fs/cifs/connect.c

   1 /*
   2  *   fs/cifs/connect.c
   3  *
   4  *   Copyright (C) International Business Machines  Corp., 2002,2009
   5  *   Author(s): Steve French (sfrench@us.ibm.com)
   6  *
   7  *   This library is free software; you can redistribute it and/or modify
   8  *   it under the terms of the GNU Lesser General Public License as published
   9  *   by the Free Software Foundation; either version 2.1 of the License, or
  10  *   (at your option) any later version.
  11  *
  12  *   This library is distributed in the hope that it will be useful,
  13  *   but WITHOUT ANY WARRANTY; without even the implied warranty of
  14  *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See
  15  *   the GNU Lesser General Public License for more details.
  16  *
  17  *   You should have received a copy of the GNU Lesser General Public License
  18  *   along with this library; if not, write to the Free Software
  19  *   Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
  20  */
  21 #include <linux/fs.h>
  22 #include <linux/net.h>
  23 #include <linux/string.h>
  24 #include <linux/list.h>
  25 #include <linux/wait.h>
  26 #include <linux/slab.h>
  27 #include <linux/pagemap.h>
  28 #include <linux/ctype.h>
  29 #include <linux/utsname.h>
  30 #include <linux/mempool.h>
  31 #include <linux/delay.h>
  32 #include <linux/completion.h>
  33 #include <linux/kthread.h>
  34 #include <linux/pagevec.h>
  35 #include <linux/freezer.h>
  36 #include <linux/namei.h>
  37 #include <asm/uaccess.h>
  38 #include <asm/processor.h>
  39 #include <linux/inet.h>
  40 #include <net/ipv6.h>
  41 #include "cifspdu.h"
  42 #include "cifsglob.h"
  43 #include "cifsproto.h"
  44 #include "cifs_unicode.h"
  45 #include "cifs_debug.h"
  46 #include "cifs_fs_sb.h"
  47 #include "ntlmssp.h"
  48 #include "nterr.h"
  49 #include "rfc1002pdu.h"
  50 #include "fscache.h"
  51
  52 #define CIFS_PORT 445
  53 #define RFC1001_PORT 139
  54
  55 /* SMB echo "timeout" -- FIXME: tunable? */
  56 #define SMB_ECHO_INTERVAL (60 * HZ)
  57
  58 extern mempool_t *cifs_req_poolp;
  59
  60 /* FIXME: should these be tunable? */
  61 #define TLINK_ERROR_EXPIRE      (1 * HZ)
  62 #define TLINK_IDLE_EXPIRE       (600 * HZ)
  63
  64 static int ip_connect(struct TCP_Server_Info *server);
  65 static int generic_ip_connect(struct TCP_Server_Info *server);
  66 static void tlink_rb_insert(struct rb_root *root, struct tcon_link *new_tlink);
  67 static void cifs_prune_tlinks(struct work_struct *work);
  68 static int cifs_setup_volume_info(struct smb_vol *volume_info, char *mount_data,
  69                                         const char *devname);
  70
  71 /*
  72  * cifs tcp session reconnection
  73  *
  74  * mark tcp session as reconnecting so temporarily locked
  75  * mark all smb sessions as reconnecting for tcp session
  76  * reconnect tcp session
  77  * wake up waiters on reconnection? - (not needed currently)
  78  */
  79 static int
  80 cifs_reconnect(struct TCP_Server_Info *server)
  81 {
  82         int rc = 0;
  83         struct list_head *tmp, *tmp2;
  84         struct cifs_ses *ses;
  85         struct cifs_tcon *tcon;
  86         struct mid_q_entry *mid_entry;
  87         struct list_head retry_list;
  88
  89         spin_lock(&GlobalMid_Lock);
  90         if (server->tcpStatus == CifsExiting) {
  91                 /* the demux thread will exit normally
  92                 next time through the loop */
  93                 spin_unlock(&GlobalMid_Lock);
  94                 return rc;
  95         } else
  96                 server->tcpStatus = CifsNeedReconnect;
  97         spin_unlock(&GlobalMid_Lock);
  98         server->maxBuf = 0;
  99
 100         cFYI(1, "Reconnecting tcp session");
 101
 102         /* before reconnecting the tcp session, mark the smb session (uid)
 103                 and the tid bad so they are not used until reconnected */
 104         cFYI(1, "%s: marking sessions and tcons for reconnect", __func__);
 105         spin_lock(&cifs_tcp_ses_lock);
 106         list_for_each(tmp, &server->smb_ses_list) {
 107                 ses = list_entry(tmp, struct cifs_ses, smb_ses_list);
 108                 ses->need_reconnect = true;
 109                 ses->ipc_tid = 0;
 110                 list_for_each(tmp2, &ses->tcon_list) {
 111                         tcon = list_entry(tmp2, struct cifs_tcon, tcon_list);
 112                         tcon->need_reconnect = true;
 113                 }
 114         }
 115         spin_unlock(&cifs_tcp_ses_lock);
 116
 117         /* do not want to be sending data on a socket we are freeing */
 118         cFYI(1, "%s: tearing down socket", __func__);
 119         mutex_lock(&server->srv_mutex);
 120         if (server->ssocket) {
 121                 cFYI(1, "State: 0x%x Flags: 0x%lx", server->ssocket->state,
 122                         server->ssocket->flags);
 123                 kernel_sock_shutdown(server->ssocket, SHUT_WR);
 124                 cFYI(1, "Post shutdown state: 0x%x Flags: 0x%lx",
 125                         server->ssocket->state,
 126                         server->ssocket->flags);
 127                 sock_release(server->ssocket);
 128                 server->ssocket = NULL;
 129         }
 130         server->sequence_number = 0;
 131         server->session_estab = false;
 132         kfree(server->session_key.response);
 133         server->session_key.response = NULL;
 134         server->session_key.len = 0;
 135         server->lstrp = jiffies;
 136         mutex_unlock(&server->srv_mutex);
 137
 138         /* mark submitted MIDs for retry and issue callback */
 139         INIT_LIST_HEAD(&retry_list);
 140         cFYI(1, "%s: moving mids to private list", __func__);
 141         spin_lock(&GlobalMid_Lock);
 142         list_for_each_safe(tmp, tmp2, &server->pending_mid_q) {
 143                 mid_entry = list_entry(tmp, struct mid_q_entry, qhead);
 144                 if (mid_entry->midState == MID_REQUEST_SUBMITTED)
 145                         mid_entry->midState = MID_RETRY_NEEDED;
 146                 list_move(&mid_entry->qhead, &retry_list);
 147         }
 148         spin_unlock(&GlobalMid_Lock);
 149
 150         cFYI(1, "%s: issuing mid callbacks", __func__);
 151         list_for_each_safe(tmp, tmp2, &retry_list) {
 152                 mid_entry = list_entry(tmp, struct mid_q_entry, qhead);
 153                 list_del_init(&mid_entry->qhead);
 154                 mid_entry->callback(mid_entry);
 155         }
 156
 157         do {
 158                 try_to_freeze();
 159
 160                 /* we should try only the port we connected to before */
 161                 rc = generic_ip_connect(server);
 162                 if (rc) {
 163                         cFYI(1, "reconnect error %d", rc);
 164                         msleep(3000);
 165                 } else {
 166                         atomic_inc(&tcpSesReconnectCount);
 167                         spin_lock(&GlobalMid_Lock);
 168                         if (server->tcpStatus != CifsExiting)
 169                                 server->tcpStatus = CifsNeedNegotiate;
 170                         spin_unlock(&GlobalMid_Lock);
 171                 }
 172         } while (server->tcpStatus == CifsNeedReconnect);
 173
 174         return rc;
 175 }
 176
 177 /*
 178         return codes:
 179                 0       not a transact2, or all data present
 180                 >0      transact2 with that much data missing
 181                 -EINVAL = invalid transact2
 182
 183  */
 184 static int check2ndT2(struct smb_hdr *pSMB)
 185 {
 186         struct smb_t2_rsp *pSMBt;
 187         int remaining;
 188         __u16 total_data_size, data_in_this_rsp;
 189
 190         if (pSMB->Command != SMB_COM_TRANSACTION2)
 191                 return 0;
 192
 193         /* check for plausible wct, bcc and t2 data and parm sizes */
 194         /* check for parm and data offset going beyond end of smb */
 195         if (pSMB->WordCount != 10) { /* coalesce_t2 depends on this */
 196                 cFYI(1, "invalid transact2 word count");
 197                 return -EINVAL;
 198         }
 199
 200         pSMBt = (struct smb_t2_rsp *)pSMB;
 201
 202         total_data_size = get_unaligned_le16(&pSMBt->t2_rsp.TotalDataCount);
 203         data_in_this_rsp = get_unaligned_le16(&pSMBt->t2_rsp.DataCount);
 204
 205         if (total_data_size == data_in_this_rsp)
 206                 return 0;
 207         else if (total_data_size < data_in_this_rsp) {
 208                 cFYI(1, "total data %d smaller than data in frame %d",
 209                         total_data_size, data_in_this_rsp);
 210                 return -EINVAL;
 211         }
 212
 213         remaining = total_data_size - data_in_this_rsp;
 214
 215         cFYI(1, "missing %d bytes from transact2, check next response",
 216                 remaining);
 217         if (total_data_size > CIFSMaxBufSize) {
 218                 cERROR(1, "TotalDataSize %d is over maximum buffer %d",
 219                         total_data_size, CIFSMaxBufSize);
 220                 return -EINVAL;
 221         }
 222         return remaining;
 223 }
 224
 225 static int coalesce_t2(struct smb_hdr *psecond, struct smb_hdr *pTargetSMB)
 226 {
 227         struct smb_t2_rsp *pSMB2 = (struct smb_t2_rsp *)psecond;
 228         struct smb_t2_rsp *pSMBt  = (struct smb_t2_rsp *)pTargetSMB;
 229         char *data_area_of_target;
 230         char *data_area_of_buf2;
 231         int remaining;
 232         unsigned int byte_count, total_in_buf;
 233         __u16 total_data_size, total_in_buf2;
 234
 235         total_data_size = get_unaligned_le16(&pSMBt->t2_rsp.TotalDataCount);
 236
 237         if (total_data_size !=
 238             get_unaligned_le16(&pSMB2->t2_rsp.TotalDataCount))
 239                 cFYI(1, "total data size of primary and secondary t2 differ");
 240
 241         total_in_buf = get_unaligned_le16(&pSMBt->t2_rsp.DataCount);
 242
 243         remaining = total_data_size - total_in_buf;
 244
 245         if (remaining < 0)
 246                 return -EPROTO;
 247
 248         if (remaining == 0) /* nothing to do, ignore */
 249                 return 0;
 250
 251         total_in_buf2 = get_unaligned_le16(&pSMB2->t2_rsp.DataCount);
 252         if (remaining < total_in_buf2) {
 253                 cFYI(1, "transact2 2nd response contains too much data");
 254         }
 255
 256         /* find end of first SMB data area */
 257         data_area_of_target = (char *)&pSMBt->hdr.Protocol +
 258                                 get_unaligned_le16(&pSMBt->t2_rsp.DataOffset);
 259         /* validate target area */
 260
 261         data_area_of_buf2 = (char *)&pSMB2->hdr.Protocol +
 262                                 get_unaligned_le16(&pSMB2->t2_rsp.DataOffset);
 263
 264         data_area_of_target += total_in_buf;
 265
 266         /* copy second buffer into end of first buffer */
 267         total_in_buf += total_in_buf2;
 268         /* is the result too big for the field? */
 269         if (total_in_buf > USHRT_MAX)
 270                 return -EPROTO;
 271         put_unaligned_le16(total_in_buf, &pSMBt->t2_rsp.DataCount);
 272
 273         /* fix up the BCC */
 274         byte_count = get_bcc(pTargetSMB);
 275         byte_count += total_in_buf2;
 276         /* is the result too big for the field? */
 277         if (byte_count > USHRT_MAX)
 278                 return -EPROTO;
 279         put_bcc(byte_count, pTargetSMB);
 280
 281         byte_count = be32_to_cpu(pTargetSMB->smb_buf_length);
 282         byte_count += total_in_buf2;
 283         /* don't allow buffer to overflow */
 284         if (byte_count > CIFSMaxBufSize)
 285                 return -ENOBUFS;
 286         pTargetSMB->smb_buf_length = cpu_to_be32(byte_count);
 287
 288         memcpy(data_area_of_target, data_area_of_buf2, total_in_buf2);
 289
 290         if (remaining == total_in_buf2) {
 291                 cFYI(1, "found the last secondary response");
 292                 return 0; /* we are done */
 293         } else /* more responses to go */
 294                 return 1;
 295 }
 296
 297 static void
 298 cifs_echo_request(struct work_struct *work)
 299 {
 300         int rc;
 301         struct TCP_Server_Info *server = container_of(work,
 302                                         struct TCP_Server_Info, echo.work);
 303
 304         /*
 305          * We cannot send an echo until the NEGOTIATE_PROTOCOL request is
 306          * done, which is indicated by maxBuf != 0. Also, no need to ping if
 307          * we got a response recently
 308          */
 309         if (server->maxBuf == 0 ||
 310             time_before(jiffies, server->lstrp + SMB_ECHO_INTERVAL - HZ))
 311                 goto requeue_echo;
 312
 313         rc = CIFSSMBEcho(server);
 314         if (rc)
 315                 cFYI(1, "Unable to send echo request to server: %s",
 316                         server->hostname);
 317
 318 requeue_echo:
 319         queue_delayed_work(system_nrt_wq, &server->echo, SMB_ECHO_INTERVAL);
 320 }
 321
 322 static bool
 323 allocate_buffers(char **bigbuf, char **smallbuf, unsigned int size,
 324                  bool is_large_buf)
 325 {
 326         char *bbuf = *bigbuf, *sbuf = *smallbuf;
 327
 328         if (bbuf == NULL) {
 329                 bbuf = (char *)cifs_buf_get();
 330                 if (!bbuf) {
 331                         cERROR(1, "No memory for large SMB response");
 332                         msleep(3000);
 333                         /* retry will check if exiting */
 334                         return false;
 335                 }
 336         } else if (is_large_buf) {
 337                 /* we are reusing a dirty large buf, clear its start */
 338                 memset(bbuf, 0, size);
 339         }
 340
 341         if (sbuf == NULL) {
 342                 sbuf = (char *)cifs_small_buf_get();
 343                 if (!sbuf) {
 344                         cERROR(1, "No memory for SMB response");
 345                         msleep(1000);
 346                         /* retry will check if exiting */
 347                         return false;
 348                 }
 349                 /* beginning of smb buffer is cleared in our buf_get */
 350         } else {
 351                 /* if existing small buf clear beginning */
 352                 memset(sbuf, 0, size);
 353         }
 354
 355         *bigbuf = bbuf;
 356         *smallbuf = sbuf;
 357
 358         return true;
 359 }
 360
 361 static bool
 362 server_unresponsive(struct TCP_Server_Info *server)
 363 {
 364         if (echo_retries > 0 && server->tcpStatus == CifsGood &&
 365             time_after(jiffies, server->lstrp +
 366                                 (echo_retries * SMB_ECHO_INTERVAL))) {
 367                 cERROR(1, "Server %s has not responded in %d seconds. "
 368                           "Reconnecting...", server->hostname,
 369                           (echo_retries * SMB_ECHO_INTERVAL / HZ));
 370                 cifs_reconnect(server);
 371                 wake_up(&server->response_q);
 372                 return true;
 373         }
 374
 375         return false;
 376 }
 377
 378 static int
 379 read_from_socket(struct TCP_Server_Info *server,
 380                  struct kvec *iov, unsigned int to_read,
 381                  unsigned int *ptotal_read, bool is_header_read)
 382 {
 383         int length, rc = 0;
 384         unsigned int total_read;
 385         struct msghdr smb_msg;
 386         char *buf = iov->iov_base;
 387
 388         smb_msg.msg_control = NULL;
 389         smb_msg.msg_controllen = 0;
 390
 391         for (total_read = 0; total_read < to_read; total_read += length) {
 392                 if (server_unresponsive(server)) {
 393                         rc = 1;
 394                         break;
 395                 }
 396
 397                 length = kernel_recvmsg(server->ssocket, &smb_msg, iov, 1,
 398                                         to_read - total_read, 0);
 399                 if (server->tcpStatus == CifsExiting) {
 400                         /* then will exit */
 401                         rc = 2;
 402                         break;
 403                 } else if (server->tcpStatus == CifsNeedReconnect) {
 404                         cifs_reconnect(server);
 405                         /* Reconnect wakes up rspns q */
 406                         /* Now we will reread sock */
 407                         rc = 1;
 408                         break;
 409                 } else if (length == -ERESTARTSYS ||
 410                            length == -EAGAIN ||
 411                            length == -EINTR) {
 412                         /*
 413                          * Minimum sleep to prevent looping, allowing socket
 414                          * to clear and app threads to set tcpStatus
 415                          * CifsNeedReconnect if server hung.
 416                          */
 417                         usleep_range(1000, 2000);
 418                         length = 0;
 419                         if (!is_header_read)
 420                                 continue;
 421                         /* Special handling for header read */
 422                         if (total_read) {
 423                                 iov->iov_base = (to_read - total_read) +
 424                                                 buf;
 425                                 iov->iov_len = to_read - total_read;
 426                                 rc = 3;
 427                         } else
 428                                 rc = 1;
 429                         break;
 430                 } else if (length <= 0) {
 431                         cERROR(1, "Received no data, expecting %d",
 432                                to_read - total_read);
 433                         cifs_reconnect(server);
 434                         rc = 1;
 435                         break;
 436                 }
 437         }
 438
 439         *ptotal_read = total_read;
 440         return rc;
 441 }
 442
 443 static bool
 444 check_rfc1002_header(struct TCP_Server_Info *server, char *buf)
 445 {
 446         char temp = *buf;
 447         unsigned int pdu_length = be32_to_cpu(
 448                                 ((struct smb_hdr *)buf)->smb_buf_length);
 449
 450         /*
 451          * The first byte big endian of the length field,
 452          * is actually not part of the length but the type
 453          * with the most common, zero, as regular data.
 454          */
 455         if (temp == (char) RFC1002_SESSION_KEEP_ALIVE) {
 456                 return false;
 457         } else if (temp == (char)RFC1002_POSITIVE_SESSION_RESPONSE) {
 458                 cFYI(1, "Good RFC 1002 session rsp");
 459                 return false;
 460         } else if (temp == (char)RFC1002_NEGATIVE_SESSION_RESPONSE) {
 461                 /*
 462                  * We get this from Windows 98 instead of an error on
 463                  * SMB negprot response.
 464                  */
 465                 cFYI(1, "Negative RFC1002 Session Response Error 0x%x)",
 466                         pdu_length);
 467                 /* give server a second to clean up */
 468                 msleep(1000);
 469                 /*
 470                  * Always try 445 first on reconnect since we get NACK
 471                  * on some if we ever connected to port 139 (the NACK
 472                  * is since we do not begin with RFC1001 session
 473                  * initialize frame).
 474                  */
 475                 cifs_set_port((struct sockaddr *)
 476                                 &server->dstaddr, CIFS_PORT);
 477                 cifs_reconnect(server);
 478                 wake_up(&server->response_q);
 479                 return false;
 480         } else if (temp != (char) 0) {
 481                 cERROR(1, "Unknown RFC 1002 frame");
 482                 cifs_dump_mem(" Received Data: ", buf, 4);
 483                 cifs_reconnect(server);
 484                 return false;
 485         }
 486
 487         /* else we have an SMB response */
 488         if ((pdu_length > CIFSMaxBufSize + MAX_CIFS_HDR_SIZE - 4) ||
 489             (pdu_length < sizeof(struct smb_hdr) - 1 - 4)) {
 490                 cERROR(1, "Invalid size SMB length %d pdu_length %d",
 491                        4, pdu_length+4);
 492                 cifs_reconnect(server);
 493                 wake_up(&server->response_q);
 494                 return false;
 495         }
 496
 497         return true;
 498 }
 499
 500 static struct mid_q_entry *
 501 find_cifs_mid(struct TCP_Server_Info *server, struct smb_hdr *buf,
 502               int *length, bool is_large_buf, bool *is_multi_rsp, char **bigbuf)
 503 {
 504         struct mid_q_entry *mid = NULL, *tmp_mid, *ret = NULL;
 505
 506         spin_lock(&GlobalMid_Lock);
 507         list_for_each_entry_safe(mid, tmp_mid, &server->pending_mid_q, qhead) {
 508                 if (mid->mid != buf->Mid ||
 509                     mid->midState != MID_REQUEST_SUBMITTED ||
 510                     mid->command != buf->Command)
 511                         continue;
 512
 513                 if (*length == 0 && check2ndT2(buf) > 0) {
 514                         /* We have a multipart transact2 resp */
 515                         *is_multi_rsp = true;
 516                         if (mid->resp_buf) {
 517                                 /* merge response - fix up 1st*/
 518                                 *length = coalesce_t2(buf, mid->resp_buf);
 519                                 if (*length > 0) {
 520                                         *length = 0;
 521                                         mid->multiRsp = true;
 522                                         break;
 523                                 }
 524                                 /* All parts received or packet is malformed. */
 525                                 mid->multiEnd = true;
 526                                 goto multi_t2_fnd;
 527                         }
 528                         if (!is_large_buf) {
 529                                 /*FIXME: switch to already allocated largebuf?*/
 530                                 cERROR(1, "1st trans2 resp needs bigbuf");
 531                         } else {
 532                                 /* Have first buffer */
 533                                 mid->resp_buf = buf;
 534                                 mid->largeBuf = true;
 535                                 *bigbuf = NULL;
 536                         }
 537                         break;
 538                 }
 539                 mid->resp_buf = buf;
 540                 mid->largeBuf = is_large_buf;
 541 multi_t2_fnd:
 542                 if (*length == 0)
 543                         mid->midState = MID_RESPONSE_RECEIVED;
 544                 else
 545                         mid->midState = MID_RESPONSE_MALFORMED;
 546 #ifdef CONFIG_CIFS_STATS2
 547                 mid->when_received = jiffies;
 548 #endif
 549                 list_del_init(&mid->qhead);
 550                 ret = mid;
 551                 break;
 552         }
 553         spin_unlock(&GlobalMid_Lock);
 554
 555         return ret;
 556 }
 557
 558 static void clean_demultiplex_info(struct TCP_Server_Info *server)
 559 {
 560         int length;
 561
 562         /* take it off the list, if it's not already */
 563         spin_lock(&cifs_tcp_ses_lock);
 564         list_del_init(&server->tcp_ses_list);
 565         spin_unlock(&cifs_tcp_ses_lock);
 566
 567         spin_lock(&GlobalMid_Lock);
 568         server->tcpStatus = CifsExiting;
 569         spin_unlock(&GlobalMid_Lock);
 570         wake_up_all(&server->response_q);
 571
 572         /*
 573          * Check if we have blocked requests that need to free. Note that
 574          * cifs_max_pending is normally 50, but can be set at module install
 575          * time to as little as two.
 576          */
 577         spin_lock(&GlobalMid_Lock);
 578         if (atomic_read(&server->inFlight) >= cifs_max_pending)
 579                 atomic_set(&server->inFlight, cifs_max_pending - 1);
 580         /*
 581          * We do not want to set the max_pending too low or we could end up
 582          * with the counter going negative.
 583          */
 584         spin_unlock(&GlobalMid_Lock);
 585         /*
 586          * Although there should not be any requests blocked on this queue it
 587          * can not hurt to be paranoid and try to wake up requests that may
 588          * haven been blocked when more than 50 at time were on the wire to the
 589          * same server - they now will see the session is in exit state and get
 590          * out of SendReceive.
 591          */
 592         wake_up_all(&server->request_q);
 593         /* give those requests time to exit */
 594         msleep(125);
 595
 596         if (server->ssocket) {
 597                 sock_release(server->ssocket);
 598                 server->ssocket = NULL;
 599         }
 600
 601         if (!list_empty(&server->pending_mid_q)) {
 602                 struct list_head dispose_list;
 603                 struct mid_q_entry *mid_entry;
 604                 struct list_head *tmp, *tmp2;
 605
 606                 INIT_LIST_HEAD(&dispose_list);
 607                 spin_lock(&GlobalMid_Lock);
 608                 list_for_each_safe(tmp, tmp2, &server->pending_mid_q) {
 609                         mid_entry = list_entry(tmp, struct mid_q_entry, qhead);
 610                         cFYI(1, "Clearing mid 0x%x", mid_entry->mid);
 611                         mid_entry->midState = MID_SHUTDOWN;
 612                         list_move(&mid_entry->qhead, &dispose_list);
 613                 }
 614                 spin_unlock(&GlobalMid_Lock);
 615
 616                 /* now walk dispose list and issue callbacks */
 617                 list_for_each_safe(tmp, tmp2, &dispose_list) {
 618                         mid_entry = list_entry(tmp, struct mid_q_entry, qhead);
 619                         cFYI(1, "Callback mid 0x%x", mid_entry->mid);
 620                         list_del_init(&mid_entry->qhead);
 621                         mid_entry->callback(mid_entry);
 622                 }
 623                 /* 1/8th of sec is more than enough time for them to exit */
 624                 msleep(125);
 625         }
 626
 627         if (!list_empty(&server->pending_mid_q)) {
 628                 /*
 629                  * mpx threads have not exited yet give them at least the smb
 630                  * send timeout time for long ops.
 631                  *
 632                  * Due to delays on oplock break requests, we need to wait at
 633                  * least 45 seconds before giving up on a request getting a
 634                  * response and going ahead and killing cifsd.
 635                  */
 636                 cFYI(1, "Wait for exit from demultiplex thread");
 637                 msleep(46000);
 638                 /*
 639                  * If threads still have not exited they are probably never
 640                  * coming home not much else we can do but free the memory.
 641                  */
 642         }
 643
 644         kfree(server->hostname);
 645         kfree(server);
 646
 647         length = atomic_dec_return(&tcpSesAllocCount);
 648         if (length > 0)
 649                 mempool_resize(cifs_req_poolp, length + cifs_min_rcv,
 650                                 GFP_KERNEL);
 651 }
 652
 653 static int
 654 cifs_demultiplex_thread(void *p)
 655 {
 656         int length;
 657         struct TCP_Server_Info *server = p;
 658         unsigned int pdu_length, total_read;
 659         char *buf = NULL, *bigbuf = NULL, *smallbuf = NULL;
 660         struct smb_hdr *smb_buffer = NULL;
 661         struct kvec iov;
 662         struct task_struct *task_to_wake = NULL;
 663         struct mid_q_entry *mid_entry;
 664         bool isLargeBuf = false;
 665         bool isMultiRsp = false;
 666         int rc;
 667
 668         current->flags |= PF_MEMALLOC;
 669         cFYI(1, "Demultiplex PID: %d", task_pid_nr(current));
 670
 671         length = atomic_inc_return(&tcpSesAllocCount);
 672         if (length > 1)
 673                 mempool_resize(cifs_req_poolp, length + cifs_min_rcv,
 674                                 GFP_KERNEL);
 675
 676         set_freezable();
 677         while (server->tcpStatus != CifsExiting) {
 678                 if (try_to_freeze())
 679                         continue;
 680
 681                 if (!allocate_buffers(&bigbuf, &smallbuf,
 682                                       sizeof(struct smb_hdr), isLargeBuf))
 683                         continue;
 684
 685                 isLargeBuf = false;
 686                 isMultiRsp = false;
 687                 smb_buffer = (struct smb_hdr *)smallbuf;
 688                 buf = smallbuf;
 689                 iov.iov_base = buf;
 690                 iov.iov_len = 4;
 691                 pdu_length = 4; /* enough to get RFC1001 header */
 692
 693 incomplete_rcv:
 694                 rc = read_from_socket(server, &iov, pdu_length,
 695                                       &total_read, true /* header read */);
 696                 if (rc == 3)
 697                         goto incomplete_rcv;
 698                 else if (rc == 2)
 699                         break;
 700                 else if (rc == 1)
 701                         continue;
 702
 703                 /*
 704                  * The right amount was read from socket - 4 bytes,
 705                  * so we can now interpret the length field.
 706                  */
 707                 pdu_length = be32_to_cpu(smb_buffer->smb_buf_length);
 708
 709                 cFYI(1, "rfc1002 length 0x%x", pdu_length+4);
 710                 if (!check_rfc1002_header(server, buf))
 711                         continue;
 712
 713                 /* else length ok */
 714                 if (pdu_length > MAX_CIFS_SMALL_BUFFER_SIZE - 4) {
 715                         isLargeBuf = true;
 716                         memcpy(bigbuf, smallbuf, 4);
 717                         smb_buffer = (struct smb_hdr *)bigbuf;
 718                         buf = bigbuf;
 719                 }
 720
 721                 iov.iov_base = 4 + buf;
 722                 iov.iov_len = pdu_length;
 723                 rc = read_from_socket(server, &iov, pdu_length,
 724                                       &total_read, false);
 725                 if (rc == 2)
 726                         break;
 727                 else if (rc == 1)
 728                         continue;
 729
 730                 total_read += 4; /* account for rfc1002 hdr */
 731
 732                 dump_smb(smb_buffer, total_read);
 733
 734                 /*
 735                  * We know that we received enough to get to the MID as we
 736                  * checked the pdu_length earlier. Now check to see
 737                  * if the rest of the header is OK. We borrow the length
 738                  * var for the rest of the loop to avoid a new stack var.
 739                  *
 740                  * 48 bytes is enough to display the header and a little bit
 741                  * into the payload for debugging purposes.
 742                  */
 743                 length = checkSMB(smb_buffer, smb_buffer->Mid, total_read);
 744                 if (length != 0)
 745                         cifs_dump_mem("Bad SMB: ", buf,
 746                                       min_t(unsigned int, total_read, 48));
 747
 748                 server->lstrp = jiffies;
 749
 750                 mid_entry = find_cifs_mid(server, smb_buffer, &length,
 751                                           isLargeBuf, &isMultiRsp, &bigbuf);
 752                 if (mid_entry != NULL) {
 753                         mid_entry->callback(mid_entry);
 754                         /* Was previous buf put in mpx struct for multi-rsp? */
 755                         if (!isMultiRsp) {
 756                                 /* smb buffer will be freed by user thread */
 757                                 if (isLargeBuf)
 758                                         bigbuf = NULL;
 759                                 else
 760                                         smallbuf = NULL;
 761                         }
 762                 } else if (length != 0) {
 763                         /* response sanity checks failed */
 764                         continue;
 765                 } else if (!is_valid_oplock_break(smb_buffer, server) &&
 766                            !isMultiRsp) {
 767                         cERROR(1, "No task to wake, unknown frame received! "
 768                                    "NumMids %d", atomic_read(&midCount));
 769                         cifs_dump_mem("Received Data is: ", buf,
 770                                       sizeof(struct smb_hdr));
 771 #ifdef CONFIG_CIFS_DEBUG2
 772                         cifs_dump_detail(smb_buffer);
 773                         cifs_dump_mids(server);
 774 #endif /* CIFS_DEBUG2 */
 775
 776                 }
 777         } /* end while !EXITING */
 778
 779         /* buffer usually freed in free_mid - need to free it here on exit */
 780         cifs_buf_release(bigbuf);
 781         if (smallbuf) /* no sense logging a debug message if NULL */
 782                 cifs_small_buf_release(smallbuf);
 783
 784         task_to_wake = xchg(&server->tsk, NULL);
 785         clean_demultiplex_info(server);
 786
 787         /* if server->tsk was NULL then wait for a signal before exiting */
 788         if (!task_to_wake) {
 789                 set_current_state(TASK_INTERRUPTIBLE);
 790                 while (!signal_pending(current)) {
 791                         schedule();
 792                         set_current_state(TASK_INTERRUPTIBLE);
 793                 }
 794                 set_current_state(TASK_RUNNING);
 795         }
 796
 797         module_put_and_exit(0);
 798 }
 799
 800 /* extract the host portion of the UNC string */
 801 static char *
 802 extract_hostname(const char *unc)
 803 {
 804         const char *src;
 805         char *dst, *delim;
 806         unsigned int len;
 807
 808         /* skip double chars at beginning of string */
 809         /* BB: check validity of these bytes? */
 810         src = unc + 2;
 811
 812         /* delimiter between hostname and sharename is always '\\' now */
 813         delim = strchr(src, '\\');
 814         if (!delim)
 815                 return ERR_PTR(-EINVAL);
 816
 817         len = delim - src;
 818         dst = kmalloc((len + 1), GFP_KERNEL);
 819         if (dst == NULL)
 820                 return ERR_PTR(-ENOMEM);
 821
 822         memcpy(dst, src, len);
 823         dst[len] = '\0';
 824
 825         return dst;
 826 }
 827
 828 static int
 829 cifs_parse_mount_options(const char *mountdata, const char *devname,
 830                          struct smb_vol *vol)
 831 {
 832         char *value, *data, *end;
 833         char *mountdata_copy = NULL, *options;
 834         unsigned int  temp_len, i, j;
 835         char separator[2];
 836         short int override_uid = -1;
 837         short int override_gid = -1;
 838         bool uid_specified = false;
 839         bool gid_specified = false;
 840         char *nodename = utsname()->nodename;
 841
 842         separator[0] = ',';
 843         separator[1] = 0;
 844
 845         /*
 846          * does not have to be perfect mapping since field is
 847          * informational, only used for servers that do not support
 848          * port 445 and it can be overridden at mount time
 849          */
 850         memset(vol->source_rfc1001_name, 0x20, RFC1001_NAME_LEN);
 851         for (i = 0; i < strnlen(nodename, RFC1001_NAME_LEN); i++)
 852                 vol->source_rfc1001_name[i] = toupper(nodename[i]);
 853
 854         vol->source_rfc1001_name[RFC1001_NAME_LEN] = 0;
 855         /* null target name indicates to use *SMBSERVR default called name
 856            if we end up sending RFC1001 session initialize */
 857         vol->target_rfc1001_name[0] = 0;
 858         vol->cred_uid = current_uid();
 859         vol->linux_uid = current_uid();
 860         vol->linux_gid = current_gid();
 861
 862         /* default to only allowing write access to owner of the mount */
 863         vol->dir_mode = vol->file_mode = S_IRUGO | S_IXUGO | S_IWUSR;
 864
 865         /* vol->retry default is 0 (i.e. "soft" limited retry not hard retry) */
 866         /* default is always to request posix paths. */
 867         vol->posix_paths = 1;
 868         /* default to using server inode numbers where available */
 869         vol->server_ino = 1;
 870
 871         vol->actimeo = CIFS_DEF_ACTIMEO;
 872
 873         if (!mountdata)
 874                 goto cifs_parse_mount_err;
 875
 876         mountdata_copy = kstrndup(mountdata, PAGE_SIZE, GFP_KERNEL);
 877         if (!mountdata_copy)
 878                 goto cifs_parse_mount_err;
 879
 880         options = mountdata_copy;
 881         end = options + strlen(options);
 882         if (strncmp(options, "sep=", 4) == 0) {
 883                 if (options[4] != 0) {
 884                         separator[0] = options[4];
 885                         options += 5;
 886                 } else {
 887                         cFYI(1, "Null separator not allowed");
 888                 }
 889         }
 890
 891         while ((data = strsep(&options, separator)) != NULL) {
 892                 if (!*data)
 893                         continue;
 894                 if ((value = strchr(data, '=')) != NULL)
 895                         *value++ = '\0';
 896
 897                 /* Have to parse this before we parse for "user" */
 898                 if (strnicmp(data, "user_xattr", 10) == 0) {
 899                         vol->no_xattr = 0;
 900                 } else if (strnicmp(data, "nouser_xattr", 12) == 0) {
 901                         vol->no_xattr = 1;
 902                 } else if (strnicmp(data, "user", 4) == 0) {
 903                         if (!value) {
 904                                 printk(KERN_WARNING
 905                                        "CIFS: invalid or missing username\n");
 906                                 goto cifs_parse_mount_err;
 907                         } else if (!*value) {
 908                                 /* null user, ie anonymous, authentication */
 909                                 vol->nullauth = 1;
 910                         }
 911                         if (strnlen(value, MAX_USERNAME_SIZE) <
 912                                                 MAX_USERNAME_SIZE) {
 913                                 vol->username = kstrdup(value, GFP_KERNEL);
 914                                 if (!vol->username) {
 915                                         printk(KERN_WARNING "CIFS: no memory "
 916                                                             "for username\n");
 917                                         goto cifs_parse_mount_err;
 918                                 }
 919                         } else {
 920                                 printk(KERN_WARNING "CIFS: username too long\n");
 921                                 goto cifs_parse_mount_err;
 922                         }
 923                 } else if (strnicmp(data, "pass", 4) == 0) {
 924                         if (!value) {
 925                                 vol->password = NULL;
 926                                 continue;
 927                         } else if (value[0] == 0) {
 928                                 /* check if string begins with double comma
 929                                    since that would mean the password really
 930                                    does start with a comma, and would not
 931                                    indicate an empty string */
 932                                 if (value[1] != separator[0]) {
 933                                         vol->password = NULL;
 934                                         continue;
 935                                 }
 936                         }
 937                         temp_len = strlen(value);
 938                         /* removed password length check, NTLM passwords
 939                                 can be arbitrarily long */
 940
 941                         /* if comma in password, the string will be
 942                         prematurely null terminated.  Commas in password are
 943                         specified across the cifs mount interface by a double
 944                         comma ie ,, and a comma used as in other cases ie ','
 945                         as a parameter delimiter/separator is single and due
 946                         to the strsep above is temporarily zeroed. */
 947
 948                         /* NB: password legally can have multiple commas and
 949                         the only illegal character in a password is null */
 950
 951                         if ((value[temp_len] == 0) &&
 952                             (value + temp_len < end) &&
 953                             (value[temp_len+1] == separator[0])) {
 954                                 /* reinsert comma */
 955                                 value[temp_len] = separator[0];
 956                                 temp_len += 2;  /* move after second comma */
 957                                 while (value[temp_len] != 0)  {
 958                                         if (value[temp_len] == separator[0]) {
 959                                                 if (value[temp_len+1] ==
 960                                                      separator[0]) {
 961                                                 /* skip second comma */
 962                                                         temp_len++;
 963                                                 } else {
 964                                                 /* single comma indicating start
 965                                                          of next parm */
 966                                                         break;
 967                                                 }
 968                                         }
 969                                         temp_len++;
 970                                 }
 971                                 if (value[temp_len] == 0) {
 972                                         options = NULL;
 973                                 } else {
 974                                         value[temp_len] = 0;
 975                                         /* point option to start of next parm */
 976                                         options = value + temp_len + 1;
 977                                 }
 978                                 /* go from value to value + temp_len condensing
 979                                 double commas to singles. Note that this ends up
 980                                 allocating a few bytes too many, which is ok */
 981                                 vol->password = kzalloc(temp_len, GFP_KERNEL);
 982                                 if (vol->password == NULL) {
 983                                         printk(KERN_WARNING "CIFS: no memory "
 984                                                             "for password\n");
 985                                         goto cifs_parse_mount_err;
 986                                 }
 987                                 for (i = 0, j = 0; i < temp_len; i++, j++) {
 988                                         vol->password[j] = value[i];
 989                                         if (value[i] == separator[0]
 990                                                 && value[i+1] == separator[0]) {
 991                                                 /* skip second comma */
 992                                                 i++;
 993                                         }
 994                                 }
 995                                 vol->password[j] = 0;
 996                         } else {
 997                                 vol->password = kzalloc(temp_len+1, GFP_KERNEL);
 998                                 if (vol->password == NULL) {
 999                                         printk(KERN_WARNING "CIFS: no memory "
1000                                                             "for password\n");
1001                                         goto cifs_parse_mount_err;
1002                                 }
1003                                 strcpy(vol->password, value);
1004                         }
1005                 } else if (!strnicmp(data, "ip", 2) ||
1006                            !strnicmp(data, "addr", 4)) {
1007                         if (!value || !*value) {
1008                                 vol->UNCip = NULL;
1009                         } else if (strnlen(value, INET6_ADDRSTRLEN) <
1010                                                         INET6_ADDRSTRLEN) {
1011                                 vol->UNCip = kstrdup(value, GFP_KERNEL);
1012                                 if (!vol->UNCip) {
1013                                         printk(KERN_WARNING "CIFS: no memory "
1014                                                             "for UNC IP\n");
1015                                         goto cifs_parse_mount_err;
1016                                 }
1017                         } else {
1018                                 printk(KERN_WARNING "CIFS: ip address "
1019                                                     "too long\n");
1020                                 goto cifs_parse_mount_err;
1021                         }
1022                 } else if (strnicmp(data, "sec", 3) == 0) {
1023                         if (!value || !*value) {
1024                                 cERROR(1, "no security value specified");
1025                                 continue;
1026                         } else if (strnicmp(value, "krb5i", 5) == 0) {
1027                                 vol->secFlg |= CIFSSEC_MAY_KRB5 |
1028                                         CIFSSEC_MUST_SIGN;
1029                         } else if (strnicmp(value, "krb5p", 5) == 0) {
1030                                 /* vol->secFlg |= CIFSSEC_MUST_SEAL |
1031                                         CIFSSEC_MAY_KRB5; */
1032                                 cERROR(1, "Krb5 cifs privacy not supported");
1033                                 goto cifs_parse_mount_err;
1034                         } else if (strnicmp(value, "krb5", 4) == 0) {
1035                                 vol->secFlg |= CIFSSEC_MAY_KRB5;
1036                         } else if (strnicmp(value, "ntlmsspi", 8) == 0) {
1037                                 vol->secFlg |= CIFSSEC_MAY_NTLMSSP |
1038                                         CIFSSEC_MUST_SIGN;
1039                         } else if (strnicmp(value, "ntlmssp", 7) == 0) {
1040                                 vol->secFlg |= CIFSSEC_MAY_NTLMSSP;
1041                         } else if (strnicmp(value, "ntlmv2i", 7) == 0) {
1042                                 vol->secFlg |= CIFSSEC_MAY_NTLMV2 |
1043                                         CIFSSEC_MUST_SIGN;
1044                         } else if (strnicmp(value, "ntlmv2", 6) == 0) {
1045                                 vol->secFlg |= CIFSSEC_MAY_NTLMV2;
1046                         } else if (strnicmp(value, "ntlmi", 5) == 0) {
1047                                 vol->secFlg |= CIFSSEC_MAY_NTLM |
1048                                         CIFSSEC_MUST_SIGN;
1049                         } else if (strnicmp(value, "ntlm", 4) == 0) {
1050                                 /* ntlm is default so can be turned off too */
1051                                 vol->secFlg |= CIFSSEC_MAY_NTLM;
1052                         } else if (strnicmp(value, "nontlm", 6) == 0) {
1053                                 /* BB is there a better way to do this? */
1054                                 vol->secFlg |= CIFSSEC_MAY_NTLMV2;
1055 #ifdef CONFIG_CIFS_WEAK_PW_HASH
1056                         } else if (strnicmp(value, "lanman", 6) == 0) {
1057                                 vol->secFlg |= CIFSSEC_MAY_LANMAN;
1058 #endif
1059                         } else if (strnicmp(value, "none", 4) == 0) {
1060                                 vol->nullauth = 1;
1061                         } else {
1062                                 cERROR(1, "bad security option: %s", value);
1063                                 goto cifs_parse_mount_err;
1064                         }
1065                 } else if (strnicmp(data, "vers", 3) == 0) {
1066                         if (!value || !*value) {
1067                                 cERROR(1, "no protocol version specified"
1068                                           " after vers= mount option");
1069                         } else if ((strnicmp(value, "cifs", 4) == 0) ||
1070                                    (strnicmp(value, "1", 1) == 0)) {
1071                                 /* this is the default */
1072                                 continue;
1073                         }
1074                 } else if ((strnicmp(data, "unc", 3) == 0)
1075                            || (strnicmp(data, "target", 6) == 0)
1076                            || (strnicmp(data, "path", 4) == 0)) {
1077                         if (!value || !*value) {
1078                                 printk(KERN_WARNING "CIFS: invalid path to "
1079                                                     "network resource\n");
1080                                 goto cifs_parse_mount_err;
1081                         }
1082                         if ((temp_len = strnlen(value, 300)) < 300) {
1083                                 vol->UNC = kmalloc(temp_len+1, GFP_KERNEL);
1084                                 if (vol->UNC == NULL)
1085                                         goto cifs_parse_mount_err;
1086                                 strcpy(vol->UNC, value);
1087                                 if (strncmp(vol->UNC, "//", 2) == 0) {
1088                                         vol->UNC[0] = '\\';
1089                                         vol->UNC[1] = '\\';
1090                                 } else if (strncmp(vol->UNC, "\\\\", 2) != 0) {
1091                                         printk(KERN_WARNING
1092                                                "CIFS: UNC Path does not begin "
1093                                                "with // or \\\\ \n");
1094                                         goto cifs_parse_mount_err;
1095                                 }
1096                         } else {
1097                                 printk(KERN_WARNING "CIFS: UNC name too long\n");
1098                                 goto cifs_parse_mount_err;
1099                         }
1100                 } else if ((strnicmp(data, "domain", 3) == 0)
1101                            || (strnicmp(data, "workgroup", 5) == 0)) {
1102                         if (!value || !*value) {
1103                                 printk(KERN_WARNING "CIFS: invalid domain name\n");
1104                                 goto cifs_parse_mount_err;
1105                         }
1106                         /* BB are there cases in which a comma can be valid in
1107                         a domain name and need special handling? */
1108                         if (strnlen(value, 256) < 256) {
1109                                 vol->domainname = kstrdup(value, GFP_KERNEL);
1110                                 if (!vol->domainname) {
1111                                         printk(KERN_WARNING "CIFS: no memory "
1112                                                             "for domainname\n");
1113                                         goto cifs_parse_mount_err;
1114                                 }
1115                                 cFYI(1, "Domain name set");
1116                         } else {
1117                                 printk(KERN_WARNING "CIFS: domain name too "
1118                                                     "long\n");
1119                                 goto cifs_parse_mount_err;
1120                         }
1121                 } else if (strnicmp(data, "srcaddr", 7) == 0) {
1122                         vol->srcaddr.ss_family = AF_UNSPEC;
1123
1124                         if (!value || !*value) {
1125                                 printk(KERN_WARNING "CIFS: srcaddr value"
1126                                        " not specified.\n");
1127                                 goto cifs_parse_mount_err;
1128                         }
1129                         i = cifs_convert_address((struct sockaddr *)&vol->srcaddr,
1130                                                  value, strlen(value));
1131                         if (i == 0) {
1132                                 printk(KERN_WARNING "CIFS:  Could not parse"
1133                                        " srcaddr: %s\n",
1134                                        value);
1135                                 goto cifs_parse_mount_err;
1136                         }
1137                 } else if (strnicmp(data, "prefixpath", 10) == 0) {
1138                         if (!value || !*value) {
1139                                 printk(KERN_WARNING
1140                                         "CIFS: invalid path prefix\n");
1141                                 goto cifs_parse_mount_err;
1142                         }
1143                         if ((temp_len = strnlen(value, 1024)) < 1024) {
1144                                 if (value[0] != '/')
1145                                         temp_len++;  /* missing leading slash */
1146                                 vol->prepath = kmalloc(temp_len+1, GFP_KERNEL);
1147                                 if (vol->prepath == NULL)
1148                                         goto cifs_parse_mount_err;
1149                                 if (value[0] != '/') {
1150                                         vol->prepath[0] = '/';
1151                                         strcpy(vol->prepath+1, value);
1152                                 } else
1153                                         strcpy(vol->prepath, value);
1154                                 cFYI(1, "prefix path %s", vol->prepath);
1155                         } else {
1156                                 printk(KERN_WARNING "CIFS: prefix too long\n");
1157                                 goto cifs_parse_mount_err;
1158                         }
1159                 } else if (strnicmp(data, "iocharset", 9) == 0) {
1160                         if (!value || !*value) {
1161                                 printk(KERN_WARNING "CIFS: invalid iocharset "
1162                                                     "specified\n");
1163                                 goto cifs_parse_mount_err;
1164                         }
1165                         if (strnlen(value, 65) < 65) {
1166                                 if (strnicmp(value, "default", 7)) {
1167                                         vol->iocharset = kstrdup(value,
1168                                                                  GFP_KERNEL);
1169
1170                                         if (!vol->iocharset) {
1171                                                 printk(KERN_WARNING "CIFS: no "
1172                                                                    "memory for"
1173                                                                    "charset\n");
1174                                                 goto cifs_parse_mount_err;
1175                                         }
1176                                 }
1177                                 /* if iocharset not set then load_nls_default
1178                                    is used by caller */
1179                                 cFYI(1, "iocharset set to %s", value);
1180                         } else {
1181                                 printk(KERN_WARNING "CIFS: iocharset name "
1182                                                     "too long.\n");
1183                                 goto cifs_parse_mount_err;
1184                         }
1185                 } else if (!strnicmp(data, "uid", 3) && value && *value) {
1186                         vol->linux_uid = simple_strtoul(value, &value, 0);
1187                         uid_specified = true;
1188                 } else if (!strnicmp(data, "cruid", 5) && value && *value) {
1189                         vol->cred_uid = simple_strtoul(value, &value, 0);
1190                 } else if (!strnicmp(data, "forceuid", 8)) {
1191                         override_uid = 1;
1192                 } else if (!strnicmp(data, "noforceuid", 10)) {
1193                         override_uid = 0;
1194                 } else if (!strnicmp(data, "gid", 3) && value && *value) {
1195                         vol->linux_gid = simple_strtoul(value, &value, 0);
1196                         gid_specified = true;
1197                 } else if (!strnicmp(data, "forcegid", 8)) {
1198                         override_gid = 1;
1199                 } else if (!strnicmp(data, "noforcegid", 10)) {
1200                         override_gid = 0;
1201                 } else if (strnicmp(data, "file_mode", 4) == 0) {
1202                         if (value && *value) {
1203                                 vol->file_mode =
1204                                         simple_strtoul(value, &value, 0);
1205                         }
1206                 } else if (strnicmp(data, "dir_mode", 4) == 0) {
1207                         if (value && *value) {
1208                                 vol->dir_mode =
1209                                         simple_strtoul(value, &value, 0);
1210                         }
1211                 } else if (strnicmp(data, "dirmode", 4) == 0) {
1212                         if (value && *value) {
1213                                 vol->dir_mode =
1214                                         simple_strtoul(value, &value, 0);
1215                         }
1216                 } else if (strnicmp(data, "port", 4) == 0) {
1217                         if (value && *value) {
1218                                 vol->port =
1219                                         simple_strtoul(value, &value, 0);
1220                         }
1221                 } else if (strnicmp(data, "rsize", 5) == 0) {
1222                         if (value && *value) {
1223                                 vol->rsize =
1224                                         simple_strtoul(value, &value, 0);
1225                         }
1226                 } else if (strnicmp(data, "wsize", 5) == 0) {
1227                         if (value && *value) {
1228                                 vol->wsize =
1229                                         simple_strtoul(value, &value, 0);
1230                         }
1231                 } else if (strnicmp(data, "sockopt", 5) == 0) {
1232                         if (!value || !*value) {
1233                                 cERROR(1, "no socket option specified");
1234                                 continue;
1235                         } else if (strnicmp(value, "TCP_NODELAY", 11) == 0) {
1236                                 vol->sockopt_tcp_nodelay = 1;
1237                         }
1238                 } else if (strnicmp(data, "netbiosname", 4) == 0) {
1239                         if (!value || !*value || (*value == ' ')) {
1240                                 cFYI(1, "invalid (empty) netbiosname");
1241                         } else {
1242                                 memset(vol->source_rfc1001_name, 0x20,
1243                                         RFC1001_NAME_LEN);
1244                                 /*
1245                                  * FIXME: are there cases in which a comma can
1246                                  * be valid in workstation netbios name (and
1247                                  * need special handling)?
1248                                  */
1249                                 for (i = 0; i < RFC1001_NAME_LEN; i++) {
1250                                         /* don't ucase netbiosname for user */
1251                                         if (value[i] == 0)
1252                                                 break;
1253                                         vol->source_rfc1001_name[i] = value[i];
1254                                 }
1255                                 /* The string has 16th byte zero still from
1256                                 set at top of the function  */
1257                                 if (i == RFC1001_NAME_LEN && value[i] != 0)
1258                                         printk(KERN_WARNING "CIFS: netbiosname"
1259                                                 " longer than 15 truncated.\n");
1260                         }
1261                 } else if (strnicmp(data, "servern", 7) == 0) {
1262                         /* servernetbiosname specified override *SMBSERVER */
1263                         if (!value || !*value || (*value == ' ')) {
1264                                 cFYI(1, "empty server netbiosname specified");
1265                         } else {
1266                                 /* last byte, type, is 0x20 for servr type */
1267                                 memset(vol->target_rfc1001_name, 0x20,
1268                                         RFC1001_NAME_LEN_WITH_NULL);
1269
1270                                 for (i = 0; i < 15; i++) {
1271                                 /* BB are there cases in which a comma can be
1272                                    valid in this workstation netbios name
1273                                    (and need special handling)? */
1274
1275                                 /* user or mount helper must uppercase
1276                                    the netbiosname */
1277                                         if (value[i] == 0)
1278                                                 break;
1279                                         else
1280                                                 vol->target_rfc1001_name[i] =
1281                                                                 value[i];
1282                                 }
1283                                 /* The string has 16th byte zero still from
1284                                    set at top of the function  */
1285                                 if (i == RFC1001_NAME_LEN && value[i] != 0)
1286                                         printk(KERN_WARNING "CIFS: server net"
1287                                         "biosname longer than 15 truncated.\n");
1288                         }
1289                 } else if (strnicmp(data, "actimeo", 7) == 0) {
1290                         if (value && *value) {
1291                                 vol->actimeo = HZ * simple_strtoul(value,
1292                                                                    &value, 0);
1293                                 if (vol->actimeo > CIFS_MAX_ACTIMEO) {
1294                                         cERROR(1, "CIFS: attribute cache"
1295                                                         "timeout too large");
1296                                         goto cifs_parse_mount_err;
1297                                 }
1298                         }
1299                 } else if (strnicmp(data, "credentials", 4) == 0) {
1300                         /* ignore */
1301                 } else if (strnicmp(data, "version", 3) == 0) {
1302                         /* ignore */
1303                 } else if (strnicmp(data, "guest", 5) == 0) {
1304                         /* ignore */
1305                 } else if (strnicmp(data, "rw", 2) == 0 && strlen(data) == 2) {
1306                         /* ignore */
1307                 } else if (strnicmp(data, "ro", 2) == 0) {
1308                         /* ignore */
1309                 } else if (strnicmp(data, "noblocksend", 11) == 0) {
1310                         vol->noblocksnd = 1;
1311                 } else if (strnicmp(data, "noautotune", 10) == 0) {
1312                         vol->noautotune = 1;
1313                 } else if ((strnicmp(data, "suid", 4) == 0) ||
1314                                    (strnicmp(data, "nosuid", 6) == 0) ||
1315                                    (strnicmp(data, "exec", 4) == 0) ||
1316                                    (strnicmp(data, "noexec", 6) == 0) ||
1317                                    (strnicmp(data, "nodev", 5) == 0) ||
1318                                    (strnicmp(data, "noauto", 6) == 0) ||
1319                                    (strnicmp(data, "dev", 3) == 0)) {
1320                         /*  The mount tool or mount.cifs helper (if present)
1321                             uses these opts to set flags, and the flags are read
1322                             by the kernel vfs layer before we get here (ie
1323                             before read super) so there is no point trying to
1324                             parse these options again and set anything and it
1325                             is ok to just ignore them */
1326                         continue;
1327                 } else if (strnicmp(data, "hard", 4) == 0) {
1328                         vol->retry = 1;
1329                 } else if (strnicmp(data, "soft", 4) == 0) {
1330                         vol->retry = 0;
1331                 } else if (strnicmp(data, "perm", 4) == 0) {
1332                         vol->noperm = 0;
1333                 } else if (strnicmp(data, "noperm", 6) == 0) {
1334                         vol->noperm = 1;
1335                 } else if (strnicmp(data, "mapchars", 8) == 0) {
1336                         vol->remap = 1;
1337                 } else if (strnicmp(data, "nomapchars", 10) == 0) {
1338                         vol->remap = 0;
1339                 } else if (strnicmp(data, "sfu", 3) == 0) {
1340                         vol->sfu_emul = 1;
1341                 } else if (strnicmp(data, "nosfu", 5) == 0) {
1342                         vol->sfu_emul = 0;
1343                 } else if (strnicmp(data, "nodfs", 5) == 0) {
1344                         vol->nodfs = 1;
1345                 } else if (strnicmp(data, "posixpaths", 10) == 0) {
1346                         vol->posix_paths = 1;
1347                 } else if (strnicmp(data, "noposixpaths", 12) == 0) {
1348                         vol->posix_paths = 0;
1349                 } else if (strnicmp(data, "nounix", 6) == 0) {
1350                         vol->no_linux_ext = 1;
1351                 } else if (strnicmp(data, "nolinux", 7) == 0) {
1352                         vol->no_linux_ext = 1;
1353                 } else if ((strnicmp(data, "nocase", 6) == 0) ||
1354                            (strnicmp(data, "ignorecase", 10)  == 0)) {
1355                         vol->nocase = 1;
1356                 } else if (strnicmp(data, "mand", 4) == 0) {
1357                         /* ignore */
1358                 } else if (strnicmp(data, "nomand", 6) == 0) {
1359                         /* ignore */
1360                 } else if (strnicmp(data, "_netdev", 7) == 0) {
1361                         /* ignore */
1362                 } else if (strnicmp(data, "brl", 3) == 0) {
1363                         vol->nobrl =  0;
1364                 } else if ((strnicmp(data, "nobrl", 5) == 0) ||
1365                            (strnicmp(data, "nolock", 6) == 0)) {
1366                         vol->nobrl =  1;
1367                         /* turn off mandatory locking in mode
1368                         if remote locking is turned off since the
1369                         local vfs will do advisory */
1370                         if (vol->file_mode ==
1371                                 (S_IALLUGO & ~(S_ISUID | S_IXGRP)))
1372                                 vol->file_mode = S_IALLUGO;
1373                 } else if (strnicmp(data, "forcemandatorylock", 9) == 0) {
1374                         /* will take the shorter form "forcemand" as well */
1375                         /* This mount option will force use of mandatory
1376                           (DOS/Windows style) byte range locks, instead of
1377                           using posix advisory byte range locks, even if the
1378                           Unix extensions are available and posix locks would
1379                           be supported otherwise. If Unix extensions are not
1380                           negotiated this has no effect since mandatory locks
1381                           would be used (mandatory locks is all that those
1382                           those servers support) */
1383                         vol->mand_lock = 1;
1384                 } else if (strnicmp(data, "setuids", 7) == 0) {
1385                         vol->setuids = 1;
1386                 } else if (strnicmp(data, "nosetuids", 9) == 0) {
1387                         vol->setuids = 0;
1388                 } else if (strnicmp(data, "dynperm", 7) == 0) {
1389                         vol->dynperm = true;
1390                 } else if (strnicmp(data, "nodynperm", 9) == 0) {
1391                         vol->dynperm = false;
1392                 } else if (strnicmp(data, "nohard", 6) == 0) {
1393                         vol->retry = 0;
1394                 } else if (strnicmp(data, "nosoft", 6) == 0) {
1395                         vol->retry = 1;
1396                 } else if (strnicmp(data, "nointr", 6) == 0) {
1397                         vol->intr = 0;
1398                 } else if (strnicmp(data, "intr", 4) == 0) {
1399                         vol->intr = 1;
1400                 } else if (strnicmp(data, "nostrictsync", 12) == 0) {
1401                         vol->nostrictsync = 1;
1402                 } else if (strnicmp(data, "strictsync", 10) == 0) {
1403                         vol->nostrictsync = 0;
1404                 } else if (strnicmp(data, "serverino", 7) == 0) {
1405                         vol->server_ino = 1;
1406                 } else if (strnicmp(data, "noserverino", 9) == 0) {
1407                         vol->server_ino = 0;
1408                 } else if (strnicmp(data, "rwpidforward", 12) == 0) {
1409                         vol->rwpidforward = 1;
1410                 } else if (strnicmp(data, "cifsacl", 7) == 0) {
1411                         vol->cifs_acl = 1;
1412                 } else if (strnicmp(data, "nocifsacl", 9) == 0) {
1413                         vol->cifs_acl = 0;
1414                 } else if (strnicmp(data, "acl", 3) == 0) {
1415                         vol->no_psx_acl = 0;
1416                 } else if (strnicmp(data, "noacl", 5) == 0) {
1417                         vol->no_psx_acl = 1;
1418                 } else if (strnicmp(data, "locallease", 6) == 0) {
1419                         vol->local_lease = 1;
1420                 } else if (strnicmp(data, "sign", 4) == 0) {
1421                         vol->secFlg |= CIFSSEC_MUST_SIGN;
1422                 } else if (strnicmp(data, "seal", 4) == 0) {
1423                         /* we do not do the following in secFlags because seal
1424                            is a per tree connection (mount) not a per socket
1425                            or per-smb connection option in the protocol */
1426                         /* vol->secFlg |= CIFSSEC_MUST_SEAL; */
1427                         vol->seal = 1;
1428                 } else if (strnicmp(data, "direct", 6) == 0) {
1429                         vol->direct_io = 1;
1430                 } else if (strnicmp(data, "forcedirectio", 13) == 0) {
1431                         vol->direct_io = 1;
1432                 } else if (strnicmp(data, "strictcache", 11) == 0) {
1433                         vol->strict_io = 1;
1434                 } else if (strnicmp(data, "noac", 4) == 0) {
1435                         printk(KERN_WARNING "CIFS: Mount option noac not "
1436                                 "supported. Instead set "
1437                                 "/proc/fs/cifs/LookupCacheEnabled to 0\n");
1438                 } else if (strnicmp(data, "fsc", 3) == 0) {
1439 #ifndef CONFIG_CIFS_FSCACHE
1440                         cERROR(1, "FS-Cache support needs CONFIG_CIFS_FSCACHE "
1441                                   "kernel config option set");
1442                         goto cifs_parse_mount_err;
1443 #endif
1444                         vol->fsc = true;
1445                 } else if (strnicmp(data, "mfsymlinks", 10) == 0) {
1446                         vol->mfsymlinks = true;
1447                 } else if (strnicmp(data, "multiuser", 8) == 0) {
1448                         vol->multiuser = true;
1449                 } else
1450                         printk(KERN_WARNING "CIFS: Unknown mount option %s\n",
1451                                                 data);
1452         }
1453         if (vol->UNC == NULL) {
1454                 if (devname == NULL) {
1455                         printk(KERN_WARNING "CIFS: Missing UNC name for mount "
1456                                                 "target\n");
1457                         goto cifs_parse_mount_err;
1458                 }
1459                 if ((temp_len = strnlen(devname, 300)) < 300) {
1460                         vol->UNC = kmalloc(temp_len+1, GFP_KERNEL);
1461                         if (vol->UNC == NULL)
1462                                 goto cifs_parse_mount_err;
1463                         strcpy(vol->UNC, devname);
1464                         if (strncmp(vol->UNC, "//", 2) == 0) {
1465                                 vol->UNC[0] = '\\';
1466                                 vol->UNC[1] = '\\';
1467                         } else if (strncmp(vol->UNC, "\\\\", 2) != 0) {
1468                                 printk(KERN_WARNING "CIFS: UNC Path does not "
1469                                                     "begin with // or \\\\ \n");
1470                                 goto cifs_parse_mount_err;
1471                         }
1472                         value = strpbrk(vol->UNC+2, "/\\");
1473                         if (value)
1474                                 *value = '\\';
1475                 } else {
1476                         printk(KERN_WARNING "CIFS: UNC name too long\n");
1477                         goto cifs_parse_mount_err;
1478                 }
1479         }
1480
1481         if (vol->multiuser && !(vol->secFlg & CIFSSEC_MAY_KRB5)) {
1482                 cERROR(1, "Multiuser mounts currently require krb5 "
1483                           "authentication!");
1484                 goto cifs_parse_mount_err;
1485         }
1486
1487         if (vol->UNCip == NULL)
1488                 vol->UNCip = &vol->UNC[2];
1489
1490         if (uid_specified)
1491                 vol->override_uid = override_uid;
1492         else if (override_uid == 1)
1493                 printk(KERN_NOTICE "CIFS: ignoring forceuid mount option "
1494                                    "specified with no uid= option.\n");
1495
1496         if (gid_specified)
1497                 vol->override_gid = override_gid;
1498         else if (override_gid == 1)
1499                 printk(KERN_NOTICE "CIFS: ignoring forcegid mount option "
1500                                    "specified with no gid= option.\n");
1501
1502         kfree(mountdata_copy);
1503         return 0;
1504
1505 cifs_parse_mount_err:
1506         kfree(mountdata_copy);
1507         return 1;
1508 }
1509
1510 /** Returns true if srcaddr isn't specified and rhs isn't
1511  * specified, or if srcaddr is specified and
1512  * matches the IP address of the rhs argument.
1513  */
1514 static bool
1515 srcip_matches(struct sockaddr *srcaddr, struct sockaddr *rhs)
1516 {
1517         switch (srcaddr->sa_family) {
1518         case AF_UNSPEC:
1519                 return (rhs->sa_family == AF_UNSPEC);
1520         case AF_INET: {
1521                 struct sockaddr_in *saddr4 = (struct sockaddr_in *)srcaddr;
1522                 struct sockaddr_in *vaddr4 = (struct sockaddr_in *)rhs;
1523                 return (saddr4->sin_addr.s_addr == vaddr4->sin_addr.s_addr);
1524         }
1525         case AF_INET6: {
1526                 struct sockaddr_in6 *saddr6 = (struct sockaddr_in6 *)srcaddr;
1527                 struct sockaddr_in6 *vaddr6 = (struct sockaddr_in6 *)&rhs;
1528                 return ipv6_addr_equal(&saddr6->sin6_addr, &vaddr6->sin6_addr);
1529         }
1530         default:
1531                 WARN_ON(1);
1532                 return false; /* don't expect to be here */
1533         }
1534 }
1535
1536 /*
1537  * If no port is specified in addr structure, we try to match with 445 port
1538  * and if it fails - with 139 ports. It should be called only if address
1539  * families of server and addr are equal.
1540  */
1541 static bool
1542 match_port(struct TCP_Server_Info *server, struct sockaddr *addr)
1543 {
1544         __be16 port, *sport;
1545
1546         switch (addr->sa_family) {
1547         case AF_INET:
1548                 sport = &((struct sockaddr_in *) &server->dstaddr)->sin_port;
1549                 port = ((struct sockaddr_in *) addr)->sin_port;
1550                 break;
1551         case AF_INET6:
1552                 sport = &((struct sockaddr_in6 *) &server->dstaddr)->sin6_port;
1553                 port = ((struct sockaddr_in6 *) addr)->sin6_port;
1554                 break;
1555         default:
1556                 WARN_ON(1);
1557                 return false;
1558         }
1559
1560         if (!port) {
1561                 port = htons(CIFS_PORT);
1562                 if (port == *sport)
1563                         return true;
1564
1565                 port = htons(RFC1001_PORT);
1566         }
1567
1568         return port == *sport;
1569 }
1570
1571 static bool
1572 match_address(struct TCP_Server_Info *server, struct sockaddr *addr,
1573               struct sockaddr *srcaddr)
1574 {
1575         switch (addr->sa_family) {
1576         case AF_INET: {
1577                 struct sockaddr_in *addr4 = (struct sockaddr_in *)addr;
1578                 struct sockaddr_in *srv_addr4 =
1579                                         (struct sockaddr_in *)&server->dstaddr;
1580
1581                 if (addr4->sin_addr.s_addr != srv_addr4->sin_addr.s_addr)
1582                         return false;
1583                 break;
1584         }
1585         case AF_INET6: {
1586                 struct sockaddr_in6 *addr6 = (struct sockaddr_in6 *)addr;
1587                 struct sockaddr_in6 *srv_addr6 =
1588                                         (struct sockaddr_in6 *)&server->dstaddr;
1589
1590                 if (!ipv6_addr_equal(&addr6->sin6_addr,
1591                                      &srv_addr6->sin6_addr))
1592                         return false;
1593                 if (addr6->sin6_scope_id != srv_addr6->sin6_scope_id)
1594                         return false;
1595                 break;
1596         }
1597         default:
1598                 WARN_ON(1);
1599                 return false; /* don't expect to be here */
1600         }
1601
1602         if (!srcip_matches(srcaddr, (struct sockaddr *)&server->srcaddr))
1603                 return false;
1604
1605         return true;
1606 }
1607
1608 static bool
1609 match_security(struct TCP_Server_Info *server, struct smb_vol *vol)
1610 {
1611         unsigned int secFlags;
1612
1613         if (vol->secFlg & (~(CIFSSEC_MUST_SIGN | CIFSSEC_MUST_SEAL)))
1614                 secFlags = vol->secFlg;
1615         else
1616                 secFlags = global_secflags | vol->secFlg;
1617
1618         switch (server->secType) {
1619         case LANMAN:
1620                 if (!(secFlags & (CIFSSEC_MAY_LANMAN|CIFSSEC_MAY_PLNTXT)))
1621                         return false;
1622                 break;
1623         case NTLMv2:
1624                 if (!(secFlags & CIFSSEC_MAY_NTLMV2))
1625                         return false;
1626                 break;
1627         case NTLM:
1628                 if (!(secFlags & CIFSSEC_MAY_NTLM))
1629                         return false;
1630                 break;
1631         case Kerberos:
1632                 if (!(secFlags & CIFSSEC_MAY_KRB5))
1633                         return false;
1634                 break;
1635         case RawNTLMSSP:
1636                 if (!(secFlags & CIFSSEC_MAY_NTLMSSP))
1637                         return false;
1638                 break;
1639         default:
1640                 /* shouldn't happen */
1641                 return false;
1642         }
1643
1644         /* now check if signing mode is acceptable */
1645         if ((secFlags & CIFSSEC_MAY_SIGN) == 0 &&
1646             (server->sec_mode & SECMODE_SIGN_REQUIRED))
1647                         return false;
1648         else if (((secFlags & CIFSSEC_MUST_SIGN) == CIFSSEC_MUST_SIGN) &&
1649                  (server->sec_mode &
1650                   (SECMODE_SIGN_ENABLED|SECMODE_SIGN_REQUIRED)) == 0)
1651                         return false;
1652
1653         return true;
1654 }
1655
1656 static int match_server(struct TCP_Server_Info *server, struct sockaddr *addr,
1657                          struct smb_vol *vol)
1658 {
1659         if (!net_eq(cifs_net_ns(server), current->nsproxy->net_ns))
1660                 return 0;
1661
1662         if (!match_address(server, addr,
1663                            (struct sockaddr *)&vol->srcaddr))
1664                 return 0;
1665
1666         if (!match_port(server, addr))
1667                 return 0;
1668
1669         if (!match_security(server, vol))
1670                 return 0;
1671
1672         return 1;
1673 }
1674
1675 static struct TCP_Server_Info *
1676 cifs_find_tcp_session(struct sockaddr *addr, struct smb_vol *vol)
1677 {
1678         struct TCP_Server_Info *server;
1679
1680         spin_lock(&cifs_tcp_ses_lock);
1681         list_for_each_entry(server, &cifs_tcp_ses_list, tcp_ses_list) {
1682                 if (!match_server(server, addr, vol))
1683                         continue;
1684
1685                 ++server->srv_count;
1686                 spin_unlock(&cifs_tcp_ses_lock);
1687                 cFYI(1, "Existing tcp session with server found");
1688                 return server;
1689         }
1690         spin_unlock(&cifs_tcp_ses_lock);
1691         return NULL;
1692 }
1693
1694 static void
1695 cifs_put_tcp_session(struct TCP_Server_Info *server)
1696 {
1697         struct task_struct *task;
1698
1699         spin_lock(&cifs_tcp_ses_lock);
1700         if (--server->srv_count > 0) {
1701                 spin_unlock(&cifs_tcp_ses_lock);
1702                 return;
1703         }
1704
1705         put_net(cifs_net_ns(server));
1706
1707         list_del_init(&server->tcp_ses_list);
1708         spin_unlock(&cifs_tcp_ses_lock);
1709
1710         cancel_delayed_work_sync(&server->echo);
1711
1712         spin_lock(&GlobalMid_Lock);
1713         server->tcpStatus = CifsExiting;
1714         spin_unlock(&GlobalMid_Lock);
1715
1716         cifs_crypto_shash_release(server);
1717         cifs_fscache_release_client_cookie(server);
1718
1719         kfree(server->session_key.response);
1720         server->session_key.response = NULL;
1721         server->session_key.len = 0;
1722
1723         task = xchg(&server->tsk, NULL);
1724         if (task)
1725                 force_sig(SIGKILL, task);
1726 }
1727
1728 static struct TCP_Server_Info *
1729 cifs_get_tcp_session(struct smb_vol *volume_info)
1730 {
1731         struct TCP_Server_Info *tcp_ses = NULL;
1732         struct sockaddr_storage addr;
1733         struct sockaddr_in *sin_server = (struct sockaddr_in *) &addr;
1734         struct sockaddr_in6 *sin_server6 = (struct sockaddr_in6 *) &addr;
1735         int rc;
1736
1737         memset(&addr, 0, sizeof(struct sockaddr_storage));
1738
1739         cFYI(1, "UNC: %s ip: %s", volume_info->UNC, volume_info->UNCip);
1740
1741         if (volume_info->UNCip && volume_info->UNC) {
1742                 rc = cifs_fill_sockaddr((struct sockaddr *)&addr,
1743                                         volume_info->UNCip,
1744                                         strlen(volume_info->UNCip),
1745                                         volume_info->port);
1746                 if (!rc) {
1747                         /* we failed translating address */
1748                         rc = -EINVAL;
1749                         goto out_err;
1750                 }
1751         } else if (volume_info->UNCip) {
1752                 /* BB using ip addr as tcp_ses name to connect to the
1753                    DFS root below */
1754                 cERROR(1, "Connecting to DFS root not implemented yet");
1755                 rc = -EINVAL;
1756                 goto out_err;
1757         } else /* which tcp_sess DFS root would we conect to */ {
1758                 cERROR(1, "CIFS mount error: No UNC path (e.g. -o "
1759                         "unc=//192.168.1.100/public) specified");
1760                 rc = -EINVAL;
1761                 goto out_err;
1762         }
1763
1764         /* see if we already have a matching tcp_ses */
1765         tcp_ses = cifs_find_tcp_session((struct sockaddr *)&addr, volume_info);
1766         if (tcp_ses)
1767                 return tcp_ses;
1768
1769         tcp_ses = kzalloc(sizeof(struct TCP_Server_Info), GFP_KERNEL);
1770         if (!tcp_ses) {
1771                 rc = -ENOMEM;
1772                 goto out_err;
1773         }
1774
1775         rc = cifs_crypto_shash_allocate(tcp_ses);
1776         if (rc) {
1777                 cERROR(1, "could not setup hash structures rc %d", rc);
1778                 goto out_err;
1779         }
1780
1781         cifs_set_net_ns(tcp_ses, get_net(current->nsproxy->net_ns));
1782         tcp_ses->hostname = extract_hostname(volume_info->UNC);
1783         if (IS_ERR(tcp_ses->hostname)) {
1784                 rc = PTR_ERR(tcp_ses->hostname);
1785                 goto out_err_crypto_release;
1786         }
1787
1788         tcp_ses->noblocksnd = volume_info->noblocksnd;
1789         tcp_ses->noautotune = volume_info->noautotune;
1790         tcp_ses->tcp_nodelay = volume_info->sockopt_tcp_nodelay;
1791         atomic_set(&tcp_ses->inFlight, 0);
1792         init_waitqueue_head(&tcp_ses->response_q);
1793         init_waitqueue_head(&tcp_ses->request_q);
1794         INIT_LIST_HEAD(&tcp_ses->pending_mid_q);
1795         mutex_init(&tcp_ses->srv_mutex);
1796         memcpy(tcp_ses->workstation_RFC1001_name,
1797                 volume_info->source_rfc1001_name, RFC1001_NAME_LEN_WITH_NULL);
1798         memcpy(tcp_ses->server_RFC1001_name,
1799                 volume_info->target_rfc1001_name, RFC1001_NAME_LEN_WITH_NULL);
1800         tcp_ses->session_estab = false;
1801         tcp_ses->sequence_number = 0;
1802         tcp_ses->lstrp = jiffies;
1803         INIT_LIST_HEAD(&tcp_ses->tcp_ses_list);
1804         INIT_LIST_HEAD(&tcp_ses->smb_ses_list);
1805         INIT_DELAYED_WORK(&tcp_ses->echo, cifs_echo_request);
1806
1807         /*
1808          * at this point we are the only ones with the pointer
1809          * to the struct since the kernel thread not created yet
1810          * no need to spinlock this init of tcpStatus or srv_count
1811          */
1812         tcp_ses->tcpStatus = CifsNew;
1813         memcpy(&tcp_ses->srcaddr, &volume_info->srcaddr,
1814                sizeof(tcp_ses->srcaddr));
1815         ++tcp_ses->srv_count;
1816
1817         if (addr.ss_family == AF_INET6) {
1818                 cFYI(1, "attempting ipv6 connect");
1819                 /* BB should we allow ipv6 on port 139? */
1820                 /* other OS never observed in Wild doing 139 with v6 */
1821                 memcpy(&tcp_ses->dstaddr, sin_server6,
1822                        sizeof(struct sockaddr_in6));
1823         } else
1824                 memcpy(&tcp_ses->dstaddr, sin_server,
1825                        sizeof(struct sockaddr_in));
1826
1827         rc = ip_connect(tcp_ses);
1828         if (rc < 0) {
1829                 cERROR(1, "Error connecting to socket. Aborting operation");
1830                 goto out_err_crypto_release;
1831         }
1832
1833         /*
1834          * since we're in a cifs function already, we know that
1835          * this will succeed. No need for try_module_get().
1836          */
1837         __module_get(THIS_MODULE);
1838         tcp_ses->tsk = kthread_run(cifs_demultiplex_thread,
1839                                   tcp_ses, "cifsd");
1840         if (IS_ERR(tcp_ses->tsk)) {
1841                 rc = PTR_ERR(tcp_ses->tsk);
1842                 cERROR(1, "error %d create cifsd thread", rc);
1843                 module_put(THIS_MODULE);
1844                 goto out_err_crypto_release;
1845         }
1846         tcp_ses->tcpStatus = CifsNeedNegotiate;
1847
1848         /* thread spawned, put it on the list */
1849         spin_lock(&cifs_tcp_ses_lock);
1850         list_add(&tcp_ses->tcp_ses_list, &cifs_tcp_ses_list);
1851         spin_unlock(&cifs_tcp_ses_lock);
1852
1853         cifs_fscache_get_client_cookie(tcp_ses);
1854
1855         /* queue echo request delayed work */
1856         queue_delayed_work(system_nrt_wq, &tcp_ses->echo, SMB_ECHO_INTERVAL);
1857
1858         return tcp_ses;
1859
1860 out_err_crypto_release:
1861         cifs_crypto_shash_release(tcp_ses);
1862
1863         put_net(cifs_net_ns(tcp_ses));
1864
1865 out_err:
1866         if (tcp_ses) {
1867                 if (!IS_ERR(tcp_ses->hostname))
1868                         kfree(tcp_ses->hostname);
1869                 if (tcp_ses->ssocket)
1870                         sock_release(tcp_ses->ssocket);
1871                 kfree(tcp_ses);
1872         }
1873         return ERR_PTR(rc);
1874 }
1875
1876 static int match_session(struct cifs_ses *ses, struct smb_vol *vol)
1877 {
1878         switch (ses->server->secType) {
1879         case Kerberos:
1880                 if (vol->cred_uid != ses->cred_uid)
1881                         return 0;
1882                 break;
1883         default:
1884                 /* anything else takes username/password */
1885                 if (ses->user_name == NULL)
1886                         return 0;
1887                 if (strncmp(ses->user_name, vol->username,
1888                             MAX_USERNAME_SIZE))
1889                         return 0;
1890                 if (strlen(vol->username) != 0 &&
1891                     ses->password != NULL &&
1892                     strncmp(ses->password,
1893                             vol->password ? vol->password : "",
1894                             MAX_PASSWORD_SIZE))
1895                         return 0;
1896         }
1897         return 1;
1898 }
1899
1900 static struct cifs_ses *
1901 cifs_find_smb_ses(struct TCP_Server_Info *server, struct smb_vol *vol)
1902 {
1903         struct cifs_ses *ses;
1904
1905         spin_lock(&cifs_tcp_ses_lock);
1906         list_for_each_entry(ses, &server->smb_ses_list, smb_ses_list) {
1907                 if (!match_session(ses, vol))
1908                         continue;
1909                 ++ses->ses_count;
1910                 spin_unlock(&cifs_tcp_ses_lock);
1911                 return ses;
1912         }
1913         spin_unlock(&cifs_tcp_ses_lock);
1914         return NULL;
1915 }
1916
1917 static void
1918 cifs_put_smb_ses(struct cifs_ses *ses)
1919 {
1920         int xid;
1921         struct TCP_Server_Info *server = ses->server;
1922
1923         cFYI(1, "%s: ses_count=%d\n", __func__, ses->ses_count);
1924         spin_lock(&cifs_tcp_ses_lock);
1925         if (--ses->ses_count > 0) {
1926                 spin_unlock(&cifs_tcp_ses_lock);
1927                 return;
1928         }
1929
1930         list_del_init(&ses->smb_ses_list);
1931         spin_unlock(&cifs_tcp_ses_lock);
1932
1933         if (ses->status == CifsGood) {
1934                 xid = GetXid();
1935                 CIFSSMBLogoff(xid, ses);
1936                 _FreeXid(xid);
1937         }
1938         sesInfoFree(ses);
1939         cifs_put_tcp_session(server);
1940 }
1941
1942 static bool warned_on_ntlm;  /* globals init to false automatically */
1943
1944 static struct cifs_ses *
1945 cifs_get_smb_ses(struct TCP_Server_Info *server, struct smb_vol *volume_info)
1946 {
1947         int rc = -ENOMEM, xid;
1948         struct cifs_ses *ses;
1949         struct sockaddr_in *addr = (struct sockaddr_in *)&server->dstaddr;
1950         struct sockaddr_in6 *addr6 = (struct sockaddr_in6 *)&server->dstaddr;
1951
1952         xid = GetXid();
1953
1954         ses = cifs_find_smb_ses(server, volume_info);
1955         if (ses) {
1956                 cFYI(1, "Existing smb sess found (status=%d)", ses->status);
1957
1958                 mutex_lock(&ses->session_mutex);
1959                 rc = cifs_negotiate_protocol(xid, ses);
1960                 if (rc) {
1961                         mutex_unlock(&ses->session_mutex);
1962                         /* problem -- put our ses reference */
1963                         cifs_put_smb_ses(ses);
1964                         FreeXid(xid);
1965                         return ERR_PTR(rc);
1966                 }
1967                 if (ses->need_reconnect) {
1968                         cFYI(1, "Session needs reconnect");
1969                         rc = cifs_setup_session(xid, ses,
1970                                                 volume_info->local_nls);
1971                         if (rc) {
1972                                 mutex_unlock(&ses->session_mutex);
1973                                 /* problem -- put our reference */
1974                                 cifs_put_smb_ses(ses);
1975                                 FreeXid(xid);
1976                                 return ERR_PTR(rc);
1977                         }
1978                 }
1979                 mutex_unlock(&ses->session_mutex);
1980
1981                 /* existing SMB ses has a server reference already */
1982                 cifs_put_tcp_session(server);
1983                 FreeXid(xid);
1984                 return ses;
1985         }
1986
1987         cFYI(1, "Existing smb sess not found");
1988         ses = sesInfoAlloc();
1989         if (ses == NULL)
1990                 goto get_ses_fail;
1991
1992         /* new SMB session uses our server ref */
1993         ses->server = server;
1994         if (server->dstaddr.ss_family == AF_INET6)
1995                 sprintf(ses->serverName, "%pI6", &addr6->sin6_addr);
1996         else
1997                 sprintf(ses->serverName, "%pI4", &addr->sin_addr);
1998
1999         if (volume_info->username) {
2000                 ses->user_name = kstrdup(volume_info->username, GFP_KERNEL);
2001                 if (!ses->user_name)
2002                         goto get_ses_fail;
2003         }
2004
2005         /* volume_info->password freed at unmount */
2006         if (volume_info->password) {
2007                 ses->password = kstrdup(volume_info->password, GFP_KERNEL);
2008                 if (!ses->password)
2009                         goto get_ses_fail;
2010         }
2011         if (volume_info->domainname) {
2012                 ses->domainName = kstrdup(volume_info->domainname, GFP_KERNEL);
2013                 if (!ses->domainName)
2014                         goto get_ses_fail;
2015         }
2016         ses->cred_uid = volume_info->cred_uid;
2017         ses->linux_uid = volume_info->linux_uid;
2018
2019         /* ntlmv2 is much stronger than ntlm security, and has been broadly
2020         supported for many years, time to update default security mechanism */
2021         if ((volume_info->secFlg == 0) && warned_on_ntlm == false) {
2022                 warned_on_ntlm = true;
2023                 cERROR(1, "default security mechanism requested.  The default "
2024                         "security mechanism will be upgraded from ntlm to "
2025                         "ntlmv2 in kernel release 3.2");
2026         }
2027         ses->overrideSecFlg = volume_info->secFlg;
2028
2029         mutex_lock(&ses->session_mutex);
2030         rc = cifs_negotiate_protocol(xid, ses);
2031         if (!rc)
2032                 rc = cifs_setup_session(xid, ses, volume_info->local_nls);
2033         mutex_unlock(&ses->session_mutex);
2034         if (rc)
2035                 goto get_ses_fail;
2036
2037         /* success, put it on the list */
2038         spin_lock(&cifs_tcp_ses_lock);
2039         list_add(&ses->smb_ses_list, &server->smb_ses_list);
2040         spin_unlock(&cifs_tcp_ses_lock);
2041
2042         FreeXid(xid);
2043         return ses;
2044
2045 get_ses_fail:
2046         sesInfoFree(ses);
2047         FreeXid(xid);
2048         return ERR_PTR(rc);
2049 }
2050
2051 static int match_tcon(struct cifs_tcon *tcon, const char *unc)
2052 {
2053         if (tcon->tidStatus == CifsExiting)
2054                 return 0;
2055         if (strncmp(tcon->treeName, unc, MAX_TREE_SIZE))
2056                 return 0;
2057         return 1;
2058 }
2059
2060 static struct cifs_tcon *
2061 cifs_find_tcon(struct cifs_ses *ses, const char *unc)
2062 {
2063         struct list_head *tmp;
2064         struct cifs_tcon *tcon;
2065
2066         spin_lock(&cifs_tcp_ses_lock);
2067         list_for_each(tmp, &ses->tcon_list) {
2068                 tcon = list_entry(tmp, struct cifs_tcon, tcon_list);
2069                 if (!match_tcon(tcon, unc))
2070                         continue;
2071                 ++tcon->tc_count;
2072                 spin_unlock(&cifs_tcp_ses_lock);
2073                 return tcon;
2074         }
2075         spin_unlock(&cifs_tcp_ses_lock);
2076         return NULL;
2077 }
2078
2079 static void
2080 cifs_put_tcon(struct cifs_tcon *tcon)
2081 {
2082         int xid;
2083         struct cifs_ses *ses = tcon->ses;
2084
2085         cFYI(1, "%s: tc_count=%d\n", __func__, tcon->tc_count);
2086         spin_lock(&cifs_tcp_ses_lock);
2087         if (--tcon->tc_count > 0) {
2088                 spin_unlock(&cifs_tcp_ses_lock);
2089                 return;
2090         }
2091
2092         list_del_init(&tcon->tcon_list);
2093         spin_unlock(&cifs_tcp_ses_lock);
2094
2095         xid = GetXid();
2096         CIFSSMBTDis(xid, tcon);
2097         _FreeXid(xid);
2098
2099         cifs_fscache_release_super_cookie(tcon);
2100         tconInfoFree(tcon);
2101         cifs_put_smb_ses(ses);
2102 }
2103
2104 static struct cifs_tcon *
2105 cifs_get_tcon(struct cifs_ses *ses, struct smb_vol *volume_info)
2106 {
2107         int rc, xid;
2108         struct cifs_tcon *tcon;
2109
2110         tcon = cifs_find_tcon(ses, volume_info->UNC);
2111         if (tcon) {
2112                 cFYI(1, "Found match on UNC path");
2113                 /* existing tcon already has a reference */
2114                 cifs_put_smb_ses(ses);
2115                 if (tcon->seal != volume_info->seal)
2116                         cERROR(1, "transport encryption setting "
2117                                    "conflicts with existing tid");
2118                 return tcon;
2119         }
2120
2121         tcon = tconInfoAlloc();
2122         if (tcon == NULL) {
2123                 rc = -ENOMEM;
2124                 goto out_fail;
2125         }
2126
2127         tcon->ses = ses;
2128         if (volume_info->password) {
2129                 tcon->password = kstrdup(volume_info->password, GFP_KERNEL);
2130                 if (!tcon->password) {
2131                         rc = -ENOMEM;
2132                         goto out_fail;
2133                 }
2134         }
2135
2136         if (strchr(volume_info->UNC + 3, '\\') == NULL
2137             && strchr(volume_info->UNC + 3, '/') == NULL) {
2138                 cERROR(1, "Missing share name");
2139                 rc = -ENODEV;
2140                 goto out_fail;
2141         }
2142
2143         /* BB Do we need to wrap session_mutex around
2144          * this TCon call and Unix SetFS as
2145          * we do on SessSetup and reconnect? */
2146         xid = GetXid();
2147         rc = CIFSTCon(xid, ses, volume_info->UNC, tcon, volume_info->local_nls);
2148         FreeXid(xid);
2149         cFYI(1, "CIFS Tcon rc = %d", rc);
2150         if (rc)
2151                 goto out_fail;
2152
2153         if (volume_info->nodfs) {
2154                 tcon->Flags &= ~SMB_SHARE_IS_IN_DFS;
2155                 cFYI(1, "DFS disabled (%d)", tcon->Flags);
2156         }
2157         tcon->seal = volume_info->seal;
2158         /* we can have only one retry value for a connection
2159            to a share so for resources mounted more than once
2160            to the same server share the last value passed in
2161            for the retry flag is used */
2162         tcon->retry = volume_info->retry;
2163         tcon->nocase = volume_info->nocase;
2164         tcon->local_lease = volume_info->local_lease;
2165
2166         spin_lock(&cifs_tcp_ses_lock);
2167         list_add(&tcon->tcon_list, &ses->tcon_list);
2168         spin_unlock(&cifs_tcp_ses_lock);
2169
2170         cifs_fscache_get_super_cookie(tcon);
2171
2172         return tcon;
2173
2174 out_fail:
2175         tconInfoFree(tcon);
2176         return ERR_PTR(rc);
2177 }
2178
2179 void
2180 cifs_put_tlink(struct tcon_link *tlink)
2181 {
2182         if (!tlink || IS_ERR(tlink))
2183                 return;
2184
2185         if (!atomic_dec_and_test(&tlink->tl_count) ||
2186             test_bit(TCON_LINK_IN_TREE, &tlink->tl_flags)) {
2187                 tlink->tl_time = jiffies;
2188                 return;
2189         }
2190
2191         if (!IS_ERR(tlink_tcon(tlink)))
2192                 cifs_put_tcon(tlink_tcon(tlink));
2193         kfree(tlink);
2194         return;
2195 }
2196
2197 static inline struct tcon_link *
2198 cifs_sb_master_tlink(struct cifs_sb_info *cifs_sb)
2199 {
2200         return cifs_sb->master_tlink;
2201 }
2202
2203 static int
2204 compare_mount_options(struct super_block *sb, struct cifs_mnt_data *mnt_data)
2205 {
2206         struct cifs_sb_info *old = CIFS_SB(sb);
2207         struct cifs_sb_info *new = mnt_data->cifs_sb;
2208
2209         if ((sb->s_flags & CIFS_MS_MASK) != (mnt_data->flags & CIFS_MS_MASK))
2210                 return 0;
2211
2212         if ((old->mnt_cifs_flags & CIFS_MOUNT_MASK) !=
2213             (new->mnt_cifs_flags & CIFS_MOUNT_MASK))
2214                 return 0;
2215
2216         if (old->rsize != new->rsize)
2217                 return 0;
2218
2219         /*
2220          * We want to share sb only if we don't specify wsize or specified wsize
2221          * is greater or equal than existing one.
2222          */
2223         if (new->wsize && new->wsize < old->wsize)
2224                 return 0;
2225
2226         if (old->mnt_uid != new->mnt_uid || old->mnt_gid != new->mnt_gid)
2227                 return 0;
2228
2229         if (old->mnt_file_mode != new->mnt_file_mode ||
2230             old->mnt_dir_mode != new->mnt_dir_mode)
2231                 return 0;
2232
2233         if (strcmp(old->local_nls->charset, new->local_nls->charset))
2234                 return 0;
2235
2236         if (old->actimeo != new->actimeo)
2237                 return 0;
2238
2239         return 1;
2240 }
2241
2242 int
2243 cifs_match_super(struct super_block *sb, void *data)
2244 {
2245         struct cifs_mnt_data *mnt_data = (struct cifs_mnt_data *)data;
2246         struct smb_vol *volume_info;
2247         struct cifs_sb_info *cifs_sb;
2248         struct TCP_Server_Info *tcp_srv;
2249         struct cifs_ses *ses;
2250         struct cifs_tcon *tcon;
2251         struct tcon_link *tlink;
2252         struct sockaddr_storage addr;
2253         int rc = 0;
2254
2255         memset(&addr, 0, sizeof(struct sockaddr_storage));
2256
2257         spin_lock(&cifs_tcp_ses_lock);
2258         cifs_sb = CIFS_SB(sb);
2259         tlink = cifs_get_tlink(cifs_sb_master_tlink(cifs_sb));
2260         if (IS_ERR(tlink)) {
2261                 spin_unlock(&cifs_tcp_ses_lock);
2262                 return rc;
2263         }
2264         tcon = tlink_tcon(tlink);
2265         ses = tcon->ses;
2266         tcp_srv = ses->server;
2267
2268         volume_info = mnt_data->vol;
2269
2270         if (!volume_info->UNCip || !volume_info->UNC)
2271                 goto out;
2272
2273         rc = cifs_fill_sockaddr((struct sockaddr *)&addr,
2274                                 volume_info->UNCip,
2275                                 strlen(volume_info->UNCip),
2276                                 volume_info->port);
2277         if (!rc)
2278                 goto out;
2279
2280         if (!match_server(tcp_srv, (struct sockaddr *)&addr, volume_info) ||
2281             !match_session(ses, volume_info) ||
2282             !match_tcon(tcon, volume_info->UNC)) {
2283                 rc = 0;
2284                 goto out;
2285         }
2286
2287         rc = compare_mount_options(sb, mnt_data);
2288 out:
2289         spin_unlock(&cifs_tcp_ses_lock);
2290         cifs_put_tlink(tlink);
2291         return rc;
2292 }
2293
2294 int
2295 get_dfs_path(int xid, struct cifs_ses *pSesInfo, const char *old_path,
2296              const struct nls_table *nls_codepage, unsigned int *pnum_referrals,
2297              struct dfs_info3_param **preferrals, int remap)
2298 {
2299         char *temp_unc;
2300         int rc = 0;
2301
2302         *pnum_referrals = 0;
2303         *preferrals = NULL;
2304
2305         if (pSesInfo->ipc_tid == 0) {
2306                 temp_unc = kmalloc(2 /* for slashes */ +
2307                         strnlen(pSesInfo->serverName,
2308                                 SERVER_NAME_LEN_WITH_NULL * 2)
2309                                  + 1 + 4 /* slash IPC$ */  + 2,
2310                                 GFP_KERNEL);
2311                 if (temp_unc == NULL)
2312                         return -ENOMEM;
2313                 temp_unc[0] = '\\';
2314                 temp_unc[1] = '\\';
2315                 strcpy(temp_unc + 2, pSesInfo->serverName);
2316                 strcpy(temp_unc + 2 + strlen(pSesInfo->serverName), "\\IPC$");
2317                 rc = CIFSTCon(xid, pSesInfo, temp_unc, NULL, nls_codepage);
2318                 cFYI(1, "CIFS Tcon rc = %d ipc_tid = %d", rc, pSesInfo->ipc_tid);
2319                 kfree(temp_unc);
2320         }
2321         if (rc == 0)
2322                 rc = CIFSGetDFSRefer(xid, pSesInfo, old_path, preferrals,
2323                                      pnum_referrals, nls_codepage, remap);
2324         /* BB map targetUNCs to dfs_info3 structures, here or
2325                 in CIFSGetDFSRefer BB */
2326
2327         return rc;
2328 }
2329
2330 #ifdef CONFIG_DEBUG_LOCK_ALLOC
2331 static struct lock_class_key cifs_key[2];
2332 static struct lock_class_key cifs_slock_key[2];
2333
2334 static inline void
2335 cifs_reclassify_socket4(struct socket *sock)
2336 {
2337         struct sock *sk = sock->sk;
2338         BUG_ON(sock_owned_by_user(sk));
2339         sock_lock_init_class_and_name(sk, "slock-AF_INET-CIFS",
2340                 &cifs_slock_key[0], "sk_lock-AF_INET-CIFS", &cifs_key[0]);
2341 }
2342
2343 static inline void
2344 cifs_reclassify_socket6(struct socket *sock)
2345 {
2346         struct sock *sk = sock->sk;
2347         BUG_ON(sock_owned_by_user(sk));
2348         sock_lock_init_class_and_name(sk, "slock-AF_INET6-CIFS",
2349                 &cifs_slock_key[1], "sk_lock-AF_INET6-CIFS", &cifs_key[1]);
2350 }
2351 #else
2352 static inline void
2353 cifs_reclassify_socket4(struct socket *sock)
2354 {
2355 }
2356
2357 static inline void
2358 cifs_reclassify_socket6(struct socket *sock)
2359 {
2360 }
2361 #endif
2362
2363 /* See RFC1001 section 14 on representation of Netbios names */
2364 static void rfc1002mangle(char *target, char *source, unsigned int length)
2365 {
2366         unsigned int i, j;
2367
2368         for (i = 0, j = 0; i < (length); i++) {
2369                 /* mask a nibble at a time and encode */
2370                 target[j] = 'A' + (0x0F & (source[i] >> 4));
2371                 target[j+1] = 'A' + (0x0F & source[i]);
2372                 j += 2;
2373         }
2374
2375 }
2376
2377 static int
2378 bind_socket(struct TCP_Server_Info *server)
2379 {
2380         int rc = 0;
2381         if (server->srcaddr.ss_family != AF_UNSPEC) {
2382                 /* Bind to the specified local IP address */
2383                 struct socket *socket = server->ssocket;
2384                 rc = socket->ops->bind(socket,
2385                                        (struct sockaddr *) &server->srcaddr,
2386                                        sizeof(server->srcaddr));
2387                 if (rc < 0) {
2388                         struct sockaddr_in *saddr4;
2389                         struct sockaddr_in6 *saddr6;
2390                         saddr4 = (struct sockaddr_in *)&server->srcaddr;
2391                         saddr6 = (struct sockaddr_in6 *)&server->srcaddr;
2392                         if (saddr6->sin6_family == AF_INET6)
2393                                 cERROR(1, "cifs: "
2394                                        "Failed to bind to: %pI6c, error: %d\n",
2395                                        &saddr6->sin6_addr, rc);
2396                         else
2397                                 cERROR(1, "cifs: "
2398                                        "Failed to bind to: %pI4, error: %d\n",
2399                                        &saddr4->sin_addr.s_addr, rc);
2400                 }
2401         }
2402         return rc;
2403 }
2404
2405 static int
2406 ip_rfc1001_connect(struct TCP_Server_Info *server)
2407 {
2408         int rc = 0;
2409         /*
2410          * some servers require RFC1001 sessinit before sending
2411          * negprot - BB check reconnection in case where second
2412          * sessinit is sent but no second negprot
2413          */
2414         struct rfc1002_session_packet *ses_init_buf;
2415         struct smb_hdr *smb_buf;
2416         ses_init_buf = kzalloc(sizeof(struct rfc1002_session_packet),
2417                                GFP_KERNEL);
2418         if (ses_init_buf) {
2419                 ses_init_buf->trailer.session_req.called_len = 32;
2420
2421                 if (server->server_RFC1001_name &&
2422                     server->server_RFC1001_name[0] != 0)
2423                         rfc1002mangle(ses_init_buf->trailer.
2424                                       session_req.called_name,
2425                                       server->server_RFC1001_name,
2426                                       RFC1001_NAME_LEN_WITH_NULL);
2427                 else
2428                         rfc1002mangle(ses_init_buf->trailer.
2429                                       session_req.called_name,
2430                                       DEFAULT_CIFS_CALLED_NAME,
2431                                       RFC1001_NAME_LEN_WITH_NULL);
2432
2433                 ses_init_buf->trailer.session_req.calling_len = 32;
2434
2435                 /*
2436                  * calling name ends in null (byte 16) from old smb
2437                  * convention.
2438                  */
2439                 if (server->workstation_RFC1001_name &&
2440                     server->workstation_RFC1001_name[0] != 0)
2441                         rfc1002mangle(ses_init_buf->trailer.
2442                                       session_req.calling_name,
2443                                       server->workstation_RFC1001_name,
2444                                       RFC1001_NAME_LEN_WITH_NULL);
2445                 else
2446                         rfc1002mangle(ses_init_buf->trailer.
2447                                       session_req.calling_name,
2448                                       "LINUX_CIFS_CLNT",
2449                                       RFC1001_NAME_LEN_WITH_NULL);
2450
2451                 ses_init_buf->trailer.session_req.scope1 = 0;
2452                 ses_init_buf->trailer.session_req.scope2 = 0;
2453                 smb_buf = (struct smb_hdr *)ses_init_buf;
2454
2455                 /* sizeof RFC1002_SESSION_REQUEST with no scope */
2456                 smb_buf->smb_buf_length = cpu_to_be32(0x81000044);
2457                 rc = smb_send(server, smb_buf, 0x44);
2458                 kfree(ses_init_buf);
2459                 /*
2460                  * RFC1001 layer in at least one server
2461                  * requires very short break before negprot
2462                  * presumably because not expecting negprot
2463                  * to follow so fast.  This is a simple
2464                  * solution that works without
2465                  * complicating the code and causes no
2466                  * significant slowing down on mount
2467                  * for everyone else
2468                  */
2469                 usleep_range(1000, 2000);
2470         }
2471         /*
2472          * else the negprot may still work without this
2473          * even though malloc failed
2474          */
2475
2476         return rc;
2477 }
2478
2479 static int
2480 generic_ip_connect(struct TCP_Server_Info *server)
2481 {
2482         int rc = 0;
2483         __be16 sport;
2484         int slen, sfamily;
2485         struct socket *socket = server->ssocket;
2486         struct sockaddr *saddr;
2487
2488         saddr = (struct sockaddr *) &server->dstaddr;
2489
2490         if (server->dstaddr.ss_family == AF_INET6) {
2491                 sport = ((struct sockaddr_in6 *) saddr)->sin6_port;
2492                 slen = sizeof(struct sockaddr_in6);
2493                 sfamily = AF_INET6;
2494         } else {
2495                 sport = ((struct sockaddr_in *) saddr)->sin_port;
2496                 slen = sizeof(struct sockaddr_in);
2497                 sfamily = AF_INET;
2498         }
2499
2500         if (socket == NULL) {
2501                 rc = __sock_create(cifs_net_ns(server), sfamily, SOCK_STREAM,
2502                                    IPPROTO_TCP, &socket, 1);
2503                 if (rc < 0) {
2504                         cERROR(1, "Error %d creating socket", rc);
2505                         server->ssocket = NULL;
2506                         return rc;
2507                 }
2508
2509                 /* BB other socket options to set KEEPALIVE, NODELAY? */
2510                 cFYI(1, "Socket created");
2511                 server->ssocket = socket;
2512                 socket->sk->sk_allocation = GFP_NOFS;
2513                 if (sfamily == AF_INET6)
2514                         cifs_reclassify_socket6(socket);
2515                 else
2516                         cifs_reclassify_socket4(socket);
2517         }
2518
2519         rc = bind_socket(server);
2520         if (rc < 0)
2521                 return rc;
2522
2523         /*
2524          * Eventually check for other socket options to change from
2525          * the default. sock_setsockopt not used because it expects
2526          * user space buffer
2527          */
2528         socket->sk->sk_rcvtimeo = 7 * HZ;
2529         socket->sk->sk_sndtimeo = 5 * HZ;
2530
2531         /* make the bufsizes depend on wsize/rsize and max requests */
2532         if (server->noautotune) {
2533                 if (socket->sk->sk_sndbuf < (200 * 1024))
2534                         socket->sk->sk_sndbuf = 200 * 1024;
2535                 if (socket->sk->sk_rcvbuf < (140 * 1024))
2536                         socket->sk->sk_rcvbuf = 140 * 1024;
2537         }
2538
2539         if (server->tcp_nodelay) {
2540                 int val = 1;
2541                 rc = kernel_setsockopt(socket, SOL_TCP, TCP_NODELAY,
2542                                 (char *)&val, sizeof(val));
2543                 if (rc)
2544                         cFYI(1, "set TCP_NODELAY socket option error %d", rc);
2545         }
2546
2547          cFYI(1, "sndbuf %d rcvbuf %d rcvtimeo 0x%lx",
2548                  socket->sk->sk_sndbuf,
2549                  socket->sk->sk_rcvbuf, socket->sk->sk_rcvtimeo);
2550
2551         rc = socket->ops->connect(socket, saddr, slen, 0);
2552         if (rc < 0) {
2553                 cFYI(1, "Error %d connecting to server", rc);
2554                 sock_release(socket);
2555                 server->ssocket = NULL;
2556                 return rc;
2557         }
2558
2559         if (sport == htons(RFC1001_PORT))
2560                 rc = ip_rfc1001_connect(server);
2561
2562         return rc;
2563 }
2564
2565 static int
2566 ip_connect(struct TCP_Server_Info *server)
2567 {
2568         __be16 *sport;
2569         struct sockaddr_in6 *addr6 = (struct sockaddr_in6 *)&server->dstaddr;
2570         struct sockaddr_in *addr = (struct sockaddr_in *)&server->dstaddr;
2571
2572         if (server->dstaddr.ss_family == AF_INET6)
2573                 sport = &addr6->sin6_port;
2574         else
2575                 sport = &addr->sin_port;
2576
2577         if (*sport == 0) {
2578                 int rc;
2579
2580                 /* try with 445 port at first */
2581                 *sport = htons(CIFS_PORT);
2582
2583                 rc = generic_ip_connect(server);
2584                 if (rc >= 0)
2585                         return rc;
2586
2587                 /* if it failed, try with 139 port */
2588                 *sport = htons(RFC1001_PORT);
2589         }
2590
2591         return generic_ip_connect(server);
2592 }
2593
2594 void reset_cifs_unix_caps(int xid, struct cifs_tcon *tcon,
2595                           struct cifs_sb_info *cifs_sb, struct smb_vol *vol_info)
2596 {
2597         /* if we are reconnecting then should we check to see if
2598          * any requested capabilities changed locally e.g. via
2599          * remount but we can not do much about it here
2600          * if they have (even if we could detect it by the following)
2601          * Perhaps we could add a backpointer to array of sb from tcon
2602          * or if we change to make all sb to same share the same
2603          * sb as NFS - then we only have one backpointer to sb.
2604          * What if we wanted to mount the server share twice once with
2605          * and once without posixacls or posix paths? */
2606         __u64 saved_cap = le64_to_cpu(tcon->fsUnixInfo.Capability);
2607
2608         if (vol_info && vol_info->no_linux_ext) {
2609                 tcon->fsUnixInfo.Capability = 0;
2610                 tcon->unix_ext = 0; /* Unix Extensions disabled */
2611                 cFYI(1, "Linux protocol extensions disabled");
2612                 return;
2613         } else if (vol_info)
2614                 tcon->unix_ext = 1; /* Unix Extensions supported */
2615
2616         if (tcon->unix_ext == 0) {
2617                 cFYI(1, "Unix extensions disabled so not set on reconnect");
2618                 return;
2619         }
2620
2621         if (!CIFSSMBQFSUnixInfo(xid, tcon)) {
2622                 __u64 cap = le64_to_cpu(tcon->fsUnixInfo.Capability);
2623                 cFYI(1, "unix caps which server supports %lld", cap);
2624                 /* check for reconnect case in which we do not
2625                    want to change the mount behavior if we can avoid it */
2626                 if (vol_info == NULL) {
2627                         /* turn off POSIX ACL and PATHNAMES if not set
2628                            originally at mount time */
2629                         if ((saved_cap & CIFS_UNIX_POSIX_ACL_CAP) == 0)
2630                                 cap &= ~CIFS_UNIX_POSIX_ACL_CAP;
2631                         if ((saved_cap & CIFS_UNIX_POSIX_PATHNAMES_CAP) == 0) {
2632                                 if (cap & CIFS_UNIX_POSIX_PATHNAMES_CAP)
2633                                         cERROR(1, "POSIXPATH support change");
2634                                 cap &= ~CIFS_UNIX_POSIX_PATHNAMES_CAP;
2635                         } else if ((cap & CIFS_UNIX_POSIX_PATHNAMES_CAP) == 0) {
2636                                 cERROR(1, "possible reconnect error");
2637                                 cERROR(1, "server disabled POSIX path support");
2638                         }
2639                 }
2640
2641                 if (cap & CIFS_UNIX_TRANSPORT_ENCRYPTION_MANDATORY_CAP)
2642                         cERROR(1, "per-share encryption not supported yet");
2643
2644                 cap &= CIFS_UNIX_CAP_MASK;
2645                 if (vol_info && vol_info->no_psx_acl)
2646                         cap &= ~CIFS_UNIX_POSIX_ACL_CAP;
2647                 else if (CIFS_UNIX_POSIX_ACL_CAP & cap) {
2648                         cFYI(1, "negotiated posix acl support");
2649                         if (cifs_sb)
2650                                 cifs_sb->mnt_cifs_flags |=
2651                                         CIFS_MOUNT_POSIXACL;
2652                 }
2653
2654                 if (vol_info && vol_info->posix_paths == 0)
2655                         cap &= ~CIFS_UNIX_POSIX_PATHNAMES_CAP;
2656                 else if (cap & CIFS_UNIX_POSIX_PATHNAMES_CAP) {
2657                         cFYI(1, "negotiate posix pathnames");
2658                         if (cifs_sb)
2659                                 cifs_sb->mnt_cifs_flags |=
2660                                         CIFS_MOUNT_POSIX_PATHS;
2661                 }
2662
2663                 if (cifs_sb && (cifs_sb->rsize > 127 * 1024)) {
2664                         if ((cap & CIFS_UNIX_LARGE_READ_CAP) == 0) {
2665                                 cifs_sb->rsize = 127 * 1024;
2666                                 cFYI(DBG2, "larger reads not supported by srv");
2667                         }
2668                 }
2669
2670
2671                 cFYI(1, "Negotiate caps 0x%x", (int)cap);
2672 #ifdef CONFIG_CIFS_DEBUG2
2673                 if (cap & CIFS_UNIX_FCNTL_CAP)
2674                         cFYI(1, "FCNTL cap");
2675                 if (cap & CIFS_UNIX_EXTATTR_CAP)
2676                         cFYI(1, "EXTATTR cap");
2677                 if (cap & CIFS_UNIX_POSIX_PATHNAMES_CAP)
2678                         cFYI(1, "POSIX path cap");
2679                 if (cap & CIFS_UNIX_XATTR_CAP)
2680                         cFYI(1, "XATTR cap");
2681                 if (cap & CIFS_UNIX_POSIX_ACL_CAP)
2682                         cFYI(1, "POSIX ACL cap");
2683                 if (cap & CIFS_UNIX_LARGE_READ_CAP)
2684                         cFYI(1, "very large read cap");
2685                 if (cap & CIFS_UNIX_LARGE_WRITE_CAP)
2686                         cFYI(1, "very large write cap");
2687                 if (cap & CIFS_UNIX_TRANSPORT_ENCRYPTION_CAP)
2688                         cFYI(1, "transport encryption cap");
2689                 if (cap & CIFS_UNIX_TRANSPORT_ENCRYPTION_MANDATORY_CAP)
2690                         cFYI(1, "mandatory transport encryption cap");
2691 #endif /* CIFS_DEBUG2 */
2692                 if (CIFSSMBSetFSUnixInfo(xid, tcon, cap)) {
2693                         if (vol_info == NULL) {
2694                                 cFYI(1, "resetting capabilities failed");
2695                         } else
2696                                 cERROR(1, "Negotiating Unix capabilities "
2697                                            "with the server failed.  Consider "
2698                                            "mounting with the Unix Extensions\n"
2699                                            "disabled, if problems are found, "
2700                                            "by specifying the nounix mount "
2701                                            "option.");
2702
2703                 }
2704         }
2705 }
2706
2707 void cifs_setup_cifs_sb(struct smb_vol *pvolume_info,
2708                         struct cifs_sb_info *cifs_sb)
2709 {
2710         INIT_DELAYED_WORK(&cifs_sb->prune_tlinks, cifs_prune_tlinks);
2711
2712         spin_lock_init(&cifs_sb->tlink_tree_lock);
2713         cifs_sb->tlink_tree = RB_ROOT;
2714
2715         if (pvolume_info->rsize > CIFSMaxBufSize) {
2716                 cERROR(1, "rsize %d too large, using MaxBufSize",
2717                         pvolume_info->rsize);
2718                 cifs_sb->rsize = CIFSMaxBufSize;
2719         } else if ((pvolume_info->rsize) &&
2720                         (pvolume_info->rsize <= CIFSMaxBufSize))
2721                 cifs_sb->rsize = pvolume_info->rsize;
2722         else /* default */
2723                 cifs_sb->rsize = CIFSMaxBufSize;
2724
2725         if (cifs_sb->rsize < 2048) {
2726                 cifs_sb->rsize = 2048;
2727                 /* Windows ME may prefer this */
2728                 cFYI(1, "readsize set to minimum: 2048");
2729         }
2730
2731         /*
2732          * Temporarily set wsize for matching superblock. If we end up using
2733          * new sb then cifs_negotiate_wsize will later negotiate it downward
2734          * if needed.
2735          */
2736         cifs_sb->wsize = pvolume_info->wsize;
2737
2738         cifs_sb->mnt_uid = pvolume_info->linux_uid;
2739         cifs_sb->mnt_gid = pvolume_info->linux_gid;
2740         cifs_sb->mnt_file_mode = pvolume_info->file_mode;
2741         cifs_sb->mnt_dir_mode = pvolume_info->dir_mode;
2742         cFYI(1, "file mode: 0x%x  dir mode: 0x%x",
2743                 cifs_sb->mnt_file_mode, cifs_sb->mnt_dir_mode);
2744
2745         cifs_sb->actimeo = pvolume_info->actimeo;
2746         cifs_sb->local_nls = pvolume_info->local_nls;
2747
2748         if (pvolume_info->noperm)
2749                 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_NO_PERM;
2750         if (pvolume_info->setuids)
2751                 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_SET_UID;
2752         if (pvolume_info->server_ino)
2753                 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_SERVER_INUM;
2754         if (pvolume_info->remap)
2755                 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_MAP_SPECIAL_CHR;
2756         if (pvolume_info->no_xattr)
2757                 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_NO_XATTR;
2758         if (pvolume_info->sfu_emul)
2759                 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_UNX_EMUL;
2760         if (pvolume_info->nobrl)
2761                 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_NO_BRL;
2762         if (pvolume_info->nostrictsync)
2763                 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_NOSSYNC;
2764         if (pvolume_info->mand_lock)
2765                 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_NOPOSIXBRL;
2766         if (pvolume_info->rwpidforward)
2767                 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_RWPIDFORWARD;
2768         if (pvolume_info->cifs_acl)
2769                 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_CIFS_ACL;
2770         if (pvolume_info->override_uid)
2771                 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_OVERR_UID;
2772         if (pvolume_info->override_gid)
2773                 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_OVERR_GID;
2774         if (pvolume_info->dynperm)
2775                 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_DYNPERM;
2776         if (pvolume_info->fsc)
2777                 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_FSCACHE;
2778         if (pvolume_info->multiuser)
2779                 cifs_sb->mnt_cifs_flags |= (CIFS_MOUNT_MULTIUSER |
2780                                             CIFS_MOUNT_NO_PERM);
2781         if (pvolume_info->strict_io)
2782                 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_STRICT_IO;
2783         if (pvolume_info->direct_io) {
2784                 cFYI(1, "mounting share using direct i/o");
2785                 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_DIRECT_IO;
2786         }
2787         if (pvolume_info->mfsymlinks) {
2788                 if (pvolume_info->sfu_emul) {
2789                         cERROR(1,  "mount option mfsymlinks ignored if sfu "
2790                                    "mount option is used");
2791                 } else {
2792                         cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_MF_SYMLINKS;
2793                 }
2794         }
2795
2796         if ((pvolume_info->cifs_acl) && (pvolume_info->dynperm))
2797                 cERROR(1, "mount option dynperm ignored if cifsacl "
2798                            "mount option supported");
2799 }
2800
2801 /*
2802  * When the server supports very large writes via POSIX extensions, we can
2803  * allow up to 2^24-1, minus the size of a WRITE_AND_X header, not including
2804  * the RFC1001 length.
2805  *
2806  * Note that this might make for "interesting" allocation problems during
2807  * writeback however as we have to allocate an array of pointers for the
2808  * pages. A 16M write means ~32kb page array with PAGE_CACHE_SIZE == 4096.
2809  */
2810 #define CIFS_MAX_WSIZE ((1<<24) - 1 - sizeof(WRITE_REQ) + 4)
2811
2812 /*
2813  * When the server doesn't allow large posix writes, only allow a wsize of
2814  * 128k minus the size of the WRITE_AND_X header. That allows for a write up
2815  * to the maximum size described by RFC1002.
2816  */
2817 #define CIFS_MAX_RFC1002_WSIZE (128 * 1024 - sizeof(WRITE_REQ) + 4)
2818
2819 /*
2820  * The default wsize is 1M. find_get_pages seems to return a maximum of 256
2821  * pages in a single call. With PAGE_CACHE_SIZE == 4k, this means we can fill
2822  * a single wsize request with a single call.
2823  */
2824 #define CIFS_DEFAULT_WSIZE (1024 * 1024)
2825
2826 static unsigned int
2827 cifs_negotiate_wsize(struct cifs_tcon *tcon, struct smb_vol *pvolume_info)
2828 {
2829         __u64 unix_cap = le64_to_cpu(tcon->fsUnixInfo.Capability);
2830         struct TCP_Server_Info *server = tcon->ses->server;
2831         unsigned int wsize = pvolume_info->wsize ? pvolume_info->wsize :
2832                                 CIFS_DEFAULT_WSIZE;
2833
2834         /* can server support 24-bit write sizes? (via UNIX extensions) */
2835         if (!tcon->unix_ext || !(unix_cap & CIFS_UNIX_LARGE_WRITE_CAP))
2836                 wsize = min_t(unsigned int, wsize, CIFS_MAX_RFC1002_WSIZE);
2837
2838         /*
2839          * no CAP_LARGE_WRITE_X or is signing enabled without CAP_UNIX set?
2840          * Limit it to max buffer offered by the server, minus the size of the
2841          * WRITEX header, not including the 4 byte RFC1001 length.
2842          */
2843         if (!(server->capabilities & CAP_LARGE_WRITE_X) ||
2844             (!(server->capabilities & CAP_UNIX) &&
2845              (server->sec_mode & (SECMODE_SIGN_ENABLED|SECMODE_SIGN_REQUIRED))))
2846                 wsize = min_t(unsigned int, wsize,
2847                                 server->maxBuf - sizeof(WRITE_REQ) + 4);
2848
2849         /* hard limit of CIFS_MAX_WSIZE */
2850         wsize = min_t(unsigned int, wsize, CIFS_MAX_WSIZE);
2851
2852         return wsize;
2853 }
2854
2855 static int
2856 is_path_accessible(int xid, struct cifs_tcon *tcon,
2857                    struct cifs_sb_info *cifs_sb, const char *full_path)
2858 {
2859         int rc;
2860         FILE_ALL_INFO *pfile_info;
2861
2862         pfile_info = kmalloc(sizeof(FILE_ALL_INFO), GFP_KERNEL);
2863         if (pfile_info == NULL)
2864                 return -ENOMEM;
2865
2866         rc = CIFSSMBQPathInfo(xid, tcon, full_path, pfile_info,
2867                               0 /* not legacy */, cifs_sb->local_nls,
2868                               cifs_sb->mnt_cifs_flags &
2869                                 CIFS_MOUNT_MAP_SPECIAL_CHR);
2870
2871         if (rc == -EOPNOTSUPP || rc == -EINVAL)
2872                 rc = SMBQueryInformation(xid, tcon, full_path, pfile_info,
2873                                 cifs_sb->local_nls, cifs_sb->mnt_cifs_flags &
2874                                   CIFS_MOUNT_MAP_SPECIAL_CHR);
2875         kfree(pfile_info);
2876         return rc;
2877 }
2878
2879 static void
2880 cleanup_volume_info_contents(struct smb_vol *volume_info)
2881 {
2882         kfree(volume_info->username);
2883         kzfree(volume_info->password);
2884         kfree(volume_info->UNC);
2885         if (volume_info->UNCip != volume_info->UNC + 2)
2886                 kfree(volume_info->UNCip);
2887         kfree(volume_info->domainname);
2888         kfree(volume_info->iocharset);
2889         kfree(volume_info->prepath);
2890 }
2891
2892 void
2893 cifs_cleanup_volume_info(struct smb_vol *volume_info)
2894 {
2895         if (!volume_info)
2896                 return;
2897         cleanup_volume_info_contents(volume_info);
2898         kfree(volume_info);
2899 }
2900
2901
2902 #ifdef CONFIG_CIFS_DFS_UPCALL
2903 /* build_path_to_root returns full path to root when
2904  * we do not have an exiting connection (tcon) */
2905 static char *
2906 build_unc_path_to_root(const struct smb_vol *vol,
2907                 const struct cifs_sb_info *cifs_sb)
2908 {
2909         char *full_path, *pos;
2910         unsigned int pplen = vol->prepath ? strlen(vol->prepath) : 0;
2911         unsigned int unc_len = strnlen(vol->UNC, MAX_TREE_SIZE + 1);
2912
2913         full_path = kmalloc(unc_len + pplen + 1, GFP_KERNEL);
2914         if (full_path == NULL)
2915                 return ERR_PTR(-ENOMEM);
2916
2917         strncpy(full_path, vol->UNC, unc_len);
2918         pos = full_path + unc_len;
2919
2920         if (pplen) {
2921                 strncpy(pos, vol->prepath, pplen);
2922                 pos += pplen;
2923         }
2924
2925         *pos = '\0'; /* add trailing null */
2926         convert_delimiter(full_path, CIFS_DIR_SEP(cifs_sb));
2927         cFYI(1, "%s: full_path=%s", __func__, full_path);
2928         return full_path;
2929 }
2930
2931 /*
2932  * Perform a dfs referral query for a share and (optionally) prefix
2933  *
2934  * If a referral is found, cifs_sb->mountdata will be (re-)allocated
2935  * to a string containing updated options for the submount.  Otherwise it
2936  * will be left untouched.
2937  *
2938  * Returns the rc from get_dfs_path to the caller, which can be used to
2939  * determine whether there were referrals.
2940  */
2941 static int
2942 expand_dfs_referral(int xid, struct cifs_ses *pSesInfo,
2943                     struct smb_vol *volume_info, struct cifs_sb_info *cifs_sb,
2944                     int check_prefix)
2945 {
2946         int rc;
2947         unsigned int num_referrals = 0;
2948         struct dfs_info3_param *referrals = NULL;
2949         char *full_path = NULL, *ref_path = NULL, *mdata = NULL;
2950
2951         full_path = build_unc_path_to_root(volume_info, cifs_sb);
2952         if (IS_ERR(full_path))
2953                 return PTR_ERR(full_path);
2954
2955         /* For DFS paths, skip the first '\' of the UNC */
2956         ref_path = check_prefix ? full_path + 1 : volume_info->UNC + 1;
2957
2958         rc = get_dfs_path(xid, pSesInfo , ref_path, cifs_sb->local_nls,
2959                           &num_referrals, &referrals,
2960                           cifs_sb->mnt_cifs_flags & CIFS_MOUNT_MAP_SPECIAL_CHR);
2961
2962         if (!rc && num_referrals > 0) {
2963                 char *fake_devname = NULL;
2964
2965                 mdata = cifs_compose_mount_options(cifs_sb->mountdata,
2966                                                    full_path + 1, referrals,
2967                                                    &fake_devname);
2968
2969                 free_dfs_info_array(referrals, num_referrals);
2970
2971                 if (IS_ERR(mdata)) {
2972                         rc = PTR_ERR(mdata);
2973                         mdata = NULL;
2974                 } else {
2975                         cleanup_volume_info_contents(volume_info);
2976                         memset(volume_info, '\0', sizeof(*volume_info));
2977                         rc = cifs_setup_volume_info(volume_info, mdata,
2978                                                         fake_devname);
2979                 }
2980                 kfree(fake_devname);
2981                 kfree(cifs_sb->mountdata);
2982                 cifs_sb->mountdata = mdata;
2983         }
2984         kfree(full_path);
2985         return rc;
2986 }
2987 #endif
2988
2989 static int
2990 cifs_setup_volume_info(struct smb_vol *volume_info, char *mount_data,
2991                         const char *devname)
2992 {
2993         int rc = 0;
2994
2995         if (cifs_parse_mount_options(mount_data, devname, volume_info))
2996                 return -EINVAL;
2997
2998         if (volume_info->nullauth) {
2999                 cFYI(1, "null user");
3000                 volume_info->username = kzalloc(1, GFP_KERNEL);
3001                 if (volume_info->username == NULL)
3002                         return -ENOMEM;
3003         } else if (volume_info->username) {
3004                 /* BB fixme parse for domain name here */
3005                 cFYI(1, "Username: %s", volume_info->username);
3006         } else {
3007                 cifserror("No username specified");
3008         /* In userspace mount helper we can get user name from alternate
3009            locations such as env variables and files on disk */
3010                 return -EINVAL;
3011         }
3012
3013         /* this is needed for ASCII cp to Unicode converts */
3014         if (volume_info->iocharset == NULL) {
3015                 /* load_nls_default cannot return null */
3016                 volume_info->local_nls = load_nls_default();
3017         } else {
3018                 volume_info->local_nls = load_nls(volume_info->iocharset);
3019                 if (volume_info->local_nls == NULL) {
3020                         cERROR(1, "CIFS mount error: iocharset %s not found",
3021                                  volume_info->iocharset);
3022                         return -ELIBACC;
3023                 }
3024         }
3025
3026         return rc;
3027 }
3028
3029 struct smb_vol *
3030 cifs_get_volume_info(char *mount_data, const char *devname)
3031 {
3032         int rc;
3033         struct smb_vol *volume_info;
3034
3035         volume_info = kzalloc(sizeof(struct smb_vol), GFP_KERNEL);
3036         if (!volume_info)
3037                 return ERR_PTR(-ENOMEM);
3038
3039         rc = cifs_setup_volume_info(volume_info, mount_data, devname);
3040         if (rc) {
3041                 cifs_cleanup_volume_info(volume_info);
3042                 volume_info = ERR_PTR(rc);
3043         }
3044
3045         return volume_info;
3046 }
3047
3048 int
3049 cifs_mount(struct cifs_sb_info *cifs_sb, struct smb_vol *volume_info)
3050 {
3051         int rc = 0;
3052         int xid;
3053         struct cifs_ses *pSesInfo;
3054         struct cifs_tcon *tcon;
3055         struct TCP_Server_Info *srvTcp;
3056         char   *full_path;
3057         struct tcon_link *tlink;
3058 #ifdef CONFIG_CIFS_DFS_UPCALL
3059         int referral_walks_count = 0;
3060 #endif
3061
3062         rc = bdi_setup_and_register(&cifs_sb->bdi, "cifs", BDI_CAP_MAP_COPY);
3063         if (rc)
3064                 return rc;
3065
3066         cifs_sb->bdi.ra_pages = default_backing_dev_info.ra_pages;
3067
3068 #ifdef CONFIG_CIFS_DFS_UPCALL
3069 try_mount_again:
3070         /* cleanup activities if we're chasing a referral */
3071         if (referral_walks_count) {
3072                 if (tcon)
3073                         cifs_put_tcon(tcon);
3074                 else if (pSesInfo)
3075                         cifs_put_smb_ses(pSesInfo);
3076
3077                 FreeXid(xid);
3078         }
3079 #endif
3080         tcon = NULL;
3081         pSesInfo = NULL;
3082         srvTcp = NULL;
3083         full_path = NULL;
3084         tlink = NULL;
3085
3086         xid = GetXid();
3087
3088         /* get a reference to a tcp session */
3089         srvTcp = cifs_get_tcp_session(volume_info);
3090         if (IS_ERR(srvTcp)) {
3091                 rc = PTR_ERR(srvTcp);
3092                 bdi_destroy(&cifs_sb->bdi);
3093                 goto out;
3094         }
3095
3096         /* get a reference to a SMB session */
3097         pSesInfo = cifs_get_smb_ses(srvTcp, volume_info);
3098         if (IS_ERR(pSesInfo)) {
3099                 rc = PTR_ERR(pSesInfo);
3100                 pSesInfo = NULL;
3101                 goto mount_fail_check;
3102         }
3103
3104         /* search for existing tcon to this server share */
3105         tcon = cifs_get_tcon(pSesInfo, volume_info);
3106         if (IS_ERR(tcon)) {
3107                 rc = PTR_ERR(tcon);
3108                 tcon = NULL;
3109                 goto remote_path_check;
3110         }
3111
3112         /* tell server which Unix caps we support */
3113         if (tcon->ses->capabilities & CAP_UNIX) {
3114                 /* reset of caps checks mount to see if unix extensions
3115                    disabled for just this mount */
3116                 reset_cifs_unix_caps(xid, tcon, cifs_sb, volume_info);
3117                 if ((tcon->ses->server->tcpStatus == CifsNeedReconnect) &&
3118                     (le64_to_cpu(tcon->fsUnixInfo.Capability) &
3119                      CIFS_UNIX_TRANSPORT_ENCRYPTION_MANDATORY_CAP)) {
3120                         rc = -EACCES;
3121                         goto mount_fail_check;
3122                 }
3123         } else
3124                 tcon->unix_ext = 0; /* server does not support them */
3125
3126         /* do not care if following two calls succeed - informational */
3127         if (!tcon->ipc) {
3128                 CIFSSMBQFSDeviceInfo(xid, tcon);
3129                 CIFSSMBQFSAttributeInfo(xid, tcon);
3130         }
3131
3132         if ((tcon->unix_ext == 0) && (cifs_sb->rsize > (1024 * 127))) {
3133                 cifs_sb->rsize = 1024 * 127;
3134                 cFYI(DBG2, "no very large read support, rsize now 127K");
3135         }
3136         if (!(tcon->ses->capabilities & CAP_LARGE_READ_X))
3137                 cifs_sb->rsize = min(cifs_sb->rsize, CIFSMaxBufSize);
3138
3139         cifs_sb->wsize = cifs_negotiate_wsize(tcon, volume_info);
3140
3141 remote_path_check:
3142 #ifdef CONFIG_CIFS_DFS_UPCALL
3143         /*
3144          * Perform an unconditional check for whether there are DFS
3145          * referrals for this path without prefix, to provide support
3146          * for DFS referrals from w2k8 servers which don't seem to respond
3147          * with PATH_NOT_COVERED to requests that include the prefix.
3148          * Chase the referral if found, otherwise continue normally.
3149          */
3150         if (referral_walks_count == 0) {
3151                 int refrc = expand_dfs_referral(xid, pSesInfo, volume_info,
3152                                                 cifs_sb, false);
3153                 if (!refrc) {
3154                         referral_walks_count++;
3155                         goto try_mount_again;
3156                 }
3157         }
3158 #endif
3159
3160         /* check if a whole path is not remote */
3161         if (!rc && tcon) {
3162                 /* build_path_to_root works only when we have a valid tcon */
3163                 full_path = cifs_build_path_to_root(volume_info, cifs_sb, tcon);
3164                 if (full_path == NULL) {
3165                         rc = -ENOMEM;
3166                         goto mount_fail_check;
3167                 }
3168                 rc = is_path_accessible(xid, tcon, cifs_sb, full_path);
3169                 if (rc != 0 && rc != -EREMOTE) {
3170                         kfree(full_path);
3171                         goto mount_fail_check;
3172                 }
3173                 kfree(full_path);
3174         }
3175
3176         /* get referral if needed */
3177         if (rc == -EREMOTE) {
3178 #ifdef CONFIG_CIFS_DFS_UPCALL
3179                 if (referral_walks_count > MAX_NESTED_LINKS) {
3180                         /*
3181                          * BB: when we implement proper loop detection,
3182                          *     we will remove this check. But now we need it
3183                          *     to prevent an indefinite loop if 'DFS tree' is
3184                          *     misconfigured (i.e. has loops).
3185                          */
3186                         rc = -ELOOP;
3187                         goto mount_fail_check;
3188                 }
3189
3190                 rc = expand_dfs_referral(xid, pSesInfo, volume_info, cifs_sb,
3191                                          true);
3192
3193                 if (!rc) {
3194                         referral_walks_count++;
3195                         goto try_mount_again;
3196                 }
3197                 goto mount_fail_check;
3198 #else /* No DFS support, return error on mount */
3199                 rc = -EOPNOTSUPP;
3200 #endif
3201         }
3202
3203         if (rc)
3204                 goto mount_fail_check;
3205
3206         /* now, hang the tcon off of the superblock */
3207         tlink = kzalloc(sizeof *tlink, GFP_KERNEL);
3208         if (tlink == NULL) {
3209                 rc = -ENOMEM;
3210                 goto mount_fail_check;
3211         }
3212
3213         tlink->tl_uid = pSesInfo->linux_uid;
3214         tlink->tl_tcon = tcon;
3215         tlink->tl_time = jiffies;
3216         set_bit(TCON_LINK_MASTER, &tlink->tl_flags);
3217         set_bit(TCON_LINK_IN_TREE, &tlink->tl_flags);
3218
3219         cifs_sb->master_tlink = tlink;
3220         spin_lock(&cifs_sb->tlink_tree_lock);
3221         tlink_rb_insert(&cifs_sb->tlink_tree, tlink);
3222         spin_unlock(&cifs_sb->tlink_tree_lock);
3223
3224         queue_delayed_work(system_nrt_wq, &cifs_sb->prune_tlinks,
3225                                 TLINK_IDLE_EXPIRE);
3226
3227 mount_fail_check:
3228         /* on error free sesinfo and tcon struct if needed */
3229         if (rc) {
3230                 /* If find_unc succeeded then rc == 0 so we can not end */
3231                 /* up accidentally freeing someone elses tcon struct */
3232                 if (tcon)
3233                         cifs_put_tcon(tcon);
3234                 else if (pSesInfo)
3235                         cifs_put_smb_ses(pSesInfo);
3236                 else
3237                         cifs_put_tcp_session(srvTcp);
3238                 bdi_destroy(&cifs_sb->bdi);
3239         }
3240
3241 out:
3242         FreeXid(xid);
3243         return rc;
3244 }
3245
3246 /*
3247  * Issue a TREE_CONNECT request. Note that for IPC$ shares, that the tcon
3248  * pointer may be NULL.
3249  */
3250 int
3251 CIFSTCon(unsigned int xid, struct cifs_ses *ses,
3252          const char *tree, struct cifs_tcon *tcon,
3253          const struct nls_table *nls_codepage)
3254 {
3255         struct smb_hdr *smb_buffer;
3256         struct smb_hdr *smb_buffer_response;
3257         TCONX_REQ *pSMB;
3258         TCONX_RSP *pSMBr;
3259         unsigned char *bcc_ptr;
3260         int rc = 0;
3261         int length;
3262         __u16 bytes_left, count;
3263
3264         if (ses == NULL)
3265                 return -EIO;
3266
3267         smb_buffer = cifs_buf_get();
3268         if (smb_buffer == NULL)
3269                 return -ENOMEM;
3270
3271         smb_buffer_response = smb_buffer;
3272
3273         header_assemble(smb_buffer, SMB_COM_TREE_CONNECT_ANDX,
3274                         NULL /*no tid */ , 4 /*wct */ );
3275
3276         smb_buffer->Mid = GetNextMid(ses->server);
3277         smb_buffer->Uid = ses->Suid;
3278         pSMB = (TCONX_REQ *) smb_buffer;
3279         pSMBr = (TCONX_RSP *) smb_buffer_response;
3280
3281         pSMB->AndXCommand = 0xFF;
3282         pSMB->Flags = cpu_to_le16(TCON_EXTENDED_SECINFO);
3283         bcc_ptr = &pSMB->Password[0];
3284         if (!tcon || (ses->server->sec_mode & SECMODE_USER)) {
3285                 pSMB->PasswordLength = cpu_to_le16(1);  /* minimum */
3286                 *bcc_ptr = 0; /* password is null byte */
3287                 bcc_ptr++;              /* skip password */
3288                 /* already aligned so no need to do it below */
3289         } else {
3290                 pSMB->PasswordLength = cpu_to_le16(CIFS_AUTH_RESP_SIZE);
3291                 /* BB FIXME add code to fail this if NTLMv2 or Kerberos
3292                    specified as required (when that support is added to
3293                    the vfs in the future) as only NTLM or the much
3294                    weaker LANMAN (which we do not send by default) is accepted
3295                    by Samba (not sure whether other servers allow
3296                    NTLMv2 password here) */
3297 #ifdef CONFIG_CIFS_WEAK_PW_HASH
3298                 if ((global_secflags & CIFSSEC_MAY_LANMAN) &&
3299                     (ses->server->secType == LANMAN))
3300                         calc_lanman_hash(tcon->password, ses->server->cryptkey,
3301                                          ses->server->sec_mode &
3302                                             SECMODE_PW_ENCRYPT ? true : false,
3303                                          bcc_ptr);
3304                 else
3305 #endif /* CIFS_WEAK_PW_HASH */
3306                 rc = SMBNTencrypt(tcon->password, ses->server->cryptkey,
3307                                         bcc_ptr);
3308
3309                 bcc_ptr += CIFS_AUTH_RESP_SIZE;
3310                 if (ses->capabilities & CAP_UNICODE) {
3311                         /* must align unicode strings */
3312                         *bcc_ptr = 0; /* null byte password */
3313                         bcc_ptr++;
3314                 }
3315         }
3316
3317         if (ses->server->sec_mode &
3318                         (SECMODE_SIGN_REQUIRED | SECMODE_SIGN_ENABLED))
3319                 smb_buffer->Flags2 |= SMBFLG2_SECURITY_SIGNATURE;
3320
3321         if (ses->capabilities & CAP_STATUS32) {
3322                 smb_buffer->Flags2 |= SMBFLG2_ERR_STATUS;
3323         }
3324         if (ses->capabilities & CAP_DFS) {
3325                 smb_buffer->Flags2 |= SMBFLG2_DFS;
3326         }
3327         if (ses->capabilities & CAP_UNICODE) {
3328                 smb_buffer->Flags2 |= SMBFLG2_UNICODE;
3329                 length =
3330                     cifs_strtoUCS((__le16 *) bcc_ptr, tree,
3331                         6 /* max utf8 char length in bytes */ *
3332                         (/* server len*/ + 256 /* share len */), nls_codepage);
3333                 bcc_ptr += 2 * length;  /* convert num 16 bit words to bytes */
3334                 bcc_ptr += 2;   /* skip trailing null */
3335         } else {                /* ASCII */
3336                 strcpy(bcc_ptr, tree);
3337                 bcc_ptr += strlen(tree) + 1;
3338         }
3339         strcpy(bcc_ptr, "?????");
3340         bcc_ptr += strlen("?????");
3341         bcc_ptr += 1;
3342         count = bcc_ptr - &pSMB->Password[0];
3343         pSMB->hdr.smb_buf_length = cpu_to_be32(be32_to_cpu(
3344                                         pSMB->hdr.smb_buf_length) + count);
3345         pSMB->ByteCount = cpu_to_le16(count);
3346
3347         rc = SendReceive(xid, ses, smb_buffer, smb_buffer_response, &length,
3348                          0);
3349
3350         /* above now done in SendReceive */
3351         if ((rc == 0) && (tcon != NULL)) {
3352                 bool is_unicode;
3353
3354                 tcon->tidStatus = CifsGood;
3355                 tcon->need_reconnect = false;
3356                 tcon->tid = smb_buffer_response->Tid;
3357                 bcc_ptr = pByteArea(smb_buffer_response);
3358                 bytes_left = get_bcc(smb_buffer_response);
3359                 length = strnlen(bcc_ptr, bytes_left - 2);
3360                 if (smb_buffer->Flags2 & SMBFLG2_UNICODE)
3361                         is_unicode = true;
3362                 else
3363                         is_unicode = false;
3364
3365
3366                 /* skip service field (NB: this field is always ASCII) */
3367                 if (length == 3) {
3368                         if ((bcc_ptr[0] == 'I') && (bcc_ptr[1] == 'P') &&
3369                             (bcc_ptr[2] == 'C')) {
3370                                 cFYI(1, "IPC connection");
3371                                 tcon->ipc = 1;
3372                         }
3373                 } else if (length == 2) {
3374                         if ((bcc_ptr[0] == 'A') && (bcc_ptr[1] == ':')) {
3375                                 /* the most common case */
3376                                 cFYI(1, "disk share connection");
3377                         }
3378                 }
3379                 bcc_ptr += length + 1;
3380                 bytes_left -= (length + 1);
3381                 strncpy(tcon->treeName, tree, MAX_TREE_SIZE);
3382
3383                 /* mostly informational -- no need to fail on error here */
3384                 kfree(tcon->nativeFileSystem);
3385                 tcon->nativeFileSystem = cifs_strndup_from_ucs(bcc_ptr,
3386                                                       bytes_left, is_unicode,
3387                                                       nls_codepage);
3388
3389                 cFYI(1, "nativeFileSystem=%s", tcon->nativeFileSystem);
3390
3391                 if ((smb_buffer_response->WordCount == 3) ||
3392                          (smb_buffer_response->WordCount == 7))
3393                         /* field is in same location */
3394                         tcon->Flags = le16_to_cpu(pSMBr->OptionalSupport);
3395                 else
3396                         tcon->Flags = 0;
3397                 cFYI(1, "Tcon flags: 0x%x ", tcon->Flags);
3398         } else if ((rc == 0) && tcon == NULL) {
3399                 /* all we need to save for IPC$ connection */
3400                 ses->ipc_tid = smb_buffer_response->Tid;
3401         }
3402
3403         cifs_buf_release(smb_buffer);
3404         return rc;
3405 }
3406
3407 void
3408 cifs_umount(struct cifs_sb_info *cifs_sb)
3409 {
3410         struct rb_root *root = &cifs_sb->tlink_tree;
3411         struct rb_node *node;
3412         struct tcon_link *tlink;
3413
3414         cancel_delayed_work_sync(&cifs_sb->prune_tlinks);
3415
3416         spin_lock(&cifs_sb->tlink_tree_lock);
3417         while ((node = rb_first(root))) {
3418                 tlink = rb_entry(node, struct tcon_link, tl_rbnode);
3419                 cifs_get_tlink(tlink);
3420                 clear_bit(TCON_LINK_IN_TREE, &tlink->tl_flags);
3421                 rb_erase(node, root);
3422
3423                 spin_unlock(&cifs_sb->tlink_tree_lock);
3424                 cifs_put_tlink(tlink);
3425                 spin_lock(&cifs_sb->tlink_tree_lock);
3426         }
3427         spin_unlock(&cifs_sb->tlink_tree_lock);
3428
3429         bdi_destroy(&cifs_sb->bdi);
3430         kfree(cifs_sb->mountdata);
3431         unload_nls(cifs_sb->local_nls);
3432         kfree(cifs_sb);
3433 }
3434
3435 int cifs_negotiate_protocol(unsigned int xid, struct cifs_ses *ses)
3436 {
3437         int rc = 0;
3438         struct TCP_Server_Info *server = ses->server;
3439
3440         /* only send once per connect */
3441         if (server->maxBuf != 0)
3442                 return 0;
3443
3444         rc = CIFSSMBNegotiate(xid, ses);
3445         if (rc == -EAGAIN) {
3446                 /* retry only once on 1st time connection */
3447                 rc = CIFSSMBNegotiate(xid, ses);
3448                 if (rc == -EAGAIN)
3449                         rc = -EHOSTDOWN;
3450         }
3451         if (rc == 0) {
3452                 spin_lock(&GlobalMid_Lock);
3453                 if (server->tcpStatus == CifsNeedNegotiate)
3454                         server->tcpStatus = CifsGood;
3455                 else
3456                         rc = -EHOSTDOWN;
3457                 spin_unlock(&GlobalMid_Lock);
3458
3459         }
3460
3461         return rc;
3462 }
3463
3464
3465 int cifs_setup_session(unsigned int xid, struct cifs_ses *ses,
3466                         struct nls_table *nls_info)
3467 {
3468         int rc = 0;
3469         struct TCP_Server_Info *server = ses->server;
3470
3471         ses->flags = 0;
3472         ses->capabilities = server->capabilities;
3473         if (linuxExtEnabled == 0)
3474                 ses->capabilities &= (~CAP_UNIX);
3475
3476         cFYI(1, "Security Mode: 0x%x Capabilities: 0x%x TimeAdjust: %d",
3477                  server->sec_mode, server->capabilities, server->timeAdj);
3478
3479         rc = CIFS_SessSetup(xid, ses, nls_info);
3480         if (rc) {
3481                 cERROR(1, "Send error in SessSetup = %d", rc);
3482         } else {
3483                 mutex_lock(&ses->server->srv_mutex);
3484                 if (!server->session_estab) {
3485                         server->session_key.response = ses->auth_key.response;
3486                         server->session_key.len = ses->auth_key.len;
3487                         server->sequence_number = 0x2;
3488                         server->session_estab = true;
3489                         ses->auth_key.response = NULL;
3490                 }
3491                 mutex_unlock(&server->srv_mutex);
3492
3493                 cFYI(1, "CIFS Session Established successfully");
3494                 spin_lock(&GlobalMid_Lock);
3495                 ses->status = CifsGood;
3496                 ses->need_reconnect = false;
3497                 spin_unlock(&GlobalMid_Lock);
3498         }
3499
3500         kfree(ses->auth_key.response);
3501         ses->auth_key.response = NULL;
3502         ses->auth_key.len = 0;
3503         kfree(ses->ntlmssp);
3504         ses->ntlmssp = NULL;
3505
3506         return rc;
3507 }
3508
3509 static struct cifs_tcon *
3510 cifs_construct_tcon(struct cifs_sb_info *cifs_sb, uid_t fsuid)
3511 {
3512         struct cifs_tcon *master_tcon = cifs_sb_master_tcon(cifs_sb);
3513         struct cifs_ses *ses;
3514         struct cifs_tcon *tcon = NULL;
3515         struct smb_vol *vol_info;
3516         char username[28]; /* big enough for "krb50x" + hex of ULONG_MAX 6+16 */
3517                            /* We used to have this as MAX_USERNAME which is   */
3518                            /* way too big now (256 instead of 32) */
3519
3520         vol_info = kzalloc(sizeof(*vol_info), GFP_KERNEL);
3521         if (vol_info == NULL) {
3522                 tcon = ERR_PTR(-ENOMEM);
3523                 goto out;
3524         }
3525
3526         snprintf(username, sizeof(username), "krb50x%x", fsuid);
3527         vol_info->username = username;
3528         vol_info->local_nls = cifs_sb->local_nls;
3529         vol_info->linux_uid = fsuid;
3530         vol_info->cred_uid = fsuid;
3531         vol_info->UNC = master_tcon->treeName;
3532         vol_info->retry = master_tcon->retry;
3533         vol_info->nocase = master_tcon->nocase;
3534         vol_info->local_lease = master_tcon->local_lease;
3535         vol_info->no_linux_ext = !master_tcon->unix_ext;
3536
3537         /* FIXME: allow for other secFlg settings */
3538         vol_info->secFlg = CIFSSEC_MUST_KRB5;
3539
3540         /* get a reference for the same TCP session */
3541         spin_lock(&cifs_tcp_ses_lock);
3542         ++master_tcon->ses->server->srv_count;
3543         spin_unlock(&cifs_tcp_ses_lock);
3544
3545         ses = cifs_get_smb_ses(master_tcon->ses->server, vol_info);
3546         if (IS_ERR(ses)) {
3547                 tcon = (struct cifs_tcon *)ses;
3548                 cifs_put_tcp_session(master_tcon->ses->server);
3549                 goto out;
3550         }
3551
3552         tcon = cifs_get_tcon(ses, vol_info);
3553         if (IS_ERR(tcon)) {
3554                 cifs_put_smb_ses(ses);
3555                 goto out;
3556         }
3557
3558         if (ses->capabilities & CAP_UNIX)
3559                 reset_cifs_unix_caps(0, tcon, NULL, vol_info);
3560 out:
3561         kfree(vol_info);
3562
3563         return tcon;
3564 }
3565
3566 struct cifs_tcon *
3567 cifs_sb_master_tcon(struct cifs_sb_info *cifs_sb)
3568 {
3569         return tlink_tcon(cifs_sb_master_tlink(cifs_sb));
3570 }
3571
3572 static int
3573 cifs_sb_tcon_pending_wait(void *unused)
3574 {
3575         schedule();
3576         return signal_pending(current) ? -ERESTARTSYS : 0;
3577 }
3578
3579 /* find and return a tlink with given uid */
3580 static struct tcon_link *
3581 tlink_rb_search(struct rb_root *root, uid_t uid)
3582 {
3583         struct rb_node *node = root->rb_node;
3584         struct tcon_link *tlink;
3585
3586         while (node) {
3587                 tlink = rb_entry(node, struct tcon_link, tl_rbnode);
3588
3589                 if (tlink->tl_uid > uid)
3590                         node = node->rb_left;
3591                 else if (tlink->tl_uid < uid)
3592                         node = node->rb_right;
3593                 else
3594                         return tlink;
3595         }
3596         return NULL;
3597 }
3598
3599 /* insert a tcon_link into the tree */
3600 static void
3601 tlink_rb_insert(struct rb_root *root, struct tcon_link *new_tlink)
3602 {
3603         struct rb_node **new = &(root->rb_node), *parent = NULL;
3604         struct tcon_link *tlink;
3605
3606         while (*new) {
3607                 tlink = rb_entry(*new, struct tcon_link, tl_rbnode);
3608                 parent = *new;
3609
3610                 if (tlink->tl_uid > new_tlink->tl_uid)
3611                         new = &((*new)->rb_left);
3612                 else
3613                         new = &((*new)->rb_right);
3614         }
3615
3616         rb_link_node(&new_tlink->tl_rbnode, parent, new);
3617         rb_insert_color(&new_tlink->tl_rbnode, root);
3618 }
3619
3620 /*
3621  * Find or construct an appropriate tcon given a cifs_sb and the fsuid of the
3622  * current task.
3623  *
3624  * If the superblock doesn't refer to a multiuser mount, then just return
3625  * the master tcon for the mount.
3626  *
3627  * First, search the rbtree for an existing tcon for this fsuid. If one
3628  * exists, then check to see if it's pending construction. If it is then wait
3629  * for construction to complete. Once it's no longer pending, check to see if
3630  * it failed and either return an error or retry construction, depending on
3631  * the timeout.
3632  *
3633  * If one doesn't exist then insert a new tcon_link struct into the tree and
3634  * try to construct a new one.
3635  */
3636 struct tcon_link *
3637 cifs_sb_tlink(struct cifs_sb_info *cifs_sb)
3638 {
3639         int ret;
3640         uid_t fsuid = current_fsuid();
3641         struct tcon_link *tlink, *newtlink;
3642
3643         if (!(cifs_sb->mnt_cifs_flags & CIFS_MOUNT_MULTIUSER))
3644                 return cifs_get_tlink(cifs_sb_master_tlink(cifs_sb));
3645
3646         spin_lock(&cifs_sb->tlink_tree_lock);
3647         tlink = tlink_rb_search(&cifs_sb->tlink_tree, fsuid);
3648         if (tlink)
3649                 cifs_get_tlink(tlink);
3650         spin_unlock(&cifs_sb->tlink_tree_lock);
3651
3652         if (tlink == NULL) {
3653                 newtlink = kzalloc(sizeof(*tlink), GFP_KERNEL);
3654                 if (newtlink == NULL)
3655                         return ERR_PTR(-ENOMEM);
3656                 newtlink->tl_uid = fsuid;
3657                 newtlink->tl_tcon = ERR_PTR(-EACCES);
3658                 set_bit(TCON_LINK_PENDING, &newtlink->tl_flags);
3659                 set_bit(TCON_LINK_IN_TREE, &newtlink->tl_flags);
3660                 cifs_get_tlink(newtlink);
3661
3662                 spin_lock(&cifs_sb->tlink_tree_lock);
3663                 /* was one inserted after previous search? */
3664                 tlink = tlink_rb_search(&cifs_sb->tlink_tree, fsuid);
3665                 if (tlink) {
3666                         cifs_get_tlink(tlink);
3667                         spin_unlock(&cifs_sb->tlink_tree_lock);
3668                         kfree(newtlink);
3669                         goto wait_for_construction;
3670                 }
3671                 tlink = newtlink;
3672                 tlink_rb_insert(&cifs_sb->tlink_tree, tlink);
3673                 spin_unlock(&cifs_sb->tlink_tree_lock);
3674         } else {
3675 wait_for_construction:
3676                 ret = wait_on_bit(&tlink->tl_flags, TCON_LINK_PENDING,
3677                                   cifs_sb_tcon_pending_wait,
3678                                   TASK_INTERRUPTIBLE);
3679                 if (ret) {
3680                         cifs_put_tlink(tlink);
3681                         return ERR_PTR(ret);
3682                 }
3683
3684                 /* if it's good, return it */
3685                 if (!IS_ERR(tlink->tl_tcon))
3686                         return tlink;
3687
3688                 /* return error if we tried this already recently */
3689                 if (time_before(jiffies, tlink->tl_time + TLINK_ERROR_EXPIRE)) {
3690                         cifs_put_tlink(tlink);
3691                         return ERR_PTR(-EACCES);
3692                 }
3693
3694                 if (test_and_set_bit(TCON_LINK_PENDING, &tlink->tl_flags))
3695                         goto wait_for_construction;
3696         }
3697
3698         tlink->tl_tcon = cifs_construct_tcon(cifs_sb, fsuid);
3699         clear_bit(TCON_LINK_PENDING, &tlink->tl_flags);
3700         wake_up_bit(&tlink->tl_flags, TCON_LINK_PENDING);
3701
3702         if (IS_ERR(tlink->tl_tcon)) {
3703                 cifs_put_tlink(tlink);
3704                 return ERR_PTR(-EACCES);
3705         }
3706
3707         return tlink;
3708 }
3709
3710 /*
3711  * periodic workqueue job that scans tcon_tree for a superblock and closes
3712  * out tcons.
3713  */
3714 static void
3715 cifs_prune_tlinks(struct work_struct *work)
3716 {
3717         struct cifs_sb_info *cifs_sb = container_of(work, struct cifs_sb_info,
3718                                                     prune_tlinks.work);
3719         struct rb_root *root = &cifs_sb->tlink_tree;
3720         struct rb_node *node = rb_first(root);
3721         struct rb_node *tmp;
3722         struct tcon_link *tlink;
3723
3724         /*
3725          * Because we drop the spinlock in the loop in order to put the tlink
3726          * it's not guarded against removal of links from the tree. The only
3727          * places that remove entries from the tree are this function and
3728          * umounts. Because this function is non-reentrant and is canceled
3729          * before umount can proceed, this is safe.
3730          */
3731         spin_lock(&cifs_sb->tlink_tree_lock);
3732         node = rb_first(root);
3733         while (node != NULL) {
3734                 tmp = node;
3735                 node = rb_next(tmp);
3736                 tlink = rb_entry(tmp, struct tcon_link, tl_rbnode);
3737
3738                 if (test_bit(TCON_LINK_MASTER, &tlink->tl_flags) ||
3739                     atomic_read(&tlink->tl_count) != 0 ||
3740                     time_after(tlink->tl_time + TLINK_IDLE_EXPIRE, jiffies))
3741                         continue;
3742
3743                 cifs_get_tlink(tlink);
3744                 clear_bit(TCON_LINK_IN_TREE, &tlink->tl_flags);
3745                 rb_erase(tmp, root);
3746
3747                 spin_unlock(&cifs_sb->tlink_tree_lock);
3748                 cifs_put_tlink(tlink);
3749                 spin_lock(&cifs_sb->tlink_tree_lock);
3750         }
3751         spin_unlock(&cifs_sb->tlink_tree_lock);
3752
3753         queue_delayed_work(system_nrt_wq, &cifs_sb->prune_tlinks,
3754                                 TLINK_IDLE_EXPIRE);
3755 }