1 // SPDX-License-Identifier: GPL-2.0-or-later 2 /* 3 * Copyright (C) 2016 Namjae Jeon <namjae.jeon@protocolfreedom.org> 4 * Copyright (C) 2018 Samsung Electronics Co., Ltd. 5 */ 6 7 #include <linux/mutex.h> 8 #include <linux/freezer.h> 9 #include <linux/module.h> 10 11 #include "server.h" 12 #include "smb_common.h" 13 #include "mgmt/ksmbd_ida.h" 14 #include "mgmt/user_session.h" 15 #include "connection.h" 16 #include "vfs_cache.h" 17 #include "compress.h" 18 #include "transport_tcp.h" 19 #include "transport_rdma.h" 20 #include "misc.h" 21 22 static DEFINE_MUTEX(init_lock); 23 24 static struct ksmbd_conn_ops default_conn_ops; 25 26 DEFINE_HASHTABLE(conn_list, CONN_HASH_BITS); 27 DECLARE_RWSEM(conn_list_lock); 28 29 #ifdef CONFIG_PROC_FS 30 static struct proc_dir_entry *proc_clients; 31 32 static const char *ksmbd_conn_state_string(struct ksmbd_conn *conn) 33 { 34 switch (READ_ONCE(conn->status)) { 35 case KSMBD_SESS_NEW: 36 return "new"; 37 case KSMBD_SESS_GOOD: 38 return "good"; 39 case KSMBD_SESS_EXITING: 40 return "exiting"; 41 case KSMBD_SESS_NEED_RECONNECT: 42 return "reconnect"; 43 case KSMBD_SESS_NEED_NEGOTIATE: 44 return "negotiate"; 45 case KSMBD_SESS_NEED_SETUP: 46 return "setup"; 47 case KSMBD_SESS_RELEASING: 48 return "releasing"; 49 default: 50 return "unknown"; 51 } 52 } 53 54 static const char *ksmbd_conn_transport_string(struct ksmbd_conn *conn) 55 { 56 if (conn->transport->ops->rdma_read || conn->transport->ops->rdma_write) 57 return "smbdirect"; 58 return "tcp"; 59 } 60 61 static void proc_show_conn_feature(struct seq_file *m, bool *separator, 62 bool enabled, const char *name) 63 { 64 if (!enabled) 65 return; 66 seq_printf(m, "%s%s", *separator ? "," : "", name); 67 *separator = true; 68 } 69 70 static void proc_show_conn_features(struct seq_file *m, 71 struct ksmbd_conn *conn) 72 { 73 bool separator = false; 74 75 proc_show_conn_feature(m, &separator, 76 conn->sign || conn->signing_negotiated, "sign"); 77 proc_show_conn_feature(m, &separator, conn->cipher_type, "encrypt"); 78 proc_show_conn_feature(m, &separator, 79 conn->compress_algorithm != SMB3_COMPRESS_NONE, 80 "compress"); 81 proc_show_conn_feature(m, &separator, conn->rdma_transform_ids, 82 "rdma-transform"); 83 proc_show_conn_feature(m, &separator, conn->posix_ext_supported, "posix"); 84 if (!separator) 85 seq_puts(m, "none"); 86 } 87 88 static int proc_show_clients(struct seq_file *m, void *v) 89 { 90 struct ksmbd_conn *conn; 91 struct timespec64 now, t; 92 int i; 93 94 down_read(&conn_list_lock); 95 hash_for_each(conn_list, i, conn, hlist) { 96 unsigned int outstanding_credits, total_credits; 97 unsigned long id; 98 void *entry; 99 unsigned int sessions = 0; 100 101 jiffies_to_timespec64(jiffies - conn->last_active, &t); 102 ktime_get_real_ts64(&now); 103 t = timespec64_sub(now, t); 104 105 spin_lock(&conn->credits_lock); 106 outstanding_credits = conn->outstanding_credits; 107 total_credits = conn->total_credits; 108 spin_unlock(&conn->credits_lock); 109 110 rcu_read_lock(); 111 xa_for_each(&conn->sessions, id, entry) 112 sessions++; 113 rcu_read_unlock(); 114 #if IS_ENABLED(CONFIG_IPV6) 115 if (!conn->inet_addr) 116 seq_printf(m, "client:\t%pI6c\n", &conn->inet6_addr); 117 else 118 #endif 119 seq_printf(m, "client:\t%pI4\n", &conn->inet_addr); 120 seq_printf(m, "transport:\t%s\n", ksmbd_conn_transport_string(conn)); 121 seq_printf(m, "state:\t%s\n", ksmbd_conn_state_string(conn)); 122 seq_printf(m, "dialect:\t0x%04x\n", conn->dialect); 123 seq_printf(m, "credits:\t%u/%u\n", outstanding_credits, 124 total_credits); 125 seq_printf(m, "sessions:\t%u\n", sessions); 126 seq_printf(m, "open_files:\t%d\n", 127 atomic_read(&conn->stats.open_files_count)); 128 seq_printf(m, "requests:\t%lld\n", 129 atomic64_read(&conn->stats.request_served)); 130 seq_puts(m, "features:\t"); 131 proc_show_conn_features(m, conn); 132 seq_printf(m, "\nlast_active:\t%ptT\n\n", &t); 133 } 134 up_read(&conn_list_lock); 135 return 0; 136 } 137 138 static int create_proc_clients(void) 139 { 140 proc_clients = ksmbd_proc_create("clients", 141 proc_show_clients, NULL); 142 if (!proc_clients) 143 return -ENOMEM; 144 return 0; 145 } 146 147 static void delete_proc_clients(void) 148 { 149 if (proc_clients) { 150 proc_remove(proc_clients); 151 proc_clients = NULL; 152 } 153 } 154 #else 155 static int create_proc_clients(void) { return 0; } 156 static void delete_proc_clients(void) {} 157 #endif 158 159 static struct workqueue_struct *ksmbd_conn_wq; 160 161 int ksmbd_conn_wq_init(void) 162 { 163 ksmbd_conn_wq = alloc_workqueue("ksmbd-conn-release", 164 WQ_UNBOUND | WQ_MEM_RECLAIM, 0); 165 if (!ksmbd_conn_wq) 166 return -ENOMEM; 167 return 0; 168 } 169 170 void ksmbd_conn_wq_destroy(void) 171 { 172 if (ksmbd_conn_wq) { 173 destroy_workqueue(ksmbd_conn_wq); 174 ksmbd_conn_wq = NULL; 175 } 176 } 177 178 /* 179 * __ksmbd_conn_release_work() - perform the final, once-per-struct cleanup 180 * of a ksmbd_conn whose refcount has just dropped to zero. 181 * 182 * This is the common release path used by ksmbd_conn_put() for the embedded 183 * state that outlives the connection thread: async_ida and the attached 184 * transport (which owns the socket and iov for TCP). Called from a workqueue 185 * so that sleep-allowed teardown (sock_release -> tcp_close -> 186 * lock_sock_nested) never runs from an RCU softirq callback (free_opinfo_rcu) 187 * or any other non-sleeping putter context. 188 */ 189 static void __ksmbd_conn_release_work(struct work_struct *work) 190 { 191 struct ksmbd_conn *conn = 192 container_of(work, struct ksmbd_conn, release_work); 193 194 ida_destroy(&conn->async_ida); 195 conn->transport->ops->free_transport(conn->transport); 196 kfree_sensitive(conn); 197 } 198 199 /** 200 * ksmbd_conn_get() - take a reference on @conn and return it. 201 * 202 * @conn: connection instance to get a reference to 203 * 204 * Returns @conn unchanged so callers can write 205 * "fp->conn = ksmbd_conn_get(work->conn);" in one expression. Returns NULL 206 * if @conn is NULL. 207 */ 208 struct ksmbd_conn *ksmbd_conn_get(struct ksmbd_conn *conn) 209 { 210 if (!conn) 211 return NULL; 212 213 atomic_inc(&conn->refcnt); 214 return conn; 215 } 216 217 /** 218 * ksmbd_conn_put() - drop a reference and, if it was the last, queue the 219 * release onto ksmbd_conn_wq so it runs from process context. 220 * 221 * @conn: connection instance to put a reference to 222 * 223 * Callable from any context including RCU softirq callbacks and non-sleeping 224 * locks; the actual release is deferred to the workqueue. ksmbd_conn_wq is 225 * created in ksmbd_server_init() before any conn can be allocated and is 226 * destroyed in ksmbd_server_exit() after rcu_barrier(), so it is always 227 * non-NULL while a conn reference is held. 228 */ 229 void ksmbd_conn_put(struct ksmbd_conn *conn) 230 { 231 if (!conn) 232 return; 233 234 if (atomic_dec_and_test(&conn->refcnt)) 235 queue_work(ksmbd_conn_wq, &conn->release_work); 236 } 237 238 /** 239 * ksmbd_conn_free() - free resources of the connection instance 240 * 241 * @conn: connection instance to be cleaned up 242 * 243 * During the thread termination, the corresponding conn instance 244 * resources(sock/memory) are released and finally the conn object is freed. 245 */ 246 void ksmbd_conn_free(struct ksmbd_conn *conn) 247 { 248 down_write(&conn_list_lock); 249 hash_del(&conn->hlist); 250 up_write(&conn_list_lock); 251 252 /* 253 * request_buf / preauth_info / mechToken are only ever accessed by the 254 * connection handler thread that owns @conn. ksmbd_conn_free() is 255 * called from the transport free_transport() path when that thread is 256 * exiting, so it is safe to release them unconditionally even when 257 * ksmbd_conn_put() below is not the final putter (oplock / ksmbd_file 258 * holders only retain the conn pointer, not these per-thread buffers). 259 */ 260 xa_destroy(&conn->sessions); 261 kvfree(conn->request_buf); 262 kfree_sensitive(conn->preauth_info); 263 kfree(conn->mechToken); 264 ksmbd_preauth_session_destroy(conn); 265 ksmbd_conn_put(conn); 266 } 267 268 /** 269 * ksmbd_conn_alloc() - initialize a new connection instance 270 * 271 * Return: ksmbd_conn struct on success, otherwise NULL 272 */ 273 struct ksmbd_conn *ksmbd_conn_alloc(void) 274 { 275 struct ksmbd_conn *conn; 276 277 conn = kzalloc_obj(struct ksmbd_conn, KSMBD_DEFAULT_GFP); 278 if (!conn) 279 return NULL; 280 281 conn->need_neg = true; 282 ksmbd_conn_set_new(conn); 283 conn->local_nls = load_nls("utf8"); 284 if (!conn->local_nls) 285 conn->local_nls = load_nls_default(); 286 if (IS_ENABLED(CONFIG_UNICODE)) 287 conn->um = utf8_load(UNICODE_AGE(12, 1, 0)); 288 else 289 conn->um = ERR_PTR(-EOPNOTSUPP); 290 if (IS_ERR(conn->um)) 291 conn->um = NULL; 292 INIT_WORK(&conn->release_work, __ksmbd_conn_release_work); 293 atomic_set(&conn->req_running, 0); 294 atomic_set(&conn->r_count, 0); 295 atomic_set(&conn->refcnt, 1); 296 conn->total_credits = 1; 297 conn->outstanding_credits = 0; 298 299 /* 300 * The command sequence window starts as the set { 0 } when the 301 * connection is established. 302 */ 303 conn->seq_low = 0; 304 conn->seq_high = 1; 305 __set_bit(0, conn->seq_bitmap); 306 307 init_waitqueue_head(&conn->req_running_q); 308 init_waitqueue_head(&conn->r_count_q); 309 INIT_LIST_HEAD(&conn->requests); 310 INIT_LIST_HEAD(&conn->async_requests); 311 INIT_LIST_HEAD(&conn->preauth_sess_table); 312 spin_lock_init(&conn->request_lock); 313 spin_lock_init(&conn->credits_lock); 314 ida_init(&conn->async_ida); 315 xa_init(&conn->sessions); 316 317 spin_lock_init(&conn->llist_lock); 318 INIT_LIST_HEAD(&conn->lock_list); 319 320 init_rwsem(&conn->session_lock); 321 322 return conn; 323 } 324 325 bool ksmbd_conn_lookup_dialect(struct ksmbd_conn *c) 326 { 327 struct ksmbd_conn *t; 328 int bkt; 329 bool ret = false; 330 331 down_read(&conn_list_lock); 332 hash_for_each(conn_list, bkt, t, hlist) { 333 if (memcmp(t->ClientGUID, c->ClientGUID, SMB2_CLIENT_GUID_SIZE)) 334 continue; 335 336 ret = true; 337 break; 338 } 339 up_read(&conn_list_lock); 340 return ret; 341 } 342 343 void ksmbd_conn_enqueue_request(struct ksmbd_work *work) 344 { 345 struct ksmbd_conn *conn = work->conn; 346 struct list_head *requests_queue = NULL; 347 348 if (conn->ops->get_cmd_val(work) != SMB2_CANCEL_HE) 349 requests_queue = &conn->requests; 350 351 atomic_inc(&conn->req_running); 352 if (requests_queue) { 353 spin_lock(&conn->request_lock); 354 list_add_tail(&work->request_entry, requests_queue); 355 spin_unlock(&conn->request_lock); 356 } 357 } 358 359 void ksmbd_conn_try_dequeue_request(struct ksmbd_work *work) 360 { 361 struct ksmbd_conn *conn = work->conn; 362 363 atomic_dec(&conn->req_running); 364 if (waitqueue_active(&conn->req_running_q)) 365 wake_up(&conn->req_running_q); 366 367 if (list_empty(&work->request_entry) && 368 list_empty(&work->async_request_entry)) 369 return; 370 371 spin_lock(&conn->request_lock); 372 list_del_init(&work->request_entry); 373 spin_unlock(&conn->request_lock); 374 if (work->asynchronous) 375 release_async_work(work); 376 377 wake_up_all(&conn->req_running_q); 378 } 379 380 static void ksmbd_conn_cancel_async_requests(struct ksmbd_conn *conn) 381 { 382 struct ksmbd_work *work, *tmp; 383 384 ksmbd_debug(CONN, "Cancel pending async requests on releasing connection\n"); 385 spin_lock(&conn->request_lock); 386 list_for_each_entry_safe(work, tmp, &conn->async_requests, 387 async_request_entry) { 388 if (cmpxchg(&work->state, KSMBD_WORK_ACTIVE, 389 KSMBD_WORK_CANCELLED) != KSMBD_WORK_ACTIVE) 390 continue; 391 392 ksmbd_debug(CONN, "Cancel async request id %d\n", 393 work->async_id); 394 if (work->cancel_fn) 395 work->cancel_fn(work->cancel_argv); 396 } 397 spin_unlock(&conn->request_lock); 398 } 399 400 void ksmbd_conn_lock(struct ksmbd_conn *conn) 401 { 402 mutex_lock(&conn->srv_mutex); 403 } 404 405 void ksmbd_conn_unlock(struct ksmbd_conn *conn) 406 { 407 mutex_unlock(&conn->srv_mutex); 408 } 409 410 static bool ksmbd_session_is_bound_to_conn(struct ksmbd_session *sess, 411 struct ksmbd_conn *conn) 412 { 413 bool found; 414 415 rcu_read_lock(); 416 found = xa_load(&conn->sessions, sess->id) == sess; 417 rcu_read_unlock(); 418 if (found) 419 return true; 420 421 down_read(&sess->chann_lock); 422 found = xa_load(&sess->ksmbd_chann_list, (long)conn); 423 up_read(&sess->chann_lock); 424 return found; 425 } 426 427 void ksmbd_all_conn_set_status(struct ksmbd_session *sess, u32 status) 428 { 429 struct ksmbd_conn *conn; 430 int bkt; 431 432 down_read(&conn_list_lock); 433 hash_for_each(conn_list, bkt, conn, hlist) { 434 if (ksmbd_session_is_bound_to_conn(sess, conn)) { 435 spin_lock(&conn->request_lock); 436 if (!ksmbd_conn_exiting(conn) && 437 !ksmbd_conn_releasing(conn)) 438 WRITE_ONCE(conn->status, status); 439 spin_unlock(&conn->request_lock); 440 } 441 } 442 up_read(&conn_list_lock); 443 } 444 445 void ksmbd_conn_abort(struct ksmbd_conn *conn) 446 { 447 bool shutdown = false; 448 449 spin_lock(&conn->request_lock); 450 if (!ksmbd_conn_exiting(conn) && !ksmbd_conn_releasing(conn)) { 451 ksmbd_conn_set_exiting(conn); 452 shutdown = true; 453 } 454 spin_unlock(&conn->request_lock); 455 wake_up_all(&conn->req_running_q); 456 457 if (shutdown && conn->transport->ops->shutdown) 458 conn->transport->ops->shutdown(conn->transport); 459 } 460 461 void ksmbd_conn_wait_idle(struct ksmbd_conn *conn) 462 { 463 wait_event(conn->req_running_q, atomic_read(&conn->req_running) < 2); 464 } 465 466 int ksmbd_conn_wait_idle_sess(struct ksmbd_conn *curr_conn, 467 struct ksmbd_session *sess) 468 { 469 struct ksmbd_conn *conn; 470 int rc, retry_count = 0, max_timeout = 120; 471 int rcount, bkt; 472 473 retry_idle: 474 if (retry_count >= max_timeout) 475 return -EIO; 476 477 /* A blocked byte-range lock cannot drain until teardown wakes it. */ 478 ksmbd_wake_session_blocked_works(sess); 479 480 down_read(&conn_list_lock); 481 hash_for_each(conn_list, bkt, conn, hlist) { 482 if (ksmbd_session_is_bound_to_conn(sess, conn)) { 483 rcount = (conn == curr_conn) ? 2 : 1; 484 if (atomic_read(&conn->req_running) >= rcount) { 485 rc = wait_event_timeout(conn->req_running_q, 486 atomic_read(&conn->req_running) < rcount, 487 HZ); 488 if (!rc) { 489 up_read(&conn_list_lock); 490 retry_count++; 491 goto retry_idle; 492 } 493 } 494 } 495 } 496 up_read(&conn_list_lock); 497 498 return 0; 499 } 500 501 static int __ksmbd_conn_write(struct ksmbd_work *work, 502 struct ksmbd_transport_write *tx) 503 { 504 struct ksmbd_conn *conn = work->conn; 505 int sent; 506 507 if (!work->response_buf) { 508 pr_err("NULL response header\n"); 509 return -EINVAL; 510 } 511 512 if (work->send_no_response) 513 return 0; 514 515 if (!work->iov_idx) 516 return -EINVAL; 517 518 tx->iov = work->iov; 519 tx->iov_cnt = work->iov_cnt; 520 tx->size = get_rfc1002_len(work->iov[0].iov_base) + 4; 521 tx->need_invalidate_rkey = work->need_invalidate_rkey; 522 tx->remote_key = work->remote_key; 523 524 ksmbd_conn_lock(conn); 525 sent = conn->transport->ops->writev(conn->transport, tx); 526 ksmbd_conn_unlock(conn); 527 528 if (sent < 0) { 529 pr_err("Failed to send message: %d\n", sent); 530 return sent; 531 } 532 533 return 0; 534 } 535 536 int ksmbd_conn_write(struct ksmbd_work *work) 537 { 538 struct ksmbd_transport_write tx = {}; 539 540 return __ksmbd_conn_write(work, &tx); 541 } 542 543 int ksmbd_conn_write_eor(struct ksmbd_work *work) 544 { 545 struct ksmbd_transport_write tx = { 546 .msg_flags = MSG_EOR, 547 }; 548 549 return __ksmbd_conn_write(work, &tx); 550 } 551 552 int ksmbd_conn_rdma_read(struct ksmbd_conn *conn, 553 void *buf, unsigned int buflen, 554 struct smbdirect_buffer_descriptor_v1 *desc, 555 unsigned int desc_len) 556 { 557 int ret = -EINVAL; 558 559 if (conn->transport->ops->rdma_read) 560 ret = conn->transport->ops->rdma_read(conn->transport, 561 buf, buflen, 562 desc, desc_len); 563 return ret; 564 } 565 566 int ksmbd_conn_rdma_write(struct ksmbd_conn *conn, 567 void *buf, unsigned int buflen, 568 struct smbdirect_buffer_descriptor_v1 *desc, 569 unsigned int desc_len) 570 { 571 int ret = -EINVAL; 572 573 if (conn->transport->ops->rdma_write) 574 ret = conn->transport->ops->rdma_write(conn->transport, 575 buf, buflen, 576 desc, desc_len); 577 return ret; 578 } 579 580 bool ksmbd_conn_alive(struct ksmbd_conn *conn) 581 { 582 if (!ksmbd_server_running()) 583 return false; 584 585 if (ksmbd_conn_exiting(conn)) 586 return false; 587 588 if (kthread_should_stop()) 589 return false; 590 591 if (atomic_read(&conn->stats.open_files_count) > 0) 592 return true; 593 594 /* 595 * Stop current session if the time that get last request from client 596 * is bigger than deadtime user configured and opening file count is 597 * zero. 598 */ 599 if (server_conf.deadtime > 0 && 600 time_after(jiffies, conn->last_active + server_conf.deadtime)) { 601 ksmbd_debug(CONN, "No response from client in %lu minutes\n", 602 server_conf.deadtime / SMB_ECHO_INTERVAL); 603 return false; 604 } 605 return true; 606 } 607 608 /* "+2" for BCC field (ByteCount, 2 bytes) */ 609 #define SMB1_MIN_SUPPORTED_PDU_SIZE (sizeof(struct smb_hdr) + 2) 610 #define SMB2_MIN_SUPPORTED_PDU_SIZE (sizeof(struct smb2_pdu)) 611 #define SMB2_TRANSFORM_MIN_SUPPORTED_PDU_SIZE \ 612 (sizeof(struct smb2_transform_hdr) + sizeof(struct smb2_hdr)) 613 614 /** 615 * ksmbd_conn_handler_loop() - session thread to listen on new smb requests 616 * @p: connection instance 617 * 618 * One thread each per connection 619 * 620 * Return: 0 on success 621 */ 622 int ksmbd_conn_handler_loop(void *p) 623 { 624 struct ksmbd_conn *conn = (struct ksmbd_conn *)p; 625 struct ksmbd_transport *t = conn->transport; 626 unsigned int pdu_size, max_allowed_pdu_size, max_req; 627 __le32 proto; 628 char hdr_buf[4] = {0,}; 629 int size; 630 631 mutex_init(&conn->srv_mutex); 632 __module_get(THIS_MODULE); 633 634 max_req = server_conf.max_inflight_req; 635 conn->last_active = jiffies; 636 set_freezable(); 637 while (ksmbd_conn_alive(conn)) { 638 if (try_to_freeze()) 639 continue; 640 641 kvfree(conn->request_buf); 642 conn->request_buf = NULL; 643 644 recheck: 645 if (atomic_read(&conn->req_running) + 1 > max_req) { 646 wait_event_interruptible(conn->req_running_q, 647 atomic_read(&conn->req_running) < max_req); 648 goto recheck; 649 } 650 651 size = t->ops->read(t, hdr_buf, sizeof(hdr_buf), -1); 652 if (size != sizeof(hdr_buf)) 653 break; 654 655 pdu_size = get_rfc1002_len(hdr_buf); 656 ksmbd_debug(CONN, "RFC1002 header %u bytes\n", pdu_size); 657 658 max_allowed_pdu_size = ksmbd_max_allowed_pdu_size(conn); 659 660 if (pdu_size > max_allowed_pdu_size) { 661 pr_err_ratelimited("PDU length(%u) exceeded maximum allowed pdu size(%u) on connection(%d)\n", 662 pdu_size, max_allowed_pdu_size, 663 READ_ONCE(conn->status)); 664 break; 665 } 666 667 /* 668 * Check maximum pdu size(0x00FFFFFF). 669 */ 670 if (pdu_size > MAX_STREAM_PROT_LEN) 671 break; 672 673 if (pdu_size < SMB1_MIN_SUPPORTED_PDU_SIZE) 674 break; 675 676 /* 4 for rfc1002 length field */ 677 /* 1 for implied bcc[0] */ 678 size = pdu_size + 4 + 1; 679 conn->request_buf = kvmalloc(size, KSMBD_DEFAULT_GFP); 680 if (!conn->request_buf) 681 break; 682 683 memcpy(conn->request_buf, hdr_buf, sizeof(hdr_buf)); 684 685 /* 686 * We already read 4 bytes to find out PDU size, now 687 * read in PDU 688 */ 689 size = t->ops->read(t, conn->request_buf + 4, pdu_size, 2); 690 if (size < 0) { 691 pr_err("sock_read failed: %d\n", size); 692 break; 693 } 694 695 if (size != pdu_size) { 696 pr_err("PDU error. Read: %d, Expected: %d\n", 697 size, pdu_size); 698 continue; 699 } 700 701 if (((struct smb2_hdr *)smb_get_msg(conn->request_buf))->ProtocolId == 702 SMB2_COMPRESSION_TRANSFORM_ID) { 703 /* 704 * Convert the transform into a normal RFC1002-framed SMB2 705 * request before protocol validation and work allocation. 706 */ 707 if (ksmbd_decompress_request(conn)) 708 break; 709 pdu_size = get_rfc1002_len(conn->request_buf); 710 } 711 712 if (!ksmbd_smb_request(conn)) 713 break; 714 715 proto = *(__le32 *)smb_get_msg(conn->request_buf); 716 if (proto == SMB2_PROTO_NUMBER && 717 pdu_size < SMB2_MIN_SUPPORTED_PDU_SIZE) 718 break; 719 720 if (proto == SMB2_TRANSFORM_PROTO_NUM && 721 pdu_size < SMB2_TRANSFORM_MIN_SUPPORTED_PDU_SIZE) 722 break; 723 724 if (!default_conn_ops.process_fn) { 725 pr_err("No connection request callback\n"); 726 break; 727 } 728 729 if (default_conn_ops.process_fn(conn)) { 730 pr_err("Cannot handle request\n"); 731 break; 732 } 733 } 734 735 ksmbd_conn_set_releasing(conn); 736 ksmbd_conn_cancel_async_requests(conn); 737 /* Wait till all reference dropped to the Server object*/ 738 ksmbd_debug(CONN, "Wait for all pending requests(%d)\n", atomic_read(&conn->r_count)); 739 wait_event(conn->r_count_q, atomic_read(&conn->r_count) == 0); 740 741 if (IS_ENABLED(CONFIG_UNICODE)) 742 utf8_unload(conn->um); 743 unload_nls(conn->local_nls); 744 if (default_conn_ops.terminate_fn) 745 default_conn_ops.terminate_fn(conn); 746 t->ops->disconnect(t); 747 module_put(THIS_MODULE); 748 return 0; 749 } 750 751 void ksmbd_conn_init_server_callbacks(struct ksmbd_conn_ops *ops) 752 { 753 default_conn_ops.process_fn = ops->process_fn; 754 default_conn_ops.terminate_fn = ops->terminate_fn; 755 } 756 757 void ksmbd_conn_r_count_inc(struct ksmbd_conn *conn) 758 { 759 atomic_inc(&conn->r_count); 760 } 761 762 void ksmbd_conn_r_count_dec(struct ksmbd_conn *conn) 763 { 764 /* 765 * Checking waitqueue to dropping pending requests on 766 * disconnection. waitqueue_active is safe because it 767 * uses atomic operation for condition. 768 */ 769 atomic_inc(&conn->refcnt); 770 if (!atomic_dec_return(&conn->r_count) && waitqueue_active(&conn->r_count_q)) 771 wake_up(&conn->r_count_q); 772 773 ksmbd_conn_put(conn); 774 } 775 776 int ksmbd_conn_transport_init(void) 777 { 778 int ret; 779 780 mutex_lock(&init_lock); 781 ret = ksmbd_tcp_init(); 782 if (ret) { 783 pr_err("Failed to init TCP subsystem: %d\n", ret); 784 goto out; 785 } 786 787 ret = ksmbd_rdma_init(); 788 if (ret) { 789 pr_err("Failed to init RDMA subsystem: %d\n", ret); 790 goto out; 791 } 792 out: 793 mutex_unlock(&init_lock); 794 if (create_proc_clients()) 795 pr_warn("Unable to create clients procfs entry\n"); 796 return ret; 797 } 798 799 static void stop_sessions(void) 800 { 801 struct ksmbd_conn *conn, *target; 802 struct ksmbd_transport *t; 803 bool any; 804 int bkt; 805 806 /* 807 * Serialised via init_lock; no concurrent stop_sessions() can 808 * touch conn->stop_called, so writing it under the read lock is 809 * safe. 810 */ 811 again: 812 target = NULL; 813 any = false; 814 down_read(&conn_list_lock); 815 hash_for_each(conn_list, bkt, conn, hlist) { 816 any = true; 817 if (conn->stop_called) 818 continue; 819 atomic_inc(&conn->refcnt); 820 conn->stop_called = true; 821 /* 822 * Mark the connection EXITING while still holding the 823 * read lock so the selection and the status transition 824 * happen together. Do not regress a connection that has 825 * already advanced to RELEASING on its own (e.g. the 826 * handler exited its receive loop for an unrelated 827 * reason). 828 */ 829 spin_lock(&conn->request_lock); 830 if (!ksmbd_conn_releasing(conn)) 831 ksmbd_conn_set_exiting(conn); 832 spin_unlock(&conn->request_lock); 833 target = conn; 834 break; 835 } 836 up_read(&conn_list_lock); 837 838 if (target) { 839 t = target->transport; 840 if (t->ops->shutdown) 841 t->ops->shutdown(t); 842 if (atomic_dec_and_test(&target->refcnt)) { 843 ida_destroy(&target->async_ida); 844 t->ops->free_transport(t); 845 kfree_sensitive(target); 846 } 847 goto again; 848 } 849 850 if (any) { 851 msleep(100); 852 goto again; 853 } 854 } 855 856 void ksmbd_conn_transport_destroy(void) 857 { 858 delete_proc_clients(); 859 mutex_lock(&init_lock); 860 ksmbd_tcp_destroy(); 861 ksmbd_rdma_stop_listening(); 862 stop_sessions(); 863 mutex_unlock(&init_lock); 864 } 865