1 /* 2 RFCOMM implementation for Linux Bluetooth stack (BlueZ). 3 Copyright (C) 2002 Maxim Krasnyansky <maxk@qualcomm.com> 4 Copyright (C) 2002 Marcel Holtmann <marcel@holtmann.org> 5 6 This program is free software; you can redistribute it and/or modify 7 it under the terms of the GNU General Public License version 2 as 8 published by the Free Software Foundation; 9 10 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS 11 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 12 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS. 13 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY 14 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES 15 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 16 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 17 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 18 19 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS, 20 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS 21 SOFTWARE IS DISCLAIMED. 22 */ 23 24 /* 25 * RFCOMM sockets. 26 */ 27 #include <linux/compat.h> 28 #include <linux/export.h> 29 #include <linux/debugfs.h> 30 #include <linux/sched/signal.h> 31 32 #include <net/bluetooth/bluetooth.h> 33 #include <net/bluetooth/hci_core.h> 34 #include <net/bluetooth/l2cap.h> 35 #include <net/bluetooth/rfcomm.h> 36 37 static const struct proto_ops rfcomm_sock_ops; 38 39 static struct bt_sock_list rfcomm_sk_list = { 40 .lock = __RW_LOCK_UNLOCKED(rfcomm_sk_list.lock) 41 }; 42 43 static void rfcomm_sock_close(struct sock *sk); 44 static void rfcomm_sock_kill(struct sock *sk); 45 46 /* ---- DLC callbacks ---- 47 * 48 * called under rfcomm_dlc_lock() 49 */ 50 static void rfcomm_sk_data_ready(struct rfcomm_dlc *d, struct sk_buff *skb) 51 { 52 struct sock *sk = d->owner; 53 if (!sk) 54 return; 55 56 atomic_add(skb->len, &sk->sk_rmem_alloc); 57 skb_queue_tail(&sk->sk_receive_queue, skb); 58 sk->sk_data_ready(sk); 59 60 if (atomic_read(&sk->sk_rmem_alloc) >= sk->sk_rcvbuf) 61 rfcomm_dlc_throttle(d); 62 } 63 64 static void rfcomm_sk_state_change(struct rfcomm_dlc *d, int err) 65 { 66 struct sock *sk = d->owner, *parent; 67 68 if (!sk) 69 return; 70 71 BT_DBG("dlc %p state %ld err %d", d, d->state, err); 72 73 lock_sock(sk); 74 75 if (err) 76 sk->sk_err = err; 77 78 sk->sk_state = d->state; 79 80 parent = bt_sk(sk)->parent; 81 if (parent) { 82 if (d->state == BT_CLOSED) { 83 sock_set_flag(sk, SOCK_ZAPPED); 84 bt_accept_unlink(sk); 85 } 86 parent->sk_data_ready(parent); 87 } else { 88 if (d->state == BT_CONNECTED) 89 rfcomm_session_getaddr(d->session, 90 &rfcomm_pi(sk)->src, NULL); 91 sk->sk_state_change(sk); 92 } 93 94 release_sock(sk); 95 96 if (parent && sock_flag(sk, SOCK_ZAPPED)) { 97 /* We have to drop DLC lock here, otherwise 98 * rfcomm_sock_destruct() will dead lock. */ 99 rfcomm_dlc_unlock(d); 100 rfcomm_sock_kill(sk); 101 rfcomm_dlc_lock(d); 102 } 103 } 104 105 /* ---- Socket functions ---- */ 106 static struct sock *__rfcomm_get_listen_sock_by_addr(u8 channel, bdaddr_t *src) 107 { 108 struct sock *sk = NULL; 109 110 sk_for_each(sk, &rfcomm_sk_list.head) { 111 if (rfcomm_pi(sk)->channel != channel) 112 continue; 113 114 if (bacmp(&rfcomm_pi(sk)->src, src)) 115 continue; 116 117 if (sk->sk_state == BT_BOUND || sk->sk_state == BT_LISTEN) 118 break; 119 } 120 121 return sk ? sk : NULL; 122 } 123 124 /* Find socket with channel and source bdaddr. 125 * Returns closest match. 126 */ 127 static struct sock *rfcomm_get_sock_by_channel(int state, u8 channel, bdaddr_t *src) 128 { 129 struct sock *sk = NULL, *sk1 = NULL; 130 131 read_lock(&rfcomm_sk_list.lock); 132 133 sk_for_each(sk, &rfcomm_sk_list.head) { 134 if (state && sk->sk_state != state) 135 continue; 136 137 if (rfcomm_pi(sk)->channel == channel) { 138 /* Exact match. */ 139 if (!bacmp(&rfcomm_pi(sk)->src, src)) 140 break; 141 142 /* Closest match */ 143 if (!bacmp(&rfcomm_pi(sk)->src, BDADDR_ANY)) 144 sk1 = sk; 145 } 146 } 147 148 read_unlock(&rfcomm_sk_list.lock); 149 150 return sk ? sk : sk1; 151 } 152 153 static void rfcomm_sock_destruct(struct sock *sk) 154 { 155 struct rfcomm_dlc *d = rfcomm_pi(sk)->dlc; 156 157 BT_DBG("sk %p dlc %p", sk, d); 158 159 skb_queue_purge(&sk->sk_receive_queue); 160 skb_queue_purge(&sk->sk_write_queue); 161 162 rfcomm_dlc_lock(d); 163 rfcomm_pi(sk)->dlc = NULL; 164 165 /* Detach DLC if it's owned by this socket */ 166 if (d->owner == sk) 167 d->owner = NULL; 168 rfcomm_dlc_unlock(d); 169 170 rfcomm_dlc_put(d); 171 } 172 173 static void rfcomm_sock_cleanup_listen(struct sock *parent) 174 { 175 struct sock *sk; 176 177 BT_DBG("parent %p", parent); 178 179 /* Close not yet accepted dlcs */ 180 while ((sk = bt_accept_dequeue(parent, NULL))) { 181 rfcomm_sock_close(sk); 182 rfcomm_sock_kill(sk); 183 } 184 185 parent->sk_state = BT_CLOSED; 186 sock_set_flag(parent, SOCK_ZAPPED); 187 } 188 189 /* Kill socket (only if zapped and orphan) 190 * Must be called on unlocked socket. 191 */ 192 static void rfcomm_sock_kill(struct sock *sk) 193 { 194 if (!sock_flag(sk, SOCK_ZAPPED) || sk->sk_socket) 195 return; 196 197 BT_DBG("sk %p state %d refcnt %d", sk, sk->sk_state, refcount_read(&sk->sk_refcnt)); 198 199 /* Kill poor orphan */ 200 bt_sock_unlink(&rfcomm_sk_list, sk); 201 sock_set_flag(sk, SOCK_DEAD); 202 sock_put(sk); 203 } 204 205 static void __rfcomm_sock_close(struct sock *sk) 206 { 207 struct rfcomm_dlc *d = rfcomm_pi(sk)->dlc; 208 209 BT_DBG("sk %p state %d socket %p", sk, sk->sk_state, sk->sk_socket); 210 211 switch (sk->sk_state) { 212 case BT_LISTEN: 213 rfcomm_sock_cleanup_listen(sk); 214 break; 215 216 case BT_CONNECT: 217 case BT_CONNECT2: 218 case BT_CONFIG: 219 case BT_CONNECTED: 220 rfcomm_dlc_close(d, 0); 221 fallthrough; 222 223 default: 224 sock_set_flag(sk, SOCK_ZAPPED); 225 break; 226 } 227 } 228 229 /* Close socket. 230 * Must be called on unlocked socket. 231 */ 232 static void rfcomm_sock_close(struct sock *sk) 233 { 234 lock_sock(sk); 235 __rfcomm_sock_close(sk); 236 release_sock(sk); 237 } 238 239 static void rfcomm_sock_init(struct sock *sk, struct sock *parent) 240 { 241 struct rfcomm_pinfo *pi = rfcomm_pi(sk); 242 243 BT_DBG("sk %p", sk); 244 245 if (parent) { 246 sk->sk_type = parent->sk_type; 247 pi->dlc->defer_setup = test_bit(BT_SK_DEFER_SETUP, 248 &bt_sk(parent)->flags); 249 250 pi->sec_level = rfcomm_pi(parent)->sec_level; 251 pi->role_switch = rfcomm_pi(parent)->role_switch; 252 253 security_sk_clone(parent, sk); 254 } else { 255 pi->dlc->defer_setup = 0; 256 257 pi->sec_level = BT_SECURITY_LOW; 258 pi->role_switch = 0; 259 } 260 261 pi->dlc->sec_level = pi->sec_level; 262 pi->dlc->role_switch = pi->role_switch; 263 } 264 265 static struct proto rfcomm_proto = { 266 .name = "RFCOMM", 267 .owner = THIS_MODULE, 268 .obj_size = sizeof(struct rfcomm_pinfo) 269 }; 270 271 static struct sock *rfcomm_sock_alloc(struct net *net, struct socket *sock, int proto, gfp_t prio, int kern) 272 { 273 struct rfcomm_dlc *d; 274 struct sock *sk; 275 276 sk = sk_alloc(net, PF_BLUETOOTH, prio, &rfcomm_proto, kern); 277 if (!sk) 278 return NULL; 279 280 sock_init_data(sock, sk); 281 INIT_LIST_HEAD(&bt_sk(sk)->accept_q); 282 283 d = rfcomm_dlc_alloc(prio); 284 if (!d) { 285 sk_free(sk); 286 return NULL; 287 } 288 289 d->data_ready = rfcomm_sk_data_ready; 290 d->state_change = rfcomm_sk_state_change; 291 292 rfcomm_pi(sk)->dlc = d; 293 d->owner = sk; 294 295 sk->sk_destruct = rfcomm_sock_destruct; 296 sk->sk_sndtimeo = RFCOMM_CONN_TIMEOUT; 297 298 sk->sk_sndbuf = RFCOMM_MAX_CREDITS * RFCOMM_DEFAULT_MTU * 10; 299 sk->sk_rcvbuf = RFCOMM_MAX_CREDITS * RFCOMM_DEFAULT_MTU * 10; 300 301 sock_reset_flag(sk, SOCK_ZAPPED); 302 303 sk->sk_protocol = proto; 304 sk->sk_state = BT_OPEN; 305 306 bt_sock_link(&rfcomm_sk_list, sk); 307 308 BT_DBG("sk %p", sk); 309 return sk; 310 } 311 312 static int rfcomm_sock_create(struct net *net, struct socket *sock, 313 int protocol, int kern) 314 { 315 struct sock *sk; 316 317 BT_DBG("sock %p", sock); 318 319 sock->state = SS_UNCONNECTED; 320 321 if (sock->type != SOCK_STREAM && sock->type != SOCK_RAW) 322 return -ESOCKTNOSUPPORT; 323 324 sock->ops = &rfcomm_sock_ops; 325 326 sk = rfcomm_sock_alloc(net, sock, protocol, GFP_ATOMIC, kern); 327 if (!sk) 328 return -ENOMEM; 329 330 rfcomm_sock_init(sk, NULL); 331 return 0; 332 } 333 334 static int rfcomm_sock_bind(struct socket *sock, struct sockaddr *addr, int addr_len) 335 { 336 struct sockaddr_rc sa; 337 struct sock *sk = sock->sk; 338 int len, err = 0; 339 340 if (!addr || addr_len < offsetofend(struct sockaddr, sa_family) || 341 addr->sa_family != AF_BLUETOOTH) 342 return -EINVAL; 343 344 memset(&sa, 0, sizeof(sa)); 345 len = min_t(unsigned int, sizeof(sa), addr_len); 346 memcpy(&sa, addr, len); 347 348 BT_DBG("sk %p %pMR", sk, &sa.rc_bdaddr); 349 350 lock_sock(sk); 351 352 if (sk->sk_state != BT_OPEN) { 353 err = -EBADFD; 354 goto done; 355 } 356 357 if (sk->sk_type != SOCK_STREAM) { 358 err = -EINVAL; 359 goto done; 360 } 361 362 write_lock(&rfcomm_sk_list.lock); 363 364 if (sa.rc_channel && 365 __rfcomm_get_listen_sock_by_addr(sa.rc_channel, &sa.rc_bdaddr)) { 366 err = -EADDRINUSE; 367 } else { 368 /* Save source address */ 369 bacpy(&rfcomm_pi(sk)->src, &sa.rc_bdaddr); 370 rfcomm_pi(sk)->channel = sa.rc_channel; 371 sk->sk_state = BT_BOUND; 372 } 373 374 write_unlock(&rfcomm_sk_list.lock); 375 376 done: 377 release_sock(sk); 378 return err; 379 } 380 381 static int rfcomm_sock_connect(struct socket *sock, struct sockaddr *addr, int alen, int flags) 382 { 383 struct sockaddr_rc *sa = (struct sockaddr_rc *) addr; 384 struct sock *sk = sock->sk; 385 struct rfcomm_dlc *d = rfcomm_pi(sk)->dlc; 386 int err = 0; 387 388 BT_DBG("sk %p", sk); 389 390 if (alen < sizeof(struct sockaddr_rc) || 391 addr->sa_family != AF_BLUETOOTH) 392 return -EINVAL; 393 394 sock_hold(sk); 395 lock_sock(sk); 396 397 if (sk->sk_state != BT_OPEN && sk->sk_state != BT_BOUND) { 398 err = -EBADFD; 399 goto done; 400 } 401 402 if (sk->sk_type != SOCK_STREAM) { 403 err = -EINVAL; 404 goto done; 405 } 406 407 sk->sk_state = BT_CONNECT; 408 bacpy(&rfcomm_pi(sk)->dst, &sa->rc_bdaddr); 409 rfcomm_pi(sk)->channel = sa->rc_channel; 410 411 d->sec_level = rfcomm_pi(sk)->sec_level; 412 d->role_switch = rfcomm_pi(sk)->role_switch; 413 414 /* Drop sock lock to avoid potential deadlock with the RFCOMM lock */ 415 release_sock(sk); 416 err = rfcomm_dlc_open(d, &rfcomm_pi(sk)->src, &sa->rc_bdaddr, 417 sa->rc_channel); 418 lock_sock(sk); 419 if (!err && !sock_flag(sk, SOCK_ZAPPED)) 420 err = bt_sock_wait_state(sk, BT_CONNECTED, 421 sock_sndtimeo(sk, flags & O_NONBLOCK)); 422 423 done: 424 release_sock(sk); 425 sock_put(sk); 426 return err; 427 } 428 429 static int rfcomm_sock_listen(struct socket *sock, int backlog) 430 { 431 struct sock *sk = sock->sk; 432 int err = 0; 433 434 BT_DBG("sk %p backlog %d", sk, backlog); 435 436 lock_sock(sk); 437 438 if (sk->sk_state != BT_BOUND) { 439 err = -EBADFD; 440 goto done; 441 } 442 443 if (sk->sk_type != SOCK_STREAM) { 444 err = -EINVAL; 445 goto done; 446 } 447 448 if (!rfcomm_pi(sk)->channel) { 449 bdaddr_t *src = &rfcomm_pi(sk)->src; 450 u8 channel; 451 452 err = -EINVAL; 453 454 write_lock(&rfcomm_sk_list.lock); 455 456 for (channel = 1; channel < 31; channel++) 457 if (!__rfcomm_get_listen_sock_by_addr(channel, src)) { 458 rfcomm_pi(sk)->channel = channel; 459 err = 0; 460 break; 461 } 462 463 write_unlock(&rfcomm_sk_list.lock); 464 465 if (err < 0) 466 goto done; 467 } 468 469 sk->sk_max_ack_backlog = backlog; 470 sk->sk_ack_backlog = 0; 471 sk->sk_state = BT_LISTEN; 472 473 done: 474 release_sock(sk); 475 return err; 476 } 477 478 static int rfcomm_sock_accept(struct socket *sock, struct socket *newsock, int flags, 479 bool kern) 480 { 481 DEFINE_WAIT_FUNC(wait, woken_wake_function); 482 struct sock *sk = sock->sk, *nsk; 483 long timeo; 484 int err = 0; 485 486 lock_sock_nested(sk, SINGLE_DEPTH_NESTING); 487 488 if (sk->sk_type != SOCK_STREAM) { 489 err = -EINVAL; 490 goto done; 491 } 492 493 timeo = sock_rcvtimeo(sk, flags & O_NONBLOCK); 494 495 BT_DBG("sk %p timeo %ld", sk, timeo); 496 497 /* Wait for an incoming connection. (wake-one). */ 498 add_wait_queue_exclusive(sk_sleep(sk), &wait); 499 while (1) { 500 if (sk->sk_state != BT_LISTEN) { 501 err = -EBADFD; 502 break; 503 } 504 505 nsk = bt_accept_dequeue(sk, newsock); 506 if (nsk) 507 break; 508 509 if (!timeo) { 510 err = -EAGAIN; 511 break; 512 } 513 514 if (signal_pending(current)) { 515 err = sock_intr_errno(timeo); 516 break; 517 } 518 519 release_sock(sk); 520 521 timeo = wait_woken(&wait, TASK_INTERRUPTIBLE, timeo); 522 523 lock_sock_nested(sk, SINGLE_DEPTH_NESTING); 524 } 525 remove_wait_queue(sk_sleep(sk), &wait); 526 527 if (err) 528 goto done; 529 530 newsock->state = SS_CONNECTED; 531 532 BT_DBG("new socket %p", nsk); 533 534 done: 535 release_sock(sk); 536 return err; 537 } 538 539 static int rfcomm_sock_getname(struct socket *sock, struct sockaddr *addr, int peer) 540 { 541 struct sockaddr_rc *sa = (struct sockaddr_rc *) addr; 542 struct sock *sk = sock->sk; 543 544 BT_DBG("sock %p, sk %p", sock, sk); 545 546 if (peer && sk->sk_state != BT_CONNECTED && 547 sk->sk_state != BT_CONNECT && sk->sk_state != BT_CONNECT2) 548 return -ENOTCONN; 549 550 memset(sa, 0, sizeof(*sa)); 551 sa->rc_family = AF_BLUETOOTH; 552 sa->rc_channel = rfcomm_pi(sk)->channel; 553 if (peer) 554 bacpy(&sa->rc_bdaddr, &rfcomm_pi(sk)->dst); 555 else 556 bacpy(&sa->rc_bdaddr, &rfcomm_pi(sk)->src); 557 558 return sizeof(struct sockaddr_rc); 559 } 560 561 static int rfcomm_sock_sendmsg(struct socket *sock, struct msghdr *msg, 562 size_t len) 563 { 564 struct sock *sk = sock->sk; 565 struct rfcomm_dlc *d = rfcomm_pi(sk)->dlc; 566 struct sk_buff *skb; 567 int sent; 568 569 if (test_bit(RFCOMM_DEFER_SETUP, &d->flags)) 570 return -ENOTCONN; 571 572 if (msg->msg_flags & MSG_OOB) 573 return -EOPNOTSUPP; 574 575 if (sk->sk_shutdown & SEND_SHUTDOWN) 576 return -EPIPE; 577 578 BT_DBG("sock %p, sk %p", sock, sk); 579 580 lock_sock(sk); 581 582 sent = bt_sock_wait_ready(sk, msg->msg_flags); 583 584 release_sock(sk); 585 586 if (sent) 587 return sent; 588 589 skb = bt_skb_sendmmsg(sk, msg, len, d->mtu, RFCOMM_SKB_HEAD_RESERVE, 590 RFCOMM_SKB_TAIL_RESERVE); 591 if (IS_ERR(skb)) 592 return PTR_ERR(skb); 593 594 sent = rfcomm_dlc_send(d, skb); 595 if (sent < 0) 596 kfree_skb(skb); 597 598 return sent; 599 } 600 601 static int rfcomm_sock_recvmsg(struct socket *sock, struct msghdr *msg, 602 size_t size, int flags) 603 { 604 struct sock *sk = sock->sk; 605 struct rfcomm_dlc *d = rfcomm_pi(sk)->dlc; 606 int len; 607 608 if (test_and_clear_bit(RFCOMM_DEFER_SETUP, &d->flags)) { 609 rfcomm_dlc_accept(d); 610 return 0; 611 } 612 613 len = bt_sock_stream_recvmsg(sock, msg, size, flags); 614 615 lock_sock(sk); 616 if (!(flags & MSG_PEEK) && len > 0) 617 atomic_sub(len, &sk->sk_rmem_alloc); 618 619 if (atomic_read(&sk->sk_rmem_alloc) <= (sk->sk_rcvbuf >> 2)) 620 rfcomm_dlc_unthrottle(rfcomm_pi(sk)->dlc); 621 release_sock(sk); 622 623 return len; 624 } 625 626 static int rfcomm_sock_setsockopt_old(struct socket *sock, int optname, 627 sockptr_t optval, unsigned int optlen) 628 { 629 struct sock *sk = sock->sk; 630 int err = 0; 631 u32 opt; 632 633 BT_DBG("sk %p", sk); 634 635 lock_sock(sk); 636 637 switch (optname) { 638 case RFCOMM_LM: 639 if (copy_from_sockptr(&opt, optval, sizeof(u32))) { 640 err = -EFAULT; 641 break; 642 } 643 644 if (opt & RFCOMM_LM_FIPS) { 645 err = -EINVAL; 646 break; 647 } 648 649 if (opt & RFCOMM_LM_AUTH) 650 rfcomm_pi(sk)->sec_level = BT_SECURITY_LOW; 651 if (opt & RFCOMM_LM_ENCRYPT) 652 rfcomm_pi(sk)->sec_level = BT_SECURITY_MEDIUM; 653 if (opt & RFCOMM_LM_SECURE) 654 rfcomm_pi(sk)->sec_level = BT_SECURITY_HIGH; 655 656 rfcomm_pi(sk)->role_switch = (opt & RFCOMM_LM_MASTER); 657 break; 658 659 default: 660 err = -ENOPROTOOPT; 661 break; 662 } 663 664 release_sock(sk); 665 return err; 666 } 667 668 static int rfcomm_sock_setsockopt(struct socket *sock, int level, int optname, 669 sockptr_t optval, unsigned int optlen) 670 { 671 struct sock *sk = sock->sk; 672 struct bt_security sec; 673 int err = 0; 674 size_t len; 675 u32 opt; 676 677 BT_DBG("sk %p", sk); 678 679 if (level == SOL_RFCOMM) 680 return rfcomm_sock_setsockopt_old(sock, optname, optval, optlen); 681 682 if (level != SOL_BLUETOOTH) 683 return -ENOPROTOOPT; 684 685 lock_sock(sk); 686 687 switch (optname) { 688 case BT_SECURITY: 689 if (sk->sk_type != SOCK_STREAM) { 690 err = -EINVAL; 691 break; 692 } 693 694 sec.level = BT_SECURITY_LOW; 695 696 len = min_t(unsigned int, sizeof(sec), optlen); 697 if (copy_from_sockptr(&sec, optval, len)) { 698 err = -EFAULT; 699 break; 700 } 701 702 if (sec.level > BT_SECURITY_HIGH) { 703 err = -EINVAL; 704 break; 705 } 706 707 rfcomm_pi(sk)->sec_level = sec.level; 708 break; 709 710 case BT_DEFER_SETUP: 711 if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) { 712 err = -EINVAL; 713 break; 714 } 715 716 if (copy_from_sockptr(&opt, optval, sizeof(u32))) { 717 err = -EFAULT; 718 break; 719 } 720 721 if (opt) 722 set_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags); 723 else 724 clear_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags); 725 726 break; 727 728 default: 729 err = -ENOPROTOOPT; 730 break; 731 } 732 733 release_sock(sk); 734 return err; 735 } 736 737 static int rfcomm_sock_getsockopt_old(struct socket *sock, int optname, char __user *optval, int __user *optlen) 738 { 739 struct sock *sk = sock->sk; 740 struct sock *l2cap_sk; 741 struct l2cap_conn *conn; 742 struct rfcomm_conninfo cinfo; 743 int len, err = 0; 744 u32 opt; 745 746 BT_DBG("sk %p", sk); 747 748 if (get_user(len, optlen)) 749 return -EFAULT; 750 751 lock_sock(sk); 752 753 switch (optname) { 754 case RFCOMM_LM: 755 switch (rfcomm_pi(sk)->sec_level) { 756 case BT_SECURITY_LOW: 757 opt = RFCOMM_LM_AUTH; 758 break; 759 case BT_SECURITY_MEDIUM: 760 opt = RFCOMM_LM_AUTH | RFCOMM_LM_ENCRYPT; 761 break; 762 case BT_SECURITY_HIGH: 763 opt = RFCOMM_LM_AUTH | RFCOMM_LM_ENCRYPT | 764 RFCOMM_LM_SECURE; 765 break; 766 case BT_SECURITY_FIPS: 767 opt = RFCOMM_LM_AUTH | RFCOMM_LM_ENCRYPT | 768 RFCOMM_LM_SECURE | RFCOMM_LM_FIPS; 769 break; 770 default: 771 opt = 0; 772 break; 773 } 774 775 if (rfcomm_pi(sk)->role_switch) 776 opt |= RFCOMM_LM_MASTER; 777 778 if (put_user(opt, (u32 __user *) optval)) 779 err = -EFAULT; 780 781 break; 782 783 case RFCOMM_CONNINFO: 784 if (sk->sk_state != BT_CONNECTED && 785 !rfcomm_pi(sk)->dlc->defer_setup) { 786 err = -ENOTCONN; 787 break; 788 } 789 790 l2cap_sk = rfcomm_pi(sk)->dlc->session->sock->sk; 791 conn = l2cap_pi(l2cap_sk)->chan->conn; 792 793 memset(&cinfo, 0, sizeof(cinfo)); 794 cinfo.hci_handle = conn->hcon->handle; 795 memcpy(cinfo.dev_class, conn->hcon->dev_class, 3); 796 797 len = min_t(unsigned int, len, sizeof(cinfo)); 798 if (copy_to_user(optval, (char *) &cinfo, len)) 799 err = -EFAULT; 800 801 break; 802 803 default: 804 err = -ENOPROTOOPT; 805 break; 806 } 807 808 release_sock(sk); 809 return err; 810 } 811 812 static int rfcomm_sock_getsockopt(struct socket *sock, int level, int optname, char __user *optval, int __user *optlen) 813 { 814 struct sock *sk = sock->sk; 815 struct bt_security sec; 816 int len, err = 0; 817 818 BT_DBG("sk %p", sk); 819 820 if (level == SOL_RFCOMM) 821 return rfcomm_sock_getsockopt_old(sock, optname, optval, optlen); 822 823 if (level != SOL_BLUETOOTH) 824 return -ENOPROTOOPT; 825 826 if (get_user(len, optlen)) 827 return -EFAULT; 828 829 lock_sock(sk); 830 831 switch (optname) { 832 case BT_SECURITY: 833 if (sk->sk_type != SOCK_STREAM) { 834 err = -EINVAL; 835 break; 836 } 837 838 sec.level = rfcomm_pi(sk)->sec_level; 839 sec.key_size = 0; 840 841 len = min_t(unsigned int, len, sizeof(sec)); 842 if (copy_to_user(optval, (char *) &sec, len)) 843 err = -EFAULT; 844 845 break; 846 847 case BT_DEFER_SETUP: 848 if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) { 849 err = -EINVAL; 850 break; 851 } 852 853 if (put_user(test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags), 854 (u32 __user *) optval)) 855 err = -EFAULT; 856 857 break; 858 859 default: 860 err = -ENOPROTOOPT; 861 break; 862 } 863 864 release_sock(sk); 865 return err; 866 } 867 868 static int rfcomm_sock_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg) 869 { 870 struct sock *sk __maybe_unused = sock->sk; 871 int err; 872 873 BT_DBG("sk %p cmd %x arg %lx", sk, cmd, arg); 874 875 err = bt_sock_ioctl(sock, cmd, arg); 876 877 if (err == -ENOIOCTLCMD) { 878 #ifdef CONFIG_BT_RFCOMM_TTY 879 lock_sock(sk); 880 err = rfcomm_dev_ioctl(sk, cmd, (void __user *) arg); 881 release_sock(sk); 882 #else 883 err = -EOPNOTSUPP; 884 #endif 885 } 886 887 return err; 888 } 889 890 #ifdef CONFIG_COMPAT 891 static int rfcomm_sock_compat_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg) 892 { 893 return rfcomm_sock_ioctl(sock, cmd, (unsigned long)compat_ptr(arg)); 894 } 895 #endif 896 897 static int rfcomm_sock_shutdown(struct socket *sock, int how) 898 { 899 struct sock *sk = sock->sk; 900 int err = 0; 901 902 BT_DBG("sock %p, sk %p", sock, sk); 903 904 if (!sk) 905 return 0; 906 907 lock_sock(sk); 908 if (!sk->sk_shutdown) { 909 sk->sk_shutdown = SHUTDOWN_MASK; 910 911 release_sock(sk); 912 __rfcomm_sock_close(sk); 913 lock_sock(sk); 914 915 if (sock_flag(sk, SOCK_LINGER) && sk->sk_lingertime && 916 !(current->flags & PF_EXITING)) 917 err = bt_sock_wait_state(sk, BT_CLOSED, sk->sk_lingertime); 918 } 919 release_sock(sk); 920 return err; 921 } 922 923 static int rfcomm_sock_release(struct socket *sock) 924 { 925 struct sock *sk = sock->sk; 926 int err; 927 928 BT_DBG("sock %p, sk %p", sock, sk); 929 930 if (!sk) 931 return 0; 932 933 err = rfcomm_sock_shutdown(sock, 2); 934 935 sock_orphan(sk); 936 rfcomm_sock_kill(sk); 937 return err; 938 } 939 940 /* ---- RFCOMM core layer callbacks ---- 941 * 942 * called under rfcomm_lock() 943 */ 944 int rfcomm_connect_ind(struct rfcomm_session *s, u8 channel, struct rfcomm_dlc **d) 945 { 946 struct sock *sk, *parent; 947 bdaddr_t src, dst; 948 int result = 0; 949 950 BT_DBG("session %p channel %d", s, channel); 951 952 rfcomm_session_getaddr(s, &src, &dst); 953 954 /* Check if we have socket listening on channel */ 955 parent = rfcomm_get_sock_by_channel(BT_LISTEN, channel, &src); 956 if (!parent) 957 return 0; 958 959 lock_sock(parent); 960 961 /* Check for backlog size */ 962 if (sk_acceptq_is_full(parent)) { 963 BT_DBG("backlog full %d", parent->sk_ack_backlog); 964 goto done; 965 } 966 967 sk = rfcomm_sock_alloc(sock_net(parent), NULL, BTPROTO_RFCOMM, GFP_ATOMIC, 0); 968 if (!sk) 969 goto done; 970 971 bt_sock_reclassify_lock(sk, BTPROTO_RFCOMM); 972 973 rfcomm_sock_init(sk, parent); 974 bacpy(&rfcomm_pi(sk)->src, &src); 975 bacpy(&rfcomm_pi(sk)->dst, &dst); 976 rfcomm_pi(sk)->channel = channel; 977 978 sk->sk_state = BT_CONFIG; 979 bt_accept_enqueue(parent, sk, true); 980 981 /* Accept connection and return socket DLC */ 982 *d = rfcomm_pi(sk)->dlc; 983 result = 1; 984 985 done: 986 release_sock(parent); 987 988 if (test_bit(BT_SK_DEFER_SETUP, &bt_sk(parent)->flags)) 989 parent->sk_state_change(parent); 990 991 return result; 992 } 993 994 static int rfcomm_sock_debugfs_show(struct seq_file *f, void *p) 995 { 996 struct sock *sk; 997 998 read_lock(&rfcomm_sk_list.lock); 999 1000 sk_for_each(sk, &rfcomm_sk_list.head) { 1001 seq_printf(f, "%pMR %pMR %d %d\n", 1002 &rfcomm_pi(sk)->src, &rfcomm_pi(sk)->dst, 1003 sk->sk_state, rfcomm_pi(sk)->channel); 1004 } 1005 1006 read_unlock(&rfcomm_sk_list.lock); 1007 1008 return 0; 1009 } 1010 1011 DEFINE_SHOW_ATTRIBUTE(rfcomm_sock_debugfs); 1012 1013 static struct dentry *rfcomm_sock_debugfs; 1014 1015 static const struct proto_ops rfcomm_sock_ops = { 1016 .family = PF_BLUETOOTH, 1017 .owner = THIS_MODULE, 1018 .release = rfcomm_sock_release, 1019 .bind = rfcomm_sock_bind, 1020 .connect = rfcomm_sock_connect, 1021 .listen = rfcomm_sock_listen, 1022 .accept = rfcomm_sock_accept, 1023 .getname = rfcomm_sock_getname, 1024 .sendmsg = rfcomm_sock_sendmsg, 1025 .recvmsg = rfcomm_sock_recvmsg, 1026 .shutdown = rfcomm_sock_shutdown, 1027 .setsockopt = rfcomm_sock_setsockopt, 1028 .getsockopt = rfcomm_sock_getsockopt, 1029 .ioctl = rfcomm_sock_ioctl, 1030 .gettstamp = sock_gettstamp, 1031 .poll = bt_sock_poll, 1032 .socketpair = sock_no_socketpair, 1033 .mmap = sock_no_mmap, 1034 #ifdef CONFIG_COMPAT 1035 .compat_ioctl = rfcomm_sock_compat_ioctl, 1036 #endif 1037 }; 1038 1039 static const struct net_proto_family rfcomm_sock_family_ops = { 1040 .family = PF_BLUETOOTH, 1041 .owner = THIS_MODULE, 1042 .create = rfcomm_sock_create 1043 }; 1044 1045 int __init rfcomm_init_sockets(void) 1046 { 1047 int err; 1048 1049 BUILD_BUG_ON(sizeof(struct sockaddr_rc) > sizeof(struct sockaddr)); 1050 1051 err = proto_register(&rfcomm_proto, 0); 1052 if (err < 0) 1053 return err; 1054 1055 err = bt_sock_register(BTPROTO_RFCOMM, &rfcomm_sock_family_ops); 1056 if (err < 0) { 1057 BT_ERR("RFCOMM socket layer registration failed"); 1058 goto error; 1059 } 1060 1061 err = bt_procfs_init(&init_net, "rfcomm", &rfcomm_sk_list, NULL); 1062 if (err < 0) { 1063 BT_ERR("Failed to create RFCOMM proc file"); 1064 bt_sock_unregister(BTPROTO_RFCOMM); 1065 goto error; 1066 } 1067 1068 BT_INFO("RFCOMM socket layer initialized"); 1069 1070 if (IS_ERR_OR_NULL(bt_debugfs)) 1071 return 0; 1072 1073 rfcomm_sock_debugfs = debugfs_create_file("rfcomm", 0444, 1074 bt_debugfs, NULL, 1075 &rfcomm_sock_debugfs_fops); 1076 1077 return 0; 1078 1079 error: 1080 proto_unregister(&rfcomm_proto); 1081 return err; 1082 } 1083 1084 void __exit rfcomm_cleanup_sockets(void) 1085 { 1086 bt_procfs_cleanup(&init_net, "rfcomm"); 1087 1088 debugfs_remove(rfcomm_sock_debugfs); 1089 1090 bt_sock_unregister(BTPROTO_RFCOMM); 1091 1092 proto_unregister(&rfcomm_proto); 1093 } 1094