?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
Fix buffer overflow if server sends corrupt response to small
[linux-2.6.22.y-op.git] / fs / cifs / transport.c
blob473962f5cb7326491f41a34d17227931a4ed3147
1 /*
2 * fs/cifs/transport.c
3 *
4 * Copyright (C) International Business Machines Corp., 2002,2005
5 * Author(s): Steve French (sfrench@us.ibm.com)
6 * Jeremy Allison (jra@samba.org) 2006.
7 *
8 * This library is free software; you can redistribute it and/or modify
9 * it under the terms of the GNU Lesser General Public License as published
10 * by the Free Software Foundation; either version 2.1 of the License, or
11 * (at your option) any later version.
12 *
13 * This library is distributed in the hope that it will be useful,
14 * but WITHOUT ANY WARRANTY; without even the implied warranty of
15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See
16 * the GNU Lesser General Public License for more details.
17 *
18 * You should have received a copy of the GNU Lesser General Public License
19 * along with this library; if not, write to the Free Software
20 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
21 */
22
23 #include <linux/fs.h>
24 #include <linux/list.h>
25 #include <linux/wait.h>
26 #include <linux/net.h>
27 #include <linux/delay.h>
28 #include <asm/uaccess.h>
29 #include <asm/processor.h>
30 #include <linux/mempool.h>
31 #include "cifspdu.h"
32 #include "cifsglob.h"
33 #include "cifsproto.h"
34 #include "cifs_debug.h"
35
36 extern mempool_t *cifs_mid_poolp;
37 extern struct kmem_cache *cifs_oplock_cachep;
38
39 static struct mid_q_entry *
40 AllocMidQEntry(const struct smb_hdr *smb_buffer, struct cifsSesInfo *ses)
41 {
42 struct mid_q_entry *temp;
43
44 if (ses == NULL) {
45 cERROR(1, ("Null session passed in to AllocMidQEntry"));
46 return NULL;
47 }
48 if (ses->server == NULL) {
49 cERROR(1, ("Null TCP session in AllocMidQEntry"));
50 return NULL;
51 }
52
53 temp = (struct mid_q_entry *) mempool_alloc(cifs_mid_poolp,
54 GFP_KERNEL | GFP_NOFS);
55 if (temp == NULL)
56 return temp;
57 else {
58 memset(temp, 0, sizeof (struct mid_q_entry));
59 temp->mid = smb_buffer->Mid; /* always LE */
60 temp->pid = current->pid;
61 temp->command = smb_buffer->Command;
62 cFYI(1, ("For smb_command %d", temp->command));
63 /* do_gettimeofday(&temp->when_sent);*/ /* easier to use jiffies */
64 /* when mid allocated can be before when sent */
65 temp->when_alloc = jiffies;
66 temp->ses = ses;
67 temp->tsk = current;
68 }
69
70 spin_lock(&GlobalMid_Lock);
71 list_add_tail(&temp->qhead, &ses->server->pending_mid_q);
72 atomic_inc(&midCount);
73 temp->midState = MID_REQUEST_ALLOCATED;
74 spin_unlock(&GlobalMid_Lock);
75 return temp;
76 }
77
78 static void
79 DeleteMidQEntry(struct mid_q_entry *midEntry)
80 {
81 #ifdef CONFIG_CIFS_STATS2
82 unsigned long now;
83 #endif
84 spin_lock(&GlobalMid_Lock);
85 midEntry->midState = MID_FREE;
86 list_del(&midEntry->qhead);
87 atomic_dec(&midCount);
88 spin_unlock(&GlobalMid_Lock);
89 if(midEntry->largeBuf)
90 cifs_buf_release(midEntry->resp_buf);
91 else
92 cifs_small_buf_release(midEntry->resp_buf);
93 #ifdef CONFIG_CIFS_STATS2
94 now = jiffies;
95 /* commands taking longer than one second are indications that
96 something is wrong, unless it is quite a slow link or server */
97 if((now - midEntry->when_alloc) > HZ) {
98 if((cifsFYI & CIFS_TIMER) &&
99 (midEntry->command != SMB_COM_LOCKING_ANDX)) {
100 printk(KERN_DEBUG " CIFS slow rsp: cmd %d mid %d",
101 midEntry->command, midEntry->mid);
102 printk(" A: 0x%lx S: 0x%lx R: 0x%lx\n",
103 now - midEntry->when_alloc,
104 now - midEntry->when_sent,
105 now - midEntry->when_received);
106 }
107 }
108 #endif
109 mempool_free(midEntry, cifs_mid_poolp);
110 }
111
112 struct oplock_q_entry *
113 AllocOplockQEntry(struct inode * pinode, __u16 fid, struct cifsTconInfo * tcon)
114 {
115 struct oplock_q_entry *temp;
116 if ((pinode== NULL) || (tcon == NULL)) {
117 cERROR(1, ("Null parms passed to AllocOplockQEntry"));
118 return NULL;
119 }
120 temp = (struct oplock_q_entry *) kmem_cache_alloc(cifs_oplock_cachep,
121 GFP_KERNEL);
122 if (temp == NULL)
123 return temp;
124 else {
125 temp->pinode = pinode;
126 temp->tcon = tcon;
127 temp->netfid = fid;
128 spin_lock(&GlobalMid_Lock);
129 list_add_tail(&temp->qhead, &GlobalOplock_Q);
130 spin_unlock(&GlobalMid_Lock);
131 }
132 return temp;
133
134 }
135
136 void DeleteOplockQEntry(struct oplock_q_entry * oplockEntry)
137 {
138 spin_lock(&GlobalMid_Lock);
139 /* should we check if list empty first? */
140 list_del(&oplockEntry->qhead);
141 spin_unlock(&GlobalMid_Lock);
142 kmem_cache_free(cifs_oplock_cachep, oplockEntry);
143 }
144
145 int
146 smb_send(struct socket *ssocket, struct smb_hdr *smb_buffer,
147 unsigned int smb_buf_length, struct sockaddr *sin)
148 {
149 int rc = 0;
150 int i = 0;
151 struct msghdr smb_msg;
152 struct kvec iov;
153 unsigned len = smb_buf_length + 4;
154
155 if(ssocket == NULL)
156 return -ENOTSOCK; /* BB eventually add reconnect code here */
157 iov.iov_base = smb_buffer;
158 iov.iov_len = len;
159
160 smb_msg.msg_name = sin;
161 smb_msg.msg_namelen = sizeof (struct sockaddr);
162 smb_msg.msg_control = NULL;
163 smb_msg.msg_controllen = 0;
164 smb_msg.msg_flags = MSG_DONTWAIT + MSG_NOSIGNAL; /* BB add more flags?*/
165
166 /* smb header is converted in header_assemble. bcc and rest of SMB word
167 area, and byte area if necessary, is converted to littleendian in
168 cifssmb.c and RFC1001 len is converted to bigendian in smb_send
169 Flags2 is converted in SendReceive */
170
171 smb_buffer->smb_buf_length = cpu_to_be32(smb_buffer->smb_buf_length);
172 cFYI(1, ("Sending smb of length %d", smb_buf_length));
173 dump_smb(smb_buffer, len);
174
175 while (len > 0) {
176 rc = kernel_sendmsg(ssocket, &smb_msg, &iov, 1, len);
177 if ((rc == -ENOSPC) || (rc == -EAGAIN)) {
178 i++;
179 /* smaller timeout here than send2 since smaller size */
180 /* Although it may not be required, this also is smaller
181 oplock break time */
182 if(i > 12) {
183 cERROR(1,
184 ("sends on sock %p stuck for 7 seconds",
185 ssocket));
186 rc = -EAGAIN;
187 break;
188 }
189 msleep(1 << i);
190 continue;
191 }
192 if (rc < 0)
193 break;
194 else
195 i = 0; /* reset i after each successful send */
196 iov.iov_base += rc;
197 iov.iov_len -= rc;
198 len -= rc;
199 }
200
201 if (rc < 0) {
202 cERROR(1,("Error %d sending data on socket to server", rc));
203 } else {
204 rc = 0;
205 }
206
207 /* Don't want to modify the buffer as a
208 side effect of this call. */
209 smb_buffer->smb_buf_length = smb_buf_length;
210
211 return rc;
212 }
213
214 static int
215 smb_send2(struct socket *ssocket, struct kvec *iov, int n_vec,
216 struct sockaddr *sin)
217 {
218 int rc = 0;
219 int i = 0;
220 struct msghdr smb_msg;
221 struct smb_hdr *smb_buffer = iov[0].iov_base;
222 unsigned int len = iov[0].iov_len;
223 unsigned int total_len;
224 int first_vec = 0;
225 unsigned int smb_buf_length = smb_buffer->smb_buf_length;
226
227 if(ssocket == NULL)
228 return -ENOTSOCK; /* BB eventually add reconnect code here */
229
230 smb_msg.msg_name = sin;
231 smb_msg.msg_namelen = sizeof (struct sockaddr);
232 smb_msg.msg_control = NULL;
233 smb_msg.msg_controllen = 0;
234 smb_msg.msg_flags = MSG_DONTWAIT + MSG_NOSIGNAL; /* BB add more flags?*/
235
236 /* smb header is converted in header_assemble. bcc and rest of SMB word
237 area, and byte area if necessary, is converted to littleendian in
238 cifssmb.c and RFC1001 len is converted to bigendian in smb_send
239 Flags2 is converted in SendReceive */
240
241
242 total_len = 0;
243 for (i = 0; i < n_vec; i++)
244 total_len += iov[i].iov_len;
245
246 smb_buffer->smb_buf_length = cpu_to_be32(smb_buffer->smb_buf_length);
247 cFYI(1, ("Sending smb: total_len %d", total_len));
248 dump_smb(smb_buffer, len);
249
250 while (total_len) {
251 rc = kernel_sendmsg(ssocket, &smb_msg, &iov[first_vec],
252 n_vec - first_vec, total_len);
253 if ((rc == -ENOSPC) || (rc == -EAGAIN)) {
254 i++;
255 if(i >= 14) {
256 cERROR(1,
257 ("sends on sock %p stuck for 15 seconds",
258 ssocket));
259 rc = -EAGAIN;
260 break;
261 }
262 msleep(1 << i);
263 continue;
264 }
265 if (rc < 0)
266 break;
267
268 if (rc >= total_len) {
269 WARN_ON(rc > total_len);
270 break;
271 }
272 if(rc == 0) {
273 /* should never happen, letting socket clear before
274 retrying is our only obvious option here */
275 cERROR(1,("tcp sent no data"));
276 msleep(500);
277 continue;
278 }
279 total_len -= rc;
280 /* the line below resets i */
281 for (i = first_vec; i < n_vec; i++) {
282 if (iov[i].iov_len) {
283 if (rc > iov[i].iov_len) {
284 rc -= iov[i].iov_len;
285 iov[i].iov_len = 0;
286 } else {
287 iov[i].iov_base += rc;
288 iov[i].iov_len -= rc;
289 first_vec = i;
290 break;
291 }
292 }
293 }
294 i = 0; /* in case we get ENOSPC on the next send */
295 }
296
297 if (rc < 0) {
298 cERROR(1,("Error %d sending data on socket to server", rc));
299 } else
300 rc = 0;
301
302 /* Don't want to modify the buffer as a
303 side effect of this call. */
304 smb_buffer->smb_buf_length = smb_buf_length;
305
306 return rc;
307 }
308
309 static int wait_for_free_request(struct cifsSesInfo *ses, const int long_op)
310 {
311 if (long_op == CIFS_ASYNC_OP) {
312 /* oplock breaks must not be held up */
313 atomic_inc(&ses->server->inFlight);
314 } else {
315 spin_lock(&GlobalMid_Lock);
316 while(1) {
317 if(atomic_read(&ses->server->inFlight) >=
318 cifs_max_pending){
319 spin_unlock(&GlobalMid_Lock);
320 #ifdef CONFIG_CIFS_STATS2
321 atomic_inc(&ses->server->num_waiters);
322 #endif
323 wait_event(ses->server->request_q,
324 atomic_read(&ses->server->inFlight)
325 < cifs_max_pending);
326 #ifdef CONFIG_CIFS_STATS2
327 atomic_dec(&ses->server->num_waiters);
328 #endif
329 spin_lock(&GlobalMid_Lock);
330 } else {
331 if(ses->server->tcpStatus == CifsExiting) {
332 spin_unlock(&GlobalMid_Lock);
333 return -ENOENT;
334 }
335
336 /* can not count locking commands against total since
337 they are allowed to block on server */
338
339 /* update # of requests on the wire to server */
340 if (long_op != CIFS_BLOCKING_OP)
341 atomic_inc(&ses->server->inFlight);
342 spin_unlock(&GlobalMid_Lock);
343 break;
344 }
345 }
346 }
347 return 0;
348 }
349
350 static int allocate_mid(struct cifsSesInfo *ses, struct smb_hdr *in_buf,
351 struct mid_q_entry **ppmidQ)
352 {
353 if (ses->server->tcpStatus == CifsExiting) {
354 return -ENOENT;
355 } else if (ses->server->tcpStatus == CifsNeedReconnect) {
356 cFYI(1,("tcp session dead - return to caller to retry"));
357 return -EAGAIN;
358 } else if (ses->status != CifsGood) {
359 /* check if SMB session is bad because we are setting it up */
360 if((in_buf->Command != SMB_COM_SESSION_SETUP_ANDX) &&
361 (in_buf->Command != SMB_COM_NEGOTIATE)) {
362 return -EAGAIN;
363 } /* else ok - we are setting up session */
364 }
365 *ppmidQ = AllocMidQEntry(in_buf, ses);
366 if (*ppmidQ == NULL) {
367 return -ENOMEM;
368 }
369 return 0;
370 }
371
372 static int wait_for_response(struct cifsSesInfo *ses,
373 struct mid_q_entry *midQ,
374 unsigned long timeout,
375 unsigned long time_to_wait)
376 {
377 unsigned long curr_timeout;
378
379 for (;;) {
380 curr_timeout = timeout + jiffies;
381 wait_event(ses->server->response_q,
382 (!(midQ->midState == MID_REQUEST_SUBMITTED)) ||
383 time_after(jiffies, curr_timeout) ||
384 ((ses->server->tcpStatus != CifsGood) &&
385 (ses->server->tcpStatus != CifsNew)));
386
387 if (time_after(jiffies, curr_timeout) &&
388 (midQ->midState == MID_REQUEST_SUBMITTED) &&
389 ((ses->server->tcpStatus == CifsGood) ||
390 (ses->server->tcpStatus == CifsNew))) {
391
392 unsigned long lrt;
393
394 /* We timed out. Is the server still
395 sending replies ? */
396 spin_lock(&GlobalMid_Lock);
397 lrt = ses->server->lstrp;
398 spin_unlock(&GlobalMid_Lock);
399
400 /* Calculate time_to_wait past last receive time.
401 Although we prefer not to time out if the
402 server is still responding - we will time
403 out if the server takes more than 15 (or 45
404 or 180) seconds to respond to this request
405 and has not responded to any request from
406 other threads on the client within 10 seconds */
407 lrt += time_to_wait;
408 if (time_after(jiffies, lrt)) {
409 /* No replies for time_to_wait. */
410 cERROR(1,("server not responding"));
411 return -1;
412 }
413 } else {
414 return 0;
415 }
416 }
417 }
418
419
420 /*
421 *
422 * Send an SMB Request. No response info (other than return code)
423 * needs to be parsed.
424 *
425 * flags indicate the type of request buffer and how long to wait
426 * and whether to log NT STATUS code (error) before mapping it to POSIX error
427 *
428 */
429 int
430 SendReceiveNoRsp(const unsigned int xid, struct cifsSesInfo *ses,
431 struct smb_hdr *in_buf, int flags)
432 {
433 int rc;
434 struct kvec iov[1];
435 int resp_buf_type;
436
437 iov[0].iov_base = (char *)in_buf;
438 iov[0].iov_len = in_buf->smb_buf_length + 4;
439 flags |= CIFS_NO_RESP;
440 rc = SendReceive2(xid, ses, iov, 1, &resp_buf_type, flags);
441 #ifdef CONFIG_CIFS_DEBUG2
442 cFYI(1, ("SendRcvNoR flags %d rc %d", flags, rc));
443 #endif
444 return rc;
445 }
446
447 int
448 SendReceive2(const unsigned int xid, struct cifsSesInfo *ses,
449 struct kvec *iov, int n_vec, int * pRespBufType /* ret */,
450 const int flags)
451 {
452 int rc = 0;
453 int long_op;
454 unsigned int receive_len;
455 unsigned long timeout;
456 struct mid_q_entry *midQ;
457 struct smb_hdr *in_buf = iov[0].iov_base;
458
459 long_op = flags & CIFS_TIMEOUT_MASK;
460
461 *pRespBufType = CIFS_NO_BUFFER; /* no response buf yet */
462
463 if ((ses == NULL) || (ses->server == NULL)) {
464 cifs_small_buf_release(in_buf);
465 cERROR(1,("Null session"));
466 return -EIO;
467 }
468
469 if(ses->server->tcpStatus == CifsExiting) {
470 cifs_small_buf_release(in_buf);
471 return -ENOENT;
472 }
473
474 /* Ensure that we do not send more than 50 overlapping requests
475 to the same server. We may make this configurable later or
476 use ses->maxReq */
477
478 rc = wait_for_free_request(ses, long_op);
479 if (rc) {
480 cifs_small_buf_release(in_buf);
481 return rc;
482 }
483
484 /* make sure that we sign in the same order that we send on this socket
485 and avoid races inside tcp sendmsg code that could cause corruption
486 of smb data */
487
488 down(&ses->server->tcpSem);
489
490 rc = allocate_mid(ses, in_buf, &midQ);
491 if (rc) {
492 up(&ses->server->tcpSem);
493 cifs_small_buf_release(in_buf);
494 /* Update # of requests on wire to server */
495 atomic_dec(&ses->server->inFlight);
496 wake_up(&ses->server->request_q);
497 return rc;
498 }
499
500 rc = cifs_sign_smb2(iov, n_vec, ses->server, &midQ->sequence_number);
501
502 midQ->midState = MID_REQUEST_SUBMITTED;
503 #ifdef CONFIG_CIFS_STATS2
504 atomic_inc(&ses->server->inSend);
505 #endif
506 rc = smb_send2(ses->server->ssocket, iov, n_vec,
507 (struct sockaddr *) &(ses->server->addr.sockAddr));
508 #ifdef CONFIG_CIFS_STATS2
509 atomic_dec(&ses->server->inSend);
510 midQ->when_sent = jiffies;
511 #endif
512
513 up(&ses->server->tcpSem);
514 cifs_small_buf_release(in_buf);
515
516 if(rc < 0)
517 goto out;
518
519 if (long_op == CIFS_STD_OP)
520 timeout = 15 * HZ;
521 else if (long_op == CIFS_VLONG_OP) /* e.g. slow writes past EOF */
522 timeout = 180 * HZ;
523 else if (long_op == CIFS_LONG_OP)
524 timeout = 45 * HZ; /* should be greater than
525 servers oplock break timeout (about 43 seconds) */
526 else if (long_op == CIFS_ASYNC_OP)
527 goto out;
528 else if (long_op == CIFS_BLOCKING_OP)
529 timeout = 0x7FFFFFFF; /* large, but not so large as to wrap */
530 else {
531 cERROR(1, ("unknown timeout flag %d", long_op));
532 rc = -EIO;
533 goto out;
534 }
535
536 /* wait for 15 seconds or until woken up due to response arriving or
537 due to last connection to this server being unmounted */
538 if (signal_pending(current)) {
539 /* if signal pending do not hold up user for full smb timeout
540 but we still give response a chance to complete */
541 timeout = 2 * HZ;
542 }
543
544 /* No user interrupts in wait - wreaks havoc with performance */
545 wait_for_response(ses, midQ, timeout, 10 * HZ);
546
547 spin_lock(&GlobalMid_Lock);
548 if (midQ->resp_buf) {
549 spin_unlock(&GlobalMid_Lock);
550 receive_len = midQ->resp_buf->smb_buf_length;
551 } else {
552 cERROR(1,("No response to cmd %d mid %d",
553 midQ->command, midQ->mid));
554 if(midQ->midState == MID_REQUEST_SUBMITTED) {
555 if(ses->server->tcpStatus == CifsExiting)
556 rc = -EHOSTDOWN;
557 else {
558 ses->server->tcpStatus = CifsNeedReconnect;
559 midQ->midState = MID_RETRY_NEEDED;
560 }
561 }
562
563 if (rc != -EHOSTDOWN) {
564 if(midQ->midState == MID_RETRY_NEEDED) {
565 rc = -EAGAIN;
566 cFYI(1,("marking request for retry"));
567 } else {
568 rc = -EIO;
569 }
570 }
571 spin_unlock(&GlobalMid_Lock);
572 DeleteMidQEntry(midQ);
573 /* Update # of requests on wire to server */
574 atomic_dec(&ses->server->inFlight);
575 wake_up(&ses->server->request_q);
576 return rc;
577 }
578
579 if (receive_len > CIFSMaxBufSize + MAX_CIFS_HDR_SIZE) {
580 cERROR(1, ("Frame too large received. Length: %d Xid: %d",
581 receive_len, xid));
582 rc = -EIO;
583 } else { /* rcvd frame is ok */
584 if (midQ->resp_buf &&
585 (midQ->midState == MID_RESPONSE_RECEIVED)) {
586
587 iov[0].iov_base = (char *)midQ->resp_buf;
588 if(midQ->largeBuf)
589 *pRespBufType = CIFS_LARGE_BUFFER;
590 else
591 *pRespBufType = CIFS_SMALL_BUFFER;
592 iov[0].iov_len = receive_len + 4;
593
594 dump_smb(midQ->resp_buf, 80);
595 /* convert the length into a more usable form */
596 if((receive_len > 24) &&
597 (ses->server->secMode & (SECMODE_SIGN_REQUIRED |
598 SECMODE_SIGN_ENABLED))) {
599 rc = cifs_verify_signature(midQ->resp_buf,
600 ses->server->mac_signing_key,
601 midQ->sequence_number+1);
602 if(rc) {
603 cERROR(1,("Unexpected SMB signature"));
604 /* BB FIXME add code to kill session */
605 }
606 }
607
608 /* BB special case reconnect tid and uid here? */
609 /* BB special case Errbadpassword and pwdexpired here */
610 rc = map_smb_to_linux_error(midQ->resp_buf);
611
612 /* convert ByteCount if necessary */
613 if (receive_len >=
614 sizeof (struct smb_hdr) -
615 4 /* do not count RFC1001 header */ +
616 (2 * midQ->resp_buf->WordCount) + 2 /* bcc */ )
617 BCC(midQ->resp_buf) =
618 le16_to_cpu(BCC_LE(midQ->resp_buf));
619 if ((flags & CIFS_NO_RESP) == 0)
620 midQ->resp_buf = NULL; /* mark it so buf will
621 not be freed by
622 DeleteMidQEntry */
623 } else {
624 rc = -EIO;
625 cFYI(1,("Bad MID state?"));
626 }
627 }
628
629 out:
630 DeleteMidQEntry(midQ);
631 atomic_dec(&ses->server->inFlight);
632 wake_up(&ses->server->request_q);
633
634 return rc;
635 }
636
637 int
638 SendReceive(const unsigned int xid, struct cifsSesInfo *ses,
639 struct smb_hdr *in_buf, struct smb_hdr *out_buf,
640 int *pbytes_returned, const int long_op)
641 {
642 int rc = 0;
643 unsigned int receive_len;
644 unsigned long timeout;
645 struct mid_q_entry *midQ;
646
647 if (ses == NULL) {
648 cERROR(1,("Null smb session"));
649 return -EIO;
650 }
651 if(ses->server == NULL) {
652 cERROR(1,("Null tcp session"));
653 return -EIO;
654 }
655
656 if(ses->server->tcpStatus == CifsExiting)
657 return -ENOENT;
658
659 /* Ensure that we do not send more than 50 overlapping requests
660 to the same server. We may make this configurable later or
661 use ses->maxReq */
662
663 rc = wait_for_free_request(ses, long_op);
664 if (rc)
665 return rc;
666
667 /* make sure that we sign in the same order that we send on this socket
668 and avoid races inside tcp sendmsg code that could cause corruption
669 of smb data */
670
671 down(&ses->server->tcpSem);
672
673 rc = allocate_mid(ses, in_buf, &midQ);
674 if (rc) {
675 up(&ses->server->tcpSem);
676 /* Update # of requests on wire to server */
677 atomic_dec(&ses->server->inFlight);
678 wake_up(&ses->server->request_q);
679 return rc;
680 }
681
682 if (in_buf->smb_buf_length > CIFSMaxBufSize + MAX_CIFS_HDR_SIZE - 4) {
683 cERROR(1, ("Illegal length, greater than maximum frame, %d",
684 in_buf->smb_buf_length));
685 DeleteMidQEntry(midQ);
686 up(&ses->server->tcpSem);
687 /* Update # of requests on wire to server */
688 atomic_dec(&ses->server->inFlight);
689 wake_up(&ses->server->request_q);
690 return -EIO;
691 }
692
693 rc = cifs_sign_smb(in_buf, ses->server, &midQ->sequence_number);
694
695 midQ->midState = MID_REQUEST_SUBMITTED;
696 #ifdef CONFIG_CIFS_STATS2
697 atomic_inc(&ses->server->inSend);
698 #endif
699 rc = smb_send(ses->server->ssocket, in_buf, in_buf->smb_buf_length,
700 (struct sockaddr *) &(ses->server->addr.sockAddr));
701 #ifdef CONFIG_CIFS_STATS2
702 atomic_dec(&ses->server->inSend);
703 midQ->when_sent = jiffies;
704 #endif
705 up(&ses->server->tcpSem);
706
707 if(rc < 0)
708 goto out;
709
710 if (long_op == CIFS_STD_OP)
711 timeout = 15 * HZ;
712 /* wait for 15 seconds or until woken up due to response arriving or
713 due to last connection to this server being unmounted */
714 else if (long_op == CIFS_ASYNC_OP)
715 goto out;
716 else if (long_op == CIFS_VLONG_OP) /* writes past EOF can be slow */
717 timeout = 180 * HZ;
718 else if (long_op == CIFS_LONG_OP)
719 timeout = 45 * HZ; /* should be greater than
720 servers oplock break timeout (about 43 seconds) */
721 else if (long_op == CIFS_BLOCKING_OP)
722 timeout = 0x7FFFFFFF; /* large but no so large as to wrap */
723 else {
724 cERROR(1, ("unknown timeout flag %d", long_op));
725 rc = -EIO;
726 goto out;
727 }
728
729 if (signal_pending(current)) {
730 /* if signal pending do not hold up user for full smb timeout
731 but we still give response a chance to complete */
732 timeout = 2 * HZ;
733 }
734
735 /* No user interrupts in wait - wreaks havoc with performance */
736 wait_for_response(ses, midQ, timeout, 10 * HZ);
737
738 spin_lock(&GlobalMid_Lock);
739 if (midQ->resp_buf) {
740 spin_unlock(&GlobalMid_Lock);
741 receive_len = midQ->resp_buf->smb_buf_length;
742 } else {
743 cERROR(1,("No response for cmd %d mid %d",
744 midQ->command, midQ->mid));
745 if(midQ->midState == MID_REQUEST_SUBMITTED) {
746 if(ses->server->tcpStatus == CifsExiting)
747 rc = -EHOSTDOWN;
748 else {
749 ses->server->tcpStatus = CifsNeedReconnect;
750 midQ->midState = MID_RETRY_NEEDED;
751 }
752 }
753
754 if (rc != -EHOSTDOWN) {
755 if(midQ->midState == MID_RETRY_NEEDED) {
756 rc = -EAGAIN;
757 cFYI(1,("marking request for retry"));
758 } else {
759 rc = -EIO;
760 }
761 }
762 spin_unlock(&GlobalMid_Lock);
763 DeleteMidQEntry(midQ);
764 /* Update # of requests on wire to server */
765 atomic_dec(&ses->server->inFlight);
766 wake_up(&ses->server->request_q);
767 return rc;
768 }
769
770 if (receive_len > CIFSMaxBufSize + MAX_CIFS_HDR_SIZE) {
771 cERROR(1, ("Frame too large received. Length: %d Xid: %d",
772 receive_len, xid));
773 rc = -EIO;
774 } else { /* rcvd frame is ok */
775
776 if (midQ->resp_buf && out_buf
777 && (midQ->midState == MID_RESPONSE_RECEIVED)) {
778 out_buf->smb_buf_length = receive_len;
779 memcpy((char *)out_buf + 4,
780 (char *)midQ->resp_buf + 4,
781 receive_len);
782
783 dump_smb(out_buf, 92);
784 /* convert the length into a more usable form */
785 if((receive_len > 24) &&
786 (ses->server->secMode & (SECMODE_SIGN_REQUIRED |
787 SECMODE_SIGN_ENABLED))) {
788 rc = cifs_verify_signature(out_buf,
789 ses->server->mac_signing_key,
790 midQ->sequence_number+1);
791 if(rc) {
792 cERROR(1,("Unexpected SMB signature"));
793 /* BB FIXME add code to kill session */
794 }
795 }
796
797 *pbytes_returned = out_buf->smb_buf_length;
798
799 /* BB special case reconnect tid and uid here? */
800 rc = map_smb_to_linux_error(out_buf);
801
802 /* convert ByteCount if necessary */
803 if (receive_len >=
804 sizeof (struct smb_hdr) -
805 4 /* do not count RFC1001 header */ +
806 (2 * out_buf->WordCount) + 2 /* bcc */ )
807 BCC(out_buf) = le16_to_cpu(BCC_LE(out_buf));
808 } else {
809 rc = -EIO;
810 cERROR(1,("Bad MID state?"));
811 }
812 }
813
814 out:
815 DeleteMidQEntry(midQ);
816 atomic_dec(&ses->server->inFlight);
817 wake_up(&ses->server->request_q);
818
819 return rc;
820 }
821
822 /* Send an NT_CANCEL SMB to cause the POSIX blocking lock to return. */
823
824 static int
825 send_nt_cancel(struct cifsTconInfo *tcon, struct smb_hdr *in_buf,
826 struct mid_q_entry *midQ)
827 {
828 int rc = 0;
829 struct cifsSesInfo *ses = tcon->ses;
830 __u16 mid = in_buf->Mid;
831
832 header_assemble(in_buf, SMB_COM_NT_CANCEL, tcon, 0);
833 in_buf->Mid = mid;
834 down(&ses->server->tcpSem);
835 rc = cifs_sign_smb(in_buf, ses->server, &midQ->sequence_number);
836 if (rc) {
837 up(&ses->server->tcpSem);
838 return rc;
839 }
840 rc = smb_send(ses->server->ssocket, in_buf, in_buf->smb_buf_length,
841 (struct sockaddr *) &(ses->server->addr.sockAddr));
842 up(&ses->server->tcpSem);
843 return rc;
844 }
845
846 /* We send a LOCKINGX_CANCEL_LOCK to cause the Windows
847 blocking lock to return. */
848
849 static int
850 send_lock_cancel(const unsigned int xid, struct cifsTconInfo *tcon,
851 struct smb_hdr *in_buf,
852 struct smb_hdr *out_buf)
853 {
854 int bytes_returned;
855 struct cifsSesInfo *ses = tcon->ses;
856 LOCK_REQ *pSMB = (LOCK_REQ *)in_buf;
857
858 /* We just modify the current in_buf to change
859 the type of lock from LOCKING_ANDX_SHARED_LOCK
860 or LOCKING_ANDX_EXCLUSIVE_LOCK to
861 LOCKING_ANDX_CANCEL_LOCK. */
862
863 pSMB->LockType = LOCKING_ANDX_CANCEL_LOCK|LOCKING_ANDX_LARGE_FILES;
864 pSMB->Timeout = 0;
865 pSMB->hdr.Mid = GetNextMid(ses->server);
866
867 return SendReceive(xid, ses, in_buf, out_buf,
868 &bytes_returned, CIFS_STD_OP);
869 }
870
871 int
872 SendReceiveBlockingLock(const unsigned int xid, struct cifsTconInfo *tcon,
873 struct smb_hdr *in_buf, struct smb_hdr *out_buf,
874 int *pbytes_returned)
875 {
876 int rc = 0;
877 int rstart = 0;
878 unsigned int receive_len;
879 struct mid_q_entry *midQ;
880 struct cifsSesInfo *ses;
881
882 if (tcon == NULL || tcon->ses == NULL) {
883 cERROR(1,("Null smb session"));
884 return -EIO;
885 }
886 ses = tcon->ses;
887
888 if(ses->server == NULL) {
889 cERROR(1,("Null tcp session"));
890 return -EIO;
891 }
892
893 if(ses->server->tcpStatus == CifsExiting)
894 return -ENOENT;
895
896 /* Ensure that we do not send more than 50 overlapping requests
897 to the same server. We may make this configurable later or
898 use ses->maxReq */
899
900 rc = wait_for_free_request(ses, CIFS_BLOCKING_OP);
901 if (rc)
902 return rc;
903
904 /* make sure that we sign in the same order that we send on this socket
905 and avoid races inside tcp sendmsg code that could cause corruption
906 of smb data */
907
908 down(&ses->server->tcpSem);
909
910 rc = allocate_mid(ses, in_buf, &midQ);
911 if (rc) {
912 up(&ses->server->tcpSem);
913 return rc;
914 }
915
916 if (in_buf->smb_buf_length > CIFSMaxBufSize + MAX_CIFS_HDR_SIZE - 4) {
917 up(&ses->server->tcpSem);
918 cERROR(1, ("Illegal length, greater than maximum frame, %d",
919 in_buf->smb_buf_length));
920 DeleteMidQEntry(midQ);
921 return -EIO;
922 }
923
924 rc = cifs_sign_smb(in_buf, ses->server, &midQ->sequence_number);
925
926 midQ->midState = MID_REQUEST_SUBMITTED;
927 #ifdef CONFIG_CIFS_STATS2
928 atomic_inc(&ses->server->inSend);
929 #endif
930 rc = smb_send(ses->server->ssocket, in_buf, in_buf->smb_buf_length,
931 (struct sockaddr *) &(ses->server->addr.sockAddr));
932 #ifdef CONFIG_CIFS_STATS2
933 atomic_dec(&ses->server->inSend);
934 midQ->when_sent = jiffies;
935 #endif
936 up(&ses->server->tcpSem);
937
938 if(rc < 0) {
939 DeleteMidQEntry(midQ);
940 return rc;
941 }
942
943 /* Wait for a reply - allow signals to interrupt. */
944 rc = wait_event_interruptible(ses->server->response_q,
945 (!(midQ->midState == MID_REQUEST_SUBMITTED)) ||
946 ((ses->server->tcpStatus != CifsGood) &&
947 (ses->server->tcpStatus != CifsNew)));
948
949 /* Were we interrupted by a signal ? */
950 if ((rc == -ERESTARTSYS) &&
951 (midQ->midState == MID_REQUEST_SUBMITTED) &&
952 ((ses->server->tcpStatus == CifsGood) ||
953 (ses->server->tcpStatus == CifsNew))) {
954
955 if (in_buf->Command == SMB_COM_TRANSACTION2) {
956 /* POSIX lock. We send a NT_CANCEL SMB to cause the
957 blocking lock to return. */
958
959 rc = send_nt_cancel(tcon, in_buf, midQ);
960 if (rc) {
961 DeleteMidQEntry(midQ);
962 return rc;
963 }
964 } else {
965 /* Windows lock. We send a LOCKINGX_CANCEL_LOCK
966 to cause the blocking lock to return. */
967
968 rc = send_lock_cancel(xid, tcon, in_buf, out_buf);
969
970 /* If we get -ENOLCK back the lock may have
971 already been removed. Don't exit in this case. */
972 if (rc && rc != -ENOLCK) {
973 DeleteMidQEntry(midQ);
974 return rc;
975 }
976 }
977
978 /* Wait 5 seconds for the response. */
979 if (wait_for_response(ses, midQ, 5 * HZ, 5 * HZ)==0) {
980 /* We got the response - restart system call. */
981 rstart = 1;
982 }
983 }
984
985 spin_lock(&GlobalMid_Lock);
986 if (midQ->resp_buf) {
987 spin_unlock(&GlobalMid_Lock);
988 receive_len = midQ->resp_buf->smb_buf_length;
989 } else {
990 cERROR(1,("No response for cmd %d mid %d",
991 midQ->command, midQ->mid));
992 if(midQ->midState == MID_REQUEST_SUBMITTED) {
993 if(ses->server->tcpStatus == CifsExiting)
994 rc = -EHOSTDOWN;
995 else {
996 ses->server->tcpStatus = CifsNeedReconnect;
997 midQ->midState = MID_RETRY_NEEDED;
998 }
999 }
1000
1001 if (rc != -EHOSTDOWN) {
1002 if(midQ->midState == MID_RETRY_NEEDED) {
1003 rc = -EAGAIN;
1004 cFYI(1,("marking request for retry"));
1005 } else {
1006 rc = -EIO;
1007 }
1008 }
1009 spin_unlock(&GlobalMid_Lock);
1010 DeleteMidQEntry(midQ);
1011 return rc;
1012 }
1013
1014 if (receive_len > CIFSMaxBufSize + MAX_CIFS_HDR_SIZE) {
1015 cERROR(1, ("Frame too large received. Length: %d Xid: %d",
1016 receive_len, xid));
1017 rc = -EIO;
1018 } else { /* rcvd frame is ok */
1019
1020 if (midQ->resp_buf && out_buf
1021 && (midQ->midState == MID_RESPONSE_RECEIVED)) {
1022 out_buf->smb_buf_length = receive_len;
1023 memcpy((char *)out_buf + 4,
1024 (char *)midQ->resp_buf + 4,
1025 receive_len);
1026
1027 dump_smb(out_buf, 92);
1028 /* convert the length into a more usable form */
1029 if((receive_len > 24) &&
1030 (ses->server->secMode & (SECMODE_SIGN_REQUIRED |
1031 SECMODE_SIGN_ENABLED))) {
1032 rc = cifs_verify_signature(out_buf,
1033 ses->server->mac_signing_key,
1034 midQ->sequence_number+1);
1035 if(rc) {
1036 cERROR(1,("Unexpected SMB signature"));
1037 /* BB FIXME add code to kill session */
1038 }
1039 }
1040
1041 *pbytes_returned = out_buf->smb_buf_length;
1042
1043 /* BB special case reconnect tid and uid here? */
1044 rc = map_smb_to_linux_error(out_buf);
1045
1046 /* convert ByteCount if necessary */
1047 if (receive_len >=
1048 sizeof (struct smb_hdr) -
1049 4 /* do not count RFC1001 header */ +
1050 (2 * out_buf->WordCount) + 2 /* bcc */ )
1051 BCC(out_buf) = le16_to_cpu(BCC_LE(out_buf));
1052 } else {
1053 rc = -EIO;
1054 cERROR(1,("Bad MID state?"));
1055 }
1056 }
1057 DeleteMidQEntry(midQ);
1058 if (rstart && rc == -EACCES)
1059 return -ERESTARTSYS;
1060 return rc;
1061 }
linux v2.6.22.y-op