fs/cifs/connect.c

   1 /*
   2  *   fs/cifs/connect.c
   3  *
   4  *   Copyright (C) International Business Machines  Corp., 2002,2009
   5  *   Author(s): Steve French (sfrench@us.ibm.com)
   6  *
   7  *   This library is free software; you can redistribute it and/or modify
   8  *   it under the terms of the GNU Lesser General Public License as published
   9  *   by the Free Software Foundation; either version 2.1 of the License, or
  10  *   (at your option) any later version.
  11  *
  12  *   This library is distributed in the hope that it will be useful,
  13  *   but WITHOUT ANY WARRANTY; without even the implied warranty of
  14  *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See
  15  *   the GNU Lesser General Public License for more details.
  16  *
  17  *   You should have received a copy of the GNU Lesser General Public License
  18  *   along with this library; if not, write to the Free Software
  19  *   Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
  20  */
  21 #include <linux/fs.h>
  22 #include <linux/net.h>
  23 #include <linux/string.h>
  24 #include <linux/list.h>
  25 #include <linux/wait.h>
  26 #include <linux/slab.h>
  27 #include <linux/pagemap.h>
  28 #include <linux/ctype.h>
  29 #include <linux/utsname.h>
  30 #include <linux/mempool.h>
  31 #include <linux/delay.h>
  32 #include <linux/completion.h>
  33 #include <linux/kthread.h>
  34 #include <linux/pagevec.h>
  35 #include <linux/freezer.h>
  36 #include <linux/namei.h>
  37 #include <asm/uaccess.h>
  38 #include <asm/processor.h>
  39 #include <linux/inet.h>
  40 #include <net/ipv6.h>
  41 #include "cifspdu.h"
  42 #include "cifsglob.h"
  43 #include "cifsproto.h"
  44 #include "cifs_unicode.h"
  45 #include "cifs_debug.h"
  46 #include "cifs_fs_sb.h"
  47 #include "ntlmssp.h"
  48 #include "nterr.h"
  49 #include "rfc1002pdu.h"
  50 #include "fscache.h"
  51
  52 #define CIFS_PORT 445
  53 #define RFC1001_PORT 139
  54
  55 /* SMB echo "timeout" -- FIXME: tunable? */
  56 #define SMB_ECHO_INTERVAL (60 * HZ)
  57
  58 extern void SMBNTencrypt(unsigned char *passwd, unsigned char *c8,
  59                          unsigned char *p24);
  60
  61 extern mempool_t *cifs_req_poolp;
  62
  63 struct smb_vol {
  64         char *username;
  65         char *password;
  66         char *domainname;
  67         char *UNC;
  68         char *UNCip;
  69         char *iocharset;  /* local code page for mapping to and from Unicode */
  70         char source_rfc1001_name[RFC1001_NAME_LEN_WITH_NULL]; /* clnt nb name */
  71         char target_rfc1001_name[RFC1001_NAME_LEN_WITH_NULL]; /* srvr nb name */
  72         uid_t cred_uid;
  73         uid_t linux_uid;
  74         gid_t linux_gid;
  75         mode_t file_mode;
  76         mode_t dir_mode;
  77         unsigned secFlg;
  78         bool retry:1;
  79         bool intr:1;
  80         bool setuids:1;
  81         bool override_uid:1;
  82         bool override_gid:1;
  83         bool dynperm:1;
  84         bool noperm:1;
  85         bool no_psx_acl:1; /* set if posix acl support should be disabled */
  86         bool cifs_acl:1;
  87         bool no_xattr:1;   /* set if xattr (EA) support should be disabled*/
  88         bool server_ino:1; /* use inode numbers from server ie UniqueId */
  89         bool direct_io:1;
  90         bool remap:1;      /* set to remap seven reserved chars in filenames */
  91         bool posix_paths:1; /* unset to not ask for posix pathnames. */
  92         bool no_linux_ext:1;
  93         bool sfu_emul:1;
  94         bool nullauth:1;   /* attempt to authenticate with null user */
  95         bool nocase:1;     /* request case insensitive filenames */
  96         bool nobrl:1;      /* disable sending byte range locks to srv */
  97         bool mand_lock:1;  /* send mandatory not posix byte range lock reqs */
  98         bool seal:1;       /* request transport encryption on share */
  99         bool nodfs:1;      /* Do not request DFS, even if available */
 100         bool local_lease:1; /* check leases only on local system, not remote */
 101         bool noblocksnd:1;
 102         bool noautotune:1;
 103         bool nostrictsync:1; /* do not force expensive SMBflush on every sync */
 104         bool fsc:1;     /* enable fscache */
 105         bool mfsymlinks:1; /* use Minshall+French Symlinks */
 106         bool multiuser:1;
 107         unsigned int rsize;
 108         unsigned int wsize;
 109         bool sockopt_tcp_nodelay:1;
 110         unsigned short int port;
 111         unsigned long actimeo; /* attribute cache timeout (jiffies) */
 112         char *prepath;
 113         struct sockaddr_storage srcaddr; /* allow binding to a local IP */
 114         struct nls_table *local_nls;
 115 };
 116
 117 /* FIXME: should these be tunable? */
 118 #define TLINK_ERROR_EXPIRE      (1 * HZ)
 119 #define TLINK_IDLE_EXPIRE       (600 * HZ)
 120
 121 static int ip_connect(struct TCP_Server_Info *server);
 122 static int generic_ip_connect(struct TCP_Server_Info *server);
 123 static void tlink_rb_insert(struct rb_root *root, struct tcon_link *new_tlink);
 124 static void cifs_prune_tlinks(struct work_struct *work);
 125
 126 /*
 127  * cifs tcp session reconnection
 128  *
 129  * mark tcp session as reconnecting so temporarily locked
 130  * mark all smb sessions as reconnecting for tcp session
 131  * reconnect tcp session
 132  * wake up waiters on reconnection? - (not needed currently)
 133  */
 134 static int
 135 cifs_reconnect(struct TCP_Server_Info *server)
 136 {
 137         int rc = 0;
 138         struct list_head *tmp, *tmp2;
 139         struct cifsSesInfo *ses;
 140         struct cifsTconInfo *tcon;
 141         struct mid_q_entry *mid_entry;
 142
 143         spin_lock(&GlobalMid_Lock);
 144         if (server->tcpStatus == CifsExiting) {
 145                 /* the demux thread will exit normally
 146                 next time through the loop */
 147                 spin_unlock(&GlobalMid_Lock);
 148                 return rc;
 149         } else
 150                 server->tcpStatus = CifsNeedReconnect;
 151         spin_unlock(&GlobalMid_Lock);
 152         server->maxBuf = 0;
 153
 154         cFYI(1, "Reconnecting tcp session");
 155
 156         /* before reconnecting the tcp session, mark the smb session (uid)
 157                 and the tid bad so they are not used until reconnected */
 158         cFYI(1, "%s: marking sessions and tcons for reconnect", __func__);
 159         spin_lock(&cifs_tcp_ses_lock);
 160         list_for_each(tmp, &server->smb_ses_list) {
 161                 ses = list_entry(tmp, struct cifsSesInfo, smb_ses_list);
 162                 ses->need_reconnect = true;
 163                 ses->ipc_tid = 0;
 164                 list_for_each(tmp2, &ses->tcon_list) {
 165                         tcon = list_entry(tmp2, struct cifsTconInfo, tcon_list);
 166                         tcon->need_reconnect = true;
 167                 }
 168         }
 169         spin_unlock(&cifs_tcp_ses_lock);
 170
 171         /* do not want to be sending data on a socket we are freeing */
 172         cFYI(1, "%s: tearing down socket", __func__);
 173         mutex_lock(&server->srv_mutex);
 174         if (server->ssocket) {
 175                 cFYI(1, "State: 0x%x Flags: 0x%lx", server->ssocket->state,
 176                         server->ssocket->flags);
 177                 kernel_sock_shutdown(server->ssocket, SHUT_WR);
 178                 cFYI(1, "Post shutdown state: 0x%x Flags: 0x%lx",
 179                         server->ssocket->state,
 180                         server->ssocket->flags);
 181                 sock_release(server->ssocket);
 182                 server->ssocket = NULL;
 183         }
 184         server->sequence_number = 0;
 185         server->session_estab = false;
 186         kfree(server->session_key.response);
 187         server->session_key.response = NULL;
 188         server->session_key.len = 0;
 189         server->lstrp = jiffies;
 190         mutex_unlock(&server->srv_mutex);
 191
 192         /* mark submitted MIDs for retry and issue callback */
 193         cFYI(1, "%s: issuing mid callbacks", __func__);
 194         spin_lock(&GlobalMid_Lock);
 195         list_for_each_safe(tmp, tmp2, &server->pending_mid_q) {
 196                 mid_entry = list_entry(tmp, struct mid_q_entry, qhead);
 197                 if (mid_entry->midState == MID_REQUEST_SUBMITTED)
 198                         mid_entry->midState = MID_RETRY_NEEDED;
 199                 list_del_init(&mid_entry->qhead);
 200                 mid_entry->callback(mid_entry);
 201         }
 202         spin_unlock(&GlobalMid_Lock);
 203
 204         while ((server->tcpStatus != CifsExiting) &&
 205                (server->tcpStatus != CifsGood)) {
 206                 try_to_freeze();
 207
 208                 /* we should try only the port we connected to before */
 209                 rc = generic_ip_connect(server);
 210                 if (rc) {
 211                         cFYI(1, "reconnect error %d", rc);
 212                         msleep(3000);
 213                 } else {
 214                         atomic_inc(&tcpSesReconnectCount);
 215                         spin_lock(&GlobalMid_Lock);
 216                         if (server->tcpStatus != CifsExiting)
 217                                 server->tcpStatus = CifsGood;
 218                         spin_unlock(&GlobalMid_Lock);
 219                 }
 220         }
 221
 222         return rc;
 223 }
 224
 225 /*
 226         return codes:
 227                 0       not a transact2, or all data present
 228                 >0      transact2 with that much data missing
 229                 -EINVAL = invalid transact2
 230
 231  */
 232 static int check2ndT2(struct smb_hdr *pSMB, unsigned int maxBufSize)
 233 {
 234         struct smb_t2_rsp *pSMBt;
 235         int remaining;
 236         __u16 total_data_size, data_in_this_rsp;
 237
 238         if (pSMB->Command != SMB_COM_TRANSACTION2)
 239                 return 0;
 240
 241         /* check for plausible wct, bcc and t2 data and parm sizes */
 242         /* check for parm and data offset going beyond end of smb */
 243         if (pSMB->WordCount != 10) { /* coalesce_t2 depends on this */
 244                 cFYI(1, "invalid transact2 word count");
 245                 return -EINVAL;
 246         }
 247
 248         pSMBt = (struct smb_t2_rsp *)pSMB;
 249
 250         total_data_size = get_unaligned_le16(&pSMBt->t2_rsp.TotalDataCount);
 251         data_in_this_rsp = get_unaligned_le16(&pSMBt->t2_rsp.DataCount);
 252
 253         remaining = total_data_size - data_in_this_rsp;
 254
 255         if (remaining == 0)
 256                 return 0;
 257         else if (remaining < 0) {
 258                 cFYI(1, "total data %d smaller than data in frame %d",
 259                         total_data_size, data_in_this_rsp);
 260                 return -EINVAL;
 261         } else {
 262                 cFYI(1, "missing %d bytes from transact2, check next response",
 263                         remaining);
 264                 if (total_data_size > maxBufSize) {
 265                         cERROR(1, "TotalDataSize %d is over maximum buffer %d",
 266                                 total_data_size, maxBufSize);
 267                         return -EINVAL;
 268                 }
 269                 return remaining;
 270         }
 271 }
 272
 273 static int coalesce_t2(struct smb_hdr *psecond, struct smb_hdr *pTargetSMB)
 274 {
 275         struct smb_t2_rsp *pSMB2 = (struct smb_t2_rsp *)psecond;
 276         struct smb_t2_rsp *pSMBt  = (struct smb_t2_rsp *)pTargetSMB;
 277         char *data_area_of_target;
 278         char *data_area_of_buf2;
 279         int remaining;
 280         __u16 byte_count, total_data_size, total_in_buf, total_in_buf2;
 281
 282         total_data_size = get_unaligned_le16(&pSMBt->t2_rsp.TotalDataCount);
 283
 284         if (total_data_size !=
 285             get_unaligned_le16(&pSMB2->t2_rsp.TotalDataCount))
 286                 cFYI(1, "total data size of primary and secondary t2 differ");
 287
 288         total_in_buf = get_unaligned_le16(&pSMBt->t2_rsp.DataCount);
 289
 290         remaining = total_data_size - total_in_buf;
 291
 292         if (remaining < 0)
 293                 return -EINVAL;
 294
 295         if (remaining == 0) /* nothing to do, ignore */
 296                 return 0;
 297
 298         total_in_buf2 = get_unaligned_le16(&pSMB2->t2_rsp.DataCount);
 299         if (remaining < total_in_buf2) {
 300                 cFYI(1, "transact2 2nd response contains too much data");
 301         }
 302
 303         /* find end of first SMB data area */
 304         data_area_of_target = (char *)&pSMBt->hdr.Protocol +
 305                                 get_unaligned_le16(&pSMBt->t2_rsp.DataOffset);
 306         /* validate target area */
 307
 308         data_area_of_buf2 = (char *)&pSMB2->hdr.Protocol +
 309                                 get_unaligned_le16(&pSMB2->t2_rsp.DataOffset);
 310
 311         data_area_of_target += total_in_buf;
 312
 313         /* copy second buffer into end of first buffer */
 314         memcpy(data_area_of_target, data_area_of_buf2, total_in_buf2);
 315         total_in_buf += total_in_buf2;
 316         put_unaligned_le16(total_in_buf, &pSMBt->t2_rsp.DataCount);
 317         byte_count = get_bcc_le(pTargetSMB);
 318         byte_count += total_in_buf2;
 319         put_bcc_le(byte_count, pTargetSMB);
 320
 321         byte_count = pTargetSMB->smb_buf_length;
 322         byte_count += total_in_buf2;
 323
 324         /* BB also add check that we are not beyond maximum buffer size */
 325
 326         pTargetSMB->smb_buf_length = byte_count;
 327
 328         if (remaining == total_in_buf2) {
 329                 cFYI(1, "found the last secondary response");
 330                 return 0; /* we are done */
 331         } else /* more responses to go */
 332                 return 1;
 333 }
 334
 335 static void
 336 cifs_echo_request(struct work_struct *work)
 337 {
 338         int rc;
 339         struct TCP_Server_Info *server = container_of(work,
 340                                         struct TCP_Server_Info, echo.work);
 341
 342         /* no need to ping if we got a response recently */
 343         if (time_before(jiffies, server->lstrp + SMB_ECHO_INTERVAL - HZ))
 344                 goto requeue_echo;
 345
 346         rc = CIFSSMBEcho(server);
 347         if (rc)
 348                 cFYI(1, "Unable to send echo request to server: %s",
 349                         server->hostname);
 350
 351 requeue_echo:
 352         queue_delayed_work(system_nrt_wq, &server->echo, SMB_ECHO_INTERVAL);
 353 }
 354
 355 static int
 356 cifs_demultiplex_thread(struct TCP_Server_Info *server)
 357 {
 358         int length;
 359         unsigned int pdu_length, total_read;
 360         struct smb_hdr *smb_buffer = NULL;
 361         struct smb_hdr *bigbuf = NULL;
 362         struct smb_hdr *smallbuf = NULL;
 363         struct msghdr smb_msg;
 364         struct kvec iov;
 365         struct socket *csocket = server->ssocket;
 366         struct list_head *tmp, *tmp2;
 367         struct task_struct *task_to_wake = NULL;
 368         struct mid_q_entry *mid_entry;
 369         char temp;
 370         bool isLargeBuf = false;
 371         bool isMultiRsp;
 372         int reconnect;
 373
 374         current->flags |= PF_MEMALLOC;
 375         cFYI(1, "Demultiplex PID: %d", task_pid_nr(current));
 376
 377         length = atomic_inc_return(&tcpSesAllocCount);
 378         if (length > 1)
 379                 mempool_resize(cifs_req_poolp, length + cifs_min_rcv,
 380                                 GFP_KERNEL);
 381
 382         set_freezable();
 383         while (server->tcpStatus != CifsExiting) {
 384                 if (try_to_freeze())
 385                         continue;
 386                 if (bigbuf == NULL) {
 387                         bigbuf = cifs_buf_get();
 388                         if (!bigbuf) {
 389                                 cERROR(1, "No memory for large SMB response");
 390                                 msleep(3000);
 391                                 /* retry will check if exiting */
 392                                 continue;
 393                         }
 394                 } else if (isLargeBuf) {
 395                         /* we are reusing a dirty large buf, clear its start */
 396                         memset(bigbuf, 0, sizeof(struct smb_hdr));
 397                 }
 398
 399                 if (smallbuf == NULL) {
 400                         smallbuf = cifs_small_buf_get();
 401                         if (!smallbuf) {
 402                                 cERROR(1, "No memory for SMB response");
 403                                 msleep(1000);
 404                                 /* retry will check if exiting */
 405                                 continue;
 406                         }
 407                         /* beginning of smb buffer is cleared in our buf_get */
 408                 } else /* if existing small buf clear beginning */
 409                         memset(smallbuf, 0, sizeof(struct smb_hdr));
 410
 411                 isLargeBuf = false;
 412                 isMultiRsp = false;
 413                 smb_buffer = smallbuf;
 414                 iov.iov_base = smb_buffer;
 415                 iov.iov_len = 4;
 416                 smb_msg.msg_control = NULL;
 417                 smb_msg.msg_controllen = 0;
 418                 pdu_length = 4; /* enough to get RFC1001 header */
 419
 420 incomplete_rcv:
 421                 if (echo_retries > 0 &&
 422                     time_after(jiffies, server->lstrp +
 423                                         (echo_retries * SMB_ECHO_INTERVAL))) {
 424                         cERROR(1, "Server %s has not responded in %d seconds. "
 425                                   "Reconnecting...", server->hostname,
 426                                   (echo_retries * SMB_ECHO_INTERVAL / HZ));
 427                         cifs_reconnect(server);
 428                         csocket = server->ssocket;
 429                         wake_up(&server->response_q);
 430                         continue;
 431                 }
 432
 433                 length =
 434                     kernel_recvmsg(csocket, &smb_msg,
 435                                 &iov, 1, pdu_length, 0 /* BB other flags? */);
 436
 437                 if (server->tcpStatus == CifsExiting) {
 438                         break;
 439                 } else if (server->tcpStatus == CifsNeedReconnect) {
 440                         cFYI(1, "Reconnect after server stopped responding");
 441                         cifs_reconnect(server);
 442                         cFYI(1, "call to reconnect done");
 443                         csocket = server->ssocket;
 444                         continue;
 445                 } else if (length == -ERESTARTSYS ||
 446                            length == -EAGAIN ||
 447                            length == -EINTR) {
 448                         msleep(1); /* minimum sleep to prevent looping
 449                                 allowing socket to clear and app threads to set
 450                                 tcpStatus CifsNeedReconnect if server hung */
 451                         if (pdu_length < 4) {
 452                                 iov.iov_base = (4 - pdu_length) +
 453                                                         (char *)smb_buffer;
 454                                 iov.iov_len = pdu_length;
 455                                 smb_msg.msg_control = NULL;
 456                                 smb_msg.msg_controllen = 0;
 457                                 goto incomplete_rcv;
 458                         } else
 459                                 continue;
 460                 } else if (length <= 0) {
 461                         cFYI(1, "Reconnect after unexpected peek error %d",
 462                                 length);
 463                         cifs_reconnect(server);
 464                         csocket = server->ssocket;
 465                         wake_up(&server->response_q);
 466                         continue;
 467                 } else if (length < pdu_length) {
 468                         cFYI(1, "requested %d bytes but only got %d bytes",
 469                                   pdu_length, length);
 470                         pdu_length -= length;
 471                         msleep(1);
 472                         goto incomplete_rcv;
 473                 }
 474
 475                 /* The right amount was read from socket - 4 bytes */
 476                 /* so we can now interpret the length field */
 477
 478                 /* the first byte big endian of the length field,
 479                 is actually not part of the length but the type
 480                 with the most common, zero, as regular data */
 481                 temp = *((char *) smb_buffer);
 482
 483                 /* Note that FC 1001 length is big endian on the wire,
 484                 but we convert it here so it is always manipulated
 485                 as host byte order */
 486                 pdu_length = be32_to_cpu((__force __be32)smb_buffer->smb_buf_length);
 487                 smb_buffer->smb_buf_length = pdu_length;
 488
 489                 cFYI(1, "rfc1002 length 0x%x", pdu_length+4);
 490
 491                 if (temp == (char) RFC1002_SESSION_KEEP_ALIVE) {
 492                         continue;
 493                 } else if (temp == (char)RFC1002_POSITIVE_SESSION_RESPONSE) {
 494                         cFYI(1, "Good RFC 1002 session rsp");
 495                         continue;
 496                 } else if (temp == (char)RFC1002_NEGATIVE_SESSION_RESPONSE) {
 497                         /* we get this from Windows 98 instead of
 498                            an error on SMB negprot response */
 499                         cFYI(1, "Negative RFC1002 Session Response Error 0x%x)",
 500                                 pdu_length);
 501                         /* give server a second to clean up  */
 502                         msleep(1000);
 503                         /* always try 445 first on reconnect since we get NACK
 504                          * on some if we ever connected to port 139 (the NACK
 505                          * is since we do not begin with RFC1001 session
 506                          * initialize frame)
 507                          */
 508                         cifs_set_port((struct sockaddr *)
 509                                         &server->dstaddr, CIFS_PORT);
 510                         cifs_reconnect(server);
 511                         csocket = server->ssocket;
 512                         wake_up(&server->response_q);
 513                         continue;
 514                 } else if (temp != (char) 0) {
 515                         cERROR(1, "Unknown RFC 1002 frame");
 516                         cifs_dump_mem(" Received Data: ", (char *)smb_buffer,
 517                                       length);
 518                         cifs_reconnect(server);
 519                         csocket = server->ssocket;
 520                         continue;
 521                 }
 522
 523                 /* else we have an SMB response */
 524                 if ((pdu_length > CIFSMaxBufSize + MAX_CIFS_HDR_SIZE - 4) ||
 525                             (pdu_length < sizeof(struct smb_hdr) - 1 - 4)) {
 526                         cERROR(1, "Invalid size SMB length %d pdu_length %d",
 527                                         length, pdu_length+4);
 528                         cifs_reconnect(server);
 529                         csocket = server->ssocket;
 530                         wake_up(&server->response_q);
 531                         continue;
 532                 }
 533
 534                 /* else length ok */
 535                 reconnect = 0;
 536
 537                 if (pdu_length > MAX_CIFS_SMALL_BUFFER_SIZE - 4) {
 538                         isLargeBuf = true;
 539                         memcpy(bigbuf, smallbuf, 4);
 540                         smb_buffer = bigbuf;
 541                 }
 542                 length = 0;
 543                 iov.iov_base = 4 + (char *)smb_buffer;
 544                 iov.iov_len = pdu_length;
 545                 for (total_read = 0; total_read < pdu_length;
 546                      total_read += length) {
 547                         length = kernel_recvmsg(csocket, &smb_msg, &iov, 1,
 548                                                 pdu_length - total_read, 0);
 549                         if (server->tcpStatus == CifsExiting) {
 550                                 /* then will exit */
 551                                 reconnect = 2;
 552                                 break;
 553                         } else if (server->tcpStatus == CifsNeedReconnect) {
 554                                 cifs_reconnect(server);
 555                                 csocket = server->ssocket;
 556                                 /* Reconnect wakes up rspns q */
 557                                 /* Now we will reread sock */
 558                                 reconnect = 1;
 559                                 break;
 560                         } else if (length == -ERESTARTSYS ||
 561                                    length == -EAGAIN ||
 562                                    length == -EINTR) {
 563                                 msleep(1); /* minimum sleep to prevent looping,
 564                                               allowing socket to clear and app
 565                                               threads to set tcpStatus
 566                                               CifsNeedReconnect if server hung*/
 567                                 length = 0;
 568                                 continue;
 569                         } else if (length <= 0) {
 570                                 cERROR(1, "Received no data, expecting %d",
 571                                               pdu_length - total_read);
 572                                 cifs_reconnect(server);
 573                                 csocket = server->ssocket;
 574                                 reconnect = 1;
 575                                 break;
 576                         }
 577                 }
 578                 if (reconnect == 2)
 579                         break;
 580                 else if (reconnect == 1)
 581                         continue;
 582
 583                 length += 4; /* account for rfc1002 hdr */
 584
 585
 586                 dump_smb(smb_buffer, length);
 587                 if (checkSMB(smb_buffer, smb_buffer->Mid, total_read+4)) {
 588                         cifs_dump_mem("Bad SMB: ", smb_buffer, 48);
 589                         continue;
 590                 }
 591
 592                 mid_entry = NULL;
 593                 server->lstrp = jiffies;
 594
 595                 spin_lock(&GlobalMid_Lock);
 596                 list_for_each_safe(tmp, tmp2, &server->pending_mid_q) {
 597                         mid_entry = list_entry(tmp, struct mid_q_entry, qhead);
 598
 599                         if ((mid_entry->mid == smb_buffer->Mid) &&
 600                             (mid_entry->midState == MID_REQUEST_SUBMITTED) &&
 601                             (mid_entry->command == smb_buffer->Command)) {
 602                                 if (check2ndT2(smb_buffer,server->maxBuf) > 0) {
 603                                         /* We have a multipart transact2 resp */
 604                                         isMultiRsp = true;
 605                                         if (mid_entry->resp_buf) {
 606                                                 /* merge response - fix up 1st*/
 607                                                 if (coalesce_t2(smb_buffer,
 608                                                         mid_entry->resp_buf)) {
 609                                                         mid_entry->multiRsp =
 610                                                                  true;
 611                                                         break;
 612                                                 } else {
 613                                                         /* all parts received */
 614                                                         mid_entry->multiEnd =
 615                                                                  true;
 616                                                         goto multi_t2_fnd;
 617                                                 }
 618                                         } else {
 619                                                 if (!isLargeBuf) {
 620                                                         cERROR(1, "1st trans2 resp needs bigbuf");
 621                                         /* BB maybe we can fix this up,  switch
 622                                            to already allocated large buffer? */
 623                                                 } else {
 624                                                         /* Have first buffer */
 625                                                         mid_entry->resp_buf =
 626                                                                  smb_buffer;
 627                                                         mid_entry->largeBuf =
 628                                                                  true;
 629                                                         bigbuf = NULL;
 630                                                 }
 631                                         }
 632                                         break;
 633                                 }
 634                                 mid_entry->resp_buf = smb_buffer;
 635                                 mid_entry->largeBuf = isLargeBuf;
 636 multi_t2_fnd:
 637                                 mid_entry->midState = MID_RESPONSE_RECEIVED;
 638                                 list_del_init(&mid_entry->qhead);
 639                                 mid_entry->callback(mid_entry);
 640 #ifdef CONFIG_CIFS_STATS2
 641                                 mid_entry->when_received = jiffies;
 642 #endif
 643                                 break;
 644                         }
 645                         mid_entry = NULL;
 646                 }
 647                 spin_unlock(&GlobalMid_Lock);
 648
 649                 if (mid_entry != NULL) {
 650                         /* Was previous buf put in mpx struct for multi-rsp? */
 651                         if (!isMultiRsp) {
 652                                 /* smb buffer will be freed by user thread */
 653                                 if (isLargeBuf)
 654                                         bigbuf = NULL;
 655                                 else
 656                                         smallbuf = NULL;
 657                         }
 658                 } else if (!is_valid_oplock_break(smb_buffer, server) &&
 659                            !isMultiRsp) {
 660                         cERROR(1, "No task to wake, unknown frame received! "
 661                                    "NumMids %d", atomic_read(&midCount));
 662                         cifs_dump_mem("Received Data is: ", (char *)smb_buffer,
 663                                       sizeof(struct smb_hdr));
 664 #ifdef CONFIG_CIFS_DEBUG2
 665                         cifs_dump_detail(smb_buffer);
 666                         cifs_dump_mids(server);
 667 #endif /* CIFS_DEBUG2 */
 668
 669                 }
 670         } /* end while !EXITING */
 671
 672         /* take it off the list, if it's not already */
 673         spin_lock(&cifs_tcp_ses_lock);
 674         list_del_init(&server->tcp_ses_list);
 675         spin_unlock(&cifs_tcp_ses_lock);
 676
 677         spin_lock(&GlobalMid_Lock);
 678         server->tcpStatus = CifsExiting;
 679         spin_unlock(&GlobalMid_Lock);
 680         wake_up_all(&server->response_q);
 681
 682         /* check if we have blocked requests that need to free */
 683         /* Note that cifs_max_pending is normally 50, but
 684         can be set at module install time to as little as two */
 685         spin_lock(&GlobalMid_Lock);
 686         if (atomic_read(&server->inFlight) >= cifs_max_pending)
 687                 atomic_set(&server->inFlight, cifs_max_pending - 1);
 688         /* We do not want to set the max_pending too low or we
 689         could end up with the counter going negative */
 690         spin_unlock(&GlobalMid_Lock);
 691         /* Although there should not be any requests blocked on
 692         this queue it can not hurt to be paranoid and try to wake up requests
 693         that may haven been blocked when more than 50 at time were on the wire
 694         to the same server - they now will see the session is in exit state
 695         and get out of SendReceive.  */
 696         wake_up_all(&server->request_q);
 697         /* give those requests time to exit */
 698         msleep(125);
 699
 700         if (server->ssocket) {
 701                 sock_release(csocket);
 702                 server->ssocket = NULL;
 703         }
 704         /* buffer usuallly freed in free_mid - need to free it here on exit */
 705         cifs_buf_release(bigbuf);
 706         if (smallbuf) /* no sense logging a debug message if NULL */
 707                 cifs_small_buf_release(smallbuf);
 708
 709         if (!list_empty(&server->pending_mid_q)) {
 710                 spin_lock(&GlobalMid_Lock);
 711                 list_for_each_safe(tmp, tmp2, &server->pending_mid_q) {
 712                         mid_entry = list_entry(tmp, struct mid_q_entry, qhead);
 713                         cFYI(1, "Clearing Mid 0x%x - issuing callback",
 714                                          mid_entry->mid);
 715                         list_del_init(&mid_entry->qhead);
 716                         mid_entry->callback(mid_entry);
 717                 }
 718                 spin_unlock(&GlobalMid_Lock);
 719                 /* 1/8th of sec is more than enough time for them to exit */
 720                 msleep(125);
 721         }
 722
 723         if (!list_empty(&server->pending_mid_q)) {
 724                 /* mpx threads have not exited yet give them
 725                 at least the smb send timeout time for long ops */
 726                 /* due to delays on oplock break requests, we need
 727                 to wait at least 45 seconds before giving up
 728                 on a request getting a response and going ahead
 729                 and killing cifsd */
 730                 cFYI(1, "Wait for exit from demultiplex thread");
 731                 msleep(46000);
 732                 /* if threads still have not exited they are probably never
 733                 coming home not much else we can do but free the memory */
 734         }
 735
 736         kfree(server->hostname);
 737         task_to_wake = xchg(&server->tsk, NULL);
 738         kfree(server);
 739
 740         length = atomic_dec_return(&tcpSesAllocCount);
 741         if (length  > 0)
 742                 mempool_resize(cifs_req_poolp, length + cifs_min_rcv,
 743                                 GFP_KERNEL);
 744
 745         /* if server->tsk was NULL then wait for a signal before exiting */
 746         if (!task_to_wake) {
 747                 set_current_state(TASK_INTERRUPTIBLE);
 748                 while (!signal_pending(current)) {
 749                         schedule();
 750                         set_current_state(TASK_INTERRUPTIBLE);
 751                 }
 752                 set_current_state(TASK_RUNNING);
 753         }
 754
 755         module_put_and_exit(0);
 756 }
 757
 758 /* extract the host portion of the UNC string */
 759 static char *
 760 extract_hostname(const char *unc)
 761 {
 762         const char *src;
 763         char *dst, *delim;
 764         unsigned int len;
 765
 766         /* skip double chars at beginning of string */
 767         /* BB: check validity of these bytes? */
 768         src = unc + 2;
 769
 770         /* delimiter between hostname and sharename is always '\\' now */
 771         delim = strchr(src, '\\');
 772         if (!delim)
 773                 return ERR_PTR(-EINVAL);
 774
 775         len = delim - src;
 776         dst = kmalloc((len + 1), GFP_KERNEL);
 777         if (dst == NULL)
 778                 return ERR_PTR(-ENOMEM);
 779
 780         memcpy(dst, src, len);
 781         dst[len] = '\0';
 782
 783         return dst;
 784 }
 785
 786 static int
 787 cifs_parse_mount_options(char *options, const char *devname,
 788                          struct smb_vol *vol)
 789 {
 790         char *value;
 791         char *data;
 792         unsigned int  temp_len, i, j;
 793         char separator[2];
 794         short int override_uid = -1;
 795         short int override_gid = -1;
 796         bool uid_specified = false;
 797         bool gid_specified = false;
 798         char *nodename = utsname()->nodename;
 799
 800         separator[0] = ',';
 801         separator[1] = 0;
 802
 803         /*
 804          * does not have to be perfect mapping since field is
 805          * informational, only used for servers that do not support
 806          * port 445 and it can be overridden at mount time
 807          */
 808         memset(vol->source_rfc1001_name, 0x20, RFC1001_NAME_LEN);
 809         for (i = 0; i < strnlen(nodename, RFC1001_NAME_LEN); i++)
 810                 vol->source_rfc1001_name[i] = toupper(nodename[i]);
 811
 812         vol->source_rfc1001_name[RFC1001_NAME_LEN] = 0;
 813         /* null target name indicates to use *SMBSERVR default called name
 814            if we end up sending RFC1001 session initialize */
 815         vol->target_rfc1001_name[0] = 0;
 816         vol->cred_uid = current_uid();
 817         vol->linux_uid = current_uid();
 818         vol->linux_gid = current_gid();
 819
 820         /* default to only allowing write access to owner of the mount */
 821         vol->dir_mode = vol->file_mode = S_IRUGO | S_IXUGO | S_IWUSR;
 822
 823         /* vol->retry default is 0 (i.e. "soft" limited retry not hard retry) */
 824         /* default is always to request posix paths. */
 825         vol->posix_paths = 1;
 826         /* default to using server inode numbers where available */
 827         vol->server_ino = 1;
 828
 829         vol->actimeo = CIFS_DEF_ACTIMEO;
 830
 831         if (!options)
 832                 return 1;
 833
 834         if (strncmp(options, "sep=", 4) == 0) {
 835                 if (options[4] != 0) {
 836                         separator[0] = options[4];
 837                         options += 5;
 838                 } else {
 839                         cFYI(1, "Null separator not allowed");
 840                 }
 841         }
 842
 843         while ((data = strsep(&options, separator)) != NULL) {
 844                 if (!*data)
 845                         continue;
 846                 if ((value = strchr(data, '=')) != NULL)
 847                         *value++ = '\0';
 848
 849                 /* Have to parse this before we parse for "user" */
 850                 if (strnicmp(data, "user_xattr", 10) == 0) {
 851                         vol->no_xattr = 0;
 852                 } else if (strnicmp(data, "nouser_xattr", 12) == 0) {
 853                         vol->no_xattr = 1;
 854                 } else if (strnicmp(data, "user", 4) == 0) {
 855                         if (!value) {
 856                                 printk(KERN_WARNING
 857                                        "CIFS: invalid or missing username\n");
 858                                 return 1;       /* needs_arg; */
 859                         } else if (!*value) {
 860                                 /* null user, ie anonymous, authentication */
 861                                 vol->nullauth = 1;
 862                         }
 863                         if (strnlen(value, 200) < 200) {
 864                                 vol->username = value;
 865                         } else {
 866                                 printk(KERN_WARNING "CIFS: username too long\n");
 867                                 return 1;
 868                         }
 869                 } else if (strnicmp(data, "pass", 4) == 0) {
 870                         if (!value) {
 871                                 vol->password = NULL;
 872                                 continue;
 873                         } else if (value[0] == 0) {
 874                                 /* check if string begins with double comma
 875                                    since that would mean the password really
 876                                    does start with a comma, and would not
 877                                    indicate an empty string */
 878                                 if (value[1] != separator[0]) {
 879                                         vol->password = NULL;
 880                                         continue;
 881                                 }
 882                         }
 883                         temp_len = strlen(value);
 884                         /* removed password length check, NTLM passwords
 885                                 can be arbitrarily long */
 886
 887                         /* if comma in password, the string will be
 888                         prematurely null terminated.  Commas in password are
 889                         specified across the cifs mount interface by a double
 890                         comma ie ,, and a comma used as in other cases ie ','
 891                         as a parameter delimiter/separator is single and due
 892                         to the strsep above is temporarily zeroed. */
 893
 894                         /* NB: password legally can have multiple commas and
 895                         the only illegal character in a password is null */
 896
 897                         if ((value[temp_len] == 0) &&
 898                             (value[temp_len+1] == separator[0])) {
 899                                 /* reinsert comma */
 900                                 value[temp_len] = separator[0];
 901                                 temp_len += 2;  /* move after second comma */
 902                                 while (value[temp_len] != 0)  {
 903                                         if (value[temp_len] == separator[0]) {
 904                                                 if (value[temp_len+1] ==
 905                                                      separator[0]) {
 906                                                 /* skip second comma */
 907                                                         temp_len++;
 908                                                 } else {
 909                                                 /* single comma indicating start
 910                                                          of next parm */
 911                                                         break;
 912                                                 }
 913                                         }
 914                                         temp_len++;
 915                                 }
 916                                 if (value[temp_len] == 0) {
 917                                         options = NULL;
 918                                 } else {
 919                                         value[temp_len] = 0;
 920                                         /* point option to start of next parm */
 921                                         options = value + temp_len + 1;
 922                                 }
 923                                 /* go from value to value + temp_len condensing
 924                                 double commas to singles. Note that this ends up
 925                                 allocating a few bytes too many, which is ok */
 926                                 vol->password = kzalloc(temp_len, GFP_KERNEL);
 927                                 if (vol->password == NULL) {
 928                                         printk(KERN_WARNING "CIFS: no memory "
 929                                                             "for password\n");
 930                                         return 1;
 931                                 }
 932                                 for (i = 0, j = 0; i < temp_len; i++, j++) {
 933                                         vol->password[j] = value[i];
 934                                         if (value[i] == separator[0]
 935                                                 && value[i+1] == separator[0]) {
 936                                                 /* skip second comma */
 937                                                 i++;
 938                                         }
 939                                 }
 940                                 vol->password[j] = 0;
 941                         } else {
 942                                 vol->password = kzalloc(temp_len+1, GFP_KERNEL);
 943                                 if (vol->password == NULL) {
 944                                         printk(KERN_WARNING "CIFS: no memory "
 945                                                             "for password\n");
 946                                         return 1;
 947                                 }
 948                                 strcpy(vol->password, value);
 949                         }
 950                 } else if (!strnicmp(data, "ip", 2) ||
 951                            !strnicmp(data, "addr", 4)) {
 952                         if (!value || !*value) {
 953                                 vol->UNCip = NULL;
 954                         } else if (strnlen(value, INET6_ADDRSTRLEN) <
 955                                                         INET6_ADDRSTRLEN) {
 956                                 vol->UNCip = value;
 957                         } else {
 958                                 printk(KERN_WARNING "CIFS: ip address "
 959                                                     "too long\n");
 960                                 return 1;
 961                         }
 962                 } else if (strnicmp(data, "sec", 3) == 0) {
 963                         if (!value || !*value) {
 964                                 cERROR(1, "no security value specified");
 965                                 continue;
 966                         } else if (strnicmp(value, "krb5i", 5) == 0) {
 967                                 vol->secFlg |= CIFSSEC_MAY_KRB5 |
 968                                         CIFSSEC_MUST_SIGN;
 969                         } else if (strnicmp(value, "krb5p", 5) == 0) {
 970                                 /* vol->secFlg |= CIFSSEC_MUST_SEAL |
 971                                         CIFSSEC_MAY_KRB5; */
 972                                 cERROR(1, "Krb5 cifs privacy not supported");
 973                                 return 1;
 974                         } else if (strnicmp(value, "krb5", 4) == 0) {
 975                                 vol->secFlg |= CIFSSEC_MAY_KRB5;
 976                         } else if (strnicmp(value, "ntlmsspi", 8) == 0) {
 977                                 vol->secFlg |= CIFSSEC_MAY_NTLMSSP |
 978                                         CIFSSEC_MUST_SIGN;
 979                         } else if (strnicmp(value, "ntlmssp", 7) == 0) {
 980                                 vol->secFlg |= CIFSSEC_MAY_NTLMSSP;
 981                         } else if (strnicmp(value, "ntlmv2i", 7) == 0) {
 982                                 vol->secFlg |= CIFSSEC_MAY_NTLMV2 |
 983                                         CIFSSEC_MUST_SIGN;
 984                         } else if (strnicmp(value, "ntlmv2", 6) == 0) {
 985                                 vol->secFlg |= CIFSSEC_MAY_NTLMV2;
 986                         } else if (strnicmp(value, "ntlmi", 5) == 0) {
 987                                 vol->secFlg |= CIFSSEC_MAY_NTLM |
 988                                         CIFSSEC_MUST_SIGN;
 989                         } else if (strnicmp(value, "ntlm", 4) == 0) {
 990                                 /* ntlm is default so can be turned off too */
 991                                 vol->secFlg |= CIFSSEC_MAY_NTLM;
 992                         } else if (strnicmp(value, "nontlm", 6) == 0) {
 993                                 /* BB is there a better way to do this? */
 994                                 vol->secFlg |= CIFSSEC_MAY_NTLMV2;
 995 #ifdef CONFIG_CIFS_WEAK_PW_HASH
 996                         } else if (strnicmp(value, "lanman", 6) == 0) {
 997                                 vol->secFlg |= CIFSSEC_MAY_LANMAN;
 998 #endif
 999                         } else if (strnicmp(value, "none", 4) == 0) {
1000                                 vol->nullauth = 1;
1001                         } else {
1002                                 cERROR(1, "bad security option: %s", value);
1003                                 return 1;
1004                         }
1005                 } else if ((strnicmp(data, "unc", 3) == 0)
1006                            || (strnicmp(data, "target", 6) == 0)
1007                            || (strnicmp(data, "path", 4) == 0)) {
1008                         if (!value || !*value) {
1009                                 printk(KERN_WARNING "CIFS: invalid path to "
1010                                                     "network resource\n");
1011                                 return 1;       /* needs_arg; */
1012                         }
1013                         if ((temp_len = strnlen(value, 300)) < 300) {
1014                                 vol->UNC = kmalloc(temp_len+1, GFP_KERNEL);
1015                                 if (vol->UNC == NULL)
1016                                         return 1;
1017                                 strcpy(vol->UNC, value);
1018                                 if (strncmp(vol->UNC, "//", 2) == 0) {
1019                                         vol->UNC[0] = '\\';
1020                                         vol->UNC[1] = '\\';
1021                                 } else if (strncmp(vol->UNC, "\\\\", 2) != 0) {
1022                                         printk(KERN_WARNING
1023                                                "CIFS: UNC Path does not begin "
1024                                                "with // or \\\\ \n");
1025                                         return 1;
1026                                 }
1027                         } else {
1028                                 printk(KERN_WARNING "CIFS: UNC name too long\n");
1029                                 return 1;
1030                         }
1031                 } else if ((strnicmp(data, "domain", 3) == 0)
1032                            || (strnicmp(data, "workgroup", 5) == 0)) {
1033                         if (!value || !*value) {
1034                                 printk(KERN_WARNING "CIFS: invalid domain name\n");
1035                                 return 1;       /* needs_arg; */
1036                         }
1037                         /* BB are there cases in which a comma can be valid in
1038                         a domain name and need special handling? */
1039                         if (strnlen(value, 256) < 256) {
1040                                 vol->domainname = value;
1041                                 cFYI(1, "Domain name set");
1042                         } else {
1043                                 printk(KERN_WARNING "CIFS: domain name too "
1044                                                     "long\n");
1045                                 return 1;
1046                         }
1047                 } else if (strnicmp(data, "srcaddr", 7) == 0) {
1048                         vol->srcaddr.ss_family = AF_UNSPEC;
1049
1050                         if (!value || !*value) {
1051                                 printk(KERN_WARNING "CIFS: srcaddr value"
1052                                        " not specified.\n");
1053                                 return 1;       /* needs_arg; */
1054                         }
1055                         i = cifs_convert_address((struct sockaddr *)&vol->srcaddr,
1056                                                  value, strlen(value));
1057                         if (i == 0) {
1058                                 printk(KERN_WARNING "CIFS:  Could not parse"
1059                                        " srcaddr: %s\n",
1060                                        value);
1061                                 return 1;
1062                         }
1063                 } else if (strnicmp(data, "prefixpath", 10) == 0) {
1064                         if (!value || !*value) {
1065                                 printk(KERN_WARNING
1066                                         "CIFS: invalid path prefix\n");
1067                                 return 1;       /* needs_argument */
1068                         }
1069                         if ((temp_len = strnlen(value, 1024)) < 1024) {
1070                                 if (value[0] != '/')
1071                                         temp_len++;  /* missing leading slash */
1072                                 vol->prepath = kmalloc(temp_len+1, GFP_KERNEL);
1073                                 if (vol->prepath == NULL)
1074                                         return 1;
1075                                 if (value[0] != '/') {
1076                                         vol->prepath[0] = '/';
1077                                         strcpy(vol->prepath+1, value);
1078                                 } else
1079                                         strcpy(vol->prepath, value);
1080                                 cFYI(1, "prefix path %s", vol->prepath);
1081                         } else {
1082                                 printk(KERN_WARNING "CIFS: prefix too long\n");
1083                                 return 1;
1084                         }
1085                 } else if (strnicmp(data, "iocharset", 9) == 0) {
1086                         if (!value || !*value) {
1087                                 printk(KERN_WARNING "CIFS: invalid iocharset "
1088                                                     "specified\n");
1089                                 return 1;       /* needs_arg; */
1090                         }
1091                         if (strnlen(value, 65) < 65) {
1092                                 if (strnicmp(value, "default", 7))
1093                                         vol->iocharset = value;
1094                                 /* if iocharset not set then load_nls_default
1095                                    is used by caller */
1096                                 cFYI(1, "iocharset set to %s", value);
1097                         } else {
1098                                 printk(KERN_WARNING "CIFS: iocharset name "
1099                                                     "too long.\n");
1100                                 return 1;
1101                         }
1102                 } else if (!strnicmp(data, "uid", 3) && value && *value) {
1103                         vol->linux_uid = simple_strtoul(value, &value, 0);
1104                         uid_specified = true;
1105                 } else if (!strnicmp(data, "cruid", 5) && value && *value) {
1106                         vol->cred_uid = simple_strtoul(value, &value, 0);
1107                 } else if (!strnicmp(data, "forceuid", 8)) {
1108                         override_uid = 1;
1109                 } else if (!strnicmp(data, "noforceuid", 10)) {
1110                         override_uid = 0;
1111                 } else if (!strnicmp(data, "gid", 3) && value && *value) {
1112                         vol->linux_gid = simple_strtoul(value, &value, 0);
1113                         gid_specified = true;
1114                 } else if (!strnicmp(data, "forcegid", 8)) {
1115                         override_gid = 1;
1116                 } else if (!strnicmp(data, "noforcegid", 10)) {
1117                         override_gid = 0;
1118                 } else if (strnicmp(data, "file_mode", 4) == 0) {
1119                         if (value && *value) {
1120                                 vol->file_mode =
1121                                         simple_strtoul(value, &value, 0);
1122                         }
1123                 } else if (strnicmp(data, "dir_mode", 4) == 0) {
1124                         if (value && *value) {
1125                                 vol->dir_mode =
1126                                         simple_strtoul(value, &value, 0);
1127                         }
1128                 } else if (strnicmp(data, "dirmode", 4) == 0) {
1129                         if (value && *value) {
1130                                 vol->dir_mode =
1131                                         simple_strtoul(value, &value, 0);
1132                         }
1133                 } else if (strnicmp(data, "port", 4) == 0) {
1134                         if (value && *value) {
1135                                 vol->port =
1136                                         simple_strtoul(value, &value, 0);
1137                         }
1138                 } else if (strnicmp(data, "rsize", 5) == 0) {
1139                         if (value && *value) {
1140                                 vol->rsize =
1141                                         simple_strtoul(value, &value, 0);
1142                         }
1143                 } else if (strnicmp(data, "wsize", 5) == 0) {
1144                         if (value && *value) {
1145                                 vol->wsize =
1146                                         simple_strtoul(value, &value, 0);
1147                         }
1148                 } else if (strnicmp(data, "sockopt", 5) == 0) {
1149                         if (!value || !*value) {
1150                                 cERROR(1, "no socket option specified");
1151                                 continue;
1152                         } else if (strnicmp(value, "TCP_NODELAY", 11) == 0) {
1153                                 vol->sockopt_tcp_nodelay = 1;
1154                         }
1155                 } else if (strnicmp(data, "netbiosname", 4) == 0) {
1156                         if (!value || !*value || (*value == ' ')) {
1157                                 cFYI(1, "invalid (empty) netbiosname");
1158                         } else {
1159                                 memset(vol->source_rfc1001_name, 0x20,
1160                                         RFC1001_NAME_LEN);
1161                                 /*
1162                                  * FIXME: are there cases in which a comma can
1163                                  * be valid in workstation netbios name (and
1164                                  * need special handling)?
1165                                  */
1166                                 for (i = 0; i < RFC1001_NAME_LEN; i++) {
1167                                         /* don't ucase netbiosname for user */
1168                                         if (value[i] == 0)
1169                                                 break;
1170                                         vol->source_rfc1001_name[i] = value[i];
1171                                 }
1172                                 /* The string has 16th byte zero still from
1173                                 set at top of the function  */
1174                                 if (i == RFC1001_NAME_LEN && value[i] != 0)
1175                                         printk(KERN_WARNING "CIFS: netbiosname"
1176                                                 " longer than 15 truncated.\n");
1177                         }
1178                 } else if (strnicmp(data, "servern", 7) == 0) {
1179                         /* servernetbiosname specified override *SMBSERVER */
1180                         if (!value || !*value || (*value == ' ')) {
1181                                 cFYI(1, "empty server netbiosname specified");
1182                         } else {
1183                                 /* last byte, type, is 0x20 for servr type */
1184                                 memset(vol->target_rfc1001_name, 0x20,
1185                                         RFC1001_NAME_LEN_WITH_NULL);
1186
1187                                 for (i = 0; i < 15; i++) {
1188                                 /* BB are there cases in which a comma can be
1189                                    valid in this workstation netbios name
1190                                    (and need special handling)? */
1191
1192                                 /* user or mount helper must uppercase
1193                                    the netbiosname */
1194                                         if (value[i] == 0)
1195                                                 break;
1196                                         else
1197                                                 vol->target_rfc1001_name[i] =
1198                                                                 value[i];
1199                                 }
1200                                 /* The string has 16th byte zero still from
1201                                    set at top of the function  */
1202                                 if (i == RFC1001_NAME_LEN && value[i] != 0)
1203                                         printk(KERN_WARNING "CIFS: server net"
1204                                         "biosname longer than 15 truncated.\n");
1205                         }
1206                 } else if (strnicmp(data, "actimeo", 7) == 0) {
1207                         if (value && *value) {
1208                                 vol->actimeo = HZ * simple_strtoul(value,
1209                                                                    &value, 0);
1210                                 if (vol->actimeo > CIFS_MAX_ACTIMEO) {
1211                                         cERROR(1, "CIFS: attribute cache"
1212                                                         "timeout too large");
1213                                         return 1;
1214                                 }
1215                         }
1216                 } else if (strnicmp(data, "credentials", 4) == 0) {
1217                         /* ignore */
1218                 } else if (strnicmp(data, "version", 3) == 0) {
1219                         /* ignore */
1220                 } else if (strnicmp(data, "guest", 5) == 0) {
1221                         /* ignore */
1222                 } else if (strnicmp(data, "rw", 2) == 0) {
1223                         /* ignore */
1224                 } else if (strnicmp(data, "ro", 2) == 0) {
1225                         /* ignore */
1226                 } else if (strnicmp(data, "noblocksend", 11) == 0) {
1227                         vol->noblocksnd = 1;
1228                 } else if (strnicmp(data, "noautotune", 10) == 0) {
1229                         vol->noautotune = 1;
1230                 } else if ((strnicmp(data, "suid", 4) == 0) ||
1231                                    (strnicmp(data, "nosuid", 6) == 0) ||
1232                                    (strnicmp(data, "exec", 4) == 0) ||
1233                                    (strnicmp(data, "noexec", 6) == 0) ||
1234                                    (strnicmp(data, "nodev", 5) == 0) ||
1235                                    (strnicmp(data, "noauto", 6) == 0) ||
1236                                    (strnicmp(data, "dev", 3) == 0)) {
1237                         /*  The mount tool or mount.cifs helper (if present)
1238                             uses these opts to set flags, and the flags are read
1239                             by the kernel vfs layer before we get here (ie
1240                             before read super) so there is no point trying to
1241                             parse these options again and set anything and it
1242                             is ok to just ignore them */
1243                         continue;
1244                 } else if (strnicmp(data, "hard", 4) == 0) {
1245                         vol->retry = 1;
1246                 } else if (strnicmp(data, "soft", 4) == 0) {
1247                         vol->retry = 0;
1248                 } else if (strnicmp(data, "perm", 4) == 0) {
1249                         vol->noperm = 0;
1250                 } else if (strnicmp(data, "noperm", 6) == 0) {
1251                         vol->noperm = 1;
1252                 } else if (strnicmp(data, "mapchars", 8) == 0) {
1253                         vol->remap = 1;
1254                 } else if (strnicmp(data, "nomapchars", 10) == 0) {
1255                         vol->remap = 0;
1256                 } else if (strnicmp(data, "sfu", 3) == 0) {
1257                         vol->sfu_emul = 1;
1258                 } else if (strnicmp(data, "nosfu", 5) == 0) {
1259                         vol->sfu_emul = 0;
1260                 } else if (strnicmp(data, "nodfs", 5) == 0) {
1261                         vol->nodfs = 1;
1262                 } else if (strnicmp(data, "posixpaths", 10) == 0) {
1263                         vol->posix_paths = 1;
1264                 } else if (strnicmp(data, "noposixpaths", 12) == 0) {
1265                         vol->posix_paths = 0;
1266                 } else if (strnicmp(data, "nounix", 6) == 0) {
1267                         vol->no_linux_ext = 1;
1268                 } else if (strnicmp(data, "nolinux", 7) == 0) {
1269                         vol->no_linux_ext = 1;
1270                 } else if ((strnicmp(data, "nocase", 6) == 0) ||
1271                            (strnicmp(data, "ignorecase", 10)  == 0)) {
1272                         vol->nocase = 1;
1273                 } else if (strnicmp(data, "mand", 4) == 0) {
1274                         /* ignore */
1275                 } else if (strnicmp(data, "nomand", 6) == 0) {
1276                         /* ignore */
1277                 } else if (strnicmp(data, "_netdev", 7) == 0) {
1278                         /* ignore */
1279                 } else if (strnicmp(data, "brl", 3) == 0) {
1280                         vol->nobrl =  0;
1281                 } else if ((strnicmp(data, "nobrl", 5) == 0) ||
1282                            (strnicmp(data, "nolock", 6) == 0)) {
1283                         vol->nobrl =  1;
1284                         /* turn off mandatory locking in mode
1285                         if remote locking is turned off since the
1286                         local vfs will do advisory */
1287                         if (vol->file_mode ==
1288                                 (S_IALLUGO & ~(S_ISUID | S_IXGRP)))
1289                                 vol->file_mode = S_IALLUGO;
1290                 } else if (strnicmp(data, "forcemandatorylock", 9) == 0) {
1291                         /* will take the shorter form "forcemand" as well */
1292                         /* This mount option will force use of mandatory
1293                           (DOS/Windows style) byte range locks, instead of
1294                           using posix advisory byte range locks, even if the
1295                           Unix extensions are available and posix locks would
1296                           be supported otherwise. If Unix extensions are not
1297                           negotiated this has no effect since mandatory locks
1298                           would be used (mandatory locks is all that those
1299                           those servers support) */
1300                         vol->mand_lock = 1;
1301                 } else if (strnicmp(data, "setuids", 7) == 0) {
1302                         vol->setuids = 1;
1303                 } else if (strnicmp(data, "nosetuids", 9) == 0) {
1304                         vol->setuids = 0;
1305                 } else if (strnicmp(data, "dynperm", 7) == 0) {
1306                         vol->dynperm = true;
1307                 } else if (strnicmp(data, "nodynperm", 9) == 0) {
1308                         vol->dynperm = false;
1309                 } else if (strnicmp(data, "nohard", 6) == 0) {
1310                         vol->retry = 0;
1311                 } else if (strnicmp(data, "nosoft", 6) == 0) {
1312                         vol->retry = 1;
1313                 } else if (strnicmp(data, "nointr", 6) == 0) {
1314                         vol->intr = 0;
1315                 } else if (strnicmp(data, "intr", 4) == 0) {
1316                         vol->intr = 1;
1317                 } else if (strnicmp(data, "nostrictsync", 12) == 0) {
1318                         vol->nostrictsync = 1;
1319                 } else if (strnicmp(data, "strictsync", 10) == 0) {
1320                         vol->nostrictsync = 0;
1321                 } else if (strnicmp(data, "serverino", 7) == 0) {
1322                         vol->server_ino = 1;
1323                 } else if (strnicmp(data, "noserverino", 9) == 0) {
1324                         vol->server_ino = 0;
1325                 } else if (strnicmp(data, "cifsacl", 7) == 0) {
1326                         vol->cifs_acl = 1;
1327                 } else if (strnicmp(data, "nocifsacl", 9) == 0) {
1328                         vol->cifs_acl = 0;
1329                 } else if (strnicmp(data, "acl", 3) == 0) {
1330                         vol->no_psx_acl = 0;
1331                 } else if (strnicmp(data, "noacl", 5) == 0) {
1332                         vol->no_psx_acl = 1;
1333                 } else if (strnicmp(data, "locallease", 6) == 0) {
1334                         vol->local_lease = 1;
1335                 } else if (strnicmp(data, "sign", 4) == 0) {
1336                         vol->secFlg |= CIFSSEC_MUST_SIGN;
1337                 } else if (strnicmp(data, "seal", 4) == 0) {
1338                         /* we do not do the following in secFlags because seal
1339                            is a per tree connection (mount) not a per socket
1340                            or per-smb connection option in the protocol */
1341                         /* vol->secFlg |= CIFSSEC_MUST_SEAL; */
1342                         vol->seal = 1;
1343                 } else if (strnicmp(data, "direct", 6) == 0) {
1344                         vol->direct_io = 1;
1345                 } else if (strnicmp(data, "forcedirectio", 13) == 0) {
1346                         vol->direct_io = 1;
1347                 } else if (strnicmp(data, "noac", 4) == 0) {
1348                         printk(KERN_WARNING "CIFS: Mount option noac not "
1349                                 "supported. Instead set "
1350                                 "/proc/fs/cifs/LookupCacheEnabled to 0\n");
1351                 } else if (strnicmp(data, "fsc", 3) == 0) {
1352 #ifndef CONFIG_CIFS_FSCACHE
1353                         cERROR(1, "FS-Cache support needs CONFIG_CIFS_FSCACHE"
1354                                   "kernel config option set");
1355                         return 1;
1356 #endif
1357                         vol->fsc = true;
1358                 } else if (strnicmp(data, "mfsymlinks", 10) == 0) {
1359                         vol->mfsymlinks = true;
1360                 } else if (strnicmp(data, "multiuser", 8) == 0) {
1361                         vol->multiuser = true;
1362                 } else
1363                         printk(KERN_WARNING "CIFS: Unknown mount option %s\n",
1364                                                 data);
1365         }
1366         if (vol->UNC == NULL) {
1367                 if (devname == NULL) {
1368                         printk(KERN_WARNING "CIFS: Missing UNC name for mount "
1369                                                 "target\n");
1370                         return 1;
1371                 }
1372                 if ((temp_len = strnlen(devname, 300)) < 300) {
1373                         vol->UNC = kmalloc(temp_len+1, GFP_KERNEL);
1374                         if (vol->UNC == NULL)
1375                                 return 1;
1376                         strcpy(vol->UNC, devname);
1377                         if (strncmp(vol->UNC, "//", 2) == 0) {
1378                                 vol->UNC[0] = '\\';
1379                                 vol->UNC[1] = '\\';
1380                         } else if (strncmp(vol->UNC, "\\\\", 2) != 0) {
1381                                 printk(KERN_WARNING "CIFS: UNC Path does not "
1382                                                     "begin with // or \\\\ \n");
1383                                 return 1;
1384                         }
1385                         value = strpbrk(vol->UNC+2, "/\\");
1386                         if (value)
1387                                 *value = '\\';
1388                 } else {
1389                         printk(KERN_WARNING "CIFS: UNC name too long\n");
1390                         return 1;
1391                 }
1392         }
1393
1394         if (vol->multiuser && !(vol->secFlg & CIFSSEC_MAY_KRB5)) {
1395                 cERROR(1, "Multiuser mounts currently require krb5 "
1396                           "authentication!");
1397                 return 1;
1398         }
1399
1400         if (vol->UNCip == NULL)
1401                 vol->UNCip = &vol->UNC[2];
1402
1403         if (uid_specified)
1404                 vol->override_uid = override_uid;
1405         else if (override_uid == 1)
1406                 printk(KERN_NOTICE "CIFS: ignoring forceuid mount option "
1407                                    "specified with no uid= option.\n");
1408
1409         if (gid_specified)
1410                 vol->override_gid = override_gid;
1411         else if (override_gid == 1)
1412                 printk(KERN_NOTICE "CIFS: ignoring forcegid mount option "
1413                                    "specified with no gid= option.\n");
1414
1415         return 0;
1416 }
1417
1418 /** Returns true if srcaddr isn't specified and rhs isn't
1419  * specified, or if srcaddr is specified and
1420  * matches the IP address of the rhs argument.
1421  */
1422 static bool
1423 srcip_matches(struct sockaddr *srcaddr, struct sockaddr *rhs)
1424 {
1425         switch (srcaddr->sa_family) {
1426         case AF_UNSPEC:
1427                 return (rhs->sa_family == AF_UNSPEC);
1428         case AF_INET: {
1429                 struct sockaddr_in *saddr4 = (struct sockaddr_in *)srcaddr;
1430                 struct sockaddr_in *vaddr4 = (struct sockaddr_in *)rhs;
1431                 return (saddr4->sin_addr.s_addr == vaddr4->sin_addr.s_addr);
1432         }
1433         case AF_INET6: {
1434                 struct sockaddr_in6 *saddr6 = (struct sockaddr_in6 *)srcaddr;
1435                 struct sockaddr_in6 *vaddr6 = (struct sockaddr_in6 *)&rhs;
1436                 return ipv6_addr_equal(&saddr6->sin6_addr, &vaddr6->sin6_addr);
1437         }
1438         default:
1439                 WARN_ON(1);
1440                 return false; /* don't expect to be here */
1441         }
1442 }
1443
1444 /*
1445  * If no port is specified in addr structure, we try to match with 445 port
1446  * and if it fails - with 139 ports. It should be called only if address
1447  * families of server and addr are equal.
1448  */
1449 static bool
1450 match_port(struct TCP_Server_Info *server, struct sockaddr *addr)
1451 {
1452         unsigned short int port, *sport;
1453
1454         switch (addr->sa_family) {
1455         case AF_INET:
1456                 sport = &((struct sockaddr_in *) &server->dstaddr)->sin_port;
1457                 port = ((struct sockaddr_in *) addr)->sin_port;
1458                 break;
1459         case AF_INET6:
1460                 sport = &((struct sockaddr_in6 *) &server->dstaddr)->sin6_port;
1461                 port = ((struct sockaddr_in6 *) addr)->sin6_port;
1462                 break;
1463         default:
1464                 WARN_ON(1);
1465                 return false;
1466         }
1467
1468         if (!port) {
1469                 port = htons(CIFS_PORT);
1470                 if (port == *sport)
1471                         return true;
1472
1473                 port = htons(RFC1001_PORT);
1474         }
1475
1476         return port == *sport;
1477 }
1478
1479 static bool
1480 match_address(struct TCP_Server_Info *server, struct sockaddr *addr,
1481               struct sockaddr *srcaddr)
1482 {
1483         switch (addr->sa_family) {
1484         case AF_INET: {
1485                 struct sockaddr_in *addr4 = (struct sockaddr_in *)addr;
1486                 struct sockaddr_in *srv_addr4 =
1487                                         (struct sockaddr_in *)&server->dstaddr;
1488
1489                 if (addr4->sin_addr.s_addr != srv_addr4->sin_addr.s_addr)
1490                         return false;
1491                 break;
1492         }
1493         case AF_INET6: {
1494                 struct sockaddr_in6 *addr6 = (struct sockaddr_in6 *)addr;
1495                 struct sockaddr_in6 *srv_addr6 =
1496                                         (struct sockaddr_in6 *)&server->dstaddr;
1497
1498                 if (!ipv6_addr_equal(&addr6->sin6_addr,
1499                                      &srv_addr6->sin6_addr))
1500                         return false;
1501                 if (addr6->sin6_scope_id != srv_addr6->sin6_scope_id)
1502                         return false;
1503                 break;
1504         }
1505         default:
1506                 WARN_ON(1);
1507                 return false; /* don't expect to be here */
1508         }
1509
1510         if (!srcip_matches(srcaddr, (struct sockaddr *)&server->srcaddr))
1511                 return false;
1512
1513         return true;
1514 }
1515
1516 static bool
1517 match_security(struct TCP_Server_Info *server, struct smb_vol *vol)
1518 {
1519         unsigned int secFlags;
1520
1521         if (vol->secFlg & (~(CIFSSEC_MUST_SIGN | CIFSSEC_MUST_SEAL)))
1522                 secFlags = vol->secFlg;
1523         else
1524                 secFlags = global_secflags | vol->secFlg;
1525
1526         switch (server->secType) {
1527         case LANMAN:
1528                 if (!(secFlags & (CIFSSEC_MAY_LANMAN|CIFSSEC_MAY_PLNTXT)))
1529                         return false;
1530                 break;
1531         case NTLMv2:
1532                 if (!(secFlags & CIFSSEC_MAY_NTLMV2))
1533                         return false;
1534                 break;
1535         case NTLM:
1536                 if (!(secFlags & CIFSSEC_MAY_NTLM))
1537                         return false;
1538                 break;
1539         case Kerberos:
1540                 if (!(secFlags & CIFSSEC_MAY_KRB5))
1541                         return false;
1542                 break;
1543         case RawNTLMSSP:
1544                 if (!(secFlags & CIFSSEC_MAY_NTLMSSP))
1545                         return false;
1546                 break;
1547         default:
1548                 /* shouldn't happen */
1549                 return false;
1550         }
1551
1552         /* now check if signing mode is acceptible */
1553         if ((secFlags & CIFSSEC_MAY_SIGN) == 0 &&
1554             (server->secMode & SECMODE_SIGN_REQUIRED))
1555                         return false;
1556         else if (((secFlags & CIFSSEC_MUST_SIGN) == CIFSSEC_MUST_SIGN) &&
1557                  (server->secMode &
1558                   (SECMODE_SIGN_ENABLED|SECMODE_SIGN_REQUIRED)) == 0)
1559                         return false;
1560
1561         return true;
1562 }
1563
1564 static struct TCP_Server_Info *
1565 cifs_find_tcp_session(struct sockaddr *addr, struct smb_vol *vol)
1566 {
1567         struct TCP_Server_Info *server;
1568
1569         spin_lock(&cifs_tcp_ses_lock);
1570         list_for_each_entry(server, &cifs_tcp_ses_list, tcp_ses_list) {
1571                 if (!net_eq(cifs_net_ns(server), current->nsproxy->net_ns))
1572                         continue;
1573
1574                 if (!match_address(server, addr,
1575                                    (struct sockaddr *)&vol->srcaddr))
1576                         continue;
1577
1578                 if (!match_port(server, addr))
1579                         continue;
1580
1581                 if (!match_security(server, vol))
1582                         continue;
1583
1584                 ++server->srv_count;
1585                 spin_unlock(&cifs_tcp_ses_lock);
1586                 cFYI(1, "Existing tcp session with server found");
1587                 return server;
1588         }
1589         spin_unlock(&cifs_tcp_ses_lock);
1590         return NULL;
1591 }
1592
1593 static void
1594 cifs_put_tcp_session(struct TCP_Server_Info *server)
1595 {
1596         struct task_struct *task;
1597
1598         spin_lock(&cifs_tcp_ses_lock);
1599         if (--server->srv_count > 0) {
1600                 spin_unlock(&cifs_tcp_ses_lock);
1601                 return;
1602         }
1603
1604         put_net(cifs_net_ns(server));
1605
1606         list_del_init(&server->tcp_ses_list);
1607         spin_unlock(&cifs_tcp_ses_lock);
1608
1609         cancel_delayed_work_sync(&server->echo);
1610
1611         spin_lock(&GlobalMid_Lock);
1612         server->tcpStatus = CifsExiting;
1613         spin_unlock(&GlobalMid_Lock);
1614
1615         cifs_crypto_shash_release(server);
1616         cifs_fscache_release_client_cookie(server);
1617
1618         kfree(server->session_key.response);
1619         server->session_key.response = NULL;
1620         server->session_key.len = 0;
1621
1622         task = xchg(&server->tsk, NULL);
1623         if (task)
1624                 force_sig(SIGKILL, task);
1625 }
1626
1627 static struct TCP_Server_Info *
1628 cifs_get_tcp_session(struct smb_vol *volume_info)
1629 {
1630         struct TCP_Server_Info *tcp_ses = NULL;
1631         struct sockaddr_storage addr;
1632         struct sockaddr_in *sin_server = (struct sockaddr_in *) &addr;
1633         struct sockaddr_in6 *sin_server6 = (struct sockaddr_in6 *) &addr;
1634         int rc;
1635
1636         memset(&addr, 0, sizeof(struct sockaddr_storage));
1637
1638         cFYI(1, "UNC: %s ip: %s", volume_info->UNC, volume_info->UNCip);
1639
1640         if (volume_info->UNCip && volume_info->UNC) {
1641                 rc = cifs_fill_sockaddr((struct sockaddr *)&addr,
1642                                         volume_info->UNCip,
1643                                         strlen(volume_info->UNCip),
1644                                         volume_info->port);
1645                 if (!rc) {
1646                         /* we failed translating address */
1647                         rc = -EINVAL;
1648                         goto out_err;
1649                 }
1650         } else if (volume_info->UNCip) {
1651                 /* BB using ip addr as tcp_ses name to connect to the
1652                    DFS root below */
1653                 cERROR(1, "Connecting to DFS root not implemented yet");
1654                 rc = -EINVAL;
1655                 goto out_err;
1656         } else /* which tcp_sess DFS root would we conect to */ {
1657                 cERROR(1, "CIFS mount error: No UNC path (e.g. -o "
1658                         "unc=//192.168.1.100/public) specified");
1659                 rc = -EINVAL;
1660                 goto out_err;
1661         }
1662
1663         /* see if we already have a matching tcp_ses */
1664         tcp_ses = cifs_find_tcp_session((struct sockaddr *)&addr, volume_info);
1665         if (tcp_ses)
1666                 return tcp_ses;
1667
1668         tcp_ses = kzalloc(sizeof(struct TCP_Server_Info), GFP_KERNEL);
1669         if (!tcp_ses) {
1670                 rc = -ENOMEM;
1671                 goto out_err;
1672         }
1673
1674         rc = cifs_crypto_shash_allocate(tcp_ses);
1675         if (rc) {
1676                 cERROR(1, "could not setup hash structures rc %d", rc);
1677                 goto out_err;
1678         }
1679
1680         cifs_set_net_ns(tcp_ses, get_net(current->nsproxy->net_ns));
1681         tcp_ses->hostname = extract_hostname(volume_info->UNC);
1682         if (IS_ERR(tcp_ses->hostname)) {
1683                 rc = PTR_ERR(tcp_ses->hostname);
1684                 goto out_err_crypto_release;
1685         }
1686
1687         tcp_ses->noblocksnd = volume_info->noblocksnd;
1688         tcp_ses->noautotune = volume_info->noautotune;
1689         tcp_ses->tcp_nodelay = volume_info->sockopt_tcp_nodelay;
1690         atomic_set(&tcp_ses->inFlight, 0);
1691         init_waitqueue_head(&tcp_ses->response_q);
1692         init_waitqueue_head(&tcp_ses->request_q);
1693         INIT_LIST_HEAD(&tcp_ses->pending_mid_q);
1694         mutex_init(&tcp_ses->srv_mutex);
1695         memcpy(tcp_ses->workstation_RFC1001_name,
1696                 volume_info->source_rfc1001_name, RFC1001_NAME_LEN_WITH_NULL);
1697         memcpy(tcp_ses->server_RFC1001_name,
1698                 volume_info->target_rfc1001_name, RFC1001_NAME_LEN_WITH_NULL);
1699         tcp_ses->session_estab = false;
1700         tcp_ses->sequence_number = 0;
1701         tcp_ses->lstrp = jiffies;
1702         INIT_LIST_HEAD(&tcp_ses->tcp_ses_list);
1703         INIT_LIST_HEAD(&tcp_ses->smb_ses_list);
1704         INIT_DELAYED_WORK(&tcp_ses->echo, cifs_echo_request);
1705
1706         /*
1707          * at this point we are the only ones with the pointer
1708          * to the struct since the kernel thread not created yet
1709          * no need to spinlock this init of tcpStatus or srv_count
1710          */
1711         tcp_ses->tcpStatus = CifsNew;
1712         memcpy(&tcp_ses->srcaddr, &volume_info->srcaddr,
1713                sizeof(tcp_ses->srcaddr));
1714         ++tcp_ses->srv_count;
1715
1716         if (addr.ss_family == AF_INET6) {
1717                 cFYI(1, "attempting ipv6 connect");
1718                 /* BB should we allow ipv6 on port 139? */
1719                 /* other OS never observed in Wild doing 139 with v6 */
1720                 memcpy(&tcp_ses->dstaddr, sin_server6,
1721                        sizeof(struct sockaddr_in6));
1722         } else
1723                 memcpy(&tcp_ses->dstaddr, sin_server,
1724                        sizeof(struct sockaddr_in));
1725
1726         rc = ip_connect(tcp_ses);
1727         if (rc < 0) {
1728                 cERROR(1, "Error connecting to socket. Aborting operation");
1729                 goto out_err_crypto_release;
1730         }
1731
1732         /*
1733          * since we're in a cifs function already, we know that
1734          * this will succeed. No need for try_module_get().
1735          */
1736         __module_get(THIS_MODULE);
1737         tcp_ses->tsk = kthread_run((void *)(void *)cifs_demultiplex_thread,
1738                                   tcp_ses, "cifsd");
1739         if (IS_ERR(tcp_ses->tsk)) {
1740                 rc = PTR_ERR(tcp_ses->tsk);
1741                 cERROR(1, "error %d create cifsd thread", rc);
1742                 module_put(THIS_MODULE);
1743                 goto out_err_crypto_release;
1744         }
1745
1746         /* thread spawned, put it on the list */
1747         spin_lock(&cifs_tcp_ses_lock);
1748         list_add(&tcp_ses->tcp_ses_list, &cifs_tcp_ses_list);
1749         spin_unlock(&cifs_tcp_ses_lock);
1750
1751         cifs_fscache_get_client_cookie(tcp_ses);
1752
1753         /* queue echo request delayed work */
1754         queue_delayed_work(system_nrt_wq, &tcp_ses->echo, SMB_ECHO_INTERVAL);
1755
1756         return tcp_ses;
1757
1758 out_err_crypto_release:
1759         cifs_crypto_shash_release(tcp_ses);
1760
1761         put_net(cifs_net_ns(tcp_ses));
1762
1763 out_err:
1764         if (tcp_ses) {
1765                 if (!IS_ERR(tcp_ses->hostname))
1766                         kfree(tcp_ses->hostname);
1767                 if (tcp_ses->ssocket)
1768                         sock_release(tcp_ses->ssocket);
1769                 kfree(tcp_ses);
1770         }
1771         return ERR_PTR(rc);
1772 }
1773
1774 static struct cifsSesInfo *
1775 cifs_find_smb_ses(struct TCP_Server_Info *server, struct smb_vol *vol)
1776 {
1777         struct cifsSesInfo *ses;
1778
1779         spin_lock(&cifs_tcp_ses_lock);
1780         list_for_each_entry(ses, &server->smb_ses_list, smb_ses_list) {
1781                 switch (server->secType) {
1782                 case Kerberos:
1783                         if (vol->cred_uid != ses->cred_uid)
1784                                 continue;
1785                         break;
1786                 default:
1787                         /* anything else takes username/password */
1788                         if (strncmp(ses->userName, vol->username,
1789                                     MAX_USERNAME_SIZE))
1790                                 continue;
1791                         if (strlen(vol->username) != 0 &&
1792                             ses->password != NULL &&
1793                             strncmp(ses->password,
1794                                     vol->password ? vol->password : "",
1795                                     MAX_PASSWORD_SIZE))
1796                                 continue;
1797                 }
1798                 ++ses->ses_count;
1799                 spin_unlock(&cifs_tcp_ses_lock);
1800                 return ses;
1801         }
1802         spin_unlock(&cifs_tcp_ses_lock);
1803         return NULL;
1804 }
1805
1806 static void
1807 cifs_put_smb_ses(struct cifsSesInfo *ses)
1808 {
1809         int xid;
1810         struct TCP_Server_Info *server = ses->server;
1811
1812         cFYI(1, "%s: ses_count=%d\n", __func__, ses->ses_count);
1813         spin_lock(&cifs_tcp_ses_lock);
1814         if (--ses->ses_count > 0) {
1815                 spin_unlock(&cifs_tcp_ses_lock);
1816                 return;
1817         }
1818
1819         list_del_init(&ses->smb_ses_list);
1820         spin_unlock(&cifs_tcp_ses_lock);
1821
1822         if (ses->status == CifsGood) {
1823                 xid = GetXid();
1824                 CIFSSMBLogoff(xid, ses);
1825                 _FreeXid(xid);
1826         }
1827         sesInfoFree(ses);
1828         cifs_put_tcp_session(server);
1829 }
1830
1831 static struct cifsSesInfo *
1832 cifs_get_smb_ses(struct TCP_Server_Info *server, struct smb_vol *volume_info)
1833 {
1834         int rc = -ENOMEM, xid;
1835         struct cifsSesInfo *ses;
1836         struct sockaddr_in *addr = (struct sockaddr_in *)&server->dstaddr;
1837         struct sockaddr_in6 *addr6 = (struct sockaddr_in6 *)&server->dstaddr;
1838
1839         xid = GetXid();
1840
1841         ses = cifs_find_smb_ses(server, volume_info);
1842         if (ses) {
1843                 cFYI(1, "Existing smb sess found (status=%d)", ses->status);
1844
1845                 mutex_lock(&ses->session_mutex);
1846                 rc = cifs_negotiate_protocol(xid, ses);
1847                 if (rc) {
1848                         mutex_unlock(&ses->session_mutex);
1849                         /* problem -- put our ses reference */
1850                         cifs_put_smb_ses(ses);
1851                         FreeXid(xid);
1852                         return ERR_PTR(rc);
1853                 }
1854                 if (ses->need_reconnect) {
1855                         cFYI(1, "Session needs reconnect");
1856                         rc = cifs_setup_session(xid, ses,
1857                                                 volume_info->local_nls);
1858                         if (rc) {
1859                                 mutex_unlock(&ses->session_mutex);
1860                                 /* problem -- put our reference */
1861                                 cifs_put_smb_ses(ses);
1862                                 FreeXid(xid);
1863                                 return ERR_PTR(rc);
1864                         }
1865                 }
1866                 mutex_unlock(&ses->session_mutex);
1867
1868                 /* existing SMB ses has a server reference already */
1869                 cifs_put_tcp_session(server);
1870                 FreeXid(xid);
1871                 return ses;
1872         }
1873
1874         cFYI(1, "Existing smb sess not found");
1875         ses = sesInfoAlloc();
1876         if (ses == NULL)
1877                 goto get_ses_fail;
1878
1879         /* new SMB session uses our server ref */
1880         ses->server = server;
1881         if (server->dstaddr.ss_family == AF_INET6)
1882                 sprintf(ses->serverName, "%pI6", &addr6->sin6_addr);
1883         else
1884                 sprintf(ses->serverName, "%pI4", &addr->sin_addr);
1885
1886         if (volume_info->username)
1887                 strncpy(ses->userName, volume_info->username,
1888                         MAX_USERNAME_SIZE);
1889
1890         /* volume_info->password freed at unmount */
1891         if (volume_info->password) {
1892                 ses->password = kstrdup(volume_info->password, GFP_KERNEL);
1893                 if (!ses->password)
1894                         goto get_ses_fail;
1895         }
1896         if (volume_info->domainname) {
1897                 ses->domainName = kstrdup(volume_info->domainname, GFP_KERNEL);
1898                 if (!ses->domainName)
1899                         goto get_ses_fail;
1900         }
1901         ses->cred_uid = volume_info->cred_uid;
1902         ses->linux_uid = volume_info->linux_uid;
1903         ses->overrideSecFlg = volume_info->secFlg;
1904
1905         mutex_lock(&ses->session_mutex);
1906         rc = cifs_negotiate_protocol(xid, ses);
1907         if (!rc)
1908                 rc = cifs_setup_session(xid, ses, volume_info->local_nls);
1909         mutex_unlock(&ses->session_mutex);
1910         if (rc)
1911                 goto get_ses_fail;
1912
1913         /* success, put it on the list */
1914         spin_lock(&cifs_tcp_ses_lock);
1915         list_add(&ses->smb_ses_list, &server->smb_ses_list);
1916         spin_unlock(&cifs_tcp_ses_lock);
1917
1918         FreeXid(xid);
1919         return ses;
1920
1921 get_ses_fail:
1922         sesInfoFree(ses);
1923         FreeXid(xid);
1924         return ERR_PTR(rc);
1925 }
1926
1927 static struct cifsTconInfo *
1928 cifs_find_tcon(struct cifsSesInfo *ses, const char *unc)
1929 {
1930         struct list_head *tmp;
1931         struct cifsTconInfo *tcon;
1932
1933         spin_lock(&cifs_tcp_ses_lock);
1934         list_for_each(tmp, &ses->tcon_list) {
1935                 tcon = list_entry(tmp, struct cifsTconInfo, tcon_list);
1936                 if (tcon->tidStatus == CifsExiting)
1937                         continue;
1938                 if (strncmp(tcon->treeName, unc, MAX_TREE_SIZE))
1939                         continue;
1940
1941                 ++tcon->tc_count;
1942                 spin_unlock(&cifs_tcp_ses_lock);
1943                 return tcon;
1944         }
1945         spin_unlock(&cifs_tcp_ses_lock);
1946         return NULL;
1947 }
1948
1949 static void
1950 cifs_put_tcon(struct cifsTconInfo *tcon)
1951 {
1952         int xid;
1953         struct cifsSesInfo *ses = tcon->ses;
1954
1955         cFYI(1, "%s: tc_count=%d\n", __func__, tcon->tc_count);
1956         spin_lock(&cifs_tcp_ses_lock);
1957         if (--tcon->tc_count > 0) {
1958                 spin_unlock(&cifs_tcp_ses_lock);
1959                 return;
1960         }
1961
1962         list_del_init(&tcon->tcon_list);
1963         spin_unlock(&cifs_tcp_ses_lock);
1964
1965         xid = GetXid();
1966         CIFSSMBTDis(xid, tcon);
1967         _FreeXid(xid);
1968
1969         cifs_fscache_release_super_cookie(tcon);
1970         tconInfoFree(tcon);
1971         cifs_put_smb_ses(ses);
1972 }
1973
1974 static struct cifsTconInfo *
1975 cifs_get_tcon(struct cifsSesInfo *ses, struct smb_vol *volume_info)
1976 {
1977         int rc, xid;
1978         struct cifsTconInfo *tcon;
1979
1980         tcon = cifs_find_tcon(ses, volume_info->UNC);
1981         if (tcon) {
1982                 cFYI(1, "Found match on UNC path");
1983                 /* existing tcon already has a reference */
1984                 cifs_put_smb_ses(ses);
1985                 if (tcon->seal != volume_info->seal)
1986                         cERROR(1, "transport encryption setting "
1987                                    "conflicts with existing tid");
1988                 return tcon;
1989         }
1990
1991         tcon = tconInfoAlloc();
1992         if (tcon == NULL) {
1993                 rc = -ENOMEM;
1994                 goto out_fail;
1995         }
1996
1997         tcon->ses = ses;
1998         if (volume_info->password) {
1999                 tcon->password = kstrdup(volume_info->password, GFP_KERNEL);
2000                 if (!tcon->password) {
2001                         rc = -ENOMEM;
2002                         goto out_fail;
2003                 }
2004         }
2005
2006         if (strchr(volume_info->UNC + 3, '\\') == NULL
2007             && strchr(volume_info->UNC + 3, '/') == NULL) {
2008                 cERROR(1, "Missing share name");
2009                 rc = -ENODEV;
2010                 goto out_fail;
2011         }
2012
2013         /* BB Do we need to wrap session_mutex around
2014          * this TCon call and Unix SetFS as
2015          * we do on SessSetup and reconnect? */
2016         xid = GetXid();
2017         rc = CIFSTCon(xid, ses, volume_info->UNC, tcon, volume_info->local_nls);
2018         FreeXid(xid);
2019         cFYI(1, "CIFS Tcon rc = %d", rc);
2020         if (rc)
2021                 goto out_fail;
2022
2023         if (volume_info->nodfs) {
2024                 tcon->Flags &= ~SMB_SHARE_IS_IN_DFS;
2025                 cFYI(1, "DFS disabled (%d)", tcon->Flags);
2026         }
2027         tcon->seal = volume_info->seal;
2028         /* we can have only one retry value for a connection
2029            to a share so for resources mounted more than once
2030            to the same server share the last value passed in
2031            for the retry flag is used */
2032         tcon->retry = volume_info->retry;
2033         tcon->nocase = volume_info->nocase;
2034         tcon->local_lease = volume_info->local_lease;
2035
2036         spin_lock(&cifs_tcp_ses_lock);
2037         list_add(&tcon->tcon_list, &ses->tcon_list);
2038         spin_unlock(&cifs_tcp_ses_lock);
2039
2040         cifs_fscache_get_super_cookie(tcon);
2041
2042         return tcon;
2043
2044 out_fail:
2045         tconInfoFree(tcon);
2046         return ERR_PTR(rc);
2047 }
2048
2049 void
2050 cifs_put_tlink(struct tcon_link *tlink)
2051 {
2052         if (!tlink || IS_ERR(tlink))
2053                 return;
2054
2055         if (!atomic_dec_and_test(&tlink->tl_count) ||
2056             test_bit(TCON_LINK_IN_TREE, &tlink->tl_flags)) {
2057                 tlink->tl_time = jiffies;
2058                 return;
2059         }
2060
2061         if (!IS_ERR(tlink_tcon(tlink)))
2062                 cifs_put_tcon(tlink_tcon(tlink));
2063         kfree(tlink);
2064         return;
2065 }
2066
2067 int
2068 get_dfs_path(int xid, struct cifsSesInfo *pSesInfo, const char *old_path,
2069              const struct nls_table *nls_codepage, unsigned int *pnum_referrals,
2070              struct dfs_info3_param **preferrals, int remap)
2071 {
2072         char *temp_unc;
2073         int rc = 0;
2074
2075         *pnum_referrals = 0;
2076         *preferrals = NULL;
2077
2078         if (pSesInfo->ipc_tid == 0) {
2079                 temp_unc = kmalloc(2 /* for slashes */ +
2080                         strnlen(pSesInfo->serverName,
2081                                 SERVER_NAME_LEN_WITH_NULL * 2)
2082                                  + 1 + 4 /* slash IPC$ */  + 2,
2083                                 GFP_KERNEL);
2084                 if (temp_unc == NULL)
2085                         return -ENOMEM;
2086                 temp_unc[0] = '\\';
2087                 temp_unc[1] = '\\';
2088                 strcpy(temp_unc + 2, pSesInfo->serverName);
2089                 strcpy(temp_unc + 2 + strlen(pSesInfo->serverName), "\\IPC$");
2090                 rc = CIFSTCon(xid, pSesInfo, temp_unc, NULL, nls_codepage);
2091                 cFYI(1, "CIFS Tcon rc = %d ipc_tid = %d", rc, pSesInfo->ipc_tid);
2092                 kfree(temp_unc);
2093         }
2094         if (rc == 0)
2095                 rc = CIFSGetDFSRefer(xid, pSesInfo, old_path, preferrals,
2096                                      pnum_referrals, nls_codepage, remap);
2097         /* BB map targetUNCs to dfs_info3 structures, here or
2098                 in CIFSGetDFSRefer BB */
2099
2100         return rc;
2101 }
2102
2103 #ifdef CONFIG_DEBUG_LOCK_ALLOC
2104 static struct lock_class_key cifs_key[2];
2105 static struct lock_class_key cifs_slock_key[2];
2106
2107 static inline void
2108 cifs_reclassify_socket4(struct socket *sock)
2109 {
2110         struct sock *sk = sock->sk;
2111         BUG_ON(sock_owned_by_user(sk));
2112         sock_lock_init_class_and_name(sk, "slock-AF_INET-CIFS",
2113                 &cifs_slock_key[0], "sk_lock-AF_INET-CIFS", &cifs_key[0]);
2114 }
2115
2116 static inline void
2117 cifs_reclassify_socket6(struct socket *sock)
2118 {
2119         struct sock *sk = sock->sk;
2120         BUG_ON(sock_owned_by_user(sk));
2121         sock_lock_init_class_and_name(sk, "slock-AF_INET6-CIFS",
2122                 &cifs_slock_key[1], "sk_lock-AF_INET6-CIFS", &cifs_key[1]);
2123 }
2124 #else
2125 static inline void
2126 cifs_reclassify_socket4(struct socket *sock)
2127 {
2128 }
2129
2130 static inline void
2131 cifs_reclassify_socket6(struct socket *sock)
2132 {
2133 }
2134 #endif
2135
2136 /* See RFC1001 section 14 on representation of Netbios names */
2137 static void rfc1002mangle(char *target, char *source, unsigned int length)
2138 {
2139         unsigned int i, j;
2140
2141         for (i = 0, j = 0; i < (length); i++) {
2142                 /* mask a nibble at a time and encode */
2143                 target[j] = 'A' + (0x0F & (source[i] >> 4));
2144                 target[j+1] = 'A' + (0x0F & source[i]);
2145                 j += 2;
2146         }
2147
2148 }
2149
2150 static int
2151 bind_socket(struct TCP_Server_Info *server)
2152 {
2153         int rc = 0;
2154         if (server->srcaddr.ss_family != AF_UNSPEC) {
2155                 /* Bind to the specified local IP address */
2156                 struct socket *socket = server->ssocket;
2157                 rc = socket->ops->bind(socket,
2158                                        (struct sockaddr *) &server->srcaddr,
2159                                        sizeof(server->srcaddr));
2160                 if (rc < 0) {
2161                         struct sockaddr_in *saddr4;
2162                         struct sockaddr_in6 *saddr6;
2163                         saddr4 = (struct sockaddr_in *)&server->srcaddr;
2164                         saddr6 = (struct sockaddr_in6 *)&server->srcaddr;
2165                         if (saddr6->sin6_family == AF_INET6)
2166                                 cERROR(1, "cifs: "
2167                                        "Failed to bind to: %pI6c, error: %d\n",
2168                                        &saddr6->sin6_addr, rc);
2169                         else
2170                                 cERROR(1, "cifs: "
2171                                        "Failed to bind to: %pI4, error: %d\n",
2172                                        &saddr4->sin_addr.s_addr, rc);
2173                 }
2174         }
2175         return rc;
2176 }
2177
2178 static int
2179 ip_rfc1001_connect(struct TCP_Server_Info *server)
2180 {
2181         int rc = 0;
2182         /*
2183          * some servers require RFC1001 sessinit before sending
2184          * negprot - BB check reconnection in case where second
2185          * sessinit is sent but no second negprot
2186          */
2187         struct rfc1002_session_packet *ses_init_buf;
2188         struct smb_hdr *smb_buf;
2189         ses_init_buf = kzalloc(sizeof(struct rfc1002_session_packet),
2190                                GFP_KERNEL);
2191         if (ses_init_buf) {
2192                 ses_init_buf->trailer.session_req.called_len = 32;
2193
2194                 if (server->server_RFC1001_name &&
2195                     server->server_RFC1001_name[0] != 0)
2196                         rfc1002mangle(ses_init_buf->trailer.
2197                                       session_req.called_name,
2198                                       server->server_RFC1001_name,
2199                                       RFC1001_NAME_LEN_WITH_NULL);
2200                 else
2201                         rfc1002mangle(ses_init_buf->trailer.
2202                                       session_req.called_name,
2203                                       DEFAULT_CIFS_CALLED_NAME,
2204                                       RFC1001_NAME_LEN_WITH_NULL);
2205
2206                 ses_init_buf->trailer.session_req.calling_len = 32;
2207
2208                 /*
2209                  * calling name ends in null (byte 16) from old smb
2210                  * convention.
2211                  */
2212                 if (server->workstation_RFC1001_name &&
2213                     server->workstation_RFC1001_name[0] != 0)
2214                         rfc1002mangle(ses_init_buf->trailer.
2215                                       session_req.calling_name,
2216                                       server->workstation_RFC1001_name,
2217                                       RFC1001_NAME_LEN_WITH_NULL);
2218                 else
2219                         rfc1002mangle(ses_init_buf->trailer.
2220                                       session_req.calling_name,
2221                                       "LINUX_CIFS_CLNT",
2222                                       RFC1001_NAME_LEN_WITH_NULL);
2223
2224                 ses_init_buf->trailer.session_req.scope1 = 0;
2225                 ses_init_buf->trailer.session_req.scope2 = 0;
2226                 smb_buf = (struct smb_hdr *)ses_init_buf;
2227
2228                 /* sizeof RFC1002_SESSION_REQUEST with no scope */
2229                 smb_buf->smb_buf_length = 0x81000044;
2230                 rc = smb_send(server, smb_buf, 0x44);
2231                 kfree(ses_init_buf);
2232                 /*
2233                  * RFC1001 layer in at least one server
2234                  * requires very short break before negprot
2235                  * presumably because not expecting negprot
2236                  * to follow so fast.  This is a simple
2237                  * solution that works without
2238                  * complicating the code and causes no
2239                  * significant slowing down on mount
2240                  * for everyone else
2241                  */
2242                 usleep_range(1000, 2000);
2243         }
2244         /*
2245          * else the negprot may still work without this
2246          * even though malloc failed
2247          */
2248
2249         return rc;
2250 }
2251
2252 static int
2253 generic_ip_connect(struct TCP_Server_Info *server)
2254 {
2255         int rc = 0;
2256         unsigned short int sport;
2257         int slen, sfamily;
2258         struct socket *socket = server->ssocket;
2259         struct sockaddr *saddr;
2260
2261         saddr = (struct sockaddr *) &server->dstaddr;
2262
2263         if (server->dstaddr.ss_family == AF_INET6) {
2264                 sport = ((struct sockaddr_in6 *) saddr)->sin6_port;
2265                 slen = sizeof(struct sockaddr_in6);
2266                 sfamily = AF_INET6;
2267         } else {
2268                 sport = ((struct sockaddr_in *) saddr)->sin_port;
2269                 slen = sizeof(struct sockaddr_in);
2270                 sfamily = AF_INET;
2271         }
2272
2273         if (socket == NULL) {
2274                 rc = __sock_create(cifs_net_ns(server), sfamily, SOCK_STREAM,
2275                                    IPPROTO_TCP, &socket, 1);
2276                 if (rc < 0) {
2277                         cERROR(1, "Error %d creating socket", rc);
2278                         server->ssocket = NULL;
2279                         return rc;
2280                 }
2281
2282                 /* BB other socket options to set KEEPALIVE, NODELAY? */
2283                 cFYI(1, "Socket created");
2284                 server->ssocket = socket;
2285                 socket->sk->sk_allocation = GFP_NOFS;
2286                 if (sfamily == AF_INET6)
2287                         cifs_reclassify_socket6(socket);
2288                 else
2289                         cifs_reclassify_socket4(socket);
2290         }
2291
2292         rc = bind_socket(server);
2293         if (rc < 0)
2294                 return rc;
2295
2296         rc = socket->ops->connect(socket, saddr, slen, 0);
2297         if (rc < 0) {
2298                 cFYI(1, "Error %d connecting to server", rc);
2299                 sock_release(socket);
2300                 server->ssocket = NULL;
2301                 return rc;
2302         }
2303
2304         /*
2305          * Eventually check for other socket options to change from
2306          * the default. sock_setsockopt not used because it expects
2307          * user space buffer
2308          */
2309         socket->sk->sk_rcvtimeo = 7 * HZ;
2310         socket->sk->sk_sndtimeo = 5 * HZ;
2311
2312         /* make the bufsizes depend on wsize/rsize and max requests */
2313         if (server->noautotune) {
2314                 if (socket->sk->sk_sndbuf < (200 * 1024))
2315                         socket->sk->sk_sndbuf = 200 * 1024;
2316                 if (socket->sk->sk_rcvbuf < (140 * 1024))
2317                         socket->sk->sk_rcvbuf = 140 * 1024;
2318         }
2319
2320         if (server->tcp_nodelay) {
2321                 int val = 1;
2322                 rc = kernel_setsockopt(socket, SOL_TCP, TCP_NODELAY,
2323                                 (char *)&val, sizeof(val));
2324                 if (rc)
2325                         cFYI(1, "set TCP_NODELAY socket option error %d", rc);
2326         }
2327
2328          cFYI(1, "sndbuf %d rcvbuf %d rcvtimeo 0x%lx",
2329                  socket->sk->sk_sndbuf,
2330                  socket->sk->sk_rcvbuf, socket->sk->sk_rcvtimeo);
2331
2332         if (sport == htons(RFC1001_PORT))
2333                 rc = ip_rfc1001_connect(server);
2334
2335         return rc;
2336 }
2337
2338 static int
2339 ip_connect(struct TCP_Server_Info *server)
2340 {
2341         unsigned short int *sport;
2342         struct sockaddr_in6 *addr6 = (struct sockaddr_in6 *)&server->dstaddr;
2343         struct sockaddr_in *addr = (struct sockaddr_in *)&server->dstaddr;
2344
2345         if (server->dstaddr.ss_family == AF_INET6)
2346                 sport = &addr6->sin6_port;
2347         else
2348                 sport = &addr->sin_port;
2349
2350         if (*sport == 0) {
2351                 int rc;
2352
2353                 /* try with 445 port at first */
2354                 *sport = htons(CIFS_PORT);
2355
2356                 rc = generic_ip_connect(server);
2357                 if (rc >= 0)
2358                         return rc;
2359
2360                 /* if it failed, try with 139 port */
2361                 *sport = htons(RFC1001_PORT);
2362         }
2363
2364         return generic_ip_connect(server);
2365 }
2366
2367 void reset_cifs_unix_caps(int xid, struct cifsTconInfo *tcon,
2368                           struct super_block *sb, struct smb_vol *vol_info)
2369 {
2370         /* if we are reconnecting then should we check to see if
2371          * any requested capabilities changed locally e.g. via
2372          * remount but we can not do much about it here
2373          * if they have (even if we could detect it by the following)
2374          * Perhaps we could add a backpointer to array of sb from tcon
2375          * or if we change to make all sb to same share the same
2376          * sb as NFS - then we only have one backpointer to sb.
2377          * What if we wanted to mount the server share twice once with
2378          * and once without posixacls or posix paths? */
2379         __u64 saved_cap = le64_to_cpu(tcon->fsUnixInfo.Capability);
2380
2381         if (vol_info && vol_info->no_linux_ext) {
2382                 tcon->fsUnixInfo.Capability = 0;
2383                 tcon->unix_ext = 0; /* Unix Extensions disabled */
2384                 cFYI(1, "Linux protocol extensions disabled");
2385                 return;
2386         } else if (vol_info)
2387                 tcon->unix_ext = 1; /* Unix Extensions supported */
2388
2389         if (tcon->unix_ext == 0) {
2390                 cFYI(1, "Unix extensions disabled so not set on reconnect");
2391                 return;
2392         }
2393
2394         if (!CIFSSMBQFSUnixInfo(xid, tcon)) {
2395                 __u64 cap = le64_to_cpu(tcon->fsUnixInfo.Capability);
2396
2397                 /* check for reconnect case in which we do not
2398                    want to change the mount behavior if we can avoid it */
2399                 if (vol_info == NULL) {
2400                         /* turn off POSIX ACL and PATHNAMES if not set
2401                            originally at mount time */
2402                         if ((saved_cap & CIFS_UNIX_POSIX_ACL_CAP) == 0)
2403                                 cap &= ~CIFS_UNIX_POSIX_ACL_CAP;
2404                         if ((saved_cap & CIFS_UNIX_POSIX_PATHNAMES_CAP) == 0) {
2405                                 if (cap & CIFS_UNIX_POSIX_PATHNAMES_CAP)
2406                                         cERROR(1, "POSIXPATH support change");
2407                                 cap &= ~CIFS_UNIX_POSIX_PATHNAMES_CAP;
2408                         } else if ((cap & CIFS_UNIX_POSIX_PATHNAMES_CAP) == 0) {
2409                                 cERROR(1, "possible reconnect error");
2410                                 cERROR(1, "server disabled POSIX path support");
2411                         }
2412                 }
2413
2414                 cap &= CIFS_UNIX_CAP_MASK;
2415                 if (vol_info && vol_info->no_psx_acl)
2416                         cap &= ~CIFS_UNIX_POSIX_ACL_CAP;
2417                 else if (CIFS_UNIX_POSIX_ACL_CAP & cap) {
2418                         cFYI(1, "negotiated posix acl support");
2419                         if (sb)
2420                                 sb->s_flags |= MS_POSIXACL;
2421                 }
2422
2423                 if (vol_info && vol_info->posix_paths == 0)
2424                         cap &= ~CIFS_UNIX_POSIX_PATHNAMES_CAP;
2425                 else if (cap & CIFS_UNIX_POSIX_PATHNAMES_CAP) {
2426                         cFYI(1, "negotiate posix pathnames");
2427                         if (sb)
2428                                 CIFS_SB(sb)->mnt_cifs_flags |=
2429                                         CIFS_MOUNT_POSIX_PATHS;
2430                 }
2431
2432                 /* We might be setting the path sep back to a different
2433                 form if we are reconnecting and the server switched its
2434                 posix path capability for this share */
2435                 if (sb && (CIFS_SB(sb)->prepathlen > 0))
2436                         CIFS_SB(sb)->prepath[0] = CIFS_DIR_SEP(CIFS_SB(sb));
2437
2438                 if (sb && (CIFS_SB(sb)->rsize > 127 * 1024)) {
2439                         if ((cap & CIFS_UNIX_LARGE_READ_CAP) == 0) {
2440                                 CIFS_SB(sb)->rsize = 127 * 1024;
2441                                 cFYI(DBG2, "larger reads not supported by srv");
2442                         }
2443                 }
2444
2445
2446                 cFYI(1, "Negotiate caps 0x%x", (int)cap);
2447 #ifdef CONFIG_CIFS_DEBUG2
2448                 if (cap & CIFS_UNIX_FCNTL_CAP)
2449                         cFYI(1, "FCNTL cap");
2450                 if (cap & CIFS_UNIX_EXTATTR_CAP)
2451                         cFYI(1, "EXTATTR cap");
2452                 if (cap & CIFS_UNIX_POSIX_PATHNAMES_CAP)
2453                         cFYI(1, "POSIX path cap");
2454                 if (cap & CIFS_UNIX_XATTR_CAP)
2455                         cFYI(1, "XATTR cap");
2456                 if (cap & CIFS_UNIX_POSIX_ACL_CAP)
2457                         cFYI(1, "POSIX ACL cap");
2458                 if (cap & CIFS_UNIX_LARGE_READ_CAP)
2459                         cFYI(1, "very large read cap");
2460                 if (cap & CIFS_UNIX_LARGE_WRITE_CAP)
2461                         cFYI(1, "very large write cap");
2462 #endif /* CIFS_DEBUG2 */
2463                 if (CIFSSMBSetFSUnixInfo(xid, tcon, cap)) {
2464                         if (vol_info == NULL) {
2465                                 cFYI(1, "resetting capabilities failed");
2466                         } else
2467                                 cERROR(1, "Negotiating Unix capabilities "
2468                                            "with the server failed.  Consider "
2469                                            "mounting with the Unix Extensions\n"
2470                                            "disabled, if problems are found, "
2471                                            "by specifying the nounix mount "
2472                                            "option.");
2473
2474                 }
2475         }
2476 }
2477
2478 static void
2479 convert_delimiter(char *path, char delim)
2480 {
2481         int i;
2482         char old_delim;
2483
2484         if (path == NULL)
2485                 return;
2486
2487         if (delim == '/')
2488                 old_delim = '\\';
2489         else
2490                 old_delim = '/';
2491
2492         for (i = 0; path[i] != '\0'; i++) {
2493                 if (path[i] == old_delim)
2494                         path[i] = delim;
2495         }
2496 }
2497
2498 static void setup_cifs_sb(struct smb_vol *pvolume_info,
2499                           struct cifs_sb_info *cifs_sb)
2500 {
2501         INIT_DELAYED_WORK(&cifs_sb->prune_tlinks, cifs_prune_tlinks);
2502
2503         if (pvolume_info->rsize > CIFSMaxBufSize) {
2504                 cERROR(1, "rsize %d too large, using MaxBufSize",
2505                         pvolume_info->rsize);
2506                 cifs_sb->rsize = CIFSMaxBufSize;
2507         } else if ((pvolume_info->rsize) &&
2508                         (pvolume_info->rsize <= CIFSMaxBufSize))
2509                 cifs_sb->rsize = pvolume_info->rsize;
2510         else /* default */
2511                 cifs_sb->rsize = CIFSMaxBufSize;
2512
2513         if (pvolume_info->wsize > PAGEVEC_SIZE * PAGE_CACHE_SIZE) {
2514                 cERROR(1, "wsize %d too large, using 4096 instead",
2515                           pvolume_info->wsize);
2516                 cifs_sb->wsize = 4096;
2517         } else if (pvolume_info->wsize)
2518                 cifs_sb->wsize = pvolume_info->wsize;
2519         else
2520                 cifs_sb->wsize = min_t(const int,
2521                                         PAGEVEC_SIZE * PAGE_CACHE_SIZE,
2522                                         127*1024);
2523                 /* old default of CIFSMaxBufSize was too small now
2524                    that SMB Write2 can send multiple pages in kvec.
2525                    RFC1001 does not describe what happens when frame
2526                    bigger than 128K is sent so use that as max in
2527                    conjunction with 52K kvec constraint on arch with 4K
2528                    page size  */
2529
2530         if (cifs_sb->rsize < 2048) {
2531                 cifs_sb->rsize = 2048;
2532                 /* Windows ME may prefer this */
2533                 cFYI(1, "readsize set to minimum: 2048");
2534         }
2535         /* calculate prepath */
2536         cifs_sb->prepath = pvolume_info->prepath;
2537         if (cifs_sb->prepath) {
2538                 cifs_sb->prepathlen = strlen(cifs_sb->prepath);
2539                 /* we can not convert the / to \ in the path
2540                 separators in the prefixpath yet because we do not
2541                 know (until reset_cifs_unix_caps is called later)
2542                 whether POSIX PATH CAP is available. We normalize
2543                 the / to \ after reset_cifs_unix_caps is called */
2544                 pvolume_info->prepath = NULL;
2545         } else
2546                 cifs_sb->prepathlen = 0;
2547         cifs_sb->mnt_uid = pvolume_info->linux_uid;
2548         cifs_sb->mnt_gid = pvolume_info->linux_gid;
2549         cifs_sb->mnt_file_mode = pvolume_info->file_mode;
2550         cifs_sb->mnt_dir_mode = pvolume_info->dir_mode;
2551         cFYI(1, "file mode: 0x%x  dir mode: 0x%x",
2552                 cifs_sb->mnt_file_mode, cifs_sb->mnt_dir_mode);
2553
2554         cifs_sb->actimeo = pvolume_info->actimeo;
2555
2556         if (pvolume_info->noperm)
2557                 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_NO_PERM;
2558         if (pvolume_info->setuids)
2559                 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_SET_UID;
2560         if (pvolume_info->server_ino)
2561                 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_SERVER_INUM;
2562         if (pvolume_info->remap)
2563                 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_MAP_SPECIAL_CHR;
2564         if (pvolume_info->no_xattr)
2565                 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_NO_XATTR;
2566         if (pvolume_info->sfu_emul)
2567                 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_UNX_EMUL;
2568         if (pvolume_info->nobrl)
2569                 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_NO_BRL;
2570         if (pvolume_info->nostrictsync)
2571                 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_NOSSYNC;
2572         if (pvolume_info->mand_lock)
2573                 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_NOPOSIXBRL;
2574         if (pvolume_info->cifs_acl)
2575                 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_CIFS_ACL;
2576         if (pvolume_info->override_uid)
2577                 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_OVERR_UID;
2578         if (pvolume_info->override_gid)
2579                 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_OVERR_GID;
2580         if (pvolume_info->dynperm)
2581                 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_DYNPERM;
2582         if (pvolume_info->fsc)
2583                 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_FSCACHE;
2584         if (pvolume_info->multiuser)
2585                 cifs_sb->mnt_cifs_flags |= (CIFS_MOUNT_MULTIUSER |
2586                                             CIFS_MOUNT_NO_PERM);
2587         if (pvolume_info->direct_io) {
2588                 cFYI(1, "mounting share using direct i/o");
2589                 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_DIRECT_IO;
2590         }
2591         if (pvolume_info->mfsymlinks) {
2592                 if (pvolume_info->sfu_emul) {
2593                         cERROR(1,  "mount option mfsymlinks ignored if sfu "
2594                                    "mount option is used");
2595                 } else {
2596                         cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_MF_SYMLINKS;
2597                 }
2598         }
2599
2600         if ((pvolume_info->cifs_acl) && (pvolume_info->dynperm))
2601                 cERROR(1, "mount option dynperm ignored if cifsacl "
2602                            "mount option supported");
2603 }
2604
2605 static int
2606 is_path_accessible(int xid, struct cifsTconInfo *tcon,
2607                    struct cifs_sb_info *cifs_sb, const char *full_path)
2608 {
2609         int rc;
2610         FILE_ALL_INFO *pfile_info;
2611
2612         pfile_info = kmalloc(sizeof(FILE_ALL_INFO), GFP_KERNEL);
2613         if (pfile_info == NULL)
2614                 return -ENOMEM;
2615
2616         rc = CIFSSMBQPathInfo(xid, tcon, full_path, pfile_info,
2617                               0 /* not legacy */, cifs_sb->local_nls,
2618                               cifs_sb->mnt_cifs_flags &
2619                                 CIFS_MOUNT_MAP_SPECIAL_CHR);
2620         kfree(pfile_info);
2621         return rc;
2622 }
2623
2624 static void
2625 cleanup_volume_info(struct smb_vol **pvolume_info)
2626 {
2627         struct smb_vol *volume_info;
2628
2629         if (!pvolume_info || !*pvolume_info)
2630                 return;
2631
2632         volume_info = *pvolume_info;
2633         kzfree(volume_info->password);
2634         kfree(volume_info->UNC);
2635         kfree(volume_info->prepath);
2636         kfree(volume_info);
2637         *pvolume_info = NULL;
2638         return;
2639 }
2640
2641 #ifdef CONFIG_CIFS_DFS_UPCALL
2642 /* build_path_to_root returns full path to root when
2643  * we do not have an exiting connection (tcon) */
2644 static char *
2645 build_unc_path_to_root(const struct smb_vol *volume_info,
2646                 const struct cifs_sb_info *cifs_sb)
2647 {
2648         char *full_path;
2649
2650         int unc_len = strnlen(volume_info->UNC, MAX_TREE_SIZE + 1);
2651         full_path = kmalloc(unc_len + cifs_sb->prepathlen + 1, GFP_KERNEL);
2652         if (full_path == NULL)
2653                 return ERR_PTR(-ENOMEM);
2654
2655         strncpy(full_path, volume_info->UNC, unc_len);
2656         if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_POSIX_PATHS) {
2657                 int i;
2658                 for (i = 0; i < unc_len; i++) {
2659                         if (full_path[i] == '\\')
2660                                 full_path[i] = '/';
2661                 }
2662         }
2663
2664         if (cifs_sb->prepathlen)
2665                 strncpy(full_path + unc_len, cifs_sb->prepath,
2666                                 cifs_sb->prepathlen);
2667
2668         full_path[unc_len + cifs_sb->prepathlen] = 0; /* add trailing null */
2669         return full_path;
2670 }
2671 #endif
2672
2673 int
2674 cifs_mount(struct super_block *sb, struct cifs_sb_info *cifs_sb,
2675                 char *mount_data_global, const char *devname)
2676 {
2677         int rc;
2678         int xid;
2679         struct smb_vol *volume_info;
2680         struct cifsSesInfo *pSesInfo;
2681         struct cifsTconInfo *tcon;
2682         struct TCP_Server_Info *srvTcp;
2683         char   *full_path;
2684         char *mount_data = mount_data_global;
2685         struct tcon_link *tlink;
2686 #ifdef CONFIG_CIFS_DFS_UPCALL
2687         struct dfs_info3_param *referrals = NULL;
2688         unsigned int num_referrals = 0;
2689         int referral_walks_count = 0;
2690 try_mount_again:
2691 #endif
2692         rc = 0;
2693         tcon = NULL;
2694         pSesInfo = NULL;
2695         srvTcp = NULL;
2696         full_path = NULL;
2697         tlink = NULL;
2698
2699         xid = GetXid();
2700
2701         volume_info = kzalloc(sizeof(struct smb_vol), GFP_KERNEL);
2702         if (!volume_info) {
2703                 rc = -ENOMEM;
2704                 goto out;
2705         }
2706
2707         if (cifs_parse_mount_options(mount_data, devname, volume_info)) {
2708                 rc = -EINVAL;
2709                 goto out;
2710         }
2711
2712         if (volume_info->nullauth) {
2713                 cFYI(1, "null user");
2714                 volume_info->username = "";
2715         } else if (volume_info->username) {
2716                 /* BB fixme parse for domain name here */
2717                 cFYI(1, "Username: %s", volume_info->username);
2718         } else {
2719                 cifserror("No username specified");
2720         /* In userspace mount helper we can get user name from alternate
2721            locations such as env variables and files on disk */
2722                 rc = -EINVAL;
2723                 goto out;
2724         }
2725
2726         /* this is needed for ASCII cp to Unicode converts */
2727         if (volume_info->iocharset == NULL) {
2728                 /* load_nls_default cannot return null */
2729                 volume_info->local_nls = load_nls_default();
2730         } else {
2731                 volume_info->local_nls = load_nls(volume_info->iocharset);
2732                 if (volume_info->local_nls == NULL) {
2733                         cERROR(1, "CIFS mount error: iocharset %s not found",
2734                                  volume_info->iocharset);
2735                         rc = -ELIBACC;
2736                         goto out;
2737                 }
2738         }
2739         cifs_sb->local_nls = volume_info->local_nls;
2740
2741         /* get a reference to a tcp session */
2742         srvTcp = cifs_get_tcp_session(volume_info);
2743         if (IS_ERR(srvTcp)) {
2744                 rc = PTR_ERR(srvTcp);
2745                 goto out;
2746         }
2747
2748         /* get a reference to a SMB session */
2749         pSesInfo = cifs_get_smb_ses(srvTcp, volume_info);
2750         if (IS_ERR(pSesInfo)) {
2751                 rc = PTR_ERR(pSesInfo);
2752                 pSesInfo = NULL;
2753                 goto mount_fail_check;
2754         }
2755
2756         setup_cifs_sb(volume_info, cifs_sb);
2757         if (pSesInfo->capabilities & CAP_LARGE_FILES)
2758                 sb->s_maxbytes = MAX_LFS_FILESIZE;
2759         else
2760                 sb->s_maxbytes = MAX_NON_LFS;
2761
2762         /* BB FIXME fix time_gran to be larger for LANMAN sessions */
2763         sb->s_time_gran = 100;
2764
2765         /* search for existing tcon to this server share */
2766         tcon = cifs_get_tcon(pSesInfo, volume_info);
2767         if (IS_ERR(tcon)) {
2768                 rc = PTR_ERR(tcon);
2769                 tcon = NULL;
2770                 goto remote_path_check;
2771         }
2772
2773         /* do not care if following two calls succeed - informational */
2774         if (!tcon->ipc) {
2775                 CIFSSMBQFSDeviceInfo(xid, tcon);
2776                 CIFSSMBQFSAttributeInfo(xid, tcon);
2777         }
2778
2779         /* tell server which Unix caps we support */
2780         if (tcon->ses->capabilities & CAP_UNIX)
2781                 /* reset of caps checks mount to see if unix extensions
2782                    disabled for just this mount */
2783                 reset_cifs_unix_caps(xid, tcon, sb, volume_info);
2784         else
2785                 tcon->unix_ext = 0; /* server does not support them */
2786
2787         /* convert forward to back slashes in prepath here if needed */
2788         if ((cifs_sb->mnt_cifs_flags & CIFS_MOUNT_POSIX_PATHS) == 0)
2789                 convert_delimiter(cifs_sb->prepath, CIFS_DIR_SEP(cifs_sb));
2790
2791         if ((tcon->unix_ext == 0) && (cifs_sb->rsize > (1024 * 127))) {
2792                 cifs_sb->rsize = 1024 * 127;
2793                 cFYI(DBG2, "no very large read support, rsize now 127K");
2794         }
2795         if (!(tcon->ses->capabilities & CAP_LARGE_WRITE_X))
2796                 cifs_sb->wsize = min(cifs_sb->wsize,
2797                                (tcon->ses->server->maxBuf - MAX_CIFS_HDR_SIZE));
2798         if (!(tcon->ses->capabilities & CAP_LARGE_READ_X))
2799                 cifs_sb->rsize = min(cifs_sb->rsize,
2800                                (tcon->ses->server->maxBuf - MAX_CIFS_HDR_SIZE));
2801
2802 remote_path_check:
2803         /* check if a whole path (including prepath) is not remote */
2804         if (!rc && cifs_sb->prepathlen && tcon) {
2805                 /* build_path_to_root works only when we have a valid tcon */
2806                 full_path = cifs_build_path_to_root(cifs_sb, tcon);
2807                 if (full_path == NULL) {
2808                         rc = -ENOMEM;
2809                         goto mount_fail_check;
2810                 }
2811                 rc = is_path_accessible(xid, tcon, cifs_sb, full_path);
2812                 if (rc != 0 && rc != -EREMOTE) {
2813                         kfree(full_path);
2814                         goto mount_fail_check;
2815                 }
2816                 kfree(full_path);
2817         }
2818
2819         /* get referral if needed */
2820         if (rc == -EREMOTE) {
2821 #ifdef CONFIG_CIFS_DFS_UPCALL
2822                 if (referral_walks_count > MAX_NESTED_LINKS) {
2823                         /*
2824                          * BB: when we implement proper loop detection,
2825                          *     we will remove this check. But now we need it
2826                          *     to prevent an indefinite loop if 'DFS tree' is
2827                          *     misconfigured (i.e. has loops).
2828                          */
2829                         rc = -ELOOP;
2830                         goto mount_fail_check;
2831                 }
2832                 /* convert forward to back slashes in prepath here if needed */
2833                 if ((cifs_sb->mnt_cifs_flags & CIFS_MOUNT_POSIX_PATHS) == 0)
2834                         convert_delimiter(cifs_sb->prepath,
2835                                         CIFS_DIR_SEP(cifs_sb));
2836                 full_path = build_unc_path_to_root(volume_info, cifs_sb);
2837                 if (IS_ERR(full_path)) {
2838                         rc = PTR_ERR(full_path);
2839                         goto mount_fail_check;
2840                 }
2841
2842                 cFYI(1, "Getting referral for: %s", full_path);
2843                 rc = get_dfs_path(xid, pSesInfo , full_path + 1,
2844                         cifs_sb->local_nls, &num_referrals, &referrals,
2845                         cifs_sb->mnt_cifs_flags & CIFS_MOUNT_MAP_SPECIAL_CHR);
2846                 if (!rc && num_referrals > 0) {
2847                         char *fake_devname = NULL;
2848
2849                         if (mount_data != mount_data_global)
2850                                 kfree(mount_data);
2851
2852                         mount_data = cifs_compose_mount_options(
2853                                         cifs_sb->mountdata, full_path + 1,
2854                                         referrals, &fake_devname);
2855
2856                         free_dfs_info_array(referrals, num_referrals);
2857                         kfree(fake_devname);
2858                         kfree(full_path);
2859
2860                         if (IS_ERR(mount_data)) {
2861                                 rc = PTR_ERR(mount_data);
2862                                 mount_data = NULL;
2863                                 goto mount_fail_check;
2864                         }
2865
2866                         if (tcon)
2867                                 cifs_put_tcon(tcon);
2868                         else if (pSesInfo)
2869                                 cifs_put_smb_ses(pSesInfo);
2870
2871                         cleanup_volume_info(&volume_info);
2872                         referral_walks_count++;
2873                         FreeXid(xid);
2874                         goto try_mount_again;
2875                 }
2876 #else /* No DFS support, return error on mount */
2877                 rc = -EOPNOTSUPP;
2878 #endif
2879         }
2880
2881         if (rc)
2882                 goto mount_fail_check;
2883
2884         /* now, hang the tcon off of the superblock */
2885         tlink = kzalloc(sizeof *tlink, GFP_KERNEL);
2886         if (tlink == NULL) {
2887                 rc = -ENOMEM;
2888                 goto mount_fail_check;
2889         }
2890
2891         tlink->tl_uid = pSesInfo->linux_uid;
2892         tlink->tl_tcon = tcon;
2893         tlink->tl_time = jiffies;
2894         set_bit(TCON_LINK_MASTER, &tlink->tl_flags);
2895         set_bit(TCON_LINK_IN_TREE, &tlink->tl_flags);
2896
2897         cifs_sb->master_tlink = tlink;
2898         spin_lock(&cifs_sb->tlink_tree_lock);
2899         tlink_rb_insert(&cifs_sb->tlink_tree, tlink);
2900         spin_unlock(&cifs_sb->tlink_tree_lock);
2901
2902         queue_delayed_work(system_nrt_wq, &cifs_sb->prune_tlinks,
2903                                 TLINK_IDLE_EXPIRE);
2904
2905 mount_fail_check:
2906         /* on error free sesinfo and tcon struct if needed */
2907         if (rc) {
2908                 if (mount_data != mount_data_global)
2909                         kfree(mount_data);
2910                 /* If find_unc succeeded then rc == 0 so we can not end */
2911                 /* up accidently freeing someone elses tcon struct */
2912                 if (tcon)
2913                         cifs_put_tcon(tcon);
2914                 else if (pSesInfo)
2915                         cifs_put_smb_ses(pSesInfo);
2916                 else
2917                         cifs_put_tcp_session(srvTcp);
2918                 goto out;
2919         }
2920
2921         /* volume_info->password is freed above when existing session found
2922         (in which case it is not needed anymore) but when new sesion is created
2923         the password ptr is put in the new session structure (in which case the
2924         password will be freed at unmount time) */
2925 out:
2926         /* zero out password before freeing */
2927         cleanup_volume_info(&volume_info);
2928         FreeXid(xid);
2929         return rc;
2930 }
2931
2932 int
2933 CIFSTCon(unsigned int xid, struct cifsSesInfo *ses,
2934          const char *tree, struct cifsTconInfo *tcon,
2935          const struct nls_table *nls_codepage)
2936 {
2937         struct smb_hdr *smb_buffer;
2938         struct smb_hdr *smb_buffer_response;
2939         TCONX_REQ *pSMB;
2940         TCONX_RSP *pSMBr;
2941         unsigned char *bcc_ptr;
2942         int rc = 0;
2943         int length;
2944         __u16 bytes_left, count;
2945
2946         if (ses == NULL)
2947                 return -EIO;
2948
2949         smb_buffer = cifs_buf_get();
2950         if (smb_buffer == NULL)
2951                 return -ENOMEM;
2952
2953         smb_buffer_response = smb_buffer;
2954
2955         header_assemble(smb_buffer, SMB_COM_TREE_CONNECT_ANDX,
2956                         NULL /*no tid */ , 4 /*wct */ );
2957
2958         smb_buffer->Mid = GetNextMid(ses->server);
2959         smb_buffer->Uid = ses->Suid;
2960         pSMB = (TCONX_REQ *) smb_buffer;
2961         pSMBr = (TCONX_RSP *) smb_buffer_response;
2962
2963         pSMB->AndXCommand = 0xFF;
2964         pSMB->Flags = cpu_to_le16(TCON_EXTENDED_SECINFO);
2965         bcc_ptr = &pSMB->Password[0];
2966         if ((ses->server->secMode) & SECMODE_USER) {
2967                 pSMB->PasswordLength = cpu_to_le16(1);  /* minimum */
2968                 *bcc_ptr = 0; /* password is null byte */
2969                 bcc_ptr++;              /* skip password */
2970                 /* already aligned so no need to do it below */
2971         } else {
2972                 pSMB->PasswordLength = cpu_to_le16(CIFS_AUTH_RESP_SIZE);
2973                 /* BB FIXME add code to fail this if NTLMv2 or Kerberos
2974                    specified as required (when that support is added to
2975                    the vfs in the future) as only NTLM or the much
2976                    weaker LANMAN (which we do not send by default) is accepted
2977                    by Samba (not sure whether other servers allow
2978                    NTLMv2 password here) */
2979 #ifdef CONFIG_CIFS_WEAK_PW_HASH
2980                 if ((global_secflags & CIFSSEC_MAY_LANMAN) &&
2981                     (ses->server->secType == LANMAN))
2982                         calc_lanman_hash(tcon->password, ses->server->cryptkey,
2983                                          ses->server->secMode &
2984                                             SECMODE_PW_ENCRYPT ? true : false,
2985                                          bcc_ptr);
2986                 else
2987 #endif /* CIFS_WEAK_PW_HASH */
2988                 SMBNTencrypt(tcon->password, ses->server->cryptkey, bcc_ptr);
2989
2990                 bcc_ptr += CIFS_AUTH_RESP_SIZE;
2991                 if (ses->capabilities & CAP_UNICODE) {
2992                         /* must align unicode strings */
2993                         *bcc_ptr = 0; /* null byte password */
2994                         bcc_ptr++;
2995                 }
2996         }
2997
2998         if (ses->server->secMode &
2999                         (SECMODE_SIGN_REQUIRED | SECMODE_SIGN_ENABLED))
3000                 smb_buffer->Flags2 |= SMBFLG2_SECURITY_SIGNATURE;
3001
3002         if (ses->capabilities & CAP_STATUS32) {
3003                 smb_buffer->Flags2 |= SMBFLG2_ERR_STATUS;
3004         }
3005         if (ses->capabilities & CAP_DFS) {
3006                 smb_buffer->Flags2 |= SMBFLG2_DFS;
3007         }
3008         if (ses->capabilities & CAP_UNICODE) {
3009                 smb_buffer->Flags2 |= SMBFLG2_UNICODE;
3010                 length =
3011                     cifs_strtoUCS((__le16 *) bcc_ptr, tree,
3012                         6 /* max utf8 char length in bytes */ *
3013                         (/* server len*/ + 256 /* share len */), nls_codepage);
3014                 bcc_ptr += 2 * length;  /* convert num 16 bit words to bytes */
3015                 bcc_ptr += 2;   /* skip trailing null */
3016         } else {                /* ASCII */
3017                 strcpy(bcc_ptr, tree);
3018                 bcc_ptr += strlen(tree) + 1;
3019         }
3020         strcpy(bcc_ptr, "?????");
3021         bcc_ptr += strlen("?????");
3022         bcc_ptr += 1;
3023         count = bcc_ptr - &pSMB->Password[0];
3024         pSMB->hdr.smb_buf_length += count;
3025         pSMB->ByteCount = cpu_to_le16(count);
3026
3027         rc = SendReceive(xid, ses, smb_buffer, smb_buffer_response, &length,
3028                          0);
3029
3030         /* above now done in SendReceive */
3031         if ((rc == 0) && (tcon != NULL)) {
3032                 bool is_unicode;
3033
3034                 tcon->tidStatus = CifsGood;
3035                 tcon->need_reconnect = false;
3036                 tcon->tid = smb_buffer_response->Tid;
3037                 bcc_ptr = pByteArea(smb_buffer_response);
3038                 bytes_left = get_bcc(smb_buffer_response);
3039                 length = strnlen(bcc_ptr, bytes_left - 2);
3040                 if (smb_buffer->Flags2 & SMBFLG2_UNICODE)
3041                         is_unicode = true;
3042                 else
3043                         is_unicode = false;
3044
3045
3046                 /* skip service field (NB: this field is always ASCII) */
3047                 if (length == 3) {
3048                         if ((bcc_ptr[0] == 'I') && (bcc_ptr[1] == 'P') &&
3049                             (bcc_ptr[2] == 'C')) {
3050                                 cFYI(1, "IPC connection");
3051                                 tcon->ipc = 1;
3052                         }
3053                 } else if (length == 2) {
3054                         if ((bcc_ptr[0] == 'A') && (bcc_ptr[1] == ':')) {
3055                                 /* the most common case */
3056                                 cFYI(1, "disk share connection");
3057                         }
3058                 }
3059                 bcc_ptr += length + 1;
3060                 bytes_left -= (length + 1);
3061                 strncpy(tcon->treeName, tree, MAX_TREE_SIZE);
3062
3063                 /* mostly informational -- no need to fail on error here */
3064                 kfree(tcon->nativeFileSystem);
3065                 tcon->nativeFileSystem = cifs_strndup_from_ucs(bcc_ptr,
3066                                                       bytes_left, is_unicode,
3067                                                       nls_codepage);
3068
3069                 cFYI(1, "nativeFileSystem=%s", tcon->nativeFileSystem);
3070
3071                 if ((smb_buffer_response->WordCount == 3) ||
3072                          (smb_buffer_response->WordCount == 7))
3073                         /* field is in same location */
3074                         tcon->Flags = le16_to_cpu(pSMBr->OptionalSupport);
3075                 else
3076                         tcon->Flags = 0;
3077                 cFYI(1, "Tcon flags: 0x%x ", tcon->Flags);
3078         } else if ((rc == 0) && tcon == NULL) {
3079                 /* all we need to save for IPC$ connection */
3080                 ses->ipc_tid = smb_buffer_response->Tid;
3081         }
3082
3083         cifs_buf_release(smb_buffer);
3084         return rc;
3085 }
3086
3087 int
3088 cifs_umount(struct super_block *sb, struct cifs_sb_info *cifs_sb)
3089 {
3090         struct rb_root *root = &cifs_sb->tlink_tree;
3091         struct rb_node *node;
3092         struct tcon_link *tlink;
3093         char *tmp;
3094
3095         cancel_delayed_work_sync(&cifs_sb->prune_tlinks);
3096
3097         spin_lock(&cifs_sb->tlink_tree_lock);
3098         while ((node = rb_first(root))) {
3099                 tlink = rb_entry(node, struct tcon_link, tl_rbnode);
3100                 cifs_get_tlink(tlink);
3101                 clear_bit(TCON_LINK_IN_TREE, &tlink->tl_flags);
3102                 rb_erase(node, root);
3103
3104                 spin_unlock(&cifs_sb->tlink_tree_lock);
3105                 cifs_put_tlink(tlink);
3106                 spin_lock(&cifs_sb->tlink_tree_lock);
3107         }
3108         spin_unlock(&cifs_sb->tlink_tree_lock);
3109
3110         tmp = cifs_sb->prepath;
3111         cifs_sb->prepathlen = 0;
3112         cifs_sb->prepath = NULL;
3113         kfree(tmp);
3114
3115         return 0;
3116 }
3117
3118 int cifs_negotiate_protocol(unsigned int xid, struct cifsSesInfo *ses)
3119 {
3120         int rc = 0;
3121         struct TCP_Server_Info *server = ses->server;
3122
3123         /* only send once per connect */
3124         if (server->maxBuf != 0)
3125                 return 0;
3126
3127         rc = CIFSSMBNegotiate(xid, ses);
3128         if (rc == -EAGAIN) {
3129                 /* retry only once on 1st time connection */
3130                 rc = CIFSSMBNegotiate(xid, ses);
3131                 if (rc == -EAGAIN)
3132                         rc = -EHOSTDOWN;
3133         }
3134         if (rc == 0) {
3135                 spin_lock(&GlobalMid_Lock);
3136                 if (server->tcpStatus != CifsExiting)
3137                         server->tcpStatus = CifsGood;
3138                 else
3139                         rc = -EHOSTDOWN;
3140                 spin_unlock(&GlobalMid_Lock);
3141
3142         }
3143
3144         return rc;
3145 }
3146
3147
3148 int cifs_setup_session(unsigned int xid, struct cifsSesInfo *ses,
3149                         struct nls_table *nls_info)
3150 {
3151         int rc = 0;
3152         struct TCP_Server_Info *server = ses->server;
3153
3154         ses->flags = 0;
3155         ses->capabilities = server->capabilities;
3156         if (linuxExtEnabled == 0)
3157                 ses->capabilities &= (~CAP_UNIX);
3158
3159         cFYI(1, "Security Mode: 0x%x Capabilities: 0x%x TimeAdjust: %d",
3160                  server->secMode, server->capabilities, server->timeAdj);
3161
3162         rc = CIFS_SessSetup(xid, ses, nls_info);
3163         if (rc) {
3164                 cERROR(1, "Send error in SessSetup = %d", rc);
3165         } else {
3166                 mutex_lock(&ses->server->srv_mutex);
3167                 if (!server->session_estab) {
3168                         server->session_key.response = ses->auth_key.response;
3169                         server->session_key.len = ses->auth_key.len;
3170                         server->sequence_number = 0x2;
3171                         server->session_estab = true;
3172                         ses->auth_key.response = NULL;
3173                 }
3174                 mutex_unlock(&server->srv_mutex);
3175
3176                 cFYI(1, "CIFS Session Established successfully");
3177                 spin_lock(&GlobalMid_Lock);
3178                 ses->status = CifsGood;
3179                 ses->need_reconnect = false;
3180                 spin_unlock(&GlobalMid_Lock);
3181         }
3182
3183         kfree(ses->auth_key.response);
3184         ses->auth_key.response = NULL;
3185         ses->auth_key.len = 0;
3186         kfree(ses->ntlmssp);
3187         ses->ntlmssp = NULL;
3188
3189         return rc;
3190 }
3191
3192 static struct cifsTconInfo *
3193 cifs_construct_tcon(struct cifs_sb_info *cifs_sb, uid_t fsuid)
3194 {
3195         struct cifsTconInfo *master_tcon = cifs_sb_master_tcon(cifs_sb);
3196         struct cifsSesInfo *ses;
3197         struct cifsTconInfo *tcon = NULL;
3198         struct smb_vol *vol_info;
3199         char username[MAX_USERNAME_SIZE + 1];
3200
3201         vol_info = kzalloc(sizeof(*vol_info), GFP_KERNEL);
3202         if (vol_info == NULL) {
3203                 tcon = ERR_PTR(-ENOMEM);
3204                 goto out;
3205         }
3206
3207         snprintf(username, MAX_USERNAME_SIZE, "krb50x%x", fsuid);
3208         vol_info->username = username;
3209         vol_info->local_nls = cifs_sb->local_nls;
3210         vol_info->linux_uid = fsuid;
3211         vol_info->cred_uid = fsuid;
3212         vol_info->UNC = master_tcon->treeName;
3213         vol_info->retry = master_tcon->retry;
3214         vol_info->nocase = master_tcon->nocase;
3215         vol_info->local_lease = master_tcon->local_lease;
3216         vol_info->no_linux_ext = !master_tcon->unix_ext;
3217
3218         /* FIXME: allow for other secFlg settings */
3219         vol_info->secFlg = CIFSSEC_MUST_KRB5;
3220
3221         /* get a reference for the same TCP session */
3222         spin_lock(&cifs_tcp_ses_lock);
3223         ++master_tcon->ses->server->srv_count;
3224         spin_unlock(&cifs_tcp_ses_lock);
3225
3226         ses = cifs_get_smb_ses(master_tcon->ses->server, vol_info);
3227         if (IS_ERR(ses)) {
3228                 tcon = (struct cifsTconInfo *)ses;
3229                 cifs_put_tcp_session(master_tcon->ses->server);
3230                 goto out;
3231         }
3232
3233         tcon = cifs_get_tcon(ses, vol_info);
3234         if (IS_ERR(tcon)) {
3235                 cifs_put_smb_ses(ses);
3236                 goto out;
3237         }
3238
3239         if (ses->capabilities & CAP_UNIX)
3240                 reset_cifs_unix_caps(0, tcon, NULL, vol_info);
3241 out:
3242         kfree(vol_info);
3243
3244         return tcon;
3245 }
3246
3247 static inline struct tcon_link *
3248 cifs_sb_master_tlink(struct cifs_sb_info *cifs_sb)
3249 {
3250         return cifs_sb->master_tlink;
3251 }
3252
3253 struct cifsTconInfo *
3254 cifs_sb_master_tcon(struct cifs_sb_info *cifs_sb)
3255 {
3256         return tlink_tcon(cifs_sb_master_tlink(cifs_sb));
3257 }
3258
3259 static int
3260 cifs_sb_tcon_pending_wait(void *unused)
3261 {
3262         schedule();
3263         return signal_pending(current) ? -ERESTARTSYS : 0;
3264 }
3265
3266 /* find and return a tlink with given uid */
3267 static struct tcon_link *
3268 tlink_rb_search(struct rb_root *root, uid_t uid)
3269 {
3270         struct rb_node *node = root->rb_node;
3271         struct tcon_link *tlink;
3272
3273         while (node) {
3274                 tlink = rb_entry(node, struct tcon_link, tl_rbnode);
3275
3276                 if (tlink->tl_uid > uid)
3277                         node = node->rb_left;
3278                 else if (tlink->tl_uid < uid)
3279                         node = node->rb_right;
3280                 else
3281                         return tlink;
3282         }
3283         return NULL;
3284 }
3285
3286 /* insert a tcon_link into the tree */
3287 static void
3288 tlink_rb_insert(struct rb_root *root, struct tcon_link *new_tlink)
3289 {
3290         struct rb_node **new = &(root->rb_node), *parent = NULL;
3291         struct tcon_link *tlink;
3292
3293         while (*new) {
3294                 tlink = rb_entry(*new, struct tcon_link, tl_rbnode);
3295                 parent = *new;
3296
3297                 if (tlink->tl_uid > new_tlink->tl_uid)
3298                         new = &((*new)->rb_left);
3299                 else
3300                         new = &((*new)->rb_right);
3301         }
3302
3303         rb_link_node(&new_tlink->tl_rbnode, parent, new);
3304         rb_insert_color(&new_tlink->tl_rbnode, root);
3305 }
3306
3307 /*
3308  * Find or construct an appropriate tcon given a cifs_sb and the fsuid of the
3309  * current task.
3310  *
3311  * If the superblock doesn't refer to a multiuser mount, then just return
3312  * the master tcon for the mount.
3313  *
3314  * First, search the rbtree for an existing tcon for this fsuid. If one
3315  * exists, then check to see if it's pending construction. If it is then wait
3316  * for construction to complete. Once it's no longer pending, check to see if
3317  * it failed and either return an error or retry construction, depending on
3318  * the timeout.
3319  *
3320  * If one doesn't exist then insert a new tcon_link struct into the tree and
3321  * try to construct a new one.
3322  */
3323 struct tcon_link *
3324 cifs_sb_tlink(struct cifs_sb_info *cifs_sb)
3325 {
3326         int ret;
3327         uid_t fsuid = current_fsuid();
3328         struct tcon_link *tlink, *newtlink;
3329
3330         if (!(cifs_sb->mnt_cifs_flags & CIFS_MOUNT_MULTIUSER))
3331                 return cifs_get_tlink(cifs_sb_master_tlink(cifs_sb));
3332
3333         spin_lock(&cifs_sb->tlink_tree_lock);
3334         tlink = tlink_rb_search(&cifs_sb->tlink_tree, fsuid);
3335         if (tlink)
3336                 cifs_get_tlink(tlink);
3337         spin_unlock(&cifs_sb->tlink_tree_lock);
3338
3339         if (tlink == NULL) {
3340                 newtlink = kzalloc(sizeof(*tlink), GFP_KERNEL);
3341                 if (newtlink == NULL)
3342                         return ERR_PTR(-ENOMEM);
3343                 newtlink->tl_uid = fsuid;
3344                 newtlink->tl_tcon = ERR_PTR(-EACCES);
3345                 set_bit(TCON_LINK_PENDING, &newtlink->tl_flags);
3346                 set_bit(TCON_LINK_IN_TREE, &newtlink->tl_flags);
3347                 cifs_get_tlink(newtlink);
3348
3349                 spin_lock(&cifs_sb->tlink_tree_lock);
3350                 /* was one inserted after previous search? */
3351                 tlink = tlink_rb_search(&cifs_sb->tlink_tree, fsuid);
3352                 if (tlink) {
3353                         cifs_get_tlink(tlink);
3354                         spin_unlock(&cifs_sb->tlink_tree_lock);
3355                         kfree(newtlink);
3356                         goto wait_for_construction;
3357                 }
3358                 tlink = newtlink;
3359                 tlink_rb_insert(&cifs_sb->tlink_tree, tlink);
3360                 spin_unlock(&cifs_sb->tlink_tree_lock);
3361         } else {
3362 wait_for_construction:
3363                 ret = wait_on_bit(&tlink->tl_flags, TCON_LINK_PENDING,
3364                                   cifs_sb_tcon_pending_wait,
3365                                   TASK_INTERRUPTIBLE);
3366                 if (ret) {
3367                         cifs_put_tlink(tlink);
3368                         return ERR_PTR(ret);
3369                 }
3370
3371                 /* if it's good, return it */
3372                 if (!IS_ERR(tlink->tl_tcon))
3373                         return tlink;
3374
3375                 /* return error if we tried this already recently */
3376                 if (time_before(jiffies, tlink->tl_time + TLINK_ERROR_EXPIRE)) {
3377                         cifs_put_tlink(tlink);
3378                         return ERR_PTR(-EACCES);
3379                 }
3380
3381                 if (test_and_set_bit(TCON_LINK_PENDING, &tlink->tl_flags))
3382                         goto wait_for_construction;
3383         }
3384
3385         tlink->tl_tcon = cifs_construct_tcon(cifs_sb, fsuid);
3386         clear_bit(TCON_LINK_PENDING, &tlink->tl_flags);
3387         wake_up_bit(&tlink->tl_flags, TCON_LINK_PENDING);
3388
3389         if (IS_ERR(tlink->tl_tcon)) {
3390                 cifs_put_tlink(tlink);
3391                 return ERR_PTR(-EACCES);
3392         }
3393
3394         return tlink;
3395 }
3396
3397 /*
3398  * periodic workqueue job that scans tcon_tree for a superblock and closes
3399  * out tcons.
3400  */
3401 static void
3402 cifs_prune_tlinks(struct work_struct *work)
3403 {
3404         struct cifs_sb_info *cifs_sb = container_of(work, struct cifs_sb_info,
3405                                                     prune_tlinks.work);
3406         struct rb_root *root = &cifs_sb->tlink_tree;
3407         struct rb_node *node = rb_first(root);
3408         struct rb_node *tmp;
3409         struct tcon_link *tlink;
3410
3411         /*
3412          * Because we drop the spinlock in the loop in order to put the tlink
3413          * it's not guarded against removal of links from the tree. The only
3414          * places that remove entries from the tree are this function and
3415          * umounts. Because this function is non-reentrant and is canceled
3416          * before umount can proceed, this is safe.
3417          */
3418         spin_lock(&cifs_sb->tlink_tree_lock);
3419         node = rb_first(root);
3420         while (node != NULL) {
3421                 tmp = node;
3422                 node = rb_next(tmp);
3423                 tlink = rb_entry(tmp, struct tcon_link, tl_rbnode);
3424
3425                 if (test_bit(TCON_LINK_MASTER, &tlink->tl_flags) ||
3426                     atomic_read(&tlink->tl_count) != 0 ||
3427                     time_after(tlink->tl_time + TLINK_IDLE_EXPIRE, jiffies))
3428                         continue;
3429
3430                 cifs_get_tlink(tlink);
3431                 clear_bit(TCON_LINK_IN_TREE, &tlink->tl_flags);
3432                 rb_erase(tmp, root);
3433
3434                 spin_unlock(&cifs_sb->tlink_tree_lock);
3435                 cifs_put_tlink(tlink);
3436                 spin_lock(&cifs_sb->tlink_tree_lock);
3437         }
3438         spin_unlock(&cifs_sb->tlink_tree_lock);
3439
3440         queue_delayed_work(system_nrt_wq, &cifs_sb->prune_tlinks,
3441                                 TLINK_IDLE_EXPIRE);
3442 }