1 // SPDX-License-Identifier: GPL-2.0-or-later 2 /* 3 * Copyright (C) 2018 Samsung Electronics Co., Ltd. 4 */ 5 6 #include <linux/list.h> 7 #include <linux/slab.h> 8 #include <linux/rwsem.h> 9 #include <linux/xarray.h> 10 11 #include "ksmbd_ida.h" 12 #include "user_session.h" 13 #include "user_config.h" 14 #include "tree_connect.h" 15 #include "../transport_ipc.h" 16 #include "../connection.h" 17 #include "../vfs_cache.h" 18 19 static DEFINE_IDA(session_ida); 20 21 #define SESSION_HASH_BITS 3 22 static DEFINE_HASHTABLE(sessions_table, SESSION_HASH_BITS); 23 static DECLARE_RWSEM(sessions_table_lock); 24 25 struct ksmbd_session_rpc { 26 int id; 27 unsigned int method; 28 }; 29 30 static void free_channel_list(struct ksmbd_session *sess) 31 { 32 struct channel *chann; 33 unsigned long index; 34 35 xa_for_each(&sess->ksmbd_chann_list, index, chann) { 36 xa_erase(&sess->ksmbd_chann_list, index); 37 kfree(chann); 38 } 39 40 xa_destroy(&sess->ksmbd_chann_list); 41 } 42 43 static void __session_rpc_close(struct ksmbd_session *sess, 44 struct ksmbd_session_rpc *entry) 45 { 46 struct ksmbd_rpc_command *resp; 47 48 resp = ksmbd_rpc_close(sess, entry->id); 49 if (!resp) 50 pr_err("Unable to close RPC pipe %d\n", entry->id); 51 52 kvfree(resp); 53 ksmbd_rpc_id_free(entry->id); 54 kfree(entry); 55 } 56 57 static void ksmbd_session_rpc_clear_list(struct ksmbd_session *sess) 58 { 59 struct ksmbd_session_rpc *entry; 60 long index; 61 62 xa_for_each(&sess->rpc_handle_list, index, entry) { 63 xa_erase(&sess->rpc_handle_list, index); 64 __session_rpc_close(sess, entry); 65 } 66 67 xa_destroy(&sess->rpc_handle_list); 68 } 69 70 static int __rpc_method(char *rpc_name) 71 { 72 if (!strcmp(rpc_name, "\\srvsvc") || !strcmp(rpc_name, "srvsvc")) 73 return KSMBD_RPC_SRVSVC_METHOD_INVOKE; 74 75 if (!strcmp(rpc_name, "\\wkssvc") || !strcmp(rpc_name, "wkssvc")) 76 return KSMBD_RPC_WKSSVC_METHOD_INVOKE; 77 78 if (!strcmp(rpc_name, "LANMAN") || !strcmp(rpc_name, "lanman")) 79 return KSMBD_RPC_RAP_METHOD; 80 81 if (!strcmp(rpc_name, "\\samr") || !strcmp(rpc_name, "samr")) 82 return KSMBD_RPC_SAMR_METHOD_INVOKE; 83 84 if (!strcmp(rpc_name, "\\lsarpc") || !strcmp(rpc_name, "lsarpc")) 85 return KSMBD_RPC_LSARPC_METHOD_INVOKE; 86 87 pr_err("Unsupported RPC: %s\n", rpc_name); 88 return 0; 89 } 90 91 int ksmbd_session_rpc_open(struct ksmbd_session *sess, char *rpc_name) 92 { 93 struct ksmbd_session_rpc *entry, *old; 94 struct ksmbd_rpc_command *resp; 95 int method; 96 97 method = __rpc_method(rpc_name); 98 if (!method) 99 return -EINVAL; 100 101 entry = kzalloc(sizeof(struct ksmbd_session_rpc), GFP_KERNEL); 102 if (!entry) 103 return -ENOMEM; 104 105 entry->method = method; 106 entry->id = ksmbd_ipc_id_alloc(); 107 if (entry->id < 0) 108 goto free_entry; 109 old = xa_store(&sess->rpc_handle_list, entry->id, entry, GFP_KERNEL); 110 if (xa_is_err(old)) 111 goto free_id; 112 113 resp = ksmbd_rpc_open(sess, entry->id); 114 if (!resp) 115 goto erase_xa; 116 117 kvfree(resp); 118 return entry->id; 119 erase_xa: 120 xa_erase(&sess->rpc_handle_list, entry->id); 121 free_id: 122 ksmbd_rpc_id_free(entry->id); 123 free_entry: 124 kfree(entry); 125 return -EINVAL; 126 } 127 128 void ksmbd_session_rpc_close(struct ksmbd_session *sess, int id) 129 { 130 struct ksmbd_session_rpc *entry; 131 132 entry = xa_erase(&sess->rpc_handle_list, id); 133 if (entry) 134 __session_rpc_close(sess, entry); 135 } 136 137 int ksmbd_session_rpc_method(struct ksmbd_session *sess, int id) 138 { 139 struct ksmbd_session_rpc *entry; 140 141 entry = xa_load(&sess->rpc_handle_list, id); 142 return entry ? entry->method : 0; 143 } 144 145 void ksmbd_session_destroy(struct ksmbd_session *sess) 146 { 147 if (!sess) 148 return; 149 150 if (sess->user) 151 ksmbd_free_user(sess->user); 152 153 ksmbd_tree_conn_session_logoff(sess); 154 ksmbd_destroy_file_table(&sess->file_table); 155 ksmbd_session_rpc_clear_list(sess); 156 free_channel_list(sess); 157 kfree(sess->Preauth_HashValue); 158 ksmbd_release_id(&session_ida, sess->id); 159 kfree(sess); 160 } 161 162 struct ksmbd_session *__session_lookup(unsigned long long id) 163 { 164 struct ksmbd_session *sess; 165 166 hash_for_each_possible(sessions_table, sess, hlist, id) { 167 if (id == sess->id) { 168 sess->last_active = jiffies; 169 return sess; 170 } 171 } 172 return NULL; 173 } 174 175 static void ksmbd_expire_session(struct ksmbd_conn *conn) 176 { 177 unsigned long id; 178 struct ksmbd_session *sess; 179 180 down_write(&sessions_table_lock); 181 down_write(&conn->session_lock); 182 xa_for_each(&conn->sessions, id, sess) { 183 if (atomic_read(&sess->refcnt) <= 1 && 184 (sess->state != SMB2_SESSION_VALID || 185 time_after(jiffies, 186 sess->last_active + SMB2_SESSION_TIMEOUT))) { 187 xa_erase(&conn->sessions, sess->id); 188 hash_del(&sess->hlist); 189 ksmbd_session_destroy(sess); 190 continue; 191 } 192 } 193 up_write(&conn->session_lock); 194 up_write(&sessions_table_lock); 195 } 196 197 int ksmbd_session_register(struct ksmbd_conn *conn, 198 struct ksmbd_session *sess) 199 { 200 sess->dialect = conn->dialect; 201 memcpy(sess->ClientGUID, conn->ClientGUID, SMB2_CLIENT_GUID_SIZE); 202 ksmbd_expire_session(conn); 203 return xa_err(xa_store(&conn->sessions, sess->id, sess, GFP_KERNEL)); 204 } 205 206 static int ksmbd_chann_del(struct ksmbd_conn *conn, struct ksmbd_session *sess) 207 { 208 struct channel *chann; 209 210 chann = xa_erase(&sess->ksmbd_chann_list, (long)conn); 211 if (!chann) 212 return -ENOENT; 213 214 kfree(chann); 215 return 0; 216 } 217 218 void ksmbd_sessions_deregister(struct ksmbd_conn *conn) 219 { 220 struct ksmbd_session *sess; 221 unsigned long id; 222 223 down_write(&sessions_table_lock); 224 if (conn->binding) { 225 int bkt; 226 struct hlist_node *tmp; 227 228 hash_for_each_safe(sessions_table, bkt, tmp, sess, hlist) { 229 if (!ksmbd_chann_del(conn, sess) && 230 xa_empty(&sess->ksmbd_chann_list)) { 231 hash_del(&sess->hlist); 232 down_write(&conn->session_lock); 233 xa_erase(&conn->sessions, sess->id); 234 up_write(&conn->session_lock); 235 if (atomic_dec_and_test(&sess->refcnt)) 236 ksmbd_session_destroy(sess); 237 } 238 } 239 } 240 241 down_write(&conn->session_lock); 242 xa_for_each(&conn->sessions, id, sess) { 243 unsigned long chann_id; 244 struct channel *chann; 245 246 xa_for_each(&sess->ksmbd_chann_list, chann_id, chann) { 247 if (chann->conn != conn) 248 ksmbd_conn_set_exiting(chann->conn); 249 } 250 251 ksmbd_chann_del(conn, sess); 252 if (xa_empty(&sess->ksmbd_chann_list)) { 253 xa_erase(&conn->sessions, sess->id); 254 hash_del(&sess->hlist); 255 if (atomic_dec_and_test(&sess->refcnt)) 256 ksmbd_session_destroy(sess); 257 } 258 } 259 up_write(&conn->session_lock); 260 up_write(&sessions_table_lock); 261 } 262 263 bool is_ksmbd_session_in_connection(struct ksmbd_conn *conn, 264 unsigned long long id) 265 { 266 struct ksmbd_session *sess; 267 268 down_read(&conn->session_lock); 269 sess = xa_load(&conn->sessions, id); 270 if (sess) { 271 up_read(&conn->session_lock); 272 return true; 273 } 274 up_read(&conn->session_lock); 275 276 return false; 277 } 278 279 struct ksmbd_session *ksmbd_session_lookup(struct ksmbd_conn *conn, 280 unsigned long long id) 281 { 282 struct ksmbd_session *sess; 283 284 down_read(&conn->session_lock); 285 sess = xa_load(&conn->sessions, id); 286 if (sess) { 287 sess->last_active = jiffies; 288 ksmbd_user_session_get(sess); 289 } 290 up_read(&conn->session_lock); 291 return sess; 292 } 293 294 struct ksmbd_session *ksmbd_session_lookup_slowpath(unsigned long long id) 295 { 296 struct ksmbd_session *sess; 297 298 down_read(&sessions_table_lock); 299 sess = __session_lookup(id); 300 if (sess) 301 ksmbd_user_session_get(sess); 302 up_read(&sessions_table_lock); 303 304 return sess; 305 } 306 307 struct ksmbd_session *ksmbd_session_lookup_all(struct ksmbd_conn *conn, 308 unsigned long long id) 309 { 310 struct ksmbd_session *sess; 311 312 sess = ksmbd_session_lookup(conn, id); 313 if (!sess && conn->binding) 314 sess = ksmbd_session_lookup_slowpath(id); 315 if (sess && sess->state != SMB2_SESSION_VALID) 316 sess = NULL; 317 return sess; 318 } 319 320 void ksmbd_user_session_get(struct ksmbd_session *sess) 321 { 322 atomic_inc(&sess->refcnt); 323 } 324 325 void ksmbd_user_session_put(struct ksmbd_session *sess) 326 { 327 if (!sess) 328 return; 329 330 if (atomic_read(&sess->refcnt) <= 0) 331 WARN_ON(1); 332 else if (atomic_dec_and_test(&sess->refcnt)) 333 ksmbd_session_destroy(sess); 334 } 335 336 struct preauth_session *ksmbd_preauth_session_alloc(struct ksmbd_conn *conn, 337 u64 sess_id) 338 { 339 struct preauth_session *sess; 340 341 sess = kmalloc(sizeof(struct preauth_session), GFP_KERNEL); 342 if (!sess) 343 return NULL; 344 345 sess->id = sess_id; 346 memcpy(sess->Preauth_HashValue, conn->preauth_info->Preauth_HashValue, 347 PREAUTH_HASHVALUE_SIZE); 348 list_add(&sess->preauth_entry, &conn->preauth_sess_table); 349 350 return sess; 351 } 352 353 void destroy_previous_session(struct ksmbd_conn *conn, 354 struct ksmbd_user *user, u64 id) 355 { 356 struct ksmbd_session *prev_sess; 357 struct ksmbd_user *prev_user; 358 int err; 359 360 down_write(&sessions_table_lock); 361 down_write(&conn->session_lock); 362 prev_sess = __session_lookup(id); 363 if (!prev_sess || prev_sess->state == SMB2_SESSION_EXPIRED) 364 goto out; 365 366 prev_user = prev_sess->user; 367 if (!prev_user || 368 strcmp(user->name, prev_user->name) || 369 user->passkey_sz != prev_user->passkey_sz || 370 memcmp(user->passkey, prev_user->passkey, user->passkey_sz)) 371 goto out; 372 373 ksmbd_all_conn_set_status(id, KSMBD_SESS_NEED_RECONNECT); 374 err = ksmbd_conn_wait_idle_sess_id(conn, id); 375 if (err) { 376 ksmbd_all_conn_set_status(id, KSMBD_SESS_NEED_NEGOTIATE); 377 goto out; 378 } 379 ksmbd_destroy_file_table(&prev_sess->file_table); 380 prev_sess->state = SMB2_SESSION_EXPIRED; 381 ksmbd_all_conn_set_status(id, KSMBD_SESS_NEED_NEGOTIATE); 382 out: 383 up_write(&conn->session_lock); 384 up_write(&sessions_table_lock); 385 } 386 387 static bool ksmbd_preauth_session_id_match(struct preauth_session *sess, 388 unsigned long long id) 389 { 390 return sess->id == id; 391 } 392 393 struct preauth_session *ksmbd_preauth_session_lookup(struct ksmbd_conn *conn, 394 unsigned long long id) 395 { 396 struct preauth_session *sess = NULL; 397 398 list_for_each_entry(sess, &conn->preauth_sess_table, preauth_entry) { 399 if (ksmbd_preauth_session_id_match(sess, id)) 400 return sess; 401 } 402 return NULL; 403 } 404 405 static int __init_smb2_session(struct ksmbd_session *sess) 406 { 407 int id = ksmbd_acquire_smb2_uid(&session_ida); 408 409 if (id < 0) 410 return -EINVAL; 411 sess->id = id; 412 return 0; 413 } 414 415 static struct ksmbd_session *__session_create(int protocol) 416 { 417 struct ksmbd_session *sess; 418 int ret; 419 420 if (protocol != CIFDS_SESSION_FLAG_SMB2) 421 return NULL; 422 423 sess = kzalloc(sizeof(struct ksmbd_session), GFP_KERNEL); 424 if (!sess) 425 return NULL; 426 427 if (ksmbd_init_file_table(&sess->file_table)) 428 goto error; 429 430 sess->last_active = jiffies; 431 sess->state = SMB2_SESSION_IN_PROGRESS; 432 set_session_flag(sess, protocol); 433 xa_init(&sess->tree_conns); 434 xa_init(&sess->ksmbd_chann_list); 435 xa_init(&sess->rpc_handle_list); 436 sess->sequence_number = 1; 437 rwlock_init(&sess->tree_conns_lock); 438 atomic_set(&sess->refcnt, 2); 439 440 ret = __init_smb2_session(sess); 441 if (ret) 442 goto error; 443 444 ida_init(&sess->tree_conn_ida); 445 446 down_write(&sessions_table_lock); 447 hash_add(sessions_table, &sess->hlist, sess->id); 448 up_write(&sessions_table_lock); 449 450 return sess; 451 452 error: 453 ksmbd_session_destroy(sess); 454 return NULL; 455 } 456 457 struct ksmbd_session *ksmbd_smb2_session_create(void) 458 { 459 return __session_create(CIFDS_SESSION_FLAG_SMB2); 460 } 461 462 int ksmbd_acquire_tree_conn_id(struct ksmbd_session *sess) 463 { 464 int id = -EINVAL; 465 466 if (test_session_flag(sess, CIFDS_SESSION_FLAG_SMB2)) 467 id = ksmbd_acquire_smb2_tid(&sess->tree_conn_ida); 468 469 return id; 470 } 471 472 void ksmbd_release_tree_conn_id(struct ksmbd_session *sess, int id) 473 { 474 if (id >= 0) 475 ksmbd_release_id(&sess->tree_conn_ida, id); 476 } 477