smb2misc.c 18.9 KB
Newer Older
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34
/*
 *   fs/cifs/smb2misc.c
 *
 *   Copyright (C) International Business Machines  Corp., 2002,2011
 *                 Etersoft, 2012
 *   Author(s): Steve French (sfrench@us.ibm.com)
 *              Pavel Shilovsky (pshilovsky@samba.org) 2012
 *
 *   This library is free software; you can redistribute it and/or modify
 *   it under the terms of the GNU Lesser General Public License as published
 *   by the Free Software Foundation; either version 2.1 of the License, or
 *   (at your option) any later version.
 *
 *   This library is distributed in the hope that it will be useful,
 *   but WITHOUT ANY WARRANTY; without even the implied warranty of
 *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See
 *   the GNU Lesser General Public License for more details.
 *
 *   You should have received a copy of the GNU Lesser General Public License
 *   along with this library; if not, write to the Free Software
 *   Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
 */
#include <linux/ctype.h>
#include "smb2pdu.h"
#include "cifsglob.h"
#include "cifsproto.h"
#include "smb2proto.h"
#include "cifs_debug.h"
#include "cifs_unicode.h"
#include "smb2status.h"

static int
check_smb2_hdr(struct smb2_hdr *hdr, __u64 mid)
{
35 36
	__u64 wire_mid = le64_to_cpu(hdr->MessageId);

37 38 39 40
	/*
	 * Make sure that this really is an SMB, that it is a response,
	 * and that the message ids match.
	 */
41
	if ((hdr->ProtocolId == SMB2_PROTO_NUMBER) &&
42
	    (mid == wire_mid)) {
43 44 45 46 47 48 49
		if (hdr->Flags & SMB2_FLAGS_SERVER_TO_REDIR)
			return 0;
		else {
			/* only one valid case where server sends us request */
			if (hdr->Command == SMB2_OPLOCK_BREAK)
				return 0;
			else
50
				cifs_dbg(VFS, "Received Request not response\n");
51 52
		}
	} else { /* bad signature or mid */
53
		if (hdr->ProtocolId != SMB2_PROTO_NUMBER)
54
			cifs_dbg(VFS, "Bad protocol string signature header %x\n",
55
				 le32_to_cpu(hdr->ProtocolId));
56
		if (mid != wire_mid)
57
			cifs_dbg(VFS, "Mids do not match: %llu and %llu\n",
58
				 mid, wire_mid);
59
	}
60
	cifs_dbg(VFS, "Bad SMB detected. The Mid=%llu\n", wire_mid);
61 62 63 64 65 66 67 68 69 70 71
	return 1;
}

/*
 *  The following table defines the expected "StructureSize" of SMB2 responses
 *  in order by SMB2 command.  This is similar to "wct" in SMB/CIFS responses.
 *
 *  Note that commands are defined in smb2pdu.h in le16 but the array below is
 *  indexed by command in host byte order
 */
static const __le16 smb2_rsp_struct_sizes[NUMBER_OF_SMB2_COMMANDS] = {
72 73 74 75 76 77 78 79 80 81 82 83
	/* SMB2_NEGOTIATE */ cpu_to_le16(65),
	/* SMB2_SESSION_SETUP */ cpu_to_le16(9),
	/* SMB2_LOGOFF */ cpu_to_le16(4),
	/* SMB2_TREE_CONNECT */ cpu_to_le16(16),
	/* SMB2_TREE_DISCONNECT */ cpu_to_le16(4),
	/* SMB2_CREATE */ cpu_to_le16(89),
	/* SMB2_CLOSE */ cpu_to_le16(60),
	/* SMB2_FLUSH */ cpu_to_le16(4),
	/* SMB2_READ */ cpu_to_le16(17),
	/* SMB2_WRITE */ cpu_to_le16(17),
	/* SMB2_LOCK */ cpu_to_le16(4),
	/* SMB2_IOCTL */ cpu_to_le16(49),
84
	/* BB CHECK this ... not listed in documentation */
85 86 87 88 89 90
	/* SMB2_CANCEL */ cpu_to_le16(0),
	/* SMB2_ECHO */ cpu_to_le16(4),
	/* SMB2_QUERY_DIRECTORY */ cpu_to_le16(9),
	/* SMB2_CHANGE_NOTIFY */ cpu_to_le16(9),
	/* SMB2_QUERY_INFO */ cpu_to_le16(9),
	/* SMB2_SET_INFO */ cpu_to_le16(2),
91
	/* BB FIXME can also be 44 for lease break */
92
	/* SMB2_OPLOCK_BREAK */ cpu_to_le16(24)
93 94 95
};

int
96
smb2_check_message(char *buf, unsigned int length, struct TCP_Server_Info *srvr)
97 98 99
{
	struct smb2_hdr *hdr = (struct smb2_hdr *)buf;
	struct smb2_pdu *pdu = (struct smb2_pdu *)hdr;
100
	__u64 mid;
101 102 103 104 105
	__u32 len = get_rfc1002_length(buf);
	__u32 clc_len;  /* calculated length */
	int command;

	/* BB disable following printk later */
106 107
	cifs_dbg(FYI, "%s length: 0x%x, smb_buf_length: 0x%x\n",
		 __func__, length, len);
108 109 110 111 112 113

	/*
	 * Add function to do table lookup of StructureSize by command
	 * ie Validate the wct via smb2_struct_sizes table above
	 */

114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137
	if (hdr->ProtocolId == SMB2_TRANSFORM_PROTO_NUM) {
		struct smb2_transform_hdr *thdr =
			(struct smb2_transform_hdr *)buf;
		struct cifs_ses *ses = NULL;
		struct list_head *tmp;

		/* decrypt frame now that it is completely read in */
		spin_lock(&cifs_tcp_ses_lock);
		list_for_each(tmp, &srvr->smb_ses_list) {
			ses = list_entry(tmp, struct cifs_ses, smb_ses_list);
			if (ses->Suid == thdr->SessionId)
				break;

			ses = NULL;
		}
		spin_unlock(&cifs_tcp_ses_lock);
		if (ses == NULL) {
			cifs_dbg(VFS, "no decryption - session id not found\n");
			return 1;
		}
	}


	mid = le64_to_cpu(hdr->MessageId);
138
	if (length < sizeof(struct smb2_pdu)) {
139 140 141 142 143 144 145 146
		if ((length >= sizeof(struct smb2_hdr)) && (hdr->Status != 0)) {
			pdu->StructureSize2 = 0;
			/*
			 * As with SMB/CIFS, on some error cases servers may
			 * not return wct properly
			 */
			return 0;
		} else {
147
			cifs_dbg(VFS, "Length less than SMB header size\n");
148 149 150 151
		}
		return 1;
	}
	if (len > CIFSMaxBufSize + MAX_SMB2_HDR_SIZE - 4) {
152 153
		cifs_dbg(VFS, "SMB length greater than maximum, mid=%llu\n",
			 mid);
154 155 156 157 158 159
		return 1;
	}

	if (check_smb2_hdr(hdr, mid))
		return 1;

160
	if (hdr->StructureSize != SMB2_HEADER_STRUCTURE_SIZE) {
161 162
		cifs_dbg(VFS, "Illegal structure size %u\n",
			 le16_to_cpu(hdr->StructureSize));
163 164 165 166 167
		return 1;
	}

	command = le16_to_cpu(hdr->Command);
	if (command >= NUMBER_OF_SMB2_COMMANDS) {
168
		cifs_dbg(VFS, "Illegal SMB2 command %d\n", command);
169 170 171 172
		return 1;
	}

	if (smb2_rsp_struct_sizes[command] != pdu->StructureSize2) {
173 174
		if (command != SMB2_OPLOCK_BREAK_HE && (hdr->Status == 0 ||
		    pdu->StructureSize2 != SMB2_ERROR_STRUCTURE_SIZE2)) {
175
			/* error packets have 9 byte structure size */
176 177
			cifs_dbg(VFS, "Illegal response size %u for command %d\n",
				 le16_to_cpu(pdu->StructureSize2), command);
178
			return 1;
179 180 181 182
		} else if (command == SMB2_OPLOCK_BREAK_HE && (hdr->Status == 0)
			   && (le16_to_cpu(pdu->StructureSize2) != 44)
			   && (le16_to_cpu(pdu->StructureSize2) != 36)) {
			/* special case for SMB2.1 lease break message */
183 184
			cifs_dbg(VFS, "Illegal response size %d for oplock break\n",
				 le16_to_cpu(pdu->StructureSize2));
185
			return 1;
186 187 188 189
		}
	}

	if (4 + len != length) {
190 191
		cifs_dbg(VFS, "Total length %u RFC1002 length %u mismatch mid %llu\n",
			 length, 4 + len, mid);
192 193 194 195 196 197
		return 1;
	}

	clc_len = smb2_calc_size(hdr);

	if (4 + len != clc_len) {
198 199
		cifs_dbg(FYI, "Calculated size %u length %u mismatch mid %llu\n",
			 clc_len, 4 + len, mid);
200 201 202 203
		/* create failed on symlink */
		if (command == SMB2_CREATE_HE &&
		    hdr->Status == STATUS_STOPPED_ON_SYMLINK)
			return 0;
204 205 206
		/* Windows 7 server returns 24 bytes more */
		if (clc_len + 20 == len && command == SMB2_OPLOCK_BREAK_HE)
			return 0;
207
		/* server can return one byte more due to implied bcc[0] */
208 209
		if (clc_len == 4 + len + 1)
			return 0;
210 211 212 213 214 215 216 217 218 219 220 221 222 223 224

		/*
		 * MacOS server pads after SMB2.1 write response with 3 bytes
		 * of junk. Other servers match RFC1001 len to actual
		 * SMB2/SMB3 frame length (header + smb2 response specific data)
		 * Log the server error (once), but allow it and continue
		 * since the frame is parseable.
		 */
		if (clc_len < 4 /* RFC1001 header size */ + len) {
			printk_once(KERN_WARNING
				"SMB2 server sent bad RFC1001 len %d not %d\n",
				len, clc_len - 4);
			return 0;
		}

225 226 227 228 229 230 231 232 233 234 235 236 237 238 239 240 241 242 243 244 245 246 247 248 249 250 251 252 253 254 255 256 257 258 259 260
		return 1;
	}
	return 0;
}

/*
 * The size of the variable area depends on the offset and length fields
 * located in different fields for various SMB2 responses. SMB2 responses
 * with no variable length info, show an offset of zero for the offset field.
 */
static const bool has_smb2_data_area[NUMBER_OF_SMB2_COMMANDS] = {
	/* SMB2_NEGOTIATE */ true,
	/* SMB2_SESSION_SETUP */ true,
	/* SMB2_LOGOFF */ false,
	/* SMB2_TREE_CONNECT */	false,
	/* SMB2_TREE_DISCONNECT */ false,
	/* SMB2_CREATE */ true,
	/* SMB2_CLOSE */ false,
	/* SMB2_FLUSH */ false,
	/* SMB2_READ */	true,
	/* SMB2_WRITE */ false,
	/* SMB2_LOCK */	false,
	/* SMB2_IOCTL */ true,
	/* SMB2_CANCEL */ false, /* BB CHECK this not listed in documentation */
	/* SMB2_ECHO */ false,
	/* SMB2_QUERY_DIRECTORY */ true,
	/* SMB2_CHANGE_NOTIFY */ true,
	/* SMB2_QUERY_INFO */ true,
	/* SMB2_SET_INFO */ false,
	/* SMB2_OPLOCK_BREAK */ false
};

/*
 * Returns the pointer to the beginning of the data area. Length of the data
 * area and the offset to it (from the beginning of the smb are also returned.
 */
261
char *
262 263 264 265 266 267 268 269 270 271 272 273 274 275 276 277 278 279
smb2_get_data_area_len(int *off, int *len, struct smb2_hdr *hdr)
{
	*off = 0;
	*len = 0;

	/* error responses do not have data area */
	if (hdr->Status && hdr->Status != STATUS_MORE_PROCESSING_REQUIRED &&
	    (((struct smb2_err_rsp *)hdr)->StructureSize) ==
						SMB2_ERROR_STRUCTURE_SIZE2)
		return NULL;

	/*
	 * Following commands have data areas so we have to get the location
	 * of the data buffer offset and data buffer length for the particular
	 * command.
	 */
	switch (hdr->Command) {
	case SMB2_NEGOTIATE:
280 281 282 283 284
		*off = le16_to_cpu(
		    ((struct smb2_negotiate_rsp *)hdr)->SecurityBufferOffset);
		*len = le16_to_cpu(
		    ((struct smb2_negotiate_rsp *)hdr)->SecurityBufferLength);
		break;
285
	case SMB2_SESSION_SETUP:
286 287 288 289 290
		*off = le16_to_cpu(
		    ((struct smb2_sess_setup_rsp *)hdr)->SecurityBufferOffset);
		*len = le16_to_cpu(
		    ((struct smb2_sess_setup_rsp *)hdr)->SecurityBufferLength);
		break;
291
	case SMB2_CREATE:
292 293 294 295 296
		*off = le32_to_cpu(
		    ((struct smb2_create_rsp *)hdr)->CreateContextsOffset);
		*len = le32_to_cpu(
		    ((struct smb2_create_rsp *)hdr)->CreateContextsLength);
		break;
297
	case SMB2_QUERY_INFO:
P
Pavel Shilovsky 已提交
298 299 300 301 302 303
		*off = le16_to_cpu(
		    ((struct smb2_query_info_rsp *)hdr)->OutputBufferOffset);
		*len = le32_to_cpu(
		    ((struct smb2_query_info_rsp *)hdr)->OutputBufferLength);
		break;
	case SMB2_READ:
304 305 306
		*off = ((struct smb2_read_rsp *)hdr)->DataOffset;
		*len = le32_to_cpu(((struct smb2_read_rsp *)hdr)->DataLength);
		break;
307
	case SMB2_QUERY_DIRECTORY:
308 309 310 311 312
		*off = le16_to_cpu(
		  ((struct smb2_query_directory_rsp *)hdr)->OutputBufferOffset);
		*len = le32_to_cpu(
		  ((struct smb2_query_directory_rsp *)hdr)->OutputBufferLength);
		break;
313
	case SMB2_IOCTL:
314 315 316 317
		*off = le32_to_cpu(
		  ((struct smb2_ioctl_rsp *)hdr)->OutputOffset);
		*len = le32_to_cpu(((struct smb2_ioctl_rsp *)hdr)->OutputCount);
		break;
318 319 320
	case SMB2_CHANGE_NOTIFY:
	default:
		/* BB FIXME for unimplemented cases above */
321
		cifs_dbg(VFS, "no length check for command\n");
322 323 324 325 326 327 328 329
		break;
	}

	/*
	 * Invalid length or offset probably means data area is invalid, but
	 * we have little choice but to ignore the data area in this case.
	 */
	if (*off > 4096) {
330
		cifs_dbg(VFS, "offset %d too large, data area ignored\n", *off);
331 332 333
		*len = 0;
		*off = 0;
	} else if (*off < 0) {
334 335
		cifs_dbg(VFS, "negative offset %d to data invalid ignore data area\n",
			 *off);
336 337 338
		*off = 0;
		*len = 0;
	} else if (*len < 0) {
339 340
		cifs_dbg(VFS, "negative data length %d invalid, data area ignored\n",
			 *len);
341 342
		*len = 0;
	} else if (*len > 128 * 1024) {
343
		cifs_dbg(VFS, "data area larger than 128K: %d\n", *len);
344 345 346 347 348
		*len = 0;
	}

	/* return pointer to beginning of data area, ie offset from SMB start */
	if ((*off != 0) && (*len != 0))
349
		return (char *)(&hdr->ProtocolId) + *off;
350 351 352 353 354 355 356 357 358
	else
		return NULL;
}

/*
 * Calculate the size of the SMB message based on the fixed header
 * portion, the number of word parameters and the data portion of the message.
 */
unsigned int
359
smb2_calc_size(void *buf)
360
{
361
	struct smb2_hdr *hdr = (struct smb2_hdr *)buf;
362 363 364 365 366 367 368 369 370 371 372 373 374 375 376 377
	struct smb2_pdu *pdu = (struct smb2_pdu *)hdr;
	int offset; /* the offset from the beginning of SMB to data area */
	int data_length; /* the length of the variable length data area */
	/* Structure Size has already been checked to make sure it is 64 */
	int len = 4 + le16_to_cpu(pdu->hdr.StructureSize);

	/*
	 * StructureSize2, ie length of fixed parameter area has already
	 * been checked to make sure it is the correct length.
	 */
	len += le16_to_cpu(pdu->StructureSize2);

	if (has_smb2_data_area[le16_to_cpu(hdr->Command)] == false)
		goto calc_size_exit;

	smb2_get_data_area_len(&offset, &data_length, hdr);
378
	cifs_dbg(FYI, "SMB2 data length %d offset %d\n", data_length, offset);
379 380 381 382 383 384 385 386 387 388

	if (data_length > 0) {
		/*
		 * Check to make sure that data area begins after fixed area,
		 * Note that last byte of the fixed area is part of data area
		 * for some commands, typically those with odd StructureSize,
		 * so we must add one to the calculation (and 4 to account for
		 * the size of the RFC1001 hdr.
		 */
		if (offset + 4 + 1 < len) {
389 390
			cifs_dbg(VFS, "data area offset %d overlaps SMB2 header %d\n",
				 offset + 4 + 1, len);
391 392 393 394 395 396
			data_length = 0;
		} else {
			len = 4 + offset + data_length;
		}
	}
calc_size_exit:
397
	cifs_dbg(FYI, "SMB2 len %d\n", len);
398 399
	return len;
}
400 401 402 403 404 405 406 407

/* Note: caller must free return buffer */
__le16 *
cifs_convert_path_to_utf16(const char *from, struct cifs_sb_info *cifs_sb)
{
	int len;
	const char *start_of_path;
	__le16 *to;
408 409 410 411 412 413 414 415
	int map_type;

	if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_MAP_SFM_CHR)
		map_type = SFM_MAP_UNI_RSVD;
	else if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_MAP_SPECIAL_CHR)
		map_type = SFU_MAP_UNI_RSVD;
	else
		map_type = NO_MAP_UNI_RSVD;
416 417 418 419 420 421 422

	/* Windows doesn't allow paths beginning with \ */
	if (from[0] == '\\')
		start_of_path = from + 1;
	else
		start_of_path = from;
	to = cifs_strndup_to_utf16(start_of_path, PATH_MAX, &len,
423
				   cifs_sb->local_nls, map_type);
424 425
	return to;
}
426

427 428 429
__le32
smb2_get_lease_state(struct cifsInodeInfo *cinode)
{
430
	__le32 lease = 0;
431

432 433 434 435 436 437 438
	if (CIFS_CACHE_WRITE(cinode))
		lease |= SMB2_LEASE_WRITE_CACHING;
	if (CIFS_CACHE_HANDLE(cinode))
		lease |= SMB2_LEASE_HANDLE_CACHING;
	if (CIFS_CACHE_READ(cinode))
		lease |= SMB2_LEASE_READ_CACHING;
	return lease;
439 440
}

441 442 443 444 445 446 447 448 449 450 451 452 453 454 455 456
struct smb2_lease_break_work {
	struct work_struct lease_break;
	struct tcon_link *tlink;
	__u8 lease_key[16];
	__le32 lease_state;
};

static void
cifs_ses_oplock_break(struct work_struct *work)
{
	struct smb2_lease_break_work *lw = container_of(work,
				struct smb2_lease_break_work, lease_break);
	int rc;

	rc = SMB2_lease_break(0, tlink_tcon(lw->tlink), lw->lease_key,
			      lw->lease_state);
457
	cifs_dbg(FYI, "Lease release rc %d\n", rc);
458 459 460 461
	cifs_put_tlink(lw->tlink);
	kfree(lw);
}

462
static bool
P
Pavel Shilovsky 已提交
463 464 465 466 467 468 469
smb2_tcon_has_lease(struct cifs_tcon *tcon, struct smb2_lease_break *rsp,
		    struct smb2_lease_break_work *lw)
{
	bool found;
	__u8 lease_state;
	struct list_head *tmp;
	struct cifsFileInfo *cfile;
470
	struct TCP_Server_Info *server = tcon->ses->server;
P
Pavel Shilovsky 已提交
471 472 473 474 475
	struct cifs_pending_open *open;
	struct cifsInodeInfo *cinode;
	int ack_req = le32_to_cpu(rsp->Flags &
				  SMB2_NOTIFY_BREAK_LEASE_FLAG_ACK_REQUIRED);

476
	lease_state = le32_to_cpu(rsp->NewLeaseState);
P
Pavel Shilovsky 已提交
477 478 479

	list_for_each(tmp, &tcon->openFileList) {
		cfile = list_entry(tmp, struct cifsFileInfo, tlist);
480
		cinode = CIFS_I(d_inode(cfile->dentry));
P
Pavel Shilovsky 已提交
481 482 483 484 485 486

		if (memcmp(cinode->lease_key, rsp->LeaseKey,
							SMB2_LEASE_KEY_SIZE))
			continue;

		cifs_dbg(FYI, "found in the open list\n");
487
		cifs_dbg(FYI, "lease key match, lease break 0x%x\n",
P
Pavel Shilovsky 已提交
488 489
			 le32_to_cpu(rsp->NewLeaseState));

490
		server->ops->set_oplock_level(cinode, lease_state, 0, NULL);
P
Pavel Shilovsky 已提交
491 492 493 494 495 496 497 498 499 500 501 502 503 504 505 506 507 508 509 510 511 512 513 514 515 516

		if (ack_req)
			cfile->oplock_break_cancelled = false;
		else
			cfile->oplock_break_cancelled = true;

		queue_work(cifsiod_wq, &cfile->oplock_break);
		kfree(lw);
		return true;
	}

	found = false;
	list_for_each_entry(open, &tcon->pending_opens, olist) {
		if (memcmp(open->lease_key, rsp->LeaseKey,
			   SMB2_LEASE_KEY_SIZE))
			continue;

		if (!found && ack_req) {
			found = true;
			memcpy(lw->lease_key, open->lease_key,
			       SMB2_LEASE_KEY_SIZE);
			lw->tlink = cifs_get_tlink(open->tlink);
			queue_work(cifsiod_wq, &lw->lease_break);
		}

		cifs_dbg(FYI, "found in the pending open list\n");
517
		cifs_dbg(FYI, "lease key match, lease break 0x%x\n",
P
Pavel Shilovsky 已提交
518 519 520 521 522 523 524 525 526
			 le32_to_cpu(rsp->NewLeaseState));

		open->oplock = lease_state;
	}
	return found;
}

static bool
smb2_is_valid_lease_break(char *buffer)
527 528 529
{
	struct smb2_lease_break *rsp = (struct smb2_lease_break *)buffer;
	struct list_head *tmp, *tmp1, *tmp2;
P
Pavel Shilovsky 已提交
530
	struct TCP_Server_Info *server;
531 532
	struct cifs_ses *ses;
	struct cifs_tcon *tcon;
533 534 535
	struct smb2_lease_break_work *lw;

	lw = kmalloc(sizeof(struct smb2_lease_break_work), GFP_KERNEL);
536
	if (!lw)
537 538 539 540
		return false;

	INIT_WORK(&lw->lease_break, cifs_ses_oplock_break);
	lw->lease_state = rsp->NewLeaseState;
541

542
	cifs_dbg(FYI, "Checking for lease break\n");
543 544 545

	/* look up tcon based on tid & uid */
	spin_lock(&cifs_tcp_ses_lock);
P
Pavel Shilovsky 已提交
546 547
	list_for_each(tmp, &cifs_tcp_ses_list) {
		server = list_entry(tmp, struct TCP_Server_Info, tcp_ses_list);
548

P
Pavel Shilovsky 已提交
549 550
		list_for_each(tmp1, &server->smb_ses_list) {
			ses = list_entry(tmp1, struct cifs_ses, smb_ses_list);
551

P
Pavel Shilovsky 已提交
552 553 554
			list_for_each(tmp2, &ses->tcon_list) {
				tcon = list_entry(tmp2, struct cifs_tcon,
						  tcon_list);
555
				spin_lock(&tcon->open_file_lock);
P
Pavel Shilovsky 已提交
556 557 558
				cifs_stats_inc(
				    &tcon->stats.cifs_stats.num_oplock_brks);
				if (smb2_tcon_has_lease(tcon, rsp, lw)) {
559
					spin_unlock(&tcon->open_file_lock);
P
Pavel Shilovsky 已提交
560 561
					spin_unlock(&cifs_tcp_ses_lock);
					return true;
562
				}
563
				spin_unlock(&tcon->open_file_lock);
564
			}
565 566 567
		}
	}
	spin_unlock(&cifs_tcp_ses_lock);
568
	kfree(lw);
569
	cifs_dbg(FYI, "Can not process lease break - no lease matched\n");
570 571 572
	return false;
}

573 574 575 576 577 578 579 580 581 582
bool
smb2_is_valid_oplock_break(char *buffer, struct TCP_Server_Info *server)
{
	struct smb2_oplock_break *rsp = (struct smb2_oplock_break *)buffer;
	struct list_head *tmp, *tmp1, *tmp2;
	struct cifs_ses *ses;
	struct cifs_tcon *tcon;
	struct cifsInodeInfo *cinode;
	struct cifsFileInfo *cfile;

583
	cifs_dbg(FYI, "Checking for oplock break\n");
584 585 586 587

	if (rsp->hdr.Command != SMB2_OPLOCK_BREAK)
		return false;

S
Steve French 已提交
588
	if (rsp->StructureSize !=
589
				smb2_rsp_struct_sizes[SMB2_OPLOCK_BREAK_HE]) {
590
		if (le16_to_cpu(rsp->StructureSize) == 44)
P
Pavel Shilovsky 已提交
591
			return smb2_is_valid_lease_break(buffer);
592 593
		else
			return false;
594 595
	}

596
	cifs_dbg(FYI, "oplock level 0x%x\n", rsp->OplockLevel);
597 598 599 600 601 602 603 604 605

	/* look up tcon based on tid & uid */
	spin_lock(&cifs_tcp_ses_lock);
	list_for_each(tmp, &server->smb_ses_list) {
		ses = list_entry(tmp, struct cifs_ses, smb_ses_list);
		list_for_each(tmp1, &ses->tcon_list) {
			tcon = list_entry(tmp1, struct cifs_tcon, tcon_list);

			cifs_stats_inc(&tcon->stats.cifs_stats.num_oplock_brks);
606
			spin_lock(&tcon->open_file_lock);
607 608 609 610 611 612 613 614 615
			list_for_each(tmp2, &tcon->openFileList) {
				cfile = list_entry(tmp2, struct cifsFileInfo,
						     tlist);
				if (rsp->PersistentFid !=
				    cfile->fid.persistent_fid ||
				    rsp->VolatileFid !=
				    cfile->fid.volatile_fid)
					continue;

616
				cifs_dbg(FYI, "file id match, oplock break\n");
617
				cinode = CIFS_I(d_inode(cfile->dentry));
618
				spin_lock(&cfile->file_info_lock);
619
				if (!CIFS_CACHE_WRITE(cinode) &&
620 621 622 623 624
				    rsp->OplockLevel == SMB2_OPLOCK_LEVEL_NONE)
					cfile->oplock_break_cancelled = true;
				else
					cfile->oplock_break_cancelled = false;

625 626 627 628 629 630 631 632 633 634 635 636 637 638 639
				set_bit(CIFS_INODE_PENDING_OPLOCK_BREAK,
					&cinode->flags);

				/*
				 * Set flag if the server downgrades the oplock
				 * to L2 else clear.
				 */
				if (rsp->OplockLevel)
					set_bit(
					   CIFS_INODE_DOWNGRADE_OPLOCK_TO_L2,
					   &cinode->flags);
				else
					clear_bit(
					   CIFS_INODE_DOWNGRADE_OPLOCK_TO_L2,
					   &cinode->flags);
640
				spin_unlock(&cfile->file_info_lock);
641 642
				queue_work(cifsiod_wq, &cfile->oplock_break);

643
				spin_unlock(&tcon->open_file_lock);
644 645 646
				spin_unlock(&cifs_tcp_ses_lock);
				return true;
			}
647
			spin_unlock(&tcon->open_file_lock);
648
			spin_unlock(&cifs_tcp_ses_lock);
649
			cifs_dbg(FYI, "No matching file for oplock break\n");
650 651 652 653
			return true;
		}
	}
	spin_unlock(&cifs_tcp_ses_lock);
654
	cifs_dbg(FYI, "Can not process oplock break for non-existent connection\n");
655 656
	return false;
}