1 // SPDX-License-Identifier: LGPL-2.1 2 /* 3 * 4 * Copyright (C) International Business Machines Corp., 2009, 2013 5 * Etersoft, 2012 6 * Author(s): Steve French (sfrench@us.ibm.com) 7 * Pavel Shilovsky (pshilovsky@samba.org) 2012 8 * 9 * Contains the routines for constructing the SMB2 PDUs themselves 10 * 11 */ 12 13 /* SMB2 PDU handling routines here - except for leftovers (eg session setup) */ 14 /* Note that there are handle based routines which must be */ 15 /* treated slightly differently for reconnection purposes since we never */ 16 /* want to reuse a stale file handle and only the caller knows the file info */ 17 18 #include <linux/fs.h> 19 #include <linux/kernel.h> 20 #include <linux/vfs.h> 21 #include <linux/task_io_accounting_ops.h> 22 #include <linux/uaccess.h> 23 #include <linux/uuid.h> 24 #include <linux/pagemap.h> 25 #include <linux/xattr.h> 26 #include <linux/netfs.h> 27 #include <trace/events/netfs.h> 28 #include "cifsglob.h" 29 #include "cifsacl.h" 30 #include "cifsproto.h" 31 #include "smb2proto.h" 32 #include "cifs_unicode.h" 33 #include "cifs_debug.h" 34 #include "ntlmssp.h" 35 #include "../common/smb2status.h" 36 #include "smb2glob.h" 37 #include "cifspdu.h" 38 #include "cifs_spnego.h" 39 #include "smbdirect.h" 40 #include "trace.h" 41 #ifdef CONFIG_CIFS_DFS_UPCALL 42 #include "dfs_cache.h" 43 #endif 44 #include "cached_dir.h" 45 #include "compress.h" 46 #include "fs_context.h" 47 48 /* 49 * The following table defines the expected "StructureSize" of SMB2 requests 50 * in order by SMB2 command. This is similar to "wct" in SMB/CIFS requests. 51 * 52 * Note that commands are defined in smb2pdu.h in le16 but the array below is 53 * indexed by command in host byte order. 54 */ 55 static const int smb2_req_struct_sizes[NUMBER_OF_SMB2_COMMANDS] = { 56 /* SMB2_NEGOTIATE */ 36, 57 /* SMB2_SESSION_SETUP */ 25, 58 /* SMB2_LOGOFF */ 4, 59 /* SMB2_TREE_CONNECT */ 9, 60 /* SMB2_TREE_DISCONNECT */ 4, 61 /* SMB2_CREATE */ 57, 62 /* SMB2_CLOSE */ 24, 63 /* SMB2_FLUSH */ 24, 64 /* SMB2_READ */ 49, 65 /* SMB2_WRITE */ 49, 66 /* SMB2_LOCK */ 48, 67 /* SMB2_IOCTL */ 57, 68 /* SMB2_CANCEL */ 4, 69 /* SMB2_ECHO */ 4, 70 /* SMB2_QUERY_DIRECTORY */ 33, 71 /* SMB2_CHANGE_NOTIFY */ 32, 72 /* SMB2_QUERY_INFO */ 41, 73 /* SMB2_SET_INFO */ 33, 74 /* SMB2_OPLOCK_BREAK */ 24 /* BB this is 36 for LEASE_BREAK variant */ 75 }; 76 77 int smb3_encryption_required(const struct cifs_tcon *tcon) 78 { 79 if (!tcon || !tcon->ses) 80 return 0; 81 if ((tcon->ses->session_flags & SMB2_SESSION_FLAG_ENCRYPT_DATA) || 82 (tcon->share_flags & SHI1005_FLAGS_ENCRYPT_DATA)) 83 return 1; 84 if (tcon->seal && 85 (tcon->ses->server->capabilities & SMB2_GLOBAL_CAP_ENCRYPTION)) 86 return 1; 87 if (((global_secflags & CIFSSEC_MUST_SEAL) == CIFSSEC_MUST_SEAL) && 88 (tcon->ses->server->capabilities & SMB2_GLOBAL_CAP_ENCRYPTION)) 89 return 1; 90 return 0; 91 } 92 93 static void 94 smb2_hdr_assemble(struct smb2_hdr *shdr, __le16 smb2_cmd, 95 const struct cifs_tcon *tcon, 96 struct TCP_Server_Info *server) 97 { 98 struct smb3_hdr_req *smb3_hdr; 99 100 shdr->ProtocolId = SMB2_PROTO_NUMBER; 101 shdr->StructureSize = cpu_to_le16(64); 102 shdr->Command = smb2_cmd; 103 104 if (server) { 105 /* After reconnect SMB3 must set ChannelSequence on subsequent reqs */ 106 if (server->dialect >= SMB30_PROT_ID) { 107 smb3_hdr = (struct smb3_hdr_req *)shdr; 108 /* 109 * if primary channel is not set yet, use default 110 * channel for chan sequence num 111 */ 112 if (SERVER_IS_CHAN(server)) 113 smb3_hdr->ChannelSequence = 114 cpu_to_le16(server->primary_server->channel_sequence_num); 115 else 116 smb3_hdr->ChannelSequence = 117 cpu_to_le16(server->channel_sequence_num); 118 } 119 spin_lock(&server->req_lock); 120 /* Request up to 10 credits but don't go over the limit. */ 121 if (server->credits >= server->max_credits) 122 shdr->CreditRequest = cpu_to_le16(0); 123 else 124 shdr->CreditRequest = cpu_to_le16( 125 min_t(int, server->max_credits - 126 server->credits, 10)); 127 spin_unlock(&server->req_lock); 128 } else { 129 shdr->CreditRequest = cpu_to_le16(2); 130 } 131 shdr->Id.SyncId.ProcessId = cpu_to_le32((__u16)current->tgid); 132 133 if (!tcon) 134 goto out; 135 136 /* GLOBAL_CAP_LARGE_MTU will only be set if dialect > SMB2.02 */ 137 /* See sections 2.2.4 and 3.2.4.1.5 of MS-SMB2 */ 138 if (server && (server->capabilities & SMB2_GLOBAL_CAP_LARGE_MTU)) 139 shdr->CreditCharge = cpu_to_le16(1); 140 /* else CreditCharge MBZ */ 141 142 shdr->Id.SyncId.TreeId = cpu_to_le32(tcon->tid); 143 /* Uid is not converted */ 144 if (tcon->ses) 145 shdr->SessionId = cpu_to_le64(tcon->ses->Suid); 146 147 /* 148 * If we would set SMB2_FLAGS_DFS_OPERATIONS on open we also would have 149 * to pass the path on the Open SMB prefixed by \\server\share. 150 * Not sure when we would need to do the augmented path (if ever) and 151 * setting this flag breaks the SMB2 open operation since it is 152 * illegal to send an empty path name (without \\server\share prefix) 153 * when the DFS flag is set in the SMB open header. We could 154 * consider setting the flag on all operations other than open 155 * but it is safer to net set it for now. 156 */ 157 /* if (tcon->share_flags & SHI1005_FLAGS_DFS) 158 shdr->Flags |= SMB2_FLAGS_DFS_OPERATIONS; */ 159 160 if (server && server->sign && !smb3_encryption_required(tcon)) 161 shdr->Flags |= SMB2_FLAGS_SIGNED; 162 out: 163 return; 164 } 165 166 /* helper function for code reuse */ 167 static int 168 cifs_chan_skip_or_disable(struct cifs_ses *ses, 169 struct TCP_Server_Info *server, 170 bool from_reconnect) 171 { 172 struct TCP_Server_Info *pserver; 173 unsigned int chan_index; 174 175 if (SERVER_IS_CHAN(server)) { 176 cifs_dbg(VFS, 177 "server %s does not support multichannel anymore. Skip secondary channel\n", 178 ses->server->hostname); 179 180 spin_lock(&ses->chan_lock); 181 chan_index = cifs_ses_get_chan_index(ses, server); 182 if (chan_index == CIFS_INVAL_CHAN_INDEX) { 183 spin_unlock(&ses->chan_lock); 184 goto skip_terminate; 185 } 186 187 ses->chans[chan_index].server = NULL; 188 server->terminate = true; 189 spin_unlock(&ses->chan_lock); 190 191 /* 192 * the above reference of server by channel 193 * needs to be dropped without holding chan_lock 194 * as cifs_put_tcp_session takes a higher lock 195 * i.e. cifs_tcp_ses_lock 196 */ 197 cifs_put_tcp_session(server, from_reconnect); 198 199 cifs_signal_cifsd_for_reconnect(server, false); 200 201 /* mark primary server as needing reconnect */ 202 pserver = server->primary_server; 203 cifs_signal_cifsd_for_reconnect(pserver, false); 204 skip_terminate: 205 return -EHOSTDOWN; 206 } 207 208 cifs_server_dbg(VFS, 209 "server does not support multichannel anymore. Disable all other channels\n"); 210 cifs_disable_secondary_channels(ses); 211 212 213 return 0; 214 } 215 216 static int 217 smb2_reconnect(__le16 smb2_command, struct cifs_tcon *tcon, 218 struct TCP_Server_Info *server, bool from_reconnect) 219 { 220 struct cifs_ses *ses; 221 int xid; 222 int rc = 0; 223 224 /* 225 * SMB2s NegProt, SessSetup, Logoff do not have tcon yet so 226 * check for tcp and smb session status done differently 227 * for those three - in the calling routine. 228 */ 229 if (tcon == NULL) 230 return 0; 231 232 if (smb2_command == SMB2_TREE_CONNECT) 233 return 0; 234 235 spin_lock(&tcon->tc_lock); 236 if (tcon->status == TID_EXITING) { 237 /* 238 * only tree disconnect allowed when disconnecting ... 239 */ 240 if (smb2_command != SMB2_TREE_DISCONNECT) { 241 spin_unlock(&tcon->tc_lock); 242 cifs_dbg(FYI, "can not send cmd %d while umounting\n", 243 smb2_command); 244 return -ENODEV; 245 } 246 } 247 spin_unlock(&tcon->tc_lock); 248 249 ses = tcon->ses; 250 if (!ses) 251 return -EIO; 252 spin_lock(&ses->ses_lock); 253 if (ses->ses_status == SES_EXITING) { 254 spin_unlock(&ses->ses_lock); 255 return -EIO; 256 } 257 spin_unlock(&ses->ses_lock); 258 if (!ses->server || !server) 259 return -EIO; 260 261 spin_lock(&server->srv_lock); 262 if (server->tcpStatus == CifsNeedReconnect) { 263 /* 264 * Return to caller for TREE_DISCONNECT and LOGOFF and CLOSE 265 * here since they are implicitly done when session drops. 266 */ 267 switch (smb2_command) { 268 /* 269 * BB Should we keep oplock break and add flush to exceptions? 270 */ 271 case SMB2_TREE_DISCONNECT: 272 case SMB2_CANCEL: 273 case SMB2_CLOSE: 274 case SMB2_OPLOCK_BREAK: 275 spin_unlock(&server->srv_lock); 276 return -EAGAIN; 277 } 278 } 279 280 /* if server is marked for termination, cifsd will cleanup */ 281 if (server->terminate) { 282 spin_unlock(&server->srv_lock); 283 return -EHOSTDOWN; 284 } 285 spin_unlock(&server->srv_lock); 286 287 again: 288 rc = cifs_wait_for_server_reconnect(server, tcon->retry); 289 if (rc) 290 return rc; 291 292 spin_lock(&ses->chan_lock); 293 if (!cifs_chan_needs_reconnect(ses, server) && !tcon->need_reconnect) { 294 spin_unlock(&ses->chan_lock); 295 return 0; 296 } 297 spin_unlock(&ses->chan_lock); 298 cifs_dbg(FYI, "sess reconnect mask: 0x%lx, tcon reconnect: %d", 299 tcon->ses->chans_need_reconnect, 300 tcon->need_reconnect); 301 302 mutex_lock(&ses->session_mutex); 303 /* 304 * Handle the case where a concurrent thread failed to negotiate or 305 * killed a channel. 306 */ 307 spin_lock(&server->srv_lock); 308 switch (server->tcpStatus) { 309 case CifsExiting: 310 spin_unlock(&server->srv_lock); 311 mutex_unlock(&ses->session_mutex); 312 return -EHOSTDOWN; 313 case CifsNeedReconnect: 314 spin_unlock(&server->srv_lock); 315 mutex_unlock(&ses->session_mutex); 316 if (!tcon->retry) 317 return -EHOSTDOWN; 318 goto again; 319 default: 320 break; 321 } 322 spin_unlock(&server->srv_lock); 323 324 /* 325 * need to prevent multiple threads trying to simultaneously 326 * reconnect the same SMB session 327 */ 328 spin_lock(&ses->ses_lock); 329 spin_lock(&ses->chan_lock); 330 if (!cifs_chan_needs_reconnect(ses, server) && 331 ses->ses_status == SES_GOOD) { 332 spin_unlock(&ses->chan_lock); 333 spin_unlock(&ses->ses_lock); 334 /* this means that we only need to tree connect */ 335 if (tcon->need_reconnect) 336 goto skip_sess_setup; 337 338 mutex_unlock(&ses->session_mutex); 339 goto out; 340 } 341 spin_unlock(&ses->chan_lock); 342 spin_unlock(&ses->ses_lock); 343 344 rc = cifs_negotiate_protocol(0, ses, server); 345 if (rc) { 346 mutex_unlock(&ses->session_mutex); 347 if (!tcon->retry) 348 return -EHOSTDOWN; 349 goto again; 350 } 351 /* 352 * if server stopped supporting multichannel 353 * and the first channel reconnected, disable all the others. 354 */ 355 if (ses->chan_count > 1 && 356 !(server->capabilities & SMB2_GLOBAL_CAP_MULTI_CHANNEL)) { 357 rc = cifs_chan_skip_or_disable(ses, server, 358 from_reconnect); 359 if (rc) { 360 mutex_unlock(&ses->session_mutex); 361 goto out; 362 } 363 } 364 365 rc = cifs_setup_session(0, ses, server, ses->local_nls); 366 if ((rc == -EACCES) || (rc == -EKEYEXPIRED) || (rc == -EKEYREVOKED)) { 367 /* 368 * Try alternate password for next reconnect (key rotation 369 * could be enabled on the server e.g.) if an alternate 370 * password is available and the current password is expired, 371 * but do not swap on non pwd related errors like host down 372 */ 373 if (ses->password2) 374 swap(ses->password2, ses->password); 375 } 376 if (rc) { 377 mutex_unlock(&ses->session_mutex); 378 if (rc == -EACCES && !tcon->retry) 379 return -EHOSTDOWN; 380 goto out; 381 } 382 383 skip_sess_setup: 384 if (!tcon->need_reconnect) { 385 mutex_unlock(&ses->session_mutex); 386 goto out; 387 } 388 cifs_mark_open_files_invalid(tcon); 389 if (tcon->use_persistent) 390 tcon->need_reopen_files = true; 391 392 rc = cifs_tree_connect(0, tcon); 393 394 cifs_dbg(FYI, "reconnect tcon rc = %d\n", rc); 395 if (rc) { 396 /* If sess reconnected but tcon didn't, something strange ... */ 397 mutex_unlock(&ses->session_mutex); 398 cifs_dbg(VFS, "reconnect tcon failed rc = %d\n", rc); 399 goto out; 400 } 401 402 spin_lock(&ses->ses_lock); 403 if (ses->flags & CIFS_SES_FLAG_SCALE_CHANNELS) { 404 spin_unlock(&ses->ses_lock); 405 mutex_unlock(&ses->session_mutex); 406 goto skip_add_channels; 407 } 408 ses->flags |= CIFS_SES_FLAG_SCALE_CHANNELS; 409 spin_unlock(&ses->ses_lock); 410 411 if (!rc && 412 (server->capabilities & SMB2_GLOBAL_CAP_MULTI_CHANNEL) && 413 server->ops->query_server_interfaces) { 414 mutex_unlock(&ses->session_mutex); 415 416 /* 417 * query server network interfaces, in case they change 418 */ 419 xid = get_xid(); 420 rc = server->ops->query_server_interfaces(xid, tcon, false); 421 free_xid(xid); 422 423 if (rc == -EOPNOTSUPP && ses->chan_count > 1) { 424 /* 425 * some servers like Azure SMB server do not advertise 426 * that multichannel has been disabled with server 427 * capabilities, rather return STATUS_NOT_IMPLEMENTED. 428 * treat this as server not supporting multichannel 429 */ 430 431 rc = cifs_chan_skip_or_disable(ses, server, 432 from_reconnect); 433 goto skip_add_channels; 434 } else if (rc) 435 cifs_dbg(FYI, "%s: failed to query server interfaces: %d\n", 436 __func__, rc); 437 438 if (ses->chan_max > ses->chan_count && 439 ses->iface_count && 440 !SERVER_IS_CHAN(server)) { 441 if (ses->chan_count == 1) { 442 cifs_server_dbg(VFS, "supports multichannel now\n"); 443 queue_delayed_work(cifsiod_wq, &tcon->query_interfaces, 444 (SMB_INTERFACE_POLL_INTERVAL * HZ)); 445 } 446 447 cifs_try_adding_channels(ses); 448 } 449 } else { 450 mutex_unlock(&ses->session_mutex); 451 } 452 453 skip_add_channels: 454 spin_lock(&ses->ses_lock); 455 ses->flags &= ~CIFS_SES_FLAG_SCALE_CHANNELS; 456 spin_unlock(&ses->ses_lock); 457 458 if (smb2_command != SMB2_INTERNAL_CMD) 459 mod_delayed_work(cifsiod_wq, &server->reconnect, 0); 460 461 atomic_inc(&tconInfoReconnectCount); 462 out: 463 /* 464 * Check if handle based operation so we know whether we can continue 465 * or not without returning to caller to reset file handle. 466 */ 467 /* 468 * BB Is flush done by server on drop of tcp session? Should we special 469 * case it and skip above? 470 */ 471 switch (smb2_command) { 472 case SMB2_FLUSH: 473 case SMB2_READ: 474 case SMB2_WRITE: 475 case SMB2_LOCK: 476 case SMB2_QUERY_DIRECTORY: 477 case SMB2_CHANGE_NOTIFY: 478 case SMB2_QUERY_INFO: 479 case SMB2_SET_INFO: 480 case SMB2_IOCTL: 481 rc = -EAGAIN; 482 } 483 return rc; 484 } 485 486 static void 487 fill_small_buf(__le16 smb2_command, struct cifs_tcon *tcon, 488 struct TCP_Server_Info *server, 489 void *buf, 490 unsigned int *total_len) 491 { 492 struct smb2_pdu *spdu = buf; 493 /* lookup word count ie StructureSize from table */ 494 __u16 parmsize = smb2_req_struct_sizes[le16_to_cpu(smb2_command)]; 495 496 /* 497 * smaller than SMALL_BUFFER_SIZE but bigger than fixed area of 498 * largest operations (Create) 499 */ 500 memset(buf, 0, 256); 501 502 smb2_hdr_assemble(&spdu->hdr, smb2_command, tcon, server); 503 spdu->StructureSize2 = cpu_to_le16(parmsize); 504 505 *total_len = parmsize + sizeof(struct smb2_hdr); 506 } 507 508 /* 509 * Allocate and return pointer to an SMB request hdr, and set basic 510 * SMB information in the SMB header. If the return code is zero, this 511 * function must have filled in request_buf pointer. 512 */ 513 static int __smb2_plain_req_init(__le16 smb2_command, struct cifs_tcon *tcon, 514 struct TCP_Server_Info *server, 515 void **request_buf, unsigned int *total_len) 516 { 517 /* BB eventually switch this to SMB2 specific small buf size */ 518 switch (smb2_command) { 519 case SMB2_SET_INFO: 520 case SMB2_QUERY_INFO: 521 *request_buf = cifs_buf_get(); 522 break; 523 default: 524 *request_buf = cifs_small_buf_get(); 525 break; 526 } 527 if (*request_buf == NULL) { 528 /* BB should we add a retry in here if not a writepage? */ 529 return -ENOMEM; 530 } 531 532 fill_small_buf(smb2_command, tcon, server, 533 (struct smb2_hdr *)(*request_buf), 534 total_len); 535 536 if (tcon != NULL) { 537 uint16_t com_code = le16_to_cpu(smb2_command); 538 cifs_stats_inc(&tcon->stats.smb2_stats.smb2_com_sent[com_code]); 539 cifs_stats_inc(&tcon->num_smbs_sent); 540 } 541 542 return 0; 543 } 544 545 static int smb2_plain_req_init(__le16 smb2_command, struct cifs_tcon *tcon, 546 struct TCP_Server_Info *server, 547 void **request_buf, unsigned int *total_len) 548 { 549 int rc; 550 551 rc = smb2_reconnect(smb2_command, tcon, server, false); 552 if (rc) 553 return rc; 554 555 return __smb2_plain_req_init(smb2_command, tcon, server, request_buf, 556 total_len); 557 } 558 559 static int smb2_ioctl_req_init(u32 opcode, struct cifs_tcon *tcon, 560 struct TCP_Server_Info *server, 561 void **request_buf, unsigned int *total_len) 562 { 563 /* Skip reconnect only for FSCTL_VALIDATE_NEGOTIATE_INFO IOCTLs */ 564 if (opcode == FSCTL_VALIDATE_NEGOTIATE_INFO) { 565 return __smb2_plain_req_init(SMB2_IOCTL, tcon, server, 566 request_buf, total_len); 567 } 568 return smb2_plain_req_init(SMB2_IOCTL, tcon, server, 569 request_buf, total_len); 570 } 571 572 /* For explanation of negotiate contexts see MS-SMB2 section 2.2.3.1 */ 573 574 static void 575 build_preauth_ctxt(struct smb2_preauth_neg_context *pneg_ctxt) 576 { 577 pneg_ctxt->ContextType = SMB2_PREAUTH_INTEGRITY_CAPABILITIES; 578 pneg_ctxt->DataLength = cpu_to_le16(38); 579 pneg_ctxt->HashAlgorithmCount = cpu_to_le16(1); 580 pneg_ctxt->SaltLength = cpu_to_le16(SMB311_SALT_SIZE); 581 get_random_bytes(pneg_ctxt->Salt, SMB311_SALT_SIZE); 582 pneg_ctxt->HashAlgorithms = SMB2_PREAUTH_INTEGRITY_SHA512; 583 } 584 585 static void 586 build_compression_ctxt(struct smb2_compression_capabilities_context *pneg_ctxt) 587 { 588 pneg_ctxt->ContextType = SMB2_COMPRESSION_CAPABILITIES; 589 pneg_ctxt->DataLength = 590 cpu_to_le16(sizeof(struct smb2_compression_capabilities_context) 591 - sizeof(struct smb2_neg_context)); 592 pneg_ctxt->CompressionAlgorithmCount = cpu_to_le16(3); 593 pneg_ctxt->CompressionAlgorithms[0] = SMB3_COMPRESS_LZ77; 594 pneg_ctxt->CompressionAlgorithms[1] = SMB3_COMPRESS_LZ77_HUFF; 595 pneg_ctxt->CompressionAlgorithms[2] = SMB3_COMPRESS_LZNT1; 596 } 597 598 static unsigned int 599 build_signing_ctxt(struct smb2_signing_capabilities *pneg_ctxt) 600 { 601 unsigned int ctxt_len = sizeof(struct smb2_signing_capabilities); 602 unsigned short num_algs = 1; /* number of signing algorithms sent */ 603 604 pneg_ctxt->ContextType = SMB2_SIGNING_CAPABILITIES; 605 /* 606 * Context Data length must be rounded to multiple of 8 for some servers 607 */ 608 pneg_ctxt->DataLength = cpu_to_le16(ALIGN(sizeof(struct smb2_signing_capabilities) - 609 sizeof(struct smb2_neg_context) + 610 (num_algs * sizeof(u16)), 8)); 611 pneg_ctxt->SigningAlgorithmCount = cpu_to_le16(num_algs); 612 pneg_ctxt->SigningAlgorithms[0] = cpu_to_le16(SIGNING_ALG_AES_CMAC); 613 614 ctxt_len += sizeof(__le16) * num_algs; 615 ctxt_len = ALIGN(ctxt_len, 8); 616 return ctxt_len; 617 /* TBD add SIGNING_ALG_AES_GMAC and/or SIGNING_ALG_HMAC_SHA256 */ 618 } 619 620 static void 621 build_encrypt_ctxt(struct smb2_encryption_neg_context *pneg_ctxt) 622 { 623 pneg_ctxt->ContextType = SMB2_ENCRYPTION_CAPABILITIES; 624 if (require_gcm_256) { 625 pneg_ctxt->DataLength = cpu_to_le16(4); /* Cipher Count + 1 cipher */ 626 pneg_ctxt->CipherCount = cpu_to_le16(1); 627 pneg_ctxt->Ciphers[0] = SMB2_ENCRYPTION_AES256_GCM; 628 } else if (enable_gcm_256) { 629 pneg_ctxt->DataLength = cpu_to_le16(8); /* Cipher Count + 3 ciphers */ 630 pneg_ctxt->CipherCount = cpu_to_le16(3); 631 pneg_ctxt->Ciphers[0] = SMB2_ENCRYPTION_AES128_GCM; 632 pneg_ctxt->Ciphers[1] = SMB2_ENCRYPTION_AES256_GCM; 633 pneg_ctxt->Ciphers[2] = SMB2_ENCRYPTION_AES128_CCM; 634 } else { 635 pneg_ctxt->DataLength = cpu_to_le16(6); /* Cipher Count + 2 ciphers */ 636 pneg_ctxt->CipherCount = cpu_to_le16(2); 637 pneg_ctxt->Ciphers[0] = SMB2_ENCRYPTION_AES128_GCM; 638 pneg_ctxt->Ciphers[1] = SMB2_ENCRYPTION_AES128_CCM; 639 } 640 } 641 642 static unsigned int 643 build_netname_ctxt(struct smb2_netname_neg_context *pneg_ctxt, char *hostname) 644 { 645 struct nls_table *cp = load_nls_default(); 646 647 pneg_ctxt->ContextType = SMB2_NETNAME_NEGOTIATE_CONTEXT_ID; 648 649 /* copy up to max of first 100 bytes of server name to NetName field */ 650 pneg_ctxt->DataLength = cpu_to_le16(2 * cifs_strtoUTF16(pneg_ctxt->NetName, hostname, 100, cp)); 651 /* context size is DataLength + minimal smb2_neg_context */ 652 return ALIGN(le16_to_cpu(pneg_ctxt->DataLength) + sizeof(struct smb2_neg_context), 8); 653 } 654 655 static void 656 build_posix_ctxt(struct smb2_posix_neg_context *pneg_ctxt) 657 { 658 pneg_ctxt->ContextType = SMB2_POSIX_EXTENSIONS_AVAILABLE; 659 pneg_ctxt->DataLength = cpu_to_le16(POSIX_CTXT_DATA_LEN); 660 /* SMB2_CREATE_TAG_POSIX is "0x93AD25509CB411E7B42383DE968BCD7C" */ 661 pneg_ctxt->Name[0] = 0x93; 662 pneg_ctxt->Name[1] = 0xAD; 663 pneg_ctxt->Name[2] = 0x25; 664 pneg_ctxt->Name[3] = 0x50; 665 pneg_ctxt->Name[4] = 0x9C; 666 pneg_ctxt->Name[5] = 0xB4; 667 pneg_ctxt->Name[6] = 0x11; 668 pneg_ctxt->Name[7] = 0xE7; 669 pneg_ctxt->Name[8] = 0xB4; 670 pneg_ctxt->Name[9] = 0x23; 671 pneg_ctxt->Name[10] = 0x83; 672 pneg_ctxt->Name[11] = 0xDE; 673 pneg_ctxt->Name[12] = 0x96; 674 pneg_ctxt->Name[13] = 0x8B; 675 pneg_ctxt->Name[14] = 0xCD; 676 pneg_ctxt->Name[15] = 0x7C; 677 } 678 679 static void 680 assemble_neg_contexts(struct smb2_negotiate_req *req, 681 struct TCP_Server_Info *server, unsigned int *total_len) 682 { 683 unsigned int ctxt_len, neg_context_count; 684 struct TCP_Server_Info *pserver; 685 char *pneg_ctxt; 686 char *hostname; 687 688 if (*total_len > 200) { 689 /* In case length corrupted don't want to overrun smb buffer */ 690 cifs_server_dbg(VFS, "Bad frame length assembling neg contexts\n"); 691 return; 692 } 693 694 /* 695 * round up total_len of fixed part of SMB3 negotiate request to 8 696 * byte boundary before adding negotiate contexts 697 */ 698 *total_len = ALIGN(*total_len, 8); 699 700 pneg_ctxt = (*total_len) + (char *)req; 701 req->NegotiateContextOffset = cpu_to_le32(*total_len); 702 703 build_preauth_ctxt((struct smb2_preauth_neg_context *)pneg_ctxt); 704 ctxt_len = ALIGN(sizeof(struct smb2_preauth_neg_context), 8); 705 *total_len += ctxt_len; 706 pneg_ctxt += ctxt_len; 707 708 build_encrypt_ctxt((struct smb2_encryption_neg_context *)pneg_ctxt); 709 ctxt_len = ALIGN(sizeof(struct smb2_encryption_neg_context), 8); 710 *total_len += ctxt_len; 711 pneg_ctxt += ctxt_len; 712 713 /* 714 * secondary channels don't have the hostname field populated 715 * use the hostname field in the primary channel instead 716 */ 717 pserver = SERVER_IS_CHAN(server) ? server->primary_server : server; 718 cifs_server_lock(pserver); 719 hostname = pserver->hostname; 720 if (hostname && (hostname[0] != 0)) { 721 ctxt_len = build_netname_ctxt((struct smb2_netname_neg_context *)pneg_ctxt, 722 hostname); 723 *total_len += ctxt_len; 724 pneg_ctxt += ctxt_len; 725 neg_context_count = 3; 726 } else 727 neg_context_count = 2; 728 cifs_server_unlock(pserver); 729 730 build_posix_ctxt((struct smb2_posix_neg_context *)pneg_ctxt); 731 *total_len += sizeof(struct smb2_posix_neg_context); 732 pneg_ctxt += sizeof(struct smb2_posix_neg_context); 733 neg_context_count++; 734 735 if (server->compression.requested) { 736 build_compression_ctxt((struct smb2_compression_capabilities_context *) 737 pneg_ctxt); 738 ctxt_len = ALIGN(sizeof(struct smb2_compression_capabilities_context), 8); 739 *total_len += ctxt_len; 740 pneg_ctxt += ctxt_len; 741 neg_context_count++; 742 } 743 744 if (enable_negotiate_signing) { 745 ctxt_len = build_signing_ctxt((struct smb2_signing_capabilities *) 746 pneg_ctxt); 747 *total_len += ctxt_len; 748 pneg_ctxt += ctxt_len; 749 neg_context_count++; 750 } 751 752 /* check for and add transport_capabilities and signing capabilities */ 753 req->NegotiateContextCount = cpu_to_le16(neg_context_count); 754 755 } 756 757 /* If invalid preauth context warn but use what we requested, SHA-512 */ 758 static void decode_preauth_context(struct smb2_preauth_neg_context *ctxt) 759 { 760 unsigned int len = le16_to_cpu(ctxt->DataLength); 761 762 /* 763 * Caller checked that DataLength remains within SMB boundary. We still 764 * need to confirm that one HashAlgorithms member is accounted for. 765 */ 766 if (len < MIN_PREAUTH_CTXT_DATA_LEN) { 767 pr_warn_once("server sent bad preauth context\n"); 768 return; 769 } else if (len < MIN_PREAUTH_CTXT_DATA_LEN + le16_to_cpu(ctxt->SaltLength)) { 770 pr_warn_once("server sent invalid SaltLength\n"); 771 return; 772 } 773 if (le16_to_cpu(ctxt->HashAlgorithmCount) != 1) 774 pr_warn_once("Invalid SMB3 hash algorithm count\n"); 775 if (ctxt->HashAlgorithms != SMB2_PREAUTH_INTEGRITY_SHA512) 776 pr_warn_once("unknown SMB3 hash algorithm\n"); 777 } 778 779 static void decode_compress_ctx(struct TCP_Server_Info *server, 780 struct smb2_compression_capabilities_context *ctxt) 781 { 782 unsigned int len = le16_to_cpu(ctxt->DataLength); 783 __le16 alg; 784 785 server->compression.enabled = false; 786 787 /* 788 * Caller checked that DataLength remains within SMB boundary. We still 789 * need to confirm that one CompressionAlgorithms member is accounted 790 * for. 791 */ 792 if (len < 10) { 793 pr_warn_once("server sent bad compression cntxt\n"); 794 return; 795 } 796 797 if (le16_to_cpu(ctxt->CompressionAlgorithmCount) != 1) { 798 pr_warn_once("invalid SMB3 compress algorithm count\n"); 799 return; 800 } 801 802 alg = ctxt->CompressionAlgorithms[0]; 803 804 /* 'NONE' (0) compressor type is never negotiated */ 805 if (alg == 0 || le16_to_cpu(alg) > 3) { 806 pr_warn_once("invalid compression algorithm '%u'\n", alg); 807 return; 808 } 809 810 server->compression.alg = alg; 811 server->compression.enabled = true; 812 } 813 814 static int decode_encrypt_ctx(struct TCP_Server_Info *server, 815 struct smb2_encryption_neg_context *ctxt) 816 { 817 unsigned int len = le16_to_cpu(ctxt->DataLength); 818 819 cifs_dbg(FYI, "decode SMB3.11 encryption neg context of len %d\n", len); 820 /* 821 * Caller checked that DataLength remains within SMB boundary. We still 822 * need to confirm that one Cipher flexible array member is accounted 823 * for. 824 */ 825 if (len < MIN_ENCRYPT_CTXT_DATA_LEN) { 826 pr_warn_once("server sent bad crypto ctxt len\n"); 827 return -EINVAL; 828 } 829 830 if (le16_to_cpu(ctxt->CipherCount) != 1) { 831 pr_warn_once("Invalid SMB3.11 cipher count\n"); 832 return -EINVAL; 833 } 834 cifs_dbg(FYI, "SMB311 cipher type:%d\n", le16_to_cpu(ctxt->Ciphers[0])); 835 if (require_gcm_256) { 836 if (ctxt->Ciphers[0] != SMB2_ENCRYPTION_AES256_GCM) { 837 cifs_dbg(VFS, "Server does not support requested encryption type (AES256 GCM)\n"); 838 return -EOPNOTSUPP; 839 } 840 } else if (ctxt->Ciphers[0] == 0) { 841 /* 842 * e.g. if server only supported AES256_CCM (very unlikely) 843 * or server supported no encryption types or had all disabled. 844 * Since GLOBAL_CAP_ENCRYPTION will be not set, in the case 845 * in which mount requested encryption ("seal") checks later 846 * on during tree connection will return proper rc, but if 847 * seal not requested by client, since server is allowed to 848 * return 0 to indicate no supported cipher, we can't fail here 849 */ 850 server->cipher_type = 0; 851 server->capabilities &= ~SMB2_GLOBAL_CAP_ENCRYPTION; 852 pr_warn_once("Server does not support requested encryption types\n"); 853 return 0; 854 } else if ((ctxt->Ciphers[0] != SMB2_ENCRYPTION_AES128_CCM) && 855 (ctxt->Ciphers[0] != SMB2_ENCRYPTION_AES128_GCM) && 856 (ctxt->Ciphers[0] != SMB2_ENCRYPTION_AES256_GCM)) { 857 /* server returned a cipher we didn't ask for */ 858 pr_warn_once("Invalid SMB3.11 cipher returned\n"); 859 return -EINVAL; 860 } 861 server->cipher_type = ctxt->Ciphers[0]; 862 server->capabilities |= SMB2_GLOBAL_CAP_ENCRYPTION; 863 return 0; 864 } 865 866 static void decode_signing_ctx(struct TCP_Server_Info *server, 867 struct smb2_signing_capabilities *pctxt) 868 { 869 unsigned int len = le16_to_cpu(pctxt->DataLength); 870 871 /* 872 * Caller checked that DataLength remains within SMB boundary. We still 873 * need to confirm that one SigningAlgorithms flexible array member is 874 * accounted for. 875 */ 876 if ((len < 4) || (len > 16)) { 877 pr_warn_once("server sent bad signing negcontext\n"); 878 return; 879 } 880 if (le16_to_cpu(pctxt->SigningAlgorithmCount) != 1) { 881 pr_warn_once("Invalid signing algorithm count\n"); 882 return; 883 } 884 if (le16_to_cpu(pctxt->SigningAlgorithms[0]) > 2) { 885 pr_warn_once("unknown signing algorithm\n"); 886 return; 887 } 888 889 server->signing_negotiated = true; 890 server->signing_algorithm = le16_to_cpu(pctxt->SigningAlgorithms[0]); 891 cifs_dbg(FYI, "signing algorithm %d chosen\n", 892 server->signing_algorithm); 893 } 894 895 896 static int smb311_decode_neg_context(struct smb2_negotiate_rsp *rsp, 897 struct TCP_Server_Info *server, 898 unsigned int len_of_smb) 899 { 900 struct smb2_neg_context *pctx; 901 unsigned int offset = le32_to_cpu(rsp->NegotiateContextOffset); 902 unsigned int ctxt_cnt = le16_to_cpu(rsp->NegotiateContextCount); 903 unsigned int len_of_ctxts, i; 904 int rc = 0; 905 906 cifs_dbg(FYI, "decoding %d negotiate contexts\n", ctxt_cnt); 907 if (len_of_smb <= offset) { 908 cifs_server_dbg(VFS, "Invalid response: negotiate context offset\n"); 909 return -EINVAL; 910 } 911 912 len_of_ctxts = len_of_smb - offset; 913 914 for (i = 0; i < ctxt_cnt; i++) { 915 int clen; 916 /* check that offset is not beyond end of SMB */ 917 if (len_of_ctxts < sizeof(struct smb2_neg_context)) 918 break; 919 920 pctx = (struct smb2_neg_context *)(offset + (char *)rsp); 921 clen = sizeof(struct smb2_neg_context) 922 + le16_to_cpu(pctx->DataLength); 923 /* 924 * 2.2.4 SMB2 NEGOTIATE Response 925 * Subsequent negotiate contexts MUST appear at the first 8-byte 926 * aligned offset following the previous negotiate context. 927 */ 928 if (i + 1 != ctxt_cnt) 929 clen = ALIGN(clen, 8); 930 if (clen > len_of_ctxts) 931 break; 932 933 if (pctx->ContextType == SMB2_PREAUTH_INTEGRITY_CAPABILITIES) 934 decode_preauth_context( 935 (struct smb2_preauth_neg_context *)pctx); 936 else if (pctx->ContextType == SMB2_ENCRYPTION_CAPABILITIES) 937 rc = decode_encrypt_ctx(server, 938 (struct smb2_encryption_neg_context *)pctx); 939 else if (pctx->ContextType == SMB2_COMPRESSION_CAPABILITIES) 940 decode_compress_ctx(server, 941 (struct smb2_compression_capabilities_context *)pctx); 942 else if (pctx->ContextType == SMB2_POSIX_EXTENSIONS_AVAILABLE) 943 server->posix_ext_supported = true; 944 else if (pctx->ContextType == SMB2_SIGNING_CAPABILITIES) 945 decode_signing_ctx(server, 946 (struct smb2_signing_capabilities *)pctx); 947 else 948 cifs_server_dbg(VFS, "unknown negcontext of type %d ignored\n", 949 le16_to_cpu(pctx->ContextType)); 950 if (rc) 951 break; 952 953 offset += clen; 954 len_of_ctxts -= clen; 955 } 956 return rc; 957 } 958 959 static struct create_posix * 960 create_posix_buf(umode_t mode) 961 { 962 struct create_posix *buf; 963 964 buf = kzalloc(sizeof(struct create_posix), 965 GFP_KERNEL); 966 if (!buf) 967 return NULL; 968 969 buf->ccontext.DataOffset = 970 cpu_to_le16(offsetof(struct create_posix, Mode)); 971 buf->ccontext.DataLength = cpu_to_le32(4); 972 buf->ccontext.NameOffset = 973 cpu_to_le16(offsetof(struct create_posix, Name)); 974 buf->ccontext.NameLength = cpu_to_le16(16); 975 976 /* SMB2_CREATE_TAG_POSIX is "0x93AD25509CB411E7B42383DE968BCD7C" */ 977 buf->Name[0] = 0x93; 978 buf->Name[1] = 0xAD; 979 buf->Name[2] = 0x25; 980 buf->Name[3] = 0x50; 981 buf->Name[4] = 0x9C; 982 buf->Name[5] = 0xB4; 983 buf->Name[6] = 0x11; 984 buf->Name[7] = 0xE7; 985 buf->Name[8] = 0xB4; 986 buf->Name[9] = 0x23; 987 buf->Name[10] = 0x83; 988 buf->Name[11] = 0xDE; 989 buf->Name[12] = 0x96; 990 buf->Name[13] = 0x8B; 991 buf->Name[14] = 0xCD; 992 buf->Name[15] = 0x7C; 993 buf->Mode = cpu_to_le32(mode); 994 cifs_dbg(FYI, "mode on posix create 0%o\n", mode); 995 return buf; 996 } 997 998 static int 999 add_posix_context(struct kvec *iov, unsigned int *num_iovec, umode_t mode) 1000 { 1001 unsigned int num = *num_iovec; 1002 1003 iov[num].iov_base = create_posix_buf(mode); 1004 if (mode == ACL_NO_MODE) 1005 cifs_dbg(FYI, "%s: no mode\n", __func__); 1006 if (iov[num].iov_base == NULL) 1007 return -ENOMEM; 1008 iov[num].iov_len = sizeof(struct create_posix); 1009 *num_iovec = num + 1; 1010 return 0; 1011 } 1012 1013 1014 /* 1015 * 1016 * SMB2 Worker functions follow: 1017 * 1018 * The general structure of the worker functions is: 1019 * 1) Call smb2_init (assembles SMB2 header) 1020 * 2) Initialize SMB2 command specific fields in fixed length area of SMB 1021 * 3) Call smb_sendrcv2 (sends request on socket and waits for response) 1022 * 4) Decode SMB2 command specific fields in the fixed length area 1023 * 5) Decode variable length data area (if any for this SMB2 command type) 1024 * 6) Call free smb buffer 1025 * 7) return 1026 * 1027 */ 1028 1029 int 1030 SMB2_negotiate(const unsigned int xid, 1031 struct cifs_ses *ses, 1032 struct TCP_Server_Info *server) 1033 { 1034 struct smb_rqst rqst; 1035 struct smb2_negotiate_req *req; 1036 struct smb2_negotiate_rsp *rsp; 1037 struct kvec iov[1]; 1038 struct kvec rsp_iov; 1039 int rc; 1040 int resp_buftype; 1041 int blob_offset, blob_length; 1042 char *security_blob; 1043 int flags = CIFS_NEG_OP; 1044 unsigned int total_len; 1045 1046 cifs_dbg(FYI, "Negotiate protocol\n"); 1047 1048 if (!server) { 1049 WARN(1, "%s: server is NULL!\n", __func__); 1050 return -EIO; 1051 } 1052 1053 rc = smb2_plain_req_init(SMB2_NEGOTIATE, NULL, server, 1054 (void **) &req, &total_len); 1055 if (rc) 1056 return rc; 1057 1058 req->hdr.SessionId = 0; 1059 1060 memset(server->preauth_sha_hash, 0, SMB2_PREAUTH_HASH_SIZE); 1061 memset(ses->preauth_sha_hash, 0, SMB2_PREAUTH_HASH_SIZE); 1062 1063 if (strcmp(server->vals->version_string, 1064 SMB3ANY_VERSION_STRING) == 0) { 1065 req->Dialects[0] = cpu_to_le16(SMB30_PROT_ID); 1066 req->Dialects[1] = cpu_to_le16(SMB302_PROT_ID); 1067 req->Dialects[2] = cpu_to_le16(SMB311_PROT_ID); 1068 req->DialectCount = cpu_to_le16(3); 1069 total_len += 6; 1070 } else if (strcmp(server->vals->version_string, 1071 SMBDEFAULT_VERSION_STRING) == 0) { 1072 req->Dialects[0] = cpu_to_le16(SMB21_PROT_ID); 1073 req->Dialects[1] = cpu_to_le16(SMB30_PROT_ID); 1074 req->Dialects[2] = cpu_to_le16(SMB302_PROT_ID); 1075 req->Dialects[3] = cpu_to_le16(SMB311_PROT_ID); 1076 req->DialectCount = cpu_to_le16(4); 1077 total_len += 8; 1078 } else { 1079 /* otherwise send specific dialect */ 1080 req->Dialects[0] = cpu_to_le16(server->vals->protocol_id); 1081 req->DialectCount = cpu_to_le16(1); 1082 total_len += 2; 1083 } 1084 1085 /* only one of SMB2 signing flags may be set in SMB2 request */ 1086 if (ses->sign) 1087 req->SecurityMode = cpu_to_le16(SMB2_NEGOTIATE_SIGNING_REQUIRED); 1088 else if (global_secflags & CIFSSEC_MAY_SIGN) 1089 req->SecurityMode = cpu_to_le16(SMB2_NEGOTIATE_SIGNING_ENABLED); 1090 else 1091 req->SecurityMode = 0; 1092 1093 req->Capabilities = cpu_to_le32(server->vals->req_capabilities); 1094 if (ses->chan_max > 1) 1095 req->Capabilities |= cpu_to_le32(SMB2_GLOBAL_CAP_MULTI_CHANNEL); 1096 1097 /* ClientGUID must be zero for SMB2.02 dialect */ 1098 if (server->vals->protocol_id == SMB20_PROT_ID) 1099 memset(req->ClientGUID, 0, SMB2_CLIENT_GUID_SIZE); 1100 else { 1101 memcpy(req->ClientGUID, server->client_guid, 1102 SMB2_CLIENT_GUID_SIZE); 1103 if ((server->vals->protocol_id == SMB311_PROT_ID) || 1104 (strcmp(server->vals->version_string, 1105 SMB3ANY_VERSION_STRING) == 0) || 1106 (strcmp(server->vals->version_string, 1107 SMBDEFAULT_VERSION_STRING) == 0)) 1108 assemble_neg_contexts(req, server, &total_len); 1109 } 1110 iov[0].iov_base = (char *)req; 1111 iov[0].iov_len = total_len; 1112 1113 memset(&rqst, 0, sizeof(struct smb_rqst)); 1114 rqst.rq_iov = iov; 1115 rqst.rq_nvec = 1; 1116 1117 rc = cifs_send_recv(xid, ses, server, 1118 &rqst, &resp_buftype, flags, &rsp_iov); 1119 cifs_small_buf_release(req); 1120 rsp = (struct smb2_negotiate_rsp *)rsp_iov.iov_base; 1121 /* 1122 * No tcon so can't do 1123 * cifs_stats_inc(&tcon->stats.smb2_stats.smb2_com_fail[SMB2...]); 1124 */ 1125 if (rc == -EOPNOTSUPP) { 1126 cifs_server_dbg(VFS, "Dialect not supported by server. Consider specifying vers=1.0 or vers=2.0 on mount for accessing older servers\n"); 1127 goto neg_exit; 1128 } else if (rc != 0) 1129 goto neg_exit; 1130 1131 rc = -EIO; 1132 if (strcmp(server->vals->version_string, 1133 SMB3ANY_VERSION_STRING) == 0) { 1134 if (rsp->DialectRevision == cpu_to_le16(SMB20_PROT_ID)) { 1135 cifs_server_dbg(VFS, 1136 "SMB2 dialect returned but not requested\n"); 1137 goto neg_exit; 1138 } else if (rsp->DialectRevision == cpu_to_le16(SMB21_PROT_ID)) { 1139 cifs_server_dbg(VFS, 1140 "SMB2.1 dialect returned but not requested\n"); 1141 goto neg_exit; 1142 } else if (rsp->DialectRevision == cpu_to_le16(SMB311_PROT_ID)) { 1143 /* ops set to 3.0 by default for default so update */ 1144 server->ops = &smb311_operations; 1145 server->vals = &smb311_values; 1146 } 1147 } else if (strcmp(server->vals->version_string, 1148 SMBDEFAULT_VERSION_STRING) == 0) { 1149 if (rsp->DialectRevision == cpu_to_le16(SMB20_PROT_ID)) { 1150 cifs_server_dbg(VFS, 1151 "SMB2 dialect returned but not requested\n"); 1152 goto neg_exit; 1153 } else if (rsp->DialectRevision == cpu_to_le16(SMB21_PROT_ID)) { 1154 /* ops set to 3.0 by default for default so update */ 1155 server->ops = &smb21_operations; 1156 server->vals = &smb21_values; 1157 } else if (rsp->DialectRevision == cpu_to_le16(SMB311_PROT_ID)) { 1158 server->ops = &smb311_operations; 1159 server->vals = &smb311_values; 1160 } 1161 } else if (le16_to_cpu(rsp->DialectRevision) != 1162 server->vals->protocol_id) { 1163 /* if requested single dialect ensure returned dialect matched */ 1164 cifs_server_dbg(VFS, "Invalid 0x%x dialect returned: not requested\n", 1165 le16_to_cpu(rsp->DialectRevision)); 1166 goto neg_exit; 1167 } 1168 1169 cifs_dbg(FYI, "mode 0x%x\n", rsp->SecurityMode); 1170 1171 if (rsp->DialectRevision == cpu_to_le16(SMB20_PROT_ID)) 1172 cifs_dbg(FYI, "negotiated smb2.0 dialect\n"); 1173 else if (rsp->DialectRevision == cpu_to_le16(SMB21_PROT_ID)) 1174 cifs_dbg(FYI, "negotiated smb2.1 dialect\n"); 1175 else if (rsp->DialectRevision == cpu_to_le16(SMB30_PROT_ID)) 1176 cifs_dbg(FYI, "negotiated smb3.0 dialect\n"); 1177 else if (rsp->DialectRevision == cpu_to_le16(SMB302_PROT_ID)) 1178 cifs_dbg(FYI, "negotiated smb3.02 dialect\n"); 1179 else if (rsp->DialectRevision == cpu_to_le16(SMB311_PROT_ID)) 1180 cifs_dbg(FYI, "negotiated smb3.1.1 dialect\n"); 1181 else { 1182 cifs_server_dbg(VFS, "Invalid dialect returned by server 0x%x\n", 1183 le16_to_cpu(rsp->DialectRevision)); 1184 goto neg_exit; 1185 } 1186 1187 rc = 0; 1188 server->dialect = le16_to_cpu(rsp->DialectRevision); 1189 1190 /* 1191 * Keep a copy of the hash after negprot. This hash will be 1192 * the starting hash value for all sessions made from this 1193 * server. 1194 */ 1195 memcpy(server->preauth_sha_hash, ses->preauth_sha_hash, 1196 SMB2_PREAUTH_HASH_SIZE); 1197 1198 /* SMB2 only has an extended negflavor */ 1199 server->negflavor = CIFS_NEGFLAVOR_EXTENDED; 1200 /* set it to the maximum buffer size value we can send with 1 credit */ 1201 server->maxBuf = min_t(unsigned int, le32_to_cpu(rsp->MaxTransactSize), 1202 SMB2_MAX_BUFFER_SIZE); 1203 server->max_read = le32_to_cpu(rsp->MaxReadSize); 1204 server->max_write = le32_to_cpu(rsp->MaxWriteSize); 1205 server->sec_mode = le16_to_cpu(rsp->SecurityMode); 1206 if ((server->sec_mode & SMB2_SEC_MODE_FLAGS_ALL) != server->sec_mode) 1207 cifs_dbg(FYI, "Server returned unexpected security mode 0x%x\n", 1208 server->sec_mode); 1209 server->capabilities = le32_to_cpu(rsp->Capabilities); 1210 /* Internal types */ 1211 server->capabilities |= SMB2_NT_FIND | SMB2_LARGE_FILES; 1212 1213 /* 1214 * SMB3.0 supports only 1 cipher and doesn't have a encryption neg context 1215 * Set the cipher type manually. 1216 */ 1217 if ((server->dialect == SMB30_PROT_ID || 1218 server->dialect == SMB302_PROT_ID) && 1219 (server->capabilities & SMB2_GLOBAL_CAP_ENCRYPTION)) 1220 server->cipher_type = SMB2_ENCRYPTION_AES128_CCM; 1221 1222 security_blob = smb2_get_data_area_len(&blob_offset, &blob_length, 1223 (struct smb2_hdr *)rsp); 1224 /* 1225 * See MS-SMB2 section 2.2.4: if no blob, client picks default which 1226 * for us will be 1227 * ses->sectype = RawNTLMSSP; 1228 * but for time being this is our only auth choice so doesn't matter. 1229 * We just found a server which sets blob length to zero expecting raw. 1230 */ 1231 if (blob_length == 0) { 1232 cifs_dbg(FYI, "missing security blob on negprot\n"); 1233 server->sec_ntlmssp = true; 1234 } 1235 1236 rc = cifs_enable_signing(server, ses->sign); 1237 if (rc) 1238 goto neg_exit; 1239 if (blob_length) { 1240 rc = decode_negTokenInit(security_blob, blob_length, server); 1241 if (rc == 1) 1242 rc = 0; 1243 else if (rc == 0) 1244 rc = -EIO; 1245 } 1246 1247 if (rsp->DialectRevision == cpu_to_le16(SMB311_PROT_ID)) { 1248 if (rsp->NegotiateContextCount) 1249 rc = smb311_decode_neg_context(rsp, server, 1250 rsp_iov.iov_len); 1251 else 1252 cifs_server_dbg(VFS, "Missing expected negotiate contexts\n"); 1253 } 1254 1255 if (server->cipher_type && !rc) 1256 rc = smb3_crypto_aead_allocate(server); 1257 neg_exit: 1258 free_rsp_buf(resp_buftype, rsp); 1259 return rc; 1260 } 1261 1262 int smb3_validate_negotiate(const unsigned int xid, struct cifs_tcon *tcon) 1263 { 1264 int rc; 1265 struct validate_negotiate_info_req *pneg_inbuf; 1266 struct validate_negotiate_info_rsp *pneg_rsp = NULL; 1267 u32 rsplen; 1268 u32 inbuflen; /* max of 4 dialects */ 1269 struct TCP_Server_Info *server = tcon->ses->server; 1270 1271 cifs_dbg(FYI, "validate negotiate\n"); 1272 1273 /* In SMB3.11 preauth integrity supersedes validate negotiate */ 1274 if (server->dialect == SMB311_PROT_ID) 1275 return 0; 1276 1277 /* 1278 * validation ioctl must be signed, so no point sending this if we 1279 * can not sign it (ie are not known user). Even if signing is not 1280 * required (enabled but not negotiated), in those cases we selectively 1281 * sign just this, the first and only signed request on a connection. 1282 * Having validation of negotiate info helps reduce attack vectors. 1283 */ 1284 if (tcon->ses->session_flags & SMB2_SESSION_FLAG_IS_GUEST) 1285 return 0; /* validation requires signing */ 1286 1287 if (tcon->ses->user_name == NULL) { 1288 cifs_dbg(FYI, "Can't validate negotiate: null user mount\n"); 1289 return 0; /* validation requires signing */ 1290 } 1291 1292 if (tcon->ses->session_flags & SMB2_SESSION_FLAG_IS_NULL) 1293 cifs_tcon_dbg(VFS, "Unexpected null user (anonymous) auth flag sent by server\n"); 1294 1295 pneg_inbuf = kmalloc(sizeof(*pneg_inbuf), GFP_NOFS); 1296 if (!pneg_inbuf) 1297 return -ENOMEM; 1298 1299 pneg_inbuf->Capabilities = 1300 cpu_to_le32(server->vals->req_capabilities); 1301 if (tcon->ses->chan_max > 1) 1302 pneg_inbuf->Capabilities |= cpu_to_le32(SMB2_GLOBAL_CAP_MULTI_CHANNEL); 1303 1304 memcpy(pneg_inbuf->Guid, server->client_guid, 1305 SMB2_CLIENT_GUID_SIZE); 1306 1307 if (tcon->ses->sign) 1308 pneg_inbuf->SecurityMode = 1309 cpu_to_le16(SMB2_NEGOTIATE_SIGNING_REQUIRED); 1310 else if (global_secflags & CIFSSEC_MAY_SIGN) 1311 pneg_inbuf->SecurityMode = 1312 cpu_to_le16(SMB2_NEGOTIATE_SIGNING_ENABLED); 1313 else 1314 pneg_inbuf->SecurityMode = 0; 1315 1316 1317 if (strcmp(server->vals->version_string, 1318 SMB3ANY_VERSION_STRING) == 0) { 1319 pneg_inbuf->Dialects[0] = cpu_to_le16(SMB30_PROT_ID); 1320 pneg_inbuf->Dialects[1] = cpu_to_le16(SMB302_PROT_ID); 1321 pneg_inbuf->Dialects[2] = cpu_to_le16(SMB311_PROT_ID); 1322 pneg_inbuf->DialectCount = cpu_to_le16(3); 1323 /* SMB 2.1 not included so subtract one dialect from len */ 1324 inbuflen = sizeof(*pneg_inbuf) - 1325 (sizeof(pneg_inbuf->Dialects[0])); 1326 } else if (strcmp(server->vals->version_string, 1327 SMBDEFAULT_VERSION_STRING) == 0) { 1328 pneg_inbuf->Dialects[0] = cpu_to_le16(SMB21_PROT_ID); 1329 pneg_inbuf->Dialects[1] = cpu_to_le16(SMB30_PROT_ID); 1330 pneg_inbuf->Dialects[2] = cpu_to_le16(SMB302_PROT_ID); 1331 pneg_inbuf->Dialects[3] = cpu_to_le16(SMB311_PROT_ID); 1332 pneg_inbuf->DialectCount = cpu_to_le16(4); 1333 /* structure is big enough for 4 dialects */ 1334 inbuflen = sizeof(*pneg_inbuf); 1335 } else { 1336 /* otherwise specific dialect was requested */ 1337 pneg_inbuf->Dialects[0] = 1338 cpu_to_le16(server->vals->protocol_id); 1339 pneg_inbuf->DialectCount = cpu_to_le16(1); 1340 /* structure is big enough for 4 dialects, sending only 1 */ 1341 inbuflen = sizeof(*pneg_inbuf) - 1342 sizeof(pneg_inbuf->Dialects[0]) * 3; 1343 } 1344 1345 rc = SMB2_ioctl(xid, tcon, NO_FILE_ID, NO_FILE_ID, 1346 FSCTL_VALIDATE_NEGOTIATE_INFO, 1347 (char *)pneg_inbuf, inbuflen, CIFSMaxBufSize, 1348 (char **)&pneg_rsp, &rsplen); 1349 if (rc == -EOPNOTSUPP) { 1350 /* 1351 * Old Windows versions or Netapp SMB server can return 1352 * not supported error. Client should accept it. 1353 */ 1354 cifs_tcon_dbg(VFS, "Server does not support validate negotiate\n"); 1355 rc = 0; 1356 goto out_free_inbuf; 1357 } else if (rc != 0) { 1358 cifs_tcon_dbg(VFS, "validate protocol negotiate failed: %d\n", 1359 rc); 1360 rc = -EIO; 1361 goto out_free_inbuf; 1362 } 1363 1364 rc = -EIO; 1365 if (rsplen != sizeof(*pneg_rsp)) { 1366 cifs_tcon_dbg(VFS, "Invalid protocol negotiate response size: %d\n", 1367 rsplen); 1368 1369 /* relax check since Mac returns max bufsize allowed on ioctl */ 1370 if (rsplen > CIFSMaxBufSize || rsplen < sizeof(*pneg_rsp)) 1371 goto out_free_rsp; 1372 } 1373 1374 /* check validate negotiate info response matches what we got earlier */ 1375 if (pneg_rsp->Dialect != cpu_to_le16(server->dialect)) 1376 goto vneg_out; 1377 1378 if (pneg_rsp->SecurityMode != cpu_to_le16(server->sec_mode)) 1379 goto vneg_out; 1380 1381 /* do not validate server guid because not saved at negprot time yet */ 1382 1383 if ((le32_to_cpu(pneg_rsp->Capabilities) | SMB2_NT_FIND | 1384 SMB2_LARGE_FILES) != server->capabilities) 1385 goto vneg_out; 1386 1387 /* validate negotiate successful */ 1388 rc = 0; 1389 cifs_dbg(FYI, "validate negotiate info successful\n"); 1390 goto out_free_rsp; 1391 1392 vneg_out: 1393 cifs_tcon_dbg(VFS, "protocol revalidation - security settings mismatch\n"); 1394 out_free_rsp: 1395 kfree(pneg_rsp); 1396 out_free_inbuf: 1397 kfree(pneg_inbuf); 1398 return rc; 1399 } 1400 1401 enum securityEnum 1402 smb2_select_sectype(struct TCP_Server_Info *server, enum securityEnum requested) 1403 { 1404 switch (requested) { 1405 case Kerberos: 1406 case RawNTLMSSP: 1407 return requested; 1408 case NTLMv2: 1409 return RawNTLMSSP; 1410 case Unspecified: 1411 if (server->sec_ntlmssp && 1412 (global_secflags & CIFSSEC_MAY_NTLMSSP)) 1413 return RawNTLMSSP; 1414 if ((server->sec_kerberos || server->sec_mskerberos || server->sec_iakerb) && 1415 (global_secflags & CIFSSEC_MAY_KRB5)) 1416 return Kerberos; 1417 fallthrough; 1418 default: 1419 return Unspecified; 1420 } 1421 } 1422 1423 struct SMB2_sess_data { 1424 unsigned int xid; 1425 struct cifs_ses *ses; 1426 struct TCP_Server_Info *server; 1427 struct nls_table *nls_cp; 1428 void (*func)(struct SMB2_sess_data *); 1429 int result; 1430 u64 previous_session; 1431 1432 /* we will send the SMB in three pieces: 1433 * a fixed length beginning part, an optional 1434 * SPNEGO blob (which can be zero length), and a 1435 * last part which will include the strings 1436 * and rest of bcc area. This allows us to avoid 1437 * a large buffer 17K allocation 1438 */ 1439 int buf0_type; 1440 struct kvec iov[2]; 1441 }; 1442 1443 static int 1444 SMB2_sess_alloc_buffer(struct SMB2_sess_data *sess_data) 1445 { 1446 int rc; 1447 struct cifs_ses *ses = sess_data->ses; 1448 struct TCP_Server_Info *server = sess_data->server; 1449 struct smb2_sess_setup_req *req; 1450 unsigned int total_len; 1451 bool is_binding = false; 1452 1453 rc = smb2_plain_req_init(SMB2_SESSION_SETUP, NULL, server, 1454 (void **) &req, 1455 &total_len); 1456 if (rc) 1457 return rc; 1458 1459 spin_lock(&ses->ses_lock); 1460 is_binding = (ses->ses_status == SES_GOOD); 1461 spin_unlock(&ses->ses_lock); 1462 1463 if (is_binding) { 1464 req->hdr.SessionId = cpu_to_le64(ses->Suid); 1465 req->hdr.Flags |= SMB2_FLAGS_SIGNED; 1466 req->PreviousSessionId = 0; 1467 req->Flags = SMB2_SESSION_REQ_FLAG_BINDING; 1468 cifs_dbg(FYI, "Binding to sess id: %llx\n", ses->Suid); 1469 } else { 1470 /* First session, not a reauthenticate */ 1471 req->hdr.SessionId = 0; 1472 /* 1473 * if reconnect, we need to send previous sess id 1474 * otherwise it is 0 1475 */ 1476 req->PreviousSessionId = cpu_to_le64(sess_data->previous_session); 1477 req->Flags = 0; /* MBZ */ 1478 cifs_dbg(FYI, "Fresh session. Previous: %llx\n", 1479 sess_data->previous_session); 1480 } 1481 1482 /* enough to enable echos and oplocks and one max size write */ 1483 if (server->credits >= server->max_credits) 1484 req->hdr.CreditRequest = cpu_to_le16(0); 1485 else 1486 req->hdr.CreditRequest = cpu_to_le16( 1487 min_t(int, server->max_credits - 1488 server->credits, 130)); 1489 1490 /* only one of SMB2 signing flags may be set in SMB2 request */ 1491 if (server->sign) 1492 req->SecurityMode = SMB2_NEGOTIATE_SIGNING_REQUIRED; 1493 else if (global_secflags & CIFSSEC_MAY_SIGN) /* one flag unlike MUST_ */ 1494 req->SecurityMode = SMB2_NEGOTIATE_SIGNING_ENABLED; 1495 else 1496 req->SecurityMode = 0; 1497 1498 #ifdef CONFIG_CIFS_DFS_UPCALL 1499 req->Capabilities = cpu_to_le32(SMB2_GLOBAL_CAP_DFS); 1500 #else 1501 req->Capabilities = 0; 1502 #endif /* DFS_UPCALL */ 1503 1504 req->Channel = 0; /* MBZ */ 1505 1506 sess_data->iov[0].iov_base = (char *)req; 1507 /* 1 for pad */ 1508 sess_data->iov[0].iov_len = total_len - 1; 1509 /* 1510 * This variable will be used to clear the buffer 1511 * allocated above in case of any error in the calling function. 1512 */ 1513 sess_data->buf0_type = CIFS_SMALL_BUFFER; 1514 1515 return 0; 1516 } 1517 1518 static void 1519 SMB2_sess_free_buffer(struct SMB2_sess_data *sess_data) 1520 { 1521 struct kvec *iov = sess_data->iov; 1522 1523 /* iov[1] is already freed by caller */ 1524 if (sess_data->buf0_type != CIFS_NO_BUFFER && iov[0].iov_base) 1525 memzero_explicit(iov[0].iov_base, iov[0].iov_len); 1526 1527 free_rsp_buf(sess_data->buf0_type, iov[0].iov_base); 1528 sess_data->buf0_type = CIFS_NO_BUFFER; 1529 } 1530 1531 static int 1532 SMB2_sess_sendreceive(struct SMB2_sess_data *sess_data) 1533 { 1534 int rc; 1535 struct smb_rqst rqst; 1536 struct smb2_sess_setup_req *req = sess_data->iov[0].iov_base; 1537 struct kvec rsp_iov = { NULL, 0 }; 1538 1539 /* Testing shows that buffer offset must be at location of Buffer[0] */ 1540 req->SecurityBufferOffset = 1541 cpu_to_le16(sizeof(struct smb2_sess_setup_req)); 1542 req->SecurityBufferLength = cpu_to_le16(sess_data->iov[1].iov_len); 1543 1544 memset(&rqst, 0, sizeof(struct smb_rqst)); 1545 rqst.rq_iov = sess_data->iov; 1546 rqst.rq_nvec = 2; 1547 1548 /* BB add code to build os and lm fields */ 1549 rc = cifs_send_recv(sess_data->xid, sess_data->ses, 1550 sess_data->server, 1551 &rqst, 1552 &sess_data->buf0_type, 1553 CIFS_LOG_ERROR | CIFS_SESS_OP, &rsp_iov); 1554 cifs_small_buf_release(sess_data->iov[0].iov_base); 1555 if (rc == 0) 1556 sess_data->ses->expired_pwd = false; 1557 else if ((rc == -EACCES) || (rc == -EKEYEXPIRED) || (rc == -EKEYREVOKED)) { 1558 if (sess_data->ses->expired_pwd == false) 1559 trace_smb3_key_expired(sess_data->server->hostname, 1560 sess_data->ses->user_name, 1561 sess_data->server->conn_id, 1562 &sess_data->server->dstaddr, rc); 1563 sess_data->ses->expired_pwd = true; 1564 } 1565 1566 memcpy(&sess_data->iov[0], &rsp_iov, sizeof(struct kvec)); 1567 1568 return rc; 1569 } 1570 1571 static int 1572 SMB2_sess_establish_session(struct SMB2_sess_data *sess_data) 1573 { 1574 int rc = 0; 1575 struct cifs_ses *ses = sess_data->ses; 1576 struct TCP_Server_Info *server = sess_data->server; 1577 1578 cifs_server_lock(server); 1579 if (server->ops->generate_signingkey) { 1580 rc = server->ops->generate_signingkey(ses, server); 1581 if (rc) { 1582 cifs_dbg(FYI, 1583 "SMB3 session key generation failed\n"); 1584 cifs_server_unlock(server); 1585 return rc; 1586 } 1587 } 1588 if (!server->session_estab) { 1589 server->sequence_number = 0x2; 1590 server->session_estab = true; 1591 } 1592 cifs_server_unlock(server); 1593 1594 cifs_dbg(FYI, "SMB2/3 session established successfully\n"); 1595 return rc; 1596 } 1597 1598 #ifdef CONFIG_CIFS_UPCALL 1599 static void 1600 SMB2_auth_kerberos(struct SMB2_sess_data *sess_data) 1601 { 1602 int rc; 1603 struct cifs_ses *ses = sess_data->ses; 1604 struct TCP_Server_Info *server = sess_data->server; 1605 struct cifs_spnego_msg *msg; 1606 struct key *spnego_key = NULL; 1607 struct smb2_sess_setup_rsp *rsp = NULL; 1608 bool is_binding = false; 1609 1610 rc = SMB2_sess_alloc_buffer(sess_data); 1611 if (rc) 1612 goto out; 1613 1614 spnego_key = cifs_get_spnego_key(ses, server); 1615 if (IS_ERR(spnego_key)) { 1616 rc = PTR_ERR(spnego_key); 1617 if (rc == -ENOKEY) 1618 cifs_dbg(VFS, "Verify user has a krb5 ticket and keyutils is installed\n"); 1619 spnego_key = NULL; 1620 goto out; 1621 } 1622 1623 msg = spnego_key->payload.data[0]; 1624 /* 1625 * check version field to make sure that cifs.upcall is 1626 * sending us a response in an expected form 1627 */ 1628 if (msg->version != CIFS_SPNEGO_UPCALL_VERSION) { 1629 cifs_dbg(VFS, "bad cifs.upcall version. Expected %d got %d\n", 1630 CIFS_SPNEGO_UPCALL_VERSION, msg->version); 1631 rc = -EKEYREJECTED; 1632 goto out_put_spnego_key; 1633 } 1634 1635 spin_lock(&ses->ses_lock); 1636 is_binding = (ses->ses_status == SES_GOOD); 1637 spin_unlock(&ses->ses_lock); 1638 1639 /* keep session key if binding */ 1640 if (!is_binding) { 1641 kfree_sensitive(ses->auth_key.response); 1642 ses->auth_key.response = kmemdup(msg->data, msg->sesskey_len, 1643 GFP_KERNEL); 1644 if (!ses->auth_key.response) { 1645 cifs_dbg(VFS, "Kerberos can't allocate (%u bytes) memory\n", 1646 msg->sesskey_len); 1647 rc = -ENOMEM; 1648 goto out_put_spnego_key; 1649 } 1650 ses->auth_key.len = msg->sesskey_len; 1651 } 1652 1653 sess_data->iov[1].iov_base = msg->data + msg->sesskey_len; 1654 sess_data->iov[1].iov_len = msg->secblob_len; 1655 1656 rc = SMB2_sess_sendreceive(sess_data); 1657 if (rc) 1658 goto out_put_spnego_key; 1659 1660 rsp = (struct smb2_sess_setup_rsp *)sess_data->iov[0].iov_base; 1661 /* keep session id and flags if binding */ 1662 if (!is_binding) { 1663 ses->Suid = le64_to_cpu(rsp->hdr.SessionId); 1664 ses->session_flags = le16_to_cpu(rsp->SessionFlags); 1665 } 1666 1667 rc = SMB2_sess_establish_session(sess_data); 1668 out_put_spnego_key: 1669 key_invalidate(spnego_key); 1670 key_put(spnego_key); 1671 if (rc) { 1672 kfree_sensitive(ses->auth_key.response); 1673 ses->auth_key.response = NULL; 1674 ses->auth_key.len = 0; 1675 } 1676 out: 1677 sess_data->result = rc; 1678 sess_data->func = NULL; 1679 SMB2_sess_free_buffer(sess_data); 1680 } 1681 #else 1682 static void 1683 SMB2_auth_kerberos(struct SMB2_sess_data *sess_data) 1684 { 1685 cifs_dbg(VFS, "Kerberos negotiated but upcall support disabled!\n"); 1686 sess_data->result = -EOPNOTSUPP; 1687 sess_data->func = NULL; 1688 } 1689 #endif 1690 1691 static void 1692 SMB2_sess_auth_rawntlmssp_authenticate(struct SMB2_sess_data *sess_data); 1693 1694 static void 1695 SMB2_sess_auth_rawntlmssp_negotiate(struct SMB2_sess_data *sess_data) 1696 { 1697 int rc; 1698 struct cifs_ses *ses = sess_data->ses; 1699 struct TCP_Server_Info *server = sess_data->server; 1700 struct smb2_sess_setup_rsp *rsp = NULL; 1701 unsigned char *ntlmssp_blob = NULL; 1702 bool use_spnego = false; /* else use raw ntlmssp */ 1703 u16 blob_length = 0; 1704 bool is_binding = false; 1705 1706 /* 1707 * If memory allocation is successful, caller of this function 1708 * frees it. 1709 */ 1710 ses->ntlmssp = kmalloc(sizeof(struct ntlmssp_auth), GFP_KERNEL); 1711 if (!ses->ntlmssp) { 1712 rc = -ENOMEM; 1713 goto out_err; 1714 } 1715 ses->ntlmssp->sesskey_per_smbsess = true; 1716 1717 rc = SMB2_sess_alloc_buffer(sess_data); 1718 if (rc) 1719 goto out_err; 1720 1721 rc = build_ntlmssp_smb3_negotiate_blob(&ntlmssp_blob, 1722 &blob_length, ses, server, 1723 sess_data->nls_cp); 1724 if (rc) 1725 goto out; 1726 1727 if (use_spnego) { 1728 /* BB eventually need to add this */ 1729 cifs_dbg(VFS, "spnego not supported for SMB2 yet\n"); 1730 rc = -EOPNOTSUPP; 1731 goto out; 1732 } 1733 sess_data->iov[1].iov_base = ntlmssp_blob; 1734 sess_data->iov[1].iov_len = blob_length; 1735 1736 rc = SMB2_sess_sendreceive(sess_data); 1737 rsp = (struct smb2_sess_setup_rsp *)sess_data->iov[0].iov_base; 1738 1739 /* If true, rc here is expected and not an error */ 1740 if (sess_data->buf0_type != CIFS_NO_BUFFER && 1741 rsp->hdr.Status == STATUS_MORE_PROCESSING_REQUIRED) 1742 rc = 0; 1743 1744 if (rc) 1745 goto out; 1746 1747 if (offsetof(struct smb2_sess_setup_rsp, Buffer) != 1748 le16_to_cpu(rsp->SecurityBufferOffset)) { 1749 cifs_dbg(VFS, "Invalid security buffer offset %d\n", 1750 le16_to_cpu(rsp->SecurityBufferOffset)); 1751 rc = -EIO; 1752 goto out; 1753 } 1754 rc = decode_ntlmssp_challenge(rsp->Buffer, 1755 le16_to_cpu(rsp->SecurityBufferLength), ses); 1756 if (rc) 1757 goto out; 1758 1759 cifs_dbg(FYI, "rawntlmssp session setup challenge phase\n"); 1760 1761 spin_lock(&ses->ses_lock); 1762 is_binding = (ses->ses_status == SES_GOOD); 1763 spin_unlock(&ses->ses_lock); 1764 1765 /* keep existing ses id and flags if binding */ 1766 if (!is_binding) { 1767 ses->Suid = le64_to_cpu(rsp->hdr.SessionId); 1768 ses->session_flags = le16_to_cpu(rsp->SessionFlags); 1769 } 1770 1771 out: 1772 kfree_sensitive(ntlmssp_blob); 1773 SMB2_sess_free_buffer(sess_data); 1774 if (!rc) { 1775 sess_data->result = 0; 1776 sess_data->func = SMB2_sess_auth_rawntlmssp_authenticate; 1777 return; 1778 } 1779 out_err: 1780 kfree_sensitive(ses->ntlmssp); 1781 ses->ntlmssp = NULL; 1782 sess_data->result = rc; 1783 sess_data->func = NULL; 1784 } 1785 1786 static void 1787 SMB2_sess_auth_rawntlmssp_authenticate(struct SMB2_sess_data *sess_data) 1788 { 1789 int rc; 1790 struct cifs_ses *ses = sess_data->ses; 1791 struct TCP_Server_Info *server = sess_data->server; 1792 struct smb2_sess_setup_req *req; 1793 struct smb2_sess_setup_rsp *rsp = NULL; 1794 unsigned char *ntlmssp_blob = NULL; 1795 bool use_spnego = false; /* else use raw ntlmssp */ 1796 u16 blob_length = 0; 1797 bool is_binding = false; 1798 1799 rc = SMB2_sess_alloc_buffer(sess_data); 1800 if (rc) 1801 goto out; 1802 1803 req = (struct smb2_sess_setup_req *) sess_data->iov[0].iov_base; 1804 req->hdr.SessionId = cpu_to_le64(ses->Suid); 1805 1806 rc = build_ntlmssp_auth_blob(&ntlmssp_blob, &blob_length, 1807 ses, server, 1808 sess_data->nls_cp); 1809 if (rc) { 1810 cifs_dbg(FYI, "build_ntlmssp_auth_blob failed %d\n", rc); 1811 goto out; 1812 } 1813 1814 if (use_spnego) { 1815 /* BB eventually need to add this */ 1816 cifs_dbg(VFS, "spnego not supported for SMB2 yet\n"); 1817 rc = -EOPNOTSUPP; 1818 goto out; 1819 } 1820 sess_data->iov[1].iov_base = ntlmssp_blob; 1821 sess_data->iov[1].iov_len = blob_length; 1822 1823 rc = SMB2_sess_sendreceive(sess_data); 1824 if (rc) 1825 goto out; 1826 1827 rsp = (struct smb2_sess_setup_rsp *)sess_data->iov[0].iov_base; 1828 1829 spin_lock(&ses->ses_lock); 1830 is_binding = (ses->ses_status == SES_GOOD); 1831 spin_unlock(&ses->ses_lock); 1832 1833 /* keep existing ses id and flags if binding */ 1834 if (!is_binding) { 1835 ses->Suid = le64_to_cpu(rsp->hdr.SessionId); 1836 ses->session_flags = le16_to_cpu(rsp->SessionFlags); 1837 } 1838 1839 rc = SMB2_sess_establish_session(sess_data); 1840 #ifdef CONFIG_CIFS_DEBUG_DUMP_KEYS 1841 if (ses->server->dialect < SMB30_PROT_ID) { 1842 cifs_dbg(VFS, "%s: dumping generated SMB2 session keys\n", __func__); 1843 /* 1844 * The session id is opaque in terms of endianness, so we can't 1845 * print it as a long long. we dump it as we got it on the wire 1846 */ 1847 cifs_dbg(VFS, "Session Id %*ph\n", (int)sizeof(ses->Suid), 1848 &ses->Suid); 1849 cifs_dbg(VFS, "Session Key %*ph\n", 1850 SMB2_NTLMV2_SESSKEY_SIZE, ses->auth_key.response); 1851 cifs_dbg(VFS, "Signing Key %*ph\n", 1852 SMB3_SIGN_KEY_SIZE, ses->auth_key.response); 1853 } 1854 #endif 1855 out: 1856 kfree_sensitive(ntlmssp_blob); 1857 SMB2_sess_free_buffer(sess_data); 1858 kfree_sensitive(ses->ntlmssp); 1859 ses->ntlmssp = NULL; 1860 sess_data->result = rc; 1861 sess_data->func = NULL; 1862 } 1863 1864 static int 1865 SMB2_select_sec(struct SMB2_sess_data *sess_data) 1866 { 1867 int type; 1868 struct cifs_ses *ses = sess_data->ses; 1869 struct TCP_Server_Info *server = sess_data->server; 1870 1871 type = smb2_select_sectype(server, ses->sectype); 1872 cifs_dbg(FYI, "sess setup type %d\n", type); 1873 if (type == Unspecified) { 1874 cifs_dbg(VFS, "Unable to select appropriate authentication method!\n"); 1875 return -EINVAL; 1876 } 1877 1878 switch (type) { 1879 case Kerberos: 1880 sess_data->func = SMB2_auth_kerberos; 1881 break; 1882 case RawNTLMSSP: 1883 sess_data->func = SMB2_sess_auth_rawntlmssp_negotiate; 1884 break; 1885 default: 1886 cifs_dbg(VFS, "secType %d not supported!\n", type); 1887 return -EOPNOTSUPP; 1888 } 1889 1890 return 0; 1891 } 1892 1893 int 1894 SMB2_sess_setup(const unsigned int xid, struct cifs_ses *ses, 1895 struct TCP_Server_Info *server, 1896 const struct nls_table *nls_cp) 1897 { 1898 int rc = 0; 1899 struct SMB2_sess_data *sess_data; 1900 1901 cifs_dbg(FYI, "Session Setup\n"); 1902 1903 if (!server) { 1904 WARN(1, "%s: server is NULL!\n", __func__); 1905 return -EIO; 1906 } 1907 1908 sess_data = kzalloc(sizeof(struct SMB2_sess_data), GFP_KERNEL); 1909 if (!sess_data) 1910 return -ENOMEM; 1911 1912 sess_data->xid = xid; 1913 sess_data->ses = ses; 1914 sess_data->server = server; 1915 sess_data->buf0_type = CIFS_NO_BUFFER; 1916 sess_data->nls_cp = (struct nls_table *) nls_cp; 1917 sess_data->previous_session = ses->Suid; 1918 1919 rc = SMB2_select_sec(sess_data); 1920 if (rc) 1921 goto out; 1922 1923 /* 1924 * Initialize the session hash with the server one. 1925 */ 1926 memcpy(ses->preauth_sha_hash, server->preauth_sha_hash, 1927 SMB2_PREAUTH_HASH_SIZE); 1928 1929 while (sess_data->func) 1930 sess_data->func(sess_data); 1931 1932 if ((ses->session_flags & SMB2_SESSION_FLAG_IS_GUEST) && (ses->sign)) 1933 cifs_server_dbg(VFS, "signing requested but authenticated as guest\n"); 1934 rc = sess_data->result; 1935 out: 1936 kfree_sensitive(sess_data); 1937 return rc; 1938 } 1939 1940 int 1941 SMB2_logoff(const unsigned int xid, struct cifs_ses *ses) 1942 { 1943 struct smb_rqst rqst; 1944 struct smb2_logoff_req *req; /* response is also trivial struct */ 1945 int rc = 0; 1946 struct TCP_Server_Info *server; 1947 int flags = 0; 1948 unsigned int total_len; 1949 struct kvec iov[1]; 1950 struct kvec rsp_iov; 1951 int resp_buf_type; 1952 1953 cifs_dbg(FYI, "disconnect session %p\n", ses); 1954 1955 if (ses && (ses->server)) 1956 server = ses->server; 1957 else 1958 return -EIO; 1959 1960 /* no need to send SMB logoff if uid already closed due to reconnect */ 1961 spin_lock(&ses->chan_lock); 1962 if (CIFS_ALL_CHANS_NEED_RECONNECT(ses)) { 1963 spin_unlock(&ses->chan_lock); 1964 goto smb2_session_already_dead; 1965 } 1966 spin_unlock(&ses->chan_lock); 1967 1968 rc = smb2_plain_req_init(SMB2_LOGOFF, NULL, ses->server, 1969 (void **) &req, &total_len); 1970 if (rc) 1971 return rc; 1972 1973 /* since no tcon, smb2_init can not do this, so do here */ 1974 req->hdr.SessionId = cpu_to_le64(ses->Suid); 1975 1976 if (ses->session_flags & SMB2_SESSION_FLAG_ENCRYPT_DATA) 1977 flags |= CIFS_TRANSFORM_REQ; 1978 else if (server->sign) 1979 req->hdr.Flags |= SMB2_FLAGS_SIGNED; 1980 1981 flags |= CIFS_NO_RSP_BUF; 1982 1983 iov[0].iov_base = (char *)req; 1984 iov[0].iov_len = total_len; 1985 1986 memset(&rqst, 0, sizeof(struct smb_rqst)); 1987 rqst.rq_iov = iov; 1988 rqst.rq_nvec = 1; 1989 1990 rc = cifs_send_recv(xid, ses, ses->server, 1991 &rqst, &resp_buf_type, flags, &rsp_iov); 1992 cifs_small_buf_release(req); 1993 /* 1994 * No tcon so can't do 1995 * cifs_stats_inc(&tcon->stats.smb2_stats.smb2_com_fail[SMB2...]); 1996 */ 1997 1998 smb2_session_already_dead: 1999 return rc; 2000 } 2001 2002 static inline void cifs_stats_fail_inc(struct cifs_tcon *tcon, uint16_t code) 2003 { 2004 cifs_stats_inc(&tcon->stats.smb2_stats.smb2_com_failed[code]); 2005 } 2006 2007 #define MAX_SHARENAME_LENGTH (255 /* server */ + 80 /* share */ + 1 /* NULL */) 2008 2009 /* These are similar values to what Windows uses */ 2010 static inline void init_copy_chunk_defaults(struct cifs_tcon *tcon) 2011 { 2012 tcon->max_chunks = 256; 2013 tcon->max_bytes_chunk = 1048576; 2014 tcon->max_bytes_copy = 16777216; 2015 } 2016 2017 int 2018 SMB2_tcon(const unsigned int xid, struct cifs_ses *ses, const char *tree, 2019 struct cifs_tcon *tcon, const struct nls_table *cp) 2020 { 2021 struct smb_rqst rqst; 2022 struct smb2_tree_connect_req *req; 2023 struct smb2_tree_connect_rsp *rsp = NULL; 2024 struct kvec iov[2]; 2025 struct kvec rsp_iov = { NULL, 0 }; 2026 int rc = 0; 2027 int resp_buftype; 2028 int unc_path_len; 2029 __le16 *unc_path = NULL; 2030 int flags = 0; 2031 unsigned int total_len; 2032 struct TCP_Server_Info *server = cifs_pick_channel(ses); 2033 2034 cifs_dbg(FYI, "TCON\n"); 2035 2036 if (!server || !tree) 2037 return -EIO; 2038 2039 unc_path = kmalloc(MAX_SHARENAME_LENGTH * 2, GFP_KERNEL); 2040 if (unc_path == NULL) 2041 return -ENOMEM; 2042 2043 unc_path_len = cifs_strtoUTF16(unc_path, tree, strlen(tree), cp); 2044 if (unc_path_len <= 0) { 2045 kfree(unc_path); 2046 return -EINVAL; 2047 } 2048 unc_path_len *= 2; 2049 2050 /* SMB2 TREE_CONNECT request must be called with TreeId == 0 */ 2051 tcon->tid = 0; 2052 atomic_set(&tcon->num_remote_opens, 0); 2053 rc = smb2_plain_req_init(SMB2_TREE_CONNECT, tcon, server, 2054 (void **) &req, &total_len); 2055 if (rc) { 2056 kfree(unc_path); 2057 return rc; 2058 } 2059 2060 if (smb3_encryption_required(tcon)) 2061 flags |= CIFS_TRANSFORM_REQ; 2062 2063 iov[0].iov_base = (char *)req; 2064 /* 1 for pad */ 2065 iov[0].iov_len = total_len - 1; 2066 2067 /* Testing shows that buffer offset must be at location of Buffer[0] */ 2068 req->PathOffset = cpu_to_le16(sizeof(struct smb2_tree_connect_req)); 2069 req->PathLength = cpu_to_le16(unc_path_len); 2070 iov[1].iov_base = unc_path; 2071 iov[1].iov_len = unc_path_len; 2072 2073 /* 2074 * 3.11 tcon req must be signed if not encrypted. See MS-SMB2 3.2.4.1.1 2075 * unless it is guest or anonymous user. See MS-SMB2 3.2.5.3.1 2076 * (Samba servers don't always set the flag so also check if null user) 2077 */ 2078 if ((server->dialect == SMB311_PROT_ID) && 2079 !smb3_encryption_required(tcon) && 2080 !(ses->session_flags & 2081 (SMB2_SESSION_FLAG_IS_GUEST|SMB2_SESSION_FLAG_IS_NULL)) && 2082 ((ses->user_name != NULL) || (ses->sectype == Kerberos))) 2083 req->hdr.Flags |= SMB2_FLAGS_SIGNED; 2084 2085 memset(&rqst, 0, sizeof(struct smb_rqst)); 2086 rqst.rq_iov = iov; 2087 rqst.rq_nvec = 2; 2088 2089 /* Need 64 for max size write so ask for more in case not there yet */ 2090 if (server->credits >= server->max_credits) 2091 req->hdr.CreditRequest = cpu_to_le16(0); 2092 else 2093 req->hdr.CreditRequest = cpu_to_le16( 2094 min_t(int, server->max_credits - 2095 server->credits, 64)); 2096 2097 rc = cifs_send_recv(xid, ses, server, 2098 &rqst, &resp_buftype, flags, &rsp_iov); 2099 cifs_small_buf_release(req); 2100 rsp = (struct smb2_tree_connect_rsp *)rsp_iov.iov_base; 2101 trace_smb3_tcon(xid, tcon->tid, ses->Suid, tree, rc); 2102 if ((rc != 0) || (rsp == NULL)) { 2103 cifs_stats_fail_inc(tcon, SMB2_TREE_CONNECT_HE); 2104 tcon->need_reconnect = true; 2105 goto tcon_error_exit; 2106 } 2107 2108 switch (rsp->ShareType) { 2109 case SMB2_SHARE_TYPE_DISK: 2110 cifs_dbg(FYI, "connection to disk share\n"); 2111 break; 2112 case SMB2_SHARE_TYPE_PIPE: 2113 tcon->pipe = true; 2114 cifs_dbg(FYI, "connection to pipe share\n"); 2115 break; 2116 case SMB2_SHARE_TYPE_PRINT: 2117 tcon->print = true; 2118 cifs_dbg(FYI, "connection to printer\n"); 2119 break; 2120 default: 2121 cifs_server_dbg(VFS, "unknown share type %d\n", rsp->ShareType); 2122 rc = -EOPNOTSUPP; 2123 goto tcon_error_exit; 2124 } 2125 2126 tcon->share_flags = le32_to_cpu(rsp->ShareFlags); 2127 tcon->capabilities = rsp->Capabilities; /* we keep caps little endian */ 2128 tcon->maximal_access = le32_to_cpu(rsp->MaximalAccess); 2129 tcon->tid = le32_to_cpu(rsp->hdr.Id.SyncId.TreeId); 2130 strscpy(tcon->tree_name, tree, sizeof(tcon->tree_name)); 2131 2132 if ((rsp->Capabilities & SMB2_SHARE_CAP_DFS) && 2133 ((tcon->share_flags & SHI1005_FLAGS_DFS) == 0)) 2134 cifs_tcon_dbg(VFS, "DFS capability contradicts DFS flag\n"); 2135 2136 if (tcon->seal && 2137 !(server->capabilities & SMB2_GLOBAL_CAP_ENCRYPTION)) 2138 cifs_tcon_dbg(VFS, "Encryption is requested but not supported\n"); 2139 2140 init_copy_chunk_defaults(tcon); 2141 if (server->ops->validate_negotiate) 2142 rc = server->ops->validate_negotiate(xid, tcon); 2143 if (rc == 0) /* See MS-SMB2 2.2.10 and 3.2.5.5 */ 2144 if (tcon->share_flags & SMB2_SHAREFLAG_ISOLATED_TRANSPORT) 2145 server->nosharesock = true; 2146 tcon_exit: 2147 2148 free_rsp_buf(resp_buftype, rsp); 2149 kfree(unc_path); 2150 return rc; 2151 2152 tcon_error_exit: 2153 if (rsp && rsp->hdr.Status == STATUS_BAD_NETWORK_NAME) 2154 cifs_dbg(VFS | ONCE, "BAD_NETWORK_NAME: %s\n", tree); 2155 goto tcon_exit; 2156 } 2157 2158 int 2159 SMB2_tdis(const unsigned int xid, struct cifs_tcon *tcon) 2160 { 2161 struct smb_rqst rqst; 2162 struct smb2_tree_disconnect_req *req; /* response is trivial */ 2163 int rc = 0; 2164 struct cifs_ses *ses = tcon->ses; 2165 struct TCP_Server_Info *server = cifs_pick_channel(ses); 2166 int flags = 0; 2167 unsigned int total_len; 2168 struct kvec iov[1]; 2169 struct kvec rsp_iov; 2170 int resp_buf_type; 2171 2172 cifs_dbg(FYI, "Tree Disconnect\n"); 2173 2174 if (!ses || !(ses->server)) 2175 return -EIO; 2176 2177 trace_smb3_tdis_enter(xid, tcon->tid, ses->Suid, tcon->tree_name); 2178 spin_lock(&ses->chan_lock); 2179 if ((tcon->need_reconnect) || 2180 (CIFS_ALL_CHANS_NEED_RECONNECT(tcon->ses))) { 2181 spin_unlock(&ses->chan_lock); 2182 return 0; 2183 } 2184 spin_unlock(&ses->chan_lock); 2185 2186 invalidate_all_cached_dirs(tcon); 2187 2188 rc = smb2_plain_req_init(SMB2_TREE_DISCONNECT, tcon, server, 2189 (void **) &req, 2190 &total_len); 2191 if (rc) 2192 return rc; 2193 2194 if (smb3_encryption_required(tcon)) 2195 flags |= CIFS_TRANSFORM_REQ; 2196 2197 flags |= CIFS_NO_RSP_BUF; 2198 2199 iov[0].iov_base = (char *)req; 2200 iov[0].iov_len = total_len; 2201 2202 memset(&rqst, 0, sizeof(struct smb_rqst)); 2203 rqst.rq_iov = iov; 2204 rqst.rq_nvec = 1; 2205 2206 rc = cifs_send_recv(xid, ses, server, 2207 &rqst, &resp_buf_type, flags, &rsp_iov); 2208 cifs_small_buf_release(req); 2209 if (rc) { 2210 cifs_stats_fail_inc(tcon, SMB2_TREE_DISCONNECT_HE); 2211 trace_smb3_tdis_err(xid, tcon->tid, ses->Suid, rc); 2212 } 2213 trace_smb3_tdis_done(xid, tcon->tid, ses->Suid); 2214 2215 return rc; 2216 } 2217 2218 2219 static struct create_durable * 2220 create_durable_buf(void) 2221 { 2222 struct create_durable *buf; 2223 2224 buf = kzalloc(sizeof(struct create_durable), GFP_KERNEL); 2225 if (!buf) 2226 return NULL; 2227 2228 buf->ccontext.DataOffset = cpu_to_le16(offsetof 2229 (struct create_durable, Data)); 2230 buf->ccontext.DataLength = cpu_to_le32(16); 2231 buf->ccontext.NameOffset = cpu_to_le16(offsetof 2232 (struct create_durable, Name)); 2233 buf->ccontext.NameLength = cpu_to_le16(4); 2234 /* SMB2_CREATE_DURABLE_HANDLE_REQUEST is "DHnQ" */ 2235 buf->Name[0] = 'D'; 2236 buf->Name[1] = 'H'; 2237 buf->Name[2] = 'n'; 2238 buf->Name[3] = 'Q'; 2239 return buf; 2240 } 2241 2242 static struct create_durable * 2243 create_reconnect_durable_buf(struct cifs_fid *fid) 2244 { 2245 struct create_durable *buf; 2246 2247 buf = kzalloc(sizeof(struct create_durable), GFP_KERNEL); 2248 if (!buf) 2249 return NULL; 2250 2251 buf->ccontext.DataOffset = cpu_to_le16(offsetof 2252 (struct create_durable, Data)); 2253 buf->ccontext.DataLength = cpu_to_le32(16); 2254 buf->ccontext.NameOffset = cpu_to_le16(offsetof 2255 (struct create_durable, Name)); 2256 buf->ccontext.NameLength = cpu_to_le16(4); 2257 buf->Data.Fid.PersistentFileId = fid->persistent_fid; 2258 buf->Data.Fid.VolatileFileId = fid->volatile_fid; 2259 /* SMB2_CREATE_DURABLE_HANDLE_RECONNECT is "DHnC" */ 2260 buf->Name[0] = 'D'; 2261 buf->Name[1] = 'H'; 2262 buf->Name[2] = 'n'; 2263 buf->Name[3] = 'C'; 2264 return buf; 2265 } 2266 2267 static void 2268 parse_query_id_ctxt(struct create_context *cc, struct smb2_file_all_info *buf) 2269 { 2270 struct create_disk_id_rsp *pdisk_id = (struct create_disk_id_rsp *)cc; 2271 2272 cifs_dbg(FYI, "parse query id context 0x%llx 0x%llx\n", 2273 pdisk_id->DiskFileId, pdisk_id->VolumeId); 2274 buf->IndexNumber = pdisk_id->DiskFileId; 2275 } 2276 2277 static void 2278 parse_posix_ctxt(struct create_context *cc, struct smb2_file_all_info *info, 2279 struct create_posix_rsp *posix) 2280 { 2281 int sid_len; 2282 u8 *beg = (u8 *)cc + le16_to_cpu(cc->DataOffset); 2283 u8 *end = beg + le32_to_cpu(cc->DataLength); 2284 u8 *sid; 2285 2286 memset(posix, 0, sizeof(*posix)); 2287 2288 posix->nlink = le32_to_cpu(*(__le32 *)(beg + 0)); 2289 posix->reparse_tag = le32_to_cpu(*(__le32 *)(beg + 4)); 2290 posix->mode = le32_to_cpu(*(__le32 *)(beg + 8)); 2291 2292 sid = beg + 12; 2293 sid_len = posix_info_sid_size(sid, end); 2294 if (sid_len < 0) { 2295 cifs_dbg(VFS, "bad owner sid in posix create response\n"); 2296 return; 2297 } 2298 memcpy(&posix->owner, sid, sid_len); 2299 2300 sid = sid + sid_len; 2301 sid_len = posix_info_sid_size(sid, end); 2302 if (sid_len < 0) { 2303 cifs_dbg(VFS, "bad group sid in posix create response\n"); 2304 return; 2305 } 2306 memcpy(&posix->group, sid, sid_len); 2307 2308 cifs_dbg(FYI, "nlink=%d mode=%o reparse_tag=%x\n", 2309 posix->nlink, posix->mode, posix->reparse_tag); 2310 } 2311 2312 int smb2_parse_contexts(struct TCP_Server_Info *server, 2313 struct kvec *rsp_iov, 2314 __u16 *epoch, 2315 char *lease_key, __u8 *oplock, 2316 struct smb2_file_all_info *buf, 2317 struct create_posix_rsp *posix) 2318 { 2319 struct smb2_create_rsp *rsp = rsp_iov->iov_base; 2320 struct create_context *cc; 2321 size_t rem, off, len; 2322 size_t doff, dlen; 2323 size_t noff, nlen; 2324 char *name; 2325 static const char smb3_create_tag_posix[] = { 2326 0x93, 0xAD, 0x25, 0x50, 0x9C, 2327 0xB4, 0x11, 0xE7, 0xB4, 0x23, 0x83, 2328 0xDE, 0x96, 0x8B, 0xCD, 0x7C 2329 }; 2330 2331 *oplock = 0; 2332 2333 off = le32_to_cpu(rsp->CreateContextsOffset); 2334 rem = le32_to_cpu(rsp->CreateContextsLength); 2335 if (check_add_overflow(off, rem, &len) || len > rsp_iov->iov_len) 2336 return -EINVAL; 2337 cc = (struct create_context *)((u8 *)rsp + off); 2338 2339 /* Initialize inode number to 0 in case no valid data in qfid context */ 2340 if (buf) 2341 buf->IndexNumber = 0; 2342 2343 while (rem >= sizeof(*cc)) { 2344 doff = le16_to_cpu(cc->DataOffset); 2345 dlen = le32_to_cpu(cc->DataLength); 2346 if (check_add_overflow(doff, dlen, &len) || len > rem) 2347 return -EINVAL; 2348 2349 noff = le16_to_cpu(cc->NameOffset); 2350 nlen = le16_to_cpu(cc->NameLength); 2351 if (noff + nlen > doff) 2352 return -EINVAL; 2353 2354 name = (char *)cc + noff; 2355 switch (nlen) { 2356 case 4: 2357 if (!strncmp(name, SMB2_CREATE_REQUEST_LEASE, 4)) { 2358 *oplock = server->ops->parse_lease_buf(cc, epoch, 2359 lease_key); 2360 } else if (buf && 2361 !strncmp(name, SMB2_CREATE_QUERY_ON_DISK_ID, 4)) { 2362 parse_query_id_ctxt(cc, buf); 2363 } 2364 break; 2365 case 16: 2366 if (posix && !memcmp(name, smb3_create_tag_posix, 16)) 2367 parse_posix_ctxt(cc, buf, posix); 2368 break; 2369 default: 2370 cifs_dbg(FYI, "%s: unhandled context (nlen=%zu dlen=%zu)\n", 2371 __func__, nlen, dlen); 2372 if (IS_ENABLED(CONFIG_CIFS_DEBUG2)) 2373 cifs_dump_mem("context data: ", cc, dlen); 2374 break; 2375 } 2376 2377 off = le32_to_cpu(cc->Next); 2378 if (!off) 2379 break; 2380 if (check_sub_overflow(rem, off, &rem)) 2381 return -EINVAL; 2382 cc = (struct create_context *)((u8 *)cc + off); 2383 } 2384 2385 if (rsp->OplockLevel != SMB2_OPLOCK_LEVEL_LEASE) 2386 *oplock = rsp->OplockLevel; 2387 2388 return 0; 2389 } 2390 2391 static int 2392 add_lease_context(struct TCP_Server_Info *server, 2393 struct smb2_create_req *req, 2394 struct kvec *iov, 2395 unsigned int *num_iovec, u8 *lease_key, __u8 *oplock) 2396 { 2397 unsigned int num = *num_iovec; 2398 2399 iov[num].iov_base = server->ops->create_lease_buf(lease_key, *oplock); 2400 if (iov[num].iov_base == NULL) 2401 return -ENOMEM; 2402 iov[num].iov_len = server->vals->create_lease_size; 2403 req->RequestedOplockLevel = SMB2_OPLOCK_LEVEL_LEASE; 2404 *num_iovec = num + 1; 2405 return 0; 2406 } 2407 2408 static struct create_durable_v2 * 2409 create_durable_v2_buf(struct cifs_open_parms *oparms) 2410 { 2411 struct cifs_fid *pfid = oparms->fid; 2412 struct create_durable_v2 *buf; 2413 2414 buf = kzalloc(sizeof(struct create_durable_v2), GFP_KERNEL); 2415 if (!buf) 2416 return NULL; 2417 2418 buf->ccontext.DataOffset = cpu_to_le16(offsetof 2419 (struct create_durable_v2, dcontext)); 2420 buf->ccontext.DataLength = cpu_to_le32(sizeof(struct durable_context_v2)); 2421 buf->ccontext.NameOffset = cpu_to_le16(offsetof 2422 (struct create_durable_v2, Name)); 2423 buf->ccontext.NameLength = cpu_to_le16(4); 2424 2425 /* 2426 * NB: Handle timeout defaults to 0, which allows server to choose 2427 * (most servers default to 120 seconds) and most clients default to 0. 2428 * This can be overridden at mount ("handletimeout=") if the user wants 2429 * a different persistent (or resilient) handle timeout for all opens 2430 * on a particular SMB3 mount. 2431 */ 2432 buf->dcontext.Timeout = cpu_to_le32(oparms->tcon->handle_timeout); 2433 buf->dcontext.Flags = cpu_to_le32(SMB2_DHANDLE_FLAG_PERSISTENT); 2434 2435 /* for replay, we should not overwrite the existing create guid */ 2436 if (!oparms->replay) { 2437 generate_random_uuid(buf->dcontext.CreateGuid); 2438 memcpy(pfid->create_guid, buf->dcontext.CreateGuid, 16); 2439 } else 2440 memcpy(buf->dcontext.CreateGuid, pfid->create_guid, 16); 2441 2442 /* SMB2_CREATE_DURABLE_HANDLE_REQUEST is "DH2Q" */ 2443 buf->Name[0] = 'D'; 2444 buf->Name[1] = 'H'; 2445 buf->Name[2] = '2'; 2446 buf->Name[3] = 'Q'; 2447 return buf; 2448 } 2449 2450 static struct create_durable_handle_reconnect_v2 * 2451 create_reconnect_durable_v2_buf(struct cifs_fid *fid) 2452 { 2453 struct create_durable_handle_reconnect_v2 *buf; 2454 2455 buf = kzalloc(sizeof(struct create_durable_handle_reconnect_v2), 2456 GFP_KERNEL); 2457 if (!buf) 2458 return NULL; 2459 2460 buf->ccontext.DataOffset = 2461 cpu_to_le16(offsetof(struct create_durable_handle_reconnect_v2, 2462 dcontext)); 2463 buf->ccontext.DataLength = 2464 cpu_to_le32(sizeof(struct durable_reconnect_context_v2)); 2465 buf->ccontext.NameOffset = 2466 cpu_to_le16(offsetof(struct create_durable_handle_reconnect_v2, 2467 Name)); 2468 buf->ccontext.NameLength = cpu_to_le16(4); 2469 2470 buf->dcontext.Fid.PersistentFileId = fid->persistent_fid; 2471 buf->dcontext.Fid.VolatileFileId = fid->volatile_fid; 2472 buf->dcontext.Flags = cpu_to_le32(SMB2_DHANDLE_FLAG_PERSISTENT); 2473 memcpy(buf->dcontext.CreateGuid, fid->create_guid, 16); 2474 2475 /* SMB2_CREATE_DURABLE_HANDLE_RECONNECT_V2 is "DH2C" */ 2476 buf->Name[0] = 'D'; 2477 buf->Name[1] = 'H'; 2478 buf->Name[2] = '2'; 2479 buf->Name[3] = 'C'; 2480 return buf; 2481 } 2482 2483 static int 2484 add_durable_v2_context(struct kvec *iov, unsigned int *num_iovec, 2485 struct cifs_open_parms *oparms) 2486 { 2487 unsigned int num = *num_iovec; 2488 2489 iov[num].iov_base = create_durable_v2_buf(oparms); 2490 if (iov[num].iov_base == NULL) 2491 return -ENOMEM; 2492 iov[num].iov_len = sizeof(struct create_durable_v2); 2493 *num_iovec = num + 1; 2494 return 0; 2495 } 2496 2497 static int 2498 add_durable_reconnect_v2_context(struct kvec *iov, unsigned int *num_iovec, 2499 struct cifs_open_parms *oparms) 2500 { 2501 unsigned int num = *num_iovec; 2502 2503 /* indicate that we don't need to relock the file */ 2504 oparms->reconnect = false; 2505 2506 iov[num].iov_base = create_reconnect_durable_v2_buf(oparms->fid); 2507 if (iov[num].iov_base == NULL) 2508 return -ENOMEM; 2509 iov[num].iov_len = sizeof(struct create_durable_handle_reconnect_v2); 2510 *num_iovec = num + 1; 2511 return 0; 2512 } 2513 2514 static int 2515 add_durable_context(struct kvec *iov, unsigned int *num_iovec, 2516 struct cifs_open_parms *oparms, bool use_persistent) 2517 { 2518 unsigned int num = *num_iovec; 2519 2520 if (use_persistent) { 2521 if (oparms->reconnect) 2522 return add_durable_reconnect_v2_context(iov, num_iovec, 2523 oparms); 2524 else 2525 return add_durable_v2_context(iov, num_iovec, oparms); 2526 } 2527 2528 if (oparms->reconnect) { 2529 iov[num].iov_base = create_reconnect_durable_buf(oparms->fid); 2530 /* indicate that we don't need to relock the file */ 2531 oparms->reconnect = false; 2532 } else 2533 iov[num].iov_base = create_durable_buf(); 2534 if (iov[num].iov_base == NULL) 2535 return -ENOMEM; 2536 iov[num].iov_len = sizeof(struct create_durable); 2537 *num_iovec = num + 1; 2538 return 0; 2539 } 2540 2541 /* See MS-SMB2 2.2.13.2.7 */ 2542 static struct crt_twarp_ctxt * 2543 create_twarp_buf(__u64 timewarp) 2544 { 2545 struct crt_twarp_ctxt *buf; 2546 2547 buf = kzalloc(sizeof(struct crt_twarp_ctxt), GFP_KERNEL); 2548 if (!buf) 2549 return NULL; 2550 2551 buf->ccontext.DataOffset = cpu_to_le16(offsetof 2552 (struct crt_twarp_ctxt, Timestamp)); 2553 buf->ccontext.DataLength = cpu_to_le32(8); 2554 buf->ccontext.NameOffset = cpu_to_le16(offsetof 2555 (struct crt_twarp_ctxt, Name)); 2556 buf->ccontext.NameLength = cpu_to_le16(4); 2557 /* SMB2_CREATE_TIMEWARP_TOKEN is "TWrp" */ 2558 buf->Name[0] = 'T'; 2559 buf->Name[1] = 'W'; 2560 buf->Name[2] = 'r'; 2561 buf->Name[3] = 'p'; 2562 buf->Timestamp = cpu_to_le64(timewarp); 2563 return buf; 2564 } 2565 2566 /* See MS-SMB2 2.2.13.2.7 */ 2567 static int 2568 add_twarp_context(struct kvec *iov, unsigned int *num_iovec, __u64 timewarp) 2569 { 2570 unsigned int num = *num_iovec; 2571 2572 iov[num].iov_base = create_twarp_buf(timewarp); 2573 if (iov[num].iov_base == NULL) 2574 return -ENOMEM; 2575 iov[num].iov_len = sizeof(struct crt_twarp_ctxt); 2576 *num_iovec = num + 1; 2577 return 0; 2578 } 2579 2580 /* See http://technet.microsoft.com/en-us/library/hh509017(v=ws.10).aspx */ 2581 static void setup_owner_group_sids(char *buf) 2582 { 2583 struct owner_group_sids *sids = (struct owner_group_sids *)buf; 2584 2585 /* Populate the user ownership fields S-1-5-88-1 */ 2586 sids->owner.Revision = 1; 2587 sids->owner.NumAuth = 3; 2588 sids->owner.Authority[5] = 5; 2589 sids->owner.SubAuthorities[0] = cpu_to_le32(88); 2590 sids->owner.SubAuthorities[1] = cpu_to_le32(1); 2591 sids->owner.SubAuthorities[2] = cpu_to_le32(current_fsuid().val); 2592 2593 /* Populate the group ownership fields S-1-5-88-2 */ 2594 sids->group.Revision = 1; 2595 sids->group.NumAuth = 3; 2596 sids->group.Authority[5] = 5; 2597 sids->group.SubAuthorities[0] = cpu_to_le32(88); 2598 sids->group.SubAuthorities[1] = cpu_to_le32(2); 2599 sids->group.SubAuthorities[2] = cpu_to_le32(current_fsgid().val); 2600 2601 cifs_dbg(FYI, "owner S-1-5-88-1-%d, group S-1-5-88-2-%d\n", current_fsuid().val, current_fsgid().val); 2602 } 2603 2604 /* See MS-SMB2 2.2.13.2.2 and MS-DTYP 2.4.6 */ 2605 static struct crt_sd_ctxt * 2606 create_sd_buf(umode_t mode, bool set_owner, unsigned int *len) 2607 { 2608 struct crt_sd_ctxt *buf; 2609 __u8 *ptr, *aclptr; 2610 unsigned int acelen, acl_size, ace_count; 2611 unsigned int owner_offset = 0; 2612 unsigned int group_offset = 0; 2613 struct smb3_acl acl = {}; 2614 2615 *len = round_up(sizeof(struct crt_sd_ctxt) + (sizeof(struct smb_ace) * 4), 8); 2616 2617 if (set_owner) { 2618 /* sizeof(struct owner_group_sids) is already multiple of 8 so no need to round */ 2619 *len += sizeof(struct owner_group_sids); 2620 } 2621 2622 buf = kzalloc(*len, GFP_KERNEL); 2623 if (buf == NULL) 2624 return buf; 2625 2626 ptr = (__u8 *)&buf[1]; 2627 if (set_owner) { 2628 /* offset fields are from beginning of security descriptor not of create context */ 2629 owner_offset = ptr - (__u8 *)&buf->sd; 2630 buf->sd.OffsetOwner = cpu_to_le32(owner_offset); 2631 group_offset = owner_offset + offsetof(struct owner_group_sids, group); 2632 buf->sd.OffsetGroup = cpu_to_le32(group_offset); 2633 2634 setup_owner_group_sids(ptr); 2635 ptr += sizeof(struct owner_group_sids); 2636 } else { 2637 buf->sd.OffsetOwner = 0; 2638 buf->sd.OffsetGroup = 0; 2639 } 2640 2641 buf->ccontext.DataOffset = cpu_to_le16(offsetof(struct crt_sd_ctxt, sd)); 2642 buf->ccontext.NameOffset = cpu_to_le16(offsetof(struct crt_sd_ctxt, Name)); 2643 buf->ccontext.NameLength = cpu_to_le16(4); 2644 /* SMB2_CREATE_SD_BUFFER_TOKEN is "SecD" */ 2645 buf->Name[0] = 'S'; 2646 buf->Name[1] = 'e'; 2647 buf->Name[2] = 'c'; 2648 buf->Name[3] = 'D'; 2649 buf->sd.Revision = 1; /* Must be one see MS-DTYP 2.4.6 */ 2650 2651 /* 2652 * ACL is "self relative" ie ACL is stored in contiguous block of memory 2653 * and "DP" ie the DACL is present 2654 */ 2655 buf->sd.Control = cpu_to_le16(ACL_CONTROL_SR | ACL_CONTROL_DP); 2656 2657 /* offset owner, group and Sbz1 and SACL are all zero */ 2658 buf->sd.OffsetDacl = cpu_to_le32(ptr - (__u8 *)&buf->sd); 2659 /* Ship the ACL for now. we will copy it into buf later. */ 2660 aclptr = ptr; 2661 ptr += sizeof(struct smb3_acl); 2662 2663 /* create one ACE to hold the mode embedded in reserved special SID */ 2664 acelen = setup_special_mode_ACE((struct smb_ace *)ptr, false, (__u64)mode); 2665 ptr += acelen; 2666 acl_size = acelen + sizeof(struct smb3_acl); 2667 ace_count = 1; 2668 2669 if (set_owner) { 2670 /* we do not need to reallocate buffer to add the two more ACEs. plenty of space */ 2671 acelen = setup_special_user_owner_ACE((struct smb_ace *)ptr); 2672 ptr += acelen; 2673 acl_size += acelen; 2674 ace_count += 1; 2675 } 2676 2677 /* and one more ACE to allow access for authenticated users */ 2678 acelen = setup_authusers_ACE((struct smb_ace *)ptr); 2679 ptr += acelen; 2680 acl_size += acelen; 2681 ace_count += 1; 2682 2683 acl.AclRevision = ACL_REVISION; /* See 2.4.4.1 of MS-DTYP */ 2684 acl.AclSize = cpu_to_le16(acl_size); 2685 acl.AceCount = cpu_to_le16(ace_count); 2686 /* acl.Sbz1 and Sbz2 MBZ so are not set here, but initialized above */ 2687 memcpy(aclptr, &acl, sizeof(struct smb3_acl)); 2688 2689 buf->ccontext.DataLength = cpu_to_le32(ptr - (__u8 *)&buf->sd); 2690 *len = round_up((unsigned int)(ptr - (__u8 *)buf), 8); 2691 2692 return buf; 2693 } 2694 2695 static int 2696 add_sd_context(struct kvec *iov, unsigned int *num_iovec, umode_t mode, bool set_owner) 2697 { 2698 unsigned int num = *num_iovec; 2699 unsigned int len = 0; 2700 2701 iov[num].iov_base = create_sd_buf(mode, set_owner, &len); 2702 if (iov[num].iov_base == NULL) 2703 return -ENOMEM; 2704 iov[num].iov_len = len; 2705 *num_iovec = num + 1; 2706 return 0; 2707 } 2708 2709 static struct crt_query_id_ctxt * 2710 create_query_id_buf(void) 2711 { 2712 struct crt_query_id_ctxt *buf; 2713 2714 buf = kzalloc(sizeof(struct crt_query_id_ctxt), GFP_KERNEL); 2715 if (!buf) 2716 return NULL; 2717 2718 buf->ccontext.DataOffset = cpu_to_le16(0); 2719 buf->ccontext.DataLength = cpu_to_le32(0); 2720 buf->ccontext.NameOffset = cpu_to_le16(offsetof 2721 (struct crt_query_id_ctxt, Name)); 2722 buf->ccontext.NameLength = cpu_to_le16(4); 2723 /* SMB2_CREATE_QUERY_ON_DISK_ID is "QFid" */ 2724 buf->Name[0] = 'Q'; 2725 buf->Name[1] = 'F'; 2726 buf->Name[2] = 'i'; 2727 buf->Name[3] = 'd'; 2728 return buf; 2729 } 2730 2731 /* See MS-SMB2 2.2.13.2.9 */ 2732 static int 2733 add_query_id_context(struct kvec *iov, unsigned int *num_iovec) 2734 { 2735 unsigned int num = *num_iovec; 2736 2737 iov[num].iov_base = create_query_id_buf(); 2738 if (iov[num].iov_base == NULL) 2739 return -ENOMEM; 2740 iov[num].iov_len = sizeof(struct crt_query_id_ctxt); 2741 *num_iovec = num + 1; 2742 return 0; 2743 } 2744 2745 static void add_ea_context(struct cifs_open_parms *oparms, 2746 struct kvec *rq_iov, unsigned int *num_iovs) 2747 { 2748 struct kvec *iov = oparms->ea_cctx; 2749 2750 if (iov && iov->iov_base && iov->iov_len) { 2751 rq_iov[(*num_iovs)++] = *iov; 2752 memset(iov, 0, sizeof(*iov)); 2753 } 2754 } 2755 2756 static int 2757 alloc_path_with_tree_prefix(__le16 **out_path, int *out_size, int *out_len, 2758 const char *treename, const __le16 *path) 2759 { 2760 int treename_len, path_len; 2761 struct nls_table *cp; 2762 const __le16 sep[] = {cpu_to_le16('\\'), cpu_to_le16(0x0000)}; 2763 2764 /* 2765 * skip leading "\\" 2766 */ 2767 treename_len = strlen(treename); 2768 if (treename_len < 2 || !(treename[0] == '\\' && treename[1] == '\\')) 2769 return -EINVAL; 2770 2771 treename += 2; 2772 treename_len -= 2; 2773 2774 path_len = UniStrnlen((wchar_t *)path, PATH_MAX); 2775 2776 /* make room for one path separator only if @path isn't empty */ 2777 *out_len = treename_len + (path[0] ? 1 : 0) + path_len; 2778 2779 /* 2780 * final path needs to be 8-byte aligned as specified in 2781 * MS-SMB2 2.2.13 SMB2 CREATE Request. 2782 */ 2783 *out_size = round_up(*out_len * sizeof(__le16), 8); 2784 *out_path = kzalloc(*out_size + sizeof(__le16) /* null */, GFP_KERNEL); 2785 if (!*out_path) 2786 return -ENOMEM; 2787 2788 cp = load_nls_default(); 2789 cifs_strtoUTF16(*out_path, treename, treename_len, cp); 2790 2791 /* Do not append the separator if the path is empty */ 2792 if (path[0] != cpu_to_le16(0x0000)) { 2793 UniStrcat((wchar_t *)*out_path, (wchar_t *)sep); 2794 UniStrcat((wchar_t *)*out_path, (wchar_t *)path); 2795 } 2796 2797 unload_nls(cp); 2798 2799 return 0; 2800 } 2801 2802 int smb311_posix_mkdir(const unsigned int xid, struct inode *inode, 2803 umode_t mode, struct cifs_tcon *tcon, 2804 const char *full_path, 2805 struct cifs_sb_info *cifs_sb) 2806 { 2807 struct smb_rqst rqst; 2808 struct smb2_create_req *req; 2809 struct smb2_create_rsp *rsp = NULL; 2810 struct cifs_ses *ses = tcon->ses; 2811 struct kvec iov[3]; /* make sure at least one for each open context */ 2812 struct kvec rsp_iov = {NULL, 0}; 2813 int resp_buftype; 2814 int uni_path_len; 2815 __le16 *copy_path = NULL; 2816 int copy_size; 2817 int rc = 0; 2818 unsigned int n_iov = 2; 2819 __u32 file_attributes = 0; 2820 char *pc_buf = NULL; 2821 int flags = 0; 2822 unsigned int total_len; 2823 __le16 *utf16_path = NULL; 2824 struct TCP_Server_Info *server; 2825 int retries = 0, cur_sleep = 1; 2826 2827 replay_again: 2828 /* reinitialize for possible replay */ 2829 flags = 0; 2830 n_iov = 2; 2831 server = cifs_pick_channel(ses); 2832 2833 cifs_dbg(FYI, "mkdir\n"); 2834 2835 /* resource #1: path allocation */ 2836 utf16_path = cifs_convert_path_to_utf16(full_path, cifs_sb); 2837 if (!utf16_path) 2838 return -ENOMEM; 2839 2840 if (!ses || !server) { 2841 rc = -EIO; 2842 goto err_free_path; 2843 } 2844 2845 /* resource #2: request */ 2846 rc = smb2_plain_req_init(SMB2_CREATE, tcon, server, 2847 (void **) &req, &total_len); 2848 if (rc) 2849 goto err_free_path; 2850 2851 2852 if (smb3_encryption_required(tcon)) 2853 flags |= CIFS_TRANSFORM_REQ; 2854 2855 req->ImpersonationLevel = IL_IMPERSONATION; 2856 req->DesiredAccess = cpu_to_le32(FILE_WRITE_ATTRIBUTES); 2857 /* File attributes ignored on open (used in create though) */ 2858 req->FileAttributes = cpu_to_le32(file_attributes); 2859 req->ShareAccess = FILE_SHARE_ALL_LE; 2860 req->CreateDisposition = cpu_to_le32(FILE_CREATE); 2861 req->CreateOptions = cpu_to_le32(CREATE_NOT_FILE); 2862 2863 iov[0].iov_base = (char *)req; 2864 /* -1 since last byte is buf[0] which is sent below (path) */ 2865 iov[0].iov_len = total_len - 1; 2866 2867 req->NameOffset = cpu_to_le16(sizeof(struct smb2_create_req)); 2868 2869 /* [MS-SMB2] 2.2.13 NameOffset: 2870 * If SMB2_FLAGS_DFS_OPERATIONS is set in the Flags field of 2871 * the SMB2 header, the file name includes a prefix that will 2872 * be processed during DFS name normalization as specified in 2873 * section 3.3.5.9. Otherwise, the file name is relative to 2874 * the share that is identified by the TreeId in the SMB2 2875 * header. 2876 */ 2877 if (tcon->share_flags & SHI1005_FLAGS_DFS) { 2878 int name_len; 2879 2880 req->hdr.Flags |= SMB2_FLAGS_DFS_OPERATIONS; 2881 rc = alloc_path_with_tree_prefix(©_path, ©_size, 2882 &name_len, 2883 tcon->tree_name, utf16_path); 2884 if (rc) 2885 goto err_free_req; 2886 2887 req->NameLength = cpu_to_le16(name_len * 2); 2888 uni_path_len = copy_size; 2889 /* free before overwriting resource */ 2890 kfree(utf16_path); 2891 utf16_path = copy_path; 2892 } else { 2893 uni_path_len = (2 * UniStrnlen((wchar_t *)utf16_path, PATH_MAX)) + 2; 2894 /* MUST set path len (NameLength) to 0 opening root of share */ 2895 req->NameLength = cpu_to_le16(uni_path_len - 2); 2896 if (uni_path_len % 8 != 0) { 2897 copy_size = roundup(uni_path_len, 8); 2898 copy_path = kzalloc(copy_size, GFP_KERNEL); 2899 if (!copy_path) { 2900 rc = -ENOMEM; 2901 goto err_free_req; 2902 } 2903 memcpy((char *)copy_path, (const char *)utf16_path, 2904 uni_path_len); 2905 uni_path_len = copy_size; 2906 /* free before overwriting resource */ 2907 kfree(utf16_path); 2908 utf16_path = copy_path; 2909 } 2910 } 2911 2912 iov[1].iov_len = uni_path_len; 2913 iov[1].iov_base = utf16_path; 2914 req->RequestedOplockLevel = SMB2_OPLOCK_LEVEL_NONE; 2915 2916 if (tcon->posix_extensions) { 2917 /* resource #3: posix buf */ 2918 rc = add_posix_context(iov, &n_iov, mode); 2919 if (rc) 2920 goto err_free_req; 2921 req->CreateContextsOffset = cpu_to_le32( 2922 sizeof(struct smb2_create_req) + 2923 iov[1].iov_len); 2924 pc_buf = iov[n_iov-1].iov_base; 2925 } 2926 2927 2928 memset(&rqst, 0, sizeof(struct smb_rqst)); 2929 rqst.rq_iov = iov; 2930 rqst.rq_nvec = n_iov; 2931 2932 /* no need to inc num_remote_opens because we close it just below */ 2933 trace_smb3_posix_mkdir_enter(xid, tcon->tid, ses->Suid, full_path, CREATE_NOT_FILE, 2934 FILE_WRITE_ATTRIBUTES); 2935 2936 if (retries) 2937 smb2_set_replay(server, &rqst); 2938 2939 /* resource #4: response buffer */ 2940 rc = cifs_send_recv(xid, ses, server, 2941 &rqst, &resp_buftype, flags, &rsp_iov); 2942 if (rc) { 2943 cifs_stats_fail_inc(tcon, SMB2_CREATE_HE); 2944 trace_smb3_posix_mkdir_err(xid, tcon->tid, ses->Suid, 2945 CREATE_NOT_FILE, 2946 FILE_WRITE_ATTRIBUTES, rc); 2947 goto err_free_rsp_buf; 2948 } 2949 2950 /* 2951 * Although unlikely to be possible for rsp to be null and rc not set, 2952 * adding check below is slightly safer long term (and quiets Coverity 2953 * warning) 2954 */ 2955 rsp = (struct smb2_create_rsp *)rsp_iov.iov_base; 2956 if (rsp == NULL) { 2957 rc = -EIO; 2958 kfree(pc_buf); 2959 goto err_free_req; 2960 } 2961 2962 trace_smb3_posix_mkdir_done(xid, rsp->PersistentFileId, tcon->tid, ses->Suid, 2963 CREATE_NOT_FILE, FILE_WRITE_ATTRIBUTES); 2964 2965 SMB2_close(xid, tcon, rsp->PersistentFileId, rsp->VolatileFileId); 2966 2967 /* Eventually save off posix specific response info and timestamps */ 2968 2969 err_free_rsp_buf: 2970 free_rsp_buf(resp_buftype, rsp); 2971 kfree(pc_buf); 2972 err_free_req: 2973 cifs_small_buf_release(req); 2974 err_free_path: 2975 kfree(utf16_path); 2976 2977 if (is_replayable_error(rc) && 2978 smb2_should_replay(tcon, &retries, &cur_sleep)) 2979 goto replay_again; 2980 2981 return rc; 2982 } 2983 2984 int 2985 SMB2_open_init(struct cifs_tcon *tcon, struct TCP_Server_Info *server, 2986 struct smb_rqst *rqst, __u8 *oplock, 2987 struct cifs_open_parms *oparms, __le16 *path) 2988 { 2989 struct smb2_create_req *req; 2990 unsigned int n_iov = 2; 2991 __u32 file_attributes = 0; 2992 int copy_size; 2993 int uni_path_len; 2994 unsigned int total_len; 2995 struct kvec *iov = rqst->rq_iov; 2996 __le16 *copy_path; 2997 int rc; 2998 2999 rc = smb2_plain_req_init(SMB2_CREATE, tcon, server, 3000 (void **) &req, &total_len); 3001 if (rc) 3002 return rc; 3003 3004 iov[0].iov_base = (char *)req; 3005 /* -1 since last byte is buf[0] which is sent below (path) */ 3006 iov[0].iov_len = total_len - 1; 3007 3008 if (oparms->create_options & CREATE_OPTION_READONLY) 3009 file_attributes |= ATTR_READONLY; 3010 if (oparms->create_options & CREATE_OPTION_SPECIAL) 3011 file_attributes |= ATTR_SYSTEM; 3012 3013 req->ImpersonationLevel = IL_IMPERSONATION; 3014 req->DesiredAccess = cpu_to_le32(oparms->desired_access); 3015 /* File attributes ignored on open (used in create though) */ 3016 req->FileAttributes = cpu_to_le32(file_attributes); 3017 req->ShareAccess = FILE_SHARE_ALL_LE; 3018 3019 req->CreateDisposition = cpu_to_le32(oparms->disposition); 3020 req->CreateOptions = cpu_to_le32(oparms->create_options & CREATE_OPTIONS_MASK); 3021 req->NameOffset = cpu_to_le16(sizeof(struct smb2_create_req)); 3022 3023 /* [MS-SMB2] 2.2.13 NameOffset: 3024 * If SMB2_FLAGS_DFS_OPERATIONS is set in the Flags field of 3025 * the SMB2 header, the file name includes a prefix that will 3026 * be processed during DFS name normalization as specified in 3027 * section 3.3.5.9. Otherwise, the file name is relative to 3028 * the share that is identified by the TreeId in the SMB2 3029 * header. 3030 */ 3031 if (tcon->share_flags & SHI1005_FLAGS_DFS) { 3032 int name_len; 3033 3034 req->hdr.Flags |= SMB2_FLAGS_DFS_OPERATIONS; 3035 rc = alloc_path_with_tree_prefix(©_path, ©_size, 3036 &name_len, 3037 tcon->tree_name, path); 3038 if (rc) 3039 return rc; 3040 req->NameLength = cpu_to_le16(name_len * 2); 3041 uni_path_len = copy_size; 3042 path = copy_path; 3043 } else { 3044 uni_path_len = (2 * UniStrnlen((wchar_t *)path, PATH_MAX)) + 2; 3045 /* MUST set path len (NameLength) to 0 opening root of share */ 3046 req->NameLength = cpu_to_le16(uni_path_len - 2); 3047 copy_size = round_up(uni_path_len, 8); 3048 copy_path = kzalloc(copy_size, GFP_KERNEL); 3049 if (!copy_path) 3050 return -ENOMEM; 3051 memcpy((char *)copy_path, (const char *)path, 3052 uni_path_len); 3053 uni_path_len = copy_size; 3054 path = copy_path; 3055 } 3056 3057 iov[1].iov_len = uni_path_len; 3058 iov[1].iov_base = path; 3059 3060 if ((!server->oplocks) || (tcon->no_lease)) 3061 *oplock = SMB2_OPLOCK_LEVEL_NONE; 3062 3063 if (!(server->capabilities & SMB2_GLOBAL_CAP_LEASING) || 3064 *oplock == SMB2_OPLOCK_LEVEL_NONE) 3065 req->RequestedOplockLevel = *oplock; 3066 else if (!(server->capabilities & SMB2_GLOBAL_CAP_DIRECTORY_LEASING) && 3067 (oparms->create_options & CREATE_NOT_FILE)) 3068 req->RequestedOplockLevel = *oplock; /* no srv lease support */ 3069 else { 3070 rc = add_lease_context(server, req, iov, &n_iov, 3071 oparms->fid->lease_key, oplock); 3072 if (rc) 3073 return rc; 3074 } 3075 3076 if (*oplock == SMB2_OPLOCK_LEVEL_BATCH) { 3077 rc = add_durable_context(iov, &n_iov, oparms, 3078 tcon->use_persistent); 3079 if (rc) 3080 return rc; 3081 } 3082 3083 if (tcon->posix_extensions) { 3084 rc = add_posix_context(iov, &n_iov, oparms->mode); 3085 if (rc) 3086 return rc; 3087 } 3088 3089 if (tcon->snapshot_time) { 3090 cifs_dbg(FYI, "adding snapshot context\n"); 3091 rc = add_twarp_context(iov, &n_iov, tcon->snapshot_time); 3092 if (rc) 3093 return rc; 3094 } 3095 3096 if ((oparms->disposition != FILE_OPEN) && (oparms->cifs_sb)) { 3097 bool set_mode; 3098 bool set_owner; 3099 3100 if ((oparms->cifs_sb->mnt_cifs_flags & CIFS_MOUNT_MODE_FROM_SID) && 3101 (oparms->mode != ACL_NO_MODE)) 3102 set_mode = true; 3103 else { 3104 set_mode = false; 3105 oparms->mode = ACL_NO_MODE; 3106 } 3107 3108 if (oparms->cifs_sb->mnt_cifs_flags & CIFS_MOUNT_UID_FROM_ACL) 3109 set_owner = true; 3110 else 3111 set_owner = false; 3112 3113 if (set_owner | set_mode) { 3114 cifs_dbg(FYI, "add sd with mode 0x%x\n", oparms->mode); 3115 rc = add_sd_context(iov, &n_iov, oparms->mode, set_owner); 3116 if (rc) 3117 return rc; 3118 } 3119 } 3120 3121 add_query_id_context(iov, &n_iov); 3122 add_ea_context(oparms, iov, &n_iov); 3123 3124 if (n_iov > 2) { 3125 /* 3126 * We have create contexts behind iov[1] (the file 3127 * name), point at them from the main create request 3128 */ 3129 req->CreateContextsOffset = cpu_to_le32( 3130 sizeof(struct smb2_create_req) + 3131 iov[1].iov_len); 3132 req->CreateContextsLength = 0; 3133 3134 for (unsigned int i = 2; i < (n_iov-1); i++) { 3135 struct kvec *v = &iov[i]; 3136 size_t len = v->iov_len; 3137 struct create_context *cctx = 3138 (struct create_context *)v->iov_base; 3139 3140 cctx->Next = cpu_to_le32(len); 3141 le32_add_cpu(&req->CreateContextsLength, len); 3142 } 3143 le32_add_cpu(&req->CreateContextsLength, 3144 iov[n_iov-1].iov_len); 3145 } 3146 3147 rqst->rq_nvec = n_iov; 3148 return 0; 3149 } 3150 3151 /* rq_iov[0] is the request and is released by cifs_small_buf_release(). 3152 * All other vectors are freed by kfree(). 3153 */ 3154 void 3155 SMB2_open_free(struct smb_rqst *rqst) 3156 { 3157 int i; 3158 3159 if (rqst && rqst->rq_iov) { 3160 cifs_small_buf_release(rqst->rq_iov[0].iov_base); 3161 for (i = 1; i < rqst->rq_nvec; i++) 3162 if (rqst->rq_iov[i].iov_base != smb2_padding) 3163 kfree(rqst->rq_iov[i].iov_base); 3164 } 3165 } 3166 3167 int 3168 SMB2_open(const unsigned int xid, struct cifs_open_parms *oparms, __le16 *path, 3169 __u8 *oplock, struct smb2_file_all_info *buf, 3170 struct create_posix_rsp *posix, 3171 struct kvec *err_iov, int *buftype) 3172 { 3173 struct smb_rqst rqst; 3174 struct smb2_create_rsp *rsp = NULL; 3175 struct cifs_tcon *tcon = oparms->tcon; 3176 struct cifs_ses *ses = tcon->ses; 3177 struct TCP_Server_Info *server; 3178 struct kvec iov[SMB2_CREATE_IOV_SIZE]; 3179 struct kvec rsp_iov = {NULL, 0}; 3180 int resp_buftype = CIFS_NO_BUFFER; 3181 int rc = 0; 3182 int flags = 0; 3183 int retries = 0, cur_sleep = 1; 3184 3185 replay_again: 3186 /* reinitialize for possible replay */ 3187 flags = 0; 3188 server = cifs_pick_channel(ses); 3189 oparms->replay = !!(retries); 3190 3191 cifs_dbg(FYI, "create/open\n"); 3192 if (!ses || !server) 3193 return -EIO; 3194 3195 if (smb3_encryption_required(tcon)) 3196 flags |= CIFS_TRANSFORM_REQ; 3197 3198 memset(&rqst, 0, sizeof(struct smb_rqst)); 3199 memset(&iov, 0, sizeof(iov)); 3200 rqst.rq_iov = iov; 3201 rqst.rq_nvec = SMB2_CREATE_IOV_SIZE; 3202 3203 rc = SMB2_open_init(tcon, server, 3204 &rqst, oplock, oparms, path); 3205 if (rc) 3206 goto creat_exit; 3207 3208 trace_smb3_open_enter(xid, tcon->tid, tcon->ses->Suid, oparms->path, 3209 oparms->create_options, oparms->desired_access); 3210 3211 if (retries) 3212 smb2_set_replay(server, &rqst); 3213 3214 rc = cifs_send_recv(xid, ses, server, 3215 &rqst, &resp_buftype, flags, 3216 &rsp_iov); 3217 rsp = (struct smb2_create_rsp *)rsp_iov.iov_base; 3218 3219 if (rc != 0) { 3220 cifs_stats_fail_inc(tcon, SMB2_CREATE_HE); 3221 if (err_iov && rsp) { 3222 *err_iov = rsp_iov; 3223 *buftype = resp_buftype; 3224 resp_buftype = CIFS_NO_BUFFER; 3225 rsp = NULL; 3226 } 3227 trace_smb3_open_err(xid, tcon->tid, ses->Suid, 3228 oparms->create_options, oparms->desired_access, rc); 3229 if (rc == -EREMCHG) { 3230 pr_warn_once("server share %s deleted\n", 3231 tcon->tree_name); 3232 tcon->need_reconnect = true; 3233 } 3234 goto creat_exit; 3235 } else if (rsp == NULL) /* unlikely to happen, but safer to check */ 3236 goto creat_exit; 3237 else 3238 trace_smb3_open_done(xid, rsp->PersistentFileId, tcon->tid, ses->Suid, 3239 oparms->create_options, oparms->desired_access); 3240 3241 atomic_inc(&tcon->num_remote_opens); 3242 oparms->fid->persistent_fid = rsp->PersistentFileId; 3243 oparms->fid->volatile_fid = rsp->VolatileFileId; 3244 oparms->fid->access = oparms->desired_access; 3245 #ifdef CONFIG_CIFS_DEBUG2 3246 oparms->fid->mid = le64_to_cpu(rsp->hdr.MessageId); 3247 #endif /* CIFS_DEBUG2 */ 3248 3249 if (buf) { 3250 buf->CreationTime = rsp->CreationTime; 3251 buf->LastAccessTime = rsp->LastAccessTime; 3252 buf->LastWriteTime = rsp->LastWriteTime; 3253 buf->ChangeTime = rsp->ChangeTime; 3254 buf->AllocationSize = rsp->AllocationSize; 3255 buf->EndOfFile = rsp->EndofFile; 3256 buf->Attributes = rsp->FileAttributes; 3257 buf->NumberOfLinks = cpu_to_le32(1); 3258 buf->DeletePending = 0; 3259 } 3260 3261 3262 rc = smb2_parse_contexts(server, &rsp_iov, &oparms->fid->epoch, 3263 oparms->fid->lease_key, oplock, buf, posix); 3264 creat_exit: 3265 SMB2_open_free(&rqst); 3266 free_rsp_buf(resp_buftype, rsp); 3267 3268 if (is_replayable_error(rc) && 3269 smb2_should_replay(tcon, &retries, &cur_sleep)) 3270 goto replay_again; 3271 3272 return rc; 3273 } 3274 3275 int 3276 SMB2_ioctl_init(struct cifs_tcon *tcon, struct TCP_Server_Info *server, 3277 struct smb_rqst *rqst, 3278 u64 persistent_fid, u64 volatile_fid, u32 opcode, 3279 char *in_data, u32 indatalen, 3280 __u32 max_response_size) 3281 { 3282 struct smb2_ioctl_req *req; 3283 struct kvec *iov = rqst->rq_iov; 3284 unsigned int total_len; 3285 int rc; 3286 char *in_data_buf; 3287 3288 rc = smb2_ioctl_req_init(opcode, tcon, server, 3289 (void **) &req, &total_len); 3290 if (rc) 3291 return rc; 3292 3293 if (indatalen) { 3294 /* 3295 * indatalen is usually small at a couple of bytes max, so 3296 * just allocate through generic pool 3297 */ 3298 in_data_buf = kmemdup(in_data, indatalen, GFP_NOFS); 3299 if (!in_data_buf) { 3300 cifs_small_buf_release(req); 3301 return -ENOMEM; 3302 } 3303 } 3304 3305 req->CtlCode = cpu_to_le32(opcode); 3306 req->PersistentFileId = persistent_fid; 3307 req->VolatileFileId = volatile_fid; 3308 3309 iov[0].iov_base = (char *)req; 3310 /* 3311 * If no input data, the size of ioctl struct in 3312 * protocol spec still includes a 1 byte data buffer, 3313 * but if input data passed to ioctl, we do not 3314 * want to double count this, so we do not send 3315 * the dummy one byte of data in iovec[0] if sending 3316 * input data (in iovec[1]). 3317 */ 3318 if (indatalen) { 3319 req->InputCount = cpu_to_le32(indatalen); 3320 /* do not set InputOffset if no input data */ 3321 req->InputOffset = 3322 cpu_to_le32(offsetof(struct smb2_ioctl_req, Buffer)); 3323 rqst->rq_nvec = 2; 3324 iov[0].iov_len = total_len - 1; 3325 iov[1].iov_base = in_data_buf; 3326 iov[1].iov_len = indatalen; 3327 } else { 3328 rqst->rq_nvec = 1; 3329 iov[0].iov_len = total_len; 3330 } 3331 3332 req->OutputOffset = 0; 3333 req->OutputCount = 0; /* MBZ */ 3334 3335 /* 3336 * In most cases max_response_size is set to 16K (CIFSMaxBufSize) 3337 * We Could increase default MaxOutputResponse, but that could require 3338 * more credits. Windows typically sets this smaller, but for some 3339 * ioctls it may be useful to allow server to send more. No point 3340 * limiting what the server can send as long as fits in one credit 3341 * We can not handle more than CIFS_MAX_BUF_SIZE yet but may want 3342 * to increase this limit up in the future. 3343 * Note that for snapshot queries that servers like Azure expect that 3344 * the first query be minimal size (and just used to get the number/size 3345 * of previous versions) so response size must be specified as EXACTLY 3346 * sizeof(struct snapshot_array) which is 16 when rounded up to multiple 3347 * of eight bytes. Currently that is the only case where we set max 3348 * response size smaller. 3349 */ 3350 req->MaxOutputResponse = cpu_to_le32(max_response_size); 3351 req->hdr.CreditCharge = 3352 cpu_to_le16(DIV_ROUND_UP(max(indatalen, max_response_size), 3353 SMB2_MAX_BUFFER_SIZE)); 3354 /* always an FSCTL (for now) */ 3355 req->Flags = cpu_to_le32(SMB2_0_IOCTL_IS_FSCTL); 3356 3357 /* validate negotiate request must be signed - see MS-SMB2 3.2.5.5 */ 3358 if (opcode == FSCTL_VALIDATE_NEGOTIATE_INFO) 3359 req->hdr.Flags |= SMB2_FLAGS_SIGNED; 3360 3361 return 0; 3362 } 3363 3364 void 3365 SMB2_ioctl_free(struct smb_rqst *rqst) 3366 { 3367 int i; 3368 3369 if (rqst && rqst->rq_iov) { 3370 cifs_small_buf_release(rqst->rq_iov[0].iov_base); /* request */ 3371 for (i = 1; i < rqst->rq_nvec; i++) 3372 if (rqst->rq_iov[i].iov_base != smb2_padding) 3373 kfree(rqst->rq_iov[i].iov_base); 3374 } 3375 } 3376 3377 3378 /* 3379 * SMB2 IOCTL is used for both IOCTLs and FSCTLs 3380 */ 3381 int 3382 SMB2_ioctl(const unsigned int xid, struct cifs_tcon *tcon, u64 persistent_fid, 3383 u64 volatile_fid, u32 opcode, char *in_data, u32 indatalen, 3384 u32 max_out_data_len, char **out_data, 3385 u32 *plen /* returned data len */) 3386 { 3387 struct smb_rqst rqst; 3388 struct smb2_ioctl_rsp *rsp = NULL; 3389 struct cifs_ses *ses; 3390 struct TCP_Server_Info *server; 3391 struct kvec iov[SMB2_IOCTL_IOV_SIZE]; 3392 struct kvec rsp_iov = {NULL, 0}; 3393 int resp_buftype = CIFS_NO_BUFFER; 3394 int rc = 0; 3395 int flags = 0; 3396 int retries = 0, cur_sleep = 1; 3397 3398 if (!tcon) 3399 return -EIO; 3400 3401 ses = tcon->ses; 3402 if (!ses) 3403 return -EIO; 3404 3405 replay_again: 3406 /* reinitialize for possible replay */ 3407 flags = 0; 3408 server = cifs_pick_channel(ses); 3409 3410 if (!server) 3411 return -EIO; 3412 3413 cifs_dbg(FYI, "SMB2 IOCTL\n"); 3414 3415 if (out_data != NULL) 3416 *out_data = NULL; 3417 3418 /* zero out returned data len, in case of error */ 3419 if (plen) 3420 *plen = 0; 3421 3422 if (smb3_encryption_required(tcon)) 3423 flags |= CIFS_TRANSFORM_REQ; 3424 3425 memset(&rqst, 0, sizeof(struct smb_rqst)); 3426 memset(&iov, 0, sizeof(iov)); 3427 rqst.rq_iov = iov; 3428 rqst.rq_nvec = SMB2_IOCTL_IOV_SIZE; 3429 3430 rc = SMB2_ioctl_init(tcon, server, 3431 &rqst, persistent_fid, volatile_fid, opcode, 3432 in_data, indatalen, max_out_data_len); 3433 if (rc) 3434 goto ioctl_exit; 3435 3436 if (retries) 3437 smb2_set_replay(server, &rqst); 3438 3439 rc = cifs_send_recv(xid, ses, server, 3440 &rqst, &resp_buftype, flags, 3441 &rsp_iov); 3442 rsp = (struct smb2_ioctl_rsp *)rsp_iov.iov_base; 3443 3444 if (rc != 0) 3445 trace_smb3_fsctl_err(xid, persistent_fid, tcon->tid, 3446 ses->Suid, 0, opcode, rc); 3447 3448 if ((rc != 0) && (rc != -EINVAL) && (rc != -E2BIG)) { 3449 cifs_stats_fail_inc(tcon, SMB2_IOCTL_HE); 3450 goto ioctl_exit; 3451 } else if (rc == -EINVAL) { 3452 if ((opcode != FSCTL_SRV_COPYCHUNK_WRITE) && 3453 (opcode != FSCTL_SRV_COPYCHUNK)) { 3454 cifs_stats_fail_inc(tcon, SMB2_IOCTL_HE); 3455 goto ioctl_exit; 3456 } 3457 } else if (rc == -E2BIG) { 3458 if (opcode != FSCTL_QUERY_ALLOCATED_RANGES) { 3459 cifs_stats_fail_inc(tcon, SMB2_IOCTL_HE); 3460 goto ioctl_exit; 3461 } 3462 } 3463 3464 /* check if caller wants to look at return data or just return rc */ 3465 if ((plen == NULL) || (out_data == NULL)) 3466 goto ioctl_exit; 3467 3468 /* 3469 * Although unlikely to be possible for rsp to be null and rc not set, 3470 * adding check below is slightly safer long term (and quiets Coverity 3471 * warning) 3472 */ 3473 if (rsp == NULL) { 3474 rc = -EIO; 3475 goto ioctl_exit; 3476 } 3477 3478 *plen = le32_to_cpu(rsp->OutputCount); 3479 3480 /* We check for obvious errors in the output buffer length and offset */ 3481 if (*plen == 0) 3482 goto ioctl_exit; /* server returned no data */ 3483 else if (*plen > rsp_iov.iov_len || *plen > 0xFF00) { 3484 cifs_tcon_dbg(VFS, "srv returned invalid ioctl length: %d\n", *plen); 3485 *plen = 0; 3486 rc = -EIO; 3487 goto ioctl_exit; 3488 } 3489 3490 if (rsp_iov.iov_len - *plen < le32_to_cpu(rsp->OutputOffset)) { 3491 cifs_tcon_dbg(VFS, "Malformed ioctl resp: len %d offset %d\n", *plen, 3492 le32_to_cpu(rsp->OutputOffset)); 3493 *plen = 0; 3494 rc = -EIO; 3495 goto ioctl_exit; 3496 } 3497 3498 *out_data = kmemdup((char *)rsp + le32_to_cpu(rsp->OutputOffset), 3499 *plen, GFP_KERNEL); 3500 if (*out_data == NULL) { 3501 rc = -ENOMEM; 3502 goto ioctl_exit; 3503 } 3504 3505 ioctl_exit: 3506 SMB2_ioctl_free(&rqst); 3507 free_rsp_buf(resp_buftype, rsp); 3508 3509 if (is_replayable_error(rc) && 3510 smb2_should_replay(tcon, &retries, &cur_sleep)) 3511 goto replay_again; 3512 3513 return rc; 3514 } 3515 3516 /* 3517 * Individual callers to ioctl worker function follow 3518 */ 3519 3520 int 3521 SMB2_set_compression(const unsigned int xid, struct cifs_tcon *tcon, 3522 u64 persistent_fid, u64 volatile_fid) 3523 { 3524 int rc; 3525 struct compress_ioctl fsctl_input; 3526 char *ret_data = NULL; 3527 3528 fsctl_input.CompressionState = 3529 cpu_to_le16(COMPRESSION_FORMAT_DEFAULT); 3530 3531 rc = SMB2_ioctl(xid, tcon, persistent_fid, volatile_fid, 3532 FSCTL_SET_COMPRESSION, 3533 (char *)&fsctl_input /* data input */, 3534 2 /* in data len */, CIFSMaxBufSize /* max out data */, 3535 &ret_data /* out data */, NULL); 3536 3537 cifs_dbg(FYI, "set compression rc %d\n", rc); 3538 3539 return rc; 3540 } 3541 3542 int 3543 SMB2_close_init(struct cifs_tcon *tcon, struct TCP_Server_Info *server, 3544 struct smb_rqst *rqst, 3545 u64 persistent_fid, u64 volatile_fid, bool query_attrs) 3546 { 3547 struct smb2_close_req *req; 3548 struct kvec *iov = rqst->rq_iov; 3549 unsigned int total_len; 3550 int rc; 3551 3552 rc = smb2_plain_req_init(SMB2_CLOSE, tcon, server, 3553 (void **) &req, &total_len); 3554 if (rc) 3555 return rc; 3556 3557 req->PersistentFileId = persistent_fid; 3558 req->VolatileFileId = volatile_fid; 3559 if (query_attrs) 3560 req->Flags = SMB2_CLOSE_FLAG_POSTQUERY_ATTRIB; 3561 else 3562 req->Flags = 0; 3563 iov[0].iov_base = (char *)req; 3564 iov[0].iov_len = total_len; 3565 3566 return 0; 3567 } 3568 3569 void 3570 SMB2_close_free(struct smb_rqst *rqst) 3571 { 3572 if (rqst && rqst->rq_iov) 3573 cifs_small_buf_release(rqst->rq_iov[0].iov_base); /* request */ 3574 } 3575 3576 int 3577 __SMB2_close(const unsigned int xid, struct cifs_tcon *tcon, 3578 u64 persistent_fid, u64 volatile_fid, 3579 struct smb2_file_network_open_info *pbuf) 3580 { 3581 struct smb_rqst rqst; 3582 struct smb2_close_rsp *rsp = NULL; 3583 struct cifs_ses *ses = tcon->ses; 3584 struct TCP_Server_Info *server; 3585 struct kvec iov[1]; 3586 struct kvec rsp_iov; 3587 int resp_buftype = CIFS_NO_BUFFER; 3588 int rc = 0; 3589 int flags = 0; 3590 bool query_attrs = false; 3591 int retries = 0, cur_sleep = 1; 3592 3593 replay_again: 3594 /* reinitialize for possible replay */ 3595 flags = 0; 3596 query_attrs = false; 3597 server = cifs_pick_channel(ses); 3598 3599 cifs_dbg(FYI, "Close\n"); 3600 3601 if (!ses || !server) 3602 return -EIO; 3603 3604 if (smb3_encryption_required(tcon)) 3605 flags |= CIFS_TRANSFORM_REQ; 3606 3607 memset(&rqst, 0, sizeof(struct smb_rqst)); 3608 memset(&iov, 0, sizeof(iov)); 3609 rqst.rq_iov = iov; 3610 rqst.rq_nvec = 1; 3611 3612 /* check if need to ask server to return timestamps in close response */ 3613 if (pbuf) 3614 query_attrs = true; 3615 3616 trace_smb3_close_enter(xid, persistent_fid, tcon->tid, ses->Suid); 3617 rc = SMB2_close_init(tcon, server, 3618 &rqst, persistent_fid, volatile_fid, 3619 query_attrs); 3620 if (rc) 3621 goto close_exit; 3622 3623 if (retries) 3624 smb2_set_replay(server, &rqst); 3625 3626 rc = cifs_send_recv(xid, ses, server, 3627 &rqst, &resp_buftype, flags, &rsp_iov); 3628 rsp = (struct smb2_close_rsp *)rsp_iov.iov_base; 3629 3630 if (rc != 0) { 3631 cifs_stats_fail_inc(tcon, SMB2_CLOSE_HE); 3632 trace_smb3_close_err(xid, persistent_fid, tcon->tid, ses->Suid, 3633 rc); 3634 goto close_exit; 3635 } else { 3636 trace_smb3_close_done(xid, persistent_fid, tcon->tid, 3637 ses->Suid); 3638 if (pbuf) 3639 memcpy(&pbuf->network_open_info, 3640 &rsp->network_open_info, 3641 sizeof(pbuf->network_open_info)); 3642 atomic_dec(&tcon->num_remote_opens); 3643 } 3644 3645 close_exit: 3646 SMB2_close_free(&rqst); 3647 free_rsp_buf(resp_buftype, rsp); 3648 3649 /* retry close in a worker thread if this one is interrupted */ 3650 if (is_interrupt_error(rc)) { 3651 int tmp_rc; 3652 3653 tmp_rc = smb2_handle_cancelled_close(tcon, persistent_fid, 3654 volatile_fid); 3655 if (tmp_rc) 3656 cifs_dbg(VFS, "handle cancelled close fid 0x%llx returned error %d\n", 3657 persistent_fid, tmp_rc); 3658 } 3659 3660 if (is_replayable_error(rc) && 3661 smb2_should_replay(tcon, &retries, &cur_sleep)) 3662 goto replay_again; 3663 3664 return rc; 3665 } 3666 3667 int 3668 SMB2_close(const unsigned int xid, struct cifs_tcon *tcon, 3669 u64 persistent_fid, u64 volatile_fid) 3670 { 3671 return __SMB2_close(xid, tcon, persistent_fid, volatile_fid, NULL); 3672 } 3673 3674 int 3675 smb2_validate_iov(unsigned int offset, unsigned int buffer_length, 3676 struct kvec *iov, unsigned int min_buf_size) 3677 { 3678 unsigned int smb_len = iov->iov_len; 3679 char *end_of_smb = smb_len + (char *)iov->iov_base; 3680 char *begin_of_buf = offset + (char *)iov->iov_base; 3681 char *end_of_buf = begin_of_buf + buffer_length; 3682 3683 3684 if (buffer_length < min_buf_size) { 3685 cifs_dbg(VFS, "buffer length %d smaller than minimum size %d\n", 3686 buffer_length, min_buf_size); 3687 return -EINVAL; 3688 } 3689 3690 /* check if beyond RFC1001 maximum length */ 3691 if ((smb_len > 0x7FFFFF) || (buffer_length > 0x7FFFFF)) { 3692 cifs_dbg(VFS, "buffer length %d or smb length %d too large\n", 3693 buffer_length, smb_len); 3694 return -EINVAL; 3695 } 3696 3697 if ((begin_of_buf > end_of_smb) || (end_of_buf > end_of_smb)) { 3698 cifs_dbg(VFS, "Invalid server response, bad offset to data\n"); 3699 return -EINVAL; 3700 } 3701 3702 return 0; 3703 } 3704 3705 /* 3706 * If SMB buffer fields are valid, copy into temporary buffer to hold result. 3707 * Caller must free buffer. 3708 */ 3709 int 3710 smb2_validate_and_copy_iov(unsigned int offset, unsigned int buffer_length, 3711 struct kvec *iov, unsigned int minbufsize, 3712 char *data) 3713 { 3714 char *begin_of_buf = offset + (char *)iov->iov_base; 3715 int rc; 3716 3717 if (!data) 3718 return -EINVAL; 3719 3720 rc = smb2_validate_iov(offset, buffer_length, iov, minbufsize); 3721 if (rc) 3722 return rc; 3723 3724 memcpy(data, begin_of_buf, minbufsize); 3725 3726 return 0; 3727 } 3728 3729 int 3730 SMB2_query_info_init(struct cifs_tcon *tcon, struct TCP_Server_Info *server, 3731 struct smb_rqst *rqst, 3732 u64 persistent_fid, u64 volatile_fid, 3733 u8 info_class, u8 info_type, u32 additional_info, 3734 size_t output_len, size_t input_len, void *input) 3735 { 3736 struct smb2_query_info_req *req; 3737 struct kvec *iov = rqst->rq_iov; 3738 unsigned int total_len; 3739 size_t len; 3740 int rc; 3741 3742 if (unlikely(check_add_overflow(input_len, sizeof(*req), &len) || 3743 len > CIFSMaxBufSize)) 3744 return -EINVAL; 3745 3746 rc = smb2_plain_req_init(SMB2_QUERY_INFO, tcon, server, 3747 (void **) &req, &total_len); 3748 if (rc) 3749 return rc; 3750 3751 req->InfoType = info_type; 3752 req->FileInfoClass = info_class; 3753 req->PersistentFileId = persistent_fid; 3754 req->VolatileFileId = volatile_fid; 3755 req->AdditionalInformation = cpu_to_le32(additional_info); 3756 3757 req->OutputBufferLength = cpu_to_le32(output_len); 3758 if (input_len) { 3759 req->InputBufferLength = cpu_to_le32(input_len); 3760 /* total_len for smb query request never close to le16 max */ 3761 req->InputBufferOffset = cpu_to_le16(total_len - 1); 3762 memcpy(req->Buffer, input, input_len); 3763 } 3764 3765 iov[0].iov_base = (char *)req; 3766 /* 1 for Buffer */ 3767 iov[0].iov_len = len; 3768 return 0; 3769 } 3770 3771 void 3772 SMB2_query_info_free(struct smb_rqst *rqst) 3773 { 3774 if (rqst && rqst->rq_iov) 3775 cifs_buf_release(rqst->rq_iov[0].iov_base); /* request */ 3776 } 3777 3778 static int 3779 query_info(const unsigned int xid, struct cifs_tcon *tcon, 3780 u64 persistent_fid, u64 volatile_fid, u8 info_class, u8 info_type, 3781 u32 additional_info, size_t output_len, size_t min_len, void **data, 3782 u32 *dlen) 3783 { 3784 struct smb_rqst rqst; 3785 struct smb2_query_info_rsp *rsp = NULL; 3786 struct kvec iov[1]; 3787 struct kvec rsp_iov; 3788 int rc = 0; 3789 int resp_buftype = CIFS_NO_BUFFER; 3790 struct cifs_ses *ses = tcon->ses; 3791 struct TCP_Server_Info *server; 3792 int flags = 0; 3793 bool allocated = false; 3794 int retries = 0, cur_sleep = 1; 3795 3796 cifs_dbg(FYI, "Query Info\n"); 3797 3798 if (!ses) 3799 return -EIO; 3800 3801 replay_again: 3802 /* reinitialize for possible replay */ 3803 flags = 0; 3804 allocated = false; 3805 server = cifs_pick_channel(ses); 3806 3807 if (!server) 3808 return -EIO; 3809 3810 if (smb3_encryption_required(tcon)) 3811 flags |= CIFS_TRANSFORM_REQ; 3812 3813 memset(&rqst, 0, sizeof(struct smb_rqst)); 3814 memset(&iov, 0, sizeof(iov)); 3815 rqst.rq_iov = iov; 3816 rqst.rq_nvec = 1; 3817 3818 rc = SMB2_query_info_init(tcon, server, 3819 &rqst, persistent_fid, volatile_fid, 3820 info_class, info_type, additional_info, 3821 output_len, 0, NULL); 3822 if (rc) 3823 goto qinf_exit; 3824 3825 trace_smb3_query_info_enter(xid, persistent_fid, tcon->tid, 3826 ses->Suid, info_class, (__u32)info_type); 3827 3828 if (retries) 3829 smb2_set_replay(server, &rqst); 3830 3831 rc = cifs_send_recv(xid, ses, server, 3832 &rqst, &resp_buftype, flags, &rsp_iov); 3833 rsp = (struct smb2_query_info_rsp *)rsp_iov.iov_base; 3834 3835 if (rc) { 3836 cifs_stats_fail_inc(tcon, SMB2_QUERY_INFO_HE); 3837 trace_smb3_query_info_err(xid, persistent_fid, tcon->tid, 3838 ses->Suid, info_class, (__u32)info_type, rc); 3839 goto qinf_exit; 3840 } 3841 3842 trace_smb3_query_info_done(xid, persistent_fid, tcon->tid, 3843 ses->Suid, info_class, (__u32)info_type); 3844 3845 if (dlen) { 3846 *dlen = le32_to_cpu(rsp->OutputBufferLength); 3847 if (!*data) { 3848 *data = kmalloc(*dlen, GFP_KERNEL); 3849 if (!*data) { 3850 cifs_tcon_dbg(VFS, 3851 "Error %d allocating memory for acl\n", 3852 rc); 3853 *dlen = 0; 3854 rc = -ENOMEM; 3855 goto qinf_exit; 3856 } 3857 allocated = true; 3858 } 3859 } 3860 3861 rc = smb2_validate_and_copy_iov(le16_to_cpu(rsp->OutputBufferOffset), 3862 le32_to_cpu(rsp->OutputBufferLength), 3863 &rsp_iov, dlen ? *dlen : min_len, *data); 3864 if (rc && allocated) { 3865 kfree(*data); 3866 *data = NULL; 3867 *dlen = 0; 3868 } 3869 3870 qinf_exit: 3871 SMB2_query_info_free(&rqst); 3872 free_rsp_buf(resp_buftype, rsp); 3873 3874 if (is_replayable_error(rc) && 3875 smb2_should_replay(tcon, &retries, &cur_sleep)) 3876 goto replay_again; 3877 3878 return rc; 3879 } 3880 3881 int SMB2_query_info(const unsigned int xid, struct cifs_tcon *tcon, 3882 u64 persistent_fid, u64 volatile_fid, struct smb2_file_all_info *data) 3883 { 3884 return query_info(xid, tcon, persistent_fid, volatile_fid, 3885 FILE_ALL_INFORMATION, SMB2_O_INFO_FILE, 0, 3886 sizeof(struct smb2_file_all_info) + PATH_MAX * 2, 3887 sizeof(struct smb2_file_all_info), (void **)&data, 3888 NULL); 3889 } 3890 3891 #if 0 3892 /* currently unused, as now we are doing compounding instead (see smb311_posix_query_path_info) */ 3893 int 3894 SMB311_posix_query_info(const unsigned int xid, struct cifs_tcon *tcon, 3895 u64 persistent_fid, u64 volatile_fid, struct smb311_posix_qinfo *data, u32 *plen) 3896 { 3897 size_t output_len = sizeof(struct smb311_posix_qinfo *) + 3898 (sizeof(struct smb_sid) * 2) + (PATH_MAX * 2); 3899 *plen = 0; 3900 3901 return query_info(xid, tcon, persistent_fid, volatile_fid, 3902 SMB_FIND_FILE_POSIX_INFO, SMB2_O_INFO_FILE, 0, 3903 output_len, sizeof(struct smb311_posix_qinfo), (void **)&data, plen); 3904 /* Note caller must free "data" (passed in above). It may be allocated in query_info call */ 3905 } 3906 #endif 3907 3908 int 3909 SMB2_query_acl(const unsigned int xid, struct cifs_tcon *tcon, 3910 u64 persistent_fid, u64 volatile_fid, 3911 void **data, u32 *plen, u32 extra_info) 3912 { 3913 *plen = 0; 3914 3915 return query_info(xid, tcon, persistent_fid, volatile_fid, 3916 0, SMB2_O_INFO_SECURITY, extra_info, 3917 SMB2_MAX_BUFFER_SIZE, MIN_SEC_DESC_LEN, data, plen); 3918 } 3919 3920 int 3921 SMB2_get_srv_num(const unsigned int xid, struct cifs_tcon *tcon, 3922 u64 persistent_fid, u64 volatile_fid, __le64 *uniqueid) 3923 { 3924 return query_info(xid, tcon, persistent_fid, volatile_fid, 3925 FILE_INTERNAL_INFORMATION, SMB2_O_INFO_FILE, 0, 3926 sizeof(struct smb2_file_internal_info), 3927 sizeof(struct smb2_file_internal_info), 3928 (void **)&uniqueid, NULL); 3929 } 3930 3931 /* 3932 * CHANGE_NOTIFY Request is sent to get notifications on changes to a directory 3933 * See MS-SMB2 2.2.35 and 2.2.36 3934 */ 3935 3936 static int 3937 SMB2_notify_init(const unsigned int xid, struct smb_rqst *rqst, 3938 struct cifs_tcon *tcon, struct TCP_Server_Info *server, 3939 u64 persistent_fid, u64 volatile_fid, 3940 u32 completion_filter, bool watch_tree) 3941 { 3942 struct smb2_change_notify_req *req; 3943 struct kvec *iov = rqst->rq_iov; 3944 unsigned int total_len; 3945 int rc; 3946 3947 rc = smb2_plain_req_init(SMB2_CHANGE_NOTIFY, tcon, server, 3948 (void **) &req, &total_len); 3949 if (rc) 3950 return rc; 3951 3952 req->PersistentFileId = persistent_fid; 3953 req->VolatileFileId = volatile_fid; 3954 /* See note 354 of MS-SMB2, 64K max */ 3955 req->OutputBufferLength = 3956 cpu_to_le32(SMB2_MAX_BUFFER_SIZE - MAX_SMB2_HDR_SIZE); 3957 req->CompletionFilter = cpu_to_le32(completion_filter); 3958 if (watch_tree) 3959 req->Flags = cpu_to_le16(SMB2_WATCH_TREE); 3960 else 3961 req->Flags = 0; 3962 3963 iov[0].iov_base = (char *)req; 3964 iov[0].iov_len = total_len; 3965 3966 return 0; 3967 } 3968 3969 int 3970 SMB2_change_notify(const unsigned int xid, struct cifs_tcon *tcon, 3971 u64 persistent_fid, u64 volatile_fid, bool watch_tree, 3972 u32 completion_filter, u32 max_out_data_len, char **out_data, 3973 u32 *plen /* returned data len */) 3974 { 3975 struct cifs_ses *ses = tcon->ses; 3976 struct TCP_Server_Info *server; 3977 struct smb_rqst rqst; 3978 struct smb2_change_notify_rsp *smb_rsp; 3979 struct kvec iov[1]; 3980 struct kvec rsp_iov = {NULL, 0}; 3981 int resp_buftype = CIFS_NO_BUFFER; 3982 int flags = 0; 3983 int rc = 0; 3984 int retries = 0, cur_sleep = 1; 3985 3986 replay_again: 3987 /* reinitialize for possible replay */ 3988 flags = 0; 3989 server = cifs_pick_channel(ses); 3990 3991 cifs_dbg(FYI, "change notify\n"); 3992 if (!ses || !server) 3993 return -EIO; 3994 3995 if (smb3_encryption_required(tcon)) 3996 flags |= CIFS_TRANSFORM_REQ; 3997 3998 memset(&rqst, 0, sizeof(struct smb_rqst)); 3999 memset(&iov, 0, sizeof(iov)); 4000 if (plen) 4001 *plen = 0; 4002 4003 rqst.rq_iov = iov; 4004 rqst.rq_nvec = 1; 4005 4006 rc = SMB2_notify_init(xid, &rqst, tcon, server, 4007 persistent_fid, volatile_fid, 4008 completion_filter, watch_tree); 4009 if (rc) 4010 goto cnotify_exit; 4011 4012 trace_smb3_notify_enter(xid, persistent_fid, tcon->tid, ses->Suid, 4013 (u8)watch_tree, completion_filter); 4014 4015 if (retries) 4016 smb2_set_replay(server, &rqst); 4017 4018 rc = cifs_send_recv(xid, ses, server, 4019 &rqst, &resp_buftype, flags, &rsp_iov); 4020 4021 if (rc != 0) { 4022 cifs_stats_fail_inc(tcon, SMB2_CHANGE_NOTIFY_HE); 4023 trace_smb3_notify_err(xid, persistent_fid, tcon->tid, ses->Suid, 4024 (u8)watch_tree, completion_filter, rc); 4025 } else { 4026 trace_smb3_notify_done(xid, persistent_fid, tcon->tid, 4027 ses->Suid, (u8)watch_tree, completion_filter); 4028 /* validate that notify information is plausible */ 4029 if ((rsp_iov.iov_base == NULL) || 4030 (rsp_iov.iov_len < sizeof(struct smb2_change_notify_rsp) + 1)) 4031 goto cnotify_exit; 4032 4033 smb_rsp = (struct smb2_change_notify_rsp *)rsp_iov.iov_base; 4034 4035 smb2_validate_iov(le16_to_cpu(smb_rsp->OutputBufferOffset), 4036 le32_to_cpu(smb_rsp->OutputBufferLength), &rsp_iov, 4037 sizeof(struct file_notify_information)); 4038 4039 *out_data = kmemdup((char *)smb_rsp + le16_to_cpu(smb_rsp->OutputBufferOffset), 4040 le32_to_cpu(smb_rsp->OutputBufferLength), GFP_KERNEL); 4041 if (*out_data == NULL) { 4042 rc = -ENOMEM; 4043 goto cnotify_exit; 4044 } else if (plen) 4045 *plen = le32_to_cpu(smb_rsp->OutputBufferLength); 4046 } 4047 4048 cnotify_exit: 4049 if (rqst.rq_iov) 4050 cifs_small_buf_release(rqst.rq_iov[0].iov_base); /* request */ 4051 free_rsp_buf(resp_buftype, rsp_iov.iov_base); 4052 4053 if (is_replayable_error(rc) && 4054 smb2_should_replay(tcon, &retries, &cur_sleep)) 4055 goto replay_again; 4056 4057 return rc; 4058 } 4059 4060 4061 4062 /* 4063 * This is a no-op for now. We're not really interested in the reply, but 4064 * rather in the fact that the server sent one and that server->lstrp 4065 * gets updated. 4066 * 4067 * FIXME: maybe we should consider checking that the reply matches request? 4068 */ 4069 static void 4070 smb2_echo_callback(struct mid_q_entry *mid) 4071 { 4072 struct TCP_Server_Info *server = mid->callback_data; 4073 struct smb2_echo_rsp *rsp = (struct smb2_echo_rsp *)mid->resp_buf; 4074 struct cifs_credits credits = { .value = 0, .instance = 0 }; 4075 4076 if (mid->mid_state == MID_RESPONSE_RECEIVED 4077 || mid->mid_state == MID_RESPONSE_MALFORMED) { 4078 credits.value = le16_to_cpu(rsp->hdr.CreditRequest); 4079 credits.instance = server->reconnect_instance; 4080 } 4081 4082 release_mid(mid); 4083 add_credits(server, &credits, CIFS_ECHO_OP); 4084 } 4085 4086 static void cifs_renegotiate_iosize(struct TCP_Server_Info *server, 4087 struct cifs_tcon *tcon) 4088 { 4089 struct cifs_sb_info *cifs_sb; 4090 4091 if (server == NULL || tcon == NULL) 4092 return; 4093 4094 spin_lock(&tcon->sb_list_lock); 4095 list_for_each_entry(cifs_sb, &tcon->cifs_sb_list, tcon_sb_link) { 4096 cifs_sb->ctx->rsize = 4097 server->ops->negotiate_rsize(tcon, cifs_sb->ctx); 4098 cifs_sb->ctx->wsize = 4099 server->ops->negotiate_wsize(tcon, cifs_sb->ctx); 4100 } 4101 spin_unlock(&tcon->sb_list_lock); 4102 } 4103 4104 void smb2_reconnect_server(struct work_struct *work) 4105 { 4106 struct TCP_Server_Info *server = container_of(work, 4107 struct TCP_Server_Info, reconnect.work); 4108 struct TCP_Server_Info *pserver; 4109 struct cifs_ses *ses, *ses2; 4110 struct cifs_tcon *tcon, *tcon2; 4111 struct list_head tmp_list, tmp_ses_list; 4112 bool ses_exist = false; 4113 bool tcon_selected = false; 4114 int rc; 4115 bool resched = false; 4116 4117 /* first check if ref count has reached 0, if not inc ref count */ 4118 spin_lock(&cifs_tcp_ses_lock); 4119 if (!server->srv_count) { 4120 spin_unlock(&cifs_tcp_ses_lock); 4121 return; 4122 } 4123 server->srv_count++; 4124 spin_unlock(&cifs_tcp_ses_lock); 4125 4126 /* If server is a channel, select the primary channel */ 4127 pserver = SERVER_IS_CHAN(server) ? server->primary_server : server; 4128 4129 /* Prevent simultaneous reconnects that can corrupt tcon->rlist list */ 4130 mutex_lock(&pserver->reconnect_mutex); 4131 4132 /* if the server is marked for termination, drop the ref count here */ 4133 if (server->terminate) { 4134 cifs_put_tcp_session(server, true); 4135 mutex_unlock(&pserver->reconnect_mutex); 4136 return; 4137 } 4138 4139 INIT_LIST_HEAD(&tmp_list); 4140 INIT_LIST_HEAD(&tmp_ses_list); 4141 cifs_dbg(FYI, "Reconnecting tcons and channels\n"); 4142 4143 spin_lock(&cifs_tcp_ses_lock); 4144 list_for_each_entry(ses, &pserver->smb_ses_list, smb_ses_list) { 4145 spin_lock(&ses->ses_lock); 4146 if (ses->ses_status == SES_EXITING) { 4147 spin_unlock(&ses->ses_lock); 4148 continue; 4149 } 4150 spin_unlock(&ses->ses_lock); 4151 4152 tcon_selected = false; 4153 4154 list_for_each_entry(tcon, &ses->tcon_list, tcon_list) { 4155 if (tcon->need_reconnect || tcon->need_reopen_files) { 4156 tcon->tc_count++; 4157 trace_smb3_tcon_ref(tcon->debug_id, tcon->tc_count, 4158 netfs_trace_tcon_ref_get_reconnect_server); 4159 list_add_tail(&tcon->rlist, &tmp_list); 4160 tcon_selected = true; 4161 } 4162 } 4163 /* 4164 * IPC has the same lifetime as its session and uses its 4165 * refcount. 4166 */ 4167 if (ses->tcon_ipc && ses->tcon_ipc->need_reconnect) { 4168 list_add_tail(&ses->tcon_ipc->rlist, &tmp_list); 4169 tcon_selected = true; 4170 cifs_smb_ses_inc_refcount(ses); 4171 } 4172 /* 4173 * handle the case where channel needs to reconnect 4174 * binding session, but tcon is healthy (some other channel 4175 * is active) 4176 */ 4177 spin_lock(&ses->chan_lock); 4178 if (!tcon_selected && cifs_chan_needs_reconnect(ses, server)) { 4179 list_add_tail(&ses->rlist, &tmp_ses_list); 4180 ses_exist = true; 4181 cifs_smb_ses_inc_refcount(ses); 4182 } 4183 spin_unlock(&ses->chan_lock); 4184 } 4185 spin_unlock(&cifs_tcp_ses_lock); 4186 4187 list_for_each_entry_safe(tcon, tcon2, &tmp_list, rlist) { 4188 rc = smb2_reconnect(SMB2_INTERNAL_CMD, tcon, server, true); 4189 if (!rc) { 4190 cifs_renegotiate_iosize(server, tcon); 4191 cifs_reopen_persistent_handles(tcon); 4192 } else 4193 resched = true; 4194 list_del_init(&tcon->rlist); 4195 if (tcon->ipc) 4196 cifs_put_smb_ses(tcon->ses); 4197 else 4198 cifs_put_tcon(tcon, netfs_trace_tcon_ref_put_reconnect_server); 4199 } 4200 4201 if (!ses_exist) 4202 goto done; 4203 4204 /* allocate a dummy tcon struct used for reconnect */ 4205 tcon = tcon_info_alloc(false, netfs_trace_tcon_ref_new_reconnect_server); 4206 if (!tcon) { 4207 resched = true; 4208 list_for_each_entry_safe(ses, ses2, &tmp_ses_list, rlist) { 4209 list_del_init(&ses->rlist); 4210 cifs_put_smb_ses(ses); 4211 } 4212 goto done; 4213 } 4214 4215 tcon->status = TID_GOOD; 4216 tcon->retry = false; 4217 tcon->need_reconnect = false; 4218 4219 /* now reconnect sessions for necessary channels */ 4220 list_for_each_entry_safe(ses, ses2, &tmp_ses_list, rlist) { 4221 tcon->ses = ses; 4222 rc = smb2_reconnect(SMB2_INTERNAL_CMD, tcon, server, true); 4223 if (rc) 4224 resched = true; 4225 list_del_init(&ses->rlist); 4226 cifs_put_smb_ses(ses); 4227 } 4228 tconInfoFree(tcon, netfs_trace_tcon_ref_free_reconnect_server); 4229 4230 done: 4231 cifs_dbg(FYI, "Reconnecting tcons and channels finished\n"); 4232 if (resched) 4233 queue_delayed_work(cifsiod_wq, &server->reconnect, 2 * HZ); 4234 mutex_unlock(&pserver->reconnect_mutex); 4235 4236 /* now we can safely release srv struct */ 4237 cifs_put_tcp_session(server, true); 4238 } 4239 4240 int 4241 SMB2_echo(struct TCP_Server_Info *server) 4242 { 4243 struct smb2_echo_req *req; 4244 int rc = 0; 4245 struct kvec iov[1]; 4246 struct smb_rqst rqst = { .rq_iov = iov, 4247 .rq_nvec = 1 }; 4248 unsigned int total_len; 4249 4250 cifs_dbg(FYI, "In echo request for conn_id %lld\n", server->conn_id); 4251 4252 spin_lock(&server->srv_lock); 4253 if (server->ops->need_neg && 4254 server->ops->need_neg(server)) { 4255 spin_unlock(&server->srv_lock); 4256 /* No need to send echo on newly established connections */ 4257 mod_delayed_work(cifsiod_wq, &server->reconnect, 0); 4258 return rc; 4259 } 4260 spin_unlock(&server->srv_lock); 4261 4262 rc = smb2_plain_req_init(SMB2_ECHO, NULL, server, 4263 (void **)&req, &total_len); 4264 if (rc) 4265 return rc; 4266 4267 req->hdr.CreditRequest = cpu_to_le16(1); 4268 4269 iov[0].iov_len = total_len; 4270 iov[0].iov_base = (char *)req; 4271 4272 rc = cifs_call_async(server, &rqst, NULL, smb2_echo_callback, NULL, 4273 server, CIFS_ECHO_OP, NULL); 4274 if (rc) 4275 cifs_dbg(FYI, "Echo request failed: %d\n", rc); 4276 4277 cifs_small_buf_release(req); 4278 return rc; 4279 } 4280 4281 void 4282 SMB2_flush_free(struct smb_rqst *rqst) 4283 { 4284 if (rqst && rqst->rq_iov) 4285 cifs_small_buf_release(rqst->rq_iov[0].iov_base); /* request */ 4286 } 4287 4288 int 4289 SMB2_flush_init(const unsigned int xid, struct smb_rqst *rqst, 4290 struct cifs_tcon *tcon, struct TCP_Server_Info *server, 4291 u64 persistent_fid, u64 volatile_fid) 4292 { 4293 struct smb2_flush_req *req; 4294 struct kvec *iov = rqst->rq_iov; 4295 unsigned int total_len; 4296 int rc; 4297 4298 rc = smb2_plain_req_init(SMB2_FLUSH, tcon, server, 4299 (void **) &req, &total_len); 4300 if (rc) 4301 return rc; 4302 4303 req->PersistentFileId = persistent_fid; 4304 req->VolatileFileId = volatile_fid; 4305 4306 iov[0].iov_base = (char *)req; 4307 iov[0].iov_len = total_len; 4308 4309 return 0; 4310 } 4311 4312 int 4313 SMB2_flush(const unsigned int xid, struct cifs_tcon *tcon, u64 persistent_fid, 4314 u64 volatile_fid) 4315 { 4316 struct cifs_ses *ses = tcon->ses; 4317 struct smb_rqst rqst; 4318 struct kvec iov[1]; 4319 struct kvec rsp_iov = {NULL, 0}; 4320 struct TCP_Server_Info *server; 4321 int resp_buftype = CIFS_NO_BUFFER; 4322 int flags = 0; 4323 int rc = 0; 4324 int retries = 0, cur_sleep = 1; 4325 4326 replay_again: 4327 /* reinitialize for possible replay */ 4328 flags = 0; 4329 server = cifs_pick_channel(ses); 4330 4331 cifs_dbg(FYI, "flush\n"); 4332 if (!ses || !(ses->server)) 4333 return -EIO; 4334 4335 if (smb3_encryption_required(tcon)) 4336 flags |= CIFS_TRANSFORM_REQ; 4337 4338 memset(&rqst, 0, sizeof(struct smb_rqst)); 4339 memset(&iov, 0, sizeof(iov)); 4340 rqst.rq_iov = iov; 4341 rqst.rq_nvec = 1; 4342 4343 rc = SMB2_flush_init(xid, &rqst, tcon, server, 4344 persistent_fid, volatile_fid); 4345 if (rc) 4346 goto flush_exit; 4347 4348 trace_smb3_flush_enter(xid, persistent_fid, tcon->tid, ses->Suid); 4349 4350 if (retries) 4351 smb2_set_replay(server, &rqst); 4352 4353 rc = cifs_send_recv(xid, ses, server, 4354 &rqst, &resp_buftype, flags, &rsp_iov); 4355 4356 if (rc != 0) { 4357 cifs_stats_fail_inc(tcon, SMB2_FLUSH_HE); 4358 trace_smb3_flush_err(xid, persistent_fid, tcon->tid, ses->Suid, 4359 rc); 4360 } else 4361 trace_smb3_flush_done(xid, persistent_fid, tcon->tid, 4362 ses->Suid); 4363 4364 flush_exit: 4365 SMB2_flush_free(&rqst); 4366 free_rsp_buf(resp_buftype, rsp_iov.iov_base); 4367 4368 if (is_replayable_error(rc) && 4369 smb2_should_replay(tcon, &retries, &cur_sleep)) 4370 goto replay_again; 4371 4372 return rc; 4373 } 4374 4375 #ifdef CONFIG_CIFS_SMB_DIRECT 4376 static inline bool smb3_use_rdma_offload(struct cifs_io_parms *io_parms) 4377 { 4378 struct TCP_Server_Info *server = io_parms->server; 4379 struct cifs_tcon *tcon = io_parms->tcon; 4380 4381 /* we can only offload if we're connected */ 4382 if (!server || !tcon) 4383 return false; 4384 4385 /* we can only offload on an rdma connection */ 4386 if (!server->rdma || !server->smbd_conn) 4387 return false; 4388 4389 /* we don't support signed offload yet */ 4390 if (server->sign) 4391 return false; 4392 4393 /* we don't support encrypted offload yet */ 4394 if (smb3_encryption_required(tcon)) 4395 return false; 4396 4397 /* offload also has its overhead, so only do it if desired */ 4398 if (io_parms->length < server->smbd_conn->rdma_readwrite_threshold) 4399 return false; 4400 4401 return true; 4402 } 4403 #endif /* CONFIG_CIFS_SMB_DIRECT */ 4404 4405 /* 4406 * To form a chain of read requests, any read requests after the first should 4407 * have the end_of_chain boolean set to true. 4408 */ 4409 static int 4410 smb2_new_read_req(void **buf, unsigned int *total_len, 4411 struct cifs_io_parms *io_parms, struct cifs_io_subrequest *rdata, 4412 unsigned int remaining_bytes, int request_type) 4413 { 4414 int rc = -EACCES; 4415 struct smb2_read_req *req = NULL; 4416 struct smb2_hdr *shdr; 4417 struct TCP_Server_Info *server = io_parms->server; 4418 4419 rc = smb2_plain_req_init(SMB2_READ, io_parms->tcon, server, 4420 (void **) &req, total_len); 4421 if (rc) 4422 return rc; 4423 4424 if (server == NULL) 4425 return -ECONNABORTED; 4426 4427 shdr = &req->hdr; 4428 shdr->Id.SyncId.ProcessId = cpu_to_le32(io_parms->pid); 4429 4430 req->PersistentFileId = io_parms->persistent_fid; 4431 req->VolatileFileId = io_parms->volatile_fid; 4432 req->ReadChannelInfoOffset = 0; /* reserved */ 4433 req->ReadChannelInfoLength = 0; /* reserved */ 4434 req->Channel = 0; /* reserved */ 4435 req->MinimumCount = 0; 4436 req->Length = cpu_to_le32(io_parms->length); 4437 req->Offset = cpu_to_le64(io_parms->offset); 4438 4439 trace_smb3_read_enter(rdata ? rdata->rreq->debug_id : 0, 4440 rdata ? rdata->subreq.debug_index : 0, 4441 rdata ? rdata->xid : 0, 4442 io_parms->persistent_fid, 4443 io_parms->tcon->tid, io_parms->tcon->ses->Suid, 4444 io_parms->offset, io_parms->length); 4445 #ifdef CONFIG_CIFS_SMB_DIRECT 4446 /* 4447 * If we want to do a RDMA write, fill in and append 4448 * smbd_buffer_descriptor_v1 to the end of read request 4449 */ 4450 if (rdata && smb3_use_rdma_offload(io_parms)) { 4451 struct smbd_buffer_descriptor_v1 *v1; 4452 bool need_invalidate = server->dialect == SMB30_PROT_ID; 4453 4454 rdata->mr = smbd_register_mr(server->smbd_conn, &rdata->subreq.io_iter, 4455 true, need_invalidate); 4456 if (!rdata->mr) 4457 return -EAGAIN; 4458 4459 req->Channel = SMB2_CHANNEL_RDMA_V1_INVALIDATE; 4460 if (need_invalidate) 4461 req->Channel = SMB2_CHANNEL_RDMA_V1; 4462 req->ReadChannelInfoOffset = 4463 cpu_to_le16(offsetof(struct smb2_read_req, Buffer)); 4464 req->ReadChannelInfoLength = 4465 cpu_to_le16(sizeof(struct smbd_buffer_descriptor_v1)); 4466 v1 = (struct smbd_buffer_descriptor_v1 *) &req->Buffer[0]; 4467 v1->offset = cpu_to_le64(rdata->mr->mr->iova); 4468 v1->token = cpu_to_le32(rdata->mr->mr->rkey); 4469 v1->length = cpu_to_le32(rdata->mr->mr->length); 4470 4471 *total_len += sizeof(*v1) - 1; 4472 } 4473 #endif 4474 if (request_type & CHAINED_REQUEST) { 4475 if (!(request_type & END_OF_CHAIN)) { 4476 /* next 8-byte aligned request */ 4477 *total_len = ALIGN(*total_len, 8); 4478 shdr->NextCommand = cpu_to_le32(*total_len); 4479 } else /* END_OF_CHAIN */ 4480 shdr->NextCommand = 0; 4481 if (request_type & RELATED_REQUEST) { 4482 shdr->Flags |= SMB2_FLAGS_RELATED_OPERATIONS; 4483 /* 4484 * Related requests use info from previous read request 4485 * in chain. 4486 */ 4487 shdr->SessionId = cpu_to_le64(0xFFFFFFFFFFFFFFFF); 4488 shdr->Id.SyncId.TreeId = cpu_to_le32(0xFFFFFFFF); 4489 req->PersistentFileId = (u64)-1; 4490 req->VolatileFileId = (u64)-1; 4491 } 4492 } 4493 if (remaining_bytes > io_parms->length) 4494 req->RemainingBytes = cpu_to_le32(remaining_bytes); 4495 else 4496 req->RemainingBytes = 0; 4497 4498 *buf = req; 4499 return rc; 4500 } 4501 4502 static void 4503 smb2_readv_callback(struct mid_q_entry *mid) 4504 { 4505 struct cifs_io_subrequest *rdata = mid->callback_data; 4506 struct netfs_inode *ictx = netfs_inode(rdata->rreq->inode); 4507 struct cifs_tcon *tcon = tlink_tcon(rdata->req->cfile->tlink); 4508 struct TCP_Server_Info *server = rdata->server; 4509 struct smb2_hdr *shdr = 4510 (struct smb2_hdr *)rdata->iov[0].iov_base; 4511 struct cifs_credits credits = { 4512 .value = 0, 4513 .instance = 0, 4514 .rreq_debug_id = rdata->rreq->debug_id, 4515 .rreq_debug_index = rdata->subreq.debug_index, 4516 }; 4517 struct smb_rqst rqst = { .rq_iov = &rdata->iov[1], .rq_nvec = 1 }; 4518 unsigned int rreq_debug_id = rdata->rreq->debug_id; 4519 unsigned int subreq_debug_index = rdata->subreq.debug_index; 4520 4521 if (rdata->got_bytes) { 4522 rqst.rq_iter = rdata->subreq.io_iter; 4523 } 4524 4525 WARN_ONCE(rdata->server != mid->server, 4526 "rdata server %p != mid server %p", 4527 rdata->server, mid->server); 4528 4529 cifs_dbg(FYI, "%s: mid=%llu state=%d result=%d bytes=%zu/%zu\n", 4530 __func__, mid->mid, mid->mid_state, rdata->result, 4531 rdata->got_bytes, rdata->subreq.len - rdata->subreq.transferred); 4532 4533 switch (mid->mid_state) { 4534 case MID_RESPONSE_RECEIVED: 4535 credits.value = le16_to_cpu(shdr->CreditRequest); 4536 credits.instance = server->reconnect_instance; 4537 /* result already set, check signature */ 4538 if (server->sign && !mid->decrypted) { 4539 int rc; 4540 4541 iov_iter_truncate(&rqst.rq_iter, rdata->got_bytes); 4542 rc = smb2_verify_signature(&rqst, server); 4543 if (rc) 4544 cifs_tcon_dbg(VFS, "SMB signature verification returned error = %d\n", 4545 rc); 4546 } 4547 /* FIXME: should this be counted toward the initiating task? */ 4548 task_io_account_read(rdata->got_bytes); 4549 cifs_stats_bytes_read(tcon, rdata->got_bytes); 4550 break; 4551 case MID_REQUEST_SUBMITTED: 4552 case MID_RETRY_NEEDED: 4553 __set_bit(NETFS_SREQ_NEED_RETRY, &rdata->subreq.flags); 4554 rdata->result = -EAGAIN; 4555 if (server->sign && rdata->got_bytes) 4556 /* reset bytes number since we can not check a sign */ 4557 rdata->got_bytes = 0; 4558 /* FIXME: should this be counted toward the initiating task? */ 4559 task_io_account_read(rdata->got_bytes); 4560 cifs_stats_bytes_read(tcon, rdata->got_bytes); 4561 break; 4562 case MID_RESPONSE_MALFORMED: 4563 credits.value = le16_to_cpu(shdr->CreditRequest); 4564 credits.instance = server->reconnect_instance; 4565 fallthrough; 4566 default: 4567 rdata->result = -EIO; 4568 } 4569 #ifdef CONFIG_CIFS_SMB_DIRECT 4570 /* 4571 * If this rdata has a memory registered, the MR can be freed 4572 * MR needs to be freed as soon as I/O finishes to prevent deadlock 4573 * because they have limited number and are used for future I/Os 4574 */ 4575 if (rdata->mr) { 4576 smbd_deregister_mr(rdata->mr); 4577 rdata->mr = NULL; 4578 } 4579 #endif 4580 if (rdata->result && rdata->result != -ENODATA) { 4581 cifs_stats_fail_inc(tcon, SMB2_READ_HE); 4582 trace_smb3_read_err(rdata->rreq->debug_id, 4583 rdata->subreq.debug_index, 4584 rdata->xid, 4585 rdata->req->cfile->fid.persistent_fid, 4586 tcon->tid, tcon->ses->Suid, 4587 rdata->subreq.start + rdata->subreq.transferred, 4588 rdata->subreq.len - rdata->subreq.transferred, 4589 rdata->result); 4590 } else 4591 trace_smb3_read_done(rdata->rreq->debug_id, 4592 rdata->subreq.debug_index, 4593 rdata->xid, 4594 rdata->req->cfile->fid.persistent_fid, 4595 tcon->tid, tcon->ses->Suid, 4596 rdata->subreq.start + rdata->subreq.transferred, 4597 rdata->got_bytes); 4598 4599 if (rdata->result == -ENODATA) { 4600 __set_bit(NETFS_SREQ_HIT_EOF, &rdata->subreq.flags); 4601 rdata->result = 0; 4602 } else { 4603 size_t trans = rdata->subreq.transferred + rdata->got_bytes; 4604 if (trans < rdata->subreq.len && 4605 rdata->subreq.start + trans == ictx->remote_i_size) { 4606 __set_bit(NETFS_SREQ_HIT_EOF, &rdata->subreq.flags); 4607 rdata->result = 0; 4608 } 4609 if (rdata->got_bytes) 4610 __set_bit(NETFS_SREQ_MADE_PROGRESS, &rdata->subreq.flags); 4611 } 4612 trace_smb3_rw_credits(rreq_debug_id, subreq_debug_index, rdata->credits.value, 4613 server->credits, server->in_flight, 4614 0, cifs_trace_rw_credits_read_response_clear); 4615 rdata->credits.value = 0; 4616 rdata->subreq.error = rdata->result; 4617 rdata->subreq.transferred += rdata->got_bytes; 4618 trace_netfs_sreq(&rdata->subreq, netfs_sreq_trace_io_progress); 4619 netfs_read_subreq_terminated(&rdata->subreq); 4620 release_mid(mid); 4621 trace_smb3_rw_credits(rreq_debug_id, subreq_debug_index, 0, 4622 server->credits, server->in_flight, 4623 credits.value, cifs_trace_rw_credits_read_response_add); 4624 add_credits(server, &credits, 0); 4625 } 4626 4627 /* smb2_async_readv - send an async read, and set up mid to handle result */ 4628 int 4629 smb2_async_readv(struct cifs_io_subrequest *rdata) 4630 { 4631 int rc, flags = 0; 4632 char *buf; 4633 struct netfs_io_subrequest *subreq = &rdata->subreq; 4634 struct smb2_hdr *shdr; 4635 struct cifs_io_parms io_parms; 4636 struct smb_rqst rqst = { .rq_iov = rdata->iov, 4637 .rq_nvec = 1 }; 4638 struct TCP_Server_Info *server; 4639 struct cifs_tcon *tcon = tlink_tcon(rdata->req->cfile->tlink); 4640 unsigned int total_len; 4641 int credit_request; 4642 4643 cifs_dbg(FYI, "%s: offset=%llu bytes=%zu\n", 4644 __func__, subreq->start, subreq->len); 4645 4646 if (!rdata->server) 4647 rdata->server = cifs_pick_channel(tcon->ses); 4648 4649 io_parms.tcon = tlink_tcon(rdata->req->cfile->tlink); 4650 io_parms.server = server = rdata->server; 4651 io_parms.offset = subreq->start + subreq->transferred; 4652 io_parms.length = subreq->len - subreq->transferred; 4653 io_parms.persistent_fid = rdata->req->cfile->fid.persistent_fid; 4654 io_parms.volatile_fid = rdata->req->cfile->fid.volatile_fid; 4655 io_parms.pid = rdata->req->pid; 4656 4657 rc = smb2_new_read_req( 4658 (void **) &buf, &total_len, &io_parms, rdata, 0, 0); 4659 if (rc) 4660 return rc; 4661 4662 if (smb3_encryption_required(io_parms.tcon)) 4663 flags |= CIFS_TRANSFORM_REQ; 4664 4665 rdata->iov[0].iov_base = buf; 4666 rdata->iov[0].iov_len = total_len; 4667 rdata->got_bytes = 0; 4668 rdata->result = 0; 4669 4670 shdr = (struct smb2_hdr *)buf; 4671 4672 if (rdata->credits.value > 0) { 4673 shdr->CreditCharge = cpu_to_le16(DIV_ROUND_UP(io_parms.length, 4674 SMB2_MAX_BUFFER_SIZE)); 4675 credit_request = le16_to_cpu(shdr->CreditCharge) + 8; 4676 if (server->credits >= server->max_credits) 4677 shdr->CreditRequest = cpu_to_le16(0); 4678 else 4679 shdr->CreditRequest = cpu_to_le16( 4680 min_t(int, server->max_credits - 4681 server->credits, credit_request)); 4682 4683 rc = adjust_credits(server, rdata, cifs_trace_rw_credits_call_readv_adjust); 4684 if (rc) 4685 goto async_readv_out; 4686 4687 flags |= CIFS_HAS_CREDITS; 4688 } 4689 4690 rc = cifs_call_async(server, &rqst, 4691 cifs_readv_receive, smb2_readv_callback, 4692 smb3_handle_read_data, rdata, flags, 4693 &rdata->credits); 4694 if (rc) { 4695 cifs_stats_fail_inc(io_parms.tcon, SMB2_READ_HE); 4696 trace_smb3_read_err(rdata->rreq->debug_id, 4697 subreq->debug_index, 4698 rdata->xid, io_parms.persistent_fid, 4699 io_parms.tcon->tid, 4700 io_parms.tcon->ses->Suid, 4701 io_parms.offset, 4702 subreq->len - subreq->transferred, rc); 4703 } 4704 4705 async_readv_out: 4706 cifs_small_buf_release(buf); 4707 return rc; 4708 } 4709 4710 int 4711 SMB2_read(const unsigned int xid, struct cifs_io_parms *io_parms, 4712 unsigned int *nbytes, char **buf, int *buf_type) 4713 { 4714 struct smb_rqst rqst; 4715 int resp_buftype, rc; 4716 struct smb2_read_req *req = NULL; 4717 struct smb2_read_rsp *rsp = NULL; 4718 struct kvec iov[1]; 4719 struct kvec rsp_iov; 4720 unsigned int total_len; 4721 int flags = CIFS_LOG_ERROR; 4722 struct cifs_ses *ses = io_parms->tcon->ses; 4723 4724 if (!io_parms->server) 4725 io_parms->server = cifs_pick_channel(io_parms->tcon->ses); 4726 4727 *nbytes = 0; 4728 rc = smb2_new_read_req((void **)&req, &total_len, io_parms, NULL, 0, 0); 4729 if (rc) 4730 return rc; 4731 4732 if (smb3_encryption_required(io_parms->tcon)) 4733 flags |= CIFS_TRANSFORM_REQ; 4734 4735 iov[0].iov_base = (char *)req; 4736 iov[0].iov_len = total_len; 4737 4738 memset(&rqst, 0, sizeof(struct smb_rqst)); 4739 rqst.rq_iov = iov; 4740 rqst.rq_nvec = 1; 4741 4742 rc = cifs_send_recv(xid, ses, io_parms->server, 4743 &rqst, &resp_buftype, flags, &rsp_iov); 4744 rsp = (struct smb2_read_rsp *)rsp_iov.iov_base; 4745 4746 if (rc) { 4747 if (rc != -ENODATA) { 4748 cifs_stats_fail_inc(io_parms->tcon, SMB2_READ_HE); 4749 cifs_dbg(VFS, "Send error in read = %d\n", rc); 4750 trace_smb3_read_err(0, 0, xid, 4751 req->PersistentFileId, 4752 io_parms->tcon->tid, ses->Suid, 4753 io_parms->offset, io_parms->length, 4754 rc); 4755 } else 4756 trace_smb3_read_done(0, 0, xid, 4757 req->PersistentFileId, io_parms->tcon->tid, 4758 ses->Suid, io_parms->offset, 0); 4759 free_rsp_buf(resp_buftype, rsp_iov.iov_base); 4760 cifs_small_buf_release(req); 4761 return rc == -ENODATA ? 0 : rc; 4762 } else 4763 trace_smb3_read_done(0, 0, xid, 4764 req->PersistentFileId, 4765 io_parms->tcon->tid, ses->Suid, 4766 io_parms->offset, io_parms->length); 4767 4768 cifs_small_buf_release(req); 4769 4770 *nbytes = le32_to_cpu(rsp->DataLength); 4771 if ((*nbytes > CIFS_MAX_MSGSIZE) || 4772 (*nbytes > io_parms->length)) { 4773 cifs_dbg(FYI, "bad length %d for count %d\n", 4774 *nbytes, io_parms->length); 4775 rc = -EIO; 4776 *nbytes = 0; 4777 } 4778 4779 if (*buf) { 4780 memcpy(*buf, (char *)rsp + rsp->DataOffset, *nbytes); 4781 free_rsp_buf(resp_buftype, rsp_iov.iov_base); 4782 } else if (resp_buftype != CIFS_NO_BUFFER) { 4783 *buf = rsp_iov.iov_base; 4784 if (resp_buftype == CIFS_SMALL_BUFFER) 4785 *buf_type = CIFS_SMALL_BUFFER; 4786 else if (resp_buftype == CIFS_LARGE_BUFFER) 4787 *buf_type = CIFS_LARGE_BUFFER; 4788 } 4789 return rc; 4790 } 4791 4792 /* 4793 * Check the mid_state and signature on received buffer (if any), and queue the 4794 * workqueue completion task. 4795 */ 4796 static void 4797 smb2_writev_callback(struct mid_q_entry *mid) 4798 { 4799 struct cifs_io_subrequest *wdata = mid->callback_data; 4800 struct cifs_tcon *tcon = tlink_tcon(wdata->req->cfile->tlink); 4801 struct TCP_Server_Info *server = wdata->server; 4802 struct smb2_write_rsp *rsp = (struct smb2_write_rsp *)mid->resp_buf; 4803 struct cifs_credits credits = { 4804 .value = 0, 4805 .instance = 0, 4806 .rreq_debug_id = wdata->rreq->debug_id, 4807 .rreq_debug_index = wdata->subreq.debug_index, 4808 }; 4809 unsigned int rreq_debug_id = wdata->rreq->debug_id; 4810 unsigned int subreq_debug_index = wdata->subreq.debug_index; 4811 ssize_t result = 0; 4812 size_t written; 4813 4814 WARN_ONCE(wdata->server != mid->server, 4815 "wdata server %p != mid server %p", 4816 wdata->server, mid->server); 4817 4818 switch (mid->mid_state) { 4819 case MID_RESPONSE_RECEIVED: 4820 credits.value = le16_to_cpu(rsp->hdr.CreditRequest); 4821 credits.instance = server->reconnect_instance; 4822 result = smb2_check_receive(mid, server, 0); 4823 if (result != 0) 4824 break; 4825 4826 written = le32_to_cpu(rsp->DataLength); 4827 /* 4828 * Mask off high 16 bits when bytes written as returned 4829 * by the server is greater than bytes requested by the 4830 * client. OS/2 servers are known to set incorrect 4831 * CountHigh values. 4832 */ 4833 if (written > wdata->subreq.len) 4834 written &= 0xFFFF; 4835 4836 cifs_stats_bytes_written(tcon, written); 4837 4838 if (written < wdata->subreq.len) { 4839 wdata->result = -ENOSPC; 4840 } else if (written > 0) { 4841 wdata->subreq.len = written; 4842 __set_bit(NETFS_SREQ_MADE_PROGRESS, &wdata->subreq.flags); 4843 } 4844 break; 4845 case MID_REQUEST_SUBMITTED: 4846 case MID_RETRY_NEEDED: 4847 result = -EAGAIN; 4848 break; 4849 case MID_RESPONSE_MALFORMED: 4850 credits.value = le16_to_cpu(rsp->hdr.CreditRequest); 4851 credits.instance = server->reconnect_instance; 4852 fallthrough; 4853 default: 4854 result = -EIO; 4855 break; 4856 } 4857 #ifdef CONFIG_CIFS_SMB_DIRECT 4858 /* 4859 * If this wdata has a memory registered, the MR can be freed 4860 * The number of MRs available is limited, it's important to recover 4861 * used MR as soon as I/O is finished. Hold MR longer in the later 4862 * I/O process can possibly result in I/O deadlock due to lack of MR 4863 * to send request on I/O retry 4864 */ 4865 if (wdata->mr) { 4866 smbd_deregister_mr(wdata->mr); 4867 wdata->mr = NULL; 4868 } 4869 #endif 4870 if (result) { 4871 cifs_stats_fail_inc(tcon, SMB2_WRITE_HE); 4872 trace_smb3_write_err(wdata->rreq->debug_id, 4873 wdata->subreq.debug_index, 4874 wdata->xid, 4875 wdata->req->cfile->fid.persistent_fid, 4876 tcon->tid, tcon->ses->Suid, wdata->subreq.start, 4877 wdata->subreq.len, wdata->result); 4878 if (wdata->result == -ENOSPC) 4879 pr_warn_once("Out of space writing to %s\n", 4880 tcon->tree_name); 4881 } else 4882 trace_smb3_write_done(wdata->rreq->debug_id, 4883 wdata->subreq.debug_index, 4884 wdata->xid, 4885 wdata->req->cfile->fid.persistent_fid, 4886 tcon->tid, tcon->ses->Suid, 4887 wdata->subreq.start, wdata->subreq.len); 4888 4889 trace_smb3_rw_credits(rreq_debug_id, subreq_debug_index, wdata->credits.value, 4890 server->credits, server->in_flight, 4891 0, cifs_trace_rw_credits_write_response_clear); 4892 wdata->credits.value = 0; 4893 trace_netfs_sreq(&wdata->subreq, netfs_sreq_trace_io_progress); 4894 cifs_write_subrequest_terminated(wdata, result ?: written, true); 4895 release_mid(mid); 4896 trace_smb3_rw_credits(rreq_debug_id, subreq_debug_index, 0, 4897 server->credits, server->in_flight, 4898 credits.value, cifs_trace_rw_credits_write_response_add); 4899 add_credits(server, &credits, 0); 4900 } 4901 4902 /* smb2_async_writev - send an async write, and set up mid to handle result */ 4903 void 4904 smb2_async_writev(struct cifs_io_subrequest *wdata) 4905 { 4906 int rc = -EACCES, flags = 0; 4907 struct smb2_write_req *req = NULL; 4908 struct smb2_hdr *shdr; 4909 struct cifs_tcon *tcon = tlink_tcon(wdata->req->cfile->tlink); 4910 struct TCP_Server_Info *server = wdata->server; 4911 struct kvec iov[1]; 4912 struct smb_rqst rqst = { }; 4913 unsigned int total_len, xid = wdata->xid; 4914 struct cifs_io_parms _io_parms; 4915 struct cifs_io_parms *io_parms = NULL; 4916 int credit_request; 4917 4918 /* 4919 * in future we may get cifs_io_parms passed in from the caller, 4920 * but for now we construct it here... 4921 */ 4922 _io_parms = (struct cifs_io_parms) { 4923 .tcon = tcon, 4924 .server = server, 4925 .offset = wdata->subreq.start, 4926 .length = wdata->subreq.len, 4927 .persistent_fid = wdata->req->cfile->fid.persistent_fid, 4928 .volatile_fid = wdata->req->cfile->fid.volatile_fid, 4929 .pid = wdata->req->pid, 4930 }; 4931 io_parms = &_io_parms; 4932 4933 rc = smb2_plain_req_init(SMB2_WRITE, tcon, server, 4934 (void **) &req, &total_len); 4935 if (rc) 4936 goto out; 4937 4938 rqst.rq_iov = iov; 4939 rqst.rq_iter = wdata->subreq.io_iter; 4940 4941 rqst.rq_iov[0].iov_len = total_len - 1; 4942 rqst.rq_iov[0].iov_base = (char *)req; 4943 rqst.rq_nvec += 1; 4944 4945 if (smb3_encryption_required(tcon)) 4946 flags |= CIFS_TRANSFORM_REQ; 4947 4948 shdr = (struct smb2_hdr *)req; 4949 shdr->Id.SyncId.ProcessId = cpu_to_le32(io_parms->pid); 4950 4951 req->PersistentFileId = io_parms->persistent_fid; 4952 req->VolatileFileId = io_parms->volatile_fid; 4953 req->WriteChannelInfoOffset = 0; 4954 req->WriteChannelInfoLength = 0; 4955 req->Channel = SMB2_CHANNEL_NONE; 4956 req->Length = cpu_to_le32(io_parms->length); 4957 req->Offset = cpu_to_le64(io_parms->offset); 4958 req->DataOffset = cpu_to_le16( 4959 offsetof(struct smb2_write_req, Buffer)); 4960 req->RemainingBytes = 0; 4961 4962 trace_smb3_write_enter(wdata->rreq->debug_id, 4963 wdata->subreq.debug_index, 4964 wdata->xid, 4965 io_parms->persistent_fid, 4966 io_parms->tcon->tid, 4967 io_parms->tcon->ses->Suid, 4968 io_parms->offset, 4969 io_parms->length); 4970 4971 #ifdef CONFIG_CIFS_SMB_DIRECT 4972 /* 4973 * If we want to do a server RDMA read, fill in and append 4974 * smbd_buffer_descriptor_v1 to the end of write request 4975 */ 4976 if (smb3_use_rdma_offload(io_parms)) { 4977 struct smbd_buffer_descriptor_v1 *v1; 4978 bool need_invalidate = server->dialect == SMB30_PROT_ID; 4979 4980 wdata->mr = smbd_register_mr(server->smbd_conn, &wdata->subreq.io_iter, 4981 false, need_invalidate); 4982 if (!wdata->mr) { 4983 rc = -EAGAIN; 4984 goto async_writev_out; 4985 } 4986 /* For RDMA read, I/O size is in RemainingBytes not in Length */ 4987 req->RemainingBytes = req->Length; 4988 req->Length = 0; 4989 req->DataOffset = 0; 4990 req->Channel = SMB2_CHANNEL_RDMA_V1_INVALIDATE; 4991 if (need_invalidate) 4992 req->Channel = SMB2_CHANNEL_RDMA_V1; 4993 req->WriteChannelInfoOffset = 4994 cpu_to_le16(offsetof(struct smb2_write_req, Buffer)); 4995 req->WriteChannelInfoLength = 4996 cpu_to_le16(sizeof(struct smbd_buffer_descriptor_v1)); 4997 v1 = (struct smbd_buffer_descriptor_v1 *) &req->Buffer[0]; 4998 v1->offset = cpu_to_le64(wdata->mr->mr->iova); 4999 v1->token = cpu_to_le32(wdata->mr->mr->rkey); 5000 v1->length = cpu_to_le32(wdata->mr->mr->length); 5001 5002 rqst.rq_iov[0].iov_len += sizeof(*v1); 5003 5004 /* 5005 * We keep wdata->subreq.io_iter, 5006 * but we have to truncate rqst.rq_iter 5007 */ 5008 iov_iter_truncate(&rqst.rq_iter, 0); 5009 } 5010 #endif 5011 5012 if (wdata->subreq.retry_count > 0) 5013 smb2_set_replay(server, &rqst); 5014 5015 cifs_dbg(FYI, "async write at %llu %u bytes iter=%zx\n", 5016 io_parms->offset, io_parms->length, iov_iter_count(&wdata->subreq.io_iter)); 5017 5018 if (wdata->credits.value > 0) { 5019 shdr->CreditCharge = cpu_to_le16(DIV_ROUND_UP(wdata->subreq.len, 5020 SMB2_MAX_BUFFER_SIZE)); 5021 credit_request = le16_to_cpu(shdr->CreditCharge) + 8; 5022 if (server->credits >= server->max_credits) 5023 shdr->CreditRequest = cpu_to_le16(0); 5024 else 5025 shdr->CreditRequest = cpu_to_le16( 5026 min_t(int, server->max_credits - 5027 server->credits, credit_request)); 5028 5029 rc = adjust_credits(server, wdata, cifs_trace_rw_credits_call_writev_adjust); 5030 if (rc) 5031 goto async_writev_out; 5032 5033 flags |= CIFS_HAS_CREDITS; 5034 } 5035 5036 /* XXX: compression + encryption is unsupported for now */ 5037 if (((flags & CIFS_TRANSFORM_REQ) != CIFS_TRANSFORM_REQ) && should_compress(tcon, &rqst)) 5038 flags |= CIFS_COMPRESS_REQ; 5039 5040 rc = cifs_call_async(server, &rqst, NULL, smb2_writev_callback, NULL, 5041 wdata, flags, &wdata->credits); 5042 /* Can't touch wdata if rc == 0 */ 5043 if (rc) { 5044 trace_smb3_write_err(wdata->rreq->debug_id, 5045 wdata->subreq.debug_index, 5046 xid, 5047 io_parms->persistent_fid, 5048 io_parms->tcon->tid, 5049 io_parms->tcon->ses->Suid, 5050 io_parms->offset, 5051 io_parms->length, 5052 rc); 5053 cifs_stats_fail_inc(tcon, SMB2_WRITE_HE); 5054 } 5055 5056 async_writev_out: 5057 cifs_small_buf_release(req); 5058 out: 5059 if (rc) { 5060 trace_smb3_rw_credits(wdata->rreq->debug_id, 5061 wdata->subreq.debug_index, 5062 wdata->credits.value, 5063 server->credits, server->in_flight, 5064 -(int)wdata->credits.value, 5065 cifs_trace_rw_credits_write_response_clear); 5066 add_credits_and_wake_if(wdata->server, &wdata->credits, 0); 5067 cifs_write_subrequest_terminated(wdata, rc, true); 5068 } 5069 } 5070 5071 /* 5072 * SMB2_write function gets iov pointer to kvec array with n_vec as a length. 5073 * The length field from io_parms must be at least 1 and indicates a number of 5074 * elements with data to write that begins with position 1 in iov array. All 5075 * data length is specified by count. 5076 */ 5077 int 5078 SMB2_write(const unsigned int xid, struct cifs_io_parms *io_parms, 5079 unsigned int *nbytes, struct kvec *iov, int n_vec) 5080 { 5081 struct smb_rqst rqst; 5082 int rc = 0; 5083 struct smb2_write_req *req = NULL; 5084 struct smb2_write_rsp *rsp = NULL; 5085 int resp_buftype; 5086 struct kvec rsp_iov; 5087 int flags = 0; 5088 unsigned int total_len; 5089 struct TCP_Server_Info *server; 5090 int retries = 0, cur_sleep = 1; 5091 5092 replay_again: 5093 /* reinitialize for possible replay */ 5094 flags = 0; 5095 *nbytes = 0; 5096 if (!io_parms->server) 5097 io_parms->server = cifs_pick_channel(io_parms->tcon->ses); 5098 server = io_parms->server; 5099 if (server == NULL) 5100 return -ECONNABORTED; 5101 5102 if (n_vec < 1) 5103 return rc; 5104 5105 rc = smb2_plain_req_init(SMB2_WRITE, io_parms->tcon, server, 5106 (void **) &req, &total_len); 5107 if (rc) 5108 return rc; 5109 5110 if (smb3_encryption_required(io_parms->tcon)) 5111 flags |= CIFS_TRANSFORM_REQ; 5112 5113 req->hdr.Id.SyncId.ProcessId = cpu_to_le32(io_parms->pid); 5114 5115 req->PersistentFileId = io_parms->persistent_fid; 5116 req->VolatileFileId = io_parms->volatile_fid; 5117 req->WriteChannelInfoOffset = 0; 5118 req->WriteChannelInfoLength = 0; 5119 req->Channel = 0; 5120 req->Length = cpu_to_le32(io_parms->length); 5121 req->Offset = cpu_to_le64(io_parms->offset); 5122 req->DataOffset = cpu_to_le16( 5123 offsetof(struct smb2_write_req, Buffer)); 5124 req->RemainingBytes = 0; 5125 5126 trace_smb3_write_enter(0, 0, xid, io_parms->persistent_fid, 5127 io_parms->tcon->tid, io_parms->tcon->ses->Suid, 5128 io_parms->offset, io_parms->length); 5129 5130 iov[0].iov_base = (char *)req; 5131 /* 1 for Buffer */ 5132 iov[0].iov_len = total_len - 1; 5133 5134 memset(&rqst, 0, sizeof(struct smb_rqst)); 5135 rqst.rq_iov = iov; 5136 rqst.rq_nvec = n_vec + 1; 5137 5138 if (retries) 5139 smb2_set_replay(server, &rqst); 5140 5141 rc = cifs_send_recv(xid, io_parms->tcon->ses, server, 5142 &rqst, 5143 &resp_buftype, flags, &rsp_iov); 5144 rsp = (struct smb2_write_rsp *)rsp_iov.iov_base; 5145 5146 if (rc) { 5147 trace_smb3_write_err(0, 0, xid, 5148 req->PersistentFileId, 5149 io_parms->tcon->tid, 5150 io_parms->tcon->ses->Suid, 5151 io_parms->offset, io_parms->length, rc); 5152 cifs_stats_fail_inc(io_parms->tcon, SMB2_WRITE_HE); 5153 cifs_dbg(VFS, "Send error in write = %d\n", rc); 5154 } else { 5155 *nbytes = le32_to_cpu(rsp->DataLength); 5156 cifs_stats_bytes_written(io_parms->tcon, *nbytes); 5157 trace_smb3_write_done(0, 0, xid, 5158 req->PersistentFileId, 5159 io_parms->tcon->tid, 5160 io_parms->tcon->ses->Suid, 5161 io_parms->offset, *nbytes); 5162 } 5163 5164 cifs_small_buf_release(req); 5165 free_rsp_buf(resp_buftype, rsp); 5166 5167 if (is_replayable_error(rc) && 5168 smb2_should_replay(io_parms->tcon, &retries, &cur_sleep)) 5169 goto replay_again; 5170 5171 return rc; 5172 } 5173 5174 int posix_info_sid_size(const void *beg, const void *end) 5175 { 5176 size_t subauth; 5177 int total; 5178 5179 if (beg + 1 > end) 5180 return -1; 5181 5182 subauth = *(u8 *)(beg+1); 5183 if (subauth < 1 || subauth > 15) 5184 return -1; 5185 5186 total = 1 + 1 + 6 + 4*subauth; 5187 if (beg + total > end) 5188 return -1; 5189 5190 return total; 5191 } 5192 5193 int posix_info_parse(const void *beg, const void *end, 5194 struct smb2_posix_info_parsed *out) 5195 5196 { 5197 int total_len = 0; 5198 int owner_len, group_len; 5199 int name_len; 5200 const void *owner_sid; 5201 const void *group_sid; 5202 const void *name; 5203 5204 /* if no end bound given, assume payload to be correct */ 5205 if (!end) { 5206 const struct smb2_posix_info *p = beg; 5207 5208 end = beg + le32_to_cpu(p->NextEntryOffset); 5209 /* last element will have a 0 offset, pick a sensible bound */ 5210 if (end == beg) 5211 end += 0xFFFF; 5212 } 5213 5214 /* check base buf */ 5215 if (beg + sizeof(struct smb2_posix_info) > end) 5216 return -1; 5217 total_len = sizeof(struct smb2_posix_info); 5218 5219 /* check owner sid */ 5220 owner_sid = beg + total_len; 5221 owner_len = posix_info_sid_size(owner_sid, end); 5222 if (owner_len < 0) 5223 return -1; 5224 total_len += owner_len; 5225 5226 /* check group sid */ 5227 group_sid = beg + total_len; 5228 group_len = posix_info_sid_size(group_sid, end); 5229 if (group_len < 0) 5230 return -1; 5231 total_len += group_len; 5232 5233 /* check name len */ 5234 if (beg + total_len + 4 > end) 5235 return -1; 5236 name_len = le32_to_cpu(*(__le32 *)(beg + total_len)); 5237 if (name_len < 1 || name_len > 0xFFFF) 5238 return -1; 5239 total_len += 4; 5240 5241 /* check name */ 5242 name = beg + total_len; 5243 if (name + name_len > end) 5244 return -1; 5245 total_len += name_len; 5246 5247 if (out) { 5248 out->base = beg; 5249 out->size = total_len; 5250 out->name_len = name_len; 5251 out->name = name; 5252 memcpy(&out->owner, owner_sid, owner_len); 5253 memcpy(&out->group, group_sid, group_len); 5254 } 5255 return total_len; 5256 } 5257 5258 static int posix_info_extra_size(const void *beg, const void *end) 5259 { 5260 int len = posix_info_parse(beg, end, NULL); 5261 5262 if (len < 0) 5263 return -1; 5264 return len - sizeof(struct smb2_posix_info); 5265 } 5266 5267 static unsigned int 5268 num_entries(int infotype, char *bufstart, char *end_of_buf, char **lastentry, 5269 size_t size) 5270 { 5271 int len; 5272 unsigned int entrycount = 0; 5273 unsigned int next_offset = 0; 5274 char *entryptr; 5275 FILE_DIRECTORY_INFO *dir_info; 5276 5277 if (bufstart == NULL) 5278 return 0; 5279 5280 entryptr = bufstart; 5281 5282 while (1) { 5283 if (entryptr + next_offset < entryptr || 5284 entryptr + next_offset > end_of_buf || 5285 entryptr + next_offset + size > end_of_buf) { 5286 cifs_dbg(VFS, "malformed search entry would overflow\n"); 5287 break; 5288 } 5289 5290 entryptr = entryptr + next_offset; 5291 dir_info = (FILE_DIRECTORY_INFO *)entryptr; 5292 5293 if (infotype == SMB_FIND_FILE_POSIX_INFO) 5294 len = posix_info_extra_size(entryptr, end_of_buf); 5295 else 5296 len = le32_to_cpu(dir_info->FileNameLength); 5297 5298 if (len < 0 || 5299 entryptr + len < entryptr || 5300 entryptr + len > end_of_buf || 5301 entryptr + len + size > end_of_buf) { 5302 cifs_dbg(VFS, "directory entry name would overflow frame end of buf %p\n", 5303 end_of_buf); 5304 break; 5305 } 5306 5307 *lastentry = entryptr; 5308 entrycount++; 5309 5310 next_offset = le32_to_cpu(dir_info->NextEntryOffset); 5311 if (!next_offset) 5312 break; 5313 } 5314 5315 return entrycount; 5316 } 5317 5318 /* 5319 * Readdir/FindFirst 5320 */ 5321 int SMB2_query_directory_init(const unsigned int xid, 5322 struct cifs_tcon *tcon, 5323 struct TCP_Server_Info *server, 5324 struct smb_rqst *rqst, 5325 u64 persistent_fid, u64 volatile_fid, 5326 int index, int info_level) 5327 { 5328 struct smb2_query_directory_req *req; 5329 unsigned char *bufptr; 5330 __le16 asteriks = cpu_to_le16('*'); 5331 unsigned int output_size = CIFSMaxBufSize - 5332 MAX_SMB2_CREATE_RESPONSE_SIZE - 5333 MAX_SMB2_CLOSE_RESPONSE_SIZE; 5334 unsigned int total_len; 5335 struct kvec *iov = rqst->rq_iov; 5336 int len, rc; 5337 5338 rc = smb2_plain_req_init(SMB2_QUERY_DIRECTORY, tcon, server, 5339 (void **) &req, &total_len); 5340 if (rc) 5341 return rc; 5342 5343 switch (info_level) { 5344 case SMB_FIND_FILE_DIRECTORY_INFO: 5345 req->FileInformationClass = FILE_DIRECTORY_INFORMATION; 5346 break; 5347 case SMB_FIND_FILE_ID_FULL_DIR_INFO: 5348 req->FileInformationClass = FILEID_FULL_DIRECTORY_INFORMATION; 5349 break; 5350 case SMB_FIND_FILE_POSIX_INFO: 5351 req->FileInformationClass = SMB_FIND_FILE_POSIX_INFO; 5352 break; 5353 case SMB_FIND_FILE_FULL_DIRECTORY_INFO: 5354 req->FileInformationClass = FILE_FULL_DIRECTORY_INFORMATION; 5355 break; 5356 default: 5357 cifs_tcon_dbg(VFS, "info level %u isn't supported\n", 5358 info_level); 5359 return -EINVAL; 5360 } 5361 5362 req->FileIndex = cpu_to_le32(index); 5363 req->PersistentFileId = persistent_fid; 5364 req->VolatileFileId = volatile_fid; 5365 5366 len = 0x2; 5367 bufptr = req->Buffer; 5368 memcpy(bufptr, &asteriks, len); 5369 5370 req->FileNameOffset = 5371 cpu_to_le16(sizeof(struct smb2_query_directory_req)); 5372 req->FileNameLength = cpu_to_le16(len); 5373 /* 5374 * BB could be 30 bytes or so longer if we used SMB2 specific 5375 * buffer lengths, but this is safe and close enough. 5376 */ 5377 output_size = min_t(unsigned int, output_size, server->maxBuf); 5378 output_size = min_t(unsigned int, output_size, 2 << 15); 5379 req->OutputBufferLength = cpu_to_le32(output_size); 5380 5381 iov[0].iov_base = (char *)req; 5382 /* 1 for Buffer */ 5383 iov[0].iov_len = total_len - 1; 5384 5385 iov[1].iov_base = (char *)(req->Buffer); 5386 iov[1].iov_len = len; 5387 5388 trace_smb3_query_dir_enter(xid, persistent_fid, tcon->tid, 5389 tcon->ses->Suid, index, output_size); 5390 5391 return 0; 5392 } 5393 5394 void SMB2_query_directory_free(struct smb_rqst *rqst) 5395 { 5396 if (rqst && rqst->rq_iov) { 5397 cifs_small_buf_release(rqst->rq_iov[0].iov_base); /* request */ 5398 } 5399 } 5400 5401 int 5402 smb2_parse_query_directory(struct cifs_tcon *tcon, 5403 struct kvec *rsp_iov, 5404 int resp_buftype, 5405 struct cifs_search_info *srch_inf) 5406 { 5407 struct smb2_query_directory_rsp *rsp; 5408 size_t info_buf_size; 5409 char *end_of_smb; 5410 int rc; 5411 5412 rsp = (struct smb2_query_directory_rsp *)rsp_iov->iov_base; 5413 5414 switch (srch_inf->info_level) { 5415 case SMB_FIND_FILE_DIRECTORY_INFO: 5416 info_buf_size = sizeof(FILE_DIRECTORY_INFO); 5417 break; 5418 case SMB_FIND_FILE_ID_FULL_DIR_INFO: 5419 info_buf_size = sizeof(SEARCH_ID_FULL_DIR_INFO); 5420 break; 5421 case SMB_FIND_FILE_POSIX_INFO: 5422 /* note that posix payload are variable size */ 5423 info_buf_size = sizeof(struct smb2_posix_info); 5424 break; 5425 case SMB_FIND_FILE_FULL_DIRECTORY_INFO: 5426 info_buf_size = sizeof(FILE_FULL_DIRECTORY_INFO); 5427 break; 5428 default: 5429 cifs_tcon_dbg(VFS, "info level %u isn't supported\n", 5430 srch_inf->info_level); 5431 return -EINVAL; 5432 } 5433 5434 rc = smb2_validate_iov(le16_to_cpu(rsp->OutputBufferOffset), 5435 le32_to_cpu(rsp->OutputBufferLength), rsp_iov, 5436 info_buf_size); 5437 if (rc) { 5438 cifs_tcon_dbg(VFS, "bad info payload"); 5439 return rc; 5440 } 5441 5442 srch_inf->unicode = true; 5443 5444 if (srch_inf->ntwrk_buf_start) { 5445 if (srch_inf->smallBuf) 5446 cifs_small_buf_release(srch_inf->ntwrk_buf_start); 5447 else 5448 cifs_buf_release(srch_inf->ntwrk_buf_start); 5449 } 5450 srch_inf->ntwrk_buf_start = (char *)rsp; 5451 srch_inf->srch_entries_start = srch_inf->last_entry = 5452 (char *)rsp + le16_to_cpu(rsp->OutputBufferOffset); 5453 end_of_smb = rsp_iov->iov_len + (char *)rsp; 5454 5455 srch_inf->entries_in_buffer = num_entries( 5456 srch_inf->info_level, 5457 srch_inf->srch_entries_start, 5458 end_of_smb, 5459 &srch_inf->last_entry, 5460 info_buf_size); 5461 5462 srch_inf->index_of_last_entry += srch_inf->entries_in_buffer; 5463 cifs_dbg(FYI, "num entries %d last_index %lld srch start %p srch end %p\n", 5464 srch_inf->entries_in_buffer, srch_inf->index_of_last_entry, 5465 srch_inf->srch_entries_start, srch_inf->last_entry); 5466 if (resp_buftype == CIFS_LARGE_BUFFER) 5467 srch_inf->smallBuf = false; 5468 else if (resp_buftype == CIFS_SMALL_BUFFER) 5469 srch_inf->smallBuf = true; 5470 else 5471 cifs_tcon_dbg(VFS, "Invalid search buffer type\n"); 5472 5473 return 0; 5474 } 5475 5476 int 5477 SMB2_query_directory(const unsigned int xid, struct cifs_tcon *tcon, 5478 u64 persistent_fid, u64 volatile_fid, int index, 5479 struct cifs_search_info *srch_inf) 5480 { 5481 struct smb_rqst rqst; 5482 struct kvec iov[SMB2_QUERY_DIRECTORY_IOV_SIZE]; 5483 struct smb2_query_directory_rsp *rsp = NULL; 5484 int resp_buftype = CIFS_NO_BUFFER; 5485 struct kvec rsp_iov; 5486 int rc = 0; 5487 struct cifs_ses *ses = tcon->ses; 5488 struct TCP_Server_Info *server; 5489 int flags = 0; 5490 int retries = 0, cur_sleep = 1; 5491 5492 replay_again: 5493 /* reinitialize for possible replay */ 5494 flags = 0; 5495 server = cifs_pick_channel(ses); 5496 5497 if (!ses || !(ses->server)) 5498 return -EIO; 5499 5500 if (smb3_encryption_required(tcon)) 5501 flags |= CIFS_TRANSFORM_REQ; 5502 5503 memset(&rqst, 0, sizeof(struct smb_rqst)); 5504 memset(&iov, 0, sizeof(iov)); 5505 rqst.rq_iov = iov; 5506 rqst.rq_nvec = SMB2_QUERY_DIRECTORY_IOV_SIZE; 5507 5508 rc = SMB2_query_directory_init(xid, tcon, server, 5509 &rqst, persistent_fid, 5510 volatile_fid, index, 5511 srch_inf->info_level); 5512 if (rc) 5513 goto qdir_exit; 5514 5515 if (retries) 5516 smb2_set_replay(server, &rqst); 5517 5518 rc = cifs_send_recv(xid, ses, server, 5519 &rqst, &resp_buftype, flags, &rsp_iov); 5520 rsp = (struct smb2_query_directory_rsp *)rsp_iov.iov_base; 5521 5522 if (rc) { 5523 if (rc == -ENODATA && 5524 rsp->hdr.Status == STATUS_NO_MORE_FILES) { 5525 trace_smb3_query_dir_done(xid, persistent_fid, 5526 tcon->tid, tcon->ses->Suid, index, 0); 5527 srch_inf->endOfSearch = true; 5528 rc = 0; 5529 } else { 5530 trace_smb3_query_dir_err(xid, persistent_fid, tcon->tid, 5531 tcon->ses->Suid, index, 0, rc); 5532 cifs_stats_fail_inc(tcon, SMB2_QUERY_DIRECTORY_HE); 5533 } 5534 goto qdir_exit; 5535 } 5536 5537 rc = smb2_parse_query_directory(tcon, &rsp_iov, resp_buftype, 5538 srch_inf); 5539 if (rc) { 5540 trace_smb3_query_dir_err(xid, persistent_fid, tcon->tid, 5541 tcon->ses->Suid, index, 0, rc); 5542 goto qdir_exit; 5543 } 5544 resp_buftype = CIFS_NO_BUFFER; 5545 5546 trace_smb3_query_dir_done(xid, persistent_fid, tcon->tid, 5547 tcon->ses->Suid, index, srch_inf->entries_in_buffer); 5548 5549 qdir_exit: 5550 SMB2_query_directory_free(&rqst); 5551 free_rsp_buf(resp_buftype, rsp); 5552 5553 if (is_replayable_error(rc) && 5554 smb2_should_replay(tcon, &retries, &cur_sleep)) 5555 goto replay_again; 5556 5557 return rc; 5558 } 5559 5560 int 5561 SMB2_set_info_init(struct cifs_tcon *tcon, struct TCP_Server_Info *server, 5562 struct smb_rqst *rqst, 5563 u64 persistent_fid, u64 volatile_fid, u32 pid, 5564 u8 info_class, u8 info_type, u32 additional_info, 5565 void **data, unsigned int *size) 5566 { 5567 struct smb2_set_info_req *req; 5568 struct kvec *iov = rqst->rq_iov; 5569 unsigned int i, total_len; 5570 int rc; 5571 5572 rc = smb2_plain_req_init(SMB2_SET_INFO, tcon, server, 5573 (void **) &req, &total_len); 5574 if (rc) 5575 return rc; 5576 5577 req->hdr.Id.SyncId.ProcessId = cpu_to_le32(pid); 5578 req->InfoType = info_type; 5579 req->FileInfoClass = info_class; 5580 req->PersistentFileId = persistent_fid; 5581 req->VolatileFileId = volatile_fid; 5582 req->AdditionalInformation = cpu_to_le32(additional_info); 5583 5584 req->BufferOffset = cpu_to_le16(sizeof(struct smb2_set_info_req)); 5585 req->BufferLength = cpu_to_le32(*size); 5586 5587 memcpy(req->Buffer, *data, *size); 5588 total_len += *size; 5589 5590 iov[0].iov_base = (char *)req; 5591 /* 1 for Buffer */ 5592 iov[0].iov_len = total_len - 1; 5593 5594 for (i = 1; i < rqst->rq_nvec; i++) { 5595 le32_add_cpu(&req->BufferLength, size[i]); 5596 iov[i].iov_base = (char *)data[i]; 5597 iov[i].iov_len = size[i]; 5598 } 5599 5600 return 0; 5601 } 5602 5603 void 5604 SMB2_set_info_free(struct smb_rqst *rqst) 5605 { 5606 if (rqst && rqst->rq_iov) 5607 cifs_buf_release(rqst->rq_iov[0].iov_base); /* request */ 5608 } 5609 5610 static int 5611 send_set_info(const unsigned int xid, struct cifs_tcon *tcon, 5612 u64 persistent_fid, u64 volatile_fid, u32 pid, u8 info_class, 5613 u8 info_type, u32 additional_info, unsigned int num, 5614 void **data, unsigned int *size) 5615 { 5616 struct smb_rqst rqst; 5617 struct smb2_set_info_rsp *rsp = NULL; 5618 struct kvec *iov; 5619 struct kvec rsp_iov; 5620 int rc = 0; 5621 int resp_buftype; 5622 struct cifs_ses *ses = tcon->ses; 5623 struct TCP_Server_Info *server; 5624 int flags = 0; 5625 int retries = 0, cur_sleep = 1; 5626 5627 replay_again: 5628 /* reinitialize for possible replay */ 5629 flags = 0; 5630 server = cifs_pick_channel(ses); 5631 5632 if (!ses || !server) 5633 return -EIO; 5634 5635 if (!num) 5636 return -EINVAL; 5637 5638 if (smb3_encryption_required(tcon)) 5639 flags |= CIFS_TRANSFORM_REQ; 5640 5641 iov = kmalloc_array(num, sizeof(struct kvec), GFP_KERNEL); 5642 if (!iov) 5643 return -ENOMEM; 5644 5645 memset(&rqst, 0, sizeof(struct smb_rqst)); 5646 rqst.rq_iov = iov; 5647 rqst.rq_nvec = num; 5648 5649 rc = SMB2_set_info_init(tcon, server, 5650 &rqst, persistent_fid, volatile_fid, pid, 5651 info_class, info_type, additional_info, 5652 data, size); 5653 if (rc) { 5654 kfree(iov); 5655 return rc; 5656 } 5657 5658 if (retries) 5659 smb2_set_replay(server, &rqst); 5660 5661 rc = cifs_send_recv(xid, ses, server, 5662 &rqst, &resp_buftype, flags, 5663 &rsp_iov); 5664 SMB2_set_info_free(&rqst); 5665 rsp = (struct smb2_set_info_rsp *)rsp_iov.iov_base; 5666 5667 if (rc != 0) { 5668 cifs_stats_fail_inc(tcon, SMB2_SET_INFO_HE); 5669 trace_smb3_set_info_err(xid, persistent_fid, tcon->tid, 5670 ses->Suid, info_class, (__u32)info_type, rc); 5671 } 5672 5673 free_rsp_buf(resp_buftype, rsp); 5674 kfree(iov); 5675 5676 if (is_replayable_error(rc) && 5677 smb2_should_replay(tcon, &retries, &cur_sleep)) 5678 goto replay_again; 5679 5680 return rc; 5681 } 5682 5683 int 5684 SMB2_set_eof(const unsigned int xid, struct cifs_tcon *tcon, u64 persistent_fid, 5685 u64 volatile_fid, u32 pid, loff_t new_eof) 5686 { 5687 struct smb2_file_eof_info info; 5688 void *data; 5689 unsigned int size; 5690 5691 info.EndOfFile = cpu_to_le64(new_eof); 5692 5693 data = &info; 5694 size = sizeof(struct smb2_file_eof_info); 5695 5696 trace_smb3_set_eof(xid, persistent_fid, tcon->tid, tcon->ses->Suid, new_eof); 5697 5698 return send_set_info(xid, tcon, persistent_fid, volatile_fid, 5699 pid, FILE_END_OF_FILE_INFORMATION, SMB2_O_INFO_FILE, 5700 0, 1, &data, &size); 5701 } 5702 5703 int 5704 SMB2_set_acl(const unsigned int xid, struct cifs_tcon *tcon, 5705 u64 persistent_fid, u64 volatile_fid, 5706 struct smb_ntsd *pnntsd, int pacllen, int aclflag) 5707 { 5708 return send_set_info(xid, tcon, persistent_fid, volatile_fid, 5709 current->tgid, 0, SMB2_O_INFO_SECURITY, aclflag, 5710 1, (void **)&pnntsd, &pacllen); 5711 } 5712 5713 int 5714 SMB2_set_ea(const unsigned int xid, struct cifs_tcon *tcon, 5715 u64 persistent_fid, u64 volatile_fid, 5716 struct smb2_file_full_ea_info *buf, int len) 5717 { 5718 return send_set_info(xid, tcon, persistent_fid, volatile_fid, 5719 current->tgid, FILE_FULL_EA_INFORMATION, SMB2_O_INFO_FILE, 5720 0, 1, (void **)&buf, &len); 5721 } 5722 5723 int 5724 SMB2_oplock_break(const unsigned int xid, struct cifs_tcon *tcon, 5725 const u64 persistent_fid, const u64 volatile_fid, 5726 __u8 oplock_level) 5727 { 5728 struct smb_rqst rqst; 5729 int rc; 5730 struct smb2_oplock_break *req = NULL; 5731 struct cifs_ses *ses = tcon->ses; 5732 struct TCP_Server_Info *server; 5733 int flags = CIFS_OBREAK_OP; 5734 unsigned int total_len; 5735 struct kvec iov[1]; 5736 struct kvec rsp_iov; 5737 int resp_buf_type; 5738 int retries = 0, cur_sleep = 1; 5739 5740 replay_again: 5741 /* reinitialize for possible replay */ 5742 flags = CIFS_OBREAK_OP; 5743 server = cifs_pick_channel(ses); 5744 5745 cifs_dbg(FYI, "SMB2_oplock_break\n"); 5746 rc = smb2_plain_req_init(SMB2_OPLOCK_BREAK, tcon, server, 5747 (void **) &req, &total_len); 5748 if (rc) 5749 return rc; 5750 5751 if (smb3_encryption_required(tcon)) 5752 flags |= CIFS_TRANSFORM_REQ; 5753 5754 req->VolatileFid = volatile_fid; 5755 req->PersistentFid = persistent_fid; 5756 req->OplockLevel = oplock_level; 5757 req->hdr.CreditRequest = cpu_to_le16(1); 5758 5759 flags |= CIFS_NO_RSP_BUF; 5760 5761 iov[0].iov_base = (char *)req; 5762 iov[0].iov_len = total_len; 5763 5764 memset(&rqst, 0, sizeof(struct smb_rqst)); 5765 rqst.rq_iov = iov; 5766 rqst.rq_nvec = 1; 5767 5768 if (retries) 5769 smb2_set_replay(server, &rqst); 5770 5771 rc = cifs_send_recv(xid, ses, server, 5772 &rqst, &resp_buf_type, flags, &rsp_iov); 5773 cifs_small_buf_release(req); 5774 if (rc) { 5775 cifs_stats_fail_inc(tcon, SMB2_OPLOCK_BREAK_HE); 5776 cifs_dbg(FYI, "Send error in Oplock Break = %d\n", rc); 5777 } 5778 5779 if (is_replayable_error(rc) && 5780 smb2_should_replay(tcon, &retries, &cur_sleep)) 5781 goto replay_again; 5782 5783 return rc; 5784 } 5785 5786 void 5787 smb2_copy_fs_info_to_kstatfs(struct smb2_fs_full_size_info *pfs_inf, 5788 struct kstatfs *kst) 5789 { 5790 kst->f_bsize = le32_to_cpu(pfs_inf->BytesPerSector) * 5791 le32_to_cpu(pfs_inf->SectorsPerAllocationUnit); 5792 kst->f_blocks = le64_to_cpu(pfs_inf->TotalAllocationUnits); 5793 kst->f_bfree = kst->f_bavail = 5794 le64_to_cpu(pfs_inf->CallerAvailableAllocationUnits); 5795 return; 5796 } 5797 5798 static void 5799 copy_posix_fs_info_to_kstatfs(FILE_SYSTEM_POSIX_INFO *response_data, 5800 struct kstatfs *kst) 5801 { 5802 kst->f_bsize = le32_to_cpu(response_data->BlockSize); 5803 kst->f_blocks = le64_to_cpu(response_data->TotalBlocks); 5804 kst->f_bfree = le64_to_cpu(response_data->BlocksAvail); 5805 if (response_data->UserBlocksAvail == cpu_to_le64(-1)) 5806 kst->f_bavail = kst->f_bfree; 5807 else 5808 kst->f_bavail = le64_to_cpu(response_data->UserBlocksAvail); 5809 if (response_data->TotalFileNodes != cpu_to_le64(-1)) 5810 kst->f_files = le64_to_cpu(response_data->TotalFileNodes); 5811 if (response_data->FreeFileNodes != cpu_to_le64(-1)) 5812 kst->f_ffree = le64_to_cpu(response_data->FreeFileNodes); 5813 5814 return; 5815 } 5816 5817 static int 5818 build_qfs_info_req(struct kvec *iov, struct cifs_tcon *tcon, 5819 struct TCP_Server_Info *server, 5820 int level, int outbuf_len, u64 persistent_fid, 5821 u64 volatile_fid) 5822 { 5823 int rc; 5824 struct smb2_query_info_req *req; 5825 unsigned int total_len; 5826 5827 cifs_dbg(FYI, "Query FSInfo level %d\n", level); 5828 5829 if ((tcon->ses == NULL) || server == NULL) 5830 return -EIO; 5831 5832 rc = smb2_plain_req_init(SMB2_QUERY_INFO, tcon, server, 5833 (void **) &req, &total_len); 5834 if (rc) 5835 return rc; 5836 5837 req->InfoType = SMB2_O_INFO_FILESYSTEM; 5838 req->FileInfoClass = level; 5839 req->PersistentFileId = persistent_fid; 5840 req->VolatileFileId = volatile_fid; 5841 /* 1 for pad */ 5842 req->InputBufferOffset = 5843 cpu_to_le16(sizeof(struct smb2_query_info_req)); 5844 req->OutputBufferLength = cpu_to_le32( 5845 outbuf_len + sizeof(struct smb2_query_info_rsp)); 5846 5847 iov->iov_base = (char *)req; 5848 iov->iov_len = total_len; 5849 return 0; 5850 } 5851 5852 static inline void free_qfs_info_req(struct kvec *iov) 5853 { 5854 cifs_buf_release(iov->iov_base); 5855 } 5856 5857 int 5858 SMB311_posix_qfs_info(const unsigned int xid, struct cifs_tcon *tcon, 5859 u64 persistent_fid, u64 volatile_fid, struct kstatfs *fsdata) 5860 { 5861 struct smb_rqst rqst; 5862 struct smb2_query_info_rsp *rsp = NULL; 5863 struct kvec iov; 5864 struct kvec rsp_iov; 5865 int rc = 0; 5866 int resp_buftype; 5867 struct cifs_ses *ses = tcon->ses; 5868 struct TCP_Server_Info *server; 5869 FILE_SYSTEM_POSIX_INFO *info = NULL; 5870 int flags = 0; 5871 int retries = 0, cur_sleep = 1; 5872 5873 replay_again: 5874 /* reinitialize for possible replay */ 5875 flags = 0; 5876 server = cifs_pick_channel(ses); 5877 5878 rc = build_qfs_info_req(&iov, tcon, server, 5879 FS_POSIX_INFORMATION, 5880 sizeof(FILE_SYSTEM_POSIX_INFO), 5881 persistent_fid, volatile_fid); 5882 if (rc) 5883 return rc; 5884 5885 if (smb3_encryption_required(tcon)) 5886 flags |= CIFS_TRANSFORM_REQ; 5887 5888 memset(&rqst, 0, sizeof(struct smb_rqst)); 5889 rqst.rq_iov = &iov; 5890 rqst.rq_nvec = 1; 5891 5892 if (retries) 5893 smb2_set_replay(server, &rqst); 5894 5895 rc = cifs_send_recv(xid, ses, server, 5896 &rqst, &resp_buftype, flags, &rsp_iov); 5897 free_qfs_info_req(&iov); 5898 if (rc) { 5899 cifs_stats_fail_inc(tcon, SMB2_QUERY_INFO_HE); 5900 goto posix_qfsinf_exit; 5901 } 5902 rsp = (struct smb2_query_info_rsp *)rsp_iov.iov_base; 5903 5904 info = (FILE_SYSTEM_POSIX_INFO *)( 5905 le16_to_cpu(rsp->OutputBufferOffset) + (char *)rsp); 5906 rc = smb2_validate_iov(le16_to_cpu(rsp->OutputBufferOffset), 5907 le32_to_cpu(rsp->OutputBufferLength), &rsp_iov, 5908 sizeof(FILE_SYSTEM_POSIX_INFO)); 5909 if (!rc) 5910 copy_posix_fs_info_to_kstatfs(info, fsdata); 5911 5912 posix_qfsinf_exit: 5913 free_rsp_buf(resp_buftype, rsp_iov.iov_base); 5914 5915 if (is_replayable_error(rc) && 5916 smb2_should_replay(tcon, &retries, &cur_sleep)) 5917 goto replay_again; 5918 5919 return rc; 5920 } 5921 5922 int 5923 SMB2_QFS_info(const unsigned int xid, struct cifs_tcon *tcon, 5924 u64 persistent_fid, u64 volatile_fid, struct kstatfs *fsdata) 5925 { 5926 struct smb_rqst rqst; 5927 struct smb2_query_info_rsp *rsp = NULL; 5928 struct kvec iov; 5929 struct kvec rsp_iov; 5930 int rc = 0; 5931 int resp_buftype; 5932 struct cifs_ses *ses = tcon->ses; 5933 struct TCP_Server_Info *server; 5934 struct smb2_fs_full_size_info *info = NULL; 5935 int flags = 0; 5936 int retries = 0, cur_sleep = 1; 5937 5938 replay_again: 5939 /* reinitialize for possible replay */ 5940 flags = 0; 5941 server = cifs_pick_channel(ses); 5942 5943 rc = build_qfs_info_req(&iov, tcon, server, 5944 FS_FULL_SIZE_INFORMATION, 5945 sizeof(struct smb2_fs_full_size_info), 5946 persistent_fid, volatile_fid); 5947 if (rc) 5948 return rc; 5949 5950 if (smb3_encryption_required(tcon)) 5951 flags |= CIFS_TRANSFORM_REQ; 5952 5953 memset(&rqst, 0, sizeof(struct smb_rqst)); 5954 rqst.rq_iov = &iov; 5955 rqst.rq_nvec = 1; 5956 5957 if (retries) 5958 smb2_set_replay(server, &rqst); 5959 5960 rc = cifs_send_recv(xid, ses, server, 5961 &rqst, &resp_buftype, flags, &rsp_iov); 5962 free_qfs_info_req(&iov); 5963 if (rc) { 5964 cifs_stats_fail_inc(tcon, SMB2_QUERY_INFO_HE); 5965 goto qfsinf_exit; 5966 } 5967 rsp = (struct smb2_query_info_rsp *)rsp_iov.iov_base; 5968 5969 info = (struct smb2_fs_full_size_info *)( 5970 le16_to_cpu(rsp->OutputBufferOffset) + (char *)rsp); 5971 rc = smb2_validate_iov(le16_to_cpu(rsp->OutputBufferOffset), 5972 le32_to_cpu(rsp->OutputBufferLength), &rsp_iov, 5973 sizeof(struct smb2_fs_full_size_info)); 5974 if (!rc) 5975 smb2_copy_fs_info_to_kstatfs(info, fsdata); 5976 5977 qfsinf_exit: 5978 free_rsp_buf(resp_buftype, rsp_iov.iov_base); 5979 5980 if (is_replayable_error(rc) && 5981 smb2_should_replay(tcon, &retries, &cur_sleep)) 5982 goto replay_again; 5983 5984 return rc; 5985 } 5986 5987 int 5988 SMB2_QFS_attr(const unsigned int xid, struct cifs_tcon *tcon, 5989 u64 persistent_fid, u64 volatile_fid, int level) 5990 { 5991 struct smb_rqst rqst; 5992 struct smb2_query_info_rsp *rsp = NULL; 5993 struct kvec iov; 5994 struct kvec rsp_iov; 5995 int rc = 0; 5996 int resp_buftype, max_len, min_len; 5997 struct cifs_ses *ses = tcon->ses; 5998 struct TCP_Server_Info *server; 5999 unsigned int rsp_len, offset; 6000 int flags = 0; 6001 int retries = 0, cur_sleep = 1; 6002 6003 replay_again: 6004 /* reinitialize for possible replay */ 6005 flags = 0; 6006 server = cifs_pick_channel(ses); 6007 6008 if (level == FS_DEVICE_INFORMATION) { 6009 max_len = sizeof(FILE_SYSTEM_DEVICE_INFO); 6010 min_len = sizeof(FILE_SYSTEM_DEVICE_INFO); 6011 } else if (level == FS_ATTRIBUTE_INFORMATION) { 6012 max_len = sizeof(FILE_SYSTEM_ATTRIBUTE_INFO); 6013 min_len = MIN_FS_ATTR_INFO_SIZE; 6014 } else if (level == FS_SECTOR_SIZE_INFORMATION) { 6015 max_len = sizeof(struct smb3_fs_ss_info); 6016 min_len = sizeof(struct smb3_fs_ss_info); 6017 } else if (level == FS_VOLUME_INFORMATION) { 6018 max_len = sizeof(struct smb3_fs_vol_info) + MAX_VOL_LABEL_LEN; 6019 min_len = sizeof(struct smb3_fs_vol_info); 6020 } else { 6021 cifs_dbg(FYI, "Invalid qfsinfo level %d\n", level); 6022 return -EINVAL; 6023 } 6024 6025 rc = build_qfs_info_req(&iov, tcon, server, 6026 level, max_len, 6027 persistent_fid, volatile_fid); 6028 if (rc) 6029 return rc; 6030 6031 if (smb3_encryption_required(tcon)) 6032 flags |= CIFS_TRANSFORM_REQ; 6033 6034 memset(&rqst, 0, sizeof(struct smb_rqst)); 6035 rqst.rq_iov = &iov; 6036 rqst.rq_nvec = 1; 6037 6038 if (retries) 6039 smb2_set_replay(server, &rqst); 6040 6041 rc = cifs_send_recv(xid, ses, server, 6042 &rqst, &resp_buftype, flags, &rsp_iov); 6043 free_qfs_info_req(&iov); 6044 if (rc) { 6045 cifs_stats_fail_inc(tcon, SMB2_QUERY_INFO_HE); 6046 goto qfsattr_exit; 6047 } 6048 rsp = (struct smb2_query_info_rsp *)rsp_iov.iov_base; 6049 6050 rsp_len = le32_to_cpu(rsp->OutputBufferLength); 6051 offset = le16_to_cpu(rsp->OutputBufferOffset); 6052 rc = smb2_validate_iov(offset, rsp_len, &rsp_iov, min_len); 6053 if (rc) 6054 goto qfsattr_exit; 6055 6056 if (level == FS_ATTRIBUTE_INFORMATION) 6057 memcpy(&tcon->fsAttrInfo, offset 6058 + (char *)rsp, min_t(unsigned int, 6059 rsp_len, max_len)); 6060 else if (level == FS_DEVICE_INFORMATION) 6061 memcpy(&tcon->fsDevInfo, offset 6062 + (char *)rsp, sizeof(FILE_SYSTEM_DEVICE_INFO)); 6063 else if (level == FS_SECTOR_SIZE_INFORMATION) { 6064 struct smb3_fs_ss_info *ss_info = (struct smb3_fs_ss_info *) 6065 (offset + (char *)rsp); 6066 tcon->ss_flags = le32_to_cpu(ss_info->Flags); 6067 tcon->perf_sector_size = 6068 le32_to_cpu(ss_info->PhysicalBytesPerSectorForPerf); 6069 } else if (level == FS_VOLUME_INFORMATION) { 6070 struct smb3_fs_vol_info *vol_info = (struct smb3_fs_vol_info *) 6071 (offset + (char *)rsp); 6072 tcon->vol_serial_number = vol_info->VolumeSerialNumber; 6073 tcon->vol_create_time = vol_info->VolumeCreationTime; 6074 } 6075 6076 qfsattr_exit: 6077 free_rsp_buf(resp_buftype, rsp_iov.iov_base); 6078 6079 if (is_replayable_error(rc) && 6080 smb2_should_replay(tcon, &retries, &cur_sleep)) 6081 goto replay_again; 6082 6083 return rc; 6084 } 6085 6086 int 6087 smb2_lockv(const unsigned int xid, struct cifs_tcon *tcon, 6088 const __u64 persist_fid, const __u64 volatile_fid, const __u32 pid, 6089 const __u32 num_lock, struct smb2_lock_element *buf) 6090 { 6091 struct smb_rqst rqst; 6092 int rc = 0; 6093 struct smb2_lock_req *req = NULL; 6094 struct kvec iov[2]; 6095 struct kvec rsp_iov; 6096 int resp_buf_type; 6097 unsigned int count; 6098 int flags = CIFS_NO_RSP_BUF; 6099 unsigned int total_len; 6100 struct TCP_Server_Info *server; 6101 int retries = 0, cur_sleep = 1; 6102 6103 replay_again: 6104 /* reinitialize for possible replay */ 6105 flags = CIFS_NO_RSP_BUF; 6106 server = cifs_pick_channel(tcon->ses); 6107 6108 cifs_dbg(FYI, "smb2_lockv num lock %d\n", num_lock); 6109 6110 rc = smb2_plain_req_init(SMB2_LOCK, tcon, server, 6111 (void **) &req, &total_len); 6112 if (rc) 6113 return rc; 6114 6115 if (smb3_encryption_required(tcon)) 6116 flags |= CIFS_TRANSFORM_REQ; 6117 6118 req->hdr.Id.SyncId.ProcessId = cpu_to_le32(pid); 6119 req->LockCount = cpu_to_le16(num_lock); 6120 6121 req->PersistentFileId = persist_fid; 6122 req->VolatileFileId = volatile_fid; 6123 6124 count = num_lock * sizeof(struct smb2_lock_element); 6125 6126 iov[0].iov_base = (char *)req; 6127 iov[0].iov_len = total_len - sizeof(struct smb2_lock_element); 6128 iov[1].iov_base = (char *)buf; 6129 iov[1].iov_len = count; 6130 6131 cifs_stats_inc(&tcon->stats.cifs_stats.num_locks); 6132 6133 memset(&rqst, 0, sizeof(struct smb_rqst)); 6134 rqst.rq_iov = iov; 6135 rqst.rq_nvec = 2; 6136 6137 if (retries) 6138 smb2_set_replay(server, &rqst); 6139 6140 rc = cifs_send_recv(xid, tcon->ses, server, 6141 &rqst, &resp_buf_type, flags, 6142 &rsp_iov); 6143 cifs_small_buf_release(req); 6144 if (rc) { 6145 cifs_dbg(FYI, "Send error in smb2_lockv = %d\n", rc); 6146 cifs_stats_fail_inc(tcon, SMB2_LOCK_HE); 6147 trace_smb3_lock_err(xid, persist_fid, tcon->tid, 6148 tcon->ses->Suid, rc); 6149 } 6150 6151 if (is_replayable_error(rc) && 6152 smb2_should_replay(tcon, &retries, &cur_sleep)) 6153 goto replay_again; 6154 6155 return rc; 6156 } 6157 6158 int 6159 SMB2_lock(const unsigned int xid, struct cifs_tcon *tcon, 6160 const __u64 persist_fid, const __u64 volatile_fid, const __u32 pid, 6161 const __u64 length, const __u64 offset, const __u32 lock_flags, 6162 const bool wait) 6163 { 6164 struct smb2_lock_element lock; 6165 6166 lock.Offset = cpu_to_le64(offset); 6167 lock.Length = cpu_to_le64(length); 6168 lock.Flags = cpu_to_le32(lock_flags); 6169 if (!wait && lock_flags != SMB2_LOCKFLAG_UNLOCK) 6170 lock.Flags |= cpu_to_le32(SMB2_LOCKFLAG_FAIL_IMMEDIATELY); 6171 6172 return smb2_lockv(xid, tcon, persist_fid, volatile_fid, pid, 1, &lock); 6173 } 6174 6175 int 6176 SMB2_lease_break(const unsigned int xid, struct cifs_tcon *tcon, 6177 __u8 *lease_key, const __le32 lease_state) 6178 { 6179 struct smb_rqst rqst; 6180 int rc; 6181 struct smb2_lease_ack *req = NULL; 6182 struct cifs_ses *ses = tcon->ses; 6183 int flags = CIFS_OBREAK_OP; 6184 unsigned int total_len; 6185 struct kvec iov[1]; 6186 struct kvec rsp_iov; 6187 int resp_buf_type; 6188 __u64 *please_key_high; 6189 __u64 *please_key_low; 6190 struct TCP_Server_Info *server = cifs_pick_channel(tcon->ses); 6191 6192 cifs_dbg(FYI, "SMB2_lease_break\n"); 6193 rc = smb2_plain_req_init(SMB2_OPLOCK_BREAK, tcon, server, 6194 (void **) &req, &total_len); 6195 if (rc) 6196 return rc; 6197 6198 if (smb3_encryption_required(tcon)) 6199 flags |= CIFS_TRANSFORM_REQ; 6200 6201 req->hdr.CreditRequest = cpu_to_le16(1); 6202 req->StructureSize = cpu_to_le16(36); 6203 total_len += 12; 6204 6205 memcpy(req->LeaseKey, lease_key, SMB2_LEASE_KEY_SIZE); 6206 req->LeaseState = lease_state; 6207 6208 flags |= CIFS_NO_RSP_BUF; 6209 6210 iov[0].iov_base = (char *)req; 6211 iov[0].iov_len = total_len; 6212 6213 memset(&rqst, 0, sizeof(struct smb_rqst)); 6214 rqst.rq_iov = iov; 6215 rqst.rq_nvec = 1; 6216 6217 rc = cifs_send_recv(xid, ses, server, 6218 &rqst, &resp_buf_type, flags, &rsp_iov); 6219 cifs_small_buf_release(req); 6220 6221 please_key_low = (__u64 *)lease_key; 6222 please_key_high = (__u64 *)(lease_key+8); 6223 if (rc) { 6224 cifs_stats_fail_inc(tcon, SMB2_OPLOCK_BREAK_HE); 6225 trace_smb3_lease_err(le32_to_cpu(lease_state), tcon->tid, 6226 ses->Suid, *please_key_low, *please_key_high, rc); 6227 cifs_dbg(FYI, "Send error in Lease Break = %d\n", rc); 6228 } else 6229 trace_smb3_lease_done(le32_to_cpu(lease_state), tcon->tid, 6230 ses->Suid, *please_key_low, *please_key_high); 6231 6232 return rc; 6233 } 6234