1 // SPDX-License-Identifier: GPL-2.0-or-later 2 /* 3 * Copyright (C) 2018 Samsung Electronics Co., Ltd. 4 * Copyright (C) 2018 Namjae Jeon <linkinjeon@kernel.org> 5 */ 6 7 #include <linux/user_namespace.h> 8 9 #include "smb_common.h" 10 #include "server.h" 11 #include "misc.h" 12 #include "../common/smb2status.h" 13 #include "connection.h" 14 #include "ksmbd_work.h" 15 #include "mgmt/user_session.h" 16 #include "mgmt/user_config.h" 17 #include "mgmt/tree_connect.h" 18 #include "mgmt/share_config.h" 19 20 /*for shortname implementation */ 21 static const char *basechars = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ_-!@#$%"; 22 #define MANGLE_BASE (strlen(basechars) - 1) 23 #define MAGIC_CHAR '~' 24 #define PERIOD '.' 25 #define mangle(V) ((char)(basechars[(V) % MANGLE_BASE])) 26 27 struct smb_protocol { 28 int index; 29 char *name; 30 char *prot; 31 __u16 prot_id; 32 }; 33 34 static struct smb_protocol smb1_protos[] = { 35 { 36 SMB21_PROT, 37 "\2SMB 2.1", 38 "SMB2_10", 39 SMB21_PROT_ID 40 }, 41 { 42 SMB2X_PROT, 43 "\2SMB 2.???", 44 "SMB2_22", 45 SMB2X_PROT_ID 46 }, 47 }; 48 49 static struct smb_protocol smb2_protos[] = { 50 { 51 SMB21_PROT, 52 "\2SMB 2.1", 53 "SMB2_10", 54 SMB21_PROT_ID 55 }, 56 { 57 SMB30_PROT, 58 "\2SMB 3.0", 59 "SMB3_00", 60 SMB30_PROT_ID 61 }, 62 { 63 SMB302_PROT, 64 "\2SMB 3.02", 65 "SMB3_02", 66 SMB302_PROT_ID 67 }, 68 { 69 SMB311_PROT, 70 "\2SMB 3.1.1", 71 "SMB3_11", 72 SMB311_PROT_ID 73 }, 74 }; 75 76 unsigned int ksmbd_server_side_copy_max_chunk_count(void) 77 { 78 return 256; 79 } 80 81 unsigned int ksmbd_server_side_copy_max_chunk_size(void) 82 { 83 return (2U << 30) - 1; 84 } 85 86 unsigned int ksmbd_server_side_copy_max_total_size(void) 87 { 88 return (2U << 30) - 1; 89 } 90 91 inline int ksmbd_min_protocol(void) 92 { 93 return SMB21_PROT; 94 } 95 96 inline int ksmbd_max_protocol(void) 97 { 98 return SMB311_PROT; 99 } 100 101 static const struct { 102 int version; 103 const char *string; 104 } version_strings[] = { 105 {SMB2_PROT, SMB20_VERSION_STRING}, 106 {SMB21_PROT, SMB21_VERSION_STRING}, 107 {SMB30_PROT, SMB30_VERSION_STRING}, 108 {SMB302_PROT, SMB302_VERSION_STRING}, 109 {SMB311_PROT, SMB311_VERSION_STRING}, 110 }; 111 112 const char *ksmbd_get_protocol_string(int version) 113 { 114 int i; 115 116 for (i = 0; i < ARRAY_SIZE(version_strings); i++) { 117 if (version_strings[i].version == version) 118 return version_strings[i].string; 119 } 120 return ""; 121 } 122 int ksmbd_lookup_protocol_idx(char *str) 123 { 124 int offt = ARRAY_SIZE(smb1_protos) - 1; 125 int len = strlen(str); 126 127 while (offt >= 0) { 128 if (!strncmp(str, smb1_protos[offt].prot, len)) { 129 ksmbd_debug(SMB, "selected %s dialect idx = %d\n", 130 smb1_protos[offt].prot, offt); 131 return smb1_protos[offt].index; 132 } 133 offt--; 134 } 135 136 offt = ARRAY_SIZE(smb2_protos) - 1; 137 while (offt >= 0) { 138 if (!strncmp(str, smb2_protos[offt].prot, len)) { 139 ksmbd_debug(SMB, "selected %s dialect idx = %d\n", 140 smb2_protos[offt].prot, offt); 141 return smb2_protos[offt].index; 142 } 143 offt--; 144 } 145 return -1; 146 } 147 148 /** 149 * ksmbd_verify_smb_message() - check for valid smb2 request header 150 * @work: smb work 151 * 152 * check for valid smb signature and packet direction(request/response) 153 * 154 * Return: 0 on success, otherwise -EINVAL 155 */ 156 int ksmbd_verify_smb_message(struct ksmbd_work *work) 157 { 158 struct smb2_hdr *smb2_hdr = ksmbd_req_buf_next(work); 159 struct smb_hdr *hdr; 160 161 if (smb2_hdr->ProtocolId == SMB2_PROTO_NUMBER) 162 return ksmbd_smb2_check_message(work); 163 164 hdr = smb_get_msg(work->request_buf); 165 if (*(__le32 *)hdr->Protocol == SMB1_PROTO_NUMBER && 166 hdr->Command == SMB_COM_NEGOTIATE) { 167 work->conn->outstanding_credits++; 168 return 0; 169 } 170 171 return -EINVAL; 172 } 173 174 /** 175 * ksmbd_smb_request() - check for valid smb request type 176 * @conn: connection instance 177 * 178 * Return: true on success, otherwise false 179 */ 180 bool ksmbd_smb_request(struct ksmbd_conn *conn) 181 { 182 __le32 *proto; 183 184 if (conn->request_buf[0] != 0) 185 return false; 186 187 proto = (__le32 *)smb_get_msg(conn->request_buf); 188 if (*proto != SMB1_PROTO_NUMBER && 189 *proto != SMB2_PROTO_NUMBER && 190 *proto != SMB2_TRANSFORM_PROTO_NUM) 191 return false; 192 193 return true; 194 } 195 196 static bool supported_protocol(int idx) 197 { 198 if (idx == SMB2X_PROT && 199 (server_conf.min_protocol >= SMB21_PROT || 200 server_conf.max_protocol <= SMB311_PROT)) 201 return true; 202 203 return (server_conf.min_protocol <= idx && 204 idx <= server_conf.max_protocol); 205 } 206 207 static char *next_dialect(char *dialect, int *next_off, int bcount) 208 { 209 dialect = dialect + *next_off; 210 *next_off = strnlen(dialect, bcount); 211 if (dialect[*next_off] != '\0') 212 return NULL; 213 return dialect; 214 } 215 216 static int ksmbd_lookup_dialect_by_name(char *cli_dialects, __le16 byte_count) 217 { 218 int i, seq_num, bcount, next; 219 char *dialect; 220 221 for (i = ARRAY_SIZE(smb1_protos) - 1; i >= 0; i--) { 222 seq_num = 0; 223 next = 0; 224 dialect = cli_dialects; 225 bcount = le16_to_cpu(byte_count); 226 do { 227 dialect = next_dialect(dialect, &next, bcount); 228 if (!dialect) 229 break; 230 ksmbd_debug(SMB, "client requested dialect %s\n", 231 dialect); 232 if (!strcmp(dialect, smb1_protos[i].name)) { 233 if (supported_protocol(smb1_protos[i].index)) { 234 ksmbd_debug(SMB, 235 "selected %s dialect\n", 236 smb1_protos[i].name); 237 if (smb1_protos[i].index == SMB1_PROT) 238 return seq_num; 239 return smb1_protos[i].prot_id; 240 } 241 } 242 seq_num++; 243 bcount -= (++next); 244 } while (bcount > 0); 245 } 246 247 return BAD_PROT_ID; 248 } 249 250 int ksmbd_lookup_dialect_by_id(__le16 *cli_dialects, __le16 dialects_count) 251 { 252 int i; 253 int count; 254 255 for (i = ARRAY_SIZE(smb2_protos) - 1; i >= 0; i--) { 256 count = le16_to_cpu(dialects_count); 257 while (--count >= 0) { 258 ksmbd_debug(SMB, "client requested dialect 0x%x\n", 259 le16_to_cpu(cli_dialects[count])); 260 if (le16_to_cpu(cli_dialects[count]) != 261 smb2_protos[i].prot_id) 262 continue; 263 264 if (supported_protocol(smb2_protos[i].index)) { 265 ksmbd_debug(SMB, "selected %s dialect\n", 266 smb2_protos[i].name); 267 return smb2_protos[i].prot_id; 268 } 269 } 270 } 271 272 return BAD_PROT_ID; 273 } 274 275 static int ksmbd_negotiate_smb_dialect(void *buf) 276 { 277 int smb_buf_length = get_rfc1002_len(buf); 278 __le32 proto = ((struct smb2_hdr *)smb_get_msg(buf))->ProtocolId; 279 280 if (proto == SMB2_PROTO_NUMBER) { 281 struct smb2_negotiate_req *req; 282 int smb2_neg_size = 283 offsetof(struct smb2_negotiate_req, Dialects); 284 285 req = (struct smb2_negotiate_req *)smb_get_msg(buf); 286 if (smb2_neg_size > smb_buf_length) 287 goto err_out; 288 289 if (struct_size(req, Dialects, le16_to_cpu(req->DialectCount)) > 290 smb_buf_length) 291 goto err_out; 292 293 return ksmbd_lookup_dialect_by_id(req->Dialects, 294 req->DialectCount); 295 } 296 297 if (proto == SMB1_PROTO_NUMBER) { 298 struct smb_negotiate_req *req; 299 300 req = (struct smb_negotiate_req *)smb_get_msg(buf); 301 if (le16_to_cpu(req->ByteCount) < 2) 302 goto err_out; 303 304 if (offsetof(struct smb_negotiate_req, DialectsArray) + 305 le16_to_cpu(req->ByteCount) > smb_buf_length) { 306 goto err_out; 307 } 308 309 return ksmbd_lookup_dialect_by_name(req->DialectsArray, 310 req->ByteCount); 311 } 312 313 err_out: 314 return BAD_PROT_ID; 315 } 316 317 #define SMB_COM_NEGOTIATE_EX 0x0 318 319 /** 320 * get_smb1_cmd_val() - get smb command value from smb header 321 * @work: smb work containing smb header 322 * 323 * Return: smb command value 324 */ 325 static u16 get_smb1_cmd_val(struct ksmbd_work *work) 326 { 327 return SMB_COM_NEGOTIATE_EX; 328 } 329 330 /** 331 * init_smb1_rsp_hdr() - initialize smb negotiate response header 332 * @work: smb work containing smb request 333 * 334 * Return: 0 on success, otherwise -EINVAL 335 */ 336 static int init_smb1_rsp_hdr(struct ksmbd_work *work) 337 { 338 struct smb_hdr *rsp_hdr = (struct smb_hdr *)smb_get_msg(work->response_buf); 339 struct smb_hdr *rcv_hdr = (struct smb_hdr *)smb_get_msg(work->request_buf); 340 341 rsp_hdr->Command = SMB_COM_NEGOTIATE; 342 *(__le32 *)rsp_hdr->Protocol = SMB1_PROTO_NUMBER; 343 rsp_hdr->Flags = SMBFLG_RESPONSE; 344 rsp_hdr->Flags2 = SMBFLG2_UNICODE | SMBFLG2_ERR_STATUS | 345 SMBFLG2_EXT_SEC | SMBFLG2_IS_LONG_NAME; 346 rsp_hdr->Pid = rcv_hdr->Pid; 347 rsp_hdr->Mid = rcv_hdr->Mid; 348 return 0; 349 } 350 351 /** 352 * smb1_check_user_session() - check for valid session for a user 353 * @work: smb work containing smb request buffer 354 * 355 * Return: 0 on success, otherwise error 356 */ 357 static int smb1_check_user_session(struct ksmbd_work *work) 358 { 359 unsigned int cmd = work->conn->ops->get_cmd_val(work); 360 361 if (cmd == SMB_COM_NEGOTIATE_EX) 362 return 0; 363 364 return -EINVAL; 365 } 366 367 /** 368 * smb1_allocate_rsp_buf() - allocate response buffer for a command 369 * @work: smb work containing smb request 370 * 371 * Return: 0 on success, otherwise -ENOMEM 372 */ 373 static int smb1_allocate_rsp_buf(struct ksmbd_work *work) 374 { 375 work->response_buf = kzalloc(MAX_CIFS_SMALL_BUFFER_SIZE, 376 KSMBD_DEFAULT_GFP); 377 work->response_sz = MAX_CIFS_SMALL_BUFFER_SIZE; 378 379 if (!work->response_buf) { 380 pr_err("Failed to allocate %u bytes buffer\n", 381 MAX_CIFS_SMALL_BUFFER_SIZE); 382 return -ENOMEM; 383 } 384 385 return 0; 386 } 387 388 /** 389 * set_smb1_rsp_status() - set error type in smb response header 390 * @work: smb work containing smb response header 391 * @err: error code to set in response 392 */ 393 static void set_smb1_rsp_status(struct ksmbd_work *work, __le32 err) 394 { 395 work->send_no_response = 1; 396 } 397 398 static struct smb_version_ops smb1_server_ops = { 399 .get_cmd_val = get_smb1_cmd_val, 400 .init_rsp_hdr = init_smb1_rsp_hdr, 401 .allocate_rsp_buf = smb1_allocate_rsp_buf, 402 .check_user_session = smb1_check_user_session, 403 .set_rsp_status = set_smb1_rsp_status, 404 }; 405 406 static struct smb_version_values smb1_server_values = { 407 .max_credits = SMB2_MAX_CREDITS, 408 }; 409 410 static int smb1_negotiate(struct ksmbd_work *work) 411 { 412 return ksmbd_smb_negotiate_common(work, SMB_COM_NEGOTIATE); 413 } 414 415 static struct smb_version_cmds smb1_server_cmds[1] = { 416 [SMB_COM_NEGOTIATE_EX] = { .proc = smb1_negotiate, }, 417 }; 418 419 static int init_smb1_server(struct ksmbd_conn *conn) 420 { 421 conn->vals = &smb1_server_values; 422 conn->ops = &smb1_server_ops; 423 conn->cmds = smb1_server_cmds; 424 conn->max_cmds = ARRAY_SIZE(smb1_server_cmds); 425 return 0; 426 } 427 428 int ksmbd_init_smb_server(struct ksmbd_conn *conn) 429 { 430 struct smb_hdr *rcv_hdr = (struct smb_hdr *)smb_get_msg(conn->request_buf); 431 __le32 proto; 432 433 proto = *(__le32 *)rcv_hdr->Protocol; 434 if (conn->need_neg == false) { 435 if (proto == SMB1_PROTO_NUMBER) 436 return -EINVAL; 437 return 0; 438 } 439 440 if (proto == SMB1_PROTO_NUMBER) 441 return init_smb1_server(conn); 442 return init_smb3_11_server(conn); 443 } 444 445 int ksmbd_populate_dot_dotdot_entries(struct ksmbd_work *work, int info_level, 446 struct ksmbd_file *dir, 447 struct ksmbd_dir_info *d_info, 448 char *search_pattern, 449 int (*fn)(struct ksmbd_conn *, int, 450 struct ksmbd_dir_info *, 451 struct ksmbd_kstat *)) 452 { 453 int i, rc = 0; 454 struct ksmbd_conn *conn = work->conn; 455 struct mnt_idmap *idmap = file_mnt_idmap(dir->filp); 456 457 for (i = 0; i < 2; i++) { 458 struct kstat kstat; 459 struct ksmbd_kstat ksmbd_kstat; 460 struct dentry *dentry; 461 462 if (!dir->dot_dotdot[i]) { /* fill dot entry info */ 463 if (i == 0) { 464 d_info->name = "."; 465 d_info->name_len = 1; 466 dentry = dir->filp->f_path.dentry; 467 } else { 468 d_info->name = ".."; 469 d_info->name_len = 2; 470 dentry = dir->filp->f_path.dentry->d_parent; 471 } 472 473 if (!match_pattern(d_info->name, d_info->name_len, 474 search_pattern)) { 475 dir->dot_dotdot[i] = 1; 476 continue; 477 } 478 479 ksmbd_kstat.kstat = &kstat; 480 rc = ksmbd_vfs_fill_dentry_attrs(work, 481 idmap, 482 dentry, 483 &ksmbd_kstat); 484 if (rc) 485 break; 486 487 rc = fn(conn, info_level, d_info, &ksmbd_kstat); 488 if (rc) 489 break; 490 if (d_info->out_buf_len <= 0) 491 break; 492 493 dir->dot_dotdot[i] = 1; 494 if (d_info->flags & SMB2_RETURN_SINGLE_ENTRY) { 495 d_info->out_buf_len = 0; 496 break; 497 } 498 } 499 } 500 501 return rc; 502 } 503 504 /** 505 * ksmbd_extract_shortname() - get shortname from long filename 506 * @conn: connection instance 507 * @longname: source long filename 508 * @shortname: destination short filename 509 * 510 * Return: shortname length or 0 when source long name is '.' or '..' 511 * TODO: Though this function conforms the restriction of 8.3 Filename spec, 512 * but the result is different with Windows 7's one. need to check. 513 */ 514 int ksmbd_extract_shortname(struct ksmbd_conn *conn, const char *longname, 515 char *shortname) 516 { 517 const char *p; 518 char base[9], extension[4]; 519 char out[13] = {0}; 520 int baselen = 0; 521 int extlen = 0, len = 0; 522 unsigned int csum = 0; 523 const unsigned char *ptr; 524 bool dot_present = true; 525 526 p = longname; 527 if ((*p == '.') || (!(strcmp(p, "..")))) { 528 /*no mangling required */ 529 return 0; 530 } 531 532 p = strrchr(longname, '.'); 533 if (p == longname) { /*name starts with a dot*/ 534 strscpy(extension, "___", sizeof(extension)); 535 } else { 536 if (p) { 537 p++; 538 while (*p && extlen < 3) { 539 if (*p != '.') 540 extension[extlen++] = toupper(*p); 541 p++; 542 } 543 extension[extlen] = '\0'; 544 } else { 545 dot_present = false; 546 } 547 } 548 549 p = longname; 550 if (*p == '.') { 551 p++; 552 longname++; 553 } 554 while (*p && (baselen < 5)) { 555 if (*p != '.') 556 base[baselen++] = toupper(*p); 557 p++; 558 } 559 560 base[baselen] = MAGIC_CHAR; 561 memcpy(out, base, baselen + 1); 562 563 ptr = longname; 564 len = strlen(longname); 565 for (; len > 0; len--, ptr++) 566 csum += *ptr; 567 568 csum = csum % (MANGLE_BASE * MANGLE_BASE); 569 out[baselen + 1] = mangle(csum / MANGLE_BASE); 570 out[baselen + 2] = mangle(csum); 571 out[baselen + 3] = PERIOD; 572 573 if (dot_present) 574 memcpy(out + baselen + 4, extension, 4); 575 else 576 out[baselen + 4] = '\0'; 577 smbConvertToUTF16((__le16 *)shortname, out, PATH_MAX, 578 conn->local_nls, 0); 579 len = strlen(out) * 2; 580 return len; 581 } 582 583 static int __smb2_negotiate(struct ksmbd_conn *conn) 584 { 585 return (conn->dialect >= SMB20_PROT_ID && 586 conn->dialect <= SMB311_PROT_ID); 587 } 588 589 static int smb_handle_negotiate(struct ksmbd_work *work) 590 { 591 struct smb_negotiate_rsp *neg_rsp = smb_get_msg(work->response_buf); 592 593 ksmbd_debug(SMB, "Unsupported SMB1 protocol\n"); 594 595 if (ksmbd_iov_pin_rsp(work, (void *)neg_rsp, 596 sizeof(struct smb_negotiate_rsp))) 597 return -ENOMEM; 598 599 neg_rsp->hdr.Status.CifsError = STATUS_SUCCESS; 600 neg_rsp->hdr.WordCount = 1; 601 neg_rsp->DialectIndex = cpu_to_le16(work->conn->dialect); 602 neg_rsp->ByteCount = 0; 603 return 0; 604 } 605 606 int ksmbd_smb_negotiate_common(struct ksmbd_work *work, unsigned int command) 607 { 608 struct ksmbd_conn *conn = work->conn; 609 int ret; 610 611 if (command == SMB2_NEGOTIATE_HE) { 612 /* 613 * An SMB2 NEGOTIATE is valid for a new connection, or after an 614 * SMB1 multi-protocol negotiate has selected SMB2. Do not allow 615 * a second SMB2 NEGOTIATE to replace connection-wide state 616 * while a session setup is pending. KSMBD_SESS_NEED_RECONNECT 617 * is a transient session state and does not restart transport 618 * negotiation. 619 */ 620 ksmbd_conn_lock(conn); 621 if (!ksmbd_conn_new(conn) && 622 !ksmbd_conn_need_negotiate(conn)) { 623 work->send_no_response = 1; 624 ksmbd_conn_set_exiting(conn); 625 ksmbd_conn_unlock(conn); 626 return 0; 627 } 628 629 conn->dialect = 630 ksmbd_negotiate_smb_dialect(work->request_buf); 631 ksmbd_debug(SMB, "conn->dialect 0x%x\n", conn->dialect); 632 ret = smb2_handle_negotiate(work); 633 ksmbd_conn_unlock(conn); 634 return ret; 635 } 636 637 if (command == SMB_COM_NEGOTIATE) { 638 ksmbd_conn_lock(conn); 639 conn->dialect = 640 ksmbd_negotiate_smb_dialect(work->request_buf); 641 ksmbd_debug(SMB, "conn->dialect 0x%x\n", conn->dialect); 642 if (__smb2_negotiate(conn)) { 643 init_smb3_11_server(conn); 644 ret = init_smb2_neg_rsp(work); 645 ksmbd_debug(SMB, "Upgrade to SMB2 negotiation\n"); 646 } else { 647 ret = smb_handle_negotiate(work); 648 } 649 ksmbd_conn_unlock(conn); 650 return ret; 651 } 652 653 pr_err("Unknown SMB negotiation command: %u\n", command); 654 return -EINVAL; 655 } 656 657 enum SHARED_MODE_ERRORS { 658 SHARE_DELETE_ERROR, 659 SHARE_READ_ERROR, 660 SHARE_WRITE_ERROR, 661 FILE_READ_ERROR, 662 FILE_WRITE_ERROR, 663 FILE_DELETE_ERROR, 664 }; 665 666 static const char * const shared_mode_errors[] = { 667 "Current access mode does not permit SHARE_DELETE", 668 "Current access mode does not permit SHARE_READ", 669 "Current access mode does not permit SHARE_WRITE", 670 "Desired access mode does not permit FILE_READ", 671 "Desired access mode does not permit FILE_WRITE", 672 "Desired access mode does not permit FILE_DELETE", 673 }; 674 675 static void smb_shared_mode_error(int error, struct ksmbd_file *prev_fp, 676 struct ksmbd_file *curr_fp) 677 { 678 ksmbd_debug(SMB, "%s\n", shared_mode_errors[error]); 679 ksmbd_debug(SMB, "Current mode: 0x%x Desired mode: 0x%x\n", 680 prev_fp->saccess, curr_fp->daccess); 681 } 682 683 int ksmbd_smb_check_shared_mode(struct file *filp, struct ksmbd_file *curr_fp) 684 { 685 int rc = 0; 686 struct ksmbd_file *prev_fp; 687 688 /* 689 * Lookup fp in master fp list, and check desired access and 690 * shared mode between previous open and current open. 691 */ 692 down_read(&curr_fp->f_ci->m_lock); 693 list_for_each_entry(prev_fp, &curr_fp->f_ci->m_fp_list, node) { 694 if (file_inode(filp) != file_inode(prev_fp->filp)) 695 continue; 696 697 if (filp == prev_fp->filp) 698 continue; 699 700 if (ksmbd_stream_fd(prev_fp) && ksmbd_stream_fd(curr_fp)) 701 if (strcmp(prev_fp->stream.name, curr_fp->stream.name)) 702 continue; 703 704 if (prev_fp->attrib_only != curr_fp->attrib_only) 705 continue; 706 707 if (!(prev_fp->saccess & FILE_SHARE_DELETE_LE) && 708 curr_fp->daccess & FILE_DELETE_LE) { 709 smb_shared_mode_error(SHARE_DELETE_ERROR, 710 prev_fp, 711 curr_fp); 712 rc = -EPERM; 713 break; 714 } 715 716 /* 717 * Only check FILE_SHARE_DELETE if stream opened and 718 * normal file opened. 719 */ 720 if (ksmbd_stream_fd(prev_fp) && !ksmbd_stream_fd(curr_fp)) 721 continue; 722 723 if (!(prev_fp->saccess & FILE_SHARE_READ_LE) && 724 curr_fp->daccess & (FILE_EXECUTE_LE | FILE_READ_DATA_LE)) { 725 smb_shared_mode_error(SHARE_READ_ERROR, 726 prev_fp, 727 curr_fp); 728 rc = -EPERM; 729 break; 730 } 731 732 if (!(prev_fp->saccess & FILE_SHARE_WRITE_LE) && 733 curr_fp->daccess & (FILE_WRITE_DATA_LE | FILE_APPEND_DATA_LE)) { 734 smb_shared_mode_error(SHARE_WRITE_ERROR, 735 prev_fp, 736 curr_fp); 737 rc = -EPERM; 738 break; 739 } 740 741 if (prev_fp->daccess & (FILE_EXECUTE_LE | FILE_READ_DATA_LE) && 742 !(curr_fp->saccess & FILE_SHARE_READ_LE)) { 743 smb_shared_mode_error(FILE_READ_ERROR, 744 prev_fp, 745 curr_fp); 746 rc = -EPERM; 747 break; 748 } 749 750 if (prev_fp->daccess & (FILE_WRITE_DATA_LE | FILE_APPEND_DATA_LE) && 751 !(curr_fp->saccess & FILE_SHARE_WRITE_LE)) { 752 smb_shared_mode_error(FILE_WRITE_ERROR, 753 prev_fp, 754 curr_fp); 755 rc = -EPERM; 756 break; 757 } 758 759 if (prev_fp->daccess & FILE_DELETE_LE && 760 !(curr_fp->saccess & FILE_SHARE_DELETE_LE)) { 761 smb_shared_mode_error(FILE_DELETE_ERROR, 762 prev_fp, 763 curr_fp); 764 rc = -EPERM; 765 break; 766 } 767 } 768 up_read(&curr_fp->f_ci->m_lock); 769 770 return rc; 771 } 772 773 bool is_asterisk(char *p) 774 { 775 return p && p[0] == '*'; 776 } 777 778 int __ksmbd_override_fsids(struct ksmbd_work *work, 779 struct ksmbd_share_config *share) 780 { 781 struct ksmbd_session *sess = work->sess; 782 struct ksmbd_user *user = sess->user; 783 struct cred *cred; 784 struct group_info *gi; 785 unsigned int uid; 786 unsigned int gid; 787 int i; 788 789 uid = user_uid(user); 790 gid = user_gid(user); 791 if (share->force_uid != KSMBD_SHARE_INVALID_UID) 792 uid = share->force_uid; 793 if (share->force_gid != KSMBD_SHARE_INVALID_GID) 794 gid = share->force_gid; 795 796 cred = prepare_kernel_cred(&init_task); 797 if (!cred) 798 return -ENOMEM; 799 800 cred->fsuid = make_kuid(&init_user_ns, uid); 801 cred->fsgid = make_kgid(&init_user_ns, gid); 802 803 gi = groups_alloc(user->ngroups); 804 if (!gi) { 805 abort_creds(cred); 806 return -ENOMEM; 807 } 808 809 for (i = 0; i < user->ngroups; i++) 810 gi->gid[i] = make_kgid(&init_user_ns, user->sgid[i]); 811 812 if (user->ngroups) 813 groups_sort(gi); 814 815 set_groups(cred, gi); 816 put_group_info(gi); 817 818 if (!uid_eq(cred->fsuid, GLOBAL_ROOT_UID)) 819 cred->cap_effective = cap_drop_fs_set(cred->cap_effective); 820 821 WARN_ON(work->saved_cred); 822 work->saved_cred = override_creds(cred); 823 return 0; 824 } 825 826 int ksmbd_override_fsids(struct ksmbd_work *work) 827 { 828 return __ksmbd_override_fsids(work, work->tcon->share_conf); 829 } 830 831 void ksmbd_revert_fsids(struct ksmbd_work *work) 832 { 833 const struct cred *cred; 834 WARN_ON(!work->saved_cred); 835 836 cred = revert_creds(work->saved_cred); 837 work->saved_cred = NULL; 838 put_cred(cred); 839 } 840 841 __le32 smb_map_generic_desired_access(__le32 daccess) 842 { 843 if (daccess & FILE_GENERIC_READ_LE) { 844 daccess |= cpu_to_le32(GENERIC_READ_FLAGS); 845 daccess &= ~FILE_GENERIC_READ_LE; 846 } 847 848 if (daccess & FILE_GENERIC_WRITE_LE) { 849 daccess |= cpu_to_le32(GENERIC_WRITE_FLAGS); 850 daccess &= ~FILE_GENERIC_WRITE_LE; 851 } 852 853 if (daccess & FILE_GENERIC_EXECUTE_LE) { 854 daccess |= cpu_to_le32(GENERIC_EXECUTE_FLAGS); 855 daccess &= ~FILE_GENERIC_EXECUTE_LE; 856 } 857 858 if (daccess & FILE_GENERIC_ALL_LE) { 859 daccess |= cpu_to_le32(GENERIC_ALL_FLAGS); 860 daccess &= ~FILE_GENERIC_ALL_LE; 861 } 862 863 return daccess; 864 } 865