connect.c

   1// SPDX-License-Identifier: LGPL-2.1
   2/*
   3 *
   4 *   Copyright (C) International Business Machines  Corp., 2002,2011
   5 *   Author(s): Steve French (sfrench@us.ibm.com)
   6 *
   7 */
   8#include <linux/fs.h>
   9#include <linux/net.h>
  10#include <linux/string.h>
  11#include <linux/sched/mm.h>
  12#include <linux/sched/signal.h>
  13#include <linux/list.h>
  14#include <linux/wait.h>
  15#include <linux/slab.h>
  16#include <linux/pagemap.h>
  17#include <linux/ctype.h>
  18#include <linux/utsname.h>
  19#include <linux/mempool.h>
  20#include <linux/delay.h>
  21#include <linux/completion.h>
  22#include <linux/kthread.h>
  23#include <linux/pagevec.h>
  24#include <linux/freezer.h>
  25#include <linux/namei.h>
  26#include <linux/uuid.h>
  27#include <linux/uaccess.h>
  28#include <asm/processor.h>
  29#include <linux/inet.h>
  30#include <linux/module.h>
  31#include <keys/user-type.h>
  32#include <net/ipv6.h>
  33#include <linux/parser.h>
  34#include <linux/bvec.h>
  35#include "cifspdu.h"
  36#include "cifsglob.h"
  37#include "cifsproto.h"
  38#include "cifs_unicode.h"
  39#include "cifs_debug.h"
  40#include "cifs_fs_sb.h"
  41#include "ntlmssp.h"
  42#include "nterr.h"
  43#include "rfc1002pdu.h"
  44#include "fscache.h"
  45#include "smb2proto.h"
  46#include "smbdirect.h"
  47#include "dns_resolve.h"
  48#ifdef CONFIG_CIFS_DFS_UPCALL
  49#include "dfs.h"
  50#include "dfs_cache.h"
  51#endif
  52#include "fs_context.h"
  53#include "cifs_swn.h"
  54
  55/* FIXME: should these be tunable? */
  56#define TLINK_ERROR_EXPIRE	(1 * HZ)
  57#define TLINK_IDLE_EXPIRE	(600 * HZ)
  58
  59/* Drop the connection to not overload the server */
  60#define MAX_STATUS_IO_TIMEOUT   5
  61
  62static int ip_connect(struct TCP_Server_Info *server);
  63static int generic_ip_connect(struct TCP_Server_Info *server);
  64static void tlink_rb_insert(struct rb_root *root, struct tcon_link *new_tlink);
  65static void cifs_prune_tlinks(struct work_struct *work);
  66
  67/*
  68 * Resolve hostname and set ip addr in tcp ses. Useful for hostnames that may
  69 * get their ip addresses changed at some point.
  70 *
  71 * This should be called with server->srv_mutex held.
  72 */
  73static int reconn_set_ipaddr_from_hostname(struct TCP_Server_Info *server)
  74{
  75	struct sockaddr_storage ss;
  76	int rc;
  77
  78	if (!server->hostname)
  79		return -EINVAL;
  80
  81	/* if server hostname isn't populated, there's nothing to do here */
  82	if (server->hostname[0] == '\0')
  83		return 0;
  84
  85	spin_lock(&server->srv_lock);
  86	ss = server->dstaddr;
  87	spin_unlock(&server->srv_lock);
  88
  89	rc = dns_resolve_name(server->dns_dom, server->hostname,
  90			      strlen(server->hostname),
  91			      (struct sockaddr *)&ss);
  92	if (!rc) {
  93		spin_lock(&server->srv_lock);
  94		memcpy(&server->dstaddr, &ss, sizeof(server->dstaddr));
  95		spin_unlock(&server->srv_lock);
  96	}
  97	return rc;
  98}
  99
 100void smb2_query_server_interfaces(struct work_struct *work)
 101{
 102	int rc;
 103	int xid;
 104	struct cifs_tcon *tcon = container_of(work,
 105					struct cifs_tcon,
 106					query_interfaces.work);
 107	struct TCP_Server_Info *server = tcon->ses->server;
 108
 109	/*
 110	 * query server network interfaces, in case they change
 111	 */
 112	if (!server->ops->query_server_interfaces)
 113		return;
 114
 115	xid = get_xid();
 116	rc = server->ops->query_server_interfaces(xid, tcon, false);
 117	free_xid(xid);
 118
 119	if (rc)
 120		cifs_dbg(FYI, "%s: failed to query server interfaces: %d\n",
 121				__func__, rc);
 122
 123	queue_delayed_work(cifsiod_wq, &tcon->query_interfaces,
 124			   (SMB_INTERFACE_POLL_INTERVAL * HZ));
 125}
 126
 127#define set_need_reco(server) \
 128do { \
 129	spin_lock(&server->srv_lock); \
 130	if (server->tcpStatus != CifsExiting) \
 131		server->tcpStatus = CifsNeedReconnect; \
 132	spin_unlock(&server->srv_lock); \
 133} while (0)
 134
 135/*
 136 * Update the tcpStatus for the server.
 137 * This is used to signal the cifsd thread to call cifs_reconnect
 138 * ONLY cifsd thread should call cifs_reconnect. For any other
 139 * thread, use this function
 140 *
 141 * @server: the tcp ses for which reconnect is needed
 142 * @all_channels: if this needs to be done for all channels
 143 */
 144void
 145cifs_signal_cifsd_for_reconnect(struct TCP_Server_Info *server,
 146				bool all_channels)
 147{
 148	struct TCP_Server_Info *nserver;
 149	struct cifs_ses *ses;
 150	LIST_HEAD(reco);
 151	int i;
 152
 153	/* if we need to signal just this channel */
 154	if (!all_channels) {
 155		set_need_reco(server);
 156		return;
 157	}
 158
 159	if (SERVER_IS_CHAN(server))
 160		server = server->primary_server;
 161	scoped_guard(spinlock, &cifs_tcp_ses_lock) {
 162		set_need_reco(server);
 163		list_for_each_entry(ses, &server->smb_ses_list, smb_ses_list) {
 164			spin_lock(&ses->ses_lock);
 165			if (ses->ses_status == SES_EXITING) {
 166				spin_unlock(&ses->ses_lock);
 167				continue;
 168			}
 169			spin_lock(&ses->chan_lock);
 170			for (i = 1; i < ses->chan_count; i++) {
 171				nserver = ses->chans[i].server;
 172				if (!nserver)
 173					continue;
 174				nserver->srv_count++;
 175				list_add(&nserver->rlist, &reco);
 176			}
 177			spin_unlock(&ses->chan_lock);
 178			spin_unlock(&ses->ses_lock);
 179		}
 180	}
 181
 182	list_for_each_entry_safe(server, nserver, &reco, rlist) {
 183		list_del_init(&server->rlist);
 184		set_need_reco(server);
 185		cifs_put_tcp_session(server, 0);
 186	}
 187}
 188
 189/*
 190 * Mark all sessions and tcons for reconnect.
 191 * IMPORTANT: make sure that this gets called only from
 192 * cifsd thread. For any other thread, use
 193 * cifs_signal_cifsd_for_reconnect
 194 *
 195 * @server: the tcp ses for which reconnect is needed
 196 * @server needs to be previously set to CifsNeedReconnect.
 197 * @mark_smb_session: whether even sessions need to be marked
 198 */
 199void
 200cifs_mark_tcp_ses_conns_for_reconnect(struct TCP_Server_Info *server,
 201				      bool mark_smb_session)
 202{
 203	struct TCP_Server_Info *pserver;
 204	struct cifs_ses *ses, *nses;
 205	struct cifs_tcon *tcon;
 206
 207	/*
 208	 * before reconnecting the tcp session, mark the smb session (uid) and the tid bad so they
 209	 * are not used until reconnected.
 210	 */
 211	cifs_dbg(FYI, "%s: marking necessary sessions and tcons for reconnect\n", __func__);
 212
 213	/* If server is a channel, select the primary channel */
 214	pserver = SERVER_IS_CHAN(server) ? server->primary_server : server;
 215
 216	/*
 217	 * if the server has been marked for termination, there is a
 218	 * chance that the remaining channels all need reconnect. To be
 219	 * on the safer side, mark the session and trees for reconnect
 220	 * for this scenario. This might cause a few redundant session
 221	 * setup and tree connect requests, but it is better than not doing
 222	 * a tree connect when needed, and all following requests failing
 223	 */
 224	if (server->terminate) {
 225		mark_smb_session = true;
 226		server = pserver;
 227	}
 228
 229	spin_lock(&cifs_tcp_ses_lock);
 230	list_for_each_entry_safe(ses, nses, &pserver->smb_ses_list, smb_ses_list) {
 231		spin_lock(&ses->ses_lock);
 232		if (ses->ses_status == SES_EXITING) {
 233			spin_unlock(&ses->ses_lock);
 234			continue;
 235		}
 236		spin_unlock(&ses->ses_lock);
 237
 238		spin_lock(&ses->chan_lock);
 239		if (cifs_ses_get_chan_index(ses, server) ==
 240		    CIFS_INVAL_CHAN_INDEX) {
 241			spin_unlock(&ses->chan_lock);
 242			continue;
 243		}
 244
 245		if (!cifs_chan_is_iface_active(ses, server)) {
 246			spin_unlock(&ses->chan_lock);
 247			cifs_chan_update_iface(ses, server);
 248			spin_lock(&ses->chan_lock);
 249		}
 250
 251		if (!mark_smb_session && cifs_chan_needs_reconnect(ses, server)) {
 252			spin_unlock(&ses->chan_lock);
 253			continue;
 254		}
 255
 256		if (mark_smb_session)
 257			CIFS_SET_ALL_CHANS_NEED_RECONNECT(ses);
 258		else
 259			cifs_chan_set_need_reconnect(ses, server);
 260
 261		cifs_dbg(FYI, "%s: channel connect bitmap: 0x%lx\n",
 262			 __func__, ses->chans_need_reconnect);
 263
 264		/* If all channels need reconnect, then tcon needs reconnect */
 265		if (!mark_smb_session && !CIFS_ALL_CHANS_NEED_RECONNECT(ses)) {
 266			spin_unlock(&ses->chan_lock);
 267			continue;
 268		}
 269		spin_unlock(&ses->chan_lock);
 270
 271		spin_lock(&ses->ses_lock);
 272		ses->ses_status = SES_NEED_RECON;
 273		spin_unlock(&ses->ses_lock);
 274
 275		list_for_each_entry(tcon, &ses->tcon_list, tcon_list) {
 276			tcon->need_reconnect = true;
 277			spin_lock(&tcon->tc_lock);
 278			tcon->status = TID_NEED_RECON;
 279			spin_unlock(&tcon->tc_lock);
 280
 281			cancel_delayed_work(&tcon->query_interfaces);
 282		}
 283		if (ses->tcon_ipc) {
 284			ses->tcon_ipc->need_reconnect = true;
 285			spin_lock(&ses->tcon_ipc->tc_lock);
 286			ses->tcon_ipc->status = TID_NEED_RECON;
 287			spin_unlock(&ses->tcon_ipc->tc_lock);
 288		}
 289	}
 290	spin_unlock(&cifs_tcp_ses_lock);
 291}
 292
 293static void
 294cifs_abort_connection(struct TCP_Server_Info *server)
 295{
 296	struct mid_q_entry *mid, *nmid;
 297	struct list_head retry_list;
 298
 299	server->maxBuf = 0;
 300	server->max_read = 0;
 301
 302	/* do not want to be sending data on a socket we are freeing */
 303	cifs_dbg(FYI, "%s: tearing down socket\n", __func__);
 304	cifs_server_lock(server);
 305	if (server->ssocket) {
 306		cifs_dbg(FYI, "State: 0x%x Flags: 0x%lx\n", server->ssocket->state,
 307			 server->ssocket->flags);
 308		kernel_sock_shutdown(server->ssocket, SHUT_WR);
 309		cifs_dbg(FYI, "Post shutdown state: 0x%x Flags: 0x%lx\n", server->ssocket->state,
 310			 server->ssocket->flags);
 311		sock_release(server->ssocket);
 312		server->ssocket = NULL;
 313	} else if (cifs_rdma_enabled(server)) {
 314		smbd_destroy(server);
 315	}
 316	server->sequence_number = 0;
 317	server->session_estab = false;
 318	kfree_sensitive(server->session_key.response);
 319	server->session_key.response = NULL;
 320	server->session_key.len = 0;
 321	server->lstrp = jiffies;
 322
 323	/* mark submitted MIDs for retry and issue callback */
 324	INIT_LIST_HEAD(&retry_list);
 325	cifs_dbg(FYI, "%s: moving mids to private list\n", __func__);
 326	spin_lock(&server->mid_queue_lock);
 327	list_for_each_entry_safe(mid, nmid, &server->pending_mid_q, qhead) {
 328		smb_get_mid(mid);
 329		if (mid->mid_state == MID_REQUEST_SUBMITTED)
 330			mid->mid_state = MID_RETRY_NEEDED;
 331		list_move(&mid->qhead, &retry_list);
 332		mid->deleted_from_q = true;
 333	}
 334	spin_unlock(&server->mid_queue_lock);
 335	cifs_server_unlock(server);
 336
 337	cifs_dbg(FYI, "%s: issuing mid callbacks\n", __func__);
 338	list_for_each_entry_safe(mid, nmid, &retry_list, qhead) {
 339		list_del_init(&mid->qhead);
 340		mid_execute_callback(server, mid);
 341		release_mid(server, mid);
 342	}
 343}
 344
 345static bool cifs_tcp_ses_needs_reconnect(struct TCP_Server_Info *server, int num_targets)
 346{
 347	spin_lock(&server->srv_lock);
 348	server->nr_targets = num_targets;
 349	if (server->tcpStatus == CifsExiting) {
 350		/* the demux thread will exit normally next time through the loop */
 351		spin_unlock(&server->srv_lock);
 352		wake_up(&server->response_q);
 353		return false;
 354	}
 355
 356	cifs_dbg(FYI, "Mark tcp session as need reconnect\n");
 357	trace_smb3_reconnect(server->current_mid, server->conn_id,
 358			     server->hostname);
 359	server->tcpStatus = CifsNeedReconnect;
 360
 361	spin_unlock(&server->srv_lock);
 362	return true;
 363}
 364
 365/*
 366 * cifs tcp session reconnection
 367 *
 368 * mark tcp session as reconnecting so temporarily locked
 369 * mark all smb sessions as reconnecting for tcp session
 370 * reconnect tcp session
 371 * wake up waiters on reconnection? - (not needed currently)
 372 *
 373 * if mark_smb_session is passed as true, unconditionally mark
 374 * the smb session (and tcon) for reconnect as well. This value
 375 * doesn't really matter for non-multichannel scenario.
 376 *
 377 */
 378static int __cifs_reconnect(struct TCP_Server_Info *server,
 379			    bool mark_smb_session, bool once)
 380{
 381	int rc = 0;
 382
 383	if (!cifs_tcp_ses_needs_reconnect(server, 1))
 384		return 0;
 385
 386	/*
 387	 * if smb session has been marked for reconnect, also reconnect all
 388	 * connections. This way, the other connections do not end up bad.
 389	 */
 390	if (mark_smb_session)
 391		cifs_signal_cifsd_for_reconnect(server, mark_smb_session);
 392
 393	cifs_mark_tcp_ses_conns_for_reconnect(server, mark_smb_session);
 394
 395	cifs_abort_connection(server);
 396
 397	do {
 398		try_to_freeze();
 399		cifs_server_lock(server);
 400
 401		if (!cifs_swn_set_server_dstaddr(server) &&
 402		    !SERVER_IS_CHAN(server)) {
 403			/* resolve the hostname again to make sure that IP address is up-to-date */
 404			rc = reconn_set_ipaddr_from_hostname(server);
 405			cifs_dbg(FYI, "%s: reconn_set_ipaddr_from_hostname: rc=%d\n", __func__, rc);
 406		}
 407
 408		if (cifs_rdma_enabled(server))
 409			rc = smbd_reconnect(server);
 410		else
 411			rc = generic_ip_connect(server);
 412		if (rc) {
 413			cifs_server_unlock(server);
 414			cifs_dbg(FYI, "%s: reconnect error %d\n", __func__, rc);
 415			/* If was asked to reconnect only once, do not try it more times */
 416			if (once)
 417				break;
 418			msleep(3000);
 419		} else {
 420			atomic_inc(&tcpSesReconnectCount);
 421			set_credits(server, 1);
 422			spin_lock(&server->srv_lock);
 423			if (server->tcpStatus != CifsExiting)
 424				server->tcpStatus = CifsNeedNegotiate;
 425			spin_unlock(&server->srv_lock);
 426			cifs_swn_reset_server_dstaddr(server);
 427			cifs_server_unlock(server);
 428			cifs_queue_server_reconn(server);
 429		}
 430	} while (server->tcpStatus == CifsNeedReconnect);
 431
 432	spin_lock(&server->srv_lock);
 433	if (server->tcpStatus == CifsNeedNegotiate)
 434		mod_delayed_work(cifsiod_wq, &server->echo, 0);
 435	spin_unlock(&server->srv_lock);
 436
 437	wake_up(&server->response_q);
 438	return rc;
 439}
 440
 441#ifdef CONFIG_CIFS_DFS_UPCALL
 442static int __reconnect_target_locked(struct TCP_Server_Info *server,
 443				     const char *target)
 444{
 445	int rc;
 446	char *hostname;
 447
 448	if (!cifs_swn_set_server_dstaddr(server)) {
 449		if (server->hostname != target) {
 450			hostname = extract_hostname(target);
 451			if (!IS_ERR(hostname)) {
 452				spin_lock(&server->srv_lock);
 453				kfree(server->hostname);
 454				server->hostname = hostname;
 455				spin_unlock(&server->srv_lock);
 456			} else {
 457				cifs_dbg(FYI, "%s: couldn't extract hostname or address from dfs target: %ld\n",
 458					 __func__, PTR_ERR(hostname));
 459				cifs_dbg(FYI, "%s: default to last target server: %s\n", __func__,
 460					 server->hostname);
 461			}
 462		}
 463		/* resolve the hostname again to make sure that IP address is up-to-date. */
 464		rc = reconn_set_ipaddr_from_hostname(server);
 465		cifs_dbg(FYI, "%s: reconn_set_ipaddr_from_hostname: rc=%d\n", __func__, rc);
 466	}
 467	/* Reconnect the socket */
 468	if (cifs_rdma_enabled(server))
 469		rc = smbd_reconnect(server);
 470	else
 471		rc = generic_ip_connect(server);
 472
 473	return rc;
 474}
 475
 476static int reconnect_target_locked(struct TCP_Server_Info *server,
 477				   struct dfs_cache_tgt_list *tl,
 478				   struct dfs_cache_tgt_iterator **target_hint)
 479{
 480	struct dfs_cache_tgt_iterator *tit;
 481	int rc;
 482
 483	*target_hint = NULL;
 484
 485	/* If dfs target list is empty, then reconnect to last server */
 486	tit = dfs_cache_get_tgt_iterator(tl);
 487	if (!tit)
 488		return __reconnect_target_locked(server, server->hostname);
 489
 490	/* Otherwise, try every dfs target in @tl */
 491	do {
 492		const char *target = dfs_cache_get_tgt_name(tit);
 493
 494		spin_lock(&server->srv_lock);
 495		if (server->tcpStatus != CifsNeedReconnect) {
 496			spin_unlock(&server->srv_lock);
 497			return -ECONNRESET;
 498		}
 499		spin_unlock(&server->srv_lock);
 500		rc = __reconnect_target_locked(server, target);
 501		if (!rc) {
 502			*target_hint = tit;
 503			break;
 504		}
 505	} while ((tit = dfs_cache_get_next_tgt(tl, tit)));
 506	return rc;
 507}
 508
 509static int reconnect_dfs_server(struct TCP_Server_Info *server)
 510{
 511	struct dfs_cache_tgt_iterator *target_hint = NULL;
 512	const char *ref_path = server->leaf_fullpath + 1;
 513	DFS_CACHE_TGT_LIST(tl);
 514	int num_targets = 0;
 515	int rc = 0;
 516
 517	/*
 518	 * Determine the number of dfs targets the referral path in @cifs_sb resolves to.
 519	 *
 520	 * smb2_reconnect() needs to know how long it should wait based upon the number of dfs
 521	 * targets (server->nr_targets).  It's also possible that the cached referral was cleared
 522	 * through /proc/fs/cifs/dfscache or the target list is empty due to server settings after
 523	 * refreshing the referral, so, in this case, default it to 1.
 524	 */
 525	if (!dfs_cache_noreq_find(ref_path, NULL, &tl))
 526		num_targets = dfs_cache_get_nr_tgts(&tl);
 527	if (!num_targets)
 528		num_targets = 1;
 529
 530	if (!cifs_tcp_ses_needs_reconnect(server, num_targets))
 531		return 0;
 532
 533	/*
 534	 * Unconditionally mark all sessions & tcons for reconnect as we might be connecting to a
 535	 * different server or share during failover.  It could be improved by adding some logic to
 536	 * only do that in case it connects to a different server or share, though.
 537	 */
 538	cifs_mark_tcp_ses_conns_for_reconnect(server, true);
 539
 540	cifs_abort_connection(server);
 541
 542	do {
 543		try_to_freeze();
 544		cifs_server_lock(server);
 545
 546		rc = reconnect_target_locked(server, &tl, &target_hint);
 547		if (rc) {
 548			/* Failed to reconnect socket */
 549			cifs_server_unlock(server);
 550			cifs_dbg(FYI, "%s: reconnect error %d\n", __func__, rc);
 551			msleep(3000);
 552			continue;
 553		}
 554		/*
 555		 * Socket was created.  Update tcp session status to CifsNeedNegotiate so that a
 556		 * process waiting for reconnect will know it needs to re-establish session and tcon
 557		 * through the reconnected target server.
 558		 */
 559		atomic_inc(&tcpSesReconnectCount);
 560		set_credits(server, 1);
 561		spin_lock(&server->srv_lock);
 562		if (server->tcpStatus != CifsExiting)
 563			server->tcpStatus = CifsNeedNegotiate;
 564		spin_unlock(&server->srv_lock);
 565		cifs_swn_reset_server_dstaddr(server);
 566		cifs_server_unlock(server);
 567		cifs_queue_server_reconn(server);
 568	} while (server->tcpStatus == CifsNeedReconnect);
 569
 570	dfs_cache_noreq_update_tgthint(ref_path, target_hint);
 571	dfs_cache_free_tgts(&tl);
 572
 573	/* Need to set up echo worker again once connection has been established */
 574	spin_lock(&server->srv_lock);
 575	if (server->tcpStatus == CifsNeedNegotiate)
 576		mod_delayed_work(cifsiod_wq, &server->echo, 0);
 577	spin_unlock(&server->srv_lock);
 578
 579	wake_up(&server->response_q);
 580	return rc;
 581}
 582
 583static int
 584_cifs_reconnect(struct TCP_Server_Info *server, bool mark_smb_session, bool once)
 585{
 586	if (!server->leaf_fullpath)
 587		return __cifs_reconnect(server, mark_smb_session, once);
 588	return reconnect_dfs_server(server);
 589}
 590#else
 591static int
 592_cifs_reconnect(struct TCP_Server_Info *server, bool mark_smb_session, bool once)
 593{
 594	return __cifs_reconnect(server, mark_smb_session, once);
 595}
 596#endif
 597
 598int
 599cifs_reconnect(struct TCP_Server_Info *server, bool mark_smb_session)
 600{
 601	return _cifs_reconnect(server, mark_smb_session, false);
 602}
 603
 604static int
 605cifs_reconnect_once(struct TCP_Server_Info *server)
 606{
 607	return _cifs_reconnect(server, true, true);
 608}
 609
 610static void
 611cifs_echo_request(struct work_struct *work)
 612{
 613	int rc;
 614	struct TCP_Server_Info *server = container_of(work,
 615					struct TCP_Server_Info, echo.work);
 616
 617	/*
 618	 * We cannot send an echo if it is disabled.
 619	 * Also, no need to ping if we got a response recently.
 620	 */
 621
 622	if (server->tcpStatus == CifsNeedReconnect ||
 623	    server->tcpStatus == CifsExiting ||
 624	    server->tcpStatus == CifsNew ||
 625	    (server->ops->can_echo && !server->ops->can_echo(server)) ||
 626	    time_before(jiffies, server->lstrp + server->echo_interval - HZ))
 627		goto requeue_echo;
 628
 629	rc = server->ops->echo ? server->ops->echo(server) : -ENOSYS;
 630	cifs_server_dbg(FYI, "send echo request: rc = %d\n", rc);
 631
 632	/* Check witness registrations */
 633	cifs_swn_check();
 634
 635requeue_echo:
 636	queue_delayed_work(cifsiod_wq, &server->echo, server->echo_interval);
 637}
 638
 639static bool
 640allocate_buffers(struct TCP_Server_Info *server)
 641{
 642	if (!server->bigbuf) {
 643		server->bigbuf = (char *)cifs_buf_get();
 644		if (!server->bigbuf) {
 645			cifs_server_dbg(VFS, "No memory for large SMB response\n");
 646			msleep(3000);
 647			/* retry will check if exiting */
 648			return false;
 649		}
 650	} else if (server->large_buf) {
 651		/* we are reusing a dirty large buf, clear its start */
 652		memset(server->bigbuf, 0, HEADER_SIZE(server));
 653	}
 654
 655	if (!server->smallbuf) {
 656		server->smallbuf = (char *)cifs_small_buf_get();
 657		if (!server->smallbuf) {
 658			cifs_server_dbg(VFS, "No memory for SMB response\n");
 659			msleep(1000);
 660			/* retry will check if exiting */
 661			return false;
 662		}
 663		/* beginning of smb buffer is cleared in our buf_get */
 664	} else {
 665		/* if existing small buf clear beginning */
 666		memset(server->smallbuf, 0, HEADER_SIZE(server));
 667	}
 668
 669	return true;
 670}
 671
 672static bool
 673server_unresponsive(struct TCP_Server_Info *server)
 674{
 675	/*
 676	 * If we're in the process of mounting a share or reconnecting a session
 677	 * and the server abruptly shut down (e.g. socket wasn't closed, packet
 678	 * had been ACK'ed but no SMB response), don't wait longer than 20s from
 679	 * when negotiate actually started.
 680	 */
 681	spin_lock(&server->srv_lock);
 682	if (server->tcpStatus == CifsInNegotiate &&
 683	    time_after(jiffies, server->neg_start + 20 * HZ)) {
 684		spin_unlock(&server->srv_lock);
 685		cifs_reconnect(server, false);
 686		return true;
 687	}
 688	/*
 689	 * We need to wait 3 echo intervals to make sure we handle such
 690	 * situations right:
 691	 * 1s  client sends a normal SMB request
 692	 * 2s  client gets a response
 693	 * 30s echo workqueue job pops, and decides we got a response recently
 694	 *     and don't need to send another
 695	 * ...
 696	 * 65s kernel_recvmsg times out, and we see that we haven't gotten
 697	 *     a response in >60s.
 698	 */
 699	if ((server->tcpStatus == CifsGood ||
 700	    server->tcpStatus == CifsNeedNegotiate) &&
 701	    (!server->ops->can_echo || server->ops->can_echo(server)) &&
 702	    time_after(jiffies, server->lstrp + 3 * server->echo_interval)) {
 703		spin_unlock(&server->srv_lock);
 704		cifs_server_dbg(VFS, "has not responded in %lu seconds. Reconnecting...\n",
 705			 (3 * server->echo_interval) / HZ);
 706		cifs_reconnect(server, false);
 707		return true;
 708	}
 709	spin_unlock(&server->srv_lock);
 710
 711	return false;
 712}
 713
 714static inline bool
 715zero_credits(struct TCP_Server_Info *server)
 716{
 717	int val;
 718
 719	spin_lock(&server->req_lock);
 720	val = server->credits + server->echo_credits + server->oplock_credits;
 721	if (server->in_flight == 0 && val == 0) {
 722		spin_unlock(&server->req_lock);
 723		return true;
 724	}
 725	spin_unlock(&server->req_lock);
 726	return false;
 727}
 728
 729static int
 730cifs_readv_from_socket(struct TCP_Server_Info *server, struct msghdr *smb_msg)
 731{
 732	int length = 0;
 733	int total_read;
 734
 735	for (total_read = 0; msg_data_left(smb_msg); total_read += length) {
 736		try_to_freeze();
 737
 738		/* reconnect if no credits and no requests in flight */
 739		if (zero_credits(server)) {
 740			cifs_reconnect(server, false);
 741			return -ECONNABORTED;
 742		}
 743
 744		if (server_unresponsive(server))
 745			return -ECONNABORTED;
 746		if (cifs_rdma_enabled(server) && server->smbd_conn)
 747			length = smbd_recv(server->smbd_conn, smb_msg);
 748		else
 749			length = sock_recvmsg(server->ssocket, smb_msg, 0);
 750
 751		spin_lock(&server->srv_lock);
 752		if (server->tcpStatus == CifsExiting) {
 753			spin_unlock(&server->srv_lock);
 754			return -ESHUTDOWN;
 755		}
 756
 757		if (server->tcpStatus == CifsNeedReconnect) {
 758			spin_unlock(&server->srv_lock);
 759			cifs_reconnect(server, false);
 760			return -ECONNABORTED;
 761		}
 762		spin_unlock(&server->srv_lock);
 763
 764		if (length == -ERESTARTSYS ||
 765		    length == -EAGAIN ||
 766		    length == -EINTR) {
 767			/*
 768			 * Minimum sleep to prevent looping, allowing socket
 769			 * to clear and app threads to set tcpStatus
 770			 * CifsNeedReconnect if server hung.
 771			 */
 772			usleep_range(1000, 2000);
 773			length = 0;
 774			continue;
 775		}
 776
 777		if (length <= 0) {
 778			cifs_dbg(FYI, "Received no data or error: %d\n", length);
 779			cifs_reconnect(server, false);
 780			return -ECONNABORTED;
 781		}
 782	}
 783	return total_read;
 784}
 785
 786int
 787cifs_read_from_socket(struct TCP_Server_Info *server, char *buf,
 788		      unsigned int to_read)
 789{
 790	struct msghdr smb_msg = {};
 791	struct kvec iov = {.iov_base = buf, .iov_len = to_read};
 792
 793	iov_iter_kvec(&smb_msg.msg_iter, ITER_DEST, &iov, 1, to_read);
 794
 795	return cifs_readv_from_socket(server, &smb_msg);
 796}
 797
 798ssize_t
 799cifs_discard_from_socket(struct TCP_Server_Info *server, size_t to_read)
 800{
 801	struct msghdr smb_msg = {};
 802
 803	/*
 804	 *  iov_iter_discard already sets smb_msg.type and count and iov_offset
 805	 *  and cifs_readv_from_socket sets msg_control and msg_controllen
 806	 *  so little to initialize in struct msghdr
 807	 */
 808	iov_iter_discard(&smb_msg.msg_iter, ITER_DEST, to_read);
 809
 810	return cifs_readv_from_socket(server, &smb_msg);
 811}
 812
 813int
 814cifs_read_iter_from_socket(struct TCP_Server_Info *server, struct iov_iter *iter,
 815			   unsigned int to_read)
 816{
 817	struct msghdr smb_msg = { .msg_iter = *iter };
 818
 819	iov_iter_truncate(&smb_msg.msg_iter, to_read);
 820	return cifs_readv_from_socket(server, &smb_msg);
 821}
 822
 823static bool
 824is_smb_response(struct TCP_Server_Info *server, unsigned char type)
 825{
 826	/*
 827	 * The first byte big endian of the length field,
 828	 * is actually not part of the length but the type
 829	 * with the most common, zero, as regular data.
 830	 */
 831	switch (type) {
 832	case RFC1002_SESSION_MESSAGE:
 833		/* Regular SMB response */
 834		return true;
 835	case RFC1002_SESSION_KEEP_ALIVE:
 836		/*
 837		 * RFC 1002 session keep alive can sent by the server only when
 838		 * we established a RFC 1002 session. But Samba servers send
 839		 * RFC 1002 session keep alive also over port 445 on which
 840		 * RFC 1002 session is not established.
 841		 */
 842		cifs_dbg(FYI, "RFC 1002 session keep alive\n");
 843		break;
 844	case RFC1002_POSITIVE_SESSION_RESPONSE:
 845		/*
 846		 * RFC 1002 positive session response cannot be returned
 847		 * for SMB request. RFC 1002 session response is handled
 848		 * exclusively in ip_rfc1001_connect() function.
 849		 */
 850		cifs_server_dbg(VFS, "RFC 1002 positive session response (unexpected)\n");
 851		cifs_reconnect(server, true);
 852		break;
 853	case RFC1002_NEGATIVE_SESSION_RESPONSE:
 854		/*
 855		 * We get this from Windows 98 instead of an error on
 856		 * SMB negprot response, when we have not established
 857		 * RFC 1002 session (which means ip_rfc1001_connect()
 858		 * was skipped). Note that same still happens with
 859		 * Windows Server 2022 when connecting via port 139.
 860		 * So for this case when mount option -o nonbsessinit
 861		 * was not specified, try to reconnect with establishing
 862		 * RFC 1002 session. If new socket establishment with
 863		 * RFC 1002 session was successful then return to the
 864		 * mid's caller -EAGAIN, so it can retry the request.
 865		 */
 866		if (!cifs_rdma_enabled(server) &&
 867		    server->tcpStatus == CifsInNegotiate &&
 868		    !server->with_rfc1001 &&
 869		    server->rfc1001_sessinit != 0) {
 870			int rc, mid_rc;
 871			struct mid_q_entry *mid, *nmid;
 872			LIST_HEAD(dispose_list);
 873
 874			cifs_dbg(FYI, "RFC 1002 negative session response during SMB Negotiate, retrying with NetBIOS session\n");
 875
 876			/*
 877			 * Before reconnect, delete all pending mids for this
 878			 * server, so reconnect would not signal connection
 879			 * aborted error to mid's callbacks. Note that for this
 880			 * server there should be exactly one pending mid
 881			 * corresponding to SMB1/SMB2 Negotiate packet.
 882			 */
 883			spin_lock(&server->mid_queue_lock);
 884			list_for_each_entry_safe(mid, nmid, &server->pending_mid_q, qhead) {
 885				smb_get_mid(mid);
 886				list_move(&mid->qhead, &dispose_list);
 887				mid->deleted_from_q = true;
 888			}
 889			spin_unlock(&server->mid_queue_lock);
 890
 891			/* Now try to reconnect once with NetBIOS session. */
 892			server->with_rfc1001 = true;
 893			rc = cifs_reconnect_once(server);
 894
 895			/*
 896			 * If reconnect was successful then indicate -EAGAIN
 897			 * to mid's caller. If reconnect failed with -EAGAIN
 898			 * then mask it as -EHOSTDOWN, so mid's caller would
 899			 * know that it failed.
 900			 */
 901			if (rc == 0)
 902				mid_rc = -EAGAIN;
 903			else if (rc == -EAGAIN)
 904				mid_rc = -EHOSTDOWN;
 905			else
 906				mid_rc = rc;
 907
 908			/*
 909			 * After reconnect (either successful or unsuccessful)
 910			 * deliver reconnect status to mid's caller via mid's
 911			 * callback. Use MID_RC state which indicates that the
 912			 * return code should be read from mid_rc member.
 913			 */
 914			list_for_each_entry_safe(mid, nmid, &dispose_list, qhead) {
 915				list_del_init(&mid->qhead);
 916				mid->mid_rc = mid_rc;
 917				mid->mid_state = MID_RC;
 918				mid_execute_callback(server, mid);
 919				release_mid(server, mid);
 920			}
 921
 922			/*
 923			 * If reconnect failed then wait two seconds. In most
 924			 * cases we were been called from the mount context and
 925			 * delivered failure to mid's callback will stop this
 926			 * receiver task thread and fails the mount process.
 927			 * So wait two seconds to prevent another reconnect
 928			 * in this task thread, which would be useless as the
 929			 * mount context will fail at all.
 930			 */
 931			if (rc != 0)
 932				msleep(2000);
 933		} else {
 934			cifs_server_dbg(VFS, "RFC 1002 negative session response (unexpected)\n");
 935			cifs_reconnect(server, true);
 936		}
 937		break;
 938	case RFC1002_RETARGET_SESSION_RESPONSE:
 939		cifs_server_dbg(VFS, "RFC 1002 retarget session response (unexpected)\n");
 940		cifs_reconnect(server, true);
 941		break;
 942	default:
 943		cifs_server_dbg(VFS, "RFC 1002 unknown response type 0x%x\n", type);
 944		cifs_reconnect(server, true);
 945	}
 946
 947	return false;
 948}
 949
 950void
 951dequeue_mid(struct TCP_Server_Info *server, struct mid_q_entry *mid, bool malformed)
 952{
 953#ifdef CONFIG_CIFS_STATS2
 954	mid->when_received = jiffies;
 955#endif
 956	spin_lock(&server->mid_queue_lock);
 957	if (!malformed)
 958		mid->mid_state = MID_RESPONSE_RECEIVED;
 959	else
 960		mid->mid_state = MID_RESPONSE_MALFORMED;
 961	/*
 962	 * Trying to handle/dequeue a mid after the send_recv()
 963	 * function has finished processing it is a bug.
 964	 */
 965	if (mid->deleted_from_q == true) {
 966		spin_unlock(&server->mid_queue_lock);
 967		pr_warn_once("trying to dequeue a deleted mid\n");
 968	} else {
 969		list_del_init(&mid->qhead);
 970		mid->deleted_from_q = true;
 971		spin_unlock(&server->mid_queue_lock);
 972	}
 973}
 974
 975static unsigned int
 976smb2_get_credits_from_hdr(char *buffer, struct TCP_Server_Info *server)
 977{
 978	struct smb2_hdr *shdr = (struct smb2_hdr *)buffer;
 979
 980	/*
 981	 * SMB1 does not use credits.
 982	 */
 983	if (is_smb1(server))
 984		return 0;
 985
 986	return le16_to_cpu(shdr->CreditRequest);
 987}
 988
 989static void
 990handle_mid(struct mid_q_entry *mid, struct TCP_Server_Info *server,
 991	   char *buf, int malformed)
 992{
 993	if (server->ops->check_trans2 &&
 994	    server->ops->check_trans2(mid, server, buf, malformed))
 995		return;
 996	mid->credits_received = smb2_get_credits_from_hdr(buf, server);
 997	mid->resp_buf = buf;
 998	mid->large_buf = server->large_buf;
 999	/* Was previous buf put in mpx struct for multi-rsp? */
1000	if (!mid->multiRsp) {
1001		/* smb buffer will be freed by user thread */
1002		if (server->large_buf)
1003			server->bigbuf = NULL;
1004		else
1005			server->smallbuf = NULL;
1006	}
1007	dequeue_mid(server, mid, malformed);
1008}
1009
1010int
1011cifs_enable_signing(struct TCP_Server_Info *server, bool mnt_sign_required)
1012{
1013	bool srv_sign_required = server->sec_mode & server->vals->signing_required;
1014	bool srv_sign_enabled = server->sec_mode & server->vals->signing_enabled;
1015	bool mnt_sign_enabled;
1016
1017	/*
1018	 * Is signing required by mnt options? If not then check
1019	 * global_secflags to see if it is there.
1020	 */
1021	if (!mnt_sign_required)
1022		mnt_sign_required = ((global_secflags & CIFSSEC_MUST_SIGN) ==
1023						CIFSSEC_MUST_SIGN);
1024
1025	/*
1026	 * If signing is required then it's automatically enabled too,
1027	 * otherwise, check to see if the secflags allow it.
1028	 */
1029	mnt_sign_enabled = mnt_sign_required ? mnt_sign_required :
1030				(global_secflags & CIFSSEC_MAY_SIGN);
1031
1032	/* If server requires signing, does client allow it? */
1033	if (srv_sign_required) {
1034		if (!mnt_sign_enabled) {
1035			cifs_dbg(VFS, "Server requires signing, but it's disabled in SecurityFlags!\n");
1036			return -EOPNOTSUPP;
1037		}
1038		server->sign = true;
1039	}
1040
1041	/* If client requires signing, does server allow it? */
1042	if (mnt_sign_required) {
1043		if (!srv_sign_enabled) {
1044			cifs_dbg(VFS, "Server does not support signing!\n");
1045			return -EOPNOTSUPP;
1046		}
1047		server->sign = true;
1048	}
1049
1050	if (cifs_rdma_enabled(server) && server->sign)
1051		cifs_dbg(VFS, "Signing is enabled, and RDMA read/write will be disabled\n");
1052
1053	return 0;
1054}
1055
1056static noinline_for_stack void
1057clean_demultiplex_info(struct TCP_Server_Info *server)
1058{
1059	int length;
1060
1061	/* take it off the list, if it's not already */
1062	spin_lock(&server->srv_lock);
1063	list_del_init(&server->tcp_ses_list);
1064	spin_unlock(&server->srv_lock);
1065
1066	cancel_delayed_work_sync(&server->echo);
1067
1068	spin_lock(&server->srv_lock);
1069	server->tcpStatus = CifsExiting;
1070	spin_unlock(&server->srv_lock);
1071	wake_up_all(&server->response_q);
1072
1073	/* check if we have blocked requests that need to free */
1074	spin_lock(&server->req_lock);
1075	if (server->credits <= 0)
1076		server->credits = 1;
1077	spin_unlock(&server->req_lock);
1078	/*
1079	 * Although there should not be any requests blocked on this queue it
1080	 * can not hurt to be paranoid and try to wake up requests that may
1081	 * haven been blocked when more than 50 at time were on the wire to the
1082	 * same server - they now will see the session is in exit state and get
1083	 * out of SendReceive.
1084	 */
1085	wake_up_all(&server->request_q);
1086	/* give those requests time to exit */
1087	msleep(125);
1088	if (cifs_rdma_enabled(server))
1089		smbd_destroy(server);
1090	if (server->ssocket) {
1091		sock_release(server->ssocket);
1092		server->ssocket = NULL;
1093	}
1094
1095	if (!list_empty(&server->pending_mid_q)) {
1096		struct mid_q_entry *mid_entry;
1097		struct list_head *tmp, *tmp2;
1098		LIST_HEAD(dispose_list);
1099
1100		spin_lock(&server->mid_queue_lock);
1101		list_for_each_safe(tmp, tmp2, &server->pending_mid_q) {
1102			mid_entry = list_entry(tmp, struct mid_q_entry, qhead);
1103			cifs_dbg(FYI, "Clearing mid %llu\n", mid_entry->mid);
1104			smb_get_mid(mid_entry);
1105			mid_entry->mid_state = MID_SHUTDOWN;
1106			list_move(&mid_entry->qhead, &dispose_list);
1107			mid_entry->deleted_from_q = true;
1108		}
1109		spin_unlock(&server->mid_queue_lock);
1110
1111		/* now walk dispose list and issue callbacks */
1112		list_for_each_safe(tmp, tmp2, &dispose_list) {
1113			mid_entry = list_entry(tmp, struct mid_q_entry, qhead);
1114			cifs_dbg(FYI, "Callback mid %llu\n", mid_entry->mid);
1115			list_del_init(&mid_entry->qhead);
1116			mid_execute_callback(server, mid_entry);
1117			release_mid(server, mid_entry);
1118		}
1119		/* 1/8th of sec is more than enough time for them to exit */
1120		msleep(125);
1121	}
1122
1123	if (!list_empty(&server->pending_mid_q)) {
1124		/*
1125		 * mpx threads have not exited yet give them at least the smb
1126		 * send timeout time for long ops.
1127		 *
1128		 * Due to delays on oplock break requests, we need to wait at
1129		 * least 45 seconds before giving up on a request getting a
1130		 * response and going ahead and killing cifsd.
1131		 */
1132		cifs_dbg(FYI, "Wait for exit from demultiplex thread\n");
1133		msleep(46000);
1134		/*
1135		 * If threads still have not exited they are probably never
1136		 * coming home not much else we can do but free the memory.
1137		 */
1138	}
1139
1140	put_net(cifs_net_ns(server));
1141	kfree(server->leaf_fullpath);
1142	kfree(server->hostname);
1143	kfree(server);
1144
1145	length = atomic_dec_return(&tcpSesAllocCount);
1146	if (length > 0)
1147		mempool_resize(cifs_req_poolp, length + cifs_min_rcv);
1148}
1149
1150static int
1151standard_receive3(struct TCP_Server_Info *server, struct mid_q_entry *mid)
1152{
1153	int length;
1154	char *buf = server->smallbuf;
1155	unsigned int pdu_length = server->pdu_size;
1156
1157	/* make sure this will fit in a large buffer */
1158	if (pdu_length > CIFSMaxBufSize + MAX_HEADER_SIZE(server)) {
1159		cifs_server_dbg(VFS, "SMB response too long (%u bytes)\n", pdu_length);
1160		cifs_reconnect(server, true);
1161		return -ECONNABORTED;
1162	}
1163
1164	/* switch to large buffer if too big for a small one */
1165	if (pdu_length > MAX_CIFS_SMALL_BUFFER_SIZE) {
1166		server->large_buf = true;
1167		memcpy(server->bigbuf, buf, server->total_read);
1168		buf = server->bigbuf;
1169	}
1170
1171	/* now read the rest */
1172	length = cifs_read_from_socket(server, buf + HEADER_SIZE(server) - 1,
1173				       pdu_length - MID_HEADER_SIZE(server));
1174
1175	if (length < 0)
1176		return length;
1177	server->total_read += length;
1178
1179	dump_smb(buf, server->total_read);
1180
1181	return cifs_handle_standard(server, mid);
1182}
1183
1184int
1185cifs_handle_standard(struct TCP_Server_Info *server, struct mid_q_entry *mid)
1186{
1187	char *buf = server->large_buf ? server->bigbuf : server->smallbuf;
1188	int rc;
1189
1190	/*
1191	 * We know that we received enough to get to the MID as we
1192	 * checked the pdu_length earlier. Now check to see
1193	 * if the rest of the header is OK.
1194	 *
1195	 * 48 bytes is enough to display the header and a little bit
1196	 * into the payload for debugging purposes.
1197	 */
1198	rc = server->ops->check_message(buf, server->pdu_size,
1199					server->total_read, server);
1200	if (rc)
1201		cifs_dump_mem("Bad SMB: ", buf,
1202			min_t(unsigned int, server->total_read, 48));
1203
1204	if (server->ops->is_session_expired &&
1205	    server->ops->is_session_expired(buf)) {
1206		cifs_reconnect(server, true);
1207		return -1;
1208	}
1209
1210	if (server->ops->is_status_pending &&
1211	    server->ops->is_status_pending(buf, server))
1212		return -1;
1213
1214	if (!mid)
1215		return rc;
1216
1217	handle_mid(mid, server, buf, rc);
1218	return 0;
1219}
1220
1221static void
1222smb2_add_credits_from_hdr(char *buffer, struct TCP_Server_Info *server)
1223{
1224	struct smb2_hdr *shdr = (struct smb2_hdr *)buffer;
1225	int scredits, in_flight;
1226
1227	/*
1228	 * SMB1 does not use credits.
1229	 */
1230	if (is_smb1(server))
1231		return;
1232
1233	if (shdr->CreditRequest) {
1234		spin_lock(&server->req_lock);
1235		server->credits += le16_to_cpu(shdr->CreditRequest);
1236		scredits = server->credits;
1237		in_flight = server->in_flight;
1238		spin_unlock(&server->req_lock);
1239		wake_up(&server->request_q);
1240
1241		trace_smb3_hdr_credits(server->current_mid,
1242				server->conn_id, server->hostname, scredits,
1243				le16_to_cpu(shdr->CreditRequest), in_flight);
1244		cifs_server_dbg(FYI, "%s: added %u credits total=%d\n",
1245				__func__, le16_to_cpu(shdr->CreditRequest),
1246				scredits);
1247	}
1248}
1249
1250
1251static int
1252cifs_demultiplex_thread(void *p)
1253{
1254	int i, num_mids, length;
1255	struct TCP_Server_Info *server = p;
1256	unsigned int pdu_length;
1257	unsigned int next_offset;
1258	char *buf = NULL;
1259	struct task_struct *task_to_wake = NULL;
1260	struct mid_q_entry *mids[MAX_COMPOUND];
1261	char *bufs[MAX_COMPOUND];
1262	unsigned int noreclaim_flag, num_io_timeout = 0;
1263	bool pending_reconnect = false;
1264
1265	noreclaim_flag = memalloc_noreclaim_save();
1266	cifs_dbg(FYI, "Demultiplex PID: %d\n", task_pid_nr(current));
1267
1268	length = atomic_inc_return(&tcpSesAllocCount);
1269	if (length > 1)
1270		mempool_resize(cifs_req_poolp, length + cifs_min_rcv);
1271
1272	set_freezable();
1273	allow_kernel_signal(SIGKILL);
1274	while (server->tcpStatus != CifsExiting) {
1275		if (try_to_freeze())
1276			continue;
1277
1278		if (!allocate_buffers(server))
1279			continue;
1280
1281		server->large_buf = false;
1282		buf = server->smallbuf;
1283		pdu_length = 4; /* enough to get RFC1001 header */
1284
1285		length = cifs_read_from_socket(server, buf, pdu_length);
1286		if (length < 0)
1287			continue;
1288
1289		server->total_read = 0;
1290
1291		/*
1292		 * The right amount was read from socket - 4 bytes,
1293		 * so we can now interpret the length field.
1294		 */
1295		pdu_length = be32_to_cpup(((__be32 *)buf)) & 0xffffff;
1296
1297		cifs_dbg(FYI, "RFC1002 header 0x%x\n", pdu_length);
1298		if (!is_smb_response(server, buf[0]))
1299			continue;
1300
1301		pending_reconnect = false;
1302next_pdu:
1303		server->pdu_size = pdu_length;
1304
1305		/* make sure we have enough to get to the MID */
1306		if (server->pdu_size < MID_HEADER_SIZE(server)) {
1307			cifs_server_dbg(VFS, "SMB response too short (%u bytes)\n",
1308				 server->pdu_size);
1309			cifs_reconnect(server, true);
1310			continue;
1311		}
1312
1313		/* read down to the MID */
1314		length = cifs_read_from_socket(server, buf,
1315					       MID_HEADER_SIZE(server));
1316		if (length < 0)
1317			continue;
1318		server->total_read += length;
1319
1320		if (server->ops->next_header) {
1321			if (server->ops->next_header(server, buf, &next_offset)) {
1322				cifs_dbg(VFS, "%s: malformed response (next_offset=%u)\n",
1323					 __func__, next_offset);
1324				cifs_reconnect(server, true);
1325				continue;
1326			}
1327			if (next_offset)
1328				server->pdu_size = next_offset;
1329		}
1330
1331		memset(mids, 0, sizeof(mids));
1332		memset(bufs, 0, sizeof(bufs));
1333		num_mids = 0;
1334
1335		if (server->ops->is_transform_hdr &&
1336		    server->ops->receive_transform &&
1337		    server->ops->is_transform_hdr(buf)) {
1338			length = server->ops->receive_transform(server,
1339								mids,
1340								bufs,
1341								&num_mids);
1342		} else {
1343			mids[0] = server->ops->find_mid(server, buf);
1344			bufs[0] = buf;
1345			num_mids = 1;
1346
1347			if (mids[0])
1348				mids[0]->response_pdu_len = pdu_length;
1349			if (!mids[0] || !mids[0]->receive)
1350				length = standard_receive3(server, mids[0]);
1351			else
1352				length = mids[0]->receive(server, mids[0]);
1353		}
1354
1355		if (length < 0) {
1356			for (i = 0; i < num_mids; i++)
1357				if (mids[i])
1358					release_mid(server, mids[i]);
1359			continue;
1360		}
1361
1362		if (server->ops->is_status_io_timeout &&
1363		    server->ops->is_status_io_timeout(buf)) {
1364			num_io_timeout++;
1365			if (num_io_timeout > MAX_STATUS_IO_TIMEOUT) {
1366				cifs_server_dbg(VFS,
1367						"Number of request timeouts exceeded %d. Reconnecting",
1368						MAX_STATUS_IO_TIMEOUT);
1369
1370				pending_reconnect = true;
1371				num_io_timeout = 0;
1372			}
1373		}
1374
1375		server->lstrp = jiffies;
1376
1377		for (i = 0; i < num_mids; i++) {
1378			if (mids[i] != NULL) {
1379				mids[i]->resp_buf_size = server->pdu_size;
1380
1381				if (bufs[i] != NULL) {
1382					if (server->ops->is_network_name_deleted &&
1383					    server->ops->is_network_name_deleted(bufs[i],
1384										 server)) {
1385						cifs_server_dbg(FYI,
1386								"Share deleted. Reconnect needed");
1387					}
1388				}
1389
1390				if (!mids[i]->multiRsp || mids[i]->multiEnd)
1391					mid_execute_callback(server, mids[i]);
1392
1393				release_mid(server, mids[i]);
1394			} else if (server->ops->is_oplock_break &&
1395				   server->ops->is_oplock_break(bufs[i],
1396								server)) {
1397				smb2_add_credits_from_hdr(bufs[i], server);
1398				cifs_dbg(FYI, "Received oplock break\n");
1399			} else {
1400				cifs_server_dbg(VFS, "No task to wake, unknown frame received! NumMids %d\n",
1401						atomic_read(&mid_count));
1402				cifs_dump_mem("Received Data is: ", bufs[i],
1403					      HEADER_SIZE(server));
1404				smb2_add_credits_from_hdr(bufs[i], server);
1405#ifdef CONFIG_CIFS_DEBUG2
1406				if (server->ops->dump_detail)
1407					server->ops->dump_detail(bufs[i], pdu_length,
1408								 server);
1409				cifs_dump_mids(server);
1410#endif /* CIFS_DEBUG2 */
1411			}
1412		}
1413
1414		if (pdu_length > server->pdu_size) {
1415			if (!allocate_buffers(server))
1416				continue;
1417			pdu_length -= server->pdu_size;
1418			server->total_read = 0;
1419			server->large_buf = false;
1420			buf = server->smallbuf;
1421			goto next_pdu;
1422		}
1423
1424		/* do this reconnect at the very end after processing all MIDs */
1425		if (pending_reconnect)
1426			cifs_reconnect(server, true);
1427
1428	} /* end while !EXITING */
1429
1430	/* buffer usually freed in free_mid - need to free it here on exit */
1431	cifs_buf_release(server->bigbuf);
1432	if (server->smallbuf) /* no sense logging a debug message if NULL */
1433		cifs_small_buf_release(server->smallbuf);
1434
1435	task_to_wake = xchg(&server->tsk, NULL);
1436	clean_demultiplex_info(server);
1437
1438	/* if server->tsk was NULL then wait for a signal before exiting */
1439	if (!task_to_wake) {
1440		set_current_state(TASK_INTERRUPTIBLE);
1441		while (!signal_pending(current)) {
1442			schedule();
1443			set_current_state(TASK_INTERRUPTIBLE);
1444		}
1445		set_current_state(TASK_RUNNING);
1446	}
1447
1448	memalloc_noreclaim_restore(noreclaim_flag);
1449	module_put_and_kthread_exit(0);
1450}
1451
1452int
1453cifs_ipaddr_cmp(struct sockaddr *srcaddr, struct sockaddr *rhs)
1454{
1455	struct sockaddr_in *saddr4 = (struct sockaddr_in *)srcaddr;
1456	struct sockaddr_in *vaddr4 = (struct sockaddr_in *)rhs;
1457	struct sockaddr_in6 *saddr6 = (struct sockaddr_in6 *)srcaddr;
1458	struct sockaddr_in6 *vaddr6 = (struct sockaddr_in6 *)rhs;
1459
1460	switch (srcaddr->sa_family) {
1461	case AF_UNSPEC:
1462		switch (rhs->sa_family) {
1463		case AF_UNSPEC:
1464			return 0;
1465		case AF_INET:
1466		case AF_INET6:
1467			return 1;
1468		default:
1469			return -1;
1470		}
1471	case AF_INET: {
1472		switch (rhs->sa_family) {
1473		case AF_UNSPEC:
1474			return -1;
1475		case AF_INET:
1476			return memcmp(saddr4, vaddr4,
1477				      sizeof(struct sockaddr_in));
1478		case AF_INET6:
1479			return 1;
1480		default:
1481			return -1;
1482		}
1483	}
1484	case AF_INET6: {
1485		switch (rhs->sa_family) {
1486		case AF_UNSPEC:
1487		case AF_INET:
1488			return -1;
1489		case AF_INET6:
1490			return memcmp(saddr6,
1491				      vaddr6,
1492				      sizeof(struct sockaddr_in6));
1493		default:
1494			return -1;
1495		}
1496	}
1497	default:
1498		return -1; /* don't expect to be here */
1499	}
1500}
1501
1502/*
1503 * Returns true if srcaddr isn't specified and rhs isn't specified, or
1504 * if srcaddr is specified and matches the IP address of the rhs argument
1505 */
1506bool
1507cifs_match_ipaddr(struct sockaddr *srcaddr, struct sockaddr *rhs)
1508{
1509	switch (srcaddr->sa_family) {
1510	case AF_UNSPEC:
1511		return (rhs->sa_family == AF_UNSPEC);
1512	case AF_INET: {
1513		struct sockaddr_in *saddr4 = (struct sockaddr_in *)srcaddr;
1514		struct sockaddr_in *vaddr4 = (struct sockaddr_in *)rhs;
1515
1516		return (saddr4->sin_addr.s_addr == vaddr4->sin_addr.s_addr);
1517	}
1518	case AF_INET6: {
1519		struct sockaddr_in6 *saddr6 = (struct sockaddr_in6 *)srcaddr;
1520		struct sockaddr_in6 *vaddr6 = (struct sockaddr_in6 *)rhs;
1521
1522		return (ipv6_addr_equal(&saddr6->sin6_addr, &vaddr6->sin6_addr)
1523			&& saddr6->sin6_scope_id == vaddr6->sin6_scope_id);
1524	}
1525	default:
1526		WARN_ON(1);
1527		return false; /* don't expect to be here */
1528	}
1529}
1530
1531/*
1532 * If no port is specified in addr structure, we try to match with 445 port
1533 * and if it fails - with 139 ports. It should be called only if address
1534 * families of server and addr are equal.
1535 */
1536static bool
1537match_port(struct TCP_Server_Info *server, struct sockaddr *addr)
1538{
1539	__be16 port, *sport;
1540
1541	/* SMBDirect manages its own ports, don't match it here */
1542	if (server->rdma)
1543		return true;
1544
1545	switch (addr->sa_family) {
1546	case AF_INET:
1547		sport = &((struct sockaddr_in *) &server->dstaddr)->sin_port;
1548		port = ((struct sockaddr_in *) addr)->sin_port;
1549		break;
1550	case AF_INET6:
1551		sport = &((struct sockaddr_in6 *) &server->dstaddr)->sin6_port;
1552		port = ((struct sockaddr_in6 *) addr)->sin6_port;
1553		break;
1554	default:
1555		WARN_ON(1);
1556		return false;
1557	}
1558
1559	if (!port) {
1560		port = htons(CIFS_PORT);
1561		if (port == *sport)
1562			return true;
1563
1564		port = htons(RFC1001_PORT);
1565	}
1566
1567	return port == *sport;
1568}
1569
1570static bool match_server_address(struct TCP_Server_Info *server, struct sockaddr *addr)
1571{
1572	if (!cifs_match_ipaddr(addr, (struct sockaddr *)&server->dstaddr))
1573		return false;
1574
1575	return true;
1576}
1577
1578static bool
1579match_security(struct TCP_Server_Info *server, struct smb3_fs_context *ctx)
1580{
1581	/*
1582	 * The select_sectype function should either return the ctx->sectype
1583	 * that was specified, or "Unspecified" if that sectype was not
1584	 * compatible with the given NEGOTIATE request.
1585	 */
1586	if (server->ops->select_sectype(server, ctx->sectype)
1587	     == Unspecified)
1588		return false;
1589
1590	/*
1591	 * Now check if signing mode is acceptable. No need to check
1592	 * global_secflags at this point since if MUST_SIGN is set then
1593	 * the server->sign had better be too.
1594	 */
1595	if (ctx->sign && !server->sign)
1596		return false;
1597
1598	return true;
1599}
1600
1601/* this function must be called with srv_lock held */
1602static int match_server(struct TCP_Server_Info *server,
1603			struct smb3_fs_context *ctx,
1604			bool match_super)
1605{
1606	struct sockaddr *addr = (struct sockaddr *)&ctx->dstaddr;
1607
1608	lockdep_assert_held(&server->srv_lock);
1609
1610	if (ctx->nosharesock)
1611		return 0;
1612
1613	/* this server does not share socket */
1614	if (server->nosharesock)
1615		return 0;
1616
1617	if (!match_super && (ctx->dfs_conn || server->dfs_conn))
1618		return 0;
1619
1620	/* If multidialect negotiation see if existing sessions match one */
1621	if (strcmp(ctx->vals->version_string, SMB3ANY_VERSION_STRING) == 0) {
1622		if (server->vals->protocol_id < SMB30_PROT_ID)
1623			return 0;
1624	} else if (strcmp(ctx->vals->version_string,
1625		   SMBDEFAULT_VERSION_STRING) == 0) {
1626		if (server->vals->protocol_id < SMB21_PROT_ID)
1627			return 0;
1628	} else if ((server->vals != ctx->vals) || (server->ops != ctx->ops))
1629		return 0;
1630
1631	if (!net_eq(cifs_net_ns(server), current->nsproxy->net_ns))
1632		return 0;
1633
1634	if (!cifs_match_ipaddr((struct sockaddr *)&ctx->srcaddr,
1635			       (struct sockaddr *)&server->srcaddr))
1636		return 0;
1637
1638	if (strcasecmp(server->hostname, ctx->server_hostname) ||
1639	    !match_server_address(server, addr) ||
1640	    !match_port(server, addr))
1641		return 0;
1642
1643	if (!match_security(server, ctx))
1644		return 0;
1645
1646	if (server->echo_interval != ctx->echo_interval * HZ)
1647		return 0;
1648
1649	if (server->rdma != ctx->rdma)
1650		return 0;
1651
1652	if (server->ignore_signature != ctx->ignore_signature)
1653		return 0;
1654
1655	if (server->min_offload != ctx->min_offload)
1656		return 0;
1657
1658	if (server->retrans != ctx->retrans)
1659		return 0;
1660
1661	return 1;
1662}
1663
1664struct TCP_Server_Info *
1665cifs_find_tcp_session(struct smb3_fs_context *ctx)
1666{
1667	struct TCP_Server_Info *server;
1668
1669	spin_lock(&cifs_tcp_ses_lock);
1670	list_for_each_entry(server, &cifs_tcp_ses_list, tcp_ses_list) {
1671		spin_lock(&server->srv_lock);
1672		/*
1673		 * Skip ses channels since they're only handled in lower layers
1674		 * (e.g. cifs_send_recv).
1675		 */
1676		if (SERVER_IS_CHAN(server) ||
1677		    !match_server(server, ctx, false)) {
1678			spin_unlock(&server->srv_lock);
1679			continue;
1680		}
1681		spin_unlock(&server->srv_lock);
1682
1683		++server->srv_count;
1684		spin_unlock(&cifs_tcp_ses_lock);
1685		cifs_dbg(FYI, "Existing tcp session with server found\n");
1686		return server;
1687	}
1688	spin_unlock(&cifs_tcp_ses_lock);
1689	return NULL;
1690}
1691
1692void
1693cifs_put_tcp_session(struct TCP_Server_Info *server, int from_reconnect)
1694{
1695	struct task_struct *task;
1696
1697	spin_lock(&cifs_tcp_ses_lock);
1698	if (--server->srv_count > 0) {
1699		spin_unlock(&cifs_tcp_ses_lock);
1700		return;
1701	}
1702
1703	/* srv_count can never go negative */
1704	WARN_ON(server->srv_count < 0);
1705
1706	list_del_init(&server->tcp_ses_list);
1707	spin_unlock(&cifs_tcp_ses_lock);
1708
1709	cancel_delayed_work_sync(&server->echo);
1710
1711	if (from_reconnect)
1712		/*
1713		 * Avoid deadlock here: reconnect work calls
1714		 * cifs_put_tcp_session() at its end. Need to be sure
1715		 * that reconnect work does nothing with server pointer after
1716		 * that step.
1717		 */
1718		cancel_delayed_work(&server->reconnect);
1719	else
1720		cancel_delayed_work_sync(&server->reconnect);
1721
1722	/* For secondary channels, we pick up ref-count on the primary server */
1723	if (SERVER_IS_CHAN(server))
1724		cifs_put_tcp_session(server->primary_server, from_reconnect);
1725
1726	spin_lock(&server->srv_lock);
1727	server->tcpStatus = CifsExiting;
1728	spin_unlock(&server->srv_lock);
1729
1730	cifs_crypto_secmech_release(server);
1731
1732	kfree_sensitive(server->session_key.response);
1733	server->session_key.response = NULL;
1734	server->session_key.len = 0;
1735
1736	task = xchg(&server->tsk, NULL);
1737	if (task)
1738		send_sig(SIGKILL, task, 1);
1739}
1740
1741struct TCP_Server_Info *
1742cifs_get_tcp_session(struct smb3_fs_context *ctx,
1743		     struct TCP_Server_Info *primary_server)
1744{
1745	struct TCP_Server_Info *tcp_ses = NULL;
1746	int rc;
1747
1748	cifs_dbg(FYI, "UNC: %s\n", ctx->UNC);
1749
1750	/* see if we already have a matching tcp_ses */
1751	tcp_ses = cifs_find_tcp_session(ctx);
1752	if (tcp_ses)
1753		return tcp_ses;
1754
1755	tcp_ses = kzalloc(sizeof(struct TCP_Server_Info), GFP_KERNEL);
1756	if (!tcp_ses) {
1757		rc = -ENOMEM;
1758		goto out_err;
1759	}
1760
1761	tcp_ses->hostname = kstrdup(ctx->server_hostname, GFP_KERNEL);
1762	if (!tcp_ses->hostname) {
1763		rc = -ENOMEM;
1764		goto out_err;
1765	}
1766
1767	if (ctx->leaf_fullpath) {
1768		tcp_ses->leaf_fullpath = kstrdup(ctx->leaf_fullpath, GFP_KERNEL);
1769		if (!tcp_ses->leaf_fullpath) {
1770			rc = -ENOMEM;
1771			goto out_err;
1772		}
1773	}
1774	if (ctx->dns_dom)
1775		strscpy(tcp_ses->dns_dom, ctx->dns_dom);
1776
1777	if (ctx->nosharesock)
1778		tcp_ses->nosharesock = true;
1779	tcp_ses->dfs_conn = ctx->dfs_conn;
1780
1781	tcp_ses->ops = ctx->ops;
1782	tcp_ses->vals = ctx->vals;
1783	cifs_set_net_ns(tcp_ses, get_net(current->nsproxy->net_ns));
1784
1785	tcp_ses->sign = ctx->sign;
1786	tcp_ses->conn_id = atomic_inc_return(&tcpSesNextId);
1787	tcp_ses->noblockcnt = ctx->rootfs;
1788	tcp_ses->noblocksnd = ctx->noblocksnd || ctx->rootfs;
1789	tcp_ses->noautotune = ctx->noautotune;
1790	tcp_ses->tcp_nodelay = ctx->sockopt_tcp_nodelay;
1791	tcp_ses->rdma = ctx->rdma;
1792	tcp_ses->in_flight = 0;
1793	tcp_ses->max_in_flight = 0;
1794	tcp_ses->credits = 1;
1795	if (primary_server) {
1796		spin_lock(&cifs_tcp_ses_lock);
1797		++primary_server->srv_count;
1798		spin_unlock(&cifs_tcp_ses_lock);
1799		tcp_ses->primary_server = primary_server;
1800	}
1801	init_waitqueue_head(&tcp_ses->response_q);
1802	init_waitqueue_head(&tcp_ses->request_q);
1803	INIT_LIST_HEAD(&tcp_ses->pending_mid_q);
1804	mutex_init(&tcp_ses->_srv_mutex);
1805	memcpy(tcp_ses->workstation_RFC1001_name,
1806		ctx->source_rfc1001_name, RFC1001_NAME_LEN_WITH_NULL);
1807	memcpy(tcp_ses->server_RFC1001_name,
1808		ctx->target_rfc1001_name, RFC1001_NAME_LEN_WITH_NULL);
1809	tcp_ses->rfc1001_sessinit = ctx->rfc1001_sessinit;
1810	tcp_ses->with_rfc1001 = false;
1811	tcp_ses->session_estab = false;
1812	tcp_ses->sequence_number = 0;
1813	tcp_ses->channel_sequence_num = 0; /* only tracked for primary channel */
1814	tcp_ses->reconnect_instance = 1;
1815	tcp_ses->lstrp = jiffies;
1816	tcp_ses->compression.requested = ctx->compress;
1817	spin_lock_init(&tcp_ses->req_lock);
1818	spin_lock_init(&tcp_ses->srv_lock);
1819	spin_lock_init(&tcp_ses->mid_queue_lock);
1820	spin_lock_init(&tcp_ses->mid_counter_lock);
1821	INIT_LIST_HEAD(&tcp_ses->tcp_ses_list);
1822	INIT_LIST_HEAD(&tcp_ses->smb_ses_list);
1823	INIT_DELAYED_WORK(&tcp_ses->echo, cifs_echo_request);
1824	INIT_DELAYED_WORK(&tcp_ses->reconnect, smb2_reconnect_server);
1825	mutex_init(&tcp_ses->reconnect_mutex);
1826	memcpy(&tcp_ses->srcaddr, &ctx->srcaddr,
1827	       sizeof(tcp_ses->srcaddr));
1828	memcpy(&tcp_ses->dstaddr, &ctx->dstaddr,
1829		sizeof(tcp_ses->dstaddr));
1830	if (ctx->use_client_guid)
1831		memcpy(tcp_ses->client_guid, ctx->client_guid,
1832		       SMB2_CLIENT_GUID_SIZE);
1833	else
1834		generate_random_uuid(tcp_ses->client_guid);
1835	/*
1836	 * at this point we are the only ones with the pointer
1837	 * to the struct since the kernel thread not created yet
1838	 * no need to spinlock this init of tcpStatus or srv_count
1839	 */
1840	tcp_ses->tcpStatus = CifsNew;
1841	++tcp_ses->srv_count;
1842	tcp_ses->echo_interval = ctx->echo_interval * HZ;
1843
1844	if (tcp_ses->rdma) {
1845#ifndef CONFIG_CIFS_SMB_DIRECT
1846		cifs_dbg(VFS, "CONFIG_CIFS_SMB_DIRECT is not enabled\n");
1847		rc = -ENOENT;
1848		goto out_err_crypto_release;
1849#endif
1850		tcp_ses->smbd_conn = smbd_get_connection(
1851			tcp_ses, (struct sockaddr *)&ctx->dstaddr);
1852		if (tcp_ses->smbd_conn) {
1853			cifs_dbg(VFS, "RDMA transport established\n");
1854			rc = 0;
1855			goto smbd_connected;
1856		} else {
1857			rc = -ENOENT;
1858			goto out_err_crypto_release;
1859		}
1860	}
1861	rc = ip_connect(tcp_ses);
1862	if (rc < 0) {
1863		cifs_dbg(VFS, "Error connecting to socket. Aborting operation.\n");
1864		goto out_err_crypto_release;
1865	}
1866smbd_connected:
1867	/*
1868	 * since we're in a cifs function already, we know that
1869	 * this will succeed. No need for try_module_get().
1870	 */
1871	__module_get(THIS_MODULE);
1872	tcp_ses->tsk = kthread_run(cifs_demultiplex_thread,
1873				  tcp_ses, "cifsd");
1874	if (IS_ERR(tcp_ses->tsk)) {
1875		rc = PTR_ERR(tcp_ses->tsk);
1876		cifs_dbg(VFS, "error %d create cifsd thread\n", rc);
1877		module_put(THIS_MODULE);
1878		goto out_err_crypto_release;
1879	}
1880	tcp_ses->min_offload = ctx->min_offload;
1881	tcp_ses->retrans = ctx->retrans;
1882	/*
1883	 * at this point we are the only ones with the pointer
1884	 * to the struct since the kernel thread not created yet
1885	 * no need to spinlock this update of tcpStatus
1886	 */
1887	spin_lock(&tcp_ses->srv_lock);
1888	tcp_ses->tcpStatus = CifsNeedNegotiate;
1889	spin_unlock(&tcp_ses->srv_lock);
1890
1891	if ((ctx->max_credits < 20) || (ctx->max_credits > 60000))
1892		tcp_ses->max_credits = SMB2_MAX_CREDITS_AVAILABLE;
1893	else
1894		tcp_ses->max_credits = ctx->max_credits;
1895
1896	tcp_ses->nr_targets = 1;
1897	tcp_ses->ignore_signature = ctx->ignore_signature;
1898	/* thread spawned, put it on the list */
1899	spin_lock(&cifs_tcp_ses_lock);
1900	list_add(&tcp_ses->tcp_ses_list, &cifs_tcp_ses_list);
1901	spin_unlock(&cifs_tcp_ses_lock);
1902
1903	/* queue echo request delayed work */
1904	queue_delayed_work(cifsiod_wq, &tcp_ses->echo, tcp_ses->echo_interval);
1905
1906	return tcp_ses;
1907
1908out_err_crypto_release:
1909	cifs_crypto_secmech_release(tcp_ses);
1910
1911	put_net(cifs_net_ns(tcp_ses));
1912
1913out_err:
1914	if (tcp_ses) {
1915		if (SERVER_IS_CHAN(tcp_ses))
1916			cifs_put_tcp_session(tcp_ses->primary_server, false);
1917		kfree(tcp_ses->hostname);
1918		kfree(tcp_ses->leaf_fullpath);
1919		if (tcp_ses->ssocket)
1920			sock_release(tcp_ses->ssocket);
1921		kfree(tcp_ses);
1922	}
1923	return ERR_PTR(rc);
1924}
1925
1926/* this function must be called with ses_lock and chan_lock held */
1927static int match_session(struct cifs_ses *ses,
1928			 struct smb3_fs_context *ctx,
1929			 bool match_super)
1930{
1931	struct TCP_Server_Info *server = ses->server;
1932	enum securityEnum ctx_sec, ses_sec;
1933
1934	if (!match_super && ctx->dfs_root_ses != ses->dfs_root_ses)
1935		return 0;
1936
1937	/*
1938	 * If an existing session is limited to less channels than
1939	 * requested, it should not be reused
1940	 */
1941	if (ses->chan_max < ctx->max_channels)
1942		return 0;
1943
1944	ctx_sec = server->ops->select_sectype(server, ctx->sectype);
1945	ses_sec = server->ops->select_sectype(server, ses->sectype);
1946
1947	if (ctx_sec != ses_sec)
1948		return 0;
1949
1950	switch (ctx_sec) {
1951	case IAKerb:
1952	case Kerberos:
1953		if (!uid_eq(ctx->cred_uid, ses->cred_uid))
1954			return 0;
1955		if (strncmp(ses->user_name ?: "",
1956			    ctx->username ?: "",
1957			    CIFS_MAX_USERNAME_LEN))
1958			return 0;
1959		break;
1960	case NTLMv2:
1961	case RawNTLMSSP:
1962	default:
1963		/* NULL username means anonymous session */
1964		if (ses->user_name == NULL) {
1965			if (!ctx->nullauth)
1966				return 0;
1967			break;
1968		}
1969
1970		/* anything else takes username/password */
1971		if (strncmp(ses->user_name,
1972			    ctx->username ? ctx->username : "",
1973			    CIFS_MAX_USERNAME_LEN))
1974			return 0;
1975		if ((ctx->username && strlen(ctx->username) != 0) &&
1976		    ses->password != NULL) {
1977
1978			/* New mount can only share sessions with an existing mount if:
1979			 * 1. Both password and password2 match, or
1980			 * 2. password2 of the old mount matches password of the new mount
1981			 *    and password of the old mount matches password2 of the new
1982			 *	  mount
1983			 */
1984			if (ses->password2 != NULL && ctx->password2 != NULL) {
1985				if (!((strncmp(ses->password, ctx->password ?
1986					ctx->password : "", CIFS_MAX_PASSWORD_LEN) == 0 &&
1987					strncmp(ses->password2, ctx->password2,
1988					CIFS_MAX_PASSWORD_LEN) == 0) ||
1989					(strncmp(ses->password, ctx->password2,
1990					CIFS_MAX_PASSWORD_LEN) == 0 &&
1991					strncmp(ses->password2, ctx->password ?
1992					ctx->password : "", CIFS_MAX_PASSWORD_LEN) == 0)))
1993					return 0;
1994
1995			} else if ((ses->password2 == NULL && ctx->password2 != NULL) ||
1996				(ses->password2 != NULL && ctx->password2 == NULL)) {
1997				return 0;
1998
1999			} else {
2000				if (strncmp(ses->password, ctx->password ?
2001					ctx->password : "", CIFS_MAX_PASSWORD_LEN))
2002					return 0;
2003			}
2004		}
2005	}
2006
2007	if (strcmp(ctx->local_nls->charset, ses->local_nls->charset))
2008		return 0;
2009
2010	return 1;
2011}
2012
2013/**
2014 * cifs_setup_ipc - helper to setup the IPC tcon for the session
2015 * @ses: smb session to issue the request on
2016 * @seal: if encryption is requested
2017 *
2018 * A new IPC connection is made and stored in the session
2019 * tcon_ipc. The IPC tcon has the same lifetime as the session.
2020 */
2021struct cifs_tcon *cifs_setup_ipc(struct cifs_ses *ses, bool seal)
2022{
2023	int rc = 0, xid;
2024	struct cifs_tcon *tcon;
2025	char unc[SERVER_NAME_LENGTH + sizeof("//x/IPC$")] = {0};
2026	struct TCP_Server_Info *server = ses->server;
2027
2028	/*
2029	 * If the mount request that resulted in the creation of the
2030	 * session requires encryption, force IPC to be encrypted too.
2031	 */
2032	if (seal && !(server->capabilities & SMB2_GLOBAL_CAP_ENCRYPTION)) {
2033		cifs_server_dbg(VFS, "IPC: server doesn't support encryption\n");
2034		return ERR_PTR(-EOPNOTSUPP);
2035	}
2036
2037	/* no need to setup directory caching on IPC share, so pass in false */
2038	tcon = tcon_info_alloc(false, netfs_trace_tcon_ref_new_ipc);
2039	if (tcon == NULL)
2040		return ERR_PTR(-ENOMEM);
2041
2042	spin_lock(&server->srv_lock);
2043	scnprintf(unc, sizeof(unc), "\\\\%s\\IPC$", server->hostname);
2044	spin_unlock(&server->srv_lock);
2045
2046	xid = get_xid();
2047	tcon->ses = ses;
2048	tcon->ipc = true;
2049	tcon->seal = seal;
2050	rc = server->ops->tree_connect(xid, ses, unc, tcon, ses->local_nls);
2051	free_xid(xid);
2052
2053	if (rc) {
2054		cifs_server_dbg(VFS | ONCE, "failed to connect to IPC (rc=%d)\n", rc);
2055		tconInfoFree(tcon, netfs_trace_tcon_ref_free_ipc_fail);
2056		return ERR_PTR(rc);
2057	}
2058
2059	cifs_dbg(FYI, "IPC tcon rc=%d ipc tid=0x%x\n", rc, tcon->tid);
2060
2061	spin_lock(&tcon->tc_lock);
2062	tcon->status = TID_GOOD;
2063	spin_unlock(&tcon->tc_lock);
2064	return tcon;
2065}
2066
2067static struct cifs_ses *
2068cifs_find_smb_ses(struct TCP_Server_Info *server, struct smb3_fs_context *ctx)
2069{
2070	struct cifs_ses *ses, *ret = NULL;
2071
2072	spin_lock(&cifs_tcp_ses_lock);
2073	list_for_each_entry(ses, &server->smb_ses_list, smb_ses_list) {
2074		spin_lock(&ses->ses_lock);
2075		if (ses->ses_status == SES_EXITING) {
2076			spin_unlock(&ses->ses_lock);
2077			continue;
2078		}
2079		spin_lock(&ses->chan_lock);
2080		if (match_session(ses, ctx, false)) {
2081			spin_unlock(&ses->chan_lock);
2082			spin_unlock(&ses->ses_lock);
2083			ret = ses;
2084			break;
2085		}
2086		spin_unlock(&ses->chan_lock);
2087		spin_unlock(&ses->ses_lock);
2088	}
2089	if (ret)
2090		cifs_smb_ses_inc_refcount(ret);
2091	spin_unlock(&cifs_tcp_ses_lock);
2092	return ret;
2093}
2094
2095void __cifs_put_smb_ses(struct cifs_ses *ses)
2096{
2097	struct TCP_Server_Info *server = ses->server;
2098	struct cifs_tcon *tcon;
2099	unsigned int xid;
2100	size_t i;
2101	bool do_logoff;
2102	int rc;
2103
2104	spin_lock(&cifs_tcp_ses_lock);
2105	spin_lock(&ses->ses_lock);
2106	cifs_dbg(FYI, "%s: id=0x%llx ses_count=%d ses_status=%u ipc=%s\n",
2107		 __func__, ses->Suid, ses->ses_count, ses->ses_status,
2108		 ses->tcon_ipc ? ses->tcon_ipc->tree_name : "none");
2109	if (ses->ses_status == SES_EXITING || --ses->ses_count > 0) {
2110		spin_unlock(&ses->ses_lock);
2111		spin_unlock(&cifs_tcp_ses_lock);
2112		return;
2113	}
2114	/* ses_count can never go negative */
2115	WARN_ON(ses->ses_count < 0);
2116
2117	spin_lock(&ses->chan_lock);
2118	cifs_chan_clear_need_reconnect(ses, server);
2119	spin_unlock(&ses->chan_lock);
2120
2121	do_logoff = ses->ses_status == SES_GOOD && server->ops->logoff;
2122	ses->ses_status = SES_EXITING;
2123	tcon = ses->tcon_ipc;
2124	ses->tcon_ipc = NULL;
2125	spin_unlock(&ses->ses_lock);
2126	spin_unlock(&cifs_tcp_ses_lock);
2127
2128	/*
2129	 * On session close, the IPC is closed and the server must release all
2130	 * tcons of the session.  No need to send a tree disconnect here.
2131	 *
2132	 * Besides, it will make the server to not close durable and resilient
2133	 * files on session close, as specified in MS-SMB2 3.3.5.6 Receiving an
2134	 * SMB2 LOGOFF Request.
2135	 */
2136	tconInfoFree(tcon, netfs_trace_tcon_ref_free_ipc);
2137	if (do_logoff) {
2138		xid = get_xid();
2139		rc = server->ops->logoff(xid, ses);
2140		cifs_server_dbg(FYI, "%s: Session Logoff: rc=%d\n",
2141				__func__, rc);
2142		_free_xid(xid);
2143	}
2144
2145	spin_lock(&cifs_tcp_ses_lock);
2146	list_del_init(&ses->smb_ses_list);
2147	spin_unlock(&cifs_tcp_ses_lock);
2148
2149	/* close any extra channels */
2150	for (i = 1; i < ses->chan_count; i++) {
2151		if (ses->chans[i].iface) {
2152			kref_put(&ses->chans[i].iface->refcount, release_iface);
2153			ses->chans[i].iface = NULL;
2154		}
2155		cifs_put_tcp_session(ses->chans[i].server, 0);
2156		ses->chans[i].server = NULL;
2157	}
2158
2159	/* we now account for primary channel in iface->refcount */
2160	if (ses->chans[0].iface) {
2161		kref_put(&ses->chans[0].iface->refcount, release_iface);
2162		ses->chans[0].server = NULL;
2163	}
2164
2165	sesInfoFree(ses);
2166	cifs_put_tcp_session(server, 0);
2167}
2168
2169#ifdef CONFIG_KEYS
2170
2171/* strlen("cifs:a:") + CIFS_MAX_DOMAINNAME_LEN + 1 */
2172#define CIFSCREDS_DESC_SIZE (7 + CIFS_MAX_DOMAINNAME_LEN + 1)
2173
2174/* Populate username and pw fields from keyring if possible */
2175static int
2176cifs_set_cifscreds(struct smb3_fs_context *ctx, struct cifs_ses *ses)
2177{
2178	int rc = 0;
2179	int is_domain = 0;
2180	const char *delim, *payload;
2181	char *desc;
2182	ssize_t len;
2183	struct key *key;
2184	struct TCP_Server_Info *server = ses->server;
2185	struct sockaddr_in *sa;
2186	struct sockaddr_in6 *sa6;
2187	const struct user_key_payload *upayload;
2188
2189	desc = kmalloc(CIFSCREDS_DESC_SIZE, GFP_KERNEL);
2190	if (!desc)
2191		return -ENOMEM;
2192
2193	/* try to find an address key first */
2194	switch (server->dstaddr.ss_family) {
2195	case AF_INET:
2196		sa = (struct sockaddr_in *)&server->dstaddr;
2197		sprintf(desc, "cifs:a:%pI4", &sa->sin_addr.s_addr);
2198		break;
2199	case AF_INET6:
2200		sa6 = (struct sockaddr_in6 *)&server->dstaddr;
2201		sprintf(desc, "cifs:a:%pI6c", &sa6->sin6_addr.s6_addr);
2202		break;
2203	default:
2204		cifs_dbg(FYI, "Bad ss_family (%hu)\n",
2205			 server->dstaddr.ss_family);
2206		rc = -EINVAL;
2207		goto out_err;
2208	}
2209
2210	cifs_dbg(FYI, "%s: desc=%s\n", __func__, desc);
2211	key = request_key(&key_type_logon, desc, "");
2212	if (IS_ERR(key)) {
2213		if (!ses->domainName) {
2214			cifs_dbg(FYI, "domainName is NULL\n");
2215			rc = PTR_ERR(key);
2216			goto out_err;
2217		}
2218
2219		/* didn't work, try to find a domain key */
2220		sprintf(desc, "cifs:d:%s", ses->domainName);
2221		cifs_dbg(FYI, "%s: desc=%s\n", __func__, desc);
2222		key = request_key(&key_type_logon, desc, "");
2223		if (IS_ERR(key)) {
2224			rc = PTR_ERR(key);
2225			goto out_err;
2226		}
2227		is_domain = 1;
2228	}
2229
2230	down_read(&key->sem);
2231	upayload = user_key_payload_locked(key);
2232	if (IS_ERR_OR_NULL(upayload)) {
2233		rc = upayload ? PTR_ERR(upayload) : -EINVAL;
2234		goto out_key_put;
2235	}
2236
2237	/* find first : in payload */
2238	payload = upayload->data;
2239	delim = strnchr(payload, upayload->datalen, ':');
2240	if (!delim) {
2241		cifs_dbg(FYI, "Unable to find ':' in payload (datalen=%d)\n",
2242			 upayload->datalen);
2243		rc = -EINVAL;
2244		goto out_key_put;
2245	}
2246
2247	len = delim - payload;
2248	if (len > CIFS_MAX_USERNAME_LEN || len <= 0) {
2249		cifs_dbg(FYI, "Bad value from username search (len=%zd)\n",
2250			 len);
2251		rc = -EINVAL;
2252		goto out_key_put;
2253	}
2254
2255	ctx->username = kstrndup(payload, len, GFP_KERNEL);
2256	if (!ctx->username) {
2257		cifs_dbg(FYI, "Unable to allocate %zd bytes for username\n",
2258			 len);
2259		rc = -ENOMEM;
2260		goto out_key_put;
2261	}
2262	cifs_dbg(FYI, "%s: username=%s\n", __func__, ctx->username);
2263
2264	len = key->datalen - (len + 1);
2265	if (len > CIFS_MAX_PASSWORD_LEN || len <= 0) {
2266		cifs_dbg(FYI, "Bad len for password search (len=%zd)\n", len);
2267		rc = -EINVAL;
2268		kfree(ctx->username);
2269		ctx->username = NULL;
2270		goto out_key_put;
2271	}
2272
2273	++delim;
2274	/* BB consider adding support for password2 (Key Rotation) for multiuser in future */
2275	ctx->password = kstrndup(delim, len, GFP_KERNEL);
2276	if (!ctx->password) {
2277		cifs_dbg(FYI, "Unable to allocate %zd bytes for password\n",
2278			 len);
2279		rc = -ENOMEM;
2280		kfree(ctx->username);
2281		ctx->username = NULL;
2282		goto out_key_put;
2283	}
2284
2285	/*
2286	 * If we have a domain key then we must set the domainName in the
2287	 * for the request.
2288	 */
2289	if (is_domain && ses->domainName) {
2290		ctx->domainname = kstrdup(ses->domainName, GFP_KERNEL);
2291		if (!ctx->domainname) {
2292			cifs_dbg(FYI, "Unable to allocate %zd bytes for domain\n",
2293				 len);
2294			rc = -ENOMEM;
2295			kfree(ctx->username);
2296			ctx->username = NULL;
2297			kfree_sensitive(ctx->password);
2298			/* no need to free ctx->password2 since not allocated in this path */
2299			ctx->password = NULL;
2300			goto out_key_put;
2301		}
2302	}
2303
2304	strscpy(ctx->workstation_name, ses->workstation_name, sizeof(ctx->workstation_name));
2305
2306out_key_put:
2307	up_read(&key->sem);
2308	key_put(key);
2309out_err:
2310	kfree(desc);
2311	cifs_dbg(FYI, "%s: returning %d\n", __func__, rc);
2312	return rc;
2313}
2314#else /* ! CONFIG_KEYS */
2315static inline int
2316cifs_set_cifscreds(struct smb3_fs_context *ctx __maybe_unused,
2317		   struct cifs_ses *ses __maybe_unused)
2318{
2319	return -ENOSYS;
2320}
2321#endif /* CONFIG_KEYS */
2322
2323/**
2324 * cifs_get_smb_ses - get a session matching @ctx data from @server
2325 * @server: server to setup the session to
2326 * @ctx: superblock configuration context to use to setup the session
2327 *
2328 * This function assumes it is being called from cifs_mount() where we
2329 * already got a server reference (server refcount +1). See
2330 * cifs_get_tcon() for refcount explanations.
2331 */
2332struct cifs_ses *
2333cifs_get_smb_ses(struct TCP_Server_Info *server, struct smb3_fs_context *ctx)
2334{
2335	struct sockaddr_in6 *addr6 = (struct sockaddr_in6 *)&server->dstaddr;
2336	struct sockaddr_in *addr = (struct sockaddr_in *)&server->dstaddr;
2337	struct cifs_tcon *ipc;
2338	struct cifs_ses *ses;
2339	unsigned int xid;
2340	int retries = 0;
2341	size_t len;
2342	int rc = 0;
2343
2344	xid = get_xid();
2345
2346	ses = cifs_find_smb_ses(server, ctx);
2347	if (ses) {
2348		cifs_dbg(FYI, "Existing smb sess found (status=%d)\n",
2349			 ses->ses_status);
2350
2351		spin_lock(&ses->chan_lock);
2352		if (cifs_chan_needs_reconnect(ses, server)) {
2353			spin_unlock(&ses->chan_lock);
2354			cifs_dbg(FYI, "Session needs reconnect\n");
2355
2356			mutex_lock(&ses->session_mutex);
2357
2358retry_old_session:
2359			rc = cifs_negotiate_protocol(xid, ses, server);
2360			if (rc) {
2361				mutex_unlock(&ses->session_mutex);
2362				/* problem -- put our ses reference */
2363				cifs_put_smb_ses(ses);
2364				free_xid(xid);
2365				return ERR_PTR(rc);
2366			}
2367
2368			rc = cifs_setup_session(xid, ses, server,
2369						ctx->local_nls);
2370			if (rc) {
2371				if (((rc == -EACCES) || (rc == -EKEYEXPIRED) ||
2372					(rc == -EKEYREVOKED)) && !retries && ses->password2) {
2373					retries++;
2374					cifs_dbg(FYI, "Session reconnect failed, retrying with alternate password\n");
2375					swap(ses->password, ses->password2);
2376					goto retry_old_session;
2377				}
2378				mutex_unlock(&ses->session_mutex);
2379				/* problem -- put our reference */
2380				cifs_put_smb_ses(ses);
2381				free_xid(xid);
2382				return ERR_PTR(rc);
2383			}
2384			mutex_unlock(&ses->session_mutex);
2385
2386			spin_lock(&ses->chan_lock);
2387		}
2388		spin_unlock(&ses->chan_lock);
2389
2390		/* existing SMB ses has a server reference already */
2391		cifs_put_tcp_session(server, 0);
2392		free_xid(xid);
2393		return ses;
2394	}
2395
2396	rc = -ENOMEM;
2397
2398	cifs_dbg(FYI, "Existing smb sess not found\n");
2399	ses = sesInfoAlloc();
2400	if (ses == NULL)
2401		goto get_ses_fail;
2402
2403	/* new SMB session uses our server ref */
2404	ses->server = server;
2405	if (server->dstaddr.ss_family == AF_INET6)
2406		sprintf(ses->ip_addr, "%pI6", &addr6->sin6_addr);
2407	else
2408		sprintf(ses->ip_addr, "%pI4", &addr->sin_addr);
2409
2410	if (ctx->username) {
2411		ses->user_name = kstrdup(ctx->username, GFP_KERNEL);
2412		if (!ses->user_name)
2413			goto get_ses_fail;
2414	}
2415
2416	/* ctx->password freed at unmount */
2417	if (ctx->password) {
2418		ses->password = kstrdup(ctx->password, GFP_KERNEL);
2419		if (!ses->password)
2420			goto get_ses_fail;
2421	}
2422	/* ctx->password freed at unmount */
2423	if (ctx->password2) {
2424		ses->password2 = kstrdup(ctx->password2, GFP_KERNEL);
2425		if (!ses->password2)
2426			goto get_ses_fail;
2427	}
2428	if (ctx->domainname) {
2429		ses->domainName = kstrdup(ctx->domainname, GFP_KERNEL);
2430		if (!ses->domainName)
2431			goto get_ses_fail;
2432
2433		len = strnlen(ctx->domainname, CIFS_MAX_DOMAINNAME_LEN);
2434		if (!cifs_netbios_name(ctx->domainname, len)) {
2435			ses->dns_dom = kstrndup(ctx->domainname,
2436						len, GFP_KERNEL);
2437			if (!ses->dns_dom)
2438				goto get_ses_fail;
2439		}
2440	}
2441
2442	strscpy(ses->workstation_name, ctx->workstation_name, sizeof(ses->workstation_name));
2443
2444	if (ctx->domainauto)
2445		ses->domainAuto = ctx->domainauto;
2446	ses->cred_uid = ctx->cred_uid;
2447	ses->linux_uid = ctx->linux_uid;
2448
2449	ses->unicode = ctx->unicode;
2450	ses->sectype = ctx->sectype;
2451	ses->sign = ctx->sign;
2452
2453	/*
2454	 *Explicitly marking upcall_target mount option for easier handling
2455	 * by cifs_spnego.c and eventually cifs.upcall.c
2456	 */
2457
2458	switch (ctx->upcall_target) {
2459	case UPTARGET_UNSPECIFIED: /* default to app */
2460	case UPTARGET_APP:
2461		ses->upcall_target = UPTARGET_APP;
2462		break;
2463	case UPTARGET_MOUNT:
2464		ses->upcall_target = UPTARGET_MOUNT;
2465		break;
2466	default:
2467		// should never happen
2468		ses->upcall_target = UPTARGET_APP;
2469		break;
2470	}
2471
2472	ses->local_nls = load_nls(ctx->local_nls->charset);
2473
2474	/* add server as first channel */
2475	spin_lock(&ses->chan_lock);
2476	ses->chans[0].server = server;
2477	ses->chan_count = 1;
2478	ses->chan_max = ctx->multichannel ? ctx->max_channels:1;
2479	ses->chans_need_reconnect = 1;
2480	spin_unlock(&ses->chan_lock);
2481
2482retry_new_session:
2483	mutex_lock(&ses->session_mutex);
2484	rc = cifs_negotiate_protocol(xid, ses, server);
2485	if (!rc)
2486		rc = cifs_setup_session(xid, ses, server, ctx->local_nls);
2487	mutex_unlock(&ses->session_mutex);
2488
2489	/* each channel uses a different signing key */
2490	spin_lock(&ses->chan_lock);
2491	memcpy(ses->chans[0].signkey, ses->smb3signingkey,
2492	       sizeof(ses->smb3signingkey));
2493	spin_unlock(&ses->chan_lock);
2494
2495	if (rc) {
2496		if (((rc == -EACCES) || (rc == -EKEYEXPIRED) ||
2497			(rc == -EKEYREVOKED)) && !retries && ses->password2) {
2498			retries++;
2499			cifs_dbg(FYI, "Session setup failed, retrying with alternate password\n");
2500			swap(ses->password, ses->password2);
2501			goto retry_new_session;
2502		} else
2503			goto get_ses_fail;
2504	}
2505
2506	/*
2507	 * success, put it on the list and add it as first channel
2508	 * note: the session becomes active soon after this. So you'll
2509	 * need to lock before changing something in the session.
2510	 */
2511	spin_lock(&cifs_tcp_ses_lock);
2512	ses->dfs_root_ses = ctx->dfs_root_ses;
2513	list_add(&ses->smb_ses_list, &server->smb_ses_list);
2514	spin_unlock(&cifs_tcp_ses_lock);
2515
2516	ipc = cifs_setup_ipc(ses, ctx->seal);
2517	spin_lock(&cifs_tcp_ses_lock);
2518	spin_lock(&ses->ses_lock);
2519	ses->tcon_ipc = !IS_ERR(ipc) ? ipc : NULL;
2520	spin_unlock(&ses->ses_lock);
2521	spin_unlock(&cifs_tcp_ses_lock);
2522
2523	free_xid(xid);
2524
2525	return ses;
2526
2527get_ses_fail:
2528	sesInfoFree(ses);
2529	free_xid(xid);
2530	return ERR_PTR(rc);
2531}
2532
2533/* this function must be called with tc_lock held */
2534static int match_tcon(struct cifs_tcon *tcon, struct smb3_fs_context *ctx)
2535{
2536	struct TCP_Server_Info *server = tcon->ses->server;
2537
2538	if (tcon->status == TID_EXITING)
2539		return 0;
2540
2541	if (tcon->origin_fullpath) {
2542		if (!ctx->source ||
2543		    !dfs_src_pathname_equal(ctx->source,
2544					    tcon->origin_fullpath))
2545			return 0;
2546	} else if (!server->leaf_fullpath &&
2547		   strncmp(tcon->tree_name, ctx->UNC, MAX_TREE_SIZE)) {
2548		return 0;
2549	}
2550	if (tcon->seal != ctx->seal)
2551		return 0;
2552	if (tcon->snapshot_time != ctx->snapshot_time)
2553		return 0;
2554	if (tcon->handle_timeout != ctx->handle_timeout)
2555		return 0;
2556	if (tcon->no_lease != ctx->no_lease)
2557		return 0;
2558	if (tcon->nodelete != ctx->nodelete)
2559		return 0;
2560	if (tcon->posix_extensions != ctx->linux_ext)
2561		return 0;
2562	return 1;
2563}
2564
2565static struct cifs_tcon *
2566cifs_find_tcon(struct cifs_ses *ses, struct smb3_fs_context *ctx)
2567{
2568	struct cifs_tcon *tcon;
2569
2570	spin_lock(&cifs_tcp_ses_lock);
2571	list_for_each_entry(tcon, &ses->tcon_list, tcon_list) {
2572		spin_lock(&tcon->tc_lock);
2573		if (!match_tcon(tcon, ctx)) {
2574			spin_unlock(&tcon->tc_lock);
2575			continue;
2576		}
2577		++tcon->tc_count;
2578		trace_smb3_tcon_ref(tcon->debug_id, tcon->tc_count,
2579				    netfs_trace_tcon_ref_get_find);
2580		spin_unlock(&tcon->tc_lock);
2581		spin_unlock(&cifs_tcp_ses_lock);
2582		return tcon;
2583	}
2584	spin_unlock(&cifs_tcp_ses_lock);
2585	return NULL;
2586}
2587
2588void
2589cifs_put_tcon(struct cifs_tcon *tcon, enum smb3_tcon_ref_trace trace)
2590{
2591	unsigned int xid;
2592	struct cifs_ses *ses;
2593	LIST_HEAD(ses_list);
2594
2595	/*
2596	 * IPC tcon share the lifetime of their session and are
2597	 * destroyed in the session put function
2598	 */
2599	if (tcon == NULL || tcon->ipc)
2600		return;
2601
2602	ses = tcon->ses;
2603	cifs_dbg(FYI, "%s: tc_count=%d\n", __func__, tcon->tc_count);
2604	spin_lock(&cifs_tcp_ses_lock);
2605	spin_lock(&tcon->tc_lock);
2606	trace_smb3_tcon_ref(tcon->debug_id, tcon->tc_count - 1, trace);
2607	if (--tcon->tc_count > 0) {
2608		spin_unlock(&tcon->tc_lock);
2609		spin_unlock(&cifs_tcp_ses_lock);
2610		return;
2611	}
2612
2613	/* tc_count can never go negative */
2614	WARN_ON(tcon->tc_count < 0);
2615
2616	list_del_init(&tcon->tcon_list);
2617	tcon->status = TID_EXITING;
2618	spin_unlock(&tcon->tc_lock);
2619	spin_unlock(&cifs_tcp_ses_lock);
2620
2621	/* cancel polling of interfaces */
2622	cancel_delayed_work_sync(&tcon->query_interfaces);
2623#ifdef CONFIG_CIFS_DFS_UPCALL
2624	cancel_delayed_work_sync(&tcon->dfs_cache_work);
2625	list_replace_init(&tcon->dfs_ses_list, &ses_list);
2626#endif
2627
2628	if (tcon->use_witness) {
2629		int rc;
2630
2631		rc = cifs_swn_unregister(tcon);
2632		if (rc < 0) {
2633			cifs_dbg(VFS, "%s: Failed to unregister for witness notifications: %d\n",
2634					__func__, rc);
2635		}
2636	}
2637
2638	xid = get_xid();
2639	if (ses->server->ops->tree_disconnect)
2640		ses->server->ops->tree_disconnect(xid, tcon);
2641	_free_xid(xid);
2642
2643	cifs_fscache_release_super_cookie(tcon);
2644	tconInfoFree(tcon, netfs_trace_tcon_ref_free);
2645	cifs_put_smb_ses(ses);
2646#ifdef CONFIG_CIFS_DFS_UPCALL
2647	dfs_put_root_smb_sessions(&ses_list);
2648#endif
2649}
2650
2651/**
2652 * cifs_get_tcon - get a tcon matching @ctx data from @ses
2653 * @ses: smb session to issue the request on
2654 * @ctx: the superblock configuration context to use for building the
2655 *
2656 * - tcon refcount is the number of mount points using the tcon.
2657 * - ses refcount is the number of tcon using the session.
2658 *
2659 * 1. This function assumes it is being called from cifs_mount() where
2660 *    we already got a session reference (ses refcount +1).
2661 *
2662 * 2. Since we're in the context of adding a mount point, the end
2663 *    result should be either:
2664 *
2665 * a) a new tcon already allocated with refcount=1 (1 mount point) and
2666 *    its session refcount incremented (1 new tcon). This +1 was
2667 *    already done in (1).
2668 *
2669 * b) an existing tcon with refcount+1 (add a mount point to it) and
2670 *    identical ses refcount (no new tcon). Because of (1) we need to
2671 *    decrement the ses refcount.
2672 */
2673static struct cifs_tcon *
2674cifs_get_tcon(struct cifs_ses *ses, struct smb3_fs_context *ctx)
2675{
2676	struct cifs_tcon *tcon;
2677	bool nohandlecache;
2678	int rc, xid;
2679
2680	tcon = cifs_find_tcon(ses, ctx);
2681	if (tcon) {
2682		/*
2683		 * tcon has refcount already incremented but we need to
2684		 * decrement extra ses reference gotten by caller (case b)
2685		 */
2686		cifs_dbg(FYI, "Found match on UNC path\n");
2687		cifs_put_smb_ses(ses);
2688		return tcon;
2689	}
2690
2691	if (!ses->server->ops->tree_connect) {
2692		rc = -ENOSYS;
2693		goto out_fail;
2694	}
2695
2696	if (ses->server->dialect >= SMB20_PROT_ID &&
2697	    (ses->server->capabilities & SMB2_GLOBAL_CAP_DIRECTORY_LEASING))
2698		nohandlecache = ctx->nohandlecache || !dir_cache_timeout;
2699	else
2700		nohandlecache = true;
2701	tcon = tcon_info_alloc(!nohandlecache, netfs_trace_tcon_ref_new);
2702	if (tcon == NULL) {
2703		rc = -ENOMEM;
2704		goto out_fail;
2705	}
2706	tcon->nohandlecache = nohandlecache;
2707
2708	if (ctx->snapshot_time) {
2709		if (ses->server->vals->protocol_id == 0) {
2710			cifs_dbg(VFS,
2711			     "Use SMB2 or later for snapshot mount option\n");
2712			rc = -EOPNOTSUPP;
2713			goto out_fail;
2714		} else
2715			tcon->snapshot_time = ctx->snapshot_time;
2716	}
2717
2718	if (ctx->handle_timeout) {
2719		if (ses->server->vals->protocol_id == 0) {
2720			cifs_dbg(VFS,
2721			     "Use SMB2.1 or later for handle timeout option\n");
2722			rc = -EOPNOTSUPP;
2723			goto out_fail;
2724		} else
2725			tcon->handle_timeout = ctx->handle_timeout;
2726	}
2727
2728	tcon->ses = ses;
2729	if (ctx->password) {
2730		tcon->password = kstrdup(ctx->password, GFP_KERNEL);
2731		if (!tcon->password) {
2732			rc = -ENOMEM;
2733			goto out_fail;
2734		}
2735	}
2736
2737	if (ctx->seal) {
2738		if (ses->server->vals->protocol_id == 0) {
2739			cifs_dbg(VFS,
2740				 "SMB3 or later required for encryption\n");
2741			rc = -EOPNOTSUPP;
2742			goto out_fail;
2743		} else if (tcon->ses->server->capabilities &
2744					SMB2_GLOBAL_CAP_ENCRYPTION)
2745			tcon->seal = true;
2746		else {
2747			cifs_dbg(VFS, "Encryption is not supported on share\n");
2748			rc = -EOPNOTSUPP;
2749			goto out_fail;
2750		}
2751	}
2752
2753	if (ctx->linux_ext) {
2754		if (ses->server->posix_ext_supported) {
2755			tcon->posix_extensions = true;
2756			pr_warn_once("SMB3.11 POSIX Extensions are experimental\n");
2757		} else if ((ses->server->vals->protocol_id == SMB311_PROT_ID) ||
2758		    (strcmp(ses->server->vals->version_string,
2759		     SMB3ANY_VERSION_STRING) == 0) ||
2760		    (strcmp(ses->server->vals->version_string,
2761		     SMBDEFAULT_VERSION_STRING) == 0)) {
2762			cifs_dbg(VFS, "Server does not support mounting with posix SMB3.11 extensions\n");
2763			rc = -EOPNOTSUPP;
2764			goto out_fail;
2765		} else if (ses->server->vals->protocol_id == SMB10_PROT_ID)
2766			if (cap_unix(ses))
2767				cifs_dbg(FYI, "Unix Extensions requested on SMB1 mount\n");
2768			else {
2769				cifs_dbg(VFS, "SMB1 Unix Extensions not supported by server\n");
2770				rc = -EOPNOTSUPP;
2771				goto out_fail;
2772		} else {
2773			cifs_dbg(VFS,
2774				"Check vers= mount option. SMB3.11 disabled but required for POSIX extensions\n");
2775			rc = -EOPNOTSUPP;
2776			goto out_fail;
2777		}
2778	}
2779
2780	xid = get_xid();
2781	rc = ses->server->ops->tree_connect(xid, ses, ctx->UNC, tcon,
2782					    ctx->local_nls);
2783	free_xid(xid);
2784	cifs_dbg(FYI, "Tcon rc = %d\n", rc);
2785	if (rc)
2786		goto out_fail;
2787
2788	tcon->use_persistent = false;
2789	/* check if SMB2 or later, CIFS does not support persistent handles */
2790	if (ctx->persistent) {
2791		if (ses->server->vals->protocol_id == 0) {
2792			cifs_dbg(VFS,
2793			     "SMB3 or later required for persistent handles\n");
2794			rc = -EOPNOTSUPP;
2795			goto out_fail;
2796		} else if (ses->server->capabilities &
2797			   SMB2_GLOBAL_CAP_PERSISTENT_HANDLES)
2798			tcon->use_persistent = true;
2799		else /* persistent handles requested but not supported */ {
2800			cifs_dbg(VFS,
2801				"Persistent handles not supported on share\n");
2802			rc = -EOPNOTSUPP;
2803			goto out_fail;
2804		}
2805	} else if ((tcon->capabilities & SMB2_SHARE_CAP_CONTINUOUS_AVAILABILITY)
2806	     && (ses->server->capabilities & SMB2_GLOBAL_CAP_PERSISTENT_HANDLES)
2807	     && (ctx->nopersistent == false)) {
2808		cifs_dbg(FYI, "enabling persistent handles\n");
2809		tcon->use_persistent = true;
2810	} else if (ctx->resilient) {
2811		if (ses->server->vals->protocol_id == 0) {
2812			cifs_dbg(VFS,
2813			     "SMB2.1 or later required for resilient handles\n");
2814			rc = -EOPNOTSUPP;
2815			goto out_fail;
2816		}
2817		tcon->use_resilient = true;
2818	}
2819
2820	tcon->use_witness = false;
2821	if (IS_ENABLED(CONFIG_CIFS_SWN_UPCALL) && ctx->witness) {
2822		if (ses->server->vals->protocol_id >= SMB30_PROT_ID) {
2823			if (tcon->capabilities & SMB2_SHARE_CAP_CLUSTER) {
2824				/*
2825				 * Set witness in use flag in first place
2826				 * to retry registration in the echo task
2827				 */
2828				tcon->use_witness = true;
2829				/* And try to register immediately */
2830				rc = cifs_swn_register(tcon);
2831				if (rc < 0) {
2832					cifs_dbg(VFS, "Failed to register for witness notifications: %d\n", rc);
2833					goto out_fail;
2834				}
2835			} else {
2836				/* TODO: try to extend for non-cluster uses (eg multichannel) */
2837				cifs_dbg(VFS, "witness requested on mount but no CLUSTER capability on share\n");
2838				rc = -EOPNOTSUPP;
2839				goto out_fail;
2840			}
2841		} else {
2842			cifs_dbg(VFS, "SMB3 or later required for witness option\n");
2843			rc = -EOPNOTSUPP;
2844			goto out_fail;
2845		}
2846	}
2847
2848	/* If the user really knows what they are doing they can override */
2849	if (tcon->share_flags & SMB2_SHAREFLAG_NO_CACHING) {
2850		if (ctx->cache_ro)
2851			cifs_dbg(VFS, "cache=ro requested on mount but NO_CACHING flag set on share\n");
2852		else if (ctx->cache_rw)
2853			cifs_dbg(VFS, "cache=singleclient requested on mount but NO_CACHING flag set on share\n");
2854	}
2855
2856	if (ctx->no_lease) {
2857		if (ses->server->vals->protocol_id == 0) {
2858			cifs_dbg(VFS,
2859				"SMB2 or later required for nolease option\n");
2860			rc = -EOPNOTSUPP;
2861			goto out_fail;
2862		} else
2863			tcon->no_lease = ctx->no_lease;
2864	}
2865
2866	/*
2867	 * We can have only one retry value for a connection to a share so for
2868	 * resources mounted more than once to the same server share the last
2869	 * value passed in for the retry flag is used.
2870	 */
2871	tcon->retry = ctx->retry;
2872	tcon->nocase = ctx->nocase;
2873	tcon->broken_sparse_sup = ctx->no_sparse;
2874	tcon->max_cached_dirs = ctx->max_cached_dirs;
2875	tcon->nodelete = ctx->nodelete;
2876	tcon->local_lease = ctx->local_lease;
2877	tcon->status = TID_GOOD;
2878
2879	if (ses->server->dialect >= SMB30_PROT_ID &&
2880	    (ses->server->capabilities & SMB2_GLOBAL_CAP_MULTI_CHANNEL)) {
2881		/* schedule query interfaces poll */
2882		queue_delayed_work(cifsiod_wq, &tcon->query_interfaces,
2883				   (SMB_INTERFACE_POLL_INTERVAL * HZ));
2884	}
2885	spin_lock(&cifs_tcp_ses_lock);
2886	list_add(&tcon->tcon_list, &ses->tcon_list);
2887	spin_unlock(&cifs_tcp_ses_lock);
2888
2889	return tcon;
2890
2891out_fail:
2892	tconInfoFree(tcon, netfs_trace_tcon_ref_free_fail);
2893	return ERR_PTR(rc);
2894}
2895
2896void
2897cifs_put_tlink(struct tcon_link *tlink)
2898{
2899	if (!tlink || IS_ERR(tlink))
2900		return;
2901
2902	if (!atomic_dec_and_test(&tlink->tl_count) ||
2903	    test_bit(TCON_LINK_IN_TREE, &tlink->tl_flags)) {
2904		tlink->tl_time = jiffies;
2905		return;
2906	}
2907
2908	if (!IS_ERR(tlink_tcon(tlink)))
2909		cifs_put_tcon(tlink_tcon(tlink), netfs_trace_tcon_ref_put_tlink);
2910	kfree(tlink);
2911}
2912
2913static int
2914compare_mount_options(struct super_block *sb, struct cifs_mnt_data *mnt_data)
2915{
2916	struct cifs_sb_info *old = CIFS_SB(sb);
2917	struct cifs_sb_info *new = mnt_data->cifs_sb;
2918	unsigned int oldflags = old->mnt_cifs_flags & CIFS_MOUNT_MASK;
2919	unsigned int newflags = new->mnt_cifs_flags & CIFS_MOUNT_MASK;
2920
2921	if ((sb->s_flags & CIFS_MS_MASK) != (mnt_data->flags & CIFS_MS_MASK))
2922		return 0;
2923
2924	if (old->mnt_cifs_serverino_autodisabled)
2925		newflags &= ~CIFS_MOUNT_SERVER_INUM;
2926
2927	if (oldflags != newflags)
2928		return 0;
2929
2930	/*
2931	 * We want to share sb only if we don't specify an r/wsize or
2932	 * specified r/wsize is greater than or equal to existing one.
2933	 */
2934	if (new->ctx->wsize && new->ctx->wsize < old->ctx->wsize)
2935		return 0;
2936
2937	if (new->ctx->rsize && new->ctx->rsize < old->ctx->rsize)
2938		return 0;
2939
2940	if (!uid_eq(old->ctx->linux_uid, new->ctx->linux_uid) ||
2941	    !gid_eq(old->ctx->linux_gid, new->ctx->linux_gid))
2942		return 0;
2943
2944	if (old->ctx->file_mode != new->ctx->file_mode ||
2945	    old->ctx->dir_mode != new->ctx->dir_mode)
2946		return 0;
2947
2948	if (strcmp(old->local_nls->charset, new->local_nls->charset))
2949		return 0;
2950
2951	if (old->ctx->acregmax != new->ctx->acregmax)
2952		return 0;
2953	if (old->ctx->acdirmax != new->ctx->acdirmax)
2954		return 0;
2955	if (old->ctx->closetimeo != new->ctx->closetimeo)
2956		return 0;
2957	if (old->ctx->reparse_type != new->ctx->reparse_type)
2958		return 0;
2959	if (old->ctx->nonativesocket != new->ctx->nonativesocket)
2960		return 0;
2961	if (old->ctx->symlink_type != new->ctx->symlink_type)
2962		return 0;
2963
2964	return 1;
2965}
2966
2967static int match_prepath(struct super_block *sb,
2968			 struct cifs_tcon *tcon,
2969			 struct cifs_mnt_data *mnt_data)
2970{
2971	struct smb3_fs_context *ctx = mnt_data->ctx;
2972	struct cifs_sb_info *old = CIFS_SB(sb);
2973	struct cifs_sb_info *new = mnt_data->cifs_sb;
2974	bool old_set = (old->mnt_cifs_flags & CIFS_MOUNT_USE_PREFIX_PATH) &&
2975		old->prepath;
2976	bool new_set = (new->mnt_cifs_flags & CIFS_MOUNT_USE_PREFIX_PATH) &&
2977		new->prepath;
2978
2979	if (tcon->origin_fullpath &&
2980	    dfs_src_pathname_equal(tcon->origin_fullpath, ctx->source))
2981		return 1;
2982
2983	if (old_set && new_set && !strcmp(new->prepath, old->prepath))
2984		return 1;
2985	else if (!old_set && !new_set)
2986		return 1;
2987
2988	return 0;
2989}
2990
2991int
2992cifs_match_super(struct super_block *sb, void *data)
2993{
2994	struct cifs_mnt_data *mnt_data = data;
2995	struct smb3_fs_context *ctx;
2996	struct cifs_sb_info *cifs_sb;
2997	struct TCP_Server_Info *tcp_srv;
2998	struct cifs_ses *ses;
2999	struct cifs_tcon *tcon;
3000	struct tcon_link *tlink;
3001	int rc = 0;
3002
3003	spin_lock(&cifs_tcp_ses_lock);
3004	cifs_sb = CIFS_SB(sb);
3005
3006	/* We do not want to use a superblock that has been shutdown */
3007	if (CIFS_MOUNT_SHUTDOWN & cifs_sb->mnt_cifs_flags) {
3008		spin_unlock(&cifs_tcp_ses_lock);
3009		return 0;
3010	}
3011
3012	tlink = cifs_get_tlink(cifs_sb_master_tlink(cifs_sb));
3013	if (IS_ERR_OR_NULL(tlink)) {
3014		pr_warn_once("%s: skip super matching due to bad tlink(%p)\n",
3015			     __func__, tlink);
3016		spin_unlock(&cifs_tcp_ses_lock);
3017		return 0;
3018	}
3019	tcon = tlink_tcon(tlink);
3020	ses = tcon->ses;
3021	tcp_srv = ses->server;
3022
3023	ctx = mnt_data->ctx;
3024
3025	spin_lock(&tcp_srv->srv_lock);
3026	spin_lock(&ses->ses_lock);
3027	spin_lock(&ses->chan_lock);
3028	spin_lock(&tcon->tc_lock);
3029	if (!match_server(tcp_srv, ctx, true) ||
3030	    !match_session(ses, ctx, true) ||
3031	    !match_tcon(tcon, ctx) ||
3032	    !match_prepath(sb, tcon, mnt_data)) {
3033		rc = 0;
3034		goto out;
3035	}
3036
3037	rc = compare_mount_options(sb, mnt_data);
3038out:
3039	spin_unlock(&tcon->tc_lock);
3040	spin_unlock(&ses->chan_lock);
3041	spin_unlock(&ses->ses_lock);
3042	spin_unlock(&tcp_srv->srv_lock);
3043
3044	spin_unlock(&cifs_tcp_ses_lock);
3045	cifs_put_tlink(tlink);
3046	return rc;
3047}
3048
3049#ifdef CONFIG_DEBUG_LOCK_ALLOC
3050static struct lock_class_key cifs_key[2];
3051static struct lock_class_key cifs_slock_key[2];
3052
3053static inline void
3054cifs_reclassify_socket4(struct socket *sock)
3055{
3056	struct sock *sk = sock->sk;
3057
3058	BUG_ON(!sock_allow_reclassification(sk));
3059	sock_lock_init_class_and_name(sk, "slock-AF_INET-CIFS",
3060		&cifs_slock_key[0], "sk_lock-AF_INET-CIFS", &cifs_key[0]);
3061}
3062
3063static inline void
3064cifs_reclassify_socket6(struct socket *sock)
3065{
3066	struct sock *sk = sock->sk;
3067
3068	BUG_ON(!sock_allow_reclassification(sk));
3069	sock_lock_init_class_and_name(sk, "slock-AF_INET6-CIFS",
3070		&cifs_slock_key[1], "sk_lock-AF_INET6-CIFS", &cifs_key[1]);
3071}
3072#else
3073static inline void
3074cifs_reclassify_socket4(struct socket *sock)
3075{
3076}
3077
3078static inline void
3079cifs_reclassify_socket6(struct socket *sock)
3080{
3081}
3082#endif
3083
3084/* See RFC1001 section 14 on representation of Netbios names */
3085static void rfc1002mangle(char *target, char *source, unsigned int length)
3086{
3087	unsigned int i, j;
3088
3089	for (i = 0, j = 0; i < (length); i++) {
3090		/* mask a nibble at a time and encode */
3091		target[j] = 'A' + (0x0F & (source[i] >> 4));
3092		target[j+1] = 'A' + (0x0F & source[i]);
3093		j += 2;
3094	}
3095
3096}
3097
3098static int
3099bind_socket(struct TCP_Server_Info *server)
3100{
3101	int rc = 0;
3102
3103	if (server->srcaddr.ss_family != AF_UNSPEC) {
3104		/* Bind to the specified local IP address */
3105		struct socket *socket = server->ssocket;
3106
3107		rc = kernel_bind(socket,
3108				 (struct sockaddr_unsized *) &server->srcaddr,
3109				 sizeof(server->srcaddr));
3110		if (rc < 0) {
3111			struct sockaddr_in *saddr4;
3112			struct sockaddr_in6 *saddr6;
3113
3114			saddr4 = (struct sockaddr_in *)&server->srcaddr;
3115			saddr6 = (struct sockaddr_in6 *)&server->srcaddr;
3116			if (saddr6->sin6_family == AF_INET6)
3117				cifs_server_dbg(VFS, "Failed to bind to: %pI6c, error: %d\n",
3118					 &saddr6->sin6_addr, rc);
3119			else
3120				cifs_server_dbg(VFS, "Failed to bind to: %pI4, error: %d\n",
3121					 &saddr4->sin_addr.s_addr, rc);
3122		}
3123	}
3124	return rc;
3125}
3126
3127static int
3128smb_recv_kvec(struct TCP_Server_Info *server, struct msghdr *msg, size_t *recv)
3129{
3130	int rc = 0;
3131	int retries = 0;
3132	int msg_flags = server->noblocksnd ? MSG_DONTWAIT : 0;
3133
3134	*recv = 0;
3135
3136	while (msg_data_left(msg)) {
3137		rc = sock_recvmsg(server->ssocket, msg, msg_flags);
3138		if (rc == -EAGAIN) {
3139			retries++;
3140			if (retries >= 14 ||
3141			    (!server->noblocksnd && (retries > 2))) {
3142				cifs_server_dbg(VFS, "sends on sock %p stuck for 15 seconds\n",
3143						server->ssocket);
3144				return -EAGAIN;
3145			}
3146			msleep(1 << retries);
3147			continue;
3148		}
3149
3150		if (rc < 0)
3151			return rc;
3152
3153		if (rc == 0) {
3154			cifs_dbg(FYI, "Received no data (TCP RST)\n");
3155			return -ECONNABORTED;
3156		}
3157
3158		/* recv was at least partially successful */
3159		*recv += rc;
3160		retries = 0; /* in case we get ENOSPC on the next send */
3161	}
3162	return 0;
3163}
3164
3165static int
3166ip_rfc1001_connect(struct TCP_Server_Info *server)
3167{
3168	int rc = 0;
3169	/*
3170	 * some servers require RFC1001 sessinit before sending
3171	 * negprot - BB check reconnection in case where second
3172	 * sessinit is sent but no second negprot
3173	 */
3174	struct rfc1002_session_packet req = {};
3175	struct rfc1002_session_packet resp = {};
3176	struct msghdr msg = {};
3177	struct kvec iov = {};
3178	unsigned int len;
3179	size_t sent;
3180	size_t recv;
3181
3182	req.trailer.session_req.called_len = sizeof(req.trailer.session_req.called_name);
3183
3184	if (server->server_RFC1001_name[0] != 0)
3185		rfc1002mangle(req.trailer.session_req.called_name,
3186			      server->server_RFC1001_name,
3187			      RFC1001_NAME_LEN_WITH_NULL);
3188	else
3189		rfc1002mangle(req.trailer.session_req.called_name,
3190			      DEFAULT_CIFS_CALLED_NAME,
3191			      RFC1001_NAME_LEN_WITH_NULL);
3192
3193	req.trailer.session_req.calling_len = sizeof(req.trailer.session_req.calling_name);
3194
3195	/* calling name ends in null (byte 16) from old smb convention */
3196	if (server->workstation_RFC1001_name[0] != 0)
3197		rfc1002mangle(req.trailer.session_req.calling_name,
3198			      server->workstation_RFC1001_name,
3199			      RFC1001_NAME_LEN_WITH_NULL);
3200	else
3201		rfc1002mangle(req.trailer.session_req.calling_name,
3202			      "LINUX_CIFS_CLNT",
3203			      RFC1001_NAME_LEN_WITH_NULL);
3204
3205	/*
3206	 * As per rfc1002, @len must be the number of bytes that follows the
3207	 * length field of a rfc1002 session request payload.
3208	 */
3209	len = sizeof(req.trailer.session_req);
3210	req.type = RFC1002_SESSION_REQUEST;
3211	req.flags = 0;
3212	req.length = cpu_to_be16(len);
3213	len += offsetof(typeof(req), trailer.session_req);
3214	iov.iov_base = &req;
3215	iov.iov_len = len;
3216	iov_iter_kvec(&msg.msg_iter, ITER_SOURCE, &iov, 1, len);
3217	rc = smb_send_kvec(server, &msg, &sent);
3218	if (rc < 0 || len != sent)
3219		return (rc == -EINTR || rc == -EAGAIN) ? rc : -ECONNABORTED;
3220
3221	/*
3222	 * RFC1001 layer in at least one server requires very short break before
3223	 * negprot presumably because not expecting negprot to follow so fast.
3224	 * For example DOS SMB servers cannot process negprot if it was received
3225	 * before the server sent response for SESSION_REQUEST packet. So, wait
3226	 * for the response, read it and parse it as it can contain useful error
3227	 * information (e.g. specified server name was incorrect). For example
3228	 * even the latest Windows Server 2022 SMB1 server over port 139 send
3229	 * error if its server name was in SESSION_REQUEST packet incorrect.
3230	 * Nowadays usage of port 139 is not common, so waiting for reply here
3231	 * does not slowing down mounting of common case (over port 445).
3232	 */
3233	len = offsetof(typeof(resp), trailer);
3234	iov.iov_base = &resp;
3235	iov.iov_len = len;
3236	iov_iter_kvec(&msg.msg_iter, ITER_DEST, &iov, 1, len);
3237	rc = smb_recv_kvec(server, &msg, &recv);
3238	if (rc < 0 || recv != len)
3239		return (rc == -EINTR || rc == -EAGAIN) ? rc : -ECONNABORTED;
3240
3241	switch (resp.type) {
3242	case RFC1002_POSITIVE_SESSION_RESPONSE:
3243		if (be16_to_cpu(resp.length) != 0) {
3244			cifs_dbg(VFS, "RFC 1002 positive session response but with invalid non-zero length %u\n",
3245				 be16_to_cpu(resp.length));
3246			return smb_EIO(smb_eio_trace_rx_pos_sess_resp);
3247		}
3248		cifs_dbg(FYI, "RFC 1002 positive session response");
3249		break;
3250	case RFC1002_NEGATIVE_SESSION_RESPONSE:
3251		/* Read RFC1002 response error code and convert it to errno in rc */
3252		len = sizeof(resp.trailer.neg_ses_resp_error_code);
3253		iov.iov_base = &resp.trailer.neg_ses_resp_error_code;
3254		iov.iov_len = len;
3255		iov_iter_kvec(&msg.msg_iter, ITER_DEST, &iov, 1, len);
3256		if (be16_to_cpu(resp.length) == len &&
3257		    smb_recv_kvec(server, &msg, &recv) == 0 &&
3258		    recv == len) {
3259			cifs_dbg(VFS, "RFC 1002 negative session response with error 0x%x\n",
3260				 resp.trailer.neg_ses_resp_error_code);
3261			switch (resp.trailer.neg_ses_resp_error_code) {
3262			case RFC1002_NOT_LISTENING_CALLED:
3263				/* server does not listen for specified server name */
3264				fallthrough;
3265			case RFC1002_NOT_PRESENT:
3266				/* server name is incorrect */
3267				rc = -ENOENT;
3268				cifs_dbg(VFS, "Server rejected NetBIOS servername %.15s\n",
3269					 server->server_RFC1001_name[0] ?
3270					 server->server_RFC1001_name :
3271					 DEFAULT_CIFS_CALLED_NAME);
3272				cifs_dbg(VFS, "Specify correct NetBIOS servername in source path or with -o servern= option\n");
3273				break;
3274			case RFC1002_NOT_LISTENING_CALLING:
3275				/* client name was not accepted by server */
3276				rc = -EACCES;
3277				cifs_dbg(VFS, "Server rejected NetBIOS clientname %.15s\n",
3278					 server->workstation_RFC1001_name[0] ?
3279					 server->workstation_RFC1001_name :
3280					 "LINUX_CIFS_CLNT");
3281				cifs_dbg(VFS, "Specify correct NetBIOS clientname with -o netbiosname= option\n");
3282				break;
3283			case RFC1002_INSUFFICIENT_RESOURCE:
3284				/* remote server resource error */
3285				smb_EIO(smb_eio_trace_rx_insuff_res);
3286				rc = -EREMOTEIO;
3287				break;
3288			case RFC1002_UNSPECIFIED_ERROR:
3289			default:
3290				/* other/unknown error */
3291				rc = smb_EIO(smb_eio_trace_rx_unspec_error);
3292				break;
3293			}
3294		} else {
3295			cifs_dbg(VFS, "RFC 1002 negative session response\n");
3296			rc = smb_EIO(smb_eio_trace_rx_neg_sess_resp);
3297		}
3298		return rc;
3299	case RFC1002_RETARGET_SESSION_RESPONSE:
3300		cifs_dbg(VFS, "RFC 1002 retarget session response\n");
3301		if (be16_to_cpu(resp.length) == sizeof(resp.trailer.retarget_resp)) {
3302			len = sizeof(resp.trailer.retarget_resp);
3303			iov.iov_base = &resp.trailer.retarget_resp;
3304			iov.iov_len = len;
3305			iov_iter_kvec(&msg.msg_iter, ITER_DEST, &iov, 1, len);
3306			if (smb_recv_kvec(server, &msg, &recv) == 0 && recv == len) {
3307				cifs_dbg(VFS, "Server wants to redirect connection\n");
3308				cifs_dbg(VFS, "Remount with options -o ip=%pI4,port=%u\n",
3309					 &resp.trailer.retarget_resp.retarget_ip_addr,
3310					 be16_to_cpu(resp.trailer.retarget_resp.port));
3311			}
3312		}
3313		cifs_dbg(VFS, "Closing connection\n");
3314		/* FIXME: Should we automatically redirect to new retarget_resp server? */
3315		return -EMULTIHOP;
3316	default:
3317		cifs_dbg(VFS, "RFC 1002 unknown response type 0x%x\n", resp.type);
3318		return smb_EIO1(smb_eio_trace_rx_unknown_resp, resp.type);
3319	}
3320
3321	server->with_rfc1001 = true;
3322	return 0;
3323}
3324
3325static int
3326generic_ip_connect(struct TCP_Server_Info *server)
3327{
3328	struct sockaddr *saddr;
3329	struct socket *socket;
3330	int slen, sfamily;
3331	__be16 sport;
3332	int rc = 0;
3333
3334	saddr = (struct sockaddr *) &server->dstaddr;
3335
3336	if (server->dstaddr.ss_family == AF_INET6) {
3337		struct sockaddr_in6 *ipv6 = (struct sockaddr_in6 *)&server->dstaddr;
3338
3339		sport = ipv6->sin6_port;
3340		slen = sizeof(struct sockaddr_in6);
3341		sfamily = AF_INET6;
3342		cifs_dbg(FYI, "%s: connecting to [%pI6]:%d\n", __func__, &ipv6->sin6_addr,
3343				ntohs(sport));
3344	} else {
3345		struct sockaddr_in *ipv4 = (struct sockaddr_in *)&server->dstaddr;
3346
3347		sport = ipv4->sin_port;
3348		slen = sizeof(struct sockaddr_in);
3349		sfamily = AF_INET;
3350		cifs_dbg(FYI, "%s: connecting to %pI4:%d\n", __func__, &ipv4->sin_addr,
3351				ntohs(sport));
3352	}
3353
3354	if (server->ssocket) {
3355		socket = server->ssocket;
3356	} else {
3357		struct net *net = cifs_net_ns(server);
3358		struct sock *sk;
3359
3360		rc = sock_create_kern(net, sfamily, SOCK_STREAM,
3361				      IPPROTO_TCP, &server->ssocket);
3362		if (rc < 0) {
3363			cifs_server_dbg(VFS, "Error %d creating socket\n", rc);
3364			return rc;
3365		}
3366
3367		sk = server->ssocket->sk;
3368		sk_net_refcnt_upgrade(sk);
3369
3370		/* BB other socket options to set KEEPALIVE, NODELAY? */
3371		cifs_dbg(FYI, "Socket created\n");
3372		socket = server->ssocket;
3373		socket->sk->sk_allocation = GFP_NOFS;
3374		socket->sk->sk_use_task_frag = false;
3375		if (sfamily == AF_INET6)
3376			cifs_reclassify_socket6(socket);
3377		else
3378			cifs_reclassify_socket4(socket);
3379	}
3380
3381	rc = bind_socket(server);
3382	if (rc < 0)
3383		return rc;
3384
3385	/*
3386	 * Eventually check for other socket options to change from
3387	 * the default. sock_setsockopt not used because it expects
3388	 * user space buffer
3389	 */
3390	socket->sk->sk_rcvtimeo = 7 * HZ;
3391	socket->sk->sk_sndtimeo = 5 * HZ;
3392
3393	/* make the bufsizes depend on wsize/rsize and max requests */
3394	if (server->noautotune) {
3395		if (socket->sk->sk_sndbuf < (200 * 1024))
3396			socket->sk->sk_sndbuf = 200 * 1024;
3397		if (socket->sk->sk_rcvbuf < (140 * 1024))
3398			socket->sk->sk_rcvbuf = 140 * 1024;
3399	}
3400
3401	if (server->tcp_nodelay)
3402		tcp_sock_set_nodelay(socket->sk);
3403
3404	cifs_dbg(FYI, "sndbuf %d rcvbuf %d rcvtimeo 0x%lx\n",
3405		 socket->sk->sk_sndbuf,
3406		 socket->sk->sk_rcvbuf, socket->sk->sk_rcvtimeo);
3407
3408	rc = kernel_connect(socket, (struct sockaddr_unsized *)saddr, slen,
3409			    server->noblockcnt ? O_NONBLOCK : 0);
3410	/*
3411	 * When mounting SMB root file systems, we do not want to block in
3412	 * connect. Otherwise bail out and then let cifs_reconnect() perform
3413	 * reconnect failover - if possible.
3414	 */
3415	if (server->noblockcnt && rc == -EINPROGRESS)
3416		rc = 0;
3417	if (rc < 0) {
3418		cifs_dbg(FYI, "Error %d connecting to server\n", rc);
3419		trace_smb3_connect_err(server->hostname, server->conn_id, &server->dstaddr, rc);
3420		sock_release(socket);
3421		server->ssocket = NULL;
3422		return rc;
3423	}
3424	trace_smb3_connect_done(server->hostname, server->conn_id, &server->dstaddr);
3425
3426	/*
3427	 * Establish RFC1001 NetBIOS session when it was explicitly requested
3428	 * by mount option -o nbsessinit, or when connecting to default RFC1001
3429	 * server port (139) and it was not explicitly disabled by mount option
3430	 * -o nonbsessinit.
3431	 */
3432	if (server->with_rfc1001 ||
3433	    server->rfc1001_sessinit == 1 ||
3434	    (server->rfc1001_sessinit == -1 && sport == htons(RFC1001_PORT)))
3435		rc = ip_rfc1001_connect(server);
3436
3437	return rc;
3438}
3439
3440static int
3441ip_connect(struct TCP_Server_Info *server)
3442{
3443	__be16 *sport;
3444	struct sockaddr_in6 *addr6 = (struct sockaddr_in6 *)&server->dstaddr;
3445	struct sockaddr_in *addr = (struct sockaddr_in *)&server->dstaddr;
3446
3447	if (server->dstaddr.ss_family == AF_INET6)
3448		sport = &addr6->sin6_port;
3449	else
3450		sport = &addr->sin_port;
3451
3452	if (*sport == 0) {
3453		int rc;
3454
3455		/* try with 445 port at first */
3456		*sport = htons(CIFS_PORT);
3457
3458		rc = generic_ip_connect(server);
3459		if (rc >= 0)
3460			return rc;
3461
3462		/* if it failed, try with 139 port */
3463		*sport = htons(RFC1001_PORT);
3464	}
3465
3466	return generic_ip_connect(server);
3467}
3468
3469#ifdef CONFIG_CIFS_ALLOW_INSECURE_LEGACY
3470void reset_cifs_unix_caps(unsigned int xid, struct cifs_tcon *tcon,
3471			  struct cifs_sb_info *cifs_sb, struct smb3_fs_context *ctx)
3472{
3473	/*
3474	 * If we are reconnecting then should we check to see if
3475	 * any requested capabilities changed locally e.g. via
3476	 * remount but we can not do much about it here
3477	 * if they have (even if we could detect it by the following)
3478	 * Perhaps we could add a backpointer to array of sb from tcon
3479	 * or if we change to make all sb to same share the same
3480	 * sb as NFS - then we only have one backpointer to sb.
3481	 * What if we wanted to mount the server share twice once with
3482	 * and once without posixacls or posix paths?
3483	 */
3484	__u64 saved_cap = le64_to_cpu(tcon->fsUnixInfo.Capability);
3485
3486	if (ctx && ctx->no_linux_ext) {
3487		tcon->fsUnixInfo.Capability = 0;
3488		tcon->unix_ext = 0; /* Unix Extensions disabled */
3489		cifs_dbg(FYI, "Linux protocol extensions disabled\n");
3490		return;
3491	} else if (ctx)
3492		tcon->unix_ext = 1; /* Unix Extensions supported */
3493
3494	if (!tcon->unix_ext) {
3495		cifs_dbg(FYI, "Unix extensions disabled so not set on reconnect\n");
3496		return;
3497	}
3498
3499	if (!CIFSSMBQFSUnixInfo(xid, tcon)) {
3500		__u64 cap = le64_to_cpu(tcon->fsUnixInfo.Capability);
3501
3502		cifs_dbg(FYI, "unix caps which server supports %lld\n", cap);
3503		/*
3504		 * check for reconnect case in which we do not
3505		 * want to change the mount behavior if we can avoid it
3506		 */
3507		if (ctx == NULL) {
3508			/*
3509			 * turn off POSIX ACL and PATHNAMES if not set
3510			 * originally at mount time
3511			 */
3512			if ((saved_cap & CIFS_UNIX_POSIX_ACL_CAP) == 0)
3513				cap &= ~CIFS_UNIX_POSIX_ACL_CAP;
3514			if ((saved_cap & CIFS_UNIX_POSIX_PATHNAMES_CAP) == 0) {
3515				if (cap & CIFS_UNIX_POSIX_PATHNAMES_CAP)
3516					cifs_dbg(VFS, "POSIXPATH support change\n");
3517				cap &= ~CIFS_UNIX_POSIX_PATHNAMES_CAP;
3518			} else if ((cap & CIFS_UNIX_POSIX_PATHNAMES_CAP) == 0) {
3519				cifs_dbg(VFS, "possible reconnect error\n");
3520				cifs_dbg(VFS, "server disabled POSIX path support\n");
3521			}
3522		}
3523
3524		if (cap & CIFS_UNIX_TRANSPORT_ENCRYPTION_MANDATORY_CAP)
3525			cifs_dbg(VFS, "per-share encryption not supported yet\n");
3526
3527		cap &= CIFS_UNIX_CAP_MASK;
3528		if (ctx && ctx->no_psx_acl)
3529			cap &= ~CIFS_UNIX_POSIX_ACL_CAP;
3530		else if (CIFS_UNIX_POSIX_ACL_CAP & cap) {
3531			cifs_dbg(FYI, "negotiated posix acl support\n");
3532			if (cifs_sb)
3533				cifs_sb->mnt_cifs_flags |=
3534					CIFS_MOUNT_POSIXACL;
3535		}
3536
3537		if (ctx && ctx->posix_paths == 0)
3538			cap &= ~CIFS_UNIX_POSIX_PATHNAMES_CAP;
3539		else if (cap & CIFS_UNIX_POSIX_PATHNAMES_CAP) {
3540			cifs_dbg(FYI, "negotiate posix pathnames\n");
3541			if (cifs_sb)
3542				cifs_sb->mnt_cifs_flags |=
3543					CIFS_MOUNT_POSIX_PATHS;
3544		}
3545
3546		cifs_dbg(FYI, "Negotiate caps 0x%x\n", (int)cap);
3547#ifdef CONFIG_CIFS_DEBUG2
3548		if (cap & CIFS_UNIX_FCNTL_CAP)
3549			cifs_dbg(FYI, "FCNTL cap\n");
3550		if (cap & CIFS_UNIX_EXTATTR_CAP)
3551			cifs_dbg(FYI, "EXTATTR cap\n");
3552		if (cap & CIFS_UNIX_POSIX_PATHNAMES_CAP)
3553			cifs_dbg(FYI, "POSIX path cap\n");
3554		if (cap & CIFS_UNIX_XATTR_CAP)
3555			cifs_dbg(FYI, "XATTR cap\n");
3556		if (cap & CIFS_UNIX_POSIX_ACL_CAP)
3557			cifs_dbg(FYI, "POSIX ACL cap\n");
3558		if (cap & CIFS_UNIX_LARGE_READ_CAP)
3559			cifs_dbg(FYI, "very large read cap\n");
3560		if (cap & CIFS_UNIX_LARGE_WRITE_CAP)
3561			cifs_dbg(FYI, "very large write cap\n");
3562		if (cap & CIFS_UNIX_TRANSPORT_ENCRYPTION_CAP)
3563			cifs_dbg(FYI, "transport encryption cap\n");
3564		if (cap & CIFS_UNIX_TRANSPORT_ENCRYPTION_MANDATORY_CAP)
3565			cifs_dbg(FYI, "mandatory transport encryption cap\n");
3566#endif /* CIFS_DEBUG2 */
3567		if (CIFSSMBSetFSUnixInfo(xid, tcon, cap)) {
3568			if (ctx == NULL)
3569				cifs_dbg(FYI, "resetting capabilities failed\n");
3570			else
3571				cifs_dbg(VFS, "Negotiating Unix capabilities with the server failed. Consider mounting with the Unix Extensions disabled if problems are found by specifying the nounix mount option.\n");
3572
3573		}
3574	}
3575}
3576#endif /* CONFIG_CIFS_ALLOW_INSECURE_LEGACY */
3577
3578int cifs_setup_cifs_sb(struct cifs_sb_info *cifs_sb)
3579{
3580	struct smb3_fs_context *ctx = cifs_sb->ctx;
3581
3582	INIT_DELAYED_WORK(&cifs_sb->prune_tlinks, cifs_prune_tlinks);
3583	INIT_LIST_HEAD(&cifs_sb->tcon_sb_link);
3584
3585	spin_lock_init(&cifs_sb->tlink_tree_lock);
3586	cifs_sb->tlink_tree = RB_ROOT;
3587
3588	cifs_dbg(FYI, "file mode: %04ho  dir mode: %04ho\n",
3589		 ctx->file_mode, ctx->dir_mode);
3590
3591	/* this is needed for ASCII cp to Unicode converts */
3592	if (ctx->iocharset == NULL) {
3593		/* load_nls_default cannot return null */
3594		cifs_sb->local_nls = load_nls_default();
3595	} else {
3596		cifs_sb->local_nls = load_nls(ctx->iocharset);
3597		if (cifs_sb->local_nls == NULL) {
3598			cifs_dbg(VFS, "CIFS mount error: iocharset %s not found\n",
3599				 ctx->iocharset);
3600			return -ELIBACC;
3601		}
3602	}
3603	ctx->local_nls = cifs_sb->local_nls;
3604
3605	smb3_update_mnt_flags(cifs_sb);
3606
3607	if (ctx->direct_io)
3608		cifs_dbg(FYI, "mounting share using direct i/o\n");
3609	if (ctx->cache_ro) {
3610		cifs_dbg(VFS, "mounting share with read only caching. Ensure that the share will not be modified while in use.\n");
3611		cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_RO_CACHE;
3612	} else if (ctx->cache_rw) {
3613		cifs_dbg(VFS, "mounting share in single client RW caching mode. Ensure that no other systems will be accessing the share.\n");
3614		cifs_sb->mnt_cifs_flags |= (CIFS_MOUNT_RO_CACHE |
3615					    CIFS_MOUNT_RW_CACHE);
3616	}
3617
3618	if ((ctx->cifs_acl) && (ctx->dynperm))
3619		cifs_dbg(VFS, "mount option dynperm ignored if cifsacl mount option supported\n");
3620
3621	if (ctx->prepath) {
3622		cifs_sb->prepath = kstrdup(ctx->prepath, GFP_KERNEL);
3623		if (cifs_sb->prepath == NULL)
3624			return -ENOMEM;
3625		cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_USE_PREFIX_PATH;
3626	}
3627
3628	return 0;
3629}
3630
3631/* Release all succeed connections */
3632void cifs_mount_put_conns(struct cifs_mount_ctx *mnt_ctx)
3633{
3634	int rc = 0;
3635
3636	if (mnt_ctx->tcon)
3637		cifs_put_tcon(mnt_ctx->tcon, netfs_trace_tcon_ref_put_mnt_ctx);
3638	else if (mnt_ctx->ses)
3639		cifs_put_smb_ses(mnt_ctx->ses);
3640	else if (mnt_ctx->server)
3641		cifs_put_tcp_session(mnt_ctx->server, 0);
3642	mnt_ctx->ses = NULL;
3643	mnt_ctx->tcon = NULL;
3644	mnt_ctx->server = NULL;
3645	mnt_ctx->cifs_sb->mnt_cifs_flags &= ~CIFS_MOUNT_POSIX_PATHS;
3646	free_xid(mnt_ctx->xid);
3647}
3648
3649int cifs_mount_get_session(struct cifs_mount_ctx *mnt_ctx)
3650{
3651	struct TCP_Server_Info *server = NULL;
3652	struct smb3_fs_context *ctx;
3653	struct cifs_ses *ses = NULL;
3654	unsigned int xid;
3655	int rc = 0;
3656
3657	xid = get_xid();
3658
3659	if (WARN_ON_ONCE(!mnt_ctx || !mnt_ctx->fs_ctx)) {
3660		rc = -EINVAL;
3661		goto out;
3662	}
3663	ctx = mnt_ctx->fs_ctx;
3664
3665	/* get a reference to a tcp session */
3666	server = cifs_get_tcp_session(ctx, NULL);
3667	if (IS_ERR(server)) {
3668		rc = PTR_ERR(server);
3669		server = NULL;
3670		goto out;
3671	}
3672
3673	/* get a reference to a SMB session */
3674	ses = cifs_get_smb_ses(server, ctx);
3675	if (IS_ERR(ses)) {
3676		rc = PTR_ERR(ses);
3677		ses = NULL;
3678		goto out;
3679	}
3680
3681	if ((ctx->persistent == true) && (!(ses->server->capabilities &
3682					    SMB2_GLOBAL_CAP_PERSISTENT_HANDLES))) {
3683		cifs_server_dbg(VFS, "persistent handles not supported by server\n");
3684		rc = -EOPNOTSUPP;
3685	}
3686
3687out:
3688	mnt_ctx->xid = xid;
3689	mnt_ctx->server = server;
3690	mnt_ctx->ses = ses;
3691	mnt_ctx->tcon = NULL;
3692
3693	return rc;
3694}
3695
3696int cifs_mount_get_tcon(struct cifs_mount_ctx *mnt_ctx)
3697{
3698	struct TCP_Server_Info *server;
3699	struct cifs_sb_info *cifs_sb;
3700	struct smb3_fs_context *ctx;
3701	struct cifs_tcon *tcon = NULL;
3702	int rc = 0;
3703
3704	if (WARN_ON_ONCE(!mnt_ctx || !mnt_ctx->server || !mnt_ctx->ses || !mnt_ctx->fs_ctx ||
3705			 !mnt_ctx->cifs_sb)) {
3706		rc = -EINVAL;
3707		goto out;
3708	}
3709	server = mnt_ctx->server;
3710	ctx = mnt_ctx->fs_ctx;
3711	cifs_sb = mnt_ctx->cifs_sb;
3712
3713	/* search for existing tcon to this server share */
3714	tcon = cifs_get_tcon(mnt_ctx->ses, ctx);
3715	if (IS_ERR(tcon)) {
3716		rc = PTR_ERR(tcon);
3717		tcon = NULL;
3718		goto out;
3719	}
3720
3721	/*
3722	 * if new SMB3.11 POSIX extensions are supported, do not change anything in the
3723	 * path (i.e., do not remap / and \ and do not map any special characters)
3724	 */
3725	if (tcon->posix_extensions) {
3726		cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_POSIX_PATHS;
3727		cifs_sb->mnt_cifs_flags &= ~(CIFS_MOUNT_MAP_SFM_CHR |
3728					     CIFS_MOUNT_MAP_SPECIAL_CHR);
3729	}
3730
3731#ifdef CONFIG_CIFS_ALLOW_INSECURE_LEGACY
3732	/* tell server which Unix caps we support */
3733	if (cap_unix(tcon->ses)) {
3734		/*
3735		 * reset of caps checks mount to see if unix extensions disabled
3736		 * for just this mount.
3737		 */
3738		reset_cifs_unix_caps(mnt_ctx->xid, tcon, cifs_sb, ctx);
3739		spin_lock(&tcon->ses->server->srv_lock);
3740		if ((tcon->ses->server->tcpStatus == CifsNeedReconnect) &&
3741		    (le64_to_cpu(tcon->fsUnixInfo.Capability) &
3742		     CIFS_UNIX_TRANSPORT_ENCRYPTION_MANDATORY_CAP)) {
3743			spin_unlock(&tcon->ses->server->srv_lock);
3744			rc = -EACCES;
3745			goto out;
3746		}
3747		spin_unlock(&tcon->ses->server->srv_lock);
3748	} else
3749#endif /* CONFIG_CIFS_ALLOW_INSECURE_LEGACY */
3750		tcon->unix_ext = 0; /* server does not support them */
3751
3752	/* do not care if a following call succeed - informational */
3753	if (!tcon->pipe && server->ops->qfs_tcon) {
3754		server->ops->qfs_tcon(mnt_ctx->xid, tcon, cifs_sb);
3755		if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_RO_CACHE) {
3756			if (tcon->fsDevInfo.DeviceCharacteristics &
3757			    cpu_to_le32(FILE_READ_ONLY_DEVICE))
3758				cifs_dbg(VFS, "mounted to read only share\n");
3759			else if ((cifs_sb->mnt_cifs_flags &
3760				  CIFS_MOUNT_RW_CACHE) == 0)
3761				cifs_dbg(VFS, "read only mount of RW share\n");
3762			/* no need to log a RW mount of a typical RW share */
3763		}
3764	}
3765
3766	cifs_negotiate_iosize(server, cifs_sb->ctx, tcon);
3767	/*
3768	 * The cookie is initialized from volume info returned above.
3769	 * Inside cifs_fscache_get_super_cookie it checks
3770	 * that we do not get super cookie twice.
3771	 */
3772	if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_FSCACHE)
3773		cifs_fscache_get_super_cookie(tcon);
3774
3775out:
3776	mnt_ctx->tcon = tcon;
3777	return rc;
3778}
3779
3780static int mount_setup_tlink(struct cifs_sb_info *cifs_sb, struct cifs_ses *ses,
3781			     struct cifs_tcon *tcon)
3782{
3783	struct tcon_link *tlink;
3784
3785	/* hang the tcon off of the superblock */
3786	tlink = kzalloc(sizeof(*tlink), GFP_KERNEL);
3787	if (tlink == NULL)
3788		return -ENOMEM;
3789
3790	tlink->tl_uid = ses->linux_uid;
3791	tlink->tl_tcon = tcon;
3792	tlink->tl_time = jiffies;
3793	set_bit(TCON_LINK_MASTER, &tlink->tl_flags);
3794	set_bit(TCON_LINK_IN_TREE, &tlink->tl_flags);
3795
3796	cifs_sb->master_tlink = tlink;
3797	spin_lock(&cifs_sb->tlink_tree_lock);
3798	tlink_rb_insert(&cifs_sb->tlink_tree, tlink);
3799	spin_unlock(&cifs_sb->tlink_tree_lock);
3800
3801	spin_lock(&tcon->sb_list_lock);
3802	list_add(&cifs_sb->tcon_sb_link, &tcon->cifs_sb_list);
3803	spin_unlock(&tcon->sb_list_lock);
3804
3805	queue_delayed_work(cifsiod_wq, &cifs_sb->prune_tlinks,
3806				TLINK_IDLE_EXPIRE);
3807	return 0;
3808}
3809
3810static int
3811cifs_are_all_path_components_accessible(struct TCP_Server_Info *server,
3812					unsigned int xid,
3813					struct cifs_tcon *tcon,
3814					struct cifs_sb_info *cifs_sb,
3815					char *full_path,
3816					int added_treename)
3817{
3818	int rc;
3819	char *s;
3820	char sep, tmp;
3821	int skip = added_treename ? 1 : 0;
3822
3823	sep = CIFS_DIR_SEP(cifs_sb);
3824	s = full_path;
3825
3826	rc = server->ops->is_path_accessible(xid, tcon, cifs_sb, "");
3827	while (rc == 0) {
3828		/* skip separators */
3829		while (*s == sep)
3830			s++;
3831		if (!*s)
3832			break;
3833		/* next separator */
3834		while (*s && *s != sep)
3835			s++;
3836		/*
3837		 * if the treename is added, we then have to skip the first
3838		 * part within the separators
3839		 */
3840		if (skip) {
3841			skip = 0;
3842			continue;
3843		}
3844		/*
3845		 * temporarily null-terminate the path at the end of
3846		 * the current component
3847		 */
3848		tmp = *s;
3849		*s = 0;
3850		rc = server->ops->is_path_accessible(xid, tcon, cifs_sb,
3851						     full_path);
3852		*s = tmp;
3853	}
3854	return rc;
3855}
3856
3857/*
3858 * Check if path is remote (i.e. a DFS share).
3859 *
3860 * Return -EREMOTE if it is, otherwise 0 or -errno.
3861 */
3862int cifs_is_path_remote(struct cifs_mount_ctx *mnt_ctx)
3863{
3864	int rc;
3865	struct cifs_sb_info *cifs_sb = mnt_ctx->cifs_sb;
3866	struct TCP_Server_Info *server = mnt_ctx->server;
3867	unsigned int xid = mnt_ctx->xid;
3868	struct cifs_tcon *tcon = mnt_ctx->tcon;
3869	struct smb3_fs_context *ctx = mnt_ctx->fs_ctx;
3870	char *full_path;
3871
3872	if (!server->ops->is_path_accessible)
3873		return -EOPNOTSUPP;
3874
3875	/*
3876	 * cifs_build_path_to_root works only when we have a valid tcon
3877	 */
3878	full_path = cifs_build_path_to_root(ctx, cifs_sb, tcon,
3879					    tcon->Flags & SMB_SHARE_IS_IN_DFS);
3880	if (full_path == NULL)
3881		return -ENOMEM;
3882
3883	cifs_dbg(FYI, "%s: full_path: %s\n", __func__, full_path);
3884
3885	rc = server->ops->is_path_accessible(xid, tcon, cifs_sb,
3886					     full_path);
3887	if (rc != 0 && rc != -EREMOTE)
3888		goto out;
3889
3890	if (rc != -EREMOTE) {
3891		rc = cifs_are_all_path_components_accessible(server, xid, tcon,
3892			cifs_sb, full_path, tcon->Flags & SMB_SHARE_IS_IN_DFS);
3893		if (rc != 0) {
3894			cifs_server_dbg(VFS, "cannot query dirs between root and final path, enabling CIFS_MOUNT_USE_PREFIX_PATH\n");
3895			cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_USE_PREFIX_PATH;
3896			rc = 0;
3897		}
3898	}
3899
3900out:
3901	kfree(full_path);
3902	return rc;
3903}
3904
3905#ifdef CONFIG_CIFS_DFS_UPCALL
3906int cifs_mount(struct cifs_sb_info *cifs_sb, struct smb3_fs_context *ctx)
3907{
3908	struct cifs_mount_ctx mnt_ctx = { .cifs_sb = cifs_sb, .fs_ctx = ctx, };
3909	int rc;
3910
3911	rc = dfs_mount_share(&mnt_ctx);
3912	if (rc)
3913		goto error;
3914	if (!ctx->dfs_conn)
3915		goto out;
3916
3917	/*
3918	 * After reconnecting to a different server, unique ids won't match anymore, so we disable
3919	 * serverino. This prevents dentry revalidation to think the dentry are stale (ESTALE).
3920	 */
3921	cifs_autodisable_serverino(cifs_sb);
3922	/*
3923	 * Force the use of prefix path to support failover on DFS paths that resolve to targets
3924	 * that have different prefix paths.
3925	 */
3926	cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_USE_PREFIX_PATH;
3927	kfree(cifs_sb->prepath);
3928	cifs_sb->prepath = ctx->prepath;
3929	ctx->prepath = NULL;
3930
3931out:
3932	smb3_update_ses_channels(mnt_ctx.ses, mnt_ctx.server,
3933				  false /* from_reconnect */,
3934				  false /* disable_mchan */);
3935	rc = mount_setup_tlink(cifs_sb, mnt_ctx.ses, mnt_ctx.tcon);
3936	if (rc)
3937		goto error;
3938
3939	free_xid(mnt_ctx.xid);
3940	return rc;
3941
3942error:
3943	cifs_mount_put_conns(&mnt_ctx);
3944	return rc;
3945}
3946#else
3947int cifs_mount(struct cifs_sb_info *cifs_sb, struct smb3_fs_context *ctx)
3948{
3949	int rc = 0;
3950	struct cifs_mount_ctx mnt_ctx = { .cifs_sb = cifs_sb, .fs_ctx = ctx, };
3951
3952	rc = cifs_mount_get_session(&mnt_ctx);
3953	if (rc)
3954		goto error;
3955
3956	rc = cifs_mount_get_tcon(&mnt_ctx);
3957	if (!rc) {
3958		/*
3959		 * Prevent superblock from being created with any missing
3960		 * connections.
3961		 */
3962		if (WARN_ON(!mnt_ctx.server))
3963			rc = -EHOSTDOWN;
3964		else if (WARN_ON(!mnt_ctx.ses))
3965			rc = -EACCES;
3966		else if (WARN_ON(!mnt_ctx.tcon))
3967			rc = -ENOENT;
3968	}
3969	if (rc)
3970		goto error;
3971
3972	rc = cifs_is_path_remote(&mnt_ctx);
3973	if (rc == -EREMOTE)
3974		rc = -EOPNOTSUPP;
3975	if (rc)
3976		goto error;
3977
3978	rc = mount_setup_tlink(cifs_sb, mnt_ctx.ses, mnt_ctx.tcon);
3979	if (rc)
3980		goto error;
3981
3982	free_xid(mnt_ctx.xid);
3983	return rc;
3984
3985error:
3986	cifs_mount_put_conns(&mnt_ctx);
3987	return rc;
3988}
3989#endif
3990
3991#ifdef CONFIG_CIFS_ALLOW_INSECURE_LEGACY
3992/*
3993 * Issue a TREE_CONNECT request.
3994 */
3995int
3996CIFSTCon(const unsigned int xid, struct cifs_ses *ses,
3997	 const char *tree, struct cifs_tcon *tcon,
3998	 const struct nls_table *nls_codepage)
3999{
4000	struct smb_hdr *smb_buffer;
4001	struct smb_hdr *smb_buffer_response;
4002	TCONX_REQ *pSMB;
4003	TCONX_RSP *pSMBr;
4004	unsigned char *bcc_ptr;
4005	int rc = 0;
4006	int length, in_len;
4007	__u16 bytes_left, count;
4008
4009	if (ses == NULL)
4010		return smb_EIO(smb_eio_trace_null_pointers);
4011
4012	smb_buffer = cifs_buf_get();
4013	if (smb_buffer == NULL)
4014		return -ENOMEM;
4015
4016	smb_buffer_response = smb_buffer;
4017
4018	in_len = header_assemble(smb_buffer, SMB_COM_TREE_CONNECT_ANDX,
4019				 NULL /*no tid */, 4 /*wct */);
4020
4021	smb_buffer->Mid = get_next_mid(ses->server);
4022	smb_buffer->Uid = ses->Suid;
4023	pSMB = (TCONX_REQ *) smb_buffer;
4024	pSMBr = (TCONX_RSP *) smb_buffer_response;
4025
4026	pSMB->AndXCommand = 0xFF;
4027	pSMB->Flags = cpu_to_le16(TCON_EXTENDED_SECINFO);
4028	bcc_ptr = &pSMB->Password[0];
4029
4030	pSMB->PasswordLength = cpu_to_le16(1);	/* minimum */
4031	*bcc_ptr = 0; /* password is null byte */
4032	bcc_ptr++;              /* skip password */
4033	/* already aligned so no need to do it below */
4034
4035	if (ses->server->sign)
4036		smb_buffer->Flags2 |= SMBFLG2_SECURITY_SIGNATURE;
4037
4038	if (ses->capabilities & CAP_STATUS32)
4039		smb_buffer->Flags2 |= SMBFLG2_ERR_STATUS;
4040
4041	if (ses->capabilities & CAP_DFS)
4042		smb_buffer->Flags2 |= SMBFLG2_DFS;
4043
4044	if (ses->capabilities & CAP_UNICODE) {
4045		smb_buffer->Flags2 |= SMBFLG2_UNICODE;
4046		length =
4047		    cifs_strtoUTF16((__le16 *) bcc_ptr, tree,
4048			6 /* max utf8 char length in bytes */ *
4049			(/* server len*/ + 256 /* share len */), nls_codepage);
4050		bcc_ptr += 2 * length;	/* convert num 16 bit words to bytes */
4051		bcc_ptr += 2;	/* skip trailing null */
4052	} else {		/* ASCII */
4053		strcpy(bcc_ptr, tree);
4054		bcc_ptr += strlen(tree) + 1;
4055	}
4056	strcpy(bcc_ptr, "?????");
4057	bcc_ptr += strlen("?????");
4058	bcc_ptr += 1;
4059	count = bcc_ptr - &pSMB->Password[0];
4060	in_len += count;
4061	pSMB->ByteCount = cpu_to_le16(count);
4062
4063	rc = SendReceive(xid, ses, smb_buffer, in_len, smb_buffer_response,
4064			 &length, 0);
4065
4066	/* above now done in SendReceive */
4067	if (rc == 0) {
4068		bool is_unicode;
4069
4070		tcon->tid = smb_buffer_response->Tid;
4071		bcc_ptr = pByteArea(smb_buffer_response);
4072		bytes_left = get_bcc(smb_buffer_response);
4073		length = strnlen(bcc_ptr, bytes_left - 2);
4074		if (smb_buffer->Flags2 & SMBFLG2_UNICODE)
4075			is_unicode = true;
4076		else
4077			is_unicode = false;
4078
4079
4080		/* skip service field (NB: this field is always ASCII) */
4081		if (length == 3) {
4082			if ((bcc_ptr[0] == 'I') && (bcc_ptr[1] == 'P') &&
4083			    (bcc_ptr[2] == 'C')) {
4084				cifs_dbg(FYI, "IPC connection\n");
4085				tcon->ipc = true;
4086				tcon->pipe = true;
4087			}
4088		} else if (length == 2) {
4089			if ((bcc_ptr[0] == 'A') && (bcc_ptr[1] == ':')) {
4090				/* the most common case */
4091				cifs_dbg(FYI, "disk share connection\n");
4092			}
4093		}
4094		bcc_ptr += length + 1;
4095		bytes_left -= (length + 1);
4096		strscpy(tcon->tree_name, tree, sizeof(tcon->tree_name));
4097
4098		/* mostly informational -- no need to fail on error here */
4099		kfree(tcon->nativeFileSystem);
4100		tcon->nativeFileSystem = cifs_strndup_from_utf16(bcc_ptr,
4101						      bytes_left, is_unicode,
4102						      nls_codepage);
4103
4104		cifs_dbg(FYI, "nativeFileSystem=%s\n", tcon->nativeFileSystem);
4105
4106		if ((smb_buffer_response->WordCount == 3) ||
4107			 (smb_buffer_response->WordCount == 7))
4108			/* field is in same location */
4109			tcon->Flags = le16_to_cpu(pSMBr->OptionalSupport);
4110		else
4111			tcon->Flags = 0;
4112		cifs_dbg(FYI, "Tcon flags: 0x%x\n", tcon->Flags);
4113
4114		/*
4115		 * reset_cifs_unix_caps calls QFSInfo which requires
4116		 * need_reconnect to be false, but we would not need to call
4117		 * reset_caps if this were not a reconnect case so must check
4118		 * need_reconnect flag here.  The caller will also clear
4119		 * need_reconnect when tcon was successful but needed to be
4120		 * cleared earlier in the case of unix extensions reconnect
4121		 */
4122		if (tcon->need_reconnect && tcon->unix_ext) {
4123			cifs_dbg(FYI, "resetting caps for %s\n", tcon->tree_name);
4124			tcon->need_reconnect = false;
4125			reset_cifs_unix_caps(xid, tcon, NULL, NULL);
4126		}
4127	}
4128	cifs_buf_release(smb_buffer);
4129	return rc;
4130}
4131#endif /* CONFIG_CIFS_ALLOW_INSECURE_LEGACY */
4132
4133static void delayed_free(struct rcu_head *p)
4134{
4135	struct cifs_sb_info *cifs_sb = container_of(p, struct cifs_sb_info, rcu);
4136
4137	unload_nls(cifs_sb->local_nls);
4138	smb3_cleanup_fs_context(cifs_sb->ctx);
4139	kfree(cifs_sb);
4140}
4141
4142void
4143cifs_umount(struct cifs_sb_info *cifs_sb)
4144{
4145	struct rb_root *root = &cifs_sb->tlink_tree;
4146	struct rb_node *node;
4147	struct tcon_link *tlink;
4148	struct cifs_tcon *tcon = NULL;
4149
4150	cancel_delayed_work_sync(&cifs_sb->prune_tlinks);
4151
4152	if (cifs_sb->master_tlink) {
4153		tcon = cifs_sb->master_tlink->tl_tcon;
4154		if (tcon) {
4155			spin_lock(&tcon->sb_list_lock);
4156			list_del_init(&cifs_sb->tcon_sb_link);
4157			spin_unlock(&tcon->sb_list_lock);
4158		}
4159	}
4160
4161	spin_lock(&cifs_sb->tlink_tree_lock);
4162	while ((node = rb_first(root))) {
4163		tlink = rb_entry(node, struct tcon_link, tl_rbnode);
4164		cifs_get_tlink(tlink);
4165		clear_bit(TCON_LINK_IN_TREE, &tlink->tl_flags);
4166		rb_erase(node, root);
4167
4168		spin_unlock(&cifs_sb->tlink_tree_lock);
4169		cifs_put_tlink(tlink);
4170		spin_lock(&cifs_sb->tlink_tree_lock);
4171	}
4172	spin_unlock(&cifs_sb->tlink_tree_lock);
4173
4174	kfree(cifs_sb->prepath);
4175	call_rcu(&cifs_sb->rcu, delayed_free);
4176}
4177
4178int
4179cifs_negotiate_protocol(const unsigned int xid, struct cifs_ses *ses,
4180			struct TCP_Server_Info *server)
4181{
4182	bool in_retry = false;
4183	int rc = 0;
4184
4185	if (!server->ops->need_neg || !server->ops->negotiate)
4186		return -ENOSYS;
4187
4188retry:
4189	/* only send once per connect */
4190	spin_lock(&server->srv_lock);
4191	if (server->tcpStatus != CifsGood &&
4192	    server->tcpStatus != CifsNew &&
4193	    server->tcpStatus != CifsNeedNegotiate) {
4194		spin_unlock(&server->srv_lock);
4195		return -EHOSTDOWN;
4196	}
4197
4198	if (!server->ops->need_neg(server) &&
4199	    server->tcpStatus == CifsGood) {
4200		spin_unlock(&server->srv_lock);
4201		return 0;
4202	}
4203
4204	server->tcpStatus = CifsInNegotiate;
4205	server->neg_start = jiffies;
4206	spin_unlock(&server->srv_lock);
4207
4208	rc = server->ops->negotiate(xid, ses, server);
4209	if (rc == -EAGAIN) {
4210		/* Allow one retry attempt */
4211		if (!in_retry) {
4212			in_retry = true;
4213			goto retry;
4214		}
4215		rc = -EHOSTDOWN;
4216	}
4217	if (rc == 0) {
4218		spin_lock(&server->srv_lock);
4219		if (server->tcpStatus == CifsInNegotiate)
4220			server->tcpStatus = CifsGood;
4221		else
4222			rc = -EHOSTDOWN;
4223		spin_unlock(&server->srv_lock);
4224	} else {
4225		spin_lock(&server->srv_lock);
4226		if (server->tcpStatus == CifsInNegotiate)
4227			server->tcpStatus = CifsNeedNegotiate;
4228		spin_unlock(&server->srv_lock);
4229	}
4230
4231	return rc;
4232}
4233
4234int
4235cifs_setup_session(const unsigned int xid, struct cifs_ses *ses,
4236		   struct TCP_Server_Info *server,
4237		   struct nls_table *nls_info)
4238{
4239	int rc = 0;
4240	struct TCP_Server_Info *pserver = SERVER_IS_CHAN(server) ? server->primary_server : server;
4241	struct sockaddr_in6 *addr6 = (struct sockaddr_in6 *)&pserver->dstaddr;
4242	struct sockaddr_in *addr = (struct sockaddr_in *)&pserver->dstaddr;
4243	bool is_binding = false;
4244	bool new_ses;
4245
4246	spin_lock(&ses->ses_lock);
4247	new_ses = ses->ses_status == SES_NEW;
4248	cifs_dbg(FYI, "%s: channel connect bitmap: 0x%lx\n",
4249		 __func__, ses->chans_need_reconnect);
4250
4251	if (ses->ses_status != SES_GOOD &&
4252	    ses->ses_status != SES_NEW &&
4253	    ses->ses_status != SES_NEED_RECON) {
4254		spin_unlock(&ses->ses_lock);
4255		return -EHOSTDOWN;
4256	}
4257
4258	/* only send once per connect */
4259	spin_lock(&ses->chan_lock);
4260	if (CIFS_ALL_CHANS_GOOD(ses)) {
4261		if (ses->ses_status == SES_NEED_RECON)
4262			ses->ses_status = SES_GOOD;
4263		spin_unlock(&ses->chan_lock);
4264		spin_unlock(&ses->ses_lock);
4265		return 0;
4266	}
4267
4268	cifs_chan_set_in_reconnect(ses, server);
4269	is_binding = !CIFS_ALL_CHANS_NEED_RECONNECT(ses);
4270	spin_unlock(&ses->chan_lock);
4271
4272	if (!is_binding) {
4273		ses->ses_status = SES_IN_SETUP;
4274
4275		/* force iface_list refresh */
4276		spin_lock(&ses->iface_lock);
4277		ses->iface_last_update = 0;
4278		spin_unlock(&ses->iface_lock);
4279	}
4280	spin_unlock(&ses->ses_lock);
4281
4282	/* update ses ip_addr only for primary chan */
4283	if (server == pserver) {
4284		if (server->dstaddr.ss_family == AF_INET6)
4285			scnprintf(ses->ip_addr, sizeof(ses->ip_addr), "%pI6", &addr6->sin6_addr);
4286		else
4287			scnprintf(ses->ip_addr, sizeof(ses->ip_addr), "%pI4", &addr->sin_addr);
4288	}
4289
4290	if (!is_binding) {
4291		ses->capabilities = server->capabilities;
4292		if (!linuxExtEnabled)
4293			ses->capabilities &= (~server->vals->cap_unix);
4294
4295		/*
4296		 * Check if the server supports specified encoding mode.
4297		 * Zero value in vals->cap_unicode indidcates that chosen
4298		 * protocol dialect does not support non-UNICODE mode.
4299		 */
4300		if (ses->unicode == 1 && server->vals->cap_unicode != 0 &&
4301		    !(server->capabilities & server->vals->cap_unicode)) {
4302			cifs_dbg(VFS, "Server does not support mounting in UNICODE mode\n");
4303			rc = -EOPNOTSUPP;
4304		} else if (ses->unicode == 0 && server->vals->cap_unicode == 0) {
4305			cifs_dbg(VFS, "Server does not support mounting in non-UNICODE mode\n");
4306			rc = -EOPNOTSUPP;
4307		} else if (ses->unicode == 0) {
4308			/*
4309			 * When UNICODE mode was explicitly disabled then
4310			 * do not announce client UNICODE capability.
4311			 */
4312			ses->capabilities &= (~server->vals->cap_unicode);
4313		}
4314
4315		if (ses->auth_key.response) {
4316			cifs_dbg(FYI, "Free previous auth_key.response = %p\n",
4317				 ses->auth_key.response);
4318			kfree_sensitive(ses->auth_key.response);
4319			ses->auth_key.response = NULL;
4320			ses->auth_key.len = 0;
4321		}
4322	}
4323
4324	cifs_dbg(FYI, "Security Mode: 0x%x Capabilities: 0x%x TimeAdjust: %d\n",
4325		 server->sec_mode, server->capabilities, server->timeAdj);
4326
4327	if (!rc) {
4328		if (server->ops->sess_setup)
4329			rc = server->ops->sess_setup(xid, ses, server, nls_info);
4330		else
4331			rc = -ENOSYS;
4332	}
4333
4334	if (rc) {
4335		if (new_ses) {
4336			cifs_server_dbg(VFS, "failed to create a new SMB session with %s: %d\n",
4337					get_security_type_str(ses->sectype), rc);
4338		}
4339		spin_lock(&ses->ses_lock);
4340		if (ses->ses_status == SES_IN_SETUP)
4341			ses->ses_status = SES_NEED_RECON;
4342		spin_lock(&ses->chan_lock);
4343		cifs_chan_clear_in_reconnect(ses, server);
4344		spin_unlock(&ses->chan_lock);
4345		spin_unlock(&ses->ses_lock);
4346	} else {
4347		spin_lock(&ses->ses_lock);
4348		if (ses->ses_status == SES_IN_SETUP)
4349			ses->ses_status = SES_GOOD;
4350		spin_lock(&ses->chan_lock);
4351		cifs_chan_clear_in_reconnect(ses, server);
4352		cifs_chan_clear_need_reconnect(ses, server);
4353		spin_unlock(&ses->chan_lock);
4354		spin_unlock(&ses->ses_lock);
4355	}
4356
4357	return rc;
4358}
4359
4360static int
4361cifs_set_vol_auth(struct smb3_fs_context *ctx, struct cifs_ses *ses)
4362{
4363	ctx->sectype = ses->sectype;
4364
4365	/* krb5 is special, since we don't need username or pw */
4366	if (ctx->sectype == Kerberos)
4367		return 0;
4368
4369	return cifs_set_cifscreds(ctx, ses);
4370}
4371
4372static struct cifs_tcon *
4373cifs_construct_tcon(struct cifs_sb_info *cifs_sb, kuid_t fsuid)
4374{
4375	int rc;
4376	struct cifs_tcon *master_tcon = cifs_sb_master_tcon(cifs_sb);
4377	struct cifs_ses *ses;
4378	struct cifs_tcon *tcon = NULL;
4379	struct smb3_fs_context *ctx;
4380	char *origin_fullpath = NULL;
4381
4382	ctx = kzalloc(sizeof(*ctx), GFP_KERNEL);
4383	if (ctx == NULL)
4384		return ERR_PTR(-ENOMEM);
4385
4386	ctx->local_nls = cifs_sb->local_nls;
4387	ctx->linux_uid = fsuid;
4388	ctx->cred_uid = fsuid;
4389	ctx->UNC = master_tcon->tree_name;
4390	ctx->retry = master_tcon->retry;
4391	ctx->nocase = master_tcon->nocase;
4392	ctx->nohandlecache = master_tcon->nohandlecache;
4393	ctx->local_lease = master_tcon->local_lease;
4394	ctx->no_lease = master_tcon->no_lease;
4395	ctx->resilient = master_tcon->use_resilient;
4396	ctx->persistent = master_tcon->use_persistent;
4397	ctx->handle_timeout = master_tcon->handle_timeout;
4398	ctx->no_linux_ext = !master_tcon->unix_ext;
4399	ctx->linux_ext = master_tcon->posix_extensions;
4400	ctx->sectype = master_tcon->ses->sectype;
4401	ctx->sign = master_tcon->ses->sign;
4402	ctx->seal = master_tcon->seal;
4403	ctx->witness = master_tcon->use_witness;
4404	ctx->dfs_root_ses = master_tcon->ses->dfs_root_ses;
4405	ctx->unicode = master_tcon->ses->unicode;
4406
4407	rc = cifs_set_vol_auth(ctx, master_tcon->ses);
4408	if (rc) {
4409		tcon = ERR_PTR(rc);
4410		goto out;
4411	}
4412
4413	/* get a reference for the same TCP session */
4414	spin_lock(&cifs_tcp_ses_lock);
4415	++master_tcon->ses->server->srv_count;
4416	spin_unlock(&cifs_tcp_ses_lock);
4417
4418	ses = cifs_get_smb_ses(master_tcon->ses->server, ctx);
4419	if (IS_ERR(ses)) {
4420		tcon = ERR_CAST(ses);
4421		cifs_put_tcp_session(master_tcon->ses->server, 0);
4422		goto out;
4423	}
4424
4425#ifdef CONFIG_CIFS_DFS_UPCALL
4426	spin_lock(&master_tcon->tc_lock);
4427	if (master_tcon->origin_fullpath) {
4428		spin_unlock(&master_tcon->tc_lock);
4429		origin_fullpath = dfs_get_path(cifs_sb, cifs_sb->ctx->source);
4430		if (IS_ERR(origin_fullpath)) {
4431			tcon = ERR_CAST(origin_fullpath);
4432			origin_fullpath = NULL;
4433			cifs_put_smb_ses(ses);
4434			goto out;
4435		}
4436	} else {
4437		spin_unlock(&master_tcon->tc_lock);
4438	}
4439#endif
4440
4441	tcon = cifs_get_tcon(ses, ctx);
4442	if (IS_ERR(tcon)) {
4443		cifs_put_smb_ses(ses);
4444		goto out;
4445	}
4446
4447#ifdef CONFIG_CIFS_DFS_UPCALL
4448	if (origin_fullpath) {
4449		spin_lock(&tcon->tc_lock);
4450		tcon->origin_fullpath = origin_fullpath;
4451		spin_unlock(&tcon->tc_lock);
4452		origin_fullpath = NULL;
4453		queue_delayed_work(dfscache_wq, &tcon->dfs_cache_work,
4454				   dfs_cache_get_ttl() * HZ);
4455	}
4456#endif
4457
4458#ifdef CONFIG_CIFS_ALLOW_INSECURE_LEGACY
4459	if (cap_unix(ses))
4460		reset_cifs_unix_caps(0, tcon, NULL, ctx);
4461#endif /* CONFIG_CIFS_ALLOW_INSECURE_LEGACY */
4462
4463out:
4464	kfree(ctx->username);
4465	kfree(ctx->domainname);
4466	kfree_sensitive(ctx->password);
4467	kfree(origin_fullpath);
4468	kfree(ctx);
4469
4470	return tcon;
4471}
4472
4473struct cifs_tcon *
4474cifs_sb_master_tcon(struct cifs_sb_info *cifs_sb)
4475{
4476	return tlink_tcon(cifs_sb_master_tlink(cifs_sb));
4477}
4478
4479/* find and return a tlink with given uid */
4480static struct tcon_link *
4481tlink_rb_search(struct rb_root *root, kuid_t uid)
4482{
4483	struct rb_node *node = root->rb_node;
4484	struct tcon_link *tlink;
4485
4486	while (node) {
4487		tlink = rb_entry(node, struct tcon_link, tl_rbnode);
4488
4489		if (uid_gt(tlink->tl_uid, uid))
4490			node = node->rb_left;
4491		else if (uid_lt(tlink->tl_uid, uid))
4492			node = node->rb_right;
4493		else
4494			return tlink;
4495	}
4496	return NULL;
4497}
4498
4499/* insert a tcon_link into the tree */
4500static void
4501tlink_rb_insert(struct rb_root *root, struct tcon_link *new_tlink)
4502{
4503	struct rb_node **new = &(root->rb_node), *parent = NULL;
4504	struct tcon_link *tlink;
4505
4506	while (*new) {
4507		tlink = rb_entry(*new, struct tcon_link, tl_rbnode);
4508		parent = *new;
4509
4510		if (uid_gt(tlink->tl_uid, new_tlink->tl_uid))
4511			new = &((*new)->rb_left);
4512		else
4513			new = &((*new)->rb_right);
4514	}
4515
4516	rb_link_node(&new_tlink->tl_rbnode, parent, new);
4517	rb_insert_color(&new_tlink->tl_rbnode, root);
4518}
4519
4520/*
4521 * Find or construct an appropriate tcon given a cifs_sb and the fsuid of the
4522 * current task.
4523 *
4524 * If the superblock doesn't refer to a multiuser mount, then just return
4525 * the master tcon for the mount.
4526 *
4527 * First, search the rbtree for an existing tcon for this fsuid. If one
4528 * exists, then check to see if it's pending construction. If it is then wait
4529 * for construction to complete. Once it's no longer pending, check to see if
4530 * it failed and either return an error or retry construction, depending on
4531 * the timeout.
4532 *
4533 * If one doesn't exist then insert a new tcon_link struct into the tree and
4534 * try to construct a new one.
4535 *
4536 * REMEMBER to call cifs_put_tlink() after successful calls to cifs_sb_tlink,
4537 * to avoid refcount issues
4538 */
4539struct tcon_link *
4540cifs_sb_tlink(struct cifs_sb_info *cifs_sb)
4541{
4542	struct tcon_link *tlink, *newtlink;
4543	kuid_t fsuid = current_fsuid();
4544	int err;
4545
4546	if (!(cifs_sb->mnt_cifs_flags & CIFS_MOUNT_MULTIUSER))
4547		return cifs_get_tlink(cifs_sb_master_tlink(cifs_sb));
4548
4549	spin_lock(&cifs_sb->tlink_tree_lock);
4550	tlink = tlink_rb_search(&cifs_sb->tlink_tree, fsuid);
4551	if (tlink)
4552		cifs_get_tlink(tlink);
4553	spin_unlock(&cifs_sb->tlink_tree_lock);
4554
4555	if (tlink == NULL) {
4556		newtlink = kzalloc(sizeof(*tlink), GFP_KERNEL);
4557		if (newtlink == NULL)
4558			return ERR_PTR(-ENOMEM);
4559		newtlink->tl_uid = fsuid;
4560		newtlink->tl_tcon = ERR_PTR(-EACCES);
4561		set_bit(TCON_LINK_PENDING, &newtlink->tl_flags);
4562		set_bit(TCON_LINK_IN_TREE, &newtlink->tl_flags);
4563		cifs_get_tlink(newtlink);
4564
4565		spin_lock(&cifs_sb->tlink_tree_lock);
4566		/* was one inserted after previous search? */
4567		tlink = tlink_rb_search(&cifs_sb->tlink_tree, fsuid);
4568		if (tlink) {
4569			cifs_get_tlink(tlink);
4570			spin_unlock(&cifs_sb->tlink_tree_lock);
4571			kfree(newtlink);
4572			goto wait_for_construction;
4573		}
4574		tlink = newtlink;
4575		tlink_rb_insert(&cifs_sb->tlink_tree, tlink);
4576		spin_unlock(&cifs_sb->tlink_tree_lock);
4577	} else {
4578wait_for_construction:
4579		err = wait_on_bit(&tlink->tl_flags, TCON_LINK_PENDING,
4580				  TASK_INTERRUPTIBLE);
4581		if (err) {
4582			cifs_put_tlink(tlink);
4583			return ERR_PTR(-ERESTARTSYS);
4584		}
4585
4586		/* if it's good, return it */
4587		if (!IS_ERR(tlink->tl_tcon))
4588			return tlink;
4589
4590		/* return error if we tried this already recently */
4591		if (time_before(jiffies, tlink->tl_time + TLINK_ERROR_EXPIRE)) {
4592			err = PTR_ERR(tlink->tl_tcon);
4593			cifs_put_tlink(tlink);
4594			return ERR_PTR(err);
4595		}
4596
4597		if (test_and_set_bit(TCON_LINK_PENDING, &tlink->tl_flags))
4598			goto wait_for_construction;
4599	}
4600
4601	tlink->tl_tcon = cifs_construct_tcon(cifs_sb, fsuid);
4602	clear_bit(TCON_LINK_PENDING, &tlink->tl_flags);
4603	wake_up_bit(&tlink->tl_flags, TCON_LINK_PENDING);
4604
4605	if (IS_ERR(tlink->tl_tcon)) {
4606		err = PTR_ERR(tlink->tl_tcon);
4607		if (err == -ENOKEY)
4608			err = -EACCES;
4609		cifs_put_tlink(tlink);
4610		return ERR_PTR(err);
4611	}
4612
4613	return tlink;
4614}
4615
4616/*
4617 * periodic workqueue job that scans tcon_tree for a superblock and closes
4618 * out tcons.
4619 */
4620static void
4621cifs_prune_tlinks(struct work_struct *work)
4622{
4623	struct cifs_sb_info *cifs_sb = container_of(work, struct cifs_sb_info,
4624						    prune_tlinks.work);
4625	struct rb_root *root = &cifs_sb->tlink_tree;
4626	struct rb_node *node;
4627	struct rb_node *tmp;
4628	struct tcon_link *tlink;
4629
4630	/*
4631	 * Because we drop the spinlock in the loop in order to put the tlink
4632	 * it's not guarded against removal of links from the tree. The only
4633	 * places that remove entries from the tree are this function and
4634	 * umounts. Because this function is non-reentrant and is canceled
4635	 * before umount can proceed, this is safe.
4636	 */
4637	spin_lock(&cifs_sb->tlink_tree_lock);
4638	node = rb_first(root);
4639	while (node != NULL) {
4640		tmp = node;
4641		node = rb_next(tmp);
4642		tlink = rb_entry(tmp, struct tcon_link, tl_rbnode);
4643
4644		if (test_bit(TCON_LINK_MASTER, &tlink->tl_flags) ||
4645		    atomic_read(&tlink->tl_count) != 0 ||
4646		    time_after(tlink->tl_time + TLINK_IDLE_EXPIRE, jiffies))
4647			continue;
4648
4649		cifs_get_tlink(tlink);
4650		clear_bit(TCON_LINK_IN_TREE, &tlink->tl_flags);
4651		rb_erase(tmp, root);
4652
4653		spin_unlock(&cifs_sb->tlink_tree_lock);
4654		cifs_put_tlink(tlink);
4655		spin_lock(&cifs_sb->tlink_tree_lock);
4656	}
4657	spin_unlock(&cifs_sb->tlink_tree_lock);
4658
4659	queue_delayed_work(cifsiod_wq, &cifs_sb->prune_tlinks,
4660				TLINK_IDLE_EXPIRE);
4661}
4662
4663#ifndef CONFIG_CIFS_DFS_UPCALL
4664int cifs_tree_connect(const unsigned int xid, struct cifs_tcon *tcon)
4665{
4666	const struct smb_version_operations *ops = tcon->ses->server->ops;
4667	int rc;
4668
4669	/* only send once per connect */
4670	spin_lock(&tcon->tc_lock);
4671
4672	/* if tcon is marked for needing reconnect, update state */
4673	if (tcon->need_reconnect)
4674		tcon->status = TID_NEED_TCON;
4675
4676	if (tcon->status == TID_GOOD) {
4677		spin_unlock(&tcon->tc_lock);
4678		return 0;
4679	}
4680
4681	if (tcon->status != TID_NEW &&
4682	    tcon->status != TID_NEED_TCON) {
4683		spin_unlock(&tcon->tc_lock);
4684		return -EHOSTDOWN;
4685	}
4686
4687	tcon->status = TID_IN_TCON;
4688	spin_unlock(&tcon->tc_lock);
4689
4690	rc = ops->tree_connect(xid, tcon->ses, tcon->tree_name,
4691			       tcon, tcon->ses->local_nls);
4692	if (rc) {
4693		spin_lock(&tcon->tc_lock);
4694		if (tcon->status == TID_IN_TCON)
4695			tcon->status = TID_NEED_TCON;
4696		spin_unlock(&tcon->tc_lock);
4697	} else {
4698		spin_lock(&tcon->tc_lock);
4699		if (tcon->status == TID_IN_TCON)
4700			tcon->status = TID_GOOD;
4701		tcon->need_reconnect = false;
4702		spin_unlock(&tcon->tc_lock);
4703	}
4704
4705	return rc;
4706}
4707#endif