fs/cifs/smb2pdu.c

   1 /*
   2  *   fs/cifs/smb2pdu.c
   3  *
   4  *   Copyright (C) International Business Machines  Corp., 2009, 2013
   5  *                 Etersoft, 2012
   6  *   Author(s): Steve French (sfrench@us.ibm.com)
   7  *              Pavel Shilovsky (pshilovsky@samba.org) 2012
   8  *
   9  *   Contains the routines for constructing the SMB2 PDUs themselves
  10  *
  11  *   This library is free software; you can redistribute it and/or modify
  12  *   it under the terms of the GNU Lesser General Public License as published
  13  *   by the Free Software Foundation; either version 2.1 of the License, or
  14  *   (at your option) any later version.
  15  *
  16  *   This library is distributed in the hope that it will be useful,
  17  *   but WITHOUT ANY WARRANTY; without even the implied warranty of
  18  *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See
  19  *   the GNU Lesser General Public License for more details.
  20  *
  21  *   You should have received a copy of the GNU Lesser General Public License
  22  *   along with this library; if not, write to the Free Software
  23  *   Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
  24  */
  25
  26  /* SMB2 PDU handling routines here - except for leftovers (eg session setup) */
  27  /* Note that there are handle based routines which must be                   */
  28  /* treated slightly differently for reconnection purposes since we never     */
  29  /* want to reuse a stale file handle and only the caller knows the file info */
  30
  31 #include <linux/fs.h>
  32 #include <linux/kernel.h>
  33 #include <linux/vfs.h>
  34 #include <linux/task_io_accounting_ops.h>
  35 #include <linux/uaccess.h>
  36 #include <linux/pagemap.h>
  37 #include <linux/xattr.h>
  38 #include "smb2pdu.h"
  39 #include "cifsglob.h"
  40 #include "cifsacl.h"
  41 #include "cifsproto.h"
  42 #include "smb2proto.h"
  43 #include "cifs_unicode.h"
  44 #include "cifs_debug.h"
  45 #include "ntlmssp.h"
  46 #include "smb2status.h"
  47 #include "smb2glob.h"
  48 #include "cifspdu.h"
  49
  50 /*
  51  *  The following table defines the expected "StructureSize" of SMB2 requests
  52  *  in order by SMB2 command.  This is similar to "wct" in SMB/CIFS requests.
  53  *
  54  *  Note that commands are defined in smb2pdu.h in le16 but the array below is
  55  *  indexed by command in host byte order.
  56  */
  57 static const int smb2_req_struct_sizes[NUMBER_OF_SMB2_COMMANDS] = {
  58         /* SMB2_NEGOTIATE */ 36,
  59         /* SMB2_SESSION_SETUP */ 25,
  60         /* SMB2_LOGOFF */ 4,
  61         /* SMB2_TREE_CONNECT */ 9,
  62         /* SMB2_TREE_DISCONNECT */ 4,
  63         /* SMB2_CREATE */ 57,
  64         /* SMB2_CLOSE */ 24,
  65         /* SMB2_FLUSH */ 24,
  66         /* SMB2_READ */ 49,
  67         /* SMB2_WRITE */ 49,
  68         /* SMB2_LOCK */ 48,
  69         /* SMB2_IOCTL */ 57,
  70         /* SMB2_CANCEL */ 4,
  71         /* SMB2_ECHO */ 4,
  72         /* SMB2_QUERY_DIRECTORY */ 33,
  73         /* SMB2_CHANGE_NOTIFY */ 32,
  74         /* SMB2_QUERY_INFO */ 41,
  75         /* SMB2_SET_INFO */ 33,
  76         /* SMB2_OPLOCK_BREAK */ 24 /* BB this is 36 for LEASE_BREAK variant */
  77 };
  78
  79
  80 static void
  81 smb2_hdr_assemble(struct smb2_hdr *hdr, __le16 smb2_cmd /* command */ ,
  82                   const struct cifs_tcon *tcon)
  83 {
  84         struct smb2_pdu *pdu = (struct smb2_pdu *)hdr;
  85         char *temp = (char *)hdr;
  86         /* lookup word count ie StructureSize from table */
  87         __u16 parmsize = smb2_req_struct_sizes[le16_to_cpu(smb2_cmd)];
  88
  89         /*
  90          * smaller than SMALL_BUFFER_SIZE but bigger than fixed area of
  91          * largest operations (Create)
  92          */
  93         memset(temp, 0, 256);
  94
  95         /* Note this is only network field converted to big endian */
  96         hdr->smb2_buf_length = cpu_to_be32(parmsize + sizeof(struct smb2_hdr)
  97                         - 4 /*  RFC 1001 length field itself not counted */);
  98
  99         hdr->ProtocolId[0] = 0xFE;
 100         hdr->ProtocolId[1] = 'S';
 101         hdr->ProtocolId[2] = 'M';
 102         hdr->ProtocolId[3] = 'B';
 103         hdr->StructureSize = cpu_to_le16(64);
 104         hdr->Command = smb2_cmd;
 105         hdr->CreditRequest = cpu_to_le16(2); /* BB make this dynamic */
 106         hdr->ProcessId = cpu_to_le32((__u16)current->tgid);
 107
 108         if (!tcon)
 109                 goto out;
 110
 111         /* BB FIXME when we do write > 64K add +1 for every 64K in req or rsp */
 112         /* GLOBAL_CAP_LARGE_MTU will only be set if dialect > SMB2.02 */
 113         /* See sections 2.2.4 and 3.2.4.1.5 of MS-SMB2 */
 114         if ((tcon->ses) &&
 115             (tcon->ses->server->capabilities & SMB2_GLOBAL_CAP_LARGE_MTU))
 116                 hdr->CreditCharge = cpu_to_le16(1);
 117         /* else CreditCharge MBZ */
 118
 119         hdr->TreeId = tcon->tid;
 120         /* Uid is not converted */
 121         if (tcon->ses)
 122                 hdr->SessionId = tcon->ses->Suid;
 123         /* BB check following DFS flags BB */
 124         /* BB do we have to add check for SHI1005_FLAGS_DFS_ROOT too? */
 125         if (tcon->share_flags & SHI1005_FLAGS_DFS)
 126                 hdr->Flags |= SMB2_FLAGS_DFS_OPERATIONS;
 127         /* BB how does SMB2 do case sensitive? */
 128         /* if (tcon->nocase)
 129                 hdr->Flags |= SMBFLG_CASELESS; */
 130         if (tcon->ses && tcon->ses->server && tcon->ses->server->sign)
 131                 hdr->Flags |= SMB2_FLAGS_SIGNED;
 132 out:
 133         pdu->StructureSize2 = cpu_to_le16(parmsize);
 134         return;
 135 }
 136
 137 static int
 138 smb2_reconnect(__le16 smb2_command, struct cifs_tcon *tcon)
 139 {
 140         int rc = 0;
 141         struct nls_table *nls_codepage;
 142         struct cifs_ses *ses;
 143         struct TCP_Server_Info *server;
 144
 145         /*
 146          * SMB2s NegProt, SessSetup, Logoff do not have tcon yet so
 147          * check for tcp and smb session status done differently
 148          * for those three - in the calling routine.
 149          */
 150         if (tcon == NULL)
 151                 return rc;
 152
 153         if (smb2_command == SMB2_TREE_CONNECT)
 154                 return rc;
 155
 156         if (tcon->tidStatus == CifsExiting) {
 157                 /*
 158                  * only tree disconnect, open, and write,
 159                  * (and ulogoff which does not have tcon)
 160                  * are allowed as we start force umount.
 161                  */
 162                 if ((smb2_command != SMB2_WRITE) &&
 163                    (smb2_command != SMB2_CREATE) &&
 164                    (smb2_command != SMB2_TREE_DISCONNECT)) {
 165                         cifs_dbg(FYI, "can not send cmd %d while umounting\n",
 166                                  smb2_command);
 167                         return -ENODEV;
 168                 }
 169         }
 170         if ((!tcon->ses) || (tcon->ses->status == CifsExiting) ||
 171             (!tcon->ses->server))
 172                 return -EIO;
 173
 174         ses = tcon->ses;
 175         server = ses->server;
 176
 177         /*
 178          * Give demultiplex thread up to 10 seconds to reconnect, should be
 179          * greater than cifs socket timeout which is 7 seconds
 180          */
 181         while (server->tcpStatus == CifsNeedReconnect) {
 182                 /*
 183                  * Return to caller for TREE_DISCONNECT and LOGOFF and CLOSE
 184                  * here since they are implicitly done when session drops.
 185                  */
 186                 switch (smb2_command) {
 187                 /*
 188                  * BB Should we keep oplock break and add flush to exceptions?
 189                  */
 190                 case SMB2_TREE_DISCONNECT:
 191                 case SMB2_CANCEL:
 192                 case SMB2_CLOSE:
 193                 case SMB2_OPLOCK_BREAK:
 194                         return -EAGAIN;
 195                 }
 196
 197                 wait_event_interruptible_timeout(server->response_q,
 198                         (server->tcpStatus != CifsNeedReconnect), 10 * HZ);
 199
 200                 /* are we still trying to reconnect? */
 201                 if (server->tcpStatus != CifsNeedReconnect)
 202                         break;
 203
 204                 /*
 205                  * on "soft" mounts we wait once. Hard mounts keep
 206                  * retrying until process is killed or server comes
 207                  * back on-line
 208                  */
 209                 if (!tcon->retry) {
 210                         cifs_dbg(FYI, "gave up waiting on reconnect in smb_init\n");
 211                         return -EHOSTDOWN;
 212                 }
 213         }
 214
 215         if (!tcon->ses->need_reconnect && !tcon->need_reconnect)
 216                 return rc;
 217
 218         nls_codepage = load_nls_default();
 219
 220         /*
 221          * need to prevent multiple threads trying to simultaneously reconnect
 222          * the same SMB session
 223          */
 224         mutex_lock(&tcon->ses->session_mutex);
 225         rc = cifs_negotiate_protocol(0, tcon->ses);
 226         if (!rc && tcon->ses->need_reconnect)
 227                 rc = cifs_setup_session(0, tcon->ses, nls_codepage);
 228
 229         if (rc || !tcon->need_reconnect) {
 230                 mutex_unlock(&tcon->ses->session_mutex);
 231                 goto out;
 232         }
 233
 234         cifs_mark_open_files_invalid(tcon);
 235         rc = SMB2_tcon(0, tcon->ses, tcon->treeName, tcon, nls_codepage);
 236         mutex_unlock(&tcon->ses->session_mutex);
 237         cifs_dbg(FYI, "reconnect tcon rc = %d\n", rc);
 238         if (rc)
 239                 goto out;
 240         atomic_inc(&tconInfoReconnectCount);
 241         /*
 242          * BB FIXME add code to check if wsize needs update due to negotiated
 243          * smb buffer size shrinking.
 244          */
 245 out:
 246         /*
 247          * Check if handle based operation so we know whether we can continue
 248          * or not without returning to caller to reset file handle.
 249          */
 250         /*
 251          * BB Is flush done by server on drop of tcp session? Should we special
 252          * case it and skip above?
 253          */
 254         switch (smb2_command) {
 255         case SMB2_FLUSH:
 256         case SMB2_READ:
 257         case SMB2_WRITE:
 258         case SMB2_LOCK:
 259         case SMB2_IOCTL:
 260         case SMB2_QUERY_DIRECTORY:
 261         case SMB2_CHANGE_NOTIFY:
 262         case SMB2_QUERY_INFO:
 263         case SMB2_SET_INFO:
 264                 return -EAGAIN;
 265         }
 266         unload_nls(nls_codepage);
 267         return rc;
 268 }
 269
 270 /*
 271  * Allocate and return pointer to an SMB request hdr, and set basic
 272  * SMB information in the SMB header. If the return code is zero, this
 273  * function must have filled in request_buf pointer.
 274  */
 275 static int
 276 small_smb2_init(__le16 smb2_command, struct cifs_tcon *tcon,
 277                 void **request_buf)
 278 {
 279         int rc = 0;
 280
 281         rc = smb2_reconnect(smb2_command, tcon);
 282         if (rc)
 283                 return rc;
 284
 285         /* BB eventually switch this to SMB2 specific small buf size */
 286         *request_buf = cifs_small_buf_get();
 287         if (*request_buf == NULL) {
 288                 /* BB should we add a retry in here if not a writepage? */
 289                 return -ENOMEM;
 290         }
 291
 292         smb2_hdr_assemble((struct smb2_hdr *) *request_buf, smb2_command, tcon);
 293
 294         if (tcon != NULL) {
 295 #ifdef CONFIG_CIFS_STATS2
 296                 uint16_t com_code = le16_to_cpu(smb2_command);
 297                 cifs_stats_inc(&tcon->stats.smb2_stats.smb2_com_sent[com_code]);
 298 #endif
 299                 cifs_stats_inc(&tcon->num_smbs_sent);
 300         }
 301
 302         return rc;
 303 }
 304
 305 static void
 306 free_rsp_buf(int resp_buftype, void *rsp)
 307 {
 308         if (resp_buftype == CIFS_SMALL_BUFFER)
 309                 cifs_small_buf_release(rsp);
 310         else if (resp_buftype == CIFS_LARGE_BUFFER)
 311                 cifs_buf_release(rsp);
 312 }
 313
 314
 315 /*
 316  *
 317  *      SMB2 Worker functions follow:
 318  *
 319  *      The general structure of the worker functions is:
 320  *      1) Call smb2_init (assembles SMB2 header)
 321  *      2) Initialize SMB2 command specific fields in fixed length area of SMB
 322  *      3) Call smb_sendrcv2 (sends request on socket and waits for response)
 323  *      4) Decode SMB2 command specific fields in the fixed length area
 324  *      5) Decode variable length data area (if any for this SMB2 command type)
 325  *      6) Call free smb buffer
 326  *      7) return
 327  *
 328  */
 329
 330 int
 331 SMB2_negotiate(const unsigned int xid, struct cifs_ses *ses)
 332 {
 333         struct smb2_negotiate_req *req;
 334         struct smb2_negotiate_rsp *rsp;
 335         struct kvec iov[1];
 336         int rc = 0;
 337         int resp_buftype;
 338         struct TCP_Server_Info *server = ses->server;
 339         int blob_offset, blob_length;
 340         char *security_blob;
 341         int flags = CIFS_NEG_OP;
 342
 343         cifs_dbg(FYI, "Negotiate protocol\n");
 344
 345         if (!server) {
 346                 WARN(1, "%s: server is NULL!\n", __func__);
 347                 return -EIO;
 348         }
 349
 350         rc = small_smb2_init(SMB2_NEGOTIATE, NULL, (void **) &req);
 351         if (rc)
 352                 return rc;
 353
 354         req->hdr.SessionId = 0;
 355
 356         req->Dialects[0] = cpu_to_le16(ses->server->vals->protocol_id);
 357
 358         req->DialectCount = cpu_to_le16(1); /* One vers= at a time for now */
 359         inc_rfc1001_len(req, 2);
 360
 361         /* only one of SMB2 signing flags may be set in SMB2 request */
 362         if (ses->sign)
 363                 req->SecurityMode = cpu_to_le16(SMB2_NEGOTIATE_SIGNING_REQUIRED);
 364         else if (global_secflags & CIFSSEC_MAY_SIGN)
 365                 req->SecurityMode = cpu_to_le16(SMB2_NEGOTIATE_SIGNING_ENABLED);
 366         else
 367                 req->SecurityMode = 0;
 368
 369         req->Capabilities = cpu_to_le32(ses->server->vals->req_capabilities);
 370
 371         memcpy(req->ClientGUID, cifs_client_guid, SMB2_CLIENT_GUID_SIZE);
 372
 373         iov[0].iov_base = (char *)req;
 374         /* 4 for rfc1002 length field */
 375         iov[0].iov_len = get_rfc1002_length(req) + 4;
 376
 377         rc = SendReceive2(xid, ses, iov, 1, &resp_buftype, flags);
 378
 379         rsp = (struct smb2_negotiate_rsp *)iov[0].iov_base;
 380         /*
 381          * No tcon so can't do
 382          * cifs_stats_inc(&tcon->stats.smb2_stats.smb2_com_fail[SMB2...]);
 383          */
 384         if (rc != 0)
 385                 goto neg_exit;
 386
 387         cifs_dbg(FYI, "mode 0x%x\n", rsp->SecurityMode);
 388
 389         /* BB we may eventually want to match the negotiated vs. requested
 390            dialect, even though we are only requesting one at a time */
 391         if (rsp->DialectRevision == cpu_to_le16(SMB20_PROT_ID))
 392                 cifs_dbg(FYI, "negotiated smb2.0 dialect\n");
 393         else if (rsp->DialectRevision == cpu_to_le16(SMB21_PROT_ID))
 394                 cifs_dbg(FYI, "negotiated smb2.1 dialect\n");
 395         else if (rsp->DialectRevision == cpu_to_le16(SMB30_PROT_ID))
 396                 cifs_dbg(FYI, "negotiated smb3.0 dialect\n");
 397         else if (rsp->DialectRevision == cpu_to_le16(SMB302_PROT_ID))
 398                 cifs_dbg(FYI, "negotiated smb3.02 dialect\n");
 399         else {
 400                 cifs_dbg(VFS, "Illegal dialect returned by server %d\n",
 401                          le16_to_cpu(rsp->DialectRevision));
 402                 rc = -EIO;
 403                 goto neg_exit;
 404         }
 405         server->dialect = le16_to_cpu(rsp->DialectRevision);
 406
 407         /* SMB2 only has an extended negflavor */
 408         server->negflavor = CIFS_NEGFLAVOR_EXTENDED;
 409         server->maxBuf = le32_to_cpu(rsp->MaxTransactSize);
 410         server->max_read = le32_to_cpu(rsp->MaxReadSize);
 411         server->max_write = le32_to_cpu(rsp->MaxWriteSize);
 412         /* BB Do we need to validate the SecurityMode? */
 413         server->sec_mode = le16_to_cpu(rsp->SecurityMode);
 414         server->capabilities = le32_to_cpu(rsp->Capabilities);
 415         /* Internal types */
 416         server->capabilities |= SMB2_NT_FIND | SMB2_LARGE_FILES;
 417
 418         security_blob = smb2_get_data_area_len(&blob_offset, &blob_length,
 419                                                &rsp->hdr);
 420         /*
 421          * See MS-SMB2 section 2.2.4: if no blob, client picks default which
 422          * for us will be
 423          *      ses->sectype = RawNTLMSSP;
 424          * but for time being this is our only auth choice so doesn't matter.
 425          * We just found a server which sets blob length to zero expecting raw.
 426          */
 427         if (blob_length == 0)
 428                 cifs_dbg(FYI, "missing security blob on negprot\n");
 429
 430         rc = cifs_enable_signing(server, ses->sign);
 431 #ifdef CONFIG_SMB2_ASN1  /* BB REMOVEME when updated asn1.c ready */
 432         if (rc)
 433                 goto neg_exit;
 434         if (blob_length)
 435                 rc = decode_neg_token_init(security_blob, blob_length,
 436                                    &server->sec_type);
 437         if (rc == 1)
 438                 rc = 0;
 439         else if (rc == 0) {
 440                 rc = -EIO;
 441                 goto neg_exit;
 442         }
 443 #endif
 444
 445 neg_exit:
 446         free_rsp_buf(resp_buftype, rsp);
 447         return rc;
 448 }
 449
 450 int
 451 SMB2_sess_setup(const unsigned int xid, struct cifs_ses *ses,
 452                 const struct nls_table *nls_cp)
 453 {
 454         struct smb2_sess_setup_req *req;
 455         struct smb2_sess_setup_rsp *rsp = NULL;
 456         struct kvec iov[2];
 457         int rc = 0;
 458         int resp_buftype;
 459         __le32 phase = NtLmNegotiate; /* NTLMSSP, if needed, is multistage */
 460         struct TCP_Server_Info *server = ses->server;
 461         u16 blob_length = 0;
 462         char *security_blob;
 463         char *ntlmssp_blob = NULL;
 464         bool use_spnego = false; /* else use raw ntlmssp */
 465
 466         cifs_dbg(FYI, "Session Setup\n");
 467
 468         if (!server) {
 469                 WARN(1, "%s: server is NULL!\n", __func__);
 470                 return -EIO;
 471         }
 472
 473         /*
 474          * If memory allocation is successful, caller of this function
 475          * frees it.
 476          */
 477         ses->ntlmssp = kmalloc(sizeof(struct ntlmssp_auth), GFP_KERNEL);
 478         if (!ses->ntlmssp)
 479                 return -ENOMEM;
 480
 481         /* FIXME: allow for other auth types besides NTLMSSP (e.g. krb5) */
 482         ses->sectype = RawNTLMSSP;
 483
 484 ssetup_ntlmssp_authenticate:
 485         if (phase == NtLmChallenge)
 486                 phase = NtLmAuthenticate; /* if ntlmssp, now final phase */
 487
 488         rc = small_smb2_init(SMB2_SESSION_SETUP, NULL, (void **) &req);
 489         if (rc)
 490                 return rc;
 491
 492         req->hdr.SessionId = 0; /* First session, not a reauthenticate */
 493         req->VcNumber = 0; /* MBZ */
 494         /* to enable echos and oplocks */
 495         req->hdr.CreditRequest = cpu_to_le16(3);
 496
 497         /* only one of SMB2 signing flags may be set in SMB2 request */
 498         if (server->sign)
 499                 req->SecurityMode = SMB2_NEGOTIATE_SIGNING_REQUIRED;
 500         else if (global_secflags & CIFSSEC_MAY_SIGN) /* one flag unlike MUST_ */
 501                 req->SecurityMode = SMB2_NEGOTIATE_SIGNING_ENABLED;
 502         else
 503                 req->SecurityMode = 0;
 504
 505         req->Capabilities = 0;
 506         req->Channel = 0; /* MBZ */
 507
 508         iov[0].iov_base = (char *)req;
 509         /* 4 for rfc1002 length field and 1 for pad */
 510         iov[0].iov_len = get_rfc1002_length(req) + 4 - 1;
 511         if (phase == NtLmNegotiate) {
 512                 ntlmssp_blob = kmalloc(sizeof(struct _NEGOTIATE_MESSAGE),
 513                                        GFP_KERNEL);
 514                 if (ntlmssp_blob == NULL) {
 515                         rc = -ENOMEM;
 516                         goto ssetup_exit;
 517                 }
 518                 build_ntlmssp_negotiate_blob(ntlmssp_blob, ses);
 519                 if (use_spnego) {
 520                         /* blob_length = build_spnego_ntlmssp_blob(
 521                                         &security_blob,
 522                                         sizeof(struct _NEGOTIATE_MESSAGE),
 523                                         ntlmssp_blob); */
 524                         /* BB eventually need to add this */
 525                         cifs_dbg(VFS, "spnego not supported for SMB2 yet\n");
 526                         rc = -EOPNOTSUPP;
 527                         kfree(ntlmssp_blob);
 528                         goto ssetup_exit;
 529                 } else {
 530                         blob_length = sizeof(struct _NEGOTIATE_MESSAGE);
 531                         /* with raw NTLMSSP we don't encapsulate in SPNEGO */
 532                         security_blob = ntlmssp_blob;
 533                 }
 534         } else if (phase == NtLmAuthenticate) {
 535                 req->hdr.SessionId = ses->Suid;
 536                 ntlmssp_blob = kzalloc(sizeof(struct _NEGOTIATE_MESSAGE) + 500,
 537                                        GFP_KERNEL);
 538                 if (ntlmssp_blob == NULL) {
 539                         rc = -ENOMEM;
 540                         goto ssetup_exit;
 541                 }
 542                 rc = build_ntlmssp_auth_blob(ntlmssp_blob, &blob_length, ses,
 543                                              nls_cp);
 544                 if (rc) {
 545                         cifs_dbg(FYI, "build_ntlmssp_auth_blob failed %d\n",
 546                                  rc);
 547                         goto ssetup_exit; /* BB double check error handling */
 548                 }
 549                 if (use_spnego) {
 550                         /* blob_length = build_spnego_ntlmssp_blob(
 551                                                         &security_blob,
 552                                                         blob_length,
 553                                                         ntlmssp_blob); */
 554                         cifs_dbg(VFS, "spnego not supported for SMB2 yet\n");
 555                         rc = -EOPNOTSUPP;
 556                         kfree(ntlmssp_blob);
 557                         goto ssetup_exit;
 558                 } else {
 559                         security_blob = ntlmssp_blob;
 560                 }
 561         } else {
 562                 cifs_dbg(VFS, "illegal ntlmssp phase\n");
 563                 rc = -EIO;
 564                 goto ssetup_exit;
 565         }
 566
 567         /* Testing shows that buffer offset must be at location of Buffer[0] */
 568         req->SecurityBufferOffset =
 569                                 cpu_to_le16(sizeof(struct smb2_sess_setup_req) -
 570                                             1 /* pad */ - 4 /* rfc1001 len */);
 571         req->SecurityBufferLength = cpu_to_le16(blob_length);
 572         iov[1].iov_base = security_blob;
 573         iov[1].iov_len = blob_length;
 574
 575         inc_rfc1001_len(req, blob_length - 1 /* pad */);
 576
 577         /* BB add code to build os and lm fields */
 578
 579         rc = SendReceive2(xid, ses, iov, 2, &resp_buftype,
 580                           CIFS_LOG_ERROR | CIFS_NEG_OP);
 581
 582         kfree(security_blob);
 583         rsp = (struct smb2_sess_setup_rsp *)iov[0].iov_base;
 584         if (resp_buftype != CIFS_NO_BUFFER &&
 585             rsp->hdr.Status == STATUS_MORE_PROCESSING_REQUIRED) {
 586                 if (phase != NtLmNegotiate) {
 587                         cifs_dbg(VFS, "Unexpected more processing error\n");
 588                         goto ssetup_exit;
 589                 }
 590                 if (offsetof(struct smb2_sess_setup_rsp, Buffer) - 4 !=
 591                                 le16_to_cpu(rsp->SecurityBufferOffset)) {
 592                         cifs_dbg(VFS, "Invalid security buffer offset %d\n",
 593                                  le16_to_cpu(rsp->SecurityBufferOffset));
 594                         rc = -EIO;
 595                         goto ssetup_exit;
 596                 }
 597
 598                 /* NTLMSSP Negotiate sent now processing challenge (response) */
 599                 phase = NtLmChallenge; /* process ntlmssp challenge */
 600                 rc = 0; /* MORE_PROCESSING is not an error here but expected */
 601                 ses->Suid = rsp->hdr.SessionId;
 602                 rc = decode_ntlmssp_challenge(rsp->Buffer,
 603                                 le16_to_cpu(rsp->SecurityBufferLength), ses);
 604         }
 605
 606         /*
 607          * BB eventually add code for SPNEGO decoding of NtlmChallenge blob,
 608          * but at least the raw NTLMSSP case works.
 609          */
 610         /*
 611          * No tcon so can't do
 612          * cifs_stats_inc(&tcon->stats.smb2_stats.smb2_com_fail[SMB2...]);
 613          */
 614         if (rc != 0)
 615                 goto ssetup_exit;
 616
 617         ses->session_flags = le16_to_cpu(rsp->SessionFlags);
 618 ssetup_exit:
 619         free_rsp_buf(resp_buftype, rsp);
 620
 621         /* if ntlmssp, and negotiate succeeded, proceed to authenticate phase */
 622         if ((phase == NtLmChallenge) && (rc == 0))
 623                 goto ssetup_ntlmssp_authenticate;
 624         return rc;
 625 }
 626
 627 int
 628 SMB2_logoff(const unsigned int xid, struct cifs_ses *ses)
 629 {
 630         struct smb2_logoff_req *req; /* response is also trivial struct */
 631         int rc = 0;
 632         struct TCP_Server_Info *server;
 633
 634         cifs_dbg(FYI, "disconnect session %p\n", ses);
 635
 636         if (ses && (ses->server))
 637                 server = ses->server;
 638         else
 639                 return -EIO;
 640
 641         rc = small_smb2_init(SMB2_LOGOFF, NULL, (void **) &req);
 642         if (rc)
 643                 return rc;
 644
 645          /* since no tcon, smb2_init can not do this, so do here */
 646         req->hdr.SessionId = ses->Suid;
 647         if (server->sign)
 648                 req->hdr.Flags |= SMB2_FLAGS_SIGNED;
 649
 650         rc = SendReceiveNoRsp(xid, ses, (char *) &req->hdr, 0);
 651         /*
 652          * No tcon so can't do
 653          * cifs_stats_inc(&tcon->stats.smb2_stats.smb2_com_fail[SMB2...]);
 654          */
 655         return rc;
 656 }
 657
 658 static inline void cifs_stats_fail_inc(struct cifs_tcon *tcon, uint16_t code)
 659 {
 660         cifs_stats_inc(&tcon->stats.smb2_stats.smb2_com_failed[code]);
 661 }
 662
 663 #define MAX_SHARENAME_LENGTH (255 /* server */ + 80 /* share */ + 1 /* NULL */)
 664
 665 int
 666 SMB2_tcon(const unsigned int xid, struct cifs_ses *ses, const char *tree,
 667           struct cifs_tcon *tcon, const struct nls_table *cp)
 668 {
 669         struct smb2_tree_connect_req *req;
 670         struct smb2_tree_connect_rsp *rsp = NULL;
 671         struct kvec iov[2];
 672         int rc = 0;
 673         int resp_buftype;
 674         int unc_path_len;
 675         struct TCP_Server_Info *server;
 676         __le16 *unc_path = NULL;
 677
 678         cifs_dbg(FYI, "TCON\n");
 679
 680         if ((ses->server) && tree)
 681                 server = ses->server;
 682         else
 683                 return -EIO;
 684
 685         if (tcon && tcon->bad_network_name)
 686                 return -ENOENT;
 687
 688         unc_path = kmalloc(MAX_SHARENAME_LENGTH * 2, GFP_KERNEL);
 689         if (unc_path == NULL)
 690                 return -ENOMEM;
 691
 692         unc_path_len = cifs_strtoUTF16(unc_path, tree, strlen(tree), cp) + 1;
 693         unc_path_len *= 2;
 694         if (unc_path_len < 2) {
 695                 kfree(unc_path);
 696                 return -EINVAL;
 697         }
 698
 699         rc = small_smb2_init(SMB2_TREE_CONNECT, tcon, (void **) &req);
 700         if (rc) {
 701                 kfree(unc_path);
 702                 return rc;
 703         }
 704
 705         if (tcon == NULL) {
 706                 /* since no tcon, smb2_init can not do this, so do here */
 707                 req->hdr.SessionId = ses->Suid;
 708                 /* if (ses->server->sec_mode & SECMODE_SIGN_REQUIRED)
 709                         req->hdr.Flags |= SMB2_FLAGS_SIGNED; */
 710         }
 711
 712         iov[0].iov_base = (char *)req;
 713         /* 4 for rfc1002 length field and 1 for pad */
 714         iov[0].iov_len = get_rfc1002_length(req) + 4 - 1;
 715
 716         /* Testing shows that buffer offset must be at location of Buffer[0] */
 717         req->PathOffset = cpu_to_le16(sizeof(struct smb2_tree_connect_req)
 718                         - 1 /* pad */ - 4 /* do not count rfc1001 len field */);
 719         req->PathLength = cpu_to_le16(unc_path_len - 2);
 720         iov[1].iov_base = unc_path;
 721         iov[1].iov_len = unc_path_len;
 722
 723         inc_rfc1001_len(req, unc_path_len - 1 /* pad */);
 724
 725         rc = SendReceive2(xid, ses, iov, 2, &resp_buftype, 0);
 726         rsp = (struct smb2_tree_connect_rsp *)iov[0].iov_base;
 727
 728         if (rc != 0) {
 729                 if (tcon) {
 730                         cifs_stats_fail_inc(tcon, SMB2_TREE_CONNECT_HE);
 731                         tcon->need_reconnect = true;
 732                 }
 733                 goto tcon_error_exit;
 734         }
 735
 736         if (tcon == NULL) {
 737                 ses->ipc_tid = rsp->hdr.TreeId;
 738                 goto tcon_exit;
 739         }
 740
 741         if (rsp->ShareType & SMB2_SHARE_TYPE_DISK)
 742                 cifs_dbg(FYI, "connection to disk share\n");
 743         else if (rsp->ShareType & SMB2_SHARE_TYPE_PIPE) {
 744                 tcon->ipc = true;
 745                 cifs_dbg(FYI, "connection to pipe share\n");
 746         } else if (rsp->ShareType & SMB2_SHARE_TYPE_PRINT) {
 747                 tcon->print = true;
 748                 cifs_dbg(FYI, "connection to printer\n");
 749         } else {
 750                 cifs_dbg(VFS, "unknown share type %d\n", rsp->ShareType);
 751                 rc = -EOPNOTSUPP;
 752                 goto tcon_error_exit;
 753         }
 754
 755         tcon->share_flags = le32_to_cpu(rsp->ShareFlags);
 756         tcon->capabilities = rsp->Capabilities; /* we keep caps little endian */
 757         tcon->maximal_access = le32_to_cpu(rsp->MaximalAccess);
 758         tcon->tidStatus = CifsGood;
 759         tcon->need_reconnect = false;
 760         tcon->tid = rsp->hdr.TreeId;
 761         strlcpy(tcon->treeName, tree, sizeof(tcon->treeName));
 762
 763         if ((rsp->Capabilities & SMB2_SHARE_CAP_DFS) &&
 764             ((tcon->share_flags & SHI1005_FLAGS_DFS) == 0))
 765                 cifs_dbg(VFS, "DFS capability contradicts DFS flag\n");
 766
 767 tcon_exit:
 768         free_rsp_buf(resp_buftype, rsp);
 769         kfree(unc_path);
 770         return rc;
 771
 772 tcon_error_exit:
 773         if (rsp->hdr.Status == STATUS_BAD_NETWORK_NAME) {
 774                 cifs_dbg(VFS, "BAD_NETWORK_NAME: %s\n", tree);
 775                 tcon->bad_network_name = true;
 776         }
 777         goto tcon_exit;
 778 }
 779
 780 int
 781 SMB2_tdis(const unsigned int xid, struct cifs_tcon *tcon)
 782 {
 783         struct smb2_tree_disconnect_req *req; /* response is trivial */
 784         int rc = 0;
 785         struct TCP_Server_Info *server;
 786         struct cifs_ses *ses = tcon->ses;
 787
 788         cifs_dbg(FYI, "Tree Disconnect\n");
 789
 790         if (ses && (ses->server))
 791                 server = ses->server;
 792         else
 793                 return -EIO;
 794
 795         if ((tcon->need_reconnect) || (tcon->ses->need_reconnect))
 796                 return 0;
 797
 798         rc = small_smb2_init(SMB2_TREE_DISCONNECT, tcon, (void **) &req);
 799         if (rc)
 800                 return rc;
 801
 802         rc = SendReceiveNoRsp(xid, ses, (char *)&req->hdr, 0);
 803         if (rc)
 804                 cifs_stats_fail_inc(tcon, SMB2_TREE_DISCONNECT_HE);
 805
 806         return rc;
 807 }
 808
 809 static struct create_lease *
 810 create_lease_buf(u8 *lease_key, u8 oplock)
 811 {
 812         struct create_lease *buf;
 813
 814         buf = kzalloc(sizeof(struct create_lease), GFP_KERNEL);
 815         if (!buf)
 816                 return NULL;
 817
 818         buf->lcontext.LeaseKeyLow = cpu_to_le64(*((u64 *)lease_key));
 819         buf->lcontext.LeaseKeyHigh = cpu_to_le64(*((u64 *)(lease_key + 8)));
 820         if (oplock == SMB2_OPLOCK_LEVEL_EXCLUSIVE)
 821                 buf->lcontext.LeaseState = SMB2_LEASE_WRITE_CACHING |
 822                                            SMB2_LEASE_READ_CACHING;
 823         else if (oplock == SMB2_OPLOCK_LEVEL_II)
 824                 buf->lcontext.LeaseState = SMB2_LEASE_READ_CACHING;
 825         else if (oplock == SMB2_OPLOCK_LEVEL_BATCH)
 826                 buf->lcontext.LeaseState = SMB2_LEASE_HANDLE_CACHING |
 827                                            SMB2_LEASE_READ_CACHING |
 828                                            SMB2_LEASE_WRITE_CACHING;
 829
 830         buf->ccontext.DataOffset = cpu_to_le16(offsetof
 831                                         (struct create_lease, lcontext));
 832         buf->ccontext.DataLength = cpu_to_le32(sizeof(struct lease_context));
 833         buf->ccontext.NameOffset = cpu_to_le16(offsetof
 834                                 (struct create_lease, Name));
 835         buf->ccontext.NameLength = cpu_to_le16(4);
 836         buf->Name[0] = 'R';
 837         buf->Name[1] = 'q';
 838         buf->Name[2] = 'L';
 839         buf->Name[3] = 's';
 840         return buf;
 841 }
 842
 843 static __u8
 844 parse_lease_state(struct smb2_create_rsp *rsp)
 845 {
 846         char *data_offset;
 847         struct create_lease *lc;
 848         bool found = false;
 849
 850         data_offset = (char *)rsp;
 851         data_offset += 4 + le32_to_cpu(rsp->CreateContextsOffset);
 852         lc = (struct create_lease *)data_offset;
 853         do {
 854                 char *name = le16_to_cpu(lc->ccontext.NameOffset) + (char *)lc;
 855                 if (le16_to_cpu(lc->ccontext.NameLength) != 4 ||
 856                     strncmp(name, "RqLs", 4)) {
 857                         lc = (struct create_lease *)((char *)lc
 858                                         + le32_to_cpu(lc->ccontext.Next));
 859                         continue;
 860                 }
 861                 if (lc->lcontext.LeaseFlags & SMB2_LEASE_FLAG_BREAK_IN_PROGRESS)
 862                         return SMB2_OPLOCK_LEVEL_NOCHANGE;
 863                 found = true;
 864                 break;
 865         } while (le32_to_cpu(lc->ccontext.Next) != 0);
 866
 867         if (!found)
 868                 return 0;
 869
 870         return smb2_map_lease_to_oplock(lc->lcontext.LeaseState);
 871 }
 872
 873 int
 874 SMB2_open(const unsigned int xid, struct cifs_tcon *tcon, __le16 *path,
 875           u64 *persistent_fid, u64 *volatile_fid, __u32 desired_access,
 876           __u32 create_disposition, __u32 file_attributes, __u32 create_options,
 877           __u8 *oplock, struct smb2_file_all_info *buf)
 878 {
 879         struct smb2_create_req *req;
 880         struct smb2_create_rsp *rsp;
 881         struct TCP_Server_Info *server;
 882         struct cifs_ses *ses = tcon->ses;
 883         struct kvec iov[3];
 884         int resp_buftype;
 885         int uni_path_len;
 886         __le16 *copy_path = NULL;
 887         int copy_size;
 888         int rc = 0;
 889         int num_iovecs = 2;
 890
 891         cifs_dbg(FYI, "create/open\n");
 892
 893         if (ses && (ses->server))
 894                 server = ses->server;
 895         else
 896                 return -EIO;
 897
 898         rc = small_smb2_init(SMB2_CREATE, tcon, (void **) &req);
 899         if (rc)
 900                 return rc;
 901
 902         req->ImpersonationLevel = IL_IMPERSONATION;
 903         req->DesiredAccess = cpu_to_le32(desired_access);
 904         /* File attributes ignored on open (used in create though) */
 905         req->FileAttributes = cpu_to_le32(file_attributes);
 906         req->ShareAccess = FILE_SHARE_ALL_LE;
 907         req->CreateDisposition = cpu_to_le32(create_disposition);
 908         req->CreateOptions = cpu_to_le32(create_options);
 909         uni_path_len = (2 * UniStrnlen((wchar_t *)path, PATH_MAX)) + 2;
 910         req->NameOffset = cpu_to_le16(sizeof(struct smb2_create_req)
 911                         - 8 /* pad */ - 4 /* do not count rfc1001 len field */);
 912
 913         iov[0].iov_base = (char *)req;
 914         /* 4 for rfc1002 length field */
 915         iov[0].iov_len = get_rfc1002_length(req) + 4;
 916
 917         /* MUST set path len (NameLength) to 0 opening root of share */
 918         if (uni_path_len >= 4) {
 919                 req->NameLength = cpu_to_le16(uni_path_len - 2);
 920                 /* -1 since last byte is buf[0] which is sent below (path) */
 921                 iov[0].iov_len--;
 922                 if (uni_path_len % 8 != 0) {
 923                         copy_size = uni_path_len / 8 * 8;
 924                         if (copy_size < uni_path_len)
 925                                 copy_size += 8;
 926
 927                         copy_path = kzalloc(copy_size, GFP_KERNEL);
 928                         if (!copy_path)
 929                                 return -ENOMEM;
 930                         memcpy((char *)copy_path, (const char *)path,
 931                                 uni_path_len);
 932                         uni_path_len = copy_size;
 933                         path = copy_path;
 934                 }
 935
 936                 iov[1].iov_len = uni_path_len;
 937                 iov[1].iov_base = path;
 938                 /*
 939                  * -1 since last byte is buf[0] which was counted in
 940                  * smb2_buf_len.
 941                  */
 942                 inc_rfc1001_len(req, uni_path_len - 1);
 943         } else {
 944                 iov[0].iov_len += 7;
 945                 req->hdr.smb2_buf_length = cpu_to_be32(be32_to_cpu(
 946                                 req->hdr.smb2_buf_length) + 8 - 1);
 947                 num_iovecs = 1;
 948                 req->NameLength = 0;
 949         }
 950
 951         if (!server->oplocks)
 952                 *oplock = SMB2_OPLOCK_LEVEL_NONE;
 953
 954         if (!(tcon->ses->server->capabilities & SMB2_GLOBAL_CAP_LEASING) ||
 955             *oplock == SMB2_OPLOCK_LEVEL_NONE)
 956                 req->RequestedOplockLevel = *oplock;
 957         else {
 958                 iov[num_iovecs].iov_base = create_lease_buf(oplock+1, *oplock);
 959                 if (iov[num_iovecs].iov_base == NULL) {
 960                         cifs_small_buf_release(req);
 961                         kfree(copy_path);
 962                         return -ENOMEM;
 963                 }
 964                 iov[num_iovecs].iov_len = sizeof(struct create_lease);
 965                 req->RequestedOplockLevel = SMB2_OPLOCK_LEVEL_LEASE;
 966                 req->CreateContextsOffset = cpu_to_le32(
 967                         sizeof(struct smb2_create_req) - 4 - 8 +
 968                         iov[num_iovecs-1].iov_len);
 969                 req->CreateContextsLength = cpu_to_le32(
 970                         sizeof(struct create_lease));
 971                 inc_rfc1001_len(&req->hdr, sizeof(struct create_lease));
 972                 num_iovecs++;
 973         }
 974
 975         rc = SendReceive2(xid, ses, iov, num_iovecs, &resp_buftype, 0);
 976         rsp = (struct smb2_create_rsp *)iov[0].iov_base;
 977
 978         if (rc != 0) {
 979                 cifs_stats_fail_inc(tcon, SMB2_CREATE_HE);
 980                 goto creat_exit;
 981         }
 982
 983         *persistent_fid = rsp->PersistentFileId;
 984         *volatile_fid = rsp->VolatileFileId;
 985
 986         if (buf) {
 987                 memcpy(buf, &rsp->CreationTime, 32);
 988                 buf->AllocationSize = rsp->AllocationSize;
 989                 buf->EndOfFile = rsp->EndofFile;
 990                 buf->Attributes = rsp->FileAttributes;
 991                 buf->NumberOfLinks = cpu_to_le32(1);
 992                 buf->DeletePending = 0;
 993         }
 994
 995         if (rsp->OplockLevel == SMB2_OPLOCK_LEVEL_LEASE)
 996                 *oplock = parse_lease_state(rsp);
 997         else
 998                 *oplock = rsp->OplockLevel;
 999 creat_exit:
1000         kfree(copy_path);
1001         free_rsp_buf(resp_buftype, rsp);
1002         return rc;
1003 }
1004
1005 /*
1006  *      SMB2 IOCTL is used for both IOCTLs and FSCTLs
1007  */
1008 int
1009 SMB2_ioctl(const unsigned int xid, struct cifs_tcon *tcon, u64 persistent_fid,
1010            u64 volatile_fid, u32 opcode, bool is_fsctl, char *in_data,
1011            u32 indatalen, char **out_data, u32 *plen /* returned data len */)
1012 {
1013         struct smb2_ioctl_req *req;
1014         struct smb2_ioctl_rsp *rsp;
1015         struct TCP_Server_Info *server;
1016         struct cifs_ses *ses = tcon->ses;
1017         struct kvec iov[2];
1018         int resp_buftype;
1019         int num_iovecs;
1020         int rc = 0;
1021
1022         cifs_dbg(FYI, "SMB2 IOCTL\n");
1023
1024         /* zero out returned data len, in case of error */
1025         if (plen)
1026                 *plen = 0;
1027
1028         if (ses && (ses->server))
1029                 server = ses->server;
1030         else
1031                 return -EIO;
1032
1033         rc = small_smb2_init(SMB2_IOCTL, tcon, (void **) &req);
1034         if (rc)
1035                 return rc;
1036
1037         req->CtlCode = cpu_to_le32(opcode);
1038         req->PersistentFileId = persistent_fid;
1039         req->VolatileFileId = volatile_fid;
1040
1041         if (indatalen) {
1042                 req->InputCount = cpu_to_le32(indatalen);
1043                 /* do not set InputOffset if no input data */
1044                 req->InputOffset =
1045                        cpu_to_le32(offsetof(struct smb2_ioctl_req, Buffer) - 4);
1046                 iov[1].iov_base = in_data;
1047                 iov[1].iov_len = indatalen;
1048                 num_iovecs = 2;
1049         } else
1050                 num_iovecs = 1;
1051
1052         req->OutputOffset = 0;
1053         req->OutputCount = 0; /* MBZ */
1054
1055         /*
1056          * Could increase MaxOutputResponse, but that would require more
1057          * than one credit. Windows typically sets this smaller, but for some
1058          * ioctls it may be useful to allow server to send more. No point
1059          * limiting what the server can send as long as fits in one credit
1060          */
1061         req->MaxOutputResponse = cpu_to_le32(0xFF00); /* < 64K uses 1 credit */
1062
1063         if (is_fsctl)
1064                 req->Flags = cpu_to_le32(SMB2_0_IOCTL_IS_FSCTL);
1065         else
1066                 req->Flags = 0;
1067
1068         iov[0].iov_base = (char *)req;
1069         /* 4 for rfc1002 length field */
1070         iov[0].iov_len = get_rfc1002_length(req) + 4;
1071
1072         if (indatalen)
1073                 inc_rfc1001_len(req, indatalen);
1074
1075         rc = SendReceive2(xid, ses, iov, num_iovecs, &resp_buftype, 0);
1076         rsp = (struct smb2_ioctl_rsp *)iov[0].iov_base;
1077
1078         if (rc != 0) {
1079                 if (tcon)
1080                         cifs_stats_fail_inc(tcon, SMB2_IOCTL_HE);
1081                 goto ioctl_exit;
1082         }
1083
1084         /* check if caller wants to look at return data or just return rc */
1085         if ((plen == NULL) || (out_data == NULL))
1086                 goto ioctl_exit;
1087
1088         *plen = le32_to_cpu(rsp->OutputCount);
1089
1090         /* We check for obvious errors in the output buffer length and offset */
1091         if (*plen == 0)
1092                 goto ioctl_exit; /* server returned no data */
1093         else if (*plen > 0xFF00) {
1094                 cifs_dbg(VFS, "srv returned invalid ioctl length: %d\n", *plen);
1095                 *plen = 0;
1096                 rc = -EIO;
1097                 goto ioctl_exit;
1098         }
1099
1100         if (get_rfc1002_length(rsp) < le32_to_cpu(rsp->OutputOffset) + *plen) {
1101                 cifs_dbg(VFS, "Malformed ioctl resp: len %d offset %d\n", *plen,
1102                         le32_to_cpu(rsp->OutputOffset));
1103                 *plen = 0;
1104                 rc = -EIO;
1105                 goto ioctl_exit;
1106         }
1107
1108         *out_data = kmalloc(*plen, GFP_KERNEL);
1109         if (*out_data == NULL) {
1110                 rc = -ENOMEM;
1111                 goto ioctl_exit;
1112         }
1113
1114         memcpy(*out_data, rsp->hdr.ProtocolId + le32_to_cpu(rsp->OutputOffset),
1115                *plen);
1116 ioctl_exit:
1117         free_rsp_buf(resp_buftype, rsp);
1118         return rc;
1119 }
1120
1121 int
1122 SMB2_close(const unsigned int xid, struct cifs_tcon *tcon,
1123            u64 persistent_fid, u64 volatile_fid)
1124 {
1125         struct smb2_close_req *req;
1126         struct smb2_close_rsp *rsp;
1127         struct TCP_Server_Info *server;
1128         struct cifs_ses *ses = tcon->ses;
1129         struct kvec iov[1];
1130         int resp_buftype;
1131         int rc = 0;
1132
1133         cifs_dbg(FYI, "Close\n");
1134
1135         if (ses && (ses->server))
1136                 server = ses->server;
1137         else
1138                 return -EIO;
1139
1140         rc = small_smb2_init(SMB2_CLOSE, tcon, (void **) &req);
1141         if (rc)
1142                 return rc;
1143
1144         req->PersistentFileId = persistent_fid;
1145         req->VolatileFileId = volatile_fid;
1146
1147         iov[0].iov_base = (char *)req;
1148         /* 4 for rfc1002 length field */
1149         iov[0].iov_len = get_rfc1002_length(req) + 4;
1150
1151         rc = SendReceive2(xid, ses, iov, 1, &resp_buftype, 0);
1152         rsp = (struct smb2_close_rsp *)iov[0].iov_base;
1153
1154         if (rc != 0) {
1155                 if (tcon)
1156                         cifs_stats_fail_inc(tcon, SMB2_CLOSE_HE);
1157                 goto close_exit;
1158         }
1159
1160         /* BB FIXME - decode close response, update inode for caching */
1161
1162 close_exit:
1163         free_rsp_buf(resp_buftype, rsp);
1164         return rc;
1165 }
1166
1167 static int
1168 validate_buf(unsigned int offset, unsigned int buffer_length,
1169              struct smb2_hdr *hdr, unsigned int min_buf_size)
1170
1171 {
1172         unsigned int smb_len = be32_to_cpu(hdr->smb2_buf_length);
1173         char *end_of_smb = smb_len + 4 /* RFC1001 length field */ + (char *)hdr;
1174         char *begin_of_buf = 4 /* RFC1001 len field */ + offset + (char *)hdr;
1175         char *end_of_buf = begin_of_buf + buffer_length;
1176
1177
1178         if (buffer_length < min_buf_size) {
1179                 cifs_dbg(VFS, "buffer length %d smaller than minimum size %d\n",
1180                          buffer_length, min_buf_size);
1181                 return -EINVAL;
1182         }
1183
1184         /* check if beyond RFC1001 maximum length */
1185         if ((smb_len > 0x7FFFFF) || (buffer_length > 0x7FFFFF)) {
1186                 cifs_dbg(VFS, "buffer length %d or smb length %d too large\n",
1187                          buffer_length, smb_len);
1188                 return -EINVAL;
1189         }
1190
1191         if ((begin_of_buf > end_of_smb) || (end_of_buf > end_of_smb)) {
1192                 cifs_dbg(VFS, "illegal server response, bad offset to data\n");
1193                 return -EINVAL;
1194         }
1195
1196         return 0;
1197 }
1198
1199 /*
1200  * If SMB buffer fields are valid, copy into temporary buffer to hold result.
1201  * Caller must free buffer.
1202  */
1203 static int
1204 validate_and_copy_buf(unsigned int offset, unsigned int buffer_length,
1205                       struct smb2_hdr *hdr, unsigned int minbufsize,
1206                       char *data)
1207
1208 {
1209         char *begin_of_buf = 4 /* RFC1001 len field */ + offset + (char *)hdr;
1210         int rc;
1211
1212         if (!data)
1213                 return -EINVAL;
1214
1215         rc = validate_buf(offset, buffer_length, hdr, minbufsize);
1216         if (rc)
1217                 return rc;
1218
1219         memcpy(data, begin_of_buf, buffer_length);
1220
1221         return 0;
1222 }
1223
1224 static int
1225 query_info(const unsigned int xid, struct cifs_tcon *tcon,
1226            u64 persistent_fid, u64 volatile_fid, u8 info_class,
1227            size_t output_len, size_t min_len, void *data)
1228 {
1229         struct smb2_query_info_req *req;
1230         struct smb2_query_info_rsp *rsp = NULL;
1231         struct kvec iov[2];
1232         int rc = 0;
1233         int resp_buftype;
1234         struct TCP_Server_Info *server;
1235         struct cifs_ses *ses = tcon->ses;
1236
1237         cifs_dbg(FYI, "Query Info\n");
1238
1239         if (ses && (ses->server))
1240                 server = ses->server;
1241         else
1242                 return -EIO;
1243
1244         rc = small_smb2_init(SMB2_QUERY_INFO, tcon, (void **) &req);
1245         if (rc)
1246                 return rc;
1247
1248         req->InfoType = SMB2_O_INFO_FILE;
1249         req->FileInfoClass = info_class;
1250         req->PersistentFileId = persistent_fid;
1251         req->VolatileFileId = volatile_fid;
1252         /* 4 for rfc1002 length field and 1 for Buffer */
1253         req->InputBufferOffset =
1254                 cpu_to_le16(sizeof(struct smb2_query_info_req) - 1 - 4);
1255         req->OutputBufferLength = cpu_to_le32(output_len);
1256
1257         iov[0].iov_base = (char *)req;
1258         /* 4 for rfc1002 length field */
1259         iov[0].iov_len = get_rfc1002_length(req) + 4;
1260
1261         rc = SendReceive2(xid, ses, iov, 1, &resp_buftype, 0);
1262         rsp = (struct smb2_query_info_rsp *)iov[0].iov_base;
1263
1264         if (rc) {
1265                 cifs_stats_fail_inc(tcon, SMB2_QUERY_INFO_HE);
1266                 goto qinf_exit;
1267         }
1268
1269         rc = validate_and_copy_buf(le16_to_cpu(rsp->OutputBufferOffset),
1270                                    le32_to_cpu(rsp->OutputBufferLength),
1271                                    &rsp->hdr, min_len, data);
1272
1273 qinf_exit:
1274         free_rsp_buf(resp_buftype, rsp);
1275         return rc;
1276 }
1277
1278 int
1279 SMB2_query_info(const unsigned int xid, struct cifs_tcon *tcon,
1280                 u64 persistent_fid, u64 volatile_fid,
1281                 struct smb2_file_all_info *data)
1282 {
1283         return query_info(xid, tcon, persistent_fid, volatile_fid,
1284                           FILE_ALL_INFORMATION,
1285                           sizeof(struct smb2_file_all_info) + MAX_NAME * 2,
1286                           sizeof(struct smb2_file_all_info), data);
1287 }
1288
1289 int
1290 SMB2_get_srv_num(const unsigned int xid, struct cifs_tcon *tcon,
1291                  u64 persistent_fid, u64 volatile_fid, __le64 *uniqueid)
1292 {
1293         return query_info(xid, tcon, persistent_fid, volatile_fid,
1294                           FILE_INTERNAL_INFORMATION,
1295                           sizeof(struct smb2_file_internal_info),
1296                           sizeof(struct smb2_file_internal_info), uniqueid);
1297 }
1298
1299 /*
1300  * This is a no-op for now. We're not really interested in the reply, but
1301  * rather in the fact that the server sent one and that server->lstrp
1302  * gets updated.
1303  *
1304  * FIXME: maybe we should consider checking that the reply matches request?
1305  */
1306 static void
1307 smb2_echo_callback(struct mid_q_entry *mid)
1308 {
1309         struct TCP_Server_Info *server = mid->callback_data;
1310         struct smb2_echo_rsp *smb2 = (struct smb2_echo_rsp *)mid->resp_buf;
1311         unsigned int credits_received = 1;
1312
1313         if (mid->mid_state == MID_RESPONSE_RECEIVED)
1314                 credits_received = le16_to_cpu(smb2->hdr.CreditRequest);
1315
1316         DeleteMidQEntry(mid);
1317         add_credits(server, credits_received, CIFS_ECHO_OP);
1318 }
1319
1320 int
1321 SMB2_echo(struct TCP_Server_Info *server)
1322 {
1323         struct smb2_echo_req *req;
1324         int rc = 0;
1325         struct kvec iov;
1326         struct smb_rqst rqst = { .rq_iov = &iov,
1327                                  .rq_nvec = 1 };
1328
1329         cifs_dbg(FYI, "In echo request\n");
1330
1331         rc = small_smb2_init(SMB2_ECHO, NULL, (void **)&req);
1332         if (rc)
1333                 return rc;
1334
1335         req->hdr.CreditRequest = cpu_to_le16(1);
1336
1337         iov.iov_base = (char *)req;
1338         /* 4 for rfc1002 length field */
1339         iov.iov_len = get_rfc1002_length(req) + 4;
1340
1341         rc = cifs_call_async(server, &rqst, NULL, smb2_echo_callback, server,
1342                              CIFS_ECHO_OP);
1343         if (rc)
1344                 cifs_dbg(FYI, "Echo request failed: %d\n", rc);
1345
1346         cifs_small_buf_release(req);
1347         return rc;
1348 }
1349
1350 int
1351 SMB2_flush(const unsigned int xid, struct cifs_tcon *tcon, u64 persistent_fid,
1352            u64 volatile_fid)
1353 {
1354         struct smb2_flush_req *req;
1355         struct TCP_Server_Info *server;
1356         struct cifs_ses *ses = tcon->ses;
1357         struct kvec iov[1];
1358         int resp_buftype;
1359         int rc = 0;
1360
1361         cifs_dbg(FYI, "Flush\n");
1362
1363         if (ses && (ses->server))
1364                 server = ses->server;
1365         else
1366                 return -EIO;
1367
1368         rc = small_smb2_init(SMB2_FLUSH, tcon, (void **) &req);
1369         if (rc)
1370                 return rc;
1371
1372         req->PersistentFileId = persistent_fid;
1373         req->VolatileFileId = volatile_fid;
1374
1375         iov[0].iov_base = (char *)req;
1376         /* 4 for rfc1002 length field */
1377         iov[0].iov_len = get_rfc1002_length(req) + 4;
1378
1379         rc = SendReceive2(xid, ses, iov, 1, &resp_buftype, 0);
1380
1381         if ((rc != 0) && tcon)
1382                 cifs_stats_fail_inc(tcon, SMB2_FLUSH_HE);
1383
1384         free_rsp_buf(resp_buftype, iov[0].iov_base);
1385         return rc;
1386 }
1387
1388 /*
1389  * To form a chain of read requests, any read requests after the first should
1390  * have the end_of_chain boolean set to true.
1391  */
1392 static int
1393 smb2_new_read_req(struct kvec *iov, struct cifs_io_parms *io_parms,
1394                   unsigned int remaining_bytes, int request_type)
1395 {
1396         int rc = -EACCES;
1397         struct smb2_read_req *req = NULL;
1398
1399         rc = small_smb2_init(SMB2_READ, io_parms->tcon, (void **) &req);
1400         if (rc)
1401                 return rc;
1402         if (io_parms->tcon->ses->server == NULL)
1403                 return -ECONNABORTED;
1404
1405         req->hdr.ProcessId = cpu_to_le32(io_parms->pid);
1406
1407         req->PersistentFileId = io_parms->persistent_fid;
1408         req->VolatileFileId = io_parms->volatile_fid;
1409         req->ReadChannelInfoOffset = 0; /* reserved */
1410         req->ReadChannelInfoLength = 0; /* reserved */
1411         req->Channel = 0; /* reserved */
1412         req->MinimumCount = 0;
1413         req->Length = cpu_to_le32(io_parms->length);
1414         req->Offset = cpu_to_le64(io_parms->offset);
1415
1416         if (request_type & CHAINED_REQUEST) {
1417                 if (!(request_type & END_OF_CHAIN)) {
1418                         /* 4 for rfc1002 length field */
1419                         req->hdr.NextCommand =
1420                                 cpu_to_le32(get_rfc1002_length(req) + 4);
1421                 } else /* END_OF_CHAIN */
1422                         req->hdr.NextCommand = 0;
1423                 if (request_type & RELATED_REQUEST) {
1424                         req->hdr.Flags |= SMB2_FLAGS_RELATED_OPERATIONS;
1425                         /*
1426                          * Related requests use info from previous read request
1427                          * in chain.
1428                          */
1429                         req->hdr.SessionId = 0xFFFFFFFF;
1430                         req->hdr.TreeId = 0xFFFFFFFF;
1431                         req->PersistentFileId = 0xFFFFFFFF;
1432                         req->VolatileFileId = 0xFFFFFFFF;
1433                 }
1434         }
1435         if (remaining_bytes > io_parms->length)
1436                 req->RemainingBytes = cpu_to_le32(remaining_bytes);
1437         else
1438                 req->RemainingBytes = 0;
1439
1440         iov[0].iov_base = (char *)req;
1441         /* 4 for rfc1002 length field */
1442         iov[0].iov_len = get_rfc1002_length(req) + 4;
1443         return rc;
1444 }
1445
1446 static void
1447 smb2_readv_callback(struct mid_q_entry *mid)
1448 {
1449         struct cifs_readdata *rdata = mid->callback_data;
1450         struct cifs_tcon *tcon = tlink_tcon(rdata->cfile->tlink);
1451         struct TCP_Server_Info *server = tcon->ses->server;
1452         struct smb2_hdr *buf = (struct smb2_hdr *)rdata->iov.iov_base;
1453         unsigned int credits_received = 1;
1454         struct smb_rqst rqst = { .rq_iov = &rdata->iov,
1455                                  .rq_nvec = 1,
1456                                  .rq_pages = rdata->pages,
1457                                  .rq_npages = rdata->nr_pages,
1458                                  .rq_pagesz = rdata->pagesz,
1459                                  .rq_tailsz = rdata->tailsz };
1460
1461         cifs_dbg(FYI, "%s: mid=%llu state=%d result=%d bytes=%u\n",
1462                  __func__, mid->mid, mid->mid_state, rdata->result,
1463                  rdata->bytes);
1464
1465         switch (mid->mid_state) {
1466         case MID_RESPONSE_RECEIVED:
1467                 credits_received = le16_to_cpu(buf->CreditRequest);
1468                 /* result already set, check signature */
1469                 if (server->sign) {
1470                         int rc;
1471
1472                         rc = smb2_verify_signature(&rqst, server);
1473                         if (rc)
1474                                 cifs_dbg(VFS, "SMB signature verification returned error = %d\n",
1475                                          rc);
1476                 }
1477                 /* FIXME: should this be counted toward the initiating task? */
1478                 task_io_account_read(rdata->bytes);
1479                 cifs_stats_bytes_read(tcon, rdata->bytes);
1480                 break;
1481         case MID_REQUEST_SUBMITTED:
1482         case MID_RETRY_NEEDED:
1483                 rdata->result = -EAGAIN;
1484                 break;
1485         default:
1486                 if (rdata->result != -ENODATA)
1487                         rdata->result = -EIO;
1488         }
1489
1490         if (rdata->result)
1491                 cifs_stats_fail_inc(tcon, SMB2_READ_HE);
1492
1493         queue_work(cifsiod_wq, &rdata->work);
1494         DeleteMidQEntry(mid);
1495         add_credits(server, credits_received, 0);
1496 }
1497
1498 /* smb2_async_readv - send an async write, and set up mid to handle result */
1499 int
1500 smb2_async_readv(struct cifs_readdata *rdata)
1501 {
1502         int rc;
1503         struct smb2_hdr *buf;
1504         struct cifs_io_parms io_parms;
1505         struct smb_rqst rqst = { .rq_iov = &rdata->iov,
1506                                  .rq_nvec = 1 };
1507
1508         cifs_dbg(FYI, "%s: offset=%llu bytes=%u\n",
1509                  __func__, rdata->offset, rdata->bytes);
1510
1511         io_parms.tcon = tlink_tcon(rdata->cfile->tlink);
1512         io_parms.offset = rdata->offset;
1513         io_parms.length = rdata->bytes;
1514         io_parms.persistent_fid = rdata->cfile->fid.persistent_fid;
1515         io_parms.volatile_fid = rdata->cfile->fid.volatile_fid;
1516         io_parms.pid = rdata->pid;
1517         rc = smb2_new_read_req(&rdata->iov, &io_parms, 0, 0);
1518         if (rc)
1519                 return rc;
1520
1521         buf = (struct smb2_hdr *)rdata->iov.iov_base;
1522         /* 4 for rfc1002 length field */
1523         rdata->iov.iov_len = get_rfc1002_length(rdata->iov.iov_base) + 4;
1524
1525         kref_get(&rdata->refcount);
1526         rc = cifs_call_async(io_parms.tcon->ses->server, &rqst,
1527                              cifs_readv_receive, smb2_readv_callback,
1528                              rdata, 0);
1529         if (rc) {
1530                 kref_put(&rdata->refcount, cifs_readdata_release);
1531                 cifs_stats_fail_inc(io_parms.tcon, SMB2_READ_HE);
1532         }
1533
1534         cifs_small_buf_release(buf);
1535         return rc;
1536 }
1537
1538 int
1539 SMB2_read(const unsigned int xid, struct cifs_io_parms *io_parms,
1540           unsigned int *nbytes, char **buf, int *buf_type)
1541 {
1542         int resp_buftype, rc = -EACCES;
1543         struct smb2_read_rsp *rsp = NULL;
1544         struct kvec iov[1];
1545
1546         *nbytes = 0;
1547         rc = smb2_new_read_req(iov, io_parms, 0, 0);
1548         if (rc)
1549                 return rc;
1550
1551         rc = SendReceive2(xid, io_parms->tcon->ses, iov, 1,
1552                           &resp_buftype, CIFS_LOG_ERROR);
1553
1554         rsp = (struct smb2_read_rsp *)iov[0].iov_base;
1555
1556         if (rsp->hdr.Status == STATUS_END_OF_FILE) {
1557                 free_rsp_buf(resp_buftype, iov[0].iov_base);
1558                 return 0;
1559         }
1560
1561         if (rc) {
1562                 cifs_stats_fail_inc(io_parms->tcon, SMB2_READ_HE);
1563                 cifs_dbg(VFS, "Send error in read = %d\n", rc);
1564         } else {
1565                 *nbytes = le32_to_cpu(rsp->DataLength);
1566                 if ((*nbytes > CIFS_MAX_MSGSIZE) ||
1567                     (*nbytes > io_parms->length)) {
1568                         cifs_dbg(FYI, "bad length %d for count %d\n",
1569                                  *nbytes, io_parms->length);
1570                         rc = -EIO;
1571                         *nbytes = 0;
1572                 }
1573         }
1574
1575         if (*buf) {
1576                 memcpy(*buf, (char *)rsp->hdr.ProtocolId + rsp->DataOffset,
1577                        *nbytes);
1578                 free_rsp_buf(resp_buftype, iov[0].iov_base);
1579         } else if (resp_buftype != CIFS_NO_BUFFER) {
1580                 *buf = iov[0].iov_base;
1581                 if (resp_buftype == CIFS_SMALL_BUFFER)
1582                         *buf_type = CIFS_SMALL_BUFFER;
1583                 else if (resp_buftype == CIFS_LARGE_BUFFER)
1584                         *buf_type = CIFS_LARGE_BUFFER;
1585         }
1586         return rc;
1587 }
1588
1589 /*
1590  * Check the mid_state and signature on received buffer (if any), and queue the
1591  * workqueue completion task.
1592  */
1593 static void
1594 smb2_writev_callback(struct mid_q_entry *mid)
1595 {
1596         struct cifs_writedata *wdata = mid->callback_data;
1597         struct cifs_tcon *tcon = tlink_tcon(wdata->cfile->tlink);
1598         unsigned int written;
1599         struct smb2_write_rsp *rsp = (struct smb2_write_rsp *)mid->resp_buf;
1600         unsigned int credits_received = 1;
1601
1602         switch (mid->mid_state) {
1603         case MID_RESPONSE_RECEIVED:
1604                 credits_received = le16_to_cpu(rsp->hdr.CreditRequest);
1605                 wdata->result = smb2_check_receive(mid, tcon->ses->server, 0);
1606                 if (wdata->result != 0)
1607                         break;
1608
1609                 written = le32_to_cpu(rsp->DataLength);
1610                 /*
1611                  * Mask off high 16 bits when bytes written as returned
1612                  * by the server is greater than bytes requested by the
1613                  * client. OS/2 servers are known to set incorrect
1614                  * CountHigh values.
1615                  */
1616                 if (written > wdata->bytes)
1617                         written &= 0xFFFF;
1618
1619                 if (written < wdata->bytes)
1620                         wdata->result = -ENOSPC;
1621                 else
1622                         wdata->bytes = written;
1623                 break;
1624         case MID_REQUEST_SUBMITTED:
1625         case MID_RETRY_NEEDED:
1626                 wdata->result = -EAGAIN;
1627                 break;
1628         default:
1629                 wdata->result = -EIO;
1630                 break;
1631         }
1632
1633         if (wdata->result)
1634                 cifs_stats_fail_inc(tcon, SMB2_WRITE_HE);
1635
1636         queue_work(cifsiod_wq, &wdata->work);
1637         DeleteMidQEntry(mid);
1638         add_credits(tcon->ses->server, credits_received, 0);
1639 }
1640
1641 /* smb2_async_writev - send an async write, and set up mid to handle result */
1642 int
1643 smb2_async_writev(struct cifs_writedata *wdata)
1644 {
1645         int rc = -EACCES;
1646         struct smb2_write_req *req = NULL;
1647         struct cifs_tcon *tcon = tlink_tcon(wdata->cfile->tlink);
1648         struct kvec iov;
1649         struct smb_rqst rqst;
1650
1651         rc = small_smb2_init(SMB2_WRITE, tcon, (void **) &req);
1652         if (rc)
1653                 goto async_writev_out;
1654
1655         req->hdr.ProcessId = cpu_to_le32(wdata->cfile->pid);
1656
1657         req->PersistentFileId = wdata->cfile->fid.persistent_fid;
1658         req->VolatileFileId = wdata->cfile->fid.volatile_fid;
1659         req->WriteChannelInfoOffset = 0;
1660         req->WriteChannelInfoLength = 0;
1661         req->Channel = 0;
1662         req->Offset = cpu_to_le64(wdata->offset);
1663         /* 4 for rfc1002 length field */
1664         req->DataOffset = cpu_to_le16(
1665                                 offsetof(struct smb2_write_req, Buffer) - 4);
1666         req->RemainingBytes = 0;
1667
1668         /* 4 for rfc1002 length field and 1 for Buffer */
1669         iov.iov_len = get_rfc1002_length(req) + 4 - 1;
1670         iov.iov_base = req;
1671
1672         rqst.rq_iov = &iov;
1673         rqst.rq_nvec = 1;
1674         rqst.rq_pages = wdata->pages;
1675         rqst.rq_npages = wdata->nr_pages;
1676         rqst.rq_pagesz = wdata->pagesz;
1677         rqst.rq_tailsz = wdata->tailsz;
1678
1679         cifs_dbg(FYI, "async write at %llu %u bytes\n",
1680                  wdata->offset, wdata->bytes);
1681
1682         req->Length = cpu_to_le32(wdata->bytes);
1683
1684         inc_rfc1001_len(&req->hdr, wdata->bytes - 1 /* Buffer */);
1685
1686         kref_get(&wdata->refcount);
1687         rc = cifs_call_async(tcon->ses->server, &rqst, NULL,
1688                                 smb2_writev_callback, wdata, 0);
1689
1690         if (rc) {
1691                 kref_put(&wdata->refcount, cifs_writedata_release);
1692                 cifs_stats_fail_inc(tcon, SMB2_WRITE_HE);
1693         }
1694
1695 async_writev_out:
1696         cifs_small_buf_release(req);
1697         return rc;
1698 }
1699
1700 /*
1701  * SMB2_write function gets iov pointer to kvec array with n_vec as a length.
1702  * The length field from io_parms must be at least 1 and indicates a number of
1703  * elements with data to write that begins with position 1 in iov array. All
1704  * data length is specified by count.
1705  */
1706 int
1707 SMB2_write(const unsigned int xid, struct cifs_io_parms *io_parms,
1708            unsigned int *nbytes, struct kvec *iov, int n_vec)
1709 {
1710         int rc = 0;
1711         struct smb2_write_req *req = NULL;
1712         struct smb2_write_rsp *rsp = NULL;
1713         int resp_buftype;
1714         *nbytes = 0;
1715
1716         if (n_vec < 1)
1717                 return rc;
1718
1719         rc = small_smb2_init(SMB2_WRITE, io_parms->tcon, (void **) &req);
1720         if (rc)
1721                 return rc;
1722
1723         if (io_parms->tcon->ses->server == NULL)
1724                 return -ECONNABORTED;
1725
1726         req->hdr.ProcessId = cpu_to_le32(io_parms->pid);
1727
1728         req->PersistentFileId = io_parms->persistent_fid;
1729         req->VolatileFileId = io_parms->volatile_fid;
1730         req->WriteChannelInfoOffset = 0;
1731         req->WriteChannelInfoLength = 0;
1732         req->Channel = 0;
1733         req->Length = cpu_to_le32(io_parms->length);
1734         req->Offset = cpu_to_le64(io_parms->offset);
1735         /* 4 for rfc1002 length field */
1736         req->DataOffset = cpu_to_le16(
1737                                 offsetof(struct smb2_write_req, Buffer) - 4);
1738         req->RemainingBytes = 0;
1739
1740         iov[0].iov_base = (char *)req;
1741         /* 4 for rfc1002 length field and 1 for Buffer */
1742         iov[0].iov_len = get_rfc1002_length(req) + 4 - 1;
1743
1744         /* length of entire message including data to be written */
1745         inc_rfc1001_len(req, io_parms->length - 1 /* Buffer */);
1746
1747         rc = SendReceive2(xid, io_parms->tcon->ses, iov, n_vec + 1,
1748                           &resp_buftype, 0);
1749         rsp = (struct smb2_write_rsp *)iov[0].iov_base;
1750
1751         if (rc) {
1752                 cifs_stats_fail_inc(io_parms->tcon, SMB2_WRITE_HE);
1753                 cifs_dbg(VFS, "Send error in write = %d\n", rc);
1754         } else
1755                 *nbytes = le32_to_cpu(rsp->DataLength);
1756
1757         free_rsp_buf(resp_buftype, rsp);
1758         return rc;
1759 }
1760
1761 static unsigned int
1762 num_entries(char *bufstart, char *end_of_buf, char **lastentry, size_t size)
1763 {
1764         int len;
1765         unsigned int entrycount = 0;
1766         unsigned int next_offset = 0;
1767         FILE_DIRECTORY_INFO *entryptr;
1768
1769         if (bufstart == NULL)
1770                 return 0;
1771
1772         entryptr = (FILE_DIRECTORY_INFO *)bufstart;
1773
1774         while (1) {
1775                 entryptr = (FILE_DIRECTORY_INFO *)
1776                                         ((char *)entryptr + next_offset);
1777
1778                 if ((char *)entryptr + size > end_of_buf) {
1779                         cifs_dbg(VFS, "malformed search entry would overflow\n");
1780                         break;
1781                 }
1782
1783                 len = le32_to_cpu(entryptr->FileNameLength);
1784                 if ((char *)entryptr + len + size > end_of_buf) {
1785                         cifs_dbg(VFS, "directory entry name would overflow frame end of buf %p\n",
1786                                  end_of_buf);
1787                         break;
1788                 }
1789
1790                 *lastentry = (char *)entryptr;
1791                 entrycount++;
1792
1793                 next_offset = le32_to_cpu(entryptr->NextEntryOffset);
1794                 if (!next_offset)
1795                         break;
1796         }
1797
1798         return entrycount;
1799 }
1800
1801 /*
1802  * Readdir/FindFirst
1803  */
1804 int
1805 SMB2_query_directory(const unsigned int xid, struct cifs_tcon *tcon,
1806                      u64 persistent_fid, u64 volatile_fid, int index,
1807                      struct cifs_search_info *srch_inf)
1808 {
1809         struct smb2_query_directory_req *req;
1810         struct smb2_query_directory_rsp *rsp = NULL;
1811         struct kvec iov[2];
1812         int rc = 0;
1813         int len;
1814         int resp_buftype;
1815         unsigned char *bufptr;
1816         struct TCP_Server_Info *server;
1817         struct cifs_ses *ses = tcon->ses;
1818         __le16 asteriks = cpu_to_le16('*');
1819         char *end_of_smb;
1820         unsigned int output_size = CIFSMaxBufSize;
1821         size_t info_buf_size;
1822
1823         if (ses && (ses->server))
1824                 server = ses->server;
1825         else
1826                 return -EIO;
1827
1828         rc = small_smb2_init(SMB2_QUERY_DIRECTORY, tcon, (void **) &req);
1829         if (rc)
1830                 return rc;
1831
1832         switch (srch_inf->info_level) {
1833         case SMB_FIND_FILE_DIRECTORY_INFO:
1834                 req->FileInformationClass = FILE_DIRECTORY_INFORMATION;
1835                 info_buf_size = sizeof(FILE_DIRECTORY_INFO) - 1;
1836                 break;
1837         case SMB_FIND_FILE_ID_FULL_DIR_INFO:
1838                 req->FileInformationClass = FILEID_FULL_DIRECTORY_INFORMATION;
1839                 info_buf_size = sizeof(SEARCH_ID_FULL_DIR_INFO) - 1;
1840                 break;
1841         default:
1842                 cifs_dbg(VFS, "info level %u isn't supported\n",
1843                          srch_inf->info_level);
1844                 rc = -EINVAL;
1845                 goto qdir_exit;
1846         }
1847
1848         req->FileIndex = cpu_to_le32(index);
1849         req->PersistentFileId = persistent_fid;
1850         req->VolatileFileId = volatile_fid;
1851
1852         len = 0x2;
1853         bufptr = req->Buffer;
1854         memcpy(bufptr, &asteriks, len);
1855
1856         req->FileNameOffset =
1857                 cpu_to_le16(sizeof(struct smb2_query_directory_req) - 1 - 4);
1858         req->FileNameLength = cpu_to_le16(len);
1859         /*
1860          * BB could be 30 bytes or so longer if we used SMB2 specific
1861          * buffer lengths, but this is safe and close enough.
1862          */
1863         output_size = min_t(unsigned int, output_size, server->maxBuf);
1864         output_size = min_t(unsigned int, output_size, 2 << 15);
1865         req->OutputBufferLength = cpu_to_le32(output_size);
1866
1867         iov[0].iov_base = (char *)req;
1868         /* 4 for RFC1001 length and 1 for Buffer */
1869         iov[0].iov_len = get_rfc1002_length(req) + 4 - 1;
1870
1871         iov[1].iov_base = (char *)(req->Buffer);
1872         iov[1].iov_len = len;
1873
1874         inc_rfc1001_len(req, len - 1 /* Buffer */);
1875
1876         rc = SendReceive2(xid, ses, iov, 2, &resp_buftype, 0);
1877         rsp = (struct smb2_query_directory_rsp *)iov[0].iov_base;
1878
1879         if (rc) {
1880                 cifs_stats_fail_inc(tcon, SMB2_QUERY_DIRECTORY_HE);
1881                 goto qdir_exit;
1882         }
1883
1884         rc = validate_buf(le16_to_cpu(rsp->OutputBufferOffset),
1885                           le32_to_cpu(rsp->OutputBufferLength), &rsp->hdr,
1886                           info_buf_size);
1887         if (rc)
1888                 goto qdir_exit;
1889
1890         srch_inf->unicode = true;
1891
1892         if (srch_inf->ntwrk_buf_start) {
1893                 if (srch_inf->smallBuf)
1894                         cifs_small_buf_release(srch_inf->ntwrk_buf_start);
1895                 else
1896                         cifs_buf_release(srch_inf->ntwrk_buf_start);
1897         }
1898         srch_inf->ntwrk_buf_start = (char *)rsp;
1899         srch_inf->srch_entries_start = srch_inf->last_entry = 4 /* rfclen */ +
1900                 (char *)&rsp->hdr + le16_to_cpu(rsp->OutputBufferOffset);
1901         /* 4 for rfc1002 length field */
1902         end_of_smb = get_rfc1002_length(rsp) + 4 + (char *)&rsp->hdr;
1903         srch_inf->entries_in_buffer =
1904                         num_entries(srch_inf->srch_entries_start, end_of_smb,
1905                                     &srch_inf->last_entry, info_buf_size);
1906         srch_inf->index_of_last_entry += srch_inf->entries_in_buffer;
1907         cifs_dbg(FYI, "num entries %d last_index %lld srch start %p srch end %p\n",
1908                  srch_inf->entries_in_buffer, srch_inf->index_of_last_entry,
1909                  srch_inf->srch_entries_start, srch_inf->last_entry);
1910         if (resp_buftype == CIFS_LARGE_BUFFER)
1911                 srch_inf->smallBuf = false;
1912         else if (resp_buftype == CIFS_SMALL_BUFFER)
1913                 srch_inf->smallBuf = true;
1914         else
1915                 cifs_dbg(VFS, "illegal search buffer type\n");
1916
1917         if (rsp->hdr.Status == STATUS_NO_MORE_FILES)
1918                 srch_inf->endOfSearch = 1;
1919         else
1920                 srch_inf->endOfSearch = 0;
1921
1922         return rc;
1923
1924 qdir_exit:
1925         free_rsp_buf(resp_buftype, rsp);
1926         return rc;
1927 }
1928
1929 static int
1930 send_set_info(const unsigned int xid, struct cifs_tcon *tcon,
1931                u64 persistent_fid, u64 volatile_fid, u32 pid, int info_class,
1932                unsigned int num, void **data, unsigned int *size)
1933 {
1934         struct smb2_set_info_req *req;
1935         struct smb2_set_info_rsp *rsp = NULL;
1936         struct kvec *iov;
1937         int rc = 0;
1938         int resp_buftype;
1939         unsigned int i;
1940         struct TCP_Server_Info *server;
1941         struct cifs_ses *ses = tcon->ses;
1942
1943         if (ses && (ses->server))
1944                 server = ses->server;
1945         else
1946                 return -EIO;
1947
1948         if (!num)
1949                 return -EINVAL;
1950
1951         iov = kmalloc(sizeof(struct kvec) * num, GFP_KERNEL);
1952         if (!iov)
1953                 return -ENOMEM;
1954
1955         rc = small_smb2_init(SMB2_SET_INFO, tcon, (void **) &req);
1956         if (rc) {
1957                 kfree(iov);
1958                 return rc;
1959         }
1960
1961         req->hdr.ProcessId = cpu_to_le32(pid);
1962
1963         req->InfoType = SMB2_O_INFO_FILE;
1964         req->FileInfoClass = info_class;
1965         req->PersistentFileId = persistent_fid;
1966         req->VolatileFileId = volatile_fid;
1967
1968         /* 4 for RFC1001 length and 1 for Buffer */
1969         req->BufferOffset =
1970                         cpu_to_le16(sizeof(struct smb2_set_info_req) - 1 - 4);
1971         req->BufferLength = cpu_to_le32(*size);
1972
1973         inc_rfc1001_len(req, *size - 1 /* Buffer */);
1974
1975         memcpy(req->Buffer, *data, *size);
1976
1977         iov[0].iov_base = (char *)req;
1978         /* 4 for RFC1001 length */
1979         iov[0].iov_len = get_rfc1002_length(req) + 4;
1980
1981         for (i = 1; i < num; i++) {
1982                 inc_rfc1001_len(req, size[i]);
1983                 le32_add_cpu(&req->BufferLength, size[i]);
1984                 iov[i].iov_base = (char *)data[i];
1985                 iov[i].iov_len = size[i];
1986         }
1987
1988         rc = SendReceive2(xid, ses, iov, num, &resp_buftype, 0);
1989         rsp = (struct smb2_set_info_rsp *)iov[0].iov_base;
1990
1991         if (rc != 0) {
1992                 cifs_stats_fail_inc(tcon, SMB2_SET_INFO_HE);
1993                 goto out;
1994         }
1995 out:
1996         free_rsp_buf(resp_buftype, rsp);
1997         kfree(iov);
1998         return rc;
1999 }
2000
2001 int
2002 SMB2_rename(const unsigned int xid, struct cifs_tcon *tcon,
2003             u64 persistent_fid, u64 volatile_fid, __le16 *target_file)
2004 {
2005         struct smb2_file_rename_info info;
2006         void **data;
2007         unsigned int size[2];
2008         int rc;
2009         int len = (2 * UniStrnlen((wchar_t *)target_file, PATH_MAX));
2010
2011         data = kmalloc(sizeof(void *) * 2, GFP_KERNEL);
2012         if (!data)
2013                 return -ENOMEM;
2014
2015         info.ReplaceIfExists = 1; /* 1 = replace existing target with new */
2016                               /* 0 = fail if target already exists */
2017         info.RootDirectory = 0;  /* MBZ for network ops (why does spec say?) */
2018         info.FileNameLength = cpu_to_le32(len);
2019
2020         data[0] = &info;
2021         size[0] = sizeof(struct smb2_file_rename_info);
2022
2023         data[1] = target_file;
2024         size[1] = len + 2 /* null */;
2025
2026         rc = send_set_info(xid, tcon, persistent_fid, volatile_fid,
2027                            current->tgid, FILE_RENAME_INFORMATION, 2, data,
2028                            size);
2029         kfree(data);
2030         return rc;
2031 }
2032
2033 int
2034 SMB2_set_hardlink(const unsigned int xid, struct cifs_tcon *tcon,
2035                   u64 persistent_fid, u64 volatile_fid, __le16 *target_file)
2036 {
2037         struct smb2_file_link_info info;
2038         void **data;
2039         unsigned int size[2];
2040         int rc;
2041         int len = (2 * UniStrnlen((wchar_t *)target_file, PATH_MAX));
2042
2043         data = kmalloc(sizeof(void *) * 2, GFP_KERNEL);
2044         if (!data)
2045                 return -ENOMEM;
2046
2047         info.ReplaceIfExists = 0; /* 1 = replace existing link with new */
2048                               /* 0 = fail if link already exists */
2049         info.RootDirectory = 0;  /* MBZ for network ops (why does spec say?) */
2050         info.FileNameLength = cpu_to_le32(len);
2051
2052         data[0] = &info;
2053         size[0] = sizeof(struct smb2_file_link_info);
2054
2055         data[1] = target_file;
2056         size[1] = len + 2 /* null */;
2057
2058         rc = send_set_info(xid, tcon, persistent_fid, volatile_fid,
2059                            current->tgid, FILE_LINK_INFORMATION, 2, data, size);
2060         kfree(data);
2061         return rc;
2062 }
2063
2064 int
2065 SMB2_set_eof(const unsigned int xid, struct cifs_tcon *tcon, u64 persistent_fid,
2066              u64 volatile_fid, u32 pid, __le64 *eof)
2067 {
2068         struct smb2_file_eof_info info;
2069         void *data;
2070         unsigned int size;
2071
2072         info.EndOfFile = *eof;
2073
2074         data = &info;
2075         size = sizeof(struct smb2_file_eof_info);
2076
2077         return send_set_info(xid, tcon, persistent_fid, volatile_fid, pid,
2078                              FILE_END_OF_FILE_INFORMATION, 1, &data, &size);
2079 }
2080
2081 int
2082 SMB2_set_info(const unsigned int xid, struct cifs_tcon *tcon,
2083               u64 persistent_fid, u64 volatile_fid, FILE_BASIC_INFO *buf)
2084 {
2085         unsigned int size;
2086         size = sizeof(FILE_BASIC_INFO);
2087         return send_set_info(xid, tcon, persistent_fid, volatile_fid,
2088                              current->tgid, FILE_BASIC_INFORMATION, 1,
2089                              (void **)&buf, &size);
2090 }
2091
2092 int
2093 SMB2_oplock_break(const unsigned int xid, struct cifs_tcon *tcon,
2094                   const u64 persistent_fid, const u64 volatile_fid,
2095                   __u8 oplock_level)
2096 {
2097         int rc;
2098         struct smb2_oplock_break *req = NULL;
2099
2100         cifs_dbg(FYI, "SMB2_oplock_break\n");
2101         rc = small_smb2_init(SMB2_OPLOCK_BREAK, tcon, (void **) &req);
2102
2103         if (rc)
2104                 return rc;
2105
2106         req->VolatileFid = volatile_fid;
2107         req->PersistentFid = persistent_fid;
2108         req->OplockLevel = oplock_level;
2109         req->hdr.CreditRequest = cpu_to_le16(1);
2110
2111         rc = SendReceiveNoRsp(xid, tcon->ses, (char *) req, CIFS_OBREAK_OP);
2112         /* SMB2 buffer freed by function above */
2113
2114         if (rc) {
2115                 cifs_stats_fail_inc(tcon, SMB2_OPLOCK_BREAK_HE);
2116                 cifs_dbg(FYI, "Send error in Oplock Break = %d\n", rc);
2117         }
2118
2119         return rc;
2120 }
2121
2122 static void
2123 copy_fs_info_to_kstatfs(struct smb2_fs_full_size_info *pfs_inf,
2124                         struct kstatfs *kst)
2125 {
2126         kst->f_bsize = le32_to_cpu(pfs_inf->BytesPerSector) *
2127                           le32_to_cpu(pfs_inf->SectorsPerAllocationUnit);
2128         kst->f_blocks = le64_to_cpu(pfs_inf->TotalAllocationUnits);
2129         kst->f_bfree  = le64_to_cpu(pfs_inf->ActualAvailableAllocationUnits);
2130         kst->f_bavail = le64_to_cpu(pfs_inf->CallerAvailableAllocationUnits);
2131         return;
2132 }
2133
2134 static int
2135 build_qfs_info_req(struct kvec *iov, struct cifs_tcon *tcon, int level,
2136                    int outbuf_len, u64 persistent_fid, u64 volatile_fid)
2137 {
2138         int rc;
2139         struct smb2_query_info_req *req;
2140
2141         cifs_dbg(FYI, "Query FSInfo level %d\n", level);
2142
2143         if ((tcon->ses == NULL) || (tcon->ses->server == NULL))
2144                 return -EIO;
2145
2146         rc = small_smb2_init(SMB2_QUERY_INFO, tcon, (void **) &req);
2147         if (rc)
2148                 return rc;
2149
2150         req->InfoType = SMB2_O_INFO_FILESYSTEM;
2151         req->FileInfoClass = level;
2152         req->PersistentFileId = persistent_fid;
2153         req->VolatileFileId = volatile_fid;
2154         /* 4 for rfc1002 length field and 1 for pad */
2155         req->InputBufferOffset =
2156                         cpu_to_le16(sizeof(struct smb2_query_info_req) - 1 - 4);
2157         req->OutputBufferLength = cpu_to_le32(
2158                 outbuf_len + sizeof(struct smb2_query_info_rsp) - 1 - 4);
2159
2160         iov->iov_base = (char *)req;
2161         /* 4 for rfc1002 length field */
2162         iov->iov_len = get_rfc1002_length(req) + 4;
2163         return 0;
2164 }
2165
2166 int
2167 SMB2_QFS_info(const unsigned int xid, struct cifs_tcon *tcon,
2168               u64 persistent_fid, u64 volatile_fid, struct kstatfs *fsdata)
2169 {
2170         struct smb2_query_info_rsp *rsp = NULL;
2171         struct kvec iov;
2172         int rc = 0;
2173         int resp_buftype;
2174         struct cifs_ses *ses = tcon->ses;
2175         struct smb2_fs_full_size_info *info = NULL;
2176
2177         rc = build_qfs_info_req(&iov, tcon, FS_FULL_SIZE_INFORMATION,
2178                                 sizeof(struct smb2_fs_full_size_info),
2179                                 persistent_fid, volatile_fid);
2180         if (rc)
2181                 return rc;
2182
2183         rc = SendReceive2(xid, ses, &iov, 1, &resp_buftype, 0);
2184         if (rc) {
2185                 cifs_stats_fail_inc(tcon, SMB2_QUERY_INFO_HE);
2186                 goto qinf_exit;
2187         }
2188         rsp = (struct smb2_query_info_rsp *)iov.iov_base;
2189
2190         info = (struct smb2_fs_full_size_info *)(4 /* RFC1001 len */ +
2191                 le16_to_cpu(rsp->OutputBufferOffset) + (char *)&rsp->hdr);
2192         rc = validate_buf(le16_to_cpu(rsp->OutputBufferOffset),
2193                           le32_to_cpu(rsp->OutputBufferLength), &rsp->hdr,
2194                           sizeof(struct smb2_fs_full_size_info));
2195         if (!rc)
2196                 copy_fs_info_to_kstatfs(info, fsdata);
2197
2198 qinf_exit:
2199         free_rsp_buf(resp_buftype, iov.iov_base);
2200         return rc;
2201 }
2202
2203 int
2204 smb2_lockv(const unsigned int xid, struct cifs_tcon *tcon,
2205            const __u64 persist_fid, const __u64 volatile_fid, const __u32 pid,
2206            const __u32 num_lock, struct smb2_lock_element *buf)
2207 {
2208         int rc = 0;
2209         struct smb2_lock_req *req = NULL;
2210         struct kvec iov[2];
2211         int resp_buf_type;
2212         unsigned int count;
2213
2214         cifs_dbg(FYI, "smb2_lockv num lock %d\n", num_lock);
2215
2216         rc = small_smb2_init(SMB2_LOCK, tcon, (void **) &req);
2217         if (rc)
2218                 return rc;
2219
2220         req->hdr.ProcessId = cpu_to_le32(pid);
2221         req->LockCount = cpu_to_le16(num_lock);
2222
2223         req->PersistentFileId = persist_fid;
2224         req->VolatileFileId = volatile_fid;
2225
2226         count = num_lock * sizeof(struct smb2_lock_element);
2227         inc_rfc1001_len(req, count - sizeof(struct smb2_lock_element));
2228
2229         iov[0].iov_base = (char *)req;
2230         /* 4 for rfc1002 length field and count for all locks */
2231         iov[0].iov_len = get_rfc1002_length(req) + 4 - count;
2232         iov[1].iov_base = (char *)buf;
2233         iov[1].iov_len = count;
2234
2235         cifs_stats_inc(&tcon->stats.cifs_stats.num_locks);
2236         rc = SendReceive2(xid, tcon->ses, iov, 2, &resp_buf_type, CIFS_NO_RESP);
2237         if (rc) {
2238                 cifs_dbg(FYI, "Send error in smb2_lockv = %d\n", rc);
2239                 cifs_stats_fail_inc(tcon, SMB2_LOCK_HE);
2240         }
2241
2242         return rc;
2243 }
2244
2245 int
2246 SMB2_lock(const unsigned int xid, struct cifs_tcon *tcon,
2247           const __u64 persist_fid, const __u64 volatile_fid, const __u32 pid,
2248           const __u64 length, const __u64 offset, const __u32 lock_flags,
2249           const bool wait)
2250 {
2251         struct smb2_lock_element lock;
2252
2253         lock.Offset = cpu_to_le64(offset);
2254         lock.Length = cpu_to_le64(length);
2255         lock.Flags = cpu_to_le32(lock_flags);
2256         if (!wait && lock_flags != SMB2_LOCKFLAG_UNLOCK)
2257                 lock.Flags |= cpu_to_le32(SMB2_LOCKFLAG_FAIL_IMMEDIATELY);
2258
2259         return smb2_lockv(xid, tcon, persist_fid, volatile_fid, pid, 1, &lock);
2260 }
2261
2262 int
2263 SMB2_lease_break(const unsigned int xid, struct cifs_tcon *tcon,
2264                  __u8 *lease_key, const __le32 lease_state)
2265 {
2266         int rc;
2267         struct smb2_lease_ack *req = NULL;
2268
2269         cifs_dbg(FYI, "SMB2_lease_break\n");
2270         rc = small_smb2_init(SMB2_OPLOCK_BREAK, tcon, (void **) &req);
2271
2272         if (rc)
2273                 return rc;
2274
2275         req->hdr.CreditRequest = cpu_to_le16(1);
2276         req->StructureSize = cpu_to_le16(36);
2277         inc_rfc1001_len(req, 12);
2278
2279         memcpy(req->LeaseKey, lease_key, 16);
2280         req->LeaseState = lease_state;
2281
2282         rc = SendReceiveNoRsp(xid, tcon->ses, (char *) req, CIFS_OBREAK_OP);
2283         /* SMB2 buffer freed by function above */
2284
2285         if (rc) {
2286                 cifs_stats_fail_inc(tcon, SMB2_OPLOCK_BREAK_HE);
2287                 cifs_dbg(FYI, "Send error in Lease Break = %d\n", rc);
2288         }
2289
2290         return rc;
2291 }