• Home
  • Line#
  • Scopes#
  • Navigate#
  • Raw
  • Download
1 // SPDX-License-Identifier: LGPL-2.1
2 /*
3  *
4  *   Copyright (C) International Business Machines  Corp., 2009, 2013
5  *                 Etersoft, 2012
6  *   Author(s): Steve French (sfrench@us.ibm.com)
7  *              Pavel Shilovsky (pshilovsky@samba.org) 2012
8  *
9  *   Contains the routines for constructing the SMB2 PDUs themselves
10  *
11  */
12 
13  /* SMB2 PDU handling routines here - except for leftovers (eg session setup) */
14  /* Note that there are handle based routines which must be		      */
15  /* treated slightly differently for reconnection purposes since we never     */
16  /* want to reuse a stale file handle and only the caller knows the file info */
17 
18 #include <linux/fs.h>
19 #include <linux/kernel.h>
20 #include <linux/vfs.h>
21 #include <linux/task_io_accounting_ops.h>
22 #include <linux/uaccess.h>
23 #include <linux/uuid.h>
24 #include <linux/pagemap.h>
25 #include <linux/xattr.h>
26 #include "smb2pdu.h"
27 #include "cifsglob.h"
28 #include "cifsacl.h"
29 #include "cifsproto.h"
30 #include "smb2proto.h"
31 #include "cifs_unicode.h"
32 #include "cifs_debug.h"
33 #include "ntlmssp.h"
34 #include "smb2status.h"
35 #include "smb2glob.h"
36 #include "cifspdu.h"
37 #include "cifs_spnego.h"
38 #include "smbdirect.h"
39 #include "trace.h"
40 #ifdef CONFIG_CIFS_DFS_UPCALL
41 #include "dfs_cache.h"
42 #endif
43 
44 /*
45  *  The following table defines the expected "StructureSize" of SMB2 requests
46  *  in order by SMB2 command.  This is similar to "wct" in SMB/CIFS requests.
47  *
48  *  Note that commands are defined in smb2pdu.h in le16 but the array below is
49  *  indexed by command in host byte order.
50  */
51 static const int smb2_req_struct_sizes[NUMBER_OF_SMB2_COMMANDS] = {
52 	/* SMB2_NEGOTIATE */ 36,
53 	/* SMB2_SESSION_SETUP */ 25,
54 	/* SMB2_LOGOFF */ 4,
55 	/* SMB2_TREE_CONNECT */	9,
56 	/* SMB2_TREE_DISCONNECT */ 4,
57 	/* SMB2_CREATE */ 57,
58 	/* SMB2_CLOSE */ 24,
59 	/* SMB2_FLUSH */ 24,
60 	/* SMB2_READ */	49,
61 	/* SMB2_WRITE */ 49,
62 	/* SMB2_LOCK */	48,
63 	/* SMB2_IOCTL */ 57,
64 	/* SMB2_CANCEL */ 4,
65 	/* SMB2_ECHO */ 4,
66 	/* SMB2_QUERY_DIRECTORY */ 33,
67 	/* SMB2_CHANGE_NOTIFY */ 32,
68 	/* SMB2_QUERY_INFO */ 41,
69 	/* SMB2_SET_INFO */ 33,
70 	/* SMB2_OPLOCK_BREAK */ 24 /* BB this is 36 for LEASE_BREAK variant */
71 };
72 
smb3_encryption_required(const struct cifs_tcon * tcon)73 int smb3_encryption_required(const struct cifs_tcon *tcon)
74 {
75 	if (!tcon || !tcon->ses)
76 		return 0;
77 	if ((tcon->ses->session_flags & SMB2_SESSION_FLAG_ENCRYPT_DATA) ||
78 	    (tcon->share_flags & SHI1005_FLAGS_ENCRYPT_DATA))
79 		return 1;
80 	if (tcon->seal &&
81 	    (tcon->ses->server->capabilities & SMB2_GLOBAL_CAP_ENCRYPTION))
82 		return 1;
83 	return 0;
84 }
85 
86 static void
smb2_hdr_assemble(struct smb2_sync_hdr * shdr,__le16 smb2_cmd,const struct cifs_tcon * tcon,struct TCP_Server_Info * server)87 smb2_hdr_assemble(struct smb2_sync_hdr *shdr, __le16 smb2_cmd,
88 		  const struct cifs_tcon *tcon,
89 		  struct TCP_Server_Info *server)
90 {
91 	shdr->ProtocolId = SMB2_PROTO_NUMBER;
92 	shdr->StructureSize = cpu_to_le16(64);
93 	shdr->Command = smb2_cmd;
94 	if (server) {
95 		spin_lock(&server->req_lock);
96 		/* Request up to 10 credits but don't go over the limit. */
97 		if (server->credits >= server->max_credits)
98 			shdr->CreditRequest = cpu_to_le16(0);
99 		else
100 			shdr->CreditRequest = cpu_to_le16(
101 				min_t(int, server->max_credits -
102 						server->credits, 10));
103 		spin_unlock(&server->req_lock);
104 	} else {
105 		shdr->CreditRequest = cpu_to_le16(2);
106 	}
107 	shdr->ProcessId = cpu_to_le32((__u16)current->tgid);
108 
109 	if (!tcon)
110 		goto out;
111 
112 	/* GLOBAL_CAP_LARGE_MTU will only be set if dialect > SMB2.02 */
113 	/* See sections 2.2.4 and 3.2.4.1.5 of MS-SMB2 */
114 	if (server && (server->capabilities & SMB2_GLOBAL_CAP_LARGE_MTU))
115 		shdr->CreditCharge = cpu_to_le16(1);
116 	/* else CreditCharge MBZ */
117 
118 	shdr->TreeId = tcon->tid;
119 	/* Uid is not converted */
120 	if (tcon->ses)
121 		shdr->SessionId = tcon->ses->Suid;
122 
123 	/*
124 	 * If we would set SMB2_FLAGS_DFS_OPERATIONS on open we also would have
125 	 * to pass the path on the Open SMB prefixed by \\server\share.
126 	 * Not sure when we would need to do the augmented path (if ever) and
127 	 * setting this flag breaks the SMB2 open operation since it is
128 	 * illegal to send an empty path name (without \\server\share prefix)
129 	 * when the DFS flag is set in the SMB open header. We could
130 	 * consider setting the flag on all operations other than open
131 	 * but it is safer to net set it for now.
132 	 */
133 /*	if (tcon->share_flags & SHI1005_FLAGS_DFS)
134 		shdr->Flags |= SMB2_FLAGS_DFS_OPERATIONS; */
135 
136 	if (server && server->sign && !smb3_encryption_required(tcon))
137 		shdr->Flags |= SMB2_FLAGS_SIGNED;
138 out:
139 	return;
140 }
141 
142 static int
smb2_reconnect(__le16 smb2_command,struct cifs_tcon * tcon,struct TCP_Server_Info * server)143 smb2_reconnect(__le16 smb2_command, struct cifs_tcon *tcon,
144 	       struct TCP_Server_Info *server)
145 {
146 	int rc;
147 	struct nls_table *nls_codepage;
148 	struct cifs_ses *ses;
149 	int retries;
150 
151 	/*
152 	 * SMB2s NegProt, SessSetup, Logoff do not have tcon yet so
153 	 * check for tcp and smb session status done differently
154 	 * for those three - in the calling routine.
155 	 */
156 	if (tcon == NULL)
157 		return 0;
158 
159 	/*
160 	 * Need to also skip SMB2_IOCTL because it is used for checking nested dfs links in
161 	 * cifs_tree_connect().
162 	 */
163 	if (smb2_command == SMB2_TREE_CONNECT || smb2_command == SMB2_IOCTL)
164 		return 0;
165 
166 	if (tcon->tidStatus == CifsExiting) {
167 		/*
168 		 * only tree disconnect, open, and write,
169 		 * (and ulogoff which does not have tcon)
170 		 * are allowed as we start force umount.
171 		 */
172 		if ((smb2_command != SMB2_WRITE) &&
173 		   (smb2_command != SMB2_CREATE) &&
174 		   (smb2_command != SMB2_TREE_DISCONNECT)) {
175 			cifs_dbg(FYI, "can not send cmd %d while umounting\n",
176 				 smb2_command);
177 			return -ENODEV;
178 		}
179 	}
180 	if ((!tcon->ses) || (tcon->ses->status == CifsExiting) ||
181 	    (!tcon->ses->server) || !server)
182 		return -EIO;
183 
184 	ses = tcon->ses;
185 	retries = server->nr_targets;
186 
187 	/*
188 	 * Give demultiplex thread up to 10 seconds to each target available for
189 	 * reconnect -- should be greater than cifs socket timeout which is 7
190 	 * seconds.
191 	 */
192 	while (server->tcpStatus == CifsNeedReconnect) {
193 		/*
194 		 * Return to caller for TREE_DISCONNECT and LOGOFF and CLOSE
195 		 * here since they are implicitly done when session drops.
196 		 */
197 		switch (smb2_command) {
198 		/*
199 		 * BB Should we keep oplock break and add flush to exceptions?
200 		 */
201 		case SMB2_TREE_DISCONNECT:
202 		case SMB2_CANCEL:
203 		case SMB2_CLOSE:
204 		case SMB2_OPLOCK_BREAK:
205 			return -EAGAIN;
206 		}
207 
208 		rc = wait_event_interruptible_timeout(server->response_q,
209 						      (server->tcpStatus != CifsNeedReconnect),
210 						      10 * HZ);
211 		if (rc < 0) {
212 			cifs_dbg(FYI, "%s: aborting reconnect due to a received signal by the process\n",
213 				 __func__);
214 			return -ERESTARTSYS;
215 		}
216 
217 		/* are we still trying to reconnect? */
218 		if (server->tcpStatus != CifsNeedReconnect)
219 			break;
220 
221 		if (retries && --retries)
222 			continue;
223 
224 		/*
225 		 * on "soft" mounts we wait once. Hard mounts keep
226 		 * retrying until process is killed or server comes
227 		 * back on-line
228 		 */
229 		if (!tcon->retry) {
230 			cifs_dbg(FYI, "gave up waiting on reconnect in smb_init\n");
231 			return -EHOSTDOWN;
232 		}
233 		retries = server->nr_targets;
234 	}
235 
236 	if (!tcon->ses->need_reconnect && !tcon->need_reconnect)
237 		return 0;
238 
239 	nls_codepage = load_nls_default();
240 
241 	/*
242 	 * need to prevent multiple threads trying to simultaneously reconnect
243 	 * the same SMB session
244 	 */
245 	mutex_lock(&tcon->ses->session_mutex);
246 
247 	/*
248 	 * Recheck after acquire mutex. If another thread is negotiating
249 	 * and the server never sends an answer the socket will be closed
250 	 * and tcpStatus set to reconnect.
251 	 */
252 	if (server->tcpStatus == CifsNeedReconnect) {
253 		rc = -EHOSTDOWN;
254 		mutex_unlock(&tcon->ses->session_mutex);
255 		goto out;
256 	}
257 
258 	/*
259 	 * If we are reconnecting an extra channel, bind
260 	 */
261 	if (server->is_channel) {
262 		ses->binding = true;
263 		ses->binding_chan = cifs_ses_find_chan(ses, server);
264 	}
265 
266 	rc = cifs_negotiate_protocol(0, tcon->ses);
267 	if (!rc && tcon->ses->need_reconnect) {
268 		rc = cifs_setup_session(0, tcon->ses, nls_codepage);
269 		if ((rc == -EACCES) && !tcon->retry) {
270 			rc = -EHOSTDOWN;
271 			ses->binding = false;
272 			ses->binding_chan = NULL;
273 			mutex_unlock(&tcon->ses->session_mutex);
274 			goto failed;
275 		} else if (rc) {
276 			mutex_unlock(&ses->session_mutex);
277 			goto out;
278 		}
279 	}
280 	/*
281 	 * End of channel binding
282 	 */
283 	ses->binding = false;
284 	ses->binding_chan = NULL;
285 
286 	if (rc || !tcon->need_reconnect) {
287 		mutex_unlock(&tcon->ses->session_mutex);
288 		goto out;
289 	}
290 
291 	cifs_mark_open_files_invalid(tcon);
292 	if (tcon->use_persistent)
293 		tcon->need_reopen_files = true;
294 
295 	rc = cifs_tree_connect(0, tcon, nls_codepage);
296 	mutex_unlock(&tcon->ses->session_mutex);
297 
298 	cifs_dbg(FYI, "reconnect tcon rc = %d\n", rc);
299 	if (rc) {
300 		/* If sess reconnected but tcon didn't, something strange ... */
301 		pr_warn_once("reconnect tcon failed rc = %d\n", rc);
302 		goto out;
303 	}
304 
305 	if (smb2_command != SMB2_INTERNAL_CMD)
306 		mod_delayed_work(cifsiod_wq, &server->reconnect, 0);
307 
308 	atomic_inc(&tconInfoReconnectCount);
309 out:
310 	/*
311 	 * Check if handle based operation so we know whether we can continue
312 	 * or not without returning to caller to reset file handle.
313 	 */
314 	/*
315 	 * BB Is flush done by server on drop of tcp session? Should we special
316 	 * case it and skip above?
317 	 */
318 	switch (smb2_command) {
319 	case SMB2_FLUSH:
320 	case SMB2_READ:
321 	case SMB2_WRITE:
322 	case SMB2_LOCK:
323 	case SMB2_IOCTL:
324 	case SMB2_QUERY_DIRECTORY:
325 	case SMB2_CHANGE_NOTIFY:
326 	case SMB2_QUERY_INFO:
327 	case SMB2_SET_INFO:
328 		rc = -EAGAIN;
329 	}
330 failed:
331 	unload_nls(nls_codepage);
332 	return rc;
333 }
334 
335 static void
fill_small_buf(__le16 smb2_command,struct cifs_tcon * tcon,struct TCP_Server_Info * server,void * buf,unsigned int * total_len)336 fill_small_buf(__le16 smb2_command, struct cifs_tcon *tcon,
337 	       struct TCP_Server_Info *server,
338 	       void *buf,
339 	       unsigned int *total_len)
340 {
341 	struct smb2_sync_pdu *spdu = (struct smb2_sync_pdu *)buf;
342 	/* lookup word count ie StructureSize from table */
343 	__u16 parmsize = smb2_req_struct_sizes[le16_to_cpu(smb2_command)];
344 
345 	/*
346 	 * smaller than SMALL_BUFFER_SIZE but bigger than fixed area of
347 	 * largest operations (Create)
348 	 */
349 	memset(buf, 0, 256);
350 
351 	smb2_hdr_assemble(&spdu->sync_hdr, smb2_command, tcon, server);
352 	spdu->StructureSize2 = cpu_to_le16(parmsize);
353 
354 	*total_len = parmsize + sizeof(struct smb2_sync_hdr);
355 }
356 
357 /*
358  * Allocate and return pointer to an SMB request hdr, and set basic
359  * SMB information in the SMB header. If the return code is zero, this
360  * function must have filled in request_buf pointer.
361  */
__smb2_plain_req_init(__le16 smb2_command,struct cifs_tcon * tcon,struct TCP_Server_Info * server,void ** request_buf,unsigned int * total_len)362 static int __smb2_plain_req_init(__le16 smb2_command, struct cifs_tcon *tcon,
363 				 struct TCP_Server_Info *server,
364 				 void **request_buf, unsigned int *total_len)
365 {
366 	/* BB eventually switch this to SMB2 specific small buf size */
367 	switch (smb2_command) {
368 	case SMB2_SET_INFO:
369 	case SMB2_QUERY_INFO:
370 		*request_buf = cifs_buf_get();
371 		break;
372 	default:
373 		*request_buf = cifs_small_buf_get();
374 		break;
375 	}
376 	if (*request_buf == NULL) {
377 		/* BB should we add a retry in here if not a writepage? */
378 		return -ENOMEM;
379 	}
380 
381 	fill_small_buf(smb2_command, tcon, server,
382 		       (struct smb2_sync_hdr *)(*request_buf),
383 		       total_len);
384 
385 	if (tcon != NULL) {
386 		uint16_t com_code = le16_to_cpu(smb2_command);
387 		cifs_stats_inc(&tcon->stats.smb2_stats.smb2_com_sent[com_code]);
388 		cifs_stats_inc(&tcon->num_smbs_sent);
389 	}
390 
391 	return 0;
392 }
393 
smb2_plain_req_init(__le16 smb2_command,struct cifs_tcon * tcon,struct TCP_Server_Info * server,void ** request_buf,unsigned int * total_len)394 static int smb2_plain_req_init(__le16 smb2_command, struct cifs_tcon *tcon,
395 			       struct TCP_Server_Info *server,
396 			       void **request_buf, unsigned int *total_len)
397 {
398 	int rc;
399 
400 	rc = smb2_reconnect(smb2_command, tcon, server);
401 	if (rc)
402 		return rc;
403 
404 	return __smb2_plain_req_init(smb2_command, tcon, server, request_buf,
405 				     total_len);
406 }
407 
smb2_ioctl_req_init(u32 opcode,struct cifs_tcon * tcon,struct TCP_Server_Info * server,void ** request_buf,unsigned int * total_len)408 static int smb2_ioctl_req_init(u32 opcode, struct cifs_tcon *tcon,
409 			       struct TCP_Server_Info *server,
410 			       void **request_buf, unsigned int *total_len)
411 {
412 	/* Skip reconnect only for FSCTL_VALIDATE_NEGOTIATE_INFO IOCTLs */
413 	if (opcode == FSCTL_VALIDATE_NEGOTIATE_INFO) {
414 		return __smb2_plain_req_init(SMB2_IOCTL, tcon, server,
415 					     request_buf, total_len);
416 	}
417 	return smb2_plain_req_init(SMB2_IOCTL, tcon, server,
418 				   request_buf, total_len);
419 }
420 
421 /* For explanation of negotiate contexts see MS-SMB2 section 2.2.3.1 */
422 
423 static void
build_preauth_ctxt(struct smb2_preauth_neg_context * pneg_ctxt)424 build_preauth_ctxt(struct smb2_preauth_neg_context *pneg_ctxt)
425 {
426 	pneg_ctxt->ContextType = SMB2_PREAUTH_INTEGRITY_CAPABILITIES;
427 	pneg_ctxt->DataLength = cpu_to_le16(38);
428 	pneg_ctxt->HashAlgorithmCount = cpu_to_le16(1);
429 	pneg_ctxt->SaltLength = cpu_to_le16(SMB311_LINUX_CLIENT_SALT_SIZE);
430 	get_random_bytes(pneg_ctxt->Salt, SMB311_LINUX_CLIENT_SALT_SIZE);
431 	pneg_ctxt->HashAlgorithms = SMB2_PREAUTH_INTEGRITY_SHA512;
432 }
433 
434 static void
build_compression_ctxt(struct smb2_compression_capabilities_context * pneg_ctxt)435 build_compression_ctxt(struct smb2_compression_capabilities_context *pneg_ctxt)
436 {
437 	pneg_ctxt->ContextType = SMB2_COMPRESSION_CAPABILITIES;
438 	pneg_ctxt->DataLength =
439 		cpu_to_le16(sizeof(struct smb2_compression_capabilities_context)
440 			  - sizeof(struct smb2_neg_context));
441 	pneg_ctxt->CompressionAlgorithmCount = cpu_to_le16(3);
442 	pneg_ctxt->CompressionAlgorithms[0] = SMB3_COMPRESS_LZ77;
443 	pneg_ctxt->CompressionAlgorithms[1] = SMB3_COMPRESS_LZ77_HUFF;
444 	pneg_ctxt->CompressionAlgorithms[2] = SMB3_COMPRESS_LZNT1;
445 }
446 
447 static unsigned int
build_signing_ctxt(struct smb2_signing_capabilities * pneg_ctxt)448 build_signing_ctxt(struct smb2_signing_capabilities *pneg_ctxt)
449 {
450 	unsigned int ctxt_len = sizeof(struct smb2_signing_capabilities);
451 	unsigned short num_algs = 1; /* number of signing algorithms sent */
452 
453 	pneg_ctxt->ContextType = SMB2_SIGNING_CAPABILITIES;
454 	/*
455 	 * Context Data length must be rounded to multiple of 8 for some servers
456 	 */
457 	pneg_ctxt->DataLength = cpu_to_le16(DIV_ROUND_UP(
458 				sizeof(struct smb2_signing_capabilities) -
459 				sizeof(struct smb2_neg_context) +
460 				(num_algs * 2 /* sizeof u16 */), 8) * 8);
461 	pneg_ctxt->SigningAlgorithmCount = cpu_to_le16(num_algs);
462 	pneg_ctxt->SigningAlgorithms[0] = cpu_to_le16(SIGNING_ALG_AES_CMAC);
463 
464 	ctxt_len += 2 /* sizeof le16 */ * num_algs;
465 	ctxt_len = DIV_ROUND_UP(ctxt_len, 8) * 8;
466 	return ctxt_len;
467 	/* TBD add SIGNING_ALG_AES_GMAC and/or SIGNING_ALG_HMAC_SHA256 */
468 }
469 
470 static void
build_encrypt_ctxt(struct smb2_encryption_neg_context * pneg_ctxt)471 build_encrypt_ctxt(struct smb2_encryption_neg_context *pneg_ctxt)
472 {
473 	pneg_ctxt->ContextType = SMB2_ENCRYPTION_CAPABILITIES;
474 	if (require_gcm_256) {
475 		pneg_ctxt->DataLength = cpu_to_le16(4); /* Cipher Count + 1 cipher */
476 		pneg_ctxt->CipherCount = cpu_to_le16(1);
477 		pneg_ctxt->Ciphers[0] = SMB2_ENCRYPTION_AES256_GCM;
478 	} else if (enable_gcm_256) {
479 		pneg_ctxt->DataLength = cpu_to_le16(8); /* Cipher Count + 3 ciphers */
480 		pneg_ctxt->CipherCount = cpu_to_le16(3);
481 		pneg_ctxt->Ciphers[0] = SMB2_ENCRYPTION_AES128_GCM;
482 		pneg_ctxt->Ciphers[1] = SMB2_ENCRYPTION_AES256_GCM;
483 		pneg_ctxt->Ciphers[2] = SMB2_ENCRYPTION_AES128_CCM;
484 	} else {
485 		pneg_ctxt->DataLength = cpu_to_le16(6); /* Cipher Count + 2 ciphers */
486 		pneg_ctxt->CipherCount = cpu_to_le16(2);
487 		pneg_ctxt->Ciphers[0] = SMB2_ENCRYPTION_AES128_GCM;
488 		pneg_ctxt->Ciphers[1] = SMB2_ENCRYPTION_AES128_CCM;
489 	}
490 }
491 
492 static unsigned int
build_netname_ctxt(struct smb2_netname_neg_context * pneg_ctxt,char * hostname)493 build_netname_ctxt(struct smb2_netname_neg_context *pneg_ctxt, char *hostname)
494 {
495 	struct nls_table *cp = load_nls_default();
496 
497 	pneg_ctxt->ContextType = SMB2_NETNAME_NEGOTIATE_CONTEXT_ID;
498 
499 	/* copy up to max of first 100 bytes of server name to NetName field */
500 	pneg_ctxt->DataLength = cpu_to_le16(2 * cifs_strtoUTF16(pneg_ctxt->NetName, hostname, 100, cp));
501 	/* context size is DataLength + minimal smb2_neg_context */
502 	return DIV_ROUND_UP(le16_to_cpu(pneg_ctxt->DataLength) +
503 			sizeof(struct smb2_neg_context), 8) * 8;
504 }
505 
506 static void
build_posix_ctxt(struct smb2_posix_neg_context * pneg_ctxt)507 build_posix_ctxt(struct smb2_posix_neg_context *pneg_ctxt)
508 {
509 	pneg_ctxt->ContextType = SMB2_POSIX_EXTENSIONS_AVAILABLE;
510 	pneg_ctxt->DataLength = cpu_to_le16(POSIX_CTXT_DATA_LEN);
511 	/* SMB2_CREATE_TAG_POSIX is "0x93AD25509CB411E7B42383DE968BCD7C" */
512 	pneg_ctxt->Name[0] = 0x93;
513 	pneg_ctxt->Name[1] = 0xAD;
514 	pneg_ctxt->Name[2] = 0x25;
515 	pneg_ctxt->Name[3] = 0x50;
516 	pneg_ctxt->Name[4] = 0x9C;
517 	pneg_ctxt->Name[5] = 0xB4;
518 	pneg_ctxt->Name[6] = 0x11;
519 	pneg_ctxt->Name[7] = 0xE7;
520 	pneg_ctxt->Name[8] = 0xB4;
521 	pneg_ctxt->Name[9] = 0x23;
522 	pneg_ctxt->Name[10] = 0x83;
523 	pneg_ctxt->Name[11] = 0xDE;
524 	pneg_ctxt->Name[12] = 0x96;
525 	pneg_ctxt->Name[13] = 0x8B;
526 	pneg_ctxt->Name[14] = 0xCD;
527 	pneg_ctxt->Name[15] = 0x7C;
528 }
529 
530 static void
assemble_neg_contexts(struct smb2_negotiate_req * req,struct TCP_Server_Info * server,unsigned int * total_len)531 assemble_neg_contexts(struct smb2_negotiate_req *req,
532 		      struct TCP_Server_Info *server, unsigned int *total_len)
533 {
534 	char *pneg_ctxt;
535 	unsigned int ctxt_len, neg_context_count;
536 
537 	if (*total_len > 200) {
538 		/* In case length corrupted don't want to overrun smb buffer */
539 		cifs_server_dbg(VFS, "Bad frame length assembling neg contexts\n");
540 		return;
541 	}
542 
543 	/*
544 	 * round up total_len of fixed part of SMB3 negotiate request to 8
545 	 * byte boundary before adding negotiate contexts
546 	 */
547 	*total_len = roundup(*total_len, 8);
548 
549 	pneg_ctxt = (*total_len) + (char *)req;
550 	req->NegotiateContextOffset = cpu_to_le32(*total_len);
551 
552 	build_preauth_ctxt((struct smb2_preauth_neg_context *)pneg_ctxt);
553 	ctxt_len = DIV_ROUND_UP(sizeof(struct smb2_preauth_neg_context), 8) * 8;
554 	*total_len += ctxt_len;
555 	pneg_ctxt += ctxt_len;
556 
557 	build_encrypt_ctxt((struct smb2_encryption_neg_context *)pneg_ctxt);
558 	ctxt_len = DIV_ROUND_UP(sizeof(struct smb2_encryption_neg_context), 8) * 8;
559 	*total_len += ctxt_len;
560 	pneg_ctxt += ctxt_len;
561 
562 	ctxt_len = build_netname_ctxt((struct smb2_netname_neg_context *)pneg_ctxt,
563 					server->hostname);
564 	*total_len += ctxt_len;
565 	pneg_ctxt += ctxt_len;
566 
567 	build_posix_ctxt((struct smb2_posix_neg_context *)pneg_ctxt);
568 	*total_len += sizeof(struct smb2_posix_neg_context);
569 	pneg_ctxt += sizeof(struct smb2_posix_neg_context);
570 
571 	neg_context_count = 4;
572 
573 	if (server->compress_algorithm) {
574 		build_compression_ctxt((struct smb2_compression_capabilities_context *)
575 				pneg_ctxt);
576 		ctxt_len = DIV_ROUND_UP(
577 			sizeof(struct smb2_compression_capabilities_context),
578 				8) * 8;
579 		*total_len += ctxt_len;
580 		pneg_ctxt += ctxt_len;
581 		neg_context_count++;
582 	}
583 
584 	if (enable_negotiate_signing) {
585 		ctxt_len = build_signing_ctxt((struct smb2_signing_capabilities *)
586 				pneg_ctxt);
587 		*total_len += ctxt_len;
588 		pneg_ctxt += ctxt_len;
589 		neg_context_count++;
590 	}
591 
592 	/* check for and add transport_capabilities and signing capabilities */
593 	req->NegotiateContextCount = cpu_to_le16(neg_context_count);
594 
595 }
596 
decode_preauth_context(struct smb2_preauth_neg_context * ctxt)597 static void decode_preauth_context(struct smb2_preauth_neg_context *ctxt)
598 {
599 	unsigned int len = le16_to_cpu(ctxt->DataLength);
600 
601 	/* If invalid preauth context warn but use what we requested, SHA-512 */
602 	if (len < MIN_PREAUTH_CTXT_DATA_LEN) {
603 		pr_warn_once("server sent bad preauth context\n");
604 		return;
605 	} else if (len < MIN_PREAUTH_CTXT_DATA_LEN + le16_to_cpu(ctxt->SaltLength)) {
606 		pr_warn_once("server sent invalid SaltLength\n");
607 		return;
608 	}
609 	if (le16_to_cpu(ctxt->HashAlgorithmCount) != 1)
610 		pr_warn_once("Invalid SMB3 hash algorithm count\n");
611 	if (ctxt->HashAlgorithms != SMB2_PREAUTH_INTEGRITY_SHA512)
612 		pr_warn_once("unknown SMB3 hash algorithm\n");
613 }
614 
decode_compress_ctx(struct TCP_Server_Info * server,struct smb2_compression_capabilities_context * ctxt)615 static void decode_compress_ctx(struct TCP_Server_Info *server,
616 			 struct smb2_compression_capabilities_context *ctxt)
617 {
618 	unsigned int len = le16_to_cpu(ctxt->DataLength);
619 
620 	/* sizeof compress context is a one element compression capbility struct */
621 	if (len < 10) {
622 		pr_warn_once("server sent bad compression cntxt\n");
623 		return;
624 	}
625 	if (le16_to_cpu(ctxt->CompressionAlgorithmCount) != 1) {
626 		pr_warn_once("Invalid SMB3 compress algorithm count\n");
627 		return;
628 	}
629 	if (le16_to_cpu(ctxt->CompressionAlgorithms[0]) > 3) {
630 		pr_warn_once("unknown compression algorithm\n");
631 		return;
632 	}
633 	server->compress_algorithm = ctxt->CompressionAlgorithms[0];
634 }
635 
decode_encrypt_ctx(struct TCP_Server_Info * server,struct smb2_encryption_neg_context * ctxt)636 static int decode_encrypt_ctx(struct TCP_Server_Info *server,
637 			      struct smb2_encryption_neg_context *ctxt)
638 {
639 	unsigned int len = le16_to_cpu(ctxt->DataLength);
640 
641 	cifs_dbg(FYI, "decode SMB3.11 encryption neg context of len %d\n", len);
642 	if (len < MIN_ENCRYPT_CTXT_DATA_LEN) {
643 		pr_warn_once("server sent bad crypto ctxt len\n");
644 		return -EINVAL;
645 	}
646 
647 	if (le16_to_cpu(ctxt->CipherCount) != 1) {
648 		pr_warn_once("Invalid SMB3.11 cipher count\n");
649 		return -EINVAL;
650 	}
651 	cifs_dbg(FYI, "SMB311 cipher type:%d\n", le16_to_cpu(ctxt->Ciphers[0]));
652 	if (require_gcm_256) {
653 		if (ctxt->Ciphers[0] != SMB2_ENCRYPTION_AES256_GCM) {
654 			cifs_dbg(VFS, "Server does not support requested encryption type (AES256 GCM)\n");
655 			return -EOPNOTSUPP;
656 		}
657 	} else if (ctxt->Ciphers[0] == 0) {
658 		/*
659 		 * e.g. if server only supported AES256_CCM (very unlikely)
660 		 * or server supported no encryption types or had all disabled.
661 		 * Since GLOBAL_CAP_ENCRYPTION will be not set, in the case
662 		 * in which mount requested encryption ("seal") checks later
663 		 * on during tree connection will return proper rc, but if
664 		 * seal not requested by client, since server is allowed to
665 		 * return 0 to indicate no supported cipher, we can't fail here
666 		 */
667 		server->cipher_type = 0;
668 		server->capabilities &= ~SMB2_GLOBAL_CAP_ENCRYPTION;
669 		pr_warn_once("Server does not support requested encryption types\n");
670 		return 0;
671 	} else if ((ctxt->Ciphers[0] != SMB2_ENCRYPTION_AES128_CCM) &&
672 		   (ctxt->Ciphers[0] != SMB2_ENCRYPTION_AES128_GCM) &&
673 		   (ctxt->Ciphers[0] != SMB2_ENCRYPTION_AES256_GCM)) {
674 		/* server returned a cipher we didn't ask for */
675 		pr_warn_once("Invalid SMB3.11 cipher returned\n");
676 		return -EINVAL;
677 	}
678 	server->cipher_type = ctxt->Ciphers[0];
679 	server->capabilities |= SMB2_GLOBAL_CAP_ENCRYPTION;
680 	return 0;
681 }
682 
decode_signing_ctx(struct TCP_Server_Info * server,struct smb2_signing_capabilities * pctxt)683 static void decode_signing_ctx(struct TCP_Server_Info *server,
684 			       struct smb2_signing_capabilities *pctxt)
685 {
686 	unsigned int len = le16_to_cpu(pctxt->DataLength);
687 
688 	if ((len < 4) || (len > 16)) {
689 		pr_warn_once("server sent bad signing negcontext\n");
690 		return;
691 	}
692 	if (le16_to_cpu(pctxt->SigningAlgorithmCount) != 1) {
693 		pr_warn_once("Invalid signing algorithm count\n");
694 		return;
695 	}
696 	if (le16_to_cpu(pctxt->SigningAlgorithms[0]) > 2) {
697 		pr_warn_once("unknown signing algorithm\n");
698 		return;
699 	}
700 
701 	server->signing_negotiated = true;
702 	server->signing_algorithm = le16_to_cpu(pctxt->SigningAlgorithms[0]);
703 	cifs_dbg(FYI, "signing algorithm %d chosen\n",
704 		     server->signing_algorithm);
705 }
706 
707 
smb311_decode_neg_context(struct smb2_negotiate_rsp * rsp,struct TCP_Server_Info * server,unsigned int len_of_smb)708 static int smb311_decode_neg_context(struct smb2_negotiate_rsp *rsp,
709 				     struct TCP_Server_Info *server,
710 				     unsigned int len_of_smb)
711 {
712 	struct smb2_neg_context *pctx;
713 	unsigned int offset = le32_to_cpu(rsp->NegotiateContextOffset);
714 	unsigned int ctxt_cnt = le16_to_cpu(rsp->NegotiateContextCount);
715 	unsigned int len_of_ctxts, i;
716 	int rc = 0;
717 
718 	cifs_dbg(FYI, "decoding %d negotiate contexts\n", ctxt_cnt);
719 	if (len_of_smb <= offset) {
720 		cifs_server_dbg(VFS, "Invalid response: negotiate context offset\n");
721 		return -EINVAL;
722 	}
723 
724 	len_of_ctxts = len_of_smb - offset;
725 
726 	for (i = 0; i < ctxt_cnt; i++) {
727 		int clen;
728 		/* check that offset is not beyond end of SMB */
729 		if (len_of_ctxts == 0)
730 			break;
731 
732 		if (len_of_ctxts < sizeof(struct smb2_neg_context))
733 			break;
734 
735 		pctx = (struct smb2_neg_context *)(offset + (char *)rsp);
736 		clen = le16_to_cpu(pctx->DataLength);
737 		if (clen > len_of_ctxts)
738 			break;
739 
740 		if (pctx->ContextType == SMB2_PREAUTH_INTEGRITY_CAPABILITIES)
741 			decode_preauth_context(
742 				(struct smb2_preauth_neg_context *)pctx);
743 		else if (pctx->ContextType == SMB2_ENCRYPTION_CAPABILITIES)
744 			rc = decode_encrypt_ctx(server,
745 				(struct smb2_encryption_neg_context *)pctx);
746 		else if (pctx->ContextType == SMB2_COMPRESSION_CAPABILITIES)
747 			decode_compress_ctx(server,
748 				(struct smb2_compression_capabilities_context *)pctx);
749 		else if (pctx->ContextType == SMB2_POSIX_EXTENSIONS_AVAILABLE)
750 			server->posix_ext_supported = true;
751 		else if (pctx->ContextType == SMB2_SIGNING_CAPABILITIES)
752 			decode_signing_ctx(server,
753 				(struct smb2_signing_capabilities *)pctx);
754 		else
755 			cifs_server_dbg(VFS, "unknown negcontext of type %d ignored\n",
756 				le16_to_cpu(pctx->ContextType));
757 
758 		if (rc)
759 			break;
760 		/* offsets must be 8 byte aligned */
761 		clen = (clen + 7) & ~0x7;
762 		offset += clen + sizeof(struct smb2_neg_context);
763 		len_of_ctxts -= clen;
764 	}
765 	return rc;
766 }
767 
768 static struct create_posix *
create_posix_buf(umode_t mode)769 create_posix_buf(umode_t mode)
770 {
771 	struct create_posix *buf;
772 
773 	buf = kzalloc(sizeof(struct create_posix),
774 			GFP_KERNEL);
775 	if (!buf)
776 		return NULL;
777 
778 	buf->ccontext.DataOffset =
779 		cpu_to_le16(offsetof(struct create_posix, Mode));
780 	buf->ccontext.DataLength = cpu_to_le32(4);
781 	buf->ccontext.NameOffset =
782 		cpu_to_le16(offsetof(struct create_posix, Name));
783 	buf->ccontext.NameLength = cpu_to_le16(16);
784 
785 	/* SMB2_CREATE_TAG_POSIX is "0x93AD25509CB411E7B42383DE968BCD7C" */
786 	buf->Name[0] = 0x93;
787 	buf->Name[1] = 0xAD;
788 	buf->Name[2] = 0x25;
789 	buf->Name[3] = 0x50;
790 	buf->Name[4] = 0x9C;
791 	buf->Name[5] = 0xB4;
792 	buf->Name[6] = 0x11;
793 	buf->Name[7] = 0xE7;
794 	buf->Name[8] = 0xB4;
795 	buf->Name[9] = 0x23;
796 	buf->Name[10] = 0x83;
797 	buf->Name[11] = 0xDE;
798 	buf->Name[12] = 0x96;
799 	buf->Name[13] = 0x8B;
800 	buf->Name[14] = 0xCD;
801 	buf->Name[15] = 0x7C;
802 	buf->Mode = cpu_to_le32(mode);
803 	cifs_dbg(FYI, "mode on posix create 0%o\n", mode);
804 	return buf;
805 }
806 
807 static int
add_posix_context(struct kvec * iov,unsigned int * num_iovec,umode_t mode)808 add_posix_context(struct kvec *iov, unsigned int *num_iovec, umode_t mode)
809 {
810 	struct smb2_create_req *req = iov[0].iov_base;
811 	unsigned int num = *num_iovec;
812 
813 	iov[num].iov_base = create_posix_buf(mode);
814 	if (mode == ACL_NO_MODE)
815 		cifs_dbg(FYI, "Invalid mode\n");
816 	if (iov[num].iov_base == NULL)
817 		return -ENOMEM;
818 	iov[num].iov_len = sizeof(struct create_posix);
819 	if (!req->CreateContextsOffset)
820 		req->CreateContextsOffset = cpu_to_le32(
821 				sizeof(struct smb2_create_req) +
822 				iov[num - 1].iov_len);
823 	le32_add_cpu(&req->CreateContextsLength, sizeof(struct create_posix));
824 	*num_iovec = num + 1;
825 	return 0;
826 }
827 
828 
829 /*
830  *
831  *	SMB2 Worker functions follow:
832  *
833  *	The general structure of the worker functions is:
834  *	1) Call smb2_init (assembles SMB2 header)
835  *	2) Initialize SMB2 command specific fields in fixed length area of SMB
836  *	3) Call smb_sendrcv2 (sends request on socket and waits for response)
837  *	4) Decode SMB2 command specific fields in the fixed length area
838  *	5) Decode variable length data area (if any for this SMB2 command type)
839  *	6) Call free smb buffer
840  *	7) return
841  *
842  */
843 
844 int
SMB2_negotiate(const unsigned int xid,struct cifs_ses * ses)845 SMB2_negotiate(const unsigned int xid, struct cifs_ses *ses)
846 {
847 	struct smb_rqst rqst;
848 	struct smb2_negotiate_req *req;
849 	struct smb2_negotiate_rsp *rsp;
850 	struct kvec iov[1];
851 	struct kvec rsp_iov;
852 	int rc = 0;
853 	int resp_buftype;
854 	struct TCP_Server_Info *server = cifs_ses_server(ses);
855 	int blob_offset, blob_length;
856 	char *security_blob;
857 	int flags = CIFS_NEG_OP;
858 	unsigned int total_len;
859 
860 	cifs_dbg(FYI, "Negotiate protocol\n");
861 
862 	if (!server) {
863 		WARN(1, "%s: server is NULL!\n", __func__);
864 		return -EIO;
865 	}
866 
867 	rc = smb2_plain_req_init(SMB2_NEGOTIATE, NULL, server,
868 				 (void **) &req, &total_len);
869 	if (rc)
870 		return rc;
871 
872 	req->sync_hdr.SessionId = 0;
873 
874 	memset(server->preauth_sha_hash, 0, SMB2_PREAUTH_HASH_SIZE);
875 	memset(ses->preauth_sha_hash, 0, SMB2_PREAUTH_HASH_SIZE);
876 
877 	if (strcmp(server->vals->version_string,
878 		   SMB3ANY_VERSION_STRING) == 0) {
879 		req->Dialects[0] = cpu_to_le16(SMB30_PROT_ID);
880 		req->Dialects[1] = cpu_to_le16(SMB302_PROT_ID);
881 		req->Dialects[2] = cpu_to_le16(SMB311_PROT_ID);
882 		req->DialectCount = cpu_to_le16(3);
883 		total_len += 6;
884 	} else if (strcmp(server->vals->version_string,
885 		   SMBDEFAULT_VERSION_STRING) == 0) {
886 		req->Dialects[0] = cpu_to_le16(SMB21_PROT_ID);
887 		req->Dialects[1] = cpu_to_le16(SMB30_PROT_ID);
888 		req->Dialects[2] = cpu_to_le16(SMB302_PROT_ID);
889 		req->Dialects[3] = cpu_to_le16(SMB311_PROT_ID);
890 		req->DialectCount = cpu_to_le16(4);
891 		total_len += 8;
892 	} else {
893 		/* otherwise send specific dialect */
894 		req->Dialects[0] = cpu_to_le16(server->vals->protocol_id);
895 		req->DialectCount = cpu_to_le16(1);
896 		total_len += 2;
897 	}
898 
899 	/* only one of SMB2 signing flags may be set in SMB2 request */
900 	if (ses->sign)
901 		req->SecurityMode = cpu_to_le16(SMB2_NEGOTIATE_SIGNING_REQUIRED);
902 	else if (global_secflags & CIFSSEC_MAY_SIGN)
903 		req->SecurityMode = cpu_to_le16(SMB2_NEGOTIATE_SIGNING_ENABLED);
904 	else
905 		req->SecurityMode = 0;
906 
907 	req->Capabilities = cpu_to_le32(server->vals->req_capabilities);
908 	if (ses->chan_max > 1)
909 		req->Capabilities |= cpu_to_le32(SMB2_GLOBAL_CAP_MULTI_CHANNEL);
910 
911 	/* ClientGUID must be zero for SMB2.02 dialect */
912 	if (server->vals->protocol_id == SMB20_PROT_ID)
913 		memset(req->ClientGUID, 0, SMB2_CLIENT_GUID_SIZE);
914 	else {
915 		memcpy(req->ClientGUID, server->client_guid,
916 			SMB2_CLIENT_GUID_SIZE);
917 		if ((server->vals->protocol_id == SMB311_PROT_ID) ||
918 		    (strcmp(server->vals->version_string,
919 		     SMB3ANY_VERSION_STRING) == 0) ||
920 		    (strcmp(server->vals->version_string,
921 		     SMBDEFAULT_VERSION_STRING) == 0))
922 			assemble_neg_contexts(req, server, &total_len);
923 	}
924 	iov[0].iov_base = (char *)req;
925 	iov[0].iov_len = total_len;
926 
927 	memset(&rqst, 0, sizeof(struct smb_rqst));
928 	rqst.rq_iov = iov;
929 	rqst.rq_nvec = 1;
930 
931 	rc = cifs_send_recv(xid, ses, server,
932 			    &rqst, &resp_buftype, flags, &rsp_iov);
933 	cifs_small_buf_release(req);
934 	rsp = (struct smb2_negotiate_rsp *)rsp_iov.iov_base;
935 	/*
936 	 * No tcon so can't do
937 	 * cifs_stats_inc(&tcon->stats.smb2_stats.smb2_com_fail[SMB2...]);
938 	 */
939 	if (rc == -EOPNOTSUPP) {
940 		cifs_server_dbg(VFS, "Dialect not supported by server. Consider  specifying vers=1.0 or vers=2.0 on mount for accessing older servers\n");
941 		goto neg_exit;
942 	} else if (rc != 0)
943 		goto neg_exit;
944 
945 	rc = -EIO;
946 	if (strcmp(server->vals->version_string,
947 		   SMB3ANY_VERSION_STRING) == 0) {
948 		if (rsp->DialectRevision == cpu_to_le16(SMB20_PROT_ID)) {
949 			cifs_server_dbg(VFS,
950 				"SMB2 dialect returned but not requested\n");
951 			goto neg_exit;
952 		} else if (rsp->DialectRevision == cpu_to_le16(SMB21_PROT_ID)) {
953 			cifs_server_dbg(VFS,
954 				"SMB2.1 dialect returned but not requested\n");
955 			goto neg_exit;
956 		} else if (rsp->DialectRevision == cpu_to_le16(SMB311_PROT_ID)) {
957 			/* ops set to 3.0 by default for default so update */
958 			server->ops = &smb311_operations;
959 			server->vals = &smb311_values;
960 		}
961 	} else if (strcmp(server->vals->version_string,
962 		   SMBDEFAULT_VERSION_STRING) == 0) {
963 		if (rsp->DialectRevision == cpu_to_le16(SMB20_PROT_ID)) {
964 			cifs_server_dbg(VFS,
965 				"SMB2 dialect returned but not requested\n");
966 			goto neg_exit;
967 		} else if (rsp->DialectRevision == cpu_to_le16(SMB21_PROT_ID)) {
968 			/* ops set to 3.0 by default for default so update */
969 			server->ops = &smb21_operations;
970 			server->vals = &smb21_values;
971 		} else if (rsp->DialectRevision == cpu_to_le16(SMB311_PROT_ID)) {
972 			server->ops = &smb311_operations;
973 			server->vals = &smb311_values;
974 		}
975 	} else if (le16_to_cpu(rsp->DialectRevision) !=
976 				server->vals->protocol_id) {
977 		/* if requested single dialect ensure returned dialect matched */
978 		cifs_server_dbg(VFS, "Invalid 0x%x dialect returned: not requested\n",
979 				le16_to_cpu(rsp->DialectRevision));
980 		goto neg_exit;
981 	}
982 
983 	cifs_dbg(FYI, "mode 0x%x\n", rsp->SecurityMode);
984 
985 	if (rsp->DialectRevision == cpu_to_le16(SMB20_PROT_ID))
986 		cifs_dbg(FYI, "negotiated smb2.0 dialect\n");
987 	else if (rsp->DialectRevision == cpu_to_le16(SMB21_PROT_ID))
988 		cifs_dbg(FYI, "negotiated smb2.1 dialect\n");
989 	else if (rsp->DialectRevision == cpu_to_le16(SMB30_PROT_ID))
990 		cifs_dbg(FYI, "negotiated smb3.0 dialect\n");
991 	else if (rsp->DialectRevision == cpu_to_le16(SMB302_PROT_ID))
992 		cifs_dbg(FYI, "negotiated smb3.02 dialect\n");
993 	else if (rsp->DialectRevision == cpu_to_le16(SMB311_PROT_ID))
994 		cifs_dbg(FYI, "negotiated smb3.1.1 dialect\n");
995 	else {
996 		cifs_server_dbg(VFS, "Invalid dialect returned by server 0x%x\n",
997 				le16_to_cpu(rsp->DialectRevision));
998 		goto neg_exit;
999 	}
1000 
1001 	rc = 0;
1002 	server->dialect = le16_to_cpu(rsp->DialectRevision);
1003 
1004 	/*
1005 	 * Keep a copy of the hash after negprot. This hash will be
1006 	 * the starting hash value for all sessions made from this
1007 	 * server.
1008 	 */
1009 	memcpy(server->preauth_sha_hash, ses->preauth_sha_hash,
1010 	       SMB2_PREAUTH_HASH_SIZE);
1011 
1012 	/* SMB2 only has an extended negflavor */
1013 	server->negflavor = CIFS_NEGFLAVOR_EXTENDED;
1014 	/* set it to the maximum buffer size value we can send with 1 credit */
1015 	server->maxBuf = min_t(unsigned int, le32_to_cpu(rsp->MaxTransactSize),
1016 			       SMB2_MAX_BUFFER_SIZE);
1017 	server->max_read = le32_to_cpu(rsp->MaxReadSize);
1018 	server->max_write = le32_to_cpu(rsp->MaxWriteSize);
1019 	server->sec_mode = le16_to_cpu(rsp->SecurityMode);
1020 	if ((server->sec_mode & SMB2_SEC_MODE_FLAGS_ALL) != server->sec_mode)
1021 		cifs_dbg(FYI, "Server returned unexpected security mode 0x%x\n",
1022 				server->sec_mode);
1023 	server->capabilities = le32_to_cpu(rsp->Capabilities);
1024 	/* Internal types */
1025 	server->capabilities |= SMB2_NT_FIND | SMB2_LARGE_FILES;
1026 
1027 	/*
1028 	 * SMB3.0 supports only 1 cipher and doesn't have a encryption neg context
1029 	 * Set the cipher type manually.
1030 	 */
1031 	if (server->dialect == SMB30_PROT_ID && (server->capabilities & SMB2_GLOBAL_CAP_ENCRYPTION))
1032 		server->cipher_type = SMB2_ENCRYPTION_AES128_CCM;
1033 
1034 	security_blob = smb2_get_data_area_len(&blob_offset, &blob_length,
1035 					       (struct smb2_sync_hdr *)rsp);
1036 	/*
1037 	 * See MS-SMB2 section 2.2.4: if no blob, client picks default which
1038 	 * for us will be
1039 	 *	ses->sectype = RawNTLMSSP;
1040 	 * but for time being this is our only auth choice so doesn't matter.
1041 	 * We just found a server which sets blob length to zero expecting raw.
1042 	 */
1043 	if (blob_length == 0) {
1044 		cifs_dbg(FYI, "missing security blob on negprot\n");
1045 		server->sec_ntlmssp = true;
1046 	}
1047 
1048 	rc = cifs_enable_signing(server, ses->sign);
1049 	if (rc)
1050 		goto neg_exit;
1051 	if (blob_length) {
1052 		rc = decode_negTokenInit(security_blob, blob_length, server);
1053 		if (rc == 1)
1054 			rc = 0;
1055 		else if (rc == 0)
1056 			rc = -EIO;
1057 	}
1058 
1059 	if (rsp->DialectRevision == cpu_to_le16(SMB311_PROT_ID)) {
1060 		if (rsp->NegotiateContextCount)
1061 			rc = smb311_decode_neg_context(rsp, server,
1062 						       rsp_iov.iov_len);
1063 		else
1064 			cifs_server_dbg(VFS, "Missing expected negotiate contexts\n");
1065 	}
1066 neg_exit:
1067 	free_rsp_buf(resp_buftype, rsp);
1068 	return rc;
1069 }
1070 
smb3_validate_negotiate(const unsigned int xid,struct cifs_tcon * tcon)1071 int smb3_validate_negotiate(const unsigned int xid, struct cifs_tcon *tcon)
1072 {
1073 	int rc;
1074 	struct validate_negotiate_info_req *pneg_inbuf;
1075 	struct validate_negotiate_info_rsp *pneg_rsp = NULL;
1076 	u32 rsplen;
1077 	u32 inbuflen; /* max of 4 dialects */
1078 	struct TCP_Server_Info *server = tcon->ses->server;
1079 
1080 	cifs_dbg(FYI, "validate negotiate\n");
1081 
1082 	/* In SMB3.11 preauth integrity supersedes validate negotiate */
1083 	if (server->dialect == SMB311_PROT_ID)
1084 		return 0;
1085 
1086 	/*
1087 	 * validation ioctl must be signed, so no point sending this if we
1088 	 * can not sign it (ie are not known user).  Even if signing is not
1089 	 * required (enabled but not negotiated), in those cases we selectively
1090 	 * sign just this, the first and only signed request on a connection.
1091 	 * Having validation of negotiate info  helps reduce attack vectors.
1092 	 */
1093 	if (tcon->ses->session_flags & SMB2_SESSION_FLAG_IS_GUEST)
1094 		return 0; /* validation requires signing */
1095 
1096 	if (tcon->ses->user_name == NULL) {
1097 		cifs_dbg(FYI, "Can't validate negotiate: null user mount\n");
1098 		return 0; /* validation requires signing */
1099 	}
1100 
1101 	if (tcon->ses->session_flags & SMB2_SESSION_FLAG_IS_NULL)
1102 		cifs_tcon_dbg(VFS, "Unexpected null user (anonymous) auth flag sent by server\n");
1103 
1104 	pneg_inbuf = kmalloc(sizeof(*pneg_inbuf), GFP_NOFS);
1105 	if (!pneg_inbuf)
1106 		return -ENOMEM;
1107 
1108 	pneg_inbuf->Capabilities =
1109 			cpu_to_le32(server->vals->req_capabilities);
1110 	if (tcon->ses->chan_max > 1)
1111 		pneg_inbuf->Capabilities |= cpu_to_le32(SMB2_GLOBAL_CAP_MULTI_CHANNEL);
1112 
1113 	memcpy(pneg_inbuf->Guid, server->client_guid,
1114 					SMB2_CLIENT_GUID_SIZE);
1115 
1116 	if (tcon->ses->sign)
1117 		pneg_inbuf->SecurityMode =
1118 			cpu_to_le16(SMB2_NEGOTIATE_SIGNING_REQUIRED);
1119 	else if (global_secflags & CIFSSEC_MAY_SIGN)
1120 		pneg_inbuf->SecurityMode =
1121 			cpu_to_le16(SMB2_NEGOTIATE_SIGNING_ENABLED);
1122 	else
1123 		pneg_inbuf->SecurityMode = 0;
1124 
1125 
1126 	if (strcmp(server->vals->version_string,
1127 		SMB3ANY_VERSION_STRING) == 0) {
1128 		pneg_inbuf->Dialects[0] = cpu_to_le16(SMB30_PROT_ID);
1129 		pneg_inbuf->Dialects[1] = cpu_to_le16(SMB302_PROT_ID);
1130 		pneg_inbuf->Dialects[2] = cpu_to_le16(SMB311_PROT_ID);
1131 		pneg_inbuf->DialectCount = cpu_to_le16(3);
1132 		/* SMB 2.1 not included so subtract one dialect from len */
1133 		inbuflen = sizeof(*pneg_inbuf) -
1134 				(sizeof(pneg_inbuf->Dialects[0]));
1135 	} else if (strcmp(server->vals->version_string,
1136 		SMBDEFAULT_VERSION_STRING) == 0) {
1137 		pneg_inbuf->Dialects[0] = cpu_to_le16(SMB21_PROT_ID);
1138 		pneg_inbuf->Dialects[1] = cpu_to_le16(SMB30_PROT_ID);
1139 		pneg_inbuf->Dialects[2] = cpu_to_le16(SMB302_PROT_ID);
1140 		pneg_inbuf->Dialects[3] = cpu_to_le16(SMB311_PROT_ID);
1141 		pneg_inbuf->DialectCount = cpu_to_le16(4);
1142 		/* structure is big enough for 4 dialects */
1143 		inbuflen = sizeof(*pneg_inbuf);
1144 	} else {
1145 		/* otherwise specific dialect was requested */
1146 		pneg_inbuf->Dialects[0] =
1147 			cpu_to_le16(server->vals->protocol_id);
1148 		pneg_inbuf->DialectCount = cpu_to_le16(1);
1149 		/* structure is big enough for 4 dialects, sending only 1 */
1150 		inbuflen = sizeof(*pneg_inbuf) -
1151 				sizeof(pneg_inbuf->Dialects[0]) * 3;
1152 	}
1153 
1154 	rc = SMB2_ioctl(xid, tcon, NO_FILE_ID, NO_FILE_ID,
1155 		FSCTL_VALIDATE_NEGOTIATE_INFO, true /* is_fsctl */,
1156 		(char *)pneg_inbuf, inbuflen, CIFSMaxBufSize,
1157 		(char **)&pneg_rsp, &rsplen);
1158 	if (rc == -EOPNOTSUPP) {
1159 		/*
1160 		 * Old Windows versions or Netapp SMB server can return
1161 		 * not supported error. Client should accept it.
1162 		 */
1163 		cifs_tcon_dbg(VFS, "Server does not support validate negotiate\n");
1164 		rc = 0;
1165 		goto out_free_inbuf;
1166 	} else if (rc != 0) {
1167 		cifs_tcon_dbg(VFS, "validate protocol negotiate failed: %d\n",
1168 			      rc);
1169 		rc = -EIO;
1170 		goto out_free_inbuf;
1171 	}
1172 
1173 	rc = -EIO;
1174 	if (rsplen != sizeof(*pneg_rsp)) {
1175 		cifs_tcon_dbg(VFS, "Invalid protocol negotiate response size: %d\n",
1176 			      rsplen);
1177 
1178 		/* relax check since Mac returns max bufsize allowed on ioctl */
1179 		if (rsplen > CIFSMaxBufSize || rsplen < sizeof(*pneg_rsp))
1180 			goto out_free_rsp;
1181 	}
1182 
1183 	/* check validate negotiate info response matches what we got earlier */
1184 	if (pneg_rsp->Dialect != cpu_to_le16(server->dialect))
1185 		goto vneg_out;
1186 
1187 	if (pneg_rsp->SecurityMode != cpu_to_le16(server->sec_mode))
1188 		goto vneg_out;
1189 
1190 	/* do not validate server guid because not saved at negprot time yet */
1191 
1192 	if ((le32_to_cpu(pneg_rsp->Capabilities) | SMB2_NT_FIND |
1193 	      SMB2_LARGE_FILES) != server->capabilities)
1194 		goto vneg_out;
1195 
1196 	/* validate negotiate successful */
1197 	rc = 0;
1198 	cifs_dbg(FYI, "validate negotiate info successful\n");
1199 	goto out_free_rsp;
1200 
1201 vneg_out:
1202 	cifs_tcon_dbg(VFS, "protocol revalidation - security settings mismatch\n");
1203 out_free_rsp:
1204 	kfree(pneg_rsp);
1205 out_free_inbuf:
1206 	kfree(pneg_inbuf);
1207 	return rc;
1208 }
1209 
1210 enum securityEnum
smb2_select_sectype(struct TCP_Server_Info * server,enum securityEnum requested)1211 smb2_select_sectype(struct TCP_Server_Info *server, enum securityEnum requested)
1212 {
1213 	switch (requested) {
1214 	case Kerberos:
1215 	case RawNTLMSSP:
1216 		return requested;
1217 	case NTLMv2:
1218 		return RawNTLMSSP;
1219 	case Unspecified:
1220 		if (server->sec_ntlmssp &&
1221 			(global_secflags & CIFSSEC_MAY_NTLMSSP))
1222 			return RawNTLMSSP;
1223 		if ((server->sec_kerberos || server->sec_mskerberos) &&
1224 			(global_secflags & CIFSSEC_MAY_KRB5))
1225 			return Kerberos;
1226 		fallthrough;
1227 	default:
1228 		return Unspecified;
1229 	}
1230 }
1231 
1232 struct SMB2_sess_data {
1233 	unsigned int xid;
1234 	struct cifs_ses *ses;
1235 	struct nls_table *nls_cp;
1236 	void (*func)(struct SMB2_sess_data *);
1237 	int result;
1238 	u64 previous_session;
1239 
1240 	/* we will send the SMB in three pieces:
1241 	 * a fixed length beginning part, an optional
1242 	 * SPNEGO blob (which can be zero length), and a
1243 	 * last part which will include the strings
1244 	 * and rest of bcc area. This allows us to avoid
1245 	 * a large buffer 17K allocation
1246 	 */
1247 	int buf0_type;
1248 	struct kvec iov[2];
1249 };
1250 
1251 static int
SMB2_sess_alloc_buffer(struct SMB2_sess_data * sess_data)1252 SMB2_sess_alloc_buffer(struct SMB2_sess_data *sess_data)
1253 {
1254 	int rc;
1255 	struct cifs_ses *ses = sess_data->ses;
1256 	struct smb2_sess_setup_req *req;
1257 	struct TCP_Server_Info *server = cifs_ses_server(ses);
1258 	unsigned int total_len;
1259 
1260 	rc = smb2_plain_req_init(SMB2_SESSION_SETUP, NULL, server,
1261 				 (void **) &req,
1262 				 &total_len);
1263 	if (rc)
1264 		return rc;
1265 
1266 	if (sess_data->ses->binding) {
1267 		req->sync_hdr.SessionId = sess_data->ses->Suid;
1268 		req->sync_hdr.Flags |= SMB2_FLAGS_SIGNED;
1269 		req->PreviousSessionId = 0;
1270 		req->Flags = SMB2_SESSION_REQ_FLAG_BINDING;
1271 	} else {
1272 		/* First session, not a reauthenticate */
1273 		req->sync_hdr.SessionId = 0;
1274 		/*
1275 		 * if reconnect, we need to send previous sess id
1276 		 * otherwise it is 0
1277 		 */
1278 		req->PreviousSessionId = sess_data->previous_session;
1279 		req->Flags = 0; /* MBZ */
1280 	}
1281 
1282 	/* enough to enable echos and oplocks and one max size write */
1283 	req->sync_hdr.CreditRequest = cpu_to_le16(130);
1284 
1285 	/* only one of SMB2 signing flags may be set in SMB2 request */
1286 	if (server->sign)
1287 		req->SecurityMode = SMB2_NEGOTIATE_SIGNING_REQUIRED;
1288 	else if (global_secflags & CIFSSEC_MAY_SIGN) /* one flag unlike MUST_ */
1289 		req->SecurityMode = SMB2_NEGOTIATE_SIGNING_ENABLED;
1290 	else
1291 		req->SecurityMode = 0;
1292 
1293 #ifdef CONFIG_CIFS_DFS_UPCALL
1294 	req->Capabilities = cpu_to_le32(SMB2_GLOBAL_CAP_DFS);
1295 #else
1296 	req->Capabilities = 0;
1297 #endif /* DFS_UPCALL */
1298 
1299 	req->Channel = 0; /* MBZ */
1300 
1301 	sess_data->iov[0].iov_base = (char *)req;
1302 	/* 1 for pad */
1303 	sess_data->iov[0].iov_len = total_len - 1;
1304 	/*
1305 	 * This variable will be used to clear the buffer
1306 	 * allocated above in case of any error in the calling function.
1307 	 */
1308 	sess_data->buf0_type = CIFS_SMALL_BUFFER;
1309 
1310 	return 0;
1311 }
1312 
1313 static void
SMB2_sess_free_buffer(struct SMB2_sess_data * sess_data)1314 SMB2_sess_free_buffer(struct SMB2_sess_data *sess_data)
1315 {
1316 	free_rsp_buf(sess_data->buf0_type, sess_data->iov[0].iov_base);
1317 	sess_data->buf0_type = CIFS_NO_BUFFER;
1318 }
1319 
1320 static int
SMB2_sess_sendreceive(struct SMB2_sess_data * sess_data)1321 SMB2_sess_sendreceive(struct SMB2_sess_data *sess_data)
1322 {
1323 	int rc;
1324 	struct smb_rqst rqst;
1325 	struct smb2_sess_setup_req *req = sess_data->iov[0].iov_base;
1326 	struct kvec rsp_iov = { NULL, 0 };
1327 
1328 	/* Testing shows that buffer offset must be at location of Buffer[0] */
1329 	req->SecurityBufferOffset =
1330 		cpu_to_le16(sizeof(struct smb2_sess_setup_req));
1331 	req->SecurityBufferLength = cpu_to_le16(sess_data->iov[1].iov_len);
1332 
1333 	memset(&rqst, 0, sizeof(struct smb_rqst));
1334 	rqst.rq_iov = sess_data->iov;
1335 	rqst.rq_nvec = 2;
1336 
1337 	/* BB add code to build os and lm fields */
1338 	rc = cifs_send_recv(sess_data->xid, sess_data->ses,
1339 			    cifs_ses_server(sess_data->ses),
1340 			    &rqst,
1341 			    &sess_data->buf0_type,
1342 			    CIFS_LOG_ERROR | CIFS_SESS_OP, &rsp_iov);
1343 	cifs_small_buf_release(sess_data->iov[0].iov_base);
1344 	memcpy(&sess_data->iov[0], &rsp_iov, sizeof(struct kvec));
1345 
1346 	return rc;
1347 }
1348 
1349 static int
SMB2_sess_establish_session(struct SMB2_sess_data * sess_data)1350 SMB2_sess_establish_session(struct SMB2_sess_data *sess_data)
1351 {
1352 	int rc = 0;
1353 	struct cifs_ses *ses = sess_data->ses;
1354 	struct TCP_Server_Info *server = cifs_ses_server(ses);
1355 
1356 	mutex_lock(&server->srv_mutex);
1357 	if (server->ops->generate_signingkey) {
1358 		rc = server->ops->generate_signingkey(ses);
1359 		if (rc) {
1360 			cifs_dbg(FYI,
1361 				"SMB3 session key generation failed\n");
1362 			mutex_unlock(&server->srv_mutex);
1363 			return rc;
1364 		}
1365 	}
1366 	if (!server->session_estab) {
1367 		server->sequence_number = 0x2;
1368 		server->session_estab = true;
1369 	}
1370 	mutex_unlock(&server->srv_mutex);
1371 
1372 	cifs_dbg(FYI, "SMB2/3 session established successfully\n");
1373 	/* keep existing ses state if binding */
1374 	if (!ses->binding) {
1375 		spin_lock(&GlobalMid_Lock);
1376 		ses->status = CifsGood;
1377 		ses->need_reconnect = false;
1378 		spin_unlock(&GlobalMid_Lock);
1379 	}
1380 
1381 	return rc;
1382 }
1383 
1384 #ifdef CONFIG_CIFS_UPCALL
1385 static void
SMB2_auth_kerberos(struct SMB2_sess_data * sess_data)1386 SMB2_auth_kerberos(struct SMB2_sess_data *sess_data)
1387 {
1388 	int rc;
1389 	struct cifs_ses *ses = sess_data->ses;
1390 	struct cifs_spnego_msg *msg;
1391 	struct key *spnego_key = NULL;
1392 	struct smb2_sess_setup_rsp *rsp = NULL;
1393 
1394 	rc = SMB2_sess_alloc_buffer(sess_data);
1395 	if (rc)
1396 		goto out;
1397 
1398 	spnego_key = cifs_get_spnego_key(ses);
1399 	if (IS_ERR(spnego_key)) {
1400 		rc = PTR_ERR(spnego_key);
1401 		if (rc == -ENOKEY)
1402 			cifs_dbg(VFS, "Verify user has a krb5 ticket and keyutils is installed\n");
1403 		spnego_key = NULL;
1404 		goto out;
1405 	}
1406 
1407 	msg = spnego_key->payload.data[0];
1408 	/*
1409 	 * check version field to make sure that cifs.upcall is
1410 	 * sending us a response in an expected form
1411 	 */
1412 	if (msg->version != CIFS_SPNEGO_UPCALL_VERSION) {
1413 		cifs_dbg(VFS, "bad cifs.upcall version. Expected %d got %d\n",
1414 			 CIFS_SPNEGO_UPCALL_VERSION, msg->version);
1415 		rc = -EKEYREJECTED;
1416 		goto out_put_spnego_key;
1417 	}
1418 
1419 	/* keep session key if binding */
1420 	if (!ses->binding) {
1421 		ses->auth_key.response = kmemdup(msg->data, msg->sesskey_len,
1422 						 GFP_KERNEL);
1423 		if (!ses->auth_key.response) {
1424 			cifs_dbg(VFS, "Kerberos can't allocate (%u bytes) memory\n",
1425 				 msg->sesskey_len);
1426 			rc = -ENOMEM;
1427 			goto out_put_spnego_key;
1428 		}
1429 		ses->auth_key.len = msg->sesskey_len;
1430 	}
1431 
1432 	sess_data->iov[1].iov_base = msg->data + msg->sesskey_len;
1433 	sess_data->iov[1].iov_len = msg->secblob_len;
1434 
1435 	rc = SMB2_sess_sendreceive(sess_data);
1436 	if (rc)
1437 		goto out_put_spnego_key;
1438 
1439 	rsp = (struct smb2_sess_setup_rsp *)sess_data->iov[0].iov_base;
1440 	/* keep session id and flags if binding */
1441 	if (!ses->binding) {
1442 		ses->Suid = rsp->sync_hdr.SessionId;
1443 		ses->session_flags = le16_to_cpu(rsp->SessionFlags);
1444 	}
1445 
1446 	rc = SMB2_sess_establish_session(sess_data);
1447 out_put_spnego_key:
1448 	key_invalidate(spnego_key);
1449 	key_put(spnego_key);
1450 out:
1451 	sess_data->result = rc;
1452 	sess_data->func = NULL;
1453 	SMB2_sess_free_buffer(sess_data);
1454 }
1455 #else
1456 static void
SMB2_auth_kerberos(struct SMB2_sess_data * sess_data)1457 SMB2_auth_kerberos(struct SMB2_sess_data *sess_data)
1458 {
1459 	cifs_dbg(VFS, "Kerberos negotiated but upcall support disabled!\n");
1460 	sess_data->result = -EOPNOTSUPP;
1461 	sess_data->func = NULL;
1462 }
1463 #endif
1464 
1465 static void
1466 SMB2_sess_auth_rawntlmssp_authenticate(struct SMB2_sess_data *sess_data);
1467 
1468 static void
SMB2_sess_auth_rawntlmssp_negotiate(struct SMB2_sess_data * sess_data)1469 SMB2_sess_auth_rawntlmssp_negotiate(struct SMB2_sess_data *sess_data)
1470 {
1471 	int rc;
1472 	struct cifs_ses *ses = sess_data->ses;
1473 	struct smb2_sess_setup_rsp *rsp = NULL;
1474 	char *ntlmssp_blob = NULL;
1475 	bool use_spnego = false; /* else use raw ntlmssp */
1476 	u16 blob_length = 0;
1477 
1478 	/*
1479 	 * If memory allocation is successful, caller of this function
1480 	 * frees it.
1481 	 */
1482 	ses->ntlmssp = kmalloc(sizeof(struct ntlmssp_auth), GFP_KERNEL);
1483 	if (!ses->ntlmssp) {
1484 		rc = -ENOMEM;
1485 		goto out_err;
1486 	}
1487 	ses->ntlmssp->sesskey_per_smbsess = true;
1488 
1489 	rc = SMB2_sess_alloc_buffer(sess_data);
1490 	if (rc)
1491 		goto out_err;
1492 
1493 	ntlmssp_blob = kmalloc(sizeof(struct _NEGOTIATE_MESSAGE),
1494 			       GFP_KERNEL);
1495 	if (ntlmssp_blob == NULL) {
1496 		rc = -ENOMEM;
1497 		goto out;
1498 	}
1499 
1500 	build_ntlmssp_negotiate_blob(ntlmssp_blob, ses);
1501 	if (use_spnego) {
1502 		/* BB eventually need to add this */
1503 		cifs_dbg(VFS, "spnego not supported for SMB2 yet\n");
1504 		rc = -EOPNOTSUPP;
1505 		goto out;
1506 	} else {
1507 		blob_length = sizeof(struct _NEGOTIATE_MESSAGE);
1508 		/* with raw NTLMSSP we don't encapsulate in SPNEGO */
1509 	}
1510 	sess_data->iov[1].iov_base = ntlmssp_blob;
1511 	sess_data->iov[1].iov_len = blob_length;
1512 
1513 	rc = SMB2_sess_sendreceive(sess_data);
1514 	rsp = (struct smb2_sess_setup_rsp *)sess_data->iov[0].iov_base;
1515 
1516 	/* If true, rc here is expected and not an error */
1517 	if (sess_data->buf0_type != CIFS_NO_BUFFER &&
1518 		rsp->sync_hdr.Status == STATUS_MORE_PROCESSING_REQUIRED)
1519 		rc = 0;
1520 
1521 	if (rc)
1522 		goto out;
1523 
1524 	if (offsetof(struct smb2_sess_setup_rsp, Buffer) !=
1525 			le16_to_cpu(rsp->SecurityBufferOffset)) {
1526 		cifs_dbg(VFS, "Invalid security buffer offset %d\n",
1527 			le16_to_cpu(rsp->SecurityBufferOffset));
1528 		rc = -EIO;
1529 		goto out;
1530 	}
1531 	rc = decode_ntlmssp_challenge(rsp->Buffer,
1532 			le16_to_cpu(rsp->SecurityBufferLength), ses);
1533 	if (rc)
1534 		goto out;
1535 
1536 	cifs_dbg(FYI, "rawntlmssp session setup challenge phase\n");
1537 
1538 	/* keep existing ses id and flags if binding */
1539 	if (!ses->binding) {
1540 		ses->Suid = rsp->sync_hdr.SessionId;
1541 		ses->session_flags = le16_to_cpu(rsp->SessionFlags);
1542 	}
1543 
1544 out:
1545 	kfree(ntlmssp_blob);
1546 	SMB2_sess_free_buffer(sess_data);
1547 	if (!rc) {
1548 		sess_data->result = 0;
1549 		sess_data->func = SMB2_sess_auth_rawntlmssp_authenticate;
1550 		return;
1551 	}
1552 out_err:
1553 	kfree(ses->ntlmssp);
1554 	ses->ntlmssp = NULL;
1555 	sess_data->result = rc;
1556 	sess_data->func = NULL;
1557 }
1558 
1559 static void
SMB2_sess_auth_rawntlmssp_authenticate(struct SMB2_sess_data * sess_data)1560 SMB2_sess_auth_rawntlmssp_authenticate(struct SMB2_sess_data *sess_data)
1561 {
1562 	int rc;
1563 	struct cifs_ses *ses = sess_data->ses;
1564 	struct smb2_sess_setup_req *req;
1565 	struct smb2_sess_setup_rsp *rsp = NULL;
1566 	unsigned char *ntlmssp_blob = NULL;
1567 	bool use_spnego = false; /* else use raw ntlmssp */
1568 	u16 blob_length = 0;
1569 
1570 	rc = SMB2_sess_alloc_buffer(sess_data);
1571 	if (rc)
1572 		goto out;
1573 
1574 	req = (struct smb2_sess_setup_req *) sess_data->iov[0].iov_base;
1575 	req->sync_hdr.SessionId = ses->Suid;
1576 
1577 	rc = build_ntlmssp_auth_blob(&ntlmssp_blob, &blob_length, ses,
1578 					sess_data->nls_cp);
1579 	if (rc) {
1580 		cifs_dbg(FYI, "build_ntlmssp_auth_blob failed %d\n", rc);
1581 		goto out;
1582 	}
1583 
1584 	if (use_spnego) {
1585 		/* BB eventually need to add this */
1586 		cifs_dbg(VFS, "spnego not supported for SMB2 yet\n");
1587 		rc = -EOPNOTSUPP;
1588 		goto out;
1589 	}
1590 	sess_data->iov[1].iov_base = ntlmssp_blob;
1591 	sess_data->iov[1].iov_len = blob_length;
1592 
1593 	rc = SMB2_sess_sendreceive(sess_data);
1594 	if (rc)
1595 		goto out;
1596 
1597 	rsp = (struct smb2_sess_setup_rsp *)sess_data->iov[0].iov_base;
1598 
1599 	/* keep existing ses id and flags if binding */
1600 	if (!ses->binding) {
1601 		ses->Suid = rsp->sync_hdr.SessionId;
1602 		ses->session_flags = le16_to_cpu(rsp->SessionFlags);
1603 	}
1604 
1605 	rc = SMB2_sess_establish_session(sess_data);
1606 #ifdef CONFIG_CIFS_DEBUG_DUMP_KEYS
1607 	if (ses->server->dialect < SMB30_PROT_ID) {
1608 		cifs_dbg(VFS, "%s: dumping generated SMB2 session keys\n", __func__);
1609 		/*
1610 		 * The session id is opaque in terms of endianness, so we can't
1611 		 * print it as a long long. we dump it as we got it on the wire
1612 		 */
1613 		cifs_dbg(VFS, "Session Id    %*ph\n", (int)sizeof(ses->Suid),
1614 			 &ses->Suid);
1615 		cifs_dbg(VFS, "Session Key   %*ph\n",
1616 			 SMB2_NTLMV2_SESSKEY_SIZE, ses->auth_key.response);
1617 		cifs_dbg(VFS, "Signing Key   %*ph\n",
1618 			 SMB3_SIGN_KEY_SIZE, ses->auth_key.response);
1619 	}
1620 #endif
1621 out:
1622 	kfree(ntlmssp_blob);
1623 	SMB2_sess_free_buffer(sess_data);
1624 	kfree(ses->ntlmssp);
1625 	ses->ntlmssp = NULL;
1626 	sess_data->result = rc;
1627 	sess_data->func = NULL;
1628 }
1629 
1630 static int
SMB2_select_sec(struct cifs_ses * ses,struct SMB2_sess_data * sess_data)1631 SMB2_select_sec(struct cifs_ses *ses, struct SMB2_sess_data *sess_data)
1632 {
1633 	int type;
1634 
1635 	type = smb2_select_sectype(cifs_ses_server(ses), ses->sectype);
1636 	cifs_dbg(FYI, "sess setup type %d\n", type);
1637 	if (type == Unspecified) {
1638 		cifs_dbg(VFS, "Unable to select appropriate authentication method!\n");
1639 		return -EINVAL;
1640 	}
1641 
1642 	switch (type) {
1643 	case Kerberos:
1644 		sess_data->func = SMB2_auth_kerberos;
1645 		break;
1646 	case RawNTLMSSP:
1647 		sess_data->func = SMB2_sess_auth_rawntlmssp_negotiate;
1648 		break;
1649 	default:
1650 		cifs_dbg(VFS, "secType %d not supported!\n", type);
1651 		return -EOPNOTSUPP;
1652 	}
1653 
1654 	return 0;
1655 }
1656 
1657 int
SMB2_sess_setup(const unsigned int xid,struct cifs_ses * ses,const struct nls_table * nls_cp)1658 SMB2_sess_setup(const unsigned int xid, struct cifs_ses *ses,
1659 		const struct nls_table *nls_cp)
1660 {
1661 	int rc = 0;
1662 	struct TCP_Server_Info *server = cifs_ses_server(ses);
1663 	struct SMB2_sess_data *sess_data;
1664 
1665 	cifs_dbg(FYI, "Session Setup\n");
1666 
1667 	if (!server) {
1668 		WARN(1, "%s: server is NULL!\n", __func__);
1669 		return -EIO;
1670 	}
1671 
1672 	sess_data = kzalloc(sizeof(struct SMB2_sess_data), GFP_KERNEL);
1673 	if (!sess_data)
1674 		return -ENOMEM;
1675 
1676 	rc = SMB2_select_sec(ses, sess_data);
1677 	if (rc)
1678 		goto out;
1679 	sess_data->xid = xid;
1680 	sess_data->ses = ses;
1681 	sess_data->buf0_type = CIFS_NO_BUFFER;
1682 	sess_data->nls_cp = (struct nls_table *) nls_cp;
1683 	sess_data->previous_session = ses->Suid;
1684 
1685 	/*
1686 	 * Initialize the session hash with the server one.
1687 	 */
1688 	memcpy(ses->preauth_sha_hash, server->preauth_sha_hash,
1689 	       SMB2_PREAUTH_HASH_SIZE);
1690 
1691 	while (sess_data->func)
1692 		sess_data->func(sess_data);
1693 
1694 	if ((ses->session_flags & SMB2_SESSION_FLAG_IS_GUEST) && (ses->sign))
1695 		cifs_server_dbg(VFS, "signing requested but authenticated as guest\n");
1696 	rc = sess_data->result;
1697 out:
1698 	kfree(sess_data);
1699 	return rc;
1700 }
1701 
1702 int
SMB2_logoff(const unsigned int xid,struct cifs_ses * ses)1703 SMB2_logoff(const unsigned int xid, struct cifs_ses *ses)
1704 {
1705 	struct smb_rqst rqst;
1706 	struct smb2_logoff_req *req; /* response is also trivial struct */
1707 	int rc = 0;
1708 	struct TCP_Server_Info *server;
1709 	int flags = 0;
1710 	unsigned int total_len;
1711 	struct kvec iov[1];
1712 	struct kvec rsp_iov;
1713 	int resp_buf_type;
1714 
1715 	cifs_dbg(FYI, "disconnect session %p\n", ses);
1716 
1717 	if (ses && (ses->server))
1718 		server = ses->server;
1719 	else
1720 		return -EIO;
1721 
1722 	/* no need to send SMB logoff if uid already closed due to reconnect */
1723 	if (ses->need_reconnect)
1724 		goto smb2_session_already_dead;
1725 
1726 	rc = smb2_plain_req_init(SMB2_LOGOFF, NULL, ses->server,
1727 				 (void **) &req, &total_len);
1728 	if (rc)
1729 		return rc;
1730 
1731 	 /* since no tcon, smb2_init can not do this, so do here */
1732 	req->sync_hdr.SessionId = ses->Suid;
1733 
1734 	if (ses->session_flags & SMB2_SESSION_FLAG_ENCRYPT_DATA)
1735 		flags |= CIFS_TRANSFORM_REQ;
1736 	else if (server->sign)
1737 		req->sync_hdr.Flags |= SMB2_FLAGS_SIGNED;
1738 
1739 	flags |= CIFS_NO_RSP_BUF;
1740 
1741 	iov[0].iov_base = (char *)req;
1742 	iov[0].iov_len = total_len;
1743 
1744 	memset(&rqst, 0, sizeof(struct smb_rqst));
1745 	rqst.rq_iov = iov;
1746 	rqst.rq_nvec = 1;
1747 
1748 	rc = cifs_send_recv(xid, ses, ses->server,
1749 			    &rqst, &resp_buf_type, flags, &rsp_iov);
1750 	cifs_small_buf_release(req);
1751 	/*
1752 	 * No tcon so can't do
1753 	 * cifs_stats_inc(&tcon->stats.smb2_stats.smb2_com_fail[SMB2...]);
1754 	 */
1755 
1756 smb2_session_already_dead:
1757 	return rc;
1758 }
1759 
cifs_stats_fail_inc(struct cifs_tcon * tcon,uint16_t code)1760 static inline void cifs_stats_fail_inc(struct cifs_tcon *tcon, uint16_t code)
1761 {
1762 	cifs_stats_inc(&tcon->stats.smb2_stats.smb2_com_failed[code]);
1763 }
1764 
1765 #define MAX_SHARENAME_LENGTH (255 /* server */ + 80 /* share */ + 1 /* NULL */)
1766 
1767 /* These are similar values to what Windows uses */
init_copy_chunk_defaults(struct cifs_tcon * tcon)1768 static inline void init_copy_chunk_defaults(struct cifs_tcon *tcon)
1769 {
1770 	tcon->max_chunks = 256;
1771 	tcon->max_bytes_chunk = 1048576;
1772 	tcon->max_bytes_copy = 16777216;
1773 }
1774 
1775 int
SMB2_tcon(const unsigned int xid,struct cifs_ses * ses,const char * tree,struct cifs_tcon * tcon,const struct nls_table * cp)1776 SMB2_tcon(const unsigned int xid, struct cifs_ses *ses, const char *tree,
1777 	  struct cifs_tcon *tcon, const struct nls_table *cp)
1778 {
1779 	struct smb_rqst rqst;
1780 	struct smb2_tree_connect_req *req;
1781 	struct smb2_tree_connect_rsp *rsp = NULL;
1782 	struct kvec iov[2];
1783 	struct kvec rsp_iov = { NULL, 0 };
1784 	int rc = 0;
1785 	int resp_buftype;
1786 	int unc_path_len;
1787 	__le16 *unc_path = NULL;
1788 	int flags = 0;
1789 	unsigned int total_len;
1790 	struct TCP_Server_Info *server;
1791 
1792 	/* always use master channel */
1793 	server = ses->server;
1794 
1795 	cifs_dbg(FYI, "TCON\n");
1796 
1797 	if (!server || !tree)
1798 		return -EIO;
1799 
1800 	unc_path = kmalloc(MAX_SHARENAME_LENGTH * 2, GFP_KERNEL);
1801 	if (unc_path == NULL)
1802 		return -ENOMEM;
1803 
1804 	unc_path_len = cifs_strtoUTF16(unc_path, tree, strlen(tree), cp) + 1;
1805 	unc_path_len *= 2;
1806 	if (unc_path_len < 2) {
1807 		kfree(unc_path);
1808 		return -EINVAL;
1809 	}
1810 
1811 	/* SMB2 TREE_CONNECT request must be called with TreeId == 0 */
1812 	tcon->tid = 0;
1813 	atomic_set(&tcon->num_remote_opens, 0);
1814 	rc = smb2_plain_req_init(SMB2_TREE_CONNECT, tcon, server,
1815 				 (void **) &req, &total_len);
1816 	if (rc) {
1817 		kfree(unc_path);
1818 		return rc;
1819 	}
1820 
1821 	if (smb3_encryption_required(tcon))
1822 		flags |= CIFS_TRANSFORM_REQ;
1823 
1824 	iov[0].iov_base = (char *)req;
1825 	/* 1 for pad */
1826 	iov[0].iov_len = total_len - 1;
1827 
1828 	/* Testing shows that buffer offset must be at location of Buffer[0] */
1829 	req->PathOffset = cpu_to_le16(sizeof(struct smb2_tree_connect_req));
1830 	req->PathLength = cpu_to_le16(unc_path_len - 2);
1831 	iov[1].iov_base = unc_path;
1832 	iov[1].iov_len = unc_path_len;
1833 
1834 	/*
1835 	 * 3.11 tcon req must be signed if not encrypted. See MS-SMB2 3.2.4.1.1
1836 	 * unless it is guest or anonymous user. See MS-SMB2 3.2.5.3.1
1837 	 * (Samba servers don't always set the flag so also check if null user)
1838 	 */
1839 	if ((server->dialect == SMB311_PROT_ID) &&
1840 	    !smb3_encryption_required(tcon) &&
1841 	    !(ses->session_flags &
1842 		    (SMB2_SESSION_FLAG_IS_GUEST|SMB2_SESSION_FLAG_IS_NULL)) &&
1843 	    ((ses->user_name != NULL) || (ses->sectype == Kerberos)))
1844 		req->sync_hdr.Flags |= SMB2_FLAGS_SIGNED;
1845 
1846 	memset(&rqst, 0, sizeof(struct smb_rqst));
1847 	rqst.rq_iov = iov;
1848 	rqst.rq_nvec = 2;
1849 
1850 	/* Need 64 for max size write so ask for more in case not there yet */
1851 	req->sync_hdr.CreditRequest = cpu_to_le16(64);
1852 
1853 	rc = cifs_send_recv(xid, ses, server,
1854 			    &rqst, &resp_buftype, flags, &rsp_iov);
1855 	cifs_small_buf_release(req);
1856 	rsp = (struct smb2_tree_connect_rsp *)rsp_iov.iov_base;
1857 	trace_smb3_tcon(xid, tcon->tid, ses->Suid, tree, rc);
1858 	if (rc != 0) {
1859 		cifs_stats_fail_inc(tcon, SMB2_TREE_CONNECT_HE);
1860 		tcon->need_reconnect = true;
1861 		goto tcon_error_exit;
1862 	}
1863 
1864 	switch (rsp->ShareType) {
1865 	case SMB2_SHARE_TYPE_DISK:
1866 		cifs_dbg(FYI, "connection to disk share\n");
1867 		break;
1868 	case SMB2_SHARE_TYPE_PIPE:
1869 		tcon->pipe = true;
1870 		cifs_dbg(FYI, "connection to pipe share\n");
1871 		break;
1872 	case SMB2_SHARE_TYPE_PRINT:
1873 		tcon->print = true;
1874 		cifs_dbg(FYI, "connection to printer\n");
1875 		break;
1876 	default:
1877 		cifs_server_dbg(VFS, "unknown share type %d\n", rsp->ShareType);
1878 		rc = -EOPNOTSUPP;
1879 		goto tcon_error_exit;
1880 	}
1881 
1882 	tcon->share_flags = le32_to_cpu(rsp->ShareFlags);
1883 	tcon->capabilities = rsp->Capabilities; /* we keep caps little endian */
1884 	tcon->maximal_access = le32_to_cpu(rsp->MaximalAccess);
1885 	tcon->tidStatus = CifsGood;
1886 	tcon->need_reconnect = false;
1887 	tcon->tid = rsp->sync_hdr.TreeId;
1888 	strlcpy(tcon->treeName, tree, sizeof(tcon->treeName));
1889 
1890 	if ((rsp->Capabilities & SMB2_SHARE_CAP_DFS) &&
1891 	    ((tcon->share_flags & SHI1005_FLAGS_DFS) == 0))
1892 		cifs_tcon_dbg(VFS, "DFS capability contradicts DFS flag\n");
1893 
1894 	if (tcon->seal &&
1895 	    !(server->capabilities & SMB2_GLOBAL_CAP_ENCRYPTION))
1896 		cifs_tcon_dbg(VFS, "Encryption is requested but not supported\n");
1897 
1898 	init_copy_chunk_defaults(tcon);
1899 	if (server->ops->validate_negotiate)
1900 		rc = server->ops->validate_negotiate(xid, tcon);
1901 tcon_exit:
1902 
1903 	free_rsp_buf(resp_buftype, rsp);
1904 	kfree(unc_path);
1905 	return rc;
1906 
1907 tcon_error_exit:
1908 	if (rsp && rsp->sync_hdr.Status == STATUS_BAD_NETWORK_NAME) {
1909 		cifs_tcon_dbg(VFS, "BAD_NETWORK_NAME: %s\n", tree);
1910 	}
1911 	goto tcon_exit;
1912 }
1913 
1914 int
SMB2_tdis(const unsigned int xid,struct cifs_tcon * tcon)1915 SMB2_tdis(const unsigned int xid, struct cifs_tcon *tcon)
1916 {
1917 	struct smb_rqst rqst;
1918 	struct smb2_tree_disconnect_req *req; /* response is trivial */
1919 	int rc = 0;
1920 	struct cifs_ses *ses = tcon->ses;
1921 	int flags = 0;
1922 	unsigned int total_len;
1923 	struct kvec iov[1];
1924 	struct kvec rsp_iov;
1925 	int resp_buf_type;
1926 
1927 	cifs_dbg(FYI, "Tree Disconnect\n");
1928 
1929 	if (!ses || !(ses->server))
1930 		return -EIO;
1931 
1932 	if ((tcon->need_reconnect) || (tcon->ses->need_reconnect))
1933 		return 0;
1934 
1935 	close_cached_dir_lease(&tcon->crfid);
1936 
1937 	rc = smb2_plain_req_init(SMB2_TREE_DISCONNECT, tcon, ses->server,
1938 				 (void **) &req,
1939 				 &total_len);
1940 	if (rc)
1941 		return rc;
1942 
1943 	if (smb3_encryption_required(tcon))
1944 		flags |= CIFS_TRANSFORM_REQ;
1945 
1946 	flags |= CIFS_NO_RSP_BUF;
1947 
1948 	iov[0].iov_base = (char *)req;
1949 	iov[0].iov_len = total_len;
1950 
1951 	memset(&rqst, 0, sizeof(struct smb_rqst));
1952 	rqst.rq_iov = iov;
1953 	rqst.rq_nvec = 1;
1954 
1955 	rc = cifs_send_recv(xid, ses, ses->server,
1956 			    &rqst, &resp_buf_type, flags, &rsp_iov);
1957 	cifs_small_buf_release(req);
1958 	if (rc)
1959 		cifs_stats_fail_inc(tcon, SMB2_TREE_DISCONNECT_HE);
1960 
1961 	return rc;
1962 }
1963 
1964 
1965 static struct create_durable *
create_durable_buf(void)1966 create_durable_buf(void)
1967 {
1968 	struct create_durable *buf;
1969 
1970 	buf = kzalloc(sizeof(struct create_durable), GFP_KERNEL);
1971 	if (!buf)
1972 		return NULL;
1973 
1974 	buf->ccontext.DataOffset = cpu_to_le16(offsetof
1975 					(struct create_durable, Data));
1976 	buf->ccontext.DataLength = cpu_to_le32(16);
1977 	buf->ccontext.NameOffset = cpu_to_le16(offsetof
1978 				(struct create_durable, Name));
1979 	buf->ccontext.NameLength = cpu_to_le16(4);
1980 	/* SMB2_CREATE_DURABLE_HANDLE_REQUEST is "DHnQ" */
1981 	buf->Name[0] = 'D';
1982 	buf->Name[1] = 'H';
1983 	buf->Name[2] = 'n';
1984 	buf->Name[3] = 'Q';
1985 	return buf;
1986 }
1987 
1988 static struct create_durable *
create_reconnect_durable_buf(struct cifs_fid * fid)1989 create_reconnect_durable_buf(struct cifs_fid *fid)
1990 {
1991 	struct create_durable *buf;
1992 
1993 	buf = kzalloc(sizeof(struct create_durable), GFP_KERNEL);
1994 	if (!buf)
1995 		return NULL;
1996 
1997 	buf->ccontext.DataOffset = cpu_to_le16(offsetof
1998 					(struct create_durable, Data));
1999 	buf->ccontext.DataLength = cpu_to_le32(16);
2000 	buf->ccontext.NameOffset = cpu_to_le16(offsetof
2001 				(struct create_durable, Name));
2002 	buf->ccontext.NameLength = cpu_to_le16(4);
2003 	buf->Data.Fid.PersistentFileId = fid->persistent_fid;
2004 	buf->Data.Fid.VolatileFileId = fid->volatile_fid;
2005 	/* SMB2_CREATE_DURABLE_HANDLE_RECONNECT is "DHnC" */
2006 	buf->Name[0] = 'D';
2007 	buf->Name[1] = 'H';
2008 	buf->Name[2] = 'n';
2009 	buf->Name[3] = 'C';
2010 	return buf;
2011 }
2012 
2013 static void
parse_query_id_ctxt(struct create_context * cc,struct smb2_file_all_info * buf)2014 parse_query_id_ctxt(struct create_context *cc, struct smb2_file_all_info *buf)
2015 {
2016 	struct create_on_disk_id *pdisk_id = (struct create_on_disk_id *)cc;
2017 
2018 	cifs_dbg(FYI, "parse query id context 0x%llx 0x%llx\n",
2019 		pdisk_id->DiskFileId, pdisk_id->VolumeId);
2020 	buf->IndexNumber = pdisk_id->DiskFileId;
2021 }
2022 
2023 static void
parse_posix_ctxt(struct create_context * cc,struct smb2_file_all_info * info,struct create_posix_rsp * posix)2024 parse_posix_ctxt(struct create_context *cc, struct smb2_file_all_info *info,
2025 		 struct create_posix_rsp *posix)
2026 {
2027 	int sid_len;
2028 	u8 *beg = (u8 *)cc + le16_to_cpu(cc->DataOffset);
2029 	u8 *end = beg + le32_to_cpu(cc->DataLength);
2030 	u8 *sid;
2031 
2032 	memset(posix, 0, sizeof(*posix));
2033 
2034 	posix->nlink = le32_to_cpu(*(__le32 *)(beg + 0));
2035 	posix->reparse_tag = le32_to_cpu(*(__le32 *)(beg + 4));
2036 	posix->mode = le32_to_cpu(*(__le32 *)(beg + 8));
2037 
2038 	sid = beg + 12;
2039 	sid_len = posix_info_sid_size(sid, end);
2040 	if (sid_len < 0) {
2041 		cifs_dbg(VFS, "bad owner sid in posix create response\n");
2042 		return;
2043 	}
2044 	memcpy(&posix->owner, sid, sid_len);
2045 
2046 	sid = sid + sid_len;
2047 	sid_len = posix_info_sid_size(sid, end);
2048 	if (sid_len < 0) {
2049 		cifs_dbg(VFS, "bad group sid in posix create response\n");
2050 		return;
2051 	}
2052 	memcpy(&posix->group, sid, sid_len);
2053 
2054 	cifs_dbg(FYI, "nlink=%d mode=%o reparse_tag=%x\n",
2055 		 posix->nlink, posix->mode, posix->reparse_tag);
2056 }
2057 
2058 void
smb2_parse_contexts(struct TCP_Server_Info * server,struct smb2_create_rsp * rsp,unsigned int * epoch,char * lease_key,__u8 * oplock,struct smb2_file_all_info * buf,struct create_posix_rsp * posix)2059 smb2_parse_contexts(struct TCP_Server_Info *server,
2060 		    struct smb2_create_rsp *rsp,
2061 		    unsigned int *epoch, char *lease_key, __u8 *oplock,
2062 		    struct smb2_file_all_info *buf,
2063 		    struct create_posix_rsp *posix)
2064 {
2065 	char *data_offset;
2066 	struct create_context *cc;
2067 	unsigned int next;
2068 	unsigned int remaining;
2069 	char *name;
2070 	static const char smb3_create_tag_posix[] = {
2071 		0x93, 0xAD, 0x25, 0x50, 0x9C,
2072 		0xB4, 0x11, 0xE7, 0xB4, 0x23, 0x83,
2073 		0xDE, 0x96, 0x8B, 0xCD, 0x7C
2074 	};
2075 
2076 	*oplock = 0;
2077 	data_offset = (char *)rsp + le32_to_cpu(rsp->CreateContextsOffset);
2078 	remaining = le32_to_cpu(rsp->CreateContextsLength);
2079 	cc = (struct create_context *)data_offset;
2080 
2081 	/* Initialize inode number to 0 in case no valid data in qfid context */
2082 	if (buf)
2083 		buf->IndexNumber = 0;
2084 
2085 	while (remaining >= sizeof(struct create_context)) {
2086 		name = le16_to_cpu(cc->NameOffset) + (char *)cc;
2087 		if (le16_to_cpu(cc->NameLength) == 4 &&
2088 		    strncmp(name, SMB2_CREATE_REQUEST_LEASE, 4) == 0)
2089 			*oplock = server->ops->parse_lease_buf(cc, epoch,
2090 							   lease_key);
2091 		else if (buf && (le16_to_cpu(cc->NameLength) == 4) &&
2092 		    strncmp(name, SMB2_CREATE_QUERY_ON_DISK_ID, 4) == 0)
2093 			parse_query_id_ctxt(cc, buf);
2094 		else if ((le16_to_cpu(cc->NameLength) == 16)) {
2095 			if (posix &&
2096 			    memcmp(name, smb3_create_tag_posix, 16) == 0)
2097 				parse_posix_ctxt(cc, buf, posix);
2098 		}
2099 		/* else {
2100 			cifs_dbg(FYI, "Context not matched with len %d\n",
2101 				le16_to_cpu(cc->NameLength));
2102 			cifs_dump_mem("Cctxt name: ", name, 4);
2103 		} */
2104 
2105 		next = le32_to_cpu(cc->Next);
2106 		if (!next)
2107 			break;
2108 		remaining -= next;
2109 		cc = (struct create_context *)((char *)cc + next);
2110 	}
2111 
2112 	if (rsp->OplockLevel != SMB2_OPLOCK_LEVEL_LEASE)
2113 		*oplock = rsp->OplockLevel;
2114 
2115 	return;
2116 }
2117 
2118 static int
add_lease_context(struct TCP_Server_Info * server,struct kvec * iov,unsigned int * num_iovec,u8 * lease_key,__u8 * oplock)2119 add_lease_context(struct TCP_Server_Info *server, struct kvec *iov,
2120 		  unsigned int *num_iovec, u8 *lease_key, __u8 *oplock)
2121 {
2122 	struct smb2_create_req *req = iov[0].iov_base;
2123 	unsigned int num = *num_iovec;
2124 
2125 	iov[num].iov_base = server->ops->create_lease_buf(lease_key, *oplock);
2126 	if (iov[num].iov_base == NULL)
2127 		return -ENOMEM;
2128 	iov[num].iov_len = server->vals->create_lease_size;
2129 	req->RequestedOplockLevel = SMB2_OPLOCK_LEVEL_LEASE;
2130 	if (!req->CreateContextsOffset)
2131 		req->CreateContextsOffset = cpu_to_le32(
2132 				sizeof(struct smb2_create_req) +
2133 				iov[num - 1].iov_len);
2134 	le32_add_cpu(&req->CreateContextsLength,
2135 		     server->vals->create_lease_size);
2136 	*num_iovec = num + 1;
2137 	return 0;
2138 }
2139 
2140 static struct create_durable_v2 *
create_durable_v2_buf(struct cifs_open_parms * oparms)2141 create_durable_v2_buf(struct cifs_open_parms *oparms)
2142 {
2143 	struct cifs_fid *pfid = oparms->fid;
2144 	struct create_durable_v2 *buf;
2145 
2146 	buf = kzalloc(sizeof(struct create_durable_v2), GFP_KERNEL);
2147 	if (!buf)
2148 		return NULL;
2149 
2150 	buf->ccontext.DataOffset = cpu_to_le16(offsetof
2151 					(struct create_durable_v2, dcontext));
2152 	buf->ccontext.DataLength = cpu_to_le32(sizeof(struct durable_context_v2));
2153 	buf->ccontext.NameOffset = cpu_to_le16(offsetof
2154 				(struct create_durable_v2, Name));
2155 	buf->ccontext.NameLength = cpu_to_le16(4);
2156 
2157 	/*
2158 	 * NB: Handle timeout defaults to 0, which allows server to choose
2159 	 * (most servers default to 120 seconds) and most clients default to 0.
2160 	 * This can be overridden at mount ("handletimeout=") if the user wants
2161 	 * a different persistent (or resilient) handle timeout for all opens
2162 	 * opens on a particular SMB3 mount.
2163 	 */
2164 	buf->dcontext.Timeout = cpu_to_le32(oparms->tcon->handle_timeout);
2165 	buf->dcontext.Flags = cpu_to_le32(SMB2_DHANDLE_FLAG_PERSISTENT);
2166 	generate_random_uuid(buf->dcontext.CreateGuid);
2167 	memcpy(pfid->create_guid, buf->dcontext.CreateGuid, 16);
2168 
2169 	/* SMB2_CREATE_DURABLE_HANDLE_REQUEST is "DH2Q" */
2170 	buf->Name[0] = 'D';
2171 	buf->Name[1] = 'H';
2172 	buf->Name[2] = '2';
2173 	buf->Name[3] = 'Q';
2174 	return buf;
2175 }
2176 
2177 static struct create_durable_handle_reconnect_v2 *
create_reconnect_durable_v2_buf(struct cifs_fid * fid)2178 create_reconnect_durable_v2_buf(struct cifs_fid *fid)
2179 {
2180 	struct create_durable_handle_reconnect_v2 *buf;
2181 
2182 	buf = kzalloc(sizeof(struct create_durable_handle_reconnect_v2),
2183 			GFP_KERNEL);
2184 	if (!buf)
2185 		return NULL;
2186 
2187 	buf->ccontext.DataOffset =
2188 		cpu_to_le16(offsetof(struct create_durable_handle_reconnect_v2,
2189 				     dcontext));
2190 	buf->ccontext.DataLength =
2191 		cpu_to_le32(sizeof(struct durable_reconnect_context_v2));
2192 	buf->ccontext.NameOffset =
2193 		cpu_to_le16(offsetof(struct create_durable_handle_reconnect_v2,
2194 			    Name));
2195 	buf->ccontext.NameLength = cpu_to_le16(4);
2196 
2197 	buf->dcontext.Fid.PersistentFileId = fid->persistent_fid;
2198 	buf->dcontext.Fid.VolatileFileId = fid->volatile_fid;
2199 	buf->dcontext.Flags = cpu_to_le32(SMB2_DHANDLE_FLAG_PERSISTENT);
2200 	memcpy(buf->dcontext.CreateGuid, fid->create_guid, 16);
2201 
2202 	/* SMB2_CREATE_DURABLE_HANDLE_RECONNECT_V2 is "DH2C" */
2203 	buf->Name[0] = 'D';
2204 	buf->Name[1] = 'H';
2205 	buf->Name[2] = '2';
2206 	buf->Name[3] = 'C';
2207 	return buf;
2208 }
2209 
2210 static int
add_durable_v2_context(struct kvec * iov,unsigned int * num_iovec,struct cifs_open_parms * oparms)2211 add_durable_v2_context(struct kvec *iov, unsigned int *num_iovec,
2212 		    struct cifs_open_parms *oparms)
2213 {
2214 	struct smb2_create_req *req = iov[0].iov_base;
2215 	unsigned int num = *num_iovec;
2216 
2217 	iov[num].iov_base = create_durable_v2_buf(oparms);
2218 	if (iov[num].iov_base == NULL)
2219 		return -ENOMEM;
2220 	iov[num].iov_len = sizeof(struct create_durable_v2);
2221 	if (!req->CreateContextsOffset)
2222 		req->CreateContextsOffset =
2223 			cpu_to_le32(sizeof(struct smb2_create_req) +
2224 								iov[1].iov_len);
2225 	le32_add_cpu(&req->CreateContextsLength, sizeof(struct create_durable_v2));
2226 	*num_iovec = num + 1;
2227 	return 0;
2228 }
2229 
2230 static int
add_durable_reconnect_v2_context(struct kvec * iov,unsigned int * num_iovec,struct cifs_open_parms * oparms)2231 add_durable_reconnect_v2_context(struct kvec *iov, unsigned int *num_iovec,
2232 		    struct cifs_open_parms *oparms)
2233 {
2234 	struct smb2_create_req *req = iov[0].iov_base;
2235 	unsigned int num = *num_iovec;
2236 
2237 	/* indicate that we don't need to relock the file */
2238 	oparms->reconnect = false;
2239 
2240 	iov[num].iov_base = create_reconnect_durable_v2_buf(oparms->fid);
2241 	if (iov[num].iov_base == NULL)
2242 		return -ENOMEM;
2243 	iov[num].iov_len = sizeof(struct create_durable_handle_reconnect_v2);
2244 	if (!req->CreateContextsOffset)
2245 		req->CreateContextsOffset =
2246 			cpu_to_le32(sizeof(struct smb2_create_req) +
2247 								iov[1].iov_len);
2248 	le32_add_cpu(&req->CreateContextsLength,
2249 			sizeof(struct create_durable_handle_reconnect_v2));
2250 	*num_iovec = num + 1;
2251 	return 0;
2252 }
2253 
2254 static int
add_durable_context(struct kvec * iov,unsigned int * num_iovec,struct cifs_open_parms * oparms,bool use_persistent)2255 add_durable_context(struct kvec *iov, unsigned int *num_iovec,
2256 		    struct cifs_open_parms *oparms, bool use_persistent)
2257 {
2258 	struct smb2_create_req *req = iov[0].iov_base;
2259 	unsigned int num = *num_iovec;
2260 
2261 	if (use_persistent) {
2262 		if (oparms->reconnect)
2263 			return add_durable_reconnect_v2_context(iov, num_iovec,
2264 								oparms);
2265 		else
2266 			return add_durable_v2_context(iov, num_iovec, oparms);
2267 	}
2268 
2269 	if (oparms->reconnect) {
2270 		iov[num].iov_base = create_reconnect_durable_buf(oparms->fid);
2271 		/* indicate that we don't need to relock the file */
2272 		oparms->reconnect = false;
2273 	} else
2274 		iov[num].iov_base = create_durable_buf();
2275 	if (iov[num].iov_base == NULL)
2276 		return -ENOMEM;
2277 	iov[num].iov_len = sizeof(struct create_durable);
2278 	if (!req->CreateContextsOffset)
2279 		req->CreateContextsOffset =
2280 			cpu_to_le32(sizeof(struct smb2_create_req) +
2281 								iov[1].iov_len);
2282 	le32_add_cpu(&req->CreateContextsLength, sizeof(struct create_durable));
2283 	*num_iovec = num + 1;
2284 	return 0;
2285 }
2286 
2287 /* See MS-SMB2 2.2.13.2.7 */
2288 static struct crt_twarp_ctxt *
create_twarp_buf(__u64 timewarp)2289 create_twarp_buf(__u64 timewarp)
2290 {
2291 	struct crt_twarp_ctxt *buf;
2292 
2293 	buf = kzalloc(sizeof(struct crt_twarp_ctxt), GFP_KERNEL);
2294 	if (!buf)
2295 		return NULL;
2296 
2297 	buf->ccontext.DataOffset = cpu_to_le16(offsetof
2298 					(struct crt_twarp_ctxt, Timestamp));
2299 	buf->ccontext.DataLength = cpu_to_le32(8);
2300 	buf->ccontext.NameOffset = cpu_to_le16(offsetof
2301 				(struct crt_twarp_ctxt, Name));
2302 	buf->ccontext.NameLength = cpu_to_le16(4);
2303 	/* SMB2_CREATE_TIMEWARP_TOKEN is "TWrp" */
2304 	buf->Name[0] = 'T';
2305 	buf->Name[1] = 'W';
2306 	buf->Name[2] = 'r';
2307 	buf->Name[3] = 'p';
2308 	buf->Timestamp = cpu_to_le64(timewarp);
2309 	return buf;
2310 }
2311 
2312 /* See MS-SMB2 2.2.13.2.7 */
2313 static int
add_twarp_context(struct kvec * iov,unsigned int * num_iovec,__u64 timewarp)2314 add_twarp_context(struct kvec *iov, unsigned int *num_iovec, __u64 timewarp)
2315 {
2316 	struct smb2_create_req *req = iov[0].iov_base;
2317 	unsigned int num = *num_iovec;
2318 
2319 	iov[num].iov_base = create_twarp_buf(timewarp);
2320 	if (iov[num].iov_base == NULL)
2321 		return -ENOMEM;
2322 	iov[num].iov_len = sizeof(struct crt_twarp_ctxt);
2323 	if (!req->CreateContextsOffset)
2324 		req->CreateContextsOffset = cpu_to_le32(
2325 				sizeof(struct smb2_create_req) +
2326 				iov[num - 1].iov_len);
2327 	le32_add_cpu(&req->CreateContextsLength, sizeof(struct crt_twarp_ctxt));
2328 	*num_iovec = num + 1;
2329 	return 0;
2330 }
2331 
2332 /* See See http://technet.microsoft.com/en-us/library/hh509017(v=ws.10).aspx */
setup_owner_group_sids(char * buf)2333 static void setup_owner_group_sids(char *buf)
2334 {
2335 	struct owner_group_sids *sids = (struct owner_group_sids *)buf;
2336 
2337 	/* Populate the user ownership fields S-1-5-88-1 */
2338 	sids->owner.Revision = 1;
2339 	sids->owner.NumAuth = 3;
2340 	sids->owner.Authority[5] = 5;
2341 	sids->owner.SubAuthorities[0] = cpu_to_le32(88);
2342 	sids->owner.SubAuthorities[1] = cpu_to_le32(1);
2343 	sids->owner.SubAuthorities[2] = cpu_to_le32(current_fsuid().val);
2344 
2345 	/* Populate the group ownership fields S-1-5-88-2 */
2346 	sids->group.Revision = 1;
2347 	sids->group.NumAuth = 3;
2348 	sids->group.Authority[5] = 5;
2349 	sids->group.SubAuthorities[0] = cpu_to_le32(88);
2350 	sids->group.SubAuthorities[1] = cpu_to_le32(2);
2351 	sids->group.SubAuthorities[2] = cpu_to_le32(current_fsgid().val);
2352 
2353 	cifs_dbg(FYI, "owner S-1-5-88-1-%d, group S-1-5-88-2-%d\n", current_fsuid().val, current_fsgid().val);
2354 }
2355 
2356 /* See MS-SMB2 2.2.13.2.2 and MS-DTYP 2.4.6 */
2357 static struct crt_sd_ctxt *
create_sd_buf(umode_t mode,bool set_owner,unsigned int * len)2358 create_sd_buf(umode_t mode, bool set_owner, unsigned int *len)
2359 {
2360 	struct crt_sd_ctxt *buf;
2361 	__u8 *ptr, *aclptr;
2362 	unsigned int acelen, acl_size, ace_count;
2363 	unsigned int owner_offset = 0;
2364 	unsigned int group_offset = 0;
2365 	struct smb3_acl acl = {};
2366 
2367 	*len = roundup(sizeof(struct crt_sd_ctxt) + (sizeof(struct cifs_ace) * 4), 8);
2368 
2369 	if (set_owner) {
2370 		/* sizeof(struct owner_group_sids) is already multiple of 8 so no need to round */
2371 		*len += sizeof(struct owner_group_sids);
2372 	}
2373 
2374 	buf = kzalloc(*len, GFP_KERNEL);
2375 	if (buf == NULL)
2376 		return buf;
2377 
2378 	ptr = (__u8 *)&buf[1];
2379 	if (set_owner) {
2380 		/* offset fields are from beginning of security descriptor not of create context */
2381 		owner_offset = ptr - (__u8 *)&buf->sd;
2382 		buf->sd.OffsetOwner = cpu_to_le32(owner_offset);
2383 		group_offset = owner_offset + offsetof(struct owner_group_sids, group);
2384 		buf->sd.OffsetGroup = cpu_to_le32(group_offset);
2385 
2386 		setup_owner_group_sids(ptr);
2387 		ptr += sizeof(struct owner_group_sids);
2388 	} else {
2389 		buf->sd.OffsetOwner = 0;
2390 		buf->sd.OffsetGroup = 0;
2391 	}
2392 
2393 	buf->ccontext.DataOffset = cpu_to_le16(offsetof(struct crt_sd_ctxt, sd));
2394 	buf->ccontext.NameOffset = cpu_to_le16(offsetof(struct crt_sd_ctxt, Name));
2395 	buf->ccontext.NameLength = cpu_to_le16(4);
2396 	/* SMB2_CREATE_SD_BUFFER_TOKEN is "SecD" */
2397 	buf->Name[0] = 'S';
2398 	buf->Name[1] = 'e';
2399 	buf->Name[2] = 'c';
2400 	buf->Name[3] = 'D';
2401 	buf->sd.Revision = 1;  /* Must be one see MS-DTYP 2.4.6 */
2402 
2403 	/*
2404 	 * ACL is "self relative" ie ACL is stored in contiguous block of memory
2405 	 * and "DP" ie the DACL is present
2406 	 */
2407 	buf->sd.Control = cpu_to_le16(ACL_CONTROL_SR | ACL_CONTROL_DP);
2408 
2409 	/* offset owner, group and Sbz1 and SACL are all zero */
2410 	buf->sd.OffsetDacl = cpu_to_le32(ptr - (__u8 *)&buf->sd);
2411 	/* Ship the ACL for now. we will copy it into buf later. */
2412 	aclptr = ptr;
2413 	ptr += sizeof(struct smb3_acl);
2414 
2415 	/* create one ACE to hold the mode embedded in reserved special SID */
2416 	acelen = setup_special_mode_ACE((struct cifs_ace *)ptr, (__u64)mode);
2417 	ptr += acelen;
2418 	acl_size = acelen + sizeof(struct smb3_acl);
2419 	ace_count = 1;
2420 
2421 	if (set_owner) {
2422 		/* we do not need to reallocate buffer to add the two more ACEs. plenty of space */
2423 		acelen = setup_special_user_owner_ACE((struct cifs_ace *)ptr);
2424 		ptr += acelen;
2425 		acl_size += acelen;
2426 		ace_count += 1;
2427 	}
2428 
2429 	/* and one more ACE to allow access for authenticated users */
2430 	acelen = setup_authusers_ACE((struct cifs_ace *)ptr);
2431 	ptr += acelen;
2432 	acl_size += acelen;
2433 	ace_count += 1;
2434 
2435 	acl.AclRevision = ACL_REVISION; /* See 2.4.4.1 of MS-DTYP */
2436 	acl.AclSize = cpu_to_le16(acl_size);
2437 	acl.AceCount = cpu_to_le16(ace_count);
2438 	/* acl.Sbz1 and Sbz2 MBZ so are not set here, but initialized above */
2439 	memcpy(aclptr, &acl, sizeof(struct smb3_acl));
2440 
2441 	buf->ccontext.DataLength = cpu_to_le32(ptr - (__u8 *)&buf->sd);
2442 	*len = roundup(ptr - (__u8 *)buf, 8);
2443 
2444 	return buf;
2445 }
2446 
2447 static int
add_sd_context(struct kvec * iov,unsigned int * num_iovec,umode_t mode,bool set_owner)2448 add_sd_context(struct kvec *iov, unsigned int *num_iovec, umode_t mode, bool set_owner)
2449 {
2450 	struct smb2_create_req *req = iov[0].iov_base;
2451 	unsigned int num = *num_iovec;
2452 	unsigned int len = 0;
2453 
2454 	iov[num].iov_base = create_sd_buf(mode, set_owner, &len);
2455 	if (iov[num].iov_base == NULL)
2456 		return -ENOMEM;
2457 	iov[num].iov_len = len;
2458 	if (!req->CreateContextsOffset)
2459 		req->CreateContextsOffset = cpu_to_le32(
2460 				sizeof(struct smb2_create_req) +
2461 				iov[num - 1].iov_len);
2462 	le32_add_cpu(&req->CreateContextsLength, len);
2463 	*num_iovec = num + 1;
2464 	return 0;
2465 }
2466 
2467 static struct crt_query_id_ctxt *
create_query_id_buf(void)2468 create_query_id_buf(void)
2469 {
2470 	struct crt_query_id_ctxt *buf;
2471 
2472 	buf = kzalloc(sizeof(struct crt_query_id_ctxt), GFP_KERNEL);
2473 	if (!buf)
2474 		return NULL;
2475 
2476 	buf->ccontext.DataOffset = cpu_to_le16(0);
2477 	buf->ccontext.DataLength = cpu_to_le32(0);
2478 	buf->ccontext.NameOffset = cpu_to_le16(offsetof
2479 				(struct crt_query_id_ctxt, Name));
2480 	buf->ccontext.NameLength = cpu_to_le16(4);
2481 	/* SMB2_CREATE_QUERY_ON_DISK_ID is "QFid" */
2482 	buf->Name[0] = 'Q';
2483 	buf->Name[1] = 'F';
2484 	buf->Name[2] = 'i';
2485 	buf->Name[3] = 'd';
2486 	return buf;
2487 }
2488 
2489 /* See MS-SMB2 2.2.13.2.9 */
2490 static int
add_query_id_context(struct kvec * iov,unsigned int * num_iovec)2491 add_query_id_context(struct kvec *iov, unsigned int *num_iovec)
2492 {
2493 	struct smb2_create_req *req = iov[0].iov_base;
2494 	unsigned int num = *num_iovec;
2495 
2496 	iov[num].iov_base = create_query_id_buf();
2497 	if (iov[num].iov_base == NULL)
2498 		return -ENOMEM;
2499 	iov[num].iov_len = sizeof(struct crt_query_id_ctxt);
2500 	if (!req->CreateContextsOffset)
2501 		req->CreateContextsOffset = cpu_to_le32(
2502 				sizeof(struct smb2_create_req) +
2503 				iov[num - 1].iov_len);
2504 	le32_add_cpu(&req->CreateContextsLength, sizeof(struct crt_query_id_ctxt));
2505 	*num_iovec = num + 1;
2506 	return 0;
2507 }
2508 
2509 static int
alloc_path_with_tree_prefix(__le16 ** out_path,int * out_size,int * out_len,const char * treename,const __le16 * path)2510 alloc_path_with_tree_prefix(__le16 **out_path, int *out_size, int *out_len,
2511 			    const char *treename, const __le16 *path)
2512 {
2513 	int treename_len, path_len;
2514 	struct nls_table *cp;
2515 	const __le16 sep[] = {cpu_to_le16('\\'), cpu_to_le16(0x0000)};
2516 
2517 	/*
2518 	 * skip leading "\\"
2519 	 */
2520 	treename_len = strlen(treename);
2521 	if (treename_len < 2 || !(treename[0] == '\\' && treename[1] == '\\'))
2522 		return -EINVAL;
2523 
2524 	treename += 2;
2525 	treename_len -= 2;
2526 
2527 	path_len = UniStrnlen((wchar_t *)path, PATH_MAX);
2528 
2529 	/*
2530 	 * make room for one path separator between the treename and
2531 	 * path
2532 	 */
2533 	*out_len = treename_len + 1 + path_len;
2534 
2535 	/*
2536 	 * final path needs to be null-terminated UTF16 with a
2537 	 * size aligned to 8
2538 	 */
2539 
2540 	*out_size = roundup((*out_len+1)*2, 8);
2541 	*out_path = kzalloc(*out_size, GFP_KERNEL);
2542 	if (!*out_path)
2543 		return -ENOMEM;
2544 
2545 	cp = load_nls_default();
2546 	cifs_strtoUTF16(*out_path, treename, treename_len, cp);
2547 	UniStrcat(*out_path, sep);
2548 	UniStrcat(*out_path, path);
2549 	unload_nls(cp);
2550 
2551 	return 0;
2552 }
2553 
smb311_posix_mkdir(const unsigned int xid,struct inode * inode,umode_t mode,struct cifs_tcon * tcon,const char * full_path,struct cifs_sb_info * cifs_sb)2554 int smb311_posix_mkdir(const unsigned int xid, struct inode *inode,
2555 			       umode_t mode, struct cifs_tcon *tcon,
2556 			       const char *full_path,
2557 			       struct cifs_sb_info *cifs_sb)
2558 {
2559 	struct smb_rqst rqst;
2560 	struct smb2_create_req *req;
2561 	struct smb2_create_rsp *rsp = NULL;
2562 	struct cifs_ses *ses = tcon->ses;
2563 	struct kvec iov[3]; /* make sure at least one for each open context */
2564 	struct kvec rsp_iov = {NULL, 0};
2565 	int resp_buftype;
2566 	int uni_path_len;
2567 	__le16 *copy_path = NULL;
2568 	int copy_size;
2569 	int rc = 0;
2570 	unsigned int n_iov = 2;
2571 	__u32 file_attributes = 0;
2572 	char *pc_buf = NULL;
2573 	int flags = 0;
2574 	unsigned int total_len;
2575 	__le16 *utf16_path = NULL;
2576 	struct TCP_Server_Info *server = cifs_pick_channel(ses);
2577 
2578 	cifs_dbg(FYI, "mkdir\n");
2579 
2580 	/* resource #1: path allocation */
2581 	utf16_path = cifs_convert_path_to_utf16(full_path, cifs_sb);
2582 	if (!utf16_path)
2583 		return -ENOMEM;
2584 
2585 	if (!ses || !server) {
2586 		rc = -EIO;
2587 		goto err_free_path;
2588 	}
2589 
2590 	/* resource #2: request */
2591 	rc = smb2_plain_req_init(SMB2_CREATE, tcon, server,
2592 				 (void **) &req, &total_len);
2593 	if (rc)
2594 		goto err_free_path;
2595 
2596 
2597 	if (smb3_encryption_required(tcon))
2598 		flags |= CIFS_TRANSFORM_REQ;
2599 
2600 	req->ImpersonationLevel = IL_IMPERSONATION;
2601 	req->DesiredAccess = cpu_to_le32(FILE_WRITE_ATTRIBUTES);
2602 	/* File attributes ignored on open (used in create though) */
2603 	req->FileAttributes = cpu_to_le32(file_attributes);
2604 	req->ShareAccess = FILE_SHARE_ALL_LE;
2605 	req->CreateDisposition = cpu_to_le32(FILE_CREATE);
2606 	req->CreateOptions = cpu_to_le32(CREATE_NOT_FILE);
2607 
2608 	iov[0].iov_base = (char *)req;
2609 	/* -1 since last byte is buf[0] which is sent below (path) */
2610 	iov[0].iov_len = total_len - 1;
2611 
2612 	req->NameOffset = cpu_to_le16(sizeof(struct smb2_create_req));
2613 
2614 	/* [MS-SMB2] 2.2.13 NameOffset:
2615 	 * If SMB2_FLAGS_DFS_OPERATIONS is set in the Flags field of
2616 	 * the SMB2 header, the file name includes a prefix that will
2617 	 * be processed during DFS name normalization as specified in
2618 	 * section 3.3.5.9. Otherwise, the file name is relative to
2619 	 * the share that is identified by the TreeId in the SMB2
2620 	 * header.
2621 	 */
2622 	if (tcon->share_flags & SHI1005_FLAGS_DFS) {
2623 		int name_len;
2624 
2625 		req->sync_hdr.Flags |= SMB2_FLAGS_DFS_OPERATIONS;
2626 		rc = alloc_path_with_tree_prefix(&copy_path, &copy_size,
2627 						 &name_len,
2628 						 tcon->treeName, utf16_path);
2629 		if (rc)
2630 			goto err_free_req;
2631 
2632 		req->NameLength = cpu_to_le16(name_len * 2);
2633 		uni_path_len = copy_size;
2634 		/* free before overwriting resource */
2635 		kfree(utf16_path);
2636 		utf16_path = copy_path;
2637 	} else {
2638 		uni_path_len = (2 * UniStrnlen((wchar_t *)utf16_path, PATH_MAX)) + 2;
2639 		/* MUST set path len (NameLength) to 0 opening root of share */
2640 		req->NameLength = cpu_to_le16(uni_path_len - 2);
2641 		if (uni_path_len % 8 != 0) {
2642 			copy_size = roundup(uni_path_len, 8);
2643 			copy_path = kzalloc(copy_size, GFP_KERNEL);
2644 			if (!copy_path) {
2645 				rc = -ENOMEM;
2646 				goto err_free_req;
2647 			}
2648 			memcpy((char *)copy_path, (const char *)utf16_path,
2649 			       uni_path_len);
2650 			uni_path_len = copy_size;
2651 			/* free before overwriting resource */
2652 			kfree(utf16_path);
2653 			utf16_path = copy_path;
2654 		}
2655 	}
2656 
2657 	iov[1].iov_len = uni_path_len;
2658 	iov[1].iov_base = utf16_path;
2659 	req->RequestedOplockLevel = SMB2_OPLOCK_LEVEL_NONE;
2660 
2661 	if (tcon->posix_extensions) {
2662 		/* resource #3: posix buf */
2663 		rc = add_posix_context(iov, &n_iov, mode);
2664 		if (rc)
2665 			goto err_free_req;
2666 		pc_buf = iov[n_iov-1].iov_base;
2667 	}
2668 
2669 
2670 	memset(&rqst, 0, sizeof(struct smb_rqst));
2671 	rqst.rq_iov = iov;
2672 	rqst.rq_nvec = n_iov;
2673 
2674 	/* no need to inc num_remote_opens because we close it just below */
2675 	trace_smb3_posix_mkdir_enter(xid, tcon->tid, ses->Suid, CREATE_NOT_FILE,
2676 				    FILE_WRITE_ATTRIBUTES);
2677 	/* resource #4: response buffer */
2678 	rc = cifs_send_recv(xid, ses, server,
2679 			    &rqst, &resp_buftype, flags, &rsp_iov);
2680 	if (rc) {
2681 		cifs_stats_fail_inc(tcon, SMB2_CREATE_HE);
2682 		trace_smb3_posix_mkdir_err(xid, tcon->tid, ses->Suid,
2683 					   CREATE_NOT_FILE,
2684 					   FILE_WRITE_ATTRIBUTES, rc);
2685 		goto err_free_rsp_buf;
2686 	}
2687 
2688 	rsp = (struct smb2_create_rsp *)rsp_iov.iov_base;
2689 	trace_smb3_posix_mkdir_done(xid, rsp->PersistentFileId, tcon->tid,
2690 				    ses->Suid, CREATE_NOT_FILE,
2691 				    FILE_WRITE_ATTRIBUTES);
2692 
2693 	SMB2_close(xid, tcon, rsp->PersistentFileId, rsp->VolatileFileId);
2694 
2695 	/* Eventually save off posix specific response info and timestaps */
2696 
2697 err_free_rsp_buf:
2698 	free_rsp_buf(resp_buftype, rsp);
2699 	kfree(pc_buf);
2700 err_free_req:
2701 	cifs_small_buf_release(req);
2702 err_free_path:
2703 	kfree(utf16_path);
2704 	return rc;
2705 }
2706 
2707 int
SMB2_open_init(struct cifs_tcon * tcon,struct TCP_Server_Info * server,struct smb_rqst * rqst,__u8 * oplock,struct cifs_open_parms * oparms,__le16 * path)2708 SMB2_open_init(struct cifs_tcon *tcon, struct TCP_Server_Info *server,
2709 	       struct smb_rqst *rqst, __u8 *oplock,
2710 	       struct cifs_open_parms *oparms, __le16 *path)
2711 {
2712 	struct smb2_create_req *req;
2713 	unsigned int n_iov = 2;
2714 	__u32 file_attributes = 0;
2715 	int copy_size;
2716 	int uni_path_len;
2717 	unsigned int total_len;
2718 	struct kvec *iov = rqst->rq_iov;
2719 	__le16 *copy_path;
2720 	int rc;
2721 
2722 	rc = smb2_plain_req_init(SMB2_CREATE, tcon, server,
2723 				 (void **) &req, &total_len);
2724 	if (rc)
2725 		return rc;
2726 
2727 	iov[0].iov_base = (char *)req;
2728 	/* -1 since last byte is buf[0] which is sent below (path) */
2729 	iov[0].iov_len = total_len - 1;
2730 
2731 	if (oparms->create_options & CREATE_OPTION_READONLY)
2732 		file_attributes |= ATTR_READONLY;
2733 	if (oparms->create_options & CREATE_OPTION_SPECIAL)
2734 		file_attributes |= ATTR_SYSTEM;
2735 
2736 	req->ImpersonationLevel = IL_IMPERSONATION;
2737 	req->DesiredAccess = cpu_to_le32(oparms->desired_access);
2738 	/* File attributes ignored on open (used in create though) */
2739 	req->FileAttributes = cpu_to_le32(file_attributes);
2740 	req->ShareAccess = FILE_SHARE_ALL_LE;
2741 
2742 	req->CreateDisposition = cpu_to_le32(oparms->disposition);
2743 	req->CreateOptions = cpu_to_le32(oparms->create_options & CREATE_OPTIONS_MASK);
2744 	req->NameOffset = cpu_to_le16(sizeof(struct smb2_create_req));
2745 
2746 	/* [MS-SMB2] 2.2.13 NameOffset:
2747 	 * If SMB2_FLAGS_DFS_OPERATIONS is set in the Flags field of
2748 	 * the SMB2 header, the file name includes a prefix that will
2749 	 * be processed during DFS name normalization as specified in
2750 	 * section 3.3.5.9. Otherwise, the file name is relative to
2751 	 * the share that is identified by the TreeId in the SMB2
2752 	 * header.
2753 	 */
2754 	if (tcon->share_flags & SHI1005_FLAGS_DFS) {
2755 		int name_len;
2756 
2757 		req->sync_hdr.Flags |= SMB2_FLAGS_DFS_OPERATIONS;
2758 		rc = alloc_path_with_tree_prefix(&copy_path, &copy_size,
2759 						 &name_len,
2760 						 tcon->treeName, path);
2761 		if (rc)
2762 			return rc;
2763 		req->NameLength = cpu_to_le16(name_len * 2);
2764 		uni_path_len = copy_size;
2765 		path = copy_path;
2766 	} else {
2767 		uni_path_len = (2 * UniStrnlen((wchar_t *)path, PATH_MAX)) + 2;
2768 		/* MUST set path len (NameLength) to 0 opening root of share */
2769 		req->NameLength = cpu_to_le16(uni_path_len - 2);
2770 		copy_size = uni_path_len;
2771 		if (copy_size % 8 != 0)
2772 			copy_size = roundup(copy_size, 8);
2773 		copy_path = kzalloc(copy_size, GFP_KERNEL);
2774 		if (!copy_path)
2775 			return -ENOMEM;
2776 		memcpy((char *)copy_path, (const char *)path,
2777 		       uni_path_len);
2778 		uni_path_len = copy_size;
2779 		path = copy_path;
2780 	}
2781 
2782 	iov[1].iov_len = uni_path_len;
2783 	iov[1].iov_base = path;
2784 
2785 	if ((!server->oplocks) || (tcon->no_lease))
2786 		*oplock = SMB2_OPLOCK_LEVEL_NONE;
2787 
2788 	if (!(server->capabilities & SMB2_GLOBAL_CAP_LEASING) ||
2789 	    *oplock == SMB2_OPLOCK_LEVEL_NONE)
2790 		req->RequestedOplockLevel = *oplock;
2791 	else if (!(server->capabilities & SMB2_GLOBAL_CAP_DIRECTORY_LEASING) &&
2792 		  (oparms->create_options & CREATE_NOT_FILE))
2793 		req->RequestedOplockLevel = *oplock; /* no srv lease support */
2794 	else {
2795 		rc = add_lease_context(server, iov, &n_iov,
2796 				       oparms->fid->lease_key, oplock);
2797 		if (rc)
2798 			return rc;
2799 	}
2800 
2801 	if (*oplock == SMB2_OPLOCK_LEVEL_BATCH) {
2802 		/* need to set Next field of lease context if we request it */
2803 		if (server->capabilities & SMB2_GLOBAL_CAP_LEASING) {
2804 			struct create_context *ccontext =
2805 			    (struct create_context *)iov[n_iov-1].iov_base;
2806 			ccontext->Next =
2807 				cpu_to_le32(server->vals->create_lease_size);
2808 		}
2809 
2810 		rc = add_durable_context(iov, &n_iov, oparms,
2811 					tcon->use_persistent);
2812 		if (rc)
2813 			return rc;
2814 	}
2815 
2816 	if (tcon->posix_extensions) {
2817 		if (n_iov > 2) {
2818 			struct create_context *ccontext =
2819 			    (struct create_context *)iov[n_iov-1].iov_base;
2820 			ccontext->Next =
2821 				cpu_to_le32(iov[n_iov-1].iov_len);
2822 		}
2823 
2824 		rc = add_posix_context(iov, &n_iov, oparms->mode);
2825 		if (rc)
2826 			return rc;
2827 	}
2828 
2829 	if (tcon->snapshot_time) {
2830 		cifs_dbg(FYI, "adding snapshot context\n");
2831 		if (n_iov > 2) {
2832 			struct create_context *ccontext =
2833 			    (struct create_context *)iov[n_iov-1].iov_base;
2834 			ccontext->Next =
2835 				cpu_to_le32(iov[n_iov-1].iov_len);
2836 		}
2837 
2838 		rc = add_twarp_context(iov, &n_iov, tcon->snapshot_time);
2839 		if (rc)
2840 			return rc;
2841 	}
2842 
2843 	if ((oparms->disposition != FILE_OPEN) && (oparms->cifs_sb)) {
2844 		bool set_mode;
2845 		bool set_owner;
2846 
2847 		if ((oparms->cifs_sb->mnt_cifs_flags & CIFS_MOUNT_MODE_FROM_SID) &&
2848 		    (oparms->mode != ACL_NO_MODE))
2849 			set_mode = true;
2850 		else {
2851 			set_mode = false;
2852 			oparms->mode = ACL_NO_MODE;
2853 		}
2854 
2855 		if (oparms->cifs_sb->mnt_cifs_flags & CIFS_MOUNT_UID_FROM_ACL)
2856 			set_owner = true;
2857 		else
2858 			set_owner = false;
2859 
2860 		if (set_owner | set_mode) {
2861 			if (n_iov > 2) {
2862 				struct create_context *ccontext =
2863 				    (struct create_context *)iov[n_iov-1].iov_base;
2864 				ccontext->Next = cpu_to_le32(iov[n_iov-1].iov_len);
2865 			}
2866 
2867 			cifs_dbg(FYI, "add sd with mode 0x%x\n", oparms->mode);
2868 			rc = add_sd_context(iov, &n_iov, oparms->mode, set_owner);
2869 			if (rc)
2870 				return rc;
2871 		}
2872 	}
2873 
2874 	if (n_iov > 2) {
2875 		struct create_context *ccontext =
2876 			(struct create_context *)iov[n_iov-1].iov_base;
2877 		ccontext->Next = cpu_to_le32(iov[n_iov-1].iov_len);
2878 	}
2879 	add_query_id_context(iov, &n_iov);
2880 
2881 	rqst->rq_nvec = n_iov;
2882 	return 0;
2883 }
2884 
2885 /* rq_iov[0] is the request and is released by cifs_small_buf_release().
2886  * All other vectors are freed by kfree().
2887  */
2888 void
SMB2_open_free(struct smb_rqst * rqst)2889 SMB2_open_free(struct smb_rqst *rqst)
2890 {
2891 	int i;
2892 
2893 	if (rqst && rqst->rq_iov) {
2894 		cifs_small_buf_release(rqst->rq_iov[0].iov_base);
2895 		for (i = 1; i < rqst->rq_nvec; i++)
2896 			if (rqst->rq_iov[i].iov_base != smb2_padding)
2897 				kfree(rqst->rq_iov[i].iov_base);
2898 	}
2899 }
2900 
2901 int
SMB2_open(const unsigned int xid,struct cifs_open_parms * oparms,__le16 * path,__u8 * oplock,struct smb2_file_all_info * buf,struct create_posix_rsp * posix,struct kvec * err_iov,int * buftype)2902 SMB2_open(const unsigned int xid, struct cifs_open_parms *oparms, __le16 *path,
2903 	  __u8 *oplock, struct smb2_file_all_info *buf,
2904 	  struct create_posix_rsp *posix,
2905 	  struct kvec *err_iov, int *buftype)
2906 {
2907 	struct smb_rqst rqst;
2908 	struct smb2_create_rsp *rsp = NULL;
2909 	struct cifs_tcon *tcon = oparms->tcon;
2910 	struct cifs_ses *ses = tcon->ses;
2911 	struct TCP_Server_Info *server = cifs_pick_channel(ses);
2912 	struct kvec iov[SMB2_CREATE_IOV_SIZE];
2913 	struct kvec rsp_iov = {NULL, 0};
2914 	int resp_buftype = CIFS_NO_BUFFER;
2915 	int rc = 0;
2916 	int flags = 0;
2917 
2918 	cifs_dbg(FYI, "create/open\n");
2919 	if (!ses || !server)
2920 		return -EIO;
2921 
2922 	if (smb3_encryption_required(tcon))
2923 		flags |= CIFS_TRANSFORM_REQ;
2924 
2925 	memset(&rqst, 0, sizeof(struct smb_rqst));
2926 	memset(&iov, 0, sizeof(iov));
2927 	rqst.rq_iov = iov;
2928 	rqst.rq_nvec = SMB2_CREATE_IOV_SIZE;
2929 
2930 	rc = SMB2_open_init(tcon, server,
2931 			    &rqst, oplock, oparms, path);
2932 	if (rc)
2933 		goto creat_exit;
2934 
2935 	trace_smb3_open_enter(xid, tcon->tid, tcon->ses->Suid,
2936 		oparms->create_options, oparms->desired_access);
2937 
2938 	rc = cifs_send_recv(xid, ses, server,
2939 			    &rqst, &resp_buftype, flags,
2940 			    &rsp_iov);
2941 	rsp = (struct smb2_create_rsp *)rsp_iov.iov_base;
2942 
2943 	if (rc != 0) {
2944 		cifs_stats_fail_inc(tcon, SMB2_CREATE_HE);
2945 		if (err_iov && rsp) {
2946 			*err_iov = rsp_iov;
2947 			*buftype = resp_buftype;
2948 			resp_buftype = CIFS_NO_BUFFER;
2949 			rsp = NULL;
2950 		}
2951 		trace_smb3_open_err(xid, tcon->tid, ses->Suid,
2952 				    oparms->create_options, oparms->desired_access, rc);
2953 		if (rc == -EREMCHG) {
2954 			pr_warn_once("server share %s deleted\n",
2955 				     tcon->treeName);
2956 			tcon->need_reconnect = true;
2957 		}
2958 		goto creat_exit;
2959 	} else
2960 		trace_smb3_open_done(xid, rsp->PersistentFileId, tcon->tid,
2961 				     ses->Suid, oparms->create_options,
2962 				     oparms->desired_access);
2963 
2964 	atomic_inc(&tcon->num_remote_opens);
2965 	oparms->fid->persistent_fid = rsp->PersistentFileId;
2966 	oparms->fid->volatile_fid = rsp->VolatileFileId;
2967 	oparms->fid->access = oparms->desired_access;
2968 #ifdef CONFIG_CIFS_DEBUG2
2969 	oparms->fid->mid = le64_to_cpu(rsp->sync_hdr.MessageId);
2970 #endif /* CIFS_DEBUG2 */
2971 
2972 	if (buf) {
2973 		buf->CreationTime = rsp->CreationTime;
2974 		buf->LastAccessTime = rsp->LastAccessTime;
2975 		buf->LastWriteTime = rsp->LastWriteTime;
2976 		buf->ChangeTime = rsp->ChangeTime;
2977 		buf->AllocationSize = rsp->AllocationSize;
2978 		buf->EndOfFile = rsp->EndofFile;
2979 		buf->Attributes = rsp->FileAttributes;
2980 		buf->NumberOfLinks = cpu_to_le32(1);
2981 		buf->DeletePending = 0;
2982 	}
2983 
2984 
2985 	smb2_parse_contexts(server, rsp, &oparms->fid->epoch,
2986 			    oparms->fid->lease_key, oplock, buf, posix);
2987 creat_exit:
2988 	SMB2_open_free(&rqst);
2989 	free_rsp_buf(resp_buftype, rsp);
2990 	return rc;
2991 }
2992 
2993 int
SMB2_ioctl_init(struct cifs_tcon * tcon,struct TCP_Server_Info * server,struct smb_rqst * rqst,u64 persistent_fid,u64 volatile_fid,u32 opcode,bool is_fsctl,char * in_data,u32 indatalen,__u32 max_response_size)2994 SMB2_ioctl_init(struct cifs_tcon *tcon, struct TCP_Server_Info *server,
2995 		struct smb_rqst *rqst,
2996 		u64 persistent_fid, u64 volatile_fid, u32 opcode,
2997 		bool is_fsctl, char *in_data, u32 indatalen,
2998 		__u32 max_response_size)
2999 {
3000 	struct smb2_ioctl_req *req;
3001 	struct kvec *iov = rqst->rq_iov;
3002 	unsigned int total_len;
3003 	int rc;
3004 	char *in_data_buf;
3005 
3006 	rc = smb2_ioctl_req_init(opcode, tcon, server,
3007 				 (void **) &req, &total_len);
3008 	if (rc)
3009 		return rc;
3010 
3011 	if (indatalen) {
3012 		/*
3013 		 * indatalen is usually small at a couple of bytes max, so
3014 		 * just allocate through generic pool
3015 		 */
3016 		in_data_buf = kmemdup(in_data, indatalen, GFP_NOFS);
3017 		if (!in_data_buf) {
3018 			cifs_small_buf_release(req);
3019 			return -ENOMEM;
3020 		}
3021 	}
3022 
3023 	req->CtlCode = cpu_to_le32(opcode);
3024 	req->PersistentFileId = persistent_fid;
3025 	req->VolatileFileId = volatile_fid;
3026 
3027 	iov[0].iov_base = (char *)req;
3028 	/*
3029 	 * If no input data, the size of ioctl struct in
3030 	 * protocol spec still includes a 1 byte data buffer,
3031 	 * but if input data passed to ioctl, we do not
3032 	 * want to double count this, so we do not send
3033 	 * the dummy one byte of data in iovec[0] if sending
3034 	 * input data (in iovec[1]).
3035 	 */
3036 	if (indatalen) {
3037 		req->InputCount = cpu_to_le32(indatalen);
3038 		/* do not set InputOffset if no input data */
3039 		req->InputOffset =
3040 		       cpu_to_le32(offsetof(struct smb2_ioctl_req, Buffer));
3041 		rqst->rq_nvec = 2;
3042 		iov[0].iov_len = total_len - 1;
3043 		iov[1].iov_base = in_data_buf;
3044 		iov[1].iov_len = indatalen;
3045 	} else {
3046 		rqst->rq_nvec = 1;
3047 		iov[0].iov_len = total_len;
3048 	}
3049 
3050 	req->OutputOffset = 0;
3051 	req->OutputCount = 0; /* MBZ */
3052 
3053 	/*
3054 	 * In most cases max_response_size is set to 16K (CIFSMaxBufSize)
3055 	 * We Could increase default MaxOutputResponse, but that could require
3056 	 * more credits. Windows typically sets this smaller, but for some
3057 	 * ioctls it may be useful to allow server to send more. No point
3058 	 * limiting what the server can send as long as fits in one credit
3059 	 * We can not handle more than CIFS_MAX_BUF_SIZE yet but may want
3060 	 * to increase this limit up in the future.
3061 	 * Note that for snapshot queries that servers like Azure expect that
3062 	 * the first query be minimal size (and just used to get the number/size
3063 	 * of previous versions) so response size must be specified as EXACTLY
3064 	 * sizeof(struct snapshot_array) which is 16 when rounded up to multiple
3065 	 * of eight bytes.  Currently that is the only case where we set max
3066 	 * response size smaller.
3067 	 */
3068 	req->MaxOutputResponse = cpu_to_le32(max_response_size);
3069 	req->sync_hdr.CreditCharge =
3070 		cpu_to_le16(DIV_ROUND_UP(max(indatalen, max_response_size),
3071 					 SMB2_MAX_BUFFER_SIZE));
3072 	if (is_fsctl)
3073 		req->Flags = cpu_to_le32(SMB2_0_IOCTL_IS_FSCTL);
3074 	else
3075 		req->Flags = 0;
3076 
3077 	/* validate negotiate request must be signed - see MS-SMB2 3.2.5.5 */
3078 	if (opcode == FSCTL_VALIDATE_NEGOTIATE_INFO)
3079 		req->sync_hdr.Flags |= SMB2_FLAGS_SIGNED;
3080 
3081 	return 0;
3082 }
3083 
3084 void
SMB2_ioctl_free(struct smb_rqst * rqst)3085 SMB2_ioctl_free(struct smb_rqst *rqst)
3086 {
3087 	int i;
3088 	if (rqst && rqst->rq_iov) {
3089 		cifs_small_buf_release(rqst->rq_iov[0].iov_base); /* request */
3090 		for (i = 1; i < rqst->rq_nvec; i++)
3091 			if (rqst->rq_iov[i].iov_base != smb2_padding)
3092 				kfree(rqst->rq_iov[i].iov_base);
3093 	}
3094 }
3095 
3096 
3097 /*
3098  *	SMB2 IOCTL is used for both IOCTLs and FSCTLs
3099  */
3100 int
SMB2_ioctl(const unsigned int xid,struct cifs_tcon * tcon,u64 persistent_fid,u64 volatile_fid,u32 opcode,bool is_fsctl,char * in_data,u32 indatalen,u32 max_out_data_len,char ** out_data,u32 * plen)3101 SMB2_ioctl(const unsigned int xid, struct cifs_tcon *tcon, u64 persistent_fid,
3102 	   u64 volatile_fid, u32 opcode, bool is_fsctl,
3103 	   char *in_data, u32 indatalen, u32 max_out_data_len,
3104 	   char **out_data, u32 *plen /* returned data len */)
3105 {
3106 	struct smb_rqst rqst;
3107 	struct smb2_ioctl_rsp *rsp = NULL;
3108 	struct cifs_ses *ses;
3109 	struct TCP_Server_Info *server;
3110 	struct kvec iov[SMB2_IOCTL_IOV_SIZE];
3111 	struct kvec rsp_iov = {NULL, 0};
3112 	int resp_buftype = CIFS_NO_BUFFER;
3113 	int rc = 0;
3114 	int flags = 0;
3115 
3116 	cifs_dbg(FYI, "SMB2 IOCTL\n");
3117 
3118 	if (out_data != NULL)
3119 		*out_data = NULL;
3120 
3121 	/* zero out returned data len, in case of error */
3122 	if (plen)
3123 		*plen = 0;
3124 
3125 	if (!tcon)
3126 		return -EIO;
3127 
3128 	ses = tcon->ses;
3129 	if (!ses)
3130 		return -EIO;
3131 
3132 	server = cifs_pick_channel(ses);
3133 	if (!server)
3134 		return -EIO;
3135 
3136 	if (smb3_encryption_required(tcon))
3137 		flags |= CIFS_TRANSFORM_REQ;
3138 
3139 	memset(&rqst, 0, sizeof(struct smb_rqst));
3140 	memset(&iov, 0, sizeof(iov));
3141 	rqst.rq_iov = iov;
3142 	rqst.rq_nvec = SMB2_IOCTL_IOV_SIZE;
3143 
3144 	rc = SMB2_ioctl_init(tcon, server,
3145 			     &rqst, persistent_fid, volatile_fid, opcode,
3146 			     is_fsctl, in_data, indatalen, max_out_data_len);
3147 	if (rc)
3148 		goto ioctl_exit;
3149 
3150 	rc = cifs_send_recv(xid, ses, server,
3151 			    &rqst, &resp_buftype, flags,
3152 			    &rsp_iov);
3153 	rsp = (struct smb2_ioctl_rsp *)rsp_iov.iov_base;
3154 
3155 	if (rc != 0)
3156 		trace_smb3_fsctl_err(xid, persistent_fid, tcon->tid,
3157 				ses->Suid, 0, opcode, rc);
3158 
3159 	if ((rc != 0) && (rc != -EINVAL) && (rc != -E2BIG)) {
3160 		cifs_stats_fail_inc(tcon, SMB2_IOCTL_HE);
3161 		goto ioctl_exit;
3162 	} else if (rc == -EINVAL) {
3163 		if ((opcode != FSCTL_SRV_COPYCHUNK_WRITE) &&
3164 		    (opcode != FSCTL_SRV_COPYCHUNK)) {
3165 			cifs_stats_fail_inc(tcon, SMB2_IOCTL_HE);
3166 			goto ioctl_exit;
3167 		}
3168 	} else if (rc == -E2BIG) {
3169 		if (opcode != FSCTL_QUERY_ALLOCATED_RANGES) {
3170 			cifs_stats_fail_inc(tcon, SMB2_IOCTL_HE);
3171 			goto ioctl_exit;
3172 		}
3173 	}
3174 
3175 	/* check if caller wants to look at return data or just return rc */
3176 	if ((plen == NULL) || (out_data == NULL))
3177 		goto ioctl_exit;
3178 
3179 	*plen = le32_to_cpu(rsp->OutputCount);
3180 
3181 	/* We check for obvious errors in the output buffer length and offset */
3182 	if (*plen == 0)
3183 		goto ioctl_exit; /* server returned no data */
3184 	else if (*plen > rsp_iov.iov_len || *plen > 0xFF00) {
3185 		cifs_tcon_dbg(VFS, "srv returned invalid ioctl length: %d\n", *plen);
3186 		*plen = 0;
3187 		rc = -EIO;
3188 		goto ioctl_exit;
3189 	}
3190 
3191 	if (rsp_iov.iov_len - *plen < le32_to_cpu(rsp->OutputOffset)) {
3192 		cifs_tcon_dbg(VFS, "Malformed ioctl resp: len %d offset %d\n", *plen,
3193 			le32_to_cpu(rsp->OutputOffset));
3194 		*plen = 0;
3195 		rc = -EIO;
3196 		goto ioctl_exit;
3197 	}
3198 
3199 	*out_data = kmemdup((char *)rsp + le32_to_cpu(rsp->OutputOffset),
3200 			    *plen, GFP_KERNEL);
3201 	if (*out_data == NULL) {
3202 		rc = -ENOMEM;
3203 		goto ioctl_exit;
3204 	}
3205 
3206 ioctl_exit:
3207 	SMB2_ioctl_free(&rqst);
3208 	free_rsp_buf(resp_buftype, rsp);
3209 	return rc;
3210 }
3211 
3212 /*
3213  *   Individual callers to ioctl worker function follow
3214  */
3215 
3216 int
SMB2_set_compression(const unsigned int xid,struct cifs_tcon * tcon,u64 persistent_fid,u64 volatile_fid)3217 SMB2_set_compression(const unsigned int xid, struct cifs_tcon *tcon,
3218 		     u64 persistent_fid, u64 volatile_fid)
3219 {
3220 	int rc;
3221 	struct  compress_ioctl fsctl_input;
3222 	char *ret_data = NULL;
3223 
3224 	fsctl_input.CompressionState =
3225 			cpu_to_le16(COMPRESSION_FORMAT_DEFAULT);
3226 
3227 	rc = SMB2_ioctl(xid, tcon, persistent_fid, volatile_fid,
3228 			FSCTL_SET_COMPRESSION, true /* is_fsctl */,
3229 			(char *)&fsctl_input /* data input */,
3230 			2 /* in data len */, CIFSMaxBufSize /* max out data */,
3231 			&ret_data /* out data */, NULL);
3232 
3233 	cifs_dbg(FYI, "set compression rc %d\n", rc);
3234 
3235 	return rc;
3236 }
3237 
3238 int
SMB2_close_init(struct cifs_tcon * tcon,struct TCP_Server_Info * server,struct smb_rqst * rqst,u64 persistent_fid,u64 volatile_fid,bool query_attrs)3239 SMB2_close_init(struct cifs_tcon *tcon, struct TCP_Server_Info *server,
3240 		struct smb_rqst *rqst,
3241 		u64 persistent_fid, u64 volatile_fid, bool query_attrs)
3242 {
3243 	struct smb2_close_req *req;
3244 	struct kvec *iov = rqst->rq_iov;
3245 	unsigned int total_len;
3246 	int rc;
3247 
3248 	rc = smb2_plain_req_init(SMB2_CLOSE, tcon, server,
3249 				 (void **) &req, &total_len);
3250 	if (rc)
3251 		return rc;
3252 
3253 	req->PersistentFileId = persistent_fid;
3254 	req->VolatileFileId = volatile_fid;
3255 	if (query_attrs)
3256 		req->Flags = SMB2_CLOSE_FLAG_POSTQUERY_ATTRIB;
3257 	else
3258 		req->Flags = 0;
3259 	iov[0].iov_base = (char *)req;
3260 	iov[0].iov_len = total_len;
3261 
3262 	return 0;
3263 }
3264 
3265 void
SMB2_close_free(struct smb_rqst * rqst)3266 SMB2_close_free(struct smb_rqst *rqst)
3267 {
3268 	if (rqst && rqst->rq_iov)
3269 		cifs_small_buf_release(rqst->rq_iov[0].iov_base); /* request */
3270 }
3271 
3272 int
__SMB2_close(const unsigned int xid,struct cifs_tcon * tcon,u64 persistent_fid,u64 volatile_fid,struct smb2_file_network_open_info * pbuf)3273 __SMB2_close(const unsigned int xid, struct cifs_tcon *tcon,
3274 	     u64 persistent_fid, u64 volatile_fid,
3275 	     struct smb2_file_network_open_info *pbuf)
3276 {
3277 	struct smb_rqst rqst;
3278 	struct smb2_close_rsp *rsp = NULL;
3279 	struct cifs_ses *ses = tcon->ses;
3280 	struct TCP_Server_Info *server = cifs_pick_channel(ses);
3281 	struct kvec iov[1];
3282 	struct kvec rsp_iov;
3283 	int resp_buftype = CIFS_NO_BUFFER;
3284 	int rc = 0;
3285 	int flags = 0;
3286 	bool query_attrs = false;
3287 
3288 	cifs_dbg(FYI, "Close\n");
3289 
3290 	if (!ses || !server)
3291 		return -EIO;
3292 
3293 	if (smb3_encryption_required(tcon))
3294 		flags |= CIFS_TRANSFORM_REQ;
3295 
3296 	memset(&rqst, 0, sizeof(struct smb_rqst));
3297 	memset(&iov, 0, sizeof(iov));
3298 	rqst.rq_iov = iov;
3299 	rqst.rq_nvec = 1;
3300 
3301 	/* check if need to ask server to return timestamps in close response */
3302 	if (pbuf)
3303 		query_attrs = true;
3304 
3305 	trace_smb3_close_enter(xid, persistent_fid, tcon->tid, ses->Suid);
3306 	rc = SMB2_close_init(tcon, server,
3307 			     &rqst, persistent_fid, volatile_fid,
3308 			     query_attrs);
3309 	if (rc)
3310 		goto close_exit;
3311 
3312 	rc = cifs_send_recv(xid, ses, server,
3313 			    &rqst, &resp_buftype, flags, &rsp_iov);
3314 	rsp = (struct smb2_close_rsp *)rsp_iov.iov_base;
3315 
3316 	if (rc != 0) {
3317 		cifs_stats_fail_inc(tcon, SMB2_CLOSE_HE);
3318 		trace_smb3_close_err(xid, persistent_fid, tcon->tid, ses->Suid,
3319 				     rc);
3320 		goto close_exit;
3321 	} else {
3322 		trace_smb3_close_done(xid, persistent_fid, tcon->tid,
3323 				      ses->Suid);
3324 		/*
3325 		 * Note that have to subtract 4 since struct network_open_info
3326 		 * has a final 4 byte pad that close response does not have
3327 		 */
3328 		if (pbuf)
3329 			memcpy(pbuf, (char *)&rsp->CreationTime, sizeof(*pbuf) - 4);
3330 	}
3331 
3332 	atomic_dec(&tcon->num_remote_opens);
3333 close_exit:
3334 	SMB2_close_free(&rqst);
3335 	free_rsp_buf(resp_buftype, rsp);
3336 
3337 	/* retry close in a worker thread if this one is interrupted */
3338 	if (is_interrupt_error(rc)) {
3339 		int tmp_rc;
3340 
3341 		tmp_rc = smb2_handle_cancelled_close(tcon, persistent_fid,
3342 						     volatile_fid);
3343 		if (tmp_rc)
3344 			cifs_dbg(VFS, "handle cancelled close fid 0x%llx returned error %d\n",
3345 				 persistent_fid, tmp_rc);
3346 	}
3347 	return rc;
3348 }
3349 
3350 int
SMB2_close(const unsigned int xid,struct cifs_tcon * tcon,u64 persistent_fid,u64 volatile_fid)3351 SMB2_close(const unsigned int xid, struct cifs_tcon *tcon,
3352 		u64 persistent_fid, u64 volatile_fid)
3353 {
3354 	return __SMB2_close(xid, tcon, persistent_fid, volatile_fid, NULL);
3355 }
3356 
3357 int
smb2_validate_iov(unsigned int offset,unsigned int buffer_length,struct kvec * iov,unsigned int min_buf_size)3358 smb2_validate_iov(unsigned int offset, unsigned int buffer_length,
3359 		  struct kvec *iov, unsigned int min_buf_size)
3360 {
3361 	unsigned int smb_len = iov->iov_len;
3362 	char *end_of_smb = smb_len + (char *)iov->iov_base;
3363 	char *begin_of_buf = offset + (char *)iov->iov_base;
3364 	char *end_of_buf = begin_of_buf + buffer_length;
3365 
3366 
3367 	if (buffer_length < min_buf_size) {
3368 		cifs_dbg(VFS, "buffer length %d smaller than minimum size %d\n",
3369 			 buffer_length, min_buf_size);
3370 		return -EINVAL;
3371 	}
3372 
3373 	/* check if beyond RFC1001 maximum length */
3374 	if ((smb_len > 0x7FFFFF) || (buffer_length > 0x7FFFFF)) {
3375 		cifs_dbg(VFS, "buffer length %d or smb length %d too large\n",
3376 			 buffer_length, smb_len);
3377 		return -EINVAL;
3378 	}
3379 
3380 	if ((begin_of_buf > end_of_smb) || (end_of_buf > end_of_smb)) {
3381 		cifs_dbg(VFS, "Invalid server response, bad offset to data\n");
3382 		return -EINVAL;
3383 	}
3384 
3385 	return 0;
3386 }
3387 
3388 /*
3389  * If SMB buffer fields are valid, copy into temporary buffer to hold result.
3390  * Caller must free buffer.
3391  */
3392 int
smb2_validate_and_copy_iov(unsigned int offset,unsigned int buffer_length,struct kvec * iov,unsigned int minbufsize,char * data)3393 smb2_validate_and_copy_iov(unsigned int offset, unsigned int buffer_length,
3394 			   struct kvec *iov, unsigned int minbufsize,
3395 			   char *data)
3396 {
3397 	char *begin_of_buf = offset + (char *)iov->iov_base;
3398 	int rc;
3399 
3400 	if (!data)
3401 		return -EINVAL;
3402 
3403 	rc = smb2_validate_iov(offset, buffer_length, iov, minbufsize);
3404 	if (rc)
3405 		return rc;
3406 
3407 	memcpy(data, begin_of_buf, buffer_length);
3408 
3409 	return 0;
3410 }
3411 
3412 int
SMB2_query_info_init(struct cifs_tcon * tcon,struct TCP_Server_Info * server,struct smb_rqst * rqst,u64 persistent_fid,u64 volatile_fid,u8 info_class,u8 info_type,u32 additional_info,size_t output_len,size_t input_len,void * input)3413 SMB2_query_info_init(struct cifs_tcon *tcon, struct TCP_Server_Info *server,
3414 		     struct smb_rqst *rqst,
3415 		     u64 persistent_fid, u64 volatile_fid,
3416 		     u8 info_class, u8 info_type, u32 additional_info,
3417 		     size_t output_len, size_t input_len, void *input)
3418 {
3419 	struct smb2_query_info_req *req;
3420 	struct kvec *iov = rqst->rq_iov;
3421 	unsigned int total_len;
3422 	size_t len;
3423 	int rc;
3424 
3425 	if (unlikely(check_add_overflow(input_len, sizeof(*req), &len) ||
3426 		     len > CIFSMaxBufSize))
3427 		return -EINVAL;
3428 
3429 	rc = smb2_plain_req_init(SMB2_QUERY_INFO, tcon, server,
3430 				 (void **) &req, &total_len);
3431 	if (rc)
3432 		return rc;
3433 
3434 	req->InfoType = info_type;
3435 	req->FileInfoClass = info_class;
3436 	req->PersistentFileId = persistent_fid;
3437 	req->VolatileFileId = volatile_fid;
3438 	req->AdditionalInformation = cpu_to_le32(additional_info);
3439 
3440 	req->OutputBufferLength = cpu_to_le32(output_len);
3441 	if (input_len) {
3442 		req->InputBufferLength = cpu_to_le32(input_len);
3443 		/* total_len for smb query request never close to le16 max */
3444 		req->InputBufferOffset = cpu_to_le16(total_len - 1);
3445 		memcpy(req->Buffer, input, input_len);
3446 	}
3447 
3448 	iov[0].iov_base = (char *)req;
3449 	/* 1 for Buffer */
3450 	iov[0].iov_len = len;
3451 	return 0;
3452 }
3453 
3454 void
SMB2_query_info_free(struct smb_rqst * rqst)3455 SMB2_query_info_free(struct smb_rqst *rqst)
3456 {
3457 	if (rqst && rqst->rq_iov)
3458 		cifs_buf_release(rqst->rq_iov[0].iov_base); /* request */
3459 }
3460 
3461 static int
query_info(const unsigned int xid,struct cifs_tcon * tcon,u64 persistent_fid,u64 volatile_fid,u8 info_class,u8 info_type,u32 additional_info,size_t output_len,size_t min_len,void ** data,u32 * dlen)3462 query_info(const unsigned int xid, struct cifs_tcon *tcon,
3463 	   u64 persistent_fid, u64 volatile_fid, u8 info_class, u8 info_type,
3464 	   u32 additional_info, size_t output_len, size_t min_len, void **data,
3465 		u32 *dlen)
3466 {
3467 	struct smb_rqst rqst;
3468 	struct smb2_query_info_rsp *rsp = NULL;
3469 	struct kvec iov[1];
3470 	struct kvec rsp_iov;
3471 	int rc = 0;
3472 	int resp_buftype = CIFS_NO_BUFFER;
3473 	struct cifs_ses *ses = tcon->ses;
3474 	struct TCP_Server_Info *server;
3475 	int flags = 0;
3476 	bool allocated = false;
3477 
3478 	cifs_dbg(FYI, "Query Info\n");
3479 
3480 	if (!ses)
3481 		return -EIO;
3482 	server = cifs_pick_channel(ses);
3483 	if (!server)
3484 		return -EIO;
3485 
3486 	if (smb3_encryption_required(tcon))
3487 		flags |= CIFS_TRANSFORM_REQ;
3488 
3489 	memset(&rqst, 0, sizeof(struct smb_rqst));
3490 	memset(&iov, 0, sizeof(iov));
3491 	rqst.rq_iov = iov;
3492 	rqst.rq_nvec = 1;
3493 
3494 	rc = SMB2_query_info_init(tcon, server,
3495 				  &rqst, persistent_fid, volatile_fid,
3496 				  info_class, info_type, additional_info,
3497 				  output_len, 0, NULL);
3498 	if (rc)
3499 		goto qinf_exit;
3500 
3501 	trace_smb3_query_info_enter(xid, persistent_fid, tcon->tid,
3502 				    ses->Suid, info_class, (__u32)info_type);
3503 
3504 	rc = cifs_send_recv(xid, ses, server,
3505 			    &rqst, &resp_buftype, flags, &rsp_iov);
3506 	rsp = (struct smb2_query_info_rsp *)rsp_iov.iov_base;
3507 
3508 	if (rc) {
3509 		cifs_stats_fail_inc(tcon, SMB2_QUERY_INFO_HE);
3510 		trace_smb3_query_info_err(xid, persistent_fid, tcon->tid,
3511 				ses->Suid, info_class, (__u32)info_type, rc);
3512 		goto qinf_exit;
3513 	}
3514 
3515 	trace_smb3_query_info_done(xid, persistent_fid, tcon->tid,
3516 				ses->Suid, info_class, (__u32)info_type);
3517 
3518 	if (dlen) {
3519 		*dlen = le32_to_cpu(rsp->OutputBufferLength);
3520 		if (!*data) {
3521 			*data = kmalloc(*dlen, GFP_KERNEL);
3522 			if (!*data) {
3523 				cifs_tcon_dbg(VFS,
3524 					"Error %d allocating memory for acl\n",
3525 					rc);
3526 				*dlen = 0;
3527 				rc = -ENOMEM;
3528 				goto qinf_exit;
3529 			}
3530 			allocated = true;
3531 		}
3532 	}
3533 
3534 	rc = smb2_validate_and_copy_iov(le16_to_cpu(rsp->OutputBufferOffset),
3535 					le32_to_cpu(rsp->OutputBufferLength),
3536 					&rsp_iov, min_len, *data);
3537 	if (rc && allocated) {
3538 		kfree(*data);
3539 		*data = NULL;
3540 		*dlen = 0;
3541 	}
3542 
3543 qinf_exit:
3544 	SMB2_query_info_free(&rqst);
3545 	free_rsp_buf(resp_buftype, rsp);
3546 	return rc;
3547 }
3548 
SMB2_query_info(const unsigned int xid,struct cifs_tcon * tcon,u64 persistent_fid,u64 volatile_fid,struct smb2_file_all_info * data)3549 int SMB2_query_info(const unsigned int xid, struct cifs_tcon *tcon,
3550 	u64 persistent_fid, u64 volatile_fid, struct smb2_file_all_info *data)
3551 {
3552 	return query_info(xid, tcon, persistent_fid, volatile_fid,
3553 			  FILE_ALL_INFORMATION, SMB2_O_INFO_FILE, 0,
3554 			  sizeof(struct smb2_file_all_info) + PATH_MAX * 2,
3555 			  sizeof(struct smb2_file_all_info), (void **)&data,
3556 			  NULL);
3557 }
3558 
3559 #if 0
3560 /* currently unused, as now we are doing compounding instead (see smb311_posix_query_path_info) */
3561 int
3562 SMB311_posix_query_info(const unsigned int xid, struct cifs_tcon *tcon,
3563 		u64 persistent_fid, u64 volatile_fid, struct smb311_posix_qinfo *data, u32 *plen)
3564 {
3565 	size_t output_len = sizeof(struct smb311_posix_qinfo *) +
3566 			(sizeof(struct cifs_sid) * 2) + (PATH_MAX * 2);
3567 	*plen = 0;
3568 
3569 	return query_info(xid, tcon, persistent_fid, volatile_fid,
3570 			  SMB_FIND_FILE_POSIX_INFO, SMB2_O_INFO_FILE, 0,
3571 			  output_len, sizeof(struct smb311_posix_qinfo), (void **)&data, plen);
3572 	/* Note caller must free "data" (passed in above). It may be allocated in query_info call */
3573 }
3574 #endif
3575 
3576 int
SMB2_query_acl(const unsigned int xid,struct cifs_tcon * tcon,u64 persistent_fid,u64 volatile_fid,void ** data,u32 * plen,u32 extra_info)3577 SMB2_query_acl(const unsigned int xid, struct cifs_tcon *tcon,
3578 	       u64 persistent_fid, u64 volatile_fid,
3579 	       void **data, u32 *plen, u32 extra_info)
3580 {
3581 	__u32 additional_info = OWNER_SECINFO | GROUP_SECINFO | DACL_SECINFO |
3582 				extra_info;
3583 	*plen = 0;
3584 
3585 	return query_info(xid, tcon, persistent_fid, volatile_fid,
3586 			  0, SMB2_O_INFO_SECURITY, additional_info,
3587 			  SMB2_MAX_BUFFER_SIZE, MIN_SEC_DESC_LEN, data, plen);
3588 }
3589 
3590 int
SMB2_get_srv_num(const unsigned int xid,struct cifs_tcon * tcon,u64 persistent_fid,u64 volatile_fid,__le64 * uniqueid)3591 SMB2_get_srv_num(const unsigned int xid, struct cifs_tcon *tcon,
3592 		 u64 persistent_fid, u64 volatile_fid, __le64 *uniqueid)
3593 {
3594 	return query_info(xid, tcon, persistent_fid, volatile_fid,
3595 			  FILE_INTERNAL_INFORMATION, SMB2_O_INFO_FILE, 0,
3596 			  sizeof(struct smb2_file_internal_info),
3597 			  sizeof(struct smb2_file_internal_info),
3598 			  (void **)&uniqueid, NULL);
3599 }
3600 
3601 /*
3602  * CHANGE_NOTIFY Request is sent to get notifications on changes to a directory
3603  * See MS-SMB2 2.2.35 and 2.2.36
3604  */
3605 
3606 static int
SMB2_notify_init(const unsigned int xid,struct smb_rqst * rqst,struct cifs_tcon * tcon,struct TCP_Server_Info * server,u64 persistent_fid,u64 volatile_fid,u32 completion_filter,bool watch_tree)3607 SMB2_notify_init(const unsigned int xid, struct smb_rqst *rqst,
3608 		 struct cifs_tcon *tcon, struct TCP_Server_Info *server,
3609 		 u64 persistent_fid, u64 volatile_fid,
3610 		 u32 completion_filter, bool watch_tree)
3611 {
3612 	struct smb2_change_notify_req *req;
3613 	struct kvec *iov = rqst->rq_iov;
3614 	unsigned int total_len;
3615 	int rc;
3616 
3617 	rc = smb2_plain_req_init(SMB2_CHANGE_NOTIFY, tcon, server,
3618 				 (void **) &req, &total_len);
3619 	if (rc)
3620 		return rc;
3621 
3622 	req->PersistentFileId = persistent_fid;
3623 	req->VolatileFileId = volatile_fid;
3624 	/* See note 354 of MS-SMB2, 64K max */
3625 	req->OutputBufferLength =
3626 		cpu_to_le32(SMB2_MAX_BUFFER_SIZE - MAX_SMB2_HDR_SIZE);
3627 	req->CompletionFilter = cpu_to_le32(completion_filter);
3628 	if (watch_tree)
3629 		req->Flags = cpu_to_le16(SMB2_WATCH_TREE);
3630 	else
3631 		req->Flags = 0;
3632 
3633 	iov[0].iov_base = (char *)req;
3634 	iov[0].iov_len = total_len;
3635 
3636 	return 0;
3637 }
3638 
3639 int
SMB2_change_notify(const unsigned int xid,struct cifs_tcon * tcon,u64 persistent_fid,u64 volatile_fid,bool watch_tree,u32 completion_filter)3640 SMB2_change_notify(const unsigned int xid, struct cifs_tcon *tcon,
3641 		u64 persistent_fid, u64 volatile_fid, bool watch_tree,
3642 		u32 completion_filter)
3643 {
3644 	struct cifs_ses *ses = tcon->ses;
3645 	struct TCP_Server_Info *server = cifs_pick_channel(ses);
3646 	struct smb_rqst rqst;
3647 	struct kvec iov[1];
3648 	struct kvec rsp_iov = {NULL, 0};
3649 	int resp_buftype = CIFS_NO_BUFFER;
3650 	int flags = 0;
3651 	int rc = 0;
3652 
3653 	cifs_dbg(FYI, "change notify\n");
3654 	if (!ses || !server)
3655 		return -EIO;
3656 
3657 	if (smb3_encryption_required(tcon))
3658 		flags |= CIFS_TRANSFORM_REQ;
3659 
3660 	memset(&rqst, 0, sizeof(struct smb_rqst));
3661 	memset(&iov, 0, sizeof(iov));
3662 	rqst.rq_iov = iov;
3663 	rqst.rq_nvec = 1;
3664 
3665 	rc = SMB2_notify_init(xid, &rqst, tcon, server,
3666 			      persistent_fid, volatile_fid,
3667 			      completion_filter, watch_tree);
3668 	if (rc)
3669 		goto cnotify_exit;
3670 
3671 	trace_smb3_notify_enter(xid, persistent_fid, tcon->tid, ses->Suid,
3672 				(u8)watch_tree, completion_filter);
3673 	rc = cifs_send_recv(xid, ses, server,
3674 			    &rqst, &resp_buftype, flags, &rsp_iov);
3675 
3676 	if (rc != 0) {
3677 		cifs_stats_fail_inc(tcon, SMB2_CHANGE_NOTIFY_HE);
3678 		trace_smb3_notify_err(xid, persistent_fid, tcon->tid, ses->Suid,
3679 				(u8)watch_tree, completion_filter, rc);
3680 	} else
3681 		trace_smb3_notify_done(xid, persistent_fid, tcon->tid,
3682 				ses->Suid, (u8)watch_tree, completion_filter);
3683 
3684  cnotify_exit:
3685 	if (rqst.rq_iov)
3686 		cifs_small_buf_release(rqst.rq_iov[0].iov_base); /* request */
3687 	free_rsp_buf(resp_buftype, rsp_iov.iov_base);
3688 	return rc;
3689 }
3690 
3691 
3692 
3693 /*
3694  * This is a no-op for now. We're not really interested in the reply, but
3695  * rather in the fact that the server sent one and that server->lstrp
3696  * gets updated.
3697  *
3698  * FIXME: maybe we should consider checking that the reply matches request?
3699  */
3700 static void
smb2_echo_callback(struct mid_q_entry * mid)3701 smb2_echo_callback(struct mid_q_entry *mid)
3702 {
3703 	struct TCP_Server_Info *server = mid->callback_data;
3704 	struct smb2_echo_rsp *rsp = (struct smb2_echo_rsp *)mid->resp_buf;
3705 	struct cifs_credits credits = { .value = 0, .instance = 0 };
3706 
3707 	if (mid->mid_state == MID_RESPONSE_RECEIVED
3708 	    || mid->mid_state == MID_RESPONSE_MALFORMED) {
3709 		credits.value = le16_to_cpu(rsp->sync_hdr.CreditRequest);
3710 		credits.instance = server->reconnect_instance;
3711 	}
3712 
3713 	DeleteMidQEntry(mid);
3714 	add_credits(server, &credits, CIFS_ECHO_OP);
3715 }
3716 
smb2_reconnect_server(struct work_struct * work)3717 void smb2_reconnect_server(struct work_struct *work)
3718 {
3719 	struct TCP_Server_Info *server = container_of(work,
3720 					struct TCP_Server_Info, reconnect.work);
3721 	struct cifs_ses *ses;
3722 	struct cifs_tcon *tcon, *tcon2;
3723 	struct list_head tmp_list;
3724 	int tcon_exist = false;
3725 	int rc;
3726 	int resched = false;
3727 
3728 
3729 	/* Prevent simultaneous reconnects that can corrupt tcon->rlist list */
3730 	mutex_lock(&server->reconnect_mutex);
3731 
3732 	INIT_LIST_HEAD(&tmp_list);
3733 	cifs_dbg(FYI, "Need negotiate, reconnecting tcons\n");
3734 
3735 	spin_lock(&cifs_tcp_ses_lock);
3736 	list_for_each_entry(ses, &server->smb_ses_list, smb_ses_list) {
3737 		list_for_each_entry(tcon, &ses->tcon_list, tcon_list) {
3738 			if (tcon->need_reconnect || tcon->need_reopen_files) {
3739 				tcon->tc_count++;
3740 				list_add_tail(&tcon->rlist, &tmp_list);
3741 				tcon_exist = true;
3742 			}
3743 		}
3744 		/*
3745 		 * IPC has the same lifetime as its session and uses its
3746 		 * refcount.
3747 		 */
3748 		if (ses->tcon_ipc && ses->tcon_ipc->need_reconnect) {
3749 			list_add_tail(&ses->tcon_ipc->rlist, &tmp_list);
3750 			tcon_exist = true;
3751 			ses->ses_count++;
3752 		}
3753 	}
3754 	/*
3755 	 * Get the reference to server struct to be sure that the last call of
3756 	 * cifs_put_tcon() in the loop below won't release the server pointer.
3757 	 */
3758 	if (tcon_exist)
3759 		server->srv_count++;
3760 
3761 	spin_unlock(&cifs_tcp_ses_lock);
3762 
3763 	list_for_each_entry_safe(tcon, tcon2, &tmp_list, rlist) {
3764 		rc = smb2_reconnect(SMB2_INTERNAL_CMD, tcon, server);
3765 		if (!rc)
3766 			cifs_reopen_persistent_handles(tcon);
3767 		else
3768 			resched = true;
3769 		list_del_init(&tcon->rlist);
3770 		if (tcon->ipc)
3771 			cifs_put_smb_ses(tcon->ses);
3772 		else
3773 			cifs_put_tcon(tcon);
3774 	}
3775 
3776 	cifs_dbg(FYI, "Reconnecting tcons finished\n");
3777 	if (resched)
3778 		queue_delayed_work(cifsiod_wq, &server->reconnect, 2 * HZ);
3779 	mutex_unlock(&server->reconnect_mutex);
3780 
3781 	/* now we can safely release srv struct */
3782 	if (tcon_exist)
3783 		cifs_put_tcp_session(server, 1);
3784 }
3785 
3786 int
SMB2_echo(struct TCP_Server_Info * server)3787 SMB2_echo(struct TCP_Server_Info *server)
3788 {
3789 	struct smb2_echo_req *req;
3790 	int rc = 0;
3791 	struct kvec iov[1];
3792 	struct smb_rqst rqst = { .rq_iov = iov,
3793 				 .rq_nvec = 1 };
3794 	unsigned int total_len;
3795 
3796 	cifs_dbg(FYI, "In echo request\n");
3797 
3798 	if (server->tcpStatus == CifsNeedNegotiate) {
3799 		/* No need to send echo on newly established connections */
3800 		mod_delayed_work(cifsiod_wq, &server->reconnect, 0);
3801 		return rc;
3802 	}
3803 
3804 	rc = smb2_plain_req_init(SMB2_ECHO, NULL, server,
3805 				 (void **)&req, &total_len);
3806 	if (rc)
3807 		return rc;
3808 
3809 	req->sync_hdr.CreditRequest = cpu_to_le16(1);
3810 
3811 	iov[0].iov_len = total_len;
3812 	iov[0].iov_base = (char *)req;
3813 
3814 	rc = cifs_call_async(server, &rqst, NULL, smb2_echo_callback, NULL,
3815 			     server, CIFS_ECHO_OP, NULL);
3816 	if (rc)
3817 		cifs_dbg(FYI, "Echo request failed: %d\n", rc);
3818 
3819 	cifs_small_buf_release(req);
3820 	return rc;
3821 }
3822 
3823 void
SMB2_flush_free(struct smb_rqst * rqst)3824 SMB2_flush_free(struct smb_rqst *rqst)
3825 {
3826 	if (rqst && rqst->rq_iov)
3827 		cifs_small_buf_release(rqst->rq_iov[0].iov_base); /* request */
3828 }
3829 
3830 int
SMB2_flush_init(const unsigned int xid,struct smb_rqst * rqst,struct cifs_tcon * tcon,struct TCP_Server_Info * server,u64 persistent_fid,u64 volatile_fid)3831 SMB2_flush_init(const unsigned int xid, struct smb_rqst *rqst,
3832 		struct cifs_tcon *tcon, struct TCP_Server_Info *server,
3833 		u64 persistent_fid, u64 volatile_fid)
3834 {
3835 	struct smb2_flush_req *req;
3836 	struct kvec *iov = rqst->rq_iov;
3837 	unsigned int total_len;
3838 	int rc;
3839 
3840 	rc = smb2_plain_req_init(SMB2_FLUSH, tcon, server,
3841 				 (void **) &req, &total_len);
3842 	if (rc)
3843 		return rc;
3844 
3845 	req->PersistentFileId = persistent_fid;
3846 	req->VolatileFileId = volatile_fid;
3847 
3848 	iov[0].iov_base = (char *)req;
3849 	iov[0].iov_len = total_len;
3850 
3851 	return 0;
3852 }
3853 
3854 int
SMB2_flush(const unsigned int xid,struct cifs_tcon * tcon,u64 persistent_fid,u64 volatile_fid)3855 SMB2_flush(const unsigned int xid, struct cifs_tcon *tcon, u64 persistent_fid,
3856 	   u64 volatile_fid)
3857 {
3858 	struct cifs_ses *ses = tcon->ses;
3859 	struct smb_rqst rqst;
3860 	struct kvec iov[1];
3861 	struct kvec rsp_iov = {NULL, 0};
3862 	struct TCP_Server_Info *server = cifs_pick_channel(ses);
3863 	int resp_buftype = CIFS_NO_BUFFER;
3864 	int flags = 0;
3865 	int rc = 0;
3866 
3867 	cifs_dbg(FYI, "flush\n");
3868 	if (!ses || !(ses->server))
3869 		return -EIO;
3870 
3871 	if (smb3_encryption_required(tcon))
3872 		flags |= CIFS_TRANSFORM_REQ;
3873 
3874 	memset(&rqst, 0, sizeof(struct smb_rqst));
3875 	memset(&iov, 0, sizeof(iov));
3876 	rqst.rq_iov = iov;
3877 	rqst.rq_nvec = 1;
3878 
3879 	rc = SMB2_flush_init(xid, &rqst, tcon, server,
3880 			     persistent_fid, volatile_fid);
3881 	if (rc)
3882 		goto flush_exit;
3883 
3884 	trace_smb3_flush_enter(xid, persistent_fid, tcon->tid, ses->Suid);
3885 	rc = cifs_send_recv(xid, ses, server,
3886 			    &rqst, &resp_buftype, flags, &rsp_iov);
3887 
3888 	if (rc != 0) {
3889 		cifs_stats_fail_inc(tcon, SMB2_FLUSH_HE);
3890 		trace_smb3_flush_err(xid, persistent_fid, tcon->tid, ses->Suid,
3891 				     rc);
3892 	} else
3893 		trace_smb3_flush_done(xid, persistent_fid, tcon->tid,
3894 				      ses->Suid);
3895 
3896  flush_exit:
3897 	SMB2_flush_free(&rqst);
3898 	free_rsp_buf(resp_buftype, rsp_iov.iov_base);
3899 	return rc;
3900 }
3901 
3902 /*
3903  * To form a chain of read requests, any read requests after the first should
3904  * have the end_of_chain boolean set to true.
3905  */
3906 static int
smb2_new_read_req(void ** buf,unsigned int * total_len,struct cifs_io_parms * io_parms,struct cifs_readdata * rdata,unsigned int remaining_bytes,int request_type)3907 smb2_new_read_req(void **buf, unsigned int *total_len,
3908 	struct cifs_io_parms *io_parms, struct cifs_readdata *rdata,
3909 	unsigned int remaining_bytes, int request_type)
3910 {
3911 	int rc = -EACCES;
3912 	struct smb2_read_plain_req *req = NULL;
3913 	struct smb2_sync_hdr *shdr;
3914 	struct TCP_Server_Info *server = io_parms->server;
3915 
3916 	rc = smb2_plain_req_init(SMB2_READ, io_parms->tcon, server,
3917 				 (void **) &req, total_len);
3918 	if (rc)
3919 		return rc;
3920 
3921 	if (server == NULL)
3922 		return -ECONNABORTED;
3923 
3924 	shdr = &req->sync_hdr;
3925 	shdr->ProcessId = cpu_to_le32(io_parms->pid);
3926 
3927 	req->PersistentFileId = io_parms->persistent_fid;
3928 	req->VolatileFileId = io_parms->volatile_fid;
3929 	req->ReadChannelInfoOffset = 0; /* reserved */
3930 	req->ReadChannelInfoLength = 0; /* reserved */
3931 	req->Channel = 0; /* reserved */
3932 	req->MinimumCount = 0;
3933 	req->Length = cpu_to_le32(io_parms->length);
3934 	req->Offset = cpu_to_le64(io_parms->offset);
3935 
3936 	trace_smb3_read_enter(0 /* xid */,
3937 			io_parms->persistent_fid,
3938 			io_parms->tcon->tid, io_parms->tcon->ses->Suid,
3939 			io_parms->offset, io_parms->length);
3940 #ifdef CONFIG_CIFS_SMB_DIRECT
3941 	/*
3942 	 * If we want to do a RDMA write, fill in and append
3943 	 * smbd_buffer_descriptor_v1 to the end of read request
3944 	 */
3945 	if (server->rdma && rdata && !server->sign &&
3946 		rdata->bytes >= server->smbd_conn->rdma_readwrite_threshold) {
3947 
3948 		struct smbd_buffer_descriptor_v1 *v1;
3949 		bool need_invalidate = server->dialect == SMB30_PROT_ID;
3950 
3951 		rdata->mr = smbd_register_mr(
3952 				server->smbd_conn, rdata->pages,
3953 				rdata->nr_pages, rdata->page_offset,
3954 				rdata->tailsz, true, need_invalidate);
3955 		if (!rdata->mr)
3956 			return -EAGAIN;
3957 
3958 		req->Channel = SMB2_CHANNEL_RDMA_V1_INVALIDATE;
3959 		if (need_invalidate)
3960 			req->Channel = SMB2_CHANNEL_RDMA_V1;
3961 		req->ReadChannelInfoOffset =
3962 			cpu_to_le16(offsetof(struct smb2_read_plain_req, Buffer));
3963 		req->ReadChannelInfoLength =
3964 			cpu_to_le16(sizeof(struct smbd_buffer_descriptor_v1));
3965 		v1 = (struct smbd_buffer_descriptor_v1 *) &req->Buffer[0];
3966 		v1->offset = cpu_to_le64(rdata->mr->mr->iova);
3967 		v1->token = cpu_to_le32(rdata->mr->mr->rkey);
3968 		v1->length = cpu_to_le32(rdata->mr->mr->length);
3969 
3970 		*total_len += sizeof(*v1) - 1;
3971 	}
3972 #endif
3973 	if (request_type & CHAINED_REQUEST) {
3974 		if (!(request_type & END_OF_CHAIN)) {
3975 			/* next 8-byte aligned request */
3976 			*total_len = DIV_ROUND_UP(*total_len, 8) * 8;
3977 			shdr->NextCommand = cpu_to_le32(*total_len);
3978 		} else /* END_OF_CHAIN */
3979 			shdr->NextCommand = 0;
3980 		if (request_type & RELATED_REQUEST) {
3981 			shdr->Flags |= SMB2_FLAGS_RELATED_OPERATIONS;
3982 			/*
3983 			 * Related requests use info from previous read request
3984 			 * in chain.
3985 			 */
3986 			shdr->SessionId = 0xFFFFFFFFFFFFFFFF;
3987 			shdr->TreeId = 0xFFFFFFFF;
3988 			req->PersistentFileId = 0xFFFFFFFFFFFFFFFF;
3989 			req->VolatileFileId = 0xFFFFFFFFFFFFFFFF;
3990 		}
3991 	}
3992 	if (remaining_bytes > io_parms->length)
3993 		req->RemainingBytes = cpu_to_le32(remaining_bytes);
3994 	else
3995 		req->RemainingBytes = 0;
3996 
3997 	*buf = req;
3998 	return rc;
3999 }
4000 
4001 static void
smb2_readv_callback(struct mid_q_entry * mid)4002 smb2_readv_callback(struct mid_q_entry *mid)
4003 {
4004 	struct cifs_readdata *rdata = mid->callback_data;
4005 	struct cifs_tcon *tcon = tlink_tcon(rdata->cfile->tlink);
4006 	struct TCP_Server_Info *server = rdata->server;
4007 	struct smb2_sync_hdr *shdr =
4008 				(struct smb2_sync_hdr *)rdata->iov[0].iov_base;
4009 	struct cifs_credits credits = { .value = 0, .instance = 0 };
4010 	struct smb_rqst rqst = { .rq_iov = &rdata->iov[1],
4011 				 .rq_nvec = 1, };
4012 
4013 	if (rdata->got_bytes) {
4014 		rqst.rq_pages = rdata->pages;
4015 		rqst.rq_offset = rdata->page_offset;
4016 		rqst.rq_npages = rdata->nr_pages;
4017 		rqst.rq_pagesz = rdata->pagesz;
4018 		rqst.rq_tailsz = rdata->tailsz;
4019 	}
4020 
4021 	WARN_ONCE(rdata->server != mid->server,
4022 		  "rdata server %p != mid server %p",
4023 		  rdata->server, mid->server);
4024 
4025 	cifs_dbg(FYI, "%s: mid=%llu state=%d result=%d bytes=%u\n",
4026 		 __func__, mid->mid, mid->mid_state, rdata->result,
4027 		 rdata->bytes);
4028 
4029 	switch (mid->mid_state) {
4030 	case MID_RESPONSE_RECEIVED:
4031 		credits.value = le16_to_cpu(shdr->CreditRequest);
4032 		credits.instance = server->reconnect_instance;
4033 		/* result already set, check signature */
4034 		if (server->sign && !mid->decrypted) {
4035 			int rc;
4036 
4037 			rc = smb2_verify_signature(&rqst, server);
4038 			if (rc)
4039 				cifs_tcon_dbg(VFS, "SMB signature verification returned error = %d\n",
4040 					 rc);
4041 		}
4042 		/* FIXME: should this be counted toward the initiating task? */
4043 		task_io_account_read(rdata->got_bytes);
4044 		cifs_stats_bytes_read(tcon, rdata->got_bytes);
4045 		break;
4046 	case MID_REQUEST_SUBMITTED:
4047 	case MID_RETRY_NEEDED:
4048 		rdata->result = -EAGAIN;
4049 		if (server->sign && rdata->got_bytes)
4050 			/* reset bytes number since we can not check a sign */
4051 			rdata->got_bytes = 0;
4052 		/* FIXME: should this be counted toward the initiating task? */
4053 		task_io_account_read(rdata->got_bytes);
4054 		cifs_stats_bytes_read(tcon, rdata->got_bytes);
4055 		break;
4056 	case MID_RESPONSE_MALFORMED:
4057 		credits.value = le16_to_cpu(shdr->CreditRequest);
4058 		credits.instance = server->reconnect_instance;
4059 		fallthrough;
4060 	default:
4061 		rdata->result = -EIO;
4062 	}
4063 #ifdef CONFIG_CIFS_SMB_DIRECT
4064 	/*
4065 	 * If this rdata has a memmory registered, the MR can be freed
4066 	 * MR needs to be freed as soon as I/O finishes to prevent deadlock
4067 	 * because they have limited number and are used for future I/Os
4068 	 */
4069 	if (rdata->mr) {
4070 		smbd_deregister_mr(rdata->mr);
4071 		rdata->mr = NULL;
4072 	}
4073 #endif
4074 	if (rdata->result && rdata->result != -ENODATA) {
4075 		cifs_stats_fail_inc(tcon, SMB2_READ_HE);
4076 		trace_smb3_read_err(0 /* xid */,
4077 				    rdata->cfile->fid.persistent_fid,
4078 				    tcon->tid, tcon->ses->Suid, rdata->offset,
4079 				    rdata->bytes, rdata->result);
4080 	} else
4081 		trace_smb3_read_done(0 /* xid */,
4082 				     rdata->cfile->fid.persistent_fid,
4083 				     tcon->tid, tcon->ses->Suid,
4084 				     rdata->offset, rdata->got_bytes);
4085 
4086 	queue_work(cifsiod_wq, &rdata->work);
4087 	DeleteMidQEntry(mid);
4088 	add_credits(server, &credits, 0);
4089 }
4090 
4091 /* smb2_async_readv - send an async read, and set up mid to handle result */
4092 int
smb2_async_readv(struct cifs_readdata * rdata)4093 smb2_async_readv(struct cifs_readdata *rdata)
4094 {
4095 	int rc, flags = 0;
4096 	char *buf;
4097 	struct smb2_sync_hdr *shdr;
4098 	struct cifs_io_parms io_parms;
4099 	struct smb_rqst rqst = { .rq_iov = rdata->iov,
4100 				 .rq_nvec = 1 };
4101 	struct TCP_Server_Info *server;
4102 	struct cifs_tcon *tcon = tlink_tcon(rdata->cfile->tlink);
4103 	unsigned int total_len;
4104 
4105 	cifs_dbg(FYI, "%s: offset=%llu bytes=%u\n",
4106 		 __func__, rdata->offset, rdata->bytes);
4107 
4108 	if (!rdata->server)
4109 		rdata->server = cifs_pick_channel(tcon->ses);
4110 
4111 	io_parms.tcon = tlink_tcon(rdata->cfile->tlink);
4112 	io_parms.server = server = rdata->server;
4113 	io_parms.offset = rdata->offset;
4114 	io_parms.length = rdata->bytes;
4115 	io_parms.persistent_fid = rdata->cfile->fid.persistent_fid;
4116 	io_parms.volatile_fid = rdata->cfile->fid.volatile_fid;
4117 	io_parms.pid = rdata->pid;
4118 
4119 	rc = smb2_new_read_req(
4120 		(void **) &buf, &total_len, &io_parms, rdata, 0, 0);
4121 	if (rc)
4122 		return rc;
4123 
4124 	if (smb3_encryption_required(io_parms.tcon))
4125 		flags |= CIFS_TRANSFORM_REQ;
4126 
4127 	rdata->iov[0].iov_base = buf;
4128 	rdata->iov[0].iov_len = total_len;
4129 
4130 	shdr = (struct smb2_sync_hdr *)buf;
4131 
4132 	if (rdata->credits.value > 0) {
4133 		shdr->CreditCharge = cpu_to_le16(DIV_ROUND_UP(rdata->bytes,
4134 						SMB2_MAX_BUFFER_SIZE));
4135 		shdr->CreditRequest = cpu_to_le16(le16_to_cpu(shdr->CreditCharge) + 8);
4136 
4137 		rc = adjust_credits(server, &rdata->credits, rdata->bytes);
4138 		if (rc)
4139 			goto async_readv_out;
4140 
4141 		flags |= CIFS_HAS_CREDITS;
4142 	}
4143 
4144 	kref_get(&rdata->refcount);
4145 	rc = cifs_call_async(server, &rqst,
4146 			     cifs_readv_receive, smb2_readv_callback,
4147 			     smb3_handle_read_data, rdata, flags,
4148 			     &rdata->credits);
4149 	if (rc) {
4150 		kref_put(&rdata->refcount, cifs_readdata_release);
4151 		cifs_stats_fail_inc(io_parms.tcon, SMB2_READ_HE);
4152 		trace_smb3_read_err(0 /* xid */, io_parms.persistent_fid,
4153 				    io_parms.tcon->tid,
4154 				    io_parms.tcon->ses->Suid,
4155 				    io_parms.offset, io_parms.length, rc);
4156 	}
4157 
4158 async_readv_out:
4159 	cifs_small_buf_release(buf);
4160 	return rc;
4161 }
4162 
4163 int
SMB2_read(const unsigned int xid,struct cifs_io_parms * io_parms,unsigned int * nbytes,char ** buf,int * buf_type)4164 SMB2_read(const unsigned int xid, struct cifs_io_parms *io_parms,
4165 	  unsigned int *nbytes, char **buf, int *buf_type)
4166 {
4167 	struct smb_rqst rqst;
4168 	int resp_buftype, rc;
4169 	struct smb2_read_plain_req *req = NULL;
4170 	struct smb2_read_rsp *rsp = NULL;
4171 	struct kvec iov[1];
4172 	struct kvec rsp_iov;
4173 	unsigned int total_len;
4174 	int flags = CIFS_LOG_ERROR;
4175 	struct cifs_ses *ses = io_parms->tcon->ses;
4176 
4177 	if (!io_parms->server)
4178 		io_parms->server = cifs_pick_channel(io_parms->tcon->ses);
4179 
4180 	*nbytes = 0;
4181 	rc = smb2_new_read_req((void **)&req, &total_len, io_parms, NULL, 0, 0);
4182 	if (rc)
4183 		return rc;
4184 
4185 	if (smb3_encryption_required(io_parms->tcon))
4186 		flags |= CIFS_TRANSFORM_REQ;
4187 
4188 	iov[0].iov_base = (char *)req;
4189 	iov[0].iov_len = total_len;
4190 
4191 	memset(&rqst, 0, sizeof(struct smb_rqst));
4192 	rqst.rq_iov = iov;
4193 	rqst.rq_nvec = 1;
4194 
4195 	rc = cifs_send_recv(xid, ses, io_parms->server,
4196 			    &rqst, &resp_buftype, flags, &rsp_iov);
4197 	rsp = (struct smb2_read_rsp *)rsp_iov.iov_base;
4198 
4199 	if (rc) {
4200 		if (rc != -ENODATA) {
4201 			cifs_stats_fail_inc(io_parms->tcon, SMB2_READ_HE);
4202 			cifs_dbg(VFS, "Send error in read = %d\n", rc);
4203 			trace_smb3_read_err(xid, req->PersistentFileId,
4204 					    io_parms->tcon->tid, ses->Suid,
4205 					    io_parms->offset, io_parms->length,
4206 					    rc);
4207 		} else
4208 			trace_smb3_read_done(xid, req->PersistentFileId,
4209 				    io_parms->tcon->tid, ses->Suid,
4210 				    io_parms->offset, 0);
4211 		free_rsp_buf(resp_buftype, rsp_iov.iov_base);
4212 		cifs_small_buf_release(req);
4213 		return rc == -ENODATA ? 0 : rc;
4214 	} else
4215 		trace_smb3_read_done(xid, req->PersistentFileId,
4216 				    io_parms->tcon->tid, ses->Suid,
4217 				    io_parms->offset, io_parms->length);
4218 
4219 	cifs_small_buf_release(req);
4220 
4221 	*nbytes = le32_to_cpu(rsp->DataLength);
4222 	if ((*nbytes > CIFS_MAX_MSGSIZE) ||
4223 	    (*nbytes > io_parms->length)) {
4224 		cifs_dbg(FYI, "bad length %d for count %d\n",
4225 			 *nbytes, io_parms->length);
4226 		rc = -EIO;
4227 		*nbytes = 0;
4228 	}
4229 
4230 	if (*buf) {
4231 		memcpy(*buf, (char *)rsp + rsp->DataOffset, *nbytes);
4232 		free_rsp_buf(resp_buftype, rsp_iov.iov_base);
4233 	} else if (resp_buftype != CIFS_NO_BUFFER) {
4234 		*buf = rsp_iov.iov_base;
4235 		if (resp_buftype == CIFS_SMALL_BUFFER)
4236 			*buf_type = CIFS_SMALL_BUFFER;
4237 		else if (resp_buftype == CIFS_LARGE_BUFFER)
4238 			*buf_type = CIFS_LARGE_BUFFER;
4239 	}
4240 	return rc;
4241 }
4242 
4243 /*
4244  * Check the mid_state and signature on received buffer (if any), and queue the
4245  * workqueue completion task.
4246  */
4247 static void
smb2_writev_callback(struct mid_q_entry * mid)4248 smb2_writev_callback(struct mid_q_entry *mid)
4249 {
4250 	struct cifs_writedata *wdata = mid->callback_data;
4251 	struct cifs_tcon *tcon = tlink_tcon(wdata->cfile->tlink);
4252 	struct TCP_Server_Info *server = wdata->server;
4253 	unsigned int written;
4254 	struct smb2_write_rsp *rsp = (struct smb2_write_rsp *)mid->resp_buf;
4255 	struct cifs_credits credits = { .value = 0, .instance = 0 };
4256 
4257 	WARN_ONCE(wdata->server != mid->server,
4258 		  "wdata server %p != mid server %p",
4259 		  wdata->server, mid->server);
4260 
4261 	switch (mid->mid_state) {
4262 	case MID_RESPONSE_RECEIVED:
4263 		credits.value = le16_to_cpu(rsp->sync_hdr.CreditRequest);
4264 		credits.instance = server->reconnect_instance;
4265 		wdata->result = smb2_check_receive(mid, server, 0);
4266 		if (wdata->result != 0)
4267 			break;
4268 
4269 		written = le32_to_cpu(rsp->DataLength);
4270 		/*
4271 		 * Mask off high 16 bits when bytes written as returned
4272 		 * by the server is greater than bytes requested by the
4273 		 * client. OS/2 servers are known to set incorrect
4274 		 * CountHigh values.
4275 		 */
4276 		if (written > wdata->bytes)
4277 			written &= 0xFFFF;
4278 
4279 		if (written < wdata->bytes)
4280 			wdata->result = -ENOSPC;
4281 		else
4282 			wdata->bytes = written;
4283 		break;
4284 	case MID_REQUEST_SUBMITTED:
4285 	case MID_RETRY_NEEDED:
4286 		wdata->result = -EAGAIN;
4287 		break;
4288 	case MID_RESPONSE_MALFORMED:
4289 		credits.value = le16_to_cpu(rsp->sync_hdr.CreditRequest);
4290 		credits.instance = server->reconnect_instance;
4291 		fallthrough;
4292 	default:
4293 		wdata->result = -EIO;
4294 		break;
4295 	}
4296 #ifdef CONFIG_CIFS_SMB_DIRECT
4297 	/*
4298 	 * If this wdata has a memory registered, the MR can be freed
4299 	 * The number of MRs available is limited, it's important to recover
4300 	 * used MR as soon as I/O is finished. Hold MR longer in the later
4301 	 * I/O process can possibly result in I/O deadlock due to lack of MR
4302 	 * to send request on I/O retry
4303 	 */
4304 	if (wdata->mr) {
4305 		smbd_deregister_mr(wdata->mr);
4306 		wdata->mr = NULL;
4307 	}
4308 #endif
4309 	if (wdata->result) {
4310 		cifs_stats_fail_inc(tcon, SMB2_WRITE_HE);
4311 		trace_smb3_write_err(0 /* no xid */,
4312 				     wdata->cfile->fid.persistent_fid,
4313 				     tcon->tid, tcon->ses->Suid, wdata->offset,
4314 				     wdata->bytes, wdata->result);
4315 		if (wdata->result == -ENOSPC)
4316 			pr_warn_once("Out of space writing to %s\n",
4317 				     tcon->treeName);
4318 	} else
4319 		trace_smb3_write_done(0 /* no xid */,
4320 				      wdata->cfile->fid.persistent_fid,
4321 				      tcon->tid, tcon->ses->Suid,
4322 				      wdata->offset, wdata->bytes);
4323 
4324 	queue_work(cifsiod_wq, &wdata->work);
4325 	DeleteMidQEntry(mid);
4326 	add_credits(server, &credits, 0);
4327 }
4328 
4329 /* smb2_async_writev - send an async write, and set up mid to handle result */
4330 int
smb2_async_writev(struct cifs_writedata * wdata,void (* release)(struct kref * kref))4331 smb2_async_writev(struct cifs_writedata *wdata,
4332 		  void (*release)(struct kref *kref))
4333 {
4334 	int rc = -EACCES, flags = 0;
4335 	struct smb2_write_req *req = NULL;
4336 	struct smb2_sync_hdr *shdr;
4337 	struct cifs_tcon *tcon = tlink_tcon(wdata->cfile->tlink);
4338 	struct TCP_Server_Info *server = wdata->server;
4339 	struct kvec iov[1];
4340 	struct smb_rqst rqst = { };
4341 	unsigned int total_len;
4342 
4343 	if (!wdata->server)
4344 		server = wdata->server = cifs_pick_channel(tcon->ses);
4345 
4346 	rc = smb2_plain_req_init(SMB2_WRITE, tcon, server,
4347 				 (void **) &req, &total_len);
4348 	if (rc)
4349 		return rc;
4350 
4351 	if (smb3_encryption_required(tcon))
4352 		flags |= CIFS_TRANSFORM_REQ;
4353 
4354 	shdr = (struct smb2_sync_hdr *)req;
4355 	shdr->ProcessId = cpu_to_le32(wdata->cfile->pid);
4356 
4357 	req->PersistentFileId = wdata->cfile->fid.persistent_fid;
4358 	req->VolatileFileId = wdata->cfile->fid.volatile_fid;
4359 	req->WriteChannelInfoOffset = 0;
4360 	req->WriteChannelInfoLength = 0;
4361 	req->Channel = 0;
4362 	req->Offset = cpu_to_le64(wdata->offset);
4363 	req->DataOffset = cpu_to_le16(
4364 				offsetof(struct smb2_write_req, Buffer));
4365 	req->RemainingBytes = 0;
4366 
4367 	trace_smb3_write_enter(0 /* xid */, wdata->cfile->fid.persistent_fid,
4368 		tcon->tid, tcon->ses->Suid, wdata->offset, wdata->bytes);
4369 #ifdef CONFIG_CIFS_SMB_DIRECT
4370 	/*
4371 	 * If we want to do a server RDMA read, fill in and append
4372 	 * smbd_buffer_descriptor_v1 to the end of write request
4373 	 */
4374 	if (server->rdma && !server->sign && wdata->bytes >=
4375 		server->smbd_conn->rdma_readwrite_threshold) {
4376 
4377 		struct smbd_buffer_descriptor_v1 *v1;
4378 		bool need_invalidate = server->dialect == SMB30_PROT_ID;
4379 
4380 		wdata->mr = smbd_register_mr(
4381 				server->smbd_conn, wdata->pages,
4382 				wdata->nr_pages, wdata->page_offset,
4383 				wdata->tailsz, false, need_invalidate);
4384 		if (!wdata->mr) {
4385 			rc = -EAGAIN;
4386 			goto async_writev_out;
4387 		}
4388 		req->Length = 0;
4389 		req->DataOffset = 0;
4390 		if (wdata->nr_pages > 1)
4391 			req->RemainingBytes =
4392 				cpu_to_le32(
4393 					(wdata->nr_pages - 1) * wdata->pagesz -
4394 					wdata->page_offset + wdata->tailsz
4395 				);
4396 		else
4397 			req->RemainingBytes = cpu_to_le32(wdata->tailsz);
4398 		req->Channel = SMB2_CHANNEL_RDMA_V1_INVALIDATE;
4399 		if (need_invalidate)
4400 			req->Channel = SMB2_CHANNEL_RDMA_V1;
4401 		req->WriteChannelInfoOffset =
4402 			cpu_to_le16(offsetof(struct smb2_write_req, Buffer));
4403 		req->WriteChannelInfoLength =
4404 			cpu_to_le16(sizeof(struct smbd_buffer_descriptor_v1));
4405 		v1 = (struct smbd_buffer_descriptor_v1 *) &req->Buffer[0];
4406 		v1->offset = cpu_to_le64(wdata->mr->mr->iova);
4407 		v1->token = cpu_to_le32(wdata->mr->mr->rkey);
4408 		v1->length = cpu_to_le32(wdata->mr->mr->length);
4409 	}
4410 #endif
4411 	iov[0].iov_len = total_len - 1;
4412 	iov[0].iov_base = (char *)req;
4413 
4414 	rqst.rq_iov = iov;
4415 	rqst.rq_nvec = 1;
4416 	rqst.rq_pages = wdata->pages;
4417 	rqst.rq_offset = wdata->page_offset;
4418 	rqst.rq_npages = wdata->nr_pages;
4419 	rqst.rq_pagesz = wdata->pagesz;
4420 	rqst.rq_tailsz = wdata->tailsz;
4421 #ifdef CONFIG_CIFS_SMB_DIRECT
4422 	if (wdata->mr) {
4423 		iov[0].iov_len += sizeof(struct smbd_buffer_descriptor_v1);
4424 		rqst.rq_npages = 0;
4425 	}
4426 #endif
4427 	cifs_dbg(FYI, "async write at %llu %u bytes\n",
4428 		 wdata->offset, wdata->bytes);
4429 
4430 #ifdef CONFIG_CIFS_SMB_DIRECT
4431 	/* For RDMA read, I/O size is in RemainingBytes not in Length */
4432 	if (!wdata->mr)
4433 		req->Length = cpu_to_le32(wdata->bytes);
4434 #else
4435 	req->Length = cpu_to_le32(wdata->bytes);
4436 #endif
4437 
4438 	if (wdata->credits.value > 0) {
4439 		shdr->CreditCharge = cpu_to_le16(DIV_ROUND_UP(wdata->bytes,
4440 						    SMB2_MAX_BUFFER_SIZE));
4441 		shdr->CreditRequest = cpu_to_le16(le16_to_cpu(shdr->CreditCharge) + 8);
4442 
4443 		rc = adjust_credits(server, &wdata->credits, wdata->bytes);
4444 		if (rc)
4445 			goto async_writev_out;
4446 
4447 		flags |= CIFS_HAS_CREDITS;
4448 	}
4449 
4450 	kref_get(&wdata->refcount);
4451 	rc = cifs_call_async(server, &rqst, NULL, smb2_writev_callback, NULL,
4452 			     wdata, flags, &wdata->credits);
4453 
4454 	if (rc) {
4455 		trace_smb3_write_err(0 /* no xid */, req->PersistentFileId,
4456 				     tcon->tid, tcon->ses->Suid, wdata->offset,
4457 				     wdata->bytes, rc);
4458 		kref_put(&wdata->refcount, release);
4459 		cifs_stats_fail_inc(tcon, SMB2_WRITE_HE);
4460 	}
4461 
4462 async_writev_out:
4463 	cifs_small_buf_release(req);
4464 	return rc;
4465 }
4466 
4467 /*
4468  * SMB2_write function gets iov pointer to kvec array with n_vec as a length.
4469  * The length field from io_parms must be at least 1 and indicates a number of
4470  * elements with data to write that begins with position 1 in iov array. All
4471  * data length is specified by count.
4472  */
4473 int
SMB2_write(const unsigned int xid,struct cifs_io_parms * io_parms,unsigned int * nbytes,struct kvec * iov,int n_vec)4474 SMB2_write(const unsigned int xid, struct cifs_io_parms *io_parms,
4475 	   unsigned int *nbytes, struct kvec *iov, int n_vec)
4476 {
4477 	struct smb_rqst rqst;
4478 	int rc = 0;
4479 	struct smb2_write_req *req = NULL;
4480 	struct smb2_write_rsp *rsp = NULL;
4481 	int resp_buftype;
4482 	struct kvec rsp_iov;
4483 	int flags = 0;
4484 	unsigned int total_len;
4485 	struct TCP_Server_Info *server;
4486 
4487 	*nbytes = 0;
4488 
4489 	if (n_vec < 1)
4490 		return rc;
4491 
4492 	if (!io_parms->server)
4493 		io_parms->server = cifs_pick_channel(io_parms->tcon->ses);
4494 	server = io_parms->server;
4495 	if (server == NULL)
4496 		return -ECONNABORTED;
4497 
4498 	rc = smb2_plain_req_init(SMB2_WRITE, io_parms->tcon, server,
4499 				 (void **) &req, &total_len);
4500 	if (rc)
4501 		return rc;
4502 
4503 	if (smb3_encryption_required(io_parms->tcon))
4504 		flags |= CIFS_TRANSFORM_REQ;
4505 
4506 	req->sync_hdr.ProcessId = cpu_to_le32(io_parms->pid);
4507 
4508 	req->PersistentFileId = io_parms->persistent_fid;
4509 	req->VolatileFileId = io_parms->volatile_fid;
4510 	req->WriteChannelInfoOffset = 0;
4511 	req->WriteChannelInfoLength = 0;
4512 	req->Channel = 0;
4513 	req->Length = cpu_to_le32(io_parms->length);
4514 	req->Offset = cpu_to_le64(io_parms->offset);
4515 	req->DataOffset = cpu_to_le16(
4516 				offsetof(struct smb2_write_req, Buffer));
4517 	req->RemainingBytes = 0;
4518 
4519 	trace_smb3_write_enter(xid, io_parms->persistent_fid,
4520 		io_parms->tcon->tid, io_parms->tcon->ses->Suid,
4521 		io_parms->offset, io_parms->length);
4522 
4523 	iov[0].iov_base = (char *)req;
4524 	/* 1 for Buffer */
4525 	iov[0].iov_len = total_len - 1;
4526 
4527 	memset(&rqst, 0, sizeof(struct smb_rqst));
4528 	rqst.rq_iov = iov;
4529 	rqst.rq_nvec = n_vec + 1;
4530 
4531 	rc = cifs_send_recv(xid, io_parms->tcon->ses, server,
4532 			    &rqst,
4533 			    &resp_buftype, flags, &rsp_iov);
4534 	rsp = (struct smb2_write_rsp *)rsp_iov.iov_base;
4535 
4536 	if (rc) {
4537 		trace_smb3_write_err(xid, req->PersistentFileId,
4538 				     io_parms->tcon->tid,
4539 				     io_parms->tcon->ses->Suid,
4540 				     io_parms->offset, io_parms->length, rc);
4541 		cifs_stats_fail_inc(io_parms->tcon, SMB2_WRITE_HE);
4542 		cifs_dbg(VFS, "Send error in write = %d\n", rc);
4543 	} else {
4544 		*nbytes = le32_to_cpu(rsp->DataLength);
4545 		trace_smb3_write_done(xid, req->PersistentFileId,
4546 				     io_parms->tcon->tid,
4547 				     io_parms->tcon->ses->Suid,
4548 				     io_parms->offset, *nbytes);
4549 	}
4550 
4551 	cifs_small_buf_release(req);
4552 	free_rsp_buf(resp_buftype, rsp);
4553 	return rc;
4554 }
4555 
posix_info_sid_size(const void * beg,const void * end)4556 int posix_info_sid_size(const void *beg, const void *end)
4557 {
4558 	size_t subauth;
4559 	int total;
4560 
4561 	if (beg + 1 > end)
4562 		return -1;
4563 
4564 	subauth = *(u8 *)(beg+1);
4565 	if (subauth < 1 || subauth > 15)
4566 		return -1;
4567 
4568 	total = 1 + 1 + 6 + 4*subauth;
4569 	if (beg + total > end)
4570 		return -1;
4571 
4572 	return total;
4573 }
4574 
posix_info_parse(const void * beg,const void * end,struct smb2_posix_info_parsed * out)4575 int posix_info_parse(const void *beg, const void *end,
4576 		     struct smb2_posix_info_parsed *out)
4577 
4578 {
4579 	int total_len = 0;
4580 	int owner_len, group_len;
4581 	int name_len;
4582 	const void *owner_sid;
4583 	const void *group_sid;
4584 	const void *name;
4585 
4586 	/* if no end bound given, assume payload to be correct */
4587 	if (!end) {
4588 		const struct smb2_posix_info *p = beg;
4589 
4590 		end = beg + le32_to_cpu(p->NextEntryOffset);
4591 		/* last element will have a 0 offset, pick a sensible bound */
4592 		if (end == beg)
4593 			end += 0xFFFF;
4594 	}
4595 
4596 	/* check base buf */
4597 	if (beg + sizeof(struct smb2_posix_info) > end)
4598 		return -1;
4599 	total_len = sizeof(struct smb2_posix_info);
4600 
4601 	/* check owner sid */
4602 	owner_sid = beg + total_len;
4603 	owner_len = posix_info_sid_size(owner_sid, end);
4604 	if (owner_len < 0)
4605 		return -1;
4606 	total_len += owner_len;
4607 
4608 	/* check group sid */
4609 	group_sid = beg + total_len;
4610 	group_len = posix_info_sid_size(group_sid, end);
4611 	if (group_len < 0)
4612 		return -1;
4613 	total_len += group_len;
4614 
4615 	/* check name len */
4616 	if (beg + total_len + 4 > end)
4617 		return -1;
4618 	name_len = le32_to_cpu(*(__le32 *)(beg + total_len));
4619 	if (name_len < 1 || name_len > 0xFFFF)
4620 		return -1;
4621 	total_len += 4;
4622 
4623 	/* check name */
4624 	name = beg + total_len;
4625 	if (name + name_len > end)
4626 		return -1;
4627 	total_len += name_len;
4628 
4629 	if (out) {
4630 		out->base = beg;
4631 		out->size = total_len;
4632 		out->name_len = name_len;
4633 		out->name = name;
4634 		memcpy(&out->owner, owner_sid, owner_len);
4635 		memcpy(&out->group, group_sid, group_len);
4636 	}
4637 	return total_len;
4638 }
4639 
posix_info_extra_size(const void * beg,const void * end)4640 static int posix_info_extra_size(const void *beg, const void *end)
4641 {
4642 	int len = posix_info_parse(beg, end, NULL);
4643 
4644 	if (len < 0)
4645 		return -1;
4646 	return len - sizeof(struct smb2_posix_info);
4647 }
4648 
4649 static unsigned int
num_entries(int infotype,char * bufstart,char * end_of_buf,char ** lastentry,size_t size)4650 num_entries(int infotype, char *bufstart, char *end_of_buf, char **lastentry,
4651 	    size_t size)
4652 {
4653 	int len;
4654 	unsigned int entrycount = 0;
4655 	unsigned int next_offset = 0;
4656 	char *entryptr;
4657 	FILE_DIRECTORY_INFO *dir_info;
4658 
4659 	if (bufstart == NULL)
4660 		return 0;
4661 
4662 	entryptr = bufstart;
4663 
4664 	while (1) {
4665 		if (entryptr + next_offset < entryptr ||
4666 		    entryptr + next_offset > end_of_buf ||
4667 		    entryptr + next_offset + size > end_of_buf) {
4668 			cifs_dbg(VFS, "malformed search entry would overflow\n");
4669 			break;
4670 		}
4671 
4672 		entryptr = entryptr + next_offset;
4673 		dir_info = (FILE_DIRECTORY_INFO *)entryptr;
4674 
4675 		if (infotype == SMB_FIND_FILE_POSIX_INFO)
4676 			len = posix_info_extra_size(entryptr, end_of_buf);
4677 		else
4678 			len = le32_to_cpu(dir_info->FileNameLength);
4679 
4680 		if (len < 0 ||
4681 		    entryptr + len < entryptr ||
4682 		    entryptr + len > end_of_buf ||
4683 		    entryptr + len + size > end_of_buf) {
4684 			cifs_dbg(VFS, "directory entry name would overflow frame end of buf %p\n",
4685 				 end_of_buf);
4686 			break;
4687 		}
4688 
4689 		*lastentry = entryptr;
4690 		entrycount++;
4691 
4692 		next_offset = le32_to_cpu(dir_info->NextEntryOffset);
4693 		if (!next_offset)
4694 			break;
4695 	}
4696 
4697 	return entrycount;
4698 }
4699 
4700 /*
4701  * Readdir/FindFirst
4702  */
SMB2_query_directory_init(const unsigned int xid,struct cifs_tcon * tcon,struct TCP_Server_Info * server,struct smb_rqst * rqst,u64 persistent_fid,u64 volatile_fid,int index,int info_level)4703 int SMB2_query_directory_init(const unsigned int xid,
4704 			      struct cifs_tcon *tcon,
4705 			      struct TCP_Server_Info *server,
4706 			      struct smb_rqst *rqst,
4707 			      u64 persistent_fid, u64 volatile_fid,
4708 			      int index, int info_level)
4709 {
4710 	struct smb2_query_directory_req *req;
4711 	unsigned char *bufptr;
4712 	__le16 asteriks = cpu_to_le16('*');
4713 	unsigned int output_size = CIFSMaxBufSize -
4714 		MAX_SMB2_CREATE_RESPONSE_SIZE -
4715 		MAX_SMB2_CLOSE_RESPONSE_SIZE;
4716 	unsigned int total_len;
4717 	struct kvec *iov = rqst->rq_iov;
4718 	int len, rc;
4719 
4720 	rc = smb2_plain_req_init(SMB2_QUERY_DIRECTORY, tcon, server,
4721 				 (void **) &req, &total_len);
4722 	if (rc)
4723 		return rc;
4724 
4725 	switch (info_level) {
4726 	case SMB_FIND_FILE_DIRECTORY_INFO:
4727 		req->FileInformationClass = FILE_DIRECTORY_INFORMATION;
4728 		break;
4729 	case SMB_FIND_FILE_ID_FULL_DIR_INFO:
4730 		req->FileInformationClass = FILEID_FULL_DIRECTORY_INFORMATION;
4731 		break;
4732 	case SMB_FIND_FILE_POSIX_INFO:
4733 		req->FileInformationClass = SMB_FIND_FILE_POSIX_INFO;
4734 		break;
4735 	default:
4736 		cifs_tcon_dbg(VFS, "info level %u isn't supported\n",
4737 			info_level);
4738 		return -EINVAL;
4739 	}
4740 
4741 	req->FileIndex = cpu_to_le32(index);
4742 	req->PersistentFileId = persistent_fid;
4743 	req->VolatileFileId = volatile_fid;
4744 
4745 	len = 0x2;
4746 	bufptr = req->Buffer;
4747 	memcpy(bufptr, &asteriks, len);
4748 
4749 	req->FileNameOffset =
4750 		cpu_to_le16(sizeof(struct smb2_query_directory_req));
4751 	req->FileNameLength = cpu_to_le16(len);
4752 	/*
4753 	 * BB could be 30 bytes or so longer if we used SMB2 specific
4754 	 * buffer lengths, but this is safe and close enough.
4755 	 */
4756 	output_size = min_t(unsigned int, output_size, server->maxBuf);
4757 	output_size = min_t(unsigned int, output_size, 2 << 15);
4758 	req->OutputBufferLength = cpu_to_le32(output_size);
4759 
4760 	iov[0].iov_base = (char *)req;
4761 	/* 1 for Buffer */
4762 	iov[0].iov_len = total_len - 1;
4763 
4764 	iov[1].iov_base = (char *)(req->Buffer);
4765 	iov[1].iov_len = len;
4766 
4767 	trace_smb3_query_dir_enter(xid, persistent_fid, tcon->tid,
4768 			tcon->ses->Suid, index, output_size);
4769 
4770 	return 0;
4771 }
4772 
SMB2_query_directory_free(struct smb_rqst * rqst)4773 void SMB2_query_directory_free(struct smb_rqst *rqst)
4774 {
4775 	if (rqst && rqst->rq_iov) {
4776 		cifs_small_buf_release(rqst->rq_iov[0].iov_base); /* request */
4777 	}
4778 }
4779 
4780 int
smb2_parse_query_directory(struct cifs_tcon * tcon,struct kvec * rsp_iov,int resp_buftype,struct cifs_search_info * srch_inf)4781 smb2_parse_query_directory(struct cifs_tcon *tcon,
4782 			   struct kvec *rsp_iov,
4783 			   int resp_buftype,
4784 			   struct cifs_search_info *srch_inf)
4785 {
4786 	struct smb2_query_directory_rsp *rsp;
4787 	size_t info_buf_size;
4788 	char *end_of_smb;
4789 	int rc;
4790 
4791 	rsp = (struct smb2_query_directory_rsp *)rsp_iov->iov_base;
4792 
4793 	switch (srch_inf->info_level) {
4794 	case SMB_FIND_FILE_DIRECTORY_INFO:
4795 		info_buf_size = sizeof(FILE_DIRECTORY_INFO) - 1;
4796 		break;
4797 	case SMB_FIND_FILE_ID_FULL_DIR_INFO:
4798 		info_buf_size = sizeof(SEARCH_ID_FULL_DIR_INFO) - 1;
4799 		break;
4800 	case SMB_FIND_FILE_POSIX_INFO:
4801 		/* note that posix payload are variable size */
4802 		info_buf_size = sizeof(struct smb2_posix_info);
4803 		break;
4804 	default:
4805 		cifs_tcon_dbg(VFS, "info level %u isn't supported\n",
4806 			 srch_inf->info_level);
4807 		return -EINVAL;
4808 	}
4809 
4810 	rc = smb2_validate_iov(le16_to_cpu(rsp->OutputBufferOffset),
4811 			       le32_to_cpu(rsp->OutputBufferLength), rsp_iov,
4812 			       info_buf_size);
4813 	if (rc) {
4814 		cifs_tcon_dbg(VFS, "bad info payload");
4815 		return rc;
4816 	}
4817 
4818 	srch_inf->unicode = true;
4819 
4820 	if (srch_inf->ntwrk_buf_start) {
4821 		if (srch_inf->smallBuf)
4822 			cifs_small_buf_release(srch_inf->ntwrk_buf_start);
4823 		else
4824 			cifs_buf_release(srch_inf->ntwrk_buf_start);
4825 	}
4826 	srch_inf->ntwrk_buf_start = (char *)rsp;
4827 	srch_inf->srch_entries_start = srch_inf->last_entry =
4828 		(char *)rsp + le16_to_cpu(rsp->OutputBufferOffset);
4829 	end_of_smb = rsp_iov->iov_len + (char *)rsp;
4830 
4831 	srch_inf->entries_in_buffer = num_entries(
4832 		srch_inf->info_level,
4833 		srch_inf->srch_entries_start,
4834 		end_of_smb,
4835 		&srch_inf->last_entry,
4836 		info_buf_size);
4837 
4838 	srch_inf->index_of_last_entry += srch_inf->entries_in_buffer;
4839 	cifs_dbg(FYI, "num entries %d last_index %lld srch start %p srch end %p\n",
4840 		 srch_inf->entries_in_buffer, srch_inf->index_of_last_entry,
4841 		 srch_inf->srch_entries_start, srch_inf->last_entry);
4842 	if (resp_buftype == CIFS_LARGE_BUFFER)
4843 		srch_inf->smallBuf = false;
4844 	else if (resp_buftype == CIFS_SMALL_BUFFER)
4845 		srch_inf->smallBuf = true;
4846 	else
4847 		cifs_tcon_dbg(VFS, "Invalid search buffer type\n");
4848 
4849 	return 0;
4850 }
4851 
4852 int
SMB2_query_directory(const unsigned int xid,struct cifs_tcon * tcon,u64 persistent_fid,u64 volatile_fid,int index,struct cifs_search_info * srch_inf)4853 SMB2_query_directory(const unsigned int xid, struct cifs_tcon *tcon,
4854 		     u64 persistent_fid, u64 volatile_fid, int index,
4855 		     struct cifs_search_info *srch_inf)
4856 {
4857 	struct smb_rqst rqst;
4858 	struct kvec iov[SMB2_QUERY_DIRECTORY_IOV_SIZE];
4859 	struct smb2_query_directory_rsp *rsp = NULL;
4860 	int resp_buftype = CIFS_NO_BUFFER;
4861 	struct kvec rsp_iov;
4862 	int rc = 0;
4863 	struct cifs_ses *ses = tcon->ses;
4864 	struct TCP_Server_Info *server = cifs_pick_channel(ses);
4865 	int flags = 0;
4866 
4867 	if (!ses || !(ses->server))
4868 		return -EIO;
4869 
4870 	if (smb3_encryption_required(tcon))
4871 		flags |= CIFS_TRANSFORM_REQ;
4872 
4873 	memset(&rqst, 0, sizeof(struct smb_rqst));
4874 	memset(&iov, 0, sizeof(iov));
4875 	rqst.rq_iov = iov;
4876 	rqst.rq_nvec = SMB2_QUERY_DIRECTORY_IOV_SIZE;
4877 
4878 	rc = SMB2_query_directory_init(xid, tcon, server,
4879 				       &rqst, persistent_fid,
4880 				       volatile_fid, index,
4881 				       srch_inf->info_level);
4882 	if (rc)
4883 		goto qdir_exit;
4884 
4885 	rc = cifs_send_recv(xid, ses, server,
4886 			    &rqst, &resp_buftype, flags, &rsp_iov);
4887 	rsp = (struct smb2_query_directory_rsp *)rsp_iov.iov_base;
4888 
4889 	if (rc) {
4890 		if (rc == -ENODATA &&
4891 		    rsp->sync_hdr.Status == STATUS_NO_MORE_FILES) {
4892 			trace_smb3_query_dir_done(xid, persistent_fid,
4893 				tcon->tid, tcon->ses->Suid, index, 0);
4894 			srch_inf->endOfSearch = true;
4895 			rc = 0;
4896 		} else {
4897 			trace_smb3_query_dir_err(xid, persistent_fid, tcon->tid,
4898 				tcon->ses->Suid, index, 0, rc);
4899 			cifs_stats_fail_inc(tcon, SMB2_QUERY_DIRECTORY_HE);
4900 		}
4901 		goto qdir_exit;
4902 	}
4903 
4904 	rc = smb2_parse_query_directory(tcon, &rsp_iov,	resp_buftype,
4905 					srch_inf);
4906 	if (rc) {
4907 		trace_smb3_query_dir_err(xid, persistent_fid, tcon->tid,
4908 			tcon->ses->Suid, index, 0, rc);
4909 		goto qdir_exit;
4910 	}
4911 	resp_buftype = CIFS_NO_BUFFER;
4912 
4913 	trace_smb3_query_dir_done(xid, persistent_fid, tcon->tid,
4914 			tcon->ses->Suid, index, srch_inf->entries_in_buffer);
4915 
4916 qdir_exit:
4917 	SMB2_query_directory_free(&rqst);
4918 	free_rsp_buf(resp_buftype, rsp);
4919 	return rc;
4920 }
4921 
4922 int
SMB2_set_info_init(struct cifs_tcon * tcon,struct TCP_Server_Info * server,struct smb_rqst * rqst,u64 persistent_fid,u64 volatile_fid,u32 pid,u8 info_class,u8 info_type,u32 additional_info,void ** data,unsigned int * size)4923 SMB2_set_info_init(struct cifs_tcon *tcon, struct TCP_Server_Info *server,
4924 		   struct smb_rqst *rqst,
4925 		   u64 persistent_fid, u64 volatile_fid, u32 pid,
4926 		   u8 info_class, u8 info_type, u32 additional_info,
4927 		   void **data, unsigned int *size)
4928 {
4929 	struct smb2_set_info_req *req;
4930 	struct kvec *iov = rqst->rq_iov;
4931 	unsigned int i, total_len;
4932 	int rc;
4933 
4934 	rc = smb2_plain_req_init(SMB2_SET_INFO, tcon, server,
4935 				 (void **) &req, &total_len);
4936 	if (rc)
4937 		return rc;
4938 
4939 	req->sync_hdr.ProcessId = cpu_to_le32(pid);
4940 	req->InfoType = info_type;
4941 	req->FileInfoClass = info_class;
4942 	req->PersistentFileId = persistent_fid;
4943 	req->VolatileFileId = volatile_fid;
4944 	req->AdditionalInformation = cpu_to_le32(additional_info);
4945 
4946 	req->BufferOffset =
4947 			cpu_to_le16(sizeof(struct smb2_set_info_req));
4948 	req->BufferLength = cpu_to_le32(*size);
4949 
4950 	memcpy(req->Buffer, *data, *size);
4951 	total_len += *size;
4952 
4953 	iov[0].iov_base = (char *)req;
4954 	/* 1 for Buffer */
4955 	iov[0].iov_len = total_len - 1;
4956 
4957 	for (i = 1; i < rqst->rq_nvec; i++) {
4958 		le32_add_cpu(&req->BufferLength, size[i]);
4959 		iov[i].iov_base = (char *)data[i];
4960 		iov[i].iov_len = size[i];
4961 	}
4962 
4963 	return 0;
4964 }
4965 
4966 void
SMB2_set_info_free(struct smb_rqst * rqst)4967 SMB2_set_info_free(struct smb_rqst *rqst)
4968 {
4969 	if (rqst && rqst->rq_iov)
4970 		cifs_buf_release(rqst->rq_iov[0].iov_base); /* request */
4971 }
4972 
4973 static int
send_set_info(const unsigned int xid,struct cifs_tcon * tcon,u64 persistent_fid,u64 volatile_fid,u32 pid,u8 info_class,u8 info_type,u32 additional_info,unsigned int num,void ** data,unsigned int * size)4974 send_set_info(const unsigned int xid, struct cifs_tcon *tcon,
4975 	       u64 persistent_fid, u64 volatile_fid, u32 pid, u8 info_class,
4976 	       u8 info_type, u32 additional_info, unsigned int num,
4977 		void **data, unsigned int *size)
4978 {
4979 	struct smb_rqst rqst;
4980 	struct smb2_set_info_rsp *rsp = NULL;
4981 	struct kvec *iov;
4982 	struct kvec rsp_iov;
4983 	int rc = 0;
4984 	int resp_buftype;
4985 	struct cifs_ses *ses = tcon->ses;
4986 	struct TCP_Server_Info *server = cifs_pick_channel(ses);
4987 	int flags = 0;
4988 
4989 	if (!ses || !server)
4990 		return -EIO;
4991 
4992 	if (!num)
4993 		return -EINVAL;
4994 
4995 	if (smb3_encryption_required(tcon))
4996 		flags |= CIFS_TRANSFORM_REQ;
4997 
4998 	iov = kmalloc_array(num, sizeof(struct kvec), GFP_KERNEL);
4999 	if (!iov)
5000 		return -ENOMEM;
5001 
5002 	memset(&rqst, 0, sizeof(struct smb_rqst));
5003 	rqst.rq_iov = iov;
5004 	rqst.rq_nvec = num;
5005 
5006 	rc = SMB2_set_info_init(tcon, server,
5007 				&rqst, persistent_fid, volatile_fid, pid,
5008 				info_class, info_type, additional_info,
5009 				data, size);
5010 	if (rc) {
5011 		kfree(iov);
5012 		return rc;
5013 	}
5014 
5015 
5016 	rc = cifs_send_recv(xid, ses, server,
5017 			    &rqst, &resp_buftype, flags,
5018 			    &rsp_iov);
5019 	SMB2_set_info_free(&rqst);
5020 	rsp = (struct smb2_set_info_rsp *)rsp_iov.iov_base;
5021 
5022 	if (rc != 0) {
5023 		cifs_stats_fail_inc(tcon, SMB2_SET_INFO_HE);
5024 		trace_smb3_set_info_err(xid, persistent_fid, tcon->tid,
5025 				ses->Suid, info_class, (__u32)info_type, rc);
5026 	}
5027 
5028 	free_rsp_buf(resp_buftype, rsp);
5029 	kfree(iov);
5030 	return rc;
5031 }
5032 
5033 int
SMB2_set_eof(const unsigned int xid,struct cifs_tcon * tcon,u64 persistent_fid,u64 volatile_fid,u32 pid,__le64 * eof)5034 SMB2_set_eof(const unsigned int xid, struct cifs_tcon *tcon, u64 persistent_fid,
5035 	     u64 volatile_fid, u32 pid, __le64 *eof)
5036 {
5037 	struct smb2_file_eof_info info;
5038 	void *data;
5039 	unsigned int size;
5040 
5041 	info.EndOfFile = *eof;
5042 
5043 	data = &info;
5044 	size = sizeof(struct smb2_file_eof_info);
5045 
5046 	return send_set_info(xid, tcon, persistent_fid, volatile_fid,
5047 			pid, FILE_END_OF_FILE_INFORMATION, SMB2_O_INFO_FILE,
5048 			0, 1, &data, &size);
5049 }
5050 
5051 int
SMB2_set_acl(const unsigned int xid,struct cifs_tcon * tcon,u64 persistent_fid,u64 volatile_fid,struct cifs_ntsd * pnntsd,int pacllen,int aclflag)5052 SMB2_set_acl(const unsigned int xid, struct cifs_tcon *tcon,
5053 		u64 persistent_fid, u64 volatile_fid,
5054 		struct cifs_ntsd *pnntsd, int pacllen, int aclflag)
5055 {
5056 	return send_set_info(xid, tcon, persistent_fid, volatile_fid,
5057 			current->tgid, 0, SMB2_O_INFO_SECURITY, aclflag,
5058 			1, (void **)&pnntsd, &pacllen);
5059 }
5060 
5061 int
SMB2_set_ea(const unsigned int xid,struct cifs_tcon * tcon,u64 persistent_fid,u64 volatile_fid,struct smb2_file_full_ea_info * buf,int len)5062 SMB2_set_ea(const unsigned int xid, struct cifs_tcon *tcon,
5063 	    u64 persistent_fid, u64 volatile_fid,
5064 	    struct smb2_file_full_ea_info *buf, int len)
5065 {
5066 	return send_set_info(xid, tcon, persistent_fid, volatile_fid,
5067 		current->tgid, FILE_FULL_EA_INFORMATION, SMB2_O_INFO_FILE,
5068 		0, 1, (void **)&buf, &len);
5069 }
5070 
5071 int
SMB2_oplock_break(const unsigned int xid,struct cifs_tcon * tcon,const u64 persistent_fid,const u64 volatile_fid,__u8 oplock_level)5072 SMB2_oplock_break(const unsigned int xid, struct cifs_tcon *tcon,
5073 		  const u64 persistent_fid, const u64 volatile_fid,
5074 		  __u8 oplock_level)
5075 {
5076 	struct smb_rqst rqst;
5077 	int rc;
5078 	struct smb2_oplock_break *req = NULL;
5079 	struct cifs_ses *ses = tcon->ses;
5080 	struct TCP_Server_Info *server = cifs_pick_channel(ses);
5081 	int flags = CIFS_OBREAK_OP;
5082 	unsigned int total_len;
5083 	struct kvec iov[1];
5084 	struct kvec rsp_iov;
5085 	int resp_buf_type;
5086 
5087 	cifs_dbg(FYI, "SMB2_oplock_break\n");
5088 	rc = smb2_plain_req_init(SMB2_OPLOCK_BREAK, tcon, server,
5089 				 (void **) &req, &total_len);
5090 	if (rc)
5091 		return rc;
5092 
5093 	if (smb3_encryption_required(tcon))
5094 		flags |= CIFS_TRANSFORM_REQ;
5095 
5096 	req->VolatileFid = volatile_fid;
5097 	req->PersistentFid = persistent_fid;
5098 	req->OplockLevel = oplock_level;
5099 	req->sync_hdr.CreditRequest = cpu_to_le16(1);
5100 
5101 	flags |= CIFS_NO_RSP_BUF;
5102 
5103 	iov[0].iov_base = (char *)req;
5104 	iov[0].iov_len = total_len;
5105 
5106 	memset(&rqst, 0, sizeof(struct smb_rqst));
5107 	rqst.rq_iov = iov;
5108 	rqst.rq_nvec = 1;
5109 
5110 	rc = cifs_send_recv(xid, ses, server,
5111 			    &rqst, &resp_buf_type, flags, &rsp_iov);
5112 	cifs_small_buf_release(req);
5113 
5114 	if (rc) {
5115 		cifs_stats_fail_inc(tcon, SMB2_OPLOCK_BREAK_HE);
5116 		cifs_dbg(FYI, "Send error in Oplock Break = %d\n", rc);
5117 	}
5118 
5119 	return rc;
5120 }
5121 
5122 void
smb2_copy_fs_info_to_kstatfs(struct smb2_fs_full_size_info * pfs_inf,struct kstatfs * kst)5123 smb2_copy_fs_info_to_kstatfs(struct smb2_fs_full_size_info *pfs_inf,
5124 			     struct kstatfs *kst)
5125 {
5126 	kst->f_bsize = le32_to_cpu(pfs_inf->BytesPerSector) *
5127 			  le32_to_cpu(pfs_inf->SectorsPerAllocationUnit);
5128 	kst->f_blocks = le64_to_cpu(pfs_inf->TotalAllocationUnits);
5129 	kst->f_bfree  = kst->f_bavail =
5130 			le64_to_cpu(pfs_inf->CallerAvailableAllocationUnits);
5131 	return;
5132 }
5133 
5134 static void
copy_posix_fs_info_to_kstatfs(FILE_SYSTEM_POSIX_INFO * response_data,struct kstatfs * kst)5135 copy_posix_fs_info_to_kstatfs(FILE_SYSTEM_POSIX_INFO *response_data,
5136 			struct kstatfs *kst)
5137 {
5138 	kst->f_bsize = le32_to_cpu(response_data->BlockSize);
5139 	kst->f_blocks = le64_to_cpu(response_data->TotalBlocks);
5140 	kst->f_bfree =  le64_to_cpu(response_data->BlocksAvail);
5141 	if (response_data->UserBlocksAvail == cpu_to_le64(-1))
5142 		kst->f_bavail = kst->f_bfree;
5143 	else
5144 		kst->f_bavail = le64_to_cpu(response_data->UserBlocksAvail);
5145 	if (response_data->TotalFileNodes != cpu_to_le64(-1))
5146 		kst->f_files = le64_to_cpu(response_data->TotalFileNodes);
5147 	if (response_data->FreeFileNodes != cpu_to_le64(-1))
5148 		kst->f_ffree = le64_to_cpu(response_data->FreeFileNodes);
5149 
5150 	return;
5151 }
5152 
5153 static int
build_qfs_info_req(struct kvec * iov,struct cifs_tcon * tcon,struct TCP_Server_Info * server,int level,int outbuf_len,u64 persistent_fid,u64 volatile_fid)5154 build_qfs_info_req(struct kvec *iov, struct cifs_tcon *tcon,
5155 		   struct TCP_Server_Info *server,
5156 		   int level, int outbuf_len, u64 persistent_fid,
5157 		   u64 volatile_fid)
5158 {
5159 	int rc;
5160 	struct smb2_query_info_req *req;
5161 	unsigned int total_len;
5162 
5163 	cifs_dbg(FYI, "Query FSInfo level %d\n", level);
5164 
5165 	if ((tcon->ses == NULL) || server == NULL)
5166 		return -EIO;
5167 
5168 	rc = smb2_plain_req_init(SMB2_QUERY_INFO, tcon, server,
5169 				 (void **) &req, &total_len);
5170 	if (rc)
5171 		return rc;
5172 
5173 	req->InfoType = SMB2_O_INFO_FILESYSTEM;
5174 	req->FileInfoClass = level;
5175 	req->PersistentFileId = persistent_fid;
5176 	req->VolatileFileId = volatile_fid;
5177 	/* 1 for pad */
5178 	req->InputBufferOffset =
5179 			cpu_to_le16(sizeof(struct smb2_query_info_req));
5180 	req->OutputBufferLength = cpu_to_le32(
5181 		outbuf_len + sizeof(struct smb2_query_info_rsp));
5182 
5183 	iov->iov_base = (char *)req;
5184 	iov->iov_len = total_len;
5185 	return 0;
5186 }
5187 
free_qfs_info_req(struct kvec * iov)5188 static inline void free_qfs_info_req(struct kvec *iov)
5189 {
5190 	cifs_buf_release(iov->iov_base);
5191 }
5192 
5193 int
SMB311_posix_qfs_info(const unsigned int xid,struct cifs_tcon * tcon,u64 persistent_fid,u64 volatile_fid,struct kstatfs * fsdata)5194 SMB311_posix_qfs_info(const unsigned int xid, struct cifs_tcon *tcon,
5195 	      u64 persistent_fid, u64 volatile_fid, struct kstatfs *fsdata)
5196 {
5197 	struct smb_rqst rqst;
5198 	struct smb2_query_info_rsp *rsp = NULL;
5199 	struct kvec iov;
5200 	struct kvec rsp_iov;
5201 	int rc = 0;
5202 	int resp_buftype;
5203 	struct cifs_ses *ses = tcon->ses;
5204 	struct TCP_Server_Info *server = cifs_pick_channel(ses);
5205 	FILE_SYSTEM_POSIX_INFO *info = NULL;
5206 	int flags = 0;
5207 
5208 	rc = build_qfs_info_req(&iov, tcon, server,
5209 				FS_POSIX_INFORMATION,
5210 				sizeof(FILE_SYSTEM_POSIX_INFO),
5211 				persistent_fid, volatile_fid);
5212 	if (rc)
5213 		return rc;
5214 
5215 	if (smb3_encryption_required(tcon))
5216 		flags |= CIFS_TRANSFORM_REQ;
5217 
5218 	memset(&rqst, 0, sizeof(struct smb_rqst));
5219 	rqst.rq_iov = &iov;
5220 	rqst.rq_nvec = 1;
5221 
5222 	rc = cifs_send_recv(xid, ses, server,
5223 			    &rqst, &resp_buftype, flags, &rsp_iov);
5224 	free_qfs_info_req(&iov);
5225 	if (rc) {
5226 		cifs_stats_fail_inc(tcon, SMB2_QUERY_INFO_HE);
5227 		goto posix_qfsinf_exit;
5228 	}
5229 	rsp = (struct smb2_query_info_rsp *)rsp_iov.iov_base;
5230 
5231 	info = (FILE_SYSTEM_POSIX_INFO *)(
5232 		le16_to_cpu(rsp->OutputBufferOffset) + (char *)rsp);
5233 	rc = smb2_validate_iov(le16_to_cpu(rsp->OutputBufferOffset),
5234 			       le32_to_cpu(rsp->OutputBufferLength), &rsp_iov,
5235 			       sizeof(FILE_SYSTEM_POSIX_INFO));
5236 	if (!rc)
5237 		copy_posix_fs_info_to_kstatfs(info, fsdata);
5238 
5239 posix_qfsinf_exit:
5240 	free_rsp_buf(resp_buftype, rsp_iov.iov_base);
5241 	return rc;
5242 }
5243 
5244 int
SMB2_QFS_info(const unsigned int xid,struct cifs_tcon * tcon,u64 persistent_fid,u64 volatile_fid,struct kstatfs * fsdata)5245 SMB2_QFS_info(const unsigned int xid, struct cifs_tcon *tcon,
5246 	      u64 persistent_fid, u64 volatile_fid, struct kstatfs *fsdata)
5247 {
5248 	struct smb_rqst rqst;
5249 	struct smb2_query_info_rsp *rsp = NULL;
5250 	struct kvec iov;
5251 	struct kvec rsp_iov;
5252 	int rc = 0;
5253 	int resp_buftype;
5254 	struct cifs_ses *ses = tcon->ses;
5255 	struct TCP_Server_Info *server = cifs_pick_channel(ses);
5256 	struct smb2_fs_full_size_info *info = NULL;
5257 	int flags = 0;
5258 
5259 	rc = build_qfs_info_req(&iov, tcon, server,
5260 				FS_FULL_SIZE_INFORMATION,
5261 				sizeof(struct smb2_fs_full_size_info),
5262 				persistent_fid, volatile_fid);
5263 	if (rc)
5264 		return rc;
5265 
5266 	if (smb3_encryption_required(tcon))
5267 		flags |= CIFS_TRANSFORM_REQ;
5268 
5269 	memset(&rqst, 0, sizeof(struct smb_rqst));
5270 	rqst.rq_iov = &iov;
5271 	rqst.rq_nvec = 1;
5272 
5273 	rc = cifs_send_recv(xid, ses, server,
5274 			    &rqst, &resp_buftype, flags, &rsp_iov);
5275 	free_qfs_info_req(&iov);
5276 	if (rc) {
5277 		cifs_stats_fail_inc(tcon, SMB2_QUERY_INFO_HE);
5278 		goto qfsinf_exit;
5279 	}
5280 	rsp = (struct smb2_query_info_rsp *)rsp_iov.iov_base;
5281 
5282 	info = (struct smb2_fs_full_size_info *)(
5283 		le16_to_cpu(rsp->OutputBufferOffset) + (char *)rsp);
5284 	rc = smb2_validate_iov(le16_to_cpu(rsp->OutputBufferOffset),
5285 			       le32_to_cpu(rsp->OutputBufferLength), &rsp_iov,
5286 			       sizeof(struct smb2_fs_full_size_info));
5287 	if (!rc)
5288 		smb2_copy_fs_info_to_kstatfs(info, fsdata);
5289 
5290 qfsinf_exit:
5291 	free_rsp_buf(resp_buftype, rsp_iov.iov_base);
5292 	return rc;
5293 }
5294 
5295 int
SMB2_QFS_attr(const unsigned int xid,struct cifs_tcon * tcon,u64 persistent_fid,u64 volatile_fid,int level)5296 SMB2_QFS_attr(const unsigned int xid, struct cifs_tcon *tcon,
5297 	      u64 persistent_fid, u64 volatile_fid, int level)
5298 {
5299 	struct smb_rqst rqst;
5300 	struct smb2_query_info_rsp *rsp = NULL;
5301 	struct kvec iov;
5302 	struct kvec rsp_iov;
5303 	int rc = 0;
5304 	int resp_buftype, max_len, min_len;
5305 	struct cifs_ses *ses = tcon->ses;
5306 	struct TCP_Server_Info *server = cifs_pick_channel(ses);
5307 	unsigned int rsp_len, offset;
5308 	int flags = 0;
5309 
5310 	if (level == FS_DEVICE_INFORMATION) {
5311 		max_len = sizeof(FILE_SYSTEM_DEVICE_INFO);
5312 		min_len = sizeof(FILE_SYSTEM_DEVICE_INFO);
5313 	} else if (level == FS_ATTRIBUTE_INFORMATION) {
5314 		max_len = sizeof(FILE_SYSTEM_ATTRIBUTE_INFO);
5315 		min_len = MIN_FS_ATTR_INFO_SIZE;
5316 	} else if (level == FS_SECTOR_SIZE_INFORMATION) {
5317 		max_len = sizeof(struct smb3_fs_ss_info);
5318 		min_len = sizeof(struct smb3_fs_ss_info);
5319 	} else if (level == FS_VOLUME_INFORMATION) {
5320 		max_len = sizeof(struct smb3_fs_vol_info) + MAX_VOL_LABEL_LEN;
5321 		min_len = sizeof(struct smb3_fs_vol_info);
5322 	} else {
5323 		cifs_dbg(FYI, "Invalid qfsinfo level %d\n", level);
5324 		return -EINVAL;
5325 	}
5326 
5327 	rc = build_qfs_info_req(&iov, tcon, server,
5328 				level, max_len,
5329 				persistent_fid, volatile_fid);
5330 	if (rc)
5331 		return rc;
5332 
5333 	if (smb3_encryption_required(tcon))
5334 		flags |= CIFS_TRANSFORM_REQ;
5335 
5336 	memset(&rqst, 0, sizeof(struct smb_rqst));
5337 	rqst.rq_iov = &iov;
5338 	rqst.rq_nvec = 1;
5339 
5340 	rc = cifs_send_recv(xid, ses, server,
5341 			    &rqst, &resp_buftype, flags, &rsp_iov);
5342 	free_qfs_info_req(&iov);
5343 	if (rc) {
5344 		cifs_stats_fail_inc(tcon, SMB2_QUERY_INFO_HE);
5345 		goto qfsattr_exit;
5346 	}
5347 	rsp = (struct smb2_query_info_rsp *)rsp_iov.iov_base;
5348 
5349 	rsp_len = le32_to_cpu(rsp->OutputBufferLength);
5350 	offset = le16_to_cpu(rsp->OutputBufferOffset);
5351 	rc = smb2_validate_iov(offset, rsp_len, &rsp_iov, min_len);
5352 	if (rc)
5353 		goto qfsattr_exit;
5354 
5355 	if (level == FS_ATTRIBUTE_INFORMATION)
5356 		memcpy(&tcon->fsAttrInfo, offset
5357 			+ (char *)rsp, min_t(unsigned int,
5358 			rsp_len, max_len));
5359 	else if (level == FS_DEVICE_INFORMATION)
5360 		memcpy(&tcon->fsDevInfo, offset
5361 			+ (char *)rsp, sizeof(FILE_SYSTEM_DEVICE_INFO));
5362 	else if (level == FS_SECTOR_SIZE_INFORMATION) {
5363 		struct smb3_fs_ss_info *ss_info = (struct smb3_fs_ss_info *)
5364 			(offset + (char *)rsp);
5365 		tcon->ss_flags = le32_to_cpu(ss_info->Flags);
5366 		tcon->perf_sector_size =
5367 			le32_to_cpu(ss_info->PhysicalBytesPerSectorForPerf);
5368 	} else if (level == FS_VOLUME_INFORMATION) {
5369 		struct smb3_fs_vol_info *vol_info = (struct smb3_fs_vol_info *)
5370 			(offset + (char *)rsp);
5371 		tcon->vol_serial_number = vol_info->VolumeSerialNumber;
5372 		tcon->vol_create_time = vol_info->VolumeCreationTime;
5373 	}
5374 
5375 qfsattr_exit:
5376 	free_rsp_buf(resp_buftype, rsp_iov.iov_base);
5377 	return rc;
5378 }
5379 
5380 int
smb2_lockv(const unsigned int xid,struct cifs_tcon * tcon,const __u64 persist_fid,const __u64 volatile_fid,const __u32 pid,const __u32 num_lock,struct smb2_lock_element * buf)5381 smb2_lockv(const unsigned int xid, struct cifs_tcon *tcon,
5382 	   const __u64 persist_fid, const __u64 volatile_fid, const __u32 pid,
5383 	   const __u32 num_lock, struct smb2_lock_element *buf)
5384 {
5385 	struct smb_rqst rqst;
5386 	int rc = 0;
5387 	struct smb2_lock_req *req = NULL;
5388 	struct kvec iov[2];
5389 	struct kvec rsp_iov;
5390 	int resp_buf_type;
5391 	unsigned int count;
5392 	int flags = CIFS_NO_RSP_BUF;
5393 	unsigned int total_len;
5394 	struct TCP_Server_Info *server = cifs_pick_channel(tcon->ses);
5395 
5396 	cifs_dbg(FYI, "smb2_lockv num lock %d\n", num_lock);
5397 
5398 	rc = smb2_plain_req_init(SMB2_LOCK, tcon, server,
5399 				 (void **) &req, &total_len);
5400 	if (rc)
5401 		return rc;
5402 
5403 	if (smb3_encryption_required(tcon))
5404 		flags |= CIFS_TRANSFORM_REQ;
5405 
5406 	req->sync_hdr.ProcessId = cpu_to_le32(pid);
5407 	req->LockCount = cpu_to_le16(num_lock);
5408 
5409 	req->PersistentFileId = persist_fid;
5410 	req->VolatileFileId = volatile_fid;
5411 
5412 	count = num_lock * sizeof(struct smb2_lock_element);
5413 
5414 	iov[0].iov_base = (char *)req;
5415 	iov[0].iov_len = total_len - sizeof(struct smb2_lock_element);
5416 	iov[1].iov_base = (char *)buf;
5417 	iov[1].iov_len = count;
5418 
5419 	cifs_stats_inc(&tcon->stats.cifs_stats.num_locks);
5420 
5421 	memset(&rqst, 0, sizeof(struct smb_rqst));
5422 	rqst.rq_iov = iov;
5423 	rqst.rq_nvec = 2;
5424 
5425 	rc = cifs_send_recv(xid, tcon->ses, server,
5426 			    &rqst, &resp_buf_type, flags,
5427 			    &rsp_iov);
5428 	cifs_small_buf_release(req);
5429 	if (rc) {
5430 		cifs_dbg(FYI, "Send error in smb2_lockv = %d\n", rc);
5431 		cifs_stats_fail_inc(tcon, SMB2_LOCK_HE);
5432 		trace_smb3_lock_err(xid, persist_fid, tcon->tid,
5433 				    tcon->ses->Suid, rc);
5434 	}
5435 
5436 	return rc;
5437 }
5438 
5439 int
SMB2_lock(const unsigned int xid,struct cifs_tcon * tcon,const __u64 persist_fid,const __u64 volatile_fid,const __u32 pid,const __u64 length,const __u64 offset,const __u32 lock_flags,const bool wait)5440 SMB2_lock(const unsigned int xid, struct cifs_tcon *tcon,
5441 	  const __u64 persist_fid, const __u64 volatile_fid, const __u32 pid,
5442 	  const __u64 length, const __u64 offset, const __u32 lock_flags,
5443 	  const bool wait)
5444 {
5445 	struct smb2_lock_element lock;
5446 
5447 	lock.Offset = cpu_to_le64(offset);
5448 	lock.Length = cpu_to_le64(length);
5449 	lock.Flags = cpu_to_le32(lock_flags);
5450 	if (!wait && lock_flags != SMB2_LOCKFLAG_UNLOCK)
5451 		lock.Flags |= cpu_to_le32(SMB2_LOCKFLAG_FAIL_IMMEDIATELY);
5452 
5453 	return smb2_lockv(xid, tcon, persist_fid, volatile_fid, pid, 1, &lock);
5454 }
5455 
5456 int
SMB2_lease_break(const unsigned int xid,struct cifs_tcon * tcon,__u8 * lease_key,const __le32 lease_state)5457 SMB2_lease_break(const unsigned int xid, struct cifs_tcon *tcon,
5458 		 __u8 *lease_key, const __le32 lease_state)
5459 {
5460 	struct smb_rqst rqst;
5461 	int rc;
5462 	struct smb2_lease_ack *req = NULL;
5463 	struct cifs_ses *ses = tcon->ses;
5464 	int flags = CIFS_OBREAK_OP;
5465 	unsigned int total_len;
5466 	struct kvec iov[1];
5467 	struct kvec rsp_iov;
5468 	int resp_buf_type;
5469 	__u64 *please_key_high;
5470 	__u64 *please_key_low;
5471 	struct TCP_Server_Info *server = cifs_pick_channel(tcon->ses);
5472 
5473 	cifs_dbg(FYI, "SMB2_lease_break\n");
5474 	rc = smb2_plain_req_init(SMB2_OPLOCK_BREAK, tcon, server,
5475 				 (void **) &req, &total_len);
5476 	if (rc)
5477 		return rc;
5478 
5479 	if (smb3_encryption_required(tcon))
5480 		flags |= CIFS_TRANSFORM_REQ;
5481 
5482 	req->sync_hdr.CreditRequest = cpu_to_le16(1);
5483 	req->StructureSize = cpu_to_le16(36);
5484 	total_len += 12;
5485 
5486 	memcpy(req->LeaseKey, lease_key, 16);
5487 	req->LeaseState = lease_state;
5488 
5489 	flags |= CIFS_NO_RSP_BUF;
5490 
5491 	iov[0].iov_base = (char *)req;
5492 	iov[0].iov_len = total_len;
5493 
5494 	memset(&rqst, 0, sizeof(struct smb_rqst));
5495 	rqst.rq_iov = iov;
5496 	rqst.rq_nvec = 1;
5497 
5498 	rc = cifs_send_recv(xid, ses, server,
5499 			    &rqst, &resp_buf_type, flags, &rsp_iov);
5500 	cifs_small_buf_release(req);
5501 
5502 	please_key_low = (__u64 *)lease_key;
5503 	please_key_high = (__u64 *)(lease_key+8);
5504 	if (rc) {
5505 		cifs_stats_fail_inc(tcon, SMB2_OPLOCK_BREAK_HE);
5506 		trace_smb3_lease_err(le32_to_cpu(lease_state), tcon->tid,
5507 			ses->Suid, *please_key_low, *please_key_high, rc);
5508 		cifs_dbg(FYI, "Send error in Lease Break = %d\n", rc);
5509 	} else
5510 		trace_smb3_lease_done(le32_to_cpu(lease_state), tcon->tid,
5511 			ses->Suid, *please_key_low, *please_key_high);
5512 
5513 	return rc;
5514 }
5515