1 /*
2 RFCOMM implementation for Linux Bluetooth stack (BlueZ).
3 Copyright (C) 2002 Maxim Krasnyansky <maxk@qualcomm.com>
4 Copyright (C) 2002 Marcel Holtmann <marcel@holtmann.org>
5
6 This program is free software; you can redistribute it and/or modify
7 it under the terms of the GNU General Public License version 2 as
8 published by the Free Software Foundation;
9
10 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
11 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
12 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
13 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
14 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
15 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
16 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
17 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
18
19 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
20 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
21 SOFTWARE IS DISCLAIMED.
22 */
23
24 /*
25 * RFCOMM sockets.
26 */
27
28 #include <linux/export.h>
29 #include <linux/debugfs.h>
30 #include <linux/sched/signal.h>
31
32 #include <net/bluetooth/bluetooth.h>
33 #include <net/bluetooth/hci_core.h>
34 #include <net/bluetooth/l2cap.h>
35 #include <net/bluetooth/rfcomm.h>
36
37 static const struct proto_ops rfcomm_sock_ops;
38
39 static struct bt_sock_list rfcomm_sk_list = {
40 .lock = __RW_LOCK_UNLOCKED(rfcomm_sk_list.lock)
41 };
42
43 static void rfcomm_sock_close(struct sock *sk);
44 static void rfcomm_sock_kill(struct sock *sk);
45
46 /* ---- DLC callbacks ----
47 *
48 * called under rfcomm_dlc_lock()
49 */
rfcomm_sk_data_ready(struct rfcomm_dlc * d,struct sk_buff * skb)50 static void rfcomm_sk_data_ready(struct rfcomm_dlc *d, struct sk_buff *skb)
51 {
52 struct sock *sk = d->owner;
53 if (!sk)
54 return;
55
56 atomic_add(skb->len, &sk->sk_rmem_alloc);
57 skb_queue_tail(&sk->sk_receive_queue, skb);
58 sk->sk_data_ready(sk);
59
60 if (atomic_read(&sk->sk_rmem_alloc) >= sk->sk_rcvbuf)
61 rfcomm_dlc_throttle(d);
62 }
63
rfcomm_sk_state_change(struct rfcomm_dlc * d,int err)64 static void rfcomm_sk_state_change(struct rfcomm_dlc *d, int err)
65 {
66 struct sock *sk = d->owner, *parent;
67 unsigned long flags;
68
69 if (!sk)
70 return;
71
72 BT_DBG("dlc %p state %ld err %d", d, d->state, err);
73
74 local_irq_save(flags);
75 bh_lock_sock(sk);
76
77 if (err)
78 sk->sk_err = err;
79
80 sk->sk_state = d->state;
81
82 parent = bt_sk(sk)->parent;
83 if (parent) {
84 if (d->state == BT_CLOSED) {
85 sock_set_flag(sk, SOCK_ZAPPED);
86 bt_accept_unlink(sk);
87 }
88 parent->sk_data_ready(parent);
89 } else {
90 if (d->state == BT_CONNECTED)
91 rfcomm_session_getaddr(d->session,
92 &rfcomm_pi(sk)->src, NULL);
93 sk->sk_state_change(sk);
94 }
95
96 bh_unlock_sock(sk);
97 local_irq_restore(flags);
98
99 if (parent && sock_flag(sk, SOCK_ZAPPED)) {
100 /* We have to drop DLC lock here, otherwise
101 * rfcomm_sock_destruct() will dead lock. */
102 rfcomm_dlc_unlock(d);
103 rfcomm_sock_kill(sk);
104 rfcomm_dlc_lock(d);
105 }
106 }
107
108 /* ---- Socket functions ---- */
__rfcomm_get_listen_sock_by_addr(u8 channel,bdaddr_t * src)109 static struct sock *__rfcomm_get_listen_sock_by_addr(u8 channel, bdaddr_t *src)
110 {
111 struct sock *sk = NULL;
112
113 sk_for_each(sk, &rfcomm_sk_list.head) {
114 if (rfcomm_pi(sk)->channel != channel)
115 continue;
116
117 if (bacmp(&rfcomm_pi(sk)->src, src))
118 continue;
119
120 if (sk->sk_state == BT_BOUND || sk->sk_state == BT_LISTEN)
121 break;
122 }
123
124 return sk ? sk : NULL;
125 }
126
127 /* Find socket with channel and source bdaddr.
128 * Returns closest match.
129 */
rfcomm_get_sock_by_channel(int state,u8 channel,bdaddr_t * src)130 static struct sock *rfcomm_get_sock_by_channel(int state, u8 channel, bdaddr_t *src)
131 {
132 struct sock *sk = NULL, *sk1 = NULL;
133
134 read_lock(&rfcomm_sk_list.lock);
135
136 sk_for_each(sk, &rfcomm_sk_list.head) {
137 if (state && sk->sk_state != state)
138 continue;
139
140 if (rfcomm_pi(sk)->channel == channel) {
141 /* Exact match. */
142 if (!bacmp(&rfcomm_pi(sk)->src, src))
143 break;
144
145 /* Closest match */
146 if (!bacmp(&rfcomm_pi(sk)->src, BDADDR_ANY))
147 sk1 = sk;
148 }
149 }
150
151 read_unlock(&rfcomm_sk_list.lock);
152
153 return sk ? sk : sk1;
154 }
155
rfcomm_sock_destruct(struct sock * sk)156 static void rfcomm_sock_destruct(struct sock *sk)
157 {
158 struct rfcomm_dlc *d = rfcomm_pi(sk)->dlc;
159
160 BT_DBG("sk %p dlc %p", sk, d);
161
162 skb_queue_purge(&sk->sk_receive_queue);
163 skb_queue_purge(&sk->sk_write_queue);
164
165 rfcomm_dlc_lock(d);
166 rfcomm_pi(sk)->dlc = NULL;
167
168 /* Detach DLC if it's owned by this socket */
169 if (d->owner == sk)
170 d->owner = NULL;
171 rfcomm_dlc_unlock(d);
172
173 rfcomm_dlc_put(d);
174 }
175
rfcomm_sock_cleanup_listen(struct sock * parent)176 static void rfcomm_sock_cleanup_listen(struct sock *parent)
177 {
178 struct sock *sk;
179
180 BT_DBG("parent %p", parent);
181
182 /* Close not yet accepted dlcs */
183 while ((sk = bt_accept_dequeue(parent, NULL))) {
184 rfcomm_sock_close(sk);
185 rfcomm_sock_kill(sk);
186 }
187
188 parent->sk_state = BT_CLOSED;
189 sock_set_flag(parent, SOCK_ZAPPED);
190 }
191
192 /* Kill socket (only if zapped and orphan)
193 * Must be called on unlocked socket.
194 */
rfcomm_sock_kill(struct sock * sk)195 static void rfcomm_sock_kill(struct sock *sk)
196 {
197 if (!sock_flag(sk, SOCK_ZAPPED) || sk->sk_socket)
198 return;
199
200 BT_DBG("sk %p state %d refcnt %d", sk, sk->sk_state, refcount_read(&sk->sk_refcnt));
201
202 /* Kill poor orphan */
203 bt_sock_unlink(&rfcomm_sk_list, sk);
204 sock_set_flag(sk, SOCK_DEAD);
205 sock_put(sk);
206 }
207
__rfcomm_sock_close(struct sock * sk)208 static void __rfcomm_sock_close(struct sock *sk)
209 {
210 struct rfcomm_dlc *d = rfcomm_pi(sk)->dlc;
211
212 BT_DBG("sk %p state %d socket %p", sk, sk->sk_state, sk->sk_socket);
213
214 switch (sk->sk_state) {
215 case BT_LISTEN:
216 rfcomm_sock_cleanup_listen(sk);
217 break;
218
219 case BT_CONNECT:
220 case BT_CONNECT2:
221 case BT_CONFIG:
222 case BT_CONNECTED:
223 rfcomm_dlc_close(d, 0);
224
225 default:
226 sock_set_flag(sk, SOCK_ZAPPED);
227 break;
228 }
229 }
230
231 /* Close socket.
232 * Must be called on unlocked socket.
233 */
rfcomm_sock_close(struct sock * sk)234 static void rfcomm_sock_close(struct sock *sk)
235 {
236 lock_sock(sk);
237 __rfcomm_sock_close(sk);
238 release_sock(sk);
239 }
240
rfcomm_sock_init(struct sock * sk,struct sock * parent)241 static void rfcomm_sock_init(struct sock *sk, struct sock *parent)
242 {
243 struct rfcomm_pinfo *pi = rfcomm_pi(sk);
244
245 BT_DBG("sk %p", sk);
246
247 if (parent) {
248 sk->sk_type = parent->sk_type;
249 pi->dlc->defer_setup = test_bit(BT_SK_DEFER_SETUP,
250 &bt_sk(parent)->flags);
251
252 pi->sec_level = rfcomm_pi(parent)->sec_level;
253 pi->role_switch = rfcomm_pi(parent)->role_switch;
254
255 security_sk_clone(parent, sk);
256 } else {
257 pi->dlc->defer_setup = 0;
258
259 pi->sec_level = BT_SECURITY_LOW;
260 pi->role_switch = 0;
261 }
262
263 pi->dlc->sec_level = pi->sec_level;
264 pi->dlc->role_switch = pi->role_switch;
265 }
266
267 static struct proto rfcomm_proto = {
268 .name = "RFCOMM",
269 .owner = THIS_MODULE,
270 .obj_size = sizeof(struct rfcomm_pinfo)
271 };
272
rfcomm_sock_alloc(struct net * net,struct socket * sock,int proto,gfp_t prio,int kern)273 static struct sock *rfcomm_sock_alloc(struct net *net, struct socket *sock, int proto, gfp_t prio, int kern)
274 {
275 struct rfcomm_dlc *d;
276 struct sock *sk;
277
278 sk = sk_alloc(net, PF_BLUETOOTH, prio, &rfcomm_proto, kern);
279 if (!sk)
280 return NULL;
281
282 sock_init_data(sock, sk);
283 INIT_LIST_HEAD(&bt_sk(sk)->accept_q);
284
285 d = rfcomm_dlc_alloc(prio);
286 if (!d) {
287 sk_free(sk);
288 return NULL;
289 }
290
291 d->data_ready = rfcomm_sk_data_ready;
292 d->state_change = rfcomm_sk_state_change;
293
294 rfcomm_pi(sk)->dlc = d;
295 d->owner = sk;
296
297 sk->sk_destruct = rfcomm_sock_destruct;
298 sk->sk_sndtimeo = RFCOMM_CONN_TIMEOUT;
299
300 sk->sk_sndbuf = RFCOMM_MAX_CREDITS * RFCOMM_DEFAULT_MTU * 10;
301 sk->sk_rcvbuf = RFCOMM_MAX_CREDITS * RFCOMM_DEFAULT_MTU * 10;
302
303 sock_reset_flag(sk, SOCK_ZAPPED);
304
305 sk->sk_protocol = proto;
306 sk->sk_state = BT_OPEN;
307
308 bt_sock_link(&rfcomm_sk_list, sk);
309
310 BT_DBG("sk %p", sk);
311 return sk;
312 }
313
rfcomm_sock_create(struct net * net,struct socket * sock,int protocol,int kern)314 static int rfcomm_sock_create(struct net *net, struct socket *sock,
315 int protocol, int kern)
316 {
317 struct sock *sk;
318
319 BT_DBG("sock %p", sock);
320
321 sock->state = SS_UNCONNECTED;
322
323 if (sock->type != SOCK_STREAM && sock->type != SOCK_RAW)
324 return -ESOCKTNOSUPPORT;
325
326 sock->ops = &rfcomm_sock_ops;
327
328 sk = rfcomm_sock_alloc(net, sock, protocol, GFP_ATOMIC, kern);
329 if (!sk)
330 return -ENOMEM;
331
332 rfcomm_sock_init(sk, NULL);
333 return 0;
334 }
335
rfcomm_sock_bind(struct socket * sock,struct sockaddr * addr,int addr_len)336 static int rfcomm_sock_bind(struct socket *sock, struct sockaddr *addr, int addr_len)
337 {
338 struct sockaddr_rc sa;
339 struct sock *sk = sock->sk;
340 int len, err = 0;
341
342 if (!addr || addr_len < offsetofend(struct sockaddr, sa_family) ||
343 addr->sa_family != AF_BLUETOOTH)
344 return -EINVAL;
345
346 memset(&sa, 0, sizeof(sa));
347 len = min_t(unsigned int, sizeof(sa), addr_len);
348 memcpy(&sa, addr, len);
349
350 BT_DBG("sk %p %pMR", sk, &sa.rc_bdaddr);
351
352 lock_sock(sk);
353
354 if (sk->sk_state != BT_OPEN) {
355 err = -EBADFD;
356 goto done;
357 }
358
359 if (sk->sk_type != SOCK_STREAM) {
360 err = -EINVAL;
361 goto done;
362 }
363
364 write_lock(&rfcomm_sk_list.lock);
365
366 if (sa.rc_channel &&
367 __rfcomm_get_listen_sock_by_addr(sa.rc_channel, &sa.rc_bdaddr)) {
368 err = -EADDRINUSE;
369 } else {
370 /* Save source address */
371 bacpy(&rfcomm_pi(sk)->src, &sa.rc_bdaddr);
372 rfcomm_pi(sk)->channel = sa.rc_channel;
373 sk->sk_state = BT_BOUND;
374 }
375
376 write_unlock(&rfcomm_sk_list.lock);
377
378 done:
379 release_sock(sk);
380 return err;
381 }
382
rfcomm_sock_connect(struct socket * sock,struct sockaddr * addr,int alen,int flags)383 static int rfcomm_sock_connect(struct socket *sock, struct sockaddr *addr, int alen, int flags)
384 {
385 struct sockaddr_rc *sa = (struct sockaddr_rc *) addr;
386 struct sock *sk = sock->sk;
387 struct rfcomm_dlc *d = rfcomm_pi(sk)->dlc;
388 int err = 0;
389
390 BT_DBG("sk %p", sk);
391
392 if (alen < sizeof(struct sockaddr_rc) ||
393 addr->sa_family != AF_BLUETOOTH)
394 return -EINVAL;
395
396 lock_sock(sk);
397
398 if (sk->sk_state != BT_OPEN && sk->sk_state != BT_BOUND) {
399 err = -EBADFD;
400 goto done;
401 }
402
403 if (sk->sk_type != SOCK_STREAM) {
404 err = -EINVAL;
405 goto done;
406 }
407
408 sk->sk_state = BT_CONNECT;
409 bacpy(&rfcomm_pi(sk)->dst, &sa->rc_bdaddr);
410 rfcomm_pi(sk)->channel = sa->rc_channel;
411
412 d->sec_level = rfcomm_pi(sk)->sec_level;
413 d->role_switch = rfcomm_pi(sk)->role_switch;
414
415 err = rfcomm_dlc_open(d, &rfcomm_pi(sk)->src, &sa->rc_bdaddr,
416 sa->rc_channel);
417 if (!err)
418 err = bt_sock_wait_state(sk, BT_CONNECTED,
419 sock_sndtimeo(sk, flags & O_NONBLOCK));
420
421 done:
422 release_sock(sk);
423 return err;
424 }
425
rfcomm_sock_listen(struct socket * sock,int backlog)426 static int rfcomm_sock_listen(struct socket *sock, int backlog)
427 {
428 struct sock *sk = sock->sk;
429 int err = 0;
430
431 BT_DBG("sk %p backlog %d", sk, backlog);
432
433 lock_sock(sk);
434
435 if (sk->sk_state != BT_BOUND) {
436 err = -EBADFD;
437 goto done;
438 }
439
440 if (sk->sk_type != SOCK_STREAM) {
441 err = -EINVAL;
442 goto done;
443 }
444
445 if (!rfcomm_pi(sk)->channel) {
446 bdaddr_t *src = &rfcomm_pi(sk)->src;
447 u8 channel;
448
449 err = -EINVAL;
450
451 write_lock(&rfcomm_sk_list.lock);
452
453 for (channel = 1; channel < 31; channel++)
454 if (!__rfcomm_get_listen_sock_by_addr(channel, src)) {
455 rfcomm_pi(sk)->channel = channel;
456 err = 0;
457 break;
458 }
459
460 write_unlock(&rfcomm_sk_list.lock);
461
462 if (err < 0)
463 goto done;
464 }
465
466 sk->sk_max_ack_backlog = backlog;
467 sk->sk_ack_backlog = 0;
468 sk->sk_state = BT_LISTEN;
469
470 done:
471 release_sock(sk);
472 return err;
473 }
474
rfcomm_sock_accept(struct socket * sock,struct socket * newsock,int flags,bool kern)475 static int rfcomm_sock_accept(struct socket *sock, struct socket *newsock, int flags,
476 bool kern)
477 {
478 DEFINE_WAIT_FUNC(wait, woken_wake_function);
479 struct sock *sk = sock->sk, *nsk;
480 long timeo;
481 int err = 0;
482
483 lock_sock_nested(sk, SINGLE_DEPTH_NESTING);
484
485 if (sk->sk_type != SOCK_STREAM) {
486 err = -EINVAL;
487 goto done;
488 }
489
490 timeo = sock_rcvtimeo(sk, flags & O_NONBLOCK);
491
492 BT_DBG("sk %p timeo %ld", sk, timeo);
493
494 /* Wait for an incoming connection. (wake-one). */
495 add_wait_queue_exclusive(sk_sleep(sk), &wait);
496 while (1) {
497 if (sk->sk_state != BT_LISTEN) {
498 err = -EBADFD;
499 break;
500 }
501
502 nsk = bt_accept_dequeue(sk, newsock);
503 if (nsk)
504 break;
505
506 if (!timeo) {
507 err = -EAGAIN;
508 break;
509 }
510
511 if (signal_pending(current)) {
512 err = sock_intr_errno(timeo);
513 break;
514 }
515
516 release_sock(sk);
517
518 timeo = wait_woken(&wait, TASK_INTERRUPTIBLE, timeo);
519
520 lock_sock_nested(sk, SINGLE_DEPTH_NESTING);
521 }
522 remove_wait_queue(sk_sleep(sk), &wait);
523
524 if (err)
525 goto done;
526
527 newsock->state = SS_CONNECTED;
528
529 BT_DBG("new socket %p", nsk);
530
531 done:
532 release_sock(sk);
533 return err;
534 }
535
rfcomm_sock_getname(struct socket * sock,struct sockaddr * addr,int * len,int peer)536 static int rfcomm_sock_getname(struct socket *sock, struct sockaddr *addr, int *len, int peer)
537 {
538 struct sockaddr_rc *sa = (struct sockaddr_rc *) addr;
539 struct sock *sk = sock->sk;
540
541 BT_DBG("sock %p, sk %p", sock, sk);
542
543 if (peer && sk->sk_state != BT_CONNECTED &&
544 sk->sk_state != BT_CONNECT && sk->sk_state != BT_CONNECT2)
545 return -ENOTCONN;
546
547 memset(sa, 0, sizeof(*sa));
548 sa->rc_family = AF_BLUETOOTH;
549 sa->rc_channel = rfcomm_pi(sk)->channel;
550 if (peer)
551 bacpy(&sa->rc_bdaddr, &rfcomm_pi(sk)->dst);
552 else
553 bacpy(&sa->rc_bdaddr, &rfcomm_pi(sk)->src);
554
555 *len = sizeof(struct sockaddr_rc);
556 return 0;
557 }
558
rfcomm_sock_sendmsg(struct socket * sock,struct msghdr * msg,size_t len)559 static int rfcomm_sock_sendmsg(struct socket *sock, struct msghdr *msg,
560 size_t len)
561 {
562 struct sock *sk = sock->sk;
563 struct rfcomm_dlc *d = rfcomm_pi(sk)->dlc;
564 struct sk_buff *skb;
565 int sent;
566
567 if (test_bit(RFCOMM_DEFER_SETUP, &d->flags))
568 return -ENOTCONN;
569
570 if (msg->msg_flags & MSG_OOB)
571 return -EOPNOTSUPP;
572
573 if (sk->sk_shutdown & SEND_SHUTDOWN)
574 return -EPIPE;
575
576 BT_DBG("sock %p, sk %p", sock, sk);
577
578 lock_sock(sk);
579
580 sent = bt_sock_wait_ready(sk, msg->msg_flags);
581 if (sent)
582 goto done;
583
584 while (len) {
585 size_t size = min_t(size_t, len, d->mtu);
586 int err;
587
588 skb = sock_alloc_send_skb(sk, size + RFCOMM_SKB_RESERVE,
589 msg->msg_flags & MSG_DONTWAIT, &err);
590 if (!skb) {
591 if (sent == 0)
592 sent = err;
593 break;
594 }
595 skb_reserve(skb, RFCOMM_SKB_HEAD_RESERVE);
596
597 err = memcpy_from_msg(skb_put(skb, size), msg, size);
598 if (err) {
599 kfree_skb(skb);
600 if (sent == 0)
601 sent = err;
602 break;
603 }
604
605 skb->priority = sk->sk_priority;
606
607 err = rfcomm_dlc_send(d, skb);
608 if (err < 0) {
609 kfree_skb(skb);
610 if (sent == 0)
611 sent = err;
612 break;
613 }
614
615 sent += size;
616 len -= size;
617 }
618
619 done:
620 release_sock(sk);
621
622 return sent;
623 }
624
rfcomm_sock_recvmsg(struct socket * sock,struct msghdr * msg,size_t size,int flags)625 static int rfcomm_sock_recvmsg(struct socket *sock, struct msghdr *msg,
626 size_t size, int flags)
627 {
628 struct sock *sk = sock->sk;
629 struct rfcomm_dlc *d = rfcomm_pi(sk)->dlc;
630 int len;
631
632 if (test_and_clear_bit(RFCOMM_DEFER_SETUP, &d->flags)) {
633 rfcomm_dlc_accept(d);
634 return 0;
635 }
636
637 len = bt_sock_stream_recvmsg(sock, msg, size, flags);
638
639 lock_sock(sk);
640 if (!(flags & MSG_PEEK) && len > 0)
641 atomic_sub(len, &sk->sk_rmem_alloc);
642
643 if (atomic_read(&sk->sk_rmem_alloc) <= (sk->sk_rcvbuf >> 2))
644 rfcomm_dlc_unthrottle(rfcomm_pi(sk)->dlc);
645 release_sock(sk);
646
647 return len;
648 }
649
rfcomm_sock_setsockopt_old(struct socket * sock,int optname,char __user * optval,unsigned int optlen)650 static int rfcomm_sock_setsockopt_old(struct socket *sock, int optname, char __user *optval, unsigned int optlen)
651 {
652 struct sock *sk = sock->sk;
653 int err = 0;
654 u32 opt;
655
656 BT_DBG("sk %p", sk);
657
658 lock_sock(sk);
659
660 switch (optname) {
661 case RFCOMM_LM:
662 if (get_user(opt, (u32 __user *) optval)) {
663 err = -EFAULT;
664 break;
665 }
666
667 if (opt & RFCOMM_LM_FIPS) {
668 err = -EINVAL;
669 break;
670 }
671
672 if (opt & RFCOMM_LM_AUTH)
673 rfcomm_pi(sk)->sec_level = BT_SECURITY_LOW;
674 if (opt & RFCOMM_LM_ENCRYPT)
675 rfcomm_pi(sk)->sec_level = BT_SECURITY_MEDIUM;
676 if (opt & RFCOMM_LM_SECURE)
677 rfcomm_pi(sk)->sec_level = BT_SECURITY_HIGH;
678
679 rfcomm_pi(sk)->role_switch = (opt & RFCOMM_LM_MASTER);
680 break;
681
682 default:
683 err = -ENOPROTOOPT;
684 break;
685 }
686
687 release_sock(sk);
688 return err;
689 }
690
rfcomm_sock_setsockopt(struct socket * sock,int level,int optname,char __user * optval,unsigned int optlen)691 static int rfcomm_sock_setsockopt(struct socket *sock, int level, int optname, char __user *optval, unsigned int optlen)
692 {
693 struct sock *sk = sock->sk;
694 struct bt_security sec;
695 int err = 0;
696 size_t len;
697 u32 opt;
698
699 BT_DBG("sk %p", sk);
700
701 if (level == SOL_RFCOMM)
702 return rfcomm_sock_setsockopt_old(sock, optname, optval, optlen);
703
704 if (level != SOL_BLUETOOTH)
705 return -ENOPROTOOPT;
706
707 lock_sock(sk);
708
709 switch (optname) {
710 case BT_SECURITY:
711 if (sk->sk_type != SOCK_STREAM) {
712 err = -EINVAL;
713 break;
714 }
715
716 sec.level = BT_SECURITY_LOW;
717
718 len = min_t(unsigned int, sizeof(sec), optlen);
719 if (copy_from_user((char *) &sec, optval, len)) {
720 err = -EFAULT;
721 break;
722 }
723
724 if (sec.level > BT_SECURITY_HIGH) {
725 err = -EINVAL;
726 break;
727 }
728
729 rfcomm_pi(sk)->sec_level = sec.level;
730 break;
731
732 case BT_DEFER_SETUP:
733 if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) {
734 err = -EINVAL;
735 break;
736 }
737
738 if (get_user(opt, (u32 __user *) optval)) {
739 err = -EFAULT;
740 break;
741 }
742
743 if (opt)
744 set_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags);
745 else
746 clear_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags);
747
748 break;
749
750 default:
751 err = -ENOPROTOOPT;
752 break;
753 }
754
755 release_sock(sk);
756 return err;
757 }
758
rfcomm_sock_getsockopt_old(struct socket * sock,int optname,char __user * optval,int __user * optlen)759 static int rfcomm_sock_getsockopt_old(struct socket *sock, int optname, char __user *optval, int __user *optlen)
760 {
761 struct sock *sk = sock->sk;
762 struct sock *l2cap_sk;
763 struct l2cap_conn *conn;
764 struct rfcomm_conninfo cinfo;
765 int len, err = 0;
766 u32 opt;
767
768 BT_DBG("sk %p", sk);
769
770 if (get_user(len, optlen))
771 return -EFAULT;
772
773 lock_sock(sk);
774
775 switch (optname) {
776 case RFCOMM_LM:
777 switch (rfcomm_pi(sk)->sec_level) {
778 case BT_SECURITY_LOW:
779 opt = RFCOMM_LM_AUTH;
780 break;
781 case BT_SECURITY_MEDIUM:
782 opt = RFCOMM_LM_AUTH | RFCOMM_LM_ENCRYPT;
783 break;
784 case BT_SECURITY_HIGH:
785 opt = RFCOMM_LM_AUTH | RFCOMM_LM_ENCRYPT |
786 RFCOMM_LM_SECURE;
787 break;
788 case BT_SECURITY_FIPS:
789 opt = RFCOMM_LM_AUTH | RFCOMM_LM_ENCRYPT |
790 RFCOMM_LM_SECURE | RFCOMM_LM_FIPS;
791 break;
792 default:
793 opt = 0;
794 break;
795 }
796
797 if (rfcomm_pi(sk)->role_switch)
798 opt |= RFCOMM_LM_MASTER;
799
800 if (put_user(opt, (u32 __user *) optval))
801 err = -EFAULT;
802
803 break;
804
805 case RFCOMM_CONNINFO:
806 if (sk->sk_state != BT_CONNECTED &&
807 !rfcomm_pi(sk)->dlc->defer_setup) {
808 err = -ENOTCONN;
809 break;
810 }
811
812 l2cap_sk = rfcomm_pi(sk)->dlc->session->sock->sk;
813 conn = l2cap_pi(l2cap_sk)->chan->conn;
814
815 memset(&cinfo, 0, sizeof(cinfo));
816 cinfo.hci_handle = conn->hcon->handle;
817 memcpy(cinfo.dev_class, conn->hcon->dev_class, 3);
818
819 len = min_t(unsigned int, len, sizeof(cinfo));
820 if (copy_to_user(optval, (char *) &cinfo, len))
821 err = -EFAULT;
822
823 break;
824
825 default:
826 err = -ENOPROTOOPT;
827 break;
828 }
829
830 release_sock(sk);
831 return err;
832 }
833
rfcomm_sock_getsockopt(struct socket * sock,int level,int optname,char __user * optval,int __user * optlen)834 static int rfcomm_sock_getsockopt(struct socket *sock, int level, int optname, char __user *optval, int __user *optlen)
835 {
836 struct sock *sk = sock->sk;
837 struct bt_security sec;
838 int len, err = 0;
839
840 BT_DBG("sk %p", sk);
841
842 if (level == SOL_RFCOMM)
843 return rfcomm_sock_getsockopt_old(sock, optname, optval, optlen);
844
845 if (level != SOL_BLUETOOTH)
846 return -ENOPROTOOPT;
847
848 if (get_user(len, optlen))
849 return -EFAULT;
850
851 lock_sock(sk);
852
853 switch (optname) {
854 case BT_SECURITY:
855 if (sk->sk_type != SOCK_STREAM) {
856 err = -EINVAL;
857 break;
858 }
859
860 sec.level = rfcomm_pi(sk)->sec_level;
861 sec.key_size = 0;
862
863 len = min_t(unsigned int, len, sizeof(sec));
864 if (copy_to_user(optval, (char *) &sec, len))
865 err = -EFAULT;
866
867 break;
868
869 case BT_DEFER_SETUP:
870 if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) {
871 err = -EINVAL;
872 break;
873 }
874
875 if (put_user(test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags),
876 (u32 __user *) optval))
877 err = -EFAULT;
878
879 break;
880
881 default:
882 err = -ENOPROTOOPT;
883 break;
884 }
885
886 release_sock(sk);
887 return err;
888 }
889
rfcomm_sock_ioctl(struct socket * sock,unsigned int cmd,unsigned long arg)890 static int rfcomm_sock_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
891 {
892 struct sock *sk __maybe_unused = sock->sk;
893 int err;
894
895 BT_DBG("sk %p cmd %x arg %lx", sk, cmd, arg);
896
897 err = bt_sock_ioctl(sock, cmd, arg);
898
899 if (err == -ENOIOCTLCMD) {
900 #ifdef CONFIG_BT_RFCOMM_TTY
901 lock_sock(sk);
902 err = rfcomm_dev_ioctl(sk, cmd, (void __user *) arg);
903 release_sock(sk);
904 #else
905 err = -EOPNOTSUPP;
906 #endif
907 }
908
909 return err;
910 }
911
rfcomm_sock_shutdown(struct socket * sock,int how)912 static int rfcomm_sock_shutdown(struct socket *sock, int how)
913 {
914 struct sock *sk = sock->sk;
915 int err = 0;
916
917 BT_DBG("sock %p, sk %p", sock, sk);
918
919 if (!sk)
920 return 0;
921
922 lock_sock(sk);
923 if (!sk->sk_shutdown) {
924 sk->sk_shutdown = SHUTDOWN_MASK;
925 __rfcomm_sock_close(sk);
926
927 if (sock_flag(sk, SOCK_LINGER) && sk->sk_lingertime &&
928 !(current->flags & PF_EXITING))
929 err = bt_sock_wait_state(sk, BT_CLOSED, sk->sk_lingertime);
930 }
931 release_sock(sk);
932 return err;
933 }
934
rfcomm_sock_release(struct socket * sock)935 static int rfcomm_sock_release(struct socket *sock)
936 {
937 struct sock *sk = sock->sk;
938 int err;
939
940 BT_DBG("sock %p, sk %p", sock, sk);
941
942 if (!sk)
943 return 0;
944
945 err = rfcomm_sock_shutdown(sock, 2);
946
947 sock_orphan(sk);
948 rfcomm_sock_kill(sk);
949 return err;
950 }
951
952 /* ---- RFCOMM core layer callbacks ----
953 *
954 * called under rfcomm_lock()
955 */
rfcomm_connect_ind(struct rfcomm_session * s,u8 channel,struct rfcomm_dlc ** d)956 int rfcomm_connect_ind(struct rfcomm_session *s, u8 channel, struct rfcomm_dlc **d)
957 {
958 struct sock *sk, *parent;
959 bdaddr_t src, dst;
960 int result = 0;
961
962 BT_DBG("session %p channel %d", s, channel);
963
964 rfcomm_session_getaddr(s, &src, &dst);
965
966 /* Check if we have socket listening on channel */
967 parent = rfcomm_get_sock_by_channel(BT_LISTEN, channel, &src);
968 if (!parent)
969 return 0;
970
971 bh_lock_sock(parent);
972
973 /* Check for backlog size */
974 if (sk_acceptq_is_full(parent)) {
975 BT_DBG("backlog full %d", parent->sk_ack_backlog);
976 goto done;
977 }
978
979 sk = rfcomm_sock_alloc(sock_net(parent), NULL, BTPROTO_RFCOMM, GFP_ATOMIC, 0);
980 if (!sk)
981 goto done;
982
983 bt_sock_reclassify_lock(sk, BTPROTO_RFCOMM);
984
985 rfcomm_sock_init(sk, parent);
986 bacpy(&rfcomm_pi(sk)->src, &src);
987 bacpy(&rfcomm_pi(sk)->dst, &dst);
988 rfcomm_pi(sk)->channel = channel;
989
990 sk->sk_state = BT_CONFIG;
991 bt_accept_enqueue(parent, sk, true);
992
993 /* Accept connection and return socket DLC */
994 *d = rfcomm_pi(sk)->dlc;
995 result = 1;
996
997 done:
998 bh_unlock_sock(parent);
999
1000 if (test_bit(BT_SK_DEFER_SETUP, &bt_sk(parent)->flags))
1001 parent->sk_state_change(parent);
1002
1003 return result;
1004 }
1005
rfcomm_sock_debugfs_show(struct seq_file * f,void * p)1006 static int rfcomm_sock_debugfs_show(struct seq_file *f, void *p)
1007 {
1008 struct sock *sk;
1009
1010 read_lock(&rfcomm_sk_list.lock);
1011
1012 sk_for_each(sk, &rfcomm_sk_list.head) {
1013 seq_printf(f, "%pMR %pMR %d %d\n",
1014 &rfcomm_pi(sk)->src, &rfcomm_pi(sk)->dst,
1015 sk->sk_state, rfcomm_pi(sk)->channel);
1016 }
1017
1018 read_unlock(&rfcomm_sk_list.lock);
1019
1020 return 0;
1021 }
1022
rfcomm_sock_debugfs_open(struct inode * inode,struct file * file)1023 static int rfcomm_sock_debugfs_open(struct inode *inode, struct file *file)
1024 {
1025 return single_open(file, rfcomm_sock_debugfs_show, inode->i_private);
1026 }
1027
1028 static const struct file_operations rfcomm_sock_debugfs_fops = {
1029 .open = rfcomm_sock_debugfs_open,
1030 .read = seq_read,
1031 .llseek = seq_lseek,
1032 .release = single_release,
1033 };
1034
1035 static struct dentry *rfcomm_sock_debugfs;
1036
1037 static const struct proto_ops rfcomm_sock_ops = {
1038 .family = PF_BLUETOOTH,
1039 .owner = THIS_MODULE,
1040 .release = rfcomm_sock_release,
1041 .bind = rfcomm_sock_bind,
1042 .connect = rfcomm_sock_connect,
1043 .listen = rfcomm_sock_listen,
1044 .accept = rfcomm_sock_accept,
1045 .getname = rfcomm_sock_getname,
1046 .sendmsg = rfcomm_sock_sendmsg,
1047 .recvmsg = rfcomm_sock_recvmsg,
1048 .shutdown = rfcomm_sock_shutdown,
1049 .setsockopt = rfcomm_sock_setsockopt,
1050 .getsockopt = rfcomm_sock_getsockopt,
1051 .ioctl = rfcomm_sock_ioctl,
1052 .poll = bt_sock_poll,
1053 .socketpair = sock_no_socketpair,
1054 .mmap = sock_no_mmap
1055 };
1056
1057 static const struct net_proto_family rfcomm_sock_family_ops = {
1058 .family = PF_BLUETOOTH,
1059 .owner = THIS_MODULE,
1060 .create = rfcomm_sock_create
1061 };
1062
rfcomm_init_sockets(void)1063 int __init rfcomm_init_sockets(void)
1064 {
1065 int err;
1066
1067 BUILD_BUG_ON(sizeof(struct sockaddr_rc) > sizeof(struct sockaddr));
1068
1069 err = proto_register(&rfcomm_proto, 0);
1070 if (err < 0)
1071 return err;
1072
1073 err = bt_sock_register(BTPROTO_RFCOMM, &rfcomm_sock_family_ops);
1074 if (err < 0) {
1075 BT_ERR("RFCOMM socket layer registration failed");
1076 goto error;
1077 }
1078
1079 err = bt_procfs_init(&init_net, "rfcomm", &rfcomm_sk_list, NULL);
1080 if (err < 0) {
1081 BT_ERR("Failed to create RFCOMM proc file");
1082 bt_sock_unregister(BTPROTO_RFCOMM);
1083 goto error;
1084 }
1085
1086 BT_INFO("RFCOMM socket layer initialized");
1087
1088 if (IS_ERR_OR_NULL(bt_debugfs))
1089 return 0;
1090
1091 rfcomm_sock_debugfs = debugfs_create_file("rfcomm", 0444,
1092 bt_debugfs, NULL,
1093 &rfcomm_sock_debugfs_fops);
1094
1095 return 0;
1096
1097 error:
1098 proto_unregister(&rfcomm_proto);
1099 return err;
1100 }
1101
rfcomm_cleanup_sockets(void)1102 void __exit rfcomm_cleanup_sockets(void)
1103 {
1104 bt_procfs_cleanup(&init_net, "rfcomm");
1105
1106 debugfs_remove(rfcomm_sock_debugfs);
1107
1108 bt_sock_unregister(BTPROTO_RFCOMM);
1109
1110 proto_unregister(&rfcomm_proto);
1111 }
1112