Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 1 | /* |
| 2 | * fs/cifs/misc.c |
| 3 | * |
Steve French | 8345187 | 2005-12-01 17:12:59 -0800 | [diff] [blame] | 4 | * Copyright (C) International Business Machines Corp., 2002,2005 |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 5 | * Author(s): Steve French (sfrench@us.ibm.com) |
| 6 | * |
| 7 | * This library is free software; you can redistribute it and/or modify |
| 8 | * it under the terms of the GNU Lesser General Public License as published |
| 9 | * by the Free Software Foundation; either version 2.1 of the License, or |
| 10 | * (at your option) any later version. |
| 11 | * |
| 12 | * This library is distributed in the hope that it will be useful, |
| 13 | * but WITHOUT ANY WARRANTY; without even the implied warranty of |
| 14 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See |
| 15 | * the GNU Lesser General Public License for more details. |
| 16 | * |
| 17 | * You should have received a copy of the GNU Lesser General Public License |
| 18 | * along with this library; if not, write to the Free Software |
| 19 | * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA |
| 20 | */ |
| 21 | |
| 22 | #include <linux/slab.h> |
| 23 | #include <linux/ctype.h> |
| 24 | #include <linux/mempool.h> |
| 25 | #include "cifspdu.h" |
| 26 | #include "cifsglob.h" |
| 27 | #include "cifsproto.h" |
| 28 | #include "cifs_debug.h" |
| 29 | #include "smberr.h" |
| 30 | #include "nterr.h" |
Steve French | 6c91d36 | 2005-04-28 22:41:06 -0700 | [diff] [blame] | 31 | #include "cifs_unicode.h" |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 32 | |
| 33 | extern mempool_t *cifs_sm_req_poolp; |
| 34 | extern mempool_t *cifs_req_poolp; |
| 35 | extern struct task_struct * oplockThread; |
| 36 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 37 | /* The xid serves as a useful identifier for each incoming vfs request, |
| 38 | in a similar way to the mid which is useful to track each sent smb, |
| 39 | and CurrentXid can also provide a running counter (although it |
| 40 | will eventually wrap past zero) of the total vfs operations handled |
| 41 | since the cifs fs was mounted */ |
| 42 | |
| 43 | unsigned int |
| 44 | _GetXid(void) |
| 45 | { |
| 46 | unsigned int xid; |
| 47 | |
| 48 | spin_lock(&GlobalMid_Lock); |
| 49 | GlobalTotalActiveXid++; |
| 50 | if (GlobalTotalActiveXid > GlobalMaxActiveXid) |
| 51 | GlobalMaxActiveXid = GlobalTotalActiveXid; /* keep high water mark for number of simultaneous vfs ops in our filesystem */ |
Steve French | 1982c34 | 2005-08-17 12:38:22 -0700 | [diff] [blame] | 52 | if(GlobalTotalActiveXid > 65000) |
| 53 | cFYI(1,("warning: more than 65000 requests active")); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 54 | xid = GlobalCurrentXid++; |
| 55 | spin_unlock(&GlobalMid_Lock); |
| 56 | return xid; |
| 57 | } |
| 58 | |
| 59 | void |
| 60 | _FreeXid(unsigned int xid) |
| 61 | { |
| 62 | spin_lock(&GlobalMid_Lock); |
| 63 | /* if(GlobalTotalActiveXid == 0) |
| 64 | BUG(); */ |
| 65 | GlobalTotalActiveXid--; |
| 66 | spin_unlock(&GlobalMid_Lock); |
| 67 | } |
| 68 | |
| 69 | struct cifsSesInfo * |
| 70 | sesInfoAlloc(void) |
| 71 | { |
| 72 | struct cifsSesInfo *ret_buf; |
| 73 | |
| 74 | ret_buf = |
Eric Sesterhenn | a048d7a | 2006-02-21 22:33:09 +0000 | [diff] [blame] | 75 | (struct cifsSesInfo *) kzalloc(sizeof (struct cifsSesInfo), |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 76 | GFP_KERNEL); |
| 77 | if (ret_buf) { |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 78 | write_lock(&GlobalSMBSeslock); |
| 79 | atomic_inc(&sesInfoAllocCount); |
| 80 | ret_buf->status = CifsNew; |
| 81 | list_add(&ret_buf->cifsSessionList, &GlobalSMBSessionList); |
| 82 | init_MUTEX(&ret_buf->sesSem); |
| 83 | write_unlock(&GlobalSMBSeslock); |
| 84 | } |
| 85 | return ret_buf; |
| 86 | } |
| 87 | |
| 88 | void |
| 89 | sesInfoFree(struct cifsSesInfo *buf_to_free) |
| 90 | { |
| 91 | if (buf_to_free == NULL) { |
| 92 | cFYI(1, ("Null buffer passed to sesInfoFree")); |
| 93 | return; |
| 94 | } |
| 95 | |
| 96 | write_lock(&GlobalSMBSeslock); |
| 97 | atomic_dec(&sesInfoAllocCount); |
| 98 | list_del(&buf_to_free->cifsSessionList); |
| 99 | write_unlock(&GlobalSMBSeslock); |
Jesper Juhl | f99d49a | 2005-11-07 01:01:34 -0800 | [diff] [blame] | 100 | kfree(buf_to_free->serverOS); |
| 101 | kfree(buf_to_free->serverDomain); |
| 102 | kfree(buf_to_free->serverNOS); |
| 103 | kfree(buf_to_free->password); |
Steve French | 3979877 | 2006-05-31 22:40:51 +0000 | [diff] [blame^] | 104 | kfree(buf_to_free->domainName); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 105 | kfree(buf_to_free); |
| 106 | } |
| 107 | |
| 108 | struct cifsTconInfo * |
| 109 | tconInfoAlloc(void) |
| 110 | { |
| 111 | struct cifsTconInfo *ret_buf; |
| 112 | ret_buf = |
Eric Sesterhenn | a048d7a | 2006-02-21 22:33:09 +0000 | [diff] [blame] | 113 | (struct cifsTconInfo *) kzalloc(sizeof (struct cifsTconInfo), |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 114 | GFP_KERNEL); |
| 115 | if (ret_buf) { |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 116 | write_lock(&GlobalSMBSeslock); |
| 117 | atomic_inc(&tconInfoAllocCount); |
| 118 | list_add(&ret_buf->cifsConnectionList, |
| 119 | &GlobalTreeConnectionList); |
| 120 | ret_buf->tidStatus = CifsNew; |
| 121 | INIT_LIST_HEAD(&ret_buf->openFileList); |
| 122 | init_MUTEX(&ret_buf->tconSem); |
| 123 | #ifdef CONFIG_CIFS_STATS |
| 124 | spin_lock_init(&ret_buf->stat_lock); |
| 125 | #endif |
| 126 | write_unlock(&GlobalSMBSeslock); |
| 127 | } |
| 128 | return ret_buf; |
| 129 | } |
| 130 | |
| 131 | void |
| 132 | tconInfoFree(struct cifsTconInfo *buf_to_free) |
| 133 | { |
| 134 | if (buf_to_free == NULL) { |
| 135 | cFYI(1, ("Null buffer passed to tconInfoFree")); |
| 136 | return; |
| 137 | } |
| 138 | write_lock(&GlobalSMBSeslock); |
| 139 | atomic_dec(&tconInfoAllocCount); |
| 140 | list_del(&buf_to_free->cifsConnectionList); |
| 141 | write_unlock(&GlobalSMBSeslock); |
Jesper Juhl | f99d49a | 2005-11-07 01:01:34 -0800 | [diff] [blame] | 142 | kfree(buf_to_free->nativeFileSystem); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 143 | kfree(buf_to_free); |
| 144 | } |
| 145 | |
| 146 | struct smb_hdr * |
| 147 | cifs_buf_get(void) |
| 148 | { |
| 149 | struct smb_hdr *ret_buf = NULL; |
| 150 | |
| 151 | /* We could use negotiated size instead of max_msgsize - |
| 152 | but it may be more efficient to always alloc same size |
| 153 | albeit slightly larger than necessary and maxbuffersize |
| 154 | defaults to this and can not be bigger */ |
| 155 | ret_buf = |
| 156 | (struct smb_hdr *) mempool_alloc(cifs_req_poolp, SLAB_KERNEL | SLAB_NOFS); |
| 157 | |
| 158 | /* clear the first few header bytes */ |
| 159 | /* for most paths, more is cleared in header_assemble */ |
| 160 | if (ret_buf) { |
| 161 | memset(ret_buf, 0, sizeof(struct smb_hdr) + 3); |
| 162 | atomic_inc(&bufAllocCount); |
Steve French | 4498eed | 2005-12-03 13:58:57 -0800 | [diff] [blame] | 163 | #ifdef CONFIG_CIFS_STATS2 |
| 164 | atomic_inc(&totBufAllocCount); |
| 165 | #endif /* CONFIG_CIFS_STATS2 */ |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 166 | } |
| 167 | |
| 168 | return ret_buf; |
| 169 | } |
| 170 | |
| 171 | void |
| 172 | cifs_buf_release(void *buf_to_free) |
| 173 | { |
| 174 | |
| 175 | if (buf_to_free == NULL) { |
| 176 | /* cFYI(1, ("Null buffer passed to cifs_buf_release"));*/ |
| 177 | return; |
| 178 | } |
| 179 | mempool_free(buf_to_free,cifs_req_poolp); |
| 180 | |
| 181 | atomic_dec(&bufAllocCount); |
| 182 | return; |
| 183 | } |
| 184 | |
| 185 | struct smb_hdr * |
| 186 | cifs_small_buf_get(void) |
| 187 | { |
| 188 | struct smb_hdr *ret_buf = NULL; |
| 189 | |
| 190 | /* We could use negotiated size instead of max_msgsize - |
| 191 | but it may be more efficient to always alloc same size |
| 192 | albeit slightly larger than necessary and maxbuffersize |
| 193 | defaults to this and can not be bigger */ |
| 194 | ret_buf = |
| 195 | (struct smb_hdr *) mempool_alloc(cifs_sm_req_poolp, SLAB_KERNEL | SLAB_NOFS); |
| 196 | if (ret_buf) { |
| 197 | /* No need to clear memory here, cleared in header assemble */ |
| 198 | /* memset(ret_buf, 0, sizeof(struct smb_hdr) + 27);*/ |
| 199 | atomic_inc(&smBufAllocCount); |
Steve French | 4498eed | 2005-12-03 13:58:57 -0800 | [diff] [blame] | 200 | #ifdef CONFIG_CIFS_STATS2 |
| 201 | atomic_inc(&totSmBufAllocCount); |
| 202 | #endif /* CONFIG_CIFS_STATS2 */ |
| 203 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 204 | } |
| 205 | return ret_buf; |
| 206 | } |
| 207 | |
| 208 | void |
| 209 | cifs_small_buf_release(void *buf_to_free) |
| 210 | { |
| 211 | |
| 212 | if (buf_to_free == NULL) { |
| 213 | cFYI(1, ("Null buffer passed to cifs_small_buf_release")); |
| 214 | return; |
| 215 | } |
| 216 | mempool_free(buf_to_free,cifs_sm_req_poolp); |
| 217 | |
| 218 | atomic_dec(&smBufAllocCount); |
| 219 | return; |
| 220 | } |
| 221 | |
Steve French | 1982c34 | 2005-08-17 12:38:22 -0700 | [diff] [blame] | 222 | /* |
| 223 | Find a free multiplex id (SMB mid). Otherwise there could be |
| 224 | mid collisions which might cause problems, demultiplexing the |
| 225 | wrong response to this request. Multiplex ids could collide if |
| 226 | one of a series requests takes much longer than the others, or |
| 227 | if a very large number of long lived requests (byte range |
| 228 | locks or FindNotify requests) are pending. No more than |
| 229 | 64K-1 requests can be outstanding at one time. If no |
| 230 | mids are available, return zero. A future optimization |
| 231 | could make the combination of mids and uid the key we use |
| 232 | to demultiplex on (rather than mid alone). |
| 233 | In addition to the above check, the cifs demultiplex |
| 234 | code already used the command code as a secondary |
| 235 | check of the frame and if signing is negotiated the |
| 236 | response would be discarded if the mid were the same |
| 237 | but the signature was wrong. Since the mid is not put in the |
| 238 | pending queue until later (when it is about to be dispatched) |
| 239 | we do have to limit the number of outstanding requests |
| 240 | to somewhat less than 64K-1 although it is hard to imagine |
| 241 | so many threads being in the vfs at one time. |
| 242 | */ |
| 243 | __u16 GetNextMid(struct TCP_Server_Info *server) |
| 244 | { |
| 245 | __u16 mid = 0; |
| 246 | __u16 last_mid; |
| 247 | int collision; |
| 248 | |
| 249 | if(server == NULL) |
| 250 | return mid; |
| 251 | |
| 252 | spin_lock(&GlobalMid_Lock); |
| 253 | last_mid = server->CurrentMid; /* we do not want to loop forever */ |
| 254 | server->CurrentMid++; |
| 255 | /* This nested loop looks more expensive than it is. |
| 256 | In practice the list of pending requests is short, |
| 257 | fewer than 50, and the mids are likely to be unique |
| 258 | on the first pass through the loop unless some request |
| 259 | takes longer than the 64 thousand requests before it |
| 260 | (and it would also have to have been a request that |
| 261 | did not time out) */ |
| 262 | while(server->CurrentMid != last_mid) { |
| 263 | struct list_head *tmp; |
| 264 | struct mid_q_entry *mid_entry; |
| 265 | |
| 266 | collision = 0; |
| 267 | if(server->CurrentMid == 0) |
| 268 | server->CurrentMid++; |
| 269 | |
| 270 | list_for_each(tmp, &server->pending_mid_q) { |
| 271 | mid_entry = list_entry(tmp, struct mid_q_entry, qhead); |
| 272 | |
| 273 | if ((mid_entry->mid == server->CurrentMid) && |
| 274 | (mid_entry->midState == MID_REQUEST_SUBMITTED)) { |
| 275 | /* This mid is in use, try a different one */ |
| 276 | collision = 1; |
| 277 | break; |
| 278 | } |
| 279 | } |
| 280 | if(collision == 0) { |
| 281 | mid = server->CurrentMid; |
| 282 | break; |
| 283 | } |
| 284 | server->CurrentMid++; |
| 285 | } |
| 286 | spin_unlock(&GlobalMid_Lock); |
| 287 | return mid; |
| 288 | } |
| 289 | |
| 290 | /* NB: MID can not be set if treeCon not passed in, in that |
| 291 | case it is responsbility of caller to set the mid */ |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 292 | void |
| 293 | header_assemble(struct smb_hdr *buffer, char smb_command /* command */ , |
| 294 | const struct cifsTconInfo *treeCon, int word_count |
| 295 | /* length of fixed section (word count) in two byte units */) |
| 296 | { |
| 297 | struct list_head* temp_item; |
| 298 | struct cifsSesInfo * ses; |
| 299 | char *temp = (char *) buffer; |
| 300 | |
Steve French | ec637e3 | 2005-12-12 20:53:18 -0800 | [diff] [blame] | 301 | memset(temp,0,256); /* bigger than MAX_CIFS_HDR_SIZE */ |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 302 | |
| 303 | buffer->smb_buf_length = |
| 304 | (2 * word_count) + sizeof (struct smb_hdr) - |
| 305 | 4 /* RFC 1001 length field does not count */ + |
| 306 | 2 /* for bcc field itself */ ; |
Steve French | 1982c34 | 2005-08-17 12:38:22 -0700 | [diff] [blame] | 307 | /* Note that this is the only network field that has to be converted |
| 308 | to big endian and it is done just before we send it */ |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 309 | |
| 310 | buffer->Protocol[0] = 0xFF; |
| 311 | buffer->Protocol[1] = 'S'; |
| 312 | buffer->Protocol[2] = 'M'; |
| 313 | buffer->Protocol[3] = 'B'; |
| 314 | buffer->Command = smb_command; |
| 315 | buffer->Flags = 0x00; /* case sensitive */ |
| 316 | buffer->Flags2 = SMBFLG2_KNOWS_LONG_NAMES; |
| 317 | buffer->Pid = cpu_to_le16((__u16)current->tgid); |
| 318 | buffer->PidHigh = cpu_to_le16((__u16)(current->tgid >> 16)); |
| 319 | spin_lock(&GlobalMid_Lock); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 320 | spin_unlock(&GlobalMid_Lock); |
| 321 | if (treeCon) { |
| 322 | buffer->Tid = treeCon->tid; |
| 323 | if (treeCon->ses) { |
| 324 | if (treeCon->ses->capabilities & CAP_UNICODE) |
| 325 | buffer->Flags2 |= SMBFLG2_UNICODE; |
| 326 | if (treeCon->ses->capabilities & CAP_STATUS32) { |
| 327 | buffer->Flags2 |= SMBFLG2_ERR_STATUS; |
| 328 | } |
Steve French | 1982c34 | 2005-08-17 12:38:22 -0700 | [diff] [blame] | 329 | /* Uid is not converted */ |
| 330 | buffer->Uid = treeCon->ses->Suid; |
| 331 | buffer->Mid = GetNextMid(treeCon->ses->server); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 332 | if(multiuser_mount != 0) { |
| 333 | /* For the multiuser case, there are few obvious technically */ |
| 334 | /* possible mechanisms to match the local linux user (uid) */ |
| 335 | /* to a valid remote smb user (smb_uid): */ |
| 336 | /* 1) Query Winbind (or other local pam/nss daemon */ |
| 337 | /* for userid/password/logon_domain or credential */ |
| 338 | /* 2) Query Winbind for uid to sid to username mapping */ |
| 339 | /* and see if we have a matching password for existing*/ |
| 340 | /* session for that user perhas getting password by */ |
| 341 | /* adding a new pam_cifs module that stores passwords */ |
| 342 | /* so that the cifs vfs can get at that for all logged*/ |
| 343 | /* on users */ |
| 344 | /* 3) (Which is the mechanism we have chosen) */ |
| 345 | /* Search through sessions to the same server for a */ |
| 346 | /* a match on the uid that was passed in on mount */ |
| 347 | /* with the current processes uid (or euid?) and use */ |
| 348 | /* that smb uid. If no existing smb session for */ |
| 349 | /* that uid found, use the default smb session ie */ |
| 350 | /* the smb session for the volume mounted which is */ |
| 351 | /* the same as would be used if the multiuser mount */ |
| 352 | /* flag were disabled. */ |
| 353 | |
| 354 | /* BB Add support for establishing new tCon and SMB Session */ |
| 355 | /* with userid/password pairs found on the smb session */ |
| 356 | /* for other target tcp/ip addresses BB */ |
Steve French | 8345187 | 2005-12-01 17:12:59 -0800 | [diff] [blame] | 357 | if(current->fsuid != treeCon->ses->linux_uid) { |
| 358 | cFYI(1,("Multiuser mode and UID did not match tcon uid")); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 359 | read_lock(&GlobalSMBSeslock); |
| 360 | list_for_each(temp_item, &GlobalSMBSessionList) { |
| 361 | ses = list_entry(temp_item, struct cifsSesInfo, cifsSessionList); |
Steve French | 8345187 | 2005-12-01 17:12:59 -0800 | [diff] [blame] | 362 | if(ses->linux_uid == current->fsuid) { |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 363 | if(ses->server == treeCon->ses->server) { |
| 364 | cFYI(1,("found matching uid substitute right smb_uid")); |
| 365 | buffer->Uid = ses->Suid; |
| 366 | break; |
| 367 | } else { |
| 368 | /* BB eventually call cifs_setup_session here */ |
| 369 | cFYI(1,("local UID found but smb sess with this server does not exist")); |
| 370 | } |
| 371 | } |
| 372 | } |
| 373 | read_unlock(&GlobalSMBSeslock); |
| 374 | } |
| 375 | } |
| 376 | } |
| 377 | if (treeCon->Flags & SMB_SHARE_IS_IN_DFS) |
| 378 | buffer->Flags2 |= SMBFLG2_DFS; |
Steve French | d3485d3 | 2005-08-19 11:04:29 -0700 | [diff] [blame] | 379 | if (treeCon->nocase) |
| 380 | buffer->Flags |= SMBFLG_CASELESS; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 381 | if((treeCon->ses) && (treeCon->ses->server)) |
| 382 | if(treeCon->ses->server->secMode & |
| 383 | (SECMODE_SIGN_REQUIRED | SECMODE_SIGN_ENABLED)) |
| 384 | buffer->Flags2 |= SMBFLG2_SECURITY_SIGNATURE; |
| 385 | } |
| 386 | |
| 387 | /* endian conversion of flags is now done just before sending */ |
| 388 | buffer->WordCount = (char) word_count; |
| 389 | return; |
| 390 | } |
| 391 | |
| 392 | int |
| 393 | checkSMBhdr(struct smb_hdr *smb, __u16 mid) |
| 394 | { |
| 395 | /* Make sure that this really is an SMB, that it is a response, |
| 396 | and that the message ids match */ |
| 397 | if ((*(__le32 *) smb->Protocol == cpu_to_le32(0x424d53ff)) && |
| 398 | (mid == smb->Mid)) { |
| 399 | if(smb->Flags & SMBFLG_RESPONSE) |
| 400 | return 0; |
| 401 | else { |
| 402 | /* only one valid case where server sends us request */ |
| 403 | if(smb->Command == SMB_COM_LOCKING_ANDX) |
| 404 | return 0; |
| 405 | else |
Steve French | 6ab16d2 | 2005-11-29 20:55:11 -0800 | [diff] [blame] | 406 | cERROR(1, ("Rcvd Request not response")); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 407 | } |
| 408 | } else { /* bad signature or mid */ |
| 409 | if (*(__le32 *) smb->Protocol != cpu_to_le32(0x424d53ff)) |
| 410 | cERROR(1, |
Steve French | 6ab16d2 | 2005-11-29 20:55:11 -0800 | [diff] [blame] | 411 | ("Bad protocol string signature header %x", |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 412 | *(unsigned int *) smb->Protocol)); |
| 413 | if (mid != smb->Mid) |
| 414 | cERROR(1, ("Mids do not match")); |
| 415 | } |
| 416 | cERROR(1, ("bad smb detected. The Mid=%d", smb->Mid)); |
| 417 | return 1; |
| 418 | } |
| 419 | |
| 420 | int |
| 421 | checkSMB(struct smb_hdr *smb, __u16 mid, int length) |
| 422 | { |
Steve French | 70ca734 | 2005-09-22 16:32:06 -0700 | [diff] [blame] | 423 | __u32 len = smb->smb_buf_length; |
Steve French | 190fdeb | 2005-10-10 11:48:26 -0700 | [diff] [blame] | 424 | __u32 clc_len; /* calculated length */ |
Steve French | 184ed21 | 2006-02-24 06:15:11 +0000 | [diff] [blame] | 425 | cFYI(0, ("checkSMB Length: 0x%x, smb_buf_length: 0x%x", length, len)); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 426 | if (((unsigned int)length < 2 + sizeof (struct smb_hdr)) || |
| 427 | (len > CIFSMaxBufSize + MAX_CIFS_HDR_SIZE - 4)) { |
| 428 | if ((unsigned int)length < 2 + sizeof (struct smb_hdr)) { |
| 429 | if (((unsigned int)length >= |
| 430 | sizeof (struct smb_hdr) - 1) |
| 431 | && (smb->Status.CifsError != 0)) { |
| 432 | smb->WordCount = 0; |
Steve French | 46c79a6 | 2006-03-02 00:07:08 +0000 | [diff] [blame] | 433 | /* some error cases do not return wct and bcc */ |
| 434 | return 0; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 435 | } else { |
| 436 | cERROR(1, ("Length less than smb header size")); |
| 437 | } |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 438 | } |
| 439 | if (len > CIFSMaxBufSize + MAX_CIFS_HDR_SIZE - 4) |
Steve French | 184ed21 | 2006-02-24 06:15:11 +0000 | [diff] [blame] | 440 | cERROR(1, ("smb length greater than MaxBufSize, mid=%d", |
| 441 | smb->Mid)); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 442 | return 1; |
| 443 | } |
| 444 | |
| 445 | if (checkSMBhdr(smb, mid)) |
| 446 | return 1; |
Steve French | 190fdeb | 2005-10-10 11:48:26 -0700 | [diff] [blame] | 447 | clc_len = smbCalcSize_LE(smb); |
Steve French | 184ed21 | 2006-02-24 06:15:11 +0000 | [diff] [blame] | 448 | |
| 449 | if(4 + len != (unsigned int)length) { |
| 450 | cERROR(1, ("Length read does not match RFC1001 length %d",len)); |
| 451 | return 1; |
| 452 | } |
| 453 | |
| 454 | if (4 + len != clc_len) { |
| 455 | /* check if bcc wrapped around for large read responses */ |
| 456 | if((len > 64 * 1024) && (len > clc_len)) { |
| 457 | /* check if lengths match mod 64K */ |
| 458 | if(((4 + len) & 0xFFFF) == (clc_len & 0xFFFF)) |
| 459 | return 0; /* bcc wrapped */ |
| 460 | } |
Steve French | 46c79a6 | 2006-03-02 00:07:08 +0000 | [diff] [blame] | 461 | cFYI(1, ("Calculated size %d vs length %d mismatch for mid %d", |
| 462 | clc_len, 4 + len, smb->Mid)); |
Steve French | 190fdeb | 2005-10-10 11:48:26 -0700 | [diff] [blame] | 463 | /* Windows XP can return a few bytes too much, presumably |
| 464 | an illegal pad, at the end of byte range lock responses |
Steve French | 6ab16d2 | 2005-11-29 20:55:11 -0800 | [diff] [blame] | 465 | so we allow for that three byte pad, as long as actual |
Steve French | 190fdeb | 2005-10-10 11:48:26 -0700 | [diff] [blame] | 466 | received length is as long or longer than calculated length */ |
Steve French | 6ab16d2 | 2005-11-29 20:55:11 -0800 | [diff] [blame] | 467 | /* We have now had to extend this more, since there is a |
| 468 | case in which it needs to be bigger still to handle a |
| 469 | malformed response to transact2 findfirst from WinXP when |
| 470 | access denied is returned and thus bcc and wct are zero |
| 471 | but server says length is 0x21 bytes too long as if the server |
| 472 | forget to reset the smb rfc1001 length when it reset the |
| 473 | wct and bcc to minimum size and drop the t2 parms and data */ |
| 474 | if((4+len > clc_len) && (len <= clc_len + 512)) |
Steve French | 190fdeb | 2005-10-10 11:48:26 -0700 | [diff] [blame] | 475 | return 0; |
Steve French | 46c79a6 | 2006-03-02 00:07:08 +0000 | [diff] [blame] | 476 | else { |
| 477 | cERROR(1, ("RFC1001 size %d bigger than SMB for Mid=%d", |
| 478 | len, smb->Mid)); |
Steve French | 190fdeb | 2005-10-10 11:48:26 -0700 | [diff] [blame] | 479 | return 1; |
Steve French | 46c79a6 | 2006-03-02 00:07:08 +0000 | [diff] [blame] | 480 | } |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 481 | } |
Steve French | 2096243 | 2005-09-21 22:05:57 -0700 | [diff] [blame] | 482 | return 0; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 483 | } |
| 484 | int |
Steve French | d7c8c94 | 2006-03-03 10:43:49 +0000 | [diff] [blame] | 485 | is_valid_oplock_break(struct smb_hdr *buf, struct TCP_Server_Info *srv) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 486 | { |
| 487 | struct smb_com_lock_req * pSMB = (struct smb_com_lock_req *)buf; |
| 488 | struct list_head *tmp; |
| 489 | struct list_head *tmp1; |
| 490 | struct cifsTconInfo *tcon; |
| 491 | struct cifsFileInfo *netfile; |
| 492 | |
| 493 | cFYI(1,("Checking for oplock break or dnotify response")); |
| 494 | if((pSMB->hdr.Command == SMB_COM_NT_TRANSACT) && |
| 495 | (pSMB->hdr.Flags & SMBFLG_RESPONSE)) { |
| 496 | struct smb_com_transaction_change_notify_rsp * pSMBr = |
| 497 | (struct smb_com_transaction_change_notify_rsp *)buf; |
| 498 | struct file_notify_information * pnotify; |
| 499 | __u32 data_offset = 0; |
| 500 | if(pSMBr->ByteCount > sizeof(struct file_notify_information)) { |
| 501 | data_offset = le32_to_cpu(pSMBr->DataOffset); |
| 502 | |
Steve French | 3979877 | 2006-05-31 22:40:51 +0000 | [diff] [blame^] | 503 | pnotify = (struct file_notify_information *) |
| 504 | ((char *)&pSMBr->hdr.Protocol + data_offset); |
| 505 | cFYI(1,("dnotify on %s Action: 0x%x",pnotify->FileName, |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 506 | pnotify->Action)); /* BB removeme BB */ |
Steve French | 3979877 | 2006-05-31 22:40:51 +0000 | [diff] [blame^] | 507 | /* cifs_dump_mem("Rcvd notify Data: ",buf, |
| 508 | sizeof(struct smb_hdr)+60); */ |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 509 | return TRUE; |
| 510 | } |
| 511 | if(pSMBr->hdr.Status.CifsError) { |
| 512 | cFYI(1,("notify err 0x%d",pSMBr->hdr.Status.CifsError)); |
| 513 | return TRUE; |
| 514 | } |
| 515 | return FALSE; |
| 516 | } |
| 517 | if(pSMB->hdr.Command != SMB_COM_LOCKING_ANDX) |
| 518 | return FALSE; |
| 519 | if(pSMB->hdr.Flags & SMBFLG_RESPONSE) { |
| 520 | /* no sense logging error on invalid handle on oplock |
| 521 | break - harmless race between close request and oplock |
| 522 | break response is expected from time to time writing out |
| 523 | large dirty files cached on the client */ |
| 524 | if ((NT_STATUS_INVALID_HANDLE) == |
| 525 | le32_to_cpu(pSMB->hdr.Status.CifsError)) { |
| 526 | cFYI(1,("invalid handle on oplock break")); |
| 527 | return TRUE; |
| 528 | } else if (ERRbadfid == |
| 529 | le16_to_cpu(pSMB->hdr.Status.DosError.Error)) { |
| 530 | return TRUE; |
| 531 | } else { |
| 532 | return FALSE; /* on valid oplock brk we get "request" */ |
| 533 | } |
| 534 | } |
| 535 | if(pSMB->hdr.WordCount != 8) |
| 536 | return FALSE; |
| 537 | |
| 538 | cFYI(1,(" oplock type 0x%d level 0x%d",pSMB->LockType,pSMB->OplockLevel)); |
| 539 | if(!(pSMB->LockType & LOCKING_ANDX_OPLOCK_RELEASE)) |
| 540 | return FALSE; |
| 541 | |
| 542 | /* look up tcon based on tid & uid */ |
| 543 | read_lock(&GlobalSMBSeslock); |
| 544 | list_for_each(tmp, &GlobalTreeConnectionList) { |
| 545 | tcon = list_entry(tmp, struct cifsTconInfo, cifsConnectionList); |
Steve French | d7c8c94 | 2006-03-03 10:43:49 +0000 | [diff] [blame] | 546 | if ((tcon->tid == buf->Tid) && (srv == tcon->ses->server)) { |
Steve French | a454434 | 2005-08-24 13:59:35 -0700 | [diff] [blame] | 547 | cifs_stats_inc(&tcon->num_oplock_brks); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 548 | list_for_each(tmp1,&tcon->openFileList){ |
Steve French | 57337e4 | 2005-04-28 22:41:10 -0700 | [diff] [blame] | 549 | netfile = list_entry(tmp1,struct cifsFileInfo, |
| 550 | tlist); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 551 | if(pSMB->Fid == netfile->netfid) { |
| 552 | struct cifsInodeInfo *pCifsInode; |
| 553 | read_unlock(&GlobalSMBSeslock); |
Steve French | 57337e4 | 2005-04-28 22:41:10 -0700 | [diff] [blame] | 554 | cFYI(1,("file id match, oplock break")); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 555 | pCifsInode = |
| 556 | CIFS_I(netfile->pInode); |
| 557 | pCifsInode->clientCanCacheAll = FALSE; |
| 558 | if(pSMB->OplockLevel == 0) |
Steve French | 57337e4 | 2005-04-28 22:41:10 -0700 | [diff] [blame] | 559 | pCifsInode->clientCanCacheRead |
| 560 | = FALSE; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 561 | pCifsInode->oplockPending = TRUE; |
Steve French | 57337e4 | 2005-04-28 22:41:10 -0700 | [diff] [blame] | 562 | AllocOplockQEntry(netfile->pInode, |
| 563 | netfile->netfid, |
| 564 | tcon); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 565 | cFYI(1,("about to wake up oplock thd")); |
Steve French | 57337e4 | 2005-04-28 22:41:10 -0700 | [diff] [blame] | 566 | if(oplockThread) |
| 567 | wake_up_process(oplockThread); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 568 | return TRUE; |
| 569 | } |
| 570 | } |
| 571 | read_unlock(&GlobalSMBSeslock); |
Steve French | 57337e4 | 2005-04-28 22:41:10 -0700 | [diff] [blame] | 572 | cFYI(1,("No matching file for oplock break")); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 573 | return TRUE; |
| 574 | } |
| 575 | } |
| 576 | read_unlock(&GlobalSMBSeslock); |
| 577 | cFYI(1,("Can not process oplock break for non-existent connection")); |
| 578 | return TRUE; |
| 579 | } |
| 580 | |
| 581 | void |
| 582 | dump_smb(struct smb_hdr *smb_buf, int smb_buf_length) |
| 583 | { |
| 584 | int i, j; |
| 585 | char debug_line[17]; |
| 586 | unsigned char *buffer; |
| 587 | |
| 588 | if (traceSMB == 0) |
| 589 | return; |
| 590 | |
| 591 | buffer = (unsigned char *) smb_buf; |
| 592 | for (i = 0, j = 0; i < smb_buf_length; i++, j++) { |
Steve French | 57337e4 | 2005-04-28 22:41:10 -0700 | [diff] [blame] | 593 | if (i % 8 == 0) { /* have reached the beginning of line */ |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 594 | printk(KERN_DEBUG "| "); |
| 595 | j = 0; |
| 596 | } |
| 597 | printk("%0#4x ", buffer[i]); |
| 598 | debug_line[2 * j] = ' '; |
| 599 | if (isprint(buffer[i])) |
| 600 | debug_line[1 + (2 * j)] = buffer[i]; |
| 601 | else |
| 602 | debug_line[1 + (2 * j)] = '_'; |
| 603 | |
Steve French | 57337e4 | 2005-04-28 22:41:10 -0700 | [diff] [blame] | 604 | if (i % 8 == 7) { /* reached end of line, time to print ascii */ |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 605 | debug_line[16] = 0; |
| 606 | printk(" | %s\n", debug_line); |
| 607 | } |
| 608 | } |
| 609 | for (; j < 8; j++) { |
| 610 | printk(" "); |
| 611 | debug_line[2 * j] = ' '; |
| 612 | debug_line[1 + (2 * j)] = ' '; |
| 613 | } |
| 614 | printk( " | %s\n", debug_line); |
| 615 | return; |
| 616 | } |
Steve French | 6a0b482 | 2005-04-28 22:41:05 -0700 | [diff] [blame] | 617 | |
Steve French | 6a0b482 | 2005-04-28 22:41:05 -0700 | [diff] [blame] | 618 | /* Windows maps these to the user defined 16 bit Unicode range since they are |
| 619 | reserved symbols (along with \ and /), otherwise illegal to store |
| 620 | in filenames in NTFS */ |
Steve French | d072471 | 2005-04-28 22:41:06 -0700 | [diff] [blame] | 621 | #define UNI_ASTERIK (__u16) ('*' + 0xF000) |
| 622 | #define UNI_QUESTION (__u16) ('?' + 0xF000) |
| 623 | #define UNI_COLON (__u16) (':' + 0xF000) |
| 624 | #define UNI_GRTRTHAN (__u16) ('>' + 0xF000) |
| 625 | #define UNI_LESSTHAN (__u16) ('<' + 0xF000) |
| 626 | #define UNI_PIPE (__u16) ('|' + 0xF000) |
| 627 | #define UNI_SLASH (__u16) ('\\' + 0xF000) |
Steve French | 6a0b482 | 2005-04-28 22:41:05 -0700 | [diff] [blame] | 628 | |
| 629 | /* Convert 16 bit Unicode pathname from wire format to string in current code |
| 630 | page. Conversion may involve remapping up the seven characters that are |
| 631 | only legal in POSIX-like OS (if they are present in the string). Path |
| 632 | names are little endian 16 bit Unicode on the wire */ |
| 633 | int |
| 634 | cifs_convertUCSpath(char *target, const __le16 * source, int maxlen, |
| 635 | const struct nls_table * cp) |
| 636 | { |
| 637 | int i,j,len; |
Steve French | d072471 | 2005-04-28 22:41:06 -0700 | [diff] [blame] | 638 | __u16 src_char; |
Steve French | 6a0b482 | 2005-04-28 22:41:05 -0700 | [diff] [blame] | 639 | |
| 640 | for(i = 0, j = 0; i < maxlen; i++) { |
| 641 | src_char = le16_to_cpu(source[i]); |
| 642 | switch (src_char) { |
| 643 | case 0: |
| 644 | goto cUCS_out; /* BB check this BB */ |
| 645 | case UNI_COLON: |
| 646 | target[j] = ':'; |
| 647 | break; |
| 648 | case UNI_ASTERIK: |
| 649 | target[j] = '*'; |
| 650 | break; |
| 651 | case UNI_QUESTION: |
| 652 | target[j] = '?'; |
| 653 | break; |
Steve French | 6c91d36 | 2005-04-28 22:41:06 -0700 | [diff] [blame] | 654 | /* BB We can not handle remapping slash until |
| 655 | all the calls to build_path_from_dentry |
| 656 | are modified, as they use slash as separator BB */ |
| 657 | /* case UNI_SLASH: |
| 658 | target[j] = '\\'; |
| 659 | break;*/ |
Steve French | 6a0b482 | 2005-04-28 22:41:05 -0700 | [diff] [blame] | 660 | case UNI_PIPE: |
| 661 | target[j] = '|'; |
| 662 | break; |
| 663 | case UNI_GRTRTHAN: |
| 664 | target[j] = '>'; |
| 665 | break; |
| 666 | case UNI_LESSTHAN: |
| 667 | target[j] = '<'; |
Steve French | 67594fe | 2005-05-17 13:04:49 -0500 | [diff] [blame] | 668 | break; |
Steve French | 6a0b482 | 2005-04-28 22:41:05 -0700 | [diff] [blame] | 669 | default: |
| 670 | len = cp->uni2char(src_char, &target[j], |
| 671 | NLS_MAX_CHARSET_SIZE); |
| 672 | if(len > 0) { |
| 673 | j += len; |
| 674 | continue; |
| 675 | } else { |
| 676 | target[j] = '?'; |
| 677 | } |
| 678 | } |
| 679 | j++; |
Steve French | 57337e4 | 2005-04-28 22:41:10 -0700 | [diff] [blame] | 680 | /* make sure we do not overrun callers allocated temp buffer */ |
Steve French | 6a0b482 | 2005-04-28 22:41:05 -0700 | [diff] [blame] | 681 | if(j >= (2 * NAME_MAX)) |
| 682 | break; |
| 683 | } |
| 684 | cUCS_out: |
| 685 | target[j] = 0; |
| 686 | return j; |
| 687 | } |
Steve French | 6c91d36 | 2005-04-28 22:41:06 -0700 | [diff] [blame] | 688 | |
| 689 | /* Convert 16 bit Unicode pathname to wire format from string in current code |
| 690 | page. Conversion may involve remapping up the seven characters that are |
| 691 | only legal in POSIX-like OS (if they are present in the string). Path |
| 692 | names are little endian 16 bit Unicode on the wire */ |
| 693 | int |
| 694 | cifsConvertToUCS(__le16 * target, const char *source, int maxlen, |
| 695 | const struct nls_table * cp, int mapChars) |
| 696 | { |
| 697 | int i,j,charlen; |
| 698 | int len_remaining = maxlen; |
| 699 | char src_char; |
Steve French | 70ca734 | 2005-09-22 16:32:06 -0700 | [diff] [blame] | 700 | __u16 temp; |
Steve French | 6c91d36 | 2005-04-28 22:41:06 -0700 | [diff] [blame] | 701 | |
| 702 | if(!mapChars) |
Steve French | e89dc92 | 2005-11-11 15:18:19 -0800 | [diff] [blame] | 703 | return cifs_strtoUCS(target, source, PATH_MAX, cp); |
Steve French | 6c91d36 | 2005-04-28 22:41:06 -0700 | [diff] [blame] | 704 | |
| 705 | for(i = 0, j = 0; i < maxlen; j++) { |
| 706 | src_char = source[i]; |
| 707 | switch (src_char) { |
| 708 | case 0: |
Steve French | f4cfd69 | 2005-07-14 18:29:02 -0500 | [diff] [blame] | 709 | target[j] = 0; |
Steve French | 6c91d36 | 2005-04-28 22:41:06 -0700 | [diff] [blame] | 710 | goto ctoUCS_out; |
| 711 | case ':': |
| 712 | target[j] = cpu_to_le16(UNI_COLON); |
| 713 | break; |
| 714 | case '*': |
| 715 | target[j] = cpu_to_le16(UNI_ASTERIK); |
| 716 | break; |
| 717 | case '?': |
| 718 | target[j] = cpu_to_le16(UNI_QUESTION); |
| 719 | break; |
| 720 | case '<': |
| 721 | target[j] = cpu_to_le16(UNI_LESSTHAN); |
| 722 | break; |
| 723 | case '>': |
| 724 | target[j] = cpu_to_le16(UNI_GRTRTHAN); |
| 725 | break; |
| 726 | case '|': |
| 727 | target[j] = cpu_to_le16(UNI_PIPE); |
| 728 | break; |
| 729 | /* BB We can not handle remapping slash until |
| 730 | all the calls to build_path_from_dentry |
| 731 | are modified, as they use slash as separator BB */ |
| 732 | /* case '\\': |
| 733 | target[j] = cpu_to_le16(UNI_SLASH); |
| 734 | break;*/ |
| 735 | default: |
| 736 | charlen = cp->char2uni(source+i, |
Steve French | 70ca734 | 2005-09-22 16:32:06 -0700 | [diff] [blame] | 737 | len_remaining, &temp); |
Steve French | 6c91d36 | 2005-04-28 22:41:06 -0700 | [diff] [blame] | 738 | /* if no match, use question mark, which |
| 739 | at least in some cases servers as wild card */ |
| 740 | if(charlen < 1) { |
| 741 | target[j] = cpu_to_le16(0x003f); |
| 742 | charlen = 1; |
Steve French | 70ca734 | 2005-09-22 16:32:06 -0700 | [diff] [blame] | 743 | } else |
| 744 | target[j] = cpu_to_le16(temp); |
Steve French | 6c91d36 | 2005-04-28 22:41:06 -0700 | [diff] [blame] | 745 | len_remaining -= charlen; |
| 746 | /* character may take more than one byte in the |
| 747 | the source string, but will take exactly two |
| 748 | bytes in the target string */ |
| 749 | i+= charlen; |
| 750 | continue; |
| 751 | } |
| 752 | i++; /* move to next char in source string */ |
| 753 | len_remaining--; |
| 754 | } |
| 755 | |
| 756 | ctoUCS_out: |
| 757 | return i; |
| 758 | } |