fs/cifs/connect.c

   1 // SPDX-License-Identifier: LGPL-2.1
   2 /*
   3  *   fs/cifs/connect.c
   4  *
   5  *   Copyright (C) International Business Machines  Corp., 2002,2011
   6  *   Author(s): Steve French (sfrench@us.ibm.com)
   7  *
   8  */
   9 #include <linux/fs.h>
  10 #include <linux/net.h>
  11 #include <linux/string.h>
  12 #include <linux/sched/mm.h>
  13 #include <linux/sched/signal.h>
  14 #include <linux/list.h>
  15 #include <linux/wait.h>
  16 #include <linux/slab.h>
  17 #include <linux/pagemap.h>
  18 #include <linux/ctype.h>
  19 #include <linux/utsname.h>
  20 #include <linux/mempool.h>
  21 #include <linux/delay.h>
  22 #include <linux/completion.h>
  23 #include <linux/kthread.h>
  24 #include <linux/pagevec.h>
  25 #include <linux/freezer.h>
  26 #include <linux/namei.h>
  27 #include <linux/uuid.h>
  28 #include <linux/uaccess.h>
  29 #include <asm/processor.h>
  30 #include <linux/inet.h>
  31 #include <linux/module.h>
  32 #include <keys/user-type.h>
  33 #include <net/ipv6.h>
  34 #include <linux/parser.h>
  35 #include <linux/bvec.h>
  36 #include "cifspdu.h"
  37 #include "cifsglob.h"
  38 #include "cifsproto.h"
  39 #include "cifs_unicode.h"
  40 #include "cifs_debug.h"
  41 #include "cifs_fs_sb.h"
  42 #include "ntlmssp.h"
  43 #include "nterr.h"
  44 #include "rfc1002pdu.h"
  45 #include "fscache.h"
  46 #include "smb2proto.h"
  47 #include "smbdirect.h"
  48 #include "dns_resolve.h"
  49 #ifdef CONFIG_CIFS_DFS_UPCALL
  50 #include "dfs_cache.h"
  51 #endif
  52 #include "fs_context.h"
  53 #include "cifs_swn.h"
  54
  55 extern mempool_t *cifs_req_poolp;
  56 extern bool disable_legacy_dialects;
  57
  58 /* FIXME: should these be tunable? */
  59 #define TLINK_ERROR_EXPIRE      (1 * HZ)
  60 #define TLINK_IDLE_EXPIRE       (600 * HZ)
  61
  62 /* Drop the connection to not overload the server */
  63 #define NUM_STATUS_IO_TIMEOUT   5
  64
  65 static int ip_connect(struct TCP_Server_Info *server);
  66 static int generic_ip_connect(struct TCP_Server_Info *server);
  67 static void tlink_rb_insert(struct rb_root *root, struct tcon_link *new_tlink);
  68 static void cifs_prune_tlinks(struct work_struct *work);
  69
  70 /*
  71  * Resolve hostname and set ip addr in tcp ses. Useful for hostnames that may
  72  * get their ip addresses changed at some point.
  73  *
  74  * This should be called with server->srv_mutex held.
  75  */
  76 static int reconn_set_ipaddr_from_hostname(struct TCP_Server_Info *server)
  77 {
  78         int rc;
  79         int len;
  80         char *unc, *ipaddr = NULL;
  81         time64_t expiry, now;
  82         unsigned long ttl = SMB_DNS_RESOLVE_INTERVAL_DEFAULT;
  83
  84         if (!server->hostname)
  85                 return -EINVAL;
  86
  87         len = strlen(server->hostname) + 3;
  88
  89         unc = kmalloc(len, GFP_KERNEL);
  90         if (!unc) {
  91                 cifs_dbg(FYI, "%s: failed to create UNC path\n", __func__);
  92                 return -ENOMEM;
  93         }
  94         scnprintf(unc, len, "\\\\%s", server->hostname);
  95
  96         rc = dns_resolve_server_name_to_ip(unc, &ipaddr, &expiry);
  97         kfree(unc);
  98
  99         if (rc < 0) {
 100                 cifs_dbg(FYI, "%s: failed to resolve server part of %s to IP: %d\n",
 101                          __func__, server->hostname, rc);
 102                 goto requeue_resolve;
 103         }
 104
 105         spin_lock(&cifs_tcp_ses_lock);
 106         rc = cifs_convert_address((struct sockaddr *)&server->dstaddr, ipaddr,
 107                                   strlen(ipaddr));
 108         spin_unlock(&cifs_tcp_ses_lock);
 109         kfree(ipaddr);
 110
 111         /* rc == 1 means success here */
 112         if (rc) {
 113                 now = ktime_get_real_seconds();
 114                 if (expiry && expiry > now)
 115                         /*
 116                          * To make sure we don't use the cached entry, retry 1s
 117                          * after expiry.
 118                          */
 119                         ttl = (expiry - now + 1);
 120         }
 121         rc = !rc ? -1 : 0;
 122
 123 requeue_resolve:
 124         cifs_dbg(FYI, "%s: next dns resolution scheduled for %lu seconds in the future\n",
 125                  __func__, ttl);
 126         mod_delayed_work(cifsiod_wq, &server->resolve, (ttl * HZ));
 127
 128         return rc;
 129 }
 130
 131
 132 static void cifs_resolve_server(struct work_struct *work)
 133 {
 134         int rc;
 135         struct TCP_Server_Info *server = container_of(work,
 136                                         struct TCP_Server_Info, resolve.work);
 137
 138         mutex_lock(&server->srv_mutex);
 139
 140         /*
 141          * Resolve the hostname again to make sure that IP address is up-to-date.
 142          */
 143         rc = reconn_set_ipaddr_from_hostname(server);
 144         if (rc) {
 145                 cifs_dbg(FYI, "%s: failed to resolve hostname: %d\n",
 146                                 __func__, rc);
 147         }
 148
 149         mutex_unlock(&server->srv_mutex);
 150 }
 151
 152 #ifdef CONFIG_CIFS_DFS_UPCALL
 153 /* These functions must be called with server->srv_mutex held */
 154 static void reconn_set_next_dfs_target(struct TCP_Server_Info *server,
 155                                        struct cifs_sb_info *cifs_sb,
 156                                        struct dfs_cache_tgt_list *tgt_list,
 157                                        struct dfs_cache_tgt_iterator **tgt_it)
 158 {
 159         const char *name;
 160         int rc;
 161
 162         if (!cifs_sb || !cifs_sb->origin_fullpath)
 163                 return;
 164
 165         if (!*tgt_it) {
 166                 *tgt_it = dfs_cache_get_tgt_iterator(tgt_list);
 167         } else {
 168                 *tgt_it = dfs_cache_get_next_tgt(tgt_list, *tgt_it);
 169                 if (!*tgt_it)
 170                         *tgt_it = dfs_cache_get_tgt_iterator(tgt_list);
 171         }
 172
 173         cifs_dbg(FYI, "%s: UNC: %s\n", __func__, cifs_sb->origin_fullpath);
 174
 175         name = dfs_cache_get_tgt_name(*tgt_it);
 176
 177         kfree(server->hostname);
 178
 179         server->hostname = extract_hostname(name);
 180         if (IS_ERR(server->hostname)) {
 181                 cifs_dbg(FYI,
 182                          "%s: failed to extract hostname from target: %ld\n",
 183                          __func__, PTR_ERR(server->hostname));
 184                 return;
 185         }
 186
 187         rc = reconn_set_ipaddr_from_hostname(server);
 188         if (rc) {
 189                 cifs_dbg(FYI, "%s: failed to resolve hostname: %d\n",
 190                          __func__, rc);
 191         }
 192 }
 193
 194 static inline int reconn_setup_dfs_targets(struct cifs_sb_info *cifs_sb,
 195                                            struct dfs_cache_tgt_list *tl)
 196 {
 197         if (!cifs_sb->origin_fullpath)
 198                 return -EOPNOTSUPP;
 199         return dfs_cache_noreq_find(cifs_sb->origin_fullpath + 1, NULL, tl);
 200 }
 201 #endif
 202
 203 /*
 204  * cifs tcp session reconnection
 205  *
 206  * mark tcp session as reconnecting so temporarily locked
 207  * mark all smb sessions as reconnecting for tcp session
 208  * reconnect tcp session
 209  * wake up waiters on reconnection? - (not needed currently)
 210  */
 211 int
 212 cifs_reconnect(struct TCP_Server_Info *server)
 213 {
 214         int rc = 0;
 215         struct list_head *tmp, *tmp2;
 216         struct cifs_ses *ses;
 217         struct cifs_tcon *tcon;
 218         struct mid_q_entry *mid_entry;
 219         struct list_head retry_list;
 220 #ifdef CONFIG_CIFS_DFS_UPCALL
 221         struct super_block *sb = NULL;
 222         struct cifs_sb_info *cifs_sb = NULL;
 223         struct dfs_cache_tgt_list tgt_list = {0};
 224         struct dfs_cache_tgt_iterator *tgt_it = NULL;
 225 #endif
 226
 227         spin_lock(&GlobalMid_Lock);
 228         server->nr_targets = 1;
 229 #ifdef CONFIG_CIFS_DFS_UPCALL
 230         spin_unlock(&GlobalMid_Lock);
 231         sb = cifs_get_tcp_super(server);
 232         if (IS_ERR(sb)) {
 233                 rc = PTR_ERR(sb);
 234                 cifs_dbg(FYI, "%s: will not do DFS failover: rc = %d\n",
 235                          __func__, rc);
 236                 sb = NULL;
 237         } else {
 238                 cifs_sb = CIFS_SB(sb);
 239                 rc = reconn_setup_dfs_targets(cifs_sb, &tgt_list);
 240                 if (rc) {
 241                         cifs_sb = NULL;
 242                         if (rc != -EOPNOTSUPP) {
 243                                 cifs_server_dbg(VFS, "%s: no target servers for DFS failover\n",
 244                                                 __func__);
 245                         }
 246                 } else {
 247                         server->nr_targets = dfs_cache_get_nr_tgts(&tgt_list);
 248                 }
 249         }
 250         cifs_dbg(FYI, "%s: will retry %d target(s)\n", __func__,
 251                  server->nr_targets);
 252         spin_lock(&GlobalMid_Lock);
 253 #endif
 254         if (server->tcpStatus == CifsExiting) {
 255                 /* the demux thread will exit normally
 256                 next time through the loop */
 257                 spin_unlock(&GlobalMid_Lock);
 258 #ifdef CONFIG_CIFS_DFS_UPCALL
 259                 dfs_cache_free_tgts(&tgt_list);
 260                 cifs_put_tcp_super(sb);
 261 #endif
 262                 wake_up(&server->response_q);
 263                 return rc;
 264         } else
 265                 server->tcpStatus = CifsNeedReconnect;
 266         spin_unlock(&GlobalMid_Lock);
 267         server->maxBuf = 0;
 268         server->max_read = 0;
 269
 270         cifs_dbg(FYI, "Mark tcp session as need reconnect\n");
 271         trace_smb3_reconnect(server->CurrentMid, server->conn_id, server->hostname);
 272
 273         /* before reconnecting the tcp session, mark the smb session (uid)
 274                 and the tid bad so they are not used until reconnected */
 275         cifs_dbg(FYI, "%s: marking sessions and tcons for reconnect\n",
 276                  __func__);
 277         spin_lock(&cifs_tcp_ses_lock);
 278         list_for_each(tmp, &server->smb_ses_list) {
 279                 ses = list_entry(tmp, struct cifs_ses, smb_ses_list);
 280                 ses->need_reconnect = true;
 281                 list_for_each(tmp2, &ses->tcon_list) {
 282                         tcon = list_entry(tmp2, struct cifs_tcon, tcon_list);
 283                         tcon->need_reconnect = true;
 284                 }
 285                 if (ses->tcon_ipc)
 286                         ses->tcon_ipc->need_reconnect = true;
 287         }
 288         spin_unlock(&cifs_tcp_ses_lock);
 289
 290         /* do not want to be sending data on a socket we are freeing */
 291         cifs_dbg(FYI, "%s: tearing down socket\n", __func__);
 292         mutex_lock(&server->srv_mutex);
 293         if (server->ssocket) {
 294                 cifs_dbg(FYI, "State: 0x%x Flags: 0x%lx\n",
 295                          server->ssocket->state, server->ssocket->flags);
 296                 kernel_sock_shutdown(server->ssocket, SHUT_WR);
 297                 cifs_dbg(FYI, "Post shutdown state: 0x%x Flags: 0x%lx\n",
 298                          server->ssocket->state, server->ssocket->flags);
 299                 sock_release(server->ssocket);
 300                 server->ssocket = NULL;
 301         }
 302         server->sequence_number = 0;
 303         server->session_estab = false;
 304         kfree(server->session_key.response);
 305         server->session_key.response = NULL;
 306         server->session_key.len = 0;
 307         server->lstrp = jiffies;
 308
 309         /* mark submitted MIDs for retry and issue callback */
 310         INIT_LIST_HEAD(&retry_list);
 311         cifs_dbg(FYI, "%s: moving mids to private list\n", __func__);
 312         spin_lock(&GlobalMid_Lock);
 313         list_for_each_safe(tmp, tmp2, &server->pending_mid_q) {
 314                 mid_entry = list_entry(tmp, struct mid_q_entry, qhead);
 315                 kref_get(&mid_entry->refcount);
 316                 if (mid_entry->mid_state == MID_REQUEST_SUBMITTED)
 317                         mid_entry->mid_state = MID_RETRY_NEEDED;
 318                 list_move(&mid_entry->qhead, &retry_list);
 319                 mid_entry->mid_flags |= MID_DELETED;
 320         }
 321         spin_unlock(&GlobalMid_Lock);
 322         mutex_unlock(&server->srv_mutex);
 323
 324         cifs_dbg(FYI, "%s: issuing mid callbacks\n", __func__);
 325         list_for_each_safe(tmp, tmp2, &retry_list) {
 326                 mid_entry = list_entry(tmp, struct mid_q_entry, qhead);
 327                 list_del_init(&mid_entry->qhead);
 328                 mid_entry->callback(mid_entry);
 329                 cifs_mid_q_entry_release(mid_entry);
 330         }
 331
 332         if (cifs_rdma_enabled(server)) {
 333                 mutex_lock(&server->srv_mutex);
 334                 smbd_destroy(server);
 335                 mutex_unlock(&server->srv_mutex);
 336         }
 337
 338         do {
 339                 try_to_freeze();
 340
 341                 mutex_lock(&server->srv_mutex);
 342
 343
 344                 if (!cifs_swn_set_server_dstaddr(server)) {
 345 #ifdef CONFIG_CIFS_DFS_UPCALL
 346                 if (cifs_sb && cifs_sb->origin_fullpath)
 347                         /*
 348                          * Set up next DFS target server (if any) for reconnect. If DFS
 349                          * feature is disabled, then we will retry last server we
 350                          * connected to before.
 351                          */
 352                         reconn_set_next_dfs_target(server, cifs_sb, &tgt_list, &tgt_it);
 353                 else {
 354 #endif
 355                         /*
 356                          * Resolve the hostname again to make sure that IP address is up-to-date.
 357                          */
 358                         rc = reconn_set_ipaddr_from_hostname(server);
 359                         if (rc) {
 360                                 cifs_dbg(FYI, "%s: failed to resolve hostname: %d\n",
 361                                                 __func__, rc);
 362                         }
 363
 364 #ifdef CONFIG_CIFS_DFS_UPCALL
 365                 }
 366 #endif
 367
 368
 369                 }
 370
 371                 if (cifs_rdma_enabled(server))
 372                         rc = smbd_reconnect(server);
 373                 else
 374                         rc = generic_ip_connect(server);
 375                 if (rc) {
 376                         cifs_dbg(FYI, "reconnect error %d\n", rc);
 377                         mutex_unlock(&server->srv_mutex);
 378                         msleep(3000);
 379                 } else {
 380                         atomic_inc(&tcpSesReconnectCount);
 381                         set_credits(server, 1);
 382                         spin_lock(&GlobalMid_Lock);
 383                         if (server->tcpStatus != CifsExiting)
 384                                 server->tcpStatus = CifsNeedNegotiate;
 385                         spin_unlock(&GlobalMid_Lock);
 386                         cifs_swn_reset_server_dstaddr(server);
 387                         mutex_unlock(&server->srv_mutex);
 388                 }
 389         } while (server->tcpStatus == CifsNeedReconnect);
 390
 391 #ifdef CONFIG_CIFS_DFS_UPCALL
 392         if (tgt_it) {
 393                 rc = dfs_cache_noreq_update_tgthint(cifs_sb->origin_fullpath + 1,
 394                                                     tgt_it);
 395                 if (rc) {
 396                         cifs_server_dbg(VFS, "%s: failed to update DFS target hint: rc = %d\n",
 397                                  __func__, rc);
 398                 }
 399                 dfs_cache_free_tgts(&tgt_list);
 400         }
 401
 402         cifs_put_tcp_super(sb);
 403 #endif
 404         if (server->tcpStatus == CifsNeedNegotiate)
 405                 mod_delayed_work(cifsiod_wq, &server->echo, 0);
 406
 407         wake_up(&server->response_q);
 408         return rc;
 409 }
 410
 411 static void
 412 cifs_echo_request(struct work_struct *work)
 413 {
 414         int rc;
 415         struct TCP_Server_Info *server = container_of(work,
 416                                         struct TCP_Server_Info, echo.work);
 417
 418         /*
 419          * We cannot send an echo if it is disabled.
 420          * Also, no need to ping if we got a response recently.
 421          */
 422
 423         if (server->tcpStatus == CifsNeedReconnect ||
 424             server->tcpStatus == CifsExiting ||
 425             server->tcpStatus == CifsNew ||
 426             (server->ops->can_echo && !server->ops->can_echo(server)) ||
 427             time_before(jiffies, server->lstrp + server->echo_interval - HZ))
 428                 goto requeue_echo;
 429
 430         rc = server->ops->echo ? server->ops->echo(server) : -ENOSYS;
 431         if (rc)
 432                 cifs_dbg(FYI, "Unable to send echo request to server: %s\n",
 433                          server->hostname);
 434
 435         /* Check witness registrations */
 436         cifs_swn_check();
 437
 438 requeue_echo:
 439         queue_delayed_work(cifsiod_wq, &server->echo, server->echo_interval);
 440 }
 441
 442 static bool
 443 allocate_buffers(struct TCP_Server_Info *server)
 444 {
 445         if (!server->bigbuf) {
 446                 server->bigbuf = (char *)cifs_buf_get();
 447                 if (!server->bigbuf) {
 448                         cifs_server_dbg(VFS, "No memory for large SMB response\n");
 449                         msleep(3000);
 450                         /* retry will check if exiting */
 451                         return false;
 452                 }
 453         } else if (server->large_buf) {
 454                 /* we are reusing a dirty large buf, clear its start */
 455                 memset(server->bigbuf, 0, HEADER_SIZE(server));
 456         }
 457
 458         if (!server->smallbuf) {
 459                 server->smallbuf = (char *)cifs_small_buf_get();
 460                 if (!server->smallbuf) {
 461                         cifs_server_dbg(VFS, "No memory for SMB response\n");
 462                         msleep(1000);
 463                         /* retry will check if exiting */
 464                         return false;
 465                 }
 466                 /* beginning of smb buffer is cleared in our buf_get */
 467         } else {
 468                 /* if existing small buf clear beginning */
 469                 memset(server->smallbuf, 0, HEADER_SIZE(server));
 470         }
 471
 472         return true;
 473 }
 474
 475 static bool
 476 server_unresponsive(struct TCP_Server_Info *server)
 477 {
 478         /*
 479          * We need to wait 3 echo intervals to make sure we handle such
 480          * situations right:
 481          * 1s  client sends a normal SMB request
 482          * 2s  client gets a response
 483          * 30s echo workqueue job pops, and decides we got a response recently
 484          *     and don't need to send another
 485          * ...
 486          * 65s kernel_recvmsg times out, and we see that we haven't gotten
 487          *     a response in >60s.
 488          */
 489         if ((server->tcpStatus == CifsGood ||
 490             server->tcpStatus == CifsNeedNegotiate) &&
 491             (!server->ops->can_echo || server->ops->can_echo(server)) &&
 492             time_after(jiffies, server->lstrp + 3 * server->echo_interval)) {
 493                 cifs_server_dbg(VFS, "has not responded in %lu seconds. Reconnecting...\n",
 494                          (3 * server->echo_interval) / HZ);
 495                 cifs_reconnect(server);
 496                 return true;
 497         }
 498
 499         return false;
 500 }
 501
 502 static inline bool
 503 zero_credits(struct TCP_Server_Info *server)
 504 {
 505         int val;
 506
 507         spin_lock(&server->req_lock);
 508         val = server->credits + server->echo_credits + server->oplock_credits;
 509         if (server->in_flight == 0 && val == 0) {
 510                 spin_unlock(&server->req_lock);
 511                 return true;
 512         }
 513         spin_unlock(&server->req_lock);
 514         return false;
 515 }
 516
 517 static int
 518 cifs_readv_from_socket(struct TCP_Server_Info *server, struct msghdr *smb_msg)
 519 {
 520         int length = 0;
 521         int total_read;
 522
 523         smb_msg->msg_control = NULL;
 524         smb_msg->msg_controllen = 0;
 525
 526         for (total_read = 0; msg_data_left(smb_msg); total_read += length) {
 527                 try_to_freeze();
 528
 529                 /* reconnect if no credits and no requests in flight */
 530                 if (zero_credits(server)) {
 531                         cifs_reconnect(server);
 532                         return -ECONNABORTED;
 533                 }
 534
 535                 if (server_unresponsive(server))
 536                         return -ECONNABORTED;
 537                 if (cifs_rdma_enabled(server) && server->smbd_conn)
 538                         length = smbd_recv(server->smbd_conn, smb_msg);
 539                 else
 540                         length = sock_recvmsg(server->ssocket, smb_msg, 0);
 541
 542                 if (server->tcpStatus == CifsExiting)
 543                         return -ESHUTDOWN;
 544
 545                 if (server->tcpStatus == CifsNeedReconnect) {
 546                         cifs_reconnect(server);
 547                         return -ECONNABORTED;
 548                 }
 549
 550                 if (length == -ERESTARTSYS ||
 551                     length == -EAGAIN ||
 552                     length == -EINTR) {
 553                         /*
 554                          * Minimum sleep to prevent looping, allowing socket
 555                          * to clear and app threads to set tcpStatus
 556                          * CifsNeedReconnect if server hung.
 557                          */
 558                         usleep_range(1000, 2000);
 559                         length = 0;
 560                         continue;
 561                 }
 562
 563                 if (length <= 0) {
 564                         cifs_dbg(FYI, "Received no data or error: %d\n", length);
 565                         cifs_reconnect(server);
 566                         return -ECONNABORTED;
 567                 }
 568         }
 569         return total_read;
 570 }
 571
 572 int
 573 cifs_read_from_socket(struct TCP_Server_Info *server, char *buf,
 574                       unsigned int to_read)
 575 {
 576         struct msghdr smb_msg;
 577         struct kvec iov = {.iov_base = buf, .iov_len = to_read};
 578         iov_iter_kvec(&smb_msg.msg_iter, READ, &iov, 1, to_read);
 579
 580         return cifs_readv_from_socket(server, &smb_msg);
 581 }
 582
 583 ssize_t
 584 cifs_discard_from_socket(struct TCP_Server_Info *server, size_t to_read)
 585 {
 586         struct msghdr smb_msg;
 587
 588         /*
 589          *  iov_iter_discard already sets smb_msg.type and count and iov_offset
 590          *  and cifs_readv_from_socket sets msg_control and msg_controllen
 591          *  so little to initialize in struct msghdr
 592          */
 593         smb_msg.msg_name = NULL;
 594         smb_msg.msg_namelen = 0;
 595         iov_iter_discard(&smb_msg.msg_iter, READ, to_read);
 596
 597         return cifs_readv_from_socket(server, &smb_msg);
 598 }
 599
 600 int
 601 cifs_read_page_from_socket(struct TCP_Server_Info *server, struct page *page,
 602         unsigned int page_offset, unsigned int to_read)
 603 {
 604         struct msghdr smb_msg;
 605         struct bio_vec bv = {
 606                 .bv_page = page, .bv_len = to_read, .bv_offset = page_offset};
 607         iov_iter_bvec(&smb_msg.msg_iter, READ, &bv, 1, to_read);
 608         return cifs_readv_from_socket(server, &smb_msg);
 609 }
 610
 611 static bool
 612 is_smb_response(struct TCP_Server_Info *server, unsigned char type)
 613 {
 614         /*
 615          * The first byte big endian of the length field,
 616          * is actually not part of the length but the type
 617          * with the most common, zero, as regular data.
 618          */
 619         switch (type) {
 620         case RFC1002_SESSION_MESSAGE:
 621                 /* Regular SMB response */
 622                 return true;
 623         case RFC1002_SESSION_KEEP_ALIVE:
 624                 cifs_dbg(FYI, "RFC 1002 session keep alive\n");
 625                 break;
 626         case RFC1002_POSITIVE_SESSION_RESPONSE:
 627                 cifs_dbg(FYI, "RFC 1002 positive session response\n");
 628                 break;
 629         case RFC1002_NEGATIVE_SESSION_RESPONSE:
 630                 /*
 631                  * We get this from Windows 98 instead of an error on
 632                  * SMB negprot response.
 633                  */
 634                 cifs_dbg(FYI, "RFC 1002 negative session response\n");
 635                 /* give server a second to clean up */
 636                 msleep(1000);
 637                 /*
 638                  * Always try 445 first on reconnect since we get NACK
 639                  * on some if we ever connected to port 139 (the NACK
 640                  * is since we do not begin with RFC1001 session
 641                  * initialize frame).
 642                  */
 643                 cifs_set_port((struct sockaddr *)&server->dstaddr, CIFS_PORT);
 644                 cifs_reconnect(server);
 645                 break;
 646         default:
 647                 cifs_server_dbg(VFS, "RFC 1002 unknown response type 0x%x\n", type);
 648                 cifs_reconnect(server);
 649         }
 650
 651         return false;
 652 }
 653
 654 void
 655 dequeue_mid(struct mid_q_entry *mid, bool malformed)
 656 {
 657 #ifdef CONFIG_CIFS_STATS2
 658         mid->when_received = jiffies;
 659 #endif
 660         spin_lock(&GlobalMid_Lock);
 661         if (!malformed)
 662                 mid->mid_state = MID_RESPONSE_RECEIVED;
 663         else
 664                 mid->mid_state = MID_RESPONSE_MALFORMED;
 665         /*
 666          * Trying to handle/dequeue a mid after the send_recv()
 667          * function has finished processing it is a bug.
 668          */
 669         if (mid->mid_flags & MID_DELETED)
 670                 pr_warn_once("trying to dequeue a deleted mid\n");
 671         else {
 672                 list_del_init(&mid->qhead);
 673                 mid->mid_flags |= MID_DELETED;
 674         }
 675         spin_unlock(&GlobalMid_Lock);
 676 }
 677
 678 static unsigned int
 679 smb2_get_credits_from_hdr(char *buffer, struct TCP_Server_Info *server)
 680 {
 681         struct smb2_sync_hdr *shdr = (struct smb2_sync_hdr *)buffer;
 682
 683         /*
 684          * SMB1 does not use credits.
 685          */
 686         if (server->vals->header_preamble_size)
 687                 return 0;
 688
 689         return le16_to_cpu(shdr->CreditRequest);
 690 }
 691
 692 static void
 693 handle_mid(struct mid_q_entry *mid, struct TCP_Server_Info *server,
 694            char *buf, int malformed)
 695 {
 696         if (server->ops->check_trans2 &&
 697             server->ops->check_trans2(mid, server, buf, malformed))
 698                 return;
 699         mid->credits_received = smb2_get_credits_from_hdr(buf, server);
 700         mid->resp_buf = buf;
 701         mid->large_buf = server->large_buf;
 702         /* Was previous buf put in mpx struct for multi-rsp? */
 703         if (!mid->multiRsp) {
 704                 /* smb buffer will be freed by user thread */
 705                 if (server->large_buf)
 706                         server->bigbuf = NULL;
 707                 else
 708                         server->smallbuf = NULL;
 709         }
 710         dequeue_mid(mid, malformed);
 711 }
 712
 713 static void clean_demultiplex_info(struct TCP_Server_Info *server)
 714 {
 715         int length;
 716
 717         /* take it off the list, if it's not already */
 718         spin_lock(&cifs_tcp_ses_lock);
 719         list_del_init(&server->tcp_ses_list);
 720         spin_unlock(&cifs_tcp_ses_lock);
 721
 722         cancel_delayed_work_sync(&server->echo);
 723         cancel_delayed_work_sync(&server->resolve);
 724
 725         spin_lock(&GlobalMid_Lock);
 726         server->tcpStatus = CifsExiting;
 727         spin_unlock(&GlobalMid_Lock);
 728         wake_up_all(&server->response_q);
 729
 730         /* check if we have blocked requests that need to free */
 731         spin_lock(&server->req_lock);
 732         if (server->credits <= 0)
 733                 server->credits = 1;
 734         spin_unlock(&server->req_lock);
 735         /*
 736          * Although there should not be any requests blocked on this queue it
 737          * can not hurt to be paranoid and try to wake up requests that may
 738          * haven been blocked when more than 50 at time were on the wire to the
 739          * same server - they now will see the session is in exit state and get
 740          * out of SendReceive.
 741          */
 742         wake_up_all(&server->request_q);
 743         /* give those requests time to exit */
 744         msleep(125);
 745         if (cifs_rdma_enabled(server))
 746                 smbd_destroy(server);
 747         if (server->ssocket) {
 748                 sock_release(server->ssocket);
 749                 server->ssocket = NULL;
 750         }
 751
 752         if (!list_empty(&server->pending_mid_q)) {
 753                 struct list_head dispose_list;
 754                 struct mid_q_entry *mid_entry;
 755                 struct list_head *tmp, *tmp2;
 756
 757                 INIT_LIST_HEAD(&dispose_list);
 758                 spin_lock(&GlobalMid_Lock);
 759                 list_for_each_safe(tmp, tmp2, &server->pending_mid_q) {
 760                         mid_entry = list_entry(tmp, struct mid_q_entry, qhead);
 761                         cifs_dbg(FYI, "Clearing mid %llu\n", mid_entry->mid);
 762                         kref_get(&mid_entry->refcount);
 763                         mid_entry->mid_state = MID_SHUTDOWN;
 764                         list_move(&mid_entry->qhead, &dispose_list);
 765                         mid_entry->mid_flags |= MID_DELETED;
 766                 }
 767                 spin_unlock(&GlobalMid_Lock);
 768
 769                 /* now walk dispose list and issue callbacks */
 770                 list_for_each_safe(tmp, tmp2, &dispose_list) {
 771                         mid_entry = list_entry(tmp, struct mid_q_entry, qhead);
 772                         cifs_dbg(FYI, "Callback mid %llu\n", mid_entry->mid);
 773                         list_del_init(&mid_entry->qhead);
 774                         mid_entry->callback(mid_entry);
 775                         cifs_mid_q_entry_release(mid_entry);
 776                 }
 777                 /* 1/8th of sec is more than enough time for them to exit */
 778                 msleep(125);
 779         }
 780
 781         if (!list_empty(&server->pending_mid_q)) {
 782                 /*
 783                  * mpx threads have not exited yet give them at least the smb
 784                  * send timeout time for long ops.
 785                  *
 786                  * Due to delays on oplock break requests, we need to wait at
 787                  * least 45 seconds before giving up on a request getting a
 788                  * response and going ahead and killing cifsd.
 789                  */
 790                 cifs_dbg(FYI, "Wait for exit from demultiplex thread\n");
 791                 msleep(46000);
 792                 /*
 793                  * If threads still have not exited they are probably never
 794                  * coming home not much else we can do but free the memory.
 795                  */
 796         }
 797
 798         kfree(server->hostname);
 799         kfree(server);
 800
 801         length = atomic_dec_return(&tcpSesAllocCount);
 802         if (length > 0)
 803                 mempool_resize(cifs_req_poolp, length + cifs_min_rcv);
 804 }
 805
 806 static int
 807 standard_receive3(struct TCP_Server_Info *server, struct mid_q_entry *mid)
 808 {
 809         int length;
 810         char *buf = server->smallbuf;
 811         unsigned int pdu_length = server->pdu_size;
 812
 813         /* make sure this will fit in a large buffer */
 814         if (pdu_length > CIFSMaxBufSize + MAX_HEADER_SIZE(server) -
 815                 server->vals->header_preamble_size) {
 816                 cifs_server_dbg(VFS, "SMB response too long (%u bytes)\n", pdu_length);
 817                 cifs_reconnect(server);
 818                 return -ECONNABORTED;
 819         }
 820
 821         /* switch to large buffer if too big for a small one */
 822         if (pdu_length > MAX_CIFS_SMALL_BUFFER_SIZE - 4) {
 823                 server->large_buf = true;
 824                 memcpy(server->bigbuf, buf, server->total_read);
 825                 buf = server->bigbuf;
 826         }
 827
 828         /* now read the rest */
 829         length = cifs_read_from_socket(server, buf + HEADER_SIZE(server) - 1,
 830                                        pdu_length - HEADER_SIZE(server) + 1
 831                                        + server->vals->header_preamble_size);
 832
 833         if (length < 0)
 834                 return length;
 835         server->total_read += length;
 836
 837         dump_smb(buf, server->total_read);
 838
 839         return cifs_handle_standard(server, mid);
 840 }
 841
 842 int
 843 cifs_handle_standard(struct TCP_Server_Info *server, struct mid_q_entry *mid)
 844 {
 845         char *buf = server->large_buf ? server->bigbuf : server->smallbuf;
 846         int length;
 847
 848         /*
 849          * We know that we received enough to get to the MID as we
 850          * checked the pdu_length earlier. Now check to see
 851          * if the rest of the header is OK. We borrow the length
 852          * var for the rest of the loop to avoid a new stack var.
 853          *
 854          * 48 bytes is enough to display the header and a little bit
 855          * into the payload for debugging purposes.
 856          */
 857         length = server->ops->check_message(buf, server->total_read, server);
 858         if (length != 0)
 859                 cifs_dump_mem("Bad SMB: ", buf,
 860                         min_t(unsigned int, server->total_read, 48));
 861
 862         if (server->ops->is_session_expired &&
 863             server->ops->is_session_expired(buf)) {
 864                 cifs_reconnect(server);
 865                 return -1;
 866         }
 867
 868         if (server->ops->is_status_pending &&
 869             server->ops->is_status_pending(buf, server))
 870                 return -1;
 871
 872         if (!mid)
 873                 return length;
 874
 875         handle_mid(mid, server, buf, length);
 876         return 0;
 877 }
 878
 879 static void
 880 smb2_add_credits_from_hdr(char *buffer, struct TCP_Server_Info *server)
 881 {
 882         struct smb2_sync_hdr *shdr = (struct smb2_sync_hdr *)buffer;
 883         int scredits, in_flight;
 884
 885         /*
 886          * SMB1 does not use credits.
 887          */
 888         if (server->vals->header_preamble_size)
 889                 return;
 890
 891         if (shdr->CreditRequest) {
 892                 spin_lock(&server->req_lock);
 893                 server->credits += le16_to_cpu(shdr->CreditRequest);
 894                 scredits = server->credits;
 895                 in_flight = server->in_flight;
 896                 spin_unlock(&server->req_lock);
 897                 wake_up(&server->request_q);
 898
 899                 trace_smb3_add_credits(server->CurrentMid,
 900                                 server->conn_id, server->hostname, scredits,
 901                                 le16_to_cpu(shdr->CreditRequest), in_flight);
 902                 cifs_server_dbg(FYI, "%s: added %u credits total=%d\n",
 903                                 __func__, le16_to_cpu(shdr->CreditRequest),
 904                                 scredits);
 905         }
 906 }
 907
 908
 909 static int
 910 cifs_demultiplex_thread(void *p)
 911 {
 912         int i, num_mids, length;
 913         struct TCP_Server_Info *server = p;
 914         unsigned int pdu_length;
 915         unsigned int next_offset;
 916         char *buf = NULL;
 917         struct task_struct *task_to_wake = NULL;
 918         struct mid_q_entry *mids[MAX_COMPOUND];
 919         char *bufs[MAX_COMPOUND];
 920         unsigned int noreclaim_flag, num_io_timeout = 0;
 921
 922         noreclaim_flag = memalloc_noreclaim_save();
 923         cifs_dbg(FYI, "Demultiplex PID: %d\n", task_pid_nr(current));
 924
 925         length = atomic_inc_return(&tcpSesAllocCount);
 926         if (length > 1)
 927                 mempool_resize(cifs_req_poolp, length + cifs_min_rcv);
 928
 929         set_freezable();
 930         allow_kernel_signal(SIGKILL);
 931         while (server->tcpStatus != CifsExiting) {
 932                 if (try_to_freeze())
 933                         continue;
 934
 935                 if (!allocate_buffers(server))
 936                         continue;
 937
 938                 server->large_buf = false;
 939                 buf = server->smallbuf;
 940                 pdu_length = 4; /* enough to get RFC1001 header */
 941
 942                 length = cifs_read_from_socket(server, buf, pdu_length);
 943                 if (length < 0)
 944                         continue;
 945
 946                 if (server->vals->header_preamble_size == 0)
 947                         server->total_read = 0;
 948                 else
 949                         server->total_read = length;
 950
 951                 /*
 952                  * The right amount was read from socket - 4 bytes,
 953                  * so we can now interpret the length field.
 954                  */
 955                 pdu_length = get_rfc1002_length(buf);
 956
 957                 cifs_dbg(FYI, "RFC1002 header 0x%x\n", pdu_length);
 958                 if (!is_smb_response(server, buf[0]))
 959                         continue;
 960 next_pdu:
 961                 server->pdu_size = pdu_length;
 962
 963                 /* make sure we have enough to get to the MID */
 964                 if (server->pdu_size < HEADER_SIZE(server) - 1 -
 965                     server->vals->header_preamble_size) {
 966                         cifs_server_dbg(VFS, "SMB response too short (%u bytes)\n",
 967                                  server->pdu_size);
 968                         cifs_reconnect(server);
 969                         continue;
 970                 }
 971
 972                 /* read down to the MID */
 973                 length = cifs_read_from_socket(server,
 974                              buf + server->vals->header_preamble_size,
 975                              HEADER_SIZE(server) - 1
 976                              - server->vals->header_preamble_size);
 977                 if (length < 0)
 978                         continue;
 979                 server->total_read += length;
 980
 981                 if (server->ops->next_header) {
 982                         next_offset = server->ops->next_header(buf);
 983                         if (next_offset)
 984                                 server->pdu_size = next_offset;
 985                 }
 986
 987                 memset(mids, 0, sizeof(mids));
 988                 memset(bufs, 0, sizeof(bufs));
 989                 num_mids = 0;
 990
 991                 if (server->ops->is_transform_hdr &&
 992                     server->ops->receive_transform &&
 993                     server->ops->is_transform_hdr(buf)) {
 994                         length = server->ops->receive_transform(server,
 995                                                                 mids,
 996                                                                 bufs,
 997                                                                 &num_mids);
 998                 } else {
 999                         mids[0] = server->ops->find_mid(server, buf);
1000                         bufs[0] = buf;
1001                         num_mids = 1;
1002
1003                         if (!mids[0] || !mids[0]->receive)
1004                                 length = standard_receive3(server, mids[0]);
1005                         else
1006                                 length = mids[0]->receive(server, mids[0]);
1007                 }
1008
1009                 if (length < 0) {
1010                         for (i = 0; i < num_mids; i++)
1011                                 if (mids[i])
1012                                         cifs_mid_q_entry_release(mids[i]);
1013                         continue;
1014                 }
1015
1016                 if (server->ops->is_status_io_timeout &&
1017                     server->ops->is_status_io_timeout(buf)) {
1018                         num_io_timeout++;
1019                         if (num_io_timeout > NUM_STATUS_IO_TIMEOUT) {
1020                                 cifs_reconnect(server);
1021                                 num_io_timeout = 0;
1022                                 continue;
1023                         }
1024                 }
1025
1026                 server->lstrp = jiffies;
1027
1028                 for (i = 0; i < num_mids; i++) {
1029                         if (mids[i] != NULL) {
1030                                 mids[i]->resp_buf_size = server->pdu_size;
1031
1032                                 if (bufs[i] && server->ops->is_network_name_deleted)
1033                                         server->ops->is_network_name_deleted(bufs[i],
1034                                                                         server);
1035
1036                                 if (!mids[i]->multiRsp || mids[i]->multiEnd)
1037                                         mids[i]->callback(mids[i]);
1038
1039                                 cifs_mid_q_entry_release(mids[i]);
1040                         } else if (server->ops->is_oplock_break &&
1041                                    server->ops->is_oplock_break(bufs[i],
1042                                                                 server)) {
1043                                 smb2_add_credits_from_hdr(bufs[i], server);
1044                                 cifs_dbg(FYI, "Received oplock break\n");
1045                         } else {
1046                                 cifs_server_dbg(VFS, "No task to wake, unknown frame received! NumMids %d\n",
1047                                                 atomic_read(&midCount));
1048                                 cifs_dump_mem("Received Data is: ", bufs[i],
1049                                               HEADER_SIZE(server));
1050                                 smb2_add_credits_from_hdr(bufs[i], server);
1051 #ifdef CONFIG_CIFS_DEBUG2
1052                                 if (server->ops->dump_detail)
1053                                         server->ops->dump_detail(bufs[i],
1054                                                                  server);
1055                                 cifs_dump_mids(server);
1056 #endif /* CIFS_DEBUG2 */
1057                         }
1058                 }
1059
1060                 if (pdu_length > server->pdu_size) {
1061                         if (!allocate_buffers(server))
1062                                 continue;
1063                         pdu_length -= server->pdu_size;
1064                         server->total_read = 0;
1065                         server->large_buf = false;
1066                         buf = server->smallbuf;
1067                         goto next_pdu;
1068                 }
1069         } /* end while !EXITING */
1070
1071         /* buffer usually freed in free_mid - need to free it here on exit */
1072         cifs_buf_release(server->bigbuf);
1073         if (server->smallbuf) /* no sense logging a debug message if NULL */
1074                 cifs_small_buf_release(server->smallbuf);
1075
1076         task_to_wake = xchg(&server->tsk, NULL);
1077         clean_demultiplex_info(server);
1078
1079         /* if server->tsk was NULL then wait for a signal before exiting */
1080         if (!task_to_wake) {
1081                 set_current_state(TASK_INTERRUPTIBLE);
1082                 while (!signal_pending(current)) {
1083                         schedule();
1084                         set_current_state(TASK_INTERRUPTIBLE);
1085                 }
1086                 set_current_state(TASK_RUNNING);
1087         }
1088
1089         memalloc_noreclaim_restore(noreclaim_flag);
1090         module_put_and_exit(0);
1091 }
1092
1093 /**
1094  * Returns true if srcaddr isn't specified and rhs isn't specified, or
1095  * if srcaddr is specified and matches the IP address of the rhs argument
1096  */
1097 bool
1098 cifs_match_ipaddr(struct sockaddr *srcaddr, struct sockaddr *rhs)
1099 {
1100         switch (srcaddr->sa_family) {
1101         case AF_UNSPEC:
1102                 return (rhs->sa_family == AF_UNSPEC);
1103         case AF_INET: {
1104                 struct sockaddr_in *saddr4 = (struct sockaddr_in *)srcaddr;
1105                 struct sockaddr_in *vaddr4 = (struct sockaddr_in *)rhs;
1106                 return (saddr4->sin_addr.s_addr == vaddr4->sin_addr.s_addr);
1107         }
1108         case AF_INET6: {
1109                 struct sockaddr_in6 *saddr6 = (struct sockaddr_in6 *)srcaddr;
1110                 struct sockaddr_in6 *vaddr6 = (struct sockaddr_in6 *)rhs;
1111                 return ipv6_addr_equal(&saddr6->sin6_addr, &vaddr6->sin6_addr);
1112         }
1113         default:
1114                 WARN_ON(1);
1115                 return false; /* don't expect to be here */
1116         }
1117 }
1118
1119 /*
1120  * If no port is specified in addr structure, we try to match with 445 port
1121  * and if it fails - with 139 ports. It should be called only if address
1122  * families of server and addr are equal.
1123  */
1124 static bool
1125 match_port(struct TCP_Server_Info *server, struct sockaddr *addr)
1126 {
1127         __be16 port, *sport;
1128
1129         /* SMBDirect manages its own ports, don't match it here */
1130         if (server->rdma)
1131                 return true;
1132
1133         switch (addr->sa_family) {
1134         case AF_INET:
1135                 sport = &((struct sockaddr_in *) &server->dstaddr)->sin_port;
1136                 port = ((struct sockaddr_in *) addr)->sin_port;
1137                 break;
1138         case AF_INET6:
1139                 sport = &((struct sockaddr_in6 *) &server->dstaddr)->sin6_port;
1140                 port = ((struct sockaddr_in6 *) addr)->sin6_port;
1141                 break;
1142         default:
1143                 WARN_ON(1);
1144                 return false;
1145         }
1146
1147         if (!port) {
1148                 port = htons(CIFS_PORT);
1149                 if (port == *sport)
1150                         return true;
1151
1152                 port = htons(RFC1001_PORT);
1153         }
1154
1155         return port == *sport;
1156 }
1157
1158 static bool
1159 match_address(struct TCP_Server_Info *server, struct sockaddr *addr,
1160               struct sockaddr *srcaddr)
1161 {
1162         switch (addr->sa_family) {
1163         case AF_INET: {
1164                 struct sockaddr_in *addr4 = (struct sockaddr_in *)addr;
1165                 struct sockaddr_in *srv_addr4 =
1166                                         (struct sockaddr_in *)&server->dstaddr;
1167
1168                 if (addr4->sin_addr.s_addr != srv_addr4->sin_addr.s_addr)
1169                         return false;
1170                 break;
1171         }
1172         case AF_INET6: {
1173                 struct sockaddr_in6 *addr6 = (struct sockaddr_in6 *)addr;
1174                 struct sockaddr_in6 *srv_addr6 =
1175                                         (struct sockaddr_in6 *)&server->dstaddr;
1176
1177                 if (!ipv6_addr_equal(&addr6->sin6_addr,
1178                                      &srv_addr6->sin6_addr))
1179                         return false;
1180                 if (addr6->sin6_scope_id != srv_addr6->sin6_scope_id)
1181                         return false;
1182                 break;
1183         }
1184         default:
1185                 WARN_ON(1);
1186                 return false; /* don't expect to be here */
1187         }
1188
1189         if (!cifs_match_ipaddr(srcaddr, (struct sockaddr *)&server->srcaddr))
1190                 return false;
1191
1192         return true;
1193 }
1194
1195 static bool
1196 match_security(struct TCP_Server_Info *server, struct smb3_fs_context *ctx)
1197 {
1198         /*
1199          * The select_sectype function should either return the ctx->sectype
1200          * that was specified, or "Unspecified" if that sectype was not
1201          * compatible with the given NEGOTIATE request.
1202          */
1203         if (server->ops->select_sectype(server, ctx->sectype)
1204              == Unspecified)
1205                 return false;
1206
1207         /*
1208          * Now check if signing mode is acceptable. No need to check
1209          * global_secflags at this point since if MUST_SIGN is set then
1210          * the server->sign had better be too.
1211          */
1212         if (ctx->sign && !server->sign)
1213                 return false;
1214
1215         return true;
1216 }
1217
1218 static int match_server(struct TCP_Server_Info *server, struct smb3_fs_context *ctx)
1219 {
1220         struct sockaddr *addr = (struct sockaddr *)&ctx->dstaddr;
1221
1222         if (ctx->nosharesock)
1223                 return 0;
1224
1225         /* If multidialect negotiation see if existing sessions match one */
1226         if (strcmp(ctx->vals->version_string, SMB3ANY_VERSION_STRING) == 0) {
1227                 if (server->vals->protocol_id < SMB30_PROT_ID)
1228                         return 0;
1229         } else if (strcmp(ctx->vals->version_string,
1230                    SMBDEFAULT_VERSION_STRING) == 0) {
1231                 if (server->vals->protocol_id < SMB21_PROT_ID)
1232                         return 0;
1233         } else if ((server->vals != ctx->vals) || (server->ops != ctx->ops))
1234                 return 0;
1235
1236         if (!net_eq(cifs_net_ns(server), current->nsproxy->net_ns))
1237                 return 0;
1238
1239         if (!match_address(server, addr,
1240                            (struct sockaddr *)&ctx->srcaddr))
1241                 return 0;
1242
1243         if (!match_port(server, addr))
1244                 return 0;
1245
1246         if (!match_security(server, ctx))
1247                 return 0;
1248
1249         if (server->echo_interval != ctx->echo_interval * HZ)
1250                 return 0;
1251
1252         if (server->rdma != ctx->rdma)
1253                 return 0;
1254
1255         if (server->ignore_signature != ctx->ignore_signature)
1256                 return 0;
1257
1258         if (server->min_offload != ctx->min_offload)
1259                 return 0;
1260
1261         return 1;
1262 }
1263
1264 struct TCP_Server_Info *
1265 cifs_find_tcp_session(struct smb3_fs_context *ctx)
1266 {
1267         struct TCP_Server_Info *server;
1268
1269         spin_lock(&cifs_tcp_ses_lock);
1270         list_for_each_entry(server, &cifs_tcp_ses_list, tcp_ses_list) {
1271                 /*
1272                  * Skip ses channels since they're only handled in lower layers
1273                  * (e.g. cifs_send_recv).
1274                  */
1275                 if (server->is_channel || !match_server(server, ctx))
1276                         continue;
1277
1278                 ++server->srv_count;
1279                 spin_unlock(&cifs_tcp_ses_lock);
1280                 cifs_dbg(FYI, "Existing tcp session with server found\n");
1281                 return server;
1282         }
1283         spin_unlock(&cifs_tcp_ses_lock);
1284         return NULL;
1285 }
1286
1287 void
1288 cifs_put_tcp_session(struct TCP_Server_Info *server, int from_reconnect)
1289 {
1290         struct task_struct *task;
1291
1292         spin_lock(&cifs_tcp_ses_lock);
1293         if (--server->srv_count > 0) {
1294                 spin_unlock(&cifs_tcp_ses_lock);
1295                 return;
1296         }
1297
1298         put_net(cifs_net_ns(server));
1299
1300         list_del_init(&server->tcp_ses_list);
1301         spin_unlock(&cifs_tcp_ses_lock);
1302
1303         cancel_delayed_work_sync(&server->echo);
1304         cancel_delayed_work_sync(&server->resolve);
1305
1306         if (from_reconnect)
1307                 /*
1308                  * Avoid deadlock here: reconnect work calls
1309                  * cifs_put_tcp_session() at its end. Need to be sure
1310                  * that reconnect work does nothing with server pointer after
1311                  * that step.
1312                  */
1313                 cancel_delayed_work(&server->reconnect);
1314         else
1315                 cancel_delayed_work_sync(&server->reconnect);
1316
1317         spin_lock(&GlobalMid_Lock);
1318         server->tcpStatus = CifsExiting;
1319         spin_unlock(&GlobalMid_Lock);
1320
1321         cifs_crypto_secmech_release(server);
1322         cifs_fscache_release_client_cookie(server);
1323
1324         kfree(server->session_key.response);
1325         server->session_key.response = NULL;
1326         server->session_key.len = 0;
1327
1328         task = xchg(&server->tsk, NULL);
1329         if (task)
1330                 send_sig(SIGKILL, task, 1);
1331 }
1332
1333 struct TCP_Server_Info *
1334 cifs_get_tcp_session(struct smb3_fs_context *ctx)
1335 {
1336         struct TCP_Server_Info *tcp_ses = NULL;
1337         int rc;
1338
1339         cifs_dbg(FYI, "UNC: %s\n", ctx->UNC);
1340
1341         /* see if we already have a matching tcp_ses */
1342         tcp_ses = cifs_find_tcp_session(ctx);
1343         if (tcp_ses)
1344                 return tcp_ses;
1345
1346         tcp_ses = kzalloc(sizeof(struct TCP_Server_Info), GFP_KERNEL);
1347         if (!tcp_ses) {
1348                 rc = -ENOMEM;
1349                 goto out_err;
1350         }
1351
1352         tcp_ses->ops = ctx->ops;
1353         tcp_ses->vals = ctx->vals;
1354         cifs_set_net_ns(tcp_ses, get_net(current->nsproxy->net_ns));
1355         tcp_ses->hostname = extract_hostname(ctx->UNC);
1356         if (IS_ERR(tcp_ses->hostname)) {
1357                 rc = PTR_ERR(tcp_ses->hostname);
1358                 goto out_err_crypto_release;
1359         }
1360
1361         tcp_ses->conn_id = atomic_inc_return(&tcpSesNextId);
1362         tcp_ses->noblockcnt = ctx->rootfs;
1363         tcp_ses->noblocksnd = ctx->noblocksnd || ctx->rootfs;
1364         tcp_ses->noautotune = ctx->noautotune;
1365         tcp_ses->tcp_nodelay = ctx->sockopt_tcp_nodelay;
1366         tcp_ses->rdma = ctx->rdma;
1367         tcp_ses->in_flight = 0;
1368         tcp_ses->max_in_flight = 0;
1369         tcp_ses->credits = 1;
1370         init_waitqueue_head(&tcp_ses->response_q);
1371         init_waitqueue_head(&tcp_ses->request_q);
1372         INIT_LIST_HEAD(&tcp_ses->pending_mid_q);
1373         mutex_init(&tcp_ses->srv_mutex);
1374         memcpy(tcp_ses->workstation_RFC1001_name,
1375                 ctx->source_rfc1001_name, RFC1001_NAME_LEN_WITH_NULL);
1376         memcpy(tcp_ses->server_RFC1001_name,
1377                 ctx->target_rfc1001_name, RFC1001_NAME_LEN_WITH_NULL);
1378         tcp_ses->session_estab = false;
1379         tcp_ses->sequence_number = 0;
1380         tcp_ses->reconnect_instance = 1;
1381         tcp_ses->lstrp = jiffies;
1382         tcp_ses->compress_algorithm = cpu_to_le16(ctx->compression);
1383         spin_lock_init(&tcp_ses->req_lock);
1384         INIT_LIST_HEAD(&tcp_ses->tcp_ses_list);
1385         INIT_LIST_HEAD(&tcp_ses->smb_ses_list);
1386         INIT_DELAYED_WORK(&tcp_ses->echo, cifs_echo_request);
1387         INIT_DELAYED_WORK(&tcp_ses->resolve, cifs_resolve_server);
1388         INIT_DELAYED_WORK(&tcp_ses->reconnect, smb2_reconnect_server);
1389         mutex_init(&tcp_ses->reconnect_mutex);
1390         memcpy(&tcp_ses->srcaddr, &ctx->srcaddr,
1391                sizeof(tcp_ses->srcaddr));
1392         memcpy(&tcp_ses->dstaddr, &ctx->dstaddr,
1393                 sizeof(tcp_ses->dstaddr));
1394         if (ctx->use_client_guid)
1395                 memcpy(tcp_ses->client_guid, ctx->client_guid,
1396                        SMB2_CLIENT_GUID_SIZE);
1397         else
1398                 generate_random_uuid(tcp_ses->client_guid);
1399         /*
1400          * at this point we are the only ones with the pointer
1401          * to the struct since the kernel thread not created yet
1402          * no need to spinlock this init of tcpStatus or srv_count
1403          */
1404         tcp_ses->tcpStatus = CifsNew;
1405         ++tcp_ses->srv_count;
1406
1407         if (ctx->echo_interval >= SMB_ECHO_INTERVAL_MIN &&
1408                 ctx->echo_interval <= SMB_ECHO_INTERVAL_MAX)
1409                 tcp_ses->echo_interval = ctx->echo_interval * HZ;
1410         else
1411                 tcp_ses->echo_interval = SMB_ECHO_INTERVAL_DEFAULT * HZ;
1412         if (tcp_ses->rdma) {
1413 #ifndef CONFIG_CIFS_SMB_DIRECT
1414                 cifs_dbg(VFS, "CONFIG_CIFS_SMB_DIRECT is not enabled\n");
1415                 rc = -ENOENT;
1416                 goto out_err_crypto_release;
1417 #endif
1418                 tcp_ses->smbd_conn = smbd_get_connection(
1419                         tcp_ses, (struct sockaddr *)&ctx->dstaddr);
1420                 if (tcp_ses->smbd_conn) {
1421                         cifs_dbg(VFS, "RDMA transport established\n");
1422                         rc = 0;
1423                         goto smbd_connected;
1424                 } else {
1425                         rc = -ENOENT;
1426                         goto out_err_crypto_release;
1427                 }
1428         }
1429         rc = ip_connect(tcp_ses);
1430         if (rc < 0) {
1431                 cifs_dbg(VFS, "Error connecting to socket. Aborting operation.\n");
1432                 goto out_err_crypto_release;
1433         }
1434 smbd_connected:
1435         /*
1436          * since we're in a cifs function already, we know that
1437          * this will succeed. No need for try_module_get().
1438          */
1439         __module_get(THIS_MODULE);
1440         tcp_ses->tsk = kthread_run(cifs_demultiplex_thread,
1441                                   tcp_ses, "cifsd");
1442         if (IS_ERR(tcp_ses->tsk)) {
1443                 rc = PTR_ERR(tcp_ses->tsk);
1444                 cifs_dbg(VFS, "error %d create cifsd thread\n", rc);
1445                 module_put(THIS_MODULE);
1446                 goto out_err_crypto_release;
1447         }
1448         tcp_ses->min_offload = ctx->min_offload;
1449         /*
1450          * at this point we are the only ones with the pointer
1451          * to the struct since the kernel thread not created yet
1452          * no need to spinlock this update of tcpStatus
1453          */
1454         tcp_ses->tcpStatus = CifsNeedNegotiate;
1455
1456         if ((ctx->max_credits < 20) || (ctx->max_credits > 60000))
1457                 tcp_ses->max_credits = SMB2_MAX_CREDITS_AVAILABLE;
1458         else
1459                 tcp_ses->max_credits = ctx->max_credits;
1460
1461         tcp_ses->nr_targets = 1;
1462         tcp_ses->ignore_signature = ctx->ignore_signature;
1463         /* thread spawned, put it on the list */
1464         spin_lock(&cifs_tcp_ses_lock);
1465         list_add(&tcp_ses->tcp_ses_list, &cifs_tcp_ses_list);
1466         spin_unlock(&cifs_tcp_ses_lock);
1467
1468         cifs_fscache_get_client_cookie(tcp_ses);
1469
1470         /* queue echo request delayed work */
1471         queue_delayed_work(cifsiod_wq, &tcp_ses->echo, tcp_ses->echo_interval);
1472
1473         /* queue dns resolution delayed work */
1474         cifs_dbg(FYI, "%s: next dns resolution scheduled for %d seconds in the future\n",
1475                  __func__, SMB_DNS_RESOLVE_INTERVAL_DEFAULT);
1476
1477         queue_delayed_work(cifsiod_wq, &tcp_ses->resolve, (SMB_DNS_RESOLVE_INTERVAL_DEFAULT * HZ));
1478
1479         return tcp_ses;
1480
1481 out_err_crypto_release:
1482         cifs_crypto_secmech_release(tcp_ses);
1483
1484         put_net(cifs_net_ns(tcp_ses));
1485
1486 out_err:
1487         if (tcp_ses) {
1488                 if (!IS_ERR(tcp_ses->hostname))
1489                         kfree(tcp_ses->hostname);
1490                 if (tcp_ses->ssocket)
1491                         sock_release(tcp_ses->ssocket);
1492                 kfree(tcp_ses);
1493         }
1494         return ERR_PTR(rc);
1495 }
1496
1497 static int match_session(struct cifs_ses *ses, struct smb3_fs_context *ctx)
1498 {
1499         if (ctx->sectype != Unspecified &&
1500             ctx->sectype != ses->sectype)
1501                 return 0;
1502
1503         /*
1504          * If an existing session is limited to less channels than
1505          * requested, it should not be reused
1506          */
1507         if (ses->chan_max < ctx->max_channels)
1508                 return 0;
1509
1510         switch (ses->sectype) {
1511         case Kerberos:
1512                 if (!uid_eq(ctx->cred_uid, ses->cred_uid))
1513                         return 0;
1514                 break;
1515         default:
1516                 /* NULL username means anonymous session */
1517                 if (ses->user_name == NULL) {
1518                         if (!ctx->nullauth)
1519                                 return 0;
1520                         break;
1521                 }
1522
1523                 /* anything else takes username/password */
1524                 if (strncmp(ses->user_name,
1525                             ctx->username ? ctx->username : "",
1526                             CIFS_MAX_USERNAME_LEN))
1527                         return 0;
1528                 if ((ctx->username && strlen(ctx->username) != 0) &&
1529                     ses->password != NULL &&
1530                     strncmp(ses->password,
1531                             ctx->password ? ctx->password : "",
1532                             CIFS_MAX_PASSWORD_LEN))
1533                         return 0;
1534         }
1535         return 1;
1536 }
1537
1538 /**
1539  * cifs_setup_ipc - helper to setup the IPC tcon for the session
1540  *
1541  * A new IPC connection is made and stored in the session
1542  * tcon_ipc. The IPC tcon has the same lifetime as the session.
1543  */
1544 static int
1545 cifs_setup_ipc(struct cifs_ses *ses, struct smb3_fs_context *ctx)
1546 {
1547         int rc = 0, xid;
1548         struct cifs_tcon *tcon;
1549         char unc[SERVER_NAME_LENGTH + sizeof("//x/IPC$")] = {0};
1550         bool seal = false;
1551         struct TCP_Server_Info *server = ses->server;
1552
1553         /*
1554          * If the mount request that resulted in the creation of the
1555          * session requires encryption, force IPC to be encrypted too.
1556          */
1557         if (ctx->seal) {
1558                 if (server->capabilities & SMB2_GLOBAL_CAP_ENCRYPTION)
1559                         seal = true;
1560                 else {
1561                         cifs_server_dbg(VFS,
1562                                  "IPC: server doesn't support encryption\n");
1563                         return -EOPNOTSUPP;
1564                 }
1565         }
1566
1567         tcon = tconInfoAlloc();
1568         if (tcon == NULL)
1569                 return -ENOMEM;
1570
1571         scnprintf(unc, sizeof(unc), "\\\\%s\\IPC$", server->hostname);
1572
1573         xid = get_xid();
1574         tcon->ses = ses;
1575         tcon->ipc = true;
1576         tcon->seal = seal;
1577         rc = server->ops->tree_connect(xid, ses, unc, tcon, ctx->local_nls);
1578         free_xid(xid);
1579
1580         if (rc) {
1581                 cifs_server_dbg(VFS, "failed to connect to IPC (rc=%d)\n", rc);
1582                 tconInfoFree(tcon);
1583                 goto out;
1584         }
1585
1586         cifs_dbg(FYI, "IPC tcon rc = %d ipc tid = %d\n", rc, tcon->tid);
1587
1588         ses->tcon_ipc = tcon;
1589 out:
1590         return rc;
1591 }
1592
1593 /**
1594  * cifs_free_ipc - helper to release the session IPC tcon
1595  *
1596  * Needs to be called everytime a session is destroyed.
1597  *
1598  * On session close, the IPC is closed and the server must release all tcons of the session.
1599  * No need to send a tree disconnect here.
1600  *
1601  * Besides, it will make the server to not close durable and resilient files on session close, as
1602  * specified in MS-SMB2 3.3.5.6 Receiving an SMB2 LOGOFF Request.
1603  */
1604 static int
1605 cifs_free_ipc(struct cifs_ses *ses)
1606 {
1607         struct cifs_tcon *tcon = ses->tcon_ipc;
1608
1609         if (tcon == NULL)
1610                 return 0;
1611
1612         tconInfoFree(tcon);
1613         ses->tcon_ipc = NULL;
1614         return 0;
1615 }
1616
1617 static struct cifs_ses *
1618 cifs_find_smb_ses(struct TCP_Server_Info *server, struct smb3_fs_context *ctx)
1619 {
1620         struct cifs_ses *ses;
1621
1622         spin_lock(&cifs_tcp_ses_lock);
1623         list_for_each_entry(ses, &server->smb_ses_list, smb_ses_list) {
1624                 if (ses->status == CifsExiting)
1625                         continue;
1626                 if (!match_session(ses, ctx))
1627                         continue;
1628                 ++ses->ses_count;
1629                 spin_unlock(&cifs_tcp_ses_lock);
1630                 return ses;
1631         }
1632         spin_unlock(&cifs_tcp_ses_lock);
1633         return NULL;
1634 }
1635
1636 void cifs_put_smb_ses(struct cifs_ses *ses)
1637 {
1638         unsigned int rc, xid;
1639         struct TCP_Server_Info *server = ses->server;
1640         cifs_dbg(FYI, "%s: ses_count=%d\n", __func__, ses->ses_count);
1641
1642         spin_lock(&cifs_tcp_ses_lock);
1643         if (ses->status == CifsExiting) {
1644                 spin_unlock(&cifs_tcp_ses_lock);
1645                 return;
1646         }
1647
1648         cifs_dbg(FYI, "%s: ses_count=%d\n", __func__, ses->ses_count);
1649         cifs_dbg(FYI, "%s: ses ipc: %s\n", __func__, ses->tcon_ipc ? ses->tcon_ipc->treeName : "NONE");
1650
1651         if (--ses->ses_count > 0) {
1652                 spin_unlock(&cifs_tcp_ses_lock);
1653                 return;
1654         }
1655         spin_unlock(&cifs_tcp_ses_lock);
1656
1657         spin_lock(&GlobalMid_Lock);
1658         if (ses->status == CifsGood)
1659                 ses->status = CifsExiting;
1660         spin_unlock(&GlobalMid_Lock);
1661
1662         cifs_free_ipc(ses);
1663
1664         if (ses->status == CifsExiting && server->ops->logoff) {
1665                 xid = get_xid();
1666                 rc = server->ops->logoff(xid, ses);
1667                 if (rc)
1668                         cifs_server_dbg(VFS, "%s: Session Logoff failure rc=%d\n",
1669                                 __func__, rc);
1670                 _free_xid(xid);
1671         }
1672
1673         spin_lock(&cifs_tcp_ses_lock);
1674         list_del_init(&ses->smb_ses_list);
1675         spin_unlock(&cifs_tcp_ses_lock);
1676
1677         /* close any extra channels */
1678         if (ses->chan_count > 1) {
1679                 int i;
1680
1681                 for (i = 1; i < ses->chan_count; i++)
1682                         cifs_put_tcp_session(ses->chans[i].server, 0);
1683         }
1684
1685         sesInfoFree(ses);
1686         cifs_put_tcp_session(server, 0);
1687 }
1688
1689 #ifdef CONFIG_KEYS
1690
1691 /* strlen("cifs:a:") + CIFS_MAX_DOMAINNAME_LEN + 1 */
1692 #define CIFSCREDS_DESC_SIZE (7 + CIFS_MAX_DOMAINNAME_LEN + 1)
1693
1694 /* Populate username and pw fields from keyring if possible */
1695 static int
1696 cifs_set_cifscreds(struct smb3_fs_context *ctx, struct cifs_ses *ses)
1697 {
1698         int rc = 0;
1699         int is_domain = 0;
1700         const char *delim, *payload;
1701         char *desc;
1702         ssize_t len;
1703         struct key *key;
1704         struct TCP_Server_Info *server = ses->server;
1705         struct sockaddr_in *sa;
1706         struct sockaddr_in6 *sa6;
1707         const struct user_key_payload *upayload;
1708
1709         desc = kmalloc(CIFSCREDS_DESC_SIZE, GFP_KERNEL);
1710         if (!desc)
1711                 return -ENOMEM;
1712
1713         /* try to find an address key first */
1714         switch (server->dstaddr.ss_family) {
1715         case AF_INET:
1716                 sa = (struct sockaddr_in *)&server->dstaddr;
1717                 sprintf(desc, "cifs:a:%pI4", &sa->sin_addr.s_addr);
1718                 break;
1719         case AF_INET6:
1720                 sa6 = (struct sockaddr_in6 *)&server->dstaddr;
1721                 sprintf(desc, "cifs:a:%pI6c", &sa6->sin6_addr.s6_addr);
1722                 break;
1723         default:
1724                 cifs_dbg(FYI, "Bad ss_family (%hu)\n",
1725                          server->dstaddr.ss_family);
1726                 rc = -EINVAL;
1727                 goto out_err;
1728         }
1729
1730         cifs_dbg(FYI, "%s: desc=%s\n", __func__, desc);
1731         key = request_key(&key_type_logon, desc, "");
1732         if (IS_ERR(key)) {
1733                 if (!ses->domainName) {
1734                         cifs_dbg(FYI, "domainName is NULL\n");
1735                         rc = PTR_ERR(key);
1736                         goto out_err;
1737                 }
1738
1739                 /* didn't work, try to find a domain key */
1740                 sprintf(desc, "cifs:d:%s", ses->domainName);
1741                 cifs_dbg(FYI, "%s: desc=%s\n", __func__, desc);
1742                 key = request_key(&key_type_logon, desc, "");
1743                 if (IS_ERR(key)) {
1744                         rc = PTR_ERR(key);
1745                         goto out_err;
1746                 }
1747                 is_domain = 1;
1748         }
1749
1750         down_read(&key->sem);
1751         upayload = user_key_payload_locked(key);
1752         if (IS_ERR_OR_NULL(upayload)) {
1753                 rc = upayload ? PTR_ERR(upayload) : -EINVAL;
1754                 goto out_key_put;
1755         }
1756
1757         /* find first : in payload */
1758         payload = upayload->data;
1759         delim = strnchr(payload, upayload->datalen, ':');
1760         cifs_dbg(FYI, "payload=%s\n", payload);
1761         if (!delim) {
1762                 cifs_dbg(FYI, "Unable to find ':' in payload (datalen=%d)\n",
1763                          upayload->datalen);
1764                 rc = -EINVAL;
1765                 goto out_key_put;
1766         }
1767
1768         len = delim - payload;
1769         if (len > CIFS_MAX_USERNAME_LEN || len <= 0) {
1770                 cifs_dbg(FYI, "Bad value from username search (len=%zd)\n",
1771                          len);
1772                 rc = -EINVAL;
1773                 goto out_key_put;
1774         }
1775
1776         ctx->username = kstrndup(payload, len, GFP_KERNEL);
1777         if (!ctx->username) {
1778                 cifs_dbg(FYI, "Unable to allocate %zd bytes for username\n",
1779                          len);
1780                 rc = -ENOMEM;
1781                 goto out_key_put;
1782         }
1783         cifs_dbg(FYI, "%s: username=%s\n", __func__, ctx->username);
1784
1785         len = key->datalen - (len + 1);
1786         if (len > CIFS_MAX_PASSWORD_LEN || len <= 0) {
1787                 cifs_dbg(FYI, "Bad len for password search (len=%zd)\n", len);
1788                 rc = -EINVAL;
1789                 kfree(ctx->username);
1790                 ctx->username = NULL;
1791                 goto out_key_put;
1792         }
1793
1794         ++delim;
1795         ctx->password = kstrndup(delim, len, GFP_KERNEL);
1796         if (!ctx->password) {
1797                 cifs_dbg(FYI, "Unable to allocate %zd bytes for password\n",
1798                          len);
1799                 rc = -ENOMEM;
1800                 kfree(ctx->username);
1801                 ctx->username = NULL;
1802                 goto out_key_put;
1803         }
1804
1805         /*
1806          * If we have a domain key then we must set the domainName in the
1807          * for the request.
1808          */
1809         if (is_domain && ses->domainName) {
1810                 ctx->domainname = kstrdup(ses->domainName, GFP_KERNEL);
1811                 if (!ctx->domainname) {
1812                         cifs_dbg(FYI, "Unable to allocate %zd bytes for domain\n",
1813                                  len);
1814                         rc = -ENOMEM;
1815                         kfree(ctx->username);
1816                         ctx->username = NULL;
1817                         kfree_sensitive(ctx->password);
1818                         ctx->password = NULL;
1819                         goto out_key_put;
1820                 }
1821         }
1822
1823 out_key_put:
1824         up_read(&key->sem);
1825         key_put(key);
1826 out_err:
1827         kfree(desc);
1828         cifs_dbg(FYI, "%s: returning %d\n", __func__, rc);
1829         return rc;
1830 }
1831 #else /* ! CONFIG_KEYS */
1832 static inline int
1833 cifs_set_cifscreds(struct smb3_fs_context *ctx __attribute__((unused)),
1834                    struct cifs_ses *ses __attribute__((unused)))
1835 {
1836         return -ENOSYS;
1837 }
1838 #endif /* CONFIG_KEYS */
1839
1840 /**
1841  * cifs_get_smb_ses - get a session matching @ctx data from @server
1842  *
1843  * This function assumes it is being called from cifs_mount() where we
1844  * already got a server reference (server refcount +1). See
1845  * cifs_get_tcon() for refcount explanations.
1846  */
1847 struct cifs_ses *
1848 cifs_get_smb_ses(struct TCP_Server_Info *server, struct smb3_fs_context *ctx)
1849 {
1850         int rc = -ENOMEM;
1851         unsigned int xid;
1852         struct cifs_ses *ses;
1853         struct sockaddr_in *addr = (struct sockaddr_in *)&server->dstaddr;
1854         struct sockaddr_in6 *addr6 = (struct sockaddr_in6 *)&server->dstaddr;
1855
1856         xid = get_xid();
1857
1858         ses = cifs_find_smb_ses(server, ctx);
1859         if (ses) {
1860                 cifs_dbg(FYI, "Existing smb sess found (status=%d)\n",
1861                          ses->status);
1862
1863                 mutex_lock(&ses->session_mutex);
1864                 rc = cifs_negotiate_protocol(xid, ses);
1865                 if (rc) {
1866                         mutex_unlock(&ses->session_mutex);
1867                         /* problem -- put our ses reference */
1868                         cifs_put_smb_ses(ses);
1869                         free_xid(xid);
1870                         return ERR_PTR(rc);
1871                 }
1872                 if (ses->need_reconnect) {
1873                         cifs_dbg(FYI, "Session needs reconnect\n");
1874                         rc = cifs_setup_session(xid, ses,
1875                                                 ctx->local_nls);
1876                         if (rc) {
1877                                 mutex_unlock(&ses->session_mutex);
1878                                 /* problem -- put our reference */
1879                                 cifs_put_smb_ses(ses);
1880                                 free_xid(xid);
1881                                 return ERR_PTR(rc);
1882                         }
1883                 }
1884                 mutex_unlock(&ses->session_mutex);
1885
1886                 /* existing SMB ses has a server reference already */
1887                 cifs_put_tcp_session(server, 0);
1888                 free_xid(xid);
1889                 return ses;
1890         }
1891
1892         cifs_dbg(FYI, "Existing smb sess not found\n");
1893         ses = sesInfoAlloc();
1894         if (ses == NULL)
1895                 goto get_ses_fail;
1896
1897         /* new SMB session uses our server ref */
1898         ses->server = server;
1899         if (server->dstaddr.ss_family == AF_INET6)
1900                 sprintf(ses->ip_addr, "%pI6", &addr6->sin6_addr);
1901         else
1902                 sprintf(ses->ip_addr, "%pI4", &addr->sin_addr);
1903
1904         if (ctx->username) {
1905                 ses->user_name = kstrdup(ctx->username, GFP_KERNEL);
1906                 if (!ses->user_name)
1907                         goto get_ses_fail;
1908         }
1909
1910         /* ctx->password freed at unmount */
1911         if (ctx->password) {
1912                 ses->password = kstrdup(ctx->password, GFP_KERNEL);
1913                 if (!ses->password)
1914                         goto get_ses_fail;
1915         }
1916         if (ctx->domainname) {
1917                 ses->domainName = kstrdup(ctx->domainname, GFP_KERNEL);
1918                 if (!ses->domainName)
1919                         goto get_ses_fail;
1920         }
1921         if (ctx->domainauto)
1922                 ses->domainAuto = ctx->domainauto;
1923         ses->cred_uid = ctx->cred_uid;
1924         ses->linux_uid = ctx->linux_uid;
1925
1926         ses->sectype = ctx->sectype;
1927         ses->sign = ctx->sign;
1928         mutex_lock(&ses->session_mutex);
1929
1930         /* add server as first channel */
1931         ses->chans[0].server = server;
1932         ses->chan_count = 1;
1933         ses->chan_max = ctx->multichannel ? ctx->max_channels:1;
1934
1935         rc = cifs_negotiate_protocol(xid, ses);
1936         if (!rc)
1937                 rc = cifs_setup_session(xid, ses, ctx->local_nls);
1938
1939         /* each channel uses a different signing key */
1940         memcpy(ses->chans[0].signkey, ses->smb3signingkey,
1941                sizeof(ses->smb3signingkey));
1942
1943         mutex_unlock(&ses->session_mutex);
1944         if (rc)
1945                 goto get_ses_fail;
1946
1947         /* success, put it on the list and add it as first channel */
1948         spin_lock(&cifs_tcp_ses_lock);
1949         list_add(&ses->smb_ses_list, &server->smb_ses_list);
1950         spin_unlock(&cifs_tcp_ses_lock);
1951
1952         free_xid(xid);
1953
1954         cifs_setup_ipc(ses, ctx);
1955
1956         return ses;
1957
1958 get_ses_fail:
1959         sesInfoFree(ses);
1960         free_xid(xid);
1961         return ERR_PTR(rc);
1962 }
1963
1964 static int match_tcon(struct cifs_tcon *tcon, struct smb3_fs_context *ctx)
1965 {
1966         if (tcon->tidStatus == CifsExiting)
1967                 return 0;
1968         if (strncmp(tcon->treeName, ctx->UNC, MAX_TREE_SIZE))
1969                 return 0;
1970         if (tcon->seal != ctx->seal)
1971                 return 0;
1972         if (tcon->snapshot_time != ctx->snapshot_time)
1973                 return 0;
1974         if (tcon->handle_timeout != ctx->handle_timeout)
1975                 return 0;
1976         if (tcon->no_lease != ctx->no_lease)
1977                 return 0;
1978         if (tcon->nodelete != ctx->nodelete)
1979                 return 0;
1980         return 1;
1981 }
1982
1983 static struct cifs_tcon *
1984 cifs_find_tcon(struct cifs_ses *ses, struct smb3_fs_context *ctx)
1985 {
1986         struct list_head *tmp;
1987         struct cifs_tcon *tcon;
1988
1989         spin_lock(&cifs_tcp_ses_lock);
1990         list_for_each(tmp, &ses->tcon_list) {
1991                 tcon = list_entry(tmp, struct cifs_tcon, tcon_list);
1992
1993                 if (!match_tcon(tcon, ctx))
1994                         continue;
1995                 ++tcon->tc_count;
1996                 spin_unlock(&cifs_tcp_ses_lock);
1997                 return tcon;
1998         }
1999         spin_unlock(&cifs_tcp_ses_lock);
2000         return NULL;
2001 }
2002
2003 void
2004 cifs_put_tcon(struct cifs_tcon *tcon)
2005 {
2006         unsigned int xid;
2007         struct cifs_ses *ses;
2008
2009         /*
2010          * IPC tcon share the lifetime of their session and are
2011          * destroyed in the session put function
2012          */
2013         if (tcon == NULL || tcon->ipc)
2014                 return;
2015
2016         ses = tcon->ses;
2017         cifs_dbg(FYI, "%s: tc_count=%d\n", __func__, tcon->tc_count);
2018         spin_lock(&cifs_tcp_ses_lock);
2019         if (--tcon->tc_count > 0) {
2020                 spin_unlock(&cifs_tcp_ses_lock);
2021                 return;
2022         }
2023
2024         if (tcon->use_witness) {
2025                 int rc;
2026
2027                 rc = cifs_swn_unregister(tcon);
2028                 if (rc < 0) {
2029                         cifs_dbg(VFS, "%s: Failed to unregister for witness notifications: %d\n",
2030                                         __func__, rc);
2031                 }
2032         }
2033
2034         list_del_init(&tcon->tcon_list);
2035         spin_unlock(&cifs_tcp_ses_lock);
2036
2037         xid = get_xid();
2038         if (ses->server->ops->tree_disconnect)
2039                 ses->server->ops->tree_disconnect(xid, tcon);
2040         _free_xid(xid);
2041
2042         cifs_fscache_release_super_cookie(tcon);
2043         tconInfoFree(tcon);
2044         cifs_put_smb_ses(ses);
2045 }
2046
2047 /**
2048  * cifs_get_tcon - get a tcon matching @ctx data from @ses
2049  *
2050  * - tcon refcount is the number of mount points using the tcon.
2051  * - ses refcount is the number of tcon using the session.
2052  *
2053  * 1. This function assumes it is being called from cifs_mount() where
2054  *    we already got a session reference (ses refcount +1).
2055  *
2056  * 2. Since we're in the context of adding a mount point, the end
2057  *    result should be either:
2058  *
2059  * a) a new tcon already allocated with refcount=1 (1 mount point) and
2060  *    its session refcount incremented (1 new tcon). This +1 was
2061  *    already done in (1).
2062  *
2063  * b) an existing tcon with refcount+1 (add a mount point to it) and
2064  *    identical ses refcount (no new tcon). Because of (1) we need to
2065  *    decrement the ses refcount.
2066  */
2067 static struct cifs_tcon *
2068 cifs_get_tcon(struct cifs_ses *ses, struct smb3_fs_context *ctx)
2069 {
2070         int rc, xid;
2071         struct cifs_tcon *tcon;
2072
2073         tcon = cifs_find_tcon(ses, ctx);
2074         if (tcon) {
2075                 /*
2076                  * tcon has refcount already incremented but we need to
2077                  * decrement extra ses reference gotten by caller (case b)
2078                  */
2079                 cifs_dbg(FYI, "Found match on UNC path\n");
2080                 cifs_put_smb_ses(ses);
2081                 return tcon;
2082         }
2083
2084         if (!ses->server->ops->tree_connect) {
2085                 rc = -ENOSYS;
2086                 goto out_fail;
2087         }
2088
2089         tcon = tconInfoAlloc();
2090         if (tcon == NULL) {
2091                 rc = -ENOMEM;
2092                 goto out_fail;
2093         }
2094
2095         if (ctx->snapshot_time) {
2096                 if (ses->server->vals->protocol_id == 0) {
2097                         cifs_dbg(VFS,
2098                              "Use SMB2 or later for snapshot mount option\n");
2099                         rc = -EOPNOTSUPP;
2100                         goto out_fail;
2101                 } else
2102                         tcon->snapshot_time = ctx->snapshot_time;
2103         }
2104
2105         if (ctx->handle_timeout) {
2106                 if (ses->server->vals->protocol_id == 0) {
2107                         cifs_dbg(VFS,
2108                              "Use SMB2.1 or later for handle timeout option\n");
2109                         rc = -EOPNOTSUPP;
2110                         goto out_fail;
2111                 } else
2112                         tcon->handle_timeout = ctx->handle_timeout;
2113         }
2114
2115         tcon->ses = ses;
2116         if (ctx->password) {
2117                 tcon->password = kstrdup(ctx->password, GFP_KERNEL);
2118                 if (!tcon->password) {
2119                         rc = -ENOMEM;
2120                         goto out_fail;
2121                 }
2122         }
2123
2124         if (ctx->seal) {
2125                 if (ses->server->vals->protocol_id == 0) {
2126                         cifs_dbg(VFS,
2127                                  "SMB3 or later required for encryption\n");
2128                         rc = -EOPNOTSUPP;
2129                         goto out_fail;
2130                 } else if (tcon->ses->server->capabilities &
2131                                         SMB2_GLOBAL_CAP_ENCRYPTION)
2132                         tcon->seal = true;
2133                 else {
2134                         cifs_dbg(VFS, "Encryption is not supported on share\n");
2135                         rc = -EOPNOTSUPP;
2136                         goto out_fail;
2137                 }
2138         }
2139
2140         if (ctx->linux_ext) {
2141                 if (ses->server->posix_ext_supported) {
2142                         tcon->posix_extensions = true;
2143                         pr_warn_once("SMB3.11 POSIX Extensions are experimental\n");
2144                 } else {
2145                         cifs_dbg(VFS, "Server does not support mounting with posix SMB3.11 extensions\n");
2146                         rc = -EOPNOTSUPP;
2147                         goto out_fail;
2148                 }
2149         }
2150
2151         /*
2152          * BB Do we need to wrap session_mutex around this TCon call and Unix
2153          * SetFS as we do on SessSetup and reconnect?
2154          */
2155         xid = get_xid();
2156         rc = ses->server->ops->tree_connect(xid, ses, ctx->UNC, tcon,
2157                                             ctx->local_nls);
2158         free_xid(xid);
2159         cifs_dbg(FYI, "Tcon rc = %d\n", rc);
2160         if (rc)
2161                 goto out_fail;
2162
2163         tcon->use_persistent = false;
2164         /* check if SMB2 or later, CIFS does not support persistent handles */
2165         if (ctx->persistent) {
2166                 if (ses->server->vals->protocol_id == 0) {
2167                         cifs_dbg(VFS,
2168                              "SMB3 or later required for persistent handles\n");
2169                         rc = -EOPNOTSUPP;
2170                         goto out_fail;
2171                 } else if (ses->server->capabilities &
2172                            SMB2_GLOBAL_CAP_PERSISTENT_HANDLES)
2173                         tcon->use_persistent = true;
2174                 else /* persistent handles requested but not supported */ {
2175                         cifs_dbg(VFS,
2176                                 "Persistent handles not supported on share\n");
2177                         rc = -EOPNOTSUPP;
2178                         goto out_fail;
2179                 }
2180         } else if ((tcon->capabilities & SMB2_SHARE_CAP_CONTINUOUS_AVAILABILITY)
2181              && (ses->server->capabilities & SMB2_GLOBAL_CAP_PERSISTENT_HANDLES)
2182              && (ctx->nopersistent == false)) {
2183                 cifs_dbg(FYI, "enabling persistent handles\n");
2184                 tcon->use_persistent = true;
2185         } else if (ctx->resilient) {
2186                 if (ses->server->vals->protocol_id == 0) {
2187                         cifs_dbg(VFS,
2188                              "SMB2.1 or later required for resilient handles\n");
2189                         rc = -EOPNOTSUPP;
2190                         goto out_fail;
2191                 }
2192                 tcon->use_resilient = true;
2193         }
2194
2195         tcon->use_witness = false;
2196         if (IS_ENABLED(CONFIG_CIFS_SWN_UPCALL) && ctx->witness) {
2197                 if (ses->server->vals->protocol_id >= SMB30_PROT_ID) {
2198                         if (tcon->capabilities & SMB2_SHARE_CAP_CLUSTER) {
2199                                 /*
2200                                  * Set witness in use flag in first place
2201                                  * to retry registration in the echo task
2202                                  */
2203                                 tcon->use_witness = true;
2204                                 /* And try to register immediately */
2205                                 rc = cifs_swn_register(tcon);
2206                                 if (rc < 0) {
2207                                         cifs_dbg(VFS, "Failed to register for witness notifications: %d\n", rc);
2208                                         goto out_fail;
2209                                 }
2210                         } else {
2211                                 /* TODO: try to extend for non-cluster uses (eg multichannel) */
2212                                 cifs_dbg(VFS, "witness requested on mount but no CLUSTER capability on share\n");
2213                                 rc = -EOPNOTSUPP;
2214                                 goto out_fail;
2215                         }
2216                 } else {
2217                         cifs_dbg(VFS, "SMB3 or later required for witness option\n");
2218                         rc = -EOPNOTSUPP;
2219                         goto out_fail;
2220                 }
2221         }
2222
2223         /* If the user really knows what they are doing they can override */
2224         if (tcon->share_flags & SMB2_SHAREFLAG_NO_CACHING) {
2225                 if (ctx->cache_ro)
2226                         cifs_dbg(VFS, "cache=ro requested on mount but NO_CACHING flag set on share\n");
2227                 else if (ctx->cache_rw)
2228                         cifs_dbg(VFS, "cache=singleclient requested on mount but NO_CACHING flag set on share\n");
2229         }
2230
2231         if (ctx->no_lease) {
2232                 if (ses->server->vals->protocol_id == 0) {
2233                         cifs_dbg(VFS,
2234                                 "SMB2 or later required for nolease option\n");
2235                         rc = -EOPNOTSUPP;
2236                         goto out_fail;
2237                 } else
2238                         tcon->no_lease = ctx->no_lease;
2239         }
2240
2241         /*
2242          * We can have only one retry value for a connection to a share so for
2243          * resources mounted more than once to the same server share the last
2244          * value passed in for the retry flag is used.
2245          */
2246         tcon->retry = ctx->retry;
2247         tcon->nocase = ctx->nocase;
2248         if (ses->server->capabilities & SMB2_GLOBAL_CAP_DIRECTORY_LEASING)
2249                 tcon->nohandlecache = ctx->nohandlecache;
2250         else
2251                 tcon->nohandlecache = true;
2252         tcon->nodelete = ctx->nodelete;
2253         tcon->local_lease = ctx->local_lease;
2254         INIT_LIST_HEAD(&tcon->pending_opens);
2255
2256         spin_lock(&cifs_tcp_ses_lock);
2257         list_add(&tcon->tcon_list, &ses->tcon_list);
2258         spin_unlock(&cifs_tcp_ses_lock);
2259
2260         cifs_fscache_get_super_cookie(tcon);
2261
2262         return tcon;
2263
2264 out_fail:
2265         tconInfoFree(tcon);
2266         return ERR_PTR(rc);
2267 }
2268
2269 void
2270 cifs_put_tlink(struct tcon_link *tlink)
2271 {
2272         if (!tlink || IS_ERR(tlink))
2273                 return;
2274
2275         if (!atomic_dec_and_test(&tlink->tl_count) ||
2276             test_bit(TCON_LINK_IN_TREE, &tlink->tl_flags)) {
2277                 tlink->tl_time = jiffies;
2278                 return;
2279         }
2280
2281         if (!IS_ERR(tlink_tcon(tlink)))
2282                 cifs_put_tcon(tlink_tcon(tlink));
2283         kfree(tlink);
2284         return;
2285 }
2286
2287 static int
2288 compare_mount_options(struct super_block *sb, struct cifs_mnt_data *mnt_data)
2289 {
2290         struct cifs_sb_info *old = CIFS_SB(sb);
2291         struct cifs_sb_info *new = mnt_data->cifs_sb;
2292         unsigned int oldflags = old->mnt_cifs_flags & CIFS_MOUNT_MASK;
2293         unsigned int newflags = new->mnt_cifs_flags & CIFS_MOUNT_MASK;
2294
2295         if ((sb->s_flags & CIFS_MS_MASK) != (mnt_data->flags & CIFS_MS_MASK))
2296                 return 0;
2297
2298         if (old->mnt_cifs_serverino_autodisabled)
2299                 newflags &= ~CIFS_MOUNT_SERVER_INUM;
2300
2301         if (oldflags != newflags)
2302                 return 0;
2303
2304         /*
2305          * We want to share sb only if we don't specify an r/wsize or
2306          * specified r/wsize is greater than or equal to existing one.
2307          */
2308         if (new->ctx->wsize && new->ctx->wsize < old->ctx->wsize)
2309                 return 0;
2310
2311         if (new->ctx->rsize && new->ctx->rsize < old->ctx->rsize)
2312                 return 0;
2313
2314         if (!uid_eq(old->ctx->linux_uid, new->ctx->linux_uid) ||
2315             !gid_eq(old->ctx->linux_gid, new->ctx->linux_gid))
2316                 return 0;
2317
2318         if (old->ctx->file_mode != new->ctx->file_mode ||
2319             old->ctx->dir_mode != new->ctx->dir_mode)
2320                 return 0;
2321
2322         if (strcmp(old->local_nls->charset, new->local_nls->charset))
2323                 return 0;
2324
2325         if (old->ctx->acregmax != new->ctx->acregmax)
2326                 return 0;
2327         if (old->ctx->acdirmax != new->ctx->acdirmax)
2328                 return 0;
2329
2330         return 1;
2331 }
2332
2333 static int
2334 match_prepath(struct super_block *sb, struct cifs_mnt_data *mnt_data)
2335 {
2336         struct cifs_sb_info *old = CIFS_SB(sb);
2337         struct cifs_sb_info *new = mnt_data->cifs_sb;
2338         bool old_set = (old->mnt_cifs_flags & CIFS_MOUNT_USE_PREFIX_PATH) &&
2339                 old->prepath;
2340         bool new_set = (new->mnt_cifs_flags & CIFS_MOUNT_USE_PREFIX_PATH) &&
2341                 new->prepath;
2342
2343         if (old_set && new_set && !strcmp(new->prepath, old->prepath))
2344                 return 1;
2345         else if (!old_set && !new_set)
2346                 return 1;
2347
2348         return 0;
2349 }
2350
2351 int
2352 cifs_match_super(struct super_block *sb, void *data)
2353 {
2354         struct cifs_mnt_data *mnt_data = (struct cifs_mnt_data *)data;
2355         struct smb3_fs_context *ctx;
2356         struct cifs_sb_info *cifs_sb;
2357         struct TCP_Server_Info *tcp_srv;
2358         struct cifs_ses *ses;
2359         struct cifs_tcon *tcon;
2360         struct tcon_link *tlink;
2361         int rc = 0;
2362
2363         spin_lock(&cifs_tcp_ses_lock);
2364         cifs_sb = CIFS_SB(sb);
2365         tlink = cifs_get_tlink(cifs_sb_master_tlink(cifs_sb));
2366         if (IS_ERR(tlink)) {
2367                 spin_unlock(&cifs_tcp_ses_lock);
2368                 return rc;
2369         }
2370         tcon = tlink_tcon(tlink);
2371         ses = tcon->ses;
2372         tcp_srv = ses->server;
2373
2374         ctx = mnt_data->ctx;
2375
2376         if (!match_server(tcp_srv, ctx) ||
2377             !match_session(ses, ctx) ||
2378             !match_tcon(tcon, ctx) ||
2379             !match_prepath(sb, mnt_data)) {
2380                 rc = 0;
2381                 goto out;
2382         }
2383
2384         rc = compare_mount_options(sb, mnt_data);
2385 out:
2386         spin_unlock(&cifs_tcp_ses_lock);
2387         cifs_put_tlink(tlink);
2388         return rc;
2389 }
2390
2391 #ifdef CONFIG_DEBUG_LOCK_ALLOC
2392 static struct lock_class_key cifs_key[2];
2393 static struct lock_class_key cifs_slock_key[2];
2394
2395 static inline void
2396 cifs_reclassify_socket4(struct socket *sock)
2397 {
2398         struct sock *sk = sock->sk;
2399         BUG_ON(!sock_allow_reclassification(sk));
2400         sock_lock_init_class_and_name(sk, "slock-AF_INET-CIFS",
2401                 &cifs_slock_key[0], "sk_lock-AF_INET-CIFS", &cifs_key[0]);
2402 }
2403
2404 static inline void
2405 cifs_reclassify_socket6(struct socket *sock)
2406 {
2407         struct sock *sk = sock->sk;
2408         BUG_ON(!sock_allow_reclassification(sk));
2409         sock_lock_init_class_and_name(sk, "slock-AF_INET6-CIFS",
2410                 &cifs_slock_key[1], "sk_lock-AF_INET6-CIFS", &cifs_key[1]);
2411 }
2412 #else
2413 static inline void
2414 cifs_reclassify_socket4(struct socket *sock)
2415 {
2416 }
2417
2418 static inline void
2419 cifs_reclassify_socket6(struct socket *sock)
2420 {
2421 }
2422 #endif
2423
2424 /* See RFC1001 section 14 on representation of Netbios names */
2425 static void rfc1002mangle(char *target, char *source, unsigned int length)
2426 {
2427         unsigned int i, j;
2428
2429         for (i = 0, j = 0; i < (length); i++) {
2430                 /* mask a nibble at a time and encode */
2431                 target[j] = 'A' + (0x0F & (source[i] >> 4));
2432                 target[j+1] = 'A' + (0x0F & source[i]);
2433                 j += 2;
2434         }
2435
2436 }
2437
2438 static int
2439 bind_socket(struct TCP_Server_Info *server)
2440 {
2441         int rc = 0;
2442         if (server->srcaddr.ss_family != AF_UNSPEC) {
2443                 /* Bind to the specified local IP address */
2444                 struct socket *socket = server->ssocket;
2445                 rc = socket->ops->bind(socket,
2446                                        (struct sockaddr *) &server->srcaddr,
2447                                        sizeof(server->srcaddr));
2448                 if (rc < 0) {
2449                         struct sockaddr_in *saddr4;
2450                         struct sockaddr_in6 *saddr6;
2451                         saddr4 = (struct sockaddr_in *)&server->srcaddr;
2452                         saddr6 = (struct sockaddr_in6 *)&server->srcaddr;
2453                         if (saddr6->sin6_family == AF_INET6)
2454                                 cifs_server_dbg(VFS, "Failed to bind to: %pI6c, error: %d\n",
2455                                          &saddr6->sin6_addr, rc);
2456                         else
2457                                 cifs_server_dbg(VFS, "Failed to bind to: %pI4, error: %d\n",
2458                                          &saddr4->sin_addr.s_addr, rc);
2459                 }
2460         }
2461         return rc;
2462 }
2463
2464 static int
2465 ip_rfc1001_connect(struct TCP_Server_Info *server)
2466 {
2467         int rc = 0;
2468         /*
2469          * some servers require RFC1001 sessinit before sending
2470          * negprot - BB check reconnection in case where second
2471          * sessinit is sent but no second negprot
2472          */
2473         struct rfc1002_session_packet *ses_init_buf;
2474         struct smb_hdr *smb_buf;
2475         ses_init_buf = kzalloc(sizeof(struct rfc1002_session_packet),
2476                                GFP_KERNEL);
2477         if (ses_init_buf) {
2478                 ses_init_buf->trailer.session_req.called_len = 32;
2479
2480                 if (server->server_RFC1001_name[0] != 0)
2481                         rfc1002mangle(ses_init_buf->trailer.
2482                                       session_req.called_name,
2483                                       server->server_RFC1001_name,
2484                                       RFC1001_NAME_LEN_WITH_NULL);
2485                 else
2486                         rfc1002mangle(ses_init_buf->trailer.
2487                                       session_req.called_name,
2488                                       DEFAULT_CIFS_CALLED_NAME,
2489                                       RFC1001_NAME_LEN_WITH_NULL);
2490
2491                 ses_init_buf->trailer.session_req.calling_len = 32;
2492
2493                 /*
2494                  * calling name ends in null (byte 16) from old smb
2495                  * convention.
2496                  */
2497                 if (server->workstation_RFC1001_name[0] != 0)
2498                         rfc1002mangle(ses_init_buf->trailer.
2499                                       session_req.calling_name,
2500                                       server->workstation_RFC1001_name,
2501                                       RFC1001_NAME_LEN_WITH_NULL);
2502                 else
2503                         rfc1002mangle(ses_init_buf->trailer.
2504                                       session_req.calling_name,
2505                                       "LINUX_CIFS_CLNT",
2506                                       RFC1001_NAME_LEN_WITH_NULL);
2507
2508                 ses_init_buf->trailer.session_req.scope1 = 0;
2509                 ses_init_buf->trailer.session_req.scope2 = 0;
2510                 smb_buf = (struct smb_hdr *)ses_init_buf;
2511
2512                 /* sizeof RFC1002_SESSION_REQUEST with no scope */
2513                 smb_buf->smb_buf_length = cpu_to_be32(0x81000044);
2514                 rc = smb_send(server, smb_buf, 0x44);
2515                 kfree(ses_init_buf);
2516                 /*
2517                  * RFC1001 layer in at least one server
2518                  * requires very short break before negprot
2519                  * presumably because not expecting negprot
2520                  * to follow so fast.  This is a simple
2521                  * solution that works without
2522                  * complicating the code and causes no
2523                  * significant slowing down on mount
2524                  * for everyone else
2525                  */
2526                 usleep_range(1000, 2000);
2527         }
2528         /*
2529          * else the negprot may still work without this
2530          * even though malloc failed
2531          */
2532
2533         return rc;
2534 }
2535
2536 static int
2537 generic_ip_connect(struct TCP_Server_Info *server)
2538 {
2539         int rc = 0;
2540         __be16 sport;
2541         int slen, sfamily;
2542         struct socket *socket = server->ssocket;
2543         struct sockaddr *saddr;
2544
2545         saddr = (struct sockaddr *) &server->dstaddr;
2546
2547         if (server->dstaddr.ss_family == AF_INET6) {
2548                 struct sockaddr_in6 *ipv6 = (struct sockaddr_in6 *)&server->dstaddr;
2549
2550                 sport = ipv6->sin6_port;
2551                 slen = sizeof(struct sockaddr_in6);
2552                 sfamily = AF_INET6;
2553                 cifs_dbg(FYI, "%s: connecting to [%pI6]:%d\n", __func__, &ipv6->sin6_addr,
2554                                 ntohs(sport));
2555         } else {
2556                 struct sockaddr_in *ipv4 = (struct sockaddr_in *)&server->dstaddr;
2557
2558                 sport = ipv4->sin_port;
2559                 slen = sizeof(struct sockaddr_in);
2560                 sfamily = AF_INET;
2561                 cifs_dbg(FYI, "%s: connecting to %pI4:%d\n", __func__, &ipv4->sin_addr,
2562                                 ntohs(sport));
2563         }
2564
2565         if (socket == NULL) {
2566                 rc = __sock_create(cifs_net_ns(server), sfamily, SOCK_STREAM,
2567                                    IPPROTO_TCP, &socket, 1);
2568                 if (rc < 0) {
2569                         cifs_server_dbg(VFS, "Error %d creating socket\n", rc);
2570                         server->ssocket = NULL;
2571                         return rc;
2572                 }
2573
2574                 /* BB other socket options to set KEEPALIVE, NODELAY? */
2575                 cifs_dbg(FYI, "Socket created\n");
2576                 server->ssocket = socket;
2577                 socket->sk->sk_allocation = GFP_NOFS;
2578                 if (sfamily == AF_INET6)
2579                         cifs_reclassify_socket6(socket);
2580                 else
2581                         cifs_reclassify_socket4(socket);
2582         }
2583
2584         rc = bind_socket(server);
2585         if (rc < 0)
2586                 return rc;
2587
2588         /*
2589          * Eventually check for other socket options to change from
2590          * the default. sock_setsockopt not used because it expects
2591          * user space buffer
2592          */
2593         socket->sk->sk_rcvtimeo = 7 * HZ;
2594         socket->sk->sk_sndtimeo = 5 * HZ;
2595
2596         /* make the bufsizes depend on wsize/rsize and max requests */
2597         if (server->noautotune) {
2598                 if (socket->sk->sk_sndbuf < (200 * 1024))
2599                         socket->sk->sk_sndbuf = 200 * 1024;
2600                 if (socket->sk->sk_rcvbuf < (140 * 1024))
2601                         socket->sk->sk_rcvbuf = 140 * 1024;
2602         }
2603
2604         if (server->tcp_nodelay)
2605                 tcp_sock_set_nodelay(socket->sk);
2606
2607         cifs_dbg(FYI, "sndbuf %d rcvbuf %d rcvtimeo 0x%lx\n",
2608                  socket->sk->sk_sndbuf,
2609                  socket->sk->sk_rcvbuf, socket->sk->sk_rcvtimeo);
2610
2611         rc = socket->ops->connect(socket, saddr, slen,
2612                                   server->noblockcnt ? O_NONBLOCK : 0);
2613         /*
2614          * When mounting SMB root file systems, we do not want to block in
2615          * connect. Otherwise bail out and then let cifs_reconnect() perform
2616          * reconnect failover - if possible.
2617          */
2618         if (server->noblockcnt && rc == -EINPROGRESS)
2619                 rc = 0;
2620         if (rc < 0) {
2621                 cifs_dbg(FYI, "Error %d connecting to server\n", rc);
2622                 sock_release(socket);
2623                 server->ssocket = NULL;
2624                 return rc;
2625         }
2626
2627         if (sport == htons(RFC1001_PORT))
2628                 rc = ip_rfc1001_connect(server);
2629
2630         return rc;
2631 }
2632
2633 static int
2634 ip_connect(struct TCP_Server_Info *server)
2635 {
2636         __be16 *sport;
2637         struct sockaddr_in6 *addr6 = (struct sockaddr_in6 *)&server->dstaddr;
2638         struct sockaddr_in *addr = (struct sockaddr_in *)&server->dstaddr;
2639
2640         if (server->dstaddr.ss_family == AF_INET6)
2641                 sport = &addr6->sin6_port;
2642         else
2643                 sport = &addr->sin_port;
2644
2645         if (*sport == 0) {
2646                 int rc;
2647
2648                 /* try with 445 port at first */
2649                 *sport = htons(CIFS_PORT);
2650
2651                 rc = generic_ip_connect(server);
2652                 if (rc >= 0)
2653                         return rc;
2654
2655                 /* if it failed, try with 139 port */
2656                 *sport = htons(RFC1001_PORT);
2657         }
2658
2659         return generic_ip_connect(server);
2660 }
2661
2662 void reset_cifs_unix_caps(unsigned int xid, struct cifs_tcon *tcon,
2663                           struct cifs_sb_info *cifs_sb, struct smb3_fs_context *ctx)
2664 {
2665         /*
2666          * If we are reconnecting then should we check to see if
2667          * any requested capabilities changed locally e.g. via
2668          * remount but we can not do much about it here
2669          * if they have (even if we could detect it by the following)
2670          * Perhaps we could add a backpointer to array of sb from tcon
2671          * or if we change to make all sb to same share the same
2672          * sb as NFS - then we only have one backpointer to sb.
2673          * What if we wanted to mount the server share twice once with
2674          * and once without posixacls or posix paths?
2675          */
2676         __u64 saved_cap = le64_to_cpu(tcon->fsUnixInfo.Capability);
2677
2678         if (ctx && ctx->no_linux_ext) {
2679                 tcon->fsUnixInfo.Capability = 0;
2680                 tcon->unix_ext = 0; /* Unix Extensions disabled */
2681                 cifs_dbg(FYI, "Linux protocol extensions disabled\n");
2682                 return;
2683         } else if (ctx)
2684                 tcon->unix_ext = 1; /* Unix Extensions supported */
2685
2686         if (!tcon->unix_ext) {
2687                 cifs_dbg(FYI, "Unix extensions disabled so not set on reconnect\n");
2688                 return;
2689         }
2690
2691         if (!CIFSSMBQFSUnixInfo(xid, tcon)) {
2692                 __u64 cap = le64_to_cpu(tcon->fsUnixInfo.Capability);
2693                 cifs_dbg(FYI, "unix caps which server supports %lld\n", cap);
2694                 /*
2695                  * check for reconnect case in which we do not
2696                  * want to change the mount behavior if we can avoid it
2697                  */
2698                 if (ctx == NULL) {
2699                         /*
2700                          * turn off POSIX ACL and PATHNAMES if not set
2701                          * originally at mount time
2702                          */
2703                         if ((saved_cap & CIFS_UNIX_POSIX_ACL_CAP) == 0)
2704                                 cap &= ~CIFS_UNIX_POSIX_ACL_CAP;
2705                         if ((saved_cap & CIFS_UNIX_POSIX_PATHNAMES_CAP) == 0) {
2706                                 if (cap & CIFS_UNIX_POSIX_PATHNAMES_CAP)
2707                                         cifs_dbg(VFS, "POSIXPATH support change\n");
2708                                 cap &= ~CIFS_UNIX_POSIX_PATHNAMES_CAP;
2709                         } else if ((cap & CIFS_UNIX_POSIX_PATHNAMES_CAP) == 0) {
2710                                 cifs_dbg(VFS, "possible reconnect error\n");
2711                                 cifs_dbg(VFS, "server disabled POSIX path support\n");
2712                         }
2713                 }
2714
2715                 if (cap & CIFS_UNIX_TRANSPORT_ENCRYPTION_MANDATORY_CAP)
2716                         cifs_dbg(VFS, "per-share encryption not supported yet\n");
2717
2718                 cap &= CIFS_UNIX_CAP_MASK;
2719                 if (ctx && ctx->no_psx_acl)
2720                         cap &= ~CIFS_UNIX_POSIX_ACL_CAP;
2721                 else if (CIFS_UNIX_POSIX_ACL_CAP & cap) {
2722                         cifs_dbg(FYI, "negotiated posix acl support\n");
2723                         if (cifs_sb)
2724                                 cifs_sb->mnt_cifs_flags |=
2725                                         CIFS_MOUNT_POSIXACL;
2726                 }
2727
2728                 if (ctx && ctx->posix_paths == 0)
2729                         cap &= ~CIFS_UNIX_POSIX_PATHNAMES_CAP;
2730                 else if (cap & CIFS_UNIX_POSIX_PATHNAMES_CAP) {
2731                         cifs_dbg(FYI, "negotiate posix pathnames\n");
2732                         if (cifs_sb)
2733                                 cifs_sb->mnt_cifs_flags |=
2734                                         CIFS_MOUNT_POSIX_PATHS;
2735                 }
2736
2737                 cifs_dbg(FYI, "Negotiate caps 0x%x\n", (int)cap);
2738 #ifdef CONFIG_CIFS_DEBUG2
2739                 if (cap & CIFS_UNIX_FCNTL_CAP)
2740                         cifs_dbg(FYI, "FCNTL cap\n");
2741                 if (cap & CIFS_UNIX_EXTATTR_CAP)
2742                         cifs_dbg(FYI, "EXTATTR cap\n");
2743                 if (cap & CIFS_UNIX_POSIX_PATHNAMES_CAP)
2744                         cifs_dbg(FYI, "POSIX path cap\n");
2745                 if (cap & CIFS_UNIX_XATTR_CAP)
2746                         cifs_dbg(FYI, "XATTR cap\n");
2747                 if (cap & CIFS_UNIX_POSIX_ACL_CAP)
2748                         cifs_dbg(FYI, "POSIX ACL cap\n");
2749                 if (cap & CIFS_UNIX_LARGE_READ_CAP)
2750                         cifs_dbg(FYI, "very large read cap\n");
2751                 if (cap & CIFS_UNIX_LARGE_WRITE_CAP)
2752                         cifs_dbg(FYI, "very large write cap\n");
2753                 if (cap & CIFS_UNIX_TRANSPORT_ENCRYPTION_CAP)
2754                         cifs_dbg(FYI, "transport encryption cap\n");
2755                 if (cap & CIFS_UNIX_TRANSPORT_ENCRYPTION_MANDATORY_CAP)
2756                         cifs_dbg(FYI, "mandatory transport encryption cap\n");
2757 #endif /* CIFS_DEBUG2 */
2758                 if (CIFSSMBSetFSUnixInfo(xid, tcon, cap)) {
2759                         if (ctx == NULL)
2760                                 cifs_dbg(FYI, "resetting capabilities failed\n");
2761                         else
2762                                 cifs_dbg(VFS, "Negotiating Unix capabilities with the server failed. Consider mounting with the Unix Extensions disabled if problems are found by specifying the nounix mount option.\n");
2763
2764                 }
2765         }
2766 }
2767
2768 int cifs_setup_cifs_sb(struct cifs_sb_info *cifs_sb)
2769 {
2770         struct smb3_fs_context *ctx = cifs_sb->ctx;
2771
2772         INIT_DELAYED_WORK(&cifs_sb->prune_tlinks, cifs_prune_tlinks);
2773
2774         spin_lock_init(&cifs_sb->tlink_tree_lock);
2775         cifs_sb->tlink_tree = RB_ROOT;
2776
2777         cifs_dbg(FYI, "file mode: %04ho  dir mode: %04ho\n",
2778                  ctx->file_mode, ctx->dir_mode);
2779
2780         /* this is needed for ASCII cp to Unicode converts */
2781         if (ctx->iocharset == NULL) {
2782                 /* load_nls_default cannot return null */
2783                 cifs_sb->local_nls = load_nls_default();
2784         } else {
2785                 cifs_sb->local_nls = load_nls(ctx->iocharset);
2786                 if (cifs_sb->local_nls == NULL) {
2787                         cifs_dbg(VFS, "CIFS mount error: iocharset %s not found\n",
2788                                  ctx->iocharset);
2789                         return -ELIBACC;
2790                 }
2791         }
2792         ctx->local_nls = cifs_sb->local_nls;
2793
2794         smb3_update_mnt_flags(cifs_sb);
2795
2796         if (ctx->direct_io)
2797                 cifs_dbg(FYI, "mounting share using direct i/o\n");
2798         if (ctx->cache_ro) {
2799                 cifs_dbg(VFS, "mounting share with read only caching. Ensure that the share will not be modified while in use.\n");
2800                 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_RO_CACHE;
2801         } else if (ctx->cache_rw) {
2802                 cifs_dbg(VFS, "mounting share in single client RW caching mode. Ensure that no other systems will be accessing the share.\n");
2803                 cifs_sb->mnt_cifs_flags |= (CIFS_MOUNT_RO_CACHE |
2804                                             CIFS_MOUNT_RW_CACHE);
2805         }
2806
2807         if ((ctx->cifs_acl) && (ctx->dynperm))
2808                 cifs_dbg(VFS, "mount option dynperm ignored if cifsacl mount option supported\n");
2809
2810         if (ctx->prepath) {
2811                 cifs_sb->prepath = kstrdup(ctx->prepath, GFP_KERNEL);
2812                 if (cifs_sb->prepath == NULL)
2813                         return -ENOMEM;
2814                 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_USE_PREFIX_PATH;
2815         }
2816
2817         return 0;
2818 }
2819
2820 /* Release all succeed connections */
2821 static inline void mount_put_conns(struct cifs_sb_info *cifs_sb,
2822                                    unsigned int xid,
2823                                    struct TCP_Server_Info *server,
2824                                    struct cifs_ses *ses, struct cifs_tcon *tcon)
2825 {
2826         int rc = 0;
2827
2828         if (tcon)
2829                 cifs_put_tcon(tcon);
2830         else if (ses)
2831                 cifs_put_smb_ses(ses);
2832         else if (server)
2833                 cifs_put_tcp_session(server, 0);
2834         cifs_sb->mnt_cifs_flags &= ~CIFS_MOUNT_POSIX_PATHS;
2835         free_xid(xid);
2836 }
2837
2838 /* Get connections for tcp, ses and tcon */
2839 static int mount_get_conns(struct smb3_fs_context *ctx, struct cifs_sb_info *cifs_sb,
2840                            unsigned int *xid,
2841                            struct TCP_Server_Info **nserver,
2842                            struct cifs_ses **nses, struct cifs_tcon **ntcon)
2843 {
2844         int rc = 0;
2845         struct TCP_Server_Info *server;
2846         struct cifs_ses *ses;
2847         struct cifs_tcon *tcon;
2848
2849         *nserver = NULL;
2850         *nses = NULL;
2851         *ntcon = NULL;
2852
2853         *xid = get_xid();
2854
2855         /* get a reference to a tcp session */
2856         server = cifs_get_tcp_session(ctx);
2857         if (IS_ERR(server)) {
2858                 rc = PTR_ERR(server);
2859                 return rc;
2860         }
2861
2862         *nserver = server;
2863
2864         /* get a reference to a SMB session */
2865         ses = cifs_get_smb_ses(server, ctx);
2866         if (IS_ERR(ses)) {
2867                 rc = PTR_ERR(ses);
2868                 return rc;
2869         }
2870
2871         *nses = ses;
2872
2873         if ((ctx->persistent == true) && (!(ses->server->capabilities &
2874                                             SMB2_GLOBAL_CAP_PERSISTENT_HANDLES))) {
2875                 cifs_server_dbg(VFS, "persistent handles not supported by server\n");
2876                 return -EOPNOTSUPP;
2877         }
2878
2879         /* search for existing tcon to this server share */
2880         tcon = cifs_get_tcon(ses, ctx);
2881         if (IS_ERR(tcon)) {
2882                 rc = PTR_ERR(tcon);
2883                 return rc;
2884         }
2885
2886         *ntcon = tcon;
2887
2888         /* if new SMB3.11 POSIX extensions are supported do not remap / and \ */
2889         if (tcon->posix_extensions)
2890                 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_POSIX_PATHS;
2891
2892         /* tell server which Unix caps we support */
2893         if (cap_unix(tcon->ses)) {
2894                 /*
2895                  * reset of caps checks mount to see if unix extensions disabled
2896                  * for just this mount.
2897                  */
2898                 reset_cifs_unix_caps(*xid, tcon, cifs_sb, ctx);
2899                 if ((tcon->ses->server->tcpStatus == CifsNeedReconnect) &&
2900                     (le64_to_cpu(tcon->fsUnixInfo.Capability) &
2901                      CIFS_UNIX_TRANSPORT_ENCRYPTION_MANDATORY_CAP))
2902                         return -EACCES;
2903         } else
2904                 tcon->unix_ext = 0; /* server does not support them */
2905
2906         /* do not care if a following call succeed - informational */
2907         if (!tcon->pipe && server->ops->qfs_tcon) {
2908                 server->ops->qfs_tcon(*xid, tcon, cifs_sb);
2909                 if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_RO_CACHE) {
2910                         if (tcon->fsDevInfo.DeviceCharacteristics &
2911                             cpu_to_le32(FILE_READ_ONLY_DEVICE))
2912                                 cifs_dbg(VFS, "mounted to read only share\n");
2913                         else if ((cifs_sb->mnt_cifs_flags &
2914                                   CIFS_MOUNT_RW_CACHE) == 0)
2915                                 cifs_dbg(VFS, "read only mount of RW share\n");
2916                         /* no need to log a RW mount of a typical RW share */
2917                 }
2918         }
2919
2920         /*
2921          * Clamp the rsize/wsize mount arguments if they are too big for the server
2922          * and set the rsize/wsize to the negotiated values if not passed in by
2923          * the user on mount
2924          */
2925         if ((cifs_sb->ctx->wsize == 0) ||
2926             (cifs_sb->ctx->wsize > server->ops->negotiate_wsize(tcon, ctx)))
2927                 cifs_sb->ctx->wsize = server->ops->negotiate_wsize(tcon, ctx);
2928         if ((cifs_sb->ctx->rsize == 0) ||
2929             (cifs_sb->ctx->rsize > server->ops->negotiate_rsize(tcon, ctx)))
2930                 cifs_sb->ctx->rsize = server->ops->negotiate_rsize(tcon, ctx);
2931
2932         return 0;
2933 }
2934
2935 static int mount_setup_tlink(struct cifs_sb_info *cifs_sb, struct cifs_ses *ses,
2936                              struct cifs_tcon *tcon)
2937 {
2938         struct tcon_link *tlink;
2939
2940         /* hang the tcon off of the superblock */
2941         tlink = kzalloc(sizeof(*tlink), GFP_KERNEL);
2942         if (tlink == NULL)
2943                 return -ENOMEM;
2944
2945         tlink->tl_uid = ses->linux_uid;
2946         tlink->tl_tcon = tcon;
2947         tlink->tl_time = jiffies;
2948         set_bit(TCON_LINK_MASTER, &tlink->tl_flags);
2949         set_bit(TCON_LINK_IN_TREE, &tlink->tl_flags);
2950
2951         cifs_sb->master_tlink = tlink;
2952         spin_lock(&cifs_sb->tlink_tree_lock);
2953         tlink_rb_insert(&cifs_sb->tlink_tree, tlink);
2954         spin_unlock(&cifs_sb->tlink_tree_lock);
2955
2956         queue_delayed_work(cifsiod_wq, &cifs_sb->prune_tlinks,
2957                                 TLINK_IDLE_EXPIRE);
2958         return 0;
2959 }
2960
2961 #ifdef CONFIG_CIFS_DFS_UPCALL
2962 /*
2963  * cifs_build_path_to_root returns full path to root when we do not have an
2964  * existing connection (tcon)
2965  */
2966 static char *
2967 build_unc_path_to_root(const struct smb3_fs_context *ctx,
2968                        const struct cifs_sb_info *cifs_sb, bool useppath)
2969 {
2970         char *full_path, *pos;
2971         unsigned int pplen = useppath && ctx->prepath ?
2972                 strlen(ctx->prepath) + 1 : 0;
2973         unsigned int unc_len = strnlen(ctx->UNC, MAX_TREE_SIZE + 1);
2974
2975         if (unc_len > MAX_TREE_SIZE)
2976                 return ERR_PTR(-EINVAL);
2977
2978         full_path = kmalloc(unc_len + pplen + 1, GFP_KERNEL);
2979         if (full_path == NULL)
2980                 return ERR_PTR(-ENOMEM);
2981
2982         memcpy(full_path, ctx->UNC, unc_len);
2983         pos = full_path + unc_len;
2984
2985         if (pplen) {
2986                 *pos = CIFS_DIR_SEP(cifs_sb);
2987                 memcpy(pos + 1, ctx->prepath, pplen);
2988                 pos += pplen;
2989         }
2990
2991         *pos = '\0'; /* add trailing null */
2992         convert_delimiter(full_path, CIFS_DIR_SEP(cifs_sb));
2993         cifs_dbg(FYI, "%s: full_path=%s\n", __func__, full_path);
2994         return full_path;
2995 }
2996
2997 /**
2998  * expand_dfs_referral - Perform a dfs referral query and update the cifs_sb
2999  *
3000  * If a referral is found, cifs_sb->ctx->mount_options will be (re-)allocated
3001  * to a string containing updated options for the submount.  Otherwise it
3002  * will be left untouched.
3003  *
3004  * Returns the rc from get_dfs_path to the caller, which can be used to
3005  * determine whether there were referrals.
3006  */
3007 static int
3008 expand_dfs_referral(const unsigned int xid, struct cifs_ses *ses,
3009                     struct smb3_fs_context *ctx, struct cifs_sb_info *cifs_sb,
3010                     char *ref_path)
3011 {
3012         int rc;
3013         struct dfs_info3_param referral = {0};
3014         char *full_path = NULL, *mdata = NULL;
3015
3016         if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_NO_DFS)
3017                 return -EREMOTE;
3018
3019         full_path = build_unc_path_to_root(ctx, cifs_sb, true);
3020         if (IS_ERR(full_path))
3021                 return PTR_ERR(full_path);
3022
3023         rc = dfs_cache_find(xid, ses, cifs_sb->local_nls, cifs_remap(cifs_sb),
3024                             ref_path, &referral, NULL);
3025         if (!rc) {
3026                 char *fake_devname = NULL;
3027
3028                 mdata = cifs_compose_mount_options(cifs_sb->ctx->mount_options,
3029                                                    full_path + 1, &referral,
3030                                                    &fake_devname);
3031                 free_dfs_info_param(&referral);
3032
3033                 if (IS_ERR(mdata)) {
3034                         rc = PTR_ERR(mdata);
3035                         mdata = NULL;
3036                 } else {
3037                         /*
3038                          * We can not clear out the whole structure since we
3039                          * no longer have an explicit function to parse
3040                          * a mount-string. Instead we need to clear out the
3041                          * individual fields that are no longer valid.
3042                          */
3043                         kfree(ctx->prepath);
3044                         ctx->prepath = NULL;
3045                         rc = cifs_setup_volume_info(ctx, mdata, fake_devname);
3046                 }
3047                 kfree(fake_devname);
3048                 kfree(cifs_sb->ctx->mount_options);
3049                 cifs_sb->ctx->mount_options = mdata;
3050         }
3051         kfree(full_path);
3052         return rc;
3053 }
3054
3055 static int get_next_dfs_tgt(struct dfs_cache_tgt_list *tgt_list,
3056                             struct dfs_cache_tgt_iterator **tgt_it)
3057 {
3058         if (!*tgt_it)
3059                 *tgt_it = dfs_cache_get_tgt_iterator(tgt_list);
3060         else
3061                 *tgt_it = dfs_cache_get_next_tgt(tgt_list, *tgt_it);
3062         return !*tgt_it ? -EHOSTDOWN : 0;
3063 }
3064
3065 static int update_vol_info(const struct dfs_cache_tgt_iterator *tgt_it,
3066                            struct smb3_fs_context *fake_ctx, struct smb3_fs_context *ctx)
3067 {
3068         const char *tgt = dfs_cache_get_tgt_name(tgt_it);
3069         int len = strlen(tgt) + 2;
3070         char *new_unc;
3071
3072         new_unc = kmalloc(len, GFP_KERNEL);
3073         if (!new_unc)
3074                 return -ENOMEM;
3075         scnprintf(new_unc, len, "\\%s", tgt);
3076
3077         kfree(ctx->UNC);
3078         ctx->UNC = new_unc;
3079
3080         if (fake_ctx->prepath) {
3081                 kfree(ctx->prepath);
3082                 ctx->prepath = fake_ctx->prepath;
3083                 fake_ctx->prepath = NULL;
3084         }
3085         memcpy(&ctx->dstaddr, &fake_ctx->dstaddr, sizeof(ctx->dstaddr));
3086
3087         return 0;
3088 }
3089
3090 static int do_dfs_failover(const char *path, const char *full_path, struct cifs_sb_info *cifs_sb,
3091                            struct smb3_fs_context *ctx, struct cifs_ses *root_ses,
3092                            unsigned int *xid, struct TCP_Server_Info **server,
3093                            struct cifs_ses **ses, struct cifs_tcon **tcon)
3094 {
3095         int rc;
3096         char *npath = NULL;
3097         struct dfs_cache_tgt_list tgt_list = {0};
3098         struct dfs_cache_tgt_iterator *tgt_it = NULL;
3099         struct smb3_fs_context tmp_ctx = {NULL};
3100
3101         if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_NO_DFS)
3102                 return -EOPNOTSUPP;
3103
3104         npath = dfs_cache_canonical_path(path, cifs_sb->local_nls, cifs_remap(cifs_sb));
3105         if (IS_ERR(npath))
3106                 return PTR_ERR(npath);
3107
3108         cifs_dbg(FYI, "%s: path=%s full_path=%s\n", __func__, npath, full_path);
3109
3110         rc = dfs_cache_noreq_find(npath, NULL, &tgt_list);
3111         if (rc)
3112                 goto out;
3113         /*
3114          * We use a 'tmp_ctx' here because we need pass it down to the mount_{get,put} functions to
3115          * test connection against new DFS targets.
3116          */
3117         rc = smb3_fs_context_dup(&tmp_ctx, ctx);
3118         if (rc)
3119                 goto out;
3120
3121         for (;;) {
3122                 struct dfs_info3_param ref = {0};
3123                 char *fake_devname = NULL, *mdata = NULL;
3124
3125                 /* Get next DFS target server - if any */
3126                 rc = get_next_dfs_tgt(&tgt_list, &tgt_it);
3127                 if (rc)
3128                         break;
3129
3130                 rc = dfs_cache_get_tgt_referral(npath, tgt_it, &ref);
3131                 if (rc)
3132                         break;
3133
3134                 cifs_dbg(FYI, "%s: old ctx: UNC=%s prepath=%s\n", __func__, tmp_ctx.UNC,
3135                          tmp_ctx.prepath);
3136
3137                 mdata = cifs_compose_mount_options(cifs_sb->ctx->mount_options, full_path + 1, &ref,
3138                                                    &fake_devname);
3139                 free_dfs_info_param(&ref);
3140
3141                 if (IS_ERR(mdata)) {
3142                         rc = PTR_ERR(mdata);
3143                         mdata = NULL;
3144                 } else
3145                         rc = cifs_setup_volume_info(&tmp_ctx, mdata, fake_devname);
3146
3147                 kfree(mdata);
3148                 kfree(fake_devname);
3149
3150                 if (rc)
3151                         break;
3152
3153                 cifs_dbg(FYI, "%s: new ctx: UNC=%s prepath=%s\n", __func__, tmp_ctx.UNC,
3154                          tmp_ctx.prepath);
3155
3156                 mount_put_conns(cifs_sb, *xid, *server, *ses, *tcon);
3157                 rc = mount_get_conns(&tmp_ctx, cifs_sb, xid, server, ses, tcon);
3158                 if (!rc || (*server && *ses)) {
3159                         /*
3160                          * We were able to connect to new target server. Update current context with
3161                          * new target server.
3162                          */
3163                         rc = update_vol_info(tgt_it, &tmp_ctx, ctx);
3164                         break;
3165                 }
3166         }
3167         if (!rc) {
3168                 cifs_dbg(FYI, "%s: final ctx: UNC=%s prepath=%s\n", __func__, tmp_ctx.UNC,
3169                          tmp_ctx.prepath);
3170                 /*
3171                  * Update DFS target hint in DFS referral cache with the target server we
3172                  * successfully reconnected to.
3173                  */
3174                 rc = dfs_cache_update_tgthint(*xid, root_ses ? root_ses : *ses, cifs_sb->local_nls,
3175                                               cifs_remap(cifs_sb), path, tgt_it);
3176         }
3177
3178 out:
3179         kfree(npath);
3180         smb3_cleanup_fs_context_contents(&tmp_ctx);
3181         dfs_cache_free_tgts(&tgt_list);
3182         return rc;
3183 }
3184 #endif
3185
3186 /* TODO: all callers to this are broken. We are not parsing mount_options here
3187  * we should pass a clone of the original context?
3188  */
3189 int
3190 cifs_setup_volume_info(struct smb3_fs_context *ctx, const char *mntopts, const char *devname)
3191 {
3192         int rc;
3193
3194         if (devname) {
3195                 cifs_dbg(FYI, "%s: devname=%s\n", __func__, devname);
3196                 rc = smb3_parse_devname(devname, ctx);
3197                 if (rc) {
3198                         cifs_dbg(VFS, "%s: failed to parse %s: %d\n", __func__, devname, rc);
3199                         return rc;
3200                 }
3201         }
3202
3203         if (mntopts) {
3204                 char *ip;
3205
3206                 rc = smb3_parse_opt(mntopts, "ip", &ip);
3207                 if (rc) {
3208                         cifs_dbg(VFS, "%s: failed to parse ip options: %d\n", __func__, rc);
3209                         return rc;
3210                 }
3211
3212                 rc = cifs_convert_address((struct sockaddr *)&ctx->dstaddr, ip, strlen(ip));
3213                 kfree(ip);
3214                 if (!rc) {
3215                         cifs_dbg(VFS, "%s: failed to convert ip address\n", __func__);
3216                         return -EINVAL;
3217                 }
3218         }
3219
3220         if (ctx->nullauth) {
3221                 cifs_dbg(FYI, "Anonymous login\n");
3222                 kfree(ctx->username);
3223                 ctx->username = NULL;
3224         } else if (ctx->username) {
3225                 /* BB fixme parse for domain name here */
3226                 cifs_dbg(FYI, "Username: %s\n", ctx->username);
3227         } else {
3228                 cifs_dbg(VFS, "No username specified\n");
3229         /* In userspace mount helper we can get user name from alternate
3230            locations such as env variables and files on disk */
3231                 return -EINVAL;
3232         }
3233
3234         return 0;
3235 }
3236
3237 static int
3238 cifs_are_all_path_components_accessible(struct TCP_Server_Info *server,
3239                                         unsigned int xid,
3240                                         struct cifs_tcon *tcon,
3241                                         struct cifs_sb_info *cifs_sb,
3242                                         char *full_path,
3243                                         int added_treename)
3244 {
3245         int rc;
3246         char *s;
3247         char sep, tmp;
3248         int skip = added_treename ? 1 : 0;
3249
3250         sep = CIFS_DIR_SEP(cifs_sb);
3251         s = full_path;
3252
3253         rc = server->ops->is_path_accessible(xid, tcon, cifs_sb, "");
3254         while (rc == 0) {
3255                 /* skip separators */
3256                 while (*s == sep)
3257                         s++;
3258                 if (!*s)
3259                         break;
3260                 /* next separator */
3261                 while (*s && *s != sep)
3262                         s++;
3263                 /*
3264                  * if the treename is added, we then have to skip the first
3265                  * part within the separators
3266                  */
3267                 if (skip) {
3268                         skip = 0;
3269                         continue;
3270                 }
3271                 /*
3272                  * temporarily null-terminate the path at the end of
3273                  * the current component
3274                  */
3275                 tmp = *s;
3276                 *s = 0;
3277                 rc = server->ops->is_path_accessible(xid, tcon, cifs_sb,
3278                                                      full_path);
3279                 *s = tmp;
3280         }
3281         return rc;
3282 }
3283
3284 /*
3285  * Check if path is remote (e.g. a DFS share). Return -EREMOTE if it is,
3286  * otherwise 0.
3287  */
3288 static int is_path_remote(struct cifs_sb_info *cifs_sb, struct smb3_fs_context *ctx,
3289                           const unsigned int xid,
3290                           struct TCP_Server_Info *server,
3291                           struct cifs_tcon *tcon)
3292 {
3293         int rc;
3294         char *full_path;
3295
3296         if (!server->ops->is_path_accessible)
3297                 return -EOPNOTSUPP;
3298
3299         /*
3300          * cifs_build_path_to_root works only when we have a valid tcon
3301          */
3302         full_path = cifs_build_path_to_root(ctx, cifs_sb, tcon,
3303                                             tcon->Flags & SMB_SHARE_IS_IN_DFS);
3304         if (full_path == NULL)
3305                 return -ENOMEM;
3306
3307         cifs_dbg(FYI, "%s: full_path: %s\n", __func__, full_path);
3308
3309         rc = server->ops->is_path_accessible(xid, tcon, cifs_sb,
3310                                              full_path);
3311         if (rc != 0 && rc != -EREMOTE) {
3312                 kfree(full_path);
3313                 return rc;
3314         }
3315
3316         if (rc != -EREMOTE) {
3317                 rc = cifs_are_all_path_components_accessible(server, xid, tcon,
3318                         cifs_sb, full_path, tcon->Flags & SMB_SHARE_IS_IN_DFS);
3319                 if (rc != 0) {
3320                         cifs_server_dbg(VFS, "cannot query dirs between root and final path, enabling CIFS_MOUNT_USE_PREFIX_PATH\n");
3321                         cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_USE_PREFIX_PATH;
3322                         rc = 0;
3323                 }
3324         }
3325
3326         kfree(full_path);
3327         return rc;
3328 }
3329
3330 #ifdef CONFIG_CIFS_DFS_UPCALL
3331 static void set_root_ses(struct cifs_sb_info *cifs_sb, const uuid_t *mount_id, struct cifs_ses *ses,
3332                          struct cifs_ses **root_ses)
3333 {
3334         if (ses) {
3335                 spin_lock(&cifs_tcp_ses_lock);
3336                 ses->ses_count++;
3337                 spin_unlock(&cifs_tcp_ses_lock);
3338                 dfs_cache_add_refsrv_session(mount_id, ses);
3339         }
3340         *root_ses = ses;
3341 }
3342
3343 /* Set up next dfs prefix path in @dfs_path */
3344 static int next_dfs_prepath(struct cifs_sb_info *cifs_sb, struct smb3_fs_context *ctx,
3345                             const unsigned int xid, struct TCP_Server_Info *server,
3346                             struct cifs_tcon *tcon, char **dfs_path)
3347 {
3348         char *path, *npath;
3349         int added_treename = is_tcon_dfs(tcon);
3350         int rc;
3351
3352         path = cifs_build_path_to_root(ctx, cifs_sb, tcon, added_treename);
3353         if (!path)
3354                 return -ENOMEM;
3355
3356         rc = is_path_remote(cifs_sb, ctx, xid, server, tcon);
3357         if (rc == -EREMOTE) {
3358                 struct smb3_fs_context v = {NULL};
3359                 /* if @path contains a tree name, skip it in the prefix path */
3360                 if (added_treename) {
3361                         rc = smb3_parse_devname(path, &v);
3362                         if (rc)
3363                                 goto out;
3364                         npath = build_unc_path_to_root(&v, cifs_sb, true);
3365                         smb3_cleanup_fs_context_contents(&v);
3366                 } else {
3367                         v.UNC = ctx->UNC;
3368                         v.prepath = path + 1;
3369                         npath = build_unc_path_to_root(&v, cifs_sb, true);
3370                 }
3371
3372                 if (IS_ERR(npath)) {
3373                         rc = PTR_ERR(npath);
3374                         goto out;
3375                 }
3376
3377                 kfree(*dfs_path);
3378                 *dfs_path = npath;
3379                 rc = -EREMOTE;
3380         }
3381
3382 out:
3383         kfree(path);
3384         return rc;
3385 }
3386
3387 /* Check if resolved targets can handle any DFS referrals */
3388 static int is_referral_server(const char *ref_path, struct cifs_sb_info *cifs_sb,
3389                               struct cifs_tcon *tcon, bool *ref_server)
3390 {
3391         int rc;
3392         struct dfs_info3_param ref = {0};
3393
3394         cifs_dbg(FYI, "%s: ref_path=%s\n", __func__, ref_path);
3395
3396         if (is_tcon_dfs(tcon)) {
3397                 *ref_server = true;
3398         } else {
3399                 char *npath;
3400
3401                 npath = dfs_cache_canonical_path(ref_path, cifs_sb->local_nls, cifs_remap(cifs_sb));
3402                 if (IS_ERR(npath))
3403                         return PTR_ERR(npath);
3404
3405                 rc = dfs_cache_noreq_find(npath, &ref, NULL);
3406                 kfree(npath);
3407                 if (rc) {
3408                         cifs_dbg(VFS, "%s: dfs_cache_noreq_find: failed (rc=%d)\n", __func__, rc);
3409                         return rc;
3410                 }
3411                 cifs_dbg(FYI, "%s: ref.flags=0x%x\n", __func__, ref.flags);
3412                 /*
3413                  * Check if all targets are capable of handling DFS referrals as per
3414                  * MS-DFSC 2.2.4 RESP_GET_DFS_REFERRAL.
3415                  */
3416                 *ref_server = !!(ref.flags & DFSREF_REFERRAL_SERVER);
3417                 free_dfs_info_param(&ref);
3418         }
3419         return 0;
3420 }
3421
3422 int cifs_mount(struct cifs_sb_info *cifs_sb, struct smb3_fs_context *ctx)
3423 {
3424         int rc = 0;
3425         unsigned int xid;
3426         struct TCP_Server_Info *server = NULL;
3427         struct cifs_ses *ses = NULL, *root_ses = NULL;
3428         struct cifs_tcon *tcon = NULL;
3429         int count = 0;
3430         uuid_t mount_id = {0};
3431         char *ref_path = NULL, *full_path = NULL;
3432         char *oldmnt = NULL;
3433         bool ref_server = false;
3434
3435         rc = mount_get_conns(ctx, cifs_sb, &xid, &server, &ses, &tcon);
3436         /*
3437          * If called with 'nodfs' mount option, then skip DFS resolving.  Otherwise unconditionally
3438          * try to get an DFS referral (even cached) to determine whether it is an DFS mount.
3439          *
3440          * Skip prefix path to provide support for DFS referrals from w2k8 servers which don't seem
3441          * to respond with PATH_NOT_COVERED to requests that include the prefix.
3442          */
3443         if ((cifs_sb->mnt_cifs_flags & CIFS_MOUNT_NO_DFS) ||
3444             dfs_cache_find(xid, ses, cifs_sb->local_nls, cifs_remap(cifs_sb), ctx->UNC + 1, NULL,
3445                            NULL)) {
3446                 if (rc)
3447                         goto error;
3448                 /* Check if it is fully accessible and then mount it */
3449                 rc = is_path_remote(cifs_sb, ctx, xid, server, tcon);
3450                 if (!rc)
3451                         goto out;
3452                 if (rc != -EREMOTE)
3453                         goto error;
3454         }
3455
3456         ctx->nosharesock = true;
3457
3458         /* Get path of DFS root */
3459         ref_path = build_unc_path_to_root(ctx, cifs_sb, false);
3460         if (IS_ERR(ref_path)) {
3461                 rc = PTR_ERR(ref_path);
3462                 ref_path = NULL;
3463                 goto error;
3464         }
3465
3466         uuid_gen(&mount_id);
3467         set_root_ses(cifs_sb, &mount_id, ses, &root_ses);
3468         do {
3469                 /* Save full path of last DFS path we used to resolve final target server */
3470                 kfree(full_path);
3471                 full_path = build_unc_path_to_root(ctx, cifs_sb, !!count);
3472                 if (IS_ERR(full_path)) {
3473                         rc = PTR_ERR(full_path);
3474                         full_path = NULL;
3475                         break;
3476                 }
3477                 /* Chase referral */
3478                 oldmnt = cifs_sb->ctx->mount_options;
3479                 rc = expand_dfs_referral(xid, root_ses, ctx, cifs_sb, ref_path + 1);
3480                 if (rc)
3481                         break;
3482                 /* Connect to new DFS target only if we were redirected */
3483                 if (oldmnt != cifs_sb->ctx->mount_options) {
3484                         mount_put_conns(cifs_sb, xid, server, ses, tcon);
3485                         rc = mount_get_conns(ctx, cifs_sb, &xid, &server, &ses, &tcon);
3486                 }
3487                 if (rc && !server && !ses) {
3488                         /* Failed to connect. Try to connect to other targets in the referral. */
3489                         rc = do_dfs_failover(ref_path + 1, full_path, cifs_sb, ctx, root_ses, &xid,
3490                                              &server, &ses, &tcon);
3491                 }
3492                 if (rc == -EACCES || rc == -EOPNOTSUPP || !server || !ses)
3493                         break;
3494                 if (!tcon)
3495                         continue;
3496
3497                 /* Make sure that requests go through new root servers */
3498                 rc = is_referral_server(ref_path + 1, cifs_sb, tcon, &ref_server);
3499                 if (rc)
3500                         break;
3501                 if (ref_server)
3502                         set_root_ses(cifs_sb, &mount_id, ses, &root_ses);
3503
3504                 /* Get next dfs path and then continue chasing them if -EREMOTE */
3505                 rc = next_dfs_prepath(cifs_sb, ctx, xid, server, tcon, &ref_path);
3506                 /* Prevent recursion on broken link referrals */
3507                 if (rc == -EREMOTE && ++count > MAX_NESTED_LINKS)
3508                         rc = -ELOOP;
3509         } while (rc == -EREMOTE);
3510
3511         if (rc || !tcon)
3512                 goto error;
3513
3514         kfree(ref_path);
3515         /*
3516          * Store DFS full path in both superblock and tree connect structures.
3517          *
3518          * For DFS root mounts, the prefix path (cifs_sb->prepath) is preserved during reconnect so
3519          * only the root path is set in cifs_sb->origin_fullpath and tcon->dfs_path. And for DFS
3520          * links, the prefix path is included in both and may be changed during reconnect.  See
3521          * cifs_tree_connect().
3522          */
3523         ref_path = dfs_cache_canonical_path(full_path, cifs_sb->local_nls, cifs_remap(cifs_sb));
3524         kfree(full_path);
3525         full_path = NULL;
3526
3527         if (IS_ERR(ref_path)) {
3528                 rc = PTR_ERR(ref_path);
3529                 ref_path = NULL;
3530                 goto error;
3531         }
3532         cifs_sb->origin_fullpath = ref_path;
3533
3534         ref_path = kstrdup(cifs_sb->origin_fullpath, GFP_KERNEL);
3535         if (!ref_path) {
3536                 rc = -ENOMEM;
3537                 goto error;
3538         }
3539         spin_lock(&cifs_tcp_ses_lock);
3540         tcon->dfs_path = ref_path;
3541         ref_path = NULL;
3542         spin_unlock(&cifs_tcp_ses_lock);
3543
3544         /*
3545          * After reconnecting to a different server, unique ids won't
3546          * match anymore, so we disable serverino. This prevents
3547          * dentry revalidation to think the dentry are stale (ESTALE).
3548          */
3549         cifs_autodisable_serverino(cifs_sb);
3550         /*
3551          * Force the use of prefix path to support failover on DFS paths that
3552          * resolve to targets that have different prefix paths.
3553          */
3554         cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_USE_PREFIX_PATH;
3555         kfree(cifs_sb->prepath);
3556         cifs_sb->prepath = ctx->prepath;
3557         ctx->prepath = NULL;
3558         uuid_copy(&cifs_sb->dfs_mount_id, &mount_id);
3559
3560 out:
3561         free_xid(xid);
3562         cifs_try_adding_channels(cifs_sb, ses);
3563         return mount_setup_tlink(cifs_sb, ses, tcon);
3564
3565 error:
3566         kfree(ref_path);
3567         kfree(full_path);
3568         kfree(cifs_sb->origin_fullpath);
3569         dfs_cache_put_refsrv_sessions(&mount_id);
3570         mount_put_conns(cifs_sb, xid, server, ses, tcon);
3571         return rc;
3572 }
3573 #else
3574 int cifs_mount(struct cifs_sb_info *cifs_sb, struct smb3_fs_context *ctx)
3575 {
3576         int rc = 0;
3577         unsigned int xid;
3578         struct cifs_ses *ses;
3579         struct cifs_tcon *tcon;
3580         struct TCP_Server_Info *server;
3581
3582         rc = mount_get_conns(ctx, cifs_sb, &xid, &server, &ses, &tcon);
3583         if (rc)
3584                 goto error;
3585
3586         if (tcon) {
3587                 rc = is_path_remote(cifs_sb, ctx, xid, server, tcon);
3588                 if (rc == -EREMOTE)
3589                         rc = -EOPNOTSUPP;
3590                 if (rc)
3591                         goto error;
3592         }
3593
3594         free_xid(xid);
3595
3596         return mount_setup_tlink(cifs_sb, ses, tcon);
3597
3598 error:
3599         mount_put_conns(cifs_sb, xid, server, ses, tcon);
3600         return rc;
3601 }
3602 #endif
3603
3604 /*
3605  * Issue a TREE_CONNECT request.
3606  */
3607 int
3608 CIFSTCon(const unsigned int xid, struct cifs_ses *ses,
3609          const char *tree, struct cifs_tcon *tcon,
3610          const struct nls_table *nls_codepage)
3611 {
3612         struct smb_hdr *smb_buffer;
3613         struct smb_hdr *smb_buffer_response;
3614         TCONX_REQ *pSMB;
3615         TCONX_RSP *pSMBr;
3616         unsigned char *bcc_ptr;
3617         int rc = 0;
3618         int length;
3619         __u16 bytes_left, count;
3620
3621         if (ses == NULL)
3622                 return -EIO;
3623
3624         smb_buffer = cifs_buf_get();
3625         if (smb_buffer == NULL)
3626                 return -ENOMEM;
3627
3628         smb_buffer_response = smb_buffer;
3629
3630         header_assemble(smb_buffer, SMB_COM_TREE_CONNECT_ANDX,
3631                         NULL /*no tid */ , 4 /*wct */ );
3632
3633         smb_buffer->Mid = get_next_mid(ses->server);
3634         smb_buffer->Uid = ses->Suid;
3635         pSMB = (TCONX_REQ *) smb_buffer;
3636         pSMBr = (TCONX_RSP *) smb_buffer_response;
3637
3638         pSMB->AndXCommand = 0xFF;
3639         pSMB->Flags = cpu_to_le16(TCON_EXTENDED_SECINFO);
3640         bcc_ptr = &pSMB->Password[0];
3641         if (tcon->pipe || (ses->server->sec_mode & SECMODE_USER)) {
3642                 pSMB->PasswordLength = cpu_to_le16(1);  /* minimum */
3643                 *bcc_ptr = 0; /* password is null byte */
3644                 bcc_ptr++;              /* skip password */
3645                 /* already aligned so no need to do it below */
3646         } else {
3647                 pSMB->PasswordLength = cpu_to_le16(CIFS_AUTH_RESP_SIZE);
3648                 /* BB FIXME add code to fail this if NTLMv2 or Kerberos
3649                    specified as required (when that support is added to
3650                    the vfs in the future) as only NTLM or the much
3651                    weaker LANMAN (which we do not send by default) is accepted
3652                    by Samba (not sure whether other servers allow
3653                    NTLMv2 password here) */
3654 #ifdef CONFIG_CIFS_WEAK_PW_HASH
3655                 if ((global_secflags & CIFSSEC_MAY_LANMAN) &&
3656                     (ses->sectype == LANMAN))
3657                         calc_lanman_hash(tcon->password, ses->server->cryptkey,
3658                                          ses->server->sec_mode &
3659                                             SECMODE_PW_ENCRYPT ? true : false,
3660                                          bcc_ptr);
3661                 else
3662 #endif /* CIFS_WEAK_PW_HASH */
3663                 rc = SMBNTencrypt(tcon->password, ses->server->cryptkey,
3664                                         bcc_ptr, nls_codepage);
3665                 if (rc) {
3666                         cifs_dbg(FYI, "%s Can't generate NTLM rsp. Error: %d\n",
3667                                  __func__, rc);
3668                         cifs_buf_release(smb_buffer);
3669                         return rc;
3670                 }
3671
3672                 bcc_ptr += CIFS_AUTH_RESP_SIZE;
3673                 if (ses->capabilities & CAP_UNICODE) {
3674                         /* must align unicode strings */
3675                         *bcc_ptr = 0; /* null byte password */
3676                         bcc_ptr++;
3677                 }
3678         }
3679
3680         if (ses->server->sign)
3681                 smb_buffer->Flags2 |= SMBFLG2_SECURITY_SIGNATURE;
3682
3683         if (ses->capabilities & CAP_STATUS32) {
3684                 smb_buffer->Flags2 |= SMBFLG2_ERR_STATUS;
3685         }
3686         if (ses->capabilities & CAP_DFS) {
3687                 smb_buffer->Flags2 |= SMBFLG2_DFS;
3688         }
3689         if (ses->capabilities & CAP_UNICODE) {
3690                 smb_buffer->Flags2 |= SMBFLG2_UNICODE;
3691                 length =
3692                     cifs_strtoUTF16((__le16 *) bcc_ptr, tree,
3693                         6 /* max utf8 char length in bytes */ *
3694                         (/* server len*/ + 256 /* share len */), nls_codepage);
3695                 bcc_ptr += 2 * length;  /* convert num 16 bit words to bytes */
3696                 bcc_ptr += 2;   /* skip trailing null */
3697         } else {                /* ASCII */
3698                 strcpy(bcc_ptr, tree);
3699                 bcc_ptr += strlen(tree) + 1;
3700         }
3701         strcpy(bcc_ptr, "?????");
3702         bcc_ptr += strlen("?????");
3703         bcc_ptr += 1;
3704         count = bcc_ptr - &pSMB->Password[0];
3705         be32_add_cpu(&pSMB->hdr.smb_buf_length, count);
3706         pSMB->ByteCount = cpu_to_le16(count);
3707
3708         rc = SendReceive(xid, ses, smb_buffer, smb_buffer_response, &length,
3709                          0);
3710
3711         /* above now done in SendReceive */
3712         if (rc == 0) {
3713                 bool is_unicode;
3714
3715                 tcon->tidStatus = CifsGood;
3716                 tcon->need_reconnect = false;
3717                 tcon->tid = smb_buffer_response->Tid;
3718                 bcc_ptr = pByteArea(smb_buffer_response);
3719                 bytes_left = get_bcc(smb_buffer_response);
3720                 length = strnlen(bcc_ptr, bytes_left - 2);
3721                 if (smb_buffer->Flags2 & SMBFLG2_UNICODE)
3722                         is_unicode = true;
3723                 else
3724                         is_unicode = false;
3725
3726
3727                 /* skip service field (NB: this field is always ASCII) */
3728                 if (length == 3) {
3729                         if ((bcc_ptr[0] == 'I') && (bcc_ptr[1] == 'P') &&
3730                             (bcc_ptr[2] == 'C')) {
3731                                 cifs_dbg(FYI, "IPC connection\n");
3732                                 tcon->ipc = true;
3733                                 tcon->pipe = true;
3734                         }
3735                 } else if (length == 2) {
3736                         if ((bcc_ptr[0] == 'A') && (bcc_ptr[1] == ':')) {
3737                                 /* the most common case */
3738                                 cifs_dbg(FYI, "disk share connection\n");
3739                         }
3740                 }
3741                 bcc_ptr += length + 1;
3742                 bytes_left -= (length + 1);
3743                 strlcpy(tcon->treeName, tree, sizeof(tcon->treeName));
3744
3745                 /* mostly informational -- no need to fail on error here */
3746                 kfree(tcon->nativeFileSystem);
3747                 tcon->nativeFileSystem = cifs_strndup_from_utf16(bcc_ptr,
3748                                                       bytes_left, is_unicode,
3749                                                       nls_codepage);
3750
3751                 cifs_dbg(FYI, "nativeFileSystem=%s\n", tcon->nativeFileSystem);
3752
3753                 if ((smb_buffer_response->WordCount == 3) ||
3754                          (smb_buffer_response->WordCount == 7))
3755                         /* field is in same location */
3756                         tcon->Flags = le16_to_cpu(pSMBr->OptionalSupport);
3757                 else
3758                         tcon->Flags = 0;
3759                 cifs_dbg(FYI, "Tcon flags: 0x%x\n", tcon->Flags);
3760         }
3761
3762         cifs_buf_release(smb_buffer);
3763         return rc;
3764 }
3765
3766 static void delayed_free(struct rcu_head *p)
3767 {
3768         struct cifs_sb_info *cifs_sb = container_of(p, struct cifs_sb_info, rcu);
3769
3770         unload_nls(cifs_sb->local_nls);
3771         smb3_cleanup_fs_context(cifs_sb->ctx);
3772         kfree(cifs_sb);
3773 }
3774
3775 void
3776 cifs_umount(struct cifs_sb_info *cifs_sb)
3777 {
3778         struct rb_root *root = &cifs_sb->tlink_tree;
3779         struct rb_node *node;
3780         struct tcon_link *tlink;
3781
3782         cancel_delayed_work_sync(&cifs_sb->prune_tlinks);
3783
3784         spin_lock(&cifs_sb->tlink_tree_lock);
3785         while ((node = rb_first(root))) {
3786                 tlink = rb_entry(node, struct tcon_link, tl_rbnode);
3787                 cifs_get_tlink(tlink);
3788                 clear_bit(TCON_LINK_IN_TREE, &tlink->tl_flags);
3789                 rb_erase(node, root);
3790
3791                 spin_unlock(&cifs_sb->tlink_tree_lock);
3792                 cifs_put_tlink(tlink);
3793                 spin_lock(&cifs_sb->tlink_tree_lock);
3794         }
3795         spin_unlock(&cifs_sb->tlink_tree_lock);
3796
3797         kfree(cifs_sb->prepath);
3798 #ifdef CONFIG_CIFS_DFS_UPCALL
3799         dfs_cache_put_refsrv_sessions(&cifs_sb->dfs_mount_id);
3800         kfree(cifs_sb->origin_fullpath);
3801 #endif
3802         call_rcu(&cifs_sb->rcu, delayed_free);
3803 }
3804
3805 int
3806 cifs_negotiate_protocol(const unsigned int xid, struct cifs_ses *ses)
3807 {
3808         int rc = 0;
3809         struct TCP_Server_Info *server = cifs_ses_server(ses);
3810
3811         if (!server->ops->need_neg || !server->ops->negotiate)
3812                 return -ENOSYS;
3813
3814         /* only send once per connect */
3815         if (!server->ops->need_neg(server))
3816                 return 0;
3817
3818         rc = server->ops->negotiate(xid, ses);
3819         if (rc == 0) {
3820                 spin_lock(&GlobalMid_Lock);
3821                 if (server->tcpStatus == CifsNeedNegotiate)
3822                         server->tcpStatus = CifsGood;
3823                 else
3824                         rc = -EHOSTDOWN;
3825                 spin_unlock(&GlobalMid_Lock);
3826         }
3827
3828         return rc;
3829 }
3830
3831 int
3832 cifs_setup_session(const unsigned int xid, struct cifs_ses *ses,
3833                    struct nls_table *nls_info)
3834 {
3835         int rc = -ENOSYS;
3836         struct TCP_Server_Info *server = cifs_ses_server(ses);
3837
3838         if (!ses->binding) {
3839                 ses->capabilities = server->capabilities;
3840                 if (!linuxExtEnabled)
3841                         ses->capabilities &= (~server->vals->cap_unix);
3842
3843                 if (ses->auth_key.response) {
3844                         cifs_dbg(FYI, "Free previous auth_key.response = %p\n",
3845                                  ses->auth_key.response);
3846                         kfree(ses->auth_key.response);
3847                         ses->auth_key.response = NULL;
3848                         ses->auth_key.len = 0;
3849                 }
3850         }
3851
3852         cifs_dbg(FYI, "Security Mode: 0x%x Capabilities: 0x%x TimeAdjust: %d\n",
3853                  server->sec_mode, server->capabilities, server->timeAdj);
3854
3855         if (server->ops->sess_setup)
3856                 rc = server->ops->sess_setup(xid, ses, nls_info);
3857
3858         if (rc)
3859                 cifs_server_dbg(VFS, "Send error in SessSetup = %d\n", rc);
3860
3861         return rc;
3862 }
3863
3864 static int
3865 cifs_set_vol_auth(struct smb3_fs_context *ctx, struct cifs_ses *ses)
3866 {
3867         ctx->sectype = ses->sectype;
3868
3869         /* krb5 is special, since we don't need username or pw */
3870         if (ctx->sectype == Kerberos)
3871                 return 0;
3872
3873         return cifs_set_cifscreds(ctx, ses);
3874 }
3875
3876 static struct cifs_tcon *
3877 cifs_construct_tcon(struct cifs_sb_info *cifs_sb, kuid_t fsuid)
3878 {
3879         int rc;
3880         struct cifs_tcon *master_tcon = cifs_sb_master_tcon(cifs_sb);
3881         struct cifs_ses *ses;
3882         struct cifs_tcon *tcon = NULL;
3883         struct smb3_fs_context *ctx;
3884
3885         ctx = kzalloc(sizeof(*ctx), GFP_KERNEL);
3886         if (ctx == NULL)
3887                 return ERR_PTR(-ENOMEM);
3888
3889         ctx->local_nls = cifs_sb->local_nls;
3890         ctx->linux_uid = fsuid;
3891         ctx->cred_uid = fsuid;
3892         ctx->UNC = master_tcon->treeName;
3893         ctx->retry = master_tcon->retry;
3894         ctx->nocase = master_tcon->nocase;
3895         ctx->nohandlecache = master_tcon->nohandlecache;
3896         ctx->local_lease = master_tcon->local_lease;
3897         ctx->no_lease = master_tcon->no_lease;
3898         ctx->resilient = master_tcon->use_resilient;
3899         ctx->persistent = master_tcon->use_persistent;
3900         ctx->handle_timeout = master_tcon->handle_timeout;
3901         ctx->no_linux_ext = !master_tcon->unix_ext;
3902         ctx->linux_ext = master_tcon->posix_extensions;
3903         ctx->sectype = master_tcon->ses->sectype;
3904         ctx->sign = master_tcon->ses->sign;
3905         ctx->seal = master_tcon->seal;
3906         ctx->witness = master_tcon->use_witness;
3907
3908         rc = cifs_set_vol_auth(ctx, master_tcon->ses);
3909         if (rc) {
3910                 tcon = ERR_PTR(rc);
3911                 goto out;
3912         }
3913
3914         /* get a reference for the same TCP session */
3915         spin_lock(&cifs_tcp_ses_lock);
3916         ++master_tcon->ses->server->srv_count;
3917         spin_unlock(&cifs_tcp_ses_lock);
3918
3919         ses = cifs_get_smb_ses(master_tcon->ses->server, ctx);
3920         if (IS_ERR(ses)) {
3921                 tcon = (struct cifs_tcon *)ses;
3922                 cifs_put_tcp_session(master_tcon->ses->server, 0);
3923                 goto out;
3924         }
3925
3926         tcon = cifs_get_tcon(ses, ctx);
3927         if (IS_ERR(tcon)) {
3928                 cifs_put_smb_ses(ses);
3929                 goto out;
3930         }
3931
3932         if (cap_unix(ses))
3933                 reset_cifs_unix_caps(0, tcon, NULL, ctx);
3934
3935 out:
3936         kfree(ctx->username);
3937         kfree_sensitive(ctx->password);
3938         kfree(ctx);
3939
3940         return tcon;
3941 }
3942
3943 struct cifs_tcon *
3944 cifs_sb_master_tcon(struct cifs_sb_info *cifs_sb)
3945 {
3946         return tlink_tcon(cifs_sb_master_tlink(cifs_sb));
3947 }
3948
3949 /* find and return a tlink with given uid */
3950 static struct tcon_link *
3951 tlink_rb_search(struct rb_root *root, kuid_t uid)
3952 {
3953         struct rb_node *node = root->rb_node;
3954         struct tcon_link *tlink;
3955
3956         while (node) {
3957                 tlink = rb_entry(node, struct tcon_link, tl_rbnode);
3958
3959                 if (uid_gt(tlink->tl_uid, uid))
3960                         node = node->rb_left;
3961                 else if (uid_lt(tlink->tl_uid, uid))
3962                         node = node->rb_right;
3963                 else
3964                         return tlink;
3965         }
3966         return NULL;
3967 }
3968
3969 /* insert a tcon_link into the tree */
3970 static void
3971 tlink_rb_insert(struct rb_root *root, struct tcon_link *new_tlink)
3972 {
3973         struct rb_node **new = &(root->rb_node), *parent = NULL;
3974         struct tcon_link *tlink;
3975
3976         while (*new) {
3977                 tlink = rb_entry(*new, struct tcon_link, tl_rbnode);
3978                 parent = *new;
3979
3980                 if (uid_gt(tlink->tl_uid, new_tlink->tl_uid))
3981                         new = &((*new)->rb_left);
3982                 else
3983                         new = &((*new)->rb_right);
3984         }
3985
3986         rb_link_node(&new_tlink->tl_rbnode, parent, new);
3987         rb_insert_color(&new_tlink->tl_rbnode, root);
3988 }
3989
3990 /*
3991  * Find or construct an appropriate tcon given a cifs_sb and the fsuid of the
3992  * current task.
3993  *
3994  * If the superblock doesn't refer to a multiuser mount, then just return
3995  * the master tcon for the mount.
3996  *
3997  * First, search the rbtree for an existing tcon for this fsuid. If one
3998  * exists, then check to see if it's pending construction. If it is then wait
3999  * for construction to complete. Once it's no longer pending, check to see if
4000  * it failed and either return an error or retry construction, depending on
4001  * the timeout.
4002  *
4003  * If one doesn't exist then insert a new tcon_link struct into the tree and
4004  * try to construct a new one.
4005  */
4006 struct tcon_link *
4007 cifs_sb_tlink(struct cifs_sb_info *cifs_sb)
4008 {
4009         int ret;
4010         kuid_t fsuid = current_fsuid();
4011         struct tcon_link *tlink, *newtlink;
4012
4013         if (!(cifs_sb->mnt_cifs_flags & CIFS_MOUNT_MULTIUSER))
4014                 return cifs_get_tlink(cifs_sb_master_tlink(cifs_sb));
4015
4016         spin_lock(&cifs_sb->tlink_tree_lock);
4017         tlink = tlink_rb_search(&cifs_sb->tlink_tree, fsuid);
4018         if (tlink)
4019                 cifs_get_tlink(tlink);
4020         spin_unlock(&cifs_sb->tlink_tree_lock);
4021
4022         if (tlink == NULL) {
4023                 newtlink = kzalloc(sizeof(*tlink), GFP_KERNEL);
4024                 if (newtlink == NULL)
4025                         return ERR_PTR(-ENOMEM);
4026                 newtlink->tl_uid = fsuid;
4027                 newtlink->tl_tcon = ERR_PTR(-EACCES);
4028                 set_bit(TCON_LINK_PENDING, &newtlink->tl_flags);
4029                 set_bit(TCON_LINK_IN_TREE, &newtlink->tl_flags);
4030                 cifs_get_tlink(newtlink);
4031
4032                 spin_lock(&cifs_sb->tlink_tree_lock);
4033                 /* was one inserted after previous search? */
4034                 tlink = tlink_rb_search(&cifs_sb->tlink_tree, fsuid);
4035                 if (tlink) {
4036                         cifs_get_tlink(tlink);
4037                         spin_unlock(&cifs_sb->tlink_tree_lock);
4038                         kfree(newtlink);
4039                         goto wait_for_construction;
4040                 }
4041                 tlink = newtlink;
4042                 tlink_rb_insert(&cifs_sb->tlink_tree, tlink);
4043                 spin_unlock(&cifs_sb->tlink_tree_lock);
4044         } else {
4045 wait_for_construction:
4046                 ret = wait_on_bit(&tlink->tl_flags, TCON_LINK_PENDING,
4047                                   TASK_INTERRUPTIBLE);
4048                 if (ret) {
4049                         cifs_put_tlink(tlink);
4050                         return ERR_PTR(-ERESTARTSYS);
4051                 }
4052
4053                 /* if it's good, return it */
4054                 if (!IS_ERR(tlink->tl_tcon))
4055                         return tlink;
4056
4057                 /* return error if we tried this already recently */
4058                 if (time_before(jiffies, tlink->tl_time + TLINK_ERROR_EXPIRE)) {
4059                         cifs_put_tlink(tlink);
4060                         return ERR_PTR(-EACCES);
4061                 }
4062
4063                 if (test_and_set_bit(TCON_LINK_PENDING, &tlink->tl_flags))
4064                         goto wait_for_construction;
4065         }
4066
4067         tlink->tl_tcon = cifs_construct_tcon(cifs_sb, fsuid);
4068         clear_bit(TCON_LINK_PENDING, &tlink->tl_flags);
4069         wake_up_bit(&tlink->tl_flags, TCON_LINK_PENDING);
4070
4071         if (IS_ERR(tlink->tl_tcon)) {
4072                 cifs_put_tlink(tlink);
4073                 return ERR_PTR(-EACCES);
4074         }
4075
4076         return tlink;
4077 }
4078
4079 /*
4080  * periodic workqueue job that scans tcon_tree for a superblock and closes
4081  * out tcons.
4082  */
4083 static void
4084 cifs_prune_tlinks(struct work_struct *work)
4085 {
4086         struct cifs_sb_info *cifs_sb = container_of(work, struct cifs_sb_info,
4087                                                     prune_tlinks.work);
4088         struct rb_root *root = &cifs_sb->tlink_tree;
4089         struct rb_node *node;
4090         struct rb_node *tmp;
4091         struct tcon_link *tlink;
4092
4093         /*
4094          * Because we drop the spinlock in the loop in order to put the tlink
4095          * it's not guarded against removal of links from the tree. The only
4096          * places that remove entries from the tree are this function and
4097          * umounts. Because this function is non-reentrant and is canceled
4098          * before umount can proceed, this is safe.
4099          */
4100         spin_lock(&cifs_sb->tlink_tree_lock);
4101         node = rb_first(root);
4102         while (node != NULL) {
4103                 tmp = node;
4104                 node = rb_next(tmp);
4105                 tlink = rb_entry(tmp, struct tcon_link, tl_rbnode);
4106
4107                 if (test_bit(TCON_LINK_MASTER, &tlink->tl_flags) ||
4108                     atomic_read(&tlink->tl_count) != 0 ||
4109                     time_after(tlink->tl_time + TLINK_IDLE_EXPIRE, jiffies))
4110                         continue;
4111
4112                 cifs_get_tlink(tlink);
4113                 clear_bit(TCON_LINK_IN_TREE, &tlink->tl_flags);
4114                 rb_erase(tmp, root);
4115
4116                 spin_unlock(&cifs_sb->tlink_tree_lock);
4117                 cifs_put_tlink(tlink);
4118                 spin_lock(&cifs_sb->tlink_tree_lock);
4119         }
4120         spin_unlock(&cifs_sb->tlink_tree_lock);
4121
4122         queue_delayed_work(cifsiod_wq, &cifs_sb->prune_tlinks,
4123                                 TLINK_IDLE_EXPIRE);
4124 }
4125
4126 #ifdef CONFIG_CIFS_DFS_UPCALL
4127 int cifs_tree_connect(const unsigned int xid, struct cifs_tcon *tcon, const struct nls_table *nlsc)
4128 {
4129         int rc;
4130         struct TCP_Server_Info *server = tcon->ses->server;
4131         const struct smb_version_operations *ops = server->ops;
4132         struct dfs_cache_tgt_list tl;
4133         struct dfs_cache_tgt_iterator *it = NULL;
4134         char *tree;
4135         const char *tcp_host;
4136         size_t tcp_host_len;
4137         const char *dfs_host;
4138         size_t dfs_host_len;
4139         char *share = NULL, *prefix = NULL;
4140         struct dfs_info3_param ref = {0};
4141         bool isroot;
4142
4143         tree = kzalloc(MAX_TREE_SIZE, GFP_KERNEL);
4144         if (!tree)
4145                 return -ENOMEM;
4146
4147         /* If it is not dfs or there was no cached dfs referral, then reconnect to same share */
4148         if (!tcon->dfs_path || dfs_cache_noreq_find(tcon->dfs_path + 1, &ref, &tl)) {
4149                 if (tcon->ipc) {
4150                         scnprintf(tree, MAX_TREE_SIZE, "\\\\%s\\IPC$", server->hostname);
4151                         rc = ops->tree_connect(xid, tcon->ses, tree, tcon, nlsc);
4152                 } else {
4153                         rc = ops->tree_connect(xid, tcon->ses, tcon->treeName, tcon, nlsc);
4154                 }
4155                 goto out;
4156         }
4157
4158         isroot = ref.server_type == DFS_TYPE_ROOT;
4159         free_dfs_info_param(&ref);
4160
4161         extract_unc_hostname(server->hostname, &tcp_host, &tcp_host_len);
4162
4163         for (it = dfs_cache_get_tgt_iterator(&tl); it; it = dfs_cache_get_next_tgt(&tl, it)) {
4164                 bool target_match;
4165
4166                 kfree(share);
4167                 kfree(prefix);
4168                 share = NULL;
4169                 prefix = NULL;
4170
4171                 rc = dfs_cache_get_tgt_share(tcon->dfs_path + 1, it, &share, &prefix);
4172                 if (rc) {
4173                         cifs_dbg(VFS, "%s: failed to parse target share %d\n",
4174                                  __func__, rc);
4175                         continue;
4176                 }
4177
4178                 extract_unc_hostname(share, &dfs_host, &dfs_host_len);
4179
4180                 if (dfs_host_len != tcp_host_len
4181                     || strncasecmp(dfs_host, tcp_host, dfs_host_len) != 0) {
4182                         cifs_dbg(FYI, "%s: %.*s doesn't match %.*s\n", __func__, (int)dfs_host_len,
4183                                  dfs_host, (int)tcp_host_len, tcp_host);
4184
4185                         rc = match_target_ip(server, dfs_host, dfs_host_len, &target_match);
4186                         if (rc) {
4187                                 cifs_dbg(VFS, "%s: failed to match target ip: %d\n", __func__, rc);
4188                                 break;
4189                         }
4190
4191                         if (!target_match) {
4192                                 cifs_dbg(FYI, "%s: skipping target\n", __func__);
4193                                 continue;
4194                         }
4195                 }
4196
4197                 if (tcon->ipc) {
4198                         scnprintf(tree, MAX_TREE_SIZE, "\\\\%s\\IPC$", share);
4199                         rc = ops->tree_connect(xid, tcon->ses, tree, tcon, nlsc);
4200                 } else {
4201                         scnprintf(tree, MAX_TREE_SIZE, "\\%s", share);
4202                         rc = ops->tree_connect(xid, tcon->ses, tree, tcon, nlsc);
4203                         /* Only handle prefix paths of DFS link targets */
4204                         if (!rc && !isroot) {
4205                                 rc = update_super_prepath(tcon, prefix);
4206                                 break;
4207                         }
4208                 }
4209                 if (rc == -EREMOTE)
4210                         break;
4211         }
4212
4213         kfree(share);
4214         kfree(prefix);
4215
4216         if (!rc) {
4217                 if (it)
4218                         rc = dfs_cache_noreq_update_tgthint(tcon->dfs_path + 1, it);
4219                 else
4220                         rc = -ENOENT;
4221         }
4222         dfs_cache_free_tgts(&tl);
4223 out:
4224         kfree(tree);
4225         return rc;
4226 }
4227 #else
4228 int cifs_tree_connect(const unsigned int xid, struct cifs_tcon *tcon, const struct nls_table *nlsc)
4229 {
4230         const struct smb_version_operations *ops = tcon->ses->server->ops;
4231
4232         return ops->tree_connect(xid, tcon->ses, tcon->treeName, tcon, nlsc);
4233 }
4234 #endif