fs/cifs/connect.c

   1 /*
   2  *   fs/cifs/connect.c
   3  *
   4  *   Copyright (C) International Business Machines  Corp., 2002,2009
   5  *   Author(s): Steve French (sfrench@us.ibm.com)
   6  *
   7  *   This library is free software; you can redistribute it and/or modify
   8  *   it under the terms of the GNU Lesser General Public License as published
   9  *   by the Free Software Foundation; either version 2.1 of the License, or
  10  *   (at your option) any later version.
  11  *
  12  *   This library is distributed in the hope that it will be useful,
  13  *   but WITHOUT ANY WARRANTY; without even the implied warranty of
  14  *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See
  15  *   the GNU Lesser General Public License for more details.
  16  *
  17  *   You should have received a copy of the GNU Lesser General Public License
  18  *   along with this library; if not, write to the Free Software
  19  *   Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
  20  */
  21 #include <linux/fs.h>
  22 #include <linux/net.h>
  23 #include <linux/string.h>
  24 #include <linux/list.h>
  25 #include <linux/wait.h>
  26 #include <linux/slab.h>
  27 #include <linux/pagemap.h>
  28 #include <linux/ctype.h>
  29 #include <linux/utsname.h>
  30 #include <linux/mempool.h>
  31 #include <linux/delay.h>
  32 #include <linux/completion.h>
  33 #include <linux/kthread.h>
  34 #include <linux/pagevec.h>
  35 #include <linux/freezer.h>
  36 #include <linux/namei.h>
  37 #include <asm/uaccess.h>
  38 #include <asm/processor.h>
  39 #include <linux/inet.h>
  40 #include <linux/module.h>
  41 #include <net/ipv6.h>
  42 #include "cifspdu.h"
  43 #include "cifsglob.h"
  44 #include "cifsproto.h"
  45 #include "cifs_unicode.h"
  46 #include "cifs_debug.h"
  47 #include "cifs_fs_sb.h"
  48 #include "ntlmssp.h"
  49 #include "nterr.h"
  50 #include "rfc1002pdu.h"
  51 #include "fscache.h"
  52
  53 #define CIFS_PORT 445
  54 #define RFC1001_PORT 139
  55
  56 /* SMB echo "timeout" -- FIXME: tunable? */
  57 #define SMB_ECHO_INTERVAL (60 * HZ)
  58
  59 extern mempool_t *cifs_req_poolp;
  60
  61 /* FIXME: should these be tunable? */
  62 #define TLINK_ERROR_EXPIRE      (1 * HZ)
  63 #define TLINK_IDLE_EXPIRE       (600 * HZ)
  64
  65 static int ip_connect(struct TCP_Server_Info *server);
  66 static int generic_ip_connect(struct TCP_Server_Info *server);
  67 static void tlink_rb_insert(struct rb_root *root, struct tcon_link *new_tlink);
  68 static void cifs_prune_tlinks(struct work_struct *work);
  69 static int cifs_setup_volume_info(struct smb_vol *volume_info, char *mount_data,
  70                                         const char *devname);
  71
  72 /*
  73  * cifs tcp session reconnection
  74  *
  75  * mark tcp session as reconnecting so temporarily locked
  76  * mark all smb sessions as reconnecting for tcp session
  77  * reconnect tcp session
  78  * wake up waiters on reconnection? - (not needed currently)
  79  */
  80 static int
  81 cifs_reconnect(struct TCP_Server_Info *server)
  82 {
  83         int rc = 0;
  84         struct list_head *tmp, *tmp2;
  85         struct cifs_ses *ses;
  86         struct cifs_tcon *tcon;
  87         struct mid_q_entry *mid_entry;
  88         struct list_head retry_list;
  89
  90         spin_lock(&GlobalMid_Lock);
  91         if (server->tcpStatus == CifsExiting) {
  92                 /* the demux thread will exit normally
  93                 next time through the loop */
  94                 spin_unlock(&GlobalMid_Lock);
  95                 return rc;
  96         } else
  97                 server->tcpStatus = CifsNeedReconnect;
  98         spin_unlock(&GlobalMid_Lock);
  99         server->maxBuf = 0;
 100
 101         cFYI(1, "Reconnecting tcp session");
 102
 103         /* before reconnecting the tcp session, mark the smb session (uid)
 104                 and the tid bad so they are not used until reconnected */
 105         cFYI(1, "%s: marking sessions and tcons for reconnect", __func__);
 106         spin_lock(&cifs_tcp_ses_lock);
 107         list_for_each(tmp, &server->smb_ses_list) {
 108                 ses = list_entry(tmp, struct cifs_ses, smb_ses_list);
 109                 ses->need_reconnect = true;
 110                 ses->ipc_tid = 0;
 111                 list_for_each(tmp2, &ses->tcon_list) {
 112                         tcon = list_entry(tmp2, struct cifs_tcon, tcon_list);
 113                         tcon->need_reconnect = true;
 114                 }
 115         }
 116         spin_unlock(&cifs_tcp_ses_lock);
 117
 118         /* do not want to be sending data on a socket we are freeing */
 119         cFYI(1, "%s: tearing down socket", __func__);
 120         mutex_lock(&server->srv_mutex);
 121         if (server->ssocket) {
 122                 cFYI(1, "State: 0x%x Flags: 0x%lx", server->ssocket->state,
 123                         server->ssocket->flags);
 124                 kernel_sock_shutdown(server->ssocket, SHUT_WR);
 125                 cFYI(1, "Post shutdown state: 0x%x Flags: 0x%lx",
 126                         server->ssocket->state,
 127                         server->ssocket->flags);
 128                 sock_release(server->ssocket);
 129                 server->ssocket = NULL;
 130         }
 131         server->sequence_number = 0;
 132         server->session_estab = false;
 133         kfree(server->session_key.response);
 134         server->session_key.response = NULL;
 135         server->session_key.len = 0;
 136         server->lstrp = jiffies;
 137         mutex_unlock(&server->srv_mutex);
 138
 139         /* mark submitted MIDs for retry and issue callback */
 140         INIT_LIST_HEAD(&retry_list);
 141         cFYI(1, "%s: moving mids to private list", __func__);
 142         spin_lock(&GlobalMid_Lock);
 143         list_for_each_safe(tmp, tmp2, &server->pending_mid_q) {
 144                 mid_entry = list_entry(tmp, struct mid_q_entry, qhead);
 145                 if (mid_entry->midState == MID_REQUEST_SUBMITTED)
 146                         mid_entry->midState = MID_RETRY_NEEDED;
 147                 list_move(&mid_entry->qhead, &retry_list);
 148         }
 149         spin_unlock(&GlobalMid_Lock);
 150
 151         cFYI(1, "%s: issuing mid callbacks", __func__);
 152         list_for_each_safe(tmp, tmp2, &retry_list) {
 153                 mid_entry = list_entry(tmp, struct mid_q_entry, qhead);
 154                 list_del_init(&mid_entry->qhead);
 155                 mid_entry->callback(mid_entry);
 156         }
 157
 158         do {
 159                 try_to_freeze();
 160
 161                 /* we should try only the port we connected to before */
 162                 rc = generic_ip_connect(server);
 163                 if (rc) {
 164                         cFYI(1, "reconnect error %d", rc);
 165                         msleep(3000);
 166                 } else {
 167                         atomic_inc(&tcpSesReconnectCount);
 168                         spin_lock(&GlobalMid_Lock);
 169                         if (server->tcpStatus != CifsExiting)
 170                                 server->tcpStatus = CifsNeedNegotiate;
 171                         spin_unlock(&GlobalMid_Lock);
 172                 }
 173         } while (server->tcpStatus == CifsNeedReconnect);
 174
 175         return rc;
 176 }
 177
 178 /*
 179         return codes:
 180                 0       not a transact2, or all data present
 181                 >0      transact2 with that much data missing
 182                 -EINVAL = invalid transact2
 183
 184  */
 185 static int check2ndT2(struct smb_hdr *pSMB)
 186 {
 187         struct smb_t2_rsp *pSMBt;
 188         int remaining;
 189         __u16 total_data_size, data_in_this_rsp;
 190
 191         if (pSMB->Command != SMB_COM_TRANSACTION2)
 192                 return 0;
 193
 194         /* check for plausible wct, bcc and t2 data and parm sizes */
 195         /* check for parm and data offset going beyond end of smb */
 196         if (pSMB->WordCount != 10) { /* coalesce_t2 depends on this */
 197                 cFYI(1, "invalid transact2 word count");
 198                 return -EINVAL;
 199         }
 200
 201         pSMBt = (struct smb_t2_rsp *)pSMB;
 202
 203         total_data_size = get_unaligned_le16(&pSMBt->t2_rsp.TotalDataCount);
 204         data_in_this_rsp = get_unaligned_le16(&pSMBt->t2_rsp.DataCount);
 205
 206         if (total_data_size == data_in_this_rsp)
 207                 return 0;
 208         else if (total_data_size < data_in_this_rsp) {
 209                 cFYI(1, "total data %d smaller than data in frame %d",
 210                         total_data_size, data_in_this_rsp);
 211                 return -EINVAL;
 212         }
 213
 214         remaining = total_data_size - data_in_this_rsp;
 215
 216         cFYI(1, "missing %d bytes from transact2, check next response",
 217                 remaining);
 218         if (total_data_size > CIFSMaxBufSize) {
 219                 cERROR(1, "TotalDataSize %d is over maximum buffer %d",
 220                         total_data_size, CIFSMaxBufSize);
 221                 return -EINVAL;
 222         }
 223         return remaining;
 224 }
 225
 226 static int coalesce_t2(struct smb_hdr *psecond, struct smb_hdr *pTargetSMB)
 227 {
 228         struct smb_t2_rsp *pSMB2 = (struct smb_t2_rsp *)psecond;
 229         struct smb_t2_rsp *pSMBt  = (struct smb_t2_rsp *)pTargetSMB;
 230         char *data_area_of_target;
 231         char *data_area_of_buf2;
 232         int remaining;
 233         unsigned int byte_count, total_in_buf;
 234         __u16 total_data_size, total_in_buf2;
 235
 236         total_data_size = get_unaligned_le16(&pSMBt->t2_rsp.TotalDataCount);
 237
 238         if (total_data_size !=
 239             get_unaligned_le16(&pSMB2->t2_rsp.TotalDataCount))
 240                 cFYI(1, "total data size of primary and secondary t2 differ");
 241
 242         total_in_buf = get_unaligned_le16(&pSMBt->t2_rsp.DataCount);
 243
 244         remaining = total_data_size - total_in_buf;
 245
 246         if (remaining < 0)
 247                 return -EPROTO;
 248
 249         if (remaining == 0) /* nothing to do, ignore */
 250                 return 0;
 251
 252         total_in_buf2 = get_unaligned_le16(&pSMB2->t2_rsp.DataCount);
 253         if (remaining < total_in_buf2) {
 254                 cFYI(1, "transact2 2nd response contains too much data");
 255         }
 256
 257         /* find end of first SMB data area */
 258         data_area_of_target = (char *)&pSMBt->hdr.Protocol +
 259                                 get_unaligned_le16(&pSMBt->t2_rsp.DataOffset);
 260         /* validate target area */
 261
 262         data_area_of_buf2 = (char *)&pSMB2->hdr.Protocol +
 263                                 get_unaligned_le16(&pSMB2->t2_rsp.DataOffset);
 264
 265         data_area_of_target += total_in_buf;
 266
 267         /* copy second buffer into end of first buffer */
 268         total_in_buf += total_in_buf2;
 269         /* is the result too big for the field? */
 270         if (total_in_buf > USHRT_MAX)
 271                 return -EPROTO;
 272         put_unaligned_le16(total_in_buf, &pSMBt->t2_rsp.DataCount);
 273
 274         /* fix up the BCC */
 275         byte_count = get_bcc(pTargetSMB);
 276         byte_count += total_in_buf2;
 277         /* is the result too big for the field? */
 278         if (byte_count > USHRT_MAX)
 279                 return -EPROTO;
 280         put_bcc(byte_count, pTargetSMB);
 281
 282         byte_count = be32_to_cpu(pTargetSMB->smb_buf_length);
 283         byte_count += total_in_buf2;
 284         /* don't allow buffer to overflow */
 285         if (byte_count > CIFSMaxBufSize + MAX_CIFS_HDR_SIZE - 4)
 286                 return -ENOBUFS;
 287         pTargetSMB->smb_buf_length = cpu_to_be32(byte_count);
 288
 289         memcpy(data_area_of_target, data_area_of_buf2, total_in_buf2);
 290
 291         if (remaining == total_in_buf2) {
 292                 cFYI(1, "found the last secondary response");
 293                 return 0; /* we are done */
 294         } else /* more responses to go */
 295                 return 1;
 296 }
 297
 298 static void
 299 cifs_echo_request(struct work_struct *work)
 300 {
 301         int rc;
 302         struct TCP_Server_Info *server = container_of(work,
 303                                         struct TCP_Server_Info, echo.work);
 304
 305         /*
 306          * We cannot send an echo until the NEGOTIATE_PROTOCOL request is
 307          * done, which is indicated by maxBuf != 0. Also, no need to ping if
 308          * we got a response recently
 309          */
 310         if (server->maxBuf == 0 ||
 311             time_before(jiffies, server->lstrp + SMB_ECHO_INTERVAL - HZ))
 312                 goto requeue_echo;
 313
 314         rc = CIFSSMBEcho(server);
 315         if (rc)
 316                 cFYI(1, "Unable to send echo request to server: %s",
 317                         server->hostname);
 318
 319 requeue_echo:
 320         queue_delayed_work(system_nrt_wq, &server->echo, SMB_ECHO_INTERVAL);
 321 }
 322
 323 static bool
 324 allocate_buffers(struct TCP_Server_Info *server)
 325 {
 326         if (!server->bigbuf) {
 327                 server->bigbuf = (char *)cifs_buf_get();
 328                 if (!server->bigbuf) {
 329                         cERROR(1, "No memory for large SMB response");
 330                         msleep(3000);
 331                         /* retry will check if exiting */
 332                         return false;
 333                 }
 334         } else if (server->large_buf) {
 335                 /* we are reusing a dirty large buf, clear its start */
 336                 memset(server->bigbuf, 0, sizeof(struct smb_hdr));
 337         }
 338
 339         if (!server->smallbuf) {
 340                 server->smallbuf = (char *)cifs_small_buf_get();
 341                 if (!server->smallbuf) {
 342                         cERROR(1, "No memory for SMB response");
 343                         msleep(1000);
 344                         /* retry will check if exiting */
 345                         return false;
 346                 }
 347                 /* beginning of smb buffer is cleared in our buf_get */
 348         } else {
 349                 /* if existing small buf clear beginning */
 350                 memset(server->smallbuf, 0, sizeof(struct smb_hdr));
 351         }
 352
 353         return true;
 354 }
 355
 356 static bool
 357 server_unresponsive(struct TCP_Server_Info *server)
 358 {
 359         if (echo_retries > 0 && server->tcpStatus == CifsGood &&
 360             time_after(jiffies, server->lstrp +
 361                                 (echo_retries * SMB_ECHO_INTERVAL))) {
 362                 cERROR(1, "Server %s has not responded in %d seconds. "
 363                           "Reconnecting...", server->hostname,
 364                           (echo_retries * SMB_ECHO_INTERVAL / HZ));
 365                 cifs_reconnect(server);
 366                 wake_up(&server->response_q);
 367                 return true;
 368         }
 369
 370         return false;
 371 }
 372
 373 /*
 374  * kvec_array_init - clone a kvec array, and advance into it
 375  * @new:        pointer to memory for cloned array
 376  * @iov:        pointer to original array
 377  * @nr_segs:    number of members in original array
 378  * @bytes:      number of bytes to advance into the cloned array
 379  *
 380  * This function will copy the array provided in iov to a section of memory
 381  * and advance the specified number of bytes into the new array. It returns
 382  * the number of segments in the new array. "new" must be at least as big as
 383  * the original iov array.
 384  */
 385 static unsigned int
 386 kvec_array_init(struct kvec *new, struct kvec *iov, unsigned int nr_segs,
 387                 size_t bytes)
 388 {
 389         size_t base = 0;
 390
 391         while (bytes || !iov->iov_len) {
 392                 int copy = min(bytes, iov->iov_len);
 393
 394                 bytes -= copy;
 395                 base += copy;
 396                 if (iov->iov_len == base) {
 397                         iov++;
 398                         nr_segs--;
 399                         base = 0;
 400                 }
 401         }
 402         memcpy(new, iov, sizeof(*iov) * nr_segs);
 403         new->iov_base += base;
 404         new->iov_len -= base;
 405         return nr_segs;
 406 }
 407
 408 static struct kvec *
 409 get_server_iovec(struct TCP_Server_Info *server, unsigned int nr_segs)
 410 {
 411         struct kvec *new_iov;
 412
 413         if (server->iov && nr_segs <= server->nr_iov)
 414                 return server->iov;
 415
 416         /* not big enough -- allocate a new one and release the old */
 417         new_iov = kmalloc(sizeof(*new_iov) * nr_segs, GFP_NOFS);
 418         if (new_iov) {
 419                 kfree(server->iov);
 420                 server->iov = new_iov;
 421                 server->nr_iov = nr_segs;
 422         }
 423         return new_iov;
 424 }
 425
 426 int
 427 cifs_readv_from_socket(struct TCP_Server_Info *server, struct kvec *iov_orig,
 428                        unsigned int nr_segs, unsigned int to_read)
 429 {
 430         int length = 0;
 431         int total_read;
 432         unsigned int segs;
 433         struct msghdr smb_msg;
 434         struct kvec *iov;
 435
 436         iov = get_server_iovec(server, nr_segs);
 437         if (!iov)
 438                 return -ENOMEM;
 439
 440         smb_msg.msg_control = NULL;
 441         smb_msg.msg_controllen = 0;
 442
 443         for (total_read = 0; to_read; total_read += length, to_read -= length) {
 444                 try_to_freeze();
 445
 446                 if (server_unresponsive(server)) {
 447                         total_read = -EAGAIN;
 448                         break;
 449                 }
 450
 451                 segs = kvec_array_init(iov, iov_orig, nr_segs, total_read);
 452
 453                 length = kernel_recvmsg(server->ssocket, &smb_msg,
 454                                         iov, segs, to_read, 0);
 455
 456                 if (server->tcpStatus == CifsExiting) {
 457                         total_read = -ESHUTDOWN;
 458                         break;
 459                 } else if (server->tcpStatus == CifsNeedReconnect) {
 460                         cifs_reconnect(server);
 461                         total_read = -EAGAIN;
 462                         break;
 463                 } else if (length == -ERESTARTSYS ||
 464                            length == -EAGAIN ||
 465                            length == -EINTR) {
 466                         /*
 467                          * Minimum sleep to prevent looping, allowing socket
 468                          * to clear and app threads to set tcpStatus
 469                          * CifsNeedReconnect if server hung.
 470                          */
 471                         usleep_range(1000, 2000);
 472                         length = 0;
 473                         continue;
 474                 } else if (length <= 0) {
 475                         cFYI(1, "Received no data or error: expecting %d "
 476                                 "got %d", to_read, length);
 477                         cifs_reconnect(server);
 478                         total_read = -EAGAIN;
 479                         break;
 480                 }
 481         }
 482         return total_read;
 483 }
 484
 485 int
 486 cifs_read_from_socket(struct TCP_Server_Info *server, char *buf,
 487                       unsigned int to_read)
 488 {
 489         struct kvec iov;
 490
 491         iov.iov_base = buf;
 492         iov.iov_len = to_read;
 493
 494         return cifs_readv_from_socket(server, &iov, 1, to_read);
 495 }
 496
 497 static bool
 498 is_smb_response(struct TCP_Server_Info *server, unsigned char type)
 499 {
 500         /*
 501          * The first byte big endian of the length field,
 502          * is actually not part of the length but the type
 503          * with the most common, zero, as regular data.
 504          */
 505         switch (type) {
 506         case RFC1002_SESSION_MESSAGE:
 507                 /* Regular SMB response */
 508                 return true;
 509         case RFC1002_SESSION_KEEP_ALIVE:
 510                 cFYI(1, "RFC 1002 session keep alive");
 511                 break;
 512         case RFC1002_POSITIVE_SESSION_RESPONSE:
 513                 cFYI(1, "RFC 1002 positive session response");
 514                 break;
 515         case RFC1002_NEGATIVE_SESSION_RESPONSE:
 516                 /*
 517                  * We get this from Windows 98 instead of an error on
 518                  * SMB negprot response.
 519                  */
 520                 cFYI(1, "RFC 1002 negative session response");
 521                 /* give server a second to clean up */
 522                 msleep(1000);
 523                 /*
 524                  * Always try 445 first on reconnect since we get NACK
 525                  * on some if we ever connected to port 139 (the NACK
 526                  * is since we do not begin with RFC1001 session
 527                  * initialize frame).
 528                  */
 529                 cifs_set_port((struct sockaddr *)&server->dstaddr, CIFS_PORT);
 530                 cifs_reconnect(server);
 531                 wake_up(&server->response_q);
 532                 break;
 533         default:
 534                 cERROR(1, "RFC 1002 unknown response type 0x%x", type);
 535                 cifs_reconnect(server);
 536         }
 537
 538         return false;
 539 }
 540
 541 static struct mid_q_entry *
 542 find_mid(struct TCP_Server_Info *server, struct smb_hdr *buf)
 543 {
 544         struct mid_q_entry *mid;
 545
 546         spin_lock(&GlobalMid_Lock);
 547         list_for_each_entry(mid, &server->pending_mid_q, qhead) {
 548                 if (mid->mid == buf->Mid &&
 549                     mid->midState == MID_REQUEST_SUBMITTED &&
 550                     mid->command == buf->Command) {
 551                         spin_unlock(&GlobalMid_Lock);
 552                         return mid;
 553                 }
 554         }
 555         spin_unlock(&GlobalMid_Lock);
 556         return NULL;
 557 }
 558
 559 void
 560 dequeue_mid(struct mid_q_entry *mid, bool malformed)
 561 {
 562 #ifdef CONFIG_CIFS_STATS2
 563         mid->when_received = jiffies;
 564 #endif
 565         spin_lock(&GlobalMid_Lock);
 566         if (!malformed)
 567                 mid->midState = MID_RESPONSE_RECEIVED;
 568         else
 569                 mid->midState = MID_RESPONSE_MALFORMED;
 570         list_del_init(&mid->qhead);
 571         spin_unlock(&GlobalMid_Lock);
 572 }
 573
 574 static void
 575 handle_mid(struct mid_q_entry *mid, struct TCP_Server_Info *server,
 576            struct smb_hdr *buf, int malformed)
 577 {
 578         if (malformed == 0 && check2ndT2(buf) > 0) {
 579                 mid->multiRsp = true;
 580                 if (mid->resp_buf) {
 581                         /* merge response - fix up 1st*/
 582                         malformed = coalesce_t2(buf, mid->resp_buf);
 583                         if (malformed > 0)
 584                                 return;
 585
 586                         /* All parts received or packet is malformed. */
 587                         mid->multiEnd = true;
 588                         return dequeue_mid(mid, malformed);
 589                 }
 590                 if (!server->large_buf) {
 591                         /*FIXME: switch to already allocated largebuf?*/
 592                         cERROR(1, "1st trans2 resp needs bigbuf");
 593                 } else {
 594                         /* Have first buffer */
 595                         mid->resp_buf = buf;
 596                         mid->largeBuf = true;
 597                         server->bigbuf = NULL;
 598                 }
 599                 return;
 600         }
 601         mid->resp_buf = buf;
 602         mid->largeBuf = server->large_buf;
 603         /* Was previous buf put in mpx struct for multi-rsp? */
 604         if (!mid->multiRsp) {
 605                 /* smb buffer will be freed by user thread */
 606                 if (server->large_buf)
 607                         server->bigbuf = NULL;
 608                 else
 609                         server->smallbuf = NULL;
 610         }
 611         dequeue_mid(mid, malformed);
 612 }
 613
 614 static void clean_demultiplex_info(struct TCP_Server_Info *server)
 615 {
 616         int length;
 617
 618         /* take it off the list, if it's not already */
 619         spin_lock(&cifs_tcp_ses_lock);
 620         list_del_init(&server->tcp_ses_list);
 621         spin_unlock(&cifs_tcp_ses_lock);
 622
 623         spin_lock(&GlobalMid_Lock);
 624         server->tcpStatus = CifsExiting;
 625         spin_unlock(&GlobalMid_Lock);
 626         wake_up_all(&server->response_q);
 627
 628         /*
 629          * Check if we have blocked requests that need to free. Note that
 630          * cifs_max_pending is normally 50, but can be set at module install
 631          * time to as little as two.
 632          */
 633         spin_lock(&GlobalMid_Lock);
 634         if (atomic_read(&server->inFlight) >= cifs_max_pending)
 635                 atomic_set(&server->inFlight, cifs_max_pending - 1);
 636         /*
 637          * We do not want to set the max_pending too low or we could end up
 638          * with the counter going negative.
 639          */
 640         spin_unlock(&GlobalMid_Lock);
 641         /*
 642          * Although there should not be any requests blocked on this queue it
 643          * can not hurt to be paranoid and try to wake up requests that may
 644          * haven been blocked when more than 50 at time were on the wire to the
 645          * same server - they now will see the session is in exit state and get
 646          * out of SendReceive.
 647          */
 648         wake_up_all(&server->request_q);
 649         /* give those requests time to exit */
 650         msleep(125);
 651
 652         if (server->ssocket) {
 653                 sock_release(server->ssocket);
 654                 server->ssocket = NULL;
 655         }
 656
 657         if (!list_empty(&server->pending_mid_q)) {
 658                 struct list_head dispose_list;
 659                 struct mid_q_entry *mid_entry;
 660                 struct list_head *tmp, *tmp2;
 661
 662                 INIT_LIST_HEAD(&dispose_list);
 663                 spin_lock(&GlobalMid_Lock);
 664                 list_for_each_safe(tmp, tmp2, &server->pending_mid_q) {
 665                         mid_entry = list_entry(tmp, struct mid_q_entry, qhead);
 666                         cFYI(1, "Clearing mid 0x%x", mid_entry->mid);
 667                         mid_entry->midState = MID_SHUTDOWN;
 668                         list_move(&mid_entry->qhead, &dispose_list);
 669                 }
 670                 spin_unlock(&GlobalMid_Lock);
 671
 672                 /* now walk dispose list and issue callbacks */
 673                 list_for_each_safe(tmp, tmp2, &dispose_list) {
 674                         mid_entry = list_entry(tmp, struct mid_q_entry, qhead);
 675                         cFYI(1, "Callback mid 0x%x", mid_entry->mid);
 676                         list_del_init(&mid_entry->qhead);
 677                         mid_entry->callback(mid_entry);
 678                 }
 679                 /* 1/8th of sec is more than enough time for them to exit */
 680                 msleep(125);
 681         }
 682
 683         if (!list_empty(&server->pending_mid_q)) {
 684                 /*
 685                  * mpx threads have not exited yet give them at least the smb
 686                  * send timeout time for long ops.
 687                  *
 688                  * Due to delays on oplock break requests, we need to wait at
 689                  * least 45 seconds before giving up on a request getting a
 690                  * response and going ahead and killing cifsd.
 691                  */
 692                 cFYI(1, "Wait for exit from demultiplex thread");
 693                 msleep(46000);
 694                 /*
 695                  * If threads still have not exited they are probably never
 696                  * coming home not much else we can do but free the memory.
 697                  */
 698         }
 699
 700         kfree(server->hostname);
 701         kfree(server->iov);
 702         kfree(server);
 703
 704         length = atomic_dec_return(&tcpSesAllocCount);
 705         if (length > 0)
 706                 mempool_resize(cifs_req_poolp, length + cifs_min_rcv,
 707                                 GFP_KERNEL);
 708 }
 709
 710 static int
 711 standard_receive3(struct TCP_Server_Info *server, struct mid_q_entry *mid)
 712 {
 713         int length;
 714         char *buf = server->smallbuf;
 715         struct smb_hdr *smb_buffer = (struct smb_hdr *)buf;
 716         unsigned int pdu_length = be32_to_cpu(smb_buffer->smb_buf_length);
 717
 718         /* make sure this will fit in a large buffer */
 719         if (pdu_length > CIFSMaxBufSize + MAX_CIFS_HDR_SIZE - 4) {
 720                 cERROR(1, "SMB response too long (%u bytes)",
 721                         pdu_length);
 722                 cifs_reconnect(server);
 723                 wake_up(&server->response_q);
 724                 return -EAGAIN;
 725         }
 726
 727         /* switch to large buffer if too big for a small one */
 728         if (pdu_length > MAX_CIFS_SMALL_BUFFER_SIZE - 4) {
 729                 server->large_buf = true;
 730                 memcpy(server->bigbuf, server->smallbuf, server->total_read);
 731                 buf = server->bigbuf;
 732                 smb_buffer = (struct smb_hdr *)buf;
 733         }
 734
 735         /* now read the rest */
 736         length = cifs_read_from_socket(server,
 737                           buf + sizeof(struct smb_hdr) - 1,
 738                           pdu_length - sizeof(struct smb_hdr) + 1 + 4);
 739         if (length < 0)
 740                 return length;
 741         server->total_read += length;
 742
 743         dump_smb(smb_buffer, server->total_read);
 744
 745         /*
 746          * We know that we received enough to get to the MID as we
 747          * checked the pdu_length earlier. Now check to see
 748          * if the rest of the header is OK. We borrow the length
 749          * var for the rest of the loop to avoid a new stack var.
 750          *
 751          * 48 bytes is enough to display the header and a little bit
 752          * into the payload for debugging purposes.
 753          */
 754         length = checkSMB(smb_buffer, smb_buffer->Mid, server->total_read);
 755         if (length != 0)
 756                 cifs_dump_mem("Bad SMB: ", buf,
 757                         min_t(unsigned int, server->total_read, 48));
 758
 759         if (!mid)
 760                 return length;
 761
 762         handle_mid(mid, server, smb_buffer, length);
 763         return 0;
 764 }
 765
 766 static int
 767 cifs_demultiplex_thread(void *p)
 768 {
 769         int length;
 770         struct TCP_Server_Info *server = p;
 771         unsigned int pdu_length;
 772         char *buf = NULL;
 773         struct smb_hdr *smb_buffer = NULL;
 774         struct task_struct *task_to_wake = NULL;
 775         struct mid_q_entry *mid_entry;
 776
 777         current->flags |= PF_MEMALLOC;
 778         cFYI(1, "Demultiplex PID: %d", task_pid_nr(current));
 779
 780         length = atomic_inc_return(&tcpSesAllocCount);
 781         if (length > 1)
 782                 mempool_resize(cifs_req_poolp, length + cifs_min_rcv,
 783                                 GFP_KERNEL);
 784
 785         set_freezable();
 786         while (server->tcpStatus != CifsExiting) {
 787                 if (try_to_freeze())
 788                         continue;
 789
 790                 if (!allocate_buffers(server))
 791                         continue;
 792
 793                 server->large_buf = false;
 794                 smb_buffer = (struct smb_hdr *)server->smallbuf;
 795                 buf = server->smallbuf;
 796                 pdu_length = 4; /* enough to get RFC1001 header */
 797
 798                 length = cifs_read_from_socket(server, buf, pdu_length);
 799                 if (length < 0)
 800                         continue;
 801                 server->total_read = length;
 802
 803                 /*
 804                  * The right amount was read from socket - 4 bytes,
 805                  * so we can now interpret the length field.
 806                  */
 807                 pdu_length = be32_to_cpu(smb_buffer->smb_buf_length);
 808
 809                 cFYI(1, "RFC1002 header 0x%x", pdu_length);
 810                 if (!is_smb_response(server, buf[0]))
 811                         continue;
 812
 813                 /* make sure we have enough to get to the MID */
 814                 if (pdu_length < sizeof(struct smb_hdr) - 1 - 4) {
 815                         cERROR(1, "SMB response too short (%u bytes)",
 816                                 pdu_length);
 817                         cifs_reconnect(server);
 818                         wake_up(&server->response_q);
 819                         continue;
 820                 }
 821
 822                 /* read down to the MID */
 823                 length = cifs_read_from_socket(server, buf + 4,
 824                                         sizeof(struct smb_hdr) - 1 - 4);
 825                 if (length < 0)
 826                         continue;
 827                 server->total_read += length;
 828
 829                 mid_entry = find_mid(server, smb_buffer);
 830
 831                 if (!mid_entry || !mid_entry->receive)
 832                         length = standard_receive3(server, mid_entry);
 833                 else
 834                         length = mid_entry->receive(server, mid_entry);
 835
 836                 if (length < 0)
 837                         continue;
 838
 839                 if (server->large_buf) {
 840                         buf = server->bigbuf;
 841                         smb_buffer = (struct smb_hdr *)buf;
 842                 }
 843
 844                 server->lstrp = jiffies;
 845                 if (mid_entry != NULL) {
 846                         if (!mid_entry->multiRsp || mid_entry->multiEnd)
 847                                 mid_entry->callback(mid_entry);
 848                 } else if (!is_valid_oplock_break(smb_buffer, server)) {
 849                         cERROR(1, "No task to wake, unknown frame received! "
 850                                    "NumMids %d", atomic_read(&midCount));
 851                         cifs_dump_mem("Received Data is: ", buf,
 852                                       sizeof(struct smb_hdr));
 853 #ifdef CONFIG_CIFS_DEBUG2
 854                         cifs_dump_detail(smb_buffer);
 855                         cifs_dump_mids(server);
 856 #endif /* CIFS_DEBUG2 */
 857
 858                 }
 859         } /* end while !EXITING */
 860
 861         /* buffer usually freed in free_mid - need to free it here on exit */
 862         cifs_buf_release(server->bigbuf);
 863         if (server->smallbuf) /* no sense logging a debug message if NULL */
 864                 cifs_small_buf_release(server->smallbuf);
 865
 866         task_to_wake = xchg(&server->tsk, NULL);
 867         clean_demultiplex_info(server);
 868
 869         /* if server->tsk was NULL then wait for a signal before exiting */
 870         if (!task_to_wake) {
 871                 set_current_state(TASK_INTERRUPTIBLE);
 872                 while (!signal_pending(current)) {
 873                         schedule();
 874                         set_current_state(TASK_INTERRUPTIBLE);
 875                 }
 876                 set_current_state(TASK_RUNNING);
 877         }
 878
 879         module_put_and_exit(0);
 880 }
 881
 882 /* extract the host portion of the UNC string */
 883 static char *
 884 extract_hostname(const char *unc)
 885 {
 886         const char *src;
 887         char *dst, *delim;
 888         unsigned int len;
 889
 890         /* skip double chars at beginning of string */
 891         /* BB: check validity of these bytes? */
 892         src = unc + 2;
 893
 894         /* delimiter between hostname and sharename is always '\\' now */
 895         delim = strchr(src, '\\');
 896         if (!delim)
 897                 return ERR_PTR(-EINVAL);
 898
 899         len = delim - src;
 900         dst = kmalloc((len + 1), GFP_KERNEL);
 901         if (dst == NULL)
 902                 return ERR_PTR(-ENOMEM);
 903
 904         memcpy(dst, src, len);
 905         dst[len] = '\0';
 906
 907         return dst;
 908 }
 909
 910 static int
 911 cifs_parse_mount_options(const char *mountdata, const char *devname,
 912                          struct smb_vol *vol)
 913 {
 914         char *value, *data, *end;
 915         char *mountdata_copy = NULL, *options;
 916         int err;
 917         unsigned int  temp_len, i, j;
 918         char separator[2];
 919         short int override_uid = -1;
 920         short int override_gid = -1;
 921         bool uid_specified = false;
 922         bool gid_specified = false;
 923         char *nodename = utsname()->nodename;
 924
 925         separator[0] = ',';
 926         separator[1] = 0;
 927
 928         /*
 929          * does not have to be perfect mapping since field is
 930          * informational, only used for servers that do not support
 931          * port 445 and it can be overridden at mount time
 932          */
 933         memset(vol->source_rfc1001_name, 0x20, RFC1001_NAME_LEN);
 934         for (i = 0; i < strnlen(nodename, RFC1001_NAME_LEN); i++)
 935                 vol->source_rfc1001_name[i] = toupper(nodename[i]);
 936
 937         vol->source_rfc1001_name[RFC1001_NAME_LEN] = 0;
 938         /* null target name indicates to use *SMBSERVR default called name
 939            if we end up sending RFC1001 session initialize */
 940         vol->target_rfc1001_name[0] = 0;
 941         vol->cred_uid = current_uid();
 942         vol->linux_uid = current_uid();
 943         vol->linux_gid = current_gid();
 944
 945         /* default to only allowing write access to owner of the mount */
 946         vol->dir_mode = vol->file_mode = S_IRUGO | S_IXUGO | S_IWUSR;
 947
 948         /* vol->retry default is 0 (i.e. "soft" limited retry not hard retry) */
 949         /* default is always to request posix paths. */
 950         vol->posix_paths = 1;
 951         /* default to using server inode numbers where available */
 952         vol->server_ino = 1;
 953
 954         vol->actimeo = CIFS_DEF_ACTIMEO;
 955
 956         if (!mountdata)
 957                 goto cifs_parse_mount_err;
 958
 959         mountdata_copy = kstrndup(mountdata, PAGE_SIZE, GFP_KERNEL);
 960         if (!mountdata_copy)
 961                 goto cifs_parse_mount_err;
 962
 963         options = mountdata_copy;
 964         end = options + strlen(options);
 965         if (strncmp(options, "sep=", 4) == 0) {
 966                 if (options[4] != 0) {
 967                         separator[0] = options[4];
 968                         options += 5;
 969                 } else {
 970                         cFYI(1, "Null separator not allowed");
 971                 }
 972         }
 973         vol->backupuid_specified = false; /* no backup intent for a user */
 974         vol->backupgid_specified = false; /* no backup intent for a group */
 975
 976         while ((data = strsep(&options, separator)) != NULL) {
 977                 if (!*data)
 978                         continue;
 979                 if ((value = strchr(data, '=')) != NULL)
 980                         *value++ = '\0';
 981
 982                 /* Have to parse this before we parse for "user" */
 983                 if (strnicmp(data, "user_xattr", 10) == 0) {
 984                         vol->no_xattr = 0;
 985                 } else if (strnicmp(data, "nouser_xattr", 12) == 0) {
 986                         vol->no_xattr = 1;
 987                 } else if (strnicmp(data, "user", 4) == 0) {
 988                         if (!value) {
 989                                 printk(KERN_WARNING
 990                                        "CIFS: invalid or missing username\n");
 991                                 goto cifs_parse_mount_err;
 992                         } else if (!*value) {
 993                                 /* null user, ie anonymous, authentication */
 994                                 vol->nullauth = 1;
 995                         }
 996                         if (strnlen(value, MAX_USERNAME_SIZE) <
 997                                                 MAX_USERNAME_SIZE) {
 998                                 vol->username = kstrdup(value, GFP_KERNEL);
 999                                 if (!vol->username) {
1000                                         printk(KERN_WARNING "CIFS: no memory "
1001                                                             "for username\n");
1002                                         goto cifs_parse_mount_err;
1003                                 }
1004                         } else {
1005                                 printk(KERN_WARNING "CIFS: username too long\n");
1006                                 goto cifs_parse_mount_err;
1007                         }
1008                 } else if (strnicmp(data, "pass", 4) == 0) {
1009                         if (!value) {
1010                                 vol->password = NULL;
1011                                 continue;
1012                         } else if (value[0] == 0) {
1013                                 /* check if string begins with double comma
1014                                    since that would mean the password really
1015                                    does start with a comma, and would not
1016                                    indicate an empty string */
1017                                 if (value[1] != separator[0]) {
1018                                         vol->password = NULL;
1019                                         continue;
1020                                 }
1021                         }
1022                         temp_len = strlen(value);
1023                         /* removed password length check, NTLM passwords
1024                                 can be arbitrarily long */
1025
1026                         /* if comma in password, the string will be
1027                         prematurely null terminated.  Commas in password are
1028                         specified across the cifs mount interface by a double
1029                         comma ie ,, and a comma used as in other cases ie ','
1030                         as a parameter delimiter/separator is single and due
1031                         to the strsep above is temporarily zeroed. */
1032
1033                         /* NB: password legally can have multiple commas and
1034                         the only illegal character in a password is null */
1035
1036                         if ((value[temp_len] == 0) &&
1037                             (value + temp_len < end) &&
1038                             (value[temp_len+1] == separator[0])) {
1039                                 /* reinsert comma */
1040                                 value[temp_len] = separator[0];
1041                                 temp_len += 2;  /* move after second comma */
1042                                 while (value[temp_len] != 0)  {
1043                                         if (value[temp_len] == separator[0]) {
1044                                                 if (value[temp_len+1] ==
1045                                                      separator[0]) {
1046                                                 /* skip second comma */
1047                                                         temp_len++;
1048                                                 } else {
1049                                                 /* single comma indicating start
1050                                                          of next parm */
1051                                                         break;
1052                                                 }
1053                                         }
1054                                         temp_len++;
1055                                 }
1056                                 if (value[temp_len] == 0) {
1057                                         options = NULL;
1058                                 } else {
1059                                         value[temp_len] = 0;
1060                                         /* point option to start of next parm */
1061                                         options = value + temp_len + 1;
1062                                 }
1063                                 /* go from value to value + temp_len condensing
1064                                 double commas to singles. Note that this ends up
1065                                 allocating a few bytes too many, which is ok */
1066                                 vol->password = kzalloc(temp_len, GFP_KERNEL);
1067                                 if (vol->password == NULL) {
1068                                         printk(KERN_WARNING "CIFS: no memory "
1069                                                             "for password\n");
1070                                         goto cifs_parse_mount_err;
1071                                 }
1072                                 for (i = 0, j = 0; i < temp_len; i++, j++) {
1073                                         vol->password[j] = value[i];
1074                                         if (value[i] == separator[0]
1075                                                 && value[i+1] == separator[0]) {
1076                                                 /* skip second comma */
1077                                                 i++;
1078                                         }
1079                                 }
1080                                 vol->password[j] = 0;
1081                         } else {
1082                                 vol->password = kzalloc(temp_len+1, GFP_KERNEL);
1083                                 if (vol->password == NULL) {
1084                                         printk(KERN_WARNING "CIFS: no memory "
1085                                                             "for password\n");
1086                                         goto cifs_parse_mount_err;
1087                                 }
1088                                 strcpy(vol->password, value);
1089                         }
1090                 } else if (!strnicmp(data, "ip", 2) ||
1091                            !strnicmp(data, "addr", 4)) {
1092                         if (!value || !*value) {
1093                                 vol->UNCip = NULL;
1094                         } else if (strnlen(value, INET6_ADDRSTRLEN) <
1095                                                         INET6_ADDRSTRLEN) {
1096                                 vol->UNCip = kstrdup(value, GFP_KERNEL);
1097                                 if (!vol->UNCip) {
1098                                         printk(KERN_WARNING "CIFS: no memory "
1099                                                             "for UNC IP\n");
1100                                         goto cifs_parse_mount_err;
1101                                 }
1102                         } else {
1103                                 printk(KERN_WARNING "CIFS: ip address "
1104                                                     "too long\n");
1105                                 goto cifs_parse_mount_err;
1106                         }
1107                 } else if (strnicmp(data, "sec", 3) == 0) {
1108                         if (!value || !*value) {
1109                                 cERROR(1, "no security value specified");
1110                                 continue;
1111                         } else if (strnicmp(value, "krb5i", 5) == 0) {
1112                                 vol->secFlg |= CIFSSEC_MAY_KRB5 |
1113                                         CIFSSEC_MUST_SIGN;
1114                         } else if (strnicmp(value, "krb5p", 5) == 0) {
1115                                 /* vol->secFlg |= CIFSSEC_MUST_SEAL |
1116                                         CIFSSEC_MAY_KRB5; */
1117                                 cERROR(1, "Krb5 cifs privacy not supported");
1118                                 goto cifs_parse_mount_err;
1119                         } else if (strnicmp(value, "krb5", 4) == 0) {
1120                                 vol->secFlg |= CIFSSEC_MAY_KRB5;
1121                         } else if (strnicmp(value, "ntlmsspi", 8) == 0) {
1122                                 vol->secFlg |= CIFSSEC_MAY_NTLMSSP |
1123                                         CIFSSEC_MUST_SIGN;
1124                         } else if (strnicmp(value, "ntlmssp", 7) == 0) {
1125                                 vol->secFlg |= CIFSSEC_MAY_NTLMSSP;
1126                         } else if (strnicmp(value, "ntlmv2i", 7) == 0) {
1127                                 vol->secFlg |= CIFSSEC_MAY_NTLMV2 |
1128                                         CIFSSEC_MUST_SIGN;
1129                         } else if (strnicmp(value, "ntlmv2", 6) == 0) {
1130                                 vol->secFlg |= CIFSSEC_MAY_NTLMV2;
1131                         } else if (strnicmp(value, "ntlmi", 5) == 0) {
1132                                 vol->secFlg |= CIFSSEC_MAY_NTLM |
1133                                         CIFSSEC_MUST_SIGN;
1134                         } else if (strnicmp(value, "ntlm", 4) == 0) {
1135                                 /* ntlm is default so can be turned off too */
1136                                 vol->secFlg |= CIFSSEC_MAY_NTLM;
1137                         } else if (strnicmp(value, "nontlm", 6) == 0) {
1138                                 /* BB is there a better way to do this? */
1139                                 vol->secFlg |= CIFSSEC_MAY_NTLMV2;
1140 #ifdef CONFIG_CIFS_WEAK_PW_HASH
1141                         } else if (strnicmp(value, "lanman", 6) == 0) {
1142                                 vol->secFlg |= CIFSSEC_MAY_LANMAN;
1143 #endif
1144                         } else if (strnicmp(value, "none", 4) == 0) {
1145                                 vol->nullauth = 1;
1146                         } else {
1147                                 cERROR(1, "bad security option: %s", value);
1148                                 goto cifs_parse_mount_err;
1149                         }
1150                 } else if (strnicmp(data, "vers", 3) == 0) {
1151                         if (!value || !*value) {
1152                                 cERROR(1, "no protocol version specified"
1153                                           " after vers= mount option");
1154                         } else if ((strnicmp(value, "cifs", 4) == 0) ||
1155                                    (strnicmp(value, "1", 1) == 0)) {
1156                                 /* this is the default */
1157                                 continue;
1158                         }
1159                 } else if ((strnicmp(data, "unc", 3) == 0)
1160                            || (strnicmp(data, "target", 6) == 0)
1161                            || (strnicmp(data, "path", 4) == 0)) {
1162                         if (!value || !*value) {
1163                                 printk(KERN_WARNING "CIFS: invalid path to "
1164                                                     "network resource\n");
1165                                 goto cifs_parse_mount_err;
1166                         }
1167                         if ((temp_len = strnlen(value, 300)) < 300) {
1168                                 vol->UNC = kmalloc(temp_len+1, GFP_KERNEL);
1169                                 if (vol->UNC == NULL)
1170                                         goto cifs_parse_mount_err;
1171                                 strcpy(vol->UNC, value);
1172                                 if (strncmp(vol->UNC, "//", 2) == 0) {
1173                                         vol->UNC[0] = '\\';
1174                                         vol->UNC[1] = '\\';
1175                                 } else if (strncmp(vol->UNC, "\\\\", 2) != 0) {
1176                                         printk(KERN_WARNING
1177                                                "CIFS: UNC Path does not begin "
1178                                                "with // or \\\\ \n");
1179                                         goto cifs_parse_mount_err;
1180                                 }
1181                         } else {
1182                                 printk(KERN_WARNING "CIFS: UNC name too long\n");
1183                                 goto cifs_parse_mount_err;
1184                         }
1185                 } else if ((strnicmp(data, "domain", 3) == 0)
1186                            || (strnicmp(data, "workgroup", 5) == 0)) {
1187                         if (!value || !*value) {
1188                                 printk(KERN_WARNING "CIFS: invalid domain name\n");
1189                                 goto cifs_parse_mount_err;
1190                         }
1191                         /* BB are there cases in which a comma can be valid in
1192                         a domain name and need special handling? */
1193                         if (strnlen(value, 256) < 256) {
1194                                 vol->domainname = kstrdup(value, GFP_KERNEL);
1195                                 if (!vol->domainname) {
1196                                         printk(KERN_WARNING "CIFS: no memory "
1197                                                             "for domainname\n");
1198                                         goto cifs_parse_mount_err;
1199                                 }
1200                                 cFYI(1, "Domain name set");
1201                         } else {
1202                                 printk(KERN_WARNING "CIFS: domain name too "
1203                                                     "long\n");
1204                                 goto cifs_parse_mount_err;
1205                         }
1206                 } else if (strnicmp(data, "srcaddr", 7) == 0) {
1207                         vol->srcaddr.ss_family = AF_UNSPEC;
1208
1209                         if (!value || !*value) {
1210                                 printk(KERN_WARNING "CIFS: srcaddr value"
1211                                        " not specified.\n");
1212                                 goto cifs_parse_mount_err;
1213                         }
1214                         i = cifs_convert_address((struct sockaddr *)&vol->srcaddr,
1215                                                  value, strlen(value));
1216                         if (i == 0) {
1217                                 printk(KERN_WARNING "CIFS:  Could not parse"
1218                                        " srcaddr: %s\n",
1219                                        value);
1220                                 goto cifs_parse_mount_err;
1221                         }
1222                 } else if (strnicmp(data, "prefixpath", 10) == 0) {
1223                         if (!value || !*value) {
1224                                 printk(KERN_WARNING
1225                                         "CIFS: invalid path prefix\n");
1226                                 goto cifs_parse_mount_err;
1227                         }
1228                         if ((temp_len = strnlen(value, 1024)) < 1024) {
1229                                 if (value[0] != '/')
1230                                         temp_len++;  /* missing leading slash */
1231                                 vol->prepath = kmalloc(temp_len+1, GFP_KERNEL);
1232                                 if (vol->prepath == NULL)
1233                                         goto cifs_parse_mount_err;
1234                                 if (value[0] != '/') {
1235                                         vol->prepath[0] = '/';
1236                                         strcpy(vol->prepath+1, value);
1237                                 } else
1238                                         strcpy(vol->prepath, value);
1239                                 cFYI(1, "prefix path %s", vol->prepath);
1240                         } else {
1241                                 printk(KERN_WARNING "CIFS: prefix too long\n");
1242                                 goto cifs_parse_mount_err;
1243                         }
1244                 } else if (strnicmp(data, "iocharset", 9) == 0) {
1245                         if (!value || !*value) {
1246                                 printk(KERN_WARNING "CIFS: invalid iocharset "
1247                                                     "specified\n");
1248                                 goto cifs_parse_mount_err;
1249                         }
1250                         if (strnlen(value, 65) < 65) {
1251                                 if (strnicmp(value, "default", 7)) {
1252                                         vol->iocharset = kstrdup(value,
1253                                                                  GFP_KERNEL);
1254
1255                                         if (!vol->iocharset) {
1256                                                 printk(KERN_WARNING "CIFS: no "
1257                                                                    "memory for"
1258                                                                    "charset\n");
1259                                                 goto cifs_parse_mount_err;
1260                                         }
1261                                 }
1262                                 /* if iocharset not set then load_nls_default
1263                                    is used by caller */
1264                                 cFYI(1, "iocharset set to %s", value);
1265                         } else {
1266                                 printk(KERN_WARNING "CIFS: iocharset name "
1267                                                     "too long.\n");
1268                                 goto cifs_parse_mount_err;
1269                         }
1270                 } else if (!strnicmp(data, "uid", 3) && value && *value) {
1271                         vol->linux_uid = simple_strtoul(value, &value, 0);
1272                         uid_specified = true;
1273                 } else if (!strnicmp(data, "cruid", 5) && value && *value) {
1274                         vol->cred_uid = simple_strtoul(value, &value, 0);
1275                 } else if (!strnicmp(data, "forceuid", 8)) {
1276                         override_uid = 1;
1277                 } else if (!strnicmp(data, "noforceuid", 10)) {
1278                         override_uid = 0;
1279                 } else if (!strnicmp(data, "gid", 3) && value && *value) {
1280                         vol->linux_gid = simple_strtoul(value, &value, 0);
1281                         gid_specified = true;
1282                 } else if (!strnicmp(data, "forcegid", 8)) {
1283                         override_gid = 1;
1284                 } else if (!strnicmp(data, "noforcegid", 10)) {
1285                         override_gid = 0;
1286                 } else if (strnicmp(data, "file_mode", 4) == 0) {
1287                         if (value && *value) {
1288                                 vol->file_mode =
1289                                         simple_strtoul(value, &value, 0);
1290                         }
1291                 } else if (strnicmp(data, "dir_mode", 4) == 0) {
1292                         if (value && *value) {
1293                                 vol->dir_mode =
1294                                         simple_strtoul(value, &value, 0);
1295                         }
1296                 } else if (strnicmp(data, "dirmode", 4) == 0) {
1297                         if (value && *value) {
1298                                 vol->dir_mode =
1299                                         simple_strtoul(value, &value, 0);
1300                         }
1301                 } else if (strnicmp(data, "port", 4) == 0) {
1302                         if (value && *value) {
1303                                 vol->port =
1304                                         simple_strtoul(value, &value, 0);
1305                         }
1306                 } else if (strnicmp(data, "rsize", 5) == 0) {
1307                         if (value && *value) {
1308                                 vol->rsize =
1309                                         simple_strtoul(value, &value, 0);
1310                         }
1311                 } else if (strnicmp(data, "wsize", 5) == 0) {
1312                         if (value && *value) {
1313                                 vol->wsize =
1314                                         simple_strtoul(value, &value, 0);
1315                         }
1316                 } else if (strnicmp(data, "sockopt", 5) == 0) {
1317                         if (!value || !*value) {
1318                                 cERROR(1, "no socket option specified");
1319                                 continue;
1320                         } else if (strnicmp(value, "TCP_NODELAY", 11) == 0) {
1321                                 vol->sockopt_tcp_nodelay = 1;
1322                         }
1323                 } else if (strnicmp(data, "netbiosname", 4) == 0) {
1324                         if (!value || !*value || (*value == ' ')) {
1325                                 cFYI(1, "invalid (empty) netbiosname");
1326                         } else {
1327                                 memset(vol->source_rfc1001_name, 0x20,
1328                                         RFC1001_NAME_LEN);
1329                                 /*
1330                                  * FIXME: are there cases in which a comma can
1331                                  * be valid in workstation netbios name (and
1332                                  * need special handling)?
1333                                  */
1334                                 for (i = 0; i < RFC1001_NAME_LEN; i++) {
1335                                         /* don't ucase netbiosname for user */
1336                                         if (value[i] == 0)
1337                                                 break;
1338                                         vol->source_rfc1001_name[i] = value[i];
1339                                 }
1340                                 /* The string has 16th byte zero still from
1341                                 set at top of the function  */
1342                                 if (i == RFC1001_NAME_LEN && value[i] != 0)
1343                                         printk(KERN_WARNING "CIFS: netbiosname"
1344                                                 " longer than 15 truncated.\n");
1345                         }
1346                 } else if (strnicmp(data, "servern", 7) == 0) {
1347                         /* servernetbiosname specified override *SMBSERVER */
1348                         if (!value || !*value || (*value == ' ')) {
1349                                 cFYI(1, "empty server netbiosname specified");
1350                         } else {
1351                                 /* last byte, type, is 0x20 for servr type */
1352                                 memset(vol->target_rfc1001_name, 0x20,
1353                                         RFC1001_NAME_LEN_WITH_NULL);
1354
1355                                 for (i = 0; i < 15; i++) {
1356                                 /* BB are there cases in which a comma can be
1357                                    valid in this workstation netbios name
1358                                    (and need special handling)? */
1359
1360                                 /* user or mount helper must uppercase
1361                                    the netbiosname */
1362                                         if (value[i] == 0)
1363                                                 break;
1364                                         else
1365                                                 vol->target_rfc1001_name[i] =
1366                                                                 value[i];
1367                                 }
1368                                 /* The string has 16th byte zero still from
1369                                    set at top of the function  */
1370                                 if (i == RFC1001_NAME_LEN && value[i] != 0)
1371                                         printk(KERN_WARNING "CIFS: server net"
1372                                         "biosname longer than 15 truncated.\n");
1373                         }
1374                 } else if (strnicmp(data, "actimeo", 7) == 0) {
1375                         if (value && *value) {
1376                                 vol->actimeo = HZ * simple_strtoul(value,
1377                                                                    &value, 0);
1378                                 if (vol->actimeo > CIFS_MAX_ACTIMEO) {
1379                                         cERROR(1, "CIFS: attribute cache"
1380                                                         "timeout too large");
1381                                         goto cifs_parse_mount_err;
1382                                 }
1383                         }
1384                 } else if (strnicmp(data, "credentials", 4) == 0) {
1385                         /* ignore */
1386                 } else if (strnicmp(data, "version", 3) == 0) {
1387                         /* ignore */
1388                 } else if (strnicmp(data, "guest", 5) == 0) {
1389                         /* ignore */
1390                 } else if (strnicmp(data, "rw", 2) == 0 && strlen(data) == 2) {
1391                         /* ignore */
1392                 } else if (strnicmp(data, "ro", 2) == 0) {
1393                         /* ignore */
1394                 } else if (strnicmp(data, "noblocksend", 11) == 0) {
1395                         vol->noblocksnd = 1;
1396                 } else if (strnicmp(data, "noautotune", 10) == 0) {
1397                         vol->noautotune = 1;
1398                 } else if ((strnicmp(data, "suid", 4) == 0) ||
1399                                    (strnicmp(data, "nosuid", 6) == 0) ||
1400                                    (strnicmp(data, "exec", 4) == 0) ||
1401                                    (strnicmp(data, "noexec", 6) == 0) ||
1402                                    (strnicmp(data, "nodev", 5) == 0) ||
1403                                    (strnicmp(data, "noauto", 6) == 0) ||
1404                                    (strnicmp(data, "dev", 3) == 0)) {
1405                         /*  The mount tool or mount.cifs helper (if present)
1406                             uses these opts to set flags, and the flags are read
1407                             by the kernel vfs layer before we get here (ie
1408                             before read super) so there is no point trying to
1409                             parse these options again and set anything and it
1410                             is ok to just ignore them */
1411                         continue;
1412                 } else if (strnicmp(data, "hard", 4) == 0) {
1413                         vol->retry = 1;
1414                 } else if (strnicmp(data, "soft", 4) == 0) {
1415                         vol->retry = 0;
1416                 } else if (strnicmp(data, "perm", 4) == 0) {
1417                         vol->noperm = 0;
1418                 } else if (strnicmp(data, "noperm", 6) == 0) {
1419                         vol->noperm = 1;
1420                 } else if (strnicmp(data, "mapchars", 8) == 0) {
1421                         vol->remap = 1;
1422                 } else if (strnicmp(data, "nomapchars", 10) == 0) {
1423                         vol->remap = 0;
1424                 } else if (strnicmp(data, "sfu", 3) == 0) {
1425                         vol->sfu_emul = 1;
1426                 } else if (strnicmp(data, "nosfu", 5) == 0) {
1427                         vol->sfu_emul = 0;
1428                 } else if (strnicmp(data, "nodfs", 5) == 0) {
1429                         vol->nodfs = 1;
1430                 } else if (strnicmp(data, "posixpaths", 10) == 0) {
1431                         vol->posix_paths = 1;
1432                 } else if (strnicmp(data, "noposixpaths", 12) == 0) {
1433                         vol->posix_paths = 0;
1434                 } else if (strnicmp(data, "nounix", 6) == 0) {
1435                         vol->no_linux_ext = 1;
1436                 } else if (strnicmp(data, "nolinux", 7) == 0) {
1437                         vol->no_linux_ext = 1;
1438                 } else if ((strnicmp(data, "nocase", 6) == 0) ||
1439                            (strnicmp(data, "ignorecase", 10)  == 0)) {
1440                         vol->nocase = 1;
1441                 } else if (strnicmp(data, "mand", 4) == 0) {
1442                         /* ignore */
1443                 } else if (strnicmp(data, "nomand", 6) == 0) {
1444                         /* ignore */
1445                 } else if (strnicmp(data, "_netdev", 7) == 0) {
1446                         /* ignore */
1447                 } else if (strnicmp(data, "brl", 3) == 0) {
1448                         vol->nobrl =  0;
1449                 } else if ((strnicmp(data, "nobrl", 5) == 0) ||
1450                            (strnicmp(data, "nolock", 6) == 0)) {
1451                         vol->nobrl =  1;
1452                         /* turn off mandatory locking in mode
1453                         if remote locking is turned off since the
1454                         local vfs will do advisory */
1455                         if (vol->file_mode ==
1456                                 (S_IALLUGO & ~(S_ISUID | S_IXGRP)))
1457                                 vol->file_mode = S_IALLUGO;
1458                 } else if (strnicmp(data, "forcemandatorylock", 9) == 0) {
1459                         /* will take the shorter form "forcemand" as well */
1460                         /* This mount option will force use of mandatory
1461                           (DOS/Windows style) byte range locks, instead of
1462                           using posix advisory byte range locks, even if the
1463                           Unix extensions are available and posix locks would
1464                           be supported otherwise. If Unix extensions are not
1465                           negotiated this has no effect since mandatory locks
1466                           would be used (mandatory locks is all that those
1467                           those servers support) */
1468                         vol->mand_lock = 1;
1469                 } else if (strnicmp(data, "setuids", 7) == 0) {
1470                         vol->setuids = 1;
1471                 } else if (strnicmp(data, "nosetuids", 9) == 0) {
1472                         vol->setuids = 0;
1473                 } else if (strnicmp(data, "dynperm", 7) == 0) {
1474                         vol->dynperm = true;
1475                 } else if (strnicmp(data, "nodynperm", 9) == 0) {
1476                         vol->dynperm = false;
1477                 } else if (strnicmp(data, "nohard", 6) == 0) {
1478                         vol->retry = 0;
1479                 } else if (strnicmp(data, "nosoft", 6) == 0) {
1480                         vol->retry = 1;
1481                 } else if (strnicmp(data, "nointr", 6) == 0) {
1482                         vol->intr = 0;
1483                 } else if (strnicmp(data, "intr", 4) == 0) {
1484                         vol->intr = 1;
1485                 } else if (strnicmp(data, "nostrictsync", 12) == 0) {
1486                         vol->nostrictsync = 1;
1487                 } else if (strnicmp(data, "strictsync", 10) == 0) {
1488                         vol->nostrictsync = 0;
1489                 } else if (strnicmp(data, "serverino", 7) == 0) {
1490                         vol->server_ino = 1;
1491                 } else if (strnicmp(data, "noserverino", 9) == 0) {
1492                         vol->server_ino = 0;
1493                 } else if (strnicmp(data, "rwpidforward", 12) == 0) {
1494                         vol->rwpidforward = 1;
1495                 } else if (strnicmp(data, "cifsacl", 7) == 0) {
1496                         vol->cifs_acl = 1;
1497                 } else if (strnicmp(data, "nocifsacl", 9) == 0) {
1498                         vol->cifs_acl = 0;
1499                 } else if (strnicmp(data, "acl", 3) == 0) {
1500                         vol->no_psx_acl = 0;
1501                 } else if (strnicmp(data, "noacl", 5) == 0) {
1502                         vol->no_psx_acl = 1;
1503                 } else if (strnicmp(data, "locallease", 6) == 0) {
1504                         vol->local_lease = 1;
1505                 } else if (strnicmp(data, "sign", 4) == 0) {
1506                         vol->secFlg |= CIFSSEC_MUST_SIGN;
1507                 } else if (strnicmp(data, "seal", 4) == 0) {
1508                         /* we do not do the following in secFlags because seal
1509                            is a per tree connection (mount) not a per socket
1510                            or per-smb connection option in the protocol */
1511                         /* vol->secFlg |= CIFSSEC_MUST_SEAL; */
1512                         vol->seal = 1;
1513                 } else if (strnicmp(data, "direct", 6) == 0) {
1514                         vol->direct_io = 1;
1515                 } else if (strnicmp(data, "forcedirectio", 13) == 0) {
1516                         vol->direct_io = 1;
1517                 } else if (strnicmp(data, "strictcache", 11) == 0) {
1518                         vol->strict_io = 1;
1519                 } else if (strnicmp(data, "noac", 4) == 0) {
1520                         printk(KERN_WARNING "CIFS: Mount option noac not "
1521                                 "supported. Instead set "
1522                                 "/proc/fs/cifs/LookupCacheEnabled to 0\n");
1523                 } else if (strnicmp(data, "fsc", 3) == 0) {
1524 #ifndef CONFIG_CIFS_FSCACHE
1525                         cERROR(1, "FS-Cache support needs CONFIG_CIFS_FSCACHE "
1526                                   "kernel config option set");
1527                         goto cifs_parse_mount_err;
1528 #endif
1529                         vol->fsc = true;
1530                 } else if (strnicmp(data, "mfsymlinks", 10) == 0) {
1531                         vol->mfsymlinks = true;
1532                 } else if (strnicmp(data, "multiuser", 8) == 0) {
1533                         vol->multiuser = true;
1534                 } else if (!strnicmp(data, "backupuid", 9) && value && *value) {
1535                         err = kstrtouint(value, 0, &vol->backupuid);
1536                         if (err < 0) {
1537                                 cERROR(1, "%s: Invalid backupuid value",
1538                                         __func__);
1539                                 goto cifs_parse_mount_err;
1540                         }
1541                         vol->backupuid_specified = true;
1542                 } else if (!strnicmp(data, "backupgid", 9) && value && *value) {
1543                         err = kstrtouint(value, 0, &vol->backupgid);
1544                         if (err < 0) {
1545                                 cERROR(1, "%s: Invalid backupgid value",
1546                                         __func__);
1547                                 goto cifs_parse_mount_err;
1548                         }
1549                         vol->backupgid_specified = true;
1550                 } else
1551                         printk(KERN_WARNING "CIFS: Unknown mount option %s\n",
1552                                                 data);
1553         }
1554         if (vol->UNC == NULL) {
1555                 if (devname == NULL) {
1556                         printk(KERN_WARNING "CIFS: Missing UNC name for mount "
1557                                                 "target\n");
1558                         goto cifs_parse_mount_err;
1559                 }
1560                 if ((temp_len = strnlen(devname, 300)) < 300) {
1561                         vol->UNC = kmalloc(temp_len+1, GFP_KERNEL);
1562                         if (vol->UNC == NULL)
1563                                 goto cifs_parse_mount_err;
1564                         strcpy(vol->UNC, devname);
1565                         if (strncmp(vol->UNC, "//", 2) == 0) {
1566                                 vol->UNC[0] = '\\';
1567                                 vol->UNC[1] = '\\';
1568                         } else if (strncmp(vol->UNC, "\\\\", 2) != 0) {
1569                                 printk(KERN_WARNING "CIFS: UNC Path does not "
1570                                                     "begin with // or \\\\ \n");
1571                                 goto cifs_parse_mount_err;
1572                         }
1573                         value = strpbrk(vol->UNC+2, "/\\");
1574                         if (value)
1575                                 *value = '\\';
1576                 } else {
1577                         printk(KERN_WARNING "CIFS: UNC name too long\n");
1578                         goto cifs_parse_mount_err;
1579                 }
1580         }
1581
1582         if (vol->multiuser && !(vol->secFlg & CIFSSEC_MAY_KRB5)) {
1583                 cERROR(1, "Multiuser mounts currently require krb5 "
1584                           "authentication!");
1585                 goto cifs_parse_mount_err;
1586         }
1587
1588         if (vol->UNCip == NULL)
1589                 vol->UNCip = &vol->UNC[2];
1590
1591         if (uid_specified)
1592                 vol->override_uid = override_uid;
1593         else if (override_uid == 1)
1594                 printk(KERN_NOTICE "CIFS: ignoring forceuid mount option "
1595                                    "specified with no uid= option.\n");
1596
1597         if (gid_specified)
1598                 vol->override_gid = override_gid;
1599         else if (override_gid == 1)
1600                 printk(KERN_NOTICE "CIFS: ignoring forcegid mount option "
1601                                    "specified with no gid= option.\n");
1602
1603         kfree(mountdata_copy);
1604         return 0;
1605
1606 cifs_parse_mount_err:
1607         kfree(mountdata_copy);
1608         return 1;
1609 }
1610
1611 /** Returns true if srcaddr isn't specified and rhs isn't
1612  * specified, or if srcaddr is specified and
1613  * matches the IP address of the rhs argument.
1614  */
1615 static bool
1616 srcip_matches(struct sockaddr *srcaddr, struct sockaddr *rhs)
1617 {
1618         switch (srcaddr->sa_family) {
1619         case AF_UNSPEC:
1620                 return (rhs->sa_family == AF_UNSPEC);
1621         case AF_INET: {
1622                 struct sockaddr_in *saddr4 = (struct sockaddr_in *)srcaddr;
1623                 struct sockaddr_in *vaddr4 = (struct sockaddr_in *)rhs;
1624                 return (saddr4->sin_addr.s_addr == vaddr4->sin_addr.s_addr);
1625         }
1626         case AF_INET6: {
1627                 struct sockaddr_in6 *saddr6 = (struct sockaddr_in6 *)srcaddr;
1628                 struct sockaddr_in6 *vaddr6 = (struct sockaddr_in6 *)&rhs;
1629                 return ipv6_addr_equal(&saddr6->sin6_addr, &vaddr6->sin6_addr);
1630         }
1631         default:
1632                 WARN_ON(1);
1633                 return false; /* don't expect to be here */
1634         }
1635 }
1636
1637 /*
1638  * If no port is specified in addr structure, we try to match with 445 port
1639  * and if it fails - with 139 ports. It should be called only if address
1640  * families of server and addr are equal.
1641  */
1642 static bool
1643 match_port(struct TCP_Server_Info *server, struct sockaddr *addr)
1644 {
1645         __be16 port, *sport;
1646
1647         switch (addr->sa_family) {
1648         case AF_INET:
1649                 sport = &((struct sockaddr_in *) &server->dstaddr)->sin_port;
1650                 port = ((struct sockaddr_in *) addr)->sin_port;
1651                 break;
1652         case AF_INET6:
1653                 sport = &((struct sockaddr_in6 *) &server->dstaddr)->sin6_port;
1654                 port = ((struct sockaddr_in6 *) addr)->sin6_port;
1655                 break;
1656         default:
1657                 WARN_ON(1);
1658                 return false;
1659         }
1660
1661         if (!port) {
1662                 port = htons(CIFS_PORT);
1663                 if (port == *sport)
1664                         return true;
1665
1666                 port = htons(RFC1001_PORT);
1667         }
1668
1669         return port == *sport;
1670 }
1671
1672 static bool
1673 match_address(struct TCP_Server_Info *server, struct sockaddr *addr,
1674               struct sockaddr *srcaddr)
1675 {
1676         switch (addr->sa_family) {
1677         case AF_INET: {
1678                 struct sockaddr_in *addr4 = (struct sockaddr_in *)addr;
1679                 struct sockaddr_in *srv_addr4 =
1680                                         (struct sockaddr_in *)&server->dstaddr;
1681
1682                 if (addr4->sin_addr.s_addr != srv_addr4->sin_addr.s_addr)
1683                         return false;
1684                 break;
1685         }
1686         case AF_INET6: {
1687                 struct sockaddr_in6 *addr6 = (struct sockaddr_in6 *)addr;
1688                 struct sockaddr_in6 *srv_addr6 =
1689                                         (struct sockaddr_in6 *)&server->dstaddr;
1690
1691                 if (!ipv6_addr_equal(&addr6->sin6_addr,
1692                                      &srv_addr6->sin6_addr))
1693                         return false;
1694                 if (addr6->sin6_scope_id != srv_addr6->sin6_scope_id)
1695                         return false;
1696                 break;
1697         }
1698         default:
1699                 WARN_ON(1);
1700                 return false; /* don't expect to be here */
1701         }
1702
1703         if (!srcip_matches(srcaddr, (struct sockaddr *)&server->srcaddr))
1704                 return false;
1705
1706         return true;
1707 }
1708
1709 static bool
1710 match_security(struct TCP_Server_Info *server, struct smb_vol *vol)
1711 {
1712         unsigned int secFlags;
1713
1714         if (vol->secFlg & (~(CIFSSEC_MUST_SIGN | CIFSSEC_MUST_SEAL)))
1715                 secFlags = vol->secFlg;
1716         else
1717                 secFlags = global_secflags | vol->secFlg;
1718
1719         switch (server->secType) {
1720         case LANMAN:
1721                 if (!(secFlags & (CIFSSEC_MAY_LANMAN|CIFSSEC_MAY_PLNTXT)))
1722                         return false;
1723                 break;
1724         case NTLMv2:
1725                 if (!(secFlags & CIFSSEC_MAY_NTLMV2))
1726                         return false;
1727                 break;
1728         case NTLM:
1729                 if (!(secFlags & CIFSSEC_MAY_NTLM))
1730                         return false;
1731                 break;
1732         case Kerberos:
1733                 if (!(secFlags & CIFSSEC_MAY_KRB5))
1734                         return false;
1735                 break;
1736         case RawNTLMSSP:
1737                 if (!(secFlags & CIFSSEC_MAY_NTLMSSP))
1738                         return false;
1739                 break;
1740         default:
1741                 /* shouldn't happen */
1742                 return false;
1743         }
1744
1745         /* now check if signing mode is acceptable */
1746         if ((secFlags & CIFSSEC_MAY_SIGN) == 0 &&
1747             (server->sec_mode & SECMODE_SIGN_REQUIRED))
1748                         return false;
1749         else if (((secFlags & CIFSSEC_MUST_SIGN) == CIFSSEC_MUST_SIGN) &&
1750                  (server->sec_mode &
1751                   (SECMODE_SIGN_ENABLED|SECMODE_SIGN_REQUIRED)) == 0)
1752                         return false;
1753
1754         return true;
1755 }
1756
1757 static int match_server(struct TCP_Server_Info *server, struct sockaddr *addr,
1758                          struct smb_vol *vol)
1759 {
1760         if (!net_eq(cifs_net_ns(server), current->nsproxy->net_ns))
1761                 return 0;
1762
1763         if (!match_address(server, addr,
1764                            (struct sockaddr *)&vol->srcaddr))
1765                 return 0;
1766
1767         if (!match_port(server, addr))
1768                 return 0;
1769
1770         if (!match_security(server, vol))
1771                 return 0;
1772
1773         return 1;
1774 }
1775
1776 static struct TCP_Server_Info *
1777 cifs_find_tcp_session(struct sockaddr *addr, struct smb_vol *vol)
1778 {
1779         struct TCP_Server_Info *server;
1780
1781         spin_lock(&cifs_tcp_ses_lock);
1782         list_for_each_entry(server, &cifs_tcp_ses_list, tcp_ses_list) {
1783                 if (!match_server(server, addr, vol))
1784                         continue;
1785
1786                 ++server->srv_count;
1787                 spin_unlock(&cifs_tcp_ses_lock);
1788                 cFYI(1, "Existing tcp session with server found");
1789                 return server;
1790         }
1791         spin_unlock(&cifs_tcp_ses_lock);
1792         return NULL;
1793 }
1794
1795 static void
1796 cifs_put_tcp_session(struct TCP_Server_Info *server)
1797 {
1798         struct task_struct *task;
1799
1800         spin_lock(&cifs_tcp_ses_lock);
1801         if (--server->srv_count > 0) {
1802                 spin_unlock(&cifs_tcp_ses_lock);
1803                 return;
1804         }
1805
1806         put_net(cifs_net_ns(server));
1807
1808         list_del_init(&server->tcp_ses_list);
1809         spin_unlock(&cifs_tcp_ses_lock);
1810
1811         cancel_delayed_work_sync(&server->echo);
1812
1813         spin_lock(&GlobalMid_Lock);
1814         server->tcpStatus = CifsExiting;
1815         spin_unlock(&GlobalMid_Lock);
1816
1817         cifs_crypto_shash_release(server);
1818         cifs_fscache_release_client_cookie(server);
1819
1820         kfree(server->session_key.response);
1821         server->session_key.response = NULL;
1822         server->session_key.len = 0;
1823
1824         task = xchg(&server->tsk, NULL);
1825         if (task)
1826                 force_sig(SIGKILL, task);
1827 }
1828
1829 static struct TCP_Server_Info *
1830 cifs_get_tcp_session(struct smb_vol *volume_info)
1831 {
1832         struct TCP_Server_Info *tcp_ses = NULL;
1833         struct sockaddr_storage addr;
1834         struct sockaddr_in *sin_server = (struct sockaddr_in *) &addr;
1835         struct sockaddr_in6 *sin_server6 = (struct sockaddr_in6 *) &addr;
1836         int rc;
1837
1838         memset(&addr, 0, sizeof(struct sockaddr_storage));
1839
1840         cFYI(1, "UNC: %s ip: %s", volume_info->UNC, volume_info->UNCip);
1841
1842         if (volume_info->UNCip && volume_info->UNC) {
1843                 rc = cifs_fill_sockaddr((struct sockaddr *)&addr,
1844                                         volume_info->UNCip,
1845                                         strlen(volume_info->UNCip),
1846                                         volume_info->port);
1847                 if (!rc) {
1848                         /* we failed translating address */
1849                         rc = -EINVAL;
1850                         goto out_err;
1851                 }
1852         } else if (volume_info->UNCip) {
1853                 /* BB using ip addr as tcp_ses name to connect to the
1854                    DFS root below */
1855                 cERROR(1, "Connecting to DFS root not implemented yet");
1856                 rc = -EINVAL;
1857                 goto out_err;
1858         } else /* which tcp_sess DFS root would we conect to */ {
1859                 cERROR(1, "CIFS mount error: No UNC path (e.g. -o "
1860                         "unc=//192.168.1.100/public) specified");
1861                 rc = -EINVAL;
1862                 goto out_err;
1863         }
1864
1865         /* see if we already have a matching tcp_ses */
1866         tcp_ses = cifs_find_tcp_session((struct sockaddr *)&addr, volume_info);
1867         if (tcp_ses)
1868                 return tcp_ses;
1869
1870         tcp_ses = kzalloc(sizeof(struct TCP_Server_Info), GFP_KERNEL);
1871         if (!tcp_ses) {
1872                 rc = -ENOMEM;
1873                 goto out_err;
1874         }
1875
1876         rc = cifs_crypto_shash_allocate(tcp_ses);
1877         if (rc) {
1878                 cERROR(1, "could not setup hash structures rc %d", rc);
1879                 goto out_err;
1880         }
1881
1882         cifs_set_net_ns(tcp_ses, get_net(current->nsproxy->net_ns));
1883         tcp_ses->hostname = extract_hostname(volume_info->UNC);
1884         if (IS_ERR(tcp_ses->hostname)) {
1885                 rc = PTR_ERR(tcp_ses->hostname);
1886                 goto out_err_crypto_release;
1887         }
1888
1889         tcp_ses->noblocksnd = volume_info->noblocksnd;
1890         tcp_ses->noautotune = volume_info->noautotune;
1891         tcp_ses->tcp_nodelay = volume_info->sockopt_tcp_nodelay;
1892         atomic_set(&tcp_ses->inFlight, 0);
1893         init_waitqueue_head(&tcp_ses->response_q);
1894         init_waitqueue_head(&tcp_ses->request_q);
1895         INIT_LIST_HEAD(&tcp_ses->pending_mid_q);
1896         mutex_init(&tcp_ses->srv_mutex);
1897         memcpy(tcp_ses->workstation_RFC1001_name,
1898                 volume_info->source_rfc1001_name, RFC1001_NAME_LEN_WITH_NULL);
1899         memcpy(tcp_ses->server_RFC1001_name,
1900                 volume_info->target_rfc1001_name, RFC1001_NAME_LEN_WITH_NULL);
1901         tcp_ses->session_estab = false;
1902         tcp_ses->sequence_number = 0;
1903         tcp_ses->lstrp = jiffies;
1904         INIT_LIST_HEAD(&tcp_ses->tcp_ses_list);
1905         INIT_LIST_HEAD(&tcp_ses->smb_ses_list);
1906         INIT_DELAYED_WORK(&tcp_ses->echo, cifs_echo_request);
1907
1908         /*
1909          * at this point we are the only ones with the pointer
1910          * to the struct since the kernel thread not created yet
1911          * no need to spinlock this init of tcpStatus or srv_count
1912          */
1913         tcp_ses->tcpStatus = CifsNew;
1914         memcpy(&tcp_ses->srcaddr, &volume_info->srcaddr,
1915                sizeof(tcp_ses->srcaddr));
1916         ++tcp_ses->srv_count;
1917
1918         if (addr.ss_family == AF_INET6) {
1919                 cFYI(1, "attempting ipv6 connect");
1920                 /* BB should we allow ipv6 on port 139? */
1921                 /* other OS never observed in Wild doing 139 with v6 */
1922                 memcpy(&tcp_ses->dstaddr, sin_server6,
1923                        sizeof(struct sockaddr_in6));
1924         } else
1925                 memcpy(&tcp_ses->dstaddr, sin_server,
1926                        sizeof(struct sockaddr_in));
1927
1928         rc = ip_connect(tcp_ses);
1929         if (rc < 0) {
1930                 cERROR(1, "Error connecting to socket. Aborting operation");
1931                 goto out_err_crypto_release;
1932         }
1933
1934         /*
1935          * since we're in a cifs function already, we know that
1936          * this will succeed. No need for try_module_get().
1937          */
1938         __module_get(THIS_MODULE);
1939         tcp_ses->tsk = kthread_run(cifs_demultiplex_thread,
1940                                   tcp_ses, "cifsd");
1941         if (IS_ERR(tcp_ses->tsk)) {
1942                 rc = PTR_ERR(tcp_ses->tsk);
1943                 cERROR(1, "error %d create cifsd thread", rc);
1944                 module_put(THIS_MODULE);
1945                 goto out_err_crypto_release;
1946         }
1947         tcp_ses->tcpStatus = CifsNeedNegotiate;
1948
1949         /* thread spawned, put it on the list */
1950         spin_lock(&cifs_tcp_ses_lock);
1951         list_add(&tcp_ses->tcp_ses_list, &cifs_tcp_ses_list);
1952         spin_unlock(&cifs_tcp_ses_lock);
1953
1954         cifs_fscache_get_client_cookie(tcp_ses);
1955
1956         /* queue echo request delayed work */
1957         queue_delayed_work(system_nrt_wq, &tcp_ses->echo, SMB_ECHO_INTERVAL);
1958
1959         return tcp_ses;
1960
1961 out_err_crypto_release:
1962         cifs_crypto_shash_release(tcp_ses);
1963
1964         put_net(cifs_net_ns(tcp_ses));
1965
1966 out_err:
1967         if (tcp_ses) {
1968                 if (!IS_ERR(tcp_ses->hostname))
1969                         kfree(tcp_ses->hostname);
1970                 if (tcp_ses->ssocket)
1971                         sock_release(tcp_ses->ssocket);
1972                 kfree(tcp_ses);
1973         }
1974         return ERR_PTR(rc);
1975 }
1976
1977 static int match_session(struct cifs_ses *ses, struct smb_vol *vol)
1978 {
1979         switch (ses->server->secType) {
1980         case Kerberos:
1981                 if (vol->cred_uid != ses->cred_uid)
1982                         return 0;
1983                 break;
1984         default:
1985                 /* anything else takes username/password */
1986                 if (ses->user_name == NULL)
1987                         return 0;
1988                 if (strncmp(ses->user_name, vol->username,
1989                             MAX_USERNAME_SIZE))
1990                         return 0;
1991                 if (strlen(vol->username) != 0 &&
1992                     ses->password != NULL &&
1993                     strncmp(ses->password,
1994                             vol->password ? vol->password : "",
1995                             MAX_PASSWORD_SIZE))
1996                         return 0;
1997         }
1998         return 1;
1999 }
2000
2001 static struct cifs_ses *
2002 cifs_find_smb_ses(struct TCP_Server_Info *server, struct smb_vol *vol)
2003 {
2004         struct cifs_ses *ses;
2005
2006         spin_lock(&cifs_tcp_ses_lock);
2007         list_for_each_entry(ses, &server->smb_ses_list, smb_ses_list) {
2008                 if (!match_session(ses, vol))
2009                         continue;
2010                 ++ses->ses_count;
2011                 spin_unlock(&cifs_tcp_ses_lock);
2012                 return ses;
2013         }
2014         spin_unlock(&cifs_tcp_ses_lock);
2015         return NULL;
2016 }
2017
2018 static void
2019 cifs_put_smb_ses(struct cifs_ses *ses)
2020 {
2021         int xid;
2022         struct TCP_Server_Info *server = ses->server;
2023
2024         cFYI(1, "%s: ses_count=%d\n", __func__, ses->ses_count);
2025         spin_lock(&cifs_tcp_ses_lock);
2026         if (--ses->ses_count > 0) {
2027                 spin_unlock(&cifs_tcp_ses_lock);
2028                 return;
2029         }
2030
2031         list_del_init(&ses->smb_ses_list);
2032         spin_unlock(&cifs_tcp_ses_lock);
2033
2034         if (ses->status == CifsGood) {
2035                 xid = GetXid();
2036                 CIFSSMBLogoff(xid, ses);
2037                 _FreeXid(xid);
2038         }
2039         sesInfoFree(ses);
2040         cifs_put_tcp_session(server);
2041 }
2042
2043 static bool warned_on_ntlm;  /* globals init to false automatically */
2044
2045 static struct cifs_ses *
2046 cifs_get_smb_ses(struct TCP_Server_Info *server, struct smb_vol *volume_info)
2047 {
2048         int rc = -ENOMEM, xid;
2049         struct cifs_ses *ses;
2050         struct sockaddr_in *addr = (struct sockaddr_in *)&server->dstaddr;
2051         struct sockaddr_in6 *addr6 = (struct sockaddr_in6 *)&server->dstaddr;
2052
2053         xid = GetXid();
2054
2055         ses = cifs_find_smb_ses(server, volume_info);
2056         if (ses) {
2057                 cFYI(1, "Existing smb sess found (status=%d)", ses->status);
2058
2059                 mutex_lock(&ses->session_mutex);
2060                 rc = cifs_negotiate_protocol(xid, ses);
2061                 if (rc) {
2062                         mutex_unlock(&ses->session_mutex);
2063                         /* problem -- put our ses reference */
2064                         cifs_put_smb_ses(ses);
2065                         FreeXid(xid);
2066                         return ERR_PTR(rc);
2067                 }
2068                 if (ses->need_reconnect) {
2069                         cFYI(1, "Session needs reconnect");
2070                         rc = cifs_setup_session(xid, ses,
2071                                                 volume_info->local_nls);
2072                         if (rc) {
2073                                 mutex_unlock(&ses->session_mutex);
2074                                 /* problem -- put our reference */
2075                                 cifs_put_smb_ses(ses);
2076                                 FreeXid(xid);
2077                                 return ERR_PTR(rc);
2078                         }
2079                 }
2080                 mutex_unlock(&ses->session_mutex);
2081
2082                 /* existing SMB ses has a server reference already */
2083                 cifs_put_tcp_session(server);
2084                 FreeXid(xid);
2085                 return ses;
2086         }
2087
2088         cFYI(1, "Existing smb sess not found");
2089         ses = sesInfoAlloc();
2090         if (ses == NULL)
2091                 goto get_ses_fail;
2092
2093         /* new SMB session uses our server ref */
2094         ses->server = server;
2095         if (server->dstaddr.ss_family == AF_INET6)
2096                 sprintf(ses->serverName, "%pI6", &addr6->sin6_addr);
2097         else
2098                 sprintf(ses->serverName, "%pI4", &addr->sin_addr);
2099
2100         if (volume_info->username) {
2101                 ses->user_name = kstrdup(volume_info->username, GFP_KERNEL);
2102                 if (!ses->user_name)
2103                         goto get_ses_fail;
2104         }
2105
2106         /* volume_info->password freed at unmount */
2107         if (volume_info->password) {
2108                 ses->password = kstrdup(volume_info->password, GFP_KERNEL);
2109                 if (!ses->password)
2110                         goto get_ses_fail;
2111         }
2112         if (volume_info->domainname) {
2113                 ses->domainName = kstrdup(volume_info->domainname, GFP_KERNEL);
2114                 if (!ses->domainName)
2115                         goto get_ses_fail;
2116         }
2117         ses->cred_uid = volume_info->cred_uid;
2118         ses->linux_uid = volume_info->linux_uid;
2119
2120         /* ntlmv2 is much stronger than ntlm security, and has been broadly
2121         supported for many years, time to update default security mechanism */
2122         if ((volume_info->secFlg == 0) && warned_on_ntlm == false) {
2123                 warned_on_ntlm = true;
2124                 cERROR(1, "default security mechanism requested.  The default "
2125                         "security mechanism will be upgraded from ntlm to "
2126                         "ntlmv2 in kernel release 3.3");
2127         }
2128         ses->overrideSecFlg = volume_info->secFlg;
2129
2130         mutex_lock(&ses->session_mutex);
2131         rc = cifs_negotiate_protocol(xid, ses);
2132         if (!rc)
2133                 rc = cifs_setup_session(xid, ses, volume_info->local_nls);
2134         mutex_unlock(&ses->session_mutex);
2135         if (rc)
2136                 goto get_ses_fail;
2137
2138         /* success, put it on the list */
2139         spin_lock(&cifs_tcp_ses_lock);
2140         list_add(&ses->smb_ses_list, &server->smb_ses_list);
2141         spin_unlock(&cifs_tcp_ses_lock);
2142
2143         FreeXid(xid);
2144         return ses;
2145
2146 get_ses_fail:
2147         sesInfoFree(ses);
2148         FreeXid(xid);
2149         return ERR_PTR(rc);
2150 }
2151
2152 static int match_tcon(struct cifs_tcon *tcon, const char *unc)
2153 {
2154         if (tcon->tidStatus == CifsExiting)
2155                 return 0;
2156         if (strncmp(tcon->treeName, unc, MAX_TREE_SIZE))
2157                 return 0;
2158         return 1;
2159 }
2160
2161 static struct cifs_tcon *
2162 cifs_find_tcon(struct cifs_ses *ses, const char *unc)
2163 {
2164         struct list_head *tmp;
2165         struct cifs_tcon *tcon;
2166
2167         spin_lock(&cifs_tcp_ses_lock);
2168         list_for_each(tmp, &ses->tcon_list) {
2169                 tcon = list_entry(tmp, struct cifs_tcon, tcon_list);
2170                 if (!match_tcon(tcon, unc))
2171                         continue;
2172                 ++tcon->tc_count;
2173                 spin_unlock(&cifs_tcp_ses_lock);
2174                 return tcon;
2175         }
2176         spin_unlock(&cifs_tcp_ses_lock);
2177         return NULL;
2178 }
2179
2180 static void
2181 cifs_put_tcon(struct cifs_tcon *tcon)
2182 {
2183         int xid;
2184         struct cifs_ses *ses = tcon->ses;
2185
2186         cFYI(1, "%s: tc_count=%d\n", __func__, tcon->tc_count);
2187         spin_lock(&cifs_tcp_ses_lock);
2188         if (--tcon->tc_count > 0) {
2189                 spin_unlock(&cifs_tcp_ses_lock);
2190                 return;
2191         }
2192
2193         list_del_init(&tcon->tcon_list);
2194         spin_unlock(&cifs_tcp_ses_lock);
2195
2196         xid = GetXid();
2197         CIFSSMBTDis(xid, tcon);
2198         _FreeXid(xid);
2199
2200         cifs_fscache_release_super_cookie(tcon);
2201         tconInfoFree(tcon);
2202         cifs_put_smb_ses(ses);
2203 }
2204
2205 static struct cifs_tcon *
2206 cifs_get_tcon(struct cifs_ses *ses, struct smb_vol *volume_info)
2207 {
2208         int rc, xid;
2209         struct cifs_tcon *tcon;
2210
2211         tcon = cifs_find_tcon(ses, volume_info->UNC);
2212         if (tcon) {
2213                 cFYI(1, "Found match on UNC path");
2214                 /* existing tcon already has a reference */
2215                 cifs_put_smb_ses(ses);
2216                 if (tcon->seal != volume_info->seal)
2217                         cERROR(1, "transport encryption setting "
2218                                    "conflicts with existing tid");
2219                 return tcon;
2220         }
2221
2222         tcon = tconInfoAlloc();
2223         if (tcon == NULL) {
2224                 rc = -ENOMEM;
2225                 goto out_fail;
2226         }
2227
2228         tcon->ses = ses;
2229         if (volume_info->password) {
2230                 tcon->password = kstrdup(volume_info->password, GFP_KERNEL);
2231                 if (!tcon->password) {
2232                         rc = -ENOMEM;
2233                         goto out_fail;
2234                 }
2235         }
2236
2237         if (strchr(volume_info->UNC + 3, '\\') == NULL
2238             && strchr(volume_info->UNC + 3, '/') == NULL) {
2239                 cERROR(1, "Missing share name");
2240                 rc = -ENODEV;
2241                 goto out_fail;
2242         }
2243
2244         /* BB Do we need to wrap session_mutex around
2245          * this TCon call and Unix SetFS as
2246          * we do on SessSetup and reconnect? */
2247         xid = GetXid();
2248         rc = CIFSTCon(xid, ses, volume_info->UNC, tcon, volume_info->local_nls);
2249         FreeXid(xid);
2250         cFYI(1, "CIFS Tcon rc = %d", rc);
2251         if (rc)
2252                 goto out_fail;
2253
2254         if (volume_info->nodfs) {
2255                 tcon->Flags &= ~SMB_SHARE_IS_IN_DFS;
2256                 cFYI(1, "DFS disabled (%d)", tcon->Flags);
2257         }
2258         tcon->seal = volume_info->seal;
2259         /* we can have only one retry value for a connection
2260            to a share so for resources mounted more than once
2261            to the same server share the last value passed in
2262            for the retry flag is used */
2263         tcon->retry = volume_info->retry;
2264         tcon->nocase = volume_info->nocase;
2265         tcon->local_lease = volume_info->local_lease;
2266
2267         spin_lock(&cifs_tcp_ses_lock);
2268         list_add(&tcon->tcon_list, &ses->tcon_list);
2269         spin_unlock(&cifs_tcp_ses_lock);
2270
2271         cifs_fscache_get_super_cookie(tcon);
2272
2273         return tcon;
2274
2275 out_fail:
2276         tconInfoFree(tcon);
2277         return ERR_PTR(rc);
2278 }
2279
2280 void
2281 cifs_put_tlink(struct tcon_link *tlink)
2282 {
2283         if (!tlink || IS_ERR(tlink))
2284                 return;
2285
2286         if (!atomic_dec_and_test(&tlink->tl_count) ||
2287             test_bit(TCON_LINK_IN_TREE, &tlink->tl_flags)) {
2288                 tlink->tl_time = jiffies;
2289                 return;
2290         }
2291
2292         if (!IS_ERR(tlink_tcon(tlink)))
2293                 cifs_put_tcon(tlink_tcon(tlink));
2294         kfree(tlink);
2295         return;
2296 }
2297
2298 static inline struct tcon_link *
2299 cifs_sb_master_tlink(struct cifs_sb_info *cifs_sb)
2300 {
2301         return cifs_sb->master_tlink;
2302 }
2303
2304 static int
2305 compare_mount_options(struct super_block *sb, struct cifs_mnt_data *mnt_data)
2306 {
2307         struct cifs_sb_info *old = CIFS_SB(sb);
2308         struct cifs_sb_info *new = mnt_data->cifs_sb;
2309
2310         if ((sb->s_flags & CIFS_MS_MASK) != (mnt_data->flags & CIFS_MS_MASK))
2311                 return 0;
2312
2313         if ((old->mnt_cifs_flags & CIFS_MOUNT_MASK) !=
2314             (new->mnt_cifs_flags & CIFS_MOUNT_MASK))
2315                 return 0;
2316
2317         /*
2318          * We want to share sb only if we don't specify an r/wsize or
2319          * specified r/wsize is greater than or equal to existing one.
2320          */
2321         if (new->wsize && new->wsize < old->wsize)
2322                 return 0;
2323
2324         if (new->rsize && new->rsize < old->rsize)
2325                 return 0;
2326
2327         if (old->mnt_uid != new->mnt_uid || old->mnt_gid != new->mnt_gid)
2328                 return 0;
2329
2330         if (old->mnt_file_mode != new->mnt_file_mode ||
2331             old->mnt_dir_mode != new->mnt_dir_mode)
2332                 return 0;
2333
2334         if (strcmp(old->local_nls->charset, new->local_nls->charset))
2335                 return 0;
2336
2337         if (old->actimeo != new->actimeo)
2338                 return 0;
2339
2340         return 1;
2341 }
2342
2343 int
2344 cifs_match_super(struct super_block *sb, void *data)
2345 {
2346         struct cifs_mnt_data *mnt_data = (struct cifs_mnt_data *)data;
2347         struct smb_vol *volume_info;
2348         struct cifs_sb_info *cifs_sb;
2349         struct TCP_Server_Info *tcp_srv;
2350         struct cifs_ses *ses;
2351         struct cifs_tcon *tcon;
2352         struct tcon_link *tlink;
2353         struct sockaddr_storage addr;
2354         int rc = 0;
2355
2356         memset(&addr, 0, sizeof(struct sockaddr_storage));
2357
2358         spin_lock(&cifs_tcp_ses_lock);
2359         cifs_sb = CIFS_SB(sb);
2360         tlink = cifs_get_tlink(cifs_sb_master_tlink(cifs_sb));
2361         if (IS_ERR(tlink)) {
2362                 spin_unlock(&cifs_tcp_ses_lock);
2363                 return rc;
2364         }
2365         tcon = tlink_tcon(tlink);
2366         ses = tcon->ses;
2367         tcp_srv = ses->server;
2368
2369         volume_info = mnt_data->vol;
2370
2371         if (!volume_info->UNCip || !volume_info->UNC)
2372                 goto out;
2373
2374         rc = cifs_fill_sockaddr((struct sockaddr *)&addr,
2375                                 volume_info->UNCip,
2376                                 strlen(volume_info->UNCip),
2377                                 volume_info->port);
2378         if (!rc)
2379                 goto out;
2380
2381         if (!match_server(tcp_srv, (struct sockaddr *)&addr, volume_info) ||
2382             !match_session(ses, volume_info) ||
2383             !match_tcon(tcon, volume_info->UNC)) {
2384                 rc = 0;
2385                 goto out;
2386         }
2387
2388         rc = compare_mount_options(sb, mnt_data);
2389 out:
2390         spin_unlock(&cifs_tcp_ses_lock);
2391         cifs_put_tlink(tlink);
2392         return rc;
2393 }
2394
2395 int
2396 get_dfs_path(int xid, struct cifs_ses *pSesInfo, const char *old_path,
2397              const struct nls_table *nls_codepage, unsigned int *pnum_referrals,
2398              struct dfs_info3_param **preferrals, int remap)
2399 {
2400         char *temp_unc;
2401         int rc = 0;
2402
2403         *pnum_referrals = 0;
2404         *preferrals = NULL;
2405
2406         if (pSesInfo->ipc_tid == 0) {
2407                 temp_unc = kmalloc(2 /* for slashes */ +
2408                         strnlen(pSesInfo->serverName,
2409                                 SERVER_NAME_LEN_WITH_NULL * 2)
2410                                  + 1 + 4 /* slash IPC$ */  + 2,
2411                                 GFP_KERNEL);
2412                 if (temp_unc == NULL)
2413                         return -ENOMEM;
2414                 temp_unc[0] = '\\';
2415                 temp_unc[1] = '\\';
2416                 strcpy(temp_unc + 2, pSesInfo->serverName);
2417                 strcpy(temp_unc + 2 + strlen(pSesInfo->serverName), "\\IPC$");
2418                 rc = CIFSTCon(xid, pSesInfo, temp_unc, NULL, nls_codepage);
2419                 cFYI(1, "CIFS Tcon rc = %d ipc_tid = %d", rc, pSesInfo->ipc_tid);
2420                 kfree(temp_unc);
2421         }
2422         if (rc == 0)
2423                 rc = CIFSGetDFSRefer(xid, pSesInfo, old_path, preferrals,
2424                                      pnum_referrals, nls_codepage, remap);
2425         /* BB map targetUNCs to dfs_info3 structures, here or
2426                 in CIFSGetDFSRefer BB */
2427
2428         return rc;
2429 }
2430
2431 #ifdef CONFIG_DEBUG_LOCK_ALLOC
2432 static struct lock_class_key cifs_key[2];
2433 static struct lock_class_key cifs_slock_key[2];
2434
2435 static inline void
2436 cifs_reclassify_socket4(struct socket *sock)
2437 {
2438         struct sock *sk = sock->sk;
2439         BUG_ON(sock_owned_by_user(sk));
2440         sock_lock_init_class_and_name(sk, "slock-AF_INET-CIFS",
2441                 &cifs_slock_key[0], "sk_lock-AF_INET-CIFS", &cifs_key[0]);
2442 }
2443
2444 static inline void
2445 cifs_reclassify_socket6(struct socket *sock)
2446 {
2447         struct sock *sk = sock->sk;
2448         BUG_ON(sock_owned_by_user(sk));
2449         sock_lock_init_class_and_name(sk, "slock-AF_INET6-CIFS",
2450                 &cifs_slock_key[1], "sk_lock-AF_INET6-CIFS", &cifs_key[1]);
2451 }
2452 #else
2453 static inline void
2454 cifs_reclassify_socket4(struct socket *sock)
2455 {
2456 }
2457
2458 static inline void
2459 cifs_reclassify_socket6(struct socket *sock)
2460 {
2461 }
2462 #endif
2463
2464 /* See RFC1001 section 14 on representation of Netbios names */
2465 static void rfc1002mangle(char *target, char *source, unsigned int length)
2466 {
2467         unsigned int i, j;
2468
2469         for (i = 0, j = 0; i < (length); i++) {
2470                 /* mask a nibble at a time and encode */
2471                 target[j] = 'A' + (0x0F & (source[i] >> 4));
2472                 target[j+1] = 'A' + (0x0F & source[i]);
2473                 j += 2;
2474         }
2475
2476 }
2477
2478 static int
2479 bind_socket(struct TCP_Server_Info *server)
2480 {
2481         int rc = 0;
2482         if (server->srcaddr.ss_family != AF_UNSPEC) {
2483                 /* Bind to the specified local IP address */
2484                 struct socket *socket = server->ssocket;
2485                 rc = socket->ops->bind(socket,
2486                                        (struct sockaddr *) &server->srcaddr,
2487                                        sizeof(server->srcaddr));
2488                 if (rc < 0) {
2489                         struct sockaddr_in *saddr4;
2490                         struct sockaddr_in6 *saddr6;
2491                         saddr4 = (struct sockaddr_in *)&server->srcaddr;
2492                         saddr6 = (struct sockaddr_in6 *)&server->srcaddr;
2493                         if (saddr6->sin6_family == AF_INET6)
2494                                 cERROR(1, "cifs: "
2495                                        "Failed to bind to: %pI6c, error: %d\n",
2496                                        &saddr6->sin6_addr, rc);
2497                         else
2498                                 cERROR(1, "cifs: "
2499                                        "Failed to bind to: %pI4, error: %d\n",
2500                                        &saddr4->sin_addr.s_addr, rc);
2501                 }
2502         }
2503         return rc;
2504 }
2505
2506 static int
2507 ip_rfc1001_connect(struct TCP_Server_Info *server)
2508 {
2509         int rc = 0;
2510         /*
2511          * some servers require RFC1001 sessinit before sending
2512          * negprot - BB check reconnection in case where second
2513          * sessinit is sent but no second negprot
2514          */
2515         struct rfc1002_session_packet *ses_init_buf;
2516         struct smb_hdr *smb_buf;
2517         ses_init_buf = kzalloc(sizeof(struct rfc1002_session_packet),
2518                                GFP_KERNEL);
2519         if (ses_init_buf) {
2520                 ses_init_buf->trailer.session_req.called_len = 32;
2521
2522                 if (server->server_RFC1001_name &&
2523                     server->server_RFC1001_name[0] != 0)
2524                         rfc1002mangle(ses_init_buf->trailer.
2525                                       session_req.called_name,
2526                                       server->server_RFC1001_name,
2527                                       RFC1001_NAME_LEN_WITH_NULL);
2528                 else
2529                         rfc1002mangle(ses_init_buf->trailer.
2530                                       session_req.called_name,
2531                                       DEFAULT_CIFS_CALLED_NAME,
2532                                       RFC1001_NAME_LEN_WITH_NULL);
2533
2534                 ses_init_buf->trailer.session_req.calling_len = 32;
2535
2536                 /*
2537                  * calling name ends in null (byte 16) from old smb
2538                  * convention.
2539                  */
2540                 if (server->workstation_RFC1001_name &&
2541                     server->workstation_RFC1001_name[0] != 0)
2542                         rfc1002mangle(ses_init_buf->trailer.
2543                                       session_req.calling_name,
2544                                       server->workstation_RFC1001_name,
2545                                       RFC1001_NAME_LEN_WITH_NULL);
2546                 else
2547                         rfc1002mangle(ses_init_buf->trailer.
2548                                       session_req.calling_name,
2549                                       "LINUX_CIFS_CLNT",
2550                                       RFC1001_NAME_LEN_WITH_NULL);
2551
2552                 ses_init_buf->trailer.session_req.scope1 = 0;
2553                 ses_init_buf->trailer.session_req.scope2 = 0;
2554                 smb_buf = (struct smb_hdr *)ses_init_buf;
2555
2556                 /* sizeof RFC1002_SESSION_REQUEST with no scope */
2557                 smb_buf->smb_buf_length = cpu_to_be32(0x81000044);
2558                 rc = smb_send(server, smb_buf, 0x44);
2559                 kfree(ses_init_buf);
2560                 /*
2561                  * RFC1001 layer in at least one server
2562                  * requires very short break before negprot
2563                  * presumably because not expecting negprot
2564                  * to follow so fast.  This is a simple
2565                  * solution that works without
2566                  * complicating the code and causes no
2567                  * significant slowing down on mount
2568                  * for everyone else
2569                  */
2570                 usleep_range(1000, 2000);
2571         }
2572         /*
2573          * else the negprot may still work without this
2574          * even though malloc failed
2575          */
2576
2577         return rc;
2578 }
2579
2580 static int
2581 generic_ip_connect(struct TCP_Server_Info *server)
2582 {
2583         int rc = 0;
2584         __be16 sport;
2585         int slen, sfamily;
2586         struct socket *socket = server->ssocket;
2587         struct sockaddr *saddr;
2588
2589         saddr = (struct sockaddr *) &server->dstaddr;
2590
2591         if (server->dstaddr.ss_family == AF_INET6) {
2592                 sport = ((struct sockaddr_in6 *) saddr)->sin6_port;
2593                 slen = sizeof(struct sockaddr_in6);
2594                 sfamily = AF_INET6;
2595         } else {
2596                 sport = ((struct sockaddr_in *) saddr)->sin_port;
2597                 slen = sizeof(struct sockaddr_in);
2598                 sfamily = AF_INET;
2599         }
2600
2601         if (socket == NULL) {
2602                 rc = __sock_create(cifs_net_ns(server), sfamily, SOCK_STREAM,
2603                                    IPPROTO_TCP, &socket, 1);
2604                 if (rc < 0) {
2605                         cERROR(1, "Error %d creating socket", rc);
2606                         server->ssocket = NULL;
2607                         return rc;
2608                 }
2609
2610                 /* BB other socket options to set KEEPALIVE, NODELAY? */
2611                 cFYI(1, "Socket created");
2612                 server->ssocket = socket;
2613                 socket->sk->sk_allocation = GFP_NOFS;
2614                 if (sfamily == AF_INET6)
2615                         cifs_reclassify_socket6(socket);
2616                 else
2617                         cifs_reclassify_socket4(socket);
2618         }
2619
2620         rc = bind_socket(server);
2621         if (rc < 0)
2622                 return rc;
2623
2624         /*
2625          * Eventually check for other socket options to change from
2626          * the default. sock_setsockopt not used because it expects
2627          * user space buffer
2628          */
2629         socket->sk->sk_rcvtimeo = 7 * HZ;
2630         socket->sk->sk_sndtimeo = 5 * HZ;
2631
2632         /* make the bufsizes depend on wsize/rsize and max requests */
2633         if (server->noautotune) {
2634                 if (socket->sk->sk_sndbuf < (200 * 1024))
2635                         socket->sk->sk_sndbuf = 200 * 1024;
2636                 if (socket->sk->sk_rcvbuf < (140 * 1024))
2637                         socket->sk->sk_rcvbuf = 140 * 1024;
2638         }
2639
2640         if (server->tcp_nodelay) {
2641                 int val = 1;
2642                 rc = kernel_setsockopt(socket, SOL_TCP, TCP_NODELAY,
2643                                 (char *)&val, sizeof(val));
2644                 if (rc)
2645                         cFYI(1, "set TCP_NODELAY socket option error %d", rc);
2646         }
2647
2648          cFYI(1, "sndbuf %d rcvbuf %d rcvtimeo 0x%lx",
2649                  socket->sk->sk_sndbuf,
2650                  socket->sk->sk_rcvbuf, socket->sk->sk_rcvtimeo);
2651
2652         rc = socket->ops->connect(socket, saddr, slen, 0);
2653         if (rc < 0) {
2654                 cFYI(1, "Error %d connecting to server", rc);
2655                 sock_release(socket);
2656                 server->ssocket = NULL;
2657                 return rc;
2658         }
2659
2660         if (sport == htons(RFC1001_PORT))
2661                 rc = ip_rfc1001_connect(server);
2662
2663         return rc;
2664 }
2665
2666 static int
2667 ip_connect(struct TCP_Server_Info *server)
2668 {
2669         __be16 *sport;
2670         struct sockaddr_in6 *addr6 = (struct sockaddr_in6 *)&server->dstaddr;
2671         struct sockaddr_in *addr = (struct sockaddr_in *)&server->dstaddr;
2672
2673         if (server->dstaddr.ss_family == AF_INET6)
2674                 sport = &addr6->sin6_port;
2675         else
2676                 sport = &addr->sin_port;
2677
2678         if (*sport == 0) {
2679                 int rc;
2680
2681                 /* try with 445 port at first */
2682                 *sport = htons(CIFS_PORT);
2683
2684                 rc = generic_ip_connect(server);
2685                 if (rc >= 0)
2686                         return rc;
2687
2688                 /* if it failed, try with 139 port */
2689                 *sport = htons(RFC1001_PORT);
2690         }
2691
2692         return generic_ip_connect(server);
2693 }
2694
2695 void reset_cifs_unix_caps(int xid, struct cifs_tcon *tcon,
2696                           struct cifs_sb_info *cifs_sb, struct smb_vol *vol_info)
2697 {
2698         /* if we are reconnecting then should we check to see if
2699          * any requested capabilities changed locally e.g. via
2700          * remount but we can not do much about it here
2701          * if they have (even if we could detect it by the following)
2702          * Perhaps we could add a backpointer to array of sb from tcon
2703          * or if we change to make all sb to same share the same
2704          * sb as NFS - then we only have one backpointer to sb.
2705          * What if we wanted to mount the server share twice once with
2706          * and once without posixacls or posix paths? */
2707         __u64 saved_cap = le64_to_cpu(tcon->fsUnixInfo.Capability);
2708
2709         if (vol_info && vol_info->no_linux_ext) {
2710                 tcon->fsUnixInfo.Capability = 0;
2711                 tcon->unix_ext = 0; /* Unix Extensions disabled */
2712                 cFYI(1, "Linux protocol extensions disabled");
2713                 return;
2714         } else if (vol_info)
2715                 tcon->unix_ext = 1; /* Unix Extensions supported */
2716
2717         if (tcon->unix_ext == 0) {
2718                 cFYI(1, "Unix extensions disabled so not set on reconnect");
2719                 return;
2720         }
2721
2722         if (!CIFSSMBQFSUnixInfo(xid, tcon)) {
2723                 __u64 cap = le64_to_cpu(tcon->fsUnixInfo.Capability);
2724                 cFYI(1, "unix caps which server supports %lld", cap);
2725                 /* check for reconnect case in which we do not
2726                    want to change the mount behavior if we can avoid it */
2727                 if (vol_info == NULL) {
2728                         /* turn off POSIX ACL and PATHNAMES if not set
2729                            originally at mount time */
2730                         if ((saved_cap & CIFS_UNIX_POSIX_ACL_CAP) == 0)
2731                                 cap &= ~CIFS_UNIX_POSIX_ACL_CAP;
2732                         if ((saved_cap & CIFS_UNIX_POSIX_PATHNAMES_CAP) == 0) {
2733                                 if (cap & CIFS_UNIX_POSIX_PATHNAMES_CAP)
2734                                         cERROR(1, "POSIXPATH support change");
2735                                 cap &= ~CIFS_UNIX_POSIX_PATHNAMES_CAP;
2736                         } else if ((cap & CIFS_UNIX_POSIX_PATHNAMES_CAP) == 0) {
2737                                 cERROR(1, "possible reconnect error");
2738                                 cERROR(1, "server disabled POSIX path support");
2739                         }
2740                 }
2741
2742                 if (cap & CIFS_UNIX_TRANSPORT_ENCRYPTION_MANDATORY_CAP)
2743                         cERROR(1, "per-share encryption not supported yet");
2744
2745                 cap &= CIFS_UNIX_CAP_MASK;
2746                 if (vol_info && vol_info->no_psx_acl)
2747                         cap &= ~CIFS_UNIX_POSIX_ACL_CAP;
2748                 else if (CIFS_UNIX_POSIX_ACL_CAP & cap) {
2749                         cFYI(1, "negotiated posix acl support");
2750                         if (cifs_sb)
2751                                 cifs_sb->mnt_cifs_flags |=
2752                                         CIFS_MOUNT_POSIXACL;
2753                 }
2754
2755                 if (vol_info && vol_info->posix_paths == 0)
2756                         cap &= ~CIFS_UNIX_POSIX_PATHNAMES_CAP;
2757                 else if (cap & CIFS_UNIX_POSIX_PATHNAMES_CAP) {
2758                         cFYI(1, "negotiate posix pathnames");
2759                         if (cifs_sb)
2760                                 cifs_sb->mnt_cifs_flags |=
2761                                         CIFS_MOUNT_POSIX_PATHS;
2762                 }
2763
2764                 cFYI(1, "Negotiate caps 0x%x", (int)cap);
2765 #ifdef CONFIG_CIFS_DEBUG2
2766                 if (cap & CIFS_UNIX_FCNTL_CAP)
2767                         cFYI(1, "FCNTL cap");
2768                 if (cap & CIFS_UNIX_EXTATTR_CAP)
2769                         cFYI(1, "EXTATTR cap");
2770                 if (cap & CIFS_UNIX_POSIX_PATHNAMES_CAP)
2771                         cFYI(1, "POSIX path cap");
2772                 if (cap & CIFS_UNIX_XATTR_CAP)
2773                         cFYI(1, "XATTR cap");
2774                 if (cap & CIFS_UNIX_POSIX_ACL_CAP)
2775                         cFYI(1, "POSIX ACL cap");
2776                 if (cap & CIFS_UNIX_LARGE_READ_CAP)
2777                         cFYI(1, "very large read cap");
2778                 if (cap & CIFS_UNIX_LARGE_WRITE_CAP)
2779                         cFYI(1, "very large write cap");
2780                 if (cap & CIFS_UNIX_TRANSPORT_ENCRYPTION_CAP)
2781                         cFYI(1, "transport encryption cap");
2782                 if (cap & CIFS_UNIX_TRANSPORT_ENCRYPTION_MANDATORY_CAP)
2783                         cFYI(1, "mandatory transport encryption cap");
2784 #endif /* CIFS_DEBUG2 */
2785                 if (CIFSSMBSetFSUnixInfo(xid, tcon, cap)) {
2786                         if (vol_info == NULL) {
2787                                 cFYI(1, "resetting capabilities failed");
2788                         } else
2789                                 cERROR(1, "Negotiating Unix capabilities "
2790                                            "with the server failed.  Consider "
2791                                            "mounting with the Unix Extensions\n"
2792                                            "disabled, if problems are found, "
2793                                            "by specifying the nounix mount "
2794                                            "option.");
2795
2796                 }
2797         }
2798 }
2799
2800 void cifs_setup_cifs_sb(struct smb_vol *pvolume_info,
2801                         struct cifs_sb_info *cifs_sb)
2802 {
2803         INIT_DELAYED_WORK(&cifs_sb->prune_tlinks, cifs_prune_tlinks);
2804
2805         spin_lock_init(&cifs_sb->tlink_tree_lock);
2806         cifs_sb->tlink_tree = RB_ROOT;
2807
2808         /*
2809          * Temporarily set r/wsize for matching superblock. If we end up using
2810          * new sb then client will later negotiate it downward if needed.
2811          */
2812         cifs_sb->rsize = pvolume_info->rsize;
2813         cifs_sb->wsize = pvolume_info->wsize;
2814
2815         cifs_sb->mnt_uid = pvolume_info->linux_uid;
2816         cifs_sb->mnt_gid = pvolume_info->linux_gid;
2817         if (pvolume_info->backupuid_specified)
2818                 cifs_sb->mnt_backupuid = pvolume_info->backupuid;
2819         if (pvolume_info->backupgid_specified)
2820                 cifs_sb->mnt_backupgid = pvolume_info->backupgid;
2821         cifs_sb->mnt_file_mode = pvolume_info->file_mode;
2822         cifs_sb->mnt_dir_mode = pvolume_info->dir_mode;
2823         cFYI(1, "file mode: 0x%x  dir mode: 0x%x",
2824                 cifs_sb->mnt_file_mode, cifs_sb->mnt_dir_mode);
2825
2826         cifs_sb->actimeo = pvolume_info->actimeo;
2827         cifs_sb->local_nls = pvolume_info->local_nls;
2828
2829         if (pvolume_info->noperm)
2830                 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_NO_PERM;
2831         if (pvolume_info->setuids)
2832                 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_SET_UID;
2833         if (pvolume_info->server_ino)
2834                 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_SERVER_INUM;
2835         if (pvolume_info->remap)
2836                 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_MAP_SPECIAL_CHR;
2837         if (pvolume_info->no_xattr)
2838                 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_NO_XATTR;
2839         if (pvolume_info->sfu_emul)
2840                 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_UNX_EMUL;
2841         if (pvolume_info->nobrl)
2842                 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_NO_BRL;
2843         if (pvolume_info->nostrictsync)
2844                 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_NOSSYNC;
2845         if (pvolume_info->mand_lock)
2846                 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_NOPOSIXBRL;
2847         if (pvolume_info->rwpidforward)
2848                 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_RWPIDFORWARD;
2849         if (pvolume_info->cifs_acl)
2850                 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_CIFS_ACL;
2851         if (pvolume_info->backupuid_specified)
2852                 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_CIFS_BACKUPUID;
2853         if (pvolume_info->backupgid_specified)
2854                 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_CIFS_BACKUPGID;
2855         if (pvolume_info->override_uid)
2856                 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_OVERR_UID;
2857         if (pvolume_info->override_gid)
2858                 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_OVERR_GID;
2859         if (pvolume_info->dynperm)
2860                 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_DYNPERM;
2861         if (pvolume_info->fsc)
2862                 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_FSCACHE;
2863         if (pvolume_info->multiuser)
2864                 cifs_sb->mnt_cifs_flags |= (CIFS_MOUNT_MULTIUSER |
2865                                             CIFS_MOUNT_NO_PERM);
2866         if (pvolume_info->strict_io)
2867                 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_STRICT_IO;
2868         if (pvolume_info->direct_io) {
2869                 cFYI(1, "mounting share using direct i/o");
2870                 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_DIRECT_IO;
2871         }
2872         if (pvolume_info->mfsymlinks) {
2873                 if (pvolume_info->sfu_emul) {
2874                         cERROR(1,  "mount option mfsymlinks ignored if sfu "
2875                                    "mount option is used");
2876                 } else {
2877                         cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_MF_SYMLINKS;
2878                 }
2879         }
2880
2881         if ((pvolume_info->cifs_acl) && (pvolume_info->dynperm))
2882                 cERROR(1, "mount option dynperm ignored if cifsacl "
2883                            "mount option supported");
2884 }
2885
2886 /*
2887  * When the server supports very large reads and writes via POSIX extensions,
2888  * we can allow up to 2^24-1, minus the size of a READ/WRITE_AND_X header, not
2889  * including the RFC1001 length.
2890  *
2891  * Note that this might make for "interesting" allocation problems during
2892  * writeback however as we have to allocate an array of pointers for the
2893  * pages. A 16M write means ~32kb page array with PAGE_CACHE_SIZE == 4096.
2894  *
2895  * For reads, there is a similar problem as we need to allocate an array
2896  * of kvecs to handle the receive, though that should only need to be done
2897  * once.
2898  */
2899 #define CIFS_MAX_WSIZE ((1<<24) - 1 - sizeof(WRITE_REQ) + 4)
2900 #define CIFS_MAX_RSIZE ((1<<24) - sizeof(READ_RSP) + 4)
2901
2902 /*
2903  * When the server doesn't allow large posix writes, only allow a rsize/wsize
2904  * of 2^17-1 minus the size of the call header. That allows for a read or
2905  * write up to the maximum size described by RFC1002.
2906  */
2907 #define CIFS_MAX_RFC1002_WSIZE ((1<<17) - 1 - sizeof(WRITE_REQ) + 4)
2908 #define CIFS_MAX_RFC1002_RSIZE ((1<<17) - 1 - sizeof(READ_RSP) + 4)
2909
2910 /*
2911  * The default wsize is 1M. find_get_pages seems to return a maximum of 256
2912  * pages in a single call. With PAGE_CACHE_SIZE == 4k, this means we can fill
2913  * a single wsize request with a single call.
2914  */
2915 #define CIFS_DEFAULT_IOSIZE (1024 * 1024)
2916
2917 /*
2918  * Windows only supports a max of 60kb reads and 65535 byte writes. Default to
2919  * those values when posix extensions aren't in force. In actuality here, we
2920  * use 65536 to allow for a write that is a multiple of 4k. Most servers seem
2921  * to be ok with the extra byte even though Windows doesn't send writes that
2922  * are that large.
2923  *
2924  * Citation:
2925  *
2926  * http://blogs.msdn.com/b/openspecification/archive/2009/04/10/smb-maximum-transmit-buffer-size-and-performance-tuning.aspx
2927  */
2928 #define CIFS_DEFAULT_NON_POSIX_RSIZE (60 * 1024)
2929 #define CIFS_DEFAULT_NON_POSIX_WSIZE (65536)
2930
2931 static unsigned int
2932 cifs_negotiate_wsize(struct cifs_tcon *tcon, struct smb_vol *pvolume_info)
2933 {
2934         __u64 unix_cap = le64_to_cpu(tcon->fsUnixInfo.Capability);
2935         struct TCP_Server_Info *server = tcon->ses->server;
2936         unsigned int wsize;
2937
2938         /* start with specified wsize, or default */
2939         if (pvolume_info->wsize)
2940                 wsize = pvolume_info->wsize;
2941         else if (tcon->unix_ext && (unix_cap & CIFS_UNIX_LARGE_WRITE_CAP))
2942                 wsize = CIFS_DEFAULT_IOSIZE;
2943         else
2944                 wsize = CIFS_DEFAULT_NON_POSIX_WSIZE;
2945
2946         /* can server support 24-bit write sizes? (via UNIX extensions) */
2947         if (!tcon->unix_ext || !(unix_cap & CIFS_UNIX_LARGE_WRITE_CAP))
2948                 wsize = min_t(unsigned int, wsize, CIFS_MAX_RFC1002_WSIZE);
2949
2950         /*
2951          * no CAP_LARGE_WRITE_X or is signing enabled without CAP_UNIX set?
2952          * Limit it to max buffer offered by the server, minus the size of the
2953          * WRITEX header, not including the 4 byte RFC1001 length.
2954          */
2955         if (!(server->capabilities & CAP_LARGE_WRITE_X) ||
2956             (!(server->capabilities & CAP_UNIX) &&
2957              (server->sec_mode & (SECMODE_SIGN_ENABLED|SECMODE_SIGN_REQUIRED))))
2958                 wsize = min_t(unsigned int, wsize,
2959                                 server->maxBuf - sizeof(WRITE_REQ) + 4);
2960
2961         /* hard limit of CIFS_MAX_WSIZE */
2962         wsize = min_t(unsigned int, wsize, CIFS_MAX_WSIZE);
2963
2964         return wsize;
2965 }
2966
2967 static unsigned int
2968 cifs_negotiate_rsize(struct cifs_tcon *tcon, struct smb_vol *pvolume_info)
2969 {
2970         __u64 unix_cap = le64_to_cpu(tcon->fsUnixInfo.Capability);
2971         struct TCP_Server_Info *server = tcon->ses->server;
2972         unsigned int rsize, defsize;
2973
2974         /*
2975          * Set default value...
2976          *
2977          * HACK alert! Ancient servers have very small buffers. Even though
2978          * MS-CIFS indicates that servers are only limited by the client's
2979          * bufsize for reads, testing against win98se shows that it throws
2980          * INVALID_PARAMETER errors if you try to request too large a read.
2981          *
2982          * If the server advertises a MaxBufferSize of less than one page,
2983          * assume that it also can't satisfy reads larger than that either.
2984          *
2985          * FIXME: Is there a better heuristic for this?
2986          */
2987         if (tcon->unix_ext && (unix_cap & CIFS_UNIX_LARGE_READ_CAP))
2988                 defsize = CIFS_DEFAULT_IOSIZE;
2989         else if (server->capabilities & CAP_LARGE_READ_X)
2990                 defsize = CIFS_DEFAULT_NON_POSIX_RSIZE;
2991         else if (server->maxBuf >= PAGE_CACHE_SIZE)
2992                 defsize = CIFSMaxBufSize;
2993         else
2994                 defsize = server->maxBuf - sizeof(READ_RSP);
2995
2996         rsize = pvolume_info->rsize ? pvolume_info->rsize : defsize;
2997
2998         /*
2999          * no CAP_LARGE_READ_X? Then MS-CIFS states that we must limit this to
3000          * the client's MaxBufferSize.
3001          */
3002         if (!(server->capabilities & CAP_LARGE_READ_X))
3003                 rsize = min_t(unsigned int, CIFSMaxBufSize, rsize);
3004
3005         /* hard limit of CIFS_MAX_RSIZE */
3006         rsize = min_t(unsigned int, rsize, CIFS_MAX_RSIZE);
3007
3008         return rsize;
3009 }
3010
3011 static int
3012 is_path_accessible(int xid, struct cifs_tcon *tcon,
3013                    struct cifs_sb_info *cifs_sb, const char *full_path)
3014 {
3015         int rc;
3016         FILE_ALL_INFO *pfile_info;
3017
3018         pfile_info = kmalloc(sizeof(FILE_ALL_INFO), GFP_KERNEL);
3019         if (pfile_info == NULL)
3020                 return -ENOMEM;
3021
3022         rc = CIFSSMBQPathInfo(xid, tcon, full_path, pfile_info,
3023                               0 /* not legacy */, cifs_sb->local_nls,
3024                               cifs_sb->mnt_cifs_flags &
3025                                 CIFS_MOUNT_MAP_SPECIAL_CHR);
3026
3027         if (rc == -EOPNOTSUPP || rc == -EINVAL)
3028                 rc = SMBQueryInformation(xid, tcon, full_path, pfile_info,
3029                                 cifs_sb->local_nls, cifs_sb->mnt_cifs_flags &
3030                                   CIFS_MOUNT_MAP_SPECIAL_CHR);
3031         kfree(pfile_info);
3032         return rc;
3033 }
3034
3035 static void
3036 cleanup_volume_info_contents(struct smb_vol *volume_info)
3037 {
3038         kfree(volume_info->username);
3039         kzfree(volume_info->password);
3040         if (volume_info->UNCip != volume_info->UNC + 2)
3041                 kfree(volume_info->UNCip);
3042         kfree(volume_info->UNC);
3043         kfree(volume_info->domainname);
3044         kfree(volume_info->iocharset);
3045         kfree(volume_info->prepath);
3046 }
3047
3048 void
3049 cifs_cleanup_volume_info(struct smb_vol *volume_info)
3050 {
3051         if (!volume_info)
3052                 return;
3053         cleanup_volume_info_contents(volume_info);
3054         kfree(volume_info);
3055 }
3056
3057
3058 #ifdef CONFIG_CIFS_DFS_UPCALL
3059 /* build_path_to_root returns full path to root when
3060  * we do not have an exiting connection (tcon) */
3061 static char *
3062 build_unc_path_to_root(const struct smb_vol *vol,
3063                 const struct cifs_sb_info *cifs_sb)
3064 {
3065         char *full_path, *pos;
3066         unsigned int pplen = vol->prepath ? strlen(vol->prepath) : 0;
3067         unsigned int unc_len = strnlen(vol->UNC, MAX_TREE_SIZE + 1);
3068
3069         full_path = kmalloc(unc_len + pplen + 1, GFP_KERNEL);
3070         if (full_path == NULL)
3071                 return ERR_PTR(-ENOMEM);
3072
3073         strncpy(full_path, vol->UNC, unc_len);
3074         pos = full_path + unc_len;
3075
3076         if (pplen) {
3077                 strncpy(pos, vol->prepath, pplen);
3078                 pos += pplen;
3079         }
3080
3081         *pos = '\0'; /* add trailing null */
3082         convert_delimiter(full_path, CIFS_DIR_SEP(cifs_sb));
3083         cFYI(1, "%s: full_path=%s", __func__, full_path);
3084         return full_path;
3085 }
3086
3087 /*
3088  * Perform a dfs referral query for a share and (optionally) prefix
3089  *
3090  * If a referral is found, cifs_sb->mountdata will be (re-)allocated
3091  * to a string containing updated options for the submount.  Otherwise it
3092  * will be left untouched.
3093  *
3094  * Returns the rc from get_dfs_path to the caller, which can be used to
3095  * determine whether there were referrals.
3096  */
3097 static int
3098 expand_dfs_referral(int xid, struct cifs_ses *pSesInfo,
3099                     struct smb_vol *volume_info, struct cifs_sb_info *cifs_sb,
3100                     int check_prefix)
3101 {
3102         int rc;
3103         unsigned int num_referrals = 0;
3104         struct dfs_info3_param *referrals = NULL;
3105         char *full_path = NULL, *ref_path = NULL, *mdata = NULL;
3106
3107         full_path = build_unc_path_to_root(volume_info, cifs_sb);
3108         if (IS_ERR(full_path))
3109                 return PTR_ERR(full_path);
3110
3111         /* For DFS paths, skip the first '\' of the UNC */
3112         ref_path = check_prefix ? full_path + 1 : volume_info->UNC + 1;
3113
3114         rc = get_dfs_path(xid, pSesInfo , ref_path, cifs_sb->local_nls,
3115                           &num_referrals, &referrals,
3116                           cifs_sb->mnt_cifs_flags & CIFS_MOUNT_MAP_SPECIAL_CHR);
3117
3118         if (!rc && num_referrals > 0) {
3119                 char *fake_devname = NULL;
3120
3121                 mdata = cifs_compose_mount_options(cifs_sb->mountdata,
3122                                                    full_path + 1, referrals,
3123                                                    &fake_devname);
3124
3125                 free_dfs_info_array(referrals, num_referrals);
3126
3127                 if (IS_ERR(mdata)) {
3128                         rc = PTR_ERR(mdata);
3129                         mdata = NULL;
3130                 } else {
3131                         cleanup_volume_info_contents(volume_info);
3132                         memset(volume_info, '\0', sizeof(*volume_info));
3133                         rc = cifs_setup_volume_info(volume_info, mdata,
3134                                                         fake_devname);
3135                 }
3136                 kfree(fake_devname);
3137                 kfree(cifs_sb->mountdata);
3138                 cifs_sb->mountdata = mdata;
3139         }
3140         kfree(full_path);
3141         return rc;
3142 }
3143 #endif
3144
3145 static int
3146 cifs_setup_volume_info(struct smb_vol *volume_info, char *mount_data,
3147                         const char *devname)
3148 {
3149         int rc = 0;
3150
3151         if (cifs_parse_mount_options(mount_data, devname, volume_info))
3152                 return -EINVAL;
3153
3154         if (volume_info->nullauth) {
3155                 cFYI(1, "null user");
3156                 volume_info->username = kzalloc(1, GFP_KERNEL);
3157                 if (volume_info->username == NULL)
3158                         return -ENOMEM;
3159         } else if (volume_info->username) {
3160                 /* BB fixme parse for domain name here */
3161                 cFYI(1, "Username: %s", volume_info->username);
3162         } else {
3163                 cifserror("No username specified");
3164         /* In userspace mount helper we can get user name from alternate
3165            locations such as env variables and files on disk */
3166                 return -EINVAL;
3167         }
3168
3169         /* this is needed for ASCII cp to Unicode converts */
3170         if (volume_info->iocharset == NULL) {
3171                 /* load_nls_default cannot return null */
3172                 volume_info->local_nls = load_nls_default();
3173         } else {
3174                 volume_info->local_nls = load_nls(volume_info->iocharset);
3175                 if (volume_info->local_nls == NULL) {
3176                         cERROR(1, "CIFS mount error: iocharset %s not found",
3177                                  volume_info->iocharset);
3178                         return -ELIBACC;
3179                 }
3180         }
3181
3182         return rc;
3183 }
3184
3185 struct smb_vol *
3186 cifs_get_volume_info(char *mount_data, const char *devname)
3187 {
3188         int rc;
3189         struct smb_vol *volume_info;
3190
3191         volume_info = kzalloc(sizeof(struct smb_vol), GFP_KERNEL);
3192         if (!volume_info)
3193                 return ERR_PTR(-ENOMEM);
3194
3195         rc = cifs_setup_volume_info(volume_info, mount_data, devname);
3196         if (rc) {
3197                 cifs_cleanup_volume_info(volume_info);
3198                 volume_info = ERR_PTR(rc);
3199         }
3200
3201         return volume_info;
3202 }
3203
3204 /* make sure ra_pages is a multiple of rsize */
3205 static inline unsigned int
3206 cifs_ra_pages(struct cifs_sb_info *cifs_sb)
3207 {
3208         unsigned int reads;
3209         unsigned int rsize_pages = cifs_sb->rsize / PAGE_CACHE_SIZE;
3210
3211         if (rsize_pages >= default_backing_dev_info.ra_pages)
3212                 return default_backing_dev_info.ra_pages;
3213         else if (rsize_pages == 0)
3214                 return rsize_pages;
3215
3216         reads = default_backing_dev_info.ra_pages / rsize_pages;
3217         return reads * rsize_pages;
3218 }
3219
3220 int
3221 cifs_mount(struct cifs_sb_info *cifs_sb, struct smb_vol *volume_info)
3222 {
3223         int rc = 0;
3224         int xid;
3225         struct cifs_ses *pSesInfo;
3226         struct cifs_tcon *tcon;
3227         struct TCP_Server_Info *srvTcp;
3228         char   *full_path;
3229         struct tcon_link *tlink;
3230 #ifdef CONFIG_CIFS_DFS_UPCALL
3231         int referral_walks_count = 0;
3232 #endif
3233
3234         rc = bdi_setup_and_register(&cifs_sb->bdi, "cifs", BDI_CAP_MAP_COPY);
3235         if (rc)
3236                 return rc;
3237
3238 #ifdef CONFIG_CIFS_DFS_UPCALL
3239 try_mount_again:
3240         /* cleanup activities if we're chasing a referral */
3241         if (referral_walks_count) {
3242                 if (tcon)
3243                         cifs_put_tcon(tcon);
3244                 else if (pSesInfo)
3245                         cifs_put_smb_ses(pSesInfo);
3246
3247                 FreeXid(xid);
3248         }
3249 #endif
3250         tcon = NULL;
3251         pSesInfo = NULL;
3252         srvTcp = NULL;
3253         full_path = NULL;
3254         tlink = NULL;
3255
3256         xid = GetXid();
3257
3258         /* get a reference to a tcp session */
3259         srvTcp = cifs_get_tcp_session(volume_info);
3260         if (IS_ERR(srvTcp)) {
3261                 rc = PTR_ERR(srvTcp);
3262                 bdi_destroy(&cifs_sb->bdi);
3263                 goto out;
3264         }
3265
3266         /* get a reference to a SMB session */
3267         pSesInfo = cifs_get_smb_ses(srvTcp, volume_info);
3268         if (IS_ERR(pSesInfo)) {
3269                 rc = PTR_ERR(pSesInfo);
3270                 pSesInfo = NULL;
3271                 goto mount_fail_check;
3272         }
3273
3274         /* search for existing tcon to this server share */
3275         tcon = cifs_get_tcon(pSesInfo, volume_info);
3276         if (IS_ERR(tcon)) {
3277                 rc = PTR_ERR(tcon);
3278                 tcon = NULL;
3279                 goto remote_path_check;
3280         }
3281
3282         /* tell server which Unix caps we support */
3283         if (tcon->ses->capabilities & CAP_UNIX) {
3284                 /* reset of caps checks mount to see if unix extensions
3285                    disabled for just this mount */
3286                 reset_cifs_unix_caps(xid, tcon, cifs_sb, volume_info);
3287                 if ((tcon->ses->server->tcpStatus == CifsNeedReconnect) &&
3288                     (le64_to_cpu(tcon->fsUnixInfo.Capability) &
3289                      CIFS_UNIX_TRANSPORT_ENCRYPTION_MANDATORY_CAP)) {
3290                         rc = -EACCES;
3291                         goto mount_fail_check;
3292                 }
3293         } else
3294                 tcon->unix_ext = 0; /* server does not support them */
3295
3296         /* do not care if following two calls succeed - informational */
3297         if (!tcon->ipc) {
3298                 CIFSSMBQFSDeviceInfo(xid, tcon);
3299                 CIFSSMBQFSAttributeInfo(xid, tcon);
3300         }
3301
3302         cifs_sb->wsize = cifs_negotiate_wsize(tcon, volume_info);
3303         cifs_sb->rsize = cifs_negotiate_rsize(tcon, volume_info);
3304
3305         /* tune readahead according to rsize */
3306         cifs_sb->bdi.ra_pages = cifs_ra_pages(cifs_sb);
3307
3308 remote_path_check:
3309 #ifdef CONFIG_CIFS_DFS_UPCALL
3310         /*
3311          * Perform an unconditional check for whether there are DFS
3312          * referrals for this path without prefix, to provide support
3313          * for DFS referrals from w2k8 servers which don't seem to respond
3314          * with PATH_NOT_COVERED to requests that include the prefix.
3315          * Chase the referral if found, otherwise continue normally.
3316          */
3317         if (referral_walks_count == 0) {
3318                 int refrc = expand_dfs_referral(xid, pSesInfo, volume_info,
3319                                                 cifs_sb, false);
3320                 if (!refrc) {
3321                         referral_walks_count++;
3322                         goto try_mount_again;
3323                 }
3324         }
3325 #endif
3326
3327         /* check if a whole path is not remote */
3328         if (!rc && tcon) {
3329                 /* build_path_to_root works only when we have a valid tcon */
3330                 full_path = cifs_build_path_to_root(volume_info, cifs_sb, tcon);
3331                 if (full_path == NULL) {
3332                         rc = -ENOMEM;
3333                         goto mount_fail_check;
3334                 }
3335                 rc = is_path_accessible(xid, tcon, cifs_sb, full_path);
3336                 if (rc != 0 && rc != -EREMOTE) {
3337                         kfree(full_path);
3338                         goto mount_fail_check;
3339                 }
3340                 kfree(full_path);
3341         }
3342
3343         /* get referral if needed */
3344         if (rc == -EREMOTE) {
3345 #ifdef CONFIG_CIFS_DFS_UPCALL
3346                 if (referral_walks_count > MAX_NESTED_LINKS) {
3347                         /*
3348                          * BB: when we implement proper loop detection,
3349                          *     we will remove this check. But now we need it
3350                          *     to prevent an indefinite loop if 'DFS tree' is
3351                          *     misconfigured (i.e. has loops).
3352                          */
3353                         rc = -ELOOP;
3354                         goto mount_fail_check;
3355                 }
3356
3357                 rc = expand_dfs_referral(xid, pSesInfo, volume_info, cifs_sb,
3358                                          true);
3359
3360                 if (!rc) {
3361                         referral_walks_count++;
3362                         goto try_mount_again;
3363                 }
3364                 goto mount_fail_check;
3365 #else /* No DFS support, return error on mount */
3366                 rc = -EOPNOTSUPP;
3367 #endif
3368         }
3369
3370         if (rc)
3371                 goto mount_fail_check;
3372
3373         /* now, hang the tcon off of the superblock */
3374         tlink = kzalloc(sizeof *tlink, GFP_KERNEL);
3375         if (tlink == NULL) {
3376                 rc = -ENOMEM;
3377                 goto mount_fail_check;
3378         }
3379
3380         tlink->tl_uid = pSesInfo->linux_uid;
3381         tlink->tl_tcon = tcon;
3382         tlink->tl_time = jiffies;
3383         set_bit(TCON_LINK_MASTER, &tlink->tl_flags);
3384         set_bit(TCON_LINK_IN_TREE, &tlink->tl_flags);
3385
3386         cifs_sb->master_tlink = tlink;
3387         spin_lock(&cifs_sb->tlink_tree_lock);
3388         tlink_rb_insert(&cifs_sb->tlink_tree, tlink);
3389         spin_unlock(&cifs_sb->tlink_tree_lock);
3390
3391         queue_delayed_work(system_nrt_wq, &cifs_sb->prune_tlinks,
3392                                 TLINK_IDLE_EXPIRE);
3393
3394 mount_fail_check:
3395         /* on error free sesinfo and tcon struct if needed */
3396         if (rc) {
3397                 /* If find_unc succeeded then rc == 0 so we can not end */
3398                 /* up accidentally freeing someone elses tcon struct */
3399                 if (tcon)
3400                         cifs_put_tcon(tcon);
3401                 else if (pSesInfo)
3402                         cifs_put_smb_ses(pSesInfo);
3403                 else
3404                         cifs_put_tcp_session(srvTcp);
3405                 bdi_destroy(&cifs_sb->bdi);
3406         }
3407
3408 out:
3409         FreeXid(xid);
3410         return rc;
3411 }
3412
3413 /*
3414  * Issue a TREE_CONNECT request. Note that for IPC$ shares, that the tcon
3415  * pointer may be NULL.
3416  */
3417 int
3418 CIFSTCon(unsigned int xid, struct cifs_ses *ses,
3419          const char *tree, struct cifs_tcon *tcon,
3420          const struct nls_table *nls_codepage)
3421 {
3422         struct smb_hdr *smb_buffer;
3423         struct smb_hdr *smb_buffer_response;
3424         TCONX_REQ *pSMB;
3425         TCONX_RSP *pSMBr;
3426         unsigned char *bcc_ptr;
3427         int rc = 0;
3428         int length;
3429         __u16 bytes_left, count;
3430
3431         if (ses == NULL)
3432                 return -EIO;
3433
3434         smb_buffer = cifs_buf_get();
3435         if (smb_buffer == NULL)
3436                 return -ENOMEM;
3437
3438         smb_buffer_response = smb_buffer;
3439
3440         header_assemble(smb_buffer, SMB_COM_TREE_CONNECT_ANDX,
3441                         NULL /*no tid */ , 4 /*wct */ );
3442
3443         smb_buffer->Mid = GetNextMid(ses->server);
3444         smb_buffer->Uid = ses->Suid;
3445         pSMB = (TCONX_REQ *) smb_buffer;
3446         pSMBr = (TCONX_RSP *) smb_buffer_response;
3447
3448         pSMB->AndXCommand = 0xFF;
3449         pSMB->Flags = cpu_to_le16(TCON_EXTENDED_SECINFO);
3450         bcc_ptr = &pSMB->Password[0];
3451         if (!tcon || (ses->server->sec_mode & SECMODE_USER)) {
3452                 pSMB->PasswordLength = cpu_to_le16(1);  /* minimum */
3453                 *bcc_ptr = 0; /* password is null byte */
3454                 bcc_ptr++;              /* skip password */
3455                 /* already aligned so no need to do it below */
3456         } else {
3457                 pSMB->PasswordLength = cpu_to_le16(CIFS_AUTH_RESP_SIZE);
3458                 /* BB FIXME add code to fail this if NTLMv2 or Kerberos
3459                    specified as required (when that support is added to
3460                    the vfs in the future) as only NTLM or the much
3461                    weaker LANMAN (which we do not send by default) is accepted
3462                    by Samba (not sure whether other servers allow
3463                    NTLMv2 password here) */
3464 #ifdef CONFIG_CIFS_WEAK_PW_HASH
3465                 if ((global_secflags & CIFSSEC_MAY_LANMAN) &&
3466                     (ses->server->secType == LANMAN))
3467                         calc_lanman_hash(tcon->password, ses->server->cryptkey,
3468                                          ses->server->sec_mode &
3469                                             SECMODE_PW_ENCRYPT ? true : false,
3470                                          bcc_ptr);
3471                 else
3472 #endif /* CIFS_WEAK_PW_HASH */
3473                 rc = SMBNTencrypt(tcon->password, ses->server->cryptkey,
3474                                         bcc_ptr, nls_codepage);
3475
3476                 bcc_ptr += CIFS_AUTH_RESP_SIZE;
3477                 if (ses->capabilities & CAP_UNICODE) {
3478                         /* must align unicode strings */
3479                         *bcc_ptr = 0; /* null byte password */
3480                         bcc_ptr++;
3481                 }
3482         }
3483
3484         if (ses->server->sec_mode &
3485                         (SECMODE_SIGN_REQUIRED | SECMODE_SIGN_ENABLED))
3486                 smb_buffer->Flags2 |= SMBFLG2_SECURITY_SIGNATURE;
3487
3488         if (ses->capabilities & CAP_STATUS32) {
3489                 smb_buffer->Flags2 |= SMBFLG2_ERR_STATUS;
3490         }
3491         if (ses->capabilities & CAP_DFS) {
3492                 smb_buffer->Flags2 |= SMBFLG2_DFS;
3493         }
3494         if (ses->capabilities & CAP_UNICODE) {
3495                 smb_buffer->Flags2 |= SMBFLG2_UNICODE;
3496                 length =
3497                     cifs_strtoUCS((__le16 *) bcc_ptr, tree,
3498                         6 /* max utf8 char length in bytes */ *
3499                         (/* server len*/ + 256 /* share len */), nls_codepage);
3500                 bcc_ptr += 2 * length;  /* convert num 16 bit words to bytes */
3501                 bcc_ptr += 2;   /* skip trailing null */
3502         } else {                /* ASCII */
3503                 strcpy(bcc_ptr, tree);
3504                 bcc_ptr += strlen(tree) + 1;
3505         }
3506         strcpy(bcc_ptr, "?????");
3507         bcc_ptr += strlen("?????");
3508         bcc_ptr += 1;
3509         count = bcc_ptr - &pSMB->Password[0];
3510         pSMB->hdr.smb_buf_length = cpu_to_be32(be32_to_cpu(
3511                                         pSMB->hdr.smb_buf_length) + count);
3512         pSMB->ByteCount = cpu_to_le16(count);
3513
3514         rc = SendReceive(xid, ses, smb_buffer, smb_buffer_response, &length,
3515                          0);
3516
3517         /* above now done in SendReceive */
3518         if ((rc == 0) && (tcon != NULL)) {
3519                 bool is_unicode;
3520
3521                 tcon->tidStatus = CifsGood;
3522                 tcon->need_reconnect = false;
3523                 tcon->tid = smb_buffer_response->Tid;
3524                 bcc_ptr = pByteArea(smb_buffer_response);
3525                 bytes_left = get_bcc(smb_buffer_response);
3526                 length = strnlen(bcc_ptr, bytes_left - 2);
3527                 if (smb_buffer->Flags2 & SMBFLG2_UNICODE)
3528                         is_unicode = true;
3529                 else
3530                         is_unicode = false;
3531
3532
3533                 /* skip service field (NB: this field is always ASCII) */
3534                 if (length == 3) {
3535                         if ((bcc_ptr[0] == 'I') && (bcc_ptr[1] == 'P') &&
3536                             (bcc_ptr[2] == 'C')) {
3537                                 cFYI(1, "IPC connection");
3538                                 tcon->ipc = 1;
3539                         }
3540                 } else if (length == 2) {
3541                         if ((bcc_ptr[0] == 'A') && (bcc_ptr[1] == ':')) {
3542                                 /* the most common case */
3543                                 cFYI(1, "disk share connection");
3544                         }
3545                 }
3546                 bcc_ptr += length + 1;
3547                 bytes_left -= (length + 1);
3548                 strncpy(tcon->treeName, tree, MAX_TREE_SIZE);
3549
3550                 /* mostly informational -- no need to fail on error here */
3551                 kfree(tcon->nativeFileSystem);
3552                 tcon->nativeFileSystem = cifs_strndup_from_ucs(bcc_ptr,
3553                                                       bytes_left, is_unicode,
3554                                                       nls_codepage);
3555
3556                 cFYI(1, "nativeFileSystem=%s", tcon->nativeFileSystem);
3557
3558                 if ((smb_buffer_response->WordCount == 3) ||
3559                          (smb_buffer_response->WordCount == 7))
3560                         /* field is in same location */
3561                         tcon->Flags = le16_to_cpu(pSMBr->OptionalSupport);
3562                 else
3563                         tcon->Flags = 0;
3564                 cFYI(1, "Tcon flags: 0x%x ", tcon->Flags);
3565         } else if ((rc == 0) && tcon == NULL) {
3566                 /* all we need to save for IPC$ connection */
3567                 ses->ipc_tid = smb_buffer_response->Tid;
3568         }
3569
3570         cifs_buf_release(smb_buffer);
3571         return rc;
3572 }
3573
3574 void
3575 cifs_umount(struct cifs_sb_info *cifs_sb)
3576 {
3577         struct rb_root *root = &cifs_sb->tlink_tree;
3578         struct rb_node *node;
3579         struct tcon_link *tlink;
3580
3581         cancel_delayed_work_sync(&cifs_sb->prune_tlinks);
3582
3583         spin_lock(&cifs_sb->tlink_tree_lock);
3584         while ((node = rb_first(root))) {
3585                 tlink = rb_entry(node, struct tcon_link, tl_rbnode);
3586                 cifs_get_tlink(tlink);
3587                 clear_bit(TCON_LINK_IN_TREE, &tlink->tl_flags);
3588                 rb_erase(node, root);
3589
3590                 spin_unlock(&cifs_sb->tlink_tree_lock);
3591                 cifs_put_tlink(tlink);
3592                 spin_lock(&cifs_sb->tlink_tree_lock);
3593         }
3594         spin_unlock(&cifs_sb->tlink_tree_lock);
3595
3596         bdi_destroy(&cifs_sb->bdi);
3597         kfree(cifs_sb->mountdata);
3598         unload_nls(cifs_sb->local_nls);
3599         kfree(cifs_sb);
3600 }
3601
3602 int cifs_negotiate_protocol(unsigned int xid, struct cifs_ses *ses)
3603 {
3604         int rc = 0;
3605         struct TCP_Server_Info *server = ses->server;
3606
3607         /* only send once per connect */
3608         if (server->maxBuf != 0)
3609                 return 0;
3610
3611         rc = CIFSSMBNegotiate(xid, ses);
3612         if (rc == -EAGAIN) {
3613                 /* retry only once on 1st time connection */
3614                 rc = CIFSSMBNegotiate(xid, ses);
3615                 if (rc == -EAGAIN)
3616                         rc = -EHOSTDOWN;
3617         }
3618         if (rc == 0) {
3619                 spin_lock(&GlobalMid_Lock);
3620                 if (server->tcpStatus == CifsNeedNegotiate)
3621                         server->tcpStatus = CifsGood;
3622                 else
3623                         rc = -EHOSTDOWN;
3624                 spin_unlock(&GlobalMid_Lock);
3625
3626         }
3627
3628         return rc;
3629 }
3630
3631
3632 int cifs_setup_session(unsigned int xid, struct cifs_ses *ses,
3633                         struct nls_table *nls_info)
3634 {
3635         int rc = 0;
3636         struct TCP_Server_Info *server = ses->server;
3637
3638         ses->flags = 0;
3639         ses->capabilities = server->capabilities;
3640         if (linuxExtEnabled == 0)
3641                 ses->capabilities &= (~CAP_UNIX);
3642
3643         cFYI(1, "Security Mode: 0x%x Capabilities: 0x%x TimeAdjust: %d",
3644                  server->sec_mode, server->capabilities, server->timeAdj);
3645
3646         rc = CIFS_SessSetup(xid, ses, nls_info);
3647         if (rc) {
3648                 cERROR(1, "Send error in SessSetup = %d", rc);
3649         } else {
3650                 mutex_lock(&ses->server->srv_mutex);
3651                 if (!server->session_estab) {
3652                         server->session_key.response = ses->auth_key.response;
3653                         server->session_key.len = ses->auth_key.len;
3654                         server->sequence_number = 0x2;
3655                         server->session_estab = true;
3656                         ses->auth_key.response = NULL;
3657                 }
3658                 mutex_unlock(&server->srv_mutex);
3659
3660                 cFYI(1, "CIFS Session Established successfully");
3661                 spin_lock(&GlobalMid_Lock);
3662                 ses->status = CifsGood;
3663                 ses->need_reconnect = false;
3664                 spin_unlock(&GlobalMid_Lock);
3665         }
3666
3667         kfree(ses->auth_key.response);
3668         ses->auth_key.response = NULL;
3669         ses->auth_key.len = 0;
3670         kfree(ses->ntlmssp);
3671         ses->ntlmssp = NULL;
3672
3673         return rc;
3674 }
3675
3676 static struct cifs_tcon *
3677 cifs_construct_tcon(struct cifs_sb_info *cifs_sb, uid_t fsuid)
3678 {
3679         struct cifs_tcon *master_tcon = cifs_sb_master_tcon(cifs_sb);
3680         struct cifs_ses *ses;
3681         struct cifs_tcon *tcon = NULL;
3682         struct smb_vol *vol_info;
3683         char username[28]; /* big enough for "krb50x" + hex of ULONG_MAX 6+16 */
3684                            /* We used to have this as MAX_USERNAME which is   */
3685                            /* way too big now (256 instead of 32) */
3686
3687         vol_info = kzalloc(sizeof(*vol_info), GFP_KERNEL);
3688         if (vol_info == NULL) {
3689                 tcon = ERR_PTR(-ENOMEM);
3690                 goto out;
3691         }
3692
3693         snprintf(username, sizeof(username), "krb50x%x", fsuid);
3694         vol_info->username = username;
3695         vol_info->local_nls = cifs_sb->local_nls;
3696         vol_info->linux_uid = fsuid;
3697         vol_info->cred_uid = fsuid;
3698         vol_info->UNC = master_tcon->treeName;
3699         vol_info->retry = master_tcon->retry;
3700         vol_info->nocase = master_tcon->nocase;
3701         vol_info->local_lease = master_tcon->local_lease;
3702         vol_info->no_linux_ext = !master_tcon->unix_ext;
3703
3704         /* FIXME: allow for other secFlg settings */
3705         vol_info->secFlg = CIFSSEC_MUST_KRB5;
3706
3707         /* get a reference for the same TCP session */
3708         spin_lock(&cifs_tcp_ses_lock);
3709         ++master_tcon->ses->server->srv_count;
3710         spin_unlock(&cifs_tcp_ses_lock);
3711
3712         ses = cifs_get_smb_ses(master_tcon->ses->server, vol_info);
3713         if (IS_ERR(ses)) {
3714                 tcon = (struct cifs_tcon *)ses;
3715                 cifs_put_tcp_session(master_tcon->ses->server);
3716                 goto out;
3717         }
3718
3719         tcon = cifs_get_tcon(ses, vol_info);
3720         if (IS_ERR(tcon)) {
3721                 cifs_put_smb_ses(ses);
3722                 goto out;
3723         }
3724
3725         if (ses->capabilities & CAP_UNIX)
3726                 reset_cifs_unix_caps(0, tcon, NULL, vol_info);
3727 out:
3728         kfree(vol_info);
3729
3730         return tcon;
3731 }
3732
3733 struct cifs_tcon *
3734 cifs_sb_master_tcon(struct cifs_sb_info *cifs_sb)
3735 {
3736         return tlink_tcon(cifs_sb_master_tlink(cifs_sb));
3737 }
3738
3739 static int
3740 cifs_sb_tcon_pending_wait(void *unused)
3741 {
3742         schedule();
3743         return signal_pending(current) ? -ERESTARTSYS : 0;
3744 }
3745
3746 /* find and return a tlink with given uid */
3747 static struct tcon_link *
3748 tlink_rb_search(struct rb_root *root, uid_t uid)
3749 {
3750         struct rb_node *node = root->rb_node;
3751         struct tcon_link *tlink;
3752
3753         while (node) {
3754                 tlink = rb_entry(node, struct tcon_link, tl_rbnode);
3755
3756                 if (tlink->tl_uid > uid)
3757                         node = node->rb_left;
3758                 else if (tlink->tl_uid < uid)
3759                         node = node->rb_right;
3760                 else
3761                         return tlink;
3762         }
3763         return NULL;
3764 }
3765
3766 /* insert a tcon_link into the tree */
3767 static void
3768 tlink_rb_insert(struct rb_root *root, struct tcon_link *new_tlink)
3769 {
3770         struct rb_node **new = &(root->rb_node), *parent = NULL;
3771         struct tcon_link *tlink;
3772
3773         while (*new) {
3774                 tlink = rb_entry(*new, struct tcon_link, tl_rbnode);
3775                 parent = *new;
3776
3777                 if (tlink->tl_uid > new_tlink->tl_uid)
3778                         new = &((*new)->rb_left);
3779                 else
3780                         new = &((*new)->rb_right);
3781         }
3782
3783         rb_link_node(&new_tlink->tl_rbnode, parent, new);
3784         rb_insert_color(&new_tlink->tl_rbnode, root);
3785 }
3786
3787 /*
3788  * Find or construct an appropriate tcon given a cifs_sb and the fsuid of the
3789  * current task.
3790  *
3791  * If the superblock doesn't refer to a multiuser mount, then just return
3792  * the master tcon for the mount.
3793  *
3794  * First, search the rbtree for an existing tcon for this fsuid. If one
3795  * exists, then check to see if it's pending construction. If it is then wait
3796  * for construction to complete. Once it's no longer pending, check to see if
3797  * it failed and either return an error or retry construction, depending on
3798  * the timeout.
3799  *
3800  * If one doesn't exist then insert a new tcon_link struct into the tree and
3801  * try to construct a new one.
3802  */
3803 struct tcon_link *
3804 cifs_sb_tlink(struct cifs_sb_info *cifs_sb)
3805 {
3806         int ret;
3807         uid_t fsuid = current_fsuid();
3808         struct tcon_link *tlink, *newtlink;
3809
3810         if (!(cifs_sb->mnt_cifs_flags & CIFS_MOUNT_MULTIUSER))
3811                 return cifs_get_tlink(cifs_sb_master_tlink(cifs_sb));
3812
3813         spin_lock(&cifs_sb->tlink_tree_lock);
3814         tlink = tlink_rb_search(&cifs_sb->tlink_tree, fsuid);
3815         if (tlink)
3816                 cifs_get_tlink(tlink);
3817         spin_unlock(&cifs_sb->tlink_tree_lock);
3818
3819         if (tlink == NULL) {
3820                 newtlink = kzalloc(sizeof(*tlink), GFP_KERNEL);
3821                 if (newtlink == NULL)
3822                         return ERR_PTR(-ENOMEM);
3823                 newtlink->tl_uid = fsuid;
3824                 newtlink->tl_tcon = ERR_PTR(-EACCES);
3825                 set_bit(TCON_LINK_PENDING, &newtlink->tl_flags);
3826                 set_bit(TCON_LINK_IN_TREE, &newtlink->tl_flags);
3827                 cifs_get_tlink(newtlink);
3828
3829                 spin_lock(&cifs_sb->tlink_tree_lock);
3830                 /* was one inserted after previous search? */
3831                 tlink = tlink_rb_search(&cifs_sb->tlink_tree, fsuid);
3832                 if (tlink) {
3833                         cifs_get_tlink(tlink);
3834                         spin_unlock(&cifs_sb->tlink_tree_lock);
3835                         kfree(newtlink);
3836                         goto wait_for_construction;
3837                 }
3838                 tlink = newtlink;
3839                 tlink_rb_insert(&cifs_sb->tlink_tree, tlink);
3840                 spin_unlock(&cifs_sb->tlink_tree_lock);
3841         } else {
3842 wait_for_construction:
3843                 ret = wait_on_bit(&tlink->tl_flags, TCON_LINK_PENDING,
3844                                   cifs_sb_tcon_pending_wait,
3845                                   TASK_INTERRUPTIBLE);
3846                 if (ret) {
3847                         cifs_put_tlink(tlink);
3848                         return ERR_PTR(ret);
3849                 }
3850
3851                 /* if it's good, return it */
3852                 if (!IS_ERR(tlink->tl_tcon))
3853                         return tlink;
3854
3855                 /* return error if we tried this already recently */
3856                 if (time_before(jiffies, tlink->tl_time + TLINK_ERROR_EXPIRE)) {
3857                         cifs_put_tlink(tlink);
3858                         return ERR_PTR(-EACCES);
3859                 }
3860
3861                 if (test_and_set_bit(TCON_LINK_PENDING, &tlink->tl_flags))
3862                         goto wait_for_construction;
3863         }
3864
3865         tlink->tl_tcon = cifs_construct_tcon(cifs_sb, fsuid);
3866         clear_bit(TCON_LINK_PENDING, &tlink->tl_flags);
3867         wake_up_bit(&tlink->tl_flags, TCON_LINK_PENDING);
3868
3869         if (IS_ERR(tlink->tl_tcon)) {
3870                 cifs_put_tlink(tlink);
3871                 return ERR_PTR(-EACCES);
3872         }
3873
3874         return tlink;
3875 }
3876
3877 /*
3878  * periodic workqueue job that scans tcon_tree for a superblock and closes
3879  * out tcons.
3880  */
3881 static void
3882 cifs_prune_tlinks(struct work_struct *work)
3883 {
3884         struct cifs_sb_info *cifs_sb = container_of(work, struct cifs_sb_info,
3885                                                     prune_tlinks.work);
3886         struct rb_root *root = &cifs_sb->tlink_tree;
3887         struct rb_node *node = rb_first(root);
3888         struct rb_node *tmp;
3889         struct tcon_link *tlink;
3890
3891         /*
3892          * Because we drop the spinlock in the loop in order to put the tlink
3893          * it's not guarded against removal of links from the tree. The only
3894          * places that remove entries from the tree are this function and
3895          * umounts. Because this function is non-reentrant and is canceled
3896          * before umount can proceed, this is safe.
3897          */
3898         spin_lock(&cifs_sb->tlink_tree_lock);
3899         node = rb_first(root);
3900         while (node != NULL) {
3901                 tmp = node;
3902                 node = rb_next(tmp);
3903                 tlink = rb_entry(tmp, struct tcon_link, tl_rbnode);
3904
3905                 if (test_bit(TCON_LINK_MASTER, &tlink->tl_flags) ||
3906                     atomic_read(&tlink->tl_count) != 0 ||
3907                     time_after(tlink->tl_time + TLINK_IDLE_EXPIRE, jiffies))
3908                         continue;
3909
3910                 cifs_get_tlink(tlink);
3911                 clear_bit(TCON_LINK_IN_TREE, &tlink->tl_flags);
3912                 rb_erase(tmp, root);
3913
3914                 spin_unlock(&cifs_sb->tlink_tree_lock);
3915                 cifs_put_tlink(tlink);
3916                 spin_lock(&cifs_sb->tlink_tree_lock);
3917         }
3918         spin_unlock(&cifs_sb->tlink_tree_lock);
3919
3920         queue_delayed_work(system_nrt_wq, &cifs_sb->prune_tlinks,
3921                                 TLINK_IDLE_EXPIRE);
3922 }