projects/linux·blob master · refs

936 lines · 23.4 KiB

1// SPDX-License-Identifier: GPL-2.0-or-later
2/*
3 * Copyright (C) 2016 Namjae Jeon <[email protected]>
4 * Copyright (C) 2018 Samsung Electronics Co., Ltd.
5 */
6
7#include <linux/mutex.h>
8#include <linux/freezer.h>
9#include <linux/module.h>
10
11#include "server.h"
12#include "smb_common.h"
13#include "mgmt/ksmbd_ida.h"
14#include "mgmt/user_session.h"
15#include "connection.h"
16#include "vfs_cache.h"
17#include "compress.h"
18#include "transport_tcp.h"
19#include "transport_rdma.h"
20#include "misc.h"
21
22static DEFINE_MUTEX(init_lock);
23
24static struct ksmbd_conn_ops default_conn_ops;
25static struct delayed_work session_expiration_work;
26static bool stopping_session_expiration_work;
27
28DEFINE_HASHTABLE(conn_list, CONN_HASH_BITS);
29DECLARE_RWSEM(conn_list_lock);
30
31#ifdef CONFIG_PROC_FS
32static struct proc_dir_entry *proc_clients;
33
34static const char *ksmbd_conn_state_string(struct ksmbd_conn *conn)
35{
36 switch (READ_ONCE(conn->status)) {
37 case KSMBD_SESS_NEW:
38 return "new";
39 case KSMBD_SESS_GOOD:
40 return "good";
41 case KSMBD_SESS_EXITING:
42 return "exiting";
43 case KSMBD_SESS_NEED_RECONNECT:
44 return "reconnect";
45 case KSMBD_SESS_NEED_NEGOTIATE:
46 return "negotiate";
47 case KSMBD_SESS_NEED_SETUP:
48 return "setup";
49 case KSMBD_SESS_RELEASING:
50 return "releasing";
51 default:
52 return "unknown";
53 }
54}
55
56static const char *ksmbd_conn_transport_string(struct ksmbd_conn *conn)
57{
58 if (conn->transport->ops->rdma_read || conn->transport->ops->rdma_write)
59 return "smbdirect";
60 return "tcp";
61}
62
63static void proc_show_conn_feature(struct seq_file *m, bool *separator,
64 bool enabled, const char *name)
65{
66 if (!enabled)
67 return;
68 seq_printf(m, "%s%s", *separator ? "," : "", name);
69 *separator = true;
70}
71
72static void proc_show_conn_features(struct seq_file *m,
73 struct ksmbd_conn *conn)
74{
75 bool separator = false;
76
77 proc_show_conn_feature(m, &separator,
78 conn->sign || conn->signing_negotiated, "sign");
79 proc_show_conn_feature(m, &separator, conn->cipher_type, "encrypt");
80 proc_show_conn_feature(m, &separator,
81 conn->compress_algorithm != SMB3_COMPRESS_NONE,
82 "compress");
83 proc_show_conn_feature(m, &separator, conn->rdma_transform_ids,
84 "rdma-transform");
85 proc_show_conn_feature(m, &separator, conn->posix_ext_supported, "posix");
86 if (!separator)
87 seq_puts(m, "none");
88}
89
90static int proc_show_clients(struct seq_file *m, void *v)
91{
92 struct ksmbd_conn *conn;
93 struct timespec64 now, t;
94 int i;
95
96 down_read(&conn_list_lock);
97 hash_for_each(conn_list, i, conn, hlist) {
98 unsigned int outstanding_credits, total_credits;
99 unsigned long id;
100 void *entry;
101 unsigned int sessions = 0;
102
103 jiffies_to_timespec64(jiffies - conn->last_active, &t);
104 ktime_get_real_ts64(&now);
105 t = timespec64_sub(now, t);
106
107 spin_lock(&conn->credits_lock);
108 outstanding_credits = conn->outstanding_credits;
109 total_credits = conn->total_credits;
110 spin_unlock(&conn->credits_lock);
111
112 rcu_read_lock();
113 xa_for_each(&conn->sessions, id, entry)
114 sessions++;
115 rcu_read_unlock();
116#if IS_ENABLED(CONFIG_IPV6)
117 if (!conn->inet_addr)
118 seq_printf(m, "client:\t%pI6c\n", &conn->inet6_addr);
119 else
120#endif
121 seq_printf(m, "client:\t%pI4\n", &conn->inet_addr);
122 seq_printf(m, "transport:\t%s\n", ksmbd_conn_transport_string(conn));
123 seq_printf(m, "state:\t%s\n", ksmbd_conn_state_string(conn));
124 seq_printf(m, "dialect:\t0x%04x\n", conn->dialect);
125 seq_printf(m, "credits:\t%u/%u\n", outstanding_credits,
126 total_credits);
127 seq_printf(m, "sessions:\t%u\n", sessions);
128 seq_printf(m, "open_files:\t%d\n",
129 atomic_read(&conn->stats.open_files_count));
130 seq_printf(m, "requests:\t%lld\n",
131 atomic64_read(&conn->stats.request_served));
132 seq_puts(m, "features:\t");
133 proc_show_conn_features(m, conn);
134 seq_printf(m, "\nlast_active:\t%ptT\n\n", &t);
135 }
136 up_read(&conn_list_lock);
137 return 0;
138}
139
140static int create_proc_clients(void)
141{
142 proc_clients = ksmbd_proc_create("clients",
143 proc_show_clients, NULL);
144 if (!proc_clients)
145 return -ENOMEM;
146 return 0;
147}
148
149static void delete_proc_clients(void)
150{
151 if (proc_clients) {
152 proc_remove(proc_clients);
153 proc_clients = NULL;
154 }
155}
156#else
157static int create_proc_clients(void) { return 0; }
158static void delete_proc_clients(void) {}
159#endif
160
161static struct workqueue_struct *ksmbd_conn_wq;
162
163static void ksmbd_session_expiration_worker(struct work_struct *work);
164
165int ksmbd_conn_wq_init(void)
166{
167 ksmbd_conn_wq = alloc_workqueue("ksmbd-conn-release",
168 WQ_UNBOUND | WQ_MEM_RECLAIM, 0);
169 if (!ksmbd_conn_wq)
170 return -ENOMEM;
171
172 WRITE_ONCE(stopping_session_expiration_work, false);
173 INIT_DELAYED_WORK(&session_expiration_work,
174 ksmbd_session_expiration_worker);
175 queue_delayed_work(ksmbd_conn_wq, &session_expiration_work,
176 KSMBD_SESSION_EXPIRATION_INTERVAL);
177 return 0;
178}
179
180void ksmbd_conn_wq_destroy(void)
181{
182 if (ksmbd_conn_wq) {
183 WRITE_ONCE(stopping_session_expiration_work, true);
184 cancel_delayed_work_sync(&session_expiration_work);
185 destroy_workqueue(ksmbd_conn_wq);
186 ksmbd_conn_wq = NULL;
187 }
188}
189
190/*
191 * __ksmbd_conn_release_work() - perform the final, once-per-struct cleanup
192 * of a ksmbd_conn whose refcount has just dropped to zero.
193 *
194 * This is the common release path used by ksmbd_conn_put() for the embedded
195 * state that outlives the connection thread: async_ida and the attached
196 * transport (which owns the socket and iov for TCP). Called from a workqueue
197 * so that sleep-allowed teardown (sock_release -> tcp_close ->
198 * lock_sock_nested) never runs from an RCU softirq callback (free_opinfo_rcu)
199 * or any other non-sleeping putter context.
200 */
201static void __ksmbd_conn_release_work(struct work_struct *work)
202{
203 struct ksmbd_conn *conn =
204 container_of(work, struct ksmbd_conn, release_work);
205
206 ida_destroy(&conn->async_ida);
207 conn->transport->ops->free_transport(conn->transport);
208 kfree_sensitive(conn);
209}
210
211/**
212 * ksmbd_conn_get() - take a reference on @conn and return it.
213 *
214 * @conn: connection instance to get a reference to
215 *
216 * Returns @conn unchanged so callers can write
217 * "fp->conn = ksmbd_conn_get(work->conn);" in one expression. Returns NULL
218 * if @conn is NULL.
219 */
220struct ksmbd_conn *ksmbd_conn_get(struct ksmbd_conn *conn)
221{
222 if (!conn)
223 return NULL;
224
225 atomic_inc(&conn->refcnt);
226 return conn;
227}
228
229/**
230 * ksmbd_conn_put() - drop a reference and, if it was the last, queue the
231 * release onto ksmbd_conn_wq so it runs from process context.
232 *
233 * @conn: connection instance to put a reference to
234 *
235 * Callable from any context including RCU softirq callbacks and non-sleeping
236 * locks; the actual release is deferred to the workqueue. ksmbd_conn_wq is
237 * created in ksmbd_server_init() before any conn can be allocated and is
238 * destroyed in ksmbd_server_exit() after rcu_barrier(), so it is always
239 * non-NULL while a conn reference is held.
240 */
241void ksmbd_conn_put(struct ksmbd_conn *conn)
242{
243 if (!conn)
244 return;
245
246 if (atomic_dec_and_test(&conn->refcnt))
247 queue_work(ksmbd_conn_wq, &conn->release_work);
248}
249
250/**
251 * ksmbd_conn_free() - free resources of the connection instance
252 *
253 * @conn: connection instance to be cleaned up
254 *
255 * During the thread termination, the corresponding conn instance
256 * resources(sock/memory) are released and finally the conn object is freed.
257 */
258void ksmbd_conn_free(struct ksmbd_conn *conn)
259{
260 down_write(&conn_list_lock);
261 hash_del(&conn->hlist);
262 up_write(&conn_list_lock);
263
264 /*
265 * request_buf / preauth_info / mechToken are only ever accessed by the
266 * connection handler thread that owns @conn. ksmbd_conn_free() is
267 * called from the transport free_transport() path when that thread is
268 * exiting, so it is safe to release them unconditionally even when
269 * ksmbd_conn_put() below is not the final putter (oplock / ksmbd_file
270 * holders only retain the conn pointer, not these per-thread buffers).
271 */
272 xa_destroy(&conn->sessions);
273 kvfree(conn->request_buf);
274 kfree_sensitive(conn->preauth_info);
275 kfree(conn->mechToken);
276 ksmbd_preauth_session_destroy(conn);
277 ksmbd_conn_put(conn);
278}
279
280/**
281 * ksmbd_conn_alloc() - initialize a new connection instance
282 *
283 * Return: ksmbd_conn struct on success, otherwise NULL
284 */
285struct ksmbd_conn *ksmbd_conn_alloc(void)
286{
287 struct ksmbd_conn *conn;
288
289 conn = kzalloc_obj(struct ksmbd_conn, KSMBD_DEFAULT_GFP);
290 if (!conn)
291 return NULL;
292
293 conn->need_neg = true;
294 conn->creation_time = jiffies;
295 ksmbd_conn_set_new(conn);
296 conn->local_nls = load_nls("utf8");
297 if (!conn->local_nls)
298 conn->local_nls = load_nls_default();
299 if (IS_ENABLED(CONFIG_UNICODE))
300 conn->um = utf8_load(UNICODE_AGE(12, 1, 0));
301 else
302 conn->um = ERR_PTR(-EOPNOTSUPP);
303 if (IS_ERR(conn->um))
304 conn->um = NULL;
305 INIT_WORK(&conn->release_work, __ksmbd_conn_release_work);
306 atomic_set(&conn->req_running, 0);
307 atomic_set(&conn->r_count, 0);
308 atomic_set(&conn->refcnt, 1);
309 conn->total_credits = 1;
310 conn->outstanding_credits = 0;
311
312 /*
313 * The command sequence window starts as the set { 0 } when the
314 * connection is established.
315 */
316 conn->seq_low = 0;
317 conn->seq_high = 1;
318 __set_bit(0, conn->seq_bitmap);
319
320 init_waitqueue_head(&conn->req_running_q);
321 init_waitqueue_head(&conn->r_count_q);
322 INIT_LIST_HEAD(&conn->requests);
323 INIT_LIST_HEAD(&conn->async_requests);
324 INIT_LIST_HEAD(&conn->preauth_sess_table);
325 spin_lock_init(&conn->request_lock);
326 spin_lock_init(&conn->credits_lock);
327 ida_init(&conn->async_ida);
328 xa_init(&conn->sessions);
329
330 spin_lock_init(&conn->llist_lock);
331 INIT_LIST_HEAD(&conn->lock_list);
332
333 init_rwsem(&conn->session_lock);
334
335 return conn;
336}
337
338bool ksmbd_conn_lookup_dialect(struct ksmbd_conn *c)
339{
340 struct ksmbd_conn *t;
341 int bkt;
342 bool ret = false;
343
344 down_read(&conn_list_lock);
345 hash_for_each(conn_list, bkt, t, hlist) {
346 if (memcmp(t->ClientGUID, c->ClientGUID, SMB2_CLIENT_GUID_SIZE))
347 continue;
348
349 ret = true;
350 break;
351 }
352 up_read(&conn_list_lock);
353 return ret;
354}
355
356void ksmbd_conn_enqueue_request(struct ksmbd_work *work)
357{
358 struct ksmbd_conn *conn = work->conn;
359 struct list_head *requests_queue = NULL;
360
361 if (conn->ops->get_cmd_val(work) != SMB2_CANCEL_HE)
362 requests_queue = &conn->requests;
363
364 atomic_inc(&conn->req_running);
365 if (requests_queue) {
366 spin_lock(&conn->request_lock);
367 list_add_tail(&work->request_entry, requests_queue);
368 spin_unlock(&conn->request_lock);
369 }
370}
371
372void ksmbd_conn_try_dequeue_request(struct ksmbd_work *work)
373{
374 struct ksmbd_conn *conn = work->conn;
375
376 atomic_dec(&conn->req_running);
377 if (waitqueue_active(&conn->req_running_q))
378 wake_up(&conn->req_running_q);
379
380 if (list_empty(&work->request_entry) &&
381 list_empty(&work->async_request_entry))
382 return;
383
384 spin_lock(&conn->request_lock);
385 list_del_init(&work->request_entry);
386 spin_unlock(&conn->request_lock);
387 if (work->asynchronous)
388 release_async_work(work);
389
390 wake_up_all(&conn->req_running_q);
391}
392
393static void ksmbd_conn_cancel_async_requests(struct ksmbd_conn *conn)
394{
395 struct ksmbd_work *work, *tmp;
396
397 ksmbd_debug(CONN, "Cancel pending async requests on releasing connection\n");
398 spin_lock(&conn->request_lock);
399 list_for_each_entry_safe(work, tmp, &conn->async_requests,
400 async_request_entry) {
401 if (cmpxchg(&work->state, KSMBD_WORK_ACTIVE,
402 KSMBD_WORK_CANCELLED) != KSMBD_WORK_ACTIVE)
403 continue;
404
405 ksmbd_debug(CONN, "Cancel async request id %d\n",
406 work->async_id);
407 if (work->cancel_fn)
408 work->cancel_fn(work->cancel_argv);
409 }
410 spin_unlock(&conn->request_lock);
411}
412
413void ksmbd_conn_lock(struct ksmbd_conn *conn)
414{
415 mutex_lock(&conn->srv_mutex);
416}
417
418void ksmbd_conn_unlock(struct ksmbd_conn *conn)
419{
420 mutex_unlock(&conn->srv_mutex);
421}
422
423static bool ksmbd_session_is_bound_to_conn(struct ksmbd_session *sess,
424 struct ksmbd_conn *conn)
425{
426 bool found;
427
428 rcu_read_lock();
429 found = xa_load(&conn->sessions, sess->id) == sess;
430 rcu_read_unlock();
431 if (found)
432 return true;
433
434 down_read(&sess->chann_lock);
435 found = xa_load(&sess->ksmbd_chann_list, (long)conn);
436 up_read(&sess->chann_lock);
437 return found;
438}
439
440void ksmbd_all_conn_set_status(struct ksmbd_session *sess, u32 status)
441{
442 struct ksmbd_conn *conn;
443 int bkt;
444
445 down_read(&conn_list_lock);
446 hash_for_each(conn_list, bkt, conn, hlist) {
447 if (ksmbd_session_is_bound_to_conn(sess, conn)) {
448 spin_lock(&conn->request_lock);
449 if (!ksmbd_conn_exiting(conn) &&
450 !ksmbd_conn_releasing(conn))
451 WRITE_ONCE(conn->status, status);
452 spin_unlock(&conn->request_lock);
453 }
454 }
455 up_read(&conn_list_lock);
456}
457
458void ksmbd_conn_abort(struct ksmbd_conn *conn)
459{
460 bool shutdown = false;
461
462 spin_lock(&conn->request_lock);
463 if (!ksmbd_conn_exiting(conn) && !ksmbd_conn_releasing(conn)) {
464 ksmbd_conn_set_exiting(conn);
465 shutdown = true;
466 }
467 spin_unlock(&conn->request_lock);
468 wake_up_all(&conn->req_running_q);
469
470 if (shutdown && conn->transport->ops->shutdown)
471 conn->transport->ops->shutdown(conn->transport);
472}
473
474void ksmbd_conn_wait_idle(struct ksmbd_conn *conn)
475{
476 wait_event(conn->req_running_q, atomic_read(&conn->req_running) < 2);
477}
478
479int ksmbd_conn_wait_idle_sess(struct ksmbd_conn *curr_conn,
480 struct ksmbd_session *sess)
481{
482 struct ksmbd_conn *conn;
483 int rc, retry_count = 0, max_timeout = 120;
484 int rcount, bkt;
485
486retry_idle:
487 if (retry_count >= max_timeout)
488 return -EIO;
489
490 /* A blocked byte-range lock cannot drain until teardown wakes it. */
491 ksmbd_wake_session_blocked_works(sess);
492
493 down_read(&conn_list_lock);
494 hash_for_each(conn_list, bkt, conn, hlist) {
495 if (ksmbd_session_is_bound_to_conn(sess, conn)) {
496 rcount = (conn == curr_conn) ? 2 : 1;
497 if (atomic_read(&conn->req_running) >= rcount) {
498 rc = wait_event_timeout(conn->req_running_q,
499 atomic_read(&conn->req_running) < rcount,
500 HZ);
501 if (!rc) {
502 up_read(&conn_list_lock);
503 retry_count++;
504 goto retry_idle;
505 }
506 }
507 }
508 }
509 up_read(&conn_list_lock);
510
511 return 0;
512}
513
514static int __ksmbd_conn_write(struct ksmbd_work *work,
515 struct ksmbd_transport_write *tx)
516{
517 struct ksmbd_conn *conn = work->conn;
518 int sent;
519
520 if (!work->response_buf) {
521 pr_err("NULL response header\n");
522 return -EINVAL;
523 }
524
525 if (work->send_no_response)
526 return 0;
527
528 if (!work->iov_idx)
529 return -EINVAL;
530
531 tx->iov = work->iov;
532 tx->iov_cnt = work->iov_cnt;
533 tx->size = get_rfc1002_len(work->iov[0].iov_base) + 4;
534 tx->need_invalidate_rkey = work->need_invalidate_rkey;
535 tx->remote_key = work->remote_key;
536
537 ksmbd_conn_lock(conn);
538 sent = conn->transport->ops->writev(conn->transport, tx);
539 ksmbd_conn_unlock(conn);
540
541 if (sent < 0) {
542 pr_err("Failed to send message: %d\n", sent);
543 return sent;
544 }
545
546 return 0;
547}
548
549int ksmbd_conn_write(struct ksmbd_work *work)
550{
551 struct ksmbd_transport_write tx = {};
552
553 return __ksmbd_conn_write(work, &tx);
554}
555
556int ksmbd_conn_write_eor(struct ksmbd_work *work)
557{
558 struct ksmbd_transport_write tx = {
559 .msg_flags = MSG_EOR,
560 };
561
562 return __ksmbd_conn_write(work, &tx);
563}
564
565int ksmbd_conn_rdma_read(struct ksmbd_conn *conn,
566 void *buf, unsigned int buflen,
567 struct smbdirect_buffer_descriptor_v1 *desc,
568 unsigned int desc_len)
569{
570 int ret = -EINVAL;
571
572 if (conn->transport->ops->rdma_read)
573 ret = conn->transport->ops->rdma_read(conn->transport,
574 buf, buflen,
575 desc, desc_len);
576 return ret;
577}
578
579int ksmbd_conn_rdma_write(struct ksmbd_conn *conn,
580 void *buf, unsigned int buflen,
581 struct smbdirect_buffer_descriptor_v1 *desc,
582 unsigned int desc_len)
583{
584 int ret = -EINVAL;
585
586 if (conn->transport->ops->rdma_write)
587 ret = conn->transport->ops->rdma_write(conn->transport,
588 buf, buflen,
589 desc, desc_len);
590 return ret;
591}
592
593bool ksmbd_conn_alive(struct ksmbd_conn *conn)
594{
595 if (!ksmbd_server_running())
596 return false;
597
598 if (ksmbd_conn_exiting(conn))
599 return false;
600
601 if (kthread_should_stop())
602 return false;
603
604 /*
605 * Stale connections that have not completed NEGOTIATE and SESSION_SETUP
606 * must be disconnected. Do not race a request that is currently
607 * completing authentication.
608 */
609 if (!atomic_read(&conn->req_running) &&
610 time_after(jiffies, conn->creation_time +
611 KSMBD_UNAUTHENTICATED_CONN_TIMEOUT) &&
612 (READ_ONCE(conn->need_neg) ||
613 !ksmbd_conn_has_valid_or_expired_session(conn))) {
614 ksmbd_debug(CONN, "Connection setup timed out\n");
615 return false;
616 }
617
618 if (atomic_read(&conn->stats.open_files_count) > 0)
619 return true;
620
621 /*
622 * Stop current session if the time that get last request from client
623 * is bigger than deadtime user configured and opening file count is
624 * zero.
625 */
626 if (server_conf.deadtime > 0 &&
627 time_after(jiffies, conn->last_active + server_conf.deadtime)) {
628 ksmbd_debug(CONN, "No response from client in %lu minutes\n",
629 server_conf.deadtime / SMB_ECHO_INTERVAL);
630 return false;
631 }
632 return true;
633}
634
635static void ksmbd_session_expiration_worker(struct work_struct *work)
636{
637 struct ksmbd_conn *conn, *target;
638 int bkt;
639
640 if (!ksmbd_server_running())
641 goto reschedule;
642
643 ksmbd_expire_sessions();
644
645 /*
646 * An old connection without a Valid or Expired session must be
647 * disconnected. Process one connection at a time without holding
648 * conn_list_lock across transport shutdown.
649 */
650again:
651 target = NULL;
652 down_read(&conn_list_lock);
653 hash_for_each(conn_list, bkt, conn, hlist) {
654 if (ksmbd_conn_exiting(conn) || ksmbd_conn_releasing(conn) ||
655 atomic_read(&conn->req_running) ||
656 time_before_eq(jiffies, conn->creation_time +
657 KSMBD_UNAUTHENTICATED_CONN_TIMEOUT) ||
658 (!READ_ONCE(conn->need_neg) &&
659 ksmbd_conn_has_valid_or_expired_session(conn)))
660 continue;
661
662 target = ksmbd_conn_get(conn);
663 break;
664 }
665 up_read(&conn_list_lock);
666
667 if (target) {
668 ksmbd_debug(CONN, "Connection setup timed out\n");
669 ksmbd_conn_abort(target);
670 ksmbd_conn_put(target);
671 goto again;
672 }
673
674reschedule:
675 if (!READ_ONCE(stopping_session_expiration_work))
676 queue_delayed_work(ksmbd_conn_wq, &session_expiration_work,
677 KSMBD_SESSION_EXPIRATION_INTERVAL);
678}
679
680/* "+2" for BCC field (ByteCount, 2 bytes) */
681#define SMB1_MIN_SUPPORTED_PDU_SIZE (sizeof(struct smb_hdr) + 2)
682#define SMB2_MIN_SUPPORTED_PDU_SIZE (sizeof(struct smb2_pdu))
683#define SMB2_TRANSFORM_MIN_SUPPORTED_PDU_SIZE \
684 (sizeof(struct smb2_transform_hdr) + sizeof(struct smb2_hdr))
685
686/**
687 * ksmbd_conn_handler_loop() - session thread to listen on new smb requests
688 * @p: connection instance
689 *
690 * One thread each per connection
691 *
692 * Return: 0 on success
693 */
694int ksmbd_conn_handler_loop(void *p)
695{
696 struct ksmbd_conn *conn = (struct ksmbd_conn *)p;
697 struct ksmbd_transport *t = conn->transport;
698 unsigned int pdu_size, max_allowed_pdu_size, max_req;
699 __le32 proto;
700 char hdr_buf[4] = {0,};
701 int size;
702
703 mutex_init(&conn->srv_mutex);
704 __module_get(THIS_MODULE);
705
706 max_req = server_conf.max_inflight_req;
707 conn->last_active = jiffies;
708 set_freezable();
709 while (ksmbd_conn_alive(conn)) {
710 if (try_to_freeze())
711 continue;
712
713 kvfree(conn->request_buf);
714 conn->request_buf = NULL;
715
716recheck:
717 if (atomic_read(&conn->req_running) + 1 > max_req) {
718 wait_event_interruptible(conn->req_running_q,
719 atomic_read(&conn->req_running) < max_req);
720 goto recheck;
721 }
722
723 size = t->ops->read(t, hdr_buf, sizeof(hdr_buf), -1);
724 if (size != sizeof(hdr_buf))
725 break;
726
727 pdu_size = get_rfc1002_len(hdr_buf);
728 ksmbd_debug(CONN, "RFC1002 header %u bytes\n", pdu_size);
729
730 max_allowed_pdu_size = ksmbd_max_allowed_pdu_size(conn);
731
732 if (pdu_size > max_allowed_pdu_size) {
733 pr_err_ratelimited("PDU length(%u) exceeded maximum allowed pdu size(%u) on connection(%d)\n",
734 pdu_size, max_allowed_pdu_size,
735 READ_ONCE(conn->status));
736 break;
737 }
738
739 /*
740 * Check maximum pdu size(0x00FFFFFF).
741 */
742 if (pdu_size > MAX_STREAM_PROT_LEN)
743 break;
744
745 if (pdu_size < SMB1_MIN_SUPPORTED_PDU_SIZE)
746 break;
747
748 /* 4 for rfc1002 length field */
749 /* 1 for implied bcc[0] */
750 size = pdu_size + 4 + 1;
751 conn->request_buf = kvmalloc(size, KSMBD_DEFAULT_GFP);
752 if (!conn->request_buf)
753 break;
754
755 memcpy(conn->request_buf, hdr_buf, sizeof(hdr_buf));
756
757 /*
758 * We already read 4 bytes to find out PDU size, now
759 * read in PDU
760 */
761 size = t->ops->read(t, conn->request_buf + 4, pdu_size, 2);
762 if (size < 0) {
763 pr_err("sock_read failed: %d\n", size);
764 break;
765 }
766
767 if (size != pdu_size) {
768 pr_err("PDU error. Read: %d, Expected: %d\n",
769 size, pdu_size);
770 continue;
771 }
772
773 if (((struct smb2_hdr *)smb_get_msg(conn->request_buf))->ProtocolId ==
774 SMB2_COMPRESSION_TRANSFORM_ID) {
775 /*
776 * Convert the transform into a normal RFC1002-framed SMB2
777 * request before protocol validation and work allocation.
778 */
779 if (ksmbd_decompress_request(conn))
780 break;
781 pdu_size = get_rfc1002_len(conn->request_buf);
782 }
783
784 if (!ksmbd_smb_request(conn))
785 break;
786
787 proto = *(__le32 *)smb_get_msg(conn->request_buf);
788 if (proto == SMB2_PROTO_NUMBER &&
789 pdu_size < SMB2_MIN_SUPPORTED_PDU_SIZE)
790 break;
791
792 if (proto == SMB2_TRANSFORM_PROTO_NUM &&
793 pdu_size < SMB2_TRANSFORM_MIN_SUPPORTED_PDU_SIZE)
794 break;
795
796 if (!default_conn_ops.process_fn) {
797 pr_err("No connection request callback\n");
798 break;
799 }
800
801 if (default_conn_ops.process_fn(conn)) {
802 pr_err("Cannot handle request\n");
803 break;
804 }
805 }
806
807 ksmbd_conn_set_releasing(conn);
808 ksmbd_conn_cancel_async_requests(conn);
809 /* Wait till all reference dropped to the Server object*/
810 ksmbd_debug(CONN, "Wait for all pending requests(%d)\n", atomic_read(&conn->r_count));
811 wait_event(conn->r_count_q, atomic_read(&conn->r_count) == 0);
812
813 if (IS_ENABLED(CONFIG_UNICODE))
814 utf8_unload(conn->um);
815 unload_nls(conn->local_nls);
816 if (default_conn_ops.terminate_fn)
817 default_conn_ops.terminate_fn(conn);
818 t->ops->disconnect(t);
819 module_put(THIS_MODULE);
820 return 0;
821}
822
823void ksmbd_conn_init_server_callbacks(struct ksmbd_conn_ops *ops)
824{
825 default_conn_ops.process_fn = ops->process_fn;
826 default_conn_ops.terminate_fn = ops->terminate_fn;
827}
828
829void ksmbd_conn_r_count_inc(struct ksmbd_conn *conn)
830{
831 atomic_inc(&conn->r_count);
832}
833
834void ksmbd_conn_r_count_dec(struct ksmbd_conn *conn)
835{
836 /*
837 * Checking waitqueue to dropping pending requests on
838 * disconnection. waitqueue_active is safe because it
839 * uses atomic operation for condition.
840 */
841 atomic_inc(&conn->refcnt);
842 if (!atomic_dec_return(&conn->r_count) && waitqueue_active(&conn->r_count_q))
843 wake_up(&conn->r_count_q);
844
845 ksmbd_conn_put(conn);
846}
847
848int ksmbd_conn_transport_init(void)
849{
850 int ret;
851
852 mutex_lock(&init_lock);
853 ret = ksmbd_tcp_init();
854 if (ret) {
855 pr_err("Failed to init TCP subsystem: %d\n", ret);
856 goto out;
857 }
858
859 ret = ksmbd_rdma_init();
860 if (ret) {
861 pr_err("Failed to init RDMA subsystem: %d\n", ret);
862 goto out;
863 }
864out:
865 mutex_unlock(&init_lock);
866 if (create_proc_clients())
867 pr_warn("Unable to create clients procfs entry\n");
868 return ret;
869}
870
871static void stop_sessions(void)
872{
873 struct ksmbd_conn *conn, *target;
874 struct ksmbd_transport *t;
875 bool any;
876 int bkt;
877
878 /*
879 * Serialised via init_lock; no concurrent stop_sessions() can
880 * touch conn->stop_called, so writing it under the read lock is
881 * safe.
882 */
883again:
884 target = NULL;
885 any = false;
886 down_read(&conn_list_lock);
887 hash_for_each(conn_list, bkt, conn, hlist) {
888 any = true;
889 if (conn->stop_called)
890 continue;
891 atomic_inc(&conn->refcnt);
892 conn->stop_called = true;
893 /*
894 * Mark the connection EXITING while still holding the
895 * read lock so the selection and the status transition
896 * happen together. Do not regress a connection that has
897 * already advanced to RELEASING on its own (e.g. the
898 * handler exited its receive loop for an unrelated
899 * reason).
900 */
901 spin_lock(&conn->request_lock);
902 if (!ksmbd_conn_releasing(conn))
903 ksmbd_conn_set_exiting(conn);
904 spin_unlock(&conn->request_lock);
905 target = conn;
906 break;
907 }
908 up_read(&conn_list_lock);
909
910 if (target) {
911 t = target->transport;
912 if (t->ops->shutdown)
913 t->ops->shutdown(t);
914 if (atomic_dec_and_test(&target->refcnt)) {
915 ida_destroy(&target->async_ida);
916 t->ops->free_transport(t);
917 kfree_sensitive(target);
918 }
919 goto again;
920 }
921
922 if (any) {
923 msleep(100);
924 goto again;
925 }
926}
927
928void ksmbd_conn_transport_destroy(void)
929{
930 delete_proc_clients();
931 mutex_lock(&init_lock);
932 ksmbd_tcp_destroy();
933 ksmbd_rdma_stop_listening();
934 stop_sessions();
935 mutex_unlock(&init_lock);
936}