1 /* 2 RFCOMM implementation for Linux Bluetooth stack (BlueZ). 3 Copyright (C) 2002 Maxim Krasnyansky <maxk@qualcomm.com> 4 Copyright (C) 2002 Marcel Holtmann <marcel@holtmann.org> 5 6 This program is free software; you can redistribute it and/or modify 7 it under the terms of the GNU General Public License version 2 as 8 published by the Free Software Foundation; 9 10 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS 11 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 12 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS. 13 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY 14 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES 15 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 16 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 17 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 18 19 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS, 20 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS 21 SOFTWARE IS DISCLAIMED. 22 */ 23 24 /* 25 * RFCOMM sockets. 26 */ 27 28 #include <linux/export.h> 29 #include <linux/debugfs.h> 30 31 #include <net/bluetooth/bluetooth.h> 32 #include <net/bluetooth/hci_core.h> 33 #include <net/bluetooth/l2cap.h> 34 #include <net/bluetooth/rfcomm.h> 35 36 static const struct proto_ops rfcomm_sock_ops; 37 38 static struct bt_sock_list rfcomm_sk_list = { 39 .lock = __RW_LOCK_UNLOCKED(rfcomm_sk_list.lock) 40 }; 41 42 static void rfcomm_sock_close(struct sock *sk); 43 static void rfcomm_sock_kill(struct sock *sk); 44 45 /* ---- DLC callbacks ---- 46 * 47 * called under rfcomm_dlc_lock() 48 */ 49 static void rfcomm_sk_data_ready(struct rfcomm_dlc *d, struct sk_buff *skb) 50 { 51 struct sock *sk = d->owner; 52 if (!sk) 53 return; 54 55 atomic_add(skb->len, &sk->sk_rmem_alloc); 56 skb_queue_tail(&sk->sk_receive_queue, skb); 57 sk->sk_data_ready(sk); 58 59 if (atomic_read(&sk->sk_rmem_alloc) >= sk->sk_rcvbuf) 60 rfcomm_dlc_throttle(d); 61 } 62 63 static void rfcomm_sk_state_change(struct rfcomm_dlc *d, int err) 64 { 65 struct sock *sk = d->owner, *parent; 66 unsigned long flags; 67 68 if (!sk) 69 return; 70 71 BT_DBG("dlc %p state %ld err %d", d, d->state, err); 72 73 local_irq_save(flags); 74 bh_lock_sock(sk); 75 76 if (err) 77 sk->sk_err = err; 78 79 sk->sk_state = d->state; 80 81 parent = bt_sk(sk)->parent; 82 if (parent) { 83 if (d->state == BT_CLOSED) { 84 sock_set_flag(sk, SOCK_ZAPPED); 85 bt_accept_unlink(sk); 86 } 87 parent->sk_data_ready(parent); 88 } else { 89 if (d->state == BT_CONNECTED) 90 rfcomm_session_getaddr(d->session, 91 &rfcomm_pi(sk)->src, NULL); 92 sk->sk_state_change(sk); 93 } 94 95 bh_unlock_sock(sk); 96 local_irq_restore(flags); 97 98 if (parent && sock_flag(sk, SOCK_ZAPPED)) { 99 /* We have to drop DLC lock here, otherwise 100 * rfcomm_sock_destruct() will dead lock. */ 101 rfcomm_dlc_unlock(d); 102 rfcomm_sock_kill(sk); 103 rfcomm_dlc_lock(d); 104 } 105 } 106 107 /* ---- Socket functions ---- */ 108 static struct sock *__rfcomm_get_listen_sock_by_addr(u8 channel, bdaddr_t *src) 109 { 110 struct sock *sk = NULL; 111 112 sk_for_each(sk, &rfcomm_sk_list.head) { 113 if (rfcomm_pi(sk)->channel != channel) 114 continue; 115 116 if (bacmp(&rfcomm_pi(sk)->src, src)) 117 continue; 118 119 if (sk->sk_state == BT_BOUND || sk->sk_state == BT_LISTEN) 120 break; 121 } 122 123 return sk ? sk : NULL; 124 } 125 126 /* Find socket with channel and source bdaddr. 127 * Returns closest match. 128 */ 129 static struct sock *rfcomm_get_sock_by_channel(int state, u8 channel, bdaddr_t *src) 130 { 131 struct sock *sk = NULL, *sk1 = NULL; 132 133 read_lock(&rfcomm_sk_list.lock); 134 135 sk_for_each(sk, &rfcomm_sk_list.head) { 136 if (state && sk->sk_state != state) 137 continue; 138 139 if (rfcomm_pi(sk)->channel == channel) { 140 /* Exact match. */ 141 if (!bacmp(&rfcomm_pi(sk)->src, src)) 142 break; 143 144 /* Closest match */ 145 if (!bacmp(&rfcomm_pi(sk)->src, BDADDR_ANY)) 146 sk1 = sk; 147 } 148 } 149 150 read_unlock(&rfcomm_sk_list.lock); 151 152 return sk ? sk : sk1; 153 } 154 155 static void rfcomm_sock_destruct(struct sock *sk) 156 { 157 struct rfcomm_dlc *d = rfcomm_pi(sk)->dlc; 158 159 BT_DBG("sk %p dlc %p", sk, d); 160 161 skb_queue_purge(&sk->sk_receive_queue); 162 skb_queue_purge(&sk->sk_write_queue); 163 164 rfcomm_dlc_lock(d); 165 rfcomm_pi(sk)->dlc = NULL; 166 167 /* Detach DLC if it's owned by this socket */ 168 if (d->owner == sk) 169 d->owner = NULL; 170 rfcomm_dlc_unlock(d); 171 172 rfcomm_dlc_put(d); 173 } 174 175 static void rfcomm_sock_cleanup_listen(struct sock *parent) 176 { 177 struct sock *sk; 178 179 BT_DBG("parent %p", parent); 180 181 /* Close not yet accepted dlcs */ 182 while ((sk = bt_accept_dequeue(parent, NULL))) { 183 rfcomm_sock_close(sk); 184 rfcomm_sock_kill(sk); 185 } 186 187 parent->sk_state = BT_CLOSED; 188 sock_set_flag(parent, SOCK_ZAPPED); 189 } 190 191 /* Kill socket (only if zapped and orphan) 192 * Must be called on unlocked socket. 193 */ 194 static void rfcomm_sock_kill(struct sock *sk) 195 { 196 if (!sock_flag(sk, SOCK_ZAPPED) || sk->sk_socket) 197 return; 198 199 BT_DBG("sk %p state %d refcnt %d", sk, sk->sk_state, atomic_read(&sk->sk_refcnt)); 200 201 /* Kill poor orphan */ 202 bt_sock_unlink(&rfcomm_sk_list, sk); 203 sock_set_flag(sk, SOCK_DEAD); 204 sock_put(sk); 205 } 206 207 static void __rfcomm_sock_close(struct sock *sk) 208 { 209 struct rfcomm_dlc *d = rfcomm_pi(sk)->dlc; 210 211 BT_DBG("sk %p state %d socket %p", sk, sk->sk_state, sk->sk_socket); 212 213 switch (sk->sk_state) { 214 case BT_LISTEN: 215 rfcomm_sock_cleanup_listen(sk); 216 break; 217 218 case BT_CONNECT: 219 case BT_CONNECT2: 220 case BT_CONFIG: 221 case BT_CONNECTED: 222 rfcomm_dlc_close(d, 0); 223 224 default: 225 sock_set_flag(sk, SOCK_ZAPPED); 226 break; 227 } 228 } 229 230 /* Close socket. 231 * Must be called on unlocked socket. 232 */ 233 static void rfcomm_sock_close(struct sock *sk) 234 { 235 lock_sock(sk); 236 __rfcomm_sock_close(sk); 237 release_sock(sk); 238 } 239 240 static void rfcomm_sock_init(struct sock *sk, struct sock *parent) 241 { 242 struct rfcomm_pinfo *pi = rfcomm_pi(sk); 243 244 BT_DBG("sk %p", sk); 245 246 if (parent) { 247 sk->sk_type = parent->sk_type; 248 pi->dlc->defer_setup = test_bit(BT_SK_DEFER_SETUP, 249 &bt_sk(parent)->flags); 250 251 pi->sec_level = rfcomm_pi(parent)->sec_level; 252 pi->role_switch = rfcomm_pi(parent)->role_switch; 253 254 security_sk_clone(parent, sk); 255 } else { 256 pi->dlc->defer_setup = 0; 257 258 pi->sec_level = BT_SECURITY_LOW; 259 pi->role_switch = 0; 260 } 261 262 pi->dlc->sec_level = pi->sec_level; 263 pi->dlc->role_switch = pi->role_switch; 264 } 265 266 static struct proto rfcomm_proto = { 267 .name = "RFCOMM", 268 .owner = THIS_MODULE, 269 .obj_size = sizeof(struct rfcomm_pinfo) 270 }; 271 272 static struct sock *rfcomm_sock_alloc(struct net *net, struct socket *sock, int proto, gfp_t prio) 273 { 274 struct rfcomm_dlc *d; 275 struct sock *sk; 276 277 sk = sk_alloc(net, PF_BLUETOOTH, prio, &rfcomm_proto); 278 if (!sk) 279 return NULL; 280 281 sock_init_data(sock, sk); 282 INIT_LIST_HEAD(&bt_sk(sk)->accept_q); 283 284 d = rfcomm_dlc_alloc(prio); 285 if (!d) { 286 sk_free(sk); 287 return NULL; 288 } 289 290 d->data_ready = rfcomm_sk_data_ready; 291 d->state_change = rfcomm_sk_state_change; 292 293 rfcomm_pi(sk)->dlc = d; 294 d->owner = sk; 295 296 sk->sk_destruct = rfcomm_sock_destruct; 297 sk->sk_sndtimeo = RFCOMM_CONN_TIMEOUT; 298 299 sk->sk_sndbuf = RFCOMM_MAX_CREDITS * RFCOMM_DEFAULT_MTU * 10; 300 sk->sk_rcvbuf = RFCOMM_MAX_CREDITS * RFCOMM_DEFAULT_MTU * 10; 301 302 sock_reset_flag(sk, SOCK_ZAPPED); 303 304 sk->sk_protocol = proto; 305 sk->sk_state = BT_OPEN; 306 307 bt_sock_link(&rfcomm_sk_list, sk); 308 309 BT_DBG("sk %p", sk); 310 return sk; 311 } 312 313 static int rfcomm_sock_create(struct net *net, struct socket *sock, 314 int protocol, int kern) 315 { 316 struct sock *sk; 317 318 BT_DBG("sock %p", sock); 319 320 sock->state = SS_UNCONNECTED; 321 322 if (sock->type != SOCK_STREAM && sock->type != SOCK_RAW) 323 return -ESOCKTNOSUPPORT; 324 325 sock->ops = &rfcomm_sock_ops; 326 327 sk = rfcomm_sock_alloc(net, sock, protocol, GFP_ATOMIC); 328 if (!sk) 329 return -ENOMEM; 330 331 rfcomm_sock_init(sk, NULL); 332 return 0; 333 } 334 335 static int rfcomm_sock_bind(struct socket *sock, struct sockaddr *addr, int addr_len) 336 { 337 struct sockaddr_rc *sa = (struct sockaddr_rc *) addr; 338 struct sock *sk = sock->sk; 339 int chan = sa->rc_channel; 340 int err = 0; 341 342 BT_DBG("sk %p %pMR", sk, &sa->rc_bdaddr); 343 344 if (!addr || addr->sa_family != AF_BLUETOOTH) 345 return -EINVAL; 346 347 lock_sock(sk); 348 349 if (sk->sk_state != BT_OPEN) { 350 err = -EBADFD; 351 goto done; 352 } 353 354 if (sk->sk_type != SOCK_STREAM) { 355 err = -EINVAL; 356 goto done; 357 } 358 359 write_lock(&rfcomm_sk_list.lock); 360 361 if (chan && __rfcomm_get_listen_sock_by_addr(chan, &sa->rc_bdaddr)) { 362 err = -EADDRINUSE; 363 } else { 364 /* Save source address */ 365 bacpy(&rfcomm_pi(sk)->src, &sa->rc_bdaddr); 366 rfcomm_pi(sk)->channel = chan; 367 sk->sk_state = BT_BOUND; 368 } 369 370 write_unlock(&rfcomm_sk_list.lock); 371 372 done: 373 release_sock(sk); 374 return err; 375 } 376 377 static int rfcomm_sock_connect(struct socket *sock, struct sockaddr *addr, int alen, int flags) 378 { 379 struct sockaddr_rc *sa = (struct sockaddr_rc *) addr; 380 struct sock *sk = sock->sk; 381 struct rfcomm_dlc *d = rfcomm_pi(sk)->dlc; 382 int err = 0; 383 384 BT_DBG("sk %p", sk); 385 386 if (alen < sizeof(struct sockaddr_rc) || 387 addr->sa_family != AF_BLUETOOTH) 388 return -EINVAL; 389 390 lock_sock(sk); 391 392 if (sk->sk_state != BT_OPEN && sk->sk_state != BT_BOUND) { 393 err = -EBADFD; 394 goto done; 395 } 396 397 if (sk->sk_type != SOCK_STREAM) { 398 err = -EINVAL; 399 goto done; 400 } 401 402 sk->sk_state = BT_CONNECT; 403 bacpy(&rfcomm_pi(sk)->dst, &sa->rc_bdaddr); 404 rfcomm_pi(sk)->channel = sa->rc_channel; 405 406 d->sec_level = rfcomm_pi(sk)->sec_level; 407 d->role_switch = rfcomm_pi(sk)->role_switch; 408 409 err = rfcomm_dlc_open(d, &rfcomm_pi(sk)->src, &sa->rc_bdaddr, 410 sa->rc_channel); 411 if (!err) 412 err = bt_sock_wait_state(sk, BT_CONNECTED, 413 sock_sndtimeo(sk, flags & O_NONBLOCK)); 414 415 done: 416 release_sock(sk); 417 return err; 418 } 419 420 static int rfcomm_sock_listen(struct socket *sock, int backlog) 421 { 422 struct sock *sk = sock->sk; 423 int err = 0; 424 425 BT_DBG("sk %p backlog %d", sk, backlog); 426 427 lock_sock(sk); 428 429 if (sk->sk_state != BT_BOUND) { 430 err = -EBADFD; 431 goto done; 432 } 433 434 if (sk->sk_type != SOCK_STREAM) { 435 err = -EINVAL; 436 goto done; 437 } 438 439 if (!rfcomm_pi(sk)->channel) { 440 bdaddr_t *src = &rfcomm_pi(sk)->src; 441 u8 channel; 442 443 err = -EINVAL; 444 445 write_lock(&rfcomm_sk_list.lock); 446 447 for (channel = 1; channel < 31; channel++) 448 if (!__rfcomm_get_listen_sock_by_addr(channel, src)) { 449 rfcomm_pi(sk)->channel = channel; 450 err = 0; 451 break; 452 } 453 454 write_unlock(&rfcomm_sk_list.lock); 455 456 if (err < 0) 457 goto done; 458 } 459 460 sk->sk_max_ack_backlog = backlog; 461 sk->sk_ack_backlog = 0; 462 sk->sk_state = BT_LISTEN; 463 464 done: 465 release_sock(sk); 466 return err; 467 } 468 469 static int rfcomm_sock_accept(struct socket *sock, struct socket *newsock, int flags) 470 { 471 DEFINE_WAIT_FUNC(wait, woken_wake_function); 472 struct sock *sk = sock->sk, *nsk; 473 long timeo; 474 int err = 0; 475 476 lock_sock_nested(sk, SINGLE_DEPTH_NESTING); 477 478 if (sk->sk_type != SOCK_STREAM) { 479 err = -EINVAL; 480 goto done; 481 } 482 483 timeo = sock_rcvtimeo(sk, flags & O_NONBLOCK); 484 485 BT_DBG("sk %p timeo %ld", sk, timeo); 486 487 /* Wait for an incoming connection. (wake-one). */ 488 add_wait_queue_exclusive(sk_sleep(sk), &wait); 489 while (1) { 490 if (sk->sk_state != BT_LISTEN) { 491 err = -EBADFD; 492 break; 493 } 494 495 nsk = bt_accept_dequeue(sk, newsock); 496 if (nsk) 497 break; 498 499 if (!timeo) { 500 err = -EAGAIN; 501 break; 502 } 503 504 if (signal_pending(current)) { 505 err = sock_intr_errno(timeo); 506 break; 507 } 508 509 release_sock(sk); 510 511 timeo = wait_woken(&wait, TASK_INTERRUPTIBLE, timeo); 512 513 lock_sock_nested(sk, SINGLE_DEPTH_NESTING); 514 } 515 remove_wait_queue(sk_sleep(sk), &wait); 516 517 if (err) 518 goto done; 519 520 newsock->state = SS_CONNECTED; 521 522 BT_DBG("new socket %p", nsk); 523 524 done: 525 release_sock(sk); 526 return err; 527 } 528 529 static int rfcomm_sock_getname(struct socket *sock, struct sockaddr *addr, int *len, int peer) 530 { 531 struct sockaddr_rc *sa = (struct sockaddr_rc *) addr; 532 struct sock *sk = sock->sk; 533 534 BT_DBG("sock %p, sk %p", sock, sk); 535 536 if (peer && sk->sk_state != BT_CONNECTED && 537 sk->sk_state != BT_CONNECT && sk->sk_state != BT_CONNECT2) 538 return -ENOTCONN; 539 540 memset(sa, 0, sizeof(*sa)); 541 sa->rc_family = AF_BLUETOOTH; 542 sa->rc_channel = rfcomm_pi(sk)->channel; 543 if (peer) 544 bacpy(&sa->rc_bdaddr, &rfcomm_pi(sk)->dst); 545 else 546 bacpy(&sa->rc_bdaddr, &rfcomm_pi(sk)->src); 547 548 *len = sizeof(struct sockaddr_rc); 549 return 0; 550 } 551 552 static int rfcomm_sock_sendmsg(struct kiocb *iocb, struct socket *sock, 553 struct msghdr *msg, size_t len) 554 { 555 struct sock *sk = sock->sk; 556 struct rfcomm_dlc *d = rfcomm_pi(sk)->dlc; 557 struct sk_buff *skb; 558 int sent; 559 560 if (test_bit(RFCOMM_DEFER_SETUP, &d->flags)) 561 return -ENOTCONN; 562 563 if (msg->msg_flags & MSG_OOB) 564 return -EOPNOTSUPP; 565 566 if (sk->sk_shutdown & SEND_SHUTDOWN) 567 return -EPIPE; 568 569 BT_DBG("sock %p, sk %p", sock, sk); 570 571 lock_sock(sk); 572 573 sent = bt_sock_wait_ready(sk, msg->msg_flags); 574 if (sent) 575 goto done; 576 577 while (len) { 578 size_t size = min_t(size_t, len, d->mtu); 579 int err; 580 581 skb = sock_alloc_send_skb(sk, size + RFCOMM_SKB_RESERVE, 582 msg->msg_flags & MSG_DONTWAIT, &err); 583 if (!skb) { 584 if (sent == 0) 585 sent = err; 586 break; 587 } 588 skb_reserve(skb, RFCOMM_SKB_HEAD_RESERVE); 589 590 err = memcpy_from_msg(skb_put(skb, size), msg, size); 591 if (err) { 592 kfree_skb(skb); 593 if (sent == 0) 594 sent = err; 595 break; 596 } 597 598 skb->priority = sk->sk_priority; 599 600 err = rfcomm_dlc_send(d, skb); 601 if (err < 0) { 602 kfree_skb(skb); 603 if (sent == 0) 604 sent = err; 605 break; 606 } 607 608 sent += size; 609 len -= size; 610 } 611 612 done: 613 release_sock(sk); 614 615 return sent; 616 } 617 618 static int rfcomm_sock_recvmsg(struct kiocb *iocb, struct socket *sock, 619 struct msghdr *msg, size_t size, int flags) 620 { 621 struct sock *sk = sock->sk; 622 struct rfcomm_dlc *d = rfcomm_pi(sk)->dlc; 623 int len; 624 625 if (test_and_clear_bit(RFCOMM_DEFER_SETUP, &d->flags)) { 626 rfcomm_dlc_accept(d); 627 return 0; 628 } 629 630 len = bt_sock_stream_recvmsg(iocb, sock, msg, size, flags); 631 632 lock_sock(sk); 633 if (!(flags & MSG_PEEK) && len > 0) 634 atomic_sub(len, &sk->sk_rmem_alloc); 635 636 if (atomic_read(&sk->sk_rmem_alloc) <= (sk->sk_rcvbuf >> 2)) 637 rfcomm_dlc_unthrottle(rfcomm_pi(sk)->dlc); 638 release_sock(sk); 639 640 return len; 641 } 642 643 static int rfcomm_sock_setsockopt_old(struct socket *sock, int optname, char __user *optval, unsigned int optlen) 644 { 645 struct sock *sk = sock->sk; 646 int err = 0; 647 u32 opt; 648 649 BT_DBG("sk %p", sk); 650 651 lock_sock(sk); 652 653 switch (optname) { 654 case RFCOMM_LM: 655 if (get_user(opt, (u32 __user *) optval)) { 656 err = -EFAULT; 657 break; 658 } 659 660 if (opt & RFCOMM_LM_FIPS) { 661 err = -EINVAL; 662 break; 663 } 664 665 if (opt & RFCOMM_LM_AUTH) 666 rfcomm_pi(sk)->sec_level = BT_SECURITY_LOW; 667 if (opt & RFCOMM_LM_ENCRYPT) 668 rfcomm_pi(sk)->sec_level = BT_SECURITY_MEDIUM; 669 if (opt & RFCOMM_LM_SECURE) 670 rfcomm_pi(sk)->sec_level = BT_SECURITY_HIGH; 671 672 rfcomm_pi(sk)->role_switch = (opt & RFCOMM_LM_MASTER); 673 break; 674 675 default: 676 err = -ENOPROTOOPT; 677 break; 678 } 679 680 release_sock(sk); 681 return err; 682 } 683 684 static int rfcomm_sock_setsockopt(struct socket *sock, int level, int optname, char __user *optval, unsigned int optlen) 685 { 686 struct sock *sk = sock->sk; 687 struct bt_security sec; 688 int err = 0; 689 size_t len; 690 u32 opt; 691 692 BT_DBG("sk %p", sk); 693 694 if (level == SOL_RFCOMM) 695 return rfcomm_sock_setsockopt_old(sock, optname, optval, optlen); 696 697 if (level != SOL_BLUETOOTH) 698 return -ENOPROTOOPT; 699 700 lock_sock(sk); 701 702 switch (optname) { 703 case BT_SECURITY: 704 if (sk->sk_type != SOCK_STREAM) { 705 err = -EINVAL; 706 break; 707 } 708 709 sec.level = BT_SECURITY_LOW; 710 711 len = min_t(unsigned int, sizeof(sec), optlen); 712 if (copy_from_user((char *) &sec, optval, len)) { 713 err = -EFAULT; 714 break; 715 } 716 717 if (sec.level > BT_SECURITY_HIGH) { 718 err = -EINVAL; 719 break; 720 } 721 722 rfcomm_pi(sk)->sec_level = sec.level; 723 break; 724 725 case BT_DEFER_SETUP: 726 if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) { 727 err = -EINVAL; 728 break; 729 } 730 731 if (get_user(opt, (u32 __user *) optval)) { 732 err = -EFAULT; 733 break; 734 } 735 736 if (opt) 737 set_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags); 738 else 739 clear_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags); 740 741 break; 742 743 default: 744 err = -ENOPROTOOPT; 745 break; 746 } 747 748 release_sock(sk); 749 return err; 750 } 751 752 static int rfcomm_sock_getsockopt_old(struct socket *sock, int optname, char __user *optval, int __user *optlen) 753 { 754 struct sock *sk = sock->sk; 755 struct sock *l2cap_sk; 756 struct l2cap_conn *conn; 757 struct rfcomm_conninfo cinfo; 758 int len, err = 0; 759 u32 opt; 760 761 BT_DBG("sk %p", sk); 762 763 if (get_user(len, optlen)) 764 return -EFAULT; 765 766 lock_sock(sk); 767 768 switch (optname) { 769 case RFCOMM_LM: 770 switch (rfcomm_pi(sk)->sec_level) { 771 case BT_SECURITY_LOW: 772 opt = RFCOMM_LM_AUTH; 773 break; 774 case BT_SECURITY_MEDIUM: 775 opt = RFCOMM_LM_AUTH | RFCOMM_LM_ENCRYPT; 776 break; 777 case BT_SECURITY_HIGH: 778 opt = RFCOMM_LM_AUTH | RFCOMM_LM_ENCRYPT | 779 RFCOMM_LM_SECURE; 780 break; 781 case BT_SECURITY_FIPS: 782 opt = RFCOMM_LM_AUTH | RFCOMM_LM_ENCRYPT | 783 RFCOMM_LM_SECURE | RFCOMM_LM_FIPS; 784 break; 785 default: 786 opt = 0; 787 break; 788 } 789 790 if (rfcomm_pi(sk)->role_switch) 791 opt |= RFCOMM_LM_MASTER; 792 793 if (put_user(opt, (u32 __user *) optval)) 794 err = -EFAULT; 795 796 break; 797 798 case RFCOMM_CONNINFO: 799 if (sk->sk_state != BT_CONNECTED && 800 !rfcomm_pi(sk)->dlc->defer_setup) { 801 err = -ENOTCONN; 802 break; 803 } 804 805 l2cap_sk = rfcomm_pi(sk)->dlc->session->sock->sk; 806 conn = l2cap_pi(l2cap_sk)->chan->conn; 807 808 memset(&cinfo, 0, sizeof(cinfo)); 809 cinfo.hci_handle = conn->hcon->handle; 810 memcpy(cinfo.dev_class, conn->hcon->dev_class, 3); 811 812 len = min_t(unsigned int, len, sizeof(cinfo)); 813 if (copy_to_user(optval, (char *) &cinfo, len)) 814 err = -EFAULT; 815 816 break; 817 818 default: 819 err = -ENOPROTOOPT; 820 break; 821 } 822 823 release_sock(sk); 824 return err; 825 } 826 827 static int rfcomm_sock_getsockopt(struct socket *sock, int level, int optname, char __user *optval, int __user *optlen) 828 { 829 struct sock *sk = sock->sk; 830 struct bt_security sec; 831 int len, err = 0; 832 833 BT_DBG("sk %p", sk); 834 835 if (level == SOL_RFCOMM) 836 return rfcomm_sock_getsockopt_old(sock, optname, optval, optlen); 837 838 if (level != SOL_BLUETOOTH) 839 return -ENOPROTOOPT; 840 841 if (get_user(len, optlen)) 842 return -EFAULT; 843 844 lock_sock(sk); 845 846 switch (optname) { 847 case BT_SECURITY: 848 if (sk->sk_type != SOCK_STREAM) { 849 err = -EINVAL; 850 break; 851 } 852 853 sec.level = rfcomm_pi(sk)->sec_level; 854 sec.key_size = 0; 855 856 len = min_t(unsigned int, len, sizeof(sec)); 857 if (copy_to_user(optval, (char *) &sec, len)) 858 err = -EFAULT; 859 860 break; 861 862 case BT_DEFER_SETUP: 863 if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) { 864 err = -EINVAL; 865 break; 866 } 867 868 if (put_user(test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags), 869 (u32 __user *) optval)) 870 err = -EFAULT; 871 872 break; 873 874 default: 875 err = -ENOPROTOOPT; 876 break; 877 } 878 879 release_sock(sk); 880 return err; 881 } 882 883 static int rfcomm_sock_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg) 884 { 885 struct sock *sk __maybe_unused = sock->sk; 886 int err; 887 888 BT_DBG("sk %p cmd %x arg %lx", sk, cmd, arg); 889 890 err = bt_sock_ioctl(sock, cmd, arg); 891 892 if (err == -ENOIOCTLCMD) { 893 #ifdef CONFIG_BT_RFCOMM_TTY 894 lock_sock(sk); 895 err = rfcomm_dev_ioctl(sk, cmd, (void __user *) arg); 896 release_sock(sk); 897 #else 898 err = -EOPNOTSUPP; 899 #endif 900 } 901 902 return err; 903 } 904 905 static int rfcomm_sock_shutdown(struct socket *sock, int how) 906 { 907 struct sock *sk = sock->sk; 908 int err = 0; 909 910 BT_DBG("sock %p, sk %p", sock, sk); 911 912 if (!sk) 913 return 0; 914 915 lock_sock(sk); 916 if (!sk->sk_shutdown) { 917 sk->sk_shutdown = SHUTDOWN_MASK; 918 __rfcomm_sock_close(sk); 919 920 if (sock_flag(sk, SOCK_LINGER) && sk->sk_lingertime && 921 !(current->flags & PF_EXITING)) 922 err = bt_sock_wait_state(sk, BT_CLOSED, sk->sk_lingertime); 923 } 924 release_sock(sk); 925 return err; 926 } 927 928 static int rfcomm_sock_release(struct socket *sock) 929 { 930 struct sock *sk = sock->sk; 931 int err; 932 933 BT_DBG("sock %p, sk %p", sock, sk); 934 935 if (!sk) 936 return 0; 937 938 err = rfcomm_sock_shutdown(sock, 2); 939 940 sock_orphan(sk); 941 rfcomm_sock_kill(sk); 942 return err; 943 } 944 945 /* ---- RFCOMM core layer callbacks ---- 946 * 947 * called under rfcomm_lock() 948 */ 949 int rfcomm_connect_ind(struct rfcomm_session *s, u8 channel, struct rfcomm_dlc **d) 950 { 951 struct sock *sk, *parent; 952 bdaddr_t src, dst; 953 int result = 0; 954 955 BT_DBG("session %p channel %d", s, channel); 956 957 rfcomm_session_getaddr(s, &src, &dst); 958 959 /* Check if we have socket listening on channel */ 960 parent = rfcomm_get_sock_by_channel(BT_LISTEN, channel, &src); 961 if (!parent) 962 return 0; 963 964 bh_lock_sock(parent); 965 966 /* Check for backlog size */ 967 if (sk_acceptq_is_full(parent)) { 968 BT_DBG("backlog full %d", parent->sk_ack_backlog); 969 goto done; 970 } 971 972 sk = rfcomm_sock_alloc(sock_net(parent), NULL, BTPROTO_RFCOMM, GFP_ATOMIC); 973 if (!sk) 974 goto done; 975 976 bt_sock_reclassify_lock(sk, BTPROTO_RFCOMM); 977 978 rfcomm_sock_init(sk, parent); 979 bacpy(&rfcomm_pi(sk)->src, &src); 980 bacpy(&rfcomm_pi(sk)->dst, &dst); 981 rfcomm_pi(sk)->channel = channel; 982 983 sk->sk_state = BT_CONFIG; 984 bt_accept_enqueue(parent, sk); 985 986 /* Accept connection and return socket DLC */ 987 *d = rfcomm_pi(sk)->dlc; 988 result = 1; 989 990 done: 991 bh_unlock_sock(parent); 992 993 if (test_bit(BT_SK_DEFER_SETUP, &bt_sk(parent)->flags)) 994 parent->sk_state_change(parent); 995 996 return result; 997 } 998 999 static int rfcomm_sock_debugfs_show(struct seq_file *f, void *p) 1000 { 1001 struct sock *sk; 1002 1003 read_lock(&rfcomm_sk_list.lock); 1004 1005 sk_for_each(sk, &rfcomm_sk_list.head) { 1006 seq_printf(f, "%pMR %pMR %d %d\n", 1007 &rfcomm_pi(sk)->src, &rfcomm_pi(sk)->dst, 1008 sk->sk_state, rfcomm_pi(sk)->channel); 1009 } 1010 1011 read_unlock(&rfcomm_sk_list.lock); 1012 1013 return 0; 1014 } 1015 1016 static int rfcomm_sock_debugfs_open(struct inode *inode, struct file *file) 1017 { 1018 return single_open(file, rfcomm_sock_debugfs_show, inode->i_private); 1019 } 1020 1021 static const struct file_operations rfcomm_sock_debugfs_fops = { 1022 .open = rfcomm_sock_debugfs_open, 1023 .read = seq_read, 1024 .llseek = seq_lseek, 1025 .release = single_release, 1026 }; 1027 1028 static struct dentry *rfcomm_sock_debugfs; 1029 1030 static const struct proto_ops rfcomm_sock_ops = { 1031 .family = PF_BLUETOOTH, 1032 .owner = THIS_MODULE, 1033 .release = rfcomm_sock_release, 1034 .bind = rfcomm_sock_bind, 1035 .connect = rfcomm_sock_connect, 1036 .listen = rfcomm_sock_listen, 1037 .accept = rfcomm_sock_accept, 1038 .getname = rfcomm_sock_getname, 1039 .sendmsg = rfcomm_sock_sendmsg, 1040 .recvmsg = rfcomm_sock_recvmsg, 1041 .shutdown = rfcomm_sock_shutdown, 1042 .setsockopt = rfcomm_sock_setsockopt, 1043 .getsockopt = rfcomm_sock_getsockopt, 1044 .ioctl = rfcomm_sock_ioctl, 1045 .poll = bt_sock_poll, 1046 .socketpair = sock_no_socketpair, 1047 .mmap = sock_no_mmap 1048 }; 1049 1050 static const struct net_proto_family rfcomm_sock_family_ops = { 1051 .family = PF_BLUETOOTH, 1052 .owner = THIS_MODULE, 1053 .create = rfcomm_sock_create 1054 }; 1055 1056 int __init rfcomm_init_sockets(void) 1057 { 1058 int err; 1059 1060 BUILD_BUG_ON(sizeof(struct sockaddr_rc) > sizeof(struct sockaddr)); 1061 1062 err = proto_register(&rfcomm_proto, 0); 1063 if (err < 0) 1064 return err; 1065 1066 err = bt_sock_register(BTPROTO_RFCOMM, &rfcomm_sock_family_ops); 1067 if (err < 0) { 1068 BT_ERR("RFCOMM socket layer registration failed"); 1069 goto error; 1070 } 1071 1072 err = bt_procfs_init(&init_net, "rfcomm", &rfcomm_sk_list, NULL); 1073 if (err < 0) { 1074 BT_ERR("Failed to create RFCOMM proc file"); 1075 bt_sock_unregister(BTPROTO_RFCOMM); 1076 goto error; 1077 } 1078 1079 BT_INFO("RFCOMM socket layer initialized"); 1080 1081 if (IS_ERR_OR_NULL(bt_debugfs)) 1082 return 0; 1083 1084 rfcomm_sock_debugfs = debugfs_create_file("rfcomm", 0444, 1085 bt_debugfs, NULL, 1086 &rfcomm_sock_debugfs_fops); 1087 1088 return 0; 1089 1090 error: 1091 proto_unregister(&rfcomm_proto); 1092 return err; 1093 } 1094 1095 void __exit rfcomm_cleanup_sockets(void) 1096 { 1097 bt_procfs_cleanup(&init_net, "rfcomm"); 1098 1099 debugfs_remove(rfcomm_sock_debugfs); 1100 1101 bt_sock_unregister(BTPROTO_RFCOMM); 1102 1103 proto_unregister(&rfcomm_proto); 1104 } 1105