Commit Graph

1611 Commits (master)

Author SHA1 Message Date
Linus Torvalds a91e1138b7 3 smb3 client fixes
-----BEGIN PGP SIGNATURE-----
 
 iQGzBAABCgAdFiEE6fsu8pdIjtWE/DpLiiy9cAdyT1EFAmlEL34ACgkQiiy9cAdy
 T1G7MAv/aPWShb8uwNhTy6OuZzR6sDxcx5eTS0L7zPY2YqWs9Pf7SRbYsW38uNhU
 v7biZqwHOjMBRlNPKCahU9gs+thliZMYrD+dkEL5FIMrD1O2kUq1Ulx3FxuzwFXh
 lCePdiRkJVNS2N/jsDjHapl+wdURV4SwFZ9k4McbUxwPJ9peifYdlQfTrKh4nz+v
 gF6S8B2ElSbFTQ6ejXpBd4aFPY/xZyvs0F9mW84Cty0I8cjoXMYaoStbS3llarPd
 FuSBB5za6Wx85O7iOPMt7qcRgZ8eSdtdWf4fVle2nbQZWW7XFptJ7V+En+or2g2e
 +d4qq5tyHgp3RCCEk1c7R/ndZp9xjbKuExPzoor3HQ/9qpnMem57HVeuiDPO0b+D
 pbH/mX4jcow+jU9+urs5BxzDoWOkZ3Hm5rzSGr407kX2YCw2KP6Oxy3sM00zh+kH
 aGG5oZzgXUBLWMEQkJi2b6DKQ6OF0zLA8rlow2dkaZHjmHZABf1eCqsgTZuui7Nq
 Lo8iUhHX
 =Oj0h
 -----END PGP SIGNATURE-----

Merge tag 'v6.19-rc1-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6

Pull smb client fixes from Steve French:

 - important fix for reconnect problem

 - minor cleanup

* tag 'v6.19-rc1-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6:
  cifs: update internal module version number
  smb: move some SMB1 definitions into common/smb1pdu.h
  smb: align durable reconnect v2 context to 8 byte boundary
2025-12-19 07:50:20 +12:00
Steve French d8a4af8f3d cifs: update internal module version number
to 2.58

Signed-off-by: Steve French <stfrench@microsoft.com>
2025-12-16 17:43:02 -06:00
ZhangGuoDong 94d5b8dbc5 smb: move some SMB1 definitions into common/smb1pdu.h
These definitions are only used by SMB1, so move them into the new
common/smb1pdu.h.

KSMBD only implements SMB_COM_NEGOTIATE, see MS-SMB2 3.3.5.2.

Co-developed-by: ChenXiaoSong <chenxiaosong@kylinos.cn>
Signed-off-by: ChenXiaoSong <chenxiaosong@kylinos.cn>
Signed-off-by: ZhangGuoDong <zhangguodong@kylinos.cn>
Signed-off-by: Steve French <stfrench@microsoft.com>
2025-12-16 17:43:01 -06:00
Bharath SM 05f5e355cf smb: align durable reconnect v2 context to 8 byte boundary
Add a 4-byte Pad to create_durable_handle_reconnect_v2 so the DH2C
create context is 8 byte aligned.
This avoids malformed CREATE contexts on reconnect.
Recent change removed this Padding, adding it back.

Fixes: 81a45de432 ("smb: move create_durable_handle_reconnect_v2 to common/smb2pdu.h")

Signed-off-by: Bharath SM <bharathsm@microsoft.com>
Reviewed-by: Paulo Alcantara (Red Hat) <pc@manguebit.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
2025-12-16 17:42:49 -06:00
Namjae Jeon 95d7a890e4 ksmbd: fix buffer validation by including null terminator size in EA length
The smb2_set_ea function, which handles Extended Attributes (EA),
was performing buffer validation checks that incorrectly omitted the size
of the null terminating character (+1 byte) for EA Name.
This patch fixes the issue by explicitly adding '+ 1' to EaNameLength where
the null terminator is expected to be present in the buffer, ensuring
the validation accurately reflects the total required buffer size.

Cc: stable@vger.kernel.org
Reported-by: Roger <roger.andersen@protonmail.com>
Reported-by: Stanislas Polu <spolu@dust.tt>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
2025-12-14 18:35:56 -06:00
Namjae Jeon cafb57f7bd ksmbd: Fix refcount leak when invalid session is found on session lookup
When a session is found but its state is not SMB2_SESSION_VALID, It
indicates that no valid session was found, but it is missing to decrement
the reference count acquired by the session lookup, which results in
a reference count leak. This patch fixes the issue by explicitly calling
ksmbd_user_session_put to release the reference to the session.

Cc: stable@vger.kernel.org
Reported-by: Alexandre <roger.andersen@protonmail.com>
Reported-by: Stanislas Polu <spolu@dust.tt>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
2025-12-14 18:35:56 -06:00
Alexey Velichayshiy 8dd2e58b62 ksmbd: remove redundant DACL check in smb_check_perm_dacl
A zero value of pdacl->num_aces is already handled at the start of
smb_check_perm_dacl() so the second check is useless.

Drop the unreachable code block, no functional impact intended.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Signed-off-by: Alexey Velichayshiy <a.velichayshiy@ispras.ru>
Acked-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
2025-12-14 18:35:56 -06:00
Chen Ni 0446356e9f ksmbd: convert comma to semicolon
Replace comma between expressions with semicolons.

Using a ',' in place of a ';' can have unintended side effects.
Although that is not the case here, it is seems best to use ';'
unless ',' is intended.

Found by inspection.
No functional change intended.
Compile tested only.

Signed-off-by: Chen Ni <nichen@iscas.ac.cn>
Acked-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
2025-12-14 18:35:56 -06:00
Stefan Metzmacher d180b1d9c7 smb: server: defer the initial recv completion logic to smb_direct_negotiate_recv_work()
The previous change to relax WARN_ON_ONCE(SMBDIRECT_SOCKET_*) checks in
recv_done() and smb_direct_cm_handler() seems to work around the
problem that the order of initial recv completion and
RDMA_CM_EVENT_ESTABLISHED is random, but it's still
a bit ugly.

This implements a better solution deferring the recv completion
processing to smb_direct_negotiate_recv_work(), which is queued
only if both events arrived.

In order to avoid more basic changes to the main recv_done
callback, I introduced a smb_direct_negotiate_recv_done,
which is only used for the first pdu, this will allow
further cleanup and simplifications in recv_done
as a future patch.

smb_direct_negotiate_recv_work() is also very basic
with only basic error checking and the transition
from SMBDIRECT_SOCKET_NEGOTIATE_NEEDED to
SMBDIRECT_SOCKET_NEGOTIATE_RUNNING, which allows
smb_direct_prepare() to continue as before.

Cc: Tom Talpey <tom@talpey.com>
Cc: linux-cifs@vger.kernel.org
Cc: samba-technical@lists.samba.org
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Acked-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
2025-12-14 18:35:55 -06:00
Stefan Metzmacher c1fb124f2a smb: server: initialize recv_io->cqe.done = recv_done just once
smbdirect_recv_io structures are pre-allocated so we can set the
callback function just once.

This will make it easy to move smb_direct_post_recv to common code
soon.

Cc: Tom Talpey <tom@talpey.com>
Cc: linux-cifs@vger.kernel.org
Cc: samba-technical@lists.samba.org
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Acked-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
2025-12-14 18:35:55 -06:00
Stefan Metzmacher 49ca214774 smb: smbdirect: introduce smbdirect_socket.connect.{lock,work}
This will first be used by the server in order to defer
the processing of the initial recv of the negotiation
request.

But in future it will also be used by the client in order
to implement an async connect.

Cc: Tom Talpey <tom@talpey.com>
Cc: Long Li <longli@microsoft.com>
Cc: linux-cifs@vger.kernel.org
Cc: samba-technical@lists.samba.org
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Acked-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
2025-12-14 18:35:55 -06:00
Linus Torvalds ce825345dd Three ksmbd server fixes
-----BEGIN PGP SIGNATURE-----
 
 iQGzBAABCgAdFiEE6fsu8pdIjtWE/DpLiiy9cAdyT1EFAmk7qq0ACgkQiiy9cAdy
 T1FBYQwAsagM3pGOhSum710iGgeFAcV/UDKV7rcY3wVRvLmVTuNA4RdTeLkxMrkQ
 LW3k7xlDwveV1qmzPvbprIlOVGawWRexXpiIMqShCDH48yPrLWL4W59AlXDAudUC
 Cn6zMMLHaOg9mcOw3gzraEUFfn0WvcvdhExOLfP9nJGd1ppzqMoOUhIeqy2fOD7R
 uBaO4tBAC2400egegqnijcc+4RWMtSUi1PL3KCSjrL2wJCEFGi5RPvVc2r+3i4We
 7tJJ2jozExTZQBkRqF1qlLGbq8C2G6xWYfZ6x41zaKAjP065zpKuoGpdhPzAZfH+
 Qek2sh5b5Ofx/zZvlhrpKZ5G01LR522g4kZcIG7+qrGDDZsnWjjAnQJlfWO/ZFa4
 j9li9AsIa58qNoMD3q3OY7vaDy21x0TFwcIpXAZ9Vj9Q+/A534+kAigtx90DEbvK
 d4muR0PvUAAS2YgDVn1I9Wpeil+jqMrLoj45mKmX8qCOpbXhZI49KjYX6jZohhWh
 E6WAOCN4
 =Nxpo
 -----END PGP SIGNATURE-----

Merge tag 'v6.19-rc-smb3-server-fixes' of git://git.samba.org/ksmbd

Pull smb server fixes from Steve French:

 - minor cleanup

 - minor update to comment to avoid confusion about fs type

* tag 'v6.19-rc-smb3-server-fixes' of git://git.samba.org/ksmbd:
  smb/server: add comment to FileSystemName of FileFsAttributeInformation
  smb/server: remove unused nterr.h
  smb/server: rename include guard in smb_common.h
2025-12-12 21:59:19 +12:00
ZhangGuoDong ab0347e67d smb/client: remove DeviceType Flags and Device Characteristics definitions
These definitions are already in common/smb2pdu.h, so remove the duplicated
ones from the client.

Co-developed-by: ChenXiaoSong <chenxiaosong@kylinos.cn>
Signed-off-by: ChenXiaoSong <chenxiaosong@kylinos.cn>
Signed-off-by: ZhangGuoDong <zhangguodong@kylinos.cn>
Signed-off-by: Steve French <stfrench@microsoft.com>
2025-12-11 00:53:07 -06:00
ChenXiaoSong 2b6abb893e smb: move File Attributes definitions into common/fscc.h
These definitions are specified in MS-FSCC 2.6, so move them into fscc.h.

Modify the following places:

  - FILE_ATTRIBUTE__MASK -> FILE_ATTRIBUTE_MASK
  - Update FILE_ATTRIBUTE_MASK value
  - cpu_to_le32(constant) -> cpu_to_le32(MACRO DEFINITION)

Signed-off-by: ChenXiaoSong <chenxiaosong@kylinos.cn>
Signed-off-by: Steve French <stfrench@microsoft.com>
2025-12-11 00:53:03 -06:00
ChenXiaoSong c97503321e smb: update struct duplicate_extents_to_file_ex
Add the missing field to the structure (see MS-FSCC 2.3.9.2), and correct
the section number in the documentation reference.

Signed-off-by: ChenXiaoSong <chenxiaosong@kylinos.cn>
Signed-off-by: Steve French <stfrench@microsoft.com>
2025-12-11 00:52:54 -06:00
ChenXiaoSong 08c2a7d2ba smb: move file_notify_information to common/fscc.h
This struct definition is specified in MS-FSCC, and KSMBD will also use it,
so move it into common header file.

Signed-off-by: ChenXiaoSong <chenxiaosong@kylinos.cn>
Signed-off-by: Steve French <stfrench@microsoft.com>
2025-12-09 21:23:03 -06:00
ChenXiaoSong 6539e18517 smb: move SMB2 Notify Action Flags into common/smb2pdu.h
Some of these definitions are already in common/smb2pdu.h. Remove the
duplicate client side definitions, and add all SMB2 Notify Action Flags to
common header file.

Signed-off-by: ChenXiaoSong <chenxiaosong@kylinos.cn>
Signed-off-by: Steve French <stfrench@microsoft.com>
2025-12-09 21:22:58 -06:00
ChenXiaoSong 9ec7629b43 smb: move notify completion filter flags into common/smb2pdu.h
Some of these definitions are already in common/smb2pdu.h, remove the
duplicate client side definitions, and move FILE_NOTIFY_CHANGE_NAME to
common header file.

Signed-off-by: ChenXiaoSong <chenxiaosong@kylinos.cn>
Signed-off-by: Steve French <stfrench@microsoft.com>
2025-12-09 21:22:54 -06:00
ChenXiaoSong a71a4aab48 smb/client: add parentheses to NT error code definitions containing bitwise OR operator
Use the following shell commands:

  # Add "("
  sed -i '/|/s/ 0x/ (0x/' fs/smb/client/nterr.h
  # Add ")" if line does not end with a comment
  sed -i '/|/ { /.*\*\/$/! s/$/)/ }' fs/smb/client/nterr.h
  # Add ")" if line end with a comment
  sed -i '/|/ s/[[:space:]]*\/\*/)&/' fs/smb/client/nterr.h

Signed-off-by: ChenXiaoSong <chenxiaosong@kylinos.cn>
Acked-by: Paulo Alcantara (Red Hat) <pc@manguebit.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
2025-12-09 21:22:34 -06:00
ChenXiaoSong bcdd6cfaf2 smb: add documentation references for smb2 change notify definitions
To make it easier to locate the documentation during development.

Signed-off-by: ChenXiaoSong <chenxiaosong@kylinos.cn>
Signed-off-by: Steve French <stfrench@microsoft.com>
2025-12-09 21:22:01 -06:00
ChenXiaoSong a9adafd401 smb/client: add 4 NT error code definitions
From server/nterr.h that has been removed.

Signed-off-by: ChenXiaoSong <chenxiaosong@kylinos.cn>
Signed-off-by: Steve French <stfrench@microsoft.com>
2025-12-09 21:21:42 -06:00
ChenXiaoSong 9f99caa895 smb/client: fix NT_STATUS_UNABLE_TO_FREE_VM value
This was reported by the KUnit tests in the later patches.

See MS-ERREF 2.3.1 STATUS_UNABLE_TO_FREE_VM. Keep it consistent with the
value in the documentation.

Signed-off-by: ChenXiaoSong <chenxiaosong@kylinos.cn>
Acked-by: Paulo Alcantara (Red Hat) <pc@manguebit.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
2025-12-09 21:20:17 -06:00
ChenXiaoSong b2b50fca34 smb/client: fix NT_STATUS_DEVICE_DOOR_OPEN value
This was reported by the KUnit tests in the later patches.

See MS-ERREF 2.3.1 STATUS_DEVICE_DOOR_OPEN. Keep it consistent with the
value in the documentation.

Signed-off-by: ChenXiaoSong <chenxiaosong@kylinos.cn>
Acked-by: Paulo Alcantara (Red Hat) <pc@manguebit.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
2025-12-09 21:20:01 -06:00
ChenXiaoSong a1237c203f smb/client: fix NT_STATUS_NO_DATA_DETECTED value
This was reported by the KUnit tests in the later patches.

See MS-ERREF 2.3.1 STATUS_NO_DATA_DETECTED. Keep it consistent with the
value in the documentation.

Signed-off-by: ChenXiaoSong <chenxiaosong@kylinos.cn>
Acked-by: Paulo Alcantara (Red Hat) <pc@manguebit.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
2025-12-09 21:19:43 -06:00
ChenXiaoSong 2e0d224d89 smb/server: add comment to FileSystemName of FileFsAttributeInformation
Explained why FileSystemName is always set to "NTFS".

Link: 84392651b0
Signed-off-by: ChenXiaoSong <chenxiaosong@kylinos.cn>
Acked-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
2025-12-09 21:01:36 -06:00
ChenXiaoSong 98def4eb02 smb/server: remove unused nterr.h
KSMBD does not use these NT error code definitions. Instead, it uses the
SMB2 status code definitions defined in common/smb2status.h.

By the way, server/nterr.h contains the following additional definitions
compared to client/nterr.h:

  - NT_STATUS_PENDING
  - NT_STATUS_INVALID_LOCK_RANGE
  - NT_STATUS_NETWORK_SESSION_EXPIRED
  - NT_STATUS_NO_PREAUTH_INTEGRITY_HASH_OVERLAP

We can add them to client/nterr.h in the next patch.

Signed-off-by: ChenXiaoSong <chenxiaosong@kylinos.cn>
Acked-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
2025-12-09 21:01:16 -06:00
ChenXiaoSong 01ab0d1640 smb/server: rename include guard in smb_common.h
Make the include guard more descriptive to avoid conflicts with include
guards that may be used in the future.

Signed-off-by: ChenXiaoSong <chenxiaosong@kylinos.cn>
Acked-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
2025-12-09 21:00:48 -06:00
ChenXiaoSong d8f52650b2 smb/client: update some SMB2 status strings
The smb2maperror KUnit tests reported the following errors:

  KTAP version 1
  1..1
      KTAP version 1
      # Subtest: smb2_maperror
      # module: cifs
      1..2
      ok 1 maperror_test_check_sort
      # maperror_test_check_search: EXPECTATION FAILED at fs/smb/client/smb2maperror_test.c:40
      Expected expect->status_string == result->status_string, but
          expect->status_string == "STATUS_ABANDONED_WAIT_0"
          result->status_string == "STATUS_ABANDONED"
      # maperror_test_check_search: EXPECTATION FAILED at fs/smb/client/smb2maperror_test.c:40
      Expected expect->status_string == result->status_string, but
          expect->status_string == "STATUS_FWP_TOO_MANY_CALLOUTS"
          result->status_string == "STATUS_FWP_TOO_MANY_BOOTTIME_FILTERS"
      not ok 2 maperror_test_check_search
  # smb2_maperror: pass:1 fail:1 skip:0 total:2
  # Totals: pass:1 fail:1 skip:0 total:2
  not ok 1 smb2_maperror

These status codes have duplicate values, so update the status strings to
make the log messages more explicit.

Signed-off-by: ChenXiaoSong <chenxiaosong@kylinos.cn>
Signed-off-by: Steve French <stfrench@microsoft.com>
2025-12-07 11:46:19 -06:00
David Howells 9146c7e53f cifs: Remove dead function prototypes
Remove a bunch of dead function prototypes.

Signed-off-by: David Howells <dhowells@redhat.com>
cc: linux-cifs@vger.kernel.org
cc: linux-fsdevel@vger.kernel.org
Reviewed-by: Paulo Alcantara (Red Hat) <pc@manguebit.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
2025-12-05 17:54:09 -06:00
ChenXiaoSong d159702c94 smb/client: add two elements to smb2_error_map_table array
Both status codes are mapped to -EIO.

Now all status codes from common/smb2status.h are included in the
smb2_error_map_table array(except for the first two zero definitions).

Signed-off-by: ChenXiaoSong <chenxiaosong@kylinos.cn>
Signed-off-by: Steve French <stfrench@microsoft.com>
2025-12-05 17:46:41 -06:00
ChenXiaoSong 523ecd9766 smb: rename to STATUS_SMB_NO_PREAUTH_INTEGRITY_HASH_OVERLAP
See MS-SMB2 3.3.5.4. To keep the name consistent with the documentation.

Additionally, move STATUS_INVALID_LOCK_RANGE to correct position in order.

Signed-off-by: ChenXiaoSong <chenxiaosong@kylinos.cn>
Signed-off-by: Steve French <stfrench@microsoft.com>
2025-12-05 17:46:41 -06:00
ChenXiaoSong bf80d1517d smb/client: remove unused elements from smb2_error_map_table array
STATUS_SUCCESS and STATUS_WAIT_0 are both zero, and since zero indicates
success, they are not needed.

Since smb2_print_status() has been removed, the last element in the array
is no longer needed.

Signed-off-by: ChenXiaoSong <chenxiaosong@kylinos.cn>
Signed-off-by: Steve French <stfrench@microsoft.com>
2025-12-05 17:46:41 -06:00
ChenXiaoSong 6c1eb31ecb smb/client: reduce loop count in map_smb2_to_linux_error() by half
The smb2_error_map_table array currently has 1743 elements. When searching
for the last element and calling smb2_print_status(), 3486 comparisons
are needed.

The loop in smb2_print_status() is unnecessary, smb2_print_status() can be
removed, and only iterate over the array once, printing the message when
the target status code is found.

Signed-off-by: ChenXiaoSong <chenxiaosong@kylinos.cn>
Signed-off-by: Steve French <stfrench@microsoft.com>
2025-12-05 17:46:41 -06:00
Paulo Alcantara 7ad785927d smb: client: Add tracepoint for krb5 auth
Add tracepoint to help debugging krb5 auth failures.

Example:

$ trace-cmd record -e smb3_kerberos_auth
$ mount.cifs ...
$ trace-cmd report
mount.cifs-1667 [003] .....  5810.668549: smb3_kerberos_auth: vers=2
host=w22-dc1.zelda.test ip=192.168.124.30:445 sec=krb5 uid=0 cruid=0
user=root pid=1667 upcall_target=app err=-126

Signed-off-by: Paulo Alcantara (Red Hat) <pc@manguebit.org>
Reviewed-by: David Howells <dhowells@redhat.com>
Cc: Pierguido Lambri <plambri@redhat.com>
Cc: linux-cifs@vger.kernel.org
Signed-off-by: Steve French <stfrench@microsoft.com>
2025-12-05 17:40:42 -06:00
Paulo Alcantara a8fce7c807 smb: client: improve error message when creating SMB session
When failing to create a new SMB session with 'sec=krb5' for example,
the following error message isn't very useful

	CIFS: VFS: \\srv Send error in SessSetup = -126

Improve it by printing the following instead on dmesg

	CIFS: VFS: \\srv failed to create a new SMB session with Kerberos: -126

Signed-off-by: Paulo Alcantara (Red Hat) <pc@manguebit.org>
Cc: Pierguido Lambri <plambri@redhat.com>
Reviewed-by: David Howells <dhowells@redhat.com>
Cc: linux-cifs@vger.kernel.org
Signed-off-by: Steve French <stfrench@microsoft.com>
2025-12-05 17:40:38 -06:00
Paulo Alcantara 855982a52f smb: client: relax session and tcon reconnect attempts
When the client re-establishes connection to the server, it will queue
a worker thread that will attempt to reconnect sessions and tcons on
every two seconds, which is kinda overkill as it is a very common
scenario when having expired passwords or KRB5 TGT tickets, or deleted
shares.

Use an exponential backoff strategy to handle session/tcon reconnect
attempts in the worker thread to prevent the client from overloading
the system when it is very unlikely to re-establish any session/tcon
soon while client is idle.

Signed-off-by: Paulo Alcantara (Red Hat) <pc@manguebit.org>
Reviewed-by: David Howells <dhowells@redhat.com>
Cc: Pierguido Lambri <plambri@redhat.com>
Cc: linux-cifs@vger.kernel.org
Signed-off-by: Steve French <stfrench@microsoft.com>
2025-12-05 17:40:33 -06:00
David Howells 4ae4dde6f3 cifs: Fix handling of a beyond-EOF DIO/unbuffered read over SMB2
If a DIO read or an unbuffered read request extends beyond the EOF, the
server will return a short read and a status code indicating that EOF was
hit, which gets translated to -ENODATA.  Note that the client does not cap
the request at i_size, but asks for the amount requested in case there's a
race on the server with a third party.

Now, on the client side, the request will get split into multiple
subrequests if rsize is smaller than the full request size.  A subrequest
that starts before or at the EOF and returns short data up to the EOF will
be correctly handled, with the NETFS_SREQ_HIT_EOF flag being set,
indicating to netfslib that we can't read more.

If a subrequest, however, starts after the EOF and not at it, HIT_EOF will
not be flagged, its error will be set to -ENODATA and it will be abandoned.
This will cause the request as a whole to fail with -ENODATA.

Fix this by setting NETFS_SREQ_HIT_EOF on any subrequest that lies beyond
the EOF marker.

Fixes: 1da29f2c39 ("netfs, cifs: Fix handling of short DIO read")
Signed-off-by: David Howells <dhowells@redhat.com>
Reviewed-by: Paulo Alcantara (Red Hat) <pc@manguebit.org>
cc: Shyam Prasad N <sprasad@microsoft.com>
cc: linux-cifs@vger.kernel.org
cc: netfs@lists.linux.dev
cc: linux-fsdevel@vger.kernel.org
Signed-off-by: Steve French <stfrench@microsoft.com>
2025-12-05 17:15:11 -06:00
Rajasi Mandal ef529f655a cifs: client: allow changing multichannel mount options on remount
Previously, the client did not update a session's channel state when
multichannel or max_channels mount options were changed via remount.
This led to inconsistent behavior and prevented enabling or disabling
multichannel support without a full unmount/remount cycle.

Enable dynamic reconfiguration of multichannel and max_channels during
remount by:
- Introducing smb3_sync_ses_chan_max(), a centralized function for
  channel updates which synchronizes the session's channels with the
  updated configuration.
- Replacing cifs_disable_secondary_channels() with
  cifs_decrease_secondary_channels(), which accepts a disable_mchan
  flag to support multichannel disable when the server stops supporting
  multichannel.
- Updating remount logic to detect changes in multichannel or
  max_channels and trigger appropriate session/channel updates.

Current limitation:
- The query_interfaces worker runs even when max_channels=1 so that
  multichannel can be enabled later via remount without requiring an
  unmount. This is a temporary approach and may be refined in the
  future.

Users can safely modify multichannel and max_channels on an existing
mount. The client will correctly adjust the session's channel state to
match the new configuration, preserving durability where possible and
avoiding unnecessary disconnects.

Reviewed-by: Shyam Prasad N <sprasad@microsoft.com>
Signed-off-by: Rajasi Mandal <rajasimandal@microsoft.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
2025-12-05 17:14:14 -06:00
David Howells 32a6086809 cifs: Do some preparation prior to organising the function declarations
Make some preparatory cleanups prior to running a script to organise the
function declarations within the fs/smb/client/ headers.  These include:

 (1) Remove "inline" from the dummy cifs_proc_init/clean() functions as
     they are in a .c file.

 (2) Move should_compress()'s kdoc comment to the .c file and remove kdoc
     markers from the comments.

 (3) Rename CIFS_ALLOW_INSECURE_LEGACY in #endif comments to have CONFIG_
     on the front to allow the script to recognise it.

 (4) Don't let comments have bare words at the left margin as that confused
     the simplistic function detection code in the script.

 (5) Adjust some argument lists so that when and if the cleanup script is
     run they don't end up over 100 chars.

 (6) Fix a few comments to have missing '*' added or the "*/" moved to
     their own lines so that checkpatch doesn't moan over the cleanup
     script patch.

 (7) Move struct cifs_calc_sig_ctx to cifsglob.h.

 (8) Remove some __KERNEL__ conditionals.

Signed-off-by: David Howells <dhowells@redhat.com>
Reviewed-by: Paulo Alcantara (Red Hat) <pc@manguebit.org>
cc: linux-cifs@vger.kernel.org
Signed-off-by: Steve French <stfrench@microsoft.com>
2025-12-05 17:11:55 -06:00
David Howells f80ac7eda1 cifs: Add a tracepoint to log EIO errors
Add a tracepoint to log EIO errors and give it the capacity to convey up to
two integers of information.  This is then wrapped with three functions:

 int smb_EIO(enum smb_eio_trace trace)
 int smb_EIO1(enum smb_eio_trace trace, unsigned long info)
 int smb_EIO2(enum smb_eio_trace trace, unsigned long info,
	      unsigned long info2)

depending on how many bits of info are desired to be logged with any
particular trace.  The functions all return -EIO and can be used in place
of -EIO.

The trace argument is an enum value that gets translated to a string when
the trace is printed.

This makes is easier to log EIO instances when the client is under high
load than turning on a printk wrapper such as cifs_dbg().  Granted, EIO
could have its own separate EIO printing since EIO shouldn't happen.

Signed-off-by: David Howells <dhowells@redhat.com>
Reviewed-by: Paulo Alcantara (Red Hat) <pc@manguebit.org>
cc: linux-cifs@vger.kernel.org
cc: linux-fsdevel@vger.kernel.org
Signed-off-by: Steve French <stfrench@microsoft.com>
2025-12-05 17:11:43 -06:00
David Howells 3a7b6d0afe cifs: Don't need state locking in smb2_get_mid_entry()
There's no need to get ->srv_lock or ->ses_lock in smb2_get_mid_entry() as
all that happens of relevance (to the lock) inside the locked sections is
the reading of one status value in each.

Replace the locking with READ_ONCE() and use a switch instead of a chain of
if-statements.

Signed-off-by: David Howells <dhowells@redhat.com>
Reviewed-by: Paulo Alcantara (Red Hat) <pc@manguebit.org>
cc: Shyam Prasad N <sprasad@microsoft.com>
cc: Tom Talpey <tom@talpey.com>
cc: linux-cifs@vger.kernel.org
cc: netfs@lists.linux.dev
cc: linux-fsdevel@vger.kernel.org
Signed-off-by: Steve French <stfrench@microsoft.com>
2025-12-05 17:11:06 -06:00
David Howells 87fba18abb cifs: Remove the server pointer from smb_message
Remove the server pointer from smb_message and instead pass it down to all
the things that access it.

Signed-off-by: David Howells <dhowells@redhat.com>
Reviewed-by: Paulo Alcantara (Red Hat) <pc@manguebit.org>
cc: Shyam Prasad N <sprasad@microsoft.com>
cc: Tom Talpey <tom@talpey.com> (RDMA, smbdirect)
cc: linux-cifs@vger.kernel.org
cc: netfs@lists.linux.dev
cc: linux-fsdevel@vger.kernel.org
Signed-off-by: Steve French <stfrench@microsoft.com>
2025-12-05 17:10:48 -06:00
David Howells 6a86a4cc28 cifs: Fix specification of function pointers
Change the mid_receive_t, mid_callback_t and mid_handle_t function pointers
to have the pointer marker in the typedef.

Signed-off-by: David Howells <dhowells@redhat.com>
Reviewed-by: Paulo Alcantara (Red Hat) <pc@manguebit.org>
cc: linux-cifs@vger.kernel.org
Signed-off-by: Steve French <stfrench@microsoft.com>
2025-12-05 17:10:13 -06:00
David Howells 28405cb5b2 cifs: Replace SendReceiveBlockingLock() with SendReceive() plus flags
Replace the smb1 transport's SendReceiveBlockingLock() with SendReceive()
plus a couple of flags.  This will then allow that to pick up the transport
changes there.

The first flag, CIFS_INTERRUPTIBLE_WAIT, is added to indicate that the wait
should be interruptible and the second, CIFS_WINDOWS_LOCK, indicates that
we need to send a Lock command with unlock type rather than a Cancel.

send_lock_cancel() is then called from cifs_lock_cancel() which is called
from the main transport loop in compound_send_recv().

[!] I *think* the error code handling is probably right.

Signed-off-by: David Howells <dhowells@redhat.com>
Reviewed-by: Paulo Alcantara (Red Hat) <pc@manguebit.org>
cc: Shyam Prasad N <sprasad@microsoft.com>
cc: Tom Talpey <tom@talpey.com>
cc: linux-cifs@vger.kernel.org
cc: netfs@lists.linux.dev
cc: linux-fsdevel@vger.kernel.org
Signed-off-by: Steve French <stfrench@microsoft.com>
2025-12-05 17:10:05 -06:00
David Howells 62432a3f51 cifs: Clean up some places where an extra kvec[] was required for rfc1002
Clean up some places where previously an extra element in the kvec array
was being used to hold an rfc1002 header for SMB1 (a previous patch removed
this and generated it on the fly as for SMB2/3).

Signed-off-by: David Howells <dhowells@redhat.com>
Reviewed-by: Paulo Alcantara (Red Hat) <pc@manguebit.org>
cc: Shyam Prasad N <sprasad@microsoft.com>
cc: Tom Talpey <tom@talpey.com>
cc: linux-cifs@vger.kernel.org
cc: netfs@lists.linux.dev
cc: linux-fsdevel@vger.kernel.org
Signed-off-by: Steve French <stfrench@microsoft.com>
2025-12-05 17:10:00 -06:00
David Howells 6be09580df cifs: Make smb1's SendReceive() wrap cifs_send_recv()
Make the smb1 transport's SendReceive() simply wrap cifs_send_recv() as
does SendReceive2().  This will then allow that to pick up the transport
changes there.

Signed-off-by: David Howells <dhowells@redhat.com>
Reviewed-by: Paulo Alcantara (Red Hat) <pc@manguebit.org>
cc: Shyam Prasad N <sprasad@microsoft.com>
cc: Tom Talpey <tom@talpey.com>
cc: linux-cifs@vger.kernel.org
cc: netfs@lists.linux.dev
cc: linux-fsdevel@vger.kernel.org
Signed-off-by: Steve French <stfrench@microsoft.com>
2025-12-05 17:09:47 -06:00
David Howells 83bfbd0bb9 cifs: Remove the RFC1002 header from smb_hdr
Remove the RFC1002 header from struct smb_hdr as used for SMB-1.0.  This
simplifies the SMB-1.0 code by simplifying a lot of places that have to add
or subtract 4 to work around the fact that the RFC1002 header isn't really
part of the message and the base for various offsets within the message is
from the base of the smb_hdr, not the RFC1002 header.

Further, clean up a bunch of places that require an extra kvec struct
specifically pointing to the RFC1002 header, such that kvec[0].iov_base
must be exactly 4 bytes before kvec[1].iov_base.

This allows the header preamble size stuff to be removed too.

The size of the request and response message are then handed around either
directly or by summing the size of all the iov_len members in the kvec
array for which we have a count.

Also, this simplifies and cleans up the common transmission and receive
paths for SMB1 and SMB2/3 as there no longer needs to be special handling
casing for SMB1 messages as the RFC1002 header is now generated on the fly
for SMB1 as it is for SMB2/3.

Signed-off-by: David Howells <dhowells@redhat.com>
Reviewed-by: Tom Talpey <tom@talpey.com>
Reviewed-by: Paulo Alcantara (Red Hat) <pc@manguebit.org>
cc: Shyam Prasad N <sprasad@microsoft.com>
cc: linux-cifs@vger.kernel.org
cc: netfs@lists.linux.dev
cc: linux-fsdevel@vger.kernel.org
Signed-off-by: Steve French <stfrench@microsoft.com>
2025-12-05 17:09:32 -06:00
David Howells 9d85ac939d cifs: Fix handling of a beyond-EOF DIO/unbuffered read over SMB1
If a DIO read or an unbuffered read request extends beyond the EOF, the
server will return a short read and a status code indicating that EOF was
hit, which gets translated to -ENODATA.  Note that the client does not cap
the request at i_size, but asks for the amount requested in case there's a
race on the server with a third party.

Now, on the client side, the request will get split into multiple
subrequests if rsize is smaller than the full request size.  A subrequest
that starts before or at the EOF and returns short data up to the EOF will
be correctly handled, with the NETFS_SREQ_HIT_EOF flag being set,
indicating to netfslib that we can't read more.

If a subrequest, however, starts after the EOF and not at it, HIT_EOF will
not be flagged, its error will be set to -ENODATA and it will be abandoned.
This will cause the request as a whole to fail with -ENODATA.

Fix this by setting NETFS_SREQ_HIT_EOF on any subrequest that lies beyond
the EOF marker.

This can be reproduced by mounting with "cache=none,sign,vers=1.0" and
doing a read of a file that's significantly bigger than the size of the
file (e.g. attempting to read 64KiB from a 16KiB file).

Fixes: a68c74865f ("cifs: Fix SMB1 readv/writev callback in the same way as SMB2/3")
Signed-off-by: David Howells <dhowells@redhat.com>
Reviewed-by: Paulo Alcantara (Red Hat) <pc@manguebit.org>
cc: Shyam Prasad N <sprasad@microsoft.com>
cc: linux-cifs@vger.kernel.org
cc: netfs@lists.linux.dev
cc: linux-fsdevel@vger.kernel.org
Signed-off-by: Steve French <stfrench@microsoft.com>
2025-12-05 17:09:28 -06:00
Rajasi Mandal 1ef15fbe67 cifs: client: enforce consistent handling of multichannel and max_channels
Previously, the behavior of the multichannel and max_channels mount
options was inconsistent and order-dependent. For example, specifying
"multichannel,max_channels=1" would result in 2 channels, while
"max_channels=1,multichannel" would result in 1 channel. Additionally,
conflicting combinations such as "nomultichannel,max_channels=3" or
"multichannel,max_channels=1" did not produce errors and could lead to
unexpected channel counts.

This commit introduces two new fields in smb3_fs_context to explicitly
track whether multichannel and max_channels were specified during
mount. The option parsing and validation logic is updated to ensure:
- The outcome is no longer dependent on the order of options.
- Conflicting combinations (e.g., "nomultichannel,max_channels=3" or
  "multichannel,max_channels=1") are detected and result in an error.
- The number of channels created is consistent with the specified
  options.

This improves the reliability and predictability of mount option
handling for SMB3 multichannel support.

Reviewed-by: Shyam Prasad N <sprasad@microsoft.com>
Signed-off-by: Rajasi Mandal <rajasimandal@microsoft.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
2025-12-03 23:32:44 -06:00
Linus Torvalds 869737543b Forty four smb client and server changesets
-----BEGIN PGP SIGNATURE-----
 
 iQGzBAABCgAdFiEE6fsu8pdIjtWE/DpLiiy9cAdyT1EFAmktxl0ACgkQiiy9cAdy
 T1HI7AwAtnKyyIWfKwSnsGNTTc3LrT6ucx0DpCw1tqU7TBDLJtNPbQlgzL2rNCiv
 cL6TTxn+qWTLfgJChQnypsCpoiQXwtqNBpfxQaoCOcwG+fUaa9G1JXxEmgv/Ob7j
 KTrYHrnPS6YCQMDLMrEJh8tnI9jHcTgLtYCtDC+psYRzcbs/8Wfgs1Ek/vKW5Ui1
 u0nKYf189KZA9UErTY7NhizyYNkifKD0n+DQPzR1FH6JWusWNRtj9MZPgoEsexXK
 NxfDoc8krWwM7O+6X10ER7Snzd9EUtnbgwIqCFhDS6igfz+w+7Hm/XevOhK+DQqX
 ApmFZL3n6yEUCnOZTQCqHutlChu1j8gWmEAnoGSmBJ3y99NvNqxBfedGDA8DGgFM
 wkX6bxCJjpBMrMeLqVv0QXaXLkRycZASz5zVgb/ly3Zu6DnDlFzRYFUBNvXHb+M/
 WFMtzV2Jzd4I09J460b0qU18iuSVxxyJNGVp6xzo++zdNUSt07UYXK/R7NCIaCXO
 buCHlQll
 =QmyI
 -----END PGP SIGNATURE-----

Merge tag 'v6.19-rc-smb-fixes' of git://git.samba.org/ksmbd

Pull smb client and server updates from Steve French:

 - server fixes:
     - IPC use after free locking fix
     - fix locking bug in delete paths
     - fix use after free in disconnect
     - fix underflow in locking check
     - error mapping improvement
     - socket listening improvement
     - return code mapping fixes
     - crypto improvements (use default libraries)

 - cleanup patches:
     - netfs
     - client checkpatch cleanup
     - server cleanup
     - move server/client duplicate code to common code
     - fix some defines to better match protocol specification

  - smbdirect (RDMA) fixes

  - client debugging improvements for leases

* tag 'v6.19-rc-smb-fixes' of git://git.samba.org/ksmbd: (44 commits)
  cifs: Use netfs_alloc/free_folioq_buffer()
  smb: client: show smb lease key in open_dirs output
  smb: client: show smb lease key in open_files output
  ksmbd: ipc: fix use-after-free in ipc_msg_send_request
  smb: client: relax WARN_ON_ONCE(SMBDIRECT_SOCKET_*) checks in recv_done() and smbd_conn_upcall()
  smb: server: relax WARN_ON_ONCE(SMBDIRECT_SOCKET_*) checks in recv_done() and smb_direct_cm_handler()
  smb: smbdirect: introduce SMBDIRECT_CHECK_STATUS_{WARN,DISCONNECT}()
  smb: smbdirect: introduce SMBDIRECT_DEBUG_ERR_PTR() helper
  ksmbd: vfs: fix race on m_flags in vfs_cache
  ksmbd: Replace strcpy + strcat to improve convert_to_nt_pathname
  smb: move FILE_SYSTEM_ATTRIBUTE_INFO to common/fscc.h
  ksmbd: implement error handling for STATUS_INFO_LENGTH_MISMATCH in smb server
  ksmbd: fix use-after-free in ksmbd_tree_connect_put under concurrency
  ksmbd: server: avoid busy polling in accept loop
  smb: move create_durable_reconn to common/smb2pdu.h
  smb: fix some warnings reported by scripts/checkpatch.pl
  smb: do some cleanups
  smb: move FILE_SYSTEM_SIZE_INFO to common/fscc.h
  smb: move some duplicate struct definitions to common/fscc.h
  smb: move list of FileSystemAttributes to common/fscc.h
  ...
2025-12-03 20:23:41 -08:00