1 // SPDX-License-Identifier: GPL-2.0-or-later 2 /* 3 * Copyright (C) 2016 Namjae Jeon <linkinjeon@kernel.org> 4 * Copyright (C) 2018 Samsung Electronics Co., Ltd. 5 */ 6 7 #include "glob.h" 8 #include "oplock.h" 9 #include "misc.h" 10 #include <linux/sched/signal.h> 11 #include <linux/workqueue.h> 12 #include <linux/sysfs.h> 13 #include <linux/module.h> 14 #include <linux/moduleparam.h> 15 16 #include "server.h" 17 #include "smb_common.h" 18 #include "../common/smb2status.h" 19 #include "connection.h" 20 #include "transport_ipc.h" 21 #include "mgmt/user_session.h" 22 #include "crypto_ctx.h" 23 #include "auth.h" 24 #include "stats.h" 25 #include "compress.h" 26 27 int ksmbd_debug_types; 28 29 struct ksmbd_server_config server_conf; 30 31 enum SERVER_CTRL_TYPE { 32 SERVER_CTRL_TYPE_INIT, 33 SERVER_CTRL_TYPE_RESET, 34 }; 35 36 struct server_ctrl_struct { 37 int type; 38 struct work_struct ctrl_work; 39 }; 40 41 static DEFINE_MUTEX(ctrl_lock); 42 43 static int ___server_conf_set(int idx, char *val) 44 { 45 if (idx >= ARRAY_SIZE(server_conf.conf)) 46 return -EINVAL; 47 48 if (!val || val[0] == 0x00) 49 return -EINVAL; 50 51 kfree(server_conf.conf[idx]); 52 server_conf.conf[idx] = kstrdup(val, KSMBD_DEFAULT_GFP); 53 if (!server_conf.conf[idx]) 54 return -ENOMEM; 55 return 0; 56 } 57 58 int ksmbd_set_netbios_name(char *v) 59 { 60 return ___server_conf_set(SERVER_CONF_NETBIOS_NAME, v); 61 } 62 63 int ksmbd_set_server_string(char *v) 64 { 65 return ___server_conf_set(SERVER_CONF_SERVER_STRING, v); 66 } 67 68 int ksmbd_set_work_group(char *v) 69 { 70 return ___server_conf_set(SERVER_CONF_WORK_GROUP, v); 71 } 72 73 char *ksmbd_netbios_name(void) 74 { 75 return server_conf.conf[SERVER_CONF_NETBIOS_NAME]; 76 } 77 78 char *ksmbd_server_string(void) 79 { 80 return server_conf.conf[SERVER_CONF_SERVER_STRING]; 81 } 82 83 char *ksmbd_work_group(void) 84 { 85 return server_conf.conf[SERVER_CONF_WORK_GROUP]; 86 } 87 88 /** 89 * check_conn_state() - check state of server thread connection 90 * @work: smb work containing server thread information 91 * 92 * Return: 0 on valid connection, otherwise 1 to reconnect 93 */ 94 static inline int check_conn_state(struct ksmbd_work *work) 95 { 96 struct smb_hdr *rsp_hdr; 97 98 if (ksmbd_conn_exiting(work->conn) || 99 ksmbd_conn_need_reconnect(work->conn)) { 100 rsp_hdr = smb_get_msg(work->response_buf); 101 rsp_hdr->Status.CifsError = STATUS_CONNECTION_DISCONNECTED; 102 return 1; 103 } 104 return 0; 105 } 106 107 #define SERVER_HANDLER_CONTINUE 0 108 #define SERVER_HANDLER_ABORT 1 109 110 static int __process_request(struct ksmbd_work *work, struct ksmbd_conn *conn, 111 u16 *cmd) 112 { 113 struct smb_version_cmds *cmds; 114 u16 command; 115 int ret; 116 117 if (check_conn_state(work)) 118 return SERVER_HANDLER_CONTINUE; 119 120 if (ksmbd_verify_smb_message(work)) { 121 conn->ops->set_rsp_status(work, STATUS_INVALID_PARAMETER); 122 return SERVER_HANDLER_ABORT; 123 } 124 125 command = conn->ops->get_cmd_val(work); 126 *cmd = command; 127 128 andx_again: 129 if (command >= conn->max_cmds) { 130 conn->ops->set_rsp_status(work, STATUS_INVALID_PARAMETER); 131 return SERVER_HANDLER_ABORT; 132 } 133 134 cmds = &conn->cmds[command]; 135 if (!cmds->proc) { 136 ksmbd_debug(SMB, "*** not implemented yet cmd = %x\n", command); 137 conn->ops->set_rsp_status(work, STATUS_NOT_IMPLEMENTED); 138 return SERVER_HANDLER_ABORT; 139 } 140 141 if (work->sess && conn->ops->is_sign_req(work, command)) { 142 ret = conn->ops->check_sign_req(work); 143 if (!ret) { 144 conn->ops->set_rsp_status(work, STATUS_ACCESS_DENIED); 145 return SERVER_HANDLER_ABORT; 146 } 147 } 148 149 ret = cmds->proc(work); 150 if (conn->ops->inc_reqs) 151 conn->ops->inc_reqs(command); 152 153 if (ret < 0) 154 ksmbd_debug(CONN, "Failed to process %u [%d]\n", command, ret); 155 /* AndX commands - chained request can return positive values */ 156 else if (ret > 0) { 157 command = ret; 158 *cmd = command; 159 goto andx_again; 160 } 161 162 if (work->send_no_response) 163 return SERVER_HANDLER_ABORT; 164 return SERVER_HANDLER_CONTINUE; 165 } 166 167 static void __handle_ksmbd_work(struct ksmbd_work *work, 168 struct ksmbd_conn *conn) 169 { 170 u16 command = 0; 171 int rc; 172 bool is_chained = false; 173 174 if (conn->ops->is_transform_hdr && 175 conn->ops->is_transform_hdr(work->request_buf)) { 176 rc = conn->ops->decrypt_req(work); 177 if (rc < 0) 178 return; 179 work->encrypted = true; 180 } 181 182 if (conn->ops->allocate_rsp_buf(work)) 183 return; 184 185 rc = conn->ops->init_rsp_hdr(work); 186 if (rc) { 187 /* either uid or tid is not correct */ 188 conn->ops->set_rsp_status(work, STATUS_INVALID_HANDLE); 189 goto send; 190 } 191 192 do { 193 if (conn->ops->check_user_session) { 194 rc = conn->ops->check_user_session(work); 195 if (rc < 0) { 196 if (rc == -EINVAL) 197 conn->ops->set_rsp_status(work, 198 STATUS_INVALID_PARAMETER); 199 else 200 conn->ops->set_rsp_status(work, 201 STATUS_USER_SESSION_DELETED); 202 if (conn->ops->is_sign_req(work, conn->ops->get_cmd_val(work))) { 203 struct smb2_hdr *rsp_hdr; 204 205 rsp_hdr = ksmbd_resp_buf_curr(work); 206 rsp_hdr->Flags |= SMB2_FLAGS_SIGNED; 207 } 208 goto send; 209 } else if (rc > 0) { 210 rc = conn->ops->get_ksmbd_tcon(work); 211 if (rc < 0) { 212 if (rc == -EINVAL) 213 conn->ops->set_rsp_status(work, 214 STATUS_INVALID_PARAMETER); 215 else 216 conn->ops->set_rsp_status(work, 217 STATUS_NETWORK_NAME_DELETED); 218 goto send; 219 } 220 } 221 } 222 223 rc = __process_request(work, conn, &command); 224 if (rc == SERVER_HANDLER_ABORT) 225 break; 226 227 /* 228 * Call smb2_set_rsp_credits() function to set number of credits 229 * granted in hdr of smb2 response. 230 */ 231 if (conn->ops->set_rsp_credits) { 232 spin_lock(&conn->credits_lock); 233 rc = conn->ops->set_rsp_credits(work); 234 spin_unlock(&conn->credits_lock); 235 if (rc < 0) { 236 conn->ops->set_rsp_status(work, 237 STATUS_INVALID_PARAMETER); 238 goto send; 239 } 240 } 241 242 is_chained = is_chained_smb2_message(work); 243 244 if (work->sess && 245 (work->sess->sign || smb3_11_final_sess_setup_resp(work) || 246 conn->ops->is_sign_req(work, command))) { 247 if (command == SMB2_SESSION_SETUP_HE && 248 work->sess->dialect >= SMB30_PROT_ID && 249 conn->dialect < SMB30_PROT_ID) 250 smb3_set_sign_rsp(work); 251 else 252 conn->ops->set_sign_rsp(work); 253 } 254 } while (is_chained == true); 255 256 send: 257 /* 258 * Release any credit charge still outstanding for this request. On 259 * the normal path smb2_set_rsp_credits() already returned it, but the 260 * abort, error and send-no-response paths skip that call, so the 261 * charge would otherwise leak and eventually exhaust the connection's 262 * outstanding credit window. 263 */ 264 if (work->credit_charge) { 265 spin_lock(&conn->credits_lock); 266 conn->outstanding_credits -= work->credit_charge; 267 work->credit_charge = 0; 268 spin_unlock(&conn->credits_lock); 269 } 270 271 if (work->tcon) 272 ksmbd_tree_connect_put(work->tcon); 273 smb3_preauth_hash_rsp(work); 274 /* 275 * Preauthentication hashes cover the original SMB2 response. Apply the 276 * transport compression wrapper only after updating the hash. 277 */ 278 if (work->compress_response) { 279 rc = ksmbd_compress_response(work); 280 if (rc < 0) 281 ksmbd_debug(CONN, "Failed to compress response: %d\n", rc); 282 } 283 if (work->sess && work->sess->enc && work->encrypted && 284 conn->ops->encrypt_resp) { 285 rc = conn->ops->encrypt_resp(work); 286 if (rc < 0) 287 conn->ops->set_rsp_status(work, STATUS_DATA_ERROR); 288 } 289 if (work->sess) 290 ksmbd_user_session_put(work->sess); 291 292 ksmbd_conn_write(work); 293 } 294 295 /** 296 * handle_ksmbd_work() - process pending smb work requests 297 * @wk: smb work containing request command buffer 298 * 299 * called by kworker threads to processing remaining smb work requests 300 */ 301 static void handle_ksmbd_work(struct work_struct *wk) 302 { 303 struct ksmbd_work *work = container_of(wk, struct ksmbd_work, work); 304 struct ksmbd_conn *conn = work->conn; 305 306 atomic64_inc(&conn->stats.request_served); 307 308 __handle_ksmbd_work(work, conn); 309 310 ksmbd_conn_try_dequeue_request(work); 311 ksmbd_free_work_struct(work); 312 ksmbd_conn_r_count_dec(conn); 313 } 314 315 /** 316 * queue_ksmbd_work() - queue a smb request to worker thread queue 317 * for processing smb command and sending response 318 * @conn: connection instance 319 * 320 * read remaining data from socket create and submit work. 321 */ 322 static int queue_ksmbd_work(struct ksmbd_conn *conn) 323 { 324 struct ksmbd_work *work; 325 int err; 326 327 err = ksmbd_init_smb_server(conn); 328 if (err) 329 return 0; 330 331 work = ksmbd_alloc_work_struct(); 332 if (!work) { 333 pr_err("allocation for work failed\n"); 334 return -ENOMEM; 335 } 336 337 work->conn = conn; 338 work->request_buf = conn->request_buf; 339 conn->request_buf = NULL; 340 341 ksmbd_conn_enqueue_request(work); 342 ksmbd_conn_r_count_inc(conn); 343 /* update activity on connection */ 344 conn->last_active = jiffies; 345 INIT_WORK(&work->work, handle_ksmbd_work); 346 ksmbd_queue_work(work); 347 return 0; 348 } 349 350 static int ksmbd_server_process_request(struct ksmbd_conn *conn) 351 { 352 return queue_ksmbd_work(conn); 353 } 354 355 static int ksmbd_server_terminate_conn(struct ksmbd_conn *conn) 356 { 357 ksmbd_sessions_deregister(conn); 358 destroy_lease_table(conn); 359 return 0; 360 } 361 362 static void ksmbd_server_tcp_callbacks_init(void) 363 { 364 struct ksmbd_conn_ops ops; 365 366 ops.process_fn = ksmbd_server_process_request; 367 ops.terminate_fn = ksmbd_server_terminate_conn; 368 369 ksmbd_conn_init_server_callbacks(&ops); 370 } 371 372 static void server_conf_free(void) 373 { 374 int i; 375 376 for (i = 0; i < ARRAY_SIZE(server_conf.conf); i++) { 377 kfree(server_conf.conf[i]); 378 server_conf.conf[i] = NULL; 379 } 380 } 381 382 static int server_conf_init(void) 383 { 384 WRITE_ONCE(server_conf.state, SERVER_STATE_STARTING_UP); 385 server_conf.enforced_signing = 0; 386 server_conf.min_protocol = ksmbd_min_protocol(); 387 server_conf.max_protocol = ksmbd_max_protocol(); 388 server_conf.auth_mechs = KSMBD_AUTH_NTLMSSP; 389 #ifdef CONFIG_SMB_SERVER_KERBEROS5 390 server_conf.auth_mechs |= KSMBD_AUTH_KRB5 | 391 KSMBD_AUTH_MSKRB5; 392 #endif 393 server_conf.max_inflight_req = SMB2_MAX_CREDITS; 394 return 0; 395 } 396 397 static void server_ctrl_handle_init(struct server_ctrl_struct *ctrl) 398 { 399 int ret; 400 401 ksmbd_proc_reset(); 402 ret = ksmbd_conn_transport_init(); 403 if (ret) { 404 server_queue_ctrl_reset_work(); 405 return; 406 } 407 408 pr_info("running\n"); 409 WRITE_ONCE(server_conf.state, SERVER_STATE_RUNNING); 410 } 411 412 static void server_ctrl_handle_reset(struct server_ctrl_struct *ctrl) 413 { 414 ksmbd_ipc_soft_reset(); 415 ksmbd_conn_transport_destroy(); 416 ksmbd_stop_durable_scavenger(); 417 server_conf_free(); 418 server_conf_init(); 419 WRITE_ONCE(server_conf.state, SERVER_STATE_STARTING_UP); 420 } 421 422 static void server_ctrl_handle_work(struct work_struct *work) 423 { 424 struct server_ctrl_struct *ctrl; 425 426 ctrl = container_of(work, struct server_ctrl_struct, ctrl_work); 427 428 mutex_lock(&ctrl_lock); 429 switch (ctrl->type) { 430 case SERVER_CTRL_TYPE_INIT: 431 server_ctrl_handle_init(ctrl); 432 break; 433 case SERVER_CTRL_TYPE_RESET: 434 server_ctrl_handle_reset(ctrl); 435 break; 436 default: 437 pr_err("Unknown server work type: %d\n", ctrl->type); 438 } 439 mutex_unlock(&ctrl_lock); 440 kfree(ctrl); 441 module_put(THIS_MODULE); 442 } 443 444 static int __queue_ctrl_work(int type) 445 { 446 struct server_ctrl_struct *ctrl; 447 448 ctrl = kmalloc_obj(struct server_ctrl_struct, KSMBD_DEFAULT_GFP); 449 if (!ctrl) 450 return -ENOMEM; 451 452 __module_get(THIS_MODULE); 453 ctrl->type = type; 454 INIT_WORK(&ctrl->ctrl_work, server_ctrl_handle_work); 455 queue_work(system_long_wq, &ctrl->ctrl_work); 456 return 0; 457 } 458 459 int server_queue_ctrl_init_work(void) 460 { 461 return __queue_ctrl_work(SERVER_CTRL_TYPE_INIT); 462 } 463 464 int server_queue_ctrl_reset_work(void) 465 { 466 return __queue_ctrl_work(SERVER_CTRL_TYPE_RESET); 467 } 468 469 static ssize_t stats_show(const struct class *class, const struct class_attribute *attr, 470 char *buf) 471 { 472 /* 473 * Inc this each time you change stats output format, 474 * so user space will know what to do. 475 */ 476 static int stats_version = 2; 477 static const char * const state[] = { 478 "startup", 479 "running", 480 "reset", 481 "shutdown" 482 }; 483 return sysfs_emit(buf, "%d %s %d %lu\n", stats_version, 484 state[server_conf.state], server_conf.tcp_port, 485 server_conf.ipc_last_active / HZ); 486 } 487 488 static ssize_t kill_server_store(const struct class *class, 489 const struct class_attribute *attr, const char *buf, 490 size_t len) 491 { 492 if (!sysfs_streq(buf, "hard")) 493 return len; 494 495 pr_info("kill command received\n"); 496 mutex_lock(&ctrl_lock); 497 WRITE_ONCE(server_conf.state, SERVER_STATE_RESETTING); 498 __module_get(THIS_MODULE); 499 server_ctrl_handle_reset(NULL); 500 module_put(THIS_MODULE); 501 mutex_unlock(&ctrl_lock); 502 return len; 503 } 504 505 static const char * const debug_type_strings[] = {"smb", "auth", "vfs", 506 "oplock", "ipc", "conn", 507 "rdma"}; 508 509 static ssize_t debug_show(const struct class *class, const struct class_attribute *attr, 510 char *buf) 511 { 512 ssize_t sz = 0; 513 int i, pos = 0; 514 515 for (i = 0; i < ARRAY_SIZE(debug_type_strings); i++) { 516 if ((ksmbd_debug_types >> i) & 1) { 517 pos = sysfs_emit_at(buf, sz, "[%s] ", debug_type_strings[i]); 518 } else { 519 pos = sysfs_emit_at(buf, sz, "%s ", debug_type_strings[i]); 520 } 521 sz += pos; 522 } 523 sz += sysfs_emit_at(buf, sz, "\n"); 524 return sz; 525 } 526 527 static ssize_t debug_store(const struct class *class, const struct class_attribute *attr, 528 const char *buf, size_t len) 529 { 530 int i; 531 532 for (i = 0; i < ARRAY_SIZE(debug_type_strings); i++) { 533 if (sysfs_streq(buf, "all")) { 534 if (ksmbd_debug_types == KSMBD_DEBUG_ALL) 535 ksmbd_debug_types = 0; 536 else 537 ksmbd_debug_types = KSMBD_DEBUG_ALL; 538 break; 539 } 540 541 if (sysfs_streq(buf, debug_type_strings[i])) { 542 if (ksmbd_debug_types & (1 << i)) 543 ksmbd_debug_types &= ~(1 << i); 544 else 545 ksmbd_debug_types |= (1 << i); 546 break; 547 } 548 } 549 550 return len; 551 } 552 553 static CLASS_ATTR_RO(stats); 554 static CLASS_ATTR_WO(kill_server); 555 static CLASS_ATTR_RW(debug); 556 557 static struct attribute *ksmbd_control_class_attrs[] = { 558 &class_attr_stats.attr, 559 &class_attr_kill_server.attr, 560 &class_attr_debug.attr, 561 NULL, 562 }; 563 ATTRIBUTE_GROUPS(ksmbd_control_class); 564 565 static struct class ksmbd_control_class = { 566 .name = "ksmbd-control", 567 .class_groups = ksmbd_control_class_groups, 568 }; 569 570 static int ksmbd_server_shutdown(void) 571 { 572 WRITE_ONCE(server_conf.state, SERVER_STATE_SHUTTING_DOWN); 573 574 ksmbd_proc_cleanup(); 575 class_unregister(&ksmbd_control_class); 576 ksmbd_workqueue_destroy(); 577 ksmbd_ipc_release(); 578 ksmbd_conn_transport_destroy(); 579 ksmbd_crypto_destroy(); 580 ksmbd_free_global_file_table(); 581 destroy_lease_table(NULL); 582 ksmbd_work_pool_destroy(); 583 ksmbd_exit_file_cache(); 584 server_conf_free(); 585 return 0; 586 } 587 588 static int __init ksmbd_server_init(void) 589 { 590 int ret; 591 592 ret = class_register(&ksmbd_control_class); 593 if (ret) { 594 pr_err("Unable to register ksmbd-control class\n"); 595 return ret; 596 } 597 598 ksmbd_proc_init(); 599 create_proc_sessions(); 600 601 ksmbd_server_tcp_callbacks_init(); 602 603 ret = server_conf_init(); 604 if (ret) 605 goto err_unregister; 606 607 ret = ksmbd_work_pool_init(); 608 if (ret) 609 goto err_unregister; 610 611 ret = ksmbd_init_file_cache(); 612 if (ret) 613 goto err_destroy_work_pools; 614 615 ret = ksmbd_ipc_init(); 616 if (ret) 617 goto err_exit_file_cache; 618 619 ret = ksmbd_init_global_file_table(); 620 if (ret) 621 goto err_ipc_release; 622 623 ret = ksmbd_inode_hash_init(); 624 if (ret) 625 goto err_destroy_file_table; 626 627 ret = ksmbd_crypto_create(); 628 if (ret) 629 goto err_release_inode_hash; 630 631 ret = ksmbd_workqueue_init(); 632 if (ret) 633 goto err_crypto_destroy; 634 635 ret = ksmbd_conn_wq_init(); 636 if (ret) 637 goto err_workqueue_destroy; 638 639 return 0; 640 641 err_workqueue_destroy: 642 ksmbd_workqueue_destroy(); 643 err_crypto_destroy: 644 ksmbd_crypto_destroy(); 645 err_release_inode_hash: 646 ksmbd_release_inode_hash(); 647 err_destroy_file_table: 648 ksmbd_free_global_file_table(); 649 err_ipc_release: 650 ksmbd_ipc_release(); 651 err_exit_file_cache: 652 ksmbd_exit_file_cache(); 653 err_destroy_work_pools: 654 ksmbd_work_pool_destroy(); 655 err_unregister: 656 class_unregister(&ksmbd_control_class); 657 658 return ret; 659 } 660 661 /** 662 * ksmbd_server_exit() - shutdown forker thread and free memory at module exit 663 */ 664 static void __exit ksmbd_server_exit(void) 665 { 666 ksmbd_server_shutdown(); 667 rcu_barrier(); 668 /* 669 * ksmbd_conn_put() defers the final release onto ksmbd_conn_wq, 670 * so drain it after rcu_barrier() has fired any pending RCU 671 * callbacks that may have queued a release. 672 */ 673 ksmbd_conn_wq_destroy(); 674 ksmbd_release_inode_hash(); 675 } 676 677 MODULE_AUTHOR("Namjae Jeon <linkinjeon@kernel.org>"); 678 MODULE_DESCRIPTION("Linux kernel CIFS/SMB SERVER"); 679 MODULE_LICENSE("GPL"); 680 MODULE_SOFTDEP("pre: nls"); 681 MODULE_SOFTDEP("pre: aes"); 682 MODULE_SOFTDEP("pre: aead2"); 683 MODULE_SOFTDEP("pre: ccm"); 684 MODULE_SOFTDEP("pre: gcm"); 685 module_init(ksmbd_server_init) 686 module_exit(ksmbd_server_exit) 687