fs/cifs/smb2pdu.c

   1 /*
   2  *   fs/cifs/smb2pdu.c
   3  *
   4  *   Copyright (C) International Business Machines  Corp., 2009, 2012
   5  *                 Etersoft, 2012
   6  *   Author(s): Steve French (sfrench@us.ibm.com)
   7  *              Pavel Shilovsky (pshilovsky@samba.org) 2012
   8  *
   9  *   Contains the routines for constructing the SMB2 PDUs themselves
  10  *
  11  *   This library is free software; you can redistribute it and/or modify
  12  *   it under the terms of the GNU Lesser General Public License as published
  13  *   by the Free Software Foundation; either version 2.1 of the License, or
  14  *   (at your option) any later version.
  15  *
  16  *   This library is distributed in the hope that it will be useful,
  17  *   but WITHOUT ANY WARRANTY; without even the implied warranty of
  18  *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See
  19  *   the GNU Lesser General Public License for more details.
  20  *
  21  *   You should have received a copy of the GNU Lesser General Public License
  22  *   along with this library; if not, write to the Free Software
  23  *   Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
  24  */
  25
  26  /* SMB2 PDU handling routines here - except for leftovers (eg session setup) */
  27  /* Note that there are handle based routines which must be                   */
  28  /* treated slightly differently for reconnection purposes since we never     */
  29  /* want to reuse a stale file handle and only the caller knows the file info */
  30
  31 #include <linux/fs.h>
  32 #include <linux/kernel.h>
  33 #include <linux/vfs.h>
  34 #include <linux/task_io_accounting_ops.h>
  35 #include <linux/uaccess.h>
  36 #include <linux/pagemap.h>
  37 #include <linux/xattr.h>
  38 #include "smb2pdu.h"
  39 #include "cifsglob.h"
  40 #include "cifsacl.h"
  41 #include "cifsproto.h"
  42 #include "smb2proto.h"
  43 #include "cifs_unicode.h"
  44 #include "cifs_debug.h"
  45 #include "ntlmssp.h"
  46 #include "smb2status.h"
  47 #include "smb2glob.h"
  48 #include "cifspdu.h"
  49
  50 /*
  51  *  The following table defines the expected "StructureSize" of SMB2 requests
  52  *  in order by SMB2 command.  This is similar to "wct" in SMB/CIFS requests.
  53  *
  54  *  Note that commands are defined in smb2pdu.h in le16 but the array below is
  55  *  indexed by command in host byte order.
  56  */
  57 static const int smb2_req_struct_sizes[NUMBER_OF_SMB2_COMMANDS] = {
  58         /* SMB2_NEGOTIATE */ 36,
  59         /* SMB2_SESSION_SETUP */ 25,
  60         /* SMB2_LOGOFF */ 4,
  61         /* SMB2_TREE_CONNECT */ 9,
  62         /* SMB2_TREE_DISCONNECT */ 4,
  63         /* SMB2_CREATE */ 57,
  64         /* SMB2_CLOSE */ 24,
  65         /* SMB2_FLUSH */ 24,
  66         /* SMB2_READ */ 49,
  67         /* SMB2_WRITE */ 49,
  68         /* SMB2_LOCK */ 48,
  69         /* SMB2_IOCTL */ 57,
  70         /* SMB2_CANCEL */ 4,
  71         /* SMB2_ECHO */ 4,
  72         /* SMB2_QUERY_DIRECTORY */ 33,
  73         /* SMB2_CHANGE_NOTIFY */ 32,
  74         /* SMB2_QUERY_INFO */ 41,
  75         /* SMB2_SET_INFO */ 33,
  76         /* SMB2_OPLOCK_BREAK */ 24 /* BB this is 36 for LEASE_BREAK variant */
  77 };
  78
  79
  80 static void
  81 smb2_hdr_assemble(struct smb2_hdr *hdr, __le16 smb2_cmd /* command */ ,
  82                   const struct cifs_tcon *tcon)
  83 {
  84         struct smb2_pdu *pdu = (struct smb2_pdu *)hdr;
  85         char *temp = (char *)hdr;
  86         /* lookup word count ie StructureSize from table */
  87         __u16 parmsize = smb2_req_struct_sizes[le16_to_cpu(smb2_cmd)];
  88
  89         /*
  90          * smaller than SMALL_BUFFER_SIZE but bigger than fixed area of
  91          * largest operations (Create)
  92          */
  93         memset(temp, 0, 256);
  94
  95         /* Note this is only network field converted to big endian */
  96         hdr->smb2_buf_length = cpu_to_be32(parmsize + sizeof(struct smb2_hdr)
  97                         - 4 /*  RFC 1001 length field itself not counted */);
  98
  99         hdr->ProtocolId[0] = 0xFE;
 100         hdr->ProtocolId[1] = 'S';
 101         hdr->ProtocolId[2] = 'M';
 102         hdr->ProtocolId[3] = 'B';
 103         hdr->StructureSize = cpu_to_le16(64);
 104         hdr->Command = smb2_cmd;
 105         hdr->CreditRequest = cpu_to_le16(2); /* BB make this dynamic */
 106         hdr->ProcessId = cpu_to_le32((__u16)current->tgid);
 107
 108         if (!tcon)
 109                 goto out;
 110
 111         hdr->TreeId = tcon->tid;
 112         /* Uid is not converted */
 113         if (tcon->ses)
 114                 hdr->SessionId = tcon->ses->Suid;
 115         /* BB check following DFS flags BB */
 116         /* BB do we have to add check for SHI1005_FLAGS_DFS_ROOT too? */
 117         if (tcon->share_flags & SHI1005_FLAGS_DFS)
 118                 hdr->Flags |= SMB2_FLAGS_DFS_OPERATIONS;
 119         /* BB how does SMB2 do case sensitive? */
 120         /* if (tcon->nocase)
 121                 hdr->Flags |= SMBFLG_CASELESS; */
 122         if (tcon->ses && tcon->ses->server && tcon->ses->server->sign)
 123                 hdr->Flags |= SMB2_FLAGS_SIGNED;
 124 out:
 125         pdu->StructureSize2 = cpu_to_le16(parmsize);
 126         return;
 127 }
 128
 129 static int
 130 smb2_reconnect(__le16 smb2_command, struct cifs_tcon *tcon)
 131 {
 132         int rc = 0;
 133         struct nls_table *nls_codepage;
 134         struct cifs_ses *ses;
 135         struct TCP_Server_Info *server;
 136
 137         /*
 138          * SMB2s NegProt, SessSetup, Logoff do not have tcon yet so
 139          * check for tcp and smb session status done differently
 140          * for those three - in the calling routine.
 141          */
 142         if (tcon == NULL)
 143                 return rc;
 144
 145         if (smb2_command == SMB2_TREE_CONNECT)
 146                 return rc;
 147
 148         if (tcon->tidStatus == CifsExiting) {
 149                 /*
 150                  * only tree disconnect, open, and write,
 151                  * (and ulogoff which does not have tcon)
 152                  * are allowed as we start force umount.
 153                  */
 154                 if ((smb2_command != SMB2_WRITE) &&
 155                    (smb2_command != SMB2_CREATE) &&
 156                    (smb2_command != SMB2_TREE_DISCONNECT)) {
 157                         cifs_dbg(FYI, "can not send cmd %d while umounting\n",
 158                                  smb2_command);
 159                         return -ENODEV;
 160                 }
 161         }
 162         if ((!tcon->ses) || (tcon->ses->status == CifsExiting) ||
 163             (!tcon->ses->server))
 164                 return -EIO;
 165
 166         ses = tcon->ses;
 167         server = ses->server;
 168
 169         /*
 170          * Give demultiplex thread up to 10 seconds to reconnect, should be
 171          * greater than cifs socket timeout which is 7 seconds
 172          */
 173         while (server->tcpStatus == CifsNeedReconnect) {
 174                 /*
 175                  * Return to caller for TREE_DISCONNECT and LOGOFF and CLOSE
 176                  * here since they are implicitly done when session drops.
 177                  */
 178                 switch (smb2_command) {
 179                 /*
 180                  * BB Should we keep oplock break and add flush to exceptions?
 181                  */
 182                 case SMB2_TREE_DISCONNECT:
 183                 case SMB2_CANCEL:
 184                 case SMB2_CLOSE:
 185                 case SMB2_OPLOCK_BREAK:
 186                         return -EAGAIN;
 187                 }
 188
 189                 wait_event_interruptible_timeout(server->response_q,
 190                         (server->tcpStatus != CifsNeedReconnect), 10 * HZ);
 191
 192                 /* are we still trying to reconnect? */
 193                 if (server->tcpStatus != CifsNeedReconnect)
 194                         break;
 195
 196                 /*
 197                  * on "soft" mounts we wait once. Hard mounts keep
 198                  * retrying until process is killed or server comes
 199                  * back on-line
 200                  */
 201                 if (!tcon->retry) {
 202                         cifs_dbg(FYI, "gave up waiting on reconnect in smb_init\n");
 203                         return -EHOSTDOWN;
 204                 }
 205         }
 206
 207         if (!tcon->ses->need_reconnect && !tcon->need_reconnect)
 208                 return rc;
 209
 210         nls_codepage = load_nls_default();
 211
 212         /*
 213          * need to prevent multiple threads trying to simultaneously reconnect
 214          * the same SMB session
 215          */
 216         mutex_lock(&tcon->ses->session_mutex);
 217         rc = cifs_negotiate_protocol(0, tcon->ses);
 218         if (!rc && tcon->ses->need_reconnect)
 219                 rc = cifs_setup_session(0, tcon->ses, nls_codepage);
 220
 221         if (rc || !tcon->need_reconnect) {
 222                 mutex_unlock(&tcon->ses->session_mutex);
 223                 goto out;
 224         }
 225
 226         cifs_mark_open_files_invalid(tcon);
 227         rc = SMB2_tcon(0, tcon->ses, tcon->treeName, tcon, nls_codepage);
 228         mutex_unlock(&tcon->ses->session_mutex);
 229         cifs_dbg(FYI, "reconnect tcon rc = %d\n", rc);
 230         if (rc)
 231                 goto out;
 232         atomic_inc(&tconInfoReconnectCount);
 233         /*
 234          * BB FIXME add code to check if wsize needs update due to negotiated
 235          * smb buffer size shrinking.
 236          */
 237 out:
 238         /*
 239          * Check if handle based operation so we know whether we can continue
 240          * or not without returning to caller to reset file handle.
 241          */
 242         /*
 243          * BB Is flush done by server on drop of tcp session? Should we special
 244          * case it and skip above?
 245          */
 246         switch (smb2_command) {
 247         case SMB2_FLUSH:
 248         case SMB2_READ:
 249         case SMB2_WRITE:
 250         case SMB2_LOCK:
 251         case SMB2_IOCTL:
 252         case SMB2_QUERY_DIRECTORY:
 253         case SMB2_CHANGE_NOTIFY:
 254         case SMB2_QUERY_INFO:
 255         case SMB2_SET_INFO:
 256                 return -EAGAIN;
 257         }
 258         unload_nls(nls_codepage);
 259         return rc;
 260 }
 261
 262 /*
 263  * Allocate and return pointer to an SMB request hdr, and set basic
 264  * SMB information in the SMB header. If the return code is zero, this
 265  * function must have filled in request_buf pointer.
 266  */
 267 static int
 268 small_smb2_init(__le16 smb2_command, struct cifs_tcon *tcon,
 269                 void **request_buf)
 270 {
 271         int rc = 0;
 272
 273         rc = smb2_reconnect(smb2_command, tcon);
 274         if (rc)
 275                 return rc;
 276
 277         /* BB eventually switch this to SMB2 specific small buf size */
 278         *request_buf = cifs_small_buf_get();
 279         if (*request_buf == NULL) {
 280                 /* BB should we add a retry in here if not a writepage? */
 281                 return -ENOMEM;
 282         }
 283
 284         smb2_hdr_assemble((struct smb2_hdr *) *request_buf, smb2_command, tcon);
 285
 286         if (tcon != NULL) {
 287 #ifdef CONFIG_CIFS_STATS2
 288                 uint16_t com_code = le16_to_cpu(smb2_command);
 289                 cifs_stats_inc(&tcon->stats.smb2_stats.smb2_com_sent[com_code]);
 290 #endif
 291                 cifs_stats_inc(&tcon->num_smbs_sent);
 292         }
 293
 294         return rc;
 295 }
 296
 297 static void
 298 free_rsp_buf(int resp_buftype, void *rsp)
 299 {
 300         if (resp_buftype == CIFS_SMALL_BUFFER)
 301                 cifs_small_buf_release(rsp);
 302         else if (resp_buftype == CIFS_LARGE_BUFFER)
 303                 cifs_buf_release(rsp);
 304 }
 305
 306
 307 /*
 308  *
 309  *      SMB2 Worker functions follow:
 310  *
 311  *      The general structure of the worker functions is:
 312  *      1) Call smb2_init (assembles SMB2 header)
 313  *      2) Initialize SMB2 command specific fields in fixed length area of SMB
 314  *      3) Call smb_sendrcv2 (sends request on socket and waits for response)
 315  *      4) Decode SMB2 command specific fields in the fixed length area
 316  *      5) Decode variable length data area (if any for this SMB2 command type)
 317  *      6) Call free smb buffer
 318  *      7) return
 319  *
 320  */
 321
 322 int
 323 SMB2_negotiate(const unsigned int xid, struct cifs_ses *ses)
 324 {
 325         struct smb2_negotiate_req *req;
 326         struct smb2_negotiate_rsp *rsp;
 327         struct kvec iov[1];
 328         int rc = 0;
 329         int resp_buftype;
 330         struct TCP_Server_Info *server = ses->server;
 331         int blob_offset, blob_length;
 332         char *security_blob;
 333         int flags = CIFS_NEG_OP;
 334
 335         cifs_dbg(FYI, "Negotiate protocol\n");
 336
 337         if (!server) {
 338                 WARN(1, "%s: server is NULL!\n", __func__);
 339                 return -EIO;
 340         }
 341
 342         rc = small_smb2_init(SMB2_NEGOTIATE, NULL, (void **) &req);
 343         if (rc)
 344                 return rc;
 345
 346         req->hdr.SessionId = 0;
 347
 348         req->Dialects[0] = cpu_to_le16(ses->server->vals->protocol_id);
 349
 350         req->DialectCount = cpu_to_le16(1); /* One vers= at a time for now */
 351         inc_rfc1001_len(req, 2);
 352
 353         /* only one of SMB2 signing flags may be set in SMB2 request */
 354         if (ses->sign)
 355                 req->SecurityMode = cpu_to_le16(SMB2_NEGOTIATE_SIGNING_REQUIRED);
 356         else if (global_secflags & CIFSSEC_MAY_SIGN)
 357                 req->SecurityMode = cpu_to_le16(SMB2_NEGOTIATE_SIGNING_ENABLED);
 358         else
 359                 req->SecurityMode = 0;
 360
 361         req->Capabilities = cpu_to_le32(ses->server->vals->req_capabilities);
 362
 363         memcpy(req->ClientGUID, cifs_client_guid, SMB2_CLIENT_GUID_SIZE);
 364
 365         iov[0].iov_base = (char *)req;
 366         /* 4 for rfc1002 length field */
 367         iov[0].iov_len = get_rfc1002_length(req) + 4;
 368
 369         rc = SendReceive2(xid, ses, iov, 1, &resp_buftype, flags);
 370
 371         rsp = (struct smb2_negotiate_rsp *)iov[0].iov_base;
 372         /*
 373          * No tcon so can't do
 374          * cifs_stats_inc(&tcon->stats.smb2_stats.smb2_com_fail[SMB2...]);
 375          */
 376         if (rc != 0)
 377                 goto neg_exit;
 378
 379         cifs_dbg(FYI, "mode 0x%x\n", rsp->SecurityMode);
 380
 381         /* BB we may eventually want to match the negotiated vs. requested
 382            dialect, even though we are only requesting one at a time */
 383         if (rsp->DialectRevision == cpu_to_le16(SMB20_PROT_ID))
 384                 cifs_dbg(FYI, "negotiated smb2.0 dialect\n");
 385         else if (rsp->DialectRevision == cpu_to_le16(SMB21_PROT_ID))
 386                 cifs_dbg(FYI, "negotiated smb2.1 dialect\n");
 387         else if (rsp->DialectRevision == cpu_to_le16(SMB30_PROT_ID))
 388                 cifs_dbg(FYI, "negotiated smb3.0 dialect\n");
 389         else if (rsp->DialectRevision == cpu_to_le16(SMB302_PROT_ID))
 390                 cifs_dbg(FYI, "negotiated smb3.02 dialect\n");
 391         else {
 392                 cifs_dbg(VFS, "Illegal dialect returned by server %d\n",
 393                          le16_to_cpu(rsp->DialectRevision));
 394                 rc = -EIO;
 395                 goto neg_exit;
 396         }
 397         server->dialect = le16_to_cpu(rsp->DialectRevision);
 398
 399         /* SMB2 only has an extended negflavor */
 400         server->negflavor = CIFS_NEGFLAVOR_EXTENDED;
 401         server->maxBuf = le32_to_cpu(rsp->MaxTransactSize);
 402         server->max_read = le32_to_cpu(rsp->MaxReadSize);
 403         server->max_write = le32_to_cpu(rsp->MaxWriteSize);
 404         /* BB Do we need to validate the SecurityMode? */
 405         server->sec_mode = le16_to_cpu(rsp->SecurityMode);
 406         server->capabilities = le32_to_cpu(rsp->Capabilities);
 407         /* Internal types */
 408         server->capabilities |= SMB2_NT_FIND | SMB2_LARGE_FILES;
 409
 410         security_blob = smb2_get_data_area_len(&blob_offset, &blob_length,
 411                                                &rsp->hdr);
 412         if (blob_length == 0) {
 413                 cifs_dbg(VFS, "missing security blob on negprot\n");
 414                 rc = -EIO;
 415                 goto neg_exit;
 416         }
 417
 418         rc = cifs_enable_signing(server, ses->sign);
 419 #ifdef CONFIG_SMB2_ASN1  /* BB REMOVEME when updated asn1.c ready */
 420         if (rc)
 421                 goto neg_exit;
 422
 423         rc = decode_neg_token_init(security_blob, blob_length,
 424                                    &server->sec_type);
 425         if (rc == 1)
 426                 rc = 0;
 427         else if (rc == 0) {
 428                 rc = -EIO;
 429                 goto neg_exit;
 430         }
 431 #endif
 432
 433 neg_exit:
 434         free_rsp_buf(resp_buftype, rsp);
 435         return rc;
 436 }
 437
 438 int
 439 SMB2_sess_setup(const unsigned int xid, struct cifs_ses *ses,
 440                 const struct nls_table *nls_cp)
 441 {
 442         struct smb2_sess_setup_req *req;
 443         struct smb2_sess_setup_rsp *rsp = NULL;
 444         struct kvec iov[2];
 445         int rc = 0;
 446         int resp_buftype;
 447         __le32 phase = NtLmNegotiate; /* NTLMSSP, if needed, is multistage */
 448         struct TCP_Server_Info *server = ses->server;
 449         u16 blob_length = 0;
 450         char *security_blob;
 451         char *ntlmssp_blob = NULL;
 452         bool use_spnego = false; /* else use raw ntlmssp */
 453
 454         cifs_dbg(FYI, "Session Setup\n");
 455
 456         if (!server) {
 457                 WARN(1, "%s: server is NULL!\n", __func__);
 458                 return -EIO;
 459         }
 460
 461         /*
 462          * If memory allocation is successful, caller of this function
 463          * frees it.
 464          */
 465         ses->ntlmssp = kmalloc(sizeof(struct ntlmssp_auth), GFP_KERNEL);
 466         if (!ses->ntlmssp)
 467                 return -ENOMEM;
 468
 469         /* FIXME: allow for other auth types besides NTLMSSP (e.g. krb5) */
 470         ses->sectype = RawNTLMSSP;
 471
 472 ssetup_ntlmssp_authenticate:
 473         if (phase == NtLmChallenge)
 474                 phase = NtLmAuthenticate; /* if ntlmssp, now final phase */
 475
 476         rc = small_smb2_init(SMB2_SESSION_SETUP, NULL, (void **) &req);
 477         if (rc)
 478                 return rc;
 479
 480         req->hdr.SessionId = 0; /* First session, not a reauthenticate */
 481         req->VcNumber = 0; /* MBZ */
 482         /* to enable echos and oplocks */
 483         req->hdr.CreditRequest = cpu_to_le16(3);
 484
 485         /* only one of SMB2 signing flags may be set in SMB2 request */
 486         if (server->sign)
 487                 req->SecurityMode = SMB2_NEGOTIATE_SIGNING_REQUIRED;
 488         else if (global_secflags & CIFSSEC_MAY_SIGN) /* one flag unlike MUST_ */
 489                 req->SecurityMode = SMB2_NEGOTIATE_SIGNING_ENABLED;
 490         else
 491                 req->SecurityMode = 0;
 492
 493         req->Capabilities = 0;
 494         req->Channel = 0; /* MBZ */
 495
 496         iov[0].iov_base = (char *)req;
 497         /* 4 for rfc1002 length field and 1 for pad */
 498         iov[0].iov_len = get_rfc1002_length(req) + 4 - 1;
 499         if (phase == NtLmNegotiate) {
 500                 ntlmssp_blob = kmalloc(sizeof(struct _NEGOTIATE_MESSAGE),
 501                                        GFP_KERNEL);
 502                 if (ntlmssp_blob == NULL) {
 503                         rc = -ENOMEM;
 504                         goto ssetup_exit;
 505                 }
 506                 build_ntlmssp_negotiate_blob(ntlmssp_blob, ses);
 507                 if (use_spnego) {
 508                         /* blob_length = build_spnego_ntlmssp_blob(
 509                                         &security_blob,
 510                                         sizeof(struct _NEGOTIATE_MESSAGE),
 511                                         ntlmssp_blob); */
 512                         /* BB eventually need to add this */
 513                         cifs_dbg(VFS, "spnego not supported for SMB2 yet\n");
 514                         rc = -EOPNOTSUPP;
 515                         kfree(ntlmssp_blob);
 516                         goto ssetup_exit;
 517                 } else {
 518                         blob_length = sizeof(struct _NEGOTIATE_MESSAGE);
 519                         /* with raw NTLMSSP we don't encapsulate in SPNEGO */
 520                         security_blob = ntlmssp_blob;
 521                 }
 522         } else if (phase == NtLmAuthenticate) {
 523                 req->hdr.SessionId = ses->Suid;
 524                 ntlmssp_blob = kzalloc(sizeof(struct _NEGOTIATE_MESSAGE) + 500,
 525                                        GFP_KERNEL);
 526                 if (ntlmssp_blob == NULL) {
 527                         rc = -ENOMEM;
 528                         goto ssetup_exit;
 529                 }
 530                 rc = build_ntlmssp_auth_blob(ntlmssp_blob, &blob_length, ses,
 531                                              nls_cp);
 532                 if (rc) {
 533                         cifs_dbg(FYI, "build_ntlmssp_auth_blob failed %d\n",
 534                                  rc);
 535                         goto ssetup_exit; /* BB double check error handling */
 536                 }
 537                 if (use_spnego) {
 538                         /* blob_length = build_spnego_ntlmssp_blob(
 539                                                         &security_blob,
 540                                                         blob_length,
 541                                                         ntlmssp_blob); */
 542                         cifs_dbg(VFS, "spnego not supported for SMB2 yet\n");
 543                         rc = -EOPNOTSUPP;
 544                         kfree(ntlmssp_blob);
 545                         goto ssetup_exit;
 546                 } else {
 547                         security_blob = ntlmssp_blob;
 548                 }
 549         } else {
 550                 cifs_dbg(VFS, "illegal ntlmssp phase\n");
 551                 rc = -EIO;
 552                 goto ssetup_exit;
 553         }
 554
 555         /* Testing shows that buffer offset must be at location of Buffer[0] */
 556         req->SecurityBufferOffset =
 557                                 cpu_to_le16(sizeof(struct smb2_sess_setup_req) -
 558                                             1 /* pad */ - 4 /* rfc1001 len */);
 559         req->SecurityBufferLength = cpu_to_le16(blob_length);
 560         iov[1].iov_base = security_blob;
 561         iov[1].iov_len = blob_length;
 562
 563         inc_rfc1001_len(req, blob_length - 1 /* pad */);
 564
 565         /* BB add code to build os and lm fields */
 566
 567         rc = SendReceive2(xid, ses, iov, 2, &resp_buftype,
 568                           CIFS_LOG_ERROR | CIFS_NEG_OP);
 569
 570         kfree(security_blob);
 571         rsp = (struct smb2_sess_setup_rsp *)iov[0].iov_base;
 572         if (resp_buftype != CIFS_NO_BUFFER &&
 573             rsp->hdr.Status == STATUS_MORE_PROCESSING_REQUIRED) {
 574                 if (phase != NtLmNegotiate) {
 575                         cifs_dbg(VFS, "Unexpected more processing error\n");
 576                         goto ssetup_exit;
 577                 }
 578                 if (offsetof(struct smb2_sess_setup_rsp, Buffer) - 4 !=
 579                                 le16_to_cpu(rsp->SecurityBufferOffset)) {
 580                         cifs_dbg(VFS, "Invalid security buffer offset %d\n",
 581                                  le16_to_cpu(rsp->SecurityBufferOffset));
 582                         rc = -EIO;
 583                         goto ssetup_exit;
 584                 }
 585
 586                 /* NTLMSSP Negotiate sent now processing challenge (response) */
 587                 phase = NtLmChallenge; /* process ntlmssp challenge */
 588                 rc = 0; /* MORE_PROCESSING is not an error here but expected */
 589                 ses->Suid = rsp->hdr.SessionId;
 590                 rc = decode_ntlmssp_challenge(rsp->Buffer,
 591                                 le16_to_cpu(rsp->SecurityBufferLength), ses);
 592         }
 593
 594         /*
 595          * BB eventually add code for SPNEGO decoding of NtlmChallenge blob,
 596          * but at least the raw NTLMSSP case works.
 597          */
 598         /*
 599          * No tcon so can't do
 600          * cifs_stats_inc(&tcon->stats.smb2_stats.smb2_com_fail[SMB2...]);
 601          */
 602         if (rc != 0)
 603                 goto ssetup_exit;
 604
 605         ses->session_flags = le16_to_cpu(rsp->SessionFlags);
 606 ssetup_exit:
 607         free_rsp_buf(resp_buftype, rsp);
 608
 609         /* if ntlmssp, and negotiate succeeded, proceed to authenticate phase */
 610         if ((phase == NtLmChallenge) && (rc == 0))
 611                 goto ssetup_ntlmssp_authenticate;
 612         return rc;
 613 }
 614
 615 int
 616 SMB2_logoff(const unsigned int xid, struct cifs_ses *ses)
 617 {
 618         struct smb2_logoff_req *req; /* response is also trivial struct */
 619         int rc = 0;
 620         struct TCP_Server_Info *server;
 621
 622         cifs_dbg(FYI, "disconnect session %p\n", ses);
 623
 624         if (ses && (ses->server))
 625                 server = ses->server;
 626         else
 627                 return -EIO;
 628
 629         rc = small_smb2_init(SMB2_LOGOFF, NULL, (void **) &req);
 630         if (rc)
 631                 return rc;
 632
 633          /* since no tcon, smb2_init can not do this, so do here */
 634         req->hdr.SessionId = ses->Suid;
 635         if (server->sign)
 636                 req->hdr.Flags |= SMB2_FLAGS_SIGNED;
 637
 638         rc = SendReceiveNoRsp(xid, ses, (char *) &req->hdr, 0);
 639         /*
 640          * No tcon so can't do
 641          * cifs_stats_inc(&tcon->stats.smb2_stats.smb2_com_fail[SMB2...]);
 642          */
 643         return rc;
 644 }
 645
 646 static inline void cifs_stats_fail_inc(struct cifs_tcon *tcon, uint16_t code)
 647 {
 648         cifs_stats_inc(&tcon->stats.smb2_stats.smb2_com_failed[code]);
 649 }
 650
 651 #define MAX_SHARENAME_LENGTH (255 /* server */ + 80 /* share */ + 1 /* NULL */)
 652
 653 int
 654 SMB2_tcon(const unsigned int xid, struct cifs_ses *ses, const char *tree,
 655           struct cifs_tcon *tcon, const struct nls_table *cp)
 656 {
 657         struct smb2_tree_connect_req *req;
 658         struct smb2_tree_connect_rsp *rsp = NULL;
 659         struct kvec iov[2];
 660         int rc = 0;
 661         int resp_buftype;
 662         int unc_path_len;
 663         struct TCP_Server_Info *server;
 664         __le16 *unc_path = NULL;
 665
 666         cifs_dbg(FYI, "TCON\n");
 667
 668         if ((ses->server) && tree)
 669                 server = ses->server;
 670         else
 671                 return -EIO;
 672
 673         if (tcon && tcon->bad_network_name)
 674                 return -ENOENT;
 675
 676         unc_path = kmalloc(MAX_SHARENAME_LENGTH * 2, GFP_KERNEL);
 677         if (unc_path == NULL)
 678                 return -ENOMEM;
 679
 680         unc_path_len = cifs_strtoUTF16(unc_path, tree, strlen(tree), cp) + 1;
 681         unc_path_len *= 2;
 682         if (unc_path_len < 2) {
 683                 kfree(unc_path);
 684                 return -EINVAL;
 685         }
 686
 687         rc = small_smb2_init(SMB2_TREE_CONNECT, tcon, (void **) &req);
 688         if (rc) {
 689                 kfree(unc_path);
 690                 return rc;
 691         }
 692
 693         if (tcon == NULL) {
 694                 /* since no tcon, smb2_init can not do this, so do here */
 695                 req->hdr.SessionId = ses->Suid;
 696                 /* if (ses->server->sec_mode & SECMODE_SIGN_REQUIRED)
 697                         req->hdr.Flags |= SMB2_FLAGS_SIGNED; */
 698         }
 699
 700         iov[0].iov_base = (char *)req;
 701         /* 4 for rfc1002 length field and 1 for pad */
 702         iov[0].iov_len = get_rfc1002_length(req) + 4 - 1;
 703
 704         /* Testing shows that buffer offset must be at location of Buffer[0] */
 705         req->PathOffset = cpu_to_le16(sizeof(struct smb2_tree_connect_req)
 706                         - 1 /* pad */ - 4 /* do not count rfc1001 len field */);
 707         req->PathLength = cpu_to_le16(unc_path_len - 2);
 708         iov[1].iov_base = unc_path;
 709         iov[1].iov_len = unc_path_len;
 710
 711         inc_rfc1001_len(req, unc_path_len - 1 /* pad */);
 712
 713         rc = SendReceive2(xid, ses, iov, 2, &resp_buftype, 0);
 714         rsp = (struct smb2_tree_connect_rsp *)iov[0].iov_base;
 715
 716         if (rc != 0) {
 717                 if (tcon) {
 718                         cifs_stats_fail_inc(tcon, SMB2_TREE_CONNECT_HE);
 719                         tcon->need_reconnect = true;
 720                 }
 721                 goto tcon_error_exit;
 722         }
 723
 724         if (tcon == NULL) {
 725                 ses->ipc_tid = rsp->hdr.TreeId;
 726                 goto tcon_exit;
 727         }
 728
 729         if (rsp->ShareType & SMB2_SHARE_TYPE_DISK)
 730                 cifs_dbg(FYI, "connection to disk share\n");
 731         else if (rsp->ShareType & SMB2_SHARE_TYPE_PIPE) {
 732                 tcon->ipc = true;
 733                 cifs_dbg(FYI, "connection to pipe share\n");
 734         } else if (rsp->ShareType & SMB2_SHARE_TYPE_PRINT) {
 735                 tcon->print = true;
 736                 cifs_dbg(FYI, "connection to printer\n");
 737         } else {
 738                 cifs_dbg(VFS, "unknown share type %d\n", rsp->ShareType);
 739                 rc = -EOPNOTSUPP;
 740                 goto tcon_error_exit;
 741         }
 742
 743         tcon->share_flags = le32_to_cpu(rsp->ShareFlags);
 744         tcon->capabilities = rsp->Capabilities; /* we keep caps little endian */
 745         tcon->maximal_access = le32_to_cpu(rsp->MaximalAccess);
 746         tcon->tidStatus = CifsGood;
 747         tcon->need_reconnect = false;
 748         tcon->tid = rsp->hdr.TreeId;
 749         strlcpy(tcon->treeName, tree, sizeof(tcon->treeName));
 750
 751         if ((rsp->Capabilities & SMB2_SHARE_CAP_DFS) &&
 752             ((tcon->share_flags & SHI1005_FLAGS_DFS) == 0))
 753                 cifs_dbg(VFS, "DFS capability contradicts DFS flag\n");
 754
 755 tcon_exit:
 756         free_rsp_buf(resp_buftype, rsp);
 757         kfree(unc_path);
 758         return rc;
 759
 760 tcon_error_exit:
 761         if (rsp->hdr.Status == STATUS_BAD_NETWORK_NAME) {
 762                 cifs_dbg(VFS, "BAD_NETWORK_NAME: %s\n", tree);
 763                 tcon->bad_network_name = true;
 764         }
 765         goto tcon_exit;
 766 }
 767
 768 int
 769 SMB2_tdis(const unsigned int xid, struct cifs_tcon *tcon)
 770 {
 771         struct smb2_tree_disconnect_req *req; /* response is trivial */
 772         int rc = 0;
 773         struct TCP_Server_Info *server;
 774         struct cifs_ses *ses = tcon->ses;
 775
 776         cifs_dbg(FYI, "Tree Disconnect\n");
 777
 778         if (ses && (ses->server))
 779                 server = ses->server;
 780         else
 781                 return -EIO;
 782
 783         if ((tcon->need_reconnect) || (tcon->ses->need_reconnect))
 784                 return 0;
 785
 786         rc = small_smb2_init(SMB2_TREE_DISCONNECT, tcon, (void **) &req);
 787         if (rc)
 788                 return rc;
 789
 790         rc = SendReceiveNoRsp(xid, ses, (char *)&req->hdr, 0);
 791         if (rc)
 792                 cifs_stats_fail_inc(tcon, SMB2_TREE_DISCONNECT_HE);
 793
 794         return rc;
 795 }
 796
 797 static struct create_lease *
 798 create_lease_buf(u8 *lease_key, u8 oplock)
 799 {
 800         struct create_lease *buf;
 801
 802         buf = kzalloc(sizeof(struct create_lease), GFP_KERNEL);
 803         if (!buf)
 804                 return NULL;
 805
 806         buf->lcontext.LeaseKeyLow = cpu_to_le64(*((u64 *)lease_key));
 807         buf->lcontext.LeaseKeyHigh = cpu_to_le64(*((u64 *)(lease_key + 8)));
 808         if (oplock == SMB2_OPLOCK_LEVEL_EXCLUSIVE)
 809                 buf->lcontext.LeaseState = SMB2_LEASE_WRITE_CACHING |
 810                                            SMB2_LEASE_READ_CACHING;
 811         else if (oplock == SMB2_OPLOCK_LEVEL_II)
 812                 buf->lcontext.LeaseState = SMB2_LEASE_READ_CACHING;
 813         else if (oplock == SMB2_OPLOCK_LEVEL_BATCH)
 814                 buf->lcontext.LeaseState = SMB2_LEASE_HANDLE_CACHING |
 815                                            SMB2_LEASE_READ_CACHING |
 816                                            SMB2_LEASE_WRITE_CACHING;
 817
 818         buf->ccontext.DataOffset = cpu_to_le16(offsetof
 819                                         (struct create_lease, lcontext));
 820         buf->ccontext.DataLength = cpu_to_le32(sizeof(struct lease_context));
 821         buf->ccontext.NameOffset = cpu_to_le16(offsetof
 822                                 (struct create_lease, Name));
 823         buf->ccontext.NameLength = cpu_to_le16(4);
 824         buf->Name[0] = 'R';
 825         buf->Name[1] = 'q';
 826         buf->Name[2] = 'L';
 827         buf->Name[3] = 's';
 828         return buf;
 829 }
 830
 831 static __u8
 832 parse_lease_state(struct smb2_create_rsp *rsp)
 833 {
 834         char *data_offset;
 835         struct create_lease *lc;
 836         bool found = false;
 837
 838         data_offset = (char *)rsp;
 839         data_offset += 4 + le32_to_cpu(rsp->CreateContextsOffset);
 840         lc = (struct create_lease *)data_offset;
 841         do {
 842                 char *name = le16_to_cpu(lc->ccontext.NameOffset) + (char *)lc;
 843                 if (le16_to_cpu(lc->ccontext.NameLength) != 4 ||
 844                     strncmp(name, "RqLs", 4)) {
 845                         lc = (struct create_lease *)((char *)lc
 846                                         + le32_to_cpu(lc->ccontext.Next));
 847                         continue;
 848                 }
 849                 if (lc->lcontext.LeaseFlags & SMB2_LEASE_FLAG_BREAK_IN_PROGRESS)
 850                         return SMB2_OPLOCK_LEVEL_NOCHANGE;
 851                 found = true;
 852                 break;
 853         } while (le32_to_cpu(lc->ccontext.Next) != 0);
 854
 855         if (!found)
 856                 return 0;
 857
 858         return smb2_map_lease_to_oplock(lc->lcontext.LeaseState);
 859 }
 860
 861 int
 862 SMB2_open(const unsigned int xid, struct cifs_tcon *tcon, __le16 *path,
 863           u64 *persistent_fid, u64 *volatile_fid, __u32 desired_access,
 864           __u32 create_disposition, __u32 file_attributes, __u32 create_options,
 865           __u8 *oplock, struct smb2_file_all_info *buf)
 866 {
 867         struct smb2_create_req *req;
 868         struct smb2_create_rsp *rsp;
 869         struct TCP_Server_Info *server;
 870         struct cifs_ses *ses = tcon->ses;
 871         struct kvec iov[3];
 872         int resp_buftype;
 873         int uni_path_len;
 874         __le16 *copy_path = NULL;
 875         int copy_size;
 876         int rc = 0;
 877         int num_iovecs = 2;
 878
 879         cifs_dbg(FYI, "create/open\n");
 880
 881         if (ses && (ses->server))
 882                 server = ses->server;
 883         else
 884                 return -EIO;
 885
 886         rc = small_smb2_init(SMB2_CREATE, tcon, (void **) &req);
 887         if (rc)
 888                 return rc;
 889
 890         req->ImpersonationLevel = IL_IMPERSONATION;
 891         req->DesiredAccess = cpu_to_le32(desired_access);
 892         /* File attributes ignored on open (used in create though) */
 893         req->FileAttributes = cpu_to_le32(file_attributes);
 894         req->ShareAccess = FILE_SHARE_ALL_LE;
 895         req->CreateDisposition = cpu_to_le32(create_disposition);
 896         req->CreateOptions = cpu_to_le32(create_options);
 897         uni_path_len = (2 * UniStrnlen((wchar_t *)path, PATH_MAX)) + 2;
 898         req->NameOffset = cpu_to_le16(sizeof(struct smb2_create_req)
 899                         - 8 /* pad */ - 4 /* do not count rfc1001 len field */);
 900
 901         iov[0].iov_base = (char *)req;
 902         /* 4 for rfc1002 length field */
 903         iov[0].iov_len = get_rfc1002_length(req) + 4;
 904
 905         /* MUST set path len (NameLength) to 0 opening root of share */
 906         if (uni_path_len >= 4) {
 907                 req->NameLength = cpu_to_le16(uni_path_len - 2);
 908                 /* -1 since last byte is buf[0] which is sent below (path) */
 909                 iov[0].iov_len--;
 910                 if (uni_path_len % 8 != 0) {
 911                         copy_size = uni_path_len / 8 * 8;
 912                         if (copy_size < uni_path_len)
 913                                 copy_size += 8;
 914
 915                         copy_path = kzalloc(copy_size, GFP_KERNEL);
 916                         if (!copy_path)
 917                                 return -ENOMEM;
 918                         memcpy((char *)copy_path, (const char *)path,
 919                                 uni_path_len);
 920                         uni_path_len = copy_size;
 921                         path = copy_path;
 922                 }
 923
 924                 iov[1].iov_len = uni_path_len;
 925                 iov[1].iov_base = path;
 926                 /*
 927                  * -1 since last byte is buf[0] which was counted in
 928                  * smb2_buf_len.
 929                  */
 930                 inc_rfc1001_len(req, uni_path_len - 1);
 931         } else {
 932                 iov[0].iov_len += 7;
 933                 req->hdr.smb2_buf_length = cpu_to_be32(be32_to_cpu(
 934                                 req->hdr.smb2_buf_length) + 8 - 1);
 935                 num_iovecs = 1;
 936                 req->NameLength = 0;
 937         }
 938
 939         if (!server->oplocks)
 940                 *oplock = SMB2_OPLOCK_LEVEL_NONE;
 941
 942         if (!(tcon->ses->server->capabilities & SMB2_GLOBAL_CAP_LEASING) ||
 943             *oplock == SMB2_OPLOCK_LEVEL_NONE)
 944                 req->RequestedOplockLevel = *oplock;
 945         else {
 946                 iov[num_iovecs].iov_base = create_lease_buf(oplock+1, *oplock);
 947                 if (iov[num_iovecs].iov_base == NULL) {
 948                         cifs_small_buf_release(req);
 949                         kfree(copy_path);
 950                         return -ENOMEM;
 951                 }
 952                 iov[num_iovecs].iov_len = sizeof(struct create_lease);
 953                 req->RequestedOplockLevel = SMB2_OPLOCK_LEVEL_LEASE;
 954                 req->CreateContextsOffset = cpu_to_le32(
 955                         sizeof(struct smb2_create_req) - 4 - 8 +
 956                         iov[num_iovecs-1].iov_len);
 957                 req->CreateContextsLength = cpu_to_le32(
 958                         sizeof(struct create_lease));
 959                 inc_rfc1001_len(&req->hdr, sizeof(struct create_lease));
 960                 num_iovecs++;
 961         }
 962
 963         rc = SendReceive2(xid, ses, iov, num_iovecs, &resp_buftype, 0);
 964         rsp = (struct smb2_create_rsp *)iov[0].iov_base;
 965
 966         if (rc != 0) {
 967                 cifs_stats_fail_inc(tcon, SMB2_CREATE_HE);
 968                 goto creat_exit;
 969         }
 970
 971         *persistent_fid = rsp->PersistentFileId;
 972         *volatile_fid = rsp->VolatileFileId;
 973
 974         if (buf) {
 975                 memcpy(buf, &rsp->CreationTime, 32);
 976                 buf->AllocationSize = rsp->AllocationSize;
 977                 buf->EndOfFile = rsp->EndofFile;
 978                 buf->Attributes = rsp->FileAttributes;
 979                 buf->NumberOfLinks = cpu_to_le32(1);
 980                 buf->DeletePending = 0;
 981         }
 982
 983         if (rsp->OplockLevel == SMB2_OPLOCK_LEVEL_LEASE)
 984                 *oplock = parse_lease_state(rsp);
 985         else
 986                 *oplock = rsp->OplockLevel;
 987 creat_exit:
 988         kfree(copy_path);
 989         free_rsp_buf(resp_buftype, rsp);
 990         return rc;
 991 }
 992
 993 int
 994 SMB2_close(const unsigned int xid, struct cifs_tcon *tcon,
 995            u64 persistent_fid, u64 volatile_fid)
 996 {
 997         struct smb2_close_req *req;
 998         struct smb2_close_rsp *rsp;
 999         struct TCP_Server_Info *server;
1000         struct cifs_ses *ses = tcon->ses;
1001         struct kvec iov[1];
1002         int resp_buftype;
1003         int rc = 0;
1004
1005         cifs_dbg(FYI, "Close\n");
1006
1007         if (ses && (ses->server))
1008                 server = ses->server;
1009         else
1010                 return -EIO;
1011
1012         rc = small_smb2_init(SMB2_CLOSE, tcon, (void **) &req);
1013         if (rc)
1014                 return rc;
1015
1016         req->PersistentFileId = persistent_fid;
1017         req->VolatileFileId = volatile_fid;
1018
1019         iov[0].iov_base = (char *)req;
1020         /* 4 for rfc1002 length field */
1021         iov[0].iov_len = get_rfc1002_length(req) + 4;
1022
1023         rc = SendReceive2(xid, ses, iov, 1, &resp_buftype, 0);
1024         rsp = (struct smb2_close_rsp *)iov[0].iov_base;
1025
1026         if (rc != 0) {
1027                 if (tcon)
1028                         cifs_stats_fail_inc(tcon, SMB2_CLOSE_HE);
1029                 goto close_exit;
1030         }
1031
1032         /* BB FIXME - decode close response, update inode for caching */
1033
1034 close_exit:
1035         free_rsp_buf(resp_buftype, rsp);
1036         return rc;
1037 }
1038
1039 static int
1040 validate_buf(unsigned int offset, unsigned int buffer_length,
1041              struct smb2_hdr *hdr, unsigned int min_buf_size)
1042
1043 {
1044         unsigned int smb_len = be32_to_cpu(hdr->smb2_buf_length);
1045         char *end_of_smb = smb_len + 4 /* RFC1001 length field */ + (char *)hdr;
1046         char *begin_of_buf = 4 /* RFC1001 len field */ + offset + (char *)hdr;
1047         char *end_of_buf = begin_of_buf + buffer_length;
1048
1049
1050         if (buffer_length < min_buf_size) {
1051                 cifs_dbg(VFS, "buffer length %d smaller than minimum size %d\n",
1052                          buffer_length, min_buf_size);
1053                 return -EINVAL;
1054         }
1055
1056         /* check if beyond RFC1001 maximum length */
1057         if ((smb_len > 0x7FFFFF) || (buffer_length > 0x7FFFFF)) {
1058                 cifs_dbg(VFS, "buffer length %d or smb length %d too large\n",
1059                          buffer_length, smb_len);
1060                 return -EINVAL;
1061         }
1062
1063         if ((begin_of_buf > end_of_smb) || (end_of_buf > end_of_smb)) {
1064                 cifs_dbg(VFS, "illegal server response, bad offset to data\n");
1065                 return -EINVAL;
1066         }
1067
1068         return 0;
1069 }
1070
1071 /*
1072  * If SMB buffer fields are valid, copy into temporary buffer to hold result.
1073  * Caller must free buffer.
1074  */
1075 static int
1076 validate_and_copy_buf(unsigned int offset, unsigned int buffer_length,
1077                       struct smb2_hdr *hdr, unsigned int minbufsize,
1078                       char *data)
1079
1080 {
1081         char *begin_of_buf = 4 /* RFC1001 len field */ + offset + (char *)hdr;
1082         int rc;
1083
1084         if (!data)
1085                 return -EINVAL;
1086
1087         rc = validate_buf(offset, buffer_length, hdr, minbufsize);
1088         if (rc)
1089                 return rc;
1090
1091         memcpy(data, begin_of_buf, buffer_length);
1092
1093         return 0;
1094 }
1095
1096 static int
1097 query_info(const unsigned int xid, struct cifs_tcon *tcon,
1098            u64 persistent_fid, u64 volatile_fid, u8 info_class,
1099            size_t output_len, size_t min_len, void *data)
1100 {
1101         struct smb2_query_info_req *req;
1102         struct smb2_query_info_rsp *rsp = NULL;
1103         struct kvec iov[2];
1104         int rc = 0;
1105         int resp_buftype;
1106         struct TCP_Server_Info *server;
1107         struct cifs_ses *ses = tcon->ses;
1108
1109         cifs_dbg(FYI, "Query Info\n");
1110
1111         if (ses && (ses->server))
1112                 server = ses->server;
1113         else
1114                 return -EIO;
1115
1116         rc = small_smb2_init(SMB2_QUERY_INFO, tcon, (void **) &req);
1117         if (rc)
1118                 return rc;
1119
1120         req->InfoType = SMB2_O_INFO_FILE;
1121         req->FileInfoClass = info_class;
1122         req->PersistentFileId = persistent_fid;
1123         req->VolatileFileId = volatile_fid;
1124         /* 4 for rfc1002 length field and 1 for Buffer */
1125         req->InputBufferOffset =
1126                 cpu_to_le16(sizeof(struct smb2_query_info_req) - 1 - 4);
1127         req->OutputBufferLength = cpu_to_le32(output_len);
1128
1129         iov[0].iov_base = (char *)req;
1130         /* 4 for rfc1002 length field */
1131         iov[0].iov_len = get_rfc1002_length(req) + 4;
1132
1133         rc = SendReceive2(xid, ses, iov, 1, &resp_buftype, 0);
1134         rsp = (struct smb2_query_info_rsp *)iov[0].iov_base;
1135
1136         if (rc) {
1137                 cifs_stats_fail_inc(tcon, SMB2_QUERY_INFO_HE);
1138                 goto qinf_exit;
1139         }
1140
1141         rc = validate_and_copy_buf(le16_to_cpu(rsp->OutputBufferOffset),
1142                                    le32_to_cpu(rsp->OutputBufferLength),
1143                                    &rsp->hdr, min_len, data);
1144
1145 qinf_exit:
1146         free_rsp_buf(resp_buftype, rsp);
1147         return rc;
1148 }
1149
1150 int
1151 SMB2_query_info(const unsigned int xid, struct cifs_tcon *tcon,
1152                 u64 persistent_fid, u64 volatile_fid,
1153                 struct smb2_file_all_info *data)
1154 {
1155         return query_info(xid, tcon, persistent_fid, volatile_fid,
1156                           FILE_ALL_INFORMATION,
1157                           sizeof(struct smb2_file_all_info) + MAX_NAME * 2,
1158                           sizeof(struct smb2_file_all_info), data);
1159 }
1160
1161 int
1162 SMB2_get_srv_num(const unsigned int xid, struct cifs_tcon *tcon,
1163                  u64 persistent_fid, u64 volatile_fid, __le64 *uniqueid)
1164 {
1165         return query_info(xid, tcon, persistent_fid, volatile_fid,
1166                           FILE_INTERNAL_INFORMATION,
1167                           sizeof(struct smb2_file_internal_info),
1168                           sizeof(struct smb2_file_internal_info), uniqueid);
1169 }
1170
1171 /*
1172  * This is a no-op for now. We're not really interested in the reply, but
1173  * rather in the fact that the server sent one and that server->lstrp
1174  * gets updated.
1175  *
1176  * FIXME: maybe we should consider checking that the reply matches request?
1177  */
1178 static void
1179 smb2_echo_callback(struct mid_q_entry *mid)
1180 {
1181         struct TCP_Server_Info *server = mid->callback_data;
1182         struct smb2_echo_rsp *smb2 = (struct smb2_echo_rsp *)mid->resp_buf;
1183         unsigned int credits_received = 1;
1184
1185         if (mid->mid_state == MID_RESPONSE_RECEIVED)
1186                 credits_received = le16_to_cpu(smb2->hdr.CreditRequest);
1187
1188         DeleteMidQEntry(mid);
1189         add_credits(server, credits_received, CIFS_ECHO_OP);
1190 }
1191
1192 int
1193 SMB2_echo(struct TCP_Server_Info *server)
1194 {
1195         struct smb2_echo_req *req;
1196         int rc = 0;
1197         struct kvec iov;
1198         struct smb_rqst rqst = { .rq_iov = &iov,
1199                                  .rq_nvec = 1 };
1200
1201         cifs_dbg(FYI, "In echo request\n");
1202
1203         rc = small_smb2_init(SMB2_ECHO, NULL, (void **)&req);
1204         if (rc)
1205                 return rc;
1206
1207         req->hdr.CreditRequest = cpu_to_le16(1);
1208
1209         iov.iov_base = (char *)req;
1210         /* 4 for rfc1002 length field */
1211         iov.iov_len = get_rfc1002_length(req) + 4;
1212
1213         rc = cifs_call_async(server, &rqst, NULL, smb2_echo_callback, server,
1214                              CIFS_ECHO_OP);
1215         if (rc)
1216                 cifs_dbg(FYI, "Echo request failed: %d\n", rc);
1217
1218         cifs_small_buf_release(req);
1219         return rc;
1220 }
1221
1222 int
1223 SMB2_flush(const unsigned int xid, struct cifs_tcon *tcon, u64 persistent_fid,
1224            u64 volatile_fid)
1225 {
1226         struct smb2_flush_req *req;
1227         struct TCP_Server_Info *server;
1228         struct cifs_ses *ses = tcon->ses;
1229         struct kvec iov[1];
1230         int resp_buftype;
1231         int rc = 0;
1232
1233         cifs_dbg(FYI, "Flush\n");
1234
1235         if (ses && (ses->server))
1236                 server = ses->server;
1237         else
1238                 return -EIO;
1239
1240         rc = small_smb2_init(SMB2_FLUSH, tcon, (void **) &req);
1241         if (rc)
1242                 return rc;
1243
1244         req->PersistentFileId = persistent_fid;
1245         req->VolatileFileId = volatile_fid;
1246
1247         iov[0].iov_base = (char *)req;
1248         /* 4 for rfc1002 length field */
1249         iov[0].iov_len = get_rfc1002_length(req) + 4;
1250
1251         rc = SendReceive2(xid, ses, iov, 1, &resp_buftype, 0);
1252
1253         if ((rc != 0) && tcon)
1254                 cifs_stats_fail_inc(tcon, SMB2_FLUSH_HE);
1255
1256         free_rsp_buf(resp_buftype, iov[0].iov_base);
1257         return rc;
1258 }
1259
1260 /*
1261  * To form a chain of read requests, any read requests after the first should
1262  * have the end_of_chain boolean set to true.
1263  */
1264 static int
1265 smb2_new_read_req(struct kvec *iov, struct cifs_io_parms *io_parms,
1266                   unsigned int remaining_bytes, int request_type)
1267 {
1268         int rc = -EACCES;
1269         struct smb2_read_req *req = NULL;
1270
1271         rc = small_smb2_init(SMB2_READ, io_parms->tcon, (void **) &req);
1272         if (rc)
1273                 return rc;
1274         if (io_parms->tcon->ses->server == NULL)
1275                 return -ECONNABORTED;
1276
1277         req->hdr.ProcessId = cpu_to_le32(io_parms->pid);
1278
1279         req->PersistentFileId = io_parms->persistent_fid;
1280         req->VolatileFileId = io_parms->volatile_fid;
1281         req->ReadChannelInfoOffset = 0; /* reserved */
1282         req->ReadChannelInfoLength = 0; /* reserved */
1283         req->Channel = 0; /* reserved */
1284         req->MinimumCount = 0;
1285         req->Length = cpu_to_le32(io_parms->length);
1286         req->Offset = cpu_to_le64(io_parms->offset);
1287
1288         if (request_type & CHAINED_REQUEST) {
1289                 if (!(request_type & END_OF_CHAIN)) {
1290                         /* 4 for rfc1002 length field */
1291                         req->hdr.NextCommand =
1292                                 cpu_to_le32(get_rfc1002_length(req) + 4);
1293                 } else /* END_OF_CHAIN */
1294                         req->hdr.NextCommand = 0;
1295                 if (request_type & RELATED_REQUEST) {
1296                         req->hdr.Flags |= SMB2_FLAGS_RELATED_OPERATIONS;
1297                         /*
1298                          * Related requests use info from previous read request
1299                          * in chain.
1300                          */
1301                         req->hdr.SessionId = 0xFFFFFFFF;
1302                         req->hdr.TreeId = 0xFFFFFFFF;
1303                         req->PersistentFileId = 0xFFFFFFFF;
1304                         req->VolatileFileId = 0xFFFFFFFF;
1305                 }
1306         }
1307         if (remaining_bytes > io_parms->length)
1308                 req->RemainingBytes = cpu_to_le32(remaining_bytes);
1309         else
1310                 req->RemainingBytes = 0;
1311
1312         iov[0].iov_base = (char *)req;
1313         /* 4 for rfc1002 length field */
1314         iov[0].iov_len = get_rfc1002_length(req) + 4;
1315         return rc;
1316 }
1317
1318 static void
1319 smb2_readv_callback(struct mid_q_entry *mid)
1320 {
1321         struct cifs_readdata *rdata = mid->callback_data;
1322         struct cifs_tcon *tcon = tlink_tcon(rdata->cfile->tlink);
1323         struct TCP_Server_Info *server = tcon->ses->server;
1324         struct smb2_hdr *buf = (struct smb2_hdr *)rdata->iov.iov_base;
1325         unsigned int credits_received = 1;
1326         struct smb_rqst rqst = { .rq_iov = &rdata->iov,
1327                                  .rq_nvec = 1,
1328                                  .rq_pages = rdata->pages,
1329                                  .rq_npages = rdata->nr_pages,
1330                                  .rq_pagesz = rdata->pagesz,
1331                                  .rq_tailsz = rdata->tailsz };
1332
1333         cifs_dbg(FYI, "%s: mid=%llu state=%d result=%d bytes=%u\n",
1334                  __func__, mid->mid, mid->mid_state, rdata->result,
1335                  rdata->bytes);
1336
1337         switch (mid->mid_state) {
1338         case MID_RESPONSE_RECEIVED:
1339                 credits_received = le16_to_cpu(buf->CreditRequest);
1340                 /* result already set, check signature */
1341                 if (server->sign) {
1342                         int rc;
1343
1344                         rc = smb2_verify_signature(&rqst, server);
1345                         if (rc)
1346                                 cifs_dbg(VFS, "SMB signature verification returned error = %d\n",
1347                                          rc);
1348                 }
1349                 /* FIXME: should this be counted toward the initiating task? */
1350                 task_io_account_read(rdata->bytes);
1351                 cifs_stats_bytes_read(tcon, rdata->bytes);
1352                 break;
1353         case MID_REQUEST_SUBMITTED:
1354         case MID_RETRY_NEEDED:
1355                 rdata->result = -EAGAIN;
1356                 break;
1357         default:
1358                 if (rdata->result != -ENODATA)
1359                         rdata->result = -EIO;
1360         }
1361
1362         if (rdata->result)
1363                 cifs_stats_fail_inc(tcon, SMB2_READ_HE);
1364
1365         queue_work(cifsiod_wq, &rdata->work);
1366         DeleteMidQEntry(mid);
1367         add_credits(server, credits_received, 0);
1368 }
1369
1370 /* smb2_async_readv - send an async write, and set up mid to handle result */
1371 int
1372 smb2_async_readv(struct cifs_readdata *rdata)
1373 {
1374         int rc;
1375         struct smb2_hdr *buf;
1376         struct cifs_io_parms io_parms;
1377         struct smb_rqst rqst = { .rq_iov = &rdata->iov,
1378                                  .rq_nvec = 1 };
1379
1380         cifs_dbg(FYI, "%s: offset=%llu bytes=%u\n",
1381                  __func__, rdata->offset, rdata->bytes);
1382
1383         io_parms.tcon = tlink_tcon(rdata->cfile->tlink);
1384         io_parms.offset = rdata->offset;
1385         io_parms.length = rdata->bytes;
1386         io_parms.persistent_fid = rdata->cfile->fid.persistent_fid;
1387         io_parms.volatile_fid = rdata->cfile->fid.volatile_fid;
1388         io_parms.pid = rdata->pid;
1389         rc = smb2_new_read_req(&rdata->iov, &io_parms, 0, 0);
1390         if (rc)
1391                 return rc;
1392
1393         buf = (struct smb2_hdr *)rdata->iov.iov_base;
1394         /* 4 for rfc1002 length field */
1395         rdata->iov.iov_len = get_rfc1002_length(rdata->iov.iov_base) + 4;
1396
1397         kref_get(&rdata->refcount);
1398         rc = cifs_call_async(io_parms.tcon->ses->server, &rqst,
1399                              cifs_readv_receive, smb2_readv_callback,
1400                              rdata, 0);
1401         if (rc) {
1402                 kref_put(&rdata->refcount, cifs_readdata_release);
1403                 cifs_stats_fail_inc(io_parms.tcon, SMB2_READ_HE);
1404         }
1405
1406         cifs_small_buf_release(buf);
1407         return rc;
1408 }
1409
1410 int
1411 SMB2_read(const unsigned int xid, struct cifs_io_parms *io_parms,
1412           unsigned int *nbytes, char **buf, int *buf_type)
1413 {
1414         int resp_buftype, rc = -EACCES;
1415         struct smb2_read_rsp *rsp = NULL;
1416         struct kvec iov[1];
1417
1418         *nbytes = 0;
1419         rc = smb2_new_read_req(iov, io_parms, 0, 0);
1420         if (rc)
1421                 return rc;
1422
1423         rc = SendReceive2(xid, io_parms->tcon->ses, iov, 1,
1424                           &resp_buftype, CIFS_LOG_ERROR);
1425
1426         rsp = (struct smb2_read_rsp *)iov[0].iov_base;
1427
1428         if (rsp->hdr.Status == STATUS_END_OF_FILE) {
1429                 free_rsp_buf(resp_buftype, iov[0].iov_base);
1430                 return 0;
1431         }
1432
1433         if (rc) {
1434                 cifs_stats_fail_inc(io_parms->tcon, SMB2_READ_HE);
1435                 cifs_dbg(VFS, "Send error in read = %d\n", rc);
1436         } else {
1437                 *nbytes = le32_to_cpu(rsp->DataLength);
1438                 if ((*nbytes > CIFS_MAX_MSGSIZE) ||
1439                     (*nbytes > io_parms->length)) {
1440                         cifs_dbg(FYI, "bad length %d for count %d\n",
1441                                  *nbytes, io_parms->length);
1442                         rc = -EIO;
1443                         *nbytes = 0;
1444                 }
1445         }
1446
1447         if (*buf) {
1448                 memcpy(*buf, (char *)rsp->hdr.ProtocolId + rsp->DataOffset,
1449                        *nbytes);
1450                 free_rsp_buf(resp_buftype, iov[0].iov_base);
1451         } else if (resp_buftype != CIFS_NO_BUFFER) {
1452                 *buf = iov[0].iov_base;
1453                 if (resp_buftype == CIFS_SMALL_BUFFER)
1454                         *buf_type = CIFS_SMALL_BUFFER;
1455                 else if (resp_buftype == CIFS_LARGE_BUFFER)
1456                         *buf_type = CIFS_LARGE_BUFFER;
1457         }
1458         return rc;
1459 }
1460
1461 /*
1462  * Check the mid_state and signature on received buffer (if any), and queue the
1463  * workqueue completion task.
1464  */
1465 static void
1466 smb2_writev_callback(struct mid_q_entry *mid)
1467 {
1468         struct cifs_writedata *wdata = mid->callback_data;
1469         struct cifs_tcon *tcon = tlink_tcon(wdata->cfile->tlink);
1470         unsigned int written;
1471         struct smb2_write_rsp *rsp = (struct smb2_write_rsp *)mid->resp_buf;
1472         unsigned int credits_received = 1;
1473
1474         switch (mid->mid_state) {
1475         case MID_RESPONSE_RECEIVED:
1476                 credits_received = le16_to_cpu(rsp->hdr.CreditRequest);
1477                 wdata->result = smb2_check_receive(mid, tcon->ses->server, 0);
1478                 if (wdata->result != 0)
1479                         break;
1480
1481                 written = le32_to_cpu(rsp->DataLength);
1482                 /*
1483                  * Mask off high 16 bits when bytes written as returned
1484                  * by the server is greater than bytes requested by the
1485                  * client. OS/2 servers are known to set incorrect
1486                  * CountHigh values.
1487                  */
1488                 if (written > wdata->bytes)
1489                         written &= 0xFFFF;
1490
1491                 if (written < wdata->bytes)
1492                         wdata->result = -ENOSPC;
1493                 else
1494                         wdata->bytes = written;
1495                 break;
1496         case MID_REQUEST_SUBMITTED:
1497         case MID_RETRY_NEEDED:
1498                 wdata->result = -EAGAIN;
1499                 break;
1500         default:
1501                 wdata->result = -EIO;
1502                 break;
1503         }
1504
1505         if (wdata->result)
1506                 cifs_stats_fail_inc(tcon, SMB2_WRITE_HE);
1507
1508         queue_work(cifsiod_wq, &wdata->work);
1509         DeleteMidQEntry(mid);
1510         add_credits(tcon->ses->server, credits_received, 0);
1511 }
1512
1513 /* smb2_async_writev - send an async write, and set up mid to handle result */
1514 int
1515 smb2_async_writev(struct cifs_writedata *wdata)
1516 {
1517         int rc = -EACCES;
1518         struct smb2_write_req *req = NULL;
1519         struct cifs_tcon *tcon = tlink_tcon(wdata->cfile->tlink);
1520         struct kvec iov;
1521         struct smb_rqst rqst;
1522
1523         rc = small_smb2_init(SMB2_WRITE, tcon, (void **) &req);
1524         if (rc)
1525                 goto async_writev_out;
1526
1527         req->hdr.ProcessId = cpu_to_le32(wdata->cfile->pid);
1528
1529         req->PersistentFileId = wdata->cfile->fid.persistent_fid;
1530         req->VolatileFileId = wdata->cfile->fid.volatile_fid;
1531         req->WriteChannelInfoOffset = 0;
1532         req->WriteChannelInfoLength = 0;
1533         req->Channel = 0;
1534         req->Offset = cpu_to_le64(wdata->offset);
1535         /* 4 for rfc1002 length field */
1536         req->DataOffset = cpu_to_le16(
1537                                 offsetof(struct smb2_write_req, Buffer) - 4);
1538         req->RemainingBytes = 0;
1539
1540         /* 4 for rfc1002 length field and 1 for Buffer */
1541         iov.iov_len = get_rfc1002_length(req) + 4 - 1;
1542         iov.iov_base = req;
1543
1544         rqst.rq_iov = &iov;
1545         rqst.rq_nvec = 1;
1546         rqst.rq_pages = wdata->pages;
1547         rqst.rq_npages = wdata->nr_pages;
1548         rqst.rq_pagesz = wdata->pagesz;
1549         rqst.rq_tailsz = wdata->tailsz;
1550
1551         cifs_dbg(FYI, "async write at %llu %u bytes\n",
1552                  wdata->offset, wdata->bytes);
1553
1554         req->Length = cpu_to_le32(wdata->bytes);
1555
1556         inc_rfc1001_len(&req->hdr, wdata->bytes - 1 /* Buffer */);
1557
1558         kref_get(&wdata->refcount);
1559         rc = cifs_call_async(tcon->ses->server, &rqst, NULL,
1560                                 smb2_writev_callback, wdata, 0);
1561
1562         if (rc) {
1563                 kref_put(&wdata->refcount, cifs_writedata_release);
1564                 cifs_stats_fail_inc(tcon, SMB2_WRITE_HE);
1565         }
1566
1567 async_writev_out:
1568         cifs_small_buf_release(req);
1569         return rc;
1570 }
1571
1572 /*
1573  * SMB2_write function gets iov pointer to kvec array with n_vec as a length.
1574  * The length field from io_parms must be at least 1 and indicates a number of
1575  * elements with data to write that begins with position 1 in iov array. All
1576  * data length is specified by count.
1577  */
1578 int
1579 SMB2_write(const unsigned int xid, struct cifs_io_parms *io_parms,
1580            unsigned int *nbytes, struct kvec *iov, int n_vec)
1581 {
1582         int rc = 0;
1583         struct smb2_write_req *req = NULL;
1584         struct smb2_write_rsp *rsp = NULL;
1585         int resp_buftype;
1586         *nbytes = 0;
1587
1588         if (n_vec < 1)
1589                 return rc;
1590
1591         rc = small_smb2_init(SMB2_WRITE, io_parms->tcon, (void **) &req);
1592         if (rc)
1593                 return rc;
1594
1595         if (io_parms->tcon->ses->server == NULL)
1596                 return -ECONNABORTED;
1597
1598         req->hdr.ProcessId = cpu_to_le32(io_parms->pid);
1599
1600         req->PersistentFileId = io_parms->persistent_fid;
1601         req->VolatileFileId = io_parms->volatile_fid;
1602         req->WriteChannelInfoOffset = 0;
1603         req->WriteChannelInfoLength = 0;
1604         req->Channel = 0;
1605         req->Length = cpu_to_le32(io_parms->length);
1606         req->Offset = cpu_to_le64(io_parms->offset);
1607         /* 4 for rfc1002 length field */
1608         req->DataOffset = cpu_to_le16(
1609                                 offsetof(struct smb2_write_req, Buffer) - 4);
1610         req->RemainingBytes = 0;
1611
1612         iov[0].iov_base = (char *)req;
1613         /* 4 for rfc1002 length field and 1 for Buffer */
1614         iov[0].iov_len = get_rfc1002_length(req) + 4 - 1;
1615
1616         /* length of entire message including data to be written */
1617         inc_rfc1001_len(req, io_parms->length - 1 /* Buffer */);
1618
1619         rc = SendReceive2(xid, io_parms->tcon->ses, iov, n_vec + 1,
1620                           &resp_buftype, 0);
1621         rsp = (struct smb2_write_rsp *)iov[0].iov_base;
1622
1623         if (rc) {
1624                 cifs_stats_fail_inc(io_parms->tcon, SMB2_WRITE_HE);
1625                 cifs_dbg(VFS, "Send error in write = %d\n", rc);
1626         } else
1627                 *nbytes = le32_to_cpu(rsp->DataLength);
1628
1629         free_rsp_buf(resp_buftype, rsp);
1630         return rc;
1631 }
1632
1633 static unsigned int
1634 num_entries(char *bufstart, char *end_of_buf, char **lastentry, size_t size)
1635 {
1636         int len;
1637         unsigned int entrycount = 0;
1638         unsigned int next_offset = 0;
1639         FILE_DIRECTORY_INFO *entryptr;
1640
1641         if (bufstart == NULL)
1642                 return 0;
1643
1644         entryptr = (FILE_DIRECTORY_INFO *)bufstart;
1645
1646         while (1) {
1647                 entryptr = (FILE_DIRECTORY_INFO *)
1648                                         ((char *)entryptr + next_offset);
1649
1650                 if ((char *)entryptr + size > end_of_buf) {
1651                         cifs_dbg(VFS, "malformed search entry would overflow\n");
1652                         break;
1653                 }
1654
1655                 len = le32_to_cpu(entryptr->FileNameLength);
1656                 if ((char *)entryptr + len + size > end_of_buf) {
1657                         cifs_dbg(VFS, "directory entry name would overflow frame end of buf %p\n",
1658                                  end_of_buf);
1659                         break;
1660                 }
1661
1662                 *lastentry = (char *)entryptr;
1663                 entrycount++;
1664
1665                 next_offset = le32_to_cpu(entryptr->NextEntryOffset);
1666                 if (!next_offset)
1667                         break;
1668         }
1669
1670         return entrycount;
1671 }
1672
1673 /*
1674  * Readdir/FindFirst
1675  */
1676 int
1677 SMB2_query_directory(const unsigned int xid, struct cifs_tcon *tcon,
1678                      u64 persistent_fid, u64 volatile_fid, int index,
1679                      struct cifs_search_info *srch_inf)
1680 {
1681         struct smb2_query_directory_req *req;
1682         struct smb2_query_directory_rsp *rsp = NULL;
1683         struct kvec iov[2];
1684         int rc = 0;
1685         int len;
1686         int resp_buftype;
1687         unsigned char *bufptr;
1688         struct TCP_Server_Info *server;
1689         struct cifs_ses *ses = tcon->ses;
1690         __le16 asteriks = cpu_to_le16('*');
1691         char *end_of_smb;
1692         unsigned int output_size = CIFSMaxBufSize;
1693         size_t info_buf_size;
1694
1695         if (ses && (ses->server))
1696                 server = ses->server;
1697         else
1698                 return -EIO;
1699
1700         rc = small_smb2_init(SMB2_QUERY_DIRECTORY, tcon, (void **) &req);
1701         if (rc)
1702                 return rc;
1703
1704         switch (srch_inf->info_level) {
1705         case SMB_FIND_FILE_DIRECTORY_INFO:
1706                 req->FileInformationClass = FILE_DIRECTORY_INFORMATION;
1707                 info_buf_size = sizeof(FILE_DIRECTORY_INFO) - 1;
1708                 break;
1709         case SMB_FIND_FILE_ID_FULL_DIR_INFO:
1710                 req->FileInformationClass = FILEID_FULL_DIRECTORY_INFORMATION;
1711                 info_buf_size = sizeof(SEARCH_ID_FULL_DIR_INFO) - 1;
1712                 break;
1713         default:
1714                 cifs_dbg(VFS, "info level %u isn't supported\n",
1715                          srch_inf->info_level);
1716                 rc = -EINVAL;
1717                 goto qdir_exit;
1718         }
1719
1720         req->FileIndex = cpu_to_le32(index);
1721         req->PersistentFileId = persistent_fid;
1722         req->VolatileFileId = volatile_fid;
1723
1724         len = 0x2;
1725         bufptr = req->Buffer;
1726         memcpy(bufptr, &asteriks, len);
1727
1728         req->FileNameOffset =
1729                 cpu_to_le16(sizeof(struct smb2_query_directory_req) - 1 - 4);
1730         req->FileNameLength = cpu_to_le16(len);
1731         /*
1732          * BB could be 30 bytes or so longer if we used SMB2 specific
1733          * buffer lengths, but this is safe and close enough.
1734          */
1735         output_size = min_t(unsigned int, output_size, server->maxBuf);
1736         output_size = min_t(unsigned int, output_size, 2 << 15);
1737         req->OutputBufferLength = cpu_to_le32(output_size);
1738
1739         iov[0].iov_base = (char *)req;
1740         /* 4 for RFC1001 length and 1 for Buffer */
1741         iov[0].iov_len = get_rfc1002_length(req) + 4 - 1;
1742
1743         iov[1].iov_base = (char *)(req->Buffer);
1744         iov[1].iov_len = len;
1745
1746         inc_rfc1001_len(req, len - 1 /* Buffer */);
1747
1748         rc = SendReceive2(xid, ses, iov, 2, &resp_buftype, 0);
1749         rsp = (struct smb2_query_directory_rsp *)iov[0].iov_base;
1750
1751         if (rc) {
1752                 cifs_stats_fail_inc(tcon, SMB2_QUERY_DIRECTORY_HE);
1753                 goto qdir_exit;
1754         }
1755
1756         rc = validate_buf(le16_to_cpu(rsp->OutputBufferOffset),
1757                           le32_to_cpu(rsp->OutputBufferLength), &rsp->hdr,
1758                           info_buf_size);
1759         if (rc)
1760                 goto qdir_exit;
1761
1762         srch_inf->unicode = true;
1763
1764         if (srch_inf->ntwrk_buf_start) {
1765                 if (srch_inf->smallBuf)
1766                         cifs_small_buf_release(srch_inf->ntwrk_buf_start);
1767                 else
1768                         cifs_buf_release(srch_inf->ntwrk_buf_start);
1769         }
1770         srch_inf->ntwrk_buf_start = (char *)rsp;
1771         srch_inf->srch_entries_start = srch_inf->last_entry = 4 /* rfclen */ +
1772                 (char *)&rsp->hdr + le16_to_cpu(rsp->OutputBufferOffset);
1773         /* 4 for rfc1002 length field */
1774         end_of_smb = get_rfc1002_length(rsp) + 4 + (char *)&rsp->hdr;
1775         srch_inf->entries_in_buffer =
1776                         num_entries(srch_inf->srch_entries_start, end_of_smb,
1777                                     &srch_inf->last_entry, info_buf_size);
1778         srch_inf->index_of_last_entry += srch_inf->entries_in_buffer;
1779         cifs_dbg(FYI, "num entries %d last_index %lld srch start %p srch end %p\n",
1780                  srch_inf->entries_in_buffer, srch_inf->index_of_last_entry,
1781                  srch_inf->srch_entries_start, srch_inf->last_entry);
1782         if (resp_buftype == CIFS_LARGE_BUFFER)
1783                 srch_inf->smallBuf = false;
1784         else if (resp_buftype == CIFS_SMALL_BUFFER)
1785                 srch_inf->smallBuf = true;
1786         else
1787                 cifs_dbg(VFS, "illegal search buffer type\n");
1788
1789         if (rsp->hdr.Status == STATUS_NO_MORE_FILES)
1790                 srch_inf->endOfSearch = 1;
1791         else
1792                 srch_inf->endOfSearch = 0;
1793
1794         return rc;
1795
1796 qdir_exit:
1797         free_rsp_buf(resp_buftype, rsp);
1798         return rc;
1799 }
1800
1801 static int
1802 send_set_info(const unsigned int xid, struct cifs_tcon *tcon,
1803                u64 persistent_fid, u64 volatile_fid, u32 pid, int info_class,
1804                unsigned int num, void **data, unsigned int *size)
1805 {
1806         struct smb2_set_info_req *req;
1807         struct smb2_set_info_rsp *rsp = NULL;
1808         struct kvec *iov;
1809         int rc = 0;
1810         int resp_buftype;
1811         unsigned int i;
1812         struct TCP_Server_Info *server;
1813         struct cifs_ses *ses = tcon->ses;
1814
1815         if (ses && (ses->server))
1816                 server = ses->server;
1817         else
1818                 return -EIO;
1819
1820         if (!num)
1821                 return -EINVAL;
1822
1823         iov = kmalloc(sizeof(struct kvec) * num, GFP_KERNEL);
1824         if (!iov)
1825                 return -ENOMEM;
1826
1827         rc = small_smb2_init(SMB2_SET_INFO, tcon, (void **) &req);
1828         if (rc) {
1829                 kfree(iov);
1830                 return rc;
1831         }
1832
1833         req->hdr.ProcessId = cpu_to_le32(pid);
1834
1835         req->InfoType = SMB2_O_INFO_FILE;
1836         req->FileInfoClass = info_class;
1837         req->PersistentFileId = persistent_fid;
1838         req->VolatileFileId = volatile_fid;
1839
1840         /* 4 for RFC1001 length and 1 for Buffer */
1841         req->BufferOffset =
1842                         cpu_to_le16(sizeof(struct smb2_set_info_req) - 1 - 4);
1843         req->BufferLength = cpu_to_le32(*size);
1844
1845         inc_rfc1001_len(req, *size - 1 /* Buffer */);
1846
1847         memcpy(req->Buffer, *data, *size);
1848
1849         iov[0].iov_base = (char *)req;
1850         /* 4 for RFC1001 length */
1851         iov[0].iov_len = get_rfc1002_length(req) + 4;
1852
1853         for (i = 1; i < num; i++) {
1854                 inc_rfc1001_len(req, size[i]);
1855                 le32_add_cpu(&req->BufferLength, size[i]);
1856                 iov[i].iov_base = (char *)data[i];
1857                 iov[i].iov_len = size[i];
1858         }
1859
1860         rc = SendReceive2(xid, ses, iov, num, &resp_buftype, 0);
1861         rsp = (struct smb2_set_info_rsp *)iov[0].iov_base;
1862
1863         if (rc != 0) {
1864                 cifs_stats_fail_inc(tcon, SMB2_SET_INFO_HE);
1865                 goto out;
1866         }
1867 out:
1868         free_rsp_buf(resp_buftype, rsp);
1869         kfree(iov);
1870         return rc;
1871 }
1872
1873 int
1874 SMB2_rename(const unsigned int xid, struct cifs_tcon *tcon,
1875             u64 persistent_fid, u64 volatile_fid, __le16 *target_file)
1876 {
1877         struct smb2_file_rename_info info;
1878         void **data;
1879         unsigned int size[2];
1880         int rc;
1881         int len = (2 * UniStrnlen((wchar_t *)target_file, PATH_MAX));
1882
1883         data = kmalloc(sizeof(void *) * 2, GFP_KERNEL);
1884         if (!data)
1885                 return -ENOMEM;
1886
1887         info.ReplaceIfExists = 1; /* 1 = replace existing target with new */
1888                               /* 0 = fail if target already exists */
1889         info.RootDirectory = 0;  /* MBZ for network ops (why does spec say?) */
1890         info.FileNameLength = cpu_to_le32(len);
1891
1892         data[0] = &info;
1893         size[0] = sizeof(struct smb2_file_rename_info);
1894
1895         data[1] = target_file;
1896         size[1] = len + 2 /* null */;
1897
1898         rc = send_set_info(xid, tcon, persistent_fid, volatile_fid,
1899                            current->tgid, FILE_RENAME_INFORMATION, 2, data,
1900                            size);
1901         kfree(data);
1902         return rc;
1903 }
1904
1905 int
1906 SMB2_set_hardlink(const unsigned int xid, struct cifs_tcon *tcon,
1907                   u64 persistent_fid, u64 volatile_fid, __le16 *target_file)
1908 {
1909         struct smb2_file_link_info info;
1910         void **data;
1911         unsigned int size[2];
1912         int rc;
1913         int len = (2 * UniStrnlen((wchar_t *)target_file, PATH_MAX));
1914
1915         data = kmalloc(sizeof(void *) * 2, GFP_KERNEL);
1916         if (!data)
1917                 return -ENOMEM;
1918
1919         info.ReplaceIfExists = 0; /* 1 = replace existing link with new */
1920                               /* 0 = fail if link already exists */
1921         info.RootDirectory = 0;  /* MBZ for network ops (why does spec say?) */
1922         info.FileNameLength = cpu_to_le32(len);
1923
1924         data[0] = &info;
1925         size[0] = sizeof(struct smb2_file_link_info);
1926
1927         data[1] = target_file;
1928         size[1] = len + 2 /* null */;
1929
1930         rc = send_set_info(xid, tcon, persistent_fid, volatile_fid,
1931                            current->tgid, FILE_LINK_INFORMATION, 2, data, size);
1932         kfree(data);
1933         return rc;
1934 }
1935
1936 int
1937 SMB2_set_eof(const unsigned int xid, struct cifs_tcon *tcon, u64 persistent_fid,
1938              u64 volatile_fid, u32 pid, __le64 *eof)
1939 {
1940         struct smb2_file_eof_info info;
1941         void *data;
1942         unsigned int size;
1943
1944         info.EndOfFile = *eof;
1945
1946         data = &info;
1947         size = sizeof(struct smb2_file_eof_info);
1948
1949         return send_set_info(xid, tcon, persistent_fid, volatile_fid, pid,
1950                              FILE_END_OF_FILE_INFORMATION, 1, &data, &size);
1951 }
1952
1953 int
1954 SMB2_set_info(const unsigned int xid, struct cifs_tcon *tcon,
1955               u64 persistent_fid, u64 volatile_fid, FILE_BASIC_INFO *buf)
1956 {
1957         unsigned int size;
1958         size = sizeof(FILE_BASIC_INFO);
1959         return send_set_info(xid, tcon, persistent_fid, volatile_fid,
1960                              current->tgid, FILE_BASIC_INFORMATION, 1,
1961                              (void **)&buf, &size);
1962 }
1963
1964 int
1965 SMB2_oplock_break(const unsigned int xid, struct cifs_tcon *tcon,
1966                   const u64 persistent_fid, const u64 volatile_fid,
1967                   __u8 oplock_level)
1968 {
1969         int rc;
1970         struct smb2_oplock_break *req = NULL;
1971
1972         cifs_dbg(FYI, "SMB2_oplock_break\n");
1973         rc = small_smb2_init(SMB2_OPLOCK_BREAK, tcon, (void **) &req);
1974
1975         if (rc)
1976                 return rc;
1977
1978         req->VolatileFid = volatile_fid;
1979         req->PersistentFid = persistent_fid;
1980         req->OplockLevel = oplock_level;
1981         req->hdr.CreditRequest = cpu_to_le16(1);
1982
1983         rc = SendReceiveNoRsp(xid, tcon->ses, (char *) req, CIFS_OBREAK_OP);
1984         /* SMB2 buffer freed by function above */
1985
1986         if (rc) {
1987                 cifs_stats_fail_inc(tcon, SMB2_OPLOCK_BREAK_HE);
1988                 cifs_dbg(FYI, "Send error in Oplock Break = %d\n", rc);
1989         }
1990
1991         return rc;
1992 }
1993
1994 static void
1995 copy_fs_info_to_kstatfs(struct smb2_fs_full_size_info *pfs_inf,
1996                         struct kstatfs *kst)
1997 {
1998         kst->f_bsize = le32_to_cpu(pfs_inf->BytesPerSector) *
1999                           le32_to_cpu(pfs_inf->SectorsPerAllocationUnit);
2000         kst->f_blocks = le64_to_cpu(pfs_inf->TotalAllocationUnits);
2001         kst->f_bfree  = le64_to_cpu(pfs_inf->ActualAvailableAllocationUnits);
2002         kst->f_bavail = le64_to_cpu(pfs_inf->CallerAvailableAllocationUnits);
2003         return;
2004 }
2005
2006 static int
2007 build_qfs_info_req(struct kvec *iov, struct cifs_tcon *tcon, int level,
2008                    int outbuf_len, u64 persistent_fid, u64 volatile_fid)
2009 {
2010         int rc;
2011         struct smb2_query_info_req *req;
2012
2013         cifs_dbg(FYI, "Query FSInfo level %d\n", level);
2014
2015         if ((tcon->ses == NULL) || (tcon->ses->server == NULL))
2016                 return -EIO;
2017
2018         rc = small_smb2_init(SMB2_QUERY_INFO, tcon, (void **) &req);
2019         if (rc)
2020                 return rc;
2021
2022         req->InfoType = SMB2_O_INFO_FILESYSTEM;
2023         req->FileInfoClass = level;
2024         req->PersistentFileId = persistent_fid;
2025         req->VolatileFileId = volatile_fid;
2026         /* 4 for rfc1002 length field and 1 for pad */
2027         req->InputBufferOffset =
2028                         cpu_to_le16(sizeof(struct smb2_query_info_req) - 1 - 4);
2029         req->OutputBufferLength = cpu_to_le32(
2030                 outbuf_len + sizeof(struct smb2_query_info_rsp) - 1 - 4);
2031
2032         iov->iov_base = (char *)req;
2033         /* 4 for rfc1002 length field */
2034         iov->iov_len = get_rfc1002_length(req) + 4;
2035         return 0;
2036 }
2037
2038 int
2039 SMB2_QFS_info(const unsigned int xid, struct cifs_tcon *tcon,
2040               u64 persistent_fid, u64 volatile_fid, struct kstatfs *fsdata)
2041 {
2042         struct smb2_query_info_rsp *rsp = NULL;
2043         struct kvec iov;
2044         int rc = 0;
2045         int resp_buftype;
2046         struct cifs_ses *ses = tcon->ses;
2047         struct smb2_fs_full_size_info *info = NULL;
2048
2049         rc = build_qfs_info_req(&iov, tcon, FS_FULL_SIZE_INFORMATION,
2050                                 sizeof(struct smb2_fs_full_size_info),
2051                                 persistent_fid, volatile_fid);
2052         if (rc)
2053                 return rc;
2054
2055         rc = SendReceive2(xid, ses, &iov, 1, &resp_buftype, 0);
2056         if (rc) {
2057                 cifs_stats_fail_inc(tcon, SMB2_QUERY_INFO_HE);
2058                 goto qinf_exit;
2059         }
2060         rsp = (struct smb2_query_info_rsp *)iov.iov_base;
2061
2062         info = (struct smb2_fs_full_size_info *)(4 /* RFC1001 len */ +
2063                 le16_to_cpu(rsp->OutputBufferOffset) + (char *)&rsp->hdr);
2064         rc = validate_buf(le16_to_cpu(rsp->OutputBufferOffset),
2065                           le32_to_cpu(rsp->OutputBufferLength), &rsp->hdr,
2066                           sizeof(struct smb2_fs_full_size_info));
2067         if (!rc)
2068                 copy_fs_info_to_kstatfs(info, fsdata);
2069
2070 qinf_exit:
2071         free_rsp_buf(resp_buftype, iov.iov_base);
2072         return rc;
2073 }
2074
2075 int
2076 smb2_lockv(const unsigned int xid, struct cifs_tcon *tcon,
2077            const __u64 persist_fid, const __u64 volatile_fid, const __u32 pid,
2078            const __u32 num_lock, struct smb2_lock_element *buf)
2079 {
2080         int rc = 0;
2081         struct smb2_lock_req *req = NULL;
2082         struct kvec iov[2];
2083         int resp_buf_type;
2084         unsigned int count;
2085
2086         cifs_dbg(FYI, "smb2_lockv num lock %d\n", num_lock);
2087
2088         rc = small_smb2_init(SMB2_LOCK, tcon, (void **) &req);
2089         if (rc)
2090                 return rc;
2091
2092         req->hdr.ProcessId = cpu_to_le32(pid);
2093         req->LockCount = cpu_to_le16(num_lock);
2094
2095         req->PersistentFileId = persist_fid;
2096         req->VolatileFileId = volatile_fid;
2097
2098         count = num_lock * sizeof(struct smb2_lock_element);
2099         inc_rfc1001_len(req, count - sizeof(struct smb2_lock_element));
2100
2101         iov[0].iov_base = (char *)req;
2102         /* 4 for rfc1002 length field and count for all locks */
2103         iov[0].iov_len = get_rfc1002_length(req) + 4 - count;
2104         iov[1].iov_base = (char *)buf;
2105         iov[1].iov_len = count;
2106
2107         cifs_stats_inc(&tcon->stats.cifs_stats.num_locks);
2108         rc = SendReceive2(xid, tcon->ses, iov, 2, &resp_buf_type, CIFS_NO_RESP);
2109         if (rc) {
2110                 cifs_dbg(FYI, "Send error in smb2_lockv = %d\n", rc);
2111                 cifs_stats_fail_inc(tcon, SMB2_LOCK_HE);
2112         }
2113
2114         return rc;
2115 }
2116
2117 int
2118 SMB2_lock(const unsigned int xid, struct cifs_tcon *tcon,
2119           const __u64 persist_fid, const __u64 volatile_fid, const __u32 pid,
2120           const __u64 length, const __u64 offset, const __u32 lock_flags,
2121           const bool wait)
2122 {
2123         struct smb2_lock_element lock;
2124
2125         lock.Offset = cpu_to_le64(offset);
2126         lock.Length = cpu_to_le64(length);
2127         lock.Flags = cpu_to_le32(lock_flags);
2128         if (!wait && lock_flags != SMB2_LOCKFLAG_UNLOCK)
2129                 lock.Flags |= cpu_to_le32(SMB2_LOCKFLAG_FAIL_IMMEDIATELY);
2130
2131         return smb2_lockv(xid, tcon, persist_fid, volatile_fid, pid, 1, &lock);
2132 }
2133
2134 int
2135 SMB2_lease_break(const unsigned int xid, struct cifs_tcon *tcon,
2136                  __u8 *lease_key, const __le32 lease_state)
2137 {
2138         int rc;
2139         struct smb2_lease_ack *req = NULL;
2140
2141         cifs_dbg(FYI, "SMB2_lease_break\n");
2142         rc = small_smb2_init(SMB2_OPLOCK_BREAK, tcon, (void **) &req);
2143
2144         if (rc)
2145                 return rc;
2146
2147         req->hdr.CreditRequest = cpu_to_le16(1);
2148         req->StructureSize = cpu_to_le16(36);
2149         inc_rfc1001_len(req, 12);
2150
2151         memcpy(req->LeaseKey, lease_key, 16);
2152         req->LeaseState = lease_state;
2153
2154         rc = SendReceiveNoRsp(xid, tcon->ses, (char *) req, CIFS_OBREAK_OP);
2155         /* SMB2 buffer freed by function above */
2156
2157         if (rc) {
2158                 cifs_stats_fail_inc(tcon, SMB2_OPLOCK_BREAK_HE);
2159                 cifs_dbg(FYI, "Send error in Lease Break = %d\n", rc);
2160         }
2161
2162         return rc;
2163 }