1 // SPDX-License-Identifier: GPL-2.0-or-later 2 /* 3 * Copyright (C) 2016 Namjae Jeon <namjae.jeon@protocolfreedom.org> 4 * Copyright (C) 2018 Samsung Electronics Co., Ltd. 5 */ 6 7 #include <linux/mutex.h> 8 #include <linux/freezer.h> 9 #include <linux/module.h> 10 11 #include "server.h" 12 #include "smb_common.h" 13 #include "mgmt/ksmbd_ida.h" 14 #include "mgmt/user_session.h" 15 #include "connection.h" 16 #include "compress.h" 17 #include "transport_tcp.h" 18 #include "transport_rdma.h" 19 #include "misc.h" 20 21 static DEFINE_MUTEX(init_lock); 22 23 static struct ksmbd_conn_ops default_conn_ops; 24 25 DEFINE_HASHTABLE(conn_list, CONN_HASH_BITS); 26 DECLARE_RWSEM(conn_list_lock); 27 28 #ifdef CONFIG_PROC_FS 29 static struct proc_dir_entry *proc_clients; 30 31 static const char *ksmbd_conn_state_string(struct ksmbd_conn *conn) 32 { 33 switch (READ_ONCE(conn->status)) { 34 case KSMBD_SESS_NEW: 35 return "new"; 36 case KSMBD_SESS_GOOD: 37 return "good"; 38 case KSMBD_SESS_EXITING: 39 return "exiting"; 40 case KSMBD_SESS_NEED_RECONNECT: 41 return "reconnect"; 42 case KSMBD_SESS_NEED_NEGOTIATE: 43 return "negotiate"; 44 case KSMBD_SESS_NEED_SETUP: 45 return "setup"; 46 case KSMBD_SESS_RELEASING: 47 return "releasing"; 48 default: 49 return "unknown"; 50 } 51 } 52 53 static const char *ksmbd_conn_transport_string(struct ksmbd_conn *conn) 54 { 55 if (conn->transport->ops->rdma_read || conn->transport->ops->rdma_write) 56 return "smbdirect"; 57 return "tcp"; 58 } 59 60 static void proc_show_conn_feature(struct seq_file *m, bool *separator, 61 bool enabled, const char *name) 62 { 63 if (!enabled) 64 return; 65 seq_printf(m, "%s%s", *separator ? "," : "", name); 66 *separator = true; 67 } 68 69 static void proc_show_conn_features(struct seq_file *m, 70 struct ksmbd_conn *conn) 71 { 72 bool separator = false; 73 74 proc_show_conn_feature(m, &separator, 75 conn->sign || conn->signing_negotiated, "sign"); 76 proc_show_conn_feature(m, &separator, conn->cipher_type, "encrypt"); 77 proc_show_conn_feature(m, &separator, 78 conn->compress_algorithm != SMB3_COMPRESS_NONE, 79 "compress"); 80 proc_show_conn_feature(m, &separator, conn->rdma_transform_ids, 81 "rdma-transform"); 82 proc_show_conn_feature(m, &separator, conn->posix_ext_supported, "posix"); 83 if (!separator) 84 seq_puts(m, "none"); 85 } 86 87 static int proc_show_clients(struct seq_file *m, void *v) 88 { 89 struct ksmbd_conn *conn; 90 struct timespec64 now, t; 91 int i; 92 93 down_read(&conn_list_lock); 94 hash_for_each(conn_list, i, conn, hlist) { 95 unsigned int outstanding_credits, total_credits; 96 unsigned long id; 97 void *entry; 98 unsigned int sessions = 0; 99 100 jiffies_to_timespec64(jiffies - conn->last_active, &t); 101 ktime_get_real_ts64(&now); 102 t = timespec64_sub(now, t); 103 104 spin_lock(&conn->credits_lock); 105 outstanding_credits = conn->outstanding_credits; 106 total_credits = conn->total_credits; 107 spin_unlock(&conn->credits_lock); 108 109 rcu_read_lock(); 110 xa_for_each(&conn->sessions, id, entry) 111 sessions++; 112 rcu_read_unlock(); 113 #if IS_ENABLED(CONFIG_IPV6) 114 if (!conn->inet_addr) 115 seq_printf(m, "client:\t%pI6c\n", &conn->inet6_addr); 116 else 117 #endif 118 seq_printf(m, "client:\t%pI4\n", &conn->inet_addr); 119 seq_printf(m, "transport:\t%s\n", ksmbd_conn_transport_string(conn)); 120 seq_printf(m, "state:\t%s\n", ksmbd_conn_state_string(conn)); 121 seq_printf(m, "dialect:\t0x%04x\n", conn->dialect); 122 seq_printf(m, "credits:\t%u/%u\n", outstanding_credits, 123 total_credits); 124 seq_printf(m, "sessions:\t%u\n", sessions); 125 seq_printf(m, "open_files:\t%d\n", 126 atomic_read(&conn->stats.open_files_count)); 127 seq_printf(m, "requests:\t%lld\n", 128 atomic64_read(&conn->stats.request_served)); 129 seq_puts(m, "features:\t"); 130 proc_show_conn_features(m, conn); 131 seq_printf(m, "\nlast_active:\t%ptT\n\n", &t); 132 } 133 up_read(&conn_list_lock); 134 return 0; 135 } 136 137 static int create_proc_clients(void) 138 { 139 proc_clients = ksmbd_proc_create("clients", 140 proc_show_clients, NULL); 141 if (!proc_clients) 142 return -ENOMEM; 143 return 0; 144 } 145 146 static void delete_proc_clients(void) 147 { 148 if (proc_clients) { 149 proc_remove(proc_clients); 150 proc_clients = NULL; 151 } 152 } 153 #else 154 static int create_proc_clients(void) { return 0; } 155 static void delete_proc_clients(void) {} 156 #endif 157 158 static struct workqueue_struct *ksmbd_conn_wq; 159 160 int ksmbd_conn_wq_init(void) 161 { 162 ksmbd_conn_wq = alloc_workqueue("ksmbd-conn-release", 163 WQ_UNBOUND | WQ_MEM_RECLAIM, 0); 164 if (!ksmbd_conn_wq) 165 return -ENOMEM; 166 return 0; 167 } 168 169 void ksmbd_conn_wq_destroy(void) 170 { 171 if (ksmbd_conn_wq) { 172 destroy_workqueue(ksmbd_conn_wq); 173 ksmbd_conn_wq = NULL; 174 } 175 } 176 177 /* 178 * __ksmbd_conn_release_work() - perform the final, once-per-struct cleanup 179 * of a ksmbd_conn whose refcount has just dropped to zero. 180 * 181 * This is the common release path used by ksmbd_conn_put() for the embedded 182 * state that outlives the connection thread: async_ida and the attached 183 * transport (which owns the socket and iov for TCP). Called from a workqueue 184 * so that sleep-allowed teardown (sock_release -> tcp_close -> 185 * lock_sock_nested) never runs from an RCU softirq callback (free_opinfo_rcu) 186 * or any other non-sleeping putter context. 187 */ 188 static void __ksmbd_conn_release_work(struct work_struct *work) 189 { 190 struct ksmbd_conn *conn = 191 container_of(work, struct ksmbd_conn, release_work); 192 193 ida_destroy(&conn->async_ida); 194 conn->transport->ops->free_transport(conn->transport); 195 kfree_sensitive(conn); 196 } 197 198 /** 199 * ksmbd_conn_get() - take a reference on @conn and return it. 200 * 201 * @conn: connection instance to get a reference to 202 * 203 * Returns @conn unchanged so callers can write 204 * "fp->conn = ksmbd_conn_get(work->conn);" in one expression. Returns NULL 205 * if @conn is NULL. 206 */ 207 struct ksmbd_conn *ksmbd_conn_get(struct ksmbd_conn *conn) 208 { 209 if (!conn) 210 return NULL; 211 212 atomic_inc(&conn->refcnt); 213 return conn; 214 } 215 216 /** 217 * ksmbd_conn_put() - drop a reference and, if it was the last, queue the 218 * release onto ksmbd_conn_wq so it runs from process context. 219 * 220 * @conn: connection instance to put a reference to 221 * 222 * Callable from any context including RCU softirq callbacks and non-sleeping 223 * locks; the actual release is deferred to the workqueue. ksmbd_conn_wq is 224 * created in ksmbd_server_init() before any conn can be allocated and is 225 * destroyed in ksmbd_server_exit() after rcu_barrier(), so it is always 226 * non-NULL while a conn reference is held. 227 */ 228 void ksmbd_conn_put(struct ksmbd_conn *conn) 229 { 230 if (!conn) 231 return; 232 233 if (atomic_dec_and_test(&conn->refcnt)) 234 queue_work(ksmbd_conn_wq, &conn->release_work); 235 } 236 237 /** 238 * ksmbd_conn_free() - free resources of the connection instance 239 * 240 * @conn: connection instance to be cleaned up 241 * 242 * During the thread termination, the corresponding conn instance 243 * resources(sock/memory) are released and finally the conn object is freed. 244 */ 245 void ksmbd_conn_free(struct ksmbd_conn *conn) 246 { 247 down_write(&conn_list_lock); 248 hash_del(&conn->hlist); 249 up_write(&conn_list_lock); 250 251 /* 252 * request_buf / preauth_info / mechToken are only ever accessed by the 253 * connection handler thread that owns @conn. ksmbd_conn_free() is 254 * called from the transport free_transport() path when that thread is 255 * exiting, so it is safe to release them unconditionally even when 256 * ksmbd_conn_put() below is not the final putter (oplock / ksmbd_file 257 * holders only retain the conn pointer, not these per-thread buffers). 258 */ 259 xa_destroy(&conn->sessions); 260 kvfree(conn->request_buf); 261 kfree_sensitive(conn->preauth_info); 262 kfree(conn->mechToken); 263 ksmbd_preauth_session_destroy(conn); 264 ksmbd_conn_put(conn); 265 } 266 267 /** 268 * ksmbd_conn_alloc() - initialize a new connection instance 269 * 270 * Return: ksmbd_conn struct on success, otherwise NULL 271 */ 272 struct ksmbd_conn *ksmbd_conn_alloc(void) 273 { 274 struct ksmbd_conn *conn; 275 276 conn = kzalloc_obj(struct ksmbd_conn, KSMBD_DEFAULT_GFP); 277 if (!conn) 278 return NULL; 279 280 conn->need_neg = true; 281 ksmbd_conn_set_new(conn); 282 conn->local_nls = load_nls("utf8"); 283 if (!conn->local_nls) 284 conn->local_nls = load_nls_default(); 285 if (IS_ENABLED(CONFIG_UNICODE)) 286 conn->um = utf8_load(UNICODE_AGE(12, 1, 0)); 287 else 288 conn->um = ERR_PTR(-EOPNOTSUPP); 289 if (IS_ERR(conn->um)) 290 conn->um = NULL; 291 INIT_WORK(&conn->release_work, __ksmbd_conn_release_work); 292 atomic_set(&conn->req_running, 0); 293 atomic_set(&conn->r_count, 0); 294 atomic_set(&conn->refcnt, 1); 295 conn->total_credits = 1; 296 conn->outstanding_credits = 0; 297 298 /* 299 * The command sequence window starts as the set { 0 } when the 300 * connection is established. 301 */ 302 conn->seq_low = 0; 303 conn->seq_high = 1; 304 __set_bit(0, conn->seq_bitmap); 305 306 init_waitqueue_head(&conn->req_running_q); 307 init_waitqueue_head(&conn->r_count_q); 308 INIT_LIST_HEAD(&conn->requests); 309 INIT_LIST_HEAD(&conn->async_requests); 310 INIT_LIST_HEAD(&conn->preauth_sess_table); 311 spin_lock_init(&conn->request_lock); 312 spin_lock_init(&conn->credits_lock); 313 ida_init(&conn->async_ida); 314 xa_init(&conn->sessions); 315 316 spin_lock_init(&conn->llist_lock); 317 INIT_LIST_HEAD(&conn->lock_list); 318 319 init_rwsem(&conn->session_lock); 320 321 return conn; 322 } 323 324 bool ksmbd_conn_lookup_dialect(struct ksmbd_conn *c) 325 { 326 struct ksmbd_conn *t; 327 int bkt; 328 bool ret = false; 329 330 down_read(&conn_list_lock); 331 hash_for_each(conn_list, bkt, t, hlist) { 332 if (memcmp(t->ClientGUID, c->ClientGUID, SMB2_CLIENT_GUID_SIZE)) 333 continue; 334 335 ret = true; 336 break; 337 } 338 up_read(&conn_list_lock); 339 return ret; 340 } 341 342 void ksmbd_conn_enqueue_request(struct ksmbd_work *work) 343 { 344 struct ksmbd_conn *conn = work->conn; 345 struct list_head *requests_queue = NULL; 346 347 if (conn->ops->get_cmd_val(work) != SMB2_CANCEL_HE) 348 requests_queue = &conn->requests; 349 350 atomic_inc(&conn->req_running); 351 if (requests_queue) { 352 spin_lock(&conn->request_lock); 353 list_add_tail(&work->request_entry, requests_queue); 354 spin_unlock(&conn->request_lock); 355 } 356 } 357 358 void ksmbd_conn_try_dequeue_request(struct ksmbd_work *work) 359 { 360 struct ksmbd_conn *conn = work->conn; 361 362 atomic_dec(&conn->req_running); 363 if (waitqueue_active(&conn->req_running_q)) 364 wake_up(&conn->req_running_q); 365 366 if (list_empty(&work->request_entry) && 367 list_empty(&work->async_request_entry)) 368 return; 369 370 spin_lock(&conn->request_lock); 371 list_del_init(&work->request_entry); 372 spin_unlock(&conn->request_lock); 373 if (work->asynchronous) 374 release_async_work(work); 375 376 wake_up_all(&conn->req_running_q); 377 } 378 379 static void ksmbd_conn_cancel_async_requests(struct ksmbd_conn *conn) 380 { 381 struct ksmbd_work *work, *tmp; 382 383 ksmbd_debug(CONN, "Cancel pending async requests on releasing connection\n"); 384 spin_lock(&conn->request_lock); 385 list_for_each_entry_safe(work, tmp, &conn->async_requests, 386 async_request_entry) { 387 if (work->state != KSMBD_WORK_ACTIVE) 388 continue; 389 390 ksmbd_debug(CONN, "Cancel async request id %d\n", 391 work->async_id); 392 work->state = KSMBD_WORK_CANCELLED; 393 if (work->cancel_fn) 394 work->cancel_fn(work->cancel_argv); 395 } 396 spin_unlock(&conn->request_lock); 397 } 398 399 void ksmbd_conn_lock(struct ksmbd_conn *conn) 400 { 401 mutex_lock(&conn->srv_mutex); 402 } 403 404 void ksmbd_conn_unlock(struct ksmbd_conn *conn) 405 { 406 mutex_unlock(&conn->srv_mutex); 407 } 408 409 static bool ksmbd_session_is_bound_to_conn(struct ksmbd_session *sess, 410 struct ksmbd_conn *conn) 411 { 412 bool found; 413 414 rcu_read_lock(); 415 found = xa_load(&conn->sessions, sess->id) == sess; 416 rcu_read_unlock(); 417 if (found) 418 return true; 419 420 down_read(&sess->chann_lock); 421 found = xa_load(&sess->ksmbd_chann_list, (long)conn); 422 up_read(&sess->chann_lock); 423 return found; 424 } 425 426 void ksmbd_all_conn_set_status(struct ksmbd_session *sess, u32 status) 427 { 428 struct ksmbd_conn *conn; 429 int bkt; 430 431 down_read(&conn_list_lock); 432 hash_for_each(conn_list, bkt, conn, hlist) { 433 if (ksmbd_session_is_bound_to_conn(sess, conn)) { 434 spin_lock(&conn->request_lock); 435 if (!ksmbd_conn_exiting(conn) && 436 !ksmbd_conn_releasing(conn)) 437 WRITE_ONCE(conn->status, status); 438 spin_unlock(&conn->request_lock); 439 } 440 } 441 up_read(&conn_list_lock); 442 } 443 444 void ksmbd_conn_abort(struct ksmbd_conn *conn) 445 { 446 bool shutdown = false; 447 448 spin_lock(&conn->request_lock); 449 if (!ksmbd_conn_exiting(conn) && !ksmbd_conn_releasing(conn)) { 450 ksmbd_conn_set_exiting(conn); 451 shutdown = true; 452 } 453 spin_unlock(&conn->request_lock); 454 wake_up_all(&conn->req_running_q); 455 456 if (shutdown && conn->transport->ops->shutdown) 457 conn->transport->ops->shutdown(conn->transport); 458 } 459 460 void ksmbd_conn_wait_idle(struct ksmbd_conn *conn) 461 { 462 wait_event(conn->req_running_q, atomic_read(&conn->req_running) < 2); 463 } 464 465 int ksmbd_conn_wait_idle_sess(struct ksmbd_conn *curr_conn, 466 struct ksmbd_session *sess) 467 { 468 struct ksmbd_conn *conn; 469 int rc, retry_count = 0, max_timeout = 120; 470 int rcount, bkt; 471 472 retry_idle: 473 if (retry_count >= max_timeout) 474 return -EIO; 475 476 down_read(&conn_list_lock); 477 hash_for_each(conn_list, bkt, conn, hlist) { 478 if (ksmbd_session_is_bound_to_conn(sess, conn)) { 479 rcount = (conn == curr_conn) ? 2 : 1; 480 if (atomic_read(&conn->req_running) >= rcount) { 481 rc = wait_event_timeout(conn->req_running_q, 482 atomic_read(&conn->req_running) < rcount, 483 HZ); 484 if (!rc) { 485 up_read(&conn_list_lock); 486 retry_count++; 487 goto retry_idle; 488 } 489 } 490 } 491 } 492 up_read(&conn_list_lock); 493 494 return 0; 495 } 496 497 static int __ksmbd_conn_write(struct ksmbd_work *work, 498 struct ksmbd_transport_write *tx) 499 { 500 struct ksmbd_conn *conn = work->conn; 501 int sent; 502 503 if (!work->response_buf) { 504 pr_err("NULL response header\n"); 505 return -EINVAL; 506 } 507 508 if (work->send_no_response) 509 return 0; 510 511 if (!work->iov_idx) 512 return -EINVAL; 513 514 tx->iov = work->iov; 515 tx->iov_cnt = work->iov_cnt; 516 tx->size = get_rfc1002_len(work->iov[0].iov_base) + 4; 517 tx->need_invalidate_rkey = work->need_invalidate_rkey; 518 tx->remote_key = work->remote_key; 519 520 ksmbd_conn_lock(conn); 521 sent = conn->transport->ops->writev(conn->transport, tx); 522 ksmbd_conn_unlock(conn); 523 524 if (sent < 0) { 525 pr_err("Failed to send message: %d\n", sent); 526 return sent; 527 } 528 529 return 0; 530 } 531 532 int ksmbd_conn_write(struct ksmbd_work *work) 533 { 534 struct ksmbd_transport_write tx = {}; 535 536 return __ksmbd_conn_write(work, &tx); 537 } 538 539 int ksmbd_conn_write_eor(struct ksmbd_work *work) 540 { 541 struct ksmbd_transport_write tx = { 542 .msg_flags = MSG_EOR, 543 }; 544 545 return __ksmbd_conn_write(work, &tx); 546 } 547 548 int ksmbd_conn_rdma_read(struct ksmbd_conn *conn, 549 void *buf, unsigned int buflen, 550 struct smbdirect_buffer_descriptor_v1 *desc, 551 unsigned int desc_len) 552 { 553 int ret = -EINVAL; 554 555 if (conn->transport->ops->rdma_read) 556 ret = conn->transport->ops->rdma_read(conn->transport, 557 buf, buflen, 558 desc, desc_len); 559 return ret; 560 } 561 562 int ksmbd_conn_rdma_write(struct ksmbd_conn *conn, 563 void *buf, unsigned int buflen, 564 struct smbdirect_buffer_descriptor_v1 *desc, 565 unsigned int desc_len) 566 { 567 int ret = -EINVAL; 568 569 if (conn->transport->ops->rdma_write) 570 ret = conn->transport->ops->rdma_write(conn->transport, 571 buf, buflen, 572 desc, desc_len); 573 return ret; 574 } 575 576 bool ksmbd_conn_alive(struct ksmbd_conn *conn) 577 { 578 if (!ksmbd_server_running()) 579 return false; 580 581 if (ksmbd_conn_exiting(conn)) 582 return false; 583 584 if (kthread_should_stop()) 585 return false; 586 587 if (atomic_read(&conn->stats.open_files_count) > 0) 588 return true; 589 590 /* 591 * Stop current session if the time that get last request from client 592 * is bigger than deadtime user configured and opening file count is 593 * zero. 594 */ 595 if (server_conf.deadtime > 0 && 596 time_after(jiffies, conn->last_active + server_conf.deadtime)) { 597 ksmbd_debug(CONN, "No response from client in %lu minutes\n", 598 server_conf.deadtime / SMB_ECHO_INTERVAL); 599 return false; 600 } 601 return true; 602 } 603 604 /* "+2" for BCC field (ByteCount, 2 bytes) */ 605 #define SMB1_MIN_SUPPORTED_PDU_SIZE (sizeof(struct smb_hdr) + 2) 606 #define SMB2_MIN_SUPPORTED_PDU_SIZE (sizeof(struct smb2_pdu)) 607 #define SMB2_TRANSFORM_MIN_SUPPORTED_PDU_SIZE \ 608 (sizeof(struct smb2_transform_hdr) + sizeof(struct smb2_hdr)) 609 610 /** 611 * ksmbd_conn_handler_loop() - session thread to listen on new smb requests 612 * @p: connection instance 613 * 614 * One thread each per connection 615 * 616 * Return: 0 on success 617 */ 618 int ksmbd_conn_handler_loop(void *p) 619 { 620 struct ksmbd_conn *conn = (struct ksmbd_conn *)p; 621 struct ksmbd_transport *t = conn->transport; 622 unsigned int pdu_size, max_allowed_pdu_size, max_req; 623 __le32 proto; 624 char hdr_buf[4] = {0,}; 625 int size; 626 627 mutex_init(&conn->srv_mutex); 628 __module_get(THIS_MODULE); 629 630 max_req = server_conf.max_inflight_req; 631 conn->last_active = jiffies; 632 set_freezable(); 633 while (ksmbd_conn_alive(conn)) { 634 if (try_to_freeze()) 635 continue; 636 637 kvfree(conn->request_buf); 638 conn->request_buf = NULL; 639 640 recheck: 641 if (atomic_read(&conn->req_running) + 1 > max_req) { 642 wait_event_interruptible(conn->req_running_q, 643 atomic_read(&conn->req_running) < max_req); 644 goto recheck; 645 } 646 647 size = t->ops->read(t, hdr_buf, sizeof(hdr_buf), -1); 648 if (size != sizeof(hdr_buf)) 649 break; 650 651 pdu_size = get_rfc1002_len(hdr_buf); 652 ksmbd_debug(CONN, "RFC1002 header %u bytes\n", pdu_size); 653 654 max_allowed_pdu_size = ksmbd_max_allowed_pdu_size(conn); 655 656 if (pdu_size > max_allowed_pdu_size) { 657 pr_err_ratelimited("PDU length(%u) exceeded maximum allowed pdu size(%u) on connection(%d)\n", 658 pdu_size, max_allowed_pdu_size, 659 READ_ONCE(conn->status)); 660 break; 661 } 662 663 /* 664 * Check maximum pdu size(0x00FFFFFF). 665 */ 666 if (pdu_size > MAX_STREAM_PROT_LEN) 667 break; 668 669 if (pdu_size < SMB1_MIN_SUPPORTED_PDU_SIZE) 670 break; 671 672 /* 4 for rfc1002 length field */ 673 /* 1 for implied bcc[0] */ 674 size = pdu_size + 4 + 1; 675 conn->request_buf = kvmalloc(size, KSMBD_DEFAULT_GFP); 676 if (!conn->request_buf) 677 break; 678 679 memcpy(conn->request_buf, hdr_buf, sizeof(hdr_buf)); 680 681 /* 682 * We already read 4 bytes to find out PDU size, now 683 * read in PDU 684 */ 685 size = t->ops->read(t, conn->request_buf + 4, pdu_size, 2); 686 if (size < 0) { 687 pr_err("sock_read failed: %d\n", size); 688 break; 689 } 690 691 if (size != pdu_size) { 692 pr_err("PDU error. Read: %d, Expected: %d\n", 693 size, pdu_size); 694 continue; 695 } 696 697 if (((struct smb2_hdr *)smb_get_msg(conn->request_buf))->ProtocolId == 698 SMB2_COMPRESSION_TRANSFORM_ID) { 699 /* 700 * Convert the transform into a normal RFC1002-framed SMB2 701 * request before protocol validation and work allocation. 702 */ 703 if (ksmbd_decompress_request(conn)) 704 break; 705 pdu_size = get_rfc1002_len(conn->request_buf); 706 } 707 708 if (!ksmbd_smb_request(conn)) 709 break; 710 711 proto = *(__le32 *)smb_get_msg(conn->request_buf); 712 if (proto == SMB2_PROTO_NUMBER && 713 pdu_size < SMB2_MIN_SUPPORTED_PDU_SIZE) 714 break; 715 716 if (proto == SMB2_TRANSFORM_PROTO_NUM && 717 pdu_size < SMB2_TRANSFORM_MIN_SUPPORTED_PDU_SIZE) 718 break; 719 720 if (!default_conn_ops.process_fn) { 721 pr_err("No connection request callback\n"); 722 break; 723 } 724 725 if (default_conn_ops.process_fn(conn)) { 726 pr_err("Cannot handle request\n"); 727 break; 728 } 729 } 730 731 ksmbd_conn_set_releasing(conn); 732 ksmbd_conn_cancel_async_requests(conn); 733 /* Wait till all reference dropped to the Server object*/ 734 ksmbd_debug(CONN, "Wait for all pending requests(%d)\n", atomic_read(&conn->r_count)); 735 wait_event(conn->r_count_q, atomic_read(&conn->r_count) == 0); 736 737 if (IS_ENABLED(CONFIG_UNICODE)) 738 utf8_unload(conn->um); 739 unload_nls(conn->local_nls); 740 if (default_conn_ops.terminate_fn) 741 default_conn_ops.terminate_fn(conn); 742 t->ops->disconnect(t); 743 module_put(THIS_MODULE); 744 return 0; 745 } 746 747 void ksmbd_conn_init_server_callbacks(struct ksmbd_conn_ops *ops) 748 { 749 default_conn_ops.process_fn = ops->process_fn; 750 default_conn_ops.terminate_fn = ops->terminate_fn; 751 } 752 753 void ksmbd_conn_r_count_inc(struct ksmbd_conn *conn) 754 { 755 atomic_inc(&conn->r_count); 756 } 757 758 void ksmbd_conn_r_count_dec(struct ksmbd_conn *conn) 759 { 760 /* 761 * Checking waitqueue to dropping pending requests on 762 * disconnection. waitqueue_active is safe because it 763 * uses atomic operation for condition. 764 */ 765 atomic_inc(&conn->refcnt); 766 if (!atomic_dec_return(&conn->r_count) && waitqueue_active(&conn->r_count_q)) 767 wake_up(&conn->r_count_q); 768 769 ksmbd_conn_put(conn); 770 } 771 772 int ksmbd_conn_transport_init(void) 773 { 774 int ret; 775 776 mutex_lock(&init_lock); 777 ret = ksmbd_tcp_init(); 778 if (ret) { 779 pr_err("Failed to init TCP subsystem: %d\n", ret); 780 goto out; 781 } 782 783 ret = ksmbd_rdma_init(); 784 if (ret) { 785 pr_err("Failed to init RDMA subsystem: %d\n", ret); 786 goto out; 787 } 788 out: 789 mutex_unlock(&init_lock); 790 if (create_proc_clients()) 791 pr_warn("Unable to create clients procfs entry\n"); 792 return ret; 793 } 794 795 static void stop_sessions(void) 796 { 797 struct ksmbd_conn *conn, *target; 798 struct ksmbd_transport *t; 799 bool any; 800 int bkt; 801 802 /* 803 * Serialised via init_lock; no concurrent stop_sessions() can 804 * touch conn->stop_called, so writing it under the read lock is 805 * safe. 806 */ 807 again: 808 target = NULL; 809 any = false; 810 down_read(&conn_list_lock); 811 hash_for_each(conn_list, bkt, conn, hlist) { 812 any = true; 813 if (conn->stop_called) 814 continue; 815 atomic_inc(&conn->refcnt); 816 conn->stop_called = true; 817 /* 818 * Mark the connection EXITING while still holding the 819 * read lock so the selection and the status transition 820 * happen together. Do not regress a connection that has 821 * already advanced to RELEASING on its own (e.g. the 822 * handler exited its receive loop for an unrelated 823 * reason). 824 */ 825 spin_lock(&conn->request_lock); 826 if (!ksmbd_conn_releasing(conn)) 827 ksmbd_conn_set_exiting(conn); 828 spin_unlock(&conn->request_lock); 829 target = conn; 830 break; 831 } 832 up_read(&conn_list_lock); 833 834 if (target) { 835 t = target->transport; 836 if (t->ops->shutdown) 837 t->ops->shutdown(t); 838 if (atomic_dec_and_test(&target->refcnt)) { 839 ida_destroy(&target->async_ida); 840 t->ops->free_transport(t); 841 kfree_sensitive(target); 842 } 843 goto again; 844 } 845 846 if (any) { 847 msleep(100); 848 goto again; 849 } 850 } 851 852 void ksmbd_conn_transport_destroy(void) 853 { 854 delete_proc_clients(); 855 mutex_lock(&init_lock); 856 ksmbd_tcp_destroy(); 857 ksmbd_rdma_stop_listening(); 858 stop_sessions(); 859 mutex_unlock(&init_lock); 860 } 861