projects/linux·blob master · refs

2008 lines · 48.6 KiB

1// SPDX-License-Identifier: GPL-2.0-or-later
2/*
3 * Copyright (C) 2016 Namjae Jeon <[email protected]>
4 * Copyright (C) 2019 Samsung Electronics Co., Ltd.
5 */
6
7#include <linux/fs.h>
8#include <linux/filelock.h>
9#include <linux/slab.h>
10#include <linux/vmalloc.h>
11#include <linux/kthread.h>
12#include <linux/freezer.h>
13#include <linux/dcache.h>
14
15#include "glob.h"
16#include "vfs_cache.h"
17#include "oplock.h"
18#include "vfs.h"
19#include "connection.h"
20#include "misc.h"
21#include "mgmt/tree_connect.h"
22#include "mgmt/user_session.h"
23#include "mgmt/user_config.h"
24#include "smb_common.h"
25#include "server.h"
26#include "smb2pdu.h"
27
28#define S_DEL_PENDING 1
29#define S_DEL_ON_CLS 2
30#define S_DEL_ON_CLS_STREAM 8
31
32static unsigned int inode_hash_mask __read_mostly;
33static unsigned int inode_hash_shift __read_mostly;
34static struct hlist_head *inode_hashtable __read_mostly;
35static DEFINE_RWLOCK(inode_hash_lock);
36
37static struct ksmbd_file_table global_ft;
38static atomic_long_t fd_limit;
39static struct kmem_cache *filp_cache;
40
41static int ksmbd_mark_fp_closed(struct ksmbd_file *fp);
42
43#define OPLOCK_NONE 0
44#define OPLOCK_EXCLUSIVE 1
45#define OPLOCK_BATCH 2
46#define OPLOCK_READ 3 /* level 2 oplock */
47
48#ifdef CONFIG_PROC_FS
49
50static const struct ksmbd_const_name ksmbd_lease_const_names[] = {
51 {le32_to_cpu(SMB2_LEASE_NONE_LE), "LEASE_NONE"},
52 {le32_to_cpu(SMB2_LEASE_READ_CACHING_LE), "LEASE_R"},
53 {le32_to_cpu(SMB2_LEASE_HANDLE_CACHING_LE), "LEASE_H"},
54 {le32_to_cpu(SMB2_LEASE_WRITE_CACHING_LE), "LEASE_W"},
55 {le32_to_cpu(SMB2_LEASE_READ_CACHING_LE |
56 SMB2_LEASE_HANDLE_CACHING_LE), "LEASE_RH"},
57 {le32_to_cpu(SMB2_LEASE_READ_CACHING_LE |
58 SMB2_LEASE_WRITE_CACHING_LE), "LEASE_RW"},
59 {le32_to_cpu(SMB2_LEASE_HANDLE_CACHING_LE |
60 SMB2_LEASE_WRITE_CACHING_LE), "LEASE_WH"},
61 {le32_to_cpu(SMB2_LEASE_READ_CACHING_LE |
62 SMB2_LEASE_HANDLE_CACHING_LE |
63 SMB2_LEASE_WRITE_CACHING_LE), "LEASE_RWH"},
64};
65
66static const struct ksmbd_const_name ksmbd_oplock_const_names[] = {
67 {SMB2_OPLOCK_LEVEL_NONE, "OPLOCK_NONE"},
68 {SMB2_OPLOCK_LEVEL_II, "OPLOCK_II"},
69 {SMB2_OPLOCK_LEVEL_EXCLUSIVE, "OPLOCK_EXCLUSIVE"},
70 {SMB2_OPLOCK_LEVEL_BATCH, "OPLOCK_BATCH"},
71};
72
73static const struct ksmbd_const_name ksmbd_file_state_names[] = {
74 {FP_NEW, "new"},
75 {FP_INITED, "open"},
76 {FP_CLOSED, "closed"},
77};
78
79#define KSMBD_PROC_FILE_DURABLE BIT(0)
80#define KSMBD_PROC_FILE_PERSISTENT BIT(1)
81#define KSMBD_PROC_FILE_RESILIENT BIT(2)
82#define KSMBD_PROC_FILE_DELETE_ON_CLOSE BIT(3)
83#define KSMBD_PROC_FILE_STREAM BIT(4)
84#define KSMBD_PROC_FILE_POSIX BIT(5)
85#define KSMBD_PROC_FILE_ATTRIB_ONLY BIT(6)
86
87static const struct ksmbd_const_name ksmbd_file_flag_names[] = {
88 {KSMBD_PROC_FILE_DURABLE, "durable"},
89 {KSMBD_PROC_FILE_PERSISTENT, "persistent"},
90 {KSMBD_PROC_FILE_RESILIENT, "resilient"},
91 {KSMBD_PROC_FILE_DELETE_ON_CLOSE, "delete-on-close"},
92 {KSMBD_PROC_FILE_STREAM, "stream"},
93 {KSMBD_PROC_FILE_POSIX, "posix"},
94 {KSMBD_PROC_FILE_ATTRIB_ONLY, "attrib-only"},
95};
96
97static unsigned int ksmbd_proc_file_flags(struct ksmbd_file *fp)
98{
99 unsigned int flags = 0;
100
101 if (fp->is_durable)
102 flags |= KSMBD_PROC_FILE_DURABLE;
103 if (fp->is_persistent)
104 flags |= KSMBD_PROC_FILE_PERSISTENT;
105 if (fp->is_resilient)
106 flags |= KSMBD_PROC_FILE_RESILIENT;
107 if (fp->coption & FILE_DELETE_ON_CLOSE_LE)
108 flags |= KSMBD_PROC_FILE_DELETE_ON_CLOSE;
109 if (fp->stream.name)
110 flags |= KSMBD_PROC_FILE_STREAM;
111 if (fp->is_posix_ctxt)
112 flags |= KSMBD_PROC_FILE_POSIX;
113 if (fp->attrib_only)
114 flags |= KSMBD_PROC_FILE_ATTRIB_ONLY;
115 return flags;
116}
117
118static int proc_show_files(struct seq_file *m, void *v)
119{
120 struct ksmbd_file *fp = NULL;
121 unsigned int id;
122 struct oplock_info *opinfo;
123
124 read_lock(&global_ft.lock);
125 idr_for_each_entry(global_ft.idr, fp, id) {
126 seq_printf(m, "tree_id:\t0x%x\n", fp->tcon ? fp->tcon->id : 0);
127 seq_printf(m, "persistent_id:\t0x%llx\n", fp->persistent_id);
128 seq_printf(m, "volatile_id:\t0x%llx\n", fp->volatile_id);
129 seq_printf(m, "refcount:\t%d\n", atomic_read(&fp->refcount));
130
131 rcu_read_lock();
132 opinfo = rcu_dereference(fp->f_opinfo);
133 if (opinfo) {
134 const struct ksmbd_const_name *const_names;
135 const char *name;
136 int count;
137 unsigned int level;
138
139 if (opinfo->is_lease) {
140 const_names = ksmbd_lease_const_names;
141 count = ARRAY_SIZE(ksmbd_lease_const_names);
142 level = le32_to_cpu(opinfo->o_lease->state);
143 } else {
144 const_names = ksmbd_oplock_const_names;
145 count = ARRAY_SIZE(ksmbd_oplock_const_names);
146 level = opinfo->level;
147 }
148 rcu_read_unlock();
149 name = ksmbd_proc_const_name(const_names, count, level);
150 if (name)
151 seq_printf(m, "oplock:\t%s\n", name);
152 else
153 seq_printf(m, "oplock:\t0x%x\n", level);
154 } else {
155 rcu_read_unlock();
156 seq_puts(m, "oplock:\tnone\n");
157 }
158
159 seq_printf(m, "state:\t%s\n",
160 ksmbd_proc_const_name(ksmbd_file_state_names,
161 ARRAY_SIZE(ksmbd_file_state_names),
162 fp->f_state));
163 seq_printf(m, "durable_timeout:\t%u\n", fp->durable_timeout);
164 seq_printf(m, "create_options:\t0x%08x\n",
165 le32_to_cpu(fp->coption));
166 seq_printf(m, "desired_access:\t0x%08x\n",
167 le32_to_cpu(fp->daccess));
168 seq_printf(m, "share_access:\t0x%08x\n",
169 le32_to_cpu(fp->saccess));
170 seq_puts(m, "flags:\t");
171 ksmbd_proc_show_flag_names(m, ksmbd_file_flag_names,
172 ARRAY_SIZE(ksmbd_file_flag_names),
173 ksmbd_proc_file_flags(fp));
174 seq_printf(m, "\nname:\t%s\n\n",
175 fp->filp->f_path.dentry->d_name.name);
176 }
177 read_unlock(&global_ft.lock);
178 return 0;
179}
180
181static int create_proc_files(void)
182{
183 if (!ksmbd_proc_create("files", proc_show_files, NULL))
184 return -ENOMEM;
185 return 0;
186}
187#else
188static int create_proc_files(void) { return 0; }
189#endif
190
191static bool durable_scavenger_running;
192static DEFINE_MUTEX(durable_scavenger_lock);
193static wait_queue_head_t dh_wq;
194
195bool ksmbd_durable_scavenger_active(void)
196{
197 bool active;
198
199 mutex_lock(&durable_scavenger_lock);
200 active = durable_scavenger_running;
201 mutex_unlock(&durable_scavenger_lock);
202 return active;
203}
204
205void ksmbd_set_fd_limit(unsigned long limit)
206{
207 limit = min(limit, get_max_files());
208 atomic_long_set(&fd_limit, limit);
209}
210
211static bool fd_limit_depleted(void)
212{
213 long v = atomic_long_dec_return(&fd_limit);
214
215 if (v >= 0)
216 return false;
217 atomic_long_inc(&fd_limit);
218 return true;
219}
220
221static void fd_limit_close(void)
222{
223 atomic_long_inc(&fd_limit);
224}
225
226/*
227 * INODE hash
228 */
229
230static unsigned long inode_hash(struct super_block *sb, unsigned long hashval)
231{
232 unsigned long tmp;
233
234 tmp = (hashval * (unsigned long)sb) ^ (GOLDEN_RATIO_PRIME + hashval) /
235 L1_CACHE_BYTES;
236 tmp = tmp ^ ((tmp ^ GOLDEN_RATIO_PRIME) >> inode_hash_shift);
237 return tmp & inode_hash_mask;
238}
239
240static struct ksmbd_inode *__ksmbd_inode_lookup(struct dentry *de)
241{
242 struct hlist_head *head = inode_hashtable +
243 inode_hash(d_inode(de)->i_sb, (unsigned long)de);
244 struct ksmbd_inode *ci = NULL, *ret_ci = NULL;
245
246 hlist_for_each_entry(ci, head, m_hash) {
247 if (ci->m_de == de) {
248 if (atomic_inc_not_zero(&ci->m_count))
249 ret_ci = ci;
250 break;
251 }
252 }
253 return ret_ci;
254}
255
256static struct ksmbd_inode *ksmbd_inode_lookup(struct ksmbd_file *fp)
257{
258 return __ksmbd_inode_lookup(fp->filp->f_path.dentry);
259}
260
261struct ksmbd_inode *ksmbd_inode_lookup_lock(struct dentry *d)
262{
263 struct ksmbd_inode *ci;
264
265 read_lock(&inode_hash_lock);
266 ci = __ksmbd_inode_lookup(d);
267 read_unlock(&inode_hash_lock);
268
269 return ci;
270}
271
272int ksmbd_query_inode_status(struct dentry *dentry)
273{
274 struct ksmbd_inode *ci;
275 int ret = KSMBD_INODE_STATUS_UNKNOWN;
276
277 read_lock(&inode_hash_lock);
278 ci = __ksmbd_inode_lookup(dentry);
279 read_unlock(&inode_hash_lock);
280 if (!ci)
281 return ret;
282
283 down_read(&ci->m_lock);
284 if (ci->m_flags & S_DEL_PENDING)
285 ret = KSMBD_INODE_STATUS_PENDING_DELETE;
286 else
287 ret = KSMBD_INODE_STATUS_OK;
288 up_read(&ci->m_lock);
289
290 ksmbd_inode_put(ci);
291 return ret;
292}
293
294bool ksmbd_inode_pending_delete(struct ksmbd_file *fp)
295{
296 struct ksmbd_inode *ci = fp->f_ci;
297 int ret;
298
299 down_read(&ci->m_lock);
300 ret = (ci->m_flags & S_DEL_PENDING);
301 up_read(&ci->m_lock);
302 if (ret || !ksmbd_stream_fd(fp))
303 return ret;
304
305 spin_lock(&fp->f_lock);
306 ret = fp->stream_del_pending;
307 spin_unlock(&fp->f_lock);
308
309 return ret;
310}
311
312void ksmbd_set_inode_pending_delete(struct ksmbd_file *fp)
313{
314 struct ksmbd_inode *ci = fp->f_ci;
315
316 down_write(&ci->m_lock);
317 ci->m_flags |= S_DEL_PENDING;
318 up_write(&ci->m_lock);
319}
320
321void ksmbd_clear_inode_pending_delete(struct ksmbd_file *fp)
322{
323 struct ksmbd_inode *ci = fp->f_ci;
324
325 down_write(&ci->m_lock);
326 ci->m_flags &= ~S_DEL_PENDING;
327 up_write(&ci->m_lock);
328}
329
330bool ksmbd_has_stream_without_delete_share(struct ksmbd_file *fp)
331{
332 struct ksmbd_file *prev_fp;
333 struct ksmbd_inode *ci = fp->f_ci;
334 bool ret = false;
335
336 if (ksmbd_stream_fd(fp))
337 return false;
338
339 down_read(&ci->m_lock);
340 list_for_each_entry(prev_fp, &ci->m_fp_list, node) {
341 if (prev_fp == fp || !ksmbd_stream_fd(prev_fp))
342 continue;
343
344 if (file_inode(fp->filp) != file_inode(prev_fp->filp))
345 continue;
346
347 if (!(prev_fp->saccess & FILE_SHARE_DELETE_LE)) {
348 ret = true;
349 break;
350 }
351 }
352 up_read(&ci->m_lock);
353
354 return ret;
355}
356
357void ksmbd_fd_set_delete_on_close(struct ksmbd_file *fp,
358 int file_info)
359{
360 struct ksmbd_inode *ci = fp->f_ci;
361
362 down_write(&ci->m_lock);
363 if (ksmbd_stream_fd(fp))
364 ci->m_flags |= S_DEL_ON_CLS_STREAM;
365 else
366 ci->m_flags |= S_DEL_ON_CLS;
367 up_write(&ci->m_lock);
368}
369
370/*
371 * FileDispositionInformation (SET_INFO) on a stream handle must only
372 * mark the stream for deletion, not the whole file -- otherwise
373 * deleting a single alternate data stream (e.g. AFP_AfpInfo) deletes
374 * the entire file's data along with it.
375 *
376 * This is tracked on fp itself (stream_del_pending), not the shared
377 * ksmbd_inode: the inode-wide S_DEL_ON_CLS_STREAM flag used by
378 * ksmbd_fd_set_delete_on_close() can't record *which* stream should be
379 * deleted, so if a different stream handle on the same file closed
380 * first, it would delete the wrong stream.
381 */
382void ksmbd_fd_set_delete_pending(struct ksmbd_file *fp)
383{
384 if (ksmbd_stream_fd(fp)) {
385 spin_lock(&fp->f_lock);
386 fp->stream_del_pending = true;
387 spin_unlock(&fp->f_lock);
388 } else {
389 ksmbd_set_inode_pending_delete(fp);
390 }
391}
392
393void ksmbd_fd_clear_delete_pending(struct ksmbd_file *fp)
394{
395 if (ksmbd_stream_fd(fp)) {
396 spin_lock(&fp->f_lock);
397 fp->stream_del_pending = false;
398 spin_unlock(&fp->f_lock);
399 } else {
400 ksmbd_clear_inode_pending_delete(fp);
401 }
402}
403
404static void ksmbd_inode_hash(struct ksmbd_inode *ci)
405{
406 struct hlist_head *b = inode_hashtable +
407 inode_hash(d_inode(ci->m_de)->i_sb, (unsigned long)ci->m_de);
408
409 hlist_add_head(&ci->m_hash, b);
410}
411
412static void ksmbd_inode_unhash(struct ksmbd_inode *ci)
413{
414 write_lock(&inode_hash_lock);
415 hlist_del_init(&ci->m_hash);
416 write_unlock(&inode_hash_lock);
417}
418
419static int ksmbd_inode_init(struct ksmbd_inode *ci, struct ksmbd_file *fp)
420{
421 atomic_set(&ci->m_count, 1);
422 atomic_set(&ci->op_count, 0);
423 atomic_set(&ci->sop_count, 0);
424 ci->m_flags = 0;
425 ci->m_fattr = 0;
426 INIT_LIST_HEAD(&ci->m_fp_list);
427 INIT_LIST_HEAD(&ci->m_op_list);
428 init_rwsem(&ci->m_lock);
429 ci->m_de = fp->filp->f_path.dentry;
430 return 0;
431}
432
433static struct ksmbd_inode *ksmbd_inode_get(struct ksmbd_file *fp)
434{
435 struct ksmbd_inode *ci, *tmpci;
436 int rc;
437
438 read_lock(&inode_hash_lock);
439 ci = ksmbd_inode_lookup(fp);
440 read_unlock(&inode_hash_lock);
441 if (ci)
442 return ci;
443
444 ci = kmalloc_obj(struct ksmbd_inode, KSMBD_DEFAULT_GFP);
445 if (!ci)
446 return NULL;
447
448 rc = ksmbd_inode_init(ci, fp);
449 if (rc) {
450 pr_err("inode initialized failed\n");
451 kfree(ci);
452 return NULL;
453 }
454
455 write_lock(&inode_hash_lock);
456 tmpci = ksmbd_inode_lookup(fp);
457 if (!tmpci) {
458 ksmbd_inode_hash(ci);
459 } else {
460 kfree(ci);
461 ci = tmpci;
462 }
463 write_unlock(&inode_hash_lock);
464 return ci;
465}
466
467static void ksmbd_inode_free(struct ksmbd_inode *ci)
468{
469 ksmbd_inode_unhash(ci);
470 kfree(ci);
471}
472
473void ksmbd_inode_put(struct ksmbd_inode *ci)
474{
475 if (atomic_dec_and_test(&ci->m_count))
476 ksmbd_inode_free(ci);
477}
478
479int __init ksmbd_inode_hash_init(void)
480{
481 unsigned int loop;
482 unsigned long numentries = 16384;
483 unsigned long bucketsize = sizeof(struct hlist_head);
484 unsigned long size;
485
486 inode_hash_shift = ilog2(numentries);
487 inode_hash_mask = (1 << inode_hash_shift) - 1;
488
489 size = bucketsize << inode_hash_shift;
490
491 /* init master fp hash table */
492 inode_hashtable = vmalloc(size);
493 if (!inode_hashtable)
494 return -ENOMEM;
495
496 for (loop = 0; loop < (1U << inode_hash_shift); loop++)
497 INIT_HLIST_HEAD(&inode_hashtable[loop]);
498 return 0;
499}
500
501void ksmbd_release_inode_hash(void)
502{
503 vfree(inode_hashtable);
504}
505
506static void __ksmbd_inode_close(struct ksmbd_file *fp)
507{
508 struct ksmbd_inode *ci = fp->f_ci;
509 int err;
510 struct file *filp;
511
512 filp = fp->filp;
513
514 if (ksmbd_stream_fd(fp)) {
515 bool remove_stream_xattr = false;
516
517 down_write(&ci->m_lock);
518 if (ci->m_flags & S_DEL_ON_CLS_STREAM) {
519 ci->m_flags &= ~S_DEL_ON_CLS_STREAM;
520 remove_stream_xattr = true;
521 }
522 up_write(&ci->m_lock);
523
524 /*
525 * Per-handle delete-pending from ksmbd_fd_set_delete_pending()
526 * (FileDispositionInformation on this stream) -- separate from
527 * the inode-wide flag above, which only ever meant "some
528 * stream on this file" with no way to say which one.
529 */
530 spin_lock(&fp->f_lock);
531 if (fp->stream_del_pending) {
532 fp->stream_del_pending = false;
533 remove_stream_xattr = true;
534 }
535 spin_unlock(&fp->f_lock);
536
537 if (remove_stream_xattr) {
538 const struct cred *saved_cred;
539
540 saved_cred = override_creds(filp->f_cred);
541 err = ksmbd_vfs_remove_xattr(file_mnt_idmap(filp),
542 &filp->f_path,
543 fp->stream.name,
544 true);
545 revert_creds(saved_cred);
546 if (err)
547 pr_err("remove xattr failed : %s\n",
548 fp->stream.name);
549 }
550 }
551
552 down_write(&ci->m_lock);
553 /* Promote S_DEL_ON_CLS to S_DEL_PENDING when close */
554 if (ci->m_flags & S_DEL_ON_CLS) {
555 ci->m_flags &= ~S_DEL_ON_CLS;
556 ci->m_flags |= S_DEL_PENDING;
557 }
558 up_write(&ci->m_lock);
559
560 if (atomic_dec_and_test(&ci->m_count)) {
561 bool do_unlink = false;
562
563 down_write(&ci->m_lock);
564 if (ci->m_flags & S_DEL_PENDING) {
565 ci->m_flags &= ~S_DEL_PENDING;
566 do_unlink = true;
567 }
568 up_write(&ci->m_lock);
569
570 if (do_unlink)
571 ksmbd_vfs_unlink(filp);
572
573 ksmbd_inode_free(ci);
574 }
575}
576
577static void __ksmbd_remove_durable_fd(struct ksmbd_file *fp)
578{
579 if (!has_file_id(fp->persistent_id))
580 return;
581
582 idr_remove(global_ft.idr, fp->persistent_id);
583 /*
584 * Clear persistent_id so a later __ksmbd_close_fd() that runs from a
585 * delayed putter (e.g. when a concurrent ksmbd_lookup_fd_inode()
586 * walker held the final reference) does not re-issue idr_remove() on
587 * an id that idr_alloc_cyclic() may have already handed out to a new
588 * durable handle.
589 */
590 fp->persistent_id = KSMBD_NO_FID;
591}
592
593static void ksmbd_remove_durable_fd(struct ksmbd_file *fp)
594{
595 write_lock(&global_ft.lock);
596 __ksmbd_remove_durable_fd(fp);
597 write_unlock(&global_ft.lock);
598 if (waitqueue_active(&dh_wq))
599 wake_up(&dh_wq);
600}
601
602static void __ksmbd_remove_fd(struct ksmbd_file_table *ft, struct ksmbd_file *fp)
603{
604 down_write(&fp->f_ci->m_lock);
605 list_del_init(&fp->node);
606 up_write(&fp->f_ci->m_lock);
607
608 if (!has_file_id(fp->volatile_id))
609 return;
610
611 write_lock(&ft->lock);
612 idr_remove(ft->idr, fp->volatile_id);
613 write_unlock(&ft->lock);
614}
615
616static void __ksmbd_close_fd(struct ksmbd_file_table *ft, struct ksmbd_file *fp)
617{
618 struct file *filp;
619 struct ksmbd_lock *smb_lock, *tmp_lock;
620 struct ksmbd_work *cn_work;
621
622 fd_limit_close();
623 ksmbd_remove_durable_fd(fp);
624 if (ft)
625 __ksmbd_remove_fd(ft, fp);
626
627 close_id_del_oplock(fp);
628 filp = fp->filp;
629
630 __ksmbd_inode_close(fp);
631 if (!IS_ERR_OR_NULL(filp))
632 fput(filp);
633
634 /*
635 * The zero fp reference count serializes access to fp->lock_list, but
636 * the VFS may still have blocked requests chained below these locks.
637 */
638 list_for_each_entry_safe(smb_lock, tmp_lock, &fp->lock_list, flist) {
639 struct ksmbd_conn *conn = smb_lock->conn;
640
641 if (conn) {
642 spin_lock(&conn->llist_lock);
643 list_del_init(&smb_lock->clist);
644 smb_lock->conn = NULL;
645 spin_unlock(&conn->llist_lock);
646 ksmbd_conn_put(conn);
647 }
648
649 list_del_init(&smb_lock->flist);
650 ksmbd_vfs_posix_lock_unblock(smb_lock->fl);
651 locks_free_lock(smb_lock->fl);
652 kfree(smb_lock);
653 }
654
655 /*
656 * Complete any CHANGE_NOTIFY left pending on this handle now that
657 * it is closed. KSMBD never completes CHANGE_NOTIFY spontaneously
658 * (no real change-notification backend), only on close -- matching
659 * genuine SMB2/macOS smbfs semantics and avoiding the Finder
660 * "directory changed, re-enumerate everything" loop.
661 *
662 * smb2_notify() on another connection can be adding to
663 * notify_pendings under fp->f_lock at the same time this handle is
664 * closed, and a client-sent CANCEL can concurrently be racing to
665 * claim the same entry via smb2_notify_cancel_fn() (smb2pdu.c).
666 * Pop one entry at a time under the lock via list_del_init() rather
667 * than a bulk list_splice_init(): list_del_init() leaves the node
668 * self-linked ("empty"), which is what the cancel path checks under
669 * the same lock to tell whether it lost the race -- a bulk splice
670 * would instead relink every entry into a shared local list, so an
671 * entry claimed here would still read as "not empty" to a racing
672 * cancel_fn, and both sides could end up freeing the same work.
673 * ksmbd_conn_write() can sleep (it takes conn's write mutex), so it
674 * must not be called while fp->f_lock is held -- release the lock
675 * before processing each popped entry, then reacquire it for the
676 * next.
677 */
678 for (;;) {
679 spin_lock(&fp->f_lock);
680 if (list_empty(&fp->notify_pendings)) {
681 spin_unlock(&fp->f_lock);
682 break;
683 }
684 cn_work = list_first_entry(&fp->notify_pendings,
685 struct ksmbd_work, notify_entry);
686 list_del_init(&cn_work->notify_entry);
687 spin_unlock(&fp->f_lock);
688
689 ksmbd_conn_write(cn_work);
690 /*
691 * release_async_work() removes cn_work from
692 * conn->async_requests, frees cancel_argv, and releases+zeroes
693 * async_id -- all needed before ksmbd_free_work_struct(), which
694 * only releases async_id itself if still nonzero (i.e. if this
695 * hadn't already been done).
696 */
697 release_async_work(cn_work);
698 ksmbd_free_work_struct(cn_work);
699 }
700
701 /*
702 * Drop fp's strong reference on conn (taken in ksmbd_open_fd() /
703 * ksmbd_reopen_durable_fd()). Durable fps that reached the
704 * scavenger have already had fp->conn cleared by session_fd_check(),
705 * in which case there is nothing to drop here.
706 */
707 if (fp->conn) {
708 ksmbd_conn_put(fp->conn);
709 fp->conn = NULL;
710 }
711
712 if (ksmbd_stream_fd(fp))
713 kfree(fp->stream.name);
714 kfree(fp->owner.name);
715
716 kmem_cache_free(filp_cache, fp);
717}
718
719/**
720 * ksmbd_close_disconnected_durable_delete_on_close() - drop a delete-on-close
721 * file kept present only by disconnected durable handles
722 * @dentry: dentry of the file being opened
723 *
724 * A durable handle opened with delete-on-close is preserved across a
725 * disconnect so it can be reclaimed by a durable reconnect. When a new
726 * (non-reconnect) open arrives for the same name instead, the disconnected
727 * handle has to give way. Close such handles so their delete-on-close is
728 * applied and the file is removed once the last handle is gone, letting the
729 * new open create a fresh file.
730 *
731 * The caller's inode reference is dropped before closing so that the final
732 * close can promote S_DEL_ON_CLS to S_DEL_PENDING and unlink the file.
733 *
734 * Return: true if a disconnected durable handle was closed.
735 */
736bool ksmbd_close_disconnected_durable_delete_on_close(struct dentry *dentry)
737{
738 struct ksmbd_inode *ci;
739 struct ksmbd_file *fp, *tmp;
740 LIST_HEAD(dispose);
741 bool closed = false;
742
743 ci = ksmbd_inode_lookup_lock(dentry);
744 if (!ci)
745 return false;
746
747 down_write(&ci->m_lock);
748 if (ci->m_flags & (S_DEL_ON_CLS | S_DEL_ON_CLS_STREAM | S_DEL_PENDING)) {
749 list_for_each_entry_safe(fp, tmp, &ci->m_fp_list, node) {
750 if (fp->conn || !fp->is_durable ||
751 fp->f_state != FP_INITED)
752 continue;
753
754 /*
755 * Claim the close before unlinking fp from m_fp_list.
756 * refcount == 1 means only the durable lifetime ref is
757 * left. Add a transient ref so final close can drop both.
758 */
759 write_lock(&global_ft.lock);
760 if (atomic_read(&fp->refcount) == 1) {
761 atomic_inc(&fp->refcount);
762 __ksmbd_remove_durable_fd(fp);
763 ksmbd_mark_fp_closed(fp);
764 list_move_tail(&fp->node, &dispose);
765 }
766 write_unlock(&global_ft.lock);
767 }
768 }
769 up_write(&ci->m_lock);
770
771 /*
772 * Drop our lookup reference before closing so the last __ksmbd_close_fd()
773 * can drop m_count to zero and unlink the delete-on-close file. The
774 * collected handles still hold the transient reference taken above, so
775 * ci stays valid until they are closed below.
776 */
777 ksmbd_inode_put(ci);
778
779 while (!list_empty(&dispose)) {
780 fp = list_first_entry(&dispose, struct ksmbd_file, node);
781 list_del_init(&fp->node);
782 if (atomic_sub_and_test(2, &fp->refcount)) {
783 __ksmbd_close_fd(NULL, fp);
784 closed = true;
785 }
786 }
787
788 return closed;
789}
790
791static struct ksmbd_file *ksmbd_fp_get(struct ksmbd_file *fp)
792{
793 if (fp->f_state != FP_INITED)
794 return NULL;
795
796 if (!atomic_inc_not_zero(&fp->refcount))
797 return NULL;
798 return fp;
799}
800
801struct ksmbd_file *ksmbd_file_get(struct ksmbd_file *fp)
802{
803 return ksmbd_fp_get(fp);
804}
805
806static struct ksmbd_file *__ksmbd_lookup_fd(struct ksmbd_file_table *ft,
807 u64 id)
808{
809 struct ksmbd_file *fp;
810
811 if (!has_file_id(id))
812 return NULL;
813
814 read_lock(&ft->lock);
815 fp = idr_find(ft->idr, id);
816 if (fp)
817 fp = ksmbd_fp_get(fp);
818 read_unlock(&ft->lock);
819 return fp;
820}
821
822static void __put_fd_final(struct ksmbd_work *work, struct ksmbd_file *fp)
823{
824 /*
825 * Detached durable fp -- session_fd_check() cleared fp->conn at
826 * preserve, so this fp is no longer tracked by any conn's
827 * stats.open_files_count. This happens when
828 * ksmbd_scavenger_dispose_dh() hands the final close off to an
829 * m_fp_list walker (e.g. ksmbd_lookup_fd_inode()) whose work->conn
830 * is unrelated to the conn that originally opened the handle; close
831 * via the NULL-ft path so we do not underflow that unrelated
832 * counter.
833 */
834 if (!fp->conn) {
835 __ksmbd_close_fd(NULL, fp);
836 return;
837 }
838 __ksmbd_close_fd(&work->sess->file_table, fp);
839 atomic_dec(&work->conn->stats.open_files_count);
840}
841
842static void set_close_state_blocked_works(struct ksmbd_file *fp)
843{
844 struct ksmbd_work *cancel_work;
845
846 spin_lock(&fp->f_lock);
847 list_for_each_entry(cancel_work, &fp->blocked_works,
848 fp_entry) {
849 if (xchg(&cancel_work->state, KSMBD_WORK_CLOSED) ==
850 KSMBD_WORK_ACTIVE)
851 cancel_work->cancel_fn(cancel_work->cancel_argv);
852 }
853 spin_unlock(&fp->f_lock);
854}
855
856void ksmbd_wake_session_blocked_works(struct ksmbd_session *sess)
857{
858 struct ksmbd_file_table *ft = &sess->file_table;
859 struct ksmbd_file *fp;
860 unsigned int id;
861
862 read_lock(&ft->lock);
863 idr_for_each_entry(ft->idr, fp, id)
864 set_close_state_blocked_works(fp);
865 read_unlock(&ft->lock);
866}
867
868int ksmbd_close_fd(struct ksmbd_work *work, u64 id)
869{
870 struct ksmbd_file *fp;
871 struct ksmbd_file_table *ft;
872 bool closed = false;
873
874 if (!has_file_id(id))
875 return 0;
876
877 ft = &work->sess->file_table;
878 write_lock(&ft->lock);
879 fp = idr_find(ft->idr, id);
880 if (fp) {
881 set_close_state_blocked_works(fp);
882
883 if (fp->f_state != FP_INITED)
884 fp = NULL;
885 else {
886 fp->f_state = FP_CLOSED;
887 idr_remove(ft->idr, id);
888 fp->volatile_id = KSMBD_NO_FID;
889 closed = true;
890 if (!atomic_dec_and_test(&fp->refcount))
891 fp = NULL;
892 }
893 }
894 write_unlock(&ft->lock);
895
896 if (!fp)
897 return closed ? 0 : -EINVAL;
898
899 __put_fd_final(work, fp);
900 return 0;
901}
902
903void ksmbd_fd_put(struct ksmbd_work *work, struct ksmbd_file *fp)
904{
905 if (!fp)
906 return;
907
908 if (!atomic_dec_and_test(&fp->refcount))
909 return;
910 __put_fd_final(work, fp);
911}
912
913static bool __sanity_check(struct ksmbd_tree_connect *tcon, struct ksmbd_file *fp)
914{
915 if (!fp)
916 return false;
917 if (fp->tcon != tcon)
918 return false;
919 return true;
920}
921
922struct ksmbd_file *ksmbd_lookup_foreign_fd(struct ksmbd_work *work, u64 id)
923{
924 return __ksmbd_lookup_fd(&work->sess->file_table, id);
925}
926
927struct ksmbd_file *ksmbd_lookup_fd_fast(struct ksmbd_work *work, u64 id)
928{
929 struct ksmbd_file *fp = __ksmbd_lookup_fd(&work->sess->file_table, id);
930
931 if (__sanity_check(work->tcon, fp))
932 return fp;
933
934 ksmbd_fd_put(work, fp);
935 return NULL;
936}
937
938struct ksmbd_file *ksmbd_lookup_fd_slow(struct ksmbd_work *work, u64 id,
939 u64 pid)
940{
941 struct ksmbd_file *fp;
942
943 if (!has_file_id(id)) {
944 id = work->compound_fid;
945 pid = work->compound_pfid;
946 }
947
948 fp = __ksmbd_lookup_fd(&work->sess->file_table, id);
949 if (!__sanity_check(work->tcon, fp)) {
950 ksmbd_fd_put(work, fp);
951 return NULL;
952 }
953 if (fp->persistent_id != pid) {
954 ksmbd_fd_put(work, fp);
955 return NULL;
956 }
957 return fp;
958}
959
960struct ksmbd_file *ksmbd_lookup_global_fd(unsigned long long id)
961{
962 return __ksmbd_lookup_fd(&global_ft, id);
963}
964
965struct ksmbd_file *ksmbd_lookup_durable_fd(unsigned long long id)
966{
967 struct ksmbd_file *fp;
968
969 fp = __ksmbd_lookup_fd(&global_ft, id);
970 if (fp && (fp->durable_reconnect_disabled ||
971 fp->conn ||
972 (fp->durable_scavenger_timeout &&
973 (fp->durable_scavenger_timeout <
974 jiffies_to_msecs(jiffies))))) {
975 ksmbd_put_durable_fd(fp);
976 fp = NULL;
977 }
978
979 return fp;
980}
981
982void ksmbd_put_durable_fd(struct ksmbd_file *fp)
983{
984 if (!atomic_dec_and_test(&fp->refcount))
985 return;
986
987 __ksmbd_close_fd(NULL, fp);
988}
989
990bool ksmbd_has_other_active_fd(struct ksmbd_file *fp)
991{
992 struct ksmbd_file *lfp;
993 struct ksmbd_inode *ci = fp->f_ci;
994 bool ret = false;
995
996 down_read(&ci->m_lock);
997 list_for_each_entry(lfp, &ci->m_fp_list, node) {
998 if (lfp == fp)
999 continue;
1000
1001 if (lfp->f_state == FP_INITED &&
1002 (READ_ONCE(lfp->conn) || READ_ONCE(lfp->tcon))) {
1003 ret = true;
1004 break;
1005 }
1006 }
1007 up_read(&ci->m_lock);
1008
1009 return ret;
1010}
1011
1012struct ksmbd_file *ksmbd_lookup_fd_app_instance_id(char *app_instance_id)
1013{
1014 struct ksmbd_file *fp = NULL;
1015 unsigned int id;
1016
1017 read_lock(&global_ft.lock);
1018 idr_for_each_entry(global_ft.idr, fp, id) {
1019 if (!fp->has_app_instance_id)
1020 continue;
1021 if (!memcmp(fp->app_instance_id, app_instance_id,
1022 SMB2_CREATE_GUID_SIZE)) {
1023 fp = ksmbd_fp_get(fp);
1024 break;
1025 }
1026 }
1027 read_unlock(&global_ft.lock);
1028
1029 return fp;
1030}
1031
1032int ksmbd_close_fd_app_instance_id(char *app_instance_id)
1033{
1034 struct ksmbd_file_table *ft;
1035 struct ksmbd_file *fp;
1036 struct oplock_info *opinfo;
1037 int n_to_drop = 0;
1038
1039 fp = ksmbd_lookup_fd_app_instance_id(app_instance_id);
1040 if (!fp)
1041 return 0;
1042
1043 opinfo = opinfo_get(fp);
1044 if (!opinfo)
1045 goto out;
1046
1047 down_read(&fp->f_ci->m_lock);
1048 if (!opinfo->conn) {
1049 up_read(&fp->f_ci->m_lock);
1050 goto out;
1051 }
1052
1053 ft = &opinfo->sess->file_table;
1054 write_lock(&ft->lock);
1055 if (fp->f_state == FP_INITED && has_file_id(fp->volatile_id)) {
1056 idr_remove(ft->idr, fp->volatile_id);
1057 fp->volatile_id = KSMBD_NO_FID;
1058 n_to_drop = ksmbd_mark_fp_closed(fp);
1059 }
1060 write_unlock(&ft->lock);
1061 up_read(&fp->f_ci->m_lock);
1062 opinfo_put(opinfo);
1063 opinfo = NULL;
1064
1065 if (!n_to_drop)
1066 goto out;
1067
1068 down_write(&fp->f_ci->m_lock);
1069 list_del_init(&fp->node);
1070 up_write(&fp->f_ci->m_lock);
1071
1072 if (atomic_sub_and_test(n_to_drop, &fp->refcount)) {
1073 if (fp->conn)
1074 atomic_dec(&fp->conn->stats.open_files_count);
1075 __ksmbd_close_fd(NULL, fp);
1076 }
1077 return 0;
1078
1079out:
1080 if (opinfo)
1081 opinfo_put(opinfo);
1082 ksmbd_put_durable_fd(fp);
1083 return 0;
1084}
1085
1086int ksmbd_invalidate_durable_fd(unsigned long long id)
1087{
1088 struct ksmbd_file *fp;
1089
1090 fp = ksmbd_lookup_global_fd(id);
1091 if (!fp)
1092 return -ENOENT;
1093
1094 fp->durable_reconnect_disabled = true;
1095
1096 if (fp->conn) {
1097 ksmbd_put_durable_fd(fp);
1098 return -ENOENT;
1099 }
1100
1101 fp->durable_timeout = 1;
1102 fp->durable_scavenger_timeout = jiffies_to_msecs(jiffies);
1103 ksmbd_put_durable_fd(fp);
1104 if (waitqueue_active(&dh_wq))
1105 wake_up(&dh_wq);
1106
1107 return -ENOENT;
1108}
1109
1110struct ksmbd_file *ksmbd_lookup_fd_cguid(char *cguid)
1111{
1112 struct ksmbd_file *fp = NULL;
1113 unsigned int id;
1114
1115 read_lock(&global_ft.lock);
1116 idr_for_each_entry(global_ft.idr, fp, id) {
1117 if (!memcmp(fp->create_guid,
1118 cguid,
1119 SMB2_CREATE_GUID_SIZE)) {
1120 fp = ksmbd_fp_get(fp);
1121 break;
1122 }
1123 }
1124 read_unlock(&global_ft.lock);
1125
1126 return fp;
1127}
1128
1129struct ksmbd_file *ksmbd_lookup_fd_inode(struct dentry *dentry)
1130{
1131 struct ksmbd_file *lfp;
1132 struct ksmbd_inode *ci;
1133 struct inode *inode = d_inode(dentry);
1134
1135 read_lock(&inode_hash_lock);
1136 ci = __ksmbd_inode_lookup(dentry);
1137 read_unlock(&inode_hash_lock);
1138 if (!ci)
1139 return NULL;
1140
1141 down_read(&ci->m_lock);
1142 list_for_each_entry(lfp, &ci->m_fp_list, node) {
1143 if (inode == file_inode(lfp->filp)) {
1144 lfp = ksmbd_fp_get(lfp);
1145 up_read(&ci->m_lock);
1146 ksmbd_inode_put(ci);
1147 return lfp;
1148 }
1149 }
1150 up_read(&ci->m_lock);
1151 ksmbd_inode_put(ci);
1152 return NULL;
1153}
1154
1155bool ksmbd_has_other_nonposix_open(struct dentry *dentry)
1156{
1157 struct ksmbd_file *fp;
1158 struct inode *inode = d_inode(dentry);
1159 unsigned int id;
1160 bool ret = false;
1161
1162 if (!inode)
1163 return false;
1164
1165 read_lock(&global_ft.lock);
1166 idr_for_each_entry(global_ft.idr, fp, id) {
1167 if (READ_ONCE(fp->f_state) != FP_INITED)
1168 continue;
1169 if (inode != file_inode(fp->filp))
1170 continue;
1171 if (fp->is_posix_ctxt)
1172 continue;
1173
1174 ret = true;
1175 break;
1176 }
1177 read_unlock(&global_ft.lock);
1178
1179 return ret;
1180}
1181
1182bool ksmbd_has_nonposix_open_child(struct ksmbd_file *old_fp)
1183{
1184 struct dentry *dentry = old_fp->filp->f_path.dentry;
1185 struct ksmbd_file *fp;
1186 unsigned int id;
1187 bool ret = false;
1188
1189 read_lock(&global_ft.lock);
1190 idr_for_each_entry(global_ft.idr, fp, id) {
1191 struct dentry *fp_dentry = fp->filp->f_path.dentry;
1192
1193 if (fp->f_state != FP_INITED)
1194 continue;
1195 if (fp_dentry == dentry)
1196 continue;
1197 if (old_fp->is_posix_ctxt && fp->is_posix_ctxt)
1198 continue;
1199 if (is_subdir(fp_dentry, dentry)) {
1200 ret = true;
1201 break;
1202 }
1203 }
1204 read_unlock(&global_ft.lock);
1205
1206 return ret;
1207}
1208
1209#define OPEN_ID_TYPE_VOLATILE_ID (0)
1210#define OPEN_ID_TYPE_PERSISTENT_ID (1)
1211
1212static void __open_id_set(struct ksmbd_file *fp, u64 id, int type)
1213{
1214 if (type == OPEN_ID_TYPE_VOLATILE_ID)
1215 fp->volatile_id = id;
1216 if (type == OPEN_ID_TYPE_PERSISTENT_ID)
1217 fp->persistent_id = id;
1218}
1219
1220static int __open_id(struct ksmbd_file_table *ft, struct ksmbd_file *fp,
1221 int type)
1222{
1223 u64 id = 0;
1224 int ret;
1225
1226 if (type == OPEN_ID_TYPE_VOLATILE_ID && fd_limit_depleted()) {
1227 __open_id_set(fp, KSMBD_NO_FID, type);
1228 return -EMFILE;
1229 }
1230
1231 idr_preload(KSMBD_DEFAULT_GFP);
1232 write_lock(&ft->lock);
1233 ret = idr_alloc_cyclic(ft->idr, fp, KSMBD_START_FID, INT_MAX - 1,
1234 GFP_NOWAIT);
1235 if (ret >= 0) {
1236 id = ret;
1237 ret = 0;
1238 } else {
1239 id = KSMBD_NO_FID;
1240 fd_limit_close();
1241 }
1242
1243 __open_id_set(fp, id, type);
1244 write_unlock(&ft->lock);
1245 idr_preload_end();
1246 return ret;
1247}
1248
1249unsigned int ksmbd_open_durable_fd(struct ksmbd_file *fp)
1250{
1251 __open_id(&global_ft, fp, OPEN_ID_TYPE_PERSISTENT_ID);
1252 return fp->persistent_id;
1253}
1254
1255struct ksmbd_file *ksmbd_open_fd(struct ksmbd_work *work, struct file *filp)
1256{
1257 struct ksmbd_file *fp;
1258 int ret;
1259
1260 fp = kmem_cache_zalloc(filp_cache, KSMBD_DEFAULT_GFP);
1261 if (!fp) {
1262 pr_err("Failed to allocate memory\n");
1263 return ERR_PTR(-ENOMEM);
1264 }
1265
1266 INIT_LIST_HEAD(&fp->blocked_works);
1267 INIT_LIST_HEAD(&fp->node);
1268 INIT_LIST_HEAD(&fp->lock_list);
1269 INIT_LIST_HEAD(&fp->notify_pendings);
1270 spin_lock_init(&fp->f_lock);
1271 mutex_init(&fp->readdir_lock);
1272 atomic_set(&fp->refcount, 1);
1273
1274 fp->filp = filp;
1275 /*
1276 * fp owns a strong reference on fp->conn for as long as fp->conn is
1277 * non-NULL, so session_fd_check() and __ksmbd_close_fd() never
1278 * dereference a dangling pointer. Paired with ksmbd_conn_put() in
1279 * session_fd_check() (durable preserve), in __ksmbd_close_fd()
1280 * (final close), and on the error paths below.
1281 */
1282 fp->conn = ksmbd_conn_get(work->conn);
1283 fp->tcon = work->tcon;
1284 fp->volatile_id = KSMBD_NO_FID;
1285 fp->persistent_id = KSMBD_NO_FID;
1286 fp->f_state = FP_NEW;
1287 fp->f_ci = ksmbd_inode_get(fp);
1288
1289 if (!fp->f_ci) {
1290 ret = -ENOMEM;
1291 goto err_out;
1292 }
1293
1294 ret = __open_id(&work->sess->file_table, fp, OPEN_ID_TYPE_VOLATILE_ID);
1295 if (ret) {
1296 ksmbd_inode_put(fp->f_ci);
1297 goto err_out;
1298 }
1299
1300 atomic_inc(&work->conn->stats.open_files_count);
1301 return fp;
1302
1303err_out:
1304 /* fp->conn was set and refcounted before every branch here. */
1305 ksmbd_conn_put(fp->conn);
1306 kmem_cache_free(filp_cache, fp);
1307 return ERR_PTR(ret);
1308}
1309
1310/**
1311 * ksmbd_update_fstate() - update an fp state under the file-table lock
1312 * @ft: file table that publishes @fp's volatile id
1313 * @fp: file pointer to update
1314 * @state: new state
1315 *
1316 * Return: 0 on success. The FP_NEW -> FP_INITED transition is special:
1317 * -ENOENT if teardown already unpublished @fp by advancing the state or
1318 * clearing the volatile id. Other state updates preserve the historical
1319 * fire-and-forget behavior.
1320 */
1321int ksmbd_update_fstate(struct ksmbd_file_table *ft, struct ksmbd_file *fp,
1322 unsigned int state)
1323{
1324 int ret;
1325
1326 if (!fp)
1327 return -ENOENT;
1328
1329 write_lock(&ft->lock);
1330 if (state == FP_INITED &&
1331 (fp->f_state != FP_NEW || !has_file_id(fp->volatile_id))) {
1332 ret = -ENOENT;
1333 } else {
1334 fp->f_state = state;
1335 ret = 0;
1336 }
1337 write_unlock(&ft->lock);
1338
1339 return ret;
1340}
1341
1342/*
1343 * ksmbd_mark_fp_closed() - mark fp closed under ft->lock and return how many
1344 * refs the teardown path owns.
1345 *
1346 * FP_INITED has a normal idr-owned reference, so teardown owns both that
1347 * reference and the transient lookup reference. FP_NEW is still owned by the
1348 * in-flight opener/reopener, which will drop the original reference after
1349 * ksmbd_update_fstate(..., FP_INITED) observes the cleared volatile id.
1350 * FP_CLOSED on entry means an earlier ksmbd_close_fd() already consumed the
1351 * idr-owned ref.
1352 */
1353static int ksmbd_mark_fp_closed(struct ksmbd_file *fp)
1354{
1355 if (fp->f_state == FP_INITED) {
1356 set_close_state_blocked_works(fp);
1357 fp->f_state = FP_CLOSED;
1358 return 2;
1359 }
1360
1361 return 1;
1362}
1363
1364static int
1365__close_file_table_ids(struct ksmbd_session *sess,
1366 struct ksmbd_tree_connect *tcon,
1367 bool (*skip)(struct ksmbd_tree_connect *tcon,
1368 struct ksmbd_file *fp,
1369 struct ksmbd_user *user),
1370 bool skip_preserves_fp)
1371{
1372 struct ksmbd_file_table *ft = &sess->file_table;
1373 struct ksmbd_file *fp;
1374 unsigned int id = 0;
1375 int num = 0;
1376
1377 while (1) {
1378 int n_to_drop;
1379
1380 write_lock(&ft->lock);
1381 fp = idr_get_next(ft->idr, &id);
1382 if (!fp) {
1383 write_unlock(&ft->lock);
1384 break;
1385 }
1386 if (!atomic_inc_not_zero(&fp->refcount)) {
1387 id++;
1388 write_unlock(&ft->lock);
1389 continue;
1390 }
1391
1392 if (skip_preserves_fp) {
1393 /*
1394 * Session teardown: skip() is session_fd_check(),
1395 * which may sleep and mutates fp->conn / fp->tcon /
1396 * fp->volatile_id when it chooses to preserve fp
1397 * for durable reconnect. Unpublish fp from the
1398 * session idr here, under ft->lock, so that
1399 * __ksmbd_lookup_fd() through this session cannot
1400 * grant a new ksmbd_fp_get() reference to an fp
1401 * whose fields are about to be rewritten outside
1402 * the lock. Durable reconnect still reaches fp via
1403 * global_ft.
1404 */
1405 idr_remove(ft->idr, id);
1406 fp->durable_volatile_id = fp->volatile_id;
1407 fp->volatile_id = KSMBD_NO_FID;
1408 write_unlock(&ft->lock);
1409
1410 if (skip(tcon, fp, sess->user)) {
1411 /*
1412 * session_fd_check() has converted fp to
1413 * durable-preserve state and cleared its
1414 * per-conn fields. fp is already unpublished
1415 * above; the original idr-owned ref keeps it
1416 * alive for the durable scavenger. Drop only
1417 * the transient ref. atomic_dec() is safe --
1418 * atomic_inc_not_zero() succeeded on a
1419 * positive value and we added one more, so
1420 * refcount cannot be zero here.
1421 */
1422 atomic_dec(&fp->refcount);
1423 id++;
1424 continue;
1425 }
1426
1427 /*
1428 * Keep the close-state decision under the same lock
1429 * observed by ksmbd_update_fstate(), which is how an
1430 * in-flight FP_NEW opener learns that teardown has
1431 * cleared its volatile id.
1432 */
1433 write_lock(&ft->lock);
1434 n_to_drop = ksmbd_mark_fp_closed(fp);
1435 write_unlock(&ft->lock);
1436 } else {
1437 /*
1438 * Tree teardown: skip() is tree_conn_fd_check(), a
1439 * cheap pointer compare that doesn't sleep and has
1440 * no side effects, so keep the skip decision plus
1441 * the unpublish-and-mark-closed sequence atomic
1442 * under ft->lock. fps belonging to other tree
1443 * connects (skip() == true) stay fully published in
1444 * the session idr with no lock window.
1445 */
1446 if (skip(tcon, fp, sess->user)) {
1447 atomic_dec(&fp->refcount);
1448 write_unlock(&ft->lock);
1449 id++;
1450 continue;
1451 }
1452 idr_remove(ft->idr, id);
1453 fp->volatile_id = KSMBD_NO_FID;
1454 n_to_drop = ksmbd_mark_fp_closed(fp);
1455 write_unlock(&ft->lock);
1456 }
1457
1458 /*
1459 * fp->volatile_id is already cleared to prevent stale idr
1460 * removal from a deferred final close. Remove fp from
1461 * m_fp_list here because __ksmbd_remove_fd() will skip the
1462 * list unlink when volatile_id is KSMBD_NO_FID.
1463 */
1464 down_write(&fp->f_ci->m_lock);
1465 list_del_init(&fp->node);
1466 up_write(&fp->f_ci->m_lock);
1467
1468 /*
1469 * Drop the references this iteration owns:
1470 *
1471 * n_to_drop == 2: we observed FP_INITED and committed
1472 * the FP_CLOSED transition ourselves, so we own the
1473 * transient (+1) and the still-intact idr-owned ref.
1474 *
1475 * n_to_drop == 1: either a prior ksmbd_close_fd()
1476 * already consumed the idr-owned ref, or fp was still
1477 * FP_NEW and the in-flight opener/reopener must keep
1478 * the original reference until ksmbd_update_fstate()
1479 * observes the cleared volatile id.
1480 *
1481 * If we end up as the final putter, finalize fp and
1482 * account the open_files_count decrement via the caller's
1483 * atomic_sub(num, ...). Otherwise the remaining user's
1484 * ksmbd_fd_put() reaches __put_fd_final(), which does its
1485 * own atomic_dec(&open_files_count), so we must not count
1486 * this fp here -- doing so would double-decrement the
1487 * connection-wide counter.
1488 */
1489 if (atomic_sub_and_test(n_to_drop, &fp->refcount)) {
1490 __ksmbd_close_fd(NULL, fp);
1491 num++;
1492 }
1493 id++;
1494 }
1495
1496 return num;
1497}
1498
1499static inline bool is_reconnectable(struct ksmbd_file *fp)
1500{
1501 struct oplock_info *opinfo = opinfo_get(fp);
1502 bool reconn = false;
1503
1504 if (!opinfo)
1505 return false;
1506
1507 if (opinfo->op_state != OPLOCK_STATE_NONE) {
1508 opinfo_put(opinfo);
1509 return false;
1510 }
1511
1512 if (fp->is_resilient || fp->is_persistent)
1513 reconn = true;
1514 else if (fp->is_durable && opinfo->is_lease &&
1515 opinfo->o_lease->state & SMB2_LEASE_HANDLE_CACHING_LE)
1516 reconn = true;
1517
1518 else if (fp->is_durable && opinfo->level == SMB2_OPLOCK_LEVEL_BATCH)
1519 reconn = true;
1520
1521 opinfo_put(opinfo);
1522 return reconn;
1523}
1524
1525static bool tree_conn_fd_check(struct ksmbd_tree_connect *tcon,
1526 struct ksmbd_file *fp,
1527 struct ksmbd_user *user)
1528{
1529 return fp->tcon != tcon;
1530}
1531
1532static bool ksmbd_durable_scavenger_alive(void)
1533{
1534 if (!durable_scavenger_running)
1535 return false;
1536
1537 if (kthread_should_stop())
1538 return false;
1539
1540 if (idr_is_empty(global_ft.idr))
1541 return false;
1542
1543 return true;
1544}
1545
1546static void ksmbd_scavenger_dispose_dh(struct ksmbd_file *fp)
1547{
1548 /*
1549 * Durable-preserved fp can remain linked on f_ci->m_fp_list for
1550 * share-mode checks. Unlink it before final close; fp->node is not
1551 * available as a scavenger-private list node because re-adding it to
1552 * another list corrupts m_fp_list.
1553 */
1554 down_write(&fp->f_ci->m_lock);
1555 list_del_init(&fp->node);
1556 up_write(&fp->f_ci->m_lock);
1557
1558 /*
1559 * Drop both the durable lifetime reference and the transient reference
1560 * taken by the scavenger under global_ft.lock. If a concurrent
1561 * ksmbd_lookup_fd_inode() (or any other m_fp_list walker) snatched fp
1562 * before the unlink above, that holder owns the final close via
1563 * ksmbd_fd_put() -> __ksmbd_close_fd(). Otherwise the scavenger is
1564 * the last putter and finalises fp here.
1565 */
1566 if (atomic_sub_and_test(2, &fp->refcount))
1567 __ksmbd_close_fd(NULL, fp);
1568}
1569
1570static int ksmbd_durable_scavenger(void *dummy)
1571{
1572 struct ksmbd_file *fp = NULL;
1573 struct ksmbd_file *expired_fp;
1574 unsigned int id;
1575 unsigned int min_timeout = 1;
1576 bool found_fp_timeout;
1577 unsigned long remaining_jiffies;
1578
1579 __module_get(THIS_MODULE);
1580
1581 set_freezable();
1582 while (ksmbd_durable_scavenger_alive()) {
1583 if (try_to_freeze())
1584 continue;
1585
1586 remaining_jiffies = wait_event_interruptible_timeout(dh_wq,
1587 ksmbd_durable_scavenger_alive() == false,
1588 __msecs_to_jiffies(min_timeout));
1589 if ((long)remaining_jiffies > 0)
1590 min_timeout = jiffies_to_msecs(remaining_jiffies);
1591 else
1592 min_timeout = DURABLE_HANDLE_MAX_TIMEOUT;
1593
1594 do {
1595 expired_fp = NULL;
1596 found_fp_timeout = false;
1597
1598 write_lock(&global_ft.lock);
1599 idr_for_each_entry(global_ft.idr, fp, id) {
1600 unsigned long durable_timeout;
1601
1602 if (!fp->durable_timeout)
1603 continue;
1604
1605 if (atomic_read(&fp->refcount) > 1 ||
1606 fp->conn)
1607 continue;
1608
1609 found_fp_timeout = true;
1610 if (fp->durable_scavenger_timeout <=
1611 jiffies_to_msecs(jiffies)) {
1612 __ksmbd_remove_durable_fd(fp);
1613 /*
1614 * Take a transient reference so fp
1615 * cannot be freed by an in-flight
1616 * ksmbd_lookup_fd_inode() that found
1617 * it through f_ci->m_fp_list while we
1618 * drop global_ft.lock and reach the
1619 * m_fp_list unlink in
1620 * ksmbd_scavenger_dispose_dh().
1621 */
1622 atomic_inc(&fp->refcount);
1623 expired_fp = fp;
1624 break;
1625 }
1626
1627 durable_timeout =
1628 fp->durable_scavenger_timeout -
1629 jiffies_to_msecs(jiffies);
1630
1631 if (min_timeout > durable_timeout)
1632 min_timeout = durable_timeout;
1633 }
1634 write_unlock(&global_ft.lock);
1635
1636 if (expired_fp)
1637 ksmbd_scavenger_dispose_dh(expired_fp);
1638 } while (expired_fp);
1639
1640 if (found_fp_timeout == false)
1641 break;
1642 }
1643
1644 durable_scavenger_running = false;
1645
1646 module_put(THIS_MODULE);
1647
1648 return 0;
1649}
1650
1651void ksmbd_launch_ksmbd_durable_scavenger(void)
1652{
1653 if (!(server_conf.flags & KSMBD_GLOBAL_FLAG_DURABLE_HANDLE))
1654 return;
1655
1656 mutex_lock(&durable_scavenger_lock);
1657 if (durable_scavenger_running == true) {
1658 mutex_unlock(&durable_scavenger_lock);
1659 return;
1660 }
1661
1662 durable_scavenger_running = true;
1663
1664 server_conf.dh_task = kthread_run(ksmbd_durable_scavenger,
1665 (void *)NULL, "ksmbd-durable-scavenger");
1666 if (IS_ERR(server_conf.dh_task)) {
1667 pr_err("cannot start conn thread, err : %ld\n",
1668 PTR_ERR(server_conf.dh_task));
1669 server_conf.dh_task = NULL;
1670 durable_scavenger_running = false;
1671 }
1672 mutex_unlock(&durable_scavenger_lock);
1673}
1674
1675void ksmbd_stop_durable_scavenger(void)
1676{
1677 if (!(server_conf.flags & KSMBD_GLOBAL_FLAG_DURABLE_HANDLE))
1678 return;
1679
1680 mutex_lock(&durable_scavenger_lock);
1681 if (!durable_scavenger_running) {
1682 mutex_unlock(&durable_scavenger_lock);
1683 return;
1684 }
1685
1686 durable_scavenger_running = false;
1687 if (waitqueue_active(&dh_wq))
1688 wake_up(&dh_wq);
1689 mutex_unlock(&durable_scavenger_lock);
1690 kthread_stop(server_conf.dh_task);
1691}
1692
1693/*
1694 * ksmbd_vfs_set_durable_owner - Store owner info for durable replay/reconnect
1695 * @fp: ksmbd file pointer to store owner info
1696 * @user: user pointer to copy from
1697 *
1698 * This function binds the current user's identity to the file handle
1699 * to satisfy MS-SMB2 Step 8 (SecurityContext matching) during reconnect.
1700 *
1701 * Return: 0 on success, or negative error code on failure
1702 */
1703int ksmbd_vfs_set_durable_owner(struct ksmbd_file *fp,
1704 struct ksmbd_user *user)
1705{
1706 char *name, *old_name;
1707
1708 if (!user)
1709 return -EINVAL;
1710
1711 /* Duplicate the user name to ensure identity persistence */
1712 name = kstrdup(user->name, GFP_KERNEL);
1713 if (!name)
1714 return -ENOMEM;
1715
1716 spin_lock(&fp->f_lock);
1717 old_name = fp->owner.name;
1718 fp->owner.uid = user->uid;
1719 fp->owner.gid = user->gid;
1720 fp->owner.name = name;
1721 spin_unlock(&fp->f_lock);
1722 kfree(old_name);
1723
1724 return 0;
1725}
1726
1727/**
1728 * ksmbd_vfs_compare_durable_owner - Verify if the requester is original owner
1729 * @fp: existing ksmbd file pointer
1730 * @user: user pointer of the reconnect requester
1731 *
1732 * Compares the UID, GID, and name of the current requester against the
1733 * original owner stored in the file handle.
1734 *
1735 * Return: true if the user matches, false otherwise
1736 */
1737bool ksmbd_vfs_compare_durable_owner(struct ksmbd_file *fp,
1738 struct ksmbd_user *user)
1739{
1740 bool ret = false;
1741
1742 if (!user)
1743 return false;
1744
1745 spin_lock(&fp->f_lock);
1746 if (!fp->owner.name)
1747 goto out;
1748
1749 /* Check if the UID and GID match first (fast path) */
1750 if (fp->owner.uid != user->uid || fp->owner.gid != user->gid)
1751 goto out;
1752
1753 /* Validate the account name to ensure the same SecurityContext */
1754 ret = (strcmp(fp->owner.name, user->name) == 0);
1755out:
1756 spin_unlock(&fp->f_lock);
1757 return ret;
1758}
1759
1760static bool session_fd_check(struct ksmbd_tree_connect *tcon,
1761 struct ksmbd_file *fp, struct ksmbd_user *user)
1762{
1763 struct ksmbd_inode *ci;
1764 struct oplock_info *op;
1765 struct ksmbd_conn *conn;
1766 struct ksmbd_lock *smb_lock, *tmp_lock;
1767
1768 if (!is_reconnectable(fp))
1769 return false;
1770
1771 if (fp->f_state != FP_INITED)
1772 return false;
1773
1774 if (WARN_ON_ONCE(!fp->conn))
1775 return false;
1776
1777 if (ksmbd_vfs_set_durable_owner(fp, user))
1778 return false;
1779
1780 /*
1781 * fp owns a strong reference on fp->conn (taken in ksmbd_open_fd()
1782 * / ksmbd_reopen_durable_fd()), so conn stays valid for the whole
1783 * body of this function regardless of any op->conn puts below.
1784 */
1785 conn = fp->conn;
1786 ci = fp->f_ci;
1787 down_write(&ci->m_lock);
1788 list_for_each_entry_rcu(op, &ci->m_op_list, op_entry,
1789 lockdep_is_held(&ci->m_lock)) {
1790 if (op->conn != conn)
1791 continue;
1792 ksmbd_conn_put(op->conn);
1793 op->conn = NULL;
1794 op->sess = NULL;
1795 }
1796 up_write(&ci->m_lock);
1797
1798 list_for_each_entry_safe(smb_lock, tmp_lock, &fp->lock_list, flist) {
1799 struct ksmbd_conn *lock_conn = smb_lock->conn;
1800
1801 if (!lock_conn)
1802 continue;
1803 spin_lock(&lock_conn->llist_lock);
1804 list_del_init(&smb_lock->clist);
1805 smb_lock->conn = NULL;
1806 spin_unlock(&lock_conn->llist_lock);
1807 ksmbd_conn_put(lock_conn);
1808 }
1809
1810 fp->conn = NULL;
1811 fp->tcon = NULL;
1812 fp->volatile_id = KSMBD_NO_FID;
1813
1814 if (fp->durable_timeout)
1815 fp->durable_scavenger_timeout =
1816 jiffies_to_msecs(jiffies) + fp->durable_timeout;
1817
1818 /* Drop fp's own reference on conn. */
1819 ksmbd_conn_put(conn);
1820 return true;
1821}
1822
1823void ksmbd_close_tree_conn_fds(struct ksmbd_work *work)
1824{
1825 int num = __close_file_table_ids(work->sess,
1826 work->tcon,
1827 tree_conn_fd_check,
1828 false);
1829
1830 atomic_sub(num, &work->conn->stats.open_files_count);
1831}
1832
1833void ksmbd_close_session_fds(struct ksmbd_work *work)
1834{
1835 int num = __close_file_table_ids(work->sess,
1836 work->tcon,
1837 session_fd_check,
1838 true);
1839
1840 atomic_sub(num, &work->conn->stats.open_files_count);
1841}
1842
1843int ksmbd_init_global_file_table(void)
1844{
1845 if (create_proc_files())
1846 pr_warn("Unable to create files procfs entry\n");
1847 return ksmbd_init_file_table(&global_ft);
1848}
1849
1850void ksmbd_free_global_file_table(void)
1851{
1852 struct ksmbd_file *fp = NULL;
1853 unsigned int id;
1854
1855 idr_for_each_entry(global_ft.idr, fp, id) {
1856 ksmbd_remove_durable_fd(fp);
1857 __ksmbd_close_fd(NULL, fp);
1858 }
1859
1860 idr_destroy(global_ft.idr);
1861 kfree(global_ft.idr);
1862}
1863
1864int ksmbd_validate_name_reconnect(struct ksmbd_share_config *share,
1865 struct ksmbd_file *fp, char *name)
1866{
1867 char *pathname, *ab_pathname;
1868 int ret = 0;
1869
1870 pathname = kmalloc(PATH_MAX, KSMBD_DEFAULT_GFP);
1871 if (!pathname)
1872 return -EACCES;
1873
1874 ab_pathname = d_path(&fp->filp->f_path, pathname, PATH_MAX);
1875 if (IS_ERR(ab_pathname)) {
1876 kfree(pathname);
1877 return -EACCES;
1878 }
1879
1880 if (name && strcmp(&ab_pathname[share->path_sz + 1], name)) {
1881 ksmbd_debug(SMB, "invalid name reconnect %s\n", name);
1882 ret = -EINVAL;
1883 }
1884
1885 kfree(pathname);
1886
1887 return ret;
1888}
1889
1890int ksmbd_reopen_durable_fd(struct ksmbd_work *work, struct ksmbd_file *fp)
1891{
1892 struct ksmbd_inode *ci;
1893 struct oplock_info *op;
1894 struct ksmbd_conn *conn = work->conn;
1895 struct ksmbd_lock *smb_lock;
1896 unsigned int old_f_state;
1897
1898 write_lock(&global_ft.lock);
1899 if ((!fp->is_durable && !fp->is_persistent) || fp->conn || fp->tcon) {
1900 write_unlock(&global_ft.lock);
1901 pr_err("Invalid durable fd [%p:%p]\n", fp->conn, fp->tcon);
1902 return -EBADF;
1903 }
1904
1905 if (has_file_id(fp->volatile_id)) {
1906 write_unlock(&global_ft.lock);
1907 pr_err("Still in use durable fd: %llu\n", fp->volatile_id);
1908 return -EBADF;
1909 }
1910
1911 /*
1912 * Initialize fp's connection binding before publishing fp into the
1913 * session's file table. If __open_id() is ordered first, a
1914 * concurrent teardown that iterates the table can observe a valid
1915 * volatile_id with fp->conn == NULL and preserve a
1916 * partially-initialized fp. fp owns a strong reference on the new
1917 * conn (see ksmbd_open_fd()); undo it on __open_id() failure.
1918 */
1919 fp->conn = ksmbd_conn_get(conn);
1920 fp->tcon = work->tcon;
1921 write_unlock(&global_ft.lock);
1922
1923 old_f_state = fp->f_state;
1924 fp->f_state = FP_NEW;
1925
1926 __open_id(&work->sess->file_table, fp, OPEN_ID_TYPE_VOLATILE_ID);
1927 if (!has_file_id(fp->volatile_id)) {
1928 write_lock(&global_ft.lock);
1929 fp->conn = NULL;
1930 fp->tcon = NULL;
1931 write_unlock(&global_ft.lock);
1932 ksmbd_conn_put(conn);
1933 fp->f_state = old_f_state;
1934 return -EBADF;
1935 }
1936
1937 list_for_each_entry(smb_lock, &fp->lock_list, flist) {
1938 smb_lock->conn = ksmbd_conn_get(conn);
1939 spin_lock(&conn->llist_lock);
1940 list_add_tail(&smb_lock->clist, &conn->lock_list);
1941 spin_unlock(&conn->llist_lock);
1942 }
1943
1944 ci = fp->f_ci;
1945 down_write(&ci->m_lock);
1946 list_for_each_entry_rcu(op, &ci->m_op_list, op_entry,
1947 lockdep_is_held(&ci->m_lock)) {
1948 if (op->conn || op->o_fp != fp)
1949 continue;
1950 op->conn = ksmbd_conn_get(fp->conn);
1951 op->sess = work->sess;
1952 }
1953 up_write(&ci->m_lock);
1954
1955 spin_lock(&fp->f_lock);
1956 fp->owner.uid = fp->owner.gid = 0;
1957 kfree(fp->owner.name);
1958 fp->owner.name = NULL;
1959 spin_unlock(&fp->f_lock);
1960
1961 return 0;
1962}
1963
1964int ksmbd_init_file_table(struct ksmbd_file_table *ft)
1965{
1966 ft->idr = kzalloc_obj(struct idr, KSMBD_DEFAULT_GFP);
1967 if (!ft->idr)
1968 return -ENOMEM;
1969
1970 idr_init(ft->idr);
1971 rwlock_init(&ft->lock);
1972 return 0;
1973}
1974
1975void ksmbd_destroy_file_table(struct ksmbd_session *sess)
1976{
1977 struct ksmbd_file_table *ft = &sess->file_table;
1978
1979 if (!ft->idr)
1980 return;
1981
1982 __close_file_table_ids(sess, NULL, session_fd_check, true);
1983 idr_destroy(ft->idr);
1984 kfree(ft->idr);
1985 ft->idr = NULL;
1986}
1987
1988int ksmbd_init_file_cache(void)
1989{
1990 filp_cache = kmem_cache_create("ksmbd_file_cache",
1991 sizeof(struct ksmbd_file), 0,
1992 SLAB_HWCACHE_ALIGN, NULL);
1993 if (!filp_cache)
1994 goto out;
1995
1996 init_waitqueue_head(&dh_wq);
1997
1998 return 0;
1999
2000out:
2001 pr_err("failed to allocate file cache\n");
2002 return -ENOMEM;
2003}
2004
2005void ksmbd_exit_file_cache(void)
2006{
2007 kmem_cache_destroy(filp_cache);
2008}