Skip to content

Commit 67ed868

Browse files
torvaldstorvalds
committed
Merge tag '5.17-rc-ksmbd-server-fixes' of git://git.samba.org/ksmbd
Pull ksmbd server fixes from Steve French: - authentication fix - RDMA (smbdirect) fixes (including fix for a memory corruption, and some performance improvements) - multiple improvements for multichannel - misc fixes, including crediting (flow control) improvements - cleanup fixes, including some kernel doc fixes * tag '5.17-rc-ksmbd-server-fixes' of git://git.samba.org/ksmbd: (23 commits) ksmbd: fix guest connection failure with nautilus ksmbd: uninitialized variable in create_socket() ksmbd: smbd: fix missing client's memory region invalidation ksmbd: add smb-direct shutdown ksmbd: smbd: change the default maximum read/write, receive size ksmbd: smbd: create MR pool ksmbd: add reserved room in ipc request/response ksmbd: smbd: call rdma_accept() under CM handler ksmbd: limits exceeding the maximum allowable outstanding requests ksmbd: move credit charge deduction under processing request ksmbd: add support for smb2 max credit parameter ksmbd: set 445 port to smbdirect port by default ksmbd: register ksmbd ib client with ib_register_client() ksmbd: Fix smb2_get_name() kernel-doc comment ksmbd: Delete an invalid argument description in smb2_populate_readdir_entry() ksmbd: Fix smb2_set_info_file() kernel-doc comment ksmbd: Fix buffer_check_err() kernel-doc comment ksmbd: fix multi session connection failure ksmbd: set both ipv4 and ipv6 in FSCTL_QUERY_NETWORK_INTERFACE_INFO ksmbd: set RSS capable in FSCTL_QUERY_NETWORK_INTERFACE_INFO ...
2 parents c5a0b6e + ac090d9 commit 67ed868

19 files changed

+429
-334
lines changed

‎fs/ksmbd/asn1.c

Lines changed: 19 additions & 123 deletions
Original file line numberDiff line numberDiff line change
@@ -21,101 +21,11 @@
2121
#include "ksmbd_spnego_negtokeninit.asn1.h"
2222
#include "ksmbd_spnego_negtokentarg.asn1.h"
2323

24-
#define SPNEGO_OID_LEN 7
2524
#define NTLMSSP_OID_LEN 10
26-
#define KRB5_OID_LEN 7
27-
#define KRB5U2U_OID_LEN 8
28-
#define MSKRB5_OID_LEN 7
29-
static unsigned long SPNEGO_OID[7] = { 1, 3, 6, 1, 5, 5, 2 };
30-
static unsigned long NTLMSSP_OID[10] = { 1, 3, 6, 1, 4, 1, 311, 2, 2, 10 };
31-
static unsigned long KRB5_OID[7] = { 1, 2, 840, 113554, 1, 2, 2 };
32-
static unsigned long KRB5U2U_OID[8] = { 1, 2, 840, 113554, 1, 2, 2, 3 };
33-
static unsigned long MSKRB5_OID[7] = { 1, 2, 840, 48018, 1, 2, 2 };
3425

3526
static char NTLMSSP_OID_STR[NTLMSSP_OID_LEN] = { 0x2b, 0x06, 0x01, 0x04, 0x01,
3627
0x82, 0x37, 0x02, 0x02, 0x0a };
3728

38-
static bool
39-
asn1_subid_decode(const unsigned char **begin, const unsigned char *end,
40-
unsigned long *subid)
41-
{
42-
const unsigned char *ptr = *begin;
43-
unsigned char ch;
44-
45-
*subid = 0;
46-
47-
do {
48-
if (ptr >= end)
49-
return false;
50-
51-
ch = *ptr++;
52-
*subid <<= 7;
53-
*subid |= ch & 0x7F;
54-
} while ((ch & 0x80) == 0x80);
55-
56-
*begin = ptr;
57-
return true;
58-
}
59-
60-
static bool asn1_oid_decode(const unsigned char *value, size_t vlen,
61-
unsigned long **oid, size_t *oidlen)
62-
{
63-
const unsigned char *iptr = value, *end = value + vlen;
64-
unsigned long *optr;
65-
unsigned long subid;
66-
67-
vlen += 1;
68-
if (vlen < 2 || vlen > UINT_MAX / sizeof(unsigned long))
69-
goto fail_nullify;
70-
71-
*oid = kmalloc(vlen * sizeof(unsigned long), GFP_KERNEL);
72-
if (!*oid)
73-
return false;
74-
75-
optr = *oid;
76-
77-
if (!asn1_subid_decode(&iptr, end, &subid))
78-
goto fail;
79-
80-
if (subid < 40) {
81-
optr[0] = 0;
82-
optr[1] = subid;
83-
} else if (subid < 80) {
84-
optr[0] = 1;
85-
optr[1] = subid - 40;
86-
} else {
87-
optr[0] = 2;
88-
optr[1] = subid - 80;
89-
}
90-
91-
*oidlen = 2;
92-
optr += 2;
93-
94-
while (iptr < end) {
95-
if (++(*oidlen) > vlen)
96-
goto fail;
97-
98-
if (!asn1_subid_decode(&iptr, end, optr++))
99-
goto fail;
100-
}
101-
return true;
102-
103-
fail:
104-
kfree(*oid);
105-
fail_nullify:
106-
*oid = NULL;
107-
return false;
108-
}
109-
110-
static bool oid_eq(unsigned long *oid1, unsigned int oid1len,
111-
unsigned long *oid2, unsigned int oid2len)
112-
{
113-
if (oid1len != oid2len)
114-
return false;
115-
116-
return memcmp(oid1, oid2, oid1len) == 0;
117-
}
118-
11929
int
12030
ksmbd_decode_negTokenInit(unsigned char *security_blob, int length,
12131
struct ksmbd_conn *conn)
@@ -252,64 +162,50 @@ int build_spnego_ntlmssp_auth_blob(unsigned char **pbuffer, u16 *buflen,
252162
int ksmbd_gssapi_this_mech(void *context, size_t hdrlen, unsigned char tag,
253163
const void *value, size_t vlen)
254164
{
255-
unsigned long *oid;
256-
size_t oidlen;
257-
int err = 0;
258-
259-
if (!asn1_oid_decode(value, vlen, &oid, &oidlen)) {
260-
err = -EBADMSG;
261-
goto out;
262-
}
165+
enum OID oid;
263166

264-
if (!oid_eq(oid, oidlen, SPNEGO_OID, SPNEGO_OID_LEN))
265-
err = -EBADMSG;
266-
kfree(oid);
267-
out:
268-
if (err) {
167+
oid = look_up_OID(value, vlen);
168+
if (oid != OID_spnego) {
269169
char buf[50];
270170

271171
sprint_oid(value, vlen, buf, sizeof(buf));
272172
ksmbd_debug(AUTH, "Unexpected OID: %s\n", buf);
173+
return -EBADMSG;
273174
}
274-
return err;
175+
176+
return 0;
275177
}
276178

277179
int ksmbd_neg_token_init_mech_type(void *context, size_t hdrlen,
278180
unsigned char tag, const void *value,
279181
size_t vlen)
280182
{
281183
struct ksmbd_conn *conn = context;
282-
unsigned long *oid;
283-
size_t oidlen;
184+
enum OID oid;
284185
int mech_type;
285-
char buf[50];
286186

287-
if (!asn1_oid_decode(value, vlen, &oid, &oidlen))
288-
goto fail;
289-
290-
if (oid_eq(oid, oidlen, NTLMSSP_OID, NTLMSSP_OID_LEN))
187+
oid = look_up_OID(value, vlen);
188+
if (oid == OID_ntlmssp) {
291189
mech_type = KSMBD_AUTH_NTLMSSP;
292-
else if (oid_eq(oid, oidlen, MSKRB5_OID, MSKRB5_OID_LEN))
190+
} else if (oid == OID_mskrb5) {
293191
mech_type = KSMBD_AUTH_MSKRB5;
294-
else if (oid_eq(oid, oidlen, KRB5_OID, KRB5_OID_LEN))
192+
} else if (oid == OID_krb5) {
295193
mech_type = KSMBD_AUTH_KRB5;
296-
else if (oid_eq(oid, oidlen, KRB5U2U_OID, KRB5U2U_OID_LEN))
194+
} else if (oid == OID_krb5u2u) {
297195
mech_type = KSMBD_AUTH_KRB5U2U;
298-
else
299-
goto fail;
196+
} else {
197+
char buf[50];
198+
199+
sprint_oid(value, vlen, buf, sizeof(buf));
200+
ksmbd_debug(AUTH, "Unexpected OID: %s\n", buf);
201+
return -EBADMSG;
202+
}
300203

301204
conn->auth_mechs |= mech_type;
302205
if (conn->preferred_auth_mech == 0)
303206
conn->preferred_auth_mech = mech_type;
304207

305-
kfree(oid);
306208
return 0;
307-
308-
fail:
309-
kfree(oid);
310-
sprint_oid(value, vlen, buf, sizeof(buf));
311-
ksmbd_debug(AUTH, "Unexpected OID: %s\n", buf);
312-
return -EBADMSG;
313209
}
314210

315211
int ksmbd_neg_token_init_mech_token(void *context, size_t hdrlen,

‎fs/ksmbd/auth.c

Lines changed: 14 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -215,7 +215,7 @@ static int calc_ntlmv2_hash(struct ksmbd_session *sess, char *ntlmv2_hash,
215215
* Return: 0 on success, error number on error
216216
*/
217217
int ksmbd_auth_ntlmv2(struct ksmbd_session *sess, struct ntlmv2_resp *ntlmv2,
218-
int blen, char *domain_name)
218+
int blen, char *domain_name, char *cryptkey)
219219
{
220220
char ntlmv2_hash[CIFS_ENCPWD_SIZE];
221221
char ntlmv2_rsp[CIFS_HMAC_MD5_HASH_SIZE];
@@ -256,7 +256,7 @@ int ksmbd_auth_ntlmv2(struct ksmbd_session *sess, struct ntlmv2_resp *ntlmv2,
256256
goto out;
257257
}
258258

259-
memcpy(construct, sess->ntlmssp.cryptkey, CIFS_CRYPTO_KEY_SIZE);
259+
memcpy(construct, cryptkey, CIFS_CRYPTO_KEY_SIZE);
260260
memcpy(construct + CIFS_CRYPTO_KEY_SIZE, &ntlmv2->blob_signature, blen);
261261

262262
rc = crypto_shash_update(CRYPTO_HMACMD5(ctx), construct, len);
@@ -295,7 +295,8 @@ int ksmbd_auth_ntlmv2(struct ksmbd_session *sess, struct ntlmv2_resp *ntlmv2,
295295
* Return: 0 on success, error number on error
296296
*/
297297
int ksmbd_decode_ntlmssp_auth_blob(struct authenticate_message *authblob,
298-
int blob_len, struct ksmbd_session *sess)
298+
int blob_len, struct ksmbd_conn *conn,
299+
struct ksmbd_session *sess)
299300
{
300301
char *domain_name;
301302
unsigned int nt_off, dn_off;
@@ -324,7 +325,7 @@ int ksmbd_decode_ntlmssp_auth_blob(struct authenticate_message *authblob,
324325

325326
/* TODO : use domain name that imported from configuration file */
326327
domain_name = smb_strndup_from_utf16((const char *)authblob + dn_off,
327-
dn_len, true, sess->conn->local_nls);
328+
dn_len, true, conn->local_nls);
328329
if (IS_ERR(domain_name))
329330
return PTR_ERR(domain_name);
330331

@@ -333,7 +334,7 @@ int ksmbd_decode_ntlmssp_auth_blob(struct authenticate_message *authblob,
333334
domain_name);
334335
ret = ksmbd_auth_ntlmv2(sess, (struct ntlmv2_resp *)((char *)authblob + nt_off),
335336
nt_len - CIFS_ENCPWD_SIZE,
336-
domain_name);
337+
domain_name, conn->ntlmssp.cryptkey);
337338
kfree(domain_name);
338339
return ret;
339340
}
@@ -347,7 +348,7 @@ int ksmbd_decode_ntlmssp_auth_blob(struct authenticate_message *authblob,
347348
*
348349
*/
349350
int ksmbd_decode_ntlmssp_neg_blob(struct negotiate_message *negblob,
350-
int blob_len, struct ksmbd_session *sess)
351+
int blob_len, struct ksmbd_conn *conn)
351352
{
352353
if (blob_len < sizeof(struct negotiate_message)) {
353354
ksmbd_debug(AUTH, "negotiate blob len %d too small\n",
@@ -361,7 +362,7 @@ int ksmbd_decode_ntlmssp_neg_blob(struct negotiate_message *negblob,
361362
return -EINVAL;
362363
}
363364

364-
sess->ntlmssp.client_flags = le32_to_cpu(negblob->NegotiateFlags);
365+
conn->ntlmssp.client_flags = le32_to_cpu(negblob->NegotiateFlags);
365366
return 0;
366367
}
367368

@@ -375,14 +376,14 @@ int ksmbd_decode_ntlmssp_neg_blob(struct negotiate_message *negblob,
375376
*/
376377
unsigned int
377378
ksmbd_build_ntlmssp_challenge_blob(struct challenge_message *chgblob,
378-
struct ksmbd_session *sess)
379+
struct ksmbd_conn *conn)
379380
{
380381
struct target_info *tinfo;
381382
wchar_t *name;
382383
__u8 *target_name;
383384
unsigned int flags, blob_off, blob_len, type, target_info_len = 0;
384385
int len, uni_len, conv_len;
385-
int cflags = sess->ntlmssp.client_flags;
386+
int cflags = conn->ntlmssp.client_flags;
386387

387388
memcpy(chgblob->Signature, NTLMSSP_SIGNATURE, 8);
388389
chgblob->MessageType = NtLmChallenge;
@@ -403,7 +404,7 @@ ksmbd_build_ntlmssp_challenge_blob(struct challenge_message *chgblob,
403404
if (cflags & NTLMSSP_REQUEST_TARGET)
404405
flags |= NTLMSSP_REQUEST_TARGET;
405406

406-
if (sess->conn->use_spnego &&
407+
if (conn->use_spnego &&
407408
(cflags & NTLMSSP_NEGOTIATE_EXTENDED_SEC))
408409
flags |= NTLMSSP_NEGOTIATE_EXTENDED_SEC;
409410

@@ -414,7 +415,7 @@ ksmbd_build_ntlmssp_challenge_blob(struct challenge_message *chgblob,
414415
return -ENOMEM;
415416

416417
conv_len = smb_strtoUTF16((__le16 *)name, ksmbd_netbios_name(), len,
417-
sess->conn->local_nls);
418+
conn->local_nls);
418419
if (conv_len < 0 || conv_len > len) {
419420
kfree(name);
420421
return -EINVAL;
@@ -430,8 +431,8 @@ ksmbd_build_ntlmssp_challenge_blob(struct challenge_message *chgblob,
430431
chgblob->TargetName.BufferOffset = cpu_to_le32(blob_off);
431432

432433
/* Initialize random conn challenge */
433-
get_random_bytes(sess->ntlmssp.cryptkey, sizeof(__u64));
434-
memcpy(chgblob->Challenge, sess->ntlmssp.cryptkey,
434+
get_random_bytes(conn->ntlmssp.cryptkey, sizeof(__u64));
435+
memcpy(chgblob->Challenge, conn->ntlmssp.cryptkey,
435436
CIFS_CRYPTO_KEY_SIZE);
436437

437438
/* Add Target Information to security buffer */

‎fs/ksmbd/auth.h

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -38,16 +38,16 @@ struct kvec;
3838
int ksmbd_crypt_message(struct ksmbd_conn *conn, struct kvec *iov,
3939
unsigned int nvec, int enc);
4040
void ksmbd_copy_gss_neg_header(void *buf);
41-
int ksmbd_auth_ntlm(struct ksmbd_session *sess, char *pw_buf);
4241
int ksmbd_auth_ntlmv2(struct ksmbd_session *sess, struct ntlmv2_resp *ntlmv2,
43-
int blen, char *domain_name);
42+
int blen, char *domain_name, char *cryptkey);
4443
int ksmbd_decode_ntlmssp_auth_blob(struct authenticate_message *authblob,
45-
int blob_len, struct ksmbd_session *sess);
44+
int blob_len, struct ksmbd_conn *conn,
45+
struct ksmbd_session *sess);
4646
int ksmbd_decode_ntlmssp_neg_blob(struct negotiate_message *negblob,
47-
int blob_len, struct ksmbd_session *sess);
47+
int blob_len, struct ksmbd_conn *conn);
4848
unsigned int
4949
ksmbd_build_ntlmssp_challenge_blob(struct challenge_message *chgblob,
50-
struct ksmbd_session *sess);
50+
struct ksmbd_conn *conn);
5151
int ksmbd_krb5_authenticate(struct ksmbd_session *sess, char *in_blob,
5252
int in_len, char *out_blob, int *out_len);
5353
int ksmbd_sign_smb2_pdu(struct ksmbd_conn *conn, char *key, struct kvec *iov,

‎fs/ksmbd/connection.c

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -62,6 +62,7 @@ struct ksmbd_conn *ksmbd_conn_alloc(void)
6262
atomic_set(&conn->req_running, 0);
6363
atomic_set(&conn->r_count, 0);
6464
conn->total_credits = 1;
65+
conn->outstanding_credits = 1;
6566

6667
init_waitqueue_head(&conn->req_running_q);
6768
INIT_LIST_HEAD(&conn->conns_list);
@@ -386,17 +387,24 @@ int ksmbd_conn_transport_init(void)
386387
static void stop_sessions(void)
387388
{
388389
struct ksmbd_conn *conn;
390+
struct ksmbd_transport *t;
389391

390392
again:
391393
read_lock(&conn_list_lock);
392394
list_for_each_entry(conn, &conn_list, conns_list) {
393395
struct task_struct *task;
394396

395-
task = conn->transport->handler;
397+
t = conn->transport;
398+
task = t->handler;
396399
if (task)
397400
ksmbd_debug(CONN, "Stop session handler %s/%d\n",
398401
task->comm, task_pid_nr(task));
399402
conn->status = KSMBD_SESS_EXITING;
403+
if (t->ops->shutdown) {
404+
read_unlock(&conn_list_lock);
405+
t->ops->shutdown(t);
406+
read_lock(&conn_list_lock);
407+
}
400408
}
401409
read_unlock(&conn_list_lock);
402410

‎fs/ksmbd/connection.h

Lines changed: 4 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -61,8 +61,8 @@ struct ksmbd_conn {
6161
atomic_t req_running;
6262
/* References which are made for this Server object*/
6363
atomic_t r_count;
64-
unsigned short total_credits;
65-
unsigned short max_credits;
64+
unsigned int total_credits;
65+
unsigned int outstanding_credits;
6666
spinlock_t credits_lock;
6767
wait_queue_head_t req_running_q;
6868
/* Lock to protect requests list*/
@@ -72,12 +72,7 @@ struct ksmbd_conn {
7272
int connection_type;
7373
struct ksmbd_stats stats;
7474
char ClientGUID[SMB2_CLIENT_GUID_SIZE];
75-
union {
76-
/* pending trans request table */
77-
struct trans_state *recent_trans;
78-
/* Used by ntlmssp */
79-
char *ntlmssp_cryptkey;
80-
};
75+
struct ntlmssp_auth ntlmssp;
8176

8277
spinlock_t llist_lock;
8378
struct list_head lock_list;
@@ -122,6 +117,7 @@ struct ksmbd_conn_ops {
122117
struct ksmbd_transport_ops {
123118
int (*prepare)(struct ksmbd_transport *t);
124119
void (*disconnect)(struct ksmbd_transport *t);
120+
void (*shutdown)(struct ksmbd_transport *t);
125121
int (*read)(struct ksmbd_transport *t, char *buf, unsigned int size);
126122
int (*writev)(struct ksmbd_transport *t, struct kvec *iovs, int niov,
127123
int size, bool need_invalidate_rkey,

0 commit comments

Comments
 (0)