fs/cifs/connect.c

   1 // SPDX-License-Identifier: LGPL-2.1
   2 /*
   3  *   fs/cifs/connect.c
   4  *
   5  *   Copyright (C) International Business Machines  Corp., 2002,2011
   6  *   Author(s): Steve French (sfrench@us.ibm.com)
   7  *
   8  */
   9 #include <linux/fs.h>
  10 #include <linux/net.h>
  11 #include <linux/string.h>
  12 #include <linux/sched/mm.h>
  13 #include <linux/sched/signal.h>
  14 #include <linux/list.h>
  15 #include <linux/wait.h>
  16 #include <linux/slab.h>
  17 #include <linux/pagemap.h>
  18 #include <linux/ctype.h>
  19 #include <linux/utsname.h>
  20 #include <linux/mempool.h>
  21 #include <linux/delay.h>
  22 #include <linux/completion.h>
  23 #include <linux/kthread.h>
  24 #include <linux/pagevec.h>
  25 #include <linux/freezer.h>
  26 #include <linux/namei.h>
  27 #include <linux/uuid.h>
  28 #include <linux/uaccess.h>
  29 #include <asm/processor.h>
  30 #include <linux/inet.h>
  31 #include <linux/module.h>
  32 #include <keys/user-type.h>
  33 #include <net/ipv6.h>
  34 #include <linux/parser.h>
  35 #include <linux/bvec.h>
  36 #include "cifspdu.h"
  37 #include "cifsglob.h"
  38 #include "cifsproto.h"
  39 #include "cifs_unicode.h"
  40 #include "cifs_debug.h"
  41 #include "cifs_fs_sb.h"
  42 #include "ntlmssp.h"
  43 #include "nterr.h"
  44 #include "rfc1002pdu.h"
  45 #include "fscache.h"
  46 #include "smb2proto.h"
  47 #include "smbdirect.h"
  48 #include "dns_resolve.h"
  49 #ifdef CONFIG_CIFS_DFS_UPCALL
  50 #include "dfs_cache.h"
  51 #endif
  52 #include "fs_context.h"
  53 #include "cifs_swn.h"
  54
  55 extern mempool_t *cifs_req_poolp;
  56 extern bool disable_legacy_dialects;
  57
  58 /* FIXME: should these be tunable? */
  59 #define TLINK_ERROR_EXPIRE      (1 * HZ)
  60 #define TLINK_IDLE_EXPIRE       (600 * HZ)
  61
  62 /* Drop the connection to not overload the server */
  63 #define NUM_STATUS_IO_TIMEOUT   5
  64
  65 static int ip_connect(struct TCP_Server_Info *server);
  66 static int generic_ip_connect(struct TCP_Server_Info *server);
  67 static void tlink_rb_insert(struct rb_root *root, struct tcon_link *new_tlink);
  68 static void cifs_prune_tlinks(struct work_struct *work);
  69
  70 /*
  71  * Resolve hostname and set ip addr in tcp ses. Useful for hostnames that may
  72  * get their ip addresses changed at some point.
  73  *
  74  * This should be called with server->srv_mutex held.
  75  */
  76 static int reconn_set_ipaddr_from_hostname(struct TCP_Server_Info *server)
  77 {
  78         int rc;
  79         int len;
  80         char *unc, *ipaddr = NULL;
  81
  82         if (!server->hostname)
  83                 return -EINVAL;
  84
  85         len = strlen(server->hostname) + 3;
  86
  87         unc = kmalloc(len, GFP_KERNEL);
  88         if (!unc) {
  89                 cifs_dbg(FYI, "%s: failed to create UNC path\n", __func__);
  90                 return -ENOMEM;
  91         }
  92         scnprintf(unc, len, "\\\\%s", server->hostname);
  93
  94         rc = dns_resolve_server_name_to_ip(unc, &ipaddr);
  95         kfree(unc);
  96
  97         if (rc < 0) {
  98                 cifs_dbg(FYI, "%s: failed to resolve server part of %s to IP: %d\n",
  99                          __func__, server->hostname, rc);
 100                 return rc;
 101         }
 102
 103         spin_lock(&cifs_tcp_ses_lock);
 104         rc = cifs_convert_address((struct sockaddr *)&server->dstaddr, ipaddr,
 105                                   strlen(ipaddr));
 106         spin_unlock(&cifs_tcp_ses_lock);
 107         kfree(ipaddr);
 108
 109         return !rc ? -1 : 0;
 110 }
 111
 112 #ifdef CONFIG_CIFS_DFS_UPCALL
 113 /* These functions must be called with server->srv_mutex held */
 114 static void reconn_set_next_dfs_target(struct TCP_Server_Info *server,
 115                                        struct cifs_sb_info *cifs_sb,
 116                                        struct dfs_cache_tgt_list *tgt_list,
 117                                        struct dfs_cache_tgt_iterator **tgt_it)
 118 {
 119         const char *name;
 120         int rc;
 121
 122         if (!cifs_sb || !cifs_sb->origin_fullpath)
 123                 return;
 124
 125         if (!*tgt_it) {
 126                 *tgt_it = dfs_cache_get_tgt_iterator(tgt_list);
 127         } else {
 128                 *tgt_it = dfs_cache_get_next_tgt(tgt_list, *tgt_it);
 129                 if (!*tgt_it)
 130                         *tgt_it = dfs_cache_get_tgt_iterator(tgt_list);
 131         }
 132
 133         cifs_dbg(FYI, "%s: UNC: %s\n", __func__, cifs_sb->origin_fullpath);
 134
 135         name = dfs_cache_get_tgt_name(*tgt_it);
 136
 137         kfree(server->hostname);
 138
 139         server->hostname = extract_hostname(name);
 140         if (IS_ERR(server->hostname)) {
 141                 cifs_dbg(FYI,
 142                          "%s: failed to extract hostname from target: %ld\n",
 143                          __func__, PTR_ERR(server->hostname));
 144                 return;
 145         }
 146
 147         rc = reconn_set_ipaddr_from_hostname(server);
 148         if (rc) {
 149                 cifs_dbg(FYI, "%s: failed to resolve hostname: %d\n",
 150                          __func__, rc);
 151         }
 152 }
 153
 154 static inline int reconn_setup_dfs_targets(struct cifs_sb_info *cifs_sb,
 155                                            struct dfs_cache_tgt_list *tl)
 156 {
 157         if (!cifs_sb->origin_fullpath)
 158                 return -EOPNOTSUPP;
 159         return dfs_cache_noreq_find(cifs_sb->origin_fullpath + 1, NULL, tl);
 160 }
 161 #endif
 162
 163 /*
 164  * cifs tcp session reconnection
 165  *
 166  * mark tcp session as reconnecting so temporarily locked
 167  * mark all smb sessions as reconnecting for tcp session
 168  * reconnect tcp session
 169  * wake up waiters on reconnection? - (not needed currently)
 170  */
 171 int
 172 cifs_reconnect(struct TCP_Server_Info *server)
 173 {
 174         int rc = 0;
 175         struct list_head *tmp, *tmp2;
 176         struct cifs_ses *ses;
 177         struct cifs_tcon *tcon;
 178         struct mid_q_entry *mid_entry;
 179         struct list_head retry_list;
 180 #ifdef CONFIG_CIFS_DFS_UPCALL
 181         struct super_block *sb = NULL;
 182         struct cifs_sb_info *cifs_sb = NULL;
 183         struct dfs_cache_tgt_list tgt_list = {0};
 184         struct dfs_cache_tgt_iterator *tgt_it = NULL;
 185 #endif
 186
 187         spin_lock(&GlobalMid_Lock);
 188         server->nr_targets = 1;
 189 #ifdef CONFIG_CIFS_DFS_UPCALL
 190         spin_unlock(&GlobalMid_Lock);
 191         sb = cifs_get_tcp_super(server);
 192         if (IS_ERR(sb)) {
 193                 rc = PTR_ERR(sb);
 194                 cifs_dbg(FYI, "%s: will not do DFS failover: rc = %d\n",
 195                          __func__, rc);
 196                 sb = NULL;
 197         } else {
 198                 cifs_sb = CIFS_SB(sb);
 199                 rc = reconn_setup_dfs_targets(cifs_sb, &tgt_list);
 200                 if (rc) {
 201                         cifs_sb = NULL;
 202                         if (rc != -EOPNOTSUPP) {
 203                                 cifs_server_dbg(VFS, "%s: no target servers for DFS failover\n",
 204                                                 __func__);
 205                         }
 206                 } else {
 207                         server->nr_targets = dfs_cache_get_nr_tgts(&tgt_list);
 208                 }
 209         }
 210         cifs_dbg(FYI, "%s: will retry %d target(s)\n", __func__,
 211                  server->nr_targets);
 212         spin_lock(&GlobalMid_Lock);
 213 #endif
 214         if (server->tcpStatus == CifsExiting) {
 215                 /* the demux thread will exit normally
 216                 next time through the loop */
 217                 spin_unlock(&GlobalMid_Lock);
 218 #ifdef CONFIG_CIFS_DFS_UPCALL
 219                 dfs_cache_free_tgts(&tgt_list);
 220                 cifs_put_tcp_super(sb);
 221 #endif
 222                 wake_up(&server->response_q);
 223                 return rc;
 224         } else
 225                 server->tcpStatus = CifsNeedReconnect;
 226         spin_unlock(&GlobalMid_Lock);
 227         server->maxBuf = 0;
 228         server->max_read = 0;
 229
 230         cifs_dbg(FYI, "Mark tcp session as need reconnect\n");
 231         trace_smb3_reconnect(server->CurrentMid, server->conn_id, server->hostname);
 232
 233         /* before reconnecting the tcp session, mark the smb session (uid)
 234                 and the tid bad so they are not used until reconnected */
 235         cifs_dbg(FYI, "%s: marking sessions and tcons for reconnect\n",
 236                  __func__);
 237         spin_lock(&cifs_tcp_ses_lock);
 238         list_for_each(tmp, &server->smb_ses_list) {
 239                 ses = list_entry(tmp, struct cifs_ses, smb_ses_list);
 240                 ses->need_reconnect = true;
 241                 list_for_each(tmp2, &ses->tcon_list) {
 242                         tcon = list_entry(tmp2, struct cifs_tcon, tcon_list);
 243                         tcon->need_reconnect = true;
 244                 }
 245                 if (ses->tcon_ipc)
 246                         ses->tcon_ipc->need_reconnect = true;
 247         }
 248         spin_unlock(&cifs_tcp_ses_lock);
 249
 250         /* do not want to be sending data on a socket we are freeing */
 251         cifs_dbg(FYI, "%s: tearing down socket\n", __func__);
 252         mutex_lock(&server->srv_mutex);
 253         if (server->ssocket) {
 254                 cifs_dbg(FYI, "State: 0x%x Flags: 0x%lx\n",
 255                          server->ssocket->state, server->ssocket->flags);
 256                 kernel_sock_shutdown(server->ssocket, SHUT_WR);
 257                 cifs_dbg(FYI, "Post shutdown state: 0x%x Flags: 0x%lx\n",
 258                          server->ssocket->state, server->ssocket->flags);
 259                 sock_release(server->ssocket);
 260                 server->ssocket = NULL;
 261         }
 262         server->sequence_number = 0;
 263         server->session_estab = false;
 264         kfree(server->session_key.response);
 265         server->session_key.response = NULL;
 266         server->session_key.len = 0;
 267         server->lstrp = jiffies;
 268
 269         /* mark submitted MIDs for retry and issue callback */
 270         INIT_LIST_HEAD(&retry_list);
 271         cifs_dbg(FYI, "%s: moving mids to private list\n", __func__);
 272         spin_lock(&GlobalMid_Lock);
 273         list_for_each_safe(tmp, tmp2, &server->pending_mid_q) {
 274                 mid_entry = list_entry(tmp, struct mid_q_entry, qhead);
 275                 kref_get(&mid_entry->refcount);
 276                 if (mid_entry->mid_state == MID_REQUEST_SUBMITTED)
 277                         mid_entry->mid_state = MID_RETRY_NEEDED;
 278                 list_move(&mid_entry->qhead, &retry_list);
 279                 mid_entry->mid_flags |= MID_DELETED;
 280         }
 281         spin_unlock(&GlobalMid_Lock);
 282         mutex_unlock(&server->srv_mutex);
 283
 284         cifs_dbg(FYI, "%s: issuing mid callbacks\n", __func__);
 285         list_for_each_safe(tmp, tmp2, &retry_list) {
 286                 mid_entry = list_entry(tmp, struct mid_q_entry, qhead);
 287                 list_del_init(&mid_entry->qhead);
 288                 mid_entry->callback(mid_entry);
 289                 cifs_mid_q_entry_release(mid_entry);
 290         }
 291
 292         if (cifs_rdma_enabled(server)) {
 293                 mutex_lock(&server->srv_mutex);
 294                 smbd_destroy(server);
 295                 mutex_unlock(&server->srv_mutex);
 296         }
 297
 298         do {
 299                 try_to_freeze();
 300
 301                 mutex_lock(&server->srv_mutex);
 302
 303
 304                 if (!cifs_swn_set_server_dstaddr(server)) {
 305 #ifdef CONFIG_CIFS_DFS_UPCALL
 306                 if (cifs_sb && cifs_sb->origin_fullpath)
 307                         /*
 308                          * Set up next DFS target server (if any) for reconnect. If DFS
 309                          * feature is disabled, then we will retry last server we
 310                          * connected to before.
 311                          */
 312                         reconn_set_next_dfs_target(server, cifs_sb, &tgt_list, &tgt_it);
 313                 else {
 314 #endif
 315                         /*
 316                          * Resolve the hostname again to make sure that IP address is up-to-date.
 317                          */
 318                         rc = reconn_set_ipaddr_from_hostname(server);
 319                         if (rc) {
 320                                 cifs_dbg(FYI, "%s: failed to resolve hostname: %d\n",
 321                                                 __func__, rc);
 322                         }
 323
 324 #ifdef CONFIG_CIFS_DFS_UPCALL
 325                 }
 326 #endif
 327
 328
 329                 }
 330
 331                 if (cifs_rdma_enabled(server))
 332                         rc = smbd_reconnect(server);
 333                 else
 334                         rc = generic_ip_connect(server);
 335                 if (rc) {
 336                         cifs_dbg(FYI, "reconnect error %d\n", rc);
 337                         mutex_unlock(&server->srv_mutex);
 338                         msleep(3000);
 339                 } else {
 340                         atomic_inc(&tcpSesReconnectCount);
 341                         set_credits(server, 1);
 342                         spin_lock(&GlobalMid_Lock);
 343                         if (server->tcpStatus != CifsExiting)
 344                                 server->tcpStatus = CifsNeedNegotiate;
 345                         spin_unlock(&GlobalMid_Lock);
 346                         cifs_swn_reset_server_dstaddr(server);
 347                         mutex_unlock(&server->srv_mutex);
 348                 }
 349         } while (server->tcpStatus == CifsNeedReconnect);
 350
 351 #ifdef CONFIG_CIFS_DFS_UPCALL
 352         if (tgt_it) {
 353                 rc = dfs_cache_noreq_update_tgthint(cifs_sb->origin_fullpath + 1,
 354                                                     tgt_it);
 355                 if (rc) {
 356                         cifs_server_dbg(VFS, "%s: failed to update DFS target hint: rc = %d\n",
 357                                  __func__, rc);
 358                 }
 359                 dfs_cache_free_tgts(&tgt_list);
 360         }
 361
 362         cifs_put_tcp_super(sb);
 363 #endif
 364         if (server->tcpStatus == CifsNeedNegotiate)
 365                 mod_delayed_work(cifsiod_wq, &server->echo, 0);
 366
 367         wake_up(&server->response_q);
 368         return rc;
 369 }
 370
 371 static void
 372 cifs_echo_request(struct work_struct *work)
 373 {
 374         int rc;
 375         struct TCP_Server_Info *server = container_of(work,
 376                                         struct TCP_Server_Info, echo.work);
 377
 378         /*
 379          * We cannot send an echo if it is disabled.
 380          * Also, no need to ping if we got a response recently.
 381          */
 382
 383         if (server->tcpStatus == CifsNeedReconnect ||
 384             server->tcpStatus == CifsExiting ||
 385             server->tcpStatus == CifsNew ||
 386             (server->ops->can_echo && !server->ops->can_echo(server)) ||
 387             time_before(jiffies, server->lstrp + server->echo_interval - HZ))
 388                 goto requeue_echo;
 389
 390         rc = server->ops->echo ? server->ops->echo(server) : -ENOSYS;
 391         if (rc)
 392                 cifs_dbg(FYI, "Unable to send echo request to server: %s\n",
 393                          server->hostname);
 394
 395         /* Check witness registrations */
 396         cifs_swn_check();
 397
 398 requeue_echo:
 399         queue_delayed_work(cifsiod_wq, &server->echo, server->echo_interval);
 400 }
 401
 402 static bool
 403 allocate_buffers(struct TCP_Server_Info *server)
 404 {
 405         if (!server->bigbuf) {
 406                 server->bigbuf = (char *)cifs_buf_get();
 407                 if (!server->bigbuf) {
 408                         cifs_server_dbg(VFS, "No memory for large SMB response\n");
 409                         msleep(3000);
 410                         /* retry will check if exiting */
 411                         return false;
 412                 }
 413         } else if (server->large_buf) {
 414                 /* we are reusing a dirty large buf, clear its start */
 415                 memset(server->bigbuf, 0, HEADER_SIZE(server));
 416         }
 417
 418         if (!server->smallbuf) {
 419                 server->smallbuf = (char *)cifs_small_buf_get();
 420                 if (!server->smallbuf) {
 421                         cifs_server_dbg(VFS, "No memory for SMB response\n");
 422                         msleep(1000);
 423                         /* retry will check if exiting */
 424                         return false;
 425                 }
 426                 /* beginning of smb buffer is cleared in our buf_get */
 427         } else {
 428                 /* if existing small buf clear beginning */
 429                 memset(server->smallbuf, 0, HEADER_SIZE(server));
 430         }
 431
 432         return true;
 433 }
 434
 435 static bool
 436 server_unresponsive(struct TCP_Server_Info *server)
 437 {
 438         /*
 439          * We need to wait 3 echo intervals to make sure we handle such
 440          * situations right:
 441          * 1s  client sends a normal SMB request
 442          * 2s  client gets a response
 443          * 30s echo workqueue job pops, and decides we got a response recently
 444          *     and don't need to send another
 445          * ...
 446          * 65s kernel_recvmsg times out, and we see that we haven't gotten
 447          *     a response in >60s.
 448          */
 449         if ((server->tcpStatus == CifsGood ||
 450             server->tcpStatus == CifsNeedNegotiate) &&
 451             (!server->ops->can_echo || server->ops->can_echo(server)) &&
 452             time_after(jiffies, server->lstrp + 3 * server->echo_interval)) {
 453                 cifs_server_dbg(VFS, "has not responded in %lu seconds. Reconnecting...\n",
 454                          (3 * server->echo_interval) / HZ);
 455                 cifs_reconnect(server);
 456                 return true;
 457         }
 458
 459         return false;
 460 }
 461
 462 static inline bool
 463 zero_credits(struct TCP_Server_Info *server)
 464 {
 465         int val;
 466
 467         spin_lock(&server->req_lock);
 468         val = server->credits + server->echo_credits + server->oplock_credits;
 469         if (server->in_flight == 0 && val == 0) {
 470                 spin_unlock(&server->req_lock);
 471                 return true;
 472         }
 473         spin_unlock(&server->req_lock);
 474         return false;
 475 }
 476
 477 static int
 478 cifs_readv_from_socket(struct TCP_Server_Info *server, struct msghdr *smb_msg)
 479 {
 480         int length = 0;
 481         int total_read;
 482
 483         smb_msg->msg_control = NULL;
 484         smb_msg->msg_controllen = 0;
 485
 486         for (total_read = 0; msg_data_left(smb_msg); total_read += length) {
 487                 try_to_freeze();
 488
 489                 /* reconnect if no credits and no requests in flight */
 490                 if (zero_credits(server)) {
 491                         cifs_reconnect(server);
 492                         return -ECONNABORTED;
 493                 }
 494
 495                 if (server_unresponsive(server))
 496                         return -ECONNABORTED;
 497                 if (cifs_rdma_enabled(server) && server->smbd_conn)
 498                         length = smbd_recv(server->smbd_conn, smb_msg);
 499                 else
 500                         length = sock_recvmsg(server->ssocket, smb_msg, 0);
 501
 502                 if (server->tcpStatus == CifsExiting)
 503                         return -ESHUTDOWN;
 504
 505                 if (server->tcpStatus == CifsNeedReconnect) {
 506                         cifs_reconnect(server);
 507                         return -ECONNABORTED;
 508                 }
 509
 510                 if (length == -ERESTARTSYS ||
 511                     length == -EAGAIN ||
 512                     length == -EINTR) {
 513                         /*
 514                          * Minimum sleep to prevent looping, allowing socket
 515                          * to clear and app threads to set tcpStatus
 516                          * CifsNeedReconnect if server hung.
 517                          */
 518                         usleep_range(1000, 2000);
 519                         length = 0;
 520                         continue;
 521                 }
 522
 523                 if (length <= 0) {
 524                         cifs_dbg(FYI, "Received no data or error: %d\n", length);
 525                         cifs_reconnect(server);
 526                         return -ECONNABORTED;
 527                 }
 528         }
 529         return total_read;
 530 }
 531
 532 int
 533 cifs_read_from_socket(struct TCP_Server_Info *server, char *buf,
 534                       unsigned int to_read)
 535 {
 536         struct msghdr smb_msg;
 537         struct kvec iov = {.iov_base = buf, .iov_len = to_read};
 538         iov_iter_kvec(&smb_msg.msg_iter, READ, &iov, 1, to_read);
 539
 540         return cifs_readv_from_socket(server, &smb_msg);
 541 }
 542
 543 ssize_t
 544 cifs_discard_from_socket(struct TCP_Server_Info *server, size_t to_read)
 545 {
 546         struct msghdr smb_msg;
 547
 548         /*
 549          *  iov_iter_discard already sets smb_msg.type and count and iov_offset
 550          *  and cifs_readv_from_socket sets msg_control and msg_controllen
 551          *  so little to initialize in struct msghdr
 552          */
 553         smb_msg.msg_name = NULL;
 554         smb_msg.msg_namelen = 0;
 555         iov_iter_discard(&smb_msg.msg_iter, READ, to_read);
 556
 557         return cifs_readv_from_socket(server, &smb_msg);
 558 }
 559
 560 int
 561 cifs_read_page_from_socket(struct TCP_Server_Info *server, struct page *page,
 562         unsigned int page_offset, unsigned int to_read)
 563 {
 564         struct msghdr smb_msg;
 565         struct bio_vec bv = {
 566                 .bv_page = page, .bv_len = to_read, .bv_offset = page_offset};
 567         iov_iter_bvec(&smb_msg.msg_iter, READ, &bv, 1, to_read);
 568         return cifs_readv_from_socket(server, &smb_msg);
 569 }
 570
 571 static bool
 572 is_smb_response(struct TCP_Server_Info *server, unsigned char type)
 573 {
 574         /*
 575          * The first byte big endian of the length field,
 576          * is actually not part of the length but the type
 577          * with the most common, zero, as regular data.
 578          */
 579         switch (type) {
 580         case RFC1002_SESSION_MESSAGE:
 581                 /* Regular SMB response */
 582                 return true;
 583         case RFC1002_SESSION_KEEP_ALIVE:
 584                 cifs_dbg(FYI, "RFC 1002 session keep alive\n");
 585                 break;
 586         case RFC1002_POSITIVE_SESSION_RESPONSE:
 587                 cifs_dbg(FYI, "RFC 1002 positive session response\n");
 588                 break;
 589         case RFC1002_NEGATIVE_SESSION_RESPONSE:
 590                 /*
 591                  * We get this from Windows 98 instead of an error on
 592                  * SMB negprot response.
 593                  */
 594                 cifs_dbg(FYI, "RFC 1002 negative session response\n");
 595                 /* give server a second to clean up */
 596                 msleep(1000);
 597                 /*
 598                  * Always try 445 first on reconnect since we get NACK
 599                  * on some if we ever connected to port 139 (the NACK
 600                  * is since we do not begin with RFC1001 session
 601                  * initialize frame).
 602                  */
 603                 cifs_set_port((struct sockaddr *)&server->dstaddr, CIFS_PORT);
 604                 cifs_reconnect(server);
 605                 break;
 606         default:
 607                 cifs_server_dbg(VFS, "RFC 1002 unknown response type 0x%x\n", type);
 608                 cifs_reconnect(server);
 609         }
 610
 611         return false;
 612 }
 613
 614 void
 615 dequeue_mid(struct mid_q_entry *mid, bool malformed)
 616 {
 617 #ifdef CONFIG_CIFS_STATS2
 618         mid->when_received = jiffies;
 619 #endif
 620         spin_lock(&GlobalMid_Lock);
 621         if (!malformed)
 622                 mid->mid_state = MID_RESPONSE_RECEIVED;
 623         else
 624                 mid->mid_state = MID_RESPONSE_MALFORMED;
 625         /*
 626          * Trying to handle/dequeue a mid after the send_recv()
 627          * function has finished processing it is a bug.
 628          */
 629         if (mid->mid_flags & MID_DELETED)
 630                 pr_warn_once("trying to dequeue a deleted mid\n");
 631         else {
 632                 list_del_init(&mid->qhead);
 633                 mid->mid_flags |= MID_DELETED;
 634         }
 635         spin_unlock(&GlobalMid_Lock);
 636 }
 637
 638 static unsigned int
 639 smb2_get_credits_from_hdr(char *buffer, struct TCP_Server_Info *server)
 640 {
 641         struct smb2_sync_hdr *shdr = (struct smb2_sync_hdr *)buffer;
 642
 643         /*
 644          * SMB1 does not use credits.
 645          */
 646         if (server->vals->header_preamble_size)
 647                 return 0;
 648
 649         return le16_to_cpu(shdr->CreditRequest);
 650 }
 651
 652 static void
 653 handle_mid(struct mid_q_entry *mid, struct TCP_Server_Info *server,
 654            char *buf, int malformed)
 655 {
 656         if (server->ops->check_trans2 &&
 657             server->ops->check_trans2(mid, server, buf, malformed))
 658                 return;
 659         mid->credits_received = smb2_get_credits_from_hdr(buf, server);
 660         mid->resp_buf = buf;
 661         mid->large_buf = server->large_buf;
 662         /* Was previous buf put in mpx struct for multi-rsp? */
 663         if (!mid->multiRsp) {
 664                 /* smb buffer will be freed by user thread */
 665                 if (server->large_buf)
 666                         server->bigbuf = NULL;
 667                 else
 668                         server->smallbuf = NULL;
 669         }
 670         dequeue_mid(mid, malformed);
 671 }
 672
 673 static void clean_demultiplex_info(struct TCP_Server_Info *server)
 674 {
 675         int length;
 676
 677         /* take it off the list, if it's not already */
 678         spin_lock(&cifs_tcp_ses_lock);
 679         list_del_init(&server->tcp_ses_list);
 680         spin_unlock(&cifs_tcp_ses_lock);
 681
 682         cancel_delayed_work_sync(&server->echo);
 683
 684         spin_lock(&GlobalMid_Lock);
 685         server->tcpStatus = CifsExiting;
 686         spin_unlock(&GlobalMid_Lock);
 687         wake_up_all(&server->response_q);
 688
 689         /* check if we have blocked requests that need to free */
 690         spin_lock(&server->req_lock);
 691         if (server->credits <= 0)
 692                 server->credits = 1;
 693         spin_unlock(&server->req_lock);
 694         /*
 695          * Although there should not be any requests blocked on this queue it
 696          * can not hurt to be paranoid and try to wake up requests that may
 697          * haven been blocked when more than 50 at time were on the wire to the
 698          * same server - they now will see the session is in exit state and get
 699          * out of SendReceive.
 700          */
 701         wake_up_all(&server->request_q);
 702         /* give those requests time to exit */
 703         msleep(125);
 704         if (cifs_rdma_enabled(server))
 705                 smbd_destroy(server);
 706         if (server->ssocket) {
 707                 sock_release(server->ssocket);
 708                 server->ssocket = NULL;
 709         }
 710
 711         if (!list_empty(&server->pending_mid_q)) {
 712                 struct list_head dispose_list;
 713                 struct mid_q_entry *mid_entry;
 714                 struct list_head *tmp, *tmp2;
 715
 716                 INIT_LIST_HEAD(&dispose_list);
 717                 spin_lock(&GlobalMid_Lock);
 718                 list_for_each_safe(tmp, tmp2, &server->pending_mid_q) {
 719                         mid_entry = list_entry(tmp, struct mid_q_entry, qhead);
 720                         cifs_dbg(FYI, "Clearing mid %llu\n", mid_entry->mid);
 721                         kref_get(&mid_entry->refcount);
 722                         mid_entry->mid_state = MID_SHUTDOWN;
 723                         list_move(&mid_entry->qhead, &dispose_list);
 724                         mid_entry->mid_flags |= MID_DELETED;
 725                 }
 726                 spin_unlock(&GlobalMid_Lock);
 727
 728                 /* now walk dispose list and issue callbacks */
 729                 list_for_each_safe(tmp, tmp2, &dispose_list) {
 730                         mid_entry = list_entry(tmp, struct mid_q_entry, qhead);
 731                         cifs_dbg(FYI, "Callback mid %llu\n", mid_entry->mid);
 732                         list_del_init(&mid_entry->qhead);
 733                         mid_entry->callback(mid_entry);
 734                         cifs_mid_q_entry_release(mid_entry);
 735                 }
 736                 /* 1/8th of sec is more than enough time for them to exit */
 737                 msleep(125);
 738         }
 739
 740         if (!list_empty(&server->pending_mid_q)) {
 741                 /*
 742                  * mpx threads have not exited yet give them at least the smb
 743                  * send timeout time for long ops.
 744                  *
 745                  * Due to delays on oplock break requests, we need to wait at
 746                  * least 45 seconds before giving up on a request getting a
 747                  * response and going ahead and killing cifsd.
 748                  */
 749                 cifs_dbg(FYI, "Wait for exit from demultiplex thread\n");
 750                 msleep(46000);
 751                 /*
 752                  * If threads still have not exited they are probably never
 753                  * coming home not much else we can do but free the memory.
 754                  */
 755         }
 756
 757         kfree(server->hostname);
 758         kfree(server);
 759
 760         length = atomic_dec_return(&tcpSesAllocCount);
 761         if (length > 0)
 762                 mempool_resize(cifs_req_poolp, length + cifs_min_rcv);
 763 }
 764
 765 static int
 766 standard_receive3(struct TCP_Server_Info *server, struct mid_q_entry *mid)
 767 {
 768         int length;
 769         char *buf = server->smallbuf;
 770         unsigned int pdu_length = server->pdu_size;
 771
 772         /* make sure this will fit in a large buffer */
 773         if (pdu_length > CIFSMaxBufSize + MAX_HEADER_SIZE(server) -
 774                 server->vals->header_preamble_size) {
 775                 cifs_server_dbg(VFS, "SMB response too long (%u bytes)\n", pdu_length);
 776                 cifs_reconnect(server);
 777                 return -ECONNABORTED;
 778         }
 779
 780         /* switch to large buffer if too big for a small one */
 781         if (pdu_length > MAX_CIFS_SMALL_BUFFER_SIZE - 4) {
 782                 server->large_buf = true;
 783                 memcpy(server->bigbuf, buf, server->total_read);
 784                 buf = server->bigbuf;
 785         }
 786
 787         /* now read the rest */
 788         length = cifs_read_from_socket(server, buf + HEADER_SIZE(server) - 1,
 789                                        pdu_length - HEADER_SIZE(server) + 1
 790                                        + server->vals->header_preamble_size);
 791
 792         if (length < 0)
 793                 return length;
 794         server->total_read += length;
 795
 796         dump_smb(buf, server->total_read);
 797
 798         return cifs_handle_standard(server, mid);
 799 }
 800
 801 int
 802 cifs_handle_standard(struct TCP_Server_Info *server, struct mid_q_entry *mid)
 803 {
 804         char *buf = server->large_buf ? server->bigbuf : server->smallbuf;
 805         int length;
 806
 807         /*
 808          * We know that we received enough to get to the MID as we
 809          * checked the pdu_length earlier. Now check to see
 810          * if the rest of the header is OK. We borrow the length
 811          * var for the rest of the loop to avoid a new stack var.
 812          *
 813          * 48 bytes is enough to display the header and a little bit
 814          * into the payload for debugging purposes.
 815          */
 816         length = server->ops->check_message(buf, server->total_read, server);
 817         if (length != 0)
 818                 cifs_dump_mem("Bad SMB: ", buf,
 819                         min_t(unsigned int, server->total_read, 48));
 820
 821         if (server->ops->is_session_expired &&
 822             server->ops->is_session_expired(buf)) {
 823                 cifs_reconnect(server);
 824                 return -1;
 825         }
 826
 827         if (server->ops->is_status_pending &&
 828             server->ops->is_status_pending(buf, server))
 829                 return -1;
 830
 831         if (!mid)
 832                 return length;
 833
 834         handle_mid(mid, server, buf, length);
 835         return 0;
 836 }
 837
 838 static void
 839 smb2_add_credits_from_hdr(char *buffer, struct TCP_Server_Info *server)
 840 {
 841         struct smb2_sync_hdr *shdr = (struct smb2_sync_hdr *)buffer;
 842         int scredits, in_flight;
 843
 844         /*
 845          * SMB1 does not use credits.
 846          */
 847         if (server->vals->header_preamble_size)
 848                 return;
 849
 850         if (shdr->CreditRequest) {
 851                 spin_lock(&server->req_lock);
 852                 server->credits += le16_to_cpu(shdr->CreditRequest);
 853                 scredits = server->credits;
 854                 in_flight = server->in_flight;
 855                 spin_unlock(&server->req_lock);
 856                 wake_up(&server->request_q);
 857
 858                 trace_smb3_add_credits(server->CurrentMid,
 859                                 server->conn_id, server->hostname, scredits,
 860                                 le16_to_cpu(shdr->CreditRequest), in_flight);
 861                 cifs_server_dbg(FYI, "%s: added %u credits total=%d\n",
 862                                 __func__, le16_to_cpu(shdr->CreditRequest),
 863                                 scredits);
 864         }
 865 }
 866
 867
 868 static int
 869 cifs_demultiplex_thread(void *p)
 870 {
 871         int i, num_mids, length;
 872         struct TCP_Server_Info *server = p;
 873         unsigned int pdu_length;
 874         unsigned int next_offset;
 875         char *buf = NULL;
 876         struct task_struct *task_to_wake = NULL;
 877         struct mid_q_entry *mids[MAX_COMPOUND];
 878         char *bufs[MAX_COMPOUND];
 879         unsigned int noreclaim_flag, num_io_timeout = 0;
 880
 881         noreclaim_flag = memalloc_noreclaim_save();
 882         cifs_dbg(FYI, "Demultiplex PID: %d\n", task_pid_nr(current));
 883
 884         length = atomic_inc_return(&tcpSesAllocCount);
 885         if (length > 1)
 886                 mempool_resize(cifs_req_poolp, length + cifs_min_rcv);
 887
 888         set_freezable();
 889         allow_kernel_signal(SIGKILL);
 890         while (server->tcpStatus != CifsExiting) {
 891                 if (try_to_freeze())
 892                         continue;
 893
 894                 if (!allocate_buffers(server))
 895                         continue;
 896
 897                 server->large_buf = false;
 898                 buf = server->smallbuf;
 899                 pdu_length = 4; /* enough to get RFC1001 header */
 900
 901                 length = cifs_read_from_socket(server, buf, pdu_length);
 902                 if (length < 0)
 903                         continue;
 904
 905                 if (server->vals->header_preamble_size == 0)
 906                         server->total_read = 0;
 907                 else
 908                         server->total_read = length;
 909
 910                 /*
 911                  * The right amount was read from socket - 4 bytes,
 912                  * so we can now interpret the length field.
 913                  */
 914                 pdu_length = get_rfc1002_length(buf);
 915
 916                 cifs_dbg(FYI, "RFC1002 header 0x%x\n", pdu_length);
 917                 if (!is_smb_response(server, buf[0]))
 918                         continue;
 919 next_pdu:
 920                 server->pdu_size = pdu_length;
 921
 922                 /* make sure we have enough to get to the MID */
 923                 if (server->pdu_size < HEADER_SIZE(server) - 1 -
 924                     server->vals->header_preamble_size) {
 925                         cifs_server_dbg(VFS, "SMB response too short (%u bytes)\n",
 926                                  server->pdu_size);
 927                         cifs_reconnect(server);
 928                         continue;
 929                 }
 930
 931                 /* read down to the MID */
 932                 length = cifs_read_from_socket(server,
 933                              buf + server->vals->header_preamble_size,
 934                              HEADER_SIZE(server) - 1
 935                              - server->vals->header_preamble_size);
 936                 if (length < 0)
 937                         continue;
 938                 server->total_read += length;
 939
 940                 if (server->ops->next_header) {
 941                         next_offset = server->ops->next_header(buf);
 942                         if (next_offset)
 943                                 server->pdu_size = next_offset;
 944                 }
 945
 946                 memset(mids, 0, sizeof(mids));
 947                 memset(bufs, 0, sizeof(bufs));
 948                 num_mids = 0;
 949
 950                 if (server->ops->is_transform_hdr &&
 951                     server->ops->receive_transform &&
 952                     server->ops->is_transform_hdr(buf)) {
 953                         length = server->ops->receive_transform(server,
 954                                                                 mids,
 955                                                                 bufs,
 956                                                                 &num_mids);
 957                 } else {
 958                         mids[0] = server->ops->find_mid(server, buf);
 959                         bufs[0] = buf;
 960                         num_mids = 1;
 961
 962                         if (!mids[0] || !mids[0]->receive)
 963                                 length = standard_receive3(server, mids[0]);
 964                         else
 965                                 length = mids[0]->receive(server, mids[0]);
 966                 }
 967
 968                 if (length < 0) {
 969                         for (i = 0; i < num_mids; i++)
 970                                 if (mids[i])
 971                                         cifs_mid_q_entry_release(mids[i]);
 972                         continue;
 973                 }
 974
 975                 if (server->ops->is_status_io_timeout &&
 976                     server->ops->is_status_io_timeout(buf)) {
 977                         num_io_timeout++;
 978                         if (num_io_timeout > NUM_STATUS_IO_TIMEOUT) {
 979                                 cifs_reconnect(server);
 980                                 num_io_timeout = 0;
 981                                 continue;
 982                         }
 983                 }
 984
 985                 server->lstrp = jiffies;
 986
 987                 for (i = 0; i < num_mids; i++) {
 988                         if (mids[i] != NULL) {
 989                                 mids[i]->resp_buf_size = server->pdu_size;
 990
 991                                 if (bufs[i] && server->ops->is_network_name_deleted)
 992                                         server->ops->is_network_name_deleted(bufs[i],
 993                                                                         server);
 994
 995                                 if (!mids[i]->multiRsp || mids[i]->multiEnd)
 996                                         mids[i]->callback(mids[i]);
 997
 998                                 cifs_mid_q_entry_release(mids[i]);
 999                         } else if (server->ops->is_oplock_break &&
1000                                    server->ops->is_oplock_break(bufs[i],
1001                                                                 server)) {
1002                                 smb2_add_credits_from_hdr(bufs[i], server);
1003                                 cifs_dbg(FYI, "Received oplock break\n");
1004                         } else {
1005                                 cifs_server_dbg(VFS, "No task to wake, unknown frame received! NumMids %d\n",
1006                                                 atomic_read(&midCount));
1007                                 cifs_dump_mem("Received Data is: ", bufs[i],
1008                                               HEADER_SIZE(server));
1009                                 smb2_add_credits_from_hdr(bufs[i], server);
1010 #ifdef CONFIG_CIFS_DEBUG2
1011                                 if (server->ops->dump_detail)
1012                                         server->ops->dump_detail(bufs[i],
1013                                                                  server);
1014                                 cifs_dump_mids(server);
1015 #endif /* CIFS_DEBUG2 */
1016                         }
1017                 }
1018
1019                 if (pdu_length > server->pdu_size) {
1020                         if (!allocate_buffers(server))
1021                                 continue;
1022                         pdu_length -= server->pdu_size;
1023                         server->total_read = 0;
1024                         server->large_buf = false;
1025                         buf = server->smallbuf;
1026                         goto next_pdu;
1027                 }
1028         } /* end while !EXITING */
1029
1030         /* buffer usually freed in free_mid - need to free it here on exit */
1031         cifs_buf_release(server->bigbuf);
1032         if (server->smallbuf) /* no sense logging a debug message if NULL */
1033                 cifs_small_buf_release(server->smallbuf);
1034
1035         task_to_wake = xchg(&server->tsk, NULL);
1036         clean_demultiplex_info(server);
1037
1038         /* if server->tsk was NULL then wait for a signal before exiting */
1039         if (!task_to_wake) {
1040                 set_current_state(TASK_INTERRUPTIBLE);
1041                 while (!signal_pending(current)) {
1042                         schedule();
1043                         set_current_state(TASK_INTERRUPTIBLE);
1044                 }
1045                 set_current_state(TASK_RUNNING);
1046         }
1047
1048         memalloc_noreclaim_restore(noreclaim_flag);
1049         module_put_and_exit(0);
1050 }
1051
1052 /**
1053  * Returns true if srcaddr isn't specified and rhs isn't specified, or
1054  * if srcaddr is specified and matches the IP address of the rhs argument
1055  */
1056 bool
1057 cifs_match_ipaddr(struct sockaddr *srcaddr, struct sockaddr *rhs)
1058 {
1059         switch (srcaddr->sa_family) {
1060         case AF_UNSPEC:
1061                 return (rhs->sa_family == AF_UNSPEC);
1062         case AF_INET: {
1063                 struct sockaddr_in *saddr4 = (struct sockaddr_in *)srcaddr;
1064                 struct sockaddr_in *vaddr4 = (struct sockaddr_in *)rhs;
1065                 return (saddr4->sin_addr.s_addr == vaddr4->sin_addr.s_addr);
1066         }
1067         case AF_INET6: {
1068                 struct sockaddr_in6 *saddr6 = (struct sockaddr_in6 *)srcaddr;
1069                 struct sockaddr_in6 *vaddr6 = (struct sockaddr_in6 *)rhs;
1070                 return ipv6_addr_equal(&saddr6->sin6_addr, &vaddr6->sin6_addr);
1071         }
1072         default:
1073                 WARN_ON(1);
1074                 return false; /* don't expect to be here */
1075         }
1076 }
1077
1078 /*
1079  * If no port is specified in addr structure, we try to match with 445 port
1080  * and if it fails - with 139 ports. It should be called only if address
1081  * families of server and addr are equal.
1082  */
1083 static bool
1084 match_port(struct TCP_Server_Info *server, struct sockaddr *addr)
1085 {
1086         __be16 port, *sport;
1087
1088         /* SMBDirect manages its own ports, don't match it here */
1089         if (server->rdma)
1090                 return true;
1091
1092         switch (addr->sa_family) {
1093         case AF_INET:
1094                 sport = &((struct sockaddr_in *) &server->dstaddr)->sin_port;
1095                 port = ((struct sockaddr_in *) addr)->sin_port;
1096                 break;
1097         case AF_INET6:
1098                 sport = &((struct sockaddr_in6 *) &server->dstaddr)->sin6_port;
1099                 port = ((struct sockaddr_in6 *) addr)->sin6_port;
1100                 break;
1101         default:
1102                 WARN_ON(1);
1103                 return false;
1104         }
1105
1106         if (!port) {
1107                 port = htons(CIFS_PORT);
1108                 if (port == *sport)
1109                         return true;
1110
1111                 port = htons(RFC1001_PORT);
1112         }
1113
1114         return port == *sport;
1115 }
1116
1117 static bool
1118 match_address(struct TCP_Server_Info *server, struct sockaddr *addr,
1119               struct sockaddr *srcaddr)
1120 {
1121         switch (addr->sa_family) {
1122         case AF_INET: {
1123                 struct sockaddr_in *addr4 = (struct sockaddr_in *)addr;
1124                 struct sockaddr_in *srv_addr4 =
1125                                         (struct sockaddr_in *)&server->dstaddr;
1126
1127                 if (addr4->sin_addr.s_addr != srv_addr4->sin_addr.s_addr)
1128                         return false;
1129                 break;
1130         }
1131         case AF_INET6: {
1132                 struct sockaddr_in6 *addr6 = (struct sockaddr_in6 *)addr;
1133                 struct sockaddr_in6 *srv_addr6 =
1134                                         (struct sockaddr_in6 *)&server->dstaddr;
1135
1136                 if (!ipv6_addr_equal(&addr6->sin6_addr,
1137                                      &srv_addr6->sin6_addr))
1138                         return false;
1139                 if (addr6->sin6_scope_id != srv_addr6->sin6_scope_id)
1140                         return false;
1141                 break;
1142         }
1143         default:
1144                 WARN_ON(1);
1145                 return false; /* don't expect to be here */
1146         }
1147
1148         if (!cifs_match_ipaddr(srcaddr, (struct sockaddr *)&server->srcaddr))
1149                 return false;
1150
1151         return true;
1152 }
1153
1154 static bool
1155 match_security(struct TCP_Server_Info *server, struct smb3_fs_context *ctx)
1156 {
1157         /*
1158          * The select_sectype function should either return the ctx->sectype
1159          * that was specified, or "Unspecified" if that sectype was not
1160          * compatible with the given NEGOTIATE request.
1161          */
1162         if (server->ops->select_sectype(server, ctx->sectype)
1163              == Unspecified)
1164                 return false;
1165
1166         /*
1167          * Now check if signing mode is acceptable. No need to check
1168          * global_secflags at this point since if MUST_SIGN is set then
1169          * the server->sign had better be too.
1170          */
1171         if (ctx->sign && !server->sign)
1172                 return false;
1173
1174         return true;
1175 }
1176
1177 static int match_server(struct TCP_Server_Info *server, struct smb3_fs_context *ctx)
1178 {
1179         struct sockaddr *addr = (struct sockaddr *)&ctx->dstaddr;
1180
1181         if (ctx->nosharesock)
1182                 return 0;
1183
1184         /* If multidialect negotiation see if existing sessions match one */
1185         if (strcmp(ctx->vals->version_string, SMB3ANY_VERSION_STRING) == 0) {
1186                 if (server->vals->protocol_id < SMB30_PROT_ID)
1187                         return 0;
1188         } else if (strcmp(ctx->vals->version_string,
1189                    SMBDEFAULT_VERSION_STRING) == 0) {
1190                 if (server->vals->protocol_id < SMB21_PROT_ID)
1191                         return 0;
1192         } else if ((server->vals != ctx->vals) || (server->ops != ctx->ops))
1193                 return 0;
1194
1195         if (!net_eq(cifs_net_ns(server), current->nsproxy->net_ns))
1196                 return 0;
1197
1198         if (!match_address(server, addr,
1199                            (struct sockaddr *)&ctx->srcaddr))
1200                 return 0;
1201
1202         if (!match_port(server, addr))
1203                 return 0;
1204
1205         if (!match_security(server, ctx))
1206                 return 0;
1207
1208         if (server->echo_interval != ctx->echo_interval * HZ)
1209                 return 0;
1210
1211         if (server->rdma != ctx->rdma)
1212                 return 0;
1213
1214         if (server->ignore_signature != ctx->ignore_signature)
1215                 return 0;
1216
1217         if (server->min_offload != ctx->min_offload)
1218                 return 0;
1219
1220         return 1;
1221 }
1222
1223 struct TCP_Server_Info *
1224 cifs_find_tcp_session(struct smb3_fs_context *ctx)
1225 {
1226         struct TCP_Server_Info *server;
1227
1228         spin_lock(&cifs_tcp_ses_lock);
1229         list_for_each_entry(server, &cifs_tcp_ses_list, tcp_ses_list) {
1230                 /*
1231                  * Skip ses channels since they're only handled in lower layers
1232                  * (e.g. cifs_send_recv).
1233                  */
1234                 if (server->is_channel || !match_server(server, ctx))
1235                         continue;
1236
1237                 ++server->srv_count;
1238                 spin_unlock(&cifs_tcp_ses_lock);
1239                 cifs_dbg(FYI, "Existing tcp session with server found\n");
1240                 return server;
1241         }
1242         spin_unlock(&cifs_tcp_ses_lock);
1243         return NULL;
1244 }
1245
1246 void
1247 cifs_put_tcp_session(struct TCP_Server_Info *server, int from_reconnect)
1248 {
1249         struct task_struct *task;
1250
1251         spin_lock(&cifs_tcp_ses_lock);
1252         if (--server->srv_count > 0) {
1253                 spin_unlock(&cifs_tcp_ses_lock);
1254                 return;
1255         }
1256
1257         put_net(cifs_net_ns(server));
1258
1259         list_del_init(&server->tcp_ses_list);
1260         spin_unlock(&cifs_tcp_ses_lock);
1261
1262         cancel_delayed_work_sync(&server->echo);
1263
1264         if (from_reconnect)
1265                 /*
1266                  * Avoid deadlock here: reconnect work calls
1267                  * cifs_put_tcp_session() at its end. Need to be sure
1268                  * that reconnect work does nothing with server pointer after
1269                  * that step.
1270                  */
1271                 cancel_delayed_work(&server->reconnect);
1272         else
1273                 cancel_delayed_work_sync(&server->reconnect);
1274
1275         spin_lock(&GlobalMid_Lock);
1276         server->tcpStatus = CifsExiting;
1277         spin_unlock(&GlobalMid_Lock);
1278
1279         cifs_crypto_secmech_release(server);
1280         cifs_fscache_release_client_cookie(server);
1281
1282         kfree(server->session_key.response);
1283         server->session_key.response = NULL;
1284         server->session_key.len = 0;
1285
1286         task = xchg(&server->tsk, NULL);
1287         if (task)
1288                 send_sig(SIGKILL, task, 1);
1289 }
1290
1291 struct TCP_Server_Info *
1292 cifs_get_tcp_session(struct smb3_fs_context *ctx)
1293 {
1294         struct TCP_Server_Info *tcp_ses = NULL;
1295         int rc;
1296
1297         cifs_dbg(FYI, "UNC: %s\n", ctx->UNC);
1298
1299         /* see if we already have a matching tcp_ses */
1300         tcp_ses = cifs_find_tcp_session(ctx);
1301         if (tcp_ses)
1302                 return tcp_ses;
1303
1304         tcp_ses = kzalloc(sizeof(struct TCP_Server_Info), GFP_KERNEL);
1305         if (!tcp_ses) {
1306                 rc = -ENOMEM;
1307                 goto out_err;
1308         }
1309
1310         tcp_ses->ops = ctx->ops;
1311         tcp_ses->vals = ctx->vals;
1312         cifs_set_net_ns(tcp_ses, get_net(current->nsproxy->net_ns));
1313         tcp_ses->hostname = extract_hostname(ctx->UNC);
1314         if (IS_ERR(tcp_ses->hostname)) {
1315                 rc = PTR_ERR(tcp_ses->hostname);
1316                 goto out_err_crypto_release;
1317         }
1318
1319         tcp_ses->conn_id = atomic_inc_return(&tcpSesNextId);
1320         tcp_ses->noblockcnt = ctx->rootfs;
1321         tcp_ses->noblocksnd = ctx->noblocksnd || ctx->rootfs;
1322         tcp_ses->noautotune = ctx->noautotune;
1323         tcp_ses->tcp_nodelay = ctx->sockopt_tcp_nodelay;
1324         tcp_ses->rdma = ctx->rdma;
1325         tcp_ses->in_flight = 0;
1326         tcp_ses->max_in_flight = 0;
1327         tcp_ses->credits = 1;
1328         init_waitqueue_head(&tcp_ses->response_q);
1329         init_waitqueue_head(&tcp_ses->request_q);
1330         INIT_LIST_HEAD(&tcp_ses->pending_mid_q);
1331         mutex_init(&tcp_ses->srv_mutex);
1332         memcpy(tcp_ses->workstation_RFC1001_name,
1333                 ctx->source_rfc1001_name, RFC1001_NAME_LEN_WITH_NULL);
1334         memcpy(tcp_ses->server_RFC1001_name,
1335                 ctx->target_rfc1001_name, RFC1001_NAME_LEN_WITH_NULL);
1336         tcp_ses->session_estab = false;
1337         tcp_ses->sequence_number = 0;
1338         tcp_ses->reconnect_instance = 1;
1339         tcp_ses->lstrp = jiffies;
1340         tcp_ses->compress_algorithm = cpu_to_le16(ctx->compression);
1341         spin_lock_init(&tcp_ses->req_lock);
1342         INIT_LIST_HEAD(&tcp_ses->tcp_ses_list);
1343         INIT_LIST_HEAD(&tcp_ses->smb_ses_list);
1344         INIT_DELAYED_WORK(&tcp_ses->echo, cifs_echo_request);
1345         INIT_DELAYED_WORK(&tcp_ses->reconnect, smb2_reconnect_server);
1346         mutex_init(&tcp_ses->reconnect_mutex);
1347         memcpy(&tcp_ses->srcaddr, &ctx->srcaddr,
1348                sizeof(tcp_ses->srcaddr));
1349         memcpy(&tcp_ses->dstaddr, &ctx->dstaddr,
1350                 sizeof(tcp_ses->dstaddr));
1351         if (ctx->use_client_guid)
1352                 memcpy(tcp_ses->client_guid, ctx->client_guid,
1353                        SMB2_CLIENT_GUID_SIZE);
1354         else
1355                 generate_random_uuid(tcp_ses->client_guid);
1356         /*
1357          * at this point we are the only ones with the pointer
1358          * to the struct since the kernel thread not created yet
1359          * no need to spinlock this init of tcpStatus or srv_count
1360          */
1361         tcp_ses->tcpStatus = CifsNew;
1362         ++tcp_ses->srv_count;
1363
1364         if (ctx->echo_interval >= SMB_ECHO_INTERVAL_MIN &&
1365                 ctx->echo_interval <= SMB_ECHO_INTERVAL_MAX)
1366                 tcp_ses->echo_interval = ctx->echo_interval * HZ;
1367         else
1368                 tcp_ses->echo_interval = SMB_ECHO_INTERVAL_DEFAULT * HZ;
1369         if (tcp_ses->rdma) {
1370 #ifndef CONFIG_CIFS_SMB_DIRECT
1371                 cifs_dbg(VFS, "CONFIG_CIFS_SMB_DIRECT is not enabled\n");
1372                 rc = -ENOENT;
1373                 goto out_err_crypto_release;
1374 #endif
1375                 tcp_ses->smbd_conn = smbd_get_connection(
1376                         tcp_ses, (struct sockaddr *)&ctx->dstaddr);
1377                 if (tcp_ses->smbd_conn) {
1378                         cifs_dbg(VFS, "RDMA transport established\n");
1379                         rc = 0;
1380                         goto smbd_connected;
1381                 } else {
1382                         rc = -ENOENT;
1383                         goto out_err_crypto_release;
1384                 }
1385         }
1386         rc = ip_connect(tcp_ses);
1387         if (rc < 0) {
1388                 cifs_dbg(VFS, "Error connecting to socket. Aborting operation.\n");
1389                 goto out_err_crypto_release;
1390         }
1391 smbd_connected:
1392         /*
1393          * since we're in a cifs function already, we know that
1394          * this will succeed. No need for try_module_get().
1395          */
1396         __module_get(THIS_MODULE);
1397         tcp_ses->tsk = kthread_run(cifs_demultiplex_thread,
1398                                   tcp_ses, "cifsd");
1399         if (IS_ERR(tcp_ses->tsk)) {
1400                 rc = PTR_ERR(tcp_ses->tsk);
1401                 cifs_dbg(VFS, "error %d create cifsd thread\n", rc);
1402                 module_put(THIS_MODULE);
1403                 goto out_err_crypto_release;
1404         }
1405         tcp_ses->min_offload = ctx->min_offload;
1406         /*
1407          * at this point we are the only ones with the pointer
1408          * to the struct since the kernel thread not created yet
1409          * no need to spinlock this update of tcpStatus
1410          */
1411         tcp_ses->tcpStatus = CifsNeedNegotiate;
1412
1413         if ((ctx->max_credits < 20) || (ctx->max_credits > 60000))
1414                 tcp_ses->max_credits = SMB2_MAX_CREDITS_AVAILABLE;
1415         else
1416                 tcp_ses->max_credits = ctx->max_credits;
1417
1418         tcp_ses->nr_targets = 1;
1419         tcp_ses->ignore_signature = ctx->ignore_signature;
1420         /* thread spawned, put it on the list */
1421         spin_lock(&cifs_tcp_ses_lock);
1422         list_add(&tcp_ses->tcp_ses_list, &cifs_tcp_ses_list);
1423         spin_unlock(&cifs_tcp_ses_lock);
1424
1425         cifs_fscache_get_client_cookie(tcp_ses);
1426
1427         /* queue echo request delayed work */
1428         queue_delayed_work(cifsiod_wq, &tcp_ses->echo, tcp_ses->echo_interval);
1429
1430         return tcp_ses;
1431
1432 out_err_crypto_release:
1433         cifs_crypto_secmech_release(tcp_ses);
1434
1435         put_net(cifs_net_ns(tcp_ses));
1436
1437 out_err:
1438         if (tcp_ses) {
1439                 if (!IS_ERR(tcp_ses->hostname))
1440                         kfree(tcp_ses->hostname);
1441                 if (tcp_ses->ssocket)
1442                         sock_release(tcp_ses->ssocket);
1443                 kfree(tcp_ses);
1444         }
1445         return ERR_PTR(rc);
1446 }
1447
1448 static int match_session(struct cifs_ses *ses, struct smb3_fs_context *ctx)
1449 {
1450         if (ctx->sectype != Unspecified &&
1451             ctx->sectype != ses->sectype)
1452                 return 0;
1453
1454         /*
1455          * If an existing session is limited to less channels than
1456          * requested, it should not be reused
1457          */
1458         if (ses->chan_max < ctx->max_channels)
1459                 return 0;
1460
1461         switch (ses->sectype) {
1462         case Kerberos:
1463                 if (!uid_eq(ctx->cred_uid, ses->cred_uid))
1464                         return 0;
1465                 break;
1466         default:
1467                 /* NULL username means anonymous session */
1468                 if (ses->user_name == NULL) {
1469                         if (!ctx->nullauth)
1470                                 return 0;
1471                         break;
1472                 }
1473
1474                 /* anything else takes username/password */
1475                 if (strncmp(ses->user_name,
1476                             ctx->username ? ctx->username : "",
1477                             CIFS_MAX_USERNAME_LEN))
1478                         return 0;
1479                 if ((ctx->username && strlen(ctx->username) != 0) &&
1480                     ses->password != NULL &&
1481                     strncmp(ses->password,
1482                             ctx->password ? ctx->password : "",
1483                             CIFS_MAX_PASSWORD_LEN))
1484                         return 0;
1485         }
1486         return 1;
1487 }
1488
1489 /**
1490  * cifs_setup_ipc - helper to setup the IPC tcon for the session
1491  *
1492  * A new IPC connection is made and stored in the session
1493  * tcon_ipc. The IPC tcon has the same lifetime as the session.
1494  */
1495 static int
1496 cifs_setup_ipc(struct cifs_ses *ses, struct smb3_fs_context *ctx)
1497 {
1498         int rc = 0, xid;
1499         struct cifs_tcon *tcon;
1500         char unc[SERVER_NAME_LENGTH + sizeof("//x/IPC$")] = {0};
1501         bool seal = false;
1502         struct TCP_Server_Info *server = ses->server;
1503
1504         /*
1505          * If the mount request that resulted in the creation of the
1506          * session requires encryption, force IPC to be encrypted too.
1507          */
1508         if (ctx->seal) {
1509                 if (server->capabilities & SMB2_GLOBAL_CAP_ENCRYPTION)
1510                         seal = true;
1511                 else {
1512                         cifs_server_dbg(VFS,
1513                                  "IPC: server doesn't support encryption\n");
1514                         return -EOPNOTSUPP;
1515                 }
1516         }
1517
1518         tcon = tconInfoAlloc();
1519         if (tcon == NULL)
1520                 return -ENOMEM;
1521
1522         scnprintf(unc, sizeof(unc), "\\\\%s\\IPC$", server->hostname);
1523
1524         xid = get_xid();
1525         tcon->ses = ses;
1526         tcon->ipc = true;
1527         tcon->seal = seal;
1528         rc = server->ops->tree_connect(xid, ses, unc, tcon, ctx->local_nls);
1529         free_xid(xid);
1530
1531         if (rc) {
1532                 cifs_server_dbg(VFS, "failed to connect to IPC (rc=%d)\n", rc);
1533                 tconInfoFree(tcon);
1534                 goto out;
1535         }
1536
1537         cifs_dbg(FYI, "IPC tcon rc = %d ipc tid = %d\n", rc, tcon->tid);
1538
1539         ses->tcon_ipc = tcon;
1540 out:
1541         return rc;
1542 }
1543
1544 /**
1545  * cifs_free_ipc - helper to release the session IPC tcon
1546  *
1547  * Needs to be called everytime a session is destroyed.
1548  *
1549  * On session close, the IPC is closed and the server must release all tcons of the session.
1550  * No need to send a tree disconnect here.
1551  *
1552  * Besides, it will make the server to not close durable and resilient files on session close, as
1553  * specified in MS-SMB2 3.3.5.6 Receiving an SMB2 LOGOFF Request.
1554  */
1555 static int
1556 cifs_free_ipc(struct cifs_ses *ses)
1557 {
1558         struct cifs_tcon *tcon = ses->tcon_ipc;
1559
1560         if (tcon == NULL)
1561                 return 0;
1562
1563         tconInfoFree(tcon);
1564         ses->tcon_ipc = NULL;
1565         return 0;
1566 }
1567
1568 static struct cifs_ses *
1569 cifs_find_smb_ses(struct TCP_Server_Info *server, struct smb3_fs_context *ctx)
1570 {
1571         struct cifs_ses *ses;
1572
1573         spin_lock(&cifs_tcp_ses_lock);
1574         list_for_each_entry(ses, &server->smb_ses_list, smb_ses_list) {
1575                 if (ses->status == CifsExiting)
1576                         continue;
1577                 if (!match_session(ses, ctx))
1578                         continue;
1579                 ++ses->ses_count;
1580                 spin_unlock(&cifs_tcp_ses_lock);
1581                 return ses;
1582         }
1583         spin_unlock(&cifs_tcp_ses_lock);
1584         return NULL;
1585 }
1586
1587 void cifs_put_smb_ses(struct cifs_ses *ses)
1588 {
1589         unsigned int rc, xid;
1590         struct TCP_Server_Info *server = ses->server;
1591         cifs_dbg(FYI, "%s: ses_count=%d\n", __func__, ses->ses_count);
1592
1593         spin_lock(&cifs_tcp_ses_lock);
1594         if (ses->status == CifsExiting) {
1595                 spin_unlock(&cifs_tcp_ses_lock);
1596                 return;
1597         }
1598
1599         cifs_dbg(FYI, "%s: ses_count=%d\n", __func__, ses->ses_count);
1600         cifs_dbg(FYI, "%s: ses ipc: %s\n", __func__, ses->tcon_ipc ? ses->tcon_ipc->treeName : "NONE");
1601
1602         if (--ses->ses_count > 0) {
1603                 spin_unlock(&cifs_tcp_ses_lock);
1604                 return;
1605         }
1606         spin_unlock(&cifs_tcp_ses_lock);
1607
1608         spin_lock(&GlobalMid_Lock);
1609         if (ses->status == CifsGood)
1610                 ses->status = CifsExiting;
1611         spin_unlock(&GlobalMid_Lock);
1612
1613         cifs_free_ipc(ses);
1614
1615         if (ses->status == CifsExiting && server->ops->logoff) {
1616                 xid = get_xid();
1617                 rc = server->ops->logoff(xid, ses);
1618                 if (rc)
1619                         cifs_server_dbg(VFS, "%s: Session Logoff failure rc=%d\n",
1620                                 __func__, rc);
1621                 _free_xid(xid);
1622         }
1623
1624         spin_lock(&cifs_tcp_ses_lock);
1625         list_del_init(&ses->smb_ses_list);
1626         spin_unlock(&cifs_tcp_ses_lock);
1627
1628         /* close any extra channels */
1629         if (ses->chan_count > 1) {
1630                 int i;
1631
1632                 for (i = 1; i < ses->chan_count; i++)
1633                         cifs_put_tcp_session(ses->chans[i].server, 0);
1634         }
1635
1636         sesInfoFree(ses);
1637         cifs_put_tcp_session(server, 0);
1638 }
1639
1640 #ifdef CONFIG_KEYS
1641
1642 /* strlen("cifs:a:") + CIFS_MAX_DOMAINNAME_LEN + 1 */
1643 #define CIFSCREDS_DESC_SIZE (7 + CIFS_MAX_DOMAINNAME_LEN + 1)
1644
1645 /* Populate username and pw fields from keyring if possible */
1646 static int
1647 cifs_set_cifscreds(struct smb3_fs_context *ctx, struct cifs_ses *ses)
1648 {
1649         int rc = 0;
1650         int is_domain = 0;
1651         const char *delim, *payload;
1652         char *desc;
1653         ssize_t len;
1654         struct key *key;
1655         struct TCP_Server_Info *server = ses->server;
1656         struct sockaddr_in *sa;
1657         struct sockaddr_in6 *sa6;
1658         const struct user_key_payload *upayload;
1659
1660         desc = kmalloc(CIFSCREDS_DESC_SIZE, GFP_KERNEL);
1661         if (!desc)
1662                 return -ENOMEM;
1663
1664         /* try to find an address key first */
1665         switch (server->dstaddr.ss_family) {
1666         case AF_INET:
1667                 sa = (struct sockaddr_in *)&server->dstaddr;
1668                 sprintf(desc, "cifs:a:%pI4", &sa->sin_addr.s_addr);
1669                 break;
1670         case AF_INET6:
1671                 sa6 = (struct sockaddr_in6 *)&server->dstaddr;
1672                 sprintf(desc, "cifs:a:%pI6c", &sa6->sin6_addr.s6_addr);
1673                 break;
1674         default:
1675                 cifs_dbg(FYI, "Bad ss_family (%hu)\n",
1676                          server->dstaddr.ss_family);
1677                 rc = -EINVAL;
1678                 goto out_err;
1679         }
1680
1681         cifs_dbg(FYI, "%s: desc=%s\n", __func__, desc);
1682         key = request_key(&key_type_logon, desc, "");
1683         if (IS_ERR(key)) {
1684                 if (!ses->domainName) {
1685                         cifs_dbg(FYI, "domainName is NULL\n");
1686                         rc = PTR_ERR(key);
1687                         goto out_err;
1688                 }
1689
1690                 /* didn't work, try to find a domain key */
1691                 sprintf(desc, "cifs:d:%s", ses->domainName);
1692                 cifs_dbg(FYI, "%s: desc=%s\n", __func__, desc);
1693                 key = request_key(&key_type_logon, desc, "");
1694                 if (IS_ERR(key)) {
1695                         rc = PTR_ERR(key);
1696                         goto out_err;
1697                 }
1698                 is_domain = 1;
1699         }
1700
1701         down_read(&key->sem);
1702         upayload = user_key_payload_locked(key);
1703         if (IS_ERR_OR_NULL(upayload)) {
1704                 rc = upayload ? PTR_ERR(upayload) : -EINVAL;
1705                 goto out_key_put;
1706         }
1707
1708         /* find first : in payload */
1709         payload = upayload->data;
1710         delim = strnchr(payload, upayload->datalen, ':');
1711         cifs_dbg(FYI, "payload=%s\n", payload);
1712         if (!delim) {
1713                 cifs_dbg(FYI, "Unable to find ':' in payload (datalen=%d)\n",
1714                          upayload->datalen);
1715                 rc = -EINVAL;
1716                 goto out_key_put;
1717         }
1718
1719         len = delim - payload;
1720         if (len > CIFS_MAX_USERNAME_LEN || len <= 0) {
1721                 cifs_dbg(FYI, "Bad value from username search (len=%zd)\n",
1722                          len);
1723                 rc = -EINVAL;
1724                 goto out_key_put;
1725         }
1726
1727         ctx->username = kstrndup(payload, len, GFP_KERNEL);
1728         if (!ctx->username) {
1729                 cifs_dbg(FYI, "Unable to allocate %zd bytes for username\n",
1730                          len);
1731                 rc = -ENOMEM;
1732                 goto out_key_put;
1733         }
1734         cifs_dbg(FYI, "%s: username=%s\n", __func__, ctx->username);
1735
1736         len = key->datalen - (len + 1);
1737         if (len > CIFS_MAX_PASSWORD_LEN || len <= 0) {
1738                 cifs_dbg(FYI, "Bad len for password search (len=%zd)\n", len);
1739                 rc = -EINVAL;
1740                 kfree(ctx->username);
1741                 ctx->username = NULL;
1742                 goto out_key_put;
1743         }
1744
1745         ++delim;
1746         ctx->password = kstrndup(delim, len, GFP_KERNEL);
1747         if (!ctx->password) {
1748                 cifs_dbg(FYI, "Unable to allocate %zd bytes for password\n",
1749                          len);
1750                 rc = -ENOMEM;
1751                 kfree(ctx->username);
1752                 ctx->username = NULL;
1753                 goto out_key_put;
1754         }
1755
1756         /*
1757          * If we have a domain key then we must set the domainName in the
1758          * for the request.
1759          */
1760         if (is_domain && ses->domainName) {
1761                 ctx->domainname = kstrdup(ses->domainName, GFP_KERNEL);
1762                 if (!ctx->domainname) {
1763                         cifs_dbg(FYI, "Unable to allocate %zd bytes for domain\n",
1764                                  len);
1765                         rc = -ENOMEM;
1766                         kfree(ctx->username);
1767                         ctx->username = NULL;
1768                         kfree_sensitive(ctx->password);
1769                         ctx->password = NULL;
1770                         goto out_key_put;
1771                 }
1772         }
1773
1774 out_key_put:
1775         up_read(&key->sem);
1776         key_put(key);
1777 out_err:
1778         kfree(desc);
1779         cifs_dbg(FYI, "%s: returning %d\n", __func__, rc);
1780         return rc;
1781 }
1782 #else /* ! CONFIG_KEYS */
1783 static inline int
1784 cifs_set_cifscreds(struct smb3_fs_context *ctx __attribute__((unused)),
1785                    struct cifs_ses *ses __attribute__((unused)))
1786 {
1787         return -ENOSYS;
1788 }
1789 #endif /* CONFIG_KEYS */
1790
1791 /**
1792  * cifs_get_smb_ses - get a session matching @ctx data from @server
1793  *
1794  * This function assumes it is being called from cifs_mount() where we
1795  * already got a server reference (server refcount +1). See
1796  * cifs_get_tcon() for refcount explanations.
1797  */
1798 struct cifs_ses *
1799 cifs_get_smb_ses(struct TCP_Server_Info *server, struct smb3_fs_context *ctx)
1800 {
1801         int rc = -ENOMEM;
1802         unsigned int xid;
1803         struct cifs_ses *ses;
1804         struct sockaddr_in *addr = (struct sockaddr_in *)&server->dstaddr;
1805         struct sockaddr_in6 *addr6 = (struct sockaddr_in6 *)&server->dstaddr;
1806
1807         xid = get_xid();
1808
1809         ses = cifs_find_smb_ses(server, ctx);
1810         if (ses) {
1811                 cifs_dbg(FYI, "Existing smb sess found (status=%d)\n",
1812                          ses->status);
1813
1814                 mutex_lock(&ses->session_mutex);
1815                 rc = cifs_negotiate_protocol(xid, ses);
1816                 if (rc) {
1817                         mutex_unlock(&ses->session_mutex);
1818                         /* problem -- put our ses reference */
1819                         cifs_put_smb_ses(ses);
1820                         free_xid(xid);
1821                         return ERR_PTR(rc);
1822                 }
1823                 if (ses->need_reconnect) {
1824                         cifs_dbg(FYI, "Session needs reconnect\n");
1825                         rc = cifs_setup_session(xid, ses,
1826                                                 ctx->local_nls);
1827                         if (rc) {
1828                                 mutex_unlock(&ses->session_mutex);
1829                                 /* problem -- put our reference */
1830                                 cifs_put_smb_ses(ses);
1831                                 free_xid(xid);
1832                                 return ERR_PTR(rc);
1833                         }
1834                 }
1835                 mutex_unlock(&ses->session_mutex);
1836
1837                 /* existing SMB ses has a server reference already */
1838                 cifs_put_tcp_session(server, 0);
1839                 free_xid(xid);
1840                 return ses;
1841         }
1842
1843         cifs_dbg(FYI, "Existing smb sess not found\n");
1844         ses = sesInfoAlloc();
1845         if (ses == NULL)
1846                 goto get_ses_fail;
1847
1848         /* new SMB session uses our server ref */
1849         ses->server = server;
1850         if (server->dstaddr.ss_family == AF_INET6)
1851                 sprintf(ses->ip_addr, "%pI6", &addr6->sin6_addr);
1852         else
1853                 sprintf(ses->ip_addr, "%pI4", &addr->sin_addr);
1854
1855         if (ctx->username) {
1856                 ses->user_name = kstrdup(ctx->username, GFP_KERNEL);
1857                 if (!ses->user_name)
1858                         goto get_ses_fail;
1859         }
1860
1861         /* ctx->password freed at unmount */
1862         if (ctx->password) {
1863                 ses->password = kstrdup(ctx->password, GFP_KERNEL);
1864                 if (!ses->password)
1865                         goto get_ses_fail;
1866         }
1867         if (ctx->domainname) {
1868                 ses->domainName = kstrdup(ctx->domainname, GFP_KERNEL);
1869                 if (!ses->domainName)
1870                         goto get_ses_fail;
1871         }
1872         if (ctx->domainauto)
1873                 ses->domainAuto = ctx->domainauto;
1874         ses->cred_uid = ctx->cred_uid;
1875         ses->linux_uid = ctx->linux_uid;
1876
1877         ses->sectype = ctx->sectype;
1878         ses->sign = ctx->sign;
1879         mutex_lock(&ses->session_mutex);
1880
1881         /* add server as first channel */
1882         ses->chans[0].server = server;
1883         ses->chan_count = 1;
1884         ses->chan_max = ctx->multichannel ? ctx->max_channels:1;
1885
1886         rc = cifs_negotiate_protocol(xid, ses);
1887         if (!rc)
1888                 rc = cifs_setup_session(xid, ses, ctx->local_nls);
1889
1890         /* each channel uses a different signing key */
1891         memcpy(ses->chans[0].signkey, ses->smb3signingkey,
1892                sizeof(ses->smb3signingkey));
1893
1894         mutex_unlock(&ses->session_mutex);
1895         if (rc)
1896                 goto get_ses_fail;
1897
1898         /* success, put it on the list and add it as first channel */
1899         spin_lock(&cifs_tcp_ses_lock);
1900         list_add(&ses->smb_ses_list, &server->smb_ses_list);
1901         spin_unlock(&cifs_tcp_ses_lock);
1902
1903         free_xid(xid);
1904
1905         cifs_setup_ipc(ses, ctx);
1906
1907         return ses;
1908
1909 get_ses_fail:
1910         sesInfoFree(ses);
1911         free_xid(xid);
1912         return ERR_PTR(rc);
1913 }
1914
1915 static int match_tcon(struct cifs_tcon *tcon, struct smb3_fs_context *ctx)
1916 {
1917         if (tcon->tidStatus == CifsExiting)
1918                 return 0;
1919         if (strncmp(tcon->treeName, ctx->UNC, MAX_TREE_SIZE))
1920                 return 0;
1921         if (tcon->seal != ctx->seal)
1922                 return 0;
1923         if (tcon->snapshot_time != ctx->snapshot_time)
1924                 return 0;
1925         if (tcon->handle_timeout != ctx->handle_timeout)
1926                 return 0;
1927         if (tcon->no_lease != ctx->no_lease)
1928                 return 0;
1929         if (tcon->nodelete != ctx->nodelete)
1930                 return 0;
1931         return 1;
1932 }
1933
1934 static struct cifs_tcon *
1935 cifs_find_tcon(struct cifs_ses *ses, struct smb3_fs_context *ctx)
1936 {
1937         struct list_head *tmp;
1938         struct cifs_tcon *tcon;
1939
1940         spin_lock(&cifs_tcp_ses_lock);
1941         list_for_each(tmp, &ses->tcon_list) {
1942                 tcon = list_entry(tmp, struct cifs_tcon, tcon_list);
1943
1944                 if (!match_tcon(tcon, ctx))
1945                         continue;
1946                 ++tcon->tc_count;
1947                 spin_unlock(&cifs_tcp_ses_lock);
1948                 return tcon;
1949         }
1950         spin_unlock(&cifs_tcp_ses_lock);
1951         return NULL;
1952 }
1953
1954 void
1955 cifs_put_tcon(struct cifs_tcon *tcon)
1956 {
1957         unsigned int xid;
1958         struct cifs_ses *ses;
1959
1960         /*
1961          * IPC tcon share the lifetime of their session and are
1962          * destroyed in the session put function
1963          */
1964         if (tcon == NULL || tcon->ipc)
1965                 return;
1966
1967         ses = tcon->ses;
1968         cifs_dbg(FYI, "%s: tc_count=%d\n", __func__, tcon->tc_count);
1969         spin_lock(&cifs_tcp_ses_lock);
1970         if (--tcon->tc_count > 0) {
1971                 spin_unlock(&cifs_tcp_ses_lock);
1972                 return;
1973         }
1974
1975         if (tcon->use_witness) {
1976                 int rc;
1977
1978                 rc = cifs_swn_unregister(tcon);
1979                 if (rc < 0) {
1980                         cifs_dbg(VFS, "%s: Failed to unregister for witness notifications: %d\n",
1981                                         __func__, rc);
1982                 }
1983         }
1984
1985         list_del_init(&tcon->tcon_list);
1986         spin_unlock(&cifs_tcp_ses_lock);
1987
1988         xid = get_xid();
1989         if (ses->server->ops->tree_disconnect)
1990                 ses->server->ops->tree_disconnect(xid, tcon);
1991         _free_xid(xid);
1992
1993         cifs_fscache_release_super_cookie(tcon);
1994         tconInfoFree(tcon);
1995         cifs_put_smb_ses(ses);
1996 }
1997
1998 /**
1999  * cifs_get_tcon - get a tcon matching @ctx data from @ses
2000  *
2001  * - tcon refcount is the number of mount points using the tcon.
2002  * - ses refcount is the number of tcon using the session.
2003  *
2004  * 1. This function assumes it is being called from cifs_mount() where
2005  *    we already got a session reference (ses refcount +1).
2006  *
2007  * 2. Since we're in the context of adding a mount point, the end
2008  *    result should be either:
2009  *
2010  * a) a new tcon already allocated with refcount=1 (1 mount point) and
2011  *    its session refcount incremented (1 new tcon). This +1 was
2012  *    already done in (1).
2013  *
2014  * b) an existing tcon with refcount+1 (add a mount point to it) and
2015  *    identical ses refcount (no new tcon). Because of (1) we need to
2016  *    decrement the ses refcount.
2017  */
2018 static struct cifs_tcon *
2019 cifs_get_tcon(struct cifs_ses *ses, struct smb3_fs_context *ctx)
2020 {
2021         int rc, xid;
2022         struct cifs_tcon *tcon;
2023
2024         tcon = cifs_find_tcon(ses, ctx);
2025         if (tcon) {
2026                 /*
2027                  * tcon has refcount already incremented but we need to
2028                  * decrement extra ses reference gotten by caller (case b)
2029                  */
2030                 cifs_dbg(FYI, "Found match on UNC path\n");
2031                 cifs_put_smb_ses(ses);
2032                 return tcon;
2033         }
2034
2035         if (!ses->server->ops->tree_connect) {
2036                 rc = -ENOSYS;
2037                 goto out_fail;
2038         }
2039
2040         tcon = tconInfoAlloc();
2041         if (tcon == NULL) {
2042                 rc = -ENOMEM;
2043                 goto out_fail;
2044         }
2045
2046         if (ctx->snapshot_time) {
2047                 if (ses->server->vals->protocol_id == 0) {
2048                         cifs_dbg(VFS,
2049                              "Use SMB2 or later for snapshot mount option\n");
2050                         rc = -EOPNOTSUPP;
2051                         goto out_fail;
2052                 } else
2053                         tcon->snapshot_time = ctx->snapshot_time;
2054         }
2055
2056         if (ctx->handle_timeout) {
2057                 if (ses->server->vals->protocol_id == 0) {
2058                         cifs_dbg(VFS,
2059                              "Use SMB2.1 or later for handle timeout option\n");
2060                         rc = -EOPNOTSUPP;
2061                         goto out_fail;
2062                 } else
2063                         tcon->handle_timeout = ctx->handle_timeout;
2064         }
2065
2066         tcon->ses = ses;
2067         if (ctx->password) {
2068                 tcon->password = kstrdup(ctx->password, GFP_KERNEL);
2069                 if (!tcon->password) {
2070                         rc = -ENOMEM;
2071                         goto out_fail;
2072                 }
2073         }
2074
2075         if (ctx->seal) {
2076                 if (ses->server->vals->protocol_id == 0) {
2077                         cifs_dbg(VFS,
2078                                  "SMB3 or later required for encryption\n");
2079                         rc = -EOPNOTSUPP;
2080                         goto out_fail;
2081                 } else if (tcon->ses->server->capabilities &
2082                                         SMB2_GLOBAL_CAP_ENCRYPTION)
2083                         tcon->seal = true;
2084                 else {
2085                         cifs_dbg(VFS, "Encryption is not supported on share\n");
2086                         rc = -EOPNOTSUPP;
2087                         goto out_fail;
2088                 }
2089         }
2090
2091         if (ctx->linux_ext) {
2092                 if (ses->server->posix_ext_supported) {
2093                         tcon->posix_extensions = true;
2094                         pr_warn_once("SMB3.11 POSIX Extensions are experimental\n");
2095                 } else {
2096                         cifs_dbg(VFS, "Server does not support mounting with posix SMB3.11 extensions\n");
2097                         rc = -EOPNOTSUPP;
2098                         goto out_fail;
2099                 }
2100         }
2101
2102         /*
2103          * BB Do we need to wrap session_mutex around this TCon call and Unix
2104          * SetFS as we do on SessSetup and reconnect?
2105          */
2106         xid = get_xid();
2107         rc = ses->server->ops->tree_connect(xid, ses, ctx->UNC, tcon,
2108                                             ctx->local_nls);
2109         free_xid(xid);
2110         cifs_dbg(FYI, "Tcon rc = %d\n", rc);
2111         if (rc)
2112                 goto out_fail;
2113
2114         tcon->use_persistent = false;
2115         /* check if SMB2 or later, CIFS does not support persistent handles */
2116         if (ctx->persistent) {
2117                 if (ses->server->vals->protocol_id == 0) {
2118                         cifs_dbg(VFS,
2119                              "SMB3 or later required for persistent handles\n");
2120                         rc = -EOPNOTSUPP;
2121                         goto out_fail;
2122                 } else if (ses->server->capabilities &
2123                            SMB2_GLOBAL_CAP_PERSISTENT_HANDLES)
2124                         tcon->use_persistent = true;
2125                 else /* persistent handles requested but not supported */ {
2126                         cifs_dbg(VFS,
2127                                 "Persistent handles not supported on share\n");
2128                         rc = -EOPNOTSUPP;
2129                         goto out_fail;
2130                 }
2131         } else if ((tcon->capabilities & SMB2_SHARE_CAP_CONTINUOUS_AVAILABILITY)
2132              && (ses->server->capabilities & SMB2_GLOBAL_CAP_PERSISTENT_HANDLES)
2133              && (ctx->nopersistent == false)) {
2134                 cifs_dbg(FYI, "enabling persistent handles\n");
2135                 tcon->use_persistent = true;
2136         } else if (ctx->resilient) {
2137                 if (ses->server->vals->protocol_id == 0) {
2138                         cifs_dbg(VFS,
2139                              "SMB2.1 or later required for resilient handles\n");
2140                         rc = -EOPNOTSUPP;
2141                         goto out_fail;
2142                 }
2143                 tcon->use_resilient = true;
2144         }
2145
2146         tcon->use_witness = false;
2147         if (IS_ENABLED(CONFIG_CIFS_SWN_UPCALL) && ctx->witness) {
2148                 if (ses->server->vals->protocol_id >= SMB30_PROT_ID) {
2149                         if (tcon->capabilities & SMB2_SHARE_CAP_CLUSTER) {
2150                                 /*
2151                                  * Set witness in use flag in first place
2152                                  * to retry registration in the echo task
2153                                  */
2154                                 tcon->use_witness = true;
2155                                 /* And try to register immediately */
2156                                 rc = cifs_swn_register(tcon);
2157                                 if (rc < 0) {
2158                                         cifs_dbg(VFS, "Failed to register for witness notifications: %d\n", rc);
2159                                         goto out_fail;
2160                                 }
2161                         } else {
2162                                 /* TODO: try to extend for non-cluster uses (eg multichannel) */
2163                                 cifs_dbg(VFS, "witness requested on mount but no CLUSTER capability on share\n");
2164                                 rc = -EOPNOTSUPP;
2165                                 goto out_fail;
2166                         }
2167                 } else {
2168                         cifs_dbg(VFS, "SMB3 or later required for witness option\n");
2169                         rc = -EOPNOTSUPP;
2170                         goto out_fail;
2171                 }
2172         }
2173
2174         /* If the user really knows what they are doing they can override */
2175         if (tcon->share_flags & SMB2_SHAREFLAG_NO_CACHING) {
2176                 if (ctx->cache_ro)
2177                         cifs_dbg(VFS, "cache=ro requested on mount but NO_CACHING flag set on share\n");
2178                 else if (ctx->cache_rw)
2179                         cifs_dbg(VFS, "cache=singleclient requested on mount but NO_CACHING flag set on share\n");
2180         }
2181
2182         if (ctx->no_lease) {
2183                 if (ses->server->vals->protocol_id == 0) {
2184                         cifs_dbg(VFS,
2185                                 "SMB2 or later required for nolease option\n");
2186                         rc = -EOPNOTSUPP;
2187                         goto out_fail;
2188                 } else
2189                         tcon->no_lease = ctx->no_lease;
2190         }
2191
2192         /*
2193          * We can have only one retry value for a connection to a share so for
2194          * resources mounted more than once to the same server share the last
2195          * value passed in for the retry flag is used.
2196          */
2197         tcon->retry = ctx->retry;
2198         tcon->nocase = ctx->nocase;
2199         if (ses->server->capabilities & SMB2_GLOBAL_CAP_DIRECTORY_LEASING)
2200                 tcon->nohandlecache = ctx->nohandlecache;
2201         else
2202                 tcon->nohandlecache = true;
2203         tcon->nodelete = ctx->nodelete;
2204         tcon->local_lease = ctx->local_lease;
2205         INIT_LIST_HEAD(&tcon->pending_opens);
2206
2207         spin_lock(&cifs_tcp_ses_lock);
2208         list_add(&tcon->tcon_list, &ses->tcon_list);
2209         spin_unlock(&cifs_tcp_ses_lock);
2210
2211         cifs_fscache_get_super_cookie(tcon);
2212
2213         return tcon;
2214
2215 out_fail:
2216         tconInfoFree(tcon);
2217         return ERR_PTR(rc);
2218 }
2219
2220 void
2221 cifs_put_tlink(struct tcon_link *tlink)
2222 {
2223         if (!tlink || IS_ERR(tlink))
2224                 return;
2225
2226         if (!atomic_dec_and_test(&tlink->tl_count) ||
2227             test_bit(TCON_LINK_IN_TREE, &tlink->tl_flags)) {
2228                 tlink->tl_time = jiffies;
2229                 return;
2230         }
2231
2232         if (!IS_ERR(tlink_tcon(tlink)))
2233                 cifs_put_tcon(tlink_tcon(tlink));
2234         kfree(tlink);
2235         return;
2236 }
2237
2238 static int
2239 compare_mount_options(struct super_block *sb, struct cifs_mnt_data *mnt_data)
2240 {
2241         struct cifs_sb_info *old = CIFS_SB(sb);
2242         struct cifs_sb_info *new = mnt_data->cifs_sb;
2243         unsigned int oldflags = old->mnt_cifs_flags & CIFS_MOUNT_MASK;
2244         unsigned int newflags = new->mnt_cifs_flags & CIFS_MOUNT_MASK;
2245
2246         if ((sb->s_flags & CIFS_MS_MASK) != (mnt_data->flags & CIFS_MS_MASK))
2247                 return 0;
2248
2249         if (old->mnt_cifs_serverino_autodisabled)
2250                 newflags &= ~CIFS_MOUNT_SERVER_INUM;
2251
2252         if (oldflags != newflags)
2253                 return 0;
2254
2255         /*
2256          * We want to share sb only if we don't specify an r/wsize or
2257          * specified r/wsize is greater than or equal to existing one.
2258          */
2259         if (new->ctx->wsize && new->ctx->wsize < old->ctx->wsize)
2260                 return 0;
2261
2262         if (new->ctx->rsize && new->ctx->rsize < old->ctx->rsize)
2263                 return 0;
2264
2265         if (!uid_eq(old->ctx->linux_uid, new->ctx->linux_uid) ||
2266             !gid_eq(old->ctx->linux_gid, new->ctx->linux_gid))
2267                 return 0;
2268
2269         if (old->ctx->file_mode != new->ctx->file_mode ||
2270             old->ctx->dir_mode != new->ctx->dir_mode)
2271                 return 0;
2272
2273         if (strcmp(old->local_nls->charset, new->local_nls->charset))
2274                 return 0;
2275
2276         if (old->ctx->acregmax != new->ctx->acregmax)
2277                 return 0;
2278         if (old->ctx->acdirmax != new->ctx->acdirmax)
2279                 return 0;
2280
2281         return 1;
2282 }
2283
2284 static int
2285 match_prepath(struct super_block *sb, struct cifs_mnt_data *mnt_data)
2286 {
2287         struct cifs_sb_info *old = CIFS_SB(sb);
2288         struct cifs_sb_info *new = mnt_data->cifs_sb;
2289         bool old_set = (old->mnt_cifs_flags & CIFS_MOUNT_USE_PREFIX_PATH) &&
2290                 old->prepath;
2291         bool new_set = (new->mnt_cifs_flags & CIFS_MOUNT_USE_PREFIX_PATH) &&
2292                 new->prepath;
2293
2294         if (old_set && new_set && !strcmp(new->prepath, old->prepath))
2295                 return 1;
2296         else if (!old_set && !new_set)
2297                 return 1;
2298
2299         return 0;
2300 }
2301
2302 int
2303 cifs_match_super(struct super_block *sb, void *data)
2304 {
2305         struct cifs_mnt_data *mnt_data = (struct cifs_mnt_data *)data;
2306         struct smb3_fs_context *ctx;
2307         struct cifs_sb_info *cifs_sb;
2308         struct TCP_Server_Info *tcp_srv;
2309         struct cifs_ses *ses;
2310         struct cifs_tcon *tcon;
2311         struct tcon_link *tlink;
2312         int rc = 0;
2313
2314         spin_lock(&cifs_tcp_ses_lock);
2315         cifs_sb = CIFS_SB(sb);
2316         tlink = cifs_get_tlink(cifs_sb_master_tlink(cifs_sb));
2317         if (IS_ERR(tlink)) {
2318                 spin_unlock(&cifs_tcp_ses_lock);
2319                 return rc;
2320         }
2321         tcon = tlink_tcon(tlink);
2322         ses = tcon->ses;
2323         tcp_srv = ses->server;
2324
2325         ctx = mnt_data->ctx;
2326
2327         if (!match_server(tcp_srv, ctx) ||
2328             !match_session(ses, ctx) ||
2329             !match_tcon(tcon, ctx) ||
2330             !match_prepath(sb, mnt_data)) {
2331                 rc = 0;
2332                 goto out;
2333         }
2334
2335         rc = compare_mount_options(sb, mnt_data);
2336 out:
2337         spin_unlock(&cifs_tcp_ses_lock);
2338         cifs_put_tlink(tlink);
2339         return rc;
2340 }
2341
2342 #ifdef CONFIG_DEBUG_LOCK_ALLOC
2343 static struct lock_class_key cifs_key[2];
2344 static struct lock_class_key cifs_slock_key[2];
2345
2346 static inline void
2347 cifs_reclassify_socket4(struct socket *sock)
2348 {
2349         struct sock *sk = sock->sk;
2350         BUG_ON(!sock_allow_reclassification(sk));
2351         sock_lock_init_class_and_name(sk, "slock-AF_INET-CIFS",
2352                 &cifs_slock_key[0], "sk_lock-AF_INET-CIFS", &cifs_key[0]);
2353 }
2354
2355 static inline void
2356 cifs_reclassify_socket6(struct socket *sock)
2357 {
2358         struct sock *sk = sock->sk;
2359         BUG_ON(!sock_allow_reclassification(sk));
2360         sock_lock_init_class_and_name(sk, "slock-AF_INET6-CIFS",
2361                 &cifs_slock_key[1], "sk_lock-AF_INET6-CIFS", &cifs_key[1]);
2362 }
2363 #else
2364 static inline void
2365 cifs_reclassify_socket4(struct socket *sock)
2366 {
2367 }
2368
2369 static inline void
2370 cifs_reclassify_socket6(struct socket *sock)
2371 {
2372 }
2373 #endif
2374
2375 /* See RFC1001 section 14 on representation of Netbios names */
2376 static void rfc1002mangle(char *target, char *source, unsigned int length)
2377 {
2378         unsigned int i, j;
2379
2380         for (i = 0, j = 0; i < (length); i++) {
2381                 /* mask a nibble at a time and encode */
2382                 target[j] = 'A' + (0x0F & (source[i] >> 4));
2383                 target[j+1] = 'A' + (0x0F & source[i]);
2384                 j += 2;
2385         }
2386
2387 }
2388
2389 static int
2390 bind_socket(struct TCP_Server_Info *server)
2391 {
2392         int rc = 0;
2393         if (server->srcaddr.ss_family != AF_UNSPEC) {
2394                 /* Bind to the specified local IP address */
2395                 struct socket *socket = server->ssocket;
2396                 rc = socket->ops->bind(socket,
2397                                        (struct sockaddr *) &server->srcaddr,
2398                                        sizeof(server->srcaddr));
2399                 if (rc < 0) {
2400                         struct sockaddr_in *saddr4;
2401                         struct sockaddr_in6 *saddr6;
2402                         saddr4 = (struct sockaddr_in *)&server->srcaddr;
2403                         saddr6 = (struct sockaddr_in6 *)&server->srcaddr;
2404                         if (saddr6->sin6_family == AF_INET6)
2405                                 cifs_server_dbg(VFS, "Failed to bind to: %pI6c, error: %d\n",
2406                                          &saddr6->sin6_addr, rc);
2407                         else
2408                                 cifs_server_dbg(VFS, "Failed to bind to: %pI4, error: %d\n",
2409                                          &saddr4->sin_addr.s_addr, rc);
2410                 }
2411         }
2412         return rc;
2413 }
2414
2415 static int
2416 ip_rfc1001_connect(struct TCP_Server_Info *server)
2417 {
2418         int rc = 0;
2419         /*
2420          * some servers require RFC1001 sessinit before sending
2421          * negprot - BB check reconnection in case where second
2422          * sessinit is sent but no second negprot
2423          */
2424         struct rfc1002_session_packet *ses_init_buf;
2425         struct smb_hdr *smb_buf;
2426         ses_init_buf = kzalloc(sizeof(struct rfc1002_session_packet),
2427                                GFP_KERNEL);
2428         if (ses_init_buf) {
2429                 ses_init_buf->trailer.session_req.called_len = 32;
2430
2431                 if (server->server_RFC1001_name[0] != 0)
2432                         rfc1002mangle(ses_init_buf->trailer.
2433                                       session_req.called_name,
2434                                       server->server_RFC1001_name,
2435                                       RFC1001_NAME_LEN_WITH_NULL);
2436                 else
2437                         rfc1002mangle(ses_init_buf->trailer.
2438                                       session_req.called_name,
2439                                       DEFAULT_CIFS_CALLED_NAME,
2440                                       RFC1001_NAME_LEN_WITH_NULL);
2441
2442                 ses_init_buf->trailer.session_req.calling_len = 32;
2443
2444                 /*
2445                  * calling name ends in null (byte 16) from old smb
2446                  * convention.
2447                  */
2448                 if (server->workstation_RFC1001_name[0] != 0)
2449                         rfc1002mangle(ses_init_buf->trailer.
2450                                       session_req.calling_name,
2451                                       server->workstation_RFC1001_name,
2452                                       RFC1001_NAME_LEN_WITH_NULL);
2453                 else
2454                         rfc1002mangle(ses_init_buf->trailer.
2455                                       session_req.calling_name,
2456                                       "LINUX_CIFS_CLNT",
2457                                       RFC1001_NAME_LEN_WITH_NULL);
2458
2459                 ses_init_buf->trailer.session_req.scope1 = 0;
2460                 ses_init_buf->trailer.session_req.scope2 = 0;
2461                 smb_buf = (struct smb_hdr *)ses_init_buf;
2462
2463                 /* sizeof RFC1002_SESSION_REQUEST with no scope */
2464                 smb_buf->smb_buf_length = cpu_to_be32(0x81000044);
2465                 rc = smb_send(server, smb_buf, 0x44);
2466                 kfree(ses_init_buf);
2467                 /*
2468                  * RFC1001 layer in at least one server
2469                  * requires very short break before negprot
2470                  * presumably because not expecting negprot
2471                  * to follow so fast.  This is a simple
2472                  * solution that works without
2473                  * complicating the code and causes no
2474                  * significant slowing down on mount
2475                  * for everyone else
2476                  */
2477                 usleep_range(1000, 2000);
2478         }
2479         /*
2480          * else the negprot may still work without this
2481          * even though malloc failed
2482          */
2483
2484         return rc;
2485 }
2486
2487 static int
2488 generic_ip_connect(struct TCP_Server_Info *server)
2489 {
2490         int rc = 0;
2491         __be16 sport;
2492         int slen, sfamily;
2493         struct socket *socket = server->ssocket;
2494         struct sockaddr *saddr;
2495
2496         saddr = (struct sockaddr *) &server->dstaddr;
2497
2498         if (server->dstaddr.ss_family == AF_INET6) {
2499                 struct sockaddr_in6 *ipv6 = (struct sockaddr_in6 *)&server->dstaddr;
2500
2501                 sport = ipv6->sin6_port;
2502                 slen = sizeof(struct sockaddr_in6);
2503                 sfamily = AF_INET6;
2504                 cifs_dbg(FYI, "%s: connecting to [%pI6]:%d\n", __func__, &ipv6->sin6_addr,
2505                                 ntohs(sport));
2506         } else {
2507                 struct sockaddr_in *ipv4 = (struct sockaddr_in *)&server->dstaddr;
2508
2509                 sport = ipv4->sin_port;
2510                 slen = sizeof(struct sockaddr_in);
2511                 sfamily = AF_INET;
2512                 cifs_dbg(FYI, "%s: connecting to %pI4:%d\n", __func__, &ipv4->sin_addr,
2513                                 ntohs(sport));
2514         }
2515
2516         if (socket == NULL) {
2517                 rc = __sock_create(cifs_net_ns(server), sfamily, SOCK_STREAM,
2518                                    IPPROTO_TCP, &socket, 1);
2519                 if (rc < 0) {
2520                         cifs_server_dbg(VFS, "Error %d creating socket\n", rc);
2521                         server->ssocket = NULL;
2522                         return rc;
2523                 }
2524
2525                 /* BB other socket options to set KEEPALIVE, NODELAY? */
2526                 cifs_dbg(FYI, "Socket created\n");
2527                 server->ssocket = socket;
2528                 socket->sk->sk_allocation = GFP_NOFS;
2529                 if (sfamily == AF_INET6)
2530                         cifs_reclassify_socket6(socket);
2531                 else
2532                         cifs_reclassify_socket4(socket);
2533         }
2534
2535         rc = bind_socket(server);
2536         if (rc < 0)
2537                 return rc;
2538
2539         /*
2540          * Eventually check for other socket options to change from
2541          * the default. sock_setsockopt not used because it expects
2542          * user space buffer
2543          */
2544         socket->sk->sk_rcvtimeo = 7 * HZ;
2545         socket->sk->sk_sndtimeo = 5 * HZ;
2546
2547         /* make the bufsizes depend on wsize/rsize and max requests */
2548         if (server->noautotune) {
2549                 if (socket->sk->sk_sndbuf < (200 * 1024))
2550                         socket->sk->sk_sndbuf = 200 * 1024;
2551                 if (socket->sk->sk_rcvbuf < (140 * 1024))
2552                         socket->sk->sk_rcvbuf = 140 * 1024;
2553         }
2554
2555         if (server->tcp_nodelay)
2556                 tcp_sock_set_nodelay(socket->sk);
2557
2558         cifs_dbg(FYI, "sndbuf %d rcvbuf %d rcvtimeo 0x%lx\n",
2559                  socket->sk->sk_sndbuf,
2560                  socket->sk->sk_rcvbuf, socket->sk->sk_rcvtimeo);
2561
2562         rc = socket->ops->connect(socket, saddr, slen,
2563                                   server->noblockcnt ? O_NONBLOCK : 0);
2564         /*
2565          * When mounting SMB root file systems, we do not want to block in
2566          * connect. Otherwise bail out and then let cifs_reconnect() perform
2567          * reconnect failover - if possible.
2568          */
2569         if (server->noblockcnt && rc == -EINPROGRESS)
2570                 rc = 0;
2571         if (rc < 0) {
2572                 cifs_dbg(FYI, "Error %d connecting to server\n", rc);
2573                 sock_release(socket);
2574                 server->ssocket = NULL;
2575                 return rc;
2576         }
2577
2578         if (sport == htons(RFC1001_PORT))
2579                 rc = ip_rfc1001_connect(server);
2580
2581         return rc;
2582 }
2583
2584 static int
2585 ip_connect(struct TCP_Server_Info *server)
2586 {
2587         __be16 *sport;
2588         struct sockaddr_in6 *addr6 = (struct sockaddr_in6 *)&server->dstaddr;
2589         struct sockaddr_in *addr = (struct sockaddr_in *)&server->dstaddr;
2590
2591         if (server->dstaddr.ss_family == AF_INET6)
2592                 sport = &addr6->sin6_port;
2593         else
2594                 sport = &addr->sin_port;
2595
2596         if (*sport == 0) {
2597                 int rc;
2598
2599                 /* try with 445 port at first */
2600                 *sport = htons(CIFS_PORT);
2601
2602                 rc = generic_ip_connect(server);
2603                 if (rc >= 0)
2604                         return rc;
2605
2606                 /* if it failed, try with 139 port */
2607                 *sport = htons(RFC1001_PORT);
2608         }
2609
2610         return generic_ip_connect(server);
2611 }
2612
2613 void reset_cifs_unix_caps(unsigned int xid, struct cifs_tcon *tcon,
2614                           struct cifs_sb_info *cifs_sb, struct smb3_fs_context *ctx)
2615 {
2616         /*
2617          * If we are reconnecting then should we check to see if
2618          * any requested capabilities changed locally e.g. via
2619          * remount but we can not do much about it here
2620          * if they have (even if we could detect it by the following)
2621          * Perhaps we could add a backpointer to array of sb from tcon
2622          * or if we change to make all sb to same share the same
2623          * sb as NFS - then we only have one backpointer to sb.
2624          * What if we wanted to mount the server share twice once with
2625          * and once without posixacls or posix paths?
2626          */
2627         __u64 saved_cap = le64_to_cpu(tcon->fsUnixInfo.Capability);
2628
2629         if (ctx && ctx->no_linux_ext) {
2630                 tcon->fsUnixInfo.Capability = 0;
2631                 tcon->unix_ext = 0; /* Unix Extensions disabled */
2632                 cifs_dbg(FYI, "Linux protocol extensions disabled\n");
2633                 return;
2634         } else if (ctx)
2635                 tcon->unix_ext = 1; /* Unix Extensions supported */
2636
2637         if (!tcon->unix_ext) {
2638                 cifs_dbg(FYI, "Unix extensions disabled so not set on reconnect\n");
2639                 return;
2640         }
2641
2642         if (!CIFSSMBQFSUnixInfo(xid, tcon)) {
2643                 __u64 cap = le64_to_cpu(tcon->fsUnixInfo.Capability);
2644                 cifs_dbg(FYI, "unix caps which server supports %lld\n", cap);
2645                 /*
2646                  * check for reconnect case in which we do not
2647                  * want to change the mount behavior if we can avoid it
2648                  */
2649                 if (ctx == NULL) {
2650                         /*
2651                          * turn off POSIX ACL and PATHNAMES if not set
2652                          * originally at mount time
2653                          */
2654                         if ((saved_cap & CIFS_UNIX_POSIX_ACL_CAP) == 0)
2655                                 cap &= ~CIFS_UNIX_POSIX_ACL_CAP;
2656                         if ((saved_cap & CIFS_UNIX_POSIX_PATHNAMES_CAP) == 0) {
2657                                 if (cap & CIFS_UNIX_POSIX_PATHNAMES_CAP)
2658                                         cifs_dbg(VFS, "POSIXPATH support change\n");
2659                                 cap &= ~CIFS_UNIX_POSIX_PATHNAMES_CAP;
2660                         } else if ((cap & CIFS_UNIX_POSIX_PATHNAMES_CAP) == 0) {
2661                                 cifs_dbg(VFS, "possible reconnect error\n");
2662                                 cifs_dbg(VFS, "server disabled POSIX path support\n");
2663                         }
2664                 }
2665
2666                 if (cap & CIFS_UNIX_TRANSPORT_ENCRYPTION_MANDATORY_CAP)
2667                         cifs_dbg(VFS, "per-share encryption not supported yet\n");
2668
2669                 cap &= CIFS_UNIX_CAP_MASK;
2670                 if (ctx && ctx->no_psx_acl)
2671                         cap &= ~CIFS_UNIX_POSIX_ACL_CAP;
2672                 else if (CIFS_UNIX_POSIX_ACL_CAP & cap) {
2673                         cifs_dbg(FYI, "negotiated posix acl support\n");
2674                         if (cifs_sb)
2675                                 cifs_sb->mnt_cifs_flags |=
2676                                         CIFS_MOUNT_POSIXACL;
2677                 }
2678
2679                 if (ctx && ctx->posix_paths == 0)
2680                         cap &= ~CIFS_UNIX_POSIX_PATHNAMES_CAP;
2681                 else if (cap & CIFS_UNIX_POSIX_PATHNAMES_CAP) {
2682                         cifs_dbg(FYI, "negotiate posix pathnames\n");
2683                         if (cifs_sb)
2684                                 cifs_sb->mnt_cifs_flags |=
2685                                         CIFS_MOUNT_POSIX_PATHS;
2686                 }
2687
2688                 cifs_dbg(FYI, "Negotiate caps 0x%x\n", (int)cap);
2689 #ifdef CONFIG_CIFS_DEBUG2
2690                 if (cap & CIFS_UNIX_FCNTL_CAP)
2691                         cifs_dbg(FYI, "FCNTL cap\n");
2692                 if (cap & CIFS_UNIX_EXTATTR_CAP)
2693                         cifs_dbg(FYI, "EXTATTR cap\n");
2694                 if (cap & CIFS_UNIX_POSIX_PATHNAMES_CAP)
2695                         cifs_dbg(FYI, "POSIX path cap\n");
2696                 if (cap & CIFS_UNIX_XATTR_CAP)
2697                         cifs_dbg(FYI, "XATTR cap\n");
2698                 if (cap & CIFS_UNIX_POSIX_ACL_CAP)
2699                         cifs_dbg(FYI, "POSIX ACL cap\n");
2700                 if (cap & CIFS_UNIX_LARGE_READ_CAP)
2701                         cifs_dbg(FYI, "very large read cap\n");
2702                 if (cap & CIFS_UNIX_LARGE_WRITE_CAP)
2703                         cifs_dbg(FYI, "very large write cap\n");
2704                 if (cap & CIFS_UNIX_TRANSPORT_ENCRYPTION_CAP)
2705                         cifs_dbg(FYI, "transport encryption cap\n");
2706                 if (cap & CIFS_UNIX_TRANSPORT_ENCRYPTION_MANDATORY_CAP)
2707                         cifs_dbg(FYI, "mandatory transport encryption cap\n");
2708 #endif /* CIFS_DEBUG2 */
2709                 if (CIFSSMBSetFSUnixInfo(xid, tcon, cap)) {
2710                         if (ctx == NULL)
2711                                 cifs_dbg(FYI, "resetting capabilities failed\n");
2712                         else
2713                                 cifs_dbg(VFS, "Negotiating Unix capabilities with the server failed. Consider mounting with the Unix Extensions disabled if problems are found by specifying the nounix mount option.\n");
2714
2715                 }
2716         }
2717 }
2718
2719 int cifs_setup_cifs_sb(struct cifs_sb_info *cifs_sb)
2720 {
2721         struct smb3_fs_context *ctx = cifs_sb->ctx;
2722
2723         INIT_DELAYED_WORK(&cifs_sb->prune_tlinks, cifs_prune_tlinks);
2724
2725         spin_lock_init(&cifs_sb->tlink_tree_lock);
2726         cifs_sb->tlink_tree = RB_ROOT;
2727
2728         cifs_dbg(FYI, "file mode: %04ho  dir mode: %04ho\n",
2729                  ctx->file_mode, ctx->dir_mode);
2730
2731         /* this is needed for ASCII cp to Unicode converts */
2732         if (ctx->iocharset == NULL) {
2733                 /* load_nls_default cannot return null */
2734                 cifs_sb->local_nls = load_nls_default();
2735         } else {
2736                 cifs_sb->local_nls = load_nls(ctx->iocharset);
2737                 if (cifs_sb->local_nls == NULL) {
2738                         cifs_dbg(VFS, "CIFS mount error: iocharset %s not found\n",
2739                                  ctx->iocharset);
2740                         return -ELIBACC;
2741                 }
2742         }
2743         ctx->local_nls = cifs_sb->local_nls;
2744
2745         smb3_update_mnt_flags(cifs_sb);
2746
2747         if (ctx->direct_io)
2748                 cifs_dbg(FYI, "mounting share using direct i/o\n");
2749         if (ctx->cache_ro) {
2750                 cifs_dbg(VFS, "mounting share with read only caching. Ensure that the share will not be modified while in use.\n");
2751                 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_RO_CACHE;
2752         } else if (ctx->cache_rw) {
2753                 cifs_dbg(VFS, "mounting share in single client RW caching mode. Ensure that no other systems will be accessing the share.\n");
2754                 cifs_sb->mnt_cifs_flags |= (CIFS_MOUNT_RO_CACHE |
2755                                             CIFS_MOUNT_RW_CACHE);
2756         }
2757
2758         if ((ctx->cifs_acl) && (ctx->dynperm))
2759                 cifs_dbg(VFS, "mount option dynperm ignored if cifsacl mount option supported\n");
2760
2761         if (ctx->prepath) {
2762                 cifs_sb->prepath = kstrdup(ctx->prepath, GFP_KERNEL);
2763                 if (cifs_sb->prepath == NULL)
2764                         return -ENOMEM;
2765                 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_USE_PREFIX_PATH;
2766         }
2767
2768         return 0;
2769 }
2770
2771 /* Release all succeed connections */
2772 static inline void mount_put_conns(struct cifs_sb_info *cifs_sb,
2773                                    unsigned int xid,
2774                                    struct TCP_Server_Info *server,
2775                                    struct cifs_ses *ses, struct cifs_tcon *tcon)
2776 {
2777         int rc = 0;
2778
2779         if (tcon)
2780                 cifs_put_tcon(tcon);
2781         else if (ses)
2782                 cifs_put_smb_ses(ses);
2783         else if (server)
2784                 cifs_put_tcp_session(server, 0);
2785         cifs_sb->mnt_cifs_flags &= ~CIFS_MOUNT_POSIX_PATHS;
2786         free_xid(xid);
2787 }
2788
2789 /* Get connections for tcp, ses and tcon */
2790 static int mount_get_conns(struct smb3_fs_context *ctx, struct cifs_sb_info *cifs_sb,
2791                            unsigned int *xid,
2792                            struct TCP_Server_Info **nserver,
2793                            struct cifs_ses **nses, struct cifs_tcon **ntcon)
2794 {
2795         int rc = 0;
2796         struct TCP_Server_Info *server;
2797         struct cifs_ses *ses;
2798         struct cifs_tcon *tcon;
2799
2800         *nserver = NULL;
2801         *nses = NULL;
2802         *ntcon = NULL;
2803
2804         *xid = get_xid();
2805
2806         /* get a reference to a tcp session */
2807         server = cifs_get_tcp_session(ctx);
2808         if (IS_ERR(server)) {
2809                 rc = PTR_ERR(server);
2810                 return rc;
2811         }
2812
2813         *nserver = server;
2814
2815         /* get a reference to a SMB session */
2816         ses = cifs_get_smb_ses(server, ctx);
2817         if (IS_ERR(ses)) {
2818                 rc = PTR_ERR(ses);
2819                 return rc;
2820         }
2821
2822         *nses = ses;
2823
2824         if ((ctx->persistent == true) && (!(ses->server->capabilities &
2825                                             SMB2_GLOBAL_CAP_PERSISTENT_HANDLES))) {
2826                 cifs_server_dbg(VFS, "persistent handles not supported by server\n");
2827                 return -EOPNOTSUPP;
2828         }
2829
2830         /* search for existing tcon to this server share */
2831         tcon = cifs_get_tcon(ses, ctx);
2832         if (IS_ERR(tcon)) {
2833                 rc = PTR_ERR(tcon);
2834                 return rc;
2835         }
2836
2837         *ntcon = tcon;
2838
2839         /* if new SMB3.11 POSIX extensions are supported do not remap / and \ */
2840         if (tcon->posix_extensions)
2841                 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_POSIX_PATHS;
2842
2843         /* tell server which Unix caps we support */
2844         if (cap_unix(tcon->ses)) {
2845                 /*
2846                  * reset of caps checks mount to see if unix extensions disabled
2847                  * for just this mount.
2848                  */
2849                 reset_cifs_unix_caps(*xid, tcon, cifs_sb, ctx);
2850                 if ((tcon->ses->server->tcpStatus == CifsNeedReconnect) &&
2851                     (le64_to_cpu(tcon->fsUnixInfo.Capability) &
2852                      CIFS_UNIX_TRANSPORT_ENCRYPTION_MANDATORY_CAP))
2853                         return -EACCES;
2854         } else
2855                 tcon->unix_ext = 0; /* server does not support them */
2856
2857         /* do not care if a following call succeed - informational */
2858         if (!tcon->pipe && server->ops->qfs_tcon) {
2859                 server->ops->qfs_tcon(*xid, tcon, cifs_sb);
2860                 if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_RO_CACHE) {
2861                         if (tcon->fsDevInfo.DeviceCharacteristics &
2862                             cpu_to_le32(FILE_READ_ONLY_DEVICE))
2863                                 cifs_dbg(VFS, "mounted to read only share\n");
2864                         else if ((cifs_sb->mnt_cifs_flags &
2865                                   CIFS_MOUNT_RW_CACHE) == 0)
2866                                 cifs_dbg(VFS, "read only mount of RW share\n");
2867                         /* no need to log a RW mount of a typical RW share */
2868                 }
2869         }
2870
2871         /*
2872          * Clamp the rsize/wsize mount arguments if they are too big for the server
2873          * and set the rsize/wsize to the negotiated values if not passed in by
2874          * the user on mount
2875          */
2876         if ((cifs_sb->ctx->wsize == 0) ||
2877             (cifs_sb->ctx->wsize > server->ops->negotiate_wsize(tcon, ctx)))
2878                 cifs_sb->ctx->wsize = server->ops->negotiate_wsize(tcon, ctx);
2879         if ((cifs_sb->ctx->rsize == 0) ||
2880             (cifs_sb->ctx->rsize > server->ops->negotiate_rsize(tcon, ctx)))
2881                 cifs_sb->ctx->rsize = server->ops->negotiate_rsize(tcon, ctx);
2882
2883         return 0;
2884 }
2885
2886 static int mount_setup_tlink(struct cifs_sb_info *cifs_sb, struct cifs_ses *ses,
2887                              struct cifs_tcon *tcon)
2888 {
2889         struct tcon_link *tlink;
2890
2891         /* hang the tcon off of the superblock */
2892         tlink = kzalloc(sizeof(*tlink), GFP_KERNEL);
2893         if (tlink == NULL)
2894                 return -ENOMEM;
2895
2896         tlink->tl_uid = ses->linux_uid;
2897         tlink->tl_tcon = tcon;
2898         tlink->tl_time = jiffies;
2899         set_bit(TCON_LINK_MASTER, &tlink->tl_flags);
2900         set_bit(TCON_LINK_IN_TREE, &tlink->tl_flags);
2901
2902         cifs_sb->master_tlink = tlink;
2903         spin_lock(&cifs_sb->tlink_tree_lock);
2904         tlink_rb_insert(&cifs_sb->tlink_tree, tlink);
2905         spin_unlock(&cifs_sb->tlink_tree_lock);
2906
2907         queue_delayed_work(cifsiod_wq, &cifs_sb->prune_tlinks,
2908                                 TLINK_IDLE_EXPIRE);
2909         return 0;
2910 }
2911
2912 #ifdef CONFIG_CIFS_DFS_UPCALL
2913 /*
2914  * cifs_build_path_to_root returns full path to root when we do not have an
2915  * existing connection (tcon)
2916  */
2917 static char *
2918 build_unc_path_to_root(const struct smb3_fs_context *ctx,
2919                        const struct cifs_sb_info *cifs_sb, bool useppath)
2920 {
2921         char *full_path, *pos;
2922         unsigned int pplen = useppath && ctx->prepath ?
2923                 strlen(ctx->prepath) + 1 : 0;
2924         unsigned int unc_len = strnlen(ctx->UNC, MAX_TREE_SIZE + 1);
2925
2926         if (unc_len > MAX_TREE_SIZE)
2927                 return ERR_PTR(-EINVAL);
2928
2929         full_path = kmalloc(unc_len + pplen + 1, GFP_KERNEL);
2930         if (full_path == NULL)
2931                 return ERR_PTR(-ENOMEM);
2932
2933         memcpy(full_path, ctx->UNC, unc_len);
2934         pos = full_path + unc_len;
2935
2936         if (pplen) {
2937                 *pos = CIFS_DIR_SEP(cifs_sb);
2938                 memcpy(pos + 1, ctx->prepath, pplen);
2939                 pos += pplen;
2940         }
2941
2942         *pos = '\0'; /* add trailing null */
2943         convert_delimiter(full_path, CIFS_DIR_SEP(cifs_sb));
2944         cifs_dbg(FYI, "%s: full_path=%s\n", __func__, full_path);
2945         return full_path;
2946 }
2947
2948 /**
2949  * expand_dfs_referral - Perform a dfs referral query and update the cifs_sb
2950  *
2951  * If a referral is found, cifs_sb->ctx->mount_options will be (re-)allocated
2952  * to a string containing updated options for the submount.  Otherwise it
2953  * will be left untouched.
2954  *
2955  * Returns the rc from get_dfs_path to the caller, which can be used to
2956  * determine whether there were referrals.
2957  */
2958 static int
2959 expand_dfs_referral(const unsigned int xid, struct cifs_ses *ses,
2960                     struct smb3_fs_context *ctx, struct cifs_sb_info *cifs_sb,
2961                     char *ref_path)
2962 {
2963         int rc;
2964         struct dfs_info3_param referral = {0};
2965         char *full_path = NULL, *mdata = NULL;
2966
2967         if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_NO_DFS)
2968                 return -EREMOTE;
2969
2970         full_path = build_unc_path_to_root(ctx, cifs_sb, true);
2971         if (IS_ERR(full_path))
2972                 return PTR_ERR(full_path);
2973
2974         rc = dfs_cache_find(xid, ses, cifs_sb->local_nls, cifs_remap(cifs_sb),
2975                             ref_path, &referral, NULL);
2976         if (!rc) {
2977                 char *fake_devname = NULL;
2978
2979                 mdata = cifs_compose_mount_options(cifs_sb->ctx->mount_options,
2980                                                    full_path + 1, &referral,
2981                                                    &fake_devname);
2982                 free_dfs_info_param(&referral);
2983
2984                 if (IS_ERR(mdata)) {
2985                         rc = PTR_ERR(mdata);
2986                         mdata = NULL;
2987                 } else {
2988                         /*
2989                          * We can not clear out the whole structure since we
2990                          * no longer have an explicit function to parse
2991                          * a mount-string. Instead we need to clear out the
2992                          * individual fields that are no longer valid.
2993                          */
2994                         kfree(ctx->prepath);
2995                         ctx->prepath = NULL;
2996                         rc = cifs_setup_volume_info(ctx, mdata, fake_devname);
2997                 }
2998                 kfree(fake_devname);
2999                 kfree(cifs_sb->ctx->mount_options);
3000                 cifs_sb->ctx->mount_options = mdata;
3001         }
3002         kfree(full_path);
3003         return rc;
3004 }
3005
3006 static int get_next_dfs_tgt(struct dfs_cache_tgt_list *tgt_list,
3007                             struct dfs_cache_tgt_iterator **tgt_it)
3008 {
3009         if (!*tgt_it)
3010                 *tgt_it = dfs_cache_get_tgt_iterator(tgt_list);
3011         else
3012                 *tgt_it = dfs_cache_get_next_tgt(tgt_list, *tgt_it);
3013         return !*tgt_it ? -EHOSTDOWN : 0;
3014 }
3015
3016 static int update_vol_info(const struct dfs_cache_tgt_iterator *tgt_it,
3017                            struct smb3_fs_context *fake_ctx, struct smb3_fs_context *ctx)
3018 {
3019         const char *tgt = dfs_cache_get_tgt_name(tgt_it);
3020         int len = strlen(tgt) + 2;
3021         char *new_unc;
3022
3023         new_unc = kmalloc(len, GFP_KERNEL);
3024         if (!new_unc)
3025                 return -ENOMEM;
3026         scnprintf(new_unc, len, "\\%s", tgt);
3027
3028         kfree(ctx->UNC);
3029         ctx->UNC = new_unc;
3030
3031         if (fake_ctx->prepath) {
3032                 kfree(ctx->prepath);
3033                 ctx->prepath = fake_ctx->prepath;
3034                 fake_ctx->prepath = NULL;
3035         }
3036         memcpy(&ctx->dstaddr, &fake_ctx->dstaddr, sizeof(ctx->dstaddr));
3037
3038         return 0;
3039 }
3040
3041 static int do_dfs_failover(const char *path, const char *full_path, struct cifs_sb_info *cifs_sb,
3042                            struct smb3_fs_context *ctx, struct cifs_ses *root_ses,
3043                            unsigned int *xid, struct TCP_Server_Info **server,
3044                            struct cifs_ses **ses, struct cifs_tcon **tcon)
3045 {
3046         int rc;
3047         char *npath = NULL;
3048         struct dfs_cache_tgt_list tgt_list = {0};
3049         struct dfs_cache_tgt_iterator *tgt_it = NULL;
3050         struct smb3_fs_context tmp_ctx = {NULL};
3051
3052         if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_NO_DFS)
3053                 return -EOPNOTSUPP;
3054
3055         npath = dfs_cache_canonical_path(path, cifs_sb->local_nls, cifs_remap(cifs_sb));
3056         if (IS_ERR(npath))
3057                 return PTR_ERR(npath);
3058
3059         cifs_dbg(FYI, "%s: path=%s full_path=%s\n", __func__, npath, full_path);
3060
3061         rc = dfs_cache_noreq_find(npath, NULL, &tgt_list);
3062         if (rc)
3063                 goto out;
3064         /*
3065          * We use a 'tmp_ctx' here because we need pass it down to the mount_{get,put} functions to
3066          * test connection against new DFS targets.
3067          */
3068         rc = smb3_fs_context_dup(&tmp_ctx, ctx);
3069         if (rc)
3070                 goto out;
3071
3072         for (;;) {
3073                 struct dfs_info3_param ref = {0};
3074                 char *fake_devname = NULL, *mdata = NULL;
3075
3076                 /* Get next DFS target server - if any */
3077                 rc = get_next_dfs_tgt(&tgt_list, &tgt_it);
3078                 if (rc)
3079                         break;
3080
3081                 rc = dfs_cache_get_tgt_referral(npath, tgt_it, &ref);
3082                 if (rc)
3083                         break;
3084
3085                 cifs_dbg(FYI, "%s: old ctx: UNC=%s prepath=%s\n", __func__, tmp_ctx.UNC,
3086                          tmp_ctx.prepath);
3087
3088                 mdata = cifs_compose_mount_options(cifs_sb->ctx->mount_options, full_path + 1, &ref,
3089                                                    &fake_devname);
3090                 free_dfs_info_param(&ref);
3091
3092                 if (IS_ERR(mdata)) {
3093                         rc = PTR_ERR(mdata);
3094                         mdata = NULL;
3095                 } else
3096                         rc = cifs_setup_volume_info(&tmp_ctx, mdata, fake_devname);
3097
3098                 kfree(mdata);
3099                 kfree(fake_devname);
3100
3101                 if (rc)
3102                         break;
3103
3104                 cifs_dbg(FYI, "%s: new ctx: UNC=%s prepath=%s\n", __func__, tmp_ctx.UNC,
3105                          tmp_ctx.prepath);
3106
3107                 mount_put_conns(cifs_sb, *xid, *server, *ses, *tcon);
3108                 rc = mount_get_conns(&tmp_ctx, cifs_sb, xid, server, ses, tcon);
3109                 if (!rc || (*server && *ses)) {
3110                         /*
3111                          * We were able to connect to new target server. Update current context with
3112                          * new target server.
3113                          */
3114                         rc = update_vol_info(tgt_it, &tmp_ctx, ctx);
3115                         break;
3116                 }
3117         }
3118         if (!rc) {
3119                 cifs_dbg(FYI, "%s: final ctx: UNC=%s prepath=%s\n", __func__, tmp_ctx.UNC,
3120                          tmp_ctx.prepath);
3121                 /*
3122                  * Update DFS target hint in DFS referral cache with the target server we
3123                  * successfully reconnected to.
3124                  */
3125                 rc = dfs_cache_update_tgthint(*xid, root_ses ? root_ses : *ses, cifs_sb->local_nls,
3126                                               cifs_remap(cifs_sb), path, tgt_it);
3127         }
3128
3129 out:
3130         kfree(npath);
3131         smb3_cleanup_fs_context_contents(&tmp_ctx);
3132         dfs_cache_free_tgts(&tgt_list);
3133         return rc;
3134 }
3135 #endif
3136
3137 /* TODO: all callers to this are broken. We are not parsing mount_options here
3138  * we should pass a clone of the original context?
3139  */
3140 int
3141 cifs_setup_volume_info(struct smb3_fs_context *ctx, const char *mntopts, const char *devname)
3142 {
3143         int rc;
3144
3145         if (devname) {
3146                 cifs_dbg(FYI, "%s: devname=%s\n", __func__, devname);
3147                 rc = smb3_parse_devname(devname, ctx);
3148                 if (rc) {
3149                         cifs_dbg(VFS, "%s: failed to parse %s: %d\n", __func__, devname, rc);
3150                         return rc;
3151                 }
3152         }
3153
3154         if (mntopts) {
3155                 char *ip;
3156
3157                 rc = smb3_parse_opt(mntopts, "ip", &ip);
3158                 if (rc) {
3159                         cifs_dbg(VFS, "%s: failed to parse ip options: %d\n", __func__, rc);
3160                         return rc;
3161                 }
3162
3163                 rc = cifs_convert_address((struct sockaddr *)&ctx->dstaddr, ip, strlen(ip));
3164                 kfree(ip);
3165                 if (!rc) {
3166                         cifs_dbg(VFS, "%s: failed to convert ip address\n", __func__);
3167                         return -EINVAL;
3168                 }
3169         }
3170
3171         if (ctx->nullauth) {
3172                 cifs_dbg(FYI, "Anonymous login\n");
3173                 kfree(ctx->username);
3174                 ctx->username = NULL;
3175         } else if (ctx->username) {
3176                 /* BB fixme parse for domain name here */
3177                 cifs_dbg(FYI, "Username: %s\n", ctx->username);
3178         } else {
3179                 cifs_dbg(VFS, "No username specified\n");
3180         /* In userspace mount helper we can get user name from alternate
3181            locations such as env variables and files on disk */
3182                 return -EINVAL;
3183         }
3184
3185         return 0;
3186 }
3187
3188 static int
3189 cifs_are_all_path_components_accessible(struct TCP_Server_Info *server,
3190                                         unsigned int xid,
3191                                         struct cifs_tcon *tcon,
3192                                         struct cifs_sb_info *cifs_sb,
3193                                         char *full_path,
3194                                         int added_treename)
3195 {
3196         int rc;
3197         char *s;
3198         char sep, tmp;
3199         int skip = added_treename ? 1 : 0;
3200
3201         sep = CIFS_DIR_SEP(cifs_sb);
3202         s = full_path;
3203
3204         rc = server->ops->is_path_accessible(xid, tcon, cifs_sb, "");
3205         while (rc == 0) {
3206                 /* skip separators */
3207                 while (*s == sep)
3208                         s++;
3209                 if (!*s)
3210                         break;
3211                 /* next separator */
3212                 while (*s && *s != sep)
3213                         s++;
3214                 /*
3215                  * if the treename is added, we then have to skip the first
3216                  * part within the separators
3217                  */
3218                 if (skip) {
3219                         skip = 0;
3220                         continue;
3221                 }
3222                 /*
3223                  * temporarily null-terminate the path at the end of
3224                  * the current component
3225                  */
3226                 tmp = *s;
3227                 *s = 0;
3228                 rc = server->ops->is_path_accessible(xid, tcon, cifs_sb,
3229                                                      full_path);
3230                 *s = tmp;
3231         }
3232         return rc;
3233 }
3234
3235 /*
3236  * Check if path is remote (e.g. a DFS share). Return -EREMOTE if it is,
3237  * otherwise 0.
3238  */
3239 static int is_path_remote(struct cifs_sb_info *cifs_sb, struct smb3_fs_context *ctx,
3240                           const unsigned int xid,
3241                           struct TCP_Server_Info *server,
3242                           struct cifs_tcon *tcon)
3243 {
3244         int rc;
3245         char *full_path;
3246
3247         if (!server->ops->is_path_accessible)
3248                 return -EOPNOTSUPP;
3249
3250         /*
3251          * cifs_build_path_to_root works only when we have a valid tcon
3252          */
3253         full_path = cifs_build_path_to_root(ctx, cifs_sb, tcon,
3254                                             tcon->Flags & SMB_SHARE_IS_IN_DFS);
3255         if (full_path == NULL)
3256                 return -ENOMEM;
3257
3258         cifs_dbg(FYI, "%s: full_path: %s\n", __func__, full_path);
3259
3260         rc = server->ops->is_path_accessible(xid, tcon, cifs_sb,
3261                                              full_path);
3262         if (rc != 0 && rc != -EREMOTE) {
3263                 kfree(full_path);
3264                 return rc;
3265         }
3266
3267         if (rc != -EREMOTE) {
3268                 rc = cifs_are_all_path_components_accessible(server, xid, tcon,
3269                         cifs_sb, full_path, tcon->Flags & SMB_SHARE_IS_IN_DFS);
3270                 if (rc != 0) {
3271                         cifs_server_dbg(VFS, "cannot query dirs between root and final path, enabling CIFS_MOUNT_USE_PREFIX_PATH\n");
3272                         cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_USE_PREFIX_PATH;
3273                         rc = 0;
3274                 }
3275         }
3276
3277         kfree(full_path);
3278         return rc;
3279 }
3280
3281 #ifdef CONFIG_CIFS_DFS_UPCALL
3282 static void set_root_ses(struct cifs_sb_info *cifs_sb, const uuid_t *mount_id, struct cifs_ses *ses,
3283                          struct cifs_ses **root_ses)
3284 {
3285         if (ses) {
3286                 spin_lock(&cifs_tcp_ses_lock);
3287                 ses->ses_count++;
3288                 spin_unlock(&cifs_tcp_ses_lock);
3289                 dfs_cache_add_refsrv_session(mount_id, ses);
3290         }
3291         *root_ses = ses;
3292 }
3293
3294 /* Set up next dfs prefix path in @dfs_path */
3295 static int next_dfs_prepath(struct cifs_sb_info *cifs_sb, struct smb3_fs_context *ctx,
3296                             const unsigned int xid, struct TCP_Server_Info *server,
3297                             struct cifs_tcon *tcon, char **dfs_path)
3298 {
3299         char *path, *npath;
3300         int added_treename = is_tcon_dfs(tcon);
3301         int rc;
3302
3303         path = cifs_build_path_to_root(ctx, cifs_sb, tcon, added_treename);
3304         if (!path)
3305                 return -ENOMEM;
3306
3307         rc = is_path_remote(cifs_sb, ctx, xid, server, tcon);
3308         if (rc == -EREMOTE) {
3309                 struct smb3_fs_context v = {NULL};
3310                 /* if @path contains a tree name, skip it in the prefix path */
3311                 if (added_treename) {
3312                         rc = smb3_parse_devname(path, &v);
3313                         if (rc)
3314                                 goto out;
3315                         npath = build_unc_path_to_root(&v, cifs_sb, true);
3316                         smb3_cleanup_fs_context_contents(&v);
3317                 } else {
3318                         v.UNC = ctx->UNC;
3319                         v.prepath = path + 1;
3320                         npath = build_unc_path_to_root(&v, cifs_sb, true);
3321                 }
3322
3323                 if (IS_ERR(npath)) {
3324                         rc = PTR_ERR(npath);
3325                         goto out;
3326                 }
3327
3328                 kfree(*dfs_path);
3329                 *dfs_path = npath;
3330                 rc = -EREMOTE;
3331         }
3332
3333 out:
3334         kfree(path);
3335         return rc;
3336 }
3337
3338 /* Check if resolved targets can handle any DFS referrals */
3339 static int is_referral_server(const char *ref_path, struct cifs_sb_info *cifs_sb,
3340                               struct cifs_tcon *tcon, bool *ref_server)
3341 {
3342         int rc;
3343         struct dfs_info3_param ref = {0};
3344
3345         cifs_dbg(FYI, "%s: ref_path=%s\n", __func__, ref_path);
3346
3347         if (is_tcon_dfs(tcon)) {
3348                 *ref_server = true;
3349         } else {
3350                 char *npath;
3351
3352                 npath = dfs_cache_canonical_path(ref_path, cifs_sb->local_nls, cifs_remap(cifs_sb));
3353                 if (IS_ERR(npath))
3354                         return PTR_ERR(npath);
3355
3356                 rc = dfs_cache_noreq_find(npath, &ref, NULL);
3357                 kfree(npath);
3358                 if (rc) {
3359                         cifs_dbg(VFS, "%s: dfs_cache_noreq_find: failed (rc=%d)\n", __func__, rc);
3360                         return rc;
3361                 }
3362                 cifs_dbg(FYI, "%s: ref.flags=0x%x\n", __func__, ref.flags);
3363                 /*
3364                  * Check if all targets are capable of handling DFS referrals as per
3365                  * MS-DFSC 2.2.4 RESP_GET_DFS_REFERRAL.
3366                  */
3367                 *ref_server = !!(ref.flags & DFSREF_REFERRAL_SERVER);
3368                 free_dfs_info_param(&ref);
3369         }
3370         return 0;
3371 }
3372
3373 int cifs_mount(struct cifs_sb_info *cifs_sb, struct smb3_fs_context *ctx)
3374 {
3375         int rc = 0;
3376         unsigned int xid;
3377         struct TCP_Server_Info *server = NULL;
3378         struct cifs_ses *ses = NULL, *root_ses = NULL;
3379         struct cifs_tcon *tcon = NULL;
3380         int count = 0;
3381         uuid_t mount_id = {0};
3382         char *ref_path = NULL, *full_path = NULL;
3383         char *oldmnt = NULL;
3384         bool ref_server = false;
3385
3386         rc = mount_get_conns(ctx, cifs_sb, &xid, &server, &ses, &tcon);
3387         /*
3388          * If called with 'nodfs' mount option, then skip DFS resolving.  Otherwise unconditionally
3389          * try to get an DFS referral (even cached) to determine whether it is an DFS mount.
3390          *
3391          * Skip prefix path to provide support for DFS referrals from w2k8 servers which don't seem
3392          * to respond with PATH_NOT_COVERED to requests that include the prefix.
3393          */
3394         if ((cifs_sb->mnt_cifs_flags & CIFS_MOUNT_NO_DFS) ||
3395             dfs_cache_find(xid, ses, cifs_sb->local_nls, cifs_remap(cifs_sb), ctx->UNC + 1, NULL,
3396                            NULL)) {
3397                 if (rc)
3398                         goto error;
3399                 /* Check if it is fully accessible and then mount it */
3400                 rc = is_path_remote(cifs_sb, ctx, xid, server, tcon);
3401                 if (!rc)
3402                         goto out;
3403                 if (rc != -EREMOTE)
3404                         goto error;
3405         }
3406
3407         ctx->nosharesock = true;
3408
3409         /* Get path of DFS root */
3410         ref_path = build_unc_path_to_root(ctx, cifs_sb, false);
3411         if (IS_ERR(ref_path)) {
3412                 rc = PTR_ERR(ref_path);
3413                 ref_path = NULL;
3414                 goto error;
3415         }
3416
3417         uuid_gen(&mount_id);
3418         set_root_ses(cifs_sb, &mount_id, ses, &root_ses);
3419         do {
3420                 /* Save full path of last DFS path we used to resolve final target server */
3421                 kfree(full_path);
3422                 full_path = build_unc_path_to_root(ctx, cifs_sb, !!count);
3423                 if (IS_ERR(full_path)) {
3424                         rc = PTR_ERR(full_path);
3425                         full_path = NULL;
3426                         break;
3427                 }
3428                 /* Chase referral */
3429                 oldmnt = cifs_sb->ctx->mount_options;
3430                 rc = expand_dfs_referral(xid, root_ses, ctx, cifs_sb, ref_path + 1);
3431                 if (rc)
3432                         break;
3433                 /* Connect to new DFS target only if we were redirected */
3434                 if (oldmnt != cifs_sb->ctx->mount_options) {
3435                         mount_put_conns(cifs_sb, xid, server, ses, tcon);
3436                         rc = mount_get_conns(ctx, cifs_sb, &xid, &server, &ses, &tcon);
3437                 }
3438                 if (rc && !server && !ses) {
3439                         /* Failed to connect. Try to connect to other targets in the referral. */
3440                         rc = do_dfs_failover(ref_path + 1, full_path, cifs_sb, ctx, root_ses, &xid,
3441                                              &server, &ses, &tcon);
3442                 }
3443                 if (rc == -EACCES || rc == -EOPNOTSUPP || !server || !ses)
3444                         break;
3445                 if (!tcon)
3446                         continue;
3447
3448                 /* Make sure that requests go through new root servers */
3449                 rc = is_referral_server(ref_path + 1, cifs_sb, tcon, &ref_server);
3450                 if (rc)
3451                         break;
3452                 if (ref_server)
3453                         set_root_ses(cifs_sb, &mount_id, ses, &root_ses);
3454
3455                 /* Get next dfs path and then continue chasing them if -EREMOTE */
3456                 rc = next_dfs_prepath(cifs_sb, ctx, xid, server, tcon, &ref_path);
3457                 /* Prevent recursion on broken link referrals */
3458                 if (rc == -EREMOTE && ++count > MAX_NESTED_LINKS)
3459                         rc = -ELOOP;
3460         } while (rc == -EREMOTE);
3461
3462         if (rc || !tcon)
3463                 goto error;
3464
3465         kfree(ref_path);
3466         /*
3467          * Store DFS full path in both superblock and tree connect structures.
3468          *
3469          * For DFS root mounts, the prefix path (cifs_sb->prepath) is preserved during reconnect so
3470          * only the root path is set in cifs_sb->origin_fullpath and tcon->dfs_path. And for DFS
3471          * links, the prefix path is included in both and may be changed during reconnect.  See
3472          * cifs_tree_connect().
3473          */
3474         ref_path = dfs_cache_canonical_path(full_path, cifs_sb->local_nls, cifs_remap(cifs_sb));
3475         kfree(full_path);
3476         full_path = NULL;
3477
3478         if (IS_ERR(ref_path)) {
3479                 rc = PTR_ERR(ref_path);
3480                 ref_path = NULL;
3481                 goto error;
3482         }
3483         cifs_sb->origin_fullpath = ref_path;
3484
3485         ref_path = kstrdup(cifs_sb->origin_fullpath, GFP_KERNEL);
3486         if (!ref_path) {
3487                 rc = -ENOMEM;
3488                 goto error;
3489         }
3490         spin_lock(&cifs_tcp_ses_lock);
3491         tcon->dfs_path = ref_path;
3492         ref_path = NULL;
3493         spin_unlock(&cifs_tcp_ses_lock);
3494
3495         /*
3496          * After reconnecting to a different server, unique ids won't
3497          * match anymore, so we disable serverino. This prevents
3498          * dentry revalidation to think the dentry are stale (ESTALE).
3499          */
3500         cifs_autodisable_serverino(cifs_sb);
3501         /*
3502          * Force the use of prefix path to support failover on DFS paths that
3503          * resolve to targets that have different prefix paths.
3504          */
3505         cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_USE_PREFIX_PATH;
3506         kfree(cifs_sb->prepath);
3507         cifs_sb->prepath = ctx->prepath;
3508         ctx->prepath = NULL;
3509         uuid_copy(&cifs_sb->dfs_mount_id, &mount_id);
3510
3511 out:
3512         free_xid(xid);
3513         cifs_try_adding_channels(cifs_sb, ses);
3514         return mount_setup_tlink(cifs_sb, ses, tcon);
3515
3516 error:
3517         kfree(ref_path);
3518         kfree(full_path);
3519         kfree(cifs_sb->origin_fullpath);
3520         dfs_cache_put_refsrv_sessions(&mount_id);
3521         mount_put_conns(cifs_sb, xid, server, ses, tcon);
3522         return rc;
3523 }
3524 #else
3525 int cifs_mount(struct cifs_sb_info *cifs_sb, struct smb3_fs_context *ctx)
3526 {
3527         int rc = 0;
3528         unsigned int xid;
3529         struct cifs_ses *ses;
3530         struct cifs_tcon *tcon;
3531         struct TCP_Server_Info *server;
3532
3533         rc = mount_get_conns(ctx, cifs_sb, &xid, &server, &ses, &tcon);
3534         if (rc)
3535                 goto error;
3536
3537         if (tcon) {
3538                 rc = is_path_remote(cifs_sb, ctx, xid, server, tcon);
3539                 if (rc == -EREMOTE)
3540                         rc = -EOPNOTSUPP;
3541                 if (rc)
3542                         goto error;
3543         }
3544
3545         free_xid(xid);
3546
3547         return mount_setup_tlink(cifs_sb, ses, tcon);
3548
3549 error:
3550         mount_put_conns(cifs_sb, xid, server, ses, tcon);
3551         return rc;
3552 }
3553 #endif
3554
3555 /*
3556  * Issue a TREE_CONNECT request.
3557  */
3558 int
3559 CIFSTCon(const unsigned int xid, struct cifs_ses *ses,
3560          const char *tree, struct cifs_tcon *tcon,
3561          const struct nls_table *nls_codepage)
3562 {
3563         struct smb_hdr *smb_buffer;
3564         struct smb_hdr *smb_buffer_response;
3565         TCONX_REQ *pSMB;
3566         TCONX_RSP *pSMBr;
3567         unsigned char *bcc_ptr;
3568         int rc = 0;
3569         int length;
3570         __u16 bytes_left, count;
3571
3572         if (ses == NULL)
3573                 return -EIO;
3574
3575         smb_buffer = cifs_buf_get();
3576         if (smb_buffer == NULL)
3577                 return -ENOMEM;
3578
3579         smb_buffer_response = smb_buffer;
3580
3581         header_assemble(smb_buffer, SMB_COM_TREE_CONNECT_ANDX,
3582                         NULL /*no tid */ , 4 /*wct */ );
3583
3584         smb_buffer->Mid = get_next_mid(ses->server);
3585         smb_buffer->Uid = ses->Suid;
3586         pSMB = (TCONX_REQ *) smb_buffer;
3587         pSMBr = (TCONX_RSP *) smb_buffer_response;
3588
3589         pSMB->AndXCommand = 0xFF;
3590         pSMB->Flags = cpu_to_le16(TCON_EXTENDED_SECINFO);
3591         bcc_ptr = &pSMB->Password[0];
3592         if (tcon->pipe || (ses->server->sec_mode & SECMODE_USER)) {
3593                 pSMB->PasswordLength = cpu_to_le16(1);  /* minimum */
3594                 *bcc_ptr = 0; /* password is null byte */
3595                 bcc_ptr++;              /* skip password */
3596                 /* already aligned so no need to do it below */
3597         } else {
3598                 pSMB->PasswordLength = cpu_to_le16(CIFS_AUTH_RESP_SIZE);
3599                 /* BB FIXME add code to fail this if NTLMv2 or Kerberos
3600                    specified as required (when that support is added to
3601                    the vfs in the future) as only NTLM or the much
3602                    weaker LANMAN (which we do not send by default) is accepted
3603                    by Samba (not sure whether other servers allow
3604                    NTLMv2 password here) */
3605 #ifdef CONFIG_CIFS_WEAK_PW_HASH
3606                 if ((global_secflags & CIFSSEC_MAY_LANMAN) &&
3607                     (ses->sectype == LANMAN))
3608                         calc_lanman_hash(tcon->password, ses->server->cryptkey,
3609                                          ses->server->sec_mode &
3610                                             SECMODE_PW_ENCRYPT ? true : false,
3611                                          bcc_ptr);
3612                 else
3613 #endif /* CIFS_WEAK_PW_HASH */
3614                 rc = SMBNTencrypt(tcon->password, ses->server->cryptkey,
3615                                         bcc_ptr, nls_codepage);
3616                 if (rc) {
3617                         cifs_dbg(FYI, "%s Can't generate NTLM rsp. Error: %d\n",
3618                                  __func__, rc);
3619                         cifs_buf_release(smb_buffer);
3620                         return rc;
3621                 }
3622
3623                 bcc_ptr += CIFS_AUTH_RESP_SIZE;
3624                 if (ses->capabilities & CAP_UNICODE) {
3625                         /* must align unicode strings */
3626                         *bcc_ptr = 0; /* null byte password */
3627                         bcc_ptr++;
3628                 }
3629         }
3630
3631         if (ses->server->sign)
3632                 smb_buffer->Flags2 |= SMBFLG2_SECURITY_SIGNATURE;
3633
3634         if (ses->capabilities & CAP_STATUS32) {
3635                 smb_buffer->Flags2 |= SMBFLG2_ERR_STATUS;
3636         }
3637         if (ses->capabilities & CAP_DFS) {
3638                 smb_buffer->Flags2 |= SMBFLG2_DFS;
3639         }
3640         if (ses->capabilities & CAP_UNICODE) {
3641                 smb_buffer->Flags2 |= SMBFLG2_UNICODE;
3642                 length =
3643                     cifs_strtoUTF16((__le16 *) bcc_ptr, tree,
3644                         6 /* max utf8 char length in bytes */ *
3645                         (/* server len*/ + 256 /* share len */), nls_codepage);
3646                 bcc_ptr += 2 * length;  /* convert num 16 bit words to bytes */
3647                 bcc_ptr += 2;   /* skip trailing null */
3648         } else {                /* ASCII */
3649                 strcpy(bcc_ptr, tree);
3650                 bcc_ptr += strlen(tree) + 1;
3651         }
3652         strcpy(bcc_ptr, "?????");
3653         bcc_ptr += strlen("?????");
3654         bcc_ptr += 1;
3655         count = bcc_ptr - &pSMB->Password[0];
3656         be32_add_cpu(&pSMB->hdr.smb_buf_length, count);
3657         pSMB->ByteCount = cpu_to_le16(count);
3658
3659         rc = SendReceive(xid, ses, smb_buffer, smb_buffer_response, &length,
3660                          0);
3661
3662         /* above now done in SendReceive */
3663         if (rc == 0) {
3664                 bool is_unicode;
3665
3666                 tcon->tidStatus = CifsGood;
3667                 tcon->need_reconnect = false;
3668                 tcon->tid = smb_buffer_response->Tid;
3669                 bcc_ptr = pByteArea(smb_buffer_response);
3670                 bytes_left = get_bcc(smb_buffer_response);
3671                 length = strnlen(bcc_ptr, bytes_left - 2);
3672                 if (smb_buffer->Flags2 & SMBFLG2_UNICODE)
3673                         is_unicode = true;
3674                 else
3675                         is_unicode = false;
3676
3677
3678                 /* skip service field (NB: this field is always ASCII) */
3679                 if (length == 3) {
3680                         if ((bcc_ptr[0] == 'I') && (bcc_ptr[1] == 'P') &&
3681                             (bcc_ptr[2] == 'C')) {
3682                                 cifs_dbg(FYI, "IPC connection\n");
3683                                 tcon->ipc = true;
3684                                 tcon->pipe = true;
3685                         }
3686                 } else if (length == 2) {
3687                         if ((bcc_ptr[0] == 'A') && (bcc_ptr[1] == ':')) {
3688                                 /* the most common case */
3689                                 cifs_dbg(FYI, "disk share connection\n");
3690                         }
3691                 }
3692                 bcc_ptr += length + 1;
3693                 bytes_left -= (length + 1);
3694                 strlcpy(tcon->treeName, tree, sizeof(tcon->treeName));
3695
3696                 /* mostly informational -- no need to fail on error here */
3697                 kfree(tcon->nativeFileSystem);
3698                 tcon->nativeFileSystem = cifs_strndup_from_utf16(bcc_ptr,
3699                                                       bytes_left, is_unicode,
3700                                                       nls_codepage);
3701
3702                 cifs_dbg(FYI, "nativeFileSystem=%s\n", tcon->nativeFileSystem);
3703
3704                 if ((smb_buffer_response->WordCount == 3) ||
3705                          (smb_buffer_response->WordCount == 7))
3706                         /* field is in same location */
3707                         tcon->Flags = le16_to_cpu(pSMBr->OptionalSupport);
3708                 else
3709                         tcon->Flags = 0;
3710                 cifs_dbg(FYI, "Tcon flags: 0x%x\n", tcon->Flags);
3711         }
3712
3713         cifs_buf_release(smb_buffer);
3714         return rc;
3715 }
3716
3717 static void delayed_free(struct rcu_head *p)
3718 {
3719         struct cifs_sb_info *cifs_sb = container_of(p, struct cifs_sb_info, rcu);
3720
3721         unload_nls(cifs_sb->local_nls);
3722         smb3_cleanup_fs_context(cifs_sb->ctx);
3723         kfree(cifs_sb);
3724 }
3725
3726 void
3727 cifs_umount(struct cifs_sb_info *cifs_sb)
3728 {
3729         struct rb_root *root = &cifs_sb->tlink_tree;
3730         struct rb_node *node;
3731         struct tcon_link *tlink;
3732
3733         cancel_delayed_work_sync(&cifs_sb->prune_tlinks);
3734
3735         spin_lock(&cifs_sb->tlink_tree_lock);
3736         while ((node = rb_first(root))) {
3737                 tlink = rb_entry(node, struct tcon_link, tl_rbnode);
3738                 cifs_get_tlink(tlink);
3739                 clear_bit(TCON_LINK_IN_TREE, &tlink->tl_flags);
3740                 rb_erase(node, root);
3741
3742                 spin_unlock(&cifs_sb->tlink_tree_lock);
3743                 cifs_put_tlink(tlink);
3744                 spin_lock(&cifs_sb->tlink_tree_lock);
3745         }
3746         spin_unlock(&cifs_sb->tlink_tree_lock);
3747
3748         kfree(cifs_sb->prepath);
3749 #ifdef CONFIG_CIFS_DFS_UPCALL
3750         dfs_cache_put_refsrv_sessions(&cifs_sb->dfs_mount_id);
3751         kfree(cifs_sb->origin_fullpath);
3752 #endif
3753         call_rcu(&cifs_sb->rcu, delayed_free);
3754 }
3755
3756 int
3757 cifs_negotiate_protocol(const unsigned int xid, struct cifs_ses *ses)
3758 {
3759         int rc = 0;
3760         struct TCP_Server_Info *server = cifs_ses_server(ses);
3761
3762         if (!server->ops->need_neg || !server->ops->negotiate)
3763                 return -ENOSYS;
3764
3765         /* only send once per connect */
3766         if (!server->ops->need_neg(server))
3767                 return 0;
3768
3769         rc = server->ops->negotiate(xid, ses);
3770         if (rc == 0) {
3771                 spin_lock(&GlobalMid_Lock);
3772                 if (server->tcpStatus == CifsNeedNegotiate)
3773                         server->tcpStatus = CifsGood;
3774                 else
3775                         rc = -EHOSTDOWN;
3776                 spin_unlock(&GlobalMid_Lock);
3777         }
3778
3779         return rc;
3780 }
3781
3782 int
3783 cifs_setup_session(const unsigned int xid, struct cifs_ses *ses,
3784                    struct nls_table *nls_info)
3785 {
3786         int rc = -ENOSYS;
3787         struct TCP_Server_Info *server = cifs_ses_server(ses);
3788
3789         if (!ses->binding) {
3790                 ses->capabilities = server->capabilities;
3791                 if (!linuxExtEnabled)
3792                         ses->capabilities &= (~server->vals->cap_unix);
3793
3794                 if (ses->auth_key.response) {
3795                         cifs_dbg(FYI, "Free previous auth_key.response = %p\n",
3796                                  ses->auth_key.response);
3797                         kfree(ses->auth_key.response);
3798                         ses->auth_key.response = NULL;
3799                         ses->auth_key.len = 0;
3800                 }
3801         }
3802
3803         cifs_dbg(FYI, "Security Mode: 0x%x Capabilities: 0x%x TimeAdjust: %d\n",
3804                  server->sec_mode, server->capabilities, server->timeAdj);
3805
3806         if (server->ops->sess_setup)
3807                 rc = server->ops->sess_setup(xid, ses, nls_info);
3808
3809         if (rc)
3810                 cifs_server_dbg(VFS, "Send error in SessSetup = %d\n", rc);
3811
3812         return rc;
3813 }
3814
3815 static int
3816 cifs_set_vol_auth(struct smb3_fs_context *ctx, struct cifs_ses *ses)
3817 {
3818         ctx->sectype = ses->sectype;
3819
3820         /* krb5 is special, since we don't need username or pw */
3821         if (ctx->sectype == Kerberos)
3822                 return 0;
3823
3824         return cifs_set_cifscreds(ctx, ses);
3825 }
3826
3827 static struct cifs_tcon *
3828 cifs_construct_tcon(struct cifs_sb_info *cifs_sb, kuid_t fsuid)
3829 {
3830         int rc;
3831         struct cifs_tcon *master_tcon = cifs_sb_master_tcon(cifs_sb);
3832         struct cifs_ses *ses;
3833         struct cifs_tcon *tcon = NULL;
3834         struct smb3_fs_context *ctx;
3835
3836         ctx = kzalloc(sizeof(*ctx), GFP_KERNEL);
3837         if (ctx == NULL)
3838                 return ERR_PTR(-ENOMEM);
3839
3840         ctx->local_nls = cifs_sb->local_nls;
3841         ctx->linux_uid = fsuid;
3842         ctx->cred_uid = fsuid;
3843         ctx->UNC = master_tcon->treeName;
3844         ctx->retry = master_tcon->retry;
3845         ctx->nocase = master_tcon->nocase;
3846         ctx->nohandlecache = master_tcon->nohandlecache;
3847         ctx->local_lease = master_tcon->local_lease;
3848         ctx->no_lease = master_tcon->no_lease;
3849         ctx->resilient = master_tcon->use_resilient;
3850         ctx->persistent = master_tcon->use_persistent;
3851         ctx->handle_timeout = master_tcon->handle_timeout;
3852         ctx->no_linux_ext = !master_tcon->unix_ext;
3853         ctx->linux_ext = master_tcon->posix_extensions;
3854         ctx->sectype = master_tcon->ses->sectype;
3855         ctx->sign = master_tcon->ses->sign;
3856         ctx->seal = master_tcon->seal;
3857         ctx->witness = master_tcon->use_witness;
3858
3859         rc = cifs_set_vol_auth(ctx, master_tcon->ses);
3860         if (rc) {
3861                 tcon = ERR_PTR(rc);
3862                 goto out;
3863         }
3864
3865         /* get a reference for the same TCP session */
3866         spin_lock(&cifs_tcp_ses_lock);
3867         ++master_tcon->ses->server->srv_count;
3868         spin_unlock(&cifs_tcp_ses_lock);
3869
3870         ses = cifs_get_smb_ses(master_tcon->ses->server, ctx);
3871         if (IS_ERR(ses)) {
3872                 tcon = (struct cifs_tcon *)ses;
3873                 cifs_put_tcp_session(master_tcon->ses->server, 0);
3874                 goto out;
3875         }
3876
3877         tcon = cifs_get_tcon(ses, ctx);
3878         if (IS_ERR(tcon)) {
3879                 cifs_put_smb_ses(ses);
3880                 goto out;
3881         }
3882
3883         if (cap_unix(ses))
3884                 reset_cifs_unix_caps(0, tcon, NULL, ctx);
3885
3886 out:
3887         kfree(ctx->username);
3888         kfree_sensitive(ctx->password);
3889         kfree(ctx);
3890
3891         return tcon;
3892 }
3893
3894 struct cifs_tcon *
3895 cifs_sb_master_tcon(struct cifs_sb_info *cifs_sb)
3896 {
3897         return tlink_tcon(cifs_sb_master_tlink(cifs_sb));
3898 }
3899
3900 /* find and return a tlink with given uid */
3901 static struct tcon_link *
3902 tlink_rb_search(struct rb_root *root, kuid_t uid)
3903 {
3904         struct rb_node *node = root->rb_node;
3905         struct tcon_link *tlink;
3906
3907         while (node) {
3908                 tlink = rb_entry(node, struct tcon_link, tl_rbnode);
3909
3910                 if (uid_gt(tlink->tl_uid, uid))
3911                         node = node->rb_left;
3912                 else if (uid_lt(tlink->tl_uid, uid))
3913                         node = node->rb_right;
3914                 else
3915                         return tlink;
3916         }
3917         return NULL;
3918 }
3919
3920 /* insert a tcon_link into the tree */
3921 static void
3922 tlink_rb_insert(struct rb_root *root, struct tcon_link *new_tlink)
3923 {
3924         struct rb_node **new = &(root->rb_node), *parent = NULL;
3925         struct tcon_link *tlink;
3926
3927         while (*new) {
3928                 tlink = rb_entry(*new, struct tcon_link, tl_rbnode);
3929                 parent = *new;
3930
3931                 if (uid_gt(tlink->tl_uid, new_tlink->tl_uid))
3932                         new = &((*new)->rb_left);
3933                 else
3934                         new = &((*new)->rb_right);
3935         }
3936
3937         rb_link_node(&new_tlink->tl_rbnode, parent, new);
3938         rb_insert_color(&new_tlink->tl_rbnode, root);
3939 }
3940
3941 /*
3942  * Find or construct an appropriate tcon given a cifs_sb and the fsuid of the
3943  * current task.
3944  *
3945  * If the superblock doesn't refer to a multiuser mount, then just return
3946  * the master tcon for the mount.
3947  *
3948  * First, search the rbtree for an existing tcon for this fsuid. If one
3949  * exists, then check to see if it's pending construction. If it is then wait
3950  * for construction to complete. Once it's no longer pending, check to see if
3951  * it failed and either return an error or retry construction, depending on
3952  * the timeout.
3953  *
3954  * If one doesn't exist then insert a new tcon_link struct into the tree and
3955  * try to construct a new one.
3956  */
3957 struct tcon_link *
3958 cifs_sb_tlink(struct cifs_sb_info *cifs_sb)
3959 {
3960         int ret;
3961         kuid_t fsuid = current_fsuid();
3962         struct tcon_link *tlink, *newtlink;
3963
3964         if (!(cifs_sb->mnt_cifs_flags & CIFS_MOUNT_MULTIUSER))
3965                 return cifs_get_tlink(cifs_sb_master_tlink(cifs_sb));
3966
3967         spin_lock(&cifs_sb->tlink_tree_lock);
3968         tlink = tlink_rb_search(&cifs_sb->tlink_tree, fsuid);
3969         if (tlink)
3970                 cifs_get_tlink(tlink);
3971         spin_unlock(&cifs_sb->tlink_tree_lock);
3972
3973         if (tlink == NULL) {
3974                 newtlink = kzalloc(sizeof(*tlink), GFP_KERNEL);
3975                 if (newtlink == NULL)
3976                         return ERR_PTR(-ENOMEM);
3977                 newtlink->tl_uid = fsuid;
3978                 newtlink->tl_tcon = ERR_PTR(-EACCES);
3979                 set_bit(TCON_LINK_PENDING, &newtlink->tl_flags);
3980                 set_bit(TCON_LINK_IN_TREE, &newtlink->tl_flags);
3981                 cifs_get_tlink(newtlink);
3982
3983                 spin_lock(&cifs_sb->tlink_tree_lock);
3984                 /* was one inserted after previous search? */
3985                 tlink = tlink_rb_search(&cifs_sb->tlink_tree, fsuid);
3986                 if (tlink) {
3987                         cifs_get_tlink(tlink);
3988                         spin_unlock(&cifs_sb->tlink_tree_lock);
3989                         kfree(newtlink);
3990                         goto wait_for_construction;
3991                 }
3992                 tlink = newtlink;
3993                 tlink_rb_insert(&cifs_sb->tlink_tree, tlink);
3994                 spin_unlock(&cifs_sb->tlink_tree_lock);
3995         } else {
3996 wait_for_construction:
3997                 ret = wait_on_bit(&tlink->tl_flags, TCON_LINK_PENDING,
3998                                   TASK_INTERRUPTIBLE);
3999                 if (ret) {
4000                         cifs_put_tlink(tlink);
4001                         return ERR_PTR(-ERESTARTSYS);
4002                 }
4003
4004                 /* if it's good, return it */
4005                 if (!IS_ERR(tlink->tl_tcon))
4006                         return tlink;
4007
4008                 /* return error if we tried this already recently */
4009                 if (time_before(jiffies, tlink->tl_time + TLINK_ERROR_EXPIRE)) {
4010                         cifs_put_tlink(tlink);
4011                         return ERR_PTR(-EACCES);
4012                 }
4013
4014                 if (test_and_set_bit(TCON_LINK_PENDING, &tlink->tl_flags))
4015                         goto wait_for_construction;
4016         }
4017
4018         tlink->tl_tcon = cifs_construct_tcon(cifs_sb, fsuid);
4019         clear_bit(TCON_LINK_PENDING, &tlink->tl_flags);
4020         wake_up_bit(&tlink->tl_flags, TCON_LINK_PENDING);
4021
4022         if (IS_ERR(tlink->tl_tcon)) {
4023                 cifs_put_tlink(tlink);
4024                 return ERR_PTR(-EACCES);
4025         }
4026
4027         return tlink;
4028 }
4029
4030 /*
4031  * periodic workqueue job that scans tcon_tree for a superblock and closes
4032  * out tcons.
4033  */
4034 static void
4035 cifs_prune_tlinks(struct work_struct *work)
4036 {
4037         struct cifs_sb_info *cifs_sb = container_of(work, struct cifs_sb_info,
4038                                                     prune_tlinks.work);
4039         struct rb_root *root = &cifs_sb->tlink_tree;
4040         struct rb_node *node;
4041         struct rb_node *tmp;
4042         struct tcon_link *tlink;
4043
4044         /*
4045          * Because we drop the spinlock in the loop in order to put the tlink
4046          * it's not guarded against removal of links from the tree. The only
4047          * places that remove entries from the tree are this function and
4048          * umounts. Because this function is non-reentrant and is canceled
4049          * before umount can proceed, this is safe.
4050          */
4051         spin_lock(&cifs_sb->tlink_tree_lock);
4052         node = rb_first(root);
4053         while (node != NULL) {
4054                 tmp = node;
4055                 node = rb_next(tmp);
4056                 tlink = rb_entry(tmp, struct tcon_link, tl_rbnode);
4057
4058                 if (test_bit(TCON_LINK_MASTER, &tlink->tl_flags) ||
4059                     atomic_read(&tlink->tl_count) != 0 ||
4060                     time_after(tlink->tl_time + TLINK_IDLE_EXPIRE, jiffies))
4061                         continue;
4062
4063                 cifs_get_tlink(tlink);
4064                 clear_bit(TCON_LINK_IN_TREE, &tlink->tl_flags);
4065                 rb_erase(tmp, root);
4066
4067                 spin_unlock(&cifs_sb->tlink_tree_lock);
4068                 cifs_put_tlink(tlink);
4069                 spin_lock(&cifs_sb->tlink_tree_lock);
4070         }
4071         spin_unlock(&cifs_sb->tlink_tree_lock);
4072
4073         queue_delayed_work(cifsiod_wq, &cifs_sb->prune_tlinks,
4074                                 TLINK_IDLE_EXPIRE);
4075 }
4076
4077 #ifdef CONFIG_CIFS_DFS_UPCALL
4078 int cifs_tree_connect(const unsigned int xid, struct cifs_tcon *tcon, const struct nls_table *nlsc)
4079 {
4080         int rc;
4081         struct TCP_Server_Info *server = tcon->ses->server;
4082         const struct smb_version_operations *ops = server->ops;
4083         struct dfs_cache_tgt_list tl;
4084         struct dfs_cache_tgt_iterator *it = NULL;
4085         char *tree;
4086         const char *tcp_host;
4087         size_t tcp_host_len;
4088         const char *dfs_host;
4089         size_t dfs_host_len;
4090         char *share = NULL, *prefix = NULL;
4091         struct dfs_info3_param ref = {0};
4092         bool isroot;
4093
4094         tree = kzalloc(MAX_TREE_SIZE, GFP_KERNEL);
4095         if (!tree)
4096                 return -ENOMEM;
4097
4098         if (!tcon->dfs_path) {
4099                 if (tcon->ipc) {
4100                         scnprintf(tree, MAX_TREE_SIZE, "\\\\%s\\IPC$", server->hostname);
4101                         rc = ops->tree_connect(xid, tcon->ses, tree, tcon, nlsc);
4102                 } else {
4103                         rc = ops->tree_connect(xid, tcon->ses, tcon->treeName, tcon, nlsc);
4104                 }
4105                 goto out;
4106         }
4107
4108         rc = dfs_cache_noreq_find(tcon->dfs_path + 1, &ref, &tl);
4109         if (rc)
4110                 goto out;
4111         isroot = ref.server_type == DFS_TYPE_ROOT;
4112         free_dfs_info_param(&ref);
4113
4114         extract_unc_hostname(server->hostname, &tcp_host, &tcp_host_len);
4115
4116         for (it = dfs_cache_get_tgt_iterator(&tl); it; it = dfs_cache_get_next_tgt(&tl, it)) {
4117                 bool target_match;
4118
4119                 kfree(share);
4120                 kfree(prefix);
4121                 share = NULL;
4122                 prefix = NULL;
4123
4124                 rc = dfs_cache_get_tgt_share(tcon->dfs_path + 1, it, &share, &prefix);
4125                 if (rc) {
4126                         cifs_dbg(VFS, "%s: failed to parse target share %d\n",
4127                                  __func__, rc);
4128                         continue;
4129                 }
4130
4131                 extract_unc_hostname(share, &dfs_host, &dfs_host_len);
4132
4133                 if (dfs_host_len != tcp_host_len
4134                     || strncasecmp(dfs_host, tcp_host, dfs_host_len) != 0) {
4135                         cifs_dbg(FYI, "%s: %.*s doesn't match %.*s\n", __func__, (int)dfs_host_len,
4136                                  dfs_host, (int)tcp_host_len, tcp_host);
4137
4138                         rc = match_target_ip(server, dfs_host, dfs_host_len, &target_match);
4139                         if (rc) {
4140                                 cifs_dbg(VFS, "%s: failed to match target ip: %d\n", __func__, rc);
4141                                 break;
4142                         }
4143
4144                         if (!target_match) {
4145                                 cifs_dbg(FYI, "%s: skipping target\n", __func__);
4146                                 continue;
4147                         }
4148                 }
4149
4150                 if (tcon->ipc) {
4151                         scnprintf(tree, MAX_TREE_SIZE, "\\\\%s\\IPC$", share);
4152                         rc = ops->tree_connect(xid, tcon->ses, tree, tcon, nlsc);
4153                 } else {
4154                         scnprintf(tree, MAX_TREE_SIZE, "\\%s", share);
4155                         rc = ops->tree_connect(xid, tcon->ses, tree, tcon, nlsc);
4156                         /* Only handle prefix paths of DFS link targets */
4157                         if (!rc && !isroot) {
4158                                 rc = update_super_prepath(tcon, prefix);
4159                                 break;
4160                         }
4161                 }
4162                 if (rc == -EREMOTE)
4163                         break;
4164         }
4165
4166         kfree(share);
4167         kfree(prefix);
4168
4169         if (!rc) {
4170                 if (it)
4171                         rc = dfs_cache_noreq_update_tgthint(tcon->dfs_path + 1, it);
4172                 else
4173                         rc = -ENOENT;
4174         }
4175         dfs_cache_free_tgts(&tl);
4176 out:
4177         kfree(tree);
4178         return rc;
4179 }
4180 #else
4181 int cifs_tree_connect(const unsigned int xid, struct cifs_tcon *tcon, const struct nls_table *nlsc)
4182 {
4183         const struct smb_version_operations *ops = tcon->ses->server->ops;
4184
4185         return ops->tree_connect(xid, tcon->ses, tcon->treeName, tcon, nlsc);
4186 }
4187 #endif