Skip to content

Commit eda1c54

Browse files
longlimsftsmfrench
longlimsft
authored and
smfrench
committed
cifs: Allocate crypto structures on the fly for calculating signatures of incoming packets
CIFS uses pre-allocated crypto structures to calculate signatures for both incoming and outgoing packets. In this way it doesn't need to allocate crypto structures for every packet, but it requires a lock to prevent concurrent access to crypto structures. Remove the lock by allocating crypto structures on the fly for incoming packets. At the same time, we can still use pre-allocated crypto structures for outgoing packets, as they are already protected by transport lock srv_mutex. Signed-off-by: Long Li <[email protected]> Signed-off-by: Steve French <[email protected]>
1 parent d4e5160 commit eda1c54

File tree

3 files changed

+60
-36
lines changed

3 files changed

+60
-36
lines changed

‎fs/cifs/cifsglob.h

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -426,7 +426,8 @@ struct smb_version_operations {
426426
/* generate new lease key */
427427
void (*new_lease_key)(struct cifs_fid *);
428428
int (*generate_signingkey)(struct cifs_ses *);
429-
int (*calc_signature)(struct smb_rqst *, struct TCP_Server_Info *);
429+
int (*calc_signature)(struct smb_rqst *, struct TCP_Server_Info *,
430+
bool allocate_crypto);
430431
int (*set_integrity)(const unsigned int, struct cifs_tcon *tcon,
431432
struct cifsFileInfo *src_file);
432433
int (*enum_snapshots)(const unsigned int xid, struct cifs_tcon *tcon,

‎fs/cifs/smb2proto.h

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -55,9 +55,11 @@ extern struct cifs_ses *smb2_find_smb_ses(struct TCP_Server_Info *server,
5555
extern struct cifs_tcon *smb2_find_smb_tcon(struct TCP_Server_Info *server,
5656
__u64 ses_id, __u32 tid);
5757
extern int smb2_calc_signature(struct smb_rqst *rqst,
58-
struct TCP_Server_Info *server);
58+
struct TCP_Server_Info *server,
59+
bool allocate_crypto);
5960
extern int smb3_calc_signature(struct smb_rqst *rqst,
60-
struct TCP_Server_Info *server);
61+
struct TCP_Server_Info *server,
62+
bool allocate_crypto);
6163
extern void smb2_echo_request(struct work_struct *work);
6264
extern __le32 smb2_get_lease_state(struct cifsInodeInfo *cinode);
6365
extern bool smb2_is_valid_oplock_break(char *buffer,

‎fs/cifs/smb2transport.c

Lines changed: 54 additions & 33 deletions
Original file line numberDiff line numberDiff line change
@@ -40,14 +40,6 @@
4040
#include "smb2status.h"
4141
#include "smb2glob.h"
4242

43-
static int
44-
smb2_crypto_shash_allocate(struct TCP_Server_Info *server)
45-
{
46-
return cifs_alloc_hash("hmac(sha256)",
47-
&server->secmech.hmacsha256,
48-
&server->secmech.sdeschmacsha256);
49-
}
50-
5143
static int
5244
smb3_crypto_shash_allocate(struct TCP_Server_Info *server)
5345
{
@@ -219,7 +211,8 @@ smb2_find_smb_tcon(struct TCP_Server_Info *server, __u64 ses_id, __u32 tid)
219211
}
220212

221213
int
222-
smb2_calc_signature(struct smb_rqst *rqst, struct TCP_Server_Info *server)
214+
smb2_calc_signature(struct smb_rqst *rqst, struct TCP_Server_Info *server,
215+
bool allocate_crypto)
223216
{
224217
int rc;
225218
unsigned char smb2_signature[SMB2_HMACSHA256_SIZE];
@@ -228,6 +221,8 @@ smb2_calc_signature(struct smb_rqst *rqst, struct TCP_Server_Info *server)
228221
struct smb2_sync_hdr *shdr = (struct smb2_sync_hdr *)iov[0].iov_base;
229222
struct cifs_ses *ses;
230223
struct shash_desc *shash;
224+
struct crypto_shash *hash;
225+
struct sdesc *sdesc = NULL;
231226
struct smb_rqst drqst;
232227

233228
ses = smb2_find_smb_ses(server, shdr->SessionId);
@@ -239,24 +234,32 @@ smb2_calc_signature(struct smb_rqst *rqst, struct TCP_Server_Info *server)
239234
memset(smb2_signature, 0x0, SMB2_HMACSHA256_SIZE);
240235
memset(shdr->Signature, 0x0, SMB2_SIGNATURE_SIZE);
241236

242-
rc = smb2_crypto_shash_allocate(server);
243-
if (rc) {
244-
cifs_server_dbg(VFS, "%s: sha256 alloc failed\n", __func__);
245-
return rc;
237+
if (allocate_crypto) {
238+
rc = cifs_alloc_hash("hmac(sha256)", &hash, &sdesc);
239+
if (rc) {
240+
cifs_server_dbg(VFS,
241+
"%s: sha256 alloc failed\n", __func__);
242+
return rc;
243+
}
244+
shash = &sdesc->shash;
245+
} else {
246+
hash = server->secmech.hmacsha256;
247+
shash = &server->secmech.sdeschmacsha256->shash;
246248
}
247249

248-
rc = crypto_shash_setkey(server->secmech.hmacsha256,
249-
ses->auth_key.response, SMB2_NTLMV2_SESSKEY_SIZE);
250+
rc = crypto_shash_setkey(hash, ses->auth_key.response,
251+
SMB2_NTLMV2_SESSKEY_SIZE);
250252
if (rc) {
251-
cifs_server_dbg(VFS, "%s: Could not update with response\n", __func__);
252-
return rc;
253+
cifs_server_dbg(VFS,
254+
"%s: Could not update with response\n",
255+
__func__);
256+
goto out;
253257
}
254258

255-
shash = &server->secmech.sdeschmacsha256->shash;
256259
rc = crypto_shash_init(shash);
257260
if (rc) {
258261
cifs_server_dbg(VFS, "%s: Could not init sha256", __func__);
259-
return rc;
262+
goto out;
260263
}
261264

262265
/*
@@ -271,9 +274,10 @@ smb2_calc_signature(struct smb_rqst *rqst, struct TCP_Server_Info *server)
271274
rc = crypto_shash_update(shash, iov[0].iov_base,
272275
iov[0].iov_len);
273276
if (rc) {
274-
cifs_server_dbg(VFS, "%s: Could not update with payload\n",
275-
__func__);
276-
return rc;
277+
cifs_server_dbg(VFS,
278+
"%s: Could not update with payload\n",
279+
__func__);
280+
goto out;
277281
}
278282
drqst.rq_iov++;
279283
drqst.rq_nvec--;
@@ -283,6 +287,9 @@ smb2_calc_signature(struct smb_rqst *rqst, struct TCP_Server_Info *server)
283287
if (!rc)
284288
memcpy(shdr->Signature, sigptr, SMB2_SIGNATURE_SIZE);
285289

290+
out:
291+
if (allocate_crypto)
292+
cifs_free_hash(&hash, &sdesc);
286293
return rc;
287294
}
288295

@@ -504,29 +511,42 @@ generate_smb311signingkey(struct cifs_ses *ses)
504511
}
505512

506513
int
507-
smb3_calc_signature(struct smb_rqst *rqst, struct TCP_Server_Info *server)
514+
smb3_calc_signature(struct smb_rqst *rqst, struct TCP_Server_Info *server,
515+
bool allocate_crypto)
508516
{
509517
int rc;
510518
unsigned char smb3_signature[SMB2_CMACAES_SIZE];
511519
unsigned char *sigptr = smb3_signature;
512520
struct kvec *iov = rqst->rq_iov;
513521
struct smb2_sync_hdr *shdr = (struct smb2_sync_hdr *)iov[0].iov_base;
514-
struct shash_desc *shash = &server->secmech.sdesccmacaes->shash;
522+
struct shash_desc *shash;
523+
struct crypto_shash *hash;
524+
struct sdesc *sdesc = NULL;
515525
struct smb_rqst drqst;
516526
u8 key[SMB3_SIGN_KEY_SIZE];
517527

518528
rc = smb2_get_sign_key(shdr->SessionId, server, key);
519529
if (rc)
520530
return 0;
521531

532+
if (allocate_crypto) {
533+
rc = cifs_alloc_hash("cmac(aes)", &hash, &sdesc);
534+
if (rc)
535+
return rc;
536+
537+
shash = &sdesc->shash;
538+
} else {
539+
hash = server->secmech.cmacaes;
540+
shash = &server->secmech.sdesccmacaes->shash;
541+
}
542+
522543
memset(smb3_signature, 0x0, SMB2_CMACAES_SIZE);
523544
memset(shdr->Signature, 0x0, SMB2_SIGNATURE_SIZE);
524545

525-
rc = crypto_shash_setkey(server->secmech.cmacaes,
526-
key, SMB2_CMACAES_SIZE);
546+
rc = crypto_shash_setkey(hash, key, SMB2_CMACAES_SIZE);
527547
if (rc) {
528548
cifs_server_dbg(VFS, "%s: Could not set key for cmac aes\n", __func__);
529-
return rc;
549+
goto out;
530550
}
531551

532552
/*
@@ -537,7 +557,7 @@ smb3_calc_signature(struct smb_rqst *rqst, struct TCP_Server_Info *server)
537557
rc = crypto_shash_init(shash);
538558
if (rc) {
539559
cifs_server_dbg(VFS, "%s: Could not init cmac aes\n", __func__);
540-
return rc;
560+
goto out;
541561
}
542562

543563
/*
@@ -554,7 +574,7 @@ smb3_calc_signature(struct smb_rqst *rqst, struct TCP_Server_Info *server)
554574
if (rc) {
555575
cifs_server_dbg(VFS, "%s: Could not update with payload\n",
556576
__func__);
557-
return rc;
577+
goto out;
558578
}
559579
drqst.rq_iov++;
560580
drqst.rq_nvec--;
@@ -564,6 +584,9 @@ smb3_calc_signature(struct smb_rqst *rqst, struct TCP_Server_Info *server)
564584
if (!rc)
565585
memcpy(shdr->Signature, sigptr, SMB2_SIGNATURE_SIZE);
566586

587+
out:
588+
if (allocate_crypto)
589+
cifs_free_hash(&hash, &sdesc);
567590
return rc;
568591
}
569592

@@ -593,7 +616,7 @@ smb2_sign_rqst(struct smb_rqst *rqst, struct TCP_Server_Info *server)
593616
return 0;
594617
}
595618

596-
rc = server->ops->calc_signature(rqst, server);
619+
rc = server->ops->calc_signature(rqst, server, false);
597620

598621
return rc;
599622
}
@@ -631,9 +654,7 @@ smb2_verify_signature(struct smb_rqst *rqst, struct TCP_Server_Info *server)
631654

632655
memset(shdr->Signature, 0, SMB2_SIGNATURE_SIZE);
633656

634-
mutex_lock(&server->srv_mutex);
635-
rc = server->ops->calc_signature(rqst, server);
636-
mutex_unlock(&server->srv_mutex);
657+
rc = server->ops->calc_signature(rqst, server, true);
637658

638659
if (rc)
639660
return rc;

0 commit comments

Comments
 (0)