smb2pdu.c 114.5 KB
Newer Older
1 2 3
/*
 *   fs/cifs/smb2pdu.c
 *
4
 *   Copyright (C) International Business Machines  Corp., 2009, 2013
5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33
 *                 Etersoft, 2012
 *   Author(s): Steve French (sfrench@us.ibm.com)
 *              Pavel Shilovsky (pshilovsky@samba.org) 2012
 *
 *   Contains the routines for constructing the SMB2 PDUs themselves
 *
 *   This library is free software; you can redistribute it and/or modify
 *   it under the terms of the GNU Lesser General Public License as published
 *   by the Free Software Foundation; either version 2.1 of the License, or
 *   (at your option) any later version.
 *
 *   This library is distributed in the hope that it will be useful,
 *   but WITHOUT ANY WARRANTY; without even the implied warranty of
 *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See
 *   the GNU Lesser General Public License for more details.
 *
 *   You should have received a copy of the GNU Lesser General Public License
 *   along with this library; if not, write to the Free Software
 *   Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
 */

 /* SMB2 PDU handling routines here - except for leftovers (eg session setup) */
 /* Note that there are handle based routines which must be		      */
 /* treated slightly differently for reconnection purposes since we never     */
 /* want to reuse a stale file handle and only the caller knows the file info */

#include <linux/fs.h>
#include <linux/kernel.h>
#include <linux/vfs.h>
34
#include <linux/task_io_accounting_ops.h>
35
#include <linux/uaccess.h>
36
#include <linux/uuid.h>
37
#include <linux/pagemap.h>
38 39 40 41 42 43 44 45 46 47
#include <linux/xattr.h>
#include "smb2pdu.h"
#include "cifsglob.h"
#include "cifsacl.h"
#include "cifsproto.h"
#include "smb2proto.h"
#include "cifs_unicode.h"
#include "cifs_debug.h"
#include "ntlmssp.h"
#include "smb2status.h"
48
#include "smb2glob.h"
49
#include "cifspdu.h"
50
#include "cifs_spnego.h"
51
#include "smbdirect.h"
52
#include "trace.h"
53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82

/*
 *  The following table defines the expected "StructureSize" of SMB2 requests
 *  in order by SMB2 command.  This is similar to "wct" in SMB/CIFS requests.
 *
 *  Note that commands are defined in smb2pdu.h in le16 but the array below is
 *  indexed by command in host byte order.
 */
static const int smb2_req_struct_sizes[NUMBER_OF_SMB2_COMMANDS] = {
	/* SMB2_NEGOTIATE */ 36,
	/* SMB2_SESSION_SETUP */ 25,
	/* SMB2_LOGOFF */ 4,
	/* SMB2_TREE_CONNECT */	9,
	/* SMB2_TREE_DISCONNECT */ 4,
	/* SMB2_CREATE */ 57,
	/* SMB2_CLOSE */ 24,
	/* SMB2_FLUSH */ 24,
	/* SMB2_READ */	49,
	/* SMB2_WRITE */ 49,
	/* SMB2_LOCK */	48,
	/* SMB2_IOCTL */ 57,
	/* SMB2_CANCEL */ 4,
	/* SMB2_ECHO */ 4,
	/* SMB2_QUERY_DIRECTORY */ 33,
	/* SMB2_CHANGE_NOTIFY */ 32,
	/* SMB2_QUERY_INFO */ 41,
	/* SMB2_SET_INFO */ 33,
	/* SMB2_OPLOCK_BREAK */ 24 /* BB this is 36 for LEASE_BREAK variant */
};

83
static int smb3_encryption_required(const struct cifs_tcon *tcon)
84
{
85 86
	if (!tcon)
		return 0;
87 88 89
	if ((tcon->ses->session_flags & SMB2_SESSION_FLAG_ENCRYPT_DATA) ||
	    (tcon->share_flags & SHI1005_FLAGS_ENCRYPT_DATA))
		return 1;
90 91 92
	if (tcon->seal &&
	    (tcon->ses->server->capabilities & SMB2_GLOBAL_CAP_ENCRYPTION))
		return 1;
93 94
	return 0;
}
95 96

static void
97
smb2_hdr_assemble(struct smb2_sync_hdr *shdr, __le16 smb2_cmd,
98 99
		  const struct cifs_tcon *tcon)
{
100 101 102
	shdr->ProtocolId = SMB2_PROTO_NUMBER;
	shdr->StructureSize = cpu_to_le16(64);
	shdr->Command = smb2_cmd;
103 104 105 106 107
	if (tcon && tcon->ses && tcon->ses->server) {
		struct TCP_Server_Info *server = tcon->ses->server;

		spin_lock(&server->req_lock);
		/* Request up to 2 credits but don't go over the limit. */
108
		if (server->credits >= server->max_credits)
109
			shdr->CreditRequest = cpu_to_le16(0);
110
		else
111
			shdr->CreditRequest = cpu_to_le16(
112
				min_t(int, server->max_credits -
113 114 115
						server->credits, 2));
		spin_unlock(&server->req_lock);
	} else {
116
		shdr->CreditRequest = cpu_to_le16(2);
117
	}
118
	shdr->ProcessId = cpu_to_le32((__u16)current->tgid);
119 120 121 122

	if (!tcon)
		goto out;

123 124
	/* GLOBAL_CAP_LARGE_MTU will only be set if dialect > SMB2.02 */
	/* See sections 2.2.4 and 3.2.4.1.5 of MS-SMB2 */
S
Steve French 已提交
125
	if ((tcon->ses) && (tcon->ses->server) &&
S
Steve French 已提交
126
	    (tcon->ses->server->capabilities & SMB2_GLOBAL_CAP_LARGE_MTU))
127
		shdr->CreditCharge = cpu_to_le16(1);
128 129
	/* else CreditCharge MBZ */

130
	shdr->TreeId = tcon->tid;
131 132
	/* Uid is not converted */
	if (tcon->ses)
133
		shdr->SessionId = tcon->ses->Suid;
134 135 136 137 138 139 140 141 142 143 144 145

	/*
	 * If we would set SMB2_FLAGS_DFS_OPERATIONS on open we also would have
	 * to pass the path on the Open SMB prefixed by \\server\share.
	 * Not sure when we would need to do the augmented path (if ever) and
	 * setting this flag breaks the SMB2 open operation since it is
	 * illegal to send an empty path name (without \\server\share prefix)
	 * when the DFS flag is set in the SMB open header. We could
	 * consider setting the flag on all operations other than open
	 * but it is safer to net set it for now.
	 */
/*	if (tcon->share_flags & SHI1005_FLAGS_DFS)
146
		shdr->Flags |= SMB2_FLAGS_DFS_OPERATIONS; */
147

148
	if (tcon->ses && tcon->ses->server && tcon->ses->server->sign &&
149
	    !smb3_encryption_required(tcon))
150
		shdr->Flags |= SMB2_FLAGS_SIGNED;
151 152 153 154 155 156 157 158
out:
	return;
}

static int
smb2_reconnect(__le16 smb2_command, struct cifs_tcon *tcon)
{
	int rc = 0;
159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182
	struct nls_table *nls_codepage;
	struct cifs_ses *ses;
	struct TCP_Server_Info *server;

	/*
	 * SMB2s NegProt, SessSetup, Logoff do not have tcon yet so
	 * check for tcp and smb session status done differently
	 * for those three - in the calling routine.
	 */
	if (tcon == NULL)
		return rc;

	if (smb2_command == SMB2_TREE_CONNECT)
		return rc;

	if (tcon->tidStatus == CifsExiting) {
		/*
		 * only tree disconnect, open, and write,
		 * (and ulogoff which does not have tcon)
		 * are allowed as we start force umount.
		 */
		if ((smb2_command != SMB2_WRITE) &&
		   (smb2_command != SMB2_CREATE) &&
		   (smb2_command != SMB2_TREE_DISCONNECT)) {
183 184
			cifs_dbg(FYI, "can not send cmd %d while umounting\n",
				 smb2_command);
185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 220 221 222 223 224 225 226 227
			return -ENODEV;
		}
	}
	if ((!tcon->ses) || (tcon->ses->status == CifsExiting) ||
	    (!tcon->ses->server))
		return -EIO;

	ses = tcon->ses;
	server = ses->server;

	/*
	 * Give demultiplex thread up to 10 seconds to reconnect, should be
	 * greater than cifs socket timeout which is 7 seconds
	 */
	while (server->tcpStatus == CifsNeedReconnect) {
		/*
		 * Return to caller for TREE_DISCONNECT and LOGOFF and CLOSE
		 * here since they are implicitly done when session drops.
		 */
		switch (smb2_command) {
		/*
		 * BB Should we keep oplock break and add flush to exceptions?
		 */
		case SMB2_TREE_DISCONNECT:
		case SMB2_CANCEL:
		case SMB2_CLOSE:
		case SMB2_OPLOCK_BREAK:
			return -EAGAIN;
		}

		wait_event_interruptible_timeout(server->response_q,
			(server->tcpStatus != CifsNeedReconnect), 10 * HZ);

		/* are we still trying to reconnect? */
		if (server->tcpStatus != CifsNeedReconnect)
			break;

		/*
		 * on "soft" mounts we wait once. Hard mounts keep
		 * retrying until process is killed or server comes
		 * back on-line
		 */
		if (!tcon->retry) {
228
			cifs_dbg(FYI, "gave up waiting on reconnect in smb_init\n");
229 230 231 232 233 234 235 236 237 238 239 240 241 242
			return -EHOSTDOWN;
		}
	}

	if (!tcon->ses->need_reconnect && !tcon->need_reconnect)
		return rc;

	nls_codepage = load_nls_default();

	/*
	 * need to prevent multiple threads trying to simultaneously reconnect
	 * the same SMB session
	 */
	mutex_lock(&tcon->ses->session_mutex);
243 244 245 246 247 248 249 250 251 252 253 254

	/*
	 * Recheck after acquire mutex. If another thread is negotiating
	 * and the server never sends an answer the socket will be closed
	 * and tcpStatus set to reconnect.
	 */
	if (server->tcpStatus == CifsNeedReconnect) {
		rc = -EHOSTDOWN;
		mutex_unlock(&tcon->ses->session_mutex);
		goto out;
	}

255 256 257 258 259 260 261 262 263 264
	rc = cifs_negotiate_protocol(0, tcon->ses);
	if (!rc && tcon->ses->need_reconnect)
		rc = cifs_setup_session(0, tcon->ses, nls_codepage);

	if (rc || !tcon->need_reconnect) {
		mutex_unlock(&tcon->ses->session_mutex);
		goto out;
	}

	cifs_mark_open_files_invalid(tcon);
265 266
	if (tcon->use_persistent)
		tcon->need_reopen_files = true;
267

268 269
	rc = SMB2_tcon(0, tcon->ses, tcon->treeName, tcon, nls_codepage);
	mutex_unlock(&tcon->ses->session_mutex);
270

271
	cifs_dbg(FYI, "reconnect tcon rc = %d\n", rc);
272 273 274
	if (rc) {
		/* If sess reconnected but tcon didn't, something strange ... */
		printk_once(KERN_WARNING "reconnect tcon failed rc = %d\n", rc);
275
		goto out;
276
	}
277 278 279 280

	if (smb2_command != SMB2_INTERNAL_CMD)
		queue_delayed_work(cifsiod_wq, &server->reconnect, 0);

281 282 283 284 285 286 287 288 289 290 291 292 293 294 295 296 297 298 299 300
	atomic_inc(&tconInfoReconnectCount);
out:
	/*
	 * Check if handle based operation so we know whether we can continue
	 * or not without returning to caller to reset file handle.
	 */
	/*
	 * BB Is flush done by server on drop of tcp session? Should we special
	 * case it and skip above?
	 */
	switch (smb2_command) {
	case SMB2_FLUSH:
	case SMB2_READ:
	case SMB2_WRITE:
	case SMB2_LOCK:
	case SMB2_IOCTL:
	case SMB2_QUERY_DIRECTORY:
	case SMB2_CHANGE_NOTIFY:
	case SMB2_QUERY_INFO:
	case SMB2_SET_INFO:
301
		rc = -EAGAIN;
302 303
	}
	unload_nls(nls_codepage);
304 305 306
	return rc;
}

307 308 309 310 311 312 313 314 315 316 317 318 319 320 321 322 323 324 325 326
static void
fill_small_buf(__le16 smb2_command, struct cifs_tcon *tcon, void *buf,
	       unsigned int *total_len)
{
	struct smb2_sync_pdu *spdu = (struct smb2_sync_pdu *)buf;
	/* lookup word count ie StructureSize from table */
	__u16 parmsize = smb2_req_struct_sizes[le16_to_cpu(smb2_command)];

	/*
	 * smaller than SMALL_BUFFER_SIZE but bigger than fixed area of
	 * largest operations (Create)
	 */
	memset(buf, 0, 256);

	smb2_hdr_assemble(&spdu->sync_hdr, smb2_command, tcon);
	spdu->StructureSize2 = cpu_to_le16(parmsize);

	*total_len = parmsize + sizeof(struct smb2_sync_hdr);
}

327 328 329
/*
 * Allocate and return pointer to an SMB request hdr, and set basic
 * SMB information in the SMB header. If the return code is zero, this
R
Ronnie Sahlberg 已提交
330
 * function must have filled in request_buf pointer.
331 332
 */
static int
R
Ronnie Sahlberg 已提交
333 334
smb2_plain_req_init(__le16 smb2_command, struct cifs_tcon *tcon,
		    void **request_buf, unsigned int *total_len)
335
{
336
	int rc;
337 338 339 340 341 342

	rc = smb2_reconnect(smb2_command, tcon);
	if (rc)
		return rc;

	/* BB eventually switch this to SMB2 specific small buf size */
343 344 345 346
	if (smb2_command == SMB2_SET_INFO)
		*request_buf = cifs_buf_get();
	else
		*request_buf = cifs_small_buf_get();
347 348 349 350 351
	if (*request_buf == NULL) {
		/* BB should we add a retry in here if not a writepage? */
		return -ENOMEM;
	}

R
Ronnie Sahlberg 已提交
352 353 354
	fill_small_buf(smb2_command, tcon,
		       (struct smb2_sync_hdr *)(*request_buf),
		       total_len);
355 356 357 358 359 360 361 362 363 364 365 366

	if (tcon != NULL) {
#ifdef CONFIG_CIFS_STATS2
		uint16_t com_code = le16_to_cpu(smb2_command);
		cifs_stats_inc(&tcon->stats.smb2_stats.smb2_com_sent[com_code]);
#endif
		cifs_stats_inc(&tcon->num_smbs_sent);
	}

	return rc;
}

367
#ifdef CONFIG_CIFS_SMB311
368 369
/* offset is sizeof smb2_negotiate_req but rounded up to 8 bytes */
#define OFFSET_OF_NEG_CONTEXT 0x68  /* sizeof(struct smb2_negotiate_req) */
370 371 372 373


#define SMB2_PREAUTH_INTEGRITY_CAPABILITIES	cpu_to_le16(1)
#define SMB2_ENCRYPTION_CAPABILITIES		cpu_to_le16(2)
374
#define SMB2_POSIX_EXTENSIONS_AVAILABLE		cpu_to_le16(0x100)
375 376 377 378 379 380 381 382 383 384 385 386 387 388 389 390

static void
build_preauth_ctxt(struct smb2_preauth_neg_context *pneg_ctxt)
{
	pneg_ctxt->ContextType = SMB2_PREAUTH_INTEGRITY_CAPABILITIES;
	pneg_ctxt->DataLength = cpu_to_le16(38);
	pneg_ctxt->HashAlgorithmCount = cpu_to_le16(1);
	pneg_ctxt->SaltLength = cpu_to_le16(SMB311_SALT_SIZE);
	get_random_bytes(pneg_ctxt->Salt, SMB311_SALT_SIZE);
	pneg_ctxt->HashAlgorithms = SMB2_PREAUTH_INTEGRITY_SHA512;
}

static void
build_encrypt_ctxt(struct smb2_encryption_neg_context *pneg_ctxt)
{
	pneg_ctxt->ContextType = SMB2_ENCRYPTION_CAPABILITIES;
391 392 393 394
	pneg_ctxt->DataLength = cpu_to_le16(4); /* Cipher Count + le16 cipher */
	pneg_ctxt->CipherCount = cpu_to_le16(1);
/* pneg_ctxt->Ciphers[0] = SMB2_ENCRYPTION_AES128_GCM;*/ /* not supported yet */
	pneg_ctxt->Ciphers[0] = SMB2_ENCRYPTION_AES128_CCM;
395 396
}

397 398 399 400 401 402 403
static void
build_posix_ctxt(struct smb2_posix_neg_context *pneg_ctxt)
{
	pneg_ctxt->ContextType = SMB2_POSIX_EXTENSIONS_AVAILABLE;
	pneg_ctxt->DataLength = cpu_to_le16(POSIX_CTXT_DATA_LEN);
}

404
static void
405 406
assemble_neg_contexts(struct smb2_negotiate_req *req,
		      unsigned int *total_len)
407
{
408
	char *pneg_ctxt = (char *)req + OFFSET_OF_NEG_CONTEXT;
409
	unsigned int ctxt_len;
410

411
	*total_len += 2; /* Add 2 due to round to 8 byte boundary for 1st ctxt */
412
	build_preauth_ctxt((struct smb2_preauth_neg_context *)pneg_ctxt);
413 414 415
	ctxt_len = DIV_ROUND_UP(sizeof(struct smb2_preauth_neg_context), 8) * 8;
	*total_len += ctxt_len;
	pneg_ctxt += ctxt_len;
416

417
	build_encrypt_ctxt((struct smb2_encryption_neg_context *)pneg_ctxt);
418 419 420 421 422 423
	ctxt_len = DIV_ROUND_UP(sizeof(struct smb2_encryption_neg_context), 8) * 8;
	*total_len += ctxt_len;
	pneg_ctxt += ctxt_len;

	build_posix_ctxt((struct smb2_posix_neg_context *)pneg_ctxt);
	*total_len += sizeof(struct smb2_posix_neg_context);
424

425 426
	req->NegotiateContextOffset = cpu_to_le32(OFFSET_OF_NEG_CONTEXT);
	req->NegotiateContextCount = cpu_to_le16(3);
427
}
428 429 430 431 432 433 434 435 436 437 438 439 440 441 442 443 444 445 446 447 448 449 450 451 452 453 454 455 456 457 458 459 460 461 462 463 464 465

static void decode_preauth_context(struct smb2_preauth_neg_context *ctxt)
{
	unsigned int len = le16_to_cpu(ctxt->DataLength);

	/* If invalid preauth context warn but use what we requested, SHA-512 */
	if (len < MIN_PREAUTH_CTXT_DATA_LEN) {
		printk_once(KERN_WARNING "server sent bad preauth context\n");
		return;
	}
	if (le16_to_cpu(ctxt->HashAlgorithmCount) != 1)
		printk_once(KERN_WARNING "illegal SMB3 hash algorithm count\n");
	if (ctxt->HashAlgorithms != SMB2_PREAUTH_INTEGRITY_SHA512)
		printk_once(KERN_WARNING "unknown SMB3 hash algorithm\n");
}

static int decode_encrypt_ctx(struct TCP_Server_Info *server,
			      struct smb2_encryption_neg_context *ctxt)
{
	unsigned int len = le16_to_cpu(ctxt->DataLength);

	cifs_dbg(FYI, "decode SMB3.11 encryption neg context of len %d\n", len);
	if (len < MIN_ENCRYPT_CTXT_DATA_LEN) {
		printk_once(KERN_WARNING "server sent bad crypto ctxt len\n");
		return -EINVAL;
	}

	if (le16_to_cpu(ctxt->CipherCount) != 1) {
		printk_once(KERN_WARNING "illegal SMB3.11 cipher count\n");
		return -EINVAL;
	}
	cifs_dbg(FYI, "SMB311 cipher type:%d\n", le16_to_cpu(ctxt->Ciphers[0]));
	if ((ctxt->Ciphers[0] != SMB2_ENCRYPTION_AES128_CCM) &&
	    (ctxt->Ciphers[0] != SMB2_ENCRYPTION_AES128_GCM)) {
		printk_once(KERN_WARNING "invalid SMB3.11 cipher returned\n");
		return -EINVAL;
	}
	server->cipher_type = ctxt->Ciphers[0];
466
	server->capabilities |= SMB2_GLOBAL_CAP_ENCRYPTION;
467 468 469 470
	return 0;
}

static int smb311_decode_neg_context(struct smb2_negotiate_rsp *rsp,
471 472
				     struct TCP_Server_Info *server,
				     unsigned int len_of_smb)
473 474 475 476 477 478 479 480 481 482 483 484 485 486 487 488 489 490 491 492 493 494 495 496
{
	struct smb2_neg_context *pctx;
	unsigned int offset = le32_to_cpu(rsp->NegotiateContextOffset);
	unsigned int ctxt_cnt = le16_to_cpu(rsp->NegotiateContextCount);
	unsigned int len_of_ctxts, i;
	int rc = 0;

	cifs_dbg(FYI, "decoding %d negotiate contexts\n", ctxt_cnt);
	if (len_of_smb <= offset) {
		cifs_dbg(VFS, "Invalid response: negotiate context offset\n");
		return -EINVAL;
	}

	len_of_ctxts = len_of_smb - offset;

	for (i = 0; i < ctxt_cnt; i++) {
		int clen;
		/* check that offset is not beyond end of SMB */
		if (len_of_ctxts == 0)
			break;

		if (len_of_ctxts < sizeof(struct smb2_neg_context))
			break;

497
		pctx = (struct smb2_neg_context *)(offset + (char *)rsp);
498 499 500 501 502 503 504 505 506 507
		clen = le16_to_cpu(pctx->DataLength);
		if (clen > len_of_ctxts)
			break;

		if (pctx->ContextType == SMB2_PREAUTH_INTEGRITY_CAPABILITIES)
			decode_preauth_context(
				(struct smb2_preauth_neg_context *)pctx);
		else if (pctx->ContextType == SMB2_ENCRYPTION_CAPABILITIES)
			rc = decode_encrypt_ctx(server,
				(struct smb2_encryption_neg_context *)pctx);
508 509
		else if (pctx->ContextType == SMB2_POSIX_EXTENSIONS_AVAILABLE)
			server->posix_ext_supported = true;
510 511 512 513 514 515 516 517 518 519 520 521 522 523
		else
			cifs_dbg(VFS, "unknown negcontext of type %d ignored\n",
				le16_to_cpu(pctx->ContextType));

		if (rc)
			break;
		/* offsets must be 8 byte aligned */
		clen = (clen + 7) & ~0x7;
		offset += clen + sizeof(struct smb2_neg_context);
		len_of_ctxts -= clen;
	}
	return rc;
}

524 525 526 527 528 529 530 531 532 533 534 535 536 537 538 539 540 541 542 543 544 545 546 547 548 549 550 551 552 553 554 555 556 557 558 559 560 561 562 563 564 565 566 567 568 569 570 571 572 573 574 575 576 577 578 579 580 581
static struct create_posix *
create_posix_buf(umode_t mode)
{
	struct create_posix *buf;

	buf = kzalloc(sizeof(struct create_posix),
			GFP_KERNEL);
	if (!buf)
		return NULL;

	buf->ccontext.DataOffset =
		cpu_to_le16(offsetof(struct create_posix, Mode));
	buf->ccontext.DataLength = cpu_to_le32(4);
	buf->ccontext.NameOffset =
		cpu_to_le16(offsetof(struct create_posix, Name));
	buf->ccontext.NameLength = cpu_to_le16(16);

	/* SMB2_CREATE_TAG_POSIX is "0x93AD25509CB411E7B42383DE968BCD7C" */
	buf->Name[0] = 0x93;
	buf->Name[1] = 0xAD;
	buf->Name[2] = 0x25;
	buf->Name[3] = 0x50;
	buf->Name[4] = 0x9C;
	buf->Name[5] = 0xB4;
	buf->Name[6] = 0x11;
	buf->Name[7] = 0xE7;
	buf->Name[8] = 0xB4;
	buf->Name[9] = 0x23;
	buf->Name[10] = 0x83;
	buf->Name[11] = 0xDE;
	buf->Name[12] = 0x96;
	buf->Name[13] = 0x8B;
	buf->Name[14] = 0xCD;
	buf->Name[15] = 0x7C;
	buf->Mode = cpu_to_le32(mode);
	cifs_dbg(FYI, "mode on posix create 0%o", mode);
	return buf;
}

static int
add_posix_context(struct kvec *iov, unsigned int *num_iovec, umode_t mode)
{
	struct smb2_create_req *req = iov[0].iov_base;
	unsigned int num = *num_iovec;

	iov[num].iov_base = create_posix_buf(mode);
	if (iov[num].iov_base == NULL)
		return -ENOMEM;
	iov[num].iov_len = sizeof(struct create_posix);
	if (!req->CreateContextsOffset)
		req->CreateContextsOffset = cpu_to_le32(
				sizeof(struct smb2_create_req) +
				iov[num - 1].iov_len);
	le32_add_cpu(&req->CreateContextsLength, sizeof(struct create_posix));
	*num_iovec = num + 1;
	return 0;
}

582
#else
583 584
static void assemble_neg_contexts(struct smb2_negotiate_req *req,
				  unsigned int *total_len)
585 586 587 588 589
{
	return;
}
#endif /* SMB311 */

590 591 592 593 594 595 596 597 598 599 600 601 602 603 604 605 606 607
/*
 *
 *	SMB2 Worker functions follow:
 *
 *	The general structure of the worker functions is:
 *	1) Call smb2_init (assembles SMB2 header)
 *	2) Initialize SMB2 command specific fields in fixed length area of SMB
 *	3) Call smb_sendrcv2 (sends request on socket and waits for response)
 *	4) Decode SMB2 command specific fields in the fixed length area
 *	5) Decode variable length data area (if any for this SMB2 command type)
 *	6) Call free smb buffer
 *	7) return
 *
 */

int
SMB2_negotiate(const unsigned int xid, struct cifs_ses *ses)
{
R
Ronnie Sahlberg 已提交
608
	struct smb_rqst rqst;
609 610 611
	struct smb2_negotiate_req *req;
	struct smb2_negotiate_rsp *rsp;
	struct kvec iov[1];
612
	struct kvec rsp_iov;
613 614
	int rc = 0;
	int resp_buftype;
615
	struct TCP_Server_Info *server = ses->server;
616 617 618
	int blob_offset, blob_length;
	char *security_blob;
	int flags = CIFS_NEG_OP;
619
	unsigned int total_len;
620

621
	cifs_dbg(FYI, "Negotiate protocol\n");
622

623 624 625
	if (!server) {
		WARN(1, "%s: server is NULL!\n", __func__);
		return -EIO;
626 627
	}

628
	rc = smb2_plain_req_init(SMB2_NEGOTIATE, NULL, (void **) &req, &total_len);
629 630 631
	if (rc)
		return rc;

632
	req->sync_hdr.SessionId = 0;
633 634 635 636
#ifdef CONFIG_CIFS_SMB311
	memset(server->preauth_sha_hash, 0, SMB2_PREAUTH_HASH_SIZE);
	memset(ses->preauth_sha_hash, 0, SMB2_PREAUTH_HASH_SIZE);
#endif
637

638 639 640 641 642
	if (strcmp(ses->server->vals->version_string,
		   SMB3ANY_VERSION_STRING) == 0) {
		req->Dialects[0] = cpu_to_le16(SMB30_PROT_ID);
		req->Dialects[1] = cpu_to_le16(SMB302_PROT_ID);
		req->DialectCount = cpu_to_le16(2);
643
		total_len += 4;
644 645 646 647 648 649
	} else if (strcmp(ses->server->vals->version_string,
		   SMBDEFAULT_VERSION_STRING) == 0) {
		req->Dialects[0] = cpu_to_le16(SMB21_PROT_ID);
		req->Dialects[1] = cpu_to_le16(SMB30_PROT_ID);
		req->Dialects[2] = cpu_to_le16(SMB302_PROT_ID);
		req->DialectCount = cpu_to_le16(3);
650
		total_len += 6;
651 652 653 654
	} else {
		/* otherwise send specific dialect */
		req->Dialects[0] = cpu_to_le16(ses->server->vals->protocol_id);
		req->DialectCount = cpu_to_le16(1);
655
		total_len += 2;
656
	}
657 658

	/* only one of SMB2 signing flags may be set in SMB2 request */
659
	if (ses->sign)
660
		req->SecurityMode = cpu_to_le16(SMB2_NEGOTIATE_SIGNING_REQUIRED);
661
	else if (global_secflags & CIFSSEC_MAY_SIGN)
662
		req->SecurityMode = cpu_to_le16(SMB2_NEGOTIATE_SIGNING_ENABLED);
663 664
	else
		req->SecurityMode = 0;
665

666
	req->Capabilities = cpu_to_le32(ses->server->vals->req_capabilities);
667

668 669 670
	/* ClientGUID must be zero for SMB2.02 dialect */
	if (ses->server->vals->protocol_id == SMB20_PROT_ID)
		memset(req->ClientGUID, 0, SMB2_CLIENT_GUID_SIZE);
671
	else {
672 673
		memcpy(req->ClientGUID, server->client_guid,
			SMB2_CLIENT_GUID_SIZE);
674
		if (ses->server->vals->protocol_id == SMB311_PROT_ID)
675
			assemble_neg_contexts(req, &total_len);
676
	}
677
	iov[0].iov_base = (char *)req;
678
	iov[0].iov_len = total_len;
679

R
Ronnie Sahlberg 已提交
680 681 682 683 684
	memset(&rqst, 0, sizeof(struct smb_rqst));
	rqst.rq_iov = iov;
	rqst.rq_nvec = 1;

	rc = cifs_send_recv(xid, ses, &rqst, &resp_buftype, flags, &rsp_iov);
685 686
	cifs_small_buf_release(req);
	rsp = (struct smb2_negotiate_rsp *)rsp_iov.iov_base;
687 688 689 690
	/*
	 * No tcon so can't do
	 * cifs_stats_inc(&tcon->stats.smb2_stats.smb2_com_fail[SMB2...]);
	 */
691 692
	if (rc == -EOPNOTSUPP) {
		cifs_dbg(VFS, "Dialect not supported by server. Consider "
693
			"specifying vers=1.0 or vers=2.0 on mount for accessing"
694 695 696
			" older servers\n");
		goto neg_exit;
	} else if (rc != 0)
697 698
		goto neg_exit;

699 700 701 702 703 704 705 706 707 708 709 710 711 712 713 714 715 716 717 718 719
	if (strcmp(ses->server->vals->version_string,
		   SMB3ANY_VERSION_STRING) == 0) {
		if (rsp->DialectRevision == cpu_to_le16(SMB20_PROT_ID)) {
			cifs_dbg(VFS,
				"SMB2 dialect returned but not requested\n");
			return -EIO;
		} else if (rsp->DialectRevision == cpu_to_le16(SMB21_PROT_ID)) {
			cifs_dbg(VFS,
				"SMB2.1 dialect returned but not requested\n");
			return -EIO;
		}
	} else if (strcmp(ses->server->vals->version_string,
		   SMBDEFAULT_VERSION_STRING) == 0) {
		if (rsp->DialectRevision == cpu_to_le16(SMB20_PROT_ID)) {
			cifs_dbg(VFS,
				"SMB2 dialect returned but not requested\n");
			return -EIO;
		} else if (rsp->DialectRevision == cpu_to_le16(SMB21_PROT_ID)) {
			/* ops set to 3.0 by default for default so update */
			ses->server->ops = &smb21_operations;
		}
S
Steve French 已提交
720 721
	} else if (le16_to_cpu(rsp->DialectRevision) !=
				ses->server->vals->protocol_id) {
722 723
		/* if requested single dialect ensure returned dialect matched */
		cifs_dbg(VFS, "Illegal 0x%x dialect returned: not requested\n",
S
Steve French 已提交
724
			le16_to_cpu(rsp->DialectRevision));
725 726 727
		return -EIO;
	}

728
	cifs_dbg(FYI, "mode 0x%x\n", rsp->SecurityMode);
729

730
	if (rsp->DialectRevision == cpu_to_le16(SMB20_PROT_ID))
731
		cifs_dbg(FYI, "negotiated smb2.0 dialect\n");
732
	else if (rsp->DialectRevision == cpu_to_le16(SMB21_PROT_ID))
733
		cifs_dbg(FYI, "negotiated smb2.1 dialect\n");
734
	else if (rsp->DialectRevision == cpu_to_le16(SMB30_PROT_ID))
735
		cifs_dbg(FYI, "negotiated smb3.0 dialect\n");
S
Steve French 已提交
736 737
	else if (rsp->DialectRevision == cpu_to_le16(SMB302_PROT_ID))
		cifs_dbg(FYI, "negotiated smb3.02 dialect\n");
738 739 740 741
#ifdef CONFIG_CIFS_SMB311
	else if (rsp->DialectRevision == cpu_to_le16(SMB311_PROT_ID))
		cifs_dbg(FYI, "negotiated smb3.1.1 dialect\n");
#endif /* SMB311 */
742
	else {
743
		cifs_dbg(VFS, "Illegal dialect returned by server 0x%x\n",
744
			 le16_to_cpu(rsp->DialectRevision));
745 746 747 748 749
		rc = -EIO;
		goto neg_exit;
	}
	server->dialect = le16_to_cpu(rsp->DialectRevision);

750 751
	/* BB: add check that dialect was valid given dialect(s) we asked for */

752 753 754 755 756 757 758 759 760
#ifdef CONFIG_CIFS_SMB311
	/*
	 * Keep a copy of the hash after negprot. This hash will be
	 * the starting hash value for all sessions made from this
	 * server.
	 */
	memcpy(server->preauth_sha_hash, ses->preauth_sha_hash,
	       SMB2_PREAUTH_HASH_SIZE);
#endif
761 762
	/* SMB2 only has an extended negflavor */
	server->negflavor = CIFS_NEGFLAVOR_EXTENDED;
763 764 765
	/* set it to the maximum buffer size value we can send with 1 credit */
	server->maxBuf = min_t(unsigned int, le32_to_cpu(rsp->MaxTransactSize),
			       SMB2_MAX_BUFFER_SIZE);
766 767 768
	server->max_read = le32_to_cpu(rsp->MaxReadSize);
	server->max_write = le32_to_cpu(rsp->MaxWriteSize);
	server->sec_mode = le16_to_cpu(rsp->SecurityMode);
769 770 771
	if ((server->sec_mode & SMB2_SEC_MODE_FLAGS_ALL) != server->sec_mode)
		cifs_dbg(FYI, "Server returned unexpected security mode 0x%x\n",
				server->sec_mode);
772
	server->capabilities = le32_to_cpu(rsp->Capabilities);
773 774
	/* Internal types */
	server->capabilities |= SMB2_NT_FIND | SMB2_LARGE_FILES;
775 776

	security_blob = smb2_get_data_area_len(&blob_offset, &blob_length,
R
Ronnie Sahlberg 已提交
777
					       (struct smb2_sync_hdr *)rsp);
778 779 780 781 782 783 784
	/*
	 * See MS-SMB2 section 2.2.4: if no blob, client picks default which
	 * for us will be
	 *	ses->sectype = RawNTLMSSP;
	 * but for time being this is our only auth choice so doesn't matter.
	 * We just found a server which sets blob length to zero expecting raw.
	 */
785
	if (blob_length == 0) {
786
		cifs_dbg(FYI, "missing security blob on negprot\n");
787 788
		server->sec_ntlmssp = true;
	}
P
Pavel Shilovsky 已提交
789

790
	rc = cifs_enable_signing(server, ses->sign);
791 792
	if (rc)
		goto neg_exit;
793
	if (blob_length) {
794
		rc = decode_negTokenInit(security_blob, blob_length, server);
795 796 797 798
		if (rc == 1)
			rc = 0;
		else if (rc == 0)
			rc = -EIO;
799
	}
800 801 802 803

#ifdef CONFIG_CIFS_SMB311
	if (rsp->DialectRevision == cpu_to_le16(SMB311_PROT_ID)) {
		if (rsp->NegotiateContextCount)
804 805
			rc = smb311_decode_neg_context(rsp, server,
						       rsp_iov.iov_len);
806 807 808 809
		else
			cifs_dbg(VFS, "Missing expected negotiate contexts\n");
	}
#endif /* CONFIG_CIFS_SMB311 */
810 811 812 813
neg_exit:
	free_rsp_buf(resp_buftype, rsp);
	return rc;
}
814

815 816
int smb3_validate_negotiate(const unsigned int xid, struct cifs_tcon *tcon)
{
817 818
	int rc;
	struct validate_negotiate_info_req *pneg_inbuf;
819
	struct validate_negotiate_info_rsp *pneg_rsp = NULL;
820
	u32 rsplen;
821
	u32 inbuflen; /* max of 4 dialects */
822 823 824

	cifs_dbg(FYI, "validate negotiate\n");

825 826 827 828
	/* In SMB3.11 preauth integrity supersedes validate negotiate */
	if (tcon->ses->server->dialect == SMB311_PROT_ID)
		return 0;

829 830
	/*
	 * validation ioctl must be signed, so no point sending this if we
831 832
	 * can not sign it (ie are not known user).  Even if signing is not
	 * required (enabled but not negotiated), in those cases we selectively
833
	 * sign just this, the first and only signed request on a connection.
834
	 * Having validation of negotiate info  helps reduce attack vectors.
835
	 */
836
	if (tcon->ses->session_flags & SMB2_SESSION_FLAG_IS_GUEST)
837 838
		return 0; /* validation requires signing */

839 840 841 842 843 844 845 846
	if (tcon->ses->user_name == NULL) {
		cifs_dbg(FYI, "Can't validate negotiate: null user mount\n");
		return 0; /* validation requires signing */
	}

	if (tcon->ses->session_flags & SMB2_SESSION_FLAG_IS_NULL)
		cifs_dbg(VFS, "Unexpected null user (anonymous) auth flag sent by server\n");

847 848 849 850 851
	pneg_inbuf = kmalloc(sizeof(*pneg_inbuf), GFP_NOFS);
	if (!pneg_inbuf)
		return -ENOMEM;

	pneg_inbuf->Capabilities =
852
			cpu_to_le32(tcon->ses->server->vals->req_capabilities);
853
	memcpy(pneg_inbuf->Guid, tcon->ses->server->client_guid,
854
					SMB2_CLIENT_GUID_SIZE);
855 856

	if (tcon->ses->sign)
857
		pneg_inbuf->SecurityMode =
858 859
			cpu_to_le16(SMB2_NEGOTIATE_SIGNING_REQUIRED);
	else if (global_secflags & CIFSSEC_MAY_SIGN)
860
		pneg_inbuf->SecurityMode =
861 862
			cpu_to_le16(SMB2_NEGOTIATE_SIGNING_ENABLED);
	else
863
		pneg_inbuf->SecurityMode = 0;
864

865 866 867

	if (strcmp(tcon->ses->server->vals->version_string,
		SMB3ANY_VERSION_STRING) == 0) {
868 869 870
		pneg_inbuf->Dialects[0] = cpu_to_le16(SMB30_PROT_ID);
		pneg_inbuf->Dialects[1] = cpu_to_le16(SMB302_PROT_ID);
		pneg_inbuf->DialectCount = cpu_to_le16(2);
871
		/* structure is big enough for 3 dialects, sending only 2 */
872 873
		inbuflen = sizeof(*pneg_inbuf) -
				sizeof(pneg_inbuf->Dialects[0]);
874 875
	} else if (strcmp(tcon->ses->server->vals->version_string,
		SMBDEFAULT_VERSION_STRING) == 0) {
876 877 878 879
		pneg_inbuf->Dialects[0] = cpu_to_le16(SMB21_PROT_ID);
		pneg_inbuf->Dialects[1] = cpu_to_le16(SMB30_PROT_ID);
		pneg_inbuf->Dialects[2] = cpu_to_le16(SMB302_PROT_ID);
		pneg_inbuf->DialectCount = cpu_to_le16(3);
880
		/* structure is big enough for 3 dialects */
881
		inbuflen = sizeof(*pneg_inbuf);
882 883
	} else {
		/* otherwise specific dialect was requested */
884
		pneg_inbuf->Dialects[0] =
885
			cpu_to_le16(tcon->ses->server->vals->protocol_id);
886
		pneg_inbuf->DialectCount = cpu_to_le16(1);
887
		/* structure is big enough for 3 dialects, sending only 1 */
888 889
		inbuflen = sizeof(*pneg_inbuf) -
				sizeof(pneg_inbuf->Dialects[0]) * 2;
890
	}
891 892 893

	rc = SMB2_ioctl(xid, tcon, NO_FILE_ID, NO_FILE_ID,
		FSCTL_VALIDATE_NEGOTIATE_INFO, true /* is_fsctl */,
894
		(char *)pneg_inbuf, inbuflen, (char **)&pneg_rsp, &rsplen);
895 896 897

	if (rc != 0) {
		cifs_dbg(VFS, "validate protocol negotiate failed: %d\n", rc);
898 899
		rc = -EIO;
		goto out_free_inbuf;
900 901
	}

902 903
	rc = -EIO;
	if (rsplen != sizeof(*pneg_rsp)) {
904 905 906 907
		cifs_dbg(VFS, "invalid protocol negotiate response size: %d\n",
			 rsplen);

		/* relax check since Mac returns max bufsize allowed on ioctl */
908 909
		if (rsplen > CIFSMaxBufSize || rsplen < sizeof(*pneg_rsp))
			goto out_free_rsp;
910 911 912
	}

	/* check validate negotiate info response matches what we got earlier */
913
	if (pneg_rsp->Dialect != cpu_to_le16(tcon->ses->server->dialect))
914 915 916 917 918 919 920 921 922 923 924 925
		goto vneg_out;

	if (pneg_rsp->SecurityMode != cpu_to_le16(tcon->ses->server->sec_mode))
		goto vneg_out;

	/* do not validate server guid because not saved at negprot time yet */

	if ((le32_to_cpu(pneg_rsp->Capabilities) | SMB2_NT_FIND |
	      SMB2_LARGE_FILES) != tcon->ses->server->capabilities)
		goto vneg_out;

	/* validate negotiate successful */
926
	rc = 0;
927
	cifs_dbg(FYI, "validate negotiate info successful\n");
928
	goto out_free_rsp;
929 930 931

vneg_out:
	cifs_dbg(VFS, "protocol revalidation - security settings mismatch\n");
932
out_free_rsp:
933
	kfree(pneg_rsp);
934 935 936
out_free_inbuf:
	kfree(pneg_inbuf);
	return rc;
937 938
}

S
Sachin Prabhu 已提交
939 940 941 942 943 944 945 946 947 948 949 950 951 952 953 954 955 956 957 958 959 960
enum securityEnum
smb2_select_sectype(struct TCP_Server_Info *server, enum securityEnum requested)
{
	switch (requested) {
	case Kerberos:
	case RawNTLMSSP:
		return requested;
	case NTLMv2:
		return RawNTLMSSP;
	case Unspecified:
		if (server->sec_ntlmssp &&
			(global_secflags & CIFSSEC_MAY_NTLMSSP))
			return RawNTLMSSP;
		if ((server->sec_kerberos || server->sec_mskerberos) &&
			(global_secflags & CIFSSEC_MAY_KRB5))
			return Kerberos;
		/* Fallthrough */
	default:
		return Unspecified;
	}
}

961 962 963 964 965 966 967 968 969 970 971 972 973 974 975 976 977 978 979 980 981 982 983 984 985 986
struct SMB2_sess_data {
	unsigned int xid;
	struct cifs_ses *ses;
	struct nls_table *nls_cp;
	void (*func)(struct SMB2_sess_data *);
	int result;
	u64 previous_session;

	/* we will send the SMB in three pieces:
	 * a fixed length beginning part, an optional
	 * SPNEGO blob (which can be zero length), and a
	 * last part which will include the strings
	 * and rest of bcc area. This allows us to avoid
	 * a large buffer 17K allocation
	 */
	int buf0_type;
	struct kvec iov[2];
};

static int
SMB2_sess_alloc_buffer(struct SMB2_sess_data *sess_data)
{
	int rc;
	struct cifs_ses *ses = sess_data->ses;
	struct smb2_sess_setup_req *req;
	struct TCP_Server_Info *server = ses->server;
987
	unsigned int total_len;
988

989 990
	rc = smb2_plain_req_init(SMB2_SESSION_SETUP, NULL, (void **) &req,
			     &total_len);
991 992 993
	if (rc)
		return rc;

994
	/* First session, not a reauthenticate */
995
	req->sync_hdr.SessionId = 0;
996 997 998 999 1000

	/* if reconnect, we need to send previous sess id, otherwise it is 0 */
	req->PreviousSessionId = sess_data->previous_session;

	req->Flags = 0; /* MBZ */
1001 1002 1003

	/* enough to enable echos and oplocks and one max size write */
	req->sync_hdr.CreditRequest = cpu_to_le16(130);
1004 1005 1006 1007 1008 1009 1010 1011 1012 1013 1014 1015 1016

	/* only one of SMB2 signing flags may be set in SMB2 request */
	if (server->sign)
		req->SecurityMode = SMB2_NEGOTIATE_SIGNING_REQUIRED;
	else if (global_secflags & CIFSSEC_MAY_SIGN) /* one flag unlike MUST_ */
		req->SecurityMode = SMB2_NEGOTIATE_SIGNING_ENABLED;
	else
		req->SecurityMode = 0;

	req->Capabilities = 0;
	req->Channel = 0; /* MBZ */

	sess_data->iov[0].iov_base = (char *)req;
1017 1018
	/* 1 for pad */
	sess_data->iov[0].iov_len = total_len - 1;
1019 1020 1021 1022 1023 1024 1025 1026 1027 1028 1029 1030 1031 1032 1033 1034 1035 1036 1037 1038
	/*
	 * This variable will be used to clear the buffer
	 * allocated above in case of any error in the calling function.
	 */
	sess_data->buf0_type = CIFS_SMALL_BUFFER;

	return 0;
}

static void
SMB2_sess_free_buffer(struct SMB2_sess_data *sess_data)
{
	free_rsp_buf(sess_data->buf0_type, sess_data->iov[0].iov_base);
	sess_data->buf0_type = CIFS_NO_BUFFER;
}

static int
SMB2_sess_sendreceive(struct SMB2_sess_data *sess_data)
{
	int rc;
R
Ronnie Sahlberg 已提交
1039
	struct smb_rqst rqst;
1040
	struct smb2_sess_setup_req *req = sess_data->iov[0].iov_base;
1041
	struct kvec rsp_iov = { NULL, 0 };
1042 1043 1044

	/* Testing shows that buffer offset must be at location of Buffer[0] */
	req->SecurityBufferOffset =
1045
		cpu_to_le16(sizeof(struct smb2_sess_setup_req) - 1 /* pad */);
1046 1047
	req->SecurityBufferLength = cpu_to_le16(sess_data->iov[1].iov_len);

R
Ronnie Sahlberg 已提交
1048 1049 1050
	memset(&rqst, 0, sizeof(struct smb_rqst));
	rqst.rq_iov = sess_data->iov;
	rqst.rq_nvec = 2;
1051

R
Ronnie Sahlberg 已提交
1052 1053 1054
	/* BB add code to build os and lm fields */
	rc = cifs_send_recv(sess_data->xid, sess_data->ses,
			    &rqst,
1055 1056
			    &sess_data->buf0_type,
			    CIFS_LOG_ERROR | CIFS_NEG_OP, &rsp_iov);
1057 1058
	cifs_small_buf_release(sess_data->iov[0].iov_base);
	memcpy(&sess_data->iov[0], &rsp_iov, sizeof(struct kvec));
1059 1060 1061 1062 1063 1064 1065 1066 1067 1068 1069

	return rc;
}

static int
SMB2_sess_establish_session(struct SMB2_sess_data *sess_data)
{
	int rc = 0;
	struct cifs_ses *ses = sess_data->ses;

	mutex_lock(&ses->server->srv_mutex);
1070
	if (ses->server->ops->generate_signingkey) {
1071 1072 1073 1074 1075
		rc = ses->server->ops->generate_signingkey(ses);
		if (rc) {
			cifs_dbg(FYI,
				"SMB3 session key generation failed\n");
			mutex_unlock(&ses->server->srv_mutex);
1076
			return rc;
1077 1078 1079 1080 1081 1082 1083 1084 1085 1086 1087 1088 1089 1090 1091 1092 1093 1094 1095 1096 1097 1098 1099 1100 1101 1102 1103 1104 1105 1106 1107 1108 1109 1110 1111 1112 1113 1114 1115 1116 1117 1118 1119 1120 1121 1122 1123 1124 1125 1126 1127 1128 1129 1130 1131 1132 1133 1134 1135 1136 1137 1138 1139 1140 1141 1142 1143 1144 1145
		}
	}
	if (!ses->server->session_estab) {
		ses->server->sequence_number = 0x2;
		ses->server->session_estab = true;
	}
	mutex_unlock(&ses->server->srv_mutex);

	cifs_dbg(FYI, "SMB2/3 session established successfully\n");
	spin_lock(&GlobalMid_Lock);
	ses->status = CifsGood;
	ses->need_reconnect = false;
	spin_unlock(&GlobalMid_Lock);
	return rc;
}

#ifdef CONFIG_CIFS_UPCALL
static void
SMB2_auth_kerberos(struct SMB2_sess_data *sess_data)
{
	int rc;
	struct cifs_ses *ses = sess_data->ses;
	struct cifs_spnego_msg *msg;
	struct key *spnego_key = NULL;
	struct smb2_sess_setup_rsp *rsp = NULL;

	rc = SMB2_sess_alloc_buffer(sess_data);
	if (rc)
		goto out;

	spnego_key = cifs_get_spnego_key(ses);
	if (IS_ERR(spnego_key)) {
		rc = PTR_ERR(spnego_key);
		spnego_key = NULL;
		goto out;
	}

	msg = spnego_key->payload.data[0];
	/*
	 * check version field to make sure that cifs.upcall is
	 * sending us a response in an expected form
	 */
	if (msg->version != CIFS_SPNEGO_UPCALL_VERSION) {
		cifs_dbg(VFS,
			  "bad cifs.upcall version. Expected %d got %d",
			  CIFS_SPNEGO_UPCALL_VERSION, msg->version);
		rc = -EKEYREJECTED;
		goto out_put_spnego_key;
	}

	ses->auth_key.response = kmemdup(msg->data, msg->sesskey_len,
					 GFP_KERNEL);
	if (!ses->auth_key.response) {
		cifs_dbg(VFS,
			"Kerberos can't allocate (%u bytes) memory",
			msg->sesskey_len);
		rc = -ENOMEM;
		goto out_put_spnego_key;
	}
	ses->auth_key.len = msg->sesskey_len;

	sess_data->iov[1].iov_base = msg->data + msg->sesskey_len;
	sess_data->iov[1].iov_len = msg->secblob_len;

	rc = SMB2_sess_sendreceive(sess_data);
	if (rc)
		goto out_put_spnego_key;

	rsp = (struct smb2_sess_setup_rsp *)sess_data->iov[0].iov_base;
R
Ronnie Sahlberg 已提交
1146
	ses->Suid = rsp->sync_hdr.SessionId;
1147 1148 1149 1150 1151 1152 1153 1154 1155 1156 1157 1158 1159 1160 1161 1162 1163 1164 1165 1166 1167 1168

	ses->session_flags = le16_to_cpu(rsp->SessionFlags);

	rc = SMB2_sess_establish_session(sess_data);
out_put_spnego_key:
	key_invalidate(spnego_key);
	key_put(spnego_key);
out:
	sess_data->result = rc;
	sess_data->func = NULL;
	SMB2_sess_free_buffer(sess_data);
}
#else
static void
SMB2_auth_kerberos(struct SMB2_sess_data *sess_data)
{
	cifs_dbg(VFS, "Kerberos negotiated but upcall support disabled!\n");
	sess_data->result = -EOPNOTSUPP;
	sess_data->func = NULL;
}
#endif

1169 1170 1171 1172 1173
static void
SMB2_sess_auth_rawntlmssp_authenticate(struct SMB2_sess_data *sess_data);

static void
SMB2_sess_auth_rawntlmssp_negotiate(struct SMB2_sess_data *sess_data)
1174
{
1175 1176
	int rc;
	struct cifs_ses *ses = sess_data->ses;
1177
	struct smb2_sess_setup_rsp *rsp = NULL;
1178
	char *ntlmssp_blob = NULL;
1179
	bool use_spnego = false; /* else use raw ntlmssp */
1180
	u16 blob_length = 0;
1181

1182 1183 1184 1185 1186
	/*
	 * If memory allocation is successful, caller of this function
	 * frees it.
	 */
	ses->ntlmssp = kmalloc(sizeof(struct ntlmssp_auth), GFP_KERNEL);
1187 1188 1189 1190
	if (!ses->ntlmssp) {
		rc = -ENOMEM;
		goto out_err;
	}
1191
	ses->ntlmssp->sesskey_per_smbsess = true;
1192

1193
	rc = SMB2_sess_alloc_buffer(sess_data);
1194
	if (rc)
1195
		goto out_err;
1196

1197 1198 1199 1200 1201 1202
	ntlmssp_blob = kmalloc(sizeof(struct _NEGOTIATE_MESSAGE),
			       GFP_KERNEL);
	if (ntlmssp_blob == NULL) {
		rc = -ENOMEM;
		goto out;
	}
1203

1204 1205 1206 1207 1208 1209 1210 1211 1212 1213 1214 1215
	build_ntlmssp_negotiate_blob(ntlmssp_blob, ses);
	if (use_spnego) {
		/* BB eventually need to add this */
		cifs_dbg(VFS, "spnego not supported for SMB2 yet\n");
		rc = -EOPNOTSUPP;
		goto out;
	} else {
		blob_length = sizeof(struct _NEGOTIATE_MESSAGE);
		/* with raw NTLMSSP we don't encapsulate in SPNEGO */
	}
	sess_data->iov[1].iov_base = ntlmssp_blob;
	sess_data->iov[1].iov_len = blob_length;
1216

1217 1218
	rc = SMB2_sess_sendreceive(sess_data);
	rsp = (struct smb2_sess_setup_rsp *)sess_data->iov[0].iov_base;
1219

1220 1221
	/* If true, rc here is expected and not an error */
	if (sess_data->buf0_type != CIFS_NO_BUFFER &&
R
Ronnie Sahlberg 已提交
1222
		rsp->sync_hdr.Status == STATUS_MORE_PROCESSING_REQUIRED)
1223
		rc = 0;
1224

1225 1226
	if (rc)
		goto out;
1227

1228
	if (offsetof(struct smb2_sess_setup_rsp, Buffer) !=
1229 1230 1231
			le16_to_cpu(rsp->SecurityBufferOffset)) {
		cifs_dbg(VFS, "Invalid security buffer offset %d\n",
			le16_to_cpu(rsp->SecurityBufferOffset));
1232
		rc = -EIO;
1233
		goto out;
1234
	}
1235 1236 1237 1238
	rc = decode_ntlmssp_challenge(rsp->Buffer,
			le16_to_cpu(rsp->SecurityBufferLength), ses);
	if (rc)
		goto out;
1239

1240
	cifs_dbg(FYI, "rawntlmssp session setup challenge phase\n");
1241 1242


R
Ronnie Sahlberg 已提交
1243
	ses->Suid = rsp->sync_hdr.SessionId;
1244 1245 1246 1247 1248 1249 1250 1251 1252 1253 1254 1255 1256 1257 1258 1259
	ses->session_flags = le16_to_cpu(rsp->SessionFlags);

out:
	kfree(ntlmssp_blob);
	SMB2_sess_free_buffer(sess_data);
	if (!rc) {
		sess_data->result = 0;
		sess_data->func = SMB2_sess_auth_rawntlmssp_authenticate;
		return;
	}
out_err:
	kfree(ses->ntlmssp);
	ses->ntlmssp = NULL;
	sess_data->result = rc;
	sess_data->func = NULL;
}
1260

1261 1262 1263 1264 1265 1266 1267 1268 1269 1270
static void
SMB2_sess_auth_rawntlmssp_authenticate(struct SMB2_sess_data *sess_data)
{
	int rc;
	struct cifs_ses *ses = sess_data->ses;
	struct smb2_sess_setup_req *req;
	struct smb2_sess_setup_rsp *rsp = NULL;
	unsigned char *ntlmssp_blob = NULL;
	bool use_spnego = false; /* else use raw ntlmssp */
	u16 blob_length = 0;
1271

1272 1273 1274
	rc = SMB2_sess_alloc_buffer(sess_data);
	if (rc)
		goto out;
1275

1276
	req = (struct smb2_sess_setup_req *) sess_data->iov[0].iov_base;
1277
	req->sync_hdr.SessionId = ses->Suid;
1278 1279 1280 1281 1282 1283

	rc = build_ntlmssp_auth_blob(&ntlmssp_blob, &blob_length, ses,
					sess_data->nls_cp);
	if (rc) {
		cifs_dbg(FYI, "build_ntlmssp_auth_blob failed %d\n", rc);
		goto out;
1284 1285
	}

1286 1287 1288 1289 1290 1291 1292 1293
	if (use_spnego) {
		/* BB eventually need to add this */
		cifs_dbg(VFS, "spnego not supported for SMB2 yet\n");
		rc = -EOPNOTSUPP;
		goto out;
	}
	sess_data->iov[1].iov_base = ntlmssp_blob;
	sess_data->iov[1].iov_len = blob_length;
1294

1295 1296 1297 1298 1299 1300
	rc = SMB2_sess_sendreceive(sess_data);
	if (rc)
		goto out;

	rsp = (struct smb2_sess_setup_rsp *)sess_data->iov[0].iov_base;

R
Ronnie Sahlberg 已提交
1301
	ses->Suid = rsp->sync_hdr.SessionId;
1302 1303
	ses->session_flags = le16_to_cpu(rsp->SessionFlags);

1304 1305 1306 1307 1308 1309 1310 1311 1312
	rc = SMB2_sess_establish_session(sess_data);
out:
	kfree(ntlmssp_blob);
	SMB2_sess_free_buffer(sess_data);
	kfree(ses->ntlmssp);
	ses->ntlmssp = NULL;
	sess_data->result = rc;
	sess_data->func = NULL;
}
1313

1314 1315 1316
static int
SMB2_select_sec(struct cifs_ses *ses, struct SMB2_sess_data *sess_data)
{
S
Sachin Prabhu 已提交
1317 1318 1319 1320 1321 1322 1323 1324 1325
	int type;

	type = smb2_select_sectype(ses->server, ses->sectype);
	cifs_dbg(FYI, "sess setup type %d\n", type);
	if (type == Unspecified) {
		cifs_dbg(VFS,
			"Unable to select appropriate authentication method!");
		return -EINVAL;
	}
1326

S
Sachin Prabhu 已提交
1327
	switch (type) {
1328 1329 1330 1331 1332 1333 1334
	case Kerberos:
		sess_data->func = SMB2_auth_kerberos;
		break;
	case RawNTLMSSP:
		sess_data->func = SMB2_sess_auth_rawntlmssp_negotiate;
		break;
	default:
S
Sachin Prabhu 已提交
1335
		cifs_dbg(VFS, "secType %d not supported!\n", type);
1336
		return -EOPNOTSUPP;
1337 1338
	}

1339 1340 1341 1342 1343 1344 1345 1346 1347 1348 1349 1350 1351 1352 1353 1354
	return 0;
}

int
SMB2_sess_setup(const unsigned int xid, struct cifs_ses *ses,
		const struct nls_table *nls_cp)
{
	int rc = 0;
	struct TCP_Server_Info *server = ses->server;
	struct SMB2_sess_data *sess_data;

	cifs_dbg(FYI, "Session Setup\n");

	if (!server) {
		WARN(1, "%s: server is NULL!\n", __func__);
		return -EIO;
1355 1356
	}

1357 1358 1359 1360 1361 1362 1363 1364 1365 1366 1367
	sess_data = kzalloc(sizeof(struct SMB2_sess_data), GFP_KERNEL);
	if (!sess_data)
		return -ENOMEM;

	rc = SMB2_select_sec(ses, sess_data);
	if (rc)
		goto out;
	sess_data->xid = xid;
	sess_data->ses = ses;
	sess_data->buf0_type = CIFS_NO_BUFFER;
	sess_data->nls_cp = (struct nls_table *) nls_cp;
1368
	sess_data->previous_session = ses->Suid;
1369

1370 1371 1372 1373 1374 1375 1376 1377
#ifdef CONFIG_CIFS_SMB311
	/*
	 * Initialize the session hash with the server one.
	 */
	memcpy(ses->preauth_sha_hash, ses->server->preauth_sha_hash,
	       SMB2_PREAUTH_HASH_SIZE);
#endif

1378 1379 1380
	while (sess_data->func)
		sess_data->func(sess_data);

1381 1382
	if ((ses->session_flags & SMB2_SESSION_FLAG_IS_GUEST) && (ses->sign))
		cifs_dbg(VFS, "signing requested but authenticated as guest\n");
1383
	rc = sess_data->result;
1384
out:
1385
	kfree(sess_data);
1386 1387 1388 1389 1390 1391
	return rc;
}

int
SMB2_logoff(const unsigned int xid, struct cifs_ses *ses)
{
R
Ronnie Sahlberg 已提交
1392
	struct smb_rqst rqst;
1393 1394 1395
	struct smb2_logoff_req *req; /* response is also trivial struct */
	int rc = 0;
	struct TCP_Server_Info *server;
1396
	int flags = 0;
1397 1398 1399 1400
	unsigned int total_len;
	struct kvec iov[1];
	struct kvec rsp_iov;
	int resp_buf_type;
1401

1402
	cifs_dbg(FYI, "disconnect session %p\n", ses);
1403 1404 1405 1406 1407 1408

	if (ses && (ses->server))
		server = ses->server;
	else
		return -EIO;

1409 1410 1411 1412
	/* no need to send SMB logoff if uid already closed due to reconnect */
	if (ses->need_reconnect)
		goto smb2_session_already_dead;

1413
	rc = smb2_plain_req_init(SMB2_LOGOFF, NULL, (void **) &req, &total_len);
1414 1415 1416 1417
	if (rc)
		return rc;

	 /* since no tcon, smb2_init can not do this, so do here */
1418
	req->sync_hdr.SessionId = ses->Suid;
1419 1420 1421 1422

	if (ses->session_flags & SMB2_SESSION_FLAG_ENCRYPT_DATA)
		flags |= CIFS_TRANSFORM_REQ;
	else if (server->sign)
1423 1424 1425 1426 1427 1428
		req->sync_hdr.Flags |= SMB2_FLAGS_SIGNED;

	flags |= CIFS_NO_RESP;

	iov[0].iov_base = (char *)req;
	iov[0].iov_len = total_len;
1429

R
Ronnie Sahlberg 已提交
1430 1431 1432 1433 1434
	memset(&rqst, 0, sizeof(struct smb_rqst));
	rqst.rq_iov = iov;
	rqst.rq_nvec = 1;

	rc = cifs_send_recv(xid, ses, &rqst, &resp_buf_type, flags, &rsp_iov);
1435
	cifs_small_buf_release(req);
1436 1437 1438 1439
	/*
	 * No tcon so can't do
	 * cifs_stats_inc(&tcon->stats.smb2_stats.smb2_com_fail[SMB2...]);
	 */
1440 1441

smb2_session_already_dead:
1442 1443
	return rc;
}
1444 1445 1446

static inline void cifs_stats_fail_inc(struct cifs_tcon *tcon, uint16_t code)
{
1447
	cifs_stats_inc(&tcon->stats.smb2_stats.smb2_com_failed[code]);
1448 1449 1450 1451
}

#define MAX_SHARENAME_LENGTH (255 /* server */ + 80 /* share */ + 1 /* NULL */)

S
Steve French 已提交
1452 1453 1454 1455 1456 1457 1458 1459
/* These are similar values to what Windows uses */
static inline void init_copy_chunk_defaults(struct cifs_tcon *tcon)
{
	tcon->max_chunks = 256;
	tcon->max_bytes_chunk = 1048576;
	tcon->max_bytes_copy = 16777216;
}

1460 1461 1462 1463
int
SMB2_tcon(const unsigned int xid, struct cifs_ses *ses, const char *tree,
	  struct cifs_tcon *tcon, const struct nls_table *cp)
{
R
Ronnie Sahlberg 已提交
1464
	struct smb_rqst rqst;
1465 1466 1467
	struct smb2_tree_connect_req *req;
	struct smb2_tree_connect_rsp *rsp = NULL;
	struct kvec iov[2];
1468
	struct kvec rsp_iov = { NULL, 0 };
1469 1470 1471 1472
	int rc = 0;
	int resp_buftype;
	int unc_path_len;
	__le16 *unc_path = NULL;
1473
	int flags = 0;
1474
	unsigned int total_len;
1475

1476
	cifs_dbg(FYI, "TCON\n");
1477

1478
	if (!(ses->server) || !tree)
1479 1480 1481 1482 1483 1484 1485 1486 1487 1488 1489 1490 1491
		return -EIO;

	unc_path = kmalloc(MAX_SHARENAME_LENGTH * 2, GFP_KERNEL);
	if (unc_path == NULL)
		return -ENOMEM;

	unc_path_len = cifs_strtoUTF16(unc_path, tree, strlen(tree), cp) + 1;
	unc_path_len *= 2;
	if (unc_path_len < 2) {
		kfree(unc_path);
		return -EINVAL;
	}

1492
	/* SMB2 TREE_CONNECT request must be called with TreeId == 0 */
A
Aurelien Aptel 已提交
1493
	tcon->tid = 0;
1494

1495 1496
	rc = smb2_plain_req_init(SMB2_TREE_CONNECT, tcon, (void **) &req,
			     &total_len);
1497 1498 1499 1500 1501
	if (rc) {
		kfree(unc_path);
		return rc;
	}

1502
	if (smb3_encryption_required(tcon))
1503
		flags |= CIFS_TRANSFORM_REQ;
1504 1505

	iov[0].iov_base = (char *)req;
1506 1507
	/* 1 for pad */
	iov[0].iov_len = total_len - 1;
1508 1509 1510

	/* Testing shows that buffer offset must be at location of Buffer[0] */
	req->PathOffset = cpu_to_le16(sizeof(struct smb2_tree_connect_req)
1511
			- 1 /* pad */);
1512 1513 1514 1515
	req->PathLength = cpu_to_le16(unc_path_len - 2);
	iov[1].iov_base = unc_path;
	iov[1].iov_len = unc_path_len;

1516 1517
	/* 3.11 tcon req must be signed if not encrypted. See MS-SMB2 3.2.4.1.1 */
	if ((ses->server->dialect == SMB311_PROT_ID) &&
1518
	    !smb3_encryption_required(tcon))
1519 1520
		req->sync_hdr.Flags |= SMB2_FLAGS_SIGNED;

R
Ronnie Sahlberg 已提交
1521 1522 1523 1524 1525
	memset(&rqst, 0, sizeof(struct smb_rqst));
	rqst.rq_iov = iov;
	rqst.rq_nvec = 2;

	rc = cifs_send_recv(xid, ses, &rqst, &resp_buftype, flags, &rsp_iov);
1526 1527
	cifs_small_buf_release(req);
	rsp = (struct smb2_tree_connect_rsp *)rsp_iov.iov_base;
1528 1529 1530 1531 1532 1533 1534 1535 1536

	if (rc != 0) {
		if (tcon) {
			cifs_stats_fail_inc(tcon, SMB2_TREE_CONNECT_HE);
			tcon->need_reconnect = true;
		}
		goto tcon_error_exit;
	}

1537 1538
	switch (rsp->ShareType) {
	case SMB2_SHARE_TYPE_DISK:
1539
		cifs_dbg(FYI, "connection to disk share\n");
1540 1541
		break;
	case SMB2_SHARE_TYPE_PIPE:
A
Aurelien Aptel 已提交
1542
		tcon->pipe = true;
1543
		cifs_dbg(FYI, "connection to pipe share\n");
1544 1545
		break;
	case SMB2_SHARE_TYPE_PRINT:
A
Aurelien Aptel 已提交
1546
		tcon->print = true;
1547
		cifs_dbg(FYI, "connection to printer\n");
1548 1549
		break;
	default:
1550
		cifs_dbg(VFS, "unknown share type %d\n", rsp->ShareType);
1551 1552 1553 1554 1555
		rc = -EOPNOTSUPP;
		goto tcon_error_exit;
	}

	tcon->share_flags = le32_to_cpu(rsp->ShareFlags);
1556
	tcon->capabilities = rsp->Capabilities; /* we keep caps little endian */
1557 1558 1559
	tcon->maximal_access = le32_to_cpu(rsp->MaximalAccess);
	tcon->tidStatus = CifsGood;
	tcon->need_reconnect = false;
R
Ronnie Sahlberg 已提交
1560
	tcon->tid = rsp->sync_hdr.TreeId;
1561
	strlcpy(tcon->treeName, tree, sizeof(tcon->treeName));
1562 1563 1564

	if ((rsp->Capabilities & SMB2_SHARE_CAP_DFS) &&
	    ((tcon->share_flags & SHI1005_FLAGS_DFS) == 0))
1565
		cifs_dbg(VFS, "DFS capability contradicts DFS flag\n");
1566 1567 1568 1569 1570

	if (tcon->seal &&
	    !(tcon->ses->server->capabilities & SMB2_GLOBAL_CAP_ENCRYPTION))
		cifs_dbg(VFS, "Encryption is requested but not supported\n");

S
Steve French 已提交
1571
	init_copy_chunk_defaults(tcon);
1572 1573
	if (tcon->ses->server->ops->validate_negotiate)
		rc = tcon->ses->server->ops->validate_negotiate(xid, tcon);
1574 1575 1576 1577 1578 1579
tcon_exit:
	free_rsp_buf(resp_buftype, rsp);
	kfree(unc_path);
	return rc;

tcon_error_exit:
R
Ronnie Sahlberg 已提交
1580
	if (rsp && rsp->sync_hdr.Status == STATUS_BAD_NETWORK_NAME) {
1581
		cifs_dbg(VFS, "BAD_NETWORK_NAME: %s\n", tree);
1582 1583 1584 1585 1586 1587 1588
	}
	goto tcon_exit;
}

int
SMB2_tdis(const unsigned int xid, struct cifs_tcon *tcon)
{
R
Ronnie Sahlberg 已提交
1589
	struct smb_rqst rqst;
1590 1591 1592
	struct smb2_tree_disconnect_req *req; /* response is trivial */
	int rc = 0;
	struct cifs_ses *ses = tcon->ses;
1593
	int flags = 0;
1594 1595 1596 1597
	unsigned int total_len;
	struct kvec iov[1];
	struct kvec rsp_iov;
	int resp_buf_type;
1598

1599
	cifs_dbg(FYI, "Tree Disconnect\n");
1600

1601
	if (!ses || !(ses->server))
1602 1603 1604 1605 1606
		return -EIO;

	if ((tcon->need_reconnect) || (tcon->ses->need_reconnect))
		return 0;

1607 1608
	rc = smb2_plain_req_init(SMB2_TREE_DISCONNECT, tcon, (void **) &req,
			     &total_len);
1609 1610 1611
	if (rc)
		return rc;

1612
	if (smb3_encryption_required(tcon))
1613 1614
		flags |= CIFS_TRANSFORM_REQ;

1615 1616 1617 1618 1619
	flags |= CIFS_NO_RESP;

	iov[0].iov_base = (char *)req;
	iov[0].iov_len = total_len;

R
Ronnie Sahlberg 已提交
1620 1621 1622 1623 1624
	memset(&rqst, 0, sizeof(struct smb_rqst));
	rqst.rq_iov = iov;
	rqst.rq_nvec = 1;

	rc = cifs_send_recv(xid, ses, &rqst, &resp_buf_type, flags, &rsp_iov);
1625
	cifs_small_buf_release(req);
1626 1627 1628 1629 1630
	if (rc)
		cifs_stats_fail_inc(tcon, SMB2_TREE_DISCONNECT_HE);

	return rc;
}
1631

P
Pavel Shilovsky 已提交
1632

1633 1634 1635 1636 1637 1638 1639 1640 1641 1642
static struct create_durable *
create_durable_buf(void)
{
	struct create_durable *buf;

	buf = kzalloc(sizeof(struct create_durable), GFP_KERNEL);
	if (!buf)
		return NULL;

	buf->ccontext.DataOffset = cpu_to_le16(offsetof
1643
					(struct create_durable, Data));
1644 1645 1646 1647
	buf->ccontext.DataLength = cpu_to_le32(16);
	buf->ccontext.NameOffset = cpu_to_le16(offsetof
				(struct create_durable, Name));
	buf->ccontext.NameLength = cpu_to_le16(4);
1648
	/* SMB2_CREATE_DURABLE_HANDLE_REQUEST is "DHnQ" */
1649 1650 1651 1652 1653 1654 1655
	buf->Name[0] = 'D';
	buf->Name[1] = 'H';
	buf->Name[2] = 'n';
	buf->Name[3] = 'Q';
	return buf;
}

1656 1657 1658 1659 1660 1661 1662 1663 1664 1665 1666 1667 1668 1669 1670 1671 1672
static struct create_durable *
create_reconnect_durable_buf(struct cifs_fid *fid)
{
	struct create_durable *buf;

	buf = kzalloc(sizeof(struct create_durable), GFP_KERNEL);
	if (!buf)
		return NULL;

	buf->ccontext.DataOffset = cpu_to_le16(offsetof
					(struct create_durable, Data));
	buf->ccontext.DataLength = cpu_to_le32(16);
	buf->ccontext.NameOffset = cpu_to_le16(offsetof
				(struct create_durable, Name));
	buf->ccontext.NameLength = cpu_to_le16(4);
	buf->Data.Fid.PersistentFileId = fid->persistent_fid;
	buf->Data.Fid.VolatileFileId = fid->volatile_fid;
1673
	/* SMB2_CREATE_DURABLE_HANDLE_RECONNECT is "DHnC" */
1674 1675 1676 1677 1678 1679 1680
	buf->Name[0] = 'D';
	buf->Name[1] = 'H';
	buf->Name[2] = 'n';
	buf->Name[3] = 'C';
	return buf;
}

P
Pavel Shilovsky 已提交
1681
static __u8
1682
parse_lease_state(struct TCP_Server_Info *server, struct smb2_create_rsp *rsp,
1683
		  unsigned int *epoch, char *lease_key)
P
Pavel Shilovsky 已提交
1684 1685
{
	char *data_offset;
1686
	struct create_context *cc;
1687 1688
	unsigned int next;
	unsigned int remaining;
1689
	char *name;
P
Pavel Shilovsky 已提交
1690

1691
	data_offset = (char *)rsp + le32_to_cpu(rsp->CreateContextsOffset);
1692
	remaining = le32_to_cpu(rsp->CreateContextsLength);
1693
	cc = (struct create_context *)data_offset;
1694
	while (remaining >= sizeof(struct create_context)) {
1695
		name = le16_to_cpu(cc->NameOffset) + (char *)cc;
1696 1697
		if (le16_to_cpu(cc->NameLength) == 4 &&
		    strncmp(name, "RqLs", 4) == 0)
1698 1699
			return server->ops->parse_lease_buf(cc, epoch,
							    lease_key);
1700 1701 1702 1703 1704 1705 1706

		next = le32_to_cpu(cc->Next);
		if (!next)
			break;
		remaining -= next;
		cc = (struct create_context *)((char *)cc + next);
	}
P
Pavel Shilovsky 已提交
1707

1708
	return 0;
P
Pavel Shilovsky 已提交
1709 1710
}

1711
static int
1712 1713
add_lease_context(struct TCP_Server_Info *server, struct kvec *iov,
		  unsigned int *num_iovec, __u8 *oplock)
1714 1715 1716 1717
{
	struct smb2_create_req *req = iov[0].iov_base;
	unsigned int num = *num_iovec;

1718
	iov[num].iov_base = server->ops->create_lease_buf(oplock+1, *oplock);
1719 1720
	if (iov[num].iov_base == NULL)
		return -ENOMEM;
1721
	iov[num].iov_len = server->vals->create_lease_size;
1722 1723 1724
	req->RequestedOplockLevel = SMB2_OPLOCK_LEVEL_LEASE;
	if (!req->CreateContextsOffset)
		req->CreateContextsOffset = cpu_to_le32(
1725
				sizeof(struct smb2_create_req) +
1726
				iov[num - 1].iov_len);
1727 1728
	le32_add_cpu(&req->CreateContextsLength,
		     server->vals->create_lease_size);
1729 1730 1731 1732
	*num_iovec = num + 1;
	return 0;
}

1733 1734 1735 1736 1737 1738 1739 1740 1741 1742 1743 1744 1745 1746 1747 1748 1749 1750
static struct create_durable_v2 *
create_durable_v2_buf(struct cifs_fid *pfid)
{
	struct create_durable_v2 *buf;

	buf = kzalloc(sizeof(struct create_durable_v2), GFP_KERNEL);
	if (!buf)
		return NULL;

	buf->ccontext.DataOffset = cpu_to_le16(offsetof
					(struct create_durable_v2, dcontext));
	buf->ccontext.DataLength = cpu_to_le32(sizeof(struct durable_context_v2));
	buf->ccontext.NameOffset = cpu_to_le16(offsetof
				(struct create_durable_v2, Name));
	buf->ccontext.NameLength = cpu_to_le16(4);

	buf->dcontext.Timeout = 0; /* Should this be configurable by workload */
	buf->dcontext.Flags = cpu_to_le32(SMB2_DHANDLE_FLAG_PERSISTENT);
1751
	generate_random_uuid(buf->dcontext.CreateGuid);
1752 1753 1754 1755 1756 1757 1758 1759 1760 1761 1762 1763 1764 1765 1766 1767 1768 1769 1770 1771 1772 1773 1774 1775 1776 1777 1778 1779 1780 1781 1782 1783 1784 1785 1786 1787 1788 1789 1790 1791 1792 1793 1794
	memcpy(pfid->create_guid, buf->dcontext.CreateGuid, 16);

	/* SMB2_CREATE_DURABLE_HANDLE_REQUEST is "DH2Q" */
	buf->Name[0] = 'D';
	buf->Name[1] = 'H';
	buf->Name[2] = '2';
	buf->Name[3] = 'Q';
	return buf;
}

static struct create_durable_handle_reconnect_v2 *
create_reconnect_durable_v2_buf(struct cifs_fid *fid)
{
	struct create_durable_handle_reconnect_v2 *buf;

	buf = kzalloc(sizeof(struct create_durable_handle_reconnect_v2),
			GFP_KERNEL);
	if (!buf)
		return NULL;

	buf->ccontext.DataOffset =
		cpu_to_le16(offsetof(struct create_durable_handle_reconnect_v2,
				     dcontext));
	buf->ccontext.DataLength =
		cpu_to_le32(sizeof(struct durable_reconnect_context_v2));
	buf->ccontext.NameOffset =
		cpu_to_le16(offsetof(struct create_durable_handle_reconnect_v2,
			    Name));
	buf->ccontext.NameLength = cpu_to_le16(4);

	buf->dcontext.Fid.PersistentFileId = fid->persistent_fid;
	buf->dcontext.Fid.VolatileFileId = fid->volatile_fid;
	buf->dcontext.Flags = cpu_to_le32(SMB2_DHANDLE_FLAG_PERSISTENT);
	memcpy(buf->dcontext.CreateGuid, fid->create_guid, 16);

	/* SMB2_CREATE_DURABLE_HANDLE_RECONNECT_V2 is "DH2C" */
	buf->Name[0] = 'D';
	buf->Name[1] = 'H';
	buf->Name[2] = '2';
	buf->Name[3] = 'C';
	return buf;
}

1795
static int
1796 1797 1798 1799 1800 1801 1802 1803 1804 1805 1806 1807
add_durable_v2_context(struct kvec *iov, unsigned int *num_iovec,
		    struct cifs_open_parms *oparms)
{
	struct smb2_create_req *req = iov[0].iov_base;
	unsigned int num = *num_iovec;

	iov[num].iov_base = create_durable_v2_buf(oparms->fid);
	if (iov[num].iov_base == NULL)
		return -ENOMEM;
	iov[num].iov_len = sizeof(struct create_durable_v2);
	if (!req->CreateContextsOffset)
		req->CreateContextsOffset =
1808
			cpu_to_le32(sizeof(struct smb2_create_req) +
1809 1810 1811 1812 1813 1814 1815 1816
								iov[1].iov_len);
	le32_add_cpu(&req->CreateContextsLength, sizeof(struct create_durable_v2));
	*num_iovec = num + 1;
	return 0;
}

static int
add_durable_reconnect_v2_context(struct kvec *iov, unsigned int *num_iovec,
1817
		    struct cifs_open_parms *oparms)
1818 1819 1820 1821
{
	struct smb2_create_req *req = iov[0].iov_base;
	unsigned int num = *num_iovec;

1822 1823 1824 1825 1826 1827 1828 1829 1830
	/* indicate that we don't need to relock the file */
	oparms->reconnect = false;

	iov[num].iov_base = create_reconnect_durable_v2_buf(oparms->fid);
	if (iov[num].iov_base == NULL)
		return -ENOMEM;
	iov[num].iov_len = sizeof(struct create_durable_handle_reconnect_v2);
	if (!req->CreateContextsOffset)
		req->CreateContextsOffset =
1831
			cpu_to_le32(sizeof(struct smb2_create_req) +
1832 1833 1834 1835 1836 1837 1838 1839 1840 1841 1842 1843 1844 1845 1846 1847 1848 1849 1850 1851 1852 1853
								iov[1].iov_len);
	le32_add_cpu(&req->CreateContextsLength,
			sizeof(struct create_durable_handle_reconnect_v2));
	*num_iovec = num + 1;
	return 0;
}

static int
add_durable_context(struct kvec *iov, unsigned int *num_iovec,
		    struct cifs_open_parms *oparms, bool use_persistent)
{
	struct smb2_create_req *req = iov[0].iov_base;
	unsigned int num = *num_iovec;

	if (use_persistent) {
		if (oparms->reconnect)
			return add_durable_reconnect_v2_context(iov, num_iovec,
								oparms);
		else
			return add_durable_v2_context(iov, num_iovec, oparms);
	}

1854 1855 1856 1857 1858 1859
	if (oparms->reconnect) {
		iov[num].iov_base = create_reconnect_durable_buf(oparms->fid);
		/* indicate that we don't need to relock the file */
		oparms->reconnect = false;
	} else
		iov[num].iov_base = create_durable_buf();
1860 1861 1862 1863 1864
	if (iov[num].iov_base == NULL)
		return -ENOMEM;
	iov[num].iov_len = sizeof(struct create_durable);
	if (!req->CreateContextsOffset)
		req->CreateContextsOffset =
1865
			cpu_to_le32(sizeof(struct smb2_create_req) +
1866
								iov[1].iov_len);
1867
	le32_add_cpu(&req->CreateContextsLength, sizeof(struct create_durable));
1868 1869 1870 1871
	*num_iovec = num + 1;
	return 0;
}

1872 1873 1874 1875 1876 1877 1878 1879 1880 1881 1882 1883 1884 1885 1886 1887 1888 1889 1890 1891 1892 1893 1894 1895 1896 1897 1898 1899 1900 1901 1902 1903 1904 1905 1906 1907 1908 1909 1910 1911 1912 1913 1914 1915 1916
static int
alloc_path_with_tree_prefix(__le16 **out_path, int *out_size, int *out_len,
			    const char *treename, const __le16 *path)
{
	int treename_len, path_len;
	struct nls_table *cp;
	const __le16 sep[] = {cpu_to_le16('\\'), cpu_to_le16(0x0000)};

	/*
	 * skip leading "\\"
	 */
	treename_len = strlen(treename);
	if (treename_len < 2 || !(treename[0] == '\\' && treename[1] == '\\'))
		return -EINVAL;

	treename += 2;
	treename_len -= 2;

	path_len = UniStrnlen((wchar_t *)path, PATH_MAX);

	/*
	 * make room for one path separator between the treename and
	 * path
	 */
	*out_len = treename_len + 1 + path_len;

	/*
	 * final path needs to be null-terminated UTF16 with a
	 * size aligned to 8
	 */

	*out_size = roundup((*out_len+1)*2, 8);
	*out_path = kzalloc(*out_size, GFP_KERNEL);
	if (!*out_path)
		return -ENOMEM;

	cp = load_nls_default();
	cifs_strtoUTF16(*out_path, treename, treename_len, cp);
	UniStrcat(*out_path, sep);
	UniStrcat(*out_path, path);
	unload_nls(cp);

	return 0;
}

1917 1918 1919 1920 1921 1922 1923 1924 1925 1926 1927 1928 1929 1930 1931 1932 1933 1934 1935 1936 1937 1938 1939 1940 1941 1942 1943 1944 1945 1946 1947 1948 1949 1950 1951 1952 1953 1954 1955 1956 1957 1958 1959 1960 1961 1962 1963 1964 1965 1966 1967 1968 1969 1970 1971 1972 1973 1974 1975 1976 1977 1978 1979 1980 1981 1982 1983 1984 1985 1986 1987 1988 1989 1990 1991 1992 1993 1994 1995 1996 1997 1998 1999 2000 2001 2002 2003 2004 2005 2006 2007 2008 2009 2010 2011 2012 2013 2014 2015 2016 2017 2018 2019 2020 2021 2022 2023 2024 2025 2026 2027 2028 2029 2030 2031 2032 2033 2034 2035 2036 2037 2038 2039 2040 2041 2042 2043 2044 2045 2046 2047 2048 2049 2050 2051 2052 2053 2054 2055 2056 2057 2058 2059 2060 2061 2062 2063 2064 2065 2066 2067 2068 2069
#ifdef CONFIG_CIFS_SMB311
int smb311_posix_mkdir(const unsigned int xid, struct inode *inode,
			       umode_t mode, struct cifs_tcon *tcon,
			       const char *full_path,
			       struct cifs_sb_info *cifs_sb)
{
	struct smb_rqst rqst;
	struct smb2_create_req *req;
	struct smb2_create_rsp *rsp;
	struct TCP_Server_Info *server;
	struct cifs_ses *ses = tcon->ses;
	struct kvec iov[3]; /* make sure at least one for each open context */
	struct kvec rsp_iov = {NULL, 0};
	int resp_buftype;
	int uni_path_len;
	__le16 *copy_path = NULL;
	int copy_size;
	int rc = 0;
	unsigned int n_iov = 2;
	__u32 file_attributes = 0;
	char *pc_buf = NULL;
	int flags = 0;
	unsigned int total_len;
	__le16 *path = cifs_convert_path_to_utf16(full_path, cifs_sb);

	if (!path)
		return -ENOMEM;

	cifs_dbg(FYI, "mkdir\n");

	if (ses && (ses->server))
		server = ses->server;
	else
		return -EIO;

	rc = smb2_plain_req_init(SMB2_CREATE, tcon, (void **) &req, &total_len);

	if (rc)
		return rc;

	if (smb3_encryption_required(tcon))
		flags |= CIFS_TRANSFORM_REQ;


	req->ImpersonationLevel = IL_IMPERSONATION;
	req->DesiredAccess = cpu_to_le32(FILE_WRITE_ATTRIBUTES);
	/* File attributes ignored on open (used in create though) */
	req->FileAttributes = cpu_to_le32(file_attributes);
	req->ShareAccess = FILE_SHARE_ALL_LE;
	req->CreateDisposition = cpu_to_le32(FILE_CREATE);
	req->CreateOptions = cpu_to_le32(CREATE_NOT_FILE);

	iov[0].iov_base = (char *)req;
	/* -1 since last byte is buf[0] which is sent below (path) */
	iov[0].iov_len = total_len - 1;

	req->NameOffset = cpu_to_le16(sizeof(struct smb2_create_req));

	/* [MS-SMB2] 2.2.13 NameOffset:
	 * If SMB2_FLAGS_DFS_OPERATIONS is set in the Flags field of
	 * the SMB2 header, the file name includes a prefix that will
	 * be processed during DFS name normalization as specified in
	 * section 3.3.5.9. Otherwise, the file name is relative to
	 * the share that is identified by the TreeId in the SMB2
	 * header.
	 */
	if (tcon->share_flags & SHI1005_FLAGS_DFS) {
		int name_len;

		req->sync_hdr.Flags |= SMB2_FLAGS_DFS_OPERATIONS;
		rc = alloc_path_with_tree_prefix(&copy_path, &copy_size,
						 &name_len,
						 tcon->treeName, path);
		if (rc) {
			cifs_small_buf_release(req);
			return rc;
		}
		req->NameLength = cpu_to_le16(name_len * 2);
		uni_path_len = copy_size;
		path = copy_path;
	} else {
		uni_path_len = (2 * UniStrnlen((wchar_t *)path, PATH_MAX)) + 2;
		/* MUST set path len (NameLength) to 0 opening root of share */
		req->NameLength = cpu_to_le16(uni_path_len - 2);
		if (uni_path_len % 8 != 0) {
			copy_size = roundup(uni_path_len, 8);
			copy_path = kzalloc(copy_size, GFP_KERNEL);
			if (!copy_path) {
				cifs_small_buf_release(req);
				return -ENOMEM;
			}
			memcpy((char *)copy_path, (const char *)path,
			       uni_path_len);
			uni_path_len = copy_size;
			path = copy_path;
		}
	}

	iov[1].iov_len = uni_path_len;
	iov[1].iov_base = path;
	req->RequestedOplockLevel = SMB2_OPLOCK_LEVEL_NONE;

	if (tcon->posix_extensions) {
		if (n_iov > 2) {
			struct create_context *ccontext =
			    (struct create_context *)iov[n_iov-1].iov_base;
			ccontext->Next =
				cpu_to_le32(iov[n_iov-1].iov_len);
		}

		rc = add_posix_context(iov, &n_iov, mode);
		if (rc) {
			cifs_small_buf_release(req);
			kfree(copy_path);
			return rc;
		}
		pc_buf = iov[n_iov-1].iov_base;
	}


	memset(&rqst, 0, sizeof(struct smb_rqst));
	rqst.rq_iov = iov;
	rqst.rq_nvec = n_iov;

	rc = cifs_send_recv(xid, ses, &rqst, &resp_buftype, flags,
			    &rsp_iov);

	cifs_small_buf_release(req);
	rsp = (struct smb2_create_rsp *)rsp_iov.iov_base;

	if (rc != 0) {
		cifs_stats_fail_inc(tcon, SMB2_CREATE_HE);
		trace_smb3_posix_mkdir_err(xid, tcon->tid, ses->Suid,
				    CREATE_NOT_FILE, FILE_WRITE_ATTRIBUTES, rc);
		goto smb311_mkdir_exit;
	} else
		trace_smb3_posix_mkdir_done(xid, rsp->PersistentFileId, tcon->tid,
				     ses->Suid, CREATE_NOT_FILE,
				     FILE_WRITE_ATTRIBUTES);

	SMB2_close(xid, tcon, rsp->PersistentFileId, rsp->VolatileFileId);

	/* Eventually save off posix specific response info and timestaps */

smb311_mkdir_exit:
	kfree(copy_path);
	kfree(pc_buf);
	free_rsp_buf(resp_buftype, rsp);
	return rc;

}
#endif /* SMB311 */

2070
int
2071
SMB2_open(const unsigned int xid, struct cifs_open_parms *oparms, __le16 *path,
2072
	  __u8 *oplock, struct smb2_file_all_info *buf,
2073
	  struct kvec *err_iov, int *buftype)
2074
{
R
Ronnie Sahlberg 已提交
2075
	struct smb_rqst rqst;
2076 2077 2078
	struct smb2_create_req *req;
	struct smb2_create_rsp *rsp;
	struct TCP_Server_Info *server;
2079
	struct cifs_tcon *tcon = oparms->tcon;
2080
	struct cifs_ses *ses = tcon->ses;
2081
	struct kvec iov[5]; /* make sure at least one for each open context */
2082
	struct kvec rsp_iov = {NULL, 0};
2083 2084
	int resp_buftype;
	int uni_path_len;
P
Pavel Shilovsky 已提交
2085 2086
	__le16 *copy_path = NULL;
	int copy_size;
2087
	int rc = 0;
2088
	unsigned int n_iov = 2;
2089
	__u32 file_attributes = 0;
2090
	char *dhc_buf = NULL, *lc_buf = NULL, *pc_buf = NULL;
2091
	int flags = 0;
2092
	unsigned int total_len;
2093

2094
	cifs_dbg(FYI, "create/open\n");
2095 2096 2097 2098 2099 2100

	if (ses && (ses->server))
		server = ses->server;
	else
		return -EIO;

2101 2102
	rc = smb2_plain_req_init(SMB2_CREATE, tcon, (void **) &req, &total_len);

2103 2104 2105
	if (rc)
		return rc;

2106
	if (smb3_encryption_required(tcon))
2107 2108
		flags |= CIFS_TRANSFORM_REQ;

2109
	if (oparms->create_options & CREATE_OPTION_READONLY)
2110
		file_attributes |= ATTR_READONLY;
2111 2112
	if (oparms->create_options & CREATE_OPTION_SPECIAL)
		file_attributes |= ATTR_SYSTEM;
2113

2114
	req->ImpersonationLevel = IL_IMPERSONATION;
2115
	req->DesiredAccess = cpu_to_le32(oparms->desired_access);
2116 2117 2118
	/* File attributes ignored on open (used in create though) */
	req->FileAttributes = cpu_to_le32(file_attributes);
	req->ShareAccess = FILE_SHARE_ALL_LE;
2119 2120
	req->CreateDisposition = cpu_to_le32(oparms->disposition);
	req->CreateOptions = cpu_to_le32(oparms->create_options & CREATE_OPTIONS_MASK);
2121 2122

	iov[0].iov_base = (char *)req;
2123
	/* -1 since last byte is buf[0] which is sent below (path) */
2124
	iov[0].iov_len = total_len - 1;
2125

2126
	req->NameOffset = cpu_to_le16(sizeof(struct smb2_create_req));
2127 2128 2129 2130 2131 2132 2133 2134 2135 2136 2137 2138

	/* [MS-SMB2] 2.2.13 NameOffset:
	 * If SMB2_FLAGS_DFS_OPERATIONS is set in the Flags field of
	 * the SMB2 header, the file name includes a prefix that will
	 * be processed during DFS name normalization as specified in
	 * section 3.3.5.9. Otherwise, the file name is relative to
	 * the share that is identified by the TreeId in the SMB2
	 * header.
	 */
	if (tcon->share_flags & SHI1005_FLAGS_DFS) {
		int name_len;

2139
		req->sync_hdr.Flags |= SMB2_FLAGS_DFS_OPERATIONS;
2140 2141 2142
		rc = alloc_path_with_tree_prefix(&copy_path, &copy_size,
						 &name_len,
						 tcon->treeName, path);
2143 2144
		if (rc) {
			cifs_small_buf_release(req);
2145
			return rc;
2146
		}
2147
		req->NameLength = cpu_to_le16(name_len * 2);
2148 2149
		uni_path_len = copy_size;
		path = copy_path;
2150 2151 2152 2153 2154 2155 2156
	} else {
		uni_path_len = (2 * UniStrnlen((wchar_t *)path, PATH_MAX)) + 2;
		/* MUST set path len (NameLength) to 0 opening root of share */
		req->NameLength = cpu_to_le16(uni_path_len - 2);
		if (uni_path_len % 8 != 0) {
			copy_size = roundup(uni_path_len, 8);
			copy_path = kzalloc(copy_size, GFP_KERNEL);
2157 2158
			if (!copy_path) {
				cifs_small_buf_release(req);
2159
				return -ENOMEM;
2160
			}
2161 2162 2163 2164 2165
			memcpy((char *)copy_path, (const char *)path,
			       uni_path_len);
			uni_path_len = copy_size;
			path = copy_path;
		}
2166 2167
	}

2168 2169 2170
	iov[1].iov_len = uni_path_len;
	iov[1].iov_base = path;

P
Pavel Shilovsky 已提交
2171 2172 2173
	if (!server->oplocks)
		*oplock = SMB2_OPLOCK_LEVEL_NONE;

2174
	if (!(server->capabilities & SMB2_GLOBAL_CAP_LEASING) ||
P
Pavel Shilovsky 已提交
2175 2176 2177
	    *oplock == SMB2_OPLOCK_LEVEL_NONE)
		req->RequestedOplockLevel = *oplock;
	else {
2178
		rc = add_lease_context(server, iov, &n_iov, oplock);
2179
		if (rc) {
P
Pavel Shilovsky 已提交
2180 2181
			cifs_small_buf_release(req);
			kfree(copy_path);
2182
			return rc;
P
Pavel Shilovsky 已提交
2183
		}
2184
		lc_buf = iov[n_iov-1].iov_base;
P
Pavel Shilovsky 已提交
2185 2186
	}

2187 2188
	if (*oplock == SMB2_OPLOCK_LEVEL_BATCH) {
		/* need to set Next field of lease context if we request it */
2189
		if (server->capabilities & SMB2_GLOBAL_CAP_LEASING) {
2190
			struct create_context *ccontext =
2191
			    (struct create_context *)iov[n_iov-1].iov_base;
2192
			ccontext->Next =
2193
				cpu_to_le32(server->vals->create_lease_size);
2194
		}
2195

2196
		rc = add_durable_context(iov, &n_iov, oparms,
2197
					tcon->use_persistent);
2198 2199 2200
		if (rc) {
			cifs_small_buf_release(req);
			kfree(copy_path);
2201
			kfree(lc_buf);
2202 2203
			return rc;
		}
2204
		dhc_buf = iov[n_iov-1].iov_base;
2205 2206
	}

2207 2208 2209 2210 2211 2212 2213 2214 2215 2216 2217 2218 2219 2220 2221 2222 2223 2224 2225 2226 2227
#ifdef CONFIG_CIFS_SMB311
	if (tcon->posix_extensions) {
		if (n_iov > 2) {
			struct create_context *ccontext =
			    (struct create_context *)iov[n_iov-1].iov_base;
			ccontext->Next =
				cpu_to_le32(iov[n_iov-1].iov_len);
		}

		rc = add_posix_context(iov, &n_iov, oparms->mode);
		if (rc) {
			cifs_small_buf_release(req);
			kfree(copy_path);
			kfree(lc_buf);
			kfree(dhc_buf);
			return rc;
		}
		pc_buf = iov[n_iov-1].iov_base;
	}
#endif /* SMB311 */

R
Ronnie Sahlberg 已提交
2228 2229 2230 2231 2232
	memset(&rqst, 0, sizeof(struct smb_rqst));
	rqst.rq_iov = iov;
	rqst.rq_nvec = n_iov;

	rc = cifs_send_recv(xid, ses, &rqst, &resp_buftype, flags,
2233
			    &rsp_iov);
2234 2235
	cifs_small_buf_release(req);
	rsp = (struct smb2_create_rsp *)rsp_iov.iov_base;
2236 2237 2238

	if (rc != 0) {
		cifs_stats_fail_inc(tcon, SMB2_CREATE_HE);
2239 2240
		if (err_iov && rsp) {
			*err_iov = rsp_iov;
2241
			*buftype = resp_buftype;
2242 2243 2244
			resp_buftype = CIFS_NO_BUFFER;
			rsp = NULL;
		}
2245 2246
		trace_smb3_open_err(xid, tcon->tid, ses->Suid,
				    oparms->create_options, oparms->desired_access, rc);
2247
		goto creat_exit;
2248 2249 2250 2251
	} else
		trace_smb3_open_done(xid, rsp->PersistentFileId, tcon->tid,
				     ses->Suid, oparms->create_options,
				     oparms->desired_access);
2252

2253 2254
	oparms->fid->persistent_fid = rsp->PersistentFileId;
	oparms->fid->volatile_fid = rsp->VolatileFileId;
2255 2256 2257 2258 2259 2260 2261 2262 2263

	if (buf) {
		memcpy(buf, &rsp->CreationTime, 32);
		buf->AllocationSize = rsp->AllocationSize;
		buf->EndOfFile = rsp->EndofFile;
		buf->Attributes = rsp->FileAttributes;
		buf->NumberOfLinks = cpu_to_le32(1);
		buf->DeletePending = 0;
	}
P
Pavel Shilovsky 已提交
2264

P
Pavel Shilovsky 已提交
2265
	if (rsp->OplockLevel == SMB2_OPLOCK_LEVEL_LEASE)
2266 2267
		*oplock = parse_lease_state(server, rsp, &oparms->fid->epoch,
					    oparms->fid->lease_key);
P
Pavel Shilovsky 已提交
2268 2269
	else
		*oplock = rsp->OplockLevel;
2270
creat_exit:
P
Pavel Shilovsky 已提交
2271
	kfree(copy_path);
2272 2273
	kfree(lc_buf);
	kfree(dhc_buf);
2274
	kfree(pc_buf);
2275 2276 2277 2278
	free_rsp_buf(resp_buftype, rsp);
	return rc;
}

2279 2280 2281 2282 2283
/*
 *	SMB2 IOCTL is used for both IOCTLs and FSCTLs
 */
int
SMB2_ioctl(const unsigned int xid, struct cifs_tcon *tcon, u64 persistent_fid,
2284
	   u64 volatile_fid, u32 opcode, bool is_fsctl,
2285 2286
	   char *in_data, u32 indatalen,
	   char **out_data, u32 *plen /* returned data len */)
2287
{
R
Ronnie Sahlberg 已提交
2288
	struct smb_rqst rqst;
2289 2290
	struct smb2_ioctl_req *req;
	struct smb2_ioctl_rsp *rsp;
2291
	struct cifs_ses *ses;
2292
	struct kvec iov[2];
2293
	struct kvec rsp_iov;
2294
	int resp_buftype;
2295
	int n_iov;
2296
	int rc = 0;
2297
	int flags = 0;
2298
	unsigned int total_len;
2299 2300 2301

	cifs_dbg(FYI, "SMB2 IOCTL\n");

2302 2303 2304
	if (out_data != NULL)
		*out_data = NULL;

2305 2306 2307 2308
	/* zero out returned data len, in case of error */
	if (plen)
		*plen = 0;

2309 2310 2311 2312 2313
	if (tcon)
		ses = tcon->ses;
	else
		return -EIO;

2314
	if (!ses || !(ses->server))
2315 2316
		return -EIO;

2317
	rc = smb2_plain_req_init(SMB2_IOCTL, tcon, (void **) &req, &total_len);
2318 2319 2320
	if (rc)
		return rc;

2321
	if (smb3_encryption_required(tcon))
2322 2323
		flags |= CIFS_TRANSFORM_REQ;

2324 2325 2326 2327 2328 2329 2330 2331
	req->CtlCode = cpu_to_le32(opcode);
	req->PersistentFileId = persistent_fid;
	req->VolatileFileId = volatile_fid;

	if (indatalen) {
		req->InputCount = cpu_to_le32(indatalen);
		/* do not set InputOffset if no input data */
		req->InputOffset =
2332
		       cpu_to_le32(offsetof(struct smb2_ioctl_req, Buffer));
2333 2334
		iov[1].iov_base = in_data;
		iov[1].iov_len = indatalen;
2335
		n_iov = 2;
2336
	} else
2337
		n_iov = 1;
2338 2339 2340 2341 2342 2343 2344 2345 2346

	req->OutputOffset = 0;
	req->OutputCount = 0; /* MBZ */

	/*
	 * Could increase MaxOutputResponse, but that would require more
	 * than one credit. Windows typically sets this smaller, but for some
	 * ioctls it may be useful to allow server to send more. No point
	 * limiting what the server can send as long as fits in one credit
2347 2348 2349 2350
	 * Unfortunately - we can not handle more than CIFS_MAX_MSG_SIZE
	 * (by default, note that it can be overridden to make max larger)
	 * in responses (except for read responses which can be bigger.
	 * We may want to bump this limit up
2351
	 */
2352
	req->MaxOutputResponse = cpu_to_le32(CIFSMaxBufSize);
2353 2354 2355 2356 2357 2358 2359 2360

	if (is_fsctl)
		req->Flags = cpu_to_le32(SMB2_0_IOCTL_IS_FSCTL);
	else
		req->Flags = 0;

	iov[0].iov_base = (char *)req;

S
Steve French 已提交
2361 2362 2363 2364 2365 2366
	/*
	 * If no input data, the size of ioctl struct in
	 * protocol spec still includes a 1 byte data buffer,
	 * but if input data passed to ioctl, we do not
	 * want to double count this, so we do not send
	 * the dummy one byte of data in iovec[0] if sending
2367
	 * input data (in iovec[1]).
S
Steve French 已提交
2368 2369 2370
	 */

	if (indatalen) {
2371
		iov[0].iov_len = total_len - 1;
S
Steve French 已提交
2372
	} else
2373
		iov[0].iov_len = total_len;
S
Steve French 已提交
2374

2375 2376
	/* validate negotiate request must be signed - see MS-SMB2 3.2.5.5 */
	if (opcode == FSCTL_VALIDATE_NEGOTIATE_INFO)
2377
		req->sync_hdr.Flags |= SMB2_FLAGS_SIGNED;
2378

R
Ronnie Sahlberg 已提交
2379 2380 2381 2382 2383
	memset(&rqst, 0, sizeof(struct smb_rqst));
	rqst.rq_iov = iov;
	rqst.rq_nvec = n_iov;

	rc = cifs_send_recv(xid, ses, &rqst, &resp_buftype, flags,
2384
			    &rsp_iov);
2385 2386
	cifs_small_buf_release(req);
	rsp = (struct smb2_ioctl_rsp *)rsp_iov.iov_base;
2387

2388 2389 2390 2391
	if (rc != 0)
		trace_smb3_fsctl_err(xid, persistent_fid, tcon->tid,
				ses->Suid, 0, opcode, rc);

2392
	if ((rc != 0) && (rc != -EINVAL)) {
2393
		cifs_stats_fail_inc(tcon, SMB2_IOCTL_HE);
2394
		goto ioctl_exit;
2395 2396 2397
	} else if (rc == -EINVAL) {
		if ((opcode != FSCTL_SRV_COPYCHUNK_WRITE) &&
		    (opcode != FSCTL_SRV_COPYCHUNK)) {
2398
			cifs_stats_fail_inc(tcon, SMB2_IOCTL_HE);
2399 2400
			goto ioctl_exit;
		}
2401 2402 2403 2404 2405 2406 2407 2408 2409 2410 2411 2412 2413 2414 2415 2416 2417 2418
	}

	/* check if caller wants to look at return data or just return rc */
	if ((plen == NULL) || (out_data == NULL))
		goto ioctl_exit;

	*plen = le32_to_cpu(rsp->OutputCount);

	/* We check for obvious errors in the output buffer length and offset */
	if (*plen == 0)
		goto ioctl_exit; /* server returned no data */
	else if (*plen > 0xFF00) {
		cifs_dbg(VFS, "srv returned invalid ioctl length: %d\n", *plen);
		*plen = 0;
		rc = -EIO;
		goto ioctl_exit;
	}

2419
	if (rsp_iov.iov_len < le32_to_cpu(rsp->OutputOffset) + *plen) {
2420 2421 2422 2423 2424 2425 2426 2427 2428 2429 2430 2431 2432
		cifs_dbg(VFS, "Malformed ioctl resp: len %d offset %d\n", *plen,
			le32_to_cpu(rsp->OutputOffset));
		*plen = 0;
		rc = -EIO;
		goto ioctl_exit;
	}

	*out_data = kmalloc(*plen, GFP_KERNEL);
	if (*out_data == NULL) {
		rc = -ENOMEM;
		goto ioctl_exit;
	}

2433
	memcpy(*out_data, (char *)rsp + le32_to_cpu(rsp->OutputOffset), *plen);
2434 2435 2436 2437 2438
ioctl_exit:
	free_rsp_buf(resp_buftype, rsp);
	return rc;
}

2439 2440 2441 2442 2443 2444 2445 2446 2447 2448 2449 2450 2451
/*
 *   Individual callers to ioctl worker function follow
 */

int
SMB2_set_compression(const unsigned int xid, struct cifs_tcon *tcon,
		     u64 persistent_fid, u64 volatile_fid)
{
	int rc;
	struct  compress_ioctl fsctl_input;
	char *ret_data = NULL;

	fsctl_input.CompressionState =
2452
			cpu_to_le16(COMPRESSION_FORMAT_DEFAULT);
2453 2454 2455 2456 2457 2458 2459 2460 2461 2462 2463

	rc = SMB2_ioctl(xid, tcon, persistent_fid, volatile_fid,
			FSCTL_SET_COMPRESSION, true /* is_fsctl */,
			(char *)&fsctl_input /* data input */,
			2 /* in data len */, &ret_data /* out data */, NULL);

	cifs_dbg(FYI, "set compression rc %d\n", rc);

	return rc;
}

2464
int
2465 2466
SMB2_close_flags(const unsigned int xid, struct cifs_tcon *tcon,
		 u64 persistent_fid, u64 volatile_fid, int flags)
2467
{
R
Ronnie Sahlberg 已提交
2468
	struct smb_rqst rqst;
2469 2470 2471 2472
	struct smb2_close_req *req;
	struct smb2_close_rsp *rsp;
	struct cifs_ses *ses = tcon->ses;
	struct kvec iov[1];
2473
	struct kvec rsp_iov;
2474 2475
	int resp_buftype;
	int rc = 0;
2476
	unsigned int total_len;
2477

2478
	cifs_dbg(FYI, "Close\n");
2479

2480
	if (!ses || !(ses->server))
2481 2482
		return -EIO;

2483
	rc = smb2_plain_req_init(SMB2_CLOSE, tcon, (void **) &req, &total_len);
2484 2485 2486
	if (rc)
		return rc;

2487
	if (smb3_encryption_required(tcon))
2488 2489
		flags |= CIFS_TRANSFORM_REQ;

2490 2491 2492 2493
	req->PersistentFileId = persistent_fid;
	req->VolatileFileId = volatile_fid;

	iov[0].iov_base = (char *)req;
2494
	iov[0].iov_len = total_len;
2495

R
Ronnie Sahlberg 已提交
2496 2497 2498 2499 2500
	memset(&rqst, 0, sizeof(struct smb_rqst));
	rqst.rq_iov = iov;
	rqst.rq_nvec = 1;

	rc = cifs_send_recv(xid, ses, &rqst, &resp_buftype, flags, &rsp_iov);
2501 2502
	cifs_small_buf_release(req);
	rsp = (struct smb2_close_rsp *)rsp_iov.iov_base;
2503 2504

	if (rc != 0) {
2505
		cifs_stats_fail_inc(tcon, SMB2_CLOSE_HE);
2506 2507
		trace_smb3_close_err(xid, persistent_fid, tcon->tid, ses->Suid,
				     rc);
2508 2509 2510 2511 2512 2513 2514 2515 2516
		goto close_exit;
	}

	/* BB FIXME - decode close response, update inode for caching */

close_exit:
	free_rsp_buf(resp_buftype, rsp);
	return rc;
}
P
Pavel Shilovsky 已提交
2517

2518 2519 2520 2521 2522 2523 2524
int
SMB2_close(const unsigned int xid, struct cifs_tcon *tcon,
	   u64 persistent_fid, u64 volatile_fid)
{
	return SMB2_close_flags(xid, tcon, persistent_fid, volatile_fid, 0);
}

P
Pavel Shilovsky 已提交
2525
static int
2526
validate_iov(unsigned int offset, unsigned int buffer_length,
2527
	     struct kvec *iov, unsigned int min_buf_size)
P
Pavel Shilovsky 已提交
2528
{
2529
	unsigned int smb_len = iov->iov_len;
2530 2531
	char *end_of_smb = smb_len + (char *)iov->iov_base;
	char *begin_of_buf = offset + (char *)iov->iov_base;
P
Pavel Shilovsky 已提交
2532 2533 2534 2535
	char *end_of_buf = begin_of_buf + buffer_length;


	if (buffer_length < min_buf_size) {
2536 2537
		cifs_dbg(VFS, "buffer length %d smaller than minimum size %d\n",
			 buffer_length, min_buf_size);
P
Pavel Shilovsky 已提交
2538 2539 2540 2541 2542
		return -EINVAL;
	}

	/* check if beyond RFC1001 maximum length */
	if ((smb_len > 0x7FFFFF) || (buffer_length > 0x7FFFFF)) {
2543 2544
		cifs_dbg(VFS, "buffer length %d or smb length %d too large\n",
			 buffer_length, smb_len);
P
Pavel Shilovsky 已提交
2545 2546 2547 2548
		return -EINVAL;
	}

	if ((begin_of_buf > end_of_smb) || (end_of_buf > end_of_smb)) {
2549
		cifs_dbg(VFS, "illegal server response, bad offset to data\n");
P
Pavel Shilovsky 已提交
2550 2551 2552 2553 2554 2555 2556 2557 2558 2559 2560
		return -EINVAL;
	}

	return 0;
}

/*
 * If SMB buffer fields are valid, copy into temporary buffer to hold result.
 * Caller must free buffer.
 */
static int
2561
validate_and_copy_iov(unsigned int offset, unsigned int buffer_length,
2562
		      struct kvec *iov, unsigned int minbufsize,
P
Pavel Shilovsky 已提交
2563 2564
		      char *data)
{
2565
	char *begin_of_buf = offset + (char *)iov->iov_base;
P
Pavel Shilovsky 已提交
2566 2567 2568 2569 2570
	int rc;

	if (!data)
		return -EINVAL;

2571
	rc = validate_iov(offset, buffer_length, iov, minbufsize);
P
Pavel Shilovsky 已提交
2572 2573 2574 2575 2576 2577 2578 2579
	if (rc)
		return rc;

	memcpy(data, begin_of_buf, buffer_length);

	return 0;
}

2580 2581
static int
query_info(const unsigned int xid, struct cifs_tcon *tcon,
2582 2583 2584
	   u64 persistent_fid, u64 volatile_fid, u8 info_class, u8 info_type,
	   u32 additional_info, size_t output_len, size_t min_len, void **data,
		u32 *dlen)
P
Pavel Shilovsky 已提交
2585
{
R
Ronnie Sahlberg 已提交
2586
	struct smb_rqst rqst;
P
Pavel Shilovsky 已提交
2587 2588 2589
	struct smb2_query_info_req *req;
	struct smb2_query_info_rsp *rsp = NULL;
	struct kvec iov[2];
2590
	struct kvec rsp_iov;
P
Pavel Shilovsky 已提交
2591 2592 2593
	int rc = 0;
	int resp_buftype;
	struct cifs_ses *ses = tcon->ses;
2594
	int flags = 0;
2595
	unsigned int total_len;
P
Pavel Shilovsky 已提交
2596

2597
	cifs_dbg(FYI, "Query Info\n");
P
Pavel Shilovsky 已提交
2598

2599
	if (!ses || !(ses->server))
P
Pavel Shilovsky 已提交
2600 2601
		return -EIO;

2602 2603
	rc = smb2_plain_req_init(SMB2_QUERY_INFO, tcon, (void **) &req,
			     &total_len);
P
Pavel Shilovsky 已提交
2604 2605 2606
	if (rc)
		return rc;

2607
	if (smb3_encryption_required(tcon))
2608 2609
		flags |= CIFS_TRANSFORM_REQ;

2610
	req->InfoType = info_type;
2611
	req->FileInfoClass = info_class;
P
Pavel Shilovsky 已提交
2612 2613
	req->PersistentFileId = persistent_fid;
	req->VolatileFileId = volatile_fid;
2614
	req->AdditionalInformation = cpu_to_le32(additional_info);
2615 2616 2617 2618 2619 2620

	/*
	 * We do not use the input buffer (do not send extra byte)
	 */
	req->InputBufferOffset = 0;

2621
	req->OutputBufferLength = cpu_to_le32(output_len);
P
Pavel Shilovsky 已提交
2622 2623

	iov[0].iov_base = (char *)req;
2624 2625
	/* 1 for Buffer */
	iov[0].iov_len = total_len - 1;
P
Pavel Shilovsky 已提交
2626

R
Ronnie Sahlberg 已提交
2627 2628 2629 2630 2631
	memset(&rqst, 0, sizeof(struct smb_rqst));
	rqst.rq_iov = iov;
	rqst.rq_nvec = 1;

	rc = cifs_send_recv(xid, ses, &rqst, &resp_buftype, flags, &rsp_iov);
2632 2633
	cifs_small_buf_release(req);
	rsp = (struct smb2_query_info_rsp *)rsp_iov.iov_base;
2634

P
Pavel Shilovsky 已提交
2635 2636
	if (rc) {
		cifs_stats_fail_inc(tcon, SMB2_QUERY_INFO_HE);
2637 2638
		trace_smb3_query_info_err(xid, persistent_fid, tcon->tid,
				ses->Suid, info_class, (__u32)info_type, rc);
P
Pavel Shilovsky 已提交
2639 2640 2641
		goto qinf_exit;
	}

2642 2643 2644 2645 2646 2647 2648 2649 2650 2651 2652 2653 2654 2655
	if (dlen) {
		*dlen = le32_to_cpu(rsp->OutputBufferLength);
		if (!*data) {
			*data = kmalloc(*dlen, GFP_KERNEL);
			if (!*data) {
				cifs_dbg(VFS,
					"Error %d allocating memory for acl\n",
					rc);
				*dlen = 0;
				goto qinf_exit;
			}
		}
	}

2656
	rc = validate_and_copy_iov(le16_to_cpu(rsp->OutputBufferOffset),
P
Pavel Shilovsky 已提交
2657
				   le32_to_cpu(rsp->OutputBufferLength),
2658
				   &rsp_iov, min_len, *data);
P
Pavel Shilovsky 已提交
2659 2660 2661 2662 2663

qinf_exit:
	free_rsp_buf(resp_buftype, rsp);
	return rc;
}
2664

2665
int SMB2_query_eas(const unsigned int xid, struct cifs_tcon *tcon,
2666 2667
		   u64 persistent_fid, u64 volatile_fid,
		   int ea_buf_size, struct smb2_file_full_ea_info *data)
2668 2669 2670
{
	return query_info(xid, tcon, persistent_fid, volatile_fid,
			  FILE_FULL_EA_INFORMATION, SMB2_O_INFO_FILE, 0,
2671
			  ea_buf_size,
2672 2673 2674 2675 2676
			  sizeof(struct smb2_file_full_ea_info),
			  (void **)&data,
			  NULL);
}

2677 2678 2679 2680 2681 2682 2683 2684 2685 2686
int SMB2_query_info(const unsigned int xid, struct cifs_tcon *tcon,
	u64 persistent_fid, u64 volatile_fid, struct smb2_file_all_info *data)
{
	return query_info(xid, tcon, persistent_fid, volatile_fid,
			  FILE_ALL_INFORMATION, SMB2_O_INFO_FILE, 0,
			  sizeof(struct smb2_file_all_info) + PATH_MAX * 2,
			  sizeof(struct smb2_file_all_info), (void **)&data,
			  NULL);
}

2687
int
2688
SMB2_query_acl(const unsigned int xid, struct cifs_tcon *tcon,
2689
		u64 persistent_fid, u64 volatile_fid,
2690
		void **data, u32 *plen)
2691
{
2692 2693 2694
	__u32 additional_info = OWNER_SECINFO | GROUP_SECINFO | DACL_SECINFO;
	*plen = 0;

2695
	return query_info(xid, tcon, persistent_fid, volatile_fid,
2696
			  0, SMB2_O_INFO_SECURITY, additional_info,
2697
			  SMB2_MAX_BUFFER_SIZE, MIN_SEC_DESC_LEN, data, plen);
2698 2699 2700 2701 2702 2703 2704
}

int
SMB2_get_srv_num(const unsigned int xid, struct cifs_tcon *tcon,
		 u64 persistent_fid, u64 volatile_fid, __le64 *uniqueid)
{
	return query_info(xid, tcon, persistent_fid, volatile_fid,
2705 2706
			  FILE_INTERNAL_INFORMATION, SMB2_O_INFO_FILE, 0,
			  sizeof(struct smb2_file_internal_info),
2707
			  sizeof(struct smb2_file_internal_info),
2708
			  (void **)&uniqueid, NULL);
2709 2710
}

2711 2712 2713 2714 2715 2716 2717 2718 2719 2720 2721
/*
 * This is a no-op for now. We're not really interested in the reply, but
 * rather in the fact that the server sent one and that server->lstrp
 * gets updated.
 *
 * FIXME: maybe we should consider checking that the reply matches request?
 */
static void
smb2_echo_callback(struct mid_q_entry *mid)
{
	struct TCP_Server_Info *server = mid->callback_data;
2722
	struct smb2_echo_rsp *rsp = (struct smb2_echo_rsp *)mid->resp_buf;
2723 2724 2725
	unsigned int credits_received = 1;

	if (mid->mid_state == MID_RESPONSE_RECEIVED)
R
Ronnie Sahlberg 已提交
2726
		credits_received = le16_to_cpu(rsp->sync_hdr.CreditRequest);
2727 2728 2729 2730 2731

	DeleteMidQEntry(mid);
	add_credits(server, credits_received, CIFS_ECHO_OP);
}

2732 2733 2734 2735 2736 2737 2738 2739
void smb2_reconnect_server(struct work_struct *work)
{
	struct TCP_Server_Info *server = container_of(work,
					struct TCP_Server_Info, reconnect.work);
	struct cifs_ses *ses;
	struct cifs_tcon *tcon, *tcon2;
	struct list_head tmp_list;
	int tcon_exist = false;
2740 2741 2742
	int rc;
	int resched = false;

2743 2744 2745 2746 2747 2748 2749 2750 2751 2752

	/* Prevent simultaneous reconnects that can corrupt tcon->rlist list */
	mutex_lock(&server->reconnect_mutex);

	INIT_LIST_HEAD(&tmp_list);
	cifs_dbg(FYI, "Need negotiate, reconnecting tcons\n");

	spin_lock(&cifs_tcp_ses_lock);
	list_for_each_entry(ses, &server->smb_ses_list, smb_ses_list) {
		list_for_each_entry(tcon, &ses->tcon_list, tcon_list) {
2753
			if (tcon->need_reconnect || tcon->need_reopen_files) {
2754 2755 2756 2757 2758
				tcon->tc_count++;
				list_add_tail(&tcon->rlist, &tmp_list);
				tcon_exist = true;
			}
		}
A
Aurelien Aptel 已提交
2759 2760 2761 2762
		if (ses->tcon_ipc && ses->tcon_ipc->need_reconnect) {
			list_add_tail(&ses->tcon_ipc->rlist, &tmp_list);
			tcon_exist = true;
		}
2763 2764 2765 2766 2767 2768 2769 2770 2771 2772 2773
	}
	/*
	 * Get the reference to server struct to be sure that the last call of
	 * cifs_put_tcon() in the loop below won't release the server pointer.
	 */
	if (tcon_exist)
		server->srv_count++;

	spin_unlock(&cifs_tcp_ses_lock);

	list_for_each_entry_safe(tcon, tcon2, &tmp_list, rlist) {
2774 2775
		rc = smb2_reconnect(SMB2_INTERNAL_CMD, tcon);
		if (!rc)
2776
			cifs_reopen_persistent_handles(tcon);
2777 2778
		else
			resched = true;
2779 2780 2781 2782 2783
		list_del_init(&tcon->rlist);
		cifs_put_tcon(tcon);
	}

	cifs_dbg(FYI, "Reconnecting tcons finished\n");
2784 2785
	if (resched)
		queue_delayed_work(cifsiod_wq, &server->reconnect, 2 * HZ);
2786 2787 2788 2789 2790 2791 2792
	mutex_unlock(&server->reconnect_mutex);

	/* now we can safely release srv struct */
	if (tcon_exist)
		cifs_put_tcp_session(server, 1);
}

2793 2794 2795 2796 2797
int
SMB2_echo(struct TCP_Server_Info *server)
{
	struct smb2_echo_req *req;
	int rc = 0;
2798
	struct kvec iov[1];
2799
	struct smb_rqst rqst = { .rq_iov = iov,
2800
				 .rq_nvec = 1 };
2801
	unsigned int total_len;
2802

2803
	cifs_dbg(FYI, "In echo request\n");
2804

2805
	if (server->tcpStatus == CifsNeedNegotiate) {
2806 2807 2808
		/* No need to send echo on newly established connections */
		queue_delayed_work(cifsiod_wq, &server->reconnect, 0);
		return rc;
2809 2810
	}

2811
	rc = smb2_plain_req_init(SMB2_ECHO, NULL, (void **)&req, &total_len);
2812 2813 2814
	if (rc)
		return rc;

2815
	req->sync_hdr.CreditRequest = cpu_to_le16(1);
2816

2817 2818
	iov[0].iov_len = total_len;
	iov[0].iov_base = (char *)req;
2819

P
Pavel Shilovsky 已提交
2820 2821
	rc = cifs_call_async(server, &rqst, NULL, smb2_echo_callback, NULL,
			     server, CIFS_ECHO_OP);
2822
	if (rc)
2823
		cifs_dbg(FYI, "Echo request failed: %d\n", rc);
2824 2825 2826 2827

	cifs_small_buf_release(req);
	return rc;
}
2828 2829 2830 2831 2832

int
SMB2_flush(const unsigned int xid, struct cifs_tcon *tcon, u64 persistent_fid,
	   u64 volatile_fid)
{
R
Ronnie Sahlberg 已提交
2833
	struct smb_rqst rqst;
2834 2835 2836
	struct smb2_flush_req *req;
	struct cifs_ses *ses = tcon->ses;
	struct kvec iov[1];
2837
	struct kvec rsp_iov;
2838 2839
	int resp_buftype;
	int rc = 0;
2840
	int flags = 0;
2841
	unsigned int total_len;
2842

2843
	cifs_dbg(FYI, "Flush\n");
2844

2845
	if (!ses || !(ses->server))
2846 2847
		return -EIO;

2848
	rc = smb2_plain_req_init(SMB2_FLUSH, tcon, (void **) &req, &total_len);
2849 2850 2851
	if (rc)
		return rc;

2852
	if (smb3_encryption_required(tcon))
2853 2854
		flags |= CIFS_TRANSFORM_REQ;

2855 2856 2857 2858
	req->PersistentFileId = persistent_fid;
	req->VolatileFileId = volatile_fid;

	iov[0].iov_base = (char *)req;
2859
	iov[0].iov_len = total_len;
2860

R
Ronnie Sahlberg 已提交
2861 2862 2863 2864 2865
	memset(&rqst, 0, sizeof(struct smb_rqst));
	rqst.rq_iov = iov;
	rqst.rq_nvec = 1;

	rc = cifs_send_recv(xid, ses, &rqst, &resp_buftype, flags, &rsp_iov);
2866
	cifs_small_buf_release(req);
2867

2868
	if (rc != 0) {
2869
		cifs_stats_fail_inc(tcon, SMB2_FLUSH_HE);
2870 2871 2872
		trace_smb3_flush_err(xid, persistent_fid, tcon->tid, ses->Suid,
				     rc);
	}
2873

2874
	free_rsp_buf(resp_buftype, rsp_iov.iov_base);
2875 2876
	return rc;
}
2877 2878 2879 2880 2881 2882

/*
 * To form a chain of read requests, any read requests after the first should
 * have the end_of_chain boolean set to true.
 */
static int
2883
smb2_new_read_req(void **buf, unsigned int *total_len,
2884 2885
	struct cifs_io_parms *io_parms, struct cifs_readdata *rdata,
	unsigned int remaining_bytes, int request_type)
2886 2887
{
	int rc = -EACCES;
2888
	struct smb2_read_plain_req *req = NULL;
2889
	struct smb2_sync_hdr *shdr;
2890
	struct TCP_Server_Info *server;
2891

2892 2893
	rc = smb2_plain_req_init(SMB2_READ, io_parms->tcon, (void **) &req,
				 total_len);
2894 2895
	if (rc)
		return rc;
2896 2897 2898

	server = io_parms->tcon->ses->server;
	if (server == NULL)
2899 2900
		return -ECONNABORTED;

2901
	shdr = &req->sync_hdr;
2902
	shdr->ProcessId = cpu_to_le32(io_parms->pid);
2903 2904 2905 2906 2907 2908 2909 2910 2911

	req->PersistentFileId = io_parms->persistent_fid;
	req->VolatileFileId = io_parms->volatile_fid;
	req->ReadChannelInfoOffset = 0; /* reserved */
	req->ReadChannelInfoLength = 0; /* reserved */
	req->Channel = 0; /* reserved */
	req->MinimumCount = 0;
	req->Length = cpu_to_le32(io_parms->length);
	req->Offset = cpu_to_le64(io_parms->offset);
2912 2913 2914 2915 2916
#ifdef CONFIG_CIFS_SMB_DIRECT
	/*
	 * If we want to do a RDMA write, fill in and append
	 * smbd_buffer_descriptor_v1 to the end of read request
	 */
2917
	if (server->rdma && rdata && !server->sign &&
2918 2919 2920 2921 2922 2923 2924 2925
		rdata->bytes >= server->smbd_conn->rdma_readwrite_threshold) {

		struct smbd_buffer_descriptor_v1 *v1;
		bool need_invalidate =
			io_parms->tcon->ses->server->dialect == SMB30_PROT_ID;

		rdata->mr = smbd_register_mr(
				server->smbd_conn, rdata->pages,
2926 2927
				rdata->nr_pages, rdata->page_offset,
				rdata->tailsz, true, need_invalidate);
2928 2929 2930 2931 2932 2933 2934
		if (!rdata->mr)
			return -ENOBUFS;

		req->Channel = SMB2_CHANNEL_RDMA_V1_INVALIDATE;
		if (need_invalidate)
			req->Channel = SMB2_CHANNEL_RDMA_V1;
		req->ReadChannelInfoOffset =
2935
			cpu_to_le16(offsetof(struct smb2_read_plain_req, Buffer));
2936
		req->ReadChannelInfoLength =
2937
			cpu_to_le16(sizeof(struct smbd_buffer_descriptor_v1));
2938
		v1 = (struct smbd_buffer_descriptor_v1 *) &req->Buffer[0];
2939 2940 2941
		v1->offset = cpu_to_le64(rdata->mr->mr->iova);
		v1->token = cpu_to_le32(rdata->mr->mr->rkey);
		v1->length = cpu_to_le32(rdata->mr->mr->length);
2942 2943 2944 2945

		*total_len += sizeof(*v1) - 1;
	}
#endif
2946 2947
	if (request_type & CHAINED_REQUEST) {
		if (!(request_type & END_OF_CHAIN)) {
2948 2949 2950
			/* next 8-byte aligned request */
			*total_len = DIV_ROUND_UP(*total_len, 8) * 8;
			shdr->NextCommand = cpu_to_le32(*total_len);
2951
		} else /* END_OF_CHAIN */
2952
			shdr->NextCommand = 0;
2953
		if (request_type & RELATED_REQUEST) {
2954
			shdr->Flags |= SMB2_FLAGS_RELATED_OPERATIONS;
2955 2956 2957 2958
			/*
			 * Related requests use info from previous read request
			 * in chain.
			 */
2959 2960
			shdr->SessionId = 0xFFFFFFFF;
			shdr->TreeId = 0xFFFFFFFF;
2961 2962 2963 2964 2965 2966 2967 2968 2969
			req->PersistentFileId = 0xFFFFFFFF;
			req->VolatileFileId = 0xFFFFFFFF;
		}
	}
	if (remaining_bytes > io_parms->length)
		req->RemainingBytes = cpu_to_le32(remaining_bytes);
	else
		req->RemainingBytes = 0;

2970
	*buf = req;
2971 2972 2973 2974 2975 2976 2977 2978 2979
	return rc;
}

static void
smb2_readv_callback(struct mid_q_entry *mid)
{
	struct cifs_readdata *rdata = mid->callback_data;
	struct cifs_tcon *tcon = tlink_tcon(rdata->cfile->tlink);
	struct TCP_Server_Info *server = tcon->ses->server;
2980
	struct smb2_sync_hdr *shdr =
2981
				(struct smb2_sync_hdr *)rdata->iov[0].iov_base;
2982
	unsigned int credits_received = 1;
2983 2984
	struct smb_rqst rqst = { .rq_iov = rdata->iov,
				 .rq_nvec = 2,
2985
				 .rq_pages = rdata->pages,
L
Long Li 已提交
2986
				 .rq_offset = rdata->page_offset,
2987 2988 2989
				 .rq_npages = rdata->nr_pages,
				 .rq_pagesz = rdata->pagesz,
				 .rq_tailsz = rdata->tailsz };
2990

2991 2992 2993
	cifs_dbg(FYI, "%s: mid=%llu state=%d result=%d bytes=%u\n",
		 __func__, mid->mid, mid->mid_state, rdata->result,
		 rdata->bytes);
2994 2995 2996

	switch (mid->mid_state) {
	case MID_RESPONSE_RECEIVED:
2997
		credits_received = le16_to_cpu(shdr->CreditRequest);
2998
		/* result already set, check signature */
2999
		if (server->sign && !mid->decrypted) {
P
Pavel Shilovsky 已提交
3000 3001
			int rc;

3002
			rc = smb2_verify_signature(&rqst, server);
P
Pavel Shilovsky 已提交
3003
			if (rc)
3004 3005
				cifs_dbg(VFS, "SMB signature verification returned error = %d\n",
					 rc);
P
Pavel Shilovsky 已提交
3006
		}
3007
		/* FIXME: should this be counted toward the initiating task? */
3008 3009
		task_io_account_read(rdata->got_bytes);
		cifs_stats_bytes_read(tcon, rdata->got_bytes);
3010 3011 3012 3013
		break;
	case MID_REQUEST_SUBMITTED:
	case MID_RETRY_NEEDED:
		rdata->result = -EAGAIN;
3014 3015 3016 3017 3018 3019
		if (server->sign && rdata->got_bytes)
			/* reset bytes number since we can not check a sign */
			rdata->got_bytes = 0;
		/* FIXME: should this be counted toward the initiating task? */
		task_io_account_read(rdata->got_bytes);
		cifs_stats_bytes_read(tcon, rdata->got_bytes);
3020 3021 3022 3023 3024
		break;
	default:
		if (rdata->result != -ENODATA)
			rdata->result = -EIO;
	}
3025 3026 3027 3028 3029 3030 3031 3032 3033 3034 3035
#ifdef CONFIG_CIFS_SMB_DIRECT
	/*
	 * If this rdata has a memmory registered, the MR can be freed
	 * MR needs to be freed as soon as I/O finishes to prevent deadlock
	 * because they have limited number and are used for future I/Os
	 */
	if (rdata->mr) {
		smbd_deregister_mr(rdata->mr);
		rdata->mr = NULL;
	}
#endif
3036 3037 3038 3039 3040 3041 3042 3043
	if (rdata->result)
		cifs_stats_fail_inc(tcon, SMB2_READ_HE);

	queue_work(cifsiod_wq, &rdata->work);
	DeleteMidQEntry(mid);
	add_credits(server, credits_received, 0);
}

3044
/* smb2_async_readv - send an async read, and set up mid to handle result */
3045 3046 3047
int
smb2_async_readv(struct cifs_readdata *rdata)
{
3048
	int rc, flags = 0;
3049 3050
	char *buf;
	struct smb2_sync_hdr *shdr;
3051
	struct cifs_io_parms io_parms;
3052
	struct smb_rqst rqst = { .rq_iov = rdata->iov,
3053
				 .rq_nvec = 1 };
3054
	struct TCP_Server_Info *server;
3055
	unsigned int total_len;
3056

3057 3058
	cifs_dbg(FYI, "%s: offset=%llu bytes=%u\n",
		 __func__, rdata->offset, rdata->bytes);
3059 3060 3061 3062 3063 3064 3065

	io_parms.tcon = tlink_tcon(rdata->cfile->tlink);
	io_parms.offset = rdata->offset;
	io_parms.length = rdata->bytes;
	io_parms.persistent_fid = rdata->cfile->fid.persistent_fid;
	io_parms.volatile_fid = rdata->cfile->fid.volatile_fid;
	io_parms.pid = rdata->pid;
3066 3067 3068

	server = io_parms.tcon->ses->server;

3069 3070
	rc = smb2_new_read_req(
		(void **) &buf, &total_len, &io_parms, rdata, 0, 0);
3071 3072 3073 3074 3075 3076 3077 3078 3079
	if (rc) {
		if (rc == -EAGAIN && rdata->credits) {
			/* credits was reset by reconnect */
			rdata->credits = 0;
			/* reduce in_flight value since we won't send the req */
			spin_lock(&server->req_lock);
			server->in_flight--;
			spin_unlock(&server->req_lock);
		}
3080
		return rc;
3081
	}
3082

3083
	if (smb3_encryption_required(io_parms.tcon))
3084 3085
		flags |= CIFS_TRANSFORM_REQ;

3086 3087
	rdata->iov[0].iov_base = buf;
	rdata->iov[0].iov_len = total_len;
3088 3089

	shdr = (struct smb2_sync_hdr *)buf;
3090

3091
	if (rdata->credits) {
3092
		shdr->CreditCharge = cpu_to_le16(DIV_ROUND_UP(rdata->bytes,
3093
						SMB2_MAX_BUFFER_SIZE));
3094
		shdr->CreditRequest = shdr->CreditCharge;
3095 3096
		spin_lock(&server->req_lock);
		server->credits += rdata->credits -
3097
						le16_to_cpu(shdr->CreditCharge);
3098 3099
		spin_unlock(&server->req_lock);
		wake_up(&server->request_q);
3100
		flags |= CIFS_HAS_CREDITS;
3101 3102
	}

3103
	kref_get(&rdata->refcount);
3104
	rc = cifs_call_async(io_parms.tcon->ses->server, &rqst,
3105
			     cifs_readv_receive, smb2_readv_callback,
3106
			     smb3_handle_read_data, rdata, flags);
3107
	if (rc) {
3108
		kref_put(&rdata->refcount, cifs_readdata_release);
3109
		cifs_stats_fail_inc(io_parms.tcon, SMB2_READ_HE);
3110 3111 3112 3113 3114 3115 3116
		trace_smb3_read_err(rc, 0 /* xid */, io_parms.persistent_fid,
				   io_parms.tcon->tid, io_parms.tcon->ses->Suid,
				   io_parms.offset, io_parms.length);
	} else
		trace_smb3_read_done(0 /* xid */, io_parms.persistent_fid,
				   io_parms.tcon->tid, io_parms.tcon->ses->Suid,
				   io_parms.offset, io_parms.length);
3117 3118 3119 3120

	cifs_small_buf_release(buf);
	return rc;
}
3121

3122 3123 3124 3125
int
SMB2_read(const unsigned int xid, struct cifs_io_parms *io_parms,
	  unsigned int *nbytes, char **buf, int *buf_type)
{
R
Ronnie Sahlberg 已提交
3126
	struct smb_rqst rqst;
3127
	int resp_buftype, rc = -EACCES;
3128
	struct smb2_read_plain_req *req = NULL;
3129
	struct smb2_read_rsp *rsp = NULL;
3130
	struct kvec iov[1];
3131
	struct kvec rsp_iov;
3132
	unsigned int total_len;
3133 3134
	int flags = CIFS_LOG_ERROR;
	struct cifs_ses *ses = io_parms->tcon->ses;
3135 3136

	*nbytes = 0;
3137
	rc = smb2_new_read_req((void **)&req, &total_len, io_parms, NULL, 0, 0);
3138 3139 3140
	if (rc)
		return rc;

3141
	if (smb3_encryption_required(io_parms->tcon))
3142 3143
		flags |= CIFS_TRANSFORM_REQ;

3144 3145
	iov[0].iov_base = (char *)req;
	iov[0].iov_len = total_len;
3146

R
Ronnie Sahlberg 已提交
3147 3148 3149 3150 3151
	memset(&rqst, 0, sizeof(struct smb_rqst));
	rqst.rq_iov = iov;
	rqst.rq_nvec = 1;

	rc = cifs_send_recv(xid, ses, &rqst, &resp_buftype, flags, &rsp_iov);
3152
	cifs_small_buf_release(req);
3153

3154
	rsp = (struct smb2_read_rsp *)rsp_iov.iov_base;
3155

3156 3157 3158 3159 3160
	if (rc) {
		if (rc != -ENODATA) {
			cifs_stats_fail_inc(io_parms->tcon, SMB2_READ_HE);
			cifs_dbg(VFS, "Send error in read = %d\n", rc);
		}
3161 3162 3163
		trace_smb3_read_err(rc, xid, req->PersistentFileId,
				    io_parms->tcon->tid, ses->Suid,
				    io_parms->offset, io_parms->length);
3164
		free_rsp_buf(resp_buftype, rsp_iov.iov_base);
3165
		return rc == -ENODATA ? 0 : rc;
3166 3167 3168 3169
	} else
		trace_smb3_read_done(xid, req->PersistentFileId,
				    io_parms->tcon->tid, ses->Suid,
				    io_parms->offset, io_parms->length);
3170

3171 3172 3173 3174 3175 3176 3177
	*nbytes = le32_to_cpu(rsp->DataLength);
	if ((*nbytes > CIFS_MAX_MSGSIZE) ||
	    (*nbytes > io_parms->length)) {
		cifs_dbg(FYI, "bad length %d for count %d\n",
			 *nbytes, io_parms->length);
		rc = -EIO;
		*nbytes = 0;
3178 3179 3180
	}

	if (*buf) {
3181
		memcpy(*buf, (char *)rsp + rsp->DataOffset, *nbytes);
3182
		free_rsp_buf(resp_buftype, rsp_iov.iov_base);
3183
	} else if (resp_buftype != CIFS_NO_BUFFER) {
3184
		*buf = rsp_iov.iov_base;
3185 3186 3187 3188 3189 3190 3191 3192
		if (resp_buftype == CIFS_SMALL_BUFFER)
			*buf_type = CIFS_SMALL_BUFFER;
		else if (resp_buftype == CIFS_LARGE_BUFFER)
			*buf_type = CIFS_LARGE_BUFFER;
	}
	return rc;
}

3193 3194 3195 3196 3197 3198 3199 3200 3201 3202 3203 3204 3205 3206 3207
/*
 * Check the mid_state and signature on received buffer (if any), and queue the
 * workqueue completion task.
 */
static void
smb2_writev_callback(struct mid_q_entry *mid)
{
	struct cifs_writedata *wdata = mid->callback_data;
	struct cifs_tcon *tcon = tlink_tcon(wdata->cfile->tlink);
	unsigned int written;
	struct smb2_write_rsp *rsp = (struct smb2_write_rsp *)mid->resp_buf;
	unsigned int credits_received = 1;

	switch (mid->mid_state) {
	case MID_RESPONSE_RECEIVED:
R
Ronnie Sahlberg 已提交
3208
		credits_received = le16_to_cpu(rsp->sync_hdr.CreditRequest);
3209 3210 3211 3212 3213 3214 3215 3216 3217 3218 3219 3220 3221 3222 3223 3224 3225 3226 3227 3228 3229 3230 3231 3232 3233 3234 3235
		wdata->result = smb2_check_receive(mid, tcon->ses->server, 0);
		if (wdata->result != 0)
			break;

		written = le32_to_cpu(rsp->DataLength);
		/*
		 * Mask off high 16 bits when bytes written as returned
		 * by the server is greater than bytes requested by the
		 * client. OS/2 servers are known to set incorrect
		 * CountHigh values.
		 */
		if (written > wdata->bytes)
			written &= 0xFFFF;

		if (written < wdata->bytes)
			wdata->result = -ENOSPC;
		else
			wdata->bytes = written;
		break;
	case MID_REQUEST_SUBMITTED:
	case MID_RETRY_NEEDED:
		wdata->result = -EAGAIN;
		break;
	default:
		wdata->result = -EIO;
		break;
	}
3236 3237 3238 3239 3240 3241 3242 3243 3244 3245 3246 3247 3248
#ifdef CONFIG_CIFS_SMB_DIRECT
	/*
	 * If this wdata has a memory registered, the MR can be freed
	 * The number of MRs available is limited, it's important to recover
	 * used MR as soon as I/O is finished. Hold MR longer in the later
	 * I/O process can possibly result in I/O deadlock due to lack of MR
	 * to send request on I/O retry
	 */
	if (wdata->mr) {
		smbd_deregister_mr(wdata->mr);
		wdata->mr = NULL;
	}
#endif
3249 3250 3251 3252 3253 3254 3255 3256 3257 3258
	if (wdata->result)
		cifs_stats_fail_inc(tcon, SMB2_WRITE_HE);

	queue_work(cifsiod_wq, &wdata->work);
	DeleteMidQEntry(mid);
	add_credits(tcon->ses->server, credits_received, 0);
}

/* smb2_async_writev - send an async write, and set up mid to handle result */
int
3259 3260
smb2_async_writev(struct cifs_writedata *wdata,
		  void (*release)(struct kref *kref))
3261
{
3262
	int rc = -EACCES, flags = 0;
3263
	struct smb2_write_req *req = NULL;
3264
	struct smb2_sync_hdr *shdr;
3265
	struct cifs_tcon *tcon = tlink_tcon(wdata->cfile->tlink);
3266
	struct TCP_Server_Info *server = tcon->ses->server;
3267
	struct kvec iov[1];
3268
	struct smb_rqst rqst = { };
3269
	unsigned int total_len;
3270

3271
	rc = smb2_plain_req_init(SMB2_WRITE, tcon, (void **) &req, &total_len);
3272 3273 3274 3275 3276 3277 3278 3279 3280
	if (rc) {
		if (rc == -EAGAIN && wdata->credits) {
			/* credits was reset by reconnect */
			wdata->credits = 0;
			/* reduce in_flight value since we won't send the req */
			spin_lock(&server->req_lock);
			server->in_flight--;
			spin_unlock(&server->req_lock);
		}
3281
		goto async_writev_out;
3282
	}
3283

3284
	if (smb3_encryption_required(tcon))
3285 3286
		flags |= CIFS_TRANSFORM_REQ;

3287
	shdr = (struct smb2_sync_hdr *)req;
3288
	shdr->ProcessId = cpu_to_le32(wdata->cfile->pid);
3289 3290 3291 3292 3293 3294 3295 3296

	req->PersistentFileId = wdata->cfile->fid.persistent_fid;
	req->VolatileFileId = wdata->cfile->fid.volatile_fid;
	req->WriteChannelInfoOffset = 0;
	req->WriteChannelInfoLength = 0;
	req->Channel = 0;
	req->Offset = cpu_to_le64(wdata->offset);
	req->DataOffset = cpu_to_le16(
3297
				offsetof(struct smb2_write_req, Buffer));
3298
	req->RemainingBytes = 0;
3299 3300 3301 3302 3303
#ifdef CONFIG_CIFS_SMB_DIRECT
	/*
	 * If we want to do a server RDMA read, fill in and append
	 * smbd_buffer_descriptor_v1 to the end of write request
	 */
3304
	if (server->rdma && !server->sign && wdata->bytes >=
3305 3306 3307 3308 3309 3310 3311
		server->smbd_conn->rdma_readwrite_threshold) {

		struct smbd_buffer_descriptor_v1 *v1;
		bool need_invalidate = server->dialect == SMB30_PROT_ID;

		wdata->mr = smbd_register_mr(
				server->smbd_conn, wdata->pages,
3312 3313
				wdata->nr_pages, wdata->page_offset,
				wdata->tailsz, false, need_invalidate);
3314 3315 3316 3317 3318 3319
		if (!wdata->mr) {
			rc = -ENOBUFS;
			goto async_writev_out;
		}
		req->Length = 0;
		req->DataOffset = 0;
3320 3321 3322 3323 3324 3325 3326 3327
		if (wdata->nr_pages > 1)
			req->RemainingBytes =
				cpu_to_le32(
					(wdata->nr_pages - 1) * wdata->pagesz -
					wdata->page_offset + wdata->tailsz
				);
		else
			req->RemainingBytes = cpu_to_le32(wdata->tailsz);
3328 3329 3330 3331
		req->Channel = SMB2_CHANNEL_RDMA_V1_INVALIDATE;
		if (need_invalidate)
			req->Channel = SMB2_CHANNEL_RDMA_V1;
		req->WriteChannelInfoOffset =
3332
			cpu_to_le16(offsetof(struct smb2_write_req, Buffer));
3333
		req->WriteChannelInfoLength =
3334
			cpu_to_le16(sizeof(struct smbd_buffer_descriptor_v1));
3335
		v1 = (struct smbd_buffer_descriptor_v1 *) &req->Buffer[0];
3336 3337 3338
		v1->offset = cpu_to_le64(wdata->mr->mr->iova);
		v1->token = cpu_to_le32(wdata->mr->mr->rkey);
		v1->length = cpu_to_le32(wdata->mr->mr->length);
3339 3340
	}
#endif
3341 3342
	iov[0].iov_len = total_len - 1;
	iov[0].iov_base = (char *)req;
3343

3344
	rqst.rq_iov = iov;
3345
	rqst.rq_nvec = 1;
3346
	rqst.rq_pages = wdata->pages;
3347
	rqst.rq_offset = wdata->page_offset;
3348 3349 3350
	rqst.rq_npages = wdata->nr_pages;
	rqst.rq_pagesz = wdata->pagesz;
	rqst.rq_tailsz = wdata->tailsz;
3351 3352
#ifdef CONFIG_CIFS_SMB_DIRECT
	if (wdata->mr) {
3353
		iov[0].iov_len += sizeof(struct smbd_buffer_descriptor_v1);
3354 3355 3356
		rqst.rq_npages = 0;
	}
#endif
3357 3358
	cifs_dbg(FYI, "async write at %llu %u bytes\n",
		 wdata->offset, wdata->bytes);
3359

3360 3361 3362 3363 3364
#ifdef CONFIG_CIFS_SMB_DIRECT
	/* For RDMA read, I/O size is in RemainingBytes not in Length */
	if (!wdata->mr)
		req->Length = cpu_to_le32(wdata->bytes);
#else
3365
	req->Length = cpu_to_le32(wdata->bytes);
3366
#endif
3367

3368
	if (wdata->credits) {
3369
		shdr->CreditCharge = cpu_to_le16(DIV_ROUND_UP(wdata->bytes,
3370
						    SMB2_MAX_BUFFER_SIZE));
3371
		shdr->CreditRequest = shdr->CreditCharge;
3372 3373
		spin_lock(&server->req_lock);
		server->credits += wdata->credits -
3374
						le16_to_cpu(shdr->CreditCharge);
3375 3376
		spin_unlock(&server->req_lock);
		wake_up(&server->request_q);
3377
		flags |= CIFS_HAS_CREDITS;
3378 3379
	}

3380
	kref_get(&wdata->refcount);
P
Pavel Shilovsky 已提交
3381 3382
	rc = cifs_call_async(server, &rqst, NULL, smb2_writev_callback, NULL,
			     wdata, flags);
3383

3384
	if (rc) {
3385 3386 3387
		trace_smb3_write_err(0 /* no xid */, req->PersistentFileId,
				     tcon->tid, tcon->ses->Suid, wdata->offset,
				     wdata->bytes, rc);
3388
		kref_put(&wdata->refcount, release);
3389
		cifs_stats_fail_inc(tcon, SMB2_WRITE_HE);
3390 3391 3392 3393
	} else
		trace_smb3_write_done(0 /* no xid */, req->PersistentFileId,
				     tcon->tid, tcon->ses->Suid, wdata->offset,
				     wdata->bytes);
3394 3395 3396 3397 3398

async_writev_out:
	cifs_small_buf_release(req);
	return rc;
}
3399 3400 3401 3402 3403 3404 3405 3406 3407 3408 3409

/*
 * SMB2_write function gets iov pointer to kvec array with n_vec as a length.
 * The length field from io_parms must be at least 1 and indicates a number of
 * elements with data to write that begins with position 1 in iov array. All
 * data length is specified by count.
 */
int
SMB2_write(const unsigned int xid, struct cifs_io_parms *io_parms,
	   unsigned int *nbytes, struct kvec *iov, int n_vec)
{
R
Ronnie Sahlberg 已提交
3410
	struct smb_rqst rqst;
3411 3412 3413 3414
	int rc = 0;
	struct smb2_write_req *req = NULL;
	struct smb2_write_rsp *rsp = NULL;
	int resp_buftype;
3415
	struct kvec rsp_iov;
3416
	int flags = 0;
3417
	unsigned int total_len;
3418

3419 3420 3421 3422 3423
	*nbytes = 0;

	if (n_vec < 1)
		return rc;

3424 3425
	rc = smb2_plain_req_init(SMB2_WRITE, io_parms->tcon, (void **) &req,
			     &total_len);
3426 3427 3428 3429 3430 3431
	if (rc)
		return rc;

	if (io_parms->tcon->ses->server == NULL)
		return -ECONNABORTED;

3432
	if (smb3_encryption_required(io_parms->tcon))
3433 3434
		flags |= CIFS_TRANSFORM_REQ;

3435
	req->sync_hdr.ProcessId = cpu_to_le32(io_parms->pid);
3436 3437 3438 3439 3440 3441 3442 3443 3444

	req->PersistentFileId = io_parms->persistent_fid;
	req->VolatileFileId = io_parms->volatile_fid;
	req->WriteChannelInfoOffset = 0;
	req->WriteChannelInfoLength = 0;
	req->Channel = 0;
	req->Length = cpu_to_le32(io_parms->length);
	req->Offset = cpu_to_le64(io_parms->offset);
	req->DataOffset = cpu_to_le16(
3445
				offsetof(struct smb2_write_req, Buffer));
3446 3447 3448
	req->RemainingBytes = 0;

	iov[0].iov_base = (char *)req;
3449 3450
	/* 1 for Buffer */
	iov[0].iov_len = total_len - 1;
3451

R
Ronnie Sahlberg 已提交
3452 3453 3454 3455 3456
	memset(&rqst, 0, sizeof(struct smb_rqst));
	rqst.rq_iov = iov;
	rqst.rq_nvec = n_vec + 1;

	rc = cifs_send_recv(xid, io_parms->tcon->ses, &rqst,
3457
			    &resp_buftype, flags, &rsp_iov);
3458 3459
	cifs_small_buf_release(req);
	rsp = (struct smb2_write_rsp *)rsp_iov.iov_base;
3460 3461

	if (rc) {
3462 3463 3464 3465
		trace_smb3_write_err(xid, req->PersistentFileId,
				     io_parms->tcon->tid,
				     io_parms->tcon->ses->Suid,
				     io_parms->offset, io_parms->length, rc);
3466
		cifs_stats_fail_inc(io_parms->tcon, SMB2_WRITE_HE);
3467
		cifs_dbg(VFS, "Send error in write = %d\n", rc);
3468
	} else {
3469
		*nbytes = le32_to_cpu(rsp->DataLength);
3470 3471 3472 3473 3474
		trace_smb3_write_done(xid, req->PersistentFileId,
				     io_parms->tcon->tid,
				     io_parms->tcon->ses->Suid,
				     io_parms->offset, *nbytes);
	}
3475 3476

	free_rsp_buf(resp_buftype, rsp);
3477 3478
	return rc;
}
3479

3480 3481 3482 3483 3484 3485 3486 3487 3488 3489 3490 3491 3492 3493 3494 3495 3496 3497
static unsigned int
num_entries(char *bufstart, char *end_of_buf, char **lastentry, size_t size)
{
	int len;
	unsigned int entrycount = 0;
	unsigned int next_offset = 0;
	FILE_DIRECTORY_INFO *entryptr;

	if (bufstart == NULL)
		return 0;

	entryptr = (FILE_DIRECTORY_INFO *)bufstart;

	while (1) {
		entryptr = (FILE_DIRECTORY_INFO *)
					((char *)entryptr + next_offset);

		if ((char *)entryptr + size > end_of_buf) {
3498
			cifs_dbg(VFS, "malformed search entry would overflow\n");
3499 3500 3501 3502 3503
			break;
		}

		len = le32_to_cpu(entryptr->FileNameLength);
		if ((char *)entryptr + len + size > end_of_buf) {
3504 3505
			cifs_dbg(VFS, "directory entry name would overflow frame end of buf %p\n",
				 end_of_buf);
3506 3507 3508 3509 3510 3511 3512 3513 3514 3515 3516 3517 3518 3519 3520 3521 3522 3523 3524 3525 3526 3527
			break;
		}

		*lastentry = (char *)entryptr;
		entrycount++;

		next_offset = le32_to_cpu(entryptr->NextEntryOffset);
		if (!next_offset)
			break;
	}

	return entrycount;
}

/*
 * Readdir/FindFirst
 */
int
SMB2_query_directory(const unsigned int xid, struct cifs_tcon *tcon,
		     u64 persistent_fid, u64 volatile_fid, int index,
		     struct cifs_search_info *srch_inf)
{
R
Ronnie Sahlberg 已提交
3528
	struct smb_rqst rqst;
3529 3530 3531
	struct smb2_query_directory_req *req;
	struct smb2_query_directory_rsp *rsp = NULL;
	struct kvec iov[2];
3532
	struct kvec rsp_iov;
3533 3534
	int rc = 0;
	int len;
3535
	int resp_buftype = CIFS_NO_BUFFER;
3536 3537 3538 3539 3540 3541 3542
	unsigned char *bufptr;
	struct TCP_Server_Info *server;
	struct cifs_ses *ses = tcon->ses;
	__le16 asteriks = cpu_to_le16('*');
	char *end_of_smb;
	unsigned int output_size = CIFSMaxBufSize;
	size_t info_buf_size;
3543
	int flags = 0;
3544
	unsigned int total_len;
3545 3546 3547 3548 3549 3550

	if (ses && (ses->server))
		server = ses->server;
	else
		return -EIO;

3551 3552
	rc = smb2_plain_req_init(SMB2_QUERY_DIRECTORY, tcon, (void **) &req,
			     &total_len);
3553 3554 3555
	if (rc)
		return rc;

3556
	if (smb3_encryption_required(tcon))
3557 3558
		flags |= CIFS_TRANSFORM_REQ;

3559 3560 3561 3562 3563 3564 3565 3566 3567 3568
	switch (srch_inf->info_level) {
	case SMB_FIND_FILE_DIRECTORY_INFO:
		req->FileInformationClass = FILE_DIRECTORY_INFORMATION;
		info_buf_size = sizeof(FILE_DIRECTORY_INFO) - 1;
		break;
	case SMB_FIND_FILE_ID_FULL_DIR_INFO:
		req->FileInformationClass = FILEID_FULL_DIRECTORY_INFORMATION;
		info_buf_size = sizeof(SEARCH_ID_FULL_DIR_INFO) - 1;
		break;
	default:
3569 3570
		cifs_dbg(VFS, "info level %u isn't supported\n",
			 srch_inf->info_level);
3571 3572 3573 3574 3575 3576 3577 3578 3579 3580 3581 3582 3583
		rc = -EINVAL;
		goto qdir_exit;
	}

	req->FileIndex = cpu_to_le32(index);
	req->PersistentFileId = persistent_fid;
	req->VolatileFileId = volatile_fid;

	len = 0x2;
	bufptr = req->Buffer;
	memcpy(bufptr, &asteriks, len);

	req->FileNameOffset =
3584
		cpu_to_le16(sizeof(struct smb2_query_directory_req) - 1);
3585 3586 3587 3588 3589 3590 3591 3592 3593 3594
	req->FileNameLength = cpu_to_le16(len);
	/*
	 * BB could be 30 bytes or so longer if we used SMB2 specific
	 * buffer lengths, but this is safe and close enough.
	 */
	output_size = min_t(unsigned int, output_size, server->maxBuf);
	output_size = min_t(unsigned int, output_size, 2 << 15);
	req->OutputBufferLength = cpu_to_le32(output_size);

	iov[0].iov_base = (char *)req;
3595 3596
	/* 1 for Buffer */
	iov[0].iov_len = total_len - 1;
3597 3598 3599 3600

	iov[1].iov_base = (char *)(req->Buffer);
	iov[1].iov_len = len;

R
Ronnie Sahlberg 已提交
3601 3602 3603 3604 3605
	memset(&rqst, 0, sizeof(struct smb_rqst));
	rqst.rq_iov = iov;
	rqst.rq_nvec = 2;

	rc = cifs_send_recv(xid, ses, &rqst, &resp_buftype, flags, &rsp_iov);
3606 3607
	cifs_small_buf_release(req);
	rsp = (struct smb2_query_directory_rsp *)rsp_iov.iov_base;
3608

3609
	if (rc) {
3610
		if (rc == -ENODATA &&
R
Ronnie Sahlberg 已提交
3611
		    rsp->sync_hdr.Status == STATUS_NO_MORE_FILES) {
3612 3613 3614
			srch_inf->endOfSearch = true;
			rc = 0;
		}
3615 3616 3617 3618
		cifs_stats_fail_inc(tcon, SMB2_QUERY_DIRECTORY_HE);
		goto qdir_exit;
	}

3619
	rc = validate_iov(le16_to_cpu(rsp->OutputBufferOffset),
3620
			  le32_to_cpu(rsp->OutputBufferLength), &rsp_iov,
3621 3622 3623 3624 3625 3626 3627 3628 3629 3630 3631 3632 3633
			  info_buf_size);
	if (rc)
		goto qdir_exit;

	srch_inf->unicode = true;

	if (srch_inf->ntwrk_buf_start) {
		if (srch_inf->smallBuf)
			cifs_small_buf_release(srch_inf->ntwrk_buf_start);
		else
			cifs_buf_release(srch_inf->ntwrk_buf_start);
	}
	srch_inf->ntwrk_buf_start = (char *)rsp;
3634 3635 3636
	srch_inf->srch_entries_start = srch_inf->last_entry =
		(char *)rsp + le16_to_cpu(rsp->OutputBufferOffset);
	end_of_smb = rsp_iov.iov_len + (char *)rsp;
3637 3638 3639 3640
	srch_inf->entries_in_buffer =
			num_entries(srch_inf->srch_entries_start, end_of_smb,
				    &srch_inf->last_entry, info_buf_size);
	srch_inf->index_of_last_entry += srch_inf->entries_in_buffer;
3641 3642 3643
	cifs_dbg(FYI, "num entries %d last_index %lld srch start %p srch end %p\n",
		 srch_inf->entries_in_buffer, srch_inf->index_of_last_entry,
		 srch_inf->srch_entries_start, srch_inf->last_entry);
3644 3645 3646 3647 3648
	if (resp_buftype == CIFS_LARGE_BUFFER)
		srch_inf->smallBuf = false;
	else if (resp_buftype == CIFS_SMALL_BUFFER)
		srch_inf->smallBuf = true;
	else
3649
		cifs_dbg(VFS, "illegal search buffer type\n");
3650 3651 3652 3653 3654 3655 3656 3657

	return rc;

qdir_exit:
	free_rsp_buf(resp_buftype, rsp);
	return rc;
}

3658 3659
static int
send_set_info(const unsigned int xid, struct cifs_tcon *tcon,
3660 3661 3662
	       u64 persistent_fid, u64 volatile_fid, u32 pid, u8 info_class,
	       u8 info_type, u32 additional_info, unsigned int num,
		void **data, unsigned int *size)
3663
{
R
Ronnie Sahlberg 已提交
3664
	struct smb_rqst rqst;
3665 3666 3667
	struct smb2_set_info_req *req;
	struct smb2_set_info_rsp *rsp = NULL;
	struct kvec *iov;
3668
	struct kvec rsp_iov;
3669 3670 3671 3672
	int rc = 0;
	int resp_buftype;
	unsigned int i;
	struct cifs_ses *ses = tcon->ses;
3673
	int flags = 0;
3674
	unsigned int total_len;
3675

3676
	if (!ses || !(ses->server))
3677 3678 3679 3680 3681
		return -EIO;

	if (!num)
		return -EINVAL;

3682
	iov = kmalloc_array(num, sizeof(struct kvec), GFP_KERNEL);
3683 3684 3685
	if (!iov)
		return -ENOMEM;

3686
	rc = smb2_plain_req_init(SMB2_SET_INFO, tcon, (void **) &req, &total_len);
3687 3688 3689 3690 3691
	if (rc) {
		kfree(iov);
		return rc;
	}

3692
	if (smb3_encryption_required(tcon))
3693 3694
		flags |= CIFS_TRANSFORM_REQ;

3695
	req->sync_hdr.ProcessId = cpu_to_le32(pid);
3696

3697
	req->InfoType = info_type;
3698 3699 3700
	req->FileInfoClass = info_class;
	req->PersistentFileId = persistent_fid;
	req->VolatileFileId = volatile_fid;
3701
	req->AdditionalInformation = cpu_to_le32(additional_info);
3702 3703

	req->BufferOffset =
3704
			cpu_to_le16(sizeof(struct smb2_set_info_req) - 1);
3705 3706 3707
	req->BufferLength = cpu_to_le32(*size);

	memcpy(req->Buffer, *data, *size);
3708
	total_len += *size;
3709 3710

	iov[0].iov_base = (char *)req;
3711 3712
	/* 1 for Buffer */
	iov[0].iov_len = total_len - 1;
3713 3714 3715 3716 3717 3718 3719

	for (i = 1; i < num; i++) {
		le32_add_cpu(&req->BufferLength, size[i]);
		iov[i].iov_base = (char *)data[i];
		iov[i].iov_len = size[i];
	}

R
Ronnie Sahlberg 已提交
3720 3721 3722 3723 3724
	memset(&rqst, 0, sizeof(struct smb_rqst));
	rqst.rq_iov = iov;
	rqst.rq_nvec = num;

	rc = cifs_send_recv(xid, ses, &rqst, &resp_buftype, flags,
3725
			    &rsp_iov);
3726
	cifs_buf_release(req);
3727
	rsp = (struct smb2_set_info_rsp *)rsp_iov.iov_base;
3728

3729
	if (rc != 0) {
3730
		cifs_stats_fail_inc(tcon, SMB2_SET_INFO_HE);
3731 3732 3733
		trace_smb3_set_info_err(xid, persistent_fid, tcon->tid,
				ses->Suid, info_class, (__u32)info_type, rc);
	}
3734

3735 3736 3737 3738 3739 3740 3741 3742 3743 3744 3745 3746 3747 3748 3749
	free_rsp_buf(resp_buftype, rsp);
	kfree(iov);
	return rc;
}

int
SMB2_rename(const unsigned int xid, struct cifs_tcon *tcon,
	    u64 persistent_fid, u64 volatile_fid, __le16 *target_file)
{
	struct smb2_file_rename_info info;
	void **data;
	unsigned int size[2];
	int rc;
	int len = (2 * UniStrnlen((wchar_t *)target_file, PATH_MAX));

3750
	data = kmalloc_array(2, sizeof(void *), GFP_KERNEL);
3751 3752 3753 3754 3755 3756 3757 3758 3759 3760 3761 3762 3763 3764 3765
	if (!data)
		return -ENOMEM;

	info.ReplaceIfExists = 1; /* 1 = replace existing target with new */
			      /* 0 = fail if target already exists */
	info.RootDirectory = 0;  /* MBZ for network ops (why does spec say?) */
	info.FileNameLength = cpu_to_le32(len);

	data[0] = &info;
	size[0] = sizeof(struct smb2_file_rename_info);

	data[1] = target_file;
	size[1] = len + 2 /* null */;

	rc = send_set_info(xid, tcon, persistent_fid, volatile_fid,
3766 3767
		current->tgid, FILE_RENAME_INFORMATION, SMB2_O_INFO_FILE,
		0, 2, data, size);
3768 3769 3770
	kfree(data);
	return rc;
}
3771

3772 3773 3774 3775 3776 3777 3778 3779 3780 3781 3782 3783
int
SMB2_rmdir(const unsigned int xid, struct cifs_tcon *tcon,
		  u64 persistent_fid, u64 volatile_fid)
{
	__u8 delete_pending = 1;
	void *data;
	unsigned int size;

	data = &delete_pending;
	size = 1; /* sizeof __u8 */

	return send_set_info(xid, tcon, persistent_fid, volatile_fid,
3784 3785
		current->tgid, FILE_DISPOSITION_INFORMATION, SMB2_O_INFO_FILE,
		0, 1, &data, &size);
3786 3787
}

3788 3789 3790 3791 3792 3793 3794 3795 3796 3797
int
SMB2_set_hardlink(const unsigned int xid, struct cifs_tcon *tcon,
		  u64 persistent_fid, u64 volatile_fid, __le16 *target_file)
{
	struct smb2_file_link_info info;
	void **data;
	unsigned int size[2];
	int rc;
	int len = (2 * UniStrnlen((wchar_t *)target_file, PATH_MAX));

3798
	data = kmalloc_array(2, sizeof(void *), GFP_KERNEL);
3799 3800 3801 3802 3803 3804 3805 3806 3807 3808 3809 3810 3811 3812 3813
	if (!data)
		return -ENOMEM;

	info.ReplaceIfExists = 0; /* 1 = replace existing link with new */
			      /* 0 = fail if link already exists */
	info.RootDirectory = 0;  /* MBZ for network ops (why does spec say?) */
	info.FileNameLength = cpu_to_le32(len);

	data[0] = &info;
	size[0] = sizeof(struct smb2_file_link_info);

	data[1] = target_file;
	size[1] = len + 2 /* null */;

	rc = send_set_info(xid, tcon, persistent_fid, volatile_fid,
3814 3815
			current->tgid, FILE_LINK_INFORMATION, SMB2_O_INFO_FILE,
			0, 2, data, size);
3816 3817 3818
	kfree(data);
	return rc;
}
3819 3820 3821

int
SMB2_set_eof(const unsigned int xid, struct cifs_tcon *tcon, u64 persistent_fid,
3822
	     u64 volatile_fid, u32 pid, __le64 *eof, bool is_falloc)
3823 3824 3825 3826 3827 3828 3829 3830 3831 3832
{
	struct smb2_file_eof_info info;
	void *data;
	unsigned int size;

	info.EndOfFile = *eof;

	data = &info;
	size = sizeof(struct smb2_file_eof_info);

3833 3834
	if (is_falloc)
		return send_set_info(xid, tcon, persistent_fid, volatile_fid,
3835 3836
			pid, FILE_ALLOCATION_INFORMATION, SMB2_O_INFO_FILE,
			0, 1, &data, &size);
3837 3838
	else
		return send_set_info(xid, tcon, persistent_fid, volatile_fid,
3839 3840
			pid, FILE_END_OF_FILE_INFORMATION, SMB2_O_INFO_FILE,
			0, 1, &data, &size);
3841
}
3842 3843 3844 3845 3846 3847 3848 3849

int
SMB2_set_info(const unsigned int xid, struct cifs_tcon *tcon,
	      u64 persistent_fid, u64 volatile_fid, FILE_BASIC_INFO *buf)
{
	unsigned int size;
	size = sizeof(FILE_BASIC_INFO);
	return send_set_info(xid, tcon, persistent_fid, volatile_fid,
3850 3851 3852 3853 3854 3855 3856 3857 3858 3859 3860 3861
		current->tgid, FILE_BASIC_INFORMATION, SMB2_O_INFO_FILE,
		0, 1, (void **)&buf, &size);
}

int
SMB2_set_acl(const unsigned int xid, struct cifs_tcon *tcon,
		u64 persistent_fid, u64 volatile_fid,
		struct cifs_ntsd *pnntsd, int pacllen, int aclflag)
{
	return send_set_info(xid, tcon, persistent_fid, volatile_fid,
			current->tgid, 0, SMB2_O_INFO_SECURITY, aclflag,
			1, (void **)&pnntsd, &pacllen);
3862
}
3863

3864 3865 3866 3867 3868 3869 3870 3871 3872 3873
int
SMB2_set_ea(const unsigned int xid, struct cifs_tcon *tcon,
	    u64 persistent_fid, u64 volatile_fid,
	    struct smb2_file_full_ea_info *buf, int len)
{
	return send_set_info(xid, tcon, persistent_fid, volatile_fid,
		current->tgid, FILE_FULL_EA_INFORMATION, SMB2_O_INFO_FILE,
		0, 1, (void **)&buf, &len);
}

3874 3875 3876 3877 3878
int
SMB2_oplock_break(const unsigned int xid, struct cifs_tcon *tcon,
		  const u64 persistent_fid, const u64 volatile_fid,
		  __u8 oplock_level)
{
R
Ronnie Sahlberg 已提交
3879
	struct smb_rqst rqst;
3880
	int rc;
3881
	struct smb2_oplock_break *req = NULL;
3882
	struct cifs_ses *ses = tcon->ses;
3883
	int flags = CIFS_OBREAK_OP;
3884 3885 3886 3887
	unsigned int total_len;
	struct kvec iov[1];
	struct kvec rsp_iov;
	int resp_buf_type;
3888

3889
	cifs_dbg(FYI, "SMB2_oplock_break\n");
3890 3891
	rc = smb2_plain_req_init(SMB2_OPLOCK_BREAK, tcon, (void **) &req,
			     &total_len);
3892 3893 3894
	if (rc)
		return rc;

3895
	if (smb3_encryption_required(tcon))
3896 3897
		flags |= CIFS_TRANSFORM_REQ;

3898 3899 3900
	req->VolatileFid = volatile_fid;
	req->PersistentFid = persistent_fid;
	req->OplockLevel = oplock_level;
3901
	req->sync_hdr.CreditRequest = cpu_to_le16(1);
3902

3903 3904 3905 3906 3907
	flags |= CIFS_NO_RESP;

	iov[0].iov_base = (char *)req;
	iov[0].iov_len = total_len;

R
Ronnie Sahlberg 已提交
3908 3909 3910 3911 3912
	memset(&rqst, 0, sizeof(struct smb_rqst));
	rqst.rq_iov = iov;
	rqst.rq_nvec = 1;

	rc = cifs_send_recv(xid, ses, &rqst, &resp_buf_type, flags, &rsp_iov);
3913
	cifs_small_buf_release(req);
3914 3915 3916

	if (rc) {
		cifs_stats_fail_inc(tcon, SMB2_OPLOCK_BREAK_HE);
3917
		cifs_dbg(FYI, "Send error in Oplock Break = %d\n", rc);
3918 3919 3920 3921
	}

	return rc;
}
3922 3923 3924 3925 3926 3927 3928 3929

static void
copy_fs_info_to_kstatfs(struct smb2_fs_full_size_info *pfs_inf,
			struct kstatfs *kst)
{
	kst->f_bsize = le32_to_cpu(pfs_inf->BytesPerSector) *
			  le32_to_cpu(pfs_inf->SectorsPerAllocationUnit);
	kst->f_blocks = le64_to_cpu(pfs_inf->TotalAllocationUnits);
3930 3931
	kst->f_bfree  = kst->f_bavail =
			le64_to_cpu(pfs_inf->CallerAvailableAllocationUnits);
3932 3933 3934 3935 3936 3937 3938
	return;
}

static int
build_qfs_info_req(struct kvec *iov, struct cifs_tcon *tcon, int level,
		   int outbuf_len, u64 persistent_fid, u64 volatile_fid)
{
3939
	struct TCP_Server_Info *server;
3940 3941
	int rc;
	struct smb2_query_info_req *req;
3942
	unsigned int total_len;
3943

3944
	cifs_dbg(FYI, "Query FSInfo level %d\n", level);
3945 3946 3947 3948

	if ((tcon->ses == NULL) || (tcon->ses->server == NULL))
		return -EIO;

3949 3950
	server = tcon->ses->server;

3951 3952
	rc = smb2_plain_req_init(SMB2_QUERY_INFO, tcon, (void **) &req,
			     &total_len);
3953 3954 3955 3956 3957 3958 3959
	if (rc)
		return rc;

	req->InfoType = SMB2_O_INFO_FILESYSTEM;
	req->FileInfoClass = level;
	req->PersistentFileId = persistent_fid;
	req->VolatileFileId = volatile_fid;
3960
	/* 1 for pad */
3961
	req->InputBufferOffset =
3962
			cpu_to_le16(sizeof(struct smb2_query_info_req) - 1);
3963
	req->OutputBufferLength = cpu_to_le32(
3964
		outbuf_len + sizeof(struct smb2_query_info_rsp) - 1);
3965 3966

	iov->iov_base = (char *)req;
3967
	iov->iov_len = total_len;
3968 3969 3970 3971 3972 3973 3974
	return 0;
}

int
SMB2_QFS_info(const unsigned int xid, struct cifs_tcon *tcon,
	      u64 persistent_fid, u64 volatile_fid, struct kstatfs *fsdata)
{
R
Ronnie Sahlberg 已提交
3975
	struct smb_rqst rqst;
3976 3977
	struct smb2_query_info_rsp *rsp = NULL;
	struct kvec iov;
3978
	struct kvec rsp_iov;
3979 3980 3981 3982
	int rc = 0;
	int resp_buftype;
	struct cifs_ses *ses = tcon->ses;
	struct smb2_fs_full_size_info *info = NULL;
3983
	int flags = 0;
3984 3985 3986 3987 3988 3989 3990

	rc = build_qfs_info_req(&iov, tcon, FS_FULL_SIZE_INFORMATION,
				sizeof(struct smb2_fs_full_size_info),
				persistent_fid, volatile_fid);
	if (rc)
		return rc;

3991
	if (smb3_encryption_required(tcon))
3992 3993
		flags |= CIFS_TRANSFORM_REQ;

R
Ronnie Sahlberg 已提交
3994 3995 3996 3997 3998
	memset(&rqst, 0, sizeof(struct smb_rqst));
	rqst.rq_iov = &iov;
	rqst.rq_nvec = 1;

	rc = cifs_send_recv(xid, ses, &rqst, &resp_buftype, flags, &rsp_iov);
3999
	cifs_small_buf_release(iov.iov_base);
4000 4001
	if (rc) {
		cifs_stats_fail_inc(tcon, SMB2_QUERY_INFO_HE);
4002
		goto qfsinf_exit;
4003
	}
4004
	rsp = (struct smb2_query_info_rsp *)rsp_iov.iov_base;
4005

4006
	info = (struct smb2_fs_full_size_info *)(
R
Ronnie Sahlberg 已提交
4007
		le16_to_cpu(rsp->OutputBufferOffset) + (char *)rsp);
4008
	rc = validate_iov(le16_to_cpu(rsp->OutputBufferOffset),
4009
			  le32_to_cpu(rsp->OutputBufferLength), &rsp_iov,
4010 4011 4012 4013
			  sizeof(struct smb2_fs_full_size_info));
	if (!rc)
		copy_fs_info_to_kstatfs(info, fsdata);

4014
qfsinf_exit:
4015
	free_rsp_buf(resp_buftype, rsp_iov.iov_base);
4016 4017 4018 4019 4020
	return rc;
}

int
SMB2_QFS_attr(const unsigned int xid, struct cifs_tcon *tcon,
4021
	      u64 persistent_fid, u64 volatile_fid, int level)
4022
{
R
Ronnie Sahlberg 已提交
4023
	struct smb_rqst rqst;
4024 4025
	struct smb2_query_info_rsp *rsp = NULL;
	struct kvec iov;
4026
	struct kvec rsp_iov;
4027
	int rc = 0;
4028
	int resp_buftype, max_len, min_len;
4029 4030
	struct cifs_ses *ses = tcon->ses;
	unsigned int rsp_len, offset;
4031
	int flags = 0;
4032

4033 4034 4035 4036 4037 4038
	if (level == FS_DEVICE_INFORMATION) {
		max_len = sizeof(FILE_SYSTEM_DEVICE_INFO);
		min_len = sizeof(FILE_SYSTEM_DEVICE_INFO);
	} else if (level == FS_ATTRIBUTE_INFORMATION) {
		max_len = sizeof(FILE_SYSTEM_ATTRIBUTE_INFO);
		min_len = MIN_FS_ATTR_INFO_SIZE;
S
Steven French 已提交
4039 4040 4041
	} else if (level == FS_SECTOR_SIZE_INFORMATION) {
		max_len = sizeof(struct smb3_fs_ss_info);
		min_len = sizeof(struct smb3_fs_ss_info);
4042
	} else {
S
Steven French 已提交
4043
		cifs_dbg(FYI, "Invalid qfsinfo level %d\n", level);
4044 4045 4046 4047
		return -EINVAL;
	}

	rc = build_qfs_info_req(&iov, tcon, level, max_len,
4048 4049 4050 4051
				persistent_fid, volatile_fid);
	if (rc)
		return rc;

4052
	if (smb3_encryption_required(tcon))
4053 4054
		flags |= CIFS_TRANSFORM_REQ;

R
Ronnie Sahlberg 已提交
4055 4056 4057 4058 4059
	memset(&rqst, 0, sizeof(struct smb_rqst));
	rqst.rq_iov = &iov;
	rqst.rq_nvec = 1;

	rc = cifs_send_recv(xid, ses, &rqst, &resp_buftype, flags, &rsp_iov);
4060
	cifs_small_buf_release(iov.iov_base);
4061 4062 4063 4064
	if (rc) {
		cifs_stats_fail_inc(tcon, SMB2_QUERY_INFO_HE);
		goto qfsattr_exit;
	}
4065
	rsp = (struct smb2_query_info_rsp *)rsp_iov.iov_base;
4066 4067 4068

	rsp_len = le32_to_cpu(rsp->OutputBufferLength);
	offset = le16_to_cpu(rsp->OutputBufferOffset);
4069
	rc = validate_iov(offset, rsp_len, &rsp_iov, min_len);
4070 4071 4072 4073
	if (rc)
		goto qfsattr_exit;

	if (level == FS_ATTRIBUTE_INFORMATION)
4074
		memcpy(&tcon->fsAttrInfo, offset
R
Ronnie Sahlberg 已提交
4075
			+ (char *)rsp, min_t(unsigned int,
4076 4077
			rsp_len, max_len));
	else if (level == FS_DEVICE_INFORMATION)
4078
		memcpy(&tcon->fsDevInfo, offset
R
Ronnie Sahlberg 已提交
4079
			+ (char *)rsp, sizeof(FILE_SYSTEM_DEVICE_INFO));
S
Steven French 已提交
4080 4081
	else if (level == FS_SECTOR_SIZE_INFORMATION) {
		struct smb3_fs_ss_info *ss_info = (struct smb3_fs_ss_info *)
4082
			(offset + (char *)rsp);
S
Steven French 已提交
4083 4084 4085 4086
		tcon->ss_flags = le32_to_cpu(ss_info->Flags);
		tcon->perf_sector_size =
			le32_to_cpu(ss_info->PhysicalBytesPerSectorForPerf);
	}
4087 4088

qfsattr_exit:
4089
	free_rsp_buf(resp_buftype, rsp_iov.iov_base);
4090 4091
	return rc;
}
4092 4093 4094 4095 4096 4097

int
smb2_lockv(const unsigned int xid, struct cifs_tcon *tcon,
	   const __u64 persist_fid, const __u64 volatile_fid, const __u32 pid,
	   const __u32 num_lock, struct smb2_lock_element *buf)
{
R
Ronnie Sahlberg 已提交
4098
	struct smb_rqst rqst;
4099 4100 4101
	int rc = 0;
	struct smb2_lock_req *req = NULL;
	struct kvec iov[2];
4102
	struct kvec rsp_iov;
4103 4104
	int resp_buf_type;
	unsigned int count;
4105
	int flags = CIFS_NO_RESP;
4106
	unsigned int total_len;
4107

4108
	cifs_dbg(FYI, "smb2_lockv num lock %d\n", num_lock);
4109

4110
	rc = smb2_plain_req_init(SMB2_LOCK, tcon, (void **) &req, &total_len);
4111 4112 4113
	if (rc)
		return rc;

4114
	if (smb3_encryption_required(tcon))
4115 4116
		flags |= CIFS_TRANSFORM_REQ;

4117
	req->sync_hdr.ProcessId = cpu_to_le32(pid);
4118 4119 4120 4121 4122 4123 4124 4125
	req->LockCount = cpu_to_le16(num_lock);

	req->PersistentFileId = persist_fid;
	req->VolatileFileId = volatile_fid;

	count = num_lock * sizeof(struct smb2_lock_element);

	iov[0].iov_base = (char *)req;
4126
	iov[0].iov_len = total_len - sizeof(struct smb2_lock_element);
4127 4128 4129 4130
	iov[1].iov_base = (char *)buf;
	iov[1].iov_len = count;

	cifs_stats_inc(&tcon->stats.cifs_stats.num_locks);
R
Ronnie Sahlberg 已提交
4131 4132 4133 4134 4135 4136

	memset(&rqst, 0, sizeof(struct smb_rqst));
	rqst.rq_iov = iov;
	rqst.rq_nvec = 2;

	rc = cifs_send_recv(xid, tcon->ses, &rqst, &resp_buf_type, flags,
4137
			    &rsp_iov);
4138
	cifs_small_buf_release(req);
4139
	if (rc) {
4140
		cifs_dbg(FYI, "Send error in smb2_lockv = %d\n", rc);
4141
		cifs_stats_fail_inc(tcon, SMB2_LOCK_HE);
4142 4143
		trace_smb3_lock_err(xid, persist_fid, tcon->tid,
				    tcon->ses->Suid, rc);
4144 4145 4146 4147 4148 4149 4150 4151 4152 4153 4154 4155 4156 4157 4158 4159 4160 4161 4162 4163 4164
	}

	return rc;
}

int
SMB2_lock(const unsigned int xid, struct cifs_tcon *tcon,
	  const __u64 persist_fid, const __u64 volatile_fid, const __u32 pid,
	  const __u64 length, const __u64 offset, const __u32 lock_flags,
	  const bool wait)
{
	struct smb2_lock_element lock;

	lock.Offset = cpu_to_le64(offset);
	lock.Length = cpu_to_le64(length);
	lock.Flags = cpu_to_le32(lock_flags);
	if (!wait && lock_flags != SMB2_LOCKFLAG_UNLOCK)
		lock.Flags |= cpu_to_le32(SMB2_LOCKFLAG_FAIL_IMMEDIATELY);

	return smb2_lockv(xid, tcon, persist_fid, volatile_fid, pid, 1, &lock);
}
4165 4166 4167 4168 4169

int
SMB2_lease_break(const unsigned int xid, struct cifs_tcon *tcon,
		 __u8 *lease_key, const __le32 lease_state)
{
R
Ronnie Sahlberg 已提交
4170
	struct smb_rqst rqst;
4171 4172
	int rc;
	struct smb2_lease_ack *req = NULL;
4173
	struct cifs_ses *ses = tcon->ses;
4174
	int flags = CIFS_OBREAK_OP;
4175 4176 4177 4178
	unsigned int total_len;
	struct kvec iov[1];
	struct kvec rsp_iov;
	int resp_buf_type;
4179

4180
	cifs_dbg(FYI, "SMB2_lease_break\n");
4181 4182
	rc = smb2_plain_req_init(SMB2_OPLOCK_BREAK, tcon, (void **) &req,
			     &total_len);
4183 4184 4185
	if (rc)
		return rc;

4186
	if (smb3_encryption_required(tcon))
4187 4188
		flags |= CIFS_TRANSFORM_REQ;

4189
	req->sync_hdr.CreditRequest = cpu_to_le16(1);
4190
	req->StructureSize = cpu_to_le16(36);
4191
	total_len += 12;
4192 4193 4194 4195

	memcpy(req->LeaseKey, lease_key, 16);
	req->LeaseState = lease_state;

4196 4197 4198 4199 4200
	flags |= CIFS_NO_RESP;

	iov[0].iov_base = (char *)req;
	iov[0].iov_len = total_len;

R
Ronnie Sahlberg 已提交
4201 4202 4203 4204 4205
	memset(&rqst, 0, sizeof(struct smb_rqst));
	rqst.rq_iov = iov;
	rqst.rq_nvec = 1;

	rc = cifs_send_recv(xid, ses, &rqst, &resp_buf_type, flags, &rsp_iov);
4206
	cifs_small_buf_release(req);
4207 4208 4209

	if (rc) {
		cifs_stats_fail_inc(tcon, SMB2_OPLOCK_BREAK_HE);
4210
		cifs_dbg(FYI, "Send error in Lease Break = %d\n", rc);
4211 4212 4213 4214
	}

	return rc;
}