1 files changed, 87 insertions, 48 deletions

diff --git a/fs/cifs/cifssmb.c b/fs/cifs/cifssmb.c
index 2f6795e524d3..df959bae6728 100644
--- a/fs/cifs/cifssmb.c
+++ b/fs/cifs/cifssmb.c
@@ -136,18 +136,15 @@ cifs_reconnect_tcon(struct cifsTconInfo *tcon, int smb_command)
                 }
         }
 
-        if (ses->status == CifsExiting)
-                return -EIO;
-
         /*
          * Give demultiplex thread up to 10 seconds to reconnect, should be
          * greater than cifs socket timeout which is 7 seconds
          */
         while (server->tcpStatus == CifsNeedReconnect) {
                 wait_event_interruptible_timeout(server->response_q,
-                        (server->tcpStatus == CifsGood), 10 * HZ);
+                        (server->tcpStatus != CifsNeedReconnect), 10 * HZ);
 
-                /* is TCP session is reestablished now ?*/
+                /* are we still trying to reconnect? */
                 if (server->tcpStatus != CifsNeedReconnect)
                         break;
 
@@ -156,7 +153,7 @@ cifs_reconnect_tcon(struct cifsTconInfo *tcon, int smb_command)
                  * retrying until process is killed or server comes
                  * back on-line
                  */
-                if (!tcon->retry || ses->status == CifsExiting) {
+                if (!tcon->retry) {
                         cFYI(1, "gave up waiting on reconnect in smb_init");
                         return -EHOSTDOWN;
                 }
@@ -331,37 +328,35 @@ smb_init_no_reconnect(int smb_command, int wct, struct cifsTconInfo *tcon,
 
 static int validate_t2(struct smb_t2_rsp *pSMB)
 {
-        int rc = -EINVAL;
-        int total_size;
-        char *pBCC;
+        unsigned int total_size;
+
+        /* check for plausible wct */
+        if (pSMB->hdr.WordCount < 10)
+                goto vt2_err;
 
-        /* check for plausible wct, bcc and t2 data and parm sizes */
         /* check for parm and data offset going beyond end of smb */
-        if (pSMB->hdr.WordCount >= 10) {
-                if ((le16_to_cpu(pSMB->t2_rsp.ParameterOffset) <= 1024) &&
-                   (le16_to_cpu(pSMB->t2_rsp.DataOffset) <= 1024)) {
-                        /* check that bcc is at least as big as parms + data */
-                        /* check that bcc is less than negotiated smb buffer */
-                        total_size = le16_to_cpu(pSMB->t2_rsp.ParameterCount);
-                        if (total_size < 512) {
-                                total_size +=
-                                        le16_to_cpu(pSMB->t2_rsp.DataCount);
-                                /* BCC le converted in SendReceive */
-                                pBCC = (pSMB->hdr.WordCount * 2) +
-                                        sizeof(struct smb_hdr) +
-                                        (char *)pSMB;
-                                if ((total_size <= (*(u16 *)pBCC)) &&
-                                   (total_size <
-                                        CIFSMaxBufSize+MAX_CIFS_HDR_SIZE)) {
-                                        return 0;
-                                }
-                        }
-                }
-        }
+        if (get_unaligned_le16(&pSMB->t2_rsp.ParameterOffset) > 1024 ||
+            get_unaligned_le16(&pSMB->t2_rsp.DataOffset) > 1024)
+                goto vt2_err;
+
+        /* check that bcc is at least as big as parms + data */
+        /* check that bcc is less than negotiated smb buffer */
+        total_size = get_unaligned_le16(&pSMB->t2_rsp.ParameterCount);
+        if (total_size >= 512)
+                goto vt2_err;
+
+        total_size += get_unaligned_le16(&pSMB->t2_rsp.DataCount);
+        if (total_size > get_bcc(&pSMB->hdr) ||
+            total_size >= CIFSMaxBufSize + MAX_CIFS_HDR_SIZE)
+                goto vt2_err;
+
+        return 0;
+vt2_err:
         cifs_dump_mem("Invalid transact2 SMB: ", (char *)pSMB,
                 sizeof(struct smb_t2_rsp) + 16);
-        return rc;
+        return -EINVAL;
 }
+
 int
 CIFSSMBNegotiate(unsigned int xid, struct cifsSesInfo *ses)
 {
@@ -452,7 +447,6 @@ CIFSSMBNegotiate(unsigned int xid, struct cifsSesInfo *ses)
                 server->maxBuf = min((__u32)le16_to_cpu(rsp->MaxBufSize),
                                 (__u32)CIFSMaxBufSize + MAX_CIFS_HDR_SIZE);
                 server->max_vcs = le16_to_cpu(rsp->MaxNumberVcs);
-                GETU32(server->sessid) = le32_to_cpu(rsp->SessionKey);
                 /* even though we do not use raw we might as well set this
                 accurately, in case we ever find a need for it */
                 if ((le16_to_cpu(rsp->RawMode) & RAW_ENABLE) == RAW_ENABLE) {
@@ -566,7 +560,6 @@ CIFSSMBNegotiate(unsigned int xid, struct cifsSesInfo *ses)
                         (__u32) CIFSMaxBufSize + MAX_CIFS_HDR_SIZE);
         server->max_rw = le32_to_cpu(pSMBr->MaxRawSize);
         cFYI(DBG2, "Max buf = %d", ses->server->maxBuf);
-        GETU32(ses->server->sessid) = le32_to_cpu(pSMBr->SessionKey);
         server->capabilities = le32_to_cpu(pSMBr->Capabilities);
         server->timeAdj = (int)(__s16)le16_to_cpu(pSMBr->ServerTimeZone);
         server->timeAdj *= 60;
@@ -706,6 +699,53 @@ CIFSSMBTDis(const int xid, struct cifsTconInfo *tcon)
         return rc;
 }
 
+/*
+ * This is a no-op for now. We're not really interested in the reply, but
+ * rather in the fact that the server sent one and that server->lstrp
+ * gets updated.
+ *
+ * FIXME: maybe we should consider checking that the reply matches request?
+ */
+static void
+cifs_echo_callback(struct mid_q_entry *mid)
+{
+        struct TCP_Server_Info *server = mid->callback_data;
+
+        DeleteMidQEntry(mid);
+        atomic_dec(&server->inFlight);
+        wake_up(&server->request_q);
+}
+
+int
+CIFSSMBEcho(struct TCP_Server_Info *server)
+{
+        ECHO_REQ *smb;
+        int rc = 0;
+
+        cFYI(1, "In echo request");
+
+        rc = small_smb_init(SMB_COM_ECHO, 0, NULL, (void **)&smb);
+        if (rc)
+                return rc;
+
+        /* set up echo request */
+        smb->hdr.Tid = 0xffff;
+        smb->hdr.WordCount = 1;
+        put_unaligned_le16(1, &smb->EchoCount);
+        put_bcc_le(1, &smb->hdr);
+        smb->Data[0] = 'a';
+        smb->hdr.smb_buf_length += 3;
+
+        rc = cifs_call_async(server, (struct smb_hdr *)smb,
+                                cifs_echo_callback, server);
+        if (rc)
+                cFYI(1, "Echo request failed: %d", rc);
+
+        cifs_small_buf_release(smb);
+
+        return rc;
+}
+
 int
 CIFSSMBLogoff(const int xid, struct cifsSesInfo *ses)
 {
@@ -1193,7 +1233,7 @@ OldOpenRetry:
         pSMB->ByteCount = cpu_to_le16(count);
         /* long_op set to 1 to allow for oplock break timeouts */
         rc = SendReceive(xid, tcon->ses, (struct smb_hdr *) pSMB,
-                        (struct smb_hdr *)pSMBr, &bytes_returned, CIFS_LONG_OP);
+                        (struct smb_hdr *)pSMBr, &bytes_returned, 0);
         cifs_stats_inc(&tcon->num_opens);
         if (rc) {
                 cFYI(1, "Error in Open = %d", rc);
@@ -1306,7 +1346,7 @@ openRetry:
         pSMB->ByteCount = cpu_to_le16(count);
         /* long_op set to 1 to allow for oplock break timeouts */
         rc = SendReceive(xid, tcon->ses, (struct smb_hdr *) pSMB,
-                        (struct smb_hdr *)pSMBr, &bytes_returned, CIFS_LONG_OP);
+                        (struct smb_hdr *)pSMBr, &bytes_returned, 0);
         cifs_stats_inc(&tcon->num_opens);
         if (rc) {
                 cFYI(1, "Error in Open = %d", rc);
@@ -1388,7 +1428,7 @@ CIFSSMBRead(const int xid, struct cifsTconInfo *tcon, const int netfid,
         iov[0].iov_base = (char *)pSMB;
         iov[0].iov_len = pSMB->hdr.smb_buf_length + 4;
         rc = SendReceive2(xid, tcon->ses, iov, 1 /* num iovecs */,
-                         &resp_buf_type, CIFS_STD_OP | CIFS_LOG_ERROR);
+                         &resp_buf_type, CIFS_LOG_ERROR);
         cifs_stats_inc(&tcon->num_reads);
         pSMBr = (READ_RSP *)iov[0].iov_base;
         if (rc) {
@@ -1663,7 +1703,8 @@ int
 CIFSSMBLock(const int xid, struct cifsTconInfo *tcon,
             const __u16 smb_file_id, const __u64 len,
             const __u64 offset, const __u32 numUnlock,
-            const __u32 numLock, const __u8 lockType, const bool waitFlag)
+            const __u32 numLock, const __u8 lockType,
+            const bool waitFlag, const __u8 oplock_level)
 {
         int rc = 0;
         LOCK_REQ *pSMB = NULL;
@@ -1691,6 +1732,7 @@ CIFSSMBLock(const int xid, struct cifsTconInfo *tcon,
         pSMB->NumberOfLocks = cpu_to_le16(numLock);
         pSMB->NumberOfUnlocks = cpu_to_le16(numUnlock);
         pSMB->LockType = lockType;
+        pSMB->OplockLevel = oplock_level;
         pSMB->AndXCommand = 0xFF;       /* none */
         pSMB->Fid = smb_file_id; /* netfid stays le */
 
@@ -1842,10 +1884,10 @@ CIFSSMBPosixLock(const int xid, struct cifsTconInfo *tcon,
                                         __constant_cpu_to_le16(CIFS_WRLCK))
                                 pLockData->fl_type = F_WRLCK;
 
-                        pLockData->fl_start = parm_data->start;
-                        pLockData->fl_end = parm_data->start +
-                                                parm_data->length - 1;
-                        pLockData->fl_pid = parm_data->pid;
+                        pLockData->fl_start = le64_to_cpu(parm_data->start);
+                        pLockData->fl_end = pLockData->fl_start +
+                                        le64_to_cpu(parm_data->length) - 1;
+                        pLockData->fl_pid = le32_to_cpu(parm_data->pid);
                 }
         }
 
@@ -3087,7 +3129,7 @@ CIFSSMBGetCIFSACL(const int xid, struct cifsTconInfo *tcon, __u16 fid,
         iov[0].iov_len = pSMB->hdr.smb_buf_length + 4;
 
         rc = SendReceive2(xid, tcon->ses, iov, 1 /* num iovec */, &buf_type,
-                         CIFS_STD_OP);
+                         0);
         cifs_stats_inc(&tcon->num_acl_get);
         if (rc) {
                 cFYI(1, "Send error in QuerySecDesc = %d", rc);
@@ -4869,7 +4911,6 @@ CIFSSMBSetFileSize(const int xid, struct cifsTconInfo *tcon, __u64 size,
                    __u16 fid, __u32 pid_of_opener, bool SetAllocation)
 {
         struct smb_com_transaction2_sfi_req *pSMB  = NULL;
-        char *data_offset;
         struct file_end_of_file_info *parm_data;
         int rc = 0;
         __u16 params, param_offset, offset, byte_count, count;
@@ -4893,8 +4934,6 @@ CIFSSMBSetFileSize(const int xid, struct cifsTconInfo *tcon, __u64 size,
         param_offset = offsetof(struct smb_com_transaction2_sfi_req, Fid) - 4;
         offset = param_offset + params;
 
-        data_offset = (char *) (&pSMB->hdr.Protocol) + offset;
-
         count = sizeof(struct file_end_of_file_info);
         pSMB->MaxParameterCount = cpu_to_le16(2);
         /* BB find exact max SMB PDU from sess structure BB */
@@ -5208,7 +5247,7 @@ cifs_fill_unix_set_info(FILE_UNIX_BASIC_INFO *data_offset,
          * Samba server ignores set of file size to zero due to bugs in some
          * older clients, but we should be precise - we use SetFileSize to
          * set file size and do not want to truncate file size to zero
-         * accidently as happened on one Samba server beta by putting
+         * accidentally as happened on one Samba server beta by putting
          * zero instead of -1 here
          */
         data_offset->EndOfFile = cpu_to_le64(NO_CHANGE_64);
@@ -5562,7 +5601,7 @@ QAllEAsRetry:
         }
 
         /* make sure list_len doesn't go past end of SMB */
-        end_of_smb = (char *)pByteArea(&pSMBr->hdr) + BCC(&pSMBr->hdr);
+        end_of_smb = (char *)pByteArea(&pSMBr->hdr) + get_bcc(&pSMBr->hdr);
         if ((char *)ea_response_data + list_len > end_of_smb) {
                 cFYI(1, "EA list appears to go beyond SMB");
                 rc = -EIO;