fs/cifs/connect.c

   1 /*
   2  *   fs/cifs/connect.c
   3  *
   4  *   Copyright (C) International Business Machines  Corp., 2002,2009
   5  *   Author(s): Steve French (sfrench@us.ibm.com)
   6  *
   7  *   This library is free software; you can redistribute it and/or modify
   8  *   it under the terms of the GNU Lesser General Public License as published
   9  *   by the Free Software Foundation; either version 2.1 of the License, or
  10  *   (at your option) any later version.
  11  *
  12  *   This library is distributed in the hope that it will be useful,
  13  *   but WITHOUT ANY WARRANTY; without even the implied warranty of
  14  *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See
  15  *   the GNU Lesser General Public License for more details.
  16  *
  17  *   You should have received a copy of the GNU Lesser General Public License
  18  *   along with this library; if not, write to the Free Software
  19  *   Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
  20  */
  21 #include <linux/fs.h>
  22 #include <linux/net.h>
  23 #include <linux/string.h>
  24 #include <linux/list.h>
  25 #include <linux/wait.h>
  26 #include <linux/slab.h>
  27 #include <linux/pagemap.h>
  28 #include <linux/ctype.h>
  29 #include <linux/utsname.h>
  30 #include <linux/mempool.h>
  31 #include <linux/delay.h>
  32 #include <linux/completion.h>
  33 #include <linux/kthread.h>
  34 #include <linux/pagevec.h>
  35 #include <linux/freezer.h>
  36 #include <linux/namei.h>
  37 #include <asm/uaccess.h>
  38 #include <asm/processor.h>
  39 #include <linux/inet.h>
  40 #include <net/ipv6.h>
  41 #include "cifspdu.h"
  42 #include "cifsglob.h"
  43 #include "cifsproto.h"
  44 #include "cifs_unicode.h"
  45 #include "cifs_debug.h"
  46 #include "cifs_fs_sb.h"
  47 #include "ntlmssp.h"
  48 #include "nterr.h"
  49 #include "rfc1002pdu.h"
  50 #include "fscache.h"
  51
  52 #define CIFS_PORT 445
  53 #define RFC1001_PORT 139
  54
  55 /* SMB echo "timeout" -- FIXME: tunable? */
  56 #define SMB_ECHO_INTERVAL (60 * HZ)
  57
  58 extern mempool_t *cifs_req_poolp;
  59
  60 struct smb_vol {
  61         char *username;
  62         char *password;
  63         char *domainname;
  64         char *UNC;
  65         char *UNCip;
  66         char *iocharset;  /* local code page for mapping to and from Unicode */
  67         char source_rfc1001_name[RFC1001_NAME_LEN_WITH_NULL]; /* clnt nb name */
  68         char target_rfc1001_name[RFC1001_NAME_LEN_WITH_NULL]; /* srvr nb name */
  69         uid_t cred_uid;
  70         uid_t linux_uid;
  71         gid_t linux_gid;
  72         mode_t file_mode;
  73         mode_t dir_mode;
  74         unsigned secFlg;
  75         bool retry:1;
  76         bool intr:1;
  77         bool setuids:1;
  78         bool override_uid:1;
  79         bool override_gid:1;
  80         bool dynperm:1;
  81         bool noperm:1;
  82         bool no_psx_acl:1; /* set if posix acl support should be disabled */
  83         bool cifs_acl:1;
  84         bool no_xattr:1;   /* set if xattr (EA) support should be disabled*/
  85         bool server_ino:1; /* use inode numbers from server ie UniqueId */
  86         bool direct_io:1;
  87         bool strict_io:1; /* strict cache behavior */
  88         bool remap:1;      /* set to remap seven reserved chars in filenames */
  89         bool posix_paths:1; /* unset to not ask for posix pathnames. */
  90         bool no_linux_ext:1;
  91         bool sfu_emul:1;
  92         bool nullauth:1;   /* attempt to authenticate with null user */
  93         bool nocase:1;     /* request case insensitive filenames */
  94         bool nobrl:1;      /* disable sending byte range locks to srv */
  95         bool mand_lock:1;  /* send mandatory not posix byte range lock reqs */
  96         bool seal:1;       /* request transport encryption on share */
  97         bool nodfs:1;      /* Do not request DFS, even if available */
  98         bool local_lease:1; /* check leases only on local system, not remote */
  99         bool noblocksnd:1;
 100         bool noautotune:1;
 101         bool nostrictsync:1; /* do not force expensive SMBflush on every sync */
 102         bool fsc:1;     /* enable fscache */
 103         bool mfsymlinks:1; /* use Minshall+French Symlinks */
 104         bool multiuser:1;
 105         unsigned int rsize;
 106         unsigned int wsize;
 107         bool sockopt_tcp_nodelay:1;
 108         unsigned short int port;
 109         unsigned long actimeo; /* attribute cache timeout (jiffies) */
 110         char *prepath;
 111         struct sockaddr_storage srcaddr; /* allow binding to a local IP */
 112         struct nls_table *local_nls;
 113 };
 114
 115 /* FIXME: should these be tunable? */
 116 #define TLINK_ERROR_EXPIRE      (1 * HZ)
 117 #define TLINK_IDLE_EXPIRE       (600 * HZ)
 118
 119 static int ip_connect(struct TCP_Server_Info *server);
 120 static int generic_ip_connect(struct TCP_Server_Info *server);
 121 static void tlink_rb_insert(struct rb_root *root, struct tcon_link *new_tlink);
 122 static void cifs_prune_tlinks(struct work_struct *work);
 123
 124 /*
 125  * cifs tcp session reconnection
 126  *
 127  * mark tcp session as reconnecting so temporarily locked
 128  * mark all smb sessions as reconnecting for tcp session
 129  * reconnect tcp session
 130  * wake up waiters on reconnection? - (not needed currently)
 131  */
 132 static int
 133 cifs_reconnect(struct TCP_Server_Info *server)
 134 {
 135         int rc = 0;
 136         struct list_head *tmp, *tmp2;
 137         struct cifsSesInfo *ses;
 138         struct cifsTconInfo *tcon;
 139         struct mid_q_entry *mid_entry;
 140
 141         spin_lock(&GlobalMid_Lock);
 142         if (server->tcpStatus == CifsExiting) {
 143                 /* the demux thread will exit normally
 144                 next time through the loop */
 145                 spin_unlock(&GlobalMid_Lock);
 146                 return rc;
 147         } else
 148                 server->tcpStatus = CifsNeedReconnect;
 149         spin_unlock(&GlobalMid_Lock);
 150         server->maxBuf = 0;
 151
 152         cFYI(1, "Reconnecting tcp session");
 153
 154         /* before reconnecting the tcp session, mark the smb session (uid)
 155                 and the tid bad so they are not used until reconnected */
 156         cFYI(1, "%s: marking sessions and tcons for reconnect", __func__);
 157         spin_lock(&cifs_tcp_ses_lock);
 158         list_for_each(tmp, &server->smb_ses_list) {
 159                 ses = list_entry(tmp, struct cifsSesInfo, smb_ses_list);
 160                 ses->need_reconnect = true;
 161                 ses->ipc_tid = 0;
 162                 list_for_each(tmp2, &ses->tcon_list) {
 163                         tcon = list_entry(tmp2, struct cifsTconInfo, tcon_list);
 164                         tcon->need_reconnect = true;
 165                 }
 166         }
 167         spin_unlock(&cifs_tcp_ses_lock);
 168
 169         /* do not want to be sending data on a socket we are freeing */
 170         cFYI(1, "%s: tearing down socket", __func__);
 171         mutex_lock(&server->srv_mutex);
 172         if (server->ssocket) {
 173                 cFYI(1, "State: 0x%x Flags: 0x%lx", server->ssocket->state,
 174                         server->ssocket->flags);
 175                 kernel_sock_shutdown(server->ssocket, SHUT_WR);
 176                 cFYI(1, "Post shutdown state: 0x%x Flags: 0x%lx",
 177                         server->ssocket->state,
 178                         server->ssocket->flags);
 179                 sock_release(server->ssocket);
 180                 server->ssocket = NULL;
 181         }
 182         server->sequence_number = 0;
 183         server->session_estab = false;
 184         kfree(server->session_key.response);
 185         server->session_key.response = NULL;
 186         server->session_key.len = 0;
 187         server->lstrp = jiffies;
 188         mutex_unlock(&server->srv_mutex);
 189
 190         /* mark submitted MIDs for retry and issue callback */
 191         cFYI(1, "%s: issuing mid callbacks", __func__);
 192         spin_lock(&GlobalMid_Lock);
 193         list_for_each_safe(tmp, tmp2, &server->pending_mid_q) {
 194                 mid_entry = list_entry(tmp, struct mid_q_entry, qhead);
 195                 if (mid_entry->midState == MID_REQUEST_SUBMITTED)
 196                         mid_entry->midState = MID_RETRY_NEEDED;
 197                 list_del_init(&mid_entry->qhead);
 198                 mid_entry->callback(mid_entry);
 199         }
 200         spin_unlock(&GlobalMid_Lock);
 201
 202         while ((server->tcpStatus != CifsExiting) &&
 203                (server->tcpStatus != CifsGood)) {
 204                 try_to_freeze();
 205
 206                 /* we should try only the port we connected to before */
 207                 rc = generic_ip_connect(server);
 208                 if (rc) {
 209                         cFYI(1, "reconnect error %d", rc);
 210                         msleep(3000);
 211                 } else {
 212                         atomic_inc(&tcpSesReconnectCount);
 213                         spin_lock(&GlobalMid_Lock);
 214                         if (server->tcpStatus != CifsExiting)
 215                                 server->tcpStatus = CifsGood;
 216                         spin_unlock(&GlobalMid_Lock);
 217                 }
 218         }
 219
 220         return rc;
 221 }
 222
 223 /*
 224         return codes:
 225                 0       not a transact2, or all data present
 226                 >0      transact2 with that much data missing
 227                 -EINVAL = invalid transact2
 228
 229  */
 230 static int check2ndT2(struct smb_hdr *pSMB, unsigned int maxBufSize)
 231 {
 232         struct smb_t2_rsp *pSMBt;
 233         int remaining;
 234         __u16 total_data_size, data_in_this_rsp;
 235
 236         if (pSMB->Command != SMB_COM_TRANSACTION2)
 237                 return 0;
 238
 239         /* check for plausible wct, bcc and t2 data and parm sizes */
 240         /* check for parm and data offset going beyond end of smb */
 241         if (pSMB->WordCount != 10) { /* coalesce_t2 depends on this */
 242                 cFYI(1, "invalid transact2 word count");
 243                 return -EINVAL;
 244         }
 245
 246         pSMBt = (struct smb_t2_rsp *)pSMB;
 247
 248         total_data_size = get_unaligned_le16(&pSMBt->t2_rsp.TotalDataCount);
 249         data_in_this_rsp = get_unaligned_le16(&pSMBt->t2_rsp.DataCount);
 250
 251         remaining = total_data_size - data_in_this_rsp;
 252
 253         if (remaining == 0)
 254                 return 0;
 255         else if (remaining < 0) {
 256                 cFYI(1, "total data %d smaller than data in frame %d",
 257                         total_data_size, data_in_this_rsp);
 258                 return -EINVAL;
 259         } else {
 260                 cFYI(1, "missing %d bytes from transact2, check next response",
 261                         remaining);
 262                 if (total_data_size > maxBufSize) {
 263                         cERROR(1, "TotalDataSize %d is over maximum buffer %d",
 264                                 total_data_size, maxBufSize);
 265                         return -EINVAL;
 266                 }
 267                 return remaining;
 268         }
 269 }
 270
 271 static int coalesce_t2(struct smb_hdr *psecond, struct smb_hdr *pTargetSMB)
 272 {
 273         struct smb_t2_rsp *pSMB2 = (struct smb_t2_rsp *)psecond;
 274         struct smb_t2_rsp *pSMBt  = (struct smb_t2_rsp *)pTargetSMB;
 275         char *data_area_of_target;
 276         char *data_area_of_buf2;
 277         int remaining;
 278         unsigned int byte_count, total_in_buf;
 279         __u16 total_data_size, total_in_buf2;
 280
 281         total_data_size = get_unaligned_le16(&pSMBt->t2_rsp.TotalDataCount);
 282
 283         if (total_data_size !=
 284             get_unaligned_le16(&pSMB2->t2_rsp.TotalDataCount))
 285                 cFYI(1, "total data size of primary and secondary t2 differ");
 286
 287         total_in_buf = get_unaligned_le16(&pSMBt->t2_rsp.DataCount);
 288
 289         remaining = total_data_size - total_in_buf;
 290
 291         if (remaining < 0)
 292                 return -EPROTO;
 293
 294         if (remaining == 0) /* nothing to do, ignore */
 295                 return 0;
 296
 297         total_in_buf2 = get_unaligned_le16(&pSMB2->t2_rsp.DataCount);
 298         if (remaining < total_in_buf2) {
 299                 cFYI(1, "transact2 2nd response contains too much data");
 300         }
 301
 302         /* find end of first SMB data area */
 303         data_area_of_target = (char *)&pSMBt->hdr.Protocol +
 304                                 get_unaligned_le16(&pSMBt->t2_rsp.DataOffset);
 305         /* validate target area */
 306
 307         data_area_of_buf2 = (char *)&pSMB2->hdr.Protocol +
 308                                 get_unaligned_le16(&pSMB2->t2_rsp.DataOffset);
 309
 310         data_area_of_target += total_in_buf;
 311
 312         /* copy second buffer into end of first buffer */
 313         total_in_buf += total_in_buf2;
 314         /* is the result too big for the field? */
 315         if (total_in_buf > USHRT_MAX)
 316                 return -EPROTO;
 317         put_unaligned_le16(total_in_buf, &pSMBt->t2_rsp.DataCount);
 318
 319         /* fix up the BCC */
 320         byte_count = get_bcc_le(pTargetSMB);
 321         byte_count += total_in_buf2;
 322         /* is the result too big for the field? */
 323         if (byte_count > USHRT_MAX)
 324                 return -EPROTO;
 325         put_bcc_le(byte_count, pTargetSMB);
 326
 327         byte_count = pTargetSMB->smb_buf_length;
 328         byte_count += total_in_buf2;
 329         /* don't allow buffer to overflow */
 330         if (byte_count > CIFSMaxBufSize)
 331                 return -ENOBUFS;
 332         pTargetSMB->smb_buf_length = byte_count;
 333
 334         memcpy(data_area_of_target, data_area_of_buf2, total_in_buf2);
 335
 336         if (remaining == total_in_buf2) {
 337                 cFYI(1, "found the last secondary response");
 338                 return 0; /* we are done */
 339         } else /* more responses to go */
 340                 return 1;
 341 }
 342
 343 static void
 344 cifs_echo_request(struct work_struct *work)
 345 {
 346         int rc;
 347         struct TCP_Server_Info *server = container_of(work,
 348                                         struct TCP_Server_Info, echo.work);
 349
 350         /*
 351          * We cannot send an echo until the NEGOTIATE_PROTOCOL request is
 352          * done, which is indicated by maxBuf != 0. Also, no need to ping if
 353          * we got a response recently
 354          */
 355         if (server->maxBuf == 0 ||
 356             time_before(jiffies, server->lstrp + SMB_ECHO_INTERVAL - HZ))
 357                 goto requeue_echo;
 358
 359         rc = CIFSSMBEcho(server);
 360         if (rc)
 361                 cFYI(1, "Unable to send echo request to server: %s",
 362                         server->hostname);
 363
 364 requeue_echo:
 365         queue_delayed_work(system_nrt_wq, &server->echo, SMB_ECHO_INTERVAL);
 366 }
 367
 368 static int
 369 cifs_demultiplex_thread(struct TCP_Server_Info *server)
 370 {
 371         int length;
 372         unsigned int pdu_length, total_read;
 373         struct smb_hdr *smb_buffer = NULL;
 374         struct smb_hdr *bigbuf = NULL;
 375         struct smb_hdr *smallbuf = NULL;
 376         struct msghdr smb_msg;
 377         struct kvec iov;
 378         struct socket *csocket = server->ssocket;
 379         struct list_head *tmp, *tmp2;
 380         struct task_struct *task_to_wake = NULL;
 381         struct mid_q_entry *mid_entry;
 382         char temp;
 383         bool isLargeBuf = false;
 384         bool isMultiRsp;
 385         int reconnect;
 386
 387         current->flags |= PF_MEMALLOC;
 388         cFYI(1, "Demultiplex PID: %d", task_pid_nr(current));
 389
 390         length = atomic_inc_return(&tcpSesAllocCount);
 391         if (length > 1)
 392                 mempool_resize(cifs_req_poolp, length + cifs_min_rcv,
 393                                 GFP_KERNEL);
 394
 395         set_freezable();
 396         while (server->tcpStatus != CifsExiting) {
 397                 if (try_to_freeze())
 398                         continue;
 399                 if (bigbuf == NULL) {
 400                         bigbuf = cifs_buf_get();
 401                         if (!bigbuf) {
 402                                 cERROR(1, "No memory for large SMB response");
 403                                 msleep(3000);
 404                                 /* retry will check if exiting */
 405                                 continue;
 406                         }
 407                 } else if (isLargeBuf) {
 408                         /* we are reusing a dirty large buf, clear its start */
 409                         memset(bigbuf, 0, sizeof(struct smb_hdr));
 410                 }
 411
 412                 if (smallbuf == NULL) {
 413                         smallbuf = cifs_small_buf_get();
 414                         if (!smallbuf) {
 415                                 cERROR(1, "No memory for SMB response");
 416                                 msleep(1000);
 417                                 /* retry will check if exiting */
 418                                 continue;
 419                         }
 420                         /* beginning of smb buffer is cleared in our buf_get */
 421                 } else /* if existing small buf clear beginning */
 422                         memset(smallbuf, 0, sizeof(struct smb_hdr));
 423
 424                 isLargeBuf = false;
 425                 isMultiRsp = false;
 426                 smb_buffer = smallbuf;
 427                 iov.iov_base = smb_buffer;
 428                 iov.iov_len = 4;
 429                 smb_msg.msg_control = NULL;
 430                 smb_msg.msg_controllen = 0;
 431                 pdu_length = 4; /* enough to get RFC1001 header */
 432
 433 incomplete_rcv:
 434                 if (echo_retries > 0 &&
 435                     time_after(jiffies, server->lstrp +
 436                                         (echo_retries * SMB_ECHO_INTERVAL))) {
 437                         cERROR(1, "Server %s has not responded in %d seconds. "
 438                                   "Reconnecting...", server->hostname,
 439                                   (echo_retries * SMB_ECHO_INTERVAL / HZ));
 440                         cifs_reconnect(server);
 441                         csocket = server->ssocket;
 442                         wake_up(&server->response_q);
 443                         continue;
 444                 }
 445
 446                 length =
 447                     kernel_recvmsg(csocket, &smb_msg,
 448                                 &iov, 1, pdu_length, 0 /* BB other flags? */);
 449
 450                 if (server->tcpStatus == CifsExiting) {
 451                         break;
 452                 } else if (server->tcpStatus == CifsNeedReconnect) {
 453                         cFYI(1, "Reconnect after server stopped responding");
 454                         cifs_reconnect(server);
 455                         cFYI(1, "call to reconnect done");
 456                         csocket = server->ssocket;
 457                         continue;
 458                 } else if (length == -ERESTARTSYS ||
 459                            length == -EAGAIN ||
 460                            length == -EINTR) {
 461                         msleep(1); /* minimum sleep to prevent looping
 462                                 allowing socket to clear and app threads to set
 463                                 tcpStatus CifsNeedReconnect if server hung */
 464                         if (pdu_length < 4) {
 465                                 iov.iov_base = (4 - pdu_length) +
 466                                                         (char *)smb_buffer;
 467                                 iov.iov_len = pdu_length;
 468                                 smb_msg.msg_control = NULL;
 469                                 smb_msg.msg_controllen = 0;
 470                                 goto incomplete_rcv;
 471                         } else
 472                                 continue;
 473                 } else if (length <= 0) {
 474                         cFYI(1, "Reconnect after unexpected peek error %d",
 475                                 length);
 476                         cifs_reconnect(server);
 477                         csocket = server->ssocket;
 478                         wake_up(&server->response_q);
 479                         continue;
 480                 } else if (length < pdu_length) {
 481                         cFYI(1, "requested %d bytes but only got %d bytes",
 482                                   pdu_length, length);
 483                         pdu_length -= length;
 484                         msleep(1);
 485                         goto incomplete_rcv;
 486                 }
 487
 488                 /* The right amount was read from socket - 4 bytes */
 489                 /* so we can now interpret the length field */
 490
 491                 /* the first byte big endian of the length field,
 492                 is actually not part of the length but the type
 493                 with the most common, zero, as regular data */
 494                 temp = *((char *) smb_buffer);
 495
 496                 /* Note that FC 1001 length is big endian on the wire,
 497                 but we convert it here so it is always manipulated
 498                 as host byte order */
 499                 pdu_length = be32_to_cpu((__force __be32)smb_buffer->smb_buf_length);
 500                 smb_buffer->smb_buf_length = pdu_length;
 501
 502                 cFYI(1, "rfc1002 length 0x%x", pdu_length+4);
 503
 504                 if (temp == (char) RFC1002_SESSION_KEEP_ALIVE) {
 505                         continue;
 506                 } else if (temp == (char)RFC1002_POSITIVE_SESSION_RESPONSE) {
 507                         cFYI(1, "Good RFC 1002 session rsp");
 508                         continue;
 509                 } else if (temp == (char)RFC1002_NEGATIVE_SESSION_RESPONSE) {
 510                         /* we get this from Windows 98 instead of
 511                            an error on SMB negprot response */
 512                         cFYI(1, "Negative RFC1002 Session Response Error 0x%x)",
 513                                 pdu_length);
 514                         /* give server a second to clean up  */
 515                         msleep(1000);
 516                         /* always try 445 first on reconnect since we get NACK
 517                          * on some if we ever connected to port 139 (the NACK
 518                          * is since we do not begin with RFC1001 session
 519                          * initialize frame)
 520                          */
 521                         cifs_set_port((struct sockaddr *)
 522                                         &server->dstaddr, CIFS_PORT);
 523                         cifs_reconnect(server);
 524                         csocket = server->ssocket;
 525                         wake_up(&server->response_q);
 526                         continue;
 527                 } else if (temp != (char) 0) {
 528                         cERROR(1, "Unknown RFC 1002 frame");
 529                         cifs_dump_mem(" Received Data: ", (char *)smb_buffer,
 530                                       length);
 531                         cifs_reconnect(server);
 532                         csocket = server->ssocket;
 533                         continue;
 534                 }
 535
 536                 /* else we have an SMB response */
 537                 if ((pdu_length > CIFSMaxBufSize + MAX_CIFS_HDR_SIZE - 4) ||
 538                             (pdu_length < sizeof(struct smb_hdr) - 1 - 4)) {
 539                         cERROR(1, "Invalid size SMB length %d pdu_length %d",
 540                                         length, pdu_length+4);
 541                         cifs_reconnect(server);
 542                         csocket = server->ssocket;
 543                         wake_up(&server->response_q);
 544                         continue;
 545                 }
 546
 547                 /* else length ok */
 548                 reconnect = 0;
 549
 550                 if (pdu_length > MAX_CIFS_SMALL_BUFFER_SIZE - 4) {
 551                         isLargeBuf = true;
 552                         memcpy(bigbuf, smallbuf, 4);
 553                         smb_buffer = bigbuf;
 554                 }
 555                 length = 0;
 556                 iov.iov_base = 4 + (char *)smb_buffer;
 557                 iov.iov_len = pdu_length;
 558                 for (total_read = 0; total_read < pdu_length;
 559                      total_read += length) {
 560                         length = kernel_recvmsg(csocket, &smb_msg, &iov, 1,
 561                                                 pdu_length - total_read, 0);
 562                         if (server->tcpStatus == CifsExiting) {
 563                                 /* then will exit */
 564                                 reconnect = 2;
 565                                 break;
 566                         } else if (server->tcpStatus == CifsNeedReconnect) {
 567                                 cifs_reconnect(server);
 568                                 csocket = server->ssocket;
 569                                 /* Reconnect wakes up rspns q */
 570                                 /* Now we will reread sock */
 571                                 reconnect = 1;
 572                                 break;
 573                         } else if (length == -ERESTARTSYS ||
 574                                    length == -EAGAIN ||
 575                                    length == -EINTR) {
 576                                 msleep(1); /* minimum sleep to prevent looping,
 577                                               allowing socket to clear and app
 578                                               threads to set tcpStatus
 579                                               CifsNeedReconnect if server hung*/
 580                                 length = 0;
 581                                 continue;
 582                         } else if (length <= 0) {
 583                                 cERROR(1, "Received no data, expecting %d",
 584                                               pdu_length - total_read);
 585                                 cifs_reconnect(server);
 586                                 csocket = server->ssocket;
 587                                 reconnect = 1;
 588                                 break;
 589                         }
 590                 }
 591                 if (reconnect == 2)
 592                         break;
 593                 else if (reconnect == 1)
 594                         continue;
 595
 596                 total_read += 4; /* account for rfc1002 hdr */
 597
 598                 dump_smb(smb_buffer, total_read);
 599
 600                 /*
 601                  * We know that we received enough to get to the MID as we
 602                  * checked the pdu_length earlier. Now check to see
 603                  * if the rest of the header is OK. We borrow the length
 604                  * var for the rest of the loop to avoid a new stack var.
 605                  *
 606                  * 48 bytes is enough to display the header and a little bit
 607                  * into the payload for debugging purposes.
 608                  */
 609                 length = checkSMB(smb_buffer, smb_buffer->Mid, total_read);
 610                 if (length != 0)
 611                         cifs_dump_mem("Bad SMB: ", smb_buffer,
 612                                         min_t(unsigned int, total_read, 48));
 613
 614                 mid_entry = NULL;
 615                 server->lstrp = jiffies;
 616
 617                 spin_lock(&GlobalMid_Lock);
 618                 list_for_each_safe(tmp, tmp2, &server->pending_mid_q) {
 619                         mid_entry = list_entry(tmp, struct mid_q_entry, qhead);
 620
 621                         if (mid_entry->mid != smb_buffer->Mid ||
 622                             mid_entry->midState != MID_REQUEST_SUBMITTED ||
 623                             mid_entry->command != smb_buffer->Command) {
 624                                 mid_entry = NULL;
 625                                 continue;
 626                         }
 627
 628                         if (length == 0 &&
 629                             check2ndT2(smb_buffer, server->maxBuf) > 0) {
 630                                 /* We have a multipart transact2 resp */
 631                                 isMultiRsp = true;
 632                                 if (mid_entry->resp_buf) {
 633                                         /* merge response - fix up 1st*/
 634                                         length = coalesce_t2(smb_buffer,
 635                                                         mid_entry->resp_buf);
 636                                         if (length > 0) {
 637                                                 length = 0;
 638                                                 mid_entry->multiRsp = true;
 639                                                 break;
 640                                         } else {
 641                                                 /* all parts received or
 642                                                  * packet is malformed
 643                                                  */
 644                                                 mid_entry->multiEnd = true;
 645                                                 goto multi_t2_fnd;
 646                                         }
 647                                 } else {
 648                                         if (!isLargeBuf) {
 649                                                 /*
 650                                                  * FIXME: switch to already
 651                                                  *        allocated largebuf?
 652                                                  */
 653                                                 cERROR(1, "1st trans2 resp "
 654                                                           "needs bigbuf");
 655                                         } else {
 656                                                 /* Have first buffer */
 657                                                 mid_entry->resp_buf =
 658                                                          smb_buffer;
 659                                                 mid_entry->largeBuf = true;
 660                                                 bigbuf = NULL;
 661                                         }
 662                                 }
 663                                 break;
 664                         }
 665                         mid_entry->resp_buf = smb_buffer;
 666                         mid_entry->largeBuf = isLargeBuf;
 667 multi_t2_fnd:
 668                         if (length == 0)
 669                                 mid_entry->midState = MID_RESPONSE_RECEIVED;
 670                         else
 671                                 mid_entry->midState = MID_RESPONSE_MALFORMED;
 672 #ifdef CONFIG_CIFS_STATS2
 673                         mid_entry->when_received = jiffies;
 674 #endif
 675                         list_del_init(&mid_entry->qhead);
 676                         mid_entry->callback(mid_entry);
 677                         break;
 678                 }
 679                 spin_unlock(&GlobalMid_Lock);
 680
 681                 if (mid_entry != NULL) {
 682                         /* Was previous buf put in mpx struct for multi-rsp? */
 683                         if (!isMultiRsp) {
 684                                 /* smb buffer will be freed by user thread */
 685                                 if (isLargeBuf)
 686                                         bigbuf = NULL;
 687                                 else
 688                                         smallbuf = NULL;
 689                         }
 690                 } else if (length != 0) {
 691                         /* response sanity checks failed */
 692                         continue;
 693                 } else if (!is_valid_oplock_break(smb_buffer, server) &&
 694                            !isMultiRsp) {
 695                         cERROR(1, "No task to wake, unknown frame received! "
 696                                    "NumMids %d", atomic_read(&midCount));
 697                         cifs_dump_mem("Received Data is: ", (char *)smb_buffer,
 698                                       sizeof(struct smb_hdr));
 699 #ifdef CONFIG_CIFS_DEBUG2
 700                         cifs_dump_detail(smb_buffer);
 701                         cifs_dump_mids(server);
 702 #endif /* CIFS_DEBUG2 */
 703
 704                 }
 705         } /* end while !EXITING */
 706
 707         /* take it off the list, if it's not already */
 708         spin_lock(&cifs_tcp_ses_lock);
 709         list_del_init(&server->tcp_ses_list);
 710         spin_unlock(&cifs_tcp_ses_lock);
 711
 712         spin_lock(&GlobalMid_Lock);
 713         server->tcpStatus = CifsExiting;
 714         spin_unlock(&GlobalMid_Lock);
 715         wake_up_all(&server->response_q);
 716
 717         /* check if we have blocked requests that need to free */
 718         /* Note that cifs_max_pending is normally 50, but
 719         can be set at module install time to as little as two */
 720         spin_lock(&GlobalMid_Lock);
 721         if (atomic_read(&server->inFlight) >= cifs_max_pending)
 722                 atomic_set(&server->inFlight, cifs_max_pending - 1);
 723         /* We do not want to set the max_pending too low or we
 724         could end up with the counter going negative */
 725         spin_unlock(&GlobalMid_Lock);
 726         /* Although there should not be any requests blocked on
 727         this queue it can not hurt to be paranoid and try to wake up requests
 728         that may haven been blocked when more than 50 at time were on the wire
 729         to the same server - they now will see the session is in exit state
 730         and get out of SendReceive.  */
 731         wake_up_all(&server->request_q);
 732         /* give those requests time to exit */
 733         msleep(125);
 734
 735         if (server->ssocket) {
 736                 sock_release(csocket);
 737                 server->ssocket = NULL;
 738         }
 739         /* buffer usuallly freed in free_mid - need to free it here on exit */
 740         cifs_buf_release(bigbuf);
 741         if (smallbuf) /* no sense logging a debug message if NULL */
 742                 cifs_small_buf_release(smallbuf);
 743
 744         if (!list_empty(&server->pending_mid_q)) {
 745                 spin_lock(&GlobalMid_Lock);
 746                 list_for_each_safe(tmp, tmp2, &server->pending_mid_q) {
 747                         mid_entry = list_entry(tmp, struct mid_q_entry, qhead);
 748                         cFYI(1, "Clearing Mid 0x%x - issuing callback",
 749                                          mid_entry->mid);
 750                         list_del_init(&mid_entry->qhead);
 751                         mid_entry->callback(mid_entry);
 752                 }
 753                 spin_unlock(&GlobalMid_Lock);
 754                 /* 1/8th of sec is more than enough time for them to exit */
 755                 msleep(125);
 756         }
 757
 758         if (!list_empty(&server->pending_mid_q)) {
 759                 /* mpx threads have not exited yet give them
 760                 at least the smb send timeout time for long ops */
 761                 /* due to delays on oplock break requests, we need
 762                 to wait at least 45 seconds before giving up
 763                 on a request getting a response and going ahead
 764                 and killing cifsd */
 765                 cFYI(1, "Wait for exit from demultiplex thread");
 766                 msleep(46000);
 767                 /* if threads still have not exited they are probably never
 768                 coming home not much else we can do but free the memory */
 769         }
 770
 771         kfree(server->hostname);
 772         task_to_wake = xchg(&server->tsk, NULL);
 773         kfree(server);
 774
 775         length = atomic_dec_return(&tcpSesAllocCount);
 776         if (length  > 0)
 777                 mempool_resize(cifs_req_poolp, length + cifs_min_rcv,
 778                                 GFP_KERNEL);
 779
 780         /* if server->tsk was NULL then wait for a signal before exiting */
 781         if (!task_to_wake) {
 782                 set_current_state(TASK_INTERRUPTIBLE);
 783                 while (!signal_pending(current)) {
 784                         schedule();
 785                         set_current_state(TASK_INTERRUPTIBLE);
 786                 }
 787                 set_current_state(TASK_RUNNING);
 788         }
 789
 790         module_put_and_exit(0);
 791 }
 792
 793 /* extract the host portion of the UNC string */
 794 static char *
 795 extract_hostname(const char *unc)
 796 {
 797         const char *src;
 798         char *dst, *delim;
 799         unsigned int len;
 800
 801         /* skip double chars at beginning of string */
 802         /* BB: check validity of these bytes? */
 803         src = unc + 2;
 804
 805         /* delimiter between hostname and sharename is always '\\' now */
 806         delim = strchr(src, '\\');
 807         if (!delim)
 808                 return ERR_PTR(-EINVAL);
 809
 810         len = delim - src;
 811         dst = kmalloc((len + 1), GFP_KERNEL);
 812         if (dst == NULL)
 813                 return ERR_PTR(-ENOMEM);
 814
 815         memcpy(dst, src, len);
 816         dst[len] = '\0';
 817
 818         return dst;
 819 }
 820
 821 static int
 822 cifs_parse_mount_options(char *options, const char *devname,
 823                          struct smb_vol *vol)
 824 {
 825         char *value, *data, *end;
 826         unsigned int  temp_len, i, j;
 827         char separator[2];
 828         short int override_uid = -1;
 829         short int override_gid = -1;
 830         bool uid_specified = false;
 831         bool gid_specified = false;
 832         char *nodename = utsname()->nodename;
 833
 834         separator[0] = ',';
 835         separator[1] = 0;
 836
 837         /*
 838          * does not have to be perfect mapping since field is
 839          * informational, only used for servers that do not support
 840          * port 445 and it can be overridden at mount time
 841          */
 842         memset(vol->source_rfc1001_name, 0x20, RFC1001_NAME_LEN);
 843         for (i = 0; i < strnlen(nodename, RFC1001_NAME_LEN); i++)
 844                 vol->source_rfc1001_name[i] = toupper(nodename[i]);
 845
 846         vol->source_rfc1001_name[RFC1001_NAME_LEN] = 0;
 847         /* null target name indicates to use *SMBSERVR default called name
 848            if we end up sending RFC1001 session initialize */
 849         vol->target_rfc1001_name[0] = 0;
 850         vol->cred_uid = current_uid();
 851         vol->linux_uid = current_uid();
 852         vol->linux_gid = current_gid();
 853
 854         /* default to only allowing write access to owner of the mount */
 855         vol->dir_mode = vol->file_mode = S_IRUGO | S_IXUGO | S_IWUSR;
 856
 857         /* vol->retry default is 0 (i.e. "soft" limited retry not hard retry) */
 858         /* default is always to request posix paths. */
 859         vol->posix_paths = 1;
 860         /* default to using server inode numbers where available */
 861         vol->server_ino = 1;
 862
 863         vol->actimeo = CIFS_DEF_ACTIMEO;
 864
 865         if (!options)
 866                 return 1;
 867
 868         end = options + strlen(options);
 869         if (strncmp(options, "sep=", 4) == 0) {
 870                 if (options[4] != 0) {
 871                         separator[0] = options[4];
 872                         options += 5;
 873                 } else {
 874                         cFYI(1, "Null separator not allowed");
 875                 }
 876         }
 877
 878         while ((data = strsep(&options, separator)) != NULL) {
 879                 if (!*data)
 880                         continue;
 881                 if ((value = strchr(data, '=')) != NULL)
 882                         *value++ = '\0';
 883
 884                 /* Have to parse this before we parse for "user" */
 885                 if (strnicmp(data, "user_xattr", 10) == 0) {
 886                         vol->no_xattr = 0;
 887                 } else if (strnicmp(data, "nouser_xattr", 12) == 0) {
 888                         vol->no_xattr = 1;
 889                 } else if (strnicmp(data, "user", 4) == 0) {
 890                         if (!value) {
 891                                 printk(KERN_WARNING
 892                                        "CIFS: invalid or missing username\n");
 893                                 return 1;       /* needs_arg; */
 894                         } else if (!*value) {
 895                                 /* null user, ie anonymous, authentication */
 896                                 vol->nullauth = 1;
 897                         }
 898                         if (strnlen(value, 200) < 200) {
 899                                 vol->username = value;
 900                         } else {
 901                                 printk(KERN_WARNING "CIFS: username too long\n");
 902                                 return 1;
 903                         }
 904                 } else if (strnicmp(data, "pass", 4) == 0) {
 905                         if (!value) {
 906                                 vol->password = NULL;
 907                                 continue;
 908                         } else if (value[0] == 0) {
 909                                 /* check if string begins with double comma
 910                                    since that would mean the password really
 911                                    does start with a comma, and would not
 912                                    indicate an empty string */
 913                                 if (value[1] != separator[0]) {
 914                                         vol->password = NULL;
 915                                         continue;
 916                                 }
 917                         }
 918                         temp_len = strlen(value);
 919                         /* removed password length check, NTLM passwords
 920                                 can be arbitrarily long */
 921
 922                         /* if comma in password, the string will be
 923                         prematurely null terminated.  Commas in password are
 924                         specified across the cifs mount interface by a double
 925                         comma ie ,, and a comma used as in other cases ie ','
 926                         as a parameter delimiter/separator is single and due
 927                         to the strsep above is temporarily zeroed. */
 928
 929                         /* NB: password legally can have multiple commas and
 930                         the only illegal character in a password is null */
 931
 932                         if ((value[temp_len] == 0) &&
 933                             (value + temp_len < end) &&
 934                             (value[temp_len+1] == separator[0])) {
 935                                 /* reinsert comma */
 936                                 value[temp_len] = separator[0];
 937                                 temp_len += 2;  /* move after second comma */
 938                                 while (value[temp_len] != 0)  {
 939                                         if (value[temp_len] == separator[0]) {
 940                                                 if (value[temp_len+1] ==
 941                                                      separator[0]) {
 942                                                 /* skip second comma */
 943                                                         temp_len++;
 944                                                 } else {
 945                                                 /* single comma indicating start
 946                                                          of next parm */
 947                                                         break;
 948                                                 }
 949                                         }
 950                                         temp_len++;
 951                                 }
 952                                 if (value[temp_len] == 0) {
 953                                         options = NULL;
 954                                 } else {
 955                                         value[temp_len] = 0;
 956                                         /* point option to start of next parm */
 957                                         options = value + temp_len + 1;
 958                                 }
 959                                 /* go from value to value + temp_len condensing
 960                                 double commas to singles. Note that this ends up
 961                                 allocating a few bytes too many, which is ok */
 962                                 vol->password = kzalloc(temp_len, GFP_KERNEL);
 963                                 if (vol->password == NULL) {
 964                                         printk(KERN_WARNING "CIFS: no memory "
 965                                                             "for password\n");
 966                                         return 1;
 967                                 }
 968                                 for (i = 0, j = 0; i < temp_len; i++, j++) {
 969                                         vol->password[j] = value[i];
 970                                         if (value[i] == separator[0]
 971                                                 && value[i+1] == separator[0]) {
 972                                                 /* skip second comma */
 973                                                 i++;
 974                                         }
 975                                 }
 976                                 vol->password[j] = 0;
 977                         } else {
 978                                 vol->password = kzalloc(temp_len+1, GFP_KERNEL);
 979                                 if (vol->password == NULL) {
 980                                         printk(KERN_WARNING "CIFS: no memory "
 981                                                             "for password\n");
 982                                         return 1;
 983                                 }
 984                                 strcpy(vol->password, value);
 985                         }
 986                 } else if (!strnicmp(data, "ip", 2) ||
 987                            !strnicmp(data, "addr", 4)) {
 988                         if (!value || !*value) {
 989                                 vol->UNCip = NULL;
 990                         } else if (strnlen(value, INET6_ADDRSTRLEN) <
 991                                                         INET6_ADDRSTRLEN) {
 992                                 vol->UNCip = value;
 993                         } else {
 994                                 printk(KERN_WARNING "CIFS: ip address "
 995                                                     "too long\n");
 996                                 return 1;
 997                         }
 998                 } else if (strnicmp(data, "sec", 3) == 0) {
 999                         if (!value || !*value) {
1000                                 cERROR(1, "no security value specified");
1001                                 continue;
1002                         } else if (strnicmp(value, "krb5i", 5) == 0) {
1003                                 vol->secFlg |= CIFSSEC_MAY_KRB5 |
1004                                         CIFSSEC_MUST_SIGN;
1005                         } else if (strnicmp(value, "krb5p", 5) == 0) {
1006                                 /* vol->secFlg |= CIFSSEC_MUST_SEAL |
1007                                         CIFSSEC_MAY_KRB5; */
1008                                 cERROR(1, "Krb5 cifs privacy not supported");
1009                                 return 1;
1010                         } else if (strnicmp(value, "krb5", 4) == 0) {
1011                                 vol->secFlg |= CIFSSEC_MAY_KRB5;
1012                         } else if (strnicmp(value, "ntlmsspi", 8) == 0) {
1013                                 vol->secFlg |= CIFSSEC_MAY_NTLMSSP |
1014                                         CIFSSEC_MUST_SIGN;
1015                         } else if (strnicmp(value, "ntlmssp", 7) == 0) {
1016                                 vol->secFlg |= CIFSSEC_MAY_NTLMSSP;
1017                         } else if (strnicmp(value, "ntlmv2i", 7) == 0) {
1018                                 vol->secFlg |= CIFSSEC_MAY_NTLMV2 |
1019                                         CIFSSEC_MUST_SIGN;
1020                         } else if (strnicmp(value, "ntlmv2", 6) == 0) {
1021                                 vol->secFlg |= CIFSSEC_MAY_NTLMV2;
1022                         } else if (strnicmp(value, "ntlmi", 5) == 0) {
1023                                 vol->secFlg |= CIFSSEC_MAY_NTLM |
1024                                         CIFSSEC_MUST_SIGN;
1025                         } else if (strnicmp(value, "ntlm", 4) == 0) {
1026                                 /* ntlm is default so can be turned off too */
1027                                 vol->secFlg |= CIFSSEC_MAY_NTLM;
1028                         } else if (strnicmp(value, "nontlm", 6) == 0) {
1029                                 /* BB is there a better way to do this? */
1030                                 vol->secFlg |= CIFSSEC_MAY_NTLMV2;
1031 #ifdef CONFIG_CIFS_WEAK_PW_HASH
1032                         } else if (strnicmp(value, "lanman", 6) == 0) {
1033                                 vol->secFlg |= CIFSSEC_MAY_LANMAN;
1034 #endif
1035                         } else if (strnicmp(value, "none", 4) == 0) {
1036                                 vol->nullauth = 1;
1037                         } else {
1038                                 cERROR(1, "bad security option: %s", value);
1039                                 return 1;
1040                         }
1041                 } else if ((strnicmp(data, "unc", 3) == 0)
1042                            || (strnicmp(data, "target", 6) == 0)
1043                            || (strnicmp(data, "path", 4) == 0)) {
1044                         if (!value || !*value) {
1045                                 printk(KERN_WARNING "CIFS: invalid path to "
1046                                                     "network resource\n");
1047                                 return 1;       /* needs_arg; */
1048                         }
1049                         if ((temp_len = strnlen(value, 300)) < 300) {
1050                                 vol->UNC = kmalloc(temp_len+1, GFP_KERNEL);
1051                                 if (vol->UNC == NULL)
1052                                         return 1;
1053                                 strcpy(vol->UNC, value);
1054                                 if (strncmp(vol->UNC, "//", 2) == 0) {
1055                                         vol->UNC[0] = '\\';
1056                                         vol->UNC[1] = '\\';
1057                                 } else if (strncmp(vol->UNC, "\\\\", 2) != 0) {
1058                                         printk(KERN_WARNING
1059                                                "CIFS: UNC Path does not begin "
1060                                                "with // or \\\\ \n");
1061                                         return 1;
1062                                 }
1063                         } else {
1064                                 printk(KERN_WARNING "CIFS: UNC name too long\n");
1065                                 return 1;
1066                         }
1067                 } else if ((strnicmp(data, "domain", 3) == 0)
1068                            || (strnicmp(data, "workgroup", 5) == 0)) {
1069                         if (!value || !*value) {
1070                                 printk(KERN_WARNING "CIFS: invalid domain name\n");
1071                                 return 1;       /* needs_arg; */
1072                         }
1073                         /* BB are there cases in which a comma can be valid in
1074                         a domain name and need special handling? */
1075                         if (strnlen(value, 256) < 256) {
1076                                 vol->domainname = value;
1077                                 cFYI(1, "Domain name set");
1078                         } else {
1079                                 printk(KERN_WARNING "CIFS: domain name too "
1080                                                     "long\n");
1081                                 return 1;
1082                         }
1083                 } else if (strnicmp(data, "srcaddr", 7) == 0) {
1084                         vol->srcaddr.ss_family = AF_UNSPEC;
1085
1086                         if (!value || !*value) {
1087                                 printk(KERN_WARNING "CIFS: srcaddr value"
1088                                        " not specified.\n");
1089                                 return 1;       /* needs_arg; */
1090                         }
1091                         i = cifs_convert_address((struct sockaddr *)&vol->srcaddr,
1092                                                  value, strlen(value));
1093                         if (i == 0) {
1094                                 printk(KERN_WARNING "CIFS:  Could not parse"
1095                                        " srcaddr: %s\n",
1096                                        value);
1097                                 return 1;
1098                         }
1099                 } else if (strnicmp(data, "prefixpath", 10) == 0) {
1100                         if (!value || !*value) {
1101                                 printk(KERN_WARNING
1102                                         "CIFS: invalid path prefix\n");
1103                                 return 1;       /* needs_argument */
1104                         }
1105                         if ((temp_len = strnlen(value, 1024)) < 1024) {
1106                                 if (value[0] != '/')
1107                                         temp_len++;  /* missing leading slash */
1108                                 vol->prepath = kmalloc(temp_len+1, GFP_KERNEL);
1109                                 if (vol->prepath == NULL)
1110                                         return 1;
1111                                 if (value[0] != '/') {
1112                                         vol->prepath[0] = '/';
1113                                         strcpy(vol->prepath+1, value);
1114                                 } else
1115                                         strcpy(vol->prepath, value);
1116                                 cFYI(1, "prefix path %s", vol->prepath);
1117                         } else {
1118                                 printk(KERN_WARNING "CIFS: prefix too long\n");
1119                                 return 1;
1120                         }
1121                 } else if (strnicmp(data, "iocharset", 9) == 0) {
1122                         if (!value || !*value) {
1123                                 printk(KERN_WARNING "CIFS: invalid iocharset "
1124                                                     "specified\n");
1125                                 return 1;       /* needs_arg; */
1126                         }
1127                         if (strnlen(value, 65) < 65) {
1128                                 if (strnicmp(value, "default", 7))
1129                                         vol->iocharset = value;
1130                                 /* if iocharset not set then load_nls_default
1131                                    is used by caller */
1132                                 cFYI(1, "iocharset set to %s", value);
1133                         } else {
1134                                 printk(KERN_WARNING "CIFS: iocharset name "
1135                                                     "too long.\n");
1136                                 return 1;
1137                         }
1138                 } else if (!strnicmp(data, "uid", 3) && value && *value) {
1139                         vol->linux_uid = simple_strtoul(value, &value, 0);
1140                         uid_specified = true;
1141                 } else if (!strnicmp(data, "cruid", 5) && value && *value) {
1142                         vol->cred_uid = simple_strtoul(value, &value, 0);
1143                 } else if (!strnicmp(data, "forceuid", 8)) {
1144                         override_uid = 1;
1145                 } else if (!strnicmp(data, "noforceuid", 10)) {
1146                         override_uid = 0;
1147                 } else if (!strnicmp(data, "gid", 3) && value && *value) {
1148                         vol->linux_gid = simple_strtoul(value, &value, 0);
1149                         gid_specified = true;
1150                 } else if (!strnicmp(data, "forcegid", 8)) {
1151                         override_gid = 1;
1152                 } else if (!strnicmp(data, "noforcegid", 10)) {
1153                         override_gid = 0;
1154                 } else if (strnicmp(data, "file_mode", 4) == 0) {
1155                         if (value && *value) {
1156                                 vol->file_mode =
1157                                         simple_strtoul(value, &value, 0);
1158                         }
1159                 } else if (strnicmp(data, "dir_mode", 4) == 0) {
1160                         if (value && *value) {
1161                                 vol->dir_mode =
1162                                         simple_strtoul(value, &value, 0);
1163                         }
1164                 } else if (strnicmp(data, "dirmode", 4) == 0) {
1165                         if (value && *value) {
1166                                 vol->dir_mode =
1167                                         simple_strtoul(value, &value, 0);
1168                         }
1169                 } else if (strnicmp(data, "port", 4) == 0) {
1170                         if (value && *value) {
1171                                 vol->port =
1172                                         simple_strtoul(value, &value, 0);
1173                         }
1174                 } else if (strnicmp(data, "rsize", 5) == 0) {
1175                         if (value && *value) {
1176                                 vol->rsize =
1177                                         simple_strtoul(value, &value, 0);
1178                         }
1179                 } else if (strnicmp(data, "wsize", 5) == 0) {
1180                         if (value && *value) {
1181                                 vol->wsize =
1182                                         simple_strtoul(value, &value, 0);
1183                         }
1184                 } else if (strnicmp(data, "sockopt", 5) == 0) {
1185                         if (!value || !*value) {
1186                                 cERROR(1, "no socket option specified");
1187                                 continue;
1188                         } else if (strnicmp(value, "TCP_NODELAY", 11) == 0) {
1189                                 vol->sockopt_tcp_nodelay = 1;
1190                         }
1191                 } else if (strnicmp(data, "netbiosname", 4) == 0) {
1192                         if (!value || !*value || (*value == ' ')) {
1193                                 cFYI(1, "invalid (empty) netbiosname");
1194                         } else {
1195                                 memset(vol->source_rfc1001_name, 0x20,
1196                                         RFC1001_NAME_LEN);
1197                                 /*
1198                                  * FIXME: are there cases in which a comma can
1199                                  * be valid in workstation netbios name (and
1200                                  * need special handling)?
1201                                  */
1202                                 for (i = 0; i < RFC1001_NAME_LEN; i++) {
1203                                         /* don't ucase netbiosname for user */
1204                                         if (value[i] == 0)
1205                                                 break;
1206                                         vol->source_rfc1001_name[i] = value[i];
1207                                 }
1208                                 /* The string has 16th byte zero still from
1209                                 set at top of the function  */
1210                                 if (i == RFC1001_NAME_LEN && value[i] != 0)
1211                                         printk(KERN_WARNING "CIFS: netbiosname"
1212                                                 " longer than 15 truncated.\n");
1213                         }
1214                 } else if (strnicmp(data, "servern", 7) == 0) {
1215                         /* servernetbiosname specified override *SMBSERVER */
1216                         if (!value || !*value || (*value == ' ')) {
1217                                 cFYI(1, "empty server netbiosname specified");
1218                         } else {
1219                                 /* last byte, type, is 0x20 for servr type */
1220                                 memset(vol->target_rfc1001_name, 0x20,
1221                                         RFC1001_NAME_LEN_WITH_NULL);
1222
1223                                 for (i = 0; i < 15; i++) {
1224                                 /* BB are there cases in which a comma can be
1225                                    valid in this workstation netbios name
1226                                    (and need special handling)? */
1227
1228                                 /* user or mount helper must uppercase
1229                                    the netbiosname */
1230                                         if (value[i] == 0)
1231                                                 break;
1232                                         else
1233                                                 vol->target_rfc1001_name[i] =
1234                                                                 value[i];
1235                                 }
1236                                 /* The string has 16th byte zero still from
1237                                    set at top of the function  */
1238                                 if (i == RFC1001_NAME_LEN && value[i] != 0)
1239                                         printk(KERN_WARNING "CIFS: server net"
1240                                         "biosname longer than 15 truncated.\n");
1241                         }
1242                 } else if (strnicmp(data, "actimeo", 7) == 0) {
1243                         if (value && *value) {
1244                                 vol->actimeo = HZ * simple_strtoul(value,
1245                                                                    &value, 0);
1246                                 if (vol->actimeo > CIFS_MAX_ACTIMEO) {
1247                                         cERROR(1, "CIFS: attribute cache"
1248                                                         "timeout too large");
1249                                         return 1;
1250                                 }
1251                         }
1252                 } else if (strnicmp(data, "credentials", 4) == 0) {
1253                         /* ignore */
1254                 } else if (strnicmp(data, "version", 3) == 0) {
1255                         /* ignore */
1256                 } else if (strnicmp(data, "guest", 5) == 0) {
1257                         /* ignore */
1258                 } else if (strnicmp(data, "rw", 2) == 0) {
1259                         /* ignore */
1260                 } else if (strnicmp(data, "ro", 2) == 0) {
1261                         /* ignore */
1262                 } else if (strnicmp(data, "noblocksend", 11) == 0) {
1263                         vol->noblocksnd = 1;
1264                 } else if (strnicmp(data, "noautotune", 10) == 0) {
1265                         vol->noautotune = 1;
1266                 } else if ((strnicmp(data, "suid", 4) == 0) ||
1267                                    (strnicmp(data, "nosuid", 6) == 0) ||
1268                                    (strnicmp(data, "exec", 4) == 0) ||
1269                                    (strnicmp(data, "noexec", 6) == 0) ||
1270                                    (strnicmp(data, "nodev", 5) == 0) ||
1271                                    (strnicmp(data, "noauto", 6) == 0) ||
1272                                    (strnicmp(data, "dev", 3) == 0)) {
1273                         /*  The mount tool or mount.cifs helper (if present)
1274                             uses these opts to set flags, and the flags are read
1275                             by the kernel vfs layer before we get here (ie
1276                             before read super) so there is no point trying to
1277                             parse these options again and set anything and it
1278                             is ok to just ignore them */
1279                         continue;
1280                 } else if (strnicmp(data, "hard", 4) == 0) {
1281                         vol->retry = 1;
1282                 } else if (strnicmp(data, "soft", 4) == 0) {
1283                         vol->retry = 0;
1284                 } else if (strnicmp(data, "perm", 4) == 0) {
1285                         vol->noperm = 0;
1286                 } else if (strnicmp(data, "noperm", 6) == 0) {
1287                         vol->noperm = 1;
1288                 } else if (strnicmp(data, "mapchars", 8) == 0) {
1289                         vol->remap = 1;
1290                 } else if (strnicmp(data, "nomapchars", 10) == 0) {
1291                         vol->remap = 0;
1292                 } else if (strnicmp(data, "sfu", 3) == 0) {
1293                         vol->sfu_emul = 1;
1294                 } else if (strnicmp(data, "nosfu", 5) == 0) {
1295                         vol->sfu_emul = 0;
1296                 } else if (strnicmp(data, "nodfs", 5) == 0) {
1297                         vol->nodfs = 1;
1298                 } else if (strnicmp(data, "posixpaths", 10) == 0) {
1299                         vol->posix_paths = 1;
1300                 } else if (strnicmp(data, "noposixpaths", 12) == 0) {
1301                         vol->posix_paths = 0;
1302                 } else if (strnicmp(data, "nounix", 6) == 0) {
1303                         vol->no_linux_ext = 1;
1304                 } else if (strnicmp(data, "nolinux", 7) == 0) {
1305                         vol->no_linux_ext = 1;
1306                 } else if ((strnicmp(data, "nocase", 6) == 0) ||
1307                            (strnicmp(data, "ignorecase", 10)  == 0)) {
1308                         vol->nocase = 1;
1309                 } else if (strnicmp(data, "mand", 4) == 0) {
1310                         /* ignore */
1311                 } else if (strnicmp(data, "nomand", 6) == 0) {
1312                         /* ignore */
1313                 } else if (strnicmp(data, "_netdev", 7) == 0) {
1314                         /* ignore */
1315                 } else if (strnicmp(data, "brl", 3) == 0) {
1316                         vol->nobrl =  0;
1317                 } else if ((strnicmp(data, "nobrl", 5) == 0) ||
1318                            (strnicmp(data, "nolock", 6) == 0)) {
1319                         vol->nobrl =  1;
1320                         /* turn off mandatory locking in mode
1321                         if remote locking is turned off since the
1322                         local vfs will do advisory */
1323                         if (vol->file_mode ==
1324                                 (S_IALLUGO & ~(S_ISUID | S_IXGRP)))
1325                                 vol->file_mode = S_IALLUGO;
1326                 } else if (strnicmp(data, "forcemandatorylock", 9) == 0) {
1327                         /* will take the shorter form "forcemand" as well */
1328                         /* This mount option will force use of mandatory
1329                           (DOS/Windows style) byte range locks, instead of
1330                           using posix advisory byte range locks, even if the
1331                           Unix extensions are available and posix locks would
1332                           be supported otherwise. If Unix extensions are not
1333                           negotiated this has no effect since mandatory locks
1334                           would be used (mandatory locks is all that those
1335                           those servers support) */
1336                         vol->mand_lock = 1;
1337                 } else if (strnicmp(data, "setuids", 7) == 0) {
1338                         vol->setuids = 1;
1339                 } else if (strnicmp(data, "nosetuids", 9) == 0) {
1340                         vol->setuids = 0;
1341                 } else if (strnicmp(data, "dynperm", 7) == 0) {
1342                         vol->dynperm = true;
1343                 } else if (strnicmp(data, "nodynperm", 9) == 0) {
1344                         vol->dynperm = false;
1345                 } else if (strnicmp(data, "nohard", 6) == 0) {
1346                         vol->retry = 0;
1347                 } else if (strnicmp(data, "nosoft", 6) == 0) {
1348                         vol->retry = 1;
1349                 } else if (strnicmp(data, "nointr", 6) == 0) {
1350                         vol->intr = 0;
1351                 } else if (strnicmp(data, "intr", 4) == 0) {
1352                         vol->intr = 1;
1353                 } else if (strnicmp(data, "nostrictsync", 12) == 0) {
1354                         vol->nostrictsync = 1;
1355                 } else if (strnicmp(data, "strictsync", 10) == 0) {
1356                         vol->nostrictsync = 0;
1357                 } else if (strnicmp(data, "serverino", 7) == 0) {
1358                         vol->server_ino = 1;
1359                 } else if (strnicmp(data, "noserverino", 9) == 0) {
1360                         vol->server_ino = 0;
1361                 } else if (strnicmp(data, "cifsacl", 7) == 0) {
1362                         vol->cifs_acl = 1;
1363                 } else if (strnicmp(data, "nocifsacl", 9) == 0) {
1364                         vol->cifs_acl = 0;
1365                 } else if (strnicmp(data, "acl", 3) == 0) {
1366                         vol->no_psx_acl = 0;
1367                 } else if (strnicmp(data, "noacl", 5) == 0) {
1368                         vol->no_psx_acl = 1;
1369                 } else if (strnicmp(data, "locallease", 6) == 0) {
1370                         vol->local_lease = 1;
1371                 } else if (strnicmp(data, "sign", 4) == 0) {
1372                         vol->secFlg |= CIFSSEC_MUST_SIGN;
1373                 } else if (strnicmp(data, "seal", 4) == 0) {
1374                         /* we do not do the following in secFlags because seal
1375                            is a per tree connection (mount) not a per socket
1376                            or per-smb connection option in the protocol */
1377                         /* vol->secFlg |= CIFSSEC_MUST_SEAL; */
1378                         vol->seal = 1;
1379                 } else if (strnicmp(data, "direct", 6) == 0) {
1380                         vol->direct_io = 1;
1381                 } else if (strnicmp(data, "forcedirectio", 13) == 0) {
1382                         vol->direct_io = 1;
1383                 } else if (strnicmp(data, "strictcache", 11) == 0) {
1384                         vol->strict_io = 1;
1385                 } else if (strnicmp(data, "noac", 4) == 0) {
1386                         printk(KERN_WARNING "CIFS: Mount option noac not "
1387                                 "supported. Instead set "
1388                                 "/proc/fs/cifs/LookupCacheEnabled to 0\n");
1389                 } else if (strnicmp(data, "fsc", 3) == 0) {
1390 #ifndef CONFIG_CIFS_FSCACHE
1391                         cERROR(1, "FS-Cache support needs CONFIG_CIFS_FSCACHE"
1392                                   "kernel config option set");
1393                         return 1;
1394 #endif
1395                         vol->fsc = true;
1396                 } else if (strnicmp(data, "mfsymlinks", 10) == 0) {
1397                         vol->mfsymlinks = true;
1398                 } else if (strnicmp(data, "multiuser", 8) == 0) {
1399                         vol->multiuser = true;
1400                 } else
1401                         printk(KERN_WARNING "CIFS: Unknown mount option %s\n",
1402                                                 data);
1403         }
1404         if (vol->UNC == NULL) {
1405                 if (devname == NULL) {
1406                         printk(KERN_WARNING "CIFS: Missing UNC name for mount "
1407                                                 "target\n");
1408                         return 1;
1409                 }
1410                 if ((temp_len = strnlen(devname, 300)) < 300) {
1411                         vol->UNC = kmalloc(temp_len+1, GFP_KERNEL);
1412                         if (vol->UNC == NULL)
1413                                 return 1;
1414                         strcpy(vol->UNC, devname);
1415                         if (strncmp(vol->UNC, "//", 2) == 0) {
1416                                 vol->UNC[0] = '\\';
1417                                 vol->UNC[1] = '\\';
1418                         } else if (strncmp(vol->UNC, "\\\\", 2) != 0) {
1419                                 printk(KERN_WARNING "CIFS: UNC Path does not "
1420                                                     "begin with // or \\\\ \n");
1421                                 return 1;
1422                         }
1423                         value = strpbrk(vol->UNC+2, "/\\");
1424                         if (value)
1425                                 *value = '\\';
1426                 } else {
1427                         printk(KERN_WARNING "CIFS: UNC name too long\n");
1428                         return 1;
1429                 }
1430         }
1431
1432         if (vol->multiuser && !(vol->secFlg & CIFSSEC_MAY_KRB5)) {
1433                 cERROR(1, "Multiuser mounts currently require krb5 "
1434                           "authentication!");
1435                 return 1;
1436         }
1437
1438         if (vol->UNCip == NULL)
1439                 vol->UNCip = &vol->UNC[2];
1440
1441         if (uid_specified)
1442                 vol->override_uid = override_uid;
1443         else if (override_uid == 1)
1444                 printk(KERN_NOTICE "CIFS: ignoring forceuid mount option "
1445                                    "specified with no uid= option.\n");
1446
1447         if (gid_specified)
1448                 vol->override_gid = override_gid;
1449         else if (override_gid == 1)
1450                 printk(KERN_NOTICE "CIFS: ignoring forcegid mount option "
1451                                    "specified with no gid= option.\n");
1452
1453         return 0;
1454 }
1455
1456 /** Returns true if srcaddr isn't specified and rhs isn't
1457  * specified, or if srcaddr is specified and
1458  * matches the IP address of the rhs argument.
1459  */
1460 static bool
1461 srcip_matches(struct sockaddr *srcaddr, struct sockaddr *rhs)
1462 {
1463         switch (srcaddr->sa_family) {
1464         case AF_UNSPEC:
1465                 return (rhs->sa_family == AF_UNSPEC);
1466         case AF_INET: {
1467                 struct sockaddr_in *saddr4 = (struct sockaddr_in *)srcaddr;
1468                 struct sockaddr_in *vaddr4 = (struct sockaddr_in *)rhs;
1469                 return (saddr4->sin_addr.s_addr == vaddr4->sin_addr.s_addr);
1470         }
1471         case AF_INET6: {
1472                 struct sockaddr_in6 *saddr6 = (struct sockaddr_in6 *)srcaddr;
1473                 struct sockaddr_in6 *vaddr6 = (struct sockaddr_in6 *)&rhs;
1474                 return ipv6_addr_equal(&saddr6->sin6_addr, &vaddr6->sin6_addr);
1475         }
1476         default:
1477                 WARN_ON(1);
1478                 return false; /* don't expect to be here */
1479         }
1480 }
1481
1482 /*
1483  * If no port is specified in addr structure, we try to match with 445 port
1484  * and if it fails - with 139 ports. It should be called only if address
1485  * families of server and addr are equal.
1486  */
1487 static bool
1488 match_port(struct TCP_Server_Info *server, struct sockaddr *addr)
1489 {
1490         unsigned short int port, *sport;
1491
1492         switch (addr->sa_family) {
1493         case AF_INET:
1494                 sport = &((struct sockaddr_in *) &server->dstaddr)->sin_port;
1495                 port = ((struct sockaddr_in *) addr)->sin_port;
1496                 break;
1497         case AF_INET6:
1498                 sport = &((struct sockaddr_in6 *) &server->dstaddr)->sin6_port;
1499                 port = ((struct sockaddr_in6 *) addr)->sin6_port;
1500                 break;
1501         default:
1502                 WARN_ON(1);
1503                 return false;
1504         }
1505
1506         if (!port) {
1507                 port = htons(CIFS_PORT);
1508                 if (port == *sport)
1509                         return true;
1510
1511                 port = htons(RFC1001_PORT);
1512         }
1513
1514         return port == *sport;
1515 }
1516
1517 static bool
1518 match_address(struct TCP_Server_Info *server, struct sockaddr *addr,
1519               struct sockaddr *srcaddr)
1520 {
1521         switch (addr->sa_family) {
1522         case AF_INET: {
1523                 struct sockaddr_in *addr4 = (struct sockaddr_in *)addr;
1524                 struct sockaddr_in *srv_addr4 =
1525                                         (struct sockaddr_in *)&server->dstaddr;
1526
1527                 if (addr4->sin_addr.s_addr != srv_addr4->sin_addr.s_addr)
1528                         return false;
1529                 break;
1530         }
1531         case AF_INET6: {
1532                 struct sockaddr_in6 *addr6 = (struct sockaddr_in6 *)addr;
1533                 struct sockaddr_in6 *srv_addr6 =
1534                                         (struct sockaddr_in6 *)&server->dstaddr;
1535
1536                 if (!ipv6_addr_equal(&addr6->sin6_addr,
1537                                      &srv_addr6->sin6_addr))
1538                         return false;
1539                 if (addr6->sin6_scope_id != srv_addr6->sin6_scope_id)
1540                         return false;
1541                 break;
1542         }
1543         default:
1544                 WARN_ON(1);
1545                 return false; /* don't expect to be here */
1546         }
1547
1548         if (!srcip_matches(srcaddr, (struct sockaddr *)&server->srcaddr))
1549                 return false;
1550
1551         return true;
1552 }
1553
1554 static bool
1555 match_security(struct TCP_Server_Info *server, struct smb_vol *vol)
1556 {
1557         unsigned int secFlags;
1558
1559         if (vol->secFlg & (~(CIFSSEC_MUST_SIGN | CIFSSEC_MUST_SEAL)))
1560                 secFlags = vol->secFlg;
1561         else
1562                 secFlags = global_secflags | vol->secFlg;
1563
1564         switch (server->secType) {
1565         case LANMAN:
1566                 if (!(secFlags & (CIFSSEC_MAY_LANMAN|CIFSSEC_MAY_PLNTXT)))
1567                         return false;
1568                 break;
1569         case NTLMv2:
1570                 if (!(secFlags & CIFSSEC_MAY_NTLMV2))
1571                         return false;
1572                 break;
1573         case NTLM:
1574                 if (!(secFlags & CIFSSEC_MAY_NTLM))
1575                         return false;
1576                 break;
1577         case Kerberos:
1578                 if (!(secFlags & CIFSSEC_MAY_KRB5))
1579                         return false;
1580                 break;
1581         case RawNTLMSSP:
1582                 if (!(secFlags & CIFSSEC_MAY_NTLMSSP))
1583                         return false;
1584                 break;
1585         default:
1586                 /* shouldn't happen */
1587                 return false;
1588         }
1589
1590         /* now check if signing mode is acceptible */
1591         if ((secFlags & CIFSSEC_MAY_SIGN) == 0 &&
1592             (server->secMode & SECMODE_SIGN_REQUIRED))
1593                         return false;
1594         else if (((secFlags & CIFSSEC_MUST_SIGN) == CIFSSEC_MUST_SIGN) &&
1595                  (server->secMode &
1596                   (SECMODE_SIGN_ENABLED|SECMODE_SIGN_REQUIRED)) == 0)
1597                         return false;
1598
1599         return true;
1600 }
1601
1602 static struct TCP_Server_Info *
1603 cifs_find_tcp_session(struct sockaddr *addr, struct smb_vol *vol)
1604 {
1605         struct TCP_Server_Info *server;
1606
1607         spin_lock(&cifs_tcp_ses_lock);
1608         list_for_each_entry(server, &cifs_tcp_ses_list, tcp_ses_list) {
1609                 if (!net_eq(cifs_net_ns(server), current->nsproxy->net_ns))
1610                         continue;
1611
1612                 if (!match_address(server, addr,
1613                                    (struct sockaddr *)&vol->srcaddr))
1614                         continue;
1615
1616                 if (!match_port(server, addr))
1617                         continue;
1618
1619                 if (!match_security(server, vol))
1620                         continue;
1621
1622                 ++server->srv_count;
1623                 spin_unlock(&cifs_tcp_ses_lock);
1624                 cFYI(1, "Existing tcp session with server found");
1625                 return server;
1626         }
1627         spin_unlock(&cifs_tcp_ses_lock);
1628         return NULL;
1629 }
1630
1631 static void
1632 cifs_put_tcp_session(struct TCP_Server_Info *server)
1633 {
1634         struct task_struct *task;
1635
1636         spin_lock(&cifs_tcp_ses_lock);
1637         if (--server->srv_count > 0) {
1638                 spin_unlock(&cifs_tcp_ses_lock);
1639                 return;
1640         }
1641
1642         put_net(cifs_net_ns(server));
1643
1644         list_del_init(&server->tcp_ses_list);
1645         spin_unlock(&cifs_tcp_ses_lock);
1646
1647         cancel_delayed_work_sync(&server->echo);
1648
1649         spin_lock(&GlobalMid_Lock);
1650         server->tcpStatus = CifsExiting;
1651         spin_unlock(&GlobalMid_Lock);
1652
1653         cifs_crypto_shash_release(server);
1654         cifs_fscache_release_client_cookie(server);
1655
1656         kfree(server->session_key.response);
1657         server->session_key.response = NULL;
1658         server->session_key.len = 0;
1659
1660         task = xchg(&server->tsk, NULL);
1661         if (task)
1662                 force_sig(SIGKILL, task);
1663 }
1664
1665 static struct TCP_Server_Info *
1666 cifs_get_tcp_session(struct smb_vol *volume_info)
1667 {
1668         struct TCP_Server_Info *tcp_ses = NULL;
1669         struct sockaddr_storage addr;
1670         struct sockaddr_in *sin_server = (struct sockaddr_in *) &addr;
1671         struct sockaddr_in6 *sin_server6 = (struct sockaddr_in6 *) &addr;
1672         int rc;
1673
1674         memset(&addr, 0, sizeof(struct sockaddr_storage));
1675
1676         cFYI(1, "UNC: %s ip: %s", volume_info->UNC, volume_info->UNCip);
1677
1678         if (volume_info->UNCip && volume_info->UNC) {
1679                 rc = cifs_fill_sockaddr((struct sockaddr *)&addr,
1680                                         volume_info->UNCip,
1681                                         strlen(volume_info->UNCip),
1682                                         volume_info->port);
1683                 if (!rc) {
1684                         /* we failed translating address */
1685                         rc = -EINVAL;
1686                         goto out_err;
1687                 }
1688         } else if (volume_info->UNCip) {
1689                 /* BB using ip addr as tcp_ses name to connect to the
1690                    DFS root below */
1691                 cERROR(1, "Connecting to DFS root not implemented yet");
1692                 rc = -EINVAL;
1693                 goto out_err;
1694         } else /* which tcp_sess DFS root would we conect to */ {
1695                 cERROR(1, "CIFS mount error: No UNC path (e.g. -o "
1696                         "unc=//192.168.1.100/public) specified");
1697                 rc = -EINVAL;
1698                 goto out_err;
1699         }
1700
1701         /* see if we already have a matching tcp_ses */
1702         tcp_ses = cifs_find_tcp_session((struct sockaddr *)&addr, volume_info);
1703         if (tcp_ses)
1704                 return tcp_ses;
1705
1706         tcp_ses = kzalloc(sizeof(struct TCP_Server_Info), GFP_KERNEL);
1707         if (!tcp_ses) {
1708                 rc = -ENOMEM;
1709                 goto out_err;
1710         }
1711
1712         rc = cifs_crypto_shash_allocate(tcp_ses);
1713         if (rc) {
1714                 cERROR(1, "could not setup hash structures rc %d", rc);
1715                 goto out_err;
1716         }
1717
1718         cifs_set_net_ns(tcp_ses, get_net(current->nsproxy->net_ns));
1719         tcp_ses->hostname = extract_hostname(volume_info->UNC);
1720         if (IS_ERR(tcp_ses->hostname)) {
1721                 rc = PTR_ERR(tcp_ses->hostname);
1722                 goto out_err_crypto_release;
1723         }
1724
1725         tcp_ses->noblocksnd = volume_info->noblocksnd;
1726         tcp_ses->noautotune = volume_info->noautotune;
1727         tcp_ses->tcp_nodelay = volume_info->sockopt_tcp_nodelay;
1728         atomic_set(&tcp_ses->inFlight, 0);
1729         init_waitqueue_head(&tcp_ses->response_q);
1730         init_waitqueue_head(&tcp_ses->request_q);
1731         INIT_LIST_HEAD(&tcp_ses->pending_mid_q);
1732         mutex_init(&tcp_ses->srv_mutex);
1733         memcpy(tcp_ses->workstation_RFC1001_name,
1734                 volume_info->source_rfc1001_name, RFC1001_NAME_LEN_WITH_NULL);
1735         memcpy(tcp_ses->server_RFC1001_name,
1736                 volume_info->target_rfc1001_name, RFC1001_NAME_LEN_WITH_NULL);
1737         tcp_ses->session_estab = false;
1738         tcp_ses->sequence_number = 0;
1739         tcp_ses->lstrp = jiffies;
1740         INIT_LIST_HEAD(&tcp_ses->tcp_ses_list);
1741         INIT_LIST_HEAD(&tcp_ses->smb_ses_list);
1742         INIT_DELAYED_WORK(&tcp_ses->echo, cifs_echo_request);
1743
1744         /*
1745          * at this point we are the only ones with the pointer
1746          * to the struct since the kernel thread not created yet
1747          * no need to spinlock this init of tcpStatus or srv_count
1748          */
1749         tcp_ses->tcpStatus = CifsNew;
1750         memcpy(&tcp_ses->srcaddr, &volume_info->srcaddr,
1751                sizeof(tcp_ses->srcaddr));
1752         ++tcp_ses->srv_count;
1753
1754         if (addr.ss_family == AF_INET6) {
1755                 cFYI(1, "attempting ipv6 connect");
1756                 /* BB should we allow ipv6 on port 139? */
1757                 /* other OS never observed in Wild doing 139 with v6 */
1758                 memcpy(&tcp_ses->dstaddr, sin_server6,
1759                        sizeof(struct sockaddr_in6));
1760         } else
1761                 memcpy(&tcp_ses->dstaddr, sin_server,
1762                        sizeof(struct sockaddr_in));
1763
1764         rc = ip_connect(tcp_ses);
1765         if (rc < 0) {
1766                 cERROR(1, "Error connecting to socket. Aborting operation");
1767                 goto out_err_crypto_release;
1768         }
1769
1770         /*
1771          * since we're in a cifs function already, we know that
1772          * this will succeed. No need for try_module_get().
1773          */
1774         __module_get(THIS_MODULE);
1775         tcp_ses->tsk = kthread_run((void *)(void *)cifs_demultiplex_thread,
1776                                   tcp_ses, "cifsd");
1777         if (IS_ERR(tcp_ses->tsk)) {
1778                 rc = PTR_ERR(tcp_ses->tsk);
1779                 cERROR(1, "error %d create cifsd thread", rc);
1780                 module_put(THIS_MODULE);
1781                 goto out_err_crypto_release;
1782         }
1783
1784         /* thread spawned, put it on the list */
1785         spin_lock(&cifs_tcp_ses_lock);
1786         list_add(&tcp_ses->tcp_ses_list, &cifs_tcp_ses_list);
1787         spin_unlock(&cifs_tcp_ses_lock);
1788
1789         cifs_fscache_get_client_cookie(tcp_ses);
1790
1791         /* queue echo request delayed work */
1792         queue_delayed_work(system_nrt_wq, &tcp_ses->echo, SMB_ECHO_INTERVAL);
1793
1794         return tcp_ses;
1795
1796 out_err_crypto_release:
1797         cifs_crypto_shash_release(tcp_ses);
1798
1799         put_net(cifs_net_ns(tcp_ses));
1800
1801 out_err:
1802         if (tcp_ses) {
1803                 if (!IS_ERR(tcp_ses->hostname))
1804                         kfree(tcp_ses->hostname);
1805                 if (tcp_ses->ssocket)
1806                         sock_release(tcp_ses->ssocket);
1807                 kfree(tcp_ses);
1808         }
1809         return ERR_PTR(rc);
1810 }
1811
1812 static struct cifsSesInfo *
1813 cifs_find_smb_ses(struct TCP_Server_Info *server, struct smb_vol *vol)
1814 {
1815         struct cifsSesInfo *ses;
1816
1817         spin_lock(&cifs_tcp_ses_lock);
1818         list_for_each_entry(ses, &server->smb_ses_list, smb_ses_list) {
1819                 switch (server->secType) {
1820                 case Kerberos:
1821                         if (vol->cred_uid != ses->cred_uid)
1822                                 continue;
1823                         break;
1824                 default:
1825                         /* anything else takes username/password */
1826                         if (strncmp(ses->userName, vol->username,
1827                                     MAX_USERNAME_SIZE))
1828                                 continue;
1829                         if (strlen(vol->username) != 0 &&
1830                             ses->password != NULL &&
1831                             strncmp(ses->password,
1832                                     vol->password ? vol->password : "",
1833                                     MAX_PASSWORD_SIZE))
1834                                 continue;
1835                 }
1836                 ++ses->ses_count;
1837                 spin_unlock(&cifs_tcp_ses_lock);
1838                 return ses;
1839         }
1840         spin_unlock(&cifs_tcp_ses_lock);
1841         return NULL;
1842 }
1843
1844 static void
1845 cifs_put_smb_ses(struct cifsSesInfo *ses)
1846 {
1847         int xid;
1848         struct TCP_Server_Info *server = ses->server;
1849
1850         cFYI(1, "%s: ses_count=%d\n", __func__, ses->ses_count);
1851         spin_lock(&cifs_tcp_ses_lock);
1852         if (--ses->ses_count > 0) {
1853                 spin_unlock(&cifs_tcp_ses_lock);
1854                 return;
1855         }
1856
1857         list_del_init(&ses->smb_ses_list);
1858         spin_unlock(&cifs_tcp_ses_lock);
1859
1860         if (ses->status == CifsGood) {
1861                 xid = GetXid();
1862                 CIFSSMBLogoff(xid, ses);
1863                 _FreeXid(xid);
1864         }
1865         sesInfoFree(ses);
1866         cifs_put_tcp_session(server);
1867 }
1868
1869 static struct cifsSesInfo *
1870 cifs_get_smb_ses(struct TCP_Server_Info *server, struct smb_vol *volume_info)
1871 {
1872         int rc = -ENOMEM, xid;
1873         struct cifsSesInfo *ses;
1874         struct sockaddr_in *addr = (struct sockaddr_in *)&server->dstaddr;
1875         struct sockaddr_in6 *addr6 = (struct sockaddr_in6 *)&server->dstaddr;
1876
1877         xid = GetXid();
1878
1879         ses = cifs_find_smb_ses(server, volume_info);
1880         if (ses) {
1881                 cFYI(1, "Existing smb sess found (status=%d)", ses->status);
1882
1883                 mutex_lock(&ses->session_mutex);
1884                 rc = cifs_negotiate_protocol(xid, ses);
1885                 if (rc) {
1886                         mutex_unlock(&ses->session_mutex);
1887                         /* problem -- put our ses reference */
1888                         cifs_put_smb_ses(ses);
1889                         FreeXid(xid);
1890                         return ERR_PTR(rc);
1891                 }
1892                 if (ses->need_reconnect) {
1893                         cFYI(1, "Session needs reconnect");
1894                         rc = cifs_setup_session(xid, ses,
1895                                                 volume_info->local_nls);
1896                         if (rc) {
1897                                 mutex_unlock(&ses->session_mutex);
1898                                 /* problem -- put our reference */
1899                                 cifs_put_smb_ses(ses);
1900                                 FreeXid(xid);
1901                                 return ERR_PTR(rc);
1902                         }
1903                 }
1904                 mutex_unlock(&ses->session_mutex);
1905
1906                 /* existing SMB ses has a server reference already */
1907                 cifs_put_tcp_session(server);
1908                 FreeXid(xid);
1909                 return ses;
1910         }
1911
1912         cFYI(1, "Existing smb sess not found");
1913         ses = sesInfoAlloc();
1914         if (ses == NULL)
1915                 goto get_ses_fail;
1916
1917         /* new SMB session uses our server ref */
1918         ses->server = server;
1919         if (server->dstaddr.ss_family == AF_INET6)
1920                 sprintf(ses->serverName, "%pI6", &addr6->sin6_addr);
1921         else
1922                 sprintf(ses->serverName, "%pI4", &addr->sin_addr);
1923
1924         if (volume_info->username)
1925                 strncpy(ses->userName, volume_info->username,
1926                         MAX_USERNAME_SIZE);
1927
1928         /* volume_info->password freed at unmount */
1929         if (volume_info->password) {
1930                 ses->password = kstrdup(volume_info->password, GFP_KERNEL);
1931                 if (!ses->password)
1932                         goto get_ses_fail;
1933         }
1934         if (volume_info->domainname) {
1935                 ses->domainName = kstrdup(volume_info->domainname, GFP_KERNEL);
1936                 if (!ses->domainName)
1937                         goto get_ses_fail;
1938         }
1939         ses->cred_uid = volume_info->cred_uid;
1940         ses->linux_uid = volume_info->linux_uid;
1941         ses->overrideSecFlg = volume_info->secFlg;
1942
1943         mutex_lock(&ses->session_mutex);
1944         rc = cifs_negotiate_protocol(xid, ses);
1945         if (!rc)
1946                 rc = cifs_setup_session(xid, ses, volume_info->local_nls);
1947         mutex_unlock(&ses->session_mutex);
1948         if (rc)
1949                 goto get_ses_fail;
1950
1951         /* success, put it on the list */
1952         spin_lock(&cifs_tcp_ses_lock);
1953         list_add(&ses->smb_ses_list, &server->smb_ses_list);
1954         spin_unlock(&cifs_tcp_ses_lock);
1955
1956         FreeXid(xid);
1957         return ses;
1958
1959 get_ses_fail:
1960         sesInfoFree(ses);
1961         FreeXid(xid);
1962         return ERR_PTR(rc);
1963 }
1964
1965 static struct cifsTconInfo *
1966 cifs_find_tcon(struct cifsSesInfo *ses, const char *unc)
1967 {
1968         struct list_head *tmp;
1969         struct cifsTconInfo *tcon;
1970
1971         spin_lock(&cifs_tcp_ses_lock);
1972         list_for_each(tmp, &ses->tcon_list) {
1973                 tcon = list_entry(tmp, struct cifsTconInfo, tcon_list);
1974                 if (tcon->tidStatus == CifsExiting)
1975                         continue;
1976                 if (strncmp(tcon->treeName, unc, MAX_TREE_SIZE))
1977                         continue;
1978
1979                 ++tcon->tc_count;
1980                 spin_unlock(&cifs_tcp_ses_lock);
1981                 return tcon;
1982         }
1983         spin_unlock(&cifs_tcp_ses_lock);
1984         return NULL;
1985 }
1986
1987 static void
1988 cifs_put_tcon(struct cifsTconInfo *tcon)
1989 {
1990         int xid;
1991         struct cifsSesInfo *ses = tcon->ses;
1992
1993         cFYI(1, "%s: tc_count=%d\n", __func__, tcon->tc_count);
1994         spin_lock(&cifs_tcp_ses_lock);
1995         if (--tcon->tc_count > 0) {
1996                 spin_unlock(&cifs_tcp_ses_lock);
1997                 return;
1998         }
1999
2000         list_del_init(&tcon->tcon_list);
2001         spin_unlock(&cifs_tcp_ses_lock);
2002
2003         xid = GetXid();
2004         CIFSSMBTDis(xid, tcon);
2005         _FreeXid(xid);
2006
2007         cifs_fscache_release_super_cookie(tcon);
2008         tconInfoFree(tcon);
2009         cifs_put_smb_ses(ses);
2010 }
2011
2012 static struct cifsTconInfo *
2013 cifs_get_tcon(struct cifsSesInfo *ses, struct smb_vol *volume_info)
2014 {
2015         int rc, xid;
2016         struct cifsTconInfo *tcon;
2017
2018         tcon = cifs_find_tcon(ses, volume_info->UNC);
2019         if (tcon) {
2020                 cFYI(1, "Found match on UNC path");
2021                 /* existing tcon already has a reference */
2022                 cifs_put_smb_ses(ses);
2023                 if (tcon->seal != volume_info->seal)
2024                         cERROR(1, "transport encryption setting "
2025                                    "conflicts with existing tid");
2026                 return tcon;
2027         }
2028
2029         tcon = tconInfoAlloc();
2030         if (tcon == NULL) {
2031                 rc = -ENOMEM;
2032                 goto out_fail;
2033         }
2034
2035         tcon->ses = ses;
2036         if (volume_info->password) {
2037                 tcon->password = kstrdup(volume_info->password, GFP_KERNEL);
2038                 if (!tcon->password) {
2039                         rc = -ENOMEM;
2040                         goto out_fail;
2041                 }
2042         }
2043
2044         if (strchr(volume_info->UNC + 3, '\\') == NULL
2045             && strchr(volume_info->UNC + 3, '/') == NULL) {
2046                 cERROR(1, "Missing share name");
2047                 rc = -ENODEV;
2048                 goto out_fail;
2049         }
2050
2051         /* BB Do we need to wrap session_mutex around
2052          * this TCon call and Unix SetFS as
2053          * we do on SessSetup and reconnect? */
2054         xid = GetXid();
2055         rc = CIFSTCon(xid, ses, volume_info->UNC, tcon, volume_info->local_nls);
2056         FreeXid(xid);
2057         cFYI(1, "CIFS Tcon rc = %d", rc);
2058         if (rc)
2059                 goto out_fail;
2060
2061         if (volume_info->nodfs) {
2062                 tcon->Flags &= ~SMB_SHARE_IS_IN_DFS;
2063                 cFYI(1, "DFS disabled (%d)", tcon->Flags);
2064         }
2065         tcon->seal = volume_info->seal;
2066         /* we can have only one retry value for a connection
2067            to a share so for resources mounted more than once
2068            to the same server share the last value passed in
2069            for the retry flag is used */
2070         tcon->retry = volume_info->retry;
2071         tcon->nocase = volume_info->nocase;
2072         tcon->local_lease = volume_info->local_lease;
2073
2074         spin_lock(&cifs_tcp_ses_lock);
2075         list_add(&tcon->tcon_list, &ses->tcon_list);
2076         spin_unlock(&cifs_tcp_ses_lock);
2077
2078         cifs_fscache_get_super_cookie(tcon);
2079
2080         return tcon;
2081
2082 out_fail:
2083         tconInfoFree(tcon);
2084         return ERR_PTR(rc);
2085 }
2086
2087 void
2088 cifs_put_tlink(struct tcon_link *tlink)
2089 {
2090         if (!tlink || IS_ERR(tlink))
2091                 return;
2092
2093         if (!atomic_dec_and_test(&tlink->tl_count) ||
2094             test_bit(TCON_LINK_IN_TREE, &tlink->tl_flags)) {
2095                 tlink->tl_time = jiffies;
2096                 return;
2097         }
2098
2099         if (!IS_ERR(tlink_tcon(tlink)))
2100                 cifs_put_tcon(tlink_tcon(tlink));
2101         kfree(tlink);
2102         return;
2103 }
2104
2105 int
2106 get_dfs_path(int xid, struct cifsSesInfo *pSesInfo, const char *old_path,
2107              const struct nls_table *nls_codepage, unsigned int *pnum_referrals,
2108              struct dfs_info3_param **preferrals, int remap)
2109 {
2110         char *temp_unc;
2111         int rc = 0;
2112
2113         *pnum_referrals = 0;
2114         *preferrals = NULL;
2115
2116         if (pSesInfo->ipc_tid == 0) {
2117                 temp_unc = kmalloc(2 /* for slashes */ +
2118                         strnlen(pSesInfo->serverName,
2119                                 SERVER_NAME_LEN_WITH_NULL * 2)
2120                                  + 1 + 4 /* slash IPC$ */  + 2,
2121                                 GFP_KERNEL);
2122                 if (temp_unc == NULL)
2123                         return -ENOMEM;
2124                 temp_unc[0] = '\\';
2125                 temp_unc[1] = '\\';
2126                 strcpy(temp_unc + 2, pSesInfo->serverName);
2127                 strcpy(temp_unc + 2 + strlen(pSesInfo->serverName), "\\IPC$");
2128                 rc = CIFSTCon(xid, pSesInfo, temp_unc, NULL, nls_codepage);
2129                 cFYI(1, "CIFS Tcon rc = %d ipc_tid = %d", rc, pSesInfo->ipc_tid);
2130                 kfree(temp_unc);
2131         }
2132         if (rc == 0)
2133                 rc = CIFSGetDFSRefer(xid, pSesInfo, old_path, preferrals,
2134                                      pnum_referrals, nls_codepage, remap);
2135         /* BB map targetUNCs to dfs_info3 structures, here or
2136                 in CIFSGetDFSRefer BB */
2137
2138         return rc;
2139 }
2140
2141 #ifdef CONFIG_DEBUG_LOCK_ALLOC
2142 static struct lock_class_key cifs_key[2];
2143 static struct lock_class_key cifs_slock_key[2];
2144
2145 static inline void
2146 cifs_reclassify_socket4(struct socket *sock)
2147 {
2148         struct sock *sk = sock->sk;
2149         BUG_ON(sock_owned_by_user(sk));
2150         sock_lock_init_class_and_name(sk, "slock-AF_INET-CIFS",
2151                 &cifs_slock_key[0], "sk_lock-AF_INET-CIFS", &cifs_key[0]);
2152 }
2153
2154 static inline void
2155 cifs_reclassify_socket6(struct socket *sock)
2156 {
2157         struct sock *sk = sock->sk;
2158         BUG_ON(sock_owned_by_user(sk));
2159         sock_lock_init_class_and_name(sk, "slock-AF_INET6-CIFS",
2160                 &cifs_slock_key[1], "sk_lock-AF_INET6-CIFS", &cifs_key[1]);
2161 }
2162 #else
2163 static inline void
2164 cifs_reclassify_socket4(struct socket *sock)
2165 {
2166 }
2167
2168 static inline void
2169 cifs_reclassify_socket6(struct socket *sock)
2170 {
2171 }
2172 #endif
2173
2174 /* See RFC1001 section 14 on representation of Netbios names */
2175 static void rfc1002mangle(char *target, char *source, unsigned int length)
2176 {
2177         unsigned int i, j;
2178
2179         for (i = 0, j = 0; i < (length); i++) {
2180                 /* mask a nibble at a time and encode */
2181                 target[j] = 'A' + (0x0F & (source[i] >> 4));
2182                 target[j+1] = 'A' + (0x0F & source[i]);
2183                 j += 2;
2184         }
2185
2186 }
2187
2188 static int
2189 bind_socket(struct TCP_Server_Info *server)
2190 {
2191         int rc = 0;
2192         if (server->srcaddr.ss_family != AF_UNSPEC) {
2193                 /* Bind to the specified local IP address */
2194                 struct socket *socket = server->ssocket;
2195                 rc = socket->ops->bind(socket,
2196                                        (struct sockaddr *) &server->srcaddr,
2197                                        sizeof(server->srcaddr));
2198                 if (rc < 0) {
2199                         struct sockaddr_in *saddr4;
2200                         struct sockaddr_in6 *saddr6;
2201                         saddr4 = (struct sockaddr_in *)&server->srcaddr;
2202                         saddr6 = (struct sockaddr_in6 *)&server->srcaddr;
2203                         if (saddr6->sin6_family == AF_INET6)
2204                                 cERROR(1, "cifs: "
2205                                        "Failed to bind to: %pI6c, error: %d\n",
2206                                        &saddr6->sin6_addr, rc);
2207                         else
2208                                 cERROR(1, "cifs: "
2209                                        "Failed to bind to: %pI4, error: %d\n",
2210                                        &saddr4->sin_addr.s_addr, rc);
2211                 }
2212         }
2213         return rc;
2214 }
2215
2216 static int
2217 ip_rfc1001_connect(struct TCP_Server_Info *server)
2218 {
2219         int rc = 0;
2220         /*
2221          * some servers require RFC1001 sessinit before sending
2222          * negprot - BB check reconnection in case where second
2223          * sessinit is sent but no second negprot
2224          */
2225         struct rfc1002_session_packet *ses_init_buf;
2226         struct smb_hdr *smb_buf;
2227         ses_init_buf = kzalloc(sizeof(struct rfc1002_session_packet),
2228                                GFP_KERNEL);
2229         if (ses_init_buf) {
2230                 ses_init_buf->trailer.session_req.called_len = 32;
2231
2232                 if (server->server_RFC1001_name &&
2233                     server->server_RFC1001_name[0] != 0)
2234                         rfc1002mangle(ses_init_buf->trailer.
2235                                       session_req.called_name,
2236                                       server->server_RFC1001_name,
2237                                       RFC1001_NAME_LEN_WITH_NULL);
2238                 else
2239                         rfc1002mangle(ses_init_buf->trailer.
2240                                       session_req.called_name,
2241                                       DEFAULT_CIFS_CALLED_NAME,
2242                                       RFC1001_NAME_LEN_WITH_NULL);
2243
2244                 ses_init_buf->trailer.session_req.calling_len = 32;
2245
2246                 /*
2247                  * calling name ends in null (byte 16) from old smb
2248                  * convention.
2249                  */
2250                 if (server->workstation_RFC1001_name &&
2251                     server->workstation_RFC1001_name[0] != 0)
2252                         rfc1002mangle(ses_init_buf->trailer.
2253                                       session_req.calling_name,
2254                                       server->workstation_RFC1001_name,
2255                                       RFC1001_NAME_LEN_WITH_NULL);
2256                 else
2257                         rfc1002mangle(ses_init_buf->trailer.
2258                                       session_req.calling_name,
2259                                       "LINUX_CIFS_CLNT",
2260                                       RFC1001_NAME_LEN_WITH_NULL);
2261
2262                 ses_init_buf->trailer.session_req.scope1 = 0;
2263                 ses_init_buf->trailer.session_req.scope2 = 0;
2264                 smb_buf = (struct smb_hdr *)ses_init_buf;
2265
2266                 /* sizeof RFC1002_SESSION_REQUEST with no scope */
2267                 smb_buf->smb_buf_length = 0x81000044;
2268                 rc = smb_send(server, smb_buf, 0x44);
2269                 kfree(ses_init_buf);
2270                 /*
2271                  * RFC1001 layer in at least one server
2272                  * requires very short break before negprot
2273                  * presumably because not expecting negprot
2274                  * to follow so fast.  This is a simple
2275                  * solution that works without
2276                  * complicating the code and causes no
2277                  * significant slowing down on mount
2278                  * for everyone else
2279                  */
2280                 usleep_range(1000, 2000);
2281         }
2282         /*
2283          * else the negprot may still work without this
2284          * even though malloc failed
2285          */
2286
2287         return rc;
2288 }
2289
2290 static int
2291 generic_ip_connect(struct TCP_Server_Info *server)
2292 {
2293         int rc = 0;
2294         unsigned short int sport;
2295         int slen, sfamily;
2296         struct socket *socket = server->ssocket;
2297         struct sockaddr *saddr;
2298
2299         saddr = (struct sockaddr *) &server->dstaddr;
2300
2301         if (server->dstaddr.ss_family == AF_INET6) {
2302                 sport = ((struct sockaddr_in6 *) saddr)->sin6_port;
2303                 slen = sizeof(struct sockaddr_in6);
2304                 sfamily = AF_INET6;
2305         } else {
2306                 sport = ((struct sockaddr_in *) saddr)->sin_port;
2307                 slen = sizeof(struct sockaddr_in);
2308                 sfamily = AF_INET;
2309         }
2310
2311         if (socket == NULL) {
2312                 rc = __sock_create(cifs_net_ns(server), sfamily, SOCK_STREAM,
2313                                    IPPROTO_TCP, &socket, 1);
2314                 if (rc < 0) {
2315                         cERROR(1, "Error %d creating socket", rc);
2316                         server->ssocket = NULL;
2317                         return rc;
2318                 }
2319
2320                 /* BB other socket options to set KEEPALIVE, NODELAY? */
2321                 cFYI(1, "Socket created");
2322                 server->ssocket = socket;
2323                 socket->sk->sk_allocation = GFP_NOFS;
2324                 if (sfamily == AF_INET6)
2325                         cifs_reclassify_socket6(socket);
2326                 else
2327                         cifs_reclassify_socket4(socket);
2328         }
2329
2330         rc = bind_socket(server);
2331         if (rc < 0)
2332                 return rc;
2333
2334         rc = socket->ops->connect(socket, saddr, slen, 0);
2335         if (rc < 0) {
2336                 cFYI(1, "Error %d connecting to server", rc);
2337                 sock_release(socket);
2338                 server->ssocket = NULL;
2339                 return rc;
2340         }
2341
2342         /*
2343          * Eventually check for other socket options to change from
2344          * the default. sock_setsockopt not used because it expects
2345          * user space buffer
2346          */
2347         socket->sk->sk_rcvtimeo = 7 * HZ;
2348         socket->sk->sk_sndtimeo = 5 * HZ;
2349
2350         /* make the bufsizes depend on wsize/rsize and max requests */
2351         if (server->noautotune) {
2352                 if (socket->sk->sk_sndbuf < (200 * 1024))
2353                         socket->sk->sk_sndbuf = 200 * 1024;
2354                 if (socket->sk->sk_rcvbuf < (140 * 1024))
2355                         socket->sk->sk_rcvbuf = 140 * 1024;
2356         }
2357
2358         if (server->tcp_nodelay) {
2359                 int val = 1;
2360                 rc = kernel_setsockopt(socket, SOL_TCP, TCP_NODELAY,
2361                                 (char *)&val, sizeof(val));
2362                 if (rc)
2363                         cFYI(1, "set TCP_NODELAY socket option error %d", rc);
2364         }
2365
2366          cFYI(1, "sndbuf %d rcvbuf %d rcvtimeo 0x%lx",
2367                  socket->sk->sk_sndbuf,
2368                  socket->sk->sk_rcvbuf, socket->sk->sk_rcvtimeo);
2369
2370         if (sport == htons(RFC1001_PORT))
2371                 rc = ip_rfc1001_connect(server);
2372
2373         return rc;
2374 }
2375
2376 static int
2377 ip_connect(struct TCP_Server_Info *server)
2378 {
2379         unsigned short int *sport;
2380         struct sockaddr_in6 *addr6 = (struct sockaddr_in6 *)&server->dstaddr;
2381         struct sockaddr_in *addr = (struct sockaddr_in *)&server->dstaddr;
2382
2383         if (server->dstaddr.ss_family == AF_INET6)
2384                 sport = &addr6->sin6_port;
2385         else
2386                 sport = &addr->sin_port;
2387
2388         if (*sport == 0) {
2389                 int rc;
2390
2391                 /* try with 445 port at first */
2392                 *sport = htons(CIFS_PORT);
2393
2394                 rc = generic_ip_connect(server);
2395                 if (rc >= 0)
2396                         return rc;
2397
2398                 /* if it failed, try with 139 port */
2399                 *sport = htons(RFC1001_PORT);
2400         }
2401
2402         return generic_ip_connect(server);
2403 }
2404
2405 void reset_cifs_unix_caps(int xid, struct cifsTconInfo *tcon,
2406                           struct super_block *sb, struct smb_vol *vol_info)
2407 {
2408         /* if we are reconnecting then should we check to see if
2409          * any requested capabilities changed locally e.g. via
2410          * remount but we can not do much about it here
2411          * if they have (even if we could detect it by the following)
2412          * Perhaps we could add a backpointer to array of sb from tcon
2413          * or if we change to make all sb to same share the same
2414          * sb as NFS - then we only have one backpointer to sb.
2415          * What if we wanted to mount the server share twice once with
2416          * and once without posixacls or posix paths? */
2417         __u64 saved_cap = le64_to_cpu(tcon->fsUnixInfo.Capability);
2418
2419         if (vol_info && vol_info->no_linux_ext) {
2420                 tcon->fsUnixInfo.Capability = 0;
2421                 tcon->unix_ext = 0; /* Unix Extensions disabled */
2422                 cFYI(1, "Linux protocol extensions disabled");
2423                 return;
2424         } else if (vol_info)
2425                 tcon->unix_ext = 1; /* Unix Extensions supported */
2426
2427         if (tcon->unix_ext == 0) {
2428                 cFYI(1, "Unix extensions disabled so not set on reconnect");
2429                 return;
2430         }
2431
2432         if (!CIFSSMBQFSUnixInfo(xid, tcon)) {
2433                 __u64 cap = le64_to_cpu(tcon->fsUnixInfo.Capability);
2434                 cFYI(1, "unix caps which server supports %lld", cap);
2435                 /* check for reconnect case in which we do not
2436                    want to change the mount behavior if we can avoid it */
2437                 if (vol_info == NULL) {
2438                         /* turn off POSIX ACL and PATHNAMES if not set
2439                            originally at mount time */
2440                         if ((saved_cap & CIFS_UNIX_POSIX_ACL_CAP) == 0)
2441                                 cap &= ~CIFS_UNIX_POSIX_ACL_CAP;
2442                         if ((saved_cap & CIFS_UNIX_POSIX_PATHNAMES_CAP) == 0) {
2443                                 if (cap & CIFS_UNIX_POSIX_PATHNAMES_CAP)
2444                                         cERROR(1, "POSIXPATH support change");
2445                                 cap &= ~CIFS_UNIX_POSIX_PATHNAMES_CAP;
2446                         } else if ((cap & CIFS_UNIX_POSIX_PATHNAMES_CAP) == 0) {
2447                                 cERROR(1, "possible reconnect error");
2448                                 cERROR(1, "server disabled POSIX path support");
2449                         }
2450                 }
2451
2452                 if (cap & CIFS_UNIX_TRANSPORT_ENCRYPTION_MANDATORY_CAP)
2453                         cERROR(1, "per-share encryption not supported yet");
2454
2455                 cap &= CIFS_UNIX_CAP_MASK;
2456                 if (vol_info && vol_info->no_psx_acl)
2457                         cap &= ~CIFS_UNIX_POSIX_ACL_CAP;
2458                 else if (CIFS_UNIX_POSIX_ACL_CAP & cap) {
2459                         cFYI(1, "negotiated posix acl support");
2460                         if (sb)
2461                                 sb->s_flags |= MS_POSIXACL;
2462                 }
2463
2464                 if (vol_info && vol_info->posix_paths == 0)
2465                         cap &= ~CIFS_UNIX_POSIX_PATHNAMES_CAP;
2466                 else if (cap & CIFS_UNIX_POSIX_PATHNAMES_CAP) {
2467                         cFYI(1, "negotiate posix pathnames");
2468                         if (sb)
2469                                 CIFS_SB(sb)->mnt_cifs_flags |=
2470                                         CIFS_MOUNT_POSIX_PATHS;
2471                 }
2472
2473                 /* We might be setting the path sep back to a different
2474                 form if we are reconnecting and the server switched its
2475                 posix path capability for this share */
2476                 if (sb && (CIFS_SB(sb)->prepathlen > 0))
2477                         CIFS_SB(sb)->prepath[0] = CIFS_DIR_SEP(CIFS_SB(sb));
2478
2479                 if (sb && (CIFS_SB(sb)->rsize > 127 * 1024)) {
2480                         if ((cap & CIFS_UNIX_LARGE_READ_CAP) == 0) {
2481                                 CIFS_SB(sb)->rsize = 127 * 1024;
2482                                 cFYI(DBG2, "larger reads not supported by srv");
2483                         }
2484                 }
2485
2486
2487                 cFYI(1, "Negotiate caps 0x%x", (int)cap);
2488 #ifdef CONFIG_CIFS_DEBUG2
2489                 if (cap & CIFS_UNIX_FCNTL_CAP)
2490                         cFYI(1, "FCNTL cap");
2491                 if (cap & CIFS_UNIX_EXTATTR_CAP)
2492                         cFYI(1, "EXTATTR cap");
2493                 if (cap & CIFS_UNIX_POSIX_PATHNAMES_CAP)
2494                         cFYI(1, "POSIX path cap");
2495                 if (cap & CIFS_UNIX_XATTR_CAP)
2496                         cFYI(1, "XATTR cap");
2497                 if (cap & CIFS_UNIX_POSIX_ACL_CAP)
2498                         cFYI(1, "POSIX ACL cap");
2499                 if (cap & CIFS_UNIX_LARGE_READ_CAP)
2500                         cFYI(1, "very large read cap");
2501                 if (cap & CIFS_UNIX_LARGE_WRITE_CAP)
2502                         cFYI(1, "very large write cap");
2503                 if (cap & CIFS_UNIX_TRANSPORT_ENCRYPTION_CAP)
2504                         cFYI(1, "transport encryption cap");
2505                 if (cap & CIFS_UNIX_TRANSPORT_ENCRYPTION_MANDATORY_CAP)
2506                         cFYI(1, "mandatory transport encryption cap");
2507 #endif /* CIFS_DEBUG2 */
2508                 if (CIFSSMBSetFSUnixInfo(xid, tcon, cap)) {
2509                         if (vol_info == NULL) {
2510                                 cFYI(1, "resetting capabilities failed");
2511                         } else
2512                                 cERROR(1, "Negotiating Unix capabilities "
2513                                            "with the server failed.  Consider "
2514                                            "mounting with the Unix Extensions\n"
2515                                            "disabled, if problems are found, "
2516                                            "by specifying the nounix mount "
2517                                            "option.");
2518
2519                 }
2520         }
2521 }
2522
2523 static void
2524 convert_delimiter(char *path, char delim)
2525 {
2526         int i;
2527         char old_delim;
2528
2529         if (path == NULL)
2530                 return;
2531
2532         if (delim == '/')
2533                 old_delim = '\\';
2534         else
2535                 old_delim = '/';
2536
2537         for (i = 0; path[i] != '\0'; i++) {
2538                 if (path[i] == old_delim)
2539                         path[i] = delim;
2540         }
2541 }
2542
2543 static void setup_cifs_sb(struct smb_vol *pvolume_info,
2544                           struct cifs_sb_info *cifs_sb)
2545 {
2546         INIT_DELAYED_WORK(&cifs_sb->prune_tlinks, cifs_prune_tlinks);
2547
2548         if (pvolume_info->rsize > CIFSMaxBufSize) {
2549                 cERROR(1, "rsize %d too large, using MaxBufSize",
2550                         pvolume_info->rsize);
2551                 cifs_sb->rsize = CIFSMaxBufSize;
2552         } else if ((pvolume_info->rsize) &&
2553                         (pvolume_info->rsize <= CIFSMaxBufSize))
2554                 cifs_sb->rsize = pvolume_info->rsize;
2555         else /* default */
2556                 cifs_sb->rsize = CIFSMaxBufSize;
2557
2558         if (pvolume_info->wsize > PAGEVEC_SIZE * PAGE_CACHE_SIZE) {
2559                 cERROR(1, "wsize %d too large, using 4096 instead",
2560                           pvolume_info->wsize);
2561                 cifs_sb->wsize = 4096;
2562         } else if (pvolume_info->wsize)
2563                 cifs_sb->wsize = pvolume_info->wsize;
2564         else
2565                 cifs_sb->wsize = min_t(const int,
2566                                         PAGEVEC_SIZE * PAGE_CACHE_SIZE,
2567                                         127*1024);
2568                 /* old default of CIFSMaxBufSize was too small now
2569                    that SMB Write2 can send multiple pages in kvec.
2570                    RFC1001 does not describe what happens when frame
2571                    bigger than 128K is sent so use that as max in
2572                    conjunction with 52K kvec constraint on arch with 4K
2573                    page size  */
2574
2575         if (cifs_sb->rsize < 2048) {
2576                 cifs_sb->rsize = 2048;
2577                 /* Windows ME may prefer this */
2578                 cFYI(1, "readsize set to minimum: 2048");
2579         }
2580         /* calculate prepath */
2581         cifs_sb->prepath = pvolume_info->prepath;
2582         if (cifs_sb->prepath) {
2583                 cifs_sb->prepathlen = strlen(cifs_sb->prepath);
2584                 /* we can not convert the / to \ in the path
2585                 separators in the prefixpath yet because we do not
2586                 know (until reset_cifs_unix_caps is called later)
2587                 whether POSIX PATH CAP is available. We normalize
2588                 the / to \ after reset_cifs_unix_caps is called */
2589                 pvolume_info->prepath = NULL;
2590         } else
2591                 cifs_sb->prepathlen = 0;
2592         cifs_sb->mnt_uid = pvolume_info->linux_uid;
2593         cifs_sb->mnt_gid = pvolume_info->linux_gid;
2594         cifs_sb->mnt_file_mode = pvolume_info->file_mode;
2595         cifs_sb->mnt_dir_mode = pvolume_info->dir_mode;
2596         cFYI(1, "file mode: 0x%x  dir mode: 0x%x",
2597                 cifs_sb->mnt_file_mode, cifs_sb->mnt_dir_mode);
2598
2599         cifs_sb->actimeo = pvolume_info->actimeo;
2600
2601         if (pvolume_info->noperm)
2602                 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_NO_PERM;
2603         if (pvolume_info->setuids)
2604                 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_SET_UID;
2605         if (pvolume_info->server_ino)
2606                 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_SERVER_INUM;
2607         if (pvolume_info->remap)
2608                 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_MAP_SPECIAL_CHR;
2609         if (pvolume_info->no_xattr)
2610                 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_NO_XATTR;
2611         if (pvolume_info->sfu_emul)
2612                 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_UNX_EMUL;
2613         if (pvolume_info->nobrl)
2614                 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_NO_BRL;
2615         if (pvolume_info->nostrictsync)
2616                 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_NOSSYNC;
2617         if (pvolume_info->mand_lock)
2618                 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_NOPOSIXBRL;
2619         if (pvolume_info->cifs_acl)
2620                 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_CIFS_ACL;
2621         if (pvolume_info->override_uid)
2622                 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_OVERR_UID;
2623         if (pvolume_info->override_gid)
2624                 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_OVERR_GID;
2625         if (pvolume_info->dynperm)
2626                 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_DYNPERM;
2627         if (pvolume_info->fsc)
2628                 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_FSCACHE;
2629         if (pvolume_info->multiuser)
2630                 cifs_sb->mnt_cifs_flags |= (CIFS_MOUNT_MULTIUSER |
2631                                             CIFS_MOUNT_NO_PERM);
2632         if (pvolume_info->strict_io)
2633                 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_STRICT_IO;
2634         if (pvolume_info->direct_io) {
2635                 cFYI(1, "mounting share using direct i/o");
2636                 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_DIRECT_IO;
2637         }
2638         if (pvolume_info->mfsymlinks) {
2639                 if (pvolume_info->sfu_emul) {
2640                         cERROR(1,  "mount option mfsymlinks ignored if sfu "
2641                                    "mount option is used");
2642                 } else {
2643                         cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_MF_SYMLINKS;
2644                 }
2645         }
2646
2647         if ((pvolume_info->cifs_acl) && (pvolume_info->dynperm))
2648                 cERROR(1, "mount option dynperm ignored if cifsacl "
2649                            "mount option supported");
2650 }
2651
2652 static int
2653 is_path_accessible(int xid, struct cifsTconInfo *tcon,
2654                    struct cifs_sb_info *cifs_sb, const char *full_path)
2655 {
2656         int rc;
2657         FILE_ALL_INFO *pfile_info;
2658
2659         pfile_info = kmalloc(sizeof(FILE_ALL_INFO), GFP_KERNEL);
2660         if (pfile_info == NULL)
2661                 return -ENOMEM;
2662
2663         rc = CIFSSMBQPathInfo(xid, tcon, full_path, pfile_info,
2664                               0 /* not legacy */, cifs_sb->local_nls,
2665                               cifs_sb->mnt_cifs_flags &
2666                                 CIFS_MOUNT_MAP_SPECIAL_CHR);
2667
2668         if (rc == -EOPNOTSUPP || rc == -EINVAL)
2669                 rc = SMBQueryInformation(xid, tcon, full_path, pfile_info,
2670                                 cifs_sb->local_nls, cifs_sb->mnt_cifs_flags &
2671                                   CIFS_MOUNT_MAP_SPECIAL_CHR);
2672         kfree(pfile_info);
2673         return rc;
2674 }
2675
2676 static void
2677 cleanup_volume_info(struct smb_vol **pvolume_info)
2678 {
2679         struct smb_vol *volume_info;
2680
2681         if (!pvolume_info || !*pvolume_info)
2682                 return;
2683
2684         volume_info = *pvolume_info;
2685         kzfree(volume_info->password);
2686         kfree(volume_info->UNC);
2687         kfree(volume_info->prepath);
2688         kfree(volume_info);
2689         *pvolume_info = NULL;
2690         return;
2691 }
2692
2693 #ifdef CONFIG_CIFS_DFS_UPCALL
2694 /* build_path_to_root returns full path to root when
2695  * we do not have an exiting connection (tcon) */
2696 static char *
2697 build_unc_path_to_root(const struct smb_vol *volume_info,
2698                 const struct cifs_sb_info *cifs_sb)
2699 {
2700         char *full_path;
2701
2702         int unc_len = strnlen(volume_info->UNC, MAX_TREE_SIZE + 1);
2703         full_path = kmalloc(unc_len + cifs_sb->prepathlen + 1, GFP_KERNEL);
2704         if (full_path == NULL)
2705                 return ERR_PTR(-ENOMEM);
2706
2707         strncpy(full_path, volume_info->UNC, unc_len);
2708         if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_POSIX_PATHS) {
2709                 int i;
2710                 for (i = 0; i < unc_len; i++) {
2711                         if (full_path[i] == '\\')
2712                                 full_path[i] = '/';
2713                 }
2714         }
2715
2716         if (cifs_sb->prepathlen)
2717                 strncpy(full_path + unc_len, cifs_sb->prepath,
2718                                 cifs_sb->prepathlen);
2719
2720         full_path[unc_len + cifs_sb->prepathlen] = 0; /* add trailing null */
2721         return full_path;
2722 }
2723 #endif
2724
2725 int
2726 cifs_mount(struct super_block *sb, struct cifs_sb_info *cifs_sb,
2727                 char *mount_data_global, const char *devname)
2728 {
2729         int rc;
2730         int xid;
2731         struct smb_vol *volume_info;
2732         struct cifsSesInfo *pSesInfo;
2733         struct cifsTconInfo *tcon;
2734         struct TCP_Server_Info *srvTcp;
2735         char   *full_path;
2736         char *mount_data = mount_data_global;
2737         struct tcon_link *tlink;
2738 #ifdef CONFIG_CIFS_DFS_UPCALL
2739         struct dfs_info3_param *referrals = NULL;
2740         unsigned int num_referrals = 0;
2741         int referral_walks_count = 0;
2742 try_mount_again:
2743 #endif
2744         rc = 0;
2745         tcon = NULL;
2746         pSesInfo = NULL;
2747         srvTcp = NULL;
2748         full_path = NULL;
2749         tlink = NULL;
2750
2751         xid = GetXid();
2752
2753         volume_info = kzalloc(sizeof(struct smb_vol), GFP_KERNEL);
2754         if (!volume_info) {
2755                 rc = -ENOMEM;
2756                 goto out;
2757         }
2758
2759         if (cifs_parse_mount_options(mount_data, devname, volume_info)) {
2760                 rc = -EINVAL;
2761                 goto out;
2762         }
2763
2764         if (volume_info->nullauth) {
2765                 cFYI(1, "null user");
2766                 volume_info->username = "";
2767         } else if (volume_info->username) {
2768                 /* BB fixme parse for domain name here */
2769                 cFYI(1, "Username: %s", volume_info->username);
2770         } else {
2771                 cifserror("No username specified");
2772         /* In userspace mount helper we can get user name from alternate
2773            locations such as env variables and files on disk */
2774                 rc = -EINVAL;
2775                 goto out;
2776         }
2777
2778         /* this is needed for ASCII cp to Unicode converts */
2779         if (volume_info->iocharset == NULL) {
2780                 /* load_nls_default cannot return null */
2781                 volume_info->local_nls = load_nls_default();
2782         } else {
2783                 volume_info->local_nls = load_nls(volume_info->iocharset);
2784                 if (volume_info->local_nls == NULL) {
2785                         cERROR(1, "CIFS mount error: iocharset %s not found",
2786                                  volume_info->iocharset);
2787                         rc = -ELIBACC;
2788                         goto out;
2789                 }
2790         }
2791         cifs_sb->local_nls = volume_info->local_nls;
2792
2793         /* get a reference to a tcp session */
2794         srvTcp = cifs_get_tcp_session(volume_info);
2795         if (IS_ERR(srvTcp)) {
2796                 rc = PTR_ERR(srvTcp);
2797                 goto out;
2798         }
2799
2800         /* get a reference to a SMB session */
2801         pSesInfo = cifs_get_smb_ses(srvTcp, volume_info);
2802         if (IS_ERR(pSesInfo)) {
2803                 rc = PTR_ERR(pSesInfo);
2804                 pSesInfo = NULL;
2805                 goto mount_fail_check;
2806         }
2807
2808         setup_cifs_sb(volume_info, cifs_sb);
2809         if (pSesInfo->capabilities & CAP_LARGE_FILES)
2810                 sb->s_maxbytes = MAX_LFS_FILESIZE;
2811         else
2812                 sb->s_maxbytes = MAX_NON_LFS;
2813
2814         /* BB FIXME fix time_gran to be larger for LANMAN sessions */
2815         sb->s_time_gran = 100;
2816
2817         /* search for existing tcon to this server share */
2818         tcon = cifs_get_tcon(pSesInfo, volume_info);
2819         if (IS_ERR(tcon)) {
2820                 rc = PTR_ERR(tcon);
2821                 tcon = NULL;
2822                 goto remote_path_check;
2823         }
2824
2825         /* tell server which Unix caps we support */
2826         if (tcon->ses->capabilities & CAP_UNIX) {
2827                 /* reset of caps checks mount to see if unix extensions
2828                    disabled for just this mount */
2829                 reset_cifs_unix_caps(xid, tcon, sb, volume_info);
2830                 if ((tcon->ses->server->tcpStatus == CifsNeedReconnect) &&
2831                     (le64_to_cpu(tcon->fsUnixInfo.Capability) &
2832                      CIFS_UNIX_TRANSPORT_ENCRYPTION_MANDATORY_CAP)) {
2833                         rc = -EACCES;
2834                         goto mount_fail_check;
2835                 }
2836         } else
2837                 tcon->unix_ext = 0; /* server does not support them */
2838
2839         /* do not care if following two calls succeed - informational */
2840         if (!tcon->ipc) {
2841                 CIFSSMBQFSDeviceInfo(xid, tcon);
2842                 CIFSSMBQFSAttributeInfo(xid, tcon);
2843         }
2844
2845         /* convert forward to back slashes in prepath here if needed */
2846         if ((cifs_sb->mnt_cifs_flags & CIFS_MOUNT_POSIX_PATHS) == 0)
2847                 convert_delimiter(cifs_sb->prepath, CIFS_DIR_SEP(cifs_sb));
2848
2849         if ((tcon->unix_ext == 0) && (cifs_sb->rsize > (1024 * 127))) {
2850                 cifs_sb->rsize = 1024 * 127;
2851                 cFYI(DBG2, "no very large read support, rsize now 127K");
2852         }
2853         if (!(tcon->ses->capabilities & CAP_LARGE_WRITE_X))
2854                 cifs_sb->wsize = min(cifs_sb->wsize,
2855                                (tcon->ses->server->maxBuf - MAX_CIFS_HDR_SIZE));
2856         if (!(tcon->ses->capabilities & CAP_LARGE_READ_X))
2857                 cifs_sb->rsize = min(cifs_sb->rsize,
2858                                (tcon->ses->server->maxBuf - MAX_CIFS_HDR_SIZE));
2859
2860 remote_path_check:
2861         /* check if a whole path (including prepath) is not remote */
2862         if (!rc && tcon) {
2863                 /* build_path_to_root works only when we have a valid tcon */
2864                 full_path = cifs_build_path_to_root(cifs_sb, tcon);
2865                 if (full_path == NULL) {
2866                         rc = -ENOMEM;
2867                         goto mount_fail_check;
2868                 }
2869                 rc = is_path_accessible(xid, tcon, cifs_sb, full_path);
2870                 if (rc != 0 && rc != -EREMOTE) {
2871                         kfree(full_path);
2872                         goto mount_fail_check;
2873                 }
2874                 kfree(full_path);
2875         }
2876
2877         /* get referral if needed */
2878         if (rc == -EREMOTE) {
2879 #ifdef CONFIG_CIFS_DFS_UPCALL
2880                 if (referral_walks_count > MAX_NESTED_LINKS) {
2881                         /*
2882                          * BB: when we implement proper loop detection,
2883                          *     we will remove this check. But now we need it
2884                          *     to prevent an indefinite loop if 'DFS tree' is
2885                          *     misconfigured (i.e. has loops).
2886                          */
2887                         rc = -ELOOP;
2888                         goto mount_fail_check;
2889                 }
2890                 /* convert forward to back slashes in prepath here if needed */
2891                 if ((cifs_sb->mnt_cifs_flags & CIFS_MOUNT_POSIX_PATHS) == 0)
2892                         convert_delimiter(cifs_sb->prepath,
2893                                         CIFS_DIR_SEP(cifs_sb));
2894                 full_path = build_unc_path_to_root(volume_info, cifs_sb);
2895                 if (IS_ERR(full_path)) {
2896                         rc = PTR_ERR(full_path);
2897                         goto mount_fail_check;
2898                 }
2899
2900                 cFYI(1, "Getting referral for: %s", full_path);
2901                 rc = get_dfs_path(xid, pSesInfo , full_path + 1,
2902                         cifs_sb->local_nls, &num_referrals, &referrals,
2903                         cifs_sb->mnt_cifs_flags & CIFS_MOUNT_MAP_SPECIAL_CHR);
2904                 if (!rc && num_referrals > 0) {
2905                         char *fake_devname = NULL;
2906
2907                         if (mount_data != mount_data_global)
2908                                 kfree(mount_data);
2909
2910                         mount_data = cifs_compose_mount_options(
2911                                         cifs_sb->mountdata, full_path + 1,
2912                                         referrals, &fake_devname);
2913
2914                         free_dfs_info_array(referrals, num_referrals);
2915                         kfree(fake_devname);
2916                         kfree(full_path);
2917
2918                         if (IS_ERR(mount_data)) {
2919                                 rc = PTR_ERR(mount_data);
2920                                 mount_data = NULL;
2921                                 goto mount_fail_check;
2922                         }
2923
2924                         if (tcon)
2925                                 cifs_put_tcon(tcon);
2926                         else if (pSesInfo)
2927                                 cifs_put_smb_ses(pSesInfo);
2928
2929                         cleanup_volume_info(&volume_info);
2930                         referral_walks_count++;
2931                         FreeXid(xid);
2932                         goto try_mount_again;
2933                 }
2934 #else /* No DFS support, return error on mount */
2935                 rc = -EOPNOTSUPP;
2936 #endif
2937         }
2938
2939         if (rc)
2940                 goto mount_fail_check;
2941
2942         /* now, hang the tcon off of the superblock */
2943         tlink = kzalloc(sizeof *tlink, GFP_KERNEL);
2944         if (tlink == NULL) {
2945                 rc = -ENOMEM;
2946                 goto mount_fail_check;
2947         }
2948
2949         tlink->tl_uid = pSesInfo->linux_uid;
2950         tlink->tl_tcon = tcon;
2951         tlink->tl_time = jiffies;
2952         set_bit(TCON_LINK_MASTER, &tlink->tl_flags);
2953         set_bit(TCON_LINK_IN_TREE, &tlink->tl_flags);
2954
2955         cifs_sb->master_tlink = tlink;
2956         spin_lock(&cifs_sb->tlink_tree_lock);
2957         tlink_rb_insert(&cifs_sb->tlink_tree, tlink);
2958         spin_unlock(&cifs_sb->tlink_tree_lock);
2959
2960         queue_delayed_work(system_nrt_wq, &cifs_sb->prune_tlinks,
2961                                 TLINK_IDLE_EXPIRE);
2962
2963 mount_fail_check:
2964         /* on error free sesinfo and tcon struct if needed */
2965         if (rc) {
2966                 if (mount_data != mount_data_global)
2967                         kfree(mount_data);
2968                 /* If find_unc succeeded then rc == 0 so we can not end */
2969                 /* up accidently freeing someone elses tcon struct */
2970                 if (tcon)
2971                         cifs_put_tcon(tcon);
2972                 else if (pSesInfo)
2973                         cifs_put_smb_ses(pSesInfo);
2974                 else
2975                         cifs_put_tcp_session(srvTcp);
2976                 goto out;
2977         }
2978
2979         /* volume_info->password is freed above when existing session found
2980         (in which case it is not needed anymore) but when new sesion is created
2981         the password ptr is put in the new session structure (in which case the
2982         password will be freed at unmount time) */
2983 out:
2984         /* zero out password before freeing */
2985         cleanup_volume_info(&volume_info);
2986         FreeXid(xid);
2987         return rc;
2988 }
2989
2990 int
2991 CIFSTCon(unsigned int xid, struct cifsSesInfo *ses,
2992          const char *tree, struct cifsTconInfo *tcon,
2993          const struct nls_table *nls_codepage)
2994 {
2995         struct smb_hdr *smb_buffer;
2996         struct smb_hdr *smb_buffer_response;
2997         TCONX_REQ *pSMB;
2998         TCONX_RSP *pSMBr;
2999         unsigned char *bcc_ptr;
3000         int rc = 0;
3001         int length;
3002         __u16 bytes_left, count;
3003
3004         if (ses == NULL)
3005                 return -EIO;
3006
3007         smb_buffer = cifs_buf_get();
3008         if (smb_buffer == NULL)
3009                 return -ENOMEM;
3010
3011         smb_buffer_response = smb_buffer;
3012
3013         header_assemble(smb_buffer, SMB_COM_TREE_CONNECT_ANDX,
3014                         NULL /*no tid */ , 4 /*wct */ );
3015
3016         smb_buffer->Mid = GetNextMid(ses->server);
3017         smb_buffer->Uid = ses->Suid;
3018         pSMB = (TCONX_REQ *) smb_buffer;
3019         pSMBr = (TCONX_RSP *) smb_buffer_response;
3020
3021         pSMB->AndXCommand = 0xFF;
3022         pSMB->Flags = cpu_to_le16(TCON_EXTENDED_SECINFO);
3023         bcc_ptr = &pSMB->Password[0];
3024         if ((ses->server->secMode) & SECMODE_USER) {
3025                 pSMB->PasswordLength = cpu_to_le16(1);  /* minimum */
3026                 *bcc_ptr = 0; /* password is null byte */
3027                 bcc_ptr++;              /* skip password */
3028                 /* already aligned so no need to do it below */
3029         } else {
3030                 pSMB->PasswordLength = cpu_to_le16(CIFS_AUTH_RESP_SIZE);
3031                 /* BB FIXME add code to fail this if NTLMv2 or Kerberos
3032                    specified as required (when that support is added to
3033                    the vfs in the future) as only NTLM or the much
3034                    weaker LANMAN (which we do not send by default) is accepted
3035                    by Samba (not sure whether other servers allow
3036                    NTLMv2 password here) */
3037 #ifdef CONFIG_CIFS_WEAK_PW_HASH
3038                 if ((global_secflags & CIFSSEC_MAY_LANMAN) &&
3039                     (ses->server->secType == LANMAN))
3040                         calc_lanman_hash(tcon->password, ses->server->cryptkey,
3041                                          ses->server->secMode &
3042                                             SECMODE_PW_ENCRYPT ? true : false,
3043                                          bcc_ptr);
3044                 else
3045 #endif /* CIFS_WEAK_PW_HASH */
3046                 rc = SMBNTencrypt(tcon->password, ses->server->cryptkey,
3047                                         bcc_ptr);
3048
3049                 bcc_ptr += CIFS_AUTH_RESP_SIZE;
3050                 if (ses->capabilities & CAP_UNICODE) {
3051                         /* must align unicode strings */
3052                         *bcc_ptr = 0; /* null byte password */
3053                         bcc_ptr++;
3054                 }
3055         }
3056
3057         if (ses->server->secMode &
3058                         (SECMODE_SIGN_REQUIRED | SECMODE_SIGN_ENABLED))
3059                 smb_buffer->Flags2 |= SMBFLG2_SECURITY_SIGNATURE;
3060
3061         if (ses->capabilities & CAP_STATUS32) {
3062                 smb_buffer->Flags2 |= SMBFLG2_ERR_STATUS;
3063         }
3064         if (ses->capabilities & CAP_DFS) {
3065                 smb_buffer->Flags2 |= SMBFLG2_DFS;
3066         }
3067         if (ses->capabilities & CAP_UNICODE) {
3068                 smb_buffer->Flags2 |= SMBFLG2_UNICODE;
3069                 length =
3070                     cifs_strtoUCS((__le16 *) bcc_ptr, tree,
3071                         6 /* max utf8 char length in bytes */ *
3072                         (/* server len*/ + 256 /* share len */), nls_codepage);
3073                 bcc_ptr += 2 * length;  /* convert num 16 bit words to bytes */
3074                 bcc_ptr += 2;   /* skip trailing null */
3075         } else {                /* ASCII */
3076                 strcpy(bcc_ptr, tree);
3077                 bcc_ptr += strlen(tree) + 1;
3078         }
3079         strcpy(bcc_ptr, "?????");
3080         bcc_ptr += strlen("?????");
3081         bcc_ptr += 1;
3082         count = bcc_ptr - &pSMB->Password[0];
3083         pSMB->hdr.smb_buf_length += count;
3084         pSMB->ByteCount = cpu_to_le16(count);
3085
3086         rc = SendReceive(xid, ses, smb_buffer, smb_buffer_response, &length,
3087                          0);
3088
3089         /* above now done in SendReceive */
3090         if ((rc == 0) && (tcon != NULL)) {
3091                 bool is_unicode;
3092
3093                 tcon->tidStatus = CifsGood;
3094                 tcon->need_reconnect = false;
3095                 tcon->tid = smb_buffer_response->Tid;
3096                 bcc_ptr = pByteArea(smb_buffer_response);
3097                 bytes_left = get_bcc(smb_buffer_response);
3098                 length = strnlen(bcc_ptr, bytes_left - 2);
3099                 if (smb_buffer->Flags2 & SMBFLG2_UNICODE)
3100                         is_unicode = true;
3101                 else
3102                         is_unicode = false;
3103
3104
3105                 /* skip service field (NB: this field is always ASCII) */
3106                 if (length == 3) {
3107                         if ((bcc_ptr[0] == 'I') && (bcc_ptr[1] == 'P') &&
3108                             (bcc_ptr[2] == 'C')) {
3109                                 cFYI(1, "IPC connection");
3110                                 tcon->ipc = 1;
3111                         }
3112                 } else if (length == 2) {
3113                         if ((bcc_ptr[0] == 'A') && (bcc_ptr[1] == ':')) {
3114                                 /* the most common case */
3115                                 cFYI(1, "disk share connection");
3116                         }
3117                 }
3118                 bcc_ptr += length + 1;
3119                 bytes_left -= (length + 1);
3120                 strncpy(tcon->treeName, tree, MAX_TREE_SIZE);
3121
3122                 /* mostly informational -- no need to fail on error here */
3123                 kfree(tcon->nativeFileSystem);
3124                 tcon->nativeFileSystem = cifs_strndup_from_ucs(bcc_ptr,
3125                                                       bytes_left, is_unicode,
3126                                                       nls_codepage);
3127
3128                 cFYI(1, "nativeFileSystem=%s", tcon->nativeFileSystem);
3129
3130                 if ((smb_buffer_response->WordCount == 3) ||
3131                          (smb_buffer_response->WordCount == 7))
3132                         /* field is in same location */
3133                         tcon->Flags = le16_to_cpu(pSMBr->OptionalSupport);
3134                 else
3135                         tcon->Flags = 0;
3136                 cFYI(1, "Tcon flags: 0x%x ", tcon->Flags);
3137         } else if ((rc == 0) && tcon == NULL) {
3138                 /* all we need to save for IPC$ connection */
3139                 ses->ipc_tid = smb_buffer_response->Tid;
3140         }
3141
3142         cifs_buf_release(smb_buffer);
3143         return rc;
3144 }
3145
3146 int
3147 cifs_umount(struct super_block *sb, struct cifs_sb_info *cifs_sb)
3148 {
3149         struct rb_root *root = &cifs_sb->tlink_tree;
3150         struct rb_node *node;
3151         struct tcon_link *tlink;
3152         char *tmp;
3153
3154         cancel_delayed_work_sync(&cifs_sb->prune_tlinks);
3155
3156         spin_lock(&cifs_sb->tlink_tree_lock);
3157         while ((node = rb_first(root))) {
3158                 tlink = rb_entry(node, struct tcon_link, tl_rbnode);
3159                 cifs_get_tlink(tlink);
3160                 clear_bit(TCON_LINK_IN_TREE, &tlink->tl_flags);
3161                 rb_erase(node, root);
3162
3163                 spin_unlock(&cifs_sb->tlink_tree_lock);
3164                 cifs_put_tlink(tlink);
3165                 spin_lock(&cifs_sb->tlink_tree_lock);
3166         }
3167         spin_unlock(&cifs_sb->tlink_tree_lock);
3168
3169         tmp = cifs_sb->prepath;
3170         cifs_sb->prepathlen = 0;
3171         cifs_sb->prepath = NULL;
3172         kfree(tmp);
3173
3174         return 0;
3175 }
3176
3177 int cifs_negotiate_protocol(unsigned int xid, struct cifsSesInfo *ses)
3178 {
3179         int rc = 0;
3180         struct TCP_Server_Info *server = ses->server;
3181
3182         /* only send once per connect */
3183         if (server->maxBuf != 0)
3184                 return 0;
3185
3186         rc = CIFSSMBNegotiate(xid, ses);
3187         if (rc == -EAGAIN) {
3188                 /* retry only once on 1st time connection */
3189                 rc = CIFSSMBNegotiate(xid, ses);
3190                 if (rc == -EAGAIN)
3191                         rc = -EHOSTDOWN;
3192         }
3193         if (rc == 0) {
3194                 spin_lock(&GlobalMid_Lock);
3195                 if (server->tcpStatus != CifsExiting)
3196                         server->tcpStatus = CifsGood;
3197                 else
3198                         rc = -EHOSTDOWN;
3199                 spin_unlock(&GlobalMid_Lock);
3200
3201         }
3202
3203         return rc;
3204 }
3205
3206
3207 int cifs_setup_session(unsigned int xid, struct cifsSesInfo *ses,
3208                         struct nls_table *nls_info)
3209 {
3210         int rc = 0;
3211         struct TCP_Server_Info *server = ses->server;
3212
3213         ses->flags = 0;
3214         ses->capabilities = server->capabilities;
3215         if (linuxExtEnabled == 0)
3216                 ses->capabilities &= (~CAP_UNIX);
3217
3218         cFYI(1, "Security Mode: 0x%x Capabilities: 0x%x TimeAdjust: %d",
3219                  server->secMode, server->capabilities, server->timeAdj);
3220
3221         rc = CIFS_SessSetup(xid, ses, nls_info);
3222         if (rc) {
3223                 cERROR(1, "Send error in SessSetup = %d", rc);
3224         } else {
3225                 mutex_lock(&ses->server->srv_mutex);
3226                 if (!server->session_estab) {
3227                         server->session_key.response = ses->auth_key.response;
3228                         server->session_key.len = ses->auth_key.len;
3229                         server->sequence_number = 0x2;
3230                         server->session_estab = true;
3231                         ses->auth_key.response = NULL;
3232                 }
3233                 mutex_unlock(&server->srv_mutex);
3234
3235                 cFYI(1, "CIFS Session Established successfully");
3236                 spin_lock(&GlobalMid_Lock);
3237                 ses->status = CifsGood;
3238                 ses->need_reconnect = false;
3239                 spin_unlock(&GlobalMid_Lock);
3240         }
3241
3242         kfree(ses->auth_key.response);
3243         ses->auth_key.response = NULL;
3244         ses->auth_key.len = 0;
3245         kfree(ses->ntlmssp);
3246         ses->ntlmssp = NULL;
3247
3248         return rc;
3249 }
3250
3251 static struct cifsTconInfo *
3252 cifs_construct_tcon(struct cifs_sb_info *cifs_sb, uid_t fsuid)
3253 {
3254         struct cifsTconInfo *master_tcon = cifs_sb_master_tcon(cifs_sb);
3255         struct cifsSesInfo *ses;
3256         struct cifsTconInfo *tcon = NULL;
3257         struct smb_vol *vol_info;
3258         char username[MAX_USERNAME_SIZE + 1];
3259
3260         vol_info = kzalloc(sizeof(*vol_info), GFP_KERNEL);
3261         if (vol_info == NULL) {
3262                 tcon = ERR_PTR(-ENOMEM);
3263                 goto out;
3264         }
3265
3266         snprintf(username, MAX_USERNAME_SIZE, "krb50x%x", fsuid);
3267         vol_info->username = username;
3268         vol_info->local_nls = cifs_sb->local_nls;
3269         vol_info->linux_uid = fsuid;
3270         vol_info->cred_uid = fsuid;
3271         vol_info->UNC = master_tcon->treeName;
3272         vol_info->retry = master_tcon->retry;
3273         vol_info->nocase = master_tcon->nocase;
3274         vol_info->local_lease = master_tcon->local_lease;
3275         vol_info->no_linux_ext = !master_tcon->unix_ext;
3276
3277         /* FIXME: allow for other secFlg settings */
3278         vol_info->secFlg = CIFSSEC_MUST_KRB5;
3279
3280         /* get a reference for the same TCP session */
3281         spin_lock(&cifs_tcp_ses_lock);
3282         ++master_tcon->ses->server->srv_count;
3283         spin_unlock(&cifs_tcp_ses_lock);
3284
3285         ses = cifs_get_smb_ses(master_tcon->ses->server, vol_info);
3286         if (IS_ERR(ses)) {
3287                 tcon = (struct cifsTconInfo *)ses;
3288                 cifs_put_tcp_session(master_tcon->ses->server);
3289                 goto out;
3290         }
3291
3292         tcon = cifs_get_tcon(ses, vol_info);
3293         if (IS_ERR(tcon)) {
3294                 cifs_put_smb_ses(ses);
3295                 goto out;
3296         }
3297
3298         if (ses->capabilities & CAP_UNIX)
3299                 reset_cifs_unix_caps(0, tcon, NULL, vol_info);
3300 out:
3301         kfree(vol_info);
3302
3303         return tcon;
3304 }
3305
3306 static inline struct tcon_link *
3307 cifs_sb_master_tlink(struct cifs_sb_info *cifs_sb)
3308 {
3309         return cifs_sb->master_tlink;
3310 }
3311
3312 struct cifsTconInfo *
3313 cifs_sb_master_tcon(struct cifs_sb_info *cifs_sb)
3314 {
3315         return tlink_tcon(cifs_sb_master_tlink(cifs_sb));
3316 }
3317
3318 static int
3319 cifs_sb_tcon_pending_wait(void *unused)
3320 {
3321         schedule();
3322         return signal_pending(current) ? -ERESTARTSYS : 0;
3323 }
3324
3325 /* find and return a tlink with given uid */
3326 static struct tcon_link *
3327 tlink_rb_search(struct rb_root *root, uid_t uid)
3328 {
3329         struct rb_node *node = root->rb_node;
3330         struct tcon_link *tlink;
3331
3332         while (node) {
3333                 tlink = rb_entry(node, struct tcon_link, tl_rbnode);
3334
3335                 if (tlink->tl_uid > uid)
3336                         node = node->rb_left;
3337                 else if (tlink->tl_uid < uid)
3338                         node = node->rb_right;
3339                 else
3340                         return tlink;
3341         }
3342         return NULL;
3343 }
3344
3345 /* insert a tcon_link into the tree */
3346 static void
3347 tlink_rb_insert(struct rb_root *root, struct tcon_link *new_tlink)
3348 {
3349         struct rb_node **new = &(root->rb_node), *parent = NULL;
3350         struct tcon_link *tlink;
3351
3352         while (*new) {
3353                 tlink = rb_entry(*new, struct tcon_link, tl_rbnode);
3354                 parent = *new;
3355
3356                 if (tlink->tl_uid > new_tlink->tl_uid)
3357                         new = &((*new)->rb_left);
3358                 else
3359                         new = &((*new)->rb_right);
3360         }
3361
3362         rb_link_node(&new_tlink->tl_rbnode, parent, new);
3363         rb_insert_color(&new_tlink->tl_rbnode, root);
3364 }
3365
3366 /*
3367  * Find or construct an appropriate tcon given a cifs_sb and the fsuid of the
3368  * current task.
3369  *
3370  * If the superblock doesn't refer to a multiuser mount, then just return
3371  * the master tcon for the mount.
3372  *
3373  * First, search the rbtree for an existing tcon for this fsuid. If one
3374  * exists, then check to see if it's pending construction. If it is then wait
3375  * for construction to complete. Once it's no longer pending, check to see if
3376  * it failed and either return an error or retry construction, depending on
3377  * the timeout.
3378  *
3379  * If one doesn't exist then insert a new tcon_link struct into the tree and
3380  * try to construct a new one.
3381  */
3382 struct tcon_link *
3383 cifs_sb_tlink(struct cifs_sb_info *cifs_sb)
3384 {
3385         int ret;
3386         uid_t fsuid = current_fsuid();
3387         struct tcon_link *tlink, *newtlink;
3388
3389         if (!(cifs_sb->mnt_cifs_flags & CIFS_MOUNT_MULTIUSER))
3390                 return cifs_get_tlink(cifs_sb_master_tlink(cifs_sb));
3391
3392         spin_lock(&cifs_sb->tlink_tree_lock);
3393         tlink = tlink_rb_search(&cifs_sb->tlink_tree, fsuid);
3394         if (tlink)
3395                 cifs_get_tlink(tlink);
3396         spin_unlock(&cifs_sb->tlink_tree_lock);
3397
3398         if (tlink == NULL) {
3399                 newtlink = kzalloc(sizeof(*tlink), GFP_KERNEL);
3400                 if (newtlink == NULL)
3401                         return ERR_PTR(-ENOMEM);
3402                 newtlink->tl_uid = fsuid;
3403                 newtlink->tl_tcon = ERR_PTR(-EACCES);
3404                 set_bit(TCON_LINK_PENDING, &newtlink->tl_flags);
3405                 set_bit(TCON_LINK_IN_TREE, &newtlink->tl_flags);
3406                 cifs_get_tlink(newtlink);
3407
3408                 spin_lock(&cifs_sb->tlink_tree_lock);
3409                 /* was one inserted after previous search? */
3410                 tlink = tlink_rb_search(&cifs_sb->tlink_tree, fsuid);
3411                 if (tlink) {
3412                         cifs_get_tlink(tlink);
3413                         spin_unlock(&cifs_sb->tlink_tree_lock);
3414                         kfree(newtlink);
3415                         goto wait_for_construction;
3416                 }
3417                 tlink = newtlink;
3418                 tlink_rb_insert(&cifs_sb->tlink_tree, tlink);
3419                 spin_unlock(&cifs_sb->tlink_tree_lock);
3420         } else {
3421 wait_for_construction:
3422                 ret = wait_on_bit(&tlink->tl_flags, TCON_LINK_PENDING,
3423                                   cifs_sb_tcon_pending_wait,
3424                                   TASK_INTERRUPTIBLE);
3425                 if (ret) {
3426                         cifs_put_tlink(tlink);
3427                         return ERR_PTR(ret);
3428                 }
3429
3430                 /* if it's good, return it */
3431                 if (!IS_ERR(tlink->tl_tcon))
3432                         return tlink;
3433
3434                 /* return error if we tried this already recently */
3435                 if (time_before(jiffies, tlink->tl_time + TLINK_ERROR_EXPIRE)) {
3436                         cifs_put_tlink(tlink);
3437                         return ERR_PTR(-EACCES);
3438                 }
3439
3440                 if (test_and_set_bit(TCON_LINK_PENDING, &tlink->tl_flags))
3441                         goto wait_for_construction;
3442         }
3443
3444         tlink->tl_tcon = cifs_construct_tcon(cifs_sb, fsuid);
3445         clear_bit(TCON_LINK_PENDING, &tlink->tl_flags);
3446         wake_up_bit(&tlink->tl_flags, TCON_LINK_PENDING);
3447
3448         if (IS_ERR(tlink->tl_tcon)) {
3449                 cifs_put_tlink(tlink);
3450                 return ERR_PTR(-EACCES);
3451         }
3452
3453         return tlink;
3454 }
3455
3456 /*
3457  * periodic workqueue job that scans tcon_tree for a superblock and closes
3458  * out tcons.
3459  */
3460 static void
3461 cifs_prune_tlinks(struct work_struct *work)
3462 {
3463         struct cifs_sb_info *cifs_sb = container_of(work, struct cifs_sb_info,
3464                                                     prune_tlinks.work);
3465         struct rb_root *root = &cifs_sb->tlink_tree;
3466         struct rb_node *node = rb_first(root);
3467         struct rb_node *tmp;
3468         struct tcon_link *tlink;
3469
3470         /*
3471          * Because we drop the spinlock in the loop in order to put the tlink
3472          * it's not guarded against removal of links from the tree. The only
3473          * places that remove entries from the tree are this function and
3474          * umounts. Because this function is non-reentrant and is canceled
3475          * before umount can proceed, this is safe.
3476          */
3477         spin_lock(&cifs_sb->tlink_tree_lock);
3478         node = rb_first(root);
3479         while (node != NULL) {
3480                 tmp = node;
3481                 node = rb_next(tmp);
3482                 tlink = rb_entry(tmp, struct tcon_link, tl_rbnode);
3483
3484                 if (test_bit(TCON_LINK_MASTER, &tlink->tl_flags) ||
3485                     atomic_read(&tlink->tl_count) != 0 ||
3486                     time_after(tlink->tl_time + TLINK_IDLE_EXPIRE, jiffies))
3487                         continue;
3488
3489                 cifs_get_tlink(tlink);
3490                 clear_bit(TCON_LINK_IN_TREE, &tlink->tl_flags);
3491                 rb_erase(tmp, root);
3492
3493                 spin_unlock(&cifs_sb->tlink_tree_lock);
3494                 cifs_put_tlink(tlink);
3495                 spin_lock(&cifs_sb->tlink_tree_lock);
3496         }
3497         spin_unlock(&cifs_sb->tlink_tree_lock);
3498
3499         queue_delayed_work(system_nrt_wq, &cifs_sb->prune_tlinks,
3500                                 TLINK_IDLE_EXPIRE);
3501 }