1 // SPDX-License-Identifier: LGPL-2.1 2 /* 3 * 4 * Copyright (C) International Business Machines Corp., 2009, 2013 5 * Etersoft, 2012 6 * Author(s): Steve French (sfrench@us.ibm.com) 7 * Pavel Shilovsky (pshilovsky@samba.org) 2012 8 * 9 * Contains the routines for constructing the SMB2 PDUs themselves 10 * 11 */ 12 13 /* SMB2 PDU handling routines here - except for leftovers (eg session setup) */ 14 /* Note that there are handle based routines which must be */ 15 /* treated slightly differently for reconnection purposes since we never */ 16 /* want to reuse a stale file handle and only the caller knows the file info */ 17 18 #include <linux/fs.h> 19 #include <linux/kernel.h> 20 #include <linux/vfs.h> 21 #include <linux/task_io_accounting_ops.h> 22 #include <linux/uaccess.h> 23 #include <linux/uuid.h> 24 #include <linux/pagemap.h> 25 #include <linux/xattr.h> 26 #include "cifsglob.h" 27 #include "cifsacl.h" 28 #include "cifsproto.h" 29 #include "smb2proto.h" 30 #include "cifs_unicode.h" 31 #include "cifs_debug.h" 32 #include "ntlmssp.h" 33 #include "smb2status.h" 34 #include "smb2glob.h" 35 #include "cifspdu.h" 36 #include "cifs_spnego.h" 37 #include "smbdirect.h" 38 #include "trace.h" 39 #ifdef CONFIG_CIFS_DFS_UPCALL 40 #include "dfs_cache.h" 41 #endif 42 #include "cached_dir.h" 43 44 /* 45 * The following table defines the expected "StructureSize" of SMB2 requests 46 * in order by SMB2 command. This is similar to "wct" in SMB/CIFS requests. 47 * 48 * Note that commands are defined in smb2pdu.h in le16 but the array below is 49 * indexed by command in host byte order. 50 */ 51 static const int smb2_req_struct_sizes[NUMBER_OF_SMB2_COMMANDS] = { 52 /* SMB2_NEGOTIATE */ 36, 53 /* SMB2_SESSION_SETUP */ 25, 54 /* SMB2_LOGOFF */ 4, 55 /* SMB2_TREE_CONNECT */ 9, 56 /* SMB2_TREE_DISCONNECT */ 4, 57 /* SMB2_CREATE */ 57, 58 /* SMB2_CLOSE */ 24, 59 /* SMB2_FLUSH */ 24, 60 /* SMB2_READ */ 49, 61 /* SMB2_WRITE */ 49, 62 /* SMB2_LOCK */ 48, 63 /* SMB2_IOCTL */ 57, 64 /* SMB2_CANCEL */ 4, 65 /* SMB2_ECHO */ 4, 66 /* SMB2_QUERY_DIRECTORY */ 33, 67 /* SMB2_CHANGE_NOTIFY */ 32, 68 /* SMB2_QUERY_INFO */ 41, 69 /* SMB2_SET_INFO */ 33, 70 /* SMB2_OPLOCK_BREAK */ 24 /* BB this is 36 for LEASE_BREAK variant */ 71 }; 72 73 int smb3_encryption_required(const struct cifs_tcon *tcon) 74 { 75 if (!tcon || !tcon->ses) 76 return 0; 77 if ((tcon->ses->session_flags & SMB2_SESSION_FLAG_ENCRYPT_DATA) || 78 (tcon->share_flags & SHI1005_FLAGS_ENCRYPT_DATA)) 79 return 1; 80 if (tcon->seal && 81 (tcon->ses->server->capabilities & SMB2_GLOBAL_CAP_ENCRYPTION)) 82 return 1; 83 return 0; 84 } 85 86 static void 87 smb2_hdr_assemble(struct smb2_hdr *shdr, __le16 smb2_cmd, 88 const struct cifs_tcon *tcon, 89 struct TCP_Server_Info *server) 90 { 91 struct smb3_hdr_req *smb3_hdr; 92 93 shdr->ProtocolId = SMB2_PROTO_NUMBER; 94 shdr->StructureSize = cpu_to_le16(64); 95 shdr->Command = smb2_cmd; 96 97 if (server) { 98 /* After reconnect SMB3 must set ChannelSequence on subsequent reqs */ 99 if (server->dialect >= SMB30_PROT_ID) { 100 smb3_hdr = (struct smb3_hdr_req *)shdr; 101 /* 102 * if primary channel is not set yet, use default 103 * channel for chan sequence num 104 */ 105 if (SERVER_IS_CHAN(server)) 106 smb3_hdr->ChannelSequence = 107 cpu_to_le16(server->primary_server->channel_sequence_num); 108 else 109 smb3_hdr->ChannelSequence = 110 cpu_to_le16(server->channel_sequence_num); 111 } 112 spin_lock(&server->req_lock); 113 /* Request up to 10 credits but don't go over the limit. */ 114 if (server->credits >= server->max_credits) 115 shdr->CreditRequest = cpu_to_le16(0); 116 else 117 shdr->CreditRequest = cpu_to_le16( 118 min_t(int, server->max_credits - 119 server->credits, 10)); 120 spin_unlock(&server->req_lock); 121 } else { 122 shdr->CreditRequest = cpu_to_le16(2); 123 } 124 shdr->Id.SyncId.ProcessId = cpu_to_le32((__u16)current->tgid); 125 126 if (!tcon) 127 goto out; 128 129 /* GLOBAL_CAP_LARGE_MTU will only be set if dialect > SMB2.02 */ 130 /* See sections 2.2.4 and 3.2.4.1.5 of MS-SMB2 */ 131 if (server && (server->capabilities & SMB2_GLOBAL_CAP_LARGE_MTU)) 132 shdr->CreditCharge = cpu_to_le16(1); 133 /* else CreditCharge MBZ */ 134 135 shdr->Id.SyncId.TreeId = cpu_to_le32(tcon->tid); 136 /* Uid is not converted */ 137 if (tcon->ses) 138 shdr->SessionId = cpu_to_le64(tcon->ses->Suid); 139 140 /* 141 * If we would set SMB2_FLAGS_DFS_OPERATIONS on open we also would have 142 * to pass the path on the Open SMB prefixed by \\server\share. 143 * Not sure when we would need to do the augmented path (if ever) and 144 * setting this flag breaks the SMB2 open operation since it is 145 * illegal to send an empty path name (without \\server\share prefix) 146 * when the DFS flag is set in the SMB open header. We could 147 * consider setting the flag on all operations other than open 148 * but it is safer to net set it for now. 149 */ 150 /* if (tcon->share_flags & SHI1005_FLAGS_DFS) 151 shdr->Flags |= SMB2_FLAGS_DFS_OPERATIONS; */ 152 153 if (server && server->sign && !smb3_encryption_required(tcon)) 154 shdr->Flags |= SMB2_FLAGS_SIGNED; 155 out: 156 return; 157 } 158 159 /* helper function for code reuse */ 160 static int 161 cifs_chan_skip_or_disable(struct cifs_ses *ses, 162 struct TCP_Server_Info *server, 163 bool from_reconnect) 164 { 165 struct TCP_Server_Info *pserver; 166 unsigned int chan_index; 167 168 if (SERVER_IS_CHAN(server)) { 169 cifs_dbg(VFS, 170 "server %s does not support multichannel anymore. Skip secondary channel\n", 171 ses->server->hostname); 172 173 spin_lock(&ses->chan_lock); 174 chan_index = cifs_ses_get_chan_index(ses, server); 175 if (chan_index == CIFS_INVAL_CHAN_INDEX) { 176 spin_unlock(&ses->chan_lock); 177 goto skip_terminate; 178 } 179 180 ses->chans[chan_index].server = NULL; 181 server->terminate = true; 182 spin_unlock(&ses->chan_lock); 183 184 /* 185 * the above reference of server by channel 186 * needs to be dropped without holding chan_lock 187 * as cifs_put_tcp_session takes a higher lock 188 * i.e. cifs_tcp_ses_lock 189 */ 190 cifs_put_tcp_session(server, from_reconnect); 191 192 cifs_signal_cifsd_for_reconnect(server, false); 193 194 /* mark primary server as needing reconnect */ 195 pserver = server->primary_server; 196 cifs_signal_cifsd_for_reconnect(pserver, false); 197 skip_terminate: 198 return -EHOSTDOWN; 199 } 200 201 cifs_server_dbg(VFS, 202 "server does not support multichannel anymore. Disable all other channels\n"); 203 cifs_disable_secondary_channels(ses); 204 205 206 return 0; 207 } 208 209 static int 210 smb2_reconnect(__le16 smb2_command, struct cifs_tcon *tcon, 211 struct TCP_Server_Info *server, bool from_reconnect) 212 { 213 int rc = 0; 214 struct nls_table *nls_codepage = NULL; 215 struct cifs_ses *ses; 216 int xid; 217 218 /* 219 * SMB2s NegProt, SessSetup, Logoff do not have tcon yet so 220 * check for tcp and smb session status done differently 221 * for those three - in the calling routine. 222 */ 223 if (tcon == NULL) 224 return 0; 225 226 /* 227 * Need to also skip SMB2_IOCTL because it is used for checking nested dfs links in 228 * cifs_tree_connect(). 229 */ 230 if (smb2_command == SMB2_TREE_CONNECT || smb2_command == SMB2_IOCTL) 231 return 0; 232 233 spin_lock(&tcon->tc_lock); 234 if (tcon->status == TID_EXITING) { 235 /* 236 * only tree disconnect allowed when disconnecting ... 237 */ 238 if (smb2_command != SMB2_TREE_DISCONNECT) { 239 spin_unlock(&tcon->tc_lock); 240 cifs_dbg(FYI, "can not send cmd %d while umounting\n", 241 smb2_command); 242 return -ENODEV; 243 } 244 } 245 spin_unlock(&tcon->tc_lock); 246 247 ses = tcon->ses; 248 if (!ses) 249 return -EIO; 250 spin_lock(&ses->ses_lock); 251 if (ses->ses_status == SES_EXITING) { 252 spin_unlock(&ses->ses_lock); 253 return -EIO; 254 } 255 spin_unlock(&ses->ses_lock); 256 if (!ses->server || !server) 257 return -EIO; 258 259 spin_lock(&server->srv_lock); 260 if (server->tcpStatus == CifsNeedReconnect) { 261 /* 262 * Return to caller for TREE_DISCONNECT and LOGOFF and CLOSE 263 * here since they are implicitly done when session drops. 264 */ 265 switch (smb2_command) { 266 /* 267 * BB Should we keep oplock break and add flush to exceptions? 268 */ 269 case SMB2_TREE_DISCONNECT: 270 case SMB2_CANCEL: 271 case SMB2_CLOSE: 272 case SMB2_OPLOCK_BREAK: 273 spin_unlock(&server->srv_lock); 274 return -EAGAIN; 275 } 276 } 277 278 /* if server is marked for termination, cifsd will cleanup */ 279 if (server->terminate) { 280 spin_unlock(&server->srv_lock); 281 return -EHOSTDOWN; 282 } 283 spin_unlock(&server->srv_lock); 284 285 again: 286 rc = cifs_wait_for_server_reconnect(server, tcon->retry); 287 if (rc) 288 return rc; 289 290 spin_lock(&ses->chan_lock); 291 if (!cifs_chan_needs_reconnect(ses, server) && !tcon->need_reconnect) { 292 spin_unlock(&ses->chan_lock); 293 return 0; 294 } 295 spin_unlock(&ses->chan_lock); 296 cifs_dbg(FYI, "sess reconnect mask: 0x%lx, tcon reconnect: %d", 297 tcon->ses->chans_need_reconnect, 298 tcon->need_reconnect); 299 300 mutex_lock(&ses->session_mutex); 301 /* 302 * if this is called by delayed work, and the channel has been disabled 303 * in parallel, the delayed work can continue to execute in parallel 304 * there's a chance that this channel may not exist anymore 305 */ 306 spin_lock(&server->srv_lock); 307 if (server->tcpStatus == CifsExiting) { 308 spin_unlock(&server->srv_lock); 309 mutex_unlock(&ses->session_mutex); 310 rc = -EHOSTDOWN; 311 goto out; 312 } 313 314 /* 315 * Recheck after acquire mutex. If another thread is negotiating 316 * and the server never sends an answer the socket will be closed 317 * and tcpStatus set to reconnect. 318 */ 319 if (server->tcpStatus == CifsNeedReconnect) { 320 spin_unlock(&server->srv_lock); 321 mutex_unlock(&ses->session_mutex); 322 323 if (tcon->retry) 324 goto again; 325 326 rc = -EHOSTDOWN; 327 goto out; 328 } 329 spin_unlock(&server->srv_lock); 330 331 nls_codepage = ses->local_nls; 332 333 /* 334 * need to prevent multiple threads trying to simultaneously 335 * reconnect the same SMB session 336 */ 337 spin_lock(&ses->ses_lock); 338 spin_lock(&ses->chan_lock); 339 if (!cifs_chan_needs_reconnect(ses, server) && 340 ses->ses_status == SES_GOOD) { 341 spin_unlock(&ses->chan_lock); 342 spin_unlock(&ses->ses_lock); 343 /* this means that we only need to tree connect */ 344 if (tcon->need_reconnect) 345 goto skip_sess_setup; 346 347 mutex_unlock(&ses->session_mutex); 348 goto out; 349 } 350 spin_unlock(&ses->chan_lock); 351 spin_unlock(&ses->ses_lock); 352 353 rc = cifs_negotiate_protocol(0, ses, server); 354 if (!rc) { 355 /* 356 * if server stopped supporting multichannel 357 * and the first channel reconnected, disable all the others. 358 */ 359 if (ses->chan_count > 1 && 360 !(server->capabilities & SMB2_GLOBAL_CAP_MULTI_CHANNEL)) { 361 rc = cifs_chan_skip_or_disable(ses, server, 362 from_reconnect); 363 if (rc) { 364 mutex_unlock(&ses->session_mutex); 365 goto out; 366 } 367 } 368 369 rc = cifs_setup_session(0, ses, server, nls_codepage); 370 if ((rc == -EACCES) && !tcon->retry) { 371 mutex_unlock(&ses->session_mutex); 372 rc = -EHOSTDOWN; 373 goto failed; 374 } else if (rc) { 375 mutex_unlock(&ses->session_mutex); 376 goto out; 377 } 378 } else { 379 mutex_unlock(&ses->session_mutex); 380 goto out; 381 } 382 383 skip_sess_setup: 384 if (!tcon->need_reconnect) { 385 mutex_unlock(&ses->session_mutex); 386 goto out; 387 } 388 cifs_mark_open_files_invalid(tcon); 389 if (tcon->use_persistent) 390 tcon->need_reopen_files = true; 391 392 rc = cifs_tree_connect(0, tcon, nls_codepage); 393 394 cifs_dbg(FYI, "reconnect tcon rc = %d\n", rc); 395 if (rc) { 396 /* If sess reconnected but tcon didn't, something strange ... */ 397 mutex_unlock(&ses->session_mutex); 398 cifs_dbg(VFS, "reconnect tcon failed rc = %d\n", rc); 399 goto out; 400 } 401 402 spin_lock(&ses->ses_lock); 403 if (ses->flags & CIFS_SES_FLAG_SCALE_CHANNELS) { 404 spin_unlock(&ses->ses_lock); 405 mutex_unlock(&ses->session_mutex); 406 goto skip_add_channels; 407 } 408 ses->flags |= CIFS_SES_FLAG_SCALE_CHANNELS; 409 spin_unlock(&ses->ses_lock); 410 411 if (!rc && 412 (server->capabilities & SMB2_GLOBAL_CAP_MULTI_CHANNEL)) { 413 mutex_unlock(&ses->session_mutex); 414 415 /* 416 * query server network interfaces, in case they change 417 */ 418 xid = get_xid(); 419 rc = SMB3_request_interfaces(xid, tcon, false); 420 free_xid(xid); 421 422 if (rc == -EOPNOTSUPP && ses->chan_count > 1) { 423 /* 424 * some servers like Azure SMB server do not advertise 425 * that multichannel has been disabled with server 426 * capabilities, rather return STATUS_NOT_IMPLEMENTED. 427 * treat this as server not supporting multichannel 428 */ 429 430 rc = cifs_chan_skip_or_disable(ses, server, 431 from_reconnect); 432 goto skip_add_channels; 433 } else if (rc) 434 cifs_dbg(FYI, "%s: failed to query server interfaces: %d\n", 435 __func__, rc); 436 437 if (ses->chan_max > ses->chan_count && 438 ses->iface_count && 439 !SERVER_IS_CHAN(server)) { 440 if (ses->chan_count == 1) { 441 cifs_server_dbg(VFS, "supports multichannel now\n"); 442 queue_delayed_work(cifsiod_wq, &tcon->query_interfaces, 443 (SMB_INTERFACE_POLL_INTERVAL * HZ)); 444 } 445 446 cifs_try_adding_channels(ses); 447 } 448 } else { 449 mutex_unlock(&ses->session_mutex); 450 } 451 452 skip_add_channels: 453 spin_lock(&ses->ses_lock); 454 ses->flags &= ~CIFS_SES_FLAG_SCALE_CHANNELS; 455 spin_unlock(&ses->ses_lock); 456 457 if (smb2_command != SMB2_INTERNAL_CMD) 458 mod_delayed_work(cifsiod_wq, &server->reconnect, 0); 459 460 atomic_inc(&tconInfoReconnectCount); 461 out: 462 /* 463 * Check if handle based operation so we know whether we can continue 464 * or not without returning to caller to reset file handle. 465 */ 466 /* 467 * BB Is flush done by server on drop of tcp session? Should we special 468 * case it and skip above? 469 */ 470 switch (smb2_command) { 471 case SMB2_FLUSH: 472 case SMB2_READ: 473 case SMB2_WRITE: 474 case SMB2_LOCK: 475 case SMB2_QUERY_DIRECTORY: 476 case SMB2_CHANGE_NOTIFY: 477 case SMB2_QUERY_INFO: 478 case SMB2_SET_INFO: 479 rc = -EAGAIN; 480 } 481 failed: 482 return rc; 483 } 484 485 static void 486 fill_small_buf(__le16 smb2_command, struct cifs_tcon *tcon, 487 struct TCP_Server_Info *server, 488 void *buf, 489 unsigned int *total_len) 490 { 491 struct smb2_pdu *spdu = buf; 492 /* lookup word count ie StructureSize from table */ 493 __u16 parmsize = smb2_req_struct_sizes[le16_to_cpu(smb2_command)]; 494 495 /* 496 * smaller than SMALL_BUFFER_SIZE but bigger than fixed area of 497 * largest operations (Create) 498 */ 499 memset(buf, 0, 256); 500 501 smb2_hdr_assemble(&spdu->hdr, smb2_command, tcon, server); 502 spdu->StructureSize2 = cpu_to_le16(parmsize); 503 504 *total_len = parmsize + sizeof(struct smb2_hdr); 505 } 506 507 /* 508 * Allocate and return pointer to an SMB request hdr, and set basic 509 * SMB information in the SMB header. If the return code is zero, this 510 * function must have filled in request_buf pointer. 511 */ 512 static int __smb2_plain_req_init(__le16 smb2_command, struct cifs_tcon *tcon, 513 struct TCP_Server_Info *server, 514 void **request_buf, unsigned int *total_len) 515 { 516 /* BB eventually switch this to SMB2 specific small buf size */ 517 switch (smb2_command) { 518 case SMB2_SET_INFO: 519 case SMB2_QUERY_INFO: 520 *request_buf = cifs_buf_get(); 521 break; 522 default: 523 *request_buf = cifs_small_buf_get(); 524 break; 525 } 526 if (*request_buf == NULL) { 527 /* BB should we add a retry in here if not a writepage? */ 528 return -ENOMEM; 529 } 530 531 fill_small_buf(smb2_command, tcon, server, 532 (struct smb2_hdr *)(*request_buf), 533 total_len); 534 535 if (tcon != NULL) { 536 uint16_t com_code = le16_to_cpu(smb2_command); 537 cifs_stats_inc(&tcon->stats.smb2_stats.smb2_com_sent[com_code]); 538 cifs_stats_inc(&tcon->num_smbs_sent); 539 } 540 541 return 0; 542 } 543 544 static int smb2_plain_req_init(__le16 smb2_command, struct cifs_tcon *tcon, 545 struct TCP_Server_Info *server, 546 void **request_buf, unsigned int *total_len) 547 { 548 int rc; 549 550 rc = smb2_reconnect(smb2_command, tcon, server, false); 551 if (rc) 552 return rc; 553 554 return __smb2_plain_req_init(smb2_command, tcon, server, request_buf, 555 total_len); 556 } 557 558 static int smb2_ioctl_req_init(u32 opcode, struct cifs_tcon *tcon, 559 struct TCP_Server_Info *server, 560 void **request_buf, unsigned int *total_len) 561 { 562 /* Skip reconnect only for FSCTL_VALIDATE_NEGOTIATE_INFO IOCTLs */ 563 if (opcode == FSCTL_VALIDATE_NEGOTIATE_INFO) { 564 return __smb2_plain_req_init(SMB2_IOCTL, tcon, server, 565 request_buf, total_len); 566 } 567 return smb2_plain_req_init(SMB2_IOCTL, tcon, server, 568 request_buf, total_len); 569 } 570 571 /* For explanation of negotiate contexts see MS-SMB2 section 2.2.3.1 */ 572 573 static void 574 build_preauth_ctxt(struct smb2_preauth_neg_context *pneg_ctxt) 575 { 576 pneg_ctxt->ContextType = SMB2_PREAUTH_INTEGRITY_CAPABILITIES; 577 pneg_ctxt->DataLength = cpu_to_le16(38); 578 pneg_ctxt->HashAlgorithmCount = cpu_to_le16(1); 579 pneg_ctxt->SaltLength = cpu_to_le16(SMB311_SALT_SIZE); 580 get_random_bytes(pneg_ctxt->Salt, SMB311_SALT_SIZE); 581 pneg_ctxt->HashAlgorithms = SMB2_PREAUTH_INTEGRITY_SHA512; 582 } 583 584 static void 585 build_compression_ctxt(struct smb2_compression_capabilities_context *pneg_ctxt) 586 { 587 pneg_ctxt->ContextType = SMB2_COMPRESSION_CAPABILITIES; 588 pneg_ctxt->DataLength = 589 cpu_to_le16(sizeof(struct smb2_compression_capabilities_context) 590 - sizeof(struct smb2_neg_context)); 591 pneg_ctxt->CompressionAlgorithmCount = cpu_to_le16(3); 592 pneg_ctxt->CompressionAlgorithms[0] = SMB3_COMPRESS_LZ77; 593 pneg_ctxt->CompressionAlgorithms[1] = SMB3_COMPRESS_LZ77_HUFF; 594 pneg_ctxt->CompressionAlgorithms[2] = SMB3_COMPRESS_LZNT1; 595 } 596 597 static unsigned int 598 build_signing_ctxt(struct smb2_signing_capabilities *pneg_ctxt) 599 { 600 unsigned int ctxt_len = sizeof(struct smb2_signing_capabilities); 601 unsigned short num_algs = 1; /* number of signing algorithms sent */ 602 603 pneg_ctxt->ContextType = SMB2_SIGNING_CAPABILITIES; 604 /* 605 * Context Data length must be rounded to multiple of 8 for some servers 606 */ 607 pneg_ctxt->DataLength = cpu_to_le16(ALIGN(sizeof(struct smb2_signing_capabilities) - 608 sizeof(struct smb2_neg_context) + 609 (num_algs * sizeof(u16)), 8)); 610 pneg_ctxt->SigningAlgorithmCount = cpu_to_le16(num_algs); 611 pneg_ctxt->SigningAlgorithms[0] = cpu_to_le16(SIGNING_ALG_AES_CMAC); 612 613 ctxt_len += sizeof(__le16) * num_algs; 614 ctxt_len = ALIGN(ctxt_len, 8); 615 return ctxt_len; 616 /* TBD add SIGNING_ALG_AES_GMAC and/or SIGNING_ALG_HMAC_SHA256 */ 617 } 618 619 static void 620 build_encrypt_ctxt(struct smb2_encryption_neg_context *pneg_ctxt) 621 { 622 pneg_ctxt->ContextType = SMB2_ENCRYPTION_CAPABILITIES; 623 if (require_gcm_256) { 624 pneg_ctxt->DataLength = cpu_to_le16(4); /* Cipher Count + 1 cipher */ 625 pneg_ctxt->CipherCount = cpu_to_le16(1); 626 pneg_ctxt->Ciphers[0] = SMB2_ENCRYPTION_AES256_GCM; 627 } else if (enable_gcm_256) { 628 pneg_ctxt->DataLength = cpu_to_le16(8); /* Cipher Count + 3 ciphers */ 629 pneg_ctxt->CipherCount = cpu_to_le16(3); 630 pneg_ctxt->Ciphers[0] = SMB2_ENCRYPTION_AES128_GCM; 631 pneg_ctxt->Ciphers[1] = SMB2_ENCRYPTION_AES256_GCM; 632 pneg_ctxt->Ciphers[2] = SMB2_ENCRYPTION_AES128_CCM; 633 } else { 634 pneg_ctxt->DataLength = cpu_to_le16(6); /* Cipher Count + 2 ciphers */ 635 pneg_ctxt->CipherCount = cpu_to_le16(2); 636 pneg_ctxt->Ciphers[0] = SMB2_ENCRYPTION_AES128_GCM; 637 pneg_ctxt->Ciphers[1] = SMB2_ENCRYPTION_AES128_CCM; 638 } 639 } 640 641 static unsigned int 642 build_netname_ctxt(struct smb2_netname_neg_context *pneg_ctxt, char *hostname) 643 { 644 struct nls_table *cp = load_nls_default(); 645 646 pneg_ctxt->ContextType = SMB2_NETNAME_NEGOTIATE_CONTEXT_ID; 647 648 /* copy up to max of first 100 bytes of server name to NetName field */ 649 pneg_ctxt->DataLength = cpu_to_le16(2 * cifs_strtoUTF16(pneg_ctxt->NetName, hostname, 100, cp)); 650 /* context size is DataLength + minimal smb2_neg_context */ 651 return ALIGN(le16_to_cpu(pneg_ctxt->DataLength) + sizeof(struct smb2_neg_context), 8); 652 } 653 654 static void 655 build_posix_ctxt(struct smb2_posix_neg_context *pneg_ctxt) 656 { 657 pneg_ctxt->ContextType = SMB2_POSIX_EXTENSIONS_AVAILABLE; 658 pneg_ctxt->DataLength = cpu_to_le16(POSIX_CTXT_DATA_LEN); 659 /* SMB2_CREATE_TAG_POSIX is "0x93AD25509CB411E7B42383DE968BCD7C" */ 660 pneg_ctxt->Name[0] = 0x93; 661 pneg_ctxt->Name[1] = 0xAD; 662 pneg_ctxt->Name[2] = 0x25; 663 pneg_ctxt->Name[3] = 0x50; 664 pneg_ctxt->Name[4] = 0x9C; 665 pneg_ctxt->Name[5] = 0xB4; 666 pneg_ctxt->Name[6] = 0x11; 667 pneg_ctxt->Name[7] = 0xE7; 668 pneg_ctxt->Name[8] = 0xB4; 669 pneg_ctxt->Name[9] = 0x23; 670 pneg_ctxt->Name[10] = 0x83; 671 pneg_ctxt->Name[11] = 0xDE; 672 pneg_ctxt->Name[12] = 0x96; 673 pneg_ctxt->Name[13] = 0x8B; 674 pneg_ctxt->Name[14] = 0xCD; 675 pneg_ctxt->Name[15] = 0x7C; 676 } 677 678 static void 679 assemble_neg_contexts(struct smb2_negotiate_req *req, 680 struct TCP_Server_Info *server, unsigned int *total_len) 681 { 682 unsigned int ctxt_len, neg_context_count; 683 struct TCP_Server_Info *pserver; 684 char *pneg_ctxt; 685 char *hostname; 686 687 if (*total_len > 200) { 688 /* In case length corrupted don't want to overrun smb buffer */ 689 cifs_server_dbg(VFS, "Bad frame length assembling neg contexts\n"); 690 return; 691 } 692 693 /* 694 * round up total_len of fixed part of SMB3 negotiate request to 8 695 * byte boundary before adding negotiate contexts 696 */ 697 *total_len = ALIGN(*total_len, 8); 698 699 pneg_ctxt = (*total_len) + (char *)req; 700 req->NegotiateContextOffset = cpu_to_le32(*total_len); 701 702 build_preauth_ctxt((struct smb2_preauth_neg_context *)pneg_ctxt); 703 ctxt_len = ALIGN(sizeof(struct smb2_preauth_neg_context), 8); 704 *total_len += ctxt_len; 705 pneg_ctxt += ctxt_len; 706 707 build_encrypt_ctxt((struct smb2_encryption_neg_context *)pneg_ctxt); 708 ctxt_len = ALIGN(sizeof(struct smb2_encryption_neg_context), 8); 709 *total_len += ctxt_len; 710 pneg_ctxt += ctxt_len; 711 712 /* 713 * secondary channels don't have the hostname field populated 714 * use the hostname field in the primary channel instead 715 */ 716 pserver = SERVER_IS_CHAN(server) ? server->primary_server : server; 717 cifs_server_lock(pserver); 718 hostname = pserver->hostname; 719 if (hostname && (hostname[0] != 0)) { 720 ctxt_len = build_netname_ctxt((struct smb2_netname_neg_context *)pneg_ctxt, 721 hostname); 722 *total_len += ctxt_len; 723 pneg_ctxt += ctxt_len; 724 neg_context_count = 3; 725 } else 726 neg_context_count = 2; 727 cifs_server_unlock(pserver); 728 729 build_posix_ctxt((struct smb2_posix_neg_context *)pneg_ctxt); 730 *total_len += sizeof(struct smb2_posix_neg_context); 731 pneg_ctxt += sizeof(struct smb2_posix_neg_context); 732 neg_context_count++; 733 734 if (server->compression.requested) { 735 build_compression_ctxt((struct smb2_compression_capabilities_context *) 736 pneg_ctxt); 737 ctxt_len = ALIGN(sizeof(struct smb2_compression_capabilities_context), 8); 738 *total_len += ctxt_len; 739 pneg_ctxt += ctxt_len; 740 neg_context_count++; 741 } 742 743 if (enable_negotiate_signing) { 744 ctxt_len = build_signing_ctxt((struct smb2_signing_capabilities *) 745 pneg_ctxt); 746 *total_len += ctxt_len; 747 pneg_ctxt += ctxt_len; 748 neg_context_count++; 749 } 750 751 /* check for and add transport_capabilities and signing capabilities */ 752 req->NegotiateContextCount = cpu_to_le16(neg_context_count); 753 754 } 755 756 /* If invalid preauth context warn but use what we requested, SHA-512 */ 757 static void decode_preauth_context(struct smb2_preauth_neg_context *ctxt) 758 { 759 unsigned int len = le16_to_cpu(ctxt->DataLength); 760 761 /* 762 * Caller checked that DataLength remains within SMB boundary. We still 763 * need to confirm that one HashAlgorithms member is accounted for. 764 */ 765 if (len < MIN_PREAUTH_CTXT_DATA_LEN) { 766 pr_warn_once("server sent bad preauth context\n"); 767 return; 768 } else if (len < MIN_PREAUTH_CTXT_DATA_LEN + le16_to_cpu(ctxt->SaltLength)) { 769 pr_warn_once("server sent invalid SaltLength\n"); 770 return; 771 } 772 if (le16_to_cpu(ctxt->HashAlgorithmCount) != 1) 773 pr_warn_once("Invalid SMB3 hash algorithm count\n"); 774 if (ctxt->HashAlgorithms != SMB2_PREAUTH_INTEGRITY_SHA512) 775 pr_warn_once("unknown SMB3 hash algorithm\n"); 776 } 777 778 static void decode_compress_ctx(struct TCP_Server_Info *server, 779 struct smb2_compression_capabilities_context *ctxt) 780 { 781 unsigned int len = le16_to_cpu(ctxt->DataLength); 782 __le16 alg; 783 784 server->compression.enabled = false; 785 786 /* 787 * Caller checked that DataLength remains within SMB boundary. We still 788 * need to confirm that one CompressionAlgorithms member is accounted 789 * for. 790 */ 791 if (len < 10) { 792 pr_warn_once("server sent bad compression cntxt\n"); 793 return; 794 } 795 796 if (le16_to_cpu(ctxt->CompressionAlgorithmCount) != 1) { 797 pr_warn_once("invalid SMB3 compress algorithm count\n"); 798 return; 799 } 800 801 alg = ctxt->CompressionAlgorithms[0]; 802 803 /* 'NONE' (0) compressor type is never negotiated */ 804 if (alg == 0 || le16_to_cpu(alg) > 3) { 805 pr_warn_once("invalid compression algorithm '%u'\n", alg); 806 return; 807 } 808 809 server->compression.alg = alg; 810 server->compression.enabled = true; 811 } 812 813 static int decode_encrypt_ctx(struct TCP_Server_Info *server, 814 struct smb2_encryption_neg_context *ctxt) 815 { 816 unsigned int len = le16_to_cpu(ctxt->DataLength); 817 818 cifs_dbg(FYI, "decode SMB3.11 encryption neg context of len %d\n", len); 819 /* 820 * Caller checked that DataLength remains within SMB boundary. We still 821 * need to confirm that one Cipher flexible array member is accounted 822 * for. 823 */ 824 if (len < MIN_ENCRYPT_CTXT_DATA_LEN) { 825 pr_warn_once("server sent bad crypto ctxt len\n"); 826 return -EINVAL; 827 } 828 829 if (le16_to_cpu(ctxt->CipherCount) != 1) { 830 pr_warn_once("Invalid SMB3.11 cipher count\n"); 831 return -EINVAL; 832 } 833 cifs_dbg(FYI, "SMB311 cipher type:%d\n", le16_to_cpu(ctxt->Ciphers[0])); 834 if (require_gcm_256) { 835 if (ctxt->Ciphers[0] != SMB2_ENCRYPTION_AES256_GCM) { 836 cifs_dbg(VFS, "Server does not support requested encryption type (AES256 GCM)\n"); 837 return -EOPNOTSUPP; 838 } 839 } else if (ctxt->Ciphers[0] == 0) { 840 /* 841 * e.g. if server only supported AES256_CCM (very unlikely) 842 * or server supported no encryption types or had all disabled. 843 * Since GLOBAL_CAP_ENCRYPTION will be not set, in the case 844 * in which mount requested encryption ("seal") checks later 845 * on during tree connection will return proper rc, but if 846 * seal not requested by client, since server is allowed to 847 * return 0 to indicate no supported cipher, we can't fail here 848 */ 849 server->cipher_type = 0; 850 server->capabilities &= ~SMB2_GLOBAL_CAP_ENCRYPTION; 851 pr_warn_once("Server does not support requested encryption types\n"); 852 return 0; 853 } else if ((ctxt->Ciphers[0] != SMB2_ENCRYPTION_AES128_CCM) && 854 (ctxt->Ciphers[0] != SMB2_ENCRYPTION_AES128_GCM) && 855 (ctxt->Ciphers[0] != SMB2_ENCRYPTION_AES256_GCM)) { 856 /* server returned a cipher we didn't ask for */ 857 pr_warn_once("Invalid SMB3.11 cipher returned\n"); 858 return -EINVAL; 859 } 860 server->cipher_type = ctxt->Ciphers[0]; 861 server->capabilities |= SMB2_GLOBAL_CAP_ENCRYPTION; 862 return 0; 863 } 864 865 static void decode_signing_ctx(struct TCP_Server_Info *server, 866 struct smb2_signing_capabilities *pctxt) 867 { 868 unsigned int len = le16_to_cpu(pctxt->DataLength); 869 870 /* 871 * Caller checked that DataLength remains within SMB boundary. We still 872 * need to confirm that one SigningAlgorithms flexible array member is 873 * accounted for. 874 */ 875 if ((len < 4) || (len > 16)) { 876 pr_warn_once("server sent bad signing negcontext\n"); 877 return; 878 } 879 if (le16_to_cpu(pctxt->SigningAlgorithmCount) != 1) { 880 pr_warn_once("Invalid signing algorithm count\n"); 881 return; 882 } 883 if (le16_to_cpu(pctxt->SigningAlgorithms[0]) > 2) { 884 pr_warn_once("unknown signing algorithm\n"); 885 return; 886 } 887 888 server->signing_negotiated = true; 889 server->signing_algorithm = le16_to_cpu(pctxt->SigningAlgorithms[0]); 890 cifs_dbg(FYI, "signing algorithm %d chosen\n", 891 server->signing_algorithm); 892 } 893 894 895 static int smb311_decode_neg_context(struct smb2_negotiate_rsp *rsp, 896 struct TCP_Server_Info *server, 897 unsigned int len_of_smb) 898 { 899 struct smb2_neg_context *pctx; 900 unsigned int offset = le32_to_cpu(rsp->NegotiateContextOffset); 901 unsigned int ctxt_cnt = le16_to_cpu(rsp->NegotiateContextCount); 902 unsigned int len_of_ctxts, i; 903 int rc = 0; 904 905 cifs_dbg(FYI, "decoding %d negotiate contexts\n", ctxt_cnt); 906 if (len_of_smb <= offset) { 907 cifs_server_dbg(VFS, "Invalid response: negotiate context offset\n"); 908 return -EINVAL; 909 } 910 911 len_of_ctxts = len_of_smb - offset; 912 913 for (i = 0; i < ctxt_cnt; i++) { 914 int clen; 915 /* check that offset is not beyond end of SMB */ 916 if (len_of_ctxts < sizeof(struct smb2_neg_context)) 917 break; 918 919 pctx = (struct smb2_neg_context *)(offset + (char *)rsp); 920 clen = sizeof(struct smb2_neg_context) 921 + le16_to_cpu(pctx->DataLength); 922 /* 923 * 2.2.4 SMB2 NEGOTIATE Response 924 * Subsequent negotiate contexts MUST appear at the first 8-byte 925 * aligned offset following the previous negotiate context. 926 */ 927 if (i + 1 != ctxt_cnt) 928 clen = ALIGN(clen, 8); 929 if (clen > len_of_ctxts) 930 break; 931 932 if (pctx->ContextType == SMB2_PREAUTH_INTEGRITY_CAPABILITIES) 933 decode_preauth_context( 934 (struct smb2_preauth_neg_context *)pctx); 935 else if (pctx->ContextType == SMB2_ENCRYPTION_CAPABILITIES) 936 rc = decode_encrypt_ctx(server, 937 (struct smb2_encryption_neg_context *)pctx); 938 else if (pctx->ContextType == SMB2_COMPRESSION_CAPABILITIES) 939 decode_compress_ctx(server, 940 (struct smb2_compression_capabilities_context *)pctx); 941 else if (pctx->ContextType == SMB2_POSIX_EXTENSIONS_AVAILABLE) 942 server->posix_ext_supported = true; 943 else if (pctx->ContextType == SMB2_SIGNING_CAPABILITIES) 944 decode_signing_ctx(server, 945 (struct smb2_signing_capabilities *)pctx); 946 else 947 cifs_server_dbg(VFS, "unknown negcontext of type %d ignored\n", 948 le16_to_cpu(pctx->ContextType)); 949 if (rc) 950 break; 951 952 offset += clen; 953 len_of_ctxts -= clen; 954 } 955 return rc; 956 } 957 958 static struct create_posix * 959 create_posix_buf(umode_t mode) 960 { 961 struct create_posix *buf; 962 963 buf = kzalloc(sizeof(struct create_posix), 964 GFP_KERNEL); 965 if (!buf) 966 return NULL; 967 968 buf->ccontext.DataOffset = 969 cpu_to_le16(offsetof(struct create_posix, Mode)); 970 buf->ccontext.DataLength = cpu_to_le32(4); 971 buf->ccontext.NameOffset = 972 cpu_to_le16(offsetof(struct create_posix, Name)); 973 buf->ccontext.NameLength = cpu_to_le16(16); 974 975 /* SMB2_CREATE_TAG_POSIX is "0x93AD25509CB411E7B42383DE968BCD7C" */ 976 buf->Name[0] = 0x93; 977 buf->Name[1] = 0xAD; 978 buf->Name[2] = 0x25; 979 buf->Name[3] = 0x50; 980 buf->Name[4] = 0x9C; 981 buf->Name[5] = 0xB4; 982 buf->Name[6] = 0x11; 983 buf->Name[7] = 0xE7; 984 buf->Name[8] = 0xB4; 985 buf->Name[9] = 0x23; 986 buf->Name[10] = 0x83; 987 buf->Name[11] = 0xDE; 988 buf->Name[12] = 0x96; 989 buf->Name[13] = 0x8B; 990 buf->Name[14] = 0xCD; 991 buf->Name[15] = 0x7C; 992 buf->Mode = cpu_to_le32(mode); 993 cifs_dbg(FYI, "mode on posix create 0%o\n", mode); 994 return buf; 995 } 996 997 static int 998 add_posix_context(struct kvec *iov, unsigned int *num_iovec, umode_t mode) 999 { 1000 unsigned int num = *num_iovec; 1001 1002 iov[num].iov_base = create_posix_buf(mode); 1003 if (mode == ACL_NO_MODE) 1004 cifs_dbg(FYI, "%s: no mode\n", __func__); 1005 if (iov[num].iov_base == NULL) 1006 return -ENOMEM; 1007 iov[num].iov_len = sizeof(struct create_posix); 1008 *num_iovec = num + 1; 1009 return 0; 1010 } 1011 1012 1013 /* 1014 * 1015 * SMB2 Worker functions follow: 1016 * 1017 * The general structure of the worker functions is: 1018 * 1) Call smb2_init (assembles SMB2 header) 1019 * 2) Initialize SMB2 command specific fields in fixed length area of SMB 1020 * 3) Call smb_sendrcv2 (sends request on socket and waits for response) 1021 * 4) Decode SMB2 command specific fields in the fixed length area 1022 * 5) Decode variable length data area (if any for this SMB2 command type) 1023 * 6) Call free smb buffer 1024 * 7) return 1025 * 1026 */ 1027 1028 int 1029 SMB2_negotiate(const unsigned int xid, 1030 struct cifs_ses *ses, 1031 struct TCP_Server_Info *server) 1032 { 1033 struct smb_rqst rqst; 1034 struct smb2_negotiate_req *req; 1035 struct smb2_negotiate_rsp *rsp; 1036 struct kvec iov[1]; 1037 struct kvec rsp_iov; 1038 int rc; 1039 int resp_buftype; 1040 int blob_offset, blob_length; 1041 char *security_blob; 1042 int flags = CIFS_NEG_OP; 1043 unsigned int total_len; 1044 1045 cifs_dbg(FYI, "Negotiate protocol\n"); 1046 1047 if (!server) { 1048 WARN(1, "%s: server is NULL!\n", __func__); 1049 return -EIO; 1050 } 1051 1052 rc = smb2_plain_req_init(SMB2_NEGOTIATE, NULL, server, 1053 (void **) &req, &total_len); 1054 if (rc) 1055 return rc; 1056 1057 req->hdr.SessionId = 0; 1058 1059 memset(server->preauth_sha_hash, 0, SMB2_PREAUTH_HASH_SIZE); 1060 memset(ses->preauth_sha_hash, 0, SMB2_PREAUTH_HASH_SIZE); 1061 1062 if (strcmp(server->vals->version_string, 1063 SMB3ANY_VERSION_STRING) == 0) { 1064 req->Dialects[0] = cpu_to_le16(SMB30_PROT_ID); 1065 req->Dialects[1] = cpu_to_le16(SMB302_PROT_ID); 1066 req->Dialects[2] = cpu_to_le16(SMB311_PROT_ID); 1067 req->DialectCount = cpu_to_le16(3); 1068 total_len += 6; 1069 } else if (strcmp(server->vals->version_string, 1070 SMBDEFAULT_VERSION_STRING) == 0) { 1071 req->Dialects[0] = cpu_to_le16(SMB21_PROT_ID); 1072 req->Dialects[1] = cpu_to_le16(SMB30_PROT_ID); 1073 req->Dialects[2] = cpu_to_le16(SMB302_PROT_ID); 1074 req->Dialects[3] = cpu_to_le16(SMB311_PROT_ID); 1075 req->DialectCount = cpu_to_le16(4); 1076 total_len += 8; 1077 } else { 1078 /* otherwise send specific dialect */ 1079 req->Dialects[0] = cpu_to_le16(server->vals->protocol_id); 1080 req->DialectCount = cpu_to_le16(1); 1081 total_len += 2; 1082 } 1083 1084 /* only one of SMB2 signing flags may be set in SMB2 request */ 1085 if (ses->sign) 1086 req->SecurityMode = cpu_to_le16(SMB2_NEGOTIATE_SIGNING_REQUIRED); 1087 else if (global_secflags & CIFSSEC_MAY_SIGN) 1088 req->SecurityMode = cpu_to_le16(SMB2_NEGOTIATE_SIGNING_ENABLED); 1089 else 1090 req->SecurityMode = 0; 1091 1092 req->Capabilities = cpu_to_le32(server->vals->req_capabilities); 1093 if (ses->chan_max > 1) 1094 req->Capabilities |= cpu_to_le32(SMB2_GLOBAL_CAP_MULTI_CHANNEL); 1095 1096 /* ClientGUID must be zero for SMB2.02 dialect */ 1097 if (server->vals->protocol_id == SMB20_PROT_ID) 1098 memset(req->ClientGUID, 0, SMB2_CLIENT_GUID_SIZE); 1099 else { 1100 memcpy(req->ClientGUID, server->client_guid, 1101 SMB2_CLIENT_GUID_SIZE); 1102 if ((server->vals->protocol_id == SMB311_PROT_ID) || 1103 (strcmp(server->vals->version_string, 1104 SMB3ANY_VERSION_STRING) == 0) || 1105 (strcmp(server->vals->version_string, 1106 SMBDEFAULT_VERSION_STRING) == 0)) 1107 assemble_neg_contexts(req, server, &total_len); 1108 } 1109 iov[0].iov_base = (char *)req; 1110 iov[0].iov_len = total_len; 1111 1112 memset(&rqst, 0, sizeof(struct smb_rqst)); 1113 rqst.rq_iov = iov; 1114 rqst.rq_nvec = 1; 1115 1116 rc = cifs_send_recv(xid, ses, server, 1117 &rqst, &resp_buftype, flags, &rsp_iov); 1118 cifs_small_buf_release(req); 1119 rsp = (struct smb2_negotiate_rsp *)rsp_iov.iov_base; 1120 /* 1121 * No tcon so can't do 1122 * cifs_stats_inc(&tcon->stats.smb2_stats.smb2_com_fail[SMB2...]); 1123 */ 1124 if (rc == -EOPNOTSUPP) { 1125 cifs_server_dbg(VFS, "Dialect not supported by server. Consider specifying vers=1.0 or vers=2.0 on mount for accessing older servers\n"); 1126 goto neg_exit; 1127 } else if (rc != 0) 1128 goto neg_exit; 1129 1130 rc = -EIO; 1131 if (strcmp(server->vals->version_string, 1132 SMB3ANY_VERSION_STRING) == 0) { 1133 if (rsp->DialectRevision == cpu_to_le16(SMB20_PROT_ID)) { 1134 cifs_server_dbg(VFS, 1135 "SMB2 dialect returned but not requested\n"); 1136 goto neg_exit; 1137 } else if (rsp->DialectRevision == cpu_to_le16(SMB21_PROT_ID)) { 1138 cifs_server_dbg(VFS, 1139 "SMB2.1 dialect returned but not requested\n"); 1140 goto neg_exit; 1141 } else if (rsp->DialectRevision == cpu_to_le16(SMB311_PROT_ID)) { 1142 /* ops set to 3.0 by default for default so update */ 1143 server->ops = &smb311_operations; 1144 server->vals = &smb311_values; 1145 } 1146 } else if (strcmp(server->vals->version_string, 1147 SMBDEFAULT_VERSION_STRING) == 0) { 1148 if (rsp->DialectRevision == cpu_to_le16(SMB20_PROT_ID)) { 1149 cifs_server_dbg(VFS, 1150 "SMB2 dialect returned but not requested\n"); 1151 goto neg_exit; 1152 } else if (rsp->DialectRevision == cpu_to_le16(SMB21_PROT_ID)) { 1153 /* ops set to 3.0 by default for default so update */ 1154 server->ops = &smb21_operations; 1155 server->vals = &smb21_values; 1156 } else if (rsp->DialectRevision == cpu_to_le16(SMB311_PROT_ID)) { 1157 server->ops = &smb311_operations; 1158 server->vals = &smb311_values; 1159 } 1160 } else if (le16_to_cpu(rsp->DialectRevision) != 1161 server->vals->protocol_id) { 1162 /* if requested single dialect ensure returned dialect matched */ 1163 cifs_server_dbg(VFS, "Invalid 0x%x dialect returned: not requested\n", 1164 le16_to_cpu(rsp->DialectRevision)); 1165 goto neg_exit; 1166 } 1167 1168 cifs_dbg(FYI, "mode 0x%x\n", rsp->SecurityMode); 1169 1170 if (rsp->DialectRevision == cpu_to_le16(SMB20_PROT_ID)) 1171 cifs_dbg(FYI, "negotiated smb2.0 dialect\n"); 1172 else if (rsp->DialectRevision == cpu_to_le16(SMB21_PROT_ID)) 1173 cifs_dbg(FYI, "negotiated smb2.1 dialect\n"); 1174 else if (rsp->DialectRevision == cpu_to_le16(SMB30_PROT_ID)) 1175 cifs_dbg(FYI, "negotiated smb3.0 dialect\n"); 1176 else if (rsp->DialectRevision == cpu_to_le16(SMB302_PROT_ID)) 1177 cifs_dbg(FYI, "negotiated smb3.02 dialect\n"); 1178 else if (rsp->DialectRevision == cpu_to_le16(SMB311_PROT_ID)) 1179 cifs_dbg(FYI, "negotiated smb3.1.1 dialect\n"); 1180 else { 1181 cifs_server_dbg(VFS, "Invalid dialect returned by server 0x%x\n", 1182 le16_to_cpu(rsp->DialectRevision)); 1183 goto neg_exit; 1184 } 1185 1186 rc = 0; 1187 server->dialect = le16_to_cpu(rsp->DialectRevision); 1188 1189 /* 1190 * Keep a copy of the hash after negprot. This hash will be 1191 * the starting hash value for all sessions made from this 1192 * server. 1193 */ 1194 memcpy(server->preauth_sha_hash, ses->preauth_sha_hash, 1195 SMB2_PREAUTH_HASH_SIZE); 1196 1197 /* SMB2 only has an extended negflavor */ 1198 server->negflavor = CIFS_NEGFLAVOR_EXTENDED; 1199 /* set it to the maximum buffer size value we can send with 1 credit */ 1200 server->maxBuf = min_t(unsigned int, le32_to_cpu(rsp->MaxTransactSize), 1201 SMB2_MAX_BUFFER_SIZE); 1202 server->max_read = le32_to_cpu(rsp->MaxReadSize); 1203 server->max_write = le32_to_cpu(rsp->MaxWriteSize); 1204 server->sec_mode = le16_to_cpu(rsp->SecurityMode); 1205 if ((server->sec_mode & SMB2_SEC_MODE_FLAGS_ALL) != server->sec_mode) 1206 cifs_dbg(FYI, "Server returned unexpected security mode 0x%x\n", 1207 server->sec_mode); 1208 server->capabilities = le32_to_cpu(rsp->Capabilities); 1209 /* Internal types */ 1210 server->capabilities |= SMB2_NT_FIND | SMB2_LARGE_FILES; 1211 1212 /* 1213 * SMB3.0 supports only 1 cipher and doesn't have a encryption neg context 1214 * Set the cipher type manually. 1215 */ 1216 if (server->dialect == SMB30_PROT_ID && (server->capabilities & SMB2_GLOBAL_CAP_ENCRYPTION)) 1217 server->cipher_type = SMB2_ENCRYPTION_AES128_CCM; 1218 1219 security_blob = smb2_get_data_area_len(&blob_offset, &blob_length, 1220 (struct smb2_hdr *)rsp); 1221 /* 1222 * See MS-SMB2 section 2.2.4: if no blob, client picks default which 1223 * for us will be 1224 * ses->sectype = RawNTLMSSP; 1225 * but for time being this is our only auth choice so doesn't matter. 1226 * We just found a server which sets blob length to zero expecting raw. 1227 */ 1228 if (blob_length == 0) { 1229 cifs_dbg(FYI, "missing security blob on negprot\n"); 1230 server->sec_ntlmssp = true; 1231 } 1232 1233 rc = cifs_enable_signing(server, ses->sign); 1234 if (rc) 1235 goto neg_exit; 1236 if (blob_length) { 1237 rc = decode_negTokenInit(security_blob, blob_length, server); 1238 if (rc == 1) 1239 rc = 0; 1240 else if (rc == 0) 1241 rc = -EIO; 1242 } 1243 1244 if (rsp->DialectRevision == cpu_to_le16(SMB311_PROT_ID)) { 1245 if (rsp->NegotiateContextCount) 1246 rc = smb311_decode_neg_context(rsp, server, 1247 rsp_iov.iov_len); 1248 else 1249 cifs_server_dbg(VFS, "Missing expected negotiate contexts\n"); 1250 } 1251 neg_exit: 1252 free_rsp_buf(resp_buftype, rsp); 1253 return rc; 1254 } 1255 1256 int smb3_validate_negotiate(const unsigned int xid, struct cifs_tcon *tcon) 1257 { 1258 int rc; 1259 struct validate_negotiate_info_req *pneg_inbuf; 1260 struct validate_negotiate_info_rsp *pneg_rsp = NULL; 1261 u32 rsplen; 1262 u32 inbuflen; /* max of 4 dialects */ 1263 struct TCP_Server_Info *server = tcon->ses->server; 1264 1265 cifs_dbg(FYI, "validate negotiate\n"); 1266 1267 /* In SMB3.11 preauth integrity supersedes validate negotiate */ 1268 if (server->dialect == SMB311_PROT_ID) 1269 return 0; 1270 1271 /* 1272 * validation ioctl must be signed, so no point sending this if we 1273 * can not sign it (ie are not known user). Even if signing is not 1274 * required (enabled but not negotiated), in those cases we selectively 1275 * sign just this, the first and only signed request on a connection. 1276 * Having validation of negotiate info helps reduce attack vectors. 1277 */ 1278 if (tcon->ses->session_flags & SMB2_SESSION_FLAG_IS_GUEST) 1279 return 0; /* validation requires signing */ 1280 1281 if (tcon->ses->user_name == NULL) { 1282 cifs_dbg(FYI, "Can't validate negotiate: null user mount\n"); 1283 return 0; /* validation requires signing */ 1284 } 1285 1286 if (tcon->ses->session_flags & SMB2_SESSION_FLAG_IS_NULL) 1287 cifs_tcon_dbg(VFS, "Unexpected null user (anonymous) auth flag sent by server\n"); 1288 1289 pneg_inbuf = kmalloc(sizeof(*pneg_inbuf), GFP_NOFS); 1290 if (!pneg_inbuf) 1291 return -ENOMEM; 1292 1293 pneg_inbuf->Capabilities = 1294 cpu_to_le32(server->vals->req_capabilities); 1295 if (tcon->ses->chan_max > 1) 1296 pneg_inbuf->Capabilities |= cpu_to_le32(SMB2_GLOBAL_CAP_MULTI_CHANNEL); 1297 1298 memcpy(pneg_inbuf->Guid, server->client_guid, 1299 SMB2_CLIENT_GUID_SIZE); 1300 1301 if (tcon->ses->sign) 1302 pneg_inbuf->SecurityMode = 1303 cpu_to_le16(SMB2_NEGOTIATE_SIGNING_REQUIRED); 1304 else if (global_secflags & CIFSSEC_MAY_SIGN) 1305 pneg_inbuf->SecurityMode = 1306 cpu_to_le16(SMB2_NEGOTIATE_SIGNING_ENABLED); 1307 else 1308 pneg_inbuf->SecurityMode = 0; 1309 1310 1311 if (strcmp(server->vals->version_string, 1312 SMB3ANY_VERSION_STRING) == 0) { 1313 pneg_inbuf->Dialects[0] = cpu_to_le16(SMB30_PROT_ID); 1314 pneg_inbuf->Dialects[1] = cpu_to_le16(SMB302_PROT_ID); 1315 pneg_inbuf->Dialects[2] = cpu_to_le16(SMB311_PROT_ID); 1316 pneg_inbuf->DialectCount = cpu_to_le16(3); 1317 /* SMB 2.1 not included so subtract one dialect from len */ 1318 inbuflen = sizeof(*pneg_inbuf) - 1319 (sizeof(pneg_inbuf->Dialects[0])); 1320 } else if (strcmp(server->vals->version_string, 1321 SMBDEFAULT_VERSION_STRING) == 0) { 1322 pneg_inbuf->Dialects[0] = cpu_to_le16(SMB21_PROT_ID); 1323 pneg_inbuf->Dialects[1] = cpu_to_le16(SMB30_PROT_ID); 1324 pneg_inbuf->Dialects[2] = cpu_to_le16(SMB302_PROT_ID); 1325 pneg_inbuf->Dialects[3] = cpu_to_le16(SMB311_PROT_ID); 1326 pneg_inbuf->DialectCount = cpu_to_le16(4); 1327 /* structure is big enough for 4 dialects */ 1328 inbuflen = sizeof(*pneg_inbuf); 1329 } else { 1330 /* otherwise specific dialect was requested */ 1331 pneg_inbuf->Dialects[0] = 1332 cpu_to_le16(server->vals->protocol_id); 1333 pneg_inbuf->DialectCount = cpu_to_le16(1); 1334 /* structure is big enough for 4 dialects, sending only 1 */ 1335 inbuflen = sizeof(*pneg_inbuf) - 1336 sizeof(pneg_inbuf->Dialects[0]) * 3; 1337 } 1338 1339 rc = SMB2_ioctl(xid, tcon, NO_FILE_ID, NO_FILE_ID, 1340 FSCTL_VALIDATE_NEGOTIATE_INFO, 1341 (char *)pneg_inbuf, inbuflen, CIFSMaxBufSize, 1342 (char **)&pneg_rsp, &rsplen); 1343 if (rc == -EOPNOTSUPP) { 1344 /* 1345 * Old Windows versions or Netapp SMB server can return 1346 * not supported error. Client should accept it. 1347 */ 1348 cifs_tcon_dbg(VFS, "Server does not support validate negotiate\n"); 1349 rc = 0; 1350 goto out_free_inbuf; 1351 } else if (rc != 0) { 1352 cifs_tcon_dbg(VFS, "validate protocol negotiate failed: %d\n", 1353 rc); 1354 rc = -EIO; 1355 goto out_free_inbuf; 1356 } 1357 1358 rc = -EIO; 1359 if (rsplen != sizeof(*pneg_rsp)) { 1360 cifs_tcon_dbg(VFS, "Invalid protocol negotiate response size: %d\n", 1361 rsplen); 1362 1363 /* relax check since Mac returns max bufsize allowed on ioctl */ 1364 if (rsplen > CIFSMaxBufSize || rsplen < sizeof(*pneg_rsp)) 1365 goto out_free_rsp; 1366 } 1367 1368 /* check validate negotiate info response matches what we got earlier */ 1369 if (pneg_rsp->Dialect != cpu_to_le16(server->dialect)) 1370 goto vneg_out; 1371 1372 if (pneg_rsp->SecurityMode != cpu_to_le16(server->sec_mode)) 1373 goto vneg_out; 1374 1375 /* do not validate server guid because not saved at negprot time yet */ 1376 1377 if ((le32_to_cpu(pneg_rsp->Capabilities) | SMB2_NT_FIND | 1378 SMB2_LARGE_FILES) != server->capabilities) 1379 goto vneg_out; 1380 1381 /* validate negotiate successful */ 1382 rc = 0; 1383 cifs_dbg(FYI, "validate negotiate info successful\n"); 1384 goto out_free_rsp; 1385 1386 vneg_out: 1387 cifs_tcon_dbg(VFS, "protocol revalidation - security settings mismatch\n"); 1388 out_free_rsp: 1389 kfree(pneg_rsp); 1390 out_free_inbuf: 1391 kfree(pneg_inbuf); 1392 return rc; 1393 } 1394 1395 enum securityEnum 1396 smb2_select_sectype(struct TCP_Server_Info *server, enum securityEnum requested) 1397 { 1398 switch (requested) { 1399 case Kerberos: 1400 case RawNTLMSSP: 1401 return requested; 1402 case NTLMv2: 1403 return RawNTLMSSP; 1404 case Unspecified: 1405 if (server->sec_ntlmssp && 1406 (global_secflags & CIFSSEC_MAY_NTLMSSP)) 1407 return RawNTLMSSP; 1408 if ((server->sec_kerberos || server->sec_mskerberos) && 1409 (global_secflags & CIFSSEC_MAY_KRB5)) 1410 return Kerberos; 1411 fallthrough; 1412 default: 1413 return Unspecified; 1414 } 1415 } 1416 1417 struct SMB2_sess_data { 1418 unsigned int xid; 1419 struct cifs_ses *ses; 1420 struct TCP_Server_Info *server; 1421 struct nls_table *nls_cp; 1422 void (*func)(struct SMB2_sess_data *); 1423 int result; 1424 u64 previous_session; 1425 1426 /* we will send the SMB in three pieces: 1427 * a fixed length beginning part, an optional 1428 * SPNEGO blob (which can be zero length), and a 1429 * last part which will include the strings 1430 * and rest of bcc area. This allows us to avoid 1431 * a large buffer 17K allocation 1432 */ 1433 int buf0_type; 1434 struct kvec iov[2]; 1435 }; 1436 1437 static int 1438 SMB2_sess_alloc_buffer(struct SMB2_sess_data *sess_data) 1439 { 1440 int rc; 1441 struct cifs_ses *ses = sess_data->ses; 1442 struct TCP_Server_Info *server = sess_data->server; 1443 struct smb2_sess_setup_req *req; 1444 unsigned int total_len; 1445 bool is_binding = false; 1446 1447 rc = smb2_plain_req_init(SMB2_SESSION_SETUP, NULL, server, 1448 (void **) &req, 1449 &total_len); 1450 if (rc) 1451 return rc; 1452 1453 spin_lock(&ses->ses_lock); 1454 is_binding = (ses->ses_status == SES_GOOD); 1455 spin_unlock(&ses->ses_lock); 1456 1457 if (is_binding) { 1458 req->hdr.SessionId = cpu_to_le64(ses->Suid); 1459 req->hdr.Flags |= SMB2_FLAGS_SIGNED; 1460 req->PreviousSessionId = 0; 1461 req->Flags = SMB2_SESSION_REQ_FLAG_BINDING; 1462 cifs_dbg(FYI, "Binding to sess id: %llx\n", ses->Suid); 1463 } else { 1464 /* First session, not a reauthenticate */ 1465 req->hdr.SessionId = 0; 1466 /* 1467 * if reconnect, we need to send previous sess id 1468 * otherwise it is 0 1469 */ 1470 req->PreviousSessionId = cpu_to_le64(sess_data->previous_session); 1471 req->Flags = 0; /* MBZ */ 1472 cifs_dbg(FYI, "Fresh session. Previous: %llx\n", 1473 sess_data->previous_session); 1474 } 1475 1476 /* enough to enable echos and oplocks and one max size write */ 1477 if (server->credits >= server->max_credits) 1478 req->hdr.CreditRequest = cpu_to_le16(0); 1479 else 1480 req->hdr.CreditRequest = cpu_to_le16( 1481 min_t(int, server->max_credits - 1482 server->credits, 130)); 1483 1484 /* only one of SMB2 signing flags may be set in SMB2 request */ 1485 if (server->sign) 1486 req->SecurityMode = SMB2_NEGOTIATE_SIGNING_REQUIRED; 1487 else if (global_secflags & CIFSSEC_MAY_SIGN) /* one flag unlike MUST_ */ 1488 req->SecurityMode = SMB2_NEGOTIATE_SIGNING_ENABLED; 1489 else 1490 req->SecurityMode = 0; 1491 1492 #ifdef CONFIG_CIFS_DFS_UPCALL 1493 req->Capabilities = cpu_to_le32(SMB2_GLOBAL_CAP_DFS); 1494 #else 1495 req->Capabilities = 0; 1496 #endif /* DFS_UPCALL */ 1497 1498 req->Channel = 0; /* MBZ */ 1499 1500 sess_data->iov[0].iov_base = (char *)req; 1501 /* 1 for pad */ 1502 sess_data->iov[0].iov_len = total_len - 1; 1503 /* 1504 * This variable will be used to clear the buffer 1505 * allocated above in case of any error in the calling function. 1506 */ 1507 sess_data->buf0_type = CIFS_SMALL_BUFFER; 1508 1509 return 0; 1510 } 1511 1512 static void 1513 SMB2_sess_free_buffer(struct SMB2_sess_data *sess_data) 1514 { 1515 struct kvec *iov = sess_data->iov; 1516 1517 /* iov[1] is already freed by caller */ 1518 if (sess_data->buf0_type != CIFS_NO_BUFFER && iov[0].iov_base) 1519 memzero_explicit(iov[0].iov_base, iov[0].iov_len); 1520 1521 free_rsp_buf(sess_data->buf0_type, iov[0].iov_base); 1522 sess_data->buf0_type = CIFS_NO_BUFFER; 1523 } 1524 1525 static int 1526 SMB2_sess_sendreceive(struct SMB2_sess_data *sess_data) 1527 { 1528 int rc; 1529 struct smb_rqst rqst; 1530 struct smb2_sess_setup_req *req = sess_data->iov[0].iov_base; 1531 struct kvec rsp_iov = { NULL, 0 }; 1532 1533 /* Testing shows that buffer offset must be at location of Buffer[0] */ 1534 req->SecurityBufferOffset = 1535 cpu_to_le16(sizeof(struct smb2_sess_setup_req)); 1536 req->SecurityBufferLength = cpu_to_le16(sess_data->iov[1].iov_len); 1537 1538 memset(&rqst, 0, sizeof(struct smb_rqst)); 1539 rqst.rq_iov = sess_data->iov; 1540 rqst.rq_nvec = 2; 1541 1542 /* BB add code to build os and lm fields */ 1543 rc = cifs_send_recv(sess_data->xid, sess_data->ses, 1544 sess_data->server, 1545 &rqst, 1546 &sess_data->buf0_type, 1547 CIFS_LOG_ERROR | CIFS_SESS_OP, &rsp_iov); 1548 cifs_small_buf_release(sess_data->iov[0].iov_base); 1549 if (rc == 0) 1550 sess_data->ses->expired_pwd = false; 1551 else if ((rc == -EACCES) || (rc == -EKEYEXPIRED) || (rc == -EKEYREVOKED)) 1552 sess_data->ses->expired_pwd = true; 1553 1554 memcpy(&sess_data->iov[0], &rsp_iov, sizeof(struct kvec)); 1555 1556 return rc; 1557 } 1558 1559 static int 1560 SMB2_sess_establish_session(struct SMB2_sess_data *sess_data) 1561 { 1562 int rc = 0; 1563 struct cifs_ses *ses = sess_data->ses; 1564 struct TCP_Server_Info *server = sess_data->server; 1565 1566 cifs_server_lock(server); 1567 if (server->ops->generate_signingkey) { 1568 rc = server->ops->generate_signingkey(ses, server); 1569 if (rc) { 1570 cifs_dbg(FYI, 1571 "SMB3 session key generation failed\n"); 1572 cifs_server_unlock(server); 1573 return rc; 1574 } 1575 } 1576 if (!server->session_estab) { 1577 server->sequence_number = 0x2; 1578 server->session_estab = true; 1579 } 1580 cifs_server_unlock(server); 1581 1582 cifs_dbg(FYI, "SMB2/3 session established successfully\n"); 1583 return rc; 1584 } 1585 1586 #ifdef CONFIG_CIFS_UPCALL 1587 static void 1588 SMB2_auth_kerberos(struct SMB2_sess_data *sess_data) 1589 { 1590 int rc; 1591 struct cifs_ses *ses = sess_data->ses; 1592 struct TCP_Server_Info *server = sess_data->server; 1593 struct cifs_spnego_msg *msg; 1594 struct key *spnego_key = NULL; 1595 struct smb2_sess_setup_rsp *rsp = NULL; 1596 bool is_binding = false; 1597 1598 rc = SMB2_sess_alloc_buffer(sess_data); 1599 if (rc) 1600 goto out; 1601 1602 spnego_key = cifs_get_spnego_key(ses, server); 1603 if (IS_ERR(spnego_key)) { 1604 rc = PTR_ERR(spnego_key); 1605 if (rc == -ENOKEY) 1606 cifs_dbg(VFS, "Verify user has a krb5 ticket and keyutils is installed\n"); 1607 spnego_key = NULL; 1608 goto out; 1609 } 1610 1611 msg = spnego_key->payload.data[0]; 1612 /* 1613 * check version field to make sure that cifs.upcall is 1614 * sending us a response in an expected form 1615 */ 1616 if (msg->version != CIFS_SPNEGO_UPCALL_VERSION) { 1617 cifs_dbg(VFS, "bad cifs.upcall version. Expected %d got %d\n", 1618 CIFS_SPNEGO_UPCALL_VERSION, msg->version); 1619 rc = -EKEYREJECTED; 1620 goto out_put_spnego_key; 1621 } 1622 1623 spin_lock(&ses->ses_lock); 1624 is_binding = (ses->ses_status == SES_GOOD); 1625 spin_unlock(&ses->ses_lock); 1626 1627 /* keep session key if binding */ 1628 if (!is_binding) { 1629 kfree_sensitive(ses->auth_key.response); 1630 ses->auth_key.response = kmemdup(msg->data, msg->sesskey_len, 1631 GFP_KERNEL); 1632 if (!ses->auth_key.response) { 1633 cifs_dbg(VFS, "Kerberos can't allocate (%u bytes) memory\n", 1634 msg->sesskey_len); 1635 rc = -ENOMEM; 1636 goto out_put_spnego_key; 1637 } 1638 ses->auth_key.len = msg->sesskey_len; 1639 } 1640 1641 sess_data->iov[1].iov_base = msg->data + msg->sesskey_len; 1642 sess_data->iov[1].iov_len = msg->secblob_len; 1643 1644 rc = SMB2_sess_sendreceive(sess_data); 1645 if (rc) 1646 goto out_put_spnego_key; 1647 1648 rsp = (struct smb2_sess_setup_rsp *)sess_data->iov[0].iov_base; 1649 /* keep session id and flags if binding */ 1650 if (!is_binding) { 1651 ses->Suid = le64_to_cpu(rsp->hdr.SessionId); 1652 ses->session_flags = le16_to_cpu(rsp->SessionFlags); 1653 } 1654 1655 rc = SMB2_sess_establish_session(sess_data); 1656 out_put_spnego_key: 1657 key_invalidate(spnego_key); 1658 key_put(spnego_key); 1659 if (rc) { 1660 kfree_sensitive(ses->auth_key.response); 1661 ses->auth_key.response = NULL; 1662 ses->auth_key.len = 0; 1663 } 1664 out: 1665 sess_data->result = rc; 1666 sess_data->func = NULL; 1667 SMB2_sess_free_buffer(sess_data); 1668 } 1669 #else 1670 static void 1671 SMB2_auth_kerberos(struct SMB2_sess_data *sess_data) 1672 { 1673 cifs_dbg(VFS, "Kerberos negotiated but upcall support disabled!\n"); 1674 sess_data->result = -EOPNOTSUPP; 1675 sess_data->func = NULL; 1676 } 1677 #endif 1678 1679 static void 1680 SMB2_sess_auth_rawntlmssp_authenticate(struct SMB2_sess_data *sess_data); 1681 1682 static void 1683 SMB2_sess_auth_rawntlmssp_negotiate(struct SMB2_sess_data *sess_data) 1684 { 1685 int rc; 1686 struct cifs_ses *ses = sess_data->ses; 1687 struct TCP_Server_Info *server = sess_data->server; 1688 struct smb2_sess_setup_rsp *rsp = NULL; 1689 unsigned char *ntlmssp_blob = NULL; 1690 bool use_spnego = false; /* else use raw ntlmssp */ 1691 u16 blob_length = 0; 1692 bool is_binding = false; 1693 1694 /* 1695 * If memory allocation is successful, caller of this function 1696 * frees it. 1697 */ 1698 ses->ntlmssp = kmalloc(sizeof(struct ntlmssp_auth), GFP_KERNEL); 1699 if (!ses->ntlmssp) { 1700 rc = -ENOMEM; 1701 goto out_err; 1702 } 1703 ses->ntlmssp->sesskey_per_smbsess = true; 1704 1705 rc = SMB2_sess_alloc_buffer(sess_data); 1706 if (rc) 1707 goto out_err; 1708 1709 rc = build_ntlmssp_smb3_negotiate_blob(&ntlmssp_blob, 1710 &blob_length, ses, server, 1711 sess_data->nls_cp); 1712 if (rc) 1713 goto out; 1714 1715 if (use_spnego) { 1716 /* BB eventually need to add this */ 1717 cifs_dbg(VFS, "spnego not supported for SMB2 yet\n"); 1718 rc = -EOPNOTSUPP; 1719 goto out; 1720 } 1721 sess_data->iov[1].iov_base = ntlmssp_blob; 1722 sess_data->iov[1].iov_len = blob_length; 1723 1724 rc = SMB2_sess_sendreceive(sess_data); 1725 rsp = (struct smb2_sess_setup_rsp *)sess_data->iov[0].iov_base; 1726 1727 /* If true, rc here is expected and not an error */ 1728 if (sess_data->buf0_type != CIFS_NO_BUFFER && 1729 rsp->hdr.Status == STATUS_MORE_PROCESSING_REQUIRED) 1730 rc = 0; 1731 1732 if (rc) 1733 goto out; 1734 1735 if (offsetof(struct smb2_sess_setup_rsp, Buffer) != 1736 le16_to_cpu(rsp->SecurityBufferOffset)) { 1737 cifs_dbg(VFS, "Invalid security buffer offset %d\n", 1738 le16_to_cpu(rsp->SecurityBufferOffset)); 1739 rc = -EIO; 1740 goto out; 1741 } 1742 rc = decode_ntlmssp_challenge(rsp->Buffer, 1743 le16_to_cpu(rsp->SecurityBufferLength), ses); 1744 if (rc) 1745 goto out; 1746 1747 cifs_dbg(FYI, "rawntlmssp session setup challenge phase\n"); 1748 1749 spin_lock(&ses->ses_lock); 1750 is_binding = (ses->ses_status == SES_GOOD); 1751 spin_unlock(&ses->ses_lock); 1752 1753 /* keep existing ses id and flags if binding */ 1754 if (!is_binding) { 1755 ses->Suid = le64_to_cpu(rsp->hdr.SessionId); 1756 ses->session_flags = le16_to_cpu(rsp->SessionFlags); 1757 } 1758 1759 out: 1760 kfree_sensitive(ntlmssp_blob); 1761 SMB2_sess_free_buffer(sess_data); 1762 if (!rc) { 1763 sess_data->result = 0; 1764 sess_data->func = SMB2_sess_auth_rawntlmssp_authenticate; 1765 return; 1766 } 1767 out_err: 1768 kfree_sensitive(ses->ntlmssp); 1769 ses->ntlmssp = NULL; 1770 sess_data->result = rc; 1771 sess_data->func = NULL; 1772 } 1773 1774 static void 1775 SMB2_sess_auth_rawntlmssp_authenticate(struct SMB2_sess_data *sess_data) 1776 { 1777 int rc; 1778 struct cifs_ses *ses = sess_data->ses; 1779 struct TCP_Server_Info *server = sess_data->server; 1780 struct smb2_sess_setup_req *req; 1781 struct smb2_sess_setup_rsp *rsp = NULL; 1782 unsigned char *ntlmssp_blob = NULL; 1783 bool use_spnego = false; /* else use raw ntlmssp */ 1784 u16 blob_length = 0; 1785 bool is_binding = false; 1786 1787 rc = SMB2_sess_alloc_buffer(sess_data); 1788 if (rc) 1789 goto out; 1790 1791 req = (struct smb2_sess_setup_req *) sess_data->iov[0].iov_base; 1792 req->hdr.SessionId = cpu_to_le64(ses->Suid); 1793 1794 rc = build_ntlmssp_auth_blob(&ntlmssp_blob, &blob_length, 1795 ses, server, 1796 sess_data->nls_cp); 1797 if (rc) { 1798 cifs_dbg(FYI, "build_ntlmssp_auth_blob failed %d\n", rc); 1799 goto out; 1800 } 1801 1802 if (use_spnego) { 1803 /* BB eventually need to add this */ 1804 cifs_dbg(VFS, "spnego not supported for SMB2 yet\n"); 1805 rc = -EOPNOTSUPP; 1806 goto out; 1807 } 1808 sess_data->iov[1].iov_base = ntlmssp_blob; 1809 sess_data->iov[1].iov_len = blob_length; 1810 1811 rc = SMB2_sess_sendreceive(sess_data); 1812 if (rc) 1813 goto out; 1814 1815 rsp = (struct smb2_sess_setup_rsp *)sess_data->iov[0].iov_base; 1816 1817 spin_lock(&ses->ses_lock); 1818 is_binding = (ses->ses_status == SES_GOOD); 1819 spin_unlock(&ses->ses_lock); 1820 1821 /* keep existing ses id and flags if binding */ 1822 if (!is_binding) { 1823 ses->Suid = le64_to_cpu(rsp->hdr.SessionId); 1824 ses->session_flags = le16_to_cpu(rsp->SessionFlags); 1825 } 1826 1827 rc = SMB2_sess_establish_session(sess_data); 1828 #ifdef CONFIG_CIFS_DEBUG_DUMP_KEYS 1829 if (ses->server->dialect < SMB30_PROT_ID) { 1830 cifs_dbg(VFS, "%s: dumping generated SMB2 session keys\n", __func__); 1831 /* 1832 * The session id is opaque in terms of endianness, so we can't 1833 * print it as a long long. we dump it as we got it on the wire 1834 */ 1835 cifs_dbg(VFS, "Session Id %*ph\n", (int)sizeof(ses->Suid), 1836 &ses->Suid); 1837 cifs_dbg(VFS, "Session Key %*ph\n", 1838 SMB2_NTLMV2_SESSKEY_SIZE, ses->auth_key.response); 1839 cifs_dbg(VFS, "Signing Key %*ph\n", 1840 SMB3_SIGN_KEY_SIZE, ses->auth_key.response); 1841 } 1842 #endif 1843 out: 1844 kfree_sensitive(ntlmssp_blob); 1845 SMB2_sess_free_buffer(sess_data); 1846 kfree_sensitive(ses->ntlmssp); 1847 ses->ntlmssp = NULL; 1848 sess_data->result = rc; 1849 sess_data->func = NULL; 1850 } 1851 1852 static int 1853 SMB2_select_sec(struct SMB2_sess_data *sess_data) 1854 { 1855 int type; 1856 struct cifs_ses *ses = sess_data->ses; 1857 struct TCP_Server_Info *server = sess_data->server; 1858 1859 type = smb2_select_sectype(server, ses->sectype); 1860 cifs_dbg(FYI, "sess setup type %d\n", type); 1861 if (type == Unspecified) { 1862 cifs_dbg(VFS, "Unable to select appropriate authentication method!\n"); 1863 return -EINVAL; 1864 } 1865 1866 switch (type) { 1867 case Kerberos: 1868 sess_data->func = SMB2_auth_kerberos; 1869 break; 1870 case RawNTLMSSP: 1871 sess_data->func = SMB2_sess_auth_rawntlmssp_negotiate; 1872 break; 1873 default: 1874 cifs_dbg(VFS, "secType %d not supported!\n", type); 1875 return -EOPNOTSUPP; 1876 } 1877 1878 return 0; 1879 } 1880 1881 int 1882 SMB2_sess_setup(const unsigned int xid, struct cifs_ses *ses, 1883 struct TCP_Server_Info *server, 1884 const struct nls_table *nls_cp) 1885 { 1886 int rc = 0; 1887 struct SMB2_sess_data *sess_data; 1888 1889 cifs_dbg(FYI, "Session Setup\n"); 1890 1891 if (!server) { 1892 WARN(1, "%s: server is NULL!\n", __func__); 1893 return -EIO; 1894 } 1895 1896 sess_data = kzalloc(sizeof(struct SMB2_sess_data), GFP_KERNEL); 1897 if (!sess_data) 1898 return -ENOMEM; 1899 1900 sess_data->xid = xid; 1901 sess_data->ses = ses; 1902 sess_data->server = server; 1903 sess_data->buf0_type = CIFS_NO_BUFFER; 1904 sess_data->nls_cp = (struct nls_table *) nls_cp; 1905 sess_data->previous_session = ses->Suid; 1906 1907 rc = SMB2_select_sec(sess_data); 1908 if (rc) 1909 goto out; 1910 1911 /* 1912 * Initialize the session hash with the server one. 1913 */ 1914 memcpy(ses->preauth_sha_hash, server->preauth_sha_hash, 1915 SMB2_PREAUTH_HASH_SIZE); 1916 1917 while (sess_data->func) 1918 sess_data->func(sess_data); 1919 1920 if ((ses->session_flags & SMB2_SESSION_FLAG_IS_GUEST) && (ses->sign)) 1921 cifs_server_dbg(VFS, "signing requested but authenticated as guest\n"); 1922 rc = sess_data->result; 1923 out: 1924 kfree_sensitive(sess_data); 1925 return rc; 1926 } 1927 1928 int 1929 SMB2_logoff(const unsigned int xid, struct cifs_ses *ses) 1930 { 1931 struct smb_rqst rqst; 1932 struct smb2_logoff_req *req; /* response is also trivial struct */ 1933 int rc = 0; 1934 struct TCP_Server_Info *server; 1935 int flags = 0; 1936 unsigned int total_len; 1937 struct kvec iov[1]; 1938 struct kvec rsp_iov; 1939 int resp_buf_type; 1940 1941 cifs_dbg(FYI, "disconnect session %p\n", ses); 1942 1943 if (ses && (ses->server)) 1944 server = ses->server; 1945 else 1946 return -EIO; 1947 1948 /* no need to send SMB logoff if uid already closed due to reconnect */ 1949 spin_lock(&ses->chan_lock); 1950 if (CIFS_ALL_CHANS_NEED_RECONNECT(ses)) { 1951 spin_unlock(&ses->chan_lock); 1952 goto smb2_session_already_dead; 1953 } 1954 spin_unlock(&ses->chan_lock); 1955 1956 rc = smb2_plain_req_init(SMB2_LOGOFF, NULL, ses->server, 1957 (void **) &req, &total_len); 1958 if (rc) 1959 return rc; 1960 1961 /* since no tcon, smb2_init can not do this, so do here */ 1962 req->hdr.SessionId = cpu_to_le64(ses->Suid); 1963 1964 if (ses->session_flags & SMB2_SESSION_FLAG_ENCRYPT_DATA) 1965 flags |= CIFS_TRANSFORM_REQ; 1966 else if (server->sign) 1967 req->hdr.Flags |= SMB2_FLAGS_SIGNED; 1968 1969 flags |= CIFS_NO_RSP_BUF; 1970 1971 iov[0].iov_base = (char *)req; 1972 iov[0].iov_len = total_len; 1973 1974 memset(&rqst, 0, sizeof(struct smb_rqst)); 1975 rqst.rq_iov = iov; 1976 rqst.rq_nvec = 1; 1977 1978 rc = cifs_send_recv(xid, ses, ses->server, 1979 &rqst, &resp_buf_type, flags, &rsp_iov); 1980 cifs_small_buf_release(req); 1981 /* 1982 * No tcon so can't do 1983 * cifs_stats_inc(&tcon->stats.smb2_stats.smb2_com_fail[SMB2...]); 1984 */ 1985 1986 smb2_session_already_dead: 1987 return rc; 1988 } 1989 1990 static inline void cifs_stats_fail_inc(struct cifs_tcon *tcon, uint16_t code) 1991 { 1992 cifs_stats_inc(&tcon->stats.smb2_stats.smb2_com_failed[code]); 1993 } 1994 1995 #define MAX_SHARENAME_LENGTH (255 /* server */ + 80 /* share */ + 1 /* NULL */) 1996 1997 /* These are similar values to what Windows uses */ 1998 static inline void init_copy_chunk_defaults(struct cifs_tcon *tcon) 1999 { 2000 tcon->max_chunks = 256; 2001 tcon->max_bytes_chunk = 1048576; 2002 tcon->max_bytes_copy = 16777216; 2003 } 2004 2005 int 2006 SMB2_tcon(const unsigned int xid, struct cifs_ses *ses, const char *tree, 2007 struct cifs_tcon *tcon, const struct nls_table *cp) 2008 { 2009 struct smb_rqst rqst; 2010 struct smb2_tree_connect_req *req; 2011 struct smb2_tree_connect_rsp *rsp = NULL; 2012 struct kvec iov[2]; 2013 struct kvec rsp_iov = { NULL, 0 }; 2014 int rc = 0; 2015 int resp_buftype; 2016 int unc_path_len; 2017 __le16 *unc_path = NULL; 2018 int flags = 0; 2019 unsigned int total_len; 2020 struct TCP_Server_Info *server = cifs_pick_channel(ses); 2021 2022 cifs_dbg(FYI, "TCON\n"); 2023 2024 if (!server || !tree) 2025 return -EIO; 2026 2027 unc_path = kmalloc(MAX_SHARENAME_LENGTH * 2, GFP_KERNEL); 2028 if (unc_path == NULL) 2029 return -ENOMEM; 2030 2031 unc_path_len = cifs_strtoUTF16(unc_path, tree, strlen(tree), cp); 2032 if (unc_path_len <= 0) { 2033 kfree(unc_path); 2034 return -EINVAL; 2035 } 2036 unc_path_len *= 2; 2037 2038 /* SMB2 TREE_CONNECT request must be called with TreeId == 0 */ 2039 tcon->tid = 0; 2040 atomic_set(&tcon->num_remote_opens, 0); 2041 rc = smb2_plain_req_init(SMB2_TREE_CONNECT, tcon, server, 2042 (void **) &req, &total_len); 2043 if (rc) { 2044 kfree(unc_path); 2045 return rc; 2046 } 2047 2048 if (smb3_encryption_required(tcon)) 2049 flags |= CIFS_TRANSFORM_REQ; 2050 2051 iov[0].iov_base = (char *)req; 2052 /* 1 for pad */ 2053 iov[0].iov_len = total_len - 1; 2054 2055 /* Testing shows that buffer offset must be at location of Buffer[0] */ 2056 req->PathOffset = cpu_to_le16(sizeof(struct smb2_tree_connect_req)); 2057 req->PathLength = cpu_to_le16(unc_path_len); 2058 iov[1].iov_base = unc_path; 2059 iov[1].iov_len = unc_path_len; 2060 2061 /* 2062 * 3.11 tcon req must be signed if not encrypted. See MS-SMB2 3.2.4.1.1 2063 * unless it is guest or anonymous user. See MS-SMB2 3.2.5.3.1 2064 * (Samba servers don't always set the flag so also check if null user) 2065 */ 2066 if ((server->dialect == SMB311_PROT_ID) && 2067 !smb3_encryption_required(tcon) && 2068 !(ses->session_flags & 2069 (SMB2_SESSION_FLAG_IS_GUEST|SMB2_SESSION_FLAG_IS_NULL)) && 2070 ((ses->user_name != NULL) || (ses->sectype == Kerberos))) 2071 req->hdr.Flags |= SMB2_FLAGS_SIGNED; 2072 2073 memset(&rqst, 0, sizeof(struct smb_rqst)); 2074 rqst.rq_iov = iov; 2075 rqst.rq_nvec = 2; 2076 2077 /* Need 64 for max size write so ask for more in case not there yet */ 2078 if (server->credits >= server->max_credits) 2079 req->hdr.CreditRequest = cpu_to_le16(0); 2080 else 2081 req->hdr.CreditRequest = cpu_to_le16( 2082 min_t(int, server->max_credits - 2083 server->credits, 64)); 2084 2085 rc = cifs_send_recv(xid, ses, server, 2086 &rqst, &resp_buftype, flags, &rsp_iov); 2087 cifs_small_buf_release(req); 2088 rsp = (struct smb2_tree_connect_rsp *)rsp_iov.iov_base; 2089 trace_smb3_tcon(xid, tcon->tid, ses->Suid, tree, rc); 2090 if ((rc != 0) || (rsp == NULL)) { 2091 cifs_stats_fail_inc(tcon, SMB2_TREE_CONNECT_HE); 2092 tcon->need_reconnect = true; 2093 goto tcon_error_exit; 2094 } 2095 2096 switch (rsp->ShareType) { 2097 case SMB2_SHARE_TYPE_DISK: 2098 cifs_dbg(FYI, "connection to disk share\n"); 2099 break; 2100 case SMB2_SHARE_TYPE_PIPE: 2101 tcon->pipe = true; 2102 cifs_dbg(FYI, "connection to pipe share\n"); 2103 break; 2104 case SMB2_SHARE_TYPE_PRINT: 2105 tcon->print = true; 2106 cifs_dbg(FYI, "connection to printer\n"); 2107 break; 2108 default: 2109 cifs_server_dbg(VFS, "unknown share type %d\n", rsp->ShareType); 2110 rc = -EOPNOTSUPP; 2111 goto tcon_error_exit; 2112 } 2113 2114 tcon->share_flags = le32_to_cpu(rsp->ShareFlags); 2115 tcon->capabilities = rsp->Capabilities; /* we keep caps little endian */ 2116 tcon->maximal_access = le32_to_cpu(rsp->MaximalAccess); 2117 tcon->tid = le32_to_cpu(rsp->hdr.Id.SyncId.TreeId); 2118 strscpy(tcon->tree_name, tree, sizeof(tcon->tree_name)); 2119 2120 if ((rsp->Capabilities & SMB2_SHARE_CAP_DFS) && 2121 ((tcon->share_flags & SHI1005_FLAGS_DFS) == 0)) 2122 cifs_tcon_dbg(VFS, "DFS capability contradicts DFS flag\n"); 2123 2124 if (tcon->seal && 2125 !(server->capabilities & SMB2_GLOBAL_CAP_ENCRYPTION)) 2126 cifs_tcon_dbg(VFS, "Encryption is requested but not supported\n"); 2127 2128 init_copy_chunk_defaults(tcon); 2129 if (server->ops->validate_negotiate) 2130 rc = server->ops->validate_negotiate(xid, tcon); 2131 if (rc == 0) /* See MS-SMB2 2.2.10 and 3.2.5.5 */ 2132 if (tcon->share_flags & SMB2_SHAREFLAG_ISOLATED_TRANSPORT) 2133 server->nosharesock = true; 2134 tcon_exit: 2135 2136 free_rsp_buf(resp_buftype, rsp); 2137 kfree(unc_path); 2138 return rc; 2139 2140 tcon_error_exit: 2141 if (rsp && rsp->hdr.Status == STATUS_BAD_NETWORK_NAME) 2142 cifs_tcon_dbg(VFS, "BAD_NETWORK_NAME: %s\n", tree); 2143 goto tcon_exit; 2144 } 2145 2146 int 2147 SMB2_tdis(const unsigned int xid, struct cifs_tcon *tcon) 2148 { 2149 struct smb_rqst rqst; 2150 struct smb2_tree_disconnect_req *req; /* response is trivial */ 2151 int rc = 0; 2152 struct cifs_ses *ses = tcon->ses; 2153 struct TCP_Server_Info *server = cifs_pick_channel(ses); 2154 int flags = 0; 2155 unsigned int total_len; 2156 struct kvec iov[1]; 2157 struct kvec rsp_iov; 2158 int resp_buf_type; 2159 2160 cifs_dbg(FYI, "Tree Disconnect\n"); 2161 2162 if (!ses || !(ses->server)) 2163 return -EIO; 2164 2165 trace_smb3_tdis_enter(xid, tcon->tid, ses->Suid, tcon->tree_name); 2166 spin_lock(&ses->chan_lock); 2167 if ((tcon->need_reconnect) || 2168 (CIFS_ALL_CHANS_NEED_RECONNECT(tcon->ses))) { 2169 spin_unlock(&ses->chan_lock); 2170 return 0; 2171 } 2172 spin_unlock(&ses->chan_lock); 2173 2174 invalidate_all_cached_dirs(tcon); 2175 2176 rc = smb2_plain_req_init(SMB2_TREE_DISCONNECT, tcon, server, 2177 (void **) &req, 2178 &total_len); 2179 if (rc) 2180 return rc; 2181 2182 if (smb3_encryption_required(tcon)) 2183 flags |= CIFS_TRANSFORM_REQ; 2184 2185 flags |= CIFS_NO_RSP_BUF; 2186 2187 iov[0].iov_base = (char *)req; 2188 iov[0].iov_len = total_len; 2189 2190 memset(&rqst, 0, sizeof(struct smb_rqst)); 2191 rqst.rq_iov = iov; 2192 rqst.rq_nvec = 1; 2193 2194 rc = cifs_send_recv(xid, ses, server, 2195 &rqst, &resp_buf_type, flags, &rsp_iov); 2196 cifs_small_buf_release(req); 2197 if (rc) { 2198 cifs_stats_fail_inc(tcon, SMB2_TREE_DISCONNECT_HE); 2199 trace_smb3_tdis_err(xid, tcon->tid, ses->Suid, rc); 2200 } 2201 trace_smb3_tdis_done(xid, tcon->tid, ses->Suid); 2202 2203 return rc; 2204 } 2205 2206 2207 static struct create_durable * 2208 create_durable_buf(void) 2209 { 2210 struct create_durable *buf; 2211 2212 buf = kzalloc(sizeof(struct create_durable), GFP_KERNEL); 2213 if (!buf) 2214 return NULL; 2215 2216 buf->ccontext.DataOffset = cpu_to_le16(offsetof 2217 (struct create_durable, Data)); 2218 buf->ccontext.DataLength = cpu_to_le32(16); 2219 buf->ccontext.NameOffset = cpu_to_le16(offsetof 2220 (struct create_durable, Name)); 2221 buf->ccontext.NameLength = cpu_to_le16(4); 2222 /* SMB2_CREATE_DURABLE_HANDLE_REQUEST is "DHnQ" */ 2223 buf->Name[0] = 'D'; 2224 buf->Name[1] = 'H'; 2225 buf->Name[2] = 'n'; 2226 buf->Name[3] = 'Q'; 2227 return buf; 2228 } 2229 2230 static struct create_durable * 2231 create_reconnect_durable_buf(struct cifs_fid *fid) 2232 { 2233 struct create_durable *buf; 2234 2235 buf = kzalloc(sizeof(struct create_durable), GFP_KERNEL); 2236 if (!buf) 2237 return NULL; 2238 2239 buf->ccontext.DataOffset = cpu_to_le16(offsetof 2240 (struct create_durable, Data)); 2241 buf->ccontext.DataLength = cpu_to_le32(16); 2242 buf->ccontext.NameOffset = cpu_to_le16(offsetof 2243 (struct create_durable, Name)); 2244 buf->ccontext.NameLength = cpu_to_le16(4); 2245 buf->Data.Fid.PersistentFileId = fid->persistent_fid; 2246 buf->Data.Fid.VolatileFileId = fid->volatile_fid; 2247 /* SMB2_CREATE_DURABLE_HANDLE_RECONNECT is "DHnC" */ 2248 buf->Name[0] = 'D'; 2249 buf->Name[1] = 'H'; 2250 buf->Name[2] = 'n'; 2251 buf->Name[3] = 'C'; 2252 return buf; 2253 } 2254 2255 static void 2256 parse_query_id_ctxt(struct create_context *cc, struct smb2_file_all_info *buf) 2257 { 2258 struct create_disk_id_rsp *pdisk_id = (struct create_disk_id_rsp *)cc; 2259 2260 cifs_dbg(FYI, "parse query id context 0x%llx 0x%llx\n", 2261 pdisk_id->DiskFileId, pdisk_id->VolumeId); 2262 buf->IndexNumber = pdisk_id->DiskFileId; 2263 } 2264 2265 static void 2266 parse_posix_ctxt(struct create_context *cc, struct smb2_file_all_info *info, 2267 struct create_posix_rsp *posix) 2268 { 2269 int sid_len; 2270 u8 *beg = (u8 *)cc + le16_to_cpu(cc->DataOffset); 2271 u8 *end = beg + le32_to_cpu(cc->DataLength); 2272 u8 *sid; 2273 2274 memset(posix, 0, sizeof(*posix)); 2275 2276 posix->nlink = le32_to_cpu(*(__le32 *)(beg + 0)); 2277 posix->reparse_tag = le32_to_cpu(*(__le32 *)(beg + 4)); 2278 posix->mode = le32_to_cpu(*(__le32 *)(beg + 8)); 2279 2280 sid = beg + 12; 2281 sid_len = posix_info_sid_size(sid, end); 2282 if (sid_len < 0) { 2283 cifs_dbg(VFS, "bad owner sid in posix create response\n"); 2284 return; 2285 } 2286 memcpy(&posix->owner, sid, sid_len); 2287 2288 sid = sid + sid_len; 2289 sid_len = posix_info_sid_size(sid, end); 2290 if (sid_len < 0) { 2291 cifs_dbg(VFS, "bad group sid in posix create response\n"); 2292 return; 2293 } 2294 memcpy(&posix->group, sid, sid_len); 2295 2296 cifs_dbg(FYI, "nlink=%d mode=%o reparse_tag=%x\n", 2297 posix->nlink, posix->mode, posix->reparse_tag); 2298 } 2299 2300 int smb2_parse_contexts(struct TCP_Server_Info *server, 2301 struct kvec *rsp_iov, 2302 unsigned int *epoch, 2303 char *lease_key, __u8 *oplock, 2304 struct smb2_file_all_info *buf, 2305 struct create_posix_rsp *posix) 2306 { 2307 struct smb2_create_rsp *rsp = rsp_iov->iov_base; 2308 struct create_context *cc; 2309 size_t rem, off, len; 2310 size_t doff, dlen; 2311 size_t noff, nlen; 2312 char *name; 2313 static const char smb3_create_tag_posix[] = { 2314 0x93, 0xAD, 0x25, 0x50, 0x9C, 2315 0xB4, 0x11, 0xE7, 0xB4, 0x23, 0x83, 2316 0xDE, 0x96, 0x8B, 0xCD, 0x7C 2317 }; 2318 2319 *oplock = 0; 2320 2321 off = le32_to_cpu(rsp->CreateContextsOffset); 2322 rem = le32_to_cpu(rsp->CreateContextsLength); 2323 if (check_add_overflow(off, rem, &len) || len > rsp_iov->iov_len) 2324 return -EINVAL; 2325 cc = (struct create_context *)((u8 *)rsp + off); 2326 2327 /* Initialize inode number to 0 in case no valid data in qfid context */ 2328 if (buf) 2329 buf->IndexNumber = 0; 2330 2331 while (rem >= sizeof(*cc)) { 2332 doff = le16_to_cpu(cc->DataOffset); 2333 dlen = le32_to_cpu(cc->DataLength); 2334 if (check_add_overflow(doff, dlen, &len) || len > rem) 2335 return -EINVAL; 2336 2337 noff = le16_to_cpu(cc->NameOffset); 2338 nlen = le16_to_cpu(cc->NameLength); 2339 if (noff + nlen > doff) 2340 return -EINVAL; 2341 2342 name = (char *)cc + noff; 2343 switch (nlen) { 2344 case 4: 2345 if (!strncmp(name, SMB2_CREATE_REQUEST_LEASE, 4)) { 2346 *oplock = server->ops->parse_lease_buf(cc, epoch, 2347 lease_key); 2348 } else if (buf && 2349 !strncmp(name, SMB2_CREATE_QUERY_ON_DISK_ID, 4)) { 2350 parse_query_id_ctxt(cc, buf); 2351 } 2352 break; 2353 case 16: 2354 if (posix && !memcmp(name, smb3_create_tag_posix, 16)) 2355 parse_posix_ctxt(cc, buf, posix); 2356 break; 2357 default: 2358 cifs_dbg(FYI, "%s: unhandled context (nlen=%zu dlen=%zu)\n", 2359 __func__, nlen, dlen); 2360 if (IS_ENABLED(CONFIG_CIFS_DEBUG2)) 2361 cifs_dump_mem("context data: ", cc, dlen); 2362 break; 2363 } 2364 2365 off = le32_to_cpu(cc->Next); 2366 if (!off) 2367 break; 2368 if (check_sub_overflow(rem, off, &rem)) 2369 return -EINVAL; 2370 cc = (struct create_context *)((u8 *)cc + off); 2371 } 2372 2373 if (rsp->OplockLevel != SMB2_OPLOCK_LEVEL_LEASE) 2374 *oplock = rsp->OplockLevel; 2375 2376 return 0; 2377 } 2378 2379 static int 2380 add_lease_context(struct TCP_Server_Info *server, 2381 struct smb2_create_req *req, 2382 struct kvec *iov, 2383 unsigned int *num_iovec, u8 *lease_key, __u8 *oplock) 2384 { 2385 unsigned int num = *num_iovec; 2386 2387 iov[num].iov_base = server->ops->create_lease_buf(lease_key, *oplock); 2388 if (iov[num].iov_base == NULL) 2389 return -ENOMEM; 2390 iov[num].iov_len = server->vals->create_lease_size; 2391 req->RequestedOplockLevel = SMB2_OPLOCK_LEVEL_LEASE; 2392 *num_iovec = num + 1; 2393 return 0; 2394 } 2395 2396 static struct create_durable_v2 * 2397 create_durable_v2_buf(struct cifs_open_parms *oparms) 2398 { 2399 struct cifs_fid *pfid = oparms->fid; 2400 struct create_durable_v2 *buf; 2401 2402 buf = kzalloc(sizeof(struct create_durable_v2), GFP_KERNEL); 2403 if (!buf) 2404 return NULL; 2405 2406 buf->ccontext.DataOffset = cpu_to_le16(offsetof 2407 (struct create_durable_v2, dcontext)); 2408 buf->ccontext.DataLength = cpu_to_le32(sizeof(struct durable_context_v2)); 2409 buf->ccontext.NameOffset = cpu_to_le16(offsetof 2410 (struct create_durable_v2, Name)); 2411 buf->ccontext.NameLength = cpu_to_le16(4); 2412 2413 /* 2414 * NB: Handle timeout defaults to 0, which allows server to choose 2415 * (most servers default to 120 seconds) and most clients default to 0. 2416 * This can be overridden at mount ("handletimeout=") if the user wants 2417 * a different persistent (or resilient) handle timeout for all opens 2418 * on a particular SMB3 mount. 2419 */ 2420 buf->dcontext.Timeout = cpu_to_le32(oparms->tcon->handle_timeout); 2421 buf->dcontext.Flags = cpu_to_le32(SMB2_DHANDLE_FLAG_PERSISTENT); 2422 2423 /* for replay, we should not overwrite the existing create guid */ 2424 if (!oparms->replay) { 2425 generate_random_uuid(buf->dcontext.CreateGuid); 2426 memcpy(pfid->create_guid, buf->dcontext.CreateGuid, 16); 2427 } else 2428 memcpy(buf->dcontext.CreateGuid, pfid->create_guid, 16); 2429 2430 /* SMB2_CREATE_DURABLE_HANDLE_REQUEST is "DH2Q" */ 2431 buf->Name[0] = 'D'; 2432 buf->Name[1] = 'H'; 2433 buf->Name[2] = '2'; 2434 buf->Name[3] = 'Q'; 2435 return buf; 2436 } 2437 2438 static struct create_durable_handle_reconnect_v2 * 2439 create_reconnect_durable_v2_buf(struct cifs_fid *fid) 2440 { 2441 struct create_durable_handle_reconnect_v2 *buf; 2442 2443 buf = kzalloc(sizeof(struct create_durable_handle_reconnect_v2), 2444 GFP_KERNEL); 2445 if (!buf) 2446 return NULL; 2447 2448 buf->ccontext.DataOffset = 2449 cpu_to_le16(offsetof(struct create_durable_handle_reconnect_v2, 2450 dcontext)); 2451 buf->ccontext.DataLength = 2452 cpu_to_le32(sizeof(struct durable_reconnect_context_v2)); 2453 buf->ccontext.NameOffset = 2454 cpu_to_le16(offsetof(struct create_durable_handle_reconnect_v2, 2455 Name)); 2456 buf->ccontext.NameLength = cpu_to_le16(4); 2457 2458 buf->dcontext.Fid.PersistentFileId = fid->persistent_fid; 2459 buf->dcontext.Fid.VolatileFileId = fid->volatile_fid; 2460 buf->dcontext.Flags = cpu_to_le32(SMB2_DHANDLE_FLAG_PERSISTENT); 2461 memcpy(buf->dcontext.CreateGuid, fid->create_guid, 16); 2462 2463 /* SMB2_CREATE_DURABLE_HANDLE_RECONNECT_V2 is "DH2C" */ 2464 buf->Name[0] = 'D'; 2465 buf->Name[1] = 'H'; 2466 buf->Name[2] = '2'; 2467 buf->Name[3] = 'C'; 2468 return buf; 2469 } 2470 2471 static int 2472 add_durable_v2_context(struct kvec *iov, unsigned int *num_iovec, 2473 struct cifs_open_parms *oparms) 2474 { 2475 unsigned int num = *num_iovec; 2476 2477 iov[num].iov_base = create_durable_v2_buf(oparms); 2478 if (iov[num].iov_base == NULL) 2479 return -ENOMEM; 2480 iov[num].iov_len = sizeof(struct create_durable_v2); 2481 *num_iovec = num + 1; 2482 return 0; 2483 } 2484 2485 static int 2486 add_durable_reconnect_v2_context(struct kvec *iov, unsigned int *num_iovec, 2487 struct cifs_open_parms *oparms) 2488 { 2489 unsigned int num = *num_iovec; 2490 2491 /* indicate that we don't need to relock the file */ 2492 oparms->reconnect = false; 2493 2494 iov[num].iov_base = create_reconnect_durable_v2_buf(oparms->fid); 2495 if (iov[num].iov_base == NULL) 2496 return -ENOMEM; 2497 iov[num].iov_len = sizeof(struct create_durable_handle_reconnect_v2); 2498 *num_iovec = num + 1; 2499 return 0; 2500 } 2501 2502 static int 2503 add_durable_context(struct kvec *iov, unsigned int *num_iovec, 2504 struct cifs_open_parms *oparms, bool use_persistent) 2505 { 2506 unsigned int num = *num_iovec; 2507 2508 if (use_persistent) { 2509 if (oparms->reconnect) 2510 return add_durable_reconnect_v2_context(iov, num_iovec, 2511 oparms); 2512 else 2513 return add_durable_v2_context(iov, num_iovec, oparms); 2514 } 2515 2516 if (oparms->reconnect) { 2517 iov[num].iov_base = create_reconnect_durable_buf(oparms->fid); 2518 /* indicate that we don't need to relock the file */ 2519 oparms->reconnect = false; 2520 } else 2521 iov[num].iov_base = create_durable_buf(); 2522 if (iov[num].iov_base == NULL) 2523 return -ENOMEM; 2524 iov[num].iov_len = sizeof(struct create_durable); 2525 *num_iovec = num + 1; 2526 return 0; 2527 } 2528 2529 /* See MS-SMB2 2.2.13.2.7 */ 2530 static struct crt_twarp_ctxt * 2531 create_twarp_buf(__u64 timewarp) 2532 { 2533 struct crt_twarp_ctxt *buf; 2534 2535 buf = kzalloc(sizeof(struct crt_twarp_ctxt), GFP_KERNEL); 2536 if (!buf) 2537 return NULL; 2538 2539 buf->ccontext.DataOffset = cpu_to_le16(offsetof 2540 (struct crt_twarp_ctxt, Timestamp)); 2541 buf->ccontext.DataLength = cpu_to_le32(8); 2542 buf->ccontext.NameOffset = cpu_to_le16(offsetof 2543 (struct crt_twarp_ctxt, Name)); 2544 buf->ccontext.NameLength = cpu_to_le16(4); 2545 /* SMB2_CREATE_TIMEWARP_TOKEN is "TWrp" */ 2546 buf->Name[0] = 'T'; 2547 buf->Name[1] = 'W'; 2548 buf->Name[2] = 'r'; 2549 buf->Name[3] = 'p'; 2550 buf->Timestamp = cpu_to_le64(timewarp); 2551 return buf; 2552 } 2553 2554 /* See MS-SMB2 2.2.13.2.7 */ 2555 static int 2556 add_twarp_context(struct kvec *iov, unsigned int *num_iovec, __u64 timewarp) 2557 { 2558 unsigned int num = *num_iovec; 2559 2560 iov[num].iov_base = create_twarp_buf(timewarp); 2561 if (iov[num].iov_base == NULL) 2562 return -ENOMEM; 2563 iov[num].iov_len = sizeof(struct crt_twarp_ctxt); 2564 *num_iovec = num + 1; 2565 return 0; 2566 } 2567 2568 /* See http://technet.microsoft.com/en-us/library/hh509017(v=ws.10).aspx */ 2569 static void setup_owner_group_sids(char *buf) 2570 { 2571 struct owner_group_sids *sids = (struct owner_group_sids *)buf; 2572 2573 /* Populate the user ownership fields S-1-5-88-1 */ 2574 sids->owner.Revision = 1; 2575 sids->owner.NumAuth = 3; 2576 sids->owner.Authority[5] = 5; 2577 sids->owner.SubAuthorities[0] = cpu_to_le32(88); 2578 sids->owner.SubAuthorities[1] = cpu_to_le32(1); 2579 sids->owner.SubAuthorities[2] = cpu_to_le32(current_fsuid().val); 2580 2581 /* Populate the group ownership fields S-1-5-88-2 */ 2582 sids->group.Revision = 1; 2583 sids->group.NumAuth = 3; 2584 sids->group.Authority[5] = 5; 2585 sids->group.SubAuthorities[0] = cpu_to_le32(88); 2586 sids->group.SubAuthorities[1] = cpu_to_le32(2); 2587 sids->group.SubAuthorities[2] = cpu_to_le32(current_fsgid().val); 2588 2589 cifs_dbg(FYI, "owner S-1-5-88-1-%d, group S-1-5-88-2-%d\n", current_fsuid().val, current_fsgid().val); 2590 } 2591 2592 /* See MS-SMB2 2.2.13.2.2 and MS-DTYP 2.4.6 */ 2593 static struct crt_sd_ctxt * 2594 create_sd_buf(umode_t mode, bool set_owner, unsigned int *len) 2595 { 2596 struct crt_sd_ctxt *buf; 2597 __u8 *ptr, *aclptr; 2598 unsigned int acelen, acl_size, ace_count; 2599 unsigned int owner_offset = 0; 2600 unsigned int group_offset = 0; 2601 struct smb3_acl acl = {}; 2602 2603 *len = round_up(sizeof(struct crt_sd_ctxt) + (sizeof(struct cifs_ace) * 4), 8); 2604 2605 if (set_owner) { 2606 /* sizeof(struct owner_group_sids) is already multiple of 8 so no need to round */ 2607 *len += sizeof(struct owner_group_sids); 2608 } 2609 2610 buf = kzalloc(*len, GFP_KERNEL); 2611 if (buf == NULL) 2612 return buf; 2613 2614 ptr = (__u8 *)&buf[1]; 2615 if (set_owner) { 2616 /* offset fields are from beginning of security descriptor not of create context */ 2617 owner_offset = ptr - (__u8 *)&buf->sd; 2618 buf->sd.OffsetOwner = cpu_to_le32(owner_offset); 2619 group_offset = owner_offset + offsetof(struct owner_group_sids, group); 2620 buf->sd.OffsetGroup = cpu_to_le32(group_offset); 2621 2622 setup_owner_group_sids(ptr); 2623 ptr += sizeof(struct owner_group_sids); 2624 } else { 2625 buf->sd.OffsetOwner = 0; 2626 buf->sd.OffsetGroup = 0; 2627 } 2628 2629 buf->ccontext.DataOffset = cpu_to_le16(offsetof(struct crt_sd_ctxt, sd)); 2630 buf->ccontext.NameOffset = cpu_to_le16(offsetof(struct crt_sd_ctxt, Name)); 2631 buf->ccontext.NameLength = cpu_to_le16(4); 2632 /* SMB2_CREATE_SD_BUFFER_TOKEN is "SecD" */ 2633 buf->Name[0] = 'S'; 2634 buf->Name[1] = 'e'; 2635 buf->Name[2] = 'c'; 2636 buf->Name[3] = 'D'; 2637 buf->sd.Revision = 1; /* Must be one see MS-DTYP 2.4.6 */ 2638 2639 /* 2640 * ACL is "self relative" ie ACL is stored in contiguous block of memory 2641 * and "DP" ie the DACL is present 2642 */ 2643 buf->sd.Control = cpu_to_le16(ACL_CONTROL_SR | ACL_CONTROL_DP); 2644 2645 /* offset owner, group and Sbz1 and SACL are all zero */ 2646 buf->sd.OffsetDacl = cpu_to_le32(ptr - (__u8 *)&buf->sd); 2647 /* Ship the ACL for now. we will copy it into buf later. */ 2648 aclptr = ptr; 2649 ptr += sizeof(struct smb3_acl); 2650 2651 /* create one ACE to hold the mode embedded in reserved special SID */ 2652 acelen = setup_special_mode_ACE((struct cifs_ace *)ptr, (__u64)mode); 2653 ptr += acelen; 2654 acl_size = acelen + sizeof(struct smb3_acl); 2655 ace_count = 1; 2656 2657 if (set_owner) { 2658 /* we do not need to reallocate buffer to add the two more ACEs. plenty of space */ 2659 acelen = setup_special_user_owner_ACE((struct cifs_ace *)ptr); 2660 ptr += acelen; 2661 acl_size += acelen; 2662 ace_count += 1; 2663 } 2664 2665 /* and one more ACE to allow access for authenticated users */ 2666 acelen = setup_authusers_ACE((struct cifs_ace *)ptr); 2667 ptr += acelen; 2668 acl_size += acelen; 2669 ace_count += 1; 2670 2671 acl.AclRevision = ACL_REVISION; /* See 2.4.4.1 of MS-DTYP */ 2672 acl.AclSize = cpu_to_le16(acl_size); 2673 acl.AceCount = cpu_to_le16(ace_count); 2674 /* acl.Sbz1 and Sbz2 MBZ so are not set here, but initialized above */ 2675 memcpy(aclptr, &acl, sizeof(struct smb3_acl)); 2676 2677 buf->ccontext.DataLength = cpu_to_le32(ptr - (__u8 *)&buf->sd); 2678 *len = round_up((unsigned int)(ptr - (__u8 *)buf), 8); 2679 2680 return buf; 2681 } 2682 2683 static int 2684 add_sd_context(struct kvec *iov, unsigned int *num_iovec, umode_t mode, bool set_owner) 2685 { 2686 unsigned int num = *num_iovec; 2687 unsigned int len = 0; 2688 2689 iov[num].iov_base = create_sd_buf(mode, set_owner, &len); 2690 if (iov[num].iov_base == NULL) 2691 return -ENOMEM; 2692 iov[num].iov_len = len; 2693 *num_iovec = num + 1; 2694 return 0; 2695 } 2696 2697 static struct crt_query_id_ctxt * 2698 create_query_id_buf(void) 2699 { 2700 struct crt_query_id_ctxt *buf; 2701 2702 buf = kzalloc(sizeof(struct crt_query_id_ctxt), GFP_KERNEL); 2703 if (!buf) 2704 return NULL; 2705 2706 buf->ccontext.DataOffset = cpu_to_le16(0); 2707 buf->ccontext.DataLength = cpu_to_le32(0); 2708 buf->ccontext.NameOffset = cpu_to_le16(offsetof 2709 (struct crt_query_id_ctxt, Name)); 2710 buf->ccontext.NameLength = cpu_to_le16(4); 2711 /* SMB2_CREATE_QUERY_ON_DISK_ID is "QFid" */ 2712 buf->Name[0] = 'Q'; 2713 buf->Name[1] = 'F'; 2714 buf->Name[2] = 'i'; 2715 buf->Name[3] = 'd'; 2716 return buf; 2717 } 2718 2719 /* See MS-SMB2 2.2.13.2.9 */ 2720 static int 2721 add_query_id_context(struct kvec *iov, unsigned int *num_iovec) 2722 { 2723 unsigned int num = *num_iovec; 2724 2725 iov[num].iov_base = create_query_id_buf(); 2726 if (iov[num].iov_base == NULL) 2727 return -ENOMEM; 2728 iov[num].iov_len = sizeof(struct crt_query_id_ctxt); 2729 *num_iovec = num + 1; 2730 return 0; 2731 } 2732 2733 static void add_ea_context(struct cifs_open_parms *oparms, 2734 struct kvec *rq_iov, unsigned int *num_iovs) 2735 { 2736 struct kvec *iov = oparms->ea_cctx; 2737 2738 if (iov && iov->iov_base && iov->iov_len) { 2739 rq_iov[(*num_iovs)++] = *iov; 2740 memset(iov, 0, sizeof(*iov)); 2741 } 2742 } 2743 2744 static int 2745 alloc_path_with_tree_prefix(__le16 **out_path, int *out_size, int *out_len, 2746 const char *treename, const __le16 *path) 2747 { 2748 int treename_len, path_len; 2749 struct nls_table *cp; 2750 const __le16 sep[] = {cpu_to_le16('\\'), cpu_to_le16(0x0000)}; 2751 2752 /* 2753 * skip leading "\\" 2754 */ 2755 treename_len = strlen(treename); 2756 if (treename_len < 2 || !(treename[0] == '\\' && treename[1] == '\\')) 2757 return -EINVAL; 2758 2759 treename += 2; 2760 treename_len -= 2; 2761 2762 path_len = UniStrnlen((wchar_t *)path, PATH_MAX); 2763 2764 /* make room for one path separator only if @path isn't empty */ 2765 *out_len = treename_len + (path[0] ? 1 : 0) + path_len; 2766 2767 /* 2768 * final path needs to be 8-byte aligned as specified in 2769 * MS-SMB2 2.2.13 SMB2 CREATE Request. 2770 */ 2771 *out_size = round_up(*out_len * sizeof(__le16), 8); 2772 *out_path = kzalloc(*out_size + sizeof(__le16) /* null */, GFP_KERNEL); 2773 if (!*out_path) 2774 return -ENOMEM; 2775 2776 cp = load_nls_default(); 2777 cifs_strtoUTF16(*out_path, treename, treename_len, cp); 2778 2779 /* Do not append the separator if the path is empty */ 2780 if (path[0] != cpu_to_le16(0x0000)) { 2781 UniStrcat((wchar_t *)*out_path, (wchar_t *)sep); 2782 UniStrcat((wchar_t *)*out_path, (wchar_t *)path); 2783 } 2784 2785 unload_nls(cp); 2786 2787 return 0; 2788 } 2789 2790 int smb311_posix_mkdir(const unsigned int xid, struct inode *inode, 2791 umode_t mode, struct cifs_tcon *tcon, 2792 const char *full_path, 2793 struct cifs_sb_info *cifs_sb) 2794 { 2795 struct smb_rqst rqst; 2796 struct smb2_create_req *req; 2797 struct smb2_create_rsp *rsp = NULL; 2798 struct cifs_ses *ses = tcon->ses; 2799 struct kvec iov[3]; /* make sure at least one for each open context */ 2800 struct kvec rsp_iov = {NULL, 0}; 2801 int resp_buftype; 2802 int uni_path_len; 2803 __le16 *copy_path = NULL; 2804 int copy_size; 2805 int rc = 0; 2806 unsigned int n_iov = 2; 2807 __u32 file_attributes = 0; 2808 char *pc_buf = NULL; 2809 int flags = 0; 2810 unsigned int total_len; 2811 __le16 *utf16_path = NULL; 2812 struct TCP_Server_Info *server; 2813 int retries = 0, cur_sleep = 1; 2814 2815 replay_again: 2816 /* reinitialize for possible replay */ 2817 flags = 0; 2818 n_iov = 2; 2819 server = cifs_pick_channel(ses); 2820 2821 cifs_dbg(FYI, "mkdir\n"); 2822 2823 /* resource #1: path allocation */ 2824 utf16_path = cifs_convert_path_to_utf16(full_path, cifs_sb); 2825 if (!utf16_path) 2826 return -ENOMEM; 2827 2828 if (!ses || !server) { 2829 rc = -EIO; 2830 goto err_free_path; 2831 } 2832 2833 /* resource #2: request */ 2834 rc = smb2_plain_req_init(SMB2_CREATE, tcon, server, 2835 (void **) &req, &total_len); 2836 if (rc) 2837 goto err_free_path; 2838 2839 2840 if (smb3_encryption_required(tcon)) 2841 flags |= CIFS_TRANSFORM_REQ; 2842 2843 req->ImpersonationLevel = IL_IMPERSONATION; 2844 req->DesiredAccess = cpu_to_le32(FILE_WRITE_ATTRIBUTES); 2845 /* File attributes ignored on open (used in create though) */ 2846 req->FileAttributes = cpu_to_le32(file_attributes); 2847 req->ShareAccess = FILE_SHARE_ALL_LE; 2848 req->CreateDisposition = cpu_to_le32(FILE_CREATE); 2849 req->CreateOptions = cpu_to_le32(CREATE_NOT_FILE); 2850 2851 iov[0].iov_base = (char *)req; 2852 /* -1 since last byte is buf[0] which is sent below (path) */ 2853 iov[0].iov_len = total_len - 1; 2854 2855 req->NameOffset = cpu_to_le16(sizeof(struct smb2_create_req)); 2856 2857 /* [MS-SMB2] 2.2.13 NameOffset: 2858 * If SMB2_FLAGS_DFS_OPERATIONS is set in the Flags field of 2859 * the SMB2 header, the file name includes a prefix that will 2860 * be processed during DFS name normalization as specified in 2861 * section 3.3.5.9. Otherwise, the file name is relative to 2862 * the share that is identified by the TreeId in the SMB2 2863 * header. 2864 */ 2865 if (tcon->share_flags & SHI1005_FLAGS_DFS) { 2866 int name_len; 2867 2868 req->hdr.Flags |= SMB2_FLAGS_DFS_OPERATIONS; 2869 rc = alloc_path_with_tree_prefix(©_path, ©_size, 2870 &name_len, 2871 tcon->tree_name, utf16_path); 2872 if (rc) 2873 goto err_free_req; 2874 2875 req->NameLength = cpu_to_le16(name_len * 2); 2876 uni_path_len = copy_size; 2877 /* free before overwriting resource */ 2878 kfree(utf16_path); 2879 utf16_path = copy_path; 2880 } else { 2881 uni_path_len = (2 * UniStrnlen((wchar_t *)utf16_path, PATH_MAX)) + 2; 2882 /* MUST set path len (NameLength) to 0 opening root of share */ 2883 req->NameLength = cpu_to_le16(uni_path_len - 2); 2884 if (uni_path_len % 8 != 0) { 2885 copy_size = roundup(uni_path_len, 8); 2886 copy_path = kzalloc(copy_size, GFP_KERNEL); 2887 if (!copy_path) { 2888 rc = -ENOMEM; 2889 goto err_free_req; 2890 } 2891 memcpy((char *)copy_path, (const char *)utf16_path, 2892 uni_path_len); 2893 uni_path_len = copy_size; 2894 /* free before overwriting resource */ 2895 kfree(utf16_path); 2896 utf16_path = copy_path; 2897 } 2898 } 2899 2900 iov[1].iov_len = uni_path_len; 2901 iov[1].iov_base = utf16_path; 2902 req->RequestedOplockLevel = SMB2_OPLOCK_LEVEL_NONE; 2903 2904 if (tcon->posix_extensions) { 2905 /* resource #3: posix buf */ 2906 rc = add_posix_context(iov, &n_iov, mode); 2907 if (rc) 2908 goto err_free_req; 2909 req->CreateContextsOffset = cpu_to_le32( 2910 sizeof(struct smb2_create_req) + 2911 iov[1].iov_len); 2912 pc_buf = iov[n_iov-1].iov_base; 2913 } 2914 2915 2916 memset(&rqst, 0, sizeof(struct smb_rqst)); 2917 rqst.rq_iov = iov; 2918 rqst.rq_nvec = n_iov; 2919 2920 /* no need to inc num_remote_opens because we close it just below */ 2921 trace_smb3_posix_mkdir_enter(xid, tcon->tid, ses->Suid, full_path, CREATE_NOT_FILE, 2922 FILE_WRITE_ATTRIBUTES); 2923 2924 if (retries) 2925 smb2_set_replay(server, &rqst); 2926 2927 /* resource #4: response buffer */ 2928 rc = cifs_send_recv(xid, ses, server, 2929 &rqst, &resp_buftype, flags, &rsp_iov); 2930 if (rc) { 2931 cifs_stats_fail_inc(tcon, SMB2_CREATE_HE); 2932 trace_smb3_posix_mkdir_err(xid, tcon->tid, ses->Suid, 2933 CREATE_NOT_FILE, 2934 FILE_WRITE_ATTRIBUTES, rc); 2935 goto err_free_rsp_buf; 2936 } 2937 2938 /* 2939 * Although unlikely to be possible for rsp to be null and rc not set, 2940 * adding check below is slightly safer long term (and quiets Coverity 2941 * warning) 2942 */ 2943 rsp = (struct smb2_create_rsp *)rsp_iov.iov_base; 2944 if (rsp == NULL) { 2945 rc = -EIO; 2946 kfree(pc_buf); 2947 goto err_free_req; 2948 } 2949 2950 trace_smb3_posix_mkdir_done(xid, rsp->PersistentFileId, tcon->tid, ses->Suid, 2951 CREATE_NOT_FILE, FILE_WRITE_ATTRIBUTES); 2952 2953 SMB2_close(xid, tcon, rsp->PersistentFileId, rsp->VolatileFileId); 2954 2955 /* Eventually save off posix specific response info and timestaps */ 2956 2957 err_free_rsp_buf: 2958 free_rsp_buf(resp_buftype, rsp); 2959 kfree(pc_buf); 2960 err_free_req: 2961 cifs_small_buf_release(req); 2962 err_free_path: 2963 kfree(utf16_path); 2964 2965 if (is_replayable_error(rc) && 2966 smb2_should_replay(tcon, &retries, &cur_sleep)) 2967 goto replay_again; 2968 2969 return rc; 2970 } 2971 2972 int 2973 SMB2_open_init(struct cifs_tcon *tcon, struct TCP_Server_Info *server, 2974 struct smb_rqst *rqst, __u8 *oplock, 2975 struct cifs_open_parms *oparms, __le16 *path) 2976 { 2977 struct smb2_create_req *req; 2978 unsigned int n_iov = 2; 2979 __u32 file_attributes = 0; 2980 int copy_size; 2981 int uni_path_len; 2982 unsigned int total_len; 2983 struct kvec *iov = rqst->rq_iov; 2984 __le16 *copy_path; 2985 int rc; 2986 2987 rc = smb2_plain_req_init(SMB2_CREATE, tcon, server, 2988 (void **) &req, &total_len); 2989 if (rc) 2990 return rc; 2991 2992 iov[0].iov_base = (char *)req; 2993 /* -1 since last byte is buf[0] which is sent below (path) */ 2994 iov[0].iov_len = total_len - 1; 2995 2996 if (oparms->create_options & CREATE_OPTION_READONLY) 2997 file_attributes |= ATTR_READONLY; 2998 if (oparms->create_options & CREATE_OPTION_SPECIAL) 2999 file_attributes |= ATTR_SYSTEM; 3000 3001 req->ImpersonationLevel = IL_IMPERSONATION; 3002 req->DesiredAccess = cpu_to_le32(oparms->desired_access); 3003 /* File attributes ignored on open (used in create though) */ 3004 req->FileAttributes = cpu_to_le32(file_attributes); 3005 req->ShareAccess = FILE_SHARE_ALL_LE; 3006 3007 req->CreateDisposition = cpu_to_le32(oparms->disposition); 3008 req->CreateOptions = cpu_to_le32(oparms->create_options & CREATE_OPTIONS_MASK); 3009 req->NameOffset = cpu_to_le16(sizeof(struct smb2_create_req)); 3010 3011 /* [MS-SMB2] 2.2.13 NameOffset: 3012 * If SMB2_FLAGS_DFS_OPERATIONS is set in the Flags field of 3013 * the SMB2 header, the file name includes a prefix that will 3014 * be processed during DFS name normalization as specified in 3015 * section 3.3.5.9. Otherwise, the file name is relative to 3016 * the share that is identified by the TreeId in the SMB2 3017 * header. 3018 */ 3019 if (tcon->share_flags & SHI1005_FLAGS_DFS) { 3020 int name_len; 3021 3022 req->hdr.Flags |= SMB2_FLAGS_DFS_OPERATIONS; 3023 rc = alloc_path_with_tree_prefix(©_path, ©_size, 3024 &name_len, 3025 tcon->tree_name, path); 3026 if (rc) 3027 return rc; 3028 req->NameLength = cpu_to_le16(name_len * 2); 3029 uni_path_len = copy_size; 3030 path = copy_path; 3031 } else { 3032 uni_path_len = (2 * UniStrnlen((wchar_t *)path, PATH_MAX)) + 2; 3033 /* MUST set path len (NameLength) to 0 opening root of share */ 3034 req->NameLength = cpu_to_le16(uni_path_len - 2); 3035 copy_size = round_up(uni_path_len, 8); 3036 copy_path = kzalloc(copy_size, GFP_KERNEL); 3037 if (!copy_path) 3038 return -ENOMEM; 3039 memcpy((char *)copy_path, (const char *)path, 3040 uni_path_len); 3041 uni_path_len = copy_size; 3042 path = copy_path; 3043 } 3044 3045 iov[1].iov_len = uni_path_len; 3046 iov[1].iov_base = path; 3047 3048 if ((!server->oplocks) || (tcon->no_lease)) 3049 *oplock = SMB2_OPLOCK_LEVEL_NONE; 3050 3051 if (!(server->capabilities & SMB2_GLOBAL_CAP_LEASING) || 3052 *oplock == SMB2_OPLOCK_LEVEL_NONE) 3053 req->RequestedOplockLevel = *oplock; 3054 else if (!(server->capabilities & SMB2_GLOBAL_CAP_DIRECTORY_LEASING) && 3055 (oparms->create_options & CREATE_NOT_FILE)) 3056 req->RequestedOplockLevel = *oplock; /* no srv lease support */ 3057 else { 3058 rc = add_lease_context(server, req, iov, &n_iov, 3059 oparms->fid->lease_key, oplock); 3060 if (rc) 3061 return rc; 3062 } 3063 3064 if (*oplock == SMB2_OPLOCK_LEVEL_BATCH) { 3065 rc = add_durable_context(iov, &n_iov, oparms, 3066 tcon->use_persistent); 3067 if (rc) 3068 return rc; 3069 } 3070 3071 if (tcon->posix_extensions) { 3072 rc = add_posix_context(iov, &n_iov, oparms->mode); 3073 if (rc) 3074 return rc; 3075 } 3076 3077 if (tcon->snapshot_time) { 3078 cifs_dbg(FYI, "adding snapshot context\n"); 3079 rc = add_twarp_context(iov, &n_iov, tcon->snapshot_time); 3080 if (rc) 3081 return rc; 3082 } 3083 3084 if ((oparms->disposition != FILE_OPEN) && (oparms->cifs_sb)) { 3085 bool set_mode; 3086 bool set_owner; 3087 3088 if ((oparms->cifs_sb->mnt_cifs_flags & CIFS_MOUNT_MODE_FROM_SID) && 3089 (oparms->mode != ACL_NO_MODE)) 3090 set_mode = true; 3091 else { 3092 set_mode = false; 3093 oparms->mode = ACL_NO_MODE; 3094 } 3095 3096 if (oparms->cifs_sb->mnt_cifs_flags & CIFS_MOUNT_UID_FROM_ACL) 3097 set_owner = true; 3098 else 3099 set_owner = false; 3100 3101 if (set_owner | set_mode) { 3102 cifs_dbg(FYI, "add sd with mode 0x%x\n", oparms->mode); 3103 rc = add_sd_context(iov, &n_iov, oparms->mode, set_owner); 3104 if (rc) 3105 return rc; 3106 } 3107 } 3108 3109 add_query_id_context(iov, &n_iov); 3110 add_ea_context(oparms, iov, &n_iov); 3111 3112 if (n_iov > 2) { 3113 /* 3114 * We have create contexts behind iov[1] (the file 3115 * name), point at them from the main create request 3116 */ 3117 req->CreateContextsOffset = cpu_to_le32( 3118 sizeof(struct smb2_create_req) + 3119 iov[1].iov_len); 3120 req->CreateContextsLength = 0; 3121 3122 for (unsigned int i = 2; i < (n_iov-1); i++) { 3123 struct kvec *v = &iov[i]; 3124 size_t len = v->iov_len; 3125 struct create_context *cctx = 3126 (struct create_context *)v->iov_base; 3127 3128 cctx->Next = cpu_to_le32(len); 3129 le32_add_cpu(&req->CreateContextsLength, len); 3130 } 3131 le32_add_cpu(&req->CreateContextsLength, 3132 iov[n_iov-1].iov_len); 3133 } 3134 3135 rqst->rq_nvec = n_iov; 3136 return 0; 3137 } 3138 3139 /* rq_iov[0] is the request and is released by cifs_small_buf_release(). 3140 * All other vectors are freed by kfree(). 3141 */ 3142 void 3143 SMB2_open_free(struct smb_rqst *rqst) 3144 { 3145 int i; 3146 3147 if (rqst && rqst->rq_iov) { 3148 cifs_small_buf_release(rqst->rq_iov[0].iov_base); 3149 for (i = 1; i < rqst->rq_nvec; i++) 3150 if (rqst->rq_iov[i].iov_base != smb2_padding) 3151 kfree(rqst->rq_iov[i].iov_base); 3152 } 3153 } 3154 3155 int 3156 SMB2_open(const unsigned int xid, struct cifs_open_parms *oparms, __le16 *path, 3157 __u8 *oplock, struct smb2_file_all_info *buf, 3158 struct create_posix_rsp *posix, 3159 struct kvec *err_iov, int *buftype) 3160 { 3161 struct smb_rqst rqst; 3162 struct smb2_create_rsp *rsp = NULL; 3163 struct cifs_tcon *tcon = oparms->tcon; 3164 struct cifs_ses *ses = tcon->ses; 3165 struct TCP_Server_Info *server; 3166 struct kvec iov[SMB2_CREATE_IOV_SIZE]; 3167 struct kvec rsp_iov = {NULL, 0}; 3168 int resp_buftype = CIFS_NO_BUFFER; 3169 int rc = 0; 3170 int flags = 0; 3171 int retries = 0, cur_sleep = 1; 3172 3173 replay_again: 3174 /* reinitialize for possible replay */ 3175 flags = 0; 3176 server = cifs_pick_channel(ses); 3177 oparms->replay = !!(retries); 3178 3179 cifs_dbg(FYI, "create/open\n"); 3180 if (!ses || !server) 3181 return -EIO; 3182 3183 if (smb3_encryption_required(tcon)) 3184 flags |= CIFS_TRANSFORM_REQ; 3185 3186 memset(&rqst, 0, sizeof(struct smb_rqst)); 3187 memset(&iov, 0, sizeof(iov)); 3188 rqst.rq_iov = iov; 3189 rqst.rq_nvec = SMB2_CREATE_IOV_SIZE; 3190 3191 rc = SMB2_open_init(tcon, server, 3192 &rqst, oplock, oparms, path); 3193 if (rc) 3194 goto creat_exit; 3195 3196 trace_smb3_open_enter(xid, tcon->tid, tcon->ses->Suid, oparms->path, 3197 oparms->create_options, oparms->desired_access); 3198 3199 if (retries) 3200 smb2_set_replay(server, &rqst); 3201 3202 rc = cifs_send_recv(xid, ses, server, 3203 &rqst, &resp_buftype, flags, 3204 &rsp_iov); 3205 rsp = (struct smb2_create_rsp *)rsp_iov.iov_base; 3206 3207 if (rc != 0) { 3208 cifs_stats_fail_inc(tcon, SMB2_CREATE_HE); 3209 if (err_iov && rsp) { 3210 *err_iov = rsp_iov; 3211 *buftype = resp_buftype; 3212 resp_buftype = CIFS_NO_BUFFER; 3213 rsp = NULL; 3214 } 3215 trace_smb3_open_err(xid, tcon->tid, ses->Suid, 3216 oparms->create_options, oparms->desired_access, rc); 3217 if (rc == -EREMCHG) { 3218 pr_warn_once("server share %s deleted\n", 3219 tcon->tree_name); 3220 tcon->need_reconnect = true; 3221 } 3222 goto creat_exit; 3223 } else if (rsp == NULL) /* unlikely to happen, but safer to check */ 3224 goto creat_exit; 3225 else 3226 trace_smb3_open_done(xid, rsp->PersistentFileId, tcon->tid, ses->Suid, 3227 oparms->create_options, oparms->desired_access); 3228 3229 atomic_inc(&tcon->num_remote_opens); 3230 oparms->fid->persistent_fid = rsp->PersistentFileId; 3231 oparms->fid->volatile_fid = rsp->VolatileFileId; 3232 oparms->fid->access = oparms->desired_access; 3233 #ifdef CONFIG_CIFS_DEBUG2 3234 oparms->fid->mid = le64_to_cpu(rsp->hdr.MessageId); 3235 #endif /* CIFS_DEBUG2 */ 3236 3237 if (buf) { 3238 buf->CreationTime = rsp->CreationTime; 3239 buf->LastAccessTime = rsp->LastAccessTime; 3240 buf->LastWriteTime = rsp->LastWriteTime; 3241 buf->ChangeTime = rsp->ChangeTime; 3242 buf->AllocationSize = rsp->AllocationSize; 3243 buf->EndOfFile = rsp->EndofFile; 3244 buf->Attributes = rsp->FileAttributes; 3245 buf->NumberOfLinks = cpu_to_le32(1); 3246 buf->DeletePending = 0; 3247 } 3248 3249 3250 rc = smb2_parse_contexts(server, &rsp_iov, &oparms->fid->epoch, 3251 oparms->fid->lease_key, oplock, buf, posix); 3252 creat_exit: 3253 SMB2_open_free(&rqst); 3254 free_rsp_buf(resp_buftype, rsp); 3255 3256 if (is_replayable_error(rc) && 3257 smb2_should_replay(tcon, &retries, &cur_sleep)) 3258 goto replay_again; 3259 3260 return rc; 3261 } 3262 3263 int 3264 SMB2_ioctl_init(struct cifs_tcon *tcon, struct TCP_Server_Info *server, 3265 struct smb_rqst *rqst, 3266 u64 persistent_fid, u64 volatile_fid, u32 opcode, 3267 char *in_data, u32 indatalen, 3268 __u32 max_response_size) 3269 { 3270 struct smb2_ioctl_req *req; 3271 struct kvec *iov = rqst->rq_iov; 3272 unsigned int total_len; 3273 int rc; 3274 char *in_data_buf; 3275 3276 rc = smb2_ioctl_req_init(opcode, tcon, server, 3277 (void **) &req, &total_len); 3278 if (rc) 3279 return rc; 3280 3281 if (indatalen) { 3282 /* 3283 * indatalen is usually small at a couple of bytes max, so 3284 * just allocate through generic pool 3285 */ 3286 in_data_buf = kmemdup(in_data, indatalen, GFP_NOFS); 3287 if (!in_data_buf) { 3288 cifs_small_buf_release(req); 3289 return -ENOMEM; 3290 } 3291 } 3292 3293 req->CtlCode = cpu_to_le32(opcode); 3294 req->PersistentFileId = persistent_fid; 3295 req->VolatileFileId = volatile_fid; 3296 3297 iov[0].iov_base = (char *)req; 3298 /* 3299 * If no input data, the size of ioctl struct in 3300 * protocol spec still includes a 1 byte data buffer, 3301 * but if input data passed to ioctl, we do not 3302 * want to double count this, so we do not send 3303 * the dummy one byte of data in iovec[0] if sending 3304 * input data (in iovec[1]). 3305 */ 3306 if (indatalen) { 3307 req->InputCount = cpu_to_le32(indatalen); 3308 /* do not set InputOffset if no input data */ 3309 req->InputOffset = 3310 cpu_to_le32(offsetof(struct smb2_ioctl_req, Buffer)); 3311 rqst->rq_nvec = 2; 3312 iov[0].iov_len = total_len - 1; 3313 iov[1].iov_base = in_data_buf; 3314 iov[1].iov_len = indatalen; 3315 } else { 3316 rqst->rq_nvec = 1; 3317 iov[0].iov_len = total_len; 3318 } 3319 3320 req->OutputOffset = 0; 3321 req->OutputCount = 0; /* MBZ */ 3322 3323 /* 3324 * In most cases max_response_size is set to 16K (CIFSMaxBufSize) 3325 * We Could increase default MaxOutputResponse, but that could require 3326 * more credits. Windows typically sets this smaller, but for some 3327 * ioctls it may be useful to allow server to send more. No point 3328 * limiting what the server can send as long as fits in one credit 3329 * We can not handle more than CIFS_MAX_BUF_SIZE yet but may want 3330 * to increase this limit up in the future. 3331 * Note that for snapshot queries that servers like Azure expect that 3332 * the first query be minimal size (and just used to get the number/size 3333 * of previous versions) so response size must be specified as EXACTLY 3334 * sizeof(struct snapshot_array) which is 16 when rounded up to multiple 3335 * of eight bytes. Currently that is the only case where we set max 3336 * response size smaller. 3337 */ 3338 req->MaxOutputResponse = cpu_to_le32(max_response_size); 3339 req->hdr.CreditCharge = 3340 cpu_to_le16(DIV_ROUND_UP(max(indatalen, max_response_size), 3341 SMB2_MAX_BUFFER_SIZE)); 3342 /* always an FSCTL (for now) */ 3343 req->Flags = cpu_to_le32(SMB2_0_IOCTL_IS_FSCTL); 3344 3345 /* validate negotiate request must be signed - see MS-SMB2 3.2.5.5 */ 3346 if (opcode == FSCTL_VALIDATE_NEGOTIATE_INFO) 3347 req->hdr.Flags |= SMB2_FLAGS_SIGNED; 3348 3349 return 0; 3350 } 3351 3352 void 3353 SMB2_ioctl_free(struct smb_rqst *rqst) 3354 { 3355 int i; 3356 3357 if (rqst && rqst->rq_iov) { 3358 cifs_small_buf_release(rqst->rq_iov[0].iov_base); /* request */ 3359 for (i = 1; i < rqst->rq_nvec; i++) 3360 if (rqst->rq_iov[i].iov_base != smb2_padding) 3361 kfree(rqst->rq_iov[i].iov_base); 3362 } 3363 } 3364 3365 3366 /* 3367 * SMB2 IOCTL is used for both IOCTLs and FSCTLs 3368 */ 3369 int 3370 SMB2_ioctl(const unsigned int xid, struct cifs_tcon *tcon, u64 persistent_fid, 3371 u64 volatile_fid, u32 opcode, char *in_data, u32 indatalen, 3372 u32 max_out_data_len, char **out_data, 3373 u32 *plen /* returned data len */) 3374 { 3375 struct smb_rqst rqst; 3376 struct smb2_ioctl_rsp *rsp = NULL; 3377 struct cifs_ses *ses; 3378 struct TCP_Server_Info *server; 3379 struct kvec iov[SMB2_IOCTL_IOV_SIZE]; 3380 struct kvec rsp_iov = {NULL, 0}; 3381 int resp_buftype = CIFS_NO_BUFFER; 3382 int rc = 0; 3383 int flags = 0; 3384 int retries = 0, cur_sleep = 1; 3385 3386 if (!tcon) 3387 return -EIO; 3388 3389 ses = tcon->ses; 3390 if (!ses) 3391 return -EIO; 3392 3393 replay_again: 3394 /* reinitialize for possible replay */ 3395 flags = 0; 3396 server = cifs_pick_channel(ses); 3397 3398 if (!server) 3399 return -EIO; 3400 3401 cifs_dbg(FYI, "SMB2 IOCTL\n"); 3402 3403 if (out_data != NULL) 3404 *out_data = NULL; 3405 3406 /* zero out returned data len, in case of error */ 3407 if (plen) 3408 *plen = 0; 3409 3410 if (smb3_encryption_required(tcon)) 3411 flags |= CIFS_TRANSFORM_REQ; 3412 3413 memset(&rqst, 0, sizeof(struct smb_rqst)); 3414 memset(&iov, 0, sizeof(iov)); 3415 rqst.rq_iov = iov; 3416 rqst.rq_nvec = SMB2_IOCTL_IOV_SIZE; 3417 3418 rc = SMB2_ioctl_init(tcon, server, 3419 &rqst, persistent_fid, volatile_fid, opcode, 3420 in_data, indatalen, max_out_data_len); 3421 if (rc) 3422 goto ioctl_exit; 3423 3424 if (retries) 3425 smb2_set_replay(server, &rqst); 3426 3427 rc = cifs_send_recv(xid, ses, server, 3428 &rqst, &resp_buftype, flags, 3429 &rsp_iov); 3430 rsp = (struct smb2_ioctl_rsp *)rsp_iov.iov_base; 3431 3432 if (rc != 0) 3433 trace_smb3_fsctl_err(xid, persistent_fid, tcon->tid, 3434 ses->Suid, 0, opcode, rc); 3435 3436 if ((rc != 0) && (rc != -EINVAL) && (rc != -E2BIG)) { 3437 cifs_stats_fail_inc(tcon, SMB2_IOCTL_HE); 3438 goto ioctl_exit; 3439 } else if (rc == -EINVAL) { 3440 if ((opcode != FSCTL_SRV_COPYCHUNK_WRITE) && 3441 (opcode != FSCTL_SRV_COPYCHUNK)) { 3442 cifs_stats_fail_inc(tcon, SMB2_IOCTL_HE); 3443 goto ioctl_exit; 3444 } 3445 } else if (rc == -E2BIG) { 3446 if (opcode != FSCTL_QUERY_ALLOCATED_RANGES) { 3447 cifs_stats_fail_inc(tcon, SMB2_IOCTL_HE); 3448 goto ioctl_exit; 3449 } 3450 } 3451 3452 /* check if caller wants to look at return data or just return rc */ 3453 if ((plen == NULL) || (out_data == NULL)) 3454 goto ioctl_exit; 3455 3456 /* 3457 * Although unlikely to be possible for rsp to be null and rc not set, 3458 * adding check below is slightly safer long term (and quiets Coverity 3459 * warning) 3460 */ 3461 if (rsp == NULL) { 3462 rc = -EIO; 3463 goto ioctl_exit; 3464 } 3465 3466 *plen = le32_to_cpu(rsp->OutputCount); 3467 3468 /* We check for obvious errors in the output buffer length and offset */ 3469 if (*plen == 0) 3470 goto ioctl_exit; /* server returned no data */ 3471 else if (*plen > rsp_iov.iov_len || *plen > 0xFF00) { 3472 cifs_tcon_dbg(VFS, "srv returned invalid ioctl length: %d\n", *plen); 3473 *plen = 0; 3474 rc = -EIO; 3475 goto ioctl_exit; 3476 } 3477 3478 if (rsp_iov.iov_len - *plen < le32_to_cpu(rsp->OutputOffset)) { 3479 cifs_tcon_dbg(VFS, "Malformed ioctl resp: len %d offset %d\n", *plen, 3480 le32_to_cpu(rsp->OutputOffset)); 3481 *plen = 0; 3482 rc = -EIO; 3483 goto ioctl_exit; 3484 } 3485 3486 *out_data = kmemdup((char *)rsp + le32_to_cpu(rsp->OutputOffset), 3487 *plen, GFP_KERNEL); 3488 if (*out_data == NULL) { 3489 rc = -ENOMEM; 3490 goto ioctl_exit; 3491 } 3492 3493 ioctl_exit: 3494 SMB2_ioctl_free(&rqst); 3495 free_rsp_buf(resp_buftype, rsp); 3496 3497 if (is_replayable_error(rc) && 3498 smb2_should_replay(tcon, &retries, &cur_sleep)) 3499 goto replay_again; 3500 3501 return rc; 3502 } 3503 3504 /* 3505 * Individual callers to ioctl worker function follow 3506 */ 3507 3508 int 3509 SMB2_set_compression(const unsigned int xid, struct cifs_tcon *tcon, 3510 u64 persistent_fid, u64 volatile_fid) 3511 { 3512 int rc; 3513 struct compress_ioctl fsctl_input; 3514 char *ret_data = NULL; 3515 3516 fsctl_input.CompressionState = 3517 cpu_to_le16(COMPRESSION_FORMAT_DEFAULT); 3518 3519 rc = SMB2_ioctl(xid, tcon, persistent_fid, volatile_fid, 3520 FSCTL_SET_COMPRESSION, 3521 (char *)&fsctl_input /* data input */, 3522 2 /* in data len */, CIFSMaxBufSize /* max out data */, 3523 &ret_data /* out data */, NULL); 3524 3525 cifs_dbg(FYI, "set compression rc %d\n", rc); 3526 3527 return rc; 3528 } 3529 3530 int 3531 SMB2_close_init(struct cifs_tcon *tcon, struct TCP_Server_Info *server, 3532 struct smb_rqst *rqst, 3533 u64 persistent_fid, u64 volatile_fid, bool query_attrs) 3534 { 3535 struct smb2_close_req *req; 3536 struct kvec *iov = rqst->rq_iov; 3537 unsigned int total_len; 3538 int rc; 3539 3540 rc = smb2_plain_req_init(SMB2_CLOSE, tcon, server, 3541 (void **) &req, &total_len); 3542 if (rc) 3543 return rc; 3544 3545 req->PersistentFileId = persistent_fid; 3546 req->VolatileFileId = volatile_fid; 3547 if (query_attrs) 3548 req->Flags = SMB2_CLOSE_FLAG_POSTQUERY_ATTRIB; 3549 else 3550 req->Flags = 0; 3551 iov[0].iov_base = (char *)req; 3552 iov[0].iov_len = total_len; 3553 3554 return 0; 3555 } 3556 3557 void 3558 SMB2_close_free(struct smb_rqst *rqst) 3559 { 3560 if (rqst && rqst->rq_iov) 3561 cifs_small_buf_release(rqst->rq_iov[0].iov_base); /* request */ 3562 } 3563 3564 int 3565 __SMB2_close(const unsigned int xid, struct cifs_tcon *tcon, 3566 u64 persistent_fid, u64 volatile_fid, 3567 struct smb2_file_network_open_info *pbuf) 3568 { 3569 struct smb_rqst rqst; 3570 struct smb2_close_rsp *rsp = NULL; 3571 struct cifs_ses *ses = tcon->ses; 3572 struct TCP_Server_Info *server; 3573 struct kvec iov[1]; 3574 struct kvec rsp_iov; 3575 int resp_buftype = CIFS_NO_BUFFER; 3576 int rc = 0; 3577 int flags = 0; 3578 bool query_attrs = false; 3579 int retries = 0, cur_sleep = 1; 3580 3581 replay_again: 3582 /* reinitialize for possible replay */ 3583 flags = 0; 3584 query_attrs = false; 3585 server = cifs_pick_channel(ses); 3586 3587 cifs_dbg(FYI, "Close\n"); 3588 3589 if (!ses || !server) 3590 return -EIO; 3591 3592 if (smb3_encryption_required(tcon)) 3593 flags |= CIFS_TRANSFORM_REQ; 3594 3595 memset(&rqst, 0, sizeof(struct smb_rqst)); 3596 memset(&iov, 0, sizeof(iov)); 3597 rqst.rq_iov = iov; 3598 rqst.rq_nvec = 1; 3599 3600 /* check if need to ask server to return timestamps in close response */ 3601 if (pbuf) 3602 query_attrs = true; 3603 3604 trace_smb3_close_enter(xid, persistent_fid, tcon->tid, ses->Suid); 3605 rc = SMB2_close_init(tcon, server, 3606 &rqst, persistent_fid, volatile_fid, 3607 query_attrs); 3608 if (rc) 3609 goto close_exit; 3610 3611 if (retries) 3612 smb2_set_replay(server, &rqst); 3613 3614 rc = cifs_send_recv(xid, ses, server, 3615 &rqst, &resp_buftype, flags, &rsp_iov); 3616 rsp = (struct smb2_close_rsp *)rsp_iov.iov_base; 3617 3618 if (rc != 0) { 3619 cifs_stats_fail_inc(tcon, SMB2_CLOSE_HE); 3620 trace_smb3_close_err(xid, persistent_fid, tcon->tid, ses->Suid, 3621 rc); 3622 goto close_exit; 3623 } else { 3624 trace_smb3_close_done(xid, persistent_fid, tcon->tid, 3625 ses->Suid); 3626 if (pbuf) 3627 memcpy(&pbuf->network_open_info, 3628 &rsp->network_open_info, 3629 sizeof(pbuf->network_open_info)); 3630 } 3631 3632 atomic_dec(&tcon->num_remote_opens); 3633 close_exit: 3634 SMB2_close_free(&rqst); 3635 free_rsp_buf(resp_buftype, rsp); 3636 3637 /* retry close in a worker thread if this one is interrupted */ 3638 if (is_interrupt_error(rc)) { 3639 int tmp_rc; 3640 3641 tmp_rc = smb2_handle_cancelled_close(tcon, persistent_fid, 3642 volatile_fid); 3643 if (tmp_rc) 3644 cifs_dbg(VFS, "handle cancelled close fid 0x%llx returned error %d\n", 3645 persistent_fid, tmp_rc); 3646 } 3647 3648 if (is_replayable_error(rc) && 3649 smb2_should_replay(tcon, &retries, &cur_sleep)) 3650 goto replay_again; 3651 3652 return rc; 3653 } 3654 3655 int 3656 SMB2_close(const unsigned int xid, struct cifs_tcon *tcon, 3657 u64 persistent_fid, u64 volatile_fid) 3658 { 3659 return __SMB2_close(xid, tcon, persistent_fid, volatile_fid, NULL); 3660 } 3661 3662 int 3663 smb2_validate_iov(unsigned int offset, unsigned int buffer_length, 3664 struct kvec *iov, unsigned int min_buf_size) 3665 { 3666 unsigned int smb_len = iov->iov_len; 3667 char *end_of_smb = smb_len + (char *)iov->iov_base; 3668 char *begin_of_buf = offset + (char *)iov->iov_base; 3669 char *end_of_buf = begin_of_buf + buffer_length; 3670 3671 3672 if (buffer_length < min_buf_size) { 3673 cifs_dbg(VFS, "buffer length %d smaller than minimum size %d\n", 3674 buffer_length, min_buf_size); 3675 return -EINVAL; 3676 } 3677 3678 /* check if beyond RFC1001 maximum length */ 3679 if ((smb_len > 0x7FFFFF) || (buffer_length > 0x7FFFFF)) { 3680 cifs_dbg(VFS, "buffer length %d or smb length %d too large\n", 3681 buffer_length, smb_len); 3682 return -EINVAL; 3683 } 3684 3685 if ((begin_of_buf > end_of_smb) || (end_of_buf > end_of_smb)) { 3686 cifs_dbg(VFS, "Invalid server response, bad offset to data\n"); 3687 return -EINVAL; 3688 } 3689 3690 return 0; 3691 } 3692 3693 /* 3694 * If SMB buffer fields are valid, copy into temporary buffer to hold result. 3695 * Caller must free buffer. 3696 */ 3697 int 3698 smb2_validate_and_copy_iov(unsigned int offset, unsigned int buffer_length, 3699 struct kvec *iov, unsigned int minbufsize, 3700 char *data) 3701 { 3702 char *begin_of_buf = offset + (char *)iov->iov_base; 3703 int rc; 3704 3705 if (!data) 3706 return -EINVAL; 3707 3708 rc = smb2_validate_iov(offset, buffer_length, iov, minbufsize); 3709 if (rc) 3710 return rc; 3711 3712 memcpy(data, begin_of_buf, minbufsize); 3713 3714 return 0; 3715 } 3716 3717 int 3718 SMB2_query_info_init(struct cifs_tcon *tcon, struct TCP_Server_Info *server, 3719 struct smb_rqst *rqst, 3720 u64 persistent_fid, u64 volatile_fid, 3721 u8 info_class, u8 info_type, u32 additional_info, 3722 size_t output_len, size_t input_len, void *input) 3723 { 3724 struct smb2_query_info_req *req; 3725 struct kvec *iov = rqst->rq_iov; 3726 unsigned int total_len; 3727 size_t len; 3728 int rc; 3729 3730 if (unlikely(check_add_overflow(input_len, sizeof(*req), &len) || 3731 len > CIFSMaxBufSize)) 3732 return -EINVAL; 3733 3734 rc = smb2_plain_req_init(SMB2_QUERY_INFO, tcon, server, 3735 (void **) &req, &total_len); 3736 if (rc) 3737 return rc; 3738 3739 req->InfoType = info_type; 3740 req->FileInfoClass = info_class; 3741 req->PersistentFileId = persistent_fid; 3742 req->VolatileFileId = volatile_fid; 3743 req->AdditionalInformation = cpu_to_le32(additional_info); 3744 3745 req->OutputBufferLength = cpu_to_le32(output_len); 3746 if (input_len) { 3747 req->InputBufferLength = cpu_to_le32(input_len); 3748 /* total_len for smb query request never close to le16 max */ 3749 req->InputBufferOffset = cpu_to_le16(total_len - 1); 3750 memcpy(req->Buffer, input, input_len); 3751 } 3752 3753 iov[0].iov_base = (char *)req; 3754 /* 1 for Buffer */ 3755 iov[0].iov_len = len; 3756 return 0; 3757 } 3758 3759 void 3760 SMB2_query_info_free(struct smb_rqst *rqst) 3761 { 3762 if (rqst && rqst->rq_iov) 3763 cifs_buf_release(rqst->rq_iov[0].iov_base); /* request */ 3764 } 3765 3766 static int 3767 query_info(const unsigned int xid, struct cifs_tcon *tcon, 3768 u64 persistent_fid, u64 volatile_fid, u8 info_class, u8 info_type, 3769 u32 additional_info, size_t output_len, size_t min_len, void **data, 3770 u32 *dlen) 3771 { 3772 struct smb_rqst rqst; 3773 struct smb2_query_info_rsp *rsp = NULL; 3774 struct kvec iov[1]; 3775 struct kvec rsp_iov; 3776 int rc = 0; 3777 int resp_buftype = CIFS_NO_BUFFER; 3778 struct cifs_ses *ses = tcon->ses; 3779 struct TCP_Server_Info *server; 3780 int flags = 0; 3781 bool allocated = false; 3782 int retries = 0, cur_sleep = 1; 3783 3784 cifs_dbg(FYI, "Query Info\n"); 3785 3786 if (!ses) 3787 return -EIO; 3788 3789 replay_again: 3790 /* reinitialize for possible replay */ 3791 flags = 0; 3792 allocated = false; 3793 server = cifs_pick_channel(ses); 3794 3795 if (!server) 3796 return -EIO; 3797 3798 if (smb3_encryption_required(tcon)) 3799 flags |= CIFS_TRANSFORM_REQ; 3800 3801 memset(&rqst, 0, sizeof(struct smb_rqst)); 3802 memset(&iov, 0, sizeof(iov)); 3803 rqst.rq_iov = iov; 3804 rqst.rq_nvec = 1; 3805 3806 rc = SMB2_query_info_init(tcon, server, 3807 &rqst, persistent_fid, volatile_fid, 3808 info_class, info_type, additional_info, 3809 output_len, 0, NULL); 3810 if (rc) 3811 goto qinf_exit; 3812 3813 trace_smb3_query_info_enter(xid, persistent_fid, tcon->tid, 3814 ses->Suid, info_class, (__u32)info_type); 3815 3816 if (retries) 3817 smb2_set_replay(server, &rqst); 3818 3819 rc = cifs_send_recv(xid, ses, server, 3820 &rqst, &resp_buftype, flags, &rsp_iov); 3821 rsp = (struct smb2_query_info_rsp *)rsp_iov.iov_base; 3822 3823 if (rc) { 3824 cifs_stats_fail_inc(tcon, SMB2_QUERY_INFO_HE); 3825 trace_smb3_query_info_err(xid, persistent_fid, tcon->tid, 3826 ses->Suid, info_class, (__u32)info_type, rc); 3827 goto qinf_exit; 3828 } 3829 3830 trace_smb3_query_info_done(xid, persistent_fid, tcon->tid, 3831 ses->Suid, info_class, (__u32)info_type); 3832 3833 if (dlen) { 3834 *dlen = le32_to_cpu(rsp->OutputBufferLength); 3835 if (!*data) { 3836 *data = kmalloc(*dlen, GFP_KERNEL); 3837 if (!*data) { 3838 cifs_tcon_dbg(VFS, 3839 "Error %d allocating memory for acl\n", 3840 rc); 3841 *dlen = 0; 3842 rc = -ENOMEM; 3843 goto qinf_exit; 3844 } 3845 allocated = true; 3846 } 3847 } 3848 3849 rc = smb2_validate_and_copy_iov(le16_to_cpu(rsp->OutputBufferOffset), 3850 le32_to_cpu(rsp->OutputBufferLength), 3851 &rsp_iov, dlen ? *dlen : min_len, *data); 3852 if (rc && allocated) { 3853 kfree(*data); 3854 *data = NULL; 3855 *dlen = 0; 3856 } 3857 3858 qinf_exit: 3859 SMB2_query_info_free(&rqst); 3860 free_rsp_buf(resp_buftype, rsp); 3861 3862 if (is_replayable_error(rc) && 3863 smb2_should_replay(tcon, &retries, &cur_sleep)) 3864 goto replay_again; 3865 3866 return rc; 3867 } 3868 3869 int SMB2_query_info(const unsigned int xid, struct cifs_tcon *tcon, 3870 u64 persistent_fid, u64 volatile_fid, struct smb2_file_all_info *data) 3871 { 3872 return query_info(xid, tcon, persistent_fid, volatile_fid, 3873 FILE_ALL_INFORMATION, SMB2_O_INFO_FILE, 0, 3874 sizeof(struct smb2_file_all_info) + PATH_MAX * 2, 3875 sizeof(struct smb2_file_all_info), (void **)&data, 3876 NULL); 3877 } 3878 3879 #if 0 3880 /* currently unused, as now we are doing compounding instead (see smb311_posix_query_path_info) */ 3881 int 3882 SMB311_posix_query_info(const unsigned int xid, struct cifs_tcon *tcon, 3883 u64 persistent_fid, u64 volatile_fid, struct smb311_posix_qinfo *data, u32 *plen) 3884 { 3885 size_t output_len = sizeof(struct smb311_posix_qinfo *) + 3886 (sizeof(struct cifs_sid) * 2) + (PATH_MAX * 2); 3887 *plen = 0; 3888 3889 return query_info(xid, tcon, persistent_fid, volatile_fid, 3890 SMB_FIND_FILE_POSIX_INFO, SMB2_O_INFO_FILE, 0, 3891 output_len, sizeof(struct smb311_posix_qinfo), (void **)&data, plen); 3892 /* Note caller must free "data" (passed in above). It may be allocated in query_info call */ 3893 } 3894 #endif 3895 3896 int 3897 SMB2_query_acl(const unsigned int xid, struct cifs_tcon *tcon, 3898 u64 persistent_fid, u64 volatile_fid, 3899 void **data, u32 *plen, u32 extra_info) 3900 { 3901 __u32 additional_info = OWNER_SECINFO | GROUP_SECINFO | DACL_SECINFO | 3902 extra_info; 3903 *plen = 0; 3904 3905 return query_info(xid, tcon, persistent_fid, volatile_fid, 3906 0, SMB2_O_INFO_SECURITY, additional_info, 3907 SMB2_MAX_BUFFER_SIZE, MIN_SEC_DESC_LEN, data, plen); 3908 } 3909 3910 int 3911 SMB2_get_srv_num(const unsigned int xid, struct cifs_tcon *tcon, 3912 u64 persistent_fid, u64 volatile_fid, __le64 *uniqueid) 3913 { 3914 return query_info(xid, tcon, persistent_fid, volatile_fid, 3915 FILE_INTERNAL_INFORMATION, SMB2_O_INFO_FILE, 0, 3916 sizeof(struct smb2_file_internal_info), 3917 sizeof(struct smb2_file_internal_info), 3918 (void **)&uniqueid, NULL); 3919 } 3920 3921 /* 3922 * CHANGE_NOTIFY Request is sent to get notifications on changes to a directory 3923 * See MS-SMB2 2.2.35 and 2.2.36 3924 */ 3925 3926 static int 3927 SMB2_notify_init(const unsigned int xid, struct smb_rqst *rqst, 3928 struct cifs_tcon *tcon, struct TCP_Server_Info *server, 3929 u64 persistent_fid, u64 volatile_fid, 3930 u32 completion_filter, bool watch_tree) 3931 { 3932 struct smb2_change_notify_req *req; 3933 struct kvec *iov = rqst->rq_iov; 3934 unsigned int total_len; 3935 int rc; 3936 3937 rc = smb2_plain_req_init(SMB2_CHANGE_NOTIFY, tcon, server, 3938 (void **) &req, &total_len); 3939 if (rc) 3940 return rc; 3941 3942 req->PersistentFileId = persistent_fid; 3943 req->VolatileFileId = volatile_fid; 3944 /* See note 354 of MS-SMB2, 64K max */ 3945 req->OutputBufferLength = 3946 cpu_to_le32(SMB2_MAX_BUFFER_SIZE - MAX_SMB2_HDR_SIZE); 3947 req->CompletionFilter = cpu_to_le32(completion_filter); 3948 if (watch_tree) 3949 req->Flags = cpu_to_le16(SMB2_WATCH_TREE); 3950 else 3951 req->Flags = 0; 3952 3953 iov[0].iov_base = (char *)req; 3954 iov[0].iov_len = total_len; 3955 3956 return 0; 3957 } 3958 3959 int 3960 SMB2_change_notify(const unsigned int xid, struct cifs_tcon *tcon, 3961 u64 persistent_fid, u64 volatile_fid, bool watch_tree, 3962 u32 completion_filter, u32 max_out_data_len, char **out_data, 3963 u32 *plen /* returned data len */) 3964 { 3965 struct cifs_ses *ses = tcon->ses; 3966 struct TCP_Server_Info *server; 3967 struct smb_rqst rqst; 3968 struct smb2_change_notify_rsp *smb_rsp; 3969 struct kvec iov[1]; 3970 struct kvec rsp_iov = {NULL, 0}; 3971 int resp_buftype = CIFS_NO_BUFFER; 3972 int flags = 0; 3973 int rc = 0; 3974 int retries = 0, cur_sleep = 1; 3975 3976 replay_again: 3977 /* reinitialize for possible replay */ 3978 flags = 0; 3979 server = cifs_pick_channel(ses); 3980 3981 cifs_dbg(FYI, "change notify\n"); 3982 if (!ses || !server) 3983 return -EIO; 3984 3985 if (smb3_encryption_required(tcon)) 3986 flags |= CIFS_TRANSFORM_REQ; 3987 3988 memset(&rqst, 0, sizeof(struct smb_rqst)); 3989 memset(&iov, 0, sizeof(iov)); 3990 if (plen) 3991 *plen = 0; 3992 3993 rqst.rq_iov = iov; 3994 rqst.rq_nvec = 1; 3995 3996 rc = SMB2_notify_init(xid, &rqst, tcon, server, 3997 persistent_fid, volatile_fid, 3998 completion_filter, watch_tree); 3999 if (rc) 4000 goto cnotify_exit; 4001 4002 trace_smb3_notify_enter(xid, persistent_fid, tcon->tid, ses->Suid, 4003 (u8)watch_tree, completion_filter); 4004 4005 if (retries) 4006 smb2_set_replay(server, &rqst); 4007 4008 rc = cifs_send_recv(xid, ses, server, 4009 &rqst, &resp_buftype, flags, &rsp_iov); 4010 4011 if (rc != 0) { 4012 cifs_stats_fail_inc(tcon, SMB2_CHANGE_NOTIFY_HE); 4013 trace_smb3_notify_err(xid, persistent_fid, tcon->tid, ses->Suid, 4014 (u8)watch_tree, completion_filter, rc); 4015 } else { 4016 trace_smb3_notify_done(xid, persistent_fid, tcon->tid, 4017 ses->Suid, (u8)watch_tree, completion_filter); 4018 /* validate that notify information is plausible */ 4019 if ((rsp_iov.iov_base == NULL) || 4020 (rsp_iov.iov_len < sizeof(struct smb2_change_notify_rsp) + 1)) 4021 goto cnotify_exit; 4022 4023 smb_rsp = (struct smb2_change_notify_rsp *)rsp_iov.iov_base; 4024 4025 smb2_validate_iov(le16_to_cpu(smb_rsp->OutputBufferOffset), 4026 le32_to_cpu(smb_rsp->OutputBufferLength), &rsp_iov, 4027 sizeof(struct file_notify_information)); 4028 4029 *out_data = kmemdup((char *)smb_rsp + le16_to_cpu(smb_rsp->OutputBufferOffset), 4030 le32_to_cpu(smb_rsp->OutputBufferLength), GFP_KERNEL); 4031 if (*out_data == NULL) { 4032 rc = -ENOMEM; 4033 goto cnotify_exit; 4034 } else if (plen) 4035 *plen = le32_to_cpu(smb_rsp->OutputBufferLength); 4036 } 4037 4038 cnotify_exit: 4039 if (rqst.rq_iov) 4040 cifs_small_buf_release(rqst.rq_iov[0].iov_base); /* request */ 4041 free_rsp_buf(resp_buftype, rsp_iov.iov_base); 4042 4043 if (is_replayable_error(rc) && 4044 smb2_should_replay(tcon, &retries, &cur_sleep)) 4045 goto replay_again; 4046 4047 return rc; 4048 } 4049 4050 4051 4052 /* 4053 * This is a no-op for now. We're not really interested in the reply, but 4054 * rather in the fact that the server sent one and that server->lstrp 4055 * gets updated. 4056 * 4057 * FIXME: maybe we should consider checking that the reply matches request? 4058 */ 4059 static void 4060 smb2_echo_callback(struct mid_q_entry *mid) 4061 { 4062 struct TCP_Server_Info *server = mid->callback_data; 4063 struct smb2_echo_rsp *rsp = (struct smb2_echo_rsp *)mid->resp_buf; 4064 struct cifs_credits credits = { .value = 0, .instance = 0 }; 4065 4066 if (mid->mid_state == MID_RESPONSE_RECEIVED 4067 || mid->mid_state == MID_RESPONSE_MALFORMED) { 4068 credits.value = le16_to_cpu(rsp->hdr.CreditRequest); 4069 credits.instance = server->reconnect_instance; 4070 } 4071 4072 release_mid(mid); 4073 add_credits(server, &credits, CIFS_ECHO_OP); 4074 } 4075 4076 void smb2_reconnect_server(struct work_struct *work) 4077 { 4078 struct TCP_Server_Info *server = container_of(work, 4079 struct TCP_Server_Info, reconnect.work); 4080 struct TCP_Server_Info *pserver; 4081 struct cifs_ses *ses, *ses2; 4082 struct cifs_tcon *tcon, *tcon2; 4083 struct list_head tmp_list, tmp_ses_list; 4084 bool ses_exist = false; 4085 bool tcon_selected = false; 4086 int rc; 4087 bool resched = false; 4088 4089 /* first check if ref count has reached 0, if not inc ref count */ 4090 spin_lock(&cifs_tcp_ses_lock); 4091 if (!server->srv_count) { 4092 spin_unlock(&cifs_tcp_ses_lock); 4093 return; 4094 } 4095 server->srv_count++; 4096 spin_unlock(&cifs_tcp_ses_lock); 4097 4098 /* If server is a channel, select the primary channel */ 4099 pserver = SERVER_IS_CHAN(server) ? server->primary_server : server; 4100 4101 /* Prevent simultaneous reconnects that can corrupt tcon->rlist list */ 4102 mutex_lock(&pserver->reconnect_mutex); 4103 4104 /* if the server is marked for termination, drop the ref count here */ 4105 if (server->terminate) { 4106 cifs_put_tcp_session(server, true); 4107 mutex_unlock(&pserver->reconnect_mutex); 4108 return; 4109 } 4110 4111 INIT_LIST_HEAD(&tmp_list); 4112 INIT_LIST_HEAD(&tmp_ses_list); 4113 cifs_dbg(FYI, "Reconnecting tcons and channels\n"); 4114 4115 spin_lock(&cifs_tcp_ses_lock); 4116 list_for_each_entry(ses, &pserver->smb_ses_list, smb_ses_list) { 4117 spin_lock(&ses->ses_lock); 4118 if (ses->ses_status == SES_EXITING) { 4119 spin_unlock(&ses->ses_lock); 4120 continue; 4121 } 4122 spin_unlock(&ses->ses_lock); 4123 4124 tcon_selected = false; 4125 4126 list_for_each_entry(tcon, &ses->tcon_list, tcon_list) { 4127 if (tcon->need_reconnect || tcon->need_reopen_files) { 4128 tcon->tc_count++; 4129 list_add_tail(&tcon->rlist, &tmp_list); 4130 tcon_selected = true; 4131 } 4132 } 4133 /* 4134 * IPC has the same lifetime as its session and uses its 4135 * refcount. 4136 */ 4137 if (ses->tcon_ipc && ses->tcon_ipc->need_reconnect) { 4138 list_add_tail(&ses->tcon_ipc->rlist, &tmp_list); 4139 tcon_selected = true; 4140 cifs_smb_ses_inc_refcount(ses); 4141 } 4142 /* 4143 * handle the case where channel needs to reconnect 4144 * binding session, but tcon is healthy (some other channel 4145 * is active) 4146 */ 4147 spin_lock(&ses->chan_lock); 4148 if (!tcon_selected && cifs_chan_needs_reconnect(ses, server)) { 4149 list_add_tail(&ses->rlist, &tmp_ses_list); 4150 ses_exist = true; 4151 cifs_smb_ses_inc_refcount(ses); 4152 } 4153 spin_unlock(&ses->chan_lock); 4154 } 4155 spin_unlock(&cifs_tcp_ses_lock); 4156 4157 list_for_each_entry_safe(tcon, tcon2, &tmp_list, rlist) { 4158 rc = smb2_reconnect(SMB2_INTERNAL_CMD, tcon, server, true); 4159 if (!rc) 4160 cifs_reopen_persistent_handles(tcon); 4161 else 4162 resched = true; 4163 list_del_init(&tcon->rlist); 4164 if (tcon->ipc) 4165 cifs_put_smb_ses(tcon->ses); 4166 else 4167 cifs_put_tcon(tcon); 4168 } 4169 4170 if (!ses_exist) 4171 goto done; 4172 4173 /* allocate a dummy tcon struct used for reconnect */ 4174 tcon = tcon_info_alloc(false); 4175 if (!tcon) { 4176 resched = true; 4177 list_for_each_entry_safe(ses, ses2, &tmp_ses_list, rlist) { 4178 list_del_init(&ses->rlist); 4179 cifs_put_smb_ses(ses); 4180 } 4181 goto done; 4182 } 4183 4184 tcon->status = TID_GOOD; 4185 tcon->retry = false; 4186 tcon->need_reconnect = false; 4187 4188 /* now reconnect sessions for necessary channels */ 4189 list_for_each_entry_safe(ses, ses2, &tmp_ses_list, rlist) { 4190 tcon->ses = ses; 4191 rc = smb2_reconnect(SMB2_INTERNAL_CMD, tcon, server, true); 4192 if (rc) 4193 resched = true; 4194 list_del_init(&ses->rlist); 4195 cifs_put_smb_ses(ses); 4196 } 4197 tconInfoFree(tcon); 4198 4199 done: 4200 cifs_dbg(FYI, "Reconnecting tcons and channels finished\n"); 4201 if (resched) 4202 queue_delayed_work(cifsiod_wq, &server->reconnect, 2 * HZ); 4203 mutex_unlock(&pserver->reconnect_mutex); 4204 4205 /* now we can safely release srv struct */ 4206 cifs_put_tcp_session(server, true); 4207 } 4208 4209 int 4210 SMB2_echo(struct TCP_Server_Info *server) 4211 { 4212 struct smb2_echo_req *req; 4213 int rc = 0; 4214 struct kvec iov[1]; 4215 struct smb_rqst rqst = { .rq_iov = iov, 4216 .rq_nvec = 1 }; 4217 unsigned int total_len; 4218 4219 cifs_dbg(FYI, "In echo request for conn_id %lld\n", server->conn_id); 4220 4221 spin_lock(&server->srv_lock); 4222 if (server->ops->need_neg && 4223 server->ops->need_neg(server)) { 4224 spin_unlock(&server->srv_lock); 4225 /* No need to send echo on newly established connections */ 4226 mod_delayed_work(cifsiod_wq, &server->reconnect, 0); 4227 return rc; 4228 } 4229 spin_unlock(&server->srv_lock); 4230 4231 rc = smb2_plain_req_init(SMB2_ECHO, NULL, server, 4232 (void **)&req, &total_len); 4233 if (rc) 4234 return rc; 4235 4236 req->hdr.CreditRequest = cpu_to_le16(1); 4237 4238 iov[0].iov_len = total_len; 4239 iov[0].iov_base = (char *)req; 4240 4241 rc = cifs_call_async(server, &rqst, NULL, smb2_echo_callback, NULL, 4242 server, CIFS_ECHO_OP, NULL); 4243 if (rc) 4244 cifs_dbg(FYI, "Echo request failed: %d\n", rc); 4245 4246 cifs_small_buf_release(req); 4247 return rc; 4248 } 4249 4250 void 4251 SMB2_flush_free(struct smb_rqst *rqst) 4252 { 4253 if (rqst && rqst->rq_iov) 4254 cifs_small_buf_release(rqst->rq_iov[0].iov_base); /* request */ 4255 } 4256 4257 int 4258 SMB2_flush_init(const unsigned int xid, struct smb_rqst *rqst, 4259 struct cifs_tcon *tcon, struct TCP_Server_Info *server, 4260 u64 persistent_fid, u64 volatile_fid) 4261 { 4262 struct smb2_flush_req *req; 4263 struct kvec *iov = rqst->rq_iov; 4264 unsigned int total_len; 4265 int rc; 4266 4267 rc = smb2_plain_req_init(SMB2_FLUSH, tcon, server, 4268 (void **) &req, &total_len); 4269 if (rc) 4270 return rc; 4271 4272 req->PersistentFileId = persistent_fid; 4273 req->VolatileFileId = volatile_fid; 4274 4275 iov[0].iov_base = (char *)req; 4276 iov[0].iov_len = total_len; 4277 4278 return 0; 4279 } 4280 4281 int 4282 SMB2_flush(const unsigned int xid, struct cifs_tcon *tcon, u64 persistent_fid, 4283 u64 volatile_fid) 4284 { 4285 struct cifs_ses *ses = tcon->ses; 4286 struct smb_rqst rqst; 4287 struct kvec iov[1]; 4288 struct kvec rsp_iov = {NULL, 0}; 4289 struct TCP_Server_Info *server; 4290 int resp_buftype = CIFS_NO_BUFFER; 4291 int flags = 0; 4292 int rc = 0; 4293 int retries = 0, cur_sleep = 1; 4294 4295 replay_again: 4296 /* reinitialize for possible replay */ 4297 flags = 0; 4298 server = cifs_pick_channel(ses); 4299 4300 cifs_dbg(FYI, "flush\n"); 4301 if (!ses || !(ses->server)) 4302 return -EIO; 4303 4304 if (smb3_encryption_required(tcon)) 4305 flags |= CIFS_TRANSFORM_REQ; 4306 4307 memset(&rqst, 0, sizeof(struct smb_rqst)); 4308 memset(&iov, 0, sizeof(iov)); 4309 rqst.rq_iov = iov; 4310 rqst.rq_nvec = 1; 4311 4312 rc = SMB2_flush_init(xid, &rqst, tcon, server, 4313 persistent_fid, volatile_fid); 4314 if (rc) 4315 goto flush_exit; 4316 4317 trace_smb3_flush_enter(xid, persistent_fid, tcon->tid, ses->Suid); 4318 4319 if (retries) 4320 smb2_set_replay(server, &rqst); 4321 4322 rc = cifs_send_recv(xid, ses, server, 4323 &rqst, &resp_buftype, flags, &rsp_iov); 4324 4325 if (rc != 0) { 4326 cifs_stats_fail_inc(tcon, SMB2_FLUSH_HE); 4327 trace_smb3_flush_err(xid, persistent_fid, tcon->tid, ses->Suid, 4328 rc); 4329 } else 4330 trace_smb3_flush_done(xid, persistent_fid, tcon->tid, 4331 ses->Suid); 4332 4333 flush_exit: 4334 SMB2_flush_free(&rqst); 4335 free_rsp_buf(resp_buftype, rsp_iov.iov_base); 4336 4337 if (is_replayable_error(rc) && 4338 smb2_should_replay(tcon, &retries, &cur_sleep)) 4339 goto replay_again; 4340 4341 return rc; 4342 } 4343 4344 #ifdef CONFIG_CIFS_SMB_DIRECT 4345 static inline bool smb3_use_rdma_offload(struct cifs_io_parms *io_parms) 4346 { 4347 struct TCP_Server_Info *server = io_parms->server; 4348 struct cifs_tcon *tcon = io_parms->tcon; 4349 4350 /* we can only offload if we're connected */ 4351 if (!server || !tcon) 4352 return false; 4353 4354 /* we can only offload on an rdma connection */ 4355 if (!server->rdma || !server->smbd_conn) 4356 return false; 4357 4358 /* we don't support signed offload yet */ 4359 if (server->sign) 4360 return false; 4361 4362 /* we don't support encrypted offload yet */ 4363 if (smb3_encryption_required(tcon)) 4364 return false; 4365 4366 /* offload also has its overhead, so only do it if desired */ 4367 if (io_parms->length < server->smbd_conn->rdma_readwrite_threshold) 4368 return false; 4369 4370 return true; 4371 } 4372 #endif /* CONFIG_CIFS_SMB_DIRECT */ 4373 4374 /* 4375 * To form a chain of read requests, any read requests after the first should 4376 * have the end_of_chain boolean set to true. 4377 */ 4378 static int 4379 smb2_new_read_req(void **buf, unsigned int *total_len, 4380 struct cifs_io_parms *io_parms, struct cifs_readdata *rdata, 4381 unsigned int remaining_bytes, int request_type) 4382 { 4383 int rc = -EACCES; 4384 struct smb2_read_req *req = NULL; 4385 struct smb2_hdr *shdr; 4386 struct TCP_Server_Info *server = io_parms->server; 4387 4388 rc = smb2_plain_req_init(SMB2_READ, io_parms->tcon, server, 4389 (void **) &req, total_len); 4390 if (rc) 4391 return rc; 4392 4393 if (server == NULL) 4394 return -ECONNABORTED; 4395 4396 shdr = &req->hdr; 4397 shdr->Id.SyncId.ProcessId = cpu_to_le32(io_parms->pid); 4398 4399 req->PersistentFileId = io_parms->persistent_fid; 4400 req->VolatileFileId = io_parms->volatile_fid; 4401 req->ReadChannelInfoOffset = 0; /* reserved */ 4402 req->ReadChannelInfoLength = 0; /* reserved */ 4403 req->Channel = 0; /* reserved */ 4404 req->MinimumCount = 0; 4405 req->Length = cpu_to_le32(io_parms->length); 4406 req->Offset = cpu_to_le64(io_parms->offset); 4407 4408 trace_smb3_read_enter(0 /* xid */, 4409 io_parms->persistent_fid, 4410 io_parms->tcon->tid, io_parms->tcon->ses->Suid, 4411 io_parms->offset, io_parms->length); 4412 #ifdef CONFIG_CIFS_SMB_DIRECT 4413 /* 4414 * If we want to do a RDMA write, fill in and append 4415 * smbd_buffer_descriptor_v1 to the end of read request 4416 */ 4417 if (smb3_use_rdma_offload(io_parms)) { 4418 struct smbd_buffer_descriptor_v1 *v1; 4419 bool need_invalidate = server->dialect == SMB30_PROT_ID; 4420 4421 rdata->mr = smbd_register_mr(server->smbd_conn, &rdata->iter, 4422 true, need_invalidate); 4423 if (!rdata->mr) 4424 return -EAGAIN; 4425 4426 req->Channel = SMB2_CHANNEL_RDMA_V1_INVALIDATE; 4427 if (need_invalidate) 4428 req->Channel = SMB2_CHANNEL_RDMA_V1; 4429 req->ReadChannelInfoOffset = 4430 cpu_to_le16(offsetof(struct smb2_read_req, Buffer)); 4431 req->ReadChannelInfoLength = 4432 cpu_to_le16(sizeof(struct smbd_buffer_descriptor_v1)); 4433 v1 = (struct smbd_buffer_descriptor_v1 *) &req->Buffer[0]; 4434 v1->offset = cpu_to_le64(rdata->mr->mr->iova); 4435 v1->token = cpu_to_le32(rdata->mr->mr->rkey); 4436 v1->length = cpu_to_le32(rdata->mr->mr->length); 4437 4438 *total_len += sizeof(*v1) - 1; 4439 } 4440 #endif 4441 if (request_type & CHAINED_REQUEST) { 4442 if (!(request_type & END_OF_CHAIN)) { 4443 /* next 8-byte aligned request */ 4444 *total_len = ALIGN(*total_len, 8); 4445 shdr->NextCommand = cpu_to_le32(*total_len); 4446 } else /* END_OF_CHAIN */ 4447 shdr->NextCommand = 0; 4448 if (request_type & RELATED_REQUEST) { 4449 shdr->Flags |= SMB2_FLAGS_RELATED_OPERATIONS; 4450 /* 4451 * Related requests use info from previous read request 4452 * in chain. 4453 */ 4454 shdr->SessionId = cpu_to_le64(0xFFFFFFFFFFFFFFFF); 4455 shdr->Id.SyncId.TreeId = cpu_to_le32(0xFFFFFFFF); 4456 req->PersistentFileId = (u64)-1; 4457 req->VolatileFileId = (u64)-1; 4458 } 4459 } 4460 if (remaining_bytes > io_parms->length) 4461 req->RemainingBytes = cpu_to_le32(remaining_bytes); 4462 else 4463 req->RemainingBytes = 0; 4464 4465 *buf = req; 4466 return rc; 4467 } 4468 4469 static void 4470 smb2_readv_callback(struct mid_q_entry *mid) 4471 { 4472 struct cifs_readdata *rdata = mid->callback_data; 4473 struct cifs_tcon *tcon = tlink_tcon(rdata->cfile->tlink); 4474 struct TCP_Server_Info *server = rdata->server; 4475 struct smb2_hdr *shdr = 4476 (struct smb2_hdr *)rdata->iov[0].iov_base; 4477 struct cifs_credits credits = { .value = 0, .instance = 0 }; 4478 struct smb_rqst rqst = { .rq_iov = &rdata->iov[1], .rq_nvec = 1 }; 4479 4480 if (rdata->got_bytes) { 4481 rqst.rq_iter = rdata->iter; 4482 rqst.rq_iter_size = iov_iter_count(&rdata->iter); 4483 } 4484 4485 WARN_ONCE(rdata->server != mid->server, 4486 "rdata server %p != mid server %p", 4487 rdata->server, mid->server); 4488 4489 cifs_dbg(FYI, "%s: mid=%llu state=%d result=%d bytes=%u\n", 4490 __func__, mid->mid, mid->mid_state, rdata->result, 4491 rdata->bytes); 4492 4493 switch (mid->mid_state) { 4494 case MID_RESPONSE_RECEIVED: 4495 credits.value = le16_to_cpu(shdr->CreditRequest); 4496 credits.instance = server->reconnect_instance; 4497 /* result already set, check signature */ 4498 if (server->sign && !mid->decrypted) { 4499 int rc; 4500 4501 iov_iter_revert(&rqst.rq_iter, rdata->got_bytes); 4502 iov_iter_truncate(&rqst.rq_iter, rdata->got_bytes); 4503 rc = smb2_verify_signature(&rqst, server); 4504 if (rc) 4505 cifs_tcon_dbg(VFS, "SMB signature verification returned error = %d\n", 4506 rc); 4507 } 4508 /* FIXME: should this be counted toward the initiating task? */ 4509 task_io_account_read(rdata->got_bytes); 4510 cifs_stats_bytes_read(tcon, rdata->got_bytes); 4511 break; 4512 case MID_REQUEST_SUBMITTED: 4513 case MID_RETRY_NEEDED: 4514 rdata->result = -EAGAIN; 4515 if (server->sign && rdata->got_bytes) 4516 /* reset bytes number since we can not check a sign */ 4517 rdata->got_bytes = 0; 4518 /* FIXME: should this be counted toward the initiating task? */ 4519 task_io_account_read(rdata->got_bytes); 4520 cifs_stats_bytes_read(tcon, rdata->got_bytes); 4521 break; 4522 case MID_RESPONSE_MALFORMED: 4523 credits.value = le16_to_cpu(shdr->CreditRequest); 4524 credits.instance = server->reconnect_instance; 4525 fallthrough; 4526 default: 4527 rdata->result = -EIO; 4528 } 4529 #ifdef CONFIG_CIFS_SMB_DIRECT 4530 /* 4531 * If this rdata has a memmory registered, the MR can be freed 4532 * MR needs to be freed as soon as I/O finishes to prevent deadlock 4533 * because they have limited number and are used for future I/Os 4534 */ 4535 if (rdata->mr) { 4536 smbd_deregister_mr(rdata->mr); 4537 rdata->mr = NULL; 4538 } 4539 #endif 4540 if (rdata->result && rdata->result != -ENODATA) { 4541 cifs_stats_fail_inc(tcon, SMB2_READ_HE); 4542 trace_smb3_read_err(0 /* xid */, 4543 rdata->cfile->fid.persistent_fid, 4544 tcon->tid, tcon->ses->Suid, rdata->offset, 4545 rdata->bytes, rdata->result); 4546 } else 4547 trace_smb3_read_done(0 /* xid */, 4548 rdata->cfile->fid.persistent_fid, 4549 tcon->tid, tcon->ses->Suid, 4550 rdata->offset, rdata->got_bytes); 4551 4552 queue_work(cifsiod_wq, &rdata->work); 4553 release_mid(mid); 4554 add_credits(server, &credits, 0); 4555 } 4556 4557 /* smb2_async_readv - send an async read, and set up mid to handle result */ 4558 int 4559 smb2_async_readv(struct cifs_readdata *rdata) 4560 { 4561 int rc, flags = 0; 4562 char *buf; 4563 struct smb2_hdr *shdr; 4564 struct cifs_io_parms io_parms; 4565 struct smb_rqst rqst = { .rq_iov = rdata->iov, 4566 .rq_nvec = 1 }; 4567 struct TCP_Server_Info *server; 4568 struct cifs_tcon *tcon = tlink_tcon(rdata->cfile->tlink); 4569 unsigned int total_len; 4570 int credit_request; 4571 4572 cifs_dbg(FYI, "%s: offset=%llu bytes=%u\n", 4573 __func__, rdata->offset, rdata->bytes); 4574 4575 if (!rdata->server) 4576 rdata->server = cifs_pick_channel(tcon->ses); 4577 4578 io_parms.tcon = tlink_tcon(rdata->cfile->tlink); 4579 io_parms.server = server = rdata->server; 4580 io_parms.offset = rdata->offset; 4581 io_parms.length = rdata->bytes; 4582 io_parms.persistent_fid = rdata->cfile->fid.persistent_fid; 4583 io_parms.volatile_fid = rdata->cfile->fid.volatile_fid; 4584 io_parms.pid = rdata->pid; 4585 4586 rc = smb2_new_read_req( 4587 (void **) &buf, &total_len, &io_parms, rdata, 0, 0); 4588 if (rc) 4589 return rc; 4590 4591 if (smb3_encryption_required(io_parms.tcon)) 4592 flags |= CIFS_TRANSFORM_REQ; 4593 4594 rdata->iov[0].iov_base = buf; 4595 rdata->iov[0].iov_len = total_len; 4596 4597 shdr = (struct smb2_hdr *)buf; 4598 4599 if (rdata->credits.value > 0) { 4600 shdr->CreditCharge = cpu_to_le16(DIV_ROUND_UP(rdata->bytes, 4601 SMB2_MAX_BUFFER_SIZE)); 4602 credit_request = le16_to_cpu(shdr->CreditCharge) + 8; 4603 if (server->credits >= server->max_credits) 4604 shdr->CreditRequest = cpu_to_le16(0); 4605 else 4606 shdr->CreditRequest = cpu_to_le16( 4607 min_t(int, server->max_credits - 4608 server->credits, credit_request)); 4609 4610 rc = adjust_credits(server, &rdata->credits, rdata->bytes); 4611 if (rc) 4612 goto async_readv_out; 4613 4614 flags |= CIFS_HAS_CREDITS; 4615 } 4616 4617 kref_get(&rdata->refcount); 4618 rc = cifs_call_async(server, &rqst, 4619 cifs_readv_receive, smb2_readv_callback, 4620 smb3_handle_read_data, rdata, flags, 4621 &rdata->credits); 4622 if (rc) { 4623 kref_put(&rdata->refcount, cifs_readdata_release); 4624 cifs_stats_fail_inc(io_parms.tcon, SMB2_READ_HE); 4625 trace_smb3_read_err(0 /* xid */, io_parms.persistent_fid, 4626 io_parms.tcon->tid, 4627 io_parms.tcon->ses->Suid, 4628 io_parms.offset, io_parms.length, rc); 4629 } 4630 4631 async_readv_out: 4632 cifs_small_buf_release(buf); 4633 return rc; 4634 } 4635 4636 int 4637 SMB2_read(const unsigned int xid, struct cifs_io_parms *io_parms, 4638 unsigned int *nbytes, char **buf, int *buf_type) 4639 { 4640 struct smb_rqst rqst; 4641 int resp_buftype, rc; 4642 struct smb2_read_req *req = NULL; 4643 struct smb2_read_rsp *rsp = NULL; 4644 struct kvec iov[1]; 4645 struct kvec rsp_iov; 4646 unsigned int total_len; 4647 int flags = CIFS_LOG_ERROR; 4648 struct cifs_ses *ses = io_parms->tcon->ses; 4649 4650 if (!io_parms->server) 4651 io_parms->server = cifs_pick_channel(io_parms->tcon->ses); 4652 4653 *nbytes = 0; 4654 rc = smb2_new_read_req((void **)&req, &total_len, io_parms, NULL, 0, 0); 4655 if (rc) 4656 return rc; 4657 4658 if (smb3_encryption_required(io_parms->tcon)) 4659 flags |= CIFS_TRANSFORM_REQ; 4660 4661 iov[0].iov_base = (char *)req; 4662 iov[0].iov_len = total_len; 4663 4664 memset(&rqst, 0, sizeof(struct smb_rqst)); 4665 rqst.rq_iov = iov; 4666 rqst.rq_nvec = 1; 4667 4668 rc = cifs_send_recv(xid, ses, io_parms->server, 4669 &rqst, &resp_buftype, flags, &rsp_iov); 4670 rsp = (struct smb2_read_rsp *)rsp_iov.iov_base; 4671 4672 if (rc) { 4673 if (rc != -ENODATA) { 4674 cifs_stats_fail_inc(io_parms->tcon, SMB2_READ_HE); 4675 cifs_dbg(VFS, "Send error in read = %d\n", rc); 4676 trace_smb3_read_err(xid, 4677 req->PersistentFileId, 4678 io_parms->tcon->tid, ses->Suid, 4679 io_parms->offset, io_parms->length, 4680 rc); 4681 } else 4682 trace_smb3_read_done(xid, req->PersistentFileId, io_parms->tcon->tid, 4683 ses->Suid, io_parms->offset, 0); 4684 free_rsp_buf(resp_buftype, rsp_iov.iov_base); 4685 cifs_small_buf_release(req); 4686 return rc == -ENODATA ? 0 : rc; 4687 } else 4688 trace_smb3_read_done(xid, 4689 req->PersistentFileId, 4690 io_parms->tcon->tid, ses->Suid, 4691 io_parms->offset, io_parms->length); 4692 4693 cifs_small_buf_release(req); 4694 4695 *nbytes = le32_to_cpu(rsp->DataLength); 4696 if ((*nbytes > CIFS_MAX_MSGSIZE) || 4697 (*nbytes > io_parms->length)) { 4698 cifs_dbg(FYI, "bad length %d for count %d\n", 4699 *nbytes, io_parms->length); 4700 rc = -EIO; 4701 *nbytes = 0; 4702 } 4703 4704 if (*buf) { 4705 memcpy(*buf, (char *)rsp + rsp->DataOffset, *nbytes); 4706 free_rsp_buf(resp_buftype, rsp_iov.iov_base); 4707 } else if (resp_buftype != CIFS_NO_BUFFER) { 4708 *buf = rsp_iov.iov_base; 4709 if (resp_buftype == CIFS_SMALL_BUFFER) 4710 *buf_type = CIFS_SMALL_BUFFER; 4711 else if (resp_buftype == CIFS_LARGE_BUFFER) 4712 *buf_type = CIFS_LARGE_BUFFER; 4713 } 4714 return rc; 4715 } 4716 4717 /* 4718 * Check the mid_state and signature on received buffer (if any), and queue the 4719 * workqueue completion task. 4720 */ 4721 static void 4722 smb2_writev_callback(struct mid_q_entry *mid) 4723 { 4724 struct cifs_writedata *wdata = mid->callback_data; 4725 struct cifs_tcon *tcon = tlink_tcon(wdata->cfile->tlink); 4726 struct TCP_Server_Info *server = wdata->server; 4727 unsigned int written; 4728 struct smb2_write_rsp *rsp = (struct smb2_write_rsp *)mid->resp_buf; 4729 struct cifs_credits credits = { .value = 0, .instance = 0 }; 4730 4731 WARN_ONCE(wdata->server != mid->server, 4732 "wdata server %p != mid server %p", 4733 wdata->server, mid->server); 4734 4735 switch (mid->mid_state) { 4736 case MID_RESPONSE_RECEIVED: 4737 credits.value = le16_to_cpu(rsp->hdr.CreditRequest); 4738 credits.instance = server->reconnect_instance; 4739 wdata->result = smb2_check_receive(mid, server, 0); 4740 if (wdata->result != 0) 4741 break; 4742 4743 written = le32_to_cpu(rsp->DataLength); 4744 /* 4745 * Mask off high 16 bits when bytes written as returned 4746 * by the server is greater than bytes requested by the 4747 * client. OS/2 servers are known to set incorrect 4748 * CountHigh values. 4749 */ 4750 if (written > wdata->bytes) 4751 written &= 0xFFFF; 4752 4753 if (written < wdata->bytes) 4754 wdata->result = -ENOSPC; 4755 else 4756 wdata->bytes = written; 4757 break; 4758 case MID_REQUEST_SUBMITTED: 4759 case MID_RETRY_NEEDED: 4760 wdata->result = -EAGAIN; 4761 break; 4762 case MID_RESPONSE_MALFORMED: 4763 credits.value = le16_to_cpu(rsp->hdr.CreditRequest); 4764 credits.instance = server->reconnect_instance; 4765 fallthrough; 4766 default: 4767 wdata->result = -EIO; 4768 break; 4769 } 4770 #ifdef CONFIG_CIFS_SMB_DIRECT 4771 /* 4772 * If this wdata has a memory registered, the MR can be freed 4773 * The number of MRs available is limited, it's important to recover 4774 * used MR as soon as I/O is finished. Hold MR longer in the later 4775 * I/O process can possibly result in I/O deadlock due to lack of MR 4776 * to send request on I/O retry 4777 */ 4778 if (wdata->mr) { 4779 smbd_deregister_mr(wdata->mr); 4780 wdata->mr = NULL; 4781 } 4782 #endif 4783 if (wdata->result) { 4784 cifs_stats_fail_inc(tcon, SMB2_WRITE_HE); 4785 trace_smb3_write_err(0 /* no xid */, 4786 wdata->cfile->fid.persistent_fid, 4787 tcon->tid, tcon->ses->Suid, wdata->offset, 4788 wdata->bytes, wdata->result); 4789 if (wdata->result == -ENOSPC) 4790 pr_warn_once("Out of space writing to %s\n", 4791 tcon->tree_name); 4792 } else 4793 trace_smb3_write_done(0 /* no xid */, 4794 wdata->cfile->fid.persistent_fid, 4795 tcon->tid, tcon->ses->Suid, 4796 wdata->offset, wdata->bytes); 4797 4798 queue_work(cifsiod_wq, &wdata->work); 4799 release_mid(mid); 4800 add_credits(server, &credits, 0); 4801 } 4802 4803 /* smb2_async_writev - send an async write, and set up mid to handle result */ 4804 int 4805 smb2_async_writev(struct cifs_writedata *wdata, 4806 void (*release)(struct kref *kref)) 4807 { 4808 int rc = -EACCES, flags = 0; 4809 struct smb2_write_req *req = NULL; 4810 struct smb2_hdr *shdr; 4811 struct cifs_tcon *tcon = tlink_tcon(wdata->cfile->tlink); 4812 struct TCP_Server_Info *server = wdata->server; 4813 struct kvec iov[1]; 4814 struct smb_rqst rqst = { }; 4815 unsigned int total_len; 4816 struct cifs_io_parms _io_parms; 4817 struct cifs_io_parms *io_parms = NULL; 4818 int credit_request; 4819 4820 if (!wdata->server || wdata->replay) 4821 server = wdata->server = cifs_pick_channel(tcon->ses); 4822 4823 /* 4824 * in future we may get cifs_io_parms passed in from the caller, 4825 * but for now we construct it here... 4826 */ 4827 _io_parms = (struct cifs_io_parms) { 4828 .tcon = tcon, 4829 .server = server, 4830 .offset = wdata->offset, 4831 .length = wdata->bytes, 4832 .persistent_fid = wdata->cfile->fid.persistent_fid, 4833 .volatile_fid = wdata->cfile->fid.volatile_fid, 4834 .pid = wdata->pid, 4835 }; 4836 io_parms = &_io_parms; 4837 4838 rc = smb2_plain_req_init(SMB2_WRITE, tcon, server, 4839 (void **) &req, &total_len); 4840 if (rc) 4841 return rc; 4842 4843 if (smb3_encryption_required(tcon)) 4844 flags |= CIFS_TRANSFORM_REQ; 4845 4846 shdr = (struct smb2_hdr *)req; 4847 shdr->Id.SyncId.ProcessId = cpu_to_le32(io_parms->pid); 4848 4849 req->PersistentFileId = io_parms->persistent_fid; 4850 req->VolatileFileId = io_parms->volatile_fid; 4851 req->WriteChannelInfoOffset = 0; 4852 req->WriteChannelInfoLength = 0; 4853 req->Channel = SMB2_CHANNEL_NONE; 4854 req->Offset = cpu_to_le64(io_parms->offset); 4855 req->DataOffset = cpu_to_le16( 4856 offsetof(struct smb2_write_req, Buffer)); 4857 req->RemainingBytes = 0; 4858 4859 trace_smb3_write_enter(0 /* xid */, 4860 io_parms->persistent_fid, 4861 io_parms->tcon->tid, 4862 io_parms->tcon->ses->Suid, 4863 io_parms->offset, 4864 io_parms->length); 4865 4866 #ifdef CONFIG_CIFS_SMB_DIRECT 4867 /* 4868 * If we want to do a server RDMA read, fill in and append 4869 * smbd_buffer_descriptor_v1 to the end of write request 4870 */ 4871 if (smb3_use_rdma_offload(io_parms)) { 4872 struct smbd_buffer_descriptor_v1 *v1; 4873 size_t data_size = iov_iter_count(&wdata->iter); 4874 bool need_invalidate = server->dialect == SMB30_PROT_ID; 4875 4876 wdata->mr = smbd_register_mr(server->smbd_conn, &wdata->iter, 4877 false, need_invalidate); 4878 if (!wdata->mr) { 4879 rc = -EAGAIN; 4880 goto async_writev_out; 4881 } 4882 req->Length = 0; 4883 req->DataOffset = 0; 4884 req->RemainingBytes = cpu_to_le32(data_size); 4885 req->Channel = SMB2_CHANNEL_RDMA_V1_INVALIDATE; 4886 if (need_invalidate) 4887 req->Channel = SMB2_CHANNEL_RDMA_V1; 4888 req->WriteChannelInfoOffset = 4889 cpu_to_le16(offsetof(struct smb2_write_req, Buffer)); 4890 req->WriteChannelInfoLength = 4891 cpu_to_le16(sizeof(struct smbd_buffer_descriptor_v1)); 4892 v1 = (struct smbd_buffer_descriptor_v1 *) &req->Buffer[0]; 4893 v1->offset = cpu_to_le64(wdata->mr->mr->iova); 4894 v1->token = cpu_to_le32(wdata->mr->mr->rkey); 4895 v1->length = cpu_to_le32(wdata->mr->mr->length); 4896 } 4897 #endif 4898 iov[0].iov_len = total_len - 1; 4899 iov[0].iov_base = (char *)req; 4900 4901 rqst.rq_iov = iov; 4902 rqst.rq_nvec = 1; 4903 rqst.rq_iter = wdata->iter; 4904 rqst.rq_iter_size = iov_iter_count(&rqst.rq_iter); 4905 if (wdata->replay) 4906 smb2_set_replay(server, &rqst); 4907 #ifdef CONFIG_CIFS_SMB_DIRECT 4908 if (wdata->mr) 4909 iov[0].iov_len += sizeof(struct smbd_buffer_descriptor_v1); 4910 #endif 4911 cifs_dbg(FYI, "async write at %llu %u bytes iter=%zx\n", 4912 io_parms->offset, io_parms->length, iov_iter_count(&rqst.rq_iter)); 4913 4914 #ifdef CONFIG_CIFS_SMB_DIRECT 4915 /* For RDMA read, I/O size is in RemainingBytes not in Length */ 4916 if (!wdata->mr) 4917 req->Length = cpu_to_le32(io_parms->length); 4918 #else 4919 req->Length = cpu_to_le32(io_parms->length); 4920 #endif 4921 4922 if (wdata->credits.value > 0) { 4923 shdr->CreditCharge = cpu_to_le16(DIV_ROUND_UP(wdata->bytes, 4924 SMB2_MAX_BUFFER_SIZE)); 4925 credit_request = le16_to_cpu(shdr->CreditCharge) + 8; 4926 if (server->credits >= server->max_credits) 4927 shdr->CreditRequest = cpu_to_le16(0); 4928 else 4929 shdr->CreditRequest = cpu_to_le16( 4930 min_t(int, server->max_credits - 4931 server->credits, credit_request)); 4932 4933 rc = adjust_credits(server, &wdata->credits, io_parms->length); 4934 if (rc) 4935 goto async_writev_out; 4936 4937 flags |= CIFS_HAS_CREDITS; 4938 } 4939 4940 kref_get(&wdata->refcount); 4941 rc = cifs_call_async(server, &rqst, NULL, smb2_writev_callback, NULL, 4942 wdata, flags, &wdata->credits); 4943 4944 if (rc) { 4945 trace_smb3_write_err(0 /* no xid */, 4946 io_parms->persistent_fid, 4947 io_parms->tcon->tid, 4948 io_parms->tcon->ses->Suid, 4949 io_parms->offset, 4950 io_parms->length, 4951 rc); 4952 kref_put(&wdata->refcount, release); 4953 cifs_stats_fail_inc(tcon, SMB2_WRITE_HE); 4954 } 4955 4956 async_writev_out: 4957 cifs_small_buf_release(req); 4958 return rc; 4959 } 4960 4961 /* 4962 * SMB2_write function gets iov pointer to kvec array with n_vec as a length. 4963 * The length field from io_parms must be at least 1 and indicates a number of 4964 * elements with data to write that begins with position 1 in iov array. All 4965 * data length is specified by count. 4966 */ 4967 int 4968 SMB2_write(const unsigned int xid, struct cifs_io_parms *io_parms, 4969 unsigned int *nbytes, struct kvec *iov, int n_vec) 4970 { 4971 struct smb_rqst rqst; 4972 int rc = 0; 4973 struct smb2_write_req *req = NULL; 4974 struct smb2_write_rsp *rsp = NULL; 4975 int resp_buftype; 4976 struct kvec rsp_iov; 4977 int flags = 0; 4978 unsigned int total_len; 4979 struct TCP_Server_Info *server; 4980 int retries = 0, cur_sleep = 1; 4981 4982 replay_again: 4983 /* reinitialize for possible replay */ 4984 flags = 0; 4985 *nbytes = 0; 4986 if (!io_parms->server) 4987 io_parms->server = cifs_pick_channel(io_parms->tcon->ses); 4988 server = io_parms->server; 4989 if (server == NULL) 4990 return -ECONNABORTED; 4991 4992 if (n_vec < 1) 4993 return rc; 4994 4995 rc = smb2_plain_req_init(SMB2_WRITE, io_parms->tcon, server, 4996 (void **) &req, &total_len); 4997 if (rc) 4998 return rc; 4999 5000 if (smb3_encryption_required(io_parms->tcon)) 5001 flags |= CIFS_TRANSFORM_REQ; 5002 5003 req->hdr.Id.SyncId.ProcessId = cpu_to_le32(io_parms->pid); 5004 5005 req->PersistentFileId = io_parms->persistent_fid; 5006 req->VolatileFileId = io_parms->volatile_fid; 5007 req->WriteChannelInfoOffset = 0; 5008 req->WriteChannelInfoLength = 0; 5009 req->Channel = 0; 5010 req->Length = cpu_to_le32(io_parms->length); 5011 req->Offset = cpu_to_le64(io_parms->offset); 5012 req->DataOffset = cpu_to_le16( 5013 offsetof(struct smb2_write_req, Buffer)); 5014 req->RemainingBytes = 0; 5015 5016 trace_smb3_write_enter(xid, io_parms->persistent_fid, 5017 io_parms->tcon->tid, io_parms->tcon->ses->Suid, 5018 io_parms->offset, io_parms->length); 5019 5020 iov[0].iov_base = (char *)req; 5021 /* 1 for Buffer */ 5022 iov[0].iov_len = total_len - 1; 5023 5024 memset(&rqst, 0, sizeof(struct smb_rqst)); 5025 rqst.rq_iov = iov; 5026 rqst.rq_nvec = n_vec + 1; 5027 5028 if (retries) 5029 smb2_set_replay(server, &rqst); 5030 5031 rc = cifs_send_recv(xid, io_parms->tcon->ses, server, 5032 &rqst, 5033 &resp_buftype, flags, &rsp_iov); 5034 rsp = (struct smb2_write_rsp *)rsp_iov.iov_base; 5035 5036 if (rc) { 5037 trace_smb3_write_err(xid, 5038 req->PersistentFileId, 5039 io_parms->tcon->tid, 5040 io_parms->tcon->ses->Suid, 5041 io_parms->offset, io_parms->length, rc); 5042 cifs_stats_fail_inc(io_parms->tcon, SMB2_WRITE_HE); 5043 cifs_dbg(VFS, "Send error in write = %d\n", rc); 5044 } else { 5045 *nbytes = le32_to_cpu(rsp->DataLength); 5046 trace_smb3_write_done(xid, 5047 req->PersistentFileId, 5048 io_parms->tcon->tid, 5049 io_parms->tcon->ses->Suid, 5050 io_parms->offset, *nbytes); 5051 } 5052 5053 cifs_small_buf_release(req); 5054 free_rsp_buf(resp_buftype, rsp); 5055 5056 if (is_replayable_error(rc) && 5057 smb2_should_replay(io_parms->tcon, &retries, &cur_sleep)) 5058 goto replay_again; 5059 5060 return rc; 5061 } 5062 5063 int posix_info_sid_size(const void *beg, const void *end) 5064 { 5065 size_t subauth; 5066 int total; 5067 5068 if (beg + 1 > end) 5069 return -1; 5070 5071 subauth = *(u8 *)(beg+1); 5072 if (subauth < 1 || subauth > 15) 5073 return -1; 5074 5075 total = 1 + 1 + 6 + 4*subauth; 5076 if (beg + total > end) 5077 return -1; 5078 5079 return total; 5080 } 5081 5082 int posix_info_parse(const void *beg, const void *end, 5083 struct smb2_posix_info_parsed *out) 5084 5085 { 5086 int total_len = 0; 5087 int owner_len, group_len; 5088 int name_len; 5089 const void *owner_sid; 5090 const void *group_sid; 5091 const void *name; 5092 5093 /* if no end bound given, assume payload to be correct */ 5094 if (!end) { 5095 const struct smb2_posix_info *p = beg; 5096 5097 end = beg + le32_to_cpu(p->NextEntryOffset); 5098 /* last element will have a 0 offset, pick a sensible bound */ 5099 if (end == beg) 5100 end += 0xFFFF; 5101 } 5102 5103 /* check base buf */ 5104 if (beg + sizeof(struct smb2_posix_info) > end) 5105 return -1; 5106 total_len = sizeof(struct smb2_posix_info); 5107 5108 /* check owner sid */ 5109 owner_sid = beg + total_len; 5110 owner_len = posix_info_sid_size(owner_sid, end); 5111 if (owner_len < 0) 5112 return -1; 5113 total_len += owner_len; 5114 5115 /* check group sid */ 5116 group_sid = beg + total_len; 5117 group_len = posix_info_sid_size(group_sid, end); 5118 if (group_len < 0) 5119 return -1; 5120 total_len += group_len; 5121 5122 /* check name len */ 5123 if (beg + total_len + 4 > end) 5124 return -1; 5125 name_len = le32_to_cpu(*(__le32 *)(beg + total_len)); 5126 if (name_len < 1 || name_len > 0xFFFF) 5127 return -1; 5128 total_len += 4; 5129 5130 /* check name */ 5131 name = beg + total_len; 5132 if (name + name_len > end) 5133 return -1; 5134 total_len += name_len; 5135 5136 if (out) { 5137 out->base = beg; 5138 out->size = total_len; 5139 out->name_len = name_len; 5140 out->name = name; 5141 memcpy(&out->owner, owner_sid, owner_len); 5142 memcpy(&out->group, group_sid, group_len); 5143 } 5144 return total_len; 5145 } 5146 5147 static int posix_info_extra_size(const void *beg, const void *end) 5148 { 5149 int len = posix_info_parse(beg, end, NULL); 5150 5151 if (len < 0) 5152 return -1; 5153 return len - sizeof(struct smb2_posix_info); 5154 } 5155 5156 static unsigned int 5157 num_entries(int infotype, char *bufstart, char *end_of_buf, char **lastentry, 5158 size_t size) 5159 { 5160 int len; 5161 unsigned int entrycount = 0; 5162 unsigned int next_offset = 0; 5163 char *entryptr; 5164 FILE_DIRECTORY_INFO *dir_info; 5165 5166 if (bufstart == NULL) 5167 return 0; 5168 5169 entryptr = bufstart; 5170 5171 while (1) { 5172 if (entryptr + next_offset < entryptr || 5173 entryptr + next_offset > end_of_buf || 5174 entryptr + next_offset + size > end_of_buf) { 5175 cifs_dbg(VFS, "malformed search entry would overflow\n"); 5176 break; 5177 } 5178 5179 entryptr = entryptr + next_offset; 5180 dir_info = (FILE_DIRECTORY_INFO *)entryptr; 5181 5182 if (infotype == SMB_FIND_FILE_POSIX_INFO) 5183 len = posix_info_extra_size(entryptr, end_of_buf); 5184 else 5185 len = le32_to_cpu(dir_info->FileNameLength); 5186 5187 if (len < 0 || 5188 entryptr + len < entryptr || 5189 entryptr + len > end_of_buf || 5190 entryptr + len + size > end_of_buf) { 5191 cifs_dbg(VFS, "directory entry name would overflow frame end of buf %p\n", 5192 end_of_buf); 5193 break; 5194 } 5195 5196 *lastentry = entryptr; 5197 entrycount++; 5198 5199 next_offset = le32_to_cpu(dir_info->NextEntryOffset); 5200 if (!next_offset) 5201 break; 5202 } 5203 5204 return entrycount; 5205 } 5206 5207 /* 5208 * Readdir/FindFirst 5209 */ 5210 int SMB2_query_directory_init(const unsigned int xid, 5211 struct cifs_tcon *tcon, 5212 struct TCP_Server_Info *server, 5213 struct smb_rqst *rqst, 5214 u64 persistent_fid, u64 volatile_fid, 5215 int index, int info_level) 5216 { 5217 struct smb2_query_directory_req *req; 5218 unsigned char *bufptr; 5219 __le16 asteriks = cpu_to_le16('*'); 5220 unsigned int output_size = CIFSMaxBufSize - 5221 MAX_SMB2_CREATE_RESPONSE_SIZE - 5222 MAX_SMB2_CLOSE_RESPONSE_SIZE; 5223 unsigned int total_len; 5224 struct kvec *iov = rqst->rq_iov; 5225 int len, rc; 5226 5227 rc = smb2_plain_req_init(SMB2_QUERY_DIRECTORY, tcon, server, 5228 (void **) &req, &total_len); 5229 if (rc) 5230 return rc; 5231 5232 switch (info_level) { 5233 case SMB_FIND_FILE_DIRECTORY_INFO: 5234 req->FileInformationClass = FILE_DIRECTORY_INFORMATION; 5235 break; 5236 case SMB_FIND_FILE_ID_FULL_DIR_INFO: 5237 req->FileInformationClass = FILEID_FULL_DIRECTORY_INFORMATION; 5238 break; 5239 case SMB_FIND_FILE_POSIX_INFO: 5240 req->FileInformationClass = SMB_FIND_FILE_POSIX_INFO; 5241 break; 5242 case SMB_FIND_FILE_FULL_DIRECTORY_INFO: 5243 req->FileInformationClass = FILE_FULL_DIRECTORY_INFORMATION; 5244 break; 5245 default: 5246 cifs_tcon_dbg(VFS, "info level %u isn't supported\n", 5247 info_level); 5248 return -EINVAL; 5249 } 5250 5251 req->FileIndex = cpu_to_le32(index); 5252 req->PersistentFileId = persistent_fid; 5253 req->VolatileFileId = volatile_fid; 5254 5255 len = 0x2; 5256 bufptr = req->Buffer; 5257 memcpy(bufptr, &asteriks, len); 5258 5259 req->FileNameOffset = 5260 cpu_to_le16(sizeof(struct smb2_query_directory_req)); 5261 req->FileNameLength = cpu_to_le16(len); 5262 /* 5263 * BB could be 30 bytes or so longer if we used SMB2 specific 5264 * buffer lengths, but this is safe and close enough. 5265 */ 5266 output_size = min_t(unsigned int, output_size, server->maxBuf); 5267 output_size = min_t(unsigned int, output_size, 2 << 15); 5268 req->OutputBufferLength = cpu_to_le32(output_size); 5269 5270 iov[0].iov_base = (char *)req; 5271 /* 1 for Buffer */ 5272 iov[0].iov_len = total_len - 1; 5273 5274 iov[1].iov_base = (char *)(req->Buffer); 5275 iov[1].iov_len = len; 5276 5277 trace_smb3_query_dir_enter(xid, persistent_fid, tcon->tid, 5278 tcon->ses->Suid, index, output_size); 5279 5280 return 0; 5281 } 5282 5283 void SMB2_query_directory_free(struct smb_rqst *rqst) 5284 { 5285 if (rqst && rqst->rq_iov) { 5286 cifs_small_buf_release(rqst->rq_iov[0].iov_base); /* request */ 5287 } 5288 } 5289 5290 int 5291 smb2_parse_query_directory(struct cifs_tcon *tcon, 5292 struct kvec *rsp_iov, 5293 int resp_buftype, 5294 struct cifs_search_info *srch_inf) 5295 { 5296 struct smb2_query_directory_rsp *rsp; 5297 size_t info_buf_size; 5298 char *end_of_smb; 5299 int rc; 5300 5301 rsp = (struct smb2_query_directory_rsp *)rsp_iov->iov_base; 5302 5303 switch (srch_inf->info_level) { 5304 case SMB_FIND_FILE_DIRECTORY_INFO: 5305 info_buf_size = sizeof(FILE_DIRECTORY_INFO); 5306 break; 5307 case SMB_FIND_FILE_ID_FULL_DIR_INFO: 5308 info_buf_size = sizeof(SEARCH_ID_FULL_DIR_INFO); 5309 break; 5310 case SMB_FIND_FILE_POSIX_INFO: 5311 /* note that posix payload are variable size */ 5312 info_buf_size = sizeof(struct smb2_posix_info); 5313 break; 5314 case SMB_FIND_FILE_FULL_DIRECTORY_INFO: 5315 info_buf_size = sizeof(FILE_FULL_DIRECTORY_INFO); 5316 break; 5317 default: 5318 cifs_tcon_dbg(VFS, "info level %u isn't supported\n", 5319 srch_inf->info_level); 5320 return -EINVAL; 5321 } 5322 5323 rc = smb2_validate_iov(le16_to_cpu(rsp->OutputBufferOffset), 5324 le32_to_cpu(rsp->OutputBufferLength), rsp_iov, 5325 info_buf_size); 5326 if (rc) { 5327 cifs_tcon_dbg(VFS, "bad info payload"); 5328 return rc; 5329 } 5330 5331 srch_inf->unicode = true; 5332 5333 if (srch_inf->ntwrk_buf_start) { 5334 if (srch_inf->smallBuf) 5335 cifs_small_buf_release(srch_inf->ntwrk_buf_start); 5336 else 5337 cifs_buf_release(srch_inf->ntwrk_buf_start); 5338 } 5339 srch_inf->ntwrk_buf_start = (char *)rsp; 5340 srch_inf->srch_entries_start = srch_inf->last_entry = 5341 (char *)rsp + le16_to_cpu(rsp->OutputBufferOffset); 5342 end_of_smb = rsp_iov->iov_len + (char *)rsp; 5343 5344 srch_inf->entries_in_buffer = num_entries( 5345 srch_inf->info_level, 5346 srch_inf->srch_entries_start, 5347 end_of_smb, 5348 &srch_inf->last_entry, 5349 info_buf_size); 5350 5351 srch_inf->index_of_last_entry += srch_inf->entries_in_buffer; 5352 cifs_dbg(FYI, "num entries %d last_index %lld srch start %p srch end %p\n", 5353 srch_inf->entries_in_buffer, srch_inf->index_of_last_entry, 5354 srch_inf->srch_entries_start, srch_inf->last_entry); 5355 if (resp_buftype == CIFS_LARGE_BUFFER) 5356 srch_inf->smallBuf = false; 5357 else if (resp_buftype == CIFS_SMALL_BUFFER) 5358 srch_inf->smallBuf = true; 5359 else 5360 cifs_tcon_dbg(VFS, "Invalid search buffer type\n"); 5361 5362 return 0; 5363 } 5364 5365 int 5366 SMB2_query_directory(const unsigned int xid, struct cifs_tcon *tcon, 5367 u64 persistent_fid, u64 volatile_fid, int index, 5368 struct cifs_search_info *srch_inf) 5369 { 5370 struct smb_rqst rqst; 5371 struct kvec iov[SMB2_QUERY_DIRECTORY_IOV_SIZE]; 5372 struct smb2_query_directory_rsp *rsp = NULL; 5373 int resp_buftype = CIFS_NO_BUFFER; 5374 struct kvec rsp_iov; 5375 int rc = 0; 5376 struct cifs_ses *ses = tcon->ses; 5377 struct TCP_Server_Info *server; 5378 int flags = 0; 5379 int retries = 0, cur_sleep = 1; 5380 5381 replay_again: 5382 /* reinitialize for possible replay */ 5383 flags = 0; 5384 server = cifs_pick_channel(ses); 5385 5386 if (!ses || !(ses->server)) 5387 return -EIO; 5388 5389 if (smb3_encryption_required(tcon)) 5390 flags |= CIFS_TRANSFORM_REQ; 5391 5392 memset(&rqst, 0, sizeof(struct smb_rqst)); 5393 memset(&iov, 0, sizeof(iov)); 5394 rqst.rq_iov = iov; 5395 rqst.rq_nvec = SMB2_QUERY_DIRECTORY_IOV_SIZE; 5396 5397 rc = SMB2_query_directory_init(xid, tcon, server, 5398 &rqst, persistent_fid, 5399 volatile_fid, index, 5400 srch_inf->info_level); 5401 if (rc) 5402 goto qdir_exit; 5403 5404 if (retries) 5405 smb2_set_replay(server, &rqst); 5406 5407 rc = cifs_send_recv(xid, ses, server, 5408 &rqst, &resp_buftype, flags, &rsp_iov); 5409 rsp = (struct smb2_query_directory_rsp *)rsp_iov.iov_base; 5410 5411 if (rc) { 5412 if (rc == -ENODATA && 5413 rsp->hdr.Status == STATUS_NO_MORE_FILES) { 5414 trace_smb3_query_dir_done(xid, persistent_fid, 5415 tcon->tid, tcon->ses->Suid, index, 0); 5416 srch_inf->endOfSearch = true; 5417 rc = 0; 5418 } else { 5419 trace_smb3_query_dir_err(xid, persistent_fid, tcon->tid, 5420 tcon->ses->Suid, index, 0, rc); 5421 cifs_stats_fail_inc(tcon, SMB2_QUERY_DIRECTORY_HE); 5422 } 5423 goto qdir_exit; 5424 } 5425 5426 rc = smb2_parse_query_directory(tcon, &rsp_iov, resp_buftype, 5427 srch_inf); 5428 if (rc) { 5429 trace_smb3_query_dir_err(xid, persistent_fid, tcon->tid, 5430 tcon->ses->Suid, index, 0, rc); 5431 goto qdir_exit; 5432 } 5433 resp_buftype = CIFS_NO_BUFFER; 5434 5435 trace_smb3_query_dir_done(xid, persistent_fid, tcon->tid, 5436 tcon->ses->Suid, index, srch_inf->entries_in_buffer); 5437 5438 qdir_exit: 5439 SMB2_query_directory_free(&rqst); 5440 free_rsp_buf(resp_buftype, rsp); 5441 5442 if (is_replayable_error(rc) && 5443 smb2_should_replay(tcon, &retries, &cur_sleep)) 5444 goto replay_again; 5445 5446 return rc; 5447 } 5448 5449 int 5450 SMB2_set_info_init(struct cifs_tcon *tcon, struct TCP_Server_Info *server, 5451 struct smb_rqst *rqst, 5452 u64 persistent_fid, u64 volatile_fid, u32 pid, 5453 u8 info_class, u8 info_type, u32 additional_info, 5454 void **data, unsigned int *size) 5455 { 5456 struct smb2_set_info_req *req; 5457 struct kvec *iov = rqst->rq_iov; 5458 unsigned int i, total_len; 5459 int rc; 5460 5461 rc = smb2_plain_req_init(SMB2_SET_INFO, tcon, server, 5462 (void **) &req, &total_len); 5463 if (rc) 5464 return rc; 5465 5466 req->hdr.Id.SyncId.ProcessId = cpu_to_le32(pid); 5467 req->InfoType = info_type; 5468 req->FileInfoClass = info_class; 5469 req->PersistentFileId = persistent_fid; 5470 req->VolatileFileId = volatile_fid; 5471 req->AdditionalInformation = cpu_to_le32(additional_info); 5472 5473 req->BufferOffset = cpu_to_le16(sizeof(struct smb2_set_info_req)); 5474 req->BufferLength = cpu_to_le32(*size); 5475 5476 memcpy(req->Buffer, *data, *size); 5477 total_len += *size; 5478 5479 iov[0].iov_base = (char *)req; 5480 /* 1 for Buffer */ 5481 iov[0].iov_len = total_len - 1; 5482 5483 for (i = 1; i < rqst->rq_nvec; i++) { 5484 le32_add_cpu(&req->BufferLength, size[i]); 5485 iov[i].iov_base = (char *)data[i]; 5486 iov[i].iov_len = size[i]; 5487 } 5488 5489 return 0; 5490 } 5491 5492 void 5493 SMB2_set_info_free(struct smb_rqst *rqst) 5494 { 5495 if (rqst && rqst->rq_iov) 5496 cifs_buf_release(rqst->rq_iov[0].iov_base); /* request */ 5497 } 5498 5499 static int 5500 send_set_info(const unsigned int xid, struct cifs_tcon *tcon, 5501 u64 persistent_fid, u64 volatile_fid, u32 pid, u8 info_class, 5502 u8 info_type, u32 additional_info, unsigned int num, 5503 void **data, unsigned int *size) 5504 { 5505 struct smb_rqst rqst; 5506 struct smb2_set_info_rsp *rsp = NULL; 5507 struct kvec *iov; 5508 struct kvec rsp_iov; 5509 int rc = 0; 5510 int resp_buftype; 5511 struct cifs_ses *ses = tcon->ses; 5512 struct TCP_Server_Info *server; 5513 int flags = 0; 5514 int retries = 0, cur_sleep = 1; 5515 5516 replay_again: 5517 /* reinitialize for possible replay */ 5518 flags = 0; 5519 server = cifs_pick_channel(ses); 5520 5521 if (!ses || !server) 5522 return -EIO; 5523 5524 if (!num) 5525 return -EINVAL; 5526 5527 if (smb3_encryption_required(tcon)) 5528 flags |= CIFS_TRANSFORM_REQ; 5529 5530 iov = kmalloc_array(num, sizeof(struct kvec), GFP_KERNEL); 5531 if (!iov) 5532 return -ENOMEM; 5533 5534 memset(&rqst, 0, sizeof(struct smb_rqst)); 5535 rqst.rq_iov = iov; 5536 rqst.rq_nvec = num; 5537 5538 rc = SMB2_set_info_init(tcon, server, 5539 &rqst, persistent_fid, volatile_fid, pid, 5540 info_class, info_type, additional_info, 5541 data, size); 5542 if (rc) { 5543 kfree(iov); 5544 return rc; 5545 } 5546 5547 if (retries) 5548 smb2_set_replay(server, &rqst); 5549 5550 rc = cifs_send_recv(xid, ses, server, 5551 &rqst, &resp_buftype, flags, 5552 &rsp_iov); 5553 SMB2_set_info_free(&rqst); 5554 rsp = (struct smb2_set_info_rsp *)rsp_iov.iov_base; 5555 5556 if (rc != 0) { 5557 cifs_stats_fail_inc(tcon, SMB2_SET_INFO_HE); 5558 trace_smb3_set_info_err(xid, persistent_fid, tcon->tid, 5559 ses->Suid, info_class, (__u32)info_type, rc); 5560 } 5561 5562 free_rsp_buf(resp_buftype, rsp); 5563 kfree(iov); 5564 5565 if (is_replayable_error(rc) && 5566 smb2_should_replay(tcon, &retries, &cur_sleep)) 5567 goto replay_again; 5568 5569 return rc; 5570 } 5571 5572 int 5573 SMB2_set_eof(const unsigned int xid, struct cifs_tcon *tcon, u64 persistent_fid, 5574 u64 volatile_fid, u32 pid, loff_t new_eof) 5575 { 5576 struct smb2_file_eof_info info; 5577 void *data; 5578 unsigned int size; 5579 5580 info.EndOfFile = cpu_to_le64(new_eof); 5581 5582 data = &info; 5583 size = sizeof(struct smb2_file_eof_info); 5584 5585 trace_smb3_set_eof(xid, persistent_fid, tcon->tid, tcon->ses->Suid, new_eof); 5586 5587 return send_set_info(xid, tcon, persistent_fid, volatile_fid, 5588 pid, FILE_END_OF_FILE_INFORMATION, SMB2_O_INFO_FILE, 5589 0, 1, &data, &size); 5590 } 5591 5592 int 5593 SMB2_set_acl(const unsigned int xid, struct cifs_tcon *tcon, 5594 u64 persistent_fid, u64 volatile_fid, 5595 struct cifs_ntsd *pnntsd, int pacllen, int aclflag) 5596 { 5597 return send_set_info(xid, tcon, persistent_fid, volatile_fid, 5598 current->tgid, 0, SMB2_O_INFO_SECURITY, aclflag, 5599 1, (void **)&pnntsd, &pacllen); 5600 } 5601 5602 int 5603 SMB2_set_ea(const unsigned int xid, struct cifs_tcon *tcon, 5604 u64 persistent_fid, u64 volatile_fid, 5605 struct smb2_file_full_ea_info *buf, int len) 5606 { 5607 return send_set_info(xid, tcon, persistent_fid, volatile_fid, 5608 current->tgid, FILE_FULL_EA_INFORMATION, SMB2_O_INFO_FILE, 5609 0, 1, (void **)&buf, &len); 5610 } 5611 5612 int 5613 SMB2_oplock_break(const unsigned int xid, struct cifs_tcon *tcon, 5614 const u64 persistent_fid, const u64 volatile_fid, 5615 __u8 oplock_level) 5616 { 5617 struct smb_rqst rqst; 5618 int rc; 5619 struct smb2_oplock_break *req = NULL; 5620 struct cifs_ses *ses = tcon->ses; 5621 struct TCP_Server_Info *server; 5622 int flags = CIFS_OBREAK_OP; 5623 unsigned int total_len; 5624 struct kvec iov[1]; 5625 struct kvec rsp_iov; 5626 int resp_buf_type; 5627 int retries = 0, cur_sleep = 1; 5628 5629 replay_again: 5630 /* reinitialize for possible replay */ 5631 flags = CIFS_OBREAK_OP; 5632 server = cifs_pick_channel(ses); 5633 5634 cifs_dbg(FYI, "SMB2_oplock_break\n"); 5635 rc = smb2_plain_req_init(SMB2_OPLOCK_BREAK, tcon, server, 5636 (void **) &req, &total_len); 5637 if (rc) 5638 return rc; 5639 5640 if (smb3_encryption_required(tcon)) 5641 flags |= CIFS_TRANSFORM_REQ; 5642 5643 req->VolatileFid = volatile_fid; 5644 req->PersistentFid = persistent_fid; 5645 req->OplockLevel = oplock_level; 5646 req->hdr.CreditRequest = cpu_to_le16(1); 5647 5648 flags |= CIFS_NO_RSP_BUF; 5649 5650 iov[0].iov_base = (char *)req; 5651 iov[0].iov_len = total_len; 5652 5653 memset(&rqst, 0, sizeof(struct smb_rqst)); 5654 rqst.rq_iov = iov; 5655 rqst.rq_nvec = 1; 5656 5657 if (retries) 5658 smb2_set_replay(server, &rqst); 5659 5660 rc = cifs_send_recv(xid, ses, server, 5661 &rqst, &resp_buf_type, flags, &rsp_iov); 5662 cifs_small_buf_release(req); 5663 if (rc) { 5664 cifs_stats_fail_inc(tcon, SMB2_OPLOCK_BREAK_HE); 5665 cifs_dbg(FYI, "Send error in Oplock Break = %d\n", rc); 5666 } 5667 5668 if (is_replayable_error(rc) && 5669 smb2_should_replay(tcon, &retries, &cur_sleep)) 5670 goto replay_again; 5671 5672 return rc; 5673 } 5674 5675 void 5676 smb2_copy_fs_info_to_kstatfs(struct smb2_fs_full_size_info *pfs_inf, 5677 struct kstatfs *kst) 5678 { 5679 kst->f_bsize = le32_to_cpu(pfs_inf->BytesPerSector) * 5680 le32_to_cpu(pfs_inf->SectorsPerAllocationUnit); 5681 kst->f_blocks = le64_to_cpu(pfs_inf->TotalAllocationUnits); 5682 kst->f_bfree = kst->f_bavail = 5683 le64_to_cpu(pfs_inf->CallerAvailableAllocationUnits); 5684 return; 5685 } 5686 5687 static void 5688 copy_posix_fs_info_to_kstatfs(FILE_SYSTEM_POSIX_INFO *response_data, 5689 struct kstatfs *kst) 5690 { 5691 kst->f_bsize = le32_to_cpu(response_data->BlockSize); 5692 kst->f_blocks = le64_to_cpu(response_data->TotalBlocks); 5693 kst->f_bfree = le64_to_cpu(response_data->BlocksAvail); 5694 if (response_data->UserBlocksAvail == cpu_to_le64(-1)) 5695 kst->f_bavail = kst->f_bfree; 5696 else 5697 kst->f_bavail = le64_to_cpu(response_data->UserBlocksAvail); 5698 if (response_data->TotalFileNodes != cpu_to_le64(-1)) 5699 kst->f_files = le64_to_cpu(response_data->TotalFileNodes); 5700 if (response_data->FreeFileNodes != cpu_to_le64(-1)) 5701 kst->f_ffree = le64_to_cpu(response_data->FreeFileNodes); 5702 5703 return; 5704 } 5705 5706 static int 5707 build_qfs_info_req(struct kvec *iov, struct cifs_tcon *tcon, 5708 struct TCP_Server_Info *server, 5709 int level, int outbuf_len, u64 persistent_fid, 5710 u64 volatile_fid) 5711 { 5712 int rc; 5713 struct smb2_query_info_req *req; 5714 unsigned int total_len; 5715 5716 cifs_dbg(FYI, "Query FSInfo level %d\n", level); 5717 5718 if ((tcon->ses == NULL) || server == NULL) 5719 return -EIO; 5720 5721 rc = smb2_plain_req_init(SMB2_QUERY_INFO, tcon, server, 5722 (void **) &req, &total_len); 5723 if (rc) 5724 return rc; 5725 5726 req->InfoType = SMB2_O_INFO_FILESYSTEM; 5727 req->FileInfoClass = level; 5728 req->PersistentFileId = persistent_fid; 5729 req->VolatileFileId = volatile_fid; 5730 /* 1 for pad */ 5731 req->InputBufferOffset = 5732 cpu_to_le16(sizeof(struct smb2_query_info_req)); 5733 req->OutputBufferLength = cpu_to_le32( 5734 outbuf_len + sizeof(struct smb2_query_info_rsp)); 5735 5736 iov->iov_base = (char *)req; 5737 iov->iov_len = total_len; 5738 return 0; 5739 } 5740 5741 static inline void free_qfs_info_req(struct kvec *iov) 5742 { 5743 cifs_buf_release(iov->iov_base); 5744 } 5745 5746 int 5747 SMB311_posix_qfs_info(const unsigned int xid, struct cifs_tcon *tcon, 5748 u64 persistent_fid, u64 volatile_fid, struct kstatfs *fsdata) 5749 { 5750 struct smb_rqst rqst; 5751 struct smb2_query_info_rsp *rsp = NULL; 5752 struct kvec iov; 5753 struct kvec rsp_iov; 5754 int rc = 0; 5755 int resp_buftype; 5756 struct cifs_ses *ses = tcon->ses; 5757 struct TCP_Server_Info *server; 5758 FILE_SYSTEM_POSIX_INFO *info = NULL; 5759 int flags = 0; 5760 int retries = 0, cur_sleep = 1; 5761 5762 replay_again: 5763 /* reinitialize for possible replay */ 5764 flags = 0; 5765 server = cifs_pick_channel(ses); 5766 5767 rc = build_qfs_info_req(&iov, tcon, server, 5768 FS_POSIX_INFORMATION, 5769 sizeof(FILE_SYSTEM_POSIX_INFO), 5770 persistent_fid, volatile_fid); 5771 if (rc) 5772 return rc; 5773 5774 if (smb3_encryption_required(tcon)) 5775 flags |= CIFS_TRANSFORM_REQ; 5776 5777 memset(&rqst, 0, sizeof(struct smb_rqst)); 5778 rqst.rq_iov = &iov; 5779 rqst.rq_nvec = 1; 5780 5781 if (retries) 5782 smb2_set_replay(server, &rqst); 5783 5784 rc = cifs_send_recv(xid, ses, server, 5785 &rqst, &resp_buftype, flags, &rsp_iov); 5786 free_qfs_info_req(&iov); 5787 if (rc) { 5788 cifs_stats_fail_inc(tcon, SMB2_QUERY_INFO_HE); 5789 goto posix_qfsinf_exit; 5790 } 5791 rsp = (struct smb2_query_info_rsp *)rsp_iov.iov_base; 5792 5793 info = (FILE_SYSTEM_POSIX_INFO *)( 5794 le16_to_cpu(rsp->OutputBufferOffset) + (char *)rsp); 5795 rc = smb2_validate_iov(le16_to_cpu(rsp->OutputBufferOffset), 5796 le32_to_cpu(rsp->OutputBufferLength), &rsp_iov, 5797 sizeof(FILE_SYSTEM_POSIX_INFO)); 5798 if (!rc) 5799 copy_posix_fs_info_to_kstatfs(info, fsdata); 5800 5801 posix_qfsinf_exit: 5802 free_rsp_buf(resp_buftype, rsp_iov.iov_base); 5803 5804 if (is_replayable_error(rc) && 5805 smb2_should_replay(tcon, &retries, &cur_sleep)) 5806 goto replay_again; 5807 5808 return rc; 5809 } 5810 5811 int 5812 SMB2_QFS_info(const unsigned int xid, struct cifs_tcon *tcon, 5813 u64 persistent_fid, u64 volatile_fid, struct kstatfs *fsdata) 5814 { 5815 struct smb_rqst rqst; 5816 struct smb2_query_info_rsp *rsp = NULL; 5817 struct kvec iov; 5818 struct kvec rsp_iov; 5819 int rc = 0; 5820 int resp_buftype; 5821 struct cifs_ses *ses = tcon->ses; 5822 struct TCP_Server_Info *server; 5823 struct smb2_fs_full_size_info *info = NULL; 5824 int flags = 0; 5825 int retries = 0, cur_sleep = 1; 5826 5827 replay_again: 5828 /* reinitialize for possible replay */ 5829 flags = 0; 5830 server = cifs_pick_channel(ses); 5831 5832 rc = build_qfs_info_req(&iov, tcon, server, 5833 FS_FULL_SIZE_INFORMATION, 5834 sizeof(struct smb2_fs_full_size_info), 5835 persistent_fid, volatile_fid); 5836 if (rc) 5837 return rc; 5838 5839 if (smb3_encryption_required(tcon)) 5840 flags |= CIFS_TRANSFORM_REQ; 5841 5842 memset(&rqst, 0, sizeof(struct smb_rqst)); 5843 rqst.rq_iov = &iov; 5844 rqst.rq_nvec = 1; 5845 5846 if (retries) 5847 smb2_set_replay(server, &rqst); 5848 5849 rc = cifs_send_recv(xid, ses, server, 5850 &rqst, &resp_buftype, flags, &rsp_iov); 5851 free_qfs_info_req(&iov); 5852 if (rc) { 5853 cifs_stats_fail_inc(tcon, SMB2_QUERY_INFO_HE); 5854 goto qfsinf_exit; 5855 } 5856 rsp = (struct smb2_query_info_rsp *)rsp_iov.iov_base; 5857 5858 info = (struct smb2_fs_full_size_info *)( 5859 le16_to_cpu(rsp->OutputBufferOffset) + (char *)rsp); 5860 rc = smb2_validate_iov(le16_to_cpu(rsp->OutputBufferOffset), 5861 le32_to_cpu(rsp->OutputBufferLength), &rsp_iov, 5862 sizeof(struct smb2_fs_full_size_info)); 5863 if (!rc) 5864 smb2_copy_fs_info_to_kstatfs(info, fsdata); 5865 5866 qfsinf_exit: 5867 free_rsp_buf(resp_buftype, rsp_iov.iov_base); 5868 5869 if (is_replayable_error(rc) && 5870 smb2_should_replay(tcon, &retries, &cur_sleep)) 5871 goto replay_again; 5872 5873 return rc; 5874 } 5875 5876 int 5877 SMB2_QFS_attr(const unsigned int xid, struct cifs_tcon *tcon, 5878 u64 persistent_fid, u64 volatile_fid, int level) 5879 { 5880 struct smb_rqst rqst; 5881 struct smb2_query_info_rsp *rsp = NULL; 5882 struct kvec iov; 5883 struct kvec rsp_iov; 5884 int rc = 0; 5885 int resp_buftype, max_len, min_len; 5886 struct cifs_ses *ses = tcon->ses; 5887 struct TCP_Server_Info *server; 5888 unsigned int rsp_len, offset; 5889 int flags = 0; 5890 int retries = 0, cur_sleep = 1; 5891 5892 replay_again: 5893 /* reinitialize for possible replay */ 5894 flags = 0; 5895 server = cifs_pick_channel(ses); 5896 5897 if (level == FS_DEVICE_INFORMATION) { 5898 max_len = sizeof(FILE_SYSTEM_DEVICE_INFO); 5899 min_len = sizeof(FILE_SYSTEM_DEVICE_INFO); 5900 } else if (level == FS_ATTRIBUTE_INFORMATION) { 5901 max_len = sizeof(FILE_SYSTEM_ATTRIBUTE_INFO); 5902 min_len = MIN_FS_ATTR_INFO_SIZE; 5903 } else if (level == FS_SECTOR_SIZE_INFORMATION) { 5904 max_len = sizeof(struct smb3_fs_ss_info); 5905 min_len = sizeof(struct smb3_fs_ss_info); 5906 } else if (level == FS_VOLUME_INFORMATION) { 5907 max_len = sizeof(struct smb3_fs_vol_info) + MAX_VOL_LABEL_LEN; 5908 min_len = sizeof(struct smb3_fs_vol_info); 5909 } else { 5910 cifs_dbg(FYI, "Invalid qfsinfo level %d\n", level); 5911 return -EINVAL; 5912 } 5913 5914 rc = build_qfs_info_req(&iov, tcon, server, 5915 level, max_len, 5916 persistent_fid, volatile_fid); 5917 if (rc) 5918 return rc; 5919 5920 if (smb3_encryption_required(tcon)) 5921 flags |= CIFS_TRANSFORM_REQ; 5922 5923 memset(&rqst, 0, sizeof(struct smb_rqst)); 5924 rqst.rq_iov = &iov; 5925 rqst.rq_nvec = 1; 5926 5927 if (retries) 5928 smb2_set_replay(server, &rqst); 5929 5930 rc = cifs_send_recv(xid, ses, server, 5931 &rqst, &resp_buftype, flags, &rsp_iov); 5932 free_qfs_info_req(&iov); 5933 if (rc) { 5934 cifs_stats_fail_inc(tcon, SMB2_QUERY_INFO_HE); 5935 goto qfsattr_exit; 5936 } 5937 rsp = (struct smb2_query_info_rsp *)rsp_iov.iov_base; 5938 5939 rsp_len = le32_to_cpu(rsp->OutputBufferLength); 5940 offset = le16_to_cpu(rsp->OutputBufferOffset); 5941 rc = smb2_validate_iov(offset, rsp_len, &rsp_iov, min_len); 5942 if (rc) 5943 goto qfsattr_exit; 5944 5945 if (level == FS_ATTRIBUTE_INFORMATION) 5946 memcpy(&tcon->fsAttrInfo, offset 5947 + (char *)rsp, min_t(unsigned int, 5948 rsp_len, max_len)); 5949 else if (level == FS_DEVICE_INFORMATION) 5950 memcpy(&tcon->fsDevInfo, offset 5951 + (char *)rsp, sizeof(FILE_SYSTEM_DEVICE_INFO)); 5952 else if (level == FS_SECTOR_SIZE_INFORMATION) { 5953 struct smb3_fs_ss_info *ss_info = (struct smb3_fs_ss_info *) 5954 (offset + (char *)rsp); 5955 tcon->ss_flags = le32_to_cpu(ss_info->Flags); 5956 tcon->perf_sector_size = 5957 le32_to_cpu(ss_info->PhysicalBytesPerSectorForPerf); 5958 } else if (level == FS_VOLUME_INFORMATION) { 5959 struct smb3_fs_vol_info *vol_info = (struct smb3_fs_vol_info *) 5960 (offset + (char *)rsp); 5961 tcon->vol_serial_number = vol_info->VolumeSerialNumber; 5962 tcon->vol_create_time = vol_info->VolumeCreationTime; 5963 } 5964 5965 qfsattr_exit: 5966 free_rsp_buf(resp_buftype, rsp_iov.iov_base); 5967 5968 if (is_replayable_error(rc) && 5969 smb2_should_replay(tcon, &retries, &cur_sleep)) 5970 goto replay_again; 5971 5972 return rc; 5973 } 5974 5975 int 5976 smb2_lockv(const unsigned int xid, struct cifs_tcon *tcon, 5977 const __u64 persist_fid, const __u64 volatile_fid, const __u32 pid, 5978 const __u32 num_lock, struct smb2_lock_element *buf) 5979 { 5980 struct smb_rqst rqst; 5981 int rc = 0; 5982 struct smb2_lock_req *req = NULL; 5983 struct kvec iov[2]; 5984 struct kvec rsp_iov; 5985 int resp_buf_type; 5986 unsigned int count; 5987 int flags = CIFS_NO_RSP_BUF; 5988 unsigned int total_len; 5989 struct TCP_Server_Info *server; 5990 int retries = 0, cur_sleep = 1; 5991 5992 replay_again: 5993 /* reinitialize for possible replay */ 5994 flags = CIFS_NO_RSP_BUF; 5995 server = cifs_pick_channel(tcon->ses); 5996 5997 cifs_dbg(FYI, "smb2_lockv num lock %d\n", num_lock); 5998 5999 rc = smb2_plain_req_init(SMB2_LOCK, tcon, server, 6000 (void **) &req, &total_len); 6001 if (rc) 6002 return rc; 6003 6004 if (smb3_encryption_required(tcon)) 6005 flags |= CIFS_TRANSFORM_REQ; 6006 6007 req->hdr.Id.SyncId.ProcessId = cpu_to_le32(pid); 6008 req->LockCount = cpu_to_le16(num_lock); 6009 6010 req->PersistentFileId = persist_fid; 6011 req->VolatileFileId = volatile_fid; 6012 6013 count = num_lock * sizeof(struct smb2_lock_element); 6014 6015 iov[0].iov_base = (char *)req; 6016 iov[0].iov_len = total_len - sizeof(struct smb2_lock_element); 6017 iov[1].iov_base = (char *)buf; 6018 iov[1].iov_len = count; 6019 6020 cifs_stats_inc(&tcon->stats.cifs_stats.num_locks); 6021 6022 memset(&rqst, 0, sizeof(struct smb_rqst)); 6023 rqst.rq_iov = iov; 6024 rqst.rq_nvec = 2; 6025 6026 if (retries) 6027 smb2_set_replay(server, &rqst); 6028 6029 rc = cifs_send_recv(xid, tcon->ses, server, 6030 &rqst, &resp_buf_type, flags, 6031 &rsp_iov); 6032 cifs_small_buf_release(req); 6033 if (rc) { 6034 cifs_dbg(FYI, "Send error in smb2_lockv = %d\n", rc); 6035 cifs_stats_fail_inc(tcon, SMB2_LOCK_HE); 6036 trace_smb3_lock_err(xid, persist_fid, tcon->tid, 6037 tcon->ses->Suid, rc); 6038 } 6039 6040 if (is_replayable_error(rc) && 6041 smb2_should_replay(tcon, &retries, &cur_sleep)) 6042 goto replay_again; 6043 6044 return rc; 6045 } 6046 6047 int 6048 SMB2_lock(const unsigned int xid, struct cifs_tcon *tcon, 6049 const __u64 persist_fid, const __u64 volatile_fid, const __u32 pid, 6050 const __u64 length, const __u64 offset, const __u32 lock_flags, 6051 const bool wait) 6052 { 6053 struct smb2_lock_element lock; 6054 6055 lock.Offset = cpu_to_le64(offset); 6056 lock.Length = cpu_to_le64(length); 6057 lock.Flags = cpu_to_le32(lock_flags); 6058 if (!wait && lock_flags != SMB2_LOCKFLAG_UNLOCK) 6059 lock.Flags |= cpu_to_le32(SMB2_LOCKFLAG_FAIL_IMMEDIATELY); 6060 6061 return smb2_lockv(xid, tcon, persist_fid, volatile_fid, pid, 1, &lock); 6062 } 6063 6064 int 6065 SMB2_lease_break(const unsigned int xid, struct cifs_tcon *tcon, 6066 __u8 *lease_key, const __le32 lease_state) 6067 { 6068 struct smb_rqst rqst; 6069 int rc; 6070 struct smb2_lease_ack *req = NULL; 6071 struct cifs_ses *ses = tcon->ses; 6072 int flags = CIFS_OBREAK_OP; 6073 unsigned int total_len; 6074 struct kvec iov[1]; 6075 struct kvec rsp_iov; 6076 int resp_buf_type; 6077 __u64 *please_key_high; 6078 __u64 *please_key_low; 6079 struct TCP_Server_Info *server = cifs_pick_channel(tcon->ses); 6080 6081 cifs_dbg(FYI, "SMB2_lease_break\n"); 6082 rc = smb2_plain_req_init(SMB2_OPLOCK_BREAK, tcon, server, 6083 (void **) &req, &total_len); 6084 if (rc) 6085 return rc; 6086 6087 if (smb3_encryption_required(tcon)) 6088 flags |= CIFS_TRANSFORM_REQ; 6089 6090 req->hdr.CreditRequest = cpu_to_le16(1); 6091 req->StructureSize = cpu_to_le16(36); 6092 total_len += 12; 6093 6094 memcpy(req->LeaseKey, lease_key, 16); 6095 req->LeaseState = lease_state; 6096 6097 flags |= CIFS_NO_RSP_BUF; 6098 6099 iov[0].iov_base = (char *)req; 6100 iov[0].iov_len = total_len; 6101 6102 memset(&rqst, 0, sizeof(struct smb_rqst)); 6103 rqst.rq_iov = iov; 6104 rqst.rq_nvec = 1; 6105 6106 rc = cifs_send_recv(xid, ses, server, 6107 &rqst, &resp_buf_type, flags, &rsp_iov); 6108 cifs_small_buf_release(req); 6109 6110 please_key_low = (__u64 *)lease_key; 6111 please_key_high = (__u64 *)(lease_key+8); 6112 if (rc) { 6113 cifs_stats_fail_inc(tcon, SMB2_OPLOCK_BREAK_HE); 6114 trace_smb3_lease_err(le32_to_cpu(lease_state), tcon->tid, 6115 ses->Suid, *please_key_low, *please_key_high, rc); 6116 cifs_dbg(FYI, "Send error in Lease Break = %d\n", rc); 6117 } else 6118 trace_smb3_lease_done(le32_to_cpu(lease_state), tcon->tid, 6119 ses->Suid, *please_key_low, *please_key_high); 6120 6121 return rc; 6122 } 6123