1 // SPDX-License-Identifier: GPL-2.0-or-later 2 /* 3 * Copyright (C) 2016 Namjae Jeon <linkinjeon@kernel.org> 4 * Copyright (C) 2018 Samsung Electronics Co., Ltd. 5 */ 6 7 #include <crypto/utils.h> 8 #include <linux/inetdevice.h> 9 #include <net/addrconf.h> 10 #include <linux/syscalls.h> 11 #include <linux/namei.h> 12 #include <linux/statfs.h> 13 #include <linux/ethtool.h> 14 #include <linux/falloc.h> 15 #include <linux/mount.h> 16 #include <linux/filelock.h> 17 18 #include "glob.h" 19 #include "smbfsctl.h" 20 #include "oplock.h" 21 #include "smbacl.h" 22 23 #include "auth.h" 24 #include "asn1.h" 25 #include "connection.h" 26 #include "transport_ipc.h" 27 #include "../common/smbdirect/smbdirect.h" 28 #include "transport_rdma.h" 29 #include "vfs.h" 30 #include "vfs_cache.h" 31 #include "misc.h" 32 33 #include "server.h" 34 #include "smb_common.h" 35 #include "../common/smb2status.h" 36 #include "ksmbd_work.h" 37 #include "mgmt/user_config.h" 38 #include "mgmt/share_config.h" 39 #include "mgmt/tree_connect.h" 40 #include "mgmt/user_session.h" 41 #include "mgmt/ksmbd_ida.h" 42 #include "ndr.h" 43 #include "stats.h" 44 #include "transport_tcp.h" 45 46 static void __wbuf(struct ksmbd_work *work, void **req, void **rsp) 47 { 48 if (work->next_smb2_rcv_hdr_off) { 49 *req = ksmbd_req_buf_next(work); 50 *rsp = ksmbd_resp_buf_next(work); 51 } else { 52 *req = smb_get_msg(work->request_buf); 53 *rsp = smb_get_msg(work->response_buf); 54 } 55 } 56 57 #define WORK_BUFFERS(w, rq, rs) __wbuf((w), (void **)&(rq), (void **)&(rs)) 58 59 /** 60 * check_session_id() - check for valid session id in smb header 61 * @conn: connection instance 62 * @id: session id from smb header 63 * 64 * Return: 1 if valid session id, otherwise 0 65 */ 66 static inline bool check_session_id(struct ksmbd_conn *conn, u64 id) 67 { 68 struct ksmbd_session *sess; 69 70 if (id == 0 || id == -1) 71 return false; 72 73 sess = ksmbd_session_lookup_all(conn, id); 74 if (sess) { 75 ksmbd_user_session_put(sess); 76 return true; 77 } 78 pr_err("Invalid user session id: %llu\n", id); 79 return false; 80 } 81 82 struct channel *lookup_chann_list(struct ksmbd_session *sess, struct ksmbd_conn *conn) 83 { 84 struct channel *chann; 85 86 down_read(&sess->chann_lock); 87 chann = xa_load(&sess->ksmbd_chann_list, (long)conn); 88 up_read(&sess->chann_lock); 89 90 return chann; 91 } 92 93 /** 94 * smb2_get_ksmbd_tcon() - get tree connection information using a tree id. 95 * @work: smb work 96 * 97 * Return: 0 if there is a tree connection matched or these are 98 * skipable commands, otherwise error 99 */ 100 int smb2_get_ksmbd_tcon(struct ksmbd_work *work) 101 { 102 struct smb2_hdr *req_hdr = ksmbd_req_buf_next(work); 103 unsigned int cmd = le16_to_cpu(req_hdr->Command); 104 unsigned int tree_id; 105 106 if (cmd == SMB2_TREE_CONNECT_HE || 107 cmd == SMB2_CANCEL_HE || 108 cmd == SMB2_LOGOFF_HE) { 109 ksmbd_debug(SMB, "skip to check tree connect request\n"); 110 return 0; 111 } 112 113 if (xa_empty(&work->sess->tree_conns)) { 114 ksmbd_debug(SMB, "NO tree connected\n"); 115 return -ENOENT; 116 } 117 118 tree_id = le32_to_cpu(req_hdr->Id.SyncId.TreeId); 119 120 /* 121 * If request is not the first in Compound request, 122 * Just validate tree id in header with work->tcon->id. 123 */ 124 if (work->next_smb2_rcv_hdr_off) { 125 if (!work->tcon) { 126 pr_err("The first operation in the compound does not have tcon\n"); 127 return -EINVAL; 128 } 129 if (tree_id != UINT_MAX && work->tcon->id != tree_id) { 130 pr_err("tree id(%u) is different with id(%u) in first operation\n", 131 tree_id, work->tcon->id); 132 return -EINVAL; 133 } 134 return 1; 135 } 136 137 work->tcon = ksmbd_tree_conn_lookup(work->sess, tree_id); 138 if (!work->tcon) { 139 pr_err("Invalid tid %d\n", tree_id); 140 return -ENOENT; 141 } 142 143 return 1; 144 } 145 146 /** 147 * smb2_set_err_rsp() - set error response code on smb response 148 * @work: smb work containing response buffer 149 */ 150 void smb2_set_err_rsp(struct ksmbd_work *work) 151 { 152 struct smb2_err_rsp *err_rsp; 153 154 if (work->next_smb2_rcv_hdr_off) 155 err_rsp = ksmbd_resp_buf_next(work); 156 else 157 err_rsp = smb_get_msg(work->response_buf); 158 159 if (err_rsp->hdr.Status != STATUS_STOPPED_ON_SYMLINK) { 160 int err; 161 162 err_rsp->StructureSize = SMB2_ERROR_STRUCTURE_SIZE2_LE; 163 err_rsp->ErrorContextCount = 0; 164 err_rsp->Reserved = 0; 165 err_rsp->ByteCount = 0; 166 err_rsp->ErrorData[0] = 0; 167 err = ksmbd_iov_pin_rsp(work, (void *)err_rsp, 168 __SMB2_HEADER_STRUCTURE_SIZE + 169 SMB2_ERROR_STRUCTURE_SIZE2); 170 if (err) 171 work->send_no_response = 1; 172 } 173 } 174 175 /** 176 * is_smb2_neg_cmd() - is it smb2 negotiation command 177 * @work: smb work containing smb header 178 * 179 * Return: true if smb2 negotiation command, otherwise false 180 */ 181 bool is_smb2_neg_cmd(struct ksmbd_work *work) 182 { 183 struct smb2_hdr *hdr = smb_get_msg(work->request_buf); 184 185 /* is it SMB2 header ? */ 186 if (hdr->ProtocolId != SMB2_PROTO_NUMBER) 187 return false; 188 189 /* make sure it is request not response message */ 190 if (hdr->Flags & SMB2_FLAGS_SERVER_TO_REDIR) 191 return false; 192 193 if (hdr->Command != SMB2_NEGOTIATE) 194 return false; 195 196 return true; 197 } 198 199 /** 200 * is_smb2_rsp() - is it smb2 response 201 * @work: smb work containing smb response buffer 202 * 203 * Return: true if smb2 response, otherwise false 204 */ 205 bool is_smb2_rsp(struct ksmbd_work *work) 206 { 207 struct smb2_hdr *hdr = smb_get_msg(work->response_buf); 208 209 /* is it SMB2 header ? */ 210 if (hdr->ProtocolId != SMB2_PROTO_NUMBER) 211 return false; 212 213 /* make sure it is response not request message */ 214 if (!(hdr->Flags & SMB2_FLAGS_SERVER_TO_REDIR)) 215 return false; 216 217 return true; 218 } 219 220 /** 221 * get_smb2_cmd_val() - get smb command code from smb header 222 * @work: smb work containing smb request buffer 223 * 224 * Return: smb2 request command value 225 */ 226 u16 get_smb2_cmd_val(struct ksmbd_work *work) 227 { 228 struct smb2_hdr *rcv_hdr; 229 230 if (work->next_smb2_rcv_hdr_off) 231 rcv_hdr = ksmbd_req_buf_next(work); 232 else 233 rcv_hdr = smb_get_msg(work->request_buf); 234 return le16_to_cpu(rcv_hdr->Command); 235 } 236 237 /** 238 * set_smb2_rsp_status() - set error response code on smb2 header 239 * @work: smb work containing response buffer 240 * @err: error response code 241 */ 242 void set_smb2_rsp_status(struct ksmbd_work *work, __le32 err) 243 { 244 struct smb2_hdr *rsp_hdr; 245 246 rsp_hdr = smb_get_msg(work->response_buf); 247 rsp_hdr->Status = err; 248 249 work->iov_idx = 0; 250 work->iov_cnt = 0; 251 work->next_smb2_rcv_hdr_off = 0; 252 smb2_set_err_rsp(work); 253 } 254 255 /** 256 * init_smb2_neg_rsp() - initialize smb2 response for negotiate command 257 * @work: smb work containing smb request buffer 258 * 259 * smb2 negotiate response is sent in reply of smb1 negotiate command for 260 * dialect auto-negotiation. 261 */ 262 int init_smb2_neg_rsp(struct ksmbd_work *work) 263 { 264 struct smb2_hdr *rsp_hdr; 265 struct smb2_negotiate_rsp *rsp; 266 struct ksmbd_conn *conn = work->conn; 267 int err; 268 269 rsp_hdr = smb_get_msg(work->response_buf); 270 memset(rsp_hdr, 0, sizeof(struct smb2_hdr) + 2); 271 rsp_hdr->ProtocolId = SMB2_PROTO_NUMBER; 272 rsp_hdr->StructureSize = SMB2_HEADER_STRUCTURE_SIZE; 273 rsp_hdr->CreditRequest = cpu_to_le16(2); 274 rsp_hdr->Command = SMB2_NEGOTIATE; 275 rsp_hdr->Flags = (SMB2_FLAGS_SERVER_TO_REDIR); 276 rsp_hdr->NextCommand = 0; 277 rsp_hdr->MessageId = 0; 278 rsp_hdr->Id.SyncId.ProcessId = 0; 279 rsp_hdr->Id.SyncId.TreeId = 0; 280 rsp_hdr->SessionId = 0; 281 memset(rsp_hdr->Signature, 0, 16); 282 283 rsp = smb_get_msg(work->response_buf); 284 285 WARN_ON(ksmbd_conn_good(conn)); 286 287 rsp->StructureSize = cpu_to_le16(65); 288 ksmbd_debug(SMB, "conn->dialect 0x%x\n", conn->dialect); 289 rsp->DialectRevision = cpu_to_le16(conn->dialect); 290 /* Not setting conn guid rsp->ServerGUID, as it 291 * not used by client for identifying connection 292 */ 293 rsp->Capabilities = cpu_to_le32(conn->vals->req_capabilities); 294 /* Default Max Message Size till SMB2.0, 64K*/ 295 rsp->MaxTransactSize = cpu_to_le32(conn->vals->max_trans_size); 296 rsp->MaxReadSize = cpu_to_le32(conn->vals->max_read_size); 297 rsp->MaxWriteSize = cpu_to_le32(conn->vals->max_write_size); 298 299 rsp->SystemTime = cpu_to_le64(ksmbd_systime()); 300 rsp->ServerStartTime = 0; 301 302 rsp->SecurityBufferOffset = cpu_to_le16(128); 303 rsp->SecurityBufferLength = cpu_to_le16(AUTH_GSS_LENGTH); 304 ksmbd_copy_gss_neg_header((char *)(&rsp->hdr) + 305 le16_to_cpu(rsp->SecurityBufferOffset)); 306 rsp->SecurityMode = SMB2_NEGOTIATE_SIGNING_ENABLED_LE; 307 if (server_conf.signing == KSMBD_CONFIG_OPT_MANDATORY) 308 rsp->SecurityMode |= SMB2_NEGOTIATE_SIGNING_REQUIRED_LE; 309 err = ksmbd_iov_pin_rsp(work, rsp, 310 sizeof(struct smb2_negotiate_rsp) + AUTH_GSS_LENGTH); 311 if (err) 312 return err; 313 conn->use_spnego = true; 314 315 ksmbd_conn_set_need_negotiate(conn); 316 return 0; 317 } 318 319 /** 320 * smb2_set_rsp_credits() - set number of credits in response buffer 321 * @work: smb work containing smb response buffer 322 */ 323 int smb2_set_rsp_credits(struct ksmbd_work *work) 324 { 325 struct smb2_hdr *req_hdr = ksmbd_req_buf_next(work); 326 struct smb2_hdr *hdr = ksmbd_resp_buf_next(work); 327 struct ksmbd_conn *conn = work->conn; 328 unsigned short credits_requested, aux_max; 329 unsigned short credit_charge, credits_granted = 0; 330 331 if (work->send_no_response) 332 return 0; 333 334 hdr->CreditCharge = req_hdr->CreditCharge; 335 336 if (conn->total_credits > conn->vals->max_credits) { 337 hdr->CreditRequest = 0; 338 pr_err("Total credits overflow: %d\n", conn->total_credits); 339 return -EINVAL; 340 } 341 342 credit_charge = max_t(unsigned short, 343 le16_to_cpu(req_hdr->CreditCharge), 1); 344 if (credit_charge > conn->total_credits) { 345 ksmbd_debug(SMB, "Insufficient credits granted, given: %u, granted: %u\n", 346 credit_charge, conn->total_credits); 347 return -EINVAL; 348 } 349 350 conn->total_credits -= credit_charge; 351 conn->outstanding_credits -= credit_charge; 352 credits_requested = max_t(unsigned short, 353 le16_to_cpu(req_hdr->CreditRequest), 1); 354 355 /* according to smb2.credits smbtorture, Windows server 356 * 2016 or later grant up to 8192 credits at once. 357 * 358 * TODO: Need to adjuct CreditRequest value according to 359 * current cpu load 360 */ 361 if (hdr->Command == SMB2_NEGOTIATE) 362 aux_max = 1; 363 else 364 aux_max = conn->vals->max_credits - conn->total_credits; 365 credits_granted = min_t(unsigned short, credits_requested, aux_max); 366 367 conn->total_credits += credits_granted; 368 work->credits_granted += credits_granted; 369 370 if (!req_hdr->NextCommand) { 371 /* Update CreditRequest in last request */ 372 hdr->CreditRequest = cpu_to_le16(work->credits_granted); 373 } 374 ksmbd_debug(SMB, 375 "credits: requested[%d] granted[%d] total_granted[%d]\n", 376 credits_requested, credits_granted, 377 conn->total_credits); 378 return 0; 379 } 380 381 /** 382 * init_chained_smb2_rsp() - initialize smb2 chained response 383 * @work: smb work containing smb response buffer 384 */ 385 static void init_chained_smb2_rsp(struct ksmbd_work *work) 386 { 387 struct smb2_hdr *req = ksmbd_req_buf_next(work); 388 struct smb2_hdr *rsp = ksmbd_resp_buf_next(work); 389 struct smb2_hdr *rsp_hdr; 390 struct smb2_hdr *rcv_hdr; 391 int next_hdr_offset = 0; 392 int len, new_len; 393 394 /* Len of this response = updated RFC len - offset of previous cmd 395 * in the compound rsp 396 */ 397 398 /* Storing the current local FID which may be needed by subsequent 399 * command in the compound request 400 */ 401 if (req->Command == SMB2_CREATE && rsp->Status == STATUS_SUCCESS) { 402 work->compound_fid = ((struct smb2_create_rsp *)rsp)->VolatileFileId; 403 work->compound_pfid = ((struct smb2_create_rsp *)rsp)->PersistentFileId; 404 work->compound_sid = le64_to_cpu(rsp->SessionId); 405 } 406 407 len = get_rfc1002_len(work->response_buf) - work->next_smb2_rsp_hdr_off; 408 next_hdr_offset = le32_to_cpu(req->NextCommand); 409 410 new_len = ALIGN(len, 8); 411 work->iov[work->iov_idx].iov_len += (new_len - len); 412 inc_rfc1001_len(work->response_buf, new_len - len); 413 rsp->NextCommand = cpu_to_le32(new_len); 414 415 work->next_smb2_rcv_hdr_off += next_hdr_offset; 416 work->curr_smb2_rsp_hdr_off = work->next_smb2_rsp_hdr_off; 417 work->next_smb2_rsp_hdr_off += new_len; 418 ksmbd_debug(SMB, 419 "Compound req new_len = %d rcv off = %d rsp off = %d\n", 420 new_len, work->next_smb2_rcv_hdr_off, 421 work->next_smb2_rsp_hdr_off); 422 423 rsp_hdr = ksmbd_resp_buf_next(work); 424 rcv_hdr = ksmbd_req_buf_next(work); 425 426 if (!(rcv_hdr->Flags & SMB2_FLAGS_RELATED_OPERATIONS)) { 427 ksmbd_debug(SMB, "related flag should be set\n"); 428 work->compound_fid = KSMBD_NO_FID; 429 work->compound_pfid = KSMBD_NO_FID; 430 } 431 memset((char *)rsp_hdr, 0, sizeof(struct smb2_hdr) + 2); 432 rsp_hdr->ProtocolId = SMB2_PROTO_NUMBER; 433 rsp_hdr->StructureSize = SMB2_HEADER_STRUCTURE_SIZE; 434 rsp_hdr->Command = rcv_hdr->Command; 435 436 /* 437 * Message is response. We don't grant oplock yet. 438 */ 439 rsp_hdr->Flags = (SMB2_FLAGS_SERVER_TO_REDIR | 440 SMB2_FLAGS_RELATED_OPERATIONS); 441 rsp_hdr->NextCommand = 0; 442 rsp_hdr->MessageId = rcv_hdr->MessageId; 443 rsp_hdr->Id.SyncId.ProcessId = rcv_hdr->Id.SyncId.ProcessId; 444 rsp_hdr->Id.SyncId.TreeId = rcv_hdr->Id.SyncId.TreeId; 445 rsp_hdr->SessionId = rcv_hdr->SessionId; 446 memcpy(rsp_hdr->Signature, rcv_hdr->Signature, 16); 447 } 448 449 /** 450 * is_chained_smb2_message() - check for chained command 451 * @work: smb work containing smb request buffer 452 * 453 * Return: true if chained request, otherwise false 454 */ 455 bool is_chained_smb2_message(struct ksmbd_work *work) 456 { 457 struct smb2_hdr *hdr = smb_get_msg(work->request_buf); 458 unsigned int len, next_cmd; 459 460 if (hdr->ProtocolId != SMB2_PROTO_NUMBER) 461 return false; 462 463 hdr = ksmbd_req_buf_next(work); 464 next_cmd = le32_to_cpu(hdr->NextCommand); 465 if (next_cmd > 0) { 466 if ((u64)work->next_smb2_rcv_hdr_off + next_cmd + 467 __SMB2_HEADER_STRUCTURE_SIZE > 468 get_rfc1002_len(work->request_buf)) { 469 pr_err("next command(%u) offset exceeds smb msg size\n", 470 next_cmd); 471 return false; 472 } 473 474 if ((u64)get_rfc1002_len(work->response_buf) + MAX_CIFS_SMALL_BUFFER_SIZE > 475 work->response_sz) { 476 pr_err("next response offset exceeds response buffer size\n"); 477 return false; 478 } 479 480 ksmbd_debug(SMB, "got SMB2 chained command\n"); 481 init_chained_smb2_rsp(work); 482 return true; 483 } else if (work->next_smb2_rcv_hdr_off) { 484 /* 485 * This is last request in chained command, 486 * align response to 8 byte 487 */ 488 len = ALIGN(get_rfc1002_len(work->response_buf), 8); 489 len = len - get_rfc1002_len(work->response_buf); 490 if (len) { 491 ksmbd_debug(SMB, "padding len %u\n", len); 492 work->iov[work->iov_idx].iov_len += len; 493 inc_rfc1001_len(work->response_buf, len); 494 } 495 work->curr_smb2_rsp_hdr_off = work->next_smb2_rsp_hdr_off; 496 } 497 return false; 498 } 499 500 /** 501 * init_smb2_rsp_hdr() - initialize smb2 response 502 * @work: smb work containing smb request buffer 503 * 504 * Return: 0 505 */ 506 int init_smb2_rsp_hdr(struct ksmbd_work *work) 507 { 508 struct smb2_hdr *rsp_hdr = smb_get_msg(work->response_buf); 509 struct smb2_hdr *rcv_hdr = smb_get_msg(work->request_buf); 510 511 memset(rsp_hdr, 0, sizeof(struct smb2_hdr) + 2); 512 rsp_hdr->ProtocolId = rcv_hdr->ProtocolId; 513 rsp_hdr->StructureSize = SMB2_HEADER_STRUCTURE_SIZE; 514 rsp_hdr->Command = rcv_hdr->Command; 515 516 /* 517 * Message is response. We don't grant oplock yet. 518 */ 519 rsp_hdr->Flags = (SMB2_FLAGS_SERVER_TO_REDIR); 520 rsp_hdr->NextCommand = 0; 521 rsp_hdr->MessageId = rcv_hdr->MessageId; 522 rsp_hdr->Id.SyncId.ProcessId = rcv_hdr->Id.SyncId.ProcessId; 523 rsp_hdr->Id.SyncId.TreeId = rcv_hdr->Id.SyncId.TreeId; 524 rsp_hdr->SessionId = rcv_hdr->SessionId; 525 memcpy(rsp_hdr->Signature, rcv_hdr->Signature, 16); 526 527 return 0; 528 } 529 530 /** 531 * smb2_allocate_rsp_buf() - allocate smb2 response buffer 532 * @work: smb work containing smb request buffer 533 * 534 * Return: 0 on success, otherwise error 535 */ 536 int smb2_allocate_rsp_buf(struct ksmbd_work *work) 537 { 538 struct smb2_hdr *hdr = smb_get_msg(work->request_buf); 539 size_t small_sz = MAX_CIFS_SMALL_BUFFER_SIZE; 540 size_t large_sz = small_sz + work->conn->vals->max_trans_size; 541 size_t sz = small_sz; 542 int cmd = le16_to_cpu(hdr->Command); 543 544 if (cmd == SMB2_IOCTL_HE || cmd == SMB2_QUERY_DIRECTORY_HE) 545 sz = large_sz; 546 547 if (cmd == SMB2_QUERY_INFO_HE) { 548 struct smb2_query_info_req *req; 549 550 if (get_rfc1002_len(work->request_buf) < 551 offsetof(struct smb2_query_info_req, OutputBufferLength)) 552 return -EINVAL; 553 554 req = smb_get_msg(work->request_buf); 555 if ((req->InfoType == SMB2_O_INFO_FILE && 556 (req->FileInfoClass == FILE_FULL_EA_INFORMATION || 557 req->FileInfoClass == FILE_ALL_INFORMATION)) || 558 req->InfoType == SMB2_O_INFO_SECURITY) 559 sz = large_sz; 560 } 561 562 /* allocate large response buf for chained commands */ 563 if (le32_to_cpu(hdr->NextCommand) > 0) 564 sz = large_sz; 565 566 work->response_buf = kvzalloc(sz, KSMBD_DEFAULT_GFP); 567 if (!work->response_buf) 568 return -ENOMEM; 569 570 work->response_sz = sz; 571 return 0; 572 } 573 574 /** 575 * smb2_check_user_session() - check for valid session for a user 576 * @work: smb work containing smb request buffer 577 * 578 * Return: 0 on success, otherwise error 579 */ 580 int smb2_check_user_session(struct ksmbd_work *work) 581 { 582 struct smb2_hdr *req_hdr = ksmbd_req_buf_next(work); 583 struct ksmbd_conn *conn = work->conn; 584 unsigned int cmd = le16_to_cpu(req_hdr->Command); 585 unsigned long long sess_id; 586 587 /* 588 * SMB2_ECHO, SMB2_NEGOTIATE, SMB2_SESSION_SETUP command do not 589 * require a session id, so no need to validate user session's for 590 * these commands. 591 */ 592 if (cmd == SMB2_ECHO_HE || cmd == SMB2_NEGOTIATE_HE || 593 cmd == SMB2_SESSION_SETUP_HE) 594 return 0; 595 596 if (!ksmbd_conn_good(conn)) 597 return -EIO; 598 599 sess_id = le64_to_cpu(req_hdr->SessionId); 600 601 /* 602 * If request is not the first in Compound request, 603 * Just validate session id in header with work->sess->id. 604 */ 605 if (work->next_smb2_rcv_hdr_off) { 606 if (!work->sess) { 607 pr_err("The first operation in the compound does not have sess\n"); 608 return -EINVAL; 609 } 610 if (sess_id != ULLONG_MAX && work->sess->id != sess_id) { 611 pr_err("session id(%llu) is different with the first operation(%lld)\n", 612 sess_id, work->sess->id); 613 return -EINVAL; 614 } 615 return 1; 616 } 617 618 /* Check for validity of user session */ 619 work->sess = ksmbd_session_lookup_all(conn, sess_id); 620 if (work->sess) 621 return 1; 622 ksmbd_debug(SMB, "Invalid user session, Uid %llu\n", sess_id); 623 return -ENOENT; 624 } 625 626 /** 627 * smb2_get_name() - get filename string from on the wire smb format 628 * @src: source buffer 629 * @maxlen: maxlen of source string 630 * @local_nls: nls_table pointer 631 * 632 * Return: matching converted filename on success, otherwise error ptr 633 */ 634 static char * 635 smb2_get_name(const char *src, const int maxlen, struct nls_table *local_nls) 636 { 637 char *name; 638 639 name = smb_strndup_from_utf16(src, maxlen, 1, local_nls); 640 if (IS_ERR(name)) { 641 pr_err("failed to get name %ld\n", PTR_ERR(name)); 642 return name; 643 } 644 645 if (*name == '\0') { 646 kfree(name); 647 return ERR_PTR(-EINVAL); 648 } 649 650 if (*name == '\\') { 651 pr_err("not allow directory name included leading slash\n"); 652 kfree(name); 653 return ERR_PTR(-EINVAL); 654 } 655 656 ksmbd_conv_path_to_unix(name); 657 ksmbd_strip_last_slash(name); 658 return name; 659 } 660 661 int setup_async_work(struct ksmbd_work *work, void (*fn)(void **), void **arg) 662 { 663 struct ksmbd_conn *conn = work->conn; 664 int id; 665 666 id = ksmbd_acquire_async_msg_id(&conn->async_ida); 667 if (id < 0) { 668 pr_err("Failed to alloc async message id\n"); 669 return id; 670 } 671 work->asynchronous = true; 672 work->async_id = id; 673 674 ksmbd_debug(SMB, 675 "Send interim Response to inform async request id : %d\n", 676 work->async_id); 677 678 work->cancel_fn = fn; 679 work->cancel_argv = arg; 680 681 if (list_empty(&work->async_request_entry)) { 682 spin_lock(&conn->request_lock); 683 list_add_tail(&work->async_request_entry, &conn->async_requests); 684 spin_unlock(&conn->request_lock); 685 } 686 687 return 0; 688 } 689 690 void release_async_work(struct ksmbd_work *work) 691 { 692 struct ksmbd_conn *conn = work->conn; 693 694 spin_lock(&conn->request_lock); 695 list_del_init(&work->async_request_entry); 696 spin_unlock(&conn->request_lock); 697 698 work->asynchronous = 0; 699 work->cancel_fn = NULL; 700 kfree(work->cancel_argv); 701 work->cancel_argv = NULL; 702 if (work->async_id) { 703 ksmbd_release_id(&conn->async_ida, work->async_id); 704 work->async_id = 0; 705 } 706 } 707 708 void smb2_send_interim_resp(struct ksmbd_work *work, __le32 status) 709 { 710 struct smb2_hdr *rsp_hdr; 711 struct ksmbd_work *in_work = ksmbd_alloc_work_struct(); 712 713 if (!in_work) 714 return; 715 716 if (allocate_interim_rsp_buf(in_work)) { 717 pr_err("smb_allocate_rsp_buf failed!\n"); 718 ksmbd_free_work_struct(in_work); 719 return; 720 } 721 722 in_work->conn = work->conn; 723 memcpy(smb_get_msg(in_work->response_buf), ksmbd_resp_buf_next(work), 724 __SMB2_HEADER_STRUCTURE_SIZE); 725 726 rsp_hdr = smb_get_msg(in_work->response_buf); 727 rsp_hdr->Flags |= SMB2_FLAGS_ASYNC_COMMAND; 728 rsp_hdr->Id.AsyncId = cpu_to_le64(work->async_id); 729 smb2_set_err_rsp(in_work); 730 rsp_hdr->Status = status; 731 732 ksmbd_conn_write(in_work); 733 ksmbd_free_work_struct(in_work); 734 } 735 736 static __le32 smb2_get_reparse_tag_special_file(umode_t mode) 737 { 738 if (S_ISDIR(mode) || S_ISREG(mode)) 739 return 0; 740 741 if (S_ISLNK(mode)) 742 return IO_REPARSE_TAG_LX_SYMLINK_LE; 743 else if (S_ISFIFO(mode)) 744 return IO_REPARSE_TAG_LX_FIFO_LE; 745 else if (S_ISSOCK(mode)) 746 return IO_REPARSE_TAG_AF_UNIX_LE; 747 else if (S_ISCHR(mode)) 748 return IO_REPARSE_TAG_LX_CHR_LE; 749 else if (S_ISBLK(mode)) 750 return IO_REPARSE_TAG_LX_BLK_LE; 751 752 return 0; 753 } 754 755 /** 756 * smb2_get_dos_mode() - get file mode in dos format from unix mode 757 * @stat: kstat containing file mode 758 * @attribute: attribute flags 759 * 760 * Return: converted dos mode 761 */ 762 static int smb2_get_dos_mode(struct kstat *stat, int attribute) 763 { 764 int attr = 0; 765 766 if (S_ISDIR(stat->mode)) { 767 attr = FILE_ATTRIBUTE_DIRECTORY | 768 (attribute & (FILE_ATTRIBUTE_HIDDEN | FILE_ATTRIBUTE_SYSTEM)); 769 } else { 770 attr = (attribute & 0x00005137) | FILE_ATTRIBUTE_ARCHIVE; 771 attr &= ~(FILE_ATTRIBUTE_DIRECTORY); 772 if (S_ISREG(stat->mode) && (server_conf.share_fake_fscaps & 773 FILE_SUPPORTS_SPARSE_FILES)) 774 attr |= FILE_ATTRIBUTE_SPARSE_FILE; 775 776 if (smb2_get_reparse_tag_special_file(stat->mode)) 777 attr |= FILE_ATTRIBUTE_REPARSE_POINT; 778 } 779 780 return attr; 781 } 782 783 static void build_preauth_ctxt(struct smb2_preauth_neg_context *pneg_ctxt, 784 __le16 hash_id) 785 { 786 pneg_ctxt->ContextType = SMB2_PREAUTH_INTEGRITY_CAPABILITIES; 787 pneg_ctxt->DataLength = cpu_to_le16(38); 788 pneg_ctxt->HashAlgorithmCount = cpu_to_le16(1); 789 pneg_ctxt->Reserved = cpu_to_le32(0); 790 pneg_ctxt->SaltLength = cpu_to_le16(SMB311_SALT_SIZE); 791 get_random_bytes(pneg_ctxt->Salt, SMB311_SALT_SIZE); 792 pneg_ctxt->HashAlgorithms = hash_id; 793 } 794 795 static void build_encrypt_ctxt(struct smb2_encryption_neg_context *pneg_ctxt, 796 __le16 cipher_type) 797 { 798 pneg_ctxt->ContextType = SMB2_ENCRYPTION_CAPABILITIES; 799 pneg_ctxt->DataLength = cpu_to_le16(4); 800 pneg_ctxt->Reserved = cpu_to_le32(0); 801 pneg_ctxt->CipherCount = cpu_to_le16(1); 802 pneg_ctxt->Ciphers[0] = cipher_type; 803 } 804 805 static void build_sign_cap_ctxt(struct smb2_signing_capabilities *pneg_ctxt, 806 __le16 sign_algo) 807 { 808 pneg_ctxt->ContextType = SMB2_SIGNING_CAPABILITIES; 809 pneg_ctxt->DataLength = 810 cpu_to_le16((sizeof(struct smb2_signing_capabilities) + 2) 811 - sizeof(struct smb2_neg_context)); 812 pneg_ctxt->Reserved = cpu_to_le32(0); 813 pneg_ctxt->SigningAlgorithmCount = cpu_to_le16(1); 814 pneg_ctxt->SigningAlgorithms[0] = sign_algo; 815 } 816 817 static void build_posix_ctxt(struct smb2_posix_neg_context *pneg_ctxt) 818 { 819 pneg_ctxt->ContextType = SMB2_POSIX_EXTENSIONS_AVAILABLE; 820 pneg_ctxt->DataLength = cpu_to_le16(POSIX_CTXT_DATA_LEN); 821 /* SMB2_CREATE_TAG_POSIX is "0x93AD25509CB411E7B42383DE968BCD7C" */ 822 pneg_ctxt->Name[0] = 0x93; 823 pneg_ctxt->Name[1] = 0xAD; 824 pneg_ctxt->Name[2] = 0x25; 825 pneg_ctxt->Name[3] = 0x50; 826 pneg_ctxt->Name[4] = 0x9C; 827 pneg_ctxt->Name[5] = 0xB4; 828 pneg_ctxt->Name[6] = 0x11; 829 pneg_ctxt->Name[7] = 0xE7; 830 pneg_ctxt->Name[8] = 0xB4; 831 pneg_ctxt->Name[9] = 0x23; 832 pneg_ctxt->Name[10] = 0x83; 833 pneg_ctxt->Name[11] = 0xDE; 834 pneg_ctxt->Name[12] = 0x96; 835 pneg_ctxt->Name[13] = 0x8B; 836 pneg_ctxt->Name[14] = 0xCD; 837 pneg_ctxt->Name[15] = 0x7C; 838 } 839 840 static unsigned int assemble_neg_contexts(struct ksmbd_conn *conn, 841 struct smb2_negotiate_rsp *rsp) 842 { 843 char * const pneg_ctxt = (char *)rsp + 844 le32_to_cpu(rsp->NegotiateContextOffset); 845 int neg_ctxt_cnt = 1; 846 int ctxt_size; 847 848 ksmbd_debug(SMB, 849 "assemble SMB2_PREAUTH_INTEGRITY_CAPABILITIES context\n"); 850 build_preauth_ctxt((struct smb2_preauth_neg_context *)pneg_ctxt, 851 conn->preauth_info->Preauth_HashId); 852 ctxt_size = sizeof(struct smb2_preauth_neg_context); 853 854 if (conn->cipher_type) { 855 /* Round to 8 byte boundary */ 856 ctxt_size = round_up(ctxt_size, 8); 857 ksmbd_debug(SMB, 858 "assemble SMB2_ENCRYPTION_CAPABILITIES context\n"); 859 build_encrypt_ctxt((struct smb2_encryption_neg_context *) 860 (pneg_ctxt + ctxt_size), 861 conn->cipher_type); 862 neg_ctxt_cnt++; 863 ctxt_size += sizeof(struct smb2_encryption_neg_context) + 2; 864 } 865 866 /* compression context not yet supported */ 867 WARN_ON(conn->compress_algorithm != SMB3_COMPRESS_NONE); 868 869 if (conn->posix_ext_supported) { 870 ctxt_size = round_up(ctxt_size, 8); 871 ksmbd_debug(SMB, 872 "assemble SMB2_POSIX_EXTENSIONS_AVAILABLE context\n"); 873 build_posix_ctxt((struct smb2_posix_neg_context *) 874 (pneg_ctxt + ctxt_size)); 875 neg_ctxt_cnt++; 876 ctxt_size += sizeof(struct smb2_posix_neg_context); 877 } 878 879 if (conn->signing_negotiated) { 880 ctxt_size = round_up(ctxt_size, 8); 881 ksmbd_debug(SMB, 882 "assemble SMB2_SIGNING_CAPABILITIES context\n"); 883 build_sign_cap_ctxt((struct smb2_signing_capabilities *) 884 (pneg_ctxt + ctxt_size), 885 conn->signing_algorithm); 886 neg_ctxt_cnt++; 887 ctxt_size += sizeof(struct smb2_signing_capabilities) + 2; 888 } 889 890 rsp->NegotiateContextCount = cpu_to_le16(neg_ctxt_cnt); 891 return ctxt_size + AUTH_GSS_PADDING; 892 } 893 894 static __le32 decode_preauth_ctxt(struct ksmbd_conn *conn, 895 struct smb2_preauth_neg_context *pneg_ctxt, 896 int ctxt_len) 897 { 898 /* 899 * sizeof(smb2_preauth_neg_context) assumes SMB311_SALT_SIZE Salt, 900 * which may not be present. Only check for used HashAlgorithms[1]. 901 */ 902 if (ctxt_len < 903 sizeof(struct smb2_neg_context) + MIN_PREAUTH_CTXT_DATA_LEN) 904 return STATUS_INVALID_PARAMETER; 905 906 if (pneg_ctxt->HashAlgorithms != SMB2_PREAUTH_INTEGRITY_SHA512) 907 return STATUS_SMB_NO_PREAUTH_INTEGRITY_HASH_OVERLAP; 908 909 conn->preauth_info->Preauth_HashId = SMB2_PREAUTH_INTEGRITY_SHA512; 910 return STATUS_SUCCESS; 911 } 912 913 static void decode_encrypt_ctxt(struct ksmbd_conn *conn, 914 struct smb2_encryption_neg_context *pneg_ctxt, 915 int ctxt_len) 916 { 917 int cph_cnt; 918 int i, cphs_size; 919 920 if (sizeof(struct smb2_encryption_neg_context) > ctxt_len) { 921 pr_err("Invalid SMB2_ENCRYPTION_CAPABILITIES context size\n"); 922 return; 923 } 924 925 conn->cipher_type = 0; 926 927 cph_cnt = le16_to_cpu(pneg_ctxt->CipherCount); 928 cphs_size = cph_cnt * sizeof(__le16); 929 930 if (sizeof(struct smb2_encryption_neg_context) + cphs_size > 931 ctxt_len) { 932 pr_err("Invalid cipher count(%d)\n", cph_cnt); 933 return; 934 } 935 936 if (server_conf.flags & KSMBD_GLOBAL_FLAG_SMB2_ENCRYPTION_OFF) 937 return; 938 939 for (i = 0; i < cph_cnt; i++) { 940 if (pneg_ctxt->Ciphers[i] == SMB2_ENCRYPTION_AES128_GCM || 941 pneg_ctxt->Ciphers[i] == SMB2_ENCRYPTION_AES128_CCM || 942 pneg_ctxt->Ciphers[i] == SMB2_ENCRYPTION_AES256_CCM || 943 pneg_ctxt->Ciphers[i] == SMB2_ENCRYPTION_AES256_GCM) { 944 ksmbd_debug(SMB, "Cipher ID = 0x%x\n", 945 pneg_ctxt->Ciphers[i]); 946 conn->cipher_type = pneg_ctxt->Ciphers[i]; 947 break; 948 } 949 } 950 } 951 952 /** 953 * smb3_encryption_negotiated() - checks if server and client agreed on enabling encryption 954 * @conn: smb connection 955 * 956 * Return: true if connection should be encrypted, else false 957 */ 958 bool smb3_encryption_negotiated(struct ksmbd_conn *conn) 959 { 960 if (!conn->ops->generate_encryptionkey) 961 return false; 962 963 /* 964 * SMB 3.0 and 3.0.2 dialects use the SMB2_GLOBAL_CAP_ENCRYPTION flag. 965 * SMB 3.1.1 uses the cipher_type field. 966 */ 967 return (conn->vals->req_capabilities & SMB2_GLOBAL_CAP_ENCRYPTION) || 968 conn->cipher_type; 969 } 970 971 static void decode_compress_ctxt(struct ksmbd_conn *conn, 972 struct smb2_compression_capabilities_context *pneg_ctxt) 973 { 974 conn->compress_algorithm = SMB3_COMPRESS_NONE; 975 } 976 977 static void decode_sign_cap_ctxt(struct ksmbd_conn *conn, 978 struct smb2_signing_capabilities *pneg_ctxt, 979 int ctxt_len) 980 { 981 int sign_algo_cnt; 982 int i, sign_alos_size; 983 984 if (sizeof(struct smb2_signing_capabilities) > ctxt_len) { 985 pr_err("Invalid SMB2_SIGNING_CAPABILITIES context length\n"); 986 return; 987 } 988 989 conn->signing_negotiated = false; 990 sign_algo_cnt = le16_to_cpu(pneg_ctxt->SigningAlgorithmCount); 991 sign_alos_size = sign_algo_cnt * sizeof(__le16); 992 993 if (sizeof(struct smb2_signing_capabilities) + sign_alos_size > 994 ctxt_len) { 995 pr_err("Invalid signing algorithm count(%d)\n", sign_algo_cnt); 996 return; 997 } 998 999 for (i = 0; i < sign_algo_cnt; i++) { 1000 if (pneg_ctxt->SigningAlgorithms[i] == SIGNING_ALG_HMAC_SHA256_LE || 1001 pneg_ctxt->SigningAlgorithms[i] == SIGNING_ALG_AES_CMAC_LE) { 1002 ksmbd_debug(SMB, "Signing Algorithm ID = 0x%x\n", 1003 pneg_ctxt->SigningAlgorithms[i]); 1004 conn->signing_negotiated = true; 1005 conn->signing_algorithm = 1006 pneg_ctxt->SigningAlgorithms[i]; 1007 break; 1008 } 1009 } 1010 } 1011 1012 static __le32 deassemble_neg_contexts(struct ksmbd_conn *conn, 1013 struct smb2_negotiate_req *req, 1014 unsigned int len_of_smb) 1015 { 1016 /* +4 is to account for the RFC1001 len field */ 1017 struct smb2_neg_context *pctx = (struct smb2_neg_context *)req; 1018 int i = 0, len_of_ctxts; 1019 unsigned int offset = le32_to_cpu(req->NegotiateContextOffset); 1020 unsigned int neg_ctxt_cnt = le16_to_cpu(req->NegotiateContextCount); 1021 __le32 status = STATUS_INVALID_PARAMETER; 1022 1023 ksmbd_debug(SMB, "decoding %d negotiate contexts\n", neg_ctxt_cnt); 1024 if (len_of_smb <= offset) { 1025 ksmbd_debug(SMB, "Invalid response: negotiate context offset\n"); 1026 return status; 1027 } 1028 1029 len_of_ctxts = len_of_smb - offset; 1030 1031 while (i++ < neg_ctxt_cnt) { 1032 int clen, ctxt_len; 1033 1034 if (len_of_ctxts < (int)sizeof(struct smb2_neg_context)) 1035 break; 1036 1037 pctx = (struct smb2_neg_context *)((char *)pctx + offset); 1038 clen = le16_to_cpu(pctx->DataLength); 1039 ctxt_len = clen + sizeof(struct smb2_neg_context); 1040 1041 if (ctxt_len > len_of_ctxts) 1042 break; 1043 1044 if (pctx->ContextType == SMB2_PREAUTH_INTEGRITY_CAPABILITIES) { 1045 ksmbd_debug(SMB, 1046 "deassemble SMB2_PREAUTH_INTEGRITY_CAPABILITIES context\n"); 1047 if (conn->preauth_info->Preauth_HashId) 1048 break; 1049 1050 status = decode_preauth_ctxt(conn, 1051 (struct smb2_preauth_neg_context *)pctx, 1052 ctxt_len); 1053 if (status != STATUS_SUCCESS) 1054 break; 1055 } else if (pctx->ContextType == SMB2_ENCRYPTION_CAPABILITIES) { 1056 ksmbd_debug(SMB, 1057 "deassemble SMB2_ENCRYPTION_CAPABILITIES context\n"); 1058 if (conn->cipher_type) 1059 break; 1060 1061 decode_encrypt_ctxt(conn, 1062 (struct smb2_encryption_neg_context *)pctx, 1063 ctxt_len); 1064 } else if (pctx->ContextType == SMB2_COMPRESSION_CAPABILITIES) { 1065 ksmbd_debug(SMB, 1066 "deassemble SMB2_COMPRESSION_CAPABILITIES context\n"); 1067 if (conn->compress_algorithm) 1068 break; 1069 1070 decode_compress_ctxt(conn, 1071 (struct smb2_compression_capabilities_context *)pctx); 1072 } else if (pctx->ContextType == SMB2_NETNAME_NEGOTIATE_CONTEXT_ID) { 1073 ksmbd_debug(SMB, 1074 "deassemble SMB2_NETNAME_NEGOTIATE_CONTEXT_ID context\n"); 1075 } else if (pctx->ContextType == SMB2_POSIX_EXTENSIONS_AVAILABLE) { 1076 ksmbd_debug(SMB, 1077 "deassemble SMB2_POSIX_EXTENSIONS_AVAILABLE context\n"); 1078 conn->posix_ext_supported = true; 1079 } else if (pctx->ContextType == SMB2_SIGNING_CAPABILITIES) { 1080 ksmbd_debug(SMB, 1081 "deassemble SMB2_SIGNING_CAPABILITIES context\n"); 1082 1083 decode_sign_cap_ctxt(conn, 1084 (struct smb2_signing_capabilities *)pctx, 1085 ctxt_len); 1086 } 1087 1088 /* offsets must be 8 byte aligned */ 1089 offset = (ctxt_len + 7) & ~0x7; 1090 len_of_ctxts -= offset; 1091 } 1092 return status; 1093 } 1094 1095 /** 1096 * smb2_handle_negotiate() - handler for smb2 negotiate command 1097 * @work: smb work containing smb request buffer 1098 * 1099 * Return: 0 1100 */ 1101 int smb2_handle_negotiate(struct ksmbd_work *work) 1102 { 1103 struct ksmbd_conn *conn = work->conn; 1104 struct smb2_negotiate_req *req = smb_get_msg(work->request_buf); 1105 struct smb2_negotiate_rsp *rsp = smb_get_msg(work->response_buf); 1106 int rc = 0; 1107 unsigned int smb2_buf_len, smb2_neg_size, neg_ctxt_len = 0; 1108 __le32 status; 1109 1110 ksmbd_debug(SMB, "Received negotiate request\n"); 1111 conn->need_neg = false; 1112 if (ksmbd_conn_good(conn)) { 1113 pr_err("conn->tcp_status is already in CifsGood State\n"); 1114 work->send_no_response = 1; 1115 return rc; 1116 } 1117 1118 ksmbd_conn_lock(conn); 1119 smb2_buf_len = get_rfc1002_len(work->request_buf); 1120 smb2_neg_size = offsetof(struct smb2_negotiate_req, Dialects); 1121 if (smb2_neg_size > smb2_buf_len) { 1122 rsp->hdr.Status = STATUS_INVALID_PARAMETER; 1123 rc = -EINVAL; 1124 goto err_out; 1125 } 1126 1127 if (req->DialectCount == 0) { 1128 pr_err("malformed packet\n"); 1129 rsp->hdr.Status = STATUS_INVALID_PARAMETER; 1130 rc = -EINVAL; 1131 goto err_out; 1132 } 1133 1134 if (conn->dialect == SMB311_PROT_ID) { 1135 unsigned int nego_ctxt_off = le32_to_cpu(req->NegotiateContextOffset); 1136 1137 if (smb2_buf_len < nego_ctxt_off) { 1138 rsp->hdr.Status = STATUS_INVALID_PARAMETER; 1139 rc = -EINVAL; 1140 goto err_out; 1141 } 1142 1143 if (smb2_neg_size > nego_ctxt_off) { 1144 rsp->hdr.Status = STATUS_INVALID_PARAMETER; 1145 rc = -EINVAL; 1146 goto err_out; 1147 } 1148 1149 if (smb2_neg_size + le16_to_cpu(req->DialectCount) * sizeof(__le16) > 1150 nego_ctxt_off) { 1151 rsp->hdr.Status = STATUS_INVALID_PARAMETER; 1152 rc = -EINVAL; 1153 goto err_out; 1154 } 1155 } else { 1156 if (smb2_neg_size + le16_to_cpu(req->DialectCount) * sizeof(__le16) > 1157 smb2_buf_len) { 1158 rsp->hdr.Status = STATUS_INVALID_PARAMETER; 1159 rc = -EINVAL; 1160 goto err_out; 1161 } 1162 } 1163 1164 conn->cli_cap = le32_to_cpu(req->Capabilities); 1165 switch (conn->dialect) { 1166 case SMB311_PROT_ID: 1167 conn->preauth_info = 1168 kzalloc_obj(struct preauth_integrity_info, 1169 KSMBD_DEFAULT_GFP); 1170 if (!conn->preauth_info) { 1171 rc = -ENOMEM; 1172 rsp->hdr.Status = STATUS_INVALID_PARAMETER; 1173 goto err_out; 1174 } 1175 1176 status = deassemble_neg_contexts(conn, req, 1177 get_rfc1002_len(work->request_buf)); 1178 if (status != STATUS_SUCCESS) { 1179 pr_err("deassemble_neg_contexts error(0x%x)\n", 1180 status); 1181 rsp->hdr.Status = status; 1182 rc = -EINVAL; 1183 kfree(conn->preauth_info); 1184 conn->preauth_info = NULL; 1185 goto err_out; 1186 } 1187 1188 rc = init_smb3_11_server(conn); 1189 if (rc < 0) { 1190 rsp->hdr.Status = STATUS_INVALID_PARAMETER; 1191 kfree(conn->preauth_info); 1192 conn->preauth_info = NULL; 1193 goto err_out; 1194 } 1195 1196 ksmbd_gen_preauth_integrity_hash(conn, 1197 work->request_buf, 1198 conn->preauth_info->Preauth_HashValue); 1199 rsp->NegotiateContextOffset = 1200 cpu_to_le32(OFFSET_OF_NEG_CONTEXT); 1201 neg_ctxt_len = assemble_neg_contexts(conn, rsp); 1202 break; 1203 case SMB302_PROT_ID: 1204 init_smb3_02_server(conn); 1205 break; 1206 case SMB30_PROT_ID: 1207 init_smb3_0_server(conn); 1208 break; 1209 case SMB21_PROT_ID: 1210 init_smb2_1_server(conn); 1211 break; 1212 case SMB2X_PROT_ID: 1213 case BAD_PROT_ID: 1214 default: 1215 ksmbd_debug(SMB, "Server dialect :0x%x not supported\n", 1216 conn->dialect); 1217 rsp->hdr.Status = STATUS_NOT_SUPPORTED; 1218 rc = -EINVAL; 1219 goto err_out; 1220 } 1221 rsp->Capabilities = cpu_to_le32(conn->vals->req_capabilities); 1222 1223 /* For stats */ 1224 conn->connection_type = conn->dialect; 1225 1226 rsp->MaxTransactSize = cpu_to_le32(conn->vals->max_trans_size); 1227 rsp->MaxReadSize = cpu_to_le32(conn->vals->max_read_size); 1228 rsp->MaxWriteSize = cpu_to_le32(conn->vals->max_write_size); 1229 1230 memcpy(conn->ClientGUID, req->ClientGUID, 1231 SMB2_CLIENT_GUID_SIZE); 1232 conn->cli_sec_mode = le16_to_cpu(req->SecurityMode); 1233 1234 rsp->StructureSize = cpu_to_le16(65); 1235 rsp->DialectRevision = cpu_to_le16(conn->dialect); 1236 /* Not setting conn guid rsp->ServerGUID, as it 1237 * not used by client for identifying server 1238 */ 1239 memset(rsp->ServerGUID, 0, SMB2_CLIENT_GUID_SIZE); 1240 1241 rsp->SystemTime = cpu_to_le64(ksmbd_systime()); 1242 rsp->ServerStartTime = 0; 1243 ksmbd_debug(SMB, "negotiate context offset %d, count %d\n", 1244 le32_to_cpu(rsp->NegotiateContextOffset), 1245 le16_to_cpu(rsp->NegotiateContextCount)); 1246 1247 rsp->SecurityBufferOffset = cpu_to_le16(128); 1248 rsp->SecurityBufferLength = cpu_to_le16(AUTH_GSS_LENGTH); 1249 ksmbd_copy_gss_neg_header((char *)(&rsp->hdr) + 1250 le16_to_cpu(rsp->SecurityBufferOffset)); 1251 1252 rsp->SecurityMode = SMB2_NEGOTIATE_SIGNING_ENABLED_LE; 1253 conn->use_spnego = true; 1254 1255 if ((server_conf.signing == KSMBD_CONFIG_OPT_AUTO || 1256 server_conf.signing == KSMBD_CONFIG_OPT_DISABLED) && 1257 req->SecurityMode & SMB2_NEGOTIATE_SIGNING_REQUIRED_LE) 1258 conn->sign = true; 1259 else if (server_conf.signing == KSMBD_CONFIG_OPT_MANDATORY) { 1260 server_conf.enforced_signing = true; 1261 rsp->SecurityMode |= SMB2_NEGOTIATE_SIGNING_REQUIRED_LE; 1262 conn->sign = true; 1263 } 1264 1265 conn->srv_sec_mode = le16_to_cpu(rsp->SecurityMode); 1266 ksmbd_conn_set_need_setup(conn); 1267 1268 err_out: 1269 ksmbd_conn_unlock(conn); 1270 if (rc) 1271 rsp->hdr.Status = STATUS_INSUFFICIENT_RESOURCES; 1272 1273 if (!rc) 1274 rc = ksmbd_iov_pin_rsp(work, rsp, 1275 sizeof(struct smb2_negotiate_rsp) + 1276 AUTH_GSS_LENGTH + neg_ctxt_len); 1277 if (rc < 0) 1278 smb2_set_err_rsp(work); 1279 return rc; 1280 } 1281 1282 static int alloc_preauth_hash(struct ksmbd_session *sess, 1283 struct ksmbd_conn *conn) 1284 { 1285 if (sess->Preauth_HashValue) 1286 return 0; 1287 1288 if (!conn->preauth_info) 1289 return -ENOMEM; 1290 1291 sess->Preauth_HashValue = kmemdup(conn->preauth_info->Preauth_HashValue, 1292 PREAUTH_HASHVALUE_SIZE, KSMBD_DEFAULT_GFP); 1293 if (!sess->Preauth_HashValue) 1294 return -ENOMEM; 1295 1296 return 0; 1297 } 1298 1299 static int generate_preauth_hash(struct ksmbd_work *work) 1300 { 1301 struct ksmbd_conn *conn = work->conn; 1302 struct ksmbd_session *sess = work->sess; 1303 u8 *preauth_hash; 1304 1305 if (conn->dialect != SMB311_PROT_ID) 1306 return 0; 1307 1308 if (conn->binding) { 1309 struct preauth_session *preauth_sess; 1310 1311 preauth_sess = ksmbd_preauth_session_lookup(conn, sess->id); 1312 if (!preauth_sess) { 1313 preauth_sess = ksmbd_preauth_session_alloc(conn, sess->id); 1314 if (!preauth_sess) 1315 return -ENOMEM; 1316 } 1317 1318 preauth_hash = preauth_sess->Preauth_HashValue; 1319 } else { 1320 if (!sess->Preauth_HashValue) 1321 if (alloc_preauth_hash(sess, conn)) 1322 return -ENOMEM; 1323 preauth_hash = sess->Preauth_HashValue; 1324 } 1325 1326 ksmbd_gen_preauth_integrity_hash(conn, work->request_buf, preauth_hash); 1327 return 0; 1328 } 1329 1330 static int decode_negotiation_token(struct ksmbd_conn *conn, 1331 struct negotiate_message *negblob, 1332 size_t sz) 1333 { 1334 if (!conn->use_spnego) 1335 return -EINVAL; 1336 1337 if (ksmbd_decode_negTokenInit((char *)negblob, sz, conn)) { 1338 if (ksmbd_decode_negTokenTarg((char *)negblob, sz, conn)) { 1339 conn->auth_mechs |= KSMBD_AUTH_NTLMSSP; 1340 conn->preferred_auth_mech = KSMBD_AUTH_NTLMSSP; 1341 conn->use_spnego = false; 1342 } 1343 } 1344 return 0; 1345 } 1346 1347 static int ntlm_negotiate(struct ksmbd_work *work, 1348 struct negotiate_message *negblob, 1349 size_t negblob_len, struct smb2_sess_setup_rsp *rsp) 1350 { 1351 struct challenge_message *chgblob; 1352 unsigned char *spnego_blob = NULL; 1353 u16 spnego_blob_len; 1354 char *neg_blob; 1355 int sz, rc; 1356 1357 ksmbd_debug(SMB, "negotiate phase\n"); 1358 rc = ksmbd_decode_ntlmssp_neg_blob(negblob, negblob_len, work->conn); 1359 if (rc) 1360 return rc; 1361 1362 sz = le16_to_cpu(rsp->SecurityBufferOffset); 1363 chgblob = (struct challenge_message *)rsp->Buffer; 1364 memset(chgblob, 0, sizeof(struct challenge_message)); 1365 1366 if (!work->conn->use_spnego) { 1367 sz = ksmbd_build_ntlmssp_challenge_blob(chgblob, work->conn); 1368 if (sz < 0) 1369 return -ENOMEM; 1370 1371 rsp->SecurityBufferLength = cpu_to_le16(sz); 1372 return 0; 1373 } 1374 1375 sz = sizeof(struct challenge_message); 1376 sz += (strlen(ksmbd_netbios_name()) * 2 + 1 + 4) * 6; 1377 1378 neg_blob = kzalloc(sz, KSMBD_DEFAULT_GFP); 1379 if (!neg_blob) 1380 return -ENOMEM; 1381 1382 chgblob = (struct challenge_message *)neg_blob; 1383 sz = ksmbd_build_ntlmssp_challenge_blob(chgblob, work->conn); 1384 if (sz < 0) { 1385 rc = -ENOMEM; 1386 goto out; 1387 } 1388 1389 rc = build_spnego_ntlmssp_neg_blob(&spnego_blob, &spnego_blob_len, 1390 neg_blob, sz); 1391 if (rc) { 1392 rc = -ENOMEM; 1393 goto out; 1394 } 1395 1396 memcpy(rsp->Buffer, spnego_blob, spnego_blob_len); 1397 rsp->SecurityBufferLength = cpu_to_le16(spnego_blob_len); 1398 1399 out: 1400 kfree(spnego_blob); 1401 kfree(neg_blob); 1402 return rc; 1403 } 1404 1405 static struct authenticate_message *user_authblob(struct ksmbd_conn *conn, 1406 struct smb2_sess_setup_req *req) 1407 { 1408 int sz; 1409 1410 if (conn->use_spnego && conn->mechToken) 1411 return (struct authenticate_message *)conn->mechToken; 1412 1413 sz = le16_to_cpu(req->SecurityBufferOffset); 1414 return (struct authenticate_message *)((char *)&req->hdr.ProtocolId 1415 + sz); 1416 } 1417 1418 static struct ksmbd_user *session_user(struct ksmbd_conn *conn, 1419 struct smb2_sess_setup_req *req) 1420 { 1421 struct authenticate_message *authblob; 1422 struct ksmbd_user *user; 1423 char *name; 1424 unsigned int name_off, name_len, secbuf_len; 1425 1426 if (conn->use_spnego && conn->mechToken) 1427 secbuf_len = conn->mechTokenLen; 1428 else 1429 secbuf_len = le16_to_cpu(req->SecurityBufferLength); 1430 if (secbuf_len < sizeof(struct authenticate_message)) { 1431 ksmbd_debug(SMB, "blob len %d too small\n", secbuf_len); 1432 return NULL; 1433 } 1434 authblob = user_authblob(conn, req); 1435 name_off = le32_to_cpu(authblob->UserName.BufferOffset); 1436 name_len = le16_to_cpu(authblob->UserName.Length); 1437 1438 if (secbuf_len < (u64)name_off + name_len) 1439 return NULL; 1440 1441 name = smb_strndup_from_utf16((const char *)authblob + name_off, 1442 name_len, 1443 true, 1444 conn->local_nls); 1445 if (IS_ERR(name)) { 1446 pr_err("cannot allocate memory\n"); 1447 return NULL; 1448 } 1449 1450 ksmbd_debug(SMB, "session setup request for user %s\n", name); 1451 user = ksmbd_login_user(name); 1452 kfree(name); 1453 return user; 1454 } 1455 1456 static int ntlm_authenticate(struct ksmbd_work *work, 1457 struct smb2_sess_setup_req *req, 1458 struct smb2_sess_setup_rsp *rsp) 1459 { 1460 struct ksmbd_conn *conn = work->conn; 1461 struct ksmbd_session *sess = work->sess; 1462 struct channel *chann = NULL, *old; 1463 struct ksmbd_user *user; 1464 u64 prev_id; 1465 int sz, rc; 1466 1467 ksmbd_debug(SMB, "authenticate phase\n"); 1468 if (conn->use_spnego) { 1469 unsigned char *spnego_blob; 1470 u16 spnego_blob_len; 1471 1472 rc = build_spnego_ntlmssp_auth_blob(&spnego_blob, 1473 &spnego_blob_len, 1474 0); 1475 if (rc) 1476 return -ENOMEM; 1477 1478 memcpy(rsp->Buffer, spnego_blob, spnego_blob_len); 1479 rsp->SecurityBufferLength = cpu_to_le16(spnego_blob_len); 1480 kfree(spnego_blob); 1481 } 1482 1483 user = session_user(conn, req); 1484 if (!user) { 1485 ksmbd_debug(SMB, "Unknown user name or an error\n"); 1486 return -EPERM; 1487 } 1488 1489 /* Check for previous session */ 1490 prev_id = le64_to_cpu(req->PreviousSessionId); 1491 if (prev_id && prev_id != sess->id) 1492 destroy_previous_session(conn, user, prev_id); 1493 1494 if (sess->state == SMB2_SESSION_VALID) { 1495 /* 1496 * Reuse session if anonymous try to connect 1497 * on reauthetication. 1498 */ 1499 if (conn->binding == false && ksmbd_anonymous_user(user)) { 1500 ksmbd_free_user(user); 1501 return 0; 1502 } 1503 1504 if (!ksmbd_compare_user(sess->user, user)) { 1505 ksmbd_free_user(user); 1506 return -EPERM; 1507 } 1508 ksmbd_free_user(user); 1509 } else { 1510 sess->user = user; 1511 } 1512 1513 if (conn->binding == false && user_guest(sess->user)) { 1514 rsp->SessionFlags = SMB2_SESSION_FLAG_IS_GUEST_LE; 1515 } else { 1516 struct authenticate_message *authblob; 1517 1518 authblob = user_authblob(conn, req); 1519 if (conn->use_spnego && conn->mechToken) 1520 sz = conn->mechTokenLen; 1521 else 1522 sz = le16_to_cpu(req->SecurityBufferLength); 1523 rc = ksmbd_decode_ntlmssp_auth_blob(authblob, sz, conn, sess); 1524 if (rc) { 1525 set_user_flag(sess->user, KSMBD_USER_FLAG_BAD_PASSWORD); 1526 ksmbd_debug(SMB, "authentication failed\n"); 1527 return -EPERM; 1528 } 1529 } 1530 1531 /* 1532 * If session state is SMB2_SESSION_VALID, We can assume 1533 * that it is reauthentication. And the user/password 1534 * has been verified, so return it here. 1535 */ 1536 if (sess->state == SMB2_SESSION_VALID) { 1537 if (conn->binding) 1538 goto binding_session; 1539 return 0; 1540 } 1541 1542 if ((rsp->SessionFlags != SMB2_SESSION_FLAG_IS_GUEST_LE && 1543 (conn->sign || server_conf.enforced_signing)) || 1544 (req->SecurityMode & SMB2_NEGOTIATE_SIGNING_REQUIRED)) 1545 sess->sign = true; 1546 1547 if (smb3_encryption_negotiated(conn) && 1548 !(req->Flags & SMB2_SESSION_REQ_FLAG_BINDING)) { 1549 conn->ops->generate_encryptionkey(conn, sess); 1550 sess->enc = true; 1551 if (server_conf.flags & KSMBD_GLOBAL_FLAG_SMB2_ENCRYPTION) 1552 rsp->SessionFlags = SMB2_SESSION_FLAG_ENCRYPT_DATA_LE; 1553 /* 1554 * signing is disable if encryption is enable 1555 * on this session 1556 */ 1557 sess->sign = false; 1558 } 1559 1560 binding_session: 1561 if (conn->dialect >= SMB30_PROT_ID) { 1562 chann = lookup_chann_list(sess, conn); 1563 if (!chann) { 1564 chann = kmalloc_obj(struct channel, KSMBD_DEFAULT_GFP); 1565 if (!chann) 1566 return -ENOMEM; 1567 1568 chann->conn = conn; 1569 down_write(&sess->chann_lock); 1570 old = xa_store(&sess->ksmbd_chann_list, (long)conn, chann, 1571 KSMBD_DEFAULT_GFP); 1572 up_write(&sess->chann_lock); 1573 if (xa_is_err(old)) { 1574 kfree(chann); 1575 return xa_err(old); 1576 } 1577 } 1578 } 1579 1580 if (conn->ops->generate_signingkey) { 1581 rc = conn->ops->generate_signingkey(sess, conn); 1582 if (rc) { 1583 ksmbd_debug(SMB, "SMB3 signing key generation failed\n"); 1584 return -EINVAL; 1585 } 1586 } 1587 1588 if (!ksmbd_conn_lookup_dialect(conn)) { 1589 pr_err("fail to verify the dialect\n"); 1590 return -ENOENT; 1591 } 1592 return 0; 1593 } 1594 1595 #ifdef CONFIG_SMB_SERVER_KERBEROS5 1596 static int krb5_authenticate(struct ksmbd_work *work, 1597 struct smb2_sess_setup_req *req, 1598 struct smb2_sess_setup_rsp *rsp) 1599 { 1600 struct ksmbd_conn *conn = work->conn; 1601 struct ksmbd_session *sess = work->sess; 1602 char *in_blob, *out_blob; 1603 struct channel *chann = NULL, *old; 1604 u64 prev_sess_id; 1605 int in_len, out_len; 1606 int retval; 1607 1608 in_blob = (char *)&req->hdr.ProtocolId + 1609 le16_to_cpu(req->SecurityBufferOffset); 1610 in_len = le16_to_cpu(req->SecurityBufferLength); 1611 out_blob = (char *)&rsp->hdr.ProtocolId + 1612 le16_to_cpu(rsp->SecurityBufferOffset); 1613 out_len = work->response_sz - 1614 (le16_to_cpu(rsp->SecurityBufferOffset) + 4); 1615 1616 retval = ksmbd_krb5_authenticate(sess, in_blob, in_len, 1617 out_blob, &out_len); 1618 if (retval) { 1619 ksmbd_debug(SMB, "krb5 authentication failed\n"); 1620 return -EINVAL; 1621 } 1622 1623 /* Check previous session */ 1624 prev_sess_id = le64_to_cpu(req->PreviousSessionId); 1625 if (prev_sess_id && prev_sess_id != sess->id) 1626 destroy_previous_session(conn, sess->user, prev_sess_id); 1627 1628 rsp->SecurityBufferLength = cpu_to_le16(out_len); 1629 1630 /* 1631 * If session state is SMB2_SESSION_VALID, We can assume 1632 * that it is reauthentication. And the user/password 1633 * has been verified, so return it here. 1634 */ 1635 if (sess->state == SMB2_SESSION_VALID) { 1636 if (conn->binding) 1637 goto binding_session; 1638 return 0; 1639 } 1640 1641 if ((rsp->SessionFlags != SMB2_SESSION_FLAG_IS_GUEST_LE && 1642 (conn->sign || server_conf.enforced_signing)) || 1643 (req->SecurityMode & SMB2_NEGOTIATE_SIGNING_REQUIRED)) 1644 sess->sign = true; 1645 1646 if (smb3_encryption_negotiated(conn) && 1647 !(req->Flags & SMB2_SESSION_REQ_FLAG_BINDING)) { 1648 conn->ops->generate_encryptionkey(conn, sess); 1649 sess->enc = true; 1650 if (server_conf.flags & KSMBD_GLOBAL_FLAG_SMB2_ENCRYPTION) 1651 rsp->SessionFlags = SMB2_SESSION_FLAG_ENCRYPT_DATA_LE; 1652 sess->sign = false; 1653 } 1654 1655 binding_session: 1656 if (conn->dialect >= SMB30_PROT_ID) { 1657 chann = lookup_chann_list(sess, conn); 1658 if (!chann) { 1659 chann = kmalloc_obj(struct channel, KSMBD_DEFAULT_GFP); 1660 if (!chann) 1661 return -ENOMEM; 1662 1663 chann->conn = conn; 1664 down_write(&sess->chann_lock); 1665 old = xa_store(&sess->ksmbd_chann_list, (long)conn, 1666 chann, KSMBD_DEFAULT_GFP); 1667 up_write(&sess->chann_lock); 1668 if (xa_is_err(old)) { 1669 kfree(chann); 1670 return xa_err(old); 1671 } 1672 } 1673 } 1674 1675 if (conn->ops->generate_signingkey) { 1676 retval = conn->ops->generate_signingkey(sess, conn); 1677 if (retval) { 1678 ksmbd_debug(SMB, "SMB3 signing key generation failed\n"); 1679 return -EINVAL; 1680 } 1681 } 1682 1683 if (!ksmbd_conn_lookup_dialect(conn)) { 1684 pr_err("fail to verify the dialect\n"); 1685 return -ENOENT; 1686 } 1687 return 0; 1688 } 1689 #else 1690 static int krb5_authenticate(struct ksmbd_work *work, 1691 struct smb2_sess_setup_req *req, 1692 struct smb2_sess_setup_rsp *rsp) 1693 { 1694 return -EOPNOTSUPP; 1695 } 1696 #endif 1697 1698 int smb2_sess_setup(struct ksmbd_work *work) 1699 { 1700 struct ksmbd_conn *conn = work->conn; 1701 struct smb2_sess_setup_req *req; 1702 struct smb2_sess_setup_rsp *rsp; 1703 struct ksmbd_session *sess; 1704 struct negotiate_message *negblob; 1705 unsigned int negblob_len, negblob_off; 1706 int rc = 0; 1707 1708 ksmbd_debug(SMB, "Received smb2 session setup request\n"); 1709 1710 if (!ksmbd_conn_need_setup(conn) && !ksmbd_conn_good(conn)) { 1711 work->send_no_response = 1; 1712 return rc; 1713 } 1714 1715 WORK_BUFFERS(work, req, rsp); 1716 1717 rsp->StructureSize = cpu_to_le16(9); 1718 rsp->SessionFlags = 0; 1719 rsp->SecurityBufferOffset = cpu_to_le16(72); 1720 rsp->SecurityBufferLength = 0; 1721 1722 ksmbd_conn_lock(conn); 1723 if (!req->hdr.SessionId) { 1724 sess = ksmbd_smb2_session_create(); 1725 if (!sess) { 1726 rc = -ENOMEM; 1727 goto out_err; 1728 } 1729 rsp->hdr.SessionId = cpu_to_le64(sess->id); 1730 rc = ksmbd_session_register(conn, sess); 1731 if (rc) 1732 goto out_err; 1733 1734 conn->binding = false; 1735 } else if (conn->dialect >= SMB30_PROT_ID && 1736 (server_conf.flags & KSMBD_GLOBAL_FLAG_SMB3_MULTICHANNEL) && 1737 req->Flags & SMB2_SESSION_REQ_FLAG_BINDING) { 1738 u64 sess_id = le64_to_cpu(req->hdr.SessionId); 1739 1740 sess = ksmbd_session_lookup_slowpath(sess_id); 1741 if (!sess) { 1742 rc = -ENOENT; 1743 goto out_err; 1744 } 1745 1746 if (conn->dialect != sess->dialect) { 1747 rc = -EINVAL; 1748 goto out_err; 1749 } 1750 1751 if (!(req->hdr.Flags & SMB2_FLAGS_SIGNED)) { 1752 rc = -EINVAL; 1753 goto out_err; 1754 } 1755 1756 if (strncmp(conn->ClientGUID, sess->ClientGUID, 1757 SMB2_CLIENT_GUID_SIZE)) { 1758 rc = -ENOENT; 1759 goto out_err; 1760 } 1761 1762 if (sess->state == SMB2_SESSION_IN_PROGRESS) { 1763 rc = -EACCES; 1764 goto out_err; 1765 } 1766 1767 if (sess->state == SMB2_SESSION_EXPIRED) { 1768 rc = -EFAULT; 1769 goto out_err; 1770 } 1771 1772 if (ksmbd_conn_need_reconnect(conn)) { 1773 rc = -EFAULT; 1774 ksmbd_user_session_put(sess); 1775 sess = NULL; 1776 goto out_err; 1777 } 1778 1779 if (is_ksmbd_session_in_connection(conn, sess_id)) { 1780 rc = -EACCES; 1781 goto out_err; 1782 } 1783 1784 if (user_guest(sess->user)) { 1785 rc = -EOPNOTSUPP; 1786 goto out_err; 1787 } 1788 1789 conn->binding = true; 1790 } else if ((conn->dialect < SMB30_PROT_ID || 1791 server_conf.flags & KSMBD_GLOBAL_FLAG_SMB3_MULTICHANNEL) && 1792 (req->Flags & SMB2_SESSION_REQ_FLAG_BINDING)) { 1793 sess = NULL; 1794 rc = -EACCES; 1795 goto out_err; 1796 } else { 1797 sess = ksmbd_session_lookup(conn, 1798 le64_to_cpu(req->hdr.SessionId)); 1799 if (!sess) { 1800 rc = -ENOENT; 1801 goto out_err; 1802 } 1803 1804 if (sess->state == SMB2_SESSION_EXPIRED) { 1805 rc = -EFAULT; 1806 goto out_err; 1807 } 1808 1809 if (ksmbd_conn_need_reconnect(conn)) { 1810 rc = -EFAULT; 1811 ksmbd_user_session_put(sess); 1812 sess = NULL; 1813 goto out_err; 1814 } 1815 1816 conn->binding = false; 1817 } 1818 work->sess = sess; 1819 1820 negblob_off = le16_to_cpu(req->SecurityBufferOffset); 1821 negblob_len = le16_to_cpu(req->SecurityBufferLength); 1822 if (negblob_off < offsetof(struct smb2_sess_setup_req, Buffer)) { 1823 rc = -EINVAL; 1824 goto out_err; 1825 } 1826 1827 negblob = (struct negotiate_message *)((char *)&req->hdr.ProtocolId + 1828 negblob_off); 1829 1830 if (decode_negotiation_token(conn, negblob, negblob_len) == 0) { 1831 if (conn->mechToken) { 1832 negblob = (struct negotiate_message *)conn->mechToken; 1833 negblob_len = conn->mechTokenLen; 1834 } 1835 } 1836 1837 if (negblob_len < offsetof(struct negotiate_message, NegotiateFlags)) { 1838 rc = -EINVAL; 1839 goto out_err; 1840 } 1841 1842 if (server_conf.auth_mechs & conn->auth_mechs) { 1843 rc = generate_preauth_hash(work); 1844 if (rc) 1845 goto out_err; 1846 1847 if (conn->preferred_auth_mech & 1848 (KSMBD_AUTH_KRB5 | KSMBD_AUTH_MSKRB5)) { 1849 rc = krb5_authenticate(work, req, rsp); 1850 if (rc) { 1851 rc = -EINVAL; 1852 goto out_err; 1853 } 1854 1855 if (!ksmbd_conn_need_reconnect(conn)) { 1856 ksmbd_conn_set_good(conn); 1857 sess->state = SMB2_SESSION_VALID; 1858 } 1859 } else if (conn->preferred_auth_mech == KSMBD_AUTH_NTLMSSP) { 1860 if (negblob->MessageType == NtLmNegotiate) { 1861 rc = ntlm_negotiate(work, negblob, negblob_len, rsp); 1862 if (rc) 1863 goto out_err; 1864 rsp->hdr.Status = 1865 STATUS_MORE_PROCESSING_REQUIRED; 1866 } else if (negblob->MessageType == NtLmAuthenticate) { 1867 rc = ntlm_authenticate(work, req, rsp); 1868 if (rc) 1869 goto out_err; 1870 1871 if (!ksmbd_conn_need_reconnect(conn)) { 1872 ksmbd_conn_set_good(conn); 1873 sess->state = SMB2_SESSION_VALID; 1874 } 1875 if (conn->binding) { 1876 struct preauth_session *preauth_sess; 1877 1878 preauth_sess = 1879 ksmbd_preauth_session_lookup(conn, sess->id); 1880 if (preauth_sess) { 1881 list_del(&preauth_sess->preauth_entry); 1882 kfree(preauth_sess); 1883 } 1884 } 1885 } else { 1886 pr_info_ratelimited("Unknown NTLMSSP message type : 0x%x\n", 1887 le32_to_cpu(negblob->MessageType)); 1888 rc = -EINVAL; 1889 } 1890 } else { 1891 /* TODO: need one more negotiation */ 1892 pr_err("Not support the preferred authentication\n"); 1893 rc = -EINVAL; 1894 } 1895 } else { 1896 pr_err("Not support authentication\n"); 1897 rc = -EINVAL; 1898 } 1899 1900 out_err: 1901 if (rc == -EINVAL) 1902 rsp->hdr.Status = STATUS_INVALID_PARAMETER; 1903 else if (rc == -ENOENT) 1904 rsp->hdr.Status = STATUS_USER_SESSION_DELETED; 1905 else if (rc == -EACCES) 1906 rsp->hdr.Status = STATUS_REQUEST_NOT_ACCEPTED; 1907 else if (rc == -EFAULT) 1908 rsp->hdr.Status = STATUS_NETWORK_SESSION_EXPIRED; 1909 else if (rc == -ENOMEM) 1910 rsp->hdr.Status = STATUS_INSUFFICIENT_RESOURCES; 1911 else if (rc == -EOPNOTSUPP) 1912 rsp->hdr.Status = STATUS_NOT_SUPPORTED; 1913 else if (rc) 1914 rsp->hdr.Status = STATUS_LOGON_FAILURE; 1915 1916 if (conn->use_spnego && conn->mechToken) { 1917 kfree(conn->mechToken); 1918 conn->mechToken = NULL; 1919 } 1920 1921 if (rc < 0) { 1922 /* 1923 * SecurityBufferOffset should be set to zero 1924 * in session setup error response. 1925 */ 1926 rsp->SecurityBufferOffset = 0; 1927 1928 if (sess) { 1929 bool try_delay = false; 1930 1931 /* 1932 * To avoid dictionary attacks (repeated session setups rapidly sent) to 1933 * connect to server, ksmbd make a delay of a 5 seconds on session setup 1934 * failure to make it harder to send enough random connection requests 1935 * to break into a server. 1936 */ 1937 if (sess->user && sess->user->flags & KSMBD_USER_FLAG_DELAY_SESSION) 1938 try_delay = true; 1939 1940 sess->last_active = jiffies; 1941 sess->state = SMB2_SESSION_EXPIRED; 1942 ksmbd_user_session_put(sess); 1943 work->sess = NULL; 1944 if (try_delay) { 1945 ksmbd_conn_set_need_reconnect(conn); 1946 ssleep(5); 1947 ksmbd_conn_set_need_setup(conn); 1948 } 1949 } 1950 smb2_set_err_rsp(work); 1951 } else { 1952 unsigned int iov_len; 1953 1954 if (rsp->SecurityBufferLength) 1955 iov_len = offsetof(struct smb2_sess_setup_rsp, Buffer) + 1956 le16_to_cpu(rsp->SecurityBufferLength); 1957 else 1958 iov_len = sizeof(struct smb2_sess_setup_rsp); 1959 rc = ksmbd_iov_pin_rsp(work, rsp, iov_len); 1960 if (rc) 1961 rsp->hdr.Status = STATUS_INSUFFICIENT_RESOURCES; 1962 } 1963 1964 ksmbd_conn_unlock(conn); 1965 return rc; 1966 } 1967 1968 /** 1969 * smb2_tree_connect() - handler for smb2 tree connect command 1970 * @work: smb work containing smb request buffer 1971 * 1972 * Return: 0 on success, otherwise error 1973 */ 1974 int smb2_tree_connect(struct ksmbd_work *work) 1975 { 1976 struct ksmbd_conn *conn = work->conn; 1977 struct smb2_tree_connect_req *req; 1978 struct smb2_tree_connect_rsp *rsp; 1979 struct ksmbd_session *sess = work->sess; 1980 char *treename = NULL, *name = NULL; 1981 struct ksmbd_tree_conn_status status; 1982 struct ksmbd_share_config *share = NULL; 1983 int rc = -EINVAL; 1984 1985 ksmbd_debug(SMB, "Received smb2 tree connect request\n"); 1986 1987 WORK_BUFFERS(work, req, rsp); 1988 1989 treename = smb_strndup_from_utf16((char *)req + le16_to_cpu(req->PathOffset), 1990 le16_to_cpu(req->PathLength), true, 1991 conn->local_nls); 1992 if (IS_ERR(treename)) { 1993 pr_err("treename is NULL\n"); 1994 status.ret = KSMBD_TREE_CONN_STATUS_ERROR; 1995 goto out_err1; 1996 } 1997 1998 name = ksmbd_extract_sharename(conn->um, treename); 1999 if (IS_ERR(name)) { 2000 status.ret = KSMBD_TREE_CONN_STATUS_ERROR; 2001 goto out_err1; 2002 } 2003 2004 ksmbd_debug(SMB, "tree connect request for tree %s treename %s\n", 2005 name, treename); 2006 2007 status = ksmbd_tree_conn_connect(work, name); 2008 if (status.ret == KSMBD_TREE_CONN_STATUS_OK) 2009 rsp->hdr.Id.SyncId.TreeId = cpu_to_le32(status.tree_conn->id); 2010 else 2011 goto out_err1; 2012 2013 share = status.tree_conn->share_conf; 2014 if (test_share_config_flag(share, KSMBD_SHARE_FLAG_PIPE)) { 2015 ksmbd_debug(SMB, "IPC share path request\n"); 2016 rsp->ShareType = SMB2_SHARE_TYPE_PIPE; 2017 rsp->MaximalAccess = FILE_READ_DATA_LE | FILE_READ_EA_LE | 2018 FILE_EXECUTE_LE | FILE_READ_ATTRIBUTES_LE | 2019 FILE_DELETE_LE | FILE_READ_CONTROL_LE | 2020 FILE_WRITE_DAC_LE | FILE_WRITE_OWNER_LE | 2021 FILE_SYNCHRONIZE_LE; 2022 } else { 2023 rsp->ShareType = SMB2_SHARE_TYPE_DISK; 2024 rsp->MaximalAccess = FILE_READ_DATA_LE | FILE_READ_EA_LE | 2025 FILE_EXECUTE_LE | FILE_READ_ATTRIBUTES_LE; 2026 if (test_tree_conn_flag(status.tree_conn, 2027 KSMBD_TREE_CONN_FLAG_WRITABLE)) { 2028 rsp->MaximalAccess |= FILE_WRITE_DATA_LE | 2029 FILE_APPEND_DATA_LE | FILE_WRITE_EA_LE | 2030 FILE_DELETE_LE | FILE_WRITE_ATTRIBUTES_LE | 2031 FILE_DELETE_CHILD_LE | FILE_READ_CONTROL_LE | 2032 FILE_WRITE_DAC_LE | FILE_WRITE_OWNER_LE | 2033 FILE_SYNCHRONIZE_LE; 2034 } 2035 } 2036 2037 status.tree_conn->maximal_access = le32_to_cpu(rsp->MaximalAccess); 2038 if (conn->posix_ext_supported) 2039 status.tree_conn->posix_extensions = true; 2040 2041 down_write(&sess->tree_conns_lock); 2042 status.tree_conn->t_state = TREE_CONNECTED; 2043 up_write(&sess->tree_conns_lock); 2044 rsp->StructureSize = cpu_to_le16(16); 2045 out_err1: 2046 if (server_conf.flags & KSMBD_GLOBAL_FLAG_DURABLE_HANDLE && share && 2047 test_share_config_flag(share, 2048 KSMBD_SHARE_FLAG_CONTINUOUS_AVAILABILITY)) 2049 rsp->Capabilities = SMB2_SHARE_CAP_CONTINUOUS_AVAILABILITY; 2050 else 2051 rsp->Capabilities = 0; 2052 rsp->Reserved = 0; 2053 /* default manual caching */ 2054 rsp->ShareFlags = SMB2_SHAREFLAG_MANUAL_CACHING; 2055 2056 rc = ksmbd_iov_pin_rsp(work, rsp, sizeof(struct smb2_tree_connect_rsp)); 2057 if (rc) 2058 status.ret = KSMBD_TREE_CONN_STATUS_NOMEM; 2059 2060 if (!IS_ERR(treename)) 2061 kfree(treename); 2062 if (!IS_ERR(name)) 2063 kfree(name); 2064 2065 switch (status.ret) { 2066 case KSMBD_TREE_CONN_STATUS_OK: 2067 rsp->hdr.Status = STATUS_SUCCESS; 2068 rc = 0; 2069 break; 2070 case -ESTALE: 2071 case -ENOENT: 2072 case KSMBD_TREE_CONN_STATUS_NO_SHARE: 2073 rsp->hdr.Status = STATUS_BAD_NETWORK_NAME; 2074 break; 2075 case -ENOMEM: 2076 case KSMBD_TREE_CONN_STATUS_NOMEM: 2077 rsp->hdr.Status = STATUS_NO_MEMORY; 2078 break; 2079 case KSMBD_TREE_CONN_STATUS_ERROR: 2080 case KSMBD_TREE_CONN_STATUS_TOO_MANY_CONNS: 2081 case KSMBD_TREE_CONN_STATUS_TOO_MANY_SESSIONS: 2082 rsp->hdr.Status = STATUS_ACCESS_DENIED; 2083 break; 2084 case -EINVAL: 2085 rsp->hdr.Status = STATUS_INVALID_PARAMETER; 2086 break; 2087 default: 2088 rsp->hdr.Status = STATUS_ACCESS_DENIED; 2089 } 2090 2091 if (status.ret != KSMBD_TREE_CONN_STATUS_OK) 2092 smb2_set_err_rsp(work); 2093 2094 return rc; 2095 } 2096 2097 /** 2098 * smb2_create_open_flags() - convert smb open flags to unix open flags 2099 * @file_present: is file already present 2100 * @access: file access flags 2101 * @disposition: file disposition flags 2102 * @may_flags: set with MAY_ flags 2103 * @coptions: file creation options 2104 * @mode: file mode 2105 * 2106 * Return: file open flags 2107 */ 2108 static int smb2_create_open_flags(bool file_present, __le32 access, 2109 __le32 disposition, 2110 int *may_flags, 2111 __le32 coptions, 2112 umode_t mode) 2113 { 2114 int oflags = O_NONBLOCK | O_LARGEFILE; 2115 2116 if (coptions & FILE_DIRECTORY_FILE_LE || S_ISDIR(mode)) { 2117 access &= ~FILE_WRITE_DESIRE_ACCESS_LE; 2118 ksmbd_debug(SMB, "Discard write access to a directory\n"); 2119 } 2120 2121 if (access & FILE_READ_DESIRED_ACCESS_LE && 2122 access & FILE_WRITE_DESIRE_ACCESS_LE) { 2123 oflags |= O_RDWR; 2124 *may_flags = MAY_OPEN | MAY_READ | MAY_WRITE; 2125 } else if (access & FILE_WRITE_DESIRE_ACCESS_LE) { 2126 oflags |= O_WRONLY; 2127 *may_flags = MAY_OPEN | MAY_WRITE; 2128 } else { 2129 oflags |= O_RDONLY; 2130 *may_flags = MAY_OPEN | MAY_READ; 2131 } 2132 2133 if (access == FILE_READ_ATTRIBUTES_LE || S_ISBLK(mode) || S_ISCHR(mode)) 2134 oflags |= O_PATH; 2135 2136 if (file_present) { 2137 switch (disposition & FILE_CREATE_MASK_LE) { 2138 case FILE_OPEN_LE: 2139 case FILE_CREATE_LE: 2140 break; 2141 case FILE_SUPERSEDE_LE: 2142 case FILE_OVERWRITE_LE: 2143 case FILE_OVERWRITE_IF_LE: 2144 oflags |= O_TRUNC; 2145 break; 2146 default: 2147 break; 2148 } 2149 } else { 2150 switch (disposition & FILE_CREATE_MASK_LE) { 2151 case FILE_SUPERSEDE_LE: 2152 case FILE_CREATE_LE: 2153 case FILE_OPEN_IF_LE: 2154 case FILE_OVERWRITE_IF_LE: 2155 oflags |= O_CREAT; 2156 break; 2157 case FILE_OPEN_LE: 2158 case FILE_OVERWRITE_LE: 2159 oflags &= ~O_CREAT; 2160 break; 2161 default: 2162 break; 2163 } 2164 } 2165 2166 return oflags; 2167 } 2168 2169 /** 2170 * smb2_tree_disconnect() - handler for smb tree connect request 2171 * @work: smb work containing request buffer 2172 * 2173 * Return: 0 on success, otherwise error 2174 */ 2175 int smb2_tree_disconnect(struct ksmbd_work *work) 2176 { 2177 struct smb2_tree_disconnect_rsp *rsp; 2178 struct smb2_tree_disconnect_req *req; 2179 struct ksmbd_session *sess = work->sess; 2180 struct ksmbd_tree_connect *tcon = work->tcon; 2181 int err; 2182 2183 ksmbd_debug(SMB, "Received smb2 tree disconnect request\n"); 2184 2185 WORK_BUFFERS(work, req, rsp); 2186 2187 if (!tcon) { 2188 ksmbd_debug(SMB, "Invalid tid %d\n", req->hdr.Id.SyncId.TreeId); 2189 2190 rsp->hdr.Status = STATUS_NETWORK_NAME_DELETED; 2191 err = -ENOENT; 2192 goto err_out; 2193 } 2194 2195 ksmbd_close_tree_conn_fds(work); 2196 2197 down_write(&sess->tree_conns_lock); 2198 if (tcon->t_state == TREE_DISCONNECTED) { 2199 up_write(&sess->tree_conns_lock); 2200 rsp->hdr.Status = STATUS_NETWORK_NAME_DELETED; 2201 err = -ENOENT; 2202 goto err_out; 2203 } 2204 2205 tcon->t_state = TREE_DISCONNECTED; 2206 up_write(&sess->tree_conns_lock); 2207 2208 err = ksmbd_tree_conn_disconnect(sess, tcon); 2209 if (err) { 2210 rsp->hdr.Status = STATUS_NETWORK_NAME_DELETED; 2211 goto err_out; 2212 } 2213 2214 rsp->StructureSize = cpu_to_le16(4); 2215 err = ksmbd_iov_pin_rsp(work, rsp, 2216 sizeof(struct smb2_tree_disconnect_rsp)); 2217 if (err) { 2218 rsp->hdr.Status = STATUS_INSUFFICIENT_RESOURCES; 2219 goto err_out; 2220 } 2221 2222 return 0; 2223 2224 err_out: 2225 smb2_set_err_rsp(work); 2226 return err; 2227 2228 } 2229 2230 /** 2231 * smb2_session_logoff() - handler for session log off request 2232 * @work: smb work containing request buffer 2233 * 2234 * Return: 0 on success, otherwise error 2235 */ 2236 int smb2_session_logoff(struct ksmbd_work *work) 2237 { 2238 struct ksmbd_conn *conn = work->conn; 2239 struct ksmbd_session *sess = work->sess; 2240 struct smb2_logoff_req *req; 2241 struct smb2_logoff_rsp *rsp; 2242 u64 sess_id; 2243 int err; 2244 2245 WORK_BUFFERS(work, req, rsp); 2246 2247 ksmbd_debug(SMB, "Received smb2 session logoff request\n"); 2248 2249 ksmbd_conn_lock(conn); 2250 if (!ksmbd_conn_good(conn)) { 2251 ksmbd_conn_unlock(conn); 2252 rsp->hdr.Status = STATUS_NETWORK_NAME_DELETED; 2253 smb2_set_err_rsp(work); 2254 return -ENOENT; 2255 } 2256 sess_id = le64_to_cpu(req->hdr.SessionId); 2257 ksmbd_all_conn_set_status(sess_id, KSMBD_SESS_NEED_RECONNECT); 2258 ksmbd_conn_unlock(conn); 2259 2260 ksmbd_close_session_fds(work); 2261 ksmbd_conn_wait_idle(conn); 2262 2263 if (ksmbd_tree_conn_session_logoff(sess)) { 2264 ksmbd_debug(SMB, "Invalid tid %d\n", req->hdr.Id.SyncId.TreeId); 2265 rsp->hdr.Status = STATUS_NETWORK_NAME_DELETED; 2266 smb2_set_err_rsp(work); 2267 return -ENOENT; 2268 } 2269 2270 down_write(&conn->session_lock); 2271 sess->state = SMB2_SESSION_EXPIRED; 2272 up_write(&conn->session_lock); 2273 2274 ksmbd_all_conn_set_status(sess_id, KSMBD_SESS_NEED_SETUP); 2275 2276 rsp->StructureSize = cpu_to_le16(4); 2277 err = ksmbd_iov_pin_rsp(work, rsp, sizeof(struct smb2_logoff_rsp)); 2278 if (err) { 2279 rsp->hdr.Status = STATUS_INSUFFICIENT_RESOURCES; 2280 smb2_set_err_rsp(work); 2281 return err; 2282 } 2283 return 0; 2284 } 2285 2286 /** 2287 * create_smb2_pipe() - create IPC pipe 2288 * @work: smb work containing request buffer 2289 * 2290 * Return: 0 on success, otherwise error 2291 */ 2292 static noinline int create_smb2_pipe(struct ksmbd_work *work) 2293 { 2294 struct smb2_create_rsp *rsp; 2295 struct smb2_create_req *req; 2296 int id = -1; 2297 int err; 2298 char *name; 2299 2300 WORK_BUFFERS(work, req, rsp); 2301 2302 name = smb_strndup_from_utf16(req->Buffer, le16_to_cpu(req->NameLength), 2303 1, work->conn->local_nls); 2304 if (IS_ERR(name)) { 2305 rsp->hdr.Status = STATUS_NO_MEMORY; 2306 err = PTR_ERR(name); 2307 goto out; 2308 } 2309 2310 id = ksmbd_session_rpc_open(work->sess, name); 2311 if (id < 0) { 2312 pr_err("Unable to open RPC pipe: %d\n", id); 2313 err = id; 2314 goto out; 2315 } 2316 2317 rsp->hdr.Status = STATUS_SUCCESS; 2318 rsp->StructureSize = cpu_to_le16(89); 2319 rsp->OplockLevel = SMB2_OPLOCK_LEVEL_NONE; 2320 rsp->Flags = 0; 2321 rsp->CreateAction = cpu_to_le32(FILE_OPENED); 2322 2323 rsp->CreationTime = cpu_to_le64(0); 2324 rsp->LastAccessTime = cpu_to_le64(0); 2325 rsp->ChangeTime = cpu_to_le64(0); 2326 rsp->AllocationSize = cpu_to_le64(0); 2327 rsp->EndofFile = cpu_to_le64(0); 2328 rsp->FileAttributes = FILE_ATTRIBUTE_NORMAL_LE; 2329 rsp->Reserved2 = 0; 2330 rsp->VolatileFileId = id; 2331 rsp->PersistentFileId = 0; 2332 rsp->CreateContextsOffset = 0; 2333 rsp->CreateContextsLength = 0; 2334 2335 err = ksmbd_iov_pin_rsp(work, rsp, offsetof(struct smb2_create_rsp, Buffer)); 2336 if (err) 2337 goto out; 2338 2339 kfree(name); 2340 return 0; 2341 2342 out: 2343 switch (err) { 2344 case -EINVAL: 2345 rsp->hdr.Status = STATUS_INVALID_PARAMETER; 2346 break; 2347 case -ENOSPC: 2348 case -ENOMEM: 2349 rsp->hdr.Status = STATUS_NO_MEMORY; 2350 break; 2351 } 2352 2353 if (id >= 0) 2354 ksmbd_session_rpc_close(work->sess, id); 2355 2356 if (!IS_ERR(name)) 2357 kfree(name); 2358 2359 smb2_set_err_rsp(work); 2360 return err; 2361 } 2362 2363 /** 2364 * smb2_set_ea() - handler for setting extended attributes using set 2365 * info command 2366 * @eabuf: set info command buffer 2367 * @buf_len: set info command buffer length 2368 * @path: dentry path for get ea 2369 * @get_write: get write access to a mount 2370 * 2371 * Return: 0 on success, otherwise error 2372 */ 2373 static int smb2_set_ea(struct smb2_ea_info *eabuf, unsigned int buf_len, 2374 const struct path *path, bool get_write) 2375 { 2376 struct mnt_idmap *idmap = mnt_idmap(path->mnt); 2377 char *attr_name = NULL, *value; 2378 int rc = 0; 2379 unsigned int next = 0; 2380 2381 if (buf_len < sizeof(struct smb2_ea_info) + eabuf->EaNameLength + 1 + 2382 le16_to_cpu(eabuf->EaValueLength)) 2383 return -EINVAL; 2384 2385 attr_name = kmalloc(XATTR_NAME_MAX + 1, KSMBD_DEFAULT_GFP); 2386 if (!attr_name) 2387 return -ENOMEM; 2388 2389 do { 2390 if (!eabuf->EaNameLength) 2391 goto next; 2392 2393 ksmbd_debug(SMB, 2394 "name : <%s>, name_len : %u, value_len : %u, next : %u\n", 2395 eabuf->name, eabuf->EaNameLength, 2396 le16_to_cpu(eabuf->EaValueLength), 2397 le32_to_cpu(eabuf->NextEntryOffset)); 2398 2399 if (eabuf->EaNameLength > 2400 (XATTR_NAME_MAX - XATTR_USER_PREFIX_LEN)) { 2401 rc = -EINVAL; 2402 break; 2403 } 2404 2405 memcpy(attr_name, XATTR_USER_PREFIX, XATTR_USER_PREFIX_LEN); 2406 memcpy(&attr_name[XATTR_USER_PREFIX_LEN], eabuf->name, 2407 eabuf->EaNameLength); 2408 attr_name[XATTR_USER_PREFIX_LEN + eabuf->EaNameLength] = '\0'; 2409 value = (char *)&eabuf->name + eabuf->EaNameLength + 1; 2410 2411 if (!eabuf->EaValueLength) { 2412 rc = ksmbd_vfs_casexattr_len(idmap, 2413 path->dentry, 2414 attr_name, 2415 XATTR_USER_PREFIX_LEN + 2416 eabuf->EaNameLength); 2417 2418 /* delete the EA only when it exits */ 2419 if (rc > 0) { 2420 rc = ksmbd_vfs_remove_xattr(idmap, 2421 path, 2422 attr_name, 2423 get_write); 2424 2425 if (rc < 0) { 2426 ksmbd_debug(SMB, 2427 "remove xattr failed(%d)\n", 2428 rc); 2429 break; 2430 } 2431 } 2432 2433 /* if the EA doesn't exist, just do nothing. */ 2434 rc = 0; 2435 } else { 2436 rc = ksmbd_vfs_setxattr(idmap, path, attr_name, value, 2437 le16_to_cpu(eabuf->EaValueLength), 2438 0, get_write); 2439 if (rc < 0) { 2440 ksmbd_debug(SMB, 2441 "ksmbd_vfs_setxattr is failed(%d)\n", 2442 rc); 2443 break; 2444 } 2445 } 2446 2447 next: 2448 next = le32_to_cpu(eabuf->NextEntryOffset); 2449 if (next == 0 || buf_len < next) 2450 break; 2451 buf_len -= next; 2452 eabuf = (struct smb2_ea_info *)((char *)eabuf + next); 2453 if (buf_len < sizeof(struct smb2_ea_info)) { 2454 rc = -EINVAL; 2455 break; 2456 } 2457 2458 if (buf_len < sizeof(struct smb2_ea_info) + eabuf->EaNameLength + 1 + 2459 le16_to_cpu(eabuf->EaValueLength)) { 2460 rc = -EINVAL; 2461 break; 2462 } 2463 } while (next != 0); 2464 2465 kfree(attr_name); 2466 return rc; 2467 } 2468 2469 static noinline int smb2_set_stream_name_xattr(const struct path *path, 2470 struct ksmbd_file *fp, 2471 char *stream_name, int s_type) 2472 { 2473 struct mnt_idmap *idmap = mnt_idmap(path->mnt); 2474 size_t xattr_stream_size; 2475 char *xattr_stream_name; 2476 int rc; 2477 2478 rc = ksmbd_vfs_xattr_stream_name(stream_name, 2479 &xattr_stream_name, 2480 &xattr_stream_size, 2481 s_type); 2482 if (rc) 2483 return rc; 2484 2485 fp->stream.name = xattr_stream_name; 2486 fp->stream.size = xattr_stream_size; 2487 2488 /* Check if there is stream prefix in xattr space */ 2489 rc = ksmbd_vfs_casexattr_len(idmap, 2490 path->dentry, 2491 xattr_stream_name, 2492 xattr_stream_size); 2493 if (rc >= 0) 2494 return 0; 2495 2496 if (fp->cdoption == FILE_OPEN_LE) { 2497 ksmbd_debug(SMB, "XATTR stream name lookup failed: %d\n", rc); 2498 return -EBADF; 2499 } 2500 2501 rc = ksmbd_vfs_setxattr(idmap, path, xattr_stream_name, NULL, 0, 0, false); 2502 if (rc < 0) 2503 pr_err("Failed to store XATTR stream name :%d\n", rc); 2504 return 0; 2505 } 2506 2507 static int smb2_remove_smb_xattrs(const struct path *path) 2508 { 2509 struct mnt_idmap *idmap = mnt_idmap(path->mnt); 2510 char *name, *xattr_list = NULL; 2511 ssize_t xattr_list_len; 2512 int err = 0; 2513 2514 xattr_list_len = ksmbd_vfs_listxattr(path->dentry, &xattr_list); 2515 if (xattr_list_len < 0) { 2516 goto out; 2517 } else if (!xattr_list_len) { 2518 ksmbd_debug(SMB, "empty xattr in the file\n"); 2519 goto out; 2520 } 2521 2522 for (name = xattr_list; name - xattr_list < xattr_list_len; 2523 name += strlen(name) + 1) { 2524 ksmbd_debug(SMB, "%s, len %zd\n", name, strlen(name)); 2525 2526 if (!strncmp(name, XATTR_USER_PREFIX, XATTR_USER_PREFIX_LEN) && 2527 !strncmp(&name[XATTR_USER_PREFIX_LEN], STREAM_PREFIX, 2528 STREAM_PREFIX_LEN)) { 2529 err = ksmbd_vfs_remove_xattr(idmap, path, 2530 name, true); 2531 if (err) 2532 ksmbd_debug(SMB, "remove xattr failed : %s\n", 2533 name); 2534 } 2535 } 2536 out: 2537 kvfree(xattr_list); 2538 return err; 2539 } 2540 2541 static int smb2_create_truncate(const struct path *path) 2542 { 2543 int rc = vfs_truncate(path, 0); 2544 2545 if (rc) { 2546 pr_err("vfs_truncate failed, rc %d\n", rc); 2547 return rc; 2548 } 2549 2550 rc = smb2_remove_smb_xattrs(path); 2551 if (rc == -EOPNOTSUPP) 2552 rc = 0; 2553 if (rc) 2554 ksmbd_debug(SMB, 2555 "ksmbd_truncate_stream_name_xattr failed, rc %d\n", 2556 rc); 2557 return rc; 2558 } 2559 2560 static void smb2_new_xattrs(struct ksmbd_tree_connect *tcon, const struct path *path, 2561 struct ksmbd_file *fp) 2562 { 2563 struct xattr_dos_attrib da = {0}; 2564 int rc; 2565 2566 if (!test_share_config_flag(tcon->share_conf, 2567 KSMBD_SHARE_FLAG_STORE_DOS_ATTRS)) 2568 return; 2569 2570 da.version = 4; 2571 da.attr = le32_to_cpu(fp->f_ci->m_fattr); 2572 da.itime = da.create_time = fp->create_time; 2573 da.flags = XATTR_DOSINFO_ATTRIB | XATTR_DOSINFO_CREATE_TIME | 2574 XATTR_DOSINFO_ITIME; 2575 2576 rc = ksmbd_vfs_set_dos_attrib_xattr(mnt_idmap(path->mnt), path, &da, true); 2577 if (rc) 2578 ksmbd_debug(SMB, "failed to store file attribute into xattr\n"); 2579 } 2580 2581 static void smb2_update_xattrs(struct ksmbd_tree_connect *tcon, 2582 const struct path *path, struct ksmbd_file *fp) 2583 { 2584 struct xattr_dos_attrib da; 2585 int rc; 2586 2587 fp->f_ci->m_fattr &= ~(FILE_ATTRIBUTE_HIDDEN_LE | FILE_ATTRIBUTE_SYSTEM_LE); 2588 2589 /* get FileAttributes from XATTR_NAME_DOS_ATTRIBUTE */ 2590 if (!test_share_config_flag(tcon->share_conf, 2591 KSMBD_SHARE_FLAG_STORE_DOS_ATTRS)) 2592 return; 2593 2594 rc = ksmbd_vfs_get_dos_attrib_xattr(mnt_idmap(path->mnt), 2595 path->dentry, &da); 2596 if (rc > 0) { 2597 fp->f_ci->m_fattr = cpu_to_le32(da.attr); 2598 fp->create_time = da.create_time; 2599 fp->itime = da.itime; 2600 } 2601 } 2602 2603 static int smb2_creat(struct ksmbd_work *work, 2604 struct path *path, char *name, int open_flags, 2605 umode_t posix_mode, bool is_dir) 2606 { 2607 struct ksmbd_tree_connect *tcon = work->tcon; 2608 struct ksmbd_share_config *share = tcon->share_conf; 2609 umode_t mode; 2610 int rc; 2611 2612 if (!(open_flags & O_CREAT)) 2613 return -EBADF; 2614 2615 ksmbd_debug(SMB, "file does not exist, so creating\n"); 2616 if (is_dir == true) { 2617 ksmbd_debug(SMB, "creating directory\n"); 2618 2619 mode = share_config_directory_mode(share, posix_mode); 2620 rc = ksmbd_vfs_mkdir(work, name, mode); 2621 if (rc) 2622 return rc; 2623 } else { 2624 ksmbd_debug(SMB, "creating regular file\n"); 2625 2626 mode = share_config_create_mode(share, posix_mode); 2627 rc = ksmbd_vfs_create(work, name, mode); 2628 if (rc) 2629 return rc; 2630 } 2631 2632 rc = ksmbd_vfs_kern_path(work, name, 0, path, 0); 2633 if (rc) { 2634 pr_err("cannot get linux path (%s), err = %d\n", 2635 name, rc); 2636 return rc; 2637 } 2638 return 0; 2639 } 2640 2641 static int smb2_create_sd_buffer(struct ksmbd_work *work, 2642 struct smb2_create_req *req, 2643 const struct path *path) 2644 { 2645 struct create_context *context; 2646 struct create_sd_buf_req *sd_buf; 2647 2648 if (!req->CreateContextsOffset) 2649 return -ENOENT; 2650 2651 /* Parse SD BUFFER create contexts */ 2652 context = smb2_find_context_vals(req, SMB2_CREATE_SD_BUFFER, 4); 2653 if (!context) 2654 return -ENOENT; 2655 else if (IS_ERR(context)) 2656 return PTR_ERR(context); 2657 2658 ksmbd_debug(SMB, 2659 "Set ACLs using SMB2_CREATE_SD_BUFFER context\n"); 2660 sd_buf = (struct create_sd_buf_req *)context; 2661 if (le16_to_cpu(context->DataOffset) + 2662 le32_to_cpu(context->DataLength) < 2663 sizeof(struct create_sd_buf_req)) 2664 return -EINVAL; 2665 return set_info_sec(work->conn, work->tcon, path, &sd_buf->ntsd, 2666 le32_to_cpu(sd_buf->ccontext.DataLength), true, false); 2667 } 2668 2669 static void ksmbd_acls_fattr(struct smb_fattr *fattr, 2670 struct mnt_idmap *idmap, 2671 struct inode *inode) 2672 { 2673 vfsuid_t vfsuid = i_uid_into_vfsuid(idmap, inode); 2674 vfsgid_t vfsgid = i_gid_into_vfsgid(idmap, inode); 2675 2676 fattr->cf_uid = vfsuid_into_kuid(vfsuid); 2677 fattr->cf_gid = vfsgid_into_kgid(vfsgid); 2678 fattr->cf_mode = inode->i_mode; 2679 fattr->cf_acls = NULL; 2680 fattr->cf_dacls = NULL; 2681 2682 if (IS_ENABLED(CONFIG_FS_POSIX_ACL)) { 2683 fattr->cf_acls = get_inode_acl(inode, ACL_TYPE_ACCESS); 2684 if (S_ISDIR(inode->i_mode)) 2685 fattr->cf_dacls = get_inode_acl(inode, ACL_TYPE_DEFAULT); 2686 } 2687 } 2688 2689 enum { 2690 DURABLE_RECONN_V2 = 1, 2691 DURABLE_RECONN, 2692 DURABLE_REQ_V2, 2693 DURABLE_REQ, 2694 }; 2695 2696 struct durable_info { 2697 struct ksmbd_file *fp; 2698 unsigned short int type; 2699 bool persistent; 2700 bool reconnected; 2701 unsigned int timeout; 2702 char *CreateGuid; 2703 }; 2704 2705 static int parse_durable_handle_context(struct ksmbd_work *work, 2706 struct smb2_create_req *req, 2707 struct lease_ctx_info *lc, 2708 struct durable_info *dh_info) 2709 { 2710 struct ksmbd_conn *conn = work->conn; 2711 struct create_context *context; 2712 int dh_idx, err = 0; 2713 u64 persistent_id = 0; 2714 int req_op_level; 2715 static const char * const durable_arr[] = {"DH2C", "DHnC", "DH2Q", "DHnQ"}; 2716 2717 req_op_level = req->RequestedOplockLevel; 2718 for (dh_idx = DURABLE_RECONN_V2; dh_idx <= ARRAY_SIZE(durable_arr); 2719 dh_idx++) { 2720 context = smb2_find_context_vals(req, durable_arr[dh_idx - 1], 4); 2721 if (IS_ERR(context)) { 2722 err = PTR_ERR(context); 2723 goto out; 2724 } 2725 if (!context) 2726 continue; 2727 2728 switch (dh_idx) { 2729 case DURABLE_RECONN_V2: 2730 { 2731 struct create_durable_handle_reconnect_v2 *recon_v2; 2732 2733 if (dh_info->type == DURABLE_RECONN || 2734 dh_info->type == DURABLE_REQ_V2) { 2735 err = -EINVAL; 2736 goto out; 2737 } 2738 2739 if (le16_to_cpu(context->DataOffset) + 2740 le32_to_cpu(context->DataLength) < 2741 sizeof(struct create_durable_handle_reconnect_v2)) { 2742 err = -EINVAL; 2743 goto out; 2744 } 2745 2746 recon_v2 = (struct create_durable_handle_reconnect_v2 *)context; 2747 persistent_id = recon_v2->dcontext.Fid.PersistentFileId; 2748 dh_info->fp = ksmbd_lookup_durable_fd(persistent_id); 2749 if (!dh_info->fp) { 2750 ksmbd_debug(SMB, "Failed to get durable handle state\n"); 2751 err = -EBADF; 2752 goto out; 2753 } 2754 2755 if (memcmp(dh_info->fp->create_guid, recon_v2->dcontext.CreateGuid, 2756 SMB2_CREATE_GUID_SIZE)) { 2757 err = -EBADF; 2758 ksmbd_put_durable_fd(dh_info->fp); 2759 goto out; 2760 } 2761 2762 dh_info->type = dh_idx; 2763 dh_info->reconnected = true; 2764 ksmbd_debug(SMB, 2765 "reconnect v2 Persistent-id from reconnect = %llu\n", 2766 persistent_id); 2767 break; 2768 } 2769 case DURABLE_RECONN: 2770 { 2771 create_durable_reconn_t *recon; 2772 2773 if (dh_info->type == DURABLE_RECONN_V2 || 2774 dh_info->type == DURABLE_REQ_V2) { 2775 err = -EINVAL; 2776 goto out; 2777 } 2778 2779 if (le16_to_cpu(context->DataOffset) + 2780 le32_to_cpu(context->DataLength) < 2781 sizeof(create_durable_reconn_t)) { 2782 err = -EINVAL; 2783 goto out; 2784 } 2785 2786 recon = (create_durable_reconn_t *)context; 2787 persistent_id = recon->Data.Fid.PersistentFileId; 2788 dh_info->fp = ksmbd_lookup_durable_fd(persistent_id); 2789 if (!dh_info->fp) { 2790 ksmbd_debug(SMB, "Failed to get durable handle state\n"); 2791 err = -EBADF; 2792 goto out; 2793 } 2794 2795 dh_info->type = dh_idx; 2796 dh_info->reconnected = true; 2797 ksmbd_debug(SMB, "reconnect Persistent-id from reconnect = %llu\n", 2798 persistent_id); 2799 break; 2800 } 2801 case DURABLE_REQ_V2: 2802 { 2803 struct create_durable_req_v2 *durable_v2_blob; 2804 2805 if (dh_info->type == DURABLE_RECONN || 2806 dh_info->type == DURABLE_RECONN_V2) { 2807 err = -EINVAL; 2808 goto out; 2809 } 2810 2811 if (le16_to_cpu(context->DataOffset) + 2812 le32_to_cpu(context->DataLength) < 2813 sizeof(struct create_durable_req_v2)) { 2814 err = -EINVAL; 2815 goto out; 2816 } 2817 2818 durable_v2_blob = 2819 (struct create_durable_req_v2 *)context; 2820 ksmbd_debug(SMB, "Request for durable v2 open\n"); 2821 dh_info->fp = ksmbd_lookup_fd_cguid(durable_v2_blob->dcontext.CreateGuid); 2822 if (dh_info->fp) { 2823 if (!memcmp(conn->ClientGUID, dh_info->fp->client_guid, 2824 SMB2_CLIENT_GUID_SIZE)) { 2825 if (!(req->hdr.Flags & SMB2_FLAGS_REPLAY_OPERATION)) { 2826 err = -ENOEXEC; 2827 ksmbd_put_durable_fd(dh_info->fp); 2828 goto out; 2829 } 2830 2831 dh_info->fp->conn = conn; 2832 dh_info->reconnected = true; 2833 goto out; 2834 } 2835 } 2836 2837 if ((lc && (lc->req_state & SMB2_LEASE_HANDLE_CACHING_LE)) || 2838 req_op_level == SMB2_OPLOCK_LEVEL_BATCH) { 2839 dh_info->CreateGuid = 2840 durable_v2_blob->dcontext.CreateGuid; 2841 dh_info->persistent = 2842 le32_to_cpu(durable_v2_blob->dcontext.Flags); 2843 dh_info->timeout = 2844 le32_to_cpu(durable_v2_blob->dcontext.Timeout); 2845 dh_info->type = dh_idx; 2846 } 2847 break; 2848 } 2849 case DURABLE_REQ: 2850 if (dh_info->type == DURABLE_RECONN) 2851 goto out; 2852 if (dh_info->type == DURABLE_RECONN_V2 || 2853 dh_info->type == DURABLE_REQ_V2) { 2854 err = -EINVAL; 2855 goto out; 2856 } 2857 2858 if ((lc && (lc->req_state & SMB2_LEASE_HANDLE_CACHING_LE)) || 2859 req_op_level == SMB2_OPLOCK_LEVEL_BATCH) { 2860 ksmbd_debug(SMB, "Request for durable open\n"); 2861 dh_info->type = dh_idx; 2862 } 2863 } 2864 } 2865 2866 out: 2867 return err; 2868 } 2869 2870 /** 2871 * smb2_open() - handler for smb file open request 2872 * @work: smb work containing request buffer 2873 * 2874 * Return: 0 on success, otherwise error 2875 */ 2876 int smb2_open(struct ksmbd_work *work) 2877 { 2878 struct ksmbd_conn *conn = work->conn; 2879 struct ksmbd_session *sess = work->sess; 2880 struct ksmbd_tree_connect *tcon = work->tcon; 2881 struct smb2_create_req *req; 2882 struct smb2_create_rsp *rsp; 2883 struct path path; 2884 struct ksmbd_share_config *share = tcon->share_conf; 2885 struct ksmbd_file *fp = NULL; 2886 struct file *filp = NULL; 2887 struct mnt_idmap *idmap = NULL; 2888 struct kstat stat; 2889 struct create_context *context; 2890 struct lease_ctx_info *lc = NULL; 2891 struct create_ea_buf_req *ea_buf = NULL; 2892 struct oplock_info *opinfo; 2893 struct durable_info dh_info = {0}; 2894 __le32 *next_ptr = NULL; 2895 int req_op_level = 0, open_flags = 0, may_flags = 0, file_info = 0; 2896 int rc = 0; 2897 int contxt_cnt = 0, query_disk_id = 0; 2898 bool maximal_access_ctxt = false, posix_ctxt = false; 2899 int s_type = 0; 2900 int next_off = 0; 2901 char *name = NULL; 2902 char *stream_name = NULL; 2903 bool file_present = false, created = false, already_permitted = false; 2904 int share_ret, need_truncate = 0; 2905 u64 time; 2906 umode_t posix_mode = 0; 2907 __le32 daccess, maximal_access = 0; 2908 int iov_len = 0; 2909 2910 ksmbd_debug(SMB, "Received smb2 create request\n"); 2911 2912 WORK_BUFFERS(work, req, rsp); 2913 2914 if (req->hdr.NextCommand && !work->next_smb2_rcv_hdr_off && 2915 (req->hdr.Flags & SMB2_FLAGS_RELATED_OPERATIONS)) { 2916 ksmbd_debug(SMB, "invalid flag in chained command\n"); 2917 rsp->hdr.Status = STATUS_INVALID_PARAMETER; 2918 smb2_set_err_rsp(work); 2919 return -EINVAL; 2920 } 2921 2922 if (test_share_config_flag(share, KSMBD_SHARE_FLAG_PIPE)) { 2923 ksmbd_debug(SMB, "IPC pipe create request\n"); 2924 return create_smb2_pipe(work); 2925 } 2926 2927 if (req->CreateContextsOffset && tcon->posix_extensions) { 2928 context = smb2_find_context_vals(req, SMB2_CREATE_TAG_POSIX, 16); 2929 if (IS_ERR(context)) { 2930 rc = PTR_ERR(context); 2931 goto err_out2; 2932 } else if (context) { 2933 struct create_posix *posix = (struct create_posix *)context; 2934 2935 if (le16_to_cpu(context->DataOffset) + 2936 le32_to_cpu(context->DataLength) < 2937 sizeof(struct create_posix) - 4) { 2938 rc = -EINVAL; 2939 goto err_out2; 2940 } 2941 ksmbd_debug(SMB, "get posix context\n"); 2942 2943 posix_mode = le32_to_cpu(posix->Mode); 2944 posix_ctxt = true; 2945 } 2946 } 2947 2948 if (req->NameLength) { 2949 name = smb2_get_name((char *)req + le16_to_cpu(req->NameOffset), 2950 le16_to_cpu(req->NameLength), 2951 work->conn->local_nls); 2952 if (IS_ERR(name)) { 2953 rc = PTR_ERR(name); 2954 name = NULL; 2955 goto err_out2; 2956 } 2957 2958 ksmbd_debug(SMB, "converted name = %s\n", name); 2959 2960 if (posix_ctxt == false) { 2961 if (strchr(name, ':')) { 2962 if (!test_share_config_flag(work->tcon->share_conf, 2963 KSMBD_SHARE_FLAG_STREAMS)) { 2964 rc = -EBADF; 2965 goto err_out2; 2966 } 2967 rc = parse_stream_name(name, &stream_name, &s_type); 2968 if (rc < 0) 2969 goto err_out2; 2970 } 2971 2972 rc = ksmbd_validate_filename(name); 2973 if (rc < 0) 2974 goto err_out2; 2975 } 2976 2977 if (ksmbd_share_veto_filename(share, name)) { 2978 rc = -ENOENT; 2979 ksmbd_debug(SMB, "Reject open(), vetoed file: %s\n", 2980 name); 2981 goto err_out2; 2982 } 2983 } else { 2984 name = kstrdup("", KSMBD_DEFAULT_GFP); 2985 if (!name) { 2986 rc = -ENOMEM; 2987 goto err_out2; 2988 } 2989 } 2990 2991 req_op_level = req->RequestedOplockLevel; 2992 2993 if (server_conf.flags & KSMBD_GLOBAL_FLAG_DURABLE_HANDLE && 2994 req->CreateContextsOffset) { 2995 lc = parse_lease_state(req); 2996 rc = parse_durable_handle_context(work, req, lc, &dh_info); 2997 if (rc) { 2998 ksmbd_debug(SMB, "error parsing durable handle context\n"); 2999 goto err_out2; 3000 } 3001 3002 if (dh_info.reconnected == true) { 3003 rc = smb2_check_durable_oplock(conn, share, dh_info.fp, lc, name); 3004 if (rc) { 3005 ksmbd_put_durable_fd(dh_info.fp); 3006 goto err_out2; 3007 } 3008 3009 rc = ksmbd_reopen_durable_fd(work, dh_info.fp); 3010 if (rc) { 3011 ksmbd_put_durable_fd(dh_info.fp); 3012 goto err_out2; 3013 } 3014 3015 if (ksmbd_override_fsids(work)) { 3016 rc = -ENOMEM; 3017 ksmbd_put_durable_fd(dh_info.fp); 3018 goto err_out2; 3019 } 3020 3021 fp = dh_info.fp; 3022 file_info = FILE_OPENED; 3023 3024 rc = ksmbd_vfs_getattr(&fp->filp->f_path, &stat); 3025 ksmbd_put_durable_fd(fp); 3026 if (rc) 3027 goto err_out2; 3028 3029 goto reconnected_fp; 3030 } 3031 } else if (req_op_level == SMB2_OPLOCK_LEVEL_LEASE) 3032 lc = parse_lease_state(req); 3033 3034 if (le32_to_cpu(req->ImpersonationLevel) > le32_to_cpu(IL_DELEGATE)) { 3035 pr_err("Invalid impersonationlevel : 0x%x\n", 3036 le32_to_cpu(req->ImpersonationLevel)); 3037 rc = -EIO; 3038 rsp->hdr.Status = STATUS_BAD_IMPERSONATION_LEVEL; 3039 goto err_out2; 3040 } 3041 3042 if (req->CreateOptions && !(req->CreateOptions & CREATE_OPTIONS_MASK_LE)) { 3043 pr_err("Invalid create options : 0x%x\n", 3044 le32_to_cpu(req->CreateOptions)); 3045 rc = -EINVAL; 3046 goto err_out2; 3047 } else { 3048 if (req->CreateOptions & FILE_SEQUENTIAL_ONLY_LE && 3049 req->CreateOptions & FILE_RANDOM_ACCESS_LE) 3050 req->CreateOptions = ~(FILE_SEQUENTIAL_ONLY_LE); 3051 3052 if (req->CreateOptions & 3053 (FILE_OPEN_BY_FILE_ID_LE | CREATE_TREE_CONNECTION | 3054 FILE_RESERVE_OPFILTER_LE)) { 3055 rc = -EOPNOTSUPP; 3056 goto err_out2; 3057 } 3058 3059 if (req->CreateOptions & FILE_DIRECTORY_FILE_LE) { 3060 if (req->CreateOptions & FILE_NON_DIRECTORY_FILE_LE) { 3061 rc = -EINVAL; 3062 goto err_out2; 3063 } else if (req->CreateOptions & FILE_NO_COMPRESSION_LE) { 3064 req->CreateOptions = ~(FILE_NO_COMPRESSION_LE); 3065 } 3066 } 3067 } 3068 3069 if (le32_to_cpu(req->CreateDisposition) > 3070 le32_to_cpu(FILE_OVERWRITE_IF_LE)) { 3071 pr_err("Invalid create disposition : 0x%x\n", 3072 le32_to_cpu(req->CreateDisposition)); 3073 rc = -EINVAL; 3074 goto err_out2; 3075 } 3076 3077 if (!(req->DesiredAccess & DESIRED_ACCESS_MASK)) { 3078 pr_err("Invalid desired access : 0x%x\n", 3079 le32_to_cpu(req->DesiredAccess)); 3080 rc = -EACCES; 3081 goto err_out2; 3082 } 3083 3084 if (req->FileAttributes && !(req->FileAttributes & FILE_ATTRIBUTE_MASK_LE)) { 3085 pr_err("Invalid file attribute : 0x%x\n", 3086 le32_to_cpu(req->FileAttributes)); 3087 rc = -EINVAL; 3088 goto err_out2; 3089 } 3090 3091 if (req->CreateContextsOffset) { 3092 /* Parse non-durable handle create contexts */ 3093 context = smb2_find_context_vals(req, SMB2_CREATE_EA_BUFFER, 4); 3094 if (IS_ERR(context)) { 3095 rc = PTR_ERR(context); 3096 goto err_out2; 3097 } else if (context) { 3098 ea_buf = (struct create_ea_buf_req *)context; 3099 if (le16_to_cpu(context->DataOffset) + 3100 le32_to_cpu(context->DataLength) < 3101 sizeof(struct create_ea_buf_req)) { 3102 rc = -EINVAL; 3103 goto err_out2; 3104 } 3105 if (req->CreateOptions & FILE_NO_EA_KNOWLEDGE_LE) { 3106 rsp->hdr.Status = STATUS_ACCESS_DENIED; 3107 rc = -EACCES; 3108 goto err_out2; 3109 } 3110 } 3111 3112 context = smb2_find_context_vals(req, 3113 SMB2_CREATE_QUERY_MAXIMAL_ACCESS_REQUEST, 4); 3114 if (IS_ERR(context)) { 3115 rc = PTR_ERR(context); 3116 goto err_out2; 3117 } else if (context) { 3118 ksmbd_debug(SMB, 3119 "get query maximal access context\n"); 3120 maximal_access_ctxt = 1; 3121 } 3122 3123 context = smb2_find_context_vals(req, 3124 SMB2_CREATE_TIMEWARP_REQUEST, 4); 3125 if (IS_ERR(context)) { 3126 rc = PTR_ERR(context); 3127 goto err_out2; 3128 } else if (context) { 3129 ksmbd_debug(SMB, "get timewarp context\n"); 3130 rc = -EBADF; 3131 goto err_out2; 3132 } 3133 } 3134 3135 if (ksmbd_override_fsids(work)) { 3136 rc = -ENOMEM; 3137 goto err_out2; 3138 } 3139 3140 rc = ksmbd_vfs_kern_path(work, name, LOOKUP_NO_SYMLINKS, 3141 &path, 1); 3142 if (!rc) { 3143 file_present = true; 3144 3145 if (req->CreateOptions & FILE_DELETE_ON_CLOSE_LE) { 3146 /* 3147 * If file exists with under flags, return access 3148 * denied error. 3149 */ 3150 if (req->CreateDisposition == FILE_OVERWRITE_IF_LE || 3151 req->CreateDisposition == FILE_OPEN_IF_LE) { 3152 rc = -EACCES; 3153 goto err_out; 3154 } 3155 3156 if (!test_tree_conn_flag(tcon, KSMBD_TREE_CONN_FLAG_WRITABLE)) { 3157 ksmbd_debug(SMB, 3158 "User does not have write permission\n"); 3159 rc = -EACCES; 3160 goto err_out; 3161 } 3162 } else if (d_is_symlink(path.dentry)) { 3163 rc = -EACCES; 3164 goto err_out; 3165 } 3166 3167 idmap = mnt_idmap(path.mnt); 3168 } else { 3169 if (rc != -ENOENT) 3170 goto err_out; 3171 ksmbd_debug(SMB, "can not get linux path for %s, rc = %d\n", 3172 name, rc); 3173 rc = 0; 3174 } 3175 3176 if (stream_name) { 3177 if (req->CreateOptions & FILE_DIRECTORY_FILE_LE) { 3178 if (s_type == DATA_STREAM) { 3179 rc = -EIO; 3180 rsp->hdr.Status = STATUS_NOT_A_DIRECTORY; 3181 } 3182 } else { 3183 if (file_present && S_ISDIR(d_inode(path.dentry)->i_mode) && 3184 s_type == DATA_STREAM) { 3185 rc = -EIO; 3186 rsp->hdr.Status = STATUS_FILE_IS_A_DIRECTORY; 3187 } 3188 } 3189 3190 if (req->CreateOptions & FILE_DIRECTORY_FILE_LE && 3191 req->FileAttributes & FILE_ATTRIBUTE_NORMAL_LE) { 3192 rsp->hdr.Status = STATUS_NOT_A_DIRECTORY; 3193 rc = -EIO; 3194 } 3195 3196 if (rc < 0) 3197 goto err_out; 3198 } 3199 3200 if (file_present && req->CreateOptions & FILE_NON_DIRECTORY_FILE_LE && 3201 S_ISDIR(d_inode(path.dentry)->i_mode) && 3202 !(req->CreateOptions & FILE_DELETE_ON_CLOSE_LE)) { 3203 ksmbd_debug(SMB, "open() argument is a directory: %s, %x\n", 3204 name, req->CreateOptions); 3205 rsp->hdr.Status = STATUS_FILE_IS_A_DIRECTORY; 3206 rc = -EIO; 3207 goto err_out; 3208 } 3209 3210 if (file_present && (req->CreateOptions & FILE_DIRECTORY_FILE_LE) && 3211 !(req->CreateDisposition == FILE_CREATE_LE) && 3212 !S_ISDIR(d_inode(path.dentry)->i_mode)) { 3213 rsp->hdr.Status = STATUS_NOT_A_DIRECTORY; 3214 rc = -EIO; 3215 goto err_out; 3216 } 3217 3218 if (!stream_name && file_present && 3219 req->CreateDisposition == FILE_CREATE_LE) { 3220 rc = -EEXIST; 3221 goto err_out; 3222 } 3223 3224 daccess = smb_map_generic_desired_access(req->DesiredAccess); 3225 3226 if (file_present && !(req->CreateOptions & FILE_DELETE_ON_CLOSE_LE)) { 3227 rc = smb_check_perm_dacl(conn, &path, &daccess, 3228 sess->user->uid); 3229 if (rc) 3230 goto err_out; 3231 } 3232 3233 if (daccess & FILE_MAXIMAL_ACCESS_LE) { 3234 if (!file_present) { 3235 daccess = cpu_to_le32(GENERIC_ALL_FLAGS); 3236 } else { 3237 ksmbd_vfs_query_maximal_access(idmap, 3238 path.dentry, 3239 &daccess); 3240 already_permitted = true; 3241 } 3242 maximal_access = daccess; 3243 } 3244 3245 open_flags = smb2_create_open_flags(file_present, daccess, 3246 req->CreateDisposition, 3247 &may_flags, 3248 req->CreateOptions, 3249 file_present ? d_inode(path.dentry)->i_mode : 0); 3250 3251 if (!test_tree_conn_flag(tcon, KSMBD_TREE_CONN_FLAG_WRITABLE)) { 3252 if (open_flags & (O_CREAT | O_TRUNC)) { 3253 ksmbd_debug(SMB, 3254 "User does not have write permission\n"); 3255 rc = -EACCES; 3256 goto err_out; 3257 } 3258 } 3259 3260 /*create file if not present */ 3261 if (!file_present) { 3262 rc = smb2_creat(work, &path, name, open_flags, 3263 posix_mode, 3264 req->CreateOptions & FILE_DIRECTORY_FILE_LE); 3265 if (rc) { 3266 if (rc == -ENOENT) { 3267 rc = -EIO; 3268 rsp->hdr.Status = STATUS_OBJECT_PATH_NOT_FOUND; 3269 } 3270 goto err_out; 3271 } 3272 3273 created = true; 3274 idmap = mnt_idmap(path.mnt); 3275 if (ea_buf) { 3276 if (le32_to_cpu(ea_buf->ccontext.DataLength) < 3277 sizeof(struct smb2_ea_info)) { 3278 rc = -EINVAL; 3279 goto err_out; 3280 } 3281 3282 rc = smb2_set_ea(&ea_buf->ea, 3283 le32_to_cpu(ea_buf->ccontext.DataLength), 3284 &path, false); 3285 if (rc == -EOPNOTSUPP) 3286 rc = 0; 3287 else if (rc) 3288 goto err_out; 3289 } 3290 } else if (!already_permitted) { 3291 /* FILE_READ_ATTRIBUTE is allowed without inode_permission, 3292 * because execute(search) permission on a parent directory, 3293 * is already granted. 3294 */ 3295 if (daccess & ~(FILE_READ_ATTRIBUTES_LE | FILE_READ_CONTROL_LE)) { 3296 rc = inode_permission(idmap, 3297 d_inode(path.dentry), 3298 may_flags); 3299 if (rc) 3300 goto err_out; 3301 3302 if ((daccess & FILE_DELETE_LE) || 3303 (req->CreateOptions & FILE_DELETE_ON_CLOSE_LE)) { 3304 rc = inode_permission(idmap, 3305 d_inode(path.dentry->d_parent), 3306 MAY_EXEC | MAY_WRITE); 3307 if (rc) 3308 goto err_out; 3309 } 3310 } 3311 } 3312 3313 rc = ksmbd_query_inode_status(path.dentry->d_parent); 3314 if (rc == KSMBD_INODE_STATUS_PENDING_DELETE) { 3315 rc = -EBUSY; 3316 goto err_out; 3317 } 3318 3319 rc = 0; 3320 filp = dentry_open(&path, open_flags, current_cred()); 3321 if (IS_ERR(filp)) { 3322 rc = PTR_ERR(filp); 3323 pr_err("dentry open for dir failed, rc %d\n", rc); 3324 goto err_out; 3325 } 3326 3327 if (file_present) { 3328 if (!(open_flags & O_TRUNC)) 3329 file_info = FILE_OPENED; 3330 else 3331 file_info = FILE_OVERWRITTEN; 3332 3333 if ((req->CreateDisposition & FILE_CREATE_MASK_LE) == 3334 FILE_SUPERSEDE_LE) 3335 file_info = FILE_SUPERSEDED; 3336 } else if (open_flags & O_CREAT) { 3337 file_info = FILE_CREATED; 3338 } 3339 3340 ksmbd_vfs_set_fadvise(filp, req->CreateOptions); 3341 3342 /* Obtain Volatile-ID */ 3343 fp = ksmbd_open_fd(work, filp); 3344 if (IS_ERR(fp)) { 3345 fput(filp); 3346 rc = PTR_ERR(fp); 3347 fp = NULL; 3348 goto err_out; 3349 } 3350 3351 /* Get Persistent-ID */ 3352 ksmbd_open_durable_fd(fp); 3353 if (!has_file_id(fp->persistent_id)) { 3354 rc = -ENOMEM; 3355 goto err_out; 3356 } 3357 3358 fp->cdoption = req->CreateDisposition; 3359 fp->daccess = daccess; 3360 fp->saccess = req->ShareAccess; 3361 fp->coption = req->CreateOptions; 3362 3363 /* Set default windows and posix acls if creating new file */ 3364 if (created) { 3365 int posix_acl_rc; 3366 struct inode *inode = d_inode(path.dentry); 3367 3368 posix_acl_rc = ksmbd_vfs_inherit_posix_acl(idmap, 3369 &path, 3370 d_inode(path.dentry->d_parent)); 3371 if (posix_acl_rc) 3372 ksmbd_debug(SMB, "inherit posix acl failed : %d\n", posix_acl_rc); 3373 3374 if (test_share_config_flag(work->tcon->share_conf, 3375 KSMBD_SHARE_FLAG_ACL_XATTR)) { 3376 rc = smb_inherit_dacl(conn, &path, sess->user->uid, 3377 sess->user->gid); 3378 } 3379 3380 if (rc) { 3381 rc = smb2_create_sd_buffer(work, req, &path); 3382 if (rc) { 3383 if (posix_acl_rc) 3384 ksmbd_vfs_set_init_posix_acl(idmap, 3385 &path); 3386 3387 if (test_share_config_flag(work->tcon->share_conf, 3388 KSMBD_SHARE_FLAG_ACL_XATTR)) { 3389 struct smb_fattr fattr; 3390 struct smb_ntsd *pntsd; 3391 int pntsd_size, ace_num = 0; 3392 3393 ksmbd_acls_fattr(&fattr, idmap, inode); 3394 if (fattr.cf_acls) 3395 ace_num = fattr.cf_acls->a_count; 3396 if (fattr.cf_dacls) 3397 ace_num += fattr.cf_dacls->a_count; 3398 3399 pntsd = kmalloc(sizeof(struct smb_ntsd) + 3400 sizeof(struct smb_sid) * 3 + 3401 sizeof(struct smb_acl) + 3402 sizeof(struct smb_ace) * ace_num * 2, 3403 KSMBD_DEFAULT_GFP); 3404 if (!pntsd) { 3405 posix_acl_release(fattr.cf_acls); 3406 posix_acl_release(fattr.cf_dacls); 3407 goto err_out; 3408 } 3409 3410 rc = build_sec_desc(idmap, 3411 pntsd, NULL, 0, 3412 OWNER_SECINFO | 3413 GROUP_SECINFO | 3414 DACL_SECINFO, 3415 &pntsd_size, &fattr); 3416 posix_acl_release(fattr.cf_acls); 3417 posix_acl_release(fattr.cf_dacls); 3418 if (rc) { 3419 kfree(pntsd); 3420 goto err_out; 3421 } 3422 3423 rc = ksmbd_vfs_set_sd_xattr(conn, 3424 idmap, 3425 &path, 3426 pntsd, 3427 pntsd_size, 3428 false); 3429 kfree(pntsd); 3430 if (rc) 3431 pr_err("failed to store ntacl in xattr : %d\n", 3432 rc); 3433 } 3434 } 3435 } 3436 rc = 0; 3437 } 3438 3439 if (stream_name) { 3440 rc = smb2_set_stream_name_xattr(&path, 3441 fp, 3442 stream_name, 3443 s_type); 3444 if (rc) 3445 goto err_out; 3446 file_info = FILE_CREATED; 3447 } 3448 3449 fp->attrib_only = !(req->DesiredAccess & ~(FILE_READ_ATTRIBUTES_LE | 3450 FILE_WRITE_ATTRIBUTES_LE | FILE_SYNCHRONIZE_LE)); 3451 3452 fp->is_posix_ctxt = posix_ctxt; 3453 3454 /* fp should be searchable through ksmbd_inode.m_fp_list 3455 * after daccess, saccess, attrib_only, and stream are 3456 * initialized. 3457 */ 3458 down_write(&fp->f_ci->m_lock); 3459 list_add(&fp->node, &fp->f_ci->m_fp_list); 3460 up_write(&fp->f_ci->m_lock); 3461 3462 /* Check delete pending among previous fp before oplock break */ 3463 if (ksmbd_inode_pending_delete(fp)) { 3464 rc = -EBUSY; 3465 goto err_out; 3466 } 3467 3468 if (file_present || created) 3469 path_put(&path); 3470 3471 if (!S_ISDIR(file_inode(filp)->i_mode) && open_flags & O_TRUNC && 3472 !fp->attrib_only && !stream_name) { 3473 smb_break_all_oplock(work, fp); 3474 need_truncate = 1; 3475 } 3476 3477 share_ret = ksmbd_smb_check_shared_mode(fp->filp, fp); 3478 if (!test_share_config_flag(work->tcon->share_conf, KSMBD_SHARE_FLAG_OPLOCKS) || 3479 (req_op_level == SMB2_OPLOCK_LEVEL_LEASE && 3480 !(conn->vals->req_capabilities & SMB2_GLOBAL_CAP_LEASING))) { 3481 if (share_ret < 0 && !S_ISDIR(file_inode(fp->filp)->i_mode)) { 3482 rc = share_ret; 3483 goto err_out1; 3484 } 3485 } else { 3486 if (req_op_level == SMB2_OPLOCK_LEVEL_LEASE && lc) { 3487 if (S_ISDIR(file_inode(filp)->i_mode)) { 3488 lc->req_state &= ~SMB2_LEASE_WRITE_CACHING_LE; 3489 lc->is_dir = true; 3490 } 3491 3492 /* 3493 * Compare parent lease using parent key. If there is no 3494 * a lease that has same parent key, Send lease break 3495 * notification. 3496 */ 3497 smb_send_parent_lease_break_noti(fp, lc); 3498 3499 req_op_level = smb2_map_lease_to_oplock(lc->req_state); 3500 ksmbd_debug(SMB, 3501 "lease req for(%s) req oplock state 0x%x, lease state 0x%x\n", 3502 name, req_op_level, lc->req_state); 3503 rc = find_same_lease_key(sess, fp->f_ci, lc); 3504 if (rc) 3505 goto err_out1; 3506 } else if (open_flags == O_RDONLY && 3507 (req_op_level == SMB2_OPLOCK_LEVEL_BATCH || 3508 req_op_level == SMB2_OPLOCK_LEVEL_EXCLUSIVE)) 3509 req_op_level = SMB2_OPLOCK_LEVEL_II; 3510 3511 rc = smb_grant_oplock(work, req_op_level, 3512 fp->persistent_id, fp, 3513 le32_to_cpu(req->hdr.Id.SyncId.TreeId), 3514 lc, share_ret); 3515 if (rc < 0) 3516 goto err_out1; 3517 } 3518 3519 if (req->CreateOptions & FILE_DELETE_ON_CLOSE_LE) 3520 ksmbd_fd_set_delete_on_close(fp, file_info); 3521 3522 if (need_truncate) { 3523 rc = smb2_create_truncate(&fp->filp->f_path); 3524 if (rc) 3525 goto err_out1; 3526 } 3527 3528 if (req->CreateContextsOffset) { 3529 struct create_alloc_size_req *az_req; 3530 3531 az_req = (struct create_alloc_size_req *)smb2_find_context_vals(req, 3532 SMB2_CREATE_ALLOCATION_SIZE, 4); 3533 if (IS_ERR(az_req)) { 3534 rc = PTR_ERR(az_req); 3535 goto err_out1; 3536 } else if (az_req) { 3537 loff_t alloc_size; 3538 int err; 3539 3540 if (le16_to_cpu(az_req->ccontext.DataOffset) + 3541 le32_to_cpu(az_req->ccontext.DataLength) < 3542 sizeof(struct create_alloc_size_req)) { 3543 rc = -EINVAL; 3544 goto err_out1; 3545 } 3546 alloc_size = le64_to_cpu(az_req->AllocationSize); 3547 ksmbd_debug(SMB, 3548 "request smb2 create allocate size : %llu\n", 3549 alloc_size); 3550 smb_break_all_levII_oplock(work, fp, 1); 3551 err = vfs_fallocate(fp->filp, FALLOC_FL_KEEP_SIZE, 0, 3552 alloc_size); 3553 if (err < 0) 3554 ksmbd_debug(SMB, 3555 "vfs_fallocate is failed : %d\n", 3556 err); 3557 } 3558 3559 context = smb2_find_context_vals(req, SMB2_CREATE_QUERY_ON_DISK_ID, 4); 3560 if (IS_ERR(context)) { 3561 rc = PTR_ERR(context); 3562 goto err_out1; 3563 } else if (context) { 3564 ksmbd_debug(SMB, "get query on disk id context\n"); 3565 query_disk_id = 1; 3566 } 3567 3568 if (conn->is_aapl == false) { 3569 context = smb2_find_context_vals(req, SMB2_CREATE_AAPL, 4); 3570 if (IS_ERR(context)) { 3571 rc = PTR_ERR(context); 3572 goto err_out1; 3573 } else if (context) 3574 conn->is_aapl = true; 3575 } 3576 } 3577 3578 rc = ksmbd_vfs_getattr(&path, &stat); 3579 if (rc) 3580 goto err_out1; 3581 3582 if (stat.result_mask & STATX_BTIME) 3583 fp->create_time = ksmbd_UnixTimeToNT(stat.btime); 3584 else 3585 fp->create_time = ksmbd_UnixTimeToNT(stat.ctime); 3586 if (req->FileAttributes || fp->f_ci->m_fattr == 0) 3587 fp->f_ci->m_fattr = 3588 cpu_to_le32(smb2_get_dos_mode(&stat, le32_to_cpu(req->FileAttributes))); 3589 3590 if (!created) 3591 smb2_update_xattrs(tcon, &path, fp); 3592 else 3593 smb2_new_xattrs(tcon, &path, fp); 3594 3595 memcpy(fp->client_guid, conn->ClientGUID, SMB2_CLIENT_GUID_SIZE); 3596 3597 if (dh_info.type == DURABLE_REQ_V2 || dh_info.type == DURABLE_REQ) { 3598 if (dh_info.type == DURABLE_REQ_V2 && dh_info.persistent && 3599 test_share_config_flag(work->tcon->share_conf, 3600 KSMBD_SHARE_FLAG_CONTINUOUS_AVAILABILITY)) 3601 fp->is_persistent = true; 3602 else 3603 fp->is_durable = true; 3604 3605 if (dh_info.type == DURABLE_REQ_V2) { 3606 memcpy(fp->create_guid, dh_info.CreateGuid, 3607 SMB2_CREATE_GUID_SIZE); 3608 if (dh_info.timeout) 3609 fp->durable_timeout = 3610 min_t(unsigned int, dh_info.timeout, 3611 DURABLE_HANDLE_MAX_TIMEOUT); 3612 else 3613 fp->durable_timeout = 60; 3614 } 3615 } 3616 3617 reconnected_fp: 3618 rsp->StructureSize = cpu_to_le16(89); 3619 rcu_read_lock(); 3620 opinfo = rcu_dereference(fp->f_opinfo); 3621 rsp->OplockLevel = opinfo != NULL ? opinfo->level : 0; 3622 rcu_read_unlock(); 3623 rsp->Flags = 0; 3624 rsp->CreateAction = cpu_to_le32(file_info); 3625 rsp->CreationTime = cpu_to_le64(fp->create_time); 3626 time = ksmbd_UnixTimeToNT(stat.atime); 3627 rsp->LastAccessTime = cpu_to_le64(time); 3628 time = ksmbd_UnixTimeToNT(stat.mtime); 3629 rsp->LastWriteTime = cpu_to_le64(time); 3630 time = ksmbd_UnixTimeToNT(stat.ctime); 3631 rsp->ChangeTime = cpu_to_le64(time); 3632 rsp->AllocationSize = S_ISDIR(stat.mode) ? 0 : 3633 cpu_to_le64(stat.blocks << 9); 3634 rsp->EndofFile = S_ISDIR(stat.mode) ? 0 : cpu_to_le64(stat.size); 3635 rsp->FileAttributes = fp->f_ci->m_fattr; 3636 3637 rsp->Reserved2 = 0; 3638 3639 rsp->PersistentFileId = fp->persistent_id; 3640 rsp->VolatileFileId = fp->volatile_id; 3641 3642 rsp->CreateContextsOffset = 0; 3643 rsp->CreateContextsLength = 0; 3644 iov_len = offsetof(struct smb2_create_rsp, Buffer); 3645 3646 /* If lease is request send lease context response */ 3647 if (opinfo && opinfo->is_lease) { 3648 struct create_context *lease_ccontext; 3649 3650 ksmbd_debug(SMB, "lease granted on(%s) lease state 0x%x\n", 3651 name, opinfo->o_lease->state); 3652 rsp->OplockLevel = SMB2_OPLOCK_LEVEL_LEASE; 3653 3654 lease_ccontext = (struct create_context *)rsp->Buffer; 3655 contxt_cnt++; 3656 create_lease_buf(rsp->Buffer, opinfo->o_lease); 3657 le32_add_cpu(&rsp->CreateContextsLength, 3658 conn->vals->create_lease_size); 3659 iov_len += conn->vals->create_lease_size; 3660 next_ptr = &lease_ccontext->Next; 3661 next_off = conn->vals->create_lease_size; 3662 } 3663 3664 if (maximal_access_ctxt) { 3665 struct create_context *mxac_ccontext; 3666 3667 if (maximal_access == 0) 3668 ksmbd_vfs_query_maximal_access(idmap, 3669 path.dentry, 3670 &maximal_access); 3671 mxac_ccontext = (struct create_context *)(rsp->Buffer + 3672 le32_to_cpu(rsp->CreateContextsLength)); 3673 contxt_cnt++; 3674 create_mxac_rsp_buf(rsp->Buffer + 3675 le32_to_cpu(rsp->CreateContextsLength), 3676 le32_to_cpu(maximal_access)); 3677 le32_add_cpu(&rsp->CreateContextsLength, 3678 conn->vals->create_mxac_size); 3679 iov_len += conn->vals->create_mxac_size; 3680 if (next_ptr) 3681 *next_ptr = cpu_to_le32(next_off); 3682 next_ptr = &mxac_ccontext->Next; 3683 next_off = conn->vals->create_mxac_size; 3684 } 3685 3686 if (query_disk_id) { 3687 struct create_context *disk_id_ccontext; 3688 3689 disk_id_ccontext = (struct create_context *)(rsp->Buffer + 3690 le32_to_cpu(rsp->CreateContextsLength)); 3691 contxt_cnt++; 3692 create_disk_id_rsp_buf(rsp->Buffer + 3693 le32_to_cpu(rsp->CreateContextsLength), 3694 stat.ino, tcon->id); 3695 le32_add_cpu(&rsp->CreateContextsLength, 3696 conn->vals->create_disk_id_size); 3697 iov_len += conn->vals->create_disk_id_size; 3698 if (next_ptr) 3699 *next_ptr = cpu_to_le32(next_off); 3700 next_ptr = &disk_id_ccontext->Next; 3701 next_off = conn->vals->create_disk_id_size; 3702 } 3703 3704 if (dh_info.type == DURABLE_REQ || dh_info.type == DURABLE_REQ_V2) { 3705 struct create_context *durable_ccontext; 3706 3707 durable_ccontext = (struct create_context *)(rsp->Buffer + 3708 le32_to_cpu(rsp->CreateContextsLength)); 3709 contxt_cnt++; 3710 if (dh_info.type == DURABLE_REQ) { 3711 create_durable_rsp_buf(rsp->Buffer + 3712 le32_to_cpu(rsp->CreateContextsLength)); 3713 le32_add_cpu(&rsp->CreateContextsLength, 3714 conn->vals->create_durable_size); 3715 iov_len += conn->vals->create_durable_size; 3716 } else { 3717 create_durable_v2_rsp_buf(rsp->Buffer + 3718 le32_to_cpu(rsp->CreateContextsLength), 3719 fp); 3720 le32_add_cpu(&rsp->CreateContextsLength, 3721 conn->vals->create_durable_v2_size); 3722 iov_len += conn->vals->create_durable_v2_size; 3723 } 3724 3725 if (next_ptr) 3726 *next_ptr = cpu_to_le32(next_off); 3727 next_ptr = &durable_ccontext->Next; 3728 next_off = conn->vals->create_durable_size; 3729 } 3730 3731 if (posix_ctxt) { 3732 contxt_cnt++; 3733 create_posix_rsp_buf(rsp->Buffer + 3734 le32_to_cpu(rsp->CreateContextsLength), 3735 fp); 3736 le32_add_cpu(&rsp->CreateContextsLength, 3737 conn->vals->create_posix_size); 3738 iov_len += conn->vals->create_posix_size; 3739 if (next_ptr) 3740 *next_ptr = cpu_to_le32(next_off); 3741 } 3742 3743 if (contxt_cnt > 0) { 3744 rsp->CreateContextsOffset = 3745 cpu_to_le32(offsetof(struct smb2_create_rsp, Buffer)); 3746 } 3747 3748 err_out: 3749 if (rc && (file_present || created)) 3750 path_put(&path); 3751 3752 err_out1: 3753 ksmbd_revert_fsids(work); 3754 3755 err_out2: 3756 if (!rc) { 3757 ksmbd_update_fstate(&work->sess->file_table, fp, FP_INITED); 3758 rc = ksmbd_iov_pin_rsp(work, (void *)rsp, iov_len); 3759 } 3760 if (rc) { 3761 if (rc == -EINVAL) 3762 rsp->hdr.Status = STATUS_INVALID_PARAMETER; 3763 else if (rc == -EOPNOTSUPP) 3764 rsp->hdr.Status = STATUS_NOT_SUPPORTED; 3765 else if (rc == -EACCES || rc == -ESTALE || rc == -EXDEV) 3766 rsp->hdr.Status = STATUS_ACCESS_DENIED; 3767 else if (rc == -ENOENT) 3768 rsp->hdr.Status = STATUS_OBJECT_NAME_INVALID; 3769 else if (rc == -EPERM) 3770 rsp->hdr.Status = STATUS_SHARING_VIOLATION; 3771 else if (rc == -EBUSY) 3772 rsp->hdr.Status = STATUS_DELETE_PENDING; 3773 else if (rc == -EBADF) 3774 rsp->hdr.Status = STATUS_OBJECT_NAME_NOT_FOUND; 3775 else if (rc == -ENOEXEC) 3776 rsp->hdr.Status = STATUS_DUPLICATE_OBJECTID; 3777 else if (rc == -ENXIO) 3778 rsp->hdr.Status = STATUS_NO_SUCH_DEVICE; 3779 else if (rc == -EEXIST) 3780 rsp->hdr.Status = STATUS_OBJECT_NAME_COLLISION; 3781 else if (rc == -EMFILE) 3782 rsp->hdr.Status = STATUS_INSUFFICIENT_RESOURCES; 3783 if (!rsp->hdr.Status) 3784 rsp->hdr.Status = STATUS_UNEXPECTED_IO_ERROR; 3785 3786 if (fp) 3787 ksmbd_fd_put(work, fp); 3788 smb2_set_err_rsp(work); 3789 ksmbd_debug(SMB, "Error response: %x\n", rsp->hdr.Status); 3790 } 3791 3792 kfree(name); 3793 kfree(lc); 3794 3795 return rc; 3796 } 3797 3798 static int readdir_info_level_struct_sz(int info_level) 3799 { 3800 switch (info_level) { 3801 case FILE_FULL_DIRECTORY_INFORMATION: 3802 return sizeof(FILE_FULL_DIRECTORY_INFO); 3803 case FILE_BOTH_DIRECTORY_INFORMATION: 3804 return sizeof(FILE_BOTH_DIRECTORY_INFO); 3805 case FILE_DIRECTORY_INFORMATION: 3806 return sizeof(FILE_DIRECTORY_INFO); 3807 case FILE_NAMES_INFORMATION: 3808 return sizeof(struct file_names_info); 3809 case FILEID_FULL_DIRECTORY_INFORMATION: 3810 return sizeof(FILE_ID_FULL_DIR_INFO); 3811 case FILEID_BOTH_DIRECTORY_INFORMATION: 3812 return sizeof(struct file_id_both_directory_info); 3813 case SMB_FIND_FILE_POSIX_INFO: 3814 return sizeof(struct smb2_posix_info); 3815 default: 3816 return -EOPNOTSUPP; 3817 } 3818 } 3819 3820 static int dentry_name(struct ksmbd_dir_info *d_info, int info_level) 3821 { 3822 switch (info_level) { 3823 case FILE_FULL_DIRECTORY_INFORMATION: 3824 { 3825 FILE_FULL_DIRECTORY_INFO *ffdinfo; 3826 3827 ffdinfo = (FILE_FULL_DIRECTORY_INFO *)d_info->rptr; 3828 d_info->rptr += le32_to_cpu(ffdinfo->NextEntryOffset); 3829 d_info->name = ffdinfo->FileName; 3830 d_info->name_len = le32_to_cpu(ffdinfo->FileNameLength); 3831 return 0; 3832 } 3833 case FILE_BOTH_DIRECTORY_INFORMATION: 3834 { 3835 FILE_BOTH_DIRECTORY_INFO *fbdinfo; 3836 3837 fbdinfo = (FILE_BOTH_DIRECTORY_INFO *)d_info->rptr; 3838 d_info->rptr += le32_to_cpu(fbdinfo->NextEntryOffset); 3839 d_info->name = fbdinfo->FileName; 3840 d_info->name_len = le32_to_cpu(fbdinfo->FileNameLength); 3841 return 0; 3842 } 3843 case FILE_DIRECTORY_INFORMATION: 3844 { 3845 FILE_DIRECTORY_INFO *fdinfo; 3846 3847 fdinfo = (FILE_DIRECTORY_INFO *)d_info->rptr; 3848 d_info->rptr += le32_to_cpu(fdinfo->NextEntryOffset); 3849 d_info->name = fdinfo->FileName; 3850 d_info->name_len = le32_to_cpu(fdinfo->FileNameLength); 3851 return 0; 3852 } 3853 case FILE_NAMES_INFORMATION: 3854 { 3855 struct file_names_info *fninfo; 3856 3857 fninfo = (struct file_names_info *)d_info->rptr; 3858 d_info->rptr += le32_to_cpu(fninfo->NextEntryOffset); 3859 d_info->name = fninfo->FileName; 3860 d_info->name_len = le32_to_cpu(fninfo->FileNameLength); 3861 return 0; 3862 } 3863 case FILEID_FULL_DIRECTORY_INFORMATION: 3864 { 3865 FILE_ID_FULL_DIR_INFO *dinfo; 3866 3867 dinfo = (FILE_ID_FULL_DIR_INFO *)d_info->rptr; 3868 d_info->rptr += le32_to_cpu(dinfo->NextEntryOffset); 3869 d_info->name = dinfo->FileName; 3870 d_info->name_len = le32_to_cpu(dinfo->FileNameLength); 3871 return 0; 3872 } 3873 case FILEID_BOTH_DIRECTORY_INFORMATION: 3874 { 3875 struct file_id_both_directory_info *fibdinfo; 3876 3877 fibdinfo = (struct file_id_both_directory_info *)d_info->rptr; 3878 d_info->rptr += le32_to_cpu(fibdinfo->NextEntryOffset); 3879 d_info->name = fibdinfo->FileName; 3880 d_info->name_len = le32_to_cpu(fibdinfo->FileNameLength); 3881 return 0; 3882 } 3883 case SMB_FIND_FILE_POSIX_INFO: 3884 { 3885 struct smb2_posix_info *posix_info; 3886 3887 posix_info = (struct smb2_posix_info *)d_info->rptr; 3888 d_info->rptr += le32_to_cpu(posix_info->NextEntryOffset); 3889 d_info->name = posix_info->name; 3890 d_info->name_len = le32_to_cpu(posix_info->name_len); 3891 return 0; 3892 } 3893 default: 3894 return -EINVAL; 3895 } 3896 } 3897 3898 /** 3899 * smb2_populate_readdir_entry() - encode directory entry in smb2 response 3900 * buffer 3901 * @conn: connection instance 3902 * @info_level: smb information level 3903 * @d_info: structure included variables for query dir 3904 * @ksmbd_kstat: ksmbd wrapper of dirent stat information 3905 * 3906 * if directory has many entries, find first can't read it fully. 3907 * find next might be called multiple times to read remaining dir entries 3908 * 3909 * Return: 0 on success, otherwise error 3910 */ 3911 static int smb2_populate_readdir_entry(struct ksmbd_conn *conn, int info_level, 3912 struct ksmbd_dir_info *d_info, 3913 struct ksmbd_kstat *ksmbd_kstat) 3914 { 3915 int next_entry_offset = 0; 3916 char *conv_name; 3917 int conv_len; 3918 void *kstat; 3919 int struct_sz, rc = 0; 3920 3921 conv_name = ksmbd_convert_dir_info_name(d_info, 3922 conn->local_nls, 3923 &conv_len); 3924 if (!conv_name) 3925 return -ENOMEM; 3926 3927 /* Somehow the name has only terminating NULL bytes */ 3928 if (conv_len < 0) { 3929 rc = -EINVAL; 3930 goto free_conv_name; 3931 } 3932 3933 struct_sz = readdir_info_level_struct_sz(info_level) + conv_len; 3934 next_entry_offset = ALIGN(struct_sz, KSMBD_DIR_INFO_ALIGNMENT); 3935 d_info->last_entry_off_align = next_entry_offset - struct_sz; 3936 3937 if (next_entry_offset > d_info->out_buf_len) { 3938 d_info->out_buf_len = 0; 3939 rc = -ENOSPC; 3940 goto free_conv_name; 3941 } 3942 3943 kstat = d_info->wptr; 3944 if (info_level != FILE_NAMES_INFORMATION) 3945 kstat = ksmbd_vfs_init_kstat(&d_info->wptr, ksmbd_kstat); 3946 3947 switch (info_level) { 3948 case FILE_FULL_DIRECTORY_INFORMATION: 3949 { 3950 FILE_FULL_DIRECTORY_INFO *ffdinfo; 3951 3952 ffdinfo = (FILE_FULL_DIRECTORY_INFO *)kstat; 3953 ffdinfo->FileNameLength = cpu_to_le32(conv_len); 3954 ffdinfo->EaSize = 3955 smb2_get_reparse_tag_special_file(ksmbd_kstat->kstat->mode); 3956 if (ffdinfo->EaSize) 3957 ffdinfo->ExtFileAttributes = FILE_ATTRIBUTE_REPARSE_POINT_LE; 3958 if (d_info->hide_dot_file && d_info->name[0] == '.') 3959 ffdinfo->ExtFileAttributes |= FILE_ATTRIBUTE_HIDDEN_LE; 3960 memcpy(ffdinfo->FileName, conv_name, conv_len); 3961 ffdinfo->NextEntryOffset = cpu_to_le32(next_entry_offset); 3962 break; 3963 } 3964 case FILE_BOTH_DIRECTORY_INFORMATION: 3965 { 3966 FILE_BOTH_DIRECTORY_INFO *fbdinfo; 3967 3968 fbdinfo = (FILE_BOTH_DIRECTORY_INFO *)kstat; 3969 fbdinfo->FileNameLength = cpu_to_le32(conv_len); 3970 fbdinfo->EaSize = 3971 smb2_get_reparse_tag_special_file(ksmbd_kstat->kstat->mode); 3972 if (fbdinfo->EaSize) 3973 fbdinfo->ExtFileAttributes = FILE_ATTRIBUTE_REPARSE_POINT_LE; 3974 fbdinfo->ShortNameLength = 0; 3975 fbdinfo->Reserved = 0; 3976 if (d_info->hide_dot_file && d_info->name[0] == '.') 3977 fbdinfo->ExtFileAttributes |= FILE_ATTRIBUTE_HIDDEN_LE; 3978 memcpy(fbdinfo->FileName, conv_name, conv_len); 3979 fbdinfo->NextEntryOffset = cpu_to_le32(next_entry_offset); 3980 break; 3981 } 3982 case FILE_DIRECTORY_INFORMATION: 3983 { 3984 FILE_DIRECTORY_INFO *fdinfo; 3985 3986 fdinfo = (FILE_DIRECTORY_INFO *)kstat; 3987 fdinfo->FileNameLength = cpu_to_le32(conv_len); 3988 if (d_info->hide_dot_file && d_info->name[0] == '.') 3989 fdinfo->ExtFileAttributes |= FILE_ATTRIBUTE_HIDDEN_LE; 3990 memcpy(fdinfo->FileName, conv_name, conv_len); 3991 fdinfo->NextEntryOffset = cpu_to_le32(next_entry_offset); 3992 break; 3993 } 3994 case FILE_NAMES_INFORMATION: 3995 { 3996 struct file_names_info *fninfo; 3997 3998 fninfo = (struct file_names_info *)kstat; 3999 fninfo->FileNameLength = cpu_to_le32(conv_len); 4000 memcpy(fninfo->FileName, conv_name, conv_len); 4001 fninfo->NextEntryOffset = cpu_to_le32(next_entry_offset); 4002 break; 4003 } 4004 case FILEID_FULL_DIRECTORY_INFORMATION: 4005 { 4006 FILE_ID_FULL_DIR_INFO *dinfo; 4007 4008 dinfo = (FILE_ID_FULL_DIR_INFO *)kstat; 4009 dinfo->FileNameLength = cpu_to_le32(conv_len); 4010 dinfo->EaSize = 4011 smb2_get_reparse_tag_special_file(ksmbd_kstat->kstat->mode); 4012 if (dinfo->EaSize) 4013 dinfo->ExtFileAttributes = FILE_ATTRIBUTE_REPARSE_POINT_LE; 4014 dinfo->Reserved = 0; 4015 if (conn->is_aapl) 4016 dinfo->UniqueId = 0; 4017 else 4018 dinfo->UniqueId = cpu_to_le64(ksmbd_kstat->kstat->ino); 4019 if (d_info->hide_dot_file && d_info->name[0] == '.') 4020 dinfo->ExtFileAttributes |= FILE_ATTRIBUTE_HIDDEN_LE; 4021 memcpy(dinfo->FileName, conv_name, conv_len); 4022 dinfo->NextEntryOffset = cpu_to_le32(next_entry_offset); 4023 break; 4024 } 4025 case FILEID_BOTH_DIRECTORY_INFORMATION: 4026 { 4027 struct file_id_both_directory_info *fibdinfo; 4028 4029 fibdinfo = (struct file_id_both_directory_info *)kstat; 4030 fibdinfo->FileNameLength = cpu_to_le32(conv_len); 4031 fibdinfo->EaSize = 4032 smb2_get_reparse_tag_special_file(ksmbd_kstat->kstat->mode); 4033 if (fibdinfo->EaSize) 4034 fibdinfo->ExtFileAttributes = FILE_ATTRIBUTE_REPARSE_POINT_LE; 4035 if (conn->is_aapl) 4036 fibdinfo->UniqueId = 0; 4037 else 4038 fibdinfo->UniqueId = cpu_to_le64(ksmbd_kstat->kstat->ino); 4039 fibdinfo->ShortNameLength = 0; 4040 fibdinfo->Reserved = 0; 4041 fibdinfo->Reserved2 = cpu_to_le16(0); 4042 if (d_info->hide_dot_file && d_info->name[0] == '.') 4043 fibdinfo->ExtFileAttributes |= FILE_ATTRIBUTE_HIDDEN_LE; 4044 memcpy(fibdinfo->FileName, conv_name, conv_len); 4045 fibdinfo->NextEntryOffset = cpu_to_le32(next_entry_offset); 4046 break; 4047 } 4048 case SMB_FIND_FILE_POSIX_INFO: 4049 { 4050 struct smb2_posix_info *posix_info; 4051 u64 time; 4052 4053 posix_info = (struct smb2_posix_info *)kstat; 4054 posix_info->Ignored = 0; 4055 posix_info->CreationTime = cpu_to_le64(ksmbd_kstat->create_time); 4056 time = ksmbd_UnixTimeToNT(ksmbd_kstat->kstat->ctime); 4057 posix_info->ChangeTime = cpu_to_le64(time); 4058 time = ksmbd_UnixTimeToNT(ksmbd_kstat->kstat->atime); 4059 posix_info->LastAccessTime = cpu_to_le64(time); 4060 time = ksmbd_UnixTimeToNT(ksmbd_kstat->kstat->mtime); 4061 posix_info->LastWriteTime = cpu_to_le64(time); 4062 posix_info->EndOfFile = cpu_to_le64(ksmbd_kstat->kstat->size); 4063 posix_info->AllocationSize = cpu_to_le64(ksmbd_kstat->kstat->blocks << 9); 4064 posix_info->DeviceId = cpu_to_le32(ksmbd_kstat->kstat->rdev); 4065 posix_info->HardLinks = cpu_to_le32(ksmbd_kstat->kstat->nlink); 4066 posix_info->Mode = cpu_to_le32(ksmbd_kstat->kstat->mode & 0777); 4067 switch (ksmbd_kstat->kstat->mode & S_IFMT) { 4068 case S_IFDIR: 4069 posix_info->Mode |= cpu_to_le32(POSIX_TYPE_DIR << POSIX_FILETYPE_SHIFT); 4070 break; 4071 case S_IFLNK: 4072 posix_info->Mode |= cpu_to_le32(POSIX_TYPE_SYMLINK << POSIX_FILETYPE_SHIFT); 4073 break; 4074 case S_IFCHR: 4075 posix_info->Mode |= cpu_to_le32(POSIX_TYPE_CHARDEV << POSIX_FILETYPE_SHIFT); 4076 break; 4077 case S_IFBLK: 4078 posix_info->Mode |= cpu_to_le32(POSIX_TYPE_BLKDEV << POSIX_FILETYPE_SHIFT); 4079 break; 4080 case S_IFIFO: 4081 posix_info->Mode |= cpu_to_le32(POSIX_TYPE_FIFO << POSIX_FILETYPE_SHIFT); 4082 break; 4083 case S_IFSOCK: 4084 posix_info->Mode |= cpu_to_le32(POSIX_TYPE_SOCKET << POSIX_FILETYPE_SHIFT); 4085 } 4086 4087 posix_info->Inode = cpu_to_le64(ksmbd_kstat->kstat->ino); 4088 posix_info->DosAttributes = 4089 S_ISDIR(ksmbd_kstat->kstat->mode) ? 4090 FILE_ATTRIBUTE_DIRECTORY_LE : FILE_ATTRIBUTE_ARCHIVE_LE; 4091 if (d_info->hide_dot_file && d_info->name[0] == '.') 4092 posix_info->DosAttributes |= FILE_ATTRIBUTE_HIDDEN_LE; 4093 /* 4094 * SidBuffer(32) contain two sids(Domain sid(16), UNIX group sid(16)). 4095 * UNIX sid(16) = revision(1) + num_subauth(1) + authority(6) + 4096 * sub_auth(4 * 1(num_subauth)) + RID(4). 4097 */ 4098 id_to_sid(from_kuid_munged(&init_user_ns, ksmbd_kstat->kstat->uid), 4099 SIDUNIX_USER, (struct smb_sid *)&posix_info->SidBuffer[0]); 4100 id_to_sid(from_kgid_munged(&init_user_ns, ksmbd_kstat->kstat->gid), 4101 SIDUNIX_GROUP, (struct smb_sid *)&posix_info->SidBuffer[16]); 4102 memcpy(posix_info->name, conv_name, conv_len); 4103 posix_info->name_len = cpu_to_le32(conv_len); 4104 posix_info->NextEntryOffset = cpu_to_le32(next_entry_offset); 4105 break; 4106 } 4107 4108 } /* switch (info_level) */ 4109 4110 d_info->last_entry_offset = d_info->data_count; 4111 d_info->data_count += next_entry_offset; 4112 d_info->out_buf_len -= next_entry_offset; 4113 d_info->wptr += next_entry_offset; 4114 4115 ksmbd_debug(SMB, 4116 "info_level : %d, buf_len :%d, next_offset : %d, data_count : %d\n", 4117 info_level, d_info->out_buf_len, 4118 next_entry_offset, d_info->data_count); 4119 4120 free_conv_name: 4121 kfree(conv_name); 4122 return rc; 4123 } 4124 4125 struct smb2_query_dir_private { 4126 struct ksmbd_work *work; 4127 char *search_pattern; 4128 struct ksmbd_file *dir_fp; 4129 4130 struct ksmbd_dir_info *d_info; 4131 int info_level; 4132 }; 4133 4134 static int process_query_dir_entries(struct smb2_query_dir_private *priv) 4135 { 4136 struct mnt_idmap *idmap = file_mnt_idmap(priv->dir_fp->filp); 4137 struct kstat kstat; 4138 struct ksmbd_kstat ksmbd_kstat; 4139 int rc; 4140 int i; 4141 4142 for (i = 0; i < priv->d_info->num_entry; i++) { 4143 struct dentry *dent; 4144 4145 if (dentry_name(priv->d_info, priv->info_level)) 4146 return -EINVAL; 4147 4148 dent = lookup_one_unlocked(idmap, 4149 &QSTR_LEN(priv->d_info->name, 4150 priv->d_info->name_len), 4151 priv->dir_fp->filp->f_path.dentry); 4152 4153 if (IS_ERR(dent)) { 4154 ksmbd_debug(SMB, "Cannot lookup `%s' [%ld]\n", 4155 priv->d_info->name, 4156 PTR_ERR(dent)); 4157 continue; 4158 } 4159 if (unlikely(d_is_negative(dent))) { 4160 dput(dent); 4161 ksmbd_debug(SMB, "Negative dentry `%s'\n", 4162 priv->d_info->name); 4163 continue; 4164 } 4165 4166 ksmbd_kstat.kstat = &kstat; 4167 if (priv->info_level != FILE_NAMES_INFORMATION) { 4168 rc = ksmbd_vfs_fill_dentry_attrs(priv->work, 4169 idmap, 4170 dent, 4171 &ksmbd_kstat); 4172 if (rc) { 4173 dput(dent); 4174 continue; 4175 } 4176 } 4177 4178 rc = smb2_populate_readdir_entry(priv->work->conn, 4179 priv->info_level, 4180 priv->d_info, 4181 &ksmbd_kstat); 4182 dput(dent); 4183 if (rc) 4184 return rc; 4185 } 4186 return 0; 4187 } 4188 4189 static int reserve_populate_dentry(struct ksmbd_dir_info *d_info, 4190 int info_level) 4191 { 4192 int struct_sz; 4193 int conv_len; 4194 int next_entry_offset; 4195 4196 struct_sz = readdir_info_level_struct_sz(info_level); 4197 if (struct_sz == -EOPNOTSUPP) 4198 return -EOPNOTSUPP; 4199 4200 conv_len = (d_info->name_len + 1) * 2; 4201 next_entry_offset = ALIGN(struct_sz + conv_len, 4202 KSMBD_DIR_INFO_ALIGNMENT); 4203 4204 if (next_entry_offset > d_info->out_buf_len) { 4205 d_info->out_buf_len = 0; 4206 return -ENOSPC; 4207 } 4208 4209 switch (info_level) { 4210 case FILE_FULL_DIRECTORY_INFORMATION: 4211 { 4212 FILE_FULL_DIRECTORY_INFO *ffdinfo; 4213 4214 ffdinfo = (FILE_FULL_DIRECTORY_INFO *)d_info->wptr; 4215 memcpy(ffdinfo->FileName, d_info->name, d_info->name_len); 4216 ffdinfo->FileName[d_info->name_len] = 0x00; 4217 ffdinfo->FileNameLength = cpu_to_le32(d_info->name_len); 4218 ffdinfo->NextEntryOffset = cpu_to_le32(next_entry_offset); 4219 break; 4220 } 4221 case FILE_BOTH_DIRECTORY_INFORMATION: 4222 { 4223 FILE_BOTH_DIRECTORY_INFO *fbdinfo; 4224 4225 fbdinfo = (FILE_BOTH_DIRECTORY_INFO *)d_info->wptr; 4226 memcpy(fbdinfo->FileName, d_info->name, d_info->name_len); 4227 fbdinfo->FileName[d_info->name_len] = 0x00; 4228 fbdinfo->FileNameLength = cpu_to_le32(d_info->name_len); 4229 fbdinfo->NextEntryOffset = cpu_to_le32(next_entry_offset); 4230 break; 4231 } 4232 case FILE_DIRECTORY_INFORMATION: 4233 { 4234 FILE_DIRECTORY_INFO *fdinfo; 4235 4236 fdinfo = (FILE_DIRECTORY_INFO *)d_info->wptr; 4237 memcpy(fdinfo->FileName, d_info->name, d_info->name_len); 4238 fdinfo->FileName[d_info->name_len] = 0x00; 4239 fdinfo->FileNameLength = cpu_to_le32(d_info->name_len); 4240 fdinfo->NextEntryOffset = cpu_to_le32(next_entry_offset); 4241 break; 4242 } 4243 case FILE_NAMES_INFORMATION: 4244 { 4245 struct file_names_info *fninfo; 4246 4247 fninfo = (struct file_names_info *)d_info->wptr; 4248 memcpy(fninfo->FileName, d_info->name, d_info->name_len); 4249 fninfo->FileName[d_info->name_len] = 0x00; 4250 fninfo->FileNameLength = cpu_to_le32(d_info->name_len); 4251 fninfo->NextEntryOffset = cpu_to_le32(next_entry_offset); 4252 break; 4253 } 4254 case FILEID_FULL_DIRECTORY_INFORMATION: 4255 { 4256 FILE_ID_FULL_DIR_INFO *dinfo; 4257 4258 dinfo = (FILE_ID_FULL_DIR_INFO *)d_info->wptr; 4259 memcpy(dinfo->FileName, d_info->name, d_info->name_len); 4260 dinfo->FileName[d_info->name_len] = 0x00; 4261 dinfo->FileNameLength = cpu_to_le32(d_info->name_len); 4262 dinfo->NextEntryOffset = cpu_to_le32(next_entry_offset); 4263 break; 4264 } 4265 case FILEID_BOTH_DIRECTORY_INFORMATION: 4266 { 4267 struct file_id_both_directory_info *fibdinfo; 4268 4269 fibdinfo = (struct file_id_both_directory_info *)d_info->wptr; 4270 memcpy(fibdinfo->FileName, d_info->name, d_info->name_len); 4271 fibdinfo->FileName[d_info->name_len] = 0x00; 4272 fibdinfo->FileNameLength = cpu_to_le32(d_info->name_len); 4273 fibdinfo->NextEntryOffset = cpu_to_le32(next_entry_offset); 4274 break; 4275 } 4276 case SMB_FIND_FILE_POSIX_INFO: 4277 { 4278 struct smb2_posix_info *posix_info; 4279 4280 posix_info = (struct smb2_posix_info *)d_info->wptr; 4281 memcpy(posix_info->name, d_info->name, d_info->name_len); 4282 posix_info->name[d_info->name_len] = 0x00; 4283 posix_info->name_len = cpu_to_le32(d_info->name_len); 4284 posix_info->NextEntryOffset = 4285 cpu_to_le32(next_entry_offset); 4286 break; 4287 } 4288 } /* switch (info_level) */ 4289 4290 d_info->num_entry++; 4291 d_info->out_buf_len -= next_entry_offset; 4292 d_info->wptr += next_entry_offset; 4293 return 0; 4294 } 4295 4296 static bool __query_dir(struct dir_context *ctx, const char *name, int namlen, 4297 loff_t offset, u64 ino, unsigned int d_type) 4298 { 4299 struct ksmbd_readdir_data *buf; 4300 struct smb2_query_dir_private *priv; 4301 struct ksmbd_dir_info *d_info; 4302 int rc; 4303 4304 buf = container_of(ctx, struct ksmbd_readdir_data, ctx); 4305 priv = buf->private; 4306 d_info = priv->d_info; 4307 4308 /* dot and dotdot entries are already reserved */ 4309 if (!strcmp(".", name) || !strcmp("..", name)) 4310 return true; 4311 d_info->num_scan++; 4312 if (ksmbd_share_veto_filename(priv->work->tcon->share_conf, name)) 4313 return true; 4314 if (!match_pattern(name, namlen, priv->search_pattern)) 4315 return true; 4316 4317 d_info->name = name; 4318 d_info->name_len = namlen; 4319 rc = reserve_populate_dentry(d_info, priv->info_level); 4320 if (rc) 4321 return false; 4322 if (d_info->flags & SMB2_RETURN_SINGLE_ENTRY) 4323 d_info->out_buf_len = 0; 4324 return true; 4325 } 4326 4327 static int verify_info_level(int info_level) 4328 { 4329 switch (info_level) { 4330 case FILE_FULL_DIRECTORY_INFORMATION: 4331 case FILE_BOTH_DIRECTORY_INFORMATION: 4332 case FILE_DIRECTORY_INFORMATION: 4333 case FILE_NAMES_INFORMATION: 4334 case FILEID_FULL_DIRECTORY_INFORMATION: 4335 case FILEID_BOTH_DIRECTORY_INFORMATION: 4336 case SMB_FIND_FILE_POSIX_INFO: 4337 break; 4338 default: 4339 return -EOPNOTSUPP; 4340 } 4341 4342 return 0; 4343 } 4344 4345 static int smb2_resp_buf_len(struct ksmbd_work *work, unsigned short hdr2_len) 4346 { 4347 int free_len; 4348 4349 free_len = (int)(work->response_sz - 4350 (get_rfc1002_len(work->response_buf) + 4)) - hdr2_len; 4351 return free_len; 4352 } 4353 4354 static int smb2_calc_max_out_buf_len(struct ksmbd_work *work, 4355 unsigned short hdr2_len, 4356 unsigned int out_buf_len) 4357 { 4358 int free_len; 4359 4360 if (out_buf_len > work->conn->vals->max_trans_size) 4361 return -EINVAL; 4362 4363 free_len = smb2_resp_buf_len(work, hdr2_len); 4364 if (free_len < 0) 4365 return -EINVAL; 4366 4367 return min_t(int, out_buf_len, free_len); 4368 } 4369 4370 int smb2_query_dir(struct ksmbd_work *work) 4371 { 4372 struct ksmbd_conn *conn = work->conn; 4373 struct smb2_query_directory_req *req; 4374 struct smb2_query_directory_rsp *rsp; 4375 struct ksmbd_share_config *share = work->tcon->share_conf; 4376 struct ksmbd_file *dir_fp = NULL; 4377 struct ksmbd_dir_info d_info; 4378 int rc = 0; 4379 char *srch_ptr = NULL; 4380 unsigned char srch_flag; 4381 int buffer_sz; 4382 struct smb2_query_dir_private query_dir_private = {NULL, }; 4383 4384 ksmbd_debug(SMB, "Received smb2 query directory request\n"); 4385 4386 WORK_BUFFERS(work, req, rsp); 4387 4388 if (ksmbd_override_fsids(work)) { 4389 rsp->hdr.Status = STATUS_NO_MEMORY; 4390 smb2_set_err_rsp(work); 4391 return -ENOMEM; 4392 } 4393 4394 rc = verify_info_level(req->FileInformationClass); 4395 if (rc) { 4396 rc = -EFAULT; 4397 goto err_out2; 4398 } 4399 4400 dir_fp = ksmbd_lookup_fd_slow(work, req->VolatileFileId, req->PersistentFileId); 4401 if (!dir_fp) { 4402 rc = -EBADF; 4403 goto err_out2; 4404 } 4405 4406 if (!(dir_fp->daccess & FILE_LIST_DIRECTORY_LE) || 4407 inode_permission(file_mnt_idmap(dir_fp->filp), 4408 file_inode(dir_fp->filp), 4409 MAY_READ | MAY_EXEC)) { 4410 pr_err("no right to enumerate directory (%pD)\n", dir_fp->filp); 4411 rc = -EACCES; 4412 goto err_out2; 4413 } 4414 4415 if (!S_ISDIR(file_inode(dir_fp->filp)->i_mode)) { 4416 pr_err("can't do query dir for a file\n"); 4417 rc = -EINVAL; 4418 goto err_out2; 4419 } 4420 4421 srch_flag = req->Flags; 4422 srch_ptr = smb_strndup_from_utf16((char *)req + le16_to_cpu(req->FileNameOffset), 4423 le16_to_cpu(req->FileNameLength), 1, 4424 conn->local_nls); 4425 if (IS_ERR(srch_ptr)) { 4426 ksmbd_debug(SMB, "Search Pattern not found\n"); 4427 rc = -EINVAL; 4428 goto err_out2; 4429 } else { 4430 ksmbd_debug(SMB, "Search pattern is %s\n", srch_ptr); 4431 } 4432 4433 if (srch_flag & SMB2_REOPEN || srch_flag & SMB2_RESTART_SCANS) { 4434 ksmbd_debug(SMB, "Restart directory scan\n"); 4435 generic_file_llseek(dir_fp->filp, 0, SEEK_SET); 4436 } 4437 4438 memset(&d_info, 0, sizeof(struct ksmbd_dir_info)); 4439 d_info.wptr = (char *)rsp->Buffer; 4440 d_info.rptr = (char *)rsp->Buffer; 4441 d_info.out_buf_len = 4442 smb2_calc_max_out_buf_len(work, 8, 4443 le32_to_cpu(req->OutputBufferLength)); 4444 if (d_info.out_buf_len < 0) { 4445 rc = -EINVAL; 4446 goto err_out; 4447 } 4448 d_info.flags = srch_flag; 4449 4450 /* 4451 * reserve dot and dotdot entries in head of buffer 4452 * in first response 4453 */ 4454 rc = ksmbd_populate_dot_dotdot_entries(work, req->FileInformationClass, 4455 dir_fp, &d_info, srch_ptr, 4456 smb2_populate_readdir_entry); 4457 if (rc == -ENOSPC) 4458 rc = 0; 4459 else if (rc) 4460 goto err_out; 4461 4462 if (test_share_config_flag(share, KSMBD_SHARE_FLAG_HIDE_DOT_FILES)) 4463 d_info.hide_dot_file = true; 4464 4465 buffer_sz = d_info.out_buf_len; 4466 d_info.rptr = d_info.wptr; 4467 query_dir_private.work = work; 4468 query_dir_private.search_pattern = srch_ptr; 4469 query_dir_private.dir_fp = dir_fp; 4470 query_dir_private.d_info = &d_info; 4471 query_dir_private.info_level = req->FileInformationClass; 4472 dir_fp->readdir_data.private = &query_dir_private; 4473 set_ctx_actor(&dir_fp->readdir_data.ctx, __query_dir); 4474 again: 4475 d_info.num_scan = 0; 4476 rc = iterate_dir(dir_fp->filp, &dir_fp->readdir_data.ctx); 4477 /* 4478 * num_entry can be 0 if the directory iteration stops before reaching 4479 * the end of the directory and no file is matched with the search 4480 * pattern. 4481 */ 4482 if (rc >= 0 && !d_info.num_entry && d_info.num_scan && 4483 d_info.out_buf_len > 0) 4484 goto again; 4485 /* 4486 * req->OutputBufferLength is too small to contain even one entry. 4487 * In this case, it immediately returns OutputBufferLength 0 to client. 4488 */ 4489 if (!d_info.out_buf_len && !d_info.num_entry) 4490 goto no_buf_len; 4491 if (rc > 0 || rc == -ENOSPC) 4492 rc = 0; 4493 else if (rc) 4494 goto err_out; 4495 4496 d_info.wptr = d_info.rptr; 4497 d_info.out_buf_len = buffer_sz; 4498 rc = process_query_dir_entries(&query_dir_private); 4499 if (rc) 4500 goto err_out; 4501 4502 if (!d_info.data_count && d_info.out_buf_len >= 0) { 4503 if (srch_flag & SMB2_RETURN_SINGLE_ENTRY && !is_asterisk(srch_ptr)) { 4504 rsp->hdr.Status = STATUS_NO_SUCH_FILE; 4505 } else { 4506 dir_fp->dot_dotdot[0] = dir_fp->dot_dotdot[1] = 0; 4507 rsp->hdr.Status = STATUS_NO_MORE_FILES; 4508 } 4509 rsp->StructureSize = cpu_to_le16(9); 4510 rsp->OutputBufferOffset = cpu_to_le16(0); 4511 rsp->OutputBufferLength = cpu_to_le32(0); 4512 rsp->Buffer[0] = 0; 4513 rc = ksmbd_iov_pin_rsp(work, (void *)rsp, 4514 offsetof(struct smb2_query_directory_rsp, Buffer) 4515 + 1); 4516 if (rc) 4517 goto err_out; 4518 } else { 4519 no_buf_len: 4520 ((FILE_DIRECTORY_INFO *) 4521 ((char *)rsp->Buffer + d_info.last_entry_offset)) 4522 ->NextEntryOffset = 0; 4523 if (d_info.data_count >= d_info.last_entry_off_align) 4524 d_info.data_count -= d_info.last_entry_off_align; 4525 4526 rsp->StructureSize = cpu_to_le16(9); 4527 rsp->OutputBufferOffset = cpu_to_le16(72); 4528 rsp->OutputBufferLength = cpu_to_le32(d_info.data_count); 4529 rc = ksmbd_iov_pin_rsp(work, (void *)rsp, 4530 offsetof(struct smb2_query_directory_rsp, Buffer) + 4531 d_info.data_count); 4532 if (rc) 4533 goto err_out; 4534 } 4535 4536 kfree(srch_ptr); 4537 ksmbd_fd_put(work, dir_fp); 4538 ksmbd_revert_fsids(work); 4539 return 0; 4540 4541 err_out: 4542 pr_err("error while processing smb2 query dir rc = %d\n", rc); 4543 kfree(srch_ptr); 4544 4545 err_out2: 4546 if (rc == -EINVAL) 4547 rsp->hdr.Status = STATUS_INVALID_PARAMETER; 4548 else if (rc == -EACCES) 4549 rsp->hdr.Status = STATUS_ACCESS_DENIED; 4550 else if (rc == -ENOENT) 4551 rsp->hdr.Status = STATUS_NO_SUCH_FILE; 4552 else if (rc == -EBADF) 4553 rsp->hdr.Status = STATUS_FILE_CLOSED; 4554 else if (rc == -ENOMEM) 4555 rsp->hdr.Status = STATUS_NO_MEMORY; 4556 else if (rc == -EFAULT) 4557 rsp->hdr.Status = STATUS_INVALID_INFO_CLASS; 4558 else if (rc == -EIO) 4559 rsp->hdr.Status = STATUS_FILE_CORRUPT_ERROR; 4560 if (!rsp->hdr.Status) 4561 rsp->hdr.Status = STATUS_UNEXPECTED_IO_ERROR; 4562 4563 smb2_set_err_rsp(work); 4564 ksmbd_fd_put(work, dir_fp); 4565 ksmbd_revert_fsids(work); 4566 return rc; 4567 } 4568 4569 /** 4570 * buffer_check_err() - helper function to check buffer errors 4571 * @reqOutputBufferLength: max buffer length expected in command response 4572 * @rsp: query info response buffer contains output buffer length 4573 * @rsp_org: base response buffer pointer in case of chained response 4574 * 4575 * Return: 0 on success, otherwise error 4576 */ 4577 static int buffer_check_err(int reqOutputBufferLength, 4578 struct smb2_query_info_rsp *rsp, 4579 void *rsp_org) 4580 { 4581 if (reqOutputBufferLength < le32_to_cpu(rsp->OutputBufferLength)) { 4582 pr_err("Invalid Buffer Size Requested\n"); 4583 rsp->hdr.Status = STATUS_INFO_LENGTH_MISMATCH; 4584 *(__be32 *)rsp_org = cpu_to_be32(sizeof(struct smb2_hdr)); 4585 return -EINVAL; 4586 } 4587 return 0; 4588 } 4589 4590 static void get_standard_info_pipe(struct smb2_query_info_rsp *rsp, 4591 void *rsp_org) 4592 { 4593 struct smb2_file_standard_info *sinfo; 4594 4595 sinfo = (struct smb2_file_standard_info *)rsp->Buffer; 4596 4597 sinfo->AllocationSize = cpu_to_le64(4096); 4598 sinfo->EndOfFile = cpu_to_le64(0); 4599 sinfo->NumberOfLinks = cpu_to_le32(1); 4600 sinfo->DeletePending = 1; 4601 sinfo->Directory = 0; 4602 rsp->OutputBufferLength = 4603 cpu_to_le32(sizeof(struct smb2_file_standard_info)); 4604 } 4605 4606 static void get_internal_info_pipe(struct smb2_query_info_rsp *rsp, u64 num, 4607 void *rsp_org) 4608 { 4609 struct smb2_file_internal_info *file_info; 4610 4611 file_info = (struct smb2_file_internal_info *)rsp->Buffer; 4612 4613 /* any unique number */ 4614 file_info->IndexNumber = cpu_to_le64(num | (1ULL << 63)); 4615 rsp->OutputBufferLength = 4616 cpu_to_le32(sizeof(struct smb2_file_internal_info)); 4617 } 4618 4619 static int smb2_get_info_file_pipe(struct ksmbd_session *sess, 4620 struct smb2_query_info_req *req, 4621 struct smb2_query_info_rsp *rsp, 4622 void *rsp_org) 4623 { 4624 u64 id; 4625 int rc; 4626 4627 /* 4628 * Windows can sometime send query file info request on 4629 * pipe without opening it, checking error condition here 4630 */ 4631 id = req->VolatileFileId; 4632 4633 lockdep_assert_not_held(&sess->rpc_lock); 4634 4635 down_read(&sess->rpc_lock); 4636 if (!ksmbd_session_rpc_method(sess, id)) { 4637 up_read(&sess->rpc_lock); 4638 return -ENOENT; 4639 } 4640 up_read(&sess->rpc_lock); 4641 4642 ksmbd_debug(SMB, "FileInfoClass %u, FileId 0x%llx\n", 4643 req->FileInfoClass, req->VolatileFileId); 4644 4645 switch (req->FileInfoClass) { 4646 case FILE_STANDARD_INFORMATION: 4647 get_standard_info_pipe(rsp, rsp_org); 4648 rc = buffer_check_err(le32_to_cpu(req->OutputBufferLength), 4649 rsp, rsp_org); 4650 break; 4651 case FILE_INTERNAL_INFORMATION: 4652 get_internal_info_pipe(rsp, id, rsp_org); 4653 rc = buffer_check_err(le32_to_cpu(req->OutputBufferLength), 4654 rsp, rsp_org); 4655 break; 4656 default: 4657 ksmbd_debug(SMB, "smb2_info_file_pipe for %u not supported\n", 4658 req->FileInfoClass); 4659 rc = -EOPNOTSUPP; 4660 } 4661 return rc; 4662 } 4663 4664 /** 4665 * smb2_get_ea() - handler for smb2 get extended attribute command 4666 * @work: smb work containing query info command buffer 4667 * @fp: ksmbd_file pointer 4668 * @req: get extended attribute request 4669 * @rsp: response buffer pointer 4670 * @rsp_org: base response buffer pointer in case of chained response 4671 * 4672 * Return: 0 on success, otherwise error 4673 */ 4674 static int smb2_get_ea(struct ksmbd_work *work, struct ksmbd_file *fp, 4675 struct smb2_query_info_req *req, 4676 struct smb2_query_info_rsp *rsp, void *rsp_org) 4677 { 4678 struct smb2_ea_info *eainfo, *prev_eainfo; 4679 char *name, *ptr, *xattr_list = NULL, *buf; 4680 int rc, name_len, value_len, xattr_list_len, idx; 4681 ssize_t buf_free_len, alignment_bytes, next_offset, rsp_data_cnt = 0; 4682 struct smb2_ea_info_req *ea_req = NULL; 4683 const struct path *path; 4684 struct mnt_idmap *idmap = file_mnt_idmap(fp->filp); 4685 4686 if (!(fp->daccess & FILE_READ_EA_LE)) { 4687 pr_err("Not permitted to read ext attr : 0x%x\n", 4688 fp->daccess); 4689 return -EACCES; 4690 } 4691 4692 path = &fp->filp->f_path; 4693 /* single EA entry is requested with given user.* name */ 4694 if (req->InputBufferLength) { 4695 if (le32_to_cpu(req->InputBufferLength) <= 4696 sizeof(struct smb2_ea_info_req)) 4697 return -EINVAL; 4698 4699 ea_req = (struct smb2_ea_info_req *)((char *)req + 4700 le16_to_cpu(req->InputBufferOffset)); 4701 } else { 4702 /* need to send all EAs, if no specific EA is requested*/ 4703 if (le32_to_cpu(req->Flags) & SL_RETURN_SINGLE_ENTRY) 4704 ksmbd_debug(SMB, 4705 "All EAs are requested but need to send single EA entry in rsp flags 0x%x\n", 4706 le32_to_cpu(req->Flags)); 4707 } 4708 4709 buf_free_len = 4710 smb2_calc_max_out_buf_len(work, 8, 4711 le32_to_cpu(req->OutputBufferLength)); 4712 if (buf_free_len < 0) 4713 return -EINVAL; 4714 4715 rc = ksmbd_vfs_listxattr(path->dentry, &xattr_list); 4716 if (rc < 0) { 4717 rsp->hdr.Status = STATUS_INVALID_HANDLE; 4718 goto out; 4719 } else if (!rc) { /* there is no EA in the file */ 4720 ksmbd_debug(SMB, "no ea data in the file\n"); 4721 goto done; 4722 } 4723 xattr_list_len = rc; 4724 4725 ptr = (char *)rsp->Buffer; 4726 eainfo = (struct smb2_ea_info *)ptr; 4727 prev_eainfo = eainfo; 4728 idx = 0; 4729 4730 while (idx < xattr_list_len) { 4731 name = xattr_list + idx; 4732 name_len = strlen(name); 4733 4734 ksmbd_debug(SMB, "%s, len %d\n", name, name_len); 4735 idx += name_len + 1; 4736 4737 /* 4738 * CIFS does not support EA other than user.* namespace, 4739 * still keep the framework generic, to list other attrs 4740 * in future. 4741 */ 4742 if (strncmp(name, XATTR_USER_PREFIX, XATTR_USER_PREFIX_LEN)) 4743 continue; 4744 4745 if (!strncmp(&name[XATTR_USER_PREFIX_LEN], STREAM_PREFIX, 4746 STREAM_PREFIX_LEN)) 4747 continue; 4748 4749 if (req->InputBufferLength && 4750 strncmp(&name[XATTR_USER_PREFIX_LEN], ea_req->name, 4751 ea_req->EaNameLength)) 4752 continue; 4753 4754 if (!strncmp(&name[XATTR_USER_PREFIX_LEN], 4755 DOS_ATTRIBUTE_PREFIX, DOS_ATTRIBUTE_PREFIX_LEN)) 4756 continue; 4757 4758 if (!strncmp(name, XATTR_USER_PREFIX, XATTR_USER_PREFIX_LEN)) 4759 name_len -= XATTR_USER_PREFIX_LEN; 4760 4761 ptr = eainfo->name + name_len + 1; 4762 buf_free_len -= (offsetof(struct smb2_ea_info, name) + 4763 name_len + 1); 4764 /* bailout if xattr can't fit in buf_free_len */ 4765 value_len = ksmbd_vfs_getxattr(idmap, path->dentry, 4766 name, &buf); 4767 if (value_len <= 0) { 4768 rc = -ENOENT; 4769 rsp->hdr.Status = STATUS_INVALID_HANDLE; 4770 goto out; 4771 } 4772 4773 buf_free_len -= value_len; 4774 if (buf_free_len < 0) { 4775 kfree(buf); 4776 break; 4777 } 4778 4779 memcpy(ptr, buf, value_len); 4780 kfree(buf); 4781 4782 ptr += value_len; 4783 eainfo->Flags = 0; 4784 eainfo->EaNameLength = name_len; 4785 4786 if (!strncmp(name, XATTR_USER_PREFIX, XATTR_USER_PREFIX_LEN)) 4787 memcpy(eainfo->name, &name[XATTR_USER_PREFIX_LEN], 4788 name_len); 4789 else 4790 memcpy(eainfo->name, name, name_len); 4791 4792 eainfo->name[name_len] = '\0'; 4793 eainfo->EaValueLength = cpu_to_le16(value_len); 4794 next_offset = offsetof(struct smb2_ea_info, name) + 4795 name_len + 1 + value_len; 4796 4797 /* align next xattr entry at 4 byte bundary */ 4798 alignment_bytes = ((next_offset + 3) & ~3) - next_offset; 4799 if (alignment_bytes) { 4800 memset(ptr, '\0', alignment_bytes); 4801 ptr += alignment_bytes; 4802 next_offset += alignment_bytes; 4803 buf_free_len -= alignment_bytes; 4804 } 4805 eainfo->NextEntryOffset = cpu_to_le32(next_offset); 4806 prev_eainfo = eainfo; 4807 eainfo = (struct smb2_ea_info *)ptr; 4808 rsp_data_cnt += next_offset; 4809 4810 if (req->InputBufferLength) { 4811 ksmbd_debug(SMB, "single entry requested\n"); 4812 break; 4813 } 4814 } 4815 4816 /* no more ea entries */ 4817 prev_eainfo->NextEntryOffset = 0; 4818 done: 4819 rc = 0; 4820 if (rsp_data_cnt == 0) 4821 rsp->hdr.Status = STATUS_NO_EAS_ON_FILE; 4822 rsp->OutputBufferLength = cpu_to_le32(rsp_data_cnt); 4823 out: 4824 kvfree(xattr_list); 4825 return rc; 4826 } 4827 4828 static void get_file_access_info(struct smb2_query_info_rsp *rsp, 4829 struct ksmbd_file *fp, void *rsp_org) 4830 { 4831 struct smb2_file_access_info *file_info; 4832 4833 file_info = (struct smb2_file_access_info *)rsp->Buffer; 4834 file_info->AccessFlags = fp->daccess; 4835 rsp->OutputBufferLength = 4836 cpu_to_le32(sizeof(struct smb2_file_access_info)); 4837 } 4838 4839 static int get_file_basic_info(struct smb2_query_info_rsp *rsp, 4840 struct ksmbd_file *fp, void *rsp_org) 4841 { 4842 struct smb2_file_basic_info *basic_info; 4843 struct kstat stat; 4844 u64 time; 4845 int ret; 4846 4847 if (!(fp->daccess & FILE_READ_ATTRIBUTES_LE)) { 4848 pr_err("no right to read the attributes : 0x%x\n", 4849 fp->daccess); 4850 return -EACCES; 4851 } 4852 4853 ret = vfs_getattr(&fp->filp->f_path, &stat, STATX_BASIC_STATS, 4854 AT_STATX_SYNC_AS_STAT); 4855 if (ret) 4856 return ret; 4857 4858 basic_info = (struct smb2_file_basic_info *)rsp->Buffer; 4859 basic_info->CreationTime = cpu_to_le64(fp->create_time); 4860 time = ksmbd_UnixTimeToNT(stat.atime); 4861 basic_info->LastAccessTime = cpu_to_le64(time); 4862 time = ksmbd_UnixTimeToNT(stat.mtime); 4863 basic_info->LastWriteTime = cpu_to_le64(time); 4864 time = ksmbd_UnixTimeToNT(stat.ctime); 4865 basic_info->ChangeTime = cpu_to_le64(time); 4866 basic_info->Attributes = fp->f_ci->m_fattr; 4867 basic_info->Pad1 = 0; 4868 rsp->OutputBufferLength = 4869 cpu_to_le32(sizeof(struct smb2_file_basic_info)); 4870 return 0; 4871 } 4872 4873 static int get_file_standard_info(struct smb2_query_info_rsp *rsp, 4874 struct ksmbd_file *fp, void *rsp_org) 4875 { 4876 struct smb2_file_standard_info *sinfo; 4877 unsigned int delete_pending; 4878 struct kstat stat; 4879 int ret; 4880 4881 ret = vfs_getattr(&fp->filp->f_path, &stat, STATX_BASIC_STATS, 4882 AT_STATX_SYNC_AS_STAT); 4883 if (ret) 4884 return ret; 4885 4886 sinfo = (struct smb2_file_standard_info *)rsp->Buffer; 4887 delete_pending = ksmbd_inode_pending_delete(fp); 4888 4889 if (ksmbd_stream_fd(fp) == false) { 4890 sinfo->AllocationSize = cpu_to_le64(stat.blocks << 9); 4891 sinfo->EndOfFile = S_ISDIR(stat.mode) ? 0 : cpu_to_le64(stat.size); 4892 } else { 4893 sinfo->AllocationSize = cpu_to_le64(fp->stream.size); 4894 sinfo->EndOfFile = cpu_to_le64(fp->stream.size); 4895 } 4896 sinfo->NumberOfLinks = cpu_to_le32(get_nlink(&stat) - delete_pending); 4897 sinfo->DeletePending = delete_pending; 4898 sinfo->Directory = S_ISDIR(stat.mode) ? 1 : 0; 4899 rsp->OutputBufferLength = 4900 cpu_to_le32(sizeof(struct smb2_file_standard_info)); 4901 4902 return 0; 4903 } 4904 4905 static void get_file_alignment_info(struct smb2_query_info_rsp *rsp, 4906 void *rsp_org) 4907 { 4908 struct smb2_file_alignment_info *file_info; 4909 4910 file_info = (struct smb2_file_alignment_info *)rsp->Buffer; 4911 file_info->AlignmentRequirement = 0; 4912 rsp->OutputBufferLength = 4913 cpu_to_le32(sizeof(struct smb2_file_alignment_info)); 4914 } 4915 4916 static int get_file_all_info(struct ksmbd_work *work, 4917 struct smb2_query_info_rsp *rsp, 4918 struct ksmbd_file *fp, 4919 void *rsp_org) 4920 { 4921 struct ksmbd_conn *conn = work->conn; 4922 struct smb2_file_all_info *file_info; 4923 unsigned int delete_pending; 4924 struct kstat stat; 4925 int conv_len; 4926 char *filename; 4927 u64 time; 4928 int ret; 4929 4930 if (!(fp->daccess & FILE_READ_ATTRIBUTES_LE)) { 4931 ksmbd_debug(SMB, "no right to read the attributes : 0x%x\n", 4932 fp->daccess); 4933 return -EACCES; 4934 } 4935 4936 filename = convert_to_nt_pathname(work->tcon->share_conf, &fp->filp->f_path); 4937 if (IS_ERR(filename)) 4938 return PTR_ERR(filename); 4939 4940 ret = vfs_getattr(&fp->filp->f_path, &stat, STATX_BASIC_STATS, 4941 AT_STATX_SYNC_AS_STAT); 4942 if (ret) { 4943 kfree(filename); 4944 return ret; 4945 } 4946 4947 ksmbd_debug(SMB, "filename = %s\n", filename); 4948 delete_pending = ksmbd_inode_pending_delete(fp); 4949 file_info = (struct smb2_file_all_info *)rsp->Buffer; 4950 4951 file_info->CreationTime = cpu_to_le64(fp->create_time); 4952 time = ksmbd_UnixTimeToNT(stat.atime); 4953 file_info->LastAccessTime = cpu_to_le64(time); 4954 time = ksmbd_UnixTimeToNT(stat.mtime); 4955 file_info->LastWriteTime = cpu_to_le64(time); 4956 time = ksmbd_UnixTimeToNT(stat.ctime); 4957 file_info->ChangeTime = cpu_to_le64(time); 4958 file_info->Attributes = fp->f_ci->m_fattr; 4959 file_info->Pad1 = 0; 4960 if (ksmbd_stream_fd(fp) == false) { 4961 file_info->AllocationSize = 4962 cpu_to_le64(stat.blocks << 9); 4963 file_info->EndOfFile = S_ISDIR(stat.mode) ? 0 : cpu_to_le64(stat.size); 4964 } else { 4965 file_info->AllocationSize = cpu_to_le64(fp->stream.size); 4966 file_info->EndOfFile = cpu_to_le64(fp->stream.size); 4967 } 4968 file_info->NumberOfLinks = 4969 cpu_to_le32(get_nlink(&stat) - delete_pending); 4970 file_info->DeletePending = delete_pending; 4971 file_info->Directory = S_ISDIR(stat.mode) ? 1 : 0; 4972 file_info->Pad2 = 0; 4973 file_info->IndexNumber = cpu_to_le64(stat.ino); 4974 file_info->EASize = 0; 4975 file_info->AccessFlags = fp->daccess; 4976 if (ksmbd_stream_fd(fp) == false) 4977 file_info->CurrentByteOffset = cpu_to_le64(fp->filp->f_pos); 4978 else 4979 file_info->CurrentByteOffset = cpu_to_le64(fp->stream.pos); 4980 file_info->Mode = fp->coption; 4981 file_info->AlignmentRequirement = 0; 4982 conv_len = smbConvertToUTF16((__le16 *)file_info->FileName, filename, 4983 PATH_MAX, conn->local_nls, 0); 4984 conv_len *= 2; 4985 file_info->FileNameLength = cpu_to_le32(conv_len); 4986 rsp->OutputBufferLength = 4987 cpu_to_le32(sizeof(struct smb2_file_all_info) + conv_len - 1); 4988 kfree(filename); 4989 return 0; 4990 } 4991 4992 static void get_file_alternate_info(struct ksmbd_work *work, 4993 struct smb2_query_info_rsp *rsp, 4994 struct ksmbd_file *fp, 4995 void *rsp_org) 4996 { 4997 struct ksmbd_conn *conn = work->conn; 4998 struct smb2_file_alt_name_info *file_info; 4999 struct dentry *dentry = fp->filp->f_path.dentry; 5000 int conv_len; 5001 5002 spin_lock(&dentry->d_lock); 5003 file_info = (struct smb2_file_alt_name_info *)rsp->Buffer; 5004 conv_len = ksmbd_extract_shortname(conn, 5005 dentry->d_name.name, 5006 file_info->FileName); 5007 spin_unlock(&dentry->d_lock); 5008 file_info->FileNameLength = cpu_to_le32(conv_len); 5009 rsp->OutputBufferLength = 5010 cpu_to_le32(struct_size(file_info, FileName, conv_len)); 5011 } 5012 5013 static int get_file_stream_info(struct ksmbd_work *work, 5014 struct smb2_query_info_rsp *rsp, 5015 struct ksmbd_file *fp, 5016 void *rsp_org) 5017 { 5018 struct ksmbd_conn *conn = work->conn; 5019 struct smb2_file_stream_info *file_info; 5020 char *stream_name, *xattr_list = NULL, *stream_buf; 5021 struct kstat stat; 5022 const struct path *path = &fp->filp->f_path; 5023 ssize_t xattr_list_len; 5024 int nbytes = 0, streamlen, stream_name_len, next, idx = 0; 5025 int buf_free_len; 5026 struct smb2_query_info_req *req = ksmbd_req_buf_next(work); 5027 int ret; 5028 5029 ret = vfs_getattr(&fp->filp->f_path, &stat, STATX_BASIC_STATS, 5030 AT_STATX_SYNC_AS_STAT); 5031 if (ret) 5032 return ret; 5033 5034 file_info = (struct smb2_file_stream_info *)rsp->Buffer; 5035 5036 buf_free_len = 5037 smb2_calc_max_out_buf_len(work, 8, 5038 le32_to_cpu(req->OutputBufferLength)); 5039 if (buf_free_len < 0) 5040 goto out; 5041 5042 xattr_list_len = ksmbd_vfs_listxattr(path->dentry, &xattr_list); 5043 if (xattr_list_len < 0) { 5044 goto out; 5045 } else if (!xattr_list_len) { 5046 ksmbd_debug(SMB, "empty xattr in the file\n"); 5047 goto out; 5048 } 5049 5050 while (idx < xattr_list_len) { 5051 stream_name = xattr_list + idx; 5052 streamlen = strlen(stream_name); 5053 idx += streamlen + 1; 5054 5055 ksmbd_debug(SMB, "%s, len %d\n", stream_name, streamlen); 5056 5057 if (strncmp(&stream_name[XATTR_USER_PREFIX_LEN], 5058 STREAM_PREFIX, STREAM_PREFIX_LEN)) 5059 continue; 5060 5061 stream_name_len = streamlen - (XATTR_USER_PREFIX_LEN + 5062 STREAM_PREFIX_LEN); 5063 streamlen = stream_name_len; 5064 5065 /* plus : size */ 5066 streamlen += 1; 5067 stream_buf = kmalloc(streamlen + 1, KSMBD_DEFAULT_GFP); 5068 if (!stream_buf) 5069 break; 5070 5071 streamlen = snprintf(stream_buf, streamlen + 1, 5072 ":%s", &stream_name[XATTR_NAME_STREAM_LEN]); 5073 5074 next = sizeof(struct smb2_file_stream_info) + streamlen * 2; 5075 if (next > buf_free_len) { 5076 kfree(stream_buf); 5077 break; 5078 } 5079 5080 file_info = (struct smb2_file_stream_info *)&rsp->Buffer[nbytes]; 5081 streamlen = smbConvertToUTF16((__le16 *)file_info->StreamName, 5082 stream_buf, streamlen, 5083 conn->local_nls, 0); 5084 streamlen *= 2; 5085 kfree(stream_buf); 5086 file_info->StreamNameLength = cpu_to_le32(streamlen); 5087 file_info->StreamSize = cpu_to_le64(stream_name_len); 5088 file_info->StreamAllocationSize = cpu_to_le64(stream_name_len); 5089 5090 nbytes += next; 5091 buf_free_len -= next; 5092 file_info->NextEntryOffset = cpu_to_le32(next); 5093 } 5094 5095 out: 5096 if (!S_ISDIR(stat.mode) && 5097 buf_free_len >= sizeof(struct smb2_file_stream_info) + 7 * 2) { 5098 file_info = (struct smb2_file_stream_info *) 5099 &rsp->Buffer[nbytes]; 5100 streamlen = smbConvertToUTF16((__le16 *)file_info->StreamName, 5101 "::$DATA", 7, conn->local_nls, 0); 5102 streamlen *= 2; 5103 file_info->StreamNameLength = cpu_to_le32(streamlen); 5104 file_info->StreamSize = cpu_to_le64(stat.size); 5105 file_info->StreamAllocationSize = cpu_to_le64(stat.blocks << 9); 5106 nbytes += sizeof(struct smb2_file_stream_info) + streamlen; 5107 } 5108 5109 /* last entry offset should be 0 */ 5110 file_info->NextEntryOffset = 0; 5111 kvfree(xattr_list); 5112 5113 rsp->OutputBufferLength = cpu_to_le32(nbytes); 5114 5115 return 0; 5116 } 5117 5118 static int get_file_internal_info(struct smb2_query_info_rsp *rsp, 5119 struct ksmbd_file *fp, void *rsp_org) 5120 { 5121 struct smb2_file_internal_info *file_info; 5122 struct kstat stat; 5123 int ret; 5124 5125 ret = vfs_getattr(&fp->filp->f_path, &stat, STATX_BASIC_STATS, 5126 AT_STATX_SYNC_AS_STAT); 5127 if (ret) 5128 return ret; 5129 5130 file_info = (struct smb2_file_internal_info *)rsp->Buffer; 5131 file_info->IndexNumber = cpu_to_le64(stat.ino); 5132 rsp->OutputBufferLength = 5133 cpu_to_le32(sizeof(struct smb2_file_internal_info)); 5134 5135 return 0; 5136 } 5137 5138 static int get_file_network_open_info(struct smb2_query_info_rsp *rsp, 5139 struct ksmbd_file *fp, void *rsp_org) 5140 { 5141 struct smb2_file_network_open_info *file_info; 5142 struct kstat stat; 5143 u64 time; 5144 int ret; 5145 5146 if (!(fp->daccess & FILE_READ_ATTRIBUTES_LE)) { 5147 pr_err("no right to read the attributes : 0x%x\n", 5148 fp->daccess); 5149 return -EACCES; 5150 } 5151 5152 ret = vfs_getattr(&fp->filp->f_path, &stat, STATX_BASIC_STATS, 5153 AT_STATX_SYNC_AS_STAT); 5154 if (ret) 5155 return ret; 5156 5157 file_info = (struct smb2_file_network_open_info *)rsp->Buffer; 5158 5159 file_info->CreationTime = cpu_to_le64(fp->create_time); 5160 time = ksmbd_UnixTimeToNT(stat.atime); 5161 file_info->LastAccessTime = cpu_to_le64(time); 5162 time = ksmbd_UnixTimeToNT(stat.mtime); 5163 file_info->LastWriteTime = cpu_to_le64(time); 5164 time = ksmbd_UnixTimeToNT(stat.ctime); 5165 file_info->ChangeTime = cpu_to_le64(time); 5166 file_info->Attributes = fp->f_ci->m_fattr; 5167 if (ksmbd_stream_fd(fp) == false) { 5168 file_info->AllocationSize = cpu_to_le64(stat.blocks << 9); 5169 file_info->EndOfFile = S_ISDIR(stat.mode) ? 0 : cpu_to_le64(stat.size); 5170 } else { 5171 file_info->AllocationSize = cpu_to_le64(fp->stream.size); 5172 file_info->EndOfFile = cpu_to_le64(fp->stream.size); 5173 } 5174 file_info->Reserved = cpu_to_le32(0); 5175 rsp->OutputBufferLength = 5176 cpu_to_le32(sizeof(struct smb2_file_network_open_info)); 5177 return 0; 5178 } 5179 5180 static void get_file_ea_info(struct smb2_query_info_rsp *rsp, void *rsp_org) 5181 { 5182 struct smb2_file_ea_info *file_info; 5183 5184 file_info = (struct smb2_file_ea_info *)rsp->Buffer; 5185 file_info->EASize = 0; 5186 rsp->OutputBufferLength = 5187 cpu_to_le32(sizeof(struct smb2_file_ea_info)); 5188 } 5189 5190 static void get_file_position_info(struct smb2_query_info_rsp *rsp, 5191 struct ksmbd_file *fp, void *rsp_org) 5192 { 5193 struct smb2_file_pos_info *file_info; 5194 5195 file_info = (struct smb2_file_pos_info *)rsp->Buffer; 5196 if (ksmbd_stream_fd(fp) == false) 5197 file_info->CurrentByteOffset = cpu_to_le64(fp->filp->f_pos); 5198 else 5199 file_info->CurrentByteOffset = cpu_to_le64(fp->stream.pos); 5200 5201 rsp->OutputBufferLength = 5202 cpu_to_le32(sizeof(struct smb2_file_pos_info)); 5203 } 5204 5205 static void get_file_mode_info(struct smb2_query_info_rsp *rsp, 5206 struct ksmbd_file *fp, void *rsp_org) 5207 { 5208 struct smb2_file_mode_info *file_info; 5209 5210 file_info = (struct smb2_file_mode_info *)rsp->Buffer; 5211 file_info->Mode = fp->coption & FILE_MODE_INFO_MASK; 5212 rsp->OutputBufferLength = 5213 cpu_to_le32(sizeof(struct smb2_file_mode_info)); 5214 } 5215 5216 static int get_file_compression_info(struct smb2_query_info_rsp *rsp, 5217 struct ksmbd_file *fp, void *rsp_org) 5218 { 5219 struct smb2_file_comp_info *file_info; 5220 struct kstat stat; 5221 int ret; 5222 5223 ret = vfs_getattr(&fp->filp->f_path, &stat, STATX_BASIC_STATS, 5224 AT_STATX_SYNC_AS_STAT); 5225 if (ret) 5226 return ret; 5227 5228 file_info = (struct smb2_file_comp_info *)rsp->Buffer; 5229 file_info->CompressedFileSize = cpu_to_le64(stat.blocks << 9); 5230 file_info->CompressionFormat = COMPRESSION_FORMAT_NONE; 5231 file_info->CompressionUnitShift = 0; 5232 file_info->ChunkShift = 0; 5233 file_info->ClusterShift = 0; 5234 memset(&file_info->Reserved[0], 0, 3); 5235 5236 rsp->OutputBufferLength = 5237 cpu_to_le32(sizeof(struct smb2_file_comp_info)); 5238 5239 return 0; 5240 } 5241 5242 static int get_file_attribute_tag_info(struct smb2_query_info_rsp *rsp, 5243 struct ksmbd_file *fp, void *rsp_org) 5244 { 5245 struct smb2_file_attr_tag_info *file_info; 5246 5247 if (!(fp->daccess & FILE_READ_ATTRIBUTES_LE)) { 5248 pr_err("no right to read the attributes : 0x%x\n", 5249 fp->daccess); 5250 return -EACCES; 5251 } 5252 5253 file_info = (struct smb2_file_attr_tag_info *)rsp->Buffer; 5254 file_info->FileAttributes = fp->f_ci->m_fattr; 5255 file_info->ReparseTag = 0; 5256 rsp->OutputBufferLength = 5257 cpu_to_le32(sizeof(struct smb2_file_attr_tag_info)); 5258 return 0; 5259 } 5260 5261 static int find_file_posix_info(struct smb2_query_info_rsp *rsp, 5262 struct ksmbd_file *fp, void *rsp_org) 5263 { 5264 struct smb311_posix_qinfo *file_info; 5265 struct inode *inode = file_inode(fp->filp); 5266 struct mnt_idmap *idmap = file_mnt_idmap(fp->filp); 5267 vfsuid_t vfsuid = i_uid_into_vfsuid(idmap, inode); 5268 vfsgid_t vfsgid = i_gid_into_vfsgid(idmap, inode); 5269 struct kstat stat; 5270 u64 time; 5271 int out_buf_len = sizeof(struct smb311_posix_qinfo) + 32; 5272 int ret; 5273 5274 ret = vfs_getattr(&fp->filp->f_path, &stat, STATX_BASIC_STATS, 5275 AT_STATX_SYNC_AS_STAT); 5276 if (ret) 5277 return ret; 5278 5279 file_info = (struct smb311_posix_qinfo *)rsp->Buffer; 5280 file_info->CreationTime = cpu_to_le64(fp->create_time); 5281 time = ksmbd_UnixTimeToNT(stat.atime); 5282 file_info->LastAccessTime = cpu_to_le64(time); 5283 time = ksmbd_UnixTimeToNT(stat.mtime); 5284 file_info->LastWriteTime = cpu_to_le64(time); 5285 time = ksmbd_UnixTimeToNT(stat.ctime); 5286 file_info->ChangeTime = cpu_to_le64(time); 5287 file_info->DosAttributes = fp->f_ci->m_fattr; 5288 file_info->Inode = cpu_to_le64(stat.ino); 5289 if (ksmbd_stream_fd(fp) == false) { 5290 file_info->EndOfFile = cpu_to_le64(stat.size); 5291 file_info->AllocationSize = cpu_to_le64(stat.blocks << 9); 5292 } else { 5293 file_info->EndOfFile = cpu_to_le64(fp->stream.size); 5294 file_info->AllocationSize = cpu_to_le64(fp->stream.size); 5295 } 5296 file_info->HardLinks = cpu_to_le32(stat.nlink); 5297 file_info->Mode = cpu_to_le32(stat.mode & 0777); 5298 switch (stat.mode & S_IFMT) { 5299 case S_IFDIR: 5300 file_info->Mode |= cpu_to_le32(POSIX_TYPE_DIR << POSIX_FILETYPE_SHIFT); 5301 break; 5302 case S_IFLNK: 5303 file_info->Mode |= cpu_to_le32(POSIX_TYPE_SYMLINK << POSIX_FILETYPE_SHIFT); 5304 break; 5305 case S_IFCHR: 5306 file_info->Mode |= cpu_to_le32(POSIX_TYPE_CHARDEV << POSIX_FILETYPE_SHIFT); 5307 break; 5308 case S_IFBLK: 5309 file_info->Mode |= cpu_to_le32(POSIX_TYPE_BLKDEV << POSIX_FILETYPE_SHIFT); 5310 break; 5311 case S_IFIFO: 5312 file_info->Mode |= cpu_to_le32(POSIX_TYPE_FIFO << POSIX_FILETYPE_SHIFT); 5313 break; 5314 case S_IFSOCK: 5315 file_info->Mode |= cpu_to_le32(POSIX_TYPE_SOCKET << POSIX_FILETYPE_SHIFT); 5316 } 5317 5318 file_info->DeviceId = cpu_to_le32(stat.rdev); 5319 5320 /* 5321 * Sids(32) contain two sids(Domain sid(16), UNIX group sid(16)). 5322 * UNIX sid(16) = revision(1) + num_subauth(1) + authority(6) + 5323 * sub_auth(4 * 1(num_subauth)) + RID(4). 5324 */ 5325 id_to_sid(from_kuid_munged(&init_user_ns, vfsuid_into_kuid(vfsuid)), 5326 SIDUNIX_USER, (struct smb_sid *)&file_info->Sids[0]); 5327 id_to_sid(from_kgid_munged(&init_user_ns, vfsgid_into_kgid(vfsgid)), 5328 SIDUNIX_GROUP, (struct smb_sid *)&file_info->Sids[16]); 5329 5330 rsp->OutputBufferLength = cpu_to_le32(out_buf_len); 5331 5332 return 0; 5333 } 5334 5335 static int smb2_get_info_file(struct ksmbd_work *work, 5336 struct smb2_query_info_req *req, 5337 struct smb2_query_info_rsp *rsp) 5338 { 5339 struct ksmbd_file *fp; 5340 int fileinfoclass = 0; 5341 int rc = 0; 5342 unsigned int id = KSMBD_NO_FID, pid = KSMBD_NO_FID; 5343 5344 if (test_share_config_flag(work->tcon->share_conf, 5345 KSMBD_SHARE_FLAG_PIPE)) { 5346 /* smb2 info file called for pipe */ 5347 return smb2_get_info_file_pipe(work->sess, req, rsp, 5348 work->response_buf); 5349 } 5350 5351 if (work->next_smb2_rcv_hdr_off) { 5352 if (!has_file_id(req->VolatileFileId)) { 5353 ksmbd_debug(SMB, "Compound request set FID = %llu\n", 5354 work->compound_fid); 5355 id = work->compound_fid; 5356 pid = work->compound_pfid; 5357 } 5358 } 5359 5360 if (!has_file_id(id)) { 5361 id = req->VolatileFileId; 5362 pid = req->PersistentFileId; 5363 } 5364 5365 fp = ksmbd_lookup_fd_slow(work, id, pid); 5366 if (!fp) 5367 return -ENOENT; 5368 5369 fileinfoclass = req->FileInfoClass; 5370 5371 switch (fileinfoclass) { 5372 case FILE_ACCESS_INFORMATION: 5373 get_file_access_info(rsp, fp, work->response_buf); 5374 break; 5375 5376 case FILE_BASIC_INFORMATION: 5377 rc = get_file_basic_info(rsp, fp, work->response_buf); 5378 break; 5379 5380 case FILE_STANDARD_INFORMATION: 5381 rc = get_file_standard_info(rsp, fp, work->response_buf); 5382 break; 5383 5384 case FILE_ALIGNMENT_INFORMATION: 5385 get_file_alignment_info(rsp, work->response_buf); 5386 break; 5387 5388 case FILE_ALL_INFORMATION: 5389 rc = get_file_all_info(work, rsp, fp, work->response_buf); 5390 break; 5391 5392 case FILE_ALTERNATE_NAME_INFORMATION: 5393 get_file_alternate_info(work, rsp, fp, work->response_buf); 5394 break; 5395 5396 case FILE_STREAM_INFORMATION: 5397 rc = get_file_stream_info(work, rsp, fp, work->response_buf); 5398 break; 5399 5400 case FILE_INTERNAL_INFORMATION: 5401 rc = get_file_internal_info(rsp, fp, work->response_buf); 5402 break; 5403 5404 case FILE_NETWORK_OPEN_INFORMATION: 5405 rc = get_file_network_open_info(rsp, fp, work->response_buf); 5406 break; 5407 5408 case FILE_EA_INFORMATION: 5409 get_file_ea_info(rsp, work->response_buf); 5410 break; 5411 5412 case FILE_FULL_EA_INFORMATION: 5413 rc = smb2_get_ea(work, fp, req, rsp, work->response_buf); 5414 break; 5415 5416 case FILE_POSITION_INFORMATION: 5417 get_file_position_info(rsp, fp, work->response_buf); 5418 break; 5419 5420 case FILE_MODE_INFORMATION: 5421 get_file_mode_info(rsp, fp, work->response_buf); 5422 break; 5423 5424 case FILE_COMPRESSION_INFORMATION: 5425 rc = get_file_compression_info(rsp, fp, work->response_buf); 5426 break; 5427 5428 case FILE_ATTRIBUTE_TAG_INFORMATION: 5429 rc = get_file_attribute_tag_info(rsp, fp, work->response_buf); 5430 break; 5431 case SMB_FIND_FILE_POSIX_INFO: 5432 if (!work->tcon->posix_extensions) { 5433 pr_err("client doesn't negotiate with SMB3.1.1 POSIX Extensions\n"); 5434 rc = -EOPNOTSUPP; 5435 } else { 5436 rc = find_file_posix_info(rsp, fp, work->response_buf); 5437 } 5438 break; 5439 default: 5440 ksmbd_debug(SMB, "fileinfoclass %d not supported yet\n", 5441 fileinfoclass); 5442 rc = -EOPNOTSUPP; 5443 } 5444 if (!rc) 5445 rc = buffer_check_err(le32_to_cpu(req->OutputBufferLength), 5446 rsp, work->response_buf); 5447 ksmbd_fd_put(work, fp); 5448 return rc; 5449 } 5450 5451 static int smb2_get_info_filesystem(struct ksmbd_work *work, 5452 struct smb2_query_info_req *req, 5453 struct smb2_query_info_rsp *rsp) 5454 { 5455 struct ksmbd_session *sess = work->sess; 5456 struct ksmbd_conn *conn = work->conn; 5457 struct ksmbd_share_config *share = work->tcon->share_conf; 5458 int fsinfoclass = 0; 5459 struct kstatfs stfs; 5460 struct path path; 5461 int rc = 0, len; 5462 5463 if (!share->path) 5464 return -EIO; 5465 5466 rc = kern_path(share->path, LOOKUP_NO_SYMLINKS, &path); 5467 if (rc) { 5468 pr_err("cannot create vfs path\n"); 5469 return -EIO; 5470 } 5471 5472 rc = vfs_statfs(&path, &stfs); 5473 if (rc) { 5474 pr_err("cannot do stat of path %s\n", share->path); 5475 path_put(&path); 5476 return -EIO; 5477 } 5478 5479 fsinfoclass = req->FileInfoClass; 5480 5481 switch (fsinfoclass) { 5482 case FS_DEVICE_INFORMATION: 5483 { 5484 FILE_SYSTEM_DEVICE_INFO *info; 5485 5486 info = (FILE_SYSTEM_DEVICE_INFO *)rsp->Buffer; 5487 5488 info->DeviceType = cpu_to_le32(FILE_DEVICE_DISK); 5489 info->DeviceCharacteristics = 5490 cpu_to_le32(FILE_DEVICE_IS_MOUNTED); 5491 if (!test_tree_conn_flag(work->tcon, 5492 KSMBD_TREE_CONN_FLAG_WRITABLE)) 5493 info->DeviceCharacteristics |= 5494 cpu_to_le32(FILE_READ_ONLY_DEVICE); 5495 rsp->OutputBufferLength = cpu_to_le32(8); 5496 break; 5497 } 5498 case FS_ATTRIBUTE_INFORMATION: 5499 { 5500 FILE_SYSTEM_ATTRIBUTE_INFO *info; 5501 size_t sz; 5502 5503 info = (FILE_SYSTEM_ATTRIBUTE_INFO *)rsp->Buffer; 5504 info->Attributes = cpu_to_le32(FILE_SUPPORTS_OBJECT_IDS | 5505 FILE_PERSISTENT_ACLS | 5506 FILE_UNICODE_ON_DISK | 5507 FILE_CASE_PRESERVED_NAMES | 5508 FILE_CASE_SENSITIVE_SEARCH | 5509 FILE_SUPPORTS_BLOCK_REFCOUNTING); 5510 5511 info->Attributes |= cpu_to_le32(server_conf.share_fake_fscaps); 5512 5513 if (test_share_config_flag(work->tcon->share_conf, 5514 KSMBD_SHARE_FLAG_STREAMS)) 5515 info->Attributes |= cpu_to_le32(FILE_NAMED_STREAMS); 5516 5517 info->MaxPathNameComponentLength = cpu_to_le32(stfs.f_namelen); 5518 /* 5519 * some application(potableapp) can not run on ksmbd share 5520 * because only NTFS handle security setting on windows. 5521 * So Although local fs(EXT4 or F2fs, etc) is not NTFS, 5522 * ksmbd should show share as NTFS. Later, If needed, we can add 5523 * fs type(s) parameter to change fs type user wanted. 5524 */ 5525 len = smbConvertToUTF16((__le16 *)info->FileSystemName, 5526 "NTFS", PATH_MAX, conn->local_nls, 0); 5527 len = len * 2; 5528 info->FileSystemNameLen = cpu_to_le32(len); 5529 sz = sizeof(FILE_SYSTEM_ATTRIBUTE_INFO) + len; 5530 rsp->OutputBufferLength = cpu_to_le32(sz); 5531 break; 5532 } 5533 case FS_VOLUME_INFORMATION: 5534 { 5535 struct filesystem_vol_info *info; 5536 size_t sz; 5537 unsigned int serial_crc = 0; 5538 5539 info = (struct filesystem_vol_info *)(rsp->Buffer); 5540 info->VolumeCreationTime = 0; 5541 serial_crc = crc32_le(serial_crc, share->name, 5542 strlen(share->name)); 5543 serial_crc = crc32_le(serial_crc, share->path, 5544 strlen(share->path)); 5545 serial_crc = crc32_le(serial_crc, ksmbd_netbios_name(), 5546 strlen(ksmbd_netbios_name())); 5547 /* Taking dummy value of serial number*/ 5548 info->SerialNumber = cpu_to_le32(serial_crc); 5549 len = smbConvertToUTF16((__le16 *)info->VolumeLabel, 5550 share->name, PATH_MAX, 5551 conn->local_nls, 0); 5552 len = len * 2; 5553 info->VolumeLabelSize = cpu_to_le32(len); 5554 info->Reserved = 0; 5555 sz = sizeof(struct filesystem_vol_info) + len; 5556 rsp->OutputBufferLength = cpu_to_le32(sz); 5557 break; 5558 } 5559 case FS_SIZE_INFORMATION: 5560 { 5561 FILE_SYSTEM_SIZE_INFO *info; 5562 5563 info = (FILE_SYSTEM_SIZE_INFO *)(rsp->Buffer); 5564 info->TotalAllocationUnits = cpu_to_le64(stfs.f_blocks); 5565 info->AvailableAllocationUnits = cpu_to_le64(stfs.f_bfree); 5566 info->SectorsPerAllocationUnit = cpu_to_le32(1); 5567 info->BytesPerSector = cpu_to_le32(stfs.f_bsize); 5568 rsp->OutputBufferLength = cpu_to_le32(24); 5569 break; 5570 } 5571 case FS_FULL_SIZE_INFORMATION: 5572 { 5573 struct smb2_fs_full_size_info *info; 5574 5575 info = (struct smb2_fs_full_size_info *)(rsp->Buffer); 5576 info->TotalAllocationUnits = cpu_to_le64(stfs.f_blocks); 5577 info->CallerAvailableAllocationUnits = 5578 cpu_to_le64(stfs.f_bavail); 5579 info->ActualAvailableAllocationUnits = 5580 cpu_to_le64(stfs.f_bfree); 5581 info->SectorsPerAllocationUnit = cpu_to_le32(1); 5582 info->BytesPerSector = cpu_to_le32(stfs.f_bsize); 5583 rsp->OutputBufferLength = cpu_to_le32(32); 5584 break; 5585 } 5586 case FS_OBJECT_ID_INFORMATION: 5587 { 5588 struct object_id_info *info; 5589 5590 info = (struct object_id_info *)(rsp->Buffer); 5591 5592 if (!user_guest(sess->user)) 5593 memcpy(info->objid, user_passkey(sess->user), 16); 5594 else 5595 memset(info->objid, 0, 16); 5596 5597 info->extended_info.magic = cpu_to_le32(EXTENDED_INFO_MAGIC); 5598 info->extended_info.version = cpu_to_le32(1); 5599 info->extended_info.release = cpu_to_le32(1); 5600 info->extended_info.rel_date = 0; 5601 memcpy(info->extended_info.version_string, "1.1.0", strlen("1.1.0")); 5602 rsp->OutputBufferLength = cpu_to_le32(64); 5603 break; 5604 } 5605 case FS_SECTOR_SIZE_INFORMATION: 5606 { 5607 struct smb3_fs_ss_info *info; 5608 unsigned int sector_size = 5609 min_t(unsigned int, path.mnt->mnt_sb->s_blocksize, 4096); 5610 5611 info = (struct smb3_fs_ss_info *)(rsp->Buffer); 5612 5613 info->LogicalBytesPerSector = cpu_to_le32(sector_size); 5614 info->PhysicalBytesPerSectorForAtomicity = 5615 cpu_to_le32(sector_size); 5616 info->PhysicalBytesPerSectorForPerf = cpu_to_le32(sector_size); 5617 info->FSEffPhysicalBytesPerSectorForAtomicity = 5618 cpu_to_le32(sector_size); 5619 info->Flags = cpu_to_le32(SSINFO_FLAGS_ALIGNED_DEVICE | 5620 SSINFO_FLAGS_PARTITION_ALIGNED_ON_DEVICE); 5621 info->ByteOffsetForSectorAlignment = 0; 5622 info->ByteOffsetForPartitionAlignment = 0; 5623 rsp->OutputBufferLength = cpu_to_le32(28); 5624 break; 5625 } 5626 case FS_CONTROL_INFORMATION: 5627 { 5628 /* 5629 * TODO : The current implementation is based on 5630 * test result with win7(NTFS) server. It's need to 5631 * modify this to get valid Quota values 5632 * from Linux kernel 5633 */ 5634 struct smb2_fs_control_info *info; 5635 5636 info = (struct smb2_fs_control_info *)(rsp->Buffer); 5637 info->FreeSpaceStartFiltering = 0; 5638 info->FreeSpaceThreshold = 0; 5639 info->FreeSpaceStopFiltering = 0; 5640 info->DefaultQuotaThreshold = cpu_to_le64(SMB2_NO_FID); 5641 info->DefaultQuotaLimit = cpu_to_le64(SMB2_NO_FID); 5642 info->Padding = 0; 5643 rsp->OutputBufferLength = cpu_to_le32(48); 5644 break; 5645 } 5646 case FS_POSIX_INFORMATION: 5647 { 5648 FILE_SYSTEM_POSIX_INFO *info; 5649 5650 if (!work->tcon->posix_extensions) { 5651 pr_err("client doesn't negotiate with SMB3.1.1 POSIX Extensions\n"); 5652 path_put(&path); 5653 return -EOPNOTSUPP; 5654 } else { 5655 info = (FILE_SYSTEM_POSIX_INFO *)(rsp->Buffer); 5656 info->OptimalTransferSize = cpu_to_le32(stfs.f_bsize); 5657 info->BlockSize = cpu_to_le32(stfs.f_bsize); 5658 info->TotalBlocks = cpu_to_le64(stfs.f_blocks); 5659 info->BlocksAvail = cpu_to_le64(stfs.f_bfree); 5660 info->UserBlocksAvail = cpu_to_le64(stfs.f_bavail); 5661 info->TotalFileNodes = cpu_to_le64(stfs.f_files); 5662 info->FreeFileNodes = cpu_to_le64(stfs.f_ffree); 5663 rsp->OutputBufferLength = cpu_to_le32(56); 5664 } 5665 break; 5666 } 5667 default: 5668 path_put(&path); 5669 return -EOPNOTSUPP; 5670 } 5671 rc = buffer_check_err(le32_to_cpu(req->OutputBufferLength), 5672 rsp, work->response_buf); 5673 path_put(&path); 5674 return rc; 5675 } 5676 5677 static int smb2_get_info_sec(struct ksmbd_work *work, 5678 struct smb2_query_info_req *req, 5679 struct smb2_query_info_rsp *rsp) 5680 { 5681 struct ksmbd_file *fp; 5682 struct mnt_idmap *idmap; 5683 struct smb_ntsd *pntsd = (struct smb_ntsd *)rsp->Buffer, *ppntsd = NULL; 5684 struct smb_fattr fattr = {{0}}; 5685 struct inode *inode; 5686 __u32 secdesclen = 0; 5687 unsigned int id = KSMBD_NO_FID, pid = KSMBD_NO_FID; 5688 int addition_info = le32_to_cpu(req->AdditionalInformation); 5689 int rc = 0, ppntsd_size = 0; 5690 5691 if (addition_info & ~(OWNER_SECINFO | GROUP_SECINFO | DACL_SECINFO | 5692 PROTECTED_DACL_SECINFO | 5693 UNPROTECTED_DACL_SECINFO)) { 5694 ksmbd_debug(SMB, "Unsupported addition info: 0x%x)\n", 5695 addition_info); 5696 5697 pntsd->revision = cpu_to_le16(1); 5698 pntsd->type = cpu_to_le16(SELF_RELATIVE | DACL_PROTECTED); 5699 pntsd->osidoffset = 0; 5700 pntsd->gsidoffset = 0; 5701 pntsd->sacloffset = 0; 5702 pntsd->dacloffset = 0; 5703 5704 secdesclen = sizeof(struct smb_ntsd); 5705 rsp->OutputBufferLength = cpu_to_le32(secdesclen); 5706 5707 return 0; 5708 } 5709 5710 if (work->next_smb2_rcv_hdr_off) { 5711 if (!has_file_id(req->VolatileFileId)) { 5712 ksmbd_debug(SMB, "Compound request set FID = %llu\n", 5713 work->compound_fid); 5714 id = work->compound_fid; 5715 pid = work->compound_pfid; 5716 } 5717 } 5718 5719 if (!has_file_id(id)) { 5720 id = req->VolatileFileId; 5721 pid = req->PersistentFileId; 5722 } 5723 5724 fp = ksmbd_lookup_fd_slow(work, id, pid); 5725 if (!fp) 5726 return -ENOENT; 5727 5728 idmap = file_mnt_idmap(fp->filp); 5729 inode = file_inode(fp->filp); 5730 ksmbd_acls_fattr(&fattr, idmap, inode); 5731 5732 if (test_share_config_flag(work->tcon->share_conf, 5733 KSMBD_SHARE_FLAG_ACL_XATTR)) 5734 ppntsd_size = ksmbd_vfs_get_sd_xattr(work->conn, idmap, 5735 fp->filp->f_path.dentry, 5736 &ppntsd); 5737 5738 /* Check if sd buffer size exceeds response buffer size */ 5739 if (smb2_resp_buf_len(work, 8) > ppntsd_size) 5740 rc = build_sec_desc(idmap, pntsd, ppntsd, ppntsd_size, 5741 addition_info, &secdesclen, &fattr); 5742 posix_acl_release(fattr.cf_acls); 5743 posix_acl_release(fattr.cf_dacls); 5744 kfree(ppntsd); 5745 ksmbd_fd_put(work, fp); 5746 if (rc) 5747 return rc; 5748 5749 rsp->OutputBufferLength = cpu_to_le32(secdesclen); 5750 return 0; 5751 } 5752 5753 /** 5754 * smb2_query_info() - handler for smb2 query info command 5755 * @work: smb work containing query info request buffer 5756 * 5757 * Return: 0 on success, otherwise error 5758 */ 5759 int smb2_query_info(struct ksmbd_work *work) 5760 { 5761 struct smb2_query_info_req *req; 5762 struct smb2_query_info_rsp *rsp; 5763 int rc = 0; 5764 5765 ksmbd_debug(SMB, "Received request smb2 query info request\n"); 5766 5767 WORK_BUFFERS(work, req, rsp); 5768 5769 if (ksmbd_override_fsids(work)) { 5770 rc = -ENOMEM; 5771 goto err_out; 5772 } 5773 5774 switch (req->InfoType) { 5775 case SMB2_O_INFO_FILE: 5776 ksmbd_debug(SMB, "GOT SMB2_O_INFO_FILE\n"); 5777 rc = smb2_get_info_file(work, req, rsp); 5778 break; 5779 case SMB2_O_INFO_FILESYSTEM: 5780 ksmbd_debug(SMB, "GOT SMB2_O_INFO_FILESYSTEM\n"); 5781 rc = smb2_get_info_filesystem(work, req, rsp); 5782 break; 5783 case SMB2_O_INFO_SECURITY: 5784 ksmbd_debug(SMB, "GOT SMB2_O_INFO_SECURITY\n"); 5785 rc = smb2_get_info_sec(work, req, rsp); 5786 break; 5787 default: 5788 ksmbd_debug(SMB, "InfoType %d not supported yet\n", 5789 req->InfoType); 5790 rc = -EOPNOTSUPP; 5791 } 5792 ksmbd_revert_fsids(work); 5793 5794 if (!rc) { 5795 rsp->StructureSize = cpu_to_le16(9); 5796 rsp->OutputBufferOffset = cpu_to_le16(72); 5797 rc = ksmbd_iov_pin_rsp(work, (void *)rsp, 5798 offsetof(struct smb2_query_info_rsp, Buffer) + 5799 le32_to_cpu(rsp->OutputBufferLength)); 5800 } 5801 5802 err_out: 5803 if (rc < 0) { 5804 if (rc == -EACCES) 5805 rsp->hdr.Status = STATUS_ACCESS_DENIED; 5806 else if (rc == -ENOENT) 5807 rsp->hdr.Status = STATUS_FILE_CLOSED; 5808 else if (rc == -EIO) 5809 rsp->hdr.Status = STATUS_UNEXPECTED_IO_ERROR; 5810 else if (rc == -ENOMEM) 5811 rsp->hdr.Status = STATUS_INSUFFICIENT_RESOURCES; 5812 else if (rc == -EOPNOTSUPP || rsp->hdr.Status == 0) 5813 rsp->hdr.Status = STATUS_INVALID_INFO_CLASS; 5814 smb2_set_err_rsp(work); 5815 5816 ksmbd_debug(SMB, "error while processing smb2 query rc = %d\n", 5817 rc); 5818 return rc; 5819 } 5820 return 0; 5821 } 5822 5823 /** 5824 * smb2_close_pipe() - handler for closing IPC pipe 5825 * @work: smb work containing close request buffer 5826 * 5827 * Return: 0 5828 */ 5829 static noinline int smb2_close_pipe(struct ksmbd_work *work) 5830 { 5831 u64 id; 5832 struct smb2_close_req *req; 5833 struct smb2_close_rsp *rsp; 5834 5835 WORK_BUFFERS(work, req, rsp); 5836 5837 id = req->VolatileFileId; 5838 ksmbd_session_rpc_close(work->sess, id); 5839 5840 rsp->StructureSize = cpu_to_le16(60); 5841 rsp->Flags = 0; 5842 rsp->Reserved = 0; 5843 rsp->CreationTime = 0; 5844 rsp->LastAccessTime = 0; 5845 rsp->LastWriteTime = 0; 5846 rsp->ChangeTime = 0; 5847 rsp->AllocationSize = 0; 5848 rsp->EndOfFile = 0; 5849 rsp->Attributes = 0; 5850 5851 return ksmbd_iov_pin_rsp(work, (void *)rsp, 5852 sizeof(struct smb2_close_rsp)); 5853 } 5854 5855 /** 5856 * smb2_close() - handler for smb2 close file command 5857 * @work: smb work containing close request buffer 5858 * 5859 * Return: 0 on success, otherwise error 5860 */ 5861 int smb2_close(struct ksmbd_work *work) 5862 { 5863 u64 volatile_id = KSMBD_NO_FID; 5864 u64 sess_id; 5865 struct smb2_close_req *req; 5866 struct smb2_close_rsp *rsp; 5867 struct ksmbd_conn *conn = work->conn; 5868 struct ksmbd_file *fp; 5869 u64 time; 5870 int err = 0; 5871 5872 ksmbd_debug(SMB, "Received smb2 close request\n"); 5873 5874 WORK_BUFFERS(work, req, rsp); 5875 5876 if (test_share_config_flag(work->tcon->share_conf, 5877 KSMBD_SHARE_FLAG_PIPE)) { 5878 ksmbd_debug(SMB, "IPC pipe close request\n"); 5879 return smb2_close_pipe(work); 5880 } 5881 5882 sess_id = le64_to_cpu(req->hdr.SessionId); 5883 if (req->hdr.Flags & SMB2_FLAGS_RELATED_OPERATIONS) 5884 sess_id = work->compound_sid; 5885 5886 work->compound_sid = 0; 5887 if (check_session_id(conn, sess_id)) { 5888 work->compound_sid = sess_id; 5889 } else { 5890 rsp->hdr.Status = STATUS_USER_SESSION_DELETED; 5891 if (req->hdr.Flags & SMB2_FLAGS_RELATED_OPERATIONS) 5892 rsp->hdr.Status = STATUS_INVALID_PARAMETER; 5893 err = -EBADF; 5894 goto out; 5895 } 5896 5897 if (work->next_smb2_rcv_hdr_off && 5898 !has_file_id(req->VolatileFileId)) { 5899 if (!has_file_id(work->compound_fid)) { 5900 /* file already closed, return FILE_CLOSED */ 5901 ksmbd_debug(SMB, "file already closed\n"); 5902 rsp->hdr.Status = STATUS_FILE_CLOSED; 5903 err = -EBADF; 5904 goto out; 5905 } else { 5906 ksmbd_debug(SMB, 5907 "Compound request set FID = %llu:%llu\n", 5908 work->compound_fid, 5909 work->compound_pfid); 5910 volatile_id = work->compound_fid; 5911 5912 /* file closed, stored id is not valid anymore */ 5913 work->compound_fid = KSMBD_NO_FID; 5914 work->compound_pfid = KSMBD_NO_FID; 5915 } 5916 } else { 5917 volatile_id = req->VolatileFileId; 5918 } 5919 ksmbd_debug(SMB, "volatile_id = %llu\n", volatile_id); 5920 5921 rsp->StructureSize = cpu_to_le16(60); 5922 rsp->Reserved = 0; 5923 5924 if (req->Flags == SMB2_CLOSE_FLAG_POSTQUERY_ATTRIB) { 5925 struct kstat stat; 5926 int ret; 5927 5928 fp = ksmbd_lookup_fd_fast(work, volatile_id); 5929 if (!fp) { 5930 err = -ENOENT; 5931 goto out; 5932 } 5933 5934 ret = vfs_getattr(&fp->filp->f_path, &stat, STATX_BASIC_STATS, 5935 AT_STATX_SYNC_AS_STAT); 5936 if (ret) { 5937 ksmbd_fd_put(work, fp); 5938 goto out; 5939 } 5940 5941 rsp->Flags = SMB2_CLOSE_FLAG_POSTQUERY_ATTRIB; 5942 rsp->AllocationSize = S_ISDIR(stat.mode) ? 0 : 5943 cpu_to_le64(stat.blocks << 9); 5944 rsp->EndOfFile = cpu_to_le64(stat.size); 5945 rsp->Attributes = fp->f_ci->m_fattr; 5946 rsp->CreationTime = cpu_to_le64(fp->create_time); 5947 time = ksmbd_UnixTimeToNT(stat.atime); 5948 rsp->LastAccessTime = cpu_to_le64(time); 5949 time = ksmbd_UnixTimeToNT(stat.mtime); 5950 rsp->LastWriteTime = cpu_to_le64(time); 5951 time = ksmbd_UnixTimeToNT(stat.ctime); 5952 rsp->ChangeTime = cpu_to_le64(time); 5953 ksmbd_fd_put(work, fp); 5954 } else { 5955 rsp->Flags = 0; 5956 rsp->AllocationSize = 0; 5957 rsp->EndOfFile = 0; 5958 rsp->Attributes = 0; 5959 rsp->CreationTime = 0; 5960 rsp->LastAccessTime = 0; 5961 rsp->LastWriteTime = 0; 5962 rsp->ChangeTime = 0; 5963 } 5964 5965 err = ksmbd_close_fd(work, volatile_id); 5966 out: 5967 if (!err) 5968 err = ksmbd_iov_pin_rsp(work, (void *)rsp, 5969 sizeof(struct smb2_close_rsp)); 5970 5971 if (err) { 5972 if (rsp->hdr.Status == 0) 5973 rsp->hdr.Status = STATUS_FILE_CLOSED; 5974 smb2_set_err_rsp(work); 5975 } 5976 5977 return err; 5978 } 5979 5980 /** 5981 * smb2_echo() - handler for smb2 echo(ping) command 5982 * @work: smb work containing echo request buffer 5983 * 5984 * Return: 0 on success, otherwise error 5985 */ 5986 int smb2_echo(struct ksmbd_work *work) 5987 { 5988 struct smb2_echo_rsp *rsp = smb_get_msg(work->response_buf); 5989 5990 ksmbd_debug(SMB, "Received smb2 echo request\n"); 5991 5992 if (work->next_smb2_rcv_hdr_off) 5993 rsp = ksmbd_resp_buf_next(work); 5994 5995 rsp->StructureSize = cpu_to_le16(4); 5996 rsp->Reserved = 0; 5997 return ksmbd_iov_pin_rsp(work, rsp, sizeof(struct smb2_echo_rsp)); 5998 } 5999 6000 static int smb2_rename(struct ksmbd_work *work, 6001 struct ksmbd_file *fp, 6002 struct smb2_file_rename_info *file_info, 6003 struct nls_table *local_nls) 6004 { 6005 struct ksmbd_share_config *share = fp->tcon->share_conf; 6006 char *new_name = NULL; 6007 int rc, flags = 0; 6008 6009 ksmbd_debug(SMB, "setting FILE_RENAME_INFO\n"); 6010 new_name = smb2_get_name(file_info->FileName, 6011 le32_to_cpu(file_info->FileNameLength), 6012 local_nls); 6013 if (IS_ERR(new_name)) 6014 return PTR_ERR(new_name); 6015 6016 if (fp->is_posix_ctxt == false && strchr(new_name, ':')) { 6017 int s_type; 6018 char *xattr_stream_name, *stream_name = NULL; 6019 size_t xattr_stream_size; 6020 int len; 6021 6022 rc = parse_stream_name(new_name, &stream_name, &s_type); 6023 if (rc < 0) 6024 goto out; 6025 6026 len = strlen(new_name); 6027 if (len > 0 && new_name[len - 1] != '/') { 6028 pr_err("not allow base filename in rename\n"); 6029 rc = -ESHARE; 6030 goto out; 6031 } 6032 6033 rc = ksmbd_vfs_xattr_stream_name(stream_name, 6034 &xattr_stream_name, 6035 &xattr_stream_size, 6036 s_type); 6037 if (rc) 6038 goto out; 6039 6040 rc = ksmbd_vfs_setxattr(file_mnt_idmap(fp->filp), 6041 &fp->filp->f_path, 6042 xattr_stream_name, 6043 NULL, 0, 0, true); 6044 if (rc < 0) { 6045 pr_err("failed to store stream name in xattr: %d\n", 6046 rc); 6047 rc = -EINVAL; 6048 goto out; 6049 } 6050 6051 goto out; 6052 } 6053 6054 ksmbd_debug(SMB, "new name %s\n", new_name); 6055 if (ksmbd_share_veto_filename(share, new_name)) { 6056 rc = -ENOENT; 6057 ksmbd_debug(SMB, "Can't rename vetoed file: %s\n", new_name); 6058 goto out; 6059 } 6060 6061 if (!file_info->ReplaceIfExists) 6062 flags = RENAME_NOREPLACE; 6063 6064 rc = ksmbd_vfs_rename(work, &fp->filp->f_path, new_name, flags); 6065 if (!rc) 6066 smb_break_all_levII_oplock(work, fp, 0); 6067 out: 6068 kfree(new_name); 6069 return rc; 6070 } 6071 6072 static int smb2_create_link(struct ksmbd_work *work, 6073 struct ksmbd_share_config *share, 6074 struct smb2_file_link_info *file_info, 6075 unsigned int buf_len, struct file *filp, 6076 struct nls_table *local_nls) 6077 { 6078 char *link_name = NULL, *target_name = NULL, *pathname = NULL; 6079 struct path path; 6080 int rc; 6081 6082 if (buf_len < (u64)sizeof(struct smb2_file_link_info) + 6083 le32_to_cpu(file_info->FileNameLength)) 6084 return -EINVAL; 6085 6086 ksmbd_debug(SMB, "setting FILE_LINK_INFORMATION\n"); 6087 pathname = kmalloc(PATH_MAX, KSMBD_DEFAULT_GFP); 6088 if (!pathname) 6089 return -ENOMEM; 6090 6091 link_name = smb2_get_name(file_info->FileName, 6092 le32_to_cpu(file_info->FileNameLength), 6093 local_nls); 6094 if (IS_ERR(link_name) || S_ISDIR(file_inode(filp)->i_mode)) { 6095 rc = -EINVAL; 6096 goto out; 6097 } 6098 6099 ksmbd_debug(SMB, "link name is %s\n", link_name); 6100 target_name = file_path(filp, pathname, PATH_MAX); 6101 if (IS_ERR(target_name)) { 6102 rc = -EINVAL; 6103 goto out; 6104 } 6105 6106 ksmbd_debug(SMB, "target name is %s\n", target_name); 6107 rc = ksmbd_vfs_kern_path_start_removing(work, link_name, LOOKUP_NO_SYMLINKS, 6108 &path, 0); 6109 if (rc) { 6110 if (rc != -ENOENT) 6111 goto out; 6112 } else { 6113 if (file_info->ReplaceIfExists) { 6114 rc = ksmbd_vfs_remove_file(work, &path); 6115 if (rc) { 6116 rc = -EINVAL; 6117 ksmbd_debug(SMB, "cannot delete %s\n", 6118 link_name); 6119 } 6120 } else { 6121 rc = -EEXIST; 6122 ksmbd_debug(SMB, "link already exists\n"); 6123 } 6124 ksmbd_vfs_kern_path_end_removing(&path); 6125 if (rc) 6126 goto out; 6127 } 6128 rc = ksmbd_vfs_link(work, target_name, link_name); 6129 if (rc) 6130 rc = -EINVAL; 6131 out: 6132 6133 if (!IS_ERR(link_name)) 6134 kfree(link_name); 6135 kfree(pathname); 6136 return rc; 6137 } 6138 6139 static int set_file_basic_info(struct ksmbd_file *fp, 6140 struct smb2_file_basic_info *file_info, 6141 struct ksmbd_share_config *share) 6142 { 6143 struct iattr attrs; 6144 struct file *filp; 6145 struct inode *inode; 6146 struct mnt_idmap *idmap; 6147 int rc = 0; 6148 6149 if (!(fp->daccess & FILE_WRITE_ATTRIBUTES_LE)) 6150 return -EACCES; 6151 6152 attrs.ia_valid = 0; 6153 filp = fp->filp; 6154 inode = file_inode(filp); 6155 idmap = file_mnt_idmap(filp); 6156 6157 if (file_info->CreationTime) 6158 fp->create_time = le64_to_cpu(file_info->CreationTime); 6159 6160 if (file_info->LastAccessTime) { 6161 attrs.ia_atime = ksmbd_NTtimeToUnix(file_info->LastAccessTime); 6162 attrs.ia_valid |= (ATTR_ATIME | ATTR_ATIME_SET); 6163 } 6164 6165 if (file_info->ChangeTime) 6166 inode_set_ctime_to_ts(inode, 6167 ksmbd_NTtimeToUnix(file_info->ChangeTime)); 6168 6169 if (file_info->LastWriteTime) { 6170 attrs.ia_mtime = ksmbd_NTtimeToUnix(file_info->LastWriteTime); 6171 attrs.ia_valid |= (ATTR_MTIME | ATTR_MTIME_SET | ATTR_CTIME); 6172 } 6173 6174 if (file_info->Attributes) { 6175 if (!S_ISDIR(inode->i_mode) && 6176 file_info->Attributes & FILE_ATTRIBUTE_DIRECTORY_LE) { 6177 pr_err("can't change a file to a directory\n"); 6178 return -EINVAL; 6179 } 6180 6181 if (!(S_ISDIR(inode->i_mode) && file_info->Attributes == FILE_ATTRIBUTE_NORMAL_LE)) 6182 fp->f_ci->m_fattr = file_info->Attributes | 6183 (fp->f_ci->m_fattr & FILE_ATTRIBUTE_DIRECTORY_LE); 6184 } 6185 6186 if (test_share_config_flag(share, KSMBD_SHARE_FLAG_STORE_DOS_ATTRS) && 6187 (file_info->CreationTime || file_info->Attributes)) { 6188 struct xattr_dos_attrib da = {0}; 6189 6190 da.version = 4; 6191 da.itime = fp->itime; 6192 da.create_time = fp->create_time; 6193 da.attr = le32_to_cpu(fp->f_ci->m_fattr); 6194 da.flags = XATTR_DOSINFO_ATTRIB | XATTR_DOSINFO_CREATE_TIME | 6195 XATTR_DOSINFO_ITIME; 6196 6197 rc = ksmbd_vfs_set_dos_attrib_xattr(idmap, &filp->f_path, &da, 6198 true); 6199 if (rc) 6200 ksmbd_debug(SMB, 6201 "failed to restore file attribute in EA\n"); 6202 rc = 0; 6203 } 6204 6205 if (attrs.ia_valid) { 6206 struct dentry *dentry = filp->f_path.dentry; 6207 struct inode *inode = d_inode(dentry); 6208 6209 if (IS_IMMUTABLE(inode) || IS_APPEND(inode)) 6210 return -EACCES; 6211 6212 inode_lock(inode); 6213 rc = notify_change(idmap, dentry, &attrs, NULL); 6214 inode_unlock(inode); 6215 } 6216 return rc; 6217 } 6218 6219 static int set_file_allocation_info(struct ksmbd_work *work, 6220 struct ksmbd_file *fp, 6221 struct smb2_file_alloc_info *file_alloc_info) 6222 { 6223 /* 6224 * TODO : It's working fine only when store dos attributes 6225 * is not yes. need to implement a logic which works 6226 * properly with any smb.conf option 6227 */ 6228 6229 loff_t alloc_blks; 6230 struct inode *inode; 6231 struct kstat stat; 6232 int rc; 6233 6234 if (!(fp->daccess & FILE_WRITE_DATA_LE)) 6235 return -EACCES; 6236 6237 if (ksmbd_stream_fd(fp) == true) 6238 return 0; 6239 6240 rc = vfs_getattr(&fp->filp->f_path, &stat, STATX_BASIC_STATS, 6241 AT_STATX_SYNC_AS_STAT); 6242 if (rc) 6243 return rc; 6244 6245 alloc_blks = (le64_to_cpu(file_alloc_info->AllocationSize) + 511) >> 9; 6246 inode = file_inode(fp->filp); 6247 6248 if (alloc_blks > stat.blocks) { 6249 smb_break_all_levII_oplock(work, fp, 1); 6250 rc = vfs_fallocate(fp->filp, FALLOC_FL_KEEP_SIZE, 0, 6251 alloc_blks * 512); 6252 if (rc && rc != -EOPNOTSUPP) { 6253 pr_err("vfs_fallocate is failed : %d\n", rc); 6254 return rc; 6255 } 6256 } else if (alloc_blks < stat.blocks) { 6257 loff_t size; 6258 6259 /* 6260 * Allocation size could be smaller than original one 6261 * which means allocated blocks in file should be 6262 * deallocated. use truncate to cut out it, but inode 6263 * size is also updated with truncate offset. 6264 * inode size is retained by backup inode size. 6265 */ 6266 size = i_size_read(inode); 6267 rc = ksmbd_vfs_truncate(work, fp, alloc_blks * 512); 6268 if (rc) { 6269 pr_err("truncate failed!, err %d\n", rc); 6270 return rc; 6271 } 6272 if (size < alloc_blks * 512) 6273 i_size_write(inode, size); 6274 } 6275 return 0; 6276 } 6277 6278 static int set_end_of_file_info(struct ksmbd_work *work, struct ksmbd_file *fp, 6279 struct smb2_file_eof_info *file_eof_info) 6280 { 6281 loff_t newsize; 6282 struct inode *inode; 6283 int rc; 6284 6285 if (!(fp->daccess & FILE_WRITE_DATA_LE)) 6286 return -EACCES; 6287 6288 newsize = le64_to_cpu(file_eof_info->EndOfFile); 6289 inode = file_inode(fp->filp); 6290 6291 /* 6292 * If FILE_END_OF_FILE_INFORMATION of set_info_file is called 6293 * on FAT32 shared device, truncate execution time is too long 6294 * and network error could cause from windows client. because 6295 * truncate of some filesystem like FAT32 fill zero data in 6296 * truncated range. 6297 */ 6298 if (inode->i_sb->s_magic != MSDOS_SUPER_MAGIC && 6299 ksmbd_stream_fd(fp) == false) { 6300 ksmbd_debug(SMB, "truncated to newsize %lld\n", newsize); 6301 rc = ksmbd_vfs_truncate(work, fp, newsize); 6302 if (rc) { 6303 ksmbd_debug(SMB, "truncate failed!, err %d\n", rc); 6304 if (rc != -EAGAIN) 6305 rc = -EBADF; 6306 return rc; 6307 } 6308 } 6309 return 0; 6310 } 6311 6312 static int set_rename_info(struct ksmbd_work *work, struct ksmbd_file *fp, 6313 struct smb2_file_rename_info *rename_info, 6314 unsigned int buf_len) 6315 { 6316 if (!(fp->daccess & FILE_DELETE_LE)) { 6317 pr_err("no right to delete : 0x%x\n", fp->daccess); 6318 return -EACCES; 6319 } 6320 6321 if (buf_len < (u64)sizeof(struct smb2_file_rename_info) + 6322 le32_to_cpu(rename_info->FileNameLength)) 6323 return -EINVAL; 6324 6325 if (!le32_to_cpu(rename_info->FileNameLength)) 6326 return -EINVAL; 6327 6328 return smb2_rename(work, fp, rename_info, work->conn->local_nls); 6329 } 6330 6331 static int set_file_disposition_info(struct ksmbd_file *fp, 6332 struct smb2_file_disposition_info *file_info) 6333 { 6334 struct inode *inode; 6335 6336 if (!(fp->daccess & FILE_DELETE_LE)) { 6337 pr_err("no right to delete : 0x%x\n", fp->daccess); 6338 return -EACCES; 6339 } 6340 6341 inode = file_inode(fp->filp); 6342 if (file_info->DeletePending) { 6343 if (S_ISDIR(inode->i_mode) && 6344 ksmbd_vfs_empty_dir(fp) == -ENOTEMPTY) 6345 return -EBUSY; 6346 ksmbd_set_inode_pending_delete(fp); 6347 } else { 6348 ksmbd_clear_inode_pending_delete(fp); 6349 } 6350 return 0; 6351 } 6352 6353 static int set_file_position_info(struct ksmbd_file *fp, 6354 struct smb2_file_pos_info *file_info) 6355 { 6356 loff_t current_byte_offset; 6357 unsigned long sector_size; 6358 struct inode *inode; 6359 6360 inode = file_inode(fp->filp); 6361 current_byte_offset = le64_to_cpu(file_info->CurrentByteOffset); 6362 sector_size = inode->i_sb->s_blocksize; 6363 6364 if (current_byte_offset < 0 || 6365 (fp->coption == FILE_NO_INTERMEDIATE_BUFFERING_LE && 6366 current_byte_offset & (sector_size - 1))) { 6367 pr_err("CurrentByteOffset is not valid : %llu\n", 6368 current_byte_offset); 6369 return -EINVAL; 6370 } 6371 6372 if (ksmbd_stream_fd(fp) == false) 6373 fp->filp->f_pos = current_byte_offset; 6374 else { 6375 if (current_byte_offset > XATTR_SIZE_MAX) 6376 current_byte_offset = XATTR_SIZE_MAX; 6377 fp->stream.pos = current_byte_offset; 6378 } 6379 return 0; 6380 } 6381 6382 static int set_file_mode_info(struct ksmbd_file *fp, 6383 struct smb2_file_mode_info *file_info) 6384 { 6385 __le32 mode; 6386 6387 mode = file_info->Mode; 6388 6389 if ((mode & ~FILE_MODE_INFO_MASK)) { 6390 pr_err("Mode is not valid : 0x%x\n", le32_to_cpu(mode)); 6391 return -EINVAL; 6392 } 6393 6394 /* 6395 * TODO : need to implement consideration for 6396 * FILE_SYNCHRONOUS_IO_ALERT and FILE_SYNCHRONOUS_IO_NONALERT 6397 */ 6398 ksmbd_vfs_set_fadvise(fp->filp, mode); 6399 fp->coption = mode; 6400 return 0; 6401 } 6402 6403 /** 6404 * smb2_set_info_file() - handler for smb2 set info command 6405 * @work: smb work containing set info command buffer 6406 * @fp: ksmbd_file pointer 6407 * @req: request buffer pointer 6408 * @share: ksmbd_share_config pointer 6409 * 6410 * Return: 0 on success, otherwise error 6411 */ 6412 static int smb2_set_info_file(struct ksmbd_work *work, struct ksmbd_file *fp, 6413 struct smb2_set_info_req *req, 6414 struct ksmbd_share_config *share) 6415 { 6416 unsigned int buf_len = le32_to_cpu(req->BufferLength); 6417 char *buffer = (char *)req + le16_to_cpu(req->BufferOffset); 6418 6419 switch (req->FileInfoClass) { 6420 case FILE_BASIC_INFORMATION: 6421 { 6422 if (buf_len < sizeof(struct smb2_file_basic_info)) 6423 return -EMSGSIZE; 6424 6425 return set_file_basic_info(fp, (struct smb2_file_basic_info *)buffer, share); 6426 } 6427 case FILE_ALLOCATION_INFORMATION: 6428 { 6429 if (buf_len < sizeof(struct smb2_file_alloc_info)) 6430 return -EMSGSIZE; 6431 6432 return set_file_allocation_info(work, fp, 6433 (struct smb2_file_alloc_info *)buffer); 6434 } 6435 case FILE_END_OF_FILE_INFORMATION: 6436 { 6437 if (buf_len < sizeof(struct smb2_file_eof_info)) 6438 return -EMSGSIZE; 6439 6440 return set_end_of_file_info(work, fp, 6441 (struct smb2_file_eof_info *)buffer); 6442 } 6443 case FILE_RENAME_INFORMATION: 6444 { 6445 if (buf_len < sizeof(struct smb2_file_rename_info)) 6446 return -EMSGSIZE; 6447 6448 return set_rename_info(work, fp, 6449 (struct smb2_file_rename_info *)buffer, 6450 buf_len); 6451 } 6452 case FILE_LINK_INFORMATION: 6453 { 6454 if (buf_len < sizeof(struct smb2_file_link_info)) 6455 return -EMSGSIZE; 6456 6457 return smb2_create_link(work, work->tcon->share_conf, 6458 (struct smb2_file_link_info *)buffer, 6459 buf_len, fp->filp, 6460 work->conn->local_nls); 6461 } 6462 case FILE_DISPOSITION_INFORMATION: 6463 { 6464 if (buf_len < sizeof(struct smb2_file_disposition_info)) 6465 return -EMSGSIZE; 6466 6467 return set_file_disposition_info(fp, 6468 (struct smb2_file_disposition_info *)buffer); 6469 } 6470 case FILE_FULL_EA_INFORMATION: 6471 { 6472 if (!(fp->daccess & FILE_WRITE_EA_LE)) { 6473 pr_err("Not permitted to write ext attr: 0x%x\n", 6474 fp->daccess); 6475 return -EACCES; 6476 } 6477 6478 if (buf_len < sizeof(struct smb2_ea_info)) 6479 return -EMSGSIZE; 6480 6481 return smb2_set_ea((struct smb2_ea_info *)buffer, 6482 buf_len, &fp->filp->f_path, true); 6483 } 6484 case FILE_POSITION_INFORMATION: 6485 { 6486 if (buf_len < sizeof(struct smb2_file_pos_info)) 6487 return -EMSGSIZE; 6488 6489 return set_file_position_info(fp, (struct smb2_file_pos_info *)buffer); 6490 } 6491 case FILE_MODE_INFORMATION: 6492 { 6493 if (buf_len < sizeof(struct smb2_file_mode_info)) 6494 return -EMSGSIZE; 6495 6496 return set_file_mode_info(fp, (struct smb2_file_mode_info *)buffer); 6497 } 6498 } 6499 6500 pr_err("Unimplemented Fileinfoclass :%d\n", req->FileInfoClass); 6501 return -EOPNOTSUPP; 6502 } 6503 6504 static int smb2_set_info_sec(struct ksmbd_file *fp, int addition_info, 6505 char *buffer, int buf_len) 6506 { 6507 struct smb_ntsd *pntsd = (struct smb_ntsd *)buffer; 6508 6509 fp->saccess |= FILE_SHARE_DELETE_LE; 6510 6511 return set_info_sec(fp->conn, fp->tcon, &fp->filp->f_path, pntsd, 6512 buf_len, false, true); 6513 } 6514 6515 /** 6516 * smb2_set_info() - handler for smb2 set info command handler 6517 * @work: smb work containing set info request buffer 6518 * 6519 * Return: 0 on success, otherwise error 6520 */ 6521 int smb2_set_info(struct ksmbd_work *work) 6522 { 6523 struct smb2_set_info_req *req; 6524 struct smb2_set_info_rsp *rsp; 6525 struct ksmbd_file *fp = NULL; 6526 int rc = 0; 6527 unsigned int id = KSMBD_NO_FID, pid = KSMBD_NO_FID; 6528 6529 ksmbd_debug(SMB, "Received smb2 set info request\n"); 6530 6531 if (work->next_smb2_rcv_hdr_off) { 6532 req = ksmbd_req_buf_next(work); 6533 rsp = ksmbd_resp_buf_next(work); 6534 if (!has_file_id(req->VolatileFileId)) { 6535 ksmbd_debug(SMB, "Compound request set FID = %llu\n", 6536 work->compound_fid); 6537 id = work->compound_fid; 6538 pid = work->compound_pfid; 6539 } 6540 } else { 6541 req = smb_get_msg(work->request_buf); 6542 rsp = smb_get_msg(work->response_buf); 6543 } 6544 6545 if (!test_tree_conn_flag(work->tcon, KSMBD_TREE_CONN_FLAG_WRITABLE)) { 6546 ksmbd_debug(SMB, "User does not have write permission\n"); 6547 pr_err("User does not have write permission\n"); 6548 rc = -EACCES; 6549 goto err_out; 6550 } 6551 6552 if (!has_file_id(id)) { 6553 id = req->VolatileFileId; 6554 pid = req->PersistentFileId; 6555 } 6556 6557 fp = ksmbd_lookup_fd_slow(work, id, pid); 6558 if (!fp) { 6559 ksmbd_debug(SMB, "Invalid id for close: %u\n", id); 6560 rc = -ENOENT; 6561 goto err_out; 6562 } 6563 6564 switch (req->InfoType) { 6565 case SMB2_O_INFO_FILE: 6566 ksmbd_debug(SMB, "GOT SMB2_O_INFO_FILE\n"); 6567 rc = smb2_set_info_file(work, fp, req, work->tcon->share_conf); 6568 break; 6569 case SMB2_O_INFO_SECURITY: 6570 ksmbd_debug(SMB, "GOT SMB2_O_INFO_SECURITY\n"); 6571 if (ksmbd_override_fsids(work)) { 6572 rc = -ENOMEM; 6573 goto err_out; 6574 } 6575 rc = smb2_set_info_sec(fp, 6576 le32_to_cpu(req->AdditionalInformation), 6577 (char *)req + le16_to_cpu(req->BufferOffset), 6578 le32_to_cpu(req->BufferLength)); 6579 ksmbd_revert_fsids(work); 6580 break; 6581 default: 6582 rc = -EOPNOTSUPP; 6583 } 6584 6585 if (rc < 0) 6586 goto err_out; 6587 6588 rsp->StructureSize = cpu_to_le16(2); 6589 rc = ksmbd_iov_pin_rsp(work, (void *)rsp, 6590 sizeof(struct smb2_set_info_rsp)); 6591 if (rc) 6592 goto err_out; 6593 ksmbd_fd_put(work, fp); 6594 return 0; 6595 6596 err_out: 6597 if (rc == -EACCES || rc == -EPERM || rc == -EXDEV) 6598 rsp->hdr.Status = STATUS_ACCESS_DENIED; 6599 else if (rc == -EINVAL) 6600 rsp->hdr.Status = STATUS_INVALID_PARAMETER; 6601 else if (rc == -EMSGSIZE) 6602 rsp->hdr.Status = STATUS_INFO_LENGTH_MISMATCH; 6603 else if (rc == -ESHARE) 6604 rsp->hdr.Status = STATUS_SHARING_VIOLATION; 6605 else if (rc == -ENOENT) 6606 rsp->hdr.Status = STATUS_OBJECT_NAME_INVALID; 6607 else if (rc == -EBUSY || rc == -ENOTEMPTY) 6608 rsp->hdr.Status = STATUS_DIRECTORY_NOT_EMPTY; 6609 else if (rc == -EAGAIN) 6610 rsp->hdr.Status = STATUS_FILE_LOCK_CONFLICT; 6611 else if (rc == -EBADF || rc == -ESTALE) 6612 rsp->hdr.Status = STATUS_INVALID_HANDLE; 6613 else if (rc == -EEXIST) 6614 rsp->hdr.Status = STATUS_OBJECT_NAME_COLLISION; 6615 else if (rsp->hdr.Status == 0 || rc == -EOPNOTSUPP) 6616 rsp->hdr.Status = STATUS_INVALID_INFO_CLASS; 6617 smb2_set_err_rsp(work); 6618 ksmbd_fd_put(work, fp); 6619 ksmbd_debug(SMB, "error while processing smb2 query rc = %d\n", rc); 6620 return rc; 6621 } 6622 6623 /** 6624 * smb2_read_pipe() - handler for smb2 read from IPC pipe 6625 * @work: smb work containing read IPC pipe command buffer 6626 * 6627 * Return: 0 on success, otherwise error 6628 */ 6629 static noinline int smb2_read_pipe(struct ksmbd_work *work) 6630 { 6631 int nbytes = 0, err; 6632 u64 id; 6633 struct ksmbd_rpc_command *rpc_resp; 6634 struct smb2_read_req *req; 6635 struct smb2_read_rsp *rsp; 6636 6637 WORK_BUFFERS(work, req, rsp); 6638 6639 id = req->VolatileFileId; 6640 6641 rpc_resp = ksmbd_rpc_read(work->sess, id); 6642 if (rpc_resp) { 6643 void *aux_payload_buf; 6644 6645 if (rpc_resp->flags != KSMBD_RPC_OK) { 6646 err = -EINVAL; 6647 goto out; 6648 } 6649 6650 aux_payload_buf = 6651 kvmalloc(rpc_resp->payload_sz, KSMBD_DEFAULT_GFP); 6652 if (!aux_payload_buf) { 6653 err = -ENOMEM; 6654 goto out; 6655 } 6656 6657 memcpy(aux_payload_buf, rpc_resp->payload, rpc_resp->payload_sz); 6658 6659 nbytes = rpc_resp->payload_sz; 6660 err = ksmbd_iov_pin_rsp_read(work, (void *)rsp, 6661 offsetof(struct smb2_read_rsp, Buffer), 6662 aux_payload_buf, nbytes); 6663 if (err) { 6664 kvfree(aux_payload_buf); 6665 goto out; 6666 } 6667 kvfree(rpc_resp); 6668 } else { 6669 err = ksmbd_iov_pin_rsp(work, (void *)rsp, 6670 offsetof(struct smb2_read_rsp, Buffer)); 6671 if (err) 6672 goto out; 6673 } 6674 6675 rsp->StructureSize = cpu_to_le16(17); 6676 rsp->DataOffset = 80; 6677 rsp->Reserved = 0; 6678 rsp->DataLength = cpu_to_le32(nbytes); 6679 rsp->DataRemaining = 0; 6680 rsp->Flags = 0; 6681 return 0; 6682 6683 out: 6684 rsp->hdr.Status = STATUS_UNEXPECTED_IO_ERROR; 6685 smb2_set_err_rsp(work); 6686 kvfree(rpc_resp); 6687 return err; 6688 } 6689 6690 static int smb2_set_remote_key_for_rdma(struct ksmbd_work *work, 6691 struct smbdirect_buffer_descriptor_v1 *desc, 6692 __le32 Channel, 6693 __le16 ChannelInfoLength) 6694 { 6695 unsigned int i, ch_count; 6696 6697 if (work->conn->dialect == SMB30_PROT_ID && 6698 Channel != SMB2_CHANNEL_RDMA_V1) 6699 return -EINVAL; 6700 6701 ch_count = le16_to_cpu(ChannelInfoLength) / sizeof(*desc); 6702 if (ksmbd_debug_types & KSMBD_DEBUG_RDMA) { 6703 for (i = 0; i < ch_count; i++) { 6704 pr_info("RDMA r/w request %#x: token %#x, length %#x\n", 6705 i, 6706 le32_to_cpu(desc[i].token), 6707 le32_to_cpu(desc[i].length)); 6708 } 6709 } 6710 if (!ch_count) 6711 return -EINVAL; 6712 6713 work->need_invalidate_rkey = 6714 (Channel == SMB2_CHANNEL_RDMA_V1_INVALIDATE); 6715 if (Channel == SMB2_CHANNEL_RDMA_V1_INVALIDATE) 6716 work->remote_key = le32_to_cpu(desc->token); 6717 return 0; 6718 } 6719 6720 static ssize_t smb2_read_rdma_channel(struct ksmbd_work *work, 6721 struct smb2_read_req *req, void *data_buf, 6722 size_t length) 6723 { 6724 int err; 6725 6726 err = ksmbd_conn_rdma_write(work->conn, data_buf, length, 6727 (struct smbdirect_buffer_descriptor_v1 *) 6728 ((char *)req + le16_to_cpu(req->ReadChannelInfoOffset)), 6729 le16_to_cpu(req->ReadChannelInfoLength)); 6730 if (err) 6731 return err; 6732 6733 return length; 6734 } 6735 6736 /** 6737 * smb2_read() - handler for smb2 read from file 6738 * @work: smb work containing read command buffer 6739 * 6740 * Return: 0 on success, otherwise error 6741 */ 6742 int smb2_read(struct ksmbd_work *work) 6743 { 6744 struct ksmbd_conn *conn = work->conn; 6745 struct smb2_read_req *req; 6746 struct smb2_read_rsp *rsp; 6747 struct ksmbd_file *fp = NULL; 6748 loff_t offset; 6749 size_t length, mincount; 6750 ssize_t nbytes = 0, remain_bytes = 0; 6751 int err = 0; 6752 bool is_rdma_channel = false; 6753 unsigned int max_read_size = conn->vals->max_read_size; 6754 unsigned int id = KSMBD_NO_FID, pid = KSMBD_NO_FID; 6755 void *aux_payload_buf; 6756 6757 ksmbd_debug(SMB, "Received smb2 read request\n"); 6758 6759 if (test_share_config_flag(work->tcon->share_conf, 6760 KSMBD_SHARE_FLAG_PIPE)) { 6761 ksmbd_debug(SMB, "IPC pipe read request\n"); 6762 return smb2_read_pipe(work); 6763 } 6764 6765 if (work->next_smb2_rcv_hdr_off) { 6766 req = ksmbd_req_buf_next(work); 6767 rsp = ksmbd_resp_buf_next(work); 6768 if (!has_file_id(req->VolatileFileId)) { 6769 ksmbd_debug(SMB, "Compound request set FID = %llu\n", 6770 work->compound_fid); 6771 id = work->compound_fid; 6772 pid = work->compound_pfid; 6773 } 6774 } else { 6775 req = smb_get_msg(work->request_buf); 6776 rsp = smb_get_msg(work->response_buf); 6777 } 6778 6779 if (!has_file_id(id)) { 6780 id = req->VolatileFileId; 6781 pid = req->PersistentFileId; 6782 } 6783 6784 if (req->Channel == SMB2_CHANNEL_RDMA_V1_INVALIDATE || 6785 req->Channel == SMB2_CHANNEL_RDMA_V1) { 6786 is_rdma_channel = true; 6787 max_read_size = get_smbd_max_read_write_size(work->conn->transport); 6788 if (max_read_size == 0) { 6789 err = -EINVAL; 6790 goto out; 6791 } 6792 } 6793 6794 if (is_rdma_channel == true) { 6795 unsigned int ch_offset = le16_to_cpu(req->ReadChannelInfoOffset); 6796 6797 if (ch_offset < offsetof(struct smb2_read_req, Buffer)) { 6798 err = -EINVAL; 6799 goto out; 6800 } 6801 err = smb2_set_remote_key_for_rdma(work, 6802 (struct smbdirect_buffer_descriptor_v1 *) 6803 ((char *)req + ch_offset), 6804 req->Channel, 6805 req->ReadChannelInfoLength); 6806 if (err) 6807 goto out; 6808 } 6809 6810 fp = ksmbd_lookup_fd_slow(work, id, pid); 6811 if (!fp) { 6812 err = -ENOENT; 6813 goto out; 6814 } 6815 6816 if (!(fp->daccess & (FILE_READ_DATA_LE | FILE_READ_ATTRIBUTES_LE))) { 6817 pr_err("Not permitted to read : 0x%x\n", fp->daccess); 6818 err = -EACCES; 6819 goto out; 6820 } 6821 6822 offset = le64_to_cpu(req->Offset); 6823 if (offset < 0) { 6824 err = -EINVAL; 6825 goto out; 6826 } 6827 length = le32_to_cpu(req->Length); 6828 mincount = le32_to_cpu(req->MinimumCount); 6829 6830 if (length > max_read_size) { 6831 ksmbd_debug(SMB, "limiting read size to max size(%u)\n", 6832 max_read_size); 6833 err = -EINVAL; 6834 goto out; 6835 } 6836 6837 ksmbd_debug(SMB, "filename %pD, offset %lld, len %zu\n", 6838 fp->filp, offset, length); 6839 6840 aux_payload_buf = kvzalloc(ALIGN(length, 8), KSMBD_DEFAULT_GFP); 6841 if (!aux_payload_buf) { 6842 err = -ENOMEM; 6843 goto out; 6844 } 6845 6846 nbytes = ksmbd_vfs_read(work, fp, length, &offset, aux_payload_buf); 6847 if (nbytes < 0) { 6848 kvfree(aux_payload_buf); 6849 err = nbytes; 6850 goto out; 6851 } 6852 6853 if ((nbytes == 0 && length != 0) || nbytes < mincount) { 6854 kvfree(aux_payload_buf); 6855 rsp->hdr.Status = STATUS_END_OF_FILE; 6856 smb2_set_err_rsp(work); 6857 ksmbd_fd_put(work, fp); 6858 return -ENODATA; 6859 } 6860 6861 ksmbd_debug(SMB, "nbytes %zu, offset %lld mincount %zu\n", 6862 nbytes, offset, mincount); 6863 6864 if (is_rdma_channel == true) { 6865 /* write data to the client using rdma channel */ 6866 remain_bytes = smb2_read_rdma_channel(work, req, 6867 aux_payload_buf, 6868 nbytes); 6869 kvfree(aux_payload_buf); 6870 aux_payload_buf = NULL; 6871 nbytes = 0; 6872 if (remain_bytes < 0) { 6873 err = (int)remain_bytes; 6874 goto out; 6875 } 6876 } 6877 6878 rsp->StructureSize = cpu_to_le16(17); 6879 rsp->DataOffset = 80; 6880 rsp->Reserved = 0; 6881 rsp->DataLength = cpu_to_le32(nbytes); 6882 rsp->DataRemaining = cpu_to_le32(remain_bytes); 6883 rsp->Flags = 0; 6884 err = ksmbd_iov_pin_rsp_read(work, (void *)rsp, 6885 offsetof(struct smb2_read_rsp, Buffer), 6886 aux_payload_buf, nbytes); 6887 if (err) { 6888 kvfree(aux_payload_buf); 6889 goto out; 6890 } 6891 ksmbd_fd_put(work, fp); 6892 return 0; 6893 6894 out: 6895 if (err) { 6896 if (err == -EISDIR) 6897 rsp->hdr.Status = STATUS_INVALID_DEVICE_REQUEST; 6898 else if (err == -EAGAIN) 6899 rsp->hdr.Status = STATUS_FILE_LOCK_CONFLICT; 6900 else if (err == -ENOENT) 6901 rsp->hdr.Status = STATUS_FILE_CLOSED; 6902 else if (err == -EACCES) 6903 rsp->hdr.Status = STATUS_ACCESS_DENIED; 6904 else if (err == -ESHARE) 6905 rsp->hdr.Status = STATUS_SHARING_VIOLATION; 6906 else if (err == -EINVAL) 6907 rsp->hdr.Status = STATUS_INVALID_PARAMETER; 6908 else 6909 rsp->hdr.Status = STATUS_INVALID_HANDLE; 6910 6911 smb2_set_err_rsp(work); 6912 } 6913 ksmbd_fd_put(work, fp); 6914 return err; 6915 } 6916 6917 /** 6918 * smb2_write_pipe() - handler for smb2 write on IPC pipe 6919 * @work: smb work containing write IPC pipe command buffer 6920 * 6921 * Return: 0 on success, otherwise error 6922 */ 6923 static noinline int smb2_write_pipe(struct ksmbd_work *work) 6924 { 6925 struct smb2_write_req *req; 6926 struct smb2_write_rsp *rsp; 6927 struct ksmbd_rpc_command *rpc_resp; 6928 u64 id = 0; 6929 int err = 0, ret = 0; 6930 char *data_buf; 6931 size_t length; 6932 6933 WORK_BUFFERS(work, req, rsp); 6934 6935 length = le32_to_cpu(req->Length); 6936 id = req->VolatileFileId; 6937 6938 if ((u64)le16_to_cpu(req->DataOffset) + length > 6939 get_rfc1002_len(work->request_buf)) { 6940 pr_err("invalid write data offset %u, smb_len %u\n", 6941 le16_to_cpu(req->DataOffset), 6942 get_rfc1002_len(work->request_buf)); 6943 err = -EINVAL; 6944 goto out; 6945 } 6946 6947 data_buf = (char *)(((char *)&req->hdr.ProtocolId) + 6948 le16_to_cpu(req->DataOffset)); 6949 6950 rpc_resp = ksmbd_rpc_write(work->sess, id, data_buf, length); 6951 if (rpc_resp) { 6952 if (rpc_resp->flags == KSMBD_RPC_ENOTIMPLEMENTED) { 6953 rsp->hdr.Status = STATUS_NOT_SUPPORTED; 6954 kvfree(rpc_resp); 6955 smb2_set_err_rsp(work); 6956 return -EOPNOTSUPP; 6957 } 6958 if (rpc_resp->flags != KSMBD_RPC_OK) { 6959 rsp->hdr.Status = STATUS_INVALID_HANDLE; 6960 smb2_set_err_rsp(work); 6961 kvfree(rpc_resp); 6962 return ret; 6963 } 6964 kvfree(rpc_resp); 6965 } 6966 6967 rsp->StructureSize = cpu_to_le16(17); 6968 rsp->DataOffset = 0; 6969 rsp->Reserved = 0; 6970 rsp->DataLength = cpu_to_le32(length); 6971 rsp->DataRemaining = 0; 6972 rsp->Reserved2 = 0; 6973 err = ksmbd_iov_pin_rsp(work, (void *)rsp, 6974 offsetof(struct smb2_write_rsp, Buffer)); 6975 out: 6976 if (err) { 6977 rsp->hdr.Status = STATUS_INVALID_HANDLE; 6978 smb2_set_err_rsp(work); 6979 } 6980 6981 return err; 6982 } 6983 6984 static ssize_t smb2_write_rdma_channel(struct ksmbd_work *work, 6985 struct smb2_write_req *req, 6986 struct ksmbd_file *fp, 6987 loff_t offset, size_t length, bool sync) 6988 { 6989 char *data_buf; 6990 int ret; 6991 ssize_t nbytes; 6992 6993 data_buf = kvzalloc(length, KSMBD_DEFAULT_GFP); 6994 if (!data_buf) 6995 return -ENOMEM; 6996 6997 ret = ksmbd_conn_rdma_read(work->conn, data_buf, length, 6998 (struct smbdirect_buffer_descriptor_v1 *) 6999 ((char *)req + le16_to_cpu(req->WriteChannelInfoOffset)), 7000 le16_to_cpu(req->WriteChannelInfoLength)); 7001 if (ret < 0) { 7002 kvfree(data_buf); 7003 return ret; 7004 } 7005 7006 ret = ksmbd_vfs_write(work, fp, data_buf, length, &offset, sync, &nbytes); 7007 kvfree(data_buf); 7008 if (ret < 0) 7009 return ret; 7010 7011 return nbytes; 7012 } 7013 7014 /** 7015 * smb2_write() - handler for smb2 write from file 7016 * @work: smb work containing write command buffer 7017 * 7018 * Return: 0 on success, otherwise error 7019 */ 7020 int smb2_write(struct ksmbd_work *work) 7021 { 7022 struct smb2_write_req *req; 7023 struct smb2_write_rsp *rsp; 7024 struct ksmbd_file *fp = NULL; 7025 loff_t offset; 7026 size_t length; 7027 ssize_t nbytes; 7028 char *data_buf; 7029 bool writethrough = false, is_rdma_channel = false; 7030 int err = 0; 7031 unsigned int max_write_size = work->conn->vals->max_write_size; 7032 7033 ksmbd_debug(SMB, "Received smb2 write request\n"); 7034 7035 WORK_BUFFERS(work, req, rsp); 7036 7037 if (test_share_config_flag(work->tcon->share_conf, KSMBD_SHARE_FLAG_PIPE)) { 7038 ksmbd_debug(SMB, "IPC pipe write request\n"); 7039 return smb2_write_pipe(work); 7040 } 7041 7042 offset = le64_to_cpu(req->Offset); 7043 if (offset < 0) 7044 return -EINVAL; 7045 length = le32_to_cpu(req->Length); 7046 7047 if (req->Channel == SMB2_CHANNEL_RDMA_V1 || 7048 req->Channel == SMB2_CHANNEL_RDMA_V1_INVALIDATE) { 7049 is_rdma_channel = true; 7050 max_write_size = get_smbd_max_read_write_size(work->conn->transport); 7051 if (max_write_size == 0) { 7052 err = -EINVAL; 7053 goto out; 7054 } 7055 length = le32_to_cpu(req->RemainingBytes); 7056 } 7057 7058 if (is_rdma_channel == true) { 7059 unsigned int ch_offset = le16_to_cpu(req->WriteChannelInfoOffset); 7060 7061 if (req->Length != 0 || req->DataOffset != 0 || 7062 ch_offset < offsetof(struct smb2_write_req, Buffer)) { 7063 err = -EINVAL; 7064 goto out; 7065 } 7066 err = smb2_set_remote_key_for_rdma(work, 7067 (struct smbdirect_buffer_descriptor_v1 *) 7068 ((char *)req + ch_offset), 7069 req->Channel, 7070 req->WriteChannelInfoLength); 7071 if (err) 7072 goto out; 7073 } 7074 7075 if (!test_tree_conn_flag(work->tcon, KSMBD_TREE_CONN_FLAG_WRITABLE)) { 7076 ksmbd_debug(SMB, "User does not have write permission\n"); 7077 err = -EACCES; 7078 goto out; 7079 } 7080 7081 fp = ksmbd_lookup_fd_slow(work, req->VolatileFileId, req->PersistentFileId); 7082 if (!fp) { 7083 err = -ENOENT; 7084 goto out; 7085 } 7086 7087 if (!(fp->daccess & (FILE_WRITE_DATA_LE | FILE_READ_ATTRIBUTES_LE))) { 7088 pr_err("Not permitted to write : 0x%x\n", fp->daccess); 7089 err = -EACCES; 7090 goto out; 7091 } 7092 7093 if (length > max_write_size) { 7094 ksmbd_debug(SMB, "limiting write size to max size(%u)\n", 7095 max_write_size); 7096 err = -EINVAL; 7097 goto out; 7098 } 7099 7100 ksmbd_debug(SMB, "flags %u\n", le32_to_cpu(req->Flags)); 7101 if (le32_to_cpu(req->Flags) & SMB2_WRITEFLAG_WRITE_THROUGH) 7102 writethrough = true; 7103 7104 if (is_rdma_channel == false) { 7105 if (le16_to_cpu(req->DataOffset) < 7106 offsetof(struct smb2_write_req, Buffer)) { 7107 err = -EINVAL; 7108 goto out; 7109 } 7110 7111 data_buf = (char *)(((char *)&req->hdr.ProtocolId) + 7112 le16_to_cpu(req->DataOffset)); 7113 7114 ksmbd_debug(SMB, "filename %pD, offset %lld, len %zu\n", 7115 fp->filp, offset, length); 7116 err = ksmbd_vfs_write(work, fp, data_buf, length, &offset, 7117 writethrough, &nbytes); 7118 if (err < 0) 7119 goto out; 7120 } else { 7121 /* read data from the client using rdma channel, and 7122 * write the data. 7123 */ 7124 nbytes = smb2_write_rdma_channel(work, req, fp, offset, length, 7125 writethrough); 7126 if (nbytes < 0) { 7127 err = (int)nbytes; 7128 goto out; 7129 } 7130 } 7131 7132 rsp->StructureSize = cpu_to_le16(17); 7133 rsp->DataOffset = 0; 7134 rsp->Reserved = 0; 7135 rsp->DataLength = cpu_to_le32(nbytes); 7136 rsp->DataRemaining = 0; 7137 rsp->Reserved2 = 0; 7138 err = ksmbd_iov_pin_rsp(work, rsp, offsetof(struct smb2_write_rsp, Buffer)); 7139 if (err) 7140 goto out; 7141 ksmbd_fd_put(work, fp); 7142 return 0; 7143 7144 out: 7145 if (err == -EAGAIN) 7146 rsp->hdr.Status = STATUS_FILE_LOCK_CONFLICT; 7147 else if (err == -ENOSPC || err == -EFBIG) 7148 rsp->hdr.Status = STATUS_DISK_FULL; 7149 else if (err == -ENOENT) 7150 rsp->hdr.Status = STATUS_FILE_CLOSED; 7151 else if (err == -EACCES) 7152 rsp->hdr.Status = STATUS_ACCESS_DENIED; 7153 else if (err == -ESHARE) 7154 rsp->hdr.Status = STATUS_SHARING_VIOLATION; 7155 else if (err == -EINVAL) 7156 rsp->hdr.Status = STATUS_INVALID_PARAMETER; 7157 else 7158 rsp->hdr.Status = STATUS_INVALID_HANDLE; 7159 7160 smb2_set_err_rsp(work); 7161 ksmbd_fd_put(work, fp); 7162 return err; 7163 } 7164 7165 /** 7166 * smb2_flush() - handler for smb2 flush file - fsync 7167 * @work: smb work containing flush command buffer 7168 * 7169 * Return: 0 on success, otherwise error 7170 */ 7171 int smb2_flush(struct ksmbd_work *work) 7172 { 7173 struct smb2_flush_req *req; 7174 struct smb2_flush_rsp *rsp; 7175 int err; 7176 7177 WORK_BUFFERS(work, req, rsp); 7178 7179 ksmbd_debug(SMB, "Received smb2 flush request(fid : %llu)\n", req->VolatileFileId); 7180 7181 err = ksmbd_vfs_fsync(work, req->VolatileFileId, req->PersistentFileId); 7182 if (err) 7183 goto out; 7184 7185 rsp->StructureSize = cpu_to_le16(4); 7186 rsp->Reserved = 0; 7187 return ksmbd_iov_pin_rsp(work, rsp, sizeof(struct smb2_flush_rsp)); 7188 7189 out: 7190 rsp->hdr.Status = STATUS_INVALID_HANDLE; 7191 smb2_set_err_rsp(work); 7192 return err; 7193 } 7194 7195 /** 7196 * smb2_cancel() - handler for smb2 cancel command 7197 * @work: smb work containing cancel command buffer 7198 * 7199 * Return: 0 on success, otherwise error 7200 */ 7201 int smb2_cancel(struct ksmbd_work *work) 7202 { 7203 struct ksmbd_conn *conn = work->conn; 7204 struct smb2_hdr *hdr = smb_get_msg(work->request_buf); 7205 struct smb2_hdr *chdr; 7206 struct ksmbd_work *iter; 7207 struct list_head *command_list; 7208 7209 if (work->next_smb2_rcv_hdr_off) 7210 hdr = ksmbd_resp_buf_next(work); 7211 7212 ksmbd_debug(SMB, "smb2 cancel called on mid %llu, async flags 0x%x\n", 7213 hdr->MessageId, hdr->Flags); 7214 7215 if (hdr->Flags & SMB2_FLAGS_ASYNC_COMMAND) { 7216 command_list = &conn->async_requests; 7217 7218 spin_lock(&conn->request_lock); 7219 list_for_each_entry(iter, command_list, 7220 async_request_entry) { 7221 chdr = smb_get_msg(iter->request_buf); 7222 7223 if (iter->async_id != 7224 le64_to_cpu(hdr->Id.AsyncId)) 7225 continue; 7226 7227 ksmbd_debug(SMB, 7228 "smb2 with AsyncId %llu cancelled command = 0x%x\n", 7229 le64_to_cpu(hdr->Id.AsyncId), 7230 le16_to_cpu(chdr->Command)); 7231 iter->state = KSMBD_WORK_CANCELLED; 7232 if (iter->cancel_fn) 7233 iter->cancel_fn(iter->cancel_argv); 7234 break; 7235 } 7236 spin_unlock(&conn->request_lock); 7237 } else { 7238 command_list = &conn->requests; 7239 7240 spin_lock(&conn->request_lock); 7241 list_for_each_entry(iter, command_list, request_entry) { 7242 chdr = smb_get_msg(iter->request_buf); 7243 7244 if (chdr->MessageId != hdr->MessageId || 7245 iter == work) 7246 continue; 7247 7248 ksmbd_debug(SMB, 7249 "smb2 with mid %llu cancelled command = 0x%x\n", 7250 le64_to_cpu(hdr->MessageId), 7251 le16_to_cpu(chdr->Command)); 7252 iter->state = KSMBD_WORK_CANCELLED; 7253 break; 7254 } 7255 spin_unlock(&conn->request_lock); 7256 } 7257 7258 /* For SMB2_CANCEL command itself send no response*/ 7259 work->send_no_response = 1; 7260 return 0; 7261 } 7262 7263 struct file_lock *smb_flock_init(struct file *f) 7264 { 7265 struct file_lock *fl; 7266 7267 fl = locks_alloc_lock(); 7268 if (!fl) 7269 goto out; 7270 7271 locks_init_lock(fl); 7272 7273 fl->c.flc_owner = f; 7274 fl->c.flc_pid = current->tgid; 7275 fl->c.flc_file = f; 7276 fl->c.flc_flags = FL_POSIX; 7277 fl->fl_ops = NULL; 7278 fl->fl_lmops = NULL; 7279 7280 out: 7281 return fl; 7282 } 7283 7284 static int smb2_set_flock_flags(struct file_lock *flock, int flags) 7285 { 7286 int cmd = -EINVAL; 7287 7288 /* Checking for wrong flag combination during lock request*/ 7289 switch (flags) { 7290 case SMB2_LOCKFLAG_SHARED: 7291 ksmbd_debug(SMB, "received shared request\n"); 7292 cmd = F_SETLKW; 7293 flock->c.flc_type = F_RDLCK; 7294 flock->c.flc_flags |= FL_SLEEP; 7295 break; 7296 case SMB2_LOCKFLAG_EXCLUSIVE: 7297 ksmbd_debug(SMB, "received exclusive request\n"); 7298 cmd = F_SETLKW; 7299 flock->c.flc_type = F_WRLCK; 7300 flock->c.flc_flags |= FL_SLEEP; 7301 break; 7302 case SMB2_LOCKFLAG_SHARED | SMB2_LOCKFLAG_FAIL_IMMEDIATELY: 7303 ksmbd_debug(SMB, 7304 "received shared & fail immediately request\n"); 7305 cmd = F_SETLK; 7306 flock->c.flc_type = F_RDLCK; 7307 break; 7308 case SMB2_LOCKFLAG_EXCLUSIVE | SMB2_LOCKFLAG_FAIL_IMMEDIATELY: 7309 ksmbd_debug(SMB, 7310 "received exclusive & fail immediately request\n"); 7311 cmd = F_SETLK; 7312 flock->c.flc_type = F_WRLCK; 7313 break; 7314 case SMB2_LOCKFLAG_UNLOCK: 7315 ksmbd_debug(SMB, "received unlock request\n"); 7316 flock->c.flc_type = F_UNLCK; 7317 cmd = F_SETLK; 7318 break; 7319 } 7320 7321 return cmd; 7322 } 7323 7324 static struct ksmbd_lock *smb2_lock_init(struct file_lock *flock, 7325 unsigned int cmd, int flags, 7326 struct list_head *lock_list) 7327 { 7328 struct ksmbd_lock *lock; 7329 7330 lock = kzalloc_obj(struct ksmbd_lock, KSMBD_DEFAULT_GFP); 7331 if (!lock) 7332 return NULL; 7333 7334 lock->cmd = cmd; 7335 lock->fl = flock; 7336 lock->start = flock->fl_start; 7337 lock->end = flock->fl_end; 7338 lock->flags = flags; 7339 if (lock->start == lock->end) 7340 lock->zero_len = 1; 7341 INIT_LIST_HEAD(&lock->clist); 7342 INIT_LIST_HEAD(&lock->flist); 7343 INIT_LIST_HEAD(&lock->llist); 7344 list_add_tail(&lock->llist, lock_list); 7345 7346 return lock; 7347 } 7348 7349 static void smb2_remove_blocked_lock(void **argv) 7350 { 7351 struct file_lock *flock = (struct file_lock *)argv[0]; 7352 7353 ksmbd_vfs_posix_lock_unblock(flock); 7354 locks_wake_up(flock); 7355 } 7356 7357 static inline bool lock_defer_pending(struct file_lock *fl) 7358 { 7359 /* check pending lock waiters */ 7360 return waitqueue_active(&fl->c.flc_wait); 7361 } 7362 7363 /** 7364 * smb2_lock() - handler for smb2 file lock command 7365 * @work: smb work containing lock command buffer 7366 * 7367 * Return: 0 on success, otherwise error 7368 */ 7369 int smb2_lock(struct ksmbd_work *work) 7370 { 7371 struct smb2_lock_req *req; 7372 struct smb2_lock_rsp *rsp; 7373 struct smb2_lock_element *lock_ele; 7374 struct ksmbd_file *fp = NULL; 7375 struct file_lock *flock = NULL; 7376 struct file *filp = NULL; 7377 int lock_count; 7378 int flags = 0; 7379 int cmd = 0; 7380 int err = -EIO, i, rc = 0; 7381 u64 lock_start, lock_length; 7382 struct ksmbd_lock *smb_lock = NULL, *cmp_lock, *tmp, *tmp2; 7383 struct ksmbd_conn *conn; 7384 int nolock = 0; 7385 LIST_HEAD(lock_list); 7386 LIST_HEAD(rollback_list); 7387 int prior_lock = 0, bkt; 7388 7389 WORK_BUFFERS(work, req, rsp); 7390 7391 ksmbd_debug(SMB, "Received smb2 lock request\n"); 7392 fp = ksmbd_lookup_fd_slow(work, req->VolatileFileId, req->PersistentFileId); 7393 if (!fp) { 7394 ksmbd_debug(SMB, "Invalid file id for lock : %llu\n", req->VolatileFileId); 7395 err = -ENOENT; 7396 goto out2; 7397 } 7398 7399 filp = fp->filp; 7400 lock_count = le16_to_cpu(req->LockCount); 7401 lock_ele = req->locks; 7402 7403 ksmbd_debug(SMB, "lock count is %d\n", lock_count); 7404 if (!lock_count) { 7405 err = -EINVAL; 7406 goto out2; 7407 } 7408 7409 for (i = 0; i < lock_count; i++) { 7410 flags = le32_to_cpu(lock_ele[i].Flags); 7411 7412 flock = smb_flock_init(filp); 7413 if (!flock) 7414 goto out; 7415 7416 cmd = smb2_set_flock_flags(flock, flags); 7417 7418 lock_start = le64_to_cpu(lock_ele[i].Offset); 7419 lock_length = le64_to_cpu(lock_ele[i].Length); 7420 if (lock_start > U64_MAX - lock_length) { 7421 pr_err("Invalid lock range requested\n"); 7422 rsp->hdr.Status = STATUS_INVALID_LOCK_RANGE; 7423 locks_free_lock(flock); 7424 goto out; 7425 } 7426 7427 if (lock_start > OFFSET_MAX) 7428 flock->fl_start = OFFSET_MAX; 7429 else 7430 flock->fl_start = lock_start; 7431 7432 lock_length = le64_to_cpu(lock_ele[i].Length); 7433 if (lock_length > OFFSET_MAX - flock->fl_start) 7434 lock_length = OFFSET_MAX - flock->fl_start; 7435 7436 flock->fl_end = flock->fl_start + lock_length; 7437 7438 if (flock->fl_end < flock->fl_start) { 7439 ksmbd_debug(SMB, 7440 "the end offset(%llx) is smaller than the start offset(%llx)\n", 7441 flock->fl_end, flock->fl_start); 7442 rsp->hdr.Status = STATUS_INVALID_LOCK_RANGE; 7443 locks_free_lock(flock); 7444 goto out; 7445 } 7446 7447 /* Check conflict locks in one request */ 7448 list_for_each_entry(cmp_lock, &lock_list, llist) { 7449 if (cmp_lock->fl->fl_start <= flock->fl_start && 7450 cmp_lock->fl->fl_end >= flock->fl_end) { 7451 if (cmp_lock->fl->c.flc_type != F_UNLCK && 7452 flock->c.flc_type != F_UNLCK) { 7453 pr_err("conflict two locks in one request\n"); 7454 err = -EINVAL; 7455 locks_free_lock(flock); 7456 goto out; 7457 } 7458 } 7459 } 7460 7461 smb_lock = smb2_lock_init(flock, cmd, flags, &lock_list); 7462 if (!smb_lock) { 7463 err = -EINVAL; 7464 locks_free_lock(flock); 7465 goto out; 7466 } 7467 } 7468 7469 list_for_each_entry_safe(smb_lock, tmp, &lock_list, llist) { 7470 if (smb_lock->cmd < 0) { 7471 err = -EINVAL; 7472 goto out; 7473 } 7474 7475 if (!(smb_lock->flags & SMB2_LOCKFLAG_MASK)) { 7476 err = -EINVAL; 7477 goto out; 7478 } 7479 7480 if ((prior_lock & (SMB2_LOCKFLAG_EXCLUSIVE | SMB2_LOCKFLAG_SHARED) && 7481 smb_lock->flags & SMB2_LOCKFLAG_UNLOCK) || 7482 (prior_lock == SMB2_LOCKFLAG_UNLOCK && 7483 !(smb_lock->flags & SMB2_LOCKFLAG_UNLOCK))) { 7484 err = -EINVAL; 7485 goto out; 7486 } 7487 7488 prior_lock = smb_lock->flags; 7489 7490 if (!(smb_lock->flags & SMB2_LOCKFLAG_UNLOCK) && 7491 !(smb_lock->flags & SMB2_LOCKFLAG_FAIL_IMMEDIATELY)) 7492 goto no_check_cl; 7493 7494 nolock = 1; 7495 /* check locks in connection list */ 7496 down_read(&conn_list_lock); 7497 hash_for_each(conn_list, bkt, conn, hlist) { 7498 spin_lock(&conn->llist_lock); 7499 list_for_each_entry_safe(cmp_lock, tmp2, &conn->lock_list, clist) { 7500 if (file_inode(cmp_lock->fl->c.flc_file) != 7501 file_inode(smb_lock->fl->c.flc_file)) 7502 continue; 7503 7504 if (lock_is_unlock(smb_lock->fl)) { 7505 if (cmp_lock->fl->c.flc_file == smb_lock->fl->c.flc_file && 7506 cmp_lock->start == smb_lock->start && 7507 cmp_lock->end == smb_lock->end && 7508 !lock_defer_pending(cmp_lock->fl)) { 7509 nolock = 0; 7510 list_del(&cmp_lock->flist); 7511 list_del(&cmp_lock->clist); 7512 spin_unlock(&conn->llist_lock); 7513 up_read(&conn_list_lock); 7514 7515 locks_free_lock(cmp_lock->fl); 7516 kfree(cmp_lock); 7517 goto out_check_cl; 7518 } 7519 continue; 7520 } 7521 7522 if (cmp_lock->fl->c.flc_file == smb_lock->fl->c.flc_file) { 7523 if (smb_lock->flags & SMB2_LOCKFLAG_SHARED) 7524 continue; 7525 } else { 7526 if (cmp_lock->flags & SMB2_LOCKFLAG_SHARED) 7527 continue; 7528 } 7529 7530 /* check zero byte lock range */ 7531 if (cmp_lock->zero_len && !smb_lock->zero_len && 7532 cmp_lock->start > smb_lock->start && 7533 cmp_lock->start < smb_lock->end) { 7534 spin_unlock(&conn->llist_lock); 7535 up_read(&conn_list_lock); 7536 pr_err("previous lock conflict with zero byte lock range\n"); 7537 goto out; 7538 } 7539 7540 if (smb_lock->zero_len && !cmp_lock->zero_len && 7541 smb_lock->start > cmp_lock->start && 7542 smb_lock->start < cmp_lock->end) { 7543 spin_unlock(&conn->llist_lock); 7544 up_read(&conn_list_lock); 7545 pr_err("current lock conflict with zero byte lock range\n"); 7546 goto out; 7547 } 7548 7549 if (((cmp_lock->start <= smb_lock->start && 7550 cmp_lock->end > smb_lock->start) || 7551 (cmp_lock->start < smb_lock->end && 7552 cmp_lock->end >= smb_lock->end)) && 7553 !cmp_lock->zero_len && !smb_lock->zero_len) { 7554 spin_unlock(&conn->llist_lock); 7555 up_read(&conn_list_lock); 7556 pr_err("Not allow lock operation on exclusive lock range\n"); 7557 goto out; 7558 } 7559 } 7560 spin_unlock(&conn->llist_lock); 7561 } 7562 up_read(&conn_list_lock); 7563 out_check_cl: 7564 if (lock_is_unlock(smb_lock->fl) && nolock) { 7565 pr_err("Try to unlock nolocked range\n"); 7566 rsp->hdr.Status = STATUS_RANGE_NOT_LOCKED; 7567 goto out; 7568 } 7569 7570 no_check_cl: 7571 flock = smb_lock->fl; 7572 list_del(&smb_lock->llist); 7573 7574 if (smb_lock->zero_len) { 7575 err = 0; 7576 goto skip; 7577 } 7578 retry: 7579 rc = vfs_lock_file(filp, smb_lock->cmd, flock, NULL); 7580 skip: 7581 if (smb_lock->flags & SMB2_LOCKFLAG_UNLOCK) { 7582 if (!rc) { 7583 ksmbd_debug(SMB, "File unlocked\n"); 7584 } else if (rc == -ENOENT) { 7585 rsp->hdr.Status = STATUS_NOT_LOCKED; 7586 goto out; 7587 } 7588 locks_free_lock(flock); 7589 kfree(smb_lock); 7590 } else { 7591 if (rc == FILE_LOCK_DEFERRED) { 7592 void **argv; 7593 7594 ksmbd_debug(SMB, 7595 "would have to wait for getting lock\n"); 7596 list_add(&smb_lock->llist, &rollback_list); 7597 7598 argv = kmalloc(sizeof(void *), KSMBD_DEFAULT_GFP); 7599 if (!argv) { 7600 err = -ENOMEM; 7601 goto out; 7602 } 7603 argv[0] = flock; 7604 7605 rc = setup_async_work(work, 7606 smb2_remove_blocked_lock, 7607 argv); 7608 if (rc) { 7609 kfree(argv); 7610 err = -ENOMEM; 7611 goto out; 7612 } 7613 spin_lock(&fp->f_lock); 7614 list_add(&work->fp_entry, &fp->blocked_works); 7615 spin_unlock(&fp->f_lock); 7616 7617 smb2_send_interim_resp(work, STATUS_PENDING); 7618 7619 ksmbd_vfs_posix_lock_wait(flock); 7620 7621 spin_lock(&fp->f_lock); 7622 list_del(&work->fp_entry); 7623 spin_unlock(&fp->f_lock); 7624 7625 if (work->state != KSMBD_WORK_ACTIVE) { 7626 list_del(&smb_lock->llist); 7627 locks_free_lock(flock); 7628 7629 if (work->state == KSMBD_WORK_CANCELLED) { 7630 rsp->hdr.Status = 7631 STATUS_CANCELLED; 7632 kfree(smb_lock); 7633 smb2_send_interim_resp(work, 7634 STATUS_CANCELLED); 7635 work->send_no_response = 1; 7636 goto out; 7637 } 7638 7639 rsp->hdr.Status = 7640 STATUS_RANGE_NOT_LOCKED; 7641 kfree(smb_lock); 7642 goto out2; 7643 } 7644 7645 list_del(&smb_lock->llist); 7646 release_async_work(work); 7647 goto retry; 7648 } else if (!rc) { 7649 list_add(&smb_lock->llist, &rollback_list); 7650 spin_lock(&work->conn->llist_lock); 7651 list_add_tail(&smb_lock->clist, 7652 &work->conn->lock_list); 7653 list_add_tail(&smb_lock->flist, 7654 &fp->lock_list); 7655 spin_unlock(&work->conn->llist_lock); 7656 ksmbd_debug(SMB, "successful in taking lock\n"); 7657 } else { 7658 goto out; 7659 } 7660 } 7661 } 7662 7663 if (atomic_read(&fp->f_ci->op_count) > 1) 7664 smb_break_all_oplock(work, fp); 7665 7666 rsp->StructureSize = cpu_to_le16(4); 7667 ksmbd_debug(SMB, "successful in taking lock\n"); 7668 rsp->hdr.Status = STATUS_SUCCESS; 7669 rsp->Reserved = 0; 7670 err = ksmbd_iov_pin_rsp(work, rsp, sizeof(struct smb2_lock_rsp)); 7671 if (err) 7672 goto out; 7673 7674 ksmbd_fd_put(work, fp); 7675 return 0; 7676 7677 out: 7678 list_for_each_entry_safe(smb_lock, tmp, &lock_list, llist) { 7679 locks_free_lock(smb_lock->fl); 7680 list_del(&smb_lock->llist); 7681 kfree(smb_lock); 7682 } 7683 7684 list_for_each_entry_safe(smb_lock, tmp, &rollback_list, llist) { 7685 struct file_lock *rlock = NULL; 7686 7687 rlock = smb_flock_init(filp); 7688 rlock->c.flc_type = F_UNLCK; 7689 rlock->fl_start = smb_lock->start; 7690 rlock->fl_end = smb_lock->end; 7691 7692 rc = vfs_lock_file(filp, F_SETLK, rlock, NULL); 7693 if (rc) 7694 pr_err("rollback unlock fail : %d\n", rc); 7695 7696 list_del(&smb_lock->llist); 7697 spin_lock(&work->conn->llist_lock); 7698 if (!list_empty(&smb_lock->flist)) 7699 list_del(&smb_lock->flist); 7700 list_del(&smb_lock->clist); 7701 spin_unlock(&work->conn->llist_lock); 7702 7703 locks_free_lock(smb_lock->fl); 7704 locks_free_lock(rlock); 7705 kfree(smb_lock); 7706 } 7707 out2: 7708 ksmbd_debug(SMB, "failed in taking lock(flags : %x), err : %d\n", flags, err); 7709 7710 if (!rsp->hdr.Status) { 7711 if (err == -EINVAL) 7712 rsp->hdr.Status = STATUS_INVALID_PARAMETER; 7713 else if (err == -ENOMEM) 7714 rsp->hdr.Status = STATUS_INSUFFICIENT_RESOURCES; 7715 else if (err == -ENOENT) 7716 rsp->hdr.Status = STATUS_FILE_CLOSED; 7717 else 7718 rsp->hdr.Status = STATUS_LOCK_NOT_GRANTED; 7719 } 7720 7721 smb2_set_err_rsp(work); 7722 ksmbd_fd_put(work, fp); 7723 return err; 7724 } 7725 7726 static int fsctl_copychunk(struct ksmbd_work *work, 7727 struct copychunk_ioctl_req *ci_req, 7728 unsigned int cnt_code, 7729 unsigned int input_count, 7730 unsigned long long volatile_id, 7731 unsigned long long persistent_id, 7732 struct smb2_ioctl_rsp *rsp) 7733 { 7734 struct copychunk_ioctl_rsp *ci_rsp; 7735 struct ksmbd_file *src_fp = NULL, *dst_fp = NULL; 7736 struct srv_copychunk *chunks; 7737 unsigned int i, chunk_count, chunk_count_written = 0; 7738 unsigned int chunk_size_written = 0; 7739 loff_t total_size_written = 0; 7740 int ret = 0; 7741 7742 ci_rsp = (struct copychunk_ioctl_rsp *)&rsp->Buffer[0]; 7743 7744 rsp->VolatileFileId = volatile_id; 7745 rsp->PersistentFileId = persistent_id; 7746 ci_rsp->ChunksWritten = 7747 cpu_to_le32(ksmbd_server_side_copy_max_chunk_count()); 7748 ci_rsp->ChunkBytesWritten = 7749 cpu_to_le32(ksmbd_server_side_copy_max_chunk_size()); 7750 ci_rsp->TotalBytesWritten = 7751 cpu_to_le32(ksmbd_server_side_copy_max_total_size()); 7752 7753 chunk_count = le32_to_cpu(ci_req->ChunkCount); 7754 if (chunk_count == 0) 7755 goto out; 7756 total_size_written = 0; 7757 7758 /* verify the SRV_COPYCHUNK_COPY packet */ 7759 if (chunk_count > ksmbd_server_side_copy_max_chunk_count() || 7760 input_count < struct_size(ci_req, Chunks, chunk_count)) { 7761 rsp->hdr.Status = STATUS_INVALID_PARAMETER; 7762 return -EINVAL; 7763 } 7764 7765 chunks = &ci_req->Chunks[0]; 7766 for (i = 0; i < chunk_count; i++) { 7767 if (le32_to_cpu(chunks[i].Length) == 0 || 7768 le32_to_cpu(chunks[i].Length) > ksmbd_server_side_copy_max_chunk_size()) 7769 break; 7770 total_size_written += le32_to_cpu(chunks[i].Length); 7771 } 7772 7773 if (i < chunk_count || 7774 total_size_written > ksmbd_server_side_copy_max_total_size()) { 7775 rsp->hdr.Status = STATUS_INVALID_PARAMETER; 7776 return -EINVAL; 7777 } 7778 7779 src_fp = ksmbd_lookup_foreign_fd(work, 7780 le64_to_cpu(ci_req->SourceKeyU64[0])); 7781 dst_fp = ksmbd_lookup_fd_slow(work, volatile_id, persistent_id); 7782 ret = -EINVAL; 7783 if (!src_fp || 7784 src_fp->persistent_id != le64_to_cpu(ci_req->SourceKeyU64[1])) { 7785 rsp->hdr.Status = STATUS_OBJECT_NAME_NOT_FOUND; 7786 goto out; 7787 } 7788 7789 if (!dst_fp) { 7790 rsp->hdr.Status = STATUS_FILE_CLOSED; 7791 goto out; 7792 } 7793 7794 /* 7795 * FILE_READ_DATA should only be included in 7796 * the FSCTL_COPYCHUNK case 7797 */ 7798 if (cnt_code == FSCTL_COPYCHUNK && 7799 !(dst_fp->daccess & (FILE_READ_DATA_LE | FILE_GENERIC_READ_LE))) { 7800 rsp->hdr.Status = STATUS_ACCESS_DENIED; 7801 goto out; 7802 } 7803 7804 ret = ksmbd_vfs_copy_file_ranges(work, src_fp, dst_fp, 7805 chunks, chunk_count, 7806 &chunk_count_written, 7807 &chunk_size_written, 7808 &total_size_written); 7809 if (ret < 0) { 7810 if (ret == -EACCES) 7811 rsp->hdr.Status = STATUS_ACCESS_DENIED; 7812 if (ret == -EAGAIN) 7813 rsp->hdr.Status = STATUS_FILE_LOCK_CONFLICT; 7814 else if (ret == -EBADF) 7815 rsp->hdr.Status = STATUS_INVALID_HANDLE; 7816 else if (ret == -EFBIG || ret == -ENOSPC) 7817 rsp->hdr.Status = STATUS_DISK_FULL; 7818 else if (ret == -EINVAL) 7819 rsp->hdr.Status = STATUS_INVALID_PARAMETER; 7820 else if (ret == -EISDIR) 7821 rsp->hdr.Status = STATUS_FILE_IS_A_DIRECTORY; 7822 else if (ret == -E2BIG) 7823 rsp->hdr.Status = STATUS_INVALID_VIEW_SIZE; 7824 else 7825 rsp->hdr.Status = STATUS_UNEXPECTED_IO_ERROR; 7826 } 7827 7828 ci_rsp->ChunksWritten = cpu_to_le32(chunk_count_written); 7829 ci_rsp->ChunkBytesWritten = cpu_to_le32(chunk_size_written); 7830 ci_rsp->TotalBytesWritten = cpu_to_le32(total_size_written); 7831 out: 7832 ksmbd_fd_put(work, src_fp); 7833 ksmbd_fd_put(work, dst_fp); 7834 return ret; 7835 } 7836 7837 static __be32 idev_ipv4_address(struct in_device *idev) 7838 { 7839 __be32 addr = 0; 7840 7841 struct in_ifaddr *ifa; 7842 7843 rcu_read_lock(); 7844 in_dev_for_each_ifa_rcu(ifa, idev) { 7845 if (ifa->ifa_flags & IFA_F_SECONDARY) 7846 continue; 7847 7848 addr = ifa->ifa_address; 7849 break; 7850 } 7851 rcu_read_unlock(); 7852 return addr; 7853 } 7854 7855 static int fsctl_query_iface_info_ioctl(struct ksmbd_conn *conn, 7856 struct smb2_ioctl_rsp *rsp, 7857 unsigned int out_buf_len) 7858 { 7859 struct network_interface_info_ioctl_rsp *nii_rsp = NULL; 7860 int nbytes = 0; 7861 struct net_device *netdev; 7862 struct sockaddr_storage_rsp *sockaddr_storage; 7863 unsigned int flags; 7864 unsigned long long speed; 7865 7866 rtnl_lock(); 7867 for_each_netdev(&init_net, netdev) { 7868 bool ipv4_set = false; 7869 7870 if (netdev->type == ARPHRD_LOOPBACK) 7871 continue; 7872 7873 if (!ksmbd_find_netdev_name_iface_list(netdev->name)) 7874 continue; 7875 7876 flags = netif_get_flags(netdev); 7877 if (!(flags & IFF_RUNNING)) 7878 continue; 7879 ipv6_retry: 7880 if (out_buf_len < 7881 nbytes + sizeof(struct network_interface_info_ioctl_rsp)) { 7882 rtnl_unlock(); 7883 return -ENOSPC; 7884 } 7885 7886 nii_rsp = (struct network_interface_info_ioctl_rsp *) 7887 &rsp->Buffer[nbytes]; 7888 nii_rsp->IfIndex = cpu_to_le32(netdev->ifindex); 7889 7890 nii_rsp->Capability = 0; 7891 if (netdev->real_num_tx_queues > 1) 7892 nii_rsp->Capability |= RSS_CAPABLE; 7893 if (ksmbd_rdma_capable_netdev(netdev)) 7894 nii_rsp->Capability |= RDMA_CAPABLE; 7895 7896 nii_rsp->Next = cpu_to_le32(152); 7897 nii_rsp->Reserved = 0; 7898 7899 if (netdev->ethtool_ops->get_link_ksettings) { 7900 struct ethtool_link_ksettings cmd; 7901 7902 netdev->ethtool_ops->get_link_ksettings(netdev, &cmd); 7903 speed = cmd.base.speed; 7904 } else { 7905 ksmbd_debug(SMB, "%s %s\n", netdev->name, 7906 "speed is unknown, defaulting to 1Gb/sec"); 7907 speed = SPEED_1000; 7908 } 7909 7910 speed *= 1000000; 7911 nii_rsp->LinkSpeed = cpu_to_le64(speed); 7912 7913 sockaddr_storage = (struct sockaddr_storage_rsp *) 7914 nii_rsp->SockAddr_Storage; 7915 memset(sockaddr_storage, 0, 128); 7916 7917 if (!ipv4_set) { 7918 struct in_device *idev; 7919 7920 sockaddr_storage->Family = INTERNETWORK; 7921 sockaddr_storage->addr4.Port = 0; 7922 7923 idev = __in_dev_get_rtnl(netdev); 7924 if (!idev) 7925 continue; 7926 sockaddr_storage->addr4.IPv4Address = 7927 idev_ipv4_address(idev); 7928 nbytes += sizeof(struct network_interface_info_ioctl_rsp); 7929 ipv4_set = true; 7930 goto ipv6_retry; 7931 } else { 7932 struct inet6_dev *idev6; 7933 struct inet6_ifaddr *ifa; 7934 __u8 *ipv6_addr = sockaddr_storage->addr6.IPv6Address; 7935 7936 sockaddr_storage->Family = INTERNETWORKV6; 7937 sockaddr_storage->addr6.Port = 0; 7938 sockaddr_storage->addr6.FlowInfo = 0; 7939 7940 idev6 = __in6_dev_get(netdev); 7941 if (!idev6) 7942 continue; 7943 7944 list_for_each_entry(ifa, &idev6->addr_list, if_list) { 7945 if (ifa->flags & (IFA_F_TENTATIVE | 7946 IFA_F_DEPRECATED)) 7947 continue; 7948 memcpy(ipv6_addr, ifa->addr.s6_addr, 16); 7949 break; 7950 } 7951 sockaddr_storage->addr6.ScopeId = 0; 7952 nbytes += sizeof(struct network_interface_info_ioctl_rsp); 7953 } 7954 } 7955 rtnl_unlock(); 7956 7957 /* zero if this is last one */ 7958 if (nii_rsp) 7959 nii_rsp->Next = 0; 7960 7961 rsp->PersistentFileId = SMB2_NO_FID; 7962 rsp->VolatileFileId = SMB2_NO_FID; 7963 return nbytes; 7964 } 7965 7966 static int fsctl_validate_negotiate_info(struct ksmbd_conn *conn, 7967 struct validate_negotiate_info_req *neg_req, 7968 struct validate_negotiate_info_rsp *neg_rsp, 7969 unsigned int in_buf_len) 7970 { 7971 int ret = 0; 7972 int dialect; 7973 7974 if (in_buf_len < offsetof(struct validate_negotiate_info_req, Dialects) + 7975 le16_to_cpu(neg_req->DialectCount) * sizeof(__le16)) 7976 return -EINVAL; 7977 7978 dialect = ksmbd_lookup_dialect_by_id(neg_req->Dialects, 7979 neg_req->DialectCount); 7980 if (dialect == BAD_PROT_ID || dialect != conn->dialect) { 7981 ret = -EINVAL; 7982 goto err_out; 7983 } 7984 7985 if (strncmp(neg_req->Guid, conn->ClientGUID, SMB2_CLIENT_GUID_SIZE)) { 7986 ret = -EINVAL; 7987 goto err_out; 7988 } 7989 7990 if (le16_to_cpu(neg_req->SecurityMode) != conn->cli_sec_mode) { 7991 ret = -EINVAL; 7992 goto err_out; 7993 } 7994 7995 if (le32_to_cpu(neg_req->Capabilities) != conn->cli_cap) { 7996 ret = -EINVAL; 7997 goto err_out; 7998 } 7999 8000 neg_rsp->Capabilities = cpu_to_le32(conn->vals->req_capabilities); 8001 memset(neg_rsp->Guid, 0, SMB2_CLIENT_GUID_SIZE); 8002 neg_rsp->SecurityMode = cpu_to_le16(conn->srv_sec_mode); 8003 neg_rsp->Dialect = cpu_to_le16(conn->dialect); 8004 err_out: 8005 return ret; 8006 } 8007 8008 static int fsctl_query_allocated_ranges(struct ksmbd_work *work, u64 id, 8009 struct file_allocated_range_buffer *qar_req, 8010 struct file_allocated_range_buffer *qar_rsp, 8011 unsigned int in_count, unsigned int *out_count) 8012 { 8013 struct ksmbd_file *fp; 8014 loff_t start, length; 8015 int ret = 0; 8016 8017 *out_count = 0; 8018 if (in_count == 0) 8019 return -EINVAL; 8020 8021 start = le64_to_cpu(qar_req->file_offset); 8022 length = le64_to_cpu(qar_req->length); 8023 8024 if (start < 0 || length < 0) 8025 return -EINVAL; 8026 8027 fp = ksmbd_lookup_fd_fast(work, id); 8028 if (!fp) 8029 return -ENOENT; 8030 8031 ret = ksmbd_vfs_fqar_lseek(fp, start, length, 8032 qar_rsp, in_count, out_count); 8033 if (ret && ret != -E2BIG) 8034 *out_count = 0; 8035 8036 ksmbd_fd_put(work, fp); 8037 return ret; 8038 } 8039 8040 static int fsctl_pipe_transceive(struct ksmbd_work *work, u64 id, 8041 unsigned int out_buf_len, 8042 struct smb2_ioctl_req *req, 8043 struct smb2_ioctl_rsp *rsp) 8044 { 8045 struct ksmbd_rpc_command *rpc_resp; 8046 char *data_buf = (char *)req + le32_to_cpu(req->InputOffset); 8047 int nbytes = 0; 8048 8049 rpc_resp = ksmbd_rpc_ioctl(work->sess, id, data_buf, 8050 le32_to_cpu(req->InputCount)); 8051 if (rpc_resp) { 8052 if (rpc_resp->flags == KSMBD_RPC_SOME_NOT_MAPPED) { 8053 /* 8054 * set STATUS_SOME_NOT_MAPPED response 8055 * for unknown domain sid. 8056 */ 8057 rsp->hdr.Status = STATUS_SOME_NOT_MAPPED; 8058 } else if (rpc_resp->flags == KSMBD_RPC_ENOTIMPLEMENTED) { 8059 rsp->hdr.Status = STATUS_NOT_SUPPORTED; 8060 goto out; 8061 } else if (rpc_resp->flags != KSMBD_RPC_OK) { 8062 rsp->hdr.Status = STATUS_INVALID_PARAMETER; 8063 goto out; 8064 } 8065 8066 nbytes = rpc_resp->payload_sz; 8067 if (rpc_resp->payload_sz > out_buf_len) { 8068 rsp->hdr.Status = STATUS_BUFFER_OVERFLOW; 8069 nbytes = out_buf_len; 8070 } 8071 8072 if (!rpc_resp->payload_sz) { 8073 rsp->hdr.Status = 8074 STATUS_UNEXPECTED_IO_ERROR; 8075 goto out; 8076 } 8077 8078 memcpy((char *)rsp->Buffer, rpc_resp->payload, nbytes); 8079 } 8080 out: 8081 kvfree(rpc_resp); 8082 return nbytes; 8083 } 8084 8085 static inline int fsctl_set_sparse(struct ksmbd_work *work, u64 id, 8086 struct file_sparse *sparse) 8087 { 8088 struct ksmbd_file *fp; 8089 struct mnt_idmap *idmap; 8090 int ret = 0; 8091 __le32 old_fattr; 8092 8093 fp = ksmbd_lookup_fd_fast(work, id); 8094 if (!fp) 8095 return -ENOENT; 8096 idmap = file_mnt_idmap(fp->filp); 8097 8098 old_fattr = fp->f_ci->m_fattr; 8099 if (sparse->SetSparse) 8100 fp->f_ci->m_fattr |= FILE_ATTRIBUTE_SPARSE_FILE_LE; 8101 else 8102 fp->f_ci->m_fattr &= ~FILE_ATTRIBUTE_SPARSE_FILE_LE; 8103 8104 if (fp->f_ci->m_fattr != old_fattr && 8105 test_share_config_flag(work->tcon->share_conf, 8106 KSMBD_SHARE_FLAG_STORE_DOS_ATTRS)) { 8107 struct xattr_dos_attrib da; 8108 8109 ret = ksmbd_vfs_get_dos_attrib_xattr(idmap, 8110 fp->filp->f_path.dentry, &da); 8111 if (ret <= 0) 8112 goto out; 8113 8114 da.attr = le32_to_cpu(fp->f_ci->m_fattr); 8115 ret = ksmbd_vfs_set_dos_attrib_xattr(idmap, 8116 &fp->filp->f_path, 8117 &da, true); 8118 if (ret) 8119 fp->f_ci->m_fattr = old_fattr; 8120 } 8121 8122 out: 8123 ksmbd_fd_put(work, fp); 8124 return ret; 8125 } 8126 8127 static int fsctl_request_resume_key(struct ksmbd_work *work, 8128 struct smb2_ioctl_req *req, 8129 struct resume_key_ioctl_rsp *key_rsp) 8130 { 8131 struct ksmbd_file *fp; 8132 8133 fp = ksmbd_lookup_fd_slow(work, req->VolatileFileId, req->PersistentFileId); 8134 if (!fp) 8135 return -ENOENT; 8136 8137 memset(key_rsp, 0, sizeof(*key_rsp)); 8138 key_rsp->ResumeKeyU64[0] = req->VolatileFileId; 8139 key_rsp->ResumeKeyU64[1] = req->PersistentFileId; 8140 ksmbd_fd_put(work, fp); 8141 8142 return 0; 8143 } 8144 8145 /** 8146 * smb2_ioctl() - handler for smb2 ioctl command 8147 * @work: smb work containing ioctl command buffer 8148 * 8149 * Return: 0 on success, otherwise error 8150 */ 8151 int smb2_ioctl(struct ksmbd_work *work) 8152 { 8153 struct smb2_ioctl_req *req; 8154 struct smb2_ioctl_rsp *rsp; 8155 unsigned int cnt_code, nbytes = 0, out_buf_len, in_buf_len; 8156 u64 id = KSMBD_NO_FID; 8157 struct ksmbd_conn *conn = work->conn; 8158 int ret = 0; 8159 char *buffer; 8160 8161 ksmbd_debug(SMB, "Received smb2 ioctl request\n"); 8162 8163 if (work->next_smb2_rcv_hdr_off) { 8164 req = ksmbd_req_buf_next(work); 8165 rsp = ksmbd_resp_buf_next(work); 8166 if (!has_file_id(req->VolatileFileId)) { 8167 ksmbd_debug(SMB, "Compound request set FID = %llu\n", 8168 work->compound_fid); 8169 id = work->compound_fid; 8170 } 8171 } else { 8172 req = smb_get_msg(work->request_buf); 8173 rsp = smb_get_msg(work->response_buf); 8174 } 8175 8176 if (!has_file_id(id)) 8177 id = req->VolatileFileId; 8178 8179 if (req->Flags != cpu_to_le32(SMB2_0_IOCTL_IS_FSCTL)) { 8180 ret = -EOPNOTSUPP; 8181 goto out; 8182 } 8183 8184 buffer = (char *)req + le32_to_cpu(req->InputOffset); 8185 8186 cnt_code = le32_to_cpu(req->CtlCode); 8187 ret = smb2_calc_max_out_buf_len(work, 48, 8188 le32_to_cpu(req->MaxOutputResponse)); 8189 if (ret < 0) { 8190 rsp->hdr.Status = STATUS_INVALID_PARAMETER; 8191 goto out; 8192 } 8193 out_buf_len = (unsigned int)ret; 8194 in_buf_len = le32_to_cpu(req->InputCount); 8195 8196 switch (cnt_code) { 8197 case FSCTL_DFS_GET_REFERRALS: 8198 case FSCTL_DFS_GET_REFERRALS_EX: 8199 /* Not support DFS yet */ 8200 ret = -EOPNOTSUPP; 8201 rsp->hdr.Status = STATUS_FS_DRIVER_REQUIRED; 8202 goto out2; 8203 case FSCTL_CREATE_OR_GET_OBJECT_ID: 8204 { 8205 struct file_object_buf_type1_ioctl_rsp *obj_buf; 8206 8207 nbytes = sizeof(struct file_object_buf_type1_ioctl_rsp); 8208 obj_buf = (struct file_object_buf_type1_ioctl_rsp *) 8209 &rsp->Buffer[0]; 8210 8211 /* 8212 * TODO: This is dummy implementation to pass smbtorture 8213 * Need to check correct response later 8214 */ 8215 memset(obj_buf->ObjectId, 0x0, 16); 8216 memset(obj_buf->BirthVolumeId, 0x0, 16); 8217 memset(obj_buf->BirthObjectId, 0x0, 16); 8218 memset(obj_buf->DomainId, 0x0, 16); 8219 8220 break; 8221 } 8222 case FSCTL_PIPE_TRANSCEIVE: 8223 out_buf_len = min_t(u32, KSMBD_IPC_MAX_PAYLOAD, out_buf_len); 8224 nbytes = fsctl_pipe_transceive(work, id, out_buf_len, req, rsp); 8225 break; 8226 case FSCTL_VALIDATE_NEGOTIATE_INFO: 8227 if (conn->dialect < SMB30_PROT_ID) { 8228 ret = -EOPNOTSUPP; 8229 goto out; 8230 } 8231 8232 if (in_buf_len < offsetof(struct validate_negotiate_info_req, 8233 Dialects)) { 8234 ret = -EINVAL; 8235 goto out; 8236 } 8237 8238 if (out_buf_len < sizeof(struct validate_negotiate_info_rsp)) { 8239 ret = -EINVAL; 8240 goto out; 8241 } 8242 8243 ret = fsctl_validate_negotiate_info(conn, 8244 (struct validate_negotiate_info_req *)buffer, 8245 (struct validate_negotiate_info_rsp *)&rsp->Buffer[0], 8246 in_buf_len); 8247 if (ret < 0) 8248 goto out; 8249 8250 nbytes = sizeof(struct validate_negotiate_info_rsp); 8251 rsp->PersistentFileId = SMB2_NO_FID; 8252 rsp->VolatileFileId = SMB2_NO_FID; 8253 break; 8254 case FSCTL_QUERY_NETWORK_INTERFACE_INFO: 8255 ret = fsctl_query_iface_info_ioctl(conn, rsp, out_buf_len); 8256 if (ret < 0) 8257 goto out; 8258 nbytes = ret; 8259 break; 8260 case FSCTL_REQUEST_RESUME_KEY: 8261 if (out_buf_len < sizeof(struct resume_key_ioctl_rsp)) { 8262 ret = -EINVAL; 8263 goto out; 8264 } 8265 8266 ret = fsctl_request_resume_key(work, req, 8267 (struct resume_key_ioctl_rsp *)&rsp->Buffer[0]); 8268 if (ret < 0) 8269 goto out; 8270 rsp->PersistentFileId = req->PersistentFileId; 8271 rsp->VolatileFileId = req->VolatileFileId; 8272 nbytes = sizeof(struct resume_key_ioctl_rsp); 8273 break; 8274 case FSCTL_COPYCHUNK: 8275 case FSCTL_COPYCHUNK_WRITE: 8276 if (!test_tree_conn_flag(work->tcon, KSMBD_TREE_CONN_FLAG_WRITABLE)) { 8277 ksmbd_debug(SMB, 8278 "User does not have write permission\n"); 8279 ret = -EACCES; 8280 goto out; 8281 } 8282 8283 if (in_buf_len <= sizeof(struct copychunk_ioctl_req)) { 8284 ret = -EINVAL; 8285 goto out; 8286 } 8287 8288 if (out_buf_len < sizeof(struct copychunk_ioctl_rsp)) { 8289 ret = -EINVAL; 8290 goto out; 8291 } 8292 8293 nbytes = sizeof(struct copychunk_ioctl_rsp); 8294 rsp->VolatileFileId = req->VolatileFileId; 8295 rsp->PersistentFileId = req->PersistentFileId; 8296 fsctl_copychunk(work, 8297 (struct copychunk_ioctl_req *)buffer, 8298 le32_to_cpu(req->CtlCode), 8299 le32_to_cpu(req->InputCount), 8300 req->VolatileFileId, 8301 req->PersistentFileId, 8302 rsp); 8303 break; 8304 case FSCTL_SET_SPARSE: 8305 if (in_buf_len < sizeof(struct file_sparse)) { 8306 ret = -EINVAL; 8307 goto out; 8308 } 8309 8310 ret = fsctl_set_sparse(work, id, (struct file_sparse *)buffer); 8311 if (ret < 0) 8312 goto out; 8313 break; 8314 case FSCTL_SET_ZERO_DATA: 8315 { 8316 struct file_zero_data_information *zero_data; 8317 struct ksmbd_file *fp; 8318 loff_t off, len, bfz; 8319 8320 if (!test_tree_conn_flag(work->tcon, KSMBD_TREE_CONN_FLAG_WRITABLE)) { 8321 ksmbd_debug(SMB, 8322 "User does not have write permission\n"); 8323 ret = -EACCES; 8324 goto out; 8325 } 8326 8327 if (in_buf_len < sizeof(struct file_zero_data_information)) { 8328 ret = -EINVAL; 8329 goto out; 8330 } 8331 8332 zero_data = 8333 (struct file_zero_data_information *)buffer; 8334 8335 off = le64_to_cpu(zero_data->FileOffset); 8336 bfz = le64_to_cpu(zero_data->BeyondFinalZero); 8337 if (off < 0 || bfz < 0 || off > bfz) { 8338 ret = -EINVAL; 8339 goto out; 8340 } 8341 8342 len = bfz - off; 8343 if (len) { 8344 fp = ksmbd_lookup_fd_fast(work, id); 8345 if (!fp) { 8346 ret = -ENOENT; 8347 goto out; 8348 } 8349 8350 ret = ksmbd_vfs_zero_data(work, fp, off, len); 8351 ksmbd_fd_put(work, fp); 8352 if (ret < 0) 8353 goto out; 8354 } 8355 break; 8356 } 8357 case FSCTL_QUERY_ALLOCATED_RANGES: 8358 if (in_buf_len < sizeof(struct file_allocated_range_buffer)) { 8359 ret = -EINVAL; 8360 goto out; 8361 } 8362 8363 ret = fsctl_query_allocated_ranges(work, id, 8364 (struct file_allocated_range_buffer *)buffer, 8365 (struct file_allocated_range_buffer *)&rsp->Buffer[0], 8366 out_buf_len / 8367 sizeof(struct file_allocated_range_buffer), &nbytes); 8368 if (ret == -E2BIG) { 8369 rsp->hdr.Status = STATUS_BUFFER_OVERFLOW; 8370 } else if (ret < 0) { 8371 nbytes = 0; 8372 goto out; 8373 } 8374 8375 nbytes *= sizeof(struct file_allocated_range_buffer); 8376 break; 8377 case FSCTL_GET_REPARSE_POINT: 8378 { 8379 struct reparse_data_buffer *reparse_ptr; 8380 struct ksmbd_file *fp; 8381 8382 reparse_ptr = (struct reparse_data_buffer *)&rsp->Buffer[0]; 8383 fp = ksmbd_lookup_fd_fast(work, id); 8384 if (!fp) { 8385 pr_err("not found fp!!\n"); 8386 ret = -ENOENT; 8387 goto out; 8388 } 8389 8390 reparse_ptr->ReparseTag = 8391 smb2_get_reparse_tag_special_file(file_inode(fp->filp)->i_mode); 8392 reparse_ptr->ReparseDataLength = 0; 8393 ksmbd_fd_put(work, fp); 8394 nbytes = sizeof(struct reparse_data_buffer); 8395 break; 8396 } 8397 case FSCTL_DUPLICATE_EXTENTS_TO_FILE: 8398 { 8399 struct ksmbd_file *fp_in, *fp_out = NULL; 8400 struct duplicate_extents_to_file *dup_ext; 8401 loff_t src_off, dst_off, length, cloned; 8402 8403 if (in_buf_len < sizeof(struct duplicate_extents_to_file)) { 8404 ret = -EINVAL; 8405 goto out; 8406 } 8407 8408 dup_ext = (struct duplicate_extents_to_file *)buffer; 8409 8410 fp_in = ksmbd_lookup_fd_slow(work, dup_ext->VolatileFileHandle, 8411 dup_ext->PersistentFileHandle); 8412 if (!fp_in) { 8413 pr_err("not found file handle in duplicate extent to file\n"); 8414 ret = -ENOENT; 8415 goto out; 8416 } 8417 8418 fp_out = ksmbd_lookup_fd_fast(work, id); 8419 if (!fp_out) { 8420 pr_err("not found fp\n"); 8421 ret = -ENOENT; 8422 goto dup_ext_out; 8423 } 8424 8425 src_off = le64_to_cpu(dup_ext->SourceFileOffset); 8426 dst_off = le64_to_cpu(dup_ext->TargetFileOffset); 8427 length = le64_to_cpu(dup_ext->ByteCount); 8428 /* 8429 * XXX: It is not clear if FSCTL_DUPLICATE_EXTENTS_TO_FILE 8430 * should fall back to vfs_copy_file_range(). This could be 8431 * beneficial when re-exporting nfs/smb mount, but note that 8432 * this can result in partial copy that returns an error status. 8433 * If/when FSCTL_DUPLICATE_EXTENTS_TO_FILE_EX is implemented, 8434 * fall back to vfs_copy_file_range(), should be avoided when 8435 * the flag DUPLICATE_EXTENTS_DATA_EX_SOURCE_ATOMIC is set. 8436 */ 8437 cloned = vfs_clone_file_range(fp_in->filp, src_off, 8438 fp_out->filp, dst_off, length, 0); 8439 if (cloned == -EXDEV || cloned == -EOPNOTSUPP) { 8440 ret = -EOPNOTSUPP; 8441 goto dup_ext_out; 8442 } else if (cloned != length) { 8443 cloned = vfs_copy_file_range(fp_in->filp, src_off, 8444 fp_out->filp, dst_off, 8445 length, 0); 8446 if (cloned != length) { 8447 if (cloned < 0) 8448 ret = cloned; 8449 else 8450 ret = -EINVAL; 8451 } 8452 } 8453 8454 dup_ext_out: 8455 ksmbd_fd_put(work, fp_in); 8456 ksmbd_fd_put(work, fp_out); 8457 if (ret < 0) 8458 goto out; 8459 break; 8460 } 8461 default: 8462 ksmbd_debug(SMB, "not implemented yet ioctl command 0x%x\n", 8463 cnt_code); 8464 ret = -EOPNOTSUPP; 8465 goto out; 8466 } 8467 8468 rsp->CtlCode = cpu_to_le32(cnt_code); 8469 rsp->InputCount = cpu_to_le32(0); 8470 rsp->InputOffset = cpu_to_le32(112); 8471 rsp->OutputOffset = cpu_to_le32(112); 8472 rsp->OutputCount = cpu_to_le32(nbytes); 8473 rsp->StructureSize = cpu_to_le16(49); 8474 rsp->Reserved = cpu_to_le16(0); 8475 rsp->Flags = cpu_to_le32(0); 8476 rsp->Reserved2 = cpu_to_le32(0); 8477 ret = ksmbd_iov_pin_rsp(work, rsp, sizeof(struct smb2_ioctl_rsp) + nbytes); 8478 if (!ret) 8479 return ret; 8480 8481 out: 8482 if (ret == -EACCES) 8483 rsp->hdr.Status = STATUS_ACCESS_DENIED; 8484 else if (ret == -ENOENT) 8485 rsp->hdr.Status = STATUS_OBJECT_NAME_NOT_FOUND; 8486 else if (ret == -EOPNOTSUPP) 8487 rsp->hdr.Status = STATUS_NOT_SUPPORTED; 8488 else if (ret == -ENOSPC) 8489 rsp->hdr.Status = STATUS_BUFFER_TOO_SMALL; 8490 else if (ret < 0 || rsp->hdr.Status == 0) 8491 rsp->hdr.Status = STATUS_INVALID_PARAMETER; 8492 8493 out2: 8494 smb2_set_err_rsp(work); 8495 return ret; 8496 } 8497 8498 /** 8499 * smb20_oplock_break_ack() - handler for smb2.0 oplock break command 8500 * @work: smb work containing oplock break command buffer 8501 * 8502 * Return: 0 8503 */ 8504 static void smb20_oplock_break_ack(struct ksmbd_work *work) 8505 { 8506 struct smb2_oplock_break *req; 8507 struct smb2_oplock_break *rsp; 8508 struct ksmbd_file *fp; 8509 struct oplock_info *opinfo = NULL; 8510 __le32 err = 0; 8511 int ret = 0; 8512 u64 volatile_id, persistent_id; 8513 char req_oplevel = 0, rsp_oplevel = 0; 8514 unsigned int oplock_change_type; 8515 8516 WORK_BUFFERS(work, req, rsp); 8517 8518 volatile_id = req->VolatileFid; 8519 persistent_id = req->PersistentFid; 8520 req_oplevel = req->OplockLevel; 8521 ksmbd_debug(OPLOCK, "v_id %llu, p_id %llu request oplock level %d\n", 8522 volatile_id, persistent_id, req_oplevel); 8523 8524 fp = ksmbd_lookup_fd_slow(work, volatile_id, persistent_id); 8525 if (!fp) { 8526 rsp->hdr.Status = STATUS_FILE_CLOSED; 8527 smb2_set_err_rsp(work); 8528 return; 8529 } 8530 8531 opinfo = opinfo_get(fp); 8532 if (!opinfo) { 8533 pr_err("unexpected null oplock_info\n"); 8534 rsp->hdr.Status = STATUS_INVALID_OPLOCK_PROTOCOL; 8535 smb2_set_err_rsp(work); 8536 ksmbd_fd_put(work, fp); 8537 return; 8538 } 8539 8540 if (opinfo->level == SMB2_OPLOCK_LEVEL_NONE) { 8541 rsp->hdr.Status = STATUS_INVALID_OPLOCK_PROTOCOL; 8542 goto err_out; 8543 } 8544 8545 if (opinfo->op_state == OPLOCK_STATE_NONE) { 8546 ksmbd_debug(SMB, "unexpected oplock state 0x%x\n", opinfo->op_state); 8547 rsp->hdr.Status = STATUS_UNSUCCESSFUL; 8548 goto err_out; 8549 } 8550 8551 if ((opinfo->level == SMB2_OPLOCK_LEVEL_EXCLUSIVE || 8552 opinfo->level == SMB2_OPLOCK_LEVEL_BATCH) && 8553 (req_oplevel != SMB2_OPLOCK_LEVEL_II && 8554 req_oplevel != SMB2_OPLOCK_LEVEL_NONE)) { 8555 err = STATUS_INVALID_OPLOCK_PROTOCOL; 8556 oplock_change_type = OPLOCK_WRITE_TO_NONE; 8557 } else if (opinfo->level == SMB2_OPLOCK_LEVEL_II && 8558 req_oplevel != SMB2_OPLOCK_LEVEL_NONE) { 8559 err = STATUS_INVALID_OPLOCK_PROTOCOL; 8560 oplock_change_type = OPLOCK_READ_TO_NONE; 8561 } else if (req_oplevel == SMB2_OPLOCK_LEVEL_II || 8562 req_oplevel == SMB2_OPLOCK_LEVEL_NONE) { 8563 err = STATUS_INVALID_DEVICE_STATE; 8564 if ((opinfo->level == SMB2_OPLOCK_LEVEL_EXCLUSIVE || 8565 opinfo->level == SMB2_OPLOCK_LEVEL_BATCH) && 8566 req_oplevel == SMB2_OPLOCK_LEVEL_II) { 8567 oplock_change_type = OPLOCK_WRITE_TO_READ; 8568 } else if ((opinfo->level == SMB2_OPLOCK_LEVEL_EXCLUSIVE || 8569 opinfo->level == SMB2_OPLOCK_LEVEL_BATCH) && 8570 req_oplevel == SMB2_OPLOCK_LEVEL_NONE) { 8571 oplock_change_type = OPLOCK_WRITE_TO_NONE; 8572 } else if (opinfo->level == SMB2_OPLOCK_LEVEL_II && 8573 req_oplevel == SMB2_OPLOCK_LEVEL_NONE) { 8574 oplock_change_type = OPLOCK_READ_TO_NONE; 8575 } else { 8576 oplock_change_type = 0; 8577 } 8578 } else { 8579 oplock_change_type = 0; 8580 } 8581 8582 switch (oplock_change_type) { 8583 case OPLOCK_WRITE_TO_READ: 8584 ret = opinfo_write_to_read(opinfo); 8585 rsp_oplevel = SMB2_OPLOCK_LEVEL_II; 8586 break; 8587 case OPLOCK_WRITE_TO_NONE: 8588 ret = opinfo_write_to_none(opinfo); 8589 rsp_oplevel = SMB2_OPLOCK_LEVEL_NONE; 8590 break; 8591 case OPLOCK_READ_TO_NONE: 8592 ret = opinfo_read_to_none(opinfo); 8593 rsp_oplevel = SMB2_OPLOCK_LEVEL_NONE; 8594 break; 8595 default: 8596 pr_err("unknown oplock change 0x%x -> 0x%x\n", 8597 opinfo->level, rsp_oplevel); 8598 } 8599 8600 if (ret < 0) { 8601 rsp->hdr.Status = err; 8602 goto err_out; 8603 } 8604 8605 rsp->StructureSize = cpu_to_le16(24); 8606 rsp->OplockLevel = rsp_oplevel; 8607 rsp->Reserved = 0; 8608 rsp->Reserved2 = 0; 8609 rsp->VolatileFid = volatile_id; 8610 rsp->PersistentFid = persistent_id; 8611 ret = ksmbd_iov_pin_rsp(work, rsp, sizeof(struct smb2_oplock_break)); 8612 if (ret) { 8613 err_out: 8614 smb2_set_err_rsp(work); 8615 } 8616 8617 opinfo->op_state = OPLOCK_STATE_NONE; 8618 wake_up_interruptible_all(&opinfo->oplock_q); 8619 opinfo_put(opinfo); 8620 ksmbd_fd_put(work, fp); 8621 } 8622 8623 static int check_lease_state(struct lease *lease, __le32 req_state) 8624 { 8625 if ((lease->new_state == 8626 (SMB2_LEASE_READ_CACHING_LE | SMB2_LEASE_HANDLE_CACHING_LE)) && 8627 !(req_state & SMB2_LEASE_WRITE_CACHING_LE)) { 8628 lease->new_state = req_state; 8629 return 0; 8630 } 8631 8632 if (lease->new_state == req_state) 8633 return 0; 8634 8635 return 1; 8636 } 8637 8638 /** 8639 * smb21_lease_break_ack() - handler for smb2.1 lease break command 8640 * @work: smb work containing lease break command buffer 8641 * 8642 * Return: 0 8643 */ 8644 static void smb21_lease_break_ack(struct ksmbd_work *work) 8645 { 8646 struct ksmbd_conn *conn = work->conn; 8647 struct smb2_lease_ack *req; 8648 struct smb2_lease_ack *rsp; 8649 struct oplock_info *opinfo; 8650 __le32 err = 0; 8651 int ret = 0; 8652 unsigned int lease_change_type; 8653 __le32 lease_state; 8654 struct lease *lease; 8655 8656 WORK_BUFFERS(work, req, rsp); 8657 8658 ksmbd_debug(OPLOCK, "smb21 lease break, lease state(0x%x)\n", 8659 le32_to_cpu(req->LeaseState)); 8660 opinfo = lookup_lease_in_table(conn, req->LeaseKey); 8661 if (!opinfo) { 8662 ksmbd_debug(OPLOCK, "file not opened\n"); 8663 smb2_set_err_rsp(work); 8664 rsp->hdr.Status = STATUS_UNSUCCESSFUL; 8665 return; 8666 } 8667 lease = opinfo->o_lease; 8668 8669 if (opinfo->op_state == OPLOCK_STATE_NONE) { 8670 pr_err("unexpected lease break state 0x%x\n", 8671 opinfo->op_state); 8672 rsp->hdr.Status = STATUS_UNSUCCESSFUL; 8673 goto err_out; 8674 } 8675 8676 if (check_lease_state(lease, req->LeaseState)) { 8677 rsp->hdr.Status = STATUS_REQUEST_NOT_ACCEPTED; 8678 ksmbd_debug(OPLOCK, 8679 "req lease state: 0x%x, expected state: 0x%x\n", 8680 req->LeaseState, lease->new_state); 8681 goto err_out; 8682 } 8683 8684 if (!atomic_read(&opinfo->breaking_cnt)) { 8685 rsp->hdr.Status = STATUS_UNSUCCESSFUL; 8686 goto err_out; 8687 } 8688 8689 /* check for bad lease state */ 8690 if (req->LeaseState & 8691 (~(SMB2_LEASE_READ_CACHING_LE | SMB2_LEASE_HANDLE_CACHING_LE))) { 8692 err = STATUS_INVALID_OPLOCK_PROTOCOL; 8693 if (lease->state & SMB2_LEASE_WRITE_CACHING_LE) 8694 lease_change_type = OPLOCK_WRITE_TO_NONE; 8695 else 8696 lease_change_type = OPLOCK_READ_TO_NONE; 8697 ksmbd_debug(OPLOCK, "handle bad lease state 0x%x -> 0x%x\n", 8698 le32_to_cpu(lease->state), 8699 le32_to_cpu(req->LeaseState)); 8700 } else if (lease->state == SMB2_LEASE_READ_CACHING_LE && 8701 req->LeaseState != SMB2_LEASE_NONE_LE) { 8702 err = STATUS_INVALID_OPLOCK_PROTOCOL; 8703 lease_change_type = OPLOCK_READ_TO_NONE; 8704 ksmbd_debug(OPLOCK, "handle bad lease state 0x%x -> 0x%x\n", 8705 le32_to_cpu(lease->state), 8706 le32_to_cpu(req->LeaseState)); 8707 } else { 8708 /* valid lease state changes */ 8709 err = STATUS_INVALID_DEVICE_STATE; 8710 if (req->LeaseState == SMB2_LEASE_NONE_LE) { 8711 if (lease->state & SMB2_LEASE_WRITE_CACHING_LE) 8712 lease_change_type = OPLOCK_WRITE_TO_NONE; 8713 else 8714 lease_change_type = OPLOCK_READ_TO_NONE; 8715 } else if (req->LeaseState & SMB2_LEASE_READ_CACHING_LE) { 8716 if (lease->state & SMB2_LEASE_WRITE_CACHING_LE) 8717 lease_change_type = OPLOCK_WRITE_TO_READ; 8718 else 8719 lease_change_type = OPLOCK_READ_HANDLE_TO_READ; 8720 } else { 8721 lease_change_type = 0; 8722 } 8723 } 8724 8725 switch (lease_change_type) { 8726 case OPLOCK_WRITE_TO_READ: 8727 ret = opinfo_write_to_read(opinfo); 8728 break; 8729 case OPLOCK_READ_HANDLE_TO_READ: 8730 ret = opinfo_read_handle_to_read(opinfo); 8731 break; 8732 case OPLOCK_WRITE_TO_NONE: 8733 ret = opinfo_write_to_none(opinfo); 8734 break; 8735 case OPLOCK_READ_TO_NONE: 8736 ret = opinfo_read_to_none(opinfo); 8737 break; 8738 default: 8739 ksmbd_debug(OPLOCK, "unknown lease change 0x%x -> 0x%x\n", 8740 le32_to_cpu(lease->state), 8741 le32_to_cpu(req->LeaseState)); 8742 } 8743 8744 if (ret < 0) { 8745 rsp->hdr.Status = err; 8746 goto err_out; 8747 } 8748 8749 lease_state = lease->state; 8750 8751 rsp->StructureSize = cpu_to_le16(36); 8752 rsp->Reserved = 0; 8753 rsp->Flags = 0; 8754 memcpy(rsp->LeaseKey, req->LeaseKey, 16); 8755 rsp->LeaseState = lease_state; 8756 rsp->LeaseDuration = 0; 8757 ret = ksmbd_iov_pin_rsp(work, rsp, sizeof(struct smb2_lease_ack)); 8758 if (ret) { 8759 err_out: 8760 smb2_set_err_rsp(work); 8761 } 8762 8763 opinfo->op_state = OPLOCK_STATE_NONE; 8764 wake_up_interruptible_all(&opinfo->oplock_q); 8765 atomic_dec(&opinfo->breaking_cnt); 8766 wake_up_interruptible_all(&opinfo->oplock_brk); 8767 opinfo_put(opinfo); 8768 } 8769 8770 /** 8771 * smb2_oplock_break() - dispatcher for smb2.0 and 2.1 oplock/lease break 8772 * @work: smb work containing oplock/lease break command buffer 8773 * 8774 * Return: 0 on success, otherwise error 8775 */ 8776 int smb2_oplock_break(struct ksmbd_work *work) 8777 { 8778 struct smb2_oplock_break *req; 8779 struct smb2_oplock_break *rsp; 8780 8781 ksmbd_debug(SMB, "Received smb2 oplock break acknowledgment request\n"); 8782 8783 WORK_BUFFERS(work, req, rsp); 8784 8785 switch (le16_to_cpu(req->StructureSize)) { 8786 case OP_BREAK_STRUCT_SIZE_20: 8787 smb20_oplock_break_ack(work); 8788 break; 8789 case OP_BREAK_STRUCT_SIZE_21: 8790 smb21_lease_break_ack(work); 8791 break; 8792 default: 8793 ksmbd_debug(OPLOCK, "invalid break cmd %d\n", 8794 le16_to_cpu(req->StructureSize)); 8795 rsp->hdr.Status = STATUS_INVALID_PARAMETER; 8796 smb2_set_err_rsp(work); 8797 return -EINVAL; 8798 } 8799 8800 return 0; 8801 } 8802 8803 /** 8804 * smb2_notify() - handler for smb2 notify request 8805 * @work: smb work containing notify command buffer 8806 * 8807 * Return: 0 on success, otherwise error 8808 */ 8809 int smb2_notify(struct ksmbd_work *work) 8810 { 8811 struct smb2_change_notify_req *req; 8812 struct smb2_change_notify_rsp *rsp; 8813 8814 ksmbd_debug(SMB, "Received smb2 notify\n"); 8815 8816 WORK_BUFFERS(work, req, rsp); 8817 8818 if (work->next_smb2_rcv_hdr_off && req->hdr.NextCommand) { 8819 rsp->hdr.Status = STATUS_INTERNAL_ERROR; 8820 smb2_set_err_rsp(work); 8821 return -EIO; 8822 } 8823 8824 smb2_set_err_rsp(work); 8825 rsp->hdr.Status = STATUS_NOT_IMPLEMENTED; 8826 return -EOPNOTSUPP; 8827 } 8828 8829 /** 8830 * smb2_is_sign_req() - handler for checking packet signing status 8831 * @work: smb work containing notify command buffer 8832 * @command: SMB2 command id 8833 * 8834 * Return: true if packed is signed, false otherwise 8835 */ 8836 bool smb2_is_sign_req(struct ksmbd_work *work, unsigned int command) 8837 { 8838 struct smb2_hdr *rcv_hdr2 = smb_get_msg(work->request_buf); 8839 8840 if ((rcv_hdr2->Flags & SMB2_FLAGS_SIGNED) && 8841 command != SMB2_NEGOTIATE_HE && 8842 command != SMB2_SESSION_SETUP_HE && 8843 command != SMB2_OPLOCK_BREAK_HE) 8844 return true; 8845 8846 return false; 8847 } 8848 8849 /** 8850 * smb2_check_sign_req() - handler for req packet sign processing 8851 * @work: smb work containing notify command buffer 8852 * 8853 * Return: 1 on success, 0 otherwise 8854 */ 8855 int smb2_check_sign_req(struct ksmbd_work *work) 8856 { 8857 struct smb2_hdr *hdr; 8858 char signature_req[SMB2_SIGNATURE_SIZE]; 8859 char signature[SMB2_HMACSHA256_SIZE]; 8860 struct kvec iov[1]; 8861 size_t len; 8862 8863 hdr = smb_get_msg(work->request_buf); 8864 if (work->next_smb2_rcv_hdr_off) 8865 hdr = ksmbd_req_buf_next(work); 8866 8867 if (!hdr->NextCommand && !work->next_smb2_rcv_hdr_off) 8868 len = get_rfc1002_len(work->request_buf); 8869 else if (hdr->NextCommand) 8870 len = le32_to_cpu(hdr->NextCommand); 8871 else 8872 len = get_rfc1002_len(work->request_buf) - 8873 work->next_smb2_rcv_hdr_off; 8874 8875 memcpy(signature_req, hdr->Signature, SMB2_SIGNATURE_SIZE); 8876 memset(hdr->Signature, 0, SMB2_SIGNATURE_SIZE); 8877 8878 iov[0].iov_base = (char *)&hdr->ProtocolId; 8879 iov[0].iov_len = len; 8880 8881 ksmbd_sign_smb2_pdu(work->conn, work->sess->sess_key, iov, 1, 8882 signature); 8883 8884 if (crypto_memneq(signature, signature_req, SMB2_SIGNATURE_SIZE)) { 8885 pr_err("bad smb2 signature\n"); 8886 return 0; 8887 } 8888 8889 return 1; 8890 } 8891 8892 /** 8893 * smb2_set_sign_rsp() - handler for rsp packet sign processing 8894 * @work: smb work containing notify command buffer 8895 * 8896 */ 8897 void smb2_set_sign_rsp(struct ksmbd_work *work) 8898 { 8899 struct smb2_hdr *hdr; 8900 char signature[SMB2_HMACSHA256_SIZE]; 8901 struct kvec *iov; 8902 int n_vec = 1; 8903 8904 hdr = ksmbd_resp_buf_curr(work); 8905 hdr->Flags |= SMB2_FLAGS_SIGNED; 8906 memset(hdr->Signature, 0, SMB2_SIGNATURE_SIZE); 8907 8908 if (hdr->Command == SMB2_READ) { 8909 iov = &work->iov[work->iov_idx - 1]; 8910 n_vec++; 8911 } else { 8912 iov = &work->iov[work->iov_idx]; 8913 } 8914 8915 ksmbd_sign_smb2_pdu(work->conn, work->sess->sess_key, iov, n_vec, 8916 signature); 8917 memcpy(hdr->Signature, signature, SMB2_SIGNATURE_SIZE); 8918 } 8919 8920 /** 8921 * smb3_check_sign_req() - handler for req packet sign processing 8922 * @work: smb work containing notify command buffer 8923 * 8924 * Return: 1 on success, 0 otherwise 8925 */ 8926 int smb3_check_sign_req(struct ksmbd_work *work) 8927 { 8928 struct ksmbd_conn *conn = work->conn; 8929 char *signing_key; 8930 struct smb2_hdr *hdr; 8931 struct channel *chann; 8932 char signature_req[SMB2_SIGNATURE_SIZE]; 8933 char signature[SMB2_CMACAES_SIZE]; 8934 struct kvec iov[1]; 8935 size_t len; 8936 8937 hdr = smb_get_msg(work->request_buf); 8938 if (work->next_smb2_rcv_hdr_off) 8939 hdr = ksmbd_req_buf_next(work); 8940 8941 if (!hdr->NextCommand && !work->next_smb2_rcv_hdr_off) 8942 len = get_rfc1002_len(work->request_buf); 8943 else if (hdr->NextCommand) 8944 len = le32_to_cpu(hdr->NextCommand); 8945 else 8946 len = get_rfc1002_len(work->request_buf) - 8947 work->next_smb2_rcv_hdr_off; 8948 8949 if (le16_to_cpu(hdr->Command) == SMB2_SESSION_SETUP_HE) { 8950 signing_key = work->sess->smb3signingkey; 8951 } else { 8952 chann = lookup_chann_list(work->sess, conn); 8953 if (!chann) { 8954 return 0; 8955 } 8956 signing_key = chann->smb3signingkey; 8957 } 8958 8959 if (!signing_key) { 8960 pr_err("SMB3 signing key is not generated\n"); 8961 return 0; 8962 } 8963 8964 memcpy(signature_req, hdr->Signature, SMB2_SIGNATURE_SIZE); 8965 memset(hdr->Signature, 0, SMB2_SIGNATURE_SIZE); 8966 iov[0].iov_base = (char *)&hdr->ProtocolId; 8967 iov[0].iov_len = len; 8968 8969 if (ksmbd_sign_smb3_pdu(conn, signing_key, iov, 1, signature)) 8970 return 0; 8971 8972 if (crypto_memneq(signature, signature_req, SMB2_SIGNATURE_SIZE)) { 8973 pr_err("bad smb2 signature\n"); 8974 return 0; 8975 } 8976 8977 return 1; 8978 } 8979 8980 /** 8981 * smb3_set_sign_rsp() - handler for rsp packet sign processing 8982 * @work: smb work containing notify command buffer 8983 * 8984 */ 8985 void smb3_set_sign_rsp(struct ksmbd_work *work) 8986 { 8987 struct ksmbd_conn *conn = work->conn; 8988 struct smb2_hdr *hdr; 8989 struct channel *chann; 8990 char signature[SMB2_CMACAES_SIZE]; 8991 struct kvec *iov; 8992 int n_vec = 1; 8993 char *signing_key; 8994 8995 hdr = ksmbd_resp_buf_curr(work); 8996 8997 if (conn->binding == false && 8998 le16_to_cpu(hdr->Command) == SMB2_SESSION_SETUP_HE) { 8999 signing_key = work->sess->smb3signingkey; 9000 } else { 9001 chann = lookup_chann_list(work->sess, work->conn); 9002 if (!chann) { 9003 return; 9004 } 9005 signing_key = chann->smb3signingkey; 9006 } 9007 9008 if (!signing_key) 9009 return; 9010 9011 hdr->Flags |= SMB2_FLAGS_SIGNED; 9012 memset(hdr->Signature, 0, SMB2_SIGNATURE_SIZE); 9013 9014 if (hdr->Command == SMB2_READ) { 9015 iov = &work->iov[work->iov_idx - 1]; 9016 n_vec++; 9017 } else { 9018 iov = &work->iov[work->iov_idx]; 9019 } 9020 9021 if (!ksmbd_sign_smb3_pdu(conn, signing_key, iov, n_vec, 9022 signature)) 9023 memcpy(hdr->Signature, signature, SMB2_SIGNATURE_SIZE); 9024 } 9025 9026 /** 9027 * smb3_preauth_hash_rsp() - handler for computing preauth hash on response 9028 * @work: smb work containing response buffer 9029 * 9030 */ 9031 void smb3_preauth_hash_rsp(struct ksmbd_work *work) 9032 { 9033 struct ksmbd_conn *conn = work->conn; 9034 struct ksmbd_session *sess = work->sess; 9035 struct smb2_hdr *req, *rsp; 9036 9037 if (conn->dialect != SMB311_PROT_ID) 9038 return; 9039 9040 WORK_BUFFERS(work, req, rsp); 9041 9042 if (le16_to_cpu(req->Command) == SMB2_NEGOTIATE_HE && 9043 conn->preauth_info) 9044 ksmbd_gen_preauth_integrity_hash(conn, work->response_buf, 9045 conn->preauth_info->Preauth_HashValue); 9046 9047 if (le16_to_cpu(rsp->Command) == SMB2_SESSION_SETUP_HE && sess) { 9048 __u8 *hash_value; 9049 9050 if (conn->binding) { 9051 struct preauth_session *preauth_sess; 9052 9053 preauth_sess = ksmbd_preauth_session_lookup(conn, sess->id); 9054 if (!preauth_sess) 9055 return; 9056 hash_value = preauth_sess->Preauth_HashValue; 9057 } else { 9058 hash_value = sess->Preauth_HashValue; 9059 if (!hash_value) 9060 return; 9061 } 9062 ksmbd_gen_preauth_integrity_hash(conn, work->response_buf, 9063 hash_value); 9064 } 9065 } 9066 9067 static void fill_transform_hdr(void *tr_buf, char *old_buf, __le16 cipher_type) 9068 { 9069 struct smb2_transform_hdr *tr_hdr = tr_buf + 4; 9070 struct smb2_hdr *hdr = smb_get_msg(old_buf); 9071 unsigned int orig_len = get_rfc1002_len(old_buf); 9072 9073 /* tr_buf must be cleared by the caller */ 9074 tr_hdr->ProtocolId = SMB2_TRANSFORM_PROTO_NUM; 9075 tr_hdr->OriginalMessageSize = cpu_to_le32(orig_len); 9076 tr_hdr->Flags = cpu_to_le16(TRANSFORM_FLAG_ENCRYPTED); 9077 if (cipher_type == SMB2_ENCRYPTION_AES128_GCM || 9078 cipher_type == SMB2_ENCRYPTION_AES256_GCM) 9079 get_random_bytes(&tr_hdr->Nonce, SMB3_AES_GCM_NONCE); 9080 else 9081 get_random_bytes(&tr_hdr->Nonce, SMB3_AES_CCM_NONCE); 9082 memcpy(&tr_hdr->SessionId, &hdr->SessionId, 8); 9083 inc_rfc1001_len(tr_buf, sizeof(struct smb2_transform_hdr)); 9084 inc_rfc1001_len(tr_buf, orig_len); 9085 } 9086 9087 int smb3_encrypt_resp(struct ksmbd_work *work) 9088 { 9089 struct kvec *iov = work->iov; 9090 int rc = -ENOMEM; 9091 void *tr_buf; 9092 9093 tr_buf = kzalloc(sizeof(struct smb2_transform_hdr) + 4, KSMBD_DEFAULT_GFP); 9094 if (!tr_buf) 9095 return rc; 9096 9097 /* fill transform header */ 9098 fill_transform_hdr(tr_buf, work->response_buf, work->conn->cipher_type); 9099 9100 iov[0].iov_base = tr_buf; 9101 iov[0].iov_len = sizeof(struct smb2_transform_hdr) + 4; 9102 work->tr_buf = tr_buf; 9103 9104 return ksmbd_crypt_message(work, iov, work->iov_idx + 1, 1); 9105 } 9106 9107 bool smb3_is_transform_hdr(void *buf) 9108 { 9109 struct smb2_transform_hdr *trhdr = smb_get_msg(buf); 9110 9111 return trhdr->ProtocolId == SMB2_TRANSFORM_PROTO_NUM; 9112 } 9113 9114 int smb3_decrypt_req(struct ksmbd_work *work) 9115 { 9116 struct ksmbd_session *sess; 9117 char *buf = work->request_buf; 9118 unsigned int pdu_length = get_rfc1002_len(buf); 9119 struct kvec iov[2]; 9120 int buf_data_size = pdu_length - sizeof(struct smb2_transform_hdr); 9121 struct smb2_transform_hdr *tr_hdr = smb_get_msg(buf); 9122 int rc = 0; 9123 9124 if (pdu_length < sizeof(struct smb2_transform_hdr) || 9125 buf_data_size < sizeof(struct smb2_hdr)) { 9126 pr_err("Transform message is too small (%u)\n", 9127 pdu_length); 9128 return -ECONNABORTED; 9129 } 9130 9131 if (buf_data_size < le32_to_cpu(tr_hdr->OriginalMessageSize)) { 9132 pr_err("Transform message is broken\n"); 9133 return -ECONNABORTED; 9134 } 9135 9136 sess = ksmbd_session_lookup_all(work->conn, le64_to_cpu(tr_hdr->SessionId)); 9137 if (!sess) { 9138 pr_err("invalid session id(%llx) in transform header\n", 9139 le64_to_cpu(tr_hdr->SessionId)); 9140 return -ECONNABORTED; 9141 } 9142 ksmbd_user_session_put(sess); 9143 9144 iov[0].iov_base = buf; 9145 iov[0].iov_len = sizeof(struct smb2_transform_hdr) + 4; 9146 iov[1].iov_base = buf + sizeof(struct smb2_transform_hdr) + 4; 9147 iov[1].iov_len = buf_data_size; 9148 rc = ksmbd_crypt_message(work, iov, 2, 0); 9149 if (rc) 9150 return rc; 9151 9152 memmove(buf + 4, iov[1].iov_base, buf_data_size); 9153 *(__be32 *)buf = cpu_to_be32(buf_data_size); 9154 9155 return rc; 9156 } 9157 9158 bool smb3_11_final_sess_setup_resp(struct ksmbd_work *work) 9159 { 9160 struct ksmbd_conn *conn = work->conn; 9161 struct ksmbd_session *sess = work->sess; 9162 struct smb2_hdr *rsp = smb_get_msg(work->response_buf); 9163 9164 if (conn->dialect < SMB30_PROT_ID) 9165 return false; 9166 9167 if (work->next_smb2_rcv_hdr_off) 9168 rsp = ksmbd_resp_buf_next(work); 9169 9170 if (le16_to_cpu(rsp->Command) == SMB2_SESSION_SETUP_HE && 9171 sess->user && !user_guest(sess->user) && 9172 rsp->Status == STATUS_SUCCESS) 9173 return true; 9174 return false; 9175 } 9176