?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
HID: hiddev: Fix slab-out-of-bounds write in hiddev_ioctl_usage()
[linux/fpc-iii.git] / fs / cifs / smb2pdu.c
blob4ffd5e177288e2bed644bff5046b0d046668d0d4
1 /*
2 * fs/cifs/smb2pdu.c
3 *
4 * Copyright (C) International Business Machines Corp., 2009, 2013
5 * Etersoft, 2012
6 * Author(s): Steve French (sfrench@us.ibm.com)
7 * Pavel Shilovsky (pshilovsky@samba.org) 2012
8 *
9 * Contains the routines for constructing the SMB2 PDUs themselves
10 *
11 * This library is free software; you can redistribute it and/or modify
12 * it under the terms of the GNU Lesser General Public License as published
13 * by the Free Software Foundation; either version 2.1 of the License, or
14 * (at your option) any later version.
15 *
16 * This library is distributed in the hope that it will be useful,
17 * but WITHOUT ANY WARRANTY; without even the implied warranty of
18 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See
19 * the GNU Lesser General Public License for more details.
20 *
21 * You should have received a copy of the GNU Lesser General Public License
22 * along with this library; if not, write to the Free Software
23 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
24 */
25
26 /* SMB2 PDU handling routines here - except for leftovers (eg session setup) */
27 /* Note that there are handle based routines which must be */
28 /* treated slightly differently for reconnection purposes since we never */
29 /* want to reuse a stale file handle and only the caller knows the file info */
30
31 #include <linux/fs.h>
32 #include <linux/kernel.h>
33 #include <linux/vfs.h>
34 #include <linux/task_io_accounting_ops.h>
35 #include <linux/uaccess.h>
36 #include <linux/pagemap.h>
37 #include <linux/xattr.h>
38 #include "smb2pdu.h"
39 #include "cifsglob.h"
40 #include "cifsacl.h"
41 #include "cifsproto.h"
42 #include "smb2proto.h"
43 #include "cifs_unicode.h"
44 #include "cifs_debug.h"
45 #include "ntlmssp.h"
46 #include "smb2status.h"
47 #include "smb2glob.h"
48 #include "cifspdu.h"
49 #include "cifs_spnego.h"
50
51 /*
52 * The following table defines the expected "StructureSize" of SMB2 requests
53 * in order by SMB2 command. This is similar to "wct" in SMB/CIFS requests.
54 *
55 * Note that commands are defined in smb2pdu.h in le16 but the array below is
56 * indexed by command in host byte order.
57 */
58 static const int smb2_req_struct_sizes[NUMBER_OF_SMB2_COMMANDS] = {
59 /* SMB2_NEGOTIATE */ 36,
60 /* SMB2_SESSION_SETUP */ 25,
61 /* SMB2_LOGOFF */ 4,
62 /* SMB2_TREE_CONNECT */ 9,
63 /* SMB2_TREE_DISCONNECT */ 4,
64 /* SMB2_CREATE */ 57,
65 /* SMB2_CLOSE */ 24,
66 /* SMB2_FLUSH */ 24,
67 /* SMB2_READ */ 49,
68 /* SMB2_WRITE */ 49,
69 /* SMB2_LOCK */ 48,
70 /* SMB2_IOCTL */ 57,
71 /* SMB2_CANCEL */ 4,
72 /* SMB2_ECHO */ 4,
73 /* SMB2_QUERY_DIRECTORY */ 33,
74 /* SMB2_CHANGE_NOTIFY */ 32,
75 /* SMB2_QUERY_INFO */ 41,
76 /* SMB2_SET_INFO */ 33,
77 /* SMB2_OPLOCK_BREAK */ 24 /* BB this is 36 for LEASE_BREAK variant */
78 };
79
80
81 static void
82 smb2_hdr_assemble(struct smb2_hdr *hdr, __le16 smb2_cmd /* command */ ,
83 const struct cifs_tcon *tcon)
84 {
85 struct smb2_pdu *pdu = (struct smb2_pdu *)hdr;
86 char *temp = (char *)hdr;
87 /* lookup word count ie StructureSize from table */
88 __u16 parmsize = smb2_req_struct_sizes[le16_to_cpu(smb2_cmd)];
89
90 /*
91 * smaller than SMALL_BUFFER_SIZE but bigger than fixed area of
92 * largest operations (Create)
93 */
94 memset(temp, 0, 256);
95
96 /* Note this is only network field converted to big endian */
97 hdr->smb2_buf_length = cpu_to_be32(parmsize + sizeof(struct smb2_hdr)
98 - 4 /* RFC 1001 length field itself not counted */);
99
100 hdr->ProtocolId[0] = 0xFE;
101 hdr->ProtocolId[1] = 'S';
102 hdr->ProtocolId[2] = 'M';
103 hdr->ProtocolId[3] = 'B';
104 hdr->StructureSize = cpu_to_le16(64);
105 hdr->Command = smb2_cmd;
106 if (tcon && tcon->ses && tcon->ses->server) {
107 struct TCP_Server_Info *server = tcon->ses->server;
108
109 spin_lock(&server->req_lock);
110 /* Request up to 2 credits but don't go over the limit. */
111 if (server->credits >= SMB2_MAX_CREDITS_AVAILABLE)
112 hdr->CreditRequest = cpu_to_le16(0);
113 else
114 hdr->CreditRequest = cpu_to_le16(
115 min_t(int, SMB2_MAX_CREDITS_AVAILABLE -
116 server->credits, 2));
117 spin_unlock(&server->req_lock);
118 } else {
119 hdr->CreditRequest = cpu_to_le16(2);
120 }
121 hdr->ProcessId = cpu_to_le32((__u16)current->tgid);
122
123 if (!tcon)
124 goto out;
125
126 /* GLOBAL_CAP_LARGE_MTU will only be set if dialect > SMB2.02 */
127 /* See sections 2.2.4 and 3.2.4.1.5 of MS-SMB2 */
128 if ((tcon->ses) && (tcon->ses->server) &&
129 (tcon->ses->server->capabilities & SMB2_GLOBAL_CAP_LARGE_MTU))
130 hdr->CreditCharge = cpu_to_le16(1);
131 /* else CreditCharge MBZ */
132
133 hdr->TreeId = tcon->tid;
134 /* Uid is not converted */
135 if (tcon->ses)
136 hdr->SessionId = tcon->ses->Suid;
137
138 /*
139 * If we would set SMB2_FLAGS_DFS_OPERATIONS on open we also would have
140 * to pass the path on the Open SMB prefixed by \\server\share.
141 * Not sure when we would need to do the augmented path (if ever) and
142 * setting this flag breaks the SMB2 open operation since it is
143 * illegal to send an empty path name (without \\server\share prefix)
144 * when the DFS flag is set in the SMB open header. We could
145 * consider setting the flag on all operations other than open
146 * but it is safer to net set it for now.
147 */
148 /* if (tcon->share_flags & SHI1005_FLAGS_DFS)
149 hdr->Flags |= SMB2_FLAGS_DFS_OPERATIONS; */
150
151 if (tcon->ses && tcon->ses->server && tcon->ses->server->sign)
152 hdr->Flags |= SMB2_FLAGS_SIGNED;
153 out:
154 pdu->StructureSize2 = cpu_to_le16(parmsize);
155 return;
156 }
157
158 static int
159 smb2_reconnect(__le16 smb2_command, struct cifs_tcon *tcon)
160 {
161 int rc;
162 struct nls_table *nls_codepage;
163 struct cifs_ses *ses;
164 struct TCP_Server_Info *server;
165
166 /*
167 * SMB2s NegProt, SessSetup, Logoff do not have tcon yet so
168 * check for tcp and smb session status done differently
169 * for those three - in the calling routine.
170 */
171 if (tcon == NULL)
172 return 0;
173
174 if (smb2_command == SMB2_TREE_CONNECT || smb2_command == SMB2_IOCTL)
175 return 0;
176
177 if (tcon->tidStatus == CifsExiting) {
178 /*
179 * only tree disconnect, open, and write,
180 * (and ulogoff which does not have tcon)
181 * are allowed as we start force umount.
182 */
183 if ((smb2_command != SMB2_WRITE) &&
184 (smb2_command != SMB2_CREATE) &&
185 (smb2_command != SMB2_TREE_DISCONNECT)) {
186 cifs_dbg(FYI, "can not send cmd %d while umounting\n",
187 smb2_command);
188 return -ENODEV;
189 }
190 }
191 if ((!tcon->ses) || (tcon->ses->status == CifsExiting) ||
192 (!tcon->ses->server))
193 return -EIO;
194
195 ses = tcon->ses;
196 server = ses->server;
197
198 /*
199 * Give demultiplex thread up to 10 seconds to reconnect, should be
200 * greater than cifs socket timeout which is 7 seconds
201 */
202 while (server->tcpStatus == CifsNeedReconnect) {
203 /*
204 * Return to caller for TREE_DISCONNECT and LOGOFF and CLOSE
205 * here since they are implicitly done when session drops.
206 */
207 switch (smb2_command) {
208 /*
209 * BB Should we keep oplock break and add flush to exceptions?
210 */
211 case SMB2_TREE_DISCONNECT:
212 case SMB2_CANCEL:
213 case SMB2_CLOSE:
214 case SMB2_OPLOCK_BREAK:
215 return -EAGAIN;
216 }
217
218 rc = wait_event_interruptible_timeout(server->response_q,
219 (server->tcpStatus != CifsNeedReconnect),
220 10 * HZ);
221 if (rc < 0) {
222 cifs_dbg(FYI, "%s: aborting reconnect due to a received"
223 " signal by the process\n", __func__);
224 return -ERESTARTSYS;
225 }
226
227 /* are we still trying to reconnect? */
228 if (server->tcpStatus != CifsNeedReconnect)
229 break;
230
231 /*
232 * on "soft" mounts we wait once. Hard mounts keep
233 * retrying until process is killed or server comes
234 * back on-line
235 */
236 if (!tcon->retry) {
237 cifs_dbg(FYI, "gave up waiting on reconnect in smb_init\n");
238 return -EHOSTDOWN;
239 }
240 }
241
242 if (!tcon->ses->need_reconnect && !tcon->need_reconnect)
243 return 0;
244
245 nls_codepage = load_nls_default();
246
247 /*
248 * need to prevent multiple threads trying to simultaneously reconnect
249 * the same SMB session
250 */
251 mutex_lock(&tcon->ses->session_mutex);
252
253 /*
254 * Recheck after acquire mutex. If another thread is negotiating
255 * and the server never sends an answer the socket will be closed
256 * and tcpStatus set to reconnect.
257 */
258 if (server->tcpStatus == CifsNeedReconnect) {
259 rc = -EHOSTDOWN;
260 mutex_unlock(&tcon->ses->session_mutex);
261 goto out;
262 }
263
264 rc = cifs_negotiate_protocol(0, tcon->ses);
265 if (!rc && tcon->ses->need_reconnect) {
266 rc = cifs_setup_session(0, tcon->ses, nls_codepage);
267 if ((rc == -EACCES) && !tcon->retry) {
268 rc = -EHOSTDOWN;
269 mutex_unlock(&tcon->ses->session_mutex);
270 goto failed;
271 }
272 }
273 if (rc || !tcon->need_reconnect) {
274 mutex_unlock(&tcon->ses->session_mutex);
275 goto out;
276 }
277
278 cifs_mark_open_files_invalid(tcon);
279 rc = SMB2_tcon(0, tcon->ses, tcon->treeName, tcon, nls_codepage);
280 mutex_unlock(&tcon->ses->session_mutex);
281 cifs_dbg(FYI, "reconnect tcon rc = %d\n", rc);
282 if (rc)
283 goto out;
284 atomic_inc(&tconInfoReconnectCount);
285 out:
286 /*
287 * Check if handle based operation so we know whether we can continue
288 * or not without returning to caller to reset file handle.
289 */
290 /*
291 * BB Is flush done by server on drop of tcp session? Should we special
292 * case it and skip above?
293 */
294 switch (smb2_command) {
295 case SMB2_FLUSH:
296 case SMB2_READ:
297 case SMB2_WRITE:
298 case SMB2_LOCK:
299 case SMB2_IOCTL:
300 case SMB2_QUERY_DIRECTORY:
301 case SMB2_CHANGE_NOTIFY:
302 case SMB2_QUERY_INFO:
303 case SMB2_SET_INFO:
304 rc = -EAGAIN;
305 }
306 failed:
307 unload_nls(nls_codepage);
308 return rc;
309 }
310
311 /*
312 * Allocate and return pointer to an SMB request hdr, and set basic
313 * SMB information in the SMB header. If the return code is zero, this
314 * function must have filled in request_buf pointer.
315 */
316 static int
317 small_smb2_init(__le16 smb2_command, struct cifs_tcon *tcon,
318 void **request_buf)
319 {
320 int rc = 0;
321
322 rc = smb2_reconnect(smb2_command, tcon);
323 if (rc)
324 return rc;
325
326 /* BB eventually switch this to SMB2 specific small buf size */
327 *request_buf = cifs_small_buf_get();
328 if (*request_buf == NULL) {
329 /* BB should we add a retry in here if not a writepage? */
330 return -ENOMEM;
331 }
332
333 smb2_hdr_assemble((struct smb2_hdr *) *request_buf, smb2_command, tcon);
334
335 if (tcon != NULL) {
336 #ifdef CONFIG_CIFS_STATS
337 uint16_t com_code = le16_to_cpu(smb2_command);
338 cifs_stats_inc(&tcon->stats.smb2_stats.smb2_com_sent[com_code]);
339 #endif
340 cifs_stats_inc(&tcon->num_smbs_sent);
341 }
342
343 return rc;
344 }
345
346 #ifdef CONFIG_CIFS_SMB311
347 /* offset is sizeof smb2_negotiate_req - 4 but rounded up to 8 bytes */
348 #define OFFSET_OF_NEG_CONTEXT 0x68 /* sizeof(struct smb2_negotiate_req) - 4 */
349
350
351 #define SMB2_PREAUTH_INTEGRITY_CAPABILITIES cpu_to_le16(1)
352 #define SMB2_ENCRYPTION_CAPABILITIES cpu_to_le16(2)
353
354 static void
355 build_preauth_ctxt(struct smb2_preauth_neg_context *pneg_ctxt)
356 {
357 pneg_ctxt->ContextType = SMB2_PREAUTH_INTEGRITY_CAPABILITIES;
358 pneg_ctxt->DataLength = cpu_to_le16(38);
359 pneg_ctxt->HashAlgorithmCount = cpu_to_le16(1);
360 pneg_ctxt->SaltLength = cpu_to_le16(SMB311_SALT_SIZE);
361 get_random_bytes(pneg_ctxt->Salt, SMB311_SALT_SIZE);
362 pneg_ctxt->HashAlgorithms = SMB2_PREAUTH_INTEGRITY_SHA512;
363 }
364
365 static void
366 build_encrypt_ctxt(struct smb2_encryption_neg_context *pneg_ctxt)
367 {
368 pneg_ctxt->ContextType = SMB2_ENCRYPTION_CAPABILITIES;
369 pneg_ctxt->DataLength = cpu_to_le16(6);
370 pneg_ctxt->CipherCount = cpu_to_le16(2);
371 pneg_ctxt->Ciphers[0] = SMB2_ENCRYPTION_AES128_GCM;
372 pneg_ctxt->Ciphers[1] = SMB2_ENCRYPTION_AES128_CCM;
373 }
374
375 static void
376 assemble_neg_contexts(struct smb2_negotiate_req *req)
377 {
378
379 /* +4 is to account for the RFC1001 len field */
380 char *pneg_ctxt = (char *)req + OFFSET_OF_NEG_CONTEXT + 4;
381
382 build_preauth_ctxt((struct smb2_preauth_neg_context *)pneg_ctxt);
383 /* Add 2 to size to round to 8 byte boundary */
384 pneg_ctxt += 2 + sizeof(struct smb2_preauth_neg_context);
385 build_encrypt_ctxt((struct smb2_encryption_neg_context *)pneg_ctxt);
386 req->NegotiateContextOffset = cpu_to_le32(OFFSET_OF_NEG_CONTEXT);
387 req->NegotiateContextCount = cpu_to_le16(2);
388 inc_rfc1001_len(req, 4 + sizeof(struct smb2_preauth_neg_context)
389 + sizeof(struct smb2_encryption_neg_context)); /* calculate hash */
390 }
391 #else
392 static void assemble_neg_contexts(struct smb2_negotiate_req *req)
393 {
394 return;
395 }
396 #endif /* SMB311 */
397
398
399 /*
400 *
401 * SMB2 Worker functions follow:
402 *
403 * The general structure of the worker functions is:
404 * 1) Call smb2_init (assembles SMB2 header)
405 * 2) Initialize SMB2 command specific fields in fixed length area of SMB
406 * 3) Call smb_sendrcv2 (sends request on socket and waits for response)
407 * 4) Decode SMB2 command specific fields in the fixed length area
408 * 5) Decode variable length data area (if any for this SMB2 command type)
409 * 6) Call free smb buffer
410 * 7) return
411 *
412 */
413
414 int
415 SMB2_negotiate(const unsigned int xid, struct cifs_ses *ses)
416 {
417 struct smb2_negotiate_req *req;
418 struct smb2_negotiate_rsp *rsp;
419 struct kvec iov[1];
420 int rc = 0;
421 int resp_buftype;
422 struct TCP_Server_Info *server = ses->server;
423 int blob_offset, blob_length;
424 char *security_blob;
425 int flags = CIFS_NEG_OP;
426
427 cifs_dbg(FYI, "Negotiate protocol\n");
428
429 if (!server) {
430 WARN(1, "%s: server is NULL!\n", __func__);
431 return -EIO;
432 }
433
434 rc = small_smb2_init(SMB2_NEGOTIATE, NULL, (void **) &req);
435 if (rc)
436 return rc;
437
438 req->hdr.SessionId = 0;
439
440 req->Dialects[0] = cpu_to_le16(ses->server->vals->protocol_id);
441
442 req->DialectCount = cpu_to_le16(1); /* One vers= at a time for now */
443 inc_rfc1001_len(req, 2);
444
445 /* only one of SMB2 signing flags may be set in SMB2 request */
446 if (ses->sign)
447 req->SecurityMode = cpu_to_le16(SMB2_NEGOTIATE_SIGNING_REQUIRED);
448 else if (global_secflags & CIFSSEC_MAY_SIGN)
449 req->SecurityMode = cpu_to_le16(SMB2_NEGOTIATE_SIGNING_ENABLED);
450 else
451 req->SecurityMode = 0;
452
453 req->Capabilities = cpu_to_le32(ses->server->vals->req_capabilities);
454
455 /* ClientGUID must be zero for SMB2.02 dialect */
456 if (ses->server->vals->protocol_id == SMB20_PROT_ID)
457 memset(req->ClientGUID, 0, SMB2_CLIENT_GUID_SIZE);
458 else {
459 memcpy(req->ClientGUID, server->client_guid,
460 SMB2_CLIENT_GUID_SIZE);
461 if (ses->server->vals->protocol_id == SMB311_PROT_ID)
462 assemble_neg_contexts(req);
463 }
464 iov[0].iov_base = (char *)req;
465 /* 4 for rfc1002 length field */
466 iov[0].iov_len = get_rfc1002_length(req) + 4;
467
468 rc = SendReceive2(xid, ses, iov, 1, &resp_buftype, flags);
469
470 rsp = (struct smb2_negotiate_rsp *)iov[0].iov_base;
471 /*
472 * No tcon so can't do
473 * cifs_stats_inc(&tcon->stats.smb2_stats.smb2_com_fail[SMB2...]);
474 */
475 if (rc != 0)
476 goto neg_exit;
477
478 cifs_dbg(FYI, "mode 0x%x\n", rsp->SecurityMode);
479
480 /* BB we may eventually want to match the negotiated vs. requested
481 dialect, even though we are only requesting one at a time */
482 if (rsp->DialectRevision == cpu_to_le16(SMB20_PROT_ID))
483 cifs_dbg(FYI, "negotiated smb2.0 dialect\n");
484 else if (rsp->DialectRevision == cpu_to_le16(SMB21_PROT_ID))
485 cifs_dbg(FYI, "negotiated smb2.1 dialect\n");
486 else if (rsp->DialectRevision == cpu_to_le16(SMB30_PROT_ID))
487 cifs_dbg(FYI, "negotiated smb3.0 dialect\n");
488 else if (rsp->DialectRevision == cpu_to_le16(SMB302_PROT_ID))
489 cifs_dbg(FYI, "negotiated smb3.02 dialect\n");
490 #ifdef CONFIG_CIFS_SMB311
491 else if (rsp->DialectRevision == cpu_to_le16(SMB311_PROT_ID))
492 cifs_dbg(FYI, "negotiated smb3.1.1 dialect\n");
493 #endif /* SMB311 */
494 else {
495 cifs_dbg(VFS, "Illegal dialect returned by server 0x%x\n",
496 le16_to_cpu(rsp->DialectRevision));
497 rc = -EIO;
498 goto neg_exit;
499 }
500 server->dialect = le16_to_cpu(rsp->DialectRevision);
501
502 /* SMB2 only has an extended negflavor */
503 server->negflavor = CIFS_NEGFLAVOR_EXTENDED;
504 /* set it to the maximum buffer size value we can send with 1 credit */
505 server->maxBuf = min_t(unsigned int, le32_to_cpu(rsp->MaxTransactSize),
506 SMB2_MAX_BUFFER_SIZE);
507 server->max_read = le32_to_cpu(rsp->MaxReadSize);
508 server->max_write = le32_to_cpu(rsp->MaxWriteSize);
509 /* BB Do we need to validate the SecurityMode? */
510 server->sec_mode = le16_to_cpu(rsp->SecurityMode);
511 server->capabilities = le32_to_cpu(rsp->Capabilities);
512 /* Internal types */
513 server->capabilities |= SMB2_NT_FIND | SMB2_LARGE_FILES;
514
515 security_blob = smb2_get_data_area_len(&blob_offset, &blob_length,
516 &rsp->hdr);
517 /*
518 * See MS-SMB2 section 2.2.4: if no blob, client picks default which
519 * for us will be
520 * ses->sectype = RawNTLMSSP;
521 * but for time being this is our only auth choice so doesn't matter.
522 * We just found a server which sets blob length to zero expecting raw.
523 */
524 if (blob_length == 0)
525 cifs_dbg(FYI, "missing security blob on negprot\n");
526
527 rc = cifs_enable_signing(server, ses->sign);
528 if (rc)
529 goto neg_exit;
530 if (blob_length) {
531 rc = decode_negTokenInit(security_blob, blob_length, server);
532 if (rc == 1)
533 rc = 0;
534 else if (rc == 0)
535 rc = -EIO;
536 }
537 neg_exit:
538 free_rsp_buf(resp_buftype, rsp);
539 return rc;
540 }
541
542 int smb3_validate_negotiate(const unsigned int xid, struct cifs_tcon *tcon)
543 {
544 int rc = 0;
545 struct validate_negotiate_info_req vneg_inbuf;
546 struct validate_negotiate_info_rsp *pneg_rsp;
547 u32 rsplen;
548
549 cifs_dbg(FYI, "validate negotiate\n");
550
551 /*
552 * validation ioctl must be signed, so no point sending this if we
553 * can not sign it (ie are not known user). Even if signing is not
554 * required (enabled but not negotiated), in those cases we selectively
555 * sign just this, the first and only signed request on a connection.
556 * Having validation of negotiate info helps reduce attack vectors.
557 */
558 if (tcon->ses->session_flags & SMB2_SESSION_FLAG_IS_GUEST)
559 return 0; /* validation requires signing */
560
561 if (tcon->ses->user_name == NULL) {
562 cifs_dbg(FYI, "Can't validate negotiate: null user mount\n");
563 return 0; /* validation requires signing */
564 }
565
566 if (tcon->ses->session_flags & SMB2_SESSION_FLAG_IS_NULL)
567 cifs_dbg(VFS, "Unexpected null user (anonymous) auth flag sent by server\n");
568
569 vneg_inbuf.Capabilities =
570 cpu_to_le32(tcon->ses->server->vals->req_capabilities);
571 memcpy(vneg_inbuf.Guid, tcon->ses->server->client_guid,
572 SMB2_CLIENT_GUID_SIZE);
573
574 if (tcon->ses->sign)
575 vneg_inbuf.SecurityMode =
576 cpu_to_le16(SMB2_NEGOTIATE_SIGNING_REQUIRED);
577 else if (global_secflags & CIFSSEC_MAY_SIGN)
578 vneg_inbuf.SecurityMode =
579 cpu_to_le16(SMB2_NEGOTIATE_SIGNING_ENABLED);
580 else
581 vneg_inbuf.SecurityMode = 0;
582
583 vneg_inbuf.DialectCount = cpu_to_le16(1);
584 vneg_inbuf.Dialects[0] =
585 cpu_to_le16(tcon->ses->server->vals->protocol_id);
586
587 rc = SMB2_ioctl(xid, tcon, NO_FILE_ID, NO_FILE_ID,
588 FSCTL_VALIDATE_NEGOTIATE_INFO, true /* is_fsctl */,
589 (char *)&vneg_inbuf, sizeof(struct validate_negotiate_info_req),
590 (char **)&pneg_rsp, &rsplen);
591
592 if (rc != 0) {
593 cifs_dbg(VFS, "validate protocol negotiate failed: %d\n", rc);
594 return -EIO;
595 }
596
597 if (rsplen != sizeof(struct validate_negotiate_info_rsp)) {
598 cifs_dbg(VFS, "invalid protocol negotiate response size: %d\n",
599 rsplen);
600
601 /* relax check since Mac returns max bufsize allowed on ioctl */
602 if (rsplen > CIFSMaxBufSize)
603 return -EIO;
604 }
605
606 /* check validate negotiate info response matches what we got earlier */
607 if (pneg_rsp->Dialect != cpu_to_le16(tcon->ses->server->dialect))
608 goto vneg_out;
609
610 if (pneg_rsp->SecurityMode != cpu_to_le16(tcon->ses->server->sec_mode))
611 goto vneg_out;
612
613 /* do not validate server guid because not saved at negprot time yet */
614
615 if ((le32_to_cpu(pneg_rsp->Capabilities) | SMB2_NT_FIND |
616 SMB2_LARGE_FILES) != tcon->ses->server->capabilities)
617 goto vneg_out;
618
619 /* validate negotiate successful */
620 cifs_dbg(FYI, "validate negotiate info successful\n");
621 return 0;
622
623 vneg_out:
624 cifs_dbg(VFS, "protocol revalidation - security settings mismatch\n");
625 return -EIO;
626 }
627
628 int
629 SMB2_sess_setup(const unsigned int xid, struct cifs_ses *ses,
630 const struct nls_table *nls_cp)
631 {
632 struct smb2_sess_setup_req *req;
633 struct smb2_sess_setup_rsp *rsp = NULL;
634 struct kvec iov[2];
635 int rc = 0;
636 int resp_buftype = CIFS_NO_BUFFER;
637 __le32 phase = NtLmNegotiate; /* NTLMSSP, if needed, is multistage */
638 struct TCP_Server_Info *server = ses->server;
639 u16 blob_length = 0;
640 struct key *spnego_key = NULL;
641 char *security_blob = NULL;
642 unsigned char *ntlmssp_blob = NULL;
643 bool use_spnego = false; /* else use raw ntlmssp */
644 u64 previous_session = ses->Suid;
645
646 cifs_dbg(FYI, "Session Setup\n");
647
648 if (!server) {
649 WARN(1, "%s: server is NULL!\n", __func__);
650 return -EIO;
651 }
652
653 /*
654 * If we are here due to reconnect, free per-smb session key
655 * in case signing was required.
656 */
657 kfree(ses->auth_key.response);
658 ses->auth_key.response = NULL;
659
660 /*
661 * If memory allocation is successful, caller of this function
662 * frees it.
663 */
664 ses->ntlmssp = kmalloc(sizeof(struct ntlmssp_auth), GFP_KERNEL);
665 if (!ses->ntlmssp)
666 return -ENOMEM;
667 ses->ntlmssp->sesskey_per_smbsess = true;
668
669 /* FIXME: allow for other auth types besides NTLMSSP (e.g. krb5) */
670 if (ses->sectype != Kerberos && ses->sectype != RawNTLMSSP)
671 ses->sectype = RawNTLMSSP;
672
673 ssetup_ntlmssp_authenticate:
674 if (phase == NtLmChallenge)
675 phase = NtLmAuthenticate; /* if ntlmssp, now final phase */
676
677 rc = small_smb2_init(SMB2_SESSION_SETUP, NULL, (void **) &req);
678 if (rc)
679 return rc;
680
681 req->hdr.SessionId = 0; /* First session, not a reauthenticate */
682
683 /* if reconnect, we need to send previous sess id, otherwise it is 0 */
684 req->PreviousSessionId = previous_session;
685
686 req->Flags = 0; /* MBZ */
687 /* to enable echos and oplocks */
688 req->hdr.CreditRequest = cpu_to_le16(3);
689
690 /* only one of SMB2 signing flags may be set in SMB2 request */
691 if (server->sign)
692 req->SecurityMode = SMB2_NEGOTIATE_SIGNING_REQUIRED;
693 else if (global_secflags & CIFSSEC_MAY_SIGN) /* one flag unlike MUST_ */
694 req->SecurityMode = SMB2_NEGOTIATE_SIGNING_ENABLED;
695 else
696 req->SecurityMode = 0;
697
698 #ifdef CONFIG_CIFS_DFS_UPCALL
699 req->Capabilities = cpu_to_le32(SMB2_GLOBAL_CAP_DFS);
700 #else
701 req->Capabilities = 0;
702 #endif /* DFS_UPCALL */
703
704 req->Channel = 0; /* MBZ */
705
706 iov[0].iov_base = (char *)req;
707 /* 4 for rfc1002 length field and 1 for pad */
708 iov[0].iov_len = get_rfc1002_length(req) + 4 - 1;
709
710 if (ses->sectype == Kerberos) {
711 #ifdef CONFIG_CIFS_UPCALL
712 struct cifs_spnego_msg *msg;
713
714 spnego_key = cifs_get_spnego_key(ses);
715 if (IS_ERR(spnego_key)) {
716 rc = PTR_ERR(spnego_key);
717 spnego_key = NULL;
718 goto ssetup_exit;
719 }
720
721 msg = spnego_key->payload.data[0];
722 /*
723 * check version field to make sure that cifs.upcall is
724 * sending us a response in an expected form
725 */
726 if (msg->version != CIFS_SPNEGO_UPCALL_VERSION) {
727 cifs_dbg(VFS,
728 "bad cifs.upcall version. Expected %d got %d",
729 CIFS_SPNEGO_UPCALL_VERSION, msg->version);
730 rc = -EKEYREJECTED;
731 goto ssetup_exit;
732 }
733 ses->auth_key.response = kmemdup(msg->data, msg->sesskey_len,
734 GFP_KERNEL);
735 if (!ses->auth_key.response) {
736 cifs_dbg(VFS,
737 "Kerberos can't allocate (%u bytes) memory",
738 msg->sesskey_len);
739 rc = -ENOMEM;
740 goto ssetup_exit;
741 }
742 ses->auth_key.len = msg->sesskey_len;
743 blob_length = msg->secblob_len;
744 iov[1].iov_base = msg->data + msg->sesskey_len;
745 iov[1].iov_len = blob_length;
746 #else
747 rc = -EOPNOTSUPP;
748 goto ssetup_exit;
749 #endif /* CONFIG_CIFS_UPCALL */
750 } else if (phase == NtLmNegotiate) { /* if not krb5 must be ntlmssp */
751 ntlmssp_blob = kmalloc(sizeof(struct _NEGOTIATE_MESSAGE),
752 GFP_KERNEL);
753 if (ntlmssp_blob == NULL) {
754 rc = -ENOMEM;
755 goto ssetup_exit;
756 }
757 build_ntlmssp_negotiate_blob(ntlmssp_blob, ses);
758 if (use_spnego) {
759 /* blob_length = build_spnego_ntlmssp_blob(
760 &security_blob,
761 sizeof(struct _NEGOTIATE_MESSAGE),
762 ntlmssp_blob); */
763 /* BB eventually need to add this */
764 cifs_dbg(VFS, "spnego not supported for SMB2 yet\n");
765 rc = -EOPNOTSUPP;
766 kfree(ntlmssp_blob);
767 goto ssetup_exit;
768 } else {
769 blob_length = sizeof(struct _NEGOTIATE_MESSAGE);
770 /* with raw NTLMSSP we don't encapsulate in SPNEGO */
771 security_blob = ntlmssp_blob;
772 }
773 iov[1].iov_base = security_blob;
774 iov[1].iov_len = blob_length;
775 } else if (phase == NtLmAuthenticate) {
776 req->hdr.SessionId = ses->Suid;
777 rc = build_ntlmssp_auth_blob(&ntlmssp_blob, &blob_length, ses,
778 nls_cp);
779 if (rc) {
780 cifs_dbg(FYI, "build_ntlmssp_auth_blob failed %d\n",
781 rc);
782 goto ssetup_exit; /* BB double check error handling */
783 }
784 if (use_spnego) {
785 /* blob_length = build_spnego_ntlmssp_blob(
786 &security_blob,
787 blob_length,
788 ntlmssp_blob); */
789 cifs_dbg(VFS, "spnego not supported for SMB2 yet\n");
790 rc = -EOPNOTSUPP;
791 kfree(ntlmssp_blob);
792 goto ssetup_exit;
793 } else {
794 security_blob = ntlmssp_blob;
795 }
796 iov[1].iov_base = security_blob;
797 iov[1].iov_len = blob_length;
798 } else {
799 cifs_dbg(VFS, "illegal ntlmssp phase\n");
800 rc = -EIO;
801 goto ssetup_exit;
802 }
803
804 /* Testing shows that buffer offset must be at location of Buffer[0] */
805 req->SecurityBufferOffset =
806 cpu_to_le16(sizeof(struct smb2_sess_setup_req) -
807 1 /* pad */ - 4 /* rfc1001 len */);
808 req->SecurityBufferLength = cpu_to_le16(blob_length);
809
810 inc_rfc1001_len(req, blob_length - 1 /* pad */);
811
812 /* BB add code to build os and lm fields */
813
814 rc = SendReceive2(xid, ses, iov, 2, &resp_buftype,
815 CIFS_LOG_ERROR | CIFS_NEG_OP);
816
817 kfree(security_blob);
818 rsp = (struct smb2_sess_setup_rsp *)iov[0].iov_base;
819 ses->Suid = rsp->hdr.SessionId;
820 if (resp_buftype != CIFS_NO_BUFFER &&
821 rsp->hdr.Status == STATUS_MORE_PROCESSING_REQUIRED) {
822 if (phase != NtLmNegotiate) {
823 cifs_dbg(VFS, "Unexpected more processing error\n");
824 goto ssetup_exit;
825 }
826 if (offsetof(struct smb2_sess_setup_rsp, Buffer) - 4 !=
827 le16_to_cpu(rsp->SecurityBufferOffset)) {
828 cifs_dbg(VFS, "Invalid security buffer offset %d\n",
829 le16_to_cpu(rsp->SecurityBufferOffset));
830 rc = -EIO;
831 goto ssetup_exit;
832 }
833
834 /* NTLMSSP Negotiate sent now processing challenge (response) */
835 phase = NtLmChallenge; /* process ntlmssp challenge */
836 rc = 0; /* MORE_PROCESSING is not an error here but expected */
837 rc = decode_ntlmssp_challenge(rsp->Buffer,
838 le16_to_cpu(rsp->SecurityBufferLength), ses);
839 }
840
841 /*
842 * BB eventually add code for SPNEGO decoding of NtlmChallenge blob,
843 * but at least the raw NTLMSSP case works.
844 */
845 /*
846 * No tcon so can't do
847 * cifs_stats_inc(&tcon->stats.smb2_stats.smb2_com_fail[SMB2...]);
848 */
849 if (rc != 0)
850 goto ssetup_exit;
851
852 ses->session_flags = le16_to_cpu(rsp->SessionFlags);
853 if (ses->session_flags & SMB2_SESSION_FLAG_ENCRYPT_DATA)
854 cifs_dbg(VFS, "SMB3 encryption not supported yet\n");
855 ssetup_exit:
856 free_rsp_buf(resp_buftype, rsp);
857
858 /* if ntlmssp, and negotiate succeeded, proceed to authenticate phase */
859 if ((phase == NtLmChallenge) && (rc == 0))
860 goto ssetup_ntlmssp_authenticate;
861
862 if (!rc) {
863 mutex_lock(&server->srv_mutex);
864 if (server->ops->generate_signingkey) {
865 rc = server->ops->generate_signingkey(ses);
866 if (rc) {
867 cifs_dbg(FYI,
868 "SMB3 session key generation failed\n");
869 mutex_unlock(&server->srv_mutex);
870 goto keygen_exit;
871 }
872 }
873 if (!server->session_estab) {
874 server->sequence_number = 0x2;
875 server->session_estab = true;
876 }
877 mutex_unlock(&server->srv_mutex);
878
879 cifs_dbg(FYI, "SMB2/3 session established successfully\n");
880 spin_lock(&GlobalMid_Lock);
881 ses->status = CifsGood;
882 ses->need_reconnect = false;
883 spin_unlock(&GlobalMid_Lock);
884 }
885
886 keygen_exit:
887 if (spnego_key) {
888 key_invalidate(spnego_key);
889 key_put(spnego_key);
890 }
891 kfree(ses->ntlmssp);
892
893 return rc;
894 }
895
896 int
897 SMB2_logoff(const unsigned int xid, struct cifs_ses *ses)
898 {
899 struct smb2_logoff_req *req; /* response is also trivial struct */
900 int rc = 0;
901 struct TCP_Server_Info *server;
902
903 cifs_dbg(FYI, "disconnect session %p\n", ses);
904
905 if (ses && (ses->server))
906 server = ses->server;
907 else
908 return -EIO;
909
910 /* no need to send SMB logoff if uid already closed due to reconnect */
911 if (ses->need_reconnect)
912 goto smb2_session_already_dead;
913
914 rc = small_smb2_init(SMB2_LOGOFF, NULL, (void **) &req);
915 if (rc)
916 return rc;
917
918 /* since no tcon, smb2_init can not do this, so do here */
919 req->hdr.SessionId = ses->Suid;
920 if (server->sign)
921 req->hdr.Flags |= SMB2_FLAGS_SIGNED;
922
923 rc = SendReceiveNoRsp(xid, ses, (char *) &req->hdr, 0);
924 /*
925 * No tcon so can't do
926 * cifs_stats_inc(&tcon->stats.smb2_stats.smb2_com_fail[SMB2...]);
927 */
928
929 smb2_session_already_dead:
930 return rc;
931 }
932
933 static inline void cifs_stats_fail_inc(struct cifs_tcon *tcon, uint16_t code)
934 {
935 cifs_stats_inc(&tcon->stats.smb2_stats.smb2_com_failed[code]);
936 }
937
938 #define MAX_SHARENAME_LENGTH (255 /* server */ + 80 /* share */ + 1 /* NULL */)
939
940 /* These are similar values to what Windows uses */
941 static inline void init_copy_chunk_defaults(struct cifs_tcon *tcon)
942 {
943 tcon->max_chunks = 256;
944 tcon->max_bytes_chunk = 1048576;
945 tcon->max_bytes_copy = 16777216;
946 }
947
948 int
949 SMB2_tcon(const unsigned int xid, struct cifs_ses *ses, const char *tree,
950 struct cifs_tcon *tcon, const struct nls_table *cp)
951 {
952 struct smb2_tree_connect_req *req;
953 struct smb2_tree_connect_rsp *rsp = NULL;
954 struct kvec iov[2];
955 int rc = 0;
956 int resp_buftype;
957 int unc_path_len;
958 struct TCP_Server_Info *server;
959 __le16 *unc_path = NULL;
960
961 cifs_dbg(FYI, "TCON\n");
962
963 if ((ses->server) && tree)
964 server = ses->server;
965 else
966 return -EIO;
967
968 if ((tcon && tcon->seal) &&
969 ((ses->server->capabilities & SMB2_GLOBAL_CAP_ENCRYPTION) == 0)) {
970 cifs_dbg(VFS, "encryption requested but no server support");
971 return -EOPNOTSUPP;
972 }
973
974 unc_path = kmalloc(MAX_SHARENAME_LENGTH * 2, GFP_KERNEL);
975 if (unc_path == NULL)
976 return -ENOMEM;
977
978 unc_path_len = cifs_strtoUTF16(unc_path, tree, strlen(tree), cp) + 1;
979 unc_path_len *= 2;
980 if (unc_path_len < 2) {
981 kfree(unc_path);
982 return -EINVAL;
983 }
984
985 /* SMB2 TREE_CONNECT request must be called with TreeId == 0 */
986 if (tcon)
987 tcon->tid = 0;
988
989 rc = small_smb2_init(SMB2_TREE_CONNECT, tcon, (void **) &req);
990 if (rc) {
991 kfree(unc_path);
992 return rc;
993 }
994
995 if (tcon == NULL) {
996 /* since no tcon, smb2_init can not do this, so do here */
997 req->hdr.SessionId = ses->Suid;
998 /* if (ses->server->sec_mode & SECMODE_SIGN_REQUIRED)
999 req->hdr.Flags |= SMB2_FLAGS_SIGNED; */
1000 }
1001
1002 iov[0].iov_base = (char *)req;
1003 /* 4 for rfc1002 length field and 1 for pad */
1004 iov[0].iov_len = get_rfc1002_length(req) + 4 - 1;
1005
1006 /* Testing shows that buffer offset must be at location of Buffer[0] */
1007 req->PathOffset = cpu_to_le16(sizeof(struct smb2_tree_connect_req)
1008 - 1 /* pad */ - 4 /* do not count rfc1001 len field */);
1009 req->PathLength = cpu_to_le16(unc_path_len - 2);
1010 iov[1].iov_base = unc_path;
1011 iov[1].iov_len = unc_path_len;
1012
1013 inc_rfc1001_len(req, unc_path_len - 1 /* pad */);
1014
1015 rc = SendReceive2(xid, ses, iov, 2, &resp_buftype, 0);
1016 rsp = (struct smb2_tree_connect_rsp *)iov[0].iov_base;
1017
1018 if (rc != 0) {
1019 if (tcon) {
1020 cifs_stats_fail_inc(tcon, SMB2_TREE_CONNECT_HE);
1021 tcon->need_reconnect = true;
1022 }
1023 goto tcon_error_exit;
1024 }
1025
1026 if (tcon == NULL) {
1027 ses->ipc_tid = rsp->hdr.TreeId;
1028 goto tcon_exit;
1029 }
1030
1031 switch (rsp->ShareType) {
1032 case SMB2_SHARE_TYPE_DISK:
1033 cifs_dbg(FYI, "connection to disk share\n");
1034 break;
1035 case SMB2_SHARE_TYPE_PIPE:
1036 tcon->ipc = true;
1037 cifs_dbg(FYI, "connection to pipe share\n");
1038 break;
1039 case SMB2_SHARE_TYPE_PRINT:
1040 tcon->ipc = true;
1041 cifs_dbg(FYI, "connection to printer\n");
1042 break;
1043 default:
1044 cifs_dbg(VFS, "unknown share type %d\n", rsp->ShareType);
1045 rc = -EOPNOTSUPP;
1046 goto tcon_error_exit;
1047 }
1048
1049 tcon->share_flags = le32_to_cpu(rsp->ShareFlags);
1050 tcon->capabilities = rsp->Capabilities; /* we keep caps little endian */
1051 tcon->maximal_access = le32_to_cpu(rsp->MaximalAccess);
1052 tcon->tidStatus = CifsGood;
1053 tcon->need_reconnect = false;
1054 tcon->tid = rsp->hdr.TreeId;
1055 strlcpy(tcon->treeName, tree, sizeof(tcon->treeName));
1056
1057 if ((rsp->Capabilities & SMB2_SHARE_CAP_DFS) &&
1058 ((tcon->share_flags & SHI1005_FLAGS_DFS) == 0))
1059 cifs_dbg(VFS, "DFS capability contradicts DFS flag\n");
1060 init_copy_chunk_defaults(tcon);
1061 if (tcon->share_flags & SHI1005_FLAGS_ENCRYPT_DATA)
1062 cifs_dbg(VFS, "Encrypted shares not supported");
1063 if (tcon->ses->server->ops->validate_negotiate)
1064 rc = tcon->ses->server->ops->validate_negotiate(xid, tcon);
1065 tcon_exit:
1066 free_rsp_buf(resp_buftype, rsp);
1067 kfree(unc_path);
1068 return rc;
1069
1070 tcon_error_exit:
1071 if (rsp->hdr.Status == STATUS_BAD_NETWORK_NAME) {
1072 cifs_dbg(VFS, "BAD_NETWORK_NAME: %s\n", tree);
1073 }
1074 goto tcon_exit;
1075 }
1076
1077 int
1078 SMB2_tdis(const unsigned int xid, struct cifs_tcon *tcon)
1079 {
1080 struct smb2_tree_disconnect_req *req; /* response is trivial */
1081 int rc = 0;
1082 struct TCP_Server_Info *server;
1083 struct cifs_ses *ses = tcon->ses;
1084
1085 cifs_dbg(FYI, "Tree Disconnect\n");
1086
1087 if (ses && (ses->server))
1088 server = ses->server;
1089 else
1090 return -EIO;
1091
1092 if ((tcon->need_reconnect) || (tcon->ses->need_reconnect))
1093 return 0;
1094
1095 rc = small_smb2_init(SMB2_TREE_DISCONNECT, tcon, (void **) &req);
1096 if (rc)
1097 return rc;
1098
1099 rc = SendReceiveNoRsp(xid, ses, (char *)&req->hdr, 0);
1100 if (rc)
1101 cifs_stats_fail_inc(tcon, SMB2_TREE_DISCONNECT_HE);
1102
1103 return rc;
1104 }
1105
1106
1107 static struct create_durable *
1108 create_durable_buf(void)
1109 {
1110 struct create_durable *buf;
1111
1112 buf = kzalloc(sizeof(struct create_durable), GFP_KERNEL);
1113 if (!buf)
1114 return NULL;
1115
1116 buf->ccontext.DataOffset = cpu_to_le16(offsetof
1117 (struct create_durable, Data));
1118 buf->ccontext.DataLength = cpu_to_le32(16);
1119 buf->ccontext.NameOffset = cpu_to_le16(offsetof
1120 (struct create_durable, Name));
1121 buf->ccontext.NameLength = cpu_to_le16(4);
1122 /* SMB2_CREATE_DURABLE_HANDLE_REQUEST is "DHnQ" */
1123 buf->Name[0] = 'D';
1124 buf->Name[1] = 'H';
1125 buf->Name[2] = 'n';
1126 buf->Name[3] = 'Q';
1127 return buf;
1128 }
1129
1130 static struct create_durable *
1131 create_reconnect_durable_buf(struct cifs_fid *fid)
1132 {
1133 struct create_durable *buf;
1134
1135 buf = kzalloc(sizeof(struct create_durable), GFP_KERNEL);
1136 if (!buf)
1137 return NULL;
1138
1139 buf->ccontext.DataOffset = cpu_to_le16(offsetof
1140 (struct create_durable, Data));
1141 buf->ccontext.DataLength = cpu_to_le32(16);
1142 buf->ccontext.NameOffset = cpu_to_le16(offsetof
1143 (struct create_durable, Name));
1144 buf->ccontext.NameLength = cpu_to_le16(4);
1145 buf->Data.Fid.PersistentFileId = fid->persistent_fid;
1146 buf->Data.Fid.VolatileFileId = fid->volatile_fid;
1147 /* SMB2_CREATE_DURABLE_HANDLE_RECONNECT is "DHnC" */
1148 buf->Name[0] = 'D';
1149 buf->Name[1] = 'H';
1150 buf->Name[2] = 'n';
1151 buf->Name[3] = 'C';
1152 return buf;
1153 }
1154
1155 static __u8
1156 parse_lease_state(struct TCP_Server_Info *server, struct smb2_create_rsp *rsp,
1157 unsigned int *epoch)
1158 {
1159 char *data_offset;
1160 struct create_context *cc;
1161 unsigned int next;
1162 unsigned int remaining;
1163 char *name;
1164
1165 data_offset = (char *)rsp + 4 + le32_to_cpu(rsp->CreateContextsOffset);
1166 remaining = le32_to_cpu(rsp->CreateContextsLength);
1167 cc = (struct create_context *)data_offset;
1168 while (remaining >= sizeof(struct create_context)) {
1169 name = le16_to_cpu(cc->NameOffset) + (char *)cc;
1170 if (le16_to_cpu(cc->NameLength) == 4 &&
1171 strncmp(name, "RqLs", 4) == 0)
1172 return server->ops->parse_lease_buf(cc, epoch);
1173
1174 next = le32_to_cpu(cc->Next);
1175 if (!next)
1176 break;
1177 remaining -= next;
1178 cc = (struct create_context *)((char *)cc + next);
1179 }
1180
1181 return 0;
1182 }
1183
1184 static int
1185 add_lease_context(struct TCP_Server_Info *server, struct kvec *iov,
1186 unsigned int *num_iovec, __u8 *oplock)
1187 {
1188 struct smb2_create_req *req = iov[0].iov_base;
1189 unsigned int num = *num_iovec;
1190
1191 iov[num].iov_base = server->ops->create_lease_buf(oplock+1, *oplock);
1192 if (iov[num].iov_base == NULL)
1193 return -ENOMEM;
1194 iov[num].iov_len = server->vals->create_lease_size;
1195 req->RequestedOplockLevel = SMB2_OPLOCK_LEVEL_LEASE;
1196 if (!req->CreateContextsOffset)
1197 req->CreateContextsOffset = cpu_to_le32(
1198 sizeof(struct smb2_create_req) - 4 +
1199 iov[num - 1].iov_len);
1200 le32_add_cpu(&req->CreateContextsLength,
1201 server->vals->create_lease_size);
1202 inc_rfc1001_len(&req->hdr, server->vals->create_lease_size);
1203 *num_iovec = num + 1;
1204 return 0;
1205 }
1206
1207 static struct create_durable_v2 *
1208 create_durable_v2_buf(struct cifs_fid *pfid)
1209 {
1210 struct create_durable_v2 *buf;
1211
1212 buf = kzalloc(sizeof(struct create_durable_v2), GFP_KERNEL);
1213 if (!buf)
1214 return NULL;
1215
1216 buf->ccontext.DataOffset = cpu_to_le16(offsetof
1217 (struct create_durable_v2, dcontext));
1218 buf->ccontext.DataLength = cpu_to_le32(sizeof(struct durable_context_v2));
1219 buf->ccontext.NameOffset = cpu_to_le16(offsetof
1220 (struct create_durable_v2, Name));
1221 buf->ccontext.NameLength = cpu_to_le16(4);
1222
1223 buf->dcontext.Timeout = 0; /* Should this be configurable by workload */
1224 buf->dcontext.Flags = cpu_to_le32(SMB2_DHANDLE_FLAG_PERSISTENT);
1225 generate_random_uuid(buf->dcontext.CreateGuid);
1226 memcpy(pfid->create_guid, buf->dcontext.CreateGuid, 16);
1227
1228 /* SMB2_CREATE_DURABLE_HANDLE_REQUEST is "DH2Q" */
1229 buf->Name[0] = 'D';
1230 buf->Name[1] = 'H';
1231 buf->Name[2] = '2';
1232 buf->Name[3] = 'Q';
1233 return buf;
1234 }
1235
1236 static struct create_durable_handle_reconnect_v2 *
1237 create_reconnect_durable_v2_buf(struct cifs_fid *fid)
1238 {
1239 struct create_durable_handle_reconnect_v2 *buf;
1240
1241 buf = kzalloc(sizeof(struct create_durable_handle_reconnect_v2),
1242 GFP_KERNEL);
1243 if (!buf)
1244 return NULL;
1245
1246 buf->ccontext.DataOffset =
1247 cpu_to_le16(offsetof(struct create_durable_handle_reconnect_v2,
1248 dcontext));
1249 buf->ccontext.DataLength =
1250 cpu_to_le32(sizeof(struct durable_reconnect_context_v2));
1251 buf->ccontext.NameOffset =
1252 cpu_to_le16(offsetof(struct create_durable_handle_reconnect_v2,
1253 Name));
1254 buf->ccontext.NameLength = cpu_to_le16(4);
1255
1256 buf->dcontext.Fid.PersistentFileId = fid->persistent_fid;
1257 buf->dcontext.Fid.VolatileFileId = fid->volatile_fid;
1258 buf->dcontext.Flags = cpu_to_le32(SMB2_DHANDLE_FLAG_PERSISTENT);
1259 memcpy(buf->dcontext.CreateGuid, fid->create_guid, 16);
1260
1261 /* SMB2_CREATE_DURABLE_HANDLE_RECONNECT_V2 is "DH2C" */
1262 buf->Name[0] = 'D';
1263 buf->Name[1] = 'H';
1264 buf->Name[2] = '2';
1265 buf->Name[3] = 'C';
1266 return buf;
1267 }
1268
1269 static int
1270 add_durable_v2_context(struct kvec *iov, unsigned int *num_iovec,
1271 struct cifs_open_parms *oparms)
1272 {
1273 struct smb2_create_req *req = iov[0].iov_base;
1274 unsigned int num = *num_iovec;
1275
1276 iov[num].iov_base = create_durable_v2_buf(oparms->fid);
1277 if (iov[num].iov_base == NULL)
1278 return -ENOMEM;
1279 iov[num].iov_len = sizeof(struct create_durable_v2);
1280 if (!req->CreateContextsOffset)
1281 req->CreateContextsOffset =
1282 cpu_to_le32(sizeof(struct smb2_create_req) - 4 +
1283 iov[1].iov_len);
1284 le32_add_cpu(&req->CreateContextsLength, sizeof(struct create_durable_v2));
1285 inc_rfc1001_len(&req->hdr, sizeof(struct create_durable_v2));
1286 *num_iovec = num + 1;
1287 return 0;
1288 }
1289
1290 static int
1291 add_durable_reconnect_v2_context(struct kvec *iov, unsigned int *num_iovec,
1292 struct cifs_open_parms *oparms)
1293 {
1294 struct smb2_create_req *req = iov[0].iov_base;
1295 unsigned int num = *num_iovec;
1296
1297 /* indicate that we don't need to relock the file */
1298 oparms->reconnect = false;
1299
1300 iov[num].iov_base = create_reconnect_durable_v2_buf(oparms->fid);
1301 if (iov[num].iov_base == NULL)
1302 return -ENOMEM;
1303 iov[num].iov_len = sizeof(struct create_durable_handle_reconnect_v2);
1304 if (!req->CreateContextsOffset)
1305 req->CreateContextsOffset =
1306 cpu_to_le32(sizeof(struct smb2_create_req) - 4 +
1307 iov[1].iov_len);
1308 le32_add_cpu(&req->CreateContextsLength,
1309 sizeof(struct create_durable_handle_reconnect_v2));
1310 inc_rfc1001_len(&req->hdr,
1311 sizeof(struct create_durable_handle_reconnect_v2));
1312 *num_iovec = num + 1;
1313 return 0;
1314 }
1315
1316 static int
1317 add_durable_context(struct kvec *iov, unsigned int *num_iovec,
1318 struct cifs_open_parms *oparms, bool use_persistent)
1319 {
1320 struct smb2_create_req *req = iov[0].iov_base;
1321 unsigned int num = *num_iovec;
1322
1323 if (use_persistent) {
1324 if (oparms->reconnect)
1325 return add_durable_reconnect_v2_context(iov, num_iovec,
1326 oparms);
1327 else
1328 return add_durable_v2_context(iov, num_iovec, oparms);
1329 }
1330
1331 if (oparms->reconnect) {
1332 iov[num].iov_base = create_reconnect_durable_buf(oparms->fid);
1333 /* indicate that we don't need to relock the file */
1334 oparms->reconnect = false;
1335 } else
1336 iov[num].iov_base = create_durable_buf();
1337 if (iov[num].iov_base == NULL)
1338 return -ENOMEM;
1339 iov[num].iov_len = sizeof(struct create_durable);
1340 if (!req->CreateContextsOffset)
1341 req->CreateContextsOffset =
1342 cpu_to_le32(sizeof(struct smb2_create_req) - 4 +
1343 iov[1].iov_len);
1344 le32_add_cpu(&req->CreateContextsLength, sizeof(struct create_durable));
1345 inc_rfc1001_len(&req->hdr, sizeof(struct create_durable));
1346 *num_iovec = num + 1;
1347 return 0;
1348 }
1349
1350 int
1351 SMB2_open(const unsigned int xid, struct cifs_open_parms *oparms, __le16 *path,
1352 __u8 *oplock, struct smb2_file_all_info *buf,
1353 struct smb2_err_rsp **err_buf)
1354 {
1355 struct smb2_create_req *req;
1356 struct smb2_create_rsp *rsp;
1357 struct TCP_Server_Info *server;
1358 struct cifs_tcon *tcon = oparms->tcon;
1359 struct cifs_ses *ses = tcon->ses;
1360 struct kvec iov[4];
1361 int resp_buftype;
1362 int uni_path_len;
1363 __le16 *copy_path = NULL;
1364 int copy_size;
1365 int rc = 0;
1366 unsigned int num_iovecs = 2;
1367 __u32 file_attributes = 0;
1368 char *dhc_buf = NULL, *lc_buf = NULL;
1369
1370 cifs_dbg(FYI, "create/open\n");
1371
1372 if (ses && (ses->server))
1373 server = ses->server;
1374 else
1375 return -EIO;
1376
1377 rc = small_smb2_init(SMB2_CREATE, tcon, (void **) &req);
1378 if (rc)
1379 return rc;
1380
1381 if (oparms->create_options & CREATE_OPTION_READONLY)
1382 file_attributes |= ATTR_READONLY;
1383 if (oparms->create_options & CREATE_OPTION_SPECIAL)
1384 file_attributes |= ATTR_SYSTEM;
1385
1386 req->ImpersonationLevel = IL_IMPERSONATION;
1387 req->DesiredAccess = cpu_to_le32(oparms->desired_access);
1388 /* File attributes ignored on open (used in create though) */
1389 req->FileAttributes = cpu_to_le32(file_attributes);
1390 req->ShareAccess = FILE_SHARE_ALL_LE;
1391 req->CreateDisposition = cpu_to_le32(oparms->disposition);
1392 req->CreateOptions = cpu_to_le32(oparms->create_options & CREATE_OPTIONS_MASK);
1393 uni_path_len = (2 * UniStrnlen((wchar_t *)path, PATH_MAX)) + 2;
1394 /* do not count rfc1001 len field */
1395 req->NameOffset = cpu_to_le16(sizeof(struct smb2_create_req) - 4);
1396
1397 iov[0].iov_base = (char *)req;
1398 /* 4 for rfc1002 length field */
1399 iov[0].iov_len = get_rfc1002_length(req) + 4;
1400
1401 /* MUST set path len (NameLength) to 0 opening root of share */
1402 req->NameLength = cpu_to_le16(uni_path_len - 2);
1403 /* -1 since last byte is buf[0] which is sent below (path) */
1404 iov[0].iov_len--;
1405 if (uni_path_len % 8 != 0) {
1406 copy_size = uni_path_len / 8 * 8;
1407 if (copy_size < uni_path_len)
1408 copy_size += 8;
1409
1410 copy_path = kzalloc(copy_size, GFP_KERNEL);
1411 if (!copy_path)
1412 return -ENOMEM;
1413 memcpy((char *)copy_path, (const char *)path,
1414 uni_path_len);
1415 uni_path_len = copy_size;
1416 path = copy_path;
1417 }
1418
1419 iov[1].iov_len = uni_path_len;
1420 iov[1].iov_base = path;
1421 /* -1 since last byte is buf[0] which was counted in smb2_buf_len */
1422 inc_rfc1001_len(req, uni_path_len - 1);
1423
1424 if (!server->oplocks)
1425 *oplock = SMB2_OPLOCK_LEVEL_NONE;
1426
1427 if (!(server->capabilities & SMB2_GLOBAL_CAP_LEASING) ||
1428 *oplock == SMB2_OPLOCK_LEVEL_NONE)
1429 req->RequestedOplockLevel = *oplock;
1430 else {
1431 rc = add_lease_context(server, iov, &num_iovecs, oplock);
1432 if (rc) {
1433 cifs_small_buf_release(req);
1434 kfree(copy_path);
1435 return rc;
1436 }
1437 lc_buf = iov[num_iovecs-1].iov_base;
1438 }
1439
1440 if (*oplock == SMB2_OPLOCK_LEVEL_BATCH) {
1441 /* need to set Next field of lease context if we request it */
1442 if (server->capabilities & SMB2_GLOBAL_CAP_LEASING) {
1443 struct create_context *ccontext =
1444 (struct create_context *)iov[num_iovecs-1].iov_base;
1445 ccontext->Next =
1446 cpu_to_le32(server->vals->create_lease_size);
1447 }
1448
1449 rc = add_durable_context(iov, &num_iovecs, oparms,
1450 tcon->use_persistent);
1451 if (rc) {
1452 cifs_small_buf_release(req);
1453 kfree(copy_path);
1454 kfree(lc_buf);
1455 return rc;
1456 }
1457 dhc_buf = iov[num_iovecs-1].iov_base;
1458 }
1459
1460 rc = SendReceive2(xid, ses, iov, num_iovecs, &resp_buftype, 0);
1461 rsp = (struct smb2_create_rsp *)iov[0].iov_base;
1462
1463 if (rc != 0) {
1464 cifs_stats_fail_inc(tcon, SMB2_CREATE_HE);
1465 if (err_buf)
1466 *err_buf = kmemdup(rsp, get_rfc1002_length(rsp) + 4,
1467 GFP_KERNEL);
1468 goto creat_exit;
1469 }
1470
1471 oparms->fid->persistent_fid = rsp->PersistentFileId;
1472 oparms->fid->volatile_fid = rsp->VolatileFileId;
1473
1474 if (buf) {
1475 memcpy(buf, &rsp->CreationTime, 32);
1476 buf->AllocationSize = rsp->AllocationSize;
1477 buf->EndOfFile = rsp->EndofFile;
1478 buf->Attributes = rsp->FileAttributes;
1479 buf->NumberOfLinks = cpu_to_le32(1);
1480 buf->DeletePending = 0;
1481 }
1482
1483 if (rsp->OplockLevel == SMB2_OPLOCK_LEVEL_LEASE)
1484 *oplock = parse_lease_state(server, rsp, &oparms->fid->epoch);
1485 else
1486 *oplock = rsp->OplockLevel;
1487 creat_exit:
1488 kfree(copy_path);
1489 kfree(lc_buf);
1490 kfree(dhc_buf);
1491 free_rsp_buf(resp_buftype, rsp);
1492 return rc;
1493 }
1494
1495 /*
1496 * SMB2 IOCTL is used for both IOCTLs and FSCTLs
1497 */
1498 int
1499 SMB2_ioctl(const unsigned int xid, struct cifs_tcon *tcon, u64 persistent_fid,
1500 u64 volatile_fid, u32 opcode, bool is_fsctl, char *in_data,
1501 u32 indatalen, char **out_data, u32 *plen /* returned data len */)
1502 {
1503 struct smb2_ioctl_req *req;
1504 struct smb2_ioctl_rsp *rsp;
1505 struct TCP_Server_Info *server;
1506 struct cifs_ses *ses;
1507 struct kvec iov[2];
1508 int resp_buftype;
1509 int num_iovecs;
1510 int rc = 0;
1511
1512 cifs_dbg(FYI, "SMB2 IOCTL\n");
1513
1514 if (out_data != NULL)
1515 *out_data = NULL;
1516
1517 /* zero out returned data len, in case of error */
1518 if (plen)
1519 *plen = 0;
1520
1521 if (tcon)
1522 ses = tcon->ses;
1523 else
1524 return -EIO;
1525
1526 if (ses && (ses->server))
1527 server = ses->server;
1528 else
1529 return -EIO;
1530
1531 rc = small_smb2_init(SMB2_IOCTL, tcon, (void **) &req);
1532 if (rc)
1533 return rc;
1534
1535 req->CtlCode = cpu_to_le32(opcode);
1536 req->PersistentFileId = persistent_fid;
1537 req->VolatileFileId = volatile_fid;
1538
1539 if (indatalen) {
1540 req->InputCount = cpu_to_le32(indatalen);
1541 /* do not set InputOffset if no input data */
1542 req->InputOffset =
1543 cpu_to_le32(offsetof(struct smb2_ioctl_req, Buffer) - 4);
1544 iov[1].iov_base = in_data;
1545 iov[1].iov_len = indatalen;
1546 num_iovecs = 2;
1547 } else
1548 num_iovecs = 1;
1549
1550 req->OutputOffset = 0;
1551 req->OutputCount = 0; /* MBZ */
1552
1553 /*
1554 * Could increase MaxOutputResponse, but that would require more
1555 * than one credit. Windows typically sets this smaller, but for some
1556 * ioctls it may be useful to allow server to send more. No point
1557 * limiting what the server can send as long as fits in one credit
1558 * Unfortunately - we can not handle more than CIFS_MAX_MSG_SIZE
1559 * (by default, note that it can be overridden to make max larger)
1560 * in responses (except for read responses which can be bigger.
1561 * We may want to bump this limit up
1562 */
1563 req->MaxOutputResponse = cpu_to_le32(CIFSMaxBufSize);
1564
1565 if (is_fsctl)
1566 req->Flags = cpu_to_le32(SMB2_0_IOCTL_IS_FSCTL);
1567 else
1568 req->Flags = 0;
1569
1570 iov[0].iov_base = (char *)req;
1571
1572 /*
1573 * If no input data, the size of ioctl struct in
1574 * protocol spec still includes a 1 byte data buffer,
1575 * but if input data passed to ioctl, we do not
1576 * want to double count this, so we do not send
1577 * the dummy one byte of data in iovec[0] if sending
1578 * input data (in iovec[1]). We also must add 4 bytes
1579 * in first iovec to allow for rfc1002 length field.
1580 */
1581
1582 if (indatalen) {
1583 iov[0].iov_len = get_rfc1002_length(req) + 4 - 1;
1584 inc_rfc1001_len(req, indatalen - 1);
1585 } else
1586 iov[0].iov_len = get_rfc1002_length(req) + 4;
1587
1588 /* validate negotiate request must be signed - see MS-SMB2 3.2.5.5 */
1589 if (opcode == FSCTL_VALIDATE_NEGOTIATE_INFO)
1590 req->hdr.Flags |= SMB2_FLAGS_SIGNED;
1591
1592 rc = SendReceive2(xid, ses, iov, num_iovecs, &resp_buftype, 0);
1593 rsp = (struct smb2_ioctl_rsp *)iov[0].iov_base;
1594
1595 if ((rc != 0) && (rc != -EINVAL)) {
1596 cifs_stats_fail_inc(tcon, SMB2_IOCTL_HE);
1597 goto ioctl_exit;
1598 } else if (rc == -EINVAL) {
1599 if ((opcode != FSCTL_SRV_COPYCHUNK_WRITE) &&
1600 (opcode != FSCTL_SRV_COPYCHUNK)) {
1601 cifs_stats_fail_inc(tcon, SMB2_IOCTL_HE);
1602 goto ioctl_exit;
1603 }
1604 }
1605
1606 /* check if caller wants to look at return data or just return rc */
1607 if ((plen == NULL) || (out_data == NULL))
1608 goto ioctl_exit;
1609
1610 *plen = le32_to_cpu(rsp->OutputCount);
1611
1612 /* We check for obvious errors in the output buffer length and offset */
1613 if (*plen == 0)
1614 goto ioctl_exit; /* server returned no data */
1615 else if (*plen > 0xFF00) {
1616 cifs_dbg(VFS, "srv returned invalid ioctl length: %d\n", *plen);
1617 *plen = 0;
1618 rc = -EIO;
1619 goto ioctl_exit;
1620 }
1621
1622 if (get_rfc1002_length(rsp) < le32_to_cpu(rsp->OutputOffset) + *plen) {
1623 cifs_dbg(VFS, "Malformed ioctl resp: len %d offset %d\n", *plen,
1624 le32_to_cpu(rsp->OutputOffset));
1625 *plen = 0;
1626 rc = -EIO;
1627 goto ioctl_exit;
1628 }
1629
1630 *out_data = kmalloc(*plen, GFP_KERNEL);
1631 if (*out_data == NULL) {
1632 rc = -ENOMEM;
1633 goto ioctl_exit;
1634 }
1635
1636 memcpy(*out_data, rsp->hdr.ProtocolId + le32_to_cpu(rsp->OutputOffset),
1637 *plen);
1638 ioctl_exit:
1639 free_rsp_buf(resp_buftype, rsp);
1640 return rc;
1641 }
1642
1643 /*
1644 * Individual callers to ioctl worker function follow
1645 */
1646
1647 int
1648 SMB2_set_compression(const unsigned int xid, struct cifs_tcon *tcon,
1649 u64 persistent_fid, u64 volatile_fid)
1650 {
1651 int rc;
1652 struct compress_ioctl fsctl_input;
1653 char *ret_data = NULL;
1654
1655 fsctl_input.CompressionState =
1656 cpu_to_le16(COMPRESSION_FORMAT_DEFAULT);
1657
1658 rc = SMB2_ioctl(xid, tcon, persistent_fid, volatile_fid,
1659 FSCTL_SET_COMPRESSION, true /* is_fsctl */,
1660 (char *)&fsctl_input /* data input */,
1661 2 /* in data len */, &ret_data /* out data */, NULL);
1662
1663 cifs_dbg(FYI, "set compression rc %d\n", rc);
1664
1665 return rc;
1666 }
1667
1668 int
1669 SMB2_close(const unsigned int xid, struct cifs_tcon *tcon,
1670 u64 persistent_fid, u64 volatile_fid)
1671 {
1672 struct smb2_close_req *req;
1673 struct smb2_close_rsp *rsp;
1674 struct TCP_Server_Info *server;
1675 struct cifs_ses *ses = tcon->ses;
1676 struct kvec iov[1];
1677 int resp_buftype;
1678 int rc = 0;
1679
1680 cifs_dbg(FYI, "Close\n");
1681
1682 if (ses && (ses->server))
1683 server = ses->server;
1684 else
1685 return -EIO;
1686
1687 rc = small_smb2_init(SMB2_CLOSE, tcon, (void **) &req);
1688 if (rc)
1689 return rc;
1690
1691 req->PersistentFileId = persistent_fid;
1692 req->VolatileFileId = volatile_fid;
1693
1694 iov[0].iov_base = (char *)req;
1695 /* 4 for rfc1002 length field */
1696 iov[0].iov_len = get_rfc1002_length(req) + 4;
1697
1698 rc = SendReceive2(xid, ses, iov, 1, &resp_buftype, 0);
1699 rsp = (struct smb2_close_rsp *)iov[0].iov_base;
1700
1701 if (rc != 0) {
1702 cifs_stats_fail_inc(tcon, SMB2_CLOSE_HE);
1703 goto close_exit;
1704 }
1705
1706 /* BB FIXME - decode close response, update inode for caching */
1707
1708 close_exit:
1709 free_rsp_buf(resp_buftype, rsp);
1710 return rc;
1711 }
1712
1713 static int
1714 validate_buf(unsigned int offset, unsigned int buffer_length,
1715 struct smb2_hdr *hdr, unsigned int min_buf_size)
1716
1717 {
1718 unsigned int smb_len = be32_to_cpu(hdr->smb2_buf_length);
1719 char *end_of_smb = smb_len + 4 /* RFC1001 length field */ + (char *)hdr;
1720 char *begin_of_buf = 4 /* RFC1001 len field */ + offset + (char *)hdr;
1721 char *end_of_buf = begin_of_buf + buffer_length;
1722
1723
1724 if (buffer_length < min_buf_size) {
1725 cifs_dbg(VFS, "buffer length %d smaller than minimum size %d\n",
1726 buffer_length, min_buf_size);
1727 return -EINVAL;
1728 }
1729
1730 /* check if beyond RFC1001 maximum length */
1731 if ((smb_len > 0x7FFFFF) || (buffer_length > 0x7FFFFF)) {
1732 cifs_dbg(VFS, "buffer length %d or smb length %d too large\n",
1733 buffer_length, smb_len);
1734 return -EINVAL;
1735 }
1736
1737 if ((begin_of_buf > end_of_smb) || (end_of_buf > end_of_smb)) {
1738 cifs_dbg(VFS, "illegal server response, bad offset to data\n");
1739 return -EINVAL;
1740 }
1741
1742 return 0;
1743 }
1744
1745 /*
1746 * If SMB buffer fields are valid, copy into temporary buffer to hold result.
1747 * Caller must free buffer.
1748 */
1749 static int
1750 validate_and_copy_buf(unsigned int offset, unsigned int buffer_length,
1751 struct smb2_hdr *hdr, unsigned int minbufsize,
1752 char *data)
1753
1754 {
1755 char *begin_of_buf = 4 /* RFC1001 len field */ + offset + (char *)hdr;
1756 int rc;
1757
1758 if (!data)
1759 return -EINVAL;
1760
1761 rc = validate_buf(offset, buffer_length, hdr, minbufsize);
1762 if (rc)
1763 return rc;
1764
1765 memcpy(data, begin_of_buf, buffer_length);
1766
1767 return 0;
1768 }
1769
1770 static int
1771 query_info(const unsigned int xid, struct cifs_tcon *tcon,
1772 u64 persistent_fid, u64 volatile_fid, u8 info_class,
1773 size_t output_len, size_t min_len, void *data)
1774 {
1775 struct smb2_query_info_req *req;
1776 struct smb2_query_info_rsp *rsp = NULL;
1777 struct kvec iov[2];
1778 int rc = 0;
1779 int resp_buftype;
1780 struct TCP_Server_Info *server;
1781 struct cifs_ses *ses = tcon->ses;
1782
1783 cifs_dbg(FYI, "Query Info\n");
1784
1785 if (ses && (ses->server))
1786 server = ses->server;
1787 else
1788 return -EIO;
1789
1790 rc = small_smb2_init(SMB2_QUERY_INFO, tcon, (void **) &req);
1791 if (rc)
1792 return rc;
1793
1794 req->InfoType = SMB2_O_INFO_FILE;
1795 req->FileInfoClass = info_class;
1796 req->PersistentFileId = persistent_fid;
1797 req->VolatileFileId = volatile_fid;
1798 /* 4 for rfc1002 length field and 1 for Buffer */
1799 req->InputBufferOffset =
1800 cpu_to_le16(sizeof(struct smb2_query_info_req) - 1 - 4);
1801 req->OutputBufferLength = cpu_to_le32(output_len);
1802
1803 iov[0].iov_base = (char *)req;
1804 /* 4 for rfc1002 length field */
1805 iov[0].iov_len = get_rfc1002_length(req) + 4;
1806
1807 rc = SendReceive2(xid, ses, iov, 1, &resp_buftype, 0);
1808 rsp = (struct smb2_query_info_rsp *)iov[0].iov_base;
1809
1810 if (rc) {
1811 cifs_stats_fail_inc(tcon, SMB2_QUERY_INFO_HE);
1812 goto qinf_exit;
1813 }
1814
1815 rc = validate_and_copy_buf(le16_to_cpu(rsp->OutputBufferOffset),
1816 le32_to_cpu(rsp->OutputBufferLength),
1817 &rsp->hdr, min_len, data);
1818
1819 qinf_exit:
1820 free_rsp_buf(resp_buftype, rsp);
1821 return rc;
1822 }
1823
1824 int
1825 SMB2_query_info(const unsigned int xid, struct cifs_tcon *tcon,
1826 u64 persistent_fid, u64 volatile_fid,
1827 struct smb2_file_all_info *data)
1828 {
1829 return query_info(xid, tcon, persistent_fid, volatile_fid,
1830 FILE_ALL_INFORMATION,
1831 sizeof(struct smb2_file_all_info) + PATH_MAX * 2,
1832 sizeof(struct smb2_file_all_info), data);
1833 }
1834
1835 int
1836 SMB2_get_srv_num(const unsigned int xid, struct cifs_tcon *tcon,
1837 u64 persistent_fid, u64 volatile_fid, __le64 *uniqueid)
1838 {
1839 return query_info(xid, tcon, persistent_fid, volatile_fid,
1840 FILE_INTERNAL_INFORMATION,
1841 sizeof(struct smb2_file_internal_info),
1842 sizeof(struct smb2_file_internal_info), uniqueid);
1843 }
1844
1845 /*
1846 * This is a no-op for now. We're not really interested in the reply, but
1847 * rather in the fact that the server sent one and that server->lstrp
1848 * gets updated.
1849 *
1850 * FIXME: maybe we should consider checking that the reply matches request?
1851 */
1852 static void
1853 smb2_echo_callback(struct mid_q_entry *mid)
1854 {
1855 struct TCP_Server_Info *server = mid->callback_data;
1856 struct smb2_echo_rsp *smb2 = (struct smb2_echo_rsp *)mid->resp_buf;
1857 unsigned int credits_received = 1;
1858
1859 if (mid->mid_state == MID_RESPONSE_RECEIVED)
1860 credits_received = le16_to_cpu(smb2->hdr.CreditRequest);
1861
1862 mutex_lock(&server->srv_mutex);
1863 DeleteMidQEntry(mid);
1864 mutex_unlock(&server->srv_mutex);
1865 add_credits(server, credits_received, CIFS_ECHO_OP);
1866 }
1867
1868 void smb2_reconnect_server(struct work_struct *work)
1869 {
1870 struct TCP_Server_Info *server = container_of(work,
1871 struct TCP_Server_Info, reconnect.work);
1872 struct cifs_ses *ses;
1873 struct cifs_tcon *tcon, *tcon2;
1874 struct list_head tmp_list;
1875 int tcon_exist = false;
1876
1877 /* Prevent simultaneous reconnects that can corrupt tcon->rlist list */
1878 mutex_lock(&server->reconnect_mutex);
1879
1880 INIT_LIST_HEAD(&tmp_list);
1881 cifs_dbg(FYI, "Need negotiate, reconnecting tcons\n");
1882
1883 spin_lock(&cifs_tcp_ses_lock);
1884 list_for_each_entry(ses, &server->smb_ses_list, smb_ses_list) {
1885 list_for_each_entry(tcon, &ses->tcon_list, tcon_list) {
1886 if (tcon->need_reconnect) {
1887 tcon->tc_count++;
1888 list_add_tail(&tcon->rlist, &tmp_list);
1889 tcon_exist = true;
1890 }
1891 }
1892 }
1893 /*
1894 * Get the reference to server struct to be sure that the last call of
1895 * cifs_put_tcon() in the loop below won't release the server pointer.
1896 */
1897 if (tcon_exist)
1898 server->srv_count++;
1899
1900 spin_unlock(&cifs_tcp_ses_lock);
1901
1902 list_for_each_entry_safe(tcon, tcon2, &tmp_list, rlist) {
1903 smb2_reconnect(SMB2_ECHO, tcon);
1904 list_del_init(&tcon->rlist);
1905 cifs_put_tcon(tcon);
1906 }
1907
1908 cifs_dbg(FYI, "Reconnecting tcons finished\n");
1909 mutex_unlock(&server->reconnect_mutex);
1910
1911 /* now we can safely release srv struct */
1912 if (tcon_exist)
1913 cifs_put_tcp_session(server, 1);
1914 }
1915
1916 int
1917 SMB2_echo(struct TCP_Server_Info *server)
1918 {
1919 struct smb2_echo_req *req;
1920 int rc = 0;
1921 struct kvec iov;
1922 struct smb_rqst rqst = { .rq_iov = &iov,
1923 .rq_nvec = 1 };
1924
1925 cifs_dbg(FYI, "In echo request\n");
1926
1927 if (server->tcpStatus == CifsNeedNegotiate) {
1928 /* No need to send echo on newly established connections */
1929 queue_delayed_work(cifsiod_wq, &server->reconnect, 0);
1930 return rc;
1931 }
1932
1933 rc = small_smb2_init(SMB2_ECHO, NULL, (void **)&req);
1934 if (rc)
1935 return rc;
1936
1937 req->hdr.CreditRequest = cpu_to_le16(1);
1938
1939 iov.iov_base = (char *)req;
1940 /* 4 for rfc1002 length field */
1941 iov.iov_len = get_rfc1002_length(req) + 4;
1942
1943 rc = cifs_call_async(server, &rqst, NULL, smb2_echo_callback, server,
1944 CIFS_ECHO_OP);
1945 if (rc)
1946 cifs_dbg(FYI, "Echo request failed: %d\n", rc);
1947
1948 cifs_small_buf_release(req);
1949 return rc;
1950 }
1951
1952 int
1953 SMB2_flush(const unsigned int xid, struct cifs_tcon *tcon, u64 persistent_fid,
1954 u64 volatile_fid)
1955 {
1956 struct smb2_flush_req *req;
1957 struct TCP_Server_Info *server;
1958 struct cifs_ses *ses = tcon->ses;
1959 struct kvec iov[1];
1960 int resp_buftype;
1961 int rc = 0;
1962
1963 cifs_dbg(FYI, "Flush\n");
1964
1965 if (ses && (ses->server))
1966 server = ses->server;
1967 else
1968 return -EIO;
1969
1970 rc = small_smb2_init(SMB2_FLUSH, tcon, (void **) &req);
1971 if (rc)
1972 return rc;
1973
1974 req->PersistentFileId = persistent_fid;
1975 req->VolatileFileId = volatile_fid;
1976
1977 iov[0].iov_base = (char *)req;
1978 /* 4 for rfc1002 length field */
1979 iov[0].iov_len = get_rfc1002_length(req) + 4;
1980
1981 rc = SendReceive2(xid, ses, iov, 1, &resp_buftype, 0);
1982
1983 if (rc != 0)
1984 cifs_stats_fail_inc(tcon, SMB2_FLUSH_HE);
1985
1986 free_rsp_buf(resp_buftype, iov[0].iov_base);
1987 return rc;
1988 }
1989
1990 /*
1991 * To form a chain of read requests, any read requests after the first should
1992 * have the end_of_chain boolean set to true.
1993 */
1994 static int
1995 smb2_new_read_req(struct kvec *iov, struct cifs_io_parms *io_parms,
1996 unsigned int remaining_bytes, int request_type)
1997 {
1998 int rc = -EACCES;
1999 struct smb2_read_req *req = NULL;
2000
2001 rc = small_smb2_init(SMB2_READ, io_parms->tcon, (void **) &req);
2002 if (rc)
2003 return rc;
2004 if (io_parms->tcon->ses->server == NULL)
2005 return -ECONNABORTED;
2006
2007 req->hdr.ProcessId = cpu_to_le32(io_parms->pid);
2008
2009 req->PersistentFileId = io_parms->persistent_fid;
2010 req->VolatileFileId = io_parms->volatile_fid;
2011 req->ReadChannelInfoOffset = 0; /* reserved */
2012 req->ReadChannelInfoLength = 0; /* reserved */
2013 req->Channel = 0; /* reserved */
2014 req->MinimumCount = 0;
2015 req->Length = cpu_to_le32(io_parms->length);
2016 req->Offset = cpu_to_le64(io_parms->offset);
2017
2018 if (request_type & CHAINED_REQUEST) {
2019 if (!(request_type & END_OF_CHAIN)) {
2020 /* 4 for rfc1002 length field */
2021 req->hdr.NextCommand =
2022 cpu_to_le32(get_rfc1002_length(req) + 4);
2023 } else /* END_OF_CHAIN */
2024 req->hdr.NextCommand = 0;
2025 if (request_type & RELATED_REQUEST) {
2026 req->hdr.Flags |= SMB2_FLAGS_RELATED_OPERATIONS;
2027 /*
2028 * Related requests use info from previous read request
2029 * in chain.
2030 */
2031 req->hdr.SessionId = 0xFFFFFFFF;
2032 req->hdr.TreeId = 0xFFFFFFFF;
2033 req->PersistentFileId = 0xFFFFFFFF;
2034 req->VolatileFileId = 0xFFFFFFFF;
2035 }
2036 }
2037 if (remaining_bytes > io_parms->length)
2038 req->RemainingBytes = cpu_to_le32(remaining_bytes);
2039 else
2040 req->RemainingBytes = 0;
2041
2042 iov[0].iov_base = (char *)req;
2043 /* 4 for rfc1002 length field */
2044 iov[0].iov_len = get_rfc1002_length(req) + 4;
2045 return rc;
2046 }
2047
2048 static void
2049 smb2_readv_callback(struct mid_q_entry *mid)
2050 {
2051 struct cifs_readdata *rdata = mid->callback_data;
2052 struct cifs_tcon *tcon = tlink_tcon(rdata->cfile->tlink);
2053 struct TCP_Server_Info *server = tcon->ses->server;
2054 struct smb2_hdr *buf = (struct smb2_hdr *)rdata->iov.iov_base;
2055 unsigned int credits_received = 1;
2056 struct smb_rqst rqst = { .rq_iov = &rdata->iov,
2057 .rq_nvec = 1,
2058 .rq_pages = rdata->pages,
2059 .rq_npages = rdata->nr_pages,
2060 .rq_pagesz = rdata->pagesz,
2061 .rq_tailsz = rdata->tailsz };
2062
2063 cifs_dbg(FYI, "%s: mid=%llu state=%d result=%d bytes=%u\n",
2064 __func__, mid->mid, mid->mid_state, rdata->result,
2065 rdata->bytes);
2066
2067 switch (mid->mid_state) {
2068 case MID_RESPONSE_RECEIVED:
2069 credits_received = le16_to_cpu(buf->CreditRequest);
2070 /* result already set, check signature */
2071 if (server->sign) {
2072 int rc;
2073
2074 rc = smb2_verify_signature(&rqst, server);
2075 if (rc)
2076 cifs_dbg(VFS, "SMB signature verification returned error = %d\n",
2077 rc);
2078 }
2079 /* FIXME: should this be counted toward the initiating task? */
2080 task_io_account_read(rdata->got_bytes);
2081 cifs_stats_bytes_read(tcon, rdata->got_bytes);
2082 break;
2083 case MID_REQUEST_SUBMITTED:
2084 case MID_RETRY_NEEDED:
2085 rdata->result = -EAGAIN;
2086 if (server->sign && rdata->got_bytes)
2087 /* reset bytes number since we can not check a sign */
2088 rdata->got_bytes = 0;
2089 /* FIXME: should this be counted toward the initiating task? */
2090 task_io_account_read(rdata->got_bytes);
2091 cifs_stats_bytes_read(tcon, rdata->got_bytes);
2092 break;
2093 default:
2094 if (rdata->result != -ENODATA)
2095 rdata->result = -EIO;
2096 }
2097
2098 if (rdata->result)
2099 cifs_stats_fail_inc(tcon, SMB2_READ_HE);
2100
2101 queue_work(cifsiod_wq, &rdata->work);
2102 mutex_lock(&server->srv_mutex);
2103 DeleteMidQEntry(mid);
2104 mutex_unlock(&server->srv_mutex);
2105 add_credits(server, credits_received, 0);
2106 }
2107
2108 /* smb2_async_readv - send an async write, and set up mid to handle result */
2109 int
2110 smb2_async_readv(struct cifs_readdata *rdata)
2111 {
2112 int rc, flags = 0;
2113 struct smb2_hdr *buf;
2114 struct cifs_io_parms io_parms;
2115 struct smb_rqst rqst = { .rq_iov = &rdata->iov,
2116 .rq_nvec = 1 };
2117 struct TCP_Server_Info *server;
2118
2119 cifs_dbg(FYI, "%s: offset=%llu bytes=%u\n",
2120 __func__, rdata->offset, rdata->bytes);
2121
2122 io_parms.tcon = tlink_tcon(rdata->cfile->tlink);
2123 io_parms.offset = rdata->offset;
2124 io_parms.length = rdata->bytes;
2125 io_parms.persistent_fid = rdata->cfile->fid.persistent_fid;
2126 io_parms.volatile_fid = rdata->cfile->fid.volatile_fid;
2127 io_parms.pid = rdata->pid;
2128
2129 server = io_parms.tcon->ses->server;
2130
2131 rc = smb2_new_read_req(&rdata->iov, &io_parms, 0, 0);
2132 if (rc) {
2133 if (rc == -EAGAIN && rdata->credits) {
2134 /* credits was reset by reconnect */
2135 rdata->credits = 0;
2136 /* reduce in_flight value since we won't send the req */
2137 spin_lock(&server->req_lock);
2138 server->in_flight--;
2139 spin_unlock(&server->req_lock);
2140 }
2141 return rc;
2142 }
2143
2144 buf = (struct smb2_hdr *)rdata->iov.iov_base;
2145 /* 4 for rfc1002 length field */
2146 rdata->iov.iov_len = get_rfc1002_length(rdata->iov.iov_base) + 4;
2147
2148 if (rdata->credits) {
2149 buf->CreditCharge = cpu_to_le16(DIV_ROUND_UP(rdata->bytes,
2150 SMB2_MAX_BUFFER_SIZE));
2151 buf->CreditRequest = buf->CreditCharge;
2152 spin_lock(&server->req_lock);
2153 server->credits += rdata->credits -
2154 le16_to_cpu(buf->CreditCharge);
2155 spin_unlock(&server->req_lock);
2156 wake_up(&server->request_q);
2157 flags = CIFS_HAS_CREDITS;
2158 }
2159
2160 kref_get(&rdata->refcount);
2161 rc = cifs_call_async(io_parms.tcon->ses->server, &rqst,
2162 cifs_readv_receive, smb2_readv_callback,
2163 rdata, flags);
2164 if (rc) {
2165 kref_put(&rdata->refcount, cifs_readdata_release);
2166 cifs_stats_fail_inc(io_parms.tcon, SMB2_READ_HE);
2167 }
2168
2169 cifs_small_buf_release(buf);
2170 return rc;
2171 }
2172
2173 int
2174 SMB2_read(const unsigned int xid, struct cifs_io_parms *io_parms,
2175 unsigned int *nbytes, char **buf, int *buf_type)
2176 {
2177 int resp_buftype, rc = -EACCES;
2178 struct smb2_read_rsp *rsp = NULL;
2179 struct kvec iov[1];
2180
2181 *nbytes = 0;
2182 rc = smb2_new_read_req(iov, io_parms, 0, 0);
2183 if (rc)
2184 return rc;
2185
2186 rc = SendReceive2(xid, io_parms->tcon->ses, iov, 1,
2187 &resp_buftype, CIFS_LOG_ERROR);
2188
2189 rsp = (struct smb2_read_rsp *)iov[0].iov_base;
2190
2191 if (rsp->hdr.Status == STATUS_END_OF_FILE) {
2192 free_rsp_buf(resp_buftype, iov[0].iov_base);
2193 return 0;
2194 }
2195
2196 if (rc) {
2197 cifs_stats_fail_inc(io_parms->tcon, SMB2_READ_HE);
2198 cifs_dbg(VFS, "Send error in read = %d\n", rc);
2199 } else {
2200 *nbytes = le32_to_cpu(rsp->DataLength);
2201 if ((*nbytes > CIFS_MAX_MSGSIZE) ||
2202 (*nbytes > io_parms->length)) {
2203 cifs_dbg(FYI, "bad length %d for count %d\n",
2204 *nbytes, io_parms->length);
2205 rc = -EIO;
2206 *nbytes = 0;
2207 }
2208 }
2209
2210 if (*buf) {
2211 memcpy(*buf, (char *)rsp->hdr.ProtocolId + rsp->DataOffset,
2212 *nbytes);
2213 free_rsp_buf(resp_buftype, iov[0].iov_base);
2214 } else if (resp_buftype != CIFS_NO_BUFFER) {
2215 *buf = iov[0].iov_base;
2216 if (resp_buftype == CIFS_SMALL_BUFFER)
2217 *buf_type = CIFS_SMALL_BUFFER;
2218 else if (resp_buftype == CIFS_LARGE_BUFFER)
2219 *buf_type = CIFS_LARGE_BUFFER;
2220 }
2221 return rc;
2222 }
2223
2224 /*
2225 * Check the mid_state and signature on received buffer (if any), and queue the
2226 * workqueue completion task.
2227 */
2228 static void
2229 smb2_writev_callback(struct mid_q_entry *mid)
2230 {
2231 struct cifs_writedata *wdata = mid->callback_data;
2232 struct cifs_tcon *tcon = tlink_tcon(wdata->cfile->tlink);
2233 struct TCP_Server_Info *server = tcon->ses->server;
2234 unsigned int written;
2235 struct smb2_write_rsp *rsp = (struct smb2_write_rsp *)mid->resp_buf;
2236 unsigned int credits_received = 1;
2237
2238 switch (mid->mid_state) {
2239 case MID_RESPONSE_RECEIVED:
2240 credits_received = le16_to_cpu(rsp->hdr.CreditRequest);
2241 wdata->result = smb2_check_receive(mid, tcon->ses->server, 0);
2242 if (wdata->result != 0)
2243 break;
2244
2245 written = le32_to_cpu(rsp->DataLength);
2246 /*
2247 * Mask off high 16 bits when bytes written as returned
2248 * by the server is greater than bytes requested by the
2249 * client. OS/2 servers are known to set incorrect
2250 * CountHigh values.
2251 */
2252 if (written > wdata->bytes)
2253 written &= 0xFFFF;
2254
2255 if (written < wdata->bytes)
2256 wdata->result = -ENOSPC;
2257 else
2258 wdata->bytes = written;
2259 break;
2260 case MID_REQUEST_SUBMITTED:
2261 case MID_RETRY_NEEDED:
2262 wdata->result = -EAGAIN;
2263 break;
2264 default:
2265 wdata->result = -EIO;
2266 break;
2267 }
2268
2269 if (wdata->result)
2270 cifs_stats_fail_inc(tcon, SMB2_WRITE_HE);
2271
2272 queue_work(cifsiod_wq, &wdata->work);
2273 mutex_lock(&server->srv_mutex);
2274 DeleteMidQEntry(mid);
2275 mutex_unlock(&server->srv_mutex);
2276 add_credits(tcon->ses->server, credits_received, 0);
2277 }
2278
2279 /* smb2_async_writev - send an async write, and set up mid to handle result */
2280 int
2281 smb2_async_writev(struct cifs_writedata *wdata,
2282 void (*release)(struct kref *kref))
2283 {
2284 int rc = -EACCES, flags = 0;
2285 struct smb2_write_req *req = NULL;
2286 struct cifs_tcon *tcon = tlink_tcon(wdata->cfile->tlink);
2287 struct TCP_Server_Info *server = tcon->ses->server;
2288 struct kvec iov;
2289 struct smb_rqst rqst;
2290
2291 rc = small_smb2_init(SMB2_WRITE, tcon, (void **) &req);
2292 if (rc) {
2293 if (rc == -EAGAIN && wdata->credits) {
2294 /* credits was reset by reconnect */
2295 wdata->credits = 0;
2296 /* reduce in_flight value since we won't send the req */
2297 spin_lock(&server->req_lock);
2298 server->in_flight--;
2299 spin_unlock(&server->req_lock);
2300 }
2301 goto async_writev_out;
2302 }
2303
2304 req->hdr.ProcessId = cpu_to_le32(wdata->cfile->pid);
2305
2306 req->PersistentFileId = wdata->cfile->fid.persistent_fid;
2307 req->VolatileFileId = wdata->cfile->fid.volatile_fid;
2308 req->WriteChannelInfoOffset = 0;
2309 req->WriteChannelInfoLength = 0;
2310 req->Channel = 0;
2311 req->Offset = cpu_to_le64(wdata->offset);
2312 /* 4 for rfc1002 length field */
2313 req->DataOffset = cpu_to_le16(
2314 offsetof(struct smb2_write_req, Buffer) - 4);
2315 req->RemainingBytes = 0;
2316
2317 /* 4 for rfc1002 length field and 1 for Buffer */
2318 iov.iov_len = get_rfc1002_length(req) + 4 - 1;
2319 iov.iov_base = req;
2320
2321 rqst.rq_iov = &iov;
2322 rqst.rq_nvec = 1;
2323 rqst.rq_pages = wdata->pages;
2324 rqst.rq_npages = wdata->nr_pages;
2325 rqst.rq_pagesz = wdata->pagesz;
2326 rqst.rq_tailsz = wdata->tailsz;
2327
2328 cifs_dbg(FYI, "async write at %llu %u bytes\n",
2329 wdata->offset, wdata->bytes);
2330
2331 req->Length = cpu_to_le32(wdata->bytes);
2332
2333 inc_rfc1001_len(&req->hdr, wdata->bytes - 1 /* Buffer */);
2334
2335 if (wdata->credits) {
2336 req->hdr.CreditCharge = cpu_to_le16(DIV_ROUND_UP(wdata->bytes,
2337 SMB2_MAX_BUFFER_SIZE));
2338 req->hdr.CreditRequest = req->hdr.CreditCharge;
2339 spin_lock(&server->req_lock);
2340 server->credits += wdata->credits -
2341 le16_to_cpu(req->hdr.CreditCharge);
2342 spin_unlock(&server->req_lock);
2343 wake_up(&server->request_q);
2344 flags = CIFS_HAS_CREDITS;
2345 }
2346
2347 kref_get(&wdata->refcount);
2348 rc = cifs_call_async(server, &rqst, NULL, smb2_writev_callback, wdata,
2349 flags);
2350
2351 if (rc) {
2352 kref_put(&wdata->refcount, release);
2353 cifs_stats_fail_inc(tcon, SMB2_WRITE_HE);
2354 }
2355
2356 async_writev_out:
2357 cifs_small_buf_release(req);
2358 return rc;
2359 }
2360
2361 /*
2362 * SMB2_write function gets iov pointer to kvec array with n_vec as a length.
2363 * The length field from io_parms must be at least 1 and indicates a number of
2364 * elements with data to write that begins with position 1 in iov array. All
2365 * data length is specified by count.
2366 */
2367 int
2368 SMB2_write(const unsigned int xid, struct cifs_io_parms *io_parms,
2369 unsigned int *nbytes, struct kvec *iov, int n_vec)
2370 {
2371 int rc = 0;
2372 struct smb2_write_req *req = NULL;
2373 struct smb2_write_rsp *rsp = NULL;
2374 int resp_buftype;
2375 *nbytes = 0;
2376
2377 if (n_vec < 1)
2378 return rc;
2379
2380 rc = small_smb2_init(SMB2_WRITE, io_parms->tcon, (void **) &req);
2381 if (rc)
2382 return rc;
2383
2384 if (io_parms->tcon->ses->server == NULL)
2385 return -ECONNABORTED;
2386
2387 req->hdr.ProcessId = cpu_to_le32(io_parms->pid);
2388
2389 req->PersistentFileId = io_parms->persistent_fid;
2390 req->VolatileFileId = io_parms->volatile_fid;
2391 req->WriteChannelInfoOffset = 0;
2392 req->WriteChannelInfoLength = 0;
2393 req->Channel = 0;
2394 req->Length = cpu_to_le32(io_parms->length);
2395 req->Offset = cpu_to_le64(io_parms->offset);
2396 /* 4 for rfc1002 length field */
2397 req->DataOffset = cpu_to_le16(
2398 offsetof(struct smb2_write_req, Buffer) - 4);
2399 req->RemainingBytes = 0;
2400
2401 iov[0].iov_base = (char *)req;
2402 /* 4 for rfc1002 length field and 1 for Buffer */
2403 iov[0].iov_len = get_rfc1002_length(req) + 4 - 1;
2404
2405 /* length of entire message including data to be written */
2406 inc_rfc1001_len(req, io_parms->length - 1 /* Buffer */);
2407
2408 rc = SendReceive2(xid, io_parms->tcon->ses, iov, n_vec + 1,
2409 &resp_buftype, 0);
2410 rsp = (struct smb2_write_rsp *)iov[0].iov_base;
2411
2412 if (rc) {
2413 cifs_stats_fail_inc(io_parms->tcon, SMB2_WRITE_HE);
2414 cifs_dbg(VFS, "Send error in write = %d\n", rc);
2415 } else
2416 *nbytes = le32_to_cpu(rsp->DataLength);
2417
2418 free_rsp_buf(resp_buftype, rsp);
2419 return rc;
2420 }
2421
2422 static unsigned int
2423 num_entries(char *bufstart, char *end_of_buf, char **lastentry, size_t size)
2424 {
2425 int len;
2426 unsigned int entrycount = 0;
2427 unsigned int next_offset = 0;
2428 char *entryptr;
2429 FILE_DIRECTORY_INFO *dir_info;
2430
2431 if (bufstart == NULL)
2432 return 0;
2433
2434 entryptr = bufstart;
2435
2436 while (1) {
2437 if (entryptr + next_offset < entryptr ||
2438 entryptr + next_offset > end_of_buf ||
2439 entryptr + next_offset + size > end_of_buf) {
2440 cifs_dbg(VFS, "malformed search entry would overflow\n");
2441 break;
2442 }
2443
2444 entryptr = entryptr + next_offset;
2445 dir_info = (FILE_DIRECTORY_INFO *)entryptr;
2446
2447 len = le32_to_cpu(dir_info->FileNameLength);
2448 if (entryptr + len < entryptr ||
2449 entryptr + len > end_of_buf ||
2450 entryptr + len + size > end_of_buf) {
2451 cifs_dbg(VFS, "directory entry name would overflow frame end of buf %p\n",
2452 end_of_buf);
2453 break;
2454 }
2455
2456 *lastentry = entryptr;
2457 entrycount++;
2458
2459 next_offset = le32_to_cpu(dir_info->NextEntryOffset);
2460 if (!next_offset)
2461 break;
2462 }
2463
2464 return entrycount;
2465 }
2466
2467 /*
2468 * Readdir/FindFirst
2469 */
2470 int
2471 SMB2_query_directory(const unsigned int xid, struct cifs_tcon *tcon,
2472 u64 persistent_fid, u64 volatile_fid, int index,
2473 struct cifs_search_info *srch_inf)
2474 {
2475 struct smb2_query_directory_req *req;
2476 struct smb2_query_directory_rsp *rsp = NULL;
2477 struct kvec iov[2];
2478 int rc = 0;
2479 int len;
2480 int resp_buftype = CIFS_NO_BUFFER;
2481 unsigned char *bufptr;
2482 struct TCP_Server_Info *server;
2483 struct cifs_ses *ses = tcon->ses;
2484 __le16 asteriks = cpu_to_le16('*');
2485 char *end_of_smb;
2486 unsigned int output_size = CIFSMaxBufSize;
2487 size_t info_buf_size;
2488
2489 if (ses && (ses->server))
2490 server = ses->server;
2491 else
2492 return -EIO;
2493
2494 rc = small_smb2_init(SMB2_QUERY_DIRECTORY, tcon, (void **) &req);
2495 if (rc)
2496 return rc;
2497
2498 switch (srch_inf->info_level) {
2499 case SMB_FIND_FILE_DIRECTORY_INFO:
2500 req->FileInformationClass = FILE_DIRECTORY_INFORMATION;
2501 info_buf_size = sizeof(FILE_DIRECTORY_INFO) - 1;
2502 break;
2503 case SMB_FIND_FILE_ID_FULL_DIR_INFO:
2504 req->FileInformationClass = FILEID_FULL_DIRECTORY_INFORMATION;
2505 info_buf_size = sizeof(SEARCH_ID_FULL_DIR_INFO) - 1;
2506 break;
2507 default:
2508 cifs_dbg(VFS, "info level %u isn't supported\n",
2509 srch_inf->info_level);
2510 rc = -EINVAL;
2511 goto qdir_exit;
2512 }
2513
2514 req->FileIndex = cpu_to_le32(index);
2515 req->PersistentFileId = persistent_fid;
2516 req->VolatileFileId = volatile_fid;
2517
2518 len = 0x2;
2519 bufptr = req->Buffer;
2520 memcpy(bufptr, &asteriks, len);
2521
2522 req->FileNameOffset =
2523 cpu_to_le16(sizeof(struct smb2_query_directory_req) - 1 - 4);
2524 req->FileNameLength = cpu_to_le16(len);
2525 /*
2526 * BB could be 30 bytes or so longer if we used SMB2 specific
2527 * buffer lengths, but this is safe and close enough.
2528 */
2529 output_size = min_t(unsigned int, output_size, server->maxBuf);
2530 output_size = min_t(unsigned int, output_size, 2 << 15);
2531 req->OutputBufferLength = cpu_to_le32(output_size);
2532
2533 iov[0].iov_base = (char *)req;
2534 /* 4 for RFC1001 length and 1 for Buffer */
2535 iov[0].iov_len = get_rfc1002_length(req) + 4 - 1;
2536
2537 iov[1].iov_base = (char *)(req->Buffer);
2538 iov[1].iov_len = len;
2539
2540 inc_rfc1001_len(req, len - 1 /* Buffer */);
2541
2542 rc = SendReceive2(xid, ses, iov, 2, &resp_buftype, 0);
2543 rsp = (struct smb2_query_directory_rsp *)iov[0].iov_base;
2544
2545 if (rc) {
2546 if (rc == -ENODATA && rsp->hdr.Status == STATUS_NO_MORE_FILES) {
2547 srch_inf->endOfSearch = true;
2548 rc = 0;
2549 } else
2550 cifs_stats_fail_inc(tcon, SMB2_QUERY_DIRECTORY_HE);
2551 goto qdir_exit;
2552 }
2553
2554 rc = validate_buf(le16_to_cpu(rsp->OutputBufferOffset),
2555 le32_to_cpu(rsp->OutputBufferLength), &rsp->hdr,
2556 info_buf_size);
2557 if (rc)
2558 goto qdir_exit;
2559
2560 srch_inf->unicode = true;
2561
2562 if (srch_inf->ntwrk_buf_start) {
2563 if (srch_inf->smallBuf)
2564 cifs_small_buf_release(srch_inf->ntwrk_buf_start);
2565 else
2566 cifs_buf_release(srch_inf->ntwrk_buf_start);
2567 }
2568 srch_inf->ntwrk_buf_start = (char *)rsp;
2569 srch_inf->srch_entries_start = srch_inf->last_entry = 4 /* rfclen */ +
2570 (char *)&rsp->hdr + le16_to_cpu(rsp->OutputBufferOffset);
2571 /* 4 for rfc1002 length field */
2572 end_of_smb = get_rfc1002_length(rsp) + 4 + (char *)&rsp->hdr;
2573 srch_inf->entries_in_buffer =
2574 num_entries(srch_inf->srch_entries_start, end_of_smb,
2575 &srch_inf->last_entry, info_buf_size);
2576 srch_inf->index_of_last_entry += srch_inf->entries_in_buffer;
2577 cifs_dbg(FYI, "num entries %d last_index %lld srch start %p srch end %p\n",
2578 srch_inf->entries_in_buffer, srch_inf->index_of_last_entry,
2579 srch_inf->srch_entries_start, srch_inf->last_entry);
2580 if (resp_buftype == CIFS_LARGE_BUFFER)
2581 srch_inf->smallBuf = false;
2582 else if (resp_buftype == CIFS_SMALL_BUFFER)
2583 srch_inf->smallBuf = true;
2584 else
2585 cifs_dbg(VFS, "illegal search buffer type\n");
2586
2587 return rc;
2588
2589 qdir_exit:
2590 free_rsp_buf(resp_buftype, rsp);
2591 return rc;
2592 }
2593
2594 static int
2595 send_set_info(const unsigned int xid, struct cifs_tcon *tcon,
2596 u64 persistent_fid, u64 volatile_fid, u32 pid, int info_class,
2597 unsigned int num, void **data, unsigned int *size)
2598 {
2599 struct smb2_set_info_req *req;
2600 struct smb2_set_info_rsp *rsp = NULL;
2601 struct kvec *iov;
2602 int rc = 0;
2603 int resp_buftype;
2604 unsigned int i;
2605 struct TCP_Server_Info *server;
2606 struct cifs_ses *ses = tcon->ses;
2607
2608 if (ses && (ses->server))
2609 server = ses->server;
2610 else
2611 return -EIO;
2612
2613 if (!num)
2614 return -EINVAL;
2615
2616 iov = kmalloc(sizeof(struct kvec) * num, GFP_KERNEL);
2617 if (!iov)
2618 return -ENOMEM;
2619
2620 rc = small_smb2_init(SMB2_SET_INFO, tcon, (void **) &req);
2621 if (rc) {
2622 kfree(iov);
2623 return rc;
2624 }
2625
2626 req->hdr.ProcessId = cpu_to_le32(pid);
2627
2628 req->InfoType = SMB2_O_INFO_FILE;
2629 req->FileInfoClass = info_class;
2630 req->PersistentFileId = persistent_fid;
2631 req->VolatileFileId = volatile_fid;
2632
2633 /* 4 for RFC1001 length and 1 for Buffer */
2634 req->BufferOffset =
2635 cpu_to_le16(sizeof(struct smb2_set_info_req) - 1 - 4);
2636 req->BufferLength = cpu_to_le32(*size);
2637
2638 inc_rfc1001_len(req, *size - 1 /* Buffer */);
2639
2640 memcpy(req->Buffer, *data, *size);
2641
2642 iov[0].iov_base = (char *)req;
2643 /* 4 for RFC1001 length */
2644 iov[0].iov_len = get_rfc1002_length(req) + 4;
2645
2646 for (i = 1; i < num; i++) {
2647 inc_rfc1001_len(req, size[i]);
2648 le32_add_cpu(&req->BufferLength, size[i]);
2649 iov[i].iov_base = (char *)data[i];
2650 iov[i].iov_len = size[i];
2651 }
2652
2653 rc = SendReceive2(xid, ses, iov, num, &resp_buftype, 0);
2654 rsp = (struct smb2_set_info_rsp *)iov[0].iov_base;
2655
2656 if (rc != 0)
2657 cifs_stats_fail_inc(tcon, SMB2_SET_INFO_HE);
2658
2659 free_rsp_buf(resp_buftype, rsp);
2660 kfree(iov);
2661 return rc;
2662 }
2663
2664 int
2665 SMB2_rename(const unsigned int xid, struct cifs_tcon *tcon,
2666 u64 persistent_fid, u64 volatile_fid, __le16 *target_file)
2667 {
2668 struct smb2_file_rename_info info;
2669 void **data;
2670 unsigned int size[2];
2671 int rc;
2672 int len = (2 * UniStrnlen((wchar_t *)target_file, PATH_MAX));
2673
2674 data = kmalloc(sizeof(void *) * 2, GFP_KERNEL);
2675 if (!data)
2676 return -ENOMEM;
2677
2678 info.ReplaceIfExists = 1; /* 1 = replace existing target with new */
2679 /* 0 = fail if target already exists */
2680 info.RootDirectory = 0; /* MBZ for network ops (why does spec say?) */
2681 info.FileNameLength = cpu_to_le32(len);
2682
2683 data[0] = &info;
2684 size[0] = sizeof(struct smb2_file_rename_info);
2685
2686 data[1] = target_file;
2687 size[1] = len + 2 /* null */;
2688
2689 rc = send_set_info(xid, tcon, persistent_fid, volatile_fid,
2690 current->tgid, FILE_RENAME_INFORMATION, 2, data,
2691 size);
2692 kfree(data);
2693 return rc;
2694 }
2695
2696 int
2697 SMB2_rmdir(const unsigned int xid, struct cifs_tcon *tcon,
2698 u64 persistent_fid, u64 volatile_fid)
2699 {
2700 __u8 delete_pending = 1;
2701 void *data;
2702 unsigned int size;
2703
2704 data = &delete_pending;
2705 size = 1; /* sizeof __u8 */
2706
2707 return send_set_info(xid, tcon, persistent_fid, volatile_fid,
2708 current->tgid, FILE_DISPOSITION_INFORMATION, 1, &data,
2709 &size);
2710 }
2711
2712 int
2713 SMB2_set_hardlink(const unsigned int xid, struct cifs_tcon *tcon,
2714 u64 persistent_fid, u64 volatile_fid, __le16 *target_file)
2715 {
2716 struct smb2_file_link_info info;
2717 void **data;
2718 unsigned int size[2];
2719 int rc;
2720 int len = (2 * UniStrnlen((wchar_t *)target_file, PATH_MAX));
2721
2722 data = kmalloc(sizeof(void *) * 2, GFP_KERNEL);
2723 if (!data)
2724 return -ENOMEM;
2725
2726 info.ReplaceIfExists = 0; /* 1 = replace existing link with new */
2727 /* 0 = fail if link already exists */
2728 info.RootDirectory = 0; /* MBZ for network ops (why does spec say?) */
2729 info.FileNameLength = cpu_to_le32(len);
2730
2731 data[0] = &info;
2732 size[0] = sizeof(struct smb2_file_link_info);
2733
2734 data[1] = target_file;
2735 size[1] = len + 2 /* null */;
2736
2737 rc = send_set_info(xid, tcon, persistent_fid, volatile_fid,
2738 current->tgid, FILE_LINK_INFORMATION, 2, data, size);
2739 kfree(data);
2740 return rc;
2741 }
2742
2743 int
2744 SMB2_set_eof(const unsigned int xid, struct cifs_tcon *tcon, u64 persistent_fid,
2745 u64 volatile_fid, u32 pid, __le64 *eof, bool is_falloc)
2746 {
2747 struct smb2_file_eof_info info;
2748 void *data;
2749 unsigned int size;
2750
2751 info.EndOfFile = *eof;
2752
2753 data = &info;
2754 size = sizeof(struct smb2_file_eof_info);
2755
2756 if (is_falloc)
2757 return send_set_info(xid, tcon, persistent_fid, volatile_fid,
2758 pid, FILE_ALLOCATION_INFORMATION, 1, &data, &size);
2759 else
2760 return send_set_info(xid, tcon, persistent_fid, volatile_fid,
2761 pid, FILE_END_OF_FILE_INFORMATION, 1, &data, &size);
2762 }
2763
2764 int
2765 SMB2_set_info(const unsigned int xid, struct cifs_tcon *tcon,
2766 u64 persistent_fid, u64 volatile_fid, FILE_BASIC_INFO *buf)
2767 {
2768 unsigned int size;
2769 size = sizeof(FILE_BASIC_INFO);
2770 return send_set_info(xid, tcon, persistent_fid, volatile_fid,
2771 current->tgid, FILE_BASIC_INFORMATION, 1,
2772 (void **)&buf, &size);
2773 }
2774
2775 int
2776 SMB2_oplock_break(const unsigned int xid, struct cifs_tcon *tcon,
2777 const u64 persistent_fid, const u64 volatile_fid,
2778 __u8 oplock_level)
2779 {
2780 int rc;
2781 struct smb2_oplock_break *req = NULL;
2782
2783 cifs_dbg(FYI, "SMB2_oplock_break\n");
2784 rc = small_smb2_init(SMB2_OPLOCK_BREAK, tcon, (void **) &req);
2785
2786 if (rc)
2787 return rc;
2788
2789 req->VolatileFid = volatile_fid;
2790 req->PersistentFid = persistent_fid;
2791 req->OplockLevel = oplock_level;
2792 req->hdr.CreditRequest = cpu_to_le16(1);
2793
2794 rc = SendReceiveNoRsp(xid, tcon->ses, (char *) req, CIFS_OBREAK_OP);
2795 /* SMB2 buffer freed by function above */
2796
2797 if (rc) {
2798 cifs_stats_fail_inc(tcon, SMB2_OPLOCK_BREAK_HE);
2799 cifs_dbg(FYI, "Send error in Oplock Break = %d\n", rc);
2800 }
2801
2802 return rc;
2803 }
2804
2805 static void
2806 copy_fs_info_to_kstatfs(struct smb2_fs_full_size_info *pfs_inf,
2807 struct kstatfs *kst)
2808 {
2809 kst->f_bsize = le32_to_cpu(pfs_inf->BytesPerSector) *
2810 le32_to_cpu(pfs_inf->SectorsPerAllocationUnit);
2811 kst->f_blocks = le64_to_cpu(pfs_inf->TotalAllocationUnits);
2812 kst->f_bfree = kst->f_bavail =
2813 le64_to_cpu(pfs_inf->CallerAvailableAllocationUnits);
2814 return;
2815 }
2816
2817 static int
2818 build_qfs_info_req(struct kvec *iov, struct cifs_tcon *tcon, int level,
2819 int outbuf_len, u64 persistent_fid, u64 volatile_fid)
2820 {
2821 int rc;
2822 struct smb2_query_info_req *req;
2823
2824 cifs_dbg(FYI, "Query FSInfo level %d\n", level);
2825
2826 if ((tcon->ses == NULL) || (tcon->ses->server == NULL))
2827 return -EIO;
2828
2829 rc = small_smb2_init(SMB2_QUERY_INFO, tcon, (void **) &req);
2830 if (rc)
2831 return rc;
2832
2833 req->InfoType = SMB2_O_INFO_FILESYSTEM;
2834 req->FileInfoClass = level;
2835 req->PersistentFileId = persistent_fid;
2836 req->VolatileFileId = volatile_fid;
2837 /* 4 for rfc1002 length field and 1 for pad */
2838 req->InputBufferOffset =
2839 cpu_to_le16(sizeof(struct smb2_query_info_req) - 1 - 4);
2840 req->OutputBufferLength = cpu_to_le32(
2841 outbuf_len + sizeof(struct smb2_query_info_rsp) - 1 - 4);
2842
2843 iov->iov_base = (char *)req;
2844 /* 4 for rfc1002 length field */
2845 iov->iov_len = get_rfc1002_length(req) + 4;
2846 return 0;
2847 }
2848
2849 int
2850 SMB2_QFS_info(const unsigned int xid, struct cifs_tcon *tcon,
2851 u64 persistent_fid, u64 volatile_fid, struct kstatfs *fsdata)
2852 {
2853 struct smb2_query_info_rsp *rsp = NULL;
2854 struct kvec iov;
2855 int rc = 0;
2856 int resp_buftype;
2857 struct cifs_ses *ses = tcon->ses;
2858 struct smb2_fs_full_size_info *info = NULL;
2859
2860 rc = build_qfs_info_req(&iov, tcon, FS_FULL_SIZE_INFORMATION,
2861 sizeof(struct smb2_fs_full_size_info),
2862 persistent_fid, volatile_fid);
2863 if (rc)
2864 return rc;
2865
2866 rc = SendReceive2(xid, ses, &iov, 1, &resp_buftype, 0);
2867 if (rc) {
2868 cifs_stats_fail_inc(tcon, SMB2_QUERY_INFO_HE);
2869 goto qfsinf_exit;
2870 }
2871 rsp = (struct smb2_query_info_rsp *)iov.iov_base;
2872
2873 info = (struct smb2_fs_full_size_info *)(4 /* RFC1001 len */ +
2874 le16_to_cpu(rsp->OutputBufferOffset) + (char *)&rsp->hdr);
2875 rc = validate_buf(le16_to_cpu(rsp->OutputBufferOffset),
2876 le32_to_cpu(rsp->OutputBufferLength), &rsp->hdr,
2877 sizeof(struct smb2_fs_full_size_info));
2878 if (!rc)
2879 copy_fs_info_to_kstatfs(info, fsdata);
2880
2881 qfsinf_exit:
2882 free_rsp_buf(resp_buftype, iov.iov_base);
2883 return rc;
2884 }
2885
2886 int
2887 SMB2_QFS_attr(const unsigned int xid, struct cifs_tcon *tcon,
2888 u64 persistent_fid, u64 volatile_fid, int level)
2889 {
2890 struct smb2_query_info_rsp *rsp = NULL;
2891 struct kvec iov;
2892 int rc = 0;
2893 int resp_buftype, max_len, min_len;
2894 struct cifs_ses *ses = tcon->ses;
2895 unsigned int rsp_len, offset;
2896
2897 if (level == FS_DEVICE_INFORMATION) {
2898 max_len = sizeof(FILE_SYSTEM_DEVICE_INFO);
2899 min_len = sizeof(FILE_SYSTEM_DEVICE_INFO);
2900 } else if (level == FS_ATTRIBUTE_INFORMATION) {
2901 max_len = sizeof(FILE_SYSTEM_ATTRIBUTE_INFO);
2902 min_len = MIN_FS_ATTR_INFO_SIZE;
2903 } else if (level == FS_SECTOR_SIZE_INFORMATION) {
2904 max_len = sizeof(struct smb3_fs_ss_info);
2905 min_len = sizeof(struct smb3_fs_ss_info);
2906 } else {
2907 cifs_dbg(FYI, "Invalid qfsinfo level %d\n", level);
2908 return -EINVAL;
2909 }
2910
2911 rc = build_qfs_info_req(&iov, tcon, level, max_len,
2912 persistent_fid, volatile_fid);
2913 if (rc)
2914 return rc;
2915
2916 rc = SendReceive2(xid, ses, &iov, 1, &resp_buftype, 0);
2917 if (rc) {
2918 cifs_stats_fail_inc(tcon, SMB2_QUERY_INFO_HE);
2919 goto qfsattr_exit;
2920 }
2921 rsp = (struct smb2_query_info_rsp *)iov.iov_base;
2922
2923 rsp_len = le32_to_cpu(rsp->OutputBufferLength);
2924 offset = le16_to_cpu(rsp->OutputBufferOffset);
2925 rc = validate_buf(offset, rsp_len, &rsp->hdr, min_len);
2926 if (rc)
2927 goto qfsattr_exit;
2928
2929 if (level == FS_ATTRIBUTE_INFORMATION)
2930 memcpy(&tcon->fsAttrInfo, 4 /* RFC1001 len */ + offset
2931 + (char *)&rsp->hdr, min_t(unsigned int,
2932 rsp_len, max_len));
2933 else if (level == FS_DEVICE_INFORMATION)
2934 memcpy(&tcon->fsDevInfo, 4 /* RFC1001 len */ + offset
2935 + (char *)&rsp->hdr, sizeof(FILE_SYSTEM_DEVICE_INFO));
2936 else if (level == FS_SECTOR_SIZE_INFORMATION) {
2937 struct smb3_fs_ss_info *ss_info = (struct smb3_fs_ss_info *)
2938 (4 /* RFC1001 len */ + offset + (char *)&rsp->hdr);
2939 tcon->ss_flags = le32_to_cpu(ss_info->Flags);
2940 tcon->perf_sector_size =
2941 le32_to_cpu(ss_info->PhysicalBytesPerSectorForPerf);
2942 }
2943
2944 qfsattr_exit:
2945 free_rsp_buf(resp_buftype, iov.iov_base);
2946 return rc;
2947 }
2948
2949 int
2950 smb2_lockv(const unsigned int xid, struct cifs_tcon *tcon,
2951 const __u64 persist_fid, const __u64 volatile_fid, const __u32 pid,
2952 const __u32 num_lock, struct smb2_lock_element *buf)
2953 {
2954 int rc = 0;
2955 struct smb2_lock_req *req = NULL;
2956 struct kvec iov[2];
2957 int resp_buf_type;
2958 unsigned int count;
2959
2960 cifs_dbg(FYI, "smb2_lockv num lock %d\n", num_lock);
2961
2962 rc = small_smb2_init(SMB2_LOCK, tcon, (void **) &req);
2963 if (rc)
2964 return rc;
2965
2966 req->hdr.ProcessId = cpu_to_le32(pid);
2967 req->LockCount = cpu_to_le16(num_lock);
2968
2969 req->PersistentFileId = persist_fid;
2970 req->VolatileFileId = volatile_fid;
2971
2972 count = num_lock * sizeof(struct smb2_lock_element);
2973 inc_rfc1001_len(req, count - sizeof(struct smb2_lock_element));
2974
2975 iov[0].iov_base = (char *)req;
2976 /* 4 for rfc1002 length field and count for all locks */
2977 iov[0].iov_len = get_rfc1002_length(req) + 4 - count;
2978 iov[1].iov_base = (char *)buf;
2979 iov[1].iov_len = count;
2980
2981 cifs_stats_inc(&tcon->stats.cifs_stats.num_locks);
2982 rc = SendReceive2(xid, tcon->ses, iov, 2, &resp_buf_type, CIFS_NO_RESP);
2983 if (rc) {
2984 cifs_dbg(FYI, "Send error in smb2_lockv = %d\n", rc);
2985 cifs_stats_fail_inc(tcon, SMB2_LOCK_HE);
2986 }
2987
2988 return rc;
2989 }
2990
2991 int
2992 SMB2_lock(const unsigned int xid, struct cifs_tcon *tcon,
2993 const __u64 persist_fid, const __u64 volatile_fid, const __u32 pid,
2994 const __u64 length, const __u64 offset, const __u32 lock_flags,
2995 const bool wait)
2996 {
2997 struct smb2_lock_element lock;
2998
2999 lock.Offset = cpu_to_le64(offset);
3000 lock.Length = cpu_to_le64(length);
3001 lock.Flags = cpu_to_le32(lock_flags);
3002 if (!wait && lock_flags != SMB2_LOCKFLAG_UNLOCK)
3003 lock.Flags |= cpu_to_le32(SMB2_LOCKFLAG_FAIL_IMMEDIATELY);
3004
3005 return smb2_lockv(xid, tcon, persist_fid, volatile_fid, pid, 1, &lock);
3006 }
3007
3008 int
3009 SMB2_lease_break(const unsigned int xid, struct cifs_tcon *tcon,
3010 __u8 *lease_key, const __le32 lease_state)
3011 {
3012 int rc;
3013 struct smb2_lease_ack *req = NULL;
3014
3015 cifs_dbg(FYI, "SMB2_lease_break\n");
3016 rc = small_smb2_init(SMB2_OPLOCK_BREAK, tcon, (void **) &req);
3017
3018 if (rc)
3019 return rc;
3020
3021 req->hdr.CreditRequest = cpu_to_le16(1);
3022 req->StructureSize = cpu_to_le16(36);
3023 inc_rfc1001_len(req, 12);
3024
3025 memcpy(req->LeaseKey, lease_key, 16);
3026 req->LeaseState = lease_state;
3027
3028 rc = SendReceiveNoRsp(xid, tcon->ses, (char *) req, CIFS_OBREAK_OP);
3029 /* SMB2 buffer freed by function above */
3030
3031 if (rc) {
3032 cifs_stats_fail_inc(tcon, SMB2_OPLOCK_BREAK_HE);
3033 cifs_dbg(FYI, "Send error in Lease Break = %d\n", rc);
3034 }
3035
3036 return rc;
3037 }
Linux with added FPC-III support