fs/cifs/connect.c

   1 /*
   2  *   fs/cifs/connect.c
   3  *
   4  *   Copyright (C) International Business Machines  Corp., 2002,2009
   5  *   Author(s): Steve French (sfrench@us.ibm.com)
   6  *
   7  *   This library is free software; you can redistribute it and/or modify
   8  *   it under the terms of the GNU Lesser General Public License as published
   9  *   by the Free Software Foundation; either version 2.1 of the License, or
  10  *   (at your option) any later version.
  11  *
  12  *   This library is distributed in the hope that it will be useful,
  13  *   but WITHOUT ANY WARRANTY; without even the implied warranty of
  14  *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See
  15  *   the GNU Lesser General Public License for more details.
  16  *
  17  *   You should have received a copy of the GNU Lesser General Public License
  18  *   along with this library; if not, write to the Free Software
  19  *   Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
  20  */
  21 #include <linux/fs.h>
  22 #include <linux/net.h>
  23 #include <linux/string.h>
  24 #include <linux/list.h>
  25 #include <linux/wait.h>
  26 #include <linux/slab.h>
  27 #include <linux/pagemap.h>
  28 #include <linux/ctype.h>
  29 #include <linux/utsname.h>
  30 #include <linux/mempool.h>
  31 #include <linux/delay.h>
  32 #include <linux/completion.h>
  33 #include <linux/kthread.h>
  34 #include <linux/pagevec.h>
  35 #include <linux/freezer.h>
  36 #include <linux/namei.h>
  37 #include <asm/uaccess.h>
  38 #include <asm/processor.h>
  39 #include <linux/inet.h>
  40 #include <linux/module.h>
  41 #include <net/ipv6.h>
  42 #include "cifspdu.h"
  43 #include "cifsglob.h"
  44 #include "cifsproto.h"
  45 #include "cifs_unicode.h"
  46 #include "cifs_debug.h"
  47 #include "cifs_fs_sb.h"
  48 #include "ntlmssp.h"
  49 #include "nterr.h"
  50 #include "rfc1002pdu.h"
  51 #include "fscache.h"
  52
  53 #define CIFS_PORT 445
  54 #define RFC1001_PORT 139
  55
  56 /* SMB echo "timeout" -- FIXME: tunable? */
  57 #define SMB_ECHO_INTERVAL (60 * HZ)
  58
  59 extern mempool_t *cifs_req_poolp;
  60
  61 /* FIXME: should these be tunable? */
  62 #define TLINK_ERROR_EXPIRE      (1 * HZ)
  63 #define TLINK_IDLE_EXPIRE       (600 * HZ)
  64
  65 static int ip_connect(struct TCP_Server_Info *server);
  66 static int generic_ip_connect(struct TCP_Server_Info *server);
  67 static void tlink_rb_insert(struct rb_root *root, struct tcon_link *new_tlink);
  68 static void cifs_prune_tlinks(struct work_struct *work);
  69 static int cifs_setup_volume_info(struct smb_vol *volume_info, char *mount_data,
  70                                         const char *devname);
  71
  72 /*
  73  * cifs tcp session reconnection
  74  *
  75  * mark tcp session as reconnecting so temporarily locked
  76  * mark all smb sessions as reconnecting for tcp session
  77  * reconnect tcp session
  78  * wake up waiters on reconnection? - (not needed currently)
  79  */
  80 static int
  81 cifs_reconnect(struct TCP_Server_Info *server)
  82 {
  83         int rc = 0;
  84         struct list_head *tmp, *tmp2;
  85         struct cifs_ses *ses;
  86         struct cifs_tcon *tcon;
  87         struct mid_q_entry *mid_entry;
  88         struct list_head retry_list;
  89
  90         spin_lock(&GlobalMid_Lock);
  91         if (server->tcpStatus == CifsExiting) {
  92                 /* the demux thread will exit normally
  93                 next time through the loop */
  94                 spin_unlock(&GlobalMid_Lock);
  95                 return rc;
  96         } else
  97                 server->tcpStatus = CifsNeedReconnect;
  98         spin_unlock(&GlobalMid_Lock);
  99         server->maxBuf = 0;
 100
 101         cFYI(1, "Reconnecting tcp session");
 102
 103         /* before reconnecting the tcp session, mark the smb session (uid)
 104                 and the tid bad so they are not used until reconnected */
 105         cFYI(1, "%s: marking sessions and tcons for reconnect", __func__);
 106         spin_lock(&cifs_tcp_ses_lock);
 107         list_for_each(tmp, &server->smb_ses_list) {
 108                 ses = list_entry(tmp, struct cifs_ses, smb_ses_list);
 109                 ses->need_reconnect = true;
 110                 ses->ipc_tid = 0;
 111                 list_for_each(tmp2, &ses->tcon_list) {
 112                         tcon = list_entry(tmp2, struct cifs_tcon, tcon_list);
 113                         tcon->need_reconnect = true;
 114                 }
 115         }
 116         spin_unlock(&cifs_tcp_ses_lock);
 117
 118         /* do not want to be sending data on a socket we are freeing */
 119         cFYI(1, "%s: tearing down socket", __func__);
 120         mutex_lock(&server->srv_mutex);
 121         if (server->ssocket) {
 122                 cFYI(1, "State: 0x%x Flags: 0x%lx", server->ssocket->state,
 123                         server->ssocket->flags);
 124                 kernel_sock_shutdown(server->ssocket, SHUT_WR);
 125                 cFYI(1, "Post shutdown state: 0x%x Flags: 0x%lx",
 126                         server->ssocket->state,
 127                         server->ssocket->flags);
 128                 sock_release(server->ssocket);
 129                 server->ssocket = NULL;
 130         }
 131         server->sequence_number = 0;
 132         server->session_estab = false;
 133         kfree(server->session_key.response);
 134         server->session_key.response = NULL;
 135         server->session_key.len = 0;
 136         server->lstrp = jiffies;
 137         mutex_unlock(&server->srv_mutex);
 138
 139         /* mark submitted MIDs for retry and issue callback */
 140         INIT_LIST_HEAD(&retry_list);
 141         cFYI(1, "%s: moving mids to private list", __func__);
 142         spin_lock(&GlobalMid_Lock);
 143         list_for_each_safe(tmp, tmp2, &server->pending_mid_q) {
 144                 mid_entry = list_entry(tmp, struct mid_q_entry, qhead);
 145                 if (mid_entry->midState == MID_REQUEST_SUBMITTED)
 146                         mid_entry->midState = MID_RETRY_NEEDED;
 147                 list_move(&mid_entry->qhead, &retry_list);
 148         }
 149         spin_unlock(&GlobalMid_Lock);
 150
 151         cFYI(1, "%s: issuing mid callbacks", __func__);
 152         list_for_each_safe(tmp, tmp2, &retry_list) {
 153                 mid_entry = list_entry(tmp, struct mid_q_entry, qhead);
 154                 list_del_init(&mid_entry->qhead);
 155                 mid_entry->callback(mid_entry);
 156         }
 157
 158         do {
 159                 try_to_freeze();
 160
 161                 /* we should try only the port we connected to before */
 162                 rc = generic_ip_connect(server);
 163                 if (rc) {
 164                         cFYI(1, "reconnect error %d", rc);
 165                         msleep(3000);
 166                 } else {
 167                         atomic_inc(&tcpSesReconnectCount);
 168                         spin_lock(&GlobalMid_Lock);
 169                         if (server->tcpStatus != CifsExiting)
 170                                 server->tcpStatus = CifsNeedNegotiate;
 171                         spin_unlock(&GlobalMid_Lock);
 172                 }
 173         } while (server->tcpStatus == CifsNeedReconnect);
 174
 175         return rc;
 176 }
 177
 178 /*
 179         return codes:
 180                 0       not a transact2, or all data present
 181                 >0      transact2 with that much data missing
 182                 -EINVAL = invalid transact2
 183
 184  */
 185 static int check2ndT2(struct smb_hdr *pSMB)
 186 {
 187         struct smb_t2_rsp *pSMBt;
 188         int remaining;
 189         __u16 total_data_size, data_in_this_rsp;
 190
 191         if (pSMB->Command != SMB_COM_TRANSACTION2)
 192                 return 0;
 193
 194         /* check for plausible wct, bcc and t2 data and parm sizes */
 195         /* check for parm and data offset going beyond end of smb */
 196         if (pSMB->WordCount != 10) { /* coalesce_t2 depends on this */
 197                 cFYI(1, "invalid transact2 word count");
 198                 return -EINVAL;
 199         }
 200
 201         pSMBt = (struct smb_t2_rsp *)pSMB;
 202
 203         total_data_size = get_unaligned_le16(&pSMBt->t2_rsp.TotalDataCount);
 204         data_in_this_rsp = get_unaligned_le16(&pSMBt->t2_rsp.DataCount);
 205
 206         if (total_data_size == data_in_this_rsp)
 207                 return 0;
 208         else if (total_data_size < data_in_this_rsp) {
 209                 cFYI(1, "total data %d smaller than data in frame %d",
 210                         total_data_size, data_in_this_rsp);
 211                 return -EINVAL;
 212         }
 213
 214         remaining = total_data_size - data_in_this_rsp;
 215
 216         cFYI(1, "missing %d bytes from transact2, check next response",
 217                 remaining);
 218         if (total_data_size > CIFSMaxBufSize) {
 219                 cERROR(1, "TotalDataSize %d is over maximum buffer %d",
 220                         total_data_size, CIFSMaxBufSize);
 221                 return -EINVAL;
 222         }
 223         return remaining;
 224 }
 225
 226 static int coalesce_t2(struct smb_hdr *psecond, struct smb_hdr *pTargetSMB)
 227 {
 228         struct smb_t2_rsp *pSMB2 = (struct smb_t2_rsp *)psecond;
 229         struct smb_t2_rsp *pSMBt  = (struct smb_t2_rsp *)pTargetSMB;
 230         char *data_area_of_target;
 231         char *data_area_of_buf2;
 232         int remaining;
 233         unsigned int byte_count, total_in_buf;
 234         __u16 total_data_size, total_in_buf2;
 235
 236         total_data_size = get_unaligned_le16(&pSMBt->t2_rsp.TotalDataCount);
 237
 238         if (total_data_size !=
 239             get_unaligned_le16(&pSMB2->t2_rsp.TotalDataCount))
 240                 cFYI(1, "total data size of primary and secondary t2 differ");
 241
 242         total_in_buf = get_unaligned_le16(&pSMBt->t2_rsp.DataCount);
 243
 244         remaining = total_data_size - total_in_buf;
 245
 246         if (remaining < 0)
 247                 return -EPROTO;
 248
 249         if (remaining == 0) /* nothing to do, ignore */
 250                 return 0;
 251
 252         total_in_buf2 = get_unaligned_le16(&pSMB2->t2_rsp.DataCount);
 253         if (remaining < total_in_buf2) {
 254                 cFYI(1, "transact2 2nd response contains too much data");
 255         }
 256
 257         /* find end of first SMB data area */
 258         data_area_of_target = (char *)&pSMBt->hdr.Protocol +
 259                                 get_unaligned_le16(&pSMBt->t2_rsp.DataOffset);
 260         /* validate target area */
 261
 262         data_area_of_buf2 = (char *)&pSMB2->hdr.Protocol +
 263                                 get_unaligned_le16(&pSMB2->t2_rsp.DataOffset);
 264
 265         data_area_of_target += total_in_buf;
 266
 267         /* copy second buffer into end of first buffer */
 268         total_in_buf += total_in_buf2;
 269         /* is the result too big for the field? */
 270         if (total_in_buf > USHRT_MAX)
 271                 return -EPROTO;
 272         put_unaligned_le16(total_in_buf, &pSMBt->t2_rsp.DataCount);
 273
 274         /* fix up the BCC */
 275         byte_count = get_bcc(pTargetSMB);
 276         byte_count += total_in_buf2;
 277         /* is the result too big for the field? */
 278         if (byte_count > USHRT_MAX)
 279                 return -EPROTO;
 280         put_bcc(byte_count, pTargetSMB);
 281
 282         byte_count = be32_to_cpu(pTargetSMB->smb_buf_length);
 283         byte_count += total_in_buf2;
 284         /* don't allow buffer to overflow */
 285         if (byte_count > CIFSMaxBufSize + MAX_CIFS_HDR_SIZE - 4)
 286                 return -ENOBUFS;
 287         pTargetSMB->smb_buf_length = cpu_to_be32(byte_count);
 288
 289         memcpy(data_area_of_target, data_area_of_buf2, total_in_buf2);
 290
 291         if (remaining == total_in_buf2) {
 292                 cFYI(1, "found the last secondary response");
 293                 return 0; /* we are done */
 294         } else /* more responses to go */
 295                 return 1;
 296 }
 297
 298 static void
 299 cifs_echo_request(struct work_struct *work)
 300 {
 301         int rc;
 302         struct TCP_Server_Info *server = container_of(work,
 303                                         struct TCP_Server_Info, echo.work);
 304
 305         /*
 306          * We cannot send an echo until the NEGOTIATE_PROTOCOL request is
 307          * done, which is indicated by maxBuf != 0. Also, no need to ping if
 308          * we got a response recently
 309          */
 310         if (server->maxBuf == 0 ||
 311             time_before(jiffies, server->lstrp + SMB_ECHO_INTERVAL - HZ))
 312                 goto requeue_echo;
 313
 314         rc = CIFSSMBEcho(server);
 315         if (rc)
 316                 cFYI(1, "Unable to send echo request to server: %s",
 317                         server->hostname);
 318
 319 requeue_echo:
 320         queue_delayed_work(system_nrt_wq, &server->echo, SMB_ECHO_INTERVAL);
 321 }
 322
 323 static bool
 324 allocate_buffers(struct TCP_Server_Info *server)
 325 {
 326         if (!server->bigbuf) {
 327                 server->bigbuf = (char *)cifs_buf_get();
 328                 if (!server->bigbuf) {
 329                         cERROR(1, "No memory for large SMB response");
 330                         msleep(3000);
 331                         /* retry will check if exiting */
 332                         return false;
 333                 }
 334         } else if (server->large_buf) {
 335                 /* we are reusing a dirty large buf, clear its start */
 336                 memset(server->bigbuf, 0, sizeof(struct smb_hdr));
 337         }
 338
 339         if (!server->smallbuf) {
 340                 server->smallbuf = (char *)cifs_small_buf_get();
 341                 if (!server->smallbuf) {
 342                         cERROR(1, "No memory for SMB response");
 343                         msleep(1000);
 344                         /* retry will check if exiting */
 345                         return false;
 346                 }
 347                 /* beginning of smb buffer is cleared in our buf_get */
 348         } else {
 349                 /* if existing small buf clear beginning */
 350                 memset(server->smallbuf, 0, sizeof(struct smb_hdr));
 351         }
 352
 353         return true;
 354 }
 355
 356 static bool
 357 server_unresponsive(struct TCP_Server_Info *server)
 358 {
 359         if (echo_retries > 0 && server->tcpStatus == CifsGood &&
 360             time_after(jiffies, server->lstrp +
 361                                 (echo_retries * SMB_ECHO_INTERVAL))) {
 362                 cERROR(1, "Server %s has not responded in %d seconds. "
 363                           "Reconnecting...", server->hostname,
 364                           (echo_retries * SMB_ECHO_INTERVAL / HZ));
 365                 cifs_reconnect(server);
 366                 wake_up(&server->response_q);
 367                 return true;
 368         }
 369
 370         return false;
 371 }
 372
 373 /*
 374  * kvec_array_init - clone a kvec array, and advance into it
 375  * @new:        pointer to memory for cloned array
 376  * @iov:        pointer to original array
 377  * @nr_segs:    number of members in original array
 378  * @bytes:      number of bytes to advance into the cloned array
 379  *
 380  * This function will copy the array provided in iov to a section of memory
 381  * and advance the specified number of bytes into the new array. It returns
 382  * the number of segments in the new array. "new" must be at least as big as
 383  * the original iov array.
 384  */
 385 static unsigned int
 386 kvec_array_init(struct kvec *new, struct kvec *iov, unsigned int nr_segs,
 387                 size_t bytes)
 388 {
 389         size_t base = 0;
 390
 391         while (bytes || !iov->iov_len) {
 392                 int copy = min(bytes, iov->iov_len);
 393
 394                 bytes -= copy;
 395                 base += copy;
 396                 if (iov->iov_len == base) {
 397                         iov++;
 398                         nr_segs--;
 399                         base = 0;
 400                 }
 401         }
 402         memcpy(new, iov, sizeof(*iov) * nr_segs);
 403         new->iov_base += base;
 404         new->iov_len -= base;
 405         return nr_segs;
 406 }
 407
 408 static struct kvec *
 409 get_server_iovec(struct TCP_Server_Info *server, unsigned int nr_segs)
 410 {
 411         struct kvec *new_iov;
 412
 413         if (server->iov && nr_segs <= server->nr_iov)
 414                 return server->iov;
 415
 416         /* not big enough -- allocate a new one and release the old */
 417         new_iov = kmalloc(sizeof(*new_iov) * nr_segs, GFP_NOFS);
 418         if (new_iov) {
 419                 kfree(server->iov);
 420                 server->iov = new_iov;
 421                 server->nr_iov = nr_segs;
 422         }
 423         return new_iov;
 424 }
 425
 426 int
 427 cifs_readv_from_socket(struct TCP_Server_Info *server, struct kvec *iov_orig,
 428                        unsigned int nr_segs, unsigned int to_read)
 429 {
 430         int length = 0;
 431         int total_read;
 432         unsigned int segs;
 433         struct msghdr smb_msg;
 434         struct kvec *iov;
 435
 436         iov = get_server_iovec(server, nr_segs);
 437         if (!iov)
 438                 return -ENOMEM;
 439
 440         smb_msg.msg_control = NULL;
 441         smb_msg.msg_controllen = 0;
 442
 443         for (total_read = 0; to_read; total_read += length, to_read -= length) {
 444                 try_to_freeze();
 445
 446                 if (server_unresponsive(server)) {
 447                         total_read = -EAGAIN;
 448                         break;
 449                 }
 450
 451                 segs = kvec_array_init(iov, iov_orig, nr_segs, total_read);
 452
 453                 length = kernel_recvmsg(server->ssocket, &smb_msg,
 454                                         iov, segs, to_read, 0);
 455
 456                 if (server->tcpStatus == CifsExiting) {
 457                         total_read = -ESHUTDOWN;
 458                         break;
 459                 } else if (server->tcpStatus == CifsNeedReconnect) {
 460                         cifs_reconnect(server);
 461                         total_read = -EAGAIN;
 462                         break;
 463                 } else if (length == -ERESTARTSYS ||
 464                            length == -EAGAIN ||
 465                            length == -EINTR) {
 466                         /*
 467                          * Minimum sleep to prevent looping, allowing socket
 468                          * to clear and app threads to set tcpStatus
 469                          * CifsNeedReconnect if server hung.
 470                          */
 471                         usleep_range(1000, 2000);
 472                         length = 0;
 473                         continue;
 474                 } else if (length <= 0) {
 475                         cFYI(1, "Received no data or error: expecting %d "
 476                                 "got %d", to_read, length);
 477                         cifs_reconnect(server);
 478                         total_read = -EAGAIN;
 479                         break;
 480                 }
 481         }
 482         return total_read;
 483 }
 484
 485 int
 486 cifs_read_from_socket(struct TCP_Server_Info *server, char *buf,
 487                       unsigned int to_read)
 488 {
 489         struct kvec iov;
 490
 491         iov.iov_base = buf;
 492         iov.iov_len = to_read;
 493
 494         return cifs_readv_from_socket(server, &iov, 1, to_read);
 495 }
 496
 497 static bool
 498 is_smb_response(struct TCP_Server_Info *server, unsigned char type)
 499 {
 500         /*
 501          * The first byte big endian of the length field,
 502          * is actually not part of the length but the type
 503          * with the most common, zero, as regular data.
 504          */
 505         switch (type) {
 506         case RFC1002_SESSION_MESSAGE:
 507                 /* Regular SMB response */
 508                 return true;
 509         case RFC1002_SESSION_KEEP_ALIVE:
 510                 cFYI(1, "RFC 1002 session keep alive");
 511                 break;
 512         case RFC1002_POSITIVE_SESSION_RESPONSE:
 513                 cFYI(1, "RFC 1002 positive session response");
 514                 break;
 515         case RFC1002_NEGATIVE_SESSION_RESPONSE:
 516                 /*
 517                  * We get this from Windows 98 instead of an error on
 518                  * SMB negprot response.
 519                  */
 520                 cFYI(1, "RFC 1002 negative session response");
 521                 /* give server a second to clean up */
 522                 msleep(1000);
 523                 /*
 524                  * Always try 445 first on reconnect since we get NACK
 525                  * on some if we ever connected to port 139 (the NACK
 526                  * is since we do not begin with RFC1001 session
 527                  * initialize frame).
 528                  */
 529                 cifs_set_port((struct sockaddr *)&server->dstaddr, CIFS_PORT);
 530                 cifs_reconnect(server);
 531                 wake_up(&server->response_q);
 532                 break;
 533         default:
 534                 cERROR(1, "RFC 1002 unknown response type 0x%x", type);
 535                 cifs_reconnect(server);
 536         }
 537
 538         return false;
 539 }
 540
 541 static struct mid_q_entry *
 542 find_mid(struct TCP_Server_Info *server, struct smb_hdr *buf)
 543 {
 544         struct mid_q_entry *mid;
 545
 546         spin_lock(&GlobalMid_Lock);
 547         list_for_each_entry(mid, &server->pending_mid_q, qhead) {
 548                 if (mid->mid == buf->Mid &&
 549                     mid->midState == MID_REQUEST_SUBMITTED &&
 550                     mid->command == buf->Command) {
 551                         spin_unlock(&GlobalMid_Lock);
 552                         return mid;
 553                 }
 554         }
 555         spin_unlock(&GlobalMid_Lock);
 556         return NULL;
 557 }
 558
 559 void
 560 dequeue_mid(struct mid_q_entry *mid, bool malformed)
 561 {
 562 #ifdef CONFIG_CIFS_STATS2
 563         mid->when_received = jiffies;
 564 #endif
 565         spin_lock(&GlobalMid_Lock);
 566         if (!malformed)
 567                 mid->midState = MID_RESPONSE_RECEIVED;
 568         else
 569                 mid->midState = MID_RESPONSE_MALFORMED;
 570         list_del_init(&mid->qhead);
 571         spin_unlock(&GlobalMid_Lock);
 572 }
 573
 574 static void
 575 handle_mid(struct mid_q_entry *mid, struct TCP_Server_Info *server,
 576            struct smb_hdr *buf, int malformed)
 577 {
 578         if (malformed == 0 && check2ndT2(buf) > 0) {
 579                 mid->multiRsp = true;
 580                 if (mid->resp_buf) {
 581                         /* merge response - fix up 1st*/
 582                         malformed = coalesce_t2(buf, mid->resp_buf);
 583                         if (malformed > 0)
 584                                 return;
 585
 586                         /* All parts received or packet is malformed. */
 587                         mid->multiEnd = true;
 588                         return dequeue_mid(mid, malformed);
 589                 }
 590                 if (!server->large_buf) {
 591                         /*FIXME: switch to already allocated largebuf?*/
 592                         cERROR(1, "1st trans2 resp needs bigbuf");
 593                 } else {
 594                         /* Have first buffer */
 595                         mid->resp_buf = buf;
 596                         mid->largeBuf = true;
 597                         server->bigbuf = NULL;
 598                 }
 599                 return;
 600         }
 601         mid->resp_buf = buf;
 602         mid->largeBuf = server->large_buf;
 603         /* Was previous buf put in mpx struct for multi-rsp? */
 604         if (!mid->multiRsp) {
 605                 /* smb buffer will be freed by user thread */
 606                 if (server->large_buf)
 607                         server->bigbuf = NULL;
 608                 else
 609                         server->smallbuf = NULL;
 610         }
 611         dequeue_mid(mid, malformed);
 612 }
 613
 614 static void clean_demultiplex_info(struct TCP_Server_Info *server)
 615 {
 616         int length;
 617
 618         /* take it off the list, if it's not already */
 619         spin_lock(&cifs_tcp_ses_lock);
 620         list_del_init(&server->tcp_ses_list);
 621         spin_unlock(&cifs_tcp_ses_lock);
 622
 623         spin_lock(&GlobalMid_Lock);
 624         server->tcpStatus = CifsExiting;
 625         spin_unlock(&GlobalMid_Lock);
 626         wake_up_all(&server->response_q);
 627
 628         /* Check if we have blocked requests that need to free. */
 629         spin_lock(&GlobalMid_Lock);
 630         if (atomic_read(&server->inFlight) >= server->maxReq)
 631                 atomic_set(&server->inFlight, server->maxReq - 1);
 632         /*
 633          * We do not want to set the max_pending too low or we could end up
 634          * with the counter going negative.
 635          */
 636         spin_unlock(&GlobalMid_Lock);
 637         /*
 638          * Although there should not be any requests blocked on this queue it
 639          * can not hurt to be paranoid and try to wake up requests that may
 640          * haven been blocked when more than 50 at time were on the wire to the
 641          * same server - they now will see the session is in exit state and get
 642          * out of SendReceive.
 643          */
 644         wake_up_all(&server->request_q);
 645         /* give those requests time to exit */
 646         msleep(125);
 647
 648         if (server->ssocket) {
 649                 sock_release(server->ssocket);
 650                 server->ssocket = NULL;
 651         }
 652
 653         if (!list_empty(&server->pending_mid_q)) {
 654                 struct list_head dispose_list;
 655                 struct mid_q_entry *mid_entry;
 656                 struct list_head *tmp, *tmp2;
 657
 658                 INIT_LIST_HEAD(&dispose_list);
 659                 spin_lock(&GlobalMid_Lock);
 660                 list_for_each_safe(tmp, tmp2, &server->pending_mid_q) {
 661                         mid_entry = list_entry(tmp, struct mid_q_entry, qhead);
 662                         cFYI(1, "Clearing mid 0x%x", mid_entry->mid);
 663                         mid_entry->midState = MID_SHUTDOWN;
 664                         list_move(&mid_entry->qhead, &dispose_list);
 665                 }
 666                 spin_unlock(&GlobalMid_Lock);
 667
 668                 /* now walk dispose list and issue callbacks */
 669                 list_for_each_safe(tmp, tmp2, &dispose_list) {
 670                         mid_entry = list_entry(tmp, struct mid_q_entry, qhead);
 671                         cFYI(1, "Callback mid 0x%x", mid_entry->mid);
 672                         list_del_init(&mid_entry->qhead);
 673                         mid_entry->callback(mid_entry);
 674                 }
 675                 /* 1/8th of sec is more than enough time for them to exit */
 676                 msleep(125);
 677         }
 678
 679         if (!list_empty(&server->pending_mid_q)) {
 680                 /*
 681                  * mpx threads have not exited yet give them at least the smb
 682                  * send timeout time for long ops.
 683                  *
 684                  * Due to delays on oplock break requests, we need to wait at
 685                  * least 45 seconds before giving up on a request getting a
 686                  * response and going ahead and killing cifsd.
 687                  */
 688                 cFYI(1, "Wait for exit from demultiplex thread");
 689                 msleep(46000);
 690                 /*
 691                  * If threads still have not exited they are probably never
 692                  * coming home not much else we can do but free the memory.
 693                  */
 694         }
 695
 696         kfree(server->hostname);
 697         kfree(server->iov);
 698         kfree(server);
 699
 700         length = atomic_dec_return(&tcpSesAllocCount);
 701         if (length > 0)
 702                 mempool_resize(cifs_req_poolp, length + cifs_min_rcv,
 703                                 GFP_KERNEL);
 704 }
 705
 706 static int
 707 standard_receive3(struct TCP_Server_Info *server, struct mid_q_entry *mid)
 708 {
 709         int length;
 710         char *buf = server->smallbuf;
 711         struct smb_hdr *smb_buffer = (struct smb_hdr *)buf;
 712         unsigned int pdu_length = be32_to_cpu(smb_buffer->smb_buf_length);
 713
 714         /* make sure this will fit in a large buffer */
 715         if (pdu_length > CIFSMaxBufSize + MAX_CIFS_HDR_SIZE - 4) {
 716                 cERROR(1, "SMB response too long (%u bytes)",
 717                         pdu_length);
 718                 cifs_reconnect(server);
 719                 wake_up(&server->response_q);
 720                 return -EAGAIN;
 721         }
 722
 723         /* switch to large buffer if too big for a small one */
 724         if (pdu_length > MAX_CIFS_SMALL_BUFFER_SIZE - 4) {
 725                 server->large_buf = true;
 726                 memcpy(server->bigbuf, server->smallbuf, server->total_read);
 727                 buf = server->bigbuf;
 728                 smb_buffer = (struct smb_hdr *)buf;
 729         }
 730
 731         /* now read the rest */
 732         length = cifs_read_from_socket(server,
 733                           buf + sizeof(struct smb_hdr) - 1,
 734                           pdu_length - sizeof(struct smb_hdr) + 1 + 4);
 735         if (length < 0)
 736                 return length;
 737         server->total_read += length;
 738
 739         dump_smb(smb_buffer, server->total_read);
 740
 741         /*
 742          * We know that we received enough to get to the MID as we
 743          * checked the pdu_length earlier. Now check to see
 744          * if the rest of the header is OK. We borrow the length
 745          * var for the rest of the loop to avoid a new stack var.
 746          *
 747          * 48 bytes is enough to display the header and a little bit
 748          * into the payload for debugging purposes.
 749          */
 750         length = checkSMB(smb_buffer, smb_buffer->Mid, server->total_read);
 751         if (length != 0)
 752                 cifs_dump_mem("Bad SMB: ", buf,
 753                         min_t(unsigned int, server->total_read, 48));
 754
 755         if (!mid)
 756                 return length;
 757
 758         handle_mid(mid, server, smb_buffer, length);
 759         return 0;
 760 }
 761
 762 static int
 763 cifs_demultiplex_thread(void *p)
 764 {
 765         int length;
 766         struct TCP_Server_Info *server = p;
 767         unsigned int pdu_length;
 768         char *buf = NULL;
 769         struct smb_hdr *smb_buffer = NULL;
 770         struct task_struct *task_to_wake = NULL;
 771         struct mid_q_entry *mid_entry;
 772
 773         current->flags |= PF_MEMALLOC;
 774         cFYI(1, "Demultiplex PID: %d", task_pid_nr(current));
 775
 776         length = atomic_inc_return(&tcpSesAllocCount);
 777         if (length > 1)
 778                 mempool_resize(cifs_req_poolp, length + cifs_min_rcv,
 779                                 GFP_KERNEL);
 780
 781         set_freezable();
 782         while (server->tcpStatus != CifsExiting) {
 783                 if (try_to_freeze())
 784                         continue;
 785
 786                 if (!allocate_buffers(server))
 787                         continue;
 788
 789                 server->large_buf = false;
 790                 smb_buffer = (struct smb_hdr *)server->smallbuf;
 791                 buf = server->smallbuf;
 792                 pdu_length = 4; /* enough to get RFC1001 header */
 793
 794                 length = cifs_read_from_socket(server, buf, pdu_length);
 795                 if (length < 0)
 796                         continue;
 797                 server->total_read = length;
 798
 799                 /*
 800                  * The right amount was read from socket - 4 bytes,
 801                  * so we can now interpret the length field.
 802                  */
 803                 pdu_length = be32_to_cpu(smb_buffer->smb_buf_length);
 804
 805                 cFYI(1, "RFC1002 header 0x%x", pdu_length);
 806                 if (!is_smb_response(server, buf[0]))
 807                         continue;
 808
 809                 /* make sure we have enough to get to the MID */
 810                 if (pdu_length < sizeof(struct smb_hdr) - 1 - 4) {
 811                         cERROR(1, "SMB response too short (%u bytes)",
 812                                 pdu_length);
 813                         cifs_reconnect(server);
 814                         wake_up(&server->response_q);
 815                         continue;
 816                 }
 817
 818                 /* read down to the MID */
 819                 length = cifs_read_from_socket(server, buf + 4,
 820                                         sizeof(struct smb_hdr) - 1 - 4);
 821                 if (length < 0)
 822                         continue;
 823                 server->total_read += length;
 824
 825                 mid_entry = find_mid(server, smb_buffer);
 826
 827                 if (!mid_entry || !mid_entry->receive)
 828                         length = standard_receive3(server, mid_entry);
 829                 else
 830                         length = mid_entry->receive(server, mid_entry);
 831
 832                 if (length < 0)
 833                         continue;
 834
 835                 if (server->large_buf) {
 836                         buf = server->bigbuf;
 837                         smb_buffer = (struct smb_hdr *)buf;
 838                 }
 839
 840                 server->lstrp = jiffies;
 841                 if (mid_entry != NULL) {
 842                         if (!mid_entry->multiRsp || mid_entry->multiEnd)
 843                                 mid_entry->callback(mid_entry);
 844                 } else if (!is_valid_oplock_break(smb_buffer, server)) {
 845                         cERROR(1, "No task to wake, unknown frame received! "
 846                                    "NumMids %d", atomic_read(&midCount));
 847                         cifs_dump_mem("Received Data is: ", buf,
 848                                       sizeof(struct smb_hdr));
 849 #ifdef CONFIG_CIFS_DEBUG2
 850                         cifs_dump_detail(smb_buffer);
 851                         cifs_dump_mids(server);
 852 #endif /* CIFS_DEBUG2 */
 853
 854                 }
 855         } /* end while !EXITING */
 856
 857         /* buffer usually freed in free_mid - need to free it here on exit */
 858         cifs_buf_release(server->bigbuf);
 859         if (server->smallbuf) /* no sense logging a debug message if NULL */
 860                 cifs_small_buf_release(server->smallbuf);
 861
 862         task_to_wake = xchg(&server->tsk, NULL);
 863         clean_demultiplex_info(server);
 864
 865         /* if server->tsk was NULL then wait for a signal before exiting */
 866         if (!task_to_wake) {
 867                 set_current_state(TASK_INTERRUPTIBLE);
 868                 while (!signal_pending(current)) {
 869                         schedule();
 870                         set_current_state(TASK_INTERRUPTIBLE);
 871                 }
 872                 set_current_state(TASK_RUNNING);
 873         }
 874
 875         module_put_and_exit(0);
 876 }
 877
 878 /* extract the host portion of the UNC string */
 879 static char *
 880 extract_hostname(const char *unc)
 881 {
 882         const char *src;
 883         char *dst, *delim;
 884         unsigned int len;
 885
 886         /* skip double chars at beginning of string */
 887         /* BB: check validity of these bytes? */
 888         src = unc + 2;
 889
 890         /* delimiter between hostname and sharename is always '\\' now */
 891         delim = strchr(src, '\\');
 892         if (!delim)
 893                 return ERR_PTR(-EINVAL);
 894
 895         len = delim - src;
 896         dst = kmalloc((len + 1), GFP_KERNEL);
 897         if (dst == NULL)
 898                 return ERR_PTR(-ENOMEM);
 899
 900         memcpy(dst, src, len);
 901         dst[len] = '\0';
 902
 903         return dst;
 904 }
 905
 906 static int
 907 cifs_parse_mount_options(const char *mountdata, const char *devname,
 908                          struct smb_vol *vol)
 909 {
 910         char *value, *data, *end;
 911         char *mountdata_copy = NULL, *options;
 912         int err;
 913         unsigned int  temp_len, i, j;
 914         char separator[2];
 915         short int override_uid = -1;
 916         short int override_gid = -1;
 917         bool uid_specified = false;
 918         bool gid_specified = false;
 919         char *nodename = utsname()->nodename;
 920
 921         separator[0] = ',';
 922         separator[1] = 0;
 923
 924         /*
 925          * does not have to be perfect mapping since field is
 926          * informational, only used for servers that do not support
 927          * port 445 and it can be overridden at mount time
 928          */
 929         memset(vol->source_rfc1001_name, 0x20, RFC1001_NAME_LEN);
 930         for (i = 0; i < strnlen(nodename, RFC1001_NAME_LEN); i++)
 931                 vol->source_rfc1001_name[i] = toupper(nodename[i]);
 932
 933         vol->source_rfc1001_name[RFC1001_NAME_LEN] = 0;
 934         /* null target name indicates to use *SMBSERVR default called name
 935            if we end up sending RFC1001 session initialize */
 936         vol->target_rfc1001_name[0] = 0;
 937         vol->cred_uid = current_uid();
 938         vol->linux_uid = current_uid();
 939         vol->linux_gid = current_gid();
 940
 941         /* default to only allowing write access to owner of the mount */
 942         vol->dir_mode = vol->file_mode = S_IRUGO | S_IXUGO | S_IWUSR;
 943
 944         /* vol->retry default is 0 (i.e. "soft" limited retry not hard retry) */
 945         /* default is always to request posix paths. */
 946         vol->posix_paths = 1;
 947         /* default to using server inode numbers where available */
 948         vol->server_ino = 1;
 949
 950         vol->actimeo = CIFS_DEF_ACTIMEO;
 951
 952         if (!mountdata)
 953                 goto cifs_parse_mount_err;
 954
 955         mountdata_copy = kstrndup(mountdata, PAGE_SIZE, GFP_KERNEL);
 956         if (!mountdata_copy)
 957                 goto cifs_parse_mount_err;
 958
 959         options = mountdata_copy;
 960         end = options + strlen(options);
 961         if (strncmp(options, "sep=", 4) == 0) {
 962                 if (options[4] != 0) {
 963                         separator[0] = options[4];
 964                         options += 5;
 965                 } else {
 966                         cFYI(1, "Null separator not allowed");
 967                 }
 968         }
 969         vol->backupuid_specified = false; /* no backup intent for a user */
 970         vol->backupgid_specified = false; /* no backup intent for a group */
 971
 972         while ((data = strsep(&options, separator)) != NULL) {
 973                 if (!*data)
 974                         continue;
 975                 if ((value = strchr(data, '=')) != NULL)
 976                         *value++ = '\0';
 977
 978                 /* Have to parse this before we parse for "user" */
 979                 if (strnicmp(data, "user_xattr", 10) == 0) {
 980                         vol->no_xattr = 0;
 981                 } else if (strnicmp(data, "nouser_xattr", 12) == 0) {
 982                         vol->no_xattr = 1;
 983                 } else if (strnicmp(data, "user", 4) == 0) {
 984                         if (!value) {
 985                                 printk(KERN_WARNING
 986                                        "CIFS: invalid or missing username\n");
 987                                 goto cifs_parse_mount_err;
 988                         } else if (!*value) {
 989                                 /* null user, ie anonymous, authentication */
 990                                 vol->nullauth = 1;
 991                         }
 992                         if (strnlen(value, MAX_USERNAME_SIZE) <
 993                                                 MAX_USERNAME_SIZE) {
 994                                 vol->username = kstrdup(value, GFP_KERNEL);
 995                                 if (!vol->username) {
 996                                         printk(KERN_WARNING "CIFS: no memory "
 997                                                             "for username\n");
 998                                         goto cifs_parse_mount_err;
 999                                 }
1000                         } else {
1001                                 printk(KERN_WARNING "CIFS: username too long\n");
1002                                 goto cifs_parse_mount_err;
1003                         }
1004                 } else if (strnicmp(data, "pass", 4) == 0) {
1005                         if (!value) {
1006                                 vol->password = NULL;
1007                                 continue;
1008                         } else if (value[0] == 0) {
1009                                 /* check if string begins with double comma
1010                                    since that would mean the password really
1011                                    does start with a comma, and would not
1012                                    indicate an empty string */
1013                                 if (value[1] != separator[0]) {
1014                                         vol->password = NULL;
1015                                         continue;
1016                                 }
1017                         }
1018                         temp_len = strlen(value);
1019                         /* removed password length check, NTLM passwords
1020                                 can be arbitrarily long */
1021
1022                         /* if comma in password, the string will be
1023                         prematurely null terminated.  Commas in password are
1024                         specified across the cifs mount interface by a double
1025                         comma ie ,, and a comma used as in other cases ie ','
1026                         as a parameter delimiter/separator is single and due
1027                         to the strsep above is temporarily zeroed. */
1028
1029                         /* NB: password legally can have multiple commas and
1030                         the only illegal character in a password is null */
1031
1032                         if ((value[temp_len] == 0) &&
1033                             (value + temp_len < end) &&
1034                             (value[temp_len+1] == separator[0])) {
1035                                 /* reinsert comma */
1036                                 value[temp_len] = separator[0];
1037                                 temp_len += 2;  /* move after second comma */
1038                                 while (value[temp_len] != 0)  {
1039                                         if (value[temp_len] == separator[0]) {
1040                                                 if (value[temp_len+1] ==
1041                                                      separator[0]) {
1042                                                 /* skip second comma */
1043                                                         temp_len++;
1044                                                 } else {
1045                                                 /* single comma indicating start
1046                                                          of next parm */
1047                                                         break;
1048                                                 }
1049                                         }
1050                                         temp_len++;
1051                                 }
1052                                 if (value[temp_len] == 0) {
1053                                         options = NULL;
1054                                 } else {
1055                                         value[temp_len] = 0;
1056                                         /* point option to start of next parm */
1057                                         options = value + temp_len + 1;
1058                                 }
1059                                 /* go from value to value + temp_len condensing
1060                                 double commas to singles. Note that this ends up
1061                                 allocating a few bytes too many, which is ok */
1062                                 vol->password = kzalloc(temp_len, GFP_KERNEL);
1063                                 if (vol->password == NULL) {
1064                                         printk(KERN_WARNING "CIFS: no memory "
1065                                                             "for password\n");
1066                                         goto cifs_parse_mount_err;
1067                                 }
1068                                 for (i = 0, j = 0; i < temp_len; i++, j++) {
1069                                         vol->password[j] = value[i];
1070                                         if (value[i] == separator[0]
1071                                                 && value[i+1] == separator[0]) {
1072                                                 /* skip second comma */
1073                                                 i++;
1074                                         }
1075                                 }
1076                                 vol->password[j] = 0;
1077                         } else {
1078                                 vol->password = kzalloc(temp_len+1, GFP_KERNEL);
1079                                 if (vol->password == NULL) {
1080                                         printk(KERN_WARNING "CIFS: no memory "
1081                                                             "for password\n");
1082                                         goto cifs_parse_mount_err;
1083                                 }
1084                                 strcpy(vol->password, value);
1085                         }
1086                 } else if (!strnicmp(data, "ip", 2) ||
1087                            !strnicmp(data, "addr", 4)) {
1088                         if (!value || !*value) {
1089                                 vol->UNCip = NULL;
1090                         } else if (strnlen(value, INET6_ADDRSTRLEN) <
1091                                                         INET6_ADDRSTRLEN) {
1092                                 vol->UNCip = kstrdup(value, GFP_KERNEL);
1093                                 if (!vol->UNCip) {
1094                                         printk(KERN_WARNING "CIFS: no memory "
1095                                                             "for UNC IP\n");
1096                                         goto cifs_parse_mount_err;
1097                                 }
1098                         } else {
1099                                 printk(KERN_WARNING "CIFS: ip address "
1100                                                     "too long\n");
1101                                 goto cifs_parse_mount_err;
1102                         }
1103                 } else if (strnicmp(data, "sec", 3) == 0) {
1104                         if (!value || !*value) {
1105                                 cERROR(1, "no security value specified");
1106                                 continue;
1107                         } else if (strnicmp(value, "krb5i", 5) == 0) {
1108                                 vol->secFlg |= CIFSSEC_MAY_KRB5 |
1109                                         CIFSSEC_MUST_SIGN;
1110                         } else if (strnicmp(value, "krb5p", 5) == 0) {
1111                                 /* vol->secFlg |= CIFSSEC_MUST_SEAL |
1112                                         CIFSSEC_MAY_KRB5; */
1113                                 cERROR(1, "Krb5 cifs privacy not supported");
1114                                 goto cifs_parse_mount_err;
1115                         } else if (strnicmp(value, "krb5", 4) == 0) {
1116                                 vol->secFlg |= CIFSSEC_MAY_KRB5;
1117                         } else if (strnicmp(value, "ntlmsspi", 8) == 0) {
1118                                 vol->secFlg |= CIFSSEC_MAY_NTLMSSP |
1119                                         CIFSSEC_MUST_SIGN;
1120                         } else if (strnicmp(value, "ntlmssp", 7) == 0) {
1121                                 vol->secFlg |= CIFSSEC_MAY_NTLMSSP;
1122                         } else if (strnicmp(value, "ntlmv2i", 7) == 0) {
1123                                 vol->secFlg |= CIFSSEC_MAY_NTLMV2 |
1124                                         CIFSSEC_MUST_SIGN;
1125                         } else if (strnicmp(value, "ntlmv2", 6) == 0) {
1126                                 vol->secFlg |= CIFSSEC_MAY_NTLMV2;
1127                         } else if (strnicmp(value, "ntlmi", 5) == 0) {
1128                                 vol->secFlg |= CIFSSEC_MAY_NTLM |
1129                                         CIFSSEC_MUST_SIGN;
1130                         } else if (strnicmp(value, "ntlm", 4) == 0) {
1131                                 /* ntlm is default so can be turned off too */
1132                                 vol->secFlg |= CIFSSEC_MAY_NTLM;
1133                         } else if (strnicmp(value, "nontlm", 6) == 0) {
1134                                 /* BB is there a better way to do this? */
1135                                 vol->secFlg |= CIFSSEC_MAY_NTLMV2;
1136 #ifdef CONFIG_CIFS_WEAK_PW_HASH
1137                         } else if (strnicmp(value, "lanman", 6) == 0) {
1138                                 vol->secFlg |= CIFSSEC_MAY_LANMAN;
1139 #endif
1140                         } else if (strnicmp(value, "none", 4) == 0) {
1141                                 vol->nullauth = 1;
1142                         } else {
1143                                 cERROR(1, "bad security option: %s", value);
1144                                 goto cifs_parse_mount_err;
1145                         }
1146                 } else if (strnicmp(data, "vers", 3) == 0) {
1147                         if (!value || !*value) {
1148                                 cERROR(1, "no protocol version specified"
1149                                           " after vers= mount option");
1150                         } else if ((strnicmp(value, "cifs", 4) == 0) ||
1151                                    (strnicmp(value, "1", 1) == 0)) {
1152                                 /* this is the default */
1153                                 continue;
1154                         }
1155                 } else if ((strnicmp(data, "unc", 3) == 0)
1156                            || (strnicmp(data, "target", 6) == 0)
1157                            || (strnicmp(data, "path", 4) == 0)) {
1158                         if (!value || !*value) {
1159                                 printk(KERN_WARNING "CIFS: invalid path to "
1160                                                     "network resource\n");
1161                                 goto cifs_parse_mount_err;
1162                         }
1163                         if ((temp_len = strnlen(value, 300)) < 300) {
1164                                 vol->UNC = kmalloc(temp_len+1, GFP_KERNEL);
1165                                 if (vol->UNC == NULL)
1166                                         goto cifs_parse_mount_err;
1167                                 strcpy(vol->UNC, value);
1168                                 if (strncmp(vol->UNC, "//", 2) == 0) {
1169                                         vol->UNC[0] = '\\';
1170                                         vol->UNC[1] = '\\';
1171                                 } else if (strncmp(vol->UNC, "\\\\", 2) != 0) {
1172                                         printk(KERN_WARNING
1173                                                "CIFS: UNC Path does not begin "
1174                                                "with // or \\\\ \n");
1175                                         goto cifs_parse_mount_err;
1176                                 }
1177                         } else {
1178                                 printk(KERN_WARNING "CIFS: UNC name too long\n");
1179                                 goto cifs_parse_mount_err;
1180                         }
1181                 } else if ((strnicmp(data, "domain", 3) == 0)
1182                            || (strnicmp(data, "workgroup", 5) == 0)) {
1183                         if (!value || !*value) {
1184                                 printk(KERN_WARNING "CIFS: invalid domain name\n");
1185                                 goto cifs_parse_mount_err;
1186                         }
1187                         /* BB are there cases in which a comma can be valid in
1188                         a domain name and need special handling? */
1189                         if (strnlen(value, 256) < 256) {
1190                                 vol->domainname = kstrdup(value, GFP_KERNEL);
1191                                 if (!vol->domainname) {
1192                                         printk(KERN_WARNING "CIFS: no memory "
1193                                                             "for domainname\n");
1194                                         goto cifs_parse_mount_err;
1195                                 }
1196                                 cFYI(1, "Domain name set");
1197                         } else {
1198                                 printk(KERN_WARNING "CIFS: domain name too "
1199                                                     "long\n");
1200                                 goto cifs_parse_mount_err;
1201                         }
1202                 } else if (strnicmp(data, "srcaddr", 7) == 0) {
1203                         vol->srcaddr.ss_family = AF_UNSPEC;
1204
1205                         if (!value || !*value) {
1206                                 printk(KERN_WARNING "CIFS: srcaddr value"
1207                                        " not specified.\n");
1208                                 goto cifs_parse_mount_err;
1209                         }
1210                         i = cifs_convert_address((struct sockaddr *)&vol->srcaddr,
1211                                                  value, strlen(value));
1212                         if (i == 0) {
1213                                 printk(KERN_WARNING "CIFS:  Could not parse"
1214                                        " srcaddr: %s\n",
1215                                        value);
1216                                 goto cifs_parse_mount_err;
1217                         }
1218                 } else if (strnicmp(data, "prefixpath", 10) == 0) {
1219                         if (!value || !*value) {
1220                                 printk(KERN_WARNING
1221                                         "CIFS: invalid path prefix\n");
1222                                 goto cifs_parse_mount_err;
1223                         }
1224                         if ((temp_len = strnlen(value, 1024)) < 1024) {
1225                                 if (value[0] != '/')
1226                                         temp_len++;  /* missing leading slash */
1227                                 vol->prepath = kmalloc(temp_len+1, GFP_KERNEL);
1228                                 if (vol->prepath == NULL)
1229                                         goto cifs_parse_mount_err;
1230                                 if (value[0] != '/') {
1231                                         vol->prepath[0] = '/';
1232                                         strcpy(vol->prepath+1, value);
1233                                 } else
1234                                         strcpy(vol->prepath, value);
1235                                 cFYI(1, "prefix path %s", vol->prepath);
1236                         } else {
1237                                 printk(KERN_WARNING "CIFS: prefix too long\n");
1238                                 goto cifs_parse_mount_err;
1239                         }
1240                 } else if (strnicmp(data, "iocharset", 9) == 0) {
1241                         if (!value || !*value) {
1242                                 printk(KERN_WARNING "CIFS: invalid iocharset "
1243                                                     "specified\n");
1244                                 goto cifs_parse_mount_err;
1245                         }
1246                         if (strnlen(value, 65) < 65) {
1247                                 if (strnicmp(value, "default", 7)) {
1248                                         vol->iocharset = kstrdup(value,
1249                                                                  GFP_KERNEL);
1250
1251                                         if (!vol->iocharset) {
1252                                                 printk(KERN_WARNING "CIFS: no "
1253                                                                    "memory for"
1254                                                                    "charset\n");
1255                                                 goto cifs_parse_mount_err;
1256                                         }
1257                                 }
1258                                 /* if iocharset not set then load_nls_default
1259                                    is used by caller */
1260                                 cFYI(1, "iocharset set to %s", value);
1261                         } else {
1262                                 printk(KERN_WARNING "CIFS: iocharset name "
1263                                                     "too long.\n");
1264                                 goto cifs_parse_mount_err;
1265                         }
1266                 } else if (!strnicmp(data, "uid", 3) && value && *value) {
1267                         vol->linux_uid = simple_strtoul(value, &value, 0);
1268                         uid_specified = true;
1269                 } else if (!strnicmp(data, "cruid", 5) && value && *value) {
1270                         vol->cred_uid = simple_strtoul(value, &value, 0);
1271                 } else if (!strnicmp(data, "forceuid", 8)) {
1272                         override_uid = 1;
1273                 } else if (!strnicmp(data, "noforceuid", 10)) {
1274                         override_uid = 0;
1275                 } else if (!strnicmp(data, "gid", 3) && value && *value) {
1276                         vol->linux_gid = simple_strtoul(value, &value, 0);
1277                         gid_specified = true;
1278                 } else if (!strnicmp(data, "forcegid", 8)) {
1279                         override_gid = 1;
1280                 } else if (!strnicmp(data, "noforcegid", 10)) {
1281                         override_gid = 0;
1282                 } else if (strnicmp(data, "file_mode", 4) == 0) {
1283                         if (value && *value) {
1284                                 vol->file_mode =
1285                                         simple_strtoul(value, &value, 0);
1286                         }
1287                 } else if (strnicmp(data, "dir_mode", 4) == 0) {
1288                         if (value && *value) {
1289                                 vol->dir_mode =
1290                                         simple_strtoul(value, &value, 0);
1291                         }
1292                 } else if (strnicmp(data, "dirmode", 4) == 0) {
1293                         if (value && *value) {
1294                                 vol->dir_mode =
1295                                         simple_strtoul(value, &value, 0);
1296                         }
1297                 } else if (strnicmp(data, "port", 4) == 0) {
1298                         if (value && *value) {
1299                                 vol->port =
1300                                         simple_strtoul(value, &value, 0);
1301                         }
1302                 } else if (strnicmp(data, "rsize", 5) == 0) {
1303                         if (value && *value) {
1304                                 vol->rsize =
1305                                         simple_strtoul(value, &value, 0);
1306                         }
1307                 } else if (strnicmp(data, "wsize", 5) == 0) {
1308                         if (value && *value) {
1309                                 vol->wsize =
1310                                         simple_strtoul(value, &value, 0);
1311                         }
1312                 } else if (strnicmp(data, "sockopt", 5) == 0) {
1313                         if (!value || !*value) {
1314                                 cERROR(1, "no socket option specified");
1315                                 continue;
1316                         } else if (strnicmp(value, "TCP_NODELAY", 11) == 0) {
1317                                 vol->sockopt_tcp_nodelay = 1;
1318                         }
1319                 } else if (strnicmp(data, "netbiosname", 4) == 0) {
1320                         if (!value || !*value || (*value == ' ')) {
1321                                 cFYI(1, "invalid (empty) netbiosname");
1322                         } else {
1323                                 memset(vol->source_rfc1001_name, 0x20,
1324                                         RFC1001_NAME_LEN);
1325                                 /*
1326                                  * FIXME: are there cases in which a comma can
1327                                  * be valid in workstation netbios name (and
1328                                  * need special handling)?
1329                                  */
1330                                 for (i = 0; i < RFC1001_NAME_LEN; i++) {
1331                                         /* don't ucase netbiosname for user */
1332                                         if (value[i] == 0)
1333                                                 break;
1334                                         vol->source_rfc1001_name[i] = value[i];
1335                                 }
1336                                 /* The string has 16th byte zero still from
1337                                 set at top of the function  */
1338                                 if (i == RFC1001_NAME_LEN && value[i] != 0)
1339                                         printk(KERN_WARNING "CIFS: netbiosname"
1340                                                 " longer than 15 truncated.\n");
1341                         }
1342                 } else if (strnicmp(data, "servern", 7) == 0) {
1343                         /* servernetbiosname specified override *SMBSERVER */
1344                         if (!value || !*value || (*value == ' ')) {
1345                                 cFYI(1, "empty server netbiosname specified");
1346                         } else {
1347                                 /* last byte, type, is 0x20 for servr type */
1348                                 memset(vol->target_rfc1001_name, 0x20,
1349                                         RFC1001_NAME_LEN_WITH_NULL);
1350
1351                                 for (i = 0; i < 15; i++) {
1352                                 /* BB are there cases in which a comma can be
1353                                    valid in this workstation netbios name
1354                                    (and need special handling)? */
1355
1356                                 /* user or mount helper must uppercase
1357                                    the netbiosname */
1358                                         if (value[i] == 0)
1359                                                 break;
1360                                         else
1361                                                 vol->target_rfc1001_name[i] =
1362                                                                 value[i];
1363                                 }
1364                                 /* The string has 16th byte zero still from
1365                                    set at top of the function  */
1366                                 if (i == RFC1001_NAME_LEN && value[i] != 0)
1367                                         printk(KERN_WARNING "CIFS: server net"
1368                                         "biosname longer than 15 truncated.\n");
1369                         }
1370                 } else if (strnicmp(data, "actimeo", 7) == 0) {
1371                         if (value && *value) {
1372                                 vol->actimeo = HZ * simple_strtoul(value,
1373                                                                    &value, 0);
1374                                 if (vol->actimeo > CIFS_MAX_ACTIMEO) {
1375                                         cERROR(1, "CIFS: attribute cache"
1376                                                         "timeout too large");
1377                                         goto cifs_parse_mount_err;
1378                                 }
1379                         }
1380                 } else if (strnicmp(data, "credentials", 4) == 0) {
1381                         /* ignore */
1382                 } else if (strnicmp(data, "version", 3) == 0) {
1383                         /* ignore */
1384                 } else if (strnicmp(data, "guest", 5) == 0) {
1385                         /* ignore */
1386                 } else if (strnicmp(data, "rw", 2) == 0 && strlen(data) == 2) {
1387                         /* ignore */
1388                 } else if (strnicmp(data, "ro", 2) == 0) {
1389                         /* ignore */
1390                 } else if (strnicmp(data, "noblocksend", 11) == 0) {
1391                         vol->noblocksnd = 1;
1392                 } else if (strnicmp(data, "noautotune", 10) == 0) {
1393                         vol->noautotune = 1;
1394                 } else if ((strnicmp(data, "suid", 4) == 0) ||
1395                                    (strnicmp(data, "nosuid", 6) == 0) ||
1396                                    (strnicmp(data, "exec", 4) == 0) ||
1397                                    (strnicmp(data, "noexec", 6) == 0) ||
1398                                    (strnicmp(data, "nodev", 5) == 0) ||
1399                                    (strnicmp(data, "noauto", 6) == 0) ||
1400                                    (strnicmp(data, "dev", 3) == 0)) {
1401                         /*  The mount tool or mount.cifs helper (if present)
1402                             uses these opts to set flags, and the flags are read
1403                             by the kernel vfs layer before we get here (ie
1404                             before read super) so there is no point trying to
1405                             parse these options again and set anything and it
1406                             is ok to just ignore them */
1407                         continue;
1408                 } else if (strnicmp(data, "hard", 4) == 0) {
1409                         vol->retry = 1;
1410                 } else if (strnicmp(data, "soft", 4) == 0) {
1411                         vol->retry = 0;
1412                 } else if (strnicmp(data, "perm", 4) == 0) {
1413                         vol->noperm = 0;
1414                 } else if (strnicmp(data, "noperm", 6) == 0) {
1415                         vol->noperm = 1;
1416                 } else if (strnicmp(data, "mapchars", 8) == 0) {
1417                         vol->remap = 1;
1418                 } else if (strnicmp(data, "nomapchars", 10) == 0) {
1419                         vol->remap = 0;
1420                 } else if (strnicmp(data, "sfu", 3) == 0) {
1421                         vol->sfu_emul = 1;
1422                 } else if (strnicmp(data, "nosfu", 5) == 0) {
1423                         vol->sfu_emul = 0;
1424                 } else if (strnicmp(data, "nodfs", 5) == 0) {
1425                         vol->nodfs = 1;
1426                 } else if (strnicmp(data, "posixpaths", 10) == 0) {
1427                         vol->posix_paths = 1;
1428                 } else if (strnicmp(data, "noposixpaths", 12) == 0) {
1429                         vol->posix_paths = 0;
1430                 } else if (strnicmp(data, "nounix", 6) == 0) {
1431                         vol->no_linux_ext = 1;
1432                 } else if (strnicmp(data, "nolinux", 7) == 0) {
1433                         vol->no_linux_ext = 1;
1434                 } else if ((strnicmp(data, "nocase", 6) == 0) ||
1435                            (strnicmp(data, "ignorecase", 10)  == 0)) {
1436                         vol->nocase = 1;
1437                 } else if (strnicmp(data, "mand", 4) == 0) {
1438                         /* ignore */
1439                 } else if (strnicmp(data, "nomand", 6) == 0) {
1440                         /* ignore */
1441                 } else if (strnicmp(data, "_netdev", 7) == 0) {
1442                         /* ignore */
1443                 } else if (strnicmp(data, "brl", 3) == 0) {
1444                         vol->nobrl =  0;
1445                 } else if ((strnicmp(data, "nobrl", 5) == 0) ||
1446                            (strnicmp(data, "nolock", 6) == 0)) {
1447                         vol->nobrl =  1;
1448                         /* turn off mandatory locking in mode
1449                         if remote locking is turned off since the
1450                         local vfs will do advisory */
1451                         if (vol->file_mode ==
1452                                 (S_IALLUGO & ~(S_ISUID | S_IXGRP)))
1453                                 vol->file_mode = S_IALLUGO;
1454                 } else if (strnicmp(data, "forcemandatorylock", 9) == 0) {
1455                         /* will take the shorter form "forcemand" as well */
1456                         /* This mount option will force use of mandatory
1457                           (DOS/Windows style) byte range locks, instead of
1458                           using posix advisory byte range locks, even if the
1459                           Unix extensions are available and posix locks would
1460                           be supported otherwise. If Unix extensions are not
1461                           negotiated this has no effect since mandatory locks
1462                           would be used (mandatory locks is all that those
1463                           those servers support) */
1464                         vol->mand_lock = 1;
1465                 } else if (strnicmp(data, "setuids", 7) == 0) {
1466                         vol->setuids = 1;
1467                 } else if (strnicmp(data, "nosetuids", 9) == 0) {
1468                         vol->setuids = 0;
1469                 } else if (strnicmp(data, "dynperm", 7) == 0) {
1470                         vol->dynperm = true;
1471                 } else if (strnicmp(data, "nodynperm", 9) == 0) {
1472                         vol->dynperm = false;
1473                 } else if (strnicmp(data, "nohard", 6) == 0) {
1474                         vol->retry = 0;
1475                 } else if (strnicmp(data, "nosoft", 6) == 0) {
1476                         vol->retry = 1;
1477                 } else if (strnicmp(data, "nointr", 6) == 0) {
1478                         vol->intr = 0;
1479                 } else if (strnicmp(data, "intr", 4) == 0) {
1480                         vol->intr = 1;
1481                 } else if (strnicmp(data, "nostrictsync", 12) == 0) {
1482                         vol->nostrictsync = 1;
1483                 } else if (strnicmp(data, "strictsync", 10) == 0) {
1484                         vol->nostrictsync = 0;
1485                 } else if (strnicmp(data, "serverino", 7) == 0) {
1486                         vol->server_ino = 1;
1487                 } else if (strnicmp(data, "noserverino", 9) == 0) {
1488                         vol->server_ino = 0;
1489                 } else if (strnicmp(data, "rwpidforward", 12) == 0) {
1490                         vol->rwpidforward = 1;
1491                 } else if (strnicmp(data, "cifsacl", 7) == 0) {
1492                         vol->cifs_acl = 1;
1493                 } else if (strnicmp(data, "nocifsacl", 9) == 0) {
1494                         vol->cifs_acl = 0;
1495                 } else if (strnicmp(data, "acl", 3) == 0) {
1496                         vol->no_psx_acl = 0;
1497                 } else if (strnicmp(data, "noacl", 5) == 0) {
1498                         vol->no_psx_acl = 1;
1499                 } else if (strnicmp(data, "locallease", 6) == 0) {
1500                         vol->local_lease = 1;
1501                 } else if (strnicmp(data, "sign", 4) == 0) {
1502                         vol->secFlg |= CIFSSEC_MUST_SIGN;
1503                 } else if (strnicmp(data, "seal", 4) == 0) {
1504                         /* we do not do the following in secFlags because seal
1505                            is a per tree connection (mount) not a per socket
1506                            or per-smb connection option in the protocol */
1507                         /* vol->secFlg |= CIFSSEC_MUST_SEAL; */
1508                         vol->seal = 1;
1509                 } else if (strnicmp(data, "direct", 6) == 0) {
1510                         vol->direct_io = 1;
1511                 } else if (strnicmp(data, "forcedirectio", 13) == 0) {
1512                         vol->direct_io = 1;
1513                 } else if (strnicmp(data, "strictcache", 11) == 0) {
1514                         vol->strict_io = 1;
1515                 } else if (strnicmp(data, "noac", 4) == 0) {
1516                         printk(KERN_WARNING "CIFS: Mount option noac not "
1517                                 "supported. Instead set "
1518                                 "/proc/fs/cifs/LookupCacheEnabled to 0\n");
1519                 } else if (strnicmp(data, "fsc", 3) == 0) {
1520 #ifndef CONFIG_CIFS_FSCACHE
1521                         cERROR(1, "FS-Cache support needs CONFIG_CIFS_FSCACHE "
1522                                   "kernel config option set");
1523                         goto cifs_parse_mount_err;
1524 #endif
1525                         vol->fsc = true;
1526                 } else if (strnicmp(data, "mfsymlinks", 10) == 0) {
1527                         vol->mfsymlinks = true;
1528                 } else if (strnicmp(data, "multiuser", 8) == 0) {
1529                         vol->multiuser = true;
1530                 } else if (!strnicmp(data, "backupuid", 9) && value && *value) {
1531                         err = kstrtouint(value, 0, &vol->backupuid);
1532                         if (err < 0) {
1533                                 cERROR(1, "%s: Invalid backupuid value",
1534                                         __func__);
1535                                 goto cifs_parse_mount_err;
1536                         }
1537                         vol->backupuid_specified = true;
1538                 } else if (!strnicmp(data, "backupgid", 9) && value && *value) {
1539                         err = kstrtouint(value, 0, &vol->backupgid);
1540                         if (err < 0) {
1541                                 cERROR(1, "%s: Invalid backupgid value",
1542                                         __func__);
1543                                 goto cifs_parse_mount_err;
1544                         }
1545                         vol->backupgid_specified = true;
1546                 } else
1547                         printk(KERN_WARNING "CIFS: Unknown mount option %s\n",
1548                                                 data);
1549         }
1550         if (vol->UNC == NULL) {
1551                 if (devname == NULL) {
1552                         printk(KERN_WARNING "CIFS: Missing UNC name for mount "
1553                                                 "target\n");
1554                         goto cifs_parse_mount_err;
1555                 }
1556                 if ((temp_len = strnlen(devname, 300)) < 300) {
1557                         vol->UNC = kmalloc(temp_len+1, GFP_KERNEL);
1558                         if (vol->UNC == NULL)
1559                                 goto cifs_parse_mount_err;
1560                         strcpy(vol->UNC, devname);
1561                         if (strncmp(vol->UNC, "//", 2) == 0) {
1562                                 vol->UNC[0] = '\\';
1563                                 vol->UNC[1] = '\\';
1564                         } else if (strncmp(vol->UNC, "\\\\", 2) != 0) {
1565                                 printk(KERN_WARNING "CIFS: UNC Path does not "
1566                                                     "begin with // or \\\\ \n");
1567                                 goto cifs_parse_mount_err;
1568                         }
1569                         value = strpbrk(vol->UNC+2, "/\\");
1570                         if (value)
1571                                 *value = '\\';
1572                 } else {
1573                         printk(KERN_WARNING "CIFS: UNC name too long\n");
1574                         goto cifs_parse_mount_err;
1575                 }
1576         }
1577
1578         if (vol->multiuser && !(vol->secFlg & CIFSSEC_MAY_KRB5)) {
1579                 cERROR(1, "Multiuser mounts currently require krb5 "
1580                           "authentication!");
1581                 goto cifs_parse_mount_err;
1582         }
1583
1584         if (vol->UNCip == NULL)
1585                 vol->UNCip = &vol->UNC[2];
1586
1587         if (uid_specified)
1588                 vol->override_uid = override_uid;
1589         else if (override_uid == 1)
1590                 printk(KERN_NOTICE "CIFS: ignoring forceuid mount option "
1591                                    "specified with no uid= option.\n");
1592
1593         if (gid_specified)
1594                 vol->override_gid = override_gid;
1595         else if (override_gid == 1)
1596                 printk(KERN_NOTICE "CIFS: ignoring forcegid mount option "
1597                                    "specified with no gid= option.\n");
1598
1599         kfree(mountdata_copy);
1600         return 0;
1601
1602 cifs_parse_mount_err:
1603         kfree(mountdata_copy);
1604         return 1;
1605 }
1606
1607 /** Returns true if srcaddr isn't specified and rhs isn't
1608  * specified, or if srcaddr is specified and
1609  * matches the IP address of the rhs argument.
1610  */
1611 static bool
1612 srcip_matches(struct sockaddr *srcaddr, struct sockaddr *rhs)
1613 {
1614         switch (srcaddr->sa_family) {
1615         case AF_UNSPEC:
1616                 return (rhs->sa_family == AF_UNSPEC);
1617         case AF_INET: {
1618                 struct sockaddr_in *saddr4 = (struct sockaddr_in *)srcaddr;
1619                 struct sockaddr_in *vaddr4 = (struct sockaddr_in *)rhs;
1620                 return (saddr4->sin_addr.s_addr == vaddr4->sin_addr.s_addr);
1621         }
1622         case AF_INET6: {
1623                 struct sockaddr_in6 *saddr6 = (struct sockaddr_in6 *)srcaddr;
1624                 struct sockaddr_in6 *vaddr6 = (struct sockaddr_in6 *)&rhs;
1625                 return ipv6_addr_equal(&saddr6->sin6_addr, &vaddr6->sin6_addr);
1626         }
1627         default:
1628                 WARN_ON(1);
1629                 return false; /* don't expect to be here */
1630         }
1631 }
1632
1633 /*
1634  * If no port is specified in addr structure, we try to match with 445 port
1635  * and if it fails - with 139 ports. It should be called only if address
1636  * families of server and addr are equal.
1637  */
1638 static bool
1639 match_port(struct TCP_Server_Info *server, struct sockaddr *addr)
1640 {
1641         __be16 port, *sport;
1642
1643         switch (addr->sa_family) {
1644         case AF_INET:
1645                 sport = &((struct sockaddr_in *) &server->dstaddr)->sin_port;
1646                 port = ((struct sockaddr_in *) addr)->sin_port;
1647                 break;
1648         case AF_INET6:
1649                 sport = &((struct sockaddr_in6 *) &server->dstaddr)->sin6_port;
1650                 port = ((struct sockaddr_in6 *) addr)->sin6_port;
1651                 break;
1652         default:
1653                 WARN_ON(1);
1654                 return false;
1655         }
1656
1657         if (!port) {
1658                 port = htons(CIFS_PORT);
1659                 if (port == *sport)
1660                         return true;
1661
1662                 port = htons(RFC1001_PORT);
1663         }
1664
1665         return port == *sport;
1666 }
1667
1668 static bool
1669 match_address(struct TCP_Server_Info *server, struct sockaddr *addr,
1670               struct sockaddr *srcaddr)
1671 {
1672         switch (addr->sa_family) {
1673         case AF_INET: {
1674                 struct sockaddr_in *addr4 = (struct sockaddr_in *)addr;
1675                 struct sockaddr_in *srv_addr4 =
1676                                         (struct sockaddr_in *)&server->dstaddr;
1677
1678                 if (addr4->sin_addr.s_addr != srv_addr4->sin_addr.s_addr)
1679                         return false;
1680                 break;
1681         }
1682         case AF_INET6: {
1683                 struct sockaddr_in6 *addr6 = (struct sockaddr_in6 *)addr;
1684                 struct sockaddr_in6 *srv_addr6 =
1685                                         (struct sockaddr_in6 *)&server->dstaddr;
1686
1687                 if (!ipv6_addr_equal(&addr6->sin6_addr,
1688                                      &srv_addr6->sin6_addr))
1689                         return false;
1690                 if (addr6->sin6_scope_id != srv_addr6->sin6_scope_id)
1691                         return false;
1692                 break;
1693         }
1694         default:
1695                 WARN_ON(1);
1696                 return false; /* don't expect to be here */
1697         }
1698
1699         if (!srcip_matches(srcaddr, (struct sockaddr *)&server->srcaddr))
1700                 return false;
1701
1702         return true;
1703 }
1704
1705 static bool
1706 match_security(struct TCP_Server_Info *server, struct smb_vol *vol)
1707 {
1708         unsigned int secFlags;
1709
1710         if (vol->secFlg & (~(CIFSSEC_MUST_SIGN | CIFSSEC_MUST_SEAL)))
1711                 secFlags = vol->secFlg;
1712         else
1713                 secFlags = global_secflags | vol->secFlg;
1714
1715         switch (server->secType) {
1716         case LANMAN:
1717                 if (!(secFlags & (CIFSSEC_MAY_LANMAN|CIFSSEC_MAY_PLNTXT)))
1718                         return false;
1719                 break;
1720         case NTLMv2:
1721                 if (!(secFlags & CIFSSEC_MAY_NTLMV2))
1722                         return false;
1723                 break;
1724         case NTLM:
1725                 if (!(secFlags & CIFSSEC_MAY_NTLM))
1726                         return false;
1727                 break;
1728         case Kerberos:
1729                 if (!(secFlags & CIFSSEC_MAY_KRB5))
1730                         return false;
1731                 break;
1732         case RawNTLMSSP:
1733                 if (!(secFlags & CIFSSEC_MAY_NTLMSSP))
1734                         return false;
1735                 break;
1736         default:
1737                 /* shouldn't happen */
1738                 return false;
1739         }
1740
1741         /* now check if signing mode is acceptable */
1742         if ((secFlags & CIFSSEC_MAY_SIGN) == 0 &&
1743             (server->sec_mode & SECMODE_SIGN_REQUIRED))
1744                         return false;
1745         else if (((secFlags & CIFSSEC_MUST_SIGN) == CIFSSEC_MUST_SIGN) &&
1746                  (server->sec_mode &
1747                   (SECMODE_SIGN_ENABLED|SECMODE_SIGN_REQUIRED)) == 0)
1748                         return false;
1749
1750         return true;
1751 }
1752
1753 static int match_server(struct TCP_Server_Info *server, struct sockaddr *addr,
1754                          struct smb_vol *vol)
1755 {
1756         if (!net_eq(cifs_net_ns(server), current->nsproxy->net_ns))
1757                 return 0;
1758
1759         if (!match_address(server, addr,
1760                            (struct sockaddr *)&vol->srcaddr))
1761                 return 0;
1762
1763         if (!match_port(server, addr))
1764                 return 0;
1765
1766         if (!match_security(server, vol))
1767                 return 0;
1768
1769         return 1;
1770 }
1771
1772 static struct TCP_Server_Info *
1773 cifs_find_tcp_session(struct sockaddr *addr, struct smb_vol *vol)
1774 {
1775         struct TCP_Server_Info *server;
1776
1777         spin_lock(&cifs_tcp_ses_lock);
1778         list_for_each_entry(server, &cifs_tcp_ses_list, tcp_ses_list) {
1779                 if (!match_server(server, addr, vol))
1780                         continue;
1781
1782                 ++server->srv_count;
1783                 spin_unlock(&cifs_tcp_ses_lock);
1784                 cFYI(1, "Existing tcp session with server found");
1785                 return server;
1786         }
1787         spin_unlock(&cifs_tcp_ses_lock);
1788         return NULL;
1789 }
1790
1791 static void
1792 cifs_put_tcp_session(struct TCP_Server_Info *server)
1793 {
1794         struct task_struct *task;
1795
1796         spin_lock(&cifs_tcp_ses_lock);
1797         if (--server->srv_count > 0) {
1798                 spin_unlock(&cifs_tcp_ses_lock);
1799                 return;
1800         }
1801
1802         put_net(cifs_net_ns(server));
1803
1804         list_del_init(&server->tcp_ses_list);
1805         spin_unlock(&cifs_tcp_ses_lock);
1806
1807         cancel_delayed_work_sync(&server->echo);
1808
1809         spin_lock(&GlobalMid_Lock);
1810         server->tcpStatus = CifsExiting;
1811         spin_unlock(&GlobalMid_Lock);
1812
1813         cifs_crypto_shash_release(server);
1814         cifs_fscache_release_client_cookie(server);
1815
1816         kfree(server->session_key.response);
1817         server->session_key.response = NULL;
1818         server->session_key.len = 0;
1819
1820         task = xchg(&server->tsk, NULL);
1821         if (task)
1822                 force_sig(SIGKILL, task);
1823 }
1824
1825 static struct TCP_Server_Info *
1826 cifs_get_tcp_session(struct smb_vol *volume_info)
1827 {
1828         struct TCP_Server_Info *tcp_ses = NULL;
1829         struct sockaddr_storage addr;
1830         struct sockaddr_in *sin_server = (struct sockaddr_in *) &addr;
1831         struct sockaddr_in6 *sin_server6 = (struct sockaddr_in6 *) &addr;
1832         int rc;
1833
1834         memset(&addr, 0, sizeof(struct sockaddr_storage));
1835
1836         cFYI(1, "UNC: %s ip: %s", volume_info->UNC, volume_info->UNCip);
1837
1838         if (volume_info->UNCip && volume_info->UNC) {
1839                 rc = cifs_fill_sockaddr((struct sockaddr *)&addr,
1840                                         volume_info->UNCip,
1841                                         strlen(volume_info->UNCip),
1842                                         volume_info->port);
1843                 if (!rc) {
1844                         /* we failed translating address */
1845                         rc = -EINVAL;
1846                         goto out_err;
1847                 }
1848         } else if (volume_info->UNCip) {
1849                 /* BB using ip addr as tcp_ses name to connect to the
1850                    DFS root below */
1851                 cERROR(1, "Connecting to DFS root not implemented yet");
1852                 rc = -EINVAL;
1853                 goto out_err;
1854         } else /* which tcp_sess DFS root would we conect to */ {
1855                 cERROR(1, "CIFS mount error: No UNC path (e.g. -o "
1856                         "unc=//192.168.1.100/public) specified");
1857                 rc = -EINVAL;
1858                 goto out_err;
1859         }
1860
1861         /* see if we already have a matching tcp_ses */
1862         tcp_ses = cifs_find_tcp_session((struct sockaddr *)&addr, volume_info);
1863         if (tcp_ses)
1864                 return tcp_ses;
1865
1866         tcp_ses = kzalloc(sizeof(struct TCP_Server_Info), GFP_KERNEL);
1867         if (!tcp_ses) {
1868                 rc = -ENOMEM;
1869                 goto out_err;
1870         }
1871
1872         rc = cifs_crypto_shash_allocate(tcp_ses);
1873         if (rc) {
1874                 cERROR(1, "could not setup hash structures rc %d", rc);
1875                 goto out_err;
1876         }
1877
1878         cifs_set_net_ns(tcp_ses, get_net(current->nsproxy->net_ns));
1879         tcp_ses->hostname = extract_hostname(volume_info->UNC);
1880         if (IS_ERR(tcp_ses->hostname)) {
1881                 rc = PTR_ERR(tcp_ses->hostname);
1882                 goto out_err_crypto_release;
1883         }
1884
1885         tcp_ses->noblocksnd = volume_info->noblocksnd;
1886         tcp_ses->noautotune = volume_info->noautotune;
1887         tcp_ses->tcp_nodelay = volume_info->sockopt_tcp_nodelay;
1888         atomic_set(&tcp_ses->inFlight, 0);
1889         tcp_ses->maxReq = 1; /* enough to send negotiate request */
1890         init_waitqueue_head(&tcp_ses->response_q);
1891         init_waitqueue_head(&tcp_ses->request_q);
1892         INIT_LIST_HEAD(&tcp_ses->pending_mid_q);
1893         mutex_init(&tcp_ses->srv_mutex);
1894         memcpy(tcp_ses->workstation_RFC1001_name,
1895                 volume_info->source_rfc1001_name, RFC1001_NAME_LEN_WITH_NULL);
1896         memcpy(tcp_ses->server_RFC1001_name,
1897                 volume_info->target_rfc1001_name, RFC1001_NAME_LEN_WITH_NULL);
1898         tcp_ses->session_estab = false;
1899         tcp_ses->sequence_number = 0;
1900         tcp_ses->lstrp = jiffies;
1901         INIT_LIST_HEAD(&tcp_ses->tcp_ses_list);
1902         INIT_LIST_HEAD(&tcp_ses->smb_ses_list);
1903         INIT_DELAYED_WORK(&tcp_ses->echo, cifs_echo_request);
1904
1905         /*
1906          * at this point we are the only ones with the pointer
1907          * to the struct since the kernel thread not created yet
1908          * no need to spinlock this init of tcpStatus or srv_count
1909          */
1910         tcp_ses->tcpStatus = CifsNew;
1911         memcpy(&tcp_ses->srcaddr, &volume_info->srcaddr,
1912                sizeof(tcp_ses->srcaddr));
1913         ++tcp_ses->srv_count;
1914
1915         if (addr.ss_family == AF_INET6) {
1916                 cFYI(1, "attempting ipv6 connect");
1917                 /* BB should we allow ipv6 on port 139? */
1918                 /* other OS never observed in Wild doing 139 with v6 */
1919                 memcpy(&tcp_ses->dstaddr, sin_server6,
1920                        sizeof(struct sockaddr_in6));
1921         } else
1922                 memcpy(&tcp_ses->dstaddr, sin_server,
1923                        sizeof(struct sockaddr_in));
1924
1925         rc = ip_connect(tcp_ses);
1926         if (rc < 0) {
1927                 cERROR(1, "Error connecting to socket. Aborting operation");
1928                 goto out_err_crypto_release;
1929         }
1930
1931         /*
1932          * since we're in a cifs function already, we know that
1933          * this will succeed. No need for try_module_get().
1934          */
1935         __module_get(THIS_MODULE);
1936         tcp_ses->tsk = kthread_run(cifs_demultiplex_thread,
1937                                   tcp_ses, "cifsd");
1938         if (IS_ERR(tcp_ses->tsk)) {
1939                 rc = PTR_ERR(tcp_ses->tsk);
1940                 cERROR(1, "error %d create cifsd thread", rc);
1941                 module_put(THIS_MODULE);
1942                 goto out_err_crypto_release;
1943         }
1944         tcp_ses->tcpStatus = CifsNeedNegotiate;
1945
1946         /* thread spawned, put it on the list */
1947         spin_lock(&cifs_tcp_ses_lock);
1948         list_add(&tcp_ses->tcp_ses_list, &cifs_tcp_ses_list);
1949         spin_unlock(&cifs_tcp_ses_lock);
1950
1951         cifs_fscache_get_client_cookie(tcp_ses);
1952
1953         /* queue echo request delayed work */
1954         queue_delayed_work(system_nrt_wq, &tcp_ses->echo, SMB_ECHO_INTERVAL);
1955
1956         return tcp_ses;
1957
1958 out_err_crypto_release:
1959         cifs_crypto_shash_release(tcp_ses);
1960
1961         put_net(cifs_net_ns(tcp_ses));
1962
1963 out_err:
1964         if (tcp_ses) {
1965                 if (!IS_ERR(tcp_ses->hostname))
1966                         kfree(tcp_ses->hostname);
1967                 if (tcp_ses->ssocket)
1968                         sock_release(tcp_ses->ssocket);
1969                 kfree(tcp_ses);
1970         }
1971         return ERR_PTR(rc);
1972 }
1973
1974 static int match_session(struct cifs_ses *ses, struct smb_vol *vol)
1975 {
1976         switch (ses->server->secType) {
1977         case Kerberos:
1978                 if (vol->cred_uid != ses->cred_uid)
1979                         return 0;
1980                 break;
1981         default:
1982                 /* anything else takes username/password */
1983                 if (ses->user_name == NULL)
1984                         return 0;
1985                 if (strncmp(ses->user_name, vol->username,
1986                             MAX_USERNAME_SIZE))
1987                         return 0;
1988                 if (strlen(vol->username) != 0 &&
1989                     ses->password != NULL &&
1990                     strncmp(ses->password,
1991                             vol->password ? vol->password : "",
1992                             MAX_PASSWORD_SIZE))
1993                         return 0;
1994         }
1995         return 1;
1996 }
1997
1998 static struct cifs_ses *
1999 cifs_find_smb_ses(struct TCP_Server_Info *server, struct smb_vol *vol)
2000 {
2001         struct cifs_ses *ses;
2002
2003         spin_lock(&cifs_tcp_ses_lock);
2004         list_for_each_entry(ses, &server->smb_ses_list, smb_ses_list) {
2005                 if (!match_session(ses, vol))
2006                         continue;
2007                 ++ses->ses_count;
2008                 spin_unlock(&cifs_tcp_ses_lock);
2009                 return ses;
2010         }
2011         spin_unlock(&cifs_tcp_ses_lock);
2012         return NULL;
2013 }
2014
2015 static void
2016 cifs_put_smb_ses(struct cifs_ses *ses)
2017 {
2018         int xid;
2019         struct TCP_Server_Info *server = ses->server;
2020
2021         cFYI(1, "%s: ses_count=%d\n", __func__, ses->ses_count);
2022         spin_lock(&cifs_tcp_ses_lock);
2023         if (--ses->ses_count > 0) {
2024                 spin_unlock(&cifs_tcp_ses_lock);
2025                 return;
2026         }
2027
2028         list_del_init(&ses->smb_ses_list);
2029         spin_unlock(&cifs_tcp_ses_lock);
2030
2031         if (ses->status == CifsGood) {
2032                 xid = GetXid();
2033                 CIFSSMBLogoff(xid, ses);
2034                 _FreeXid(xid);
2035         }
2036         sesInfoFree(ses);
2037         cifs_put_tcp_session(server);
2038 }
2039
2040 static bool warned_on_ntlm;  /* globals init to false automatically */
2041
2042 static struct cifs_ses *
2043 cifs_get_smb_ses(struct TCP_Server_Info *server, struct smb_vol *volume_info)
2044 {
2045         int rc = -ENOMEM, xid;
2046         struct cifs_ses *ses;
2047         struct sockaddr_in *addr = (struct sockaddr_in *)&server->dstaddr;
2048         struct sockaddr_in6 *addr6 = (struct sockaddr_in6 *)&server->dstaddr;
2049
2050         xid = GetXid();
2051
2052         ses = cifs_find_smb_ses(server, volume_info);
2053         if (ses) {
2054                 cFYI(1, "Existing smb sess found (status=%d)", ses->status);
2055
2056                 mutex_lock(&ses->session_mutex);
2057                 rc = cifs_negotiate_protocol(xid, ses);
2058                 if (rc) {
2059                         mutex_unlock(&ses->session_mutex);
2060                         /* problem -- put our ses reference */
2061                         cifs_put_smb_ses(ses);
2062                         FreeXid(xid);
2063                         return ERR_PTR(rc);
2064                 }
2065                 if (ses->need_reconnect) {
2066                         cFYI(1, "Session needs reconnect");
2067                         rc = cifs_setup_session(xid, ses,
2068                                                 volume_info->local_nls);
2069                         if (rc) {
2070                                 mutex_unlock(&ses->session_mutex);
2071                                 /* problem -- put our reference */
2072                                 cifs_put_smb_ses(ses);
2073                                 FreeXid(xid);
2074                                 return ERR_PTR(rc);
2075                         }
2076                 }
2077                 mutex_unlock(&ses->session_mutex);
2078
2079                 /* existing SMB ses has a server reference already */
2080                 cifs_put_tcp_session(server);
2081                 FreeXid(xid);
2082                 return ses;
2083         }
2084
2085         cFYI(1, "Existing smb sess not found");
2086         ses = sesInfoAlloc();
2087         if (ses == NULL)
2088                 goto get_ses_fail;
2089
2090         /* new SMB session uses our server ref */
2091         ses->server = server;
2092         if (server->dstaddr.ss_family == AF_INET6)
2093                 sprintf(ses->serverName, "%pI6", &addr6->sin6_addr);
2094         else
2095                 sprintf(ses->serverName, "%pI4", &addr->sin_addr);
2096
2097         if (volume_info->username) {
2098                 ses->user_name = kstrdup(volume_info->username, GFP_KERNEL);
2099                 if (!ses->user_name)
2100                         goto get_ses_fail;
2101         }
2102
2103         /* volume_info->password freed at unmount */
2104         if (volume_info->password) {
2105                 ses->password = kstrdup(volume_info->password, GFP_KERNEL);
2106                 if (!ses->password)
2107                         goto get_ses_fail;
2108         }
2109         if (volume_info->domainname) {
2110                 ses->domainName = kstrdup(volume_info->domainname, GFP_KERNEL);
2111                 if (!ses->domainName)
2112                         goto get_ses_fail;
2113         }
2114         ses->cred_uid = volume_info->cred_uid;
2115         ses->linux_uid = volume_info->linux_uid;
2116
2117         /* ntlmv2 is much stronger than ntlm security, and has been broadly
2118         supported for many years, time to update default security mechanism */
2119         if ((volume_info->secFlg == 0) && warned_on_ntlm == false) {
2120                 warned_on_ntlm = true;
2121                 cERROR(1, "default security mechanism requested.  The default "
2122                         "security mechanism will be upgraded from ntlm to "
2123                         "ntlmv2 in kernel release 3.3");
2124         }
2125         ses->overrideSecFlg = volume_info->secFlg;
2126
2127         mutex_lock(&ses->session_mutex);
2128         rc = cifs_negotiate_protocol(xid, ses);
2129         if (!rc)
2130                 rc = cifs_setup_session(xid, ses, volume_info->local_nls);
2131         mutex_unlock(&ses->session_mutex);
2132         if (rc)
2133                 goto get_ses_fail;
2134
2135         /* success, put it on the list */
2136         spin_lock(&cifs_tcp_ses_lock);
2137         list_add(&ses->smb_ses_list, &server->smb_ses_list);
2138         spin_unlock(&cifs_tcp_ses_lock);
2139
2140         FreeXid(xid);
2141         return ses;
2142
2143 get_ses_fail:
2144         sesInfoFree(ses);
2145         FreeXid(xid);
2146         return ERR_PTR(rc);
2147 }
2148
2149 static int match_tcon(struct cifs_tcon *tcon, const char *unc)
2150 {
2151         if (tcon->tidStatus == CifsExiting)
2152                 return 0;
2153         if (strncmp(tcon->treeName, unc, MAX_TREE_SIZE))
2154                 return 0;
2155         return 1;
2156 }
2157
2158 static struct cifs_tcon *
2159 cifs_find_tcon(struct cifs_ses *ses, const char *unc)
2160 {
2161         struct list_head *tmp;
2162         struct cifs_tcon *tcon;
2163
2164         spin_lock(&cifs_tcp_ses_lock);
2165         list_for_each(tmp, &ses->tcon_list) {
2166                 tcon = list_entry(tmp, struct cifs_tcon, tcon_list);
2167                 if (!match_tcon(tcon, unc))
2168                         continue;
2169                 ++tcon->tc_count;
2170                 spin_unlock(&cifs_tcp_ses_lock);
2171                 return tcon;
2172         }
2173         spin_unlock(&cifs_tcp_ses_lock);
2174         return NULL;
2175 }
2176
2177 static void
2178 cifs_put_tcon(struct cifs_tcon *tcon)
2179 {
2180         int xid;
2181         struct cifs_ses *ses = tcon->ses;
2182
2183         cFYI(1, "%s: tc_count=%d\n", __func__, tcon->tc_count);
2184         spin_lock(&cifs_tcp_ses_lock);
2185         if (--tcon->tc_count > 0) {
2186                 spin_unlock(&cifs_tcp_ses_lock);
2187                 return;
2188         }
2189
2190         list_del_init(&tcon->tcon_list);
2191         spin_unlock(&cifs_tcp_ses_lock);
2192
2193         xid = GetXid();
2194         CIFSSMBTDis(xid, tcon);
2195         _FreeXid(xid);
2196
2197         cifs_fscache_release_super_cookie(tcon);
2198         tconInfoFree(tcon);
2199         cifs_put_smb_ses(ses);
2200 }
2201
2202 static struct cifs_tcon *
2203 cifs_get_tcon(struct cifs_ses *ses, struct smb_vol *volume_info)
2204 {
2205         int rc, xid;
2206         struct cifs_tcon *tcon;
2207
2208         tcon = cifs_find_tcon(ses, volume_info->UNC);
2209         if (tcon) {
2210                 cFYI(1, "Found match on UNC path");
2211                 /* existing tcon already has a reference */
2212                 cifs_put_smb_ses(ses);
2213                 if (tcon->seal != volume_info->seal)
2214                         cERROR(1, "transport encryption setting "
2215                                    "conflicts with existing tid");
2216                 return tcon;
2217         }
2218
2219         tcon = tconInfoAlloc();
2220         if (tcon == NULL) {
2221                 rc = -ENOMEM;
2222                 goto out_fail;
2223         }
2224
2225         tcon->ses = ses;
2226         if (volume_info->password) {
2227                 tcon->password = kstrdup(volume_info->password, GFP_KERNEL);
2228                 if (!tcon->password) {
2229                         rc = -ENOMEM;
2230                         goto out_fail;
2231                 }
2232         }
2233
2234         if (strchr(volume_info->UNC + 3, '\\') == NULL
2235             && strchr(volume_info->UNC + 3, '/') == NULL) {
2236                 cERROR(1, "Missing share name");
2237                 rc = -ENODEV;
2238                 goto out_fail;
2239         }
2240
2241         /* BB Do we need to wrap session_mutex around
2242          * this TCon call and Unix SetFS as
2243          * we do on SessSetup and reconnect? */
2244         xid = GetXid();
2245         rc = CIFSTCon(xid, ses, volume_info->UNC, tcon, volume_info->local_nls);
2246         FreeXid(xid);
2247         cFYI(1, "CIFS Tcon rc = %d", rc);
2248         if (rc)
2249                 goto out_fail;
2250
2251         if (volume_info->nodfs) {
2252                 tcon->Flags &= ~SMB_SHARE_IS_IN_DFS;
2253                 cFYI(1, "DFS disabled (%d)", tcon->Flags);
2254         }
2255         tcon->seal = volume_info->seal;
2256         /* we can have only one retry value for a connection
2257            to a share so for resources mounted more than once
2258            to the same server share the last value passed in
2259            for the retry flag is used */
2260         tcon->retry = volume_info->retry;
2261         tcon->nocase = volume_info->nocase;
2262         tcon->local_lease = volume_info->local_lease;
2263
2264         spin_lock(&cifs_tcp_ses_lock);
2265         list_add(&tcon->tcon_list, &ses->tcon_list);
2266         spin_unlock(&cifs_tcp_ses_lock);
2267
2268         cifs_fscache_get_super_cookie(tcon);
2269
2270         return tcon;
2271
2272 out_fail:
2273         tconInfoFree(tcon);
2274         return ERR_PTR(rc);
2275 }
2276
2277 void
2278 cifs_put_tlink(struct tcon_link *tlink)
2279 {
2280         if (!tlink || IS_ERR(tlink))
2281                 return;
2282
2283         if (!atomic_dec_and_test(&tlink->tl_count) ||
2284             test_bit(TCON_LINK_IN_TREE, &tlink->tl_flags)) {
2285                 tlink->tl_time = jiffies;
2286                 return;
2287         }
2288
2289         if (!IS_ERR(tlink_tcon(tlink)))
2290                 cifs_put_tcon(tlink_tcon(tlink));
2291         kfree(tlink);
2292         return;
2293 }
2294
2295 static inline struct tcon_link *
2296 cifs_sb_master_tlink(struct cifs_sb_info *cifs_sb)
2297 {
2298         return cifs_sb->master_tlink;
2299 }
2300
2301 static int
2302 compare_mount_options(struct super_block *sb, struct cifs_mnt_data *mnt_data)
2303 {
2304         struct cifs_sb_info *old = CIFS_SB(sb);
2305         struct cifs_sb_info *new = mnt_data->cifs_sb;
2306
2307         if ((sb->s_flags & CIFS_MS_MASK) != (mnt_data->flags & CIFS_MS_MASK))
2308                 return 0;
2309
2310         if ((old->mnt_cifs_flags & CIFS_MOUNT_MASK) !=
2311             (new->mnt_cifs_flags & CIFS_MOUNT_MASK))
2312                 return 0;
2313
2314         /*
2315          * We want to share sb only if we don't specify an r/wsize or
2316          * specified r/wsize is greater than or equal to existing one.
2317          */
2318         if (new->wsize && new->wsize < old->wsize)
2319                 return 0;
2320
2321         if (new->rsize && new->rsize < old->rsize)
2322                 return 0;
2323
2324         if (old->mnt_uid != new->mnt_uid || old->mnt_gid != new->mnt_gid)
2325                 return 0;
2326
2327         if (old->mnt_file_mode != new->mnt_file_mode ||
2328             old->mnt_dir_mode != new->mnt_dir_mode)
2329                 return 0;
2330
2331         if (strcmp(old->local_nls->charset, new->local_nls->charset))
2332                 return 0;
2333
2334         if (old->actimeo != new->actimeo)
2335                 return 0;
2336
2337         return 1;
2338 }
2339
2340 int
2341 cifs_match_super(struct super_block *sb, void *data)
2342 {
2343         struct cifs_mnt_data *mnt_data = (struct cifs_mnt_data *)data;
2344         struct smb_vol *volume_info;
2345         struct cifs_sb_info *cifs_sb;
2346         struct TCP_Server_Info *tcp_srv;
2347         struct cifs_ses *ses;
2348         struct cifs_tcon *tcon;
2349         struct tcon_link *tlink;
2350         struct sockaddr_storage addr;
2351         int rc = 0;
2352
2353         memset(&addr, 0, sizeof(struct sockaddr_storage));
2354
2355         spin_lock(&cifs_tcp_ses_lock);
2356         cifs_sb = CIFS_SB(sb);
2357         tlink = cifs_get_tlink(cifs_sb_master_tlink(cifs_sb));
2358         if (IS_ERR(tlink)) {
2359                 spin_unlock(&cifs_tcp_ses_lock);
2360                 return rc;
2361         }
2362         tcon = tlink_tcon(tlink);
2363         ses = tcon->ses;
2364         tcp_srv = ses->server;
2365
2366         volume_info = mnt_data->vol;
2367
2368         if (!volume_info->UNCip || !volume_info->UNC)
2369                 goto out;
2370
2371         rc = cifs_fill_sockaddr((struct sockaddr *)&addr,
2372                                 volume_info->UNCip,
2373                                 strlen(volume_info->UNCip),
2374                                 volume_info->port);
2375         if (!rc)
2376                 goto out;
2377
2378         if (!match_server(tcp_srv, (struct sockaddr *)&addr, volume_info) ||
2379             !match_session(ses, volume_info) ||
2380             !match_tcon(tcon, volume_info->UNC)) {
2381                 rc = 0;
2382                 goto out;
2383         }
2384
2385         rc = compare_mount_options(sb, mnt_data);
2386 out:
2387         spin_unlock(&cifs_tcp_ses_lock);
2388         cifs_put_tlink(tlink);
2389         return rc;
2390 }
2391
2392 int
2393 get_dfs_path(int xid, struct cifs_ses *pSesInfo, const char *old_path,
2394              const struct nls_table *nls_codepage, unsigned int *pnum_referrals,
2395              struct dfs_info3_param **preferrals, int remap)
2396 {
2397         char *temp_unc;
2398         int rc = 0;
2399
2400         *pnum_referrals = 0;
2401         *preferrals = NULL;
2402
2403         if (pSesInfo->ipc_tid == 0) {
2404                 temp_unc = kmalloc(2 /* for slashes */ +
2405                         strnlen(pSesInfo->serverName,
2406                                 SERVER_NAME_LEN_WITH_NULL * 2)
2407                                  + 1 + 4 /* slash IPC$ */  + 2,
2408                                 GFP_KERNEL);
2409                 if (temp_unc == NULL)
2410                         return -ENOMEM;
2411                 temp_unc[0] = '\\';
2412                 temp_unc[1] = '\\';
2413                 strcpy(temp_unc + 2, pSesInfo->serverName);
2414                 strcpy(temp_unc + 2 + strlen(pSesInfo->serverName), "\\IPC$");
2415                 rc = CIFSTCon(xid, pSesInfo, temp_unc, NULL, nls_codepage);
2416                 cFYI(1, "CIFS Tcon rc = %d ipc_tid = %d", rc, pSesInfo->ipc_tid);
2417                 kfree(temp_unc);
2418         }
2419         if (rc == 0)
2420                 rc = CIFSGetDFSRefer(xid, pSesInfo, old_path, preferrals,
2421                                      pnum_referrals, nls_codepage, remap);
2422         /* BB map targetUNCs to dfs_info3 structures, here or
2423                 in CIFSGetDFSRefer BB */
2424
2425         return rc;
2426 }
2427
2428 #ifdef CONFIG_DEBUG_LOCK_ALLOC
2429 static struct lock_class_key cifs_key[2];
2430 static struct lock_class_key cifs_slock_key[2];
2431
2432 static inline void
2433 cifs_reclassify_socket4(struct socket *sock)
2434 {
2435         struct sock *sk = sock->sk;
2436         BUG_ON(sock_owned_by_user(sk));
2437         sock_lock_init_class_and_name(sk, "slock-AF_INET-CIFS",
2438                 &cifs_slock_key[0], "sk_lock-AF_INET-CIFS", &cifs_key[0]);
2439 }
2440
2441 static inline void
2442 cifs_reclassify_socket6(struct socket *sock)
2443 {
2444         struct sock *sk = sock->sk;
2445         BUG_ON(sock_owned_by_user(sk));
2446         sock_lock_init_class_and_name(sk, "slock-AF_INET6-CIFS",
2447                 &cifs_slock_key[1], "sk_lock-AF_INET6-CIFS", &cifs_key[1]);
2448 }
2449 #else
2450 static inline void
2451 cifs_reclassify_socket4(struct socket *sock)
2452 {
2453 }
2454
2455 static inline void
2456 cifs_reclassify_socket6(struct socket *sock)
2457 {
2458 }
2459 #endif
2460
2461 /* See RFC1001 section 14 on representation of Netbios names */
2462 static void rfc1002mangle(char *target, char *source, unsigned int length)
2463 {
2464         unsigned int i, j;
2465
2466         for (i = 0, j = 0; i < (length); i++) {
2467                 /* mask a nibble at a time and encode */
2468                 target[j] = 'A' + (0x0F & (source[i] >> 4));
2469                 target[j+1] = 'A' + (0x0F & source[i]);
2470                 j += 2;
2471         }
2472
2473 }
2474
2475 static int
2476 bind_socket(struct TCP_Server_Info *server)
2477 {
2478         int rc = 0;
2479         if (server->srcaddr.ss_family != AF_UNSPEC) {
2480                 /* Bind to the specified local IP address */
2481                 struct socket *socket = server->ssocket;
2482                 rc = socket->ops->bind(socket,
2483                                        (struct sockaddr *) &server->srcaddr,
2484                                        sizeof(server->srcaddr));
2485                 if (rc < 0) {
2486                         struct sockaddr_in *saddr4;
2487                         struct sockaddr_in6 *saddr6;
2488                         saddr4 = (struct sockaddr_in *)&server->srcaddr;
2489                         saddr6 = (struct sockaddr_in6 *)&server->srcaddr;
2490                         if (saddr6->sin6_family == AF_INET6)
2491                                 cERROR(1, "cifs: "
2492                                        "Failed to bind to: %pI6c, error: %d\n",
2493                                        &saddr6->sin6_addr, rc);
2494                         else
2495                                 cERROR(1, "cifs: "
2496                                        "Failed to bind to: %pI4, error: %d\n",
2497                                        &saddr4->sin_addr.s_addr, rc);
2498                 }
2499         }
2500         return rc;
2501 }
2502
2503 static int
2504 ip_rfc1001_connect(struct TCP_Server_Info *server)
2505 {
2506         int rc = 0;
2507         /*
2508          * some servers require RFC1001 sessinit before sending
2509          * negprot - BB check reconnection in case where second
2510          * sessinit is sent but no second negprot
2511          */
2512         struct rfc1002_session_packet *ses_init_buf;
2513         struct smb_hdr *smb_buf;
2514         ses_init_buf = kzalloc(sizeof(struct rfc1002_session_packet),
2515                                GFP_KERNEL);
2516         if (ses_init_buf) {
2517                 ses_init_buf->trailer.session_req.called_len = 32;
2518
2519                 if (server->server_RFC1001_name &&
2520                     server->server_RFC1001_name[0] != 0)
2521                         rfc1002mangle(ses_init_buf->trailer.
2522                                       session_req.called_name,
2523                                       server->server_RFC1001_name,
2524                                       RFC1001_NAME_LEN_WITH_NULL);
2525                 else
2526                         rfc1002mangle(ses_init_buf->trailer.
2527                                       session_req.called_name,
2528                                       DEFAULT_CIFS_CALLED_NAME,
2529                                       RFC1001_NAME_LEN_WITH_NULL);
2530
2531                 ses_init_buf->trailer.session_req.calling_len = 32;
2532
2533                 /*
2534                  * calling name ends in null (byte 16) from old smb
2535                  * convention.
2536                  */
2537                 if (server->workstation_RFC1001_name &&
2538                     server->workstation_RFC1001_name[0] != 0)
2539                         rfc1002mangle(ses_init_buf->trailer.
2540                                       session_req.calling_name,
2541                                       server->workstation_RFC1001_name,
2542                                       RFC1001_NAME_LEN_WITH_NULL);
2543                 else
2544                         rfc1002mangle(ses_init_buf->trailer.
2545                                       session_req.calling_name,
2546                                       "LINUX_CIFS_CLNT",
2547                                       RFC1001_NAME_LEN_WITH_NULL);
2548
2549                 ses_init_buf->trailer.session_req.scope1 = 0;
2550                 ses_init_buf->trailer.session_req.scope2 = 0;
2551                 smb_buf = (struct smb_hdr *)ses_init_buf;
2552
2553                 /* sizeof RFC1002_SESSION_REQUEST with no scope */
2554                 smb_buf->smb_buf_length = cpu_to_be32(0x81000044);
2555                 rc = smb_send(server, smb_buf, 0x44);
2556                 kfree(ses_init_buf);
2557                 /*
2558                  * RFC1001 layer in at least one server
2559                  * requires very short break before negprot
2560                  * presumably because not expecting negprot
2561                  * to follow so fast.  This is a simple
2562                  * solution that works without
2563                  * complicating the code and causes no
2564                  * significant slowing down on mount
2565                  * for everyone else
2566                  */
2567                 usleep_range(1000, 2000);
2568         }
2569         /*
2570          * else the negprot may still work without this
2571          * even though malloc failed
2572          */
2573
2574         return rc;
2575 }
2576
2577 static int
2578 generic_ip_connect(struct TCP_Server_Info *server)
2579 {
2580         int rc = 0;
2581         __be16 sport;
2582         int slen, sfamily;
2583         struct socket *socket = server->ssocket;
2584         struct sockaddr *saddr;
2585
2586         saddr = (struct sockaddr *) &server->dstaddr;
2587
2588         if (server->dstaddr.ss_family == AF_INET6) {
2589                 sport = ((struct sockaddr_in6 *) saddr)->sin6_port;
2590                 slen = sizeof(struct sockaddr_in6);
2591                 sfamily = AF_INET6;
2592         } else {
2593                 sport = ((struct sockaddr_in *) saddr)->sin_port;
2594                 slen = sizeof(struct sockaddr_in);
2595                 sfamily = AF_INET;
2596         }
2597
2598         if (socket == NULL) {
2599                 rc = __sock_create(cifs_net_ns(server), sfamily, SOCK_STREAM,
2600                                    IPPROTO_TCP, &socket, 1);
2601                 if (rc < 0) {
2602                         cERROR(1, "Error %d creating socket", rc);
2603                         server->ssocket = NULL;
2604                         return rc;
2605                 }
2606
2607                 /* BB other socket options to set KEEPALIVE, NODELAY? */
2608                 cFYI(1, "Socket created");
2609                 server->ssocket = socket;
2610                 socket->sk->sk_allocation = GFP_NOFS;
2611                 if (sfamily == AF_INET6)
2612                         cifs_reclassify_socket6(socket);
2613                 else
2614                         cifs_reclassify_socket4(socket);
2615         }
2616
2617         rc = bind_socket(server);
2618         if (rc < 0)
2619                 return rc;
2620
2621         /*
2622          * Eventually check for other socket options to change from
2623          * the default. sock_setsockopt not used because it expects
2624          * user space buffer
2625          */
2626         socket->sk->sk_rcvtimeo = 7 * HZ;
2627         socket->sk->sk_sndtimeo = 5 * HZ;
2628
2629         /* make the bufsizes depend on wsize/rsize and max requests */
2630         if (server->noautotune) {
2631                 if (socket->sk->sk_sndbuf < (200 * 1024))
2632                         socket->sk->sk_sndbuf = 200 * 1024;
2633                 if (socket->sk->sk_rcvbuf < (140 * 1024))
2634                         socket->sk->sk_rcvbuf = 140 * 1024;
2635         }
2636
2637         if (server->tcp_nodelay) {
2638                 int val = 1;
2639                 rc = kernel_setsockopt(socket, SOL_TCP, TCP_NODELAY,
2640                                 (char *)&val, sizeof(val));
2641                 if (rc)
2642                         cFYI(1, "set TCP_NODELAY socket option error %d", rc);
2643         }
2644
2645          cFYI(1, "sndbuf %d rcvbuf %d rcvtimeo 0x%lx",
2646                  socket->sk->sk_sndbuf,
2647                  socket->sk->sk_rcvbuf, socket->sk->sk_rcvtimeo);
2648
2649         rc = socket->ops->connect(socket, saddr, slen, 0);
2650         if (rc < 0) {
2651                 cFYI(1, "Error %d connecting to server", rc);
2652                 sock_release(socket);
2653                 server->ssocket = NULL;
2654                 return rc;
2655         }
2656
2657         if (sport == htons(RFC1001_PORT))
2658                 rc = ip_rfc1001_connect(server);
2659
2660         return rc;
2661 }
2662
2663 static int
2664 ip_connect(struct TCP_Server_Info *server)
2665 {
2666         __be16 *sport;
2667         struct sockaddr_in6 *addr6 = (struct sockaddr_in6 *)&server->dstaddr;
2668         struct sockaddr_in *addr = (struct sockaddr_in *)&server->dstaddr;
2669
2670         if (server->dstaddr.ss_family == AF_INET6)
2671                 sport = &addr6->sin6_port;
2672         else
2673                 sport = &addr->sin_port;
2674
2675         if (*sport == 0) {
2676                 int rc;
2677
2678                 /* try with 445 port at first */
2679                 *sport = htons(CIFS_PORT);
2680
2681                 rc = generic_ip_connect(server);
2682                 if (rc >= 0)
2683                         return rc;
2684
2685                 /* if it failed, try with 139 port */
2686                 *sport = htons(RFC1001_PORT);
2687         }
2688
2689         return generic_ip_connect(server);
2690 }
2691
2692 void reset_cifs_unix_caps(int xid, struct cifs_tcon *tcon,
2693                           struct cifs_sb_info *cifs_sb, struct smb_vol *vol_info)
2694 {
2695         /* if we are reconnecting then should we check to see if
2696          * any requested capabilities changed locally e.g. via
2697          * remount but we can not do much about it here
2698          * if they have (even if we could detect it by the following)
2699          * Perhaps we could add a backpointer to array of sb from tcon
2700          * or if we change to make all sb to same share the same
2701          * sb as NFS - then we only have one backpointer to sb.
2702          * What if we wanted to mount the server share twice once with
2703          * and once without posixacls or posix paths? */
2704         __u64 saved_cap = le64_to_cpu(tcon->fsUnixInfo.Capability);
2705
2706         if (vol_info && vol_info->no_linux_ext) {
2707                 tcon->fsUnixInfo.Capability = 0;
2708                 tcon->unix_ext = 0; /* Unix Extensions disabled */
2709                 cFYI(1, "Linux protocol extensions disabled");
2710                 return;
2711         } else if (vol_info)
2712                 tcon->unix_ext = 1; /* Unix Extensions supported */
2713
2714         if (tcon->unix_ext == 0) {
2715                 cFYI(1, "Unix extensions disabled so not set on reconnect");
2716                 return;
2717         }
2718
2719         if (!CIFSSMBQFSUnixInfo(xid, tcon)) {
2720                 __u64 cap = le64_to_cpu(tcon->fsUnixInfo.Capability);
2721                 cFYI(1, "unix caps which server supports %lld", cap);
2722                 /* check for reconnect case in which we do not
2723                    want to change the mount behavior if we can avoid it */
2724                 if (vol_info == NULL) {
2725                         /* turn off POSIX ACL and PATHNAMES if not set
2726                            originally at mount time */
2727                         if ((saved_cap & CIFS_UNIX_POSIX_ACL_CAP) == 0)
2728                                 cap &= ~CIFS_UNIX_POSIX_ACL_CAP;
2729                         if ((saved_cap & CIFS_UNIX_POSIX_PATHNAMES_CAP) == 0) {
2730                                 if (cap & CIFS_UNIX_POSIX_PATHNAMES_CAP)
2731                                         cERROR(1, "POSIXPATH support change");
2732                                 cap &= ~CIFS_UNIX_POSIX_PATHNAMES_CAP;
2733                         } else if ((cap & CIFS_UNIX_POSIX_PATHNAMES_CAP) == 0) {
2734                                 cERROR(1, "possible reconnect error");
2735                                 cERROR(1, "server disabled POSIX path support");
2736                         }
2737                 }
2738
2739                 if (cap & CIFS_UNIX_TRANSPORT_ENCRYPTION_MANDATORY_CAP)
2740                         cERROR(1, "per-share encryption not supported yet");
2741
2742                 cap &= CIFS_UNIX_CAP_MASK;
2743                 if (vol_info && vol_info->no_psx_acl)
2744                         cap &= ~CIFS_UNIX_POSIX_ACL_CAP;
2745                 else if (CIFS_UNIX_POSIX_ACL_CAP & cap) {
2746                         cFYI(1, "negotiated posix acl support");
2747                         if (cifs_sb)
2748                                 cifs_sb->mnt_cifs_flags |=
2749                                         CIFS_MOUNT_POSIXACL;
2750                 }
2751
2752                 if (vol_info && vol_info->posix_paths == 0)
2753                         cap &= ~CIFS_UNIX_POSIX_PATHNAMES_CAP;
2754                 else if (cap & CIFS_UNIX_POSIX_PATHNAMES_CAP) {
2755                         cFYI(1, "negotiate posix pathnames");
2756                         if (cifs_sb)
2757                                 cifs_sb->mnt_cifs_flags |=
2758                                         CIFS_MOUNT_POSIX_PATHS;
2759                 }
2760
2761                 cFYI(1, "Negotiate caps 0x%x", (int)cap);
2762 #ifdef CONFIG_CIFS_DEBUG2
2763                 if (cap & CIFS_UNIX_FCNTL_CAP)
2764                         cFYI(1, "FCNTL cap");
2765                 if (cap & CIFS_UNIX_EXTATTR_CAP)
2766                         cFYI(1, "EXTATTR cap");
2767                 if (cap & CIFS_UNIX_POSIX_PATHNAMES_CAP)
2768                         cFYI(1, "POSIX path cap");
2769                 if (cap & CIFS_UNIX_XATTR_CAP)
2770                         cFYI(1, "XATTR cap");
2771                 if (cap & CIFS_UNIX_POSIX_ACL_CAP)
2772                         cFYI(1, "POSIX ACL cap");
2773                 if (cap & CIFS_UNIX_LARGE_READ_CAP)
2774                         cFYI(1, "very large read cap");
2775                 if (cap & CIFS_UNIX_LARGE_WRITE_CAP)
2776                         cFYI(1, "very large write cap");
2777                 if (cap & CIFS_UNIX_TRANSPORT_ENCRYPTION_CAP)
2778                         cFYI(1, "transport encryption cap");
2779                 if (cap & CIFS_UNIX_TRANSPORT_ENCRYPTION_MANDATORY_CAP)
2780                         cFYI(1, "mandatory transport encryption cap");
2781 #endif /* CIFS_DEBUG2 */
2782                 if (CIFSSMBSetFSUnixInfo(xid, tcon, cap)) {
2783                         if (vol_info == NULL) {
2784                                 cFYI(1, "resetting capabilities failed");
2785                         } else
2786                                 cERROR(1, "Negotiating Unix capabilities "
2787                                            "with the server failed.  Consider "
2788                                            "mounting with the Unix Extensions\n"
2789                                            "disabled, if problems are found, "
2790                                            "by specifying the nounix mount "
2791                                            "option.");
2792
2793                 }
2794         }
2795 }
2796
2797 void cifs_setup_cifs_sb(struct smb_vol *pvolume_info,
2798                         struct cifs_sb_info *cifs_sb)
2799 {
2800         INIT_DELAYED_WORK(&cifs_sb->prune_tlinks, cifs_prune_tlinks);
2801
2802         spin_lock_init(&cifs_sb->tlink_tree_lock);
2803         cifs_sb->tlink_tree = RB_ROOT;
2804
2805         /*
2806          * Temporarily set r/wsize for matching superblock. If we end up using
2807          * new sb then client will later negotiate it downward if needed.
2808          */
2809         cifs_sb->rsize = pvolume_info->rsize;
2810         cifs_sb->wsize = pvolume_info->wsize;
2811
2812         cifs_sb->mnt_uid = pvolume_info->linux_uid;
2813         cifs_sb->mnt_gid = pvolume_info->linux_gid;
2814         if (pvolume_info->backupuid_specified)
2815                 cifs_sb->mnt_backupuid = pvolume_info->backupuid;
2816         if (pvolume_info->backupgid_specified)
2817                 cifs_sb->mnt_backupgid = pvolume_info->backupgid;
2818         cifs_sb->mnt_file_mode = pvolume_info->file_mode;
2819         cifs_sb->mnt_dir_mode = pvolume_info->dir_mode;
2820         cFYI(1, "file mode: 0x%x  dir mode: 0x%x",
2821                 cifs_sb->mnt_file_mode, cifs_sb->mnt_dir_mode);
2822
2823         cifs_sb->actimeo = pvolume_info->actimeo;
2824         cifs_sb->local_nls = pvolume_info->local_nls;
2825
2826         if (pvolume_info->noperm)
2827                 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_NO_PERM;
2828         if (pvolume_info->setuids)
2829                 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_SET_UID;
2830         if (pvolume_info->server_ino)
2831                 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_SERVER_INUM;
2832         if (pvolume_info->remap)
2833                 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_MAP_SPECIAL_CHR;
2834         if (pvolume_info->no_xattr)
2835                 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_NO_XATTR;
2836         if (pvolume_info->sfu_emul)
2837                 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_UNX_EMUL;
2838         if (pvolume_info->nobrl)
2839                 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_NO_BRL;
2840         if (pvolume_info->nostrictsync)
2841                 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_NOSSYNC;
2842         if (pvolume_info->mand_lock)
2843                 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_NOPOSIXBRL;
2844         if (pvolume_info->rwpidforward)
2845                 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_RWPIDFORWARD;
2846         if (pvolume_info->cifs_acl)
2847                 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_CIFS_ACL;
2848         if (pvolume_info->backupuid_specified)
2849                 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_CIFS_BACKUPUID;
2850         if (pvolume_info->backupgid_specified)
2851                 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_CIFS_BACKUPGID;
2852         if (pvolume_info->override_uid)
2853                 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_OVERR_UID;
2854         if (pvolume_info->override_gid)
2855                 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_OVERR_GID;
2856         if (pvolume_info->dynperm)
2857                 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_DYNPERM;
2858         if (pvolume_info->fsc)
2859                 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_FSCACHE;
2860         if (pvolume_info->multiuser)
2861                 cifs_sb->mnt_cifs_flags |= (CIFS_MOUNT_MULTIUSER |
2862                                             CIFS_MOUNT_NO_PERM);
2863         if (pvolume_info->strict_io)
2864                 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_STRICT_IO;
2865         if (pvolume_info->direct_io) {
2866                 cFYI(1, "mounting share using direct i/o");
2867                 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_DIRECT_IO;
2868         }
2869         if (pvolume_info->mfsymlinks) {
2870                 if (pvolume_info->sfu_emul) {
2871                         cERROR(1,  "mount option mfsymlinks ignored if sfu "
2872                                    "mount option is used");
2873                 } else {
2874                         cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_MF_SYMLINKS;
2875                 }
2876         }
2877
2878         if ((pvolume_info->cifs_acl) && (pvolume_info->dynperm))
2879                 cERROR(1, "mount option dynperm ignored if cifsacl "
2880                            "mount option supported");
2881 }
2882
2883 /*
2884  * When the server supports very large reads and writes via POSIX extensions,
2885  * we can allow up to 2^24-1, minus the size of a READ/WRITE_AND_X header, not
2886  * including the RFC1001 length.
2887  *
2888  * Note that this might make for "interesting" allocation problems during
2889  * writeback however as we have to allocate an array of pointers for the
2890  * pages. A 16M write means ~32kb page array with PAGE_CACHE_SIZE == 4096.
2891  *
2892  * For reads, there is a similar problem as we need to allocate an array
2893  * of kvecs to handle the receive, though that should only need to be done
2894  * once.
2895  */
2896 #define CIFS_MAX_WSIZE ((1<<24) - 1 - sizeof(WRITE_REQ) + 4)
2897 #define CIFS_MAX_RSIZE ((1<<24) - sizeof(READ_RSP) + 4)
2898
2899 /*
2900  * When the server doesn't allow large posix writes, only allow a rsize/wsize
2901  * of 2^17-1 minus the size of the call header. That allows for a read or
2902  * write up to the maximum size described by RFC1002.
2903  */
2904 #define CIFS_MAX_RFC1002_WSIZE ((1<<17) - 1 - sizeof(WRITE_REQ) + 4)
2905 #define CIFS_MAX_RFC1002_RSIZE ((1<<17) - 1 - sizeof(READ_RSP) + 4)
2906
2907 /*
2908  * The default wsize is 1M. find_get_pages seems to return a maximum of 256
2909  * pages in a single call. With PAGE_CACHE_SIZE == 4k, this means we can fill
2910  * a single wsize request with a single call.
2911  */
2912 #define CIFS_DEFAULT_IOSIZE (1024 * 1024)
2913
2914 /*
2915  * Windows only supports a max of 60kb reads and 65535 byte writes. Default to
2916  * those values when posix extensions aren't in force. In actuality here, we
2917  * use 65536 to allow for a write that is a multiple of 4k. Most servers seem
2918  * to be ok with the extra byte even though Windows doesn't send writes that
2919  * are that large.
2920  *
2921  * Citation:
2922  *
2923  * http://blogs.msdn.com/b/openspecification/archive/2009/04/10/smb-maximum-transmit-buffer-size-and-performance-tuning.aspx
2924  */
2925 #define CIFS_DEFAULT_NON_POSIX_RSIZE (60 * 1024)
2926 #define CIFS_DEFAULT_NON_POSIX_WSIZE (65536)
2927
2928 /*
2929  * On hosts with high memory, we can't currently support wsize/rsize that are
2930  * larger than we can kmap at once. Cap the rsize/wsize at
2931  * LAST_PKMAP * PAGE_SIZE. We'll never be able to fill a read or write request
2932  * larger than that anyway.
2933  */
2934 #ifdef CONFIG_HIGHMEM
2935 #define CIFS_KMAP_SIZE_LIMIT    (LAST_PKMAP * PAGE_CACHE_SIZE)
2936 #else /* CONFIG_HIGHMEM */
2937 #define CIFS_KMAP_SIZE_LIMIT    (1<<24)
2938 #endif /* CONFIG_HIGHMEM */
2939
2940 static unsigned int
2941 cifs_negotiate_wsize(struct cifs_tcon *tcon, struct smb_vol *pvolume_info)
2942 {
2943         __u64 unix_cap = le64_to_cpu(tcon->fsUnixInfo.Capability);
2944         struct TCP_Server_Info *server = tcon->ses->server;
2945         unsigned int wsize;
2946
2947         /* start with specified wsize, or default */
2948         if (pvolume_info->wsize)
2949                 wsize = pvolume_info->wsize;
2950         else if (tcon->unix_ext && (unix_cap & CIFS_UNIX_LARGE_WRITE_CAP))
2951                 wsize = CIFS_DEFAULT_IOSIZE;
2952         else
2953                 wsize = CIFS_DEFAULT_NON_POSIX_WSIZE;
2954
2955         /* can server support 24-bit write sizes? (via UNIX extensions) */
2956         if (!tcon->unix_ext || !(unix_cap & CIFS_UNIX_LARGE_WRITE_CAP))
2957                 wsize = min_t(unsigned int, wsize, CIFS_MAX_RFC1002_WSIZE);
2958
2959         /*
2960          * no CAP_LARGE_WRITE_X or is signing enabled without CAP_UNIX set?
2961          * Limit it to max buffer offered by the server, minus the size of the
2962          * WRITEX header, not including the 4 byte RFC1001 length.
2963          */
2964         if (!(server->capabilities & CAP_LARGE_WRITE_X) ||
2965             (!(server->capabilities & CAP_UNIX) &&
2966              (server->sec_mode & (SECMODE_SIGN_ENABLED|SECMODE_SIGN_REQUIRED))))
2967                 wsize = min_t(unsigned int, wsize,
2968                                 server->maxBuf - sizeof(WRITE_REQ) + 4);
2969
2970         /* limit to the amount that we can kmap at once */
2971         wsize = min_t(unsigned int, wsize, CIFS_KMAP_SIZE_LIMIT);
2972
2973         /* hard limit of CIFS_MAX_WSIZE */
2974         wsize = min_t(unsigned int, wsize, CIFS_MAX_WSIZE);
2975
2976         return wsize;
2977 }
2978
2979 static unsigned int
2980 cifs_negotiate_rsize(struct cifs_tcon *tcon, struct smb_vol *pvolume_info)
2981 {
2982         __u64 unix_cap = le64_to_cpu(tcon->fsUnixInfo.Capability);
2983         struct TCP_Server_Info *server = tcon->ses->server;
2984         unsigned int rsize, defsize;
2985
2986         /*
2987          * Set default value...
2988          *
2989          * HACK alert! Ancient servers have very small buffers. Even though
2990          * MS-CIFS indicates that servers are only limited by the client's
2991          * bufsize for reads, testing against win98se shows that it throws
2992          * INVALID_PARAMETER errors if you try to request too large a read.
2993          * OS/2 just sends back short reads.
2994          *
2995          * If the server doesn't advertise CAP_LARGE_READ_X, then assume that
2996          * it can't handle a read request larger than its MaxBufferSize either.
2997          */
2998         if (tcon->unix_ext && (unix_cap & CIFS_UNIX_LARGE_READ_CAP))
2999                 defsize = CIFS_DEFAULT_IOSIZE;
3000         else if (server->capabilities & CAP_LARGE_READ_X)
3001                 defsize = CIFS_DEFAULT_NON_POSIX_RSIZE;
3002         else
3003                 defsize = server->maxBuf - sizeof(READ_RSP);
3004
3005         rsize = pvolume_info->rsize ? pvolume_info->rsize : defsize;
3006
3007         /*
3008          * no CAP_LARGE_READ_X? Then MS-CIFS states that we must limit this to
3009          * the client's MaxBufferSize.
3010          */
3011         if (!(server->capabilities & CAP_LARGE_READ_X))
3012                 rsize = min_t(unsigned int, CIFSMaxBufSize, rsize);
3013
3014         /* limit to the amount that we can kmap at once */
3015         rsize = min_t(unsigned int, rsize, CIFS_KMAP_SIZE_LIMIT);
3016
3017         /* hard limit of CIFS_MAX_RSIZE */
3018         rsize = min_t(unsigned int, rsize, CIFS_MAX_RSIZE);
3019
3020         return rsize;
3021 }
3022
3023 static int
3024 is_path_accessible(int xid, struct cifs_tcon *tcon,
3025                    struct cifs_sb_info *cifs_sb, const char *full_path)
3026 {
3027         int rc;
3028         FILE_ALL_INFO *pfile_info;
3029
3030         pfile_info = kmalloc(sizeof(FILE_ALL_INFO), GFP_KERNEL);
3031         if (pfile_info == NULL)
3032                 return -ENOMEM;
3033
3034         rc = CIFSSMBQPathInfo(xid, tcon, full_path, pfile_info,
3035                               0 /* not legacy */, cifs_sb->local_nls,
3036                               cifs_sb->mnt_cifs_flags &
3037                                 CIFS_MOUNT_MAP_SPECIAL_CHR);
3038
3039         if (rc == -EOPNOTSUPP || rc == -EINVAL)
3040                 rc = SMBQueryInformation(xid, tcon, full_path, pfile_info,
3041                                 cifs_sb->local_nls, cifs_sb->mnt_cifs_flags &
3042                                   CIFS_MOUNT_MAP_SPECIAL_CHR);
3043         kfree(pfile_info);
3044         return rc;
3045 }
3046
3047 static void
3048 cleanup_volume_info_contents(struct smb_vol *volume_info)
3049 {
3050         kfree(volume_info->username);
3051         kzfree(volume_info->password);
3052         if (volume_info->UNCip != volume_info->UNC + 2)
3053                 kfree(volume_info->UNCip);
3054         kfree(volume_info->UNC);
3055         kfree(volume_info->domainname);
3056         kfree(volume_info->iocharset);
3057         kfree(volume_info->prepath);
3058 }
3059
3060 void
3061 cifs_cleanup_volume_info(struct smb_vol *volume_info)
3062 {
3063         if (!volume_info)
3064                 return;
3065         cleanup_volume_info_contents(volume_info);
3066         kfree(volume_info);
3067 }
3068
3069
3070 #ifdef CONFIG_CIFS_DFS_UPCALL
3071 /* build_path_to_root returns full path to root when
3072  * we do not have an exiting connection (tcon) */
3073 static char *
3074 build_unc_path_to_root(const struct smb_vol *vol,
3075                 const struct cifs_sb_info *cifs_sb)
3076 {
3077         char *full_path, *pos;
3078         unsigned int pplen = vol->prepath ? strlen(vol->prepath) : 0;
3079         unsigned int unc_len = strnlen(vol->UNC, MAX_TREE_SIZE + 1);
3080
3081         full_path = kmalloc(unc_len + pplen + 1, GFP_KERNEL);
3082         if (full_path == NULL)
3083                 return ERR_PTR(-ENOMEM);
3084
3085         strncpy(full_path, vol->UNC, unc_len);
3086         pos = full_path + unc_len;
3087
3088         if (pplen) {
3089                 strncpy(pos, vol->prepath, pplen);
3090                 pos += pplen;
3091         }
3092
3093         *pos = '\0'; /* add trailing null */
3094         convert_delimiter(full_path, CIFS_DIR_SEP(cifs_sb));
3095         cFYI(1, "%s: full_path=%s", __func__, full_path);
3096         return full_path;
3097 }
3098
3099 /*
3100  * Perform a dfs referral query for a share and (optionally) prefix
3101  *
3102  * If a referral is found, cifs_sb->mountdata will be (re-)allocated
3103  * to a string containing updated options for the submount.  Otherwise it
3104  * will be left untouched.
3105  *
3106  * Returns the rc from get_dfs_path to the caller, which can be used to
3107  * determine whether there were referrals.
3108  */
3109 static int
3110 expand_dfs_referral(int xid, struct cifs_ses *pSesInfo,
3111                     struct smb_vol *volume_info, struct cifs_sb_info *cifs_sb,
3112                     int check_prefix)
3113 {
3114         int rc;
3115         unsigned int num_referrals = 0;
3116         struct dfs_info3_param *referrals = NULL;
3117         char *full_path = NULL, *ref_path = NULL, *mdata = NULL;
3118
3119         full_path = build_unc_path_to_root(volume_info, cifs_sb);
3120         if (IS_ERR(full_path))
3121                 return PTR_ERR(full_path);
3122
3123         /* For DFS paths, skip the first '\' of the UNC */
3124         ref_path = check_prefix ? full_path + 1 : volume_info->UNC + 1;
3125
3126         rc = get_dfs_path(xid, pSesInfo , ref_path, cifs_sb->local_nls,
3127                           &num_referrals, &referrals,
3128                           cifs_sb->mnt_cifs_flags & CIFS_MOUNT_MAP_SPECIAL_CHR);
3129
3130         if (!rc && num_referrals > 0) {
3131                 char *fake_devname = NULL;
3132
3133                 mdata = cifs_compose_mount_options(cifs_sb->mountdata,
3134                                                    full_path + 1, referrals,
3135                                                    &fake_devname);
3136
3137                 free_dfs_info_array(referrals, num_referrals);
3138
3139                 if (IS_ERR(mdata)) {
3140                         rc = PTR_ERR(mdata);
3141                         mdata = NULL;
3142                 } else {
3143                         cleanup_volume_info_contents(volume_info);
3144                         memset(volume_info, '\0', sizeof(*volume_info));
3145                         rc = cifs_setup_volume_info(volume_info, mdata,
3146                                                         fake_devname);
3147                 }
3148                 kfree(fake_devname);
3149                 kfree(cifs_sb->mountdata);
3150                 cifs_sb->mountdata = mdata;
3151         }
3152         kfree(full_path);
3153         return rc;
3154 }
3155 #endif
3156
3157 static int
3158 cifs_setup_volume_info(struct smb_vol *volume_info, char *mount_data,
3159                         const char *devname)
3160 {
3161         int rc = 0;
3162
3163         if (cifs_parse_mount_options(mount_data, devname, volume_info))
3164                 return -EINVAL;
3165
3166         if (volume_info->nullauth) {
3167                 cFYI(1, "null user");
3168                 volume_info->username = kzalloc(1, GFP_KERNEL);
3169                 if (volume_info->username == NULL)
3170                         return -ENOMEM;
3171         } else if (volume_info->username) {
3172                 /* BB fixme parse for domain name here */
3173                 cFYI(1, "Username: %s", volume_info->username);
3174         } else {
3175                 cifserror("No username specified");
3176         /* In userspace mount helper we can get user name from alternate
3177            locations such as env variables and files on disk */
3178                 return -EINVAL;
3179         }
3180
3181         /* this is needed for ASCII cp to Unicode converts */
3182         if (volume_info->iocharset == NULL) {
3183                 /* load_nls_default cannot return null */
3184                 volume_info->local_nls = load_nls_default();
3185         } else {
3186                 volume_info->local_nls = load_nls(volume_info->iocharset);
3187                 if (volume_info->local_nls == NULL) {
3188                         cERROR(1, "CIFS mount error: iocharset %s not found",
3189                                  volume_info->iocharset);
3190                         return -ELIBACC;
3191                 }
3192         }
3193
3194         return rc;
3195 }
3196
3197 struct smb_vol *
3198 cifs_get_volume_info(char *mount_data, const char *devname)
3199 {
3200         int rc;
3201         struct smb_vol *volume_info;
3202
3203         volume_info = kzalloc(sizeof(struct smb_vol), GFP_KERNEL);
3204         if (!volume_info)
3205                 return ERR_PTR(-ENOMEM);
3206
3207         rc = cifs_setup_volume_info(volume_info, mount_data, devname);
3208         if (rc) {
3209                 cifs_cleanup_volume_info(volume_info);
3210                 volume_info = ERR_PTR(rc);
3211         }
3212
3213         return volume_info;
3214 }
3215
3216 /* make sure ra_pages is a multiple of rsize */
3217 static inline unsigned int
3218 cifs_ra_pages(struct cifs_sb_info *cifs_sb)
3219 {
3220         unsigned int reads;
3221         unsigned int rsize_pages = cifs_sb->rsize / PAGE_CACHE_SIZE;
3222
3223         if (rsize_pages >= default_backing_dev_info.ra_pages)
3224                 return default_backing_dev_info.ra_pages;
3225         else if (rsize_pages == 0)
3226                 return rsize_pages;
3227
3228         reads = default_backing_dev_info.ra_pages / rsize_pages;
3229         return reads * rsize_pages;
3230 }
3231
3232 int
3233 cifs_mount(struct cifs_sb_info *cifs_sb, struct smb_vol *volume_info)
3234 {
3235         int rc;
3236         int xid;
3237         struct cifs_ses *pSesInfo;
3238         struct cifs_tcon *tcon;
3239         struct TCP_Server_Info *srvTcp;
3240         char   *full_path;
3241         struct tcon_link *tlink;
3242 #ifdef CONFIG_CIFS_DFS_UPCALL
3243         int referral_walks_count = 0;
3244 #endif
3245
3246         rc = bdi_setup_and_register(&cifs_sb->bdi, "cifs", BDI_CAP_MAP_COPY);
3247         if (rc)
3248                 return rc;
3249
3250 #ifdef CONFIG_CIFS_DFS_UPCALL
3251 try_mount_again:
3252         /* cleanup activities if we're chasing a referral */
3253         if (referral_walks_count) {
3254                 if (tcon)
3255                         cifs_put_tcon(tcon);
3256                 else if (pSesInfo)
3257                         cifs_put_smb_ses(pSesInfo);
3258
3259                 FreeXid(xid);
3260         }
3261 #endif
3262         rc = 0;
3263         tcon = NULL;
3264         pSesInfo = NULL;
3265         srvTcp = NULL;
3266         full_path = NULL;
3267         tlink = NULL;
3268
3269         xid = GetXid();
3270
3271         /* get a reference to a tcp session */
3272         srvTcp = cifs_get_tcp_session(volume_info);
3273         if (IS_ERR(srvTcp)) {
3274                 rc = PTR_ERR(srvTcp);
3275                 bdi_destroy(&cifs_sb->bdi);
3276                 goto out;
3277         }
3278
3279         /* get a reference to a SMB session */
3280         pSesInfo = cifs_get_smb_ses(srvTcp, volume_info);
3281         if (IS_ERR(pSesInfo)) {
3282                 rc = PTR_ERR(pSesInfo);
3283                 pSesInfo = NULL;
3284                 goto mount_fail_check;
3285         }
3286
3287         /* search for existing tcon to this server share */
3288         tcon = cifs_get_tcon(pSesInfo, volume_info);
3289         if (IS_ERR(tcon)) {
3290                 rc = PTR_ERR(tcon);
3291                 tcon = NULL;
3292                 goto remote_path_check;
3293         }
3294
3295         /* tell server which Unix caps we support */
3296         if (tcon->ses->capabilities & CAP_UNIX) {
3297                 /* reset of caps checks mount to see if unix extensions
3298                    disabled for just this mount */
3299                 reset_cifs_unix_caps(xid, tcon, cifs_sb, volume_info);
3300                 if ((tcon->ses->server->tcpStatus == CifsNeedReconnect) &&
3301                     (le64_to_cpu(tcon->fsUnixInfo.Capability) &
3302                      CIFS_UNIX_TRANSPORT_ENCRYPTION_MANDATORY_CAP)) {
3303                         rc = -EACCES;
3304                         goto mount_fail_check;
3305                 }
3306         } else
3307                 tcon->unix_ext = 0; /* server does not support them */
3308
3309         /* do not care if following two calls succeed - informational */
3310         if (!tcon->ipc) {
3311                 CIFSSMBQFSDeviceInfo(xid, tcon);
3312                 CIFSSMBQFSAttributeInfo(xid, tcon);
3313         }
3314
3315         cifs_sb->wsize = cifs_negotiate_wsize(tcon, volume_info);
3316         cifs_sb->rsize = cifs_negotiate_rsize(tcon, volume_info);
3317
3318         /* tune readahead according to rsize */
3319         cifs_sb->bdi.ra_pages = cifs_ra_pages(cifs_sb);
3320
3321 remote_path_check:
3322 #ifdef CONFIG_CIFS_DFS_UPCALL
3323         /*
3324          * Perform an unconditional check for whether there are DFS
3325          * referrals for this path without prefix, to provide support
3326          * for DFS referrals from w2k8 servers which don't seem to respond
3327          * with PATH_NOT_COVERED to requests that include the prefix.
3328          * Chase the referral if found, otherwise continue normally.
3329          */
3330         if (referral_walks_count == 0) {
3331                 int refrc = expand_dfs_referral(xid, pSesInfo, volume_info,
3332                                                 cifs_sb, false);
3333                 if (!refrc) {
3334                         referral_walks_count++;
3335                         goto try_mount_again;
3336                 }
3337         }
3338 #endif
3339
3340         /* check if a whole path is not remote */
3341         if (!rc && tcon) {
3342                 /* build_path_to_root works only when we have a valid tcon */
3343                 full_path = cifs_build_path_to_root(volume_info, cifs_sb, tcon);
3344                 if (full_path == NULL) {
3345                         rc = -ENOMEM;
3346                         goto mount_fail_check;
3347                 }
3348                 rc = is_path_accessible(xid, tcon, cifs_sb, full_path);
3349                 if (rc != 0 && rc != -EREMOTE) {
3350                         kfree(full_path);
3351                         goto mount_fail_check;
3352                 }
3353                 kfree(full_path);
3354         }
3355
3356         /* get referral if needed */
3357         if (rc == -EREMOTE) {
3358 #ifdef CONFIG_CIFS_DFS_UPCALL
3359                 if (referral_walks_count > MAX_NESTED_LINKS) {
3360                         /*
3361                          * BB: when we implement proper loop detection,
3362                          *     we will remove this check. But now we need it
3363                          *     to prevent an indefinite loop if 'DFS tree' is
3364                          *     misconfigured (i.e. has loops).
3365                          */
3366                         rc = -ELOOP;
3367                         goto mount_fail_check;
3368                 }
3369
3370                 rc = expand_dfs_referral(xid, pSesInfo, volume_info, cifs_sb,
3371                                          true);
3372
3373                 if (!rc) {
3374                         referral_walks_count++;
3375                         goto try_mount_again;
3376                 }
3377                 goto mount_fail_check;
3378 #else /* No DFS support, return error on mount */
3379                 rc = -EOPNOTSUPP;
3380 #endif
3381         }
3382
3383         if (rc)
3384                 goto mount_fail_check;
3385
3386         /* now, hang the tcon off of the superblock */
3387         tlink = kzalloc(sizeof *tlink, GFP_KERNEL);
3388         if (tlink == NULL) {
3389                 rc = -ENOMEM;
3390                 goto mount_fail_check;
3391         }
3392
3393         tlink->tl_uid = pSesInfo->linux_uid;
3394         tlink->tl_tcon = tcon;
3395         tlink->tl_time = jiffies;
3396         set_bit(TCON_LINK_MASTER, &tlink->tl_flags);
3397         set_bit(TCON_LINK_IN_TREE, &tlink->tl_flags);
3398
3399         cifs_sb->master_tlink = tlink;
3400         spin_lock(&cifs_sb->tlink_tree_lock);
3401         tlink_rb_insert(&cifs_sb->tlink_tree, tlink);
3402         spin_unlock(&cifs_sb->tlink_tree_lock);
3403
3404         queue_delayed_work(system_nrt_wq, &cifs_sb->prune_tlinks,
3405                                 TLINK_IDLE_EXPIRE);
3406
3407 mount_fail_check:
3408         /* on error free sesinfo and tcon struct if needed */
3409         if (rc) {
3410                 /* If find_unc succeeded then rc == 0 so we can not end */
3411                 /* up accidentally freeing someone elses tcon struct */
3412                 if (tcon)
3413                         cifs_put_tcon(tcon);
3414                 else if (pSesInfo)
3415                         cifs_put_smb_ses(pSesInfo);
3416                 else
3417                         cifs_put_tcp_session(srvTcp);
3418                 bdi_destroy(&cifs_sb->bdi);
3419         }
3420
3421 out:
3422         FreeXid(xid);
3423         return rc;
3424 }
3425
3426 /*
3427  * Issue a TREE_CONNECT request. Note that for IPC$ shares, that the tcon
3428  * pointer may be NULL.
3429  */
3430 int
3431 CIFSTCon(unsigned int xid, struct cifs_ses *ses,
3432          const char *tree, struct cifs_tcon *tcon,
3433          const struct nls_table *nls_codepage)
3434 {
3435         struct smb_hdr *smb_buffer;
3436         struct smb_hdr *smb_buffer_response;
3437         TCONX_REQ *pSMB;
3438         TCONX_RSP *pSMBr;
3439         unsigned char *bcc_ptr;
3440         int rc = 0;
3441         int length;
3442         __u16 bytes_left, count;
3443
3444         if (ses == NULL)
3445                 return -EIO;
3446
3447         smb_buffer = cifs_buf_get();
3448         if (smb_buffer == NULL)
3449                 return -ENOMEM;
3450
3451         smb_buffer_response = smb_buffer;
3452
3453         header_assemble(smb_buffer, SMB_COM_TREE_CONNECT_ANDX,
3454                         NULL /*no tid */ , 4 /*wct */ );
3455
3456         smb_buffer->Mid = GetNextMid(ses->server);
3457         smb_buffer->Uid = ses->Suid;
3458         pSMB = (TCONX_REQ *) smb_buffer;
3459         pSMBr = (TCONX_RSP *) smb_buffer_response;
3460
3461         pSMB->AndXCommand = 0xFF;
3462         pSMB->Flags = cpu_to_le16(TCON_EXTENDED_SECINFO);
3463         bcc_ptr = &pSMB->Password[0];
3464         if (!tcon || (ses->server->sec_mode & SECMODE_USER)) {
3465                 pSMB->PasswordLength = cpu_to_le16(1);  /* minimum */
3466                 *bcc_ptr = 0; /* password is null byte */
3467                 bcc_ptr++;              /* skip password */
3468                 /* already aligned so no need to do it below */
3469         } else {
3470                 pSMB->PasswordLength = cpu_to_le16(CIFS_AUTH_RESP_SIZE);
3471                 /* BB FIXME add code to fail this if NTLMv2 or Kerberos
3472                    specified as required (when that support is added to
3473                    the vfs in the future) as only NTLM or the much
3474                    weaker LANMAN (which we do not send by default) is accepted
3475                    by Samba (not sure whether other servers allow
3476                    NTLMv2 password here) */
3477 #ifdef CONFIG_CIFS_WEAK_PW_HASH
3478                 if ((global_secflags & CIFSSEC_MAY_LANMAN) &&
3479                     (ses->server->secType == LANMAN))
3480                         calc_lanman_hash(tcon->password, ses->server->cryptkey,
3481                                          ses->server->sec_mode &
3482                                             SECMODE_PW_ENCRYPT ? true : false,
3483                                          bcc_ptr);
3484                 else
3485 #endif /* CIFS_WEAK_PW_HASH */
3486                 rc = SMBNTencrypt(tcon->password, ses->server->cryptkey,
3487                                         bcc_ptr, nls_codepage);
3488
3489                 bcc_ptr += CIFS_AUTH_RESP_SIZE;
3490                 if (ses->capabilities & CAP_UNICODE) {
3491                         /* must align unicode strings */
3492                         *bcc_ptr = 0; /* null byte password */
3493                         bcc_ptr++;
3494                 }
3495         }
3496
3497         if (ses->server->sec_mode &
3498                         (SECMODE_SIGN_REQUIRED | SECMODE_SIGN_ENABLED))
3499                 smb_buffer->Flags2 |= SMBFLG2_SECURITY_SIGNATURE;
3500
3501         if (ses->capabilities & CAP_STATUS32) {
3502                 smb_buffer->Flags2 |= SMBFLG2_ERR_STATUS;
3503         }
3504         if (ses->capabilities & CAP_DFS) {
3505                 smb_buffer->Flags2 |= SMBFLG2_DFS;
3506         }
3507         if (ses->capabilities & CAP_UNICODE) {
3508                 smb_buffer->Flags2 |= SMBFLG2_UNICODE;
3509                 length =
3510                     cifs_strtoUCS((__le16 *) bcc_ptr, tree,
3511                         6 /* max utf8 char length in bytes */ *
3512                         (/* server len*/ + 256 /* share len */), nls_codepage);
3513                 bcc_ptr += 2 * length;  /* convert num 16 bit words to bytes */
3514                 bcc_ptr += 2;   /* skip trailing null */
3515         } else {                /* ASCII */
3516                 strcpy(bcc_ptr, tree);
3517                 bcc_ptr += strlen(tree) + 1;
3518         }
3519         strcpy(bcc_ptr, "?????");
3520         bcc_ptr += strlen("?????");
3521         bcc_ptr += 1;
3522         count = bcc_ptr - &pSMB->Password[0];
3523         pSMB->hdr.smb_buf_length = cpu_to_be32(be32_to_cpu(
3524                                         pSMB->hdr.smb_buf_length) + count);
3525         pSMB->ByteCount = cpu_to_le16(count);
3526
3527         rc = SendReceive(xid, ses, smb_buffer, smb_buffer_response, &length,
3528                          0);
3529
3530         /* above now done in SendReceive */
3531         if ((rc == 0) && (tcon != NULL)) {
3532                 bool is_unicode;
3533
3534                 tcon->tidStatus = CifsGood;
3535                 tcon->need_reconnect = false;
3536                 tcon->tid = smb_buffer_response->Tid;
3537                 bcc_ptr = pByteArea(smb_buffer_response);
3538                 bytes_left = get_bcc(smb_buffer_response);
3539                 length = strnlen(bcc_ptr, bytes_left - 2);
3540                 if (smb_buffer->Flags2 & SMBFLG2_UNICODE)
3541                         is_unicode = true;
3542                 else
3543                         is_unicode = false;
3544
3545
3546                 /* skip service field (NB: this field is always ASCII) */
3547                 if (length == 3) {
3548                         if ((bcc_ptr[0] == 'I') && (bcc_ptr[1] == 'P') &&
3549                             (bcc_ptr[2] == 'C')) {
3550                                 cFYI(1, "IPC connection");
3551                                 tcon->ipc = 1;
3552                         }
3553                 } else if (length == 2) {
3554                         if ((bcc_ptr[0] == 'A') && (bcc_ptr[1] == ':')) {
3555                                 /* the most common case */
3556                                 cFYI(1, "disk share connection");
3557                         }
3558                 }
3559                 bcc_ptr += length + 1;
3560                 bytes_left -= (length + 1);
3561                 strncpy(tcon->treeName, tree, MAX_TREE_SIZE);
3562
3563                 /* mostly informational -- no need to fail on error here */
3564                 kfree(tcon->nativeFileSystem);
3565                 tcon->nativeFileSystem = cifs_strndup_from_ucs(bcc_ptr,
3566                                                       bytes_left, is_unicode,
3567                                                       nls_codepage);
3568
3569                 cFYI(1, "nativeFileSystem=%s", tcon->nativeFileSystem);
3570
3571                 if ((smb_buffer_response->WordCount == 3) ||
3572                          (smb_buffer_response->WordCount == 7))
3573                         /* field is in same location */
3574                         tcon->Flags = le16_to_cpu(pSMBr->OptionalSupport);
3575                 else
3576                         tcon->Flags = 0;
3577                 cFYI(1, "Tcon flags: 0x%x ", tcon->Flags);
3578         } else if ((rc == 0) && tcon == NULL) {
3579                 /* all we need to save for IPC$ connection */
3580                 ses->ipc_tid = smb_buffer_response->Tid;
3581         }
3582
3583         cifs_buf_release(smb_buffer);
3584         return rc;
3585 }
3586
3587 void
3588 cifs_umount(struct cifs_sb_info *cifs_sb)
3589 {
3590         struct rb_root *root = &cifs_sb->tlink_tree;
3591         struct rb_node *node;
3592         struct tcon_link *tlink;
3593
3594         cancel_delayed_work_sync(&cifs_sb->prune_tlinks);
3595
3596         spin_lock(&cifs_sb->tlink_tree_lock);
3597         while ((node = rb_first(root))) {
3598                 tlink = rb_entry(node, struct tcon_link, tl_rbnode);
3599                 cifs_get_tlink(tlink);
3600                 clear_bit(TCON_LINK_IN_TREE, &tlink->tl_flags);
3601                 rb_erase(node, root);
3602
3603                 spin_unlock(&cifs_sb->tlink_tree_lock);
3604                 cifs_put_tlink(tlink);
3605                 spin_lock(&cifs_sb->tlink_tree_lock);
3606         }
3607         spin_unlock(&cifs_sb->tlink_tree_lock);
3608
3609         bdi_destroy(&cifs_sb->bdi);
3610         kfree(cifs_sb->mountdata);
3611         unload_nls(cifs_sb->local_nls);
3612         kfree(cifs_sb);
3613 }
3614
3615 int cifs_negotiate_protocol(unsigned int xid, struct cifs_ses *ses)
3616 {
3617         int rc = 0;
3618         struct TCP_Server_Info *server = ses->server;
3619
3620         /* only send once per connect */
3621         if (server->maxBuf != 0)
3622                 return 0;
3623
3624         rc = CIFSSMBNegotiate(xid, ses);
3625         if (rc == -EAGAIN) {
3626                 /* retry only once on 1st time connection */
3627                 rc = CIFSSMBNegotiate(xid, ses);
3628                 if (rc == -EAGAIN)
3629                         rc = -EHOSTDOWN;
3630         }
3631         if (rc == 0) {
3632                 spin_lock(&GlobalMid_Lock);
3633                 if (server->tcpStatus == CifsNeedNegotiate)
3634                         server->tcpStatus = CifsGood;
3635                 else
3636                         rc = -EHOSTDOWN;
3637                 spin_unlock(&GlobalMid_Lock);
3638
3639         }
3640
3641         return rc;
3642 }
3643
3644
3645 int cifs_setup_session(unsigned int xid, struct cifs_ses *ses,
3646                         struct nls_table *nls_info)
3647 {
3648         int rc = 0;
3649         struct TCP_Server_Info *server = ses->server;
3650
3651         ses->flags = 0;
3652         ses->capabilities = server->capabilities;
3653         if (linuxExtEnabled == 0)
3654                 ses->capabilities &= (~CAP_UNIX);
3655
3656         cFYI(1, "Security Mode: 0x%x Capabilities: 0x%x TimeAdjust: %d",
3657                  server->sec_mode, server->capabilities, server->timeAdj);
3658
3659         rc = CIFS_SessSetup(xid, ses, nls_info);
3660         if (rc) {
3661                 cERROR(1, "Send error in SessSetup = %d", rc);
3662         } else {
3663                 mutex_lock(&ses->server->srv_mutex);
3664                 if (!server->session_estab) {
3665                         server->session_key.response = ses->auth_key.response;
3666                         server->session_key.len = ses->auth_key.len;
3667                         server->sequence_number = 0x2;
3668                         server->session_estab = true;
3669                         ses->auth_key.response = NULL;
3670                 }
3671                 mutex_unlock(&server->srv_mutex);
3672
3673                 cFYI(1, "CIFS Session Established successfully");
3674                 spin_lock(&GlobalMid_Lock);
3675                 ses->status = CifsGood;
3676                 ses->need_reconnect = false;
3677                 spin_unlock(&GlobalMid_Lock);
3678         }
3679
3680         kfree(ses->auth_key.response);
3681         ses->auth_key.response = NULL;
3682         ses->auth_key.len = 0;
3683         kfree(ses->ntlmssp);
3684         ses->ntlmssp = NULL;
3685
3686         return rc;
3687 }
3688
3689 static struct cifs_tcon *
3690 cifs_construct_tcon(struct cifs_sb_info *cifs_sb, uid_t fsuid)
3691 {
3692         struct cifs_tcon *master_tcon = cifs_sb_master_tcon(cifs_sb);
3693         struct cifs_ses *ses;
3694         struct cifs_tcon *tcon = NULL;
3695         struct smb_vol *vol_info;
3696         char username[28]; /* big enough for "krb50x" + hex of ULONG_MAX 6+16 */
3697                            /* We used to have this as MAX_USERNAME which is   */
3698                            /* way too big now (256 instead of 32) */
3699
3700         vol_info = kzalloc(sizeof(*vol_info), GFP_KERNEL);
3701         if (vol_info == NULL) {
3702                 tcon = ERR_PTR(-ENOMEM);
3703                 goto out;
3704         }
3705
3706         snprintf(username, sizeof(username), "krb50x%x", fsuid);
3707         vol_info->username = username;
3708         vol_info->local_nls = cifs_sb->local_nls;
3709         vol_info->linux_uid = fsuid;
3710         vol_info->cred_uid = fsuid;
3711         vol_info->UNC = master_tcon->treeName;
3712         vol_info->retry = master_tcon->retry;
3713         vol_info->nocase = master_tcon->nocase;
3714         vol_info->local_lease = master_tcon->local_lease;
3715         vol_info->no_linux_ext = !master_tcon->unix_ext;
3716
3717         /* FIXME: allow for other secFlg settings */
3718         vol_info->secFlg = CIFSSEC_MUST_KRB5;
3719
3720         /* get a reference for the same TCP session */
3721         spin_lock(&cifs_tcp_ses_lock);
3722         ++master_tcon->ses->server->srv_count;
3723         spin_unlock(&cifs_tcp_ses_lock);
3724
3725         ses = cifs_get_smb_ses(master_tcon->ses->server, vol_info);
3726         if (IS_ERR(ses)) {
3727                 tcon = (struct cifs_tcon *)ses;
3728                 cifs_put_tcp_session(master_tcon->ses->server);
3729                 goto out;
3730         }
3731
3732         tcon = cifs_get_tcon(ses, vol_info);
3733         if (IS_ERR(tcon)) {
3734                 cifs_put_smb_ses(ses);
3735                 goto out;
3736         }
3737
3738         if (ses->capabilities & CAP_UNIX)
3739                 reset_cifs_unix_caps(0, tcon, NULL, vol_info);
3740 out:
3741         kfree(vol_info);
3742
3743         return tcon;
3744 }
3745
3746 struct cifs_tcon *
3747 cifs_sb_master_tcon(struct cifs_sb_info *cifs_sb)
3748 {
3749         return tlink_tcon(cifs_sb_master_tlink(cifs_sb));
3750 }
3751
3752 static int
3753 cifs_sb_tcon_pending_wait(void *unused)
3754 {
3755         schedule();
3756         return signal_pending(current) ? -ERESTARTSYS : 0;
3757 }
3758
3759 /* find and return a tlink with given uid */
3760 static struct tcon_link *
3761 tlink_rb_search(struct rb_root *root, uid_t uid)
3762 {
3763         struct rb_node *node = root->rb_node;
3764         struct tcon_link *tlink;
3765
3766         while (node) {
3767                 tlink = rb_entry(node, struct tcon_link, tl_rbnode);
3768
3769                 if (tlink->tl_uid > uid)
3770                         node = node->rb_left;
3771                 else if (tlink->tl_uid < uid)
3772                         node = node->rb_right;
3773                 else
3774                         return tlink;
3775         }
3776         return NULL;
3777 }
3778
3779 /* insert a tcon_link into the tree */
3780 static void
3781 tlink_rb_insert(struct rb_root *root, struct tcon_link *new_tlink)
3782 {
3783         struct rb_node **new = &(root->rb_node), *parent = NULL;
3784         struct tcon_link *tlink;
3785
3786         while (*new) {
3787                 tlink = rb_entry(*new, struct tcon_link, tl_rbnode);
3788                 parent = *new;
3789
3790                 if (tlink->tl_uid > new_tlink->tl_uid)
3791                         new = &((*new)->rb_left);
3792                 else
3793                         new = &((*new)->rb_right);
3794         }
3795
3796         rb_link_node(&new_tlink->tl_rbnode, parent, new);
3797         rb_insert_color(&new_tlink->tl_rbnode, root);
3798 }
3799
3800 /*
3801  * Find or construct an appropriate tcon given a cifs_sb and the fsuid of the
3802  * current task.
3803  *
3804  * If the superblock doesn't refer to a multiuser mount, then just return
3805  * the master tcon for the mount.
3806  *
3807  * First, search the rbtree for an existing tcon for this fsuid. If one
3808  * exists, then check to see if it's pending construction. If it is then wait
3809  * for construction to complete. Once it's no longer pending, check to see if
3810  * it failed and either return an error or retry construction, depending on
3811  * the timeout.
3812  *
3813  * If one doesn't exist then insert a new tcon_link struct into the tree and
3814  * try to construct a new one.
3815  */
3816 struct tcon_link *
3817 cifs_sb_tlink(struct cifs_sb_info *cifs_sb)
3818 {
3819         int ret;
3820         uid_t fsuid = current_fsuid();
3821         struct tcon_link *tlink, *newtlink;
3822
3823         if (!(cifs_sb->mnt_cifs_flags & CIFS_MOUNT_MULTIUSER))
3824                 return cifs_get_tlink(cifs_sb_master_tlink(cifs_sb));
3825
3826         spin_lock(&cifs_sb->tlink_tree_lock);
3827         tlink = tlink_rb_search(&cifs_sb->tlink_tree, fsuid);
3828         if (tlink)
3829                 cifs_get_tlink(tlink);
3830         spin_unlock(&cifs_sb->tlink_tree_lock);
3831
3832         if (tlink == NULL) {
3833                 newtlink = kzalloc(sizeof(*tlink), GFP_KERNEL);
3834                 if (newtlink == NULL)
3835                         return ERR_PTR(-ENOMEM);
3836                 newtlink->tl_uid = fsuid;
3837                 newtlink->tl_tcon = ERR_PTR(-EACCES);
3838                 set_bit(TCON_LINK_PENDING, &newtlink->tl_flags);
3839                 set_bit(TCON_LINK_IN_TREE, &newtlink->tl_flags);
3840                 cifs_get_tlink(newtlink);
3841
3842                 spin_lock(&cifs_sb->tlink_tree_lock);
3843                 /* was one inserted after previous search? */
3844                 tlink = tlink_rb_search(&cifs_sb->tlink_tree, fsuid);
3845                 if (tlink) {
3846                         cifs_get_tlink(tlink);
3847                         spin_unlock(&cifs_sb->tlink_tree_lock);
3848                         kfree(newtlink);
3849                         goto wait_for_construction;
3850                 }
3851                 tlink = newtlink;
3852                 tlink_rb_insert(&cifs_sb->tlink_tree, tlink);
3853                 spin_unlock(&cifs_sb->tlink_tree_lock);
3854         } else {
3855 wait_for_construction:
3856                 ret = wait_on_bit(&tlink->tl_flags, TCON_LINK_PENDING,
3857                                   cifs_sb_tcon_pending_wait,
3858                                   TASK_INTERRUPTIBLE);
3859                 if (ret) {
3860                         cifs_put_tlink(tlink);
3861                         return ERR_PTR(ret);
3862                 }
3863
3864                 /* if it's good, return it */
3865                 if (!IS_ERR(tlink->tl_tcon))
3866                         return tlink;
3867
3868                 /* return error if we tried this already recently */
3869                 if (time_before(jiffies, tlink->tl_time + TLINK_ERROR_EXPIRE)) {
3870                         cifs_put_tlink(tlink);
3871                         return ERR_PTR(-EACCES);
3872                 }
3873
3874                 if (test_and_set_bit(TCON_LINK_PENDING, &tlink->tl_flags))
3875                         goto wait_for_construction;
3876         }
3877
3878         tlink->tl_tcon = cifs_construct_tcon(cifs_sb, fsuid);
3879         clear_bit(TCON_LINK_PENDING, &tlink->tl_flags);
3880         wake_up_bit(&tlink->tl_flags, TCON_LINK_PENDING);
3881
3882         if (IS_ERR(tlink->tl_tcon)) {
3883                 cifs_put_tlink(tlink);
3884                 return ERR_PTR(-EACCES);
3885         }
3886
3887         return tlink;
3888 }
3889
3890 /*
3891  * periodic workqueue job that scans tcon_tree for a superblock and closes
3892  * out tcons.
3893  */
3894 static void
3895 cifs_prune_tlinks(struct work_struct *work)
3896 {
3897         struct cifs_sb_info *cifs_sb = container_of(work, struct cifs_sb_info,
3898                                                     prune_tlinks.work);
3899         struct rb_root *root = &cifs_sb->tlink_tree;
3900         struct rb_node *node = rb_first(root);
3901         struct rb_node *tmp;
3902         struct tcon_link *tlink;
3903
3904         /*
3905          * Because we drop the spinlock in the loop in order to put the tlink
3906          * it's not guarded against removal of links from the tree. The only
3907          * places that remove entries from the tree are this function and
3908          * umounts. Because this function is non-reentrant and is canceled
3909          * before umount can proceed, this is safe.
3910          */
3911         spin_lock(&cifs_sb->tlink_tree_lock);
3912         node = rb_first(root);
3913         while (node != NULL) {
3914                 tmp = node;
3915                 node = rb_next(tmp);
3916                 tlink = rb_entry(tmp, struct tcon_link, tl_rbnode);
3917
3918                 if (test_bit(TCON_LINK_MASTER, &tlink->tl_flags) ||
3919                     atomic_read(&tlink->tl_count) != 0 ||
3920                     time_after(tlink->tl_time + TLINK_IDLE_EXPIRE, jiffies))
3921                         continue;
3922
3923                 cifs_get_tlink(tlink);
3924                 clear_bit(TCON_LINK_IN_TREE, &tlink->tl_flags);
3925                 rb_erase(tmp, root);
3926
3927                 spin_unlock(&cifs_sb->tlink_tree_lock);
3928                 cifs_put_tlink(tlink);
3929                 spin_lock(&cifs_sb->tlink_tree_lock);
3930         }
3931         spin_unlock(&cifs_sb->tlink_tree_lock);
3932
3933         queue_delayed_work(system_nrt_wq, &cifs_sb->prune_tlinks,
3934                                 TLINK_IDLE_EXPIRE);
3935 }