|
|
@@ -125,6 +125,94 @@ cifs_get_credits_field(struct TCP_Server_Info *server)
|
|
|
return &server->credits;
|
|
|
}
|
|
|
|
|
|
+/*
|
|
|
+ * Find a free multiplex id (SMB mid). Otherwise there could be
|
|
|
+ * mid collisions which might cause problems, demultiplexing the
|
|
|
+ * wrong response to this request. Multiplex ids could collide if
|
|
|
+ * one of a series requests takes much longer than the others, or
|
|
|
+ * if a very large number of long lived requests (byte range
|
|
|
+ * locks or FindNotify requests) are pending. No more than
|
|
|
+ * 64K-1 requests can be outstanding at one time. If no
|
|
|
+ * mids are available, return zero. A future optimization
|
|
|
+ * could make the combination of mids and uid the key we use
|
|
|
+ * to demultiplex on (rather than mid alone).
|
|
|
+ * In addition to the above check, the cifs demultiplex
|
|
|
+ * code already used the command code as a secondary
|
|
|
+ * check of the frame and if signing is negotiated the
|
|
|
+ * response would be discarded if the mid were the same
|
|
|
+ * but the signature was wrong. Since the mid is not put in the
|
|
|
+ * pending queue until later (when it is about to be dispatched)
|
|
|
+ * we do have to limit the number of outstanding requests
|
|
|
+ * to somewhat less than 64K-1 although it is hard to imagine
|
|
|
+ * so many threads being in the vfs at one time.
|
|
|
+ */
|
|
|
+static __u64
|
|
|
+cifs_get_next_mid(struct TCP_Server_Info *server)
|
|
|
+{
|
|
|
+ __u64 mid = 0;
|
|
|
+ __u16 last_mid, cur_mid;
|
|
|
+ bool collision;
|
|
|
+
|
|
|
+ spin_lock(&GlobalMid_Lock);
|
|
|
+
|
|
|
+ /* mid is 16 bit only for CIFS/SMB */
|
|
|
+ cur_mid = (__u16)((server->CurrentMid) & 0xffff);
|
|
|
+ /* we do not want to loop forever */
|
|
|
+ last_mid = cur_mid;
|
|
|
+ cur_mid++;
|
|
|
+
|
|
|
+ /*
|
|
|
+ * This nested loop looks more expensive than it is.
|
|
|
+ * In practice the list of pending requests is short,
|
|
|
+ * fewer than 50, and the mids are likely to be unique
|
|
|
+ * on the first pass through the loop unless some request
|
|
|
+ * takes longer than the 64 thousand requests before it
|
|
|
+ * (and it would also have to have been a request that
|
|
|
+ * did not time out).
|
|
|
+ */
|
|
|
+ while (cur_mid != last_mid) {
|
|
|
+ struct mid_q_entry *mid_entry;
|
|
|
+ unsigned int num_mids;
|
|
|
+
|
|
|
+ collision = false;
|
|
|
+ if (cur_mid == 0)
|
|
|
+ cur_mid++;
|
|
|
+
|
|
|
+ num_mids = 0;
|
|
|
+ list_for_each_entry(mid_entry, &server->pending_mid_q, qhead) {
|
|
|
+ ++num_mids;
|
|
|
+ if (mid_entry->mid == cur_mid &&
|
|
|
+ mid_entry->mid_state == MID_REQUEST_SUBMITTED) {
|
|
|
+ /* This mid is in use, try a different one */
|
|
|
+ collision = true;
|
|
|
+ break;
|
|
|
+ }
|
|
|
+ }
|
|
|
+
|
|
|
+ /*
|
|
|
+ * if we have more than 32k mids in the list, then something
|
|
|
+ * is very wrong. Possibly a local user is trying to DoS the
|
|
|
+ * box by issuing long-running calls and SIGKILL'ing them. If
|
|
|
+ * we get to 2^16 mids then we're in big trouble as this
|
|
|
+ * function could loop forever.
|
|
|
+ *
|
|
|
+ * Go ahead and assign out the mid in this situation, but force
|
|
|
+ * an eventual reconnect to clean out the pending_mid_q.
|
|
|
+ */
|
|
|
+ if (num_mids > 32768)
|
|
|
+ server->tcpStatus = CifsNeedReconnect;
|
|
|
+
|
|
|
+ if (!collision) {
|
|
|
+ mid = (__u64)cur_mid;
|
|
|
+ server->CurrentMid = mid;
|
|
|
+ break;
|
|
|
+ }
|
|
|
+ cur_mid++;
|
|
|
+ }
|
|
|
+ spin_unlock(&GlobalMid_Lock);
|
|
|
+ return mid;
|
|
|
+}
|
|
|
+
|
|
|
struct smb_version_operations smb1_operations = {
|
|
|
.send_cancel = send_nt_cancel,
|
|
|
.compare_fids = cifs_compare_fids,
|
|
|
@@ -133,6 +221,7 @@ struct smb_version_operations smb1_operations = {
|
|
|
.add_credits = cifs_add_credits,
|
|
|
.set_credits = cifs_set_credits,
|
|
|
.get_credits_field = cifs_get_credits_field,
|
|
|
+ .get_next_mid = cifs_get_next_mid,
|
|
|
.read_data_offset = cifs_read_data_offset,
|
|
|
.read_data_length = cifs_read_data_length,
|
|
|
.map_error = map_smb_to_linux_error,
|
Pavel Shilovsky