1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /*
3 * Copyright (C) 2018 Samsung Electronics Co., Ltd.
4 */
5
6 #include <linux/list.h>
7 #include <linux/slab.h>
8 #include <linux/rwsem.h>
9 #include <linux/xarray.h>
10
11 #include "ksmbd_ida.h"
12 #include "user_session.h"
13 #include "user_config.h"
14 #include "tree_connect.h"
15 #include "../transport_ipc.h"
16 #include "../connection.h"
17 #include "../vfs_cache.h"
18
19 static DEFINE_IDA(session_ida);
20
21 #define SESSION_HASH_BITS 3
22 static DEFINE_HASHTABLE(sessions_table, SESSION_HASH_BITS);
23 static DECLARE_RWSEM(sessions_table_lock);
24
25 struct ksmbd_session_rpc {
26 int id;
27 unsigned int method;
28 };
29
free_channel_list(struct ksmbd_session * sess)30 static void free_channel_list(struct ksmbd_session *sess)
31 {
32 struct channel *chann;
33 unsigned long index;
34
35 xa_for_each(&sess->ksmbd_chann_list, index, chann) {
36 xa_erase(&sess->ksmbd_chann_list, index);
37 kfree(chann);
38 }
39
40 xa_destroy(&sess->ksmbd_chann_list);
41 }
42
__session_rpc_close(struct ksmbd_session * sess,struct ksmbd_session_rpc * entry)43 static void __session_rpc_close(struct ksmbd_session *sess,
44 struct ksmbd_session_rpc *entry)
45 {
46 struct ksmbd_rpc_command *resp;
47
48 resp = ksmbd_rpc_close(sess, entry->id);
49 if (!resp)
50 pr_err("Unable to close RPC pipe %d\n", entry->id);
51
52 kvfree(resp);
53 ksmbd_rpc_id_free(entry->id);
54 kfree(entry);
55 }
56
ksmbd_session_rpc_clear_list(struct ksmbd_session * sess)57 static void ksmbd_session_rpc_clear_list(struct ksmbd_session *sess)
58 {
59 struct ksmbd_session_rpc *entry;
60 long index;
61
62 xa_for_each(&sess->rpc_handle_list, index, entry) {
63 xa_erase(&sess->rpc_handle_list, index);
64 __session_rpc_close(sess, entry);
65 }
66
67 xa_destroy(&sess->rpc_handle_list);
68 }
69
__rpc_method(char * rpc_name)70 static int __rpc_method(char *rpc_name)
71 {
72 if (!strcmp(rpc_name, "\\srvsvc") || !strcmp(rpc_name, "srvsvc"))
73 return KSMBD_RPC_SRVSVC_METHOD_INVOKE;
74
75 if (!strcmp(rpc_name, "\\wkssvc") || !strcmp(rpc_name, "wkssvc"))
76 return KSMBD_RPC_WKSSVC_METHOD_INVOKE;
77
78 if (!strcmp(rpc_name, "LANMAN") || !strcmp(rpc_name, "lanman"))
79 return KSMBD_RPC_RAP_METHOD;
80
81 if (!strcmp(rpc_name, "\\samr") || !strcmp(rpc_name, "samr"))
82 return KSMBD_RPC_SAMR_METHOD_INVOKE;
83
84 if (!strcmp(rpc_name, "\\lsarpc") || !strcmp(rpc_name, "lsarpc"))
85 return KSMBD_RPC_LSARPC_METHOD_INVOKE;
86
87 pr_err("Unsupported RPC: %s\n", rpc_name);
88 return 0;
89 }
90
ksmbd_session_rpc_open(struct ksmbd_session * sess,char * rpc_name)91 int ksmbd_session_rpc_open(struct ksmbd_session *sess, char *rpc_name)
92 {
93 struct ksmbd_session_rpc *entry, *old;
94 struct ksmbd_rpc_command *resp;
95 int method;
96
97 method = __rpc_method(rpc_name);
98 if (!method)
99 return -EINVAL;
100
101 entry = kzalloc(sizeof(struct ksmbd_session_rpc), GFP_KERNEL);
102 if (!entry)
103 return -ENOMEM;
104
105 entry->method = method;
106 entry->id = ksmbd_ipc_id_alloc();
107 if (entry->id < 0)
108 goto free_entry;
109 old = xa_store(&sess->rpc_handle_list, entry->id, entry, GFP_KERNEL);
110 if (xa_is_err(old))
111 goto free_id;
112
113 resp = ksmbd_rpc_open(sess, entry->id);
114 if (!resp)
115 goto erase_xa;
116
117 kvfree(resp);
118 return entry->id;
119 erase_xa:
120 xa_erase(&sess->rpc_handle_list, entry->id);
121 free_id:
122 ksmbd_rpc_id_free(entry->id);
123 free_entry:
124 kfree(entry);
125 return -EINVAL;
126 }
127
ksmbd_session_rpc_close(struct ksmbd_session * sess,int id)128 void ksmbd_session_rpc_close(struct ksmbd_session *sess, int id)
129 {
130 struct ksmbd_session_rpc *entry;
131
132 entry = xa_erase(&sess->rpc_handle_list, id);
133 if (entry)
134 __session_rpc_close(sess, entry);
135 }
136
ksmbd_session_rpc_method(struct ksmbd_session * sess,int id)137 int ksmbd_session_rpc_method(struct ksmbd_session *sess, int id)
138 {
139 struct ksmbd_session_rpc *entry;
140
141 entry = xa_load(&sess->rpc_handle_list, id);
142 return entry ? entry->method : 0;
143 }
144
ksmbd_session_destroy(struct ksmbd_session * sess)145 void ksmbd_session_destroy(struct ksmbd_session *sess)
146 {
147 if (!sess)
148 return;
149
150 if (sess->user)
151 ksmbd_free_user(sess->user);
152
153 ksmbd_tree_conn_session_logoff(sess);
154 ksmbd_destroy_file_table(&sess->file_table);
155 ksmbd_session_rpc_clear_list(sess);
156 free_channel_list(sess);
157 kfree(sess->Preauth_HashValue);
158 ksmbd_release_id(&session_ida, sess->id);
159 kfree(sess);
160 }
161
__session_lookup(unsigned long long id)162 struct ksmbd_session *__session_lookup(unsigned long long id)
163 {
164 struct ksmbd_session *sess;
165
166 hash_for_each_possible(sessions_table, sess, hlist, id) {
167 if (id == sess->id) {
168 sess->last_active = jiffies;
169 return sess;
170 }
171 }
172 return NULL;
173 }
174
ksmbd_expire_session(struct ksmbd_conn * conn)175 static void ksmbd_expire_session(struct ksmbd_conn *conn)
176 {
177 unsigned long id;
178 struct ksmbd_session *sess;
179
180 down_write(&sessions_table_lock);
181 down_write(&conn->session_lock);
182 xa_for_each(&conn->sessions, id, sess) {
183 if (atomic_read(&sess->refcnt) <= 1 &&
184 (sess->state != SMB2_SESSION_VALID ||
185 time_after(jiffies,
186 sess->last_active + SMB2_SESSION_TIMEOUT))) {
187 xa_erase(&conn->sessions, sess->id);
188 hash_del(&sess->hlist);
189 ksmbd_session_destroy(sess);
190 continue;
191 }
192 }
193 up_write(&conn->session_lock);
194 up_write(&sessions_table_lock);
195 }
196
ksmbd_session_register(struct ksmbd_conn * conn,struct ksmbd_session * sess)197 int ksmbd_session_register(struct ksmbd_conn *conn,
198 struct ksmbd_session *sess)
199 {
200 sess->dialect = conn->dialect;
201 memcpy(sess->ClientGUID, conn->ClientGUID, SMB2_CLIENT_GUID_SIZE);
202 ksmbd_expire_session(conn);
203 return xa_err(xa_store(&conn->sessions, sess->id, sess, GFP_KERNEL));
204 }
205
ksmbd_chann_del(struct ksmbd_conn * conn,struct ksmbd_session * sess)206 static int ksmbd_chann_del(struct ksmbd_conn *conn, struct ksmbd_session *sess)
207 {
208 struct channel *chann;
209
210 chann = xa_erase(&sess->ksmbd_chann_list, (long)conn);
211 if (!chann)
212 return -ENOENT;
213
214 kfree(chann);
215 return 0;
216 }
217
ksmbd_sessions_deregister(struct ksmbd_conn * conn)218 void ksmbd_sessions_deregister(struct ksmbd_conn *conn)
219 {
220 struct ksmbd_session *sess;
221 unsigned long id;
222
223 down_write(&sessions_table_lock);
224 if (conn->binding) {
225 int bkt;
226 struct hlist_node *tmp;
227
228 hash_for_each_safe(sessions_table, bkt, tmp, sess, hlist) {
229 if (!ksmbd_chann_del(conn, sess) &&
230 xa_empty(&sess->ksmbd_chann_list)) {
231 hash_del(&sess->hlist);
232 down_write(&conn->session_lock);
233 xa_erase(&conn->sessions, sess->id);
234 up_write(&conn->session_lock);
235 if (atomic_dec_and_test(&sess->refcnt))
236 ksmbd_session_destroy(sess);
237 }
238 }
239 }
240
241 down_write(&conn->session_lock);
242 xa_for_each(&conn->sessions, id, sess) {
243 unsigned long chann_id;
244 struct channel *chann;
245
246 xa_for_each(&sess->ksmbd_chann_list, chann_id, chann) {
247 if (chann->conn != conn)
248 ksmbd_conn_set_exiting(chann->conn);
249 }
250
251 ksmbd_chann_del(conn, sess);
252 if (xa_empty(&sess->ksmbd_chann_list)) {
253 xa_erase(&conn->sessions, sess->id);
254 hash_del(&sess->hlist);
255 if (atomic_dec_and_test(&sess->refcnt))
256 ksmbd_session_destroy(sess);
257 }
258 }
259 up_write(&conn->session_lock);
260 up_write(&sessions_table_lock);
261 }
262
is_ksmbd_session_in_connection(struct ksmbd_conn * conn,unsigned long long id)263 bool is_ksmbd_session_in_connection(struct ksmbd_conn *conn,
264 unsigned long long id)
265 {
266 struct ksmbd_session *sess;
267
268 down_read(&conn->session_lock);
269 sess = xa_load(&conn->sessions, id);
270 if (sess) {
271 up_read(&conn->session_lock);
272 return true;
273 }
274 up_read(&conn->session_lock);
275
276 return false;
277 }
278
ksmbd_session_lookup(struct ksmbd_conn * conn,unsigned long long id)279 struct ksmbd_session *ksmbd_session_lookup(struct ksmbd_conn *conn,
280 unsigned long long id)
281 {
282 struct ksmbd_session *sess;
283
284 down_read(&conn->session_lock);
285 sess = xa_load(&conn->sessions, id);
286 if (sess) {
287 sess->last_active = jiffies;
288 ksmbd_user_session_get(sess);
289 }
290 up_read(&conn->session_lock);
291 return sess;
292 }
293
ksmbd_session_lookup_slowpath(unsigned long long id)294 struct ksmbd_session *ksmbd_session_lookup_slowpath(unsigned long long id)
295 {
296 struct ksmbd_session *sess;
297
298 down_read(&sessions_table_lock);
299 sess = __session_lookup(id);
300 if (sess)
301 ksmbd_user_session_get(sess);
302 up_read(&sessions_table_lock);
303
304 return sess;
305 }
306
ksmbd_session_lookup_all(struct ksmbd_conn * conn,unsigned long long id)307 struct ksmbd_session *ksmbd_session_lookup_all(struct ksmbd_conn *conn,
308 unsigned long long id)
309 {
310 struct ksmbd_session *sess;
311
312 sess = ksmbd_session_lookup(conn, id);
313 if (!sess && conn->binding)
314 sess = ksmbd_session_lookup_slowpath(id);
315 if (sess && sess->state != SMB2_SESSION_VALID)
316 sess = NULL;
317 return sess;
318 }
319
ksmbd_user_session_get(struct ksmbd_session * sess)320 void ksmbd_user_session_get(struct ksmbd_session *sess)
321 {
322 atomic_inc(&sess->refcnt);
323 }
324
ksmbd_user_session_put(struct ksmbd_session * sess)325 void ksmbd_user_session_put(struct ksmbd_session *sess)
326 {
327 if (!sess)
328 return;
329
330 if (atomic_read(&sess->refcnt) <= 0)
331 WARN_ON(1);
332 else if (atomic_dec_and_test(&sess->refcnt))
333 ksmbd_session_destroy(sess);
334 }
335
ksmbd_preauth_session_alloc(struct ksmbd_conn * conn,u64 sess_id)336 struct preauth_session *ksmbd_preauth_session_alloc(struct ksmbd_conn *conn,
337 u64 sess_id)
338 {
339 struct preauth_session *sess;
340
341 sess = kmalloc(sizeof(struct preauth_session), GFP_KERNEL);
342 if (!sess)
343 return NULL;
344
345 sess->id = sess_id;
346 memcpy(sess->Preauth_HashValue, conn->preauth_info->Preauth_HashValue,
347 PREAUTH_HASHVALUE_SIZE);
348 list_add(&sess->preauth_entry, &conn->preauth_sess_table);
349
350 return sess;
351 }
352
destroy_previous_session(struct ksmbd_conn * conn,struct ksmbd_user * user,u64 id)353 void destroy_previous_session(struct ksmbd_conn *conn,
354 struct ksmbd_user *user, u64 id)
355 {
356 struct ksmbd_session *prev_sess;
357 struct ksmbd_user *prev_user;
358 int err;
359
360 down_write(&sessions_table_lock);
361 down_write(&conn->session_lock);
362 prev_sess = __session_lookup(id);
363 if (!prev_sess || prev_sess->state == SMB2_SESSION_EXPIRED)
364 goto out;
365
366 prev_user = prev_sess->user;
367 if (!prev_user ||
368 strcmp(user->name, prev_user->name) ||
369 user->passkey_sz != prev_user->passkey_sz ||
370 memcmp(user->passkey, prev_user->passkey, user->passkey_sz))
371 goto out;
372
373 ksmbd_all_conn_set_status(id, KSMBD_SESS_NEED_RECONNECT);
374 err = ksmbd_conn_wait_idle_sess_id(conn, id);
375 if (err) {
376 ksmbd_all_conn_set_status(id, KSMBD_SESS_NEED_NEGOTIATE);
377 goto out;
378 }
379 ksmbd_destroy_file_table(&prev_sess->file_table);
380 prev_sess->state = SMB2_SESSION_EXPIRED;
381 ksmbd_all_conn_set_status(id, KSMBD_SESS_NEED_NEGOTIATE);
382 out:
383 up_write(&conn->session_lock);
384 up_write(&sessions_table_lock);
385 }
386
ksmbd_preauth_session_id_match(struct preauth_session * sess,unsigned long long id)387 static bool ksmbd_preauth_session_id_match(struct preauth_session *sess,
388 unsigned long long id)
389 {
390 return sess->id == id;
391 }
392
ksmbd_preauth_session_lookup(struct ksmbd_conn * conn,unsigned long long id)393 struct preauth_session *ksmbd_preauth_session_lookup(struct ksmbd_conn *conn,
394 unsigned long long id)
395 {
396 struct preauth_session *sess = NULL;
397
398 list_for_each_entry(sess, &conn->preauth_sess_table, preauth_entry) {
399 if (ksmbd_preauth_session_id_match(sess, id))
400 return sess;
401 }
402 return NULL;
403 }
404
__init_smb2_session(struct ksmbd_session * sess)405 static int __init_smb2_session(struct ksmbd_session *sess)
406 {
407 int id = ksmbd_acquire_smb2_uid(&session_ida);
408
409 if (id < 0)
410 return -EINVAL;
411 sess->id = id;
412 return 0;
413 }
414
__session_create(int protocol)415 static struct ksmbd_session *__session_create(int protocol)
416 {
417 struct ksmbd_session *sess;
418 int ret;
419
420 if (protocol != CIFDS_SESSION_FLAG_SMB2)
421 return NULL;
422
423 sess = kzalloc(sizeof(struct ksmbd_session), GFP_KERNEL);
424 if (!sess)
425 return NULL;
426
427 if (ksmbd_init_file_table(&sess->file_table))
428 goto error;
429
430 sess->last_active = jiffies;
431 sess->state = SMB2_SESSION_IN_PROGRESS;
432 set_session_flag(sess, protocol);
433 xa_init(&sess->tree_conns);
434 xa_init(&sess->ksmbd_chann_list);
435 xa_init(&sess->rpc_handle_list);
436 sess->sequence_number = 1;
437 rwlock_init(&sess->tree_conns_lock);
438 atomic_set(&sess->refcnt, 2);
439
440 ret = __init_smb2_session(sess);
441 if (ret)
442 goto error;
443
444 ida_init(&sess->tree_conn_ida);
445
446 down_write(&sessions_table_lock);
447 hash_add(sessions_table, &sess->hlist, sess->id);
448 up_write(&sessions_table_lock);
449
450 return sess;
451
452 error:
453 ksmbd_session_destroy(sess);
454 return NULL;
455 }
456
ksmbd_smb2_session_create(void)457 struct ksmbd_session *ksmbd_smb2_session_create(void)
458 {
459 return __session_create(CIFDS_SESSION_FLAG_SMB2);
460 }
461
ksmbd_acquire_tree_conn_id(struct ksmbd_session * sess)462 int ksmbd_acquire_tree_conn_id(struct ksmbd_session *sess)
463 {
464 int id = -EINVAL;
465
466 if (test_session_flag(sess, CIFDS_SESSION_FLAG_SMB2))
467 id = ksmbd_acquire_smb2_tid(&sess->tree_conn_ida);
468
469 return id;
470 }
471
ksmbd_release_tree_conn_id(struct ksmbd_session * sess,int id)472 void ksmbd_release_tree_conn_id(struct ksmbd_session *sess, int id)
473 {
474 if (id >= 0)
475 ksmbd_release_id(&sess->tree_conn_ida, id);
476 }
477