1 /* 2 RFCOMM implementation for Linux Bluetooth stack (BlueZ). 3 Copyright (C) 2002 Maxim Krasnyansky <maxk@qualcomm.com> 4 Copyright (C) 2002 Marcel Holtmann <marcel@holtmann.org> 5 6 This program is free software; you can redistribute it and/or modify 7 it under the terms of the GNU General Public License version 2 as 8 published by the Free Software Foundation; 9 10 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS 11 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 12 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS. 13 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY 14 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES 15 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 16 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 17 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 18 19 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS, 20 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS 21 SOFTWARE IS DISCLAIMED. 22 */ 23 24 /* 25 * RFCOMM sockets. 26 */ 27 28 #include <linux/export.h> 29 #include <linux/debugfs.h> 30 #include <linux/sched/signal.h> 31 32 #include <net/bluetooth/bluetooth.h> 33 #include <net/bluetooth/hci_core.h> 34 #include <net/bluetooth/l2cap.h> 35 #include <net/bluetooth/rfcomm.h> 36 37 static const struct proto_ops rfcomm_sock_ops; 38 39 static struct bt_sock_list rfcomm_sk_list = { 40 .lock = __RW_LOCK_UNLOCKED(rfcomm_sk_list.lock) 41 }; 42 43 static void rfcomm_sock_close(struct sock *sk); 44 static void rfcomm_sock_kill(struct sock *sk); 45 46 /* ---- DLC callbacks ---- 47 * 48 * called under rfcomm_dlc_lock() 49 */ 50 static void rfcomm_sk_data_ready(struct rfcomm_dlc *d, struct sk_buff *skb) 51 { 52 struct sock *sk = d->owner; 53 if (!sk) 54 return; 55 56 atomic_add(skb->len, &sk->sk_rmem_alloc); 57 skb_queue_tail(&sk->sk_receive_queue, skb); 58 sk->sk_data_ready(sk); 59 60 if (atomic_read(&sk->sk_rmem_alloc) >= sk->sk_rcvbuf) 61 rfcomm_dlc_throttle(d); 62 } 63 64 static void rfcomm_sk_state_change(struct rfcomm_dlc *d, int err) 65 { 66 struct sock *sk = d->owner, *parent; 67 unsigned long flags; 68 69 if (!sk) 70 return; 71 72 BT_DBG("dlc %p state %ld err %d", d, d->state, err); 73 74 local_irq_save(flags); 75 bh_lock_sock(sk); 76 77 if (err) 78 sk->sk_err = err; 79 80 sk->sk_state = d->state; 81 82 parent = bt_sk(sk)->parent; 83 if (parent) { 84 if (d->state == BT_CLOSED) { 85 sock_set_flag(sk, SOCK_ZAPPED); 86 bt_accept_unlink(sk); 87 } 88 parent->sk_data_ready(parent); 89 } else { 90 if (d->state == BT_CONNECTED) 91 rfcomm_session_getaddr(d->session, 92 &rfcomm_pi(sk)->src, NULL); 93 sk->sk_state_change(sk); 94 } 95 96 bh_unlock_sock(sk); 97 local_irq_restore(flags); 98 99 if (parent && sock_flag(sk, SOCK_ZAPPED)) { 100 /* We have to drop DLC lock here, otherwise 101 * rfcomm_sock_destruct() will dead lock. */ 102 rfcomm_dlc_unlock(d); 103 rfcomm_sock_kill(sk); 104 rfcomm_dlc_lock(d); 105 } 106 } 107 108 /* ---- Socket functions ---- */ 109 static struct sock *__rfcomm_get_listen_sock_by_addr(u8 channel, bdaddr_t *src) 110 { 111 struct sock *sk = NULL; 112 113 sk_for_each(sk, &rfcomm_sk_list.head) { 114 if (rfcomm_pi(sk)->channel != channel) 115 continue; 116 117 if (bacmp(&rfcomm_pi(sk)->src, src)) 118 continue; 119 120 if (sk->sk_state == BT_BOUND || sk->sk_state == BT_LISTEN) 121 break; 122 } 123 124 return sk ? sk : NULL; 125 } 126 127 /* Find socket with channel and source bdaddr. 128 * Returns closest match. 129 */ 130 static struct sock *rfcomm_get_sock_by_channel(int state, u8 channel, bdaddr_t *src) 131 { 132 struct sock *sk = NULL, *sk1 = NULL; 133 134 read_lock(&rfcomm_sk_list.lock); 135 136 sk_for_each(sk, &rfcomm_sk_list.head) { 137 if (state && sk->sk_state != state) 138 continue; 139 140 if (rfcomm_pi(sk)->channel == channel) { 141 /* Exact match. */ 142 if (!bacmp(&rfcomm_pi(sk)->src, src)) 143 break; 144 145 /* Closest match */ 146 if (!bacmp(&rfcomm_pi(sk)->src, BDADDR_ANY)) 147 sk1 = sk; 148 } 149 } 150 151 read_unlock(&rfcomm_sk_list.lock); 152 153 return sk ? sk : sk1; 154 } 155 156 static void rfcomm_sock_destruct(struct sock *sk) 157 { 158 struct rfcomm_dlc *d = rfcomm_pi(sk)->dlc; 159 160 BT_DBG("sk %p dlc %p", sk, d); 161 162 skb_queue_purge(&sk->sk_receive_queue); 163 skb_queue_purge(&sk->sk_write_queue); 164 165 rfcomm_dlc_lock(d); 166 rfcomm_pi(sk)->dlc = NULL; 167 168 /* Detach DLC if it's owned by this socket */ 169 if (d->owner == sk) 170 d->owner = NULL; 171 rfcomm_dlc_unlock(d); 172 173 rfcomm_dlc_put(d); 174 } 175 176 static void rfcomm_sock_cleanup_listen(struct sock *parent) 177 { 178 struct sock *sk; 179 180 BT_DBG("parent %p", parent); 181 182 /* Close not yet accepted dlcs */ 183 while ((sk = bt_accept_dequeue(parent, NULL))) { 184 rfcomm_sock_close(sk); 185 rfcomm_sock_kill(sk); 186 } 187 188 parent->sk_state = BT_CLOSED; 189 sock_set_flag(parent, SOCK_ZAPPED); 190 } 191 192 /* Kill socket (only if zapped and orphan) 193 * Must be called on unlocked socket. 194 */ 195 static void rfcomm_sock_kill(struct sock *sk) 196 { 197 if (!sock_flag(sk, SOCK_ZAPPED) || sk->sk_socket) 198 return; 199 200 BT_DBG("sk %p state %d refcnt %d", sk, sk->sk_state, refcount_read(&sk->sk_refcnt)); 201 202 /* Kill poor orphan */ 203 bt_sock_unlink(&rfcomm_sk_list, sk); 204 sock_set_flag(sk, SOCK_DEAD); 205 sock_put(sk); 206 } 207 208 static void __rfcomm_sock_close(struct sock *sk) 209 { 210 struct rfcomm_dlc *d = rfcomm_pi(sk)->dlc; 211 212 BT_DBG("sk %p state %d socket %p", sk, sk->sk_state, sk->sk_socket); 213 214 switch (sk->sk_state) { 215 case BT_LISTEN: 216 rfcomm_sock_cleanup_listen(sk); 217 break; 218 219 case BT_CONNECT: 220 case BT_CONNECT2: 221 case BT_CONFIG: 222 case BT_CONNECTED: 223 rfcomm_dlc_close(d, 0); 224 225 default: 226 sock_set_flag(sk, SOCK_ZAPPED); 227 break; 228 } 229 } 230 231 /* Close socket. 232 * Must be called on unlocked socket. 233 */ 234 static void rfcomm_sock_close(struct sock *sk) 235 { 236 lock_sock(sk); 237 __rfcomm_sock_close(sk); 238 release_sock(sk); 239 } 240 241 static void rfcomm_sock_init(struct sock *sk, struct sock *parent) 242 { 243 struct rfcomm_pinfo *pi = rfcomm_pi(sk); 244 245 BT_DBG("sk %p", sk); 246 247 if (parent) { 248 sk->sk_type = parent->sk_type; 249 pi->dlc->defer_setup = test_bit(BT_SK_DEFER_SETUP, 250 &bt_sk(parent)->flags); 251 252 pi->sec_level = rfcomm_pi(parent)->sec_level; 253 pi->role_switch = rfcomm_pi(parent)->role_switch; 254 255 security_sk_clone(parent, sk); 256 } else { 257 pi->dlc->defer_setup = 0; 258 259 pi->sec_level = BT_SECURITY_LOW; 260 pi->role_switch = 0; 261 } 262 263 pi->dlc->sec_level = pi->sec_level; 264 pi->dlc->role_switch = pi->role_switch; 265 } 266 267 static struct proto rfcomm_proto = { 268 .name = "RFCOMM", 269 .owner = THIS_MODULE, 270 .obj_size = sizeof(struct rfcomm_pinfo) 271 }; 272 273 static struct sock *rfcomm_sock_alloc(struct net *net, struct socket *sock, int proto, gfp_t prio, int kern) 274 { 275 struct rfcomm_dlc *d; 276 struct sock *sk; 277 278 sk = sk_alloc(net, PF_BLUETOOTH, prio, &rfcomm_proto, kern); 279 if (!sk) 280 return NULL; 281 282 sock_init_data(sock, sk); 283 INIT_LIST_HEAD(&bt_sk(sk)->accept_q); 284 285 d = rfcomm_dlc_alloc(prio); 286 if (!d) { 287 sk_free(sk); 288 return NULL; 289 } 290 291 d->data_ready = rfcomm_sk_data_ready; 292 d->state_change = rfcomm_sk_state_change; 293 294 rfcomm_pi(sk)->dlc = d; 295 d->owner = sk; 296 297 sk->sk_destruct = rfcomm_sock_destruct; 298 sk->sk_sndtimeo = RFCOMM_CONN_TIMEOUT; 299 300 sk->sk_sndbuf = RFCOMM_MAX_CREDITS * RFCOMM_DEFAULT_MTU * 10; 301 sk->sk_rcvbuf = RFCOMM_MAX_CREDITS * RFCOMM_DEFAULT_MTU * 10; 302 303 sock_reset_flag(sk, SOCK_ZAPPED); 304 305 sk->sk_protocol = proto; 306 sk->sk_state = BT_OPEN; 307 308 bt_sock_link(&rfcomm_sk_list, sk); 309 310 BT_DBG("sk %p", sk); 311 return sk; 312 } 313 314 static int rfcomm_sock_create(struct net *net, struct socket *sock, 315 int protocol, int kern) 316 { 317 struct sock *sk; 318 319 BT_DBG("sock %p", sock); 320 321 sock->state = SS_UNCONNECTED; 322 323 if (sock->type != SOCK_STREAM && sock->type != SOCK_RAW) 324 return -ESOCKTNOSUPPORT; 325 326 sock->ops = &rfcomm_sock_ops; 327 328 sk = rfcomm_sock_alloc(net, sock, protocol, GFP_ATOMIC, kern); 329 if (!sk) 330 return -ENOMEM; 331 332 rfcomm_sock_init(sk, NULL); 333 return 0; 334 } 335 336 static int rfcomm_sock_bind(struct socket *sock, struct sockaddr *addr, int addr_len) 337 { 338 struct sockaddr_rc sa; 339 struct sock *sk = sock->sk; 340 int len, err = 0; 341 342 if (!addr || addr_len < offsetofend(struct sockaddr, sa_family) || 343 addr->sa_family != AF_BLUETOOTH) 344 return -EINVAL; 345 346 memset(&sa, 0, sizeof(sa)); 347 len = min_t(unsigned int, sizeof(sa), addr_len); 348 memcpy(&sa, addr, len); 349 350 BT_DBG("sk %p %pMR", sk, &sa.rc_bdaddr); 351 352 lock_sock(sk); 353 354 if (sk->sk_state != BT_OPEN) { 355 err = -EBADFD; 356 goto done; 357 } 358 359 if (sk->sk_type != SOCK_STREAM) { 360 err = -EINVAL; 361 goto done; 362 } 363 364 write_lock(&rfcomm_sk_list.lock); 365 366 if (sa.rc_channel && 367 __rfcomm_get_listen_sock_by_addr(sa.rc_channel, &sa.rc_bdaddr)) { 368 err = -EADDRINUSE; 369 } else { 370 /* Save source address */ 371 bacpy(&rfcomm_pi(sk)->src, &sa.rc_bdaddr); 372 rfcomm_pi(sk)->channel = sa.rc_channel; 373 sk->sk_state = BT_BOUND; 374 } 375 376 write_unlock(&rfcomm_sk_list.lock); 377 378 done: 379 release_sock(sk); 380 return err; 381 } 382 383 static int rfcomm_sock_connect(struct socket *sock, struct sockaddr *addr, int alen, int flags) 384 { 385 struct sockaddr_rc *sa = (struct sockaddr_rc *) addr; 386 struct sock *sk = sock->sk; 387 struct rfcomm_dlc *d = rfcomm_pi(sk)->dlc; 388 int err = 0; 389 390 BT_DBG("sk %p", sk); 391 392 if (alen < sizeof(struct sockaddr_rc) || 393 addr->sa_family != AF_BLUETOOTH) 394 return -EINVAL; 395 396 lock_sock(sk); 397 398 if (sk->sk_state != BT_OPEN && sk->sk_state != BT_BOUND) { 399 err = -EBADFD; 400 goto done; 401 } 402 403 if (sk->sk_type != SOCK_STREAM) { 404 err = -EINVAL; 405 goto done; 406 } 407 408 sk->sk_state = BT_CONNECT; 409 bacpy(&rfcomm_pi(sk)->dst, &sa->rc_bdaddr); 410 rfcomm_pi(sk)->channel = sa->rc_channel; 411 412 d->sec_level = rfcomm_pi(sk)->sec_level; 413 d->role_switch = rfcomm_pi(sk)->role_switch; 414 415 err = rfcomm_dlc_open(d, &rfcomm_pi(sk)->src, &sa->rc_bdaddr, 416 sa->rc_channel); 417 if (!err) 418 err = bt_sock_wait_state(sk, BT_CONNECTED, 419 sock_sndtimeo(sk, flags & O_NONBLOCK)); 420 421 done: 422 release_sock(sk); 423 return err; 424 } 425 426 static int rfcomm_sock_listen(struct socket *sock, int backlog) 427 { 428 struct sock *sk = sock->sk; 429 int err = 0; 430 431 BT_DBG("sk %p backlog %d", sk, backlog); 432 433 lock_sock(sk); 434 435 if (sk->sk_state != BT_BOUND) { 436 err = -EBADFD; 437 goto done; 438 } 439 440 if (sk->sk_type != SOCK_STREAM) { 441 err = -EINVAL; 442 goto done; 443 } 444 445 if (!rfcomm_pi(sk)->channel) { 446 bdaddr_t *src = &rfcomm_pi(sk)->src; 447 u8 channel; 448 449 err = -EINVAL; 450 451 write_lock(&rfcomm_sk_list.lock); 452 453 for (channel = 1; channel < 31; channel++) 454 if (!__rfcomm_get_listen_sock_by_addr(channel, src)) { 455 rfcomm_pi(sk)->channel = channel; 456 err = 0; 457 break; 458 } 459 460 write_unlock(&rfcomm_sk_list.lock); 461 462 if (err < 0) 463 goto done; 464 } 465 466 sk->sk_max_ack_backlog = backlog; 467 sk->sk_ack_backlog = 0; 468 sk->sk_state = BT_LISTEN; 469 470 done: 471 release_sock(sk); 472 return err; 473 } 474 475 static int rfcomm_sock_accept(struct socket *sock, struct socket *newsock, int flags, 476 bool kern) 477 { 478 DEFINE_WAIT_FUNC(wait, woken_wake_function); 479 struct sock *sk = sock->sk, *nsk; 480 long timeo; 481 int err = 0; 482 483 lock_sock_nested(sk, SINGLE_DEPTH_NESTING); 484 485 if (sk->sk_type != SOCK_STREAM) { 486 err = -EINVAL; 487 goto done; 488 } 489 490 timeo = sock_rcvtimeo(sk, flags & O_NONBLOCK); 491 492 BT_DBG("sk %p timeo %ld", sk, timeo); 493 494 /* Wait for an incoming connection. (wake-one). */ 495 add_wait_queue_exclusive(sk_sleep(sk), &wait); 496 while (1) { 497 if (sk->sk_state != BT_LISTEN) { 498 err = -EBADFD; 499 break; 500 } 501 502 nsk = bt_accept_dequeue(sk, newsock); 503 if (nsk) 504 break; 505 506 if (!timeo) { 507 err = -EAGAIN; 508 break; 509 } 510 511 if (signal_pending(current)) { 512 err = sock_intr_errno(timeo); 513 break; 514 } 515 516 release_sock(sk); 517 518 timeo = wait_woken(&wait, TASK_INTERRUPTIBLE, timeo); 519 520 lock_sock_nested(sk, SINGLE_DEPTH_NESTING); 521 } 522 remove_wait_queue(sk_sleep(sk), &wait); 523 524 if (err) 525 goto done; 526 527 newsock->state = SS_CONNECTED; 528 529 BT_DBG("new socket %p", nsk); 530 531 done: 532 release_sock(sk); 533 return err; 534 } 535 536 static int rfcomm_sock_getname(struct socket *sock, struct sockaddr *addr, int peer) 537 { 538 struct sockaddr_rc *sa = (struct sockaddr_rc *) addr; 539 struct sock *sk = sock->sk; 540 541 BT_DBG("sock %p, sk %p", sock, sk); 542 543 if (peer && sk->sk_state != BT_CONNECTED && 544 sk->sk_state != BT_CONNECT && sk->sk_state != BT_CONNECT2) 545 return -ENOTCONN; 546 547 memset(sa, 0, sizeof(*sa)); 548 sa->rc_family = AF_BLUETOOTH; 549 sa->rc_channel = rfcomm_pi(sk)->channel; 550 if (peer) 551 bacpy(&sa->rc_bdaddr, &rfcomm_pi(sk)->dst); 552 else 553 bacpy(&sa->rc_bdaddr, &rfcomm_pi(sk)->src); 554 555 return sizeof(struct sockaddr_rc); 556 } 557 558 static int rfcomm_sock_sendmsg(struct socket *sock, struct msghdr *msg, 559 size_t len) 560 { 561 struct sock *sk = sock->sk; 562 struct rfcomm_dlc *d = rfcomm_pi(sk)->dlc; 563 struct sk_buff *skb; 564 int sent; 565 566 if (test_bit(RFCOMM_DEFER_SETUP, &d->flags)) 567 return -ENOTCONN; 568 569 if (msg->msg_flags & MSG_OOB) 570 return -EOPNOTSUPP; 571 572 if (sk->sk_shutdown & SEND_SHUTDOWN) 573 return -EPIPE; 574 575 BT_DBG("sock %p, sk %p", sock, sk); 576 577 lock_sock(sk); 578 579 sent = bt_sock_wait_ready(sk, msg->msg_flags); 580 if (sent) 581 goto done; 582 583 while (len) { 584 size_t size = min_t(size_t, len, d->mtu); 585 int err; 586 587 skb = sock_alloc_send_skb(sk, size + RFCOMM_SKB_RESERVE, 588 msg->msg_flags & MSG_DONTWAIT, &err); 589 if (!skb) { 590 if (sent == 0) 591 sent = err; 592 break; 593 } 594 skb_reserve(skb, RFCOMM_SKB_HEAD_RESERVE); 595 596 err = memcpy_from_msg(skb_put(skb, size), msg, size); 597 if (err) { 598 kfree_skb(skb); 599 if (sent == 0) 600 sent = err; 601 break; 602 } 603 604 skb->priority = sk->sk_priority; 605 606 err = rfcomm_dlc_send(d, skb); 607 if (err < 0) { 608 kfree_skb(skb); 609 if (sent == 0) 610 sent = err; 611 break; 612 } 613 614 sent += size; 615 len -= size; 616 } 617 618 done: 619 release_sock(sk); 620 621 return sent; 622 } 623 624 static int rfcomm_sock_recvmsg(struct socket *sock, struct msghdr *msg, 625 size_t size, int flags) 626 { 627 struct sock *sk = sock->sk; 628 struct rfcomm_dlc *d = rfcomm_pi(sk)->dlc; 629 int len; 630 631 if (test_and_clear_bit(RFCOMM_DEFER_SETUP, &d->flags)) { 632 rfcomm_dlc_accept(d); 633 return 0; 634 } 635 636 len = bt_sock_stream_recvmsg(sock, msg, size, flags); 637 638 lock_sock(sk); 639 if (!(flags & MSG_PEEK) && len > 0) 640 atomic_sub(len, &sk->sk_rmem_alloc); 641 642 if (atomic_read(&sk->sk_rmem_alloc) <= (sk->sk_rcvbuf >> 2)) 643 rfcomm_dlc_unthrottle(rfcomm_pi(sk)->dlc); 644 release_sock(sk); 645 646 return len; 647 } 648 649 static int rfcomm_sock_setsockopt_old(struct socket *sock, int optname, char __user *optval, unsigned int optlen) 650 { 651 struct sock *sk = sock->sk; 652 int err = 0; 653 u32 opt; 654 655 BT_DBG("sk %p", sk); 656 657 lock_sock(sk); 658 659 switch (optname) { 660 case RFCOMM_LM: 661 if (get_user(opt, (u32 __user *) optval)) { 662 err = -EFAULT; 663 break; 664 } 665 666 if (opt & RFCOMM_LM_FIPS) { 667 err = -EINVAL; 668 break; 669 } 670 671 if (opt & RFCOMM_LM_AUTH) 672 rfcomm_pi(sk)->sec_level = BT_SECURITY_LOW; 673 if (opt & RFCOMM_LM_ENCRYPT) 674 rfcomm_pi(sk)->sec_level = BT_SECURITY_MEDIUM; 675 if (opt & RFCOMM_LM_SECURE) 676 rfcomm_pi(sk)->sec_level = BT_SECURITY_HIGH; 677 678 rfcomm_pi(sk)->role_switch = (opt & RFCOMM_LM_MASTER); 679 break; 680 681 default: 682 err = -ENOPROTOOPT; 683 break; 684 } 685 686 release_sock(sk); 687 return err; 688 } 689 690 static int rfcomm_sock_setsockopt(struct socket *sock, int level, int optname, char __user *optval, unsigned int optlen) 691 { 692 struct sock *sk = sock->sk; 693 struct bt_security sec; 694 int err = 0; 695 size_t len; 696 u32 opt; 697 698 BT_DBG("sk %p", sk); 699 700 if (level == SOL_RFCOMM) 701 return rfcomm_sock_setsockopt_old(sock, optname, optval, optlen); 702 703 if (level != SOL_BLUETOOTH) 704 return -ENOPROTOOPT; 705 706 lock_sock(sk); 707 708 switch (optname) { 709 case BT_SECURITY: 710 if (sk->sk_type != SOCK_STREAM) { 711 err = -EINVAL; 712 break; 713 } 714 715 sec.level = BT_SECURITY_LOW; 716 717 len = min_t(unsigned int, sizeof(sec), optlen); 718 if (copy_from_user((char *) &sec, optval, len)) { 719 err = -EFAULT; 720 break; 721 } 722 723 if (sec.level > BT_SECURITY_HIGH) { 724 err = -EINVAL; 725 break; 726 } 727 728 rfcomm_pi(sk)->sec_level = sec.level; 729 break; 730 731 case BT_DEFER_SETUP: 732 if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) { 733 err = -EINVAL; 734 break; 735 } 736 737 if (get_user(opt, (u32 __user *) optval)) { 738 err = -EFAULT; 739 break; 740 } 741 742 if (opt) 743 set_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags); 744 else 745 clear_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags); 746 747 break; 748 749 default: 750 err = -ENOPROTOOPT; 751 break; 752 } 753 754 release_sock(sk); 755 return err; 756 } 757 758 static int rfcomm_sock_getsockopt_old(struct socket *sock, int optname, char __user *optval, int __user *optlen) 759 { 760 struct sock *sk = sock->sk; 761 struct sock *l2cap_sk; 762 struct l2cap_conn *conn; 763 struct rfcomm_conninfo cinfo; 764 int len, err = 0; 765 u32 opt; 766 767 BT_DBG("sk %p", sk); 768 769 if (get_user(len, optlen)) 770 return -EFAULT; 771 772 lock_sock(sk); 773 774 switch (optname) { 775 case RFCOMM_LM: 776 switch (rfcomm_pi(sk)->sec_level) { 777 case BT_SECURITY_LOW: 778 opt = RFCOMM_LM_AUTH; 779 break; 780 case BT_SECURITY_MEDIUM: 781 opt = RFCOMM_LM_AUTH | RFCOMM_LM_ENCRYPT; 782 break; 783 case BT_SECURITY_HIGH: 784 opt = RFCOMM_LM_AUTH | RFCOMM_LM_ENCRYPT | 785 RFCOMM_LM_SECURE; 786 break; 787 case BT_SECURITY_FIPS: 788 opt = RFCOMM_LM_AUTH | RFCOMM_LM_ENCRYPT | 789 RFCOMM_LM_SECURE | RFCOMM_LM_FIPS; 790 break; 791 default: 792 opt = 0; 793 break; 794 } 795 796 if (rfcomm_pi(sk)->role_switch) 797 opt |= RFCOMM_LM_MASTER; 798 799 if (put_user(opt, (u32 __user *) optval)) 800 err = -EFAULT; 801 802 break; 803 804 case RFCOMM_CONNINFO: 805 if (sk->sk_state != BT_CONNECTED && 806 !rfcomm_pi(sk)->dlc->defer_setup) { 807 err = -ENOTCONN; 808 break; 809 } 810 811 l2cap_sk = rfcomm_pi(sk)->dlc->session->sock->sk; 812 conn = l2cap_pi(l2cap_sk)->chan->conn; 813 814 memset(&cinfo, 0, sizeof(cinfo)); 815 cinfo.hci_handle = conn->hcon->handle; 816 memcpy(cinfo.dev_class, conn->hcon->dev_class, 3); 817 818 len = min_t(unsigned int, len, sizeof(cinfo)); 819 if (copy_to_user(optval, (char *) &cinfo, len)) 820 err = -EFAULT; 821 822 break; 823 824 default: 825 err = -ENOPROTOOPT; 826 break; 827 } 828 829 release_sock(sk); 830 return err; 831 } 832 833 static int rfcomm_sock_getsockopt(struct socket *sock, int level, int optname, char __user *optval, int __user *optlen) 834 { 835 struct sock *sk = sock->sk; 836 struct bt_security sec; 837 int len, err = 0; 838 839 BT_DBG("sk %p", sk); 840 841 if (level == SOL_RFCOMM) 842 return rfcomm_sock_getsockopt_old(sock, optname, optval, optlen); 843 844 if (level != SOL_BLUETOOTH) 845 return -ENOPROTOOPT; 846 847 if (get_user(len, optlen)) 848 return -EFAULT; 849 850 lock_sock(sk); 851 852 switch (optname) { 853 case BT_SECURITY: 854 if (sk->sk_type != SOCK_STREAM) { 855 err = -EINVAL; 856 break; 857 } 858 859 sec.level = rfcomm_pi(sk)->sec_level; 860 sec.key_size = 0; 861 862 len = min_t(unsigned int, len, sizeof(sec)); 863 if (copy_to_user(optval, (char *) &sec, len)) 864 err = -EFAULT; 865 866 break; 867 868 case BT_DEFER_SETUP: 869 if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) { 870 err = -EINVAL; 871 break; 872 } 873 874 if (put_user(test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags), 875 (u32 __user *) optval)) 876 err = -EFAULT; 877 878 break; 879 880 default: 881 err = -ENOPROTOOPT; 882 break; 883 } 884 885 release_sock(sk); 886 return err; 887 } 888 889 static int rfcomm_sock_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg) 890 { 891 struct sock *sk __maybe_unused = sock->sk; 892 int err; 893 894 BT_DBG("sk %p cmd %x arg %lx", sk, cmd, arg); 895 896 err = bt_sock_ioctl(sock, cmd, arg); 897 898 if (err == -ENOIOCTLCMD) { 899 #ifdef CONFIG_BT_RFCOMM_TTY 900 lock_sock(sk); 901 err = rfcomm_dev_ioctl(sk, cmd, (void __user *) arg); 902 release_sock(sk); 903 #else 904 err = -EOPNOTSUPP; 905 #endif 906 } 907 908 return err; 909 } 910 911 static int rfcomm_sock_shutdown(struct socket *sock, int how) 912 { 913 struct sock *sk = sock->sk; 914 int err = 0; 915 916 BT_DBG("sock %p, sk %p", sock, sk); 917 918 if (!sk) 919 return 0; 920 921 lock_sock(sk); 922 if (!sk->sk_shutdown) { 923 sk->sk_shutdown = SHUTDOWN_MASK; 924 __rfcomm_sock_close(sk); 925 926 if (sock_flag(sk, SOCK_LINGER) && sk->sk_lingertime && 927 !(current->flags & PF_EXITING)) 928 err = bt_sock_wait_state(sk, BT_CLOSED, sk->sk_lingertime); 929 } 930 release_sock(sk); 931 return err; 932 } 933 934 static int rfcomm_sock_release(struct socket *sock) 935 { 936 struct sock *sk = sock->sk; 937 int err; 938 939 BT_DBG("sock %p, sk %p", sock, sk); 940 941 if (!sk) 942 return 0; 943 944 err = rfcomm_sock_shutdown(sock, 2); 945 946 sock_orphan(sk); 947 rfcomm_sock_kill(sk); 948 return err; 949 } 950 951 /* ---- RFCOMM core layer callbacks ---- 952 * 953 * called under rfcomm_lock() 954 */ 955 int rfcomm_connect_ind(struct rfcomm_session *s, u8 channel, struct rfcomm_dlc **d) 956 { 957 struct sock *sk, *parent; 958 bdaddr_t src, dst; 959 int result = 0; 960 961 BT_DBG("session %p channel %d", s, channel); 962 963 rfcomm_session_getaddr(s, &src, &dst); 964 965 /* Check if we have socket listening on channel */ 966 parent = rfcomm_get_sock_by_channel(BT_LISTEN, channel, &src); 967 if (!parent) 968 return 0; 969 970 bh_lock_sock(parent); 971 972 /* Check for backlog size */ 973 if (sk_acceptq_is_full(parent)) { 974 BT_DBG("backlog full %d", parent->sk_ack_backlog); 975 goto done; 976 } 977 978 sk = rfcomm_sock_alloc(sock_net(parent), NULL, BTPROTO_RFCOMM, GFP_ATOMIC, 0); 979 if (!sk) 980 goto done; 981 982 bt_sock_reclassify_lock(sk, BTPROTO_RFCOMM); 983 984 rfcomm_sock_init(sk, parent); 985 bacpy(&rfcomm_pi(sk)->src, &src); 986 bacpy(&rfcomm_pi(sk)->dst, &dst); 987 rfcomm_pi(sk)->channel = channel; 988 989 sk->sk_state = BT_CONFIG; 990 bt_accept_enqueue(parent, sk); 991 992 /* Accept connection and return socket DLC */ 993 *d = rfcomm_pi(sk)->dlc; 994 result = 1; 995 996 done: 997 bh_unlock_sock(parent); 998 999 if (test_bit(BT_SK_DEFER_SETUP, &bt_sk(parent)->flags)) 1000 parent->sk_state_change(parent); 1001 1002 return result; 1003 } 1004 1005 static int rfcomm_sock_debugfs_show(struct seq_file *f, void *p) 1006 { 1007 struct sock *sk; 1008 1009 read_lock(&rfcomm_sk_list.lock); 1010 1011 sk_for_each(sk, &rfcomm_sk_list.head) { 1012 seq_printf(f, "%pMR %pMR %d %d\n", 1013 &rfcomm_pi(sk)->src, &rfcomm_pi(sk)->dst, 1014 sk->sk_state, rfcomm_pi(sk)->channel); 1015 } 1016 1017 read_unlock(&rfcomm_sk_list.lock); 1018 1019 return 0; 1020 } 1021 1022 static int rfcomm_sock_debugfs_open(struct inode *inode, struct file *file) 1023 { 1024 return single_open(file, rfcomm_sock_debugfs_show, inode->i_private); 1025 } 1026 1027 static const struct file_operations rfcomm_sock_debugfs_fops = { 1028 .open = rfcomm_sock_debugfs_open, 1029 .read = seq_read, 1030 .llseek = seq_lseek, 1031 .release = single_release, 1032 }; 1033 1034 static struct dentry *rfcomm_sock_debugfs; 1035 1036 static const struct proto_ops rfcomm_sock_ops = { 1037 .family = PF_BLUETOOTH, 1038 .owner = THIS_MODULE, 1039 .release = rfcomm_sock_release, 1040 .bind = rfcomm_sock_bind, 1041 .connect = rfcomm_sock_connect, 1042 .listen = rfcomm_sock_listen, 1043 .accept = rfcomm_sock_accept, 1044 .getname = rfcomm_sock_getname, 1045 .sendmsg = rfcomm_sock_sendmsg, 1046 .recvmsg = rfcomm_sock_recvmsg, 1047 .shutdown = rfcomm_sock_shutdown, 1048 .setsockopt = rfcomm_sock_setsockopt, 1049 .getsockopt = rfcomm_sock_getsockopt, 1050 .ioctl = rfcomm_sock_ioctl, 1051 .poll = bt_sock_poll, 1052 .socketpair = sock_no_socketpair, 1053 .mmap = sock_no_mmap 1054 }; 1055 1056 static const struct net_proto_family rfcomm_sock_family_ops = { 1057 .family = PF_BLUETOOTH, 1058 .owner = THIS_MODULE, 1059 .create = rfcomm_sock_create 1060 }; 1061 1062 int __init rfcomm_init_sockets(void) 1063 { 1064 int err; 1065 1066 BUILD_BUG_ON(sizeof(struct sockaddr_rc) > sizeof(struct sockaddr)); 1067 1068 err = proto_register(&rfcomm_proto, 0); 1069 if (err < 0) 1070 return err; 1071 1072 err = bt_sock_register(BTPROTO_RFCOMM, &rfcomm_sock_family_ops); 1073 if (err < 0) { 1074 BT_ERR("RFCOMM socket layer registration failed"); 1075 goto error; 1076 } 1077 1078 err = bt_procfs_init(&init_net, "rfcomm", &rfcomm_sk_list, NULL); 1079 if (err < 0) { 1080 BT_ERR("Failed to create RFCOMM proc file"); 1081 bt_sock_unregister(BTPROTO_RFCOMM); 1082 goto error; 1083 } 1084 1085 BT_INFO("RFCOMM socket layer initialized"); 1086 1087 if (IS_ERR_OR_NULL(bt_debugfs)) 1088 return 0; 1089 1090 rfcomm_sock_debugfs = debugfs_create_file("rfcomm", 0444, 1091 bt_debugfs, NULL, 1092 &rfcomm_sock_debugfs_fops); 1093 1094 return 0; 1095 1096 error: 1097 proto_unregister(&rfcomm_proto); 1098 return err; 1099 } 1100 1101 void __exit rfcomm_cleanup_sockets(void) 1102 { 1103 bt_procfs_cleanup(&init_net, "rfcomm"); 1104 1105 debugfs_remove(rfcomm_sock_debugfs); 1106 1107 bt_sock_unregister(BTPROTO_RFCOMM); 1108 1109 proto_unregister(&rfcomm_proto); 1110 } 1111