Steve French
603ab5ea64
SMB3.1.1: add missing QUERY_DIR info levels
...
New Infolevels for QUERY_DIR (and QUERY_INFO) levels 78 through 81 are
now being used by Windows clients and were added to the documentation.
Add defines for them (and correct some typos in documentation). See
MS-SMB2 2.2.33 and MS-FSCC 2.4
Signed-off-by: Steve French <stfrench@microsoft.com >
2026-05-12 10:13:24 -05:00
Linus Torvalds
bd1886d6e4
Merge tag 'v7.1-rc-part2-ksmbd-fixes' of git://git.samba.org/ksmbd
...
Pull more smb server updates from Steve French:
- move fs/smb/common/smbdirect to fs/smb/smbdirect
- change signature calc to use AES-CMAC library, simpler and faster
- invalid signature fix
- multichannel fix
- open create options fix
- fix durable handle leak
- cap maximum lock count to avoid potential denial of service
- four connection fixes: connection free and session destroy IDA fixes,
refcount fix, connection leak fix, max_connections off by one fix
- IPC validation fix
- fix out of bounds write in getting xattrs
- fix use after free in durable handle reconnect
- three ACL fixes: fix potential ACL overflow, harden num_aces check,
and fix minimum ACE size check
* tag 'v7.1-rc-part2-ksmbd-fixes' of git://git.samba.org/ksmbd:
smb: smbdirect: move fs/smb/common/smbdirect/ to fs/smb/smbdirect/
smb: server: stop sending fake security descriptors
ksmbd: scope conn->binding slowpath to bound sessions only
ksmbd: fix CreateOptions sanitization clobbering the whole field
ksmbd: fix durable fd leak on ClientGUID mismatch in durable v2 open
ksmbd: fix O(N^2) DoS in smb2_lock via unbounded LockCount
ksmbd: destroy async_ida in ksmbd_conn_free()
ksmbd: destroy tree_conn_ida in ksmbd_session_destroy()
ksmbd: Use AES-CMAC library for SMB3 signature calculation
ksmbd: reset rcount per connection in ksmbd_conn_wait_idle_sess_id()
ksmbd: fix out-of-bounds write in smb2_get_ea() EA alignment
ksmbd: use check_add_overflow() to prevent u16 DACL size overflow
ksmbd: fix use-after-free in smb2_open during durable reconnect
ksmbd: validate num_aces and harden ACE walk in smb_inherit_dacl()
smb: server: fix max_connections off-by-one in tcp accept path
ksmbd: require minimum ACE size in smb_check_perm_dacl()
ksmbd: validate response sizes in ipc_validate_msg()
smb: server: fix active_num_conn leak on transport allocation failure
2026-04-23 17:04:18 -07:00
Stefan Metzmacher and Steve French
1249c01aa4
smb: smbdirect: move fs/smb/common/smbdirect/ to fs/smb/smbdirect/
...
This also removes the smbdirect_ prefix from the files.
Suggested-by: Linus Torvalds <torvalds@linux-foundation.org >
Link: https://lore.kernel.org/linux-cifs/CAHk-=whmue3PVi88K0UZLZO0at22QhQZ-yu+qO2TOKyZpGqecw@mail.gmail.com/
Cc: Steve French <smfrench@gmail.com >
Cc: Tom Talpey <tom@talpey.com >
Cc: Long Li <longli@microsoft.com >
Cc: Linus Torvalds <torvalds@linux-foundation.org >
Cc: linux-cifs@vger.kernel.org
Cc: samba-technical@lists.samba.org
Acked-by: Namjae Jeon <linkinjeon@kernel.org >
Signed-off-by: Stefan Metzmacher <metze@samba.org >
Signed-off-by: Steve French <stfrench@microsoft.com >
2026-04-22 19:00:41 -05:00
Enzo Matsumiya and Steve French
44ccf4162a
smb: common: add SMB3_COMPRESS_MAX_ALGS
...
Set it to number of currently defined algorithms (6 as of now).
Signed-off-by: Enzo Matsumiya <ematsumiya@suse.de >
Signed-off-by: Steve French <stfrench@microsoft.com >
2026-04-22 09:55:56 -05:00
Stefan Metzmacher and Steve French
d09a040c18
smb: smbdirect: let smbdirect_connection_deregister_mr_io unlock while waiting
...
We should not hold a mutex locked during wait_for_completion()
holding a reference is enough.
Cc: Steve French <smfrench@gmail.com >
Cc: Tom Talpey <tom@talpey.com >
Cc: Long Li <longli@microsoft.com >
Cc: Namjae Jeon <linkinjeon@kernel.org >
Cc: David Howells <dhowells@redhat.com >
Cc: Henrique Carvalho <henrique.carvalho@suse.com >
Cc: linux-cifs@vger.kernel.org
Cc: samba-technical@lists.samba.org
Signed-off-by: Stefan Metzmacher <metze@samba.org >
Signed-off-by: Steve French <stfrench@microsoft.com >
2026-04-15 21:58:24 -05:00
Stefan Metzmacher and Steve French
25c2e34931
smb: smbdirect: fix the logic in smbdirect_socket_destroy_sync() without an error
...
If smbdirect_socket_destroy_sync() and sc->first_error was not set
we should set -ESHUTDOWN, that's a better condition
doing it only implicitly with the
sc->status < SMBDIRECT_SOCKET_DISCONNECTING check.
Cc: Steve French <smfrench@gmail.com >
Cc: Tom Talpey <tom@talpey.com >
Cc: Long Li <longli@microsoft.com >
Cc: Namjae Jeon <linkinjeon@kernel.org >
Cc: David Howells <dhowells@redhat.com >
Cc: Henrique Carvalho <henrique.carvalho@suse.com >
Cc: linux-cifs@vger.kernel.org
Cc: samba-technical@lists.samba.org
Signed-off-by: Stefan Metzmacher <metze@samba.org >
Signed-off-by: Steve French <stfrench@microsoft.com >
2026-04-15 21:58:24 -05:00
Stefan Metzmacher and Steve French
3892007f2b
smb: smbdirect: fix copyright header of smbdirect.h
...
Everything in smbdirect.h was taken from my out of
tree prototype.
Cc: Steve French <smfrench@gmail.com >
Cc: Tom Talpey <tom@talpey.com >
Cc: Long Li <longli@microsoft.com >
Cc: Namjae Jeon <linkinjeon@kernel.org >
Cc: David Howells <dhowells@redhat.com >
Cc: Henrique Carvalho <henrique.carvalho@suse.com >
Cc: linux-cifs@vger.kernel.org
Cc: samba-technical@lists.samba.org
Signed-off-by: Stefan Metzmacher <metze@samba.org >
Signed-off-by: Steve French <stfrench@microsoft.com >
2026-04-15 21:58:24 -05:00
Stefan Metzmacher and Steve French
735610d0ce
smb: smbdirect: change smbdirect_socket_parameters.{initiator_depth,responder_resources} to __u16
...
We still limit this to U8_MAX as the rdma api only uses __u8
and that's also the limit for Infiniband and RoCE*,
while iWarp would be able to support larger values at
the protocol level.
As struct smbdirect_socket_parameters will be part
of the uapi for IPPROTO_SMBDIRECT in future, change it
now even if userspace sockets won't be supported yet.
Cc: Steve French <smfrench@gmail.com >
Cc: Tom Talpey <tom@talpey.com >
Cc: Long Li <longli@microsoft.com >
Cc: Namjae Jeon <linkinjeon@kernel.org >
Cc: David Howells <dhowells@redhat.com >
Cc: linux-cifs@vger.kernel.org
Cc: samba-technical@lists.samba.org
Acked-by: Henrique Carvalho <henrique.carvalho@suse.com >
Signed-off-by: Stefan Metzmacher <metze@samba.org >
Signed-off-by: Steve French <stfrench@microsoft.com >
2026-04-15 21:58:24 -05:00
Stefan Metzmacher and Steve French
aa43bb2c0f
smb: smbdirect: remove unused SMBDIRECT_USE_INLINE_C_FILES logic
...
We always build as standalone module (or as part of the core kernel).
This also removes unused elements from struct smbdirect_socket
and unused exports.
Cc: Steve French <smfrench@gmail.com >
Cc: Tom Talpey <tom@talpey.com >
Cc: Long Li <longli@microsoft.com >
Cc: Namjae Jeon <linkinjeon@kernel.org >
Cc: linux-cifs@vger.kernel.org
Cc: samba-technical@lists.samba.org
Signed-off-by: Stefan Metzmacher <metze@samba.org >
Acked-by: Namjae Jeon <linkinjeon@kernel.org >
Signed-off-by: Steve French <stfrench@microsoft.com >
2026-04-15 21:58:24 -05:00
Stefan Metzmacher and Steve French
1adde16a9e
smb: smbdirect: introduce global workqueues
...
These will be used in future and callers should no
longer use smbdirect_socket_set_custom_workqueue().
Cc: Steve French <smfrench@gmail.com >
Cc: Tom Talpey <tom@talpey.com >
Cc: Long Li <longli@microsoft.com >
Cc: Namjae Jeon <linkinjeon@kernel.org >
Cc: linux-cifs@vger.kernel.org
Cc: samba-technical@lists.samba.org
Signed-off-by: Stefan Metzmacher <metze@samba.org >
Acked-by: Namjae Jeon <linkinjeon@kernel.org >
Signed-off-by: Steve French <stfrench@microsoft.com >
2026-04-15 21:58:24 -05:00
Stefan Metzmacher and Steve French
e4ce1fca04
smb: smbdirect: prepare use of dedicated workqueues for different steps
...
This is a preparation in order to have global workqueues in
the smbdirect module instead of having the caller to
provide one.
Cc: Steve French <smfrench@gmail.com >
Cc: Tom Talpey <tom@talpey.com >
Cc: Long Li <longli@microsoft.com >
Cc: Namjae Jeon <linkinjeon@kernel.org >
Cc: linux-cifs@vger.kernel.org
Cc: samba-technical@lists.samba.org
Signed-off-by: Stefan Metzmacher <metze@samba.org >
Acked-by: Namjae Jeon <linkinjeon@kernel.org >
Signed-off-by: Steve French <stfrench@microsoft.com >
2026-04-15 21:58:24 -05:00
Stefan Metzmacher and Steve French
00ac2a4fe0
smb: smbdirect: remove unused smbdirect_connection_mr_io_recovery_work()
...
This would actually never be used as we only move to
SMBDIRECT_MR_ERROR when we directly call
smbdirect_socket_schedule_cleanup().
Doing an ib_dereg_mr/ib_alloc_mr dance on
working connection is not needed and
it's also pointless on a broken connection
as we don't reuse any ib_pd.
Cc: Steve French <smfrench@gmail.com >
Cc: Tom Talpey <tom@talpey.com >
Cc: Long Li <longli@microsoft.com >
Cc: Namjae Jeon <linkinjeon@kernel.org >
Cc: linux-cifs@vger.kernel.org
Cc: samba-technical@lists.samba.org
Signed-off-by: Stefan Metzmacher <metze@samba.org >
Acked-by: Namjae Jeon <linkinjeon@kernel.org >
Signed-off-by: Steve French <stfrench@microsoft.com >
2026-04-15 21:58:24 -05:00
Stefan Metzmacher and Steve French
a40e6f0166
smb: smbdirect: wrap rdma_disconnect() in rdma_[un]lock_handler()
...
This might not be needed, but it controls the order
of ib_drain_qp() and rdma_disconnect().
Cc: Steve French <smfrench@gmail.com >
Cc: Tom Talpey <tom@talpey.com >
Cc: Long Li <longli@microsoft.com >
Cc: Namjae Jeon <linkinjeon@kernel.org >
Cc: linux-cifs@vger.kernel.org
Cc: samba-technical@lists.samba.org
Signed-off-by: Stefan Metzmacher <metze@samba.org >
Acked-by: Namjae Jeon <linkinjeon@kernel.org >
Signed-off-by: Steve French <stfrench@microsoft.com >
2026-04-15 21:58:24 -05:00
Stefan Metzmacher and Steve French
81a7a3a0fa
smb: smbdirect: introduce smbdirect_netdev_rdma_capable_mode_type()
...
This is basically a copy of ksmbd_rdma_capable_netdev() in the
server, but this also prints a message when a device is renamed.
The differences are:
- It uses rdma_for_each_port() instead of implementing the
same logic again.
- It returns RDMA_NODE_{UNSPECIFIED,IB_CA,RNIC} values instead of bool
Cc: Steve French <smfrench@gmail.com >
Cc: Tom Talpey <tom@talpey.com >
Cc: Long Li <longli@microsoft.com >
Cc: Namjae Jeon <linkinjeon@kernel.org >
Cc: linux-cifs@vger.kernel.org
Cc: samba-technical@lists.samba.org
Signed-off-by: Stefan Metzmacher <metze@samba.org >
Acked-by: Namjae Jeon <linkinjeon@kernel.org >
Signed-off-by: Steve French <stfrench@microsoft.com >
2026-04-15 21:58:24 -05:00
Stefan Metzmacher and Steve French
f9a804da47
smb: smbdirect: introduce the basic smbdirect.ko
...
This exports the functions needed by cifs.ko and ksmbd.ko.
It doesn't yet provide a generic socket layer, but it
is a good start to introduce that on top.
It will be much easier after Davids refactoring
using MSG_SPLICE_PAGES, will make it easier to
use the socket layer without an additional copy.
Cc: Steve French <smfrench@gmail.com >
Cc: Tom Talpey <tom@talpey.com >
Cc: Long Li <longli@microsoft.com >
Cc: Namjae Jeon <linkinjeon@kernel.org >
Cc: David Howells <dhowells@redhat.com >
Cc: linux-cifs@vger.kernel.org
Cc: samba-technical@lists.samba.org
Signed-off-by: Stefan Metzmacher <metze@samba.org >
Acked-by: Namjae Jeon <linkinjeon@kernel.org >
Signed-off-by: Steve French <stfrench@microsoft.com >
2026-04-15 21:58:20 -05:00
Stefan Metzmacher and Steve French
dc691b91ad
smb: smbdirect: introduce smbdirect_socket_{listen,accept}()
...
These will be used by the server soon instead of using
smbdirect_accept_connect_request() together with rdma_listen().
Cc: Steve French <smfrench@gmail.com >
Cc: Tom Talpey <tom@talpey.com >
Cc: Long Li <longli@microsoft.com >
Cc: Namjae Jeon <linkinjeon@kernel.org >
Cc: linux-cifs@vger.kernel.org
Cc: samba-technical@lists.samba.org
Signed-off-by: Stefan Metzmacher <metze@samba.org >
Acked-by: Namjae Jeon <linkinjeon@kernel.org >
Signed-off-by: Steve French <stfrench@microsoft.com >
2026-04-15 21:58:20 -05:00
Stefan Metzmacher and Steve French
03f9e2c15f
smb: smbdirect: introduce smbdirect_socket_bind()
...
This will be used by the server in the next steps.
Cc: Steve French <smfrench@gmail.com >
Cc: Tom Talpey <tom@talpey.com >
Cc: Long Li <longli@microsoft.com >
Cc: Namjae Jeon <linkinjeon@kernel.org >
Cc: linux-cifs@vger.kernel.org
Cc: samba-technical@lists.samba.org
Signed-off-by: Stefan Metzmacher <metze@samba.org >
Acked-by: Namjae Jeon <linkinjeon@kernel.org >
Signed-off-by: Steve French <stfrench@microsoft.com >
2026-04-15 21:58:20 -05:00
Stefan Metzmacher and Steve French
84df3cde16
smb: smbdirect: split out smbdirect_accept_negotiate_finish()
...
This will make it easier to support the listen/accept socket interfaces
in the next steps.
Cc: Steve French <smfrench@gmail.com >
Cc: Tom Talpey <tom@talpey.com >
Cc: Long Li <longli@microsoft.com >
Cc: Namjae Jeon <linkinjeon@kernel.org >
Cc: linux-cifs@vger.kernel.org
Cc: samba-technical@lists.samba.org
Signed-off-by: Stefan Metzmacher <metze@samba.org >
Acked-by: Namjae Jeon <linkinjeon@kernel.org >
Signed-off-by: Steve French <stfrench@microsoft.com >
2026-04-15 21:58:20 -05:00
Stefan Metzmacher and Steve French
4c9e665cb1
smb: smbdirect: introduce smbdirect_init_send_batch_storage()
...
This makes it possible to use batching via public functions
without exposing the internals of struct smbdirect_send_batch.
Once the client no longer needs to use
smbdirect_connection_send_single_iter() we can remove this again.
Cc: Steve French <smfrench@gmail.com >
Cc: Tom Talpey <tom@talpey.com >
Cc: Long Li <longli@microsoft.com >
Cc: Namjae Jeon <linkinjeon@kernel.org >
Cc: linux-cifs@vger.kernel.org
Cc: samba-technical@lists.samba.org
Signed-off-by: Stefan Metzmacher <metze@samba.org >
Acked-by: Namjae Jeon <linkinjeon@kernel.org >
Signed-off-by: Steve French <stfrench@microsoft.com >
2026-04-15 21:58:20 -05:00
Stefan Metzmacher and Steve French
89df094290
smb: smbdirect: provide explicit prototypes for cross .c file functions
...
These prototypes are used between private .c files,
when they will be compiled alone into smbdirect.ko.
For now this uses the SMBDIRECT_USE_INLINE_C_FILES code path
and marks all function as '__maybe_unused static',
but this will make further changes easier.
Cc: Steve French <smfrench@gmail.com >
Cc: Tom Talpey <tom@talpey.com >
Cc: Long Li <longli@microsoft.com >
Cc: Namjae Jeon <linkinjeon@kernel.org >
Cc: linux-cifs@vger.kernel.org
Cc: samba-technical@lists.samba.org
Signed-off-by: Stefan Metzmacher <metze@samba.org >
Acked-by: Namjae Jeon <linkinjeon@kernel.org >
Signed-off-by: Steve French <stfrench@microsoft.com >
2026-04-15 21:58:20 -05:00
Stefan Metzmacher and Steve French
b2261ceedd
smb: smbdirect: introduce smbdirect_public.h with prototypes
...
smbdirect_public.h contains functions which will be still be
eported when we move to an smbdirect.ko.
For now this uses the SMBDIRECT_USE_INLINE_C_FILES code path
and marks all function as '__maybe_unused static',
but this will make further changes easier.
Note this generates the following things from checkpatch.pl,
so I passed --ignore=FILE_PATH_CHANGES,EXPORT_SYMBOL,COMPLEX_MACRO
ERROR: Macros with complex values should be enclosed in parentheses
#514 : FILE: fs/smb/common/smbdirect/smbdirect_public.h:18:
+#define __SMBDIRECT_PUBLIC__ __maybe_unused static
WARNING: EXPORT_SYMBOL(foo); should immediately follow its function/variable
#515 : FILE: fs/smb/common/smbdirect/smbdirect_public.h:19:
+#define __SMBDIRECT_EXPORT_SYMBOL__(__sym)
WARNING: EXPORT_SYMBOL(foo); should immediately follow its function/variable
#518 : FILE: fs/smb/common/smbdirect/smbdirect_public.h:22:
+#define __SMBDIRECT_EXPORT_SYMBOL__(__sym) EXPORT_SYMBOL_FOR_MODULES(__sym, "cifs,ksmbd")
This is exactly what we want here, so we should ignore the
checkpatch.pl problems.
Cc: Steve French <smfrench@gmail.com >
Cc: Tom Talpey <tom@talpey.com >
Cc: Long Li <longli@microsoft.com >
Cc: Namjae Jeon <linkinjeon@kernel.org >
Cc: linux-cifs@vger.kernel.org
Cc: samba-technical@lists.samba.org
Signed-off-by: Stefan Metzmacher <metze@samba.org >
Acked-by: Namjae Jeon <linkinjeon@kernel.org >
Signed-off-by: Steve French <stfrench@microsoft.com >
2026-04-15 21:58:20 -05:00
Stefan Metzmacher and Steve French
5e4bf7fadd
smb: smbdirect: let smbdirect_internal.h define pr_fmt without SMBDIRECT_USE_INLINE_C_FILES
...
When we move to smbdirect.ko we want log message prefixed with the
module name.
Note callers are still using smbdirect_socket_set_logging() in order
to redirect the per connection logging to their own log functions.
Cc: Steve French <smfrench@gmail.com >
Cc: Tom Talpey <tom@talpey.com >
Cc: Long Li <longli@microsoft.com >
Cc: Namjae Jeon <linkinjeon@kernel.org >
Cc: linux-cifs@vger.kernel.org
Cc: samba-technical@lists.samba.org
Signed-off-by: Stefan Metzmacher <metze@samba.org >
Acked-by: Namjae Jeon <linkinjeon@kernel.org >
Signed-off-by: Steve French <stfrench@microsoft.com >
2026-04-15 21:58:20 -05:00
Stefan Metzmacher and Steve French
b1e6277bd1
smb: smbdirect: let smbdirect_socket.h include all headers for used structures
...
Currently they are implicitly included via client and server code,
but this is needed when we move to an smbdirect.ko.
Cc: Steve French <smfrench@gmail.com >
Cc: Tom Talpey <tom@talpey.com >
Cc: Long Li <longli@microsoft.com >
Cc: Namjae Jeon <linkinjeon@kernel.org >
Cc: linux-cifs@vger.kernel.org
Cc: samba-technical@lists.samba.org
Signed-off-by: Stefan Metzmacher <metze@samba.org >
Acked-by: Namjae Jeon <linkinjeon@kernel.org >
Signed-off-by: Steve French <stfrench@microsoft.com >
2026-04-15 21:58:20 -05:00
Stefan Metzmacher and Steve French
20cd3cc442
smb: smbdirect: introduce smbdirect_socket_create_{kern,accepting}() and smbdirect_socket_release()
...
This provides functions which also allocate and free struct
smbdirect_socket.
This allows callers to use the same flow as with
sock_create_kern()/sock_release().
The end goal would be to use sock_create_kern()/sock_release(), but the
first step will be to use smbdirect specific functions without any
struct socket nor struct sock.
Cc: Steve French <smfrench@gmail.com >
Cc: Tom Talpey <tom@talpey.com >
Cc: Long Li <longli@microsoft.com >
Cc: Namjae Jeon <linkinjeon@kernel.org >
Cc: linux-cifs@vger.kernel.org
Cc: samba-technical@lists.samba.org
Signed-off-by: Stefan Metzmacher <metze@samba.org >
Acked-by: Namjae Jeon <linkinjeon@kernel.org >
Signed-off-by: Steve French <stfrench@microsoft.com >
2026-04-15 21:58:20 -05:00
Stefan Metzmacher and Steve French
eb3ed1e904
smb: smbdirect: introduce smbdirect_accept_connect_request()
...
This will be used by the server to handle new connections.
All rdma processing from rdma_accept() to RDMA_CM_EVENT_ESTABLISHED
as well as the waiting for the smbdirect negotiation request
and sending the negotiation response is done async
until we reach SMBDIRECT_SOCKET_CONNECTED.
Sync behaviour will be done by the server calling
smbdirect_conection_wait_for_connected() in order
to each SMBDIRECT_SOCKET_CONNECTED or an error.
Cc: Steve French <smfrench@gmail.com >
Cc: Tom Talpey <tom@talpey.com >
Cc: Long Li <longli@microsoft.com >
Cc: Namjae Jeon <linkinjeon@kernel.org >
Cc: linux-cifs@vger.kernel.org
Cc: samba-technical@lists.samba.org
Signed-off-by: Stefan Metzmacher <metze@samba.org >
Acked-by: Namjae Jeon <linkinjeon@kernel.org >
Signed-off-by: Steve French <stfrench@microsoft.com >
2026-04-15 21:58:20 -05:00
