fs/cifs/transport.c

   1 /*
   2  *   fs/cifs/transport.c
   3  *
   4  *   Copyright (C) International Business Machines  Corp., 2002,2008
   5  *   Author(s): Steve French (sfrench@us.ibm.com)
   6  *   Jeremy Allison (jra@samba.org) 2006.
   7  *
   8  *   This library is free software; you can redistribute it and/or modify
   9  *   it under the terms of the GNU Lesser General Public License as published
  10  *   by the Free Software Foundation; either version 2.1 of the License, or
  11  *   (at your option) any later version.
  12  *
  13  *   This library is distributed in the hope that it will be useful,
  14  *   but WITHOUT ANY WARRANTY; without even the implied warranty of
  15  *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See
  16  *   the GNU Lesser General Public License for more details.
  17  *
  18  *   You should have received a copy of the GNU Lesser General Public License
  19  *   along with this library; if not, write to the Free Software
  20  *   Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
  21  */
  22
  23 #include <linux/fs.h>
  24 #include <linux/list.h>
  25 #include <linux/gfp.h>
  26 #include <linux/wait.h>
  27 #include <linux/net.h>
  28 #include <linux/delay.h>
  29 #include <linux/freezer.h>
  30 #include <asm/uaccess.h>
  31 #include <asm/processor.h>
  32 #include <linux/mempool.h>
  33 #include "cifspdu.h"
  34 #include "cifsglob.h"
  35 #include "cifsproto.h"
  36 #include "cifs_debug.h"
  37
  38 extern mempool_t *cifs_mid_poolp;
  39
  40 static void
  41 wake_up_task(struct mid_q_entry *mid)
  42 {
  43         wake_up_process(mid->callback_data);
  44 }
  45
  46 struct mid_q_entry *
  47 AllocMidQEntry(const struct smb_hdr *smb_buffer, struct TCP_Server_Info *server)
  48 {
  49         struct mid_q_entry *temp;
  50
  51         if (server == NULL) {
  52                 cERROR(1, "Null TCP session in AllocMidQEntry");
  53                 return NULL;
  54         }
  55
  56         temp = mempool_alloc(cifs_mid_poolp, GFP_NOFS);
  57         if (temp == NULL)
  58                 return temp;
  59         else {
  60                 memset(temp, 0, sizeof(struct mid_q_entry));
  61                 temp->mid = smb_buffer->Mid;    /* always LE */
  62                 temp->pid = current->pid;
  63                 temp->command = smb_buffer->Command;
  64                 cFYI(1, "For smb_command %d", temp->command);
  65         /*      do_gettimeofday(&temp->when_sent);*/ /* easier to use jiffies */
  66                 /* when mid allocated can be before when sent */
  67                 temp->when_alloc = jiffies;
  68
  69                 /*
  70                  * The default is for the mid to be synchronous, so the
  71                  * default callback just wakes up the current task.
  72                  */
  73                 temp->callback = wake_up_task;
  74                 temp->callback_data = current;
  75         }
  76
  77         atomic_inc(&midCount);
  78         temp->midState = MID_REQUEST_ALLOCATED;
  79         return temp;
  80 }
  81
  82 void
  83 DeleteMidQEntry(struct mid_q_entry *midEntry)
  84 {
  85 #ifdef CONFIG_CIFS_STATS2
  86         unsigned long now;
  87 #endif
  88         midEntry->midState = MID_FREE;
  89         atomic_dec(&midCount);
  90         if (midEntry->largeBuf)
  91                 cifs_buf_release(midEntry->resp_buf);
  92         else
  93                 cifs_small_buf_release(midEntry->resp_buf);
  94 #ifdef CONFIG_CIFS_STATS2
  95         now = jiffies;
  96         /* commands taking longer than one second are indications that
  97            something is wrong, unless it is quite a slow link or server */
  98         if ((now - midEntry->when_alloc) > HZ) {
  99                 if ((cifsFYI & CIFS_TIMER) &&
 100                    (midEntry->command != SMB_COM_LOCKING_ANDX)) {
 101                         printk(KERN_DEBUG " CIFS slow rsp: cmd %d mid %d",
 102                                midEntry->command, midEntry->mid);
 103                         printk(" A: 0x%lx S: 0x%lx R: 0x%lx\n",
 104                                now - midEntry->when_alloc,
 105                                now - midEntry->when_sent,
 106                                now - midEntry->when_received);
 107                 }
 108         }
 109 #endif
 110         mempool_free(midEntry, cifs_mid_poolp);
 111 }
 112
 113 static void
 114 delete_mid(struct mid_q_entry *mid)
 115 {
 116         spin_lock(&GlobalMid_Lock);
 117         list_del(&mid->qhead);
 118         spin_unlock(&GlobalMid_Lock);
 119
 120         DeleteMidQEntry(mid);
 121 }
 122
 123 static int
 124 smb_sendv(struct TCP_Server_Info *server, struct kvec *iov, int n_vec)
 125 {
 126         int rc = 0;
 127         int i = 0;
 128         struct msghdr smb_msg;
 129         struct smb_hdr *smb_buffer = iov[0].iov_base;
 130         unsigned int len = iov[0].iov_len;
 131         unsigned int total_len;
 132         int first_vec = 0;
 133         unsigned int smb_buf_length = be32_to_cpu(smb_buffer->smb_buf_length);
 134         struct socket *ssocket = server->ssocket;
 135
 136         if (ssocket == NULL)
 137                 return -ENOTSOCK; /* BB eventually add reconnect code here */
 138
 139         smb_msg.msg_name = (struct sockaddr *) &server->dstaddr;
 140         smb_msg.msg_namelen = sizeof(struct sockaddr);
 141         smb_msg.msg_control = NULL;
 142         smb_msg.msg_controllen = 0;
 143         if (server->noblocksnd)
 144                 smb_msg.msg_flags = MSG_DONTWAIT + MSG_NOSIGNAL;
 145         else
 146                 smb_msg.msg_flags = MSG_NOSIGNAL;
 147
 148         total_len = 0;
 149         for (i = 0; i < n_vec; i++)
 150                 total_len += iov[i].iov_len;
 151
 152         cFYI(1, "Sending smb:  total_len %d", total_len);
 153         dump_smb(smb_buffer, len);
 154
 155         i = 0;
 156         while (total_len) {
 157                 rc = kernel_sendmsg(ssocket, &smb_msg, &iov[first_vec],
 158                                     n_vec - first_vec, total_len);
 159                 if ((rc == -ENOSPC) || (rc == -EAGAIN)) {
 160                         i++;
 161                         /* if blocking send we try 3 times, since each can block
 162                            for 5 seconds. For nonblocking  we have to try more
 163                            but wait increasing amounts of time allowing time for
 164                            socket to clear.  The overall time we wait in either
 165                            case to send on the socket is about 15 seconds.
 166                            Similarly we wait for 15 seconds for
 167                            a response from the server in SendReceive[2]
 168                            for the server to send a response back for
 169                            most types of requests (except SMB Write
 170                            past end of file which can be slow, and
 171                            blocking lock operations). NFS waits slightly longer
 172                            than CIFS, but this can make it take longer for
 173                            nonresponsive servers to be detected and 15 seconds
 174                            is more than enough time for modern networks to
 175                            send a packet.  In most cases if we fail to send
 176                            after the retries we will kill the socket and
 177                            reconnect which may clear the network problem.
 178                         */
 179                         if ((i >= 14) || (!server->noblocksnd && (i > 2))) {
 180                                 cERROR(1, "sends on sock %p stuck for 15 seconds",
 181                                     ssocket);
 182                                 rc = -EAGAIN;
 183                                 break;
 184                         }
 185                         msleep(1 << i);
 186                         continue;
 187                 }
 188                 if (rc < 0)
 189                         break;
 190
 191                 if (rc == total_len) {
 192                         total_len = 0;
 193                         break;
 194                 } else if (rc > total_len) {
 195                         cERROR(1, "sent %d requested %d", rc, total_len);
 196                         break;
 197                 }
 198                 if (rc == 0) {
 199                         /* should never happen, letting socket clear before
 200                            retrying is our only obvious option here */
 201                         cERROR(1, "tcp sent no data");
 202                         msleep(500);
 203                         continue;
 204                 }
 205                 total_len -= rc;
 206                 /* the line below resets i */
 207                 for (i = first_vec; i < n_vec; i++) {
 208                         if (iov[i].iov_len) {
 209                                 if (rc > iov[i].iov_len) {
 210                                         rc -= iov[i].iov_len;
 211                                         iov[i].iov_len = 0;
 212                                 } else {
 213                                         iov[i].iov_base += rc;
 214                                         iov[i].iov_len -= rc;
 215                                         first_vec = i;
 216                                         break;
 217                                 }
 218                         }
 219                 }
 220                 i = 0; /* in case we get ENOSPC on the next send */
 221         }
 222
 223         if ((total_len > 0) && (total_len != smb_buf_length + 4)) {
 224                 cFYI(1, "partial send (%d remaining), terminating session",
 225                         total_len);
 226                 /* If we have only sent part of an SMB then the next SMB
 227                    could be taken as the remainder of this one.  We need
 228                    to kill the socket so the server throws away the partial
 229                    SMB */
 230                 server->tcpStatus = CifsNeedReconnect;
 231         }
 232
 233         if (rc < 0 && rc != -EINTR)
 234                 cERROR(1, "Error %d sending data on socket to server", rc);
 235         else
 236                 rc = 0;
 237
 238         /* Don't want to modify the buffer as a
 239            side effect of this call. */
 240         smb_buffer->smb_buf_length = cpu_to_be32(smb_buf_length);
 241
 242         return rc;
 243 }
 244
 245 int
 246 smb_send(struct TCP_Server_Info *server, struct smb_hdr *smb_buffer,
 247          unsigned int smb_buf_length)
 248 {
 249         struct kvec iov;
 250
 251         iov.iov_base = smb_buffer;
 252         iov.iov_len = smb_buf_length + 4;
 253
 254         return smb_sendv(server, &iov, 1);
 255 }
 256
 257 static int wait_for_free_request(struct TCP_Server_Info *server,
 258                                  const int long_op)
 259 {
 260         if (long_op == CIFS_ASYNC_OP) {
 261                 /* oplock breaks must not be held up */
 262                 atomic_inc(&server->inFlight);
 263                 return 0;
 264         }
 265
 266         spin_lock(&GlobalMid_Lock);
 267         while (1) {
 268                 if (atomic_read(&server->inFlight) >= server->maxReq) {
 269                         spin_unlock(&GlobalMid_Lock);
 270                         cifs_num_waiters_inc(server);
 271                         wait_event(server->request_q,
 272                                    atomic_read(&server->inFlight)
 273                                      < server->maxReq);
 274                         cifs_num_waiters_dec(server);
 275                         spin_lock(&GlobalMid_Lock);
 276                 } else {
 277                         if (server->tcpStatus == CifsExiting) {
 278                                 spin_unlock(&GlobalMid_Lock);
 279                                 return -ENOENT;
 280                         }
 281
 282                         /* can not count locking commands against total
 283                            as they are allowed to block on server */
 284
 285                         /* update # of requests on the wire to server */
 286                         if (long_op != CIFS_BLOCKING_OP)
 287                                 atomic_inc(&server->inFlight);
 288                         spin_unlock(&GlobalMid_Lock);
 289                         break;
 290                 }
 291         }
 292         return 0;
 293 }
 294
 295 static int allocate_mid(struct cifs_ses *ses, struct smb_hdr *in_buf,
 296                         struct mid_q_entry **ppmidQ)
 297 {
 298         if (ses->server->tcpStatus == CifsExiting) {
 299                 return -ENOENT;
 300         }
 301
 302         if (ses->server->tcpStatus == CifsNeedReconnect) {
 303                 cFYI(1, "tcp session dead - return to caller to retry");
 304                 return -EAGAIN;
 305         }
 306
 307         if (ses->status != CifsGood) {
 308                 /* check if SMB session is bad because we are setting it up */
 309                 if ((in_buf->Command != SMB_COM_SESSION_SETUP_ANDX) &&
 310                         (in_buf->Command != SMB_COM_NEGOTIATE))
 311                         return -EAGAIN;
 312                 /* else ok - we are setting up session */
 313         }
 314         *ppmidQ = AllocMidQEntry(in_buf, ses->server);
 315         if (*ppmidQ == NULL)
 316                 return -ENOMEM;
 317         spin_lock(&GlobalMid_Lock);
 318         list_add_tail(&(*ppmidQ)->qhead, &ses->server->pending_mid_q);
 319         spin_unlock(&GlobalMid_Lock);
 320         return 0;
 321 }
 322
 323 static int
 324 wait_for_response(struct TCP_Server_Info *server, struct mid_q_entry *midQ)
 325 {
 326         int error;
 327
 328         error = wait_event_freezekillable(server->response_q,
 329                                     midQ->midState != MID_REQUEST_SUBMITTED);
 330         if (error < 0)
 331                 return -ERESTARTSYS;
 332
 333         return 0;
 334 }
 335
 336
 337 /*
 338  * Send a SMB request and set the callback function in the mid to handle
 339  * the result. Caller is responsible for dealing with timeouts.
 340  */
 341 int
 342 cifs_call_async(struct TCP_Server_Info *server, struct kvec *iov,
 343                 unsigned int nvec, mid_receive_t *receive,
 344                 mid_callback_t *callback, void *cbdata, bool ignore_pend)
 345 {
 346         int rc;
 347         struct mid_q_entry *mid;
 348         struct smb_hdr *hdr = (struct smb_hdr *)iov[0].iov_base;
 349
 350         rc = wait_for_free_request(server, ignore_pend ? CIFS_ASYNC_OP : 0);
 351         if (rc)
 352                 return rc;
 353
 354         /* enable signing if server requires it */
 355         if (server->sec_mode & (SECMODE_SIGN_REQUIRED | SECMODE_SIGN_ENABLED))
 356                 hdr->Flags2 |= SMBFLG2_SECURITY_SIGNATURE;
 357
 358         mutex_lock(&server->srv_mutex);
 359         mid = AllocMidQEntry(hdr, server);
 360         if (mid == NULL) {
 361                 mutex_unlock(&server->srv_mutex);
 362                 atomic_dec(&server->inFlight);
 363                 wake_up(&server->request_q);
 364                 return -ENOMEM;
 365         }
 366
 367         /* put it on the pending_mid_q */
 368         spin_lock(&GlobalMid_Lock);
 369         list_add_tail(&mid->qhead, &server->pending_mid_q);
 370         spin_unlock(&GlobalMid_Lock);
 371
 372         rc = cifs_sign_smb2(iov, nvec, server, &mid->sequence_number);
 373         if (rc)
 374                 goto out;
 375
 376         mid->receive = receive;
 377         mid->callback = callback;
 378         mid->callback_data = cbdata;
 379         mid->midState = MID_REQUEST_SUBMITTED;
 380
 381         cifs_in_send_inc(server);
 382         rc = smb_sendv(server, iov, nvec);
 383         cifs_in_send_dec(server);
 384         cifs_save_when_sent(mid);
 385 out:
 386         if (rc < 0)
 387                 delete_mid(mid);
 388
 389         mutex_unlock(&server->srv_mutex);
 390
 391         if (rc == 0)
 392                 return 0;
 393
 394         atomic_dec(&server->inFlight);
 395         wake_up(&server->request_q);
 396         return rc;
 397 }
 398
 399 /*
 400  *
 401  * Send an SMB Request.  No response info (other than return code)
 402  * needs to be parsed.
 403  *
 404  * flags indicate the type of request buffer and how long to wait
 405  * and whether to log NT STATUS code (error) before mapping it to POSIX error
 406  *
 407  */
 408 int
 409 SendReceiveNoRsp(const unsigned int xid, struct cifs_ses *ses,
 410                 struct smb_hdr *in_buf, int flags)
 411 {
 412         int rc;
 413         struct kvec iov[1];
 414         int resp_buf_type;
 415
 416         iov[0].iov_base = (char *)in_buf;
 417         iov[0].iov_len = be32_to_cpu(in_buf->smb_buf_length) + 4;
 418         flags |= CIFS_NO_RESP;
 419         rc = SendReceive2(xid, ses, iov, 1, &resp_buf_type, flags);
 420         cFYI(DBG2, "SendRcvNoRsp flags %d rc %d", flags, rc);
 421
 422         return rc;
 423 }
 424
 425 static int
 426 cifs_sync_mid_result(struct mid_q_entry *mid, struct TCP_Server_Info *server)
 427 {
 428         int rc = 0;
 429
 430         cFYI(1, "%s: cmd=%d mid=%d state=%d", __func__, mid->command,
 431                 mid->mid, mid->midState);
 432
 433         spin_lock(&GlobalMid_Lock);
 434         switch (mid->midState) {
 435         case MID_RESPONSE_RECEIVED:
 436                 spin_unlock(&GlobalMid_Lock);
 437                 return rc;
 438         case MID_RETRY_NEEDED:
 439                 rc = -EAGAIN;
 440                 break;
 441         case MID_RESPONSE_MALFORMED:
 442                 rc = -EIO;
 443                 break;
 444         case MID_SHUTDOWN:
 445                 rc = -EHOSTDOWN;
 446                 break;
 447         default:
 448                 list_del_init(&mid->qhead);
 449                 cERROR(1, "%s: invalid mid state mid=%d state=%d", __func__,
 450                         mid->mid, mid->midState);
 451                 rc = -EIO;
 452         }
 453         spin_unlock(&GlobalMid_Lock);
 454
 455         DeleteMidQEntry(mid);
 456         return rc;
 457 }
 458
 459 /*
 460  * An NT cancel request header looks just like the original request except:
 461  *
 462  * The Command is SMB_COM_NT_CANCEL
 463  * The WordCount is zeroed out
 464  * The ByteCount is zeroed out
 465  *
 466  * This function mangles an existing request buffer into a
 467  * SMB_COM_NT_CANCEL request and then sends it.
 468  */
 469 static int
 470 send_nt_cancel(struct TCP_Server_Info *server, struct smb_hdr *in_buf,
 471                 struct mid_q_entry *mid)
 472 {
 473         int rc = 0;
 474
 475         /* -4 for RFC1001 length and +2 for BCC field */
 476         in_buf->smb_buf_length = cpu_to_be32(sizeof(struct smb_hdr) - 4  + 2);
 477         in_buf->Command = SMB_COM_NT_CANCEL;
 478         in_buf->WordCount = 0;
 479         put_bcc(0, in_buf);
 480
 481         mutex_lock(&server->srv_mutex);
 482         rc = cifs_sign_smb(in_buf, server, &mid->sequence_number);
 483         if (rc) {
 484                 mutex_unlock(&server->srv_mutex);
 485                 return rc;
 486         }
 487
 488         /*
 489          * The response to this call was already factored into the sequence
 490          * number when the call went out, so we must adjust it back downward
 491          * after signing here.
 492          */
 493         --server->sequence_number;
 494         rc = smb_send(server, in_buf, be32_to_cpu(in_buf->smb_buf_length));
 495         mutex_unlock(&server->srv_mutex);
 496
 497         cFYI(1, "issued NT_CANCEL for mid %u, rc = %d",
 498                 in_buf->Mid, rc);
 499
 500         return rc;
 501 }
 502
 503 int
 504 cifs_check_receive(struct mid_q_entry *mid, struct TCP_Server_Info *server,
 505                    bool log_error)
 506 {
 507         unsigned int len = be32_to_cpu(mid->resp_buf->smb_buf_length) + 4;
 508
 509         dump_smb(mid->resp_buf, min_t(u32, 92, len));
 510
 511         /* convert the length into a more usable form */
 512         if (server->sec_mode & (SECMODE_SIGN_REQUIRED | SECMODE_SIGN_ENABLED)) {
 513                 struct kvec iov;
 514
 515                 iov.iov_base = mid->resp_buf;
 516                 iov.iov_len = len;
 517                 /* FIXME: add code to kill session */
 518                 if (cifs_verify_signature(&iov, 1, server,
 519                                           mid->sequence_number + 1) != 0)
 520                         cERROR(1, "Unexpected SMB signature");
 521         }
 522
 523         /* BB special case reconnect tid and uid here? */
 524         return map_smb_to_linux_error(mid->resp_buf, log_error);
 525 }
 526
 527 int
 528 SendReceive2(const unsigned int xid, struct cifs_ses *ses,
 529              struct kvec *iov, int n_vec, int *pRespBufType /* ret */,
 530              const int flags)
 531 {
 532         int rc = 0;
 533         int long_op;
 534         struct mid_q_entry *midQ;
 535         struct smb_hdr *in_buf = iov[0].iov_base;
 536
 537         long_op = flags & CIFS_TIMEOUT_MASK;
 538
 539         *pRespBufType = CIFS_NO_BUFFER;  /* no response buf yet */
 540
 541         if ((ses == NULL) || (ses->server == NULL)) {
 542                 cifs_small_buf_release(in_buf);
 543                 cERROR(1, "Null session");
 544                 return -EIO;
 545         }
 546
 547         if (ses->server->tcpStatus == CifsExiting) {
 548                 cifs_small_buf_release(in_buf);
 549                 return -ENOENT;
 550         }
 551
 552         /* Ensure that we do not send more than 50 overlapping requests
 553            to the same server. We may make this configurable later or
 554            use ses->maxReq */
 555
 556         rc = wait_for_free_request(ses->server, long_op);
 557         if (rc) {
 558                 cifs_small_buf_release(in_buf);
 559                 return rc;
 560         }
 561
 562         /* make sure that we sign in the same order that we send on this socket
 563            and avoid races inside tcp sendmsg code that could cause corruption
 564            of smb data */
 565
 566         mutex_lock(&ses->server->srv_mutex);
 567
 568         rc = allocate_mid(ses, in_buf, &midQ);
 569         if (rc) {
 570                 mutex_unlock(&ses->server->srv_mutex);
 571                 cifs_small_buf_release(in_buf);
 572                 /* Update # of requests on wire to server */
 573                 atomic_dec(&ses->server->inFlight);
 574                 wake_up(&ses->server->request_q);
 575                 return rc;
 576         }
 577         rc = cifs_sign_smb2(iov, n_vec, ses->server, &midQ->sequence_number);
 578         if (rc) {
 579                 mutex_unlock(&ses->server->srv_mutex);
 580                 cifs_small_buf_release(in_buf);
 581                 goto out;
 582         }
 583
 584         midQ->midState = MID_REQUEST_SUBMITTED;
 585         cifs_in_send_inc(ses->server);
 586         rc = smb_sendv(ses->server, iov, n_vec);
 587         cifs_in_send_dec(ses->server);
 588         cifs_save_when_sent(midQ);
 589
 590         mutex_unlock(&ses->server->srv_mutex);
 591
 592         if (rc < 0) {
 593                 cifs_small_buf_release(in_buf);
 594                 goto out;
 595         }
 596
 597         if (long_op == CIFS_ASYNC_OP) {
 598                 cifs_small_buf_release(in_buf);
 599                 goto out;
 600         }
 601
 602         rc = wait_for_response(ses->server, midQ);
 603         if (rc != 0) {
 604                 send_nt_cancel(ses->server, in_buf, midQ);
 605                 spin_lock(&GlobalMid_Lock);
 606                 if (midQ->midState == MID_REQUEST_SUBMITTED) {
 607                         midQ->callback = DeleteMidQEntry;
 608                         spin_unlock(&GlobalMid_Lock);
 609                         cifs_small_buf_release(in_buf);
 610                         atomic_dec(&ses->server->inFlight);
 611                         wake_up(&ses->server->request_q);
 612                         return rc;
 613                 }
 614                 spin_unlock(&GlobalMid_Lock);
 615         }
 616
 617         cifs_small_buf_release(in_buf);
 618
 619         rc = cifs_sync_mid_result(midQ, ses->server);
 620         if (rc != 0) {
 621                 atomic_dec(&ses->server->inFlight);
 622                 wake_up(&ses->server->request_q);
 623                 return rc;
 624         }
 625
 626         if (!midQ->resp_buf || midQ->midState != MID_RESPONSE_RECEIVED) {
 627                 rc = -EIO;
 628                 cFYI(1, "Bad MID state?");
 629                 goto out;
 630         }
 631
 632         iov[0].iov_base = (char *)midQ->resp_buf;
 633         iov[0].iov_len = be32_to_cpu(midQ->resp_buf->smb_buf_length) + 4;
 634         if (midQ->largeBuf)
 635                 *pRespBufType = CIFS_LARGE_BUFFER;
 636         else
 637                 *pRespBufType = CIFS_SMALL_BUFFER;
 638
 639         rc = cifs_check_receive(midQ, ses->server, flags & CIFS_LOG_ERROR);
 640
 641         /* mark it so buf will not be freed by delete_mid */
 642         if ((flags & CIFS_NO_RESP) == 0)
 643                 midQ->resp_buf = NULL;
 644 out:
 645         delete_mid(midQ);
 646         atomic_dec(&ses->server->inFlight);
 647         wake_up(&ses->server->request_q);
 648
 649         return rc;
 650 }
 651
 652 int
 653 SendReceive(const unsigned int xid, struct cifs_ses *ses,
 654             struct smb_hdr *in_buf, struct smb_hdr *out_buf,
 655             int *pbytes_returned, const int long_op)
 656 {
 657         int rc = 0;
 658         struct mid_q_entry *midQ;
 659
 660         if (ses == NULL) {
 661                 cERROR(1, "Null smb session");
 662                 return -EIO;
 663         }
 664         if (ses->server == NULL) {
 665                 cERROR(1, "Null tcp session");
 666                 return -EIO;
 667         }
 668
 669         if (ses->server->tcpStatus == CifsExiting)
 670                 return -ENOENT;
 671
 672         /* Ensure that we do not send more than 50 overlapping requests
 673            to the same server. We may make this configurable later or
 674            use ses->maxReq */
 675
 676         if (be32_to_cpu(in_buf->smb_buf_length) > CIFSMaxBufSize +
 677                         MAX_CIFS_HDR_SIZE - 4) {
 678                 cERROR(1, "Illegal length, greater than maximum frame, %d",
 679                            be32_to_cpu(in_buf->smb_buf_length));
 680                 return -EIO;
 681         }
 682
 683         rc = wait_for_free_request(ses->server, long_op);
 684         if (rc)
 685                 return rc;
 686
 687         /* make sure that we sign in the same order that we send on this socket
 688            and avoid races inside tcp sendmsg code that could cause corruption
 689            of smb data */
 690
 691         mutex_lock(&ses->server->srv_mutex);
 692
 693         rc = allocate_mid(ses, in_buf, &midQ);
 694         if (rc) {
 695                 mutex_unlock(&ses->server->srv_mutex);
 696                 /* Update # of requests on wire to server */
 697                 atomic_dec(&ses->server->inFlight);
 698                 wake_up(&ses->server->request_q);
 699                 return rc;
 700         }
 701
 702         rc = cifs_sign_smb(in_buf, ses->server, &midQ->sequence_number);
 703         if (rc) {
 704                 mutex_unlock(&ses->server->srv_mutex);
 705                 goto out;
 706         }
 707
 708         midQ->midState = MID_REQUEST_SUBMITTED;
 709
 710         cifs_in_send_inc(ses->server);
 711         rc = smb_send(ses->server, in_buf, be32_to_cpu(in_buf->smb_buf_length));
 712         cifs_in_send_dec(ses->server);
 713         cifs_save_when_sent(midQ);
 714         mutex_unlock(&ses->server->srv_mutex);
 715
 716         if (rc < 0)
 717                 goto out;
 718
 719         if (long_op == CIFS_ASYNC_OP)
 720                 goto out;
 721
 722         rc = wait_for_response(ses->server, midQ);
 723         if (rc != 0) {
 724                 send_nt_cancel(ses->server, in_buf, midQ);
 725                 spin_lock(&GlobalMid_Lock);
 726                 if (midQ->midState == MID_REQUEST_SUBMITTED) {
 727                         /* no longer considered to be "in-flight" */
 728                         midQ->callback = DeleteMidQEntry;
 729                         spin_unlock(&GlobalMid_Lock);
 730                         atomic_dec(&ses->server->inFlight);
 731                         wake_up(&ses->server->request_q);
 732                         return rc;
 733                 }
 734                 spin_unlock(&GlobalMid_Lock);
 735         }
 736
 737         rc = cifs_sync_mid_result(midQ, ses->server);
 738         if (rc != 0) {
 739                 atomic_dec(&ses->server->inFlight);
 740                 wake_up(&ses->server->request_q);
 741                 return rc;
 742         }
 743
 744         if (!midQ->resp_buf || !out_buf ||
 745             midQ->midState != MID_RESPONSE_RECEIVED) {
 746                 rc = -EIO;
 747                 cERROR(1, "Bad MID state?");
 748                 goto out;
 749         }
 750
 751         *pbytes_returned = be32_to_cpu(midQ->resp_buf->smb_buf_length);
 752         memcpy(out_buf, midQ->resp_buf, *pbytes_returned + 4);
 753         rc = cifs_check_receive(midQ, ses->server, 0);
 754 out:
 755         delete_mid(midQ);
 756         atomic_dec(&ses->server->inFlight);
 757         wake_up(&ses->server->request_q);
 758
 759         return rc;
 760 }
 761
 762 /* We send a LOCKINGX_CANCEL_LOCK to cause the Windows
 763    blocking lock to return. */
 764
 765 static int
 766 send_lock_cancel(const unsigned int xid, struct cifs_tcon *tcon,
 767                         struct smb_hdr *in_buf,
 768                         struct smb_hdr *out_buf)
 769 {
 770         int bytes_returned;
 771         struct cifs_ses *ses = tcon->ses;
 772         LOCK_REQ *pSMB = (LOCK_REQ *)in_buf;
 773
 774         /* We just modify the current in_buf to change
 775            the type of lock from LOCKING_ANDX_SHARED_LOCK
 776            or LOCKING_ANDX_EXCLUSIVE_LOCK to
 777            LOCKING_ANDX_CANCEL_LOCK. */
 778
 779         pSMB->LockType = LOCKING_ANDX_CANCEL_LOCK|LOCKING_ANDX_LARGE_FILES;
 780         pSMB->Timeout = 0;
 781         pSMB->hdr.Mid = GetNextMid(ses->server);
 782
 783         return SendReceive(xid, ses, in_buf, out_buf,
 784                         &bytes_returned, 0);
 785 }
 786
 787 int
 788 SendReceiveBlockingLock(const unsigned int xid, struct cifs_tcon *tcon,
 789             struct smb_hdr *in_buf, struct smb_hdr *out_buf,
 790             int *pbytes_returned)
 791 {
 792         int rc = 0;
 793         int rstart = 0;
 794         struct mid_q_entry *midQ;
 795         struct cifs_ses *ses;
 796
 797         if (tcon == NULL || tcon->ses == NULL) {
 798                 cERROR(1, "Null smb session");
 799                 return -EIO;
 800         }
 801         ses = tcon->ses;
 802
 803         if (ses->server == NULL) {
 804                 cERROR(1, "Null tcp session");
 805                 return -EIO;
 806         }
 807
 808         if (ses->server->tcpStatus == CifsExiting)
 809                 return -ENOENT;
 810
 811         /* Ensure that we do not send more than 50 overlapping requests
 812            to the same server. We may make this configurable later or
 813            use ses->maxReq */
 814
 815         if (be32_to_cpu(in_buf->smb_buf_length) > CIFSMaxBufSize +
 816                         MAX_CIFS_HDR_SIZE - 4) {
 817                 cERROR(1, "Illegal length, greater than maximum frame, %d",
 818                            be32_to_cpu(in_buf->smb_buf_length));
 819                 return -EIO;
 820         }
 821
 822         rc = wait_for_free_request(ses->server, CIFS_BLOCKING_OP);
 823         if (rc)
 824                 return rc;
 825
 826         /* make sure that we sign in the same order that we send on this socket
 827            and avoid races inside tcp sendmsg code that could cause corruption
 828            of smb data */
 829
 830         mutex_lock(&ses->server->srv_mutex);
 831
 832         rc = allocate_mid(ses, in_buf, &midQ);
 833         if (rc) {
 834                 mutex_unlock(&ses->server->srv_mutex);
 835                 return rc;
 836         }
 837
 838         rc = cifs_sign_smb(in_buf, ses->server, &midQ->sequence_number);
 839         if (rc) {
 840                 delete_mid(midQ);
 841                 mutex_unlock(&ses->server->srv_mutex);
 842                 return rc;
 843         }
 844
 845         midQ->midState = MID_REQUEST_SUBMITTED;
 846         cifs_in_send_inc(ses->server);
 847         rc = smb_send(ses->server, in_buf, be32_to_cpu(in_buf->smb_buf_length));
 848         cifs_in_send_dec(ses->server);
 849         cifs_save_when_sent(midQ);
 850         mutex_unlock(&ses->server->srv_mutex);
 851
 852         if (rc < 0) {
 853                 delete_mid(midQ);
 854                 return rc;
 855         }
 856
 857         /* Wait for a reply - allow signals to interrupt. */
 858         rc = wait_event_interruptible(ses->server->response_q,
 859                 (!(midQ->midState == MID_REQUEST_SUBMITTED)) ||
 860                 ((ses->server->tcpStatus != CifsGood) &&
 861                  (ses->server->tcpStatus != CifsNew)));
 862
 863         /* Were we interrupted by a signal ? */
 864         if ((rc == -ERESTARTSYS) &&
 865                 (midQ->midState == MID_REQUEST_SUBMITTED) &&
 866                 ((ses->server->tcpStatus == CifsGood) ||
 867                  (ses->server->tcpStatus == CifsNew))) {
 868
 869                 if (in_buf->Command == SMB_COM_TRANSACTION2) {
 870                         /* POSIX lock. We send a NT_CANCEL SMB to cause the
 871                            blocking lock to return. */
 872                         rc = send_nt_cancel(ses->server, in_buf, midQ);
 873                         if (rc) {
 874                                 delete_mid(midQ);
 875                                 return rc;
 876                         }
 877                 } else {
 878                         /* Windows lock. We send a LOCKINGX_CANCEL_LOCK
 879                            to cause the blocking lock to return. */
 880
 881                         rc = send_lock_cancel(xid, tcon, in_buf, out_buf);
 882
 883                         /* If we get -ENOLCK back the lock may have
 884                            already been removed. Don't exit in this case. */
 885                         if (rc && rc != -ENOLCK) {
 886                                 delete_mid(midQ);
 887                                 return rc;
 888                         }
 889                 }
 890
 891                 rc = wait_for_response(ses->server, midQ);
 892                 if (rc) {
 893                         send_nt_cancel(ses->server, in_buf, midQ);
 894                         spin_lock(&GlobalMid_Lock);
 895                         if (midQ->midState == MID_REQUEST_SUBMITTED) {
 896                                 /* no longer considered to be "in-flight" */
 897                                 midQ->callback = DeleteMidQEntry;
 898                                 spin_unlock(&GlobalMid_Lock);
 899                                 return rc;
 900                         }
 901                         spin_unlock(&GlobalMid_Lock);
 902                 }
 903
 904                 /* We got the response - restart system call. */
 905                 rstart = 1;
 906         }
 907
 908         rc = cifs_sync_mid_result(midQ, ses->server);
 909         if (rc != 0)
 910                 return rc;
 911
 912         /* rcvd frame is ok */
 913         if (out_buf == NULL || midQ->midState != MID_RESPONSE_RECEIVED) {
 914                 rc = -EIO;
 915                 cERROR(1, "Bad MID state?");
 916                 goto out;
 917         }
 918
 919         *pbytes_returned = be32_to_cpu(midQ->resp_buf->smb_buf_length);
 920         memcpy(out_buf, midQ->resp_buf, *pbytes_returned + 4);
 921         rc = cifs_check_receive(midQ, ses->server, 0);
 922 out:
 923         delete_mid(midQ);
 924         if (rstart && rc == -EACCES)
 925                 return -ERESTARTSYS;
 926         return rc;
 927 }