1 /* 2 RFCOMM implementation for Linux Bluetooth stack (BlueZ). 3 Copyright (C) 2002 Maxim Krasnyansky <maxk@qualcomm.com> 4 Copyright (C) 2002 Marcel Holtmann <marcel@holtmann.org> 5 6 This program is free software; you can redistribute it and/or modify 7 it under the terms of the GNU General Public License version 2 as 8 published by the Free Software Foundation; 9 10 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS 11 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 12 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS. 13 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY 14 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES 15 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 16 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 17 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 18 19 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS, 20 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS 21 SOFTWARE IS DISCLAIMED. 22 */ 23 24 /* 25 * RFCOMM sockets. 26 */ 27 28 #include <linux/export.h> 29 #include <linux/debugfs.h> 30 31 #include <net/bluetooth/bluetooth.h> 32 #include <net/bluetooth/hci_core.h> 33 #include <net/bluetooth/l2cap.h> 34 #include <net/bluetooth/rfcomm.h> 35 36 static const struct proto_ops rfcomm_sock_ops; 37 38 static struct bt_sock_list rfcomm_sk_list = { 39 .lock = __RW_LOCK_UNLOCKED(rfcomm_sk_list.lock) 40 }; 41 42 static void rfcomm_sock_close(struct sock *sk); 43 static void rfcomm_sock_kill(struct sock *sk); 44 45 /* ---- DLC callbacks ---- 46 * 47 * called under rfcomm_dlc_lock() 48 */ 49 static void rfcomm_sk_data_ready(struct rfcomm_dlc *d, struct sk_buff *skb) 50 { 51 struct sock *sk = d->owner; 52 if (!sk) 53 return; 54 55 atomic_add(skb->len, &sk->sk_rmem_alloc); 56 skb_queue_tail(&sk->sk_receive_queue, skb); 57 sk->sk_data_ready(sk, skb->len); 58 59 if (atomic_read(&sk->sk_rmem_alloc) >= sk->sk_rcvbuf) 60 rfcomm_dlc_throttle(d); 61 } 62 63 static void rfcomm_sk_state_change(struct rfcomm_dlc *d, int err) 64 { 65 struct sock *sk = d->owner, *parent; 66 unsigned long flags; 67 68 if (!sk) 69 return; 70 71 BT_DBG("dlc %p state %ld err %d", d, d->state, err); 72 73 local_irq_save(flags); 74 bh_lock_sock(sk); 75 76 if (err) 77 sk->sk_err = err; 78 79 sk->sk_state = d->state; 80 81 parent = bt_sk(sk)->parent; 82 if (parent) { 83 if (d->state == BT_CLOSED) { 84 sock_set_flag(sk, SOCK_ZAPPED); 85 bt_accept_unlink(sk); 86 } 87 parent->sk_data_ready(parent, 0); 88 } else { 89 if (d->state == BT_CONNECTED) 90 rfcomm_session_getaddr(d->session, &bt_sk(sk)->src, NULL); 91 sk->sk_state_change(sk); 92 } 93 94 bh_unlock_sock(sk); 95 local_irq_restore(flags); 96 97 if (parent && sock_flag(sk, SOCK_ZAPPED)) { 98 /* We have to drop DLC lock here, otherwise 99 * rfcomm_sock_destruct() will dead lock. */ 100 rfcomm_dlc_unlock(d); 101 rfcomm_sock_kill(sk); 102 rfcomm_dlc_lock(d); 103 } 104 } 105 106 /* ---- Socket functions ---- */ 107 static struct sock *__rfcomm_get_sock_by_addr(u8 channel, bdaddr_t *src) 108 { 109 struct sock *sk = NULL; 110 struct hlist_node *node; 111 112 sk_for_each(sk, node, &rfcomm_sk_list.head) { 113 if (rfcomm_pi(sk)->channel == channel && 114 !bacmp(&bt_sk(sk)->src, src)) 115 break; 116 } 117 118 return node ? sk : NULL; 119 } 120 121 /* Find socket with channel and source bdaddr. 122 * Returns closest match. 123 */ 124 static struct sock *rfcomm_get_sock_by_channel(int state, u8 channel, bdaddr_t *src) 125 { 126 struct sock *sk = NULL, *sk1 = NULL; 127 struct hlist_node *node; 128 129 read_lock(&rfcomm_sk_list.lock); 130 131 sk_for_each(sk, node, &rfcomm_sk_list.head) { 132 if (state && sk->sk_state != state) 133 continue; 134 135 if (rfcomm_pi(sk)->channel == channel) { 136 /* Exact match. */ 137 if (!bacmp(&bt_sk(sk)->src, src)) 138 break; 139 140 /* Closest match */ 141 if (!bacmp(&bt_sk(sk)->src, BDADDR_ANY)) 142 sk1 = sk; 143 } 144 } 145 146 read_unlock(&rfcomm_sk_list.lock); 147 148 return node ? sk : sk1; 149 } 150 151 static void rfcomm_sock_destruct(struct sock *sk) 152 { 153 struct rfcomm_dlc *d = rfcomm_pi(sk)->dlc; 154 155 BT_DBG("sk %p dlc %p", sk, d); 156 157 skb_queue_purge(&sk->sk_receive_queue); 158 skb_queue_purge(&sk->sk_write_queue); 159 160 rfcomm_dlc_lock(d); 161 rfcomm_pi(sk)->dlc = NULL; 162 163 /* Detach DLC if it's owned by this socket */ 164 if (d->owner == sk) 165 d->owner = NULL; 166 rfcomm_dlc_unlock(d); 167 168 rfcomm_dlc_put(d); 169 } 170 171 static void rfcomm_sock_cleanup_listen(struct sock *parent) 172 { 173 struct sock *sk; 174 175 BT_DBG("parent %p", parent); 176 177 /* Close not yet accepted dlcs */ 178 while ((sk = bt_accept_dequeue(parent, NULL))) { 179 rfcomm_sock_close(sk); 180 rfcomm_sock_kill(sk); 181 } 182 183 parent->sk_state = BT_CLOSED; 184 sock_set_flag(parent, SOCK_ZAPPED); 185 } 186 187 /* Kill socket (only if zapped and orphan) 188 * Must be called on unlocked socket. 189 */ 190 static void rfcomm_sock_kill(struct sock *sk) 191 { 192 if (!sock_flag(sk, SOCK_ZAPPED) || sk->sk_socket) 193 return; 194 195 BT_DBG("sk %p state %d refcnt %d", sk, sk->sk_state, atomic_read(&sk->sk_refcnt)); 196 197 /* Kill poor orphan */ 198 bt_sock_unlink(&rfcomm_sk_list, sk); 199 sock_set_flag(sk, SOCK_DEAD); 200 sock_put(sk); 201 } 202 203 static void __rfcomm_sock_close(struct sock *sk) 204 { 205 struct rfcomm_dlc *d = rfcomm_pi(sk)->dlc; 206 207 BT_DBG("sk %p state %d socket %p", sk, sk->sk_state, sk->sk_socket); 208 209 switch (sk->sk_state) { 210 case BT_LISTEN: 211 rfcomm_sock_cleanup_listen(sk); 212 break; 213 214 case BT_CONNECT: 215 case BT_CONNECT2: 216 case BT_CONFIG: 217 case BT_CONNECTED: 218 rfcomm_dlc_close(d, 0); 219 220 default: 221 sock_set_flag(sk, SOCK_ZAPPED); 222 break; 223 } 224 } 225 226 /* Close socket. 227 * Must be called on unlocked socket. 228 */ 229 static void rfcomm_sock_close(struct sock *sk) 230 { 231 lock_sock(sk); 232 __rfcomm_sock_close(sk); 233 release_sock(sk); 234 } 235 236 static void rfcomm_sock_init(struct sock *sk, struct sock *parent) 237 { 238 struct rfcomm_pinfo *pi = rfcomm_pi(sk); 239 240 BT_DBG("sk %p", sk); 241 242 if (parent) { 243 sk->sk_type = parent->sk_type; 244 pi->dlc->defer_setup = test_bit(BT_SK_DEFER_SETUP, 245 &bt_sk(parent)->flags); 246 247 pi->sec_level = rfcomm_pi(parent)->sec_level; 248 pi->role_switch = rfcomm_pi(parent)->role_switch; 249 250 security_sk_clone(parent, sk); 251 } else { 252 pi->dlc->defer_setup = 0; 253 254 pi->sec_level = BT_SECURITY_LOW; 255 pi->role_switch = 0; 256 } 257 258 pi->dlc->sec_level = pi->sec_level; 259 pi->dlc->role_switch = pi->role_switch; 260 } 261 262 static struct proto rfcomm_proto = { 263 .name = "RFCOMM", 264 .owner = THIS_MODULE, 265 .obj_size = sizeof(struct rfcomm_pinfo) 266 }; 267 268 static struct sock *rfcomm_sock_alloc(struct net *net, struct socket *sock, int proto, gfp_t prio) 269 { 270 struct rfcomm_dlc *d; 271 struct sock *sk; 272 273 sk = sk_alloc(net, PF_BLUETOOTH, prio, &rfcomm_proto); 274 if (!sk) 275 return NULL; 276 277 sock_init_data(sock, sk); 278 INIT_LIST_HEAD(&bt_sk(sk)->accept_q); 279 280 d = rfcomm_dlc_alloc(prio); 281 if (!d) { 282 sk_free(sk); 283 return NULL; 284 } 285 286 d->data_ready = rfcomm_sk_data_ready; 287 d->state_change = rfcomm_sk_state_change; 288 289 rfcomm_pi(sk)->dlc = d; 290 d->owner = sk; 291 292 sk->sk_destruct = rfcomm_sock_destruct; 293 sk->sk_sndtimeo = RFCOMM_CONN_TIMEOUT; 294 295 sk->sk_sndbuf = RFCOMM_MAX_CREDITS * RFCOMM_DEFAULT_MTU * 10; 296 sk->sk_rcvbuf = RFCOMM_MAX_CREDITS * RFCOMM_DEFAULT_MTU * 10; 297 298 sock_reset_flag(sk, SOCK_ZAPPED); 299 300 sk->sk_protocol = proto; 301 sk->sk_state = BT_OPEN; 302 303 bt_sock_link(&rfcomm_sk_list, sk); 304 305 BT_DBG("sk %p", sk); 306 return sk; 307 } 308 309 static int rfcomm_sock_create(struct net *net, struct socket *sock, 310 int protocol, int kern) 311 { 312 struct sock *sk; 313 314 BT_DBG("sock %p", sock); 315 316 sock->state = SS_UNCONNECTED; 317 318 if (sock->type != SOCK_STREAM && sock->type != SOCK_RAW) 319 return -ESOCKTNOSUPPORT; 320 321 sock->ops = &rfcomm_sock_ops; 322 323 sk = rfcomm_sock_alloc(net, sock, protocol, GFP_ATOMIC); 324 if (!sk) 325 return -ENOMEM; 326 327 rfcomm_sock_init(sk, NULL); 328 return 0; 329 } 330 331 static int rfcomm_sock_bind(struct socket *sock, struct sockaddr *addr, int addr_len) 332 { 333 struct sockaddr_rc *sa = (struct sockaddr_rc *) addr; 334 struct sock *sk = sock->sk; 335 int err = 0; 336 337 BT_DBG("sk %p %pMR", sk, &sa->rc_bdaddr); 338 339 if (!addr || addr->sa_family != AF_BLUETOOTH) 340 return -EINVAL; 341 342 lock_sock(sk); 343 344 if (sk->sk_state != BT_OPEN) { 345 err = -EBADFD; 346 goto done; 347 } 348 349 if (sk->sk_type != SOCK_STREAM) { 350 err = -EINVAL; 351 goto done; 352 } 353 354 write_lock(&rfcomm_sk_list.lock); 355 356 if (sa->rc_channel && __rfcomm_get_sock_by_addr(sa->rc_channel, &sa->rc_bdaddr)) { 357 err = -EADDRINUSE; 358 } else { 359 /* Save source address */ 360 bacpy(&bt_sk(sk)->src, &sa->rc_bdaddr); 361 rfcomm_pi(sk)->channel = sa->rc_channel; 362 sk->sk_state = BT_BOUND; 363 } 364 365 write_unlock(&rfcomm_sk_list.lock); 366 367 done: 368 release_sock(sk); 369 return err; 370 } 371 372 static int rfcomm_sock_connect(struct socket *sock, struct sockaddr *addr, int alen, int flags) 373 { 374 struct sockaddr_rc *sa = (struct sockaddr_rc *) addr; 375 struct sock *sk = sock->sk; 376 struct rfcomm_dlc *d = rfcomm_pi(sk)->dlc; 377 int err = 0; 378 379 BT_DBG("sk %p", sk); 380 381 if (alen < sizeof(struct sockaddr_rc) || 382 addr->sa_family != AF_BLUETOOTH) 383 return -EINVAL; 384 385 lock_sock(sk); 386 387 if (sk->sk_state != BT_OPEN && sk->sk_state != BT_BOUND) { 388 err = -EBADFD; 389 goto done; 390 } 391 392 if (sk->sk_type != SOCK_STREAM) { 393 err = -EINVAL; 394 goto done; 395 } 396 397 sk->sk_state = BT_CONNECT; 398 bacpy(&bt_sk(sk)->dst, &sa->rc_bdaddr); 399 rfcomm_pi(sk)->channel = sa->rc_channel; 400 401 d->sec_level = rfcomm_pi(sk)->sec_level; 402 d->role_switch = rfcomm_pi(sk)->role_switch; 403 404 err = rfcomm_dlc_open(d, &bt_sk(sk)->src, &sa->rc_bdaddr, sa->rc_channel); 405 if (!err) 406 err = bt_sock_wait_state(sk, BT_CONNECTED, 407 sock_sndtimeo(sk, flags & O_NONBLOCK)); 408 409 done: 410 release_sock(sk); 411 return err; 412 } 413 414 static int rfcomm_sock_listen(struct socket *sock, int backlog) 415 { 416 struct sock *sk = sock->sk; 417 int err = 0; 418 419 BT_DBG("sk %p backlog %d", sk, backlog); 420 421 lock_sock(sk); 422 423 if (sk->sk_state != BT_BOUND) { 424 err = -EBADFD; 425 goto done; 426 } 427 428 if (sk->sk_type != SOCK_STREAM) { 429 err = -EINVAL; 430 goto done; 431 } 432 433 if (!rfcomm_pi(sk)->channel) { 434 bdaddr_t *src = &bt_sk(sk)->src; 435 u8 channel; 436 437 err = -EINVAL; 438 439 write_lock(&rfcomm_sk_list.lock); 440 441 for (channel = 1; channel < 31; channel++) 442 if (!__rfcomm_get_sock_by_addr(channel, src)) { 443 rfcomm_pi(sk)->channel = channel; 444 err = 0; 445 break; 446 } 447 448 write_unlock(&rfcomm_sk_list.lock); 449 450 if (err < 0) 451 goto done; 452 } 453 454 sk->sk_max_ack_backlog = backlog; 455 sk->sk_ack_backlog = 0; 456 sk->sk_state = BT_LISTEN; 457 458 done: 459 release_sock(sk); 460 return err; 461 } 462 463 static int rfcomm_sock_accept(struct socket *sock, struct socket *newsock, int flags) 464 { 465 DECLARE_WAITQUEUE(wait, current); 466 struct sock *sk = sock->sk, *nsk; 467 long timeo; 468 int err = 0; 469 470 lock_sock_nested(sk, SINGLE_DEPTH_NESTING); 471 472 if (sk->sk_type != SOCK_STREAM) { 473 err = -EINVAL; 474 goto done; 475 } 476 477 timeo = sock_rcvtimeo(sk, flags & O_NONBLOCK); 478 479 BT_DBG("sk %p timeo %ld", sk, timeo); 480 481 /* Wait for an incoming connection. (wake-one). */ 482 add_wait_queue_exclusive(sk_sleep(sk), &wait); 483 while (1) { 484 set_current_state(TASK_INTERRUPTIBLE); 485 486 if (sk->sk_state != BT_LISTEN) { 487 err = -EBADFD; 488 break; 489 } 490 491 nsk = bt_accept_dequeue(sk, newsock); 492 if (nsk) 493 break; 494 495 if (!timeo) { 496 err = -EAGAIN; 497 break; 498 } 499 500 if (signal_pending(current)) { 501 err = sock_intr_errno(timeo); 502 break; 503 } 504 505 release_sock(sk); 506 timeo = schedule_timeout(timeo); 507 lock_sock_nested(sk, SINGLE_DEPTH_NESTING); 508 } 509 __set_current_state(TASK_RUNNING); 510 remove_wait_queue(sk_sleep(sk), &wait); 511 512 if (err) 513 goto done; 514 515 newsock->state = SS_CONNECTED; 516 517 BT_DBG("new socket %p", nsk); 518 519 done: 520 release_sock(sk); 521 return err; 522 } 523 524 static int rfcomm_sock_getname(struct socket *sock, struct sockaddr *addr, int *len, int peer) 525 { 526 struct sockaddr_rc *sa = (struct sockaddr_rc *) addr; 527 struct sock *sk = sock->sk; 528 529 BT_DBG("sock %p, sk %p", sock, sk); 530 531 memset(sa, 0, sizeof(*sa)); 532 sa->rc_family = AF_BLUETOOTH; 533 sa->rc_channel = rfcomm_pi(sk)->channel; 534 if (peer) 535 bacpy(&sa->rc_bdaddr, &bt_sk(sk)->dst); 536 else 537 bacpy(&sa->rc_bdaddr, &bt_sk(sk)->src); 538 539 *len = sizeof(struct sockaddr_rc); 540 return 0; 541 } 542 543 static int rfcomm_sock_sendmsg(struct kiocb *iocb, struct socket *sock, 544 struct msghdr *msg, size_t len) 545 { 546 struct sock *sk = sock->sk; 547 struct rfcomm_dlc *d = rfcomm_pi(sk)->dlc; 548 struct sk_buff *skb; 549 int sent = 0; 550 551 if (test_bit(RFCOMM_DEFER_SETUP, &d->flags)) 552 return -ENOTCONN; 553 554 if (msg->msg_flags & MSG_OOB) 555 return -EOPNOTSUPP; 556 557 if (sk->sk_shutdown & SEND_SHUTDOWN) 558 return -EPIPE; 559 560 BT_DBG("sock %p, sk %p", sock, sk); 561 562 lock_sock(sk); 563 564 while (len) { 565 size_t size = min_t(size_t, len, d->mtu); 566 int err; 567 568 skb = sock_alloc_send_skb(sk, size + RFCOMM_SKB_RESERVE, 569 msg->msg_flags & MSG_DONTWAIT, &err); 570 if (!skb) { 571 if (sent == 0) 572 sent = err; 573 break; 574 } 575 skb_reserve(skb, RFCOMM_SKB_HEAD_RESERVE); 576 577 err = memcpy_fromiovec(skb_put(skb, size), msg->msg_iov, size); 578 if (err) { 579 kfree_skb(skb); 580 if (sent == 0) 581 sent = err; 582 break; 583 } 584 585 skb->priority = sk->sk_priority; 586 587 err = rfcomm_dlc_send(d, skb); 588 if (err < 0) { 589 kfree_skb(skb); 590 if (sent == 0) 591 sent = err; 592 break; 593 } 594 595 sent += size; 596 len -= size; 597 } 598 599 release_sock(sk); 600 601 return sent; 602 } 603 604 static int rfcomm_sock_recvmsg(struct kiocb *iocb, struct socket *sock, 605 struct msghdr *msg, size_t size, int flags) 606 { 607 struct sock *sk = sock->sk; 608 struct rfcomm_dlc *d = rfcomm_pi(sk)->dlc; 609 int len; 610 611 if (test_and_clear_bit(RFCOMM_DEFER_SETUP, &d->flags)) { 612 rfcomm_dlc_accept(d); 613 return 0; 614 } 615 616 len = bt_sock_stream_recvmsg(iocb, sock, msg, size, flags); 617 618 lock_sock(sk); 619 if (!(flags & MSG_PEEK) && len > 0) 620 atomic_sub(len, &sk->sk_rmem_alloc); 621 622 if (atomic_read(&sk->sk_rmem_alloc) <= (sk->sk_rcvbuf >> 2)) 623 rfcomm_dlc_unthrottle(rfcomm_pi(sk)->dlc); 624 release_sock(sk); 625 626 return len; 627 } 628 629 static int rfcomm_sock_setsockopt_old(struct socket *sock, int optname, char __user *optval, unsigned int optlen) 630 { 631 struct sock *sk = sock->sk; 632 int err = 0; 633 u32 opt; 634 635 BT_DBG("sk %p", sk); 636 637 lock_sock(sk); 638 639 switch (optname) { 640 case RFCOMM_LM: 641 if (get_user(opt, (u32 __user *) optval)) { 642 err = -EFAULT; 643 break; 644 } 645 646 if (opt & RFCOMM_LM_AUTH) 647 rfcomm_pi(sk)->sec_level = BT_SECURITY_LOW; 648 if (opt & RFCOMM_LM_ENCRYPT) 649 rfcomm_pi(sk)->sec_level = BT_SECURITY_MEDIUM; 650 if (opt & RFCOMM_LM_SECURE) 651 rfcomm_pi(sk)->sec_level = BT_SECURITY_HIGH; 652 653 rfcomm_pi(sk)->role_switch = (opt & RFCOMM_LM_MASTER); 654 break; 655 656 default: 657 err = -ENOPROTOOPT; 658 break; 659 } 660 661 release_sock(sk); 662 return err; 663 } 664 665 static int rfcomm_sock_setsockopt(struct socket *sock, int level, int optname, char __user *optval, unsigned int optlen) 666 { 667 struct sock *sk = sock->sk; 668 struct bt_security sec; 669 int err = 0; 670 size_t len; 671 u32 opt; 672 673 BT_DBG("sk %p", sk); 674 675 if (level == SOL_RFCOMM) 676 return rfcomm_sock_setsockopt_old(sock, optname, optval, optlen); 677 678 if (level != SOL_BLUETOOTH) 679 return -ENOPROTOOPT; 680 681 lock_sock(sk); 682 683 switch (optname) { 684 case BT_SECURITY: 685 if (sk->sk_type != SOCK_STREAM) { 686 err = -EINVAL; 687 break; 688 } 689 690 sec.level = BT_SECURITY_LOW; 691 692 len = min_t(unsigned int, sizeof(sec), optlen); 693 if (copy_from_user((char *) &sec, optval, len)) { 694 err = -EFAULT; 695 break; 696 } 697 698 if (sec.level > BT_SECURITY_HIGH) { 699 err = -EINVAL; 700 break; 701 } 702 703 rfcomm_pi(sk)->sec_level = sec.level; 704 break; 705 706 case BT_DEFER_SETUP: 707 if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) { 708 err = -EINVAL; 709 break; 710 } 711 712 if (get_user(opt, (u32 __user *) optval)) { 713 err = -EFAULT; 714 break; 715 } 716 717 if (opt) 718 set_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags); 719 else 720 clear_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags); 721 722 break; 723 724 default: 725 err = -ENOPROTOOPT; 726 break; 727 } 728 729 release_sock(sk); 730 return err; 731 } 732 733 static int rfcomm_sock_getsockopt_old(struct socket *sock, int optname, char __user *optval, int __user *optlen) 734 { 735 struct sock *sk = sock->sk; 736 struct rfcomm_conninfo cinfo; 737 struct l2cap_conn *conn = l2cap_pi(sk)->chan->conn; 738 int len, err = 0; 739 u32 opt; 740 741 BT_DBG("sk %p", sk); 742 743 if (get_user(len, optlen)) 744 return -EFAULT; 745 746 lock_sock(sk); 747 748 switch (optname) { 749 case RFCOMM_LM: 750 switch (rfcomm_pi(sk)->sec_level) { 751 case BT_SECURITY_LOW: 752 opt = RFCOMM_LM_AUTH; 753 break; 754 case BT_SECURITY_MEDIUM: 755 opt = RFCOMM_LM_AUTH | RFCOMM_LM_ENCRYPT; 756 break; 757 case BT_SECURITY_HIGH: 758 opt = RFCOMM_LM_AUTH | RFCOMM_LM_ENCRYPT | 759 RFCOMM_LM_SECURE; 760 break; 761 default: 762 opt = 0; 763 break; 764 } 765 766 if (rfcomm_pi(sk)->role_switch) 767 opt |= RFCOMM_LM_MASTER; 768 769 if (put_user(opt, (u32 __user *) optval)) 770 err = -EFAULT; 771 break; 772 773 case RFCOMM_CONNINFO: 774 if (sk->sk_state != BT_CONNECTED && 775 !rfcomm_pi(sk)->dlc->defer_setup) { 776 err = -ENOTCONN; 777 break; 778 } 779 780 memset(&cinfo, 0, sizeof(cinfo)); 781 cinfo.hci_handle = conn->hcon->handle; 782 memcpy(cinfo.dev_class, conn->hcon->dev_class, 3); 783 784 len = min_t(unsigned int, len, sizeof(cinfo)); 785 if (copy_to_user(optval, (char *) &cinfo, len)) 786 err = -EFAULT; 787 788 break; 789 790 default: 791 err = -ENOPROTOOPT; 792 break; 793 } 794 795 release_sock(sk); 796 return err; 797 } 798 799 static int rfcomm_sock_getsockopt(struct socket *sock, int level, int optname, char __user *optval, int __user *optlen) 800 { 801 struct sock *sk = sock->sk; 802 struct bt_security sec; 803 int len, err = 0; 804 805 BT_DBG("sk %p", sk); 806 807 if (level == SOL_RFCOMM) 808 return rfcomm_sock_getsockopt_old(sock, optname, optval, optlen); 809 810 if (level != SOL_BLUETOOTH) 811 return -ENOPROTOOPT; 812 813 if (get_user(len, optlen)) 814 return -EFAULT; 815 816 lock_sock(sk); 817 818 switch (optname) { 819 case BT_SECURITY: 820 if (sk->sk_type != SOCK_STREAM) { 821 err = -EINVAL; 822 break; 823 } 824 825 sec.level = rfcomm_pi(sk)->sec_level; 826 sec.key_size = 0; 827 828 len = min_t(unsigned int, len, sizeof(sec)); 829 if (copy_to_user(optval, (char *) &sec, len)) 830 err = -EFAULT; 831 832 break; 833 834 case BT_DEFER_SETUP: 835 if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) { 836 err = -EINVAL; 837 break; 838 } 839 840 if (put_user(test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags), 841 (u32 __user *) optval)) 842 err = -EFAULT; 843 844 break; 845 846 default: 847 err = -ENOPROTOOPT; 848 break; 849 } 850 851 release_sock(sk); 852 return err; 853 } 854 855 static int rfcomm_sock_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg) 856 { 857 struct sock *sk __maybe_unused = sock->sk; 858 int err; 859 860 BT_DBG("sk %p cmd %x arg %lx", sk, cmd, arg); 861 862 err = bt_sock_ioctl(sock, cmd, arg); 863 864 if (err == -ENOIOCTLCMD) { 865 #ifdef CONFIG_BT_RFCOMM_TTY 866 lock_sock(sk); 867 err = rfcomm_dev_ioctl(sk, cmd, (void __user *) arg); 868 release_sock(sk); 869 #else 870 err = -EOPNOTSUPP; 871 #endif 872 } 873 874 return err; 875 } 876 877 static int rfcomm_sock_shutdown(struct socket *sock, int how) 878 { 879 struct sock *sk = sock->sk; 880 int err = 0; 881 882 BT_DBG("sock %p, sk %p", sock, sk); 883 884 if (!sk) 885 return 0; 886 887 lock_sock(sk); 888 if (!sk->sk_shutdown) { 889 sk->sk_shutdown = SHUTDOWN_MASK; 890 __rfcomm_sock_close(sk); 891 892 if (sock_flag(sk, SOCK_LINGER) && sk->sk_lingertime) 893 err = bt_sock_wait_state(sk, BT_CLOSED, sk->sk_lingertime); 894 } 895 release_sock(sk); 896 return err; 897 } 898 899 static int rfcomm_sock_release(struct socket *sock) 900 { 901 struct sock *sk = sock->sk; 902 int err; 903 904 BT_DBG("sock %p, sk %p", sock, sk); 905 906 if (!sk) 907 return 0; 908 909 err = rfcomm_sock_shutdown(sock, 2); 910 911 sock_orphan(sk); 912 rfcomm_sock_kill(sk); 913 return err; 914 } 915 916 /* ---- RFCOMM core layer callbacks ---- 917 * 918 * called under rfcomm_lock() 919 */ 920 int rfcomm_connect_ind(struct rfcomm_session *s, u8 channel, struct rfcomm_dlc **d) 921 { 922 struct sock *sk, *parent; 923 bdaddr_t src, dst; 924 int result = 0; 925 926 BT_DBG("session %p channel %d", s, channel); 927 928 rfcomm_session_getaddr(s, &src, &dst); 929 930 /* Check if we have socket listening on channel */ 931 parent = rfcomm_get_sock_by_channel(BT_LISTEN, channel, &src); 932 if (!parent) 933 return 0; 934 935 bh_lock_sock(parent); 936 937 /* Check for backlog size */ 938 if (sk_acceptq_is_full(parent)) { 939 BT_DBG("backlog full %d", parent->sk_ack_backlog); 940 goto done; 941 } 942 943 sk = rfcomm_sock_alloc(sock_net(parent), NULL, BTPROTO_RFCOMM, GFP_ATOMIC); 944 if (!sk) 945 goto done; 946 947 bt_sock_reclassify_lock(sk, BTPROTO_RFCOMM); 948 949 rfcomm_sock_init(sk, parent); 950 bacpy(&bt_sk(sk)->src, &src); 951 bacpy(&bt_sk(sk)->dst, &dst); 952 rfcomm_pi(sk)->channel = channel; 953 954 sk->sk_state = BT_CONFIG; 955 bt_accept_enqueue(parent, sk); 956 957 /* Accept connection and return socket DLC */ 958 *d = rfcomm_pi(sk)->dlc; 959 result = 1; 960 961 done: 962 bh_unlock_sock(parent); 963 964 if (test_bit(BT_SK_DEFER_SETUP, &bt_sk(parent)->flags)) 965 parent->sk_state_change(parent); 966 967 return result; 968 } 969 970 static int rfcomm_sock_debugfs_show(struct seq_file *f, void *p) 971 { 972 struct sock *sk; 973 struct hlist_node *node; 974 975 read_lock(&rfcomm_sk_list.lock); 976 977 sk_for_each(sk, node, &rfcomm_sk_list.head) { 978 seq_printf(f, "%pMR %pMR %d %d\n", 979 &bt_sk(sk)->src, &bt_sk(sk)->dst, 980 sk->sk_state, rfcomm_pi(sk)->channel); 981 } 982 983 read_unlock(&rfcomm_sk_list.lock); 984 985 return 0; 986 } 987 988 static int rfcomm_sock_debugfs_open(struct inode *inode, struct file *file) 989 { 990 return single_open(file, rfcomm_sock_debugfs_show, inode->i_private); 991 } 992 993 static const struct file_operations rfcomm_sock_debugfs_fops = { 994 .open = rfcomm_sock_debugfs_open, 995 .read = seq_read, 996 .llseek = seq_lseek, 997 .release = single_release, 998 }; 999 1000 static struct dentry *rfcomm_sock_debugfs; 1001 1002 static const struct proto_ops rfcomm_sock_ops = { 1003 .family = PF_BLUETOOTH, 1004 .owner = THIS_MODULE, 1005 .release = rfcomm_sock_release, 1006 .bind = rfcomm_sock_bind, 1007 .connect = rfcomm_sock_connect, 1008 .listen = rfcomm_sock_listen, 1009 .accept = rfcomm_sock_accept, 1010 .getname = rfcomm_sock_getname, 1011 .sendmsg = rfcomm_sock_sendmsg, 1012 .recvmsg = rfcomm_sock_recvmsg, 1013 .shutdown = rfcomm_sock_shutdown, 1014 .setsockopt = rfcomm_sock_setsockopt, 1015 .getsockopt = rfcomm_sock_getsockopt, 1016 .ioctl = rfcomm_sock_ioctl, 1017 .poll = bt_sock_poll, 1018 .socketpair = sock_no_socketpair, 1019 .mmap = sock_no_mmap 1020 }; 1021 1022 static const struct net_proto_family rfcomm_sock_family_ops = { 1023 .family = PF_BLUETOOTH, 1024 .owner = THIS_MODULE, 1025 .create = rfcomm_sock_create 1026 }; 1027 1028 int __init rfcomm_init_sockets(void) 1029 { 1030 int err; 1031 1032 err = proto_register(&rfcomm_proto, 0); 1033 if (err < 0) 1034 return err; 1035 1036 err = bt_sock_register(BTPROTO_RFCOMM, &rfcomm_sock_family_ops); 1037 if (err < 0) { 1038 BT_ERR("RFCOMM socket layer registration failed"); 1039 goto error; 1040 } 1041 1042 err = bt_procfs_init(THIS_MODULE, &init_net, "rfcomm", &rfcomm_sk_list, NULL); 1043 if (err < 0) { 1044 BT_ERR("Failed to create RFCOMM proc file"); 1045 bt_sock_unregister(BTPROTO_RFCOMM); 1046 goto error; 1047 } 1048 1049 if (bt_debugfs) { 1050 rfcomm_sock_debugfs = debugfs_create_file("rfcomm", 0444, 1051 bt_debugfs, NULL, &rfcomm_sock_debugfs_fops); 1052 if (!rfcomm_sock_debugfs) 1053 BT_ERR("Failed to create RFCOMM debug file"); 1054 } 1055 1056 BT_INFO("RFCOMM socket layer initialized"); 1057 1058 return 0; 1059 1060 error: 1061 proto_unregister(&rfcomm_proto); 1062 return err; 1063 } 1064 1065 void __exit rfcomm_cleanup_sockets(void) 1066 { 1067 bt_procfs_cleanup(&init_net, "rfcomm"); 1068 1069 debugfs_remove(rfcomm_sock_debugfs); 1070 1071 if (bt_sock_unregister(BTPROTO_RFCOMM) < 0) 1072 BT_ERR("RFCOMM socket layer unregistration failed"); 1073 1074 proto_unregister(&rfcomm_proto); 1075 } 1076