fs/cifs/connect.c

   1 /*
   2  *   fs/cifs/connect.c
   3  *
   4  *   Copyright (C) International Business Machines  Corp., 2002,2009
   5  *   Author(s): Steve French (sfrench@us.ibm.com)
   6  *
   7  *   This library is free software; you can redistribute it and/or modify
   8  *   it under the terms of the GNU Lesser General Public License as published
   9  *   by the Free Software Foundation; either version 2.1 of the License, or
  10  *   (at your option) any later version.
  11  *
  12  *   This library is distributed in the hope that it will be useful,
  13  *   but WITHOUT ANY WARRANTY; without even the implied warranty of
  14  *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See
  15  *   the GNU Lesser General Public License for more details.
  16  *
  17  *   You should have received a copy of the GNU Lesser General Public License
  18  *   along with this library; if not, write to the Free Software
  19  *   Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
  20  */
  21 #include <linux/fs.h>
  22 #include <linux/net.h>
  23 #include <linux/string.h>
  24 #include <linux/list.h>
  25 #include <linux/wait.h>
  26 #include <linux/slab.h>
  27 #include <linux/pagemap.h>
  28 #include <linux/ctype.h>
  29 #include <linux/utsname.h>
  30 #include <linux/mempool.h>
  31 #include <linux/delay.h>
  32 #include <linux/completion.h>
  33 #include <linux/kthread.h>
  34 #include <linux/pagevec.h>
  35 #include <linux/freezer.h>
  36 #include <linux/namei.h>
  37 #include <asm/uaccess.h>
  38 #include <asm/processor.h>
  39 #include <linux/inet.h>
  40 #include <net/ipv6.h>
  41 #include "cifspdu.h"
  42 #include "cifsglob.h"
  43 #include "cifsproto.h"
  44 #include "cifs_unicode.h"
  45 #include "cifs_debug.h"
  46 #include "cifs_fs_sb.h"
  47 #include "ntlmssp.h"
  48 #include "nterr.h"
  49 #include "rfc1002pdu.h"
  50 #include "fscache.h"
  51
  52 #define CIFS_PORT 445
  53 #define RFC1001_PORT 139
  54
  55 /* SMB echo "timeout" -- FIXME: tunable? */
  56 #define SMB_ECHO_INTERVAL (60 * HZ)
  57
  58 extern mempool_t *cifs_req_poolp;
  59
  60 struct smb_vol {
  61         char *username;
  62         char *password;
  63         char *domainname;
  64         char *UNC;
  65         char *UNCip;
  66         char *iocharset;  /* local code page for mapping to and from Unicode */
  67         char source_rfc1001_name[RFC1001_NAME_LEN_WITH_NULL]; /* clnt nb name */
  68         char target_rfc1001_name[RFC1001_NAME_LEN_WITH_NULL]; /* srvr nb name */
  69         uid_t cred_uid;
  70         uid_t linux_uid;
  71         gid_t linux_gid;
  72         mode_t file_mode;
  73         mode_t dir_mode;
  74         unsigned secFlg;
  75         bool retry:1;
  76         bool intr:1;
  77         bool setuids:1;
  78         bool override_uid:1;
  79         bool override_gid:1;
  80         bool dynperm:1;
  81         bool noperm:1;
  82         bool no_psx_acl:1; /* set if posix acl support should be disabled */
  83         bool cifs_acl:1;
  84         bool no_xattr:1;   /* set if xattr (EA) support should be disabled*/
  85         bool server_ino:1; /* use inode numbers from server ie UniqueId */
  86         bool direct_io:1;
  87         bool strict_io:1; /* strict cache behavior */
  88         bool remap:1;      /* set to remap seven reserved chars in filenames */
  89         bool posix_paths:1; /* unset to not ask for posix pathnames. */
  90         bool no_linux_ext:1;
  91         bool sfu_emul:1;
  92         bool nullauth:1;   /* attempt to authenticate with null user */
  93         bool nocase:1;     /* request case insensitive filenames */
  94         bool nobrl:1;      /* disable sending byte range locks to srv */
  95         bool mand_lock:1;  /* send mandatory not posix byte range lock reqs */
  96         bool seal:1;       /* request transport encryption on share */
  97         bool nodfs:1;      /* Do not request DFS, even if available */
  98         bool local_lease:1; /* check leases only on local system, not remote */
  99         bool noblocksnd:1;
 100         bool noautotune:1;
 101         bool nostrictsync:1; /* do not force expensive SMBflush on every sync */
 102         bool fsc:1;     /* enable fscache */
 103         bool mfsymlinks:1; /* use Minshall+French Symlinks */
 104         bool multiuser:1;
 105         unsigned int rsize;
 106         unsigned int wsize;
 107         bool sockopt_tcp_nodelay:1;
 108         unsigned short int port;
 109         unsigned long actimeo; /* attribute cache timeout (jiffies) */
 110         char *prepath;
 111         struct sockaddr_storage srcaddr; /* allow binding to a local IP */
 112         struct nls_table *local_nls;
 113 };
 114
 115 /* FIXME: should these be tunable? */
 116 #define TLINK_ERROR_EXPIRE      (1 * HZ)
 117 #define TLINK_IDLE_EXPIRE       (600 * HZ)
 118
 119 static int ip_connect(struct TCP_Server_Info *server);
 120 static int generic_ip_connect(struct TCP_Server_Info *server);
 121 static void tlink_rb_insert(struct rb_root *root, struct tcon_link *new_tlink);
 122 static void cifs_prune_tlinks(struct work_struct *work);
 123
 124 /*
 125  * cifs tcp session reconnection
 126  *
 127  * mark tcp session as reconnecting so temporarily locked
 128  * mark all smb sessions as reconnecting for tcp session
 129  * reconnect tcp session
 130  * wake up waiters on reconnection? - (not needed currently)
 131  */
 132 static int
 133 cifs_reconnect(struct TCP_Server_Info *server)
 134 {
 135         int rc = 0;
 136         struct list_head *tmp, *tmp2;
 137         struct cifsSesInfo *ses;
 138         struct cifsTconInfo *tcon;
 139         struct mid_q_entry *mid_entry;
 140
 141         spin_lock(&GlobalMid_Lock);
 142         if (server->tcpStatus == CifsExiting) {
 143                 /* the demux thread will exit normally
 144                 next time through the loop */
 145                 spin_unlock(&GlobalMid_Lock);
 146                 return rc;
 147         } else
 148                 server->tcpStatus = CifsNeedReconnect;
 149         spin_unlock(&GlobalMid_Lock);
 150         server->maxBuf = 0;
 151
 152         cFYI(1, "Reconnecting tcp session");
 153
 154         /* before reconnecting the tcp session, mark the smb session (uid)
 155                 and the tid bad so they are not used until reconnected */
 156         cFYI(1, "%s: marking sessions and tcons for reconnect", __func__);
 157         spin_lock(&cifs_tcp_ses_lock);
 158         list_for_each(tmp, &server->smb_ses_list) {
 159                 ses = list_entry(tmp, struct cifsSesInfo, smb_ses_list);
 160                 ses->need_reconnect = true;
 161                 ses->ipc_tid = 0;
 162                 list_for_each(tmp2, &ses->tcon_list) {
 163                         tcon = list_entry(tmp2, struct cifsTconInfo, tcon_list);
 164                         tcon->need_reconnect = true;
 165                 }
 166         }
 167         spin_unlock(&cifs_tcp_ses_lock);
 168
 169         /* do not want to be sending data on a socket we are freeing */
 170         cFYI(1, "%s: tearing down socket", __func__);
 171         mutex_lock(&server->srv_mutex);
 172         if (server->ssocket) {
 173                 cFYI(1, "State: 0x%x Flags: 0x%lx", server->ssocket->state,
 174                         server->ssocket->flags);
 175                 kernel_sock_shutdown(server->ssocket, SHUT_WR);
 176                 cFYI(1, "Post shutdown state: 0x%x Flags: 0x%lx",
 177                         server->ssocket->state,
 178                         server->ssocket->flags);
 179                 sock_release(server->ssocket);
 180                 server->ssocket = NULL;
 181         }
 182         server->sequence_number = 0;
 183         server->session_estab = false;
 184         kfree(server->session_key.response);
 185         server->session_key.response = NULL;
 186         server->session_key.len = 0;
 187         server->lstrp = jiffies;
 188         mutex_unlock(&server->srv_mutex);
 189
 190         /* mark submitted MIDs for retry and issue callback */
 191         cFYI(1, "%s: issuing mid callbacks", __func__);
 192         spin_lock(&GlobalMid_Lock);
 193         list_for_each_safe(tmp, tmp2, &server->pending_mid_q) {
 194                 mid_entry = list_entry(tmp, struct mid_q_entry, qhead);
 195                 if (mid_entry->midState == MID_REQUEST_SUBMITTED)
 196                         mid_entry->midState = MID_RETRY_NEEDED;
 197                 list_del_init(&mid_entry->qhead);
 198                 mid_entry->callback(mid_entry);
 199         }
 200         spin_unlock(&GlobalMid_Lock);
 201
 202         while ((server->tcpStatus != CifsExiting) &&
 203                (server->tcpStatus != CifsGood)) {
 204                 try_to_freeze();
 205
 206                 /* we should try only the port we connected to before */
 207                 rc = generic_ip_connect(server);
 208                 if (rc) {
 209                         cFYI(1, "reconnect error %d", rc);
 210                         msleep(3000);
 211                 } else {
 212                         atomic_inc(&tcpSesReconnectCount);
 213                         spin_lock(&GlobalMid_Lock);
 214                         if (server->tcpStatus != CifsExiting)
 215                                 server->tcpStatus = CifsGood;
 216                         spin_unlock(&GlobalMid_Lock);
 217                 }
 218         }
 219
 220         return rc;
 221 }
 222
 223 /*
 224         return codes:
 225                 0       not a transact2, or all data present
 226                 >0      transact2 with that much data missing
 227                 -EINVAL = invalid transact2
 228
 229  */
 230 static int check2ndT2(struct smb_hdr *pSMB, unsigned int maxBufSize)
 231 {
 232         struct smb_t2_rsp *pSMBt;
 233         int remaining;
 234         __u16 total_data_size, data_in_this_rsp;
 235
 236         if (pSMB->Command != SMB_COM_TRANSACTION2)
 237                 return 0;
 238
 239         /* check for plausible wct, bcc and t2 data and parm sizes */
 240         /* check for parm and data offset going beyond end of smb */
 241         if (pSMB->WordCount != 10) { /* coalesce_t2 depends on this */
 242                 cFYI(1, "invalid transact2 word count");
 243                 return -EINVAL;
 244         }
 245
 246         pSMBt = (struct smb_t2_rsp *)pSMB;
 247
 248         total_data_size = get_unaligned_le16(&pSMBt->t2_rsp.TotalDataCount);
 249         data_in_this_rsp = get_unaligned_le16(&pSMBt->t2_rsp.DataCount);
 250
 251         remaining = total_data_size - data_in_this_rsp;
 252
 253         if (remaining == 0)
 254                 return 0;
 255         else if (remaining < 0) {
 256                 cFYI(1, "total data %d smaller than data in frame %d",
 257                         total_data_size, data_in_this_rsp);
 258                 return -EINVAL;
 259         } else {
 260                 cFYI(1, "missing %d bytes from transact2, check next response",
 261                         remaining);
 262                 if (total_data_size > maxBufSize) {
 263                         cERROR(1, "TotalDataSize %d is over maximum buffer %d",
 264                                 total_data_size, maxBufSize);
 265                         return -EINVAL;
 266                 }
 267                 return remaining;
 268         }
 269 }
 270
 271 static int coalesce_t2(struct smb_hdr *psecond, struct smb_hdr *pTargetSMB)
 272 {
 273         struct smb_t2_rsp *pSMB2 = (struct smb_t2_rsp *)psecond;
 274         struct smb_t2_rsp *pSMBt  = (struct smb_t2_rsp *)pTargetSMB;
 275         char *data_area_of_target;
 276         char *data_area_of_buf2;
 277         int remaining;
 278         __u16 byte_count, total_data_size, total_in_buf, total_in_buf2;
 279
 280         total_data_size = get_unaligned_le16(&pSMBt->t2_rsp.TotalDataCount);
 281
 282         if (total_data_size !=
 283             get_unaligned_le16(&pSMB2->t2_rsp.TotalDataCount))
 284                 cFYI(1, "total data size of primary and secondary t2 differ");
 285
 286         total_in_buf = get_unaligned_le16(&pSMBt->t2_rsp.DataCount);
 287
 288         remaining = total_data_size - total_in_buf;
 289
 290         if (remaining < 0)
 291                 return -EINVAL;
 292
 293         if (remaining == 0) /* nothing to do, ignore */
 294                 return 0;
 295
 296         total_in_buf2 = get_unaligned_le16(&pSMB2->t2_rsp.DataCount);
 297         if (remaining < total_in_buf2) {
 298                 cFYI(1, "transact2 2nd response contains too much data");
 299         }
 300
 301         /* find end of first SMB data area */
 302         data_area_of_target = (char *)&pSMBt->hdr.Protocol +
 303                                 get_unaligned_le16(&pSMBt->t2_rsp.DataOffset);
 304         /* validate target area */
 305
 306         data_area_of_buf2 = (char *)&pSMB2->hdr.Protocol +
 307                                 get_unaligned_le16(&pSMB2->t2_rsp.DataOffset);
 308
 309         data_area_of_target += total_in_buf;
 310
 311         /* copy second buffer into end of first buffer */
 312         memcpy(data_area_of_target, data_area_of_buf2, total_in_buf2);
 313         total_in_buf += total_in_buf2;
 314         put_unaligned_le16(total_in_buf, &pSMBt->t2_rsp.DataCount);
 315         byte_count = get_bcc_le(pTargetSMB);
 316         byte_count += total_in_buf2;
 317         put_bcc_le(byte_count, pTargetSMB);
 318
 319         byte_count = pTargetSMB->smb_buf_length;
 320         byte_count += total_in_buf2;
 321
 322         /* BB also add check that we are not beyond maximum buffer size */
 323
 324         pTargetSMB->smb_buf_length = byte_count;
 325
 326         if (remaining == total_in_buf2) {
 327                 cFYI(1, "found the last secondary response");
 328                 return 0; /* we are done */
 329         } else /* more responses to go */
 330                 return 1;
 331 }
 332
 333 static void
 334 cifs_echo_request(struct work_struct *work)
 335 {
 336         int rc;
 337         struct TCP_Server_Info *server = container_of(work,
 338                                         struct TCP_Server_Info, echo.work);
 339
 340         /* no need to ping if we got a response recently */
 341         if (time_before(jiffies, server->lstrp + SMB_ECHO_INTERVAL - HZ))
 342                 goto requeue_echo;
 343
 344         rc = CIFSSMBEcho(server);
 345         if (rc)
 346                 cFYI(1, "Unable to send echo request to server: %s",
 347                         server->hostname);
 348
 349 requeue_echo:
 350         queue_delayed_work(system_nrt_wq, &server->echo, SMB_ECHO_INTERVAL);
 351 }
 352
 353 static int
 354 cifs_demultiplex_thread(struct TCP_Server_Info *server)
 355 {
 356         int length;
 357         unsigned int pdu_length, total_read;
 358         struct smb_hdr *smb_buffer = NULL;
 359         struct smb_hdr *bigbuf = NULL;
 360         struct smb_hdr *smallbuf = NULL;
 361         struct msghdr smb_msg;
 362         struct kvec iov;
 363         struct socket *csocket = server->ssocket;
 364         struct list_head *tmp, *tmp2;
 365         struct task_struct *task_to_wake = NULL;
 366         struct mid_q_entry *mid_entry;
 367         char temp;
 368         bool isLargeBuf = false;
 369         bool isMultiRsp;
 370         int reconnect;
 371
 372         current->flags |= PF_MEMALLOC;
 373         cFYI(1, "Demultiplex PID: %d", task_pid_nr(current));
 374
 375         length = atomic_inc_return(&tcpSesAllocCount);
 376         if (length > 1)
 377                 mempool_resize(cifs_req_poolp, length + cifs_min_rcv,
 378                                 GFP_KERNEL);
 379
 380         set_freezable();
 381         while (server->tcpStatus != CifsExiting) {
 382                 if (try_to_freeze())
 383                         continue;
 384                 if (bigbuf == NULL) {
 385                         bigbuf = cifs_buf_get();
 386                         if (!bigbuf) {
 387                                 cERROR(1, "No memory for large SMB response");
 388                                 msleep(3000);
 389                                 /* retry will check if exiting */
 390                                 continue;
 391                         }
 392                 } else if (isLargeBuf) {
 393                         /* we are reusing a dirty large buf, clear its start */
 394                         memset(bigbuf, 0, sizeof(struct smb_hdr));
 395                 }
 396
 397                 if (smallbuf == NULL) {
 398                         smallbuf = cifs_small_buf_get();
 399                         if (!smallbuf) {
 400                                 cERROR(1, "No memory for SMB response");
 401                                 msleep(1000);
 402                                 /* retry will check if exiting */
 403                                 continue;
 404                         }
 405                         /* beginning of smb buffer is cleared in our buf_get */
 406                 } else /* if existing small buf clear beginning */
 407                         memset(smallbuf, 0, sizeof(struct smb_hdr));
 408
 409                 isLargeBuf = false;
 410                 isMultiRsp = false;
 411                 smb_buffer = smallbuf;
 412                 iov.iov_base = smb_buffer;
 413                 iov.iov_len = 4;
 414                 smb_msg.msg_control = NULL;
 415                 smb_msg.msg_controllen = 0;
 416                 pdu_length = 4; /* enough to get RFC1001 header */
 417
 418 incomplete_rcv:
 419                 if (echo_retries > 0 &&
 420                     time_after(jiffies, server->lstrp +
 421                                         (echo_retries * SMB_ECHO_INTERVAL))) {
 422                         cERROR(1, "Server %s has not responded in %d seconds. "
 423                                   "Reconnecting...", server->hostname,
 424                                   (echo_retries * SMB_ECHO_INTERVAL / HZ));
 425                         cifs_reconnect(server);
 426                         csocket = server->ssocket;
 427                         wake_up(&server->response_q);
 428                         continue;
 429                 }
 430
 431                 length =
 432                     kernel_recvmsg(csocket, &smb_msg,
 433                                 &iov, 1, pdu_length, 0 /* BB other flags? */);
 434
 435                 if (server->tcpStatus == CifsExiting) {
 436                         break;
 437                 } else if (server->tcpStatus == CifsNeedReconnect) {
 438                         cFYI(1, "Reconnect after server stopped responding");
 439                         cifs_reconnect(server);
 440                         cFYI(1, "call to reconnect done");
 441                         csocket = server->ssocket;
 442                         continue;
 443                 } else if (length == -ERESTARTSYS ||
 444                            length == -EAGAIN ||
 445                            length == -EINTR) {
 446                         msleep(1); /* minimum sleep to prevent looping
 447                                 allowing socket to clear and app threads to set
 448                                 tcpStatus CifsNeedReconnect if server hung */
 449                         if (pdu_length < 4) {
 450                                 iov.iov_base = (4 - pdu_length) +
 451                                                         (char *)smb_buffer;
 452                                 iov.iov_len = pdu_length;
 453                                 smb_msg.msg_control = NULL;
 454                                 smb_msg.msg_controllen = 0;
 455                                 goto incomplete_rcv;
 456                         } else
 457                                 continue;
 458                 } else if (length <= 0) {
 459                         cFYI(1, "Reconnect after unexpected peek error %d",
 460                                 length);
 461                         cifs_reconnect(server);
 462                         csocket = server->ssocket;
 463                         wake_up(&server->response_q);
 464                         continue;
 465                 } else if (length < pdu_length) {
 466                         cFYI(1, "requested %d bytes but only got %d bytes",
 467                                   pdu_length, length);
 468                         pdu_length -= length;
 469                         msleep(1);
 470                         goto incomplete_rcv;
 471                 }
 472
 473                 /* The right amount was read from socket - 4 bytes */
 474                 /* so we can now interpret the length field */
 475
 476                 /* the first byte big endian of the length field,
 477                 is actually not part of the length but the type
 478                 with the most common, zero, as regular data */
 479                 temp = *((char *) smb_buffer);
 480
 481                 /* Note that FC 1001 length is big endian on the wire,
 482                 but we convert it here so it is always manipulated
 483                 as host byte order */
 484                 pdu_length = be32_to_cpu((__force __be32)smb_buffer->smb_buf_length);
 485                 smb_buffer->smb_buf_length = pdu_length;
 486
 487                 cFYI(1, "rfc1002 length 0x%x", pdu_length+4);
 488
 489                 if (temp == (char) RFC1002_SESSION_KEEP_ALIVE) {
 490                         continue;
 491                 } else if (temp == (char)RFC1002_POSITIVE_SESSION_RESPONSE) {
 492                         cFYI(1, "Good RFC 1002 session rsp");
 493                         continue;
 494                 } else if (temp == (char)RFC1002_NEGATIVE_SESSION_RESPONSE) {
 495                         /* we get this from Windows 98 instead of
 496                            an error on SMB negprot response */
 497                         cFYI(1, "Negative RFC1002 Session Response Error 0x%x)",
 498                                 pdu_length);
 499                         /* give server a second to clean up  */
 500                         msleep(1000);
 501                         /* always try 445 first on reconnect since we get NACK
 502                          * on some if we ever connected to port 139 (the NACK
 503                          * is since we do not begin with RFC1001 session
 504                          * initialize frame)
 505                          */
 506                         cifs_set_port((struct sockaddr *)
 507                                         &server->dstaddr, CIFS_PORT);
 508                         cifs_reconnect(server);
 509                         csocket = server->ssocket;
 510                         wake_up(&server->response_q);
 511                         continue;
 512                 } else if (temp != (char) 0) {
 513                         cERROR(1, "Unknown RFC 1002 frame");
 514                         cifs_dump_mem(" Received Data: ", (char *)smb_buffer,
 515                                       length);
 516                         cifs_reconnect(server);
 517                         csocket = server->ssocket;
 518                         continue;
 519                 }
 520
 521                 /* else we have an SMB response */
 522                 if ((pdu_length > CIFSMaxBufSize + MAX_CIFS_HDR_SIZE - 4) ||
 523                             (pdu_length < sizeof(struct smb_hdr) - 1 - 4)) {
 524                         cERROR(1, "Invalid size SMB length %d pdu_length %d",
 525                                         length, pdu_length+4);
 526                         cifs_reconnect(server);
 527                         csocket = server->ssocket;
 528                         wake_up(&server->response_q);
 529                         continue;
 530                 }
 531
 532                 /* else length ok */
 533                 reconnect = 0;
 534
 535                 if (pdu_length > MAX_CIFS_SMALL_BUFFER_SIZE - 4) {
 536                         isLargeBuf = true;
 537                         memcpy(bigbuf, smallbuf, 4);
 538                         smb_buffer = bigbuf;
 539                 }
 540                 length = 0;
 541                 iov.iov_base = 4 + (char *)smb_buffer;
 542                 iov.iov_len = pdu_length;
 543                 for (total_read = 0; total_read < pdu_length;
 544                      total_read += length) {
 545                         length = kernel_recvmsg(csocket, &smb_msg, &iov, 1,
 546                                                 pdu_length - total_read, 0);
 547                         if (server->tcpStatus == CifsExiting) {
 548                                 /* then will exit */
 549                                 reconnect = 2;
 550                                 break;
 551                         } else if (server->tcpStatus == CifsNeedReconnect) {
 552                                 cifs_reconnect(server);
 553                                 csocket = server->ssocket;
 554                                 /* Reconnect wakes up rspns q */
 555                                 /* Now we will reread sock */
 556                                 reconnect = 1;
 557                                 break;
 558                         } else if (length == -ERESTARTSYS ||
 559                                    length == -EAGAIN ||
 560                                    length == -EINTR) {
 561                                 msleep(1); /* minimum sleep to prevent looping,
 562                                               allowing socket to clear and app
 563                                               threads to set tcpStatus
 564                                               CifsNeedReconnect if server hung*/
 565                                 length = 0;
 566                                 continue;
 567                         } else if (length <= 0) {
 568                                 cERROR(1, "Received no data, expecting %d",
 569                                               pdu_length - total_read);
 570                                 cifs_reconnect(server);
 571                                 csocket = server->ssocket;
 572                                 reconnect = 1;
 573                                 break;
 574                         }
 575                 }
 576                 if (reconnect == 2)
 577                         break;
 578                 else if (reconnect == 1)
 579                         continue;
 580
 581                 length += 4; /* account for rfc1002 hdr */
 582
 583
 584                 dump_smb(smb_buffer, length);
 585                 if (checkSMB(smb_buffer, smb_buffer->Mid, total_read+4)) {
 586                         cifs_dump_mem("Bad SMB: ", smb_buffer, 48);
 587                         continue;
 588                 }
 589
 590                 mid_entry = NULL;
 591                 server->lstrp = jiffies;
 592
 593                 spin_lock(&GlobalMid_Lock);
 594                 list_for_each_safe(tmp, tmp2, &server->pending_mid_q) {
 595                         mid_entry = list_entry(tmp, struct mid_q_entry, qhead);
 596
 597                         if ((mid_entry->mid == smb_buffer->Mid) &&
 598                             (mid_entry->midState == MID_REQUEST_SUBMITTED) &&
 599                             (mid_entry->command == smb_buffer->Command)) {
 600                                 if (check2ndT2(smb_buffer,server->maxBuf) > 0) {
 601                                         /* We have a multipart transact2 resp */
 602                                         isMultiRsp = true;
 603                                         if (mid_entry->resp_buf) {
 604                                                 /* merge response - fix up 1st*/
 605                                                 if (coalesce_t2(smb_buffer,
 606                                                         mid_entry->resp_buf)) {
 607                                                         mid_entry->multiRsp =
 608                                                                  true;
 609                                                         break;
 610                                                 } else {
 611                                                         /* all parts received */
 612                                                         mid_entry->multiEnd =
 613                                                                  true;
 614                                                         goto multi_t2_fnd;
 615                                                 }
 616                                         } else {
 617                                                 if (!isLargeBuf) {
 618                                                         cERROR(1, "1st trans2 resp needs bigbuf");
 619                                         /* BB maybe we can fix this up,  switch
 620                                            to already allocated large buffer? */
 621                                                 } else {
 622                                                         /* Have first buffer */
 623                                                         mid_entry->resp_buf =
 624                                                                  smb_buffer;
 625                                                         mid_entry->largeBuf =
 626                                                                  true;
 627                                                         bigbuf = NULL;
 628                                                 }
 629                                         }
 630                                         break;
 631                                 }
 632                                 mid_entry->resp_buf = smb_buffer;
 633                                 mid_entry->largeBuf = isLargeBuf;
 634 multi_t2_fnd:
 635                                 mid_entry->midState = MID_RESPONSE_RECEIVED;
 636                                 list_del_init(&mid_entry->qhead);
 637                                 mid_entry->callback(mid_entry);
 638 #ifdef CONFIG_CIFS_STATS2
 639                                 mid_entry->when_received = jiffies;
 640 #endif
 641                                 break;
 642                         }
 643                         mid_entry = NULL;
 644                 }
 645                 spin_unlock(&GlobalMid_Lock);
 646
 647                 if (mid_entry != NULL) {
 648                         /* Was previous buf put in mpx struct for multi-rsp? */
 649                         if (!isMultiRsp) {
 650                                 /* smb buffer will be freed by user thread */
 651                                 if (isLargeBuf)
 652                                         bigbuf = NULL;
 653                                 else
 654                                         smallbuf = NULL;
 655                         }
 656                 } else if (!is_valid_oplock_break(smb_buffer, server) &&
 657                            !isMultiRsp) {
 658                         cERROR(1, "No task to wake, unknown frame received! "
 659                                    "NumMids %d", atomic_read(&midCount));
 660                         cifs_dump_mem("Received Data is: ", (char *)smb_buffer,
 661                                       sizeof(struct smb_hdr));
 662 #ifdef CONFIG_CIFS_DEBUG2
 663                         cifs_dump_detail(smb_buffer);
 664                         cifs_dump_mids(server);
 665 #endif /* CIFS_DEBUG2 */
 666
 667                 }
 668         } /* end while !EXITING */
 669
 670         /* take it off the list, if it's not already */
 671         spin_lock(&cifs_tcp_ses_lock);
 672         list_del_init(&server->tcp_ses_list);
 673         spin_unlock(&cifs_tcp_ses_lock);
 674
 675         spin_lock(&GlobalMid_Lock);
 676         server->tcpStatus = CifsExiting;
 677         spin_unlock(&GlobalMid_Lock);
 678         wake_up_all(&server->response_q);
 679
 680         /* check if we have blocked requests that need to free */
 681         /* Note that cifs_max_pending is normally 50, but
 682         can be set at module install time to as little as two */
 683         spin_lock(&GlobalMid_Lock);
 684         if (atomic_read(&server->inFlight) >= cifs_max_pending)
 685                 atomic_set(&server->inFlight, cifs_max_pending - 1);
 686         /* We do not want to set the max_pending too low or we
 687         could end up with the counter going negative */
 688         spin_unlock(&GlobalMid_Lock);
 689         /* Although there should not be any requests blocked on
 690         this queue it can not hurt to be paranoid and try to wake up requests
 691         that may haven been blocked when more than 50 at time were on the wire
 692         to the same server - they now will see the session is in exit state
 693         and get out of SendReceive.  */
 694         wake_up_all(&server->request_q);
 695         /* give those requests time to exit */
 696         msleep(125);
 697
 698         if (server->ssocket) {
 699                 sock_release(csocket);
 700                 server->ssocket = NULL;
 701         }
 702         /* buffer usuallly freed in free_mid - need to free it here on exit */
 703         cifs_buf_release(bigbuf);
 704         if (smallbuf) /* no sense logging a debug message if NULL */
 705                 cifs_small_buf_release(smallbuf);
 706
 707         if (!list_empty(&server->pending_mid_q)) {
 708                 spin_lock(&GlobalMid_Lock);
 709                 list_for_each_safe(tmp, tmp2, &server->pending_mid_q) {
 710                         mid_entry = list_entry(tmp, struct mid_q_entry, qhead);
 711                         cFYI(1, "Clearing Mid 0x%x - issuing callback",
 712                                          mid_entry->mid);
 713                         list_del_init(&mid_entry->qhead);
 714                         mid_entry->callback(mid_entry);
 715                 }
 716                 spin_unlock(&GlobalMid_Lock);
 717                 /* 1/8th of sec is more than enough time for them to exit */
 718                 msleep(125);
 719         }
 720
 721         if (!list_empty(&server->pending_mid_q)) {
 722                 /* mpx threads have not exited yet give them
 723                 at least the smb send timeout time for long ops */
 724                 /* due to delays on oplock break requests, we need
 725                 to wait at least 45 seconds before giving up
 726                 on a request getting a response and going ahead
 727                 and killing cifsd */
 728                 cFYI(1, "Wait for exit from demultiplex thread");
 729                 msleep(46000);
 730                 /* if threads still have not exited they are probably never
 731                 coming home not much else we can do but free the memory */
 732         }
 733
 734         kfree(server->hostname);
 735         task_to_wake = xchg(&server->tsk, NULL);
 736         kfree(server);
 737
 738         length = atomic_dec_return(&tcpSesAllocCount);
 739         if (length  > 0)
 740                 mempool_resize(cifs_req_poolp, length + cifs_min_rcv,
 741                                 GFP_KERNEL);
 742
 743         /* if server->tsk was NULL then wait for a signal before exiting */
 744         if (!task_to_wake) {
 745                 set_current_state(TASK_INTERRUPTIBLE);
 746                 while (!signal_pending(current)) {
 747                         schedule();
 748                         set_current_state(TASK_INTERRUPTIBLE);
 749                 }
 750                 set_current_state(TASK_RUNNING);
 751         }
 752
 753         module_put_and_exit(0);
 754 }
 755
 756 /* extract the host portion of the UNC string */
 757 static char *
 758 extract_hostname(const char *unc)
 759 {
 760         const char *src;
 761         char *dst, *delim;
 762         unsigned int len;
 763
 764         /* skip double chars at beginning of string */
 765         /* BB: check validity of these bytes? */
 766         src = unc + 2;
 767
 768         /* delimiter between hostname and sharename is always '\\' now */
 769         delim = strchr(src, '\\');
 770         if (!delim)
 771                 return ERR_PTR(-EINVAL);
 772
 773         len = delim - src;
 774         dst = kmalloc((len + 1), GFP_KERNEL);
 775         if (dst == NULL)
 776                 return ERR_PTR(-ENOMEM);
 777
 778         memcpy(dst, src, len);
 779         dst[len] = '\0';
 780
 781         return dst;
 782 }
 783
 784 static int
 785 cifs_parse_mount_options(char *options, const char *devname,
 786                          struct smb_vol *vol)
 787 {
 788         char *value;
 789         char *data;
 790         unsigned int  temp_len, i, j;
 791         char separator[2];
 792         short int override_uid = -1;
 793         short int override_gid = -1;
 794         bool uid_specified = false;
 795         bool gid_specified = false;
 796         char *nodename = utsname()->nodename;
 797
 798         separator[0] = ',';
 799         separator[1] = 0;
 800
 801         /*
 802          * does not have to be perfect mapping since field is
 803          * informational, only used for servers that do not support
 804          * port 445 and it can be overridden at mount time
 805          */
 806         memset(vol->source_rfc1001_name, 0x20, RFC1001_NAME_LEN);
 807         for (i = 0; i < strnlen(nodename, RFC1001_NAME_LEN); i++)
 808                 vol->source_rfc1001_name[i] = toupper(nodename[i]);
 809
 810         vol->source_rfc1001_name[RFC1001_NAME_LEN] = 0;
 811         /* null target name indicates to use *SMBSERVR default called name
 812            if we end up sending RFC1001 session initialize */
 813         vol->target_rfc1001_name[0] = 0;
 814         vol->cred_uid = current_uid();
 815         vol->linux_uid = current_uid();
 816         vol->linux_gid = current_gid();
 817
 818         /* default to only allowing write access to owner of the mount */
 819         vol->dir_mode = vol->file_mode = S_IRUGO | S_IXUGO | S_IWUSR;
 820
 821         /* vol->retry default is 0 (i.e. "soft" limited retry not hard retry) */
 822         /* default is always to request posix paths. */
 823         vol->posix_paths = 1;
 824         /* default to using server inode numbers where available */
 825         vol->server_ino = 1;
 826
 827         vol->actimeo = CIFS_DEF_ACTIMEO;
 828
 829         if (!options)
 830                 return 1;
 831
 832         if (strncmp(options, "sep=", 4) == 0) {
 833                 if (options[4] != 0) {
 834                         separator[0] = options[4];
 835                         options += 5;
 836                 } else {
 837                         cFYI(1, "Null separator not allowed");
 838                 }
 839         }
 840
 841         while ((data = strsep(&options, separator)) != NULL) {
 842                 if (!*data)
 843                         continue;
 844                 if ((value = strchr(data, '=')) != NULL)
 845                         *value++ = '\0';
 846
 847                 /* Have to parse this before we parse for "user" */
 848                 if (strnicmp(data, "user_xattr", 10) == 0) {
 849                         vol->no_xattr = 0;
 850                 } else if (strnicmp(data, "nouser_xattr", 12) == 0) {
 851                         vol->no_xattr = 1;
 852                 } else if (strnicmp(data, "user", 4) == 0) {
 853                         if (!value) {
 854                                 printk(KERN_WARNING
 855                                        "CIFS: invalid or missing username\n");
 856                                 return 1;       /* needs_arg; */
 857                         } else if (!*value) {
 858                                 /* null user, ie anonymous, authentication */
 859                                 vol->nullauth = 1;
 860                         }
 861                         if (strnlen(value, 200) < 200) {
 862                                 vol->username = value;
 863                         } else {
 864                                 printk(KERN_WARNING "CIFS: username too long\n");
 865                                 return 1;
 866                         }
 867                 } else if (strnicmp(data, "pass", 4) == 0) {
 868                         if (!value) {
 869                                 vol->password = NULL;
 870                                 continue;
 871                         } else if (value[0] == 0) {
 872                                 /* check if string begins with double comma
 873                                    since that would mean the password really
 874                                    does start with a comma, and would not
 875                                    indicate an empty string */
 876                                 if (value[1] != separator[0]) {
 877                                         vol->password = NULL;
 878                                         continue;
 879                                 }
 880                         }
 881                         temp_len = strlen(value);
 882                         /* removed password length check, NTLM passwords
 883                                 can be arbitrarily long */
 884
 885                         /* if comma in password, the string will be
 886                         prematurely null terminated.  Commas in password are
 887                         specified across the cifs mount interface by a double
 888                         comma ie ,, and a comma used as in other cases ie ','
 889                         as a parameter delimiter/separator is single and due
 890                         to the strsep above is temporarily zeroed. */
 891
 892                         /* NB: password legally can have multiple commas and
 893                         the only illegal character in a password is null */
 894
 895                         if ((value[temp_len] == 0) &&
 896                             (value[temp_len+1] == separator[0])) {
 897                                 /* reinsert comma */
 898                                 value[temp_len] = separator[0];
 899                                 temp_len += 2;  /* move after second comma */
 900                                 while (value[temp_len] != 0)  {
 901                                         if (value[temp_len] == separator[0]) {
 902                                                 if (value[temp_len+1] ==
 903                                                      separator[0]) {
 904                                                 /* skip second comma */
 905                                                         temp_len++;
 906                                                 } else {
 907                                                 /* single comma indicating start
 908                                                          of next parm */
 909                                                         break;
 910                                                 }
 911                                         }
 912                                         temp_len++;
 913                                 }
 914                                 if (value[temp_len] == 0) {
 915                                         options = NULL;
 916                                 } else {
 917                                         value[temp_len] = 0;
 918                                         /* point option to start of next parm */
 919                                         options = value + temp_len + 1;
 920                                 }
 921                                 /* go from value to value + temp_len condensing
 922                                 double commas to singles. Note that this ends up
 923                                 allocating a few bytes too many, which is ok */
 924                                 vol->password = kzalloc(temp_len, GFP_KERNEL);
 925                                 if (vol->password == NULL) {
 926                                         printk(KERN_WARNING "CIFS: no memory "
 927                                                             "for password\n");
 928                                         return 1;
 929                                 }
 930                                 for (i = 0, j = 0; i < temp_len; i++, j++) {
 931                                         vol->password[j] = value[i];
 932                                         if (value[i] == separator[0]
 933                                                 && value[i+1] == separator[0]) {
 934                                                 /* skip second comma */
 935                                                 i++;
 936                                         }
 937                                 }
 938                                 vol->password[j] = 0;
 939                         } else {
 940                                 vol->password = kzalloc(temp_len+1, GFP_KERNEL);
 941                                 if (vol->password == NULL) {
 942                                         printk(KERN_WARNING "CIFS: no memory "
 943                                                             "for password\n");
 944                                         return 1;
 945                                 }
 946                                 strcpy(vol->password, value);
 947                         }
 948                 } else if (!strnicmp(data, "ip", 2) ||
 949                            !strnicmp(data, "addr", 4)) {
 950                         if (!value || !*value) {
 951                                 vol->UNCip = NULL;
 952                         } else if (strnlen(value, INET6_ADDRSTRLEN) <
 953                                                         INET6_ADDRSTRLEN) {
 954                                 vol->UNCip = value;
 955                         } else {
 956                                 printk(KERN_WARNING "CIFS: ip address "
 957                                                     "too long\n");
 958                                 return 1;
 959                         }
 960                 } else if (strnicmp(data, "sec", 3) == 0) {
 961                         if (!value || !*value) {
 962                                 cERROR(1, "no security value specified");
 963                                 continue;
 964                         } else if (strnicmp(value, "krb5i", 5) == 0) {
 965                                 vol->secFlg |= CIFSSEC_MAY_KRB5 |
 966                                         CIFSSEC_MUST_SIGN;
 967                         } else if (strnicmp(value, "krb5p", 5) == 0) {
 968                                 /* vol->secFlg |= CIFSSEC_MUST_SEAL |
 969                                         CIFSSEC_MAY_KRB5; */
 970                                 cERROR(1, "Krb5 cifs privacy not supported");
 971                                 return 1;
 972                         } else if (strnicmp(value, "krb5", 4) == 0) {
 973                                 vol->secFlg |= CIFSSEC_MAY_KRB5;
 974                         } else if (strnicmp(value, "ntlmsspi", 8) == 0) {
 975                                 vol->secFlg |= CIFSSEC_MAY_NTLMSSP |
 976                                         CIFSSEC_MUST_SIGN;
 977                         } else if (strnicmp(value, "ntlmssp", 7) == 0) {
 978                                 vol->secFlg |= CIFSSEC_MAY_NTLMSSP;
 979                         } else if (strnicmp(value, "ntlmv2i", 7) == 0) {
 980                                 vol->secFlg |= CIFSSEC_MAY_NTLMV2 |
 981                                         CIFSSEC_MUST_SIGN;
 982                         } else if (strnicmp(value, "ntlmv2", 6) == 0) {
 983                                 vol->secFlg |= CIFSSEC_MAY_NTLMV2;
 984                         } else if (strnicmp(value, "ntlmi", 5) == 0) {
 985                                 vol->secFlg |= CIFSSEC_MAY_NTLM |
 986                                         CIFSSEC_MUST_SIGN;
 987                         } else if (strnicmp(value, "ntlm", 4) == 0) {
 988                                 /* ntlm is default so can be turned off too */
 989                                 vol->secFlg |= CIFSSEC_MAY_NTLM;
 990                         } else if (strnicmp(value, "nontlm", 6) == 0) {
 991                                 /* BB is there a better way to do this? */
 992                                 vol->secFlg |= CIFSSEC_MAY_NTLMV2;
 993 #ifdef CONFIG_CIFS_WEAK_PW_HASH
 994                         } else if (strnicmp(value, "lanman", 6) == 0) {
 995                                 vol->secFlg |= CIFSSEC_MAY_LANMAN;
 996 #endif
 997                         } else if (strnicmp(value, "none", 4) == 0) {
 998                                 vol->nullauth = 1;
 999                         } else {
1000                                 cERROR(1, "bad security option: %s", value);
1001                                 return 1;
1002                         }
1003                 } else if ((strnicmp(data, "unc", 3) == 0)
1004                            || (strnicmp(data, "target", 6) == 0)
1005                            || (strnicmp(data, "path", 4) == 0)) {
1006                         if (!value || !*value) {
1007                                 printk(KERN_WARNING "CIFS: invalid path to "
1008                                                     "network resource\n");
1009                                 return 1;       /* needs_arg; */
1010                         }
1011                         if ((temp_len = strnlen(value, 300)) < 300) {
1012                                 vol->UNC = kmalloc(temp_len+1, GFP_KERNEL);
1013                                 if (vol->UNC == NULL)
1014                                         return 1;
1015                                 strcpy(vol->UNC, value);
1016                                 if (strncmp(vol->UNC, "//", 2) == 0) {
1017                                         vol->UNC[0] = '\\';
1018                                         vol->UNC[1] = '\\';
1019                                 } else if (strncmp(vol->UNC, "\\\\", 2) != 0) {
1020                                         printk(KERN_WARNING
1021                                                "CIFS: UNC Path does not begin "
1022                                                "with // or \\\\ \n");
1023                                         return 1;
1024                                 }
1025                         } else {
1026                                 printk(KERN_WARNING "CIFS: UNC name too long\n");
1027                                 return 1;
1028                         }
1029                 } else if ((strnicmp(data, "domain", 3) == 0)
1030                            || (strnicmp(data, "workgroup", 5) == 0)) {
1031                         if (!value || !*value) {
1032                                 printk(KERN_WARNING "CIFS: invalid domain name\n");
1033                                 return 1;       /* needs_arg; */
1034                         }
1035                         /* BB are there cases in which a comma can be valid in
1036                         a domain name and need special handling? */
1037                         if (strnlen(value, 256) < 256) {
1038                                 vol->domainname = value;
1039                                 cFYI(1, "Domain name set");
1040                         } else {
1041                                 printk(KERN_WARNING "CIFS: domain name too "
1042                                                     "long\n");
1043                                 return 1;
1044                         }
1045                 } else if (strnicmp(data, "srcaddr", 7) == 0) {
1046                         vol->srcaddr.ss_family = AF_UNSPEC;
1047
1048                         if (!value || !*value) {
1049                                 printk(KERN_WARNING "CIFS: srcaddr value"
1050                                        " not specified.\n");
1051                                 return 1;       /* needs_arg; */
1052                         }
1053                         i = cifs_convert_address((struct sockaddr *)&vol->srcaddr,
1054                                                  value, strlen(value));
1055                         if (i == 0) {
1056                                 printk(KERN_WARNING "CIFS:  Could not parse"
1057                                        " srcaddr: %s\n",
1058                                        value);
1059                                 return 1;
1060                         }
1061                 } else if (strnicmp(data, "prefixpath", 10) == 0) {
1062                         if (!value || !*value) {
1063                                 printk(KERN_WARNING
1064                                         "CIFS: invalid path prefix\n");
1065                                 return 1;       /* needs_argument */
1066                         }
1067                         if ((temp_len = strnlen(value, 1024)) < 1024) {
1068                                 if (value[0] != '/')
1069                                         temp_len++;  /* missing leading slash */
1070                                 vol->prepath = kmalloc(temp_len+1, GFP_KERNEL);
1071                                 if (vol->prepath == NULL)
1072                                         return 1;
1073                                 if (value[0] != '/') {
1074                                         vol->prepath[0] = '/';
1075                                         strcpy(vol->prepath+1, value);
1076                                 } else
1077                                         strcpy(vol->prepath, value);
1078                                 cFYI(1, "prefix path %s", vol->prepath);
1079                         } else {
1080                                 printk(KERN_WARNING "CIFS: prefix too long\n");
1081                                 return 1;
1082                         }
1083                 } else if (strnicmp(data, "iocharset", 9) == 0) {
1084                         if (!value || !*value) {
1085                                 printk(KERN_WARNING "CIFS: invalid iocharset "
1086                                                     "specified\n");
1087                                 return 1;       /* needs_arg; */
1088                         }
1089                         if (strnlen(value, 65) < 65) {
1090                                 if (strnicmp(value, "default", 7))
1091                                         vol->iocharset = value;
1092                                 /* if iocharset not set then load_nls_default
1093                                    is used by caller */
1094                                 cFYI(1, "iocharset set to %s", value);
1095                         } else {
1096                                 printk(KERN_WARNING "CIFS: iocharset name "
1097                                                     "too long.\n");
1098                                 return 1;
1099                         }
1100                 } else if (!strnicmp(data, "uid", 3) && value && *value) {
1101                         vol->linux_uid = simple_strtoul(value, &value, 0);
1102                         uid_specified = true;
1103                 } else if (!strnicmp(data, "cruid", 5) && value && *value) {
1104                         vol->cred_uid = simple_strtoul(value, &value, 0);
1105                 } else if (!strnicmp(data, "forceuid", 8)) {
1106                         override_uid = 1;
1107                 } else if (!strnicmp(data, "noforceuid", 10)) {
1108                         override_uid = 0;
1109                 } else if (!strnicmp(data, "gid", 3) && value && *value) {
1110                         vol->linux_gid = simple_strtoul(value, &value, 0);
1111                         gid_specified = true;
1112                 } else if (!strnicmp(data, "forcegid", 8)) {
1113                         override_gid = 1;
1114                 } else if (!strnicmp(data, "noforcegid", 10)) {
1115                         override_gid = 0;
1116                 } else if (strnicmp(data, "file_mode", 4) == 0) {
1117                         if (value && *value) {
1118                                 vol->file_mode =
1119                                         simple_strtoul(value, &value, 0);
1120                         }
1121                 } else if (strnicmp(data, "dir_mode", 4) == 0) {
1122                         if (value && *value) {
1123                                 vol->dir_mode =
1124                                         simple_strtoul(value, &value, 0);
1125                         }
1126                 } else if (strnicmp(data, "dirmode", 4) == 0) {
1127                         if (value && *value) {
1128                                 vol->dir_mode =
1129                                         simple_strtoul(value, &value, 0);
1130                         }
1131                 } else if (strnicmp(data, "port", 4) == 0) {
1132                         if (value && *value) {
1133                                 vol->port =
1134                                         simple_strtoul(value, &value, 0);
1135                         }
1136                 } else if (strnicmp(data, "rsize", 5) == 0) {
1137                         if (value && *value) {
1138                                 vol->rsize =
1139                                         simple_strtoul(value, &value, 0);
1140                         }
1141                 } else if (strnicmp(data, "wsize", 5) == 0) {
1142                         if (value && *value) {
1143                                 vol->wsize =
1144                                         simple_strtoul(value, &value, 0);
1145                         }
1146                 } else if (strnicmp(data, "sockopt", 5) == 0) {
1147                         if (!value || !*value) {
1148                                 cERROR(1, "no socket option specified");
1149                                 continue;
1150                         } else if (strnicmp(value, "TCP_NODELAY", 11) == 0) {
1151                                 vol->sockopt_tcp_nodelay = 1;
1152                         }
1153                 } else if (strnicmp(data, "netbiosname", 4) == 0) {
1154                         if (!value || !*value || (*value == ' ')) {
1155                                 cFYI(1, "invalid (empty) netbiosname");
1156                         } else {
1157                                 memset(vol->source_rfc1001_name, 0x20,
1158                                         RFC1001_NAME_LEN);
1159                                 /*
1160                                  * FIXME: are there cases in which a comma can
1161                                  * be valid in workstation netbios name (and
1162                                  * need special handling)?
1163                                  */
1164                                 for (i = 0; i < RFC1001_NAME_LEN; i++) {
1165                                         /* don't ucase netbiosname for user */
1166                                         if (value[i] == 0)
1167                                                 break;
1168                                         vol->source_rfc1001_name[i] = value[i];
1169                                 }
1170                                 /* The string has 16th byte zero still from
1171                                 set at top of the function  */
1172                                 if (i == RFC1001_NAME_LEN && value[i] != 0)
1173                                         printk(KERN_WARNING "CIFS: netbiosname"
1174                                                 " longer than 15 truncated.\n");
1175                         }
1176                 } else if (strnicmp(data, "servern", 7) == 0) {
1177                         /* servernetbiosname specified override *SMBSERVER */
1178                         if (!value || !*value || (*value == ' ')) {
1179                                 cFYI(1, "empty server netbiosname specified");
1180                         } else {
1181                                 /* last byte, type, is 0x20 for servr type */
1182                                 memset(vol->target_rfc1001_name, 0x20,
1183                                         RFC1001_NAME_LEN_WITH_NULL);
1184
1185                                 for (i = 0; i < 15; i++) {
1186                                 /* BB are there cases in which a comma can be
1187                                    valid in this workstation netbios name
1188                                    (and need special handling)? */
1189
1190                                 /* user or mount helper must uppercase
1191                                    the netbiosname */
1192                                         if (value[i] == 0)
1193                                                 break;
1194                                         else
1195                                                 vol->target_rfc1001_name[i] =
1196                                                                 value[i];
1197                                 }
1198                                 /* The string has 16th byte zero still from
1199                                    set at top of the function  */
1200                                 if (i == RFC1001_NAME_LEN && value[i] != 0)
1201                                         printk(KERN_WARNING "CIFS: server net"
1202                                         "biosname longer than 15 truncated.\n");
1203                         }
1204                 } else if (strnicmp(data, "actimeo", 7) == 0) {
1205                         if (value && *value) {
1206                                 vol->actimeo = HZ * simple_strtoul(value,
1207                                                                    &value, 0);
1208                                 if (vol->actimeo > CIFS_MAX_ACTIMEO) {
1209                                         cERROR(1, "CIFS: attribute cache"
1210                                                         "timeout too large");
1211                                         return 1;
1212                                 }
1213                         }
1214                 } else if (strnicmp(data, "credentials", 4) == 0) {
1215                         /* ignore */
1216                 } else if (strnicmp(data, "version", 3) == 0) {
1217                         /* ignore */
1218                 } else if (strnicmp(data, "guest", 5) == 0) {
1219                         /* ignore */
1220                 } else if (strnicmp(data, "rw", 2) == 0) {
1221                         /* ignore */
1222                 } else if (strnicmp(data, "ro", 2) == 0) {
1223                         /* ignore */
1224                 } else if (strnicmp(data, "noblocksend", 11) == 0) {
1225                         vol->noblocksnd = 1;
1226                 } else if (strnicmp(data, "noautotune", 10) == 0) {
1227                         vol->noautotune = 1;
1228                 } else if ((strnicmp(data, "suid", 4) == 0) ||
1229                                    (strnicmp(data, "nosuid", 6) == 0) ||
1230                                    (strnicmp(data, "exec", 4) == 0) ||
1231                                    (strnicmp(data, "noexec", 6) == 0) ||
1232                                    (strnicmp(data, "nodev", 5) == 0) ||
1233                                    (strnicmp(data, "noauto", 6) == 0) ||
1234                                    (strnicmp(data, "dev", 3) == 0)) {
1235                         /*  The mount tool or mount.cifs helper (if present)
1236                             uses these opts to set flags, and the flags are read
1237                             by the kernel vfs layer before we get here (ie
1238                             before read super) so there is no point trying to
1239                             parse these options again and set anything and it
1240                             is ok to just ignore them */
1241                         continue;
1242                 } else if (strnicmp(data, "hard", 4) == 0) {
1243                         vol->retry = 1;
1244                 } else if (strnicmp(data, "soft", 4) == 0) {
1245                         vol->retry = 0;
1246                 } else if (strnicmp(data, "perm", 4) == 0) {
1247                         vol->noperm = 0;
1248                 } else if (strnicmp(data, "noperm", 6) == 0) {
1249                         vol->noperm = 1;
1250                 } else if (strnicmp(data, "mapchars", 8) == 0) {
1251                         vol->remap = 1;
1252                 } else if (strnicmp(data, "nomapchars", 10) == 0) {
1253                         vol->remap = 0;
1254                 } else if (strnicmp(data, "sfu", 3) == 0) {
1255                         vol->sfu_emul = 1;
1256                 } else if (strnicmp(data, "nosfu", 5) == 0) {
1257                         vol->sfu_emul = 0;
1258                 } else if (strnicmp(data, "nodfs", 5) == 0) {
1259                         vol->nodfs = 1;
1260                 } else if (strnicmp(data, "posixpaths", 10) == 0) {
1261                         vol->posix_paths = 1;
1262                 } else if (strnicmp(data, "noposixpaths", 12) == 0) {
1263                         vol->posix_paths = 0;
1264                 } else if (strnicmp(data, "nounix", 6) == 0) {
1265                         vol->no_linux_ext = 1;
1266                 } else if (strnicmp(data, "nolinux", 7) == 0) {
1267                         vol->no_linux_ext = 1;
1268                 } else if ((strnicmp(data, "nocase", 6) == 0) ||
1269                            (strnicmp(data, "ignorecase", 10)  == 0)) {
1270                         vol->nocase = 1;
1271                 } else if (strnicmp(data, "mand", 4) == 0) {
1272                         /* ignore */
1273                 } else if (strnicmp(data, "nomand", 6) == 0) {
1274                         /* ignore */
1275                 } else if (strnicmp(data, "_netdev", 7) == 0) {
1276                         /* ignore */
1277                 } else if (strnicmp(data, "brl", 3) == 0) {
1278                         vol->nobrl =  0;
1279                 } else if ((strnicmp(data, "nobrl", 5) == 0) ||
1280                            (strnicmp(data, "nolock", 6) == 0)) {
1281                         vol->nobrl =  1;
1282                         /* turn off mandatory locking in mode
1283                         if remote locking is turned off since the
1284                         local vfs will do advisory */
1285                         if (vol->file_mode ==
1286                                 (S_IALLUGO & ~(S_ISUID | S_IXGRP)))
1287                                 vol->file_mode = S_IALLUGO;
1288                 } else if (strnicmp(data, "forcemandatorylock", 9) == 0) {
1289                         /* will take the shorter form "forcemand" as well */
1290                         /* This mount option will force use of mandatory
1291                           (DOS/Windows style) byte range locks, instead of
1292                           using posix advisory byte range locks, even if the
1293                           Unix extensions are available and posix locks would
1294                           be supported otherwise. If Unix extensions are not
1295                           negotiated this has no effect since mandatory locks
1296                           would be used (mandatory locks is all that those
1297                           those servers support) */
1298                         vol->mand_lock = 1;
1299                 } else if (strnicmp(data, "setuids", 7) == 0) {
1300                         vol->setuids = 1;
1301                 } else if (strnicmp(data, "nosetuids", 9) == 0) {
1302                         vol->setuids = 0;
1303                 } else if (strnicmp(data, "dynperm", 7) == 0) {
1304                         vol->dynperm = true;
1305                 } else if (strnicmp(data, "nodynperm", 9) == 0) {
1306                         vol->dynperm = false;
1307                 } else if (strnicmp(data, "nohard", 6) == 0) {
1308                         vol->retry = 0;
1309                 } else if (strnicmp(data, "nosoft", 6) == 0) {
1310                         vol->retry = 1;
1311                 } else if (strnicmp(data, "nointr", 6) == 0) {
1312                         vol->intr = 0;
1313                 } else if (strnicmp(data, "intr", 4) == 0) {
1314                         vol->intr = 1;
1315                 } else if (strnicmp(data, "nostrictsync", 12) == 0) {
1316                         vol->nostrictsync = 1;
1317                 } else if (strnicmp(data, "strictsync", 10) == 0) {
1318                         vol->nostrictsync = 0;
1319                 } else if (strnicmp(data, "serverino", 7) == 0) {
1320                         vol->server_ino = 1;
1321                 } else if (strnicmp(data, "noserverino", 9) == 0) {
1322                         vol->server_ino = 0;
1323                 } else if (strnicmp(data, "cifsacl", 7) == 0) {
1324                         vol->cifs_acl = 1;
1325                 } else if (strnicmp(data, "nocifsacl", 9) == 0) {
1326                         vol->cifs_acl = 0;
1327                 } else if (strnicmp(data, "acl", 3) == 0) {
1328                         vol->no_psx_acl = 0;
1329                 } else if (strnicmp(data, "noacl", 5) == 0) {
1330                         vol->no_psx_acl = 1;
1331                 } else if (strnicmp(data, "locallease", 6) == 0) {
1332                         vol->local_lease = 1;
1333                 } else if (strnicmp(data, "sign", 4) == 0) {
1334                         vol->secFlg |= CIFSSEC_MUST_SIGN;
1335                 } else if (strnicmp(data, "seal", 4) == 0) {
1336                         /* we do not do the following in secFlags because seal
1337                            is a per tree connection (mount) not a per socket
1338                            or per-smb connection option in the protocol */
1339                         /* vol->secFlg |= CIFSSEC_MUST_SEAL; */
1340                         vol->seal = 1;
1341                 } else if (strnicmp(data, "direct", 6) == 0) {
1342                         vol->direct_io = 1;
1343                 } else if (strnicmp(data, "forcedirectio", 13) == 0) {
1344                         vol->direct_io = 1;
1345                 } else if (strnicmp(data, "strictcache", 11) == 0) {
1346                         vol->strict_io = 1;
1347                 } else if (strnicmp(data, "noac", 4) == 0) {
1348                         printk(KERN_WARNING "CIFS: Mount option noac not "
1349                                 "supported. Instead set "
1350                                 "/proc/fs/cifs/LookupCacheEnabled to 0\n");
1351                 } else if (strnicmp(data, "fsc", 3) == 0) {
1352 #ifndef CONFIG_CIFS_FSCACHE
1353                         cERROR(1, "FS-Cache support needs CONFIG_CIFS_FSCACHE"
1354                                   "kernel config option set");
1355                         return 1;
1356 #endif
1357                         vol->fsc = true;
1358                 } else if (strnicmp(data, "mfsymlinks", 10) == 0) {
1359                         vol->mfsymlinks = true;
1360                 } else if (strnicmp(data, "multiuser", 8) == 0) {
1361                         vol->multiuser = true;
1362                 } else
1363                         printk(KERN_WARNING "CIFS: Unknown mount option %s\n",
1364                                                 data);
1365         }
1366         if (vol->UNC == NULL) {
1367                 if (devname == NULL) {
1368                         printk(KERN_WARNING "CIFS: Missing UNC name for mount "
1369                                                 "target\n");
1370                         return 1;
1371                 }
1372                 if ((temp_len = strnlen(devname, 300)) < 300) {
1373                         vol->UNC = kmalloc(temp_len+1, GFP_KERNEL);
1374                         if (vol->UNC == NULL)
1375                                 return 1;
1376                         strcpy(vol->UNC, devname);
1377                         if (strncmp(vol->UNC, "//", 2) == 0) {
1378                                 vol->UNC[0] = '\\';
1379                                 vol->UNC[1] = '\\';
1380                         } else if (strncmp(vol->UNC, "\\\\", 2) != 0) {
1381                                 printk(KERN_WARNING "CIFS: UNC Path does not "
1382                                                     "begin with // or \\\\ \n");
1383                                 return 1;
1384                         }
1385                         value = strpbrk(vol->UNC+2, "/\\");
1386                         if (value)
1387                                 *value = '\\';
1388                 } else {
1389                         printk(KERN_WARNING "CIFS: UNC name too long\n");
1390                         return 1;
1391                 }
1392         }
1393
1394         if (vol->multiuser && !(vol->secFlg & CIFSSEC_MAY_KRB5)) {
1395                 cERROR(1, "Multiuser mounts currently require krb5 "
1396                           "authentication!");
1397                 return 1;
1398         }
1399
1400         if (vol->UNCip == NULL)
1401                 vol->UNCip = &vol->UNC[2];
1402
1403         if (uid_specified)
1404                 vol->override_uid = override_uid;
1405         else if (override_uid == 1)
1406                 printk(KERN_NOTICE "CIFS: ignoring forceuid mount option "
1407                                    "specified with no uid= option.\n");
1408
1409         if (gid_specified)
1410                 vol->override_gid = override_gid;
1411         else if (override_gid == 1)
1412                 printk(KERN_NOTICE "CIFS: ignoring forcegid mount option "
1413                                    "specified with no gid= option.\n");
1414
1415         return 0;
1416 }
1417
1418 /** Returns true if srcaddr isn't specified and rhs isn't
1419  * specified, or if srcaddr is specified and
1420  * matches the IP address of the rhs argument.
1421  */
1422 static bool
1423 srcip_matches(struct sockaddr *srcaddr, struct sockaddr *rhs)
1424 {
1425         switch (srcaddr->sa_family) {
1426         case AF_UNSPEC:
1427                 return (rhs->sa_family == AF_UNSPEC);
1428         case AF_INET: {
1429                 struct sockaddr_in *saddr4 = (struct sockaddr_in *)srcaddr;
1430                 struct sockaddr_in *vaddr4 = (struct sockaddr_in *)rhs;
1431                 return (saddr4->sin_addr.s_addr == vaddr4->sin_addr.s_addr);
1432         }
1433         case AF_INET6: {
1434                 struct sockaddr_in6 *saddr6 = (struct sockaddr_in6 *)srcaddr;
1435                 struct sockaddr_in6 *vaddr6 = (struct sockaddr_in6 *)&rhs;
1436                 return ipv6_addr_equal(&saddr6->sin6_addr, &vaddr6->sin6_addr);
1437         }
1438         default:
1439                 WARN_ON(1);
1440                 return false; /* don't expect to be here */
1441         }
1442 }
1443
1444 /*
1445  * If no port is specified in addr structure, we try to match with 445 port
1446  * and if it fails - with 139 ports. It should be called only if address
1447  * families of server and addr are equal.
1448  */
1449 static bool
1450 match_port(struct TCP_Server_Info *server, struct sockaddr *addr)
1451 {
1452         unsigned short int port, *sport;
1453
1454         switch (addr->sa_family) {
1455         case AF_INET:
1456                 sport = &((struct sockaddr_in *) &server->dstaddr)->sin_port;
1457                 port = ((struct sockaddr_in *) addr)->sin_port;
1458                 break;
1459         case AF_INET6:
1460                 sport = &((struct sockaddr_in6 *) &server->dstaddr)->sin6_port;
1461                 port = ((struct sockaddr_in6 *) addr)->sin6_port;
1462                 break;
1463         default:
1464                 WARN_ON(1);
1465                 return false;
1466         }
1467
1468         if (!port) {
1469                 port = htons(CIFS_PORT);
1470                 if (port == *sport)
1471                         return true;
1472
1473                 port = htons(RFC1001_PORT);
1474         }
1475
1476         return port == *sport;
1477 }
1478
1479 static bool
1480 match_address(struct TCP_Server_Info *server, struct sockaddr *addr,
1481               struct sockaddr *srcaddr)
1482 {
1483         switch (addr->sa_family) {
1484         case AF_INET: {
1485                 struct sockaddr_in *addr4 = (struct sockaddr_in *)addr;
1486                 struct sockaddr_in *srv_addr4 =
1487                                         (struct sockaddr_in *)&server->dstaddr;
1488
1489                 if (addr4->sin_addr.s_addr != srv_addr4->sin_addr.s_addr)
1490                         return false;
1491                 break;
1492         }
1493         case AF_INET6: {
1494                 struct sockaddr_in6 *addr6 = (struct sockaddr_in6 *)addr;
1495                 struct sockaddr_in6 *srv_addr6 =
1496                                         (struct sockaddr_in6 *)&server->dstaddr;
1497
1498                 if (!ipv6_addr_equal(&addr6->sin6_addr,
1499                                      &srv_addr6->sin6_addr))
1500                         return false;
1501                 if (addr6->sin6_scope_id != srv_addr6->sin6_scope_id)
1502                         return false;
1503                 break;
1504         }
1505         default:
1506                 WARN_ON(1);
1507                 return false; /* don't expect to be here */
1508         }
1509
1510         if (!srcip_matches(srcaddr, (struct sockaddr *)&server->srcaddr))
1511                 return false;
1512
1513         return true;
1514 }
1515
1516 static bool
1517 match_security(struct TCP_Server_Info *server, struct smb_vol *vol)
1518 {
1519         unsigned int secFlags;
1520
1521         if (vol->secFlg & (~(CIFSSEC_MUST_SIGN | CIFSSEC_MUST_SEAL)))
1522                 secFlags = vol->secFlg;
1523         else
1524                 secFlags = global_secflags | vol->secFlg;
1525
1526         switch (server->secType) {
1527         case LANMAN:
1528                 if (!(secFlags & (CIFSSEC_MAY_LANMAN|CIFSSEC_MAY_PLNTXT)))
1529                         return false;
1530                 break;
1531         case NTLMv2:
1532                 if (!(secFlags & CIFSSEC_MAY_NTLMV2))
1533                         return false;
1534                 break;
1535         case NTLM:
1536                 if (!(secFlags & CIFSSEC_MAY_NTLM))
1537                         return false;
1538                 break;
1539         case Kerberos:
1540                 if (!(secFlags & CIFSSEC_MAY_KRB5))
1541                         return false;
1542                 break;
1543         case RawNTLMSSP:
1544                 if (!(secFlags & CIFSSEC_MAY_NTLMSSP))
1545                         return false;
1546                 break;
1547         default:
1548                 /* shouldn't happen */
1549                 return false;
1550         }
1551
1552         /* now check if signing mode is acceptible */
1553         if ((secFlags & CIFSSEC_MAY_SIGN) == 0 &&
1554             (server->secMode & SECMODE_SIGN_REQUIRED))
1555                         return false;
1556         else if (((secFlags & CIFSSEC_MUST_SIGN) == CIFSSEC_MUST_SIGN) &&
1557                  (server->secMode &
1558                   (SECMODE_SIGN_ENABLED|SECMODE_SIGN_REQUIRED)) == 0)
1559                         return false;
1560
1561         return true;
1562 }
1563
1564 static struct TCP_Server_Info *
1565 cifs_find_tcp_session(struct sockaddr *addr, struct smb_vol *vol)
1566 {
1567         struct TCP_Server_Info *server;
1568
1569         spin_lock(&cifs_tcp_ses_lock);
1570         list_for_each_entry(server, &cifs_tcp_ses_list, tcp_ses_list) {
1571                 if (!net_eq(cifs_net_ns(server), current->nsproxy->net_ns))
1572                         continue;
1573
1574                 if (!match_address(server, addr,
1575                                    (struct sockaddr *)&vol->srcaddr))
1576                         continue;
1577
1578                 if (!match_port(server, addr))
1579                         continue;
1580
1581                 if (!match_security(server, vol))
1582                         continue;
1583
1584                 ++server->srv_count;
1585                 spin_unlock(&cifs_tcp_ses_lock);
1586                 cFYI(1, "Existing tcp session with server found");
1587                 return server;
1588         }
1589         spin_unlock(&cifs_tcp_ses_lock);
1590         return NULL;
1591 }
1592
1593 static void
1594 cifs_put_tcp_session(struct TCP_Server_Info *server)
1595 {
1596         struct task_struct *task;
1597
1598         spin_lock(&cifs_tcp_ses_lock);
1599         if (--server->srv_count > 0) {
1600                 spin_unlock(&cifs_tcp_ses_lock);
1601                 return;
1602         }
1603
1604         put_net(cifs_net_ns(server));
1605
1606         list_del_init(&server->tcp_ses_list);
1607         spin_unlock(&cifs_tcp_ses_lock);
1608
1609         cancel_delayed_work_sync(&server->echo);
1610
1611         spin_lock(&GlobalMid_Lock);
1612         server->tcpStatus = CifsExiting;
1613         spin_unlock(&GlobalMid_Lock);
1614
1615         cifs_crypto_shash_release(server);
1616         cifs_fscache_release_client_cookie(server);
1617
1618         kfree(server->session_key.response);
1619         server->session_key.response = NULL;
1620         server->session_key.len = 0;
1621
1622         task = xchg(&server->tsk, NULL);
1623         if (task)
1624                 force_sig(SIGKILL, task);
1625 }
1626
1627 static struct TCP_Server_Info *
1628 cifs_get_tcp_session(struct smb_vol *volume_info)
1629 {
1630         struct TCP_Server_Info *tcp_ses = NULL;
1631         struct sockaddr_storage addr;
1632         struct sockaddr_in *sin_server = (struct sockaddr_in *) &addr;
1633         struct sockaddr_in6 *sin_server6 = (struct sockaddr_in6 *) &addr;
1634         int rc;
1635
1636         memset(&addr, 0, sizeof(struct sockaddr_storage));
1637
1638         cFYI(1, "UNC: %s ip: %s", volume_info->UNC, volume_info->UNCip);
1639
1640         if (volume_info->UNCip && volume_info->UNC) {
1641                 rc = cifs_fill_sockaddr((struct sockaddr *)&addr,
1642                                         volume_info->UNCip,
1643                                         strlen(volume_info->UNCip),
1644                                         volume_info->port);
1645                 if (!rc) {
1646                         /* we failed translating address */
1647                         rc = -EINVAL;
1648                         goto out_err;
1649                 }
1650         } else if (volume_info->UNCip) {
1651                 /* BB using ip addr as tcp_ses name to connect to the
1652                    DFS root below */
1653                 cERROR(1, "Connecting to DFS root not implemented yet");
1654                 rc = -EINVAL;
1655                 goto out_err;
1656         } else /* which tcp_sess DFS root would we conect to */ {
1657                 cERROR(1, "CIFS mount error: No UNC path (e.g. -o "
1658                         "unc=//192.168.1.100/public) specified");
1659                 rc = -EINVAL;
1660                 goto out_err;
1661         }
1662
1663         /* see if we already have a matching tcp_ses */
1664         tcp_ses = cifs_find_tcp_session((struct sockaddr *)&addr, volume_info);
1665         if (tcp_ses)
1666                 return tcp_ses;
1667
1668         tcp_ses = kzalloc(sizeof(struct TCP_Server_Info), GFP_KERNEL);
1669         if (!tcp_ses) {
1670                 rc = -ENOMEM;
1671                 goto out_err;
1672         }
1673
1674         rc = cifs_crypto_shash_allocate(tcp_ses);
1675         if (rc) {
1676                 cERROR(1, "could not setup hash structures rc %d", rc);
1677                 goto out_err;
1678         }
1679
1680         cifs_set_net_ns(tcp_ses, get_net(current->nsproxy->net_ns));
1681         tcp_ses->hostname = extract_hostname(volume_info->UNC);
1682         if (IS_ERR(tcp_ses->hostname)) {
1683                 rc = PTR_ERR(tcp_ses->hostname);
1684                 goto out_err_crypto_release;
1685         }
1686
1687         tcp_ses->noblocksnd = volume_info->noblocksnd;
1688         tcp_ses->noautotune = volume_info->noautotune;
1689         tcp_ses->tcp_nodelay = volume_info->sockopt_tcp_nodelay;
1690         atomic_set(&tcp_ses->inFlight, 0);
1691         init_waitqueue_head(&tcp_ses->response_q);
1692         init_waitqueue_head(&tcp_ses->request_q);
1693         INIT_LIST_HEAD(&tcp_ses->pending_mid_q);
1694         mutex_init(&tcp_ses->srv_mutex);
1695         memcpy(tcp_ses->workstation_RFC1001_name,
1696                 volume_info->source_rfc1001_name, RFC1001_NAME_LEN_WITH_NULL);
1697         memcpy(tcp_ses->server_RFC1001_name,
1698                 volume_info->target_rfc1001_name, RFC1001_NAME_LEN_WITH_NULL);
1699         tcp_ses->session_estab = false;
1700         tcp_ses->sequence_number = 0;
1701         tcp_ses->lstrp = jiffies;
1702         INIT_LIST_HEAD(&tcp_ses->tcp_ses_list);
1703         INIT_LIST_HEAD(&tcp_ses->smb_ses_list);
1704         INIT_DELAYED_WORK(&tcp_ses->echo, cifs_echo_request);
1705
1706         /*
1707          * at this point we are the only ones with the pointer
1708          * to the struct since the kernel thread not created yet
1709          * no need to spinlock this init of tcpStatus or srv_count
1710          */
1711         tcp_ses->tcpStatus = CifsNew;
1712         memcpy(&tcp_ses->srcaddr, &volume_info->srcaddr,
1713                sizeof(tcp_ses->srcaddr));
1714         ++tcp_ses->srv_count;
1715
1716         if (addr.ss_family == AF_INET6) {
1717                 cFYI(1, "attempting ipv6 connect");
1718                 /* BB should we allow ipv6 on port 139? */
1719                 /* other OS never observed in Wild doing 139 with v6 */
1720                 memcpy(&tcp_ses->dstaddr, sin_server6,
1721                        sizeof(struct sockaddr_in6));
1722         } else
1723                 memcpy(&tcp_ses->dstaddr, sin_server,
1724                        sizeof(struct sockaddr_in));
1725
1726         rc = ip_connect(tcp_ses);
1727         if (rc < 0) {
1728                 cERROR(1, "Error connecting to socket. Aborting operation");
1729                 goto out_err_crypto_release;
1730         }
1731
1732         /*
1733          * since we're in a cifs function already, we know that
1734          * this will succeed. No need for try_module_get().
1735          */
1736         __module_get(THIS_MODULE);
1737         tcp_ses->tsk = kthread_run((void *)(void *)cifs_demultiplex_thread,
1738                                   tcp_ses, "cifsd");
1739         if (IS_ERR(tcp_ses->tsk)) {
1740                 rc = PTR_ERR(tcp_ses->tsk);
1741                 cERROR(1, "error %d create cifsd thread", rc);
1742                 module_put(THIS_MODULE);
1743                 goto out_err_crypto_release;
1744         }
1745
1746         /* thread spawned, put it on the list */
1747         spin_lock(&cifs_tcp_ses_lock);
1748         list_add(&tcp_ses->tcp_ses_list, &cifs_tcp_ses_list);
1749         spin_unlock(&cifs_tcp_ses_lock);
1750
1751         cifs_fscache_get_client_cookie(tcp_ses);
1752
1753         /* queue echo request delayed work */
1754         queue_delayed_work(system_nrt_wq, &tcp_ses->echo, SMB_ECHO_INTERVAL);
1755
1756         return tcp_ses;
1757
1758 out_err_crypto_release:
1759         cifs_crypto_shash_release(tcp_ses);
1760
1761         put_net(cifs_net_ns(tcp_ses));
1762
1763 out_err:
1764         if (tcp_ses) {
1765                 if (!IS_ERR(tcp_ses->hostname))
1766                         kfree(tcp_ses->hostname);
1767                 if (tcp_ses->ssocket)
1768                         sock_release(tcp_ses->ssocket);
1769                 kfree(tcp_ses);
1770         }
1771         return ERR_PTR(rc);
1772 }
1773
1774 static struct cifsSesInfo *
1775 cifs_find_smb_ses(struct TCP_Server_Info *server, struct smb_vol *vol)
1776 {
1777         struct cifsSesInfo *ses;
1778
1779         spin_lock(&cifs_tcp_ses_lock);
1780         list_for_each_entry(ses, &server->smb_ses_list, smb_ses_list) {
1781                 switch (server->secType) {
1782                 case Kerberos:
1783                         if (vol->cred_uid != ses->cred_uid)
1784                                 continue;
1785                         break;
1786                 default:
1787                         /* anything else takes username/password */
1788                         if (strncmp(ses->userName, vol->username,
1789                                     MAX_USERNAME_SIZE))
1790                                 continue;
1791                         if (strlen(vol->username) != 0 &&
1792                             ses->password != NULL &&
1793                             strncmp(ses->password,
1794                                     vol->password ? vol->password : "",
1795                                     MAX_PASSWORD_SIZE))
1796                                 continue;
1797                 }
1798                 ++ses->ses_count;
1799                 spin_unlock(&cifs_tcp_ses_lock);
1800                 return ses;
1801         }
1802         spin_unlock(&cifs_tcp_ses_lock);
1803         return NULL;
1804 }
1805
1806 static void
1807 cifs_put_smb_ses(struct cifsSesInfo *ses)
1808 {
1809         int xid;
1810         struct TCP_Server_Info *server = ses->server;
1811
1812         cFYI(1, "%s: ses_count=%d\n", __func__, ses->ses_count);
1813         spin_lock(&cifs_tcp_ses_lock);
1814         if (--ses->ses_count > 0) {
1815                 spin_unlock(&cifs_tcp_ses_lock);
1816                 return;
1817         }
1818
1819         list_del_init(&ses->smb_ses_list);
1820         spin_unlock(&cifs_tcp_ses_lock);
1821
1822         if (ses->status == CifsGood) {
1823                 xid = GetXid();
1824                 CIFSSMBLogoff(xid, ses);
1825                 _FreeXid(xid);
1826         }
1827         sesInfoFree(ses);
1828         cifs_put_tcp_session(server);
1829 }
1830
1831 static struct cifsSesInfo *
1832 cifs_get_smb_ses(struct TCP_Server_Info *server, struct smb_vol *volume_info)
1833 {
1834         int rc = -ENOMEM, xid;
1835         struct cifsSesInfo *ses;
1836         struct sockaddr_in *addr = (struct sockaddr_in *)&server->dstaddr;
1837         struct sockaddr_in6 *addr6 = (struct sockaddr_in6 *)&server->dstaddr;
1838
1839         xid = GetXid();
1840
1841         ses = cifs_find_smb_ses(server, volume_info);
1842         if (ses) {
1843                 cFYI(1, "Existing smb sess found (status=%d)", ses->status);
1844
1845                 mutex_lock(&ses->session_mutex);
1846                 rc = cifs_negotiate_protocol(xid, ses);
1847                 if (rc) {
1848                         mutex_unlock(&ses->session_mutex);
1849                         /* problem -- put our ses reference */
1850                         cifs_put_smb_ses(ses);
1851                         FreeXid(xid);
1852                         return ERR_PTR(rc);
1853                 }
1854                 if (ses->need_reconnect) {
1855                         cFYI(1, "Session needs reconnect");
1856                         rc = cifs_setup_session(xid, ses,
1857                                                 volume_info->local_nls);
1858                         if (rc) {
1859                                 mutex_unlock(&ses->session_mutex);
1860                                 /* problem -- put our reference */
1861                                 cifs_put_smb_ses(ses);
1862                                 FreeXid(xid);
1863                                 return ERR_PTR(rc);
1864                         }
1865                 }
1866                 mutex_unlock(&ses->session_mutex);
1867
1868                 /* existing SMB ses has a server reference already */
1869                 cifs_put_tcp_session(server);
1870                 FreeXid(xid);
1871                 return ses;
1872         }
1873
1874         cFYI(1, "Existing smb sess not found");
1875         ses = sesInfoAlloc();
1876         if (ses == NULL)
1877                 goto get_ses_fail;
1878
1879         /* new SMB session uses our server ref */
1880         ses->server = server;
1881         if (server->dstaddr.ss_family == AF_INET6)
1882                 sprintf(ses->serverName, "%pI6", &addr6->sin6_addr);
1883         else
1884                 sprintf(ses->serverName, "%pI4", &addr->sin_addr);
1885
1886         if (volume_info->username)
1887                 strncpy(ses->userName, volume_info->username,
1888                         MAX_USERNAME_SIZE);
1889
1890         /* volume_info->password freed at unmount */
1891         if (volume_info->password) {
1892                 ses->password = kstrdup(volume_info->password, GFP_KERNEL);
1893                 if (!ses->password)
1894                         goto get_ses_fail;
1895         }
1896         if (volume_info->domainname) {
1897                 ses->domainName = kstrdup(volume_info->domainname, GFP_KERNEL);
1898                 if (!ses->domainName)
1899                         goto get_ses_fail;
1900         }
1901         ses->cred_uid = volume_info->cred_uid;
1902         ses->linux_uid = volume_info->linux_uid;
1903         ses->overrideSecFlg = volume_info->secFlg;
1904
1905         mutex_lock(&ses->session_mutex);
1906         rc = cifs_negotiate_protocol(xid, ses);
1907         if (!rc)
1908                 rc = cifs_setup_session(xid, ses, volume_info->local_nls);
1909         mutex_unlock(&ses->session_mutex);
1910         if (rc)
1911                 goto get_ses_fail;
1912
1913         /* success, put it on the list */
1914         spin_lock(&cifs_tcp_ses_lock);
1915         list_add(&ses->smb_ses_list, &server->smb_ses_list);
1916         spin_unlock(&cifs_tcp_ses_lock);
1917
1918         FreeXid(xid);
1919         return ses;
1920
1921 get_ses_fail:
1922         sesInfoFree(ses);
1923         FreeXid(xid);
1924         return ERR_PTR(rc);
1925 }
1926
1927 static struct cifsTconInfo *
1928 cifs_find_tcon(struct cifsSesInfo *ses, const char *unc)
1929 {
1930         struct list_head *tmp;
1931         struct cifsTconInfo *tcon;
1932
1933         spin_lock(&cifs_tcp_ses_lock);
1934         list_for_each(tmp, &ses->tcon_list) {
1935                 tcon = list_entry(tmp, struct cifsTconInfo, tcon_list);
1936                 if (tcon->tidStatus == CifsExiting)
1937                         continue;
1938                 if (strncmp(tcon->treeName, unc, MAX_TREE_SIZE))
1939                         continue;
1940
1941                 ++tcon->tc_count;
1942                 spin_unlock(&cifs_tcp_ses_lock);
1943                 return tcon;
1944         }
1945         spin_unlock(&cifs_tcp_ses_lock);
1946         return NULL;
1947 }
1948
1949 static void
1950 cifs_put_tcon(struct cifsTconInfo *tcon)
1951 {
1952         int xid;
1953         struct cifsSesInfo *ses = tcon->ses;
1954
1955         cFYI(1, "%s: tc_count=%d\n", __func__, tcon->tc_count);
1956         spin_lock(&cifs_tcp_ses_lock);
1957         if (--tcon->tc_count > 0) {
1958                 spin_unlock(&cifs_tcp_ses_lock);
1959                 return;
1960         }
1961
1962         list_del_init(&tcon->tcon_list);
1963         spin_unlock(&cifs_tcp_ses_lock);
1964
1965         xid = GetXid();
1966         CIFSSMBTDis(xid, tcon);
1967         _FreeXid(xid);
1968
1969         cifs_fscache_release_super_cookie(tcon);
1970         tconInfoFree(tcon);
1971         cifs_put_smb_ses(ses);
1972 }
1973
1974 static struct cifsTconInfo *
1975 cifs_get_tcon(struct cifsSesInfo *ses, struct smb_vol *volume_info)
1976 {
1977         int rc, xid;
1978         struct cifsTconInfo *tcon;
1979
1980         tcon = cifs_find_tcon(ses, volume_info->UNC);
1981         if (tcon) {
1982                 cFYI(1, "Found match on UNC path");
1983                 /* existing tcon already has a reference */
1984                 cifs_put_smb_ses(ses);
1985                 if (tcon->seal != volume_info->seal)
1986                         cERROR(1, "transport encryption setting "
1987                                    "conflicts with existing tid");
1988                 return tcon;
1989         }
1990
1991         tcon = tconInfoAlloc();
1992         if (tcon == NULL) {
1993                 rc = -ENOMEM;
1994                 goto out_fail;
1995         }
1996
1997         tcon->ses = ses;
1998         if (volume_info->password) {
1999                 tcon->password = kstrdup(volume_info->password, GFP_KERNEL);
2000                 if (!tcon->password) {
2001                         rc = -ENOMEM;
2002                         goto out_fail;
2003                 }
2004         }
2005
2006         if (strchr(volume_info->UNC + 3, '\\') == NULL
2007             && strchr(volume_info->UNC + 3, '/') == NULL) {
2008                 cERROR(1, "Missing share name");
2009                 rc = -ENODEV;
2010                 goto out_fail;
2011         }
2012
2013         /* BB Do we need to wrap session_mutex around
2014          * this TCon call and Unix SetFS as
2015          * we do on SessSetup and reconnect? */
2016         xid = GetXid();
2017         rc = CIFSTCon(xid, ses, volume_info->UNC, tcon, volume_info->local_nls);
2018         FreeXid(xid);
2019         cFYI(1, "CIFS Tcon rc = %d", rc);
2020         if (rc)
2021                 goto out_fail;
2022
2023         if (volume_info->nodfs) {
2024                 tcon->Flags &= ~SMB_SHARE_IS_IN_DFS;
2025                 cFYI(1, "DFS disabled (%d)", tcon->Flags);
2026         }
2027         tcon->seal = volume_info->seal;
2028         /* we can have only one retry value for a connection
2029            to a share so for resources mounted more than once
2030            to the same server share the last value passed in
2031            for the retry flag is used */
2032         tcon->retry = volume_info->retry;
2033         tcon->nocase = volume_info->nocase;
2034         tcon->local_lease = volume_info->local_lease;
2035
2036         spin_lock(&cifs_tcp_ses_lock);
2037         list_add(&tcon->tcon_list, &ses->tcon_list);
2038         spin_unlock(&cifs_tcp_ses_lock);
2039
2040         cifs_fscache_get_super_cookie(tcon);
2041
2042         return tcon;
2043
2044 out_fail:
2045         tconInfoFree(tcon);
2046         return ERR_PTR(rc);
2047 }
2048
2049 void
2050 cifs_put_tlink(struct tcon_link *tlink)
2051 {
2052         if (!tlink || IS_ERR(tlink))
2053                 return;
2054
2055         if (!atomic_dec_and_test(&tlink->tl_count) ||
2056             test_bit(TCON_LINK_IN_TREE, &tlink->tl_flags)) {
2057                 tlink->tl_time = jiffies;
2058                 return;
2059         }
2060
2061         if (!IS_ERR(tlink_tcon(tlink)))
2062                 cifs_put_tcon(tlink_tcon(tlink));
2063         kfree(tlink);
2064         return;
2065 }
2066
2067 int
2068 get_dfs_path(int xid, struct cifsSesInfo *pSesInfo, const char *old_path,
2069              const struct nls_table *nls_codepage, unsigned int *pnum_referrals,
2070              struct dfs_info3_param **preferrals, int remap)
2071 {
2072         char *temp_unc;
2073         int rc = 0;
2074
2075         *pnum_referrals = 0;
2076         *preferrals = NULL;
2077
2078         if (pSesInfo->ipc_tid == 0) {
2079                 temp_unc = kmalloc(2 /* for slashes */ +
2080                         strnlen(pSesInfo->serverName,
2081                                 SERVER_NAME_LEN_WITH_NULL * 2)
2082                                  + 1 + 4 /* slash IPC$ */  + 2,
2083                                 GFP_KERNEL);
2084                 if (temp_unc == NULL)
2085                         return -ENOMEM;
2086                 temp_unc[0] = '\\';
2087                 temp_unc[1] = '\\';
2088                 strcpy(temp_unc + 2, pSesInfo->serverName);
2089                 strcpy(temp_unc + 2 + strlen(pSesInfo->serverName), "\\IPC$");
2090                 rc = CIFSTCon(xid, pSesInfo, temp_unc, NULL, nls_codepage);
2091                 cFYI(1, "CIFS Tcon rc = %d ipc_tid = %d", rc, pSesInfo->ipc_tid);
2092                 kfree(temp_unc);
2093         }
2094         if (rc == 0)
2095                 rc = CIFSGetDFSRefer(xid, pSesInfo, old_path, preferrals,
2096                                      pnum_referrals, nls_codepage, remap);
2097         /* BB map targetUNCs to dfs_info3 structures, here or
2098                 in CIFSGetDFSRefer BB */
2099
2100         return rc;
2101 }
2102
2103 #ifdef CONFIG_DEBUG_LOCK_ALLOC
2104 static struct lock_class_key cifs_key[2];
2105 static struct lock_class_key cifs_slock_key[2];
2106
2107 static inline void
2108 cifs_reclassify_socket4(struct socket *sock)
2109 {
2110         struct sock *sk = sock->sk;
2111         BUG_ON(sock_owned_by_user(sk));
2112         sock_lock_init_class_and_name(sk, "slock-AF_INET-CIFS",
2113                 &cifs_slock_key[0], "sk_lock-AF_INET-CIFS", &cifs_key[0]);
2114 }
2115
2116 static inline void
2117 cifs_reclassify_socket6(struct socket *sock)
2118 {
2119         struct sock *sk = sock->sk;
2120         BUG_ON(sock_owned_by_user(sk));
2121         sock_lock_init_class_and_name(sk, "slock-AF_INET6-CIFS",
2122                 &cifs_slock_key[1], "sk_lock-AF_INET6-CIFS", &cifs_key[1]);
2123 }
2124 #else
2125 static inline void
2126 cifs_reclassify_socket4(struct socket *sock)
2127 {
2128 }
2129
2130 static inline void
2131 cifs_reclassify_socket6(struct socket *sock)
2132 {
2133 }
2134 #endif
2135
2136 /* See RFC1001 section 14 on representation of Netbios names */
2137 static void rfc1002mangle(char *target, char *source, unsigned int length)
2138 {
2139         unsigned int i, j;
2140
2141         for (i = 0, j = 0; i < (length); i++) {
2142                 /* mask a nibble at a time and encode */
2143                 target[j] = 'A' + (0x0F & (source[i] >> 4));
2144                 target[j+1] = 'A' + (0x0F & source[i]);
2145                 j += 2;
2146         }
2147
2148 }
2149
2150 static int
2151 bind_socket(struct TCP_Server_Info *server)
2152 {
2153         int rc = 0;
2154         if (server->srcaddr.ss_family != AF_UNSPEC) {
2155                 /* Bind to the specified local IP address */
2156                 struct socket *socket = server->ssocket;
2157                 rc = socket->ops->bind(socket,
2158                                        (struct sockaddr *) &server->srcaddr,
2159                                        sizeof(server->srcaddr));
2160                 if (rc < 0) {
2161                         struct sockaddr_in *saddr4;
2162                         struct sockaddr_in6 *saddr6;
2163                         saddr4 = (struct sockaddr_in *)&server->srcaddr;
2164                         saddr6 = (struct sockaddr_in6 *)&server->srcaddr;
2165                         if (saddr6->sin6_family == AF_INET6)
2166                                 cERROR(1, "cifs: "
2167                                        "Failed to bind to: %pI6c, error: %d\n",
2168                                        &saddr6->sin6_addr, rc);
2169                         else
2170                                 cERROR(1, "cifs: "
2171                                        "Failed to bind to: %pI4, error: %d\n",
2172                                        &saddr4->sin_addr.s_addr, rc);
2173                 }
2174         }
2175         return rc;
2176 }
2177
2178 static int
2179 ip_rfc1001_connect(struct TCP_Server_Info *server)
2180 {
2181         int rc = 0;
2182         /*
2183          * some servers require RFC1001 sessinit before sending
2184          * negprot - BB check reconnection in case where second
2185          * sessinit is sent but no second negprot
2186          */
2187         struct rfc1002_session_packet *ses_init_buf;
2188         struct smb_hdr *smb_buf;
2189         ses_init_buf = kzalloc(sizeof(struct rfc1002_session_packet),
2190                                GFP_KERNEL);
2191         if (ses_init_buf) {
2192                 ses_init_buf->trailer.session_req.called_len = 32;
2193
2194                 if (server->server_RFC1001_name &&
2195                     server->server_RFC1001_name[0] != 0)
2196                         rfc1002mangle(ses_init_buf->trailer.
2197                                       session_req.called_name,
2198                                       server->server_RFC1001_name,
2199                                       RFC1001_NAME_LEN_WITH_NULL);
2200                 else
2201                         rfc1002mangle(ses_init_buf->trailer.
2202                                       session_req.called_name,
2203                                       DEFAULT_CIFS_CALLED_NAME,
2204                                       RFC1001_NAME_LEN_WITH_NULL);
2205
2206                 ses_init_buf->trailer.session_req.calling_len = 32;
2207
2208                 /*
2209                  * calling name ends in null (byte 16) from old smb
2210                  * convention.
2211                  */
2212                 if (server->workstation_RFC1001_name &&
2213                     server->workstation_RFC1001_name[0] != 0)
2214                         rfc1002mangle(ses_init_buf->trailer.
2215                                       session_req.calling_name,
2216                                       server->workstation_RFC1001_name,
2217                                       RFC1001_NAME_LEN_WITH_NULL);
2218                 else
2219                         rfc1002mangle(ses_init_buf->trailer.
2220                                       session_req.calling_name,
2221                                       "LINUX_CIFS_CLNT",
2222                                       RFC1001_NAME_LEN_WITH_NULL);
2223
2224                 ses_init_buf->trailer.session_req.scope1 = 0;
2225                 ses_init_buf->trailer.session_req.scope2 = 0;
2226                 smb_buf = (struct smb_hdr *)ses_init_buf;
2227
2228                 /* sizeof RFC1002_SESSION_REQUEST with no scope */
2229                 smb_buf->smb_buf_length = 0x81000044;
2230                 rc = smb_send(server, smb_buf, 0x44);
2231                 kfree(ses_init_buf);
2232                 /*
2233                  * RFC1001 layer in at least one server
2234                  * requires very short break before negprot
2235                  * presumably because not expecting negprot
2236                  * to follow so fast.  This is a simple
2237                  * solution that works without
2238                  * complicating the code and causes no
2239                  * significant slowing down on mount
2240                  * for everyone else
2241                  */
2242                 usleep_range(1000, 2000);
2243         }
2244         /*
2245          * else the negprot may still work without this
2246          * even though malloc failed
2247          */
2248
2249         return rc;
2250 }
2251
2252 static int
2253 generic_ip_connect(struct TCP_Server_Info *server)
2254 {
2255         int rc = 0;
2256         unsigned short int sport;
2257         int slen, sfamily;
2258         struct socket *socket = server->ssocket;
2259         struct sockaddr *saddr;
2260
2261         saddr = (struct sockaddr *) &server->dstaddr;
2262
2263         if (server->dstaddr.ss_family == AF_INET6) {
2264                 sport = ((struct sockaddr_in6 *) saddr)->sin6_port;
2265                 slen = sizeof(struct sockaddr_in6);
2266                 sfamily = AF_INET6;
2267         } else {
2268                 sport = ((struct sockaddr_in *) saddr)->sin_port;
2269                 slen = sizeof(struct sockaddr_in);
2270                 sfamily = AF_INET;
2271         }
2272
2273         if (socket == NULL) {
2274                 rc = __sock_create(cifs_net_ns(server), sfamily, SOCK_STREAM,
2275                                    IPPROTO_TCP, &socket, 1);
2276                 if (rc < 0) {
2277                         cERROR(1, "Error %d creating socket", rc);
2278                         server->ssocket = NULL;
2279                         return rc;
2280                 }
2281
2282                 /* BB other socket options to set KEEPALIVE, NODELAY? */
2283                 cFYI(1, "Socket created");
2284                 server->ssocket = socket;
2285                 socket->sk->sk_allocation = GFP_NOFS;
2286                 if (sfamily == AF_INET6)
2287                         cifs_reclassify_socket6(socket);
2288                 else
2289                         cifs_reclassify_socket4(socket);
2290         }
2291
2292         rc = bind_socket(server);
2293         if (rc < 0)
2294                 return rc;
2295
2296         rc = socket->ops->connect(socket, saddr, slen, 0);
2297         if (rc < 0) {
2298                 cFYI(1, "Error %d connecting to server", rc);
2299                 sock_release(socket);
2300                 server->ssocket = NULL;
2301                 return rc;
2302         }
2303
2304         /*
2305          * Eventually check for other socket options to change from
2306          * the default. sock_setsockopt not used because it expects
2307          * user space buffer
2308          */
2309         socket->sk->sk_rcvtimeo = 7 * HZ;
2310         socket->sk->sk_sndtimeo = 5 * HZ;
2311
2312         /* make the bufsizes depend on wsize/rsize and max requests */
2313         if (server->noautotune) {
2314                 if (socket->sk->sk_sndbuf < (200 * 1024))
2315                         socket->sk->sk_sndbuf = 200 * 1024;
2316                 if (socket->sk->sk_rcvbuf < (140 * 1024))
2317                         socket->sk->sk_rcvbuf = 140 * 1024;
2318         }
2319
2320         if (server->tcp_nodelay) {
2321                 int val = 1;
2322                 rc = kernel_setsockopt(socket, SOL_TCP, TCP_NODELAY,
2323                                 (char *)&val, sizeof(val));
2324                 if (rc)
2325                         cFYI(1, "set TCP_NODELAY socket option error %d", rc);
2326         }
2327
2328          cFYI(1, "sndbuf %d rcvbuf %d rcvtimeo 0x%lx",
2329                  socket->sk->sk_sndbuf,
2330                  socket->sk->sk_rcvbuf, socket->sk->sk_rcvtimeo);
2331
2332         if (sport == htons(RFC1001_PORT))
2333                 rc = ip_rfc1001_connect(server);
2334
2335         return rc;
2336 }
2337
2338 static int
2339 ip_connect(struct TCP_Server_Info *server)
2340 {
2341         unsigned short int *sport;
2342         struct sockaddr_in6 *addr6 = (struct sockaddr_in6 *)&server->dstaddr;
2343         struct sockaddr_in *addr = (struct sockaddr_in *)&server->dstaddr;
2344
2345         if (server->dstaddr.ss_family == AF_INET6)
2346                 sport = &addr6->sin6_port;
2347         else
2348                 sport = &addr->sin_port;
2349
2350         if (*sport == 0) {
2351                 int rc;
2352
2353                 /* try with 445 port at first */
2354                 *sport = htons(CIFS_PORT);
2355
2356                 rc = generic_ip_connect(server);
2357                 if (rc >= 0)
2358                         return rc;
2359
2360                 /* if it failed, try with 139 port */
2361                 *sport = htons(RFC1001_PORT);
2362         }
2363
2364         return generic_ip_connect(server);
2365 }
2366
2367 void reset_cifs_unix_caps(int xid, struct cifsTconInfo *tcon,
2368                           struct super_block *sb, struct smb_vol *vol_info)
2369 {
2370         /* if we are reconnecting then should we check to see if
2371          * any requested capabilities changed locally e.g. via
2372          * remount but we can not do much about it here
2373          * if they have (even if we could detect it by the following)
2374          * Perhaps we could add a backpointer to array of sb from tcon
2375          * or if we change to make all sb to same share the same
2376          * sb as NFS - then we only have one backpointer to sb.
2377          * What if we wanted to mount the server share twice once with
2378          * and once without posixacls or posix paths? */
2379         __u64 saved_cap = le64_to_cpu(tcon->fsUnixInfo.Capability);
2380
2381         if (vol_info && vol_info->no_linux_ext) {
2382                 tcon->fsUnixInfo.Capability = 0;
2383                 tcon->unix_ext = 0; /* Unix Extensions disabled */
2384                 cFYI(1, "Linux protocol extensions disabled");
2385                 return;
2386         } else if (vol_info)
2387                 tcon->unix_ext = 1; /* Unix Extensions supported */
2388
2389         if (tcon->unix_ext == 0) {
2390                 cFYI(1, "Unix extensions disabled so not set on reconnect");
2391                 return;
2392         }
2393
2394         if (!CIFSSMBQFSUnixInfo(xid, tcon)) {
2395                 __u64 cap = le64_to_cpu(tcon->fsUnixInfo.Capability);
2396
2397                 /* check for reconnect case in which we do not
2398                    want to change the mount behavior if we can avoid it */
2399                 if (vol_info == NULL) {
2400                         /* turn off POSIX ACL and PATHNAMES if not set
2401                            originally at mount time */
2402                         if ((saved_cap & CIFS_UNIX_POSIX_ACL_CAP) == 0)
2403                                 cap &= ~CIFS_UNIX_POSIX_ACL_CAP;
2404                         if ((saved_cap & CIFS_UNIX_POSIX_PATHNAMES_CAP) == 0) {
2405                                 if (cap & CIFS_UNIX_POSIX_PATHNAMES_CAP)
2406                                         cERROR(1, "POSIXPATH support change");
2407                                 cap &= ~CIFS_UNIX_POSIX_PATHNAMES_CAP;
2408                         } else if ((cap & CIFS_UNIX_POSIX_PATHNAMES_CAP) == 0) {
2409                                 cERROR(1, "possible reconnect error");
2410                                 cERROR(1, "server disabled POSIX path support");
2411                         }
2412                 }
2413
2414                 cap &= CIFS_UNIX_CAP_MASK;
2415                 if (vol_info && vol_info->no_psx_acl)
2416                         cap &= ~CIFS_UNIX_POSIX_ACL_CAP;
2417                 else if (CIFS_UNIX_POSIX_ACL_CAP & cap) {
2418                         cFYI(1, "negotiated posix acl support");
2419                         if (sb)
2420                                 sb->s_flags |= MS_POSIXACL;
2421                 }
2422
2423                 if (vol_info && vol_info->posix_paths == 0)
2424                         cap &= ~CIFS_UNIX_POSIX_PATHNAMES_CAP;
2425                 else if (cap & CIFS_UNIX_POSIX_PATHNAMES_CAP) {
2426                         cFYI(1, "negotiate posix pathnames");
2427                         if (sb)
2428                                 CIFS_SB(sb)->mnt_cifs_flags |=
2429                                         CIFS_MOUNT_POSIX_PATHS;
2430                 }
2431
2432                 /* We might be setting the path sep back to a different
2433                 form if we are reconnecting and the server switched its
2434                 posix path capability for this share */
2435                 if (sb && (CIFS_SB(sb)->prepathlen > 0))
2436                         CIFS_SB(sb)->prepath[0] = CIFS_DIR_SEP(CIFS_SB(sb));
2437
2438                 if (sb && (CIFS_SB(sb)->rsize > 127 * 1024)) {
2439                         if ((cap & CIFS_UNIX_LARGE_READ_CAP) == 0) {
2440                                 CIFS_SB(sb)->rsize = 127 * 1024;
2441                                 cFYI(DBG2, "larger reads not supported by srv");
2442                         }
2443                 }
2444
2445
2446                 cFYI(1, "Negotiate caps 0x%x", (int)cap);
2447 #ifdef CONFIG_CIFS_DEBUG2
2448                 if (cap & CIFS_UNIX_FCNTL_CAP)
2449                         cFYI(1, "FCNTL cap");
2450                 if (cap & CIFS_UNIX_EXTATTR_CAP)
2451                         cFYI(1, "EXTATTR cap");
2452                 if (cap & CIFS_UNIX_POSIX_PATHNAMES_CAP)
2453                         cFYI(1, "POSIX path cap");
2454                 if (cap & CIFS_UNIX_XATTR_CAP)
2455                         cFYI(1, "XATTR cap");
2456                 if (cap & CIFS_UNIX_POSIX_ACL_CAP)
2457                         cFYI(1, "POSIX ACL cap");
2458                 if (cap & CIFS_UNIX_LARGE_READ_CAP)
2459                         cFYI(1, "very large read cap");
2460                 if (cap & CIFS_UNIX_LARGE_WRITE_CAP)
2461                         cFYI(1, "very large write cap");
2462 #endif /* CIFS_DEBUG2 */
2463                 if (CIFSSMBSetFSUnixInfo(xid, tcon, cap)) {
2464                         if (vol_info == NULL) {
2465                                 cFYI(1, "resetting capabilities failed");
2466                         } else
2467                                 cERROR(1, "Negotiating Unix capabilities "
2468                                            "with the server failed.  Consider "
2469                                            "mounting with the Unix Extensions\n"
2470                                            "disabled, if problems are found, "
2471                                            "by specifying the nounix mount "
2472                                            "option.");
2473
2474                 }
2475         }
2476 }
2477
2478 static void
2479 convert_delimiter(char *path, char delim)
2480 {
2481         int i;
2482         char old_delim;
2483
2484         if (path == NULL)
2485                 return;
2486
2487         if (delim == '/')
2488                 old_delim = '\\';
2489         else
2490                 old_delim = '/';
2491
2492         for (i = 0; path[i] != '\0'; i++) {
2493                 if (path[i] == old_delim)
2494                         path[i] = delim;
2495         }
2496 }
2497
2498 static void setup_cifs_sb(struct smb_vol *pvolume_info,
2499                           struct cifs_sb_info *cifs_sb)
2500 {
2501         INIT_DELAYED_WORK(&cifs_sb->prune_tlinks, cifs_prune_tlinks);
2502
2503         if (pvolume_info->rsize > CIFSMaxBufSize) {
2504                 cERROR(1, "rsize %d too large, using MaxBufSize",
2505                         pvolume_info->rsize);
2506                 cifs_sb->rsize = CIFSMaxBufSize;
2507         } else if ((pvolume_info->rsize) &&
2508                         (pvolume_info->rsize <= CIFSMaxBufSize))
2509                 cifs_sb->rsize = pvolume_info->rsize;
2510         else /* default */
2511                 cifs_sb->rsize = CIFSMaxBufSize;
2512
2513         if (pvolume_info->wsize > PAGEVEC_SIZE * PAGE_CACHE_SIZE) {
2514                 cERROR(1, "wsize %d too large, using 4096 instead",
2515                           pvolume_info->wsize);
2516                 cifs_sb->wsize = 4096;
2517         } else if (pvolume_info->wsize)
2518                 cifs_sb->wsize = pvolume_info->wsize;
2519         else
2520                 cifs_sb->wsize = min_t(const int,
2521                                         PAGEVEC_SIZE * PAGE_CACHE_SIZE,
2522                                         127*1024);
2523                 /* old default of CIFSMaxBufSize was too small now
2524                    that SMB Write2 can send multiple pages in kvec.
2525                    RFC1001 does not describe what happens when frame
2526                    bigger than 128K is sent so use that as max in
2527                    conjunction with 52K kvec constraint on arch with 4K
2528                    page size  */
2529
2530         if (cifs_sb->rsize < 2048) {
2531                 cifs_sb->rsize = 2048;
2532                 /* Windows ME may prefer this */
2533                 cFYI(1, "readsize set to minimum: 2048");
2534         }
2535         /* calculate prepath */
2536         cifs_sb->prepath = pvolume_info->prepath;
2537         if (cifs_sb->prepath) {
2538                 cifs_sb->prepathlen = strlen(cifs_sb->prepath);
2539                 /* we can not convert the / to \ in the path
2540                 separators in the prefixpath yet because we do not
2541                 know (until reset_cifs_unix_caps is called later)
2542                 whether POSIX PATH CAP is available. We normalize
2543                 the / to \ after reset_cifs_unix_caps is called */
2544                 pvolume_info->prepath = NULL;
2545         } else
2546                 cifs_sb->prepathlen = 0;
2547         cifs_sb->mnt_uid = pvolume_info->linux_uid;
2548         cifs_sb->mnt_gid = pvolume_info->linux_gid;
2549         cifs_sb->mnt_file_mode = pvolume_info->file_mode;
2550         cifs_sb->mnt_dir_mode = pvolume_info->dir_mode;
2551         cFYI(1, "file mode: 0x%x  dir mode: 0x%x",
2552                 cifs_sb->mnt_file_mode, cifs_sb->mnt_dir_mode);
2553
2554         cifs_sb->actimeo = pvolume_info->actimeo;
2555
2556         if (pvolume_info->noperm)
2557                 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_NO_PERM;
2558         if (pvolume_info->setuids)
2559                 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_SET_UID;
2560         if (pvolume_info->server_ino)
2561                 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_SERVER_INUM;
2562         if (pvolume_info->remap)
2563                 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_MAP_SPECIAL_CHR;
2564         if (pvolume_info->no_xattr)
2565                 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_NO_XATTR;
2566         if (pvolume_info->sfu_emul)
2567                 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_UNX_EMUL;
2568         if (pvolume_info->nobrl)
2569                 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_NO_BRL;
2570         if (pvolume_info->nostrictsync)
2571                 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_NOSSYNC;
2572         if (pvolume_info->mand_lock)
2573                 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_NOPOSIXBRL;
2574         if (pvolume_info->cifs_acl)
2575                 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_CIFS_ACL;
2576         if (pvolume_info->override_uid)
2577                 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_OVERR_UID;
2578         if (pvolume_info->override_gid)
2579                 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_OVERR_GID;
2580         if (pvolume_info->dynperm)
2581                 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_DYNPERM;
2582         if (pvolume_info->fsc)
2583                 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_FSCACHE;
2584         if (pvolume_info->multiuser)
2585                 cifs_sb->mnt_cifs_flags |= (CIFS_MOUNT_MULTIUSER |
2586                                             CIFS_MOUNT_NO_PERM);
2587         if (pvolume_info->strict_io)
2588                 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_STRICT_IO;
2589         if (pvolume_info->direct_io) {
2590                 cFYI(1, "mounting share using direct i/o");
2591                 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_DIRECT_IO;
2592         }
2593         if (pvolume_info->mfsymlinks) {
2594                 if (pvolume_info->sfu_emul) {
2595                         cERROR(1,  "mount option mfsymlinks ignored if sfu "
2596                                    "mount option is used");
2597                 } else {
2598                         cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_MF_SYMLINKS;
2599                 }
2600         }
2601
2602         if ((pvolume_info->cifs_acl) && (pvolume_info->dynperm))
2603                 cERROR(1, "mount option dynperm ignored if cifsacl "
2604                            "mount option supported");
2605 }
2606
2607 static int
2608 is_path_accessible(int xid, struct cifsTconInfo *tcon,
2609                    struct cifs_sb_info *cifs_sb, const char *full_path)
2610 {
2611         int rc;
2612         FILE_ALL_INFO *pfile_info;
2613
2614         pfile_info = kmalloc(sizeof(FILE_ALL_INFO), GFP_KERNEL);
2615         if (pfile_info == NULL)
2616                 return -ENOMEM;
2617
2618         rc = CIFSSMBQPathInfo(xid, tcon, full_path, pfile_info,
2619                               0 /* not legacy */, cifs_sb->local_nls,
2620                               cifs_sb->mnt_cifs_flags &
2621                                 CIFS_MOUNT_MAP_SPECIAL_CHR);
2622         kfree(pfile_info);
2623         return rc;
2624 }
2625
2626 static void
2627 cleanup_volume_info(struct smb_vol **pvolume_info)
2628 {
2629         struct smb_vol *volume_info;
2630
2631         if (!pvolume_info || !*pvolume_info)
2632                 return;
2633
2634         volume_info = *pvolume_info;
2635         kzfree(volume_info->password);
2636         kfree(volume_info->UNC);
2637         kfree(volume_info->prepath);
2638         kfree(volume_info);
2639         *pvolume_info = NULL;
2640         return;
2641 }
2642
2643 #ifdef CONFIG_CIFS_DFS_UPCALL
2644 /* build_path_to_root returns full path to root when
2645  * we do not have an exiting connection (tcon) */
2646 static char *
2647 build_unc_path_to_root(const struct smb_vol *volume_info,
2648                 const struct cifs_sb_info *cifs_sb)
2649 {
2650         char *full_path;
2651
2652         int unc_len = strnlen(volume_info->UNC, MAX_TREE_SIZE + 1);
2653         full_path = kmalloc(unc_len + cifs_sb->prepathlen + 1, GFP_KERNEL);
2654         if (full_path == NULL)
2655                 return ERR_PTR(-ENOMEM);
2656
2657         strncpy(full_path, volume_info->UNC, unc_len);
2658         if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_POSIX_PATHS) {
2659                 int i;
2660                 for (i = 0; i < unc_len; i++) {
2661                         if (full_path[i] == '\\')
2662                                 full_path[i] = '/';
2663                 }
2664         }
2665
2666         if (cifs_sb->prepathlen)
2667                 strncpy(full_path + unc_len, cifs_sb->prepath,
2668                                 cifs_sb->prepathlen);
2669
2670         full_path[unc_len + cifs_sb->prepathlen] = 0; /* add trailing null */
2671         return full_path;
2672 }
2673 #endif
2674
2675 int
2676 cifs_mount(struct super_block *sb, struct cifs_sb_info *cifs_sb,
2677                 char *mount_data_global, const char *devname)
2678 {
2679         int rc;
2680         int xid;
2681         struct smb_vol *volume_info;
2682         struct cifsSesInfo *pSesInfo;
2683         struct cifsTconInfo *tcon;
2684         struct TCP_Server_Info *srvTcp;
2685         char   *full_path;
2686         char *mount_data = mount_data_global;
2687         struct tcon_link *tlink;
2688 #ifdef CONFIG_CIFS_DFS_UPCALL
2689         struct dfs_info3_param *referrals = NULL;
2690         unsigned int num_referrals = 0;
2691         int referral_walks_count = 0;
2692 try_mount_again:
2693 #endif
2694         rc = 0;
2695         tcon = NULL;
2696         pSesInfo = NULL;
2697         srvTcp = NULL;
2698         full_path = NULL;
2699         tlink = NULL;
2700
2701         xid = GetXid();
2702
2703         volume_info = kzalloc(sizeof(struct smb_vol), GFP_KERNEL);
2704         if (!volume_info) {
2705                 rc = -ENOMEM;
2706                 goto out;
2707         }
2708
2709         if (cifs_parse_mount_options(mount_data, devname, volume_info)) {
2710                 rc = -EINVAL;
2711                 goto out;
2712         }
2713
2714         if (volume_info->nullauth) {
2715                 cFYI(1, "null user");
2716                 volume_info->username = "";
2717         } else if (volume_info->username) {
2718                 /* BB fixme parse for domain name here */
2719                 cFYI(1, "Username: %s", volume_info->username);
2720         } else {
2721                 cifserror("No username specified");
2722         /* In userspace mount helper we can get user name from alternate
2723            locations such as env variables and files on disk */
2724                 rc = -EINVAL;
2725                 goto out;
2726         }
2727
2728         /* this is needed for ASCII cp to Unicode converts */
2729         if (volume_info->iocharset == NULL) {
2730                 /* load_nls_default cannot return null */
2731                 volume_info->local_nls = load_nls_default();
2732         } else {
2733                 volume_info->local_nls = load_nls(volume_info->iocharset);
2734                 if (volume_info->local_nls == NULL) {
2735                         cERROR(1, "CIFS mount error: iocharset %s not found",
2736                                  volume_info->iocharset);
2737                         rc = -ELIBACC;
2738                         goto out;
2739                 }
2740         }
2741         cifs_sb->local_nls = volume_info->local_nls;
2742
2743         /* get a reference to a tcp session */
2744         srvTcp = cifs_get_tcp_session(volume_info);
2745         if (IS_ERR(srvTcp)) {
2746                 rc = PTR_ERR(srvTcp);
2747                 goto out;
2748         }
2749
2750         /* get a reference to a SMB session */
2751         pSesInfo = cifs_get_smb_ses(srvTcp, volume_info);
2752         if (IS_ERR(pSesInfo)) {
2753                 rc = PTR_ERR(pSesInfo);
2754                 pSesInfo = NULL;
2755                 goto mount_fail_check;
2756         }
2757
2758         setup_cifs_sb(volume_info, cifs_sb);
2759         if (pSesInfo->capabilities & CAP_LARGE_FILES)
2760                 sb->s_maxbytes = MAX_LFS_FILESIZE;
2761         else
2762                 sb->s_maxbytes = MAX_NON_LFS;
2763
2764         /* BB FIXME fix time_gran to be larger for LANMAN sessions */
2765         sb->s_time_gran = 100;
2766
2767         /* search for existing tcon to this server share */
2768         tcon = cifs_get_tcon(pSesInfo, volume_info);
2769         if (IS_ERR(tcon)) {
2770                 rc = PTR_ERR(tcon);
2771                 tcon = NULL;
2772                 goto remote_path_check;
2773         }
2774
2775         /* do not care if following two calls succeed - informational */
2776         if (!tcon->ipc) {
2777                 CIFSSMBQFSDeviceInfo(xid, tcon);
2778                 CIFSSMBQFSAttributeInfo(xid, tcon);
2779         }
2780
2781         /* tell server which Unix caps we support */
2782         if (tcon->ses->capabilities & CAP_UNIX)
2783                 /* reset of caps checks mount to see if unix extensions
2784                    disabled for just this mount */
2785                 reset_cifs_unix_caps(xid, tcon, sb, volume_info);
2786         else
2787                 tcon->unix_ext = 0; /* server does not support them */
2788
2789         /* convert forward to back slashes in prepath here if needed */
2790         if ((cifs_sb->mnt_cifs_flags & CIFS_MOUNT_POSIX_PATHS) == 0)
2791                 convert_delimiter(cifs_sb->prepath, CIFS_DIR_SEP(cifs_sb));
2792
2793         if ((tcon->unix_ext == 0) && (cifs_sb->rsize > (1024 * 127))) {
2794                 cifs_sb->rsize = 1024 * 127;
2795                 cFYI(DBG2, "no very large read support, rsize now 127K");
2796         }
2797         if (!(tcon->ses->capabilities & CAP_LARGE_WRITE_X))
2798                 cifs_sb->wsize = min(cifs_sb->wsize,
2799                                (tcon->ses->server->maxBuf - MAX_CIFS_HDR_SIZE));
2800         if (!(tcon->ses->capabilities & CAP_LARGE_READ_X))
2801                 cifs_sb->rsize = min(cifs_sb->rsize,
2802                                (tcon->ses->server->maxBuf - MAX_CIFS_HDR_SIZE));
2803
2804 remote_path_check:
2805         /* check if a whole path (including prepath) is not remote */
2806         if (!rc && cifs_sb->prepathlen && tcon) {
2807                 /* build_path_to_root works only when we have a valid tcon */
2808                 full_path = cifs_build_path_to_root(cifs_sb, tcon);
2809                 if (full_path == NULL) {
2810                         rc = -ENOMEM;
2811                         goto mount_fail_check;
2812                 }
2813                 rc = is_path_accessible(xid, tcon, cifs_sb, full_path);
2814                 if (rc != 0 && rc != -EREMOTE) {
2815                         kfree(full_path);
2816                         goto mount_fail_check;
2817                 }
2818                 kfree(full_path);
2819         }
2820
2821         /* get referral if needed */
2822         if (rc == -EREMOTE) {
2823 #ifdef CONFIG_CIFS_DFS_UPCALL
2824                 if (referral_walks_count > MAX_NESTED_LINKS) {
2825                         /*
2826                          * BB: when we implement proper loop detection,
2827                          *     we will remove this check. But now we need it
2828                          *     to prevent an indefinite loop if 'DFS tree' is
2829                          *     misconfigured (i.e. has loops).
2830                          */
2831                         rc = -ELOOP;
2832                         goto mount_fail_check;
2833                 }
2834                 /* convert forward to back slashes in prepath here if needed */
2835                 if ((cifs_sb->mnt_cifs_flags & CIFS_MOUNT_POSIX_PATHS) == 0)
2836                         convert_delimiter(cifs_sb->prepath,
2837                                         CIFS_DIR_SEP(cifs_sb));
2838                 full_path = build_unc_path_to_root(volume_info, cifs_sb);
2839                 if (IS_ERR(full_path)) {
2840                         rc = PTR_ERR(full_path);
2841                         goto mount_fail_check;
2842                 }
2843
2844                 cFYI(1, "Getting referral for: %s", full_path);
2845                 rc = get_dfs_path(xid, pSesInfo , full_path + 1,
2846                         cifs_sb->local_nls, &num_referrals, &referrals,
2847                         cifs_sb->mnt_cifs_flags & CIFS_MOUNT_MAP_SPECIAL_CHR);
2848                 if (!rc && num_referrals > 0) {
2849                         char *fake_devname = NULL;
2850
2851                         if (mount_data != mount_data_global)
2852                                 kfree(mount_data);
2853
2854                         mount_data = cifs_compose_mount_options(
2855                                         cifs_sb->mountdata, full_path + 1,
2856                                         referrals, &fake_devname);
2857
2858                         free_dfs_info_array(referrals, num_referrals);
2859                         kfree(fake_devname);
2860                         kfree(full_path);
2861
2862                         if (IS_ERR(mount_data)) {
2863                                 rc = PTR_ERR(mount_data);
2864                                 mount_data = NULL;
2865                                 goto mount_fail_check;
2866                         }
2867
2868                         if (tcon)
2869                                 cifs_put_tcon(tcon);
2870                         else if (pSesInfo)
2871                                 cifs_put_smb_ses(pSesInfo);
2872
2873                         cleanup_volume_info(&volume_info);
2874                         referral_walks_count++;
2875                         FreeXid(xid);
2876                         goto try_mount_again;
2877                 }
2878 #else /* No DFS support, return error on mount */
2879                 rc = -EOPNOTSUPP;
2880 #endif
2881         }
2882
2883         if (rc)
2884                 goto mount_fail_check;
2885
2886         /* now, hang the tcon off of the superblock */
2887         tlink = kzalloc(sizeof *tlink, GFP_KERNEL);
2888         if (tlink == NULL) {
2889                 rc = -ENOMEM;
2890                 goto mount_fail_check;
2891         }
2892
2893         tlink->tl_uid = pSesInfo->linux_uid;
2894         tlink->tl_tcon = tcon;
2895         tlink->tl_time = jiffies;
2896         set_bit(TCON_LINK_MASTER, &tlink->tl_flags);
2897         set_bit(TCON_LINK_IN_TREE, &tlink->tl_flags);
2898
2899         cifs_sb->master_tlink = tlink;
2900         spin_lock(&cifs_sb->tlink_tree_lock);
2901         tlink_rb_insert(&cifs_sb->tlink_tree, tlink);
2902         spin_unlock(&cifs_sb->tlink_tree_lock);
2903
2904         queue_delayed_work(system_nrt_wq, &cifs_sb->prune_tlinks,
2905                                 TLINK_IDLE_EXPIRE);
2906
2907 mount_fail_check:
2908         /* on error free sesinfo and tcon struct if needed */
2909         if (rc) {
2910                 if (mount_data != mount_data_global)
2911                         kfree(mount_data);
2912                 /* If find_unc succeeded then rc == 0 so we can not end */
2913                 /* up accidently freeing someone elses tcon struct */
2914                 if (tcon)
2915                         cifs_put_tcon(tcon);
2916                 else if (pSesInfo)
2917                         cifs_put_smb_ses(pSesInfo);
2918                 else
2919                         cifs_put_tcp_session(srvTcp);
2920                 goto out;
2921         }
2922
2923         /* volume_info->password is freed above when existing session found
2924         (in which case it is not needed anymore) but when new sesion is created
2925         the password ptr is put in the new session structure (in which case the
2926         password will be freed at unmount time) */
2927 out:
2928         /* zero out password before freeing */
2929         cleanup_volume_info(&volume_info);
2930         FreeXid(xid);
2931         return rc;
2932 }
2933
2934 int
2935 CIFSTCon(unsigned int xid, struct cifsSesInfo *ses,
2936          const char *tree, struct cifsTconInfo *tcon,
2937          const struct nls_table *nls_codepage)
2938 {
2939         struct smb_hdr *smb_buffer;
2940         struct smb_hdr *smb_buffer_response;
2941         TCONX_REQ *pSMB;
2942         TCONX_RSP *pSMBr;
2943         unsigned char *bcc_ptr;
2944         int rc = 0;
2945         int length;
2946         __u16 bytes_left, count;
2947
2948         if (ses == NULL)
2949                 return -EIO;
2950
2951         smb_buffer = cifs_buf_get();
2952         if (smb_buffer == NULL)
2953                 return -ENOMEM;
2954
2955         smb_buffer_response = smb_buffer;
2956
2957         header_assemble(smb_buffer, SMB_COM_TREE_CONNECT_ANDX,
2958                         NULL /*no tid */ , 4 /*wct */ );
2959
2960         smb_buffer->Mid = GetNextMid(ses->server);
2961         smb_buffer->Uid = ses->Suid;
2962         pSMB = (TCONX_REQ *) smb_buffer;
2963         pSMBr = (TCONX_RSP *) smb_buffer_response;
2964
2965         pSMB->AndXCommand = 0xFF;
2966         pSMB->Flags = cpu_to_le16(TCON_EXTENDED_SECINFO);
2967         bcc_ptr = &pSMB->Password[0];
2968         if ((ses->server->secMode) & SECMODE_USER) {
2969                 pSMB->PasswordLength = cpu_to_le16(1);  /* minimum */
2970                 *bcc_ptr = 0; /* password is null byte */
2971                 bcc_ptr++;              /* skip password */
2972                 /* already aligned so no need to do it below */
2973         } else {
2974                 pSMB->PasswordLength = cpu_to_le16(CIFS_AUTH_RESP_SIZE);
2975                 /* BB FIXME add code to fail this if NTLMv2 or Kerberos
2976                    specified as required (when that support is added to
2977                    the vfs in the future) as only NTLM or the much
2978                    weaker LANMAN (which we do not send by default) is accepted
2979                    by Samba (not sure whether other servers allow
2980                    NTLMv2 password here) */
2981 #ifdef CONFIG_CIFS_WEAK_PW_HASH
2982                 if ((global_secflags & CIFSSEC_MAY_LANMAN) &&
2983                     (ses->server->secType == LANMAN))
2984                         calc_lanman_hash(tcon->password, ses->server->cryptkey,
2985                                          ses->server->secMode &
2986                                             SECMODE_PW_ENCRYPT ? true : false,
2987                                          bcc_ptr);
2988                 else
2989 #endif /* CIFS_WEAK_PW_HASH */
2990                 rc = SMBNTencrypt(tcon->password, ses->server->cryptkey,
2991                                         bcc_ptr);
2992
2993                 bcc_ptr += CIFS_AUTH_RESP_SIZE;
2994                 if (ses->capabilities & CAP_UNICODE) {
2995                         /* must align unicode strings */
2996                         *bcc_ptr = 0; /* null byte password */
2997                         bcc_ptr++;
2998                 }
2999         }
3000
3001         if (ses->server->secMode &
3002                         (SECMODE_SIGN_REQUIRED | SECMODE_SIGN_ENABLED))
3003                 smb_buffer->Flags2 |= SMBFLG2_SECURITY_SIGNATURE;
3004
3005         if (ses->capabilities & CAP_STATUS32) {
3006                 smb_buffer->Flags2 |= SMBFLG2_ERR_STATUS;
3007         }
3008         if (ses->capabilities & CAP_DFS) {
3009                 smb_buffer->Flags2 |= SMBFLG2_DFS;
3010         }
3011         if (ses->capabilities & CAP_UNICODE) {
3012                 smb_buffer->Flags2 |= SMBFLG2_UNICODE;
3013                 length =
3014                     cifs_strtoUCS((__le16 *) bcc_ptr, tree,
3015                         6 /* max utf8 char length in bytes */ *
3016                         (/* server len*/ + 256 /* share len */), nls_codepage);
3017                 bcc_ptr += 2 * length;  /* convert num 16 bit words to bytes */
3018                 bcc_ptr += 2;   /* skip trailing null */
3019         } else {                /* ASCII */
3020                 strcpy(bcc_ptr, tree);
3021                 bcc_ptr += strlen(tree) + 1;
3022         }
3023         strcpy(bcc_ptr, "?????");
3024         bcc_ptr += strlen("?????");
3025         bcc_ptr += 1;
3026         count = bcc_ptr - &pSMB->Password[0];
3027         pSMB->hdr.smb_buf_length += count;
3028         pSMB->ByteCount = cpu_to_le16(count);
3029
3030         rc = SendReceive(xid, ses, smb_buffer, smb_buffer_response, &length,
3031                          0);
3032
3033         /* above now done in SendReceive */
3034         if ((rc == 0) && (tcon != NULL)) {
3035                 bool is_unicode;
3036
3037                 tcon->tidStatus = CifsGood;
3038                 tcon->need_reconnect = false;
3039                 tcon->tid = smb_buffer_response->Tid;
3040                 bcc_ptr = pByteArea(smb_buffer_response);
3041                 bytes_left = get_bcc(smb_buffer_response);
3042                 length = strnlen(bcc_ptr, bytes_left - 2);
3043                 if (smb_buffer->Flags2 & SMBFLG2_UNICODE)
3044                         is_unicode = true;
3045                 else
3046                         is_unicode = false;
3047
3048
3049                 /* skip service field (NB: this field is always ASCII) */
3050                 if (length == 3) {
3051                         if ((bcc_ptr[0] == 'I') && (bcc_ptr[1] == 'P') &&
3052                             (bcc_ptr[2] == 'C')) {
3053                                 cFYI(1, "IPC connection");
3054                                 tcon->ipc = 1;
3055                         }
3056                 } else if (length == 2) {
3057                         if ((bcc_ptr[0] == 'A') && (bcc_ptr[1] == ':')) {
3058                                 /* the most common case */
3059                                 cFYI(1, "disk share connection");
3060                         }
3061                 }
3062                 bcc_ptr += length + 1;
3063                 bytes_left -= (length + 1);
3064                 strncpy(tcon->treeName, tree, MAX_TREE_SIZE);
3065
3066                 /* mostly informational -- no need to fail on error here */
3067                 kfree(tcon->nativeFileSystem);
3068                 tcon->nativeFileSystem = cifs_strndup_from_ucs(bcc_ptr,
3069                                                       bytes_left, is_unicode,
3070                                                       nls_codepage);
3071
3072                 cFYI(1, "nativeFileSystem=%s", tcon->nativeFileSystem);
3073
3074                 if ((smb_buffer_response->WordCount == 3) ||
3075                          (smb_buffer_response->WordCount == 7))
3076                         /* field is in same location */
3077                         tcon->Flags = le16_to_cpu(pSMBr->OptionalSupport);
3078                 else
3079                         tcon->Flags = 0;
3080                 cFYI(1, "Tcon flags: 0x%x ", tcon->Flags);
3081         } else if ((rc == 0) && tcon == NULL) {
3082                 /* all we need to save for IPC$ connection */
3083                 ses->ipc_tid = smb_buffer_response->Tid;
3084         }
3085
3086         cifs_buf_release(smb_buffer);
3087         return rc;
3088 }
3089
3090 int
3091 cifs_umount(struct super_block *sb, struct cifs_sb_info *cifs_sb)
3092 {
3093         struct rb_root *root = &cifs_sb->tlink_tree;
3094         struct rb_node *node;
3095         struct tcon_link *tlink;
3096         char *tmp;
3097
3098         cancel_delayed_work_sync(&cifs_sb->prune_tlinks);
3099
3100         spin_lock(&cifs_sb->tlink_tree_lock);
3101         while ((node = rb_first(root))) {
3102                 tlink = rb_entry(node, struct tcon_link, tl_rbnode);
3103                 cifs_get_tlink(tlink);
3104                 clear_bit(TCON_LINK_IN_TREE, &tlink->tl_flags);
3105                 rb_erase(node, root);
3106
3107                 spin_unlock(&cifs_sb->tlink_tree_lock);
3108                 cifs_put_tlink(tlink);
3109                 spin_lock(&cifs_sb->tlink_tree_lock);
3110         }
3111         spin_unlock(&cifs_sb->tlink_tree_lock);
3112
3113         tmp = cifs_sb->prepath;
3114         cifs_sb->prepathlen = 0;
3115         cifs_sb->prepath = NULL;
3116         kfree(tmp);
3117
3118         return 0;
3119 }
3120
3121 int cifs_negotiate_protocol(unsigned int xid, struct cifsSesInfo *ses)
3122 {
3123         int rc = 0;
3124         struct TCP_Server_Info *server = ses->server;
3125
3126         /* only send once per connect */
3127         if (server->maxBuf != 0)
3128                 return 0;
3129
3130         rc = CIFSSMBNegotiate(xid, ses);
3131         if (rc == -EAGAIN) {
3132                 /* retry only once on 1st time connection */
3133                 rc = CIFSSMBNegotiate(xid, ses);
3134                 if (rc == -EAGAIN)
3135                         rc = -EHOSTDOWN;
3136         }
3137         if (rc == 0) {
3138                 spin_lock(&GlobalMid_Lock);
3139                 if (server->tcpStatus != CifsExiting)
3140                         server->tcpStatus = CifsGood;
3141                 else
3142                         rc = -EHOSTDOWN;
3143                 spin_unlock(&GlobalMid_Lock);
3144
3145         }
3146
3147         return rc;
3148 }
3149
3150
3151 int cifs_setup_session(unsigned int xid, struct cifsSesInfo *ses,
3152                         struct nls_table *nls_info)
3153 {
3154         int rc = 0;
3155         struct TCP_Server_Info *server = ses->server;
3156
3157         ses->flags = 0;
3158         ses->capabilities = server->capabilities;
3159         if (linuxExtEnabled == 0)
3160                 ses->capabilities &= (~CAP_UNIX);
3161
3162         cFYI(1, "Security Mode: 0x%x Capabilities: 0x%x TimeAdjust: %d",
3163                  server->secMode, server->capabilities, server->timeAdj);
3164
3165         rc = CIFS_SessSetup(xid, ses, nls_info);
3166         if (rc) {
3167                 cERROR(1, "Send error in SessSetup = %d", rc);
3168         } else {
3169                 mutex_lock(&ses->server->srv_mutex);
3170                 if (!server->session_estab) {
3171                         server->session_key.response = ses->auth_key.response;
3172                         server->session_key.len = ses->auth_key.len;
3173                         server->sequence_number = 0x2;
3174                         server->session_estab = true;
3175                         ses->auth_key.response = NULL;
3176                 }
3177                 mutex_unlock(&server->srv_mutex);
3178
3179                 cFYI(1, "CIFS Session Established successfully");
3180                 spin_lock(&GlobalMid_Lock);
3181                 ses->status = CifsGood;
3182                 ses->need_reconnect = false;
3183                 spin_unlock(&GlobalMid_Lock);
3184         }
3185
3186         kfree(ses->auth_key.response);
3187         ses->auth_key.response = NULL;
3188         ses->auth_key.len = 0;
3189         kfree(ses->ntlmssp);
3190         ses->ntlmssp = NULL;
3191
3192         return rc;
3193 }
3194
3195 static struct cifsTconInfo *
3196 cifs_construct_tcon(struct cifs_sb_info *cifs_sb, uid_t fsuid)
3197 {
3198         struct cifsTconInfo *master_tcon = cifs_sb_master_tcon(cifs_sb);
3199         struct cifsSesInfo *ses;
3200         struct cifsTconInfo *tcon = NULL;
3201         struct smb_vol *vol_info;
3202         char username[MAX_USERNAME_SIZE + 1];
3203
3204         vol_info = kzalloc(sizeof(*vol_info), GFP_KERNEL);
3205         if (vol_info == NULL) {
3206                 tcon = ERR_PTR(-ENOMEM);
3207                 goto out;
3208         }
3209
3210         snprintf(username, MAX_USERNAME_SIZE, "krb50x%x", fsuid);
3211         vol_info->username = username;
3212         vol_info->local_nls = cifs_sb->local_nls;
3213         vol_info->linux_uid = fsuid;
3214         vol_info->cred_uid = fsuid;
3215         vol_info->UNC = master_tcon->treeName;
3216         vol_info->retry = master_tcon->retry;
3217         vol_info->nocase = master_tcon->nocase;
3218         vol_info->local_lease = master_tcon->local_lease;
3219         vol_info->no_linux_ext = !master_tcon->unix_ext;
3220
3221         /* FIXME: allow for other secFlg settings */
3222         vol_info->secFlg = CIFSSEC_MUST_KRB5;
3223
3224         /* get a reference for the same TCP session */
3225         spin_lock(&cifs_tcp_ses_lock);
3226         ++master_tcon->ses->server->srv_count;
3227         spin_unlock(&cifs_tcp_ses_lock);
3228
3229         ses = cifs_get_smb_ses(master_tcon->ses->server, vol_info);
3230         if (IS_ERR(ses)) {
3231                 tcon = (struct cifsTconInfo *)ses;
3232                 cifs_put_tcp_session(master_tcon->ses->server);
3233                 goto out;
3234         }
3235
3236         tcon = cifs_get_tcon(ses, vol_info);
3237         if (IS_ERR(tcon)) {
3238                 cifs_put_smb_ses(ses);
3239                 goto out;
3240         }
3241
3242         if (ses->capabilities & CAP_UNIX)
3243                 reset_cifs_unix_caps(0, tcon, NULL, vol_info);
3244 out:
3245         kfree(vol_info);
3246
3247         return tcon;
3248 }
3249
3250 static inline struct tcon_link *
3251 cifs_sb_master_tlink(struct cifs_sb_info *cifs_sb)
3252 {
3253         return cifs_sb->master_tlink;
3254 }
3255
3256 struct cifsTconInfo *
3257 cifs_sb_master_tcon(struct cifs_sb_info *cifs_sb)
3258 {
3259         return tlink_tcon(cifs_sb_master_tlink(cifs_sb));
3260 }
3261
3262 static int
3263 cifs_sb_tcon_pending_wait(void *unused)
3264 {
3265         schedule();
3266         return signal_pending(current) ? -ERESTARTSYS : 0;
3267 }
3268
3269 /* find and return a tlink with given uid */
3270 static struct tcon_link *
3271 tlink_rb_search(struct rb_root *root, uid_t uid)
3272 {
3273         struct rb_node *node = root->rb_node;
3274         struct tcon_link *tlink;
3275
3276         while (node) {
3277                 tlink = rb_entry(node, struct tcon_link, tl_rbnode);
3278
3279                 if (tlink->tl_uid > uid)
3280                         node = node->rb_left;
3281                 else if (tlink->tl_uid < uid)
3282                         node = node->rb_right;
3283                 else
3284                         return tlink;
3285         }
3286         return NULL;
3287 }
3288
3289 /* insert a tcon_link into the tree */
3290 static void
3291 tlink_rb_insert(struct rb_root *root, struct tcon_link *new_tlink)
3292 {
3293         struct rb_node **new = &(root->rb_node), *parent = NULL;
3294         struct tcon_link *tlink;
3295
3296         while (*new) {
3297                 tlink = rb_entry(*new, struct tcon_link, tl_rbnode);
3298                 parent = *new;
3299
3300                 if (tlink->tl_uid > new_tlink->tl_uid)
3301                         new = &((*new)->rb_left);
3302                 else
3303                         new = &((*new)->rb_right);
3304         }
3305
3306         rb_link_node(&new_tlink->tl_rbnode, parent, new);
3307         rb_insert_color(&new_tlink->tl_rbnode, root);
3308 }
3309
3310 /*
3311  * Find or construct an appropriate tcon given a cifs_sb and the fsuid of the
3312  * current task.
3313  *
3314  * If the superblock doesn't refer to a multiuser mount, then just return
3315  * the master tcon for the mount.
3316  *
3317  * First, search the rbtree for an existing tcon for this fsuid. If one
3318  * exists, then check to see if it's pending construction. If it is then wait
3319  * for construction to complete. Once it's no longer pending, check to see if
3320  * it failed and either return an error or retry construction, depending on
3321  * the timeout.
3322  *
3323  * If one doesn't exist then insert a new tcon_link struct into the tree and
3324  * try to construct a new one.
3325  */
3326 struct tcon_link *
3327 cifs_sb_tlink(struct cifs_sb_info *cifs_sb)
3328 {
3329         int ret;
3330         uid_t fsuid = current_fsuid();
3331         struct tcon_link *tlink, *newtlink;
3332
3333         if (!(cifs_sb->mnt_cifs_flags & CIFS_MOUNT_MULTIUSER))
3334                 return cifs_get_tlink(cifs_sb_master_tlink(cifs_sb));
3335
3336         spin_lock(&cifs_sb->tlink_tree_lock);
3337         tlink = tlink_rb_search(&cifs_sb->tlink_tree, fsuid);
3338         if (tlink)
3339                 cifs_get_tlink(tlink);
3340         spin_unlock(&cifs_sb->tlink_tree_lock);
3341
3342         if (tlink == NULL) {
3343                 newtlink = kzalloc(sizeof(*tlink), GFP_KERNEL);
3344                 if (newtlink == NULL)
3345                         return ERR_PTR(-ENOMEM);
3346                 newtlink->tl_uid = fsuid;
3347                 newtlink->tl_tcon = ERR_PTR(-EACCES);
3348                 set_bit(TCON_LINK_PENDING, &newtlink->tl_flags);
3349                 set_bit(TCON_LINK_IN_TREE, &newtlink->tl_flags);
3350                 cifs_get_tlink(newtlink);
3351
3352                 spin_lock(&cifs_sb->tlink_tree_lock);
3353                 /* was one inserted after previous search? */
3354                 tlink = tlink_rb_search(&cifs_sb->tlink_tree, fsuid);
3355                 if (tlink) {
3356                         cifs_get_tlink(tlink);
3357                         spin_unlock(&cifs_sb->tlink_tree_lock);
3358                         kfree(newtlink);
3359                         goto wait_for_construction;
3360                 }
3361                 tlink = newtlink;
3362                 tlink_rb_insert(&cifs_sb->tlink_tree, tlink);
3363                 spin_unlock(&cifs_sb->tlink_tree_lock);
3364         } else {
3365 wait_for_construction:
3366                 ret = wait_on_bit(&tlink->tl_flags, TCON_LINK_PENDING,
3367                                   cifs_sb_tcon_pending_wait,
3368                                   TASK_INTERRUPTIBLE);
3369                 if (ret) {
3370                         cifs_put_tlink(tlink);
3371                         return ERR_PTR(ret);
3372                 }
3373
3374                 /* if it's good, return it */
3375                 if (!IS_ERR(tlink->tl_tcon))
3376                         return tlink;
3377
3378                 /* return error if we tried this already recently */
3379                 if (time_before(jiffies, tlink->tl_time + TLINK_ERROR_EXPIRE)) {
3380                         cifs_put_tlink(tlink);
3381                         return ERR_PTR(-EACCES);
3382                 }
3383
3384                 if (test_and_set_bit(TCON_LINK_PENDING, &tlink->tl_flags))
3385                         goto wait_for_construction;
3386         }
3387
3388         tlink->tl_tcon = cifs_construct_tcon(cifs_sb, fsuid);
3389         clear_bit(TCON_LINK_PENDING, &tlink->tl_flags);
3390         wake_up_bit(&tlink->tl_flags, TCON_LINK_PENDING);
3391
3392         if (IS_ERR(tlink->tl_tcon)) {
3393                 cifs_put_tlink(tlink);
3394                 return ERR_PTR(-EACCES);
3395         }
3396
3397         return tlink;
3398 }
3399
3400 /*
3401  * periodic workqueue job that scans tcon_tree for a superblock and closes
3402  * out tcons.
3403  */
3404 static void
3405 cifs_prune_tlinks(struct work_struct *work)
3406 {
3407         struct cifs_sb_info *cifs_sb = container_of(work, struct cifs_sb_info,
3408                                                     prune_tlinks.work);
3409         struct rb_root *root = &cifs_sb->tlink_tree;
3410         struct rb_node *node = rb_first(root);
3411         struct rb_node *tmp;
3412         struct tcon_link *tlink;
3413
3414         /*
3415          * Because we drop the spinlock in the loop in order to put the tlink
3416          * it's not guarded against removal of links from the tree. The only
3417          * places that remove entries from the tree are this function and
3418          * umounts. Because this function is non-reentrant and is canceled
3419          * before umount can proceed, this is safe.
3420          */
3421         spin_lock(&cifs_sb->tlink_tree_lock);
3422         node = rb_first(root);
3423         while (node != NULL) {
3424                 tmp = node;
3425                 node = rb_next(tmp);
3426                 tlink = rb_entry(tmp, struct tcon_link, tl_rbnode);
3427
3428                 if (test_bit(TCON_LINK_MASTER, &tlink->tl_flags) ||
3429                     atomic_read(&tlink->tl_count) != 0 ||
3430                     time_after(tlink->tl_time + TLINK_IDLE_EXPIRE, jiffies))
3431                         continue;
3432
3433                 cifs_get_tlink(tlink);
3434                 clear_bit(TCON_LINK_IN_TREE, &tlink->tl_flags);
3435                 rb_erase(tmp, root);
3436
3437                 spin_unlock(&cifs_sb->tlink_tree_lock);
3438                 cifs_put_tlink(tlink);
3439                 spin_lock(&cifs_sb->tlink_tree_lock);
3440         }
3441         spin_unlock(&cifs_sb->tlink_tree_lock);
3442
3443         queue_delayed_work(system_nrt_wq, &cifs_sb->prune_tlinks,
3444                                 TLINK_IDLE_EXPIRE);
3445 }