fs/cifs/connect.c

   1 /*
   2  *   fs/cifs/connect.c
   3  *
   4  *   Copyright (C) International Business Machines  Corp., 2002,2009
   5  *   Author(s): Steve French (sfrench@us.ibm.com)
   6  *
   7  *   This library is free software; you can redistribute it and/or modify
   8  *   it under the terms of the GNU Lesser General Public License as published
   9  *   by the Free Software Foundation; either version 2.1 of the License, or
  10  *   (at your option) any later version.
  11  *
  12  *   This library is distributed in the hope that it will be useful,
  13  *   but WITHOUT ANY WARRANTY; without even the implied warranty of
  14  *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See
  15  *   the GNU Lesser General Public License for more details.
  16  *
  17  *   You should have received a copy of the GNU Lesser General Public License
  18  *   along with this library; if not, write to the Free Software
  19  *   Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
  20  */
  21 #include <linux/fs.h>
  22 #include <linux/net.h>
  23 #include <linux/string.h>
  24 #include <linux/list.h>
  25 #include <linux/wait.h>
  26 #include <linux/slab.h>
  27 #include <linux/pagemap.h>
  28 #include <linux/ctype.h>
  29 #include <linux/utsname.h>
  30 #include <linux/mempool.h>
  31 #include <linux/delay.h>
  32 #include <linux/completion.h>
  33 #include <linux/kthread.h>
  34 #include <linux/pagevec.h>
  35 #include <linux/freezer.h>
  36 #include <linux/namei.h>
  37 #include <asm/uaccess.h>
  38 #include <asm/processor.h>
  39 #include <linux/inet.h>
  40 #include <net/ipv6.h>
  41 #include "cifspdu.h"
  42 #include "cifsglob.h"
  43 #include "cifsproto.h"
  44 #include "cifs_unicode.h"
  45 #include "cifs_debug.h"
  46 #include "cifs_fs_sb.h"
  47 #include "ntlmssp.h"
  48 #include "nterr.h"
  49 #include "rfc1002pdu.h"
  50 #include "fscache.h"
  51
  52 #define CIFS_PORT 445
  53 #define RFC1001_PORT 139
  54
  55 /* SMB echo "timeout" -- FIXME: tunable? */
  56 #define SMB_ECHO_INTERVAL (60 * HZ)
  57
  58 extern mempool_t *cifs_req_poolp;
  59
  60 /* FIXME: should these be tunable? */
  61 #define TLINK_ERROR_EXPIRE      (1 * HZ)
  62 #define TLINK_IDLE_EXPIRE       (600 * HZ)
  63
  64 static int ip_connect(struct TCP_Server_Info *server);
  65 static int generic_ip_connect(struct TCP_Server_Info *server);
  66 static void tlink_rb_insert(struct rb_root *root, struct tcon_link *new_tlink);
  67 static void cifs_prune_tlinks(struct work_struct *work);
  68 static int cifs_setup_volume_info(struct smb_vol *volume_info, char *mount_data,
  69                                         const char *devname);
  70
  71 /*
  72  * cifs tcp session reconnection
  73  *
  74  * mark tcp session as reconnecting so temporarily locked
  75  * mark all smb sessions as reconnecting for tcp session
  76  * reconnect tcp session
  77  * wake up waiters on reconnection? - (not needed currently)
  78  */
  79 static int
  80 cifs_reconnect(struct TCP_Server_Info *server)
  81 {
  82         int rc = 0;
  83         struct list_head *tmp, *tmp2;
  84         struct cifs_ses *ses;
  85         struct cifs_tcon *tcon;
  86         struct mid_q_entry *mid_entry;
  87         struct list_head retry_list;
  88
  89         spin_lock(&GlobalMid_Lock);
  90         if (server->tcpStatus == CifsExiting) {
  91                 /* the demux thread will exit normally
  92                 next time through the loop */
  93                 spin_unlock(&GlobalMid_Lock);
  94                 return rc;
  95         } else
  96                 server->tcpStatus = CifsNeedReconnect;
  97         spin_unlock(&GlobalMid_Lock);
  98         server->maxBuf = 0;
  99
 100         cFYI(1, "Reconnecting tcp session");
 101
 102         /* before reconnecting the tcp session, mark the smb session (uid)
 103                 and the tid bad so they are not used until reconnected */
 104         cFYI(1, "%s: marking sessions and tcons for reconnect", __func__);
 105         spin_lock(&cifs_tcp_ses_lock);
 106         list_for_each(tmp, &server->smb_ses_list) {
 107                 ses = list_entry(tmp, struct cifs_ses, smb_ses_list);
 108                 ses->need_reconnect = true;
 109                 ses->ipc_tid = 0;
 110                 list_for_each(tmp2, &ses->tcon_list) {
 111                         tcon = list_entry(tmp2, struct cifs_tcon, tcon_list);
 112                         tcon->need_reconnect = true;
 113                 }
 114         }
 115         spin_unlock(&cifs_tcp_ses_lock);
 116
 117         /* do not want to be sending data on a socket we are freeing */
 118         cFYI(1, "%s: tearing down socket", __func__);
 119         mutex_lock(&server->srv_mutex);
 120         if (server->ssocket) {
 121                 cFYI(1, "State: 0x%x Flags: 0x%lx", server->ssocket->state,
 122                         server->ssocket->flags);
 123                 kernel_sock_shutdown(server->ssocket, SHUT_WR);
 124                 cFYI(1, "Post shutdown state: 0x%x Flags: 0x%lx",
 125                         server->ssocket->state,
 126                         server->ssocket->flags);
 127                 sock_release(server->ssocket);
 128                 server->ssocket = NULL;
 129         }
 130         server->sequence_number = 0;
 131         server->session_estab = false;
 132         kfree(server->session_key.response);
 133         server->session_key.response = NULL;
 134         server->session_key.len = 0;
 135         server->lstrp = jiffies;
 136         mutex_unlock(&server->srv_mutex);
 137
 138         /* mark submitted MIDs for retry and issue callback */
 139         INIT_LIST_HEAD(&retry_list);
 140         cFYI(1, "%s: moving mids to private list", __func__);
 141         spin_lock(&GlobalMid_Lock);
 142         list_for_each_safe(tmp, tmp2, &server->pending_mid_q) {
 143                 mid_entry = list_entry(tmp, struct mid_q_entry, qhead);
 144                 if (mid_entry->midState == MID_REQUEST_SUBMITTED)
 145                         mid_entry->midState = MID_RETRY_NEEDED;
 146                 list_move(&mid_entry->qhead, &retry_list);
 147         }
 148         spin_unlock(&GlobalMid_Lock);
 149
 150         cFYI(1, "%s: issuing mid callbacks", __func__);
 151         list_for_each_safe(tmp, tmp2, &retry_list) {
 152                 mid_entry = list_entry(tmp, struct mid_q_entry, qhead);
 153                 list_del_init(&mid_entry->qhead);
 154                 mid_entry->callback(mid_entry);
 155         }
 156
 157         do {
 158                 try_to_freeze();
 159
 160                 /* we should try only the port we connected to before */
 161                 rc = generic_ip_connect(server);
 162                 if (rc) {
 163                         cFYI(1, "reconnect error %d", rc);
 164                         msleep(3000);
 165                 } else {
 166                         atomic_inc(&tcpSesReconnectCount);
 167                         spin_lock(&GlobalMid_Lock);
 168                         if (server->tcpStatus != CifsExiting)
 169                                 server->tcpStatus = CifsNeedNegotiate;
 170                         spin_unlock(&GlobalMid_Lock);
 171                 }
 172         } while (server->tcpStatus == CifsNeedReconnect);
 173
 174         return rc;
 175 }
 176
 177 /*
 178         return codes:
 179                 0       not a transact2, or all data present
 180                 >0      transact2 with that much data missing
 181                 -EINVAL = invalid transact2
 182
 183  */
 184 static int check2ndT2(struct smb_hdr *pSMB)
 185 {
 186         struct smb_t2_rsp *pSMBt;
 187         int remaining;
 188         __u16 total_data_size, data_in_this_rsp;
 189
 190         if (pSMB->Command != SMB_COM_TRANSACTION2)
 191                 return 0;
 192
 193         /* check for plausible wct, bcc and t2 data and parm sizes */
 194         /* check for parm and data offset going beyond end of smb */
 195         if (pSMB->WordCount != 10) { /* coalesce_t2 depends on this */
 196                 cFYI(1, "invalid transact2 word count");
 197                 return -EINVAL;
 198         }
 199
 200         pSMBt = (struct smb_t2_rsp *)pSMB;
 201
 202         total_data_size = get_unaligned_le16(&pSMBt->t2_rsp.TotalDataCount);
 203         data_in_this_rsp = get_unaligned_le16(&pSMBt->t2_rsp.DataCount);
 204
 205         if (total_data_size == data_in_this_rsp)
 206                 return 0;
 207         else if (total_data_size < data_in_this_rsp) {
 208                 cFYI(1, "total data %d smaller than data in frame %d",
 209                         total_data_size, data_in_this_rsp);
 210                 return -EINVAL;
 211         }
 212
 213         remaining = total_data_size - data_in_this_rsp;
 214
 215         cFYI(1, "missing %d bytes from transact2, check next response",
 216                 remaining);
 217         if (total_data_size > CIFSMaxBufSize) {
 218                 cERROR(1, "TotalDataSize %d is over maximum buffer %d",
 219                         total_data_size, CIFSMaxBufSize);
 220                 return -EINVAL;
 221         }
 222         return remaining;
 223 }
 224
 225 static int coalesce_t2(struct smb_hdr *psecond, struct smb_hdr *pTargetSMB)
 226 {
 227         struct smb_t2_rsp *pSMB2 = (struct smb_t2_rsp *)psecond;
 228         struct smb_t2_rsp *pSMBt  = (struct smb_t2_rsp *)pTargetSMB;
 229         char *data_area_of_target;
 230         char *data_area_of_buf2;
 231         int remaining;
 232         unsigned int byte_count, total_in_buf;
 233         __u16 total_data_size, total_in_buf2;
 234
 235         total_data_size = get_unaligned_le16(&pSMBt->t2_rsp.TotalDataCount);
 236
 237         if (total_data_size !=
 238             get_unaligned_le16(&pSMB2->t2_rsp.TotalDataCount))
 239                 cFYI(1, "total data size of primary and secondary t2 differ");
 240
 241         total_in_buf = get_unaligned_le16(&pSMBt->t2_rsp.DataCount);
 242
 243         remaining = total_data_size - total_in_buf;
 244
 245         if (remaining < 0)
 246                 return -EPROTO;
 247
 248         if (remaining == 0) /* nothing to do, ignore */
 249                 return 0;
 250
 251         total_in_buf2 = get_unaligned_le16(&pSMB2->t2_rsp.DataCount);
 252         if (remaining < total_in_buf2) {
 253                 cFYI(1, "transact2 2nd response contains too much data");
 254         }
 255
 256         /* find end of first SMB data area */
 257         data_area_of_target = (char *)&pSMBt->hdr.Protocol +
 258                                 get_unaligned_le16(&pSMBt->t2_rsp.DataOffset);
 259         /* validate target area */
 260
 261         data_area_of_buf2 = (char *)&pSMB2->hdr.Protocol +
 262                                 get_unaligned_le16(&pSMB2->t2_rsp.DataOffset);
 263
 264         data_area_of_target += total_in_buf;
 265
 266         /* copy second buffer into end of first buffer */
 267         total_in_buf += total_in_buf2;
 268         /* is the result too big for the field? */
 269         if (total_in_buf > USHRT_MAX)
 270                 return -EPROTO;
 271         put_unaligned_le16(total_in_buf, &pSMBt->t2_rsp.DataCount);
 272
 273         /* fix up the BCC */
 274         byte_count = get_bcc(pTargetSMB);
 275         byte_count += total_in_buf2;
 276         /* is the result too big for the field? */
 277         if (byte_count > USHRT_MAX)
 278                 return -EPROTO;
 279         put_bcc(byte_count, pTargetSMB);
 280
 281         byte_count = be32_to_cpu(pTargetSMB->smb_buf_length);
 282         byte_count += total_in_buf2;
 283         /* don't allow buffer to overflow */
 284         if (byte_count > CIFSMaxBufSize)
 285                 return -ENOBUFS;
 286         pTargetSMB->smb_buf_length = cpu_to_be32(byte_count);
 287
 288         memcpy(data_area_of_target, data_area_of_buf2, total_in_buf2);
 289
 290         if (remaining == total_in_buf2) {
 291                 cFYI(1, "found the last secondary response");
 292                 return 0; /* we are done */
 293         } else /* more responses to go */
 294                 return 1;
 295 }
 296
 297 static void
 298 cifs_echo_request(struct work_struct *work)
 299 {
 300         int rc;
 301         struct TCP_Server_Info *server = container_of(work,
 302                                         struct TCP_Server_Info, echo.work);
 303
 304         /*
 305          * We cannot send an echo until the NEGOTIATE_PROTOCOL request is
 306          * done, which is indicated by maxBuf != 0. Also, no need to ping if
 307          * we got a response recently
 308          */
 309         if (server->maxBuf == 0 ||
 310             time_before(jiffies, server->lstrp + SMB_ECHO_INTERVAL - HZ))
 311                 goto requeue_echo;
 312
 313         rc = CIFSSMBEcho(server);
 314         if (rc)
 315                 cFYI(1, "Unable to send echo request to server: %s",
 316                         server->hostname);
 317
 318 requeue_echo:
 319         queue_delayed_work(system_nrt_wq, &server->echo, SMB_ECHO_INTERVAL);
 320 }
 321
 322 static bool
 323 allocate_buffers(char **bigbuf, char **smallbuf, unsigned int size,
 324                  bool is_large_buf)
 325 {
 326         char *bbuf = *bigbuf, *sbuf = *smallbuf;
 327
 328         if (bbuf == NULL) {
 329                 bbuf = (char *)cifs_buf_get();
 330                 if (!bbuf) {
 331                         cERROR(1, "No memory for large SMB response");
 332                         msleep(3000);
 333                         /* retry will check if exiting */
 334                         return false;
 335                 }
 336         } else if (is_large_buf) {
 337                 /* we are reusing a dirty large buf, clear its start */
 338                 memset(bbuf, 0, size);
 339         }
 340
 341         if (sbuf == NULL) {
 342                 sbuf = (char *)cifs_small_buf_get();
 343                 if (!sbuf) {
 344                         cERROR(1, "No memory for SMB response");
 345                         msleep(1000);
 346                         /* retry will check if exiting */
 347                         return false;
 348                 }
 349                 /* beginning of smb buffer is cleared in our buf_get */
 350         } else {
 351                 /* if existing small buf clear beginning */
 352                 memset(sbuf, 0, size);
 353         }
 354
 355         *bigbuf = bbuf;
 356         *smallbuf = sbuf;
 357
 358         return true;
 359 }
 360
 361 static bool
 362 server_unresponsive(struct TCP_Server_Info *server)
 363 {
 364         if (echo_retries > 0 && server->tcpStatus == CifsGood &&
 365             time_after(jiffies, server->lstrp +
 366                                 (echo_retries * SMB_ECHO_INTERVAL))) {
 367                 cERROR(1, "Server %s has not responded in %d seconds. "
 368                           "Reconnecting...", server->hostname,
 369                           (echo_retries * SMB_ECHO_INTERVAL / HZ));
 370                 cifs_reconnect(server);
 371                 wake_up(&server->response_q);
 372                 return true;
 373         }
 374
 375         return false;
 376 }
 377
 378 /*
 379  * kvec_array_init - clone a kvec array, and advance into it
 380  * @new:        pointer to memory for cloned array
 381  * @iov:        pointer to original array
 382  * @nr_segs:    number of members in original array
 383  * @bytes:      number of bytes to advance into the cloned array
 384  *
 385  * This function will copy the array provided in iov to a section of memory
 386  * and advance the specified number of bytes into the new array. It returns
 387  * the number of segments in the new array. "new" must be at least as big as
 388  * the original iov array.
 389  */
 390 static unsigned int
 391 kvec_array_init(struct kvec *new, struct kvec *iov, unsigned int nr_segs,
 392                 size_t bytes)
 393 {
 394         size_t base = 0;
 395
 396         while (bytes || !iov->iov_len) {
 397                 int copy = min(bytes, iov->iov_len);
 398
 399                 bytes -= copy;
 400                 base += copy;
 401                 if (iov->iov_len == base) {
 402                         iov++;
 403                         nr_segs--;
 404                         base = 0;
 405                 }
 406         }
 407         memcpy(new, iov, sizeof(*iov) * nr_segs);
 408         new->iov_base += base;
 409         new->iov_len -= base;
 410         return nr_segs;
 411 }
 412
 413 static struct kvec *
 414 get_server_iovec(struct TCP_Server_Info *server, unsigned int nr_segs)
 415 {
 416         struct kvec *new_iov;
 417
 418         if (server->iov && nr_segs <= server->nr_iov)
 419                 return server->iov;
 420
 421         /* not big enough -- allocate a new one and release the old */
 422         new_iov = kmalloc(sizeof(*new_iov) * nr_segs, GFP_NOFS);
 423         if (new_iov) {
 424                 kfree(server->iov);
 425                 server->iov = new_iov;
 426                 server->nr_iov = nr_segs;
 427         }
 428         return new_iov;
 429 }
 430
 431 static int
 432 readv_from_socket(struct TCP_Server_Info *server, struct kvec *iov_orig,
 433                   unsigned int nr_segs, unsigned int to_read)
 434 {
 435         int length = 0;
 436         int total_read;
 437         unsigned int segs;
 438         struct msghdr smb_msg;
 439         struct kvec *iov;
 440
 441         iov = get_server_iovec(server, nr_segs);
 442         if (!iov)
 443                 return -ENOMEM;
 444
 445         smb_msg.msg_control = NULL;
 446         smb_msg.msg_controllen = 0;
 447
 448         for (total_read = 0; to_read; total_read += length, to_read -= length) {
 449                 if (server_unresponsive(server)) {
 450                         total_read = -EAGAIN;
 451                         break;
 452                 }
 453
 454                 segs = kvec_array_init(iov, iov_orig, nr_segs, total_read);
 455
 456                 length = kernel_recvmsg(server->ssocket, &smb_msg,
 457                                         iov, segs, to_read, 0);
 458
 459                 if (server->tcpStatus == CifsExiting) {
 460                         total_read = -ESHUTDOWN;
 461                         break;
 462                 } else if (server->tcpStatus == CifsNeedReconnect) {
 463                         cifs_reconnect(server);
 464                         total_read = -EAGAIN;
 465                         break;
 466                 } else if (length == -ERESTARTSYS ||
 467                            length == -EAGAIN ||
 468                            length == -EINTR) {
 469                         /*
 470                          * Minimum sleep to prevent looping, allowing socket
 471                          * to clear and app threads to set tcpStatus
 472                          * CifsNeedReconnect if server hung.
 473                          */
 474                         usleep_range(1000, 2000);
 475                         length = 0;
 476                         continue;
 477                 } else if (length <= 0) {
 478                         cFYI(1, "Received no data or error: expecting %d "
 479                                 "got %d", to_read, length);
 480                         cifs_reconnect(server);
 481                         total_read = -EAGAIN;
 482                         break;
 483                 }
 484         }
 485         return total_read;
 486 }
 487
 488 static int
 489 read_from_socket(struct TCP_Server_Info *server, char *buf,
 490                  unsigned int to_read)
 491 {
 492         struct kvec iov;
 493
 494         iov.iov_base = buf;
 495         iov.iov_len = to_read;
 496
 497         return readv_from_socket(server, &iov, 1, to_read);
 498 }
 499
 500 static bool
 501 is_smb_response(struct TCP_Server_Info *server, unsigned char type)
 502 {
 503         /*
 504          * The first byte big endian of the length field,
 505          * is actually not part of the length but the type
 506          * with the most common, zero, as regular data.
 507          */
 508         switch (type) {
 509         case RFC1002_SESSION_MESSAGE:
 510                 /* Regular SMB response */
 511                 return true;
 512         case RFC1002_SESSION_KEEP_ALIVE:
 513                 cFYI(1, "RFC 1002 session keep alive");
 514                 break;
 515         case RFC1002_POSITIVE_SESSION_RESPONSE:
 516                 cFYI(1, "RFC 1002 positive session response");
 517                 break;
 518         case RFC1002_NEGATIVE_SESSION_RESPONSE:
 519                 /*
 520                  * We get this from Windows 98 instead of an error on
 521                  * SMB negprot response.
 522                  */
 523                 cFYI(1, "RFC 1002 negative session response");
 524                 /* give server a second to clean up */
 525                 msleep(1000);
 526                 /*
 527                  * Always try 445 first on reconnect since we get NACK
 528                  * on some if we ever connected to port 139 (the NACK
 529                  * is since we do not begin with RFC1001 session
 530                  * initialize frame).
 531                  */
 532                 cifs_set_port((struct sockaddr *)&server->dstaddr, CIFS_PORT);
 533                 cifs_reconnect(server);
 534                 wake_up(&server->response_q);
 535                 break;
 536         default:
 537                 cERROR(1, "RFC 1002 unknown response type 0x%x", type);
 538                 cifs_reconnect(server);
 539         }
 540
 541         return false;
 542 }
 543
 544 static struct mid_q_entry *
 545 find_cifs_mid(struct TCP_Server_Info *server, struct smb_hdr *buf,
 546               int *length, bool is_large_buf, bool *is_multi_rsp, char **bigbuf)
 547 {
 548         struct mid_q_entry *mid = NULL, *tmp_mid, *ret = NULL;
 549
 550         spin_lock(&GlobalMid_Lock);
 551         list_for_each_entry_safe(mid, tmp_mid, &server->pending_mid_q, qhead) {
 552                 if (mid->mid != buf->Mid ||
 553                     mid->midState != MID_REQUEST_SUBMITTED ||
 554                     mid->command != buf->Command)
 555                         continue;
 556
 557                 if (*length == 0 && check2ndT2(buf) > 0) {
 558                         /* We have a multipart transact2 resp */
 559                         *is_multi_rsp = true;
 560                         if (mid->resp_buf) {
 561                                 /* merge response - fix up 1st*/
 562                                 *length = coalesce_t2(buf, mid->resp_buf);
 563                                 if (*length > 0) {
 564                                         *length = 0;
 565                                         mid->multiRsp = true;
 566                                         break;
 567                                 }
 568                                 /* All parts received or packet is malformed. */
 569                                 mid->multiEnd = true;
 570                                 goto multi_t2_fnd;
 571                         }
 572                         if (!is_large_buf) {
 573                                 /*FIXME: switch to already allocated largebuf?*/
 574                                 cERROR(1, "1st trans2 resp needs bigbuf");
 575                         } else {
 576                                 /* Have first buffer */
 577                                 mid->resp_buf = buf;
 578                                 mid->largeBuf = true;
 579                                 *bigbuf = NULL;
 580                         }
 581                         break;
 582                 }
 583                 mid->resp_buf = buf;
 584                 mid->largeBuf = is_large_buf;
 585 multi_t2_fnd:
 586                 if (*length == 0)
 587                         mid->midState = MID_RESPONSE_RECEIVED;
 588                 else
 589                         mid->midState = MID_RESPONSE_MALFORMED;
 590 #ifdef CONFIG_CIFS_STATS2
 591                 mid->when_received = jiffies;
 592 #endif
 593                 list_del_init(&mid->qhead);
 594                 ret = mid;
 595                 break;
 596         }
 597         spin_unlock(&GlobalMid_Lock);
 598
 599         return ret;
 600 }
 601
 602 static void clean_demultiplex_info(struct TCP_Server_Info *server)
 603 {
 604         int length;
 605
 606         /* take it off the list, if it's not already */
 607         spin_lock(&cifs_tcp_ses_lock);
 608         list_del_init(&server->tcp_ses_list);
 609         spin_unlock(&cifs_tcp_ses_lock);
 610
 611         spin_lock(&GlobalMid_Lock);
 612         server->tcpStatus = CifsExiting;
 613         spin_unlock(&GlobalMid_Lock);
 614         wake_up_all(&server->response_q);
 615
 616         /*
 617          * Check if we have blocked requests that need to free. Note that
 618          * cifs_max_pending is normally 50, but can be set at module install
 619          * time to as little as two.
 620          */
 621         spin_lock(&GlobalMid_Lock);
 622         if (atomic_read(&server->inFlight) >= cifs_max_pending)
 623                 atomic_set(&server->inFlight, cifs_max_pending - 1);
 624         /*
 625          * We do not want to set the max_pending too low or we could end up
 626          * with the counter going negative.
 627          */
 628         spin_unlock(&GlobalMid_Lock);
 629         /*
 630          * Although there should not be any requests blocked on this queue it
 631          * can not hurt to be paranoid and try to wake up requests that may
 632          * haven been blocked when more than 50 at time were on the wire to the
 633          * same server - they now will see the session is in exit state and get
 634          * out of SendReceive.
 635          */
 636         wake_up_all(&server->request_q);
 637         /* give those requests time to exit */
 638         msleep(125);
 639
 640         if (server->ssocket) {
 641                 sock_release(server->ssocket);
 642                 server->ssocket = NULL;
 643         }
 644
 645         if (!list_empty(&server->pending_mid_q)) {
 646                 struct list_head dispose_list;
 647                 struct mid_q_entry *mid_entry;
 648                 struct list_head *tmp, *tmp2;
 649
 650                 INIT_LIST_HEAD(&dispose_list);
 651                 spin_lock(&GlobalMid_Lock);
 652                 list_for_each_safe(tmp, tmp2, &server->pending_mid_q) {
 653                         mid_entry = list_entry(tmp, struct mid_q_entry, qhead);
 654                         cFYI(1, "Clearing mid 0x%x", mid_entry->mid);
 655                         mid_entry->midState = MID_SHUTDOWN;
 656                         list_move(&mid_entry->qhead, &dispose_list);
 657                 }
 658                 spin_unlock(&GlobalMid_Lock);
 659
 660                 /* now walk dispose list and issue callbacks */
 661                 list_for_each_safe(tmp, tmp2, &dispose_list) {
 662                         mid_entry = list_entry(tmp, struct mid_q_entry, qhead);
 663                         cFYI(1, "Callback mid 0x%x", mid_entry->mid);
 664                         list_del_init(&mid_entry->qhead);
 665                         mid_entry->callback(mid_entry);
 666                 }
 667                 /* 1/8th of sec is more than enough time for them to exit */
 668                 msleep(125);
 669         }
 670
 671         if (!list_empty(&server->pending_mid_q)) {
 672                 /*
 673                  * mpx threads have not exited yet give them at least the smb
 674                  * send timeout time for long ops.
 675                  *
 676                  * Due to delays on oplock break requests, we need to wait at
 677                  * least 45 seconds before giving up on a request getting a
 678                  * response and going ahead and killing cifsd.
 679                  */
 680                 cFYI(1, "Wait for exit from demultiplex thread");
 681                 msleep(46000);
 682                 /*
 683                  * If threads still have not exited they are probably never
 684                  * coming home not much else we can do but free the memory.
 685                  */
 686         }
 687
 688         kfree(server->hostname);
 689         kfree(server->iov);
 690         kfree(server);
 691
 692         length = atomic_dec_return(&tcpSesAllocCount);
 693         if (length > 0)
 694                 mempool_resize(cifs_req_poolp, length + cifs_min_rcv,
 695                                 GFP_KERNEL);
 696 }
 697
 698 static int
 699 cifs_demultiplex_thread(void *p)
 700 {
 701         int length;
 702         struct TCP_Server_Info *server = p;
 703         unsigned int pdu_length, total_read;
 704         char *buf = NULL, *bigbuf = NULL, *smallbuf = NULL;
 705         struct smb_hdr *smb_buffer = NULL;
 706         struct task_struct *task_to_wake = NULL;
 707         struct mid_q_entry *mid_entry;
 708         bool isLargeBuf = false;
 709         bool isMultiRsp = false;
 710
 711         current->flags |= PF_MEMALLOC;
 712         cFYI(1, "Demultiplex PID: %d", task_pid_nr(current));
 713
 714         length = atomic_inc_return(&tcpSesAllocCount);
 715         if (length > 1)
 716                 mempool_resize(cifs_req_poolp, length + cifs_min_rcv,
 717                                 GFP_KERNEL);
 718
 719         set_freezable();
 720         while (server->tcpStatus != CifsExiting) {
 721                 if (try_to_freeze())
 722                         continue;
 723
 724                 if (!allocate_buffers(&bigbuf, &smallbuf,
 725                                       sizeof(struct smb_hdr), isLargeBuf))
 726                         continue;
 727
 728                 isLargeBuf = false;
 729                 isMultiRsp = false;
 730                 smb_buffer = (struct smb_hdr *)smallbuf;
 731                 buf = smallbuf;
 732                 pdu_length = 4; /* enough to get RFC1001 header */
 733
 734                 length = read_from_socket(server, buf, pdu_length);
 735                 if (length < 0)
 736                         continue;
 737                 total_read = length;
 738
 739                 /*
 740                  * The right amount was read from socket - 4 bytes,
 741                  * so we can now interpret the length field.
 742                  */
 743                 pdu_length = be32_to_cpu(smb_buffer->smb_buf_length);
 744
 745                 cFYI(1, "RFC1002 header 0x%x", pdu_length);
 746                 if (!is_smb_response(server, buf[0]))
 747                         continue;
 748
 749                 /* make sure we have enough to get to the MID */
 750                 if (pdu_length < sizeof(struct smb_hdr) - 1 - 4) {
 751                         cERROR(1, "SMB response too short (%u bytes)",
 752                                 pdu_length);
 753                         cifs_reconnect(server);
 754                         wake_up(&server->response_q);
 755                         continue;
 756                 }
 757
 758                 /* read down to the MID */
 759                 length = read_from_socket(server, buf + 4,
 760                                           sizeof(struct smb_hdr) - 1 - 4);
 761                 if (length < 0)
 762                         continue;
 763                 total_read += length;
 764
 765                 if (pdu_length > CIFSMaxBufSize + MAX_CIFS_HDR_SIZE - 4) {
 766                         cERROR(1, "SMB response too long (%u bytes)",
 767                                 pdu_length);
 768                         cifs_reconnect(server);
 769                         wake_up(&server->response_q);
 770                         continue;
 771                 }
 772
 773                 /* else length ok */
 774                 if (pdu_length > MAX_CIFS_SMALL_BUFFER_SIZE - 4) {
 775                         isLargeBuf = true;
 776                         memcpy(bigbuf, smallbuf, total_read);
 777                         smb_buffer = (struct smb_hdr *)bigbuf;
 778                         buf = bigbuf;
 779                 }
 780
 781                 /* now read the rest */
 782                 length = read_from_socket(server,
 783                                   buf + sizeof(struct smb_hdr) - 1,
 784                                   pdu_length - sizeof(struct smb_hdr) + 1 + 4);
 785                 if (length < 0)
 786                         continue;
 787                 total_read += length;
 788
 789                 dump_smb(smb_buffer, total_read);
 790
 791                 /*
 792                  * We know that we received enough to get to the MID as we
 793                  * checked the pdu_length earlier. Now check to see
 794                  * if the rest of the header is OK. We borrow the length
 795                  * var for the rest of the loop to avoid a new stack var.
 796                  *
 797                  * 48 bytes is enough to display the header and a little bit
 798                  * into the payload for debugging purposes.
 799                  */
 800                 length = checkSMB(smb_buffer, smb_buffer->Mid, total_read);
 801                 if (length != 0)
 802                         cifs_dump_mem("Bad SMB: ", buf,
 803                                       min_t(unsigned int, total_read, 48));
 804
 805                 server->lstrp = jiffies;
 806
 807                 mid_entry = find_cifs_mid(server, smb_buffer, &length,
 808                                           isLargeBuf, &isMultiRsp, &bigbuf);
 809                 if (mid_entry != NULL) {
 810                         mid_entry->callback(mid_entry);
 811                         /* Was previous buf put in mpx struct for multi-rsp? */
 812                         if (!isMultiRsp) {
 813                                 /* smb buffer will be freed by user thread */
 814                                 if (isLargeBuf)
 815                                         bigbuf = NULL;
 816                                 else
 817                                         smallbuf = NULL;
 818                         }
 819                 } else if (length != 0) {
 820                         /* response sanity checks failed */
 821                         continue;
 822                 } else if (!is_valid_oplock_break(smb_buffer, server) &&
 823                            !isMultiRsp) {
 824                         cERROR(1, "No task to wake, unknown frame received! "
 825                                    "NumMids %d", atomic_read(&midCount));
 826                         cifs_dump_mem("Received Data is: ", buf,
 827                                       sizeof(struct smb_hdr));
 828 #ifdef CONFIG_CIFS_DEBUG2
 829                         cifs_dump_detail(smb_buffer);
 830                         cifs_dump_mids(server);
 831 #endif /* CIFS_DEBUG2 */
 832
 833                 }
 834         } /* end while !EXITING */
 835
 836         /* buffer usually freed in free_mid - need to free it here on exit */
 837         cifs_buf_release(bigbuf);
 838         if (smallbuf) /* no sense logging a debug message if NULL */
 839                 cifs_small_buf_release(smallbuf);
 840
 841         task_to_wake = xchg(&server->tsk, NULL);
 842         clean_demultiplex_info(server);
 843
 844         /* if server->tsk was NULL then wait for a signal before exiting */
 845         if (!task_to_wake) {
 846                 set_current_state(TASK_INTERRUPTIBLE);
 847                 while (!signal_pending(current)) {
 848                         schedule();
 849                         set_current_state(TASK_INTERRUPTIBLE);
 850                 }
 851                 set_current_state(TASK_RUNNING);
 852         }
 853
 854         module_put_and_exit(0);
 855 }
 856
 857 /* extract the host portion of the UNC string */
 858 static char *
 859 extract_hostname(const char *unc)
 860 {
 861         const char *src;
 862         char *dst, *delim;
 863         unsigned int len;
 864
 865         /* skip double chars at beginning of string */
 866         /* BB: check validity of these bytes? */
 867         src = unc + 2;
 868
 869         /* delimiter between hostname and sharename is always '\\' now */
 870         delim = strchr(src, '\\');
 871         if (!delim)
 872                 return ERR_PTR(-EINVAL);
 873
 874         len = delim - src;
 875         dst = kmalloc((len + 1), GFP_KERNEL);
 876         if (dst == NULL)
 877                 return ERR_PTR(-ENOMEM);
 878
 879         memcpy(dst, src, len);
 880         dst[len] = '\0';
 881
 882         return dst;
 883 }
 884
 885 static int
 886 cifs_parse_mount_options(const char *mountdata, const char *devname,
 887                          struct smb_vol *vol)
 888 {
 889         char *value, *data, *end;
 890         char *mountdata_copy = NULL, *options;
 891         int err;
 892         unsigned int  temp_len, i, j;
 893         char separator[2];
 894         short int override_uid = -1;
 895         short int override_gid = -1;
 896         bool uid_specified = false;
 897         bool gid_specified = false;
 898         char *nodename = utsname()->nodename;
 899
 900         separator[0] = ',';
 901         separator[1] = 0;
 902
 903         /*
 904          * does not have to be perfect mapping since field is
 905          * informational, only used for servers that do not support
 906          * port 445 and it can be overridden at mount time
 907          */
 908         memset(vol->source_rfc1001_name, 0x20, RFC1001_NAME_LEN);
 909         for (i = 0; i < strnlen(nodename, RFC1001_NAME_LEN); i++)
 910                 vol->source_rfc1001_name[i] = toupper(nodename[i]);
 911
 912         vol->source_rfc1001_name[RFC1001_NAME_LEN] = 0;
 913         /* null target name indicates to use *SMBSERVR default called name
 914            if we end up sending RFC1001 session initialize */
 915         vol->target_rfc1001_name[0] = 0;
 916         vol->cred_uid = current_uid();
 917         vol->linux_uid = current_uid();
 918         vol->linux_gid = current_gid();
 919
 920         /* default to only allowing write access to owner of the mount */
 921         vol->dir_mode = vol->file_mode = S_IRUGO | S_IXUGO | S_IWUSR;
 922
 923         /* vol->retry default is 0 (i.e. "soft" limited retry not hard retry) */
 924         /* default is always to request posix paths. */
 925         vol->posix_paths = 1;
 926         /* default to using server inode numbers where available */
 927         vol->server_ino = 1;
 928
 929         vol->actimeo = CIFS_DEF_ACTIMEO;
 930
 931         if (!mountdata)
 932                 goto cifs_parse_mount_err;
 933
 934         mountdata_copy = kstrndup(mountdata, PAGE_SIZE, GFP_KERNEL);
 935         if (!mountdata_copy)
 936                 goto cifs_parse_mount_err;
 937
 938         options = mountdata_copy;
 939         end = options + strlen(options);
 940         if (strncmp(options, "sep=", 4) == 0) {
 941                 if (options[4] != 0) {
 942                         separator[0] = options[4];
 943                         options += 5;
 944                 } else {
 945                         cFYI(1, "Null separator not allowed");
 946                 }
 947         }
 948         vol->backupuid_specified = false; /* no backup intent for a user */
 949         vol->backupgid_specified = false; /* no backup intent for a group */
 950
 951         while ((data = strsep(&options, separator)) != NULL) {
 952                 if (!*data)
 953                         continue;
 954                 if ((value = strchr(data, '=')) != NULL)
 955                         *value++ = '\0';
 956
 957                 /* Have to parse this before we parse for "user" */
 958                 if (strnicmp(data, "user_xattr", 10) == 0) {
 959                         vol->no_xattr = 0;
 960                 } else if (strnicmp(data, "nouser_xattr", 12) == 0) {
 961                         vol->no_xattr = 1;
 962                 } else if (strnicmp(data, "user", 4) == 0) {
 963                         if (!value) {
 964                                 printk(KERN_WARNING
 965                                        "CIFS: invalid or missing username\n");
 966                                 goto cifs_parse_mount_err;
 967                         } else if (!*value) {
 968                                 /* null user, ie anonymous, authentication */
 969                                 vol->nullauth = 1;
 970                         }
 971                         if (strnlen(value, MAX_USERNAME_SIZE) <
 972                                                 MAX_USERNAME_SIZE) {
 973                                 vol->username = kstrdup(value, GFP_KERNEL);
 974                                 if (!vol->username) {
 975                                         printk(KERN_WARNING "CIFS: no memory "
 976                                                             "for username\n");
 977                                         goto cifs_parse_mount_err;
 978                                 }
 979                         } else {
 980                                 printk(KERN_WARNING "CIFS: username too long\n");
 981                                 goto cifs_parse_mount_err;
 982                         }
 983                 } else if (strnicmp(data, "pass", 4) == 0) {
 984                         if (!value) {
 985                                 vol->password = NULL;
 986                                 continue;
 987                         } else if (value[0] == 0) {
 988                                 /* check if string begins with double comma
 989                                    since that would mean the password really
 990                                    does start with a comma, and would not
 991                                    indicate an empty string */
 992                                 if (value[1] != separator[0]) {
 993                                         vol->password = NULL;
 994                                         continue;
 995                                 }
 996                         }
 997                         temp_len = strlen(value);
 998                         /* removed password length check, NTLM passwords
 999                                 can be arbitrarily long */
1000
1001                         /* if comma in password, the string will be
1002                         prematurely null terminated.  Commas in password are
1003                         specified across the cifs mount interface by a double
1004                         comma ie ,, and a comma used as in other cases ie ','
1005                         as a parameter delimiter/separator is single and due
1006                         to the strsep above is temporarily zeroed. */
1007
1008                         /* NB: password legally can have multiple commas and
1009                         the only illegal character in a password is null */
1010
1011                         if ((value[temp_len] == 0) &&
1012                             (value + temp_len < end) &&
1013                             (value[temp_len+1] == separator[0])) {
1014                                 /* reinsert comma */
1015                                 value[temp_len] = separator[0];
1016                                 temp_len += 2;  /* move after second comma */
1017                                 while (value[temp_len] != 0)  {
1018                                         if (value[temp_len] == separator[0]) {
1019                                                 if (value[temp_len+1] ==
1020                                                      separator[0]) {
1021                                                 /* skip second comma */
1022                                                         temp_len++;
1023                                                 } else {
1024                                                 /* single comma indicating start
1025                                                          of next parm */
1026                                                         break;
1027                                                 }
1028                                         }
1029                                         temp_len++;
1030                                 }
1031                                 if (value[temp_len] == 0) {
1032                                         options = NULL;
1033                                 } else {
1034                                         value[temp_len] = 0;
1035                                         /* point option to start of next parm */
1036                                         options = value + temp_len + 1;
1037                                 }
1038                                 /* go from value to value + temp_len condensing
1039                                 double commas to singles. Note that this ends up
1040                                 allocating a few bytes too many, which is ok */
1041                                 vol->password = kzalloc(temp_len, GFP_KERNEL);
1042                                 if (vol->password == NULL) {
1043                                         printk(KERN_WARNING "CIFS: no memory "
1044                                                             "for password\n");
1045                                         goto cifs_parse_mount_err;
1046                                 }
1047                                 for (i = 0, j = 0; i < temp_len; i++, j++) {
1048                                         vol->password[j] = value[i];
1049                                         if (value[i] == separator[0]
1050                                                 && value[i+1] == separator[0]) {
1051                                                 /* skip second comma */
1052                                                 i++;
1053                                         }
1054                                 }
1055                                 vol->password[j] = 0;
1056                         } else {
1057                                 vol->password = kzalloc(temp_len+1, GFP_KERNEL);
1058                                 if (vol->password == NULL) {
1059                                         printk(KERN_WARNING "CIFS: no memory "
1060                                                             "for password\n");
1061                                         goto cifs_parse_mount_err;
1062                                 }
1063                                 strcpy(vol->password, value);
1064                         }
1065                 } else if (!strnicmp(data, "ip", 2) ||
1066                            !strnicmp(data, "addr", 4)) {
1067                         if (!value || !*value) {
1068                                 vol->UNCip = NULL;
1069                         } else if (strnlen(value, INET6_ADDRSTRLEN) <
1070                                                         INET6_ADDRSTRLEN) {
1071                                 vol->UNCip = kstrdup(value, GFP_KERNEL);
1072                                 if (!vol->UNCip) {
1073                                         printk(KERN_WARNING "CIFS: no memory "
1074                                                             "for UNC IP\n");
1075                                         goto cifs_parse_mount_err;
1076                                 }
1077                         } else {
1078                                 printk(KERN_WARNING "CIFS: ip address "
1079                                                     "too long\n");
1080                                 goto cifs_parse_mount_err;
1081                         }
1082                 } else if (strnicmp(data, "sec", 3) == 0) {
1083                         if (!value || !*value) {
1084                                 cERROR(1, "no security value specified");
1085                                 continue;
1086                         } else if (strnicmp(value, "krb5i", 5) == 0) {
1087                                 vol->secFlg |= CIFSSEC_MAY_KRB5 |
1088                                         CIFSSEC_MUST_SIGN;
1089                         } else if (strnicmp(value, "krb5p", 5) == 0) {
1090                                 /* vol->secFlg |= CIFSSEC_MUST_SEAL |
1091                                         CIFSSEC_MAY_KRB5; */
1092                                 cERROR(1, "Krb5 cifs privacy not supported");
1093                                 goto cifs_parse_mount_err;
1094                         } else if (strnicmp(value, "krb5", 4) == 0) {
1095                                 vol->secFlg |= CIFSSEC_MAY_KRB5;
1096                         } else if (strnicmp(value, "ntlmsspi", 8) == 0) {
1097                                 vol->secFlg |= CIFSSEC_MAY_NTLMSSP |
1098                                         CIFSSEC_MUST_SIGN;
1099                         } else if (strnicmp(value, "ntlmssp", 7) == 0) {
1100                                 vol->secFlg |= CIFSSEC_MAY_NTLMSSP;
1101                         } else if (strnicmp(value, "ntlmv2i", 7) == 0) {
1102                                 vol->secFlg |= CIFSSEC_MAY_NTLMV2 |
1103                                         CIFSSEC_MUST_SIGN;
1104                         } else if (strnicmp(value, "ntlmv2", 6) == 0) {
1105                                 vol->secFlg |= CIFSSEC_MAY_NTLMV2;
1106                         } else if (strnicmp(value, "ntlmi", 5) == 0) {
1107                                 vol->secFlg |= CIFSSEC_MAY_NTLM |
1108                                         CIFSSEC_MUST_SIGN;
1109                         } else if (strnicmp(value, "ntlm", 4) == 0) {
1110                                 /* ntlm is default so can be turned off too */
1111                                 vol->secFlg |= CIFSSEC_MAY_NTLM;
1112                         } else if (strnicmp(value, "nontlm", 6) == 0) {
1113                                 /* BB is there a better way to do this? */
1114                                 vol->secFlg |= CIFSSEC_MAY_NTLMV2;
1115 #ifdef CONFIG_CIFS_WEAK_PW_HASH
1116                         } else if (strnicmp(value, "lanman", 6) == 0) {
1117                                 vol->secFlg |= CIFSSEC_MAY_LANMAN;
1118 #endif
1119                         } else if (strnicmp(value, "none", 4) == 0) {
1120                                 vol->nullauth = 1;
1121                         } else {
1122                                 cERROR(1, "bad security option: %s", value);
1123                                 goto cifs_parse_mount_err;
1124                         }
1125                 } else if (strnicmp(data, "vers", 3) == 0) {
1126                         if (!value || !*value) {
1127                                 cERROR(1, "no protocol version specified"
1128                                           " after vers= mount option");
1129                         } else if ((strnicmp(value, "cifs", 4) == 0) ||
1130                                    (strnicmp(value, "1", 1) == 0)) {
1131                                 /* this is the default */
1132                                 continue;
1133                         }
1134                 } else if ((strnicmp(data, "unc", 3) == 0)
1135                            || (strnicmp(data, "target", 6) == 0)
1136                            || (strnicmp(data, "path", 4) == 0)) {
1137                         if (!value || !*value) {
1138                                 printk(KERN_WARNING "CIFS: invalid path to "
1139                                                     "network resource\n");
1140                                 goto cifs_parse_mount_err;
1141                         }
1142                         if ((temp_len = strnlen(value, 300)) < 300) {
1143                                 vol->UNC = kmalloc(temp_len+1, GFP_KERNEL);
1144                                 if (vol->UNC == NULL)
1145                                         goto cifs_parse_mount_err;
1146                                 strcpy(vol->UNC, value);
1147                                 if (strncmp(vol->UNC, "//", 2) == 0) {
1148                                         vol->UNC[0] = '\\';
1149                                         vol->UNC[1] = '\\';
1150                                 } else if (strncmp(vol->UNC, "\\\\", 2) != 0) {
1151                                         printk(KERN_WARNING
1152                                                "CIFS: UNC Path does not begin "
1153                                                "with // or \\\\ \n");
1154                                         goto cifs_parse_mount_err;
1155                                 }
1156                         } else {
1157                                 printk(KERN_WARNING "CIFS: UNC name too long\n");
1158                                 goto cifs_parse_mount_err;
1159                         }
1160                 } else if ((strnicmp(data, "domain", 3) == 0)
1161                            || (strnicmp(data, "workgroup", 5) == 0)) {
1162                         if (!value || !*value) {
1163                                 printk(KERN_WARNING "CIFS: invalid domain name\n");
1164                                 goto cifs_parse_mount_err;
1165                         }
1166                         /* BB are there cases in which a comma can be valid in
1167                         a domain name and need special handling? */
1168                         if (strnlen(value, 256) < 256) {
1169                                 vol->domainname = kstrdup(value, GFP_KERNEL);
1170                                 if (!vol->domainname) {
1171                                         printk(KERN_WARNING "CIFS: no memory "
1172                                                             "for domainname\n");
1173                                         goto cifs_parse_mount_err;
1174                                 }
1175                                 cFYI(1, "Domain name set");
1176                         } else {
1177                                 printk(KERN_WARNING "CIFS: domain name too "
1178                                                     "long\n");
1179                                 goto cifs_parse_mount_err;
1180                         }
1181                 } else if (strnicmp(data, "srcaddr", 7) == 0) {
1182                         vol->srcaddr.ss_family = AF_UNSPEC;
1183
1184                         if (!value || !*value) {
1185                                 printk(KERN_WARNING "CIFS: srcaddr value"
1186                                        " not specified.\n");
1187                                 goto cifs_parse_mount_err;
1188                         }
1189                         i = cifs_convert_address((struct sockaddr *)&vol->srcaddr,
1190                                                  value, strlen(value));
1191                         if (i == 0) {
1192                                 printk(KERN_WARNING "CIFS:  Could not parse"
1193                                        " srcaddr: %s\n",
1194                                        value);
1195                                 goto cifs_parse_mount_err;
1196                         }
1197                 } else if (strnicmp(data, "prefixpath", 10) == 0) {
1198                         if (!value || !*value) {
1199                                 printk(KERN_WARNING
1200                                         "CIFS: invalid path prefix\n");
1201                                 goto cifs_parse_mount_err;
1202                         }
1203                         if ((temp_len = strnlen(value, 1024)) < 1024) {
1204                                 if (value[0] != '/')
1205                                         temp_len++;  /* missing leading slash */
1206                                 vol->prepath = kmalloc(temp_len+1, GFP_KERNEL);
1207                                 if (vol->prepath == NULL)
1208                                         goto cifs_parse_mount_err;
1209                                 if (value[0] != '/') {
1210                                         vol->prepath[0] = '/';
1211                                         strcpy(vol->prepath+1, value);
1212                                 } else
1213                                         strcpy(vol->prepath, value);
1214                                 cFYI(1, "prefix path %s", vol->prepath);
1215                         } else {
1216                                 printk(KERN_WARNING "CIFS: prefix too long\n");
1217                                 goto cifs_parse_mount_err;
1218                         }
1219                 } else if (strnicmp(data, "iocharset", 9) == 0) {
1220                         if (!value || !*value) {
1221                                 printk(KERN_WARNING "CIFS: invalid iocharset "
1222                                                     "specified\n");
1223                                 goto cifs_parse_mount_err;
1224                         }
1225                         if (strnlen(value, 65) < 65) {
1226                                 if (strnicmp(value, "default", 7)) {
1227                                         vol->iocharset = kstrdup(value,
1228                                                                  GFP_KERNEL);
1229
1230                                         if (!vol->iocharset) {
1231                                                 printk(KERN_WARNING "CIFS: no "
1232                                                                    "memory for"
1233                                                                    "charset\n");
1234                                                 goto cifs_parse_mount_err;
1235                                         }
1236                                 }
1237                                 /* if iocharset not set then load_nls_default
1238                                    is used by caller */
1239                                 cFYI(1, "iocharset set to %s", value);
1240                         } else {
1241                                 printk(KERN_WARNING "CIFS: iocharset name "
1242                                                     "too long.\n");
1243                                 goto cifs_parse_mount_err;
1244                         }
1245                 } else if (!strnicmp(data, "uid", 3) && value && *value) {
1246                         vol->linux_uid = simple_strtoul(value, &value, 0);
1247                         uid_specified = true;
1248                 } else if (!strnicmp(data, "cruid", 5) && value && *value) {
1249                         vol->cred_uid = simple_strtoul(value, &value, 0);
1250                 } else if (!strnicmp(data, "forceuid", 8)) {
1251                         override_uid = 1;
1252                 } else if (!strnicmp(data, "noforceuid", 10)) {
1253                         override_uid = 0;
1254                 } else if (!strnicmp(data, "gid", 3) && value && *value) {
1255                         vol->linux_gid = simple_strtoul(value, &value, 0);
1256                         gid_specified = true;
1257                 } else if (!strnicmp(data, "forcegid", 8)) {
1258                         override_gid = 1;
1259                 } else if (!strnicmp(data, "noforcegid", 10)) {
1260                         override_gid = 0;
1261                 } else if (strnicmp(data, "file_mode", 4) == 0) {
1262                         if (value && *value) {
1263                                 vol->file_mode =
1264                                         simple_strtoul(value, &value, 0);
1265                         }
1266                 } else if (strnicmp(data, "dir_mode", 4) == 0) {
1267                         if (value && *value) {
1268                                 vol->dir_mode =
1269                                         simple_strtoul(value, &value, 0);
1270                         }
1271                 } else if (strnicmp(data, "dirmode", 4) == 0) {
1272                         if (value && *value) {
1273                                 vol->dir_mode =
1274                                         simple_strtoul(value, &value, 0);
1275                         }
1276                 } else if (strnicmp(data, "port", 4) == 0) {
1277                         if (value && *value) {
1278                                 vol->port =
1279                                         simple_strtoul(value, &value, 0);
1280                         }
1281                 } else if (strnicmp(data, "rsize", 5) == 0) {
1282                         if (value && *value) {
1283                                 vol->rsize =
1284                                         simple_strtoul(value, &value, 0);
1285                         }
1286                 } else if (strnicmp(data, "wsize", 5) == 0) {
1287                         if (value && *value) {
1288                                 vol->wsize =
1289                                         simple_strtoul(value, &value, 0);
1290                         }
1291                 } else if (strnicmp(data, "sockopt", 5) == 0) {
1292                         if (!value || !*value) {
1293                                 cERROR(1, "no socket option specified");
1294                                 continue;
1295                         } else if (strnicmp(value, "TCP_NODELAY", 11) == 0) {
1296                                 vol->sockopt_tcp_nodelay = 1;
1297                         }
1298                 } else if (strnicmp(data, "netbiosname", 4) == 0) {
1299                         if (!value || !*value || (*value == ' ')) {
1300                                 cFYI(1, "invalid (empty) netbiosname");
1301                         } else {
1302                                 memset(vol->source_rfc1001_name, 0x20,
1303                                         RFC1001_NAME_LEN);
1304                                 /*
1305                                  * FIXME: are there cases in which a comma can
1306                                  * be valid in workstation netbios name (and
1307                                  * need special handling)?
1308                                  */
1309                                 for (i = 0; i < RFC1001_NAME_LEN; i++) {
1310                                         /* don't ucase netbiosname for user */
1311                                         if (value[i] == 0)
1312                                                 break;
1313                                         vol->source_rfc1001_name[i] = value[i];
1314                                 }
1315                                 /* The string has 16th byte zero still from
1316                                 set at top of the function  */
1317                                 if (i == RFC1001_NAME_LEN && value[i] != 0)
1318                                         printk(KERN_WARNING "CIFS: netbiosname"
1319                                                 " longer than 15 truncated.\n");
1320                         }
1321                 } else if (strnicmp(data, "servern", 7) == 0) {
1322                         /* servernetbiosname specified override *SMBSERVER */
1323                         if (!value || !*value || (*value == ' ')) {
1324                                 cFYI(1, "empty server netbiosname specified");
1325                         } else {
1326                                 /* last byte, type, is 0x20 for servr type */
1327                                 memset(vol->target_rfc1001_name, 0x20,
1328                                         RFC1001_NAME_LEN_WITH_NULL);
1329
1330                                 for (i = 0; i < 15; i++) {
1331                                 /* BB are there cases in which a comma can be
1332                                    valid in this workstation netbios name
1333                                    (and need special handling)? */
1334
1335                                 /* user or mount helper must uppercase
1336                                    the netbiosname */
1337                                         if (value[i] == 0)
1338                                                 break;
1339                                         else
1340                                                 vol->target_rfc1001_name[i] =
1341                                                                 value[i];
1342                                 }
1343                                 /* The string has 16th byte zero still from
1344                                    set at top of the function  */
1345                                 if (i == RFC1001_NAME_LEN && value[i] != 0)
1346                                         printk(KERN_WARNING "CIFS: server net"
1347                                         "biosname longer than 15 truncated.\n");
1348                         }
1349                 } else if (strnicmp(data, "actimeo", 7) == 0) {
1350                         if (value && *value) {
1351                                 vol->actimeo = HZ * simple_strtoul(value,
1352                                                                    &value, 0);
1353                                 if (vol->actimeo > CIFS_MAX_ACTIMEO) {
1354                                         cERROR(1, "CIFS: attribute cache"
1355                                                         "timeout too large");
1356                                         goto cifs_parse_mount_err;
1357                                 }
1358                         }
1359                 } else if (strnicmp(data, "credentials", 4) == 0) {
1360                         /* ignore */
1361                 } else if (strnicmp(data, "version", 3) == 0) {
1362                         /* ignore */
1363                 } else if (strnicmp(data, "guest", 5) == 0) {
1364                         /* ignore */
1365                 } else if (strnicmp(data, "rw", 2) == 0 && strlen(data) == 2) {
1366                         /* ignore */
1367                 } else if (strnicmp(data, "ro", 2) == 0) {
1368                         /* ignore */
1369                 } else if (strnicmp(data, "noblocksend", 11) == 0) {
1370                         vol->noblocksnd = 1;
1371                 } else if (strnicmp(data, "noautotune", 10) == 0) {
1372                         vol->noautotune = 1;
1373                 } else if ((strnicmp(data, "suid", 4) == 0) ||
1374                                    (strnicmp(data, "nosuid", 6) == 0) ||
1375                                    (strnicmp(data, "exec", 4) == 0) ||
1376                                    (strnicmp(data, "noexec", 6) == 0) ||
1377                                    (strnicmp(data, "nodev", 5) == 0) ||
1378                                    (strnicmp(data, "noauto", 6) == 0) ||
1379                                    (strnicmp(data, "dev", 3) == 0)) {
1380                         /*  The mount tool or mount.cifs helper (if present)
1381                             uses these opts to set flags, and the flags are read
1382                             by the kernel vfs layer before we get here (ie
1383                             before read super) so there is no point trying to
1384                             parse these options again and set anything and it
1385                             is ok to just ignore them */
1386                         continue;
1387                 } else if (strnicmp(data, "hard", 4) == 0) {
1388                         vol->retry = 1;
1389                 } else if (strnicmp(data, "soft", 4) == 0) {
1390                         vol->retry = 0;
1391                 } else if (strnicmp(data, "perm", 4) == 0) {
1392                         vol->noperm = 0;
1393                 } else if (strnicmp(data, "noperm", 6) == 0) {
1394                         vol->noperm = 1;
1395                 } else if (strnicmp(data, "mapchars", 8) == 0) {
1396                         vol->remap = 1;
1397                 } else if (strnicmp(data, "nomapchars", 10) == 0) {
1398                         vol->remap = 0;
1399                 } else if (strnicmp(data, "sfu", 3) == 0) {
1400                         vol->sfu_emul = 1;
1401                 } else if (strnicmp(data, "nosfu", 5) == 0) {
1402                         vol->sfu_emul = 0;
1403                 } else if (strnicmp(data, "nodfs", 5) == 0) {
1404                         vol->nodfs = 1;
1405                 } else if (strnicmp(data, "posixpaths", 10) == 0) {
1406                         vol->posix_paths = 1;
1407                 } else if (strnicmp(data, "noposixpaths", 12) == 0) {
1408                         vol->posix_paths = 0;
1409                 } else if (strnicmp(data, "nounix", 6) == 0) {
1410                         vol->no_linux_ext = 1;
1411                 } else if (strnicmp(data, "nolinux", 7) == 0) {
1412                         vol->no_linux_ext = 1;
1413                 } else if ((strnicmp(data, "nocase", 6) == 0) ||
1414                            (strnicmp(data, "ignorecase", 10)  == 0)) {
1415                         vol->nocase = 1;
1416                 } else if (strnicmp(data, "mand", 4) == 0) {
1417                         /* ignore */
1418                 } else if (strnicmp(data, "nomand", 6) == 0) {
1419                         /* ignore */
1420                 } else if (strnicmp(data, "_netdev", 7) == 0) {
1421                         /* ignore */
1422                 } else if (strnicmp(data, "brl", 3) == 0) {
1423                         vol->nobrl =  0;
1424                 } else if ((strnicmp(data, "nobrl", 5) == 0) ||
1425                            (strnicmp(data, "nolock", 6) == 0)) {
1426                         vol->nobrl =  1;
1427                         /* turn off mandatory locking in mode
1428                         if remote locking is turned off since the
1429                         local vfs will do advisory */
1430                         if (vol->file_mode ==
1431                                 (S_IALLUGO & ~(S_ISUID | S_IXGRP)))
1432                                 vol->file_mode = S_IALLUGO;
1433                 } else if (strnicmp(data, "forcemandatorylock", 9) == 0) {
1434                         /* will take the shorter form "forcemand" as well */
1435                         /* This mount option will force use of mandatory
1436                           (DOS/Windows style) byte range locks, instead of
1437                           using posix advisory byte range locks, even if the
1438                           Unix extensions are available and posix locks would
1439                           be supported otherwise. If Unix extensions are not
1440                           negotiated this has no effect since mandatory locks
1441                           would be used (mandatory locks is all that those
1442                           those servers support) */
1443                         vol->mand_lock = 1;
1444                 } else if (strnicmp(data, "setuids", 7) == 0) {
1445                         vol->setuids = 1;
1446                 } else if (strnicmp(data, "nosetuids", 9) == 0) {
1447                         vol->setuids = 0;
1448                 } else if (strnicmp(data, "dynperm", 7) == 0) {
1449                         vol->dynperm = true;
1450                 } else if (strnicmp(data, "nodynperm", 9) == 0) {
1451                         vol->dynperm = false;
1452                 } else if (strnicmp(data, "nohard", 6) == 0) {
1453                         vol->retry = 0;
1454                 } else if (strnicmp(data, "nosoft", 6) == 0) {
1455                         vol->retry = 1;
1456                 } else if (strnicmp(data, "nointr", 6) == 0) {
1457                         vol->intr = 0;
1458                 } else if (strnicmp(data, "intr", 4) == 0) {
1459                         vol->intr = 1;
1460                 } else if (strnicmp(data, "nostrictsync", 12) == 0) {
1461                         vol->nostrictsync = 1;
1462                 } else if (strnicmp(data, "strictsync", 10) == 0) {
1463                         vol->nostrictsync = 0;
1464                 } else if (strnicmp(data, "serverino", 7) == 0) {
1465                         vol->server_ino = 1;
1466                 } else if (strnicmp(data, "noserverino", 9) == 0) {
1467                         vol->server_ino = 0;
1468                 } else if (strnicmp(data, "rwpidforward", 12) == 0) {
1469                         vol->rwpidforward = 1;
1470                 } else if (strnicmp(data, "cifsacl", 7) == 0) {
1471                         vol->cifs_acl = 1;
1472                 } else if (strnicmp(data, "nocifsacl", 9) == 0) {
1473                         vol->cifs_acl = 0;
1474                 } else if (strnicmp(data, "acl", 3) == 0) {
1475                         vol->no_psx_acl = 0;
1476                 } else if (strnicmp(data, "noacl", 5) == 0) {
1477                         vol->no_psx_acl = 1;
1478                 } else if (strnicmp(data, "locallease", 6) == 0) {
1479                         vol->local_lease = 1;
1480                 } else if (strnicmp(data, "sign", 4) == 0) {
1481                         vol->secFlg |= CIFSSEC_MUST_SIGN;
1482                 } else if (strnicmp(data, "seal", 4) == 0) {
1483                         /* we do not do the following in secFlags because seal
1484                            is a per tree connection (mount) not a per socket
1485                            or per-smb connection option in the protocol */
1486                         /* vol->secFlg |= CIFSSEC_MUST_SEAL; */
1487                         vol->seal = 1;
1488                 } else if (strnicmp(data, "direct", 6) == 0) {
1489                         vol->direct_io = 1;
1490                 } else if (strnicmp(data, "forcedirectio", 13) == 0) {
1491                         vol->direct_io = 1;
1492                 } else if (strnicmp(data, "strictcache", 11) == 0) {
1493                         vol->strict_io = 1;
1494                 } else if (strnicmp(data, "noac", 4) == 0) {
1495                         printk(KERN_WARNING "CIFS: Mount option noac not "
1496                                 "supported. Instead set "
1497                                 "/proc/fs/cifs/LookupCacheEnabled to 0\n");
1498                 } else if (strnicmp(data, "fsc", 3) == 0) {
1499 #ifndef CONFIG_CIFS_FSCACHE
1500                         cERROR(1, "FS-Cache support needs CONFIG_CIFS_FSCACHE "
1501                                   "kernel config option set");
1502                         goto cifs_parse_mount_err;
1503 #endif
1504                         vol->fsc = true;
1505                 } else if (strnicmp(data, "mfsymlinks", 10) == 0) {
1506                         vol->mfsymlinks = true;
1507                 } else if (strnicmp(data, "multiuser", 8) == 0) {
1508                         vol->multiuser = true;
1509                 } else if (!strnicmp(data, "backupuid", 9) && value && *value) {
1510                         err = kstrtouint(value, 0, &vol->backupuid);
1511                         if (err < 0) {
1512                                 cERROR(1, "%s: Invalid backupuid value",
1513                                         __func__);
1514                                 goto cifs_parse_mount_err;
1515                         }
1516                         vol->backupuid_specified = true;
1517                 } else if (!strnicmp(data, "backupgid", 9) && value && *value) {
1518                         err = kstrtouint(value, 0, &vol->backupgid);
1519                         if (err < 0) {
1520                                 cERROR(1, "%s: Invalid backupgid value",
1521                                         __func__);
1522                                 goto cifs_parse_mount_err;
1523                         }
1524                         vol->backupgid_specified = true;
1525                 } else
1526                         printk(KERN_WARNING "CIFS: Unknown mount option %s\n",
1527                                                 data);
1528         }
1529         if (vol->UNC == NULL) {
1530                 if (devname == NULL) {
1531                         printk(KERN_WARNING "CIFS: Missing UNC name for mount "
1532                                                 "target\n");
1533                         goto cifs_parse_mount_err;
1534                 }
1535                 if ((temp_len = strnlen(devname, 300)) < 300) {
1536                         vol->UNC = kmalloc(temp_len+1, GFP_KERNEL);
1537                         if (vol->UNC == NULL)
1538                                 goto cifs_parse_mount_err;
1539                         strcpy(vol->UNC, devname);
1540                         if (strncmp(vol->UNC, "//", 2) == 0) {
1541                                 vol->UNC[0] = '\\';
1542                                 vol->UNC[1] = '\\';
1543                         } else if (strncmp(vol->UNC, "\\\\", 2) != 0) {
1544                                 printk(KERN_WARNING "CIFS: UNC Path does not "
1545                                                     "begin with // or \\\\ \n");
1546                                 goto cifs_parse_mount_err;
1547                         }
1548                         value = strpbrk(vol->UNC+2, "/\\");
1549                         if (value)
1550                                 *value = '\\';
1551                 } else {
1552                         printk(KERN_WARNING "CIFS: UNC name too long\n");
1553                         goto cifs_parse_mount_err;
1554                 }
1555         }
1556
1557         if (vol->multiuser && !(vol->secFlg & CIFSSEC_MAY_KRB5)) {
1558                 cERROR(1, "Multiuser mounts currently require krb5 "
1559                           "authentication!");
1560                 goto cifs_parse_mount_err;
1561         }
1562
1563         if (vol->UNCip == NULL)
1564                 vol->UNCip = &vol->UNC[2];
1565
1566         if (uid_specified)
1567                 vol->override_uid = override_uid;
1568         else if (override_uid == 1)
1569                 printk(KERN_NOTICE "CIFS: ignoring forceuid mount option "
1570                                    "specified with no uid= option.\n");
1571
1572         if (gid_specified)
1573                 vol->override_gid = override_gid;
1574         else if (override_gid == 1)
1575                 printk(KERN_NOTICE "CIFS: ignoring forcegid mount option "
1576                                    "specified with no gid= option.\n");
1577
1578         kfree(mountdata_copy);
1579         return 0;
1580
1581 cifs_parse_mount_err:
1582         kfree(mountdata_copy);
1583         return 1;
1584 }
1585
1586 /** Returns true if srcaddr isn't specified and rhs isn't
1587  * specified, or if srcaddr is specified and
1588  * matches the IP address of the rhs argument.
1589  */
1590 static bool
1591 srcip_matches(struct sockaddr *srcaddr, struct sockaddr *rhs)
1592 {
1593         switch (srcaddr->sa_family) {
1594         case AF_UNSPEC:
1595                 return (rhs->sa_family == AF_UNSPEC);
1596         case AF_INET: {
1597                 struct sockaddr_in *saddr4 = (struct sockaddr_in *)srcaddr;
1598                 struct sockaddr_in *vaddr4 = (struct sockaddr_in *)rhs;
1599                 return (saddr4->sin_addr.s_addr == vaddr4->sin_addr.s_addr);
1600         }
1601         case AF_INET6: {
1602                 struct sockaddr_in6 *saddr6 = (struct sockaddr_in6 *)srcaddr;
1603                 struct sockaddr_in6 *vaddr6 = (struct sockaddr_in6 *)&rhs;
1604                 return ipv6_addr_equal(&saddr6->sin6_addr, &vaddr6->sin6_addr);
1605         }
1606         default:
1607                 WARN_ON(1);
1608                 return false; /* don't expect to be here */
1609         }
1610 }
1611
1612 /*
1613  * If no port is specified in addr structure, we try to match with 445 port
1614  * and if it fails - with 139 ports. It should be called only if address
1615  * families of server and addr are equal.
1616  */
1617 static bool
1618 match_port(struct TCP_Server_Info *server, struct sockaddr *addr)
1619 {
1620         __be16 port, *sport;
1621
1622         switch (addr->sa_family) {
1623         case AF_INET:
1624                 sport = &((struct sockaddr_in *) &server->dstaddr)->sin_port;
1625                 port = ((struct sockaddr_in *) addr)->sin_port;
1626                 break;
1627         case AF_INET6:
1628                 sport = &((struct sockaddr_in6 *) &server->dstaddr)->sin6_port;
1629                 port = ((struct sockaddr_in6 *) addr)->sin6_port;
1630                 break;
1631         default:
1632                 WARN_ON(1);
1633                 return false;
1634         }
1635
1636         if (!port) {
1637                 port = htons(CIFS_PORT);
1638                 if (port == *sport)
1639                         return true;
1640
1641                 port = htons(RFC1001_PORT);
1642         }
1643
1644         return port == *sport;
1645 }
1646
1647 static bool
1648 match_address(struct TCP_Server_Info *server, struct sockaddr *addr,
1649               struct sockaddr *srcaddr)
1650 {
1651         switch (addr->sa_family) {
1652         case AF_INET: {
1653                 struct sockaddr_in *addr4 = (struct sockaddr_in *)addr;
1654                 struct sockaddr_in *srv_addr4 =
1655                                         (struct sockaddr_in *)&server->dstaddr;
1656
1657                 if (addr4->sin_addr.s_addr != srv_addr4->sin_addr.s_addr)
1658                         return false;
1659                 break;
1660         }
1661         case AF_INET6: {
1662                 struct sockaddr_in6 *addr6 = (struct sockaddr_in6 *)addr;
1663                 struct sockaddr_in6 *srv_addr6 =
1664                                         (struct sockaddr_in6 *)&server->dstaddr;
1665
1666                 if (!ipv6_addr_equal(&addr6->sin6_addr,
1667                                      &srv_addr6->sin6_addr))
1668                         return false;
1669                 if (addr6->sin6_scope_id != srv_addr6->sin6_scope_id)
1670                         return false;
1671                 break;
1672         }
1673         default:
1674                 WARN_ON(1);
1675                 return false; /* don't expect to be here */
1676         }
1677
1678         if (!srcip_matches(srcaddr, (struct sockaddr *)&server->srcaddr))
1679                 return false;
1680
1681         return true;
1682 }
1683
1684 static bool
1685 match_security(struct TCP_Server_Info *server, struct smb_vol *vol)
1686 {
1687         unsigned int secFlags;
1688
1689         if (vol->secFlg & (~(CIFSSEC_MUST_SIGN | CIFSSEC_MUST_SEAL)))
1690                 secFlags = vol->secFlg;
1691         else
1692                 secFlags = global_secflags | vol->secFlg;
1693
1694         switch (server->secType) {
1695         case LANMAN:
1696                 if (!(secFlags & (CIFSSEC_MAY_LANMAN|CIFSSEC_MAY_PLNTXT)))
1697                         return false;
1698                 break;
1699         case NTLMv2:
1700                 if (!(secFlags & CIFSSEC_MAY_NTLMV2))
1701                         return false;
1702                 break;
1703         case NTLM:
1704                 if (!(secFlags & CIFSSEC_MAY_NTLM))
1705                         return false;
1706                 break;
1707         case Kerberos:
1708                 if (!(secFlags & CIFSSEC_MAY_KRB5))
1709                         return false;
1710                 break;
1711         case RawNTLMSSP:
1712                 if (!(secFlags & CIFSSEC_MAY_NTLMSSP))
1713                         return false;
1714                 break;
1715         default:
1716                 /* shouldn't happen */
1717                 return false;
1718         }
1719
1720         /* now check if signing mode is acceptable */
1721         if ((secFlags & CIFSSEC_MAY_SIGN) == 0 &&
1722             (server->sec_mode & SECMODE_SIGN_REQUIRED))
1723                         return false;
1724         else if (((secFlags & CIFSSEC_MUST_SIGN) == CIFSSEC_MUST_SIGN) &&
1725                  (server->sec_mode &
1726                   (SECMODE_SIGN_ENABLED|SECMODE_SIGN_REQUIRED)) == 0)
1727                         return false;
1728
1729         return true;
1730 }
1731
1732 static int match_server(struct TCP_Server_Info *server, struct sockaddr *addr,
1733                          struct smb_vol *vol)
1734 {
1735         if (!net_eq(cifs_net_ns(server), current->nsproxy->net_ns))
1736                 return 0;
1737
1738         if (!match_address(server, addr,
1739                            (struct sockaddr *)&vol->srcaddr))
1740                 return 0;
1741
1742         if (!match_port(server, addr))
1743                 return 0;
1744
1745         if (!match_security(server, vol))
1746                 return 0;
1747
1748         return 1;
1749 }
1750
1751 static struct TCP_Server_Info *
1752 cifs_find_tcp_session(struct sockaddr *addr, struct smb_vol *vol)
1753 {
1754         struct TCP_Server_Info *server;
1755
1756         spin_lock(&cifs_tcp_ses_lock);
1757         list_for_each_entry(server, &cifs_tcp_ses_list, tcp_ses_list) {
1758                 if (!match_server(server, addr, vol))
1759                         continue;
1760
1761                 ++server->srv_count;
1762                 spin_unlock(&cifs_tcp_ses_lock);
1763                 cFYI(1, "Existing tcp session with server found");
1764                 return server;
1765         }
1766         spin_unlock(&cifs_tcp_ses_lock);
1767         return NULL;
1768 }
1769
1770 static void
1771 cifs_put_tcp_session(struct TCP_Server_Info *server)
1772 {
1773         struct task_struct *task;
1774
1775         spin_lock(&cifs_tcp_ses_lock);
1776         if (--server->srv_count > 0) {
1777                 spin_unlock(&cifs_tcp_ses_lock);
1778                 return;
1779         }
1780
1781         put_net(cifs_net_ns(server));
1782
1783         list_del_init(&server->tcp_ses_list);
1784         spin_unlock(&cifs_tcp_ses_lock);
1785
1786         cancel_delayed_work_sync(&server->echo);
1787
1788         spin_lock(&GlobalMid_Lock);
1789         server->tcpStatus = CifsExiting;
1790         spin_unlock(&GlobalMid_Lock);
1791
1792         cifs_crypto_shash_release(server);
1793         cifs_fscache_release_client_cookie(server);
1794
1795         kfree(server->session_key.response);
1796         server->session_key.response = NULL;
1797         server->session_key.len = 0;
1798
1799         task = xchg(&server->tsk, NULL);
1800         if (task)
1801                 force_sig(SIGKILL, task);
1802 }
1803
1804 static struct TCP_Server_Info *
1805 cifs_get_tcp_session(struct smb_vol *volume_info)
1806 {
1807         struct TCP_Server_Info *tcp_ses = NULL;
1808         struct sockaddr_storage addr;
1809         struct sockaddr_in *sin_server = (struct sockaddr_in *) &addr;
1810         struct sockaddr_in6 *sin_server6 = (struct sockaddr_in6 *) &addr;
1811         int rc;
1812
1813         memset(&addr, 0, sizeof(struct sockaddr_storage));
1814
1815         cFYI(1, "UNC: %s ip: %s", volume_info->UNC, volume_info->UNCip);
1816
1817         if (volume_info->UNCip && volume_info->UNC) {
1818                 rc = cifs_fill_sockaddr((struct sockaddr *)&addr,
1819                                         volume_info->UNCip,
1820                                         strlen(volume_info->UNCip),
1821                                         volume_info->port);
1822                 if (!rc) {
1823                         /* we failed translating address */
1824                         rc = -EINVAL;
1825                         goto out_err;
1826                 }
1827         } else if (volume_info->UNCip) {
1828                 /* BB using ip addr as tcp_ses name to connect to the
1829                    DFS root below */
1830                 cERROR(1, "Connecting to DFS root not implemented yet");
1831                 rc = -EINVAL;
1832                 goto out_err;
1833         } else /* which tcp_sess DFS root would we conect to */ {
1834                 cERROR(1, "CIFS mount error: No UNC path (e.g. -o "
1835                         "unc=//192.168.1.100/public) specified");
1836                 rc = -EINVAL;
1837                 goto out_err;
1838         }
1839
1840         /* see if we already have a matching tcp_ses */
1841         tcp_ses = cifs_find_tcp_session((struct sockaddr *)&addr, volume_info);
1842         if (tcp_ses)
1843                 return tcp_ses;
1844
1845         tcp_ses = kzalloc(sizeof(struct TCP_Server_Info), GFP_KERNEL);
1846         if (!tcp_ses) {
1847                 rc = -ENOMEM;
1848                 goto out_err;
1849         }
1850
1851         rc = cifs_crypto_shash_allocate(tcp_ses);
1852         if (rc) {
1853                 cERROR(1, "could not setup hash structures rc %d", rc);
1854                 goto out_err;
1855         }
1856
1857         cifs_set_net_ns(tcp_ses, get_net(current->nsproxy->net_ns));
1858         tcp_ses->hostname = extract_hostname(volume_info->UNC);
1859         if (IS_ERR(tcp_ses->hostname)) {
1860                 rc = PTR_ERR(tcp_ses->hostname);
1861                 goto out_err_crypto_release;
1862         }
1863
1864         tcp_ses->noblocksnd = volume_info->noblocksnd;
1865         tcp_ses->noautotune = volume_info->noautotune;
1866         tcp_ses->tcp_nodelay = volume_info->sockopt_tcp_nodelay;
1867         atomic_set(&tcp_ses->inFlight, 0);
1868         init_waitqueue_head(&tcp_ses->response_q);
1869         init_waitqueue_head(&tcp_ses->request_q);
1870         INIT_LIST_HEAD(&tcp_ses->pending_mid_q);
1871         mutex_init(&tcp_ses->srv_mutex);
1872         memcpy(tcp_ses->workstation_RFC1001_name,
1873                 volume_info->source_rfc1001_name, RFC1001_NAME_LEN_WITH_NULL);
1874         memcpy(tcp_ses->server_RFC1001_name,
1875                 volume_info->target_rfc1001_name, RFC1001_NAME_LEN_WITH_NULL);
1876         tcp_ses->session_estab = false;
1877         tcp_ses->sequence_number = 0;
1878         tcp_ses->lstrp = jiffies;
1879         INIT_LIST_HEAD(&tcp_ses->tcp_ses_list);
1880         INIT_LIST_HEAD(&tcp_ses->smb_ses_list);
1881         INIT_DELAYED_WORK(&tcp_ses->echo, cifs_echo_request);
1882
1883         /*
1884          * at this point we are the only ones with the pointer
1885          * to the struct since the kernel thread not created yet
1886          * no need to spinlock this init of tcpStatus or srv_count
1887          */
1888         tcp_ses->tcpStatus = CifsNew;
1889         memcpy(&tcp_ses->srcaddr, &volume_info->srcaddr,
1890                sizeof(tcp_ses->srcaddr));
1891         ++tcp_ses->srv_count;
1892
1893         if (addr.ss_family == AF_INET6) {
1894                 cFYI(1, "attempting ipv6 connect");
1895                 /* BB should we allow ipv6 on port 139? */
1896                 /* other OS never observed in Wild doing 139 with v6 */
1897                 memcpy(&tcp_ses->dstaddr, sin_server6,
1898                        sizeof(struct sockaddr_in6));
1899         } else
1900                 memcpy(&tcp_ses->dstaddr, sin_server,
1901                        sizeof(struct sockaddr_in));
1902
1903         rc = ip_connect(tcp_ses);
1904         if (rc < 0) {
1905                 cERROR(1, "Error connecting to socket. Aborting operation");
1906                 goto out_err_crypto_release;
1907         }
1908
1909         /*
1910          * since we're in a cifs function already, we know that
1911          * this will succeed. No need for try_module_get().
1912          */
1913         __module_get(THIS_MODULE);
1914         tcp_ses->tsk = kthread_run(cifs_demultiplex_thread,
1915                                   tcp_ses, "cifsd");
1916         if (IS_ERR(tcp_ses->tsk)) {
1917                 rc = PTR_ERR(tcp_ses->tsk);
1918                 cERROR(1, "error %d create cifsd thread", rc);
1919                 module_put(THIS_MODULE);
1920                 goto out_err_crypto_release;
1921         }
1922         tcp_ses->tcpStatus = CifsNeedNegotiate;
1923
1924         /* thread spawned, put it on the list */
1925         spin_lock(&cifs_tcp_ses_lock);
1926         list_add(&tcp_ses->tcp_ses_list, &cifs_tcp_ses_list);
1927         spin_unlock(&cifs_tcp_ses_lock);
1928
1929         cifs_fscache_get_client_cookie(tcp_ses);
1930
1931         /* queue echo request delayed work */
1932         queue_delayed_work(system_nrt_wq, &tcp_ses->echo, SMB_ECHO_INTERVAL);
1933
1934         return tcp_ses;
1935
1936 out_err_crypto_release:
1937         cifs_crypto_shash_release(tcp_ses);
1938
1939         put_net(cifs_net_ns(tcp_ses));
1940
1941 out_err:
1942         if (tcp_ses) {
1943                 if (!IS_ERR(tcp_ses->hostname))
1944                         kfree(tcp_ses->hostname);
1945                 if (tcp_ses->ssocket)
1946                         sock_release(tcp_ses->ssocket);
1947                 kfree(tcp_ses);
1948         }
1949         return ERR_PTR(rc);
1950 }
1951
1952 static int match_session(struct cifs_ses *ses, struct smb_vol *vol)
1953 {
1954         switch (ses->server->secType) {
1955         case Kerberos:
1956                 if (vol->cred_uid != ses->cred_uid)
1957                         return 0;
1958                 break;
1959         default:
1960                 /* anything else takes username/password */
1961                 if (ses->user_name == NULL)
1962                         return 0;
1963                 if (strncmp(ses->user_name, vol->username,
1964                             MAX_USERNAME_SIZE))
1965                         return 0;
1966                 if (strlen(vol->username) != 0 &&
1967                     ses->password != NULL &&
1968                     strncmp(ses->password,
1969                             vol->password ? vol->password : "",
1970                             MAX_PASSWORD_SIZE))
1971                         return 0;
1972         }
1973         return 1;
1974 }
1975
1976 static struct cifs_ses *
1977 cifs_find_smb_ses(struct TCP_Server_Info *server, struct smb_vol *vol)
1978 {
1979         struct cifs_ses *ses;
1980
1981         spin_lock(&cifs_tcp_ses_lock);
1982         list_for_each_entry(ses, &server->smb_ses_list, smb_ses_list) {
1983                 if (!match_session(ses, vol))
1984                         continue;
1985                 ++ses->ses_count;
1986                 spin_unlock(&cifs_tcp_ses_lock);
1987                 return ses;
1988         }
1989         spin_unlock(&cifs_tcp_ses_lock);
1990         return NULL;
1991 }
1992
1993 static void
1994 cifs_put_smb_ses(struct cifs_ses *ses)
1995 {
1996         int xid;
1997         struct TCP_Server_Info *server = ses->server;
1998
1999         cFYI(1, "%s: ses_count=%d\n", __func__, ses->ses_count);
2000         spin_lock(&cifs_tcp_ses_lock);
2001         if (--ses->ses_count > 0) {
2002                 spin_unlock(&cifs_tcp_ses_lock);
2003                 return;
2004         }
2005
2006         list_del_init(&ses->smb_ses_list);
2007         spin_unlock(&cifs_tcp_ses_lock);
2008
2009         if (ses->status == CifsGood) {
2010                 xid = GetXid();
2011                 CIFSSMBLogoff(xid, ses);
2012                 _FreeXid(xid);
2013         }
2014         sesInfoFree(ses);
2015         cifs_put_tcp_session(server);
2016 }
2017
2018 static bool warned_on_ntlm;  /* globals init to false automatically */
2019
2020 static struct cifs_ses *
2021 cifs_get_smb_ses(struct TCP_Server_Info *server, struct smb_vol *volume_info)
2022 {
2023         int rc = -ENOMEM, xid;
2024         struct cifs_ses *ses;
2025         struct sockaddr_in *addr = (struct sockaddr_in *)&server->dstaddr;
2026         struct sockaddr_in6 *addr6 = (struct sockaddr_in6 *)&server->dstaddr;
2027
2028         xid = GetXid();
2029
2030         ses = cifs_find_smb_ses(server, volume_info);
2031         if (ses) {
2032                 cFYI(1, "Existing smb sess found (status=%d)", ses->status);
2033
2034                 mutex_lock(&ses->session_mutex);
2035                 rc = cifs_negotiate_protocol(xid, ses);
2036                 if (rc) {
2037                         mutex_unlock(&ses->session_mutex);
2038                         /* problem -- put our ses reference */
2039                         cifs_put_smb_ses(ses);
2040                         FreeXid(xid);
2041                         return ERR_PTR(rc);
2042                 }
2043                 if (ses->need_reconnect) {
2044                         cFYI(1, "Session needs reconnect");
2045                         rc = cifs_setup_session(xid, ses,
2046                                                 volume_info->local_nls);
2047                         if (rc) {
2048                                 mutex_unlock(&ses->session_mutex);
2049                                 /* problem -- put our reference */
2050                                 cifs_put_smb_ses(ses);
2051                                 FreeXid(xid);
2052                                 return ERR_PTR(rc);
2053                         }
2054                 }
2055                 mutex_unlock(&ses->session_mutex);
2056
2057                 /* existing SMB ses has a server reference already */
2058                 cifs_put_tcp_session(server);
2059                 FreeXid(xid);
2060                 return ses;
2061         }
2062
2063         cFYI(1, "Existing smb sess not found");
2064         ses = sesInfoAlloc();
2065         if (ses == NULL)
2066                 goto get_ses_fail;
2067
2068         /* new SMB session uses our server ref */
2069         ses->server = server;
2070         if (server->dstaddr.ss_family == AF_INET6)
2071                 sprintf(ses->serverName, "%pI6", &addr6->sin6_addr);
2072         else
2073                 sprintf(ses->serverName, "%pI4", &addr->sin_addr);
2074
2075         if (volume_info->username) {
2076                 ses->user_name = kstrdup(volume_info->username, GFP_KERNEL);
2077                 if (!ses->user_name)
2078                         goto get_ses_fail;
2079         }
2080
2081         /* volume_info->password freed at unmount */
2082         if (volume_info->password) {
2083                 ses->password = kstrdup(volume_info->password, GFP_KERNEL);
2084                 if (!ses->password)
2085                         goto get_ses_fail;
2086         }
2087         if (volume_info->domainname) {
2088                 ses->domainName = kstrdup(volume_info->domainname, GFP_KERNEL);
2089                 if (!ses->domainName)
2090                         goto get_ses_fail;
2091         }
2092         ses->cred_uid = volume_info->cred_uid;
2093         ses->linux_uid = volume_info->linux_uid;
2094
2095         /* ntlmv2 is much stronger than ntlm security, and has been broadly
2096         supported for many years, time to update default security mechanism */
2097         if ((volume_info->secFlg == 0) && warned_on_ntlm == false) {
2098                 warned_on_ntlm = true;
2099                 cERROR(1, "default security mechanism requested.  The default "
2100                         "security mechanism will be upgraded from ntlm to "
2101                         "ntlmv2 in kernel release 3.2");
2102         }
2103         ses->overrideSecFlg = volume_info->secFlg;
2104
2105         mutex_lock(&ses->session_mutex);
2106         rc = cifs_negotiate_protocol(xid, ses);
2107         if (!rc)
2108                 rc = cifs_setup_session(xid, ses, volume_info->local_nls);
2109         mutex_unlock(&ses->session_mutex);
2110         if (rc)
2111                 goto get_ses_fail;
2112
2113         /* success, put it on the list */
2114         spin_lock(&cifs_tcp_ses_lock);
2115         list_add(&ses->smb_ses_list, &server->smb_ses_list);
2116         spin_unlock(&cifs_tcp_ses_lock);
2117
2118         FreeXid(xid);
2119         return ses;
2120
2121 get_ses_fail:
2122         sesInfoFree(ses);
2123         FreeXid(xid);
2124         return ERR_PTR(rc);
2125 }
2126
2127 static int match_tcon(struct cifs_tcon *tcon, const char *unc)
2128 {
2129         if (tcon->tidStatus == CifsExiting)
2130                 return 0;
2131         if (strncmp(tcon->treeName, unc, MAX_TREE_SIZE))
2132                 return 0;
2133         return 1;
2134 }
2135
2136 static struct cifs_tcon *
2137 cifs_find_tcon(struct cifs_ses *ses, const char *unc)
2138 {
2139         struct list_head *tmp;
2140         struct cifs_tcon *tcon;
2141
2142         spin_lock(&cifs_tcp_ses_lock);
2143         list_for_each(tmp, &ses->tcon_list) {
2144                 tcon = list_entry(tmp, struct cifs_tcon, tcon_list);
2145                 if (!match_tcon(tcon, unc))
2146                         continue;
2147                 ++tcon->tc_count;
2148                 spin_unlock(&cifs_tcp_ses_lock);
2149                 return tcon;
2150         }
2151         spin_unlock(&cifs_tcp_ses_lock);
2152         return NULL;
2153 }
2154
2155 static void
2156 cifs_put_tcon(struct cifs_tcon *tcon)
2157 {
2158         int xid;
2159         struct cifs_ses *ses = tcon->ses;
2160
2161         cFYI(1, "%s: tc_count=%d\n", __func__, tcon->tc_count);
2162         spin_lock(&cifs_tcp_ses_lock);
2163         if (--tcon->tc_count > 0) {
2164                 spin_unlock(&cifs_tcp_ses_lock);
2165                 return;
2166         }
2167
2168         list_del_init(&tcon->tcon_list);
2169         spin_unlock(&cifs_tcp_ses_lock);
2170
2171         xid = GetXid();
2172         CIFSSMBTDis(xid, tcon);
2173         _FreeXid(xid);
2174
2175         cifs_fscache_release_super_cookie(tcon);
2176         tconInfoFree(tcon);
2177         cifs_put_smb_ses(ses);
2178 }
2179
2180 static struct cifs_tcon *
2181 cifs_get_tcon(struct cifs_ses *ses, struct smb_vol *volume_info)
2182 {
2183         int rc, xid;
2184         struct cifs_tcon *tcon;
2185
2186         tcon = cifs_find_tcon(ses, volume_info->UNC);
2187         if (tcon) {
2188                 cFYI(1, "Found match on UNC path");
2189                 /* existing tcon already has a reference */
2190                 cifs_put_smb_ses(ses);
2191                 if (tcon->seal != volume_info->seal)
2192                         cERROR(1, "transport encryption setting "
2193                                    "conflicts with existing tid");
2194                 return tcon;
2195         }
2196
2197         tcon = tconInfoAlloc();
2198         if (tcon == NULL) {
2199                 rc = -ENOMEM;
2200                 goto out_fail;
2201         }
2202
2203         tcon->ses = ses;
2204         if (volume_info->password) {
2205                 tcon->password = kstrdup(volume_info->password, GFP_KERNEL);
2206                 if (!tcon->password) {
2207                         rc = -ENOMEM;
2208                         goto out_fail;
2209                 }
2210         }
2211
2212         if (strchr(volume_info->UNC + 3, '\\') == NULL
2213             && strchr(volume_info->UNC + 3, '/') == NULL) {
2214                 cERROR(1, "Missing share name");
2215                 rc = -ENODEV;
2216                 goto out_fail;
2217         }
2218
2219         /* BB Do we need to wrap session_mutex around
2220          * this TCon call and Unix SetFS as
2221          * we do on SessSetup and reconnect? */
2222         xid = GetXid();
2223         rc = CIFSTCon(xid, ses, volume_info->UNC, tcon, volume_info->local_nls);
2224         FreeXid(xid);
2225         cFYI(1, "CIFS Tcon rc = %d", rc);
2226         if (rc)
2227                 goto out_fail;
2228
2229         if (volume_info->nodfs) {
2230                 tcon->Flags &= ~SMB_SHARE_IS_IN_DFS;
2231                 cFYI(1, "DFS disabled (%d)", tcon->Flags);
2232         }
2233         tcon->seal = volume_info->seal;
2234         /* we can have only one retry value for a connection
2235            to a share so for resources mounted more than once
2236            to the same server share the last value passed in
2237            for the retry flag is used */
2238         tcon->retry = volume_info->retry;
2239         tcon->nocase = volume_info->nocase;
2240         tcon->local_lease = volume_info->local_lease;
2241
2242         spin_lock(&cifs_tcp_ses_lock);
2243         list_add(&tcon->tcon_list, &ses->tcon_list);
2244         spin_unlock(&cifs_tcp_ses_lock);
2245
2246         cifs_fscache_get_super_cookie(tcon);
2247
2248         return tcon;
2249
2250 out_fail:
2251         tconInfoFree(tcon);
2252         return ERR_PTR(rc);
2253 }
2254
2255 void
2256 cifs_put_tlink(struct tcon_link *tlink)
2257 {
2258         if (!tlink || IS_ERR(tlink))
2259                 return;
2260
2261         if (!atomic_dec_and_test(&tlink->tl_count) ||
2262             test_bit(TCON_LINK_IN_TREE, &tlink->tl_flags)) {
2263                 tlink->tl_time = jiffies;
2264                 return;
2265         }
2266
2267         if (!IS_ERR(tlink_tcon(tlink)))
2268                 cifs_put_tcon(tlink_tcon(tlink));
2269         kfree(tlink);
2270         return;
2271 }
2272
2273 static inline struct tcon_link *
2274 cifs_sb_master_tlink(struct cifs_sb_info *cifs_sb)
2275 {
2276         return cifs_sb->master_tlink;
2277 }
2278
2279 static int
2280 compare_mount_options(struct super_block *sb, struct cifs_mnt_data *mnt_data)
2281 {
2282         struct cifs_sb_info *old = CIFS_SB(sb);
2283         struct cifs_sb_info *new = mnt_data->cifs_sb;
2284
2285         if ((sb->s_flags & CIFS_MS_MASK) != (mnt_data->flags & CIFS_MS_MASK))
2286                 return 0;
2287
2288         if ((old->mnt_cifs_flags & CIFS_MOUNT_MASK) !=
2289             (new->mnt_cifs_flags & CIFS_MOUNT_MASK))
2290                 return 0;
2291
2292         if (old->rsize != new->rsize)
2293                 return 0;
2294
2295         /*
2296          * We want to share sb only if we don't specify wsize or specified wsize
2297          * is greater or equal than existing one.
2298          */
2299         if (new->wsize && new->wsize < old->wsize)
2300                 return 0;
2301
2302         if (old->mnt_uid != new->mnt_uid || old->mnt_gid != new->mnt_gid)
2303                 return 0;
2304
2305         if (old->mnt_file_mode != new->mnt_file_mode ||
2306             old->mnt_dir_mode != new->mnt_dir_mode)
2307                 return 0;
2308
2309         if (strcmp(old->local_nls->charset, new->local_nls->charset))
2310                 return 0;
2311
2312         if (old->actimeo != new->actimeo)
2313                 return 0;
2314
2315         return 1;
2316 }
2317
2318 int
2319 cifs_match_super(struct super_block *sb, void *data)
2320 {
2321         struct cifs_mnt_data *mnt_data = (struct cifs_mnt_data *)data;
2322         struct smb_vol *volume_info;
2323         struct cifs_sb_info *cifs_sb;
2324         struct TCP_Server_Info *tcp_srv;
2325         struct cifs_ses *ses;
2326         struct cifs_tcon *tcon;
2327         struct tcon_link *tlink;
2328         struct sockaddr_storage addr;
2329         int rc = 0;
2330
2331         memset(&addr, 0, sizeof(struct sockaddr_storage));
2332
2333         spin_lock(&cifs_tcp_ses_lock);
2334         cifs_sb = CIFS_SB(sb);
2335         tlink = cifs_get_tlink(cifs_sb_master_tlink(cifs_sb));
2336         if (IS_ERR(tlink)) {
2337                 spin_unlock(&cifs_tcp_ses_lock);
2338                 return rc;
2339         }
2340         tcon = tlink_tcon(tlink);
2341         ses = tcon->ses;
2342         tcp_srv = ses->server;
2343
2344         volume_info = mnt_data->vol;
2345
2346         if (!volume_info->UNCip || !volume_info->UNC)
2347                 goto out;
2348
2349         rc = cifs_fill_sockaddr((struct sockaddr *)&addr,
2350                                 volume_info->UNCip,
2351                                 strlen(volume_info->UNCip),
2352                                 volume_info->port);
2353         if (!rc)
2354                 goto out;
2355
2356         if (!match_server(tcp_srv, (struct sockaddr *)&addr, volume_info) ||
2357             !match_session(ses, volume_info) ||
2358             !match_tcon(tcon, volume_info->UNC)) {
2359                 rc = 0;
2360                 goto out;
2361         }
2362
2363         rc = compare_mount_options(sb, mnt_data);
2364 out:
2365         spin_unlock(&cifs_tcp_ses_lock);
2366         cifs_put_tlink(tlink);
2367         return rc;
2368 }
2369
2370 int
2371 get_dfs_path(int xid, struct cifs_ses *pSesInfo, const char *old_path,
2372              const struct nls_table *nls_codepage, unsigned int *pnum_referrals,
2373              struct dfs_info3_param **preferrals, int remap)
2374 {
2375         char *temp_unc;
2376         int rc = 0;
2377
2378         *pnum_referrals = 0;
2379         *preferrals = NULL;
2380
2381         if (pSesInfo->ipc_tid == 0) {
2382                 temp_unc = kmalloc(2 /* for slashes */ +
2383                         strnlen(pSesInfo->serverName,
2384                                 SERVER_NAME_LEN_WITH_NULL * 2)
2385                                  + 1 + 4 /* slash IPC$ */  + 2,
2386                                 GFP_KERNEL);
2387                 if (temp_unc == NULL)
2388                         return -ENOMEM;
2389                 temp_unc[0] = '\\';
2390                 temp_unc[1] = '\\';
2391                 strcpy(temp_unc + 2, pSesInfo->serverName);
2392                 strcpy(temp_unc + 2 + strlen(pSesInfo->serverName), "\\IPC$");
2393                 rc = CIFSTCon(xid, pSesInfo, temp_unc, NULL, nls_codepage);
2394                 cFYI(1, "CIFS Tcon rc = %d ipc_tid = %d", rc, pSesInfo->ipc_tid);
2395                 kfree(temp_unc);
2396         }
2397         if (rc == 0)
2398                 rc = CIFSGetDFSRefer(xid, pSesInfo, old_path, preferrals,
2399                                      pnum_referrals, nls_codepage, remap);
2400         /* BB map targetUNCs to dfs_info3 structures, here or
2401                 in CIFSGetDFSRefer BB */
2402
2403         return rc;
2404 }
2405
2406 #ifdef CONFIG_DEBUG_LOCK_ALLOC
2407 static struct lock_class_key cifs_key[2];
2408 static struct lock_class_key cifs_slock_key[2];
2409
2410 static inline void
2411 cifs_reclassify_socket4(struct socket *sock)
2412 {
2413         struct sock *sk = sock->sk;
2414         BUG_ON(sock_owned_by_user(sk));
2415         sock_lock_init_class_and_name(sk, "slock-AF_INET-CIFS",
2416                 &cifs_slock_key[0], "sk_lock-AF_INET-CIFS", &cifs_key[0]);
2417 }
2418
2419 static inline void
2420 cifs_reclassify_socket6(struct socket *sock)
2421 {
2422         struct sock *sk = sock->sk;
2423         BUG_ON(sock_owned_by_user(sk));
2424         sock_lock_init_class_and_name(sk, "slock-AF_INET6-CIFS",
2425                 &cifs_slock_key[1], "sk_lock-AF_INET6-CIFS", &cifs_key[1]);
2426 }
2427 #else
2428 static inline void
2429 cifs_reclassify_socket4(struct socket *sock)
2430 {
2431 }
2432
2433 static inline void
2434 cifs_reclassify_socket6(struct socket *sock)
2435 {
2436 }
2437 #endif
2438
2439 /* See RFC1001 section 14 on representation of Netbios names */
2440 static void rfc1002mangle(char *target, char *source, unsigned int length)
2441 {
2442         unsigned int i, j;
2443
2444         for (i = 0, j = 0; i < (length); i++) {
2445                 /* mask a nibble at a time and encode */
2446                 target[j] = 'A' + (0x0F & (source[i] >> 4));
2447                 target[j+1] = 'A' + (0x0F & source[i]);
2448                 j += 2;
2449         }
2450
2451 }
2452
2453 static int
2454 bind_socket(struct TCP_Server_Info *server)
2455 {
2456         int rc = 0;
2457         if (server->srcaddr.ss_family != AF_UNSPEC) {
2458                 /* Bind to the specified local IP address */
2459                 struct socket *socket = server->ssocket;
2460                 rc = socket->ops->bind(socket,
2461                                        (struct sockaddr *) &server->srcaddr,
2462                                        sizeof(server->srcaddr));
2463                 if (rc < 0) {
2464                         struct sockaddr_in *saddr4;
2465                         struct sockaddr_in6 *saddr6;
2466                         saddr4 = (struct sockaddr_in *)&server->srcaddr;
2467                         saddr6 = (struct sockaddr_in6 *)&server->srcaddr;
2468                         if (saddr6->sin6_family == AF_INET6)
2469                                 cERROR(1, "cifs: "
2470                                        "Failed to bind to: %pI6c, error: %d\n",
2471                                        &saddr6->sin6_addr, rc);
2472                         else
2473                                 cERROR(1, "cifs: "
2474                                        "Failed to bind to: %pI4, error: %d\n",
2475                                        &saddr4->sin_addr.s_addr, rc);
2476                 }
2477         }
2478         return rc;
2479 }
2480
2481 static int
2482 ip_rfc1001_connect(struct TCP_Server_Info *server)
2483 {
2484         int rc = 0;
2485         /*
2486          * some servers require RFC1001 sessinit before sending
2487          * negprot - BB check reconnection in case where second
2488          * sessinit is sent but no second negprot
2489          */
2490         struct rfc1002_session_packet *ses_init_buf;
2491         struct smb_hdr *smb_buf;
2492         ses_init_buf = kzalloc(sizeof(struct rfc1002_session_packet),
2493                                GFP_KERNEL);
2494         if (ses_init_buf) {
2495                 ses_init_buf->trailer.session_req.called_len = 32;
2496
2497                 if (server->server_RFC1001_name &&
2498                     server->server_RFC1001_name[0] != 0)
2499                         rfc1002mangle(ses_init_buf->trailer.
2500                                       session_req.called_name,
2501                                       server->server_RFC1001_name,
2502                                       RFC1001_NAME_LEN_WITH_NULL);
2503                 else
2504                         rfc1002mangle(ses_init_buf->trailer.
2505                                       session_req.called_name,
2506                                       DEFAULT_CIFS_CALLED_NAME,
2507                                       RFC1001_NAME_LEN_WITH_NULL);
2508
2509                 ses_init_buf->trailer.session_req.calling_len = 32;
2510
2511                 /*
2512                  * calling name ends in null (byte 16) from old smb
2513                  * convention.
2514                  */
2515                 if (server->workstation_RFC1001_name &&
2516                     server->workstation_RFC1001_name[0] != 0)
2517                         rfc1002mangle(ses_init_buf->trailer.
2518                                       session_req.calling_name,
2519                                       server->workstation_RFC1001_name,
2520                                       RFC1001_NAME_LEN_WITH_NULL);
2521                 else
2522                         rfc1002mangle(ses_init_buf->trailer.
2523                                       session_req.calling_name,
2524                                       "LINUX_CIFS_CLNT",
2525                                       RFC1001_NAME_LEN_WITH_NULL);
2526
2527                 ses_init_buf->trailer.session_req.scope1 = 0;
2528                 ses_init_buf->trailer.session_req.scope2 = 0;
2529                 smb_buf = (struct smb_hdr *)ses_init_buf;
2530
2531                 /* sizeof RFC1002_SESSION_REQUEST with no scope */
2532                 smb_buf->smb_buf_length = cpu_to_be32(0x81000044);
2533                 rc = smb_send(server, smb_buf, 0x44);
2534                 kfree(ses_init_buf);
2535                 /*
2536                  * RFC1001 layer in at least one server
2537                  * requires very short break before negprot
2538                  * presumably because not expecting negprot
2539                  * to follow so fast.  This is a simple
2540                  * solution that works without
2541                  * complicating the code and causes no
2542                  * significant slowing down on mount
2543                  * for everyone else
2544                  */
2545                 usleep_range(1000, 2000);
2546         }
2547         /*
2548          * else the negprot may still work without this
2549          * even though malloc failed
2550          */
2551
2552         return rc;
2553 }
2554
2555 static int
2556 generic_ip_connect(struct TCP_Server_Info *server)
2557 {
2558         int rc = 0;
2559         __be16 sport;
2560         int slen, sfamily;
2561         struct socket *socket = server->ssocket;
2562         struct sockaddr *saddr;
2563
2564         saddr = (struct sockaddr *) &server->dstaddr;
2565
2566         if (server->dstaddr.ss_family == AF_INET6) {
2567                 sport = ((struct sockaddr_in6 *) saddr)->sin6_port;
2568                 slen = sizeof(struct sockaddr_in6);
2569                 sfamily = AF_INET6;
2570         } else {
2571                 sport = ((struct sockaddr_in *) saddr)->sin_port;
2572                 slen = sizeof(struct sockaddr_in);
2573                 sfamily = AF_INET;
2574         }
2575
2576         if (socket == NULL) {
2577                 rc = __sock_create(cifs_net_ns(server), sfamily, SOCK_STREAM,
2578                                    IPPROTO_TCP, &socket, 1);
2579                 if (rc < 0) {
2580                         cERROR(1, "Error %d creating socket", rc);
2581                         server->ssocket = NULL;
2582                         return rc;
2583                 }
2584
2585                 /* BB other socket options to set KEEPALIVE, NODELAY? */
2586                 cFYI(1, "Socket created");
2587                 server->ssocket = socket;
2588                 socket->sk->sk_allocation = GFP_NOFS;
2589                 if (sfamily == AF_INET6)
2590                         cifs_reclassify_socket6(socket);
2591                 else
2592                         cifs_reclassify_socket4(socket);
2593         }
2594
2595         rc = bind_socket(server);
2596         if (rc < 0)
2597                 return rc;
2598
2599         /*
2600          * Eventually check for other socket options to change from
2601          * the default. sock_setsockopt not used because it expects
2602          * user space buffer
2603          */
2604         socket->sk->sk_rcvtimeo = 7 * HZ;
2605         socket->sk->sk_sndtimeo = 5 * HZ;
2606
2607         /* make the bufsizes depend on wsize/rsize and max requests */
2608         if (server->noautotune) {
2609                 if (socket->sk->sk_sndbuf < (200 * 1024))
2610                         socket->sk->sk_sndbuf = 200 * 1024;
2611                 if (socket->sk->sk_rcvbuf < (140 * 1024))
2612                         socket->sk->sk_rcvbuf = 140 * 1024;
2613         }
2614
2615         if (server->tcp_nodelay) {
2616                 int val = 1;
2617                 rc = kernel_setsockopt(socket, SOL_TCP, TCP_NODELAY,
2618                                 (char *)&val, sizeof(val));
2619                 if (rc)
2620                         cFYI(1, "set TCP_NODELAY socket option error %d", rc);
2621         }
2622
2623          cFYI(1, "sndbuf %d rcvbuf %d rcvtimeo 0x%lx",
2624                  socket->sk->sk_sndbuf,
2625                  socket->sk->sk_rcvbuf, socket->sk->sk_rcvtimeo);
2626
2627         rc = socket->ops->connect(socket, saddr, slen, 0);
2628         if (rc < 0) {
2629                 cFYI(1, "Error %d connecting to server", rc);
2630                 sock_release(socket);
2631                 server->ssocket = NULL;
2632                 return rc;
2633         }
2634
2635         if (sport == htons(RFC1001_PORT))
2636                 rc = ip_rfc1001_connect(server);
2637
2638         return rc;
2639 }
2640
2641 static int
2642 ip_connect(struct TCP_Server_Info *server)
2643 {
2644         __be16 *sport;
2645         struct sockaddr_in6 *addr6 = (struct sockaddr_in6 *)&server->dstaddr;
2646         struct sockaddr_in *addr = (struct sockaddr_in *)&server->dstaddr;
2647
2648         if (server->dstaddr.ss_family == AF_INET6)
2649                 sport = &addr6->sin6_port;
2650         else
2651                 sport = &addr->sin_port;
2652
2653         if (*sport == 0) {
2654                 int rc;
2655
2656                 /* try with 445 port at first */
2657                 *sport = htons(CIFS_PORT);
2658
2659                 rc = generic_ip_connect(server);
2660                 if (rc >= 0)
2661                         return rc;
2662
2663                 /* if it failed, try with 139 port */
2664                 *sport = htons(RFC1001_PORT);
2665         }
2666
2667         return generic_ip_connect(server);
2668 }
2669
2670 void reset_cifs_unix_caps(int xid, struct cifs_tcon *tcon,
2671                           struct cifs_sb_info *cifs_sb, struct smb_vol *vol_info)
2672 {
2673         /* if we are reconnecting then should we check to see if
2674          * any requested capabilities changed locally e.g. via
2675          * remount but we can not do much about it here
2676          * if they have (even if we could detect it by the following)
2677          * Perhaps we could add a backpointer to array of sb from tcon
2678          * or if we change to make all sb to same share the same
2679          * sb as NFS - then we only have one backpointer to sb.
2680          * What if we wanted to mount the server share twice once with
2681          * and once without posixacls or posix paths? */
2682         __u64 saved_cap = le64_to_cpu(tcon->fsUnixInfo.Capability);
2683
2684         if (vol_info && vol_info->no_linux_ext) {
2685                 tcon->fsUnixInfo.Capability = 0;
2686                 tcon->unix_ext = 0; /* Unix Extensions disabled */
2687                 cFYI(1, "Linux protocol extensions disabled");
2688                 return;
2689         } else if (vol_info)
2690                 tcon->unix_ext = 1; /* Unix Extensions supported */
2691
2692         if (tcon->unix_ext == 0) {
2693                 cFYI(1, "Unix extensions disabled so not set on reconnect");
2694                 return;
2695         }
2696
2697         if (!CIFSSMBQFSUnixInfo(xid, tcon)) {
2698                 __u64 cap = le64_to_cpu(tcon->fsUnixInfo.Capability);
2699                 cFYI(1, "unix caps which server supports %lld", cap);
2700                 /* check for reconnect case in which we do not
2701                    want to change the mount behavior if we can avoid it */
2702                 if (vol_info == NULL) {
2703                         /* turn off POSIX ACL and PATHNAMES if not set
2704                            originally at mount time */
2705                         if ((saved_cap & CIFS_UNIX_POSIX_ACL_CAP) == 0)
2706                                 cap &= ~CIFS_UNIX_POSIX_ACL_CAP;
2707                         if ((saved_cap & CIFS_UNIX_POSIX_PATHNAMES_CAP) == 0) {
2708                                 if (cap & CIFS_UNIX_POSIX_PATHNAMES_CAP)
2709                                         cERROR(1, "POSIXPATH support change");
2710                                 cap &= ~CIFS_UNIX_POSIX_PATHNAMES_CAP;
2711                         } else if ((cap & CIFS_UNIX_POSIX_PATHNAMES_CAP) == 0) {
2712                                 cERROR(1, "possible reconnect error");
2713                                 cERROR(1, "server disabled POSIX path support");
2714                         }
2715                 }
2716
2717                 if (cap & CIFS_UNIX_TRANSPORT_ENCRYPTION_MANDATORY_CAP)
2718                         cERROR(1, "per-share encryption not supported yet");
2719
2720                 cap &= CIFS_UNIX_CAP_MASK;
2721                 if (vol_info && vol_info->no_psx_acl)
2722                         cap &= ~CIFS_UNIX_POSIX_ACL_CAP;
2723                 else if (CIFS_UNIX_POSIX_ACL_CAP & cap) {
2724                         cFYI(1, "negotiated posix acl support");
2725                         if (cifs_sb)
2726                                 cifs_sb->mnt_cifs_flags |=
2727                                         CIFS_MOUNT_POSIXACL;
2728                 }
2729
2730                 if (vol_info && vol_info->posix_paths == 0)
2731                         cap &= ~CIFS_UNIX_POSIX_PATHNAMES_CAP;
2732                 else if (cap & CIFS_UNIX_POSIX_PATHNAMES_CAP) {
2733                         cFYI(1, "negotiate posix pathnames");
2734                         if (cifs_sb)
2735                                 cifs_sb->mnt_cifs_flags |=
2736                                         CIFS_MOUNT_POSIX_PATHS;
2737                 }
2738
2739                 if (cifs_sb && (cifs_sb->rsize > 127 * 1024)) {
2740                         if ((cap & CIFS_UNIX_LARGE_READ_CAP) == 0) {
2741                                 cifs_sb->rsize = 127 * 1024;
2742                                 cFYI(DBG2, "larger reads not supported by srv");
2743                         }
2744                 }
2745
2746
2747                 cFYI(1, "Negotiate caps 0x%x", (int)cap);
2748 #ifdef CONFIG_CIFS_DEBUG2
2749                 if (cap & CIFS_UNIX_FCNTL_CAP)
2750                         cFYI(1, "FCNTL cap");
2751                 if (cap & CIFS_UNIX_EXTATTR_CAP)
2752                         cFYI(1, "EXTATTR cap");
2753                 if (cap & CIFS_UNIX_POSIX_PATHNAMES_CAP)
2754                         cFYI(1, "POSIX path cap");
2755                 if (cap & CIFS_UNIX_XATTR_CAP)
2756                         cFYI(1, "XATTR cap");
2757                 if (cap & CIFS_UNIX_POSIX_ACL_CAP)
2758                         cFYI(1, "POSIX ACL cap");
2759                 if (cap & CIFS_UNIX_LARGE_READ_CAP)
2760                         cFYI(1, "very large read cap");
2761                 if (cap & CIFS_UNIX_LARGE_WRITE_CAP)
2762                         cFYI(1, "very large write cap");
2763                 if (cap & CIFS_UNIX_TRANSPORT_ENCRYPTION_CAP)
2764                         cFYI(1, "transport encryption cap");
2765                 if (cap & CIFS_UNIX_TRANSPORT_ENCRYPTION_MANDATORY_CAP)
2766                         cFYI(1, "mandatory transport encryption cap");
2767 #endif /* CIFS_DEBUG2 */
2768                 if (CIFSSMBSetFSUnixInfo(xid, tcon, cap)) {
2769                         if (vol_info == NULL) {
2770                                 cFYI(1, "resetting capabilities failed");
2771                         } else
2772                                 cERROR(1, "Negotiating Unix capabilities "
2773                                            "with the server failed.  Consider "
2774                                            "mounting with the Unix Extensions\n"
2775                                            "disabled, if problems are found, "
2776                                            "by specifying the nounix mount "
2777                                            "option.");
2778
2779                 }
2780         }
2781 }
2782
2783 void cifs_setup_cifs_sb(struct smb_vol *pvolume_info,
2784                         struct cifs_sb_info *cifs_sb)
2785 {
2786         INIT_DELAYED_WORK(&cifs_sb->prune_tlinks, cifs_prune_tlinks);
2787
2788         spin_lock_init(&cifs_sb->tlink_tree_lock);
2789         cifs_sb->tlink_tree = RB_ROOT;
2790
2791         if (pvolume_info->rsize > CIFSMaxBufSize) {
2792                 cERROR(1, "rsize %d too large, using MaxBufSize",
2793                         pvolume_info->rsize);
2794                 cifs_sb->rsize = CIFSMaxBufSize;
2795         } else if ((pvolume_info->rsize) &&
2796                         (pvolume_info->rsize <= CIFSMaxBufSize))
2797                 cifs_sb->rsize = pvolume_info->rsize;
2798         else /* default */
2799                 cifs_sb->rsize = CIFSMaxBufSize;
2800
2801         if (cifs_sb->rsize < 2048) {
2802                 cifs_sb->rsize = 2048;
2803                 /* Windows ME may prefer this */
2804                 cFYI(1, "readsize set to minimum: 2048");
2805         }
2806
2807         /*
2808          * Temporarily set wsize for matching superblock. If we end up using
2809          * new sb then cifs_negotiate_wsize will later negotiate it downward
2810          * if needed.
2811          */
2812         cifs_sb->wsize = pvolume_info->wsize;
2813
2814         cifs_sb->mnt_uid = pvolume_info->linux_uid;
2815         cifs_sb->mnt_gid = pvolume_info->linux_gid;
2816         if (pvolume_info->backupuid_specified)
2817                 cifs_sb->mnt_backupuid = pvolume_info->backupuid;
2818         if (pvolume_info->backupgid_specified)
2819                 cifs_sb->mnt_backupgid = pvolume_info->backupgid;
2820         cifs_sb->mnt_file_mode = pvolume_info->file_mode;
2821         cifs_sb->mnt_dir_mode = pvolume_info->dir_mode;
2822         cFYI(1, "file mode: 0x%x  dir mode: 0x%x",
2823                 cifs_sb->mnt_file_mode, cifs_sb->mnt_dir_mode);
2824
2825         cifs_sb->actimeo = pvolume_info->actimeo;
2826         cifs_sb->local_nls = pvolume_info->local_nls;
2827
2828         if (pvolume_info->noperm)
2829                 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_NO_PERM;
2830         if (pvolume_info->setuids)
2831                 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_SET_UID;
2832         if (pvolume_info->server_ino)
2833                 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_SERVER_INUM;
2834         if (pvolume_info->remap)
2835                 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_MAP_SPECIAL_CHR;
2836         if (pvolume_info->no_xattr)
2837                 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_NO_XATTR;
2838         if (pvolume_info->sfu_emul)
2839                 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_UNX_EMUL;
2840         if (pvolume_info->nobrl)
2841                 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_NO_BRL;
2842         if (pvolume_info->nostrictsync)
2843                 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_NOSSYNC;
2844         if (pvolume_info->mand_lock)
2845                 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_NOPOSIXBRL;
2846         if (pvolume_info->rwpidforward)
2847                 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_RWPIDFORWARD;
2848         if (pvolume_info->cifs_acl)
2849                 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_CIFS_ACL;
2850         if (pvolume_info->backupuid_specified)
2851                 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_CIFS_BACKUPUID;
2852         if (pvolume_info->backupgid_specified)
2853                 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_CIFS_BACKUPGID;
2854         if (pvolume_info->override_uid)
2855                 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_OVERR_UID;
2856         if (pvolume_info->override_gid)
2857                 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_OVERR_GID;
2858         if (pvolume_info->dynperm)
2859                 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_DYNPERM;
2860         if (pvolume_info->fsc)
2861                 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_FSCACHE;
2862         if (pvolume_info->multiuser)
2863                 cifs_sb->mnt_cifs_flags |= (CIFS_MOUNT_MULTIUSER |
2864                                             CIFS_MOUNT_NO_PERM);
2865         if (pvolume_info->strict_io)
2866                 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_STRICT_IO;
2867         if (pvolume_info->direct_io) {
2868                 cFYI(1, "mounting share using direct i/o");
2869                 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_DIRECT_IO;
2870         }
2871         if (pvolume_info->mfsymlinks) {
2872                 if (pvolume_info->sfu_emul) {
2873                         cERROR(1,  "mount option mfsymlinks ignored if sfu "
2874                                    "mount option is used");
2875                 } else {
2876                         cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_MF_SYMLINKS;
2877                 }
2878         }
2879
2880         if ((pvolume_info->cifs_acl) && (pvolume_info->dynperm))
2881                 cERROR(1, "mount option dynperm ignored if cifsacl "
2882                            "mount option supported");
2883 }
2884
2885 /*
2886  * When the server supports very large writes via POSIX extensions, we can
2887  * allow up to 2^24-1, minus the size of a WRITE_AND_X header, not including
2888  * the RFC1001 length.
2889  *
2890  * Note that this might make for "interesting" allocation problems during
2891  * writeback however as we have to allocate an array of pointers for the
2892  * pages. A 16M write means ~32kb page array with PAGE_CACHE_SIZE == 4096.
2893  */
2894 #define CIFS_MAX_WSIZE ((1<<24) - 1 - sizeof(WRITE_REQ) + 4)
2895
2896 /*
2897  * When the server doesn't allow large posix writes, only allow a wsize of
2898  * 2^17-1 minus the size of the WRITE_AND_X header. That allows for a write up
2899  * to the maximum size described by RFC1002.
2900  */
2901 #define CIFS_MAX_RFC1002_WSIZE ((1<<17) - 1 - sizeof(WRITE_REQ) + 4)
2902
2903 /*
2904  * The default wsize is 1M. find_get_pages seems to return a maximum of 256
2905  * pages in a single call. With PAGE_CACHE_SIZE == 4k, this means we can fill
2906  * a single wsize request with a single call.
2907  */
2908 #define CIFS_DEFAULT_WSIZE (1024 * 1024)
2909
2910 static unsigned int
2911 cifs_negotiate_wsize(struct cifs_tcon *tcon, struct smb_vol *pvolume_info)
2912 {
2913         __u64 unix_cap = le64_to_cpu(tcon->fsUnixInfo.Capability);
2914         struct TCP_Server_Info *server = tcon->ses->server;
2915         unsigned int wsize = pvolume_info->wsize ? pvolume_info->wsize :
2916                                 CIFS_DEFAULT_WSIZE;
2917
2918         /* can server support 24-bit write sizes? (via UNIX extensions) */
2919         if (!tcon->unix_ext || !(unix_cap & CIFS_UNIX_LARGE_WRITE_CAP))
2920                 wsize = min_t(unsigned int, wsize, CIFS_MAX_RFC1002_WSIZE);
2921
2922         /*
2923          * no CAP_LARGE_WRITE_X or is signing enabled without CAP_UNIX set?
2924          * Limit it to max buffer offered by the server, minus the size of the
2925          * WRITEX header, not including the 4 byte RFC1001 length.
2926          */
2927         if (!(server->capabilities & CAP_LARGE_WRITE_X) ||
2928             (!(server->capabilities & CAP_UNIX) &&
2929              (server->sec_mode & (SECMODE_SIGN_ENABLED|SECMODE_SIGN_REQUIRED))))
2930                 wsize = min_t(unsigned int, wsize,
2931                                 server->maxBuf - sizeof(WRITE_REQ) + 4);
2932
2933         /* hard limit of CIFS_MAX_WSIZE */
2934         wsize = min_t(unsigned int, wsize, CIFS_MAX_WSIZE);
2935
2936         return wsize;
2937 }
2938
2939 static int
2940 is_path_accessible(int xid, struct cifs_tcon *tcon,
2941                    struct cifs_sb_info *cifs_sb, const char *full_path)
2942 {
2943         int rc;
2944         FILE_ALL_INFO *pfile_info;
2945
2946         pfile_info = kmalloc(sizeof(FILE_ALL_INFO), GFP_KERNEL);
2947         if (pfile_info == NULL)
2948                 return -ENOMEM;
2949
2950         rc = CIFSSMBQPathInfo(xid, tcon, full_path, pfile_info,
2951                               0 /* not legacy */, cifs_sb->local_nls,
2952                               cifs_sb->mnt_cifs_flags &
2953                                 CIFS_MOUNT_MAP_SPECIAL_CHR);
2954
2955         if (rc == -EOPNOTSUPP || rc == -EINVAL)
2956                 rc = SMBQueryInformation(xid, tcon, full_path, pfile_info,
2957                                 cifs_sb->local_nls, cifs_sb->mnt_cifs_flags &
2958                                   CIFS_MOUNT_MAP_SPECIAL_CHR);
2959         kfree(pfile_info);
2960         return rc;
2961 }
2962
2963 static void
2964 cleanup_volume_info_contents(struct smb_vol *volume_info)
2965 {
2966         kfree(volume_info->username);
2967         kzfree(volume_info->password);
2968         kfree(volume_info->UNC);
2969         if (volume_info->UNCip != volume_info->UNC + 2)
2970                 kfree(volume_info->UNCip);
2971         kfree(volume_info->domainname);
2972         kfree(volume_info->iocharset);
2973         kfree(volume_info->prepath);
2974 }
2975
2976 void
2977 cifs_cleanup_volume_info(struct smb_vol *volume_info)
2978 {
2979         if (!volume_info)
2980                 return;
2981         cleanup_volume_info_contents(volume_info);
2982         kfree(volume_info);
2983 }
2984
2985
2986 #ifdef CONFIG_CIFS_DFS_UPCALL
2987 /* build_path_to_root returns full path to root when
2988  * we do not have an exiting connection (tcon) */
2989 static char *
2990 build_unc_path_to_root(const struct smb_vol *vol,
2991                 const struct cifs_sb_info *cifs_sb)
2992 {
2993         char *full_path, *pos;
2994         unsigned int pplen = vol->prepath ? strlen(vol->prepath) : 0;
2995         unsigned int unc_len = strnlen(vol->UNC, MAX_TREE_SIZE + 1);
2996
2997         full_path = kmalloc(unc_len + pplen + 1, GFP_KERNEL);
2998         if (full_path == NULL)
2999                 return ERR_PTR(-ENOMEM);
3000
3001         strncpy(full_path, vol->UNC, unc_len);
3002         pos = full_path + unc_len;
3003
3004         if (pplen) {
3005                 strncpy(pos, vol->prepath, pplen);
3006                 pos += pplen;
3007         }
3008
3009         *pos = '\0'; /* add trailing null */
3010         convert_delimiter(full_path, CIFS_DIR_SEP(cifs_sb));
3011         cFYI(1, "%s: full_path=%s", __func__, full_path);
3012         return full_path;
3013 }
3014
3015 /*
3016  * Perform a dfs referral query for a share and (optionally) prefix
3017  *
3018  * If a referral is found, cifs_sb->mountdata will be (re-)allocated
3019  * to a string containing updated options for the submount.  Otherwise it
3020  * will be left untouched.
3021  *
3022  * Returns the rc from get_dfs_path to the caller, which can be used to
3023  * determine whether there were referrals.
3024  */
3025 static int
3026 expand_dfs_referral(int xid, struct cifs_ses *pSesInfo,
3027                     struct smb_vol *volume_info, struct cifs_sb_info *cifs_sb,
3028                     int check_prefix)
3029 {
3030         int rc;
3031         unsigned int num_referrals = 0;
3032         struct dfs_info3_param *referrals = NULL;
3033         char *full_path = NULL, *ref_path = NULL, *mdata = NULL;
3034
3035         full_path = build_unc_path_to_root(volume_info, cifs_sb);
3036         if (IS_ERR(full_path))
3037                 return PTR_ERR(full_path);
3038
3039         /* For DFS paths, skip the first '\' of the UNC */
3040         ref_path = check_prefix ? full_path + 1 : volume_info->UNC + 1;
3041
3042         rc = get_dfs_path(xid, pSesInfo , ref_path, cifs_sb->local_nls,
3043                           &num_referrals, &referrals,
3044                           cifs_sb->mnt_cifs_flags & CIFS_MOUNT_MAP_SPECIAL_CHR);
3045
3046         if (!rc && num_referrals > 0) {
3047                 char *fake_devname = NULL;
3048
3049                 mdata = cifs_compose_mount_options(cifs_sb->mountdata,
3050                                                    full_path + 1, referrals,
3051                                                    &fake_devname);
3052
3053                 free_dfs_info_array(referrals, num_referrals);
3054
3055                 if (IS_ERR(mdata)) {
3056                         rc = PTR_ERR(mdata);
3057                         mdata = NULL;
3058                 } else {
3059                         cleanup_volume_info_contents(volume_info);
3060                         memset(volume_info, '\0', sizeof(*volume_info));
3061                         rc = cifs_setup_volume_info(volume_info, mdata,
3062                                                         fake_devname);
3063                 }
3064                 kfree(fake_devname);
3065                 kfree(cifs_sb->mountdata);
3066                 cifs_sb->mountdata = mdata;
3067         }
3068         kfree(full_path);
3069         return rc;
3070 }
3071 #endif
3072
3073 static int
3074 cifs_setup_volume_info(struct smb_vol *volume_info, char *mount_data,
3075                         const char *devname)
3076 {
3077         int rc = 0;
3078
3079         if (cifs_parse_mount_options(mount_data, devname, volume_info))
3080                 return -EINVAL;
3081
3082         if (volume_info->nullauth) {
3083                 cFYI(1, "null user");
3084                 volume_info->username = kzalloc(1, GFP_KERNEL);
3085                 if (volume_info->username == NULL)
3086                         return -ENOMEM;
3087         } else if (volume_info->username) {
3088                 /* BB fixme parse for domain name here */
3089                 cFYI(1, "Username: %s", volume_info->username);
3090         } else {
3091                 cifserror("No username specified");
3092         /* In userspace mount helper we can get user name from alternate
3093            locations such as env variables and files on disk */
3094                 return -EINVAL;
3095         }
3096
3097         /* this is needed for ASCII cp to Unicode converts */
3098         if (volume_info->iocharset == NULL) {
3099                 /* load_nls_default cannot return null */
3100                 volume_info->local_nls = load_nls_default();
3101         } else {
3102                 volume_info->local_nls = load_nls(volume_info->iocharset);
3103                 if (volume_info->local_nls == NULL) {
3104                         cERROR(1, "CIFS mount error: iocharset %s not found",
3105                                  volume_info->iocharset);
3106                         return -ELIBACC;
3107                 }
3108         }
3109
3110         return rc;
3111 }
3112
3113 struct smb_vol *
3114 cifs_get_volume_info(char *mount_data, const char *devname)
3115 {
3116         int rc;
3117         struct smb_vol *volume_info;
3118
3119         volume_info = kzalloc(sizeof(struct smb_vol), GFP_KERNEL);
3120         if (!volume_info)
3121                 return ERR_PTR(-ENOMEM);
3122
3123         rc = cifs_setup_volume_info(volume_info, mount_data, devname);
3124         if (rc) {
3125                 cifs_cleanup_volume_info(volume_info);
3126                 volume_info = ERR_PTR(rc);
3127         }
3128
3129         return volume_info;
3130 }
3131
3132 int
3133 cifs_mount(struct cifs_sb_info *cifs_sb, struct smb_vol *volume_info)
3134 {
3135         int rc = 0;
3136         int xid;
3137         struct cifs_ses *pSesInfo;
3138         struct cifs_tcon *tcon;
3139         struct TCP_Server_Info *srvTcp;
3140         char   *full_path;
3141         struct tcon_link *tlink;
3142 #ifdef CONFIG_CIFS_DFS_UPCALL
3143         int referral_walks_count = 0;
3144 #endif
3145
3146         rc = bdi_setup_and_register(&cifs_sb->bdi, "cifs", BDI_CAP_MAP_COPY);
3147         if (rc)
3148                 return rc;
3149
3150         cifs_sb->bdi.ra_pages = default_backing_dev_info.ra_pages;
3151
3152 #ifdef CONFIG_CIFS_DFS_UPCALL
3153 try_mount_again:
3154         /* cleanup activities if we're chasing a referral */
3155         if (referral_walks_count) {
3156                 if (tcon)
3157                         cifs_put_tcon(tcon);
3158                 else if (pSesInfo)
3159                         cifs_put_smb_ses(pSesInfo);
3160
3161                 FreeXid(xid);
3162         }
3163 #endif
3164         tcon = NULL;
3165         pSesInfo = NULL;
3166         srvTcp = NULL;
3167         full_path = NULL;
3168         tlink = NULL;
3169
3170         xid = GetXid();
3171
3172         /* get a reference to a tcp session */
3173         srvTcp = cifs_get_tcp_session(volume_info);
3174         if (IS_ERR(srvTcp)) {
3175                 rc = PTR_ERR(srvTcp);
3176                 bdi_destroy(&cifs_sb->bdi);
3177                 goto out;
3178         }
3179
3180         /* get a reference to a SMB session */
3181         pSesInfo = cifs_get_smb_ses(srvTcp, volume_info);
3182         if (IS_ERR(pSesInfo)) {
3183                 rc = PTR_ERR(pSesInfo);
3184                 pSesInfo = NULL;
3185                 goto mount_fail_check;
3186         }
3187
3188         /* search for existing tcon to this server share */
3189         tcon = cifs_get_tcon(pSesInfo, volume_info);
3190         if (IS_ERR(tcon)) {
3191                 rc = PTR_ERR(tcon);
3192                 tcon = NULL;
3193                 goto remote_path_check;
3194         }
3195
3196         /* tell server which Unix caps we support */
3197         if (tcon->ses->capabilities & CAP_UNIX) {
3198                 /* reset of caps checks mount to see if unix extensions
3199                    disabled for just this mount */
3200                 reset_cifs_unix_caps(xid, tcon, cifs_sb, volume_info);
3201                 if ((tcon->ses->server->tcpStatus == CifsNeedReconnect) &&
3202                     (le64_to_cpu(tcon->fsUnixInfo.Capability) &
3203                      CIFS_UNIX_TRANSPORT_ENCRYPTION_MANDATORY_CAP)) {
3204                         rc = -EACCES;
3205                         goto mount_fail_check;
3206                 }
3207         } else
3208                 tcon->unix_ext = 0; /* server does not support them */
3209
3210         /* do not care if following two calls succeed - informational */
3211         if (!tcon->ipc) {
3212                 CIFSSMBQFSDeviceInfo(xid, tcon);
3213                 CIFSSMBQFSAttributeInfo(xid, tcon);
3214         }
3215
3216         if ((tcon->unix_ext == 0) && (cifs_sb->rsize > (1024 * 127))) {
3217                 cifs_sb->rsize = 1024 * 127;
3218                 cFYI(DBG2, "no very large read support, rsize now 127K");
3219         }
3220         if (!(tcon->ses->capabilities & CAP_LARGE_READ_X))
3221                 cifs_sb->rsize = min(cifs_sb->rsize, CIFSMaxBufSize);
3222
3223         cifs_sb->wsize = cifs_negotiate_wsize(tcon, volume_info);
3224
3225 remote_path_check:
3226 #ifdef CONFIG_CIFS_DFS_UPCALL
3227         /*
3228          * Perform an unconditional check for whether there are DFS
3229          * referrals for this path without prefix, to provide support
3230          * for DFS referrals from w2k8 servers which don't seem to respond
3231          * with PATH_NOT_COVERED to requests that include the prefix.
3232          * Chase the referral if found, otherwise continue normally.
3233          */
3234         if (referral_walks_count == 0) {
3235                 int refrc = expand_dfs_referral(xid, pSesInfo, volume_info,
3236                                                 cifs_sb, false);
3237                 if (!refrc) {
3238                         referral_walks_count++;
3239                         goto try_mount_again;
3240                 }
3241         }
3242 #endif
3243
3244         /* check if a whole path is not remote */
3245         if (!rc && tcon) {
3246                 /* build_path_to_root works only when we have a valid tcon */
3247                 full_path = cifs_build_path_to_root(volume_info, cifs_sb, tcon);
3248                 if (full_path == NULL) {
3249                         rc = -ENOMEM;
3250                         goto mount_fail_check;
3251                 }
3252                 rc = is_path_accessible(xid, tcon, cifs_sb, full_path);
3253                 if (rc != 0 && rc != -EREMOTE) {
3254                         kfree(full_path);
3255                         goto mount_fail_check;
3256                 }
3257                 kfree(full_path);
3258         }
3259
3260         /* get referral if needed */
3261         if (rc == -EREMOTE) {
3262 #ifdef CONFIG_CIFS_DFS_UPCALL
3263                 if (referral_walks_count > MAX_NESTED_LINKS) {
3264                         /*
3265                          * BB: when we implement proper loop detection,
3266                          *     we will remove this check. But now we need it
3267                          *     to prevent an indefinite loop if 'DFS tree' is
3268                          *     misconfigured (i.e. has loops).
3269                          */
3270                         rc = -ELOOP;
3271                         goto mount_fail_check;
3272                 }
3273
3274                 rc = expand_dfs_referral(xid, pSesInfo, volume_info, cifs_sb,
3275                                          true);
3276
3277                 if (!rc) {
3278                         referral_walks_count++;
3279                         goto try_mount_again;
3280                 }
3281                 goto mount_fail_check;
3282 #else /* No DFS support, return error on mount */
3283                 rc = -EOPNOTSUPP;
3284 #endif
3285         }
3286
3287         if (rc)
3288                 goto mount_fail_check;
3289
3290         /* now, hang the tcon off of the superblock */
3291         tlink = kzalloc(sizeof *tlink, GFP_KERNEL);
3292         if (tlink == NULL) {
3293                 rc = -ENOMEM;
3294                 goto mount_fail_check;
3295         }
3296
3297         tlink->tl_uid = pSesInfo->linux_uid;
3298         tlink->tl_tcon = tcon;
3299         tlink->tl_time = jiffies;
3300         set_bit(TCON_LINK_MASTER, &tlink->tl_flags);
3301         set_bit(TCON_LINK_IN_TREE, &tlink->tl_flags);
3302
3303         cifs_sb->master_tlink = tlink;
3304         spin_lock(&cifs_sb->tlink_tree_lock);
3305         tlink_rb_insert(&cifs_sb->tlink_tree, tlink);
3306         spin_unlock(&cifs_sb->tlink_tree_lock);
3307
3308         queue_delayed_work(system_nrt_wq, &cifs_sb->prune_tlinks,
3309                                 TLINK_IDLE_EXPIRE);
3310
3311 mount_fail_check:
3312         /* on error free sesinfo and tcon struct if needed */
3313         if (rc) {
3314                 /* If find_unc succeeded then rc == 0 so we can not end */
3315                 /* up accidentally freeing someone elses tcon struct */
3316                 if (tcon)
3317                         cifs_put_tcon(tcon);
3318                 else if (pSesInfo)
3319                         cifs_put_smb_ses(pSesInfo);
3320                 else
3321                         cifs_put_tcp_session(srvTcp);
3322                 bdi_destroy(&cifs_sb->bdi);
3323         }
3324
3325 out:
3326         FreeXid(xid);
3327         return rc;
3328 }
3329
3330 /*
3331  * Issue a TREE_CONNECT request. Note that for IPC$ shares, that the tcon
3332  * pointer may be NULL.
3333  */
3334 int
3335 CIFSTCon(unsigned int xid, struct cifs_ses *ses,
3336          const char *tree, struct cifs_tcon *tcon,
3337          const struct nls_table *nls_codepage)
3338 {
3339         struct smb_hdr *smb_buffer;
3340         struct smb_hdr *smb_buffer_response;
3341         TCONX_REQ *pSMB;
3342         TCONX_RSP *pSMBr;
3343         unsigned char *bcc_ptr;
3344         int rc = 0;
3345         int length;
3346         __u16 bytes_left, count;
3347
3348         if (ses == NULL)
3349                 return -EIO;
3350
3351         smb_buffer = cifs_buf_get();
3352         if (smb_buffer == NULL)
3353                 return -ENOMEM;
3354
3355         smb_buffer_response = smb_buffer;
3356
3357         header_assemble(smb_buffer, SMB_COM_TREE_CONNECT_ANDX,
3358                         NULL /*no tid */ , 4 /*wct */ );
3359
3360         smb_buffer->Mid = GetNextMid(ses->server);
3361         smb_buffer->Uid = ses->Suid;
3362         pSMB = (TCONX_REQ *) smb_buffer;
3363         pSMBr = (TCONX_RSP *) smb_buffer_response;
3364
3365         pSMB->AndXCommand = 0xFF;
3366         pSMB->Flags = cpu_to_le16(TCON_EXTENDED_SECINFO);
3367         bcc_ptr = &pSMB->Password[0];
3368         if (!tcon || (ses->server->sec_mode & SECMODE_USER)) {
3369                 pSMB->PasswordLength = cpu_to_le16(1);  /* minimum */
3370                 *bcc_ptr = 0; /* password is null byte */
3371                 bcc_ptr++;              /* skip password */
3372                 /* already aligned so no need to do it below */
3373         } else {
3374                 pSMB->PasswordLength = cpu_to_le16(CIFS_AUTH_RESP_SIZE);
3375                 /* BB FIXME add code to fail this if NTLMv2 or Kerberos
3376                    specified as required (when that support is added to
3377                    the vfs in the future) as only NTLM or the much
3378                    weaker LANMAN (which we do not send by default) is accepted
3379                    by Samba (not sure whether other servers allow
3380                    NTLMv2 password here) */
3381 #ifdef CONFIG_CIFS_WEAK_PW_HASH
3382                 if ((global_secflags & CIFSSEC_MAY_LANMAN) &&
3383                     (ses->server->secType == LANMAN))
3384                         calc_lanman_hash(tcon->password, ses->server->cryptkey,
3385                                          ses->server->sec_mode &
3386                                             SECMODE_PW_ENCRYPT ? true : false,
3387                                          bcc_ptr);
3388                 else
3389 #endif /* CIFS_WEAK_PW_HASH */
3390                 rc = SMBNTencrypt(tcon->password, ses->server->cryptkey,
3391                                         bcc_ptr);
3392
3393                 bcc_ptr += CIFS_AUTH_RESP_SIZE;
3394                 if (ses->capabilities & CAP_UNICODE) {
3395                         /* must align unicode strings */
3396                         *bcc_ptr = 0; /* null byte password */
3397                         bcc_ptr++;
3398                 }
3399         }
3400
3401         if (ses->server->sec_mode &
3402                         (SECMODE_SIGN_REQUIRED | SECMODE_SIGN_ENABLED))
3403                 smb_buffer->Flags2 |= SMBFLG2_SECURITY_SIGNATURE;
3404
3405         if (ses->capabilities & CAP_STATUS32) {
3406                 smb_buffer->Flags2 |= SMBFLG2_ERR_STATUS;
3407         }
3408         if (ses->capabilities & CAP_DFS) {
3409                 smb_buffer->Flags2 |= SMBFLG2_DFS;
3410         }
3411         if (ses->capabilities & CAP_UNICODE) {
3412                 smb_buffer->Flags2 |= SMBFLG2_UNICODE;
3413                 length =
3414                     cifs_strtoUCS((__le16 *) bcc_ptr, tree,
3415                         6 /* max utf8 char length in bytes */ *
3416                         (/* server len*/ + 256 /* share len */), nls_codepage);
3417                 bcc_ptr += 2 * length;  /* convert num 16 bit words to bytes */
3418                 bcc_ptr += 2;   /* skip trailing null */
3419         } else {                /* ASCII */
3420                 strcpy(bcc_ptr, tree);
3421                 bcc_ptr += strlen(tree) + 1;
3422         }
3423         strcpy(bcc_ptr, "?????");
3424         bcc_ptr += strlen("?????");
3425         bcc_ptr += 1;
3426         count = bcc_ptr - &pSMB->Password[0];
3427         pSMB->hdr.smb_buf_length = cpu_to_be32(be32_to_cpu(
3428                                         pSMB->hdr.smb_buf_length) + count);
3429         pSMB->ByteCount = cpu_to_le16(count);
3430
3431         rc = SendReceive(xid, ses, smb_buffer, smb_buffer_response, &length,
3432                          0);
3433
3434         /* above now done in SendReceive */
3435         if ((rc == 0) && (tcon != NULL)) {
3436                 bool is_unicode;
3437
3438                 tcon->tidStatus = CifsGood;
3439                 tcon->need_reconnect = false;
3440                 tcon->tid = smb_buffer_response->Tid;
3441                 bcc_ptr = pByteArea(smb_buffer_response);
3442                 bytes_left = get_bcc(smb_buffer_response);
3443                 length = strnlen(bcc_ptr, bytes_left - 2);
3444                 if (smb_buffer->Flags2 & SMBFLG2_UNICODE)
3445                         is_unicode = true;
3446                 else
3447                         is_unicode = false;
3448
3449
3450                 /* skip service field (NB: this field is always ASCII) */
3451                 if (length == 3) {
3452                         if ((bcc_ptr[0] == 'I') && (bcc_ptr[1] == 'P') &&
3453                             (bcc_ptr[2] == 'C')) {
3454                                 cFYI(1, "IPC connection");
3455                                 tcon->ipc = 1;
3456                         }
3457                 } else if (length == 2) {
3458                         if ((bcc_ptr[0] == 'A') && (bcc_ptr[1] == ':')) {
3459                                 /* the most common case */
3460                                 cFYI(1, "disk share connection");
3461                         }
3462                 }
3463                 bcc_ptr += length + 1;
3464                 bytes_left -= (length + 1);
3465                 strncpy(tcon->treeName, tree, MAX_TREE_SIZE);
3466
3467                 /* mostly informational -- no need to fail on error here */
3468                 kfree(tcon->nativeFileSystem);
3469                 tcon->nativeFileSystem = cifs_strndup_from_ucs(bcc_ptr,
3470                                                       bytes_left, is_unicode,
3471                                                       nls_codepage);
3472
3473                 cFYI(1, "nativeFileSystem=%s", tcon->nativeFileSystem);
3474
3475                 if ((smb_buffer_response->WordCount == 3) ||
3476                          (smb_buffer_response->WordCount == 7))
3477                         /* field is in same location */
3478                         tcon->Flags = le16_to_cpu(pSMBr->OptionalSupport);
3479                 else
3480                         tcon->Flags = 0;
3481                 cFYI(1, "Tcon flags: 0x%x ", tcon->Flags);
3482         } else if ((rc == 0) && tcon == NULL) {
3483                 /* all we need to save for IPC$ connection */
3484                 ses->ipc_tid = smb_buffer_response->Tid;
3485         }
3486
3487         cifs_buf_release(smb_buffer);
3488         return rc;
3489 }
3490
3491 void
3492 cifs_umount(struct cifs_sb_info *cifs_sb)
3493 {
3494         struct rb_root *root = &cifs_sb->tlink_tree;
3495         struct rb_node *node;
3496         struct tcon_link *tlink;
3497
3498         cancel_delayed_work_sync(&cifs_sb->prune_tlinks);
3499
3500         spin_lock(&cifs_sb->tlink_tree_lock);
3501         while ((node = rb_first(root))) {
3502                 tlink = rb_entry(node, struct tcon_link, tl_rbnode);
3503                 cifs_get_tlink(tlink);
3504                 clear_bit(TCON_LINK_IN_TREE, &tlink->tl_flags);
3505                 rb_erase(node, root);
3506
3507                 spin_unlock(&cifs_sb->tlink_tree_lock);
3508                 cifs_put_tlink(tlink);
3509                 spin_lock(&cifs_sb->tlink_tree_lock);
3510         }
3511         spin_unlock(&cifs_sb->tlink_tree_lock);
3512
3513         bdi_destroy(&cifs_sb->bdi);
3514         kfree(cifs_sb->mountdata);
3515         unload_nls(cifs_sb->local_nls);
3516         kfree(cifs_sb);
3517 }
3518
3519 int cifs_negotiate_protocol(unsigned int xid, struct cifs_ses *ses)
3520 {
3521         int rc = 0;
3522         struct TCP_Server_Info *server = ses->server;
3523
3524         /* only send once per connect */
3525         if (server->maxBuf != 0)
3526                 return 0;
3527
3528         rc = CIFSSMBNegotiate(xid, ses);
3529         if (rc == -EAGAIN) {
3530                 /* retry only once on 1st time connection */
3531                 rc = CIFSSMBNegotiate(xid, ses);
3532                 if (rc == -EAGAIN)
3533                         rc = -EHOSTDOWN;
3534         }
3535         if (rc == 0) {
3536                 spin_lock(&GlobalMid_Lock);
3537                 if (server->tcpStatus == CifsNeedNegotiate)
3538                         server->tcpStatus = CifsGood;
3539                 else
3540                         rc = -EHOSTDOWN;
3541                 spin_unlock(&GlobalMid_Lock);
3542
3543         }
3544
3545         return rc;
3546 }
3547
3548
3549 int cifs_setup_session(unsigned int xid, struct cifs_ses *ses,
3550                         struct nls_table *nls_info)
3551 {
3552         int rc = 0;
3553         struct TCP_Server_Info *server = ses->server;
3554
3555         ses->flags = 0;
3556         ses->capabilities = server->capabilities;
3557         if (linuxExtEnabled == 0)
3558                 ses->capabilities &= (~CAP_UNIX);
3559
3560         cFYI(1, "Security Mode: 0x%x Capabilities: 0x%x TimeAdjust: %d",
3561                  server->sec_mode, server->capabilities, server->timeAdj);
3562
3563         rc = CIFS_SessSetup(xid, ses, nls_info);
3564         if (rc) {
3565                 cERROR(1, "Send error in SessSetup = %d", rc);
3566         } else {
3567                 mutex_lock(&ses->server->srv_mutex);
3568                 if (!server->session_estab) {
3569                         server->session_key.response = ses->auth_key.response;
3570                         server->session_key.len = ses->auth_key.len;
3571                         server->sequence_number = 0x2;
3572                         server->session_estab = true;
3573                         ses->auth_key.response = NULL;
3574                 }
3575                 mutex_unlock(&server->srv_mutex);
3576
3577                 cFYI(1, "CIFS Session Established successfully");
3578                 spin_lock(&GlobalMid_Lock);
3579                 ses->status = CifsGood;
3580                 ses->need_reconnect = false;
3581                 spin_unlock(&GlobalMid_Lock);
3582         }
3583
3584         kfree(ses->auth_key.response);
3585         ses->auth_key.response = NULL;
3586         ses->auth_key.len = 0;
3587         kfree(ses->ntlmssp);
3588         ses->ntlmssp = NULL;
3589
3590         return rc;
3591 }
3592
3593 static struct cifs_tcon *
3594 cifs_construct_tcon(struct cifs_sb_info *cifs_sb, uid_t fsuid)
3595 {
3596         struct cifs_tcon *master_tcon = cifs_sb_master_tcon(cifs_sb);
3597         struct cifs_ses *ses;
3598         struct cifs_tcon *tcon = NULL;
3599         struct smb_vol *vol_info;
3600         char username[28]; /* big enough for "krb50x" + hex of ULONG_MAX 6+16 */
3601                            /* We used to have this as MAX_USERNAME which is   */
3602                            /* way too big now (256 instead of 32) */
3603
3604         vol_info = kzalloc(sizeof(*vol_info), GFP_KERNEL);
3605         if (vol_info == NULL) {
3606                 tcon = ERR_PTR(-ENOMEM);
3607                 goto out;
3608         }
3609
3610         snprintf(username, sizeof(username), "krb50x%x", fsuid);
3611         vol_info->username = username;
3612         vol_info->local_nls = cifs_sb->local_nls;
3613         vol_info->linux_uid = fsuid;
3614         vol_info->cred_uid = fsuid;
3615         vol_info->UNC = master_tcon->treeName;
3616         vol_info->retry = master_tcon->retry;
3617         vol_info->nocase = master_tcon->nocase;
3618         vol_info->local_lease = master_tcon->local_lease;
3619         vol_info->no_linux_ext = !master_tcon->unix_ext;
3620
3621         /* FIXME: allow for other secFlg settings */
3622         vol_info->secFlg = CIFSSEC_MUST_KRB5;
3623
3624         /* get a reference for the same TCP session */
3625         spin_lock(&cifs_tcp_ses_lock);
3626         ++master_tcon->ses->server->srv_count;
3627         spin_unlock(&cifs_tcp_ses_lock);
3628
3629         ses = cifs_get_smb_ses(master_tcon->ses->server, vol_info);
3630         if (IS_ERR(ses)) {
3631                 tcon = (struct cifs_tcon *)ses;
3632                 cifs_put_tcp_session(master_tcon->ses->server);
3633                 goto out;
3634         }
3635
3636         tcon = cifs_get_tcon(ses, vol_info);
3637         if (IS_ERR(tcon)) {
3638                 cifs_put_smb_ses(ses);
3639                 goto out;
3640         }
3641
3642         if (ses->capabilities & CAP_UNIX)
3643                 reset_cifs_unix_caps(0, tcon, NULL, vol_info);
3644 out:
3645         kfree(vol_info);
3646
3647         return tcon;
3648 }
3649
3650 struct cifs_tcon *
3651 cifs_sb_master_tcon(struct cifs_sb_info *cifs_sb)
3652 {
3653         return tlink_tcon(cifs_sb_master_tlink(cifs_sb));
3654 }
3655
3656 static int
3657 cifs_sb_tcon_pending_wait(void *unused)
3658 {
3659         schedule();
3660         return signal_pending(current) ? -ERESTARTSYS : 0;
3661 }
3662
3663 /* find and return a tlink with given uid */
3664 static struct tcon_link *
3665 tlink_rb_search(struct rb_root *root, uid_t uid)
3666 {
3667         struct rb_node *node = root->rb_node;
3668         struct tcon_link *tlink;
3669
3670         while (node) {
3671                 tlink = rb_entry(node, struct tcon_link, tl_rbnode);
3672
3673                 if (tlink->tl_uid > uid)
3674                         node = node->rb_left;
3675                 else if (tlink->tl_uid < uid)
3676                         node = node->rb_right;
3677                 else
3678                         return tlink;
3679         }
3680         return NULL;
3681 }
3682
3683 /* insert a tcon_link into the tree */
3684 static void
3685 tlink_rb_insert(struct rb_root *root, struct tcon_link *new_tlink)
3686 {
3687         struct rb_node **new = &(root->rb_node), *parent = NULL;
3688         struct tcon_link *tlink;
3689
3690         while (*new) {
3691                 tlink = rb_entry(*new, struct tcon_link, tl_rbnode);
3692                 parent = *new;
3693
3694                 if (tlink->tl_uid > new_tlink->tl_uid)
3695                         new = &((*new)->rb_left);
3696                 else
3697                         new = &((*new)->rb_right);
3698         }
3699
3700         rb_link_node(&new_tlink->tl_rbnode, parent, new);
3701         rb_insert_color(&new_tlink->tl_rbnode, root);
3702 }
3703
3704 /*
3705  * Find or construct an appropriate tcon given a cifs_sb and the fsuid of the
3706  * current task.
3707  *
3708  * If the superblock doesn't refer to a multiuser mount, then just return
3709  * the master tcon for the mount.
3710  *
3711  * First, search the rbtree for an existing tcon for this fsuid. If one
3712  * exists, then check to see if it's pending construction. If it is then wait
3713  * for construction to complete. Once it's no longer pending, check to see if
3714  * it failed and either return an error or retry construction, depending on
3715  * the timeout.
3716  *
3717  * If one doesn't exist then insert a new tcon_link struct into the tree and
3718  * try to construct a new one.
3719  */
3720 struct tcon_link *
3721 cifs_sb_tlink(struct cifs_sb_info *cifs_sb)
3722 {
3723         int ret;
3724         uid_t fsuid = current_fsuid();
3725         struct tcon_link *tlink, *newtlink;
3726
3727         if (!(cifs_sb->mnt_cifs_flags & CIFS_MOUNT_MULTIUSER))
3728                 return cifs_get_tlink(cifs_sb_master_tlink(cifs_sb));
3729
3730         spin_lock(&cifs_sb->tlink_tree_lock);
3731         tlink = tlink_rb_search(&cifs_sb->tlink_tree, fsuid);
3732         if (tlink)
3733                 cifs_get_tlink(tlink);
3734         spin_unlock(&cifs_sb->tlink_tree_lock);
3735
3736         if (tlink == NULL) {
3737                 newtlink = kzalloc(sizeof(*tlink), GFP_KERNEL);
3738                 if (newtlink == NULL)
3739                         return ERR_PTR(-ENOMEM);
3740                 newtlink->tl_uid = fsuid;
3741                 newtlink->tl_tcon = ERR_PTR(-EACCES);
3742                 set_bit(TCON_LINK_PENDING, &newtlink->tl_flags);
3743                 set_bit(TCON_LINK_IN_TREE, &newtlink->tl_flags);
3744                 cifs_get_tlink(newtlink);
3745
3746                 spin_lock(&cifs_sb->tlink_tree_lock);
3747                 /* was one inserted after previous search? */
3748                 tlink = tlink_rb_search(&cifs_sb->tlink_tree, fsuid);
3749                 if (tlink) {
3750                         cifs_get_tlink(tlink);
3751                         spin_unlock(&cifs_sb->tlink_tree_lock);
3752                         kfree(newtlink);
3753                         goto wait_for_construction;
3754                 }
3755                 tlink = newtlink;
3756                 tlink_rb_insert(&cifs_sb->tlink_tree, tlink);
3757                 spin_unlock(&cifs_sb->tlink_tree_lock);
3758         } else {
3759 wait_for_construction:
3760                 ret = wait_on_bit(&tlink->tl_flags, TCON_LINK_PENDING,
3761                                   cifs_sb_tcon_pending_wait,
3762                                   TASK_INTERRUPTIBLE);
3763                 if (ret) {
3764                         cifs_put_tlink(tlink);
3765                         return ERR_PTR(ret);
3766                 }
3767
3768                 /* if it's good, return it */
3769                 if (!IS_ERR(tlink->tl_tcon))
3770                         return tlink;
3771
3772                 /* return error if we tried this already recently */
3773                 if (time_before(jiffies, tlink->tl_time + TLINK_ERROR_EXPIRE)) {
3774                         cifs_put_tlink(tlink);
3775                         return ERR_PTR(-EACCES);
3776                 }
3777
3778                 if (test_and_set_bit(TCON_LINK_PENDING, &tlink->tl_flags))
3779                         goto wait_for_construction;
3780         }
3781
3782         tlink->tl_tcon = cifs_construct_tcon(cifs_sb, fsuid);
3783         clear_bit(TCON_LINK_PENDING, &tlink->tl_flags);
3784         wake_up_bit(&tlink->tl_flags, TCON_LINK_PENDING);
3785
3786         if (IS_ERR(tlink->tl_tcon)) {
3787                 cifs_put_tlink(tlink);
3788                 return ERR_PTR(-EACCES);
3789         }
3790
3791         return tlink;
3792 }
3793
3794 /*
3795  * periodic workqueue job that scans tcon_tree for a superblock and closes
3796  * out tcons.
3797  */
3798 static void
3799 cifs_prune_tlinks(struct work_struct *work)
3800 {
3801         struct cifs_sb_info *cifs_sb = container_of(work, struct cifs_sb_info,
3802                                                     prune_tlinks.work);
3803         struct rb_root *root = &cifs_sb->tlink_tree;
3804         struct rb_node *node = rb_first(root);
3805         struct rb_node *tmp;
3806         struct tcon_link *tlink;
3807
3808         /*
3809          * Because we drop the spinlock in the loop in order to put the tlink
3810          * it's not guarded against removal of links from the tree. The only
3811          * places that remove entries from the tree are this function and
3812          * umounts. Because this function is non-reentrant and is canceled
3813          * before umount can proceed, this is safe.
3814          */
3815         spin_lock(&cifs_sb->tlink_tree_lock);
3816         node = rb_first(root);
3817         while (node != NULL) {
3818                 tmp = node;
3819                 node = rb_next(tmp);
3820                 tlink = rb_entry(tmp, struct tcon_link, tl_rbnode);
3821
3822                 if (test_bit(TCON_LINK_MASTER, &tlink->tl_flags) ||
3823                     atomic_read(&tlink->tl_count) != 0 ||
3824                     time_after(tlink->tl_time + TLINK_IDLE_EXPIRE, jiffies))
3825                         continue;
3826
3827                 cifs_get_tlink(tlink);
3828                 clear_bit(TCON_LINK_IN_TREE, &tlink->tl_flags);
3829                 rb_erase(tmp, root);
3830
3831                 spin_unlock(&cifs_sb->tlink_tree_lock);
3832                 cifs_put_tlink(tlink);
3833                 spin_lock(&cifs_sb->tlink_tree_lock);
3834         }
3835         spin_unlock(&cifs_sb->tlink_tree_lock);
3836
3837         queue_delayed_work(system_nrt_wq, &cifs_sb->prune_tlinks,
3838                                 TLINK_IDLE_EXPIRE);
3839 }