1038 	int rc;
1039 	int resp_buftype;
1040 	int blob_offset, blob_length;
1041 	char *security_blob;
1042 	int flags = CIFS_NEG_OP;
1043 	unsigned int total_len;
1044 
1045 	cifs_dbg(FYI, "Negotiate protocol\n");
1046 
1047 	if (!server) {
1048 		WARN(1, "%s: server is NULL!\n", __func__);
1049 		return -EIO;
1050 	}
1051 
1052 	rc = smb2_plain_req_init(SMB2_NEGOTIATE, NULL, server,
1053 				 (void **) &req, &total_len);
1054 	if (rc)
1055 		return rc;
1056 
1057 	req->hdr.SessionId = 0;
1058 
1059 	memset(server->preauth_sha_hash, 0, SMB2_PREAUTH_HASH_SIZE);
1060 	memset(ses->preauth_sha_hash, 0, SMB2_PREAUTH_HASH_SIZE);
1061 
1062 	if (strcmp(server->vals->version_string,
1063 		   SMB3ANY_VERSION_STRING) == 0) {
1064 		req->Dialects[0] = cpu_to_le16(SMB30_PROT_ID);
1065 		req->Dialects[1] = cpu_to_le16(SMB302_PROT_ID);
1066 		req->Dialects[2] = cpu_to_le16(SMB311_PROT_ID);
1067 		req->DialectCount = cpu_to_le16(3);
1068 		total_len += 6;
1069 	} else if (strcmp(server->vals->version_string,
1070 		   SMBDEFAULT_VERSION_STRING) == 0) {
1071 		req->Dialects[0] = cpu_to_le16(SMB21_PROT_ID);
1072 		req->Dialects[1] = cpu_to_le16(SMB30_PROT_ID);
1073 		req->Dialects[2] = cpu_to_le16(SMB302_PROT_ID);
1074 		req->Dialects[3] = cpu_to_le16(SMB311_PROT_ID);
1075 		req->DialectCount = cpu_to_le16(4);
1076 		total_len += 8;
1077 	} else {
1078 		/* otherwise send specific dialect */
1079 		req->Dialects[0] = cpu_to_le16(server->vals->protocol_id);
1080 		req->DialectCount = cpu_to_le16(1);
1081 		total_len += 2;
1082 	}
1083 
1084 	/* only one of SMB2 signing flags may be set in SMB2 request */
1085 	if (ses->sign)
1086 		req->SecurityMode = cpu_to_le16(SMB2_NEGOTIATE_SIGNING_REQUIRED);
1087 	else if (global_secflags & CIFSSEC_MAY_SIGN)
1088 		req->SecurityMode = cpu_to_le16(SMB2_NEGOTIATE_SIGNING_ENABLED);
1089 	else
1090 		req->SecurityMode = 0;
1091 
1092 	req->Capabilities = cpu_to_le32(server->vals->req_capabilities);
1093 	if (ses->chan_max > 1)
1094 		req->Capabilities |= cpu_to_le32(SMB2_GLOBAL_CAP_MULTI_CHANNEL);
1095 
1096 	/* ClientGUID must be zero for SMB2.02 dialect */
1097 	if (server->vals->protocol_id == SMB20_PROT_ID)
1098 		memset(req->ClientGUID, 0, SMB2_CLIENT_GUID_SIZE);
1099 	else {
1100 		memcpy(req->ClientGUID, server->client_guid,
1101 			SMB2_CLIENT_GUID_SIZE);
1102 		if ((server->vals->protocol_id == SMB311_PROT_ID) ||
1103 		    (strcmp(server->vals->version_string,
1104 		     SMB3ANY_VERSION_STRING) == 0) ||
1105 		    (strcmp(server->vals->version_string,
1106 		     SMBDEFAULT_VERSION_STRING) == 0))
1107 			assemble_neg_contexts(req, server, &total_len);
1108 	}
1109 	iov[0].iov_base = (char *)req;
1110 	iov[0].iov_len = total_len;
1111 
1112 	memset(&rqst, 0, sizeof(struct smb_rqst));
1113 	rqst.rq_iov = iov;
1114 	rqst.rq_nvec = 1;
1115 
1116 	rc = cifs_send_recv(xid, ses, server,
1117 			    &rqst, &resp_buftype, flags, &rsp_iov);
1118 	cifs_small_buf_release(req);
1119 	rsp = (struct smb2_negotiate_rsp *)rsp_iov.iov_base;
1120 	/*
1121 	 * No tcon so can't do
1122 	 * cifs_stats_inc(&tcon->stats.smb2_stats.smb2_com_fail[SMB2...]);
1123 	 */
1124 	if (rc == -EOPNOTSUPP) {
1125 		cifs_server_dbg(VFS, "Dialect not supported by server. Consider  specifying vers=1.0 or vers=2.0 on mount for accessing older servers\n");
1126 		goto neg_exit;
1127 	} else if (rc != 0)
1128 		goto neg_exit;
1129 
1130 	rc = -EIO;
1131 	if (strcmp(server->vals->version_string,
1132 		   SMB3ANY_VERSION_STRING) == 0) {
1133 		if (rsp->DialectRevision == cpu_to_le16(SMB20_PROT_ID)) {
1134 			cifs_server_dbg(VFS,
1135 				"SMB2 dialect returned but not requested\n");
1136 			goto neg_exit;
1137 		} else if (rsp->DialectRevision == cpu_to_le16(SMB21_PROT_ID)) {
1138 			cifs_server_dbg(VFS,
1139 				"SMB2.1 dialect returned but not requested\n");
1140 			goto neg_exit;
1141 		} else if (rsp->DialectRevision == cpu_to_le16(SMB311_PROT_ID)) {
1142 			/* ops set to 3.0 by default for default so update */
1143 			server->ops = &smb311_operations;
1144 			server->vals = &smb311_values;
1145 		}
1146 	} else if (strcmp(server->vals->version_string,
1147 		   SMBDEFAULT_VERSION_STRING) == 0) {
1148 		if (rsp->DialectRevision == cpu_to_le16(SMB20_PROT_ID)) {
1149 			cifs_server_dbg(VFS,
1150 				"SMB2 dialect returned but not requested\n");
1151 			goto neg_exit;
1152 		} else if (rsp->DialectRevision == cpu_to_le16(SMB21_PROT_ID)) {
1153 			/* ops set to 3.0 by default for default so update */
1154 			server->ops = &smb21_operations;
1155 			server->vals = &smb21_values;
1156 		} else if (rsp->DialectRevision == cpu_to_le16(SMB311_PROT_ID)) {
1157 			server->ops = &smb311_operations;
1158 			server->vals = &smb311_values;
1159 		}
1160 	} else if (le16_to_cpu(rsp->DialectRevision) !=
1161 				server->vals->protocol_id) {
1162 		/* if requested single dialect ensure returned dialect matched */
1163 		cifs_server_dbg(VFS, "Invalid 0x%x dialect returned: not requested\n",
1164 				le16_to_cpu(rsp->DialectRevision));
1165 		goto neg_exit;
1166 	}
1167 
1168 	cifs_dbg(FYI, "mode 0x%x\n", rsp->SecurityMode);
1169 
1170 	if (rsp->DialectRevision == cpu_to_le16(SMB20_PROT_ID))
1171 		cifs_dbg(FYI, "negotiated smb2.0 dialect\n");
1172 	else if (rsp->DialectRevision == cpu_to_le16(SMB21_PROT_ID))
1173 		cifs_dbg(FYI, "negotiated smb2.1 dialect\n");
1174 	else if (rsp->DialectRevision == cpu_to_le16(SMB30_PROT_ID))
1175 		cifs_dbg(FYI, "negotiated smb3.0 dialect\n");
1176 	else if (rsp->DialectRevision == cpu_to_le16(SMB302_PROT_ID))
1177 		cifs_dbg(FYI, "negotiated smb3.02 dialect\n");
1178 	else if (rsp->DialectRevision == cpu_to_le16(SMB311_PROT_ID))
1179 		cifs_dbg(FYI, "negotiated smb3.1.1 dialect\n");
1180 	else {
1181 		cifs_server_dbg(VFS, "Invalid dialect returned by server 0x%x\n",
1182 				le16_to_cpu(rsp->DialectRevision));
1183 		goto neg_exit;
1184 	}
1185 
1186 	rc = 0;
1187 	server->dialect = le16_to_cpu(rsp->DialectRevision);
1188 
1189 	/*
1190 	 * Keep a copy of the hash after negprot. This hash will be
1191 	 * the starting hash value for all sessions made from this
1192 	 * server.
1193 	 */
1194 	memcpy(server->preauth_sha_hash, ses->preauth_sha_hash,
1195 	       SMB2_PREAUTH_HASH_SIZE);
1196 
1197 	/* SMB2 only has an extended negflavor */
1198 	server->negflavor = CIFS_NEGFLAVOR_EXTENDED;
1199 	/* set it to the maximum buffer size value we can send with 1 credit */
1200 	server->maxBuf = min_t(unsigned int, le32_to_cpu(rsp->MaxTransactSize),
1201 			       SMB2_MAX_BUFFER_SIZE);
1202 	server->max_read = le32_to_cpu(rsp->MaxReadSize);
1203 	server->max_write = le32_to_cpu(rsp->MaxWriteSize);
1204 	server->sec_mode = le16_to_cpu(rsp->SecurityMode);
1205 	if ((server->sec_mode & SMB2_SEC_MODE_FLAGS_ALL) != server->sec_mode)
1206 		cifs_dbg(FYI, "Server returned unexpected security mode 0x%x\n",
1207 				server->sec_mode);
1208 	server->capabilities = le32_to_cpu(rsp->Capabilities);
1209 	/* Internal types */
1210 	server->capabilities |= SMB2_NT_FIND | SMB2_LARGE_FILES;
1211 
1212 	/*
1213 	 * SMB3.0 supports only 1 cipher and doesn't have a encryption neg context
1214 	 * Set the cipher type manually.
1215 	 */
1216 	if (server->dialect == SMB30_PROT_ID && (server->capabilities & SMB2_GLOBAL_CAP_ENCRYPTION))
1217 		server->cipher_type = SMB2_ENCRYPTION_AES128_CCM;
1218 
1219 	security_blob = smb2_get_data_area_len(&blob_offset, &blob_length,
1220 					       (struct smb2_hdr *)rsp);
1221 	/*
1222 	 * See MS-SMB2 section 2.2.4: if no blob, client picks default which
1223 	 * for us will be
1224 	 *	ses->sectype = RawNTLMSSP;
1225 	 * but for time being this is our only auth choice so doesn't matter.
1226 	 * We just found a server which sets blob length to zero expecting raw.
1227 	 */
1228 	if (blob_length == 0) {
1229 		cifs_dbg(FYI, "missing security blob on negprot\n");
1230 		server->sec_ntlmssp = true;
1231 	}
1232 
1233 	rc = cifs_enable_signing(server, ses->sign);
1234 	if (rc)
1235 		goto neg_exit;
1236 	if (blob_length) {
1237 		rc = decode_negTokenInit(security_blob, blob_length, server);
1238 		if (rc == 1)
1239 			rc = 0;
1240 		else if (rc == 0)
1241 			rc = -EIO;
1242 	}
1243 
1244 	if (rsp->DialectRevision == cpu_to_le16(SMB311_PROT_ID)) {
1245 		if (rsp->NegotiateContextCount)
1246 			rc = smb311_decode_neg_context(rsp, server,
1247 						       rsp_iov.iov_len);
1248 		else
1249 			cifs_server_dbg(VFS, "Missing expected negotiate contexts\n");
1250 	}
1251 neg_exit:
1252 	free_rsp_buf(resp_buftype, rsp);
1253 	return rc;
1254 }
1255 
1256 int smb3_validate_negotiate(const unsigned int xid, struct cifs_tcon *tcon)
1257 {
1258 	int rc;
1259 	struct validate_negotiate_info_req *pneg_inbuf;
1260 	struct validate_negotiate_info_rsp *pneg_rsp = NULL;
1261 	u32 rsplen;
1262 	u32 inbuflen; /* max of 4 dialects */
1263 	struct TCP_Server_Info *server = tcon->ses->server;
1264 
1265 	cifs_dbg(FYI, "validate negotiate\n");
1266 
1267 	/* In SMB3.11 preauth integrity supersedes validate negotiate */
1268 	if (server->dialect == SMB311_PROT_ID)
1269 		return 0;
1270 
1271 	/*
1272 	 * validation ioctl must be signed, so no point sending this if we
1273 	 * can not sign it (ie are not known user).  Even if signing is not
1274 	 * required (enabled but not negotiated), in those cases we selectively
1275 	 * sign just this, the first and only signed request on a connection.
1276 	 * Having validation of negotiate info  helps reduce attack vectors.
1277 	 */
1278 	if (tcon->ses->session_flags & SMB2_SESSION_FLAG_IS_GUEST)
1279 		return 0; /* validation requires signing */
1280 
1281 	if (tcon->ses->user_name == NULL) {
1282 		cifs_dbg(FYI, "Can't validate negotiate: null user mount\n");
1283 		return 0; /* validation requires signing */
1284 	}
1285 
1286 	if (tcon->ses->session_flags & SMB2_SESSION_FLAG_IS_NULL)
1287 		cifs_tcon_dbg(VFS, "Unexpected null user (anonymous) auth flag sent by server\n");
1288 
1289 	pneg_inbuf = kmalloc(sizeof(*pneg_inbuf), GFP_NOFS);
1290 	if (!pneg_inbuf)
1291 		return -ENOMEM;
1292 
1293 	pneg_inbuf->Capabilities =
1294 			cpu_to_le32(server->vals->req_capabilities);
1295 	if (tcon->ses->chan_max > 1)
1296 		pneg_inbuf->Capabilities |= cpu_to_le32(SMB2_GLOBAL_CAP_MULTI_CHANNEL);
1297 
1298 	memcpy(pneg_inbuf->Guid, server->client_guid,
1299 					SMB2_CLIENT_GUID_SIZE);
1300 
1301 	if (tcon->ses->sign)
1302 		pneg_inbuf->SecurityMode =
1303 			cpu_to_le16(SMB2_NEGOTIATE_SIGNING_REQUIRED);
1304 	else if (global_secflags & CIFSSEC_MAY_SIGN)
1305 		pneg_inbuf->SecurityMode =
1306 			cpu_to_le16(SMB2_NEGOTIATE_SIGNING_ENABLED);
1307 	else
1308 		pneg_inbuf->SecurityMode = 0;
1309 
1310 
1311 	if (strcmp(server->vals->version_string,
1312 		SMB3ANY_VERSION_STRING) == 0) {
1313 		pneg_inbuf->Dialects[0] = cpu_to_le16(SMB30_PROT_ID);
1314 		pneg_inbuf->Dialects[1] = cpu_to_le16(SMB302_PROT_ID);
1315 		pneg_inbuf->Dialects[2] = cpu_to_le16(SMB311_PROT_ID);
1316 		pneg_inbuf->DialectCount = cpu_to_le16(3);
1317 		/* SMB 2.1 not included so subtract one dialect from len */
1318 		inbuflen = sizeof(*pneg_inbuf) -
1319 				(sizeof(pneg_inbuf->Dialects[0]));
1320 	} else if (strcmp(server->vals->version_string,
1321 		SMBDEFAULT_VERSION_STRING) == 0) {
1322 		pneg_inbuf->Dialects[0] = cpu_to_le16(SMB21_PROT_ID);
1323 		pneg_inbuf->Dialects[1] = cpu_to_le16(SMB30_PROT_ID);
1324 		pneg_inbuf->Dialects[2] = cpu_to_le16(SMB302_PROT_ID);
1325 		pneg_inbuf->Dialects[3] = cpu_to_le16(SMB311_PROT_ID);
1326 		pneg_inbuf->DialectCount = cpu_to_le16(4);
1327 		/* structure is big enough for 4 dialects */
1328 		inbuflen = sizeof(*pneg_inbuf);
1329 	} else {
1330 		/* otherwise specific dialect was requested */
1331 		pneg_inbuf->Dialects[0] =
1332 			cpu_to_le16(server->vals->protocol_id);
1333 		pneg_inbuf->DialectCount = cpu_to_le16(1);
1334 		/* structure is big enough for 4 dialects, sending only 1 */
1335 		inbuflen = sizeof(*pneg_inbuf) -
1336 				sizeof(pneg_inbuf->Dialects[0]) * 3;
1337 	}
1338 
1339 	rc = SMB2_ioctl(xid, tcon, NO_FILE_ID, NO_FILE_ID,
1340 		FSCTL_VALIDATE_NEGOTIATE_INFO,
1341 		(char *)pneg_inbuf, inbuflen, CIFSMaxBufSize,
1342 		(char **)&pneg_rsp, &rsplen);
1343 	if (rc == -EOPNOTSUPP) {
1344 		/*
1345 		 * Old Windows versions or Netapp SMB server can return
1346 		 * not supported error. Client should accept it.
1347 		 */
1348 		cifs_tcon_dbg(VFS, "Server does not support validate negotiate\n");
1349 		rc = 0;
1350 		goto out_free_inbuf;
1351 	} else if (rc != 0) {
1352 		cifs_tcon_dbg(VFS, "validate protocol negotiate failed: %d\n",
1353 			      rc);
1354 		rc = -EIO;
1355 		goto out_free_inbuf;
1356 	}
1357 
1358 	rc = -EIO;
1359 	if (rsplen != sizeof(*pneg_rsp)) {
1360 		cifs_tcon_dbg(VFS, "Invalid protocol negotiate response size: %d\n",
1361 			      rsplen);
1362 
1363 		/* relax check since Mac returns max bufsize allowed on ioctl */
1364 		if (rsplen > CIFSMaxBufSize || rsplen < sizeof(*pneg_rsp))
1365 			goto out_free_rsp;
1366 	}
1367 
1368 	/* check validate negotiate info response matches what we got earlier */
1369 	if (pneg_rsp->Dialect != cpu_to_le16(server->dialect))
1370 		goto vneg_out;
1371 
1372 	if (pneg_rsp->SecurityMode != cpu_to_le16(server->sec_mode))
1373 		goto vneg_out;
1374 
1375 	/* do not validate server guid because not saved at negprot time yet */
1376 
1377 	if ((le32_to_cpu(pneg_rsp->Capabilities) | SMB2_NT_FIND |
1378 	      SMB2_LARGE_FILES) != server->capabilities)
1379 		goto vneg_out;
1380 
1381 	/* validate negotiate successful */
1382 	rc = 0;
1383 	cifs_dbg(FYI, "validate negotiate info successful\n");
1384 	goto out_free_rsp;
1385 
1386 vneg_out:
1387 	cifs_tcon_dbg(VFS, "protocol revalidation - security settings mismatch\n");
1388 out_free_rsp:
1389 	kfree(pneg_rsp);
1390 out_free_inbuf:
1391 	kfree(pneg_inbuf);
1392 	return rc;
1393 }
1394 
1395 enum securityEnum
1396 smb2_select_sectype(struct TCP_Server_Info *server, enum securityEnum requested)
1397 {
1398 	switch (requested) {
1399 	case Kerberos:
1400 	case RawNTLMSSP:
1401 		return requested;
1402 	case NTLMv2:
1403 		return RawNTLMSSP;
1404 	case Unspecified:
1405 		if (server->sec_ntlmssp &&
1406 			(global_secflags & CIFSSEC_MAY_NTLMSSP))
1407 			return RawNTLMSSP;
1408 		if ((server->sec_kerberos || server->sec_mskerberos) &&
1409 			(global_secflags & CIFSSEC_MAY_KRB5))
1410 			return Kerberos;
1411 		fallthrough;
1412 	default:
1413 		return Unspecified;
1414 	}
1415 }
1416 
1417 struct SMB2_sess_data {
1418 	unsigned int xid;
1419 	struct cifs_ses *ses;
1420 	struct TCP_Server_Info *server;
1421 	struct nls_table *nls_cp;
1422 	void (*func)(struct SMB2_sess_data *);
1423 	int result;
1424 	u64 previous_session;
1425 
1426 	/* we will send the SMB in three pieces:
1427 	 * a fixed length beginning part, an optional
1428 	 * SPNEGO blob (which can be zero length), and a
1429 	 * last part which will include the strings
1430 	 * and rest of bcc area. This allows us to avoid
1431 	 * a large buffer 17K allocation
1432 	 */
1433 	int buf0_type;
1434 	struct kvec iov[2];
1435 };
1436 
1437 static int
1438 SMB2_sess_alloc_buffer(struct SMB2_sess_data *sess_data)
1439 {
1440 	int rc;
1441 	struct cifs_ses *ses = sess_data->ses;
1442 	struct TCP_Server_Info *server = sess_data->server;
1443 	struct smb2_sess_setup_req *req;
1444 	unsigned int total_len;
1445 	bool is_binding = false;
1446 
1447 	rc = smb2_plain_req_init(SMB2_SESSION_SETUP, NULL, server,
1448 				 (void **) &req,
1449 				 &total_len);
1450 	if (rc)
1451 		return rc;
1452 
1453 	spin_lock(&ses->ses_lock);
1454 	is_binding = (ses->ses_status == SES_GOOD);
1455 	spin_unlock(&ses->ses_lock);
1456 
1457 	if (is_binding) {
1458 		req->hdr.SessionId = cpu_to_le64(ses->Suid);
1459 		req->hdr.Flags |= SMB2_FLAGS_SIGNED;
1460 		req->PreviousSessionId = 0;
1461 		req->Flags = SMB2_SESSION_REQ_FLAG_BINDING;
1462 		cifs_dbg(FYI, "Binding to sess id: %llx\n", ses->Suid);
1463 	} else {
1464 		/* First session, not a reauthenticate */
1465 		req->hdr.SessionId = 0;
1466 		/*
1467 		 * if reconnect, we need to send previous sess id
1468 		 * otherwise it is 0
1469 		 */
1470 		req->PreviousSessionId = cpu_to_le64(sess_data->previous_session);
1471 		req->Flags = 0; /* MBZ */
1472 		cifs_dbg(FYI, "Fresh session. Previous: %llx\n",
1473 			 sess_data->previous_session);
1474 	}
1475 
1476 	/* enough to enable echos and oplocks and one max size write */
1477 	if (server->credits >= server->max_credits)
1478 		req->hdr.CreditRequest = cpu_to_le16(0);
1479 	else
1480 		req->hdr.CreditRequest = cpu_to_le16(
1481 			min_t(int, server->max_credits -
1482 			      server->credits, 130));
1483 
1484 	/* only one of SMB2 signing flags may be set in SMB2 request */
1485 	if (server->sign)
1486 		req->SecurityMode = SMB2_NEGOTIATE_SIGNING_REQUIRED;
1487 	else if (global_secflags & CIFSSEC_MAY_SIGN) /* one flag unlike MUST_ */
1488 		req->SecurityMode = SMB2_NEGOTIATE_SIGNING_ENABLED;
1489 	else
1490 		req->SecurityMode = 0;
1491 
1492 #ifdef CONFIG_CIFS_DFS_UPCALL
1493 	req->Capabilities = cpu_to_le32(SMB2_GLOBAL_CAP_DFS);
1494 #else
1495 	req->Capabilities = 0;
1496 #endif /* DFS_UPCALL */
1497 
1498 	req->Channel = 0; /* MBZ */
1499 
1500 	sess_data->iov[0].iov_base = (char *)req;
1501 	/* 1 for pad */
1502 	sess_data->iov[0].iov_len = total_len - 1;
1503 	/*
1504 	 * This variable will be used to clear the buffer
1505 	 * allocated above in case of any error in the calling function.
1506 	 */
1507 	sess_data->buf0_type = CIFS_SMALL_BUFFER;
1508 
1509 	return 0;
1510 }
1511 
1512 static void
1513 SMB2_sess_free_buffer(struct SMB2_sess_data *sess_data)
1514 {
1515 	struct kvec *iov = sess_data->iov;
1516 
1517 	/* iov[1] is already freed by caller */
1518 	if (sess_data->buf0_type != CIFS_NO_BUFFER && iov[0].iov_base)
1519 		memzero_explicit(iov[0].iov_base, iov[0].iov_len);
1520 
1521 	free_rsp_buf(sess_data->buf0_type, iov[0].iov_base);
1522 	sess_data->buf0_type = CIFS_NO_BUFFER;
1523 }
1524 
1525 static int
1526 SMB2_sess_sendreceive(struct SMB2_sess_data *sess_data)
1527 {
1528 	int rc;
1529 	struct smb_rqst rqst;
1530 	struct smb2_sess_setup_req *req = sess_data->iov[0].iov_base;
1531 	struct kvec rsp_iov = { NULL, 0 };
1532 
1533 	/* Testing shows that buffer offset must be at location of Buffer[0] */
1534 	req->SecurityBufferOffset =
1535 		cpu_to_le16(sizeof(struct smb2_sess_setup_req));
1536 	req->SecurityBufferLength = cpu_to_le16(sess_data->iov[1].iov_len);
1537 
1538 	memset(&rqst, 0, sizeof(struct smb_rqst));
1539 	rqst.rq_iov = sess_data->iov;
1540 	rqst.rq_nvec = 2;
1541 
1542 	/* BB add code to build os and lm fields */
1543 	rc = cifs_send_recv(sess_data->xid, sess_data->ses,
1544 			    sess_data->server,
1545 			    &rqst,
1546 			    &sess_data->buf0_type,
1547 			    CIFS_LOG_ERROR | CIFS_SESS_OP, &rsp_iov);
1548 	cifs_small_buf_release(sess_data->iov[0].iov_base);
1549 	if (rc == 0)
1550 		sess_data->ses->expired_pwd = false;
1551 	else if ((rc == -EACCES) || (rc == -EKEYEXPIRED) || (rc == -EKEYREVOKED))
1552 		sess_data->ses->expired_pwd = true;
1553 
1554 	memcpy(&sess_data->iov[0], &rsp_iov, sizeof(struct kvec));
1555 
1556 	return rc;
1557 }
1558 
1559 static int
1560 SMB2_sess_establish_session(struct SMB2_sess_data *sess_data)
1561 {
1562 	int rc = 0;
1563 	struct cifs_ses *ses = sess_data->ses;
1564 	struct TCP_Server_Info *server = sess_data->server;
1565 
1566 	cifs_server_lock(server);
1567 	if (server->ops->generate_signingkey) {
1568 		rc = server->ops->generate_signingkey(ses, server);
1569 		if (rc) {
1570 			cifs_dbg(FYI,
1571 				"SMB3 session key generation failed\n");
1572 			cifs_server_unlock(server);
1573 			return rc;
1574 		}
1575 	}
1576 	if (!server->session_estab) {
1577 		server->sequence_number = 0x2;
1578 		server->session_estab = true;
1579 	}
1580 	cifs_server_unlock(server);
1581 
1582 	cifs_dbg(FYI, "SMB2/3 session established successfully\n");
1583 	return rc;
1584 }
1585 
1586 #ifdef CONFIG_CIFS_UPCALL
1587 static void
1588 SMB2_auth_kerberos(struct SMB2_sess_data *sess_data)
1589 {
1590 	int rc;
1591 	struct cifs_ses *ses = sess_data->ses;
1592 	struct TCP_Server_Info *server = sess_data->server;
1593 	struct cifs_spnego_msg *msg;
1594 	struct key *spnego_key = NULL;
1595 	struct smb2_sess_setup_rsp *rsp = NULL;
1596 	bool is_binding = false;
1597 
1598 	rc = SMB2_sess_alloc_buffer(sess_data);
1599 	if (rc)
1600 		goto out;
1601 
1602 	spnego_key = cifs_get_spnego_key(ses, server);
1603 	if (IS_ERR(spnego_key)) {
1604 		rc = PTR_ERR(spnego_key);
1605 		if (rc == -ENOKEY)
1606 			cifs_dbg(VFS, "Verify user has a krb5 ticket and keyutils is installed\n");
1607 		spnego_key = NULL;
1608 		goto out;
1609 	}
1610 
1611 	msg = spnego_key->payload.data[0];
1612 	/*
1613 	 * check version field to make sure that cifs.upcall is
1614 	 * sending us a response in an expected form
1615 	 */
1616 	if (msg->version != CIFS_SPNEGO_UPCALL_VERSION) {
1617 		cifs_dbg(VFS, "bad cifs.upcall version. Expected %d got %d\n",
1618 			 CIFS_SPNEGO_UPCALL_VERSION, msg->version);
1619 		rc = -EKEYREJECTED;
1620 		goto out_put_spnego_key;
1621 	}
1622 
1623 	spin_lock(&ses->ses_lock);
1624 	is_binding = (ses->ses_status == SES_GOOD);
1625 	spin_unlock(&ses->ses_lock);
1626 
1627 	/* keep session key if binding */
1628 	if (!is_binding) {
1629 		kfree_sensitive(ses->auth_key.response);
1630 		ses->auth_key.response = kmemdup(msg->data, msg->sesskey_len,
1631 						 GFP_KERNEL);
1632 		if (!ses->auth_key.response) {
1633 			cifs_dbg(VFS, "Kerberos can't allocate (%u bytes) memory\n",
1634 				 msg->sesskey_len);
1635 			rc = -ENOMEM;
1636 			goto out_put_spnego_key;
1637 		}
1638 		ses->auth_key.len = msg->sesskey_len;
1639 	}
1640 
1641 	sess_data->iov[1].iov_base = msg->data + msg->sesskey_len;
1642 	sess_data->iov[1].iov_len = msg->secblob_len;
1643 
1644 	rc = SMB2_sess_sendreceive(sess_data);
1645 	if (rc)
1646 		goto out_put_spnego_key;
1647 
1648 	rsp = (struct smb2_sess_setup_rsp *)sess_data->iov[0].iov_base;
1649 	/* keep session id and flags if binding */
1650 	if (!is_binding) {
1651 		ses->Suid = le64_to_cpu(rsp->hdr.SessionId);
1652 		ses->session_flags = le16_to_cpu(rsp->SessionFlags);
1653 	}
1654 
1655 	rc = SMB2_sess_establish_session(sess_data);
1656 out_put_spnego_key:
1657 	key_invalidate(spnego_key);
1658 	key_put(spnego_key);
1659 	if (rc) {
1660 		kfree_sensitive(ses->auth_key.response);
1661 		ses->auth_key.response = NULL;
1662 		ses->auth_key.len = 0;
1663 	}
1664 out:
1665 	sess_data->result = rc;
1666 	sess_data->func = NULL;
1667 	SMB2_sess_free_buffer(sess_data);
1668 }
1669 #else
1670 static void
1671 SMB2_auth_kerberos(struct SMB2_sess_data *sess_data)
1672 {
1673 	cifs_dbg(VFS, "Kerberos negotiated but upcall support disabled!\n");
1674 	sess_data->result = -EOPNOTSUPP;
1675 	sess_data->func = NULL;
1676 }
1677 #endif
1678 
1679 static void
1680 SMB2_sess_auth_rawntlmssp_authenticate(struct SMB2_sess_data *sess_data);
1681 
1682 static void
1683 SMB2_sess_auth_rawntlmssp_negotiate(struct SMB2_sess_data *sess_data)
1684 {
1685 	int rc;
1686 	struct cifs_ses *ses = sess_data->ses;
1687 	struct TCP_Server_Info *server = sess_data->server;
1688 	struct smb2_sess_setup_rsp *rsp = NULL;
1689 	unsigned char *ntlmssp_blob = NULL;
1690 	bool use_spnego = false; /* else use raw ntlmssp */
1691 	u16 blob_length = 0;
1692 	bool is_binding = false;
1693 
1694 	/*
1695 	 * If memory allocation is successful, caller of this function
1696 	 * frees it.
1697 	 */
1698 	ses->ntlmssp = kmalloc(sizeof(struct ntlmssp_auth), GFP_KERNEL);
1699 	if (!ses->ntlmssp) {
1700 		rc = -ENOMEM;
1701 		goto out_err;
1702 	}
1703 	ses->ntlmssp->sesskey_per_smbsess = true;
1704 
1705 	rc = SMB2_sess_alloc_buffer(sess_data);
1706 	if (rc)
1707 		goto out_err;
1708 
1709 	rc = build_ntlmssp_smb3_negotiate_blob(&ntlmssp_blob,
1710 					  &blob_length, ses, server,
1711 					  sess_data->nls_cp);
1712 	if (rc)
1713 		goto out;
1714 
1715 	if (use_spnego) {
1716 		/* BB eventually need to add this */
1717 		cifs_dbg(VFS, "spnego not supported for SMB2 yet\n");
1718 		rc = -EOPNOTSUPP;
1719 		goto out;
1720 	}
1721 	sess_data->iov[1].iov_base = ntlmssp_blob;
1722 	sess_data->iov[1].iov_len = blob_length;
1723 
1724 	rc = SMB2_sess_sendreceive(sess_data);
1725 	rsp = (struct smb2_sess_setup_rsp *)sess_data->iov[0].iov_base;
1726 
1727 	/* If true, rc here is expected and not an error */
1728 	if (sess_data->buf0_type != CIFS_NO_BUFFER &&
1729 		rsp->hdr.Status == STATUS_MORE_PROCESSING_REQUIRED)
1730 		rc = 0;
1731 
1732 	if (rc)
1733 		goto out;
1734 
1735 	if (offsetof(struct smb2_sess_setup_rsp, Buffer) !=
1736 			le16_to_cpu(rsp->SecurityBufferOffset)) {
1737 		cifs_dbg(VFS, "Invalid security buffer offset %d\n",
1738 			le16_to_cpu(rsp->SecurityBufferOffset));
1739 		rc = -EIO;
1740 		goto out;
1741 	}
1742 	rc = decode_ntlmssp_challenge(rsp->Buffer,
1743 			le16_to_cpu(rsp->SecurityBufferLength), ses);
1744 	if (rc)
1745 		goto out;
1746 
1747 	cifs_dbg(FYI, "rawntlmssp session setup challenge phase\n");
1748 
1749 	spin_lock(&ses->ses_lock);
1750 	is_binding = (ses->ses_status == SES_GOOD);
1751 	spin_unlock(&ses->ses_lock);
1752 
1753 	/* keep existing ses id and flags if binding */
1754 	if (!is_binding) {
1755 		ses->Suid = le64_to_cpu(rsp->hdr.SessionId);
1756 		ses->session_flags = le16_to_cpu(rsp->SessionFlags);
1757 	}
1758 
1759 out:
1760 	kfree_sensitive(ntlmssp_blob);
1761 	SMB2_sess_free_buffer(sess_data);
1762 	if (!rc) {
1763 		sess_data->result = 0;
1764 		sess_data->func = SMB2_sess_auth_rawntlmssp_authenticate;
1765 		return;
1766 	}
1767 out_err:
1768 	kfree_sensitive(ses->ntlmssp);
1769 	ses->ntlmssp = NULL;
1770 	sess_data->result = rc;
1771 	sess_data->func = NULL;
1772 }
1773 
1774 static void
1775 SMB2_sess_auth_rawntlmssp_authenticate(struct SMB2_sess_data *sess_data)
1776 {
1777 	int rc;
1778 	struct cifs_ses *ses = sess_data->ses;
1779 	struct TCP_Server_Info *server = sess_data->server;
1780 	struct smb2_sess_setup_req *req;
1781 	struct smb2_sess_setup_rsp *rsp = NULL;
1782 	unsigned char *ntlmssp_blob = NULL;
1783 	bool use_spnego = false; /* else use raw ntlmssp */
1784 	u16 blob_length = 0;
1785 	bool is_binding = false;
1786 
1787 	rc = SMB2_sess_alloc_buffer(sess_data);
1788 	if (rc)
1789 		goto out;
1790 
1791 	req = (struct smb2_sess_setup_req *) sess_data->iov[0].iov_base;
1792 	req->hdr.SessionId = cpu_to_le64(ses->Suid);
1793 
1794 	rc = build_ntlmssp_auth_blob(&ntlmssp_blob, &blob_length,
1795 				     ses, server,
1796 				     sess_data->nls_cp);
1797 	if (rc) {
1798 		cifs_dbg(FYI, "build_ntlmssp_auth_blob failed %d\n", rc);
1799 		goto out;
1800 	}
1801 
1802 	if (use_spnego) {
1803 		/* BB eventually need to add this */
1804 		cifs_dbg(VFS, "spnego not supported for SMB2 yet\n");
1805 		rc = -EOPNOTSUPP;
1806 		goto out;
1807 	}
1808 	sess_data->iov[1].iov_base = ntlmssp_blob;
1809 	sess_data->iov[1].iov_len = blob_length;
1810 
1811 	rc = SMB2_sess_sendreceive(sess_data);
1812 	if (rc)
1813 		goto out;
1814 
1815 	rsp = (struct smb2_sess_setup_rsp *)sess_data->iov[0].iov_base;
1816 
1817 	spin_lock(&ses->ses_lock);
1818 	is_binding = (ses->ses_status == SES_GOOD);
1819 	spin_unlock(&ses->ses_lock);
1820 
1821 	/* keep existing ses id and flags if binding */
1822 	if (!is_binding) {
1823 		ses->Suid = le64_to_cpu(rsp->hdr.SessionId);
1824 		ses->session_flags = le16_to_cpu(rsp->SessionFlags);
1825 	}
1826 
1827 	rc = SMB2_sess_establish_session(sess_data);
1828 #ifdef CONFIG_CIFS_DEBUG_DUMP_KEYS
1829 	if (ses->server->dialect < SMB30_PROT_ID) {
1830 		cifs_dbg(VFS, "%s: dumping generated SMB2 session keys\n", __func__);
1831 		/*
1832 		 * The session id is opaque in terms of endianness, so we can't
1833 		 * print it as a long long. we dump it as we got it on the wire
1834 		 */
1835 		cifs_dbg(VFS, "Session Id    %*ph\n", (int)sizeof(ses->Suid),
1836 			 &ses->Suid);
1837 		cifs_dbg(VFS, "Session Key   %*ph\n",
1838 			 SMB2_NTLMV2_SESSKEY_SIZE, ses->auth_key.response);
1839 		cifs_dbg(VFS, "Signing Key   %*ph\n",
1840 			 SMB3_SIGN_KEY_SIZE, ses->auth_key.response);
1841 	}
1842 #endif
1843 out:
1844 	kfree_sensitive(ntlmssp_blob);
1845 	SMB2_sess_free_buffer(sess_data);
1846 	kfree_sensitive(ses->ntlmssp);
1847 	ses->ntlmssp = NULL;
1848 	sess_data->result = rc;
1849 	sess_data->func = NULL;
1850 }
1851 
1852 static int
1853 SMB2_select_sec(struct SMB2_sess_data *sess_data)
1854 {
1855 	int type;
1856 	struct cifs_ses *ses = sess_data->ses;
1857 	struct TCP_Server_Info *server = sess_data->server;
1858 
1859 	type = smb2_select_sectype(server, ses->sectype);
1860 	cifs_dbg(FYI, "sess setup type %d\n", type);
1861 	if (type == Unspecified) {
1862 		cifs_dbg(VFS, "Unable to select appropriate authentication method!\n");
1863 		return -EINVAL;
1864 	}
1865 
1866 	switch (type) {
1867 	case Kerberos:
1868 		sess_data->func = SMB2_auth_kerberos;
1869 		break;
1870 	case RawNTLMSSP:
1871 		sess_data->func = SMB2_sess_auth_rawntlmssp_negotiate;
1872 		break;
1873 	default:
1874 		cifs_dbg(VFS, "secType %d not supported!\n", type);
1875 		return -EOPNOTSUPP;
1876 	}
1877 
1878 	return 0;
1879 }
1880 
1881 int
1882 SMB2_sess_setup(const unsigned int xid, struct cifs_ses *ses,
1883 		struct TCP_Server_Info *server,
1884 		const struct nls_table *nls_cp)
1885 {
1886 	int rc = 0;
1887 	struct SMB2_sess_data *sess_data;
1888 
1889 	cifs_dbg(FYI, "Session Setup\n");
1890 
1891 	if (!server) {
1892 		WARN(1, "%s: server is NULL!\n", __func__);
1893 		return -EIO;
1894 	}
1895 
1896 	sess_data = kzalloc(sizeof(struct SMB2_sess_data), GFP_KERNEL);
1897 	if (!sess_data)
1898 		return -ENOMEM;
1899 
1900 	sess_data->xid = xid;
1901 	sess_data->ses = ses;
1902 	sess_data->server = server;
1903 	sess_data->buf0_type = CIFS_NO_BUFFER;
1904 	sess_data->nls_cp = (struct nls_table *) nls_cp;
1905 	sess_data->previous_session = ses->Suid;
1906 
1907 	rc = SMB2_select_sec(sess_data);
1908 	if (rc)
1909 		goto out;
1910 
1911 	/*
1912 	 * Initialize the session hash with the server one.
1913 	 */
1914 	memcpy(ses->preauth_sha_hash, server->preauth_sha_hash,
1915 	       SMB2_PREAUTH_HASH_SIZE);
1916 
1917 	while (sess_data->func)
1918 		sess_data->func(sess_data);
1919 
1920 	if ((ses->session_flags & SMB2_SESSION_FLAG_IS_GUEST) && (ses->sign))
1921 		cifs_server_dbg(VFS, "signing requested but authenticated as guest\n");
1922 	rc = sess_data->result;
1923 out:
1924 	kfree_sensitive(sess_data);
1925 	return rc;
1926 }
1927 
1928 int
1929 SMB2_logoff(const unsigned int xid, struct cifs_ses *ses)
1930 {
1931 	struct smb_rqst rqst;
1932 	struct smb2_logoff_req *req; /* response is also trivial struct */
1933 	int rc = 0;
1934 	struct TCP_Server_Info *server;
1935 	int flags = 0;
1936 	unsigned int total_len;
1937 	struct kvec iov[1];
1938 	struct kvec rsp_iov;
1939 	int resp_buf_type;
1940 
1941 	cifs_dbg(FYI, "disconnect session %p\n", ses);
1942 
1943 	if (ses && (ses->server))
1944 		server = ses->server;
1945 	else
1946 		return -EIO;
1947 
1948 	/* no need to send SMB logoff if uid already closed due to reconnect */
1949 	spin_lock(&ses->chan_lock);
1950 	if (CIFS_ALL_CHANS_NEED_RECONNECT(ses)) {
1951 		spin_unlock(&ses->chan_lock);
1952 		goto smb2_session_already_dead;
1953 	}
1954 	spin_unlock(&ses->chan_lock);
1955 
1956 	rc = smb2_plain_req_init(SMB2_LOGOFF, NULL, ses->server,
1957 				 (void **) &req, &total_len);
1958 	if (rc)
1959 		return rc;
1960 
1961 	 /* since no tcon, smb2_init can not do this, so do here */
1962 	req->hdr.SessionId = cpu_to_le64(ses->Suid);
1963 
1964 	if (ses->session_flags & SMB2_SESSION_FLAG_ENCRYPT_DATA)
1965 		flags |= CIFS_TRANSFORM_REQ;
1966 	else if (server->sign)
1967 		req->hdr.Flags |= SMB2_FLAGS_SIGNED;
1968 
1969 	flags |= CIFS_NO_RSP_BUF;
1970 
1971 	iov[0].iov_base = (char *)req;
1972 	iov[0].iov_len = total_len;
1973 
1974 	memset(&rqst, 0, sizeof(struct smb_rqst));
1975 	rqst.rq_iov = iov;
1976 	rqst.rq_nvec = 1;
1977 
1978 	rc = cifs_send_recv(xid, ses, ses->server,
1979 			    &rqst, &resp_buf_type, flags, &rsp_iov);
1980 	cifs_small_buf_release(req);
1981 	/*
1982 	 * No tcon so can't do
1983 	 * cifs_stats_inc(&tcon->stats.smb2_stats.smb2_com_fail[SMB2...]);
1984 	 */
1985 
1986 smb2_session_already_dead:
1987 	return rc;
1988 }
1989 
1990 static inline void cifs_stats_fail_inc(struct cifs_tcon *tcon, uint16_t code)
1991 {
1992 	cifs_stats_inc(&tcon->stats.smb2_stats.smb2_com_failed[code]);
1993 }
1994 
1995 #define MAX_SHARENAME_LENGTH (255 /* server */ + 80 /* share */ + 1 /* NULL */)
1996 
1997 /* These are similar values to what Windows uses */
1998 static inline void init_copy_chunk_defaults(struct cifs_tcon *tcon)
1999 {
2000 	tcon->max_chunks = 256;
2001 	tcon->max_bytes_chunk = 1048576;
2002 	tcon->max_bytes_copy = 16777216;
2003 }
2004 
2005 int
2006 SMB2_tcon(const unsigned int xid, struct cifs_ses *ses, const char *tree,
2007 	  struct cifs_tcon *tcon, const struct nls_table *cp)
2008 {
2009 	struct smb_rqst rqst;
2010 	struct smb2_tree_connect_req *req;
2011 	struct smb2_tree_connect_rsp *rsp = NULL;
2012 	struct kvec iov[2];
2013 	struct kvec rsp_iov = { NULL, 0 };
2014 	int rc = 0;
2015 	int resp_buftype;
2016 	int unc_path_len;
2017 	__le16 *unc_path = NULL;
2018 	int flags = 0;
2019 	unsigned int total_len;
2020 	struct TCP_Server_Info *server = cifs_pick_channel(ses);
2021 
2022 	cifs_dbg(FYI, "TCON\n");
2023 
2024 	if (!server || !tree)
2025 		return -EIO;
2026 
2027 	unc_path = kmalloc(MAX_SHARENAME_LENGTH * 2, GFP_KERNEL);
2028 	if (unc_path == NULL)
2029 		return -ENOMEM;
2030 
2031 	unc_path_len = cifs_strtoUTF16(unc_path, tree, strlen(tree), cp);
2032 	if (unc_path_len <= 0) {
2033 		kfree(unc_path);
2034 		return -EINVAL;
2035 	}
2036 	unc_path_len *= 2;
2037 
2038 	/* SMB2 TREE_CONNECT request must be called with TreeId == 0 */
2039 	tcon->tid = 0;
2040 	atomic_set(&tcon->num_remote_opens, 0);
2041 	rc = smb2_plain_req_init(SMB2_TREE_CONNECT, tcon, server,
2042 				 (void **) &req, &total_len);
2043 	if (rc) {
2044 		kfree(unc_path);
2045 		return rc;
2046 	}
2047 
2048 	if (smb3_encryption_required(tcon))
2049 		flags |= CIFS_TRANSFORM_REQ;
2050 
2051 	iov[0].iov_base = (char *)req;
2052 	/* 1 for pad */
2053 	iov[0].iov_len = total_len - 1;
2054 
2055 	/* Testing shows that buffer offset must be at location of Buffer[0] */
2056 	req->PathOffset = cpu_to_le16(sizeof(struct smb2_tree_connect_req));
2057 	req->PathLength = cpu_to_le16(unc_path_len);
2058 	iov[1].iov_base = unc_path;
2059 	iov[1].iov_len = unc_path_len;
2060 
2061 	/*
2062 	 * 3.11 tcon req must be signed if not encrypted. See MS-SMB2 3.2.4.1.1
2063 	 * unless it is guest or anonymous user. See MS-SMB2 3.2.5.3.1
2064 	 * (Samba servers don't always set the flag so also check if null user)
2065 	 */
2066 	if ((server->dialect == SMB311_PROT_ID) &&
2067 	    !smb3_encryption_required(tcon) &&
2068 	    !(ses->session_flags &
2069 		    (SMB2_SESSION_FLAG_IS_GUEST|SMB2_SESSION_FLAG_IS_NULL)) &&
2070 	    ((ses->user_name != NULL) || (ses->sectype == Kerberos)))
2071 		req->hdr.Flags |= SMB2_FLAGS_SIGNED;
2072 
2073 	memset(&rqst, 0, sizeof(struct smb_rqst));
2074 	rqst.rq_iov = iov;
2075 	rqst.rq_nvec = 2;
2076 
2077 	/* Need 64 for max size write so ask for more in case not there yet */
2078 	if (server->credits >= server->max_credits)
2079 		req->hdr.CreditRequest = cpu_to_le16(0);
2080 	else
2081 		req->hdr.CreditRequest = cpu_to_le16(
2082 			min_t(int, server->max_credits -
2083 			      server->credits, 64));
2084 
2085 	rc = cifs_send_recv(xid, ses, server,
2086 			    &rqst, &resp_buftype, flags, &rsp_iov);
2087 	cifs_small_buf_release(req);
2088 	rsp = (struct smb2_tree_connect_rsp *)rsp_iov.iov_base;
2089 	trace_smb3_tcon(xid, tcon->tid, ses->Suid, tree, rc);
2090 	if ((rc != 0) || (rsp == NULL)) {
2091 		cifs_stats_fail_inc(tcon, SMB2_TREE_CONNECT_HE);
2092 		tcon->need_reconnect = true;
2093 		goto tcon_error_exit;
2094 	}
2095 
2096 	switch (rsp->ShareType) {
2097 	case SMB2_SHARE_TYPE_DISK:
2098 		cifs_dbg(FYI, "connection to disk share\n");
2099 		break;
2100 	case SMB2_SHARE_TYPE_PIPE:
2101 		tcon->pipe = true;
2102 		cifs_dbg(FYI, "connection to pipe share\n");
2103 		break;
2104 	case SMB2_SHARE_TYPE_PRINT:
2105 		tcon->print = true;
2106 		cifs_dbg(FYI, "connection to printer\n");
2107 		break;
2108 	default:
2109 		cifs_server_dbg(VFS, "unknown share type %d\n", rsp->ShareType);
2110 		rc = -EOPNOTSUPP;
2111 		goto tcon_error_exit;
2112 	}
2113 
2114 	tcon->share_flags = le32_to_cpu(rsp->ShareFlags);
2115 	tcon->capabilities = rsp->Capabilities; /* we keep caps little endian */
2116 	tcon->maximal_access = le32_to_cpu(rsp->MaximalAccess);
2117 	tcon->tid = le32_to_cpu(rsp->hdr.Id.SyncId.TreeId);
2118 	strscpy(tcon->tree_name, tree, sizeof(tcon->tree_name));
2119 
2120 	if ((rsp->Capabilities & SMB2_SHARE_CAP_DFS) &&
2121 	    ((tcon->share_flags & SHI1005_FLAGS_DFS) == 0))
2122 		cifs_tcon_dbg(VFS, "DFS capability contradicts DFS flag\n");
2123 
2124 	if (tcon->seal &&
2125 	    !(server->capabilities & SMB2_GLOBAL_CAP_ENCRYPTION))
2126 		cifs_tcon_dbg(VFS, "Encryption is requested but not supported\n");
2127 
2128 	init_copy_chunk_defaults(tcon);
2129 	if (server->ops->validate_negotiate)
2130 		rc = server->ops->validate_negotiate(xid, tcon);
2131 	if (rc == 0) /* See MS-SMB2 2.2.10 and 3.2.5.5 */
2132 		if (tcon->share_flags & SMB2_SHAREFLAG_ISOLATED_TRANSPORT)
2133 			server->nosharesock = true;
2134 tcon_exit:
2135 
2136 	free_rsp_buf(resp_buftype, rsp);
2137 	kfree(unc_path);
2138 	return rc;
2139 
2140 tcon_error_exit:
2141 	if (rsp && rsp->hdr.Status == STATUS_BAD_NETWORK_NAME)
2142 		cifs_tcon_dbg(VFS, "BAD_NETWORK_NAME: %s\n", tree);
2143 	goto tcon_exit;
2144 }
2145 
2146 int
2147 SMB2_tdis(const unsigned int xid, struct cifs_tcon *tcon)
2148 {
2149 	struct smb_rqst rqst;
2150 	struct smb2_tree_disconnect_req *req; /* response is trivial */
2151 	int rc = 0;
2152 	struct cifs_ses *ses = tcon->ses;
2153 	struct TCP_Server_Info *server = cifs_pick_channel(ses);
2154 	int flags = 0;
2155 	unsigned int total_len;
2156 	struct kvec iov[1];
2157 	struct kvec rsp_iov;
2158 	int resp_buf_type;
2159 
2160 	cifs_dbg(FYI, "Tree Disconnect\n");
2161 
2162 	if (!ses || !(ses->server))
2163 		return -EIO;
2164 
2165 	trace_smb3_tdis_enter(xid, tcon->tid, ses->Suid, tcon->tree_name);
2166 	spin_lock(&ses->chan_lock);
2167 	if ((tcon->need_reconnect) ||
2168 	    (CIFS_ALL_CHANS_NEED_RECONNECT(tcon->ses))) {
2169 		spin_unlock(&ses->chan_lock);
2170 		return 0;
2171 	}
2172 	spin_unlock(&ses->chan_lock);
2173 
2174 	invalidate_all_cached_dirs(tcon);
2175 
2176 	rc = smb2_plain_req_init(SMB2_TREE_DISCONNECT, tcon, server,
2177 				 (void **) &req,
2178 				 &total_len);
2179 	if (rc)
2180 		return rc;
2181 
2182 	if (smb3_encryption_required(tcon))
2183 		flags |= CIFS_TRANSFORM_REQ;
2184 
2185 	flags |= CIFS_NO_RSP_BUF;
2186 
2187 	iov[0].iov_base = (char *)req;
2188 	iov[0].iov_len = total_len;
2189 
2190 	memset(&rqst, 0, sizeof(struct smb_rqst));
2191 	rqst.rq_iov = iov;
2192 	rqst.rq_nvec = 1;
2193 
2194 	rc = cifs_send_recv(xid, ses, server,
2195 			    &rqst, &resp_buf_type, flags, &rsp_iov);
2196 	cifs_small_buf_release(req);
2197 	if (rc) {
2198 		cifs_stats_fail_inc(tcon, SMB2_TREE_DISCONNECT_HE);
2199 		trace_smb3_tdis_err(xid, tcon->tid, ses->Suid, rc);
2200 	}
2201 	trace_smb3_tdis_done(xid, tcon->tid, ses->Suid);
2202 
2203 	return rc;
2204 }
2205 
2206 
2207 static struct create_durable *
2208 create_durable_buf(void)
2209 {
2210 	struct create_durable *buf;
2211 
2212 	buf = kzalloc(sizeof(struct create_durable), GFP_KERNEL);
2213 	if (!buf)
2214 		return NULL;
2215 
2216 	buf->ccontext.DataOffset = cpu_to_le16(offsetof
2217 					(struct create_durable, Data));
2218 	buf->ccontext.DataLength = cpu_to_le32(16);
2219 	buf->ccontext.NameOffset = cpu_to_le16(offsetof
2220 				(struct create_durable, Name));
2221 	buf->ccontext.NameLength = cpu_to_le16(4);
2222 	/* SMB2_CREATE_DURABLE_HANDLE_REQUEST is "DHnQ" */
2223 	buf->Name[0] = 'D';
2224 	buf->Name[1] = 'H';
2225 	buf->Name[2] = 'n';
2226 	buf->Name[3] = 'Q';
2227 	return buf;
2228 }
2229 
2230 static struct create_durable *
2231 create_reconnect_durable_buf(struct cifs_fid *fid)
2232 {
2233 	struct create_durable *buf;
2234 
2235 	buf = kzalloc(sizeof(struct create_durable), GFP_KERNEL);
2236 	if (!buf)
2237 		return NULL;
2238 
2239 	buf->ccontext.DataOffset = cpu_to_le16(offsetof
2240 					(struct create_durable, Data));
2241 	buf->ccontext.DataLength = cpu_to_le32(16);
2242 	buf->ccontext.NameOffset = cpu_to_le16(offsetof
2243 				(struct create_durable, Name));
2244 	buf->ccontext.NameLength = cpu_to_le16(4);
2245 	buf->Data.Fid.PersistentFileId = fid->persistent_fid;
2246 	buf->Data.Fid.VolatileFileId = fid->volatile_fid;
2247 	/* SMB2_CREATE_DURABLE_HANDLE_RECONNECT is "DHnC" */
2248 	buf->Name[0] = 'D';
2249 	buf->Name[1] = 'H';
2250 	buf->Name[2] = 'n';
2251 	buf->Name[3] = 'C';
2252 	return buf;
2253 }
2254 
2255 static void
2256 parse_query_id_ctxt(struct create_context *cc, struct smb2_file_all_info *buf)
2257 {
2258 	struct create_disk_id_rsp *pdisk_id = (struct create_disk_id_rsp *)cc;
2259 
2260 	cifs_dbg(FYI, "parse query id context 0x%llx 0x%llx\n",
2261 		pdisk_id->DiskFileId, pdisk_id->VolumeId);
2262 	buf->IndexNumber = pdisk_id->DiskFileId;
2263 }
2264 
2265 static void
2266 parse_posix_ctxt(struct create_context *cc, struct smb2_file_all_info *info,
2267 		 struct create_posix_rsp *posix)
2268 {
2269 	int sid_len;
2270 	u8 *beg = (u8 *)cc + le16_to_cpu(cc->DataOffset);
2271 	u8 *end = beg + le32_to_cpu(cc->DataLength);
2272 	u8 *sid;
2273 
2274 	memset(posix, 0, sizeof(*posix));
2275 
2276 	posix->nlink = le32_to_cpu(*(__le32 *)(beg + 0));
2277 	posix->reparse_tag = le32_to_cpu(*(__le32 *)(beg + 4));
2278 	posix->mode = le32_to_cpu(*(__le32 *)(beg + 8));
2279 
2280 	sid = beg + 12;
2281 	sid_len = posix_info_sid_size(sid, end);
2282 	if (sid_len < 0) {
2283 		cifs_dbg(VFS, "bad owner sid in posix create response\n");
2284 		return;
2285 	}
2286 	memcpy(&posix->owner, sid, sid_len);
2287 
2288 	sid = sid + sid_len;
2289 	sid_len = posix_info_sid_size(sid, end);
2290 	if (sid_len < 0) {
2291 		cifs_dbg(VFS, "bad group sid in posix create response\n");
2292 		return;
2293 	}
2294 	memcpy(&posix->group, sid, sid_len);
2295 
2296 	cifs_dbg(FYI, "nlink=%d mode=%o reparse_tag=%x\n",
2297 		 posix->nlink, posix->mode, posix->reparse_tag);
2298 }
2299 
2300 int smb2_parse_contexts(struct TCP_Server_Info *server,
2301 			struct kvec *rsp_iov,
2302 			unsigned int *epoch,
2303 			char *lease_key, __u8 *oplock,
2304 			struct smb2_file_all_info *buf,
2305 			struct create_posix_rsp *posix)
2306 {
2307 	struct smb2_create_rsp *rsp = rsp_iov->iov_base;
2308 	struct create_context *cc;
2309 	size_t rem, off, len;
2310 	size_t doff, dlen;
2311 	size_t noff, nlen;
2312 	char *name;
2313 	static const char smb3_create_tag_posix[] = {
2314 		0x93, 0xAD, 0x25, 0x50, 0x9C,
2315 		0xB4, 0x11, 0xE7, 0xB4, 0x23, 0x83,
2316 		0xDE, 0x96, 0x8B, 0xCD, 0x7C
2317 	};
2318 
2319 	*oplock = 0;
2320 
2321 	off = le32_to_cpu(rsp->CreateContextsOffset);
2322 	rem = le32_to_cpu(rsp->CreateContextsLength);
2323 	if (check_add_overflow(off, rem, &len) || len > rsp_iov->iov_len)
2324 		return -EINVAL;
2325 	cc = (struct create_context *)((u8 *)rsp + off);
2326 
2327 	/* Initialize inode number to 0 in case no valid data in qfid context */
2328 	if (buf)
2329 		buf->IndexNumber = 0;
2330 
2331 	while (rem >= sizeof(*cc)) {
2332 		doff = le16_to_cpu(cc->DataOffset);
2333 		dlen = le32_to_cpu(cc->DataLength);
2334 		if (check_add_overflow(doff, dlen, &len) || len > rem)
2335 			return -EINVAL;
2336 
2337 		noff = le16_to_cpu(cc->NameOffset);
2338 		nlen = le16_to_cpu(cc->NameLength);
2339 		if (noff + nlen > doff)
2340 			return -EINVAL;
2341 
2342 		name = (char *)cc + noff;
2343 		switch (nlen) {
2344 		case 4:
2345 			if (!strncmp(name, SMB2_CREATE_REQUEST_LEASE, 4)) {
2346 				*oplock = server->ops->parse_lease_buf(cc, epoch,
2347 								       lease_key);
2348 			} else if (buf &&
2349 				   !strncmp(name, SMB2_CREATE_QUERY_ON_DISK_ID, 4)) {
2350 				parse_query_id_ctxt(cc, buf);
2351 			}
2352 			break;
2353 		case 16:
2354 			if (posix && !memcmp(name, smb3_create_tag_posix, 16))
2355 				parse_posix_ctxt(cc, buf, posix);
2356 			break;
2357 		default:
2358 			cifs_dbg(FYI, "%s: unhandled context (nlen=%zu dlen=%zu)\n",
2359 				 __func__, nlen, dlen);
2360 			if (IS_ENABLED(CONFIG_CIFS_DEBUG2))
2361 				cifs_dump_mem("context data: ", cc, dlen);
2362 			break;
2363 		}
2364 
2365 		off = le32_to_cpu(cc->Next);
2366 		if (!off)
2367 			break;
2368 		if (check_sub_overflow(rem, off, &rem))
2369 			return -EINVAL;
2370 		cc = (struct create_context *)((u8 *)cc + off);
2371 	}
2372 
2373 	if (rsp->OplockLevel != SMB2_OPLOCK_LEVEL_LEASE)
2374 		*oplock = rsp->OplockLevel;
2375 
2376 	return 0;
2377 }
2378 
2379 static int
2380 add_lease_context(struct TCP_Server_Info *server,
2381 		  struct smb2_create_req *req,
2382 		  struct kvec *iov,
2383 		  unsigned int *num_iovec, u8 *lease_key, __u8 *oplock)
2384 {
2385 	unsigned int num = *num_iovec;
2386 
2387 	iov[num].iov_base = server->ops->create_lease_buf(lease_key, *oplock);
2388 	if (iov[num].iov_base == NULL)
2389 		return -ENOMEM;
2390 	iov[num].iov_len = server->vals->create_lease_size;
2391 	req->RequestedOplockLevel = SMB2_OPLOCK_LEVEL_LEASE;
2392 	*num_iovec = num + 1;
2393 	return 0;
2394 }
2395 
2396 static struct create_durable_v2 *
2397 create_durable_v2_buf(struct cifs_open_parms *oparms)
2398 {
2399 	struct cifs_fid *pfid = oparms->fid;
2400 	struct create_durable_v2 *buf;
2401 
2402 	buf = kzalloc(sizeof(struct create_durable_v2), GFP_KERNEL);
2403 	if (!buf)
2404 		return NULL;
2405 
2406 	buf->ccontext.DataOffset = cpu_to_le16(offsetof
2407 					(struct create_durable_v2, dcontext));
2408 	buf->ccontext.DataLength = cpu_to_le32(sizeof(struct durable_context_v2));
2409 	buf->ccontext.NameOffset = cpu_to_le16(offsetof
2410 				(struct create_durable_v2, Name));
2411 	buf->ccontext.NameLength = cpu_to_le16(4);
2412 
2413 	/*
2414 	 * NB: Handle timeout defaults to 0, which allows server to choose
2415 	 * (most servers default to 120 seconds) and most clients default to 0.
2416 	 * This can be overridden at mount ("handletimeout=") if the user wants
2417 	 * a different persistent (or resilient) handle timeout for all opens
2418 	 * on a particular SMB3 mount.
2419 	 */
2420 	buf->dcontext.Timeout = cpu_to_le32(oparms->tcon->handle_timeout);
2421 	buf->dcontext.Flags = cpu_to_le32(SMB2_DHANDLE_FLAG_PERSISTENT);
2422 
2423 	/* for replay, we should not overwrite the existing create guid */
2424 	if (!oparms->replay) {
2425 		generate_random_uuid(buf->dcontext.CreateGuid);
2426 		memcpy(pfid->create_guid, buf->dcontext.CreateGuid, 16);
2427 	} else
2428 		memcpy(buf->dcontext.CreateGuid, pfid->create_guid, 16);
2429 
2430 	/* SMB2_CREATE_DURABLE_HANDLE_REQUEST is "DH2Q" */
2431 	buf->Name[0] = 'D';
2432 	buf->Name[1] = 'H';
2433 	buf->Name[2] = '2';
2434 	buf->Name[3] = 'Q';
2435 	return buf;
2436 }
2437 
2438 static struct create_durable_handle_reconnect_v2 *
2439 create_reconnect_durable_v2_buf(struct cifs_fid *fid)
2440 {
2441 	struct create_durable_handle_reconnect_v2 *buf;
2442 
2443 	buf = kzalloc(sizeof(struct create_durable_handle_reconnect_v2),
2444 			GFP_KERNEL);
2445 	if (!buf)
2446 		return NULL;
2447 
2448 	buf->ccontext.DataOffset =
2449 		cpu_to_le16(offsetof(struct create_durable_handle_reconnect_v2,
2450 				     dcontext));
2451 	buf->ccontext.DataLength =
2452 		cpu_to_le32(sizeof(struct durable_reconnect_context_v2));
2453 	buf->ccontext.NameOffset =
2454 		cpu_to_le16(offsetof(struct create_durable_handle_reconnect_v2,
2455 			    Name));
2456 	buf->ccontext.NameLength = cpu_to_le16(4);
2457 
2458 	buf->dcontext.Fid.PersistentFileId = fid->persistent_fid;
2459 	buf->dcontext.Fid.VolatileFileId = fid->volatile_fid;
2460 	buf->dcontext.Flags = cpu_to_le32(SMB2_DHANDLE_FLAG_PERSISTENT);
2461 	memcpy(buf->dcontext.CreateGuid, fid->create_guid, 16);
2462 
2463 	/* SMB2_CREATE_DURABLE_HANDLE_RECONNECT_V2 is "DH2C" */
2464 	buf->Name[0] = 'D';
2465 	buf->Name[1] = 'H';
2466 	buf->Name[2] = '2';
2467 	buf->Name[3] = 'C';
2468 	return buf;
2469 }
2470 
2471 static int
2472 add_durable_v2_context(struct kvec *iov, unsigned int *num_iovec,
2473 		    struct cifs_open_parms *oparms)
2474 {
2475 	unsigned int num = *num_iovec;
2476 
2477 	iov[num].iov_base = create_durable_v2_buf(oparms);
2478 	if (iov[num].iov_base == NULL)
2479 		return -ENOMEM;
2480 	iov[num].iov_len = sizeof(struct create_durable_v2);
2481 	*num_iovec = num + 1;
2482 	return 0;
2483 }
2484 
2485 static int
2486 add_durable_reconnect_v2_context(struct kvec *iov, unsigned int *num_iovec,
2487 		    struct cifs_open_parms *oparms)
2488 {
2489 	unsigned int num = *num_iovec;
2490 
2491 	/* indicate that we don't need to relock the file */
2492 	oparms->reconnect = false;
2493 
2494 	iov[num].iov_base = create_reconnect_durable_v2_buf(oparms->fid);
2495 	if (iov[num].iov_base == NULL)
2496 		return -ENOMEM;
2497 	iov[num].iov_len = sizeof(struct create_durable_handle_reconnect_v2);
2498 	*num_iovec = num + 1;
2499 	return 0;
2500 }
2501 
2502 static int
2503 add_durable_context(struct kvec *iov, unsigned int *num_iovec,
2504 		    struct cifs_open_parms *oparms, bool use_persistent)
2505 {
2506 	unsigned int num = *num_iovec;
2507 
2508 	if (use_persistent) {
2509 		if (oparms->reconnect)
2510 			return add_durable_reconnect_v2_context(iov, num_iovec,
2511 								oparms);
2512 		else
2513 			return add_durable_v2_context(iov, num_iovec, oparms);
2514 	}
2515 
2516 	if (oparms->reconnect) {
2517 		iov[num].iov_base = create_reconnect_durable_buf(oparms->fid);
2518 		/* indicate that we don't need to relock the file */
2519 		oparms->reconnect = false;
2520 	} else
2521 		iov[num].iov_base = create_durable_buf();
2522 	if (iov[num].iov_base == NULL)
2523 		return -ENOMEM;
2524 	iov[num].iov_len = sizeof(struct create_durable);
2525 	*num_iovec = num + 1;
2526 	return 0;
2527 }
2528 
2529 /* See MS-SMB2 2.2.13.2.7 */
2530 static struct crt_twarp_ctxt *
2531 create_twarp_buf(__u64 timewarp)
2532 {
2533 	struct crt_twarp_ctxt *buf;
2534 
2535 	buf = kzalloc(sizeof(struct crt_twarp_ctxt), GFP_KERNEL);
2536 	if (!buf)
2537 		return NULL;
2538 
2539 	buf->ccontext.DataOffset = cpu_to_le16(offsetof
2540 					(struct crt_twarp_ctxt, Timestamp));
2541 	buf->ccontext.DataLength = cpu_to_le32(8);
2542 	buf->ccontext.NameOffset = cpu_to_le16(offsetof
2543 				(struct crt_twarp_ctxt, Name));
2544 	buf->ccontext.NameLength = cpu_to_le16(4);
2545 	/* SMB2_CREATE_TIMEWARP_TOKEN is "TWrp" */
2546 	buf->Name[0] = 'T';
2547 	buf->Name[1] = 'W';
2548 	buf->Name[2] = 'r';
2549 	buf->Name[3] = 'p';
2550 	buf->Timestamp = cpu_to_le64(timewarp);
2551 	return buf;
2552 }
2553 
2554 /* See MS-SMB2 2.2.13.2.7 */
2555 static int
2556 add_twarp_context(struct kvec *iov, unsigned int *num_iovec, __u64 timewarp)
2557 {
2558 	unsigned int num = *num_iovec;
2559 
2560 	iov[num].iov_base = create_twarp_buf(timewarp);
2561 	if (iov[num].iov_base == NULL)
2562 		return -ENOMEM;
2563 	iov[num].iov_len = sizeof(struct crt_twarp_ctxt);
2564 	*num_iovec = num + 1;
2565 	return 0;
2566 }
2567 
2568 /* See http://technet.microsoft.com/en-us/library/hh509017(v=ws.10).aspx */
2569 static void setup_owner_group_sids(char *buf)
2570 {
2571 	struct owner_group_sids *sids = (struct owner_group_sids *)buf;
2572 
2573 	/* Populate the user ownership fields S-1-5-88-1 */
2574 	sids->owner.Revision = 1;
2575 	sids->owner.NumAuth = 3;
2576 	sids->owner.Authority[5] = 5;
2577 	sids->owner.SubAuthorities[0] = cpu_to_le32(88);
2578 	sids->owner.SubAuthorities[1] = cpu_to_le32(1);
2579 	sids->owner.SubAuthorities[2] = cpu_to_le32(current_fsuid().val);
2580 
2581 	/* Populate the group ownership fields S-1-5-88-2 */
2582 	sids->group.Revision = 1;
2583 	sids->group.NumAuth = 3;
2584 	sids->group.Authority[5] = 5;
2585 	sids->group.SubAuthorities[0] = cpu_to_le32(88);
2586 	sids->group.SubAuthorities[1] = cpu_to_le32(2);
2587 	sids->group.SubAuthorities[2] = cpu_to_le32(current_fsgid().val);
2588 
2589 	cifs_dbg(FYI, "owner S-1-5-88-1-%d, group S-1-5-88-2-%d\n", current_fsuid().val, current_fsgid().val);
2590 }
2591 
2592 /* See MS-SMB2 2.2.13.2.2 and MS-DTYP 2.4.6 */
2593 static struct crt_sd_ctxt *
2594 create_sd_buf(umode_t mode, bool set_owner, unsigned int *len)
2595 {
2596 	struct crt_sd_ctxt *buf;
2597 	__u8 *ptr, *aclptr;
2598 	unsigned int acelen, acl_size, ace_count;
2599 	unsigned int owner_offset = 0;
2600 	unsigned int group_offset = 0;
2601 	struct smb3_acl acl = {};
2602 
2603 	*len = round_up(sizeof(struct crt_sd_ctxt) + (sizeof(struct cifs_ace) * 4), 8);
2604 
2605 	if (set_owner) {
2606 		/* sizeof(struct owner_group_sids) is already multiple of 8 so no need to round */
2607 		*len += sizeof(struct owner_group_sids);
2608 	}
2609 
2610 	buf = kzalloc(*len, GFP_KERNEL);
2611 	if (buf == NULL)
2612 		return buf;
2613 
2614 	ptr = (__u8 *)&buf[1];
2615 	if (set_owner) {
2616 		/* offset fields are from beginning of security descriptor not of create context */
2617 		owner_offset = ptr - (__u8 *)&buf->sd;
2618 		buf->sd.OffsetOwner = cpu_to_le32(owner_offset);
2619 		group_offset = owner_offset + offsetof(struct owner_group_sids, group);
2620 		buf->sd.OffsetGroup = cpu_to_le32(group_offset);
2621 
2622 		setup_owner_group_sids(ptr);
2623 		ptr += sizeof(struct owner_group_sids);
2624 	} else {
2625 		buf->sd.OffsetOwner = 0;
2626 		buf->sd.OffsetGroup = 0;
2627 	}
2628 
2629 	buf->ccontext.DataOffset = cpu_to_le16(offsetof(struct crt_sd_ctxt, sd));
2630 	buf->ccontext.NameOffset = cpu_to_le16(offsetof(struct crt_sd_ctxt, Name));
2631 	buf->ccontext.NameLength = cpu_to_le16(4);
2632 	/* SMB2_CREATE_SD_BUFFER_TOKEN is "SecD" */
2633 	buf->Name[0] = 'S';
2634 	buf->Name[1] = 'e';
2635 	buf->Name[2] = 'c';
2636 	buf->Name[3] = 'D';
2637 	buf->sd.Revision = 1;  /* Must be one see MS-DTYP 2.4.6 */
2638 
2639 	/*
2640 	 * ACL is "self relative" ie ACL is stored in contiguous block of memory
2641 	 * and "DP" ie the DACL is present
2642 	 */
2643 	buf->sd.Control = cpu_to_le16(ACL_CONTROL_SR | ACL_CONTROL_DP);
2644 
2645 	/* offset owner, group and Sbz1 and SACL are all zero */
2646 	buf->sd.OffsetDacl = cpu_to_le32(ptr - (__u8 *)&buf->sd);
2647 	/* Ship the ACL for now. we will copy it into buf later. */
2648 	aclptr = ptr;
2649 	ptr += sizeof(struct smb3_acl);
2650 
2651 	/* create one ACE to hold the mode embedded in reserved special SID */
2652 	acelen = setup_special_mode_ACE((struct cifs_ace *)ptr, (__u64)mode);
2653 	ptr += acelen;
2654 	acl_size = acelen + sizeof(struct smb3_acl);
2655 	ace_count = 1;
2656 
2657 	if (set_owner) {
2658 		/* we do not need to reallocate buffer to add the two more ACEs. plenty of space */
2659 		acelen = setup_special_user_owner_ACE((struct cifs_ace *)ptr);
2660 		ptr += acelen;
2661 		acl_size += acelen;
2662 		ace_count += 1;
2663 	}
2664 
2665 	/* and one more ACE to allow access for authenticated users */
2666 	acelen = setup_authusers_ACE((struct cifs_ace *)ptr);
2667 	ptr += acelen;
2668 	acl_size += acelen;
2669 	ace_count += 1;
2670 
2671 	acl.AclRevision = ACL_REVISION; /* See 2.4.4.1 of MS-DTYP */
2672 	acl.AclSize = cpu_to_le16(acl_size);
2673 	acl.AceCount = cpu_to_le16(ace_count);
2674 	/* acl.Sbz1 and Sbz2 MBZ so are not set here, but initialized above */
2675 	memcpy(aclptr, &acl, sizeof(struct smb3_acl));
2676 
2677 	buf->ccontext.DataLength = cpu_to_le32(ptr - (__u8 *)&buf->sd);
2678 	*len = round_up((unsigned int)(ptr - (__u8 *)buf), 8);
2679 
2680 	return buf;
2681 }
2682 
2683 static int
2684 add_sd_context(struct kvec *iov, unsigned int *num_iovec, umode_t mode, bool set_owner)
2685 {
2686 	unsigned int num = *num_iovec;
2687 	unsigned int len = 0;
2688 
2689 	iov[num].iov_base = create_sd_buf(mode, set_owner, &len);
2690 	if (iov[num].iov_base == NULL)
2691 		return -ENOMEM;
2692 	iov[num].iov_len = len;
2693 	*num_iovec = num + 1;
2694 	return 0;
2695 }
2696 
2697 static struct crt_query_id_ctxt *
2698 create_query_id_buf(void)
2699 {
2700 	struct crt_query_id_ctxt *buf;
2701 
2702 	buf = kzalloc(sizeof(struct crt_query_id_ctxt), GFP_KERNEL);
2703 	if (!buf)
2704 		return NULL;
2705 
2706 	buf->ccontext.DataOffset = cpu_to_le16(0);
2707 	buf->ccontext.DataLength = cpu_to_le32(0);
2708 	buf->ccontext.NameOffset = cpu_to_le16(offsetof
2709 				(struct crt_query_id_ctxt, Name));
2710 	buf->ccontext.NameLength = cpu_to_le16(4);
2711 	/* SMB2_CREATE_QUERY_ON_DISK_ID is "QFid" */
2712 	buf->Name[0] = 'Q';
2713 	buf->Name[1] = 'F';
2714 	buf->Name[2] = 'i';
2715 	buf->Name[3] = 'd';
2716 	return buf;
2717 }
2718 
2719 /* See MS-SMB2 2.2.13.2.9 */
2720 static int
2721 add_query_id_context(struct kvec *iov, unsigned int *num_iovec)
2722 {
2723 	unsigned int num = *num_iovec;
2724 
2725 	iov[num].iov_base = create_query_id_buf();
2726 	if (iov[num].iov_base == NULL)
2727 		return -ENOMEM;
2728 	iov[num].iov_len = sizeof(struct crt_query_id_ctxt);
2729 	*num_iovec = num + 1;
2730 	return 0;
2731 }
2732 
2733 static void add_ea_context(struct cifs_open_parms *oparms,
2734 			   struct kvec *rq_iov, unsigned int *num_iovs)
2735 {
2736 	struct kvec *iov = oparms->ea_cctx;
2737 
2738 	if (iov && iov->iov_base && iov->iov_len) {
2739 		rq_iov[(*num_iovs)++] = *iov;
2740 		memset(iov, 0, sizeof(*iov));
2741 	}
2742 }
2743 
2744 static int
2745 alloc_path_with_tree_prefix(__le16 **out_path, int *out_size, int *out_len,
2746 			    const char *treename, const __le16 *path)
2747 {
2748 	int treename_len, path_len;
2749 	struct nls_table *cp;
2750 	const __le16 sep[] = {cpu_to_le16('\\'), cpu_to_le16(0x0000)};
2751 
2752 	/*
2753 	 * skip leading "\\"
2754 	 */
2755 	treename_len = strlen(treename);
2756 	if (treename_len < 2 || !(treename[0] == '\\' && treename[1] == '\\'))
2757 		return -EINVAL;
2758 
2759 	treename += 2;
2760 	treename_len -= 2;
2761 
2762 	path_len = UniStrnlen((wchar_t *)path, PATH_MAX);
2763 
2764 	/* make room for one path separator only if @path isn't empty */
2765 	*out_len = treename_len + (path[0] ? 1 : 0) + path_len;
2766 
2767 	/*
2768 	 * final path needs to be 8-byte aligned as specified in
2769 	 * MS-SMB2 2.2.13 SMB2 CREATE Request.
2770 	 */
2771 	*out_size = round_up(*out_len * sizeof(__le16), 8);
2772 	*out_path = kzalloc(*out_size + sizeof(__le16) /* null */, GFP_KERNEL);
2773 	if (!*out_path)
2774 		return -ENOMEM;
2775 
2776 	cp = load_nls_default();
2777 	cifs_strtoUTF16(*out_path, treename, treename_len, cp);
2778 
2779 	/* Do not append the separator if the path is empty */
2780 	if (path[0] != cpu_to_le16(0x0000)) {
2781 		UniStrcat((wchar_t *)*out_path, (wchar_t *)sep);
2782 		UniStrcat((wchar_t *)*out_path, (wchar_t *)path);
2783 	}
2784 
2785 	unload_nls(cp);
2786 
2787 	return 0;
2788 }
2789 
2790 int smb311_posix_mkdir(const unsigned int xid, struct inode *inode,
2791 			       umode_t mode, struct cifs_tcon *tcon,
2792 			       const char *full_path,
2793 			       struct cifs_sb_info *cifs_sb)
2794 {
2795 	struct smb_rqst rqst;
2796 	struct smb2_create_req *req;
2797 	struct smb2_create_rsp *rsp = NULL;
2798 	struct cifs_ses *ses = tcon->ses;
2799 	struct kvec iov[3]; /* make sure at least one for each open context */
2800 	struct kvec rsp_iov = {NULL, 0};
2801 	int resp_buftype;
2802 	int uni_path_len;
2803 	__le16 *copy_path = NULL;
2804 	int copy_size;
2805 	int rc = 0;
2806 	unsigned int n_iov = 2;
2807 	__u32 file_attributes = 0;
2808 	char *pc_buf = NULL;
2809 	int flags = 0;
2810 	unsigned int total_len;
2811 	__le16 *utf16_path = NULL;
2812 	struct TCP_Server_Info *server;
2813 	int retries = 0, cur_sleep = 1;
2814 
2815 replay_again:
2816 	/* reinitialize for possible replay */
2817 	flags = 0;
2818 	n_iov = 2;
2819 	server = cifs_pick_channel(ses);
2820 
2821 	cifs_dbg(FYI, "mkdir\n");
2822 
2823 	/* resource #1: path allocation */
2824 	utf16_path = cifs_convert_path_to_utf16(full_path, cifs_sb);
2825 	if (!utf16_path)
2826 		return -ENOMEM;
2827 
2828 	if (!ses || !server) {
2829 		rc = -EIO;
2830 		goto err_free_path;
2831 	}
2832 
2833 	/* resource #2: request */
2834 	rc = smb2_plain_req_init(SMB2_CREATE, tcon, server,
2835 				 (void **) &req, &total_len);
2836 	if (rc)
2837 		goto err_free_path;
2838 
2839 
2840 	if (smb3_encryption_required(tcon))
2841 		flags |= CIFS_TRANSFORM_REQ;
2842 
2843 	req->ImpersonationLevel = IL_IMPERSONATION;
2844 	req->DesiredAccess = cpu_to_le32(FILE_WRITE_ATTRIBUTES);
2845 	/* File attributes ignored on open (used in create though) */
2846 	req->FileAttributes = cpu_to_le32(file_attributes);
2847 	req->ShareAccess = FILE_SHARE_ALL_LE;
2848 	req->CreateDisposition = cpu_to_le32(FILE_CREATE);
2849 	req->CreateOptions = cpu_to_le32(CREATE_NOT_FILE);
2850 
2851 	iov[0].iov_base = (char *)req;
2852 	/* -1 since last byte is buf[0] which is sent below (path) */
2853 	iov[0].iov_len = total_len - 1;
2854 
2855 	req->NameOffset = cpu_to_le16(sizeof(struct smb2_create_req));
2856 
2857 	/* [MS-SMB2] 2.2.13 NameOffset:
2858 	 * If SMB2_FLAGS_DFS_OPERATIONS is set in the Flags field of
2859 	 * the SMB2 header, the file name includes a prefix that will
2860 	 * be processed during DFS name normalization as specified in
2861 	 * section 3.3.5.9. Otherwise, the file name is relative to
2862 	 * the share that is identified by the TreeId in the SMB2
2863 	 * header.
2864 	 */
2865 	if (tcon->share_flags & SHI1005_FLAGS_DFS) {
2866 		int name_len;
2867 
2868 		req->hdr.Flags |= SMB2_FLAGS_DFS_OPERATIONS;
2869 		rc = alloc_path_with_tree_prefix(&copy_path, &copy_size,
2870 						 &name_len,
2871 						 tcon->tree_name, utf16_path);
2872 		if (rc)
2873 			goto err_free_req;
2874 
2875 		req->NameLength = cpu_to_le16(name_len * 2);
2876 		uni_path_len = copy_size;
2877 		/* free before overwriting resource */
2878 		kfree(utf16_path);
2879 		utf16_path = copy_path;
2880 	} else {
2881 		uni_path_len = (2 * UniStrnlen((wchar_t *)utf16_path, PATH_MAX)) + 2;
2882 		/* MUST set path len (NameLength) to 0 opening root of share */
2883 		req->NameLength = cpu_to_le16(uni_path_len - 2);
2884 		if (uni_path_len % 8 != 0) {
2885 			copy_size = roundup(uni_path_len, 8);
2886 			copy_path = kzalloc(copy_size, GFP_KERNEL);
2887 			if (!copy_path) {
2888 				rc = -ENOMEM;
2889 				goto err_free_req;
2890 			}
2891 			memcpy((char *)copy_path, (const char *)utf16_path,
2892 			       uni_path_len);
2893 			uni_path_len = copy_size;
2894 			/* free before overwriting resource */
2895 			kfree(utf16_path);
2896 			utf16_path = copy_path;
2897 		}
2898 	}
2899 
2900 	iov[1].iov_len = uni_path_len;
2901 	iov[1].iov_base = utf16_path;
2902 	req->RequestedOplockLevel = SMB2_OPLOCK_LEVEL_NONE;
2903 
2904 	if (tcon->posix_extensions) {
2905 		/* resource #3: posix buf */
2906 		rc = add_posix_context(iov, &n_iov, mode);
2907 		if (rc)
2908 			goto err_free_req;
2909 		req->CreateContextsOffset = cpu_to_le32(
2910 			sizeof(struct smb2_create_req) +
2911 			iov[1].iov_len);
2912 		pc_buf = iov[n_iov-1].iov_base;
2913 	}
2914 
2915 
2916 	memset(&rqst, 0, sizeof(struct smb_rqst));
2917 	rqst.rq_iov = iov;
2918 	rqst.rq_nvec = n_iov;
2919 
2920 	/* no need to inc num_remote_opens because we close it just below */
2921 	trace_smb3_posix_mkdir_enter(xid, tcon->tid, ses->Suid, full_path, CREATE_NOT_FILE,
2922 				    FILE_WRITE_ATTRIBUTES);
2923 
2924 	if (retries)
2925 		smb2_set_replay(server, &rqst);
2926 
2927 	/* resource #4: response buffer */
2928 	rc = cifs_send_recv(xid, ses, server,
2929 			    &rqst, &resp_buftype, flags, &rsp_iov);
2930 	if (rc) {
2931 		cifs_stats_fail_inc(tcon, SMB2_CREATE_HE);
2932 		trace_smb3_posix_mkdir_err(xid, tcon->tid, ses->Suid,
2933 					   CREATE_NOT_FILE,
2934 					   FILE_WRITE_ATTRIBUTES, rc);
2935 		goto err_free_rsp_buf;
2936 	}
2937 
2938 	/*
2939 	 * Although unlikely to be possible for rsp to be null and rc not set,
2940 	 * adding check below is slightly safer long term (and quiets Coverity
2941 	 * warning)
2942 	 */
2943 	rsp = (struct smb2_create_rsp *)rsp_iov.iov_base;
2944 	if (rsp == NULL) {
2945 		rc = -EIO;
2946 		kfree(pc_buf);
2947 		goto err_free_req;
2948 	}
2949 
2950 	trace_smb3_posix_mkdir_done(xid, rsp->PersistentFileId, tcon->tid, ses->Suid,
2951 				    CREATE_NOT_FILE, FILE_WRITE_ATTRIBUTES);
2952 
2953 	SMB2_close(xid, tcon, rsp->PersistentFileId, rsp->VolatileFileId);
2954 
2955 	/* Eventually save off posix specific response info and timestaps */
2956 
2957 err_free_rsp_buf:
2958 	free_rsp_buf(resp_buftype, rsp);
2959 	kfree(pc_buf);
2960 err_free_req:
2961 	cifs_small_buf_release(req);
2962 err_free_path:
2963 	kfree(utf16_path);
2964 
2965 	if (is_replayable_error(rc) &&
2966 	    smb2_should_replay(tcon, &retries, &cur_sleep))
2967 		goto replay_again;
2968 
2969 	return rc;
2970 }
2971 
2972 int
2973 SMB2_open_init(struct cifs_tcon *tcon, struct TCP_Server_Info *server,
2974 	       struct smb_rqst *rqst, __u8 *oplock,
2975 	       struct cifs_open_parms *oparms, __le16 *path)
2976 {
2977 	struct smb2_create_req *req;
2978 	unsigned int n_iov = 2;
2979 	__u32 file_attributes = 0;
2980 	int copy_size;
2981 	int uni_path_len;
2982 	unsigned int total_len;
2983 	struct kvec *iov = rqst->rq_iov;
2984 	__le16 *copy_path;
2985 	int rc;
2986 
2987 	rc = smb2_plain_req_init(SMB2_CREATE, tcon, server,
2988 				 (void **) &req, &total_len);
2989 	if (rc)
2990 		return rc;
2991 
2992 	iov[0].iov_base = (char *)req;
2993 	/* -1 since last byte is buf[0] which is sent below (path) */
2994 	iov[0].iov_len = total_len - 1;
2995 
2996 	if (oparms->create_options & CREATE_OPTION_READONLY)
2997 		file_attributes |= ATTR_READONLY;
2998 	if (oparms->create_options & CREATE_OPTION_SPECIAL)
2999 		file_attributes |= ATTR_SYSTEM;
3000 
3001 	req->ImpersonationLevel = IL_IMPERSONATION;
3002 	req->DesiredAccess = cpu_to_le32(oparms->desired_access);
3003 	/* File attributes ignored on open (used in create though) */
3004 	req->FileAttributes = cpu_to_le32(file_attributes);
3005 	req->ShareAccess = FILE_SHARE_ALL_LE;
3006 
3007 	req->CreateDisposition = cpu_to_le32(oparms->disposition);
3008 	req->CreateOptions = cpu_to_le32(oparms->create_options & CREATE_OPTIONS_MASK);
3009 	req->NameOffset = cpu_to_le16(sizeof(struct smb2_create_req));
3010 
3011 	/* [MS-SMB2] 2.2.13 NameOffset:
3012 	 * If SMB2_FLAGS_DFS_OPERATIONS is set in the Flags field of
3013 	 * the SMB2 header, the file name includes a prefix that will
3014 	 * be processed during DFS name normalization as specified in
3015 	 * section 3.3.5.9. Otherwise, the file name is relative to
3016 	 * the share that is identified by the TreeId in the SMB2
3017 	 * header.
3018 	 */
3019 	if (tcon->share_flags & SHI1005_FLAGS_DFS) {
3020 		int name_len;
3021 
3022 		req->hdr.Flags |= SMB2_FLAGS_DFS_OPERATIONS;
3023 		rc = alloc_path_with_tree_prefix(&copy_path, &copy_size,
3024 						 &name_len,
3025 						 tcon->tree_name, path);
3026 		if (rc)
3027 			return rc;
3028 		req->NameLength = cpu_to_le16(name_len * 2);
3029 		uni_path_len = copy_size;
3030 		path = copy_path;
3031 	} else {
3032 		uni_path_len = (2 * UniStrnlen((wchar_t *)path, PATH_MAX)) + 2;
3033 		/* MUST set path len (NameLength) to 0 opening root of share */
3034 		req->NameLength = cpu_to_le16(uni_path_len - 2);
3035 		copy_size = round_up(uni_path_len, 8);
3036 		copy_path = kzalloc(copy_size, GFP_KERNEL);
3037 		if (!copy_path)
3038 			return -ENOMEM;
3039 		memcpy((char *)copy_path, (const char *)path,
3040 		       uni_path_len);
3041 		uni_path_len = copy_size;
3042 		path = copy_path;
3043 	}
3044 
3045 	iov[1].iov_len = uni_path_len;
3046 	iov[1].iov_base = path;
3047 
3048 	if ((!server->oplocks) || (tcon->no_lease))
3049 		*oplock = SMB2_OPLOCK_LEVEL_NONE;
3050 
3051 	if (!(server->capabilities & SMB2_GLOBAL_CAP_LEASING) ||
3052 	    *oplock == SMB2_OPLOCK_LEVEL_NONE)
3053 		req->RequestedOplockLevel = *oplock;
3054 	else if (!(server->capabilities & SMB2_GLOBAL_CAP_DIRECTORY_LEASING) &&
3055 		  (oparms->create_options & CREATE_NOT_FILE))
3056 		req->RequestedOplockLevel = *oplock; /* no srv lease support */
3057 	else {
3058 		rc = add_lease_context(server, req, iov, &n_iov,
3059 				       oparms->fid->lease_key, oplock);
3060 		if (rc)
3061 			return rc;
3062 	}
3063 
3064 	if (*oplock == SMB2_OPLOCK_LEVEL_BATCH) {
3065 		rc = add_durable_context(iov, &n_iov, oparms,
3066 					tcon->use_persistent);
3067 		if (rc)
3068 			return rc;
3069 	}
3070 
3071 	if (tcon->posix_extensions) {
3072 		rc = add_posix_context(iov, &n_iov, oparms->mode);
3073 		if (rc)
3074 			return rc;
3075 	}
3076 
3077 	if (tcon->snapshot_time) {
3078 		cifs_dbg(FYI, "adding snapshot context\n");
3079 		rc = add_twarp_context(iov, &n_iov, tcon->snapshot_time);
3080 		if (rc)
3081 			return rc;
3082 	}
3083 
3084 	if ((oparms->disposition != FILE_OPEN) && (oparms->cifs_sb)) {
3085 		bool set_mode;
3086 		bool set_owner;
3087 
3088 		if ((oparms->cifs_sb->mnt_cifs_flags & CIFS_MOUNT_MODE_FROM_SID) &&
3089 		    (oparms->mode != ACL_NO_MODE))
3090 			set_mode = true;
3091 		else {
3092 			set_mode = false;
3093 			oparms->mode = ACL_NO_MODE;
3094 		}
3095 
3096 		if (oparms->cifs_sb->mnt_cifs_flags & CIFS_MOUNT_UID_FROM_ACL)
3097 			set_owner = true;
3098 		else
3099 			set_owner = false;
3100 
3101 		if (set_owner | set_mode) {
3102 			cifs_dbg(FYI, "add sd with mode 0x%x\n", oparms->mode);
3103 			rc = add_sd_context(iov, &n_iov, oparms->mode, set_owner);
3104 			if (rc)
3105 				return rc;
3106 		}
3107 	}
3108 
3109 	add_query_id_context(iov, &n_iov);
3110 	add_ea_context(oparms, iov, &n_iov);
3111 
3112 	if (n_iov > 2) {
3113 		/*
3114 		 * We have create contexts behind iov[1] (the file
3115 		 * name), point at them from the main create request
3116 		 */
3117 		req->CreateContextsOffset = cpu_to_le32(
3118 			sizeof(struct smb2_create_req) +
3119 			iov[1].iov_len);
3120 		req->CreateContextsLength = 0;
3121 
3122 		for (unsigned int i = 2; i < (n_iov-1); i++) {
3123 			struct kvec *v = &iov[i];
3124 			size_t len = v->iov_len;
3125 			struct create_context *cctx =
3126 				(struct create_context *)v->iov_base;
3127 
3128 			cctx->Next = cpu_to_le32(len);
3129 			le32_add_cpu(&req->CreateContextsLength, len);
3130 		}
3131 		le32_add_cpu(&req->CreateContextsLength,
3132 			     iov[n_iov-1].iov_len);
3133 	}
3134 
3135 	rqst->rq_nvec = n_iov;
3136 	return 0;
3137 }
3138 
3139 /* rq_iov[0] is the request and is released by cifs_small_buf_release().
3140  * All other vectors are freed by kfree().
3141  */
3142 void
3143 SMB2_open_free(struct smb_rqst *rqst)
3144 {
3145 	int i;
3146 
3147 	if (rqst && rqst->rq_iov) {
3148 		cifs_small_buf_release(rqst->rq_iov[0].iov_base);
3149 		for (i = 1; i < rqst->rq_nvec; i++)
3150 			if (rqst->rq_iov[i].iov_base != smb2_padding)
3151 				kfree(rqst->rq_iov[i].iov_base);
3152 	}
3153 }
3154 
3155 int
3156 SMB2_open(const unsigned int xid, struct cifs_open_parms *oparms, __le16 *path,
3157 	  __u8 *oplock, struct smb2_file_all_info *buf,
3158 	  struct create_posix_rsp *posix,
3159 	  struct kvec *err_iov, int *buftype)
3160 {
3161 	struct smb_rqst rqst;
3162 	struct smb2_create_rsp *rsp = NULL;
3163 	struct cifs_tcon *tcon = oparms->tcon;
3164 	struct cifs_ses *ses = tcon->ses;
3165 	struct TCP_Server_Info *server;
3166 	struct kvec iov[SMB2_CREATE_IOV_SIZE];
3167 	struct kvec rsp_iov = {NULL, 0};
3168 	int resp_buftype = CIFS_NO_BUFFER;
3169 	int rc = 0;
3170 	int flags = 0;
3171 	int retries = 0, cur_sleep = 1;
3172 
3173 replay_again:
3174 	/* reinitialize for possible replay */
3175 	flags = 0;
3176 	server = cifs_pick_channel(ses);
3177 	oparms->replay = !!(retries);
3178 
3179 	cifs_dbg(FYI, "create/open\n");
3180 	if (!ses || !server)
3181 		return -EIO;
3182 
3183 	if (smb3_encryption_required(tcon))
3184 		flags |= CIFS_TRANSFORM_REQ;
3185 
3186 	memset(&rqst, 0, sizeof(struct smb_rqst));
3187 	memset(&iov, 0, sizeof(iov));
3188 	rqst.rq_iov = iov;
3189 	rqst.rq_nvec = SMB2_CREATE_IOV_SIZE;
3190 
3191 	rc = SMB2_open_init(tcon, server,
3192 			    &rqst, oplock, oparms, path);
3193 	if (rc)
3194 		goto creat_exit;
3195 
3196 	trace_smb3_open_enter(xid, tcon->tid, tcon->ses->Suid, oparms->path,
3197 		oparms->create_options, oparms->desired_access);
3198 
3199 	if (retries)
3200 		smb2_set_replay(server, &rqst);
3201 
3202 	rc = cifs_send_recv(xid, ses, server,
3203 			    &rqst, &resp_buftype, flags,
3204 			    &rsp_iov);
3205 	rsp = (struct smb2_create_rsp *)rsp_iov.iov_base;
3206 
3207 	if (rc != 0) {
3208 		cifs_stats_fail_inc(tcon, SMB2_CREATE_HE);
3209 		if (err_iov && rsp) {
3210 			*err_iov = rsp_iov;
3211 			*buftype = resp_buftype;
3212 			resp_buftype = CIFS_NO_BUFFER;
3213 			rsp = NULL;
3214 		}
3215 		trace_smb3_open_err(xid, tcon->tid, ses->Suid,
3216 				    oparms->create_options, oparms->desired_access, rc);
3217 		if (rc == -EREMCHG) {
3218 			pr_warn_once("server share %s deleted\n",
3219 				     tcon->tree_name);
3220 			tcon->need_reconnect = true;
3221 		}
3222 		goto creat_exit;
3223 	} else if (rsp == NULL) /* unlikely to happen, but safer to check */
3224 		goto creat_exit;
3225 	else
3226 		trace_smb3_open_done(xid, rsp->PersistentFileId, tcon->tid, ses->Suid,
3227 				     oparms->create_options, oparms->desired_access);
3228 
3229 	atomic_inc(&tcon->num_remote_opens);
3230 	oparms->fid->persistent_fid = rsp->PersistentFileId;
3231 	oparms->fid->volatile_fid = rsp->VolatileFileId;
3232 	oparms->fid->access = oparms->desired_access;
3233 #ifdef CONFIG_CIFS_DEBUG2
3234 	oparms->fid->mid = le64_to_cpu(rsp->hdr.MessageId);
3235 #endif /* CIFS_DEBUG2 */
3236 
3237 	if (buf) {
3238 		buf->CreationTime = rsp->CreationTime;
3239 		buf->LastAccessTime = rsp->LastAccessTime;
3240 		buf->LastWriteTime = rsp->LastWriteTime;
3241 		buf->ChangeTime = rsp->ChangeTime;
3242 		buf->AllocationSize = rsp->AllocationSize;
3243 		buf->EndOfFile = rsp->EndofFile;
3244 		buf->Attributes = rsp->FileAttributes;
3245 		buf->NumberOfLinks = cpu_to_le32(1);
3246 		buf->DeletePending = 0;
3247 	}
3248 
3249 
3250 	rc = smb2_parse_contexts(server, &rsp_iov, &oparms->fid->epoch,
3251 				 oparms->fid->lease_key, oplock, buf, posix);
3252 creat_exit:
3253 	SMB2_open_free(&rqst);
3254 	free_rsp_buf(resp_buftype, rsp);
3255 
3256 	if (is_replayable_error(rc) &&
3257 	    smb2_should_replay(tcon, &retries, &cur_sleep))
3258 		goto replay_again;
3259 
3260 	return rc;
3261 }
3262 
3263 int
3264 SMB2_ioctl_init(struct cifs_tcon *tcon, struct TCP_Server_Info *server,
3265 		struct smb_rqst *rqst,
3266 		u64 persistent_fid, u64 volatile_fid, u32 opcode,
3267 		char *in_data, u32 indatalen,
3268 		__u32 max_response_size)
3269 {
3270 	struct smb2_ioctl_req *req;
3271 	struct kvec *iov = rqst->rq_iov;
3272 	unsigned int total_len;
3273 	int rc;
3274 	char *in_data_buf;
3275 
3276 	rc = smb2_ioctl_req_init(opcode, tcon, server,
3277 				 (void **) &req, &total_len);
3278 	if (rc)
3279 		return rc;
3280 
3281 	if (indatalen) {
3282 		/*
3283 		 * indatalen is usually small at a couple of bytes max, so
3284 		 * just allocate through generic pool
3285 		 */
3286 		in_data_buf = kmemdup(in_data, indatalen, GFP_NOFS);
3287 		if (!in_data_buf) {
3288 			cifs_small_buf_release(req);
3289 			return -ENOMEM;
3290 		}
3291 	}
3292 
3293 	req->CtlCode = cpu_to_le32(opcode);
3294 	req->PersistentFileId = persistent_fid;
3295 	req->VolatileFileId = volatile_fid;
3296 
3297 	iov[0].iov_base = (char *)req;
3298 	/*
3299 	 * If no input data, the size of ioctl struct in
3300 	 * protocol spec still includes a 1 byte data buffer,
3301 	 * but if input data passed to ioctl, we do not
3302 	 * want to double count this, so we do not send
3303 	 * the dummy one byte of data in iovec[0] if sending
3304 	 * input data (in iovec[1]).
3305 	 */
3306 	if (indatalen) {
3307 		req->InputCount = cpu_to_le32(indatalen);
3308 		/* do not set InputOffset if no input data */
3309 		req->InputOffset =
3310 		       cpu_to_le32(offsetof(struct smb2_ioctl_req, Buffer));
3311 		rqst->rq_nvec = 2;
3312 		iov[0].iov_len = total_len - 1;
3313 		iov[1].iov_base = in_data_buf;
3314 		iov[1].iov_len = indatalen;
3315 	} else {
3316 		rqst->rq_nvec = 1;
3317 		iov[0].iov_len = total_len;
3318 	}
3319 
3320 	req->OutputOffset = 0;
3321 	req->OutputCount = 0; /* MBZ */
3322 
3323 	/*
3324 	 * In most cases max_response_size is set to 16K (CIFSMaxBufSize)
3325 	 * We Could increase default MaxOutputResponse, but that could require
3326 	 * more credits. Windows typically sets this smaller, but for some
3327 	 * ioctls it may be useful to allow server to send more. No point
3328 	 * limiting what the server can send as long as fits in one credit
3329 	 * We can not handle more than CIFS_MAX_BUF_SIZE yet but may want
3330 	 * to increase this limit up in the future.
3331 	 * Note that for snapshot queries that servers like Azure expect that
3332 	 * the first query be minimal size (and just used to get the number/size
3333 	 * of previous versions) so response size must be specified as EXACTLY
3334 	 * sizeof(struct snapshot_array) which is 16 when rounded up to multiple
3335 	 * of eight bytes.  Currently that is the only case where we set max
3336 	 * response size smaller.
3337 	 */
3338 	req->MaxOutputResponse = cpu_to_le32(max_response_size);
3339 	req->hdr.CreditCharge =
3340 		cpu_to_le16(DIV_ROUND_UP(max(indatalen, max_response_size),
3341 					 SMB2_MAX_BUFFER_SIZE));
3342 	/* always an FSCTL (for now) */
3343 	req->Flags = cpu_to_le32(SMB2_0_IOCTL_IS_FSCTL);
3344 
3345 	/* validate negotiate request must be signed - see MS-SMB2 3.2.5.5 */
3346 	if (opcode == FSCTL_VALIDATE_NEGOTIATE_INFO)
3347 		req->hdr.Flags |= SMB2_FLAGS_SIGNED;
3348 
3349 	return 0;
3350 }
3351 
3352 void
3353 SMB2_ioctl_free(struct smb_rqst *rqst)
3354 {
3355 	int i;
3356 
3357 	if (rqst && rqst->rq_iov) {
3358 		cifs_small_buf_release(rqst->rq_iov[0].iov_base); /* request */
3359 		for (i = 1; i < rqst->rq_nvec; i++)
3360 			if (rqst->rq_iov[i].iov_base != smb2_padding)
3361 				kfree(rqst->rq_iov[i].iov_base);
3362 	}
3363 }
3364 
3365 
3366 /*
3367  *	SMB2 IOCTL is used for both IOCTLs and FSCTLs
3368  */
3369 int
3370 SMB2_ioctl(const unsigned int xid, struct cifs_tcon *tcon, u64 persistent_fid,
3371 	   u64 volatile_fid, u32 opcode, char *in_data, u32 indatalen,
3372 	   u32 max_out_data_len, char **out_data,
3373 	   u32 *plen /* returned data len */)
3374 {
3375 	struct smb_rqst rqst;
3376 	struct smb2_ioctl_rsp *rsp = NULL;
3377 	struct cifs_ses *ses;
3378 	struct TCP_Server_Info *server;
3379 	struct kvec iov[SMB2_IOCTL_IOV_SIZE];
3380 	struct kvec rsp_iov = {NULL, 0};
3381 	int resp_buftype = CIFS_NO_BUFFER;
3382 	int rc = 0;
3383 	int flags = 0;
3384 	int retries = 0, cur_sleep = 1;
3385 
3386 	if (!tcon)
3387 		return -EIO;
3388 
3389 	ses = tcon->ses;
3390 	if (!ses)
3391 		return -EIO;
3392 
3393 replay_again:
3394 	/* reinitialize for possible replay */
3395 	flags = 0;
3396 	server = cifs_pick_channel(ses);
3397 
3398 	if (!server)
3399 		return -EIO;
3400 
3401 	cifs_dbg(FYI, "SMB2 IOCTL\n");
3402 
3403 	if (out_data != NULL)
3404 		*out_data = NULL;
3405 
3406 	/* zero out returned data len, in case of error */
3407 	if (plen)
3408 		*plen = 0;
3409 
3410 	if (smb3_encryption_required(tcon))
3411 		flags |= CIFS_TRANSFORM_REQ;
3412 
3413 	memset(&rqst, 0, sizeof(struct smb_rqst));
3414 	memset(&iov, 0, sizeof(iov));
3415 	rqst.rq_iov = iov;
3416 	rqst.rq_nvec = SMB2_IOCTL_IOV_SIZE;
3417 
3418 	rc = SMB2_ioctl_init(tcon, server,
3419 			     &rqst, persistent_fid, volatile_fid, opcode,
3420 			     in_data, indatalen, max_out_data_len);
3421 	if (rc)
3422 		goto ioctl_exit;
3423 
3424 	if (retries)
3425 		smb2_set_replay(server, &rqst);
3426 
3427 	rc = cifs_send_recv(xid, ses, server,
3428 			    &rqst, &resp_buftype, flags,
3429 			    &rsp_iov);
3430 	rsp = (struct smb2_ioctl_rsp *)rsp_iov.iov_base;
3431 
3432 	if (rc != 0)
3433 		trace_smb3_fsctl_err(xid, persistent_fid, tcon->tid,
3434 				ses->Suid, 0, opcode, rc);
3435 
3436 	if ((rc != 0) && (rc != -EINVAL) && (rc != -E2BIG)) {
3437 		cifs_stats_fail_inc(tcon, SMB2_IOCTL_HE);
3438 		goto ioctl_exit;
3439 	} else if (rc == -EINVAL) {
3440 		if ((opcode != FSCTL_SRV_COPYCHUNK_WRITE) &&
3441 		    (opcode != FSCTL_SRV_COPYCHUNK)) {
3442 			cifs_stats_fail_inc(tcon, SMB2_IOCTL_HE);
3443 			goto ioctl_exit;
3444 		}
3445 	} else if (rc == -E2BIG) {
3446 		if (opcode != FSCTL_QUERY_ALLOCATED_RANGES) {
3447 			cifs_stats_fail_inc(tcon, SMB2_IOCTL_HE);
3448 			goto ioctl_exit;
3449 		}
3450 	}
3451 
3452 	/* check if caller wants to look at return data or just return rc */
3453 	if ((plen == NULL) || (out_data == NULL))
3454 		goto ioctl_exit;
3455 
3456 	/*
3457 	 * Although unlikely to be possible for rsp to be null and rc not set,
3458 	 * adding check below is slightly safer long term (and quiets Coverity
3459 	 * warning)
3460 	 */
3461 	if (rsp == NULL) {
3462 		rc = -EIO;
3463 		goto ioctl_exit;
3464 	}
3465 
3466 	*plen = le32_to_cpu(rsp->OutputCount);
3467 
3468 	/* We check for obvious errors in the output buffer length and offset */
3469 	if (*plen == 0)
3470 		goto ioctl_exit; /* server returned no data */
3471 	else if (*plen > rsp_iov.iov_len || *plen > 0xFF00) {
3472 		cifs_tcon_dbg(VFS, "srv returned invalid ioctl length: %d\n", *plen);
3473 		*plen = 0;
3474 		rc = -EIO;
3475 		goto ioctl_exit;
3476 	}
3477 
3478 	if (rsp_iov.iov_len - *plen < le32_to_cpu(rsp->OutputOffset)) {
3479 		cifs_tcon_dbg(VFS, "Malformed ioctl resp: len %d offset %d\n", *plen,
3480 			le32_to_cpu(rsp->OutputOffset));
3481 		*plen = 0;
3482 		rc = -EIO;
3483 		goto ioctl_exit;
3484 	}
3485 
3486 	*out_data = kmemdup((char *)rsp + le32_to_cpu(rsp->OutputOffset),
3487 			    *plen, GFP_KERNEL);
3488 	if (*out_data == NULL) {
3489 		rc = -ENOMEM;
3490 		goto ioctl_exit;
3491 	}
3492 
3493 ioctl_exit:
3494 	SMB2_ioctl_free(&rqst);
3495 	free_rsp_buf(resp_buftype, rsp);
3496 
3497 	if (is_replayable_error(rc) &&
3498 	    smb2_should_replay(tcon, &retries, &cur_sleep))
3499 		goto replay_again;
3500 
3501 	return rc;
3502 }
3503 
3504 /*
3505  *   Individual callers to ioctl worker function follow
3506  */
3507 
3508 int
3509 SMB2_set_compression(const unsigned int xid, struct cifs_tcon *tcon,
3510 		     u64 persistent_fid, u64 volatile_fid)
3511 {
3512 	int rc;
3513 	struct  compress_ioctl fsctl_input;
3514 	char *ret_data = NULL;
3515 
3516 	fsctl_input.CompressionState =
3517 			cpu_to_le16(COMPRESSION_FORMAT_DEFAULT);
3518 
3519 	rc = SMB2_ioctl(xid, tcon, persistent_fid, volatile_fid,
3520 			FSCTL_SET_COMPRESSION,
3521 			(char *)&fsctl_input /* data input */,
3522 			2 /* in data len */, CIFSMaxBufSize /* max out data */,
3523 			&ret_data /* out data */, NULL);
3524 
3525 	cifs_dbg(FYI, "set compression rc %d\n", rc);
3526 
3527 	return rc;
3528 }
3529 
3530 int
3531 SMB2_close_init(struct cifs_tcon *tcon, struct TCP_Server_Info *server,
3532 		struct smb_rqst *rqst,
3533 		u64 persistent_fid, u64 volatile_fid, bool query_attrs)
3534 {
3535 	struct smb2_close_req *req;
3536 	struct kvec *iov = rqst->rq_iov;
3537 	unsigned int total_len;
3538 	int rc;
3539 
3540 	rc = smb2_plain_req_init(SMB2_CLOSE, tcon, server,
3541 				 (void **) &req, &total_len);
3542 	if (rc)
3543 		return rc;
3544 
3545 	req->PersistentFileId = persistent_fid;
3546 	req->VolatileFileId = volatile_fid;
3547 	if (query_attrs)
3548 		req->Flags = SMB2_CLOSE_FLAG_POSTQUERY_ATTRIB;
3549 	else
3550 		req->Flags = 0;
3551 	iov[0].iov_base = (char *)req;
3552 	iov[0].iov_len = total_len;
3553 
3554 	return 0;
3555 }
3556 
3557 void
3558 SMB2_close_free(struct smb_rqst *rqst)
3559 {
3560 	if (rqst && rqst->rq_iov)
3561 		cifs_small_buf_release(rqst->rq_iov[0].iov_base); /* request */
3562 }
3563 
3564 int
3565 __SMB2_close(const unsigned int xid, struct cifs_tcon *tcon,
3566 	     u64 persistent_fid, u64 volatile_fid,
3567 	     struct smb2_file_network_open_info *pbuf)
3568 {
3569 	struct smb_rqst rqst;
3570 	struct smb2_close_rsp *rsp = NULL;
3571 	struct cifs_ses *ses = tcon->ses;
3572 	struct TCP_Server_Info *server;
3573 	struct kvec iov[1];
3574 	struct kvec rsp_iov;
3575 	int resp_buftype = CIFS_NO_BUFFER;
3576 	int rc = 0;
3577 	int flags = 0;
3578 	bool query_attrs = false;
3579 	int retries = 0, cur_sleep = 1;
3580 
3581 replay_again:
3582 	/* reinitialize for possible replay */
3583 	flags = 0;
3584 	query_attrs = false;
3585 	server = cifs_pick_channel(ses);
3586 
3587 	cifs_dbg(FYI, "Close\n");
3588 
3589 	if (!ses || !server)
3590 		return -EIO;
3591 
3592 	if (smb3_encryption_required(tcon))
3593 		flags |= CIFS_TRANSFORM_REQ;
3594 
3595 	memset(&rqst, 0, sizeof(struct smb_rqst));
3596 	memset(&iov, 0, sizeof(iov));
3597 	rqst.rq_iov = iov;
3598 	rqst.rq_nvec = 1;
3599 
3600 	/* check if need to ask server to return timestamps in close response */
3601 	if (pbuf)
3602 		query_attrs = true;
3603 
3604 	trace_smb3_close_enter(xid, persistent_fid, tcon->tid, ses->Suid);
3605 	rc = SMB2_close_init(tcon, server,
3606 			     &rqst, persistent_fid, volatile_fid,
3607 			     query_attrs);
3608 	if (rc)
3609 		goto close_exit;
3610 
3611 	if (retries)
3612 		smb2_set_replay(server, &rqst);
3613 
3614 	rc = cifs_send_recv(xid, ses, server,
3615 			    &rqst, &resp_buftype, flags, &rsp_iov);
3616 	rsp = (struct smb2_close_rsp *)rsp_iov.iov_base;
3617 
3618 	if (rc != 0) {
3619 		cifs_stats_fail_inc(tcon, SMB2_CLOSE_HE);
3620 		trace_smb3_close_err(xid, persistent_fid, tcon->tid, ses->Suid,
3621 				     rc);
3622 		goto close_exit;
3623 	} else {
3624 		trace_smb3_close_done(xid, persistent_fid, tcon->tid,
3625 				      ses->Suid);
3626 		if (pbuf)
3627 			memcpy(&pbuf->network_open_info,
3628 			       &rsp->network_open_info,
3629 			       sizeof(pbuf->network_open_info));
3630 	}
3631 
3632 	atomic_dec(&tcon->num_remote_opens);
3633 close_exit:
3634 	SMB2_close_free(&rqst);
3635 	free_rsp_buf(resp_buftype, rsp);
3636 
3637 	/* retry close in a worker thread if this one is interrupted */
3638 	if (is_interrupt_error(rc)) {
3639 		int tmp_rc;
3640 
3641 		tmp_rc = smb2_handle_cancelled_close(tcon, persistent_fid,
3642 						     volatile_fid);
3643 		if (tmp_rc)
3644 			cifs_dbg(VFS, "handle cancelled close fid 0x%llx returned error %d\n",
3645 				 persistent_fid, tmp_rc);
3646 	}
3647 
3648 	if (is_replayable_error(rc) &&
3649 	    smb2_should_replay(tcon, &retries, &cur_sleep))
3650 		goto replay_again;
3651 
3652 	return rc;
3653 }
3654 
3655 int
3656 SMB2_close(const unsigned int xid, struct cifs_tcon *tcon,
3657 		u64 persistent_fid, u64 volatile_fid)
3658 {
3659 	return __SMB2_close(xid, tcon, persistent_fid, volatile_fid, NULL);
3660 }
3661 
3662 int
3663 smb2_validate_iov(unsigned int offset, unsigned int buffer_length,
3664 		  struct kvec *iov, unsigned int min_buf_size)
3665 {
3666 	unsigned int smb_len = iov->iov_len;
3667 	char *end_of_smb = smb_len + (char *)iov->iov_base;
3668 	char *begin_of_buf = offset + (char *)iov->iov_base;
3669 	char *end_of_buf = begin_of_buf + buffer_length;
3670 
3671 
3672 	if (buffer_length < min_buf_size) {
3673 		cifs_dbg(VFS, "buffer length %d smaller than minimum size %d\n",
3674 			 buffer_length, min_buf_size);
3675 		return -EINVAL;
3676 	}
3677 
3678 	/* check if beyond RFC1001 maximum length */
3679 	if ((smb_len > 0x7FFFFF) || (buffer_length > 0x7FFFFF)) {
3680 		cifs_dbg(VFS, "buffer length %d or smb length %d too large\n",
3681 			 buffer_length, smb_len);
3682 		return -EINVAL;
3683 	}
3684 
3685 	if ((begin_of_buf > end_of_smb) || (end_of_buf > end_of_smb)) {
3686 		cifs_dbg(VFS, "Invalid server response, bad offset to data\n");
3687 		return -EINVAL;
3688 	}
3689 
3690 	return 0;
3691 }
3692 
3693 /*
3694  * If SMB buffer fields are valid, copy into temporary buffer to hold result.
3695  * Caller must free buffer.
3696  */
3697 int
3698 smb2_validate_and_copy_iov(unsigned int offset, unsigned int buffer_length,
3699 			   struct kvec *iov, unsigned int minbufsize,
3700 			   char *data)
3701 {
3702 	char *begin_of_buf = offset + (char *)iov->iov_base;
3703 	int rc;
3704 
3705 	if (!data)
3706 		return -EINVAL;
3707 
3708 	rc = smb2_validate_iov(offset, buffer_length, iov, minbufsize);
3709 	if (rc)
3710 		return rc;
3711 
3712 	memcpy(data, begin_of_buf, minbufsize);
3713 
3714 	return 0;
3715 }
3716 
3717 int
3718 SMB2_query_info_init(struct cifs_tcon *tcon, struct TCP_Server_Info *server,
3719 		     struct smb_rqst *rqst,
3720 		     u64 persistent_fid, u64 volatile_fid,
3721 		     u8 info_class, u8 info_type, u32 additional_info,
3722 		     size_t output_len, size_t input_len, void *input)
3723 {
3724 	struct smb2_query_info_req *req;
3725 	struct kvec *iov = rqst->rq_iov;
3726 	unsigned int total_len;
3727 	size_t len;
3728 	int rc;
3729 
3730 	if (unlikely(check_add_overflow(input_len, sizeof(*req), &len) ||
3731 		     len > CIFSMaxBufSize))
3732 		return -EINVAL;
3733 
3734 	rc = smb2_plain_req_init(SMB2_QUERY_INFO, tcon, server,
3735 				 (void **) &req, &total_len);
3736 	if (rc)
3737 		return rc;
3738 
3739 	req->InfoType = info_type;
3740 	req->FileInfoClass = info_class;
3741 	req->PersistentFileId = persistent_fid;
3742 	req->VolatileFileId = volatile_fid;
3743 	req->AdditionalInformation = cpu_to_le32(additional_info);
3744 
3745 	req->OutputBufferLength = cpu_to_le32(output_len);
3746 	if (input_len) {
3747 		req->InputBufferLength = cpu_to_le32(input_len);
3748 		/* total_len for smb query request never close to le16 max */
3749 		req->InputBufferOffset = cpu_to_le16(total_len - 1);
3750 		memcpy(req->Buffer, input, input_len);
3751 	}
3752 
3753 	iov[0].iov_base = (char *)req;
3754 	/* 1 for Buffer */
3755 	iov[0].iov_len = len;
3756 	return 0;
3757 }
3758 
3759 void
3760 SMB2_query_info_free(struct smb_rqst *rqst)
3761 {
3762 	if (rqst && rqst->rq_iov)
3763 		cifs_buf_release(rqst->rq_iov[0].iov_base); /* request */
3764 }
3765 
3766 static int
3767 query_info(const unsigned int xid, struct cifs_tcon *tcon,
3768 	   u64 persistent_fid, u64 volatile_fid, u8 info_class, u8 info_type,
3769 	   u32 additional_info, size_t output_len, size_t min_len, void **data,
3770 		u32 *dlen)
3771 {
3772 	struct smb_rqst rqst;
3773 	struct smb2_query_info_rsp *rsp = NULL;
3774 	struct kvec iov[1];
3775 	struct kvec rsp_iov;
3776 	int rc = 0;
3777 	int resp_buftype = CIFS_NO_BUFFER;
3778 	struct cifs_ses *ses = tcon->ses;
3779 	struct TCP_Server_Info *server;
3780 	int flags = 0;
3781 	bool allocated = false;
3782 	int retries = 0, cur_sleep = 1;
3783 
3784 	cifs_dbg(FYI, "Query Info\n");
3785 
3786 	if (!ses)
3787 		return -EIO;
3788 
3789 replay_again:
3790 	/* reinitialize for possible replay */
3791 	flags = 0;
3792 	allocated = false;
3793 	server = cifs_pick_channel(ses);
3794 
3795 	if (!server)
3796 		return -EIO;
3797 
3798 	if (smb3_encryption_required(tcon))
3799 		flags |= CIFS_TRANSFORM_REQ;
3800 
3801 	memset(&rqst, 0, sizeof(struct smb_rqst));
3802 	memset(&iov, 0, sizeof(iov));
3803 	rqst.rq_iov = iov;
3804 	rqst.rq_nvec = 1;
3805 
3806 	rc = SMB2_query_info_init(tcon, server,
3807 				  &rqst, persistent_fid, volatile_fid,
3808 				  info_class, info_type, additional_info,
3809 				  output_len, 0, NULL);
3810 	if (rc)
3811 		goto qinf_exit;
3812 
3813 	trace_smb3_query_info_enter(xid, persistent_fid, tcon->tid,
3814 				    ses->Suid, info_class, (__u32)info_type);
3815 
3816 	if (retries)
3817 		smb2_set_replay(server, &rqst);
3818 
3819 	rc = cifs_send_recv(xid, ses, server,
3820 			    &rqst, &resp_buftype, flags, &rsp_iov);
3821 	rsp = (struct smb2_query_info_rsp *)rsp_iov.iov_base;
3822 
3823 	if (rc) {
3824 		cifs_stats_fail_inc(tcon, SMB2_QUERY_INFO_HE);
3825 		trace_smb3_query_info_err(xid, persistent_fid, tcon->tid,
3826 				ses->Suid, info_class, (__u32)info_type, rc);
3827 		goto qinf_exit;
3828 	}
3829 
3830 	trace_smb3_query_info_done(xid, persistent_fid, tcon->tid,
3831 				ses->Suid, info_class, (__u32)info_type);
3832 
3833 	if (dlen) {
3834 		*dlen = le32_to_cpu(rsp->OutputBufferLength);
3835 		if (!*data) {
3836 			*data = kmalloc(*dlen, GFP_KERNEL);
3837 			if (!*data) {
3838 				cifs_tcon_dbg(VFS,
3839 					"Error %d allocating memory for acl\n",
3840 					rc);
3841 				*dlen = 0;
3842 				rc = -ENOMEM;
3843 				goto qinf_exit;
3844 			}
3845 			allocated = true;
3846 		}
3847 	}
3848 
3849 	rc = smb2_validate_and_copy_iov(le16_to_cpu(rsp->OutputBufferOffset),
3850 					le32_to_cpu(rsp->OutputBufferLength),
3851 					&rsp_iov, dlen ? *dlen : min_len, *data);
3852 	if (rc && allocated) {
3853 		kfree(*data);
3854 		*data = NULL;
3855 		*dlen = 0;
3856 	}
3857 
3858 qinf_exit:
3859 	SMB2_query_info_free(&rqst);
3860 	free_rsp_buf(resp_buftype, rsp);
3861 
3862 	if (is_replayable_error(rc) &&
3863 	    smb2_should_replay(tcon, &retries, &cur_sleep))
3864 		goto replay_again;
3865 
3866 	return rc;
3867 }
3868 
3869 int SMB2_query_info(const unsigned int xid, struct cifs_tcon *tcon,
3870 	u64 persistent_fid, u64 volatile_fid, struct smb2_file_all_info *data)
3871 {
3872 	return query_info(xid, tcon, persistent_fid, volatile_fid,
3873 			  FILE_ALL_INFORMATION, SMB2_O_INFO_FILE, 0,
3874 			  sizeof(struct smb2_file_all_info) + PATH_MAX * 2,
3875 			  sizeof(struct smb2_file_all_info), (void **)&data,
3876 			  NULL);
3877 }
3878 
3879 #if 0
3880 /* currently unused, as now we are doing compounding instead (see smb311_posix_query_path_info) */
3881 int
3882 SMB311_posix_query_info(const unsigned int xid, struct cifs_tcon *tcon,
3883 		u64 persistent_fid, u64 volatile_fid, struct smb311_posix_qinfo *data, u32 *plen)
3884 {
3885 	size_t output_len = sizeof(struct smb311_posix_qinfo *) +
3886 			(sizeof(struct cifs_sid) * 2) + (PATH_MAX * 2);
3887 	*plen = 0;
3888 
3889 	return query_info(xid, tcon, persistent_fid, volatile_fid,
3890 			  SMB_FIND_FILE_POSIX_INFO, SMB2_O_INFO_FILE, 0,
3891 			  output_len, sizeof(struct smb311_posix_qinfo), (void **)&data, plen);
3892 	/* Note caller must free "data" (passed in above). It may be allocated in query_info call */
3893 }
3894 #endif
3895 
3896 int
3897 SMB2_query_acl(const unsigned int xid, struct cifs_tcon *tcon,
3898 	       u64 persistent_fid, u64 volatile_fid,
3899 	       void **data, u32 *plen, u32 extra_info)
3900 {
3901 	__u32 additional_info = OWNER_SECINFO | GROUP_SECINFO | DACL_SECINFO |
3902 				extra_info;
3903 	*plen = 0;
3904 
3905 	return query_info(xid, tcon, persistent_fid, volatile_fid,
3906 			  0, SMB2_O_INFO_SECURITY, additional_info,
3907 			  SMB2_MAX_BUFFER_SIZE, MIN_SEC_DESC_LEN, data, plen);
3908 }
3909 
3910 int
3911 SMB2_get_srv_num(const unsigned int xid, struct cifs_tcon *tcon,
3912 		 u64 persistent_fid, u64 volatile_fid, __le64 *uniqueid)
3913 {
3914 	return query_info(xid, tcon, persistent_fid, volatile_fid,
3915 			  FILE_INTERNAL_INFORMATION, SMB2_O_INFO_FILE, 0,
3916 			  sizeof(struct smb2_file_internal_info),
3917 			  sizeof(struct smb2_file_internal_info),
3918 			  (void **)&uniqueid, NULL);
3919 }
3920 
3921 /*
3922  * CHANGE_NOTIFY Request is sent to get notifications on changes to a directory
3923  * See MS-SMB2 2.2.35 and 2.2.36
3924  */
3925 
3926 static int
3927 SMB2_notify_init(const unsigned int xid, struct smb_rqst *rqst,
3928 		 struct cifs_tcon *tcon, struct TCP_Server_Info *server,
3929 		 u64 persistent_fid, u64 volatile_fid,
3930 		 u32 completion_filter, bool watch_tree)
3931 {
3932 	struct smb2_change_notify_req *req;
3933 	struct kvec *iov = rqst->rq_iov;
3934 	unsigned int total_len;
3935 	int rc;
3936 
3937 	rc = smb2_plain_req_init(SMB2_CHANGE_NOTIFY, tcon, server,
3938 				 (void **) &req, &total_len);
3939 	if (rc)
3940 		return rc;
3941 
3942 	req->PersistentFileId = persistent_fid;
3943 	req->VolatileFileId = volatile_fid;
3944 	/* See note 354 of MS-SMB2, 64K max */
3945 	req->OutputBufferLength =
3946 		cpu_to_le32(SMB2_MAX_BUFFER_SIZE - MAX_SMB2_HDR_SIZE);
3947 	req->CompletionFilter = cpu_to_le32(completion_filter);
3948 	if (watch_tree)
3949 		req->Flags = cpu_to_le16(SMB2_WATCH_TREE);
3950 	else
3951 		req->Flags = 0;
3952 
3953 	iov[0].iov_base = (char *)req;
3954 	iov[0].iov_len = total_len;
3955 
3956 	return 0;
3957 }
3958 
3959 int
3960 SMB2_change_notify(const unsigned int xid, struct cifs_tcon *tcon,
3961 		u64 persistent_fid, u64 volatile_fid, bool watch_tree,
3962 		u32 completion_filter, u32 max_out_data_len, char **out_data,
3963 		u32 *plen /* returned data len */)
3964 {
3965 	struct cifs_ses *ses = tcon->ses;
3966 	struct TCP_Server_Info *server;
3967 	struct smb_rqst rqst;
3968 	struct smb2_change_notify_rsp *smb_rsp;
3969 	struct kvec iov[1];
3970 	struct kvec rsp_iov = {NULL, 0};
3971 	int resp_buftype = CIFS_NO_BUFFER;
3972 	int flags = 0;
3973 	int rc = 0;
3974 	int retries = 0, cur_sleep = 1;
3975 
3976 replay_again:
3977 	/* reinitialize for possible replay */
3978 	flags = 0;
3979 	server = cifs_pick_channel(ses);
3980 
3981 	cifs_dbg(FYI, "change notify\n");
3982 	if (!ses || !server)
3983 		return -EIO;
3984 
3985 	if (smb3_encryption_required(tcon))
3986 		flags |= CIFS_TRANSFORM_REQ;
3987 
3988 	memset(&rqst, 0, sizeof(struct smb_rqst));
3989 	memset(&iov, 0, sizeof(iov));
3990 	if (plen)
3991 		*plen = 0;
3992 
3993 	rqst.rq_iov = iov;
3994 	rqst.rq_nvec = 1;
3995 
3996 	rc = SMB2_notify_init(xid, &rqst, tcon, server,
3997 			      persistent_fid, volatile_fid,
3998 			      completion_filter, watch_tree);
3999 	if (rc)
4000 		goto cnotify_exit;
4001 
4002 	trace_smb3_notify_enter(xid, persistent_fid, tcon->tid, ses->Suid,
4003 				(u8)watch_tree, completion_filter);
4004 
4005 	if (retries)
4006 		smb2_set_replay(server, &rqst);
4007 
4008 	rc = cifs_send_recv(xid, ses, server,
4009 			    &rqst, &resp_buftype, flags, &rsp_iov);
4010 
4011 	if (rc != 0) {
4012 		cifs_stats_fail_inc(tcon, SMB2_CHANGE_NOTIFY_HE);
4013 		trace_smb3_notify_err(xid, persistent_fid, tcon->tid, ses->Suid,
4014 				(u8)watch_tree, completion_filter, rc);
4015 	} else {
4016 		trace_smb3_notify_done(xid, persistent_fid, tcon->tid,
4017 			ses->Suid, (u8)watch_tree, completion_filter);
4018 		/* validate that notify information is plausible */
4019 		if ((rsp_iov.iov_base == NULL) ||
4020 		    (rsp_iov.iov_len < sizeof(struct smb2_change_notify_rsp) + 1))
4021 			goto cnotify_exit;
4022 
4023 		smb_rsp = (struct smb2_change_notify_rsp *)rsp_iov.iov_base;
4024 
4025 		smb2_validate_iov(le16_to_cpu(smb_rsp->OutputBufferOffset),
4026 				le32_to_cpu(smb_rsp->OutputBufferLength), &rsp_iov,
4027 				sizeof(struct file_notify_information));
4028 
4029 		*out_data = kmemdup((char *)smb_rsp + le16_to_cpu(smb_rsp->OutputBufferOffset),
4030 				le32_to_cpu(smb_rsp->OutputBufferLength), GFP_KERNEL);
4031 		if (*out_data == NULL) {
4032 			rc = -ENOMEM;
4033 			goto cnotify_exit;
4034 		} else if (plen)
4035 			*plen = le32_to_cpu(smb_rsp->OutputBufferLength);
4036 	}
4037 
4038  cnotify_exit:
4039 	if (rqst.rq_iov)
4040 		cifs_small_buf_release(rqst.rq_iov[0].iov_base); /* request */
4041 	free_rsp_buf(resp_buftype, rsp_iov.iov_base);
4042 
4043 	if (is_replayable_error(rc) &&
4044 	    smb2_should_replay(tcon, &retries, &cur_sleep))
4045 		goto replay_again;
4046 
4047 	return rc;
4048 }
4049 
4050 
4051 
4052 /*
4053  * This is a no-op for now. We're not really interested in the reply, but
4054  * rather in the fact that the server sent one and that server->lstrp
4055  * gets updated.
4056  *
4057  * FIXME: maybe we should consider checking that the reply matches request?
4058  */
4059 static void
4060 smb2_echo_callback(struct mid_q_entry *mid)
4061 {
4062 	struct TCP_Server_Info *server = mid->callback_data;
4063 	struct smb2_echo_rsp *rsp = (struct smb2_echo_rsp *)mid->resp_buf;
4064 	struct cifs_credits credits = { .value = 0, .instance = 0 };
4065 
4066 	if (mid->mid_state == MID_RESPONSE_RECEIVED
4067 	    || mid->mid_state == MID_RESPONSE_MALFORMED) {
4068 		credits.value = le16_to_cpu(rsp->hdr.CreditRequest);
4069 		credits.instance = server->reconnect_instance;
4070 	}
4071 
4072 	release_mid(mid);
4073 	add_credits(server, &credits, CIFS_ECHO_OP);
4074 }
4075 
4076 void smb2_reconnect_server(struct work_struct *work)
4077 {
4078 	struct TCP_Server_Info *server = container_of(work,
4079 					struct TCP_Server_Info, reconnect.work);
4080 	struct TCP_Server_Info *pserver;
4081 	struct cifs_ses *ses, *ses2;
4082 	struct cifs_tcon *tcon, *tcon2;
4083 	struct list_head tmp_list, tmp_ses_list;
4084 	bool ses_exist = false;
4085 	bool tcon_selected = false;
4086 	int rc;
4087 	bool resched = false;
4088 
4089 	/* first check if ref count has reached 0, if not inc ref count */
4090 	spin_lock(&cifs_tcp_ses_lock);
4091 	if (!server->srv_count) {
4092 		spin_unlock(&cifs_tcp_ses_lock);
4093 		return;
4094 	}
4095 	server->srv_count++;
4096 	spin_unlock(&cifs_tcp_ses_lock);
4097 
4098 	/* If server is a channel, select the primary channel */
4099 	pserver = SERVER_IS_CHAN(server) ? server->primary_server : server;
4100 
4101 	/* Prevent simultaneous reconnects that can corrupt tcon->rlist list */
4102 	mutex_lock(&pserver->reconnect_mutex);
4103 
4104 	/* if the server is marked for termination, drop the ref count here */
4105 	if (server->terminate) {
4106 		cifs_put_tcp_session(server, true);
4107 		mutex_unlock(&pserver->reconnect_mutex);
4108 		return;
4109 	}
4110 
4111 	INIT_LIST_HEAD(&tmp_list);
4112 	INIT_LIST_HEAD(&tmp_ses_list);
4113 	cifs_dbg(FYI, "Reconnecting tcons and channels\n");
4114 
4115 	spin_lock(&cifs_tcp_ses_lock);
4116 	list_for_each_entry(ses, &pserver->smb_ses_list, smb_ses_list) {
4117 		spin_lock(&ses->ses_lock);
4118 		if (ses->ses_status == SES_EXITING) {
4119 			spin_unlock(&ses->ses_lock);
4120 			continue;
4121 		}
4122 		spin_unlock(&ses->ses_lock);
4123 
4124 		tcon_selected = false;
4125 
4126 		list_for_each_entry(tcon, &ses->tcon_list, tcon_list) {
4127 			if (tcon->need_reconnect || tcon->need_reopen_files) {
4128 				tcon->tc_count++;
4129 				list_add_tail(&tcon->rlist, &tmp_list);
4130 				tcon_selected = true;
4131 			}
4132 		}
4133 		/*
4134 		 * IPC has the same lifetime as its session and uses its
4135 		 * refcount.
4136 		 */
4137 		if (ses->tcon_ipc && ses->tcon_ipc->need_reconnect) {
4138 			list_add_tail(&ses->tcon_ipc->rlist, &tmp_list);
4139 			tcon_selected = true;
4140 			cifs_smb_ses_inc_refcount(ses);
4141 		}
4142 		/*
4143 		 * handle the case where channel needs to reconnect
4144 		 * binding session, but tcon is healthy (some other channel
4145 		 * is active)
4146 		 */
4147 		spin_lock(&ses->chan_lock);
4148 		if (!tcon_selected && cifs_chan_needs_reconnect(ses, server)) {
4149 			list_add_tail(&ses->rlist, &tmp_ses_list);
4150 			ses_exist = true;
4151 			cifs_smb_ses_inc_refcount(ses);
4152 		}
4153 		spin_unlock(&ses->chan_lock);
4154 	}
4155 	spin_unlock(&cifs_tcp_ses_lock);
4156 
4157 	list_for_each_entry_safe(tcon, tcon2, &tmp_list, rlist) {
4158 		rc = smb2_reconnect(SMB2_INTERNAL_CMD, tcon, server, true);
4159 		if (!rc)
4160 			cifs_reopen_persistent_handles(tcon);
4161 		else
4162 			resched = true;
4163 		list_del_init(&tcon->rlist);
4164 		if (tcon->ipc)
4165 			cifs_put_smb_ses(tcon->ses);
4166 		else
4167 			cifs_put_tcon(tcon);
4168 	}
4169 
4170 	if (!ses_exist)
4171 		goto done;
4172 
4173 	/* allocate a dummy tcon struct used for reconnect */
4174 	tcon = tcon_info_alloc(false);
4175 	if (!tcon) {
4176 		resched = true;
4177 		list_for_each_entry_safe(ses, ses2, &tmp_ses_list, rlist) {
4178 			list_del_init(&ses->rlist);
4179 			cifs_put_smb_ses(ses);
4180 		}
4181 		goto done;
4182 	}
4183 
4184 	tcon->status = TID_GOOD;
4185 	tcon->retry = false;
4186 	tcon->need_reconnect = false;
4187 
4188 	/* now reconnect sessions for necessary channels */
4189 	list_for_each_entry_safe(ses, ses2, &tmp_ses_list, rlist) {
4190 		tcon->ses = ses;
4191 		rc = smb2_reconnect(SMB2_INTERNAL_CMD, tcon, server, true);
4192 		if (rc)
4193 			resched = true;
4194 		list_del_init(&ses->rlist);
4195 		cifs_put_smb_ses(ses);
4196 	}
4197 	tconInfoFree(tcon);
4198 
4199 done:
4200 	cifs_dbg(FYI, "Reconnecting tcons and channels finished\n");
4201 	if (resched)
4202 		queue_delayed_work(cifsiod_wq, &server->reconnect, 2 * HZ);
4203 	mutex_unlock(&pserver->reconnect_mutex);
4204 
4205 	/* now we can safely release srv struct */
4206 	cifs_put_tcp_session(server, true);
4207 }
4208 
4209 int
4210 SMB2_echo(struct TCP_Server_Info *server)
4211 {
4212 	struct smb2_echo_req *req;
4213 	int rc = 0;
4214 	struct kvec iov[1];
4215 	struct smb_rqst rqst = { .rq_iov = iov,
4216 				 .rq_nvec = 1 };
4217 	unsigned int total_len;
4218 
4219 	cifs_dbg(FYI, "In echo request for conn_id %lld\n", server->conn_id);
4220 
4221 	spin_lock(&server->srv_lock);
4222 	if (server->ops->need_neg &&
4223 	    server->ops->need_neg(server)) {
4224 		spin_unlock(&server->srv_lock);
4225 		/* No need to send echo on newly established connections */
4226 		mod_delayed_work(cifsiod_wq, &server->reconnect, 0);
4227 		return rc;
4228 	}
4229 	spin_unlock(&server->srv_lock);
4230 
4231 	rc = smb2_plain_req_init(SMB2_ECHO, NULL, server,
4232 				 (void **)&req, &total_len);
4233 	if (rc)
4234 		return rc;
4235 
4236 	req->hdr.CreditRequest = cpu_to_le16(1);
4237 
4238 	iov[0].iov_len = total_len;
4239 	iov[0].iov_base = (char *)req;
4240 
4241 	rc = cifs_call_async(server, &rqst, NULL, smb2_echo_callback, NULL,
4242 			     server, CIFS_ECHO_OP, NULL);
4243 	if (rc)
4244 		cifs_dbg(FYI, "Echo request failed: %d\n", rc);
4245 
4246 	cifs_small_buf_release(req);
4247 	return rc;
4248 }
4249 
4250 void
4251 SMB2_flush_free(struct smb_rqst *rqst)
4252 {
4253 	if (rqst && rqst->rq_iov)
4254 		cifs_small_buf_release(rqst->rq_iov[0].iov_base); /* request */
4255 }
4256 
4257 int
4258 SMB2_flush_init(const unsigned int xid, struct smb_rqst *rqst,
4259 		struct cifs_tcon *tcon, struct TCP_Server_Info *server,
4260 		u64 persistent_fid, u64 volatile_fid)
4261 {
4262 	struct smb2_flush_req *req;
4263 	struct kvec *iov = rqst->rq_iov;
4264 	unsigned int total_len;
4265 	int rc;
4266 
4267 	rc = smb2_plain_req_init(SMB2_FLUSH, tcon, server,
4268 				 (void **) &req, &total_len);
4269 	if (rc)
4270 		return rc;
4271 
4272 	req->PersistentFileId = persistent_fid;
4273 	req->VolatileFileId = volatile_fid;
4274 
4275 	iov[0].iov_base = (char *)req;
4276 	iov[0].iov_len = total_len;
4277 
4278 	return 0;
4279 }
4280 
4281 int
4282 SMB2_flush(const unsigned int xid, struct cifs_tcon *tcon, u64 persistent_fid,
4283 	   u64 volatile_fid)
4284 {
4285 	struct cifs_ses *ses = tcon->ses;
4286 	struct smb_rqst rqst;
4287 	struct kvec iov[1];
4288 	struct kvec rsp_iov = {NULL, 0};
4289 	struct TCP_Server_Info *server;
4290 	int resp_buftype = CIFS_NO_BUFFER;
4291 	int flags = 0;
4292 	int rc = 0;
4293 	int retries = 0, cur_sleep = 1;
4294 
4295 replay_again:
4296 	/* reinitialize for possible replay */
4297 	flags = 0;
4298 	server = cifs_pick_channel(ses);
4299 
4300 	cifs_dbg(FYI, "flush\n");
4301 	if (!ses || !(ses->server))
4302 		return -EIO;
4303 
4304 	if (smb3_encryption_required(tcon))
4305 		flags |= CIFS_TRANSFORM_REQ;
4306 
4307 	memset(&rqst, 0, sizeof(struct smb_rqst));
4308 	memset(&iov, 0, sizeof(iov));
4309 	rqst.rq_iov = iov;
4310 	rqst.rq_nvec = 1;
4311 
4312 	rc = SMB2_flush_init(xid, &rqst, tcon, server,
4313 			     persistent_fid, volatile_fid);
4314 	if (rc)
4315 		goto flush_exit;
4316 
4317 	trace_smb3_flush_enter(xid, persistent_fid, tcon->tid, ses->Suid);
4318 
4319 	if (retries)
4320 		smb2_set_replay(server, &rqst);
4321 
4322 	rc = cifs_send_recv(xid, ses, server,
4323 			    &rqst, &resp_buftype, flags, &rsp_iov);
4324 
4325 	if (rc != 0) {
4326 		cifs_stats_fail_inc(tcon, SMB2_FLUSH_HE);
4327 		trace_smb3_flush_err(xid, persistent_fid, tcon->tid, ses->Suid,
4328 				     rc);
4329 	} else
4330 		trace_smb3_flush_done(xid, persistent_fid, tcon->tid,
4331 				      ses->Suid);
4332 
4333  flush_exit:
4334 	SMB2_flush_free(&rqst);
4335 	free_rsp_buf(resp_buftype, rsp_iov.iov_base);
4336 
4337 	if (is_replayable_error(rc) &&
4338 	    smb2_should_replay(tcon, &retries, &cur_sleep))
4339 		goto replay_again;
4340 
4341 	return rc;
4342 }
4343 
4344 #ifdef CONFIG_CIFS_SMB_DIRECT
4345 static inline bool smb3_use_rdma_offload(struct cifs_io_parms *io_parms)
4346 {
4347 	struct TCP_Server_Info *server = io_parms->server;
4348 	struct cifs_tcon *tcon = io_parms->tcon;
4349 
4350 	/* we can only offload if we're connected */
4351 	if (!server || !tcon)
4352 		return false;
4353 
4354 	/* we can only offload on an rdma connection */
4355 	if (!server->rdma || !server->smbd_conn)
4356 		return false;
4357 
4358 	/* we don't support signed offload yet */
4359 	if (server->sign)
4360 		return false;
4361 
4362 	/* we don't support encrypted offload yet */
4363 	if (smb3_encryption_required(tcon))
4364 		return false;
4365 
4366 	/* offload also has its overhead, so only do it if desired */
4367 	if (io_parms->length < server->smbd_conn->rdma_readwrite_threshold)
4368 		return false;
4369 
4370 	return true;
4371 }
4372 #endif /* CONFIG_CIFS_SMB_DIRECT */
4373 
4374 /*
4375  * To form a chain of read requests, any read requests after the first should
4376  * have the end_of_chain boolean set to true.
4377  */
4378 static int
4379 smb2_new_read_req(void **buf, unsigned int *total_len,
4380 	struct cifs_io_parms *io_parms, struct cifs_readdata *rdata,
4381 	unsigned int remaining_bytes, int request_type)
4382 {
4383 	int rc = -EACCES;
4384 	struct smb2_read_req *req = NULL;
4385 	struct smb2_hdr *shdr;
4386 	struct TCP_Server_Info *server = io_parms->server;
4387 
4388 	rc = smb2_plain_req_init(SMB2_READ, io_parms->tcon, server,
4389 				 (void **) &req, total_len);
4390 	if (rc)
4391 		return rc;
4392 
4393 	if (server == NULL)
4394 		return -ECONNABORTED;
4395 
4396 	shdr = &req->hdr;
4397 	shdr->Id.SyncId.ProcessId = cpu_to_le32(io_parms->pid);
4398 
4399 	req->PersistentFileId = io_parms->persistent_fid;
4400 	req->VolatileFileId = io_parms->volatile_fid;
4401 	req->ReadChannelInfoOffset = 0; /* reserved */
4402 	req->ReadChannelInfoLength = 0; /* reserved */
4403 	req->Channel = 0; /* reserved */
4404 	req->MinimumCount = 0;
4405 	req->Length = cpu_to_le32(io_parms->length);
4406 	req->Offset = cpu_to_le64(io_parms->offset);
4407 
4408 	trace_smb3_read_enter(0 /* xid */,
4409 			io_parms->persistent_fid,
4410 			io_parms->tcon->tid, io_parms->tcon->ses->Suid,
4411 			io_parms->offset, io_parms->length);
4412 #ifdef CONFIG_CIFS_SMB_DIRECT
4413 	/*
4414 	 * If we want to do a RDMA write, fill in and append
4415 	 * smbd_buffer_descriptor_v1 to the end of read request
4416 	 */
4417 	if (smb3_use_rdma_offload(io_parms)) {
4418 		struct smbd_buffer_descriptor_v1 *v1;
4419 		bool need_invalidate = server->dialect == SMB30_PROT_ID;
4420 
4421 		rdata->mr = smbd_register_mr(server->smbd_conn, &rdata->iter,
4422 					     true, need_invalidate);
4423 		if (!rdata->mr)
4424 			return -EAGAIN;
4425 
4426 		req->Channel = SMB2_CHANNEL_RDMA_V1_INVALIDATE;
4427 		if (need_invalidate)
4428 			req->Channel = SMB2_CHANNEL_RDMA_V1;
4429 		req->ReadChannelInfoOffset =
4430 			cpu_to_le16(offsetof(struct smb2_read_req, Buffer));
4431 		req->ReadChannelInfoLength =
4432 			cpu_to_le16(sizeof(struct smbd_buffer_descriptor_v1));
4433 		v1 = (struct smbd_buffer_descriptor_v1 *) &req->Buffer[0];
4434 		v1->offset = cpu_to_le64(rdata->mr->mr->iova);
4435 		v1->token = cpu_to_le32(rdata->mr->mr->rkey);
4436 		v1->length = cpu_to_le32(rdata->mr->mr->length);
4437 
4438 		*total_len += sizeof(*v1) - 1;
4439 	}
4440 #endif
4441 	if (request_type & CHAINED_REQUEST) {
4442 		if (!(request_type & END_OF_CHAIN)) {
4443 			/* next 8-byte aligned request */
4444 			*total_len = ALIGN(*total_len, 8);
4445 			shdr->NextCommand = cpu_to_le32(*total_len);
4446 		} else /* END_OF_CHAIN */
4447 			shdr->NextCommand = 0;
4448 		if (request_type & RELATED_REQUEST) {
4449 			shdr->Flags |= SMB2_FLAGS_RELATED_OPERATIONS;
4450 			/*
4451 			 * Related requests use info from previous read request
4452 			 * in chain.
4453 			 */
4454 			shdr->SessionId = cpu_to_le64(0xFFFFFFFFFFFFFFFF);
4455 			shdr->Id.SyncId.TreeId = cpu_to_le32(0xFFFFFFFF);
4456 			req->PersistentFileId = (u64)-1;
4457 			req->VolatileFileId = (u64)-1;
4458 		}
4459 	}
4460 	if (remaining_bytes > io_parms->length)
4461 		req->RemainingBytes = cpu_to_le32(remaining_bytes);
4462 	else
4463 		req->RemainingBytes = 0;
4464 
4465 	*buf = req;
4466 	return rc;
4467 }
4468 
4469 static void
4470 smb2_readv_callback(struct mid_q_entry *mid)
4471 {
4472 	struct cifs_readdata *rdata = mid->callback_data;
4473 	struct cifs_tcon *tcon = tlink_tcon(rdata->cfile->tlink);
4474 	struct TCP_Server_Info *server = rdata->server;
4475 	struct smb2_hdr *shdr =
4476 				(struct smb2_hdr *)rdata->iov[0].iov_base;
4477 	struct cifs_credits credits = { .value = 0, .instance = 0 };
4478 	struct smb_rqst rqst = { .rq_iov = &rdata->iov[1], .rq_nvec = 1 };
4479 
4480 	if (rdata->got_bytes) {
4481 		rqst.rq_iter	  = rdata->iter;
4482 		rqst.rq_iter_size = iov_iter_count(&rdata->iter);
4483 	}
4484 
4485 	WARN_ONCE(rdata->server != mid->server,
4486 		  "rdata server %p != mid server %p",
4487 		  rdata->server, mid->server);
4488 
4489 	cifs_dbg(FYI, "%s: mid=%llu state=%d result=%d bytes=%u\n",
4490 		 __func__, mid->mid, mid->mid_state, rdata->result,
4491 		 rdata->bytes);
4492 
4493 	switch (mid->mid_state) {
4494 	case MID_RESPONSE_RECEIVED:
4495 		credits.value = le16_to_cpu(shdr->CreditRequest);
4496 		credits.instance = server->reconnect_instance;
4497 		/* result already set, check signature */
4498 		if (server->sign && !mid->decrypted) {
4499 			int rc;
4500 
4501 			iov_iter_revert(&rqst.rq_iter, rdata->got_bytes);
4502 			iov_iter_truncate(&rqst.rq_iter, rdata->got_bytes);
4503 			rc = smb2_verify_signature(&rqst, server);
4504 			if (rc)
4505 				cifs_tcon_dbg(VFS, "SMB signature verification returned error = %d\n",
4506 					 rc);
4507 		}
4508 		/* FIXME: should this be counted toward the initiating task? */
4509 		task_io_account_read(rdata->got_bytes);
4510 		cifs_stats_bytes_read(tcon, rdata->got_bytes);
4511 		break;
4512 	case MID_REQUEST_SUBMITTED:
4513 	case MID_RETRY_NEEDED:
4514 		rdata->result = -EAGAIN;
4515 		if (server->sign && rdata->got_bytes)
4516 			/* reset bytes number since we can not check a sign */
4517 			rdata->got_bytes = 0;
4518 		/* FIXME: should this be counted toward the initiating task? */
4519 		task_io_account_read(rdata->got_bytes);
4520 		cifs_stats_bytes_read(tcon, rdata->got_bytes);
4521 		break;
4522 	case MID_RESPONSE_MALFORMED:
4523 		credits.value = le16_to_cpu(shdr->CreditRequest);
4524 		credits.instance = server->reconnect_instance;
4525 		fallthrough;
4526 	default:
4527 		rdata->result = -EIO;
4528 	}
4529 #ifdef CONFIG_CIFS_SMB_DIRECT
4530 	/*
4531 	 * If this rdata has a memmory registered, the MR can be freed
4532 	 * MR needs to be freed as soon as I/O finishes to prevent deadlock
4533 	 * because they have limited number and are used for future I/Os
4534 	 */
4535 	if (rdata->mr) {
4536 		smbd_deregister_mr(rdata->mr);
4537 		rdata->mr = NULL;
4538 	}
4539 #endif
4540 	if (rdata->result && rdata->result != -ENODATA) {
4541 		cifs_stats_fail_inc(tcon, SMB2_READ_HE);
4542 		trace_smb3_read_err(0 /* xid */,
4543 				    rdata->cfile->fid.persistent_fid,
4544 				    tcon->tid, tcon->ses->Suid, rdata->offset,
4545 				    rdata->bytes, rdata->result);
4546 	} else
4547 		trace_smb3_read_done(0 /* xid */,
4548 				     rdata->cfile->fid.persistent_fid,
4549 				     tcon->tid, tcon->ses->Suid,
4550 				     rdata->offset, rdata->got_bytes);
4551 
4552 	queue_work(cifsiod_wq, &rdata->work);
4553 	release_mid(mid);
4554 	add_credits(server, &credits, 0);
4555 }
4556 
4557 /* smb2_async_readv - send an async read, and set up mid to handle result */
4558 int
4559 smb2_async_readv(struct cifs_readdata *rdata)
4560 {
4561 	int rc, flags = 0;
4562 	char *buf;
4563 	struct smb2_hdr *shdr;
4564 	struct cifs_io_parms io_parms;
4565 	struct smb_rqst rqst = { .rq_iov = rdata->iov,
4566 				 .rq_nvec = 1 };
4567 	struct TCP_Server_Info *server;
4568 	struct cifs_tcon *tcon = tlink_tcon(rdata->cfile->tlink);
4569 	unsigned int total_len;
4570 	int credit_request;
4571 
4572 	cifs_dbg(FYI, "%s: offset=%llu bytes=%u\n",
4573 		 __func__, rdata->offset, rdata->bytes);
4574 
4575 	if (!rdata->server)
4576 		rdata->server = cifs_pick_channel(tcon->ses);
4577 
4578 	io_parms.tcon = tlink_tcon(rdata->cfile->tlink);
4579 	io_parms.server = server = rdata->server;
4580 	io_parms.offset = rdata->offset;
4581 	io_parms.length = rdata->bytes;
4582 	io_parms.persistent_fid = rdata->cfile->fid.persistent_fid;
4583 	io_parms.volatile_fid = rdata->cfile->fid.volatile_fid;
4584 	io_parms.pid = rdata->pid;
4585 
4586 	rc = smb2_new_read_req(
4587 		(void **) &buf, &total_len, &io_parms, rdata, 0, 0);
4588 	if (rc)
4589 		return rc;
4590 
4591 	if (smb3_encryption_required(io_parms.tcon))
4592 		flags |= CIFS_TRANSFORM_REQ;
4593 
4594 	rdata->iov[0].iov_base = buf;
4595 	rdata->iov[0].iov_len = total_len;
4596 
4597 	shdr = (struct smb2_hdr *)buf;
4598 
4599 	if (rdata->credits.value > 0) {
4600 		shdr->CreditCharge = cpu_to_le16(DIV_ROUND_UP(rdata->bytes,
4601 						SMB2_MAX_BUFFER_SIZE));
4602 		credit_request = le16_to_cpu(shdr->CreditCharge) + 8;
4603 		if (server->credits >= server->max_credits)
4604 			shdr->CreditRequest = cpu_to_le16(0);
4605 		else
4606 			shdr->CreditRequest = cpu_to_le16(
4607 				min_t(int, server->max_credits -
4608 						server->credits, credit_request));
4609 
4610 		rc = adjust_credits(server, &rdata->credits, rdata->bytes);
4611 		if (rc)
4612 			goto async_readv_out;
4613 
4614 		flags |= CIFS_HAS_CREDITS;
4615 	}
4616 
4617 	kref_get(&rdata->refcount);
4618 	rc = cifs_call_async(server, &rqst,
4619 			     cifs_readv_receive, smb2_readv_callback,
4620 			     smb3_handle_read_data, rdata, flags,
4621 			     &rdata->credits);
4622 	if (rc) {
4623 		kref_put(&rdata->refcount, cifs_readdata_release);
4624 		cifs_stats_fail_inc(io_parms.tcon, SMB2_READ_HE);
4625 		trace_smb3_read_err(0 /* xid */, io_parms.persistent_fid,
4626 				    io_parms.tcon->tid,
4627 				    io_parms.tcon->ses->Suid,
4628 				    io_parms.offset, io_parms.length, rc);
4629 	}
4630 
4631 async_readv_out:
4632 	cifs_small_buf_release(buf);
4633 	return rc;
4634 }
4635 
4636 int
4637 SMB2_read(const unsigned int xid, struct cifs_io_parms *io_parms,
4638 	  unsigned int *nbytes, char **buf, int *buf_type)
4639 {
4640 	struct smb_rqst rqst;
4641 	int resp_buftype, rc;
4642 	struct smb2_read_req *req = NULL;
4643 	struct smb2_read_rsp *rsp = NULL;
4644 	struct kvec iov[1];
4645 	struct kvec rsp_iov;
4646 	unsigned int total_len;
4647 	int flags = CIFS_LOG_ERROR;
4648 	struct cifs_ses *ses = io_parms->tcon->ses;
4649 
4650 	if (!io_parms->server)
4651 		io_parms->server = cifs_pick_channel(io_parms->tcon->ses);
4652 
4653 	*nbytes = 0;
4654 	rc = smb2_new_read_req((void **)&req, &total_len, io_parms, NULL, 0, 0);
4655 	if (rc)
4656 		return rc;
4657 
4658 	if (smb3_encryption_required(io_parms->tcon))
4659 		flags |= CIFS_TRANSFORM_REQ;
4660 
4661 	iov[0].iov_base = (char *)req;
4662 	iov[0].iov_len = total_len;
4663 
4664 	memset(&rqst, 0, sizeof(struct smb_rqst));
4665 	rqst.rq_iov = iov;
4666 	rqst.rq_nvec = 1;
4667 
4668 	rc = cifs_send_recv(xid, ses, io_parms->server,
4669 			    &rqst, &resp_buftype, flags, &rsp_iov);
4670 	rsp = (struct smb2_read_rsp *)rsp_iov.iov_base;
4671 
4672 	if (rc) {
4673 		if (rc != -ENODATA) {
4674 			cifs_stats_fail_inc(io_parms->tcon, SMB2_READ_HE);
4675 			cifs_dbg(VFS, "Send error in read = %d\n", rc);
4676 			trace_smb3_read_err(xid,
4677 					    req->PersistentFileId,
4678 					    io_parms->tcon->tid, ses->Suid,
4679 					    io_parms->offset, io_parms->length,
4680 					    rc);
4681 		} else
4682 			trace_smb3_read_done(xid, req->PersistentFileId, io_parms->tcon->tid,
4683 					     ses->Suid, io_parms->offset, 0);
4684 		free_rsp_buf(resp_buftype, rsp_iov.iov_base);
4685 		cifs_small_buf_release(req);
4686 		return rc == -ENODATA ? 0 : rc;
4687 	} else
4688 		trace_smb3_read_done(xid,
4689 				    req->PersistentFileId,
4690 				    io_parms->tcon->tid, ses->Suid,
4691 				    io_parms->offset, io_parms->length);
4692 
4693 	cifs_small_buf_release(req);
4694 
4695 	*nbytes = le32_to_cpu(rsp->DataLength);
4696 	if ((*nbytes > CIFS_MAX_MSGSIZE) ||
4697 	    (*nbytes > io_parms->length)) {
4698 		cifs_dbg(FYI, "bad length %d for count %d\n",
4699 			 *nbytes, io_parms->length);
4700 		rc = -EIO;
4701 		*nbytes = 0;
4702 	}
4703 
4704 	if (*buf) {
4705 		memcpy(*buf, (char *)rsp + rsp->DataOffset, *nbytes);
4706 		free_rsp_buf(resp_buftype, rsp_iov.iov_base);
4707 	} else if (resp_buftype != CIFS_NO_BUFFER) {
4708 		*buf = rsp_iov.iov_base;
4709 		if (resp_buftype == CIFS_SMALL_BUFFER)
4710 			*buf_type = CIFS_SMALL_BUFFER;
4711 		else if (resp_buftype == CIFS_LARGE_BUFFER)
4712 			*buf_type = CIFS_LARGE_BUFFER;
4713 	}
4714 	return rc;
4715 }
4716 
4717 /*
4718  * Check the mid_state and signature on received buffer (if any), and queue the
4719  * workqueue completion task.
4720  */
4721 static void
4722 smb2_writev_callback(struct mid_q_entry *mid)
4723 {
4724 	struct cifs_writedata *wdata = mid->callback_data;
4725 	struct cifs_tcon *tcon = tlink_tcon(wdata->cfile->tlink);
4726 	struct TCP_Server_Info *server = wdata->server;
4727 	unsigned int written;
4728 	struct smb2_write_rsp *rsp = (struct smb2_write_rsp *)mid->resp_buf;
4729 	struct cifs_credits credits = { .value = 0, .instance = 0 };
4730 
4731 	WARN_ONCE(wdata->server != mid->server,
4732 		  "wdata server %p != mid server %p",
4733 		  wdata->server, mid->server);
4734 
4735 	switch (mid->mid_state) {
4736 	case MID_RESPONSE_RECEIVED:
4737 		credits.value = le16_to_cpu(rsp->hdr.CreditRequest);
4738 		credits.instance = server->reconnect_instance;
4739 		wdata->result = smb2_check_receive(mid, server, 0);
4740 		if (wdata->result != 0)
4741 			break;
4742 
4743 		written = le32_to_cpu(rsp->DataLength);
4744 		/*
4745 		 * Mask off high 16 bits when bytes written as returned
4746 		 * by the server is greater than bytes requested by the
4747 		 * client. OS/2 servers are known to set incorrect
4748 		 * CountHigh values.
4749 		 */
4750 		if (written > wdata->bytes)
4751 			written &= 0xFFFF;
4752 
4753 		if (written < wdata->bytes)
4754 			wdata->result = -ENOSPC;
4755 		else
4756 			wdata->bytes = written;
4757 		break;
4758 	case MID_REQUEST_SUBMITTED:
4759 	case MID_RETRY_NEEDED:
4760 		wdata->result = -EAGAIN;
4761 		break;
4762 	case MID_RESPONSE_MALFORMED:
4763 		credits.value = le16_to_cpu(rsp->hdr.CreditRequest);
4764 		credits.instance = server->reconnect_instance;
4765 		fallthrough;
4766 	default:
4767 		wdata->result = -EIO;
4768 		break;
4769 	}
4770 #ifdef CONFIG_CIFS_SMB_DIRECT
4771 	/*
4772 	 * If this wdata has a memory registered, the MR can be freed
4773 	 * The number of MRs available is limited, it's important to recover
4774 	 * used MR as soon as I/O is finished. Hold MR longer in the later
4775 	 * I/O process can possibly result in I/O deadlock due to lack of MR
4776 	 * to send request on I/O retry
4777 	 */
4778 	if (wdata->mr) {
4779 		smbd_deregister_mr(wdata->mr);
4780 		wdata->mr = NULL;
4781 	}
4782 #endif
4783 	if (wdata->result) {
4784 		cifs_stats_fail_inc(tcon, SMB2_WRITE_HE);
4785 		trace_smb3_write_err(0 /* no xid */,
4786 				     wdata->cfile->fid.persistent_fid,
4787 				     tcon->tid, tcon->ses->Suid, wdata->offset,
4788 				     wdata->bytes, wdata->result);
4789 		if (wdata->result == -ENOSPC)
4790 			pr_warn_once("Out of space writing to %s\n",
4791 				     tcon->tree_name);
4792 	} else
4793 		trace_smb3_write_done(0 /* no xid */,
4794 				      wdata->cfile->fid.persistent_fid,
4795 				      tcon->tid, tcon->ses->Suid,
4796 				      wdata->offset, wdata->bytes);
4797 
4798 	queue_work(cifsiod_wq, &wdata->work);
4799 	release_mid(mid);
4800 	add_credits(server, &credits, 0);
4801 }
4802 
4803 /* smb2_async_writev - send an async write, and set up mid to handle result */
4804 int
4805 smb2_async_writev(struct cifs_writedata *wdata,
4806 		  void (*release)(struct kref *kref))
4807 {
4808 	int rc = -EACCES, flags = 0;
4809 	struct smb2_write_req *req = NULL;
4810 	struct smb2_hdr *shdr;
4811 	struct cifs_tcon *tcon = tlink_tcon(wdata->cfile->tlink);
4812 	struct TCP_Server_Info *server = wdata->server;
4813 	struct kvec iov[1];
4814 	struct smb_rqst rqst = { };
4815 	unsigned int total_len;
4816 	struct cifs_io_parms _io_parms;
4817 	struct cifs_io_parms *io_parms = NULL;
4818 	int credit_request;
4819 
4820 	if (!wdata->server || wdata->replay)
4821 		server = wdata->server = cifs_pick_channel(tcon->ses);
4822 
4823 	/*
4824 	 * in future we may get cifs_io_parms passed in from the caller,
4825 	 * but for now we construct it here...
4826 	 */
4827 	_io_parms = (struct cifs_io_parms) {
4828 		.tcon = tcon,
4829 		.server = server,
4830 		.offset = wdata->offset,
4831 		.length = wdata->bytes,
4832 		.persistent_fid = wdata->cfile->fid.persistent_fid,
4833 		.volatile_fid = wdata->cfile->fid.volatile_fid,
4834 		.pid = wdata->pid,
4835 	};
4836 	io_parms = &_io_parms;
4837 
4838 	rc = smb2_plain_req_init(SMB2_WRITE, tcon, server,
4839 				 (void **) &req, &total_len);
4840 	if (rc)
4841 		return rc;
4842 
4843 	if (smb3_encryption_required(tcon))
4844 		flags |= CIFS_TRANSFORM_REQ;
4845 
4846 	shdr = (struct smb2_hdr *)req;
4847 	shdr->Id.SyncId.ProcessId = cpu_to_le32(io_parms->pid);
4848 
4849 	req->PersistentFileId = io_parms->persistent_fid;
4850 	req->VolatileFileId = io_parms->volatile_fid;
4851 	req->WriteChannelInfoOffset = 0;
4852 	req->WriteChannelInfoLength = 0;
4853 	req->Channel = SMB2_CHANNEL_NONE;
4854 	req->Offset = cpu_to_le64(io_parms->offset);
4855 	req->DataOffset = cpu_to_le16(
4856 				offsetof(struct smb2_write_req, Buffer));
4857 	req->RemainingBytes = 0;
4858 
4859 	trace_smb3_write_enter(0 /* xid */,
4860 			       io_parms->persistent_fid,
4861 			       io_parms->tcon->tid,
4862 			       io_parms->tcon->ses->Suid,
4863 			       io_parms->offset,
4864 			       io_parms->length);
4865 
4866 #ifdef CONFIG_CIFS_SMB_DIRECT
4867 	/*
4868 	 * If we want to do a server RDMA read, fill in and append
4869 	 * smbd_buffer_descriptor_v1 to the end of write request
4870 	 */
4871 	if (smb3_use_rdma_offload(io_parms)) {
4872 		struct smbd_buffer_descriptor_v1 *v1;
4873 		size_t data_size = iov_iter_count(&wdata->iter);
4874 		bool need_invalidate = server->dialect == SMB30_PROT_ID;
4875 
4876 		wdata->mr = smbd_register_mr(server->smbd_conn, &wdata->iter,
4877 					     false, need_invalidate);
4878 		if (!wdata->mr) {
4879 			rc = -EAGAIN;
4880 			goto async_writev_out;
4881 		}
4882 		req->Length = 0;
4883 		req->DataOffset = 0;
4884 		req->RemainingBytes = cpu_to_le32(data_size);
4885 		req->Channel = SMB2_CHANNEL_RDMA_V1_INVALIDATE;
4886 		if (need_invalidate)
4887 			req->Channel = SMB2_CHANNEL_RDMA_V1;
4888 		req->WriteChannelInfoOffset =
4889 			cpu_to_le16(offsetof(struct smb2_write_req, Buffer));
4890 		req->WriteChannelInfoLength =
4891 			cpu_to_le16(sizeof(struct smbd_buffer_descriptor_v1));
4892 		v1 = (struct smbd_buffer_descriptor_v1 *) &req->Buffer[0];
4893 		v1->offset = cpu_to_le64(wdata->mr->mr->iova);
4894 		v1->token = cpu_to_le32(wdata->mr->mr->rkey);
4895 		v1->length = cpu_to_le32(wdata->mr->mr->length);
4896 	}
4897 #endif
4898 	iov[0].iov_len = total_len - 1;
4899 	iov[0].iov_base = (char *)req;
4900 
4901 	rqst.rq_iov = iov;
4902 	rqst.rq_nvec = 1;
4903 	rqst.rq_iter = wdata->iter;
4904 	rqst.rq_iter_size = iov_iter_count(&rqst.rq_iter);
4905 	if (wdata->replay)
4906 		smb2_set_replay(server, &rqst);
4907 #ifdef CONFIG_CIFS_SMB_DIRECT
4908 	if (wdata->mr)
4909 		iov[0].iov_len += sizeof(struct smbd_buffer_descriptor_v1);
4910 #endif
4911 	cifs_dbg(FYI, "async write at %llu %u bytes iter=%zx\n",
4912 		 io_parms->offset, io_parms->length, iov_iter_count(&rqst.rq_iter));
4913 
4914 #ifdef CONFIG_CIFS_SMB_DIRECT
4915 	/* For RDMA read, I/O size is in RemainingBytes not in Length */
4916 	if (!wdata->mr)
4917 		req->Length = cpu_to_le32(io_parms->length);
4918 #else
4919 	req->Length = cpu_to_le32(io_parms->length);
4920 #endif
4921 
4922 	if (wdata->credits.value > 0) {
4923 		shdr->CreditCharge = cpu_to_le16(DIV_ROUND_UP(wdata->bytes,
4924 						    SMB2_MAX_BUFFER_SIZE));
4925 		credit_request = le16_to_cpu(shdr->CreditCharge) + 8;
4926 		if (server->credits >= server->max_credits)
4927 			shdr->CreditRequest = cpu_to_le16(0);
4928 		else
4929 			shdr->CreditRequest = cpu_to_le16(
4930 				min_t(int, server->max_credits -
4931 						server->credits, credit_request));
4932 
4933 		rc = adjust_credits(server, &wdata->credits, io_parms->length);
4934 		if (rc)
4935 			goto async_writev_out;
4936 
4937 		flags |= CIFS_HAS_CREDITS;
4938 	}
4939 
4940 	kref_get(&wdata->refcount);
4941 	rc = cifs_call_async(server, &rqst, NULL, smb2_writev_callback, NULL,
4942 			     wdata, flags, &wdata->credits);
4943 
4944 	if (rc) {
4945 		trace_smb3_write_err(0 /* no xid */,
4946 				     io_parms->persistent_fid,
4947 				     io_parms->tcon->tid,
4948 				     io_parms->tcon->ses->Suid,
4949 				     io_parms->offset,
4950 				     io_parms->length,
4951 				     rc);
4952 		kref_put(&wdata->refcount, release);
4953 		cifs_stats_fail_inc(tcon, SMB2_WRITE_HE);
4954 	}
4955 
4956 async_writev_out:
4957 	cifs_small_buf_release(req);
4958 	return rc;
4959 }
4960 
4961 /*
4962  * SMB2_write function gets iov pointer to kvec array with n_vec as a length.
4963  * The length field from io_parms must be at least 1 and indicates a number of
4964  * elements with data to write that begins with position 1 in iov array. All
4965  * data length is specified by count.
4966  */
4967 int
4968 SMB2_write(const unsigned int xid, struct cifs_io_parms *io_parms,
4969 	   unsigned int *nbytes, struct kvec *iov, int n_vec)
4970 {
4971 	struct smb_rqst rqst;
4972 	int rc = 0;
4973 	struct smb2_write_req *req = NULL;
4974 	struct smb2_write_rsp *rsp = NULL;
4975 	int resp_buftype;
4976 	struct kvec rsp_iov;
4977 	int flags = 0;
4978 	unsigned int total_len;
4979 	struct TCP_Server_Info *server;
4980 	int retries = 0, cur_sleep = 1;
4981 
4982 replay_again:
4983 	/* reinitialize for possible replay */
4984 	flags = 0;
4985 	*nbytes = 0;
4986 	if (!io_parms->server)
4987 		io_parms->server = cifs_pick_channel(io_parms->tcon->ses);
4988 	server = io_parms->server;
4989 	if (server == NULL)
4990 		return -ECONNABORTED;
4991 
4992 	if (n_vec < 1)
4993 		return rc;
4994 
4995 	rc = smb2_plain_req_init(SMB2_WRITE, io_parms->tcon, server,
4996 				 (void **) &req, &total_len);
4997 	if (rc)
4998 		return rc;
4999 
5000 	if (smb3_encryption_required(io_parms->tcon))
5001 		flags |= CIFS_TRANSFORM_REQ;
5002 
5003 	req->hdr.Id.SyncId.ProcessId = cpu_to_le32(io_parms->pid);
5004 
5005 	req->PersistentFileId = io_parms->persistent_fid;
5006 	req->VolatileFileId = io_parms->volatile_fid;
5007 	req->WriteChannelInfoOffset = 0;
5008 	req->WriteChannelInfoLength = 0;
5009 	req->Channel = 0;
5010 	req->Length = cpu_to_le32(io_parms->length);
5011 	req->Offset = cpu_to_le64(io_parms->offset);
5012 	req->DataOffset = cpu_to_le16(
5013 				offsetof(struct smb2_write_req, Buffer));
5014 	req->RemainingBytes = 0;
5015 
5016 	trace_smb3_write_enter(xid, io_parms->persistent_fid,
5017 		io_parms->tcon->tid, io_parms->tcon->ses->Suid,
5018 		io_parms->offset, io_parms->length);
5019 
5020 	iov[0].iov_base = (char *)req;
5021 	/* 1 for Buffer */
5022 	iov[0].iov_len = total_len - 1;
5023 
5024 	memset(&rqst, 0, sizeof(struct smb_rqst));
5025 	rqst.rq_iov = iov;
5026 	rqst.rq_nvec = n_vec + 1;
5027 
5028 	if (retries)
5029 		smb2_set_replay(server, &rqst);
5030 
5031 	rc = cifs_send_recv(xid, io_parms->tcon->ses, server,
5032 			    &rqst,
5033 			    &resp_buftype, flags, &rsp_iov);
5034 	rsp = (struct smb2_write_rsp *)rsp_iov.iov_base;
5035 
5036 	if (rc) {
5037 		trace_smb3_write_err(xid,
5038 				     req->PersistentFileId,
5039 				     io_parms->tcon->tid,
5040 				     io_parms->tcon->ses->Suid,
5041 				     io_parms->offset, io_parms->length, rc);
5042 		cifs_stats_fail_inc(io_parms->tcon, SMB2_WRITE_HE);
5043 		cifs_dbg(VFS, "Send error in write = %d\n", rc);
5044 	} else {
5045 		*nbytes = le32_to_cpu(rsp->DataLength);
5046 		trace_smb3_write_done(xid,
5047 				      req->PersistentFileId,
5048 				      io_parms->tcon->tid,
5049 				      io_parms->tcon->ses->Suid,
5050 				      io_parms->offset, *nbytes);
5051 	}
5052 
5053 	cifs_small_buf_release(req);
5054 	free_rsp_buf(resp_buftype, rsp);
5055 
5056 	if (is_replayable_error(rc) &&
5057 	    smb2_should_replay(io_parms->tcon, &retries, &cur_sleep))
5058 		goto replay_again;
5059 
5060 	return rc;
5061 }
5062 
5063 int posix_info_sid_size(const void *beg, const void *end)
5064 {
5065 	size_t subauth;
5066 	int total;
5067 
5068 	if (beg + 1 > end)
5069 		return -1;
5070 
5071 	subauth = *(u8 *)(beg+1);
5072 	if (subauth < 1 || subauth > 15)
5073 		return -1;
5074 
5075 	total = 1 + 1 + 6 + 4*subauth;
5076 	if (beg + total > end)
5077 		return -1;
5078 
5079 	return total;
5080 }
5081 
5082 int posix_info_parse(const void *beg, const void *end,
5083 		     struct smb2_posix_info_parsed *out)
5084 
5085 {
5086 	int total_len = 0;
5087 	int owner_len, group_len;
5088 	int name_len;
5089 	const void *owner_sid;
5090 	const void *group_sid;
5091 	const void *name;
5092 
5093 	/* if no end bound given, assume payload to be correct */
5094 	if (!end) {
5095 		const struct smb2_posix_info *p = beg;
5096 
5097 		end = beg + le32_to_cpu(p->NextEntryOffset);
5098 		/* last element will have a 0 offset, pick a sensible bound */
5099 		if (end == beg)
5100 			end += 0xFFFF;
5101 	}
5102 
5103 	/* check base buf */
5104 	if (beg + sizeof(struct smb2_posix_info) > end)
5105 		return -1;
5106 	total_len = sizeof(struct smb2_posix_info);
5107 
5108 	/* check owner sid */
5109 	owner_sid = beg + total_len;
5110 	owner_len = posix_info_sid_size(owner_sid, end);
5111 	if (owner_len < 0)
5112 		return -1;
5113 	total_len += owner_len;
5114 
5115 	/* check group sid */
5116 	group_sid = beg + total_len;
5117 	group_len = posix_info_sid_size(group_sid, end);
5118 	if (group_len < 0)
5119 		return -1;
5120 	total_len += group_len;
5121 
5122 	/* check name len */
5123 	if (beg + total_len + 4 > end)
5124 		return -1;
5125 	name_len = le32_to_cpu(*(__le32 *)(beg + total_len));
5126 	if (name_len < 1 || name_len > 0xFFFF)
5127 		return -1;
5128 	total_len += 4;
5129 
5130 	/* check name */
5131 	name = beg + total_len;
5132 	if (name + name_len > end)
5133 		return -1;
5134 	total_len += name_len;
5135 
5136 	if (out) {
5137 		out->base = beg;
5138 		out->size = total_len;
5139 		out->name_len = name_len;
5140 		out->name = name;
5141 		memcpy(&out->owner, owner_sid, owner_len);
5142 		memcpy(&out->group, group_sid, group_len);
5143 	}
5144 	return total_len;
5145 }
5146 
5147 static int posix_info_extra_size(const void *beg, const void *end)
5148 {
5149 	int len = posix_info_parse(beg, end, NULL);
5150 
5151 	if (len < 0)
5152 		return -1;
5153 	return len - sizeof(struct smb2_posix_info);
5154 }
5155 
5156 static unsigned int
5157 num_entries(int infotype, char *bufstart, char *end_of_buf, char **lastentry,
5158 	    size_t size)
5159 {
5160 	int len;
5161 	unsigned int entrycount = 0;
5162 	unsigned int next_offset = 0;
5163 	char *entryptr;
5164 	FILE_DIRECTORY_INFO *dir_info;
5165 
5166 	if (bufstart == NULL)
5167 		return 0;
5168 
5169 	entryptr = bufstart;
5170 
5171 	while (1) {
5172 		if (entryptr + next_offset < entryptr ||
5173 		    entryptr + next_offset > end_of_buf ||
5174 		    entryptr + next_offset + size > end_of_buf) {
5175 			cifs_dbg(VFS, "malformed search entry would overflow\n");
5176 			break;
5177 		}
5178 
5179 		entryptr = entryptr + next_offset;
5180 		dir_info = (FILE_DIRECTORY_INFO *)entryptr;
5181 
5182 		if (infotype == SMB_FIND_FILE_POSIX_INFO)
5183 			len = posix_info_extra_size(entryptr, end_of_buf);
5184 		else
5185 			len = le32_to_cpu(dir_info->FileNameLength);
5186 
5187 		if (len < 0 ||
5188 		    entryptr + len < entryptr ||
5189 		    entryptr + len > end_of_buf ||
5190 		    entryptr + len + size > end_of_buf) {
5191 			cifs_dbg(VFS, "directory entry name would overflow frame end of buf %p\n",
5192 				 end_of_buf);
5193 			break;
5194 		}
5195 
5196 		*lastentry = entryptr;
5197 		entrycount++;
5198 
5199 		next_offset = le32_to_cpu(dir_info->NextEntryOffset);
5200 		if (!next_offset)
5201 			break;
5202 	}
5203 
5204 	return entrycount;
5205 }
5206 
5207 /*
5208  * Readdir/FindFirst
5209  */
5210 int SMB2_query_directory_init(const unsigned int xid,
5211 			      struct cifs_tcon *tcon,
5212 			      struct TCP_Server_Info *server,
5213 			      struct smb_rqst *rqst,
5214 			      u64 persistent_fid, u64 volatile_fid,
5215 			      int index, int info_level)
5216 {
5217 	struct smb2_query_directory_req *req;
5218 	unsigned char *bufptr;
5219 	__le16 asteriks = cpu_to_le16('*');
5220 	unsigned int output_size = CIFSMaxBufSize -
5221 		MAX_SMB2_CREATE_RESPONSE_SIZE -
5222 		MAX_SMB2_CLOSE_RESPONSE_SIZE;
5223 	unsigned int total_len;
5224 	struct kvec *iov = rqst->rq_iov;
5225 	int len, rc;
5226 
5227 	rc = smb2_plain_req_init(SMB2_QUERY_DIRECTORY, tcon, server,
5228 				 (void **) &req, &total_len);
5229 	if (rc)
5230 		return rc;
5231 
5232 	switch (info_level) {
5233 	case SMB_FIND_FILE_DIRECTORY_INFO:
5234 		req->FileInformationClass = FILE_DIRECTORY_INFORMATION;
5235 		break;
5236 	case SMB_FIND_FILE_ID_FULL_DIR_INFO:
5237 		req->FileInformationClass = FILEID_FULL_DIRECTORY_INFORMATION;
5238 		break;
5239 	case SMB_FIND_FILE_POSIX_INFO:
5240 		req->FileInformationClass = SMB_FIND_FILE_POSIX_INFO;
5241 		break;
5242 	case SMB_FIND_FILE_FULL_DIRECTORY_INFO:
5243 		req->FileInformationClass = FILE_FULL_DIRECTORY_INFORMATION;
5244 		break;
5245 	default:
5246 		cifs_tcon_dbg(VFS, "info level %u isn't supported\n",
5247 			info_level);
5248 		return -EINVAL;
5249 	}
5250 
5251 	req->FileIndex = cpu_to_le32(index);
5252 	req->PersistentFileId = persistent_fid;
5253 	req->VolatileFileId = volatile_fid;
5254 
5255 	len = 0x2;
5256 	bufptr = req->Buffer;
5257 	memcpy(bufptr, &asteriks, len);
5258 
5259 	req->FileNameOffset =
5260 		cpu_to_le16(sizeof(struct smb2_query_directory_req));
5261 	req->FileNameLength = cpu_to_le16(len);
5262 	/*
5263 	 * BB could be 30 bytes or so longer if we used SMB2 specific
5264 	 * buffer lengths, but this is safe and close enough.
5265 	 */
5266 	output_size = min_t(unsigned int, output_size, server->maxBuf);
5267 	output_size = min_t(unsigned int, output_size, 2 << 15);
5268 	req->OutputBufferLength = cpu_to_le32(output_size);
5269 
5270 	iov[0].iov_base = (char *)req;
5271 	/* 1 for Buffer */
5272 	iov[0].iov_len = total_len - 1;
5273 
5274 	iov[1].iov_base = (char *)(req->Buffer);
5275 	iov[1].iov_len = len;
5276 
5277 	trace_smb3_query_dir_enter(xid, persistent_fid, tcon->tid,
5278 			tcon->ses->Suid, index, output_size);
5279 
5280 	return 0;
5281 }
5282 
5283 void SMB2_query_directory_free(struct smb_rqst *rqst)
5284 {
5285 	if (rqst && rqst->rq_iov) {
5286 		cifs_small_buf_release(rqst->rq_iov[0].iov_base); /* request */
5287 	}
5288 }
5289 
5290 int
5291 smb2_parse_query_directory(struct cifs_tcon *tcon,
5292 			   struct kvec *rsp_iov,
5293 			   int resp_buftype,
5294 			   struct cifs_search_info *srch_inf)
5295 {
5296 	struct smb2_query_directory_rsp *rsp;
5297 	size_t info_buf_size;
5298 	char *end_of_smb;
5299 	int rc;
5300 
5301 	rsp = (struct smb2_query_directory_rsp *)rsp_iov->iov_base;
5302 
5303 	switch (srch_inf->info_level) {
5304 	case SMB_FIND_FILE_DIRECTORY_INFO:
5305 		info_buf_size = sizeof(FILE_DIRECTORY_INFO);
5306 		break;
5307 	case SMB_FIND_FILE_ID_FULL_DIR_INFO:
5308 		info_buf_size = sizeof(SEARCH_ID_FULL_DIR_INFO);
5309 		break;
5310 	case SMB_FIND_FILE_POSIX_INFO:
5311 		/* note that posix payload are variable size */
5312 		info_buf_size = sizeof(struct smb2_posix_info);
5313 		break;
5314 	case SMB_FIND_FILE_FULL_DIRECTORY_INFO:
5315 		info_buf_size = sizeof(FILE_FULL_DIRECTORY_INFO);
5316 		break;
5317 	default:
5318 		cifs_tcon_dbg(VFS, "info level %u isn't supported\n",
5319 			 srch_inf->info_level);
5320 		return -EINVAL;
5321 	}
5322 
5323 	rc = smb2_validate_iov(le16_to_cpu(rsp->OutputBufferOffset),
5324 			       le32_to_cpu(rsp->OutputBufferLength), rsp_iov,
5325 			       info_buf_size);
5326 	if (rc) {
5327 		cifs_tcon_dbg(VFS, "bad info payload");
5328 		return rc;
5329 	}
5330 
5331 	srch_inf->unicode = true;
5332 
5333 	if (srch_inf->ntwrk_buf_start) {
5334 		if (srch_inf->smallBuf)
5335 			cifs_small_buf_release(srch_inf->ntwrk_buf_start);
5336 		else
5337 			cifs_buf_release(srch_inf->ntwrk_buf_start);
5338 	}
5339 	srch_inf->ntwrk_buf_start = (char *)rsp;
5340 	srch_inf->srch_entries_start = srch_inf->last_entry =
5341 		(char *)rsp + le16_to_cpu(rsp->OutputBufferOffset);
5342 	end_of_smb = rsp_iov->iov_len + (char *)rsp;
5343 
5344 	srch_inf->entries_in_buffer = num_entries(
5345 		srch_inf->info_level,
5346 		srch_inf->srch_entries_start,
5347 		end_of_smb,
5348 		&srch_inf->last_entry,
5349 		info_buf_size);
5350 
5351 	srch_inf->index_of_last_entry += srch_inf->entries_in_buffer;
5352 	cifs_dbg(FYI, "num entries %d last_index %lld srch start %p srch end %p\n",
5353 		 srch_inf->entries_in_buffer, srch_inf->index_of_last_entry,
5354 		 srch_inf->srch_entries_start, srch_inf->last_entry);
5355 	if (resp_buftype == CIFS_LARGE_BUFFER)
5356 		srch_inf->smallBuf = false;
5357 	else if (resp_buftype == CIFS_SMALL_BUFFER)
5358 		srch_inf->smallBuf = true;
5359 	else
5360 		cifs_tcon_dbg(VFS, "Invalid search buffer type\n");
5361 
5362 	return 0;
5363 }
5364 
5365 int
5366 SMB2_query_directory(const unsigned int xid, struct cifs_tcon *tcon,
5367 		     u64 persistent_fid, u64 volatile_fid, int index,
5368 		     struct cifs_search_info *srch_inf)
5369 {
5370 	struct smb_rqst rqst;
5371 	struct kvec iov[SMB2_QUERY_DIRECTORY_IOV_SIZE];
5372 	struct smb2_query_directory_rsp *rsp = NULL;
5373 	int resp_buftype = CIFS_NO_BUFFER;
5374 	struct kvec rsp_iov;
5375 	int rc = 0;
5376 	struct cifs_ses *ses = tcon->ses;
5377 	struct TCP_Server_Info *server;
5378 	int flags = 0;
5379 	int retries = 0, cur_sleep = 1;
5380 
5381 replay_again:
5382 	/* reinitialize for possible replay */
5383 	flags = 0;
5384 	server = cifs_pick_channel(ses);
5385 
5386 	if (!ses || !(ses->server))
5387 		return -EIO;
5388 
5389 	if (smb3_encryption_required(tcon))
5390 		flags |= CIFS_TRANSFORM_REQ;
5391 
5392 	memset(&rqst, 0, sizeof(struct smb_rqst));
5393 	memset(&iov, 0, sizeof(iov));
5394 	rqst.rq_iov = iov;
5395 	rqst.rq_nvec = SMB2_QUERY_DIRECTORY_IOV_SIZE;
5396 
5397 	rc = SMB2_query_directory_init(xid, tcon, server,
5398 				       &rqst, persistent_fid,
5399 				       volatile_fid, index,
5400 				       srch_inf->info_level);
5401 	if (rc)
5402 		goto qdir_exit;
5403 
5404 	if (retries)
5405 		smb2_set_replay(server, &rqst);
5406 
5407 	rc = cifs_send_recv(xid, ses, server,
5408 			    &rqst, &resp_buftype, flags, &rsp_iov);
5409 	rsp = (struct smb2_query_directory_rsp *)rsp_iov.iov_base;
5410 
5411 	if (rc) {
5412 		if (rc == -ENODATA &&
5413 		    rsp->hdr.Status == STATUS_NO_MORE_FILES) {
5414 			trace_smb3_query_dir_done(xid, persistent_fid,
5415 				tcon->tid, tcon->ses->Suid, index, 0);
5416 			srch_inf->endOfSearch = true;
5417 			rc = 0;
5418 		} else {
5419 			trace_smb3_query_dir_err(xid, persistent_fid, tcon->tid,
5420 				tcon->ses->Suid, index, 0, rc);
5421 			cifs_stats_fail_inc(tcon, SMB2_QUERY_DIRECTORY_HE);
5422 		}
5423 		goto qdir_exit;
5424 	}
5425 
5426 	rc = smb2_parse_query_directory(tcon, &rsp_iov,	resp_buftype,
5427 					srch_inf);
5428 	if (rc) {
5429 		trace_smb3_query_dir_err(xid, persistent_fid, tcon->tid,
5430 			tcon->ses->Suid, index, 0, rc);
5431 		goto qdir_exit;
5432 	}
5433 	resp_buftype = CIFS_NO_BUFFER;
5434 
5435 	trace_smb3_query_dir_done(xid, persistent_fid, tcon->tid,
5436 			tcon->ses->Suid, index, srch_inf->entries_in_buffer);
5437 
5438 qdir_exit:
5439 	SMB2_query_directory_free(&rqst);
5440 	free_rsp_buf(resp_buftype, rsp);
5441 
5442 	if (is_replayable_error(rc) &&
5443 	    smb2_should_replay(tcon, &retries, &cur_sleep))
5444 		goto replay_again;
5445 
5446 	return rc;
5447 }
5448 
5449 int
5450 SMB2_set_info_init(struct cifs_tcon *tcon, struct TCP_Server_Info *server,
5451 		   struct smb_rqst *rqst,
5452 		   u64 persistent_fid, u64 volatile_fid, u32 pid,
5453 		   u8 info_class, u8 info_type, u32 additional_info,
5454 		   void **data, unsigned int *size)
5455 {
5456 	struct smb2_set_info_req *req;
5457 	struct kvec *iov = rqst->rq_iov;
5458 	unsigned int i, total_len;
5459 	int rc;
5460 
5461 	rc = smb2_plain_req_init(SMB2_SET_INFO, tcon, server,
5462 				 (void **) &req, &total_len);
5463 	if (rc)
5464 		return rc;
5465 
5466 	req->hdr.Id.SyncId.ProcessId = cpu_to_le32(pid);
5467 	req->InfoType = info_type;
5468 	req->FileInfoClass = info_class;
5469 	req->PersistentFileId = persistent_fid;
5470 	req->VolatileFileId = volatile_fid;
5471 	req->AdditionalInformation = cpu_to_le32(additional_info);
5472 
5473 	req->BufferOffset = cpu_to_le16(sizeof(struct smb2_set_info_req));
5474 	req->BufferLength = cpu_to_le32(*size);
5475 
5476 	memcpy(req->Buffer, *data, *size);
5477 	total_len += *size;
5478 
5479 	iov[0].iov_base = (char *)req;
5480 	/* 1 for Buffer */
5481 	iov[0].iov_len = total_len - 1;
5482 
5483 	for (i = 1; i < rqst->rq_nvec; i++) {
5484 		le32_add_cpu(&req->BufferLength, size[i]);
5485 		iov[i].iov_base = (char *)data[i];
5486 		iov[i].iov_len = size[i];
5487 	}
5488 
5489 	return 0;
5490 }
5491 
5492 void
5493 SMB2_set_info_free(struct smb_rqst *rqst)
5494 {
5495 	if (rqst && rqst->rq_iov)
5496 		cifs_buf_release(rqst->rq_iov[0].iov_base); /* request */
5497 }
5498 
5499 static int
5500 send_set_info(const unsigned int xid, struct cifs_tcon *tcon,
5501 	       u64 persistent_fid, u64 volatile_fid, u32 pid, u8 info_class,
5502 	       u8 info_type, u32 additional_info, unsigned int num,
5503 		void **data, unsigned int *size)
5504 {
5505 	struct smb_rqst rqst;
5506 	struct smb2_set_info_rsp *rsp = NULL;
5507 	struct kvec *iov;
5508 	struct kvec rsp_iov;
5509 	int rc = 0;
5510 	int resp_buftype;
5511 	struct cifs_ses *ses = tcon->ses;
5512 	struct TCP_Server_Info *server;
5513 	int flags = 0;
5514 	int retries = 0, cur_sleep = 1;
5515 
5516 replay_again:
5517 	/* reinitialize for possible replay */
5518 	flags = 0;
5519 	server = cifs_pick_channel(ses);
5520 
5521 	if (!ses || !server)
5522 		return -EIO;
5523 
5524 	if (!num)
5525 		return -EINVAL;
5526 
5527 	if (smb3_encryption_required(tcon))
5528 		flags |= CIFS_TRANSFORM_REQ;
5529 
5530 	iov = kmalloc_array(num, sizeof(struct kvec), GFP_KERNEL);
5531 	if (!iov)
5532 		return -ENOMEM;
5533 
5534 	memset(&rqst, 0, sizeof(struct smb_rqst));
5535 	rqst.rq_iov = iov;
5536 	rqst.rq_nvec = num;
5537 
5538 	rc = SMB2_set_info_init(tcon, server,
5539 				&rqst, persistent_fid, volatile_fid, pid,
5540 				info_class, info_type, additional_info,
5541 				data, size);
5542 	if (rc) {
5543 		kfree(iov);
5544 		return rc;
5545 	}
5546 
5547 	if (retries)
5548 		smb2_set_replay(server, &rqst);
5549 
5550 	rc = cifs_send_recv(xid, ses, server,
5551 			    &rqst, &resp_buftype, flags,
5552 			    &rsp_iov);
5553 	SMB2_set_info_free(&rqst);
5554 	rsp = (struct smb2_set_info_rsp *)rsp_iov.iov_base;
5555 
5556 	if (rc != 0) {
5557 		cifs_stats_fail_inc(tcon, SMB2_SET_INFO_HE);
5558 		trace_smb3_set_info_err(xid, persistent_fid, tcon->tid,
5559 				ses->Suid, info_class, (__u32)info_type, rc);
5560 	}
5561 
5562 	free_rsp_buf(resp_buftype, rsp);
5563 	kfree(iov);
5564 
5565 	if (is_replayable_error(rc) &&
5566 	    smb2_should_replay(tcon, &retries, &cur_sleep))
5567 		goto replay_again;
5568 
5569 	return rc;
5570 }
5571 
5572 int
5573 SMB2_set_eof(const unsigned int xid, struct cifs_tcon *tcon, u64 persistent_fid,
5574 	     u64 volatile_fid, u32 pid, loff_t new_eof)
5575 {
5576 	struct smb2_file_eof_info info;
5577 	void *data;
5578 	unsigned int size;
5579 
5580 	info.EndOfFile = cpu_to_le64(new_eof);
5581 
5582 	data = &info;
5583 	size = sizeof(struct smb2_file_eof_info);
5584 
5585 	trace_smb3_set_eof(xid, persistent_fid, tcon->tid, tcon->ses->Suid, new_eof);
5586 
5587 	return send_set_info(xid, tcon, persistent_fid, volatile_fid,
5588 			pid, FILE_END_OF_FILE_INFORMATION, SMB2_O_INFO_FILE,
5589 			0, 1, &data, &size);
5590 }
5591 
5592 int
5593 SMB2_set_acl(const unsigned int xid, struct cifs_tcon *tcon,
5594 		u64 persistent_fid, u64 volatile_fid,
5595 		struct cifs_ntsd *pnntsd, int pacllen, int aclflag)
5596 {
5597 	return send_set_info(xid, tcon, persistent_fid, volatile_fid,
5598 			current->tgid, 0, SMB2_O_INFO_SECURITY, aclflag,
5599 			1, (void **)&pnntsd, &pacllen);
5600 }
5601 
5602 int
5603 SMB2_set_ea(const unsigned int xid, struct cifs_tcon *tcon,
5604 	    u64 persistent_fid, u64 volatile_fid,
5605 	    struct smb2_file_full_ea_info *buf, int len)
5606 {
5607 	return send_set_info(xid, tcon, persistent_fid, volatile_fid,
5608 		current->tgid, FILE_FULL_EA_INFORMATION, SMB2_O_INFO_FILE,
5609 		0, 1, (void **)&buf, &len);
5610 }
5611 
5612 int
5613 SMB2_oplock_break(const unsigned int xid, struct cifs_tcon *tcon,
5614 		  const u64 persistent_fid, const u64 volatile_fid,
5615 		  __u8 oplock_level)
5616 {
5617 	struct smb_rqst rqst;
5618 	int rc;
5619 	struct smb2_oplock_break *req = NULL;
5620 	struct cifs_ses *ses = tcon->ses;
5621 	struct TCP_Server_Info *server;
5622 	int flags = CIFS_OBREAK_OP;
5623 	unsigned int total_len;
5624 	struct kvec iov[1];
5625 	struct kvec rsp_iov;
5626 	int resp_buf_type;
5627 	int retries = 0, cur_sleep = 1;
5628 
5629 replay_again:
5630 	/* reinitialize for possible replay */
5631 	flags = CIFS_OBREAK_OP;
5632 	server = cifs_pick_channel(ses);
5633 
5634 	cifs_dbg(FYI, "SMB2_oplock_break\n");
5635 	rc = smb2_plain_req_init(SMB2_OPLOCK_BREAK, tcon, server,
5636 				 (void **) &req, &total_len);
5637 	if (rc)
5638 		return rc;
5639 
5640 	if (smb3_encryption_required(tcon))
5641 		flags |= CIFS_TRANSFORM_REQ;
5642 
5643 	req->VolatileFid = volatile_fid;
5644 	req->PersistentFid = persistent_fid;
5645 	req->OplockLevel = oplock_level;
5646 	req->hdr.CreditRequest = cpu_to_le16(1);
5647 
5648 	flags |= CIFS_NO_RSP_BUF;
5649 
5650 	iov[0].iov_base = (char *)req;
5651 	iov[0].iov_len = total_len;
5652 
5653 	memset(&rqst, 0, sizeof(struct smb_rqst));
5654 	rqst.rq_iov = iov;
5655 	rqst.rq_nvec = 1;
5656 
5657 	if (retries)
5658 		smb2_set_replay(server, &rqst);
5659 
5660 	rc = cifs_send_recv(xid, ses, server,
5661 			    &rqst, &resp_buf_type, flags, &rsp_iov);
5662 	cifs_small_buf_release(req);
5663 	if (rc) {
5664 		cifs_stats_fail_inc(tcon, SMB2_OPLOCK_BREAK_HE);
5665 		cifs_dbg(FYI, "Send error in Oplock Break = %d\n", rc);
5666 	}
5667 
5668 	if (is_replayable_error(rc) &&
5669 	    smb2_should_replay(tcon, &retries, &cur_sleep))
5670 		goto replay_again;
5671 
5672 	return rc;
5673 }
5674 
5675 void
5676 smb2_copy_fs_info_to_kstatfs(struct smb2_fs_full_size_info *pfs_inf,
5677 			     struct kstatfs *kst)
5678 {
5679 	kst->f_bsize = le32_to_cpu(pfs_inf->BytesPerSector) *
5680 			  le32_to_cpu(pfs_inf->SectorsPerAllocationUnit);
5681 	kst->f_blocks = le64_to_cpu(pfs_inf->TotalAllocationUnits);
5682 	kst->f_bfree  = kst->f_bavail =
5683 			le64_to_cpu(pfs_inf->CallerAvailableAllocationUnits);
5684 	return;
5685 }
5686 
5687 static void
5688 copy_posix_fs_info_to_kstatfs(FILE_SYSTEM_POSIX_INFO *response_data,
5689 			struct kstatfs *kst)
5690 {
5691 	kst->f_bsize = le32_to_cpu(response_data->BlockSize);
5692 	kst->f_blocks = le64_to_cpu(response_data->TotalBlocks);
5693 	kst->f_bfree =  le64_to_cpu(response_data->BlocksAvail);
5694 	if (response_data->UserBlocksAvail == cpu_to_le64(-1))
5695 		kst->f_bavail = kst->f_bfree;
5696 	else
5697 		kst->f_bavail = le64_to_cpu(response_data->UserBlocksAvail);
5698 	if (response_data->TotalFileNodes != cpu_to_le64(-1))
5699 		kst->f_files = le64_to_cpu(response_data->TotalFileNodes);
5700 	if (response_data->FreeFileNodes != cpu_to_le64(-1))
5701 		kst->f_ffree = le64_to_cpu(response_data->FreeFileNodes);
5702 
5703 	return;
5704 }
5705 
5706 static int
5707 build_qfs_info_req(struct kvec *iov, struct cifs_tcon *tcon,
5708 		   struct TCP_Server_Info *server,
5709 		   int level, int outbuf_len, u64 persistent_fid,
5710 		   u64 volatile_fid)
5711 {
5712 	int rc;
5713 	struct smb2_query_info_req *req;
5714 	unsigned int total_len;
5715 
5716 	cifs_dbg(FYI, "Query FSInfo level %d\n", level);
5717 
5718 	if ((tcon->ses == NULL) || server == NULL)
5719 		return -EIO;
5720 
5721 	rc = smb2_plain_req_init(SMB2_QUERY_INFO, tcon, server,
5722 				 (void **) &req, &total_len);
5723 	if (rc)
5724 		return rc;
5725 
5726 	req->InfoType = SMB2_O_INFO_FILESYSTEM;
5727 	req->FileInfoClass = level;
5728 	req->PersistentFileId = persistent_fid;
5729 	req->VolatileFileId = volatile_fid;
5730 	/* 1 for pad */
5731 	req->InputBufferOffset =
5732 			cpu_to_le16(sizeof(struct smb2_query_info_req));
5733 	req->OutputBufferLength = cpu_to_le32(
5734 		outbuf_len + sizeof(struct smb2_query_info_rsp));
5735 
5736 	iov->iov_base = (char *)req;
5737 	iov->iov_len = total_len;
5738 	return 0;
5739 }
5740 
5741 static inline void free_qfs_info_req(struct kvec *iov)
5742 {
5743 	cifs_buf_release(iov->iov_base);
5744 }
5745 
5746 int
5747 SMB311_posix_qfs_info(const unsigned int xid, struct cifs_tcon *tcon,
5748 	      u64 persistent_fid, u64 volatile_fid, struct kstatfs *fsdata)
5749 {
5750 	struct smb_rqst rqst;
5751 	struct smb2_query_info_rsp *rsp = NULL;
5752 	struct kvec iov;
5753 	struct kvec rsp_iov;
5754 	int rc = 0;
5755 	int resp_buftype;
5756 	struct cifs_ses *ses = tcon->ses;
5757 	struct TCP_Server_Info *server;
5758 	FILE_SYSTEM_POSIX_INFO *info = NULL;
5759 	int flags = 0;
5760 	int retries = 0, cur_sleep = 1;
5761 
5762 replay_again:
5763 	/* reinitialize for possible replay */
5764 	flags = 0;
5765 	server = cifs_pick_channel(ses);
5766 
5767 	rc = build_qfs_info_req(&iov, tcon, server,
5768 				FS_POSIX_INFORMATION,
5769 				sizeof(FILE_SYSTEM_POSIX_INFO),
5770 				persistent_fid, volatile_fid);
5771 	if (rc)
5772 		return rc;
5773 
5774 	if (smb3_encryption_required(tcon))
5775 		flags |= CIFS_TRANSFORM_REQ;
5776 
5777 	memset(&rqst, 0, sizeof(struct smb_rqst));
5778 	rqst.rq_iov = &iov;
5779 	rqst.rq_nvec = 1;
5780 
5781 	if (retries)
5782 		smb2_set_replay(server, &rqst);
5783 
5784 	rc = cifs_send_recv(xid, ses, server,
5785 			    &rqst, &resp_buftype, flags, &rsp_iov);
5786 	free_qfs_info_req(&iov);
5787 	if (rc) {
5788 		cifs_stats_fail_inc(tcon, SMB2_QUERY_INFO_HE);
5789 		goto posix_qfsinf_exit;
5790 	}
5791 	rsp = (struct smb2_query_info_rsp *)rsp_iov.iov_base;
5792 
5793 	info = (FILE_SYSTEM_POSIX_INFO *)(
5794 		le16_to_cpu(rsp->OutputBufferOffset) + (char *)rsp);
5795 	rc = smb2_validate_iov(le16_to_cpu(rsp->OutputBufferOffset),
5796 			       le32_to_cpu(rsp->OutputBufferLength), &rsp_iov,
5797 			       sizeof(FILE_SYSTEM_POSIX_INFO));
5798 	if (!rc)
5799 		copy_posix_fs_info_to_kstatfs(info, fsdata);
5800 
5801 posix_qfsinf_exit:
5802 	free_rsp_buf(resp_buftype, rsp_iov.iov_base);
5803 
5804 	if (is_replayable_error(rc) &&
5805 	    smb2_should_replay(tcon, &retries, &cur_sleep))
5806 		goto replay_again;
5807 
5808 	return rc;
5809 }
5810 
5811 int
5812 SMB2_QFS_info(const unsigned int xid, struct cifs_tcon *tcon,
5813 	      u64 persistent_fid, u64 volatile_fid, struct kstatfs *fsdata)
5814 {
5815 	struct smb_rqst rqst;
5816 	struct smb2_query_info_rsp *rsp = NULL;
5817 	struct kvec iov;
5818 	struct kvec rsp_iov;
5819 	int rc = 0;
5820 	int resp_buftype;
5821 	struct cifs_ses *ses = tcon->ses;
5822 	struct TCP_Server_Info *server;
5823 	struct smb2_fs_full_size_info *info = NULL;
5824 	int flags = 0;
5825 	int retries = 0, cur_sleep = 1;
5826 
5827 replay_again:
5828 	/* reinitialize for possible replay */
5829 	flags = 0;
5830 	server = cifs_pick_channel(ses);
5831 
5832 	rc = build_qfs_info_req(&iov, tcon, server,
5833 				FS_FULL_SIZE_INFORMATION,
5834 				sizeof(struct smb2_fs_full_size_info),
5835 				persistent_fid, volatile_fid);
5836 	if (rc)
5837 		return rc;
5838 
5839 	if (smb3_encryption_required(tcon))
5840 		flags |= CIFS_TRANSFORM_REQ;
5841 
5842 	memset(&rqst, 0, sizeof(struct smb_rqst));
5843 	rqst.rq_iov = &iov;
5844 	rqst.rq_nvec = 1;
5845 
5846 	if (retries)
5847 		smb2_set_replay(server, &rqst);
5848 
5849 	rc = cifs_send_recv(xid, ses, server,
5850 			    &rqst, &resp_buftype, flags, &rsp_iov);
5851 	free_qfs_info_req(&iov);
5852 	if (rc) {
5853 		cifs_stats_fail_inc(tcon, SMB2_QUERY_INFO_HE);
5854 		goto qfsinf_exit;
5855 	}
5856 	rsp = (struct smb2_query_info_rsp *)rsp_iov.iov_base;
5857 
5858 	info = (struct smb2_fs_full_size_info *)(
5859 		le16_to_cpu(rsp->OutputBufferOffset) + (char *)rsp);
5860 	rc = smb2_validate_iov(le16_to_cpu(rsp->OutputBufferOffset),
5861 			       le32_to_cpu(rsp->OutputBufferLength), &rsp_iov,
5862 			       sizeof(struct smb2_fs_full_size_info));
5863 	if (!rc)
5864 		smb2_copy_fs_info_to_kstatfs(info, fsdata);
5865 
5866 qfsinf_exit:
5867 	free_rsp_buf(resp_buftype, rsp_iov.iov_base);
5868 
5869 	if (is_replayable_error(rc) &&
5870 	    smb2_should_replay(tcon, &retries, &cur_sleep))
5871 		goto replay_again;
5872 
5873 	return rc;
5874 }
5875 
5876 int
5877 SMB2_QFS_attr(const unsigned int xid, struct cifs_tcon *tcon,
5878 	      u64 persistent_fid, u64 volatile_fid, int level)
5879 {
5880 	struct smb_rqst rqst;
5881 	struct smb2_query_info_rsp *rsp = NULL;
5882 	struct kvec iov;
5883 	struct kvec rsp_iov;
5884 	int rc = 0;
5885 	int resp_buftype, max_len, min_len;
5886 	struct cifs_ses *ses = tcon->ses;
5887 	struct TCP_Server_Info *server;
5888 	unsigned int rsp_len, offset;
5889 	int flags = 0;
5890 	int retries = 0, cur_sleep = 1;
5891 
5892 replay_again:
5893 	/* reinitialize for possible replay */
5894 	flags = 0;
5895 	server = cifs_pick_channel(ses);
5896 
5897 	if (level == FS_DEVICE_INFORMATION) {
5898 		max_len = sizeof(FILE_SYSTEM_DEVICE_INFO);
5899 		min_len = sizeof(FILE_SYSTEM_DEVICE_INFO);
5900 	} else if (level == FS_ATTRIBUTE_INFORMATION) {
5901 		max_len = sizeof(FILE_SYSTEM_ATTRIBUTE_INFO);
5902 		min_len = MIN_FS_ATTR_INFO_SIZE;
5903 	} else if (level == FS_SECTOR_SIZE_INFORMATION) {
5904 		max_len = sizeof(struct smb3_fs_ss_info);
5905 		min_len = sizeof(struct smb3_fs_ss_info);
5906 	} else if (level == FS_VOLUME_INFORMATION) {
5907 		max_len = sizeof(struct smb3_fs_vol_info) + MAX_VOL_LABEL_LEN;
5908 		min_len = sizeof(struct smb3_fs_vol_info);
5909 	} else {
5910 		cifs_dbg(FYI, "Invalid qfsinfo level %d\n", level);
5911 		return -EINVAL;
5912 	}
5913 
5914 	rc = build_qfs_info_req(&iov, tcon, server,
5915 				level, max_len,
5916 				persistent_fid, volatile_fid);
5917 	if (rc)
5918 		return rc;
5919 
5920 	if (smb3_encryption_required(tcon))
5921 		flags |= CIFS_TRANSFORM_REQ;
5922 
5923 	memset(&rqst, 0, sizeof(struct smb_rqst));
5924 	rqst.rq_iov = &iov;
5925 	rqst.rq_nvec = 1;
5926 
5927 	if (retries)
5928 		smb2_set_replay(server, &rqst);
5929 
5930 	rc = cifs_send_recv(xid, ses, server,
5931 			    &rqst, &resp_buftype, flags, &rsp_iov);
5932 	free_qfs_info_req(&iov);
5933 	if (rc) {
5934 		cifs_stats_fail_inc(tcon, SMB2_QUERY_INFO_HE);
5935 		goto qfsattr_exit;
5936 	}
5937 	rsp = (struct smb2_query_info_rsp *)rsp_iov.iov_base;
5938 
5939 	rsp_len = le32_to_cpu(rsp->OutputBufferLength);
5940 	offset = le16_to_cpu(rsp->OutputBufferOffset);
5941 	rc = smb2_validate_iov(offset, rsp_len, &rsp_iov, min_len);
5942 	if (rc)
5943 		goto qfsattr_exit;
5944 
5945 	if (level == FS_ATTRIBUTE_INFORMATION)
5946 		memcpy(&tcon->fsAttrInfo, offset
5947 			+ (char *)rsp, min_t(unsigned int,
5948 			rsp_len, max_len));
5949 	else if (level == FS_DEVICE_INFORMATION)
5950 		memcpy(&tcon->fsDevInfo, offset
5951 			+ (char *)rsp, sizeof(FILE_SYSTEM_DEVICE_INFO));
5952 	else if (level == FS_SECTOR_SIZE_INFORMATION) {
5953 		struct smb3_fs_ss_info *ss_info = (struct smb3_fs_ss_info *)
5954 			(offset + (char *)rsp);
5955 		tcon->ss_flags = le32_to_cpu(ss_info->Flags);
5956 		tcon->perf_sector_size =
5957 			le32_to_cpu(ss_info->PhysicalBytesPerSectorForPerf);
5958 	} else if (level == FS_VOLUME_INFORMATION) {
5959 		struct smb3_fs_vol_info *vol_info = (struct smb3_fs_vol_info *)
5960 			(offset + (char *)rsp);
5961 		tcon->vol_serial_number = vol_info->VolumeSerialNumber;
5962 		tcon->vol_create_time = vol_info->VolumeCreationTime;
5963 	}
5964 
5965 qfsattr_exit:
5966 	free_rsp_buf(resp_buftype, rsp_iov.iov_base);
5967 
5968 	if (is_replayable_error(rc) &&
5969 	    smb2_should_replay(tcon, &retries, &cur_sleep))
5970 		goto replay_again;
5971 
5972 	return rc;
5973 }
5974 
5975 int
5976 smb2_lockv(const unsigned int xid, struct cifs_tcon *tcon,
5977 	   const __u64 persist_fid, const __u64 volatile_fid, const __u32 pid,
5978 	   const __u32 num_lock, struct smb2_lock_element *buf)
5979 {
5980 	struct smb_rqst rqst;
5981 	int rc = 0;
5982 	struct smb2_lock_req *req = NULL;
5983 	struct kvec iov[2];
5984 	struct kvec rsp_iov;
5985 	int resp_buf_type;
5986 	unsigned int count;
5987 	int flags = CIFS_NO_RSP_BUF;
5988 	unsigned int total_len;
5989 	struct TCP_Server_Info *server;
5990 	int retries = 0, cur_sleep = 1;
5991 
5992 replay_again:
5993 	/* reinitialize for possible replay */
5994 	flags = CIFS_NO_RSP_BUF;
5995 	server = cifs_pick_channel(tcon->ses);
5996 
5997 	cifs_dbg(FYI, "smb2_lockv num lock %d\n", num_lock);
5998 
5999 	rc = smb2_plain_req_init(SMB2_LOCK, tcon, server,
6000 				 (void **) &req, &total_len);
6001 	if (rc)
6002 		return rc;
6003 
6004 	if (smb3_encryption_required(tcon))
6005 		flags |= CIFS_TRANSFORM_REQ;
6006 
6007 	req->hdr.Id.SyncId.ProcessId = cpu_to_le32(pid);
6008 	req->LockCount = cpu_to_le16(num_lock);
6009 
6010 	req->PersistentFileId = persist_fid;
6011 	req->VolatileFileId = volatile_fid;
6012 
6013 	count = num_lock * sizeof(struct smb2_lock_element);
6014 
6015 	iov[0].iov_base = (char *)req;
6016 	iov[0].iov_len = total_len - sizeof(struct smb2_lock_element);
6017 	iov[1].iov_base = (char *)buf;
6018 	iov[1].iov_len = count;
6019 
6020 	cifs_stats_inc(&tcon->stats.cifs_stats.num_locks);
6021 
6022 	memset(&rqst, 0, sizeof(struct smb_rqst));
6023 	rqst.rq_iov = iov;
6024 	rqst.rq_nvec = 2;
6025 
6026 	if (retries)
6027 		smb2_set_replay(server, &rqst);
6028 
6029 	rc = cifs_send_recv(xid, tcon->ses, server,
6030 			    &rqst, &resp_buf_type, flags,
6031 			    &rsp_iov);
6032 	cifs_small_buf_release(req);
6033 	if (rc) {
6034 		cifs_dbg(FYI, "Send error in smb2_lockv = %d\n", rc);
6035 		cifs_stats_fail_inc(tcon, SMB2_LOCK_HE);
6036 		trace_smb3_lock_err(xid, persist_fid, tcon->tid,
6037 				    tcon->ses->Suid, rc);
6038 	}
6039 
6040 	if (is_replayable_error(rc) &&
6041 	    smb2_should_replay(tcon, &retries, &cur_sleep))
6042 		goto replay_again;
6043 
6044 	return rc;
6045 }
6046 
6047 int
6048 SMB2_lock(const unsigned int xid, struct cifs_tcon *tcon,
6049 	  const __u64 persist_fid, const __u64 volatile_fid, const __u32 pid,
6050 	  const __u64 length, const __u64 offset, const __u32 lock_flags,
6051 	  const bool wait)
6052 {
6053 	struct smb2_lock_element lock;
6054 
6055 	lock.Offset = cpu_to_le64(offset);
6056 	lock.Length = cpu_to_le64(length);
6057 	lock.Flags = cpu_to_le32(lock_flags);
6058 	if (!wait && lock_flags != SMB2_LOCKFLAG_UNLOCK)
6059 		lock.Flags |= cpu_to_le32(SMB2_LOCKFLAG_FAIL_IMMEDIATELY);
6060 
6061 	return smb2_lockv(xid, tcon, persist_fid, volatile_fid, pid, 1, &lock);
6062 }
6063 
6064 int
6065 SMB2_lease_break(const unsigned int xid, struct cifs_tcon *tcon,
6066 		 __u8 *lease_key, const __le32 lease_state)
6067 {
6068 	struct smb_rqst rqst;
6069 	int rc;
6070 	struct smb2_lease_ack *req = NULL;
6071 	struct cifs_ses *ses = tcon->ses;
6072 	int flags = CIFS_OBREAK_OP;
6073 	unsigned int total_len;
6074 	struct kvec iov[1];
6075 	struct kvec rsp_iov;
6076 	int resp_buf_type;
6077 	__u64 *please_key_high;
6078 	__u64 *please_key_low;
6079 	struct TCP_Server_Info *server = cifs_pick_channel(tcon->ses);
6080 
6081 	cifs_dbg(FYI, "SMB2_lease_break\n");
6082 	rc = smb2_plain_req_init(SMB2_OPLOCK_BREAK, tcon, server,
6083 				 (void **) &req, &total_len);
6084 	if (rc)
6085 		return rc;
6086 
6087 	if (smb3_encryption_required(tcon))
6088 		flags |= CIFS_TRANSFORM_REQ;
6089 
6090 	req->hdr.CreditRequest = cpu_to_le16(1);
6091 	req->StructureSize = cpu_to_le16(36);
6092 	total_len += 12;
6093 
6094 	memcpy(req->LeaseKey, lease_key, 16);
6095 	req->LeaseState = lease_state;
6096 
6097 	flags |= CIFS_NO_RSP_BUF;
6098 
6099 	iov[0].iov_base = (char *)req;
6100 	iov[0].iov_len = total_len;
6101 
6102 	memset(&rqst, 0, sizeof(struct smb_rqst));
6103 	rqst.rq_iov = iov;
6104 	rqst.rq_nvec = 1;
6105 
6106 	rc = cifs_send_recv(xid, ses, server,
6107 			    &rqst, &resp_buf_type, flags, &rsp_iov);
6108 	cifs_small_buf_release(req);
6109 
6110 	please_key_low = (__u64 *)lease_key;
6111 	please_key_high = (__u64 *)(lease_key+8);
6112 	if (rc) {
6113 		cifs_stats_fail_inc(tcon, SMB2_OPLOCK_BREAK_HE);
6114 		trace_smb3_lease_err(le32_to_cpu(lease_state), tcon->tid,
6115 			ses->Suid, *please_key_low, *please_key_high, rc);
6116 		cifs_dbg(FYI, "Send error in Lease Break = %d\n", rc);
6117 	} else
6118 		trace_smb3_lease_done(le32_to_cpu(lease_state), tcon->tid,
6119 			ses->Suid, *please_key_low, *please_key_high);
6120 
6121 	return rc;
6122 }
6123