1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /*
3 * Copyright (C) 2016 Namjae Jeon <linkinjeon@kernel.org>
4 * Copyright (C) 2018 Samsung Electronics Co., Ltd.
5 */
6
7 #include "glob.h"
8 #include "nterr.h"
9 #include "smb2pdu.h"
10 #include "smb_common.h"
11 #include "smbstatus.h"
12 #include "mgmt/user_session.h"
13 #include "connection.h"
14
check_smb2_hdr(struct smb2_hdr * hdr)15 static int check_smb2_hdr(struct smb2_hdr *hdr)
16 {
17 /*
18 * Make sure that this really is an SMB, that it is a response.
19 */
20 if (hdr->Flags & SMB2_FLAGS_SERVER_TO_REDIR)
21 return 1;
22 return 0;
23 }
24
25 /*
26 * The following table defines the expected "StructureSize" of SMB2 requests
27 * in order by SMB2 command. This is similar to "wct" in SMB/CIFS requests.
28 *
29 * Note that commands are defined in smb2pdu.h in le16 but the array below is
30 * indexed by command in host byte order
31 */
32 static const __le16 smb2_req_struct_sizes[NUMBER_OF_SMB2_COMMANDS] = {
33 /* SMB2_NEGOTIATE */ cpu_to_le16(36),
34 /* SMB2_SESSION_SETUP */ cpu_to_le16(25),
35 /* SMB2_LOGOFF */ cpu_to_le16(4),
36 /* SMB2_TREE_CONNECT */ cpu_to_le16(9),
37 /* SMB2_TREE_DISCONNECT */ cpu_to_le16(4),
38 /* SMB2_CREATE */ cpu_to_le16(57),
39 /* SMB2_CLOSE */ cpu_to_le16(24),
40 /* SMB2_FLUSH */ cpu_to_le16(24),
41 /* SMB2_READ */ cpu_to_le16(49),
42 /* SMB2_WRITE */ cpu_to_le16(49),
43 /* SMB2_LOCK */ cpu_to_le16(48),
44 /* SMB2_IOCTL */ cpu_to_le16(57),
45 /* SMB2_CANCEL */ cpu_to_le16(4),
46 /* SMB2_ECHO */ cpu_to_le16(4),
47 /* SMB2_QUERY_DIRECTORY */ cpu_to_le16(33),
48 /* SMB2_CHANGE_NOTIFY */ cpu_to_le16(32),
49 /* SMB2_QUERY_INFO */ cpu_to_le16(41),
50 /* SMB2_SET_INFO */ cpu_to_le16(33),
51 /* use 44 for lease break */
52 /* SMB2_OPLOCK_BREAK */ cpu_to_le16(36)
53 };
54
55 /*
56 * The size of the variable area depends on the offset and length fields
57 * located in different fields for various SMB2 requests. SMB2 requests
58 * with no variable length info, show an offset of zero for the offset field.
59 */
60 static const bool has_smb2_data_area[NUMBER_OF_SMB2_COMMANDS] = {
61 /* SMB2_NEGOTIATE */ true,
62 /* SMB2_SESSION_SETUP */ true,
63 /* SMB2_LOGOFF */ false,
64 /* SMB2_TREE_CONNECT */ true,
65 /* SMB2_TREE_DISCONNECT */ false,
66 /* SMB2_CREATE */ true,
67 /* SMB2_CLOSE */ false,
68 /* SMB2_FLUSH */ false,
69 /* SMB2_READ */ true,
70 /* SMB2_WRITE */ true,
71 /* SMB2_LOCK */ true,
72 /* SMB2_IOCTL */ true,
73 /* SMB2_CANCEL */ false, /* BB CHECK this not listed in documentation */
74 /* SMB2_ECHO */ false,
75 /* SMB2_QUERY_DIRECTORY */ true,
76 /* SMB2_CHANGE_NOTIFY */ false,
77 /* SMB2_QUERY_INFO */ true,
78 /* SMB2_SET_INFO */ true,
79 /* SMB2_OPLOCK_BREAK */ false
80 };
81
82 /*
83 * Set length of the data area and the offset to arguments.
84 * if they are invalid, return error.
85 */
smb2_get_data_area_len(unsigned int * off,unsigned int * len,struct smb2_hdr * hdr)86 static int smb2_get_data_area_len(unsigned int *off, unsigned int *len,
87 struct smb2_hdr *hdr)
88 {
89 int ret = 0;
90
91 *off = 0;
92 *len = 0;
93
94 /*
95 * Following commands have data areas so we have to get the location
96 * of the data buffer offset and data buffer length for the particular
97 * command.
98 */
99 switch (hdr->Command) {
100 case SMB2_SESSION_SETUP:
101 *off = le16_to_cpu(((struct smb2_sess_setup_req *)hdr)->SecurityBufferOffset);
102 *len = le16_to_cpu(((struct smb2_sess_setup_req *)hdr)->SecurityBufferLength);
103 break;
104 case SMB2_TREE_CONNECT:
105 *off = le16_to_cpu(((struct smb2_tree_connect_req *)hdr)->PathOffset);
106 *len = le16_to_cpu(((struct smb2_tree_connect_req *)hdr)->PathLength);
107 break;
108 case SMB2_CREATE:
109 {
110 unsigned short int name_off =
111 le16_to_cpu(((struct smb2_create_req *)hdr)->NameOffset);
112 unsigned short int name_len =
113 le16_to_cpu(((struct smb2_create_req *)hdr)->NameLength);
114
115 if (((struct smb2_create_req *)hdr)->CreateContextsLength) {
116 *off = le32_to_cpu(((struct smb2_create_req *)
117 hdr)->CreateContextsOffset);
118 *len = le32_to_cpu(((struct smb2_create_req *)
119 hdr)->CreateContextsLength);
120 if (!name_len)
121 break;
122
123 if (name_off + name_len < (u64)*off + *len)
124 break;
125 }
126
127 *off = name_off;
128 *len = name_len;
129 break;
130 }
131 case SMB2_QUERY_INFO:
132 *off = le16_to_cpu(((struct smb2_query_info_req *)hdr)->InputBufferOffset);
133 *len = le32_to_cpu(((struct smb2_query_info_req *)hdr)->InputBufferLength);
134 break;
135 case SMB2_SET_INFO:
136 *off = le16_to_cpu(((struct smb2_set_info_req *)hdr)->BufferOffset);
137 *len = le32_to_cpu(((struct smb2_set_info_req *)hdr)->BufferLength);
138 break;
139 case SMB2_READ:
140 *off = le16_to_cpu(((struct smb2_read_req *)hdr)->ReadChannelInfoOffset);
141 *len = le16_to_cpu(((struct smb2_read_req *)hdr)->ReadChannelInfoLength);
142 break;
143 case SMB2_WRITE:
144 if (((struct smb2_write_req *)hdr)->DataOffset ||
145 ((struct smb2_write_req *)hdr)->Length) {
146 *off = max_t(unsigned int,
147 le16_to_cpu(((struct smb2_write_req *)hdr)->DataOffset),
148 offsetof(struct smb2_write_req, Buffer) - 4);
149 *len = le32_to_cpu(((struct smb2_write_req *)hdr)->Length);
150 break;
151 }
152
153 *off = le16_to_cpu(((struct smb2_write_req *)hdr)->WriteChannelInfoOffset);
154 *len = le16_to_cpu(((struct smb2_write_req *)hdr)->WriteChannelInfoLength);
155 break;
156 case SMB2_QUERY_DIRECTORY:
157 *off = le16_to_cpu(((struct smb2_query_directory_req *)hdr)->FileNameOffset);
158 *len = le16_to_cpu(((struct smb2_query_directory_req *)hdr)->FileNameLength);
159 break;
160 case SMB2_LOCK:
161 {
162 unsigned short lock_count;
163
164 lock_count = le16_to_cpu(((struct smb2_lock_req *)hdr)->LockCount);
165 if (lock_count > 0) {
166 *off = offsetof(struct smb2_lock_req, locks);
167 *len = sizeof(struct smb2_lock_element) * lock_count;
168 }
169 break;
170 }
171 case SMB2_IOCTL:
172 *off = le32_to_cpu(((struct smb2_ioctl_req *)hdr)->InputOffset);
173 *len = le32_to_cpu(((struct smb2_ioctl_req *)hdr)->InputCount);
174 break;
175 default:
176 ksmbd_debug(SMB, "no length check for command\n");
177 break;
178 }
179
180 if (*off > 4096) {
181 ksmbd_debug(SMB, "offset %d too large\n", *off);
182 ret = -EINVAL;
183 } else if ((u64)*off + *len > MAX_STREAM_PROT_LEN) {
184 ksmbd_debug(SMB, "Request is larger than maximum stream protocol length(%u): %llu\n",
185 MAX_STREAM_PROT_LEN, (u64)*off + *len);
186 ret = -EINVAL;
187 }
188
189 return ret;
190 }
191
192 /*
193 * Calculate the size of the SMB message based on the fixed header
194 * portion, the number of word parameters and the data portion of the message.
195 */
smb2_calc_size(void * buf,unsigned int * len)196 static int smb2_calc_size(void *buf, unsigned int *len)
197 {
198 struct smb2_pdu *pdu = (struct smb2_pdu *)buf;
199 struct smb2_hdr *hdr = &pdu->hdr;
200 unsigned int offset; /* the offset from the beginning of SMB to data area */
201 unsigned int data_length; /* the length of the variable length data area */
202 int ret;
203
204 /* Structure Size has already been checked to make sure it is 64 */
205 *len = le16_to_cpu(hdr->StructureSize);
206
207 /*
208 * StructureSize2, ie length of fixed parameter area has already
209 * been checked to make sure it is the correct length.
210 */
211 *len += le16_to_cpu(pdu->StructureSize2);
212 /*
213 * StructureSize2 of smb2_lock pdu is set to 48, indicating
214 * the size of smb2 lock request with single smb2_lock_element
215 * regardless of number of locks. Subtract single
216 * smb2_lock_element for correct buffer size check.
217 */
218 if (hdr->Command == SMB2_LOCK)
219 *len -= sizeof(struct smb2_lock_element);
220
221 if (has_smb2_data_area[le16_to_cpu(hdr->Command)] == false)
222 goto calc_size_exit;
223
224 ret = smb2_get_data_area_len(&offset, &data_length, hdr);
225 if (ret)
226 return ret;
227 ksmbd_debug(SMB, "SMB2 data length %u offset %u\n", data_length,
228 offset);
229
230 if (data_length > 0) {
231 /*
232 * Check to make sure that data area begins after fixed area,
233 * Note that last byte of the fixed area is part of data area
234 * for some commands, typically those with odd StructureSize,
235 * so we must add one to the calculation.
236 */
237 if (offset + 1 < *len) {
238 ksmbd_debug(SMB,
239 "data area offset %d overlaps SMB2 header %u\n",
240 offset + 1, *len);
241 return -EINVAL;
242 }
243
244 *len = offset + data_length;
245 }
246
247 calc_size_exit:
248 ksmbd_debug(SMB, "SMB2 len %u\n", *len);
249 return 0;
250 }
251
smb2_query_info_req_len(struct smb2_query_info_req * h)252 static inline int smb2_query_info_req_len(struct smb2_query_info_req *h)
253 {
254 return le32_to_cpu(h->InputBufferLength) +
255 le32_to_cpu(h->OutputBufferLength);
256 }
257
smb2_set_info_req_len(struct smb2_set_info_req * h)258 static inline int smb2_set_info_req_len(struct smb2_set_info_req *h)
259 {
260 return le32_to_cpu(h->BufferLength);
261 }
262
smb2_read_req_len(struct smb2_read_req * h)263 static inline int smb2_read_req_len(struct smb2_read_req *h)
264 {
265 return le32_to_cpu(h->Length);
266 }
267
smb2_write_req_len(struct smb2_write_req * h)268 static inline int smb2_write_req_len(struct smb2_write_req *h)
269 {
270 return le32_to_cpu(h->Length);
271 }
272
smb2_query_dir_req_len(struct smb2_query_directory_req * h)273 static inline int smb2_query_dir_req_len(struct smb2_query_directory_req *h)
274 {
275 return le32_to_cpu(h->OutputBufferLength);
276 }
277
smb2_ioctl_req_len(struct smb2_ioctl_req * h)278 static inline int smb2_ioctl_req_len(struct smb2_ioctl_req *h)
279 {
280 return le32_to_cpu(h->InputCount) +
281 le32_to_cpu(h->OutputCount);
282 }
283
smb2_ioctl_resp_len(struct smb2_ioctl_req * h)284 static inline int smb2_ioctl_resp_len(struct smb2_ioctl_req *h)
285 {
286 return le32_to_cpu(h->MaxInputResponse) +
287 le32_to_cpu(h->MaxOutputResponse);
288 }
289
smb2_validate_credit_charge(struct ksmbd_conn * conn,struct smb2_hdr * hdr)290 static int smb2_validate_credit_charge(struct ksmbd_conn *conn,
291 struct smb2_hdr *hdr)
292 {
293 unsigned int req_len = 0, expect_resp_len = 0, calc_credit_num, max_len;
294 unsigned short credit_charge = le16_to_cpu(hdr->CreditCharge);
295 void *__hdr = hdr;
296 int ret = 0;
297
298 switch (hdr->Command) {
299 case SMB2_QUERY_INFO:
300 req_len = smb2_query_info_req_len(__hdr);
301 break;
302 case SMB2_SET_INFO:
303 req_len = smb2_set_info_req_len(__hdr);
304 break;
305 case SMB2_READ:
306 req_len = smb2_read_req_len(__hdr);
307 break;
308 case SMB2_WRITE:
309 req_len = smb2_write_req_len(__hdr);
310 break;
311 case SMB2_QUERY_DIRECTORY:
312 req_len = smb2_query_dir_req_len(__hdr);
313 break;
314 case SMB2_IOCTL:
315 req_len = smb2_ioctl_req_len(__hdr);
316 expect_resp_len = smb2_ioctl_resp_len(__hdr);
317 break;
318 case SMB2_CANCEL:
319 return 0;
320 default:
321 req_len = 1;
322 break;
323 }
324
325 credit_charge = max_t(unsigned short, credit_charge, 1);
326 max_len = max_t(unsigned int, req_len, expect_resp_len);
327 calc_credit_num = DIV_ROUND_UP(max_len, SMB2_MAX_BUFFER_SIZE);
328
329 if (credit_charge < calc_credit_num) {
330 ksmbd_debug(SMB, "Insufficient credit charge, given: %d, needed: %d\n",
331 credit_charge, calc_credit_num);
332 return 1;
333 } else if (credit_charge > conn->vals->max_credits) {
334 ksmbd_debug(SMB, "Too large credit charge: %d\n", credit_charge);
335 return 1;
336 }
337
338 spin_lock(&conn->credits_lock);
339 if (credit_charge > conn->total_credits) {
340 ksmbd_debug(SMB, "Insufficient credits granted, given: %u, granted: %u\n",
341 credit_charge, conn->total_credits);
342 ret = 1;
343 }
344
345 if ((u64)conn->outstanding_credits + credit_charge > conn->total_credits) {
346 ksmbd_debug(SMB, "Limits exceeding the maximum allowable outstanding requests, given : %u, pending : %u\n",
347 credit_charge, conn->outstanding_credits);
348 ret = 1;
349 } else
350 conn->outstanding_credits += credit_charge;
351
352 spin_unlock(&conn->credits_lock);
353
354 return ret;
355 }
356
ksmbd_smb2_check_message(struct ksmbd_work * work)357 int ksmbd_smb2_check_message(struct ksmbd_work *work)
358 {
359 struct smb2_pdu *pdu = ksmbd_req_buf_next(work);
360 struct smb2_hdr *hdr = &pdu->hdr;
361 int command;
362 __u32 clc_len; /* calculated length */
363 __u32 len = get_rfc1002_len(work->request_buf);
364 __u32 req_struct_size, next_cmd = le32_to_cpu(hdr->NextCommand);
365
366 if ((u64)work->next_smb2_rcv_hdr_off + next_cmd > len) {
367 pr_err("next command(%u) offset exceeds smb msg size\n",
368 next_cmd);
369 return 1;
370 }
371
372 if (next_cmd > 0)
373 len = next_cmd;
374 else if (work->next_smb2_rcv_hdr_off)
375 len -= work->next_smb2_rcv_hdr_off;
376
377 if (check_smb2_hdr(hdr))
378 return 1;
379
380 if (hdr->StructureSize != SMB2_HEADER_STRUCTURE_SIZE) {
381 ksmbd_debug(SMB, "Illegal structure size %u\n",
382 le16_to_cpu(hdr->StructureSize));
383 return 1;
384 }
385
386 command = le16_to_cpu(hdr->Command);
387 if (command >= NUMBER_OF_SMB2_COMMANDS) {
388 ksmbd_debug(SMB, "Illegal SMB2 command %d\n", command);
389 return 1;
390 }
391
392 if (smb2_req_struct_sizes[command] != pdu->StructureSize2) {
393 if (!(command == SMB2_OPLOCK_BREAK_HE &&
394 (le16_to_cpu(pdu->StructureSize2) == OP_BREAK_STRUCT_SIZE_20 ||
395 le16_to_cpu(pdu->StructureSize2) == OP_BREAK_STRUCT_SIZE_21))) {
396 /* special case for SMB2.1 lease break message */
397 ksmbd_debug(SMB,
398 "Illegal request size %u for command %d\n",
399 le16_to_cpu(pdu->StructureSize2), command);
400 return 1;
401 }
402 }
403
404 req_struct_size = le16_to_cpu(pdu->StructureSize2) +
405 __SMB2_HEADER_STRUCTURE_SIZE;
406 if (command == SMB2_LOCK_HE)
407 req_struct_size -= sizeof(struct smb2_lock_element);
408
409 if (req_struct_size > len + 1)
410 return 1;
411
412 if (smb2_calc_size(hdr, &clc_len))
413 return 1;
414
415 if (len != clc_len) {
416 /* client can return one byte more due to implied bcc[0] */
417 if (clc_len == len + 1)
418 goto validate_credit;
419
420 /*
421 * Some windows servers (win2016) will pad also the final
422 * PDU in a compound to 8 bytes.
423 */
424 if (ALIGN(clc_len, 8) == len)
425 goto validate_credit;
426
427 /*
428 * SMB2 NEGOTIATE request will be validated when message
429 * handling proceeds.
430 */
431 if (command == SMB2_NEGOTIATE_HE)
432 goto validate_credit;
433
434 /*
435 * Allow a message that padded to 8byte boundary.
436 * Linux 4.19.217 with smb 3.0.2 are sometimes
437 * sending messages where the cls_len is exactly
438 * 8 bytes less than len.
439 */
440 if (clc_len < len && (len - clc_len) <= 8)
441 goto validate_credit;
442
443 pr_err_ratelimited(
444 "cli req too short, len %d not %d. cmd:%d mid:%llu\n",
445 len, clc_len, command,
446 le64_to_cpu(hdr->MessageId));
447
448 return 1;
449 }
450
451 validate_credit:
452 if ((work->conn->vals->capabilities & SMB2_GLOBAL_CAP_LARGE_MTU) &&
453 smb2_validate_credit_charge(work->conn, hdr))
454 return 1;
455
456 return 0;
457 }
458
smb2_negotiate_request(struct ksmbd_work * work)459 int smb2_negotiate_request(struct ksmbd_work *work)
460 {
461 return ksmbd_smb_negotiate_common(work, SMB2_NEGOTIATE_HE);
462 }
463