1 // SPDX-License-Identifier: LGPL-2.1 2 /* 3 * 4 * Copyright (C) International Business Machines Corp., 2002,2008 5 * Author(s): Steve French (sfrench@us.ibm.com) 6 * Jeremy Allison (jra@samba.org) 2006. 7 * 8 */ 9 10 #include <linux/fs.h> 11 #include <linux/list.h> 12 #include <linux/gfp.h> 13 #include <linux/wait.h> 14 #include <linux/net.h> 15 #include <linux/delay.h> 16 #include <linux/freezer.h> 17 #include <linux/tcp.h> 18 #include <linux/bvec.h> 19 #include <linux/highmem.h> 20 #include <linux/uaccess.h> 21 #include <linux/processor.h> 22 #include <linux/mempool.h> 23 #include <linux/sched/signal.h> 24 #include <linux/task_io_accounting_ops.h> 25 #include "cifspdu.h" 26 #include "cifsglob.h" 27 #include "cifsproto.h" 28 #include "cifs_debug.h" 29 #include "smb2proto.h" 30 #include "smbdirect.h" 31 32 /* Max number of iovectors we can use off the stack when sending requests. */ 33 #define CIFS_MAX_IOV_SIZE 8 34 35 void 36 cifs_wake_up_task(struct mid_q_entry *mid) 37 { 38 if (mid->mid_state == MID_RESPONSE_RECEIVED) 39 mid->mid_state = MID_RESPONSE_READY; 40 wake_up_process(mid->callback_data); 41 } 42 43 static struct mid_q_entry * 44 alloc_mid(const struct smb_hdr *smb_buffer, struct TCP_Server_Info *server) 45 { 46 struct mid_q_entry *temp; 47 48 if (server == NULL) { 49 cifs_dbg(VFS, "%s: null TCP session\n", __func__); 50 return NULL; 51 } 52 53 temp = mempool_alloc(cifs_mid_poolp, GFP_NOFS); 54 memset(temp, 0, sizeof(struct mid_q_entry)); 55 kref_init(&temp->refcount); 56 temp->mid = get_mid(smb_buffer); 57 temp->pid = current->pid; 58 temp->command = cpu_to_le16(smb_buffer->Command); 59 cifs_dbg(FYI, "For smb_command %d\n", smb_buffer->Command); 60 /* easier to use jiffies */ 61 /* when mid allocated can be before when sent */ 62 temp->when_alloc = jiffies; 63 temp->server = server; 64 65 /* 66 * The default is for the mid to be synchronous, so the 67 * default callback just wakes up the current task. 68 */ 69 get_task_struct(current); 70 temp->creator = current; 71 temp->callback = cifs_wake_up_task; 72 temp->callback_data = current; 73 74 atomic_inc(&mid_count); 75 temp->mid_state = MID_REQUEST_ALLOCATED; 76 return temp; 77 } 78 79 void __release_mid(struct kref *refcount) 80 { 81 struct mid_q_entry *midEntry = 82 container_of(refcount, struct mid_q_entry, refcount); 83 #ifdef CONFIG_CIFS_STATS2 84 __le16 command = midEntry->server->vals->lock_cmd; 85 __u16 smb_cmd = le16_to_cpu(midEntry->command); 86 unsigned long now; 87 unsigned long roundtrip_time; 88 #endif 89 struct TCP_Server_Info *server = midEntry->server; 90 91 if (midEntry->resp_buf && (midEntry->mid_flags & MID_WAIT_CANCELLED) && 92 (midEntry->mid_state == MID_RESPONSE_RECEIVED || 93 midEntry->mid_state == MID_RESPONSE_READY) && 94 server->ops->handle_cancelled_mid) 95 server->ops->handle_cancelled_mid(midEntry, server); 96 97 midEntry->mid_state = MID_FREE; 98 atomic_dec(&mid_count); 99 if (midEntry->large_buf) 100 cifs_buf_release(midEntry->resp_buf); 101 else 102 cifs_small_buf_release(midEntry->resp_buf); 103 #ifdef CONFIG_CIFS_STATS2 104 now = jiffies; 105 if (now < midEntry->when_alloc) 106 cifs_server_dbg(VFS, "Invalid mid allocation time\n"); 107 roundtrip_time = now - midEntry->when_alloc; 108 109 if (smb_cmd < NUMBER_OF_SMB2_COMMANDS) { 110 if (atomic_read(&server->num_cmds[smb_cmd]) == 0) { 111 server->slowest_cmd[smb_cmd] = roundtrip_time; 112 server->fastest_cmd[smb_cmd] = roundtrip_time; 113 } else { 114 if (server->slowest_cmd[smb_cmd] < roundtrip_time) 115 server->slowest_cmd[smb_cmd] = roundtrip_time; 116 else if (server->fastest_cmd[smb_cmd] > roundtrip_time) 117 server->fastest_cmd[smb_cmd] = roundtrip_time; 118 } 119 cifs_stats_inc(&server->num_cmds[smb_cmd]); 120 server->time_per_cmd[smb_cmd] += roundtrip_time; 121 } 122 /* 123 * commands taking longer than one second (default) can be indications 124 * that something is wrong, unless it is quite a slow link or a very 125 * busy server. Note that this calc is unlikely or impossible to wrap 126 * as long as slow_rsp_threshold is not set way above recommended max 127 * value (32767 ie 9 hours) and is generally harmless even if wrong 128 * since only affects debug counters - so leaving the calc as simple 129 * comparison rather than doing multiple conversions and overflow 130 * checks 131 */ 132 if ((slow_rsp_threshold != 0) && 133 time_after(now, midEntry->when_alloc + (slow_rsp_threshold * HZ)) && 134 (midEntry->command != command)) { 135 /* 136 * smb2slowcmd[NUMBER_OF_SMB2_COMMANDS] counts by command 137 * NB: le16_to_cpu returns unsigned so can not be negative below 138 */ 139 if (smb_cmd < NUMBER_OF_SMB2_COMMANDS) 140 cifs_stats_inc(&server->smb2slowcmd[smb_cmd]); 141 142 trace_smb3_slow_rsp(smb_cmd, midEntry->mid, midEntry->pid, 143 midEntry->when_sent, midEntry->when_received); 144 if (cifsFYI & CIFS_TIMER) { 145 pr_debug("slow rsp: cmd %d mid %llu", 146 midEntry->command, midEntry->mid); 147 cifs_info("A: 0x%lx S: 0x%lx R: 0x%lx\n", 148 now - midEntry->when_alloc, 149 now - midEntry->when_sent, 150 now - midEntry->when_received); 151 } 152 } 153 #endif 154 put_task_struct(midEntry->creator); 155 156 mempool_free(midEntry, cifs_mid_poolp); 157 } 158 159 void 160 delete_mid(struct mid_q_entry *mid) 161 { 162 spin_lock(&mid->server->mid_lock); 163 if (!(mid->mid_flags & MID_DELETED)) { 164 list_del_init(&mid->qhead); 165 mid->mid_flags |= MID_DELETED; 166 } 167 spin_unlock(&mid->server->mid_lock); 168 169 release_mid(mid); 170 } 171 172 /* 173 * smb_send_kvec - send an array of kvecs to the server 174 * @server: Server to send the data to 175 * @smb_msg: Message to send 176 * @sent: amount of data sent on socket is stored here 177 * 178 * Our basic "send data to server" function. Should be called with srv_mutex 179 * held. The caller is responsible for handling the results. 180 */ 181 static int 182 smb_send_kvec(struct TCP_Server_Info *server, struct msghdr *smb_msg, 183 size_t *sent) 184 { 185 int rc = 0; 186 int retries = 0; 187 struct socket *ssocket = server->ssocket; 188 189 *sent = 0; 190 191 if (server->noblocksnd) 192 smb_msg->msg_flags = MSG_DONTWAIT + MSG_NOSIGNAL; 193 else 194 smb_msg->msg_flags = MSG_NOSIGNAL; 195 196 while (msg_data_left(smb_msg)) { 197 /* 198 * If blocking send, we try 3 times, since each can block 199 * for 5 seconds. For nonblocking we have to try more 200 * but wait increasing amounts of time allowing time for 201 * socket to clear. The overall time we wait in either 202 * case to send on the socket is about 15 seconds. 203 * Similarly we wait for 15 seconds for a response from 204 * the server in SendReceive[2] for the server to send 205 * a response back for most types of requests (except 206 * SMB Write past end of file which can be slow, and 207 * blocking lock operations). NFS waits slightly longer 208 * than CIFS, but this can make it take longer for 209 * nonresponsive servers to be detected and 15 seconds 210 * is more than enough time for modern networks to 211 * send a packet. In most cases if we fail to send 212 * after the retries we will kill the socket and 213 * reconnect which may clear the network problem. 214 */ 215 rc = sock_sendmsg(ssocket, smb_msg); 216 if (rc == -EAGAIN) { 217 retries++; 218 if (retries >= 14 || 219 (!server->noblocksnd && (retries > 2))) { 220 cifs_server_dbg(VFS, "sends on sock %p stuck for 15 seconds\n", 221 ssocket); 222 return -EAGAIN; 223 } 224 msleep(1 << retries); 225 continue; 226 } 227 228 if (rc < 0) 229 return rc; 230 231 if (rc == 0) { 232 /* should never happen, letting socket clear before 233 retrying is our only obvious option here */ 234 cifs_server_dbg(VFS, "tcp sent no data\n"); 235 msleep(500); 236 continue; 237 } 238 239 /* send was at least partially successful */ 240 *sent += rc; 241 retries = 0; /* in case we get ENOSPC on the next send */ 242 } 243 return 0; 244 } 245 246 unsigned long 247 smb_rqst_len(struct TCP_Server_Info *server, struct smb_rqst *rqst) 248 { 249 unsigned int i; 250 struct kvec *iov; 251 int nvec; 252 unsigned long buflen = 0; 253 254 if (!is_smb1(server) && rqst->rq_nvec >= 2 && 255 rqst->rq_iov[0].iov_len == 4) { 256 iov = &rqst->rq_iov[1]; 257 nvec = rqst->rq_nvec - 1; 258 } else { 259 iov = rqst->rq_iov; 260 nvec = rqst->rq_nvec; 261 } 262 263 /* total up iov array first */ 264 for (i = 0; i < nvec; i++) 265 buflen += iov[i].iov_len; 266 267 buflen += iov_iter_count(&rqst->rq_iter); 268 return buflen; 269 } 270 271 static int 272 __smb_send_rqst(struct TCP_Server_Info *server, int num_rqst, 273 struct smb_rqst *rqst) 274 { 275 int rc; 276 struct kvec *iov; 277 int n_vec; 278 unsigned int send_length = 0; 279 unsigned int i, j; 280 sigset_t mask, oldmask; 281 size_t total_len = 0, sent, size; 282 struct socket *ssocket = server->ssocket; 283 struct msghdr smb_msg = {}; 284 __be32 rfc1002_marker; 285 286 cifs_in_send_inc(server); 287 if (cifs_rdma_enabled(server)) { 288 /* return -EAGAIN when connecting or reconnecting */ 289 rc = -EAGAIN; 290 if (server->smbd_conn) 291 rc = smbd_send(server, num_rqst, rqst); 292 goto smbd_done; 293 } 294 295 rc = -EAGAIN; 296 if (ssocket == NULL) 297 goto out; 298 299 rc = -ERESTARTSYS; 300 if (fatal_signal_pending(current)) { 301 cifs_dbg(FYI, "signal pending before send request\n"); 302 goto out; 303 } 304 305 rc = 0; 306 /* cork the socket */ 307 tcp_sock_set_cork(ssocket->sk, true); 308 309 for (j = 0; j < num_rqst; j++) 310 send_length += smb_rqst_len(server, &rqst[j]); 311 rfc1002_marker = cpu_to_be32(send_length); 312 313 /* 314 * We should not allow signals to interrupt the network send because 315 * any partial send will cause session reconnects thus increasing 316 * latency of system calls and overload a server with unnecessary 317 * requests. 318 */ 319 320 sigfillset(&mask); 321 sigprocmask(SIG_BLOCK, &mask, &oldmask); 322 323 /* Generate a rfc1002 marker for SMB2+ */ 324 if (!is_smb1(server)) { 325 struct kvec hiov = { 326 .iov_base = &rfc1002_marker, 327 .iov_len = 4 328 }; 329 iov_iter_kvec(&smb_msg.msg_iter, ITER_SOURCE, &hiov, 1, 4); 330 rc = smb_send_kvec(server, &smb_msg, &sent); 331 if (rc < 0) 332 goto unmask; 333 334 total_len += sent; 335 send_length += 4; 336 } 337 338 cifs_dbg(FYI, "Sending smb: smb_len=%u\n", send_length); 339 340 for (j = 0; j < num_rqst; j++) { 341 iov = rqst[j].rq_iov; 342 n_vec = rqst[j].rq_nvec; 343 344 size = 0; 345 for (i = 0; i < n_vec; i++) { 346 dump_smb(iov[i].iov_base, iov[i].iov_len); 347 size += iov[i].iov_len; 348 } 349 350 iov_iter_kvec(&smb_msg.msg_iter, ITER_SOURCE, iov, n_vec, size); 351 352 rc = smb_send_kvec(server, &smb_msg, &sent); 353 if (rc < 0) 354 goto unmask; 355 356 total_len += sent; 357 358 if (iov_iter_count(&rqst[j].rq_iter) > 0) { 359 smb_msg.msg_iter = rqst[j].rq_iter; 360 rc = smb_send_kvec(server, &smb_msg, &sent); 361 if (rc < 0) 362 break; 363 total_len += sent; 364 } 365 366 } 367 368 unmask: 369 sigprocmask(SIG_SETMASK, &oldmask, NULL); 370 371 /* 372 * If signal is pending but we have already sent the whole packet to 373 * the server we need to return success status to allow a corresponding 374 * mid entry to be kept in the pending requests queue thus allowing 375 * to handle responses from the server by the client. 376 * 377 * If only part of the packet has been sent there is no need to hide 378 * interrupt because the session will be reconnected anyway, so there 379 * won't be any response from the server to handle. 380 */ 381 382 if (signal_pending(current) && (total_len != send_length)) { 383 cifs_dbg(FYI, "signal is pending after attempt to send\n"); 384 rc = -ERESTARTSYS; 385 } 386 387 /* uncork it */ 388 tcp_sock_set_cork(ssocket->sk, false); 389 390 if ((total_len > 0) && (total_len != send_length)) { 391 cifs_dbg(FYI, "partial send (wanted=%u sent=%zu): terminating session\n", 392 send_length, total_len); 393 /* 394 * If we have only sent part of an SMB then the next SMB could 395 * be taken as the remainder of this one. We need to kill the 396 * socket so the server throws away the partial SMB 397 */ 398 cifs_signal_cifsd_for_reconnect(server, false); 399 trace_smb3_partial_send_reconnect(server->CurrentMid, 400 server->conn_id, server->hostname); 401 } 402 smbd_done: 403 /* 404 * there's hardly any use for the layers above to know the 405 * actual error code here. All they should do at this point is 406 * to retry the connection and hope it goes away. 407 */ 408 if (rc < 0 && rc != -EINTR && rc != -EAGAIN) { 409 cifs_server_dbg(VFS, "Error %d sending data on socket to server\n", 410 rc); 411 rc = -ECONNABORTED; 412 cifs_signal_cifsd_for_reconnect(server, false); 413 } else if (rc > 0) 414 rc = 0; 415 out: 416 cifs_in_send_dec(server); 417 return rc; 418 } 419 420 struct send_req_vars { 421 struct smb2_transform_hdr tr_hdr; 422 struct smb_rqst rqst[MAX_COMPOUND]; 423 struct kvec iov; 424 }; 425 426 static int 427 smb_send_rqst(struct TCP_Server_Info *server, int num_rqst, 428 struct smb_rqst *rqst, int flags) 429 { 430 struct send_req_vars *vars; 431 struct smb_rqst *cur_rqst; 432 struct kvec *iov; 433 int rc; 434 435 if (!(flags & CIFS_TRANSFORM_REQ)) 436 return __smb_send_rqst(server, num_rqst, rqst); 437 438 if (WARN_ON_ONCE(num_rqst > MAX_COMPOUND - 1)) 439 return -EIO; 440 441 if (!server->ops->init_transform_rq) { 442 cifs_server_dbg(VFS, "Encryption requested but transform callback is missing\n"); 443 return -EIO; 444 } 445 446 vars = kzalloc(sizeof(*vars), GFP_NOFS); 447 if (!vars) 448 return -ENOMEM; 449 cur_rqst = vars->rqst; 450 iov = &vars->iov; 451 452 iov->iov_base = &vars->tr_hdr; 453 iov->iov_len = sizeof(vars->tr_hdr); 454 cur_rqst[0].rq_iov = iov; 455 cur_rqst[0].rq_nvec = 1; 456 457 rc = server->ops->init_transform_rq(server, num_rqst + 1, 458 &cur_rqst[0], rqst); 459 if (rc) 460 goto out; 461 462 rc = __smb_send_rqst(server, num_rqst + 1, &cur_rqst[0]); 463 smb3_free_compound_rqst(num_rqst, &cur_rqst[1]); 464 out: 465 kfree(vars); 466 return rc; 467 } 468 469 int 470 smb_send(struct TCP_Server_Info *server, struct smb_hdr *smb_buffer, 471 unsigned int smb_buf_length) 472 { 473 struct kvec iov[2]; 474 struct smb_rqst rqst = { .rq_iov = iov, 475 .rq_nvec = 2 }; 476 477 iov[0].iov_base = smb_buffer; 478 iov[0].iov_len = 4; 479 iov[1].iov_base = (char *)smb_buffer + 4; 480 iov[1].iov_len = smb_buf_length; 481 482 return __smb_send_rqst(server, 1, &rqst); 483 } 484 485 static int 486 wait_for_free_credits(struct TCP_Server_Info *server, const int num_credits, 487 const int timeout, const int flags, 488 unsigned int *instance) 489 { 490 long rc; 491 int *credits; 492 int optype; 493 long int t; 494 int scredits, in_flight; 495 496 if (timeout < 0) 497 t = MAX_JIFFY_OFFSET; 498 else 499 t = msecs_to_jiffies(timeout); 500 501 optype = flags & CIFS_OP_MASK; 502 503 *instance = 0; 504 505 credits = server->ops->get_credits_field(server, optype); 506 /* Since an echo is already inflight, no need to wait to send another */ 507 if (*credits <= 0 && optype == CIFS_ECHO_OP) 508 return -EAGAIN; 509 510 spin_lock(&server->req_lock); 511 if ((flags & CIFS_TIMEOUT_MASK) == CIFS_NON_BLOCKING) { 512 /* oplock breaks must not be held up */ 513 server->in_flight++; 514 if (server->in_flight > server->max_in_flight) 515 server->max_in_flight = server->in_flight; 516 *credits -= 1; 517 *instance = server->reconnect_instance; 518 scredits = *credits; 519 in_flight = server->in_flight; 520 spin_unlock(&server->req_lock); 521 522 trace_smb3_nblk_credits(server->CurrentMid, 523 server->conn_id, server->hostname, scredits, -1, in_flight); 524 cifs_dbg(FYI, "%s: remove %u credits total=%d\n", 525 __func__, 1, scredits); 526 527 return 0; 528 } 529 530 while (1) { 531 spin_unlock(&server->req_lock); 532 533 spin_lock(&server->srv_lock); 534 if (server->tcpStatus == CifsExiting) { 535 spin_unlock(&server->srv_lock); 536 return -ENOENT; 537 } 538 spin_unlock(&server->srv_lock); 539 540 spin_lock(&server->req_lock); 541 if (*credits < num_credits) { 542 scredits = *credits; 543 spin_unlock(&server->req_lock); 544 545 cifs_num_waiters_inc(server); 546 rc = wait_event_killable_timeout(server->request_q, 547 has_credits(server, credits, num_credits), t); 548 cifs_num_waiters_dec(server); 549 if (!rc) { 550 spin_lock(&server->req_lock); 551 scredits = *credits; 552 in_flight = server->in_flight; 553 spin_unlock(&server->req_lock); 554 555 trace_smb3_credit_timeout(server->CurrentMid, 556 server->conn_id, server->hostname, scredits, 557 num_credits, in_flight); 558 cifs_server_dbg(VFS, "wait timed out after %d ms\n", 559 timeout); 560 return -EBUSY; 561 } 562 if (rc == -ERESTARTSYS) 563 return -ERESTARTSYS; 564 spin_lock(&server->req_lock); 565 } else { 566 /* 567 * For normal commands, reserve the last MAX_COMPOUND 568 * credits to compound requests. 569 * Otherwise these compounds could be permanently 570 * starved for credits by single-credit requests. 571 * 572 * To prevent spinning CPU, block this thread until 573 * there are >MAX_COMPOUND credits available. 574 * But only do this is we already have a lot of 575 * credits in flight to avoid triggering this check 576 * for servers that are slow to hand out credits on 577 * new sessions. 578 */ 579 if (!optype && num_credits == 1 && 580 server->in_flight > 2 * MAX_COMPOUND && 581 *credits <= MAX_COMPOUND) { 582 spin_unlock(&server->req_lock); 583 584 cifs_num_waiters_inc(server); 585 rc = wait_event_killable_timeout( 586 server->request_q, 587 has_credits(server, credits, 588 MAX_COMPOUND + 1), 589 t); 590 cifs_num_waiters_dec(server); 591 if (!rc) { 592 spin_lock(&server->req_lock); 593 scredits = *credits; 594 in_flight = server->in_flight; 595 spin_unlock(&server->req_lock); 596 597 trace_smb3_credit_timeout( 598 server->CurrentMid, 599 server->conn_id, server->hostname, 600 scredits, num_credits, in_flight); 601 cifs_server_dbg(VFS, "wait timed out after %d ms\n", 602 timeout); 603 return -EBUSY; 604 } 605 if (rc == -ERESTARTSYS) 606 return -ERESTARTSYS; 607 spin_lock(&server->req_lock); 608 continue; 609 } 610 611 /* 612 * Can not count locking commands against total 613 * as they are allowed to block on server. 614 */ 615 616 /* update # of requests on the wire to server */ 617 if ((flags & CIFS_TIMEOUT_MASK) != CIFS_BLOCKING_OP) { 618 *credits -= num_credits; 619 server->in_flight += num_credits; 620 if (server->in_flight > server->max_in_flight) 621 server->max_in_flight = server->in_flight; 622 *instance = server->reconnect_instance; 623 } 624 scredits = *credits; 625 in_flight = server->in_flight; 626 spin_unlock(&server->req_lock); 627 628 trace_smb3_waitff_credits(server->CurrentMid, 629 server->conn_id, server->hostname, scredits, 630 -(num_credits), in_flight); 631 cifs_dbg(FYI, "%s: remove %u credits total=%d\n", 632 __func__, num_credits, scredits); 633 break; 634 } 635 } 636 return 0; 637 } 638 639 static int 640 wait_for_free_request(struct TCP_Server_Info *server, const int flags, 641 unsigned int *instance) 642 { 643 return wait_for_free_credits(server, 1, -1, flags, 644 instance); 645 } 646 647 static int 648 wait_for_compound_request(struct TCP_Server_Info *server, int num, 649 const int flags, unsigned int *instance) 650 { 651 int *credits; 652 int scredits, in_flight; 653 654 credits = server->ops->get_credits_field(server, flags & CIFS_OP_MASK); 655 656 spin_lock(&server->req_lock); 657 scredits = *credits; 658 in_flight = server->in_flight; 659 660 if (*credits < num) { 661 /* 662 * If the server is tight on resources or just gives us less 663 * credits for other reasons (e.g. requests are coming out of 664 * order and the server delays granting more credits until it 665 * processes a missing mid) and we exhausted most available 666 * credits there may be situations when we try to send 667 * a compound request but we don't have enough credits. At this 668 * point the client needs to decide if it should wait for 669 * additional credits or fail the request. If at least one 670 * request is in flight there is a high probability that the 671 * server will return enough credits to satisfy this compound 672 * request. 673 * 674 * Return immediately if no requests in flight since we will be 675 * stuck on waiting for credits. 676 */ 677 if (server->in_flight == 0) { 678 spin_unlock(&server->req_lock); 679 trace_smb3_insufficient_credits(server->CurrentMid, 680 server->conn_id, server->hostname, scredits, 681 num, in_flight); 682 cifs_dbg(FYI, "%s: %d requests in flight, needed %d total=%d\n", 683 __func__, in_flight, num, scredits); 684 return -EDEADLK; 685 } 686 } 687 spin_unlock(&server->req_lock); 688 689 return wait_for_free_credits(server, num, 60000, flags, 690 instance); 691 } 692 693 int 694 cifs_wait_mtu_credits(struct TCP_Server_Info *server, unsigned int size, 695 unsigned int *num, struct cifs_credits *credits) 696 { 697 *num = size; 698 credits->value = 0; 699 credits->instance = server->reconnect_instance; 700 return 0; 701 } 702 703 static int allocate_mid(struct cifs_ses *ses, struct smb_hdr *in_buf, 704 struct mid_q_entry **ppmidQ) 705 { 706 spin_lock(&ses->ses_lock); 707 if (ses->ses_status == SES_NEW) { 708 if ((in_buf->Command != SMB_COM_SESSION_SETUP_ANDX) && 709 (in_buf->Command != SMB_COM_NEGOTIATE)) { 710 spin_unlock(&ses->ses_lock); 711 return -EAGAIN; 712 } 713 /* else ok - we are setting up session */ 714 } 715 716 if (ses->ses_status == SES_EXITING) { 717 /* check if SMB session is bad because we are setting it up */ 718 if (in_buf->Command != SMB_COM_LOGOFF_ANDX) { 719 spin_unlock(&ses->ses_lock); 720 return -EAGAIN; 721 } 722 /* else ok - we are shutting down session */ 723 } 724 spin_unlock(&ses->ses_lock); 725 726 *ppmidQ = alloc_mid(in_buf, ses->server); 727 if (*ppmidQ == NULL) 728 return -ENOMEM; 729 spin_lock(&ses->server->mid_lock); 730 list_add_tail(&(*ppmidQ)->qhead, &ses->server->pending_mid_q); 731 spin_unlock(&ses->server->mid_lock); 732 return 0; 733 } 734 735 static int 736 wait_for_response(struct TCP_Server_Info *server, struct mid_q_entry *midQ) 737 { 738 int error; 739 740 error = wait_event_state(server->response_q, 741 midQ->mid_state != MID_REQUEST_SUBMITTED && 742 midQ->mid_state != MID_RESPONSE_RECEIVED, 743 (TASK_KILLABLE|TASK_FREEZABLE_UNSAFE)); 744 if (error < 0) 745 return -ERESTARTSYS; 746 747 return 0; 748 } 749 750 struct mid_q_entry * 751 cifs_setup_async_request(struct TCP_Server_Info *server, struct smb_rqst *rqst) 752 { 753 int rc; 754 struct smb_hdr *hdr = (struct smb_hdr *)rqst->rq_iov[0].iov_base; 755 struct mid_q_entry *mid; 756 757 if (rqst->rq_iov[0].iov_len != 4 || 758 rqst->rq_iov[0].iov_base + 4 != rqst->rq_iov[1].iov_base) 759 return ERR_PTR(-EIO); 760 761 /* enable signing if server requires it */ 762 if (server->sign) 763 hdr->Flags2 |= SMBFLG2_SECURITY_SIGNATURE; 764 765 mid = alloc_mid(hdr, server); 766 if (mid == NULL) 767 return ERR_PTR(-ENOMEM); 768 769 rc = cifs_sign_rqst(rqst, server, &mid->sequence_number); 770 if (rc) { 771 release_mid(mid); 772 return ERR_PTR(rc); 773 } 774 775 return mid; 776 } 777 778 /* 779 * Send a SMB request and set the callback function in the mid to handle 780 * the result. Caller is responsible for dealing with timeouts. 781 */ 782 int 783 cifs_call_async(struct TCP_Server_Info *server, struct smb_rqst *rqst, 784 mid_receive_t *receive, mid_callback_t *callback, 785 mid_handle_t *handle, void *cbdata, const int flags, 786 const struct cifs_credits *exist_credits) 787 { 788 int rc; 789 struct mid_q_entry *mid; 790 struct cifs_credits credits = { .value = 0, .instance = 0 }; 791 unsigned int instance; 792 int optype; 793 794 optype = flags & CIFS_OP_MASK; 795 796 if ((flags & CIFS_HAS_CREDITS) == 0) { 797 rc = wait_for_free_request(server, flags, &instance); 798 if (rc) 799 return rc; 800 credits.value = 1; 801 credits.instance = instance; 802 } else 803 instance = exist_credits->instance; 804 805 cifs_server_lock(server); 806 807 /* 808 * We can't use credits obtained from the previous session to send this 809 * request. Check if there were reconnects after we obtained credits and 810 * return -EAGAIN in such cases to let callers handle it. 811 */ 812 if (instance != server->reconnect_instance) { 813 cifs_server_unlock(server); 814 add_credits_and_wake_if(server, &credits, optype); 815 return -EAGAIN; 816 } 817 818 mid = server->ops->setup_async_request(server, rqst); 819 if (IS_ERR(mid)) { 820 cifs_server_unlock(server); 821 add_credits_and_wake_if(server, &credits, optype); 822 return PTR_ERR(mid); 823 } 824 825 mid->receive = receive; 826 mid->callback = callback; 827 mid->callback_data = cbdata; 828 mid->handle = handle; 829 mid->mid_state = MID_REQUEST_SUBMITTED; 830 831 /* put it on the pending_mid_q */ 832 spin_lock(&server->mid_lock); 833 list_add_tail(&mid->qhead, &server->pending_mid_q); 834 spin_unlock(&server->mid_lock); 835 836 /* 837 * Need to store the time in mid before calling I/O. For call_async, 838 * I/O response may come back and free the mid entry on another thread. 839 */ 840 cifs_save_when_sent(mid); 841 rc = smb_send_rqst(server, 1, rqst, flags); 842 843 if (rc < 0) { 844 revert_current_mid(server, mid->credits); 845 server->sequence_number -= 2; 846 delete_mid(mid); 847 } 848 849 cifs_server_unlock(server); 850 851 if (rc == 0) 852 return 0; 853 854 add_credits_and_wake_if(server, &credits, optype); 855 return rc; 856 } 857 858 /* 859 * 860 * Send an SMB Request. No response info (other than return code) 861 * needs to be parsed. 862 * 863 * flags indicate the type of request buffer and how long to wait 864 * and whether to log NT STATUS code (error) before mapping it to POSIX error 865 * 866 */ 867 int 868 SendReceiveNoRsp(const unsigned int xid, struct cifs_ses *ses, 869 char *in_buf, int flags) 870 { 871 int rc; 872 struct kvec iov[1]; 873 struct kvec rsp_iov; 874 int resp_buf_type; 875 876 iov[0].iov_base = in_buf; 877 iov[0].iov_len = get_rfc1002_length(in_buf) + 4; 878 flags |= CIFS_NO_RSP_BUF; 879 rc = SendReceive2(xid, ses, iov, 1, &resp_buf_type, flags, &rsp_iov); 880 cifs_dbg(NOISY, "SendRcvNoRsp flags %d rc %d\n", flags, rc); 881 882 return rc; 883 } 884 885 static int 886 cifs_sync_mid_result(struct mid_q_entry *mid, struct TCP_Server_Info *server) 887 { 888 int rc = 0; 889 890 cifs_dbg(FYI, "%s: cmd=%d mid=%llu state=%d\n", 891 __func__, le16_to_cpu(mid->command), mid->mid, mid->mid_state); 892 893 spin_lock(&server->mid_lock); 894 switch (mid->mid_state) { 895 case MID_RESPONSE_READY: 896 spin_unlock(&server->mid_lock); 897 return rc; 898 case MID_RETRY_NEEDED: 899 rc = -EAGAIN; 900 break; 901 case MID_RESPONSE_MALFORMED: 902 rc = -EIO; 903 break; 904 case MID_SHUTDOWN: 905 rc = -EHOSTDOWN; 906 break; 907 default: 908 if (!(mid->mid_flags & MID_DELETED)) { 909 list_del_init(&mid->qhead); 910 mid->mid_flags |= MID_DELETED; 911 } 912 spin_unlock(&server->mid_lock); 913 cifs_server_dbg(VFS, "%s: invalid mid state mid=%llu state=%d\n", 914 __func__, mid->mid, mid->mid_state); 915 rc = -EIO; 916 goto sync_mid_done; 917 } 918 spin_unlock(&server->mid_lock); 919 920 sync_mid_done: 921 release_mid(mid); 922 return rc; 923 } 924 925 static inline int 926 send_cancel(struct TCP_Server_Info *server, struct smb_rqst *rqst, 927 struct mid_q_entry *mid) 928 { 929 return server->ops->send_cancel ? 930 server->ops->send_cancel(server, rqst, mid) : 0; 931 } 932 933 int 934 cifs_check_receive(struct mid_q_entry *mid, struct TCP_Server_Info *server, 935 bool log_error) 936 { 937 unsigned int len = get_rfc1002_length(mid->resp_buf) + 4; 938 939 dump_smb(mid->resp_buf, min_t(u32, 92, len)); 940 941 /* convert the length into a more usable form */ 942 if (server->sign) { 943 struct kvec iov[2]; 944 int rc = 0; 945 struct smb_rqst rqst = { .rq_iov = iov, 946 .rq_nvec = 2 }; 947 948 iov[0].iov_base = mid->resp_buf; 949 iov[0].iov_len = 4; 950 iov[1].iov_base = (char *)mid->resp_buf + 4; 951 iov[1].iov_len = len - 4; 952 /* FIXME: add code to kill session */ 953 rc = cifs_verify_signature(&rqst, server, 954 mid->sequence_number); 955 if (rc) 956 cifs_server_dbg(VFS, "SMB signature verification returned error = %d\n", 957 rc); 958 } 959 960 /* BB special case reconnect tid and uid here? */ 961 return map_and_check_smb_error(mid, log_error); 962 } 963 964 struct mid_q_entry * 965 cifs_setup_request(struct cifs_ses *ses, struct TCP_Server_Info *ignored, 966 struct smb_rqst *rqst) 967 { 968 int rc; 969 struct smb_hdr *hdr = (struct smb_hdr *)rqst->rq_iov[0].iov_base; 970 struct mid_q_entry *mid; 971 972 if (rqst->rq_iov[0].iov_len != 4 || 973 rqst->rq_iov[0].iov_base + 4 != rqst->rq_iov[1].iov_base) 974 return ERR_PTR(-EIO); 975 976 rc = allocate_mid(ses, hdr, &mid); 977 if (rc) 978 return ERR_PTR(rc); 979 rc = cifs_sign_rqst(rqst, ses->server, &mid->sequence_number); 980 if (rc) { 981 delete_mid(mid); 982 return ERR_PTR(rc); 983 } 984 return mid; 985 } 986 987 static void 988 cifs_compound_callback(struct mid_q_entry *mid) 989 { 990 struct TCP_Server_Info *server = mid->server; 991 struct cifs_credits credits; 992 993 credits.value = server->ops->get_credits(mid); 994 credits.instance = server->reconnect_instance; 995 996 add_credits(server, &credits, mid->optype); 997 998 if (mid->mid_state == MID_RESPONSE_RECEIVED) 999 mid->mid_state = MID_RESPONSE_READY; 1000 } 1001 1002 static void 1003 cifs_compound_last_callback(struct mid_q_entry *mid) 1004 { 1005 cifs_compound_callback(mid); 1006 cifs_wake_up_task(mid); 1007 } 1008 1009 static void 1010 cifs_cancelled_callback(struct mid_q_entry *mid) 1011 { 1012 cifs_compound_callback(mid); 1013 release_mid(mid); 1014 } 1015 1016 /* 1017 * Return a channel (master if none) of @ses that can be used to send 1018 * regular requests. 1019 * 1020 * If we are currently binding a new channel (negprot/sess.setup), 1021 * return the new incomplete channel. 1022 */ 1023 struct TCP_Server_Info *cifs_pick_channel(struct cifs_ses *ses) 1024 { 1025 uint index = 0; 1026 unsigned int min_in_flight = UINT_MAX, max_in_flight = 0; 1027 struct TCP_Server_Info *server = NULL; 1028 int i; 1029 1030 if (!ses) 1031 return NULL; 1032 1033 spin_lock(&ses->chan_lock); 1034 for (i = 0; i < ses->chan_count; i++) { 1035 server = ses->chans[i].server; 1036 if (!server || server->terminate) 1037 continue; 1038 1039 if (CIFS_CHAN_NEEDS_RECONNECT(ses, i)) 1040 continue; 1041 1042 /* 1043 * strictly speaking, we should pick up req_lock to read 1044 * server->in_flight. But it shouldn't matter much here if we 1045 * race while reading this data. The worst that can happen is 1046 * that we could use a channel that's not least loaded. Avoiding 1047 * taking the lock could help reduce wait time, which is 1048 * important for this function 1049 */ 1050 if (server->in_flight < min_in_flight) { 1051 min_in_flight = server->in_flight; 1052 index = i; 1053 } 1054 if (server->in_flight > max_in_flight) 1055 max_in_flight = server->in_flight; 1056 } 1057 1058 /* if all channels are equally loaded, fall back to round-robin */ 1059 if (min_in_flight == max_in_flight) { 1060 index = (uint)atomic_inc_return(&ses->chan_seq); 1061 index %= ses->chan_count; 1062 } 1063 1064 server = ses->chans[index].server; 1065 spin_unlock(&ses->chan_lock); 1066 1067 return server; 1068 } 1069 1070 int 1071 compound_send_recv(const unsigned int xid, struct cifs_ses *ses, 1072 struct TCP_Server_Info *server, 1073 const int flags, const int num_rqst, struct smb_rqst *rqst, 1074 int *resp_buf_type, struct kvec *resp_iov) 1075 { 1076 int i, j, optype, rc = 0; 1077 struct mid_q_entry *midQ[MAX_COMPOUND]; 1078 bool cancelled_mid[MAX_COMPOUND] = {false}; 1079 struct cifs_credits credits[MAX_COMPOUND] = { 1080 { .value = 0, .instance = 0 } 1081 }; 1082 unsigned int instance; 1083 char *buf; 1084 1085 optype = flags & CIFS_OP_MASK; 1086 1087 for (i = 0; i < num_rqst; i++) 1088 resp_buf_type[i] = CIFS_NO_BUFFER; /* no response buf yet */ 1089 1090 if (!ses || !ses->server || !server) { 1091 cifs_dbg(VFS, "Null session\n"); 1092 return -EIO; 1093 } 1094 1095 spin_lock(&server->srv_lock); 1096 if (server->tcpStatus == CifsExiting) { 1097 spin_unlock(&server->srv_lock); 1098 return -ENOENT; 1099 } 1100 spin_unlock(&server->srv_lock); 1101 1102 /* 1103 * Wait for all the requests to become available. 1104 * This approach still leaves the possibility to be stuck waiting for 1105 * credits if the server doesn't grant credits to the outstanding 1106 * requests and if the client is completely idle, not generating any 1107 * other requests. 1108 * This can be handled by the eventual session reconnect. 1109 */ 1110 rc = wait_for_compound_request(server, num_rqst, flags, 1111 &instance); 1112 if (rc) 1113 return rc; 1114 1115 for (i = 0; i < num_rqst; i++) { 1116 credits[i].value = 1; 1117 credits[i].instance = instance; 1118 } 1119 1120 /* 1121 * Make sure that we sign in the same order that we send on this socket 1122 * and avoid races inside tcp sendmsg code that could cause corruption 1123 * of smb data. 1124 */ 1125 1126 cifs_server_lock(server); 1127 1128 /* 1129 * All the parts of the compound chain belong obtained credits from the 1130 * same session. We can not use credits obtained from the previous 1131 * session to send this request. Check if there were reconnects after 1132 * we obtained credits and return -EAGAIN in such cases to let callers 1133 * handle it. 1134 */ 1135 if (instance != server->reconnect_instance) { 1136 cifs_server_unlock(server); 1137 for (j = 0; j < num_rqst; j++) 1138 add_credits(server, &credits[j], optype); 1139 return -EAGAIN; 1140 } 1141 1142 for (i = 0; i < num_rqst; i++) { 1143 midQ[i] = server->ops->setup_request(ses, server, &rqst[i]); 1144 if (IS_ERR(midQ[i])) { 1145 revert_current_mid(server, i); 1146 for (j = 0; j < i; j++) 1147 delete_mid(midQ[j]); 1148 cifs_server_unlock(server); 1149 1150 /* Update # of requests on wire to server */ 1151 for (j = 0; j < num_rqst; j++) 1152 add_credits(server, &credits[j], optype); 1153 return PTR_ERR(midQ[i]); 1154 } 1155 1156 midQ[i]->mid_state = MID_REQUEST_SUBMITTED; 1157 midQ[i]->optype = optype; 1158 /* 1159 * Invoke callback for every part of the compound chain 1160 * to calculate credits properly. Wake up this thread only when 1161 * the last element is received. 1162 */ 1163 if (i < num_rqst - 1) 1164 midQ[i]->callback = cifs_compound_callback; 1165 else 1166 midQ[i]->callback = cifs_compound_last_callback; 1167 } 1168 rc = smb_send_rqst(server, num_rqst, rqst, flags); 1169 1170 for (i = 0; i < num_rqst; i++) 1171 cifs_save_when_sent(midQ[i]); 1172 1173 if (rc < 0) { 1174 revert_current_mid(server, num_rqst); 1175 server->sequence_number -= 2; 1176 } 1177 1178 cifs_server_unlock(server); 1179 1180 /* 1181 * If sending failed for some reason or it is an oplock break that we 1182 * will not receive a response to - return credits back 1183 */ 1184 if (rc < 0 || (flags & CIFS_NO_SRV_RSP)) { 1185 for (i = 0; i < num_rqst; i++) 1186 add_credits(server, &credits[i], optype); 1187 goto out; 1188 } 1189 1190 /* 1191 * At this point the request is passed to the network stack - we assume 1192 * that any credits taken from the server structure on the client have 1193 * been spent and we can't return them back. Once we receive responses 1194 * we will collect credits granted by the server in the mid callbacks 1195 * and add those credits to the server structure. 1196 */ 1197 1198 /* 1199 * Compounding is never used during session establish. 1200 */ 1201 spin_lock(&ses->ses_lock); 1202 if ((ses->ses_status == SES_NEW) || (optype & CIFS_NEG_OP) || (optype & CIFS_SESS_OP)) { 1203 spin_unlock(&ses->ses_lock); 1204 1205 cifs_server_lock(server); 1206 smb311_update_preauth_hash(ses, server, rqst[0].rq_iov, rqst[0].rq_nvec); 1207 cifs_server_unlock(server); 1208 1209 spin_lock(&ses->ses_lock); 1210 } 1211 spin_unlock(&ses->ses_lock); 1212 1213 for (i = 0; i < num_rqst; i++) { 1214 rc = wait_for_response(server, midQ[i]); 1215 if (rc != 0) 1216 break; 1217 } 1218 if (rc != 0) { 1219 for (; i < num_rqst; i++) { 1220 cifs_server_dbg(FYI, "Cancelling wait for mid %llu cmd: %d\n", 1221 midQ[i]->mid, le16_to_cpu(midQ[i]->command)); 1222 send_cancel(server, &rqst[i], midQ[i]); 1223 spin_lock(&server->mid_lock); 1224 midQ[i]->mid_flags |= MID_WAIT_CANCELLED; 1225 if (midQ[i]->mid_state == MID_REQUEST_SUBMITTED || 1226 midQ[i]->mid_state == MID_RESPONSE_RECEIVED) { 1227 midQ[i]->callback = cifs_cancelled_callback; 1228 cancelled_mid[i] = true; 1229 credits[i].value = 0; 1230 } 1231 spin_unlock(&server->mid_lock); 1232 } 1233 } 1234 1235 for (i = 0; i < num_rqst; i++) { 1236 if (rc < 0) 1237 goto out; 1238 1239 rc = cifs_sync_mid_result(midQ[i], server); 1240 if (rc != 0) { 1241 /* mark this mid as cancelled to not free it below */ 1242 cancelled_mid[i] = true; 1243 goto out; 1244 } 1245 1246 if (!midQ[i]->resp_buf || 1247 midQ[i]->mid_state != MID_RESPONSE_READY) { 1248 rc = -EIO; 1249 cifs_dbg(FYI, "Bad MID state?\n"); 1250 goto out; 1251 } 1252 1253 buf = (char *)midQ[i]->resp_buf; 1254 resp_iov[i].iov_base = buf; 1255 resp_iov[i].iov_len = midQ[i]->resp_buf_size + 1256 HEADER_PREAMBLE_SIZE(server); 1257 1258 if (midQ[i]->large_buf) 1259 resp_buf_type[i] = CIFS_LARGE_BUFFER; 1260 else 1261 resp_buf_type[i] = CIFS_SMALL_BUFFER; 1262 1263 rc = server->ops->check_receive(midQ[i], server, 1264 flags & CIFS_LOG_ERROR); 1265 1266 /* mark it so buf will not be freed by delete_mid */ 1267 if ((flags & CIFS_NO_RSP_BUF) == 0) 1268 midQ[i]->resp_buf = NULL; 1269 1270 } 1271 1272 /* 1273 * Compounding is never used during session establish. 1274 */ 1275 spin_lock(&ses->ses_lock); 1276 if ((ses->ses_status == SES_NEW) || (optype & CIFS_NEG_OP) || (optype & CIFS_SESS_OP)) { 1277 struct kvec iov = { 1278 .iov_base = resp_iov[0].iov_base, 1279 .iov_len = resp_iov[0].iov_len 1280 }; 1281 spin_unlock(&ses->ses_lock); 1282 cifs_server_lock(server); 1283 smb311_update_preauth_hash(ses, server, &iov, 1); 1284 cifs_server_unlock(server); 1285 spin_lock(&ses->ses_lock); 1286 } 1287 spin_unlock(&ses->ses_lock); 1288 1289 out: 1290 /* 1291 * This will dequeue all mids. After this it is important that the 1292 * demultiplex_thread will not process any of these mids any futher. 1293 * This is prevented above by using a noop callback that will not 1294 * wake this thread except for the very last PDU. 1295 */ 1296 for (i = 0; i < num_rqst; i++) { 1297 if (!cancelled_mid[i]) 1298 delete_mid(midQ[i]); 1299 } 1300 1301 return rc; 1302 } 1303 1304 int 1305 cifs_send_recv(const unsigned int xid, struct cifs_ses *ses, 1306 struct TCP_Server_Info *server, 1307 struct smb_rqst *rqst, int *resp_buf_type, const int flags, 1308 struct kvec *resp_iov) 1309 { 1310 return compound_send_recv(xid, ses, server, flags, 1, 1311 rqst, resp_buf_type, resp_iov); 1312 } 1313 1314 int 1315 SendReceive2(const unsigned int xid, struct cifs_ses *ses, 1316 struct kvec *iov, int n_vec, int *resp_buf_type /* ret */, 1317 const int flags, struct kvec *resp_iov) 1318 { 1319 struct smb_rqst rqst; 1320 struct kvec s_iov[CIFS_MAX_IOV_SIZE], *new_iov; 1321 int rc; 1322 1323 if (n_vec + 1 > CIFS_MAX_IOV_SIZE) { 1324 new_iov = kmalloc_array(n_vec + 1, sizeof(struct kvec), 1325 GFP_KERNEL); 1326 if (!new_iov) { 1327 /* otherwise cifs_send_recv below sets resp_buf_type */ 1328 *resp_buf_type = CIFS_NO_BUFFER; 1329 return -ENOMEM; 1330 } 1331 } else 1332 new_iov = s_iov; 1333 1334 /* 1st iov is a RFC1001 length followed by the rest of the packet */ 1335 memcpy(new_iov + 1, iov, (sizeof(struct kvec) * n_vec)); 1336 1337 new_iov[0].iov_base = new_iov[1].iov_base; 1338 new_iov[0].iov_len = 4; 1339 new_iov[1].iov_base += 4; 1340 new_iov[1].iov_len -= 4; 1341 1342 memset(&rqst, 0, sizeof(struct smb_rqst)); 1343 rqst.rq_iov = new_iov; 1344 rqst.rq_nvec = n_vec + 1; 1345 1346 rc = cifs_send_recv(xid, ses, ses->server, 1347 &rqst, resp_buf_type, flags, resp_iov); 1348 if (n_vec + 1 > CIFS_MAX_IOV_SIZE) 1349 kfree(new_iov); 1350 return rc; 1351 } 1352 1353 int 1354 SendReceive(const unsigned int xid, struct cifs_ses *ses, 1355 struct smb_hdr *in_buf, struct smb_hdr *out_buf, 1356 int *pbytes_returned, const int flags) 1357 { 1358 int rc = 0; 1359 struct mid_q_entry *midQ; 1360 unsigned int len = be32_to_cpu(in_buf->smb_buf_length); 1361 struct kvec iov = { .iov_base = in_buf, .iov_len = len }; 1362 struct smb_rqst rqst = { .rq_iov = &iov, .rq_nvec = 1 }; 1363 struct cifs_credits credits = { .value = 1, .instance = 0 }; 1364 struct TCP_Server_Info *server; 1365 1366 if (ses == NULL) { 1367 cifs_dbg(VFS, "Null smb session\n"); 1368 return -EIO; 1369 } 1370 server = ses->server; 1371 if (server == NULL) { 1372 cifs_dbg(VFS, "Null tcp session\n"); 1373 return -EIO; 1374 } 1375 1376 spin_lock(&server->srv_lock); 1377 if (server->tcpStatus == CifsExiting) { 1378 spin_unlock(&server->srv_lock); 1379 return -ENOENT; 1380 } 1381 spin_unlock(&server->srv_lock); 1382 1383 /* Ensure that we do not send more than 50 overlapping requests 1384 to the same server. We may make this configurable later or 1385 use ses->maxReq */ 1386 1387 if (len > CIFSMaxBufSize + MAX_CIFS_HDR_SIZE - 4) { 1388 cifs_server_dbg(VFS, "Invalid length, greater than maximum frame, %d\n", 1389 len); 1390 return -EIO; 1391 } 1392 1393 rc = wait_for_free_request(server, flags, &credits.instance); 1394 if (rc) 1395 return rc; 1396 1397 /* make sure that we sign in the same order that we send on this socket 1398 and avoid races inside tcp sendmsg code that could cause corruption 1399 of smb data */ 1400 1401 cifs_server_lock(server); 1402 1403 rc = allocate_mid(ses, in_buf, &midQ); 1404 if (rc) { 1405 cifs_server_unlock(server); 1406 /* Update # of requests on wire to server */ 1407 add_credits(server, &credits, 0); 1408 return rc; 1409 } 1410 1411 rc = cifs_sign_smb(in_buf, server, &midQ->sequence_number); 1412 if (rc) { 1413 cifs_server_unlock(server); 1414 goto out; 1415 } 1416 1417 midQ->mid_state = MID_REQUEST_SUBMITTED; 1418 1419 rc = smb_send(server, in_buf, len); 1420 cifs_save_when_sent(midQ); 1421 1422 if (rc < 0) 1423 server->sequence_number -= 2; 1424 1425 cifs_server_unlock(server); 1426 1427 if (rc < 0) 1428 goto out; 1429 1430 rc = wait_for_response(server, midQ); 1431 if (rc != 0) { 1432 send_cancel(server, &rqst, midQ); 1433 spin_lock(&server->mid_lock); 1434 if (midQ->mid_state == MID_REQUEST_SUBMITTED || 1435 midQ->mid_state == MID_RESPONSE_RECEIVED) { 1436 /* no longer considered to be "in-flight" */ 1437 midQ->callback = release_mid; 1438 spin_unlock(&server->mid_lock); 1439 add_credits(server, &credits, 0); 1440 return rc; 1441 } 1442 spin_unlock(&server->mid_lock); 1443 } 1444 1445 rc = cifs_sync_mid_result(midQ, server); 1446 if (rc != 0) { 1447 add_credits(server, &credits, 0); 1448 return rc; 1449 } 1450 1451 if (!midQ->resp_buf || !out_buf || 1452 midQ->mid_state != MID_RESPONSE_READY) { 1453 rc = -EIO; 1454 cifs_server_dbg(VFS, "Bad MID state?\n"); 1455 goto out; 1456 } 1457 1458 *pbytes_returned = get_rfc1002_length(midQ->resp_buf); 1459 memcpy(out_buf, midQ->resp_buf, *pbytes_returned + 4); 1460 rc = cifs_check_receive(midQ, server, 0); 1461 out: 1462 delete_mid(midQ); 1463 add_credits(server, &credits, 0); 1464 1465 return rc; 1466 } 1467 1468 /* We send a LOCKINGX_CANCEL_LOCK to cause the Windows 1469 blocking lock to return. */ 1470 1471 static int 1472 send_lock_cancel(const unsigned int xid, struct cifs_tcon *tcon, 1473 struct smb_hdr *in_buf, 1474 struct smb_hdr *out_buf) 1475 { 1476 int bytes_returned; 1477 struct cifs_ses *ses = tcon->ses; 1478 LOCK_REQ *pSMB = (LOCK_REQ *)in_buf; 1479 1480 /* We just modify the current in_buf to change 1481 the type of lock from LOCKING_ANDX_SHARED_LOCK 1482 or LOCKING_ANDX_EXCLUSIVE_LOCK to 1483 LOCKING_ANDX_CANCEL_LOCK. */ 1484 1485 pSMB->LockType = LOCKING_ANDX_CANCEL_LOCK|LOCKING_ANDX_LARGE_FILES; 1486 pSMB->Timeout = 0; 1487 pSMB->hdr.Mid = get_next_mid(ses->server); 1488 1489 return SendReceive(xid, ses, in_buf, out_buf, 1490 &bytes_returned, 0); 1491 } 1492 1493 int 1494 SendReceiveBlockingLock(const unsigned int xid, struct cifs_tcon *tcon, 1495 struct smb_hdr *in_buf, struct smb_hdr *out_buf, 1496 int *pbytes_returned) 1497 { 1498 int rc = 0; 1499 int rstart = 0; 1500 struct mid_q_entry *midQ; 1501 struct cifs_ses *ses; 1502 unsigned int len = be32_to_cpu(in_buf->smb_buf_length); 1503 struct kvec iov = { .iov_base = in_buf, .iov_len = len }; 1504 struct smb_rqst rqst = { .rq_iov = &iov, .rq_nvec = 1 }; 1505 unsigned int instance; 1506 struct TCP_Server_Info *server; 1507 1508 if (tcon == NULL || tcon->ses == NULL) { 1509 cifs_dbg(VFS, "Null smb session\n"); 1510 return -EIO; 1511 } 1512 ses = tcon->ses; 1513 server = ses->server; 1514 1515 if (server == NULL) { 1516 cifs_dbg(VFS, "Null tcp session\n"); 1517 return -EIO; 1518 } 1519 1520 spin_lock(&server->srv_lock); 1521 if (server->tcpStatus == CifsExiting) { 1522 spin_unlock(&server->srv_lock); 1523 return -ENOENT; 1524 } 1525 spin_unlock(&server->srv_lock); 1526 1527 /* Ensure that we do not send more than 50 overlapping requests 1528 to the same server. We may make this configurable later or 1529 use ses->maxReq */ 1530 1531 if (len > CIFSMaxBufSize + MAX_CIFS_HDR_SIZE - 4) { 1532 cifs_tcon_dbg(VFS, "Invalid length, greater than maximum frame, %d\n", 1533 len); 1534 return -EIO; 1535 } 1536 1537 rc = wait_for_free_request(server, CIFS_BLOCKING_OP, &instance); 1538 if (rc) 1539 return rc; 1540 1541 /* make sure that we sign in the same order that we send on this socket 1542 and avoid races inside tcp sendmsg code that could cause corruption 1543 of smb data */ 1544 1545 cifs_server_lock(server); 1546 1547 rc = allocate_mid(ses, in_buf, &midQ); 1548 if (rc) { 1549 cifs_server_unlock(server); 1550 return rc; 1551 } 1552 1553 rc = cifs_sign_smb(in_buf, server, &midQ->sequence_number); 1554 if (rc) { 1555 delete_mid(midQ); 1556 cifs_server_unlock(server); 1557 return rc; 1558 } 1559 1560 midQ->mid_state = MID_REQUEST_SUBMITTED; 1561 rc = smb_send(server, in_buf, len); 1562 cifs_save_when_sent(midQ); 1563 1564 if (rc < 0) 1565 server->sequence_number -= 2; 1566 1567 cifs_server_unlock(server); 1568 1569 if (rc < 0) { 1570 delete_mid(midQ); 1571 return rc; 1572 } 1573 1574 /* Wait for a reply - allow signals to interrupt. */ 1575 rc = wait_event_interruptible(server->response_q, 1576 (!(midQ->mid_state == MID_REQUEST_SUBMITTED || 1577 midQ->mid_state == MID_RESPONSE_RECEIVED)) || 1578 ((server->tcpStatus != CifsGood) && 1579 (server->tcpStatus != CifsNew))); 1580 1581 /* Were we interrupted by a signal ? */ 1582 spin_lock(&server->srv_lock); 1583 if ((rc == -ERESTARTSYS) && 1584 (midQ->mid_state == MID_REQUEST_SUBMITTED || 1585 midQ->mid_state == MID_RESPONSE_RECEIVED) && 1586 ((server->tcpStatus == CifsGood) || 1587 (server->tcpStatus == CifsNew))) { 1588 spin_unlock(&server->srv_lock); 1589 1590 if (in_buf->Command == SMB_COM_TRANSACTION2) { 1591 /* POSIX lock. We send a NT_CANCEL SMB to cause the 1592 blocking lock to return. */ 1593 rc = send_cancel(server, &rqst, midQ); 1594 if (rc) { 1595 delete_mid(midQ); 1596 return rc; 1597 } 1598 } else { 1599 /* Windows lock. We send a LOCKINGX_CANCEL_LOCK 1600 to cause the blocking lock to return. */ 1601 1602 rc = send_lock_cancel(xid, tcon, in_buf, out_buf); 1603 1604 /* If we get -ENOLCK back the lock may have 1605 already been removed. Don't exit in this case. */ 1606 if (rc && rc != -ENOLCK) { 1607 delete_mid(midQ); 1608 return rc; 1609 } 1610 } 1611 1612 rc = wait_for_response(server, midQ); 1613 if (rc) { 1614 send_cancel(server, &rqst, midQ); 1615 spin_lock(&server->mid_lock); 1616 if (midQ->mid_state == MID_REQUEST_SUBMITTED || 1617 midQ->mid_state == MID_RESPONSE_RECEIVED) { 1618 /* no longer considered to be "in-flight" */ 1619 midQ->callback = release_mid; 1620 spin_unlock(&server->mid_lock); 1621 return rc; 1622 } 1623 spin_unlock(&server->mid_lock); 1624 } 1625 1626 /* We got the response - restart system call. */ 1627 rstart = 1; 1628 spin_lock(&server->srv_lock); 1629 } 1630 spin_unlock(&server->srv_lock); 1631 1632 rc = cifs_sync_mid_result(midQ, server); 1633 if (rc != 0) 1634 return rc; 1635 1636 /* rcvd frame is ok */ 1637 if (out_buf == NULL || midQ->mid_state != MID_RESPONSE_READY) { 1638 rc = -EIO; 1639 cifs_tcon_dbg(VFS, "Bad MID state?\n"); 1640 goto out; 1641 } 1642 1643 *pbytes_returned = get_rfc1002_length(midQ->resp_buf); 1644 memcpy(out_buf, midQ->resp_buf, *pbytes_returned + 4); 1645 rc = cifs_check_receive(midQ, server, 0); 1646 out: 1647 delete_mid(midQ); 1648 if (rstart && rc == -EACCES) 1649 return -ERESTARTSYS; 1650 return rc; 1651 } 1652 1653 /* 1654 * Discard any remaining data in the current SMB. To do this, we borrow the 1655 * current bigbuf. 1656 */ 1657 int 1658 cifs_discard_remaining_data(struct TCP_Server_Info *server) 1659 { 1660 unsigned int rfclen = server->pdu_size; 1661 size_t remaining = rfclen + HEADER_PREAMBLE_SIZE(server) - 1662 server->total_read; 1663 1664 while (remaining > 0) { 1665 ssize_t length; 1666 1667 length = cifs_discard_from_socket(server, 1668 min_t(size_t, remaining, 1669 CIFSMaxBufSize + MAX_HEADER_SIZE(server))); 1670 if (length < 0) 1671 return length; 1672 server->total_read += length; 1673 remaining -= length; 1674 } 1675 1676 return 0; 1677 } 1678 1679 static int 1680 __cifs_readv_discard(struct TCP_Server_Info *server, struct mid_q_entry *mid, 1681 bool malformed) 1682 { 1683 int length; 1684 1685 length = cifs_discard_remaining_data(server); 1686 dequeue_mid(mid, malformed); 1687 mid->resp_buf = server->smallbuf; 1688 server->smallbuf = NULL; 1689 return length; 1690 } 1691 1692 static int 1693 cifs_readv_discard(struct TCP_Server_Info *server, struct mid_q_entry *mid) 1694 { 1695 struct cifs_readdata *rdata = mid->callback_data; 1696 1697 return __cifs_readv_discard(server, mid, rdata->result); 1698 } 1699 1700 int 1701 cifs_readv_receive(struct TCP_Server_Info *server, struct mid_q_entry *mid) 1702 { 1703 int length, len; 1704 unsigned int data_offset, data_len; 1705 struct cifs_readdata *rdata = mid->callback_data; 1706 char *buf = server->smallbuf; 1707 unsigned int buflen = server->pdu_size + HEADER_PREAMBLE_SIZE(server); 1708 bool use_rdma_mr = false; 1709 1710 cifs_dbg(FYI, "%s: mid=%llu offset=%llu bytes=%u\n", 1711 __func__, mid->mid, rdata->offset, rdata->bytes); 1712 1713 /* 1714 * read the rest of READ_RSP header (sans Data array), or whatever we 1715 * can if there's not enough data. At this point, we've read down to 1716 * the Mid. 1717 */ 1718 len = min_t(unsigned int, buflen, server->vals->read_rsp_size) - 1719 HEADER_SIZE(server) + 1; 1720 1721 length = cifs_read_from_socket(server, 1722 buf + HEADER_SIZE(server) - 1, len); 1723 if (length < 0) 1724 return length; 1725 server->total_read += length; 1726 1727 if (server->ops->is_session_expired && 1728 server->ops->is_session_expired(buf)) { 1729 cifs_reconnect(server, true); 1730 return -1; 1731 } 1732 1733 if (server->ops->is_status_pending && 1734 server->ops->is_status_pending(buf, server)) { 1735 cifs_discard_remaining_data(server); 1736 return -1; 1737 } 1738 1739 /* set up first two iov for signature check and to get credits */ 1740 rdata->iov[0].iov_base = buf; 1741 rdata->iov[0].iov_len = HEADER_PREAMBLE_SIZE(server); 1742 rdata->iov[1].iov_base = buf + HEADER_PREAMBLE_SIZE(server); 1743 rdata->iov[1].iov_len = 1744 server->total_read - HEADER_PREAMBLE_SIZE(server); 1745 cifs_dbg(FYI, "0: iov_base=%p iov_len=%zu\n", 1746 rdata->iov[0].iov_base, rdata->iov[0].iov_len); 1747 cifs_dbg(FYI, "1: iov_base=%p iov_len=%zu\n", 1748 rdata->iov[1].iov_base, rdata->iov[1].iov_len); 1749 1750 /* Was the SMB read successful? */ 1751 rdata->result = server->ops->map_error(buf, false); 1752 if (rdata->result != 0) { 1753 cifs_dbg(FYI, "%s: server returned error %d\n", 1754 __func__, rdata->result); 1755 /* normal error on read response */ 1756 return __cifs_readv_discard(server, mid, false); 1757 } 1758 1759 /* Is there enough to get to the rest of the READ_RSP header? */ 1760 if (server->total_read < server->vals->read_rsp_size) { 1761 cifs_dbg(FYI, "%s: server returned short header. got=%u expected=%zu\n", 1762 __func__, server->total_read, 1763 server->vals->read_rsp_size); 1764 rdata->result = -EIO; 1765 return cifs_readv_discard(server, mid); 1766 } 1767 1768 data_offset = server->ops->read_data_offset(buf) + 1769 HEADER_PREAMBLE_SIZE(server); 1770 if (data_offset < server->total_read) { 1771 /* 1772 * win2k8 sometimes sends an offset of 0 when the read 1773 * is beyond the EOF. Treat it as if the data starts just after 1774 * the header. 1775 */ 1776 cifs_dbg(FYI, "%s: data offset (%u) inside read response header\n", 1777 __func__, data_offset); 1778 data_offset = server->total_read; 1779 } else if (data_offset > MAX_CIFS_SMALL_BUFFER_SIZE) { 1780 /* data_offset is beyond the end of smallbuf */ 1781 cifs_dbg(FYI, "%s: data offset (%u) beyond end of smallbuf\n", 1782 __func__, data_offset); 1783 rdata->result = -EIO; 1784 return cifs_readv_discard(server, mid); 1785 } 1786 1787 cifs_dbg(FYI, "%s: total_read=%u data_offset=%u\n", 1788 __func__, server->total_read, data_offset); 1789 1790 len = data_offset - server->total_read; 1791 if (len > 0) { 1792 /* read any junk before data into the rest of smallbuf */ 1793 length = cifs_read_from_socket(server, 1794 buf + server->total_read, len); 1795 if (length < 0) 1796 return length; 1797 server->total_read += length; 1798 } 1799 1800 /* how much data is in the response? */ 1801 #ifdef CONFIG_CIFS_SMB_DIRECT 1802 use_rdma_mr = rdata->mr; 1803 #endif 1804 data_len = server->ops->read_data_length(buf, use_rdma_mr); 1805 if (!use_rdma_mr && (data_offset + data_len > buflen)) { 1806 /* data_len is corrupt -- discard frame */ 1807 rdata->result = -EIO; 1808 return cifs_readv_discard(server, mid); 1809 } 1810 1811 #ifdef CONFIG_CIFS_SMB_DIRECT 1812 if (rdata->mr) 1813 length = data_len; /* An RDMA read is already done. */ 1814 else 1815 #endif 1816 length = cifs_read_iter_from_socket(server, &rdata->iter, 1817 data_len); 1818 if (length > 0) 1819 rdata->got_bytes += length; 1820 server->total_read += length; 1821 1822 cifs_dbg(FYI, "total_read=%u buflen=%u remaining=%u\n", 1823 server->total_read, buflen, data_len); 1824 1825 /* discard anything left over */ 1826 if (server->total_read < buflen) 1827 return cifs_readv_discard(server, mid); 1828 1829 dequeue_mid(mid, false); 1830 mid->resp_buf = server->smallbuf; 1831 server->smallbuf = NULL; 1832 return length; 1833 } 1834