request.c 20 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818
  1. /*
  2. * request.c
  3. *
  4. * Copyright (C) 2001 by Urban Widmark
  5. *
  6. * Please add a note about your changes to smbfs in the ChangeLog file.
  7. */
  8. #include <linux/types.h>
  9. #include <linux/fs.h>
  10. #include <linux/slab.h>
  11. #include <linux/net.h>
  12. #include <linux/smb_fs.h>
  13. #include <linux/smbno.h>
  14. #include <linux/smb_mount.h>
  15. #include "smb_debug.h"
  16. #include "request.h"
  17. #include "proto.h"
  18. /* #define SMB_SLAB_DEBUG (SLAB_RED_ZONE | SLAB_POISON) */
  19. #define SMB_SLAB_DEBUG 0
  20. #define ROUND_UP(x) (((x)+3) & ~3)
  21. /* cache for request structures */
  22. static struct kmem_cache *req_cachep;
  23. static int smb_request_send_req(struct smb_request *req);
  24. /*
  25. /proc/slabinfo:
  26. name, active, num, objsize, active_slabs, num_slaps, #pages
  27. */
  28. int smb_init_request_cache(void)
  29. {
  30. req_cachep = kmem_cache_create("smb_request",
  31. sizeof(struct smb_request), 0,
  32. SMB_SLAB_DEBUG | SLAB_HWCACHE_ALIGN,
  33. NULL, NULL);
  34. if (req_cachep == NULL)
  35. return -ENOMEM;
  36. return 0;
  37. }
  38. void smb_destroy_request_cache(void)
  39. {
  40. kmem_cache_destroy(req_cachep);
  41. }
  42. /*
  43. * Allocate and initialise a request structure
  44. */
  45. static struct smb_request *smb_do_alloc_request(struct smb_sb_info *server,
  46. int bufsize)
  47. {
  48. struct smb_request *req;
  49. unsigned char *buf = NULL;
  50. req = kmem_cache_zalloc(req_cachep, GFP_KERNEL);
  51. VERBOSE("allocating request: %p\n", req);
  52. if (!req)
  53. goto out;
  54. if (bufsize > 0) {
  55. buf = kmalloc(bufsize, GFP_NOFS);
  56. if (!buf) {
  57. kmem_cache_free(req_cachep, req);
  58. return NULL;
  59. }
  60. }
  61. req->rq_buffer = buf;
  62. req->rq_bufsize = bufsize;
  63. req->rq_server = server;
  64. init_waitqueue_head(&req->rq_wait);
  65. INIT_LIST_HEAD(&req->rq_queue);
  66. atomic_set(&req->rq_count, 1);
  67. out:
  68. return req;
  69. }
  70. struct smb_request *smb_alloc_request(struct smb_sb_info *server, int bufsize)
  71. {
  72. struct smb_request *req = NULL;
  73. for (;;) {
  74. atomic_inc(&server->nr_requests);
  75. if (atomic_read(&server->nr_requests) <= MAX_REQUEST_HARD) {
  76. req = smb_do_alloc_request(server, bufsize);
  77. if (req != NULL)
  78. break;
  79. }
  80. #if 0
  81. /*
  82. * Try to free up at least one request in order to stay
  83. * below the hard limit
  84. */
  85. if (nfs_try_to_free_pages(server))
  86. continue;
  87. if (signalled() && (server->flags & NFS_MOUNT_INTR))
  88. return ERR_PTR(-ERESTARTSYS);
  89. current->policy = SCHED_YIELD;
  90. schedule();
  91. #else
  92. /* FIXME: we want something like nfs does above, but that
  93. requires changes to all callers and can wait. */
  94. break;
  95. #endif
  96. }
  97. return req;
  98. }
  99. static void smb_free_request(struct smb_request *req)
  100. {
  101. atomic_dec(&req->rq_server->nr_requests);
  102. if (req->rq_buffer && !(req->rq_flags & SMB_REQ_STATIC))
  103. kfree(req->rq_buffer);
  104. kfree(req->rq_trans2buffer);
  105. kmem_cache_free(req_cachep, req);
  106. }
  107. /*
  108. * What prevents a rget to race with a rput? The count must never drop to zero
  109. * while it is in use. Only rput if it is ok that it is free'd.
  110. */
  111. static void smb_rget(struct smb_request *req)
  112. {
  113. atomic_inc(&req->rq_count);
  114. }
  115. void smb_rput(struct smb_request *req)
  116. {
  117. if (atomic_dec_and_test(&req->rq_count)) {
  118. list_del_init(&req->rq_queue);
  119. smb_free_request(req);
  120. }
  121. }
  122. /* setup to receive the data part of the SMB */
  123. static int smb_setup_bcc(struct smb_request *req)
  124. {
  125. int result = 0;
  126. req->rq_rlen = smb_len(req->rq_header) + 4 - req->rq_bytes_recvd;
  127. if (req->rq_rlen > req->rq_bufsize) {
  128. PARANOIA("Packet too large %d > %d\n",
  129. req->rq_rlen, req->rq_bufsize);
  130. return -ENOBUFS;
  131. }
  132. req->rq_iov[0].iov_base = req->rq_buffer;
  133. req->rq_iov[0].iov_len = req->rq_rlen;
  134. req->rq_iovlen = 1;
  135. return result;
  136. }
  137. /*
  138. * Prepare a "normal" request structure.
  139. */
  140. static int smb_setup_request(struct smb_request *req)
  141. {
  142. int len = smb_len(req->rq_header) + 4;
  143. req->rq_slen = len;
  144. /* if we expect a data part in the reply we set the iov's to read it */
  145. if (req->rq_resp_bcc)
  146. req->rq_setup_read = smb_setup_bcc;
  147. /* This tries to support re-using the same request */
  148. req->rq_bytes_sent = 0;
  149. req->rq_rcls = 0;
  150. req->rq_err = 0;
  151. req->rq_errno = 0;
  152. req->rq_fragment = 0;
  153. kfree(req->rq_trans2buffer);
  154. req->rq_trans2buffer = NULL;
  155. return 0;
  156. }
  157. /*
  158. * Prepare a transaction2 request structure
  159. */
  160. static int smb_setup_trans2request(struct smb_request *req)
  161. {
  162. struct smb_sb_info *server = req->rq_server;
  163. int mparam, mdata;
  164. static unsigned char padding[4];
  165. /* I know the following is very ugly, but I want to build the
  166. smb packet as efficiently as possible. */
  167. const int smb_parameters = 15;
  168. const int header = SMB_HEADER_LEN + 2 * smb_parameters + 2;
  169. const int oparam = ROUND_UP(header + 3);
  170. const int odata = ROUND_UP(oparam + req->rq_lparm);
  171. const int bcc = (req->rq_data ? odata + req->rq_ldata :
  172. oparam + req->rq_lparm) - header;
  173. if ((bcc + oparam) > server->opt.max_xmit)
  174. return -ENOMEM;
  175. smb_setup_header(req, SMBtrans2, smb_parameters, bcc);
  176. /*
  177. * max parameters + max data + max setup == bufsize to make NT4 happy
  178. * and not abort the transfer or split into multiple responses. It also
  179. * makes smbfs happy as handling packets larger than the buffer size
  180. * is extra work.
  181. *
  182. * OS/2 is probably going to hate me for this ...
  183. */
  184. mparam = SMB_TRANS2_MAX_PARAM;
  185. mdata = req->rq_bufsize - mparam;
  186. mdata = server->opt.max_xmit - mparam - 100;
  187. if (mdata < 1024) {
  188. mdata = 1024;
  189. mparam = 20;
  190. }
  191. #if 0
  192. /* NT/win2k has ~4k max_xmit, so with this we request more than it wants
  193. to return as one SMB. Useful for testing the fragmented trans2
  194. handling. */
  195. mdata = 8192;
  196. #endif
  197. WSET(req->rq_header, smb_tpscnt, req->rq_lparm);
  198. WSET(req->rq_header, smb_tdscnt, req->rq_ldata);
  199. WSET(req->rq_header, smb_mprcnt, mparam);
  200. WSET(req->rq_header, smb_mdrcnt, mdata);
  201. WSET(req->rq_header, smb_msrcnt, 0); /* max setup always 0 ? */
  202. WSET(req->rq_header, smb_flags, 0);
  203. DSET(req->rq_header, smb_timeout, 0);
  204. WSET(req->rq_header, smb_pscnt, req->rq_lparm);
  205. WSET(req->rq_header, smb_psoff, oparam - 4);
  206. WSET(req->rq_header, smb_dscnt, req->rq_ldata);
  207. WSET(req->rq_header, smb_dsoff, req->rq_data ? odata - 4 : 0);
  208. *(req->rq_header + smb_suwcnt) = 0x01; /* setup count */
  209. *(req->rq_header + smb_suwcnt + 1) = 0x00; /* reserved */
  210. WSET(req->rq_header, smb_setup0, req->rq_trans2_command);
  211. req->rq_iovlen = 2;
  212. req->rq_iov[0].iov_base = (void *) req->rq_header;
  213. req->rq_iov[0].iov_len = oparam;
  214. req->rq_iov[1].iov_base = (req->rq_parm==NULL) ? padding : req->rq_parm;
  215. req->rq_iov[1].iov_len = req->rq_lparm;
  216. req->rq_slen = oparam + req->rq_lparm;
  217. if (req->rq_data) {
  218. req->rq_iovlen += 2;
  219. req->rq_iov[2].iov_base = padding;
  220. req->rq_iov[2].iov_len = odata - oparam - req->rq_lparm;
  221. req->rq_iov[3].iov_base = req->rq_data;
  222. req->rq_iov[3].iov_len = req->rq_ldata;
  223. req->rq_slen = odata + req->rq_ldata;
  224. }
  225. /* always a data part for trans2 replies */
  226. req->rq_setup_read = smb_setup_bcc;
  227. return 0;
  228. }
  229. /*
  230. * Add a request and tell smbiod to process it
  231. */
  232. int smb_add_request(struct smb_request *req)
  233. {
  234. long timeleft;
  235. struct smb_sb_info *server = req->rq_server;
  236. int result = 0;
  237. smb_setup_request(req);
  238. if (req->rq_trans2_command) {
  239. if (req->rq_buffer == NULL) {
  240. PARANOIA("trans2 attempted without response buffer!\n");
  241. return -EIO;
  242. }
  243. result = smb_setup_trans2request(req);
  244. }
  245. if (result < 0)
  246. return result;
  247. #ifdef SMB_DEBUG_PACKET_SIZE
  248. add_xmit_stats(req);
  249. #endif
  250. /* add 'req' to the queue of requests */
  251. if (smb_lock_server_interruptible(server))
  252. return -EINTR;
  253. /*
  254. * Try to send the request as the process. If that fails we queue the
  255. * request and let smbiod send it later.
  256. */
  257. /* FIXME: each server has a number on the maximum number of parallel
  258. requests. 10, 50 or so. We should not allow more requests to be
  259. active. */
  260. if (server->mid > 0xf000)
  261. server->mid = 0;
  262. req->rq_mid = server->mid++;
  263. WSET(req->rq_header, smb_mid, req->rq_mid);
  264. result = 0;
  265. if (server->state == CONN_VALID) {
  266. if (list_empty(&server->xmitq))
  267. result = smb_request_send_req(req);
  268. if (result < 0) {
  269. /* Connection lost? */
  270. server->conn_error = result;
  271. server->state = CONN_INVALID;
  272. }
  273. }
  274. if (result != 1)
  275. list_add_tail(&req->rq_queue, &server->xmitq);
  276. smb_rget(req);
  277. if (server->state != CONN_VALID)
  278. smbiod_retry(server);
  279. smb_unlock_server(server);
  280. smbiod_wake_up();
  281. timeleft = wait_event_interruptible_timeout(req->rq_wait,
  282. req->rq_flags & SMB_REQ_RECEIVED, 30*HZ);
  283. if (!timeleft || signal_pending(current)) {
  284. /*
  285. * On timeout or on interrupt we want to try and remove the
  286. * request from the recvq/xmitq.
  287. * First check if the request is still part of a queue. (May
  288. * have been removed by some error condition)
  289. */
  290. smb_lock_server(server);
  291. if (!list_empty(&req->rq_queue)) {
  292. list_del_init(&req->rq_queue);
  293. smb_rput(req);
  294. }
  295. smb_unlock_server(server);
  296. }
  297. if (!timeleft) {
  298. PARANOIA("request [%p, mid=%d] timed out!\n",
  299. req, req->rq_mid);
  300. VERBOSE("smb_com: %02x\n", *(req->rq_header + smb_com));
  301. VERBOSE("smb_rcls: %02x\n", *(req->rq_header + smb_rcls));
  302. VERBOSE("smb_flg: %02x\n", *(req->rq_header + smb_flg));
  303. VERBOSE("smb_tid: %04x\n", WVAL(req->rq_header, smb_tid));
  304. VERBOSE("smb_pid: %04x\n", WVAL(req->rq_header, smb_pid));
  305. VERBOSE("smb_uid: %04x\n", WVAL(req->rq_header, smb_uid));
  306. VERBOSE("smb_mid: %04x\n", WVAL(req->rq_header, smb_mid));
  307. VERBOSE("smb_wct: %02x\n", *(req->rq_header + smb_wct));
  308. req->rq_rcls = ERRSRV;
  309. req->rq_err = ERRtimeout;
  310. /* Just in case it was "stuck" */
  311. smbiod_wake_up();
  312. }
  313. VERBOSE("woke up, rcls=%d\n", req->rq_rcls);
  314. if (req->rq_rcls != 0)
  315. req->rq_errno = smb_errno(req);
  316. if (signal_pending(current))
  317. req->rq_errno = -ERESTARTSYS;
  318. return req->rq_errno;
  319. }
  320. /*
  321. * Send a request and place it on the recvq if successfully sent.
  322. * Must be called with the server lock held.
  323. */
  324. static int smb_request_send_req(struct smb_request *req)
  325. {
  326. struct smb_sb_info *server = req->rq_server;
  327. int result;
  328. if (req->rq_bytes_sent == 0) {
  329. WSET(req->rq_header, smb_tid, server->opt.tid);
  330. WSET(req->rq_header, smb_pid, 1);
  331. WSET(req->rq_header, smb_uid, server->opt.server_uid);
  332. }
  333. result = smb_send_request(req);
  334. if (result < 0 && result != -EAGAIN)
  335. goto out;
  336. result = 0;
  337. if (!(req->rq_flags & SMB_REQ_TRANSMITTED))
  338. goto out;
  339. list_move_tail(&req->rq_queue, &server->recvq);
  340. result = 1;
  341. out:
  342. return result;
  343. }
  344. /*
  345. * Sends one request for this server. (smbiod)
  346. * Must be called with the server lock held.
  347. * Returns: <0 on error
  348. * 0 if no request could be completely sent
  349. * 1 if all data for one request was sent
  350. */
  351. int smb_request_send_server(struct smb_sb_info *server)
  352. {
  353. struct list_head *head;
  354. struct smb_request *req;
  355. int result;
  356. if (server->state != CONN_VALID)
  357. return 0;
  358. /* dequeue first request, if any */
  359. req = NULL;
  360. head = server->xmitq.next;
  361. if (head != &server->xmitq) {
  362. req = list_entry(head, struct smb_request, rq_queue);
  363. }
  364. if (!req)
  365. return 0;
  366. result = smb_request_send_req(req);
  367. if (result < 0) {
  368. server->conn_error = result;
  369. list_move(&req->rq_queue, &server->xmitq);
  370. result = -EIO;
  371. goto out;
  372. }
  373. out:
  374. return result;
  375. }
  376. /*
  377. * Try to find a request matching this "mid". Typically the first entry will
  378. * be the matching one.
  379. */
  380. static struct smb_request *find_request(struct smb_sb_info *server, int mid)
  381. {
  382. struct list_head *tmp;
  383. struct smb_request *req = NULL;
  384. list_for_each(tmp, &server->recvq) {
  385. req = list_entry(tmp, struct smb_request, rq_queue);
  386. if (req->rq_mid == mid) {
  387. break;
  388. }
  389. req = NULL;
  390. }
  391. if (!req) {
  392. VERBOSE("received reply with mid %d but no request!\n",
  393. WVAL(server->header, smb_mid));
  394. server->rstate = SMB_RECV_DROP;
  395. }
  396. return req;
  397. }
  398. /*
  399. * Called when we have read the smb header and believe this is a response.
  400. */
  401. static int smb_init_request(struct smb_sb_info *server, struct smb_request *req)
  402. {
  403. int hdrlen, wct;
  404. memcpy(req->rq_header, server->header, SMB_HEADER_LEN);
  405. wct = *(req->rq_header + smb_wct);
  406. if (wct > 20) {
  407. PARANOIA("wct too large, %d > 20\n", wct);
  408. server->rstate = SMB_RECV_DROP;
  409. return 0;
  410. }
  411. req->rq_resp_wct = wct;
  412. hdrlen = SMB_HEADER_LEN + wct*2 + 2;
  413. VERBOSE("header length: %d smb_wct: %2d\n", hdrlen, wct);
  414. req->rq_bytes_recvd = SMB_HEADER_LEN;
  415. req->rq_rlen = hdrlen;
  416. req->rq_iov[0].iov_base = req->rq_header;
  417. req->rq_iov[0].iov_len = hdrlen;
  418. req->rq_iovlen = 1;
  419. server->rstate = SMB_RECV_PARAM;
  420. #ifdef SMB_DEBUG_PACKET_SIZE
  421. add_recv_stats(smb_len(server->header));
  422. #endif
  423. return 0;
  424. }
  425. /*
  426. * Reads the SMB parameters
  427. */
  428. static int smb_recv_param(struct smb_sb_info *server, struct smb_request *req)
  429. {
  430. int result;
  431. result = smb_receive(server, req);
  432. if (result < 0)
  433. return result;
  434. if (req->rq_bytes_recvd < req->rq_rlen)
  435. return 0;
  436. VERBOSE("result: %d smb_bcc: %04x\n", result,
  437. WVAL(req->rq_header, SMB_HEADER_LEN +
  438. (*(req->rq_header + smb_wct) * 2)));
  439. result = 0;
  440. req->rq_iov[0].iov_base = NULL;
  441. req->rq_rlen = 0;
  442. if (req->rq_callback)
  443. req->rq_callback(req);
  444. else if (req->rq_setup_read)
  445. result = req->rq_setup_read(req);
  446. if (result < 0) {
  447. server->rstate = SMB_RECV_DROP;
  448. return result;
  449. }
  450. server->rstate = req->rq_rlen > 0 ? SMB_RECV_DATA : SMB_RECV_END;
  451. req->rq_bytes_recvd = 0; // recvd out of the iov
  452. VERBOSE("rlen: %d\n", req->rq_rlen);
  453. if (req->rq_rlen < 0) {
  454. PARANOIA("Parameters read beyond end of packet!\n");
  455. server->rstate = SMB_RECV_END;
  456. return -EIO;
  457. }
  458. return 0;
  459. }
  460. /*
  461. * Reads the SMB data
  462. */
  463. static int smb_recv_data(struct smb_sb_info *server, struct smb_request *req)
  464. {
  465. int result;
  466. result = smb_receive(server, req);
  467. if (result < 0)
  468. goto out;
  469. if (req->rq_bytes_recvd < req->rq_rlen)
  470. goto out;
  471. server->rstate = SMB_RECV_END;
  472. out:
  473. VERBOSE("result: %d\n", result);
  474. return result;
  475. }
  476. /*
  477. * Receive a transaction2 response
  478. * Return: 0 if the response has been fully read
  479. * 1 if there are further "fragments" to read
  480. * <0 if there is an error
  481. */
  482. static int smb_recv_trans2(struct smb_sb_info *server, struct smb_request *req)
  483. {
  484. unsigned char *inbuf;
  485. unsigned int parm_disp, parm_offset, parm_count, parm_tot;
  486. unsigned int data_disp, data_offset, data_count, data_tot;
  487. int hdrlen = SMB_HEADER_LEN + req->rq_resp_wct*2 - 2;
  488. VERBOSE("handling trans2\n");
  489. inbuf = req->rq_header;
  490. data_tot = WVAL(inbuf, smb_tdrcnt);
  491. parm_tot = WVAL(inbuf, smb_tprcnt);
  492. parm_disp = WVAL(inbuf, smb_prdisp);
  493. parm_offset = WVAL(inbuf, smb_proff);
  494. parm_count = WVAL(inbuf, smb_prcnt);
  495. data_disp = WVAL(inbuf, smb_drdisp);
  496. data_offset = WVAL(inbuf, smb_droff);
  497. data_count = WVAL(inbuf, smb_drcnt);
  498. /* Modify offset for the split header/buffer we use */
  499. if (data_count || data_offset) {
  500. if (unlikely(data_offset < hdrlen))
  501. goto out_bad_data;
  502. else
  503. data_offset -= hdrlen;
  504. }
  505. if (parm_count || parm_offset) {
  506. if (unlikely(parm_offset < hdrlen))
  507. goto out_bad_parm;
  508. else
  509. parm_offset -= hdrlen;
  510. }
  511. if (parm_count == parm_tot && data_count == data_tot) {
  512. /*
  513. * This packet has all the trans2 data.
  514. *
  515. * We setup the request so that this will be the common
  516. * case. It may be a server error to not return a
  517. * response that fits.
  518. */
  519. VERBOSE("single trans2 response "
  520. "dcnt=%u, pcnt=%u, doff=%u, poff=%u\n",
  521. data_count, parm_count,
  522. data_offset, parm_offset);
  523. req->rq_ldata = data_count;
  524. req->rq_lparm = parm_count;
  525. req->rq_data = req->rq_buffer + data_offset;
  526. req->rq_parm = req->rq_buffer + parm_offset;
  527. if (unlikely(parm_offset + parm_count > req->rq_rlen))
  528. goto out_bad_parm;
  529. if (unlikely(data_offset + data_count > req->rq_rlen))
  530. goto out_bad_data;
  531. return 0;
  532. }
  533. VERBOSE("multi trans2 response "
  534. "frag=%d, dcnt=%u, pcnt=%u, doff=%u, poff=%u\n",
  535. req->rq_fragment,
  536. data_count, parm_count,
  537. data_offset, parm_offset);
  538. if (!req->rq_fragment) {
  539. int buf_len;
  540. /* We got the first trans2 fragment */
  541. req->rq_fragment = 1;
  542. req->rq_total_data = data_tot;
  543. req->rq_total_parm = parm_tot;
  544. req->rq_ldata = 0;
  545. req->rq_lparm = 0;
  546. buf_len = data_tot + parm_tot;
  547. if (buf_len > SMB_MAX_PACKET_SIZE)
  548. goto out_too_long;
  549. req->rq_trans2bufsize = buf_len;
  550. req->rq_trans2buffer = kzalloc(buf_len, GFP_NOFS);
  551. if (!req->rq_trans2buffer)
  552. goto out_no_mem;
  553. req->rq_parm = req->rq_trans2buffer;
  554. req->rq_data = req->rq_trans2buffer + parm_tot;
  555. } else if (unlikely(req->rq_total_data < data_tot ||
  556. req->rq_total_parm < parm_tot))
  557. goto out_data_grew;
  558. if (unlikely(parm_disp + parm_count > req->rq_total_parm ||
  559. parm_offset + parm_count > req->rq_rlen))
  560. goto out_bad_parm;
  561. if (unlikely(data_disp + data_count > req->rq_total_data ||
  562. data_offset + data_count > req->rq_rlen))
  563. goto out_bad_data;
  564. inbuf = req->rq_buffer;
  565. memcpy(req->rq_parm + parm_disp, inbuf + parm_offset, parm_count);
  566. memcpy(req->rq_data + data_disp, inbuf + data_offset, data_count);
  567. req->rq_ldata += data_count;
  568. req->rq_lparm += parm_count;
  569. /*
  570. * Check whether we've received all of the data. Note that
  571. * we use the packet totals -- total lengths might shrink!
  572. */
  573. if (req->rq_ldata >= data_tot && req->rq_lparm >= parm_tot) {
  574. req->rq_ldata = data_tot;
  575. req->rq_lparm = parm_tot;
  576. return 0;
  577. }
  578. return 1;
  579. out_too_long:
  580. printk(KERN_ERR "smb_trans2: data/param too long, data=%u, parm=%u\n",
  581. data_tot, parm_tot);
  582. goto out_EIO;
  583. out_no_mem:
  584. printk(KERN_ERR "smb_trans2: couldn't allocate data area of %d bytes\n",
  585. req->rq_trans2bufsize);
  586. req->rq_errno = -ENOMEM;
  587. goto out;
  588. out_data_grew:
  589. printk(KERN_ERR "smb_trans2: data/params grew!\n");
  590. goto out_EIO;
  591. out_bad_parm:
  592. printk(KERN_ERR "smb_trans2: invalid parms, disp=%u, cnt=%u, tot=%u, ofs=%u\n",
  593. parm_disp, parm_count, parm_tot, parm_offset);
  594. goto out_EIO;
  595. out_bad_data:
  596. printk(KERN_ERR "smb_trans2: invalid data, disp=%u, cnt=%u, tot=%u, ofs=%u\n",
  597. data_disp, data_count, data_tot, data_offset);
  598. out_EIO:
  599. req->rq_errno = -EIO;
  600. out:
  601. return req->rq_errno;
  602. }
  603. /*
  604. * State machine for receiving responses. We handle the fact that we can't
  605. * read the full response in one try by having states telling us how much we
  606. * have read.
  607. *
  608. * Must be called with the server lock held (only called from smbiod).
  609. *
  610. * Return: <0 on error
  611. */
  612. int smb_request_recv(struct smb_sb_info *server)
  613. {
  614. struct smb_request *req = NULL;
  615. int result = 0;
  616. if (smb_recv_available(server) <= 0)
  617. return 0;
  618. VERBOSE("state: %d\n", server->rstate);
  619. switch (server->rstate) {
  620. case SMB_RECV_DROP:
  621. result = smb_receive_drop(server);
  622. if (result < 0)
  623. break;
  624. if (server->rstate == SMB_RECV_DROP)
  625. break;
  626. server->rstate = SMB_RECV_START;
  627. /* fallthrough */
  628. case SMB_RECV_START:
  629. server->smb_read = 0;
  630. server->rstate = SMB_RECV_HEADER;
  631. /* fallthrough */
  632. case SMB_RECV_HEADER:
  633. result = smb_receive_header(server);
  634. if (result < 0)
  635. break;
  636. if (server->rstate == SMB_RECV_HEADER)
  637. break;
  638. if (! (*(server->header + smb_flg) & SMB_FLAGS_REPLY) ) {
  639. server->rstate = SMB_RECV_REQUEST;
  640. break;
  641. }
  642. if (server->rstate != SMB_RECV_HCOMPLETE)
  643. break;
  644. /* fallthrough */
  645. case SMB_RECV_HCOMPLETE:
  646. req = find_request(server, WVAL(server->header, smb_mid));
  647. if (!req)
  648. break;
  649. smb_init_request(server, req);
  650. req->rq_rcls = *(req->rq_header + smb_rcls);
  651. req->rq_err = WVAL(req->rq_header, smb_err);
  652. if (server->rstate != SMB_RECV_PARAM)
  653. break;
  654. /* fallthrough */
  655. case SMB_RECV_PARAM:
  656. if (!req)
  657. req = find_request(server,WVAL(server->header,smb_mid));
  658. if (!req)
  659. break;
  660. result = smb_recv_param(server, req);
  661. if (result < 0)
  662. break;
  663. if (server->rstate != SMB_RECV_DATA)
  664. break;
  665. /* fallthrough */
  666. case SMB_RECV_DATA:
  667. if (!req)
  668. req = find_request(server,WVAL(server->header,smb_mid));
  669. if (!req)
  670. break;
  671. result = smb_recv_data(server, req);
  672. if (result < 0)
  673. break;
  674. break;
  675. /* We should never be called with any of these states */
  676. case SMB_RECV_END:
  677. case SMB_RECV_REQUEST:
  678. BUG();
  679. }
  680. if (result < 0) {
  681. /* We saw an error */
  682. return result;
  683. }
  684. if (server->rstate != SMB_RECV_END)
  685. return 0;
  686. result = 0;
  687. if (req->rq_trans2_command && req->rq_rcls == SUCCESS)
  688. result = smb_recv_trans2(server, req);
  689. /*
  690. * Response completely read. Drop any extra bytes sent by the server.
  691. * (Yes, servers sometimes add extra bytes to responses)
  692. */
  693. VERBOSE("smb_len: %d smb_read: %d\n",
  694. server->smb_len, server->smb_read);
  695. if (server->smb_read < server->smb_len)
  696. smb_receive_drop(server);
  697. server->rstate = SMB_RECV_START;
  698. if (!result) {
  699. list_del_init(&req->rq_queue);
  700. req->rq_flags |= SMB_REQ_RECEIVED;
  701. smb_rput(req);
  702. wake_up_interruptible(&req->rq_wait);
  703. }
  704. return 0;
  705. }